diff -ENwbur a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
--- a/arch/arm64/boot/dts/Makefile	2018-05-06 08:47:35.345263577 +0200
+++ b/arch/arm64/boot/dts/Makefile	2018-05-06 08:49:48.242657438 +0200
@@ -14,6 +14,7 @@
 dts-dirs += hisilicon
 dts-dirs += marvell
 dts-dirs += mediatek
+dts-dirs += nexell
 dts-dirs += nvidia
 dts-dirs += qcom
 dts-dirs += realtek
diff -ENwbur a/arch/arm64/boot/dts/nexell/Makefile b/arch/arm64/boot/dts/nexell/Makefile
--- a/arch/arm64/boot/dts/nexell/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/boot/dts/nexell/Makefile	2018-05-06 08:49:48.254657924 +0200
@@ -0,0 +1,5 @@
+dtb-$(CONFIG_ARCH_S5P6818) += s5p6818-nanopi-m3.dtb
+
+always		:= $(dtb-y)
+subdir-y	:= $(dts-dirs)
+clean-files	:= *.dtb
diff -ENwbur a/arch/arm64/boot/dts/nexell/s5p6818-nanopi-m3.dts b/arch/arm64/boot/dts/nexell/s5p6818-nanopi-m3.dts
--- a/arch/arm64/boot/dts/nexell/s5p6818-nanopi-m3.dts	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/boot/dts/nexell/s5p6818-nanopi-m3.dts	2018-05-06 08:49:48.254657924 +0200
@@ -0,0 +1,750 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/dts-v1/;
+#include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/thermal/thermal.h>
+#include "s5p6818.dtsi"
+
+#define PMIC_PDATA_INIT(_id, _rname, _minuv,	\
+			_maxuv, _always_on, _boot_on,		\
+			_init_uv, _init_enable, _slp_slots)	\
+		regulator-name = _rname;		\
+		regulator-min-microvolt = <_minuv>;	\
+		regulator-max-microvolt = <_maxuv>;	\
+		nx,id = <_id>;				\
+		nx,always_on = <_always_on>;		\
+		nx,boot_on = <_boot_on>;		\
+		nx,init_enable = <_init_enable>;	\
+		nx,init_uV = <_init_uv>;		\
+		nx,sleep_slots = <_slp_slots>;
+
+/ {
+	memory {
+		/* Note: Samsung Artik u-boot fixates memory information to values
+		 * specified by CONFIG_SYS_SDRAM_BASE and CONFIG_SYS_SDRAM_SIZE in
+		 * the u-boot configuration. Values specified below are meaningless.
+		 */
+		device_type = "memory";
+		reg = <0x40000000 0x40000000>;
+	};
+
+	aliases {
+		ethernet0 = &gmac0;
+	};
+
+	nx-v4l2 {
+		status = "okay";
+	};
+
+	soc {
+		#include "s5p6818-pinctrl.dtsi"
+
+		clocks {
+			uart0:uart@c00a9000 { clock-frequency = <147500000>; };
+			uart1:uart@c00a8000 { clock-frequency = <147500000>; };
+			uart2:uart@c00aa000 { clock-frequency = <147500000>; };
+			uart3:uart@c00ab000 { clock-frequency = <147500000>; };
+			uart4:uart@c006e000 { clock-frequency = <147500000>; };
+			uart5:uart@c0084000 { clock-frequency = <147500000>; };
+			pwm0:pwm0@c00ba000 { clock-frequency = <100000000>; };
+			i2c0:i2c@c00ae000  { clock-frequency = <200000000>; };
+			i2c1:i2c@c00af000  { clock-frequency = <200000000>; };
+			i2c2:i2c@c00b0000  { clock-frequency = <200000000>; };
+			vip1:vip@c00c2000 { src-force = <4>; };
+		};
+
+		serial0:serial@c00a1000 {
+			status ="okay";
+		};
+
+		serial1:serial@c00a0000 {
+			status ="okay";
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial1_pin &serial1_flow>;
+		};
+
+		amba {
+			pl08xdma0:pl08xdma@c0000000 {
+				use_isr;
+
+				ch12 {
+					slave_wait_flush_dma;
+				};
+
+				ch13 {
+					slave_wait_flush_dma;
+				};
+
+				ch14 {
+					slave_wait_flush_dma;
+				};
+
+				ch15 {
+					slave_wait_flush_dma;
+				};
+			};
+
+			pl08xdma1:pl08xdma@c0001000 {
+				use_isr;
+
+				ch0 {
+					slave_wait_flush_dma;
+				};
+
+				ch1 {
+					slave_wait_flush_dma;
+				};
+			};
+		};
+
+		dw_mmc_0:dw_mmc@c0062000 {			// mappings from kernel 3.x:
+			bus-width = <4>;				// MMC_CAP_4_BIT_DATA
+			cap-sd-highspeed;				// DW_MCI_QUIRK_HIGHSPEED
+			cap-mmc-highspeed;				// also DW_MCI_QUIRK_HIGHSPEED
+			clock-frequency = <100000000>;	// bus_hz: 100 * 1000 * 1000
+			card-detect-delay = <200>;		// detect_delay_ms
+			disable-wp;						// write protect: -> get_ro; feature not available for micro SD
+			cd-gpios = <&alive_0 1 GPIO_ACTIVE_LOW>; // card detect: CFG_SDMMC0_DETECT_IO == PAD_GPIO_ALV + 1
+			nexell,drive_dly = <0x0>;		// DW_MMC_DRIVE_DELAY(0)
+			nexell,drive_shift = <0x02>;	// DW_MMC_DRIVE_PHASE(2)
+			nexell,sample_dly = <0x00>;		// DW_MMC_SAMPLE_DELAY(0)
+			nexell,sample_shift = <0x01>;	// DW_MMC_SAMPLE_PHASE(1)
+			status = "okay";
+		};
+
+		dw_mmc_1:dw_mmc@c0068000 {
+			bus-width = <4>;
+			cap-sd-highspeed;
+			clock-frequency = <100000000>;
+			card-detect-delay = <200>;
+			non-removable;
+            keep-power-in-suspend;
+			nexell,drive_dly = <0x0>;
+			nexell,drive_shift = <0x02>;
+			nexell,sample_dly = <0x00>;
+			nexell,sample_shift = <0x01>;
+			mmc-pwrseq = <&wifi_powerseq>;
+			status = "okay";
+
+			/* wifi definition for brcmfmac.ko module */
+            brcmf: bcrmf@1 {
+                compatible = "brcm,bcm4329-fmac";
+                reg = <1>;
+				interrupt-parent = <&gpio_c>;
+				interrupts = <17 IRQ_TYPE_LEVEL_HIGH>;
+				brcm,powersave-default-off;
+            };
+		};
+
+		dw_mmc_2:dw_mmc@c0069000 {
+			bus-width = <4>;				// MMC_CAP_4_BIT_DATA
+			cap-sd-highspeed;				// DW_MCI_QUIRK_HIGHSPEED
+			cap-mmc-highspeed;				// also DW_MCI_QUIRK_HIGHSPEED
+			sd-uhs-ddr50;					// MMC_CAP_UHS_DDR50
+			cap-mmc-hw-reset;				// MMC_CAP_HW_RESET
+			clock-frequency = <200000000>;	// bus_hz: 200 * 1000 * 1000
+			card-detect-delay = <200>;		// detect_delay_ms
+			non-removable;					// MMC_CAP_NONREMOVABLE
+			broken-cd;
+			cd-gpios = <&gpio_c 24 GPIO_ACTIVE_LOW>; // card detect: CFG_SDMMC2_DETECT_IO == PAD_GPIO_C + 24
+			nexell,drive_dly = <0x0>;		// DW_MMC_DRIVE_DELAY(0)
+			nexell,drive_shift = <0x03>;	// DW_MMC_DRIVE_PHASE(3)
+			nexell,sample_dly = <0x00>;		// DW_MMC_SAMPLE_DELAY(0)
+			nexell,sample_shift = <0x02>;	// DW_MMC_SAMPLE_PHASE(2)
+			status = "okay";
+		};
+
+		/* FIXME: bluetooth reset is piggybacked here although their data flow
+		 * goes through serial1 */
+		wifi_powerseq: wifi_powerseq  {
+			compatible = "mmc-pwrseq-simple";
+			reset-gpios =
+				<&gpio_b 24 GPIO_ACTIVE_LOW		/* wifi */
+				&gpio_b 8 GPIO_ACTIVE_LOW>;		/* bluetooth */
+			post-power-on-delay-ms = <50>;
+		};
+
+		i2c3_gpio:i2c@0 {
+			compatible = "i2c-gpio";
+			gpios = <&gpio_e 31 0	/* sda */
+				&gpio_e 30 0	/* scl */
+				>;
+			i2c-gpio,delay-us = <10>;/* ~100 kHz */
+			i2c-gpio,ch =<3>;
+		};
+
+		i2c3_gpio:i2c@0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			axp228@34 {
+				compatible = "x-powers,axp228";
+				reg = <0x34>;
+				interrupt-parent = <&alive_0>;	// CFG_GPIO_PMIC_INTR
+				interrupts = <0x4 IRQ_TYPE_EDGE_FALLING>;
+				nx,id = <0>;
+				/* vdd_arm-supply = <&VCC1P1_ARM_PMIC>; */
+				/* vdd_core-supply = <&VCC1P0_CORE_PMIC>; */
+				regulators {
+					VCC_LDO1:
+						axp22_rtcldo{PMIC_PDATA_INIT( 0,
+						"axp228_rtcldo",
+						3000000, 3000000, 0, 0, 3300000,
+						0, 0xF) };
+					VCC_LDO2:
+						axp22_aldo1{PMIC_PDATA_INIT( 1,
+						"axp228_3p3_alive",
+						700000, 3300000, 1, 1, 3300000,
+						1, 0xF) };
+					VCC_LDO3:
+						axp22_aldo2{PMIC_PDATA_INIT( 2,
+						"axp228_1p8_alive",
+						700000, 3300000, 1, 1, 1800000,
+						1, 0xF) };
+					VCC_LDO4:
+						axp22_aldo3{PMIC_PDATA_INIT( 3,
+						"axp228_1p0_alive",
+						700000, 3300000, 1, 1, 1000000,
+						1, 0xF) };
+					VCC_LDO5:
+						axp22_dldo1{PMIC_PDATA_INIT( 4,
+						"axp228_wide",
+						700000, 3300000, 1, 1, 3300000,
+						1, 0xF) };
+					VCC_LDO6:
+						axp22_dldo2{PMIC_PDATA_INIT( 5,
+						"axp228_1p8_cam",
+						700000, 3300000, 0, 0, 1800000,
+						0, 0xF) };
+					VCC_LDO7:
+						axp22_dldo3{PMIC_PDATA_INIT( 6,
+						"axp228_dldo3",
+						700000, 3300000, 0, 0,  700000,
+						0, 0xF) };
+					VCC_LDO8:
+						axp22_dldo4{PMIC_PDATA_INIT( 7,
+						"axp228_dldo4",
+						700000, 3300000, 0, 0,  700000,
+						0, 0xF) };
+					VCC_LDO9:
+						axp22_eldo1{PMIC_PDATA_INIT( 8,
+						"axp228_1p8_sys",
+						700000, 3300000, 1, 1, 1800000,
+						1, 0xF) };
+					VCC_LDO10:
+						axp22_eldo2{PMIC_PDATA_INIT( 9,
+						"axp228_3p3_wifi",
+						700000, 3300000, 1, 1, 3300000,
+						1, 0xF) };
+					VCC_LDO11:
+						axp22_eldo3{PMIC_PDATA_INIT(10,
+						"axp228_eldo3",
+						700000, 3300000, 0, 0,  700000,
+						0, 0xF) };
+					VCC_LDO12:
+						axp22_dc5ldo{PMIC_PDATA_INIT(11,
+						"axp228_1p2_cvbs",
+						700000, 1400000, 0, 0, 1200000,
+						0, 0xF) };
+					VCC_DCDC1:
+						axp22_dcdc1{PMIC_PDATA_INIT(12,
+						"axp228_3p3_sys",
+						1600000, 3400000, 1, 1, 3300000,
+						1, 0xF) };
+					VCC1P1_ARM_PMIC:
+						axp22_dcdc2{PMIC_PDATA_INIT(13,
+						"axp228_1p1_arm",
+						600000, 1540000, 1, 1, 1200000,
+						1, 0xF) };
+					VCC1P0_CORE_PMIC:
+						axp22_dcdc3{PMIC_PDATA_INIT(14,
+						"axp228_1p0_core",
+						600000, 1860000, 1, 1, 1200000,
+						1, 0xF) };
+					VCC_DCDC4:
+						axp22_dcdc4{PMIC_PDATA_INIT(15,
+						"axp228_1p5_sys",
+						600000, 1540000, 1, 1, 1500000,
+						1, 0xF) };
+					VCC_DCDC5:
+						axp22_dcdc5{PMIC_PDATA_INIT(16,
+						"axp228_1p5_ddr",
+						1000000, 2550000, 1, 1, 1500000,
+						1, 0xF) };
+					VCC_LDOIO0:
+						axp22_ldoio0{PMIC_PDATA_INIT(17,
+						"axp228_ldoio0",
+						700000, 3300000, 0, 0, 1800000,
+						0, 0xF) };
+					VCC_LDOIO1:
+						axp22_ldoio1{PMIC_PDATA_INIT(18,
+						"axp228_ldoio1",
+						700000, 3300000, 0, 0, 1000000,
+						0, 0xF) };
+				};
+			};
+		};
+
+		pinctrl@C0010000 {
+			touchpanel_irq: touchpanel-irq {
+				nexell,pins = "gpioc-16";
+				nexell,pin-function = <1>;
+				nexell,pin-pull = <2>;
+				nexell,pin-strength = <0>;
+			};
+		};
+
+		nexell_usbphy: nexell-usbphy@c0012000 {
+			status = "okay";
+		};
+
+		ehci@c0030000 {
+			status = "okay";
+			port@0 {
+				status = "okay";
+			};
+		};
+
+		ohci@c0020000 {
+			status = "okay";
+			port@0 {
+				status = "okay";
+			};
+		};
+
+		dwc2otg@c0040000 {
+			gpios = <&gpio_d 21 0>;
+			status = "okay";
+		};
+
+		gmac0:ethernet@c0060000 {
+			pinctrl-names = "default";
+			pinctrl-0 = <&gmac_pins>;
+
+			status = "okay";
+			#address-cells = <0x1>;
+			#size-cells = <0x0>;
+
+			snps,phy-addr = <7>;
+			snps,reset-gpio = <&gpio_e 22 0>;
+			snps,reset-active-low;
+			snps,reset-delays-us = <0 10000 30000>;
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				ethernet_phy: ethernet-phy@3 {
+					reg = <3>;
+					fixed-link {
+						speed = <1000>;
+						full-duplex;
+					};
+				};
+			};
+		};
+
+		i2c_0:i2c@c00a4000 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			es8316_codec: es8316@11 {
+				#sound-dai-cells = <0>;
+				compatible = "everest,es8316";
+				reg = <0x11>;
+			};
+		};
+
+		i2c_1:i2c@c00a5000 {
+			status = "okay";
+		};
+
+		i2c_2:i2c@c00a6000 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "okay";
+
+			/* Note: touch sensors are registered by onewire */
+			/*touchscreen@38 {
+				compatible = "edt,edt-ft5506";
+				reg = <0x38>;
+				interrupt-parent = <&gpio_c>;
+				interrupts = <16 IRQ_TYPE_EDGE_FALLING>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&touchpanel_irq>;
+				touchscreen-size-x = <1280>;
+				touchscreen-size-y = <800>;
+				touchscreen-max-pressure = <255>;
+			};*/
+
+			/*touchscreen@46 {
+				compatible = "ite,it7260";
+				reg = <0x46>;
+				interrupt-parent = <&gpio_c>;
+				interrupts = <16 IRQ_TYPE_LEVEL_LOW>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&touchpanel_irq>;
+			};*/
+		};
+
+		pwm:pwm@c0018000 {
+			// block pwm3_pin - conflicts with spi0_miso (on spi0_bus) drawn on 2.54mm header
+			pinctrl-0 = <&pwm0_pin &pwm1_pin &pwm2_pin>;
+			samsung,pwm-outputs = <0>, <1>, <2>;
+			status = "okay";
+		};
+
+		vip_1:vip@c0064000 {
+			status = "okay";
+		};
+
+		clipper_1:clipper1@c0064000 {
+			status = "okay";
+			pwms = <&pwm 1 41 0>; /* 1000000000/41 */
+			interface_type = <NX_CAPTURE_INTERFACE_PARALLEL>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&vid1_data_clk &vid1_sync> ;
+			port = <0>;
+			external_sync = <0>;
+			data_order = <NX_VIN_Y0CBY1CR>;
+			interlace = <0>;
+			regulator_names = "axp22_dldo2";
+			regulator_voltages = <1800000>;
+
+			gpios = <&gpio_c 4 0
+				 &gpio_c 5 0
+			         &gpio_c 6 0>;
+
+			sensor {
+				type = <NX_CAPTURE_SENSOR_I2C>;
+				i2c_name = "SP2518";
+				i2c_adapter = <0>;
+				addr = <0x30>;
+			};
+
+			power {
+				enable_seq = <
+				NX_ACTION_START NX_ACTION_TYPE_GPIO 2 1 0 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_PMIC 0 0 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_PMIC 1 0 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_GPIO 0 0 0 1 0 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_CLOCK 1 10 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_GPIO 0 0 0 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_GPIO 1 1 0 0 1 NX_ACTION_END
+				NX_ACTION_START NX_ACTION_TYPE_GPIO 1 1 100 NX_ACTION_END
+				>;
+			};
+		};
+
+		dp_drm: display_drm {
+            status = "okay";
+            ports {
+                port@0 {
+                    reg = <0>;
+                    back_color = < 0x0 >;
+                    color_key = < 0x0 >;
+					/* Port 0 has two RGB planes and one video plane. These planes
+					 * are arranged in z-order: RGB plane 0 is below plane 1,
+					 * video plane may be set at any position in z-order.
+					 *
+					 * Possible names for RGB planes: "primary", "rgb", "cursor"
+					 * Possible name for video plane: "video"
+					 * Two RGB plane names and one video plane name may be specified in
+					 * "plane-names" property.
+					 * RGB plane "primary" will be used as root window.
+					 * RGB plane "cursor" will be used for cursor.
+					 * RGB plane "rgb" and video plane are overlay planes, normally
+					 * not used by X-windows.
+					 *
+					 * Order of plane names specifies z-order of planes, top to bottom.
+					 */
+                    plane-names = "cursor", "video", "primary";
+                };
+                port@1 {
+                    reg = <1>;
+                    back_color = < 0x0 >;
+                    color_key = < 0x0 >;
+					/* Port 1 has one RGB plane and one video plane only. */
+                    plane-names = "video", "primary";
+                };
+            };
+        };
+
+        dp_drm_hdmi: display_drm_hdmi {
+            ddc-i2c-bus = <&i2c_1>;
+            q_range = <1>;
+            status = "ok";
+        };
+
+        dp_drm_rgb: display_drm_rgb {
+            remote-endpoint = <&rgb_panel>;
+            status = "okay";
+
+            dp_control {
+                clk_src_lv0 = <0>;
+                clk_div_lv0 = <16>;
+                clk_src_lv1 = <7>;
+                clk_div_lv1 = <1>;
+                out_format = <3>;
+                invert_field = <0>;
+                swap_rb = <0>;
+                yc_order = <0>;
+                delay_mask = < ((1<<0) | (1<<1) | (1<<2) | (1<<3)) >;
+                d_rgb_pvd = <0>;
+                d_hsync_cp1 = <0>;
+                d_vsync_fram = <0>;
+                d_de_cp2 = <7>;
+                vs_start_offset = <863>;
+                ev_start_offset = <863>;
+                vs_end_offset = <0>;
+                ev_end_offset = <0>;
+            };
+        };
+
+        dp_drm_lvds: display_drm_lvds {
+			status = "ok";
+			remote-endpoint = <&lvds_panel>;
+			dp_control {
+				clk_src_lv0 = <0>;
+				clk_div_lv0 = <16>;
+				clk_src_lv1 = <7>;
+				clk_div_lv1 = <1>;
+				out_format = <3>;
+			};
+		};
+
+		rtc@c0010c00 {
+            status = "okay";
+		};
+
+		tmuctrl_0: tmuctrl@c0096000 {
+			status = "okay";
+		};
+
+		i2s_0:i2s@c0055000 {
+			#sound-dai-cells = <1>;
+			sample-rate = <48000>;
+			frame-bit = <32>;
+			status = "okay";
+		};
+
+		spdif_tx: spdiftx@c0059000 {
+			#sound-dai-cells = <1>;
+			status = "okay";
+		};
+
+		adc:adc@c0053000 {
+			status = "okay";
+		};
+
+		video-codec@c0080000 {
+			status = "okay";
+			sram = <0 0>;
+		};
+
+		scaler@c0066000 {
+			status = "okay";
+		};
+
+		nano-videodev {
+			compatible = "nexell,nano-videodev";
+			reg = <0xc0102000 0x100>;
+			reg-names = "mlc.0";
+			status = "okay";
+		};
+	};	/*** soc ***/
+
+	panel_lvds {
+		compatible = "nanopi,nano-panel";
+		lvds;
+		status = "okay";
+
+		port {
+			lvds_panel: endpoint {
+			};
+		};
+	};
+
+	panel_rgb {
+		compatible = "nanopi,nano-panel";
+		status = "okay";
+
+		pinctrl-names = "default";
+		pinctrl-0 = <&dp_rgb_vclk &dp_rgb_vsync &dp_rgb_hsync
+			&dp_rgb_de &dp_rgb_R &dp_rgb_G &dp_rgb_B>;
+
+		port {
+			rgb_panel: endpoint {
+			};
+		};
+	};
+
+	spdif_out: spdif-out {
+		#sound-dai-cells = <0>;
+		compatible = "linux,spdif-dit";
+		status = "okay";
+	};
+
+	/* Audio jack output configured to use with Nexell driver. Not used.
+	 */
+	es8316_sound: es8316@i2s0 {
+		compatible = "nexell,nexell-es8316";
+		ch = <0>;
+		sample-rate = <48000>;
+		format = "S16";
+		hpin-support = <0>;
+		hpin-gpio = <&gpio_b 27 0>;
+		hpin-level = <1>;
+		status = "disabled";
+	};
+
+	/* HDMI output configured to use with Nexell driver. Not used also.
+	 *
+	 * Note that es8316_sound and spdif_sound cannot be enabled together
+	 * because of nexell-pcm device used by both.
+	 */
+	spdif_sound {
+		compatible = "nexell,spdif-transceiver";
+		sample_rate = <48000>;
+		format = "S16";
+		status = "disabled";
+	};
+
+	jack_sound {
+		compatible = "simple-audio-card";
+		simple-audio-card,mclk-fs = <256>;
+		simple-audio-card,name = "Jack";
+		simple-audio-card,widgets =
+			"Headphone", "Headphones",
+			"Microphone", "Microphone";
+		simple-audio-card,routing =
+			"Headphones", "HPOL",
+			"Headphones", "HPOR",
+			"MIC1", "Microphone";
+		status = "okay";
+
+		simple-audio-card,dai-link@0 {
+		    format = "i2s";
+			cpu {
+				sound-dai = <&i2s_0 0>;
+		    };
+
+		    codec {
+				sound-dai = <&es8316_codec>;
+		    };
+		};
+	};
+
+	hdmi_sound {
+		compatible = "simple-audio-card";
+		simple-audio-card,mclk-fs = <256>;
+		simple-audio-card,name = "HDMI";
+		simple-audio-card,widgets =
+			"Headphone", "TV Out";
+		simple-audio-card,routing =
+			"TV Out", "spdif-out";
+		status = "okay";
+
+		simple-audio-card,dai-link@0 {
+		    cpu {
+				sound-dai = <&spdif_tx 0>;
+		    };
+
+		    codec {
+				sound-dai = <&spdif_out>;
+		    };
+		};
+	};
+
+	thermal-zones {
+		cpu_thermal: cpu-thermal {
+			polling-delay-passive = <100>;	/* milliseconds */
+			polling-delay = <1000>;			/* milliseconds */
+
+			thermal-sensors = <&tmuctrl_0>;
+
+			trips {
+				cpu_alert0: cpu-alert0 {
+					temperature = <85000>;	/* millicelsius */
+					hysteresis = <2000>;	/* millicelsius */
+					type = "passive";
+				};
+				cpu_crit: cpu-crit {
+					temperature = <100000>;	/* millicelsius */
+					hysteresis = <2000>;	/* millicelsius */
+					type = "critical";
+				};
+			};
+
+			cooling-maps {
+				map0 {
+					trip = <&cpu_alert0>;
+					cooling-device =
+						<&cpu0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
+				};
+			};
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		blue {
+			label = "blue";
+			gpios = <&gpio_b 12 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "mmc1";
+		};
+	};
+
+	wifi_bcm4329 { /* wifi definition for bcmdhd.ko module */
+		compatible = "nanopi,bcm4329";
+		interrupt-parent = <&gpio_c>;
+		interrupts = <17 IRQ_TYPE_LEVEL_HIGH>;
+	};
+
+	nanopi-thermistor {
+		compatible = "friendlyarm,nanopi-thermistor";
+		status = "okay";
+
+		io-channels = <&adc 2>;
+		io-channel-names = "nanopi-thermistor";
+	};
+
+	nanopi-onewire {
+		interrupt-parent = <&gic>;
+		compatible = "friendlyarm,onewire";
+
+		channel-gpio = <&gpio_c 15 0>;
+		reg = <PHYS_BASE_TIMER 0x1000>;
+		interrupts = <0 IRQ_TIMER3 0>;
+		irq-timer = <3>;
+	};
+
+	onewire-touch {
+		compatible = "friendlyarm,onewire-touch";
+		interrupt-parent = <&gpio_c>;
+		interrupts = <16 IRQ_TYPE_NONE>;
+		i2c-bus = <&i2c_2>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&touchpanel_irq>;
+	};
+};
+
diff -ENwbur a/arch/arm64/boot/dts/nexell/s5p6818.dtsi b/arch/arm64/boot/dts/nexell/s5p6818.dtsi
--- a/arch/arm64/boot/dts/nexell/s5p6818.dtsi	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/boot/dts/nexell/s5p6818.dtsi	2018-05-06 08:49:48.254657924 +0200
@@ -0,0 +1,959 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dt-bindings/tieoff/s5p6818-tieoff.h>
+#include <dt-bindings/soc/s5p6818-base.h>
+#include <dt-bindings/reset/nexell,s5p6818-reset.h>
+#include <dt-bindings/interrupt-controller/s5p6818-irq.h>
+#include <dt-bindings/media/nexell-vip.h>
+
+/ {
+	model = "nexell soc";
+	compatible = "nexell,s5p6818";
+	#address-cells = <0x1>;
+	#size-cells = <0x1>;
+
+	aliases {
+		serial0 = &serial0;
+		serial1 = &serial1;
+		serial2 = &serial2;
+		serial3 = &serial3;
+		serial4 = &serial4;
+		serial5 = &serial5;
+		i2s0	= &i2s_0;
+		i2s1	= &i2s_1;
+		i2s2	= &i2s_2;
+		spi0	= &spi_0;
+		spi1	= &spi_1;
+		spi2	= &spi_2;
+		i2c0	= &i2c_0;
+		i2c1	= &i2c_1;
+		i2c2	= &i2c_2;
+
+		pinctrl0 = &pinctrl_0;
+	};
+
+	psci {
+		compatible = "arm,psci-0.2";
+		method = "smc";
+	};
+
+	cpus {
+		#address-cells = <0x2>;
+		#size-cells = <0x0>;
+
+		cpu0: cpu@0 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x0>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			#cooling-cells = <2>;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu1: cpu@1 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x1>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu2: cpu@2 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x2>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu3: cpu@3 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x3>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu4: cpu@4 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x100>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu5: cpu@5 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x101>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu6: cpu@6 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x102>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu7: cpu@7 {
+			device_type = "cpu";
+			compatible = "arm,cortex-a53";
+			reg = <0x0 0x103>;
+			enable-method = "psci";
+			cpu-release-addr = < 0x1 0xc0010230 >;
+			cpu-idle-states =<&CPU_SLEEP>;
+		};
+
+		cpu-map {
+			cluster0 {
+				core0 {
+					cpu = <&cpu0>;
+				};
+				core1 {
+					cpu = <&cpu1>;
+				};
+				core2 {
+					cpu = <&cpu2>;
+				};
+				core3 {
+					cpu = <&cpu3>;
+				};
+			};
+			cluster1 {
+				core0 {
+					cpu = <&cpu4>;
+				};
+				core1 {
+					cpu = <&cpu5>;
+				};
+				core2 {
+					cpu = <&cpu6>;
+				};
+				core3 {
+					cpu = <&cpu7>;
+				};
+			};
+		};
+
+		idle-states {
+			CPU_SLEEP: sleep {
+				compatible = "nexell,idle-state";
+				arm,psci-suspend-param = <0x0000000>;
+				entry-latency-us = <150>;
+				exit-latency-us = <200>;
+				min-residency-us = <2000>;
+			};
+		};
+	};
+
+	pmu {
+		compatible = "arm,armv8-pmuv3";
+		interrupt-parent = <&gic>;
+		interrupts = <0 IRQ_P0_PMUIRQ0 0>,
+			     <0 IRQ_P0_PMUIRQ1 0>,
+			     <0 IRQ_P0_PMUIRQ2 0>,
+			     <0 IRQ_P0_PMUIRQ3 0>,
+			     <0 IRQ_P1_PMUIRQ0 0>,
+			     <0 IRQ_P1_PMUIRQ1 0>,
+			     <0 IRQ_P1_PMUIRQ2 0>,
+			     <0 IRQ_P1_PMUIRQ3 0>;
+		interrupt-affinity = <&cpu0>,
+				     <&cpu1>,
+				     <&cpu2>,
+				     <&cpu3>,
+				     <&cpu4>,
+				     <&cpu5>,
+				     <&cpu6>,
+				     <&cpu7>;
+	};
+
+	refclk:oscillator {
+		compatible = "nexell,s5pxx18,pll";
+		reg = <0xc0010000 0x1000>;
+		ref-freuecny = <24000000>;
+	};
+
+	nx-v4l2 {
+		compatible = "nexell,nx-v4l2";
+		status = "disabled";
+	};
+
+	nx-devfreq {
+		compatible = "nexell,s5pxx18-devfreq";
+		pll = <0>;
+		supply_name = "vdd_arm_regulator";
+		vdd_arm_regulator-supply = <&VCC_DCDC1>;
+		status = "disabled";
+	};
+
+	soc {
+		compatible = "simple-bus";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0xc0000000 0x300000>;
+		interrupt-parent = <&gic>;
+		ranges;
+
+		#include "s5p6818-soc.dtsi"
+
+		gic:interrupt-controller@c0009000 {
+			compatible = "arm,gic-400";
+			interrupt-controller;
+			#interrupt-cells = <3>;
+			reg	= <0xC0009000 0x1000>, <0xC000a000 0x100>;
+		};
+
+		timer@c0017000 {
+			compatible = "nexell,s5p6818-timer";
+			reg = <PHYS_BASE_TIMER 0x1000>;
+			interrupts = <0 IRQ_TIMER1 0>;
+			clksource = <0>;
+			clkevent = <1>;
+			clocks =  <&timer0>, <&timer1>, <&pclk>;
+			clock-names = "timer0", "timer1", "pclk";
+		};
+
+		tieoff@c0011000 {
+			compatible = "nexell,tieoff";
+			reg = <PHYS_BASE_TIEOFF 0x1000>;
+		};
+
+		dynamic-freq@bb000 {
+			compatible = "nexell,s5pxx18-cpufreq";
+			reg = <0xc00bb000 0x30000>;
+		};
+
+		serial0:serial@c00a1000 {
+			compatible = "nexell,s5p6818-uart";
+			reg = <PHYS_BASE_UART0 0x1000>;
+			interrupts = <0 IRQ_UART0  0>;
+			clock-names = "uart", "clk_uart_baud0";
+			clocks = <&uart0>, <&uart0>;
+			resets  = <&nexell_reset RESET_ID_UART0>;
+			reset-names = "uart-reset";
+			soc,tieoff = <NX_TIEOFF_UART0_USESMC 0>,
+					<NX_TIEOFF_UART0_SMCTXENB 0>,
+					<NX_TIEOFF_UART0_SMCRXENB 0> ;
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial0_pin>;
+			status = "disabled";
+		};
+
+		serial1:serial@c00a0000 {
+			compatible = "nexell,s5p6818-uart";
+			reg = <PHYS_BASE_UART1 0x1000>;
+			interrupts = <0 IRQ_UART1  0>;
+			clock-names = "uart", "clk_uart_baud0";
+			clocks = <&uart1>, <&uart1>;
+			resets  = <&nexell_reset RESET_ID_UART1>;
+			reset-names = "uart-reset";
+			soc,tieoff = <NX_TIEOFF_UART1_USESMC 0>,
+					<NX_TIEOFF_UART1_SMCTXENB 0>,
+					<NX_TIEOFF_UART1_SMCRXENB 0> ;
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial1_pin>;
+			status = "disabled";
+		};
+
+		serial2:serial@c00a2000 {
+			compatible = "nexell,s5p6818-uart";
+			reg = <PHYS_BASE_UART2 0x1000>;
+			interrupts = <0 IRQ_UART2  0>;
+			clock-names = "uart", "clk_uart_baud0";
+			clocks = <&uart2>, <&uart2>;
+			resets  = <&nexell_reset RESET_ID_UART2>;
+			reset-names = "uart-reset";
+			soc,tieoff = <NX_TIEOFF_UART2_USESMC 0>,
+					<NX_TIEOFF_UART2_SMCTXENB 0>,
+					<NX_TIEOFF_UART2_SMCRXENB 0> ;
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial2_pin>;
+			status = "disabled";
+		};
+
+		serial3:serial@c00a3000 {
+			compatible = "nexell,s5p6818-uart";
+			reg = <PHYS_BASE_UART3 0x1000>;
+			interrupts = <0 IRQ_UART3  0>;
+			clock-names = "uart", "clk_uart_baud0";
+			clocks = <&uart3>, <&uart3>;
+			resets  = <&nexell_reset RESET_ID_UART3>;
+			reset-names = "uart-reset";
+			soc,tieoff = <NX_TIEOFF_UART3_USESMC 0>,
+					<NX_TIEOFF_UART3_SMCTXENB 0>,
+					<NX_TIEOFF_UART3_SMCRXENB 0> ;
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial3_pin>;
+			status = "disabled";
+		};
+
+		serial4:serial@c006d000 {
+			compatible = "nexell,s5p6818-uart";
+			reg = <PHYS_BASE_UART4 0x1000>;
+			interrupts = <0 IRQ_UART4  0>;
+			clock-names = "uart", "clk_uart_baud0";
+			clocks = <&uart4>, <&uart4>;
+			resets  = <&nexell_reset RESET_ID_UART4>;
+			reset-names = "uart-reset";
+			soc,tieoff = <NX_TIEOFF_UART4_USESMC 0>,
+					<NX_TIEOFF_UART4_SMCTXENB 0>,
+					<NX_TIEOFF_UART4_SMCRXENB 0> ;
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial4_pin>;
+			status = "disabled";
+		};
+
+		serial5:serial@c006f000 {
+			compatible = "nexell,s5p6818-uart";
+			reg = <PHYS_BASE_UART5 0x1000>;
+			interrupts = <0 IRQ_UART5  0>;
+			clock-names = "uart", "clk_uart_baud0";
+			clocks = <&uart5>, <&uart5>;
+			resets  = <&nexell_reset RESET_ID_UART5>;
+			reset-names = "uart-reset";
+			soc,tieoff = <NX_TIEOFF_UART5_USESMC 0>,
+					<NX_TIEOFF_UART5_SMCTXENB 0>,
+					<NX_TIEOFF_UART5_SMCRXENB 0> ;
+			pinctrl-names = "default";
+			pinctrl-0 = <&serial5_pin>;
+			status = "disabled";
+		};
+
+		nexell_reset:reset@c0012000 {
+			#reset-cells = <1>;
+			compatible = "nexell,s5pxx18-reset";
+			reg = <0xC0012000 0x3>;
+			status = "okay";
+		};
+
+		pwm:pwm@c0018000 {
+			compatible = "nexell,s5p6818-pwm";
+			reg = <PHYS_BASE_PWM 0x1000>;
+			reset-names = "pwm-reset";
+			resets  = <&nexell_reset RESET_ID_PWM>;
+			clock-names = "timers", "pwm-tclk0", "pwm-tclk1";
+			clocks =  <&pclk>, <&pwm0>, <&pwm2>;
+			#pwm-cells = <3>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&pwm0_pin &pwm1_pin &pwm2_pin &pwm3_pin>;
+			samsung,pwm-outputs = <0>, <1>, <2>, <3>;
+			status = "disabled";
+		};
+
+		i2c_0:i2c@c00a4000 {
+			compatible = "nexell,s5p6818-i2c";
+			reg = <PHYS_BASE_I2C0 0x100>;
+			interrupts = <0 IRQ_I2C0 0>;
+			clock-names = "i2c";
+			clocks = <&i2c0>;
+			samsung,i2c-sda-delay = <100>;
+			samsung,i2c-max-bus-freq = <100000>;
+			samsung,i2c-slave-addr = <0x66>;
+			resets  = <&nexell_reset RESET_ID_I2C0>;
+			reset-names = "i2c-reset";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c0_pin>;
+			status = "disabled";
+		};
+
+		i2c_1:i2c@c00a5000 {
+			compatible = "nexell,s5p6818-i2c";
+			reg = <PHYS_BASE_I2C1 0x100>;
+			interrupts = <0 IRQ_I2C1 0>;
+			clock-names = "i2c";
+			clocks = <&i2c1>;
+			samsung,i2c-sda-delay = <100>;
+			samsung,i2c-max-bus-freq = <100000>;
+			samsung,i2c-slave-addr = <0x66>;
+			resets  = <&nexell_reset RESET_ID_I2C1>;
+			reset-names = "i2c-reset";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c1_pin>;
+			status = "disabled";
+		};
+
+		i2c_2:i2c@c00a6000 {
+			compatible = "nexell,s5p6818-i2c";
+			reg = <PHYS_BASE_I2C2 0x100>;
+			interrupts = <0 IRQ_I2C2 0>;
+			clock-names = "i2c";
+			clocks = <&i2c2>;
+			samsung,i2c-sda-delay = <100>;
+			samsung,i2c-max-bus-freq = <100000>;
+			samsung,i2c-slave-addr = <0x66>;
+			resets  = <&nexell_reset RESET_ID_I2C2>;
+			reset-names = "i2c-reset";
+			pinctrl-names = "default";
+			pinctrl-0 = <&i2c2_pin>;
+			status = "disabled";
+		};
+
+		dw_mmc_2:dw_mmc@c0069000 {
+			compatible = "nexell,s5p6818-dw-mshc";
+			interrupts = <0 IRQ_SDMMC2 0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <PHYS_BASE_SDMMC2 0x1000>;
+			resets  = <&nexell_reset RESET_ID_SDMMC2>;
+			reset-names = "dw_mmc-reset";
+			clock-names = "biu","ciu";
+			clocks = <&sdhc2>, <&sdhc2>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdmmc2_cclk &sdmmc2_cmd &sdmmc2_bus4>;
+			fifo-depth = <0x20>;
+			status = "disabled";
+		};
+
+		dw_mmc_1:dw_mmc@c0068000 {
+			compatible = "nexell,s5p6818-dw-mshc";
+			interrupts = <0 IRQ_SDMMC1 0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <PHYS_BASE_SDMMC1 0x1000>;
+			resets  = <&nexell_reset RESET_ID_SDMMC1>;
+			reset-names = "dw_mmc-reset";
+			clock-names = "biu","ciu";
+			clocks = <&sdhc1>, <&sdhc1>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdmmc1_cclk &sdmmc1_cmd &sdmmc1_bus4>;
+			fifo-depth = <0x20>;
+			status = "disabled";
+		};
+
+		dw_mmc_0:dw_mmc@c0062000 {
+			compatible = "nexell,s5p6818-dw-mshc";
+			interrupts = <0 IRQ_SDMMC0 0>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <PHYS_BASE_SDMMC0 0x1000>;
+			resets  = <&nexell_reset RESET_ID_SDMMC0>;
+			reset-names = "dw_mmc-reset";
+			clock-names = "biu", "ciu";
+			clocks = <&sdhc0>, <&sdhc0>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdmmc0_cclk &sdmmc0_cmd &sdmmc0_bus4>;
+			fifo-depth = <0x20>;
+			status = "disabled";
+		};
+
+		i2s_0:i2s@c0055000 {
+			  compatible = "nexell,nexell-i2s";
+			  reg = <PHYS_BASE_I2S0 0x1000>;
+			  dmas = <&pl08xdma0 12 0>, <&pl08xdma0 13 0>;
+			  dma-names = "tx", "rx";
+			  clocks = <&i2s0>;
+			  clock-names = "i2s0";
+			  resets = <&nexell_reset RESET_ID_I2S0>;
+			  reset-names = "i2s-reset";
+			  pinctrl-names = "default";
+			  pinctrl-0 = <&i2s0_bus>;
+			  master-mode = <1>;
+			  mclk-in = <0>;
+			  trans-mode = <0>;
+			  frame-bit = <32>;
+			  sample-rate = <48000>;
+			  pre-supply-mclk = <1>;
+			  status = "disabled";
+		};
+
+		i2s_1:i2s@c0056000 {
+			  compatible = "nexell,nexell-i2s";
+			  reg = <PHYS_BASE_I2S1 0x1000>;
+			  dmas = <&pl08xdma0 14 0>, <&pl08xdma0 15 0>;
+			  dma-names = "tx", "rx";
+			  clocks = <&i2s1>;
+			  clock-names = "i2s1";
+			  resets = <&nexell_reset RESET_ID_I2S1>;
+			  reset-names = "i2s-reset";
+			  pinctrl-names = "default";
+			  pinctrl-0 = <&i2s1_bus>;
+			  master-mode = <1>;
+			  mclk-in = <0>;
+			  trans-mode = <0>;
+			  frame-bit = <32>;
+			  sample-rate = <48000>;
+			  pre-supply-mclk = <1>;
+			  status = "disabled";
+		};
+
+		i2s_2:i2s@c0057000 {
+			  compatible = "nexell,nexell-i2s";
+			  reg = <PHYS_BASE_I2S2 0x1000>;
+			  dmas = <&pl08xdma1 0 0>, <&pl08xdma1 1 0>;
+			  dma-names = "tx", "rx";
+			  clocks = <&i2s2>;
+			  clock-names = "i2s2";
+			  resets = <&nexell_reset RESET_ID_I2S2>;
+			  reset-names = "i2s-reset";
+			  pinctrl-names = "default";
+			  pinctrl-0 = <&i2s2_bus>;
+			  master-mode = <1>;
+			  mclk-in = <0>;
+			  trans-mode = <0>;
+			  frame-bit = <32>;
+			  sample-rate = <48000>;
+			  pre-supply-mclk = <1>;
+			  status = "disabled";
+		};
+
+		nexell_usbphy: nexell-usbphy@c0012000 {
+			compatible = "nexell,nexell-usb2-phy";
+			reg = <PHYS_BASE_TIEOFF 0x100>;
+			clocks = <&usbhost>;
+			clock-names = "phy";
+			#phy-cells = <1>;
+			status = "disabled";
+		};
+
+		ehci@c0030000 {
+			compatible = "nexell,nexell-ehci";
+			reg = <PHYS_BASE_EHCI 0x10000>;
+			interrupts = <0 IRQ_USB20HOST 0>;
+			clocks = <&usbhost>;
+			clock-names = "usbhost";
+			resets = <&nexell_reset RESET_ID_USB20HOST>;
+			reset-names = "usbhost-reset";
+			status = "disabled";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				phys = <&nexell_usbphy 1>;
+				status = "disabled";
+			};
+			port@1 {
+				reg = <1>;
+				phys = <&nexell_usbphy 2>;
+				status = "disabled";
+			};
+		};
+
+		ohci@c0020000 {
+			compatible = "nexell,nexell-ohci";
+			reg = <PHYS_BASE_OHCI 0x10000>;
+			interrupts = <0 IRQ_USB20HOST 0>;
+			clocks = <&usbhost>;
+			clock-names = "usbhost";
+			resets = <&nexell_reset RESET_ID_USB20HOST>;
+			reset-names = "usbhost-reset";
+			status = "disabled";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			port@0 {
+				reg = <0>;
+				phys = <&nexell_usbphy 1>;
+				status = "disabled";
+			};
+		};
+
+		dwc2otg@c0040000 {
+			compatible = "nexell,nexell-dwc2otg";
+			reg = <PHYS_BASE_HSOTG 0x11000>;
+			interrupts = <0 IRQ_USB20OTG 0>;
+			clocks = <&otg>;
+			clock-names = "otg";
+			resets = <&nexell_reset RESET_ID_USB20OTG>;
+			reset-names = "usbotg-reset";
+			phys = <&nexell_usbphy 0>;
+			phy-names = "usb2-phy";
+			dr_mode = "otg";
+			g-use-dma = <1>;
+			g-rx-fifo-size = <1064>;
+			g-np-tx-fifo-size = <512>;
+			g-tx-fifo-size = <512 512 512 512 512 256 256 256 256
+			    256 64 64 64 64 64>;
+			status = "disabled";
+		};
+
+		gmac0:ethernet@c0060000 {
+			compatible = "nexell,s5p6818-gmac";
+			clocks = <&pclk>, <&gmac>;
+			clock-names = "stmmaceth", "nexell_gmac_tx";
+			resets = <&nexell_reset RESET_ID_DWC_GMAC>;
+			reset-names = "stmmaceth";
+			reg = <PHYS_BASE_GMAC 0x2000>;
+			interrupt-parent = <&gic>;
+			interrupts = <0 IRQ_GMAC 0>;
+			interrupt-names = "macirq";
+			mac-address = [000000000000]; /* Filled in by U-Boot */
+			phy-mode = "rgmii";
+			snps,multicast-filter-bins = <256>;
+			status = "disable";
+		};
+
+		adc:adc@c0053000 {
+			compatible = "nexell,s5p6818-adc";
+			reg = <PHYS_BASE_ADC 0x1000>;
+			interrupts = <0 IRQ_ADC 0>;
+			resets = <&nexell_reset RESET_ID_ADC>;
+			reset-names = "adc-reset";
+			clocks = <&pclk>;
+			clock-names = "adc";
+			sample_rate = <200000>;
+			#io-channel-cells = <1>;
+			status = "disabled";
+		};
+
+		spi_0:spi@c005b000 {
+			compatible = "nexell,s5p6818-spi";
+			reg = <PHYS_BASE_SSP0 0x100>;
+			interrupts = <0 IRQ_SSP0 0>;
+			dmas = <&pl08xdma0 6 0>, <&pl08xdma0 7 0>;
+			dma-names = "tx", "rx";
+			resets = <&nexell_reset RESET_ID_SSP0_P>,
+			       <&nexell_reset RESET_ID_SSP0>;
+			reset-names = "pre-reset","spi-reset";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			samsung,spi-src-clk = <0>;
+			num-cs = <1>;
+			clocks = <&spi0>, <&spi0>;
+			clock-names = "spi", "spi_busclk0";
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi0_bus>;
+			status ="disable";
+		};
+
+		spi_1:spi@c005c000 {
+			compatible = "nexell,s5p6818-spi";
+			reg = <PHYS_BASE_SSP1 0x100>;
+			interrupts = <0 IRQ_SSP1 0>;
+			dmas = <&pl08xdma0 8 0>, <&pl08xdma0 9 0>;
+			dma-names = "tx", "rx";
+			resets = <&nexell_reset RESET_ID_SSP1_P>,
+			       <&nexell_reset RESET_ID_SSP1>;
+			reset-names = "pre-reset","spi-reset";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			samsung,spi-src-clk = <0>;
+			num-cs = <1>;
+			clocks = <&spi1>, <&spi1>;
+			clock-names = "spi", "spi_busclk0";
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi1_bus>;
+			status ="disable";
+		};
+
+		spi_2:spi@c005f000 {
+			compatible = "nexell,s5p6818-spi";
+			reg = <PHYS_BASE_SSP2 0x100>;
+			interrupts = <0 IRQ_SSP2 0>;
+			dmas = <&pl08xdma0 10 0>, <&pl08xdma0 11 0>;
+			dma-names = "tx", "rx";
+			resets = <&nexell_reset RESET_ID_SSP2_P>,
+			       <&nexell_reset RESET_ID_SSP2>;
+			reset-names = "pre-reset","spi-reset";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			samsung,spi-src-clk = <0>;
+			num-cs = <1>;
+			clocks = <&spi2>, <&spi2>;
+			clock-names = "spi", "spi_busclk0";
+			pinctrl-names = "default";
+			pinctrl-0 = <&spi2_bus>;
+			status ="disable";
+		};
+
+		watchdog@c0019000 {
+			compatible = "nexell,nexell-wdt";
+			reg = <PHYS_BASE_WDT 0x1000>;
+			interrupts = <0 IRQ_WDT 0>;
+			resets = <&nexell_reset RESET_ID_WDT>,
+			       <&nexell_reset RESET_ID_WDT_POR>;
+			reset-names = "wdt-reset","wdt-por-reset";
+			clocks = <&pclk>;
+			clock-names = "watchdog";
+			status = "disabled";
+		};
+
+		spdif_tx: spdiftx@c0059000 {
+			compatible = "nexell,nexell-spdif-tx";
+			reg = <PHYS_BASE_SPDIF_TX 0x1000>;
+			interrupts = <0 IRQ_SPDIFTX 0>;
+			dmas = <&pl08xdma1 6 0>;
+			dma-names = "tx";
+			resets = <&nexell_reset RESET_ID_SPDIFTX>;
+			reset-names = "spdiftx-reset";
+			clocks = <&spdiftx>;
+			clock-names = "spdif-tx";
+			pcm-bit = <16>;
+			sample_rate = <48000>;
+			status = "disabled";
+		};
+
+		tmuctrl_0: tmuctrl@c0096000 {
+			compatible = "nexell,s5p6818-tmu";
+			reg = <PHYS_BASE_TMU0 0x100>;
+			interrupts = <0 IRQ_TMU0 0>;
+			clocks = <&pclk>;
+			clock-names = "tmu_apbif";
+			#include "s5p6818-tmu-sensor-conf.dtsi"
+			soc,tieoff = <NX_TIEOFF_Inst_TMU0_SENSING_START 1>;
+			status = "disabled";
+		};
+
+		tmuctrl_1: tmuctrl@c0097000 {
+			compatible = "nexell,s5p6818-tmu";
+			reg = <PHYS_BASE_TMU1 0x100>;
+			interrupts = <0 IRQ_TMU1 0>;
+			clocks = <&pclk>;
+			clock-names = "tmu_apbif";
+			#include "s5p6818-tmu-sensor-conf.dtsi"
+			soc,tieoff = <NX_TIEOFF_Inst_TMU1_SENSING_START 1>;
+			status = "disabled";
+		};
+
+		mipi_csi:mipi_csi@c00d0000 {
+			compatible = "nexell,mipi_csi";
+			reg = <PHYS_BASE_MIPI 0x1000>;
+			clock-names = "mipi";
+			clocks = <&mipi>;
+			reset-names = "mipi-reset", "mipi_csi-reset", "mipi_phy_s-reset";
+			resets = <&nexell_reset RESET_ID_MIPI>,
+				 <&nexell_reset RESET_ID_MIPI_CSI>,
+				 <&nexell_reset RESET_ID_MIPI_PHY_S>;
+			soc,tieoff = <NX_TIEOFF_MIPI0_NX_DPSRAM_1R1W_EMAA 3>;
+			data_lane = <2>;
+			swap_clocklane = <0>;
+			swap_datalane = <0>;
+			pllval = <750>;
+			status = "disabled";
+		};
+
+		vip_0:vip@c0063000 {
+			compatible = "nexell,vip";
+			reg = <PHYS_BASE_VIP0 0x1000>;
+			interrupts = <0 IRQ_VIP0 0>;
+			clock-names = "vip0";
+			clocks = <&vip0>;
+			reset-names = "vip0-reset";
+			resets = <&nexell_reset RESET_ID_VIP0>;
+			module = <0>;
+			status = "disabled";
+		};
+
+		vip_1:vip@c0064000 {
+			compatible = "nexell,vip";
+			reg = <PHYS_BASE_VIP1 0x1000>;
+			interrupts = <0 IRQ_VIP1 0>;
+			clock-names = "vip1";
+			clocks = <&vip1>;
+			reset-names = "vip1-reset";
+			resets = <&nexell_reset RESET_ID_VIP1>;
+			module = <1>;
+			status = "disabled";
+		};
+
+		vip_2:vip@c0099000 {
+			compatible = "nexell,vip";
+			reg = <PHYS_BASE_VIP2 0x1000>;
+			interrupts = <0 IRQ_VIP2 0>;
+			clock-names = "vip2";
+			clocks = <&vip2>;
+			reset-names = "vip2-reset";
+			resets = <&nexell_reset RESET_ID_VIP2>;
+			module = <2>;
+			status = "disabled";
+		};
+
+		clipper_0:clipper0@c0063000 {
+			compatible = "nexell,nx-clipper";
+			module = <0>;
+			status = "disabled";
+		};
+
+		clipper_1:clipper1@c0064000 {
+			compatible = "nexell,nx-clipper";
+			module = <1>;
+			status = "disabled";
+		};
+
+		clipper_2:clipper2@c0064000 {
+			compatible = "nexell,nx-clipper";
+			module = <2>;
+			status = "disabled";
+		};
+
+		decimator_0:decimator0@c0063000 {
+			compatible = "nexell,nx-decimator";
+			module = <0>;
+			status = "disabled";
+		};
+
+		dp_drm: display_drm {
+			compatible = "nexell,s5pxx18-drm";
+			reg = <0xc0102800 0x100>, <0xc0102c00 0x100>,
+				<0xc0102000 0x100>, <0xc0102400 0x100>;
+			reg-names = "dpc.0", "dpc.1", "mlc.0", "mlc.1";
+
+			interrupts = < 0 IRQ_DPC_P 0 >, <0 IRQ_DPC_S 0>;
+			interrupts-names = "dpc.0", "dpc.1";
+
+			resets = <&nexell_reset RESET_ID_DISPLAY>,
+					<&nexell_reset RESET_ID_DISP_TOP>;
+			reset-names = "rsc-display", "rsc-display-top";
+
+			status = "disabled";
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 { };
+				port@1 { };
+			};
+		};
+
+		dp_drm_rgb: display_drm_rgb {
+			compatible = "nexell,s5pxx18-drm-rgb";
+			reg = <0xc0101000 0x100>;
+			resets = <&nexell_reset RESET_ID_DISP_TOP>;
+			reset-names = "rsc-display-top";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+		};
+
+		dp_drm_lvds: display_drm_lvds {
+			compatible = "nexell,s5pxx18-drm-lvds";
+			reg = <0xc0101000 0x100>;
+			resets = <&nexell_reset RESET_ID_DISP_TOP>;
+			reset-names = "rsc-display-top";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+
+			dp-resource {
+				reg_base = <0xc010a000 0x100>;
+				clk_base = <0xc0108000 3>;
+				resets = <&nexell_reset RESET_ID_LVDS>;
+				reset-names = "rsc-lvds-phy";
+			};
+		};
+
+		dp_drm_mipi: display_drm_mipi {
+			compatible = "nexell,s5pxx18-drm-mipi";
+			reg = <0xc0101000 0x100>;
+			resets = <&nexell_reset RESET_ID_DISP_TOP>;
+			reset-names = "rsc-display-top";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+
+			dp-resource {
+				reg_base = <0xc00d0000 0x100>;
+				clk_base = <0xc0105000 2>;
+
+				resets = <&nexell_reset RESET_ID_MIPI>,
+					<&nexell_reset RESET_ID_MIPI_DSI>,
+					<&nexell_reset RESET_ID_MIPI_PHY_S>,
+					<&nexell_reset RESET_ID_MIPI_PHY_M>;
+				reset-names = "rsc-mipi", "rsc-mipi-dsi",
+					"rsc-mipi-phy-s", "rsc-mipi-phy-m";
+				soc,tieoff = <NX_TIEOFF_MIPI0_NX_DPSRAM_1R1W_EMAA 3>,
+					<NX_TIEOFF_MIPI0_NX_DPSRAM_1R1W_EMAB 3>;
+			};
+		};
+
+		dp_drm_hdmi: display_drm_hdmi{
+			compatible = "nexell,s5pxx18-drm-hdmi";
+			reg = <0xc0101000 0x100>;
+			interrupts = < 0 IRQ_HDMI 0 >;
+			resets = <&nexell_reset RESET_ID_DISP_TOP>;
+			reset-names = "rsc-display-top";
+			#address-cells = <1>;
+			#size-cells = <0>;
+			status = "disabled";
+
+			dp-resource {
+				reg_base = <0xc0000000 0x300000>;
+				clk_base = <0xc0109000 4>, <0xc0105000 2>;
+				resets = <&nexell_reset RESET_ID_HDMI_VIDEO>,
+						<&nexell_reset RESET_ID_HDMI_SPDIF>,
+						<&nexell_reset RESET_ID_HDMI_TMDS>,
+						<&nexell_reset RESET_ID_HDMI>,
+						<&nexell_reset RESET_ID_HDMI_PHY>;
+				reset-names = "rsc-hdmi-video", "rsc-hdmi-spdif",
+						"rsc-hdmi-tmds", "rsc-hdmi", "rsc-hdmi-phy";
+				soc,tieoff = <NX_TIEOFF_DISPLAYTOP0_i_HDMI_PHY_REFCLK_SEL 1>;
+			};
+		};
+
+		video-codec@c0080000 {
+			compatible = "nexell, nx-vpu";
+			reg = <0xc0080000 0x4000>;
+			interrupts = <0 IRQ_CODA960_HOST 0>,
+				<0 IRQ_CODA960_JPG 0>;
+			resets = <&nexell_reset RESET_ID_CODA_A>,
+				<&nexell_reset RESET_ID_CODA_P>,
+				<&nexell_reset RESET_ID_CODA_C>;
+			reset-names = "vpu-a-reset", "vpu-p-reset",
+				"vpu-c-reset";
+			clocks = <&pclk>, <&bclk>;
+			status = "disabled";
+		};
+
+		rtc@c0010c00 {
+		    compatible = "nexell,nx-rtc";
+		    reg = <PHYS_BASE_RTC 0x100>, <0xc0010200 0x100>;
+		    interrupts = <0 IRQ_RTC 0>;
+		    status = "disabled";
+		};
+
+		scaler@c0066000 {
+			compatible = "nexell,scaler";
+			reg = <PHYS_BASE_SCALER 0x1000>;
+			interrupts = <0 IRQ_SCALER 0>;
+			clock-names = "scaler";
+			clocks = <&scaler>;
+			reset-names = "scaler-reset";
+			resets = <&nexell_reset RESET_ID_SCALER>;
+			status = "disabled";
+		};
+
+		gpu@c0070000 {
+			compatible = "arm,mali-400", "arm,mali-utgard";
+			reg = <PHYS_BASE_VR 0x10000>;
+			interrupts = <0 IRQ_VR 0>, <0 IRQ_VR 0>, <0 IRQ_VR 0>,
+				<0 IRQ_VR 0>, <0 IRQ_VR 0>, <0 IRQ_VR 0>,
+				<0 IRQ_VR 0>, <0 IRQ_VR 0>, <0 IRQ_VR 0>,
+				<0 IRQ_VR 0>, <0 IRQ_VR 0>;
+			interrupt-names = "IRQGP", "IRQGPMMU", "IRQPP0",
+				"IRQPPMMU0", "IRQPP1", "IRQPPMMU1",
+				"IRQPP2", "IRQPPMMU2", "IRQPP3",
+				"IRQPPMMU3", "IRQPMU";
+			pmu_domain_config = <0x1 0x4 0x8 0x10 0x20 0x0 0x0 0x0
+						0x0 0x2 0x0 0x0>;
+			pmu_switch_delay = <0xff>;
+			clocks = <&vr>;
+			clock-names = "clk_mali";
+			resets = <&nexell_reset RESET_ID_VR>;
+			reset-names = "vr-reset";
+		};
+	}; /*** soc ***/
+};
diff -ENwbur a/arch/arm64/boot/dts/nexell/s5p6818-pinctrl.dtsi b/arch/arm64/boot/dts/nexell/s5p6818-pinctrl.dtsi
--- a/arch/arm64/boot/dts/nexell/s5p6818-pinctrl.dtsi	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/boot/dts/nexell/s5p6818-pinctrl.dtsi	2018-05-06 08:49:48.254657924 +0200
@@ -0,0 +1,519 @@
+/*
+ * Nexell's s5p6818 SoC pin-mux and pin-config device tree source
+ *
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ *		http://www.nexell.co.kr
+ *
+ * Nexell's s5p6818 SoC pin-mux and pin-config options are listed as
+ * device tree nodes in this file.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+pinctrl@C0010000 {
+	gpio_a: gpioa {
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	gpio_b: gpiob {
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	gpio_c: gpioc {
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	gpio_d: gpiod {
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	gpio_e: gpioe {
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+	alive_0: alive {
+		gpio-controller;
+		#gpio-cells = <2>;
+
+		interrupt-controller;
+		#interrupt-cells = <2>;
+	};
+
+    /* Function mapping from kernel 3.x
+     *  pin-function
+     *      PAD_FUNC_ALT0   0
+     *      PAD_FUNC_ALT1   1
+     *      PAD_FUNC_ALT2   2
+     *      PAD_FUNC_ALT3   3
+     *
+     *  no control (PINCFG_TYPE_DIR)
+     *      PAD_MODE_ALT    0
+     *      PAD_MODE_IN     0
+     *      PAD_MODE_OUT    1
+     *
+     *  no control (PINCFG_TYPE_DAT)
+     *      PAD_LEVEL_LOW   0
+     *      PAD_LEVEL_HIGH  1
+     *
+     *  pin-pull
+     *      PAD_PULL_DN     0
+     *      PAD_PULL_UP     1
+     *      PAD_PULL_OFF    2
+     *
+     *  pin-strength
+     *      PAD_STRENGTH_0  0
+     *      PAD_STRENGTH_1  1
+     *      PAD_STRENGTH_2  2
+     *      PAD_STRENGTH_3  3
+     */
+
+	/* NAND */
+	nand_default: nand-default {
+		nand_cle: nand-cle {
+			nexell,pins = "gpiob-11";
+			nexell,pin-function = <0>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <0>;
+		};
+
+		nand_ale: nand-ale {
+			nexell,pins = "gpiob-12";
+			nexell,pin-function = <0>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <0>;
+		};
+
+		nand_bus8: nand-bus-width8 {
+			nexell,pins = "gpiob-13", "gpiob-15", "gpiob-17",
+				      "gpiob-19", "gpiob-20", "gpiob-21",
+				      "gpiob-22", "gpiob-23";
+			nexell,pin-function = <0>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <0>;
+		};
+
+		nand_rnb: nand-rnb {
+			nexell,pins = "gpiob-14";
+			nexell,pin-function = <0>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <0>;
+		};
+
+		nand_noe: nand-noe {
+			nexell,pins = "gpiob-16";
+			nexell,pin-function = <0>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <0>;
+		};
+
+		nand_nwe: nand-nwe {
+			nexell,pins = "gpiob-18";
+			nexell,pin-function = <0>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <0>;
+		};
+	};
+
+
+	/* GMAC */
+	gmac_pins: gmac_pins {
+		gmac_txd: gmac-txd {
+			nexell,pins = "gpioe-7", "gpioe-8", "gpioe-9",
+				      "gpioe-10";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <3>;
+		};
+
+		gmac_rxd: gmac-rxd {
+			nexell,pins = "gpioe-14", "gpioe-15", "gpioe-16",
+				      "gpioe-17";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <3>;
+		};
+
+		gmac_txen: gmac-txen {
+			nexell,pins = "gpioe-11";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <3>;
+		};
+
+		gmac_mdc: gmac-mdc {
+			nexell,pins = "gpioe-20";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <3>;
+		};
+
+		gmac_mdio: gmac-mdio {
+			nexell,pins = "gpioe-21";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <3>;
+		};
+
+		gmac_rxclk: gmac-rxclk {
+			nexell,pins = "gpioe-18";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <3>;
+		};
+
+		gmac_txclk: gmac-txclk {
+			nexell,pins = "gpioe-24";
+			nexell,pin-function = <1>;
+			nexell,pin-pull = <2>;
+			nexell,pin-strength = <2>;
+		};
+	};
+
+	/* MMC0 */
+	sdmmc0_cclk: sdmmc0-cclk {
+		nexell,pins = "gpioa-29";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <2>;
+	};
+
+	sdmmc0_cmd: sdmmc0-cmd {
+		nexell,pins = "gpioa-31";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+
+	sdmmc0_bus4: sdmmc0-bus-width4 {
+		nexell,pins = "gpiob-1", "gpiob-3", "gpiob-5", "gpiob-7";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+	/* MMC1 */
+	sdmmc1_cclk: sdmmc1-cclk {
+		nexell,pins = "gpiod-22";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <2>;
+	};
+
+	sdmmc1_cmd: sdmmc1-cmd {
+		nexell,pins = "gpiod-23";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+
+	sdmmc1_bus4: sdmmc1-bus-width4 {
+		nexell,pins = "gpiod-24", "gpiod-25", "gpiod-26", "gpiod-27";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+
+	/* MMC2 */
+	sdmmc2_cclk: sdmmc2-cclk {
+		nexell,pins = "gpioc-18";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <2>;
+	};
+
+	sdmmc2_cmd: sdmmc2-cmd {
+		nexell,pins = "gpioc-19";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+
+	sdmmc2_bus4: sdmmc2-bus-width4 {
+		nexell,pins = "gpioc-20", "gpioc-21", "gpioc-22", "gpioc-23";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+
+	sdmmc2_bus8: sdmmc2-bus-width8 {
+		nexell,pins = "gpioe-21", "gpioe-22", "gpioe-23", "gpioe-24";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <1>;
+	};
+
+	/* serial */
+	serial0_pin:serial0 {
+		nexell,pins = "gpiod-14", "gpiod-18";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	serial1_pin:serial1 {
+		nexell,pins = "gpiod-15", "gpiod-19";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	serial1_flow:serial1_flow {
+		nexell,pins = "gpioc-5", "gpioc-6";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	serial2_pin:serial2 {
+		nexell,pins = "gpiod-16", "gpiod-20";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	serial3_pin:serial3 {
+		nexell,pins = "gpiod-17", "gpiod-21";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	serial4_pin:serial4 {
+		nexell,pins = "gpiob-28", "gpiob-29";
+		nexell,pin-function = <3>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	serial5_pin:serial5 {
+		nexell,pins = "gpiob-30", "gpiob-31";
+		nexell,pin-function = <3>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	i2c0_pin:i2c0 {
+		nexell,pins = "gpiod-2", "gpiod-3";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	i2c1_pin:i2c1 {
+		nexell,pins = "gpiod-4", "gpiod-5";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	i2c2_pin:i2c2 {
+		nexell,pins = "gpiod-6", "gpiod-7";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	pwm0_pin:pwm0 {
+		nexell,pins = "gpiod-1";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	pwm1_pin:pwm1 {
+		nexell,pins = "gpioc-13";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	pwm2_pin:pwm2 {
+		nexell,pins = "gpioc-14";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	pwm3_pin:pwm3 {
+		nexell,pins = "gpiod-0";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	i2s0_bus:i2s0 {
+		nexell,pins = "gpiod-9", "gpiod-10", "gpiod-11",
+				"gpiod-12", "gpiod-13";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	i2s1_bus:i2s1 {
+		nexell,pins = "gpioa-28", "gpioa-30", "gpiob-0",
+				"gpiob-6", "gpiob-9";
+		nexell,pin-function = <3>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	i2s2_bus:i2s2 {
+		i2s2_mclk: i2s2-mclk {
+			nexell,pins = "gpioa-28";
+			nexell,pin-function = <2>;
+			nexell,pin-pull = <0>;
+			nexell,pin-strength = <0>;
+		};
+
+		i2s2_other: i2s2-other {
+			nexell,pins = "gpiob-2", "gpiob-4",
+					"gpiob-8", "gpiob-10";
+			nexell,pin-function = <3>;
+			nexell,pin-pull = <0>;
+			nexell,pin-strength = <0>;
+		};
+	};
+
+	spi0_bus:spi0 {
+		nexell,pins = "gpioc-29", "gpioc-30", "gpioc-31", "gpiod-0";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	spi1_bus:spi1 {
+		nexell,pins = "gpioe-14", "gpioe-15", "gpioe-18", "gpioe-19";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	spi2_bus:spi2 {
+		nexell,pins = "gpioc-9", "gpioc-10", "gpioc-11", "gpioc-12";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <1>;
+		nexell,pin-strength = <0>;
+	};
+
+	spdiftx_pin:spdiftx {
+		nexell,pins = "gpioc-25";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <0>;
+		nexell,pin-strength = <0>;
+	};
+
+	vid0_data_clk: vid0-data-clk {
+		nexell,pins = "gpiod-28", "gpiod-29", "gpiod-30", "gpiod-31", "gpioe-0", "gpioe-1", "gpioe-2", "gpioe-3", "gpioe-4";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	vid0_sync: vid0-sync {
+		nexell,pins = "gpioe-5", "gpioe-6";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	vid1_data_clk: vid1-data-clk {
+		nexell,pins = "gpioa-30", "gpiob-0", "gpiob-2", "gpiob-4", "gpiob-6", "gpiob-8", "gpiob-9", "gpiob-10", "gpioa-28";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	vid1_sync: vid1-sync {
+		nexell,pins = "gpioe-13", "gpioe-7";
+		nexell,pin-function = <2>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	vid2_data_clk: vid2-data-clk {
+		nexell,pins = "gpioc-17", "gpioc-18", "gpioc-19", "gpioc-20", "gpioc-21", "gpioc-22", "gpioc-23", "gpioc-24", "gpioc-14";
+		nexell,pin-function = <3>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	vid2_sync: vid2-sync {
+		nexell,pins = "gpioc-15", "gpioc-16";
+		nexell,pin-function = <3>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_vclk: dp-rgb-vclk {
+		nexell,pins = "gpioa-0";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_vsync: dp-rgb-vsync {
+		nexell,pins = "gpioa-25";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_hsync: dp-rgb-hsync {
+		nexell,pins = "gpioa-26";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_de: dp-rgb-de {
+		nexell,pins = "gpioa-27";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_B: dp-rgb-B {
+		nexell,pins = "gpioa-1", "gpioa-2", "gpioa-3", "gpioa-4",
+			      "gpioa-5", "gpioa-6", "gpioa-7", "gpioa-8";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_G: dp-rgb-G {
+		nexell,pins = "gpioa-9", "gpioa-10", "gpioa-11", "gpioa-12",
+			      "gpioa-13", "gpioa-14", "gpioa-15", "gpioa-16";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+
+	dp_rgb_R: dp-rgb-R {
+		nexell,pins = "gpioa-17", "gpioa-18", "gpioa-19", "gpioa-20",
+			      "gpioa-21", "gpioa-22", "gpioa-23", "gpioa-24";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <0>;
+	};
+};
diff -ENwbur a/arch/arm64/boot/dts/nexell/s5p6818-soc.dtsi b/arch/arm64/boot/dts/nexell/s5p6818-soc.dtsi
--- a/arch/arm64/boot/dts/nexell/s5p6818-soc.dtsi	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/boot/dts/nexell/s5p6818-soc.dtsi	2018-05-06 08:49:48.254657924 +0200
@@ -0,0 +1,667 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+pinctrl_0: pinctrl@C0010000 {
+	compatible = "nexell,s5p6818-pinctrl";
+	reg = <PHYS_BASE_GPIOA 0x1000
+	       PHYS_BASE_GPIOB 0x1000
+	       PHYS_BASE_GPIOC 0x1000
+	       PHYS_BASE_GPIOD 0x1000
+	       PHYS_BASE_GPIOE 0x1000
+	       PHYS_BASE_ALIVE 0x200>;
+	#address-cells = <1>;
+	#size-cells = <1>;
+	interrupts = <0 IRQ_GPIOA 0>,
+		     <0 IRQ_GPIOB 0>,
+		     <0 IRQ_GPIOC 0>,
+		     <0 IRQ_GPIOD 0>,
+		     <0 IRQ_GPIOE 0>,
+		     <0 IRQ_ALIVE 0>;
+};
+
+clocks {
+	compatible = "nexell,s5pxx18,clocks";
+	reg = <0xc00bb000 0x30000>;
+	#address-cells = <1>;
+	#size-cells = <1>;
+	ranges;
+
+	pll0: pll0 {
+		#clock-cells = <0>;
+		clock-names = "sys-pll0";
+		clock-output-names = "pll0";
+	};
+
+	pll1: pll1 {
+		#clock-cells = <0>;
+		clock-names = "sys-pll1";
+		clock-output-names = "pll1";
+	};
+
+	pll2: pll2 {
+		#clock-cells = <0>;
+		clock-names = "sys-pll2";
+		clock-output-names = "pll2";
+	};
+
+	pll3: pll3 {
+		#clock-cells = <0>;
+		clock-names = "sys-pll3";
+		clock-output-names = "pll3";
+	};
+
+	bclk: bclk {
+		#clock-cells = <0>;
+		clock-names = "sys-bbclk";
+		clock-output-names = "bclk";
+	};
+
+	pclk: pclk {
+		#clock-cells = <0>;
+		clock-names = "sys-bpclk";
+		clock-output-names = "pclk";
+	};
+
+	apb_pclk: apb_pclk {
+		#clock-cells = <0>;
+		clock-names = "sys-bbclk";
+		clock-output-names = "apb_pclk";
+	};
+
+	timer0:timer@c00b9000 {
+		#clock-cells = <0>;
+		clock-output-names = "timer0";
+		cell-id = <CLK_ID_TIMER_0>;
+		reg = <PHYS_BASE_CLK_14 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_TIMER>;
+	};
+
+	timer1:timer@c00bb000 {
+		#clock-cells = <0>;
+		clock-output-names = "timer1";
+		cell-id = <CLK_ID_TIMER_1>;
+		reg = <PHYS_BASE_CLK_0 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_TIMER>;
+	};
+
+	timer2:timer@c00bc000 {
+		#clock-cells = <0>;
+		clock-output-names = "timer2";
+		cell-id = <CLK_ID_TIMER_2>;
+		reg = <PHYS_BASE_CLK_1 0x1000>;
+		clk-step = <1>;
+		clk-input = <CLK_INPUT_TIMER>;
+	};
+
+	timer3:timer@c00bd000 {
+		#clock-cells = <0>;
+		clock-output-names = "timer3";
+		cell-id = <CLK_ID_TIMER_3>;
+		reg = <PHYS_BASE_CLK_2 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_TIMER>;
+	};
+
+	uart0:uart@c00a9000 {
+		#clock-cells = <0>;
+		clock-output-names = "uart0";
+		cell-id = <CLK_ID_UART_0>;
+		reg = <PHYS_BASE_CLK_22 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_UART>;
+	};
+
+	uart1:uart@c00a8000 {
+		#clock-cells = <0>;
+		clock-output-names = "uart1";
+		cell-id = <CLK_ID_UART_1>;
+		reg = <PHYS_BASE_CLK_24 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_UART>;
+	};
+
+	uart2:uart@c00aa000 {
+		#clock-cells = <0>;
+		clock-output-names = "uart2";
+		cell-id = <CLK_ID_UART_2>;
+		reg = <PHYS_BASE_CLK_23 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_UART>;
+	};
+
+	uart3:uart@c00ab000 {
+		#clock-cells = <0>;
+		clock-output-names = "uart3";
+		cell-id = <CLK_ID_UART_3>;
+		reg = <PHYS_BASE_CLK_25 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_UART>;
+	};
+
+	uart4:uart@c006e000 {
+		#clock-cells = <0>;
+		clock-output-names = "uart4";
+		cell-id = <CLK_ID_UART_4>;
+		reg = <PHYS_BASE_CLK_26 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_UART>;
+	};
+
+	uart5:uart@c0084000 {
+		#clock-cells = <0>;
+		clock-output-names = "uart5";
+		cell-id = <CLK_ID_UART_5>;
+		reg = <PHYS_BASE_CLK_27 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_UART>;
+	};
+
+	pwm0:pwm0@c00ba000 {
+		#clock-cells = <0>;
+		clock-output-names = "pwm0";
+		cell-id = <CLK_ID_PWM_0>;
+		reg = <PHYS_BASE_CLK_13 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_PWM>;
+	};
+
+	pwm1:pwm1@c00ba000 {
+		#clock-cells = <0>;
+		clock-output-names = "pwm1";
+		cell-id = <CLK_ID_PWM_1>;
+		reg = <PHYS_BASE_CLK_13 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_PWM>;
+	};
+
+	pwm2:pwm2@c00be000 {
+		#clock-cells = <0>;
+		clock-output-names = "pwm2";
+		cell-id = <CLK_ID_PWM_2>;
+		reg = <PHYS_BASE_CLK_3 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_PWM>;
+	};
+
+	pwm3:pwm3@c00be000 {
+		#clock-cells = <0>;
+		clock-output-names = "pwm3";
+		cell-id = <CLK_ID_PWM_3>;
+		reg = <PHYS_BASE_CLK_3 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_PWM>;
+	};
+
+	i2c0:i2c@c00ae000 {
+		#clock-cells = <0>;
+		clock-output-names = "i2c0";
+		cell-id = <CLK_ID_I2C_0>;
+		reg = <PHYS_BASE_CLK_6 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_I2C>;
+	};
+
+	i2c1:i2c@c00af000 {
+		#clock-cells = <0>;
+		clock-output-names = "i2c1";
+		cell-id = <CLK_ID_I2C_1>;
+		reg = <PHYS_BASE_CLK_7 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_I2C>;
+	};
+
+	i2c2:i2c@c00b0000 {
+		#clock-cells = <0>;
+		clock-output-names = "i2c2";
+		cell-id = <CLK_ID_I2C_2>;
+		reg = <PHYS_BASE_CLK_8 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_I2C>;
+	};
+
+	i2s0:i2s@c00b2000 {
+		#clock-cells = <0>;
+		clock-output-names = "i2s0";
+		cell-id = <CLK_ID_I2S_0>;
+		reg = <PHYS_BASE_CLK_15 0x1000>;
+		clk-step   = <2>;
+		clk-input  = <CLK_INPUT_I2S>;
+		clk-input1 = <CLK_INPUT_I2S_IN1>;
+	};
+
+	i2s1:i2s@c00b3000 {
+		#clock-cells = <0>;
+		clock-output-names = "i2s1";
+		cell-id = <CLK_ID_I2S_1>;
+		reg = <PHYS_BASE_CLK_16 0x1000>;
+		clk-step   = <2>;
+		clk-input  = <CLK_INPUT_I2S>;
+		clk-input1 = <CLK_INPUT_I2S_IN1>;
+	};
+
+	i2s2:i2s@c00b4000 {
+		#clock-cells = <0>;
+		clock-output-names = "i2s2";
+		cell-id = <CLK_ID_I2S_2>;
+		reg = <PHYS_BASE_CLK_17 0x1000>;
+		clk-step   = <2>;
+		clk-input  = <CLK_INPUT_I2S>;
+		clk-input1 = <CLK_INPUT_I2S_IN1>;
+	};
+
+	sdhc0:sdhc@c00c5000 {
+		#clock-cells = <0>;
+		clock-output-names = "sdhc0";
+		cell-id = <CLK_ID_SDHC_0>;
+		reg = <PHYS_BASE_CLK_18 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SDHC>;
+	};
+
+	sdhc1:sdhc@c00cc000 {
+		#clock-cells = <0>;
+		clock-output-names = "sdhc1";
+		cell-id = <CLK_ID_SDHC_1>;
+		reg = <PHYS_BASE_CLK_19 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SDHC>;
+	};
+
+	sdhc2:sdhc@c00cd000 {
+		#clock-cells = <0>;
+		clock-output-names = "sdhc2";
+		cell-id = <CLK_ID_SDHC_2>;
+		reg = <PHYS_BASE_CLK_20 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SDHC>;
+	};
+
+	spi0:spi@c00ac000 {
+		#clock-cells = <0>;
+		clock-output-names = "spi0";
+		cell-id = <CLK_ID_SPI_0>;
+		reg = <PHYS_BASE_CLK_37 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SPI>;
+	};
+
+	spi1:spi@c00ad000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_SPI_1>;
+		reg = <PHYS_BASE_CLK_38 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SPI>;
+		clock-output-names = "spi1";
+	};
+
+	spi2:spi@c00a7000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_SPI_2>;
+		reg = <PHYS_BASE_CLK_39 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SPI>;
+		clock-output-names = "spi2";
+	};
+
+	vip0:vip@c00c1000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_VIP_0>;
+		reg = <PHYS_BASE_CLK_30 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_VIP0>;
+		clock-output-names = "vip0";
+	};
+
+	vip1:vip@c00c2000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_VIP_1>;
+		reg = <PHYS_BASE_CLK_31 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_VIP1>;
+		clock-output-names = "vip1";
+	};
+
+	vip2:vip@c0099000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_VIP_2>;
+		reg = <PHYS_BASE_CLK_40 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_VIP2>;
+		clock-output-names = "vip2";
+	};
+
+	mipi:mipi@c00ca000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_MIPI>;
+		reg = <PHYS_BASE_CLK_9 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_MIPI>;
+		clock-output-names = "mipi";
+	};
+
+	gmac:gmac@c00c8000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_GMAC>;
+		reg = <PHYS_BASE_CLK_10 0x1000>;
+		clk-step   = <2>;
+		clk-input  = <CLK_INPUT_GMAC>;
+		clk-input1 = <CLK_INPUT_GMAC_IN1>;
+		clock-output-names = "gmac";
+		src-force = <4>;
+	};
+
+	spdiftx:spdiftx@c00b8000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_SPDIF_TX>;
+		reg = <PHYS_BASE_CLK_11 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SPDIFTX>;
+		clock-output-names = "spdif-tx";
+	};
+
+	mpegtsi:mpegtsi@c00b7000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_MPEGTSI>;
+		reg = <PHYS_BASE_CLK_12 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_MPEGTS>;
+		clock-output-names = "mpeg-tsi";
+	};
+
+	vr:vr@c00c3000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_VR>;
+		reg = <PHYS_BASE_CLK_21 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_VR>;
+		clock-output-names = "vr";
+	};
+
+	deinterlace:deinterlace@c00b5000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_DIT>;
+		reg = <PHYS_BASE_CLK_28 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_DIT>;
+		clock-output-names = "deinterlace";
+	};
+
+	ppm:pppm@c00c4000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_PPM>;
+		reg = <PHYS_BASE_CLK_29 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_PPM>;
+		clock-output-names = "ppm";
+	};
+
+	vpu:vpu@c00c7000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_CODA>;
+		reg = <PHYS_BASE_CLK_33 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_VPU>;
+		clock-output-names = "vpu";
+	};
+
+	crypto:crypto@c00c6000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_CRYPTO>;
+		reg = <PHYS_BASE_CLK_34 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_CRYPTO>;
+		clock-output-names = "crypto";
+	};
+
+	scaler:scaler@c00b6000 {
+		#clock-cells = <0>;
+		clock-output-names = "scaler";
+		cell-id = <CLK_ID_CRYPTO>;
+		reg = <PHYS_BASE_CLK_35 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_SCALER>;
+	};
+
+	pdm:pdm@c00cb000 {
+		#clock-cells = <0>;
+		clock-output-names = "pdm";
+		cell-id = <CLK_ID_PDM>;
+		reg = <PHYS_BASE_CLK_36 0x1000>;
+		clk-step  = <1>;
+		clk-input = <CLK_INPUT_PDM>;
+	};
+
+	usbhost:usbhost@c006b000 {
+		#clock-cells = <0>;
+		cell-id = <CLK_ID_USB2HOST>;
+		reg = <PHYS_BASE_CLK_32 0x1000>;
+		clk-step   = <2>;
+		clk-input  = <CLK_INPUT_EHCI>;
+		clk-input1 = <CLK_INPUT_EHCI_IN1>;
+		clock-output-names = "usbhost";
+		clock-frequency = <12000000>;
+	};
+
+	otg:otg@6c00b000 {
+		#clock-cells = <0>;
+		clock-output-names = "otg";
+		cell-id = <CLK_ID_USBOTG>;
+		reg = <PHYS_BASE_CLK_32 0x1000>;
+		clk-step   = <2>;
+		clk-input  = <CLK_INPUT_OTG>;
+		clk-input1 = <CLK_INPUT_OTG_IN1>;
+	};
+};
+
+amba {
+	compatible = "arm,amba-bus";
+	reg = <0xC0000000 0x2000>;
+	#address-cells = <1>;
+	#size-cells = <1>;
+	interrupt-parent = <&gic>;
+	ranges;
+
+	pl08xdma0:pl08xdma@c0000000 {
+		compatible = "arm,pl080", "arm,primecell";
+		arm,primecell-periphid = <0x00041080>;
+		reg = <PHYS_BASE_DMA0 0x1000>;
+		interrupts = <0 IRQ_DMA0 0>;
+		#dma-cells = <2>;
+		dma-channels = <8>;
+		dma-requests = <16>;
+		lli-bus-interface-ahb1;
+		mem-bus-interface-ahb1;
+		memcpy-burst-size = <256>;
+		memcpy-bus-width = <32>;
+
+		/* slave channels */
+		ch0 {
+			slave_bus_id = PL08X_DMA_NAME_UART1_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch1 {
+			slave_bus_id = PL08X_DMA_NAME_UART1_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch2 {
+			slave_bus_id = PL08X_DMA_NAME_UART0_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch3 {
+			slave_bus_id = PL08X_DMA_NAME_UART0_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch4 {
+			slave_bus_id = PL08X_DMA_NAME_UART2_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch5 {
+			slave_bus_id = PL08X_DMA_NAME_UART2_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch6 {
+			slave_bus_id = PL08X_DMA_NAME_SSP0_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch7 {
+			slave_bus_id = PL08X_DMA_NAME_SSP0_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch8 {
+			slave_bus_id = PL08X_DMA_NAME_SSP1_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch9 {
+			slave_bus_id = PL08X_DMA_NAME_SSP1_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch10 {
+			slave_bus_id = PL08X_DMA_NAME_SSP2_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch11 {
+			slave_bus_id = PL08X_DMA_NAME_SSP2_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch12 {
+			slave_bus_id = PL08X_DMA_NAME_I2S0_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch13 {
+			slave_bus_id = PL08X_DMA_NAME_I2S0_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch14 {
+			slave_bus_id = PL08X_DMA_NAME_I2S1_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch15 {
+			slave_bus_id = PL08X_DMA_NAME_I2S1_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+	};
+
+	pl08xdma1:pl08xdma@c0001000 {
+		compatible = "arm,pl080", "arm,primecell";
+		arm,primecell-periphid = <0x00041080>;
+		reg = <PHYS_BASE_DMA1 0x1000>;
+		interrupts = <0 IRQ_DMA1 0>;
+		#dma-cells = <2>;
+		dma-channels = <8>;
+		dma-requests = <16>;
+		lli-bus-interface-ahb1;
+		mem-bus-interface-ahb1;
+		memcpy-burst-size = <256>;
+		memcpy-bus-width = <32>;
+
+		/* slave channels */
+		ch0 {
+			slave_bus_id = PL08X_DMA_NAME_I2S2_TX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch1 {
+			slave_bus_id = PL08X_DMA_NAME_I2S2_RX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch2 {
+			slave_bus_id = PL08X_DMA_NAME_AC97_PCMOUT;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch3 {
+			slave_bus_id = PL08X_DMA_NAME_AC97_PCMIN;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch4 {
+			slave_bus_id = PL08X_DMA_NAME_AC97_MICIN;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch5 {
+			slave_bus_id = PL08X_DMA_NAME_SPDIFRX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch6 {
+			slave_bus_id = PL08X_DMA_NAME_SPDIFTX;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch7 {
+			slave_bus_id = PL08X_DMA_NAME_MPEGTSI0;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch8 {
+			slave_bus_id = PL08X_DMA_NAME_MPEGTSI1;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch9 {
+			slave_bus_id = PL08X_DMA_NAME_MPEGTSI2;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch10 {
+			slave_bus_id = PL08X_DMA_NAME_MPEGTSI3;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch11 {
+			slave_bus_id = PL08X_DMA_NAME_CRYPTO_BR;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch12 {
+			slave_bus_id = PL08X_DMA_NAME_CRYPTO_BW;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch13 {
+			slave_bus_id = PL08X_DMA_NAME_CRYPTO_HR;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+
+		ch14 {
+			slave_bus_id = PL08X_DMA_NAME_PDM;
+			slave_periph_buses = <PL08X_AHB2>;
+		};
+	};
+};
+
+
diff -ENwbur a/arch/arm64/boot/dts/nexell/s5p6818-tmu-sensor-conf.dtsi b/arch/arm64/boot/dts/nexell/s5p6818-tmu-sensor-conf.dtsi
--- a/arch/arm64/boot/dts/nexell/s5p6818-tmu-sensor-conf.dtsi	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/boot/dts/nexell/s5p6818-tmu-sensor-conf.dtsi	2018-05-06 08:49:48.254657924 +0200
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <dt-bindings/thermal/thermal_exynos.h>
+
+#thermal-sensor-cells = <0>;
+samsung,tmu_gain = <5>;
+samsung,tmu_reference_voltage = <16>;
+samsung,tmu_noise_cancel_mode = <4>;
+samsung,tmu_efuse_value = <0x5d2d>;
+samsung,tmu_min_efuse_value = <16>;
+samsung,tmu_max_efuse_value = <76>;
+samsung,tmu_first_point_trim = <25>;
+samsung,tmu_second_point_trim = <85>;
+samsung,tmu_default_temp_offset = <25>;
+samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
diff -ENwbur a/arch/arm64/configs/nanopim3_defconfig b/arch/arm64/configs/nanopim3_defconfig
--- a/arch/arm64/configs/nanopim3_defconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/arch/arm64/configs/nanopim3_defconfig	2018-05-06 08:49:48.262658250 +0200
@@ -0,0 +1,4592 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# Linux/arm64 4.14.39 Kernel Configuration
+#
+CONFIG_ARM64=y
+CONFIG_64BIT=y
+CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
+CONFIG_MMU=y
+CONFIG_ARM64_PAGE_SHIFT=12
+CONFIG_ARM64_CONT_SHIFT=4
+CONFIG_ARCH_MMAP_RND_BITS_MIN=18
+CONFIG_ARCH_MMAP_RND_BITS_MAX=24
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
+CONFIG_NO_IOPORT_MAP=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_ZONE_DMA=y
+CONFIG_HAVE_GENERIC_GUP=y
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SG_DMA_LENGTH=y
+CONFIG_SMP=y
+CONFIG_SWIOTLB=y
+CONFIG_IOMMU_HELPER=y
+CONFIG_KERNEL_MODE_NEON=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_PGTABLE_LEVELS=3
+CONFIG_ARCH_SUPPORTS_UPROBES=y
+CONFIG_ARCH_PROC_KCORE_TEXT=y
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_IRQ_WORK=y
+CONFIG_BUILDTIME_EXTABLE_SORT=y
+CONFIG_THREAD_INFO_IN_TASK=y
+
+#
+# General setup
+#
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_CROSS_COMPILE="aarch64-linux-gnu-"
+# CONFIG_COMPILE_TEST is not set
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_DEFAULT_HOSTNAME="S5P6818"
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_FHANDLE=y
+CONFIG_USELIB=y
+CONFIG_AUDIT=y
+CONFIG_HAVE_ARCH_AUDITSYSCALL=y
+CONFIG_AUDITSYSCALL=y
+CONFIG_AUDIT_WATCH=y
+CONFIG_AUDIT_TREE=y
+
+#
+# IRQ subsystem
+#
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+# CONFIG_IRQ_DOMAIN_DEBUG is not set
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_SPARSE_IRQ=y
+# CONFIG_GENERIC_IRQ_DEBUGFS is not set
+CONFIG_ARCH_CLOCKSOURCE_DATA=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_ARCH_HAS_TICK_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+
+#
+# Timers subsystem
+#
+CONFIG_TICK_ONESHOT=y
+CONFIG_NO_HZ_COMMON=y
+# CONFIG_HZ_PERIODIC is not set
+CONFIG_NO_HZ_IDLE=y
+# CONFIG_NO_HZ_FULL is not set
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+
+#
+# CPU/Task time and stats accounting
+#
+CONFIG_TICK_CPU_ACCOUNTING=y
+# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set
+# CONFIG_IRQ_TIME_ACCOUNTING is not set
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+# CONFIG_TASKSTATS is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_PREEMPT_RCU=y
+# CONFIG_RCU_EXPERT is not set
+CONFIG_SRCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_TASKS_RCU=y
+CONFIG_RCU_STALL_COMMON=y
+CONFIG_RCU_NEED_SEGCBLIST=y
+CONFIG_BUILD_BIN2C=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=16
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
+CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
+CONFIG_CGROUPS=y
+CONFIG_PAGE_COUNTER=y
+CONFIG_MEMCG=y
+CONFIG_MEMCG_SWAP=y
+CONFIG_MEMCG_SWAP_ENABLED=y
+# CONFIG_BLK_CGROUP is not set
+CONFIG_CGROUP_SCHED=y
+CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_CFS_BANDWIDTH is not set
+CONFIG_RT_GROUP_SCHED=y
+# CONFIG_CGROUP_PIDS is not set
+# CONFIG_CGROUP_RDMA is not set
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+# CONFIG_CPUSETS is not set
+# CONFIG_CGROUP_DEVICE is not set
+CONFIG_CGROUP_CPUACCT=y
+# CONFIG_CGROUP_PERF is not set
+CONFIG_CGROUP_BPF=y
+CONFIG_CGROUP_DEBUG=y
+CONFIG_SOCK_CGROUP_DATA=y
+# CONFIG_CHECKPOINT_RESTORE is not set
+CONFIG_NAMESPACES=y
+CONFIG_UTS_NS=y
+CONFIG_IPC_NS=y
+# CONFIG_USER_NS is not set
+CONFIG_PID_NS=y
+CONFIG_NET_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+# CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_RELAY is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_RD_GZIP=y
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
+CONFIG_HAVE_UID16=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_BPF=y
+CONFIG_EXPERT=y
+CONFIG_UID16=y
+CONFIG_MULTIUSER=y
+# CONFIG_SGETMASK_SYSCALL is not set
+CONFIG_SYSFS_SYSCALL=y
+# CONFIG_SYSCTL_SYSCALL is not set
+CONFIG_POSIX_TIMERS=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_ABSOLUTE_PERCPU is not set
+CONFIG_KALLSYMS_BASE_RELATIVE=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_FUTEX_PI=y
+CONFIG_EPOLL=y
+CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
+CONFIG_EVENTFD=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_SHMEM=y
+CONFIG_AIO=y
+CONFIG_ADVISE_SYSCALLS=y
+# CONFIG_USERFAULTFD is not set
+CONFIG_MEMBARRIER=y
+CONFIG_EMBEDDED=y
+CONFIG_HAVE_PERF_EVENTS=y
+# CONFIG_PC104 is not set
+
+#
+# Kernel Performance Events And Counters
+#
+CONFIG_PERF_EVENTS=y
+# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
+CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
+# CONFIG_SLOB is not set
+CONFIG_SLAB_MERGE_DEFAULT=y
+# CONFIG_SLAB_FREELIST_RANDOM is not set
+# CONFIG_SYSTEM_DATA_VERIFICATION is not set
+# CONFIG_PROFILING is not set
+CONFIG_TRACEPOINTS=y
+# CONFIG_KPROBES is not set
+# CONFIG_JUMP_LABEL is not set
+# CONFIG_UPROBES is not set
+# CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_DMA_CONTIGUOUS=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
+CONFIG_ARCH_HAS_SET_MEMORY=y
+CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
+CONFIG_HAVE_CLK=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_HW_BREAKPOINT=y
+CONFIG_HAVE_PERF_REGS=y
+CONFIG_HAVE_PERF_USER_STACK_DUMP=y
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_HAVE_RCU_TABLE_FREE=y
+CONFIG_HAVE_CMPXCHG_LOCAL=y
+CONFIG_HAVE_CMPXCHG_DOUBLE=y
+CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_HAVE_GCC_PLUGINS=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_HAVE_CC_STACKPROTECTOR=y
+# CONFIG_CC_STACKPROTECTOR is not set
+CONFIG_CC_STACKPROTECTOR_NONE=y
+# CONFIG_CC_STACKPROTECTOR_REGULAR is not set
+# CONFIG_CC_STACKPROTECTOR_STRONG is not set
+CONFIG_THIN_ARCHIVES=y
+CONFIG_HAVE_CONTEXT_TRACKING=y
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
+CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
+CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
+CONFIG_HAVE_ARCH_HUGE_VMAP=y
+CONFIG_MODULES_USE_ELF_RELA=y
+CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
+CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
+CONFIG_ARCH_MMAP_RND_BITS=18
+CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS=11
+# CONFIG_HAVE_ARCH_HASH is not set
+# CONFIG_ISA_BUS_API is not set
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_COMPAT_OLD_SIGACTION=y
+# CONFIG_CPU_NO_EFFICIENT_FFS is not set
+CONFIG_HAVE_ARCH_VMAP_STACK=y
+CONFIG_VMAP_STACK=y
+# CONFIG_ARCH_OPTIONAL_KERNEL_RWX is not set
+# CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT is not set
+CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
+CONFIG_STRICT_KERNEL_RWX=y
+CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
+CONFIG_STRICT_MODULE_RWX=y
+# CONFIG_REFCOUNT_FULL is not set
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
+CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_SLABINFO=y
+CONFIG_RT_MUTEXES=y
+CONFIG_BASE_SMALL=0
+CONFIG_MODULES=y
+CONFIG_MODULE_FORCE_LOAD=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+# CONFIG_MODULE_SIG is not set
+# CONFIG_MODULE_COMPRESS is not set
+# CONFIG_TRIM_UNUSED_KSYMS is not set
+CONFIG_MODULES_TREE_LOOKUP=y
+CONFIG_BLOCK=y
+CONFIG_BLK_SCSI_REQUEST=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSGLIB=y
+# CONFIG_BLK_DEV_INTEGRITY is not set
+# CONFIG_BLK_DEV_ZONED is not set
+# CONFIG_BLK_CMDLINE_PARSER is not set
+# CONFIG_BLK_WBT is not set
+CONFIG_BLK_DEBUG_FS=y
+# CONFIG_BLK_SED_OPAL is not set
+
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+CONFIG_EFI_PARTITION=y
+CONFIG_BLOCK_COMPAT=y
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+# CONFIG_IOSCHED_DEADLINE is not set
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_MQ_IOSCHED_DEADLINE=y
+CONFIG_MQ_IOSCHED_KYBER=y
+# CONFIG_IOSCHED_BFQ is not set
+CONFIG_UNINLINE_SPIN_UNLOCK=y
+CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_FREEZER=y
+
+#
+# Platform selection
+#
+# CONFIG_ARCH_ACTIONS is not set
+# CONFIG_ARCH_SUNXI is not set
+# CONFIG_ARCH_ALPINE is not set
+# CONFIG_ARCH_BCM2835 is not set
+# CONFIG_ARCH_BCM_IPROC is not set
+# CONFIG_ARCH_BERLIN is not set
+# CONFIG_ARCH_BRCMSTB is not set
+# CONFIG_ARCH_EXYNOS is not set
+# CONFIG_ARCH_LAYERSCAPE is not set
+# CONFIG_ARCH_LG1K is not set
+# CONFIG_ARCH_HISI is not set
+# CONFIG_ARCH_MEDIATEK is not set
+# CONFIG_ARCH_MESON is not set
+# CONFIG_ARCH_MVEBU is not set
+# CONFIG_ARCH_QCOM is not set
+# CONFIG_ARCH_REALTEK is not set
+# CONFIG_ARCH_ROCKCHIP is not set
+# CONFIG_ARCH_SEATTLE is not set
+# CONFIG_ARCH_RENESAS is not set
+# CONFIG_ARCH_STRATIX10 is not set
+# CONFIG_ARCH_TEGRA is not set
+# CONFIG_ARCH_SPRD is not set
+CONFIG_ARCH_S5P6818=y
+# CONFIG_ARCH_THUNDER is not set
+# CONFIG_ARCH_THUNDER2 is not set
+# CONFIG_ARCH_UNIPHIER is not set
+# CONFIG_ARCH_VEXPRESS is not set
+# CONFIG_ARCH_VULCAN is not set
+# CONFIG_ARCH_XGENE is not set
+# CONFIG_ARCH_ZX is not set
+# CONFIG_ARCH_ZYNQMP is not set
+
+#
+# Bus support
+#
+# CONFIG_PCI is not set
+# CONFIG_PCI_DOMAINS is not set
+# CONFIG_PCI_DOMAINS_GENERIC is not set
+# CONFIG_PCI_SYSCALL is not set
+
+#
+# DesignWare PCI Core Support
+#
+
+#
+# PCI Endpoint
+#
+# CONFIG_PCI_ENDPOINT is not set
+
+#
+# Kernel Features
+#
+
+#
+# ARM errata workarounds via the alternatives framework
+#
+# CONFIG_ARM64_ERRATUM_826319 is not set
+# CONFIG_ARM64_ERRATUM_827319 is not set
+# CONFIG_ARM64_ERRATUM_824069 is not set
+# CONFIG_ARM64_ERRATUM_819472 is not set
+# CONFIG_ARM64_ERRATUM_832075 is not set
+CONFIG_ARM64_ERRATUM_845719=y
+CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_CAVIUM_ERRATUM_22375=y
+CONFIG_CAVIUM_ERRATUM_23154=y
+CONFIG_CAVIUM_ERRATUM_27456=y
+CONFIG_CAVIUM_ERRATUM_30115=y
+CONFIG_QCOM_FALKOR_ERRATUM_1003=y
+CONFIG_QCOM_FALKOR_ERRATUM_1009=y
+CONFIG_QCOM_QDF2400_ERRATUM_0065=y
+CONFIG_QCOM_FALKOR_ERRATUM_E1041=y
+CONFIG_ARM64_4K_PAGES=y
+# CONFIG_ARM64_16K_PAGES is not set
+# CONFIG_ARM64_64K_PAGES is not set
+CONFIG_ARM64_VA_BITS_39=y
+# CONFIG_ARM64_VA_BITS_48 is not set
+CONFIG_ARM64_VA_BITS=39
+CONFIG_ARM64_WORKAROUND_CCI400_DVMV7=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_SMT=y
+CONFIG_NR_CPUS=8
+CONFIG_HOTPLUG_CPU=y
+# CONFIG_NUMA is not set
+# CONFIG_PREEMPT_NONE is not set
+# CONFIG_PREEMPT_VOLUNTARY is not set
+CONFIG_PREEMPT=y
+CONFIG_PREEMPT_COUNT=y
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+CONFIG_SCHED_HRTICK=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_ARCH_HAS_HOLES_MEMORYMODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_HAVE_ARCH_PFN_VALID=y
+CONFIG_HW_PERF_EVENTS=y
+CONFIG_SYS_SUPPORTS_HUGETLBFS=y
+CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM=y
+CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_HAVE_MEMBLOCK=y
+CONFIG_NO_BOOTMEM=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_HAVE_BOOTMEM_INFO_NODE is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_COMPACTION=y
+CONFIG_MIGRATION=y
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_BOUNCE=y
+CONFIG_KSM=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
+CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
+# CONFIG_MEMORY_FAILURE is not set
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+# CONFIG_ARCH_WANTS_THP_SWAP is not set
+CONFIG_TRANSPARENT_HUGE_PAGECACHE=y
+# CONFIG_CLEANCACHE is not set
+# CONFIG_FRONTSWAP is not set
+CONFIG_CMA=y
+# CONFIG_CMA_DEBUG is not set
+CONFIG_CMA_DEBUGFS=y
+CONFIG_CMA_AREAS=3
+# CONFIG_ZPOOL is not set
+# CONFIG_ZBUD is not set
+# CONFIG_ZSMALLOC is not set
+CONFIG_GENERIC_EARLY_IOREMAP=y
+# CONFIG_IDLE_PAGE_TRACKING is not set
+CONFIG_FRAME_VECTOR=y
+# CONFIG_PERCPU_STATS is not set
+# CONFIG_SECCOMP is not set
+# CONFIG_PARAVIRT is not set
+# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
+# CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
+# CONFIG_XEN is not set
+CONFIG_FORCE_MAX_ZONEORDER=11
+CONFIG_UNMAP_KERNEL_AT_EL0=y
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+# CONFIG_ARMV8_DEPRECATED is not set
+# CONFIG_ARM64_SW_TTBR0_PAN is not set
+
+#
+# ARMv8.1 architectural features
+#
+CONFIG_ARM64_HW_AFDBM=y
+CONFIG_ARM64_PAN=y
+# CONFIG_ARM64_LSE_ATOMICS is not set
+# CONFIG_ARM64_VHE is not set
+
+#
+# ARMv8.2 architectural features
+#
+CONFIG_ARM64_UAO=y
+# CONFIG_ARM64_PMEM is not set
+CONFIG_ARM64_MODULE_CMODEL_LARGE=y
+# CONFIG_RANDOMIZE_BASE is not set
+
+#
+# Boot options
+#
+CONFIG_CMDLINE="console=ttySAC0,115200n8 root=/dev/ram0 rw initrd=0x49000000,16M ramdisk=16384"
+# CONFIG_CMDLINE_FORCE is not set
+# CONFIG_EFI is not set
+
+#
+# Userspace binary formats
+#
+CONFIG_BINFMT_ELF=y
+CONFIG_COMPAT_BINFMT_ELF=y
+CONFIG_ELFCORE=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_BINFMT_SCRIPT=y
+# CONFIG_HAVE_AOUT is not set
+CONFIG_BINFMT_MISC=y
+CONFIG_COREDUMP=y
+CONFIG_COMPAT=y
+CONFIG_SYSVIPC_COMPAT=y
+
+#
+# Power management options
+#
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+# CONFIG_SUSPEND_SKIP_SYNC is not set
+# CONFIG_HIBERNATION is not set
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PM_AUTOSLEEP=y
+CONFIG_PM_WAKELOCKS=y
+CONFIG_PM_WAKELOCKS_LIMIT=100
+CONFIG_PM_WAKELOCKS_GC=y
+CONFIG_PM=y
+CONFIG_PM_DEBUG=y
+# CONFIG_PM_ADVANCED_DEBUG is not set
+# CONFIG_PM_TEST_SUSPEND is not set
+CONFIG_PM_SLEEP_DEBUG=y
+CONFIG_PM_CLK=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_CPU_PM=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+
+#
+# CPU Power Management
+#
+
+#
+# CPU Idle
+#
+CONFIG_CPU_IDLE=y
+# CONFIG_CPU_IDLE_GOV_LADDER is not set
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_DT_IDLE_STATES=y
+
+#
+# ARM CPU Idle Drivers
+#
+# CONFIG_ARM_CPUIDLE is not set
+CONFIG_ARM_NEXELL_CPUIDLE=y
+# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set
+
+#
+# CPU Frequency scaling
+#
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_STAT is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+# CONFIG_CPU_FREQ_GOV_SCHEDUTIL is not set
+
+#
+# CPU frequency scaling drivers
+#
+# CONFIG_CPUFREQ_DT is not set
+# CONFIG_ARM_BIG_LITTLE_CPUFREQ is not set
+# CONFIG_ARM_KIRKWOOD_CPUFREQ is not set
+CONFIG_ARM_NEXELL_CPUFREQ=y
+# CONFIG_ARM_NEXELL_CPUFREQ_DEBUG is not set
+# CONFIG_ARM_NEXELL_CPUFREQ_VOLTAGE_DEBUG is not set
+# CONFIG_ARM_DYNAMIC_CLUSTER_HOTPLUG is not set
+# CONFIG_NEXELL_CPUFREQ_PLL_0 is not set
+CONFIG_NEXELL_CPUFREQ_PLL_1=y
+CONFIG_NEXELL_CPUFREQ_PLLDEV=1
+# CONFIG_QORIQ_CPUFREQ is not set
+CONFIG_NET=y
+CONFIG_COMPAT_NETLINK_MESSAGES=y
+CONFIG_NET_INGRESS=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+# CONFIG_PACKET_DIAG is not set
+CONFIG_UNIX=y
+# CONFIG_UNIX_DIAG is not set
+# CONFIG_TLS is not set
+CONFIG_XFRM=y
+CONFIG_XFRM_ALGO=y
+CONFIG_XFRM_USER=y
+# CONFIG_XFRM_SUB_POLICY is not set
+CONFIG_XFRM_MIGRATE=y
+# CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=y
+CONFIG_NET_KEY=y
+CONFIG_NET_KEY_MIGRATE=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+# CONFIG_IP_FIB_TRIE_STATS is not set
+CONFIG_IP_MULTIPLE_TABLES=y
+# CONFIG_IP_ROUTE_MULTIPATH is not set
+# CONFIG_IP_ROUTE_VERBOSE is not set
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_IP_PNP_RARP=y
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE_DEMUX is not set
+# CONFIG_NET_IP_TUNNEL is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_SYN_COOKIES is not set
+# CONFIG_NET_IPVTI is not set
+# CONFIG_NET_UDP_TUNNEL is not set
+# CONFIG_NET_FOU is not set
+# CONFIG_INET_AH is not set
+CONFIG_INET_ESP=y
+# CONFIG_INET_ESP_OFFLOAD is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
+# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_INET_UDP_DIAG is not set
+# CONFIG_INET_RAW_DIAG is not set
+# CONFIG_INET_DIAG_DESTROY is not set
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
+CONFIG_IPV6=y
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_IPV6_OPTIMISTIC_DAD=y
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+# CONFIG_INET6_ESP_OFFLOAD is not set
+CONFIG_INET6_IPCOMP=y
+CONFIG_IPV6_MIP6=y
+# CONFIG_IPV6_ILA is not set
+CONFIG_INET6_XFRM_TUNNEL=y
+CONFIG_INET6_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_TRANSPORT=y
+CONFIG_INET6_XFRM_MODE_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_BEET=y
+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+# CONFIG_IPV6_VTI is not set
+# CONFIG_IPV6_SIT is not set
+# CONFIG_IPV6_TUNNEL is not set
+# CONFIG_IPV6_FOU is not set
+# CONFIG_IPV6_FOU_TUNNEL is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+# CONFIG_IPV6_SUBTREES is not set
+# CONFIG_IPV6_MROUTE is not set
+# CONFIG_IPV6_SEG6_LWTUNNEL is not set
+# CONFIG_IPV6_SEG6_HMAC is not set
+CONFIG_NETLABEL=y
+CONFIG_NETWORK_SECMARK=y
+# CONFIG_NET_PTP_CLASSIFY is not set
+# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
+CONFIG_NETFILTER=y
+CONFIG_NETFILTER_ADVANCED=y
+
+#
+# Core Netfilter Configuration
+#
+CONFIG_NETFILTER_INGRESS=y
+CONFIG_NETFILTER_NETLINK=y
+# CONFIG_NETFILTER_NETLINK_ACCT is not set
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+# CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_PROCFS=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+# CONFIG_NF_CONNTRACK_TIMEOUT is not set
+# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_GRE=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
+CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_BROADCAST=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+# CONFIG_NF_CONNTRACK_SNMP is not set
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+# CONFIG_NF_CONNTRACK_SIP is not set
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+# CONFIG_NF_CT_NETLINK_TIMEOUT is not set
+# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set
+# CONFIG_NF_TABLES is not set
+CONFIG_NETFILTER_XTABLES=y
+
+#
+# Xtables combined modules
+#
+CONFIG_NETFILTER_XT_MARK=y
+CONFIG_NETFILTER_XT_CONNMARK=y
+
+#
+# Xtables targets
+#
+# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
+# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
+# CONFIG_NETFILTER_XT_TARGET_CT is not set
+# CONFIG_NETFILTER_XT_TARGET_DSCP is not set
+# CONFIG_NETFILTER_XT_TARGET_HL is not set
+# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
+# CONFIG_NETFILTER_XT_TARGET_LED is not set
+# CONFIG_NETFILTER_XT_TARGET_LOG is not set
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
+# CONFIG_NETFILTER_XT_TARGET_RATEEST is not set
+# CONFIG_NETFILTER_XT_TARGET_TEE is not set
+CONFIG_NETFILTER_XT_TARGET_TPROXY=y
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
+CONFIG_NETFILTER_XT_TARGET_SECMARK=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+
+#
+# Xtables matches
+#
+# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set
+# CONFIG_NETFILTER_XT_MATCH_BPF is not set
+# CONFIG_NETFILTER_XT_MATCH_CGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_CLUSTER is not set
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+# CONFIG_NETFILTER_XT_MATCH_CONNBYTES is not set
+# CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+# CONFIG_NETFILTER_XT_MATCH_CPU is not set
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set
+# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
+CONFIG_NETFILTER_XT_MATCH_ECN=y
+# CONFIG_NETFILTER_XT_MATCH_ESP is not set
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_HL=y
+# CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set
+# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
+# CONFIG_NETFILTER_XT_MATCH_OSF is not set
+# CONFIG_NETFILTER_XT_MATCH_OWNER is not set
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+# CONFIG_NETFILTER_XT_MATCH_RATEEST is not set
+# CONFIG_NETFILTER_XT_MATCH_REALM is not set
+# CONFIG_NETFILTER_XT_MATCH_RECENT is not set
+# CONFIG_NETFILTER_XT_MATCH_SCTP is not set
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+# CONFIG_NETFILTER_XT_MATCH_TCPMSS is not set
+CONFIG_NETFILTER_XT_MATCH_TIME=y
+CONFIG_NETFILTER_XT_MATCH_U32=y
+# CONFIG_IP_SET is not set
+# CONFIG_IP_VS is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV4=y
+CONFIG_NF_CONNTRACK_IPV4=y
+# CONFIG_NF_SOCKET_IPV4 is not set
+# CONFIG_NF_DUP_IPV4 is not set
+# CONFIG_NF_LOG_ARP is not set
+# CONFIG_NF_LOG_IPV4 is not set
+CONFIG_NF_REJECT_IPV4=y
+# CONFIG_NF_NAT_IPV4 is not set
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+# CONFIG_IP_NF_MATCH_RPFILTER is not set
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_TARGET_REJECT=y
+# CONFIG_IP_NF_TARGET_SYNPROXY is not set
+# CONFIG_IP_NF_NAT is not set
+CONFIG_IP_NF_MANGLE=y
+# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
+# CONFIG_IP_NF_TARGET_ECN is not set
+# CONFIG_IP_NF_TARGET_TTL is not set
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_SECURITY=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+
+#
+# IPv6: Netfilter Configuration
+#
+CONFIG_NF_DEFRAG_IPV6=y
+CONFIG_NF_CONNTRACK_IPV6=y
+# CONFIG_NF_SOCKET_IPV6 is not set
+# CONFIG_NF_DUP_IPV6 is not set
+CONFIG_NF_REJECT_IPV6=y
+# CONFIG_NF_LOG_IPV6 is not set
+# CONFIG_NF_NAT_IPV6 is not set
+CONFIG_IP6_NF_IPTABLES=y
+# CONFIG_IP6_NF_MATCH_AH is not set
+# CONFIG_IP6_NF_MATCH_EUI64 is not set
+# CONFIG_IP6_NF_MATCH_FRAG is not set
+# CONFIG_IP6_NF_MATCH_OPTS is not set
+# CONFIG_IP6_NF_MATCH_HL is not set
+# CONFIG_IP6_NF_MATCH_IPV6HEADER is not set
+# CONFIG_IP6_NF_MATCH_MH is not set
+# CONFIG_IP6_NF_MATCH_RPFILTER is not set
+# CONFIG_IP6_NF_MATCH_RT is not set
+# CONFIG_IP6_NF_TARGET_HL is not set
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+# CONFIG_IP6_NF_TARGET_SYNPROXY is not set
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_RAW=y
+# CONFIG_IP6_NF_SECURITY is not set
+# CONFIG_IP6_NF_NAT is not set
+# CONFIG_IP_DCCP is not set
+# CONFIG_IP_SCTP is not set
+# CONFIG_RDS is not set
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_L2TP is not set
+# CONFIG_BRIDGE is not set
+CONFIG_HAVE_NET_DSA=y
+# CONFIG_NET_DSA is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_PHONET is not set
+# CONFIG_6LOWPAN is not set
+# CONFIG_IEEE802154 is not set
+CONFIG_NET_SCHED=y
+
+#
+# Queueing/Scheduling
+#
+# CONFIG_NET_SCH_CBQ is not set
+CONFIG_NET_SCH_HTB=y
+# CONFIG_NET_SCH_HFSC is not set
+# CONFIG_NET_SCH_PRIO is not set
+# CONFIG_NET_SCH_MULTIQ is not set
+# CONFIG_NET_SCH_RED is not set
+# CONFIG_NET_SCH_SFB is not set
+# CONFIG_NET_SCH_SFQ is not set
+# CONFIG_NET_SCH_TEQL is not set
+# CONFIG_NET_SCH_TBF is not set
+# CONFIG_NET_SCH_GRED is not set
+# CONFIG_NET_SCH_DSMARK is not set
+# CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_DRR is not set
+# CONFIG_NET_SCH_MQPRIO is not set
+# CONFIG_NET_SCH_CHOKE is not set
+# CONFIG_NET_SCH_QFQ is not set
+# CONFIG_NET_SCH_CODEL is not set
+# CONFIG_NET_SCH_FQ_CODEL is not set
+# CONFIG_NET_SCH_FQ is not set
+# CONFIG_NET_SCH_HHF is not set
+# CONFIG_NET_SCH_PIE is not set
+# CONFIG_NET_SCH_INGRESS is not set
+# CONFIG_NET_SCH_PLUG is not set
+# CONFIG_NET_SCH_DEFAULT is not set
+
+#
+# Classification
+#
+CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_BASIC is not set
+# CONFIG_NET_CLS_TCINDEX is not set
+# CONFIG_NET_CLS_ROUTE4 is not set
+# CONFIG_NET_CLS_FW is not set
+CONFIG_NET_CLS_U32=y
+# CONFIG_CLS_U32_PERF is not set
+# CONFIG_CLS_U32_MARK is not set
+# CONFIG_NET_CLS_RSVP is not set
+# CONFIG_NET_CLS_RSVP6 is not set
+# CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_CLS_CGROUP is not set
+# CONFIG_NET_CLS_BPF is not set
+# CONFIG_NET_CLS_FLOWER is not set
+# CONFIG_NET_CLS_MATCHALL is not set
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_STACK=32
+# CONFIG_NET_EMATCH_CMP is not set
+# CONFIG_NET_EMATCH_NBYTE is not set
+CONFIG_NET_EMATCH_U32=y
+# CONFIG_NET_EMATCH_META is not set
+# CONFIG_NET_EMATCH_TEXT is not set
+CONFIG_NET_CLS_ACT=y
+# CONFIG_NET_ACT_POLICE is not set
+# CONFIG_NET_ACT_GACT is not set
+# CONFIG_NET_ACT_MIRRED is not set
+# CONFIG_NET_ACT_SAMPLE is not set
+# CONFIG_NET_ACT_IPT is not set
+# CONFIG_NET_ACT_NAT is not set
+# CONFIG_NET_ACT_PEDIT is not set
+# CONFIG_NET_ACT_SIMP is not set
+# CONFIG_NET_ACT_SKBEDIT is not set
+# CONFIG_NET_ACT_CSUM is not set
+# CONFIG_NET_ACT_VLAN is not set
+# CONFIG_NET_ACT_BPF is not set
+# CONFIG_NET_ACT_CONNMARK is not set
+# CONFIG_NET_ACT_SKBMOD is not set
+# CONFIG_NET_ACT_IFE is not set
+# CONFIG_NET_ACT_TUNNEL_KEY is not set
+# CONFIG_NET_CLS_IND is not set
+CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
+CONFIG_DNS_RESOLVER=y
+# CONFIG_BATMAN_ADV is not set
+# CONFIG_OPENVSWITCH is not set
+# CONFIG_VSOCKETS is not set
+# CONFIG_NETLINK_DIAG is not set
+# CONFIG_MPLS is not set
+# CONFIG_NET_NSH is not set
+# CONFIG_HSR is not set
+# CONFIG_NET_SWITCHDEV is not set
+# CONFIG_NET_L3_MASTER_DEV is not set
+# CONFIG_NET_NCSI is not set
+CONFIG_RPS=y
+CONFIG_RFS_ACCEL=y
+CONFIG_XPS=y
+# CONFIG_CGROUP_NET_PRIO is not set
+# CONFIG_CGROUP_NET_CLASSID is not set
+CONFIG_NET_RX_BUSY_POLL=y
+CONFIG_BQL=y
+# CONFIG_BPF_JIT is not set
+# CONFIG_BPF_STREAM_PARSER is not set
+CONFIG_NET_FLOW_LIMIT=y
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_NET_DROP_MONITOR is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
+CONFIG_BT=m
+CONFIG_BT_BREDR=y
+CONFIG_BT_RFCOMM=m
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_HIDP=m
+CONFIG_BT_HS=y
+CONFIG_BT_LE=y
+# CONFIG_BT_LEDS is not set
+# CONFIG_BT_SELFTEST is not set
+CONFIG_BT_DEBUGFS=y
+
+#
+# Bluetooth device drivers
+#
+CONFIG_BT_INTEL=m
+CONFIG_BT_BCM=m
+CONFIG_BT_RTL=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIBTUSB_BCM=y
+CONFIG_BT_HCIBTUSB_RTL=y
+# CONFIG_BT_HCIBTSDIO is not set
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_H4=y
+# CONFIG_BT_HCIUART_BCSP is not set
+# CONFIG_BT_HCIUART_ATH3K is not set
+# CONFIG_BT_HCIUART_3WIRE is not set
+# CONFIG_BT_HCIUART_INTEL is not set
+# CONFIG_BT_HCIUART_QCA is not set
+# CONFIG_BT_HCIUART_AG6XX is not set
+# CONFIG_BT_HCIUART_MRVL is not set
+# CONFIG_BT_HCIBCM203X is not set
+# CONFIG_BT_HCIBPA10X is not set
+# CONFIG_BT_HCIBFUSB is not set
+# CONFIG_BT_HCIVHCI is not set
+# CONFIG_BT_MRVL is not set
+# CONFIG_BT_ATH3K is not set
+# CONFIG_AF_RXRPC is not set
+# CONFIG_AF_KCM is not set
+# CONFIG_STREAM_PARSER is not set
+CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
+CONFIG_WEXT_CORE=y
+CONFIG_WEXT_PROC=y
+CONFIG_CFG80211=m
+CONFIG_NL80211_TESTMODE=y
+# CONFIG_CFG80211_DEVELOPER_WARNINGS is not set
+# CONFIG_CFG80211_CERTIFICATION_ONUS is not set
+# CONFIG_CFG80211_DEFAULT_PS is not set
+CONFIG_CFG80211_DEBUGFS=y
+# CONFIG_CFG80211_INTERNAL_REGDB is not set
+CONFIG_CFG80211_CRDA_SUPPORT=y
+CONFIG_CFG80211_WEXT=y
+# CONFIG_LIB80211 is not set
+CONFIG_MAC80211=m
+CONFIG_MAC80211_HAS_RC=y
+CONFIG_MAC80211_RC_MINSTREL=y
+CONFIG_MAC80211_RC_MINSTREL_HT=y
+# CONFIG_MAC80211_RC_MINSTREL_VHT is not set
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel_ht"
+CONFIG_MAC80211_MESH=y
+# CONFIG_MAC80211_LEDS is not set
+CONFIG_MAC80211_DEBUGFS=y
+# CONFIG_MAC80211_MESSAGE_TRACING is not set
+# CONFIG_MAC80211_DEBUG_MENU is not set
+CONFIG_MAC80211_STA_HASH_MAX_SIZE=0
+# CONFIG_WIMAX is not set
+CONFIG_RFKILL=m
+CONFIG_RFKILL_LEDS=y
+# CONFIG_RFKILL_INPUT is not set
+CONFIG_RFKILL_GPIO=m
+CONFIG_NET_9P=y
+# CONFIG_NET_9P_DEBUG is not set
+# CONFIG_CAIF is not set
+# CONFIG_CEPH_LIB is not set
+# CONFIG_NFC is not set
+# CONFIG_PSAMPLE is not set
+# CONFIG_NET_IFE is not set
+# CONFIG_LWTUNNEL is not set
+# CONFIG_DST_CACHE is not set
+CONFIG_GRO_CELLS=y
+# CONFIG_NET_DEVLINK is not set
+CONFIG_MAY_USE_DEVLINK=y
+CONFIG_HAVE_EBPF_JIT=y
+
+#
+# Device Drivers
+#
+CONFIG_ARM_AMBA=y
+
+#
+# Generic Driver Options
+#
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH=""
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_FW_LOADER=y
+CONFIG_FIRMWARE_IN_KERNEL=y
+CONFIG_EXTRA_FIRMWARE=""
+# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
+CONFIG_ALLOW_DEV_COREDUMP=y
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
+# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
+# CONFIG_SYS_HYPERVISOR is not set
+# CONFIG_GENERIC_CPU_DEVICES is not set
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_SPI=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_DMA_SHARED_BUFFER=y
+# CONFIG_DMA_FENCE_TRACE is not set
+CONFIG_DMA_CMA=y
+
+#
+# Default contiguous memory area size:
+#
+CONFIG_CMA_SIZE_MBYTES=128
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+
+#
+# Bus devices
+#
+# CONFIG_ARM_CCI400_PMU is not set
+# CONFIG_ARM_CCI5xx_PMU is not set
+# CONFIG_ARM_CCN is not set
+# CONFIG_BRCMSTB_GISB_ARB is not set
+# CONFIG_SIMPLE_PM_BUS is not set
+# CONFIG_VEXPRESS_CONFIG is not set
+# CONFIG_CONNECTOR is not set
+# CONFIG_MTD is not set
+CONFIG_DTC=y
+CONFIG_OF=y
+# CONFIG_OF_UNITTEST is not set
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_NET=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_RESERVED_MEM=y
+# CONFIG_OF_OVERLAY is not set
+# CONFIG_PARPORT is not set
+CONFIG_BLK_DEV=y
+# CONFIG_BLK_DEV_NULL_BLK is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+# CONFIG_BLK_DEV_DRBD is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_RAM is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_RBD is not set
+# CONFIG_NVME_FC is not set
+# CONFIG_NVME_TARGET is not set
+
+#
+# Misc devices
+#
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_AD525X_DPOT is not set
+# CONFIG_DUMMY_IRQ is not set
+# CONFIG_ICS932S401 is not set
+# CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_APDS9802ALS is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_ISL29020 is not set
+# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_SENSORS_BH1770 is not set
+# CONFIG_SENSORS_APDS990X is not set
+# CONFIG_HMC6352 is not set
+# CONFIG_DS1682 is not set
+# CONFIG_TI_DAC7512 is not set
+# CONFIG_USB_SWITCH_FSA9480 is not set
+# CONFIG_LATTICE_ECP3_CONFIG is not set
+# CONFIG_SRAM is not set
+CONFIG_NX_SCALER=m
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_AT25 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_EEPROM_93XX46 is not set
+# CONFIG_EEPROM_IDT_89HPESX is not set
+
+#
+# Texas Instruments shared transport line discipline
+#
+# CONFIG_TI_ST is not set
+# CONFIG_SENSORS_LIS3_SPI is not set
+# CONFIG_SENSORS_LIS3_I2C is not set
+
+#
+# Altera FPGA firmware download module
+#
+# CONFIG_ALTERA_STAPL is not set
+
+#
+# Intel MIC Bus Driver
+#
+
+#
+# SCIF Bus Driver
+#
+
+#
+# VOP Bus Driver
+#
+
+#
+# Intel MIC Host Driver
+#
+
+#
+# Intel MIC Card Driver
+#
+
+#
+# SCIF Driver
+#
+
+#
+# Intel MIC Coprocessor State Management (COSM) Drivers
+#
+
+#
+# VOP Driver
+#
+# CONFIG_ECHO is not set
+# CONFIG_CXL_BASE is not set
+# CONFIG_CXL_AFU_DRIVER_OPS is not set
+# CONFIG_CXL_LIB is not set
+
+#
+# SCSI device support
+#
+CONFIG_SCSI_MOD=y
+# CONFIG_RAID_ATTRS is not set
+CONFIG_SCSI=y
+CONFIG_SCSI_DMA=y
+# CONFIG_SCSI_NETLINK is not set
+# CONFIG_SCSI_MQ_DEFAULT is not set
+CONFIG_SCSI_PROC_FS=y
+
+#
+# SCSI support type (disk, tape, CD-ROM)
+#
+CONFIG_BLK_DEV_SD=y
+# CONFIG_CHR_DEV_ST is not set
+# CONFIG_CHR_DEV_OSST is not set
+# CONFIG_BLK_DEV_SR is not set
+CONFIG_CHR_DEV_SG=y
+# CONFIG_CHR_DEV_SCH is not set
+# CONFIG_SCSI_CONSTANTS is not set
+# CONFIG_SCSI_LOGGING is not set
+# CONFIG_SCSI_SCAN_ASYNC is not set
+
+#
+# SCSI Transports
+#
+# CONFIG_SCSI_SPI_ATTRS is not set
+# CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
+# CONFIG_SCSI_SRP_ATTRS is not set
+CONFIG_SCSI_LOWLEVEL=y
+# CONFIG_ISCSI_TCP is not set
+# CONFIG_ISCSI_BOOT_SYSFS is not set
+# CONFIG_SCSI_UFSHCD is not set
+# CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_LOWLEVEL_PCMCIA is not set
+# CONFIG_SCSI_DH is not set
+# CONFIG_SCSI_OSD_INITIATOR is not set
+CONFIG_HAVE_PATA_PLATFORM=y
+# CONFIG_ATA is not set
+CONFIG_MD=y
+# CONFIG_BLK_DEV_MD is not set
+# CONFIG_BCACHE is not set
+CONFIG_BLK_DEV_DM_BUILTIN=y
+CONFIG_BLK_DEV_DM=y
+# CONFIG_DM_MQ_DEFAULT is not set
+# CONFIG_DM_DEBUG is not set
+CONFIG_DM_CRYPT=y
+# CONFIG_DM_SNAPSHOT is not set
+# CONFIG_DM_THIN_PROVISIONING is not set
+# CONFIG_DM_CACHE is not set
+# CONFIG_DM_ERA is not set
+# CONFIG_DM_MIRROR is not set
+# CONFIG_DM_RAID is not set
+# CONFIG_DM_ZERO is not set
+# CONFIG_DM_MULTIPATH is not set
+# CONFIG_DM_DELAY is not set
+CONFIG_DM_UEVENT=y
+# CONFIG_DM_FLAKEY is not set
+# CONFIG_DM_VERITY is not set
+# CONFIG_DM_SWITCH is not set
+# CONFIG_DM_LOG_WRITES is not set
+# CONFIG_DM_INTEGRITY is not set
+# CONFIG_TARGET_CORE is not set
+CONFIG_NETDEVICES=y
+CONFIG_MII=y
+CONFIG_NET_CORE=y
+# CONFIG_BONDING is not set
+# CONFIG_DUMMY is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_IFB is not set
+# CONFIG_NET_TEAM is not set
+# CONFIG_MACVLAN is not set
+# CONFIG_VXLAN is not set
+# CONFIG_MACSEC is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_TUN is not set
+# CONFIG_TUN_VNET_CROSS_LE is not set
+# CONFIG_VETH is not set
+# CONFIG_NLMON is not set
+
+#
+# CAIF transport drivers
+#
+
+#
+# Distributed Switch Architecture drivers
+#
+CONFIG_ETHERNET=y
+# CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_ALTERA_TSE is not set
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_AURORA is not set
+# CONFIG_NET_CADENCE is not set
+# CONFIG_NET_VENDOR_BROADCOM is not set
+# CONFIG_DNET is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+CONFIG_NET_VENDOR_HUAWEI=y
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+CONFIG_NET_VENDOR_MELLANOX=y
+# CONFIG_MLXSW_CORE is not set
+# CONFIG_MLXFW is not set
+# CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_MICROCHIP is not set
+# CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_ETHOC is not set
+# CONFIG_NET_VENDOR_QUALCOMM is not set
+# CONFIG_NET_VENDOR_RENESAS is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SAMSUNG is not set
+# CONFIG_NET_VENDOR_SEEQ is not set
+# CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SMSC is not set
+CONFIG_NET_VENDOR_STMICRO=y
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+# CONFIG_DWMAC_DWC_QOS_ETH is not set
+# CONFIG_DWMAC_GENERIC is not set
+CONFIG_DWMAC_NEXELL=y
+# CONFIG_NET_VENDOR_VIA is not set
+# CONFIG_NET_VENDOR_WIZNET is not set
+CONFIG_NET_VENDOR_SYNOPSYS=y
+# CONFIG_DWC_XLGMAC is not set
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_BUS=y
+# CONFIG_MDIO_BCM_UNIMAC is not set
+# CONFIG_MDIO_BITBANG is not set
+# CONFIG_MDIO_BUS_MUX_GPIO is not set
+# CONFIG_MDIO_BUS_MUX_MMIOREG is not set
+# CONFIG_MDIO_HISI_FEMAC is not set
+# CONFIG_MDIO_OCTEON is not set
+CONFIG_PHYLIB=y
+CONFIG_SWPHY=y
+# CONFIG_LED_TRIGGER_PHY is not set
+
+#
+# MII PHY device drivers
+#
+# CONFIG_AMD_PHY is not set
+# CONFIG_AQUANTIA_PHY is not set
+# CONFIG_AT803X_PHY is not set
+# CONFIG_BCM7XXX_PHY is not set
+# CONFIG_BCM87XX_PHY is not set
+# CONFIG_BROADCOM_PHY is not set
+# CONFIG_CICADA_PHY is not set
+# CONFIG_CORTINA_PHY is not set
+# CONFIG_DAVICOM_PHY is not set
+# CONFIG_DP83848_PHY is not set
+# CONFIG_DP83867_PHY is not set
+CONFIG_FIXED_PHY=y
+# CONFIG_ICPLUS_PHY is not set
+# CONFIG_INTEL_XWAY_PHY is not set
+# CONFIG_LSI_ET1011C_PHY is not set
+# CONFIG_LXT_PHY is not set
+# CONFIG_MARVELL_PHY is not set
+# CONFIG_MARVELL_10G_PHY is not set
+# CONFIG_MICREL_PHY is not set
+# CONFIG_MICROCHIP_PHY is not set
+# CONFIG_MICROSEMI_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_QSEMI_PHY is not set
+CONFIG_REALTEK_PHY=y
+# CONFIG_ROCKCHIP_PHY is not set
+# CONFIG_SMSC_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_TERANETICS_PHY is not set
+# CONFIG_VITESSE_PHY is not set
+# CONFIG_XILINX_GMII2RGMII is not set
+# CONFIG_MICREL_KS8995MA is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+CONFIG_USB_NET_DRIVERS=y
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_RTL8152 is not set
+# CONFIG_USB_LAN78XX is not set
+CONFIG_USB_USBNET=y
+# CONFIG_USB_NET_AX8817X is not set
+# CONFIG_USB_NET_AX88179_178A is not set
+CONFIG_USB_NET_CDCETHER=y
+# CONFIG_USB_NET_CDC_EEM is not set
+# CONFIG_USB_NET_CDC_NCM is not set
+# CONFIG_USB_NET_HUAWEI_CDC_NCM is not set
+# CONFIG_USB_NET_CDC_MBIM is not set
+# CONFIG_USB_NET_DM9601 is not set
+# CONFIG_USB_NET_SR9700 is not set
+# CONFIG_USB_NET_SR9800 is not set
+# CONFIG_USB_NET_SMSC75XX is not set
+# CONFIG_USB_NET_SMSC95XX is not set
+# CONFIG_USB_NET_GL620A is not set
+# CONFIG_USB_NET_NET1080 is not set
+# CONFIG_USB_NET_PLUSB is not set
+# CONFIG_USB_NET_MCS7830 is not set
+# CONFIG_USB_NET_RNDIS_HOST is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+# CONFIG_USB_NET_ZAURUS is not set
+# CONFIG_USB_NET_CX82310_ETH is not set
+# CONFIG_USB_NET_KALMIA is not set
+# CONFIG_USB_NET_QMI_WWAN is not set
+# CONFIG_USB_HSO is not set
+# CONFIG_USB_NET_INT51X1 is not set
+# CONFIG_USB_IPHETH is not set
+# CONFIG_USB_SIERRA_NET is not set
+# CONFIG_USB_VL600 is not set
+# CONFIG_USB_NET_CH9200 is not set
+CONFIG_WLAN=y
+# CONFIG_WIRELESS_WDS is not set
+# CONFIG_WLAN_VENDOR_ADMTEK is not set
+# CONFIG_WLAN_VENDOR_ATH is not set
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_BCMDHD is not set
+CONFIG_WLAN_VENDOR_BROADCOM=y
+# CONFIG_B43 is not set
+# CONFIG_B43LEGACY is not set
+CONFIG_BRCMUTIL=m
+# CONFIG_BRCMSMAC is not set
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_PROTO_BCDC=y
+CONFIG_BRCMFMAC_SDIO=y
+# CONFIG_BRCMFMAC_USB is not set
+# CONFIG_BRCM_TRACING is not set
+# CONFIG_BRCMDBG is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+CONFIG_WLAN_VENDOR_RALINK=y
+CONFIG_RT2X00=m
+# CONFIG_RT2500USB is not set
+CONFIG_RT73USB=m
+# CONFIG_RT2800USB is not set
+CONFIG_RT2X00_LIB_USB=m
+CONFIG_RT2X00_LIB=m
+CONFIG_RT2X00_LIB_FIRMWARE=y
+CONFIG_RT2X00_LIB_CRYPTO=y
+CONFIG_RT2X00_LIB_LEDS=y
+# CONFIG_RT2X00_LIB_DEBUGFS is not set
+# CONFIG_RT2X00_DEBUG is not set
+# CONFIG_WLAN_VENDOR_REALTEK is not set
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_ST is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+CONFIG_WLAN_VENDOR_QUANTENNA=y
+# CONFIG_MAC80211_HWSIM is not set
+# CONFIG_USB_NET_RNDIS_WLAN is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+# CONFIG_WAN is not set
+# CONFIG_ISDN is not set
+# CONFIG_NVM is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+CONFIG_INPUT_LEDS=y
+CONFIG_INPUT_FF_MEMLESS=y
+# CONFIG_INPUT_POLLDEV is not set
+# CONFIG_INPUT_SPARSEKMAP is not set
+# CONFIG_INPUT_MATRIXKMAP is not set
+
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_EVBUG is not set
+
+#
+# Input Device Drivers
+#
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TABLET is not set
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_PROPERTIES=y
+# CONFIG_TOUCHSCREEN_ADS7846 is not set
+# CONFIG_TOUCHSCREEN_AD7877 is not set
+# CONFIG_TOUCHSCREEN_AD7879 is not set
+# CONFIG_TOUCHSCREEN_AR1021_I2C is not set
+# CONFIG_TOUCHSCREEN_ATMEL_MXT is not set
+# CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_BU21013 is not set
+# CONFIG_TOUCHSCREEN_CHIPONE_ICN8318 is not set
+# CONFIG_TOUCHSCREEN_CY8CTMG110 is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set
+# CONFIG_TOUCHSCREEN_DYNAPRO is not set
+# CONFIG_TOUCHSCREEN_HAMPSHIRE is not set
+# CONFIG_TOUCHSCREEN_EETI is not set
+# CONFIG_TOUCHSCREEN_EGALAX is not set
+# CONFIG_TOUCHSCREEN_EGALAX_SERIAL is not set
+# CONFIG_TOUCHSCREEN_FUJITSU is not set
+CONFIG_TOUCHSCREEN_GOODIX=m
+# CONFIG_TOUCHSCREEN_ILI210X is not set
+# CONFIG_TOUCHSCREEN_GUNZE is not set
+# CONFIG_TOUCHSCREEN_EKTF2127 is not set
+# CONFIG_TOUCHSCREEN_ELAN is not set
+# CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
+# CONFIG_TOUCHSCREEN_WACOM_I2C is not set
+# CONFIG_TOUCHSCREEN_MAX11801 is not set
+# CONFIG_TOUCHSCREEN_MCS5000 is not set
+# CONFIG_TOUCHSCREEN_MMS114 is not set
+# CONFIG_TOUCHSCREEN_MELFAS_MIP4 is not set
+# CONFIG_TOUCHSCREEN_MTOUCH is not set
+# CONFIG_TOUCHSCREEN_IMX6UL_TSC is not set
+# CONFIG_TOUCHSCREEN_INEXIO is not set
+# CONFIG_TOUCHSCREEN_MK712 is not set
+# CONFIG_TOUCHSCREEN_PENMOUNT is not set
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
+# CONFIG_TOUCHSCREEN_TOUCHWIN is not set
+# CONFIG_TOUCHSCREEN_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set
+# CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
+# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TSC_SERIO is not set
+# CONFIG_TOUCHSCREEN_TSC2004 is not set
+# CONFIG_TOUCHSCREEN_TSC2005 is not set
+# CONFIG_TOUCHSCREEN_TSC2007 is not set
+# CONFIG_TOUCHSCREEN_RM_TS is not set
+# CONFIG_TOUCHSCREEN_SILEAD is not set
+# CONFIG_TOUCHSCREEN_SIS_I2C is not set
+# CONFIG_TOUCHSCREEN_ST1232 is not set
+# CONFIG_TOUCHSCREEN_STMFTS is not set
+# CONFIG_TOUCHSCREEN_SUR40 is not set
+# CONFIG_TOUCHSCREEN_SURFACE3_SPI is not set
+# CONFIG_TOUCHSCREEN_SX8654 is not set
+# CONFIG_TOUCHSCREEN_TPS6507X is not set
+# CONFIG_TOUCHSCREEN_ZET6223 is not set
+# CONFIG_TOUCHSCREEN_ZFORCE is not set
+# CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set
+CONFIG_TOUCHSCREEN_IT7260=m
+CONFIG_TOUCHSCREEN_HIMAX=m
+CONFIG_TOUCHSCREEN_1WIRE=y
+CONFIG_SENSOR_LOADER_1WIRE=m
+# CONFIG_INPUT_MISC is not set
+# CONFIG_RMI4_CORE is not set
+
+#
+# Hardware I/O ports
+#
+# CONFIG_SERIO is not set
+# CONFIG_GAMEPORT is not set
+
+#
+# Character devices
+#
+CONFIG_TTY=y
+CONFIG_VT=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_HW_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_UNIX98_PTYS=y
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_N_GSM is not set
+# CONFIG_TRACE_SINK is not set
+CONFIG_DEVMEM=y
+
+#
+# Serial drivers
+#
+CONFIG_SERIAL_EARLYCON=y
+# CONFIG_SERIAL_8250 is not set
+
+#
+# Non-8250 serial port support
+#
+# CONFIG_SERIAL_AMBA_PL010 is not set
+# CONFIG_SERIAL_AMBA_PL011 is not set
+# CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST is not set
+# CONFIG_SERIAL_KGDB_NMI is not set
+CONFIG_SERIAL_SAMSUNG=y
+CONFIG_SERIAL_SAMSUNG_UARTS_4=y
+CONFIG_SERIAL_SAMSUNG_UARTS=6
+CONFIG_SERIAL_SAMSUNG_CONSOLE=y
+# CONFIG_SERIAL_MAX3100 is not set
+# CONFIG_SERIAL_MAX310X is not set
+# CONFIG_SERIAL_UARTLITE is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_CONSOLE_POLL=y
+# CONFIG_SERIAL_SCCNXP is not set
+# CONFIG_SERIAL_SC16IS7XX is not set
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
+# CONFIG_SERIAL_IFX6X60 is not set
+# CONFIG_SERIAL_XILINX_PS_UART is not set
+# CONFIG_SERIAL_ARC is not set
+# CONFIG_SERIAL_FSL_LPUART is not set
+# CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set
+# CONFIG_SERIAL_DEV_BUS is not set
+# CONFIG_TTY_PRINTK is not set
+# CONFIG_HVC_DCC is not set
+# CONFIG_IPMI_HANDLER is not set
+CONFIG_HW_RANDOM=y
+# CONFIG_HW_RANDOM_TIMERIOMEM is not set
+# CONFIG_R3964 is not set
+
+#
+# PCMCIA character devices
+#
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_TCG_TPM is not set
+# CONFIG_XILLYBUS is not set
+
+#
+# I2C support
+#
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_CHARDEV=y
+# CONFIG_I2C_MUX is not set
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_ALGOBIT=y
+
+#
+# I2C Hardware Bus support
+#
+
+#
+# I2C system bus drivers (mostly embedded / system-on-chip)
+#
+# CONFIG_I2C_CADENCE is not set
+# CONFIG_I2C_CBUS_GPIO is not set
+# CONFIG_I2C_DESIGNWARE_PLATFORM is not set
+# CONFIG_I2C_EMEV2 is not set
+CONFIG_I2C_GPIO=y
+# CONFIG_I2C_NOMADIK is not set
+# CONFIG_I2C_OCORES is not set
+# CONFIG_I2C_PCA_PLATFORM is not set
+# CONFIG_I2C_PXA_PCI is not set
+# CONFIG_I2C_RK3X is not set
+CONFIG_HAVE_S3C2410_I2C=y
+CONFIG_I2C_S3C2410=y
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_XILINX is not set
+
+#
+# External I2C/SMBus adapter drivers
+#
+# CONFIG_I2C_DIOLAN_U2C is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_ROBOTFUZZ_OSIF is not set
+# CONFIG_I2C_TAOS_EVM is not set
+# CONFIG_I2C_TINY_USB is not set
+
+#
+# Other I2C/SMBus bus drivers
+#
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_SLAVE is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+CONFIG_SPI=y
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_MASTER=y
+
+#
+# SPI Master Controller Drivers
+#
+# CONFIG_SPI_ALTERA is not set
+# CONFIG_SPI_AXI_SPI_ENGINE is not set
+# CONFIG_SPI_BITBANG is not set
+# CONFIG_SPI_CADENCE is not set
+# CONFIG_SPI_DESIGNWARE is not set
+# CONFIG_SPI_GPIO is not set
+# CONFIG_SPI_FSL_SPI is not set
+# CONFIG_SPI_OC_TINY is not set
+# CONFIG_SPI_PL022 is not set
+# CONFIG_SPI_PXA2XX_PCI is not set
+# CONFIG_SPI_ROCKCHIP is not set
+# CONFIG_SPI_SC18IS602 is not set
+# CONFIG_SPI_XCOMM is not set
+# CONFIG_SPI_XILINX is not set
+# CONFIG_SPI_ZYNQMP_GQSPI is not set
+
+#
+# SPI Protocol Masters
+#
+CONFIG_SPI_SPIDEV=y
+# CONFIG_SPI_LOOPBACK_TEST is not set
+# CONFIG_SPI_TLE62X0 is not set
+# CONFIG_SPI_SLAVE is not set
+# CONFIG_SPMI is not set
+# CONFIG_HSI is not set
+CONFIG_PPS=y
+# CONFIG_PPS_DEBUG is not set
+
+#
+# PPS clients support
+#
+# CONFIG_PPS_CLIENT_KTIMER is not set
+# CONFIG_PPS_CLIENT_LDISC is not set
+# CONFIG_PPS_CLIENT_GPIO is not set
+
+#
+# PPS generators support
+#
+
+#
+# PTP clock support
+#
+# CONFIG_PTP_1588_CLOCK is not set
+
+#
+# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks.
+#
+CONFIG_PINCTRL=y
+
+#
+# Pin controllers
+#
+CONFIG_PINMUX=y
+CONFIG_PINCONF=y
+# CONFIG_DEBUG_PINCTRL is not set
+# CONFIG_PINCTRL_AMD is not set
+# CONFIG_PINCTRL_MCP23S08 is not set
+# CONFIG_PINCTRL_SINGLE is not set
+# CONFIG_PINCTRL_SX150X is not set
+CONFIG_PINCTRL_NEXELL=y
+CONFIG_GPIOLIB=y
+CONFIG_OF_GPIO=y
+# CONFIG_DEBUG_GPIO is not set
+CONFIG_GPIO_SYSFS=y
+
+#
+# Memory mapped GPIO drivers
+#
+# CONFIG_GPIO_74XX_MMIO is not set
+# CONFIG_GPIO_ALTERA is not set
+# CONFIG_GPIO_DWAPB is not set
+# CONFIG_GPIO_FTGPIO010 is not set
+# CONFIG_GPIO_GENERIC_PLATFORM is not set
+# CONFIG_GPIO_GRGPIO is not set
+# CONFIG_GPIO_MOCKUP is not set
+# CONFIG_GPIO_PL061 is not set
+# CONFIG_GPIO_SYSCON is not set
+# CONFIG_GPIO_XGENE is not set
+# CONFIG_GPIO_XILINX is not set
+
+#
+# I2C GPIO expanders
+#
+# CONFIG_GPIO_ADP5588 is not set
+# CONFIG_GPIO_ADNP is not set
+# CONFIG_GPIO_MAX7300 is not set
+# CONFIG_GPIO_MAX732X is not set
+# CONFIG_GPIO_PCA953X is not set
+# CONFIG_GPIO_PCF857X is not set
+# CONFIG_GPIO_SX150X is not set
+# CONFIG_GPIO_TPIC2810 is not set
+
+#
+# MFD GPIO expanders
+#
+
+#
+# SPI GPIO expanders
+#
+# CONFIG_GPIO_74X164 is not set
+# CONFIG_GPIO_MAX7301 is not set
+# CONFIG_GPIO_MC33880 is not set
+# CONFIG_GPIO_PISOSR is not set
+# CONFIG_GPIO_XRA1403 is not set
+
+#
+# USB GPIO expanders
+#
+# CONFIG_W1 is not set
+# CONFIG_POWER_AVS is not set
+CONFIG_POWER_RESET=y
+# CONFIG_POWER_RESET_BRCMSTB is not set
+# CONFIG_POWER_RESET_GPIO is not set
+# CONFIG_POWER_RESET_GPIO_RESTART is not set
+# CONFIG_POWER_RESET_LTC2952 is not set
+# CONFIG_POWER_RESET_RESTART is not set
+# CONFIG_POWER_RESET_XGENE is not set
+# CONFIG_POWER_RESET_SYSCON is not set
+# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set
+# CONFIG_SYSCON_REBOOT_MODE is not set
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+# CONFIG_PDA_POWER is not set
+# CONFIG_GENERIC_ADC_BATTERY is not set
+# CONFIG_TEST_POWER is not set
+# CONFIG_BATTERY_DS2780 is not set
+# CONFIG_BATTERY_DS2781 is not set
+# CONFIG_BATTERY_DS2782 is not set
+# CONFIG_BATTERY_LEGO_EV3 is not set
+# CONFIG_BATTERY_SBS is not set
+# CONFIG_CHARGER_SBS is not set
+# CONFIG_BATTERY_BQ27XXX is not set
+# CONFIG_BATTERY_MAX17040 is not set
+# CONFIG_BATTERY_MAX17042 is not set
+# CONFIG_CHARGER_MAX8903 is not set
+# CONFIG_CHARGER_LP8727 is not set
+# CONFIG_CHARGER_GPIO is not set
+# CONFIG_CHARGER_MANAGER is not set
+# CONFIG_CHARGER_LTC3651 is not set
+# CONFIG_CHARGER_DETECTOR_MAX14656 is not set
+# CONFIG_CHARGER_BQ2415X is not set
+# CONFIG_CHARGER_BQ24257 is not set
+# CONFIG_CHARGER_BQ24735 is not set
+# CONFIG_CHARGER_BQ25890 is not set
+# CONFIG_CHARGER_SMB347 is not set
+# CONFIG_BATTERY_GAUGE_LTC2941 is not set
+# CONFIG_CHARGER_RT9455 is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
+# Native drivers
+#
+# CONFIG_SENSORS_AD7314 is not set
+# CONFIG_SENSORS_AD7414 is not set
+# CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
+# CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADT7310 is not set
+# CONFIG_SENSORS_ADT7410 is not set
+# CONFIG_SENSORS_ADT7411 is not set
+# CONFIG_SENSORS_ADT7462 is not set
+# CONFIG_SENSORS_ADT7470 is not set
+# CONFIG_SENSORS_ADT7475 is not set
+# CONFIG_SENSORS_ASC7621 is not set
+# CONFIG_SENSORS_ASPEED is not set
+# CONFIG_SENSORS_ATXP1 is not set
+# CONFIG_SENSORS_DS620 is not set
+# CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_F75375S is not set
+# CONFIG_SENSORS_FTSTEUTATES is not set
+# CONFIG_SENSORS_GL518SM is not set
+# CONFIG_SENSORS_GL520SM is not set
+# CONFIG_SENSORS_G760A is not set
+# CONFIG_SENSORS_G762 is not set
+# CONFIG_SENSORS_GPIO_FAN is not set
+# CONFIG_SENSORS_HIH6130 is not set
+# CONFIG_SENSORS_IIO_HWMON is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_JC42 is not set
+# CONFIG_SENSORS_POWR1220 is not set
+# CONFIG_SENSORS_LINEAGE is not set
+# CONFIG_SENSORS_LTC2945 is not set
+# CONFIG_SENSORS_LTC2990 is not set
+# CONFIG_SENSORS_LTC4151 is not set
+# CONFIG_SENSORS_LTC4215 is not set
+# CONFIG_SENSORS_LTC4222 is not set
+# CONFIG_SENSORS_LTC4245 is not set
+# CONFIG_SENSORS_LTC4260 is not set
+# CONFIG_SENSORS_LTC4261 is not set
+# CONFIG_SENSORS_MAX1111 is not set
+# CONFIG_SENSORS_MAX16065 is not set
+# CONFIG_SENSORS_MAX1619 is not set
+# CONFIG_SENSORS_MAX1668 is not set
+# CONFIG_SENSORS_MAX197 is not set
+# CONFIG_SENSORS_MAX31722 is not set
+# CONFIG_SENSORS_MAX6639 is not set
+# CONFIG_SENSORS_MAX6642 is not set
+# CONFIG_SENSORS_MAX6650 is not set
+# CONFIG_SENSORS_MAX6697 is not set
+# CONFIG_SENSORS_MAX31790 is not set
+# CONFIG_SENSORS_MCP3021 is not set
+# CONFIG_SENSORS_TC654 is not set
+# CONFIG_SENSORS_ADCXX is not set
+# CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM70 is not set
+# CONFIG_SENSORS_LM73 is not set
+# CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
+# CONFIG_SENSORS_LM78 is not set
+# CONFIG_SENSORS_LM80 is not set
+# CONFIG_SENSORS_LM83 is not set
+# CONFIG_SENSORS_LM85 is not set
+# CONFIG_SENSORS_LM87 is not set
+# CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
+# CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LM95234 is not set
+# CONFIG_SENSORS_LM95241 is not set
+# CONFIG_SENSORS_LM95245 is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_NTC_THERMISTOR is not set
+# CONFIG_SENSORS_NCT6683 is not set
+# CONFIG_SENSORS_NCT6775 is not set
+# CONFIG_SENSORS_NCT7802 is not set
+# CONFIG_SENSORS_NCT7904 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_PMBUS is not set
+# CONFIG_SENSORS_PWM_FAN is not set
+# CONFIG_SENSORS_SHT15 is not set
+# CONFIG_SENSORS_SHT21 is not set
+# CONFIG_SENSORS_SHT3x is not set
+# CONFIG_SENSORS_SHTC1 is not set
+# CONFIG_SENSORS_DME1737 is not set
+# CONFIG_SENSORS_EMC1403 is not set
+# CONFIG_SENSORS_EMC2103 is not set
+# CONFIG_SENSORS_EMC6W201 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_SCH56XX_COMMON is not set
+# CONFIG_SENSORS_SCH5627 is not set
+# CONFIG_SENSORS_SCH5636 is not set
+# CONFIG_SENSORS_STTS751 is not set
+# CONFIG_SENSORS_SMM665 is not set
+# CONFIG_SENSORS_ADC128D818 is not set
+# CONFIG_SENSORS_ADS1015 is not set
+# CONFIG_SENSORS_ADS7828 is not set
+# CONFIG_SENSORS_ADS7871 is not set
+# CONFIG_SENSORS_AMC6821 is not set
+# CONFIG_SENSORS_INA209 is not set
+# CONFIG_SENSORS_INA2XX is not set
+# CONFIG_SENSORS_INA3221 is not set
+# CONFIG_SENSORS_TC74 is not set
+# CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_TMP102 is not set
+# CONFIG_SENSORS_TMP103 is not set
+# CONFIG_SENSORS_TMP108 is not set
+# CONFIG_SENSORS_TMP401 is not set
+# CONFIG_SENSORS_TMP421 is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
+# CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
+# CONFIG_SENSORS_W83795 is not set
+# CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+CONFIG_NANOPI_THERMISTOR=m
+CONFIG_THERMAL=y
+CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
+CONFIG_THERMAL_HWMON=y
+CONFIG_THERMAL_OF=y
+# CONFIG_THERMAL_WRITABLE_TRIPS is not set
+CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
+# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR is not set
+# CONFIG_THERMAL_GOV_FAIR_SHARE is not set
+CONFIG_THERMAL_GOV_STEP_WISE=y
+# CONFIG_THERMAL_GOV_BANG_BANG is not set
+# CONFIG_THERMAL_GOV_USER_SPACE is not set
+# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set
+# CONFIG_CPU_THERMAL is not set
+# CONFIG_THERMAL_EMULATION is not set
+# CONFIG_QORIQ_THERMAL is not set
+
+#
+# ACPI INT340X thermal drivers
+#
+
+#
+# Samsung thermal drivers
+#
+CONFIG_EXYNOS_THERMAL=y
+# CONFIG_GENERIC_ADC_THERMAL is not set
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y
+# CONFIG_WATCHDOG_SYSFS is not set
+
+#
+# Watchdog Device Drivers
+#
+# CONFIG_SOFT_WATCHDOG is not set
+# CONFIG_GPIO_WATCHDOG is not set
+# CONFIG_XILINX_WATCHDOG is not set
+# CONFIG_ZIIRAVE_WATCHDOG is not set
+# CONFIG_ARM_SP805_WATCHDOG is not set
+# CONFIG_CADENCE_WATCHDOG is not set
+CONFIG_HAVE_S3C2410_WATCHDOG=y
+# CONFIG_S3C2410_WATCHDOG is not set
+# CONFIG_DW_WATCHDOG is not set
+# CONFIG_MAX63XX_WATCHDOG is not set
+# CONFIG_MEN_A21_WDT is not set
+
+#
+# USB-based Watchdog Cards
+#
+# CONFIG_USBPCWATCHDOG is not set
+
+#
+# Watchdog Pretimeout Governors
+#
+# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set
+CONFIG_SSB_POSSIBLE=y
+
+#
+# Sonics Silicon Backplane
+#
+# CONFIG_SSB is not set
+CONFIG_BCMA_POSSIBLE=y
+# CONFIG_BCMA is not set
+
+#
+# Multifunction device drivers
+#
+CONFIG_MFD_CORE=y
+# CONFIG_MFD_ACT8945A is not set
+# CONFIG_MFD_AS3711 is not set
+# CONFIG_MFD_AS3722 is not set
+# CONFIG_PMIC_ADP5520 is not set
+# CONFIG_MFD_AAT2870_CORE is not set
+# CONFIG_MFD_ATMEL_FLEXCOM is not set
+# CONFIG_MFD_ATMEL_HLCDC is not set
+CONFIG_MFD_AXP228=y
+# CONFIG_MFD_BCM590XX is not set
+# CONFIG_MFD_BD9571MWV is not set
+# CONFIG_MFD_AXP20X_I2C is not set
+# CONFIG_MFD_CROS_EC is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_MFD_DA9052_SPI is not set
+# CONFIG_MFD_DA9052_I2C is not set
+# CONFIG_MFD_DA9055 is not set
+# CONFIG_MFD_DA9062 is not set
+# CONFIG_MFD_DA9063 is not set
+# CONFIG_MFD_DA9150 is not set
+# CONFIG_MFD_DLN2 is not set
+# CONFIG_MFD_MC13XXX_SPI is not set
+# CONFIG_MFD_MC13XXX_I2C is not set
+# CONFIG_MFD_HI6421_PMIC is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_HTC_I2CPLD is not set
+# CONFIG_MFD_KEMPLD is not set
+# CONFIG_MFD_88PM800 is not set
+# CONFIG_MFD_88PM805 is not set
+# CONFIG_MFD_88PM860X is not set
+# CONFIG_MFD_MAX14577 is not set
+# CONFIG_MFD_MAX77620 is not set
+# CONFIG_MFD_MAX77686 is not set
+# CONFIG_MFD_MAX77693 is not set
+# CONFIG_MFD_MAX77843 is not set
+# CONFIG_MFD_MAX8907 is not set
+# CONFIG_MFD_MAX8925 is not set
+# CONFIG_MFD_MAX8997 is not set
+# CONFIG_MFD_MAX8998 is not set
+# CONFIG_MFD_MT6397 is not set
+# CONFIG_MFD_MENF21BMC is not set
+# CONFIG_EZX_PCAP is not set
+# CONFIG_MFD_CPCAP is not set
+# CONFIG_MFD_VIPERBOARD is not set
+# CONFIG_MFD_RETU is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_MFD_RT5033 is not set
+# CONFIG_MFD_RTSX_USB is not set
+# CONFIG_MFD_RC5T583 is not set
+# CONFIG_MFD_RK808 is not set
+# CONFIG_MFD_RN5T618 is not set
+# CONFIG_MFD_SEC_CORE is not set
+# CONFIG_MFD_SI476X_CORE is not set
+# CONFIG_MFD_SM501 is not set
+# CONFIG_MFD_SKY81452 is not set
+# CONFIG_MFD_SMSC is not set
+# CONFIG_ABX500_CORE is not set
+# CONFIG_MFD_STMPE is not set
+CONFIG_MFD_SYSCON=y
+# CONFIG_MFD_TI_AM335X_TSCADC is not set
+# CONFIG_MFD_LP3943 is not set
+# CONFIG_MFD_LP8788 is not set
+# CONFIG_MFD_TI_LMU is not set
+# CONFIG_MFD_PALMAS is not set
+# CONFIG_TPS6105X is not set
+# CONFIG_TPS65010 is not set
+# CONFIG_TPS6507X is not set
+# CONFIG_MFD_TPS65086 is not set
+# CONFIG_MFD_TPS65090 is not set
+# CONFIG_MFD_TPS65217 is not set
+# CONFIG_MFD_TI_LP873X is not set
+# CONFIG_MFD_TI_LP87565 is not set
+# CONFIG_MFD_TPS65218 is not set
+# CONFIG_MFD_TPS6586X is not set
+# CONFIG_MFD_TPS65910 is not set
+# CONFIG_MFD_TPS65912_I2C is not set
+# CONFIG_MFD_TPS65912_SPI is not set
+# CONFIG_MFD_TPS80031 is not set
+# CONFIG_TWL4030_CORE is not set
+# CONFIG_TWL6040_CORE is not set
+# CONFIG_MFD_WL1273_CORE is not set
+# CONFIG_MFD_LM3533 is not set
+# CONFIG_MFD_TC3589X is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_MFD_ARIZONA_I2C is not set
+# CONFIG_MFD_ARIZONA_SPI is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM831X_I2C is not set
+# CONFIG_MFD_WM831X_SPI is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8994 is not set
+CONFIG_REGULATOR=y
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+# CONFIG_REGULATOR_VIRTUAL_CONSUMER is not set
+# CONFIG_REGULATOR_USERSPACE_CONSUMER is not set
+# CONFIG_REGULATOR_ACT8865 is not set
+# CONFIG_REGULATOR_AD5398 is not set
+# CONFIG_REGULATOR_ANATOP is not set
+CONFIG_REGULATOR_AXP228=y
+# CONFIG_REGULATOR_DA9210 is not set
+# CONFIG_REGULATOR_DA9211 is not set
+# CONFIG_REGULATOR_FAN53555 is not set
+# CONFIG_REGULATOR_GPIO is not set
+# CONFIG_REGULATOR_ISL9305 is not set
+# CONFIG_REGULATOR_ISL6271A is not set
+# CONFIG_REGULATOR_LP3971 is not set
+# CONFIG_REGULATOR_LP3972 is not set
+# CONFIG_REGULATOR_LP872X is not set
+# CONFIG_REGULATOR_LP8755 is not set
+# CONFIG_REGULATOR_LTC3589 is not set
+# CONFIG_REGULATOR_LTC3676 is not set
+# CONFIG_REGULATOR_MAX1586 is not set
+# CONFIG_REGULATOR_MAX8649 is not set
+# CONFIG_REGULATOR_MAX8660 is not set
+# CONFIG_REGULATOR_MAX8952 is not set
+# CONFIG_REGULATOR_MAX8973 is not set
+# CONFIG_REGULATOR_MT6311 is not set
+# CONFIG_REGULATOR_PFUZE100 is not set
+# CONFIG_REGULATOR_PV88060 is not set
+# CONFIG_REGULATOR_PV88080 is not set
+# CONFIG_REGULATOR_PV88090 is not set
+# CONFIG_REGULATOR_PWM is not set
+# CONFIG_REGULATOR_TPS51632 is not set
+# CONFIG_REGULATOR_TPS62360 is not set
+# CONFIG_REGULATOR_TPS65023 is not set
+# CONFIG_REGULATOR_TPS6507X is not set
+# CONFIG_REGULATOR_TPS65132 is not set
+# CONFIG_REGULATOR_TPS6524X is not set
+# CONFIG_REGULATOR_VCTRL is not set
+CONFIG_RC_CORE=y
+# CONFIG_RC_MAP is not set
+# CONFIG_RC_DECODERS is not set
+# CONFIG_RC_DEVICES is not set
+CONFIG_MEDIA_SUPPORT=y
+
+#
+# Multimedia core support
+#
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+# CONFIG_MEDIA_ANALOG_TV_SUPPORT is not set
+# CONFIG_MEDIA_DIGITAL_TV_SUPPORT is not set
+# CONFIG_MEDIA_RADIO_SUPPORT is not set
+# CONFIG_MEDIA_SDR_SUPPORT is not set
+# CONFIG_MEDIA_CEC_SUPPORT is not set
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_DEV=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
+CONFIG_VIDEO_V4L2=y
+# CONFIG_VIDEO_ADV_DEBUG is not set
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+CONFIG_VIDEOBUF2_CORE=m
+CONFIG_VIDEOBUF2_MEMOPS=m
+CONFIG_VIDEOBUF2_DMA_CONTIG=m
+CONFIG_VIDEOBUF2_VMALLOC=m
+# CONFIG_TTPCI_EEPROM is not set
+
+#
+# Media drivers
+#
+CONFIG_MEDIA_USB_SUPPORT=y
+
+#
+# Webcam devices
+#
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
+CONFIG_USB_GSPCA=m
+# CONFIG_USB_M5602 is not set
+# CONFIG_USB_STV06XX is not set
+# CONFIG_USB_GL860 is not set
+# CONFIG_USB_GSPCA_BENQ is not set
+# CONFIG_USB_GSPCA_CONEX is not set
+# CONFIG_USB_GSPCA_CPIA1 is not set
+# CONFIG_USB_GSPCA_DTCS033 is not set
+# CONFIG_USB_GSPCA_ETOMS is not set
+# CONFIG_USB_GSPCA_FINEPIX is not set
+# CONFIG_USB_GSPCA_JEILINJ is not set
+# CONFIG_USB_GSPCA_JL2005BCD is not set
+# CONFIG_USB_GSPCA_KINECT is not set
+# CONFIG_USB_GSPCA_KONICA is not set
+# CONFIG_USB_GSPCA_MARS is not set
+# CONFIG_USB_GSPCA_MR97310A is not set
+# CONFIG_USB_GSPCA_NW80X is not set
+# CONFIG_USB_GSPCA_OV519 is not set
+# CONFIG_USB_GSPCA_OV534 is not set
+# CONFIG_USB_GSPCA_OV534_9 is not set
+# CONFIG_USB_GSPCA_PAC207 is not set
+# CONFIG_USB_GSPCA_PAC7302 is not set
+# CONFIG_USB_GSPCA_PAC7311 is not set
+# CONFIG_USB_GSPCA_SE401 is not set
+# CONFIG_USB_GSPCA_SN9C2028 is not set
+# CONFIG_USB_GSPCA_SN9C20X is not set
+# CONFIG_USB_GSPCA_SONIXB is not set
+# CONFIG_USB_GSPCA_SONIXJ is not set
+# CONFIG_USB_GSPCA_SPCA500 is not set
+# CONFIG_USB_GSPCA_SPCA501 is not set
+# CONFIG_USB_GSPCA_SPCA505 is not set
+# CONFIG_USB_GSPCA_SPCA506 is not set
+# CONFIG_USB_GSPCA_SPCA508 is not set
+# CONFIG_USB_GSPCA_SPCA561 is not set
+# CONFIG_USB_GSPCA_SPCA1528 is not set
+# CONFIG_USB_GSPCA_SQ905 is not set
+# CONFIG_USB_GSPCA_SQ905C is not set
+# CONFIG_USB_GSPCA_SQ930X is not set
+# CONFIG_USB_GSPCA_STK014 is not set
+# CONFIG_USB_GSPCA_STK1135 is not set
+# CONFIG_USB_GSPCA_STV0680 is not set
+# CONFIG_USB_GSPCA_SUNPLUS is not set
+# CONFIG_USB_GSPCA_T613 is not set
+# CONFIG_USB_GSPCA_TOPRO is not set
+# CONFIG_USB_GSPCA_TOUPTEK is not set
+# CONFIG_USB_GSPCA_TV8532 is not set
+# CONFIG_USB_GSPCA_VC032X is not set
+# CONFIG_USB_GSPCA_VICAM is not set
+# CONFIG_USB_GSPCA_XIRLINK_CIT is not set
+# CONFIG_USB_GSPCA_ZC3XX is not set
+# CONFIG_USB_PWC is not set
+# CONFIG_VIDEO_CPIA2 is not set
+# CONFIG_USB_ZR364XX is not set
+# CONFIG_USB_STKWEBCAM is not set
+# CONFIG_USB_S2255 is not set
+# CONFIG_VIDEO_USBTV is not set
+
+#
+# Webcam, TV (analog/digital) USB devices
+#
+# CONFIG_VIDEO_EM28XX is not set
+# CONFIG_V4L_PLATFORM_DRIVERS is not set
+# CONFIG_V4L_MEM2MEM_DRIVERS is not set
+# CONFIG_V4L_TEST_DRIVERS is not set
+CONFIG_VIDEO_NEXELL_CODEC=m
+CONFIG_NANO_VIDEODEV=m
+
+#
+# Supported MMC/SDIO adapters
+#
+# CONFIG_CYPRESS_FIRMWARE is not set
+
+#
+# Media ancillary drivers (tuners, sensors, i2c, spi, frontends)
+#
+# CONFIG_MEDIA_SUBDRV_AUTOSELECT is not set
+# CONFIG_VIDEO_IR_I2C is not set
+
+#
+# I2C Encoders, decoders, sensors and other helper chips
+#
+
+#
+# Audio decoders, processors and mixers
+#
+# CONFIG_VIDEO_TVAUDIO is not set
+# CONFIG_VIDEO_TDA7432 is not set
+# CONFIG_VIDEO_TDA9840 is not set
+# CONFIG_VIDEO_TEA6415C is not set
+# CONFIG_VIDEO_TEA6420 is not set
+# CONFIG_VIDEO_MSP3400 is not set
+# CONFIG_VIDEO_CS3308 is not set
+# CONFIG_VIDEO_CS5345 is not set
+# CONFIG_VIDEO_CS53L32A is not set
+# CONFIG_VIDEO_TLV320AIC23B is not set
+# CONFIG_VIDEO_UDA1342 is not set
+# CONFIG_VIDEO_WM8775 is not set
+# CONFIG_VIDEO_WM8739 is not set
+# CONFIG_VIDEO_VP27SMPX is not set
+# CONFIG_VIDEO_SONY_BTF_MPX is not set
+
+#
+# RDS decoders
+#
+# CONFIG_VIDEO_SAA6588 is not set
+
+#
+# Video decoders
+#
+# CONFIG_VIDEO_ADV7180 is not set
+# CONFIG_VIDEO_ADV7183 is not set
+# CONFIG_VIDEO_ADV748X is not set
+# CONFIG_VIDEO_ADV7604 is not set
+# CONFIG_VIDEO_ADV7842 is not set
+# CONFIG_VIDEO_BT819 is not set
+# CONFIG_VIDEO_BT856 is not set
+# CONFIG_VIDEO_BT866 is not set
+# CONFIG_VIDEO_KS0127 is not set
+# CONFIG_VIDEO_ML86V7667 is not set
+# CONFIG_VIDEO_AD5820 is not set
+# CONFIG_VIDEO_DW9714 is not set
+# CONFIG_VIDEO_SAA7110 is not set
+# CONFIG_VIDEO_SAA711X is not set
+# CONFIG_VIDEO_TC358743 is not set
+# CONFIG_VIDEO_TVP514X is not set
+# CONFIG_VIDEO_TVP5150 is not set
+# CONFIG_VIDEO_TVP7002 is not set
+# CONFIG_VIDEO_TW2804 is not set
+# CONFIG_VIDEO_TW9903 is not set
+# CONFIG_VIDEO_TW9906 is not set
+# CONFIG_VIDEO_VPX3220 is not set
+
+#
+# Video and audio decoders
+#
+# CONFIG_VIDEO_SAA717X is not set
+# CONFIG_VIDEO_CX25840 is not set
+
+#
+# Video encoders
+#
+# CONFIG_VIDEO_SAA7127 is not set
+# CONFIG_VIDEO_SAA7185 is not set
+# CONFIG_VIDEO_ADV7170 is not set
+# CONFIG_VIDEO_ADV7175 is not set
+# CONFIG_VIDEO_ADV7343 is not set
+# CONFIG_VIDEO_ADV7393 is not set
+# CONFIG_VIDEO_ADV7511 is not set
+# CONFIG_VIDEO_AD9389B is not set
+# CONFIG_VIDEO_AK881X is not set
+# CONFIG_VIDEO_THS8200 is not set
+
+#
+# Camera sensor devices
+#
+# CONFIG_VIDEO_OV2640 is not set
+# CONFIG_VIDEO_OV2659 is not set
+# CONFIG_VIDEO_OV5640 is not set
+# CONFIG_VIDEO_OV5645 is not set
+# CONFIG_VIDEO_OV5647 is not set
+# CONFIG_VIDEO_OV6650 is not set
+# CONFIG_VIDEO_OV5670 is not set
+# CONFIG_VIDEO_OV7640 is not set
+# CONFIG_VIDEO_OV7670 is not set
+# CONFIG_VIDEO_OV9650 is not set
+# CONFIG_VIDEO_OV13858 is not set
+# CONFIG_VIDEO_VS6624 is not set
+# CONFIG_VIDEO_MT9M032 is not set
+# CONFIG_VIDEO_MT9M111 is not set
+# CONFIG_VIDEO_MT9P031 is not set
+# CONFIG_VIDEO_MT9T001 is not set
+# CONFIG_VIDEO_MT9V011 is not set
+# CONFIG_VIDEO_MT9V032 is not set
+# CONFIG_VIDEO_SR030PC30 is not set
+# CONFIG_VIDEO_NOON010PC30 is not set
+# CONFIG_VIDEO_M5MOLS is not set
+# CONFIG_VIDEO_S5K6AA is not set
+# CONFIG_VIDEO_S5K6A3 is not set
+# CONFIG_VIDEO_S5K4ECGX is not set
+# CONFIG_VIDEO_S5K5BAF is not set
+# CONFIG_VIDEO_SMIAPP is not set
+# CONFIG_VIDEO_ET8EK8 is not set
+# CONFIG_VIDEO_S5C73M3 is not set
+
+#
+# Flash devices
+#
+# CONFIG_VIDEO_ADP1653 is not set
+# CONFIG_VIDEO_AS3645A is not set
+# CONFIG_VIDEO_LM3560 is not set
+# CONFIG_VIDEO_LM3646 is not set
+
+#
+# Video improvement chips
+#
+# CONFIG_VIDEO_UPD64031A is not set
+# CONFIG_VIDEO_UPD64083 is not set
+
+#
+# Audio/Video compression chips
+#
+# CONFIG_VIDEO_SAA6752HS is not set
+
+#
+# SDR tuner chips
+#
+
+#
+# Miscellaneous helper chips
+#
+# CONFIG_VIDEO_THS7303 is not set
+# CONFIG_VIDEO_M52790 is not set
+
+#
+# Sensors used on soc_camera driver
+#
+
+#
+# SPI helper chips
+#
+# CONFIG_VIDEO_GS1662 is not set
+
+#
+# Customise DVB Frontends
+#
+
+#
+# Tools to develop new frontends
+#
+
+#
+# Graphics support
+#
+CONFIG_DRM=y
+# CONFIG_DRM_DP_AUX_CHARDEV is not set
+# CONFIG_DRM_DEBUG_MM is not set
+# CONFIG_DRM_DEBUG_MM_SELFTEST is not set
+CONFIG_DRM_KMS_HELPER=y
+CONFIG_DRM_KMS_FB_HELPER=y
+CONFIG_DRM_FBDEV_EMULATION=y
+CONFIG_DRM_FBDEV_OVERALLOC=100
+# CONFIG_DRM_LOAD_EDID_FIRMWARE is not set
+
+#
+# I2C encoder or helper chips
+#
+# CONFIG_DRM_I2C_CH7006 is not set
+# CONFIG_DRM_I2C_SIL164 is not set
+# CONFIG_DRM_I2C_NXP_TDA998X is not set
+# CONFIG_DRM_HDLCD is not set
+# CONFIG_DRM_MALI_DISPLAY is not set
+
+#
+# ACP (Audio CoProcessor) Configuration
+#
+# CONFIG_DRM_VGEM is not set
+# CONFIG_DRM_UDL is not set
+# CONFIG_DRM_RCAR_DW_HDMI is not set
+CONFIG_DRM_PANEL=y
+
+#
+# Display Panels
+#
+# CONFIG_DRM_PANEL_LVDS is not set
+# CONFIG_DRM_PANEL_SIMPLE is not set
+# CONFIG_DRM_PANEL_SAMSUNG_LD9040 is not set
+# CONFIG_DRM_PANEL_LG_LG4573 is not set
+# CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0 is not set
+# CONFIG_DRM_PANEL_SITRONIX_ST7789V is not set
+CONFIG_DRM_PANEL_NANOPI=y
+CONFIG_DRM_BRIDGE=y
+CONFIG_DRM_PANEL_BRIDGE=y
+
+#
+# Display Interface Bridges
+#
+# CONFIG_DRM_ANALOGIX_ANX78XX is not set
+# CONFIG_DRM_DUMB_VGA_DAC is not set
+# CONFIG_DRM_LVDS_ENCODER is not set
+# CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set
+# CONFIG_DRM_NXP_PTN3460 is not set
+# CONFIG_DRM_PARADE_PS8622 is not set
+# CONFIG_DRM_SIL_SII8620 is not set
+# CONFIG_DRM_SII902X is not set
+# CONFIG_DRM_TOSHIBA_TC358767 is not set
+# CONFIG_DRM_TI_TFP410 is not set
+# CONFIG_DRM_I2C_ADV7511 is not set
+# CONFIG_DRM_ARCPGU is not set
+# CONFIG_DRM_HISI_KIRIN is not set
+# CONFIG_DRM_MXSFB is not set
+# CONFIG_DRM_TINYDRM is not set
+# CONFIG_DRM_PL111 is not set
+CONFIG_DRM_NX=y
+CONFIG_DRM_NX_RGB=y
+CONFIG_DRM_NX_LVDS=y
+# CONFIG_DRM_NX_MIPI_DSI is not set
+CONFIG_DRM_NX_HDMI=y
+# CONFIG_DRM_LEGACY is not set
+# CONFIG_DRM_LIB_RANDOM is not set
+
+#
+# ARM GPU Configuration
+#
+# CONFIG_MALI400 is not set
+
+#
+# Frame buffer Devices
+#
+CONFIG_FB=y
+# CONFIG_FIRMWARE_EDID is not set
+CONFIG_FB_CMDLINE=y
+CONFIG_FB_NOTIFY=y
+# CONFIG_FB_DDC is not set
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_IMAGEBLIT=y
+# CONFIG_FB_PROVIDE_GET_FB_UNMAPPED_AREA is not set
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_DEFERRED_IO=y
+# CONFIG_FB_SVGALIB is not set
+# CONFIG_FB_MACMODES is not set
+# CONFIG_FB_BACKLIGHT is not set
+# CONFIG_FB_MODE_HELPERS is not set
+# CONFIG_FB_TILEBLITTING is not set
+
+#
+# Frame buffer hardware drivers
+#
+# CONFIG_FB_ARMCLCD is not set
+# CONFIG_FB_OPENCORES is not set
+# CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_SMSCUFX is not set
+# CONFIG_FB_UDL is not set
+# CONFIG_FB_IBM_GXT4500 is not set
+# CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_BROADSHEET is not set
+# CONFIG_FB_AUO_K190X is not set
+# CONFIG_FB_SIMPLE is not set
+# CONFIG_FB_SSD1307 is not set
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+# CONFIG_BACKLIGHT_GENERIC is not set
+# CONFIG_BACKLIGHT_PWM is not set
+# CONFIG_BACKLIGHT_PM8941_WLED is not set
+# CONFIG_BACKLIGHT_ADP8860 is not set
+# CONFIG_BACKLIGHT_ADP8870 is not set
+# CONFIG_BACKLIGHT_LM3630A is not set
+# CONFIG_BACKLIGHT_LM3639 is not set
+# CONFIG_BACKLIGHT_LP855X is not set
+# CONFIG_BACKLIGHT_GPIO is not set
+# CONFIG_BACKLIGHT_LV5207LP is not set
+# CONFIG_BACKLIGHT_BD6107 is not set
+# CONFIG_BACKLIGHT_ARCXCNN is not set
+# CONFIG_VGASTATE is not set
+CONFIG_VIDEOMODE_HELPERS=y
+CONFIG_HDMI=y
+
+#
+# Console display driver support
+#
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DUMMY_CONSOLE_COLUMNS=80
+CONFIG_DUMMY_CONSOLE_ROWS=25
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_LOGO=y
+CONFIG_LOGO_LINUX_MONO=y
+CONFIG_LOGO_LINUX_VGA16=y
+CONFIG_LOGO_LINUX_CLUT224=y
+CONFIG_SOUND=y
+# CONFIG_SOUND_OSS_CORE is not set
+CONFIG_SND=y
+CONFIG_SND_TIMER=y
+CONFIG_SND_PCM=y
+CONFIG_SND_JACK=y
+CONFIG_SND_JACK_INPUT_DEV=y
+# CONFIG_SND_OSSEMUL is not set
+CONFIG_SND_PCM_TIMER=y
+# CONFIG_SND_HRTIMER is not set
+# CONFIG_SND_DYNAMIC_MINORS is not set
+# CONFIG_SND_SUPPORT_OLD_API is not set
+CONFIG_SND_PROC_FS=y
+# CONFIG_SND_VERBOSE_PROCFS is not set
+# CONFIG_SND_VERBOSE_PRINTK is not set
+# CONFIG_SND_DEBUG is not set
+# CONFIG_SND_SEQUENCER is not set
+# CONFIG_SND_OPL3_LIB_SEQ is not set
+# CONFIG_SND_OPL4_LIB_SEQ is not set
+# CONFIG_SND_DRIVERS is not set
+
+#
+# HD-Audio
+#
+CONFIG_SND_HDA_PREALLOC_SIZE=64
+# CONFIG_SND_SPI is not set
+CONFIG_SND_USB=y
+# CONFIG_SND_USB_AUDIO is not set
+# CONFIG_SND_USB_UA101 is not set
+# CONFIG_SND_USB_CAIAQ is not set
+# CONFIG_SND_USB_6FIRE is not set
+# CONFIG_SND_USB_HIFACE is not set
+# CONFIG_SND_BCD2000 is not set
+# CONFIG_SND_USB_POD is not set
+# CONFIG_SND_USB_PODHD is not set
+# CONFIG_SND_USB_TONEPORT is not set
+# CONFIG_SND_USB_VARIAX is not set
+CONFIG_SND_SOC=y
+# CONFIG_SND_SOC_AMD_ACP is not set
+# CONFIG_SND_ATMEL_SOC is not set
+# CONFIG_SND_DESIGNWARE_I2S is not set
+
+#
+# SoC Audio for Freescale CPUs
+#
+
+#
+# Common SoC Audio options for Freescale CPUs:
+#
+# CONFIG_SND_SOC_FSL_ASRC is not set
+# CONFIG_SND_SOC_FSL_SAI is not set
+# CONFIG_SND_SOC_FSL_SSI is not set
+# CONFIG_SND_SOC_FSL_SPDIF is not set
+# CONFIG_SND_SOC_FSL_ESAI is not set
+# CONFIG_SND_SOC_IMX_AUDMUX is not set
+# CONFIG_SND_I2S_HI6210_I2S is not set
+# CONFIG_SND_SOC_IMG is not set
+
+#
+# STMicroelectronics STM32 SOC audio support
+#
+# CONFIG_SND_SOC_XTFPGA_I2S is not set
+# CONFIG_ZX_TDM is not set
+CONFIG_SND_NX_SOC=y
+CONFIG_SND_NX_I2S=y
+CONFIG_SND_NX_I2S_CH0=y
+# CONFIG_SND_NX_I2S_CH1 is not set
+# CONFIG_SND_NX_I2S_CH2 is not set
+CONFIG_SND_NX_SPDIF_TX=y
+CONFIG_SND_SPDIF_TRANSCEIVER=y
+# CONFIG_SND_CODEC_NULL is not set
+# CONFIG_SND_CODEC_ES8316 is not set
+# CONFIG_SND_CODEC_ALC5658 is not set
+CONFIG_SND_SOC_I2C_AND_SPI=y
+
+#
+# CODEC drivers
+#
+# CONFIG_SND_SOC_AC97_CODEC is not set
+# CONFIG_SND_SOC_ADAU1701 is not set
+# CONFIG_SND_SOC_ADAU1761_I2C is not set
+# CONFIG_SND_SOC_ADAU1761_SPI is not set
+# CONFIG_SND_SOC_ADAU7002 is not set
+# CONFIG_SND_SOC_AK4104 is not set
+# CONFIG_SND_SOC_AK4554 is not set
+# CONFIG_SND_SOC_AK4613 is not set
+# CONFIG_SND_SOC_AK4642 is not set
+# CONFIG_SND_SOC_AK5386 is not set
+# CONFIG_SND_SOC_ALC5623 is not set
+# CONFIG_SND_SOC_BT_SCO is not set
+# CONFIG_SND_SOC_CS35L32 is not set
+# CONFIG_SND_SOC_CS35L33 is not set
+# CONFIG_SND_SOC_CS35L34 is not set
+# CONFIG_SND_SOC_CS35L35 is not set
+# CONFIG_SND_SOC_CS42L42 is not set
+# CONFIG_SND_SOC_CS42L51_I2C is not set
+# CONFIG_SND_SOC_CS42L52 is not set
+# CONFIG_SND_SOC_CS42L56 is not set
+# CONFIG_SND_SOC_CS42L73 is not set
+# CONFIG_SND_SOC_CS4265 is not set
+# CONFIG_SND_SOC_CS4270 is not set
+# CONFIG_SND_SOC_CS4271_I2C is not set
+# CONFIG_SND_SOC_CS4271_SPI is not set
+# CONFIG_SND_SOC_CS42XX8_I2C is not set
+# CONFIG_SND_SOC_CS43130 is not set
+# CONFIG_SND_SOC_CS4349 is not set
+# CONFIG_SND_SOC_CS53L30 is not set
+# CONFIG_SND_SOC_DIO2125 is not set
+# CONFIG_SND_SOC_ES7134 is not set
+CONFIG_SND_SOC_ES8316=y
+# CONFIG_SND_SOC_ES8328_I2C is not set
+# CONFIG_SND_SOC_ES8328_SPI is not set
+# CONFIG_SND_SOC_GTM601 is not set
+# CONFIG_SND_SOC_INNO_RK3036 is not set
+# CONFIG_SND_SOC_MAX98504 is not set
+# CONFIG_SND_SOC_MAX98927 is not set
+# CONFIG_SND_SOC_MAX9860 is not set
+# CONFIG_SND_SOC_MSM8916_WCD_DIGITAL is not set
+# CONFIG_SND_SOC_PCM1681 is not set
+# CONFIG_SND_SOC_PCM179X_I2C is not set
+# CONFIG_SND_SOC_PCM179X_SPI is not set
+# CONFIG_SND_SOC_PCM3168A_I2C is not set
+# CONFIG_SND_SOC_PCM3168A_SPI is not set
+# CONFIG_SND_SOC_PCM512x_I2C is not set
+# CONFIG_SND_SOC_PCM512x_SPI is not set
+# CONFIG_SND_SOC_RT5616 is not set
+# CONFIG_SND_SOC_RT5631 is not set
+# CONFIG_SND_SOC_RT5677_SPI is not set
+# CONFIG_SND_SOC_SGTL5000 is not set
+# CONFIG_SND_SOC_SIRF_AUDIO_CODEC is not set
+CONFIG_SND_SOC_SPDIF=y
+# CONFIG_SND_SOC_SSM2602_SPI is not set
+# CONFIG_SND_SOC_SSM2602_I2C is not set
+# CONFIG_SND_SOC_SSM4567 is not set
+# CONFIG_SND_SOC_STA32X is not set
+# CONFIG_SND_SOC_STA350 is not set
+# CONFIG_SND_SOC_STI_SAS is not set
+# CONFIG_SND_SOC_TAS2552 is not set
+# CONFIG_SND_SOC_TAS5086 is not set
+# CONFIG_SND_SOC_TAS571X is not set
+# CONFIG_SND_SOC_TAS5720 is not set
+# CONFIG_SND_SOC_TFA9879 is not set
+# CONFIG_SND_SOC_TLV320AIC23_I2C is not set
+# CONFIG_SND_SOC_TLV320AIC23_SPI is not set
+# CONFIG_SND_SOC_TLV320AIC31XX is not set
+# CONFIG_SND_SOC_TLV320AIC3X is not set
+# CONFIG_SND_SOC_TS3A227E is not set
+# CONFIG_SND_SOC_WM8510 is not set
+# CONFIG_SND_SOC_WM8523 is not set
+# CONFIG_SND_SOC_WM8524 is not set
+# CONFIG_SND_SOC_WM8580 is not set
+# CONFIG_SND_SOC_WM8711 is not set
+# CONFIG_SND_SOC_WM8728 is not set
+# CONFIG_SND_SOC_WM8731 is not set
+# CONFIG_SND_SOC_WM8737 is not set
+# CONFIG_SND_SOC_WM8741 is not set
+# CONFIG_SND_SOC_WM8750 is not set
+# CONFIG_SND_SOC_WM8753 is not set
+# CONFIG_SND_SOC_WM8770 is not set
+# CONFIG_SND_SOC_WM8776 is not set
+# CONFIG_SND_SOC_WM8804_I2C is not set
+# CONFIG_SND_SOC_WM8804_SPI is not set
+# CONFIG_SND_SOC_WM8903 is not set
+# CONFIG_SND_SOC_WM8960 is not set
+# CONFIG_SND_SOC_WM8962 is not set
+# CONFIG_SND_SOC_WM8974 is not set
+# CONFIG_SND_SOC_WM8978 is not set
+# CONFIG_SND_SOC_WM8985 is not set
+# CONFIG_SND_SOC_ZX_AUD96P22 is not set
+# CONFIG_SND_SOC_NAU8540 is not set
+# CONFIG_SND_SOC_NAU8810 is not set
+# CONFIG_SND_SOC_NAU8824 is not set
+# CONFIG_SND_SOC_TPA6130A2 is not set
+CONFIG_SND_SIMPLE_CARD_UTILS=y
+CONFIG_SND_SIMPLE_CARD=y
+# CONFIG_SND_SIMPLE_SCU_CARD is not set
+# CONFIG_SND_AUDIO_GRAPH_CARD is not set
+# CONFIG_SND_AUDIO_GRAPH_SCU_CARD is not set
+
+#
+# HID support
+#
+CONFIG_HID=y
+# CONFIG_HID_BATTERY_STRENGTH is not set
+# CONFIG_HIDRAW is not set
+CONFIG_UHID=y
+CONFIG_HID_GENERIC=y
+
+#
+# Special HID drivers
+#
+# CONFIG_HID_A4TECH is not set
+# CONFIG_HID_ACCUTOUCH is not set
+# CONFIG_HID_ACRUX is not set
+# CONFIG_HID_APPLE is not set
+# CONFIG_HID_APPLEIR is not set
+# CONFIG_HID_ASUS is not set
+# CONFIG_HID_AUREAL is not set
+# CONFIG_HID_BELKIN is not set
+# CONFIG_HID_BETOP_FF is not set
+# CONFIG_HID_CHERRY is not set
+# CONFIG_HID_CHICONY is not set
+# CONFIG_HID_CORSAIR is not set
+# CONFIG_HID_PRODIKEYS is not set
+# CONFIG_HID_CMEDIA is not set
+# CONFIG_HID_CYPRESS is not set
+# CONFIG_HID_DRAGONRISE is not set
+# CONFIG_HID_EMS_FF is not set
+# CONFIG_HID_ELECOM is not set
+# CONFIG_HID_ELO is not set
+# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_GEMBIRD is not set
+# CONFIG_HID_GFRM is not set
+# CONFIG_HID_HOLTEK is not set
+# CONFIG_HID_GT683R is not set
+# CONFIG_HID_KEYTOUCH is not set
+# CONFIG_HID_KYE is not set
+# CONFIG_HID_UCLOGIC is not set
+# CONFIG_HID_WALTOP is not set
+# CONFIG_HID_GYRATION is not set
+# CONFIG_HID_ICADE is not set
+# CONFIG_HID_ITE is not set
+# CONFIG_HID_TWINHAN is not set
+# CONFIG_HID_KENSINGTON is not set
+# CONFIG_HID_LCPOWER is not set
+# CONFIG_HID_LED is not set
+# CONFIG_HID_LENOVO is not set
+# CONFIG_HID_LOGITECH is not set
+# CONFIG_HID_MAGICMOUSE is not set
+# CONFIG_HID_MAYFLASH is not set
+# CONFIG_HID_MICROSOFT is not set
+# CONFIG_HID_MONTEREY is not set
+# CONFIG_HID_MULTITOUCH is not set
+# CONFIG_HID_NTI is not set
+# CONFIG_HID_NTRIG is not set
+# CONFIG_HID_ORTEK is not set
+# CONFIG_HID_PANTHERLORD is not set
+# CONFIG_HID_PENMOUNT is not set
+# CONFIG_HID_PETALYNX is not set
+# CONFIG_HID_PICOLCD is not set
+# CONFIG_HID_PLANTRONICS is not set
+# CONFIG_HID_PRIMAX is not set
+# CONFIG_HID_RETRODE is not set
+# CONFIG_HID_ROCCAT is not set
+# CONFIG_HID_SAITEK is not set
+# CONFIG_HID_SAMSUNG is not set
+# CONFIG_HID_SONY is not set
+# CONFIG_HID_SPEEDLINK is not set
+# CONFIG_HID_STEELSERIES is not set
+# CONFIG_HID_SUNPLUS is not set
+# CONFIG_HID_RMI is not set
+# CONFIG_HID_GREENASIA is not set
+# CONFIG_HID_SMARTJOYPLUS is not set
+# CONFIG_HID_TIVO is not set
+# CONFIG_HID_TOPSEED is not set
+# CONFIG_HID_THINGM is not set
+# CONFIG_HID_THRUSTMASTER is not set
+# CONFIG_HID_UDRAW_PS3 is not set
+# CONFIG_HID_WACOM is not set
+# CONFIG_HID_WIIMOTE is not set
+# CONFIG_HID_XINMO is not set
+# CONFIG_HID_ZEROPLUS is not set
+# CONFIG_HID_ZYDACRON is not set
+# CONFIG_HID_SENSOR_HUB is not set
+# CONFIG_HID_ALPS is not set
+
+#
+# USB HID support
+#
+CONFIG_USB_HID=y
+# CONFIG_HID_PID is not set
+# CONFIG_USB_HIDDEV is not set
+
+#
+# I2C HID support
+#
+# CONFIG_I2C_HID is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+
+#
+# Miscellaneous USB options
+#
+CONFIG_USB_DEFAULT_PERSIST=y
+CONFIG_USB_DYNAMIC_MINORS=y
+# CONFIG_USB_OTG is not set
+# CONFIG_USB_OTG_WHITELIST is not set
+# CONFIG_USB_OTG_BLACKLIST_HUB is not set
+# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set
+# CONFIG_USB_MON is not set
+# CONFIG_USB_WUSB_CBAF is not set
+
+#
+# USB Host Controller Drivers
+#
+# CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_XHCI_HCD is not set
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_TT_NEWSCHED=y
+CONFIG_USB_EHCI_EXYNOS=y
+# CONFIG_USB_EHCI_HCD_PLATFORM is not set
+# CONFIG_USB_OXU210HP_HCD is not set
+# CONFIG_USB_ISP116X_HCD is not set
+# CONFIG_USB_ISP1362_HCD is not set
+# CONFIG_USB_FOTG210_HCD is not set
+# CONFIG_USB_MAX3421_HCD is not set
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_EXYNOS=y
+# CONFIG_USB_OHCI_HCD_PLATFORM is not set
+# CONFIG_USB_SL811_HCD is not set
+# CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_HCD_TEST_MODE is not set
+
+#
+# USB Device Class drivers
+#
+CONFIG_USB_ACM=m
+CONFIG_USB_PRINTER=m
+# CONFIG_USB_WDM is not set
+# CONFIG_USB_TMC is not set
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
+#
+
+#
+# also be needed; see USB_STORAGE Help for more info
+#
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+# CONFIG_USBIP_CORE is not set
+# CONFIG_USB_MUSB_HDRC is not set
+# CONFIG_USB_DWC3 is not set
+CONFIG_USB_DWC2=m
+# CONFIG_USB_DWC2_HOST is not set
+
+#
+# Gadget/Dual-role mode requires USB Gadget support to be enabled
+#
+# CONFIG_USB_DWC2_PERIPHERAL is not set
+CONFIG_USB_DWC2_DUAL_ROLE=y
+# CONFIG_USB_DWC2_DEBUG is not set
+# CONFIG_USB_DWC2_TRACK_MISSED_SOFS is not set
+# CONFIG_USB_CHIPIDEA is not set
+# CONFIG_USB_ISP1760 is not set
+
+#
+# USB port drivers
+#
+# CONFIG_USB_SERIAL is not set
+
+#
+# USB Miscellaneous drivers
+#
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_SEVSEG is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+# CONFIG_USB_SISUSBVGA is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+# CONFIG_USB_IOWARRIOR is not set
+# CONFIG_USB_TEST is not set
+# CONFIG_USB_EHSET_TEST_FIXTURE is not set
+# CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_YUREX is not set
+# CONFIG_USB_EZUSB_FX2 is not set
+# CONFIG_USB_HUB_USB251XB is not set
+# CONFIG_USB_HSIC_USB3503 is not set
+# CONFIG_USB_HSIC_USB4604 is not set
+# CONFIG_USB_LINK_LAYER_TEST is not set
+# CONFIG_USB_CHAOSKEY is not set
+
+#
+# USB Physical Layer drivers
+#
+# CONFIG_USB_PHY is not set
+# CONFIG_NOP_USB_XCEIV is not set
+# CONFIG_USB_GPIO_VBUS is not set
+# CONFIG_USB_ISP1301 is not set
+# CONFIG_USB_ULPI is not set
+CONFIG_USB_GADGET=m
+# CONFIG_USB_GADGET_DEBUG is not set
+# CONFIG_USB_GADGET_DEBUG_FILES is not set
+# CONFIG_USB_GADGET_DEBUG_FS is not set
+CONFIG_USB_GADGET_VBUS_DRAW=2
+CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2
+
+#
+# USB Peripheral Controller
+#
+# CONFIG_USB_FOTG210_UDC is not set
+# CONFIG_USB_GR_UDC is not set
+# CONFIG_USB_R8A66597 is not set
+# CONFIG_USB_PXA27X is not set
+# CONFIG_USB_MV_UDC is not set
+# CONFIG_USB_MV_U3D is not set
+# CONFIG_USB_SNP_UDC_PLAT is not set
+# CONFIG_USB_M66592 is not set
+# CONFIG_USB_BDC_UDC is not set
+# CONFIG_USB_NET2272 is not set
+# CONFIG_USB_GADGET_XILINX is not set
+# CONFIG_USB_DUMMY_HCD is not set
+CONFIG_USB_LIBCOMPOSITE=m
+CONFIG_USB_U_ETHER=m
+CONFIG_USB_F_ECM=m
+CONFIG_USB_F_SUBSET=m
+CONFIG_USB_F_RNDIS=m
+# CONFIG_USB_CONFIGFS is not set
+# CONFIG_USB_ZERO is not set
+# CONFIG_USB_AUDIO is not set
+CONFIG_USB_ETH=m
+CONFIG_USB_ETH_RNDIS=y
+# CONFIG_USB_ETH_EEM is not set
+# CONFIG_USB_G_NCM is not set
+# CONFIG_USB_GADGETFS is not set
+# CONFIG_USB_FUNCTIONFS is not set
+# CONFIG_USB_MASS_STORAGE is not set
+# CONFIG_USB_G_SERIAL is not set
+# CONFIG_USB_MIDI_GADGET is not set
+# CONFIG_USB_G_PRINTER is not set
+# CONFIG_USB_CDC_COMPOSITE is not set
+# CONFIG_USB_G_ACM_MS is not set
+# CONFIG_USB_G_MULTI is not set
+# CONFIG_USB_G_HID is not set
+# CONFIG_USB_G_DBGP is not set
+# CONFIG_USB_G_WEBCAM is not set
+
+#
+# USB Power Delivery and Type-C drivers
+#
+# CONFIG_TYPEC_UCSI is not set
+# CONFIG_USB_LED_TRIG is not set
+# CONFIG_USB_ULPI_BUS is not set
+# CONFIG_UWB is not set
+CONFIG_MMC=y
+CONFIG_PWRSEQ_EMMC=y
+CONFIG_PWRSEQ_SIMPLE=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=8
+# CONFIG_SDIO_UART is not set
+# CONFIG_MMC_TEST is not set
+
+#
+# MMC/SD/SDIO Host Controller Drivers
+#
+# CONFIG_MMC_DEBUG is not set
+# CONFIG_MMC_ARMMMCI is not set
+# CONFIG_MMC_SDHCI is not set
+# CONFIG_MMC_SPI is not set
+CONFIG_MMC_DW=y
+CONFIG_MMC_DW_PLTFM=y
+# CONFIG_MMC_DW_EXYNOS is not set
+CONFIG_MMC_DW_NEXELL=y
+# CONFIG_MMC_DW_K3 is not set
+# CONFIG_MMC_VUB300 is not set
+# CONFIG_MMC_USHC is not set
+# CONFIG_MMC_USDHI6ROL0 is not set
+# CONFIG_MMC_MTK is not set
+# CONFIG_MEMSTICK is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+# CONFIG_LEDS_CLASS_FLASH is not set
+# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
+
+#
+# LED drivers
+#
+# CONFIG_LEDS_BCM6328 is not set
+# CONFIG_LEDS_BCM6358 is not set
+# CONFIG_LEDS_LM3530 is not set
+# CONFIG_LEDS_LM3642 is not set
+# CONFIG_LEDS_PCA9532 is not set
+CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_LP3944 is not set
+# CONFIG_LEDS_LP3952 is not set
+# CONFIG_LEDS_LP5521 is not set
+# CONFIG_LEDS_LP5523 is not set
+# CONFIG_LEDS_LP5562 is not set
+# CONFIG_LEDS_LP8501 is not set
+# CONFIG_LEDS_LP8860 is not set
+# CONFIG_LEDS_PCA955X is not set
+# CONFIG_LEDS_PCA963X is not set
+# CONFIG_LEDS_DAC124S085 is not set
+# CONFIG_LEDS_PWM is not set
+# CONFIG_LEDS_REGULATOR is not set
+# CONFIG_LEDS_BD2802 is not set
+# CONFIG_LEDS_LT3593 is not set
+# CONFIG_LEDS_TCA6507 is not set
+# CONFIG_LEDS_TLC591XX is not set
+# CONFIG_LEDS_LM355x is not set
+# CONFIG_LEDS_IS31FL319X is not set
+# CONFIG_LEDS_IS31FL32XX is not set
+
+#
+# LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM)
+#
+# CONFIG_LEDS_BLINKM is not set
+# CONFIG_LEDS_SYSCON is not set
+# CONFIG_LEDS_USER is not set
+
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_TIMER is not set
+# CONFIG_LEDS_TRIGGER_ONESHOT is not set
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+# CONFIG_LEDS_TRIGGER_CPU is not set
+# CONFIG_LEDS_TRIGGER_GPIO is not set
+# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
+
+#
+# iptables trigger is under Netfilter config (LED target)
+#
+# CONFIG_LEDS_TRIGGER_TRANSIENT is not set
+# CONFIG_LEDS_TRIGGER_CAMERA is not set
+# CONFIG_LEDS_TRIGGER_PANIC is not set
+# CONFIG_ACCESSIBILITY is not set
+CONFIG_EDAC_SUPPORT=y
+CONFIG_RTC_LIB=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+CONFIG_RTC_SYSTOHC=y
+CONFIG_RTC_SYSTOHC_DEVICE="rtc0"
+# CONFIG_RTC_DEBUG is not set
+CONFIG_RTC_NVMEM=y
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+# CONFIG_RTC_DRV_TEST is not set
+
+#
+# I2C RTC drivers
+#
+# CONFIG_RTC_DRV_ABB5ZES3 is not set
+# CONFIG_RTC_DRV_ABX80X is not set
+# CONFIG_RTC_DRV_DS1307 is not set
+# CONFIG_RTC_DRV_DS1374 is not set
+# CONFIG_RTC_DRV_DS1672 is not set
+# CONFIG_RTC_DRV_HYM8563 is not set
+# CONFIG_RTC_DRV_MAX6900 is not set
+# CONFIG_RTC_DRV_RS5C372 is not set
+# CONFIG_RTC_DRV_ISL1208 is not set
+# CONFIG_RTC_DRV_ISL12022 is not set
+# CONFIG_RTC_DRV_X1205 is not set
+# CONFIG_RTC_DRV_PCF8523 is not set
+# CONFIG_RTC_DRV_PCF85063 is not set
+# CONFIG_RTC_DRV_PCF8563 is not set
+# CONFIG_RTC_DRV_PCF8583 is not set
+# CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_BQ32K is not set
+# CONFIG_RTC_DRV_S35390A is not set
+# CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_RX8010 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
+# CONFIG_RTC_DRV_RX8025 is not set
+# CONFIG_RTC_DRV_EM3027 is not set
+# CONFIG_RTC_DRV_RV8803 is not set
+
+#
+# SPI RTC drivers
+#
+# CONFIG_RTC_DRV_M41T93 is not set
+# CONFIG_RTC_DRV_M41T94 is not set
+# CONFIG_RTC_DRV_DS1302 is not set
+# CONFIG_RTC_DRV_DS1305 is not set
+# CONFIG_RTC_DRV_DS1343 is not set
+# CONFIG_RTC_DRV_DS1347 is not set
+# CONFIG_RTC_DRV_DS1390 is not set
+# CONFIG_RTC_DRV_MAX6916 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RX4581 is not set
+# CONFIG_RTC_DRV_RX6110 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_PCF2123 is not set
+# CONFIG_RTC_DRV_MCP795 is not set
+CONFIG_RTC_I2C_AND_SPI=y
+
+#
+# SPI and I2C RTC drivers
+#
+# CONFIG_RTC_DRV_DS3232 is not set
+# CONFIG_RTC_DRV_PCF2127 is not set
+# CONFIG_RTC_DRV_RV3029C2 is not set
+
+#
+# Platform RTC drivers
+#
+# CONFIG_RTC_DRV_DS1286 is not set
+# CONFIG_RTC_DRV_DS1511 is not set
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1685_FAMILY is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_DS2404 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
+# CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_MSM6242 is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
+# CONFIG_RTC_DRV_RP5C01 is not set
+# CONFIG_RTC_DRV_V3020 is not set
+# CONFIG_RTC_DRV_ZYNQMP is not set
+
+#
+# on-CPU RTC drivers
+#
+# CONFIG_RTC_DRV_PL030 is not set
+# CONFIG_RTC_DRV_PL031 is not set
+# CONFIG_RTC_DRV_FTRTC010 is not set
+# CONFIG_RTC_DRV_SNVS is not set
+# CONFIG_RTC_DRV_R7301 is not set
+CONFIG_RTC_DRV_NX=y
+
+#
+# HID Sensor RTC drivers
+#
+# CONFIG_RTC_DRV_HID_SENSOR_TIME is not set
+CONFIG_DMADEVICES=y
+# CONFIG_DMADEVICES_DEBUG is not set
+
+#
+# DMA Devices
+#
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DMA_OF=y
+# CONFIG_ALTERA_MSGDMA is not set
+CONFIG_AMBA_PL08X=y
+# CONFIG_FSL_EDMA is not set
+# CONFIG_INTEL_IDMA64 is not set
+# CONFIG_MV_XOR_V2 is not set
+# CONFIG_PL330_DMA is not set
+# CONFIG_XILINX_DMA is not set
+# CONFIG_XILINX_ZYNQMP_DMA is not set
+# CONFIG_QCOM_HIDMA_MGMT is not set
+# CONFIG_QCOM_HIDMA is not set
+# CONFIG_DW_DMAC is not set
+
+#
+# DMA Clients
+#
+# CONFIG_ASYNC_TX_DMA is not set
+# CONFIG_DMATEST is not set
+
+#
+# DMABUF options
+#
+CONFIG_SYNC_FILE=y
+CONFIG_SW_SYNC=y
+# CONFIG_AUXDISPLAY is not set
+# CONFIG_UIO is not set
+# CONFIG_VIRT_DRIVERS is not set
+
+#
+# Virtio drivers
+#
+# CONFIG_VIRTIO_MMIO is not set
+
+#
+# Microsoft Hyper-V guest support
+#
+# CONFIG_HYPERV_TSCPAGE is not set
+CONFIG_STAGING=y
+# CONFIG_IRDA is not set
+# CONFIG_PRISM2_USB is not set
+# CONFIG_COMEDI is not set
+# CONFIG_RTLLIB is not set
+# CONFIG_RTL8723BS is not set
+# CONFIG_R8712U is not set
+# CONFIG_R8188EU is not set
+# CONFIG_VT6656 is not set
+
+#
+# IIO staging drivers
+#
+
+#
+# Accelerometers
+#
+# CONFIG_ADIS16201 is not set
+# CONFIG_ADIS16203 is not set
+# CONFIG_ADIS16209 is not set
+# CONFIG_ADIS16240 is not set
+
+#
+# Analog to digital converters
+#
+# CONFIG_AD7606 is not set
+# CONFIG_AD7780 is not set
+# CONFIG_AD7816 is not set
+# CONFIG_AD7192 is not set
+# CONFIG_AD7280 is not set
+
+#
+# Analog digital bi-direction converters
+#
+# CONFIG_ADT7316 is not set
+
+#
+# Capacitance to digital converters
+#
+# CONFIG_AD7150 is not set
+# CONFIG_AD7152 is not set
+# CONFIG_AD7746 is not set
+
+#
+# Direct Digital Synthesis
+#
+# CONFIG_AD9832 is not set
+# CONFIG_AD9834 is not set
+
+#
+# Digital gyroscope sensors
+#
+# CONFIG_ADIS16060 is not set
+
+#
+# Network Analyzer, Impedance Converters
+#
+# CONFIG_AD5933 is not set
+
+#
+# Light sensors
+#
+# CONFIG_TSL2x7x is not set
+
+#
+# Active energy metering IC
+#
+# CONFIG_ADE7753 is not set
+# CONFIG_ADE7754 is not set
+# CONFIG_ADE7758 is not set
+# CONFIG_ADE7759 is not set
+# CONFIG_ADE7854 is not set
+
+#
+# Resolver to digital converters
+#
+# CONFIG_AD2S90 is not set
+# CONFIG_AD2S1200 is not set
+# CONFIG_AD2S1210 is not set
+
+#
+# Triggers - standalone
+#
+
+#
+# Speakup console speech
+#
+# CONFIG_SPEAKUP is not set
+# CONFIG_STAGING_MEDIA is not set
+
+#
+# Android
+#
+CONFIG_ASHMEM=y
+CONFIG_ION=y
+# CONFIG_ION_SYSTEM_HEAP is not set
+# CONFIG_ION_CARVEOUT_HEAP is not set
+# CONFIG_ION_CHUNK_HEAP is not set
+# CONFIG_ION_CMA_HEAP is not set
+# CONFIG_STAGING_BOARD is not set
+# CONFIG_LTE_GDM724X is not set
+# CONFIG_LNET is not set
+# CONFIG_GS_FPGABOOT is not set
+# CONFIG_COMMON_CLK_XLNX_CLKWZRD is not set
+# CONFIG_FB_TFT is not set
+# CONFIG_WILC1000_SDIO is not set
+# CONFIG_WILC1000_SPI is not set
+# CONFIG_MOST is not set
+# CONFIG_KS7010 is not set
+# CONFIG_GREYBUS is not set
+
+#
+# USB Power Delivery and Type-C drivers
+#
+# CONFIG_TYPEC_TCPM is not set
+# CONFIG_PI433 is not set
+# CONFIG_GOLDFISH is not set
+# CONFIG_CHROME_PLATFORMS is not set
+CONFIG_CLKDEV_LOOKUP=y
+CONFIG_HAVE_CLK_PREPARE=y
+CONFIG_COMMON_CLK=y
+
+#
+# Common Clock Framework
+#
+# CONFIG_COMMON_CLK_VERSATILE is not set
+# CONFIG_CLK_HSDK is not set
+# CONFIG_COMMON_CLK_SI5351 is not set
+# CONFIG_COMMON_CLK_SI514 is not set
+# CONFIG_COMMON_CLK_SI570 is not set
+# CONFIG_COMMON_CLK_CDCE706 is not set
+# CONFIG_COMMON_CLK_CDCE925 is not set
+# CONFIG_COMMON_CLK_CS2000_CP is not set
+# CONFIG_CLK_QORIQ is not set
+CONFIG_COMMON_CLK_XGENE=y
+# CONFIG_COMMON_CLK_NXP is not set
+# CONFIG_COMMON_CLK_PWM is not set
+# CONFIG_COMMON_CLK_PXA is not set
+# CONFIG_COMMON_CLK_PIC32 is not set
+# CONFIG_COMMON_CLK_VC5 is not set
+# CONFIG_HWSPINLOCK is not set
+
+#
+# Clock Source drivers
+#
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+# CONFIG_ARM_TIMER_SP804 is not set
+# CONFIG_ATMEL_PIT is not set
+# CONFIG_SH_TIMER_CMT is not set
+# CONFIG_SH_TIMER_MTU2 is not set
+# CONFIG_SH_TIMER_TMU is not set
+# CONFIG_EM_TIMER_STI is not set
+CONFIG_CLKSRC_NEXELL_TIMER=y
+# CONFIG_MAILBOX is not set
+# CONFIG_IOMMU_SUPPORT is not set
+
+#
+# Remoteproc drivers
+#
+# CONFIG_REMOTEPROC is not set
+
+#
+# Rpmsg drivers
+#
+
+#
+# SOC (System On Chip) specific Drivers
+#
+
+#
+# Amlogic SoC drivers
+#
+
+#
+# Broadcom SoC drivers
+#
+# CONFIG_SOC_BRCMSTB is not set
+
+#
+# i.MX SoC drivers
+#
+
+#
+# Qualcomm SoC drivers
+#
+# CONFIG_SUNXI_SRAM is not set
+# CONFIG_SOC_TI is not set
+
+#
+# NEXELL s5pxx18
+#
+# CONFIG_PM_DEVFREQ is not set
+# CONFIG_EXTCON is not set
+# CONFIG_MEMORY is not set
+CONFIG_IIO=y
+CONFIG_IIO_BUFFER=y
+# CONFIG_IIO_BUFFER_CB is not set
+CONFIG_IIO_KFIFO_BUF=y
+# CONFIG_IIO_CONFIGFS is not set
+CONFIG_IIO_TRIGGER=y
+CONFIG_IIO_CONSUMERS_PER_TRIGGER=2
+# CONFIG_IIO_SW_DEVICE is not set
+# CONFIG_IIO_SW_TRIGGER is not set
+
+#
+# Accelerometers
+#
+# CONFIG_ADXL345_I2C is not set
+# CONFIG_ADXL345_SPI is not set
+# CONFIG_BMA180 is not set
+# CONFIG_BMA220 is not set
+# CONFIG_BMC150_ACCEL is not set
+# CONFIG_DA280 is not set
+# CONFIG_DA311 is not set
+# CONFIG_DMARD06 is not set
+# CONFIG_DMARD09 is not set
+# CONFIG_DMARD10 is not set
+# CONFIG_IIO_ST_ACCEL_3AXIS is not set
+# CONFIG_KXSD9 is not set
+# CONFIG_KXCJK1013 is not set
+# CONFIG_MC3230 is not set
+# CONFIG_MMA7455_I2C is not set
+# CONFIG_MMA7455_SPI is not set
+# CONFIG_MMA7660 is not set
+# CONFIG_MMA8452 is not set
+# CONFIG_MMA9551 is not set
+# CONFIG_MMA9553 is not set
+# CONFIG_MXC4005 is not set
+# CONFIG_MXC6255 is not set
+# CONFIG_SCA3000 is not set
+# CONFIG_STK8312 is not set
+# CONFIG_STK8BA50 is not set
+
+#
+# Analog to digital converters
+#
+# CONFIG_AD7266 is not set
+# CONFIG_AD7291 is not set
+# CONFIG_AD7298 is not set
+# CONFIG_AD7476 is not set
+# CONFIG_AD7766 is not set
+# CONFIG_AD7791 is not set
+# CONFIG_AD7793 is not set
+# CONFIG_AD7887 is not set
+# CONFIG_AD7923 is not set
+# CONFIG_AD799X is not set
+# CONFIG_CC10001_ADC is not set
+# CONFIG_ENVELOPE_DETECTOR is not set
+# CONFIG_HI8435 is not set
+# CONFIG_HX711 is not set
+# CONFIG_INA2XX_ADC is not set
+# CONFIG_LTC2471 is not set
+# CONFIG_LTC2485 is not set
+# CONFIG_LTC2497 is not set
+# CONFIG_MAX1027 is not set
+# CONFIG_MAX11100 is not set
+# CONFIG_MAX1118 is not set
+# CONFIG_MAX1363 is not set
+# CONFIG_MAX9611 is not set
+# CONFIG_MCP320X is not set
+# CONFIG_MCP3422 is not set
+# CONFIG_NAU7802 is not set
+# CONFIG_TI_ADC081C is not set
+# CONFIG_TI_ADC0832 is not set
+# CONFIG_TI_ADC084S021 is not set
+# CONFIG_TI_ADC12138 is not set
+# CONFIG_TI_ADC108S102 is not set
+# CONFIG_TI_ADC128S052 is not set
+# CONFIG_TI_ADC161S626 is not set
+# CONFIG_TI_ADS1015 is not set
+# CONFIG_TI_ADS7950 is not set
+# CONFIG_TI_ADS8688 is not set
+# CONFIG_TI_TLC4541 is not set
+# CONFIG_VF610_ADC is not set
+CONFIG_NX_ADC=y
+
+#
+# Amplifiers
+#
+# CONFIG_AD8366 is not set
+
+#
+# Chemical Sensors
+#
+# CONFIG_ATLAS_PH_SENSOR is not set
+# CONFIG_CCS811 is not set
+# CONFIG_IAQCORE is not set
+# CONFIG_VZ89X is not set
+
+#
+# Hid Sensor IIO Common
+#
+
+#
+# SSP Sensor Common
+#
+# CONFIG_IIO_SSP_SENSORHUB is not set
+
+#
+# Counters
+#
+
+#
+# Digital to analog converters
+#
+# CONFIG_AD5064 is not set
+# CONFIG_AD5360 is not set
+# CONFIG_AD5380 is not set
+# CONFIG_AD5421 is not set
+# CONFIG_AD5446 is not set
+# CONFIG_AD5449 is not set
+# CONFIG_AD5592R is not set
+# CONFIG_AD5593R is not set
+# CONFIG_AD5504 is not set
+# CONFIG_AD5624R_SPI is not set
+# CONFIG_LTC2632 is not set
+# CONFIG_AD5686 is not set
+# CONFIG_AD5755 is not set
+# CONFIG_AD5761 is not set
+# CONFIG_AD5764 is not set
+# CONFIG_AD5791 is not set
+# CONFIG_AD7303 is not set
+# CONFIG_AD8801 is not set
+# CONFIG_DPOT_DAC is not set
+# CONFIG_M62332 is not set
+# CONFIG_MAX517 is not set
+# CONFIG_MAX5821 is not set
+# CONFIG_MCP4725 is not set
+# CONFIG_MCP4922 is not set
+# CONFIG_VF610_DAC is not set
+
+#
+# IIO dummy driver
+#
+
+#
+# Frequency Synthesizers DDS/PLL
+#
+
+#
+# Clock Generator/Distribution
+#
+# CONFIG_AD9523 is not set
+
+#
+# Phase-Locked Loop (PLL) frequency synthesizers
+#
+# CONFIG_ADF4350 is not set
+
+#
+# Digital gyroscope sensors
+#
+# CONFIG_ADIS16080 is not set
+# CONFIG_ADIS16130 is not set
+# CONFIG_ADIS16136 is not set
+# CONFIG_ADIS16260 is not set
+# CONFIG_ADXRS450 is not set
+# CONFIG_BMG160 is not set
+# CONFIG_MPU3050_I2C is not set
+# CONFIG_IIO_ST_GYRO_3AXIS is not set
+# CONFIG_ITG3200 is not set
+
+#
+# Health Sensors
+#
+
+#
+# Heart Rate Monitors
+#
+# CONFIG_AFE4403 is not set
+# CONFIG_AFE4404 is not set
+# CONFIG_MAX30100 is not set
+# CONFIG_MAX30102 is not set
+
+#
+# Humidity sensors
+#
+# CONFIG_AM2315 is not set
+# CONFIG_DHT11 is not set
+# CONFIG_HDC100X is not set
+# CONFIG_HTS221 is not set
+# CONFIG_HTU21 is not set
+# CONFIG_SI7005 is not set
+# CONFIG_SI7020 is not set
+
+#
+# Inertial measurement units
+#
+# CONFIG_ADIS16400 is not set
+# CONFIG_ADIS16480 is not set
+# CONFIG_BMI160_I2C is not set
+# CONFIG_BMI160_SPI is not set
+# CONFIG_KMX61 is not set
+# CONFIG_INV_MPU6050_SPI is not set
+# CONFIG_IIO_ST_LSM6DSX is not set
+
+#
+# Light sensors
+#
+# CONFIG_ADJD_S311 is not set
+# CONFIG_AL3320A is not set
+# CONFIG_APDS9300 is not set
+# CONFIG_APDS9960 is not set
+# CONFIG_BH1750 is not set
+# CONFIG_BH1780 is not set
+# CONFIG_CM32181 is not set
+# CONFIG_CM3232 is not set
+# CONFIG_CM3323 is not set
+# CONFIG_CM3605 is not set
+# CONFIG_CM36651 is not set
+# CONFIG_GP2AP020A00F is not set
+# CONFIG_SENSORS_ISL29018 is not set
+# CONFIG_SENSORS_ISL29028 is not set
+# CONFIG_ISL29125 is not set
+# CONFIG_JSA1212 is not set
+# CONFIG_RPR0521 is not set
+# CONFIG_LTR501 is not set
+# CONFIG_MAX44000 is not set
+# CONFIG_OPT3001 is not set
+# CONFIG_PA12203001 is not set
+# CONFIG_SI1145 is not set
+# CONFIG_STK3310 is not set
+# CONFIG_TCS3414 is not set
+# CONFIG_TCS3472 is not set
+# CONFIG_SENSORS_TSL2563 is not set
+# CONFIG_TSL2583 is not set
+# CONFIG_TSL4531 is not set
+# CONFIG_US5182D is not set
+# CONFIG_VCNL4000 is not set
+# CONFIG_VEML6070 is not set
+# CONFIG_VL6180 is not set
+
+#
+# Magnetometer sensors
+#
+# CONFIG_AK8974 is not set
+# CONFIG_AK8975 is not set
+# CONFIG_AK09911 is not set
+# CONFIG_BMC150_MAGN_I2C is not set
+# CONFIG_BMC150_MAGN_SPI is not set
+# CONFIG_MAG3110 is not set
+# CONFIG_MMC35240 is not set
+# CONFIG_IIO_ST_MAGN_3AXIS is not set
+# CONFIG_SENSORS_HMC5843_I2C is not set
+# CONFIG_SENSORS_HMC5843_SPI is not set
+
+#
+# Multiplexers
+#
+# CONFIG_IIO_MUX is not set
+
+#
+# Inclinometer sensors
+#
+
+#
+# Triggers - standalone
+#
+# CONFIG_IIO_INTERRUPT_TRIGGER is not set
+# CONFIG_IIO_SYSFS_TRIGGER is not set
+
+#
+# Digital potentiometers
+#
+# CONFIG_DS1803 is not set
+# CONFIG_MAX5481 is not set
+# CONFIG_MAX5487 is not set
+# CONFIG_MCP4131 is not set
+# CONFIG_MCP4531 is not set
+# CONFIG_TPL0102 is not set
+
+#
+# Digital potentiostats
+#
+# CONFIG_LMP91000 is not set
+
+#
+# Pressure sensors
+#
+# CONFIG_ABP060MG is not set
+# CONFIG_BMP280 is not set
+# CONFIG_HP03 is not set
+# CONFIG_MPL115_I2C is not set
+# CONFIG_MPL115_SPI is not set
+# CONFIG_MPL3115 is not set
+# CONFIG_MS5611 is not set
+# CONFIG_MS5637 is not set
+# CONFIG_IIO_ST_PRESS is not set
+# CONFIG_T5403 is not set
+# CONFIG_HP206C is not set
+# CONFIG_ZPA2326 is not set
+
+#
+# Lightning sensors
+#
+# CONFIG_AS3935 is not set
+
+#
+# Proximity and distance sensors
+#
+# CONFIG_LIDAR_LITE_V2 is not set
+# CONFIG_SRF04 is not set
+# CONFIG_SX9500 is not set
+# CONFIG_SRF08 is not set
+
+#
+# Temperature sensors
+#
+# CONFIG_MAXIM_THERMOCOUPLE is not set
+# CONFIG_MLX90614 is not set
+# CONFIG_TMP006 is not set
+# CONFIG_TMP007 is not set
+# CONFIG_TSYS01 is not set
+# CONFIG_TSYS02D is not set
+CONFIG_PWM=y
+CONFIG_PWM_SYSFS=y
+# CONFIG_PWM_FSL_FTM is not set
+# CONFIG_PWM_PCA9685 is not set
+CONFIG_PWM_SAMSUNG=m
+CONFIG_IRQCHIP=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_GIC_MAX_NR=1
+# CONFIG_IPACK_BUS is not set
+CONFIG_ARCH_HAS_RESET_CONTROLLER=y
+CONFIG_RESET_CONTROLLER=y
+# CONFIG_RESET_ATH79 is not set
+# CONFIG_RESET_BERLIN is not set
+# CONFIG_RESET_IMX7 is not set
+# CONFIG_RESET_LANTIQ is not set
+# CONFIG_RESET_LPC18XX is not set
+# CONFIG_RESET_MESON is not set
+# CONFIG_RESET_PISTACHIO is not set
+# CONFIG_RESET_SOCFPGA is not set
+# CONFIG_RESET_STM32 is not set
+# CONFIG_RESET_SUNXI is not set
+# CONFIG_RESET_TI_SYSCON is not set
+# CONFIG_RESET_ZYNQ is not set
+# CONFIG_RESET_TEGRA_BPMP is not set
+# CONFIG_FMC is not set
+
+#
+# PHY Subsystem
+#
+CONFIG_GENERIC_PHY=y
+# CONFIG_PHY_XGENE is not set
+# CONFIG_BCM_KONA_USB2_PHY is not set
+# CONFIG_PHY_PXA_28NM_HSIC is not set
+# CONFIG_PHY_PXA_28NM_USB2 is not set
+# CONFIG_PHY_CPCAP_USB is not set
+CONFIG_PHY_SAMSUNG_USB2=y
+# CONFIG_PHY_EXYNOS4210_USB2 is not set
+# CONFIG_PHY_EXYNOS4X12_USB2 is not set
+# CONFIG_PHY_EXYNOS5250_USB2 is not set
+CONFIG_PHY_NX_USB2=y
+# CONFIG_POWERCAP is not set
+# CONFIG_MCB is not set
+
+#
+# Performance monitor support
+#
+CONFIG_ARM_PMU=y
+# CONFIG_RAS is not set
+
+#
+# Android
+#
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_ANDROID_BINDER_DEVICES="binder"
+# CONFIG_ANDROID_BINDER_IPC_SELFTEST is not set
+# CONFIG_LIBNVDIMM is not set
+CONFIG_DAX=y
+# CONFIG_DEV_DAX is not set
+CONFIG_NVMEM=y
+# CONFIG_STM is not set
+# CONFIG_INTEL_TH is not set
+# CONFIG_FPGA is not set
+
+#
+# FSI support
+#
+# CONFIG_FSI is not set
+# CONFIG_TEE is not set
+
+#
+# Firmware Drivers
+#
+CONFIG_ARM_PSCI_FW=y
+# CONFIG_ARM_PSCI_CHECKER is not set
+# CONFIG_FIRMWARE_MEMMAP is not set
+CONFIG_HAVE_ARM_SMCCC=y
+# CONFIG_GOOGLE_FIRMWARE is not set
+# CONFIG_MESON_SM is not set
+
+#
+# Tegra firmware driver
+#
+
+#
+# File systems
+#
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT3_FS is not set
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+# CONFIG_EXT4_ENCRYPTION is not set
+# CONFIG_EXT4_DEBUG is not set
+CONFIG_JBD2=y
+# CONFIG_JBD2_DEBUG is not set
+CONFIG_FS_MBCACHE=y
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+# CONFIG_F2FS_FS is not set
+# CONFIG_FS_DAX is not set
+CONFIG_FS_POSIX_ACL=y
+CONFIG_EXPORTFS=y
+# CONFIG_EXPORTFS_BLOCK_OPS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_MANDATORY_FILE_LOCKING=y
+# CONFIG_FS_ENCRYPTION is not set
+CONFIG_FSNOTIFY=y
+# CONFIG_DNOTIFY is not set
+CONFIG_INOTIFY_USER=y
+# CONFIG_FANOTIFY is not set
+# CONFIG_QUOTA is not set
+# CONFIG_QUOTACTL is not set
+CONFIG_AUTOFS4_FS=y
+CONFIG_FUSE_FS=y
+# CONFIG_CUSE is not set
+# CONFIG_OVERLAY_FS is not set
+
+#
+# Caches
+#
+CONFIG_FSCACHE=m
+# CONFIG_FSCACHE_STATS is not set
+# CONFIG_FSCACHE_HISTOGRAM is not set
+# CONFIG_FSCACHE_DEBUG is not set
+# CONFIG_FSCACHE_OBJECT_LIST is not set
+# CONFIG_CACHEFILES is not set
+
+#
+# CD-ROM/DVD Filesystems
+#
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+# CONFIG_ZISOFS is not set
+# CONFIG_UDF_FS is not set
+
+#
+# DOS/FAT/NT Filesystems
+#
+CONFIG_FAT_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_FAT_DEFAULT_UTF8 is not set
+# CONFIG_NTFS_FS is not set
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+# CONFIG_PROC_KCORE is not set
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_PROC_CHILDREN is not set
+CONFIG_KERNFS=y
+CONFIG_SYSFS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TMPFS_XATTR=y
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
+CONFIG_CONFIGFS_FS=y
+CONFIG_MISC_FILESYSTEMS=y
+# CONFIG_ORANGEFS_FS is not set
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_ECRYPT_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_QNX6FS_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_PSTORE is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+CONFIG_NETWORK_FILESYSTEMS=y
+CONFIG_NFS_FS=m
+CONFIG_NFS_V2=m
+CONFIG_NFS_V3=m
+# CONFIG_NFS_V3_ACL is not set
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFS_SWAP is not set
+# CONFIG_NFS_FSCACHE is not set
+CONFIG_NFSD=m
+CONFIG_NFSD_V3=y
+# CONFIG_NFSD_V3_ACL is not set
+# CONFIG_NFSD_V4 is not set
+CONFIG_GRACE_PERIOD=m
+CONFIG_LOCKD=m
+CONFIG_LOCKD_V4=y
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=m
+# CONFIG_SUNRPC_DEBUG is not set
+# CONFIG_CEPH_FS is not set
+CONFIG_CIFS=m
+# CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
+# CONFIG_CIFS_UPCALL is not set
+# CONFIG_CIFS_XATTR is not set
+CONFIG_CIFS_DEBUG=y
+# CONFIG_CIFS_DEBUG2 is not set
+# CONFIG_CIFS_DEBUG_DUMP_KEYS is not set
+# CONFIG_CIFS_DFS_UPCALL is not set
+# CONFIG_CIFS_SMB311 is not set
+# CONFIG_CIFS_FSCACHE is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+CONFIG_NLS_CODEPAGE_437=y
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+CONFIG_NLS_ASCII=y
+CONFIG_NLS_ISO8859_1=y
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_MAC_ROMAN is not set
+# CONFIG_NLS_MAC_CELTIC is not set
+# CONFIG_NLS_MAC_CENTEURO is not set
+# CONFIG_NLS_MAC_CROATIAN is not set
+# CONFIG_NLS_MAC_CYRILLIC is not set
+# CONFIG_NLS_MAC_GAELIC is not set
+# CONFIG_NLS_MAC_GREEK is not set
+# CONFIG_NLS_MAC_ICELAND is not set
+# CONFIG_NLS_MAC_INUIT is not set
+# CONFIG_NLS_MAC_ROMANIAN is not set
+# CONFIG_NLS_MAC_TURKISH is not set
+# CONFIG_NLS_UTF8 is not set
+# CONFIG_DLM is not set
+# CONFIG_VIRTUALIZATION is not set
+
+#
+# Kernel hacking
+#
+
+#
+# printk and dmesg options
+#
+CONFIG_PRINTK_TIME=y
+CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
+CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
+# CONFIG_BOOT_PRINTK_DELAY is not set
+CONFIG_DYNAMIC_DEBUG=y
+
+#
+# Compile-time checks and compiler options
+#
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO_REDUCED is not set
+# CONFIG_DEBUG_INFO_SPLIT is not set
+# CONFIG_DEBUG_INFO_DWARF4 is not set
+# CONFIG_GDB_SCRIPTS is not set
+CONFIG_ENABLE_WARN_DEPRECATED=y
+CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
+# CONFIG_STRIP_ASM_SYMS is not set
+# CONFIG_READABLE_ASM is not set
+# CONFIG_UNUSED_SYMBOLS is not set
+# CONFIG_PAGE_OWNER is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_DEBUG_SECTION_MISMATCH is not set
+CONFIG_SECTION_MISMATCH_WARN_ONLY=y
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_FRAME_POINTER=y
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1
+CONFIG_MAGIC_SYSRQ_SERIAL=y
+CONFIG_DEBUG_KERNEL=y
+
+#
+# Memory Debugging
+#
+# CONFIG_PAGE_EXTENSION is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+# CONFIG_PAGE_POISONING is not set
+# CONFIG_DEBUG_PAGE_REF is not set
+# CONFIG_DEBUG_RODATA_TEST is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_SLAB is not set
+CONFIG_HAVE_DEBUG_KMEMLEAK=y
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_MEMORY_INIT is not set
+# CONFIG_DEBUG_PER_CPU_MAPS is not set
+CONFIG_HAVE_ARCH_KASAN=y
+# CONFIG_KASAN is not set
+CONFIG_ARCH_HAS_KCOV=y
+# CONFIG_KCOV is not set
+# CONFIG_DEBUG_SHIRQ is not set
+
+#
+# Debug Lockups and Hangs
+#
+# CONFIG_SOFTLOCKUP_DETECTOR is not set
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=10
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+# CONFIG_WQ_WATCHDOG is not set
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=5
+CONFIG_SCHED_DEBUG=y
+CONFIG_SCHED_INFO=y
+CONFIG_SCHEDSTATS=y
+# CONFIG_SCHED_STACK_END_CHECK is not set
+# CONFIG_DEBUG_TIMEKEEPING is not set
+CONFIG_DEBUG_PREEMPT=y
+
+#
+# Lock Debugging (spinlocks, mutexes, etc...)
+#
+# CONFIG_DEBUG_RT_MUTEXES is not set
+CONFIG_DEBUG_SPINLOCK=y
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_LOCK_TORTURE_TEST is not set
+# CONFIG_WW_MUTEX_SELFTEST is not set
+CONFIG_STACKTRACE=y
+# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set
+# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_HAVE_DEBUG_BUGVERBOSE=y
+CONFIG_DEBUG_BUGVERBOSE=y
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_PI_LIST is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_CREDENTIALS is not set
+
+#
+# RCU Debugging
+#
+# CONFIG_PROVE_RCU is not set
+# CONFIG_TORTURE_TEST is not set
+# CONFIG_RCU_PERF_TEST is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
+# CONFIG_RCU_TRACE is not set
+# CONFIG_RCU_EQS_DEBUG is not set
+# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set
+# CONFIG_NOTIFIER_ERROR_INJECTION is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
+CONFIG_NOP_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_TRACER_MAX_TRACE=y
+CONFIG_TRACE_CLOCK=y
+CONFIG_RING_BUFFER=y
+CONFIG_EVENT_TRACING=y
+CONFIG_CONTEXT_SWITCH_TRACER=y
+CONFIG_TRACING=y
+CONFIG_GENERIC_TRACER=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_FTRACE=y
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_PREEMPT_TRACER is not set
+CONFIG_SCHED_TRACER=y
+# CONFIG_HWLAT_TRACER is not set
+# CONFIG_FTRACE_SYSCALLS is not set
+CONFIG_TRACER_SNAPSHOT=y
+# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_UPROBE_EVENTS is not set
+# CONFIG_PROBE_EVENTS is not set
+# CONFIG_FTRACE_STARTUP_TEST is not set
+# CONFIG_TRACEPOINT_BENCHMARK is not set
+# CONFIG_RING_BUFFER_BENCHMARK is not set
+# CONFIG_RING_BUFFER_STARTUP_TEST is not set
+# CONFIG_TRACE_EVAL_MAP_FILE is not set
+CONFIG_TRACING_EVENTS_GPIO=y
+# CONFIG_DMA_API_DEBUG is not set
+
+#
+# Runtime Testing
+#
+# CONFIG_LKDTM is not set
+# CONFIG_TEST_LIST_SORT is not set
+# CONFIG_TEST_SORT is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_RBTREE_TEST is not set
+# CONFIG_INTERVAL_TREE_TEST is not set
+# CONFIG_PERCPU_TEST is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
+# CONFIG_TEST_HEXDUMP is not set
+# CONFIG_TEST_STRING_HELPERS is not set
+# CONFIG_TEST_KSTRTOX is not set
+# CONFIG_TEST_PRINTF is not set
+# CONFIG_TEST_BITMAP is not set
+# CONFIG_TEST_UUID is not set
+# CONFIG_TEST_RHASHTABLE is not set
+# CONFIG_TEST_HASH is not set
+# CONFIG_TEST_LKM is not set
+# CONFIG_TEST_USER_COPY is not set
+# CONFIG_TEST_BPF is not set
+# CONFIG_TEST_FIRMWARE is not set
+# CONFIG_TEST_SYSCTL is not set
+# CONFIG_TEST_UDELAY is not set
+# CONFIG_TEST_STATIC_KEYS is not set
+# CONFIG_TEST_KMOD is not set
+# CONFIG_MEMTEST is not set
+# CONFIG_BUG_ON_DATA_CORRUPTION is not set
+# CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_KGDB=y
+CONFIG_KGDB_SERIAL_CONSOLE=y
+# CONFIG_KGDB_TESTS is not set
+CONFIG_KGDB_KDB=y
+CONFIG_KDB_DEFAULT_ENABLE=0x1
+# CONFIG_KDB_KEYBOARD is not set
+CONFIG_KDB_CONTINUE_CATASTROPHIC=0
+CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
+# CONFIG_ARCH_WANTS_UBSAN_NO_NULL is not set
+# CONFIG_UBSAN is not set
+CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y
+# CONFIG_STRICT_DEVMEM is not set
+# CONFIG_ARM64_PTDUMP_CORE is not set
+# CONFIG_ARM64_PTDUMP_DEBUGFS is not set
+# CONFIG_PID_IN_CONTEXTIDR is not set
+# CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set
+# CONFIG_DEBUG_WX is not set
+# CONFIG_DEBUG_ALIGN_RODATA is not set
+# CONFIG_ARM64_RELOC_TEST is not set
+# CONFIG_CORESIGHT is not set
+
+#
+# Security options
+#
+CONFIG_KEYS=y
+CONFIG_KEYS_COMPAT=y
+# CONFIG_PERSISTENT_KEYRINGS is not set
+# CONFIG_BIG_KEYS is not set
+# CONFIG_ENCRYPTED_KEYS is not set
+# CONFIG_KEY_DH_OPERATIONS is not set
+# CONFIG_SECURITY_DMESG_RESTRICT is not set
+CONFIG_SECURITY=y
+# CONFIG_SECURITY_WRITABLE_HOOKS is not set
+# CONFIG_SECURITYFS is not set
+CONFIG_SECURITY_NETWORK=y
+# CONFIG_SECURITY_NETWORK_XFRM is not set
+# CONFIG_SECURITY_PATH is not set
+CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
+# CONFIG_HARDENED_USERCOPY is not set
+# CONFIG_FORTIFY_SOURCE is not set
+# CONFIG_STATIC_USERMODEHELPER is not set
+# CONFIG_SECURITY_SELINUX is not set
+# CONFIG_SECURITY_SMACK is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_SECURITY_APPARMOR is not set
+# CONFIG_SECURITY_LOADPIN is not set
+# CONFIG_SECURITY_YAMA is not set
+CONFIG_INTEGRITY=y
+# CONFIG_INTEGRITY_SIGNATURE is not set
+CONFIG_INTEGRITY_AUDIT=y
+# CONFIG_IMA is not set
+# CONFIG_EVM is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_AKCIPHER2=y
+CONFIG_CRYPTO_KPP2=y
+CONFIG_CRYPTO_KPP=m
+CONFIG_CRYPTO_ACOMP2=y
+# CONFIG_CRYPTO_RSA is not set
+# CONFIG_CRYPTO_DH is not set
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+# CONFIG_CRYPTO_USER is not set
+CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+CONFIG_CRYPTO_GF128MUL=m
+CONFIG_CRYPTO_NULL=y
+CONFIG_CRYPTO_NULL2=y
+# CONFIG_CRYPTO_PCRYPT is not set
+CONFIG_CRYPTO_WORKQUEUE=y
+# CONFIG_CRYPTO_CRYPTD is not set
+# CONFIG_CRYPTO_MCRYPTD is not set
+CONFIG_CRYPTO_AUTHENC=y
+# CONFIG_CRYPTO_TEST is not set
+
+#
+# Authenticated Encryption with Associated Data
+#
+CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_GCM=m
+# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
+CONFIG_CRYPTO_SEQIV=m
+CONFIG_CRYPTO_ECHAINIV=y
+
+#
+# Block modes
+#
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CTR=m
+# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_ECB=y
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+# CONFIG_CRYPTO_KEYWRAP is not set
+
+#
+# Hash modes
+#
+CONFIG_CRYPTO_CMAC=m
+CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_XCBC is not set
+# CONFIG_CRYPTO_VMAC is not set
+
+#
+# Digest
+#
+CONFIG_CRYPTO_CRC32C=y
+# CONFIG_CRYPTO_CRC32 is not set
+# CONFIG_CRYPTO_CRCT10DIF is not set
+CONFIG_CRYPTO_GHASH=m
+# CONFIG_CRYPTO_POLY1305 is not set
+CONFIG_CRYPTO_MD4=m
+CONFIG_CRYPTO_MD5=y
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_RMD128 is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RMD256 is not set
+# CONFIG_CRYPTO_RMD320 is not set
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA256=y
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_SHA3 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_WP512 is not set
+
+#
+# Ciphers
+#
+CONFIG_CRYPTO_AES=y
+# CONFIG_CRYPTO_AES_TI is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+CONFIG_CRYPTO_ARC4=y
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+CONFIG_CRYPTO_DES=y
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_CHACHA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_TWOFISH_COMMON=y
+
+#
+# Compression
+#
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LZO=y
+# CONFIG_CRYPTO_842 is not set
+# CONFIG_CRYPTO_LZ4 is not set
+# CONFIG_CRYPTO_LZ4HC is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_DRBG_MENU=y
+CONFIG_CRYPTO_DRBG_HMAC=y
+# CONFIG_CRYPTO_DRBG_HASH is not set
+# CONFIG_CRYPTO_DRBG_CTR is not set
+CONFIG_CRYPTO_DRBG=y
+CONFIG_CRYPTO_JITTERENTROPY=y
+# CONFIG_CRYPTO_USER_API_HASH is not set
+# CONFIG_CRYPTO_USER_API_SKCIPHER is not set
+# CONFIG_CRYPTO_USER_API_RNG is not set
+# CONFIG_CRYPTO_USER_API_AEAD is not set
+# CONFIG_CRYPTO_HW is not set
+# CONFIG_ASYMMETRIC_KEY_TYPE is not set
+
+#
+# Certificates for signature checking
+#
+# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
+# CONFIG_ARM64_CRYPTO is not set
+CONFIG_BINARY_PRINTF=y
+
+#
+# Library routines
+#
+CONFIG_BITREVERSE=y
+CONFIG_HAVE_ARCH_BITREVERSE=y
+CONFIG_RATIONAL=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_NET_UTILS=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_IO=y
+CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
+CONFIG_CRC_CCITT=y
+CONFIG_CRC16=y
+# CONFIG_CRC_T10DIF is not set
+CONFIG_CRC_ITU_T=m
+CONFIG_CRC32=y
+# CONFIG_CRC32_SELFTEST is not set
+CONFIG_CRC32_SLICEBY8=y
+# CONFIG_CRC32_SLICEBY4 is not set
+# CONFIG_CRC32_SARWATE is not set
+# CONFIG_CRC32_BIT is not set
+# CONFIG_CRC4 is not set
+# CONFIG_CRC7 is not set
+CONFIG_LIBCRC32C=y
+# CONFIG_CRC8 is not set
+CONFIG_AUDIT_GENERIC=y
+CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
+CONFIG_AUDIT_COMPAT_GENERIC=y
+# CONFIG_RANDOM32_SELFTEST is not set
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+# CONFIG_XZ_DEC is not set
+# CONFIG_XZ_DEC_BCJ is not set
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_KMP=y
+CONFIG_TEXTSEARCH_BM=y
+CONFIG_TEXTSEARCH_FSM=y
+CONFIG_RADIX_TREE_MULTIORDER=y
+CONFIG_ASSOCIATIVE_ARRAY=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_DMA=y
+# CONFIG_DMA_NOOP_OPS is not set
+# CONFIG_DMA_VIRT_OPS is not set
+CONFIG_CPU_RMAP=y
+CONFIG_DQL=y
+CONFIG_GLOB=y
+# CONFIG_GLOB_SELFTEST is not set
+CONFIG_NLATTR=y
+# CONFIG_CORDIC is not set
+# CONFIG_DDR is not set
+# CONFIG_IRQ_POLL is not set
+CONFIG_LIBFDT=y
+CONFIG_FONT_SUPPORT=y
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x8=y
+CONFIG_FONT_8x16=y
+# CONFIG_SG_SPLIT is not set
+CONFIG_SG_POOL=y
+CONFIG_ARCH_HAS_SG_CHAIN=y
+CONFIG_SBITMAP=y
+# CONFIG_STRING_SELFTEST is not set
diff -ENwbur a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
--- a/arch/arm64/include/asm/arch_timer.h	2018-05-06 08:47:35.377264876 +0200
+++ b/arch/arm64/include/asm/arch_timer.h	2018-05-06 08:49:48.266658411 +0200
@@ -131,6 +131,7 @@
 	BUG();
 }

+#ifdef CONFIG_ARM_ARCH_TIMER
 static inline u32 arch_timer_get_cntfrq(void)
 {
 	return read_sysreg(cntfrq_el0);
@@ -165,5 +166,33 @@
 {
 	return 0;
 }
+#else
+static inline u32 arch_timer_get_cntfrq(void)
+{
+	return 0;
+}
+
+static inline u32 arch_timer_get_cntkctl(void)
+{
+
+	return 0;
+}
+
+static inline void arch_timer_set_cntkctl(u32 cntkctl)
+{
+}
+
+static inline u64 arch_counter_get_cntpct(void)
+{
+/*
+* AArch64 kernel and user space mandate the use of CNTVCT.
+*/
+	BUG();
+	return 0;
+}
+
+extern u64 arch_counter_get_cntvct(void);
+extern int arch_timer_arch_init(void);
+#endif

 #endif
diff -ENwbur a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
--- a/arch/arm64/include/asm/tlbflush.h	2018-05-06 08:47:35.385265201 +0200
+++ b/arch/arm64/include/asm/tlbflush.h	2018-05-06 08:49:48.270658574 +0200
@@ -117,23 +117,36 @@

 static inline void flush_tlb_mm(struct mm_struct *mm)
 {
+	/* FIXME: temporary turnaround code to resolve tlb flush by ASID BUG.
+	 * We assume the cause of this issue is synchronization between cpu
+	 * clusters. This issue must be resolved in BL1~BL3 layer not here.
+	 * This patch will be removed afterwards.
+	 */
+#if defined (CONFIG_SMP) && defined (CONFIG_ARCH_S5P6818)
+	flush_tlb_all();
+#else
 	unsigned long asid = ASID(mm) << 48;

 	dsb(ishst);
 	__tlbi(aside1is, asid);
 	__tlbi_user(aside1is, asid);
 	dsb(ish);
+#endif
 }

 static inline void flush_tlb_page(struct vm_area_struct *vma,
 				  unsigned long uaddr)
 {
+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+	flush_tlb_mm(vma->vm_mm);
+#else
 	unsigned long addr = uaddr >> 12 | (ASID(vma->vm_mm) << 48);

 	dsb(ishst);
 	__tlbi(vale1is, addr);
 	__tlbi_user(vale1is, addr);
 	dsb(ish);
+#endif
 }

 /*
@@ -146,6 +159,9 @@
 				     unsigned long start, unsigned long end,
 				     bool last_level)
 {
+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+	flush_tlb_mm(vma->vm_mm);
+#else
 	unsigned long asid = ASID(vma->vm_mm) << 48;
 	unsigned long addr;

@@ -168,6 +184,7 @@
 		}
 	}
 	dsb(ish);
+#endif
 }

 static inline void flush_tlb_range(struct vm_area_struct *vma,
@@ -178,6 +195,9 @@

 static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end)
 {
+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+	flush_tlb_all();
+#else
 	unsigned long addr;

 	if ((end - start) > MAX_TLB_RANGE) {
@@ -193,6 +213,7 @@
 		__tlbi(vaae1is, addr);
 	dsb(ish);
 	isb();
+#endif
 }

 /*
@@ -202,11 +223,15 @@
 static inline void __flush_tlb_pgtable(struct mm_struct *mm,
 				       unsigned long uaddr)
 {
+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+	flush_tlb_mm(mm);
+#else
 	unsigned long addr = uaddr >> 12 | (ASID(mm) << 48);

 	__tlbi(vae1is, addr);
 	__tlbi_user(vae1is, addr);
 	dsb(ish);
+#endif
 }

 #endif
diff -ENwbur a/arch/arm64/Kconfig b/arch/arm64/Kconfig
--- a/arch/arm64/Kconfig	2018-05-06 08:47:35.345263577 +0200
+++ b/arch/arm64/Kconfig	2018-05-06 08:49:48.242657438 +0200
@@ -30,11 +30,11 @@
 	select ARCH_WANT_FRAME_POINTERS
 	select ARCH_HAS_UBSAN_SANITIZE_ALL
 	select ARM_AMBA
-	select ARM_ARCH_TIMER
+	select ARM_ARCH_TIMER if !ARCH_S5P6818
 	select ARM_GIC
 	select AUDIT_ARCH_COMPAT_GENERIC
 	select ARM_GIC_V2M if PCI
-	select ARM_GIC_V3
+	select ARM_GIC_V3 if !ARCH_S5P6818
 	select ARM_GIC_V3_ITS if PCI
 	select ARM_PSCI_FW
 	select BUILDTIME_EXTABLE_SORT
@@ -612,6 +612,25 @@
 	default 47 if ARM64_VA_BITS_47
 	default 48 if ARM64_VA_BITS_48

+config ARM64_WORKAROUND_CCI400_DVMV7
+	bool "Work around for cci400 using dvmv7 protocol"
+	depends on SMP
+	help
+	  This option adds an alternative code sequence to work around ARMv8
+	  cores using CCI400 DVMv7 protocol.
+
+	  According to "AMBA AXI and ACE Protocol Specification" chapter C12.4,
+	  12.6, CCI400 optionally supports DVM(Distributed Virtual Message)
+	  protocol version8(DVMv8), and version8 supports ARMv8 and ARMv7 but,
+	  version7(DVMv7) supports only ARMv7.
+
+	  To work properly with DVMv7 protocol, C12.4 recommends below list.
+	  - If upper 8-bits of ASID are zero the message will be received correctly
+	  - TLB Invalidation by address range will work incorrectly
+
+	  So, this patch changes available bits of ASID and all tlb flush by address
+	  range commands to flush by ASID.
+
 config CPU_BIG_ENDIAN
        bool "Build big-endian kernel"
        help
diff -ENwbur a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
--- a/arch/arm64/Kconfig.platforms	2018-05-06 08:47:35.345263577 +0200
+++ b/arch/arm64/Kconfig.platforms	2018-05-06 08:49:48.242657438 +0200
@@ -215,6 +215,20 @@
 	help
 	  Support for Spreadtrum ARM based SoCs

+config ARCH_S5P6818
+	bool "NEXELL S5P6818"
+	select ARCH_REQUIRE_GPIOLIB
+	select ARCH_HAS_RESET_CONTROLLER
+	select CLKSRC_NXP_TIMER
+	select RESET_CONTROLLER
+	select PINCTRL
+	select ARM64_ERRATUM_845719
+	select HAVE_S3C2410_I2C if I2C
+	select HAVE_S3C2410_WATCHDOG if WATCHDOG
+	select ARM64_WORKAROUND_CCI400_DVMV7
+	help
+	  This enables support for the NEXELL S5P6818 Architecture
+
 config ARCH_THUNDER
 	bool "Cavium Inc. Thunder SoC Family"
 	help
diff -ENwbur a/arch/arm64/kernel/time.c b/arch/arm64/kernel/time.c
--- a/arch/arm64/kernel/time.c	2018-05-06 08:47:35.393265526 +0200
+++ b/arch/arm64/kernel/time.c	2018-05-06 08:49:48.278658899 +0200
@@ -66,11 +66,14 @@

 void __init time_init(void)
 {
+#ifdef CONFIG_ARM_ARCH_TIMER
 	u32 arch_timer_rate;
+#endif

 	of_clk_init(NULL);
 	timer_probe();

+#ifdef CONFIG_ARM_ARCH_TIMER
 	tick_setup_hrtimer_broadcast();

 	arch_timer_rate = arch_timer_get_rate();
@@ -79,4 +82,5 @@

 	/* Calibrate the delay loop directly */
 	lpj_fine = arch_timer_rate / HZ;
+#endif
 }
diff -ENwbur a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
--- a/arch/arm64/mm/context.c	2018-05-06 08:47:35.397265688 +0200
+++ b/arch/arm64/mm/context.c	2018-05-06 08:49:48.282659061 +0200
@@ -69,6 +69,11 @@
 		asid = 16;
 	}

+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+/* In DVMv7 protocol, ASID bits must be 8 regardless of cpu core feature */
+	asid = 8;
+#endif
+
 	return asid;
 }

@@ -119,6 +124,9 @@

 	/* Queue a TLB invalidate and flush the I-cache if necessary. */
 	cpumask_setall(&tlb_flush_pending);
+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+	flush_tlb_all();
+#endif
 }

 static bool check_update_reserved_asid(u64 asid, u64 newasid)
@@ -236,6 +244,9 @@
 	 */
 	if (!system_uses_ttbr0_pan())
 		cpu_switch_mm(mm->pgd, mm);
+#ifdef CONFIG_ARM64_WORKAROUND_CCI400_DVMV7
+	flush_tlb_all();
+#endif
 }

 /* Errata workaround post TTBRx_EL1 update. */
diff -ENwbur a/Documentation/devicetree/bindings/pinctrl/nexell,s5p6818-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/nexell,s5p6818-pinctrl.txt
--- a/Documentation/devicetree/bindings/pinctrl/nexell,s5p6818-pinctrl.txt	1970-01-01 01:00:00.000000000 +0100
+++ b/Documentation/devicetree/bindings/pinctrl/nexell,s5p6818-pinctrl.txt	2018-05-06 08:49:47.754637636 +0200
@@ -0,0 +1,95 @@
+Binding for Nexell s5p6818 pin cotroller
+========================================
+
+Nexell's ARM bases SoC's integrates a GPIO and Pin mux/config hardware
+controller. It controls the input/output settings on the available pads/pins
+and also provides ability to multiplex and configure the output of various
+on-chip controllers onto these pads.
+
+Please refer to pinctrl-bindings.txt in this directory for details of the
+common pinctrl bindings used by client devices, including the meaning of the
+phrase "pin configuration node".
+
+
+Required properties:
+  - compatible: may be "nexell,s5pxx18-pinctrl", "nexell,s5p6818-pinctrl"
+  - reg: should be register base and length as documented in the datasheet
+  - interrupts: interrupt specifier for the controller over gpio and alive pins
+
+Example:
+pinctrl_0: pinctrl@c0010000 {
+	compatible = "nexell,s5pxx18-pinctrl";
+	#address-cells = <1>;
+	#size-cells = <1>;
+	reg = <PHYS_BASE_GPIOA 0x1000
+	       PHYS_BASE_GPIOB 0x1000
+	       PHYS_BASE_GPIOC 0x1000
+	       PHYS_BASE_GPIOD 0x1000
+	       PHYS_BASE_GPIOE 0x1000
+	       PHYS_BASE_ALIVE 0x800>;
+	interrupts = <0 IRQ_GPIOA 0>,
+		     <0 IRQ_GPIOB 0>,
+		     <0 IRQ_GPIOC 0>,
+		     <0 IRQ_GPIOD 0>,
+		     <0 IRQ_GPIOE 0>,
+		     <0 IRQ_ALIVE 0>;
+};
+
+  Note: Setting up the order must always match.
+
+
+Nexell's pin configuration nodes act as a container for an arbitrary number of
+subnodes. Each of these subnodes represents some desired configuration for a
+pin, a group, or a list of pins or groups. This configuration can include the
+mux function to select on those pin(s)/group(s), and various pin configuration
+parameters.
+
+  Child nodes must be set at least one of the following settings:
+  - nexell,pins = Select pins for using this function.
+  - nexell,pin-function = Select the function for use in a selected pin.
+  - nexell,pin-pull = Pull up/down configuration.
+  - nexell,pin-strength = Drive strength configuration.
+
+  Valid values for nexell,pins are:
+     "gpioX-N" : X in {A,B,C,D,E}, N in {0-31}
+  Valid values for nexell,pin-function are:
+     "N"       : N in {0-3}.
+                 This setting means that the value is different for each pin.
+                 Please refer to datasheet.
+  Valid values for nexell,pin-pull are:
+     "N"       : 0 - Down, 1 - Up, 2 - Off
+  Valid values for nexell,pin-strength are:
+     "N"       : 0,1,2,3
+
+
+Example:
+  - pin settings
+	gmac_txd: gmac-txd {
+		nexell,pins = "gpioe-7", "gpioe-8", "gpioe-9", "gpioe-10";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <3>;
+	};
+
+	gmac_rxd: gmac-rxd {
+		nexell,pins = "gpioe-14", "gpioe-15", "gpioe-16", "gpioe-17";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <3>;
+	};
+
+	gmac_txen: gmac-txen {
+		nexell,pins = "gpioe-11";
+		nexell,pin-function = <1>;
+		nexell,pin-pull = <2>;
+		nexell,pin-strength = <3>;
+	};
+
+  - used by client devices
+	gmac0:ethernet@... {
+		pinctrl-names = "default";
+		pinctrl-0 = <&gmac_txd &gmac_rxd &gmac_txen &gmac_mdc
+		             &gmac_mdio &gmac_rxclk &gmac_txclk>;
+		...
+	};
+
diff -ENwbur a/Documentation/devicetree/bindings/reset/nexell,reset.txt b/Documentation/devicetree/bindings/reset/nexell,reset.txt
--- a/Documentation/devicetree/bindings/reset/nexell,reset.txt	1970-01-01 01:00:00.000000000 +0100
+++ b/Documentation/devicetree/bindings/reset/nexell,reset.txt	2018-05-06 08:49:47.766638123 +0200
@@ -0,0 +1,32 @@
+Nexell System Reset Controller
+======================================
+
+Please also refer to reset.txt in this directory for common reset
+controller binding usage.
+
+The reset controller registers are part of the system-ctl block on s5pxx18 SoC.
+
+Required properties:
+- compatible: may be "nexell,s5pxx18-reset"
+- reg: should be register base and length as documented in the datasheet
+- #reset-cells: 1, see below
+
+Example:
+nexell_reset:reset@c0012000 {
+	#reset-cells = <1>;
+	compatible = "nexell,s5pxx18-reset";
+	reg = <0xC0012000 0x3>;
+};
+
+Specifying reset lines connected to IP modules
+==============================================
+example:
+
+	serial0:serial@..... {
+		...
+		resets  = <&nexell_reset RESET_ID_UART0>;
+		reset-names = "uart-reset";
+                ...
+        };
+
+The index could be found in <dt-bindings/reset/nexell,{CHIP NAME}-reset.h>.
diff -ENwbur a/drivers/clk/Makefile b/drivers/clk/Makefile
--- a/drivers/clk/Makefile	2018-05-06 08:47:36.225299305 +0200
+++ b/drivers/clk/Makefile	2018-05-06 08:49:49.034689576 +0200
@@ -98,3 +98,4 @@
 endif
 obj-$(CONFIG_ARCH_ZX)			+= zte/
 obj-$(CONFIG_ARCH_ZYNQ)			+= zynq/
+obj-$(CONFIG_ARCH_S5P6818)   		+= nexell/
diff -ENwbur a/drivers/clk/nexell/clk-s5pxx18.c b/drivers/clk/nexell/clk-s5pxx18.c
--- a/drivers/clk/nexell/clk-s5pxx18.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/clk/nexell/clk-s5pxx18.c	2018-05-06 08:49:49.054690387 +0200
@@ -0,0 +1,589 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/clk.h>
+#include <linux/clkdev.h>
+#include <linux/clk-provider.h>
+#include <linux/slab.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/syscore_ops.h>
+
+#include "clk-s5pxx18.h"
+
+#define to_clk_dev(_hw) container_of(_hw, struct clk_dev, hw)
+
+struct clk_dev_peri {
+	const char *parent_name;
+	const char *name;
+	void __iomem *base;
+	int id;
+	int clk_step; /* 1S or 2S */
+	bool enable;
+	long rate;
+	u32 in_mask;
+	u32 in_mask1;
+	/* clock register */
+	int div_src_0;
+	int div_val_0;
+	int invert_0;
+	int div_src_1;
+	int div_val_1;
+	int invert_1;
+	int in_extclk_1;
+	int in_extclk_2;
+	int fix_src;
+};
+
+struct clk_dev {
+	struct device_node *node;
+	struct clk *clk;
+	struct clk_hw hw;
+	struct clk_dev_peri *peri;
+	unsigned int rate;
+	spinlock_t lock;
+};
+
+struct clk_dev_map {
+	unsigned int con_enb;
+	unsigned int con_gen[4];
+};
+
+#define MAX_DIVIDER ((1 << 8) - 1) /* 256, align 2 */
+
+static inline void clk_dev_bclk(void *base, int on)
+{
+	struct clk_dev_map *reg = base;
+	unsigned int val = readl(&reg->con_enb) & ~(0x3);
+
+	val |= (on ? 3 : 0) & 0x3; /* always BCLK */
+	writel(val, &reg->con_enb);
+}
+
+static inline void clk_dev_pclk(void *base, int on)
+{
+	struct clk_dev_map *reg = base;
+	unsigned int val = 0;
+
+	if (!on)
+		return;
+
+	val = readl(&reg->con_enb) & ~(1 << 3);
+	val |= (1 << 3);
+	writel(val, &reg->con_enb);
+}
+
+static inline void clk_dev_rate(void *base, int step, int src, int div)
+{
+	struct clk_dev_map *reg = base;
+	unsigned int val = 0;
+
+	val = readl(&reg->con_gen[step << 1]);
+	val &= ~(0x07 << 2);
+	val |= (src << 2); /* source */
+	val &= ~(0xFF << 5);
+	val |= (div - 1) << 5; /* divider */
+	writel(val, &reg->con_gen[step << 1]);
+}
+
+static inline void clk_dev_inv(void *base, int step, int inv)
+{
+	struct clk_dev_map *reg = base;
+	unsigned int val = readl(&reg->con_gen[step << 1]) & ~(1 << 1);
+
+	val |= (inv << 1);
+	writel(val, &reg->con_gen[step << 1]);
+}
+
+static inline void clk_dev_enb(void *base, int on)
+{
+	struct clk_dev_map *reg = base;
+	unsigned int val = readl(&reg->con_enb) & ~(1 << 2);
+
+	val |= ((on ? 1 : 0) << 2);
+	writel(val, &reg->con_enb);
+}
+
+static inline long clk_dev_divide(long rate, long request, int align,
+				  int *divide)
+{
+	int div = (rate / request);
+	int max = MAX_DIVIDER & ~(align - 1);
+	int adv = (div & ~(align - 1)) + align;
+
+	if (!div) {
+		if (divide)
+			*divide = 1;
+		return rate;
+	}
+
+	if (1 != div)
+		div &= ~(align - 1);
+
+	if (div != adv && abs(request - rate / div) > abs(request - rate / adv))
+		div = adv;
+
+	div = (div > max ? max : div);
+	if (divide)
+		*divide = div;
+
+	return (rate / div);
+}
+
+static long clk_dev_bus_rate(struct clk_dev_peri *peri)
+{
+	struct clk *clk;
+	const char *name = NULL;
+	long rate = 0;
+
+	if (I_PCLK_MASK & peri->in_mask)
+		name = CLK_BUS_PCLK;
+	else if (I_BCLK_MASK & peri->in_mask)
+		name = CLK_BUS_PCLK;
+
+	if (name) {
+		clk = clk_get(NULL, name);
+		rate = clk_get_rate(clk);
+		clk_put(clk);
+	}
+
+	return rate ?: -EINVAL;
+}
+
+static long clk_dev_pll_rate(int no)
+{
+	struct clk *clk;
+	char name[16];
+	long rate = 0;
+
+	sprintf(name, "pll%d", no);
+	clk = clk_get(NULL, name);
+	rate = clk_get_rate(clk);
+	clk_put(clk);
+
+	return rate;
+}
+
+static long dev_round_rate(struct clk_hw *hw, unsigned long rate)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+	unsigned long request = rate, new_rate = 0;
+	unsigned long clock_hz, freq_hz = 0;
+	unsigned int mask;
+	int step, div[2] = {
+		0,
+	};
+	int i, n, start_src = 0, max_src = 0, clk2 = 0;
+	short s1 = 0, s2 = 0, d1 = 0, d2 = 0;
+
+	step = peri->clk_step;
+	mask = peri->in_mask;
+	pr_debug("clk: %s request = %ld [input=0x%x]\n", peri->name, rate,
+		 mask);
+
+	if (!(mask & I_CLOCK_MASK))
+		return clk_dev_bus_rate(peri);
+
+next:
+	if (peri->fix_src >= 0) {
+		start_src = peri->fix_src;
+		max_src = start_src + 1;
+	} else {
+		start_src = 0;
+		max_src = I_CLOCK_NUM;
+	}
+
+	for (n = start_src ; n < max_src ; n++) {
+		if (!(((mask & I_CLOCK_MASK) >> n) & 0x1))
+			continue;
+
+		if (I_EXT1_BIT == n)
+			rate = peri->in_extclk_1;
+		else if (I_EXT2_BIT == n)
+			rate = peri->in_extclk_2;
+		else
+			rate = clk_dev_pll_rate(n);
+
+		if (!rate)
+			continue;
+
+		clock_hz = rate;
+		for (i = 0; step > i; i++)
+			rate = clk_dev_divide(rate, request, 2, &div[i]);
+
+		if (new_rate && (abs(rate - request) > abs(new_rate - request)))
+			continue;
+
+		pr_debug("clk: %s, pll.%d request[%ld] calc[%ld]\n", peri->name,
+			 n, request, rate);
+
+		if (clk2) {
+			s1 = -1, d1 = -1; /* not use */
+			s2 = n, d2 = div[0];
+		} else {
+			s1 = n, d1 = div[0];
+			s2 = I_CLKn_BIT, d2 = div[1];
+		}
+
+		new_rate = rate;
+		freq_hz = clock_hz;
+
+		if (request == rate)
+			break;
+	}
+
+	/* search 2th clock from input */
+	if (!clk2 && abs(new_rate - request) &&
+	    peri->in_mask1 & ((1 << I_CLOCK_NUM) - 1)) {
+		clk2 = 1;
+		mask = peri->in_mask1;
+		step = 1;
+		goto next;
+	}
+
+	peri->div_src_0 = s1, peri->div_val_0 = d1;
+	peri->div_src_1 = s2, peri->div_val_1 = d2;
+
+	pr_debug("clk: %s, step[%d] src[%d,%d] %ld /(div0: %d * div1: %d) ",
+		 peri->name, peri->clk_step, peri->div_src_0, peri->div_src_1,
+		 freq_hz, peri->div_val_0, peri->div_val_1);
+	pr_debug("=  %ld, %ld diff (%ld)\n", new_rate, request,
+		 (long)abs(new_rate - request));
+
+	return new_rate;
+}
+
+static int dev_set_rate(struct clk_hw *hw, unsigned long rate)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+	int i;
+
+	rate = dev_round_rate(hw, rate);
+
+	for (i = 0; peri->clk_step > i; i++) {
+		int s = (0 == i ? peri->div_src_0 : peri->div_src_1);
+		int d = (0 == i ? peri->div_val_0 : peri->div_val_1);
+
+		if (-1 == s)
+			continue;
+
+		/* change rate */
+#ifdef CONFIG_EARLY_PRINTK
+		if (!strcmp(peri->name, "uart0"))
+			break;
+#endif
+		clk_dev_rate((void *)peri->base, i, s, d);
+
+		pr_debug("clk: %s (%p) set_rate [%d] src[%d] div[%d]\n",
+			 peri->name, peri->base, i, s, d);
+	}
+	peri->rate = rate;
+	return rate;
+}
+
+/*
+ *	clock devices interface
+ */
+static int clk_dev_enable(struct clk_hw *hw)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+	int i = 0, inv = 0;
+
+	pr_debug("clk: %s enable (BCLK=%s, PCLK=%s)\n", peri->name,
+		 I_GATE_BCLK & peri->in_mask ? "ON" : "PASS",
+		 I_GATE_PCLK & peri->in_mask ? "ON" : "PASS");
+
+	if (peri->in_mask & I_GATE_BCLK)
+		clk_dev_bclk((void *)peri->base, 1);
+
+	if (peri->in_mask & I_GATE_PCLK)
+		clk_dev_pclk((void *)peri->base, 1);
+
+	if (!(peri->in_mask & I_CLOCK_MASK))
+		return 0;
+
+	for (i = 0, inv = peri->invert_0; peri->clk_step > i;
+		i++, inv = peri->invert_1)
+		clk_dev_inv((void *)peri->base, i, inv);
+
+	/* restore clock rate */
+	for (i = 0; peri->clk_step > i; i++) {
+		if (peri->fix_src < 0) {
+			int s = (0 == i ? peri->div_src_0 : peri->div_src_1);
+			int d = (0 == i ? peri->div_val_0 : peri->div_val_1);
+
+			if (s == -1)
+				continue;
+
+			clk_dev_rate((void *)peri->base, i, s, d);
+		} else {
+			int s = peri->fix_src;
+			int d = (0 == i ? peri->div_val_0 : peri->div_val_1);
+			if(d == 0)
+				d = 1;
+			clk_dev_rate((void *)peri->base, i, s, d);
+		}
+	}
+
+	clk_dev_enb((void *)peri->base, 1);
+	peri->enable = true;
+
+	return 0;
+}
+
+static void clk_dev_disable(struct clk_hw *hw)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+
+	pr_debug("clk: %s disable\n", peri->name);
+
+	if (peri->in_mask & I_GATE_BCLK)
+		clk_dev_bclk((void *)peri->base, 0);
+
+	if (peri->in_mask & I_GATE_PCLK)
+		clk_dev_pclk((void *)peri->base, 0);
+
+	if (!(peri->in_mask & I_CLOCK_MASK))
+		return;
+
+	clk_dev_rate((void *)peri->base, 0, 7, 256); /* for power save */
+	clk_dev_enb((void *)peri->base, 0);
+
+	peri->enable = false;
+
+}
+
+static unsigned long clk_dev_recalc_rate(struct clk_hw *hw, unsigned long rate)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+
+	pr_debug("%s: name %s, (%lu)\n", __func__, peri->name, peri->rate);
+	return peri->rate;
+}
+
+static long clk_dev_round_rate(struct clk_hw *hw, unsigned long drate,
+			       unsigned long *prate)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+	long rate = dev_round_rate(hw, drate);
+
+	pr_debug("%s: name %s, (%lu, %lu)\n", __func__, peri->name, drate,
+		 rate);
+	return rate;
+}
+
+static int clk_dev_set_rate(struct clk_hw *hw, unsigned long drate,
+			    unsigned long prate)
+{
+	struct clk_dev_peri *peri = to_clk_dev(hw)->peri;
+	int rate = dev_set_rate(hw, drate);
+
+	pr_debug("%s: name %s, rate %lu:%d\n", __func__, peri->name, drate,
+		 rate);
+	return rate;
+}
+
+static const struct clk_ops clk_dev_ops = {
+	.recalc_rate = clk_dev_recalc_rate,
+	.round_rate = clk_dev_round_rate,
+	.set_rate = clk_dev_set_rate,
+	.enable = clk_dev_enable,
+	.disable = clk_dev_disable,
+};
+
+static const struct clk_ops clk_empty_ops = {};
+
+struct clk *clk_dev_get_provider(struct of_phandle_args *clkspec, void *data)
+{
+	struct clk_dev *clk_data = data;
+
+	pr_debug("%s: name %s\n", __func__, clk_data->peri->name);
+	return clk_data->clk;
+}
+
+static void __init clk_dev_parse_device_data(struct device_node *np,
+					     struct clk_dev *clk_data,
+					     struct device *dev)
+{
+	struct clk_dev_peri *peri = clk_data->peri;
+	unsigned int frequency = 0;
+	u32 value;
+
+	if (of_property_read_string(np, "clock-output-names", &peri->name)) {
+		pr_err("clock node is missing 'clock-output-names'\n");
+		return;
+	}
+
+	if (!of_property_read_string(np, "clock-names", &peri->parent_name))
+		return;
+
+	if (of_property_read_u32(np, "cell-id", &peri->id)) {
+		pr_err("clock node is missing 'cell-id'\n");
+		return;
+	}
+
+	if (of_property_read_u32(np, "clk-step", &peri->clk_step)) {
+		pr_err("clock node is missing 'clk-step'\n");
+		return;
+	}
+
+	if (of_property_read_u32(np, "clk-input", &peri->in_mask)) {
+		pr_err("clock node is missing 'clk-input'\n");
+		return;
+	}
+
+	if (2 == peri->clk_step &&
+	    of_property_read_u32(np, "clk-input1", &peri->in_mask1)) {
+		pr_err("clock node is missing 'clk-input1'\n");
+		return;
+	}
+
+	if (!of_property_read_u32(np, "src-force", &value))
+		peri->fix_src = value;
+	else
+		peri->fix_src = -1;
+
+	if (!of_property_read_u32(np, "clk-input-ext1", &value))
+		peri->in_extclk_1 = value;
+
+	if (!of_property_read_u32(np, "clk-input-ext2", &value))
+		peri->in_extclk_2 = value;
+
+	if (!of_property_read_u32(np, "clock-frequency", &frequency))
+		clk_data->rate = frequency;
+
+	peri->base = of_iomap(np, 0);
+	if (!peri->base) {
+		pr_err("Can't map registers for clock %s!\n", peri->name);
+		return;
+	}
+
+	pr_debug("%8s: id=%2d, base=%p, step=%d, m=0x%04x, m1=0x%04x\n",
+		 peri->name, peri->id, peri->base, peri->clk_step,
+		 peri->in_mask, peri->in_mask1);
+}
+
+struct clk *clk_dev_clock_register(const char *name, const char *parent_name,
+				   struct clk_hw *hw, const struct clk_ops *ops,
+				   unsigned long flags)
+{
+	struct clk *clk;
+	struct clk_init_data init;
+
+	init.name = name;
+	init.ops = ops;
+	init.flags = flags;
+	init.parent_names = (parent_name ? &parent_name : NULL);
+	init.num_parents = parent_name ? 1 : 0;
+	hw->init = &init;
+	pr_debug("Register clk %8s: parent %s\n", name, parent_name);
+
+	clk = clk_register(NULL, hw);
+	if (IS_ERR(clk)) {
+		pr_err("%s: failed to register pll clock %s\n", __func__,
+		       init.name);
+		return NULL;
+	}
+
+	if (clk_register_clkdev(clk, init.name, NULL))
+		pr_err("%s: failed to register lookup for %s", __func__,
+		       init.name);
+
+	return clk;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int clk_syscore_suspend(void) { return 0; }
+
+static void clk_syscore_resume(void) {}
+
+static struct syscore_ops clk_syscore_ops = {
+	.suspend = clk_syscore_suspend, .resume = clk_syscore_resume,
+};
+#endif /* CONFIG_PM_SLEEP */
+
+static void __init clk_dev_of_setup(struct device_node *node)
+{
+	struct device_node *np;
+	struct clk_dev *clk_data = NULL;
+	struct clk_dev_peri *peri = NULL;
+	struct clk *clk;
+	int i = 0, size = (sizeof(*clk_data) + sizeof(*peri));
+	int num_clks;
+
+#ifdef CONFIG_ARM_NEXELL_CPUFREQ
+	char pll[16];
+
+	sprintf(pll, "sys-pll%d", CONFIG_NEXELL_CPUFREQ_PLLDEV);
+#endif
+
+	num_clks = of_get_child_count(node);
+	if (!num_clks) {
+		pr_err("Failed to clocks count for clock generator!\n");
+		return;
+	}
+
+	clk_data = kzalloc(size * num_clks, GFP_KERNEL);
+	if (!clk_data) {
+		WARN_ON(1);
+		return;
+	}
+	peri = (struct clk_dev_peri *)(clk_data + num_clks);
+
+	for_each_child_of_node(node, np) {
+		clk_data[i].peri = &peri[i];
+		clk_data[i].node = np;
+		clk_dev_parse_device_data(np, &clk_data[i], NULL);
+		of_clk_add_provider(np, clk_dev_get_provider, &clk_data[i++]);
+	}
+
+	for (i = 0; num_clks > i; i++, clk_data++) {
+		unsigned long flags = 0;
+		const struct clk_ops *ops = &clk_dev_ops;
+
+		if (peri[i].parent_name) {
+			ops = &clk_empty_ops;
+			flags = CLK_IS_BASIC;
+#ifdef CONFIG_ARM_NEXELL_CPUFREQ
+			if (!strcmp(pll, peri[i].parent_name))
+				flags |= CLK_SET_RATE_PARENT;
+#endif
+		}
+
+		clk = clk_dev_clock_register(peri[i].name, peri[i].parent_name,
+					     &clk_data->hw, ops, flags);
+		if (NULL == clk)
+			continue;
+
+		clk_data->clk = clk;
+		if (clk_data->rate) {
+			pr_debug("[%s set boot rate %u]\n", node->name,
+				 clk_data->rate);
+			clk_set_rate(clk, clk_data->rate);
+		}
+	}
+
+#ifdef CONFIG_PM_SLEEP
+	register_syscore_ops(&clk_syscore_ops);
+#endif
+
+	pr_debug("[%s:%d] %s (%d)\n", __func__, __LINE__, node->name, num_clks);
+}
+CLK_OF_DECLARE(s5pxx18, "nexell,s5pxx18,clocks", clk_dev_of_setup);
diff -ENwbur a/drivers/clk/nexell/clk-s5pxx18.h b/drivers/clk/nexell/clk-s5pxx18.h
--- a/drivers/clk/nexell/clk-s5pxx18.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/clk/nexell/clk-s5pxx18.h	2018-05-06 08:49:49.054690387 +0200
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _CLK_S5PXX18_H
+#define _CLK_S5PXX18_H
+
+#define I_PLL0_BIT (0)
+#define I_PLL1_BIT (1)
+#define I_PLL2_BIT (2)
+#define I_PLL3_BIT (3)
+#define I_EXT1_BIT (4)
+#define I_EXT2_BIT (5)
+#define I_CLKn_BIT (7)
+
+#define I_CLOCK_NUM 6 /* PLL0, PLL1, PLL2, PLL3, EXT1, EXT2 */
+
+#ifdef CONFIG_ARM_NEXELL_CPUFREQ
+#define I_EXECEPT_CLK (1 << CONFIG_NEXELL_CPUFREQ_PLLDEV)
+#else
+#define I_EXECEPT_CLK (0)
+#endif
+
+#define I_CLOCK_MASK (((1 << I_CLOCK_NUM) - 1) & ~I_EXECEPT_CLK)
+/*
+ * clock
+ */
+#define CLK_CPU_PLL0 "sys-pll0"
+#define CLK_CPU_PLL1 "sys-pll1"
+#define CLK_CPU_PLL2 "sys-pll2"
+#define CLK_CPU_PLL3 "sys-pll3"
+#define CLK_CPU_FCLK "sys-cfclk"
+#define CLK_CPU_HCLK "sys-chclk"
+#define CLK_MEM_FCLK "sys-mfclk"
+#define CLK_MEM_DCLK "sys-mdclk"
+#define CLK_MEM_BCLK "sys-mbclk"
+#define CLK_MEM_PCLK "sys-mpclk"
+#define CLK_BUS_BCLK "sys-bbclk"
+#define CLK_BUS_PCLK "sys-bpclk"
+#define CLK_VPU_BCLK "sys-vpubclk"
+#define CLK_VPU_PCLK "sys-vpupclk"
+#define CLK_DIS_BCLK "sys-disbclk"
+#define CLK_DIS_PCLK "sys-disspclk"
+#define CLK_CCI_BCLK "sys-ccibclk"
+#define CLK_CCI_PCLK "sys-ccipclk"
+#define CLK_G3D_BCLK "sys-g3dbclk"
+
+#define CLK_ID_TIMER_1 0
+#define CLK_ID_TIMER_2 1
+#define CLK_ID_TIMER_3 2
+#define CLK_ID_PWM_1 3
+#define CLK_ID_PWM_2 4
+#define CLK_ID_PWM_3 5
+#define CLK_ID_I2C_0 6
+#define CLK_ID_I2C_1 7
+#define CLK_ID_I2C_2 8
+#define CLK_ID_MIPI 9
+#define CLK_ID_GMAC 10 /* External Clock 1 */
+#define CLK_ID_SPDIF_TX 11
+#define CLK_ID_MPEGTSI 12
+#define CLK_ID_PWM_0 13
+#define CLK_ID_TIMER_0 14
+#define CLK_ID_I2S_0 15 /* External Clock 1 */
+#define CLK_ID_I2S_1 16 /* External Clock 1 */
+#define CLK_ID_I2S_2 17 /* External Clock 1 */
+#define CLK_ID_SDHC_0 18
+#define CLK_ID_SDHC_1 19
+#define CLK_ID_SDHC_2 20
+#define CLK_ID_VR 21
+#define CLK_ID_UART_0 22 /* UART0_MODULE */
+#define CLK_ID_UART_2 23 /* UART1_MODULE */
+#define CLK_ID_UART_1 24 /* pl01115_Uart_modem_MODULE  */
+#define CLK_ID_UART_3 25 /* pl01115_Uart_nodma0_MODULE */
+#define CLK_ID_UART_4 26 /* pl01115_Uart_nodma1_MODULE */
+#define CLK_ID_UART_5 27 /* pl01115_Uart_nodma2_MODULE */
+#define CLK_ID_DIT 28
+#define CLK_ID_PPM 29
+#define CLK_ID_VIP_0 30    /* External Clock 1 */
+#define CLK_ID_VIP_1 31    /* External Clock 1, 2 */
+#define CLK_ID_USB2HOST 32 /* External Clock 2 */
+#define CLK_ID_CODA 33
+#define CLK_ID_CRYPTO 34
+#define CLK_ID_SCALER 35
+#define CLK_ID_PDM 36
+#define CLK_ID_SPI_0 37
+#define CLK_ID_SPI_1 38
+#define CLK_ID_SPI_2 39
+#define CLK_ID_MAX 39
+#define CLK_ID_USBOTG 40 /* Shared with USB2HOST */
+
+#define I_PLL0_BIT (0)
+#define I_PLL1_BIT (1)
+#define I_PLL2_BIT (2)
+#define I_PLL3_BIT (3)
+#define I_EXT1_BIT (4)
+#define I_EXT2_BIT (5)
+#define I_CLKn_BIT (7)
+
+#define I_PLL0 (1 << I_PLL0_BIT)
+#define I_PLL1 (1 << I_PLL1_BIT)
+#define I_PLL2 (1 << I_PLL2_BIT)
+#define I_PLL3 (1 << I_PLL3_BIT)
+#define I_EXTCLK1 (1 << I_EXT1_BIT)
+#define I_EXTCLK2 (1 << I_EXT2_BIT)
+
+#define I_PLL_0_1 (I_PLL0 | I_PLL1)
+#define I_PLL_0_2 (I_PLL_0_1 | I_PLL2)
+#define I_PLL_0_3 (I_PLL_0_2 | I_PLL3)
+#define I_CLKnOUT (0)
+
+#define I_PCLK (1 << 8)
+#define I_BCLK (1 << 9)
+#define I_GATE_PCLK (1 << 12)
+#define I_GATE_BCLK (1 << 13)
+#define I_PCLK_MASK (I_GATE_PCLK | I_PCLK)
+#define I_BCLK_MASK (I_GATE_BCLK | I_BCLK)
+
+#define CLK_INPUT_TIMER (I_PLL_0_2)
+#define CLK_INPUT_UART (I_PLL_0_2)
+#define CLK_INPUT_PWM (I_PLL_0_2)
+#define CLK_INPUT_I2C (I_GATE_PCLK)
+#define CLK_INPUT_SDHC (I_PLL_0_2 | I_GATE_PCLK)
+#define CLK_INPUT_I2S (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_I2S_IN1 (I_CLKnOUT)
+#define CLK_INPUT_SPI (I_PLL_0_2)
+#define CLK_INPUT_VIP0 (I_PLL_0_3 | I_EXTCLK1 | I_GATE_BCLK)
+#define CLK_INPUT_VIP1 (I_PLL_0_3 | I_EXTCLK1 | I_EXTCLK2 | I_GATE_BCLK)
+#define CLK_INPUT_MIPI (I_PLL_0_2)
+#define CLK_INPUT_GMAC (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_GMAC_IN1 (I_CLKnOUT)
+#define CLK_INPUT_SPDIFTX (I_PLL_0_2)
+#define CLK_INPUT_MPEGTS (I_GATE_BCLK)
+#define CLK_INPUT_VR (I_GATE_BCLK)
+#define CLK_INPUT_DIT (I_GATE_BCLK)
+#define CLK_INPUT_PPM (I_PLL_0_2)
+#define CLK_INPUT_EHCI (I_PLL_0_3)
+#define CLK_INPUT_EHCI_IN1 (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_VPU (I_GATE_PCLK | I_GATE_BCLK)
+#define CLK_INPUT_CRYPTO (I_GATE_PCLK)
+#define CLK_INPUT_SCALER (I_GATE_BCLK)
+#define CLK_INPUT_OTG (I_PLL_0_3)
+#define CLK_INPUT_OTG_IN1 (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_PDM (I_GATE_PCLK)
+
+#endif
diff -ENwbur a/drivers/clk/nexell/clk-s5pxx18-pll.c b/drivers/clk/nexell/clk-s5pxx18-pll.c
--- a/drivers/clk/nexell/clk-s5pxx18-pll.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/clk/nexell/clk-s5pxx18-pll.c	2018-05-06 08:49:49.054690387 +0200
@@ -0,0 +1,838 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/clk.h>
+#include <linux/clkdev.h>
+#include <linux/clk-provider.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <asm/tlbflush.h>
+#include "clk-s5pxx18.h"
+#include "clk-s5pxx18-pll.h"
+
+#define PLL_LOCKING_TIME 100
+
+struct pll_pms {
+	long rate; /* unint Khz */
+	int P;
+	int M;
+	int S;
+};
+
+struct clk_core {
+	const char *name;
+	int id, div, pll;
+	unsigned long rate;
+	struct clk_hw hw;
+	struct pll_pms pms;
+};
+
+#ifdef CONFIG_ARCH_S5P4418
+/* PLL 0,1 */
+static struct pll_pms pll0_1_pms[] = {
+	[0] = {
+		.rate = 1200000, .P = 3, .M = 300, .S = 1,
+	},
+	[1] = {
+		.rate = 1100000, .P = 3, .M = 275, .S = 1,
+	},
+	[2] = {
+		.rate = 1000000, .P = 3, .M = 250, .S = 1,
+	},
+	[3] = {
+		.rate = 900000, .P = 3, .M = 225, .S = 1,
+	},
+	[4] = {
+		.rate = 800000, .P = 3, .M = 200, .S = 1,
+	},
+	[5] = {
+		.rate = 700000, .P = 3, .M = 175, .S = 1,
+	},
+	[6] = {
+		.rate = 600000, .P = 2, .M = 200, .S = 2,
+	},
+	[7] = {
+		.rate = 500000, .P = 3, .M = 250, .S = 2,
+	},
+	[8] = {
+		.rate = 400000, .P = 3, .M = 200, .S = 2,
+	},
+	[9] = {
+		.rate = 300000, .P = 2, .M = 200, .S = 3,
+	},
+	[10] = {
+		.rate = 200000, .P = 3, .M = 200, .S = 3,
+	},
+	[11] = {
+		.rate = 100000, .P = 3, .M = 200, .S = 4,
+	},
+};
+
+/* PLL 2,3 */
+static struct pll_pms pll2_3_pms[] = {
+	[0] = {
+		.rate = 1200000, .P = 3, .M = 300, .S = 1,
+	},
+	[1] = {
+		.rate = 1100000, .P = 3, .M = 275, .S = 1,
+	},
+	[2] = {
+		.rate = 1000000, .P = 3, .M = 250, .S = 1,
+	},
+	[3] = {
+		.rate = 900000, .P = 3, .M = 225, .S = 1,
+	},
+	[4] = {
+		.rate = 800000, .P = 3, .M = 200, .S = 1,
+	},
+	[5] = {
+		.rate = 700000, .P = 3, .M = 175, .S = 1,
+	},
+	[6] = {
+		.rate = 600000, .P = 3, .M = 150, .S = 1,
+	},
+	[7] = {
+		.rate = 500000, .P = 3, .M = 250, .S = 2,
+	},
+	[8] = {
+		.rate = 400000, .P = 3, .M = 200, .S = 2,
+	},
+	[9] = {
+		.rate = 300000, .P = 3, .M = 150, .S = 2,
+	},
+	[10] = {
+		.rate = 200000, .P = 3, .M = 200, .S = 3,
+	},
+	[11] = {
+		.rate = 100000, .P = 3, .M = 200, .S = 4,
+	},
+};
+#else	/* S5P6818 */
+/* PLL 0,1 */
+static struct pll_pms pll0_1_pms[] = {
+	[0] = {
+		.rate = 1600000, .P = 6, .M = 400, .S = 0,
+	},
+	[1] = {
+		.rate = 1500000, .P = 6, .M = 375, .S = 0,
+	},
+	[2] = {
+		.rate = 1400000, .P = 6, .M = 350, .S = 0,
+	},
+	[3] = {
+		.rate = 1300000, .P = 6, .M = 325, .S = 0,
+	},
+	[4] = {
+		.rate = 1200000, .P = 3, .M = 300, .S = 1,
+	},
+	[5] = {
+		.rate = 1100000, .P = 3, .M = 275, .S = 1,
+	},
+	[6] = {
+		.rate = 1000000, .P = 3, .M = 250, .S = 1,
+	},
+	[7] = {
+		.rate = 900000, .P = 3, .M = 225, .S = 1,
+	},
+	[8] = {
+		.rate = 800000, .P = 3, .M = 200, .S = 1,
+	},
+	[9] = {
+		.rate = 700000, .P = 3, .M = 175, .S = 1,
+	},
+	[10] = {
+		.rate = 600000, .P = 2, .M = 200, .S = 2,
+	},
+	[11] = {
+		.rate = 500000, .P = 3, .M = 250, .S = 2,
+	},
+	[12] = {
+		.rate = 400000, .P = 3, .M = 200, .S = 2,
+	},
+	[13] = {
+		.rate = 300000, .P = 2, .M = 200, .S = 3,
+	},
+	[14] = {
+		.rate = 200000, .P = 3, .M = 200, .S = 3,
+	},
+	[15] = {
+		.rate = 100000, .P = 3, .M = 200, .S = 4,
+	},
+};
+
+/* PLL 2,3 */
+static struct pll_pms pll2_3_pms[] = {
+	[0] = {
+		.rate = 1600000, .P = 3, .M = 400, .S = 1,
+	},
+	[1] = {
+		.rate = 1500000, .P = 3, .M = 375, .S = 1,
+	},
+	[2] = {
+		.rate = 1400000, .P = 3, .M = 350, .S = 1,
+	},
+	[3] = {
+		.rate = 1300000, .P = 3, .M = 325, .S = 1,
+	},
+	[4] = {
+		.rate = 1200000, .P = 3, .M = 300, .S = 1,
+	},
+	[5] = {
+		.rate = 1100000, .P = 3, .M = 275, .S = 1,
+	},
+	[6] = {
+		.rate = 1000000, .P = 3, .M = 250, .S = 1,
+	},
+	[7] = {
+		.rate = 900000, .P = 3, .M = 225, .S = 1,
+	},
+	[8] = {
+		.rate = 800000, .P = 3, .M = 200, .S = 1,
+	},
+	[9] = {
+		.rate = 700000, .P = 3, .M = 175, .S = 1,
+	},
+	[10] = {
+		.rate = 600000, .P = 3, .M = 150, .S = 1,
+	},
+	[11] = {
+		.rate = 500000, .P = 3, .M = 250, .S = 2,
+	},
+	[12] = {
+		.rate = 400000, .P = 3, .M = 200, .S = 2,
+	},
+	[13] = {
+		.rate = 300000, .P = 3, .M = 150, .S = 2,
+	},
+	[14] = {
+		.rate = 200000, .P = 3, .M = 200, .S = 3,
+	},
+	[15] = {
+		.rate = 100000, .P = 3, .M = 200, .S = 4,
+	},
+};
+#endif
+
+#define PLL0_1_SIZE ARRAY_SIZE(pll0_1_pms)
+#define PLL2_3_SIZE ARRAY_SIZE(pll2_3_pms)
+
+#define PMS_RATE(p, i) ((&p[i])->rate)
+#define PMS_P(p, i) ((&p[i])->P)
+#define PMS_M(p, i) ((&p[i])->M)
+#define PMS_S(p, i) ((&p[i])->S)
+
+#define PLL_S_BITPOS 0
+#define PLL_M_BITPOS 8
+#define PLL_P_BITPOS 18
+
+static void *ref_clk_base;
+static spinlock_t pll_lock = __SPIN_LOCK_UNLOCKED(pll_lock);
+
+static void nx_pll_set_rate(int PLL, int P, int M, int S)
+{
+	struct reg_clkpwr *reg = ref_clk_base;
+	unsigned long flags;
+
+	spin_lock_irqsave(&pll_lock, flags);
+
+	/*
+	 * 1. change PLL0 clock to Oscillator Clock
+	 */
+	reg->PLLSETREG[PLL] &= ~(1 << 28); /* pll bypass on, xtal clock use */
+	reg->CLKMODEREG0 = (1 << PLL);     /* update pll */
+
+	while (readl(&reg->CLKMODEREG0) & (1 << 31))
+		;/* wait for change update pll*/
+
+	/*
+	 * 2. PLL Power Down & PMS value setting
+	 */
+	reg->PLLSETREG[PLL] =
+		((1UL << 29 |   /* power down */
+		  (0UL << 28) | /* clock bypass on, xtal clock use */
+		  (S << PLL_S_BITPOS) |
+		  (M << PLL_M_BITPOS) |
+		  (P << PLL_P_BITPOS)));
+	reg->CLKMODEREG0 = (1 << PLL); /* update pll */
+
+	while (readl(&reg->CLKMODEREG0) & (1 << 31))
+		; /* wait for change update pll */
+
+	udelay(10);
+
+	/*
+	 * 3. Update PLL & wait PLL locking
+	 */
+	reg->PLLSETREG[PLL] &= ~((u32)(1UL << 29));/* pll power up */
+	reg->CLKMODEREG0 = (1 << PLL);		   /* update pll */
+
+	while (readl(&reg->CLKMODEREG0) & (1 << 31))
+		;/* wait for change update pll */
+
+	udelay(PLL_LOCKING_TIME);/* 1000us */
+
+	/*
+	 * 4. Change to PLL clock
+	 */
+	reg->PLLSETREG[PLL] |= (1 << 28);/* pll bypass off, pll clock use */
+	reg->CLKMODEREG0 = (1 << PLL);   /* update pll */
+
+	while (readl(&reg->CLKMODEREG0) & (1 << 31))
+		;/* wait for change update pll */
+
+	spin_unlock_irqrestore(&pll_lock, flags);
+}
+
+#if defined(CONFIG_ARCH_S5P4418)
+asmlinkage int __invoke_nexell_fn_smc(u32, u32, u32, u32);
+#endif
+
+int nx_change_bus_freq(u32 pll_data)
+{
+#if defined(CONFIG_ARCH_S5P6818)
+	uint32_t pll_num = pll_data & 0x00000003;
+	uint32_t s       = (pll_data & 0x000000fc) >> 2;
+	uint32_t m       = (pll_data & 0x00ffff00) >> 8;
+	uint32_t p       = (pll_data & 0xff000000) >> 24;
+
+	nx_pll_set_rate(pll_num, p, m, s);
+	return 0;
+#else
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&pll_lock, flags);
+	ret = __invoke_nexell_fn_smc(0x82000009, pll_data, 0, 0);
+	spin_unlock_irqrestore(&pll_lock, flags);
+
+	return ret;
+#endif
+}
+EXPORT_SYMBOL(nx_change_bus_freq);
+
+static unsigned long pll_round_rate(int pllno, unsigned long rate, int *p,
+				    int *m, int *s)
+{
+	struct pll_pms *pms;
+	int len, idx = 0, n = 0, l = 0;
+	long freq = 0;
+
+	rate /= 1000;
+	pr_debug("PLL.%d, %ld", pllno, rate);
+
+	switch (pllno) {
+	case 0:
+	case 1:
+		pms = pll0_1_pms;
+		len = PLL0_1_SIZE;
+		break;
+	case 2:
+	case 3:
+		pms = pll2_3_pms;
+		len = PLL2_3_SIZE;
+		break;
+	default:
+		pr_info("Not support pll.%d (0~3)\n", pllno);
+		return 0;
+	}
+
+	/* array index so -1 */
+	idx = (len / 2) - 1;
+
+	while (1) {
+		l = n + idx;
+		freq = PMS_RATE(pms, l);
+		if (freq == rate)
+			break;
+
+		if (rate > freq)
+			len -= idx, idx >>= 1;
+		else
+			n += idx, idx = (len - n - 1) >> 1;
+
+		if (0 == idx) {
+			int k = l;
+
+			if (abs(rate - freq) > abs(rate - PMS_RATE(pms, k + 1)))
+				k += 1;
+
+			if (abs(rate - PMS_RATE(pms, k)) >=
+			    abs(rate - PMS_RATE(pms, k - 1)))
+				k -= 1;
+
+			l = k;
+			break;
+		}
+	}
+
+	if (p)
+		*p = PMS_P(pms, l);
+	if (m)
+		*m = PMS_M(pms, l);
+	if (s)
+		*s = PMS_S(pms, l);
+
+	pr_debug("(real %ld Khz, P=%d ,M=%3d, S=%d)\n", PMS_RATE(pms, l),
+		 PMS_P(pms, l), PMS_M(pms, l), PMS_S(pms, l));
+
+	return (PMS_RATE(pms, l) * 1000);
+}
+
+static unsigned long ref_clk = 24000000UL;
+
+#define getquotient(v, d) (v / d)
+
+#define DIV_CPUG0 0
+#define DIV_BUS 1
+#define DIV_MEM 2
+#define DIV_G3D 3
+#define DIV_VPU 4
+#define DIV_DISP 5
+#define DIV_HDMI 6
+#define DIV_CPUG1 7
+#define DIV_CCI4 8
+
+#define DVO0 3
+#define DVO1 9
+#define DVO2 15
+#define DVO3 21
+
+static inline unsigned int pll_rate(unsigned int pllN, unsigned int xtal)
+{
+	struct reg_clkpwr *reg = ref_clk_base;
+	unsigned int val, val1, nP, nM, nS, nK;
+	unsigned int temp = 0;
+
+	val = reg->PLLSETREG[pllN];
+	val1 = reg->PLLSETREG_SSCG[pllN];
+	xtal /= 1000; /* Unit Khz */
+
+	nP = (val >> 18) & 0x03F;
+	nM = (val >> 8) & 0x3FF;
+	nS = (val >> 0) & 0x0FF;
+	nK = (val1 >> 16) & 0xFFFF;
+
+	if ((pllN > 1) && nK)
+		temp =	(unsigned int)(
+			getquotient((getquotient((nK * 1000), 65536) * xtal),
+			nP) >>  nS);
+
+	return (unsigned int)((getquotient((nM * xtal), nP) >> nS) * 1000) +
+		temp;
+}
+
+static inline unsigned int pll_dvo(int dvo)
+{
+	struct reg_clkpwr *reg = ref_clk_base;
+
+	return (reg->DVOREG[dvo] & 0x7);
+}
+
+static inline unsigned int pll_div(int dvo)
+{
+	struct reg_clkpwr *reg = ref_clk_base;
+	unsigned int val = reg->DVOREG[dvo];
+
+	return ((((val >> DVO3) & 0x3F) + 1) << 24) |
+		((((val >> DVO2) & 0x3F) + 1) << 16) |
+		((((val >> DVO1) & 0x3F) + 1) << 8) |
+		((((val >> DVO0) & 0x3F) + 1) << 0);
+}
+
+#define PLLN_RATE(n) (pll_rate(n, ref_clk)) /* 0~ 3 */
+#define CPU_FCLK_RATE(n)                                                       \
+	(pll_rate(pll_dvo(n), ref_clk) / ((pll_div(n) >> 0) & 0x3F))
+#define CPU_HCLK_RATE(n)                                                       \
+	(pll_rate(pll_dvo(n), ref_clk) / ((pll_div(n) >> 0) & 0x3F) /          \
+	 ((pll_div(n) >> 8) & 0x3F))
+#define MEM_FCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_MEM), ref_clk) /                                 \
+	 ((pll_div(DIV_MEM) >> 0) & 0x3F) / ((pll_div(DIV_MEM) >> 8) & 0x3F))
+#define MEM_DCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_MEM), ref_clk) / ((pll_div(DIV_MEM) >> 0) & 0x3F))
+#define MEM_BCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_MEM), ref_clk) /                                 \
+	 ((pll_div(DIV_MEM) >> 0) & 0x3F) / ((pll_div(DIV_MEM) >> 8) & 0x3F) / \
+	 ((pll_div(DIV_MEM) >> 16) & 0x3F))
+#define MEM_PCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_MEM), ref_clk) /                                 \
+	 ((pll_div(DIV_MEM) >> 0) & 0x3F) / ((pll_div(DIV_MEM) >> 8) & 0x3F) / \
+	 ((pll_div(DIV_MEM) >> 16) & 0x3F) /                                   \
+	 ((pll_div(DIV_MEM) >> 24) & 0x3F))
+#define BUS_BCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_BUS), ref_clk) / ((pll_div(DIV_BUS) >> 0) & 0x3F))
+#define BUS_PCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_BUS), ref_clk) /                                 \
+	 ((pll_div(DIV_BUS) >> 0) & 0x3F) / ((pll_div(DIV_BUS) >> 8) & 0x3F))
+#define G3D_BCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_G3D), ref_clk) / ((pll_div(DIV_G3D) >> 0) & 0x3F))
+#define VPU_BCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_VPU), ref_clk) / ((pll_div(DIV_VPU) >> 0) & 0x3F))
+#define VPU_PCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_VPU), ref_clk) /                                 \
+	 ((pll_div(DIV_VPU) >> 0) & 0x3F) / ((pll_div(DIV_VPU) >> 8) & 0x3F))
+#define DIS_BCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_DISP), ref_clk) /                                \
+	 ((pll_div(DIV_DISP) >> 0) & 0x3F))
+#define DIS_PCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_DISP), ref_clk) /                                \
+	 ((pll_div(DIV_DISP) >> 0) & 0x3F) /                                   \
+	 ((pll_div(DIV_DISP) >> 8) & 0x3F))
+#define HDMI_PCLK_RATE()                                                       \
+	(pll_rate(pll_dvo(DIV_HDMI), ref_clk) /                                \
+	 ((pll_div(DIV_HDMI) >> 0) & 0x3F))
+#define CCI_BCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_CCI4), ref_clk) /                                \
+	 ((pll_div(DIV_CCI4) >> 0) & 0x3F))
+#define CCI_PCLK_RATE()                                                        \
+	(pll_rate(pll_dvo(DIV_CCI4), ref_clk) /                                \
+	 ((pll_div(DIV_CCI4) >> 0) & 0x3F) /                                   \
+	 ((pll_div(DIV_CCI4) >> 8) & 0x3F))
+
+/*
+ *	core frequency clk interface
+ */
+static struct clk_core clk_pll_dev[] = {
+	[ID_CPU_PLL0] =	{
+		.id = ID_CPU_PLL0, .name = CLK_CPU_PLL0,
+	},
+	[ID_CPU_PLL1] =	{
+		.id = ID_CPU_PLL1, .name = CLK_CPU_PLL1,
+	},
+	[ID_CPU_PLL2] =	{
+		.id = ID_CPU_PLL2, .name = CLK_CPU_PLL2,
+	},
+	[ID_CPU_PLL3] =	{
+		.id = ID_CPU_PLL3, .name = CLK_CPU_PLL3,
+	},
+	[ID_CPU_FCLK] = {.id = ID_CPU_FCLK,
+		.name = CLK_CPU_FCLK,
+		.div = DIV_CPUG0},
+	[ID_CPU_HCLK] = {.id = ID_CPU_HCLK,
+		.name = CLK_CPU_HCLK,
+		.div = DIV_CPUG0},
+	[ID_MEM_FCLK] = {.id = ID_MEM_FCLK,
+		.name = CLK_MEM_FCLK,
+		.div = DIV_MEM},
+	[ID_MEM_DCLK] = {.id = ID_MEM_DCLK,
+		.name = CLK_MEM_DCLK,
+		.div = DIV_MEM},
+	[ID_MEM_BCLK] = {.id = ID_MEM_BCLK,
+		.name = CLK_MEM_BCLK,
+		.div = DIV_MEM},
+	[ID_MEM_PCLK] = {.id = ID_MEM_PCLK,
+		.name = CLK_MEM_PCLK,
+		.div = DIV_MEM},
+	[ID_BUS_BCLK] = {.id = ID_BUS_BCLK,
+		.name = CLK_BUS_BCLK,
+		.div = DIV_BUS},
+	[ID_BUS_PCLK] = {.id = ID_BUS_PCLK,
+		.name = CLK_BUS_PCLK,
+		.div = DIV_BUS},
+	[ID_VPU_BCLK] = {.id = ID_VPU_BCLK,
+		.name = CLK_VPU_BCLK,
+		.div = DIV_VPU},
+	[ID_VPU_PCLK] = {.id = ID_VPU_PCLK,
+		.name = CLK_VPU_PCLK,
+		.div = DIV_VPU},
+	[ID_DIS_BCLK] = {.id = ID_DIS_BCLK,
+		.name = CLK_DIS_BCLK,
+		.div = DIV_DISP},
+	[ID_DIS_PCLK] = {.id = ID_DIS_PCLK,
+		.name = CLK_DIS_PCLK,
+		.div = DIV_DISP},
+	[ID_CCI_BCLK] = {.id = ID_CCI_BCLK,
+		.name = CLK_CCI_BCLK,
+		.div = DIV_CCI4},
+	[ID_CCI_PCLK] = {.id = ID_CCI_PCLK,
+		.name = CLK_CCI_PCLK,
+		.div = DIV_CCI4},
+	[ID_G3D_BCLK] = {.id = ID_G3D_BCLK,
+		.name = CLK_G3D_BCLK,
+		.div = DIV_G3D},
+};
+
+static unsigned long clk_pll_recalc_rate(struct clk_hw *hw, unsigned long rate)
+{
+	struct clk_core *clk_data = to_clk_core(hw);
+	int id = clk_data->id;
+
+	switch (id) {
+	case ID_CPU_PLL0:
+		rate = PLLN_RATE(0);
+		break;
+	case ID_CPU_PLL1:
+		rate = PLLN_RATE(1);
+		break;
+	case ID_CPU_PLL2:
+		rate = PLLN_RATE(2);
+		break;
+	case ID_CPU_PLL3:
+		rate = PLLN_RATE(3);
+		break;
+	case ID_CPU_FCLK:
+		rate = CPU_FCLK_RATE(DIV_CPUG0);
+		break;
+	case ID_CPU_HCLK:
+		rate = CPU_HCLK_RATE(DIV_CPUG0);
+		break;
+	case ID_MEM_FCLK:
+		rate = MEM_FCLK_RATE();
+		break;
+	case ID_BUS_BCLK:
+		rate = BUS_BCLK_RATE();
+		break;
+	case ID_BUS_PCLK:
+		rate = BUS_PCLK_RATE();
+		break;
+	case ID_MEM_DCLK:
+		rate = MEM_DCLK_RATE();
+		break;
+	case ID_MEM_BCLK:
+		rate = MEM_BCLK_RATE();
+		break;
+	case ID_MEM_PCLK:
+		rate = MEM_PCLK_RATE();
+		break;
+	case ID_G3D_BCLK:
+		rate = G3D_BCLK_RATE();
+		break;
+	case ID_VPU_BCLK:
+		rate = VPU_BCLK_RATE();
+		break;
+	case ID_VPU_PCLK:
+		rate = VPU_PCLK_RATE();
+		break;
+	case ID_DIS_BCLK:
+		rate = DIS_BCLK_RATE();
+		break;
+	case ID_DIS_PCLK:
+		rate = DIS_PCLK_RATE();
+		break;
+	case ID_CCI_BCLK:
+		rate = CCI_BCLK_RATE();
+		break;
+	case ID_CCI_PCLK:
+		rate = CCI_PCLK_RATE();
+		break;
+	default:
+		pr_info("Unknown clock ID [%d] ...\n", id);
+		break;
+	}
+
+	pr_debug("%s: name %s id %d rate %ld\n", __func__, clk_data->name,
+		 clk_data->id, rate);
+	return rate;
+}
+
+static long clk_pll_round_rate(struct clk_hw *hw, unsigned long drate,
+			       unsigned long *prate)
+{
+	struct clk_core *clk_data = to_clk_core(hw);
+	struct pll_pms *pms = &clk_data->pms;
+	int id = clk_data->id;
+	long rate = 0;
+
+	/* clear P,M,S */
+	pms->P = 0, pms->M = 0, pms->S = 0;
+	rate = pll_round_rate(id, drate, &pms->P, &pms->M, &pms->S);
+
+	pr_debug("%s: name %s id %d (%lu, %lu) <%d,%d,%d>\n", __func__,
+		 clk_data->name, id, drate, rate, pms->P, pms->M, pms->S);
+	return rate;
+}
+
+static int clk_pll_set_rate(struct clk_hw *hw, unsigned long drate,
+			    unsigned long prate)
+{
+	struct clk_core *clk_data = to_clk_core(hw);
+	struct pll_pms *pms = &clk_data->pms;
+	int id = clk_data->id;
+	long rate = drate;
+
+	if (!pms->P && !pms->M && !pms->S)
+		rate = pll_round_rate(id, drate, &pms->P, &pms->M, &pms->S);
+
+	pr_debug("%s: name %s id %d (%lu, %lu) <%d,%d,%d>\n", __func__,
+		 clk_data->name, id, drate, rate, pms->P, pms->M, pms->S);
+	nx_pll_set_rate(id, pms->P, pms->M, pms->S);
+
+	/* clear P,M,S */
+	pms->P = 0, pms->M = 0, pms->S = 0;
+
+	return 0;
+}
+
+static const struct clk_ops clk_pll_ops = {
+	.recalc_rate = clk_pll_recalc_rate,
+	.round_rate = clk_pll_round_rate,
+	.set_rate = clk_pll_set_rate,
+};
+
+static const struct clk_ops clk_dev_ops = {
+	.recalc_rate = clk_pll_recalc_rate,
+};
+
+static struct clk *clk_pll_clock_register(const char *name,
+					  const char *parent_name,
+					  struct clk_hw *hw,
+					  const struct clk_ops *ops,
+					  unsigned long flags)
+{
+	struct clk *clk;
+	struct clk_init_data init;
+
+	init.name = name;
+	init.ops = ops;
+	init.flags = flags;
+	init.parent_names = (parent_name ? &parent_name : NULL);
+	init.num_parents = parent_name ? 1 : 0;
+	hw->init = &init;
+
+	clk = clk_register(NULL, hw);
+	if (IS_ERR(clk)) {
+		pr_err("%s: failed to register pll clock %s\n", __func__,
+		       init.name);
+		return NULL;
+	}
+
+	if (clk_register_clkdev(clk, init.name, NULL))
+		pr_err("%s: failed to register lookup for %s", __func__,
+		       init.name);
+
+	return clk;
+}
+
+static void __init clk_pll_sysclk_setup(struct device_node *np)
+{
+	struct clk *clk;
+	unsigned long flags = 0;/* | CLK_GET_RATE_NOCACHE; */
+	unsigned long rate[ID_CPU_FCLK];
+	int i;
+
+	for (i = 0; i < ID_CPU_FCLK; i++) {
+		clk = clk_pll_clock_register(clk_pll_dev[i].name, NULL,
+					     &clk_pll_dev[i].hw, &clk_pll_ops,
+					     flags);
+		if (NULL == clk)
+			continue;
+		rate[i] = clk_get_rate(clk);
+	}
+	pr_info("PLL : [0] = %10lu, [1] = %10lu, [2] = %10lu, [3] = %10lu\n",
+	       rate[0], rate[1], rate[2], rate[3]);
+}
+
+static void __init clk_pll_of_clocks_setup(struct device_node *node)
+{
+	struct clk_core *clk_data = NULL;
+	struct clk *clk;
+	unsigned long flags = CLK_IS_BASIC;
+	const char *parent_name = NULL;
+	int i, div, pll;
+
+	for (i = ID_CPU_FCLK; ID_END > i; i++) {
+		clk_data = &clk_pll_dev[i];
+		div = clk_data->div;
+		pll = pll_dvo(div);
+		clk_data->pll = pll;
+		parent_name = clk_pll_dev[pll].name;
+
+		clk = clk_pll_clock_register(clk_data->name, parent_name,
+				       &clk_data->hw, &clk_dev_ops, flags);
+		if (clk)
+			clk_data->rate = clk_get_rate(clk);
+	}
+}
+
+static void __init clk_pll_of_clocks_dump(struct device_node *np)
+{
+	struct clk_core *clk_data = clk_pll_dev;
+	int pll = pll_dvo(DIV_CPUG1);
+
+	/* cpu 0, 1  : div 0, 7 */
+	pr_info("(%d) PLL%d: CPU  FCLK = %10lu, HCLK = %9lu (G0)\n",
+	       clk_data[ID_CPU_FCLK].div, clk_data[ID_CPU_FCLK].pll,
+	       clk_data[ID_CPU_FCLK].rate, clk_data[ID_CPU_HCLK].rate);
+
+	pr_info("(%d) PLL%d: CPU  FCLK = %10lu, HCLK = %9lu (G1)\n", DIV_CPUG1,
+	       pll, (ulong)CPU_FCLK_RATE(DIV_CPUG1),
+	       (ulong)CPU_HCLK_RATE(DIV_CPUG1));
+
+	/* memory */
+	pr_info("(%d) PLL%d: MEM  FCLK = %10lu, DCLK = %9lu, BCLK = %9lu,",
+	       clk_data[ID_MEM_FCLK].div, clk_data[ID_MEM_FCLK].pll,
+	       clk_data[ID_MEM_FCLK].rate, clk_data[ID_MEM_DCLK].rate,
+	       clk_data[ID_MEM_BCLK].rate);
+
+	pr_info("PCLK = %9lu\n", clk_data[ID_MEM_PCLK].rate);
+
+	/* bus */
+	pr_info("(%d) PLL%d: BUS  BCLK = %10lu, PCLK = %9lu\n",
+	       clk_data[ID_BUS_BCLK].div, clk_data[ID_BUS_BCLK].pll,
+	       clk_data[ID_BUS_BCLK].rate, clk_data[ID_BUS_PCLK].rate);
+
+	/* cci400 */
+	pr_info("(%d) PLL%d: CCI4 BCLK = %10lu, PCLK = %9lu\n",
+	       clk_data[ID_CCI_BCLK].div, clk_data[ID_CCI_BCLK].pll,
+	       clk_data[ID_CCI_BCLK].rate, clk_data[ID_CCI_PCLK].rate);
+
+	/* 3d graphic */
+	pr_info("(%d) PLL%d: G3D  BCLK = %10lu\n", clk_data[ID_G3D_BCLK].div,
+	       clk_data[ID_G3D_BCLK].pll, clk_data[ID_G3D_BCLK].rate);
+
+	/* coda (vpu) */
+	pr_info("(%d) PLL%d: VPU  BCLK = %10lu, PCLK = %9lu\n",
+	       clk_data[ID_VPU_BCLK].div, clk_data[ID_VPU_BCLK].pll,
+	       clk_data[ID_VPU_BCLK].rate, clk_data[ID_VPU_PCLK].rate);
+
+	/* display */
+	pr_info("(%d) PLL%d: DISP BCLK = %10lu, PCLK = %9lu\n",
+	       clk_data[ID_DIS_BCLK].div, clk_data[ID_DIS_BCLK].pll,
+	       clk_data[ID_DIS_BCLK].rate, clk_data[ID_DIS_PCLK].rate);
+}
+
+static void __init clk_pll_of_setup(struct device_node *node)
+{
+	unsigned int pllin;
+	struct resource regs;
+
+	if (of_address_to_resource(node, 0, &regs) < 0) {
+		pr_err("fail get clock pll regsister\n");
+		return;
+	}
+
+	ref_clk_base = ioremap(regs.start, resource_size(&regs));
+	if (ref_clk_base == NULL) {
+		pr_err("fail get Clock control base address\n");
+		return;
+	}
+	if (0 == of_property_read_u32(node, "ref-freuecny", &pllin))
+		ref_clk = pllin;
+
+	clk_pll_sysclk_setup(node);
+	clk_pll_of_clocks_setup(node);
+	clk_pll_of_clocks_dump(node);
+
+	pr_info("CPU REF HZ: %lu hz (0x%08x:0x%p)\n", ref_clk, 0xc0010000,
+		ref_clk_base);
+}
+
+CLK_OF_DECLARE(s5pxx18, "nexell,s5pxx18,pll", clk_pll_of_setup);
diff -ENwbur a/drivers/clk/nexell/clk-s5pxx18-pll.h b/drivers/clk/nexell/clk-s5pxx18-pll.h
--- a/drivers/clk/nexell/clk-s5pxx18-pll.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/clk/nexell/clk-s5pxx18-pll.h	2018-05-06 08:49:49.054690387 +0200
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _CLK_S5P4818_PLL_H
+#define _CLK_S5P4818_PLL_H
+
+enum { ID_CPU_PLL0 = 0,
+	ID_CPU_PLL1,
+	ID_CPU_PLL2,
+	ID_CPU_PLL3,
+	ID_CPU_FCLK,
+	ID_CPU_HCLK,
+	ID_BUS_BCLK,
+	ID_BUS_PCLK,
+	ID_MEM_FCLK,
+	ID_MEM_DCLK,
+	ID_MEM_BCLK,
+	ID_MEM_PCLK,
+	ID_G3D_BCLK,
+	ID_VPU_BCLK,
+	ID_VPU_PCLK,
+	ID_DIS_BCLK,
+	ID_DIS_PCLK,
+	ID_CCI_BCLK,
+	ID_CCI_PCLK,
+	ID_END,
+};
+
+struct  reg_clkpwr {
+	unsigned int CLKMODEREG0;
+	unsigned int __Reserved0;
+	unsigned int PLLSETREG[4];
+	unsigned int __Reserved1[2];
+	unsigned int DVOREG[9];
+	unsigned int __Reserved2;
+	unsigned int PLLSETREG_SSCG[6];
+	unsigned int __reserved3[8];
+	unsigned char __Reserved4[0x200 - 0x80];
+	unsigned int GPIOWAKEUPRISEENB;
+	unsigned int GPIOWAKEUPFALLENB;
+	unsigned int GPIORSTENB;
+	unsigned int GPIOWAKEUPENB;
+	unsigned int GPIOINTENB;
+	unsigned int GPIOINTPEND;
+	unsigned int RESETSTATUS;
+	unsigned int INTENABLE;
+	unsigned int INTPEND;
+	unsigned int PWRCONT;
+	unsigned int PWRMODE;
+	unsigned int __Reserved5;
+	unsigned int SCRATCH[3];
+	unsigned int SYSRSTCONFIG;
+	unsigned int __Reserved6[0x100-0x80];
+	unsigned int PADSTRENGTHGPIO[5][2];
+	unsigned int __Reserved7[2];
+	unsigned int PADSTRENGTHBUS;
+};
+
+#define to_clk_core(_hw) container_of(_hw, struct clk_core, hw)
+
+#endif
diff -ENwbur a/drivers/clk/nexell/Makefile b/drivers/clk/nexell/Makefile
--- a/drivers/clk/nexell/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/clk/nexell/Makefile	2018-05-06 08:49:49.054690387 +0200
@@ -0,0 +1 @@
+obj-y	+= clk-s5pxx18.o clk-s5pxx18-pll.o
diff -ENwbur a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
--- a/drivers/clocksource/Kconfig	2018-05-06 08:47:36.269301092 +0200
+++ b/drivers/clocksource/Kconfig	2018-05-06 08:49:49.082691523 +0200
@@ -615,4 +615,11 @@
 	  Enable this option to use the Low Power controller timer
 	  as clocksource.

+config CLKSRC_NEXELL_TIMER
+	bool "Support for s5p6818 timer generation"
+	def_bool y if ARCH_S5P6818
+	select TIMER_OF if OF
+	help
+	  This is a new clocksource driver for the Nexell timer.
+
 endmenu
diff -ENwbur a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
--- a/drivers/clocksource/Makefile	2018-05-06 08:47:36.269301092 +0200
+++ b/drivers/clocksource/Makefile	2018-05-06 08:49:49.082691523 +0200
@@ -54,6 +54,7 @@
 obj-$(CONFIG_CLKSRC_NPS)	+= timer-nps.o
 obj-$(CONFIG_OXNAS_RPS_TIMER)	+= timer-oxnas-rps.o
 obj-$(CONFIG_OWL_TIMER)		+= owl-timer.o
+obj-$(CONFIG_CLKSRC_NEXELL_TIMER)  += s5pxx18_timer.o

 obj-$(CONFIG_ARC_TIMERS)		+= arc_timer.o
 obj-$(CONFIG_ARM_ARCH_TIMER)		+= arm_arch_timer.o
diff -ENwbur a/drivers/clocksource/s5pxx18_timer.c b/drivers/clocksource/s5pxx18_timer.c
--- a/drivers/clocksource/s5pxx18_timer.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/clocksource/s5pxx18_timer.c	2018-05-06 08:49:49.082691523 +0200
@@ -0,0 +1,498 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/kernel.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/spinlock.h>
+#include <linux/clocksource.h>
+#include <linux/clockchips.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/version.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <linux/clk-provider.h>
+#include <linux/reset.h>
+
+#define CLK_SOURCE_HZ (10 * 1000000) /* or 1MHZ */
+#define CLK_EVENT_HZ (10 * 1000000)  /* or 1MHZ */
+
+/* timer register */
+#define REG_TCFG0 (0x00)
+#define REG_TCFG1 (0x04)
+#define REG_TCON (0x08)
+#define REG_TCNTB0 (0x0C)
+#define REG_TCMPB0 (0x10)
+#define REG_TCNT0 (0x14)
+#define REG_CSTAT (0x44)
+
+#define TCON_BIT_AUTO (1 << 3)
+#define TCON_BIT_INVT (1 << 2)
+#define TCON_BIT_UP (1 << 1)
+#define TCON_BIT_RUN (1 << 0)
+#define TCFG0_BIT_CH(ch) (ch == 0 || ch == 1 ? 0 : 8)
+#define TCFG1_BIT_CH(ch) (ch * 4)
+#define TCON_BIT_CH(ch) (ch ? ch * 4 + 4 : 0)
+#define TINT_CSTAT_BIT_CH(ch) (ch + 5)
+#define TINT_CSTAT_MASK (0x1F)
+#define TIMER_TCNT_OFFS (0xC)
+
+/* timer data structs */
+struct timer_info {
+	int channel;
+	int interrupt;
+	const char *clock_name;
+	struct clk *clk;
+	unsigned long request;
+	unsigned long rate;
+	int tmux;
+	int prescale;
+	unsigned int tcount;
+	unsigned int rcount;
+};
+
+struct timer_of_dev {
+	void __iomem *base;
+	struct clk *pclk;
+	struct timer_info timer_source;
+	struct timer_info timer_event;
+};
+
+static struct timer_of_dev *timer_dev;
+#define get_timer_dev() ((struct timer_of_dev *)timer_dev)
+
+static inline void timer_periph_reset(int id) { return; }
+
+static inline void timer_clock(void __iomem *base, int ch, int mux, int scl)
+{
+	u32 val = readl(base + REG_TCFG0) & ~(0xFF << TCFG0_BIT_CH(ch));
+
+	writel(val | ((scl - 1) << TCFG0_BIT_CH(ch)), base + REG_TCFG0);
+	val = readl(base + REG_TCFG1) & ~(0xF << TCFG1_BIT_CH(ch));
+	writel(val | (mux << TCFG1_BIT_CH(ch)), base + REG_TCFG1);
+}
+
+static inline void timer_count(void __iomem *base, int ch, unsigned int cnt)
+{
+	writel((cnt - 1), base + REG_TCNTB0 + (TIMER_TCNT_OFFS * ch));
+	writel((cnt - 1), base + REG_TCMPB0 + (TIMER_TCNT_OFFS * ch));
+}
+
+static inline void timer_start(void __iomem *base, int ch, int irqon)
+{
+	int on = irqon ? 1 : 0;
+	u32 val = readl(base + REG_CSTAT) & ~(TINT_CSTAT_MASK << 5 | 0x1 << ch);
+
+	writel(val | (0x1 << TINT_CSTAT_BIT_CH(ch) | on << ch),
+	       base + REG_CSTAT);
+	val = readl(base + REG_TCON) & ~(0xE << TCON_BIT_CH(ch));
+	writel(val | (TCON_BIT_UP << TCON_BIT_CH(ch)), base + REG_TCON);
+
+	val &= ~(TCON_BIT_UP << TCON_BIT_CH(ch));
+	val |= ((TCON_BIT_AUTO | TCON_BIT_RUN) << TCON_BIT_CH(ch));
+	writel(val, base + REG_TCON);
+}
+
+static inline void timer_stop(void __iomem *base, int ch, int irqon)
+{
+	int on = irqon ? 1 : 0;
+	u32 val = readl(base + REG_CSTAT) & ~(TINT_CSTAT_MASK << 5 | 0x1 << ch);
+
+	writel(val | (0x1 << TINT_CSTAT_BIT_CH(ch) | on << ch),
+	       base + REG_CSTAT);
+	val = readl(base + REG_TCON) & ~(TCON_BIT_RUN << TCON_BIT_CH(ch));
+	writel(val, base + REG_TCON);
+}
+
+static inline unsigned int timer_read(void __iomem *base, int ch)
+{
+	return readl(base + REG_TCNT0 + (TIMER_TCNT_OFFS * ch));
+}
+
+static inline u32 timer_read_count(void)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info;
+
+	if (NULL == dev || NULL == dev->base)
+		return 0;
+
+	info = &dev->timer_source;
+
+	info->rcount = (info->tcount - timer_read(dev->base, info->channel));
+	return (u64)info->rcount;
+}
+
+/*
+ * Timer clock source
+ */
+static void timer_clock_select(struct timer_of_dev *dev,
+			       struct timer_info *info)
+{
+	unsigned long rate, tout = 0;
+	unsigned long mout, thz, delt = (-1UL);
+	unsigned long frequency = info->request;
+	int tscl = 0, tmux = 5, smux = 0, pscl = 0;
+	int from_tclk = 0;
+
+	if (dev->pclk) {
+		rate = clk_get_rate(dev->pclk);
+		for (smux = 0; 5 > smux; smux++) {
+			mout = rate / (1 << smux), pscl = mout / frequency;
+			thz = mout / (pscl ? pscl : 1);
+			if (!(mout % frequency) && 256 > pscl) {
+				tout = thz, tmux = smux, tscl = pscl;
+				break;
+			}
+			if (pscl > 256)
+				continue;
+			if (abs(frequency - thz) >= delt)
+				continue;
+			tout = thz, tmux = smux, tscl = pscl;
+			delt = abs(frequency - thz);
+		}
+	}
+
+	if (tout != frequency) {
+		rate = clk_round_rate(info->clk, frequency);
+		if (abs(frequency - tout) >= abs(frequency - rate)) {
+			clk_set_rate(info->clk, rate);
+			clk_prepare_enable(info->clk);
+			tout = rate, tmux = 5, tscl = 1, from_tclk = 1;
+		}
+	}
+
+	if (dev->pclk && !from_tclk) {
+		clk_put(info->clk);
+		info->clk = NULL;
+		rate = clk_get_rate(dev->pclk); /* restore pclk */
+	}
+
+	info->tmux = tmux;
+	info->prescale = tscl;
+	info->tcount = tout / HZ;
+	info->rate = tout;
+
+	pr_debug("%s (ch:%d, mux=%d, scl=%d, rate=%ld, %s)\n", __func__,
+		 info->channel, tmux, tscl, tout, from_tclk ? "TCLK" : "PCLK");
+}
+
+static void timer_source_suspend(struct clocksource *cs)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_source;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+
+	if (info->clk) {
+		clk_disable_unprepare(info->clk);
+	}
+
+	info->rcount = (info->tcount - timer_read(base, ch));
+	timer_stop(base, ch, 0);
+}
+
+static void timer_source_resume(struct clocksource *cs)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_source;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+	ulong flags;
+
+	pr_debug("%s (ch:%d, mux:%d, scale:%d cnt:0x%x,0x%x)\n", __func__, ch,
+		 info->tmux, info->prescale, info->rcount, info->tcount);
+
+	local_irq_save(flags);
+
+	if (info->clk) {
+		clk_set_rate(info->clk, info->rate);
+		clk_prepare_enable(info->clk);
+	}
+
+	timer_stop(base, ch, 0);
+	timer_clock(base, ch, info->tmux, info->prescale);
+	timer_count(base, ch, info->rcount + 1); /* restore count */
+	timer_start(base, ch, 0);
+	timer_count(base, ch, info->tcount + 1); /* next count */
+
+	local_irq_restore(flags);
+}
+
+static u64 timer_source_read(struct clocksource *cs)
+{
+	return (u64)timer_read_count();
+}
+
+static struct clocksource timer_clocksource = {
+	.name = "source timer",
+	.rating = 300,
+	.read = timer_source_read,
+	.mask = CLOCKSOURCE_MASK(32),
+	.shift = 20,
+	.flags = CLOCK_SOURCE_IS_CONTINUOUS,
+	.suspend = timer_source_suspend,
+	.resume = timer_source_resume,
+};
+
+static int __init timer_source_of_init(struct device_node *node)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_source;
+	struct clocksource *cs = &timer_clocksource;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+
+	info->request = CLK_SOURCE_HZ;
+
+	timer_clock_select(dev, info);
+
+	/* reset tcount */
+	info->tcount = 0xFFFFFFFF;
+
+	clocksource_register_hz(cs, info->rate);
+
+	timer_stop(base, ch, 0);
+	timer_clock(base, ch, info->tmux, info->prescale);
+	timer_count(base, ch, 0);
+	timer_start(base, ch, 0);
+
+	pr_debug("timer.%d: source, %9lu(HZ:%d), mult:%u\n", ch, info->rate, HZ,
+	       cs->mult);
+	return 0;
+}
+
+/*
+ * Timer clock event
+ */
+static void timer_event_resume(struct clock_event_device *evt)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_event;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+
+	pr_debug("%s (ch:%d, mux:%d, scale:%d)\n", __func__, ch, info->tmux,
+		 info->prescale);
+
+	timer_stop(base, ch, 1);
+	timer_clock(base, ch, info->tmux, info->prescale);
+}
+
+static int timer_event_shutdown(struct clock_event_device *evt)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_event;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+
+	timer_stop(base, ch, 0);
+
+	return 0;
+}
+
+static int timer_event_set_oneshot(struct clock_event_device *evt)
+{
+	return 0;
+}
+
+static int timer_event_set_periodic(struct clock_event_device *evt)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_event;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+	unsigned long cnt = info->tcount;
+
+	timer_stop(base, ch, 0);
+	timer_count(base, ch, cnt);
+	timer_start(base, ch, 1);
+
+	return 0;
+}
+
+static int timer_event_set_next(unsigned long delta,
+				struct clock_event_device *evt)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_event;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+	ulong flags;
+
+	raw_local_irq_save(flags);
+
+	timer_stop(base, ch, 0);
+	timer_count(base, ch, delta);
+	timer_start(base, ch, 1);
+
+	raw_local_irq_restore(flags);
+	return 0;
+}
+
+static struct clock_event_device timer_clock_event = {
+	.name = "event timer",
+	.features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
+	.set_state_shutdown = timer_event_shutdown,
+	.set_state_periodic = timer_event_set_periodic,
+	.set_state_oneshot = timer_event_set_oneshot,
+	.tick_resume = timer_event_shutdown,
+	.set_next_event = timer_event_set_next,
+	.resume = timer_event_resume,
+	.rating = 50, /* Lower than dummy timer (for 6818) */
+};
+
+static irqreturn_t timer_event_handler(int irq, void *dev_id)
+{
+	struct clock_event_device *evt = &timer_clock_event;
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_event;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+	u32 val;
+
+	/* clear status */
+	val = readl(base + REG_CSTAT) & ~(TINT_CSTAT_MASK << 5);
+	val |= (0x1 << TINT_CSTAT_BIT_CH(ch));
+	writel(val, base + REG_CSTAT);
+
+	evt->event_handler(evt);
+
+	return IRQ_HANDLED;
+}
+
+static struct irqaction timer_event_irqaction = {
+	.name = "Event Timer IRQ",
+	.flags = IRQF_TIMER, /* removed IRQF_DISABLED kernel 4.1.15 */
+	.handler = timer_event_handler,
+};
+
+#ifdef CONFIG_ARM64
+/*
+ * to __delay , refer to arch_timer.h and  arm64 lib delay.c
+ */
+u64 arch_counter_get_cntvct(void) { return timer_read_count(); }
+EXPORT_SYMBOL(arch_counter_get_cntvct);
+
+int arch_timer_arch_init(void) { return 0; }
+#endif
+
+static int __init timer_event_of_init(struct device_node *node)
+{
+	struct timer_of_dev *dev = get_timer_dev();
+	struct timer_info *info = &dev->timer_event;
+	struct clock_event_device *evt = &timer_clock_event;
+	void __iomem *base = dev->base;
+	int ch = info->channel;
+
+	info->request = CLK_EVENT_HZ;
+
+	timer_clock_select(dev, info);
+	timer_stop(base, ch, 1);
+	timer_clock(base, ch, info->tmux, info->prescale);
+
+	setup_irq(info->interrupt, &timer_event_irqaction);
+	clockevents_calc_mult_shift(evt, info->rate, 5);
+	evt->max_delta_ns = clockevent_delta2ns(0xffffffff, evt);
+	evt->min_delta_ns = clockevent_delta2ns(0xf, evt);
+	evt->cpumask = cpumask_of(0);
+	evt->irq = info->interrupt;
+
+	clockevents_register_device(evt);
+
+	pr_debug("timer.%d: event , %9lu(HZ:%d), mult:%u\n",
+		 ch, info->rate, HZ, evt->mult);
+	return 0;
+}
+
+static int __init
+timer_get_device_data(struct device_node *node, struct timer_of_dev *dev)
+{
+	struct timer_info *tsrc = &dev->timer_source;
+	struct timer_info *tevt = &dev->timer_event;
+
+	dev->base = of_iomap(node, 0);
+	if (!dev->base) {
+		pr_err("Can't map registers for timer!");
+		return -EINVAL;
+	}
+
+	if (of_property_read_u32(node, "clksource", &tsrc->channel)) {
+		pr_err("timer node is missing 'clksource'\n");
+		return -EINVAL;
+	}
+
+	if (of_property_read_u32(node, "clkevent", &tevt->channel)) {
+		pr_err("timer node is missing 'clkevent'\n");
+		return -EINVAL;
+	}
+	tevt->interrupt = irq_of_parse_and_map(node, 0);
+
+	tsrc->clk = of_clk_get(node, 0);
+	if (IS_ERR(tsrc->clk)) {
+		pr_err("failed timer tsrc clock\n");
+		return -EINVAL;
+	}
+
+	tevt->clk = of_clk_get(node, 1);
+	if (IS_ERR(tevt->clk)) {
+		pr_err("failed timer event clock\n");
+		return -EINVAL;
+	}
+
+	dev->pclk = of_clk_get(node, 2);
+	if (IS_ERR(dev->pclk))
+		dev->pclk = NULL;
+
+	pr_debug("%s : ch %d,%d irq %d\n", node->name, tsrc->channel,
+		 tevt->channel, tevt->interrupt);
+
+	return 0;
+}
+
+#ifdef CONFIG_ARM
+static struct delay_timer nxp_delay_timer = {
+	.freq = CLK_SOURCE_HZ,
+	.read_current_timer = (unsigned long (*)(void))timer_read_count,
+};
+#endif
+
+static int __init timer_of_init_dt(struct device_node *node)
+{
+	struct timer_of_dev *dev = NULL;
+
+	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+
+	timer_dev = dev;
+
+	if (timer_get_device_data(node, dev))
+		panic("unable to map timer cpu !!!\n");
+
+	timer_source_of_init(node);
+	timer_event_of_init(node);
+
+#ifdef CONFIG_ARM
+	register_current_timer_delay(&nxp_delay_timer);
+#endif
+    return 0;
+}
+
+CLOCKSOURCE_OF_DECLARE(s5p6818, "nexell,s5p6818-timer", timer_of_init_dt);
diff -ENwbur a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
--- a/drivers/cpufreq/Kconfig.arm	2018-05-06 08:47:36.273301254 +0200
+++ b/drivers/cpufreq/Kconfig.arm	2018-05-06 08:49:49.086691685 +0200
@@ -292,3 +292,45 @@
 	  support for its operation.

 	  If in doubt, say N.
+
+config ARM_NEXELL_CPUFREQ
+	bool "Nexell CPU Frequency scaling support"
+	depends on ARCH_S5P6818 || ARCH_S5P4418
+	default y
+	help
+	  This adds the CPUFreq driver for Nexell SoC.
+
+config ARM_NEXELL_CPUFREQ_DEBUG
+	bool "Dynamic Frequency scaling debug message"
+	depends on ARM_NEXELL_CPUFREQ
+	default n
+
+config ARM_NEXELL_CPUFREQ_VOLTAGE_DEBUG
+	bool "Dynamic Voltage scaling debug message"
+	depends on ARM_NEXELL_CPUFREQ
+	default n
+
+config ARM_DYNAMIC_CLUSTER_HOTPLUG
+	bool "Dynamic CLUSTER Hotplug support"
+	depends on HOTPLUG_CPU
+	help
+		Enable Dynamic CLUSTER Hotplug
+
+choice
+	prompt "Select CPU PLL device"
+	depends on ARM_NEXELL_CPUFREQ
+	default NEXELL_CPUFREQ_PLL_1
+
+	config NEXELL_CPUFREQ_PLL_0
+		bool "PLL 0"
+
+	config NEXELL_CPUFREQ_PLL_1
+		bool "PLL 1"
+endchoice
+
+config NEXELL_CPUFREQ_PLLDEV
+	int
+	default 0 if NEXELL_CPUFREQ_PLL_0
+	default 1 if NEXELL_CPUFREQ_PLL_1
+	default 2 if NEXELL_CPUFREQ_PLL_2
+	default 3 if NEXELL_CPUFREQ_PLL_3
diff -ENwbur a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
--- a/drivers/cpufreq/Makefile	2018-05-06 08:47:36.273301254 +0200
+++ b/drivers/cpufreq/Makefile	2018-05-06 08:49:49.086691685 +0200
@@ -83,6 +83,7 @@
 obj-$(CONFIG_ARM_VEXPRESS_SPC_CPUFREQ)	+= vexpress-spc-cpufreq.o
 obj-$(CONFIG_ACPI_CPPC_CPUFREQ) += cppc_cpufreq.o
 obj-$(CONFIG_MACH_MVEBU_V7)		+= mvebu-cpufreq.o
+obj-$(CONFIG_ARM_NEXELL_CPUFREQ)   	+= nexell-cpufreq.o


 ##################################################################################
diff -ENwbur a/drivers/cpufreq/nexell-cpufreq.c b/drivers/cpufreq/nexell-cpufreq.c
--- a/drivers/cpufreq/nexell-cpufreq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/cpufreq/nexell-cpufreq.c	2018-05-06 08:49:49.090691848 +0200
@@ -0,0 +1,902 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/cpufreq.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/kthread.h>
+#include <linux/sysrq.h>
+#include <linux/suspend.h>
+#include <linux/notifier.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/cpu_cooling.h>
+#include <linux/pm_qos.h>
+
+#include <linux/soc/nexell/cpufreq.h>
+
+#define DEV_NAME_CPUFREQ	"nexell-cpufreq"
+
+/*
+ * DVFS info
+ */
+struct cpufreq_asv_ops {
+	int  (*setup_table)(unsigned long (*tables)[2]);
+	long (*get_voltage)(long freqkhz);
+	int  (*modify_vol_table)(unsigned long (*tables)[2], int table_size,
+			long val, bool dn, bool percent);
+	int  (*current_label)(char *string);
+	long (*get_vol_margin)(long uV, long val, bool dn, bool percent);
+};
+
+#if defined(CONFIG_ARCH_S5P6818)
+#include "s5p6818-cpufreq.h"
+#elif defined(CONFIG_ARCH_S5P4418)
+#include "s5p4418-cpufreq.h"
+#else
+#define	FREQ_MAX_FREQ_KHZ		(1400*1000)
+#define	FREQ_ARRAY_SIZE			(11)
+static struct cpufreq_asv_ops	asv_ops = { };
+#endif
+
+struct cpufreq_dvfs_timestamp {
+	unsigned long start;
+	unsigned long duration;
+};
+
+struct cpufreq_dvfs_info {
+	struct cpufreq_frequency_table *freq_table;
+	unsigned long (*dvfs_table)[2];
+	struct clk *clk;
+	cpumask_var_t cpus;
+	struct cpufreq_policy *policy;
+	int cpu;
+	long target_freq;
+	int  freq_point;
+	struct mutex lock;
+	/* voltage control */
+	struct regulator *volt;
+	int table_size;
+	long supply_delay_us;
+	/* for suspend/resume */
+	struct notifier_block pm_notifier;
+	unsigned long resume_state;
+	long boot_frequency;
+	int  boot_voltage;
+	/* check frequency duration */
+	int  pre_freq_point;
+	unsigned long check_state;
+	struct cpufreq_dvfs_timestamp *time_stamp;
+	/* ASV operation */
+	struct cpufreq_asv_ops *asv_ops;
+};
+
+#define	FREQ_TABLE_MAX			(30)
+#define	FREQ_STATE_RESUME		(0)	/* bit num */
+#define	FREQ_STATE_TIME_RUN		(0)	/* bit num */
+
+static struct thermal_cooling_device *cdev;
+static struct cpufreq_dvfs_info	*ptr_current_dvfs;
+static unsigned long dvfs_freq_voltage[FREQ_TABLE_MAX][2];
+static struct cpufreq_dvfs_timestamp dvfs_timestamp[FREQ_TABLE_MAX] = { {0,}, };
+#define	ms_to_ktime(m)	ns_to_ktime((u64)m * 1000 * 1000)
+
+static inline void set_dvfs_ptr(void *dvfs)	{ ptr_current_dvfs = dvfs; }
+static inline void *get_dvfs_ptr(void)		{ return ptr_current_dvfs; }
+
+static inline unsigned long cpufreq_get_voltage(struct cpufreq_dvfs_info *dvfs,
+						unsigned long frequency)
+{
+	unsigned long (*dvfs_table)[2] = (unsigned long(*)[2])dvfs->dvfs_table;
+	int i = 0;
+
+	for (i = 0; dvfs->table_size > i; i++) {
+		if (frequency == dvfs_table[i][0])
+			return dvfs_table[i][1];
+	}
+
+	pr_err("Fail : invalid frequency (%ld:%d) id !!!\n",
+	       frequency, dvfs->table_size);
+	return -EINVAL;
+}
+
+static int nxp_cpufreq_set_freq_point(struct cpufreq_dvfs_info *dvfs,
+					unsigned long frequency)
+{
+	unsigned long (*dvfs_tables)[2] = (unsigned long(*)[2])dvfs->dvfs_table;
+	int len = dvfs->table_size;
+	int id = 0;
+
+	for (id = 0; len > id; id++)
+		if (frequency == dvfs_tables[id][0])
+			break;
+
+	if (id == len) {
+		pr_err("Fail : invalid frequency (%ld:%d) id !!!\n",
+		       frequency, len);
+		return -EINVAL;
+	}
+
+	dvfs->freq_point = id;
+	return 0;
+}
+
+static long nxp_cpufreq_change_voltage(struct cpufreq_dvfs_info *dvfs,
+				       unsigned long frequency)
+{
+	long mS = 0, uS = 0;
+	long uV = 0, wT = 0;
+
+	if (!dvfs->volt)
+		return 0;
+
+	uV = cpufreq_get_voltage(dvfs, frequency);
+	wT = dvfs->supply_delay_us;
+
+	/* when rest duration */
+	if (0 > uV) {
+		pr_err("%s: failed invalid freq %ld uV %ld !!!\n", __func__,
+		       frequency, uV);
+		return -EINVAL;
+	}
+
+	if (dvfs->asv_ops->get_voltage)
+		uV = dvfs->asv_ops->get_voltage(frequency);
+
+	regulator_set_voltage(dvfs->volt, uV, uV);
+
+	if (wT) {
+		mS = wT/1000;
+		uS = wT%1000;
+		if (mS)
+			mdelay(mS);
+		if (uS)
+			udelay(uS);
+	}
+
+#ifdef CONFIG_ARM_NEXELL_CPUFREQ_VOLTAGE_DEBUG
+	pr_info(" volt (%lukhz %ld.%06ld v, delay %ld.%03ld us)\n",
+			frequency, uV/1000000, uV%1000000, mS, uS);
+#endif
+	return uV;
+}
+
+static unsigned long nxp_cpufreq_change_freq(struct cpufreq_dvfs_info *dvfs,
+				unsigned int new, unsigned old)
+{
+	struct clk *clk = dvfs->clk;
+	unsigned long rate_khz = 0;
+	struct cpufreq_policy policy;
+
+	nxp_cpufreq_set_freq_point(dvfs, new);
+
+	if (!test_bit(FREQ_STATE_RESUME, &dvfs->resume_state))
+		return old;
+
+	/* pre voltage */
+	if (new >= old)
+		nxp_cpufreq_change_voltage(dvfs, new);
+
+	if (NULL == dvfs->policy) {
+		cpumask_copy(policy.cpus, cpu_online_mask);
+		dvfs->policy = &policy;
+	}
+
+	clk_set_rate(clk, new*1000);
+	rate_khz = clk_get_rate(clk)/1000;
+
+#ifdef CONFIG_ARM_NEXELL_CPUFREQ_DEBUG
+	pr_debug(" set rate %u:%lukhz\n", new, rate_khz);
+#endif
+
+	if (test_bit(FREQ_STATE_TIME_RUN, &dvfs->check_state)) {
+		int id = dvfs->freq_point;
+		int prev = dvfs->pre_freq_point;
+		long ms = ktime_to_ms(ktime_get());
+
+		dvfs->time_stamp[prev].duration +=
+			(ms - dvfs->time_stamp[prev].start);
+		dvfs->time_stamp[id].start = ms;
+		dvfs->pre_freq_point = id;
+	}
+
+	/* post voltage */
+	if (old > new)
+		nxp_cpufreq_change_voltage(dvfs, new);
+
+	return rate_khz;
+}
+
+static int nxp_cpufreq_pm_notify(struct notifier_block *this,
+				 unsigned long mode, void *unused)
+{
+	struct cpufreq_dvfs_info *dvfs = container_of(this,
+						      struct cpufreq_dvfs_info,
+						      pm_notifier);
+	struct clk *clk = dvfs->clk;
+	unsigned int old, new;
+	long max_freq = cpufreq_quick_get_max(dvfs->cpu);
+
+	switch (mode) {
+	case PM_SUSPEND_PREPARE:	/* set initial frequecny */
+		mutex_lock(&dvfs->lock);
+
+		new = dvfs->boot_frequency;
+		if (new > max_freq) {
+			new = max_freq;
+			pr_info("DVFS: max freq %ldkhz less than boot %ldkz.\n",
+				max_freq, dvfs->boot_frequency);
+		}
+		old = clk_get_rate(clk)/1000;
+
+		dvfs->target_freq = new;
+		nxp_cpufreq_change_freq(dvfs, new, old);
+
+		clear_bit(FREQ_STATE_RESUME, &dvfs->resume_state);
+		mutex_unlock(&dvfs->lock);
+		break;
+
+	case PM_POST_SUSPEND:	/* set restore frequecny */
+		mutex_lock(&dvfs->lock);
+		set_bit(FREQ_STATE_RESUME, &dvfs->resume_state);
+
+		new = dvfs->target_freq;
+		old = clk_get_rate(clk)/1000;
+		nxp_cpufreq_change_freq(dvfs, new, old);
+
+		mutex_unlock(&dvfs->lock);
+		break;
+	}
+	return 0;
+}
+
+/*
+ * Attribute sys interfaces
+ */
+static ssize_t show_speed_duration(struct cpufreq_policy *policy, char *buf)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	int id = dvfs->freq_point;
+	ssize_t count = 0;
+	int i = 0;
+
+	if (test_bit(FREQ_STATE_TIME_RUN, &dvfs->check_state)) {
+		long ms = ktime_to_ms(ktime_get());
+
+		if (dvfs->time_stamp[id].start)
+			dvfs->time_stamp[id].duration +=
+				(ms - dvfs->time_stamp[id].start);
+		dvfs->time_stamp[id].start = ms;
+		dvfs->pre_freq_point = id;
+	}
+
+	for (; dvfs->table_size > i; i++)
+		count += sprintf(&buf[count], "%8ld ",
+				 dvfs->time_stamp[i].duration);
+
+	count += sprintf(&buf[count], "\n");
+	return count;
+}
+
+static ssize_t store_speed_duration(struct cpufreq_policy *policy,
+			const char *buf, size_t count)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	int id = dvfs->freq_point;
+	long ms = ktime_to_ms(ktime_get());
+	const char *s = buf;
+
+	mutex_lock(&dvfs->lock);
+
+	if (0 == strncmp(s, "run", strlen("run"))) {
+		dvfs->pre_freq_point = id;
+		dvfs->time_stamp[id].start = ms;
+		set_bit(FREQ_STATE_TIME_RUN, &dvfs->check_state);
+	} else if (0 == strncmp(s, "stop", strlen("stop"))) {
+		clear_bit(FREQ_STATE_TIME_RUN, &dvfs->check_state);
+	} else if (0 == strncmp(s, "clear", strlen("clear"))) {
+		memset(dvfs->time_stamp, 0, sizeof(dvfs_timestamp));
+		if (test_bit(FREQ_STATE_TIME_RUN, &dvfs->check_state)) {
+			dvfs->time_stamp[id].start = ms;
+			dvfs->pre_freq_point = id;
+		}
+	} else {
+		count = -1;
+	}
+
+	mutex_unlock(&dvfs->lock);
+
+	return count;
+}
+
+static ssize_t show_available_voltages(struct cpufreq_policy *policy, char *buf)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	unsigned long (*dvfs_table)[2] = (unsigned long(*)[2])dvfs->dvfs_table;
+	ssize_t count = 0;
+	int i = 0;
+
+	for (; dvfs->table_size > i; i++) {
+		long uV = dvfs_table[i][1];
+
+		if (dvfs->asv_ops->get_voltage)
+			uV = dvfs->asv_ops->get_voltage(dvfs_table[i][0]);
+		count += sprintf(&buf[count], "%ld ", uV);
+	}
+
+	count += sprintf(&buf[count], "\n");
+	return count;
+}
+
+static ssize_t show_cur_voltages(struct cpufreq_policy *policy, char *buf)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	unsigned long (*dvfs_table)[2] = (unsigned long(*)[2])dvfs->dvfs_table;
+	ssize_t count = 0;
+	int i = 0;
+
+	for (; dvfs->table_size > i; i++)
+		count += sprintf(&buf[count], "%ld ", dvfs_table[i][1]);
+
+	count += sprintf(&buf[count], "\n");
+	return count;
+}
+
+static ssize_t store_cur_voltages(struct cpufreq_policy *policy,
+			const char *buf, size_t count)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	unsigned long (*dvfs_tables)[2] =
+		(unsigned long(*)[2])dvfs_freq_voltage;
+	bool percent = false, down = false;
+	const char *s = strchr(buf, '-');
+	long val;
+
+	if (s)
+		down = true;
+	else
+		s = strchr(buf, '+');
+
+	if (!s)
+		s = buf;
+	else
+		s++;
+
+	if (strchr(buf, '%'))
+		percent = 1;
+
+	val = simple_strtol(s, NULL, 10);
+
+	mutex_lock(&dvfs->lock);
+
+	if (dvfs->asv_ops->modify_vol_table)
+		dvfs->asv_ops->modify_vol_table(dvfs_tables, dvfs->table_size,
+							val, down, percent);
+
+	nxp_cpufreq_change_voltage(dvfs, dvfs->target_freq);
+
+	mutex_unlock(&dvfs->lock);
+	return count;
+}
+
+static ssize_t show_asv_level(struct cpufreq_policy *policy, char *buf)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	int ret = 0;
+
+	if (dvfs->asv_ops->current_label)
+		ret = dvfs->asv_ops->current_label(buf);
+
+	return ret;
+}
+
+/*
+ * show/store frequency duration time status
+ */
+static struct freq_attr cpufreq_freq_attr_scaling_speed_duration = {
+	.attr = {
+		.name = "scaling_speed_duration",
+		.mode = 0664,
+	},
+	.show  = show_speed_duration,
+	.store = store_speed_duration,
+};
+
+/*
+ * show available voltages each frequency
+ */
+static struct freq_attr cpufreq_freq_attr_scaling_available_voltages = {
+	.attr = {
+		.name = "scaling_available_voltages",
+		.mode = 0664,
+	},
+	.show  = show_available_voltages,
+};
+
+/*
+ * show/store ASV current voltage adjust margin
+ */
+static struct freq_attr cpufreq_freq_attr_scaling_cur_voltages = {
+	.attr = {
+		.name = "scaling_cur_voltages",
+		.mode = 0664,
+	},
+	.show  = show_cur_voltages,
+	.store = store_cur_voltages,
+};
+
+/*
+ * show ASV level status
+ */
+static struct freq_attr cpufreq_freq_attr_scaling_asv_level = {
+	.attr = {
+		.name = "scaling_asv_level",
+		.mode = 0664,
+	},
+	.show  = show_asv_level,
+};
+
+static struct freq_attr *nxp_cpufreq_attr[] = {
+	/* kernel attribute */
+	&cpufreq_freq_attr_scaling_available_freqs,
+	/* new sttribute */
+	&cpufreq_freq_attr_scaling_speed_duration,
+	&cpufreq_freq_attr_scaling_available_voltages,
+	&cpufreq_freq_attr_scaling_cur_voltages,
+	&cpufreq_freq_attr_scaling_asv_level,
+	NULL,
+};
+
+static int nxp_cpufreq_verify_speed(struct cpufreq_policy *policy)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	struct cpufreq_frequency_table *freq_table = dvfs->freq_table;
+
+	if (!freq_table)
+		return -EINVAL;
+
+	return cpufreq_frequency_table_verify(policy, freq_table);
+}
+
+static unsigned int nxp_cpufreq_get_speed(unsigned int cpu)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	struct clk *clk = dvfs->clk;
+	long rate_khz = clk_get_rate(clk)/1000;
+
+	return rate_khz;
+}
+
+static int nxp_cpufreq_target(struct cpufreq_policy *policy,
+				unsigned int index)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	struct cpufreq_frequency_table *freq_table = dvfs->freq_table;
+	unsigned long rate_khz = 0;
+	unsigned int old, new;
+	int ret = 0;
+
+	old = policy->cur;
+	new = freq_table[index].frequency;
+
+	new = max((unsigned int)pm_qos_request(PM_QOS_CPU_FREQ_MIN), new);
+	new = min((unsigned int)pm_qos_request(PM_QOS_CPU_FREQ_MAX), new);
+
+	mutex_lock(&dvfs->lock);
+
+	pr_debug("cpufreq : target %u -> %u khz", old, new);
+
+	if (old == new && policy->cur == new) {
+		pr_debug("PASS\n");
+		mutex_unlock(&dvfs->lock);
+		return ret;
+	}
+
+	dvfs->target_freq = new;
+
+	pr_debug("\n");
+
+	dvfs->policy = policy;
+
+	rate_khz = nxp_cpufreq_change_freq(dvfs, new, old);
+
+	policy->cur = rate_khz;
+
+	mutex_unlock(&dvfs->lock);
+
+	return ret;
+}
+
+static int nxp_cpufreq_init(struct cpufreq_policy *policy)
+{
+	struct cpufreq_dvfs_info *dvfs = get_dvfs_ptr();
+	struct cpufreq_frequency_table *freq_table = dvfs->freq_table;
+
+	pr_debug("nxp-cpufreq: freq table 0x%p\n", freq_table);
+	return cpufreq_generic_init(policy, freq_table, 100000);
+}
+
+static int cpufreq_min_qos_handler(struct notifier_block *b,
+		unsigned long val, void *v)
+{
+	struct cpufreq_policy *policy;
+	int ret;
+
+	policy = cpufreq_cpu_get(0);
+
+	if (!policy)
+		goto bad;
+
+	if (policy->cur >= val) {
+		cpufreq_cpu_put(policy);
+		goto good;
+	}
+
+	if (!policy->governor) {
+		cpufreq_cpu_put(policy);
+		goto bad;
+	}
+
+	ret = __cpufreq_driver_target(policy, val, CPUFREQ_RELATION_L);
+
+	cpufreq_cpu_put(policy);
+
+	if (ret < 0)
+	    goto bad;
+
+good:
+	return NOTIFY_OK;
+bad:
+	return NOTIFY_BAD;
+}
+
+static int cpufreq_max_qos_handler(struct notifier_block *b,
+		unsigned long val, void *v)
+{
+	struct cpufreq_policy *policy;
+	int ret;
+
+	policy = cpufreq_cpu_get(0);
+
+	if (!policy)
+		goto bad;
+
+	if (policy->cur <= val) {
+		cpufreq_cpu_put(policy);
+		goto good;
+	}
+
+	if (!policy->governor) {
+		cpufreq_cpu_put(policy);
+		goto bad;
+	}
+
+	ret = __cpufreq_driver_target(policy, val, CPUFREQ_RELATION_H);
+
+	cpufreq_cpu_put(policy);
+
+	if (ret < 0)
+		goto bad;
+
+good:
+	return NOTIFY_OK;
+bad:
+	return NOTIFY_BAD;
+}
+
+static struct notifier_block cpufreq_min_qos_notifier = {
+	.notifier_call = cpufreq_min_qos_handler,
+};
+
+static struct notifier_block cpufreq_max_qos_notifier = {
+	.notifier_call = cpufreq_max_qos_handler,
+};
+
+static void nxp_cpufreq_ready(struct cpufreq_policy *policy)
+{
+	struct device_node *cpu0;
+
+	cpu0 = of_get_cpu_node(0, NULL);
+	if (!cpu0) {
+		pr_err("failed to find cpu0 node\n");
+		return;
+	}
+
+	if (of_find_property(cpu0, "#cooling-cells", NULL)) {
+		cdev = of_cpufreq_cooling_register(cpu0, policy);
+		if (IS_ERR(cdev))
+			pr_err("running cpufreq without cooling device: %ld\n",
+			       PTR_ERR(cdev));
+	}
+
+	pm_qos_add_notifier(PM_QOS_CPU_FREQ_MIN, &cpufreq_min_qos_notifier);
+	pm_qos_add_notifier(PM_QOS_CPU_FREQ_MAX, &cpufreq_max_qos_notifier);
+}
+
+static struct cpufreq_driver nxp_cpufreq_driver = {
+	.flags   = CPUFREQ_STICKY | CPUFREQ_NEED_INITIAL_FREQ_CHECK,
+	.verify  = nxp_cpufreq_verify_speed,
+	.target_index  = nxp_cpufreq_target,
+	.get     = nxp_cpufreq_get_speed,
+	.init    = nxp_cpufreq_init,
+	.ready   = nxp_cpufreq_ready,
+	.name    = "nxp-cpufreq",
+	.attr    = nxp_cpufreq_attr,
+};
+
+#ifdef CONFIG_OF
+static unsigned long dt_dvfs_table[FREQ_TABLE_MAX][2];
+
+struct nxp_cpufreq_plat_data dt_cpufreq_data = {
+	.pll_dev = CONFIG_NEXELL_CPUFREQ_PLLDEV,
+	.dvfs_table = dt_dvfs_table,
+};
+
+static const struct of_device_id dvfs_dt_match[] = {
+	{
+	.compatible = "nexell,s5pxx18-cpufreq",
+	.data = (void *)&dt_cpufreq_data,
+	}, {},
+};
+MODULE_DEVICE_TABLE(of, dvfs_dt_match);
+
+#define	FN_SIZE		4
+static void *nxp_cpufreq_get_dt_data(struct platform_device *pdev)
+{
+	struct device_node *node = pdev->dev.of_node;
+	const struct of_device_id *match;
+	struct nxp_cpufreq_plat_data *pdata;
+	unsigned long (*plat_tbs)[2] = NULL;
+	const __be32 *list;
+	char *supply;
+	int value, i, size = 0;
+
+	match = of_match_node(dvfs_dt_match, node);
+	if (!match)
+		return NULL;
+
+	pdata = (struct nxp_cpufreq_plat_data *)match->data;
+	plat_tbs = (unsigned long(*)[2])pdata->dvfs_table;
+
+	if (!of_property_read_string(node, "supply_name",
+				     (const char **)&supply)) {
+		pdata->supply_name = supply;
+		if (!of_property_read_u32(node, "supply_delay_us", &value))
+			pdata->supply_delay_us = value;
+		pr_info("voltage supply : %s\n", pdata->supply_name);
+	}
+
+	list = of_get_property(node, "dvfs-tables", &size);
+	size /= FN_SIZE;
+
+	if (size) {
+		for (i = 0; size/2 > i; i++) {
+			plat_tbs[i][0] = be32_to_cpu(*list++);
+			plat_tbs[i][1] = be32_to_cpu(*list++);
+			pr_debug("DTS %2d = %8ldkhz, %8ld uV\n",
+				 i, plat_tbs[i][0], plat_tbs[i][1]);
+		}
+		pdata->table_size = size/2;
+	}
+
+	return pdata;
+}
+#else
+#define dvfs_dt_match NULL
+#endif
+
+static void *nxp_cpufreq_make_table(struct platform_device *pdev,
+				    int *table_size,
+				    unsigned long (*dvfs_tables)[2])
+{
+	struct nxp_cpufreq_plat_data *pdata = pdev->dev.platform_data;
+	struct cpufreq_frequency_table *freq_table;
+	struct cpufreq_asv_ops *ops = &asv_ops;
+	unsigned long (*plat_tbs)[2] = NULL;
+	int tb_size, asv_size = 0;
+	int id = 0, n = 0;
+
+	/* user defined dvfs */
+	if (pdata->dvfs_table && pdata->table_size)
+		plat_tbs = (unsigned long(*)[2])pdata->dvfs_table;
+
+	/* asv dvfs tables */
+	if (ops->setup_table)
+		asv_size = ops->setup_table(dvfs_tables);
+
+	if (!pdata->table_size && !asv_size) {
+		dev_err(&pdev->dev, "failed no freq table !!!\n");
+		return NULL;
+	}
+
+	tb_size = (pdata->table_size ? pdata->table_size : asv_size);
+
+	/* alloc with end table */
+	freq_table = kzalloc((sizeof(*freq_table) * (tb_size + 1)), GFP_KERNEL);
+	if (!freq_table) {
+		dev_warn(&pdev->dev, "failed cllocate freq table!!!\n");
+		return NULL;
+	}
+
+	/* make frequency table with platform data */
+	if (asv_size > 0) {
+		for (n = 0, id = 0; tb_size > id && asv_size > n; n++) {
+			if (plat_tbs) {
+				for (n = 0; asv_size > n; n++) {
+					if (plat_tbs[id][0] ==
+					    dvfs_tables[n][0]) {
+						dvfs_tables[id][0] =
+							dvfs_tables[n][0];
+						dvfs_tables[id][1] =
+							dvfs_tables[n][1];
+						break;
+					}
+				}
+			} else {
+				if (dvfs_tables[n][0] > FREQ_MAX_FREQ_KHZ)
+					continue;
+				dvfs_tables[id][0] = dvfs_tables[n][0];
+				dvfs_tables[id][1] = dvfs_tables[n][1];
+			}
+
+			freq_table[id].frequency = dvfs_tables[id][0];
+			pr_info("ASV %2d = %8ldkhz, %8ld uV\n",
+			       id, dvfs_tables[id][0], dvfs_tables[id][1]);
+			/* next */
+			id++;
+		}
+	} else {
+		for (id = 0; tb_size > id; id++) {
+			dvfs_tables[id][0] = plat_tbs[id][0];
+			dvfs_tables[id][1] = plat_tbs[id][1];
+			freq_table[id].frequency = dvfs_tables[id][0];
+			pr_info("DTB %2d = %8ldkhz, %8ld uV\n",
+			       id, dvfs_tables[id][0], dvfs_tables[id][1]);
+		}
+	}
+
+	/* End table */
+	freq_table[id].frequency = CPUFREQ_TABLE_END;
+	*table_size = id;
+
+	return (void *)freq_table;
+}
+
+static int nxp_cpufreq_set_supply(struct platform_device *pdev,
+				  struct cpufreq_dvfs_info *dvfs)
+{
+	struct nxp_cpufreq_plat_data *pdata = pdev->dev.platform_data;
+	static struct notifier_block *pm_notifier;
+
+	/* get voltage regulator */
+	dvfs->volt = regulator_get(&pdev->dev, pdata->supply_name);
+	if (IS_ERR(dvfs->volt)) {
+		dev_err(&pdev->dev, "Cannot get regulator for DVS supply %s\n",
+				pdata->supply_name);
+		return -1;
+	}
+
+	pm_notifier = &dvfs->pm_notifier;
+	pm_notifier->notifier_call = nxp_cpufreq_pm_notify;
+	if (register_pm_notifier(pm_notifier)) {
+		dev_err(&pdev->dev, "Cannot pm notifier %s\n",
+			pdata->supply_name);
+		return -1;
+	}
+
+	/* bootup voltage */
+	nxp_cpufreq_change_voltage(dvfs, dvfs->boot_frequency);
+	dvfs->boot_voltage = regulator_get_voltage(dvfs->volt);
+
+	pr_info("DVFS: regulator %s\n", pdata->supply_name);
+	return 0;
+}
+
+static int nxp_cpufreq_probe(struct platform_device *pdev)
+{
+	struct nxp_cpufreq_plat_data *pdata = pdev->dev.platform_data;
+	unsigned long (*dvfs_tables)[2] =
+		(unsigned long(*)[2])dvfs_freq_voltage;
+	struct cpufreq_dvfs_info *dvfs = NULL;
+	struct cpufreq_frequency_table *freq_table = NULL;
+	int cpu = raw_smp_processor_id();
+	char name[16];
+	int table_size = 0, ret = 0;
+
+	dvfs = kzalloc(sizeof(*dvfs), GFP_KERNEL);
+	if (!dvfs) {
+		dev_err(&pdev->dev, "failed allocate DVFS data !!!\n");
+		return -ENOMEM;
+	}
+
+#ifdef CONFIG_OF
+	if (pdev->dev.of_node) {
+		pdata = nxp_cpufreq_get_dt_data(pdev);
+		if (!pdata)
+			goto err_free_table;
+		pdev->dev.platform_data = pdata;
+	}
+#endif
+
+	freq_table = nxp_cpufreq_make_table(pdev, &table_size, dvfs_tables);
+	if (!freq_table)
+		goto err_free_table;
+
+	sprintf(name, "pll%d", pdata->pll_dev);
+	dvfs->clk = clk_get(NULL, name);
+	if (IS_ERR(dvfs->clk))
+		goto err_free_table;
+
+	set_dvfs_ptr(dvfs);
+	mutex_init(&dvfs->lock);
+
+	dvfs->asv_ops = &asv_ops;
+	dvfs->freq_table = freq_table;
+	dvfs->dvfs_table = (unsigned long(*)[2])(dvfs_tables);
+	dvfs->table_size = table_size;
+	dvfs->supply_delay_us = pdata->supply_delay_us;
+	dvfs->boot_frequency = nxp_cpufreq_get_speed(cpu);
+	dvfs->target_freq = dvfs->boot_frequency;
+	dvfs->pre_freq_point = -1;
+	dvfs->check_state = 0;
+	dvfs->time_stamp = dvfs_timestamp;
+
+	set_bit(FREQ_STATE_RESUME, &dvfs->resume_state);
+	nxp_cpufreq_set_freq_point(dvfs, dvfs->target_freq);
+
+	if (pdata->supply_name) {
+		ret = nxp_cpufreq_set_supply(pdev, dvfs);
+		if (0 > ret)
+			goto err_free_table;
+	}
+
+	pr_info("DVFS: cpu %s with PLL.%d [tables=%d]\n",
+		dvfs->volt?"DVFS":"DFS", pdata->pll_dev, dvfs->table_size);
+
+	ret = cpufreq_register_driver(&nxp_cpufreq_driver);
+	if (ret) {
+		pr_err("Fial registet cpufreq driver!!\n");
+		goto err_free_table;
+	}
+
+	return 0;
+
+err_free_table:
+	if (dvfs)
+		kfree(dvfs);
+
+	if (freq_table)
+		kfree(freq_table);
+
+	return ret;
+}
+
+static struct platform_driver cpufreq_driver = {
+	.probe	= nxp_cpufreq_probe,
+	.driver	= {
+		.name	= DEV_NAME_CPUFREQ,
+		.owner	= THIS_MODULE,
+		.of_match_table	= of_match_ptr(dvfs_dt_match),
+	},
+};
+module_platform_driver(cpufreq_driver);
diff -ENwbur a/drivers/cpufreq/s5p6818-cpufreq.h b/drivers/cpufreq/s5p6818-cpufreq.h
--- a/drivers/cpufreq/s5p6818-cpufreq.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/cpufreq/s5p6818-cpufreq.h	2018-05-06 08:49:49.094692010 +0200
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __S5P6818_ASV_H__
+#define __S5P6818_ASV_H__
+
+#define	VOLTAGE_STEP_UV		(1)
+#define	ASV_DEFAULT_LEVEL	(0)
+
+#define	FREQ_MAX_FREQ_KHZ	(1400*1000)
+#define	FREQ_ARRAY_SIZE		(13)
+#define	UV(v)				(v*1000)
+
+struct asv_tb_info {
+	int ids;
+	int ro;
+	long mhz[FREQ_ARRAY_SIZE];
+	long uv[FREQ_ARRAY_SIZE];
+};
+
+#define	ASB_FREQ_MHZ {	\
+	[0] = 1600,	\
+	[1] = 1500,	\
+	[2] = 1400,	\
+	[3] = 1300,	\
+	[4] = 1200,	\
+	[5] = 1100,	\
+	[6] = 1000,	\
+	[7] =  900,	\
+	[8] =  800,	\
+	[9] =  700,	\
+	[10] =  600,	\
+	[11] =  500,	\
+	[12] =  400,	\
+	}
+
+static struct asv_tb_info asv_tables[] = {
+	[0] = {	.ids = 6, .ro = 90,
+			.mhz = ASB_FREQ_MHZ,
+			.uv  = { UV(1360), UV(1350),	/* OVER FREQ */
+				 UV(1325), UV(1275), UV(1225), UV(1175),
+				 UV(1150), UV(1125), UV(1100), UV(1075),
+				 UV(1050), UV(1025), UV(1000) },
+	},
+	[1] = {	.ids = 15, .ro = 130,
+			.mhz = ASB_FREQ_MHZ,
+			.uv  = { UV(1350), UV(1280),	/* OVER FREQ */
+				 UV(1275), UV(1225), UV(1175), UV(1125),
+				 UV(1100), UV(1075), UV(1050), UV(1025),
+				 UV(1000), UV(1000), UV(1000) },
+	},
+	[2] = {	.ids = 38, .ro = 170,
+			.mhz = ASB_FREQ_MHZ,
+			.uv  = { UV(1270), UV(1240),	/* OVER FREQ */
+				 UV(1225), UV(1175), UV(1125), UV(1075),
+				 UV(1050), UV(1025), UV(1000), UV(1000),
+				 UV(1000), UV(1000), UV(1000) },
+	},
+	[3] = {	.ids = 78, .ro = 200,
+			.mhz = ASB_FREQ_MHZ,
+			.uv  = { UV(1240), UV(1210),	/* OVER FREQ */
+				 UV(1175), UV(1125), UV(1075), UV(1050),
+				 UV(1025), UV(1000), UV(1000), UV(1000),
+				 UV(1000), UV(1000), UV(1000) },
+	},
+	[4] = {	.ids = 78, .ro = 200,
+			.mhz = ASB_FREQ_MHZ,
+			.uv  = { UV(1225), UV(1175),	/* OVER FREQ */
+				 UV(1125), UV(1075), UV(1025), UV(1000),
+				 UV(1000), UV(1000), UV(1000), UV(1000),
+				 UV(1000), UV(1000), UV(1000) },
+	},
+};
+#define	ASV_ARRAY_SIZE	ARRAY_SIZE(asv_tables)
+
+struct asv_param {
+	int level;
+	int ids, ro;
+	int flag, group, shift;
+};
+
+static struct asv_tb_info *p_asv_table;
+static struct asv_param	asv_param = { 0, };
+
+extern int nxp_cpu_id_ecid(u32 ecid[4]);
+
+static inline unsigned int mtol(unsigned int data, int bits)
+{
+	unsigned int result = 0;
+	unsigned int mask = 1;
+	int i = 0;
+
+	for (i = 0; i < bits ; i++) {
+		if (data&(1<<i))
+			result |= mask<<(bits-i-1);
+	}
+	return result;
+}
+
+static int s5p6818_asv_setup_table(unsigned long (*freq_tables)[2])
+{
+	unsigned int ecid[4] = { 0, };
+	int i, ids = 0, ro = 0;
+	int idslv, rolv, asvlv;
+
+	nxp_cpu_id_ecid(ecid);
+
+	/* Use Fusing Flags */
+	if ((ecid[2] & (1<<0))) {
+		int gs = mtol((ecid[2]>>1) & 0x07, 3);
+		int ag = mtol((ecid[2]>>4) & 0x0F, 4);
+
+		asv_param.level = (ag - gs);
+
+		if (asv_param.level < 0)
+			asv_param.level = 0;
+
+		asv_param.flag = 1;
+		asv_param.group = ag;
+		asv_param.shift = gs;
+		p_asv_table = &asv_tables[asv_param.level];
+		pr_info("DVFS: ASV[%d] IDS(%dmA) Ro(%d), Fusing Shift(%d), Group(%d)\n",
+		       asv_param.level+1, p_asv_table->ids, p_asv_table->ro,
+		       gs, ag);
+		goto asv_done;
+	}
+
+	/* Use IDS/Ro */
+	ids = mtol((ecid[1]>>16) & 0xFF, 8);
+	ro  = mtol((ecid[1]>>24) & 0xFF, 8);
+
+	/* find IDS Level */
+	for (i = 0; (ASV_ARRAY_SIZE-1) > i; i++) {
+		p_asv_table = &asv_tables[i];
+		if (p_asv_table->ids >= ids)
+			break;
+	}
+	idslv = ASV_ARRAY_SIZE != i ? i : (ASV_ARRAY_SIZE-1);
+
+	/* find RO Level */
+	for (i = 0; (ASV_ARRAY_SIZE-1) > i; i++) {
+		p_asv_table = &asv_tables[i];
+		if (p_asv_table->ro >= ro)
+			break;
+	}
+	rolv = ASV_ARRAY_SIZE != i ? i : (ASV_ARRAY_SIZE-1);
+
+	/* find Lowest ASV Level */
+	asvlv = idslv > rolv ? rolv : idslv;
+
+	p_asv_table = &asv_tables[asvlv];
+	asv_param.level = asvlv;
+	asv_param.ids = ids;
+	asv_param.ro  = ro;
+	pr_info("DVFS: ASV[%d] IDS %dmA, Ro %3d -> Table [IDS %dmA, Ro %3d]\n",
+	       asv_param.level+1, ids, ro, p_asv_table->ids, p_asv_table->ro);
+
+asv_done:
+	for (i = 0; FREQ_ARRAY_SIZE > i; i++) {
+		freq_tables[i][0] = p_asv_table->mhz[i] * 1000;	/* frequency */
+		freq_tables[i][1] = p_asv_table->uv[i];		/* voltage */
+	}
+
+	return FREQ_ARRAY_SIZE;
+}
+
+static long s5p6818_asv_get_voltage(long freqkhz)
+{
+	long uv = 0;
+	int i = 0;
+
+	if (NULL == p_asv_table)
+		return -EINVAL;
+
+	for (i = 0; FREQ_ARRAY_SIZE > i; i++) {
+		if (freqkhz == (p_asv_table->mhz[i]*1000)) {
+			uv = p_asv_table->uv[i];
+			break;
+		}
+	}
+
+	if (0 == uv) {
+		pr_info("FAIL: %ldkhz is not exist on the ASV TABLEs !!!\n",
+		       freqkhz);
+		return -EINVAL;
+	}
+
+	return uv;
+}
+
+static int s5p6818_asv_modify_vol_table(unsigned long (*freq_tables)[2],
+					int table_size,	long value, bool down,
+					bool percent)
+{
+	long step_vol = VOLTAGE_STEP_UV;
+	long uv, dv, new;
+	int i = 0, n = 0;
+
+	if (NULL == freq_tables ||
+		NULL == p_asv_table || (0 > value))
+		return -EINVAL;
+
+	/* initialzie */
+	for (i = 0; table_size > i; i++) {
+		for (n = 0; FREQ_ARRAY_SIZE > n; n++) {
+			if (freq_tables[i][0] == (p_asv_table->mhz[n]*1000)) {
+				freq_tables[i][1] = p_asv_table->uv[n];
+				break;
+			}
+		}
+	}
+	pr_info("DVFS:%s%ld%s\n", down?"-":"+", value, percent?"%":"mV");
+
+	/* new voltage */
+	for (i = 0; table_size > i; i++) {
+		int al = 0;
+
+		uv = freq_tables[i][1];
+		dv = percent ? ((uv/100) * value) : (value*1000);
+		new = down ? uv - dv : uv + dv;
+
+		if ((new % step_vol)) {
+			new = (new / step_vol) * step_vol;
+
+			al = 1;
+			if (down)
+				new += step_vol;	/* Upper */
+		}
+
+		pr_info("%7ldkhz, %7ld (%s%ld) align %ld (%s) -> %7ld\n",
+			freq_tables[i][0], freq_tables[i][1],
+			down?"-":"+", dv, step_vol, al?"X":"O", new);
+
+		freq_tables[i][1] = new;
+	}
+	return 0;
+}
+
+static long s5p6818_asv_get_vol_margin(long uv, long value, bool down,
+				       bool percent)
+{
+	long step_vol = VOLTAGE_STEP_UV;
+	long dv = percent ? ((uv/100) * value) : (value*1000);
+	long new = down ? uv - dv : uv + dv;
+	int al = 0;
+
+	if (NULL == p_asv_table)
+		return -EINVAL;
+
+	if ((new % step_vol)) {
+		new = (new / step_vol) * step_vol;
+		al = 1;
+		if (down)
+			new += step_vol;	/* Upper */
+	}
+	return new;
+}
+
+static int s5p6818_asv_current_label(char *buf)
+{
+	char *s = buf;
+
+	if (NULL == p_asv_table)
+		return -EINVAL;
+
+	if (s && p_asv_table) {
+		if (!asv_param.flag) {
+			s += sprintf(s, "%d:%dmA,%d\n",
+				     asv_param.level, asv_param.ids,
+				     asv_param.ro);
+		} else {
+			s += sprintf(s, "%d:G%d,S%d\n",
+				     asv_param.level, asv_param.group,
+				     asv_param.shift);
+		}
+	}
+	return (s - buf);
+}
+
+static struct cpufreq_asv_ops asv_ops = {
+	.setup_table = s5p6818_asv_setup_table,
+	.get_voltage = s5p6818_asv_get_voltage,
+	.modify_vol_table = s5p6818_asv_modify_vol_table,
+	.current_label = s5p6818_asv_current_label,
+	.get_vol_margin = s5p6818_asv_get_vol_margin,
+};
+#endif
diff -ENwbur a/drivers/cpuidle/cpuidle-nexell.c b/drivers/cpuidle/cpuidle-nexell.c
--- a/drivers/cpuidle/cpuidle-nexell.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/cpuidle/cpuidle-nexell.c	2018-05-06 08:49:49.094692010 +0200
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/init.h>
+#include <linux/cpuidle.h>
+#include <asm/cpuidle.h>
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <linux/cpu_pm.h>
+
+#include "dt_idle_states.h"
+
+#define NEXELL_MAX_STATES		1
+
+static int nexell_enter_idle(struct cpuidle_device *dev,
+			   struct cpuidle_driver *drv, int index)
+{
+	cpu_do_idle();
+
+	return index;
+}
+
+static struct cpuidle_driver nexell_idle_driver = {
+	.name = "nexell_idle",
+	.owner = THIS_MODULE,
+	.states = {
+		{
+			.enter			= nexell_enter_idle,
+			.exit_latency		= 1,
+			.target_residency	= 1,
+			.name			= "Nexell Idle",
+			.desc			= "Nexell cpu Idle",
+		},
+	},
+	.safe_state_index = 0,
+	.state_count = NEXELL_MAX_STATES,
+};
+
+static const struct of_device_id nexell_idle_state_match[] __initconst = {
+	{ .compatible = "nexell,idle-state",
+	  .data = nexell_enter_idle },
+	{ },
+};
+
+static int __init nexell_idle_init(void)
+{
+	int cpu, ret;
+	struct cpuidle_driver *drv = &nexell_idle_driver;
+	struct cpuidle_device *dev;
+
+	ret = dt_init_idle_driver(drv, nexell_idle_state_match, 1);
+	if (ret <= 0)
+		return ret ? : -ENODEV;
+
+	ret = cpuidle_register_driver(drv);
+	if (ret) {
+		pr_err("Failed to register cpuidle driver\n");
+		return ret;
+	}
+	for_each_possible_cpu(cpu) {
+		dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+		if (!dev) {
+			pr_err("Failed to allocate cpuidle device\n");
+			goto out_fail;
+		}
+		dev->cpu = cpu;
+
+		ret = cpuidle_register_device(dev);
+		if (ret) {
+			pr_err("Failed to register cpuidle device for CPU %d\n"
+			       , cpu);
+			kfree(dev);
+			goto out_fail;
+		}
+	}
+
+	return 0;
+out_fail:
+	while (--cpu >= 0) {
+		dev = per_cpu(cpuidle_devices, cpu);
+		cpuidle_unregister_device(dev);
+		kfree(dev);
+	}
+
+	cpuidle_unregister_driver(drv);
+
+	return ret;
+}
+device_initcall(nexell_idle_init);
diff -ENwbur a/drivers/cpuidle/Kconfig.arm b/drivers/cpuidle/Kconfig.arm
--- a/drivers/cpuidle/Kconfig.arm	2018-05-06 08:47:36.281301578 +0200
+++ b/drivers/cpuidle/Kconfig.arm	2018-05-06 08:49:49.094692010 +0200
@@ -75,3 +75,10 @@
 	depends on ARCH_MVEBU && !ARM64
 	help
 	  Select this to enable cpuidle on Armada 370, 38x and XP processors.
+
+config ARM_NEXELL_CPUIDLE
+	bool "Cpu Idle Driver for the nexell processors"
+	depends on ARCH_S5P4418  || ARCH_S5P6818
+	select DT_IDLE_STATES
+	help
+	  Select this to enable cpuidle for Nexell processors
diff -ENwbur a/drivers/cpuidle/Makefile b/drivers/cpuidle/Makefile
--- a/drivers/cpuidle/Makefile	2018-05-06 08:47:36.281301578 +0200
+++ b/drivers/cpuidle/Makefile	2018-05-06 08:49:49.094692010 +0200
@@ -19,6 +19,7 @@
 obj-$(CONFIG_ARM_U8500_CPUIDLE)         += cpuidle-ux500.o
 obj-$(CONFIG_ARM_AT91_CPUIDLE)          += cpuidle-at91.o
 obj-$(CONFIG_ARM_EXYNOS_CPUIDLE)        += cpuidle-exynos.o
+obj-$(CONFIG_ARM_NEXELL_CPUIDLE)        += cpuidle-nexell.o
 obj-$(CONFIG_ARM_CPUIDLE)		+= cpuidle-arm.o

 ###############################################################################
diff -ENwbur a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig
--- a/drivers/devfreq/Kconfig	2018-05-06 08:47:36.309302715 +0200
+++ b/drivers/devfreq/Kconfig	2018-05-06 08:49:49.122693147 +0200
@@ -113,6 +113,14 @@
           It sets the frequency for the memory controller and reads the usage counts
           from hardware.

+config ARM_S5Pxx18_DEVFREQ
+	tristate "Nexell S5Pxx18 Bus DEVFREQ Driver"
+	depends on ARCH_S5P6818
+	select DEVFREQ_GOV_SIMPLE_ONDEMAND
+	select PM_OPP
+	help
+	  This adds the DEVFREQ driver for Nexell S5Pxx18 Series SoC bus interface.
+
 source "drivers/devfreq/event/Kconfig"

 endif # PM_DEVFREQ
diff -ENwbur a/drivers/devfreq/Makefile b/drivers/devfreq/Makefile
--- a/drivers/devfreq/Makefile	2018-05-06 08:47:36.309302715 +0200
+++ b/drivers/devfreq/Makefile	2018-05-06 08:49:49.122693147 +0200
@@ -11,6 +11,7 @@
 obj-$(CONFIG_ARM_EXYNOS_BUS_DEVFREQ)	+= exynos-bus.o
 obj-$(CONFIG_ARM_RK3399_DMC_DEVFREQ)	+= rk3399_dmc.o
 obj-$(CONFIG_ARM_TEGRA_DEVFREQ)		+= tegra-devfreq.o
+obj-$(CONFIG_ARM_S5Pxx18_DEVFREQ)		+= nx-devfreq.o

 # DEVFREQ Event Drivers
 obj-$(CONFIG_PM_DEVFREQ_EVENT)		+= event/
diff -ENwbur a/drivers/devfreq/nx-devfreq.c b/drivers/devfreq/nx-devfreq.c
--- a/drivers/devfreq/nx-devfreq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/devfreq/nx-devfreq.c	2018-05-06 08:49:49.122693147 +0200
@@ -0,0 +1,592 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Sungwoo, Park <swpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/module.h>
+#include <linux/devfreq.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/pm_opp.h>
+#include <linux/pm_qos.h>
+#include <linux/clk.h>
+#include <linux/atomic.h>
+#include <linux/of.h>
+#include <linux/devfreq.h>
+#include <linux/soc/nexell/cpufreq.h>
+#include <linux/regulator/consumer.h>
+#include <linux/slab.h>
+
+#include "governor.h"
+
+#define KHZ			1000
+
+struct nx_devfreq {
+	struct devfreq *devfreq;
+	struct devfreq_notifier_block nb;
+	int pm_qos_class;
+	struct clk *bclk;
+	atomic_t req_freq;
+	atomic_t cur_freq;
+	u32 pll;
+	char *supply_name;
+	struct regulator *regulator;
+	struct device *dev;
+	unsigned long suspend_freq;
+};
+
+struct bus_opp_table {
+	int index;
+	unsigned long clk;
+};
+
+static struct nx_devfreq *_nx_devfreq;
+
+static struct bus_opp_table bus_opp_table[] = {
+	{0, NX_BUS_CLK_HIGH_KHZ},
+	{1, NX_BUS_CLK_MID_KHZ},
+	{2, NX_BUS_CLK_LOW_KHZ},
+	{0, 0},
+};
+
+struct nx_bus_notifier_data {
+	struct list_head list;
+	struct notifier_block *data;
+};
+
+LIST_HEAD(nx_devfreq_notifier_list);
+DEFINE_MUTEX(nx_devfreq_notifier_list_lock);
+
+int nx_bus_add_notifier(void *data)
+{
+	struct nx_bus_notifier_data *noti_data;
+
+	noti_data = kzalloc(sizeof(struct nx_bus_notifier_data), GFP_KERNEL);
+	if (!noti_data)
+		return -ENOMEM;
+
+	noti_data->data = data;
+
+	mutex_lock(&nx_devfreq_notifier_list_lock);
+	list_add(&noti_data->list, &nx_devfreq_notifier_list);
+	mutex_unlock(&nx_devfreq_notifier_list_lock);
+
+	return  0;
+}
+
+void nx_bus_remove_notifier(void *data)
+{
+	struct nx_bus_notifier_data *noti_data;
+	bool found = false;
+
+	mutex_lock(&nx_devfreq_notifier_list_lock);
+	list_for_each_entry(noti_data, &nx_devfreq_notifier_list, list) {
+		if (noti_data->data == data) {
+			found = true;
+			break;
+		}
+	}
+	if (found) {
+		list_del_init(&noti_data->list);
+		kfree(noti_data);
+	}
+	mutex_unlock(&nx_devfreq_notifier_list_lock);
+}
+
+static int register_all_pm_qos_notifiers(int pm_qos_class)
+{
+	int ret = 0;
+	struct nx_bus_notifier_data *noti_data;
+
+	mutex_lock(&nx_devfreq_notifier_list_lock);
+	list_for_each_entry(noti_data, &nx_devfreq_notifier_list, list) {
+		ret = pm_qos_add_notifier(pm_qos_class,
+					  noti_data->data);
+		if (ret)
+			break;
+	}
+	mutex_unlock(&nx_devfreq_notifier_list_lock);
+
+	return ret;
+}
+
+static struct pm_qos_request nx_bus_qos;
+
+/* interface function for update qos */
+void nx_bus_qos_update(int val)
+{
+	pm_qos_update_request(&nx_bus_qos, val);
+}
+EXPORT_SYMBOL(nx_bus_qos_update);
+
+/* soc specific */
+struct pll_pms {
+	unsigned long rate;
+	unsigned long voltage;
+	u32 P;
+	u32 M;
+	u32 S;
+};
+
+#if defined(CONFIG_ARCH_S5P6818)
+static struct pll_pms pll0_1_pms[] = {
+	[0] = { .rate =  NX_BUS_CLK_HIGH_KHZ, .voltage = 1200000, .P = 3, .M = 200, .S = 1, },
+	[1] = { .rate =  NX_BUS_CLK_MID_KHZ,  .voltage = 1000000, .P = 3, .M = 300, .S = 3, },
+	[2] = { .rate =  NX_BUS_CLK_LOW_KHZ,  .voltage = 1000000, .P = 3, .M = 200, .S = 3, },
+};
+
+static struct pll_pms pll2_3_pms[] = {
+	[0] = { .rate =  NX_BUS_CLK_HIGH_KHZ, .voltage = 1200000, .P = 3, .M = 200, .S = 2, },
+	[1] = { .rate =  NX_BUS_CLK_MID_KHZ,  .voltage = 1000000, .P = 3, .M = 200, .S = 3, },
+	[2] = { .rate =  NX_BUS_CLK_LOW_KHZ,  .voltage = 1000000, .P = 3, .M = 250, .S = 4, },
+};
+#elif defined(CONFIG_ARCH_S5P4418)
+static struct pll_pms pll0_1_pms[] = {
+	[0] = { .rate =  NX_BUS_CLK_HIGH_KHZ, .voltage = 1100000, .P = 3, .M = 200, .S = 1, },
+	[1] = { .rate =  NX_BUS_CLK_MID_KHZ,  .voltage = 1000000, .P = 2, .M = 200, .S = 3, },
+	[2] = { .rate =  NX_BUS_CLK_LOW_KHZ,  .voltage = 1000000, .P = 3, .M = 200, .S = 3, },
+};
+
+static struct pll_pms pll2_3_pms[] = {
+	[0] = { .rate =  NX_BUS_CLK_HIGH_KHZ, .voltage = 1100000, .P = 3, .M = 200, .S = 1, },
+	[1] = { .rate =  NX_BUS_CLK_MID_KHZ,  .voltage = 1000000, .P = 3, .M = 150, .S = 2, },
+	[2] = { .rate =  NX_BUS_CLK_LOW_KHZ,  .voltage = 1000000, .P = 3, .M = 200, .S = 3, },
+};
+#endif
+
+static int get_pll_data(u32 pll, unsigned long rate, u32 *pll_data,
+			unsigned long *voltage)
+{
+	struct pll_pms *p = NULL;
+	int len;
+	int i;
+	unsigned long freq = 0;
+
+	switch (pll) {
+	case 0:
+	case 1:
+		p = &pll0_1_pms[0];
+		len = ARRAY_SIZE(pll0_1_pms);
+		break;
+	case 2:
+	case 3:
+		p = &pll2_3_pms[0];
+		len = ARRAY_SIZE(pll2_3_pms);
+		break;
+	}
+
+	for (i = 0; i < len; i++) {
+		freq = p->rate;
+		if (freq == rate)
+			break;
+		p++;
+	}
+
+	if (freq) {
+		*pll_data = (p->P << 24) | (p->M << 8) | (p->S << 2) | pll;
+		*voltage = p->voltage;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+/* profile */
+static int nx_devfreq_target(struct device *dev, unsigned long *freq, u32 flags)
+{
+	int err;
+	u32 pll_data;
+	struct nx_devfreq *nx_devfreq = dev_get_drvdata(dev);
+	struct dev_pm_opp *opp;
+	unsigned long rate = *freq * KHZ;
+	unsigned long voltage;
+	bool is_up = false;
+
+	rcu_read_lock();
+	opp = devfreq_recommended_opp(dev, freq, flags);
+	if (IS_ERR(opp)) {
+		rcu_read_unlock();
+		dev_err(dev, "failed to find opp for %lu KHz\n", *freq);
+		return PTR_ERR(opp);
+	}
+	rate = dev_pm_opp_get_freq(opp);
+	rcu_read_unlock();
+
+	dev_dbg(dev, "freq: %lu KHz, rate: %lu\n", *freq, rate);
+
+	if (atomic_read(&nx_devfreq->cur_freq) == *freq)
+		return 0;
+
+	if (atomic_read(&nx_devfreq->cur_freq) < *freq)
+		is_up = true;
+
+	err = get_pll_data(nx_devfreq->pll, *freq, &pll_data, &voltage);
+	if (err) {
+		dev_err(dev, "failed to get pll data of freq %lu KHz\n", *freq);
+		return err;
+	}
+
+	if (is_up)
+		regulator_set_voltage(nx_devfreq->regulator, voltage, voltage);
+
+	err = nx_change_bus_freq(pll_data);
+	if (err) {
+		dev_err(dev, "failed to change bus clock for %lu KHz\n", *freq);
+		return err;
+	}
+
+	if (!is_up)
+		regulator_set_voltage(nx_devfreq->regulator, voltage, voltage);
+
+	atomic_set(&nx_devfreq->cur_freq, *freq);
+	return 0;
+}
+
+static int nx_devfreq_get_cur_freq(struct device *dev, unsigned long *freq)
+{
+	struct nx_devfreq *nx_devfreq = dev_get_drvdata(dev);
+
+	*freq = atomic_read(&nx_devfreq->cur_freq);
+	return 0;
+}
+
+static int nx_devfreq_get_dev_status(struct device *dev,
+				     struct devfreq_dev_status *stat)
+{
+	struct nx_devfreq *nx_devfreq = dev_get_drvdata(dev);
+
+	stat->current_frequency = atomic_read(&nx_devfreq->cur_freq);
+	stat->private_data = nx_devfreq;
+
+	return 0;
+}
+
+static struct devfreq_dev_profile nx_devfreq_profile = {
+	.target = nx_devfreq_target,
+	.get_dev_status = nx_devfreq_get_dev_status,
+	.get_cur_freq = nx_devfreq_get_cur_freq,
+};
+
+/* notifier */
+static int nx_devfreq_pm_qos_notifier(struct notifier_block *nb,
+				      unsigned long val,
+				      void *v)
+{
+	struct devfreq_notifier_block *devfreq_nb;
+	struct nx_devfreq *nx_devfreq;
+	u32 cur_freq, new;
+	bool changed = false;
+
+	devfreq_nb = container_of(nb, struct devfreq_notifier_block, nb);
+	nx_devfreq = devfreq_nb->df->data;
+
+	dev_dbg(nx_devfreq->dev, "%s: val --> %ld\n", __func__, val);
+	if (val == PM_QOS_DEFAULT_VALUE)
+		val = nx_devfreq_profile.initial_freq;
+
+	cur_freq = atomic_read(&nx_devfreq->cur_freq);
+
+	new = val;
+	new = max((unsigned int)pm_qos_request(PM_QOS_BUS_THROUGHPUT), new);
+	if (new != cur_freq)
+		changed = true;
+
+	if (changed) {
+		dev_dbg(nx_devfreq->dev, "%s changed from %d to %d\n",
+			 __func__, cur_freq, new);
+		atomic_set(&nx_devfreq->req_freq, new);
+		mutex_lock(&devfreq_nb->df->lock);
+		update_devfreq(devfreq_nb->df);
+		mutex_unlock(&devfreq_nb->df->lock);
+		return NOTIFY_OK;
+	}
+
+	return NOTIFY_STOP;
+}
+
+static int nx_devfreq_register_notifier(struct devfreq *devfreq)
+{
+	struct nx_devfreq *nx_devfreq;
+	int ret;
+
+	nx_devfreq = devfreq->data;
+
+	dev_dbg(nx_devfreq->dev, "%s: E\n", __func__);
+	nx_devfreq->nb.df = devfreq;
+	nx_devfreq->nb.nb.notifier_call = nx_devfreq_pm_qos_notifier;
+
+	ret = pm_qos_add_notifier(nx_devfreq->pm_qos_class,
+				  &nx_devfreq->nb.nb);
+	if (ret) {
+		dev_err(nx_devfreq->dev, "failed to add notifier\n");
+		return ret;
+	}
+
+	return register_all_pm_qos_notifiers(nx_devfreq->pm_qos_class);
+}
+
+static int nx_devfreq_unregister_notifier(struct devfreq *devfreq)
+{
+	struct nx_devfreq *nx_devfreq = devfreq->data;
+
+	dev_info(nx_devfreq->dev, "%s: E\n", __func__);
+	return pm_qos_remove_notifier(nx_devfreq->pm_qos_class,
+				      &nx_devfreq->nb.nb);
+}
+
+/* governor */
+static int nx_governor_get_target(struct devfreq *devfreq, unsigned long *freq)
+{
+	struct devfreq_dev_status stat;
+	struct nx_devfreq *nx_devfreq;
+	int err;
+
+	err = devfreq->profile->get_dev_status(devfreq->dev.parent, &stat);
+	if (err)
+		return err;
+
+	nx_devfreq = stat.private_data;
+	*freq = atomic_read(&nx_devfreq->req_freq);
+
+	if (*freq == atomic_read(&nx_devfreq->cur_freq)) {
+		if (devfreq->min_freq && *freq != devfreq->min_freq)
+			*freq = devfreq->min_freq;
+		else if (devfreq->max_freq && *freq != devfreq->max_freq)
+			*freq = devfreq->max_freq;
+	}
+
+	return 0;
+}
+
+static void governor_suspend(struct devfreq *devfreq)
+{
+	struct nx_devfreq *nx_devfreq = devfreq->data;
+	unsigned long freq;
+
+	nx_devfreq->suspend_freq = 0;
+	if (atomic_read(&nx_devfreq->cur_freq) != NX_BUS_CLK_HIGH_KHZ) {
+		freq = NX_BUS_CLK_HIGH_KHZ;
+		nx_devfreq->suspend_freq = atomic_read(&nx_devfreq->cur_freq);
+		nx_devfreq_target(devfreq->dev.parent, &freq, 0);
+	}
+}
+
+static void governor_resume(struct devfreq *devfreq)
+{
+	struct nx_devfreq *nx_devfreq = devfreq->data;
+	unsigned long freq;
+
+	if (nx_devfreq->suspend_freq != 0) {
+		freq = nx_devfreq->suspend_freq;
+		nx_devfreq_target(devfreq->dev.parent, &freq, 0);
+	}
+}
+
+static int nx_governor_event_handler(struct devfreq *devfreq,
+				     unsigned int event, void *data)
+{
+	int ret;
+
+	switch (event) {
+	case DEVFREQ_GOV_START:
+		ret = nx_devfreq_register_notifier(devfreq);
+		if (ret)
+			return ret;
+		devfreq_monitor_start(devfreq);
+		break;
+
+	case DEVFREQ_GOV_STOP:
+		devfreq_monitor_stop(devfreq);
+		ret = nx_devfreq_unregister_notifier(devfreq);
+		if (ret)
+			return ret;
+		break;
+
+	case DEVFREQ_GOV_SUSPEND:
+		governor_suspend(devfreq);
+		devfreq_monitor_suspend(devfreq);
+		break;
+
+	case DEVFREQ_GOV_RESUME:
+		governor_resume(devfreq);
+		devfreq_monitor_resume(devfreq);
+		break;
+	}
+
+	return 0;
+}
+
+static struct devfreq_governor nx_devfreq_governor = {
+	.name = "nx_devfreq_gov",
+	.get_target_freq = nx_governor_get_target,
+	.event_handler = nx_governor_event_handler,
+};
+
+/* util function */
+static int nx_devfreq_parse_dt(struct device *dev,
+			       struct nx_devfreq *nx_devfreq)
+{
+	struct device_node *np = dev->of_node;
+
+	if (of_property_read_u32(np, "pll", &nx_devfreq->pll)) {
+		dev_err(dev, "failed to get dt pll number\n");
+		return -EINVAL;
+	}
+
+	if (of_property_read_string(np, "supply_name",
+				    (const char **)&nx_devfreq->supply_name)) {
+		dev_err(dev, "failed to get dt supply name\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* platform driver interface */
+static int nx_devfreq_probe(struct platform_device *pdev)
+{
+	struct nx_devfreq *nx_devfreq;
+	struct bus_opp_table *entry;
+
+	nx_devfreq = devm_kzalloc(&pdev->dev, sizeof(*nx_devfreq), GFP_KERNEL);
+	if (!nx_devfreq)
+		return -ENOMEM;
+
+	if (nx_devfreq_parse_dt(&pdev->dev, nx_devfreq))
+		return -EINVAL;
+
+	nx_devfreq->regulator = regulator_get(&pdev->dev,
+					      nx_devfreq->supply_name);
+	if (IS_ERR(nx_devfreq->regulator)) {
+		dev_err(&pdev->dev, "failed to regulator_get for supply %s\n",
+			nx_devfreq->supply_name);
+		return PTR_ERR(nx_devfreq->regulator);
+	}
+
+	nx_devfreq->bclk = devm_clk_get(&pdev->dev, "bclk");
+	if (IS_ERR(nx_devfreq->bclk)) {
+		dev_err(&pdev->dev, "failed to get bus clock\n");
+		return PTR_ERR(nx_devfreq->bclk);
+	}
+
+	atomic_set(&nx_devfreq->cur_freq, clk_get_rate(nx_devfreq->bclk) / KHZ);
+	dev_info(&pdev->dev, "Current bus clock rate: %dKHz\n",
+		 atomic_read(&nx_devfreq->cur_freq));
+
+	entry = &bus_opp_table[0];
+	while (entry->clk != 0) {
+		dev_pm_opp_add(&pdev->dev, entry->clk, 0);
+		entry++;
+	}
+
+	nx_devfreq->pm_qos_class = PM_QOS_BUS_THROUGHPUT;
+	nx_devfreq_profile.initial_freq = NX_BUS_CLK_LOW_KHZ;
+	nx_devfreq->devfreq = devm_devfreq_add_device(&pdev->dev,
+						      &nx_devfreq_profile,
+						      "nx_devfreq_gov",
+						      nx_devfreq);
+
+	platform_set_drvdata(pdev, nx_devfreq);
+	nx_devfreq->dev = &pdev->dev;
+	_nx_devfreq = nx_devfreq;
+
+	pm_qos_add_request(&nx_bus_qos, PM_QOS_BUS_THROUGHPUT,
+			   nx_devfreq_profile.initial_freq);
+	pm_qos_update_request_timeout(&nx_bus_qos, NX_BUS_CLK_HIGH_KHZ,
+				      60 * 1000 * 1000);
+
+	return 0;
+}
+
+static int nx_devfreq_remove(struct platform_device *pdev)
+{
+	return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int nx_devfreq_pm_prepare(struct device *dev)
+{
+	struct nx_devfreq *nx_devfreq = dev_get_drvdata(dev);
+	struct devfreq *devfreq = nx_devfreq->devfreq;
+
+	return devfreq_suspend_device(devfreq);
+}
+
+static void nx_devfreq_pm_complete(struct device *dev)
+{
+	struct nx_devfreq *nx_devfreq = dev_get_drvdata(dev);
+	struct devfreq *devfreq = nx_devfreq->devfreq;
+
+	devfreq_resume_device(devfreq);
+}
+
+static const struct dev_pm_ops nx_devfreq_pm_ops = {
+	.prepare = nx_devfreq_pm_prepare,
+	.complete = nx_devfreq_pm_complete,
+};
+#endif
+
+static const struct of_device_id nx_devfreq_of_match[] = {
+	{ .compatible = "nexell,s5pxx18-devfreq" },
+	{ },
+};
+
+MODULE_DEVICE_TABLE(of, nx_devfreq_of_match);
+
+static struct platform_driver nx_devfreq_driver = {
+	.probe = nx_devfreq_probe,
+	.remove = nx_devfreq_remove,
+	.driver = {
+		.name = "nx-devfreq",
+		.of_match_table = nx_devfreq_of_match,
+#ifdef CONFIG_PM_SLEEP
+		.pm = &nx_devfreq_pm_ops,
+#endif
+	},
+};
+
+static int __init nx_devfreq_init(void)
+{
+	int ret;
+
+	ret = devfreq_add_governor(&nx_devfreq_governor);
+	if (ret) {
+		pr_err("%s: failed to add governor: %d\n", __func__, ret);
+		return ret;
+	}
+
+	ret = platform_driver_register(&nx_devfreq_driver);
+	if (ret)
+		devfreq_remove_governor(&nx_devfreq_governor);
+
+	return ret;
+}
+module_init(nx_devfreq_init);
+
+static void __exit nx_devfreq_exit(void)
+{
+	int ret;
+
+	platform_driver_unregister(&nx_devfreq_driver);
+
+	ret = devfreq_remove_governor(&nx_devfreq_governor);
+	if (ret)
+		pr_err("%s: failed to remove governor: %d\n", __func__, ret);
+}
+module_exit(nx_devfreq_exit);
+
+MODULE_AUTHOR("SungwooPark <swpark@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell S5Pxx18 series SoC devfreq driver");
+MODULE_LICENSE("GPL v2");
diff -ENwbur a/drivers/gpu/arm/Kbuild b/drivers/gpu/arm/Kbuild
--- a/drivers/gpu/arm/Kbuild	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/Kbuild	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,13 @@
+#
+# (C) COPYRIGHT 2012 ARM Limited. All rights reserved.
+#
+# This program is free software and is provided to you under the terms of the GNU General Public License version 2
+# as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+#
+# A copy of the licence is included with the program, and can also be obtained from Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+#
+
+
+obj-$(CONFIG_MALI400) += mali400/
diff -ENwbur a/drivers/gpu/arm/Kconfig b/drivers/gpu/arm/Kconfig
--- a/drivers/gpu/arm/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/Kconfig	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,15 @@
+#
+# (C) COPYRIGHT 2012 ARM Limited. All rights reserved.
+#
+# This program is free software and is provided to you under the terms of the GNU General Public License version 2
+# as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+#
+# A copy of the licence is included with the program, and can also be obtained from Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+#
+
+
+menu "ARM GPU Configuration"
+source "drivers/gpu/arm/mali400/Kconfig"
+endmenu
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_broadcast.c b/drivers/gpu/arm/mali400/common/mali_broadcast.c
--- a/drivers/gpu/arm/mali400/common/mali_broadcast.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_broadcast.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_broadcast.h"
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+
+#define MALI_BROADCAST_REGISTER_SIZE      0x1000
+#define MALI_BROADCAST_REG_BROADCAST_MASK    0x0
+#define MALI_BROADCAST_REG_INTERRUPT_MASK    0x4
+
+struct mali_bcast_unit {
+	struct mali_hw_core hw_core;
+	u32 current_mask;
+};
+
+struct mali_bcast_unit *mali_bcast_unit_create(const _mali_osk_resource_t *resource)
+{
+	struct mali_bcast_unit *bcast_unit = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(resource);
+	MALI_DEBUG_PRINT(2, ("Broadcast: Creating Mali Broadcast unit: %s\n",
+			     resource->description));
+
+	bcast_unit = _mali_osk_malloc(sizeof(struct mali_bcast_unit));
+	if (NULL == bcast_unit) {
+		MALI_PRINT_ERROR(("Broadcast: Failed to allocate memory for Broadcast unit\n"));
+		return NULL;
+	}
+
+	if (_MALI_OSK_ERR_OK == mali_hw_core_create(&bcast_unit->hw_core,
+			resource, MALI_BROADCAST_REGISTER_SIZE)) {
+		bcast_unit->current_mask = 0;
+		mali_bcast_reset(bcast_unit);
+
+		return bcast_unit;
+	} else {
+		MALI_PRINT_ERROR(("Broadcast: Failed map broadcast unit\n"));
+	}
+
+	_mali_osk_free(bcast_unit);
+
+	return NULL;
+}
+
+void mali_bcast_unit_delete(struct mali_bcast_unit *bcast_unit)
+{
+	MALI_DEBUG_ASSERT_POINTER(bcast_unit);
+	mali_hw_core_delete(&bcast_unit->hw_core);
+	_mali_osk_free(bcast_unit);
+}
+
+/* Call this function to add the @group's id into bcast mask
+ * Note: redundant calling this function with same @group
+ * doesn't make any difference as calling it once
+ */
+void mali_bcast_add_group(struct mali_bcast_unit *bcast_unit,
+			  struct mali_group *group)
+{
+	u32 bcast_id;
+	u32 broadcast_mask;
+
+	MALI_DEBUG_ASSERT_POINTER(bcast_unit);
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	bcast_id = mali_pp_core_get_bcast_id(mali_group_get_pp_core(group));
+
+	broadcast_mask = bcast_unit->current_mask;
+
+	broadcast_mask |= (bcast_id); /* add PP core to broadcast */
+	broadcast_mask |= (bcast_id << 16); /* add MMU to broadcast */
+
+	/* store mask so we can restore on reset */
+	bcast_unit->current_mask = broadcast_mask;
+}
+
+/* Call this function to remove @group's id from bcast mask
+ * Note: redundant calling this function with same @group
+ * doesn't make any difference as calling it once
+ */
+void mali_bcast_remove_group(struct mali_bcast_unit *bcast_unit,
+			     struct mali_group *group)
+{
+	u32 bcast_id;
+	u32 broadcast_mask;
+
+	MALI_DEBUG_ASSERT_POINTER(bcast_unit);
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	bcast_id = mali_pp_core_get_bcast_id(mali_group_get_pp_core(group));
+
+	broadcast_mask = bcast_unit->current_mask;
+
+	broadcast_mask &= ~((bcast_id << 16) | bcast_id);
+
+	/* store mask so we can restore on reset */
+	bcast_unit->current_mask = broadcast_mask;
+}
+
+void mali_bcast_reset(struct mali_bcast_unit *bcast_unit)
+{
+	MALI_DEBUG_ASSERT_POINTER(bcast_unit);
+
+	MALI_DEBUG_PRINT(4,
+			 ("Broadcast: setting mask 0x%08X + 0x%08X (reset)\n",
+			  bcast_unit->current_mask,
+			  bcast_unit->current_mask & 0xFF));
+
+	/* set broadcast mask */
+	mali_hw_core_register_write(&bcast_unit->hw_core,
+				    MALI_BROADCAST_REG_BROADCAST_MASK,
+				    bcast_unit->current_mask);
+
+	/* set IRQ override mask */
+	mali_hw_core_register_write(&bcast_unit->hw_core,
+				    MALI_BROADCAST_REG_INTERRUPT_MASK,
+				    bcast_unit->current_mask & 0xFF);
+}
+
+void mali_bcast_disable(struct mali_bcast_unit *bcast_unit)
+{
+	MALI_DEBUG_ASSERT_POINTER(bcast_unit);
+
+	MALI_DEBUG_PRINT(4, ("Broadcast: setting mask 0x0 + 0x0 (disable)\n"));
+
+	/* set broadcast mask */
+	mali_hw_core_register_write(&bcast_unit->hw_core,
+				    MALI_BROADCAST_REG_BROADCAST_MASK,
+				    0x0);
+
+	/* set IRQ override mask */
+	mali_hw_core_register_write(&bcast_unit->hw_core,
+				    MALI_BROADCAST_REG_INTERRUPT_MASK,
+				    0x0);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_broadcast.h b/drivers/gpu/arm/mali400/common/mali_broadcast.h
--- a/drivers/gpu/arm/mali400/common/mali_broadcast.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_broadcast.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_BROADCAST_H__
+#define __MALI_BROADCAST_H__
+
+/*
+ *  Interface for the broadcast unit on Mali-450.
+ *
+ * - Represents up to 8 Ã— (MMU + PP) pairs.
+ * - Supports dynamically changing which (MMU + PP) pairs receive the broadcast by
+ *   setting a mask.
+ */
+
+#include "mali_hw_core.h"
+#include "mali_group.h"
+
+struct mali_bcast_unit;
+
+struct mali_bcast_unit *mali_bcast_unit_create(const _mali_osk_resource_t *resource);
+void mali_bcast_unit_delete(struct mali_bcast_unit *bcast_unit);
+
+/* Add a group to the list of (MMU + PP) pairs broadcasts go out to. */
+void mali_bcast_add_group(struct mali_bcast_unit *bcast_unit, struct mali_group *group);
+
+/* Remove a group to the list of (MMU + PP) pairs broadcasts go out to. */
+void mali_bcast_remove_group(struct mali_bcast_unit *bcast_unit, struct mali_group *group);
+
+/* Re-set cached mask. This needs to be called after having been suspended. */
+void mali_bcast_reset(struct mali_bcast_unit *bcast_unit);
+
+/**
+ * Disable broadcast unit
+ *
+ * mali_bcast_enable must be called to re-enable the unit. Cores may not be
+ * added or removed when the unit is disabled.
+ */
+void mali_bcast_disable(struct mali_bcast_unit *bcast_unit);
+
+/**
+ * Re-enable broadcast unit
+ *
+ * This resets the masks to include the cores present when mali_bcast_disable was called.
+ */
+MALI_STATIC_INLINE void mali_bcast_enable(struct mali_bcast_unit *bcast_unit)
+{
+	mali_bcast_reset(bcast_unit);
+}
+
+#endif /* __MALI_BROADCAST_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_control_timer.c b/drivers/gpu/arm/mali400/common/mali_control_timer.c
--- a/drivers/gpu/arm/mali400/common/mali_control_timer.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_control_timer.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2010-2012, 2014-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_utilization.h"
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_dvfs_policy.h"
+#include "mali_control_timer.h"
+
+static u64 period_start_time = 0;
+
+static _mali_osk_timer_t *mali_control_timer = NULL;
+static mali_bool timer_running = MALI_FALSE;
+
+static u32 mali_control_timeout = 1000;
+
+void mali_control_timer_add(u32 timeout)
+{
+	_mali_osk_timer_add(mali_control_timer, _mali_osk_time_mstoticks(timeout));
+}
+
+static void mali_control_timer_callback(void *arg)
+{
+	if (mali_utilization_enabled()) {
+		struct mali_gpu_utilization_data *util_data = NULL;
+		u64 time_period = 0;
+		mali_bool need_add_timer = MALI_TRUE;
+
+		/* Calculate gpu utilization */
+		util_data = mali_utilization_calculate(&period_start_time, &time_period, &need_add_timer);
+
+		if (util_data) {
+#if defined(CONFIG_MALI_DVFS)
+			mali_dvfs_policy_realize(util_data, time_period);
+#else
+			mali_utilization_platform_realize(util_data);
+#endif
+
+			if (MALI_TRUE == need_add_timer) {
+				mali_control_timer_add(mali_control_timeout);
+			}
+		}
+	}
+}
+
+/* Init a timer (for now it is used for GPU utilization and dvfs) */
+_mali_osk_errcode_t mali_control_timer_init(void)
+{
+	_mali_osk_device_data data;
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+		/* Use device specific settings (if defined) */
+		if (0 != data.control_interval) {
+			mali_control_timeout = data.control_interval;
+			MALI_DEBUG_PRINT(2, ("Mali GPU Timer: %u\n", mali_control_timeout));
+		}
+	}
+
+	mali_control_timer = _mali_osk_timer_init();
+	if (NULL == mali_control_timer) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+	_mali_osk_timer_setcallback(mali_control_timer, mali_control_timer_callback, NULL);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_control_timer_term(void)
+{
+	if (NULL != mali_control_timer) {
+		_mali_osk_timer_del(mali_control_timer);
+		timer_running = MALI_FALSE;
+		_mali_osk_timer_term(mali_control_timer);
+		mali_control_timer = NULL;
+	}
+}
+
+mali_bool mali_control_timer_resume(u64 time_now)
+{
+	mali_utilization_data_assert_locked();
+
+	if (timer_running != MALI_TRUE) {
+		timer_running = MALI_TRUE;
+
+		period_start_time = time_now;
+
+		mali_utilization_reset();
+
+		return MALI_TRUE;
+	}
+
+	return MALI_FALSE;
+}
+
+void mali_control_timer_pause(void)
+{
+	mali_utilization_data_assert_locked();
+	if (timer_running == MALI_TRUE) {
+		timer_running = MALI_FALSE;
+	}
+}
+
+void mali_control_timer_suspend(mali_bool suspend)
+{
+	mali_utilization_data_lock();
+
+	if (timer_running == MALI_TRUE) {
+		timer_running = MALI_FALSE;
+
+		mali_utilization_data_unlock();
+
+		if (suspend == MALI_TRUE) {
+			_mali_osk_timer_del(mali_control_timer);
+			mali_utilization_reset();
+		}
+	} else {
+		mali_utilization_data_unlock();
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_control_timer.h b/drivers/gpu/arm/mali400/common/mali_control_timer.h
--- a/drivers/gpu/arm/mali400/common/mali_control_timer.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_control_timer.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2010-2012, 2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_CONTROL_TIMER_H__
+#define __MALI_CONTROL_TIMER_H__
+
+#include "mali_osk.h"
+
+_mali_osk_errcode_t mali_control_timer_init(void);
+
+void mali_control_timer_term(void);
+
+mali_bool mali_control_timer_resume(u64 time_now);
+
+void mali_control_timer_suspend(mali_bool suspend);
+void mali_control_timer_pause(void);
+
+void mali_control_timer_add(u32 timeout);
+
+#endif /* __MALI_CONTROL_TIMER_H__ */
+
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_dlbu.c b/drivers/gpu/arm/mali400/common/mali_dlbu.c
--- a/drivers/gpu/arm/mali400/common/mali_dlbu.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_dlbu.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,213 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_dlbu.h"
+#include "mali_memory.h"
+#include "mali_pp.h"
+#include "mali_group.h"
+#include "mali_osk.h"
+#include "mali_hw_core.h"
+
+/**
+ * Size of DLBU registers in bytes
+ */
+#define MALI_DLBU_SIZE 0x400
+
+mali_dma_addr mali_dlbu_phys_addr = 0;
+static mali_io_address mali_dlbu_cpu_addr = NULL;
+
+/**
+ * DLBU register numbers
+ * Used in the register read/write routines.
+ * See the hardware documentation for more information about each register
+ */
+typedef enum mali_dlbu_register {
+	MALI_DLBU_REGISTER_MASTER_TLLIST_PHYS_ADDR = 0x0000, /**< Master tile list physical base address;
+                                                             31:12 Physical address to the page used for the DLBU
+                                                             0 DLBU enable - set this bit to 1 enables the AXI bus
+                                                             between PPs and L2s, setting to 0 disables the router and
+                                                             no further transactions are sent to DLBU */
+	MALI_DLBU_REGISTER_MASTER_TLLIST_VADDR     = 0x0004, /**< Master tile list virtual base address;
+                                                             31:12 Virtual address to the page used for the DLBU */
+	MALI_DLBU_REGISTER_TLLIST_VBASEADDR     = 0x0008, /**< Tile list virtual base address;
+                                                             31:12 Virtual address to the tile list. This address is used when
+                                                             calculating the call address sent to PP.*/
+	MALI_DLBU_REGISTER_FB_DIM                 = 0x000C, /**< Framebuffer dimension;
+                                                             23:16 Number of tiles in Y direction-1
+                                                             7:0 Number of tiles in X direction-1 */
+	MALI_DLBU_REGISTER_TLLIST_CONF       = 0x0010, /**< Tile list configuration;
+                                                             29:28 select the size of each allocated block: 0=128 bytes, 1=256, 2=512, 3=1024
+                                                             21:16 2^n number of tiles to be binned to one tile list in Y direction
+                                                             5:0 2^n number of tiles to be binned to one tile list in X direction */
+	MALI_DLBU_REGISTER_START_TILE_POS         = 0x0014, /**< Start tile positions;
+                                                             31:24 start position in Y direction for group 1
+                                                             23:16 start position in X direction for group 1
+                                                             15:8 start position in Y direction for group 0
+                                                             7:0 start position in X direction for group 0 */
+	MALI_DLBU_REGISTER_PP_ENABLE_MASK         = 0x0018, /**< PP enable mask;
+                                                             7 enable PP7 for load balancing
+                                                             6 enable PP6 for load balancing
+                                                             5 enable PP5 for load balancing
+                                                             4 enable PP4 for load balancing
+                                                             3 enable PP3 for load balancing
+                                                             2 enable PP2 for load balancing
+                                                             1 enable PP1 for load balancing
+                                                             0 enable PP0 for load balancing */
+} mali_dlbu_register;
+
+typedef enum {
+	PP0ENABLE = 0,
+	PP1ENABLE,
+	PP2ENABLE,
+	PP3ENABLE,
+	PP4ENABLE,
+	PP5ENABLE,
+	PP6ENABLE,
+	PP7ENABLE
+} mali_dlbu_pp_enable;
+
+struct mali_dlbu_core {
+	struct mali_hw_core     hw_core;           /**< Common for all HW cores */
+	u32                     pp_cores_mask;     /**< This is a mask for the PP cores whose operation will be controlled by LBU
+                                                      see MALI_DLBU_REGISTER_PP_ENABLE_MASK register */
+};
+
+_mali_osk_errcode_t mali_dlbu_initialize(void)
+{
+	MALI_DEBUG_PRINT(2, ("Mali DLBU: Initializing\n"));
+
+	if (_MALI_OSK_ERR_OK ==
+	    mali_mmu_get_table_page(&mali_dlbu_phys_addr,
+				    &mali_dlbu_cpu_addr)) {
+		return _MALI_OSK_ERR_OK;
+	}
+
+	return _MALI_OSK_ERR_FAULT;
+}
+
+void mali_dlbu_terminate(void)
+{
+	MALI_DEBUG_PRINT(3, ("Mali DLBU: terminating\n"));
+
+	if (0 != mali_dlbu_phys_addr && 0 != mali_dlbu_cpu_addr) {
+		mali_mmu_release_table_page(mali_dlbu_phys_addr,
+					    mali_dlbu_cpu_addr);
+		mali_dlbu_phys_addr = 0;
+		mali_dlbu_cpu_addr = 0;
+	}
+}
+
+struct mali_dlbu_core *mali_dlbu_create(const _mali_osk_resource_t *resource)
+{
+	struct mali_dlbu_core *core = NULL;
+
+	MALI_DEBUG_PRINT(2, ("Mali DLBU: Creating Mali dynamic load balancing unit: %s\n", resource->description));
+
+	core = _mali_osk_malloc(sizeof(struct mali_dlbu_core));
+	if (NULL != core) {
+		if (_MALI_OSK_ERR_OK == mali_hw_core_create(&core->hw_core, resource, MALI_DLBU_SIZE)) {
+			core->pp_cores_mask = 0;
+			if (_MALI_OSK_ERR_OK == mali_dlbu_reset(core)) {
+				return core;
+			}
+			MALI_PRINT_ERROR(("Failed to reset DLBU %s\n", core->hw_core.description));
+			mali_hw_core_delete(&core->hw_core);
+		}
+
+		_mali_osk_free(core);
+	} else {
+		MALI_PRINT_ERROR(("Mali DLBU: Failed to allocate memory for DLBU core\n"));
+	}
+
+	return NULL;
+}
+
+void mali_dlbu_delete(struct mali_dlbu_core *dlbu)
+{
+	MALI_DEBUG_ASSERT_POINTER(dlbu);
+	mali_hw_core_delete(&dlbu->hw_core);
+	_mali_osk_free(dlbu);
+}
+
+_mali_osk_errcode_t mali_dlbu_reset(struct mali_dlbu_core *dlbu)
+{
+	u32 dlbu_registers[7];
+	_mali_osk_errcode_t err = _MALI_OSK_ERR_FAULT;
+	MALI_DEBUG_ASSERT_POINTER(dlbu);
+
+	MALI_DEBUG_PRINT(4, ("Mali DLBU: mali_dlbu_reset: %s\n", dlbu->hw_core.description));
+
+	dlbu_registers[0] = mali_dlbu_phys_addr | 1; /* bit 0 enables the whole core */
+	dlbu_registers[1] = MALI_DLBU_VIRT_ADDR;
+	dlbu_registers[2] = 0;
+	dlbu_registers[3] = 0;
+	dlbu_registers[4] = 0;
+	dlbu_registers[5] = 0;
+	dlbu_registers[6] = dlbu->pp_cores_mask;
+
+	/* write reset values to core registers */
+	mali_hw_core_register_write_array_relaxed(&dlbu->hw_core, MALI_DLBU_REGISTER_MASTER_TLLIST_PHYS_ADDR, dlbu_registers, 7);
+
+	err = _MALI_OSK_ERR_OK;
+
+	return err;
+}
+
+void mali_dlbu_update_mask(struct mali_dlbu_core *dlbu)
+{
+	MALI_DEBUG_ASSERT_POINTER(dlbu);
+
+	mali_hw_core_register_write(&dlbu->hw_core, MALI_DLBU_REGISTER_PP_ENABLE_MASK, dlbu->pp_cores_mask);
+}
+
+void mali_dlbu_add_group(struct mali_dlbu_core *dlbu, struct mali_group *group)
+{
+	struct mali_pp_core *pp_core;
+	u32 bcast_id;
+
+	MALI_DEBUG_ASSERT_POINTER(dlbu);
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	pp_core = mali_group_get_pp_core(group);
+	bcast_id = mali_pp_core_get_bcast_id(pp_core);
+
+	dlbu->pp_cores_mask |= bcast_id;
+	MALI_DEBUG_PRINT(3, ("Mali DLBU: Adding core[%d] New mask= 0x%02x\n", bcast_id , dlbu->pp_cores_mask));
+}
+
+/* Remove a group from the DLBU */
+void mali_dlbu_remove_group(struct mali_dlbu_core *dlbu, struct mali_group *group)
+{
+	struct mali_pp_core *pp_core;
+	u32 bcast_id;
+
+	MALI_DEBUG_ASSERT_POINTER(dlbu);
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	pp_core = mali_group_get_pp_core(group);
+	bcast_id = mali_pp_core_get_bcast_id(pp_core);
+
+	dlbu->pp_cores_mask &= ~bcast_id;
+	MALI_DEBUG_PRINT(3, ("Mali DLBU: Removing core[%d] New mask= 0x%02x\n", bcast_id, dlbu->pp_cores_mask));
+}
+
+/* Configure the DLBU for \a job. This needs to be done before the job is started on the groups in the DLBU. */
+void mali_dlbu_config_job(struct mali_dlbu_core *dlbu, struct mali_pp_job *job)
+{
+	u32 *registers;
+	MALI_DEBUG_ASSERT(job);
+	registers = mali_pp_job_get_dlbu_registers(job);
+	MALI_DEBUG_PRINT(4, ("Mali DLBU: Starting job\n"));
+
+	/* Writing 4 registers:
+	 * DLBU registers except the first two (written once at DLBU initialisation / reset) and the PP_ENABLE_MASK register */
+	mali_hw_core_register_write_array_relaxed(&dlbu->hw_core, MALI_DLBU_REGISTER_TLLIST_VBASEADDR, registers, 4);
+
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_dlbu.h b/drivers/gpu/arm/mali400/common/mali_dlbu.h
--- a/drivers/gpu/arm/mali400/common/mali_dlbu.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_dlbu.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_DLBU_H__
+#define __MALI_DLBU_H__
+
+#define MALI_DLBU_VIRT_ADDR 0xFFF00000 /* master tile virtual address fixed at this value and mapped into every session */
+
+#include "mali_osk.h"
+
+struct mali_pp_job;
+struct mali_group;
+struct mali_dlbu_core;
+
+extern mali_dma_addr mali_dlbu_phys_addr;
+
+_mali_osk_errcode_t mali_dlbu_initialize(void);
+void mali_dlbu_terminate(void);
+
+struct mali_dlbu_core *mali_dlbu_create(const _mali_osk_resource_t *resource);
+void mali_dlbu_delete(struct mali_dlbu_core *dlbu);
+
+_mali_osk_errcode_t mali_dlbu_reset(struct mali_dlbu_core *dlbu);
+
+void mali_dlbu_add_group(struct mali_dlbu_core *dlbu, struct mali_group *group);
+void mali_dlbu_remove_group(struct mali_dlbu_core *dlbu, struct mali_group *group);
+
+/** @brief Called to update HW after DLBU state changed
+ *
+ * This function must be called after \a mali_dlbu_add_group or \a
+ * mali_dlbu_remove_group to write the updated mask to hardware, unless the
+ * same is accomplished by calling \a mali_dlbu_reset.
+ */
+void mali_dlbu_update_mask(struct mali_dlbu_core *dlbu);
+
+void mali_dlbu_config_job(struct mali_dlbu_core *dlbu, struct mali_pp_job *job);
+
+#endif /* __MALI_DLBU_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_dvfs_policy.c b/drivers/gpu/arm/mali400/common/mali_dvfs_policy.c
--- a/drivers/gpu/arm/mali400/common/mali_dvfs_policy.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_dvfs_policy.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,312 @@
+/*
+ * Copyright (C) 2010-2012, 2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_common.h"
+#include "mali_scheduler.h"
+#include "mali_dvfs_policy.h"
+#include "mali_osk_mali.h"
+#include "mali_osk_profiling.h"
+
+#define CLOCK_TUNING_TIME_DEBUG 0
+
+#define MAX_PERFORMANCE_VALUE 256
+#define MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(percent) ((int) ((percent)*(MAX_PERFORMANCE_VALUE)/100.0 + 0.5))
+
+/** The max fps the same as display vsync default 60, can set by module insert parameter */
+int mali_max_system_fps = 60;
+/** A lower limit on their desired FPS default 58, can set by module insert parameter */
+int mali_desired_fps = 58;
+
+static int mali_fps_step1 = 0;
+static int mali_fps_step2 = 0;
+
+static int clock_step = -1;
+static int cur_clk_step = -1;
+static struct mali_gpu_clock *gpu_clk = NULL;
+
+/*Function prototype */
+static int (*mali_gpu_set_freq)(int) = NULL;
+static int (*mali_gpu_get_freq)(void) = NULL;
+
+static mali_bool mali_dvfs_enabled = MALI_FALSE;
+
+#define NUMBER_OF_NANOSECONDS_PER_SECOND  1000000000ULL
+static u32 calculate_window_render_fps(u64 time_period)
+{
+	u32 max_window_number;
+	u64 tmp;
+	u64 max = time_period;
+	u32 leading_zeroes;
+	u32 shift_val;
+	u32 time_period_shift;
+	u32 max_window_number_shift;
+	u32 ret_val;
+
+	max_window_number = mali_session_max_window_num();
+
+	/* To avoid float division, extend the dividend to ns unit */
+	tmp = (u64)max_window_number * NUMBER_OF_NANOSECONDS_PER_SECOND;
+	if (tmp > time_period) {
+		max = tmp;
+	}
+
+	/*
+	 * We may have 64-bit values, a dividend or a divisor or both
+	 * To avoid dependencies to a 64-bit divider, we shift down the two values
+	 * equally first.
+	 */
+	leading_zeroes = _mali_osk_clz((u32)(max >> 32));
+	shift_val = 32 - leading_zeroes;
+
+	time_period_shift = (u32)(time_period >> shift_val);
+	max_window_number_shift = (u32)(tmp >> shift_val);
+
+	ret_val = max_window_number_shift / time_period_shift;
+
+	return ret_val;
+}
+
+static bool mali_pickup_closest_avail_clock(int target_clock_mhz, mali_bool pick_clock_up)
+{
+	int i = 0;
+	bool clock_changed = false;
+
+	/* Round up the closest available frequency step for target_clock_hz */
+	for (i = 0; i < gpu_clk->num_of_steps; i++) {
+		/* Find the first item > target_clock_hz */
+		if (((int)(gpu_clk->item[i].clock) - target_clock_mhz) > 0) {
+			break;
+		}
+	}
+
+	/* If the target clock greater than the maximum clock just pick the maximum one*/
+	if (i == gpu_clk->num_of_steps) {
+		i = gpu_clk->num_of_steps - 1;
+	} else {
+		if ((!pick_clock_up) && (i > 0)) {
+			i = i - 1;
+		}
+	}
+
+	clock_step = i;
+	if (cur_clk_step != clock_step) {
+		clock_changed = true;
+	}
+
+	return clock_changed;
+}
+
+void mali_dvfs_policy_realize(struct mali_gpu_utilization_data *data, u64 time_period)
+{
+	int under_perform_boundary_value = 0;
+	int over_perform_boundary_value = 0;
+	int current_fps = 0;
+	int current_gpu_util = 0;
+	bool clock_changed = false;
+#if CLOCK_TUNING_TIME_DEBUG
+	struct timeval start;
+	struct timeval stop;
+	unsigned int elapse_time;
+	do_gettimeofday(&start);
+#endif
+	u32 window_render_fps;
+
+	if (NULL == gpu_clk) {
+		MALI_DEBUG_PRINT(2, ("Enable DVFS but patform doesn't Support freq change. \n"));
+		return;
+	}
+
+	window_render_fps = calculate_window_render_fps(time_period);
+
+	current_fps = window_render_fps;
+	current_gpu_util = data->utilization_gpu;
+
+	/* Get the specific under_perform_boundary_value and over_perform_boundary_value */
+	if ((mali_desired_fps <= current_fps) && (current_fps < mali_max_system_fps)) {
+		under_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(90);
+		over_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(70);
+	} else if ((mali_fps_step1 <= current_fps) && (current_fps < mali_desired_fps)) {
+		under_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(55);
+		over_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(35);
+	} else if ((mali_fps_step2 <= current_fps) && (current_fps < mali_fps_step1)) {
+		under_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(70);
+		over_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(50);
+	} else {
+		under_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(55);
+		over_perform_boundary_value = MALI_PERCENTAGE_TO_UTILIZATION_FRACTION(35);
+	}
+
+	MALI_DEBUG_PRINT(5, ("Using ARM power policy: gpu util = %d \n", current_gpu_util));
+	MALI_DEBUG_PRINT(5, ("Using ARM power policy: under_perform = %d,  over_perform = %d \n", under_perform_boundary_value, over_perform_boundary_value));
+	MALI_DEBUG_PRINT(5, ("Using ARM power policy: render fps = %d,  pressure render fps = %d \n", current_fps, window_render_fps));
+
+	/* Get current clock value */
+	cur_clk_step = mali_gpu_get_freq();
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	if (1) {
+#else
+	/* Consider offscreen */
+	if (0 == current_fps) {
+#endif
+		/* GP or PP under perform, need to give full power */
+		if (current_gpu_util > over_perform_boundary_value) {
+			if (cur_clk_step != gpu_clk->num_of_steps - 1) {
+				clock_changed = true;
+				clock_step = gpu_clk->num_of_steps - 1;
+			}
+		}
+
+		/* If GPU is idle, use lowest power */
+		if (0 == current_gpu_util) {
+			if (cur_clk_step != 0) {
+				clock_changed = true;
+				clock_step = 0;
+			}
+		}
+
+		goto real_setting;
+	}
+
+	/* 2. Calculate target clock if the GPU clock can be tuned */
+	if (-1 != cur_clk_step) {
+		int target_clk_mhz = -1;
+		mali_bool pick_clock_up = MALI_TRUE;
+
+		if (current_gpu_util > under_perform_boundary_value) {
+			/* when under perform, need to consider the fps part */
+			target_clk_mhz = gpu_clk->item[cur_clk_step].clock * current_gpu_util * mali_desired_fps / under_perform_boundary_value / current_fps;
+			pick_clock_up = MALI_TRUE;
+		} else if (current_gpu_util < over_perform_boundary_value) {
+			/* when over perform, did't need to consider fps, system didn't want to reach desired fps */
+			target_clk_mhz = gpu_clk->item[cur_clk_step].clock * current_gpu_util / under_perform_boundary_value;
+			pick_clock_up = MALI_FALSE;
+		}
+
+		if (-1 != target_clk_mhz) {
+			clock_changed = mali_pickup_closest_avail_clock(target_clk_mhz, pick_clock_up);
+		}
+	}
+
+real_setting:
+	if (clock_changed) {
+		mali_gpu_set_freq(clock_step);
+
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+					      MALI_PROFILING_EVENT_CHANNEL_GPU |
+					      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+					      gpu_clk->item[clock_step].clock,
+					      gpu_clk->item[clock_step].vol / 1000,
+					      0, 0, 0);
+	}
+
+#if CLOCK_TUNING_TIME_DEBUG
+	do_gettimeofday(&stop);
+
+	elapse_time = timeval_to_ns(&stop) - timeval_to_ns(&start);
+	MALI_DEBUG_PRINT(2, ("Using ARM power policy:  eclapse time = %d\n", elapse_time));
+#endif
+}
+
+_mali_osk_errcode_t mali_dvfs_policy_init(void)
+{
+	_mali_osk_device_data data;
+	_mali_osk_errcode_t err = _MALI_OSK_ERR_OK;
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+		if ((NULL != data.get_clock_info) && (NULL != data.set_freq) && (NULL != data.get_freq)) {
+			MALI_DEBUG_PRINT(2, ("Mali DVFS init: using arm dvfs policy \n"));
+
+
+			mali_fps_step1 = mali_max_system_fps / 3;
+			mali_fps_step2 = mali_max_system_fps / 5;
+
+			data.get_clock_info(&gpu_clk);
+
+			if (gpu_clk != NULL) {
+#ifdef DEBUG
+				int i;
+				for (i = 0; i < gpu_clk->num_of_steps; i++) {
+					MALI_DEBUG_PRINT(5, ("mali gpu clock info: step%d clock(%d)Hz,vol(%d) \n",
+							     i, gpu_clk->item[i].clock, gpu_clk->item[i].vol));
+				}
+#endif
+			} else {
+				MALI_DEBUG_PRINT(2, ("Mali DVFS init: platform didn't define enough info for ddk to do DVFS \n"));
+			}
+
+			mali_gpu_get_freq = data.get_freq;
+			mali_gpu_set_freq = data.set_freq;
+
+			if ((NULL != gpu_clk) && (gpu_clk->num_of_steps > 0)
+			    && (NULL != mali_gpu_get_freq) && (NULL != mali_gpu_set_freq)) {
+				mali_dvfs_enabled = MALI_TRUE;
+			}
+		} else {
+			MALI_DEBUG_PRINT(2, ("Mali DVFS init: platform function callback incomplete, need check mali_gpu_device_data in platform .\n"));
+		}
+	} else {
+		err = _MALI_OSK_ERR_FAULT;
+		MALI_DEBUG_PRINT(2, ("Mali DVFS init: get platform data error .\n"));
+	}
+
+	return err;
+}
+
+/*
+ * Always give full power when start a new period,
+ * if mali dvfs enabled, for performance consideration
+ */
+void mali_dvfs_policy_new_period(void)
+{
+	/* Always give full power when start a new period */
+	unsigned int cur_clk_step = 0;
+
+	cur_clk_step = mali_gpu_get_freq();
+
+	if (cur_clk_step != (gpu_clk->num_of_steps - 1)) {
+		mali_gpu_set_freq(gpu_clk->num_of_steps - 1);
+
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+					      MALI_PROFILING_EVENT_CHANNEL_GPU |
+					      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE, gpu_clk->item[gpu_clk->num_of_steps - 1].clock,
+					      gpu_clk->item[gpu_clk->num_of_steps - 1].vol / 1000, 0, 0, 0);
+	}
+}
+
+mali_bool mali_dvfs_policy_enabled(void)
+{
+	return mali_dvfs_enabled;
+}
+
+#if defined(CONFIG_MALI400_PROFILING)
+void mali_get_current_gpu_clk_item(struct mali_gpu_clk_item *clk_item)
+{
+	if (mali_platform_device != NULL) {
+
+		struct mali_gpu_device_data *device_data = NULL;
+		device_data = (struct mali_gpu_device_data *)mali_platform_device->dev.platform_data;
+
+		if ((NULL != device_data->get_clock_info) && (NULL != device_data->get_freq)) {
+
+			int cur_clk_step = device_data->get_freq();
+			struct mali_gpu_clock *mali_gpu_clk = NULL;
+
+			device_data->get_clock_info(&mali_gpu_clk);
+			clk_item->clock = mali_gpu_clk->item[cur_clk_step].clock;
+			clk_item->vol = mali_gpu_clk->item[cur_clk_step].vol;
+		} else {
+			MALI_DEBUG_PRINT(2, ("Mali GPU Utilization: platform function callback incomplete, need check mali_gpu_device_data in platform .\n"));
+		}
+	}
+}
+#endif
+
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_dvfs_policy.h b/drivers/gpu/arm/mali400/common/mali_dvfs_policy.h
--- a/drivers/gpu/arm/mali400/common/mali_dvfs_policy.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_dvfs_policy.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2010-2012, 2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_DVFS_POLICY_H__
+#define __MALI_DVFS_POLICY_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void mali_dvfs_policy_realize(struct mali_gpu_utilization_data *data, u64 time_period);
+
+_mali_osk_errcode_t mali_dvfs_policy_init(void);
+
+void mali_dvfs_policy_new_period(void);
+
+mali_bool mali_dvfs_policy_enabled(void);
+
+#if defined(CONFIG_MALI400_PROFILING)
+void mali_get_current_gpu_clk_item(struct mali_gpu_clk_item *clk_item);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif/* __MALI_DVFS_POLICY_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_executor.c b/drivers/gpu/arm/mali400/common/mali_executor.c
--- a/drivers/gpu/arm/mali400/common/mali_executor.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_executor.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,2693 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_executor.h"
+#include "mali_scheduler.h"
+#include "mali_kernel_common.h"
+#include "mali_kernel_core.h"
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_pp.h"
+#include "mali_pp_job.h"
+#include "mali_group.h"
+#include "mali_pm.h"
+#include "mali_timeline.h"
+#include "mali_osk_profiling.h"
+#include "mali_session.h"
+#include "mali_osk_mali.h"
+
+/*
+ * If dma_buf with map on demand is used, we defer job deletion and job queue
+ * if in atomic context, since both might sleep.
+ */
+#if defined(CONFIG_DMA_SHARED_BUFFER) && !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+#define MALI_EXECUTOR_USE_DEFERRED_PP_JOB_DELETE 1
+#define MALI_EXECUTOR_USE_DEFERRED_PP_JOB_QUEUE 1
+#endif /* !defined(CONFIG_DMA_SHARED_BUFFER) && !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH) */
+
+/*
+ * ---------- static type definitions (structs, enums, etc) ----------
+ */
+
+enum mali_executor_state_t {
+	EXEC_STATE_NOT_PRESENT, /* Virtual group on Mali-300/400 (do not use) */
+	EXEC_STATE_DISABLED,    /* Disabled by core scaling (do not use) */
+	EXEC_STATE_EMPTY,       /* No child groups for virtual group (do not use) */
+	EXEC_STATE_INACTIVE,    /* Can be used, but must be activate first */
+	EXEC_STATE_IDLE,        /* Active and ready to be used */
+	EXEC_STATE_WORKING,     /* Executing a job */
+};
+
+/*
+ * ---------- global variables (exported due to inline functions) ----------
+ */
+
+/* Lock for this module (protecting all HW access except L2 caches) */
+_mali_osk_spinlock_irq_t *mali_executor_lock_obj = NULL;
+
+mali_bool mali_executor_hints[MALI_EXECUTOR_HINT_MAX];
+
+/*
+ * ---------- static variables ----------
+ */
+
+/* Used to defer job scheduling */
+static _mali_osk_wq_work_t *executor_wq_high_pri = NULL;
+
+/* Store version from GP and PP (user space wants to know this) */
+static u32 pp_version = 0;
+static u32 gp_version = 0;
+
+/* List of physical PP groups which are disabled by some external source */
+static _MALI_OSK_LIST_HEAD_STATIC_INIT(group_list_disabled);
+static u32 group_list_disabled_count = 0;
+
+/* List of groups which can be used, but activate first */
+static _MALI_OSK_LIST_HEAD_STATIC_INIT(group_list_inactive);
+static u32 group_list_inactive_count = 0;
+
+/* List of groups which are active and ready to be used */
+static _MALI_OSK_LIST_HEAD_STATIC_INIT(group_list_idle);
+static u32 group_list_idle_count = 0;
+
+/* List of groups which are executing a job */
+static _MALI_OSK_LIST_HEAD_STATIC_INIT(group_list_working);
+static u32 group_list_working_count = 0;
+
+/* Virtual group (if any) */
+static struct mali_group *virtual_group = NULL;
+
+/* Virtual group state is tracked with a state variable instead of 4 lists */
+static enum mali_executor_state_t virtual_group_state = EXEC_STATE_NOT_PRESENT;
+
+/* GP group */
+static struct mali_group *gp_group = NULL;
+
+/* GP group state is tracked with a state variable instead of 4 lists */
+static enum mali_executor_state_t gp_group_state = EXEC_STATE_NOT_PRESENT;
+
+static u32 gp_returned_cookie = 0;
+
+/* Total number of physical PP cores present */
+static u32 num_physical_pp_cores_total = 0;
+
+/* Number of physical cores which are enabled */
+static u32 num_physical_pp_cores_enabled = 0;
+
+/* Enable or disable core scaling */
+static mali_bool core_scaling_enabled = MALI_TRUE;
+
+/* Variables to allow safe pausing of the scheduler */
+static _mali_osk_wait_queue_t *executor_working_wait_queue = NULL;
+static u32 pause_count = 0;
+
+/* PP cores haven't been enabled because of some pp cores haven't been disabled. */
+static int core_scaling_delay_up_mask[MALI_MAX_NUMBER_OF_DOMAINS] = { 0 };
+
+/* Variables used to implement notify pp core changes to userspace when core scaling
+ * is finished in mali_executor_complete_group() function. */
+static _mali_osk_wq_work_t *executor_wq_notify_core_change = NULL;
+static _mali_osk_wait_queue_t *executor_notify_core_change_wait_queue = NULL;
+
+/*
+ * ---------- Forward declaration of static functions ----------
+ */
+static mali_bool mali_executor_is_suspended(void *data);
+static mali_bool mali_executor_is_working(void);
+static void mali_executor_disable_empty_virtual(void);
+static mali_bool mali_executor_physical_rejoin_virtual(struct mali_group *group);
+static mali_bool mali_executor_has_virtual_group(void);
+static mali_bool mali_executor_virtual_group_is_usable(void);
+static void mali_executor_schedule(void);
+static void mali_executor_wq_schedule(void *arg);
+static void mali_executor_send_gp_oom_to_user(struct mali_gp_job *job);
+static void mali_executor_complete_group(struct mali_group *group,
+		mali_bool success,
+		struct mali_gp_job **gp_job_done,
+		struct mali_pp_job **pp_job_done);
+static void mali_executor_change_state_pp_physical(struct mali_group *group,
+		_mali_osk_list_t *old_list,
+		u32 *old_count,
+		_mali_osk_list_t *new_list,
+		u32 *new_count);
+static mali_bool mali_executor_group_is_in_state(struct mali_group *group,
+		enum mali_executor_state_t state);
+
+static void mali_executor_group_enable_internal(struct mali_group *group);
+static void mali_executor_group_disable_internal(struct mali_group *group);
+static void mali_executor_core_scale(unsigned int target_core_nr);
+static void mali_executor_core_scale_in_group_complete(struct mali_group *group);
+static void mali_executor_notify_core_change(u32 num_cores);
+static void mali_executor_wq_notify_core_change(void *arg);
+static void mali_executor_change_group_status_disabled(struct mali_group *group);
+static mali_bool mali_executor_deactivate_list_idle(mali_bool deactivate_idle_group);
+static void mali_executor_set_state_pp_physical(struct mali_group *group,
+		_mali_osk_list_t *new_list,
+		u32 *new_count);
+
+/*
+ * ---------- Actual implementation ----------
+ */
+
+_mali_osk_errcode_t mali_executor_initialize(void)
+{
+	mali_executor_lock_obj = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_ORDERED, _MALI_OSK_LOCK_ORDER_EXECUTOR);
+	if (NULL == mali_executor_lock_obj) {
+		mali_executor_terminate();
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	executor_wq_high_pri = _mali_osk_wq_create_work_high_pri(mali_executor_wq_schedule, NULL);
+	if (NULL == executor_wq_high_pri) {
+		mali_executor_terminate();
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	executor_working_wait_queue = _mali_osk_wait_queue_init();
+	if (NULL == executor_working_wait_queue) {
+		mali_executor_terminate();
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	executor_wq_notify_core_change = _mali_osk_wq_create_work(mali_executor_wq_notify_core_change, NULL);
+	if (NULL == executor_wq_notify_core_change) {
+		mali_executor_terminate();
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	executor_notify_core_change_wait_queue = _mali_osk_wait_queue_init();
+	if (NULL == executor_notify_core_change_wait_queue) {
+		mali_executor_terminate();
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_executor_terminate(void)
+{
+	if (NULL != executor_notify_core_change_wait_queue) {
+		_mali_osk_wait_queue_term(executor_notify_core_change_wait_queue);
+		executor_notify_core_change_wait_queue = NULL;
+	}
+
+	if (NULL != executor_wq_notify_core_change) {
+		_mali_osk_wq_delete_work(executor_wq_notify_core_change);
+		executor_wq_notify_core_change = NULL;
+	}
+
+	if (NULL != executor_working_wait_queue) {
+		_mali_osk_wait_queue_term(executor_working_wait_queue);
+		executor_working_wait_queue = NULL;
+	}
+
+	if (NULL != executor_wq_high_pri) {
+		_mali_osk_wq_delete_work(executor_wq_high_pri);
+		executor_wq_high_pri = NULL;
+	}
+
+	if (NULL != mali_executor_lock_obj) {
+		_mali_osk_spinlock_irq_term(mali_executor_lock_obj);
+		mali_executor_lock_obj = NULL;
+	}
+}
+
+void mali_executor_populate(void)
+{
+	u32 num_groups;
+	u32 i;
+
+	num_groups = mali_group_get_glob_num_groups();
+
+	/* Do we have a virtual group? */
+	for (i = 0; i < num_groups; i++) {
+		struct mali_group *group = mali_group_get_glob_group(i);
+
+		if (mali_group_is_virtual(group)) {
+			virtual_group = group;
+			virtual_group_state = EXEC_STATE_INACTIVE;
+			break;
+		}
+	}
+
+	/* Find all the available physical GP and PP cores */
+	for (i = 0; i < num_groups; i++) {
+		struct mali_group *group = mali_group_get_glob_group(i);
+
+		if (NULL != group) {
+			struct mali_pp_core *pp_core = mali_group_get_pp_core(group);
+			struct mali_gp_core *gp_core = mali_group_get_gp_core(group);
+
+			if (!mali_group_is_virtual(group)) {
+				if (NULL != pp_core) {
+					if (0 == pp_version) {
+						/* Retrieve PP version from the first available PP core */
+						pp_version = mali_pp_core_get_version(pp_core);
+					}
+
+					if (NULL != virtual_group) {
+						mali_executor_lock();
+						mali_group_add_group(virtual_group, group);
+						mali_executor_unlock();
+					} else {
+						_mali_osk_list_add(&group->executor_list, &group_list_inactive);
+						group_list_inactive_count++;
+					}
+
+					num_physical_pp_cores_total++;
+				} else {
+					MALI_DEBUG_ASSERT_POINTER(gp_core);
+
+					if (0 == gp_version) {
+						/* Retrieve GP version */
+						gp_version = mali_gp_core_get_version(gp_core);
+					}
+
+					gp_group = group;
+					gp_group_state = EXEC_STATE_INACTIVE;
+				}
+
+			}
+		}
+	}
+
+	num_physical_pp_cores_enabled = num_physical_pp_cores_total;
+}
+
+void mali_executor_depopulate(void)
+{
+	struct mali_group *group;
+	struct mali_group *temp;
+
+	MALI_DEBUG_ASSERT(EXEC_STATE_WORKING != gp_group_state);
+
+	if (NULL != gp_group) {
+		mali_group_delete(gp_group);
+		gp_group = NULL;
+	}
+
+	MALI_DEBUG_ASSERT(EXEC_STATE_WORKING != virtual_group_state);
+
+	if (NULL != virtual_group) {
+		mali_group_delete(virtual_group);
+		virtual_group = NULL;
+	}
+
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(&group_list_working));
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_idle, struct mali_group, executor_list) {
+		mali_group_delete(group);
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_inactive, struct mali_group, executor_list) {
+		mali_group_delete(group);
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_disabled, struct mali_group, executor_list) {
+		mali_group_delete(group);
+	}
+}
+
+void mali_executor_suspend(void)
+{
+	mali_executor_lock();
+
+	/* Increment the pause_count so that no more jobs will be scheduled */
+	pause_count++;
+
+	mali_executor_unlock();
+
+	_mali_osk_wait_queue_wait_event(executor_working_wait_queue,
+					mali_executor_is_suspended, NULL);
+
+	/*
+	 * mali_executor_complete_XX() leaves jobs in idle state.
+	 * deactivate option is used when we are going to power down
+	 * the entire GPU (OS suspend) and want a consistent SW vs HW
+	 * state.
+	 */
+	mali_executor_lock();
+
+	mali_executor_deactivate_list_idle(MALI_TRUE);
+
+	/*
+	 * The following steps are used to deactive all of activated
+	 * (MALI_GROUP_STATE_ACTIVE) and activating (MALI_GROUP
+	 * _STAET_ACTIVATION_PENDING) groups, to make sure the variable
+	 * pd_mask_wanted is equal with 0. */
+	if (MALI_GROUP_STATE_INACTIVE != mali_group_get_state(gp_group)) {
+		gp_group_state = EXEC_STATE_INACTIVE;
+		mali_group_deactivate(gp_group);
+	}
+
+	if (mali_executor_has_virtual_group()) {
+		if (MALI_GROUP_STATE_INACTIVE
+		    != mali_group_get_state(virtual_group)) {
+			virtual_group_state = EXEC_STATE_INACTIVE;
+			mali_group_deactivate(virtual_group);
+		}
+	}
+
+	if (0 < group_list_inactive_count) {
+		struct mali_group *group;
+		struct mali_group *temp;
+
+		_MALI_OSK_LIST_FOREACHENTRY(group, temp,
+					    &group_list_inactive,
+					    struct mali_group, executor_list) {
+			if (MALI_GROUP_STATE_ACTIVATION_PENDING
+			    == mali_group_get_state(group)) {
+				mali_group_deactivate(group);
+			}
+
+			/*
+			 * On mali-450 platform, we may have physical group in the group inactive
+			 * list, and its state is MALI_GROUP_STATE_ACTIVATION_PENDING, so we only
+			 * deactivate it is not enough, we still also need add it back to virtual group.
+			 * And now, virtual group must be in INACTIVE state, so it's safe to add
+			 * physical group to virtual group at this point.
+			 */
+			if (NULL != virtual_group) {
+				_mali_osk_list_delinit(&group->executor_list);
+				group_list_inactive_count--;
+
+				mali_group_add_group(virtual_group, group);
+			}
+		}
+	}
+
+	mali_executor_unlock();
+}
+
+void mali_executor_resume(void)
+{
+	mali_executor_lock();
+
+	/* Decrement pause_count to allow scheduling again (if it reaches 0) */
+	pause_count--;
+	if (0 == pause_count) {
+		mali_executor_schedule();
+	}
+
+	mali_executor_unlock();
+}
+
+u32 mali_executor_get_num_cores_total(void)
+{
+	return num_physical_pp_cores_total;
+}
+
+u32 mali_executor_get_num_cores_enabled(void)
+{
+	return num_physical_pp_cores_enabled;
+}
+
+struct mali_pp_core *mali_executor_get_virtual_pp(void)
+{
+	MALI_DEBUG_ASSERT_POINTER(virtual_group);
+	MALI_DEBUG_ASSERT_POINTER(virtual_group->pp_core);
+	return virtual_group->pp_core;
+}
+
+struct mali_group *mali_executor_get_virtual_group(void)
+{
+	return virtual_group;
+}
+
+void mali_executor_zap_all_active(struct mali_session_data *session)
+{
+	struct mali_group *group;
+	struct mali_group *temp;
+	mali_bool ret;
+
+	mali_executor_lock();
+
+	/*
+	 * This function is a bit complicated because
+	 * mali_group_zap_session() can fail. This only happens because the
+	 * group is in an unhandled page fault status.
+	 * We need to make sure this page fault is handled before we return,
+	 * so that we know every single outstanding MMU transactions have
+	 * completed. This will allow caller to safely remove physical pages
+	 * when we have returned.
+	 */
+
+	MALI_DEBUG_ASSERT(NULL != gp_group);
+	ret = mali_group_zap_session(gp_group, session);
+	if (MALI_FALSE == ret) {
+		struct mali_gp_job *gp_job = NULL;
+
+		mali_executor_complete_group(gp_group, MALI_FALSE, &gp_job, NULL);
+
+		MALI_DEBUG_ASSERT_POINTER(gp_job);
+
+		/* GP job completed, make sure it is freed */
+		mali_scheduler_complete_gp_job(gp_job, MALI_FALSE,
+					       MALI_TRUE, MALI_TRUE);
+	}
+
+	if (mali_executor_has_virtual_group()) {
+		ret = mali_group_zap_session(virtual_group, session);
+		if (MALI_FALSE == ret) {
+			struct mali_pp_job *pp_job = NULL;
+
+			mali_executor_complete_group(virtual_group, MALI_FALSE, NULL, &pp_job);
+
+			if (NULL != pp_job) {
+				/* PP job completed, make sure it is freed */
+				mali_scheduler_complete_pp_job(pp_job, 0,
+							       MALI_FALSE, MALI_TRUE);
+			}
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_working,
+				    struct mali_group, executor_list) {
+		ret = mali_group_zap_session(group, session);
+		if (MALI_FALSE == ret) {
+			ret = mali_group_zap_session(group, session);
+			if (MALI_FALSE == ret) {
+				struct mali_pp_job *pp_job = NULL;
+
+				mali_executor_complete_group(group, MALI_FALSE, NULL, &pp_job);
+
+				if (NULL != pp_job) {
+					/* PP job completed, free it */
+					mali_scheduler_complete_pp_job(pp_job,
+								       0, MALI_FALSE,
+								       MALI_TRUE);
+				}
+			}
+		}
+	}
+
+	mali_executor_unlock();
+}
+
+void mali_executor_schedule_from_mask(mali_scheduler_mask mask, mali_bool deferred_schedule)
+{
+	if (MALI_SCHEDULER_MASK_EMPTY != mask) {
+		if (MALI_TRUE == deferred_schedule) {
+			_mali_osk_wq_schedule_work_high_pri(executor_wq_high_pri);
+		} else {
+			/* Schedule from this thread*/
+			mali_executor_lock();
+			mali_executor_schedule();
+			mali_executor_unlock();
+		}
+	}
+}
+
+_mali_osk_errcode_t mali_executor_interrupt_gp(struct mali_group *group,
+		mali_bool in_upper_half)
+{
+	enum mali_interrupt_result int_result;
+	mali_bool time_out = MALI_FALSE;
+
+	MALI_DEBUG_PRINT(4, ("Executor: GP interrupt from %s in %s half\n",
+			     mali_group_core_description(group),
+			     in_upper_half ? "upper" : "bottom"));
+
+	mali_executor_lock();
+	if (!mali_group_is_working(group)) {
+		/* Not working, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_group_is_working(group));
+
+	if (mali_group_has_timed_out(group)) {
+		int_result = MALI_INTERRUPT_RESULT_ERROR;
+		time_out = MALI_TRUE;
+		MALI_PRINT(("Executor GP: Job %d Timeout on %s\n",
+			    mali_gp_job_get_id(group->gp_running_job),
+			    mali_group_core_description(group)));
+	} else {
+		int_result = mali_group_get_interrupt_result_gp(group);
+		if (MALI_INTERRUPT_RESULT_NONE == int_result) {
+			mali_executor_unlock();
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	if (MALI_INTERRUPT_RESULT_NONE == int_result) {
+		/* No interrupts signalled, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+#else
+	MALI_DEBUG_ASSERT(MALI_INTERRUPT_RESULT_NONE != int_result);
+#endif
+
+	mali_group_mask_all_interrupts_gp(group);
+
+	if (MALI_INTERRUPT_RESULT_SUCCESS_VS == int_result) {
+		if (mali_group_gp_is_active(group)) {
+			/* Only VS completed so far, while PLBU is still active */
+
+			/* Enable all but the current interrupt */
+			mali_group_enable_interrupts_gp(group, int_result);
+
+			mali_executor_unlock();
+			return _MALI_OSK_ERR_OK;
+		}
+	} else if (MALI_INTERRUPT_RESULT_SUCCESS_PLBU == int_result) {
+		if (mali_group_gp_is_active(group)) {
+			/* Only PLBU completed so far, while VS is still active */
+
+			/* Enable all but the current interrupt */
+			mali_group_enable_interrupts_gp(group, int_result);
+
+			mali_executor_unlock();
+			return _MALI_OSK_ERR_OK;
+		}
+	} else if (MALI_INTERRUPT_RESULT_OOM == int_result) {
+		struct mali_gp_job *job = mali_group_get_running_gp_job(group);
+
+		/* PLBU out of mem */
+		MALI_DEBUG_PRINT(3, ("Executor: PLBU needs more heap memory\n"));
+
+#if defined(CONFIG_MALI400_PROFILING)
+		/* Give group a chance to generate a SUSPEND event */
+		mali_group_oom(group);
+#endif
+
+		/*
+		 * no need to hold interrupt raised while
+		 * waiting for more memory.
+		 */
+		mali_executor_send_gp_oom_to_user(job);
+
+		mali_executor_unlock();
+
+		return _MALI_OSK_ERR_OK;
+	}
+
+	/* We should now have a real interrupt to handle */
+
+	MALI_DEBUG_PRINT(4, ("Executor: Group %s completed with %s\n",
+			     mali_group_core_description(group),
+			     (MALI_INTERRUPT_RESULT_ERROR == int_result) ?
+			     "ERROR" : "success"));
+
+	if (in_upper_half && MALI_INTERRUPT_RESULT_ERROR == int_result) {
+		/* Don't bother to do processing of errors in upper half */
+		mali_executor_unlock();
+
+		if (MALI_FALSE == time_out) {
+			mali_group_schedule_bottom_half_gp(group);
+		}
+	} else {
+		struct mali_gp_job *job;
+		mali_bool success;
+
+		if (MALI_TRUE == time_out) {
+			mali_group_dump_status(group);
+		}
+
+		success = (int_result != MALI_INTERRUPT_RESULT_ERROR) ?
+			  MALI_TRUE : MALI_FALSE;
+
+		mali_executor_complete_group(group, success, &job, NULL);
+
+		mali_executor_unlock();
+
+		/* GP jobs always fully complete */
+		MALI_DEBUG_ASSERT(NULL != job);
+
+		/* This will notify user space and close the job object */
+		mali_scheduler_complete_gp_job(job, success,
+					       MALI_TRUE, MALI_TRUE);
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_executor_interrupt_pp(struct mali_group *group,
+		mali_bool in_upper_half)
+{
+	enum mali_interrupt_result int_result;
+	mali_bool time_out = MALI_FALSE;
+
+	MALI_DEBUG_PRINT(4, ("Executor: PP interrupt from %s in %s half\n",
+			     mali_group_core_description(group),
+			     in_upper_half ? "upper" : "bottom"));
+
+	mali_executor_lock();
+
+	if (!mali_group_is_working(group)) {
+		/* Not working, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	if (in_upper_half) {
+		if (mali_group_is_in_virtual(group)) {
+			/* Child groups should never handle PP interrupts */
+			MALI_DEBUG_ASSERT(!mali_group_has_timed_out(group));
+			mali_executor_unlock();
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_group_is_working(group));
+	MALI_DEBUG_ASSERT(!mali_group_is_in_virtual(group));
+
+	if (mali_group_has_timed_out(group)) {
+		int_result = MALI_INTERRUPT_RESULT_ERROR;
+		time_out = MALI_TRUE;
+		MALI_PRINT(("Executor PP: Job %d Timeout on %s\n",
+			    mali_pp_job_get_id(group->pp_running_job),
+			    mali_group_core_description(group)));
+	} else {
+		int_result = mali_group_get_interrupt_result_pp(group);
+		if (MALI_INTERRUPT_RESULT_NONE == int_result) {
+			mali_executor_unlock();
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	if (MALI_INTERRUPT_RESULT_NONE == int_result) {
+		/* No interrupts signalled, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	} else if (MALI_INTERRUPT_RESULT_SUCCESS == int_result) {
+		if (mali_group_is_virtual(group) && mali_group_pp_is_active(group)) {
+			/* Some child groups are still working, so nothing to do right now */
+			mali_executor_unlock();
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+#else
+	MALI_DEBUG_ASSERT(MALI_INTERRUPT_RESULT_NONE != int_result);
+#endif
+
+	/* We should now have a real interrupt to handle */
+
+	MALI_DEBUG_PRINT(4, ("Executor: Group %s completed with %s\n",
+			     mali_group_core_description(group),
+			     (MALI_INTERRUPT_RESULT_ERROR == int_result) ?
+			     "ERROR" : "success"));
+
+	if (in_upper_half && MALI_INTERRUPT_RESULT_ERROR == int_result) {
+		/* Don't bother to do processing of errors in upper half */
+		mali_group_mask_all_interrupts_pp(group);
+		mali_executor_unlock();
+
+		if (MALI_FALSE == time_out) {
+			mali_group_schedule_bottom_half_pp(group);
+		}
+	} else {
+		struct mali_pp_job *job = NULL;
+		mali_bool success;
+
+		if (MALI_TRUE == time_out) {
+			mali_group_dump_status(group);
+		}
+
+		success = (int_result == MALI_INTERRUPT_RESULT_SUCCESS) ?
+			  MALI_TRUE : MALI_FALSE;
+
+		mali_executor_complete_group(group, success, NULL, &job);
+
+		mali_executor_unlock();
+
+		if (NULL != job) {
+			/* Notify user space and close the job object */
+			mali_scheduler_complete_pp_job(job,
+						       num_physical_pp_cores_total,
+						       MALI_TRUE, MALI_TRUE);
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_executor_interrupt_mmu(struct mali_group *group,
+		mali_bool in_upper_half)
+{
+	enum mali_interrupt_result int_result;
+
+	MALI_DEBUG_PRINT(4, ("Executor: MMU interrupt from %s in %s half\n",
+			     mali_group_core_description(group),
+			     in_upper_half ? "upper" : "bottom"));
+
+	mali_executor_lock();
+	if (!mali_group_is_working(group)) {
+		/* Not working, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_group_is_working(group));
+
+	int_result = mali_group_get_interrupt_result_mmu(group);
+	if (MALI_INTERRUPT_RESULT_NONE == int_result) {
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	if (MALI_INTERRUPT_RESULT_NONE == int_result) {
+		/* No interrupts signalled, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+#else
+	MALI_DEBUG_ASSERT(MALI_INTERRUPT_RESULT_ERROR == int_result);
+#endif
+
+	/* We should now have a real interrupt to handle */
+
+	if (in_upper_half) {
+		/* Don't bother to do processing of errors in upper half */
+
+		struct mali_group *parent = group->parent_group;
+
+		mali_mmu_mask_all_interrupts(group->mmu);
+
+		mali_executor_unlock();
+
+		if (NULL == parent) {
+			mali_group_schedule_bottom_half_mmu(group);
+		} else {
+			mali_group_schedule_bottom_half_mmu(parent);
+		}
+
+	} else {
+		struct mali_gp_job *gp_job = NULL;
+		struct mali_pp_job *pp_job = NULL;
+
+#ifdef DEBUG
+
+		u32 fault_address = mali_mmu_get_page_fault_addr(group->mmu);
+		u32 status = mali_mmu_get_status(group->mmu);
+		MALI_DEBUG_PRINT(2, ("Executor: Mali page fault detected at 0x%x from bus id %d of type %s on %s\n",
+				     (void *)(uintptr_t)fault_address,
+				     (status >> 6) & 0x1F,
+				     (status & 32) ? "write" : "read",
+				     group->mmu->hw_core.description));
+		MALI_DEBUG_PRINT(3, ("Executor: MMU rawstat = 0x%08X, MMU status = 0x%08X\n",
+				     mali_mmu_get_rawstat(group->mmu), status));
+		mali_mmu_pagedir_diag(mali_session_get_page_directory(group->session), fault_address);
+#endif
+
+		mali_executor_complete_group(group, MALI_FALSE, &gp_job, &pp_job);
+
+		mali_executor_unlock();
+
+		if (NULL != gp_job) {
+			MALI_DEBUG_ASSERT(NULL == pp_job);
+
+			/* Notify user space and close the job object */
+			mali_scheduler_complete_gp_job(gp_job, MALI_FALSE,
+						       MALI_TRUE, MALI_TRUE);
+		} else if (NULL != pp_job) {
+			MALI_DEBUG_ASSERT(NULL == gp_job);
+
+			/* Notify user space and close the job object */
+			mali_scheduler_complete_pp_job(pp_job,
+						       num_physical_pp_cores_total,
+						       MALI_TRUE, MALI_TRUE);
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_executor_group_power_up(struct mali_group *groups[], u32 num_groups)
+{
+	u32 i;
+	mali_bool child_groups_activated = MALI_FALSE;
+	mali_bool do_schedule = MALI_FALSE;
+#if defined(DEBUG)
+	u32 num_activated = 0;
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(groups);
+	MALI_DEBUG_ASSERT(0 < num_groups);
+
+	mali_executor_lock();
+
+	MALI_DEBUG_PRINT(3, ("Executor: powering up %u groups\n", num_groups));
+
+	for (i = 0; i < num_groups; i++) {
+		MALI_DEBUG_PRINT(3, ("Executor: powering up group %s\n",
+				     mali_group_core_description(groups[i])));
+
+		mali_group_power_up(groups[i]);
+
+		if ((MALI_GROUP_STATE_ACTIVATION_PENDING != mali_group_get_state(groups[i]) ||
+		     (MALI_TRUE != mali_executor_group_is_in_state(groups[i], EXEC_STATE_INACTIVE)))) {
+			/* nothing more to do for this group */
+			continue;
+		}
+
+		MALI_DEBUG_PRINT(3, ("Executor: activating group %s\n",
+				     mali_group_core_description(groups[i])));
+
+#if defined(DEBUG)
+		num_activated++;
+#endif
+
+		if (mali_group_is_in_virtual(groups[i])) {
+			/*
+			 * At least one child group of virtual group is powered on.
+			 */
+			child_groups_activated = MALI_TRUE;
+		} else if (MALI_FALSE == mali_group_is_virtual(groups[i])) {
+			/* Set gp and pp not in virtual to active. */
+			mali_group_set_active(groups[i]);
+		}
+
+		/* Move group from inactive to idle list */
+		if (groups[i] == gp_group) {
+			MALI_DEBUG_ASSERT(EXEC_STATE_INACTIVE ==
+					  gp_group_state);
+			gp_group_state = EXEC_STATE_IDLE;
+		} else if (MALI_FALSE == mali_group_is_in_virtual(groups[i])
+			   && MALI_FALSE == mali_group_is_virtual(groups[i])) {
+			MALI_DEBUG_ASSERT(MALI_TRUE == mali_executor_group_is_in_state(groups[i],
+					  EXEC_STATE_INACTIVE));
+
+			mali_executor_change_state_pp_physical(groups[i],
+							       &group_list_inactive,
+							       &group_list_inactive_count,
+							       &group_list_idle,
+							       &group_list_idle_count);
+		}
+
+		do_schedule = MALI_TRUE;
+	}
+
+	if (mali_executor_has_virtual_group() &&
+	    MALI_TRUE == child_groups_activated &&
+	    MALI_GROUP_STATE_ACTIVATION_PENDING ==
+	    mali_group_get_state(virtual_group)) {
+		/*
+		 * Try to active virtual group while it may be not sucessful every time,
+		 * because there is one situation that not all of child groups are powered on
+		 * in one time and virtual group is in activation pending state.
+		 */
+		if (mali_group_set_active(virtual_group)) {
+			/* Move group from inactive to idle */
+			MALI_DEBUG_ASSERT(EXEC_STATE_INACTIVE ==
+					  virtual_group_state);
+			virtual_group_state = EXEC_STATE_IDLE;
+
+			MALI_DEBUG_PRINT(3, ("Executor: powering up %u groups completed, %u  physical activated, 1 virtual activated.\n", num_groups, num_activated));
+		} else {
+			MALI_DEBUG_PRINT(3, ("Executor: powering up %u groups completed, %u physical activated\n", num_groups, num_activated));
+		}
+	} else {
+		MALI_DEBUG_PRINT(3, ("Executor: powering up %u groups completed, %u physical activated\n", num_groups, num_activated));
+	}
+
+	if (MALI_TRUE == do_schedule) {
+		/* Trigger a schedule */
+		mali_executor_schedule();
+	}
+
+	mali_executor_unlock();
+}
+
+void mali_executor_group_power_down(struct mali_group *groups[],
+				    u32 num_groups)
+{
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(groups);
+	MALI_DEBUG_ASSERT(0 < num_groups);
+
+	mali_executor_lock();
+
+	MALI_DEBUG_PRINT(3, ("Executor: powering down %u groups\n", num_groups));
+
+	for (i = 0; i < num_groups; i++) {
+		/* Groups must be either disabled or inactive. while for virtual group,
+		 * it maybe in empty state, because when we meet pm_runtime_suspend,
+		 * virtual group could be powered off, and before we acquire mali_executor_lock,
+		 * we must release mali_pm_state_lock, if there is a new physical job was queued,
+		 * all of physical groups in virtual group could be pulled out, so we only can
+		 * powered down an empty virtual group. Those physical groups will be powered
+		 * up in following pm_runtime_resume callback function.
+		 */
+		MALI_DEBUG_ASSERT(mali_executor_group_is_in_state(groups[i],
+				  EXEC_STATE_DISABLED) ||
+				  mali_executor_group_is_in_state(groups[i],
+						  EXEC_STATE_INACTIVE) ||
+				  mali_executor_group_is_in_state(groups[i],
+						  EXEC_STATE_EMPTY));
+
+		MALI_DEBUG_PRINT(3, ("Executor: powering down group %s\n",
+				     mali_group_core_description(groups[i])));
+
+		mali_group_power_down(groups[i]);
+	}
+
+	MALI_DEBUG_PRINT(3, ("Executor: powering down %u groups completed\n", num_groups));
+
+	mali_executor_unlock();
+}
+
+void mali_executor_abort_session(struct mali_session_data *session)
+{
+	struct mali_group *group;
+	struct mali_group *tmp_group;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT(session->is_aborting);
+
+	MALI_DEBUG_PRINT(3,
+			 ("Executor: Aborting all jobs from session 0x%08X.\n",
+			  session));
+
+	mali_executor_lock();
+
+	if (mali_group_get_session(gp_group) == session) {
+		if (EXEC_STATE_WORKING == gp_group_state) {
+			struct mali_gp_job *gp_job = NULL;
+
+			mali_executor_complete_group(gp_group, MALI_FALSE, &gp_job, NULL);
+
+			MALI_DEBUG_ASSERT_POINTER(gp_job);
+
+			/* GP job completed, make sure it is freed */
+			mali_scheduler_complete_gp_job(gp_job, MALI_FALSE,
+						       MALI_FALSE, MALI_TRUE);
+		} else {
+			/* Same session, but not working, so just clear it */
+			mali_group_clear_session(gp_group);
+		}
+	}
+
+	if (mali_executor_has_virtual_group()) {
+		if (EXEC_STATE_WORKING == virtual_group_state
+		    && mali_group_get_session(virtual_group) == session) {
+			struct mali_pp_job *pp_job = NULL;
+
+			mali_executor_complete_group(virtual_group, MALI_FALSE, NULL, &pp_job);
+
+			if (NULL != pp_job) {
+				/* PP job completed, make sure it is freed */
+				mali_scheduler_complete_pp_job(pp_job, 0,
+							       MALI_FALSE, MALI_TRUE);
+			}
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, tmp_group, &group_list_working,
+				    struct mali_group, executor_list) {
+		if (mali_group_get_session(group) == session) {
+			struct mali_pp_job *pp_job = NULL;
+
+			mali_executor_complete_group(group, MALI_FALSE, NULL, &pp_job);
+
+			if (NULL != pp_job) {
+				/* PP job completed, make sure it is freed */
+				mali_scheduler_complete_pp_job(pp_job, 0,
+							       MALI_FALSE, MALI_TRUE);
+			}
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, tmp_group, &group_list_idle, struct mali_group, executor_list) {
+		mali_group_clear_session(group);
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, tmp_group, &group_list_inactive, struct mali_group, executor_list) {
+		mali_group_clear_session(group);
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, tmp_group, &group_list_disabled, struct mali_group, executor_list) {
+		mali_group_clear_session(group);
+	}
+
+	mali_executor_unlock();
+}
+
+
+void mali_executor_core_scaling_enable(void)
+{
+	/* PS: Core scaling is by default enabled */
+	core_scaling_enabled = MALI_TRUE;
+}
+
+void mali_executor_core_scaling_disable(void)
+{
+	core_scaling_enabled = MALI_FALSE;
+}
+
+mali_bool mali_executor_core_scaling_is_enabled(void)
+{
+	return core_scaling_enabled;
+}
+
+void mali_executor_group_enable(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	mali_executor_lock();
+
+	if ((NULL != mali_group_get_gp_core(group) || NULL != mali_group_get_pp_core(group))
+	    && (mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED))) {
+		mali_executor_group_enable_internal(group);
+	}
+
+	mali_executor_schedule();
+	mali_executor_unlock();
+
+	_mali_osk_wq_schedule_work(executor_wq_notify_core_change);
+}
+
+/*
+ * If a physical group is inactive or idle, we should disable it immediately,
+ * if group is in virtual, and virtual group is idle, disable given physical group in it.
+ */
+void mali_executor_group_disable(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	mali_executor_lock();
+
+	if ((NULL != mali_group_get_gp_core(group) || NULL != mali_group_get_pp_core(group))
+	    && (!mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED))) {
+		mali_executor_group_disable_internal(group);
+	}
+
+	mali_executor_schedule();
+	mali_executor_unlock();
+
+	_mali_osk_wq_schedule_work(executor_wq_notify_core_change);
+}
+
+mali_bool mali_executor_group_is_disabled(struct mali_group *group)
+{
+	/* NB: This function is not optimized for time critical usage */
+
+	mali_bool ret;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	mali_executor_lock();
+	ret = mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED);
+	mali_executor_unlock();
+
+	return ret;
+}
+
+int mali_executor_set_perf_level(unsigned int target_core_nr, mali_bool override)
+{
+	if (target_core_nr == num_physical_pp_cores_enabled) return 0;
+	if (MALI_FALSE == core_scaling_enabled && MALI_FALSE == override) return -EPERM;
+	if (target_core_nr > num_physical_pp_cores_total) return -EINVAL;
+	if (0 == target_core_nr) return -EINVAL;
+
+	mali_executor_core_scale(target_core_nr);
+
+	_mali_osk_wq_schedule_work(executor_wq_notify_core_change);
+
+	return 0;
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_executor_dump_state(char *buf, u32 size)
+{
+	int n = 0;
+	struct mali_group *group;
+	struct mali_group *temp;
+
+	mali_executor_lock();
+
+	switch (gp_group_state) {
+	case EXEC_STATE_INACTIVE:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"GP group is in state INACTIVE\n");
+		break;
+	case EXEC_STATE_IDLE:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"GP group is in state IDLE\n");
+		break;
+	case EXEC_STATE_WORKING:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"GP group is in state WORKING\n");
+		break;
+	default:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"GP group is in unknown/illegal state %u\n",
+					gp_group_state);
+		break;
+	}
+
+	n += mali_group_dump_state(gp_group, buf + n, size - n);
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"Physical PP groups in WORKING state (count = %u):\n",
+				group_list_working_count);
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_working, struct mali_group, executor_list) {
+		n += mali_group_dump_state(group, buf + n, size - n);
+	}
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"Physical PP groups in IDLE state (count = %u):\n",
+				group_list_idle_count);
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_idle, struct mali_group, executor_list) {
+		n += mali_group_dump_state(group, buf + n, size - n);
+	}
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"Physical PP groups in INACTIVE state (count = %u):\n",
+				group_list_inactive_count);
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_inactive, struct mali_group, executor_list) {
+		n += mali_group_dump_state(group, buf + n, size - n);
+	}
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"Physical PP groups in DISABLED state (count = %u):\n",
+				group_list_disabled_count);
+
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_disabled, struct mali_group, executor_list) {
+		n += mali_group_dump_state(group, buf + n, size - n);
+	}
+
+	if (mali_executor_has_virtual_group()) {
+		switch (virtual_group_state) {
+		case EXEC_STATE_EMPTY:
+			n += _mali_osk_snprintf(buf + n, size - n,
+						"Virtual PP group is in state EMPTY\n");
+			break;
+		case EXEC_STATE_INACTIVE:
+			n += _mali_osk_snprintf(buf + n, size - n,
+						"Virtual PP group is in state INACTIVE\n");
+			break;
+		case EXEC_STATE_IDLE:
+			n += _mali_osk_snprintf(buf + n, size - n,
+						"Virtual PP group is in state IDLE\n");
+			break;
+		case EXEC_STATE_WORKING:
+			n += _mali_osk_snprintf(buf + n, size - n,
+						"Virtual PP group is in state WORKING\n");
+			break;
+		default:
+			n += _mali_osk_snprintf(buf + n, size - n,
+						"Virtual PP group is in unknown/illegal state %u\n",
+						virtual_group_state);
+			break;
+		}
+
+		n += mali_group_dump_state(virtual_group, buf + n, size - n);
+	}
+
+	mali_executor_unlock();
+
+	n += _mali_osk_snprintf(buf + n, size - n, "\n");
+
+	return n;
+}
+#endif
+
+_mali_osk_errcode_t _mali_ukk_get_pp_number_of_cores(_mali_uk_get_pp_number_of_cores_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+	args->number_of_total_cores = num_physical_pp_cores_total;
+	args->number_of_enabled_cores = num_physical_pp_cores_enabled;
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_get_pp_core_version(_mali_uk_get_pp_core_version_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+	args->version = pp_version;
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_get_gp_number_of_cores(_mali_uk_get_gp_number_of_cores_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+	args->number_of_cores = 1;
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_get_gp_core_version(_mali_uk_get_gp_core_version_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+	args->version = gp_version;
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_gp_suspend_response(_mali_uk_gp_suspend_response_s *args)
+{
+	struct mali_session_data *session;
+	struct mali_gp_job *job;
+
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)args->ctx;
+
+	if (_MALIGP_JOB_RESUME_WITH_NEW_HEAP == args->code) {
+		_mali_osk_notification_t *new_notification = NULL;
+
+		new_notification = _mali_osk_notification_create(
+					   _MALI_NOTIFICATION_GP_STALLED,
+					   sizeof(_mali_uk_gp_job_suspended_s));
+
+		if (NULL != new_notification) {
+			MALI_DEBUG_PRINT(3, ("Executor: Resuming job %u with new heap; 0x%08X - 0x%08X\n",
+					     args->cookie, args->arguments[0], args->arguments[1]));
+
+			mali_executor_lock();
+
+			/* Resume the job in question if it is still running */
+			job = mali_group_get_running_gp_job(gp_group);
+			if (NULL != job &&
+			    args->cookie == mali_gp_job_get_id(job) &&
+			    session == mali_gp_job_get_session(job)) {
+				/*
+				 * Correct job is running, resume with new heap
+				 */
+
+				mali_gp_job_set_oom_notification(job,
+								 new_notification);
+
+				/* This will also re-enable interrupts */
+				mali_group_resume_gp_with_new_heap(gp_group,
+								   args->cookie,
+								   args->arguments[0],
+								   args->arguments[1]);
+
+				mali_executor_unlock();
+				return _MALI_OSK_ERR_OK;
+			} else {
+				MALI_DEBUG_PRINT(2, ("Executor: Unable to resume  gp job becasue gp time out or any other unexpected reason!\n"));
+
+				_mali_osk_notification_delete(new_notification);
+
+				mali_executor_unlock();
+				return _MALI_OSK_ERR_FAULT;
+			}
+		} else {
+			MALI_PRINT_ERROR(("Executor: Failed to allocate notification object. Will abort GP job.\n"));
+		}
+	} else {
+		MALI_DEBUG_PRINT(2, ("Executor: Aborting job %u, no new heap provided\n", args->cookie));
+	}
+
+	mali_executor_lock();
+
+	/* Abort the job in question if it is still running */
+	job = mali_group_get_running_gp_job(gp_group);
+	if (NULL != job &&
+	    args->cookie == mali_gp_job_get_id(job) &&
+	    session == mali_gp_job_get_session(job)) {
+		/* Correct job is still running */
+		struct mali_gp_job *job_done = NULL;
+
+		mali_executor_complete_group(gp_group, MALI_FALSE, &job_done, NULL);
+
+		/* The same job should have completed */
+		MALI_DEBUG_ASSERT(job_done == job);
+
+		/* GP job completed, make sure it is freed */
+		mali_scheduler_complete_gp_job(job_done, MALI_FALSE,
+					       MALI_TRUE, MALI_TRUE);
+	}
+
+	mali_executor_unlock();
+	return _MALI_OSK_ERR_FAULT;
+}
+
+
+/*
+ * ---------- Implementation of static functions ----------
+ */
+
+void mali_executor_lock(void)
+{
+	_mali_osk_spinlock_irq_lock(mali_executor_lock_obj);
+	MALI_DEBUG_PRINT(5, ("Executor: lock taken\n"));
+}
+
+void mali_executor_unlock(void)
+{
+	MALI_DEBUG_PRINT(5, ("Executor: Releasing lock\n"));
+	_mali_osk_spinlock_irq_unlock(mali_executor_lock_obj);
+}
+
+static mali_bool mali_executor_is_suspended(void *data)
+{
+	mali_bool ret;
+
+	/* This callback does not use the data pointer. */
+	MALI_IGNORE(data);
+
+	mali_executor_lock();
+
+	ret = pause_count > 0 && !mali_executor_is_working();
+
+	mali_executor_unlock();
+
+	return ret;
+}
+
+static mali_bool mali_executor_is_working()
+{
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	return (0 != group_list_working_count ||
+		EXEC_STATE_WORKING == gp_group_state ||
+		EXEC_STATE_WORKING == virtual_group_state);
+}
+
+static void mali_executor_disable_empty_virtual(void)
+{
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(virtual_group_state != EXEC_STATE_EMPTY);
+	MALI_DEBUG_ASSERT(virtual_group_state != EXEC_STATE_WORKING);
+
+	if (mali_group_is_empty(virtual_group)) {
+		virtual_group_state = EXEC_STATE_EMPTY;
+	}
+}
+
+static mali_bool mali_executor_physical_rejoin_virtual(struct mali_group *group)
+{
+	mali_bool trigger_pm_update = MALI_FALSE;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	/* Only rejoining after job has completed (still active) */
+	MALI_DEBUG_ASSERT(MALI_GROUP_STATE_ACTIVE ==
+			  mali_group_get_state(group));
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(MALI_TRUE == mali_executor_has_virtual_group());
+	MALI_DEBUG_ASSERT(MALI_FALSE == mali_group_is_virtual(group));
+
+	/* Make sure group and virtual group have same status */
+
+	if (MALI_GROUP_STATE_INACTIVE == mali_group_get_state(virtual_group)) {
+		if (mali_group_deactivate(group)) {
+			trigger_pm_update = MALI_TRUE;
+		}
+
+		if (virtual_group_state == EXEC_STATE_EMPTY) {
+			virtual_group_state = EXEC_STATE_INACTIVE;
+		}
+	} else if (MALI_GROUP_STATE_ACTIVATION_PENDING ==
+		   mali_group_get_state(virtual_group)) {
+		/*
+		 * Activation is pending for virtual group, leave
+		 * this child group as active.
+		 */
+		if (virtual_group_state == EXEC_STATE_EMPTY) {
+			virtual_group_state = EXEC_STATE_INACTIVE;
+		}
+	} else {
+		MALI_DEBUG_ASSERT(MALI_GROUP_STATE_ACTIVE ==
+				  mali_group_get_state(virtual_group));
+
+		if (virtual_group_state == EXEC_STATE_EMPTY) {
+			virtual_group_state = EXEC_STATE_IDLE;
+		}
+	}
+
+	/* Remove group from idle list */
+	MALI_DEBUG_ASSERT(mali_executor_group_is_in_state(group,
+			  EXEC_STATE_IDLE));
+	_mali_osk_list_delinit(&group->executor_list);
+	group_list_idle_count--;
+
+	/*
+	 * And finally rejoin the virtual group
+	 * group will start working on same job as virtual_group,
+	 * if virtual_group is working on a job
+	 */
+	mali_group_add_group(virtual_group, group);
+
+	return trigger_pm_update;
+}
+
+static mali_bool mali_executor_has_virtual_group(void)
+{
+#if (defined(CONFIG_MALI450) || defined(CONFIG_MALI470))
+	return (NULL != virtual_group) ? MALI_TRUE : MALI_FALSE;
+#else
+	return MALI_FALSE;
+#endif /* (defined(CONFIG_MALI450) || defined(CONFIG_MALI470)) */
+}
+
+static mali_bool mali_executor_virtual_group_is_usable(void)
+{
+#if (defined(CONFIG_MALI450) || defined(CONFIG_MALI470))
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return ((EXEC_STATE_INACTIVE == virtual_group_state ||
+		 EXEC_STATE_IDLE == virtual_group_state) && (virtual_group->state != MALI_GROUP_STATE_ACTIVATION_PENDING)) ?
+	       MALI_TRUE : MALI_FALSE;
+#else
+	return MALI_FALSE;
+#endif /* (defined(CONFIG_MALI450) || defined(CONFIG_MALI470)) */
+}
+
+static mali_bool mali_executor_tackle_gp_bound(void)
+{
+	struct mali_pp_job *job;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	job = mali_scheduler_job_pp_physical_peek();
+
+	if (NULL != job && MALI_TRUE == mali_is_mali400()) {
+		if (0 < group_list_working_count &&
+		    mali_pp_job_is_large_and_unstarted(job)) {
+			return MALI_TRUE;
+		}
+	}
+
+	return MALI_FALSE;
+}
+
+static mali_bool mali_executor_schedule_is_early_out(mali_bool *gpu_secure_mode_is_needed)
+{
+	struct mali_pp_job *next_pp_job_to_start = NULL;
+	struct mali_group *group;
+	struct mali_group *tmp_group;
+	struct mali_pp_job *physical_pp_job_working = NULL;
+	struct mali_pp_job *virtual_pp_job_working = NULL;
+	mali_bool gpu_working_in_protected_mode = MALI_FALSE;
+	mali_bool gpu_working_in_non_protected_mode = MALI_FALSE;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+
+	*gpu_secure_mode_is_needed = MALI_FALSE;
+
+	/* Check if the gpu secure mode is supported, exit if not.*/
+	if (MALI_FALSE == _mali_osk_gpu_secure_mode_is_supported()) {
+		return MALI_FALSE;
+	}
+
+	/* Check if need to set gpu secure mode for the next pp job,
+	 * get the next pp job that will be scheduled  if exist.
+	 */
+	next_pp_job_to_start = mali_scheduler_job_pp_next();
+
+	/* Check current pp physical/virtual running job is protected job or not if exist.*/
+	_MALI_OSK_LIST_FOREACHENTRY(group, tmp_group, &group_list_working,
+				    struct mali_group, executor_list) {
+		physical_pp_job_working = group->pp_running_job;
+		break;
+	}
+
+	if (EXEC_STATE_WORKING == virtual_group_state) {
+		virtual_pp_job_working = virtual_group->pp_running_job;
+	}
+
+	if (NULL != physical_pp_job_working) {
+		if (MALI_TRUE == mali_pp_job_is_protected_job(physical_pp_job_working)) {
+			gpu_working_in_protected_mode = MALI_TRUE;
+		} else {
+			gpu_working_in_non_protected_mode = MALI_TRUE;
+		}
+	} else if (NULL != virtual_pp_job_working) {
+		if (MALI_TRUE == mali_pp_job_is_protected_job(virtual_pp_job_working)) {
+			gpu_working_in_protected_mode = MALI_TRUE;
+		} else {
+			gpu_working_in_non_protected_mode = MALI_TRUE;
+		}
+	} else if (EXEC_STATE_WORKING == gp_group_state) {
+		gpu_working_in_non_protected_mode = MALI_TRUE;
+	}
+
+	/* If the next pp job is the protected pp job.*/
+	if ((NULL != next_pp_job_to_start) && MALI_TRUE == mali_pp_job_is_protected_job(next_pp_job_to_start)) {
+		/* if gp is working or any non-protected pp job is working now, unable to schedule protected pp job. */
+		if (MALI_TRUE == gpu_working_in_non_protected_mode)
+			return MALI_TRUE;
+
+		*gpu_secure_mode_is_needed = MALI_TRUE;
+		return MALI_FALSE;
+
+	}
+
+	if (MALI_TRUE == gpu_working_in_protected_mode) {
+		/* Unable to schedule non-protected pp job/gp job if exist protected pp running jobs*/
+		return MALI_TRUE;
+	}
+
+	return MALI_FALSE;
+}
+/*
+ * This is where jobs are actually started.
+ */
+static void mali_executor_schedule(void)
+{
+	u32 i;
+	u32 num_physical_needed = 0;
+	u32 num_physical_to_process = 0;
+	mali_bool trigger_pm_update = MALI_FALSE;
+	mali_bool deactivate_idle_group = MALI_TRUE;
+	mali_bool gpu_secure_mode_is_needed = MALI_FALSE;
+	mali_bool is_gpu_secure_mode = MALI_FALSE;
+	/* Physical groups + jobs to start in this function */
+	struct mali_group *groups_to_start[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS];
+	struct mali_pp_job *jobs_to_start[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS];
+	u32 sub_jobs_to_start[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS];
+	int num_jobs_to_start = 0;
+
+	/* Virtual job to start in this function */
+	struct mali_pp_job *virtual_job_to_start = NULL;
+
+	/* GP job to start in this function */
+	struct mali_gp_job *gp_job_to_start = NULL;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	if (pause_count > 0) {
+		/* Execution is suspended, don't schedule any jobs. */
+		return;
+	}
+
+	/* Lock needed in order to safely handle the job queues */
+	mali_scheduler_lock();
+
+	/* 1. Check the schedule if need to early out. */
+	if (MALI_TRUE == mali_executor_schedule_is_early_out(&gpu_secure_mode_is_needed)) {
+		mali_scheduler_unlock();
+		return;
+	}
+
+	/* 2. Activate gp firstly if have gp job queued. */
+	if ((EXEC_STATE_INACTIVE == gp_group_state)
+	    && (0 < mali_scheduler_job_gp_count())
+	    && (gpu_secure_mode_is_needed == MALI_FALSE)) {
+
+		enum mali_group_state state =
+			mali_group_activate(gp_group);
+		if (MALI_GROUP_STATE_ACTIVE == state) {
+			/* Set GP group state to idle */
+			gp_group_state = EXEC_STATE_IDLE;
+		} else {
+			trigger_pm_update = MALI_TRUE;
+		}
+	}
+
+	/* 3. Prepare as many physical groups as needed/possible */
+
+	num_physical_needed = mali_scheduler_job_physical_head_count(gpu_secure_mode_is_needed);
+
+	/* On mali-450 platform, we don't need to enter in this block frequently. */
+	if (0 < num_physical_needed) {
+
+		if (num_physical_needed <= group_list_idle_count) {
+			/* We have enough groups on idle list already */
+			num_physical_to_process = num_physical_needed;
+			num_physical_needed = 0;
+		} else {
+			/* We need to get a hold of some more groups */
+			num_physical_to_process = group_list_idle_count;
+			num_physical_needed -= group_list_idle_count;
+		}
+
+		if (0 < num_physical_needed) {
+
+			/* 3.1. Activate groups which are inactive */
+
+			struct mali_group *group;
+			struct mali_group *temp;
+
+			_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_inactive,
+						    struct mali_group, executor_list) {
+				enum mali_group_state state =
+					mali_group_activate(group);
+				if (MALI_GROUP_STATE_ACTIVE == state) {
+					/* Move from inactive to idle */
+					mali_executor_change_state_pp_physical(group,
+									       &group_list_inactive,
+									       &group_list_inactive_count,
+									       &group_list_idle,
+									       &group_list_idle_count);
+					num_physical_to_process++;
+				} else {
+					trigger_pm_update = MALI_TRUE;
+				}
+
+				num_physical_needed--;
+				if (0 == num_physical_needed) {
+					/* We have activated all the groups we need */
+					break;
+				}
+			}
+		}
+
+		if (mali_executor_virtual_group_is_usable()) {
+
+			/*
+			 * 3.2. And finally, steal and activate groups
+			 * from virtual group if we need even more
+			 */
+			while (0 < num_physical_needed) {
+				struct mali_group *group;
+
+				group = mali_group_acquire_group(virtual_group);
+				if (NULL != group) {
+					enum mali_group_state state;
+
+					mali_executor_disable_empty_virtual();
+
+					state = mali_group_activate(group);
+					if (MALI_GROUP_STATE_ACTIVE == state) {
+						/* Group is ready, add to idle list */
+						_mali_osk_list_add(
+							&group->executor_list,
+							&group_list_idle);
+						group_list_idle_count++;
+						num_physical_to_process++;
+					} else {
+						/*
+						 * Group is not ready yet,
+						 * add to inactive list
+						 */
+						_mali_osk_list_add(
+							&group->executor_list,
+							&group_list_inactive);
+						group_list_inactive_count++;
+
+						trigger_pm_update = MALI_TRUE;
+					}
+					num_physical_needed--;
+				} else {
+					/*
+					 * We could not get enough groups
+					 * from the virtual group.
+					 */
+					break;
+				}
+			}
+		}
+
+		/* 3.3. Assign physical jobs to groups */
+
+		if (0 < num_physical_to_process) {
+			struct mali_group *group;
+			struct mali_group *temp;
+
+			_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_idle,
+						    struct mali_group, executor_list) {
+				struct mali_pp_job *job = NULL;
+				u32 sub_job = MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS;
+
+				MALI_DEBUG_ASSERT(num_jobs_to_start <
+						  MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS);
+
+				MALI_DEBUG_ASSERT(0 <
+						  mali_scheduler_job_physical_head_count(gpu_secure_mode_is_needed));
+
+				/* If the next pp job is non-protected, check if gp bound now. */
+				if ((MALI_FALSE == gpu_secure_mode_is_needed)
+				    && (mali_executor_hint_is_enabled(MALI_EXECUTOR_HINT_GP_BOUND))
+				    && (MALI_TRUE == mali_executor_tackle_gp_bound())) {
+					/*
+					* We're gp bound,
+					* don't start this right now.
+					*/
+					deactivate_idle_group = MALI_FALSE;
+					num_physical_to_process = 0;
+					break;
+				}
+
+				job = mali_scheduler_job_pp_physical_get(
+					      &sub_job);
+
+				if (MALI_FALSE == gpu_secure_mode_is_needed) {
+					MALI_DEBUG_ASSERT(MALI_FALSE == mali_pp_job_is_protected_job(job));
+				} else {
+					MALI_DEBUG_ASSERT(MALI_TRUE == mali_pp_job_is_protected_job(job));
+				}
+
+				MALI_DEBUG_ASSERT_POINTER(job);
+				MALI_DEBUG_ASSERT(sub_job <= MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS);
+
+				/* Put job + group on list of jobs to start later on */
+
+				groups_to_start[num_jobs_to_start] = group;
+				jobs_to_start[num_jobs_to_start] = job;
+				sub_jobs_to_start[num_jobs_to_start] = sub_job;
+				num_jobs_to_start++;
+
+				/* Move group from idle to working */
+				mali_executor_change_state_pp_physical(group,
+								       &group_list_idle,
+								       &group_list_idle_count,
+								       &group_list_working,
+								       &group_list_working_count);
+
+				num_physical_to_process--;
+				if (0 == num_physical_to_process) {
+					/* Got all we needed */
+					break;
+				}
+			}
+		}
+	}
+
+	/* 4. Deactivate idle pp group , must put deactive here before active vitual group
+	 *    for cover case first only has physical job in normal queue but group inactive,
+	 *    so delay the job start go to active group, when group activated,
+	 *    call scheduler again, but now if we get high queue virtual job,
+	 *    we will do nothing in schedule cause executor schedule stop
+	 */
+
+	if (MALI_TRUE == mali_executor_deactivate_list_idle(deactivate_idle_group
+			&& (!mali_timeline_has_physical_pp_job()))) {
+		trigger_pm_update = MALI_TRUE;
+	}
+
+	/* 5. Activate virtual group, if needed */
+	if (EXEC_STATE_INACTIVE == virtual_group_state &&
+	    MALI_TRUE ==  mali_scheduler_job_next_is_virtual()) {
+		struct mali_pp_job *virtual_job = mali_scheduler_job_pp_virtual_peek();
+		if ((MALI_FALSE == gpu_secure_mode_is_needed && MALI_FALSE == mali_pp_job_is_protected_job(virtual_job))
+		    || (MALI_TRUE == gpu_secure_mode_is_needed && MALI_TRUE == mali_pp_job_is_protected_job(virtual_job))) {
+			enum mali_group_state state =
+				mali_group_activate(virtual_group);
+			if (MALI_GROUP_STATE_ACTIVE == state) {
+				/* Set virtual group state to idle */
+				virtual_group_state = EXEC_STATE_IDLE;
+			} else {
+				trigger_pm_update = MALI_TRUE;
+			}
+		}
+	}
+
+	/* 6. To power up group asap,  trigger pm update only when no need to swith the gpu mode. */
+
+	is_gpu_secure_mode = _mali_osk_gpu_secure_mode_is_enabled();
+
+	if ((MALI_FALSE == gpu_secure_mode_is_needed && MALI_FALSE == is_gpu_secure_mode)
+	    || (MALI_TRUE == gpu_secure_mode_is_needed && MALI_TRUE == is_gpu_secure_mode)) {
+		if (MALI_TRUE == trigger_pm_update) {
+			trigger_pm_update = MALI_FALSE;
+			mali_pm_update_async();
+		}
+	}
+
+	/* 7. Assign jobs to idle virtual group (or deactivate if no job) */
+
+	if (EXEC_STATE_IDLE == virtual_group_state) {
+		if (MALI_TRUE == mali_scheduler_job_next_is_virtual()) {
+			struct mali_pp_job *virtual_job = mali_scheduler_job_pp_virtual_peek();
+			if ((MALI_FALSE == gpu_secure_mode_is_needed && MALI_FALSE == mali_pp_job_is_protected_job(virtual_job))
+			    || (MALI_TRUE == gpu_secure_mode_is_needed && MALI_TRUE == mali_pp_job_is_protected_job(virtual_job))) {
+				virtual_job_to_start =
+					mali_scheduler_job_pp_virtual_get();
+				virtual_group_state = EXEC_STATE_WORKING;
+			}
+		} else if (!mali_timeline_has_virtual_pp_job()) {
+			virtual_group_state = EXEC_STATE_INACTIVE;
+
+			if (mali_group_deactivate(virtual_group)) {
+				trigger_pm_update = MALI_TRUE;
+			}
+		}
+	}
+
+	/* 8. Assign job to idle GP group (or deactivate if no job) */
+
+	if (EXEC_STATE_IDLE == gp_group_state && MALI_FALSE == gpu_secure_mode_is_needed) {
+		if (0 < mali_scheduler_job_gp_count()) {
+			gp_job_to_start = mali_scheduler_job_gp_get();
+			gp_group_state = EXEC_STATE_WORKING;
+		} else if (!mali_timeline_has_gp_job()) {
+			gp_group_state = EXEC_STATE_INACTIVE;
+			if (mali_group_deactivate(gp_group)) {
+				trigger_pm_update = MALI_TRUE;
+			}
+		}
+	}
+
+	/* 9. We no longer need the schedule/queue lock */
+
+	mali_scheduler_unlock();
+
+	/* 10. start jobs */
+	if (NULL != virtual_job_to_start) {
+		MALI_DEBUG_ASSERT(!mali_group_pp_is_active(virtual_group));
+		mali_group_start_pp_job(virtual_group,
+					virtual_job_to_start, 0, is_gpu_secure_mode);
+	}
+
+	for (i = 0; i < num_jobs_to_start; i++) {
+		MALI_DEBUG_ASSERT(!mali_group_pp_is_active(
+					  groups_to_start[i]));
+		mali_group_start_pp_job(groups_to_start[i],
+					jobs_to_start[i],
+					sub_jobs_to_start[i], is_gpu_secure_mode);
+	}
+
+	MALI_DEBUG_ASSERT_POINTER(gp_group);
+
+	if (NULL != gp_job_to_start) {
+		MALI_DEBUG_ASSERT(!mali_group_gp_is_active(gp_group));
+		mali_group_start_gp_job(gp_group, gp_job_to_start, is_gpu_secure_mode);
+	}
+
+	/* 11. Trigger any pending PM updates */
+	if (MALI_TRUE == trigger_pm_update) {
+		mali_pm_update_async();
+	}
+}
+
+/* Handler for deferred schedule requests */
+static void mali_executor_wq_schedule(void *arg)
+{
+	MALI_IGNORE(arg);
+	mali_executor_lock();
+	mali_executor_schedule();
+	mali_executor_unlock();
+}
+
+static void mali_executor_send_gp_oom_to_user(struct mali_gp_job *job)
+{
+	_mali_uk_gp_job_suspended_s *jobres;
+	_mali_osk_notification_t *notification;
+
+	notification = mali_gp_job_get_oom_notification(job);
+
+	/*
+	 * Remember the id we send to user space, so we have something to
+	 * verify when we get a response
+	 */
+	gp_returned_cookie = mali_gp_job_get_id(job);
+
+	jobres = (_mali_uk_gp_job_suspended_s *)notification->result_buffer;
+	jobres->user_job_ptr = mali_gp_job_get_user_id(job);
+	jobres->cookie = gp_returned_cookie;
+
+	mali_session_send_notification(mali_gp_job_get_session(job),
+				       notification);
+}
+static struct mali_gp_job *mali_executor_complete_gp(struct mali_group *group,
+		mali_bool success)
+{
+	struct mali_gp_job *job;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	/* Extracts the needed HW status from core and reset */
+	job = mali_group_complete_gp(group, success);
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	/* Core is now ready to go into idle list */
+	gp_group_state = EXEC_STATE_IDLE;
+
+	/* This will potentially queue more GP and PP jobs */
+	mali_timeline_tracker_release(&job->tracker);
+
+	/* Signal PP job */
+	mali_gp_job_signal_pp_tracker(job, success);
+
+	return job;
+}
+
+static struct mali_pp_job *mali_executor_complete_pp(struct mali_group *group,
+		mali_bool success)
+{
+	struct mali_pp_job *job;
+	u32 sub_job;
+	mali_bool job_is_done;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	/* Extracts the needed HW status from core and reset */
+	job = mali_group_complete_pp(group, success, &sub_job);
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	/* Core is now ready to go into idle list */
+	if (mali_group_is_virtual(group)) {
+		virtual_group_state = EXEC_STATE_IDLE;
+	} else {
+		/* Move from working to idle state */
+		mali_executor_change_state_pp_physical(group,
+						       &group_list_working,
+						       &group_list_working_count,
+						       &group_list_idle,
+						       &group_list_idle_count);
+	}
+
+	/* It is the executor module which owns the jobs themselves by now */
+	mali_pp_job_mark_sub_job_completed(job, success);
+	job_is_done = mali_pp_job_is_complete(job);
+
+	if (job_is_done) {
+		/* This will potentially queue more GP and PP jobs */
+		mali_timeline_tracker_release(&job->tracker);
+	}
+
+	return job;
+}
+
+static void mali_executor_complete_group(struct mali_group *group,
+		mali_bool success,
+		struct mali_gp_job **gp_job_done,
+		struct mali_pp_job **pp_job_done)
+{
+	struct mali_gp_core *gp_core = mali_group_get_gp_core(group);
+	struct mali_pp_core *pp_core = mali_group_get_pp_core(group);
+	struct mali_gp_job *gp_job = NULL;
+	struct mali_pp_job *pp_job = NULL;
+	mali_bool pp_job_is_done = MALI_TRUE;
+
+	if (NULL != gp_core) {
+		gp_job = mali_executor_complete_gp(group, success);
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(pp_core);
+		MALI_IGNORE(pp_core);
+		pp_job = mali_executor_complete_pp(group, success);
+
+		pp_job_is_done = mali_pp_job_is_complete(pp_job);
+	}
+
+	if (pause_count > 0) {
+		/* Execution has been suspended */
+
+		if (!mali_executor_is_working()) {
+			/* Last job completed, wake up sleepers */
+			_mali_osk_wait_queue_wake_up(
+				executor_working_wait_queue);
+		}
+	} else if (MALI_TRUE == mali_group_disable_requested(group)) {
+		mali_executor_core_scale_in_group_complete(group);
+
+		mali_executor_schedule();
+	} else {
+		/* try to schedule new jobs */
+		mali_executor_schedule();
+	}
+
+	if (NULL != gp_job) {
+		MALI_DEBUG_ASSERT_POINTER(gp_job_done);
+		*gp_job_done = gp_job;
+	} else if (pp_job_is_done) {
+		MALI_DEBUG_ASSERT_POINTER(pp_job);
+		MALI_DEBUG_ASSERT_POINTER(pp_job_done);
+		*pp_job_done = pp_job;
+	}
+}
+
+static void mali_executor_change_state_pp_physical(struct mali_group *group,
+		_mali_osk_list_t *old_list,
+		u32 *old_count,
+		_mali_osk_list_t *new_list,
+		u32 *new_count)
+{
+	/*
+	 * It's a bit more complicated to change the state for the physical PP
+	 * groups since their state is determined by the list they are on.
+	 */
+#if defined(DEBUG)
+	mali_bool found = MALI_FALSE;
+	struct mali_group *group_iter;
+	struct mali_group *temp;
+	u32 old_counted = 0;
+	u32 new_counted = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(old_list);
+	MALI_DEBUG_ASSERT_POINTER(old_count);
+	MALI_DEBUG_ASSERT_POINTER(new_list);
+	MALI_DEBUG_ASSERT_POINTER(new_count);
+
+	/*
+	 * Verify that group is present on old list,
+	 * and that the count is correct
+	 */
+
+	_MALI_OSK_LIST_FOREACHENTRY(group_iter, temp, old_list,
+				    struct mali_group, executor_list) {
+		old_counted++;
+		if (group == group_iter) {
+			found = MALI_TRUE;
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(group_iter, temp, new_list,
+				    struct mali_group, executor_list) {
+		new_counted++;
+	}
+
+	if (MALI_FALSE == found) {
+		if (old_list == &group_list_idle) {
+			MALI_DEBUG_PRINT(1, (" old Group list is idle,"));
+		} else if (old_list == &group_list_inactive) {
+			MALI_DEBUG_PRINT(1, (" old Group list is inactive,"));
+		} else if (old_list == &group_list_working) {
+			MALI_DEBUG_PRINT(1, (" old Group list is working,"));
+		} else if (old_list == &group_list_disabled) {
+			MALI_DEBUG_PRINT(1, (" old Group list is disable,"));
+		}
+
+		if (MALI_TRUE == mali_executor_group_is_in_state(group, EXEC_STATE_WORKING)) {
+			MALI_DEBUG_PRINT(1, (" group in working \n"));
+		} else if (MALI_TRUE == mali_executor_group_is_in_state(group, EXEC_STATE_INACTIVE)) {
+			MALI_DEBUG_PRINT(1, (" group in inactive \n"));
+		} else if (MALI_TRUE == mali_executor_group_is_in_state(group, EXEC_STATE_IDLE)) {
+			MALI_DEBUG_PRINT(1, (" group in idle \n"));
+		} else if (MALI_TRUE == mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED)) {
+			MALI_DEBUG_PRINT(1, (" but group in disabled \n"));
+		}
+	}
+
+	MALI_DEBUG_ASSERT(MALI_TRUE == found);
+	MALI_DEBUG_ASSERT(0 < (*old_count));
+	MALI_DEBUG_ASSERT((*old_count) == old_counted);
+	MALI_DEBUG_ASSERT((*new_count) == new_counted);
+#endif
+
+	_mali_osk_list_move(&group->executor_list, new_list);
+	(*old_count)--;
+	(*new_count)++;
+}
+
+static void mali_executor_set_state_pp_physical(struct mali_group *group,
+		_mali_osk_list_t *new_list,
+		u32 *new_count)
+{
+	_mali_osk_list_add(&group->executor_list, new_list);
+	(*new_count)++;
+}
+
+static mali_bool mali_executor_group_is_in_state(struct mali_group *group,
+		enum mali_executor_state_t state)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	if (gp_group == group) {
+		if (gp_group_state == state) {
+			return MALI_TRUE;
+		}
+	} else if (virtual_group == group || mali_group_is_in_virtual(group)) {
+		if (virtual_group_state == state) {
+			return MALI_TRUE;
+		}
+	} else {
+		/* Physical PP group */
+		struct mali_group *group_iter;
+		struct mali_group *temp;
+		_mali_osk_list_t *list;
+
+		if (EXEC_STATE_DISABLED == state) {
+			list = &group_list_disabled;
+		} else if (EXEC_STATE_INACTIVE == state) {
+			list = &group_list_inactive;
+		} else if (EXEC_STATE_IDLE == state) {
+			list = &group_list_idle;
+		} else {
+			MALI_DEBUG_ASSERT(EXEC_STATE_WORKING == state);
+			list = &group_list_working;
+		}
+
+		_MALI_OSK_LIST_FOREACHENTRY(group_iter, temp, list,
+					    struct mali_group, executor_list) {
+			if (group_iter == group) {
+				return MALI_TRUE;
+			}
+		}
+	}
+
+	/* group not in correct state */
+	return MALI_FALSE;
+}
+
+static void mali_executor_group_enable_internal(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED));
+
+	/* Put into inactive state (== "lowest" enabled state) */
+	if (group == gp_group) {
+		MALI_DEBUG_ASSERT(EXEC_STATE_DISABLED == gp_group_state);
+		gp_group_state = EXEC_STATE_INACTIVE;
+	} else {
+		mali_executor_change_state_pp_physical(group,
+						       &group_list_disabled,
+						       &group_list_disabled_count,
+						       &group_list_inactive,
+						       &group_list_inactive_count);
+
+		++num_physical_pp_cores_enabled;
+		MALI_DEBUG_PRINT(4, ("Enabling group id %d \n", group->pp_core->core_id));
+	}
+
+	if (MALI_GROUP_STATE_ACTIVE == mali_group_activate(group)) {
+		MALI_DEBUG_ASSERT(MALI_TRUE == mali_group_power_is_on(group));
+
+		/* Move from inactive to idle */
+		if (group == gp_group) {
+			gp_group_state = EXEC_STATE_IDLE;
+		} else {
+			mali_executor_change_state_pp_physical(group,
+							       &group_list_inactive,
+							       &group_list_inactive_count,
+							       &group_list_idle,
+							       &group_list_idle_count);
+
+			if (mali_executor_has_virtual_group()) {
+				if (mali_executor_physical_rejoin_virtual(group)) {
+					mali_pm_update_async();
+				}
+			}
+		}
+	} else {
+		mali_pm_update_async();
+	}
+}
+
+static void mali_executor_group_disable_internal(struct mali_group *group)
+{
+	mali_bool working;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(!mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED));
+
+	working = mali_executor_group_is_in_state(group, EXEC_STATE_WORKING);
+	if (MALI_TRUE == working) {
+		/** Group to be disabled once it completes current work,
+		 * when virtual group completes, also check child groups for this flag */
+		mali_group_set_disable_request(group, MALI_TRUE);
+		return;
+	}
+
+	/* Put into disabled state */
+	if (group == gp_group) {
+		/* GP group */
+		MALI_DEBUG_ASSERT(EXEC_STATE_WORKING != gp_group_state);
+		gp_group_state = EXEC_STATE_DISABLED;
+	} else {
+		if (mali_group_is_in_virtual(group)) {
+			/* A child group of virtual group. move the specific group from virtual group */
+			MALI_DEBUG_ASSERT(EXEC_STATE_WORKING != virtual_group_state);
+
+			mali_executor_set_state_pp_physical(group,
+							    &group_list_disabled,
+							    &group_list_disabled_count);
+
+			mali_group_remove_group(virtual_group, group);
+			mali_executor_disable_empty_virtual();
+		} else {
+			mali_executor_change_group_status_disabled(group);
+		}
+
+		--num_physical_pp_cores_enabled;
+		MALI_DEBUG_PRINT(4, ("Disabling group id %d \n", group->pp_core->core_id));
+	}
+
+	if (MALI_GROUP_STATE_INACTIVE != group->state) {
+		if (MALI_TRUE == mali_group_deactivate(group)) {
+			mali_pm_update_async();
+		}
+	}
+}
+
+static void mali_executor_notify_core_change(u32 num_cores)
+{
+	mali_bool done = MALI_FALSE;
+
+	if (mali_is_mali450() || mali_is_mali470()) {
+		return;
+	}
+
+	/*
+	 * This function gets a bit complicated because we can't hold the session lock while
+	 * allocating notification objects.
+	 */
+	while (!done) {
+		u32 i;
+		u32 num_sessions_alloc;
+		u32 num_sessions_with_lock;
+		u32 used_notification_objects = 0;
+		_mali_osk_notification_t **notobjs;
+
+		/* Pre allocate the number of notifications objects we need right now (might change after lock has been taken) */
+		num_sessions_alloc = mali_session_get_count();
+		if (0 == num_sessions_alloc) {
+			/* No sessions to report to */
+			return;
+		}
+
+		notobjs = (_mali_osk_notification_t **)_mali_osk_malloc(sizeof(_mali_osk_notification_t *) * num_sessions_alloc);
+		if (NULL == notobjs) {
+			MALI_PRINT_ERROR(("Failed to notify user space session about num PP core change (alloc failure)\n"));
+			/* there is probably no point in trying again, system must be really low on memory and probably unusable now anyway */
+			return;
+		}
+
+		for (i = 0; i < num_sessions_alloc; i++) {
+			notobjs[i] = _mali_osk_notification_create(_MALI_NOTIFICATION_PP_NUM_CORE_CHANGE, sizeof(_mali_uk_pp_num_cores_changed_s));
+			if (NULL != notobjs[i]) {
+				_mali_uk_pp_num_cores_changed_s *data = notobjs[i]->result_buffer;
+				data->number_of_enabled_cores = num_cores;
+			} else {
+				MALI_PRINT_ERROR(("Failed to notify user space session about num PP core change (alloc failure %u)\n", i));
+			}
+		}
+
+		mali_session_lock();
+
+		/* number of sessions will not change while we hold the lock */
+		num_sessions_with_lock = mali_session_get_count();
+
+		if (num_sessions_alloc >= num_sessions_with_lock) {
+			/* We have allocated enough notification objects for all the sessions atm */
+			struct mali_session_data *session, *tmp;
+			MALI_SESSION_FOREACH(session, tmp, link) {
+				MALI_DEBUG_ASSERT(used_notification_objects < num_sessions_alloc);
+				if (NULL != notobjs[used_notification_objects]) {
+					mali_session_send_notification(session, notobjs[used_notification_objects]);
+					notobjs[used_notification_objects] = NULL; /* Don't track this notification object any more */
+				}
+				used_notification_objects++;
+			}
+			done = MALI_TRUE;
+		}
+
+		mali_session_unlock();
+
+		/* Delete any remaining/unused notification objects */
+		for (; used_notification_objects < num_sessions_alloc; used_notification_objects++) {
+			if (NULL != notobjs[used_notification_objects]) {
+				_mali_osk_notification_delete(notobjs[used_notification_objects]);
+			}
+		}
+
+		_mali_osk_free(notobjs);
+	}
+}
+
+static mali_bool mali_executor_core_scaling_is_done(void *data)
+{
+	u32 i;
+	u32 num_groups;
+	mali_bool ret = MALI_TRUE;
+
+	MALI_IGNORE(data);
+
+	mali_executor_lock();
+
+	num_groups = mali_group_get_glob_num_groups();
+
+	for (i = 0; i < num_groups; i++) {
+		struct mali_group *group = mali_group_get_glob_group(i);
+
+		if (NULL != group) {
+			if (MALI_TRUE == group->disable_requested && NULL != mali_group_get_pp_core(group)) {
+				ret = MALI_FALSE;
+				break;
+			}
+		}
+	}
+	mali_executor_unlock();
+
+	return ret;
+}
+
+static void mali_executor_wq_notify_core_change(void *arg)
+{
+	MALI_IGNORE(arg);
+
+	if (mali_is_mali450() || mali_is_mali470()) {
+		return;
+	}
+
+	_mali_osk_wait_queue_wait_event(executor_notify_core_change_wait_queue,
+					mali_executor_core_scaling_is_done, NULL);
+
+	mali_executor_notify_core_change(num_physical_pp_cores_enabled);
+}
+
+/**
+ * Clear all disable request from the _last_ core scaling behavior.
+ */
+static void mali_executor_core_scaling_reset(void)
+{
+	u32 i;
+	u32 num_groups;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	num_groups = mali_group_get_glob_num_groups();
+
+	for (i = 0; i < num_groups; i++) {
+		struct mali_group *group = mali_group_get_glob_group(i);
+
+		if (NULL != group) {
+			group->disable_requested = MALI_FALSE;
+		}
+	}
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		core_scaling_delay_up_mask[i] = 0;
+	}
+}
+
+static void mali_executor_core_scale(unsigned int target_core_nr)
+{
+	int current_core_scaling_mask[MALI_MAX_NUMBER_OF_DOMAINS] = { 0 };
+	int target_core_scaling_mask[MALI_MAX_NUMBER_OF_DOMAINS] = { 0 };
+	int i;
+
+	MALI_DEBUG_ASSERT(0 < target_core_nr);
+	MALI_DEBUG_ASSERT(num_physical_pp_cores_total >= target_core_nr);
+
+	mali_executor_lock();
+
+	if (target_core_nr < num_physical_pp_cores_enabled) {
+		MALI_DEBUG_PRINT(2, ("Requesting %d cores: disabling %d cores\n", target_core_nr, num_physical_pp_cores_enabled - target_core_nr));
+	} else {
+		MALI_DEBUG_PRINT(2, ("Requesting %d cores: enabling %d cores\n", target_core_nr, target_core_nr - num_physical_pp_cores_enabled));
+	}
+
+	/* When a new core scaling request is comming,  we should remove the un-doing
+	 * part of the last core scaling request.  It's safe because we have only one
+	 * lock(executor lock) protection. */
+	mali_executor_core_scaling_reset();
+
+	mali_pm_get_best_power_cost_mask(num_physical_pp_cores_enabled, current_core_scaling_mask);
+	mali_pm_get_best_power_cost_mask(target_core_nr, target_core_scaling_mask);
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		target_core_scaling_mask[i] = target_core_scaling_mask[i] - current_core_scaling_mask[i];
+		MALI_DEBUG_PRINT(5, ("target_core_scaling_mask[%d] = %d\n", i, target_core_scaling_mask[i]));
+	}
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		if (0 > target_core_scaling_mask[i]) {
+			struct mali_pm_domain *domain;
+
+			domain = mali_pm_domain_get_from_index(i);
+
+			/* Domain is valid and has pp cores */
+			if ((NULL != domain) && !(_mali_osk_list_empty(&domain->group_list))) {
+				struct mali_group *group;
+				struct mali_group *temp;
+
+				_MALI_OSK_LIST_FOREACHENTRY(group, temp, &domain->group_list, struct mali_group, pm_domain_list) {
+					if (NULL != mali_group_get_pp_core(group) && (!mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED))
+					    && (!mali_group_is_virtual(group))) {
+						mali_executor_group_disable_internal(group);
+						target_core_scaling_mask[i]++;
+						if ((0 == target_core_scaling_mask[i])) {
+							break;
+						}
+
+					}
+				}
+			}
+		}
+	}
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		/**
+		 * Target_core_scaling_mask[i] is bigger than 0,
+		 * means we need to enable some pp cores in
+		 * this domain whose domain index is i.
+		 */
+		if (0 < target_core_scaling_mask[i]) {
+			struct mali_pm_domain *domain;
+
+			if (num_physical_pp_cores_enabled >= target_core_nr) {
+				break;
+			}
+
+			domain = mali_pm_domain_get_from_index(i);
+
+			/* Domain is valid and has pp cores */
+			if ((NULL != domain) && !(_mali_osk_list_empty(&domain->group_list))) {
+				struct mali_group *group;
+				struct mali_group *temp;
+
+				_MALI_OSK_LIST_FOREACHENTRY(group, temp, &domain->group_list, struct mali_group, pm_domain_list) {
+					if (NULL != mali_group_get_pp_core(group) && mali_executor_group_is_in_state(group, EXEC_STATE_DISABLED)
+					    && (!mali_group_is_virtual(group))) {
+						mali_executor_group_enable_internal(group);
+						target_core_scaling_mask[i]--;
+
+						if ((0 == target_core_scaling_mask[i]) || num_physical_pp_cores_enabled == target_core_nr) {
+							break;
+						}
+					}
+				}
+			}
+		}
+	}
+
+	/**
+	 * Here, we may still have some pp cores not been enabled because of some
+	 * pp cores need to be disabled are still in working state.
+	 */
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		if (0 < target_core_scaling_mask[i]) {
+			core_scaling_delay_up_mask[i] = target_core_scaling_mask[i];
+		}
+	}
+
+	mali_executor_schedule();
+	mali_executor_unlock();
+}
+
+static void mali_executor_core_scale_in_group_complete(struct mali_group *group)
+{
+	int num_pp_cores_disabled = 0;
+	int num_pp_cores_to_enable = 0;
+	int i;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(MALI_TRUE == mali_group_disable_requested(group));
+
+	/* Disable child group of virtual group */
+	if (mali_group_is_virtual(group)) {
+		struct mali_group *child;
+		struct mali_group *temp;
+
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+			if (MALI_TRUE == mali_group_disable_requested(child)) {
+				mali_group_set_disable_request(child, MALI_FALSE);
+				mali_executor_group_disable_internal(child);
+				num_pp_cores_disabled++;
+			}
+		}
+		mali_group_set_disable_request(group, MALI_FALSE);
+	} else {
+		mali_executor_group_disable_internal(group);
+		mali_group_set_disable_request(group, MALI_FALSE);
+		if (NULL != mali_group_get_pp_core(group)) {
+			num_pp_cores_disabled++;
+		}
+	}
+
+	num_pp_cores_to_enable = num_pp_cores_disabled;
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		if (0 < core_scaling_delay_up_mask[i]) {
+			struct mali_pm_domain *domain;
+
+			if (0 == num_pp_cores_to_enable) {
+				break;
+			}
+
+			domain = mali_pm_domain_get_from_index(i);
+
+			/* Domain is valid and has pp cores */
+			if ((NULL != domain) && !(_mali_osk_list_empty(&domain->group_list))) {
+				struct mali_group *disabled_group;
+				struct mali_group *temp;
+
+				_MALI_OSK_LIST_FOREACHENTRY(disabled_group, temp, &domain->group_list, struct mali_group, pm_domain_list) {
+					if (NULL != mali_group_get_pp_core(disabled_group) && mali_executor_group_is_in_state(disabled_group, EXEC_STATE_DISABLED)) {
+						mali_executor_group_enable_internal(disabled_group);
+						core_scaling_delay_up_mask[i]--;
+						num_pp_cores_to_enable--;
+
+						if ((0 == core_scaling_delay_up_mask[i]) || 0 == num_pp_cores_to_enable) {
+							break;
+						}
+					}
+				}
+			}
+		}
+	}
+
+	_mali_osk_wait_queue_wake_up(executor_notify_core_change_wait_queue);
+}
+
+static void mali_executor_change_group_status_disabled(struct mali_group *group)
+{
+	/* Physical PP group */
+	mali_bool idle;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	idle = mali_executor_group_is_in_state(group, EXEC_STATE_IDLE);
+	if (MALI_TRUE == idle) {
+		mali_executor_change_state_pp_physical(group,
+						       &group_list_idle,
+						       &group_list_idle_count,
+						       &group_list_disabled,
+						       &group_list_disabled_count);
+	} else {
+		mali_executor_change_state_pp_physical(group,
+						       &group_list_inactive,
+						       &group_list_inactive_count,
+						       &group_list_disabled,
+						       &group_list_disabled_count);
+	}
+}
+
+static mali_bool mali_executor_deactivate_list_idle(mali_bool deactivate_idle_group)
+{
+	mali_bool trigger_pm_update = MALI_FALSE;
+
+	if (group_list_idle_count > 0) {
+		if (mali_executor_has_virtual_group()) {
+
+			/* Rejoin virtual group on Mali-450 */
+
+			struct mali_group *group;
+			struct mali_group *temp;
+
+			_MALI_OSK_LIST_FOREACHENTRY(group, temp,
+						    &group_list_idle,
+						    struct mali_group, executor_list) {
+				if (mali_executor_physical_rejoin_virtual(
+					    group)) {
+					trigger_pm_update = MALI_TRUE;
+				}
+			}
+		} else if (deactivate_idle_group) {
+			struct mali_group *group;
+			struct mali_group *temp;
+
+			/* Deactivate group on Mali-300/400 */
+
+			_MALI_OSK_LIST_FOREACHENTRY(group, temp,
+						    &group_list_idle,
+						    struct mali_group, executor_list) {
+				if (mali_group_deactivate(group)) {
+					trigger_pm_update = MALI_TRUE;
+				}
+
+				/* Move from idle to inactive */
+				mali_executor_change_state_pp_physical(group,
+								       &group_list_idle,
+								       &group_list_idle_count,
+								       &group_list_inactive,
+								       &group_list_inactive_count);
+			}
+		}
+	}
+
+	return trigger_pm_update;
+}
+
+void mali_executor_running_status_print(void)
+{
+	struct mali_group *group = NULL;
+	struct mali_group *temp = NULL;
+
+	MALI_PRINT(("GP running job: %p\n", gp_group->gp_running_job));
+	if ((gp_group->gp_core) && (gp_group->is_working)) {
+		mali_group_dump_status(gp_group);
+	}
+	MALI_PRINT(("Physical PP groups in WORKING state (count = %u):\n", group_list_working_count));
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_working, struct mali_group, executor_list) {
+		MALI_PRINT(("PP running job: %p, subjob %d \n", group->pp_running_job, group->pp_running_sub_job));
+		mali_group_dump_status(group);
+	}
+	MALI_PRINT(("Physical PP groups in INACTIVE state (count = %u):\n", group_list_inactive_count));
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_inactive, struct mali_group, executor_list) {
+		MALI_PRINT(("\tPP status %d, SW power: %s\n", group->state, group->power_is_on ? "On" : "Off"));
+		MALI_PRINT(("\tPP #%d: %s\n", group->pp_core->core_id, group->pp_core->hw_core.description));
+	}
+	MALI_PRINT(("Physical PP groups in IDLE state (count = %u):\n", group_list_idle_count));
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_idle, struct mali_group, executor_list) {
+		MALI_PRINT(("\tPP status %d, SW power: %s\n", group->state, group->power_is_on ? "On" : "Off"));
+		MALI_PRINT(("\tPP #%d: %s\n", group->pp_core->core_id, group->pp_core->hw_core.description));
+	}
+	MALI_PRINT(("Physical PP groups in DISABLED state (count = %u):\n", group_list_disabled_count));
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &group_list_disabled, struct mali_group, executor_list) {
+		MALI_PRINT(("\tPP status %d, SW power: %s\n", group->state, group->power_is_on ? "On" : "Off"));
+		MALI_PRINT(("\tPP #%d: %s\n", group->pp_core->core_id, group->pp_core->hw_core.description));
+	}
+
+	if (mali_executor_has_virtual_group()) {
+		MALI_PRINT(("Virtual group running job: %p\n", virtual_group->pp_running_job));
+		MALI_PRINT(("Virtual group status: %d\n", virtual_group_state));
+		MALI_PRINT(("Virtual group->status: %d\n", virtual_group->state));
+		MALI_PRINT(("\tSW power: %s\n", virtual_group->power_is_on ? "On" : "Off"));
+		_MALI_OSK_LIST_FOREACHENTRY(group, temp, &virtual_group->group_list,
+					    struct mali_group, group_list) {
+			int i = 0;
+			MALI_PRINT(("\tchild group(%s) running job: %p\n", group->pp_core->hw_core.description, group->pp_running_job));
+			MALI_PRINT(("\tchild group(%s)->status: %d\n", group->pp_core->hw_core.description, group->state));
+			MALI_PRINT(("\tchild group(%s) SW power: %s\n", group->pp_core->hw_core.description, group->power_is_on ? "On" : "Off"));
+			if (group->pm_domain) {
+				MALI_PRINT(("\tPower domain: id %u\n", mali_pm_domain_get_id(group->pm_domain)));
+				MALI_PRINT(("\tMask:0x%04x \n", mali_pm_domain_get_mask(group->pm_domain)));
+				MALI_PRINT(("\tUse-count:%u \n", mali_pm_domain_get_use_count(group->pm_domain)));
+				MALI_PRINT(("\tCurrent power status:%s \n", (mali_pm_domain_get_mask(group->pm_domain)& mali_pm_get_current_mask()) ? "On" : "Off"));
+				MALI_PRINT(("\tWanted  power status:%s \n", (mali_pm_domain_get_mask(group->pm_domain)& mali_pm_get_wanted_mask()) ? "On" : "Off"));
+			}
+
+			for (i = 0; i < 2; i++) {
+				if (NULL != group->l2_cache_core[i]) {
+					struct mali_pm_domain *domain;
+					domain = mali_l2_cache_get_pm_domain(group->l2_cache_core[i]);
+					MALI_PRINT(("\t L2(index %d) group SW power: %s\n", i, group->l2_cache_core[i]->power_is_on ? "On" : "Off"));
+					if (domain) {
+						MALI_PRINT(("\tL2 Power domain: id %u\n", mali_pm_domain_get_id(domain)));
+						MALI_PRINT(("\tL2 Mask:0x%04x \n", mali_pm_domain_get_mask(domain)));
+						MALI_PRINT(("\tL2 Use-count:%u \n", mali_pm_domain_get_use_count(domain)));
+						MALI_PRINT(("\tL2 Current power status:%s \n", (mali_pm_domain_get_mask(domain) & mali_pm_get_current_mask()) ? "On" : "Off"));
+						MALI_PRINT(("\tL2 Wanted  power status:%s \n", (mali_pm_domain_get_mask(domain) & mali_pm_get_wanted_mask()) ? "On" : "Off"));
+					}
+				}
+			}
+		}
+		if (EXEC_STATE_WORKING == virtual_group_state) {
+			mali_group_dump_status(virtual_group);
+		}
+	}
+}
+
+void mali_executor_status_dump(void)
+{
+	mali_executor_lock();
+	mali_scheduler_lock();
+
+	/* print schedule queue status */
+	mali_scheduler_gp_pp_job_queue_print();
+
+	mali_scheduler_unlock();
+	mali_executor_unlock();
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_executor.h b/drivers/gpu/arm/mali400/common/mali_executor.h
--- a/drivers/gpu/arm/mali400/common/mali_executor.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_executor.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012, 2014-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_EXECUTOR_H__
+#define __MALI_EXECUTOR_H__
+
+#include "mali_osk.h"
+#include "mali_scheduler_types.h"
+#include "mali_kernel_common.h"
+
+typedef enum {
+	MALI_EXECUTOR_HINT_GP_BOUND = 0
+#define MALI_EXECUTOR_HINT_MAX        1
+} mali_executor_hint;
+
+extern mali_bool mali_executor_hints[MALI_EXECUTOR_HINT_MAX];
+
+/* forward declare struct instead of using include */
+struct mali_session_data;
+struct mali_group;
+struct mali_pp_core;
+
+extern _mali_osk_spinlock_irq_t *mali_executor_lock_obj;
+
+#define MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD() MALI_DEBUG_ASSERT_LOCK_HELD(mali_executor_lock_obj);
+
+_mali_osk_errcode_t mali_executor_initialize(void);
+void mali_executor_terminate(void);
+
+void mali_executor_populate(void);
+void mali_executor_depopulate(void);
+
+void mali_executor_suspend(void);
+void mali_executor_resume(void);
+
+u32 mali_executor_get_num_cores_total(void);
+u32 mali_executor_get_num_cores_enabled(void);
+struct mali_pp_core *mali_executor_get_virtual_pp(void);
+struct mali_group *mali_executor_get_virtual_group(void);
+
+void mali_executor_zap_all_active(struct mali_session_data *session);
+
+/**
+ * Schedule GP and PP according to bitmask.
+ *
+ * @param mask A scheduling bitmask.
+ * @param deferred_schedule MALI_TRUE if schedule should be deferred, MALI_FALSE if not.
+ */
+void mali_executor_schedule_from_mask(mali_scheduler_mask mask, mali_bool deferred_schedule);
+
+_mali_osk_errcode_t mali_executor_interrupt_gp(struct mali_group *group, mali_bool in_upper_half);
+_mali_osk_errcode_t mali_executor_interrupt_pp(struct mali_group *group, mali_bool in_upper_half);
+_mali_osk_errcode_t mali_executor_interrupt_mmu(struct mali_group *group, mali_bool in_upper_half);
+void mali_executor_group_power_up(struct mali_group *groups[], u32 num_groups);
+void mali_executor_group_power_down(struct mali_group *groups[], u32 num_groups);
+
+void mali_executor_abort_session(struct mali_session_data *session);
+
+void mali_executor_core_scaling_enable(void);
+void mali_executor_core_scaling_disable(void);
+mali_bool mali_executor_core_scaling_is_enabled(void);
+
+void mali_executor_group_enable(struct mali_group *group);
+void mali_executor_group_disable(struct mali_group *group);
+mali_bool mali_executor_group_is_disabled(struct mali_group *group);
+
+int mali_executor_set_perf_level(unsigned int target_core_nr, mali_bool override);
+
+#if MALI_STATE_TRACKING
+u32 mali_executor_dump_state(char *buf, u32 size);
+#endif
+
+MALI_STATIC_INLINE void mali_executor_hint_enable(mali_executor_hint hint)
+{
+	MALI_DEBUG_ASSERT(hint < MALI_EXECUTOR_HINT_MAX);
+	mali_executor_hints[hint] = MALI_TRUE;
+}
+
+MALI_STATIC_INLINE void mali_executor_hint_disable(mali_executor_hint hint)
+{
+	MALI_DEBUG_ASSERT(hint < MALI_EXECUTOR_HINT_MAX);
+	mali_executor_hints[hint] = MALI_FALSE;
+}
+
+MALI_STATIC_INLINE mali_bool mali_executor_hint_is_enabled(mali_executor_hint hint)
+{
+	MALI_DEBUG_ASSERT(hint < MALI_EXECUTOR_HINT_MAX);
+	return mali_executor_hints[hint];
+}
+
+void mali_executor_running_status_print(void);
+void mali_executor_status_dump(void);
+void mali_executor_lock(void);
+void mali_executor_unlock(void);
+#endif /* __MALI_EXECUTOR_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_gp.c b/drivers/gpu/arm/mali400/common/mali_gp.c
--- a/drivers/gpu/arm/mali400/common/mali_gp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_gp.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,357 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_gp.h"
+#include "mali_hw_core.h"
+#include "mali_group.h"
+#include "mali_osk.h"
+#include "regs/mali_gp_regs.h"
+#include "mali_kernel_common.h"
+#include "mali_kernel_core.h"
+#if defined(CONFIG_MALI400_PROFILING)
+#include "mali_osk_profiling.h"
+#endif
+
+static struct mali_gp_core *mali_global_gp_core = NULL;
+
+/* Interrupt handlers */
+static void mali_gp_irq_probe_trigger(void *data);
+static _mali_osk_errcode_t mali_gp_irq_probe_ack(void *data);
+
+struct mali_gp_core *mali_gp_create(const _mali_osk_resource_t *resource, struct mali_group *group)
+{
+	struct mali_gp_core *core = NULL;
+
+	MALI_DEBUG_ASSERT(NULL == mali_global_gp_core);
+	MALI_DEBUG_PRINT(2, ("Mali GP: Creating Mali GP core: %s\n", resource->description));
+
+	core = _mali_osk_malloc(sizeof(struct mali_gp_core));
+	if (NULL != core) {
+		if (_MALI_OSK_ERR_OK == mali_hw_core_create(&core->hw_core, resource, MALIGP2_REGISTER_ADDRESS_SPACE_SIZE)) {
+			_mali_osk_errcode_t ret;
+
+			ret = mali_gp_reset(core);
+
+			if (_MALI_OSK_ERR_OK == ret) {
+				ret = mali_group_add_gp_core(group, core);
+				if (_MALI_OSK_ERR_OK == ret) {
+					/* Setup IRQ handlers (which will do IRQ probing if needed) */
+					core->irq = _mali_osk_irq_init(resource->irq,
+								       mali_group_upper_half_gp,
+								       group,
+								       mali_gp_irq_probe_trigger,
+								       mali_gp_irq_probe_ack,
+								       core,
+								       resource->description);
+					if (NULL != core->irq) {
+						MALI_DEBUG_PRINT(4, ("Mali GP: set global gp core from 0x%08X to 0x%08X\n", mali_global_gp_core, core));
+						mali_global_gp_core = core;
+
+						return core;
+					} else {
+						MALI_PRINT_ERROR(("Mali GP: Failed to setup interrupt handlers for GP core %s\n", core->hw_core.description));
+					}
+					mali_group_remove_gp_core(group);
+				} else {
+					MALI_PRINT_ERROR(("Mali GP: Failed to add core %s to group\n", core->hw_core.description));
+				}
+			}
+			mali_hw_core_delete(&core->hw_core);
+		}
+
+		_mali_osk_free(core);
+	} else {
+		MALI_PRINT_ERROR(("Failed to allocate memory for GP core\n"));
+	}
+
+	return NULL;
+}
+
+void mali_gp_delete(struct mali_gp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	_mali_osk_irq_term(core->irq);
+	mali_hw_core_delete(&core->hw_core);
+	mali_global_gp_core = NULL;
+	_mali_osk_free(core);
+}
+
+void mali_gp_stop_bus(struct mali_gp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_CMD, MALIGP2_REG_VAL_CMD_STOP_BUS);
+}
+
+_mali_osk_errcode_t mali_gp_stop_bus_wait(struct mali_gp_core *core)
+{
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	/* Send the stop bus command. */
+	mali_gp_stop_bus(core);
+
+	/* Wait for bus to be stopped */
+	for (i = 0; i < MALI_REG_POLL_COUNT_SLOW; i++) {
+		if (mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_STATUS) & MALIGP2_REG_VAL_STATUS_BUS_STOPPED) {
+			break;
+		}
+	}
+
+	if (MALI_REG_POLL_COUNT_SLOW == i) {
+		MALI_PRINT_ERROR(("Mali GP: Failed to stop bus on %s\n", core->hw_core.description));
+		return _MALI_OSK_ERR_FAULT;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_gp_hard_reset(struct mali_gp_core *core)
+{
+	const u32 reset_wait_target_register = MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_LIMIT;
+	const u32 reset_invalid_value = 0xC0FFE000;
+	const u32 reset_check_value = 0xC01A0000;
+	const u32 reset_default_value = 0;
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+	MALI_DEBUG_PRINT(4, ("Mali GP: Hard reset of core %s\n", core->hw_core.description));
+
+	mali_hw_core_register_write(&core->hw_core, reset_wait_target_register, reset_invalid_value);
+
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_CMD, MALIGP2_REG_VAL_CMD_RESET);
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; i++) {
+		mali_hw_core_register_write(&core->hw_core, reset_wait_target_register, reset_check_value);
+		if (reset_check_value == mali_hw_core_register_read(&core->hw_core, reset_wait_target_register)) {
+			break;
+		}
+	}
+
+	if (MALI_REG_POLL_COUNT_FAST == i) {
+		MALI_PRINT_ERROR(("Mali GP: The hard reset loop didn't work, unable to recover\n"));
+	}
+
+	mali_hw_core_register_write(&core->hw_core, reset_wait_target_register, reset_default_value); /* set it back to the default */
+	/* Re-enable interrupts */
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_CLEAR, MALIGP2_REG_VAL_IRQ_MASK_ALL);
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_MASK, MALIGP2_REG_VAL_IRQ_MASK_USED);
+
+}
+
+void mali_gp_reset_async(struct mali_gp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	MALI_DEBUG_PRINT(4, ("Mali GP: Reset of core %s\n", core->hw_core.description));
+
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_MASK, 0); /* disable the IRQs */
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_CLEAR, MALI400GP_REG_VAL_IRQ_RESET_COMPLETED);
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_CMD, MALI400GP_REG_VAL_CMD_SOFT_RESET);
+
+}
+
+_mali_osk_errcode_t mali_gp_reset_wait(struct mali_gp_core *core)
+{
+	int i;
+	u32 rawstat = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; i++) {
+		rawstat = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_RAWSTAT);
+		if (rawstat & MALI400GP_REG_VAL_IRQ_RESET_COMPLETED) {
+			break;
+		}
+	}
+
+	if (i == MALI_REG_POLL_COUNT_FAST) {
+		MALI_PRINT_ERROR(("Mali GP: Failed to reset core %s, rawstat: 0x%08x\n",
+				  core->hw_core.description, rawstat));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Re-enable interrupts */
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_CLEAR, MALIGP2_REG_VAL_IRQ_MASK_ALL);
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_MASK, MALIGP2_REG_VAL_IRQ_MASK_USED);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_gp_reset(struct mali_gp_core *core)
+{
+	mali_gp_reset_async(core);
+	return mali_gp_reset_wait(core);
+}
+
+void mali_gp_job_start(struct mali_gp_core *core, struct mali_gp_job *job)
+{
+	u32 startcmd = 0;
+	u32 *frame_registers = mali_gp_job_get_frame_registers(job);
+	u32 counter_src0 = mali_gp_job_get_perf_counter_src0(job);
+	u32 counter_src1 = mali_gp_job_get_perf_counter_src1(job);
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	if (mali_gp_job_has_vs_job(job)) {
+		startcmd |= (u32) MALIGP2_REG_VAL_CMD_START_VS;
+	}
+
+	if (mali_gp_job_has_plbu_job(job)) {
+		startcmd |= (u32) MALIGP2_REG_VAL_CMD_START_PLBU;
+	}
+
+	MALI_DEBUG_ASSERT(0 != startcmd);
+
+	mali_hw_core_register_write_array_relaxed(&core->hw_core, MALIGP2_REG_ADDR_MGMT_VSCL_START_ADDR, frame_registers, MALIGP2_NUM_REGS_FRAME);
+
+	if (MALI_HW_CORE_NO_COUNTER != counter_src0) {
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_SRC, counter_src0);
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_ENABLE, MALIGP2_REG_VAL_PERF_CNT_ENABLE);
+	}
+	if (MALI_HW_CORE_NO_COUNTER != counter_src1) {
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PERF_CNT_1_SRC, counter_src1);
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PERF_CNT_1_ENABLE, MALIGP2_REG_VAL_PERF_CNT_ENABLE);
+	}
+
+	MALI_DEBUG_PRINT(3, ("Mali GP: Starting job (0x%08x) on core %s with command 0x%08X\n", job, core->hw_core.description, startcmd));
+
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALIGP2_REG_ADDR_MGMT_CMD, MALIGP2_REG_VAL_CMD_UPDATE_PLBU_ALLOC);
+
+	/* Barrier to make sure the previous register write is finished */
+	_mali_osk_write_mem_barrier();
+
+	/* This is the command that starts the core.
+	 *
+	 * Don't actually run the job if PROFILING_SKIP_PP_JOBS are set, just
+	 * force core to assert the completion interrupt.
+	 */
+#if !defined(PROFILING_SKIP_GP_JOBS)
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALIGP2_REG_ADDR_MGMT_CMD, startcmd);
+#else
+	{
+		u32 bits = 0;
+
+		if (mali_gp_job_has_vs_job(job))
+			bits = MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST;
+		if (mali_gp_job_has_plbu_job(job))
+			bits |= MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST;
+
+		mali_hw_core_register_write_relaxed(&core->hw_core,
+						    MALIGP2_REG_ADDR_MGMT_INT_RAWSTAT, bits);
+	}
+#endif
+
+	/* Barrier to make sure the previous register write is finished */
+	_mali_osk_write_mem_barrier();
+}
+
+void mali_gp_resume_with_new_heap(struct mali_gp_core *core, u32 start_addr, u32 end_addr)
+{
+	u32 irq_readout;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	irq_readout = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_RAWSTAT);
+
+	if (irq_readout & MALIGP2_REG_VAL_IRQ_PLBU_OUT_OF_MEM) {
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_CLEAR, (MALIGP2_REG_VAL_IRQ_PLBU_OUT_OF_MEM | MALIGP2_REG_VAL_IRQ_HANG));
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_MASK, MALIGP2_REG_VAL_IRQ_MASK_USED); /* re-enable interrupts */
+		mali_hw_core_register_write_relaxed(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PLBU_ALLOC_START_ADDR, start_addr);
+		mali_hw_core_register_write_relaxed(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PLBU_ALLOC_END_ADDR, end_addr);
+
+		MALI_DEBUG_PRINT(3, ("Mali GP: Resuming job\n"));
+
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_CMD, MALIGP2_REG_VAL_CMD_UPDATE_PLBU_ALLOC);
+		_mali_osk_write_mem_barrier();
+	}
+	/*
+	 * else: core has been reset between PLBU_OUT_OF_MEM interrupt and this new heap response.
+	 * A timeout or a page fault on Mali-200 PP core can cause this behaviour.
+	 */
+}
+
+u32 mali_gp_core_get_version(struct mali_gp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	return mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_VERSION);
+}
+
+struct mali_gp_core *mali_gp_get_global_gp_core(void)
+{
+	return mali_global_gp_core;
+}
+
+/* ------------- interrupt handling below ------------------ */
+static void mali_gp_irq_probe_trigger(void *data)
+{
+	struct mali_gp_core *core = (struct mali_gp_core *)data;
+
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_MASK, MALIGP2_REG_VAL_IRQ_MASK_USED);
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_RAWSTAT, MALIGP2_REG_VAL_IRQ_AXI_BUS_ERROR);
+	_mali_osk_mem_barrier();
+}
+
+static _mali_osk_errcode_t mali_gp_irq_probe_ack(void *data)
+{
+	struct mali_gp_core *core = (struct mali_gp_core *)data;
+	u32 irq_readout;
+
+	irq_readout = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_STAT);
+	if (MALIGP2_REG_VAL_IRQ_AXI_BUS_ERROR & irq_readout) {
+		mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_CLEAR, MALIGP2_REG_VAL_IRQ_AXI_BUS_ERROR);
+		_mali_osk_mem_barrier();
+		return _MALI_OSK_ERR_OK;
+	}
+
+	return _MALI_OSK_ERR_FAULT;
+}
+
+/* ------ local helper functions below --------- */
+#if MALI_STATE_TRACKING
+u32 mali_gp_dump_state(struct mali_gp_core *core, char *buf, u32 size)
+{
+	int n = 0;
+
+	n += _mali_osk_snprintf(buf + n, size - n, "\tGP: %s\n", core->hw_core.description);
+
+	return n;
+}
+#endif
+
+void mali_gp_update_performance_counters(struct mali_gp_core *core, struct mali_gp_job *job)
+{
+	u32 val0 = 0;
+	u32 val1 = 0;
+	u32 counter_src0 = mali_gp_job_get_perf_counter_src0(job);
+	u32 counter_src1 = mali_gp_job_get_perf_counter_src1(job);
+
+	if (MALI_HW_CORE_NO_COUNTER != counter_src0) {
+		val0 = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_VALUE);
+		mali_gp_job_set_perf_counter_value0(job, val0);
+
+#if defined(CONFIG_MALI400_PROFILING)
+		_mali_osk_profiling_report_hw_counter(COUNTER_VP_0_C0, val0);
+		_mali_osk_profiling_record_global_counters(COUNTER_VP_0_C0, val0);
+#endif
+
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER != counter_src1) {
+		val1 = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PERF_CNT_1_VALUE);
+		mali_gp_job_set_perf_counter_value1(job, val1);
+
+#if defined(CONFIG_MALI400_PROFILING)
+		_mali_osk_profiling_report_hw_counter(COUNTER_VP_0_C1, val1);
+		_mali_osk_profiling_record_global_counters(COUNTER_VP_0_C1, val1);
+#endif
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_gp.h b/drivers/gpu/arm/mali400/common/mali_gp.h
--- a/drivers/gpu/arm/mali400/common/mali_gp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_gp.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2011-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_GP_H__
+#define __MALI_GP_H__
+
+#include "mali_osk.h"
+#include "mali_gp_job.h"
+#include "mali_hw_core.h"
+#include "regs/mali_gp_regs.h"
+
+struct mali_group;
+
+/**
+ * Definition of the GP core struct
+ * Used to track a GP core in the system.
+ */
+struct mali_gp_core {
+	struct mali_hw_core  hw_core;           /**< Common for all HW cores */
+	_mali_osk_irq_t     *irq;               /**< IRQ handler */
+};
+
+_mali_osk_errcode_t mali_gp_initialize(void);
+void mali_gp_terminate(void);
+
+struct mali_gp_core *mali_gp_create(const _mali_osk_resource_t *resource, struct mali_group *group);
+void mali_gp_delete(struct mali_gp_core *core);
+
+void mali_gp_stop_bus(struct mali_gp_core *core);
+_mali_osk_errcode_t mali_gp_stop_bus_wait(struct mali_gp_core *core);
+void mali_gp_reset_async(struct mali_gp_core *core);
+_mali_osk_errcode_t mali_gp_reset_wait(struct mali_gp_core *core);
+void mali_gp_hard_reset(struct mali_gp_core *core);
+_mali_osk_errcode_t mali_gp_reset(struct mali_gp_core *core);
+
+void mali_gp_job_start(struct mali_gp_core *core, struct mali_gp_job *job);
+void mali_gp_resume_with_new_heap(struct mali_gp_core *core, u32 start_addr, u32 end_addr);
+
+u32 mali_gp_core_get_version(struct mali_gp_core *core);
+
+struct mali_gp_core *mali_gp_get_global_gp_core(void);
+
+#if MALI_STATE_TRACKING
+u32 mali_gp_dump_state(struct mali_gp_core *core, char *buf, u32 size);
+#endif
+
+void mali_gp_update_performance_counters(struct mali_gp_core *core, struct mali_gp_job *job);
+
+MALI_STATIC_INLINE const char *mali_gp_core_description(struct mali_gp_core *core)
+{
+	return core->hw_core.description;
+}
+
+MALI_STATIC_INLINE enum mali_interrupt_result mali_gp_get_interrupt_result(struct mali_gp_core *core)
+{
+	u32 stat_used = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_STAT) &
+			MALIGP2_REG_VAL_IRQ_MASK_USED;
+
+	if (0 == stat_used) {
+		return MALI_INTERRUPT_RESULT_NONE;
+	} else if ((MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST |
+		    MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST) == stat_used) {
+		return MALI_INTERRUPT_RESULT_SUCCESS;
+	} else if (MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST == stat_used) {
+		return MALI_INTERRUPT_RESULT_SUCCESS_VS;
+	} else if (MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST == stat_used) {
+		return MALI_INTERRUPT_RESULT_SUCCESS_PLBU;
+	} else if (MALIGP2_REG_VAL_IRQ_PLBU_OUT_OF_MEM & stat_used) {
+		return MALI_INTERRUPT_RESULT_OOM;
+	}
+
+	return MALI_INTERRUPT_RESULT_ERROR;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_get_rawstat(struct mali_gp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	return mali_hw_core_register_read(&core->hw_core,
+					  MALIGP2_REG_ADDR_MGMT_INT_RAWSTAT);
+}
+
+MALI_STATIC_INLINE u32 mali_gp_is_active(struct mali_gp_core *core)
+{
+	u32 status = mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_STATUS);
+	return (status & MALIGP2_REG_VAL_STATUS_MASK_ACTIVE) ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE void mali_gp_mask_all_interrupts(struct mali_gp_core *core)
+{
+	mali_hw_core_register_write(&core->hw_core, MALIGP2_REG_ADDR_MGMT_INT_MASK, MALIGP2_REG_VAL_IRQ_MASK_NONE);
+}
+
+MALI_STATIC_INLINE void mali_gp_enable_interrupts(struct mali_gp_core *core, enum mali_interrupt_result exceptions)
+{
+	/* Enable all interrupts, except those specified in exceptions */
+	u32 value;
+
+	if (MALI_INTERRUPT_RESULT_SUCCESS_VS == exceptions) {
+		/* Enable all used except VS complete */
+		value = MALIGP2_REG_VAL_IRQ_MASK_USED &
+			~MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST;
+	} else {
+		MALI_DEBUG_ASSERT(MALI_INTERRUPT_RESULT_SUCCESS_PLBU ==
+				  exceptions);
+		/* Enable all used except PLBU complete */
+		value = MALIGP2_REG_VAL_IRQ_MASK_USED &
+			~MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST;
+	}
+
+	mali_hw_core_register_write(&core->hw_core,
+				    MALIGP2_REG_ADDR_MGMT_INT_MASK,
+				    value);
+}
+
+MALI_STATIC_INLINE u32 mali_gp_read_plbu_alloc_start_addr(struct mali_gp_core *core)
+{
+	return mali_hw_core_register_read(&core->hw_core, MALIGP2_REG_ADDR_MGMT_PLBU_ALLOC_START_ADDR);
+}
+
+#endif /* __MALI_GP_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_gp_job.c b/drivers/gpu/arm/mali400/common/mali_gp_job.c
--- a/drivers/gpu/arm/mali400/common/mali_gp_job.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_gp_job.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,302 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_gp_job.h"
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_uk_types.h"
+#include "mali_memory_virtual.h"
+#include "mali_memory_defer_bind.h"
+
+static u32 gp_counter_src0 = MALI_HW_CORE_NO_COUNTER;      /**< Performance counter 0, MALI_HW_CORE_NO_COUNTER for disabled */
+static u32 gp_counter_src1 = MALI_HW_CORE_NO_COUNTER;           /**< Performance counter 1, MALI_HW_CORE_NO_COUNTER for disabled */
+static void _mali_gp_del_varying_allocations(struct mali_gp_job *job);
+
+
+static int _mali_gp_add_varying_allocations(struct mali_session_data *session,
+		struct mali_gp_job *job,
+		u32 *alloc,
+		u32 num)
+{
+	int i = 0;
+	struct mali_gp_allocation_node *alloc_node;
+	mali_mem_allocation *mali_alloc = NULL;
+	struct mali_vma_node *mali_vma_node = NULL;
+
+	for (i = 0 ; i < num ; i++) {
+		MALI_DEBUG_ASSERT(alloc[i]);
+		alloc_node = _mali_osk_calloc(1, sizeof(struct mali_gp_allocation_node));
+		if (alloc_node) {
+			INIT_LIST_HEAD(&alloc_node->node);
+			/* find mali allocation structure by vaddress*/
+			mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, alloc[i], 0);
+
+			if (likely(mali_vma_node)) {
+				mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+				MALI_DEBUG_ASSERT(alloc[i] == mali_vma_node->vm_node.start);
+			} else {
+				MALI_DEBUG_PRINT(1, ("ERROE!_mali_gp_add_varying_allocations,can't find allocation %d by address =0x%x, num=%d\n", i, alloc[i], num));
+				_mali_osk_free(alloc_node);
+				goto fail;
+			}
+			alloc_node->alloc = mali_alloc;
+			/* add to gp job varying alloc list*/
+			list_move(&alloc_node->node, &job->varying_alloc);
+		} else
+			goto fail;
+	}
+
+	return 0;
+fail:
+	MALI_DEBUG_PRINT(1, ("ERROE!_mali_gp_add_varying_allocations,failed to alloc memory!\n"));
+	_mali_gp_del_varying_allocations(job);
+	return -1;
+}
+
+
+static void _mali_gp_del_varying_allocations(struct mali_gp_job *job)
+{
+	struct mali_gp_allocation_node *alloc_node, *tmp_node;
+
+	list_for_each_entry_safe(alloc_node, tmp_node, &job->varying_alloc, node) {
+		list_del(&alloc_node->node);
+		kfree(alloc_node);
+	}
+	INIT_LIST_HEAD(&job->varying_alloc);
+}
+
+struct mali_gp_job *mali_gp_job_create(struct mali_session_data *session, _mali_uk_gp_start_job_s *uargs, u32 id, struct mali_timeline_tracker *pp_tracker)
+{
+	struct mali_gp_job *job;
+	u32 perf_counter_flag;
+	u32 __user *memory_list = NULL;
+	struct mali_gp_allocation_node *alloc_node, *tmp_node;
+
+	job = _mali_osk_calloc(1, sizeof(struct mali_gp_job));
+	if (NULL != job) {
+		job->finished_notification = _mali_osk_notification_create(_MALI_NOTIFICATION_GP_FINISHED, sizeof(_mali_uk_gp_job_finished_s));
+		if (NULL == job->finished_notification) {
+			goto fail3;
+		}
+
+		job->oom_notification = _mali_osk_notification_create(_MALI_NOTIFICATION_GP_STALLED, sizeof(_mali_uk_gp_job_suspended_s));
+		if (NULL == job->oom_notification) {
+			goto fail2;
+		}
+
+		if (0 != _mali_osk_copy_from_user(&job->uargs, uargs, sizeof(_mali_uk_gp_start_job_s))) {
+			goto fail1;
+		}
+
+		perf_counter_flag = mali_gp_job_get_perf_counter_flag(job);
+
+		/* case when no counters came from user space
+		 * so pass the debugfs / DS-5 provided global ones to the job object */
+		if (!((perf_counter_flag & _MALI_PERFORMANCE_COUNTER_FLAG_SRC0_ENABLE) ||
+		      (perf_counter_flag & _MALI_PERFORMANCE_COUNTER_FLAG_SRC1_ENABLE))) {
+			mali_gp_job_set_perf_counter_src0(job, mali_gp_job_get_gp_counter_src0());
+			mali_gp_job_set_perf_counter_src1(job, mali_gp_job_get_gp_counter_src1());
+		}
+
+		_mali_osk_list_init(&job->list);
+		job->session = session;
+		job->id = id;
+		job->heap_current_addr = job->uargs.frame_registers[4];
+		job->perf_counter_value0 = 0;
+		job->perf_counter_value1 = 0;
+		job->pid = _mali_osk_get_pid();
+		job->tid = _mali_osk_get_tid();
+
+
+		INIT_LIST_HEAD(&job->varying_alloc);
+		INIT_LIST_HEAD(&job->vary_todo);
+		job->dmem = NULL;
+
+		if (job->uargs.deferred_mem_num > session->allocation_mgr.mali_allocation_num) {
+			MALI_PRINT_ERROR(("Mali GP job: The number of  varying buffer to defer bind  is invalid !\n"));
+			goto fail1;
+		}
+
+		/* add varying allocation list*/
+		if (job->uargs.deferred_mem_num > 0) {
+			/* copy varying list from user space*/
+			job->varying_list = _mali_osk_calloc(1, sizeof(u32) * job->uargs.deferred_mem_num);
+			if (!job->varying_list) {
+				MALI_PRINT_ERROR(("Mali GP job: allocate varying_list failed varying_alloc_num = %d !\n", job->uargs.deferred_mem_num));
+				goto fail1;
+			}
+
+			memory_list = (u32 __user *)(uintptr_t)job->uargs.deferred_mem_list;
+
+			if (0 != _mali_osk_copy_from_user(job->varying_list, memory_list, sizeof(u32) * job->uargs.deferred_mem_num)) {
+				MALI_PRINT_ERROR(("Mali GP job: Failed to copy varying list from user space!\n"));
+				goto fail;
+			}
+
+			if (unlikely(_mali_gp_add_varying_allocations(session, job, job->varying_list,
+					job->uargs.deferred_mem_num))) {
+				MALI_PRINT_ERROR(("Mali GP job: _mali_gp_add_varying_allocations failed!\n"));
+				goto fail;
+			}
+
+			/* do preparetion for each allocation */
+			list_for_each_entry_safe(alloc_node, tmp_node, &job->varying_alloc, node) {
+				if (unlikely(_MALI_OSK_ERR_OK != mali_mem_defer_bind_allocation_prepare(alloc_node->alloc, &job->vary_todo, &job->required_varying_memsize))) {
+					MALI_PRINT_ERROR(("Mali GP job: mali_mem_defer_bind_allocation_prepare failed!\n"));
+					goto fail;
+				}
+			}
+
+			_mali_gp_del_varying_allocations(job);
+
+			/* bind varying here, to avoid memory latency issue. */
+			{
+				struct mali_defer_mem_block dmem_block;
+
+				INIT_LIST_HEAD(&dmem_block.free_pages);
+				atomic_set(&dmem_block.num_free_pages, 0);
+
+				if (mali_mem_prepare_mem_for_job(job, &dmem_block)) {
+					MALI_PRINT_ERROR(("Mali GP job: mali_mem_prepare_mem_for_job failed!\n"));
+					goto fail;
+				}
+				if (_MALI_OSK_ERR_OK != mali_mem_defer_bind(job, &dmem_block)) {
+					MALI_PRINT_ERROR(("gp job create, mali_mem_defer_bind failed! GP %x fail!", job));
+					goto fail;
+				}
+			}
+
+			if (job->uargs.varying_memsize > MALI_UK_BIG_VARYING_SIZE) {
+				job->big_job = 1;
+			}
+		}
+		job->pp_tracker = pp_tracker;
+		if (NULL != job->pp_tracker) {
+			/* Take a reference on PP job's tracker that will be released when the GP
+			   job is done. */
+			mali_timeline_system_tracker_get(session->timeline_system, pp_tracker);
+		}
+
+		mali_timeline_tracker_init(&job->tracker, MALI_TIMELINE_TRACKER_GP, NULL, job);
+		mali_timeline_fence_copy_uk_fence(&(job->tracker.fence), &(job->uargs.fence));
+
+		return job;
+	} else {
+		MALI_PRINT_ERROR(("Mali GP job: _mali_osk_calloc failed!\n"));
+		return NULL;
+	}
+
+
+fail:
+	_mali_osk_free(job->varying_list);
+	/* Handle allocate fail here, free all varying node */
+	{
+		struct mali_backend_bind_list *bkn, *bkn_tmp;
+		list_for_each_entry_safe(bkn, bkn_tmp , &job->vary_todo, node) {
+			list_del(&bkn->node);
+			_mali_osk_free(bkn);
+		}
+	}
+fail1:
+	_mali_osk_notification_delete(job->oom_notification);
+fail2:
+	_mali_osk_notification_delete(job->finished_notification);
+fail3:
+	_mali_osk_free(job);
+	return NULL;
+}
+
+void mali_gp_job_delete(struct mali_gp_job *job)
+{
+	struct mali_backend_bind_list *bkn, *bkn_tmp;
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT(NULL == job->pp_tracker);
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(&job->list));
+	_mali_osk_free(job->varying_list);
+
+	/* Handle allocate fail here, free all varying node */
+	list_for_each_entry_safe(bkn, bkn_tmp , &job->vary_todo, node) {
+		list_del(&bkn->node);
+		_mali_osk_free(bkn);
+	}
+
+	mali_mem_defer_dmem_free(job);
+
+	/* de-allocate the pre-allocated oom notifications */
+	if (NULL != job->oom_notification) {
+		_mali_osk_notification_delete(job->oom_notification);
+		job->oom_notification = NULL;
+	}
+	if (NULL != job->finished_notification) {
+		_mali_osk_notification_delete(job->finished_notification);
+		job->finished_notification = NULL;
+	}
+
+	_mali_osk_free(job);
+}
+
+void mali_gp_job_list_add(struct mali_gp_job *job, _mali_osk_list_t *list)
+{
+	struct mali_gp_job *iter;
+	struct mali_gp_job *tmp;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+
+	/* Find position in list/queue where job should be added. */
+	_MALI_OSK_LIST_FOREACHENTRY_REVERSE(iter, tmp, list,
+					    struct mali_gp_job, list) {
+
+		/* A span is used to handle job ID wrapping. */
+		bool job_is_after = (mali_gp_job_get_id(job) -
+				     mali_gp_job_get_id(iter)) <
+				    MALI_SCHEDULER_JOB_ID_SPAN;
+
+		if (job_is_after) {
+			break;
+		}
+	}
+
+	_mali_osk_list_add(&job->list, &iter->list);
+}
+
+u32 mali_gp_job_get_gp_counter_src0(void)
+{
+	return gp_counter_src0;
+}
+
+void mali_gp_job_set_gp_counter_src0(u32 counter)
+{
+	gp_counter_src0 = counter;
+}
+
+u32 mali_gp_job_get_gp_counter_src1(void)
+{
+	return gp_counter_src1;
+}
+
+void mali_gp_job_set_gp_counter_src1(u32 counter)
+{
+	gp_counter_src1 = counter;
+}
+
+mali_scheduler_mask mali_gp_job_signal_pp_tracker(struct mali_gp_job *job, mali_bool success)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	if (NULL != job->pp_tracker) {
+		schedule_mask |= mali_timeline_system_tracker_put(job->session->timeline_system, job->pp_tracker, MALI_FALSE == success);
+		job->pp_tracker = NULL;
+	}
+
+	return schedule_mask;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_gp_job.h b/drivers/gpu/arm/mali400/common/mali_gp_job.h
--- a/drivers/gpu/arm/mali400/common/mali_gp_job.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_gp_job.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,324 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_GP_JOB_H__
+#define __MALI_GP_JOB_H__
+
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_uk_types.h"
+#include "mali_session.h"
+#include "mali_timeline.h"
+#include "mali_scheduler_types.h"
+#include "mali_scheduler.h"
+#include "mali_executor.h"
+#include "mali_timeline.h"
+
+struct mali_defer_mem;
+/**
+ * This structure represents a GP job
+ *
+ * The GP job object itself is not protected by any single lock,
+ * but relies on other locks instead (scheduler, executor and timeline lock).
+ * Think of the job object as moving between these sub systems through-out
+ * its lifetime. Different part of the GP job struct is used by different
+ * subsystems. Accessor functions ensure that correct lock is taken.
+ * Do NOT access any data members directly from outside this module!
+ */
+struct mali_gp_job {
+	/*
+	 * These members are typically only set at creation,
+	 * and only read later on.
+	 * They do not require any lock protection.
+	 */
+	_mali_uk_gp_start_job_s uargs;                     /**< Arguments from user space */
+	struct mali_session_data *session;                 /**< Session which submitted this job */
+	u32 pid;                                           /**< Process ID of submitting process */
+	u32 tid;                                           /**< Thread ID of submitting thread */
+	u32 id;                                            /**< Identifier for this job in kernel space (sequential numbering) */
+	u32 cache_order;                                   /**< Cache order used for L2 cache flushing (sequential numbering) */
+	struct mali_timeline_tracker tracker;              /**< Timeline tracker for this job */
+	struct mali_timeline_tracker *pp_tracker;          /**< Pointer to Timeline tracker for PP job that depends on this job. */
+	_mali_osk_notification_t *finished_notification;   /**< Notification sent back to userspace on job complete */
+
+	/*
+	 * These members are used by the scheduler,
+	 * protected by scheduler lock
+	 */
+	_mali_osk_list_t list;                             /**< Used to link jobs together in the scheduler queue */
+
+	/*
+	 * These members are used by the executor and/or group,
+	 * protected by executor lock
+	 */
+	_mali_osk_notification_t *oom_notification;        /**< Notification sent back to userspace on OOM */
+
+	/*
+	 * Set by executor/group on job completion, read by scheduler when
+	 * returning job to user. Hold executor lock when setting,
+	 * no lock needed when reading
+	 */
+	u32 heap_current_addr;                             /**< Holds the current HEAP address when the job has completed */
+	u32 perf_counter_value0;                           /**< Value of performance counter 0 (to be returned to user space) */
+	u32 perf_counter_value1;                           /**< Value of performance counter 1 (to be returned to user space) */
+	struct mali_defer_mem *dmem;                                          /** < used for defer bind to store dmem info */
+	struct list_head varying_alloc;                    /**< hold the list of varying allocations */
+	u32 bind_flag;                                     /** < flag for deferbind*/
+	u32 *varying_list;                                 /**< varying memory list need to to defer bind*/
+	struct list_head vary_todo;                        /**< list of backend list need to do defer bind*/
+	u32 required_varying_memsize;                      /** < size of varying memory to reallocate*/
+	u32 big_job;                                       /** < if the gp job have large varying output and may take long time*/
+};
+
+#define MALI_DEFER_BIND_MEMORY_PREPARED (0x1 << 0)
+#define MALI_DEFER_BIND_MEMORY_BINDED (0x1 << 2)
+
+struct mali_gp_allocation_node {
+	struct list_head node;
+	mali_mem_allocation *alloc;
+};
+
+struct mali_gp_job *mali_gp_job_create(struct mali_session_data *session, _mali_uk_gp_start_job_s *uargs, u32 id, struct mali_timeline_tracker *pp_tracker);
+void mali_gp_job_delete(struct mali_gp_job *job);
+
+u32 mali_gp_job_get_gp_counter_src0(void);
+void mali_gp_job_set_gp_counter_src0(u32 counter);
+u32 mali_gp_job_get_gp_counter_src1(void);
+void mali_gp_job_set_gp_counter_src1(u32 counter);
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_id(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (NULL == job) ? 0 : job->id;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_cache_order(struct mali_gp_job *job,
+		u32 cache_order)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	job->cache_order = cache_order;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_cache_order(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (NULL == job) ? 0 : job->cache_order;
+}
+
+MALI_STATIC_INLINE u64 mali_gp_job_get_user_id(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.user_job_ptr;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_frame_builder_id(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.frame_builder_id;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_flush_id(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.flush_id;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_pid(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->pid;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_tid(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->tid;
+}
+
+MALI_STATIC_INLINE u32 *mali_gp_job_get_frame_registers(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.frame_registers;
+}
+
+MALI_STATIC_INLINE struct mali_session_data *mali_gp_job_get_session(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->session;
+}
+
+MALI_STATIC_INLINE mali_bool mali_gp_job_has_vs_job(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (job->uargs.frame_registers[0] != job->uargs.frame_registers[1]) ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE mali_bool mali_gp_job_has_plbu_job(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (job->uargs.frame_registers[2] != job->uargs.frame_registers[3]) ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_current_heap_addr(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->heap_current_addr;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_current_heap_addr(struct mali_gp_job *job, u32 heap_addr)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	job->heap_current_addr = heap_addr;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_perf_counter_flag(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.perf_counter_flag;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_perf_counter_src0(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.perf_counter_src0;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_perf_counter_src1(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.perf_counter_src1;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_perf_counter_value0(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->perf_counter_value0;
+}
+
+MALI_STATIC_INLINE u32 mali_gp_job_get_perf_counter_value1(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->perf_counter_value1;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_perf_counter_src0(struct mali_gp_job *job, u32 src)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	job->uargs.perf_counter_src0 = src;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_perf_counter_src1(struct mali_gp_job *job, u32 src)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	job->uargs.perf_counter_src1 = src;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_perf_counter_value0(struct mali_gp_job *job, u32 value)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	job->perf_counter_value0 = value;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_perf_counter_value1(struct mali_gp_job *job, u32 value)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	job->perf_counter_value1 = value;
+}
+
+void mali_gp_job_list_add(struct mali_gp_job *job, _mali_osk_list_t *list);
+
+MALI_STATIC_INLINE void mali_gp_job_list_move(struct mali_gp_job *job,
+		_mali_osk_list_t *list)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	MALI_DEBUG_ASSERT(!_mali_osk_list_empty(&job->list));
+	_mali_osk_list_move(&job->list, list);
+}
+
+MALI_STATIC_INLINE void mali_gp_job_list_remove(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	_mali_osk_list_delinit(&job->list);
+}
+
+MALI_STATIC_INLINE _mali_osk_notification_t *
+mali_gp_job_get_finished_notification(struct mali_gp_job *job)
+{
+	_mali_osk_notification_t *notification;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(job->finished_notification);
+
+	notification = job->finished_notification;
+	job->finished_notification = NULL;
+
+	return notification;
+}
+
+MALI_STATIC_INLINE _mali_osk_notification_t *mali_gp_job_get_oom_notification(
+	struct mali_gp_job *job)
+{
+	_mali_osk_notification_t *notification;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT_POINTER(job->oom_notification);
+
+	notification = job->oom_notification;
+	job->oom_notification = NULL;
+
+	return notification;
+}
+
+MALI_STATIC_INLINE void mali_gp_job_set_oom_notification(
+	struct mali_gp_job *job,
+	_mali_osk_notification_t *notification)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(NULL == job->oom_notification);
+	job->oom_notification = notification;
+}
+
+MALI_STATIC_INLINE struct mali_timeline_tracker *mali_gp_job_get_tracker(
+	struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return &(job->tracker);
+}
+
+
+MALI_STATIC_INLINE u32 *mali_gp_job_get_timeline_point_ptr(
+	struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (u32 __user *)(uintptr_t)job->uargs.timeline_point_ptr;
+}
+
+
+/**
+ * Release reference on tracker for PP job that depends on this GP job.
+ *
+ * @note If GP job has a reference on tracker, this function MUST be called before the GP job is
+ * deleted.
+ *
+ * @param job GP job that is done.
+ * @param success MALI_TRUE if job completed successfully, MALI_FALSE if not.
+ * @return A scheduling bitmask indicating whether scheduling needs to be done.
+ */
+mali_scheduler_mask mali_gp_job_signal_pp_tracker(struct mali_gp_job *job, mali_bool success);
+
+#endif /* __MALI_GP_JOB_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_group.c b/drivers/gpu/arm/mali400/common/mali_group.c
--- a/drivers/gpu/arm/mali400/common/mali_group.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_group.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,1865 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include "mali_kernel_common.h"
+#include "mali_group.h"
+#include "mali_osk.h"
+#include "mali_l2_cache.h"
+#include "mali_gp.h"
+#include "mali_pp.h"
+#include "mali_mmu.h"
+#include "mali_dlbu.h"
+#include "mali_broadcast.h"
+#include "mali_scheduler.h"
+#include "mali_osk_profiling.h"
+#include "mali_osk_mali.h"
+#include "mali_pm_domain.h"
+#include "mali_pm.h"
+#include "mali_executor.h"
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+#include <linux/sched.h>
+#include <trace/events/gpu.h>
+#endif
+
+#define MALI_MAX_NUM_DOMAIN_REFS (MALI_MAX_NUMBER_OF_GROUPS * 2)
+
+#if defined(CONFIG_MALI400_PROFILING)
+static void mali_group_report_l2_cache_counters_per_core(struct mali_group *group, u32 core_num);
+#endif /* #if defined(CONFIG_MALI400_PROFILING) */
+
+static struct mali_group *mali_global_groups[MALI_MAX_NUMBER_OF_GROUPS] = { NULL, };
+static u32 mali_global_num_groups = 0;
+
+/* SW timer for job execution */
+int mali_max_job_runtime = MALI_MAX_JOB_RUNTIME_DEFAULT;
+
+/* local helper functions */
+static void mali_group_bottom_half_mmu(void *data);
+static void mali_group_bottom_half_gp(void *data);
+static void mali_group_bottom_half_pp(void *data);
+static void mali_group_timeout(void *data);
+static void mali_group_reset_pp(struct mali_group *group);
+static void mali_group_reset_mmu(struct mali_group *group);
+
+static void mali_group_activate_page_directory(struct mali_group *group, struct mali_session_data *session, mali_bool is_reload);
+static void mali_group_recovery_reset(struct mali_group *group);
+
+struct mali_group *mali_group_create(struct mali_l2_cache_core *core,
+				     struct mali_dlbu_core *dlbu,
+				     struct mali_bcast_unit *bcast,
+				     u32 domain_index)
+{
+	struct mali_group *group = NULL;
+
+	if (mali_global_num_groups >= MALI_MAX_NUMBER_OF_GROUPS) {
+		MALI_PRINT_ERROR(("Mali group: Too many group objects created\n"));
+		return NULL;
+	}
+
+	group = _mali_osk_calloc(1, sizeof(struct mali_group));
+	if (NULL != group) {
+		group->timeout_timer = _mali_osk_timer_init();
+		if (NULL != group->timeout_timer) {
+			_mali_osk_timer_setcallback(group->timeout_timer, mali_group_timeout, (void *)group);
+
+			group->l2_cache_core[0] = core;
+			_mali_osk_list_init(&group->group_list);
+			_mali_osk_list_init(&group->executor_list);
+			_mali_osk_list_init(&group->pm_domain_list);
+			group->bcast_core = bcast;
+			group->dlbu_core = dlbu;
+
+			/* register this object as a part of the correct power domain */
+			if ((NULL != core) || (NULL != dlbu) || (NULL != bcast))
+				group->pm_domain = mali_pm_register_group(domain_index, group);
+
+			mali_global_groups[mali_global_num_groups] = group;
+			mali_global_num_groups++;
+
+			return group;
+		}
+		_mali_osk_free(group);
+	}
+
+	return NULL;
+}
+
+void mali_group_delete(struct mali_group *group)
+{
+	u32 i;
+
+	MALI_DEBUG_PRINT(4, ("Deleting group %s\n",
+			     mali_group_core_description(group)));
+
+	MALI_DEBUG_ASSERT(NULL == group->parent_group);
+	MALI_DEBUG_ASSERT((MALI_GROUP_STATE_INACTIVE == group->state) || ((MALI_GROUP_STATE_ACTIVATION_PENDING == group->state)));
+
+	/* Delete the resources that this group owns */
+	if (NULL != group->gp_core) {
+		mali_gp_delete(group->gp_core);
+	}
+
+	if (NULL != group->pp_core) {
+		mali_pp_delete(group->pp_core);
+	}
+
+	if (NULL != group->mmu) {
+		mali_mmu_delete(group->mmu);
+	}
+
+	if (mali_group_is_virtual(group)) {
+		/* Remove all groups from virtual group */
+		struct mali_group *child;
+		struct mali_group *temp;
+
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+			child->parent_group = NULL;
+			mali_group_delete(child);
+		}
+
+		mali_dlbu_delete(group->dlbu_core);
+
+		if (NULL != group->bcast_core) {
+			mali_bcast_unit_delete(group->bcast_core);
+		}
+	}
+
+	for (i = 0; i < mali_global_num_groups; i++) {
+		if (mali_global_groups[i] == group) {
+			mali_global_groups[i] = NULL;
+			mali_global_num_groups--;
+
+			if (i != mali_global_num_groups) {
+				/* We removed a group from the middle of the array -- move the last
+				 * group to the current position to close the gap */
+				mali_global_groups[i] = mali_global_groups[mali_global_num_groups];
+				mali_global_groups[mali_global_num_groups] = NULL;
+			}
+
+			break;
+		}
+	}
+
+	if (NULL != group->timeout_timer) {
+		_mali_osk_timer_del(group->timeout_timer);
+		_mali_osk_timer_term(group->timeout_timer);
+	}
+
+	if (NULL != group->bottom_half_work_mmu) {
+		_mali_osk_wq_delete_work(group->bottom_half_work_mmu);
+	}
+
+	if (NULL != group->bottom_half_work_gp) {
+		_mali_osk_wq_delete_work(group->bottom_half_work_gp);
+	}
+
+	if (NULL != group->bottom_half_work_pp) {
+		_mali_osk_wq_delete_work(group->bottom_half_work_pp);
+	}
+
+	_mali_osk_free(group);
+}
+
+_mali_osk_errcode_t mali_group_add_mmu_core(struct mali_group *group, struct mali_mmu_core *mmu_core)
+{
+	/* This group object now owns the MMU core object */
+	group->mmu = mmu_core;
+	group->bottom_half_work_mmu = _mali_osk_wq_create_work(mali_group_bottom_half_mmu, group);
+	if (NULL == group->bottom_half_work_mmu) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_group_remove_mmu_core(struct mali_group *group)
+{
+	/* This group object no longer owns the MMU core object */
+	group->mmu = NULL;
+	if (NULL != group->bottom_half_work_mmu) {
+		_mali_osk_wq_delete_work(group->bottom_half_work_mmu);
+	}
+}
+
+_mali_osk_errcode_t mali_group_add_gp_core(struct mali_group *group, struct mali_gp_core *gp_core)
+{
+	/* This group object now owns the GP core object */
+	group->gp_core = gp_core;
+	group->bottom_half_work_gp = _mali_osk_wq_create_work(mali_group_bottom_half_gp, group);
+	if (NULL == group->bottom_half_work_gp) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_group_remove_gp_core(struct mali_group *group)
+{
+	/* This group object no longer owns the GP core object */
+	group->gp_core = NULL;
+	if (NULL != group->bottom_half_work_gp) {
+		_mali_osk_wq_delete_work(group->bottom_half_work_gp);
+	}
+}
+
+_mali_osk_errcode_t mali_group_add_pp_core(struct mali_group *group, struct mali_pp_core *pp_core)
+{
+	/* This group object now owns the PP core object */
+	group->pp_core = pp_core;
+	group->bottom_half_work_pp = _mali_osk_wq_create_work(mali_group_bottom_half_pp, group);
+	if (NULL == group->bottom_half_work_pp) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_group_remove_pp_core(struct mali_group *group)
+{
+	/* This group object no longer owns the PP core object */
+	group->pp_core = NULL;
+	if (NULL != group->bottom_half_work_pp) {
+		_mali_osk_wq_delete_work(group->bottom_half_work_pp);
+	}
+}
+
+enum mali_group_state mali_group_activate(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	MALI_DEBUG_PRINT(4, ("Group: Activating group %s\n",
+			     mali_group_core_description(group)));
+
+	if (MALI_GROUP_STATE_INACTIVE == group->state) {
+		/* Group is inactive, get PM refs in order to power up */
+
+		/*
+		 * We'll take a maximum of 2 power domain references pr group,
+		 * one for the group itself, and one for it's L2 cache.
+		 */
+		struct mali_pm_domain *domains[MALI_MAX_NUM_DOMAIN_REFS];
+		struct mali_group *groups[MALI_MAX_NUM_DOMAIN_REFS];
+		u32 num_domains = 0;
+		mali_bool all_groups_on;
+
+		/* Deal with child groups first */
+		if (mali_group_is_virtual(group)) {
+			/*
+			 * The virtual group might have 0, 1 or 2 L2s in
+			 * its l2_cache_core array, but we ignore these and
+			 * let the child groups take the needed L2 cache ref
+			 * on behalf of the virtual group.
+			 * In other words; The L2 refs are taken in pair with
+			 * the physical group which the L2 is attached to.
+			 */
+			struct mali_group *child;
+			struct mali_group *temp;
+
+			/*
+			 * Child group is inactive, get PM
+			 * refs in order to power up.
+			 */
+			_MALI_OSK_LIST_FOREACHENTRY(child, temp,
+						    &group->group_list,
+						    struct mali_group, group_list) {
+				MALI_DEBUG_ASSERT(MALI_GROUP_STATE_INACTIVE
+						  == child->state);
+
+				child->state = MALI_GROUP_STATE_ACTIVATION_PENDING;
+
+				MALI_DEBUG_ASSERT_POINTER(
+					child->pm_domain);
+				domains[num_domains] = child->pm_domain;
+				groups[num_domains] = child;
+				num_domains++;
+
+				/*
+				 * Take L2 domain ref for child group.
+				 */
+				MALI_DEBUG_ASSERT(MALI_MAX_NUM_DOMAIN_REFS
+						  > num_domains);
+				domains[num_domains] = mali_l2_cache_get_pm_domain(
+							       child->l2_cache_core[0]);
+				groups[num_domains] = NULL;
+				MALI_DEBUG_ASSERT(NULL ==
+						  child->l2_cache_core[1]);
+				num_domains++;
+			}
+		} else {
+			/* Take L2 domain ref for physical groups. */
+			MALI_DEBUG_ASSERT(MALI_MAX_NUM_DOMAIN_REFS >
+					  num_domains);
+
+			domains[num_domains] = mali_l2_cache_get_pm_domain(
+						       group->l2_cache_core[0]);
+			groups[num_domains] = NULL;
+			MALI_DEBUG_ASSERT(NULL == group->l2_cache_core[1]);
+			num_domains++;
+		}
+
+		/* Do the group itself last (it's dependencies first) */
+
+		group->state = MALI_GROUP_STATE_ACTIVATION_PENDING;
+
+		MALI_DEBUG_ASSERT_POINTER(group->pm_domain);
+		domains[num_domains] = group->pm_domain;
+		groups[num_domains] = group;
+		num_domains++;
+
+		all_groups_on = mali_pm_get_domain_refs(domains, groups,
+							num_domains);
+
+		/*
+		 * Complete activation for group, include
+		 * virtual group or physical group.
+		 */
+		if (MALI_TRUE == all_groups_on) {
+
+			mali_group_set_active(group);
+		}
+	} else if (MALI_GROUP_STATE_ACTIVE == group->state) {
+		/* Already active */
+		MALI_DEBUG_ASSERT(MALI_TRUE == group->power_is_on);
+	} else {
+		/*
+		 * Activation already pending, group->power_is_on could
+		 * be both true or false. We need to wait for power up
+		 * notification anyway.
+		 */
+		MALI_DEBUG_ASSERT(MALI_GROUP_STATE_ACTIVATION_PENDING
+				  == group->state);
+	}
+
+	MALI_DEBUG_PRINT(4, ("Group: group %s activation result: %s\n",
+			     mali_group_core_description(group),
+			     MALI_GROUP_STATE_ACTIVE == group->state ?
+			     "ACTIVE" : "PENDING"));
+
+	return group->state;
+}
+
+mali_bool mali_group_set_active(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(MALI_GROUP_STATE_ACTIVATION_PENDING == group->state);
+	MALI_DEBUG_ASSERT(MALI_TRUE == group->power_is_on);
+
+	MALI_DEBUG_PRINT(4, ("Group: Activation completed for %s\n",
+			     mali_group_core_description(group)));
+
+	if (mali_group_is_virtual(group)) {
+		struct mali_group *child;
+		struct mali_group *temp;
+
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list,
+					    struct mali_group, group_list) {
+			if (MALI_TRUE != child->power_is_on) {
+				return MALI_FALSE;
+			}
+
+			child->state = MALI_GROUP_STATE_ACTIVE;
+		}
+
+		mali_group_reset(group);
+	}
+
+	/* Go to ACTIVE state */
+	group->state = MALI_GROUP_STATE_ACTIVE;
+
+	return MALI_TRUE;
+}
+
+mali_bool mali_group_deactivate(struct mali_group *group)
+{
+	struct mali_pm_domain *domains[MALI_MAX_NUM_DOMAIN_REFS];
+	u32 num_domains = 0;
+	mali_bool power_down = MALI_FALSE;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(MALI_GROUP_STATE_INACTIVE != group->state);
+
+	MALI_DEBUG_PRINT(3, ("Group: Deactivating group %s\n",
+			     mali_group_core_description(group)));
+
+	group->state = MALI_GROUP_STATE_INACTIVE;
+
+	MALI_DEBUG_ASSERT_POINTER(group->pm_domain);
+	domains[num_domains] = group->pm_domain;
+	num_domains++;
+
+	if (mali_group_is_virtual(group)) {
+		/* Release refs for all child groups */
+		struct mali_group *child;
+		struct mali_group *temp;
+
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp,
+					    &group->group_list,
+					    struct mali_group, group_list) {
+			child->state = MALI_GROUP_STATE_INACTIVE;
+
+			MALI_DEBUG_ASSERT_POINTER(child->pm_domain);
+			domains[num_domains] = child->pm_domain;
+			num_domains++;
+
+			/* Release L2 cache domain for child groups */
+			MALI_DEBUG_ASSERT(MALI_MAX_NUM_DOMAIN_REFS >
+					  num_domains);
+			domains[num_domains] = mali_l2_cache_get_pm_domain(
+						       child->l2_cache_core[0]);
+			MALI_DEBUG_ASSERT(NULL == child->l2_cache_core[1]);
+			num_domains++;
+		}
+
+		/*
+		 * Must do mali_group_power_down() steps right here for
+		 * virtual group, because virtual group itself is likely to
+		 * stay powered on, however child groups are now very likely
+		 * to be powered off (and thus lose their state).
+		 */
+
+		mali_group_clear_session(group);
+		/*
+		 * Disable the broadcast unit (clear it's mask).
+		 * This is needed in case the GPU isn't actually
+		 * powered down at this point and groups are
+		 * removed from an inactive virtual group.
+		 * If not, then the broadcast unit will intercept
+		 * their interrupts!
+		 */
+		mali_bcast_disable(group->bcast_core);
+	} else {
+		/* Release L2 cache domain for physical groups */
+		MALI_DEBUG_ASSERT(MALI_MAX_NUM_DOMAIN_REFS >
+				  num_domains);
+		domains[num_domains] = mali_l2_cache_get_pm_domain(
+					       group->l2_cache_core[0]);
+		MALI_DEBUG_ASSERT(NULL == group->l2_cache_core[1]);
+		num_domains++;
+	}
+
+	power_down = mali_pm_put_domain_refs(domains, num_domains);
+
+	return power_down;
+}
+
+void mali_group_power_up(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	MALI_DEBUG_PRINT(3, ("Group: Power up for %s\n",
+			     mali_group_core_description(group)));
+
+	group->power_is_on = MALI_TRUE;
+
+	if (MALI_FALSE == mali_group_is_virtual(group)
+	    && MALI_FALSE == mali_group_is_in_virtual(group)) {
+		mali_group_reset(group);
+	}
+
+	/*
+	 * When we just acquire only one physical group form virt group,
+	 * we should remove the bcast&dlbu mask from virt group and
+	 * reset bcast and dlbu core, although part of pp cores in virt
+	 * group maybe not be powered on.
+	 */
+	if (MALI_TRUE == mali_group_is_virtual(group)) {
+		mali_bcast_reset(group->bcast_core);
+		mali_dlbu_update_mask(group->dlbu_core);
+	}
+}
+
+void mali_group_power_down(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT(MALI_TRUE == group->power_is_on);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	MALI_DEBUG_PRINT(3, ("Group: Power down for %s\n",
+			     mali_group_core_description(group)));
+
+	group->power_is_on = MALI_FALSE;
+
+	if (mali_group_is_virtual(group)) {
+		/*
+		 * What we do for physical jobs in this function should
+		 * already have been done in mali_group_deactivate()
+		 * for virtual group.
+		 */
+		MALI_DEBUG_ASSERT(NULL == group->session);
+	} else {
+		mali_group_clear_session(group);
+	}
+}
+
+MALI_DEBUG_CODE(static void mali_group_print_virtual(struct mali_group *vgroup)
+{
+	u32 i;
+	struct mali_group *group;
+	struct mali_group *temp;
+
+	MALI_DEBUG_PRINT(4, ("Virtual group %s (%p)\n",
+			     mali_group_core_description(vgroup),
+			     vgroup));
+	MALI_DEBUG_PRINT(4, ("l2_cache_core[0] = %p, ref = %d\n", vgroup->l2_cache_core[0], vgroup->l2_cache_core_ref_count[0]));
+	MALI_DEBUG_PRINT(4, ("l2_cache_core[1] = %p, ref = %d\n", vgroup->l2_cache_core[1], vgroup->l2_cache_core_ref_count[1]));
+
+	i = 0;
+	_MALI_OSK_LIST_FOREACHENTRY(group, temp, &vgroup->group_list, struct mali_group, group_list) {
+		MALI_DEBUG_PRINT(4, ("[%d] %s (%p), l2_cache_core[0] = %p\n",
+				     i, mali_group_core_description(group),
+				     group, group->l2_cache_core[0]));
+		i++;
+	}
+})
+
+static void mali_group_dump_core_status(struct mali_group *group)
+{
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT(NULL != group->gp_core || (NULL != group->pp_core && !mali_group_is_virtual(group)));
+
+	if (NULL != group->gp_core) {
+		MALI_PRINT(("Dump Group %s\n", group->gp_core->hw_core.description));
+
+		for (i = 0; i < 0xA8; i += 0x10) {
+			MALI_PRINT(("0x%04x: 0x%08x 0x%08x 0x%08x 0x%08x\n", i, mali_hw_core_register_read(&group->gp_core->hw_core, i),
+				    mali_hw_core_register_read(&group->gp_core->hw_core, i + 4),
+				    mali_hw_core_register_read(&group->gp_core->hw_core, i + 8),
+				    mali_hw_core_register_read(&group->gp_core->hw_core, i + 12)));
+		}
+
+
+	} else {
+		MALI_PRINT(("Dump Group %s\n", group->pp_core->hw_core.description));
+
+		for (i = 0; i < 0x5c; i += 0x10) {
+			MALI_PRINT(("0x%04x: 0x%08x 0x%08x 0x%08x 0x%08x\n", i, mali_hw_core_register_read(&group->pp_core->hw_core, i),
+				    mali_hw_core_register_read(&group->pp_core->hw_core, i + 4),
+				    mali_hw_core_register_read(&group->pp_core->hw_core, i + 8),
+				    mali_hw_core_register_read(&group->pp_core->hw_core, i + 12)));
+		}
+
+		/* Ignore some minor registers */
+		for (i = 0x1000; i < 0x1068; i += 0x10) {
+			MALI_PRINT(("0x%04x: 0x%08x 0x%08x 0x%08x 0x%08x\n", i, mali_hw_core_register_read(&group->pp_core->hw_core, i),
+				    mali_hw_core_register_read(&group->pp_core->hw_core, i + 4),
+				    mali_hw_core_register_read(&group->pp_core->hw_core, i + 8),
+				    mali_hw_core_register_read(&group->pp_core->hw_core, i + 12)));
+		}
+	}
+
+	MALI_PRINT(("Dump Group MMU\n"));
+	for (i = 0; i < 0x24; i += 0x10) {
+		MALI_PRINT(("0x%04x: 0x%08x 0x%08x 0x%08x 0x%08x\n", i, mali_hw_core_register_read(&group->mmu->hw_core, i),
+			    mali_hw_core_register_read(&group->mmu->hw_core, i + 4),
+			    mali_hw_core_register_read(&group->mmu->hw_core, i + 8),
+			    mali_hw_core_register_read(&group->mmu->hw_core, i + 12)));
+	}
+}
+
+
+/**
+ * @Dump group status
+ */
+void mali_group_dump_status(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	if (mali_group_is_virtual(group)) {
+		struct mali_group *group_c;
+		struct mali_group *temp;
+		_MALI_OSK_LIST_FOREACHENTRY(group_c, temp, &group->group_list, struct mali_group, group_list) {
+			mali_group_dump_core_status(group_c);
+		}
+	} else {
+		mali_group_dump_core_status(group);
+	}
+}
+
+/**
+ * @brief Add child group to virtual group parent
+ */
+void mali_group_add_group(struct mali_group *parent, struct mali_group *child)
+{
+	mali_bool found;
+	u32 i;
+
+	MALI_DEBUG_PRINT(3, ("Adding group %s to virtual group %s\n",
+			     mali_group_core_description(child),
+			     mali_group_core_description(parent)));
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_group_is_virtual(parent));
+	MALI_DEBUG_ASSERT(!mali_group_is_virtual(child));
+	MALI_DEBUG_ASSERT(NULL == child->parent_group);
+
+	_mali_osk_list_addtail(&child->group_list, &parent->group_list);
+
+	child->parent_group = parent;
+
+	MALI_DEBUG_ASSERT_POINTER(child->l2_cache_core[0]);
+
+	MALI_DEBUG_PRINT(4, ("parent->l2_cache_core: [0] = %p, [1] = %p\n", parent->l2_cache_core[0], parent->l2_cache_core[1]));
+	MALI_DEBUG_PRINT(4, ("child->l2_cache_core: [0] = %p, [1] = %p\n", child->l2_cache_core[0], child->l2_cache_core[1]));
+
+	/* Keep track of the L2 cache cores of child groups */
+	found = MALI_FALSE;
+	for (i = 0; i < 2; i++) {
+		if (parent->l2_cache_core[i] == child->l2_cache_core[0]) {
+			MALI_DEBUG_ASSERT(parent->l2_cache_core_ref_count[i] > 0);
+			parent->l2_cache_core_ref_count[i]++;
+			found = MALI_TRUE;
+		}
+	}
+
+	if (!found) {
+		/* First time we see this L2 cache, add it to our list */
+		i = (NULL == parent->l2_cache_core[0]) ? 0 : 1;
+
+		MALI_DEBUG_PRINT(4, ("First time we see l2_cache %p. Adding to [%d] = %p\n", child->l2_cache_core[0], i, parent->l2_cache_core[i]));
+
+		MALI_DEBUG_ASSERT(NULL == parent->l2_cache_core[i]);
+
+		parent->l2_cache_core[i] = child->l2_cache_core[0];
+		parent->l2_cache_core_ref_count[i]++;
+	}
+
+	/* Update Broadcast Unit and DLBU */
+	mali_bcast_add_group(parent->bcast_core, child);
+	mali_dlbu_add_group(parent->dlbu_core, child);
+
+	if (MALI_TRUE == parent->power_is_on) {
+		mali_bcast_reset(parent->bcast_core);
+		mali_dlbu_update_mask(parent->dlbu_core);
+	}
+
+	if (MALI_TRUE == child->power_is_on) {
+		if (NULL == parent->session) {
+			if (NULL != child->session) {
+				/*
+				 * Parent has no session, so clear
+				 * child session as well.
+				 */
+				mali_mmu_activate_empty_page_directory(child->mmu);
+			}
+		} else {
+			if (parent->session == child->session) {
+				/* We already have same session as parent,
+				 * so a simple zap should be enough.
+				 */
+				mali_mmu_zap_tlb(child->mmu);
+			} else {
+				/*
+				 * Parent has a different session, so we must
+				 * switch to that sessions page table
+				 */
+				mali_mmu_activate_page_directory(child->mmu, mali_session_get_page_directory(parent->session));
+			}
+
+			/* It is the parent which keeps the session from now on */
+			child->session = NULL;
+		}
+	} else {
+		/* should have been cleared when child was powered down */
+		MALI_DEBUG_ASSERT(NULL == child->session);
+	}
+
+	/* Start job on child when parent is active */
+	if (NULL != parent->pp_running_job) {
+		struct mali_pp_job *job = parent->pp_running_job;
+
+		MALI_DEBUG_PRINT(3, ("Group %x joining running job %d on virtual group %x\n",
+				     child, mali_pp_job_get_id(job), parent));
+
+		/* Only allowed to add active child to an active parent */
+		MALI_DEBUG_ASSERT(MALI_GROUP_STATE_ACTIVE == parent->state);
+		MALI_DEBUG_ASSERT(MALI_GROUP_STATE_ACTIVE == child->state);
+
+		mali_pp_job_start(child->pp_core, job, mali_pp_core_get_id(child->pp_core), MALI_TRUE);
+
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+					      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(child->pp_core)) |
+					      MALI_PROFILING_EVENT_REASON_SINGLE_HW_FLUSH,
+					      mali_pp_job_get_frame_builder_id(job), mali_pp_job_get_flush_id(job), 0, 0, 0);
+
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+					      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(child->pp_core)) |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_HW_VIRTUAL,
+					      mali_pp_job_get_pid(job), mali_pp_job_get_tid(job), 0, 0, 0);
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+		trace_gpu_sched_switch(
+			mali_pp_core_description(group->pp_core),
+			sched_clock(), mali_pp_job_get_tid(job),
+			0, mali_pp_job_get_id(job));
+#endif
+
+#if defined(CONFIG_MALI400_PROFILING)
+		trace_mali_core_active(mali_pp_job_get_pid(job), 1 /* active */, 0 /* PP */, mali_pp_core_get_id(child->pp_core),
+				       mali_pp_job_get_frame_builder_id(job), mali_pp_job_get_flush_id(job));
+#endif
+	}
+
+	MALI_DEBUG_CODE(mali_group_print_virtual(parent);)
+}
+
+/**
+ * @brief Remove child group from virtual group parent
+ */
+void mali_group_remove_group(struct mali_group *parent, struct mali_group *child)
+{
+	u32 i;
+
+	MALI_DEBUG_PRINT(3, ("Removing group %s from virtual group %s\n",
+			     mali_group_core_description(child),
+			     mali_group_core_description(parent)));
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_group_is_virtual(parent));
+	MALI_DEBUG_ASSERT(!mali_group_is_virtual(child));
+	MALI_DEBUG_ASSERT(parent == child->parent_group);
+
+	/* Update Broadcast Unit and DLBU */
+	mali_bcast_remove_group(parent->bcast_core, child);
+	mali_dlbu_remove_group(parent->dlbu_core, child);
+
+	if (MALI_TRUE == parent->power_is_on) {
+		mali_bcast_reset(parent->bcast_core);
+		mali_dlbu_update_mask(parent->dlbu_core);
+	}
+
+	child->session = parent->session;
+	child->parent_group = NULL;
+
+	_mali_osk_list_delinit(&child->group_list);
+	if (_mali_osk_list_empty(&parent->group_list)) {
+		parent->session = NULL;
+	}
+
+	/* Keep track of the L2 cache cores of child groups */
+	i = (child->l2_cache_core[0] == parent->l2_cache_core[0]) ? 0 : 1;
+
+	MALI_DEBUG_ASSERT(child->l2_cache_core[0] == parent->l2_cache_core[i]);
+
+	parent->l2_cache_core_ref_count[i]--;
+	if (parent->l2_cache_core_ref_count[i] == 0) {
+		parent->l2_cache_core[i] = NULL;
+	}
+
+	MALI_DEBUG_CODE(mali_group_print_virtual(parent));
+}
+
+struct mali_group *mali_group_acquire_group(struct mali_group *parent)
+{
+	struct mali_group *child = NULL;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(mali_group_is_virtual(parent));
+
+	if (!_mali_osk_list_empty(&parent->group_list)) {
+		child = _MALI_OSK_LIST_ENTRY(parent->group_list.prev, struct mali_group, group_list);
+		mali_group_remove_group(parent, child);
+	}
+
+	if (NULL != child) {
+		if (MALI_GROUP_STATE_ACTIVE != parent->state
+		    && MALI_TRUE == child->power_is_on) {
+			mali_group_reset(child);
+		}
+	}
+
+	return child;
+}
+
+void mali_group_reset(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT(NULL == group->gp_running_job);
+	MALI_DEBUG_ASSERT(NULL == group->pp_running_job);
+
+	MALI_DEBUG_PRINT(3, ("Group: reset of %s\n",
+			     mali_group_core_description(group)));
+
+	if (NULL != group->dlbu_core) {
+		mali_dlbu_reset(group->dlbu_core);
+	}
+
+	if (NULL != group->bcast_core) {
+		mali_bcast_reset(group->bcast_core);
+	}
+
+	MALI_DEBUG_ASSERT(NULL != group->mmu);
+	mali_group_reset_mmu(group);
+
+	if (NULL != group->gp_core) {
+		MALI_DEBUG_ASSERT(NULL == group->pp_core);
+		mali_gp_reset(group->gp_core);
+	} else {
+		MALI_DEBUG_ASSERT(NULL != group->pp_core);
+		mali_group_reset_pp(group);
+	}
+}
+
+void mali_group_start_gp_job(struct mali_group *group, struct mali_gp_job *job, mali_bool gpu_secure_mode_pre_enabled)
+{
+	struct mali_session_data *session;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	MALI_DEBUG_PRINT(3, ("Group: Starting GP job 0x%08X on group %s\n",
+			     job,
+			     mali_group_core_description(group)));
+
+	session = mali_gp_job_get_session(job);
+
+	MALI_DEBUG_ASSERT_POINTER(group->l2_cache_core[0]);
+	mali_l2_cache_invalidate_conditional(group->l2_cache_core[0], mali_gp_job_get_cache_order(job));
+
+	/* Reset GPU and disable gpu secure mode if needed. */
+	if (MALI_TRUE == _mali_osk_gpu_secure_mode_is_enabled()) {
+		struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+		_mali_osk_gpu_reset_and_secure_mode_disable();
+		/* Need to disable the pmu interrupt mask register */
+		if (NULL != pmu) {
+			mali_pmu_reset(pmu);
+		}
+	}
+
+	/* Reload mmu page table if needed */
+	if (MALI_TRUE == gpu_secure_mode_pre_enabled) {
+		mali_group_reset(group);
+		mali_group_activate_page_directory(group, session, MALI_TRUE);
+	} else {
+		mali_group_activate_page_directory(group, session, MALI_FALSE);
+	}
+
+	mali_gp_job_start(group->gp_core, job);
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+				      MALI_PROFILING_MAKE_EVENT_CHANNEL_GP(0) |
+				      MALI_PROFILING_EVENT_REASON_SINGLE_HW_FLUSH,
+				      mali_gp_job_get_frame_builder_id(job), mali_gp_job_get_flush_id(job), 0, 0, 0);
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+				      MALI_PROFILING_MAKE_EVENT_CHANNEL_GP(0),
+				      mali_gp_job_get_pid(job), mali_gp_job_get_tid(job), 0, 0, 0);
+
+#if defined(CONFIG_MALI400_PROFILING)
+	trace_mali_core_active(mali_gp_job_get_pid(job), 1 /* active */, 1 /* GP */,  0 /* core */,
+			       mali_gp_job_get_frame_builder_id(job), mali_gp_job_get_flush_id(job));
+#endif
+
+#if defined(CONFIG_MALI400_PROFILING)
+	if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[0])) &&
+	    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[0]))) {
+		mali_group_report_l2_cache_counters_per_core(group, 0);
+	}
+#endif /* #if defined(CONFIG_MALI400_PROFILING) */
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+	trace_gpu_sched_switch(mali_gp_core_description(group->gp_core),
+			       sched_clock(), mali_gp_job_get_tid(job),
+			       0, mali_gp_job_get_id(job));
+#endif
+
+	group->gp_running_job = job;
+	group->is_working = MALI_TRUE;
+
+	/* Setup SW timer and record start time */
+	group->start_time = _mali_osk_time_tickcount();
+	_mali_osk_timer_mod(group->timeout_timer, _mali_osk_time_mstoticks(mali_max_job_runtime));
+
+	MALI_DEBUG_PRINT(4, ("Group: Started GP job 0x%08X on group %s at %u\n",
+			     job,
+			     mali_group_core_description(group),
+			     group->start_time));
+}
+
+/* Used to set all the registers except frame renderer list address and fragment shader stack address
+ * It means the caller must set these two registers properly before calling this function
+ */
+void mali_group_start_pp_job(struct mali_group *group, struct mali_pp_job *job, u32 sub_job, mali_bool gpu_secure_mode_pre_enabled)
+{
+	struct mali_session_data *session;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	MALI_DEBUG_PRINT(3, ("Group: Starting PP job 0x%08X part %u/%u on group %s\n",
+			     job, sub_job + 1,
+			     mali_pp_job_get_sub_job_count(job),
+			     mali_group_core_description(group)));
+
+	session = mali_pp_job_get_session(job);
+
+	if (NULL != group->l2_cache_core[0]) {
+		mali_l2_cache_invalidate_conditional(group->l2_cache_core[0], mali_pp_job_get_cache_order(job));
+	}
+
+	if (NULL != group->l2_cache_core[1]) {
+		mali_l2_cache_invalidate_conditional(group->l2_cache_core[1], mali_pp_job_get_cache_order(job));
+	}
+
+	/* Reset GPU and change gpu secure mode if needed. */
+	if (MALI_TRUE == mali_pp_job_is_protected_job(job) && MALI_FALSE == _mali_osk_gpu_secure_mode_is_enabled()) {
+		struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+		_mali_osk_gpu_reset_and_secure_mode_enable();
+		/* Need to disable the pmu interrupt mask register */
+		if (NULL != pmu) {
+			mali_pmu_reset(pmu);
+		}
+	} else if (MALI_FALSE == mali_pp_job_is_protected_job(job) && MALI_TRUE == _mali_osk_gpu_secure_mode_is_enabled()) {
+		struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+		_mali_osk_gpu_reset_and_secure_mode_disable();
+		/* Need to disable the pmu interrupt mask register */
+		if (NULL != pmu) {
+			mali_pmu_reset(pmu);
+		}
+	}
+
+	/* Reload the mmu page table if needed */
+	if ((MALI_TRUE == mali_pp_job_is_protected_job(job) && MALI_FALSE == gpu_secure_mode_pre_enabled)
+	    || (MALI_FALSE == mali_pp_job_is_protected_job(job) && MALI_TRUE == gpu_secure_mode_pre_enabled)) {
+		mali_group_reset(group);
+		mali_group_activate_page_directory(group, session, MALI_TRUE);
+	} else {
+		mali_group_activate_page_directory(group, session, MALI_FALSE);
+	}
+
+	if (mali_group_is_virtual(group)) {
+		struct mali_group *child;
+		struct mali_group *temp;
+		u32 core_num = 0;
+
+		MALI_DEBUG_ASSERT(mali_pp_job_is_virtual(job));
+
+		/* Configure DLBU for the job */
+		mali_dlbu_config_job(group->dlbu_core, job);
+
+		/* Write stack address for each child group */
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+			mali_pp_write_addr_stack(child->pp_core, job);
+			core_num++;
+		}
+
+		mali_pp_job_start(group->pp_core, job, sub_job, MALI_FALSE);
+	} else {
+		mali_pp_job_start(group->pp_core, job, sub_job, MALI_FALSE);
+	}
+
+	/* if the group is virtual, loop through physical groups which belong to this group
+	 * and call profiling events for its cores as virtual */
+	if (MALI_TRUE == mali_group_is_virtual(group)) {
+		struct mali_group *child;
+		struct mali_group *temp;
+
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+			_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+						      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(child->pp_core)) |
+						      MALI_PROFILING_EVENT_REASON_SINGLE_HW_FLUSH,
+						      mali_pp_job_get_frame_builder_id(job), mali_pp_job_get_flush_id(job), 0, 0, 0);
+
+			_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+						      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(child->pp_core)) |
+						      MALI_PROFILING_EVENT_REASON_START_STOP_HW_VIRTUAL,
+						      mali_pp_job_get_pid(job), mali_pp_job_get_tid(job), 0, 0, 0);
+
+#if defined(CONFIG_MALI400_PROFILING)
+			trace_mali_core_active(mali_pp_job_get_pid(job), 1 /* active */, 0 /* PP */, mali_pp_core_get_id(child->pp_core),
+					       mali_pp_job_get_frame_builder_id(job), mali_pp_job_get_flush_id(job));
+#endif
+		}
+
+#if defined(CONFIG_MALI400_PROFILING)
+		if (0 != group->l2_cache_core_ref_count[0]) {
+			if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[0])) &&
+			    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[0]))) {
+				mali_group_report_l2_cache_counters_per_core(group, mali_l2_cache_get_id(group->l2_cache_core[0]));
+			}
+		}
+		if (0 != group->l2_cache_core_ref_count[1]) {
+			if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[1])) &&
+			    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[1]))) {
+				mali_group_report_l2_cache_counters_per_core(group, mali_l2_cache_get_id(group->l2_cache_core[1]));
+			}
+		}
+#endif /* #if defined(CONFIG_MALI400_PROFILING) */
+
+	} else { /* group is physical - call profiling events for physical cores */
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+					      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(group->pp_core)) |
+					      MALI_PROFILING_EVENT_REASON_SINGLE_HW_FLUSH,
+					      mali_pp_job_get_frame_builder_id(job), mali_pp_job_get_flush_id(job), 0, 0, 0);
+
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+					      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(group->pp_core)) |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_HW_PHYSICAL,
+					      mali_pp_job_get_pid(job), mali_pp_job_get_tid(job), 0, 0, 0);
+
+#if defined(CONFIG_MALI400_PROFILING)
+		trace_mali_core_active(mali_pp_job_get_pid(job), 1 /* active */, 0 /* PP */, mali_pp_core_get_id(group->pp_core),
+				       mali_pp_job_get_frame_builder_id(job), mali_pp_job_get_flush_id(job));
+#endif
+
+#if defined(CONFIG_MALI400_PROFILING)
+		if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[0])) &&
+		    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[0]))) {
+			mali_group_report_l2_cache_counters_per_core(group, mali_l2_cache_get_id(group->l2_cache_core[0]));
+		}
+#endif /* #if defined(CONFIG_MALI400_PROFILING) */
+	}
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+	trace_gpu_sched_switch(mali_pp_core_description(group->pp_core),
+			       sched_clock(), mali_pp_job_get_tid(job),
+			       0, mali_pp_job_get_id(job));
+#endif
+
+	group->pp_running_job = job;
+	group->pp_running_sub_job = sub_job;
+	group->is_working = MALI_TRUE;
+
+	/* Setup SW timer and record start time */
+	group->start_time = _mali_osk_time_tickcount();
+	_mali_osk_timer_mod(group->timeout_timer, _mali_osk_time_mstoticks(mali_max_job_runtime));
+
+	MALI_DEBUG_PRINT(4, ("Group: Started PP job 0x%08X part %u/%u on group %s at %u\n",
+			     job, sub_job + 1,
+			     mali_pp_job_get_sub_job_count(job),
+			     mali_group_core_description(group),
+			     group->start_time));
+
+}
+
+void mali_group_resume_gp_with_new_heap(struct mali_group *group, u32 job_id, u32 start_addr, u32 end_addr)
+{
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	MALI_DEBUG_ASSERT_POINTER(group->l2_cache_core[0]);
+	mali_l2_cache_invalidate(group->l2_cache_core[0]);
+
+	mali_mmu_zap_tlb_without_stall(group->mmu);
+
+	mali_gp_resume_with_new_heap(group->gp_core, start_addr, end_addr);
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_RESUME |
+				      MALI_PROFILING_MAKE_EVENT_CHANNEL_GP(0),
+				      0, 0, 0, 0, 0);
+
+#if defined(CONFIG_MALI400_PROFILING)
+	trace_mali_core_active(mali_gp_job_get_pid(group->gp_running_job), 1 /* active */, 1 /* GP */,  0 /* core */,
+			       mali_gp_job_get_frame_builder_id(group->gp_running_job), mali_gp_job_get_flush_id(group->gp_running_job));
+#endif
+}
+
+static void mali_group_reset_mmu(struct mali_group *group)
+{
+	struct mali_group *child;
+	struct mali_group *temp;
+	_mali_osk_errcode_t err;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	if (!mali_group_is_virtual(group)) {
+		/* This is a physical group or an idle virtual group -- simply wait for
+		 * the reset to complete. */
+		err = mali_mmu_reset(group->mmu);
+		MALI_DEBUG_ASSERT(_MALI_OSK_ERR_OK == err);
+	} else { /* virtual group */
+		/* Loop through all members of this virtual group and wait
+		 * until they are done resetting.
+		 */
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+			err = mali_mmu_reset(child->mmu);
+			MALI_DEBUG_ASSERT(_MALI_OSK_ERR_OK == err);
+		}
+	}
+}
+
+static void mali_group_reset_pp(struct mali_group *group)
+{
+	struct mali_group *child;
+	struct mali_group *temp;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	mali_pp_reset_async(group->pp_core);
+
+	if (!mali_group_is_virtual(group) || NULL == group->pp_running_job) {
+		/* This is a physical group or an idle virtual group -- simply wait for
+		 * the reset to complete. */
+		mali_pp_reset_wait(group->pp_core);
+	} else {
+		/* Loop through all members of this virtual group and wait until they
+		 * are done resetting.
+		 */
+		_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+			mali_pp_reset_wait(child->pp_core);
+		}
+	}
+}
+
+struct mali_pp_job *mali_group_complete_pp(struct mali_group *group, mali_bool success, u32 *sub_job)
+{
+	struct mali_pp_job *pp_job_to_return;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_running_job);
+	MALI_DEBUG_ASSERT_POINTER(sub_job);
+	MALI_DEBUG_ASSERT(MALI_TRUE == group->is_working);
+
+	/* Stop/clear the timeout timer. */
+	_mali_osk_timer_del_async(group->timeout_timer);
+
+	if (NULL != group->pp_running_job) {
+
+		/* Deal with HW counters and profiling */
+
+		if (MALI_TRUE == mali_group_is_virtual(group)) {
+			struct mali_group *child;
+			struct mali_group *temp;
+
+			/* update performance counters from each physical pp core within this virtual group */
+			_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+				mali_pp_update_performance_counters(group->pp_core, child->pp_core, group->pp_running_job, mali_pp_core_get_id(child->pp_core));
+			}
+
+#if defined(CONFIG_MALI400_PROFILING)
+			/* send profiling data per physical core */
+			_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+				_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+							      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(child->pp_core)) |
+							      MALI_PROFILING_EVENT_REASON_START_STOP_HW_VIRTUAL,
+							      mali_pp_job_get_perf_counter_value0(group->pp_running_job, mali_pp_core_get_id(child->pp_core)),
+							      mali_pp_job_get_perf_counter_value1(group->pp_running_job, mali_pp_core_get_id(child->pp_core)),
+							      mali_pp_job_get_perf_counter_src0(group->pp_running_job, group->pp_running_sub_job) | (mali_pp_job_get_perf_counter_src1(group->pp_running_job, group->pp_running_sub_job) << 8),
+							      0, 0);
+
+				trace_mali_core_active(mali_pp_job_get_pid(group->pp_running_job),
+						       0 /* active */, 0 /* PP */, mali_pp_core_get_id(child->pp_core),
+						       mali_pp_job_get_frame_builder_id(group->pp_running_job),
+						       mali_pp_job_get_flush_id(group->pp_running_job));
+			}
+			if (0 != group->l2_cache_core_ref_count[0]) {
+				if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[0])) &&
+				    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[0]))) {
+					mali_group_report_l2_cache_counters_per_core(group, mali_l2_cache_get_id(group->l2_cache_core[0]));
+				}
+			}
+			if (0 != group->l2_cache_core_ref_count[1]) {
+				if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[1])) &&
+				    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[1]))) {
+					mali_group_report_l2_cache_counters_per_core(group, mali_l2_cache_get_id(group->l2_cache_core[1]));
+				}
+			}
+
+#endif
+		} else {
+			/* update performance counters for a physical group's pp core */
+			mali_pp_update_performance_counters(group->pp_core, group->pp_core, group->pp_running_job, group->pp_running_sub_job);
+
+#if defined(CONFIG_MALI400_PROFILING)
+			_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+						      MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(mali_pp_core_get_id(group->pp_core)) |
+						      MALI_PROFILING_EVENT_REASON_START_STOP_HW_PHYSICAL,
+						      mali_pp_job_get_perf_counter_value0(group->pp_running_job, group->pp_running_sub_job),
+						      mali_pp_job_get_perf_counter_value1(group->pp_running_job, group->pp_running_sub_job),
+						      mali_pp_job_get_perf_counter_src0(group->pp_running_job, group->pp_running_sub_job) | (mali_pp_job_get_perf_counter_src1(group->pp_running_job, group->pp_running_sub_job) << 8),
+						      0, 0);
+
+			trace_mali_core_active(mali_pp_job_get_pid(group->pp_running_job),
+					       0 /* active */, 0 /* PP */, mali_pp_core_get_id(group->pp_core),
+					       mali_pp_job_get_frame_builder_id(group->pp_running_job),
+					       mali_pp_job_get_flush_id(group->pp_running_job));
+
+			if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[0])) &&
+			    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[0]))) {
+				mali_group_report_l2_cache_counters_per_core(group, mali_l2_cache_get_id(group->l2_cache_core[0]));
+			}
+#endif
+		}
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+		trace_gpu_sched_switch(
+			mali_gp_core_description(group->gp_core),
+			sched_clock(), 0, 0, 0);
+#endif
+
+	}
+
+	if (success) {
+		/* Only do soft reset for successful jobs, a full recovery
+		 * reset will be done for failed jobs. */
+		mali_pp_reset_async(group->pp_core);
+	}
+
+	pp_job_to_return = group->pp_running_job;
+	group->pp_running_job = NULL;
+	group->is_working = MALI_FALSE;
+	*sub_job = group->pp_running_sub_job;
+
+	if (!success) {
+		MALI_DEBUG_PRINT(2, ("Mali group: Executing recovery reset due to job failure\n"));
+		mali_group_recovery_reset(group);
+	} else if (_MALI_OSK_ERR_OK != mali_pp_reset_wait(group->pp_core)) {
+		MALI_PRINT_ERROR(("Mali group: Executing recovery reset due to reset failure\n"));
+		mali_group_recovery_reset(group);
+	}
+
+	return pp_job_to_return;
+}
+
+struct mali_gp_job *mali_group_complete_gp(struct mali_group *group, mali_bool success)
+{
+	struct mali_gp_job *gp_job_to_return;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_running_job);
+	MALI_DEBUG_ASSERT(MALI_TRUE == group->is_working);
+
+	/* Stop/clear the timeout timer. */
+	_mali_osk_timer_del_async(group->timeout_timer);
+
+	if (NULL != group->gp_running_job) {
+		mali_gp_update_performance_counters(group->gp_core, group->gp_running_job);
+
+#if defined(CONFIG_MALI400_PROFILING)
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP | MALI_PROFILING_MAKE_EVENT_CHANNEL_GP(0),
+					      mali_gp_job_get_perf_counter_value0(group->gp_running_job),
+					      mali_gp_job_get_perf_counter_value1(group->gp_running_job),
+					      mali_gp_job_get_perf_counter_src0(group->gp_running_job) | (mali_gp_job_get_perf_counter_src1(group->gp_running_job) << 8),
+					      0, 0);
+
+		if ((MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src0(group->l2_cache_core[0])) &&
+		    (MALI_HW_CORE_NO_COUNTER != mali_l2_cache_core_get_counter_src1(group->l2_cache_core[0])))
+			mali_group_report_l2_cache_counters_per_core(group, 0);
+#endif
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+		trace_gpu_sched_switch(
+			mali_pp_core_description(group->pp_core),
+			sched_clock(), 0, 0, 0);
+#endif
+
+#if defined(CONFIG_MALI400_PROFILING)
+		trace_mali_core_active(mali_gp_job_get_pid(group->gp_running_job), 0 /* active */, 1 /* GP */,  0 /* core */,
+				       mali_gp_job_get_frame_builder_id(group->gp_running_job), mali_gp_job_get_flush_id(group->gp_running_job));
+#endif
+
+		mali_gp_job_set_current_heap_addr(group->gp_running_job,
+						  mali_gp_read_plbu_alloc_start_addr(group->gp_core));
+	}
+
+	if (success) {
+		/* Only do soft reset for successful jobs, a full recovery
+		 * reset will be done for failed jobs. */
+		mali_gp_reset_async(group->gp_core);
+	}
+
+	gp_job_to_return = group->gp_running_job;
+	group->gp_running_job = NULL;
+	group->is_working = MALI_FALSE;
+
+	if (!success) {
+		MALI_DEBUG_PRINT(2, ("Mali group: Executing recovery reset due to job failure\n"));
+		mali_group_recovery_reset(group);
+	} else if (_MALI_OSK_ERR_OK != mali_gp_reset_wait(group->gp_core)) {
+		MALI_PRINT_ERROR(("Mali group: Executing recovery reset due to reset failure\n"));
+		mali_group_recovery_reset(group);
+	}
+
+	return gp_job_to_return;
+}
+
+struct mali_group *mali_group_get_glob_group(u32 index)
+{
+	if (mali_global_num_groups > index) {
+		return mali_global_groups[index];
+	}
+
+	return NULL;
+}
+
+u32 mali_group_get_glob_num_groups(void)
+{
+	return mali_global_num_groups;
+}
+
+static void mali_group_activate_page_directory(struct mali_group *group, struct mali_session_data *session, mali_bool is_reload)
+{
+	MALI_DEBUG_PRINT(5, ("Mali group: Activating page directory 0x%08X from session 0x%08X on group %s\n",
+			     mali_session_get_page_directory(session), session,
+			     mali_group_core_description(group)));
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	if (group->session != session || MALI_TRUE == is_reload) {
+		/* Different session than last time, so we need to do some work */
+		MALI_DEBUG_PRINT(5, ("Mali group: Activate session: %08x previous: %08x on group %s\n",
+				     session, group->session,
+				     mali_group_core_description(group)));
+		mali_mmu_activate_page_directory(group->mmu, mali_session_get_page_directory(session));
+		group->session = session;
+	} else {
+		/* Same session as last time, so no work required */
+		MALI_DEBUG_PRINT(4, ("Mali group: Activate existing session 0x%08X on group %s\n",
+				     session->page_directory,
+				     mali_group_core_description(group)));
+		mali_mmu_zap_tlb_without_stall(group->mmu);
+	}
+}
+
+static void mali_group_recovery_reset(struct mali_group *group)
+{
+	_mali_osk_errcode_t err;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	/* Stop cores, bus stop */
+	if (NULL != group->pp_core) {
+		mali_pp_stop_bus(group->pp_core);
+	} else {
+		mali_gp_stop_bus(group->gp_core);
+	}
+
+	/* Flush MMU and clear page fault (if any) */
+	mali_mmu_activate_fault_flush_page_directory(group->mmu);
+	mali_mmu_page_fault_done(group->mmu);
+
+	/* Wait for cores to stop bus, then do a hard reset on them */
+	if (NULL != group->pp_core) {
+		if (mali_group_is_virtual(group)) {
+			struct mali_group *child, *temp;
+
+			/* Disable the broadcast unit while we do reset directly on the member cores. */
+			mali_bcast_disable(group->bcast_core);
+
+			_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list, struct mali_group, group_list) {
+				mali_pp_stop_bus_wait(child->pp_core);
+				mali_pp_hard_reset(child->pp_core);
+			}
+
+			mali_bcast_enable(group->bcast_core);
+		} else {
+			mali_pp_stop_bus_wait(group->pp_core);
+			mali_pp_hard_reset(group->pp_core);
+		}
+	} else {
+		mali_gp_stop_bus_wait(group->gp_core);
+		mali_gp_hard_reset(group->gp_core);
+	}
+
+	/* Reset MMU */
+	err = mali_mmu_reset(group->mmu);
+	MALI_DEBUG_ASSERT(_MALI_OSK_ERR_OK == err);
+	MALI_IGNORE(err);
+
+	group->session = NULL;
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_group_dump_state(struct mali_group *group, char *buf, u32 size)
+{
+	int n = 0;
+	int i;
+	struct mali_group *child;
+	struct mali_group *temp;
+
+	if (mali_group_is_virtual(group)) {
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"Virtual PP Group: %p\n", group);
+	} else if (mali_group_is_in_virtual(group)) {
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"Child PP Group: %p\n", group);
+	} else if (NULL != group->pp_core) {
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"Physical PP Group: %p\n", group);
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"GP Group: %p\n", group);
+	}
+
+	switch (group->state) {
+	case MALI_GROUP_STATE_INACTIVE:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"\tstate: INACTIVE\n");
+		break;
+	case MALI_GROUP_STATE_ACTIVATION_PENDING:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"\tstate: ACTIVATION_PENDING\n");
+		break;
+	case MALI_GROUP_STATE_ACTIVE:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"\tstate: MALI_GROUP_STATE_ACTIVE\n");
+		break;
+	default:
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"\tstate: UNKNOWN (%d)\n", group->state);
+		MALI_DEBUG_ASSERT(0);
+		break;
+	}
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tSW power: %s\n",
+				group->power_is_on ? "On" : "Off");
+
+	n += mali_pm_dump_state_domain(group->pm_domain, buf + n, size - n);
+
+	for (i = 0; i < 2; i++) {
+		if (NULL != group->l2_cache_core[i]) {
+			struct mali_pm_domain *domain;
+			domain = mali_l2_cache_get_pm_domain(
+					 group->l2_cache_core[i]);
+			n += mali_pm_dump_state_domain(domain,
+						       buf + n, size - n);
+		}
+	}
+
+	if (group->gp_core) {
+		n += mali_gp_dump_state(group->gp_core, buf + n, size - n);
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"\tGP running job: %p\n", group->gp_running_job);
+	}
+
+	if (group->pp_core) {
+		n += mali_pp_dump_state(group->pp_core, buf + n, size - n);
+		n += _mali_osk_snprintf(buf + n, size - n,
+					"\tPP running job: %p, subjob %d \n",
+					group->pp_running_job,
+					group->pp_running_sub_job);
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(child, temp, &group->group_list,
+				    struct mali_group, group_list) {
+		n += mali_group_dump_state(child, buf + n, size - n);
+	}
+
+	return n;
+}
+#endif
+
+_mali_osk_errcode_t mali_group_upper_half_mmu(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+	_mali_osk_errcode_t ret;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_lock();
+	if (!mali_group_is_working(group)) {
+		/* Not working, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif
+	if (NULL != group->gp_core) {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+					      0, 0, /* No pid and tid for interrupt handler */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP_MMU(0),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+					      0, 0, /* No pid and tid for interrupt handler */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP_MMU(
+						      mali_pp_core_get_id(group->pp_core)),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	}
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_unlock();
+#endif
+#endif
+
+	ret = mali_executor_interrupt_mmu(group, MALI_TRUE);
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_lock();
+	if (!mali_group_is_working(group) && (!mali_group_power_is_on(group))) {
+		/* group complete and on job shedule on it, it already power off */
+		if (NULL != group->gp_core) {
+			_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+						      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+						      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+						      0, 0, /* No pid and tid for interrupt handler */
+						      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP_MMU(0),
+						      0xFFFFFFFF, 0);
+		} else {
+			_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+						      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+						      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+						      0, 0, /* No pid and tid for interrupt handler */
+						      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP_MMU(
+							      mali_pp_core_get_id(group->pp_core)),
+						      0xFFFFFFFF, 0);
+		}
+
+		mali_executor_unlock();
+		return ret;
+	}
+#endif
+
+	if (NULL != group->gp_core) {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+					      0, 0, /* No pid and tid for interrupt handler */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP_MMU(0),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	} else {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+					      0, 0, /* No pid and tid for interrupt handler */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP_MMU(
+						      mali_pp_core_get_id(group->pp_core)),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	}
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_unlock();
+#endif
+#endif
+
+	return ret;
+}
+
+static void mali_group_bottom_half_mmu(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+
+	if (NULL != group->gp_core) {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+					      0, _mali_osk_get_tid(), /* pid and tid */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP_MMU(0),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+					      0, _mali_osk_get_tid(), /* pid and tid */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP_MMU(
+						      mali_pp_core_get_id(group->pp_core)),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	}
+
+	mali_executor_interrupt_mmu(group, MALI_FALSE);
+
+	if (NULL != group->gp_core) {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+					      0, _mali_osk_get_tid(), /* pid and tid */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP_MMU(0),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	} else {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+					      0, _mali_osk_get_tid(), /* pid and tid */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP_MMU(
+						      mali_pp_core_get_id(group->pp_core)),
+					      mali_mmu_get_rawstat(group->mmu), 0);
+	}
+}
+
+_mali_osk_errcode_t mali_group_upper_half_gp(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+	_mali_osk_errcode_t ret;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_lock();
+	if (!mali_group_is_working(group)) {
+		/* Not working, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+				      0, 0, /* No pid and tid for interrupt handler */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP(0),
+				      mali_gp_get_rawstat(group->gp_core), 0);
+
+	MALI_DEBUG_PRINT(4, ("Group: Interrupt 0x%08X from %s\n",
+			     mali_gp_get_rawstat(group->gp_core),
+			     mali_group_core_description(group)));
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_unlock();
+#endif
+#endif
+	ret = mali_executor_interrupt_gp(group, MALI_TRUE);
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_lock();
+	if (!mali_group_is_working(group) && (!mali_group_power_is_on(group))) {
+		/* group complete and on job shedule on it, it already power off */
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+					      0, 0, /* No pid and tid for interrupt handler */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP(0),
+					      0xFFFFFFFF, 0);
+		mali_executor_unlock();
+		return ret;
+	}
+#endif
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+				      0, 0, /* No pid and tid for interrupt handler */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP(0),
+				      mali_gp_get_rawstat(group->gp_core), 0);
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_unlock();
+#endif
+#endif
+	return ret;
+}
+
+static void mali_group_bottom_half_gp(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+				      0, _mali_osk_get_tid(), /* pid and tid */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP(0),
+				      mali_gp_get_rawstat(group->gp_core), 0);
+
+	mali_executor_interrupt_gp(group, MALI_FALSE);
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+				      0, _mali_osk_get_tid(), /* pid and tid */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP(0),
+				      mali_gp_get_rawstat(group->gp_core), 0);
+}
+
+_mali_osk_errcode_t mali_group_upper_half_pp(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+	_mali_osk_errcode_t ret;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_lock();
+	if (!mali_group_is_working(group)) {
+		/* Not working, so nothing to do */
+		mali_executor_unlock();
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+				      0, 0, /* No pid and tid for interrupt handler */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP(
+					      mali_pp_core_get_id(group->pp_core)),
+				      mali_pp_get_rawstat(group->pp_core), 0);
+
+	MALI_DEBUG_PRINT(4, ("Group: Interrupt 0x%08X from %s\n",
+			     mali_pp_get_rawstat(group->pp_core),
+			     mali_group_core_description(group)));
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_unlock();
+#endif
+#endif
+
+	ret = mali_executor_interrupt_pp(group, MALI_TRUE);
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_lock();
+	if (!mali_group_is_working(group) && (!mali_group_power_is_on(group))) {
+		/* group complete and on job shedule on it, it already power off */
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+					      0, 0, /* No pid and tid for interrupt handler */
+					      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP(
+						      mali_pp_core_get_id(group->pp_core)),
+					      0xFFFFFFFF, 0);
+		mali_executor_unlock();
+		return ret;
+	}
+#endif
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF,
+				      0, 0, /* No pid and tid for interrupt handler */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP(
+					      mali_pp_core_get_id(group->pp_core)),
+				      mali_pp_get_rawstat(group->pp_core), 0);
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	mali_executor_unlock();
+#endif
+#endif
+	return ret;
+}
+
+static void mali_group_bottom_half_pp(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_START |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+				      0, _mali_osk_get_tid(), /* pid and tid */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP(
+					      mali_pp_core_get_id(group->pp_core)),
+				      mali_pp_get_rawstat(group->pp_core), 0);
+
+	mali_executor_interrupt_pp(group, MALI_FALSE);
+
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_STOP |
+				      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+				      MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF,
+				      0, _mali_osk_get_tid(), /* pid and tid */
+				      MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP(
+					      mali_pp_core_get_id(group->pp_core)),
+				      mali_pp_get_rawstat(group->pp_core), 0);
+}
+
+static void mali_group_timeout(void *data)
+{
+	struct mali_group *group = (struct mali_group *)data;
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	MALI_DEBUG_PRINT(2, ("Group: timeout handler for %s at %u\n",
+			     mali_group_core_description(group),
+			     _mali_osk_time_tickcount()));
+
+	if (NULL != group->gp_core) {
+		mali_group_schedule_bottom_half_gp(group);
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+		mali_group_schedule_bottom_half_pp(group);
+	}
+}
+
+mali_bool mali_group_zap_session(struct mali_group *group,
+				 struct mali_session_data *session)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	if (group->session != session) {
+		/* not running from this session */
+		return MALI_TRUE; /* success */
+	}
+
+	if (group->is_working) {
+		/* The Zap also does the stall and disable_stall */
+		mali_bool zap_success = mali_mmu_zap_tlb(group->mmu);
+		return zap_success;
+	} else {
+		/* Just remove the session instead of zapping */
+		mali_group_clear_session(group);
+		return MALI_TRUE; /* success */
+	}
+}
+
+#if defined(CONFIG_MALI400_PROFILING)
+static void mali_group_report_l2_cache_counters_per_core(struct mali_group *group, u32 core_num)
+{
+	u32 source0 = 0;
+	u32 value0 = 0;
+	u32 source1 = 0;
+	u32 value1 = 0;
+	u32 profiling_channel = 0;
+
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	switch (core_num) {
+	case 0:
+		profiling_channel = MALI_PROFILING_EVENT_TYPE_SINGLE |
+				    MALI_PROFILING_EVENT_CHANNEL_GPU |
+				    MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L20_COUNTERS;
+		break;
+	case 1:
+		profiling_channel = MALI_PROFILING_EVENT_TYPE_SINGLE |
+				    MALI_PROFILING_EVENT_CHANNEL_GPU |
+				    MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L21_COUNTERS;
+		break;
+	case 2:
+		profiling_channel = MALI_PROFILING_EVENT_TYPE_SINGLE |
+				    MALI_PROFILING_EVENT_CHANNEL_GPU |
+				    MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L22_COUNTERS;
+		break;
+	default:
+		profiling_channel = MALI_PROFILING_EVENT_TYPE_SINGLE |
+				    MALI_PROFILING_EVENT_CHANNEL_GPU |
+				    MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L20_COUNTERS;
+		break;
+	}
+
+	if (0 == core_num) {
+		mali_l2_cache_core_get_counter_values(group->l2_cache_core[0], &source0, &value0, &source1, &value1);
+	}
+	if (1 == core_num) {
+		if (1 == mali_l2_cache_get_id(group->l2_cache_core[0])) {
+			mali_l2_cache_core_get_counter_values(group->l2_cache_core[0], &source0, &value0, &source1, &value1);
+		} else if (1 == mali_l2_cache_get_id(group->l2_cache_core[1])) {
+			mali_l2_cache_core_get_counter_values(group->l2_cache_core[1], &source0, &value0, &source1, &value1);
+		}
+	}
+	if (2 == core_num) {
+		if (2 == mali_l2_cache_get_id(group->l2_cache_core[0])) {
+			mali_l2_cache_core_get_counter_values(group->l2_cache_core[0], &source0, &value0, &source1, &value1);
+		} else if (2 == mali_l2_cache_get_id(group->l2_cache_core[1])) {
+			mali_l2_cache_core_get_counter_values(group->l2_cache_core[1], &source0, &value0, &source1, &value1);
+		}
+	}
+
+	_mali_osk_profiling_add_event(profiling_channel, source1 << 8 | source0, value0, value1, 0, 0);
+}
+#endif /* #if defined(CONFIG_MALI400_PROFILING) */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_group.h b/drivers/gpu/arm/mali400/common/mali_group.h
--- a/drivers/gpu/arm/mali400/common/mali_group.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_group.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,460 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_GROUP_H__
+#define __MALI_GROUP_H__
+
+#include "mali_osk.h"
+#include "mali_l2_cache.h"
+#include "mali_mmu.h"
+#include "mali_gp.h"
+#include "mali_pp.h"
+#include "mali_session.h"
+#include "mali_osk_profiling.h"
+
+/**
+ * @brief Default max runtime [ms] for a core job - used by timeout timers
+ */
+#define MALI_MAX_JOB_RUNTIME_DEFAULT 5000
+
+extern int mali_max_job_runtime;
+
+#define MALI_MAX_NUMBER_OF_GROUPS 10
+#define MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS 8
+
+enum mali_group_state {
+	MALI_GROUP_STATE_INACTIVE,
+	MALI_GROUP_STATE_ACTIVATION_PENDING,
+	MALI_GROUP_STATE_ACTIVE,
+};
+
+/**
+ * The structure represents a render group
+ * A render group is defined by all the cores that share the same Mali MMU
+ */
+
+struct mali_group {
+	struct mali_mmu_core        *mmu;
+	struct mali_session_data    *session;
+
+	enum mali_group_state        state;
+	mali_bool                    power_is_on;
+
+	mali_bool                    is_working;
+	unsigned long                start_time; /* in ticks */
+
+	struct mali_gp_core         *gp_core;
+	struct mali_gp_job          *gp_running_job;
+
+	struct mali_pp_core         *pp_core;
+	struct mali_pp_job          *pp_running_job;
+	u32                         pp_running_sub_job;
+
+	struct mali_pm_domain       *pm_domain;
+
+	struct mali_l2_cache_core   *l2_cache_core[2];
+	u32                         l2_cache_core_ref_count[2];
+
+	/* Parent virtual group (if any) */
+	struct mali_group           *parent_group;
+
+	struct mali_dlbu_core       *dlbu_core;
+	struct mali_bcast_unit      *bcast_core;
+
+	/* Used for working groups which needs to be disabled */
+	mali_bool                    disable_requested;
+
+	/* Used by group to link child groups (for virtual group) */
+	_mali_osk_list_t            group_list;
+
+	/* Used by executor module in order to link groups of same state */
+	_mali_osk_list_t            executor_list;
+
+	/* Used by PM domains to link groups of same domain */
+	_mali_osk_list_t             pm_domain_list;
+
+	_mali_osk_wq_work_t         *bottom_half_work_mmu;
+	_mali_osk_wq_work_t         *bottom_half_work_gp;
+	_mali_osk_wq_work_t         *bottom_half_work_pp;
+
+	_mali_osk_timer_t           *timeout_timer;
+};
+
+/** @brief Create a new Mali group object
+ *
+ * @return A pointer to a new group object
+ */
+struct mali_group *mali_group_create(struct mali_l2_cache_core *core,
+				     struct mali_dlbu_core *dlbu,
+				     struct mali_bcast_unit *bcast,
+				     u32 domain_index);
+
+void mali_group_dump_status(struct mali_group *group);
+
+void mali_group_delete(struct mali_group *group);
+
+_mali_osk_errcode_t mali_group_add_mmu_core(struct mali_group *group,
+		struct mali_mmu_core *mmu_core);
+void mali_group_remove_mmu_core(struct mali_group *group);
+
+_mali_osk_errcode_t mali_group_add_gp_core(struct mali_group *group,
+		struct mali_gp_core *gp_core);
+void mali_group_remove_gp_core(struct mali_group *group);
+
+_mali_osk_errcode_t mali_group_add_pp_core(struct mali_group *group,
+		struct mali_pp_core *pp_core);
+void mali_group_remove_pp_core(struct mali_group *group);
+
+MALI_STATIC_INLINE const char *mali_group_core_description(
+	struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	if (NULL != group->pp_core) {
+		return mali_pp_core_description(group->pp_core);
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+		return mali_gp_core_description(group->gp_core);
+	}
+}
+
+MALI_STATIC_INLINE mali_bool mali_group_is_virtual(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+#if (defined(CONFIG_MALI450) || defined(CONFIG_MALI470))
+	return (NULL != group->dlbu_core);
+#else
+	return MALI_FALSE;
+#endif
+}
+
+/** @brief Check if a group is a part of a virtual group or not
+ */
+MALI_STATIC_INLINE mali_bool mali_group_is_in_virtual(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+#if (defined(CONFIG_MALI450) || defined(CONFIG_MALI470))
+	return (NULL != group->parent_group) ? MALI_TRUE : MALI_FALSE;
+#else
+	return MALI_FALSE;
+#endif
+}
+
+/** @brief Reset group
+ *
+ * This function will reset the entire group,
+ * including all the cores present in the group.
+ *
+ * @param group Pointer to the group to reset
+ */
+void mali_group_reset(struct mali_group *group);
+
+MALI_STATIC_INLINE struct mali_session_data *mali_group_get_session(
+	struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	return group->session;
+}
+
+MALI_STATIC_INLINE void mali_group_clear_session(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	if (NULL != group->session) {
+		mali_mmu_activate_empty_page_directory(group->mmu);
+		group->session = NULL;
+	}
+}
+
+enum mali_group_state mali_group_activate(struct mali_group *group);
+
+/*
+ * Change state from ACTIVATION_PENDING to ACTIVE
+ * For virtual group, all childs need to be ACTIVE first
+ */
+mali_bool mali_group_set_active(struct mali_group *group);
+
+/*
+ * @return MALI_TRUE means one or more domains can now be powered off,
+ * and caller should call either mali_pm_update_async() or
+ * mali_pm_update_sync() in order to do so.
+ */
+mali_bool mali_group_deactivate(struct mali_group *group);
+
+MALI_STATIC_INLINE enum mali_group_state mali_group_get_state(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return group->state;
+}
+
+MALI_STATIC_INLINE mali_bool mali_group_power_is_on(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	return group->power_is_on;
+}
+
+void mali_group_power_up(struct mali_group *group);
+void mali_group_power_down(struct mali_group *group);
+
+MALI_STATIC_INLINE void mali_group_set_disable_request(
+	struct mali_group *group, mali_bool disable)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	group->disable_requested = disable;
+
+	/**
+	 * When one of child group's disable_requeset is set TRUE, then
+	 * the disable_request of parent group should also be set to TRUE.
+	 * While, the disable_request of parent group should only be set to FALSE
+	 * only when all of its child group's disable_request are set to FALSE.
+	 */
+	if (NULL != group->parent_group && MALI_TRUE == disable) {
+		group->parent_group->disable_requested = disable;
+	}
+}
+
+MALI_STATIC_INLINE mali_bool mali_group_disable_requested(
+	struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return group->disable_requested;
+}
+
+/** @brief Virtual groups */
+void mali_group_add_group(struct mali_group *parent, struct mali_group *child);
+struct mali_group *mali_group_acquire_group(struct mali_group *parent);
+void mali_group_remove_group(struct mali_group *parent, struct mali_group *child);
+
+/** @brief Checks if the group is working.
+ */
+MALI_STATIC_INLINE mali_bool mali_group_is_working(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	if (mali_group_is_in_virtual(group)) {
+		struct mali_group *tmp_group = mali_executor_get_virtual_group();
+		return tmp_group->is_working;
+	}
+	return group->is_working;
+}
+
+MALI_STATIC_INLINE struct mali_gp_job *mali_group_get_running_gp_job(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return group->gp_running_job;
+}
+
+/** @brief Zap MMU TLB on all groups
+ *
+ * Zap TLB on group if \a session is active.
+ */
+mali_bool mali_group_zap_session(struct mali_group *group,
+				 struct mali_session_data *session);
+
+/** @brief Get pointer to GP core object
+ */
+MALI_STATIC_INLINE struct mali_gp_core *mali_group_get_gp_core(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	return group->gp_core;
+}
+
+/** @brief Get pointer to PP core object
+ */
+MALI_STATIC_INLINE struct mali_pp_core *mali_group_get_pp_core(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	return group->pp_core;
+}
+
+/** @brief Start GP job
+ */
+void mali_group_start_gp_job(struct mali_group *group, struct mali_gp_job *job, mali_bool gpu_secure_mode_pre_enabled);
+
+void mali_group_start_pp_job(struct mali_group *group, struct mali_pp_job *job, u32 sub_job, mali_bool gpu_secure_mode_pre_enabled);
+
+/** @brief Start virtual group Job on a virtual group
+*/
+void mali_group_start_job_on_virtual(struct mali_group *group, struct mali_pp_job *job, u32 first_subjob, u32 last_subjob);
+
+
+/** @brief Start a subjob from a particular on a specific PP group
+*/
+void mali_group_start_job_on_group(struct mali_group *group, struct mali_pp_job *job, u32 subjob);
+
+
+/** @brief remove all the unused groups in tmp_unused group  list, so that the group is in consistent status.
+ */
+void mali_group_non_dlbu_job_done_virtual(struct mali_group *group);
+
+
+/** @brief Resume GP job that suspended waiting for more heap memory
+ */
+void mali_group_resume_gp_with_new_heap(struct mali_group *group, u32 job_id, u32 start_addr, u32 end_addr);
+
+MALI_STATIC_INLINE enum mali_interrupt_result mali_group_get_interrupt_result_gp(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_gp_get_interrupt_result(group->gp_core);
+}
+
+MALI_STATIC_INLINE enum mali_interrupt_result mali_group_get_interrupt_result_pp(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_pp_get_interrupt_result(group->pp_core);
+}
+
+MALI_STATIC_INLINE enum mali_interrupt_result mali_group_get_interrupt_result_mmu(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_mmu_get_interrupt_result(group->mmu);
+}
+
+MALI_STATIC_INLINE mali_bool mali_group_gp_is_active(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_gp_is_active(group->gp_core);
+}
+
+MALI_STATIC_INLINE mali_bool mali_group_pp_is_active(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_pp_is_active(group->pp_core);
+}
+
+MALI_STATIC_INLINE mali_bool mali_group_has_timed_out(struct mali_group *group)
+{
+	unsigned long time_cost;
+	struct mali_group *tmp_group = group;
+
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+
+	/* if the group is in virtual need to use virtual_group's start time */
+	if (mali_group_is_in_virtual(group)) {
+		tmp_group = mali_executor_get_virtual_group();
+	}
+
+	time_cost = _mali_osk_time_tickcount() - tmp_group->start_time;
+	if (_mali_osk_time_mstoticks(mali_max_job_runtime) <= time_cost) {
+		/*
+		 * current tick is at or after timeout end time,
+		 * so this is a valid timeout
+		 */
+		return MALI_TRUE;
+	} else {
+		/*
+		 * Not a valid timeout. A HW interrupt probably beat
+		 * us to it, and the timer wasn't properly deleted
+		 * (async deletion used due to atomic context).
+		 */
+		return MALI_FALSE;
+	}
+}
+
+MALI_STATIC_INLINE void mali_group_mask_all_interrupts_gp(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_gp_mask_all_interrupts(group->gp_core);
+}
+
+MALI_STATIC_INLINE void mali_group_mask_all_interrupts_pp(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return mali_pp_mask_all_interrupts(group->pp_core);
+}
+
+MALI_STATIC_INLINE void mali_group_enable_interrupts_gp(
+	struct mali_group *group,
+	enum mali_interrupt_result exceptions)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	mali_gp_enable_interrupts(group->gp_core, exceptions);
+}
+
+MALI_STATIC_INLINE void mali_group_schedule_bottom_half_gp(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->gp_core);
+	_mali_osk_wq_schedule_work(group->bottom_half_work_gp);
+}
+
+
+MALI_STATIC_INLINE void mali_group_schedule_bottom_half_pp(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->pp_core);
+	_mali_osk_wq_schedule_work(group->bottom_half_work_pp);
+}
+
+MALI_STATIC_INLINE void mali_group_schedule_bottom_half_mmu(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT_POINTER(group->mmu);
+	_mali_osk_wq_schedule_work(group->bottom_half_work_mmu);
+}
+
+struct mali_pp_job *mali_group_complete_pp(struct mali_group *group, mali_bool success, u32 *sub_job);
+
+struct mali_gp_job *mali_group_complete_gp(struct mali_group *group, mali_bool success);
+
+#if defined(CONFIG_MALI400_PROFILING)
+MALI_STATIC_INLINE void mali_group_oom(struct mali_group *group)
+{
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SUSPEND |
+				      MALI_PROFILING_MAKE_EVENT_CHANNEL_GP(0),
+				      0, 0, 0, 0, 0);
+}
+#endif
+
+struct mali_group *mali_group_get_glob_group(u32 index);
+u32 mali_group_get_glob_num_groups(void);
+
+u32 mali_group_dump_state(struct mali_group *group, char *buf, u32 size);
+
+
+_mali_osk_errcode_t mali_group_upper_half_mmu(void *data);
+_mali_osk_errcode_t mali_group_upper_half_gp(void *data);
+_mali_osk_errcode_t mali_group_upper_half_pp(void *data);
+
+MALI_STATIC_INLINE mali_bool mali_group_is_empty(struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(group);
+	MALI_DEBUG_ASSERT(mali_group_is_virtual(group));
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	return _mali_osk_list_empty(&group->group_list);
+}
+
+#endif /* __MALI_GROUP_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_hw_core.c b/drivers/gpu/arm/mali400/common/mali_hw_core.c
--- a/drivers/gpu/arm/mali400/common/mali_hw_core.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_hw_core.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_hw_core.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_osk_mali.h"
+
+_mali_osk_errcode_t mali_hw_core_create(struct mali_hw_core *core, const _mali_osk_resource_t *resource, u32 reg_size)
+{
+	core->phys_addr = resource->base;
+	core->phys_offset = resource->base - _mali_osk_resource_base_address();
+	core->description = resource->description;
+	core->size = reg_size;
+
+	MALI_DEBUG_ASSERT(core->phys_offset < core->phys_addr);
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_mem_reqregion(core->phys_addr, core->size, core->description)) {
+		core->mapped_registers = _mali_osk_mem_mapioregion(core->phys_addr, core->size, core->description);
+		if (NULL != core->mapped_registers) {
+			return _MALI_OSK_ERR_OK;
+		} else {
+			MALI_PRINT_ERROR(("Failed to map memory region for core %s at phys_addr 0x%08X\n", core->description, core->phys_addr));
+		}
+		_mali_osk_mem_unreqregion(core->phys_addr, core->size);
+	} else {
+		MALI_PRINT_ERROR(("Failed to request memory region for core %s at phys_addr 0x%08X\n", core->description, core->phys_addr));
+	}
+
+	return _MALI_OSK_ERR_FAULT;
+}
+
+void mali_hw_core_delete(struct mali_hw_core *core)
+{
+	if (NULL != core->mapped_registers) {
+		_mali_osk_mem_unmapioregion(core->phys_addr, core->size, core->mapped_registers);
+		core->mapped_registers = NULL;
+	}
+	_mali_osk_mem_unreqregion(core->phys_addr, core->size);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_hw_core.h b/drivers/gpu/arm/mali400/common/mali_hw_core.h
--- a/drivers/gpu/arm/mali400/common/mali_hw_core.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_hw_core.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_HW_CORE_H__
+#define __MALI_HW_CORE_H__
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+/**
+ * The common parts for all Mali HW cores (GP, PP, MMU, L2 and PMU)
+ * This struct is embedded inside all core specific structs.
+ */
+struct mali_hw_core {
+	uintptr_t phys_addr;              /**< Physical address of the registers */
+	u32 phys_offset;                  /**< Offset from start of Mali to registers */
+	u32 size;                         /**< Size of registers */
+	mali_io_address mapped_registers; /**< Virtual mapping of the registers */
+	const char *description;          /**< Name of unit (as specified in device configuration) */
+};
+
+#define MALI_REG_POLL_COUNT_FAST 1000000
+#define MALI_REG_POLL_COUNT_SLOW 1000000
+
+/*
+ * GP and PP core translate their int_stat/rawstat into one of these
+ */
+enum mali_interrupt_result {
+	MALI_INTERRUPT_RESULT_NONE,
+	MALI_INTERRUPT_RESULT_SUCCESS,
+	MALI_INTERRUPT_RESULT_SUCCESS_VS,
+	MALI_INTERRUPT_RESULT_SUCCESS_PLBU,
+	MALI_INTERRUPT_RESULT_OOM,
+	MALI_INTERRUPT_RESULT_ERROR
+};
+
+_mali_osk_errcode_t mali_hw_core_create(struct mali_hw_core *core, const _mali_osk_resource_t *resource, u32 reg_size);
+void mali_hw_core_delete(struct mali_hw_core *core);
+
+/* nexell add */
+#if defined(CONFIG_ARCH_S5P4418) && defined(CONFIG_SECURE_REG_ACCESS)
+#define USE_PSCI_REG_READ_WRITE
+extern void write_sec_reg(void __iomem *reg, int val);
+extern int read_sec_reg(void __iomem *reg);
+#endif
+
+#ifdef USE_PSCI_REG_READ_WRITE
+MALI_STATIC_INLINE u32 nx_register_read(u32 phys_addr_page, u32 offset)
+{
+	void *phys_addr = (void*)(phys_addr_page + offset);
+	return read_sec_reg(phys_addr);
+}
+
+MALI_STATIC_INLINE void nx_register_write(u32 phys_addr_page, u32 offset,
+					  u32 new_val)
+{
+	void *phys_addr = (void*)(phys_addr_page + offset);
+	write_sec_reg(phys_addr, new_val);
+}
+#endif
+
+MALI_STATIC_INLINE u32 mali_hw_core_register_read(struct mali_hw_core *core, u32 relative_address)
+{
+#if !defined( USE_PSCI_REG_READ_WRITE )
+	u32 read_val;
+	read_val = _mali_osk_mem_ioread32(core->mapped_registers, relative_address);
+	MALI_DEBUG_PRINT(6, ("register_read for core %s, relative addr=0x%04X, val=0x%08X\n",
+			     core->description, relative_address, read_val));
+	return read_val;
+#else
+	return nx_register_read(core->phys_addr, relative_address);
+#endif
+}
+
+MALI_STATIC_INLINE void mali_hw_core_register_write_relaxed(struct mali_hw_core *core, u32 relative_address, u32 new_val)
+{
+	MALI_DEBUG_PRINT(6, ("register_write_relaxed for core %s, relative addr=0x%04X, val=0x%08X\n",
+			     core->description, relative_address, new_val));
+#if !defined( USE_PSCI_REG_READ_WRITE )
+	_mali_osk_mem_iowrite32_relaxed(core->mapped_registers, relative_address, new_val);
+#else
+	nx_register_write(core->phys_addr, relative_address, new_val);
+#endif
+}
+
+/* Conditionally write a register.
+ * The register will only be written if the new value is different from the old_value.
+ * If the new value is different, the old value will also be updated */
+MALI_STATIC_INLINE void mali_hw_core_register_write_relaxed_conditional(struct mali_hw_core *core, u32 relative_address, u32 new_val, const u32 old_val)
+{
+	MALI_DEBUG_PRINT(6, ("register_write_relaxed for core %s, relative addr=0x%04X, val=0x%08X\n",
+			     core->description, relative_address, new_val));
+	if (old_val != new_val) {
+#if !defined( USE_PSCI_REG_READ_WRITE )
+		_mali_osk_mem_iowrite32_relaxed(core->mapped_registers, relative_address, new_val);
+#else
+		nx_register_write(core->phys_addr, relative_address, new_val);
+#endif
+	}
+}
+
+MALI_STATIC_INLINE void mali_hw_core_register_write(struct mali_hw_core *core, u32 relative_address, u32 new_val)
+{
+	MALI_DEBUG_PRINT(6, ("register_write for core %s, relative addr=0x%04X, val=0x%08X\n",
+			     core->description, relative_address, new_val));
+#if !defined( USE_PSCI_REG_READ_WRITE )
+	_mali_osk_mem_iowrite32(core->mapped_registers, relative_address, new_val);
+#else
+	nx_register_write(core->phys_addr, relative_address, new_val);
+#endif
+}
+
+MALI_STATIC_INLINE void mali_hw_core_register_write_array_relaxed(struct mali_hw_core *core, u32 relative_address, u32 *write_array, u32 nr_of_regs)
+{
+	u32 i;
+	MALI_DEBUG_PRINT(6, ("register_write_array: for core %s, relative addr=0x%04X, nr of regs=%u\n",
+			     core->description, relative_address, nr_of_regs));
+
+	/* Do not use burst writes against the registers */
+	for (i = 0; i < nr_of_regs; i++) {
+		mali_hw_core_register_write_relaxed(core, relative_address + i * 4, write_array[i]);
+	}
+}
+
+/* Conditionally write a set of registers.
+ * The register will only be written if the new value is different from the old_value.
+ * If the new value is different, the old value will also be updated */
+MALI_STATIC_INLINE void mali_hw_core_register_write_array_relaxed_conditional(struct mali_hw_core *core, u32 relative_address, u32 *write_array, u32 nr_of_regs, const u32 *old_array)
+{
+	u32 i;
+	MALI_DEBUG_PRINT(6, ("register_write_array: for core %s, relative addr=0x%04X, nr of regs=%u\n",
+			     core->description, relative_address, nr_of_regs));
+
+	/* Do not use burst writes against the registers */
+	for (i = 0; i < nr_of_regs; i++) {
+		if (old_array[i] != write_array[i]) {
+			mali_hw_core_register_write_relaxed(core, relative_address + i * 4, write_array[i]);
+		}
+	}
+}
+
+#endif /* __MALI_HW_CORE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_kernel_common.h b/drivers/gpu/arm/mali400/common/mali_kernel_common.h
--- a/drivers/gpu/arm/mali400/common/mali_kernel_common.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_kernel_common.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2010, 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_KERNEL_COMMON_H__
+#define __MALI_KERNEL_COMMON_H__
+
+#include "mali_osk.h"
+
+/* Make sure debug is defined when it should be */
+#ifndef DEBUG
+#if defined(_DEBUG)
+#define DEBUG
+#endif
+#endif
+
+/* The file include several useful macros for error checking, debugging and printing.
+ * - MALI_PRINTF(...)           Do not use this function: Will be included in Release builds.
+ * - MALI_DEBUG_PRINT(nr, (X) ) Prints the second argument if nr<=MALI_DEBUG_LEVEL.
+ * - MALI_DEBUG_ERROR( (X) )    Prints an errortext, a source trace, and the given error message.
+ * - MALI_DEBUG_ASSERT(exp,(X)) If the asserted expr is false, the program will exit.
+ * - MALI_DEBUG_ASSERT_POINTER(pointer)  Triggers if the pointer is a zero pointer.
+ * - MALI_DEBUG_CODE( X )       The code inside the macro is only compiled in Debug builds.
+ *
+ * The (X) means that you must add an extra parenthesis around the argumentlist.
+ *
+ * The  printf function: MALI_PRINTF(...) is routed to _mali_osk_debugmsg
+ *
+ * Suggested range for the DEBUG-LEVEL is [1:6] where
+ * [1:2] Is messages with highest priority, indicate possible errors.
+ * [3:4] Is messages with medium priority, output important variables.
+ * [5:6] Is messages with low priority, used during extensive debugging.
+ */
+
+/**
+*  Fundamental error macro. Reports an error code. This is abstracted to allow us to
+*  easily switch to a different error reporting method if we want, and also to allow
+*  us to search for error returns easily.
+*
+*  Note no closing semicolon - this is supplied in typical usage:
+*
+*  MALI_ERROR(MALI_ERROR_OUT_OF_MEMORY);
+*/
+#define MALI_ERROR(error_code) return (error_code)
+
+/**
+ *  Basic error macro, to indicate success.
+ *  Note no closing semicolon - this is supplied in typical usage:
+ *
+ *  MALI_SUCCESS;
+ */
+#define MALI_SUCCESS MALI_ERROR(_MALI_OSK_ERR_OK)
+
+/**
+ *  Basic error macro. This checks whether the given condition is true, and if not returns
+ *  from this function with the supplied error code. This is a macro so that we can override it
+ *  for stress testing.
+ *
+ *  Note that this uses the do-while-0 wrapping to ensure that we don't get problems with dangling
+ *  else clauses. Note also no closing semicolon - this is supplied in typical usage:
+ *
+ *  MALI_CHECK((p!=NULL), ERROR_NO_OBJECT);
+ */
+#define MALI_CHECK(condition, error_code) do { if(!(condition)) MALI_ERROR(error_code); } while(0)
+
+/**
+ *  Error propagation macro. If the expression given is anything other than
+ *  _MALI_OSK_NO_ERROR, then the value is returned from the enclosing function
+ *  as an error code. This effectively acts as a guard clause, and propagates
+ *  error values up the call stack. This uses a temporary value to ensure that
+ *  the error expression is not evaluated twice.
+ *  If the counter for forcing a failure has been set using _mali_force_error,
+ *  this error will be returned without evaluating the expression in
+ *  MALI_CHECK_NO_ERROR
+ */
+#define MALI_CHECK_NO_ERROR(expression) \
+	do { _mali_osk_errcode_t _check_no_error_result=(expression); \
+		if(_check_no_error_result != _MALI_OSK_ERR_OK) \
+			MALI_ERROR(_check_no_error_result); \
+	} while(0)
+
+/**
+ *  Pointer check macro. Checks non-null pointer.
+ */
+#define MALI_CHECK_NON_NULL(pointer, error_code) MALI_CHECK( ((pointer)!=NULL), (error_code) )
+
+/**
+ *  Error macro with goto. This checks whether the given condition is true, and if not jumps
+ *  to the specified label using a goto. The label must therefore be local to the function in
+ *  which this macro appears. This is most usually used to execute some clean-up code before
+ *  exiting with a call to ERROR.
+ *
+ *  Like the other macros, this is a macro to allow us to override the condition if we wish,
+ *  e.g. to force an error during stress testing.
+ */
+#define MALI_CHECK_GOTO(condition, label) do { if(!(condition)) goto label; } while(0)
+
+/**
+ *  Explicitly ignore a parameter passed into a function, to suppress compiler warnings.
+ *  Should only be used with parameter names.
+ */
+#define MALI_IGNORE(x) x=x
+
+#if defined(CONFIG_MALI_QUIET)
+#define MALI_PRINTF(args)
+#else
+#define MALI_PRINTF(args) _mali_osk_dbgmsg args;
+#endif
+
+#define MALI_PRINT_ERROR(args) do{ \
+		MALI_PRINTF(("Mali: ERR: %s\n" ,__FILE__)); \
+		MALI_PRINTF(("           %s()%4d\n           ", __FUNCTION__, __LINE__)) ; \
+		MALI_PRINTF(args); \
+		MALI_PRINTF(("\n")); \
+	} while(0)
+
+#define MALI_PRINT(args) do{ \
+		pr_info("Mali: "); \
+		pr_cont args; \
+	} while (0)
+
+#ifdef DEBUG
+#ifndef mali_debug_level
+extern int mali_debug_level;
+#endif
+
+#define MALI_DEBUG_CODE(code) code
+#define MALI_DEBUG_PRINT(level, args)  do { \
+		if((level) <=  mali_debug_level)\
+		{MALI_PRINTF(("Mali<" #level ">: ")); MALI_PRINTF(args); } \
+	} while (0)
+
+#define MALI_DEBUG_PRINT_ERROR(args) MALI_PRINT_ERROR(args)
+
+#define MALI_DEBUG_PRINT_IF(level,condition,args)  \
+	if((condition)&&((level) <=  mali_debug_level))\
+	{MALI_PRINTF(("Mali<" #level ">: ")); MALI_PRINTF(args); }
+
+#define MALI_DEBUG_PRINT_ELSE(level, args)\
+	else if((level) <=  mali_debug_level)\
+	{ MALI_PRINTF(("Mali<" #level ">: ")); MALI_PRINTF(args); }
+
+/**
+ * @note these variants of DEBUG ASSERTS will cause a debugger breakpoint
+ * to be entered (see _mali_osk_break() ). An alternative would be to call
+ * _mali_osk_abort(), on OSs that support it.
+ */
+#define MALI_DEBUG_PRINT_ASSERT(condition, args) do  {if( !(condition)) { MALI_PRINT_ERROR(args); _mali_osk_break(); } } while(0)
+#define MALI_DEBUG_ASSERT_POINTER(pointer) do  {if( (pointer)== NULL) {MALI_PRINT_ERROR(("NULL pointer " #pointer)); _mali_osk_break();} } while(0)
+#define MALI_DEBUG_ASSERT(condition) do  {if( !(condition)) {MALI_PRINT_ERROR(("ASSERT failed: " #condition )); _mali_osk_break();} } while(0)
+
+#else /* DEBUG */
+
+#define MALI_DEBUG_CODE(code)
+#define MALI_DEBUG_PRINT(string,args) do {} while(0)
+#define MALI_DEBUG_PRINT_ERROR(args) do {} while(0)
+#define MALI_DEBUG_PRINT_IF(level,condition,args) do {} while(0)
+#define MALI_DEBUG_PRINT_ELSE(level,condition,args) do {} while(0)
+#define MALI_DEBUG_PRINT_ASSERT(condition,args) do {} while(0)
+#define MALI_DEBUG_ASSERT_POINTER(pointer) do {} while(0)
+#define MALI_DEBUG_ASSERT(condition) do {} while(0)
+
+#endif /* DEBUG */
+
+/**
+ * variables from user space cannot be dereferenced from kernel space; tagging them
+ * with __user allows the GCC compiler to generate a warning. Other compilers may
+ * not support this so we define it here as an empty macro if the compiler doesn't
+ * define it.
+ */
+#ifndef __user
+#define __user
+#endif
+
+#endif /* __MALI_KERNEL_COMMON_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_kernel_core.c b/drivers/gpu/arm/mali400/common/mali_kernel_core.c
--- a/drivers/gpu/arm/mali400/common/mali_kernel_core.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_kernel_core.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,1339 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_ukk.h"
+#include "mali_kernel_core.h"
+#include "mali_memory.h"
+#include "mali_mem_validation.h"
+#include "mali_mmu.h"
+#include "mali_mmu_page_directory.h"
+#include "mali_dlbu.h"
+#include "mali_broadcast.h"
+#include "mali_gp.h"
+#include "mali_pp.h"
+#include "mali_executor.h"
+#include "mali_pp_job.h"
+#include "mali_group.h"
+#include "mali_pm.h"
+#include "mali_pmu.h"
+#include "mali_scheduler.h"
+#include "mali_kernel_utilization.h"
+#include "mali_l2_cache.h"
+#include "mali_timeline.h"
+#include "mali_soft_job.h"
+#include "mali_pm_domain.h"
+#if defined(CONFIG_MALI400_PROFILING)
+#include "mali_osk_profiling.h"
+#endif
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+#include "mali_profiling_internal.h"
+#endif
+#include "mali_control_timer.h"
+#include "mali_dvfs_policy.h"
+#include <linux/sched.h>
+#include <linux/atomic.h>
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+#include <linux/fence.h>
+#endif
+
+#define MALI_SHARED_MEMORY_DEFAULT_SIZE 0xffffffff
+
+/* Mali GPU memory. Real values come from module parameter or from device specific data */
+unsigned int mali_dedicated_mem_start = 0;
+unsigned int mali_dedicated_mem_size = 0;
+
+/* Default shared memory size is set to 4G. */
+unsigned int mali_shared_mem_size = MALI_SHARED_MEMORY_DEFAULT_SIZE;
+
+/* Frame buffer memory to be accessible by Mali GPU */
+int mali_fb_start = 0;
+int mali_fb_size = 0;
+
+/* Mali max job runtime */
+extern int mali_max_job_runtime;
+
+/** Start profiling from module load? */
+int mali_boot_profiling = 0;
+
+/** Limits for the number of PP cores behind each L2 cache. */
+int mali_max_pp_cores_group_1 = 0xFF;
+int mali_max_pp_cores_group_2 = 0xFF;
+
+int mali_inited_pp_cores_group_1 = 0;
+int mali_inited_pp_cores_group_2 = 0;
+
+static _mali_product_id_t global_product_id = _MALI_PRODUCT_ID_UNKNOWN;
+static uintptr_t global_gpu_base_address = 0;
+static u32 global_gpu_major_version = 0;
+static u32 global_gpu_minor_version = 0;
+
+mali_bool mali_gpu_class_is_mali450 = MALI_FALSE;
+mali_bool mali_gpu_class_is_mali470 = MALI_FALSE;
+
+static _mali_osk_errcode_t mali_set_global_gpu_base_address(void)
+{
+	_mali_osk_errcode_t err = _MALI_OSK_ERR_OK;
+
+	global_gpu_base_address = _mali_osk_resource_base_address();
+	if (0 == global_gpu_base_address) {
+		err = _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	}
+
+	return err;
+}
+
+static u32 mali_get_bcast_id(_mali_osk_resource_t *resource_pp)
+{
+	switch (resource_pp->base - global_gpu_base_address) {
+	case 0x08000:
+	case 0x20000: /* fall-through for aliased mapping */
+		return 0x01;
+	case 0x0A000:
+	case 0x22000: /* fall-through for aliased mapping */
+		return 0x02;
+	case 0x0C000:
+	case 0x24000: /* fall-through for aliased mapping */
+		return 0x04;
+	case 0x0E000:
+	case 0x26000: /* fall-through for aliased mapping */
+		return 0x08;
+	case 0x28000:
+		return 0x10;
+	case 0x2A000:
+		return 0x20;
+	case 0x2C000:
+		return 0x40;
+	case 0x2E000:
+		return 0x80;
+	default:
+		return 0;
+	}
+}
+
+static _mali_osk_errcode_t mali_parse_product_info(void)
+{
+	_mali_osk_resource_t first_pp_resource;
+
+	/* Find the first PP core resource (again) */
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI_OFFSET_PP0, &first_pp_resource)) {
+		/* Create a dummy PP object for this core so that we can read the version register */
+		struct mali_group *group = mali_group_create(NULL, NULL, NULL, MALI_DOMAIN_INDEX_PP0);
+		if (NULL != group) {
+			struct mali_pp_core *pp_core = mali_pp_create(&first_pp_resource, group, MALI_FALSE, mali_get_bcast_id(&first_pp_resource));
+			if (NULL != pp_core) {
+				u32 pp_version;
+
+				pp_version = mali_pp_core_get_version(pp_core);
+
+				mali_group_delete(group);
+
+				global_gpu_major_version = (pp_version >> 8) & 0xFF;
+				global_gpu_minor_version = pp_version & 0xFF;
+
+				switch (pp_version >> 16) {
+				case MALI200_PP_PRODUCT_ID:
+					global_product_id = _MALI_PRODUCT_ID_MALI200;
+					MALI_DEBUG_PRINT(2, ("Found Mali GPU Mali-200 r%up%u\n", global_gpu_major_version, global_gpu_minor_version));
+					MALI_PRINT_ERROR(("Mali-200 is not supported by this driver.\n"));
+					_mali_osk_abort();
+					break;
+				case MALI300_PP_PRODUCT_ID:
+					global_product_id = _MALI_PRODUCT_ID_MALI300;
+					MALI_DEBUG_PRINT(2, ("Found Mali GPU Mali-300 r%up%u\n", global_gpu_major_version, global_gpu_minor_version));
+					break;
+				case MALI400_PP_PRODUCT_ID:
+					global_product_id = _MALI_PRODUCT_ID_MALI400;
+					MALI_DEBUG_PRINT(2, ("Found Mali GPU Mali-400 MP r%up%u\n", global_gpu_major_version, global_gpu_minor_version));
+					break;
+				case MALI450_PP_PRODUCT_ID:
+					global_product_id = _MALI_PRODUCT_ID_MALI450;
+					MALI_DEBUG_PRINT(2, ("Found Mali GPU Mali-450 MP r%up%u\n", global_gpu_major_version, global_gpu_minor_version));
+					break;
+				case MALI470_PP_PRODUCT_ID:
+					global_product_id = _MALI_PRODUCT_ID_MALI470;
+					MALI_DEBUG_PRINT(2, ("Found Mali GPU Mali-470 MP r%up%u\n", global_gpu_major_version, global_gpu_minor_version));
+					break;
+				default:
+					MALI_DEBUG_PRINT(2, ("Found unknown Mali GPU (r%up%u)\n", global_gpu_major_version, global_gpu_minor_version));
+					return _MALI_OSK_ERR_FAULT;
+				}
+
+				return _MALI_OSK_ERR_OK;
+			} else {
+				MALI_PRINT_ERROR(("Failed to create initial PP object\n"));
+			}
+		} else {
+			MALI_PRINT_ERROR(("Failed to create initial group object\n"));
+		}
+	} else {
+		MALI_PRINT_ERROR(("First PP core not specified in config file\n"));
+	}
+
+	return _MALI_OSK_ERR_FAULT;
+}
+
+static void mali_delete_groups(void)
+{
+	struct mali_group *group;
+
+	group = mali_group_get_glob_group(0);
+	while (NULL != group) {
+		mali_group_delete(group);
+		group = mali_group_get_glob_group(0);
+	}
+
+	MALI_DEBUG_ASSERT(0 == mali_group_get_glob_num_groups());
+}
+
+static void mali_delete_l2_cache_cores(void)
+{
+	struct mali_l2_cache_core *l2;
+
+	l2 = mali_l2_cache_core_get_glob_l2_core(0);
+	while (NULL != l2) {
+		mali_l2_cache_delete(l2);
+		l2 = mali_l2_cache_core_get_glob_l2_core(0);
+	}
+
+	MALI_DEBUG_ASSERT(0 == mali_l2_cache_core_get_glob_num_l2_cores());
+}
+
+static struct mali_l2_cache_core *mali_create_l2_cache_core(_mali_osk_resource_t *resource, u32 domain_index)
+{
+	struct mali_l2_cache_core *l2_cache = NULL;
+
+	if (NULL != resource) {
+
+		MALI_DEBUG_PRINT(3, ("Found L2 cache %s\n", resource->description));
+
+		l2_cache = mali_l2_cache_create(resource, domain_index);
+		if (NULL == l2_cache) {
+			MALI_PRINT_ERROR(("Failed to create L2 cache object\n"));
+			return NULL;
+		}
+	}
+	MALI_DEBUG_PRINT(3, ("Created L2 cache core object\n"));
+
+	return l2_cache;
+}
+
+static _mali_osk_errcode_t mali_parse_config_l2_cache(void)
+{
+	struct mali_l2_cache_core *l2_cache = NULL;
+
+	if (mali_is_mali400()) {
+		_mali_osk_resource_t l2_resource;
+		if (_MALI_OSK_ERR_OK != _mali_osk_resource_find(MALI400_OFFSET_L2_CACHE0, &l2_resource)) {
+			MALI_DEBUG_PRINT(3, ("Did not find required Mali L2 cache in config file\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+
+		l2_cache = mali_create_l2_cache_core(&l2_resource, MALI_DOMAIN_INDEX_L20);
+		if (NULL == l2_cache) {
+			return _MALI_OSK_ERR_FAULT;
+		}
+	} else if (mali_is_mali450()) {
+		/*
+		 * L2 for GP    at 0x10000
+		 * L2 for PP0-3 at 0x01000
+		 * L2 for PP4-7 at 0x11000 (optional)
+		 */
+
+		_mali_osk_resource_t l2_gp_resource;
+		_mali_osk_resource_t l2_pp_grp0_resource;
+		_mali_osk_resource_t l2_pp_grp1_resource;
+
+		/* Make cluster for GP's L2 */
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI450_OFFSET_L2_CACHE0, &l2_gp_resource)) {
+			MALI_DEBUG_PRINT(3, ("Creating Mali-450 L2 cache core for GP\n"));
+			l2_cache = mali_create_l2_cache_core(&l2_gp_resource, MALI_DOMAIN_INDEX_L20);
+			if (NULL == l2_cache) {
+				return _MALI_OSK_ERR_FAULT;
+			}
+		} else {
+			MALI_DEBUG_PRINT(3, ("Did not find required Mali L2 cache for GP in config file\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+
+		/* Find corresponding l2 domain */
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI450_OFFSET_L2_CACHE1, &l2_pp_grp0_resource)) {
+			MALI_DEBUG_PRINT(3, ("Creating Mali-450 L2 cache core for PP group 0\n"));
+			l2_cache = mali_create_l2_cache_core(&l2_pp_grp0_resource, MALI_DOMAIN_INDEX_L21);
+			if (NULL == l2_cache) {
+				return _MALI_OSK_ERR_FAULT;
+			}
+		} else {
+			MALI_DEBUG_PRINT(3, ("Did not find required Mali L2 cache for PP group 0 in config file\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+
+		/* Second PP core group is optional, don't fail if we don't find it */
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI450_OFFSET_L2_CACHE2, &l2_pp_grp1_resource)) {
+			MALI_DEBUG_PRINT(3, ("Creating Mali-450 L2 cache core for PP group 1\n"));
+			l2_cache = mali_create_l2_cache_core(&l2_pp_grp1_resource, MALI_DOMAIN_INDEX_L22);
+			if (NULL == l2_cache) {
+				return _MALI_OSK_ERR_FAULT;
+			}
+		}
+	} else if (mali_is_mali470()) {
+		_mali_osk_resource_t l2c1_resource;
+
+		/* Make cluster for L2C1 */
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI470_OFFSET_L2_CACHE1, &l2c1_resource)) {
+			MALI_DEBUG_PRINT(3, ("Creating Mali-470 L2 cache 1\n"));
+			l2_cache = mali_create_l2_cache_core(&l2c1_resource, MALI_DOMAIN_INDEX_L21);
+			if (NULL == l2_cache) {
+				return _MALI_OSK_ERR_FAULT;
+			}
+		} else {
+			MALI_DEBUG_PRINT(3, ("Did not find required Mali L2 cache for L2C1\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static struct mali_group *mali_create_group(struct mali_l2_cache_core *cache,
+		_mali_osk_resource_t *resource_mmu,
+		_mali_osk_resource_t *resource_gp,
+		_mali_osk_resource_t *resource_pp,
+		u32 domain_index)
+{
+	struct mali_mmu_core *mmu;
+	struct mali_group *group;
+
+	MALI_DEBUG_PRINT(3, ("Starting new group for MMU %s\n", resource_mmu->description));
+
+	/* Create the group object */
+	group = mali_group_create(cache, NULL, NULL, domain_index);
+	if (NULL == group) {
+		MALI_PRINT_ERROR(("Failed to create group object for MMU %s\n", resource_mmu->description));
+		return NULL;
+	}
+
+	/* Create the MMU object inside group */
+	mmu = mali_mmu_create(resource_mmu, group, MALI_FALSE);
+	if (NULL == mmu) {
+		MALI_PRINT_ERROR(("Failed to create MMU object\n"));
+		mali_group_delete(group);
+		return NULL;
+	}
+
+	if (NULL != resource_gp) {
+		/* Create the GP core object inside this group */
+		struct mali_gp_core *gp_core = mali_gp_create(resource_gp, group);
+		if (NULL == gp_core) {
+			/* No need to clean up now, as we will clean up everything linked in from the cluster when we fail this function */
+			MALI_PRINT_ERROR(("Failed to create GP object\n"));
+			mali_group_delete(group);
+			return NULL;
+		}
+	}
+
+	if (NULL != resource_pp) {
+		struct mali_pp_core *pp_core;
+
+		/* Create the PP core object inside this group */
+		pp_core = mali_pp_create(resource_pp, group, MALI_FALSE, mali_get_bcast_id(resource_pp));
+		if (NULL == pp_core) {
+			/* No need to clean up now, as we will clean up everything linked in from the cluster when we fail this function */
+			MALI_PRINT_ERROR(("Failed to create PP object\n"));
+			mali_group_delete(group);
+			return NULL;
+		}
+	}
+
+	return group;
+}
+
+static _mali_osk_errcode_t mali_create_virtual_group(_mali_osk_resource_t *resource_mmu_pp_bcast,
+		_mali_osk_resource_t *resource_pp_bcast,
+		_mali_osk_resource_t *resource_dlbu,
+		_mali_osk_resource_t *resource_bcast)
+{
+	struct mali_mmu_core *mmu_pp_bcast_core;
+	struct mali_pp_core *pp_bcast_core;
+	struct mali_dlbu_core *dlbu_core;
+	struct mali_bcast_unit *bcast_core;
+	struct mali_group *group;
+
+	MALI_DEBUG_PRINT(2, ("Starting new virtual group for MMU PP broadcast core %s\n", resource_mmu_pp_bcast->description));
+
+	/* Create the DLBU core object */
+	dlbu_core = mali_dlbu_create(resource_dlbu);
+	if (NULL == dlbu_core) {
+		MALI_PRINT_ERROR(("Failed to create DLBU object \n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Create the Broadcast unit core */
+	bcast_core = mali_bcast_unit_create(resource_bcast);
+	if (NULL == bcast_core) {
+		MALI_PRINT_ERROR(("Failed to create Broadcast unit object!\n"));
+		mali_dlbu_delete(dlbu_core);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Create the group object */
+#if defined(DEBUG)
+	/* Get a physical PP group to temporarily add to broadcast unit.  IRQ
+	 * verification needs a physical group in the broadcast unit to test
+	 * the broadcast unit interrupt line. */
+	{
+		struct mali_group *phys_group = NULL;
+		int i;
+		for (i = 0; i < mali_group_get_glob_num_groups(); i++) {
+			phys_group = mali_group_get_glob_group(i);
+			if (NULL != mali_group_get_pp_core(phys_group)) break;
+		}
+		MALI_DEBUG_ASSERT(NULL != mali_group_get_pp_core(phys_group));
+
+		/* Add the group temporarily to the broadcast, and update the
+		 * broadcast HW. Since the HW is not updated when removing the
+		 * group the IRQ check will work when the virtual PP is created
+		 * later.
+		 *
+		 * When the virtual group gets populated, the actually used
+		 * groups will be added to the broadcast unit and the HW will
+		 * be updated.
+		 */
+		mali_bcast_add_group(bcast_core, phys_group);
+		mali_bcast_reset(bcast_core);
+		mali_bcast_remove_group(bcast_core, phys_group);
+	}
+#endif /* DEBUG */
+	group = mali_group_create(NULL, dlbu_core, bcast_core, MALI_DOMAIN_INDEX_DUMMY);
+	if (NULL == group) {
+		MALI_PRINT_ERROR(("Failed to create group object for MMU PP broadcast core %s\n", resource_mmu_pp_bcast->description));
+		mali_bcast_unit_delete(bcast_core);
+		mali_dlbu_delete(dlbu_core);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Create the MMU object inside group */
+	mmu_pp_bcast_core = mali_mmu_create(resource_mmu_pp_bcast, group, MALI_TRUE);
+	if (NULL == mmu_pp_bcast_core) {
+		MALI_PRINT_ERROR(("Failed to create MMU PP broadcast object\n"));
+		mali_group_delete(group);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Create the PP core object inside this group */
+	pp_bcast_core = mali_pp_create(resource_pp_bcast, group, MALI_TRUE, 0);
+	if (NULL == pp_bcast_core) {
+		/* No need to clean up now, as we will clean up everything linked in from the cluster when we fail this function */
+		MALI_PRINT_ERROR(("Failed to create PP object\n"));
+		mali_group_delete(group);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static _mali_osk_errcode_t mali_parse_config_groups(void)
+{
+	struct mali_group *group;
+	int cluster_id_gp = 0;
+	int cluster_id_pp_grp0 = 0;
+	int cluster_id_pp_grp1 = 0;
+	int i;
+
+	_mali_osk_resource_t resource_gp;
+	_mali_osk_resource_t resource_gp_mmu;
+	_mali_osk_resource_t resource_pp[8];
+	_mali_osk_resource_t resource_pp_mmu[8];
+	_mali_osk_resource_t resource_pp_mmu_bcast;
+	_mali_osk_resource_t resource_pp_bcast;
+	_mali_osk_resource_t resource_dlbu;
+	_mali_osk_resource_t resource_bcast;
+	_mali_osk_errcode_t resource_gp_found;
+	_mali_osk_errcode_t resource_gp_mmu_found;
+	_mali_osk_errcode_t resource_pp_found[8];
+	_mali_osk_errcode_t resource_pp_mmu_found[8];
+	_mali_osk_errcode_t resource_pp_mmu_bcast_found;
+	_mali_osk_errcode_t resource_pp_bcast_found;
+	_mali_osk_errcode_t resource_dlbu_found;
+	_mali_osk_errcode_t resource_bcast_found;
+
+	if (!(mali_is_mali400() || mali_is_mali450() || mali_is_mali470())) {
+		/* No known HW core */
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	if (MALI_MAX_JOB_RUNTIME_DEFAULT == mali_max_job_runtime) {
+		/* Group settings are not overridden by module parameters, so use device settings */
+		_mali_osk_device_data data = { 0, };
+
+		if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+			/* Use device specific settings (if defined) */
+			if (0 != data.max_job_runtime) {
+				mali_max_job_runtime = data.max_job_runtime;
+			}
+		}
+	}
+
+	if (mali_is_mali450()) {
+		/* Mali-450 have separate L2s for GP, and PP core group(s) */
+		cluster_id_pp_grp0 = 1;
+		cluster_id_pp_grp1 = 2;
+	}
+
+	resource_gp_found = _mali_osk_resource_find(MALI_OFFSET_GP, &resource_gp);
+	resource_gp_mmu_found = _mali_osk_resource_find(MALI_OFFSET_GP_MMU, &resource_gp_mmu);
+	resource_pp_found[0] = _mali_osk_resource_find(MALI_OFFSET_PP0, &(resource_pp[0]));
+	resource_pp_found[1] = _mali_osk_resource_find(MALI_OFFSET_PP1, &(resource_pp[1]));
+	resource_pp_found[2] = _mali_osk_resource_find(MALI_OFFSET_PP2, &(resource_pp[2]));
+	resource_pp_found[3] = _mali_osk_resource_find(MALI_OFFSET_PP3, &(resource_pp[3]));
+	resource_pp_found[4] = _mali_osk_resource_find(MALI_OFFSET_PP4, &(resource_pp[4]));
+	resource_pp_found[5] = _mali_osk_resource_find(MALI_OFFSET_PP5, &(resource_pp[5]));
+	resource_pp_found[6] = _mali_osk_resource_find(MALI_OFFSET_PP6, &(resource_pp[6]));
+	resource_pp_found[7] = _mali_osk_resource_find(MALI_OFFSET_PP7, &(resource_pp[7]));
+	resource_pp_mmu_found[0] = _mali_osk_resource_find(MALI_OFFSET_PP0_MMU, &(resource_pp_mmu[0]));
+	resource_pp_mmu_found[1] = _mali_osk_resource_find(MALI_OFFSET_PP1_MMU, &(resource_pp_mmu[1]));
+	resource_pp_mmu_found[2] = _mali_osk_resource_find(MALI_OFFSET_PP2_MMU, &(resource_pp_mmu[2]));
+	resource_pp_mmu_found[3] = _mali_osk_resource_find(MALI_OFFSET_PP3_MMU, &(resource_pp_mmu[3]));
+	resource_pp_mmu_found[4] = _mali_osk_resource_find(MALI_OFFSET_PP4_MMU, &(resource_pp_mmu[4]));
+	resource_pp_mmu_found[5] = _mali_osk_resource_find(MALI_OFFSET_PP5_MMU, &(resource_pp_mmu[5]));
+	resource_pp_mmu_found[6] = _mali_osk_resource_find(MALI_OFFSET_PP6_MMU, &(resource_pp_mmu[6]));
+	resource_pp_mmu_found[7] = _mali_osk_resource_find(MALI_OFFSET_PP7_MMU, &(resource_pp_mmu[7]));
+
+
+	if (mali_is_mali450() || mali_is_mali470()) {
+		resource_bcast_found = _mali_osk_resource_find(MALI_OFFSET_BCAST, &resource_bcast);
+		resource_dlbu_found = _mali_osk_resource_find(MALI_OFFSET_DLBU, &resource_dlbu);
+		resource_pp_mmu_bcast_found = _mali_osk_resource_find(MALI_OFFSET_PP_BCAST_MMU, &resource_pp_mmu_bcast);
+		resource_pp_bcast_found = _mali_osk_resource_find(MALI_OFFSET_PP_BCAST, &resource_pp_bcast);
+
+		if (_MALI_OSK_ERR_OK != resource_bcast_found ||
+		    _MALI_OSK_ERR_OK != resource_dlbu_found ||
+		    _MALI_OSK_ERR_OK != resource_pp_mmu_bcast_found ||
+		    _MALI_OSK_ERR_OK != resource_pp_bcast_found) {
+			/* Missing mandatory core(s) for Mali-450 or Mali-470 */
+			MALI_DEBUG_PRINT(2, ("Missing mandatory resources, Mali-450 needs DLBU, Broadcast unit, virtual PP core and virtual MMU\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+
+	if (_MALI_OSK_ERR_OK != resource_gp_found ||
+	    _MALI_OSK_ERR_OK != resource_gp_mmu_found ||
+	    _MALI_OSK_ERR_OK != resource_pp_found[0] ||
+	    _MALI_OSK_ERR_OK != resource_pp_mmu_found[0]) {
+		/* Missing mandatory core(s) */
+		MALI_DEBUG_PRINT(2, ("Missing mandatory resource, need at least one GP and one PP, both with a separate MMU\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	MALI_DEBUG_ASSERT(1 <= mali_l2_cache_core_get_glob_num_l2_cores());
+	group = mali_create_group(mali_l2_cache_core_get_glob_l2_core(cluster_id_gp), &resource_gp_mmu, &resource_gp, NULL, MALI_DOMAIN_INDEX_GP);
+	if (NULL == group) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Create group for first (and mandatory) PP core */
+	MALI_DEBUG_ASSERT(mali_l2_cache_core_get_glob_num_l2_cores() >= (cluster_id_pp_grp0 + 1)); /* >= 1 on Mali-300 and Mali-400, >= 2 on Mali-450 */
+	group = mali_create_group(mali_l2_cache_core_get_glob_l2_core(cluster_id_pp_grp0), &resource_pp_mmu[0], NULL, &resource_pp[0], MALI_DOMAIN_INDEX_PP0);
+	if (NULL == group) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	mali_inited_pp_cores_group_1++;
+
+	/* Create groups for rest of the cores in the first PP core group */
+	for (i = 1; i < 4; i++) { /* First half of the PP cores belong to first core group */
+		if (mali_inited_pp_cores_group_1 < mali_max_pp_cores_group_1) {
+			if (_MALI_OSK_ERR_OK == resource_pp_found[i] && _MALI_OSK_ERR_OK == resource_pp_mmu_found[i]) {
+				group = mali_create_group(mali_l2_cache_core_get_glob_l2_core(cluster_id_pp_grp0), &resource_pp_mmu[i], NULL, &resource_pp[i], MALI_DOMAIN_INDEX_PP0 + i);
+				if (NULL == group) {
+					return _MALI_OSK_ERR_FAULT;
+				}
+
+				mali_inited_pp_cores_group_1++;
+			}
+		}
+	}
+
+	/* Create groups for cores in the second PP core group */
+	for (i = 4; i < 8; i++) { /* Second half of the PP cores belong to second core group */
+		if (mali_inited_pp_cores_group_2 < mali_max_pp_cores_group_2) {
+			if (_MALI_OSK_ERR_OK == resource_pp_found[i] && _MALI_OSK_ERR_OK == resource_pp_mmu_found[i]) {
+				MALI_DEBUG_ASSERT(mali_l2_cache_core_get_glob_num_l2_cores() >= 2); /* Only Mali-450 have a second core group */
+				group = mali_create_group(mali_l2_cache_core_get_glob_l2_core(cluster_id_pp_grp1), &resource_pp_mmu[i], NULL, &resource_pp[i], MALI_DOMAIN_INDEX_PP0 + i);
+				if (NULL == group) {
+					return _MALI_OSK_ERR_FAULT;
+				}
+
+				mali_inited_pp_cores_group_2++;
+			}
+		}
+	}
+
+	if (mali_is_mali450() || mali_is_mali470()) {
+		_mali_osk_errcode_t err = mali_create_virtual_group(&resource_pp_mmu_bcast, &resource_pp_bcast, &resource_dlbu, &resource_bcast);
+		if (_MALI_OSK_ERR_OK != err) {
+			return err;
+		}
+	}
+
+	mali_max_pp_cores_group_1 = mali_inited_pp_cores_group_1;
+	mali_max_pp_cores_group_2 = mali_inited_pp_cores_group_2;
+	MALI_DEBUG_PRINT(2, ("%d+%d PP cores initialized\n", mali_inited_pp_cores_group_1, mali_inited_pp_cores_group_2));
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static _mali_osk_errcode_t mali_check_shared_interrupts(void)
+{
+#if !defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	if (MALI_TRUE == _mali_osk_shared_interrupts()) {
+		MALI_PRINT_ERROR(("Shared interrupts detected, but driver support is not enabled\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif /* !defined(CONFIG_MALI_SHARED_INTERRUPTS) */
+
+	/* It is OK to compile support for shared interrupts even if Mali is not using it. */
+	return _MALI_OSK_ERR_OK;
+}
+
+static _mali_osk_errcode_t mali_parse_config_pmu(void)
+{
+	_mali_osk_resource_t resource_pmu;
+
+	MALI_DEBUG_ASSERT(0 != global_gpu_base_address);
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI_OFFSET_PMU, &resource_pmu)) {
+		struct mali_pmu_core *pmu;
+
+		pmu = mali_pmu_create(&resource_pmu);
+		if (NULL == pmu) {
+			MALI_PRINT_ERROR(("Failed to create PMU\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+
+	/* It's ok if the PMU doesn't exist */
+	return _MALI_OSK_ERR_OK;
+}
+
+static _mali_osk_errcode_t mali_parse_config_memory(void)
+{
+	_mali_osk_device_data data = { 0, };
+	_mali_osk_errcode_t ret;
+
+	/* The priority of setting the value of mali_shared_mem_size,
+	 * mali_dedicated_mem_start and mali_dedicated_mem_size:
+	 * 1. module parameter;
+	 * 2. platform data;
+	 * 3. default value;
+	 **/
+	if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+		/* Memory settings are not overridden by module parameters, so use device settings */
+		if (0 == mali_dedicated_mem_start && 0 == mali_dedicated_mem_size) {
+			/* Use device specific settings (if defined) */
+			mali_dedicated_mem_start = data.dedicated_mem_start;
+			mali_dedicated_mem_size = data.dedicated_mem_size;
+		}
+
+		if (MALI_SHARED_MEMORY_DEFAULT_SIZE == mali_shared_mem_size &&
+		    0 != data.shared_mem_size) {
+			mali_shared_mem_size = data.shared_mem_size;
+		}
+	}
+
+	if (0 < mali_dedicated_mem_size && 0 != mali_dedicated_mem_start) {
+		MALI_DEBUG_PRINT(2, ("Mali memory settings (dedicated: 0x%08X@0x%08X)\n",
+				     mali_dedicated_mem_size, mali_dedicated_mem_start));
+
+		/* Dedicated memory */
+		ret = mali_memory_core_resource_dedicated_memory(mali_dedicated_mem_start, mali_dedicated_mem_size);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_PRINT_ERROR(("Failed to register dedicated memory\n"));
+			mali_memory_terminate();
+			return ret;
+		}
+	}
+
+	if (0 < mali_shared_mem_size) {
+		MALI_DEBUG_PRINT(2, ("Mali memory settings (shared: 0x%08X)\n", mali_shared_mem_size));
+
+		/* Shared OS memory */
+		ret = mali_memory_core_resource_os_memory(mali_shared_mem_size);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_PRINT_ERROR(("Failed to register shared OS memory\n"));
+			mali_memory_terminate();
+			return ret;
+		}
+	}
+
+	if (0 == mali_fb_start && 0 == mali_fb_size) {
+		/* Frame buffer settings are not overridden by module parameters, so use device settings */
+		_mali_osk_device_data data = { 0, };
+
+		if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+			/* Use device specific settings (if defined) */
+			mali_fb_start = data.fb_start;
+			mali_fb_size = data.fb_size;
+		}
+
+		MALI_DEBUG_PRINT(2, ("Using device defined frame buffer settings (0x%08X@0x%08X)\n",
+				     mali_fb_size, mali_fb_start));
+	} else {
+		MALI_DEBUG_PRINT(2, ("Using module defined frame buffer settings (0x%08X@0x%08X)\n",
+				     mali_fb_size, mali_fb_start));
+	}
+
+	if (0 != mali_fb_size) {
+		/* Register frame buffer */
+		ret = mali_mem_validation_add_range(mali_fb_start, mali_fb_size);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_PRINT_ERROR(("Failed to register frame buffer memory region\n"));
+			mali_memory_terminate();
+			return ret;
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static void mali_detect_gpu_class(void)
+{
+	if (_mali_osk_identify_gpu_resource() == 0x450)
+		mali_gpu_class_is_mali450 = MALI_TRUE;
+
+	if (_mali_osk_identify_gpu_resource() == 0x470)
+		mali_gpu_class_is_mali470 = MALI_TRUE;
+}
+
+static _mali_osk_errcode_t mali_init_hw_reset(void)
+{
+#if (defined(CONFIG_MALI450) || defined(CONFIG_MALI470))
+	_mali_osk_resource_t resource_bcast;
+
+	/* Ensure broadcast unit is in a good state before we start creating
+	 * groups and cores.
+	 */
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI_OFFSET_BCAST, &resource_bcast)) {
+		struct mali_bcast_unit *bcast_core;
+
+		bcast_core = mali_bcast_unit_create(&resource_bcast);
+		if (NULL == bcast_core) {
+			MALI_PRINT_ERROR(("Failed to create Broadcast unit object!\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+		mali_bcast_unit_delete(bcast_core);
+	}
+#endif /* (defined(CONFIG_MALI450) || defined(CONFIG_MALI470)) */
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_initialize_subsystems(void)
+{
+	_mali_osk_errcode_t err;
+
+#ifdef CONFIG_MALI_DT
+	err = _mali_osk_resource_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+#endif
+
+	mali_pp_job_initialize();
+
+	mali_timeline_initialize();
+
+	err = mali_session_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/*Try to init gpu secure mode */
+	_mali_osk_gpu_secure_mode_init();
+
+#if defined(CONFIG_MALI400_PROFILING)
+	err = _mali_osk_profiling_init(mali_boot_profiling ? MALI_TRUE : MALI_FALSE);
+	if (_MALI_OSK_ERR_OK != err) {
+		/* No biggie if we weren't able to initialize the profiling */
+		MALI_PRINT_ERROR(("Failed to initialize profiling, feature will be unavailable\n"));
+	}
+#endif
+
+	err = mali_memory_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	err = mali_executor_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	err = mali_scheduler_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Configure memory early, needed by mali_mmu_initialize. */
+	err = mali_parse_config_memory();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	err = mali_set_global_gpu_base_address();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Detect GPU class (uses L2 cache count) */
+	mali_detect_gpu_class();
+
+	err = mali_check_shared_interrupts();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Initialize the MALI PMU (will not touch HW!) */
+	err = mali_parse_config_pmu();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Initialize the power management module */
+	err = mali_pm_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Make sure the entire GPU stays on for the rest of this function */
+	mali_pm_init_begin();
+
+	/* Ensure HW is in a good state before starting to access cores. */
+	err = mali_init_hw_reset();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Detect which Mali GPU we are dealing with */
+	err = mali_parse_product_info();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* The global_product_id is now populated with the correct Mali GPU */
+
+	/* Start configuring the actual Mali hardware. */
+
+	err = mali_mmu_initialize();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	if (mali_is_mali450() || mali_is_mali470()) {
+		err = mali_dlbu_initialize();
+		if (_MALI_OSK_ERR_OK != err) {
+			mali_pm_init_end();
+			mali_terminate_subsystems();
+			return err;
+		}
+	}
+
+	err = mali_parse_config_l2_cache();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	err = mali_parse_config_groups();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Move groups into executor */
+	mali_executor_populate();
+
+	/* Need call after all group has assigned a domain */
+	mali_pm_power_cost_setup();
+
+	/* Initialize the GPU timer */
+	err = mali_control_timer_init();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+
+	/* Initialize the GPU utilization tracking */
+	err = mali_utilization_init();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+
+#if defined(CONFIG_MALI_DVFS)
+	err = mali_dvfs_policy_init();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_init_end();
+		mali_terminate_subsystems();
+		return err;
+	}
+#endif
+
+	/* Allowing the system to be turned off */
+	mali_pm_init_end();
+
+	return _MALI_OSK_ERR_OK; /* all ok */
+}
+
+void mali_terminate_subsystems(void)
+{
+	struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+
+	MALI_DEBUG_PRINT(2, ("terminate_subsystems() called\n"));
+
+	mali_utilization_term();
+	mali_control_timer_term();
+
+	mali_executor_depopulate();
+	mali_delete_groups(); /* Delete groups not added to executor */
+	mali_executor_terminate();
+
+	mali_scheduler_terminate();
+	mali_pp_job_terminate();
+	mali_delete_l2_cache_cores();
+	mali_mmu_terminate();
+
+	if (mali_is_mali450() || mali_is_mali470()) {
+		mali_dlbu_terminate();
+	}
+
+	mali_pm_terminate();
+
+	if (NULL != pmu) {
+		mali_pmu_delete(pmu);
+	}
+
+#if defined(CONFIG_MALI400_PROFILING)
+	_mali_osk_profiling_term();
+#endif
+
+	_mali_osk_gpu_secure_mode_deinit();
+
+	mali_memory_terminate();
+
+	mali_session_terminate();
+
+	mali_timeline_terminate();
+
+	global_gpu_base_address = 0;
+}
+
+_mali_product_id_t mali_kernel_core_get_product_id(void)
+{
+	return global_product_id;
+}
+
+u32 mali_kernel_core_get_gpu_major_version(void)
+{
+	return global_gpu_major_version;
+}
+
+u32 mali_kernel_core_get_gpu_minor_version(void)
+{
+	return global_gpu_minor_version;
+}
+
+_mali_osk_errcode_t _mali_ukk_get_api_version(_mali_uk_get_api_version_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	/* check compatability */
+	if (args->version == _MALI_UK_API_VERSION) {
+		args->compatible = 1;
+	} else {
+		args->compatible = 0;
+	}
+
+	args->version = _MALI_UK_API_VERSION; /* report our version */
+
+	/* success regardless of being compatible or not */
+	MALI_SUCCESS;
+}
+
+_mali_osk_errcode_t _mali_ukk_get_api_version_v2(_mali_uk_get_api_version_v2_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	/* check compatability */
+	if (args->version == _MALI_UK_API_VERSION) {
+		args->compatible = 1;
+	} else {
+		args->compatible = 0;
+	}
+
+	args->version = _MALI_UK_API_VERSION; /* report our version */
+
+	/* success regardless of being compatible or not */
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_wait_for_notification(_mali_uk_wait_for_notification_s *args)
+{
+	_mali_osk_errcode_t err;
+	_mali_osk_notification_t *notification;
+	_mali_osk_notification_queue_t *queue;
+	struct mali_session_data *session;
+
+	/* check input */
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	queue = session->ioctl_queue;
+
+	/* if the queue does not exist we're currently shutting down */
+	if (NULL == queue) {
+		MALI_DEBUG_PRINT(1, ("No notification queue registered with the session. Asking userspace to stop querying\n"));
+		args->type = _MALI_NOTIFICATION_CORE_SHUTDOWN_IN_PROGRESS;
+		return _MALI_OSK_ERR_OK;
+	}
+
+	/* receive a notification, might sleep */
+	err = _mali_osk_notification_queue_receive(queue, &notification);
+	if (_MALI_OSK_ERR_OK != err) {
+		MALI_ERROR(err); /* errcode returned, pass on to caller */
+	}
+
+	/* copy the buffer to the user */
+	args->type = (_mali_uk_notification_type)notification->notification_type;
+	_mali_osk_memcpy(&args->data, notification->result_buffer, notification->result_buffer_size);
+
+	/* finished with the notification */
+	_mali_osk_notification_delete(notification);
+
+	return _MALI_OSK_ERR_OK; /* all ok */
+}
+
+_mali_osk_errcode_t _mali_ukk_post_notification(_mali_uk_post_notification_s *args)
+{
+	_mali_osk_notification_t *notification;
+	_mali_osk_notification_queue_t *queue;
+	struct mali_session_data *session;
+
+	/* check input */
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	queue = session->ioctl_queue;
+
+	/* if the queue does not exist we're currently shutting down */
+	if (NULL == queue) {
+		MALI_DEBUG_PRINT(1, ("No notification queue registered with the session. Asking userspace to stop querying\n"));
+		return _MALI_OSK_ERR_OK;
+	}
+
+	notification = _mali_osk_notification_create(args->type, 0);
+	if (NULL == notification) {
+		MALI_PRINT_ERROR(("Failed to create notification object\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	_mali_osk_notification_queue_send(queue, notification);
+
+	return _MALI_OSK_ERR_OK; /* all ok */
+}
+
+_mali_osk_errcode_t _mali_ukk_pending_submit(_mali_uk_pending_submit_s *args)
+{
+	wait_queue_head_t *queue;
+
+	/* check input */
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	queue = mali_session_get_wait_queue();
+
+	/* check pending big job number, might sleep if larger than MAX allowed number */
+	if (wait_event_interruptible(*queue, MALI_MAX_PENDING_BIG_JOB > mali_scheduler_job_gp_big_job_count())) {
+		return _MALI_OSK_ERR_RESTARTSYSCALL;
+	}
+
+	return _MALI_OSK_ERR_OK; /* all ok */
+}
+
+
+_mali_osk_errcode_t _mali_ukk_request_high_priority(_mali_uk_request_high_priority_s *args)
+{
+	struct mali_session_data *session;
+
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)args->ctx;
+
+	if (!session->use_high_priority_job_queue) {
+		session->use_high_priority_job_queue = MALI_TRUE;
+		MALI_DEBUG_PRINT(2, ("Session 0x%08X with pid %d was granted higher priority.\n", session, _mali_osk_get_pid()));
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_open(void **context)
+{
+	u32 i;
+	struct mali_session_data *session;
+
+	/* allocated struct to track this session */
+	session = (struct mali_session_data *)_mali_osk_calloc(1, sizeof(struct mali_session_data));
+	MALI_CHECK_NON_NULL(session, _MALI_OSK_ERR_NOMEM);
+
+	MALI_DEBUG_PRINT(3, ("Session starting\n"));
+
+	/* create a response queue for this session */
+	session->ioctl_queue = _mali_osk_notification_queue_init();
+	if (NULL == session->ioctl_queue) {
+		goto err;
+	}
+
+	/*create a wait queue for this session */
+	session->wait_queue = _mali_osk_wait_queue_init();
+	if (NULL == session->wait_queue) {
+		goto err_wait_queue;
+	}
+
+	session->page_directory = mali_mmu_pagedir_alloc();
+	if (NULL == session->page_directory) {
+		goto err_mmu;
+	}
+
+	if (_MALI_OSK_ERR_OK != mali_mmu_pagedir_map(session->page_directory, MALI_DLBU_VIRT_ADDR, _MALI_OSK_MALI_PAGE_SIZE)) {
+		MALI_PRINT_ERROR(("Failed to map DLBU page into session\n"));
+		goto err_mmu;
+	}
+
+	if (0 != mali_dlbu_phys_addr) {
+		mali_mmu_pagedir_update(session->page_directory, MALI_DLBU_VIRT_ADDR, mali_dlbu_phys_addr,
+					_MALI_OSK_MALI_PAGE_SIZE, MALI_MMU_FLAGS_DEFAULT);
+	}
+
+	if (_MALI_OSK_ERR_OK != mali_memory_session_begin(session)) {
+		goto err_session;
+	}
+
+	/* Create soft system. */
+	session->soft_job_system = mali_soft_job_system_create(session);
+	if (NULL == session->soft_job_system) {
+		goto err_soft;
+	}
+
+	/* Initialize the dma fence context.*/
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+	session->fence_context = dma_fence_context_alloc(1);
+	_mali_osk_atomic_init(&session->fence_seqno, 0);
+#else
+	MALI_PRINT_ERROR(("The kernel version not support dma fence!\n"));
+	goto err_time_line;
+#endif
+#endif
+
+	/* Create timeline system. */
+	session->timeline_system = mali_timeline_system_create(session);
+	if (NULL == session->timeline_system) {
+		goto err_time_line;
+	}
+
+#if defined(CONFIG_MALI_DVFS)
+	_mali_osk_atomic_init(&session->number_of_window_jobs, 0);
+#endif
+
+	_mali_osk_atomic_init(&session->number_of_pp_jobs, 0);
+
+	session->use_high_priority_job_queue = MALI_FALSE;
+
+	/* Initialize list of PP jobs on this session. */
+	_MALI_OSK_INIT_LIST_HEAD(&session->pp_job_list);
+
+	/* Initialize the pp_job_fb_lookup_list array used to quickly lookup jobs from a given frame builder */
+	for (i = 0; i < MALI_PP_JOB_FB_LOOKUP_LIST_SIZE; ++i) {
+		_MALI_OSK_INIT_LIST_HEAD(&session->pp_job_fb_lookup_list[i]);
+	}
+
+	session->pid = _mali_osk_get_pid();
+	session->comm = _mali_osk_get_comm();
+	session->max_mali_mem_allocated_size = 0;
+	for (i = 0; i < MALI_MEM_TYPE_MAX; i ++) {
+		atomic_set(&session->mali_mem_array[i], 0);
+	}
+	atomic_set(&session->mali_mem_allocated_pages, 0);
+	*context = (void *)session;
+
+	/* Add session to the list of all sessions. */
+	mali_session_add(session);
+
+	MALI_DEBUG_PRINT(3, ("Session started\n"));
+	return _MALI_OSK_ERR_OK;
+
+err_time_line:
+	mali_soft_job_system_destroy(session->soft_job_system);
+err_soft:
+	mali_memory_session_end(session);
+err_session:
+	mali_mmu_pagedir_free(session->page_directory);
+err_mmu:
+	_mali_osk_wait_queue_term(session->wait_queue);
+err_wait_queue:
+	_mali_osk_notification_queue_term(session->ioctl_queue);
+err:
+	_mali_osk_free(session);
+	MALI_ERROR(_MALI_OSK_ERR_NOMEM);
+
+}
+
+#if defined(DEBUG)
+/* parameter used for debug */
+extern u32 num_pm_runtime_resume;
+extern u32 num_pm_updates;
+extern u32 num_pm_updates_up;
+extern u32 num_pm_updates_down;
+#endif
+
+_mali_osk_errcode_t _mali_ukk_close(void **context)
+{
+	struct mali_session_data *session;
+	MALI_CHECK_NON_NULL(context, _MALI_OSK_ERR_INVALID_ARGS);
+	session = (struct mali_session_data *)*context;
+
+	MALI_DEBUG_PRINT(3, ("Session ending\n"));
+
+	MALI_DEBUG_ASSERT_POINTER(session->soft_job_system);
+	MALI_DEBUG_ASSERT_POINTER(session->timeline_system);
+
+	/* Remove session from list of all sessions. */
+	mali_session_remove(session);
+
+	/* This flag is used to prevent queueing of jobs due to activation. */
+	session->is_aborting = MALI_TRUE;
+
+	/* Stop the soft job timer. */
+	mali_timeline_system_stop_timer(session->timeline_system);
+
+	/* Abort queued jobs */
+	mali_scheduler_abort_session(session);
+
+	/* Abort executing jobs */
+	mali_executor_abort_session(session);
+
+	/* Abort the soft job system. */
+	mali_soft_job_system_abort(session->soft_job_system);
+
+	/* Force execution of all pending bottom half processing for GP and PP. */
+	_mali_osk_wq_flush();
+
+	/* The session PP list should now be empty. */
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(&session->pp_job_list));
+
+	/* At this point the GP and PP scheduler no longer has any jobs queued or running from this
+	 * session, and all soft jobs in the soft job system has been destroyed. */
+
+	/* Any trackers left in the timeline system are directly or indirectly waiting on external
+	 * sync fences.  Cancel all sync fence waiters to trigger activation of all remaining
+	 * trackers.  This call will sleep until all timelines are empty. */
+	mali_timeline_system_abort(session->timeline_system);
+
+	/* Flush pending work.
+	 * Needed to make sure all bottom half processing related to this
+	 * session has been completed, before we free internal data structures.
+	 */
+	_mali_osk_wq_flush();
+
+	/* Destroy timeline system. */
+	mali_timeline_system_destroy(session->timeline_system);
+	session->timeline_system = NULL;
+
+	/* Destroy soft system. */
+	mali_soft_job_system_destroy(session->soft_job_system);
+	session->soft_job_system = NULL;
+
+	/*Wait for the session job lists become empty.*/
+	_mali_osk_wait_queue_wait_event(session->wait_queue, mali_session_pp_job_is_empty, (void *) session);
+
+	/* Free remaining memory allocated to this session */
+	mali_memory_session_end(session);
+
+#if defined(CONFIG_MALI_DVFS)
+	_mali_osk_atomic_term(&session->number_of_window_jobs);
+#endif
+
+#if defined(CONFIG_MALI400_PROFILING)
+	_mali_osk_profiling_stop_sampling(session->pid);
+#endif
+
+	/* Free session data structures */
+	mali_mmu_pagedir_unmap(session->page_directory, MALI_DLBU_VIRT_ADDR, _MALI_OSK_MALI_PAGE_SIZE);
+	mali_mmu_pagedir_free(session->page_directory);
+	_mali_osk_wait_queue_term(session->wait_queue);
+	_mali_osk_notification_queue_term(session->ioctl_queue);
+	_mali_osk_free(session);
+
+	*context = NULL;
+
+	MALI_DEBUG_PRINT(3, ("Session has ended\n"));
+
+#if defined(DEBUG)
+	MALI_DEBUG_PRINT(3, ("Stats: # runtime resumes: %u\n", num_pm_runtime_resume));
+	MALI_DEBUG_PRINT(3, ("       # PM updates: .... %u (up %u, down %u)\n", num_pm_updates, num_pm_updates_up, num_pm_updates_down));
+
+	num_pm_runtime_resume = 0;
+	num_pm_updates = 0;
+	num_pm_updates_up = 0;
+	num_pm_updates_down = 0;
+#endif
+
+	return _MALI_OSK_ERR_OK;;
+}
+
+#if MALI_STATE_TRACKING
+u32 _mali_kernel_core_dump_state(char *buf, u32 size)
+{
+	int n = 0; /* Number of bytes written to buf */
+
+	n += mali_scheduler_dump_state(buf + n, size - n);
+	n += mali_executor_dump_state(buf + n, size - n);
+
+	return n;
+}
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_kernel_core.h b/drivers/gpu/arm/mali400/common/mali_kernel_core.h
--- a/drivers/gpu/arm/mali400/common/mali_kernel_core.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_kernel_core.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_KERNEL_CORE_H__
+#define __MALI_KERNEL_CORE_H__
+
+#include "mali_osk.h"
+
+typedef enum {
+	_MALI_PRODUCT_ID_UNKNOWN,
+	_MALI_PRODUCT_ID_MALI200,
+	_MALI_PRODUCT_ID_MALI300,
+	_MALI_PRODUCT_ID_MALI400,
+	_MALI_PRODUCT_ID_MALI450,
+	_MALI_PRODUCT_ID_MALI470,
+} _mali_product_id_t;
+
+extern mali_bool mali_gpu_class_is_mali450;
+extern mali_bool mali_gpu_class_is_mali470;
+
+_mali_osk_errcode_t mali_initialize_subsystems(void);
+
+void mali_terminate_subsystems(void);
+
+_mali_product_id_t mali_kernel_core_get_product_id(void);
+
+u32 mali_kernel_core_get_gpu_major_version(void);
+
+u32 mali_kernel_core_get_gpu_minor_version(void);
+
+u32 _mali_kernel_core_dump_state(char *buf, u32 size);
+
+MALI_STATIC_INLINE mali_bool mali_is_mali470(void)
+{
+	return mali_gpu_class_is_mali470;
+}
+
+MALI_STATIC_INLINE mali_bool mali_is_mali450(void)
+{
+	return mali_gpu_class_is_mali450;
+}
+
+MALI_STATIC_INLINE mali_bool mali_is_mali400(void)
+{
+	if (mali_gpu_class_is_mali450 || mali_gpu_class_is_mali470)
+		return MALI_FALSE;
+
+	return MALI_TRUE;
+}
+#endif /* __MALI_KERNEL_CORE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_kernel_utilization.c b/drivers/gpu/arm/mali400/common/mali_kernel_utilization.c
--- a/drivers/gpu/arm/mali400/common/mali_kernel_utilization.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_kernel_utilization.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,440 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_utilization.h"
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_scheduler.h"
+
+#include "mali_executor.h"
+#include "mali_dvfs_policy.h"
+#include "mali_control_timer.h"
+
+/* Thresholds for GP bound detection. */
+#define MALI_GP_BOUND_GP_UTILIZATION_THRESHOLD 240
+#define MALI_GP_BOUND_PP_UTILIZATION_THRESHOLD 250
+
+static _mali_osk_spinlock_irq_t *utilization_data_lock;
+
+static u32 num_running_gp_cores = 0;
+static u32 num_running_pp_cores = 0;
+
+static u64 work_start_time_gpu = 0;
+static u64 work_start_time_gp = 0;
+static u64 work_start_time_pp = 0;
+static u64 accumulated_work_time_gpu = 0;
+static u64 accumulated_work_time_gp = 0;
+static u64 accumulated_work_time_pp = 0;
+
+static u32 last_utilization_gpu = 0 ;
+static u32 last_utilization_gp = 0 ;
+static u32 last_utilization_pp = 0 ;
+
+void (*mali_utilization_callback)(struct mali_gpu_utilization_data *data) = NULL;
+
+/* Define the first timer control timer timeout in milliseconds */
+static u32 mali_control_first_timeout = 100;
+static struct mali_gpu_utilization_data mali_util_data = {0, };
+
+struct mali_gpu_utilization_data *mali_utilization_calculate(u64 *start_time, u64 *time_period, mali_bool *need_add_timer)
+{
+	u64 time_now;
+	u32 leading_zeroes;
+	u32 shift_val;
+	u32 work_normalized_gpu;
+	u32 work_normalized_gp;
+	u32 work_normalized_pp;
+	u32 period_normalized;
+	u32 utilization_gpu;
+	u32 utilization_gp;
+	u32 utilization_pp;
+
+	mali_utilization_data_lock();
+
+	time_now = _mali_osk_time_get_ns();
+
+	*time_period = time_now - *start_time;
+
+	if (accumulated_work_time_gpu == 0 && work_start_time_gpu == 0) {
+		mali_control_timer_pause();
+		/*
+		 * No work done for this period
+		 * - No need to reschedule timer
+		 * - Report zero usage
+		 */
+		last_utilization_gpu = 0;
+		last_utilization_gp = 0;
+		last_utilization_pp = 0;
+
+		mali_util_data.utilization_gpu = last_utilization_gpu;
+		mali_util_data.utilization_gp = last_utilization_gp;
+		mali_util_data.utilization_pp = last_utilization_pp;
+
+		mali_utilization_data_unlock();
+
+		*need_add_timer = MALI_FALSE;
+
+		mali_executor_hint_disable(MALI_EXECUTOR_HINT_GP_BOUND);
+
+		MALI_DEBUG_PRINT(4, ("last_utilization_gpu = %d \n", last_utilization_gpu));
+		MALI_DEBUG_PRINT(4, ("last_utilization_gp = %d \n", last_utilization_gp));
+		MALI_DEBUG_PRINT(4, ("last_utilization_pp = %d \n", last_utilization_pp));
+
+		return &mali_util_data;
+	}
+
+	/* If we are currently busy, update working period up to now */
+	if (work_start_time_gpu != 0) {
+		accumulated_work_time_gpu += (time_now - work_start_time_gpu);
+		work_start_time_gpu = time_now;
+
+		/* GP and/or PP will also be busy if the GPU is busy at this point */
+
+		if (work_start_time_gp != 0) {
+			accumulated_work_time_gp += (time_now - work_start_time_gp);
+			work_start_time_gp = time_now;
+		}
+
+		if (work_start_time_pp != 0) {
+			accumulated_work_time_pp += (time_now - work_start_time_pp);
+			work_start_time_pp = time_now;
+		}
+	}
+
+	/*
+	 * We have two 64-bit values, a dividend and a divisor.
+	 * To avoid dependencies to a 64-bit divider, we shift down the two values
+	 * equally first.
+	 * We shift the dividend up and possibly the divisor down, making the result X in 256.
+	 */
+
+	/* Shift the 64-bit values down so they fit inside a 32-bit integer */
+	leading_zeroes = _mali_osk_clz((u32)(*time_period >> 32));
+	shift_val = 32 - leading_zeroes;
+	work_normalized_gpu = (u32)(accumulated_work_time_gpu >> shift_val);
+	work_normalized_gp = (u32)(accumulated_work_time_gp >> shift_val);
+	work_normalized_pp = (u32)(accumulated_work_time_pp >> shift_val);
+	period_normalized = (u32)(*time_period >> shift_val);
+
+	/*
+	 * Now, we should report the usage in parts of 256
+	 * this means we must shift up the dividend or down the divisor by 8
+	 * (we could do a combination, but we just use one for simplicity,
+	 * but the end result should be good enough anyway)
+	 */
+	if (period_normalized > 0x00FFFFFF) {
+		/* The divisor is so big that it is safe to shift it down */
+		period_normalized >>= 8;
+	} else {
+		/*
+		 * The divisor is so small that we can shift up the dividend, without loosing any data.
+		 * (dividend is always smaller than the divisor)
+		 */
+		work_normalized_gpu <<= 8;
+		work_normalized_gp <<= 8;
+		work_normalized_pp <<= 8;
+	}
+
+	utilization_gpu = work_normalized_gpu / period_normalized;
+	utilization_gp = work_normalized_gp / period_normalized;
+	utilization_pp = work_normalized_pp / period_normalized;
+
+	last_utilization_gpu = utilization_gpu;
+	last_utilization_gp = utilization_gp;
+	last_utilization_pp = utilization_pp;
+
+	if ((MALI_GP_BOUND_GP_UTILIZATION_THRESHOLD < last_utilization_gp) &&
+	    (MALI_GP_BOUND_PP_UTILIZATION_THRESHOLD > last_utilization_pp)) {
+		mali_executor_hint_enable(MALI_EXECUTOR_HINT_GP_BOUND);
+	} else {
+		mali_executor_hint_disable(MALI_EXECUTOR_HINT_GP_BOUND);
+	}
+
+	/* starting a new period */
+	accumulated_work_time_gpu = 0;
+	accumulated_work_time_gp = 0;
+	accumulated_work_time_pp = 0;
+
+	*start_time = time_now;
+
+	mali_util_data.utilization_gp = last_utilization_gp;
+	mali_util_data.utilization_gpu = last_utilization_gpu;
+	mali_util_data.utilization_pp = last_utilization_pp;
+
+	mali_utilization_data_unlock();
+
+	*need_add_timer = MALI_TRUE;
+
+	MALI_DEBUG_PRINT(4, ("last_utilization_gpu = %d \n", last_utilization_gpu));
+	MALI_DEBUG_PRINT(4, ("last_utilization_gp = %d \n", last_utilization_gp));
+	MALI_DEBUG_PRINT(4, ("last_utilization_pp = %d \n", last_utilization_pp));
+
+	return &mali_util_data;
+}
+
+_mali_osk_errcode_t mali_utilization_init(void)
+{
+#if USING_GPU_UTILIZATION
+	_mali_osk_device_data data;
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+		if (NULL != data.utilization_callback) {
+			mali_utilization_callback = data.utilization_callback;
+			MALI_DEBUG_PRINT(2, ("Mali GPU Utilization: Utilization handler installed \n"));
+		}
+	}
+#endif /* defined(USING_GPU_UTILIZATION) */
+
+	if (NULL == mali_utilization_callback) {
+		MALI_DEBUG_PRINT(2, ("Mali GPU Utilization: No platform utilization handler installed\n"));
+	}
+
+	utilization_data_lock = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_ORDERED, _MALI_OSK_LOCK_ORDER_UTILIZATION);
+	if (NULL == utilization_data_lock) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	num_running_gp_cores = 0;
+	num_running_pp_cores = 0;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_utilization_term(void)
+{
+	if (NULL != utilization_data_lock) {
+		_mali_osk_spinlock_irq_term(utilization_data_lock);
+	}
+}
+
+void mali_utilization_gp_start(void)
+{
+	mali_utilization_data_lock();
+
+	++num_running_gp_cores;
+	if (1 == num_running_gp_cores) {
+		u64 time_now = _mali_osk_time_get_ns();
+
+		/* First GP core started, consider GP busy from now and onwards */
+		work_start_time_gp = time_now;
+
+		if (0 == num_running_pp_cores) {
+			mali_bool is_resume = MALI_FALSE;
+			/*
+			 * There are no PP cores running, so this is also the point
+			 * at which we consider the GPU to be busy as well.
+			 */
+			work_start_time_gpu = time_now;
+
+			is_resume  = mali_control_timer_resume(time_now);
+
+			mali_utilization_data_unlock();
+
+			if (is_resume) {
+				/* Do some policy in new period for performance consideration */
+#if defined(CONFIG_MALI_DVFS)
+				/* Clear session->number_of_window_jobs, prepare parameter for dvfs */
+				mali_session_max_window_num();
+				if (0 == last_utilization_gpu) {
+					/*
+					 * for mali_dev_pause is called in set clock,
+					 * so each time we change clock, we will set clock to
+					 * highest step even if under down clock case,
+					 * it is not nessesary, so we only set the clock under
+					 * last time utilization equal 0, we stop the timer then
+					 * start the GPU again case
+					 */
+					mali_dvfs_policy_new_period();
+				}
+#endif
+				/*
+				 * First timeout using short interval for power consideration
+				 * because we give full power in the new period, but if the
+				 * job loading is light, finish in 10ms, the other time all keep
+				 * in high freq it will wast time.
+				 */
+				mali_control_timer_add(mali_control_first_timeout);
+			}
+		} else {
+			mali_utilization_data_unlock();
+		}
+
+	} else {
+		/* Nothing to do */
+		mali_utilization_data_unlock();
+	}
+}
+
+void mali_utilization_pp_start(void)
+{
+	mali_utilization_data_lock();
+
+	++num_running_pp_cores;
+	if (1 == num_running_pp_cores) {
+		u64 time_now = _mali_osk_time_get_ns();
+
+		/* First PP core started, consider PP busy from now and onwards */
+		work_start_time_pp = time_now;
+
+		if (0 == num_running_gp_cores) {
+			mali_bool is_resume = MALI_FALSE;
+			/*
+			 * There are no GP cores running, so this is also the point
+			 * at which we consider the GPU to be busy as well.
+			 */
+			work_start_time_gpu = time_now;
+
+			/* Start a new period if stoped */
+			is_resume = mali_control_timer_resume(time_now);
+
+			mali_utilization_data_unlock();
+
+			if (is_resume) {
+#if defined(CONFIG_MALI_DVFS)
+				/* Clear session->number_of_window_jobs, prepare parameter for dvfs */
+				mali_session_max_window_num();
+				if (0 == last_utilization_gpu) {
+					/*
+					 * for mali_dev_pause is called in set clock,
+					 * so each time we change clock, we will set clock to
+					 * highest step even if under down clock case,
+					 * it is not nessesary, so we only set the clock under
+					 * last time utilization equal 0, we stop the timer then
+					 * start the GPU again case
+					 */
+					mali_dvfs_policy_new_period();
+				}
+#endif
+
+				/*
+				 * First timeout using short interval for power consideration
+				 * because we give full power in the new period, but if the
+				 * job loading is light, finish in 10ms, the other time all keep
+				 * in high freq it will wast time.
+				 */
+				mali_control_timer_add(mali_control_first_timeout);
+			}
+		} else {
+			mali_utilization_data_unlock();
+		}
+	} else {
+		/* Nothing to do */
+		mali_utilization_data_unlock();
+	}
+}
+
+void mali_utilization_gp_end(void)
+{
+	mali_utilization_data_lock();
+
+	--num_running_gp_cores;
+	if (0 == num_running_gp_cores) {
+		u64 time_now = _mali_osk_time_get_ns();
+
+		/* Last GP core ended, consider GP idle from now and onwards */
+		accumulated_work_time_gp += (time_now - work_start_time_gp);
+		work_start_time_gp = 0;
+
+		if (0 == num_running_pp_cores) {
+			/*
+			 * There are no PP cores running, so this is also the point
+			 * at which we consider the GPU to be idle as well.
+			 */
+			accumulated_work_time_gpu += (time_now - work_start_time_gpu);
+			work_start_time_gpu = 0;
+		}
+	}
+
+	mali_utilization_data_unlock();
+}
+
+void mali_utilization_pp_end(void)
+{
+	mali_utilization_data_lock();
+
+	--num_running_pp_cores;
+	if (0 == num_running_pp_cores) {
+		u64 time_now = _mali_osk_time_get_ns();
+
+		/* Last PP core ended, consider PP idle from now and onwards */
+		accumulated_work_time_pp += (time_now - work_start_time_pp);
+		work_start_time_pp = 0;
+
+		if (0 == num_running_gp_cores) {
+			/*
+			 * There are no GP cores running, so this is also the point
+			 * at which we consider the GPU to be idle as well.
+			 */
+			accumulated_work_time_gpu += (time_now - work_start_time_gpu);
+			work_start_time_gpu = 0;
+		}
+	}
+
+	mali_utilization_data_unlock();
+}
+
+mali_bool mali_utilization_enabled(void)
+{
+#if defined(CONFIG_MALI_DVFS)
+	return mali_dvfs_policy_enabled();
+#else
+	return (NULL != mali_utilization_callback);
+#endif /* defined(CONFIG_MALI_DVFS) */
+}
+
+void mali_utilization_platform_realize(struct mali_gpu_utilization_data *util_data)
+{
+	MALI_DEBUG_ASSERT_POINTER(mali_utilization_callback);
+
+	mali_utilization_callback(util_data);
+}
+
+void mali_utilization_reset(void)
+{
+	accumulated_work_time_gpu = 0;
+	accumulated_work_time_gp = 0;
+	accumulated_work_time_pp = 0;
+
+	last_utilization_gpu = 0;
+	last_utilization_gp = 0;
+	last_utilization_pp = 0;
+}
+
+void mali_utilization_data_lock(void)
+{
+	_mali_osk_spinlock_irq_lock(utilization_data_lock);
+}
+
+void mali_utilization_data_unlock(void)
+{
+	_mali_osk_spinlock_irq_unlock(utilization_data_lock);
+}
+
+void mali_utilization_data_assert_locked(void)
+{
+	MALI_DEBUG_ASSERT_LOCK_HELD(utilization_data_lock);
+}
+
+u32 _mali_ukk_utilization_gp_pp(void)
+{
+	return last_utilization_gpu;
+}
+
+u32 _mali_ukk_utilization_gp(void)
+{
+	return last_utilization_gp;
+}
+
+u32 _mali_ukk_utilization_pp(void)
+{
+	return last_utilization_pp;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_kernel_utilization.h b/drivers/gpu/arm/mali400/common/mali_kernel_utilization.h
--- a/drivers/gpu/arm/mali400/common/mali_kernel_utilization.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_kernel_utilization.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_KERNEL_UTILIZATION_H__
+#define __MALI_KERNEL_UTILIZATION_H__
+
+#include <linux/mali/mali_utgard.h>
+#include "mali_osk.h"
+
+/**
+ * Initialize/start the Mali GPU utilization metrics reporting.
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t mali_utilization_init(void);
+
+/**
+ * Terminate the Mali GPU utilization metrics reporting
+ */
+void mali_utilization_term(void);
+
+/**
+ * Check if Mali utilization is enabled
+ */
+mali_bool mali_utilization_enabled(void);
+
+/**
+ * Should be called when a job is about to execute a GP job
+ */
+void mali_utilization_gp_start(void);
+
+/**
+ * Should be called when a job has completed executing a GP job
+ */
+void mali_utilization_gp_end(void);
+
+/**
+ * Should be called when a job is about to execute a PP job
+ */
+void mali_utilization_pp_start(void);
+
+/**
+ * Should be called when a job has completed executing a PP job
+ */
+void mali_utilization_pp_end(void);
+
+/**
+ * Should be called to calcution the GPU utilization
+ */
+struct mali_gpu_utilization_data *mali_utilization_calculate(u64 *start_time, u64 *time_period, mali_bool *need_add_timer);
+
+_mali_osk_spinlock_irq_t *mali_utilization_get_lock(void);
+
+void mali_utilization_platform_realize(struct mali_gpu_utilization_data *util_data);
+
+void mali_utilization_data_lock(void);
+
+void mali_utilization_data_unlock(void);
+
+void mali_utilization_data_assert_locked(void);
+
+void mali_utilization_reset(void);
+
+
+#endif /* __MALI_KERNEL_UTILIZATION_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_kernel_vsync.c b/drivers/gpu/arm/mali400/common/mali_kernel_vsync.c
--- a/drivers/gpu/arm/mali400/common/mali_kernel_vsync.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_kernel_vsync.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_ukk.h"
+
+#include "mali_osk_profiling.h"
+
+_mali_osk_errcode_t _mali_ukk_vsync_event_report(_mali_uk_vsync_event_report_s *args)
+{
+	_mali_uk_vsync_event event = (_mali_uk_vsync_event)args->event;
+	MALI_IGNORE(event); /* event is not used for release code, and that is OK */
+
+	/*
+	 * Manually generate user space events in kernel space.
+	 * This saves user space from calling kernel space twice in this case.
+	 * We just need to remember to add pid and tid manually.
+	 */
+	if (event == _MALI_UK_VSYNC_EVENT_BEGIN_WAIT) {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SUSPEND |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_VSYNC,
+					      _mali_osk_get_pid(), _mali_osk_get_tid(), 0, 0, 0);
+	}
+
+	if (event == _MALI_UK_VSYNC_EVENT_END_WAIT) {
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_RESUME |
+					      MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+					      MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_VSYNC,
+					      _mali_osk_get_pid(), _mali_osk_get_tid(), 0, 0, 0);
+	}
+
+
+	MALI_DEBUG_PRINT(4, ("Received VSYNC event: %d\n", event));
+	MALI_SUCCESS;
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_l2_cache.c b/drivers/gpu/arm/mali400/common/mali_l2_cache.c
--- a/drivers/gpu/arm/mali400/common/mali_l2_cache.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_l2_cache.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,534 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_l2_cache.h"
+#include "mali_hw_core.h"
+#include "mali_scheduler.h"
+#include "mali_pm.h"
+#include "mali_pm_domain.h"
+
+/**
+ * Size of the Mali L2 cache registers in bytes
+ */
+#define MALI400_L2_CACHE_REGISTERS_SIZE 0x30
+
+/**
+ * Mali L2 cache register numbers
+ * Used in the register read/write routines.
+ * See the hardware documentation for more information about each register
+ */
+typedef enum mali_l2_cache_register {
+	MALI400_L2_CACHE_REGISTER_SIZE         = 0x0004,
+	MALI400_L2_CACHE_REGISTER_STATUS       = 0x0008,
+	/*unused                               = 0x000C */
+	MALI400_L2_CACHE_REGISTER_COMMAND      = 0x0010,
+	MALI400_L2_CACHE_REGISTER_CLEAR_PAGE   = 0x0014,
+	MALI400_L2_CACHE_REGISTER_MAX_READS    = 0x0018,
+	MALI400_L2_CACHE_REGISTER_ENABLE       = 0x001C,
+	MALI400_L2_CACHE_REGISTER_PERFCNT_SRC0 = 0x0020,
+	MALI400_L2_CACHE_REGISTER_PERFCNT_VAL0 = 0x0024,
+	MALI400_L2_CACHE_REGISTER_PERFCNT_SRC1 = 0x0028,
+	MALI400_L2_CACHE_REGISTER_PERFCNT_VAL1 = 0x002C,
+} mali_l2_cache_register;
+
+/**
+ * Mali L2 cache commands
+ * These are the commands that can be sent to the Mali L2 cache unit
+ */
+typedef enum mali_l2_cache_command {
+	MALI400_L2_CACHE_COMMAND_CLEAR_ALL = 0x01,
+} mali_l2_cache_command;
+
+/**
+ * Mali L2 cache commands
+ * These are the commands that can be sent to the Mali L2 cache unit
+ */
+typedef enum mali_l2_cache_enable {
+	MALI400_L2_CACHE_ENABLE_DEFAULT = 0x0, /* Default */
+	MALI400_L2_CACHE_ENABLE_ACCESS = 0x01,
+	MALI400_L2_CACHE_ENABLE_READ_ALLOCATE = 0x02,
+} mali_l2_cache_enable;
+
+/**
+ * Mali L2 cache status bits
+ */
+typedef enum mali_l2_cache_status {
+	MALI400_L2_CACHE_STATUS_COMMAND_BUSY = 0x01,
+	MALI400_L2_CACHE_STATUS_DATA_BUSY    = 0x02,
+} mali_l2_cache_status;
+
+#define MALI400_L2_MAX_READS_NOT_SET -1
+
+static struct mali_l2_cache_core *
+	mali_global_l2s[MALI_MAX_NUMBER_OF_L2_CACHE_CORES] = { NULL, };
+static u32 mali_global_num_l2s = 0;
+
+int mali_l2_max_reads = MALI400_L2_MAX_READS_NOT_SET;
+
+
+/* Local helper functions */
+
+static void mali_l2_cache_reset(struct mali_l2_cache_core *cache);
+
+static _mali_osk_errcode_t mali_l2_cache_send_command(
+	struct mali_l2_cache_core *cache, u32 reg, u32 val);
+
+static void mali_l2_cache_lock(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	_mali_osk_spinlock_irq_lock(cache->lock);
+}
+
+static void mali_l2_cache_unlock(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	_mali_osk_spinlock_irq_unlock(cache->lock);
+}
+
+/* Implementation of the L2 cache interface */
+
+struct mali_l2_cache_core *mali_l2_cache_create(
+	_mali_osk_resource_t *resource, u32 domain_index)
+{
+	struct mali_l2_cache_core *cache = NULL;
+#if defined(DEBUG)
+	u32 cache_size;
+#endif
+
+	MALI_DEBUG_PRINT(4, ("Mali L2 cache: Creating Mali L2 cache: %s\n",
+			     resource->description));
+
+	if (mali_global_num_l2s >= MALI_MAX_NUMBER_OF_L2_CACHE_CORES) {
+		MALI_PRINT_ERROR(("Mali L2 cache: Too many L2 caches\n"));
+		return NULL;
+	}
+
+	cache = _mali_osk_malloc(sizeof(struct mali_l2_cache_core));
+	if (NULL == cache) {
+		MALI_PRINT_ERROR(("Mali L2 cache: Failed to allocate memory for L2 cache core\n"));
+		return NULL;
+	}
+
+	cache->core_id =  mali_global_num_l2s;
+	cache->counter_src0 = MALI_HW_CORE_NO_COUNTER;
+	cache->counter_src1 = MALI_HW_CORE_NO_COUNTER;
+	cache->counter_value0_base = 0;
+	cache->counter_value1_base = 0;
+	cache->pm_domain = NULL;
+	cache->power_is_on = MALI_FALSE;
+	cache->last_invalidated_id = 0;
+
+	if (_MALI_OSK_ERR_OK != mali_hw_core_create(&cache->hw_core,
+			resource, MALI400_L2_CACHE_REGISTERS_SIZE)) {
+		_mali_osk_free(cache);
+		return NULL;
+	}
+
+#if defined(DEBUG)
+	cache_size = mali_hw_core_register_read(&cache->hw_core,
+						MALI400_L2_CACHE_REGISTER_SIZE);
+	MALI_DEBUG_PRINT(2, ("Mali L2 cache: Created %s: % 3uK, %u-way, % 2ubyte cache line, % 3ubit external bus\n",
+			     resource->description,
+			     1 << (((cache_size >> 16) & 0xff) - 10),
+			     1 << ((cache_size >> 8) & 0xff),
+			     1 << (cache_size & 0xff),
+			     1 << ((cache_size >> 24) & 0xff)));
+#endif
+
+	cache->lock = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_ORDERED,
+			_MALI_OSK_LOCK_ORDER_L2);
+	if (NULL == cache->lock) {
+		MALI_PRINT_ERROR(("Mali L2 cache: Failed to create counter lock for L2 cache core %s\n",
+				  cache->hw_core.description));
+		mali_hw_core_delete(&cache->hw_core);
+		_mali_osk_free(cache);
+		return NULL;
+	}
+
+	/* register with correct power domain */
+	cache->pm_domain = mali_pm_register_l2_cache(
+				   domain_index, cache);
+
+	mali_global_l2s[mali_global_num_l2s] = cache;
+	mali_global_num_l2s++;
+
+	return cache;
+}
+
+void mali_l2_cache_delete(struct mali_l2_cache_core *cache)
+{
+	u32 i;
+	for (i = 0; i < mali_global_num_l2s; i++) {
+		if (mali_global_l2s[i] != cache) {
+			continue;
+		}
+
+		mali_global_l2s[i] = NULL;
+		mali_global_num_l2s--;
+
+		if (i == mali_global_num_l2s) {
+			/* Removed last element, nothing more to do */
+			break;
+		}
+
+		/*
+		 * We removed a l2 cache from the middle of the array,
+		 * so move the last l2 cache to current position
+		 */
+		mali_global_l2s[i] = mali_global_l2s[mali_global_num_l2s];
+		mali_global_l2s[mali_global_num_l2s] = NULL;
+
+		/* All good */
+		break;
+	}
+
+	_mali_osk_spinlock_irq_term(cache->lock);
+	mali_hw_core_delete(&cache->hw_core);
+	_mali_osk_free(cache);
+}
+
+void mali_l2_cache_power_up(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+
+	mali_l2_cache_lock(cache);
+
+	mali_l2_cache_reset(cache);
+
+	if ((1 << MALI_DOMAIN_INDEX_DUMMY) != cache->pm_domain->pmu_mask)
+		MALI_DEBUG_ASSERT(MALI_FALSE == cache->power_is_on);
+	cache->power_is_on = MALI_TRUE;
+
+	mali_l2_cache_unlock(cache);
+}
+
+void mali_l2_cache_power_down(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+
+	mali_l2_cache_lock(cache);
+
+	MALI_DEBUG_ASSERT(MALI_TRUE == cache->power_is_on);
+
+	/*
+	 * The HW counters will start from zero again when we resume,
+	 * but we should report counters as always increasing.
+	 * Take a copy of the HW values now in order to add this to
+	 * the values we report after being powered up.
+	 *
+	 * The physical power off of the L2 cache might be outside our
+	 * own control (e.g. runtime PM). That is why we must manually
+	 * set set the counter value to zero as well.
+	 */
+
+	if (cache->counter_src0 != MALI_HW_CORE_NO_COUNTER) {
+		cache->counter_value0_base += mali_hw_core_register_read(
+						      &cache->hw_core,
+						      MALI400_L2_CACHE_REGISTER_PERFCNT_VAL0);
+		mali_hw_core_register_write(&cache->hw_core,
+					    MALI400_L2_CACHE_REGISTER_PERFCNT_VAL0, 0);
+	}
+
+	if (cache->counter_src1 != MALI_HW_CORE_NO_COUNTER) {
+		cache->counter_value1_base += mali_hw_core_register_read(
+						      &cache->hw_core,
+						      MALI400_L2_CACHE_REGISTER_PERFCNT_VAL1);
+		mali_hw_core_register_write(&cache->hw_core,
+					    MALI400_L2_CACHE_REGISTER_PERFCNT_VAL1, 0);
+	}
+
+
+	cache->power_is_on = MALI_FALSE;
+
+	mali_l2_cache_unlock(cache);
+}
+
+void mali_l2_cache_core_set_counter_src(
+	struct mali_l2_cache_core *cache, u32 source_id, u32 counter)
+{
+	u32 reg_offset_src;
+	u32 reg_offset_val;
+
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	MALI_DEBUG_ASSERT(source_id >= 0 && source_id <= 1);
+
+	mali_l2_cache_lock(cache);
+
+	if (0 == source_id) {
+		/* start counting from 0 */
+		cache->counter_value0_base = 0;
+		cache->counter_src0 = counter;
+		reg_offset_src = MALI400_L2_CACHE_REGISTER_PERFCNT_SRC0;
+		reg_offset_val = MALI400_L2_CACHE_REGISTER_PERFCNT_VAL0;
+	} else {
+		/* start counting from 0 */
+		cache->counter_value1_base = 0;
+		cache->counter_src1 = counter;
+		reg_offset_src = MALI400_L2_CACHE_REGISTER_PERFCNT_SRC1;
+		reg_offset_val = MALI400_L2_CACHE_REGISTER_PERFCNT_VAL1;
+	}
+
+	if (cache->power_is_on) {
+		u32 hw_src;
+
+		if (MALI_HW_CORE_NO_COUNTER != counter) {
+			hw_src = counter;
+		} else {
+			hw_src = 0; /* disable value for HW */
+		}
+
+		/* Set counter src */
+		mali_hw_core_register_write(&cache->hw_core,
+					    reg_offset_src, hw_src);
+
+		/* Make sure the HW starts counting from 0 again */
+		mali_hw_core_register_write(&cache->hw_core,
+					    reg_offset_val, 0);
+	}
+
+	mali_l2_cache_unlock(cache);
+}
+
+void mali_l2_cache_core_get_counter_values(
+	struct mali_l2_cache_core *cache,
+	u32 *src0, u32 *value0, u32 *src1, u32 *value1)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	MALI_DEBUG_ASSERT(NULL != src0);
+	MALI_DEBUG_ASSERT(NULL != value0);
+	MALI_DEBUG_ASSERT(NULL != src1);
+	MALI_DEBUG_ASSERT(NULL != value1);
+
+	mali_l2_cache_lock(cache);
+
+	*src0 = cache->counter_src0;
+	*src1 = cache->counter_src1;
+
+	if (cache->counter_src0 != MALI_HW_CORE_NO_COUNTER) {
+		if (MALI_TRUE == cache->power_is_on) {
+			*value0 = mali_hw_core_register_read(&cache->hw_core,
+							     MALI400_L2_CACHE_REGISTER_PERFCNT_VAL0);
+		} else {
+			*value0 = 0;
+		}
+
+		/* Add base offset value (in case we have been power off) */
+		*value0 += cache->counter_value0_base;
+	}
+
+	if (cache->counter_src1 != MALI_HW_CORE_NO_COUNTER) {
+		if (MALI_TRUE == cache->power_is_on) {
+			*value1 = mali_hw_core_register_read(&cache->hw_core,
+							     MALI400_L2_CACHE_REGISTER_PERFCNT_VAL1);
+		} else {
+			*value1 = 0;
+		}
+
+		/* Add base offset value (in case we have been power off) */
+		*value1 += cache->counter_value1_base;
+	}
+
+	mali_l2_cache_unlock(cache);
+}
+
+struct mali_l2_cache_core *mali_l2_cache_core_get_glob_l2_core(u32 index)
+{
+	if (mali_global_num_l2s > index) {
+		return mali_global_l2s[index];
+	}
+
+	return NULL;
+}
+
+u32 mali_l2_cache_core_get_glob_num_l2_cores(void)
+{
+	return mali_global_num_l2s;
+}
+
+void mali_l2_cache_invalidate(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+
+	if (NULL == cache) {
+		return;
+	}
+
+	mali_l2_cache_lock(cache);
+
+	cache->last_invalidated_id = mali_scheduler_get_new_cache_order();
+	mali_l2_cache_send_command(cache, MALI400_L2_CACHE_REGISTER_COMMAND,
+				   MALI400_L2_CACHE_COMMAND_CLEAR_ALL);
+
+	mali_l2_cache_unlock(cache);
+}
+
+void mali_l2_cache_invalidate_conditional(
+	struct mali_l2_cache_core *cache, u32 id)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+
+	if (NULL == cache) {
+		return;
+	}
+
+	/*
+	 * If the last cache invalidation was done by a job with a higher id we
+	 * don't have to flush. Since user space will store jobs w/ their
+	 * corresponding memory in sequence (first job #0, then job #1, ...),
+	 * we don't have to flush for job n-1 if job n has already invalidated
+	 * the cache since we know for sure that job n-1's memory was already
+	 * written when job n was started.
+	 */
+
+	mali_l2_cache_lock(cache);
+
+	if (((s32)id) > ((s32)cache->last_invalidated_id)) {
+		/* Set latest invalidated id to current "point in time" */
+		cache->last_invalidated_id =
+			mali_scheduler_get_new_cache_order();
+		mali_l2_cache_send_command(cache,
+					   MALI400_L2_CACHE_REGISTER_COMMAND,
+					   MALI400_L2_CACHE_COMMAND_CLEAR_ALL);
+	}
+
+	mali_l2_cache_unlock(cache);
+}
+
+void mali_l2_cache_invalidate_all(void)
+{
+	u32 i;
+	for (i = 0; i < mali_global_num_l2s; i++) {
+		struct mali_l2_cache_core *cache = mali_global_l2s[i];
+		_mali_osk_errcode_t ret;
+
+		MALI_DEBUG_ASSERT_POINTER(cache);
+
+		mali_l2_cache_lock(cache);
+
+		if (MALI_TRUE != cache->power_is_on) {
+			mali_l2_cache_unlock(cache);
+			continue;
+		}
+
+		cache->last_invalidated_id =
+			mali_scheduler_get_new_cache_order();
+
+		ret = mali_l2_cache_send_command(cache,
+						 MALI400_L2_CACHE_REGISTER_COMMAND,
+						 MALI400_L2_CACHE_COMMAND_CLEAR_ALL);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_PRINT_ERROR(("Failed to invalidate cache\n"));
+		}
+
+		mali_l2_cache_unlock(cache);
+	}
+}
+
+void mali_l2_cache_invalidate_all_pages(u32 *pages, u32 num_pages)
+{
+	u32 i;
+	for (i = 0; i < mali_global_num_l2s; i++) {
+		struct mali_l2_cache_core *cache = mali_global_l2s[i];
+		u32 j;
+
+		MALI_DEBUG_ASSERT_POINTER(cache);
+
+		mali_l2_cache_lock(cache);
+
+		if (MALI_TRUE != cache->power_is_on) {
+			mali_l2_cache_unlock(cache);
+			continue;
+		}
+
+		for (j = 0; j < num_pages; j++) {
+			_mali_osk_errcode_t ret;
+
+			ret = mali_l2_cache_send_command(cache,
+							 MALI400_L2_CACHE_REGISTER_CLEAR_PAGE,
+							 pages[j]);
+			if (_MALI_OSK_ERR_OK != ret) {
+				MALI_PRINT_ERROR(("Failed to invalidate cache (page)\n"));
+			}
+		}
+
+		mali_l2_cache_unlock(cache);
+	}
+}
+
+/* -------- local helper functions below -------- */
+
+static void mali_l2_cache_reset(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	MALI_DEBUG_ASSERT_LOCK_HELD(cache->lock);
+
+	/* Invalidate cache (just to keep it in a known state at startup) */
+	mali_l2_cache_send_command(cache, MALI400_L2_CACHE_REGISTER_COMMAND,
+				   MALI400_L2_CACHE_COMMAND_CLEAR_ALL);
+
+	/* Enable cache */
+	mali_hw_core_register_write(&cache->hw_core,
+				    MALI400_L2_CACHE_REGISTER_ENABLE,
+				    (u32)MALI400_L2_CACHE_ENABLE_ACCESS |
+				    (u32)MALI400_L2_CACHE_ENABLE_READ_ALLOCATE);
+
+	if (MALI400_L2_MAX_READS_NOT_SET != mali_l2_max_reads) {
+		mali_hw_core_register_write(&cache->hw_core,
+					    MALI400_L2_CACHE_REGISTER_MAX_READS,
+					    (u32)mali_l2_max_reads);
+	}
+
+	/* Restart any performance counters (if enabled) */
+	if (cache->counter_src0 != MALI_HW_CORE_NO_COUNTER) {
+
+		mali_hw_core_register_write(&cache->hw_core,
+					    MALI400_L2_CACHE_REGISTER_PERFCNT_SRC0,
+					    cache->counter_src0);
+	}
+
+	if (cache->counter_src1 != MALI_HW_CORE_NO_COUNTER) {
+		mali_hw_core_register_write(&cache->hw_core,
+					    MALI400_L2_CACHE_REGISTER_PERFCNT_SRC1,
+					    cache->counter_src1);
+	}
+}
+
+static _mali_osk_errcode_t mali_l2_cache_send_command(
+	struct mali_l2_cache_core *cache, u32 reg, u32 val)
+{
+	int i = 0;
+	const int loop_count = 100000;
+
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	MALI_DEBUG_ASSERT_LOCK_HELD(cache->lock);
+
+	/*
+	 * First, wait for L2 cache command handler to go idle.
+	 * (Commands received while processing another command will be ignored)
+	 */
+	for (i = 0; i < loop_count; i++) {
+		if (!(mali_hw_core_register_read(&cache->hw_core,
+						 MALI400_L2_CACHE_REGISTER_STATUS) &
+		      (u32)MALI400_L2_CACHE_STATUS_COMMAND_BUSY)) {
+			break;
+		}
+	}
+
+	if (i == loop_count) {
+		MALI_DEBUG_PRINT(1, ("Mali L2 cache: aborting wait for command interface to go idle\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* then issue the command */
+	mali_hw_core_register_write(&cache->hw_core, reg, val);
+
+	return _MALI_OSK_ERR_OK;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_l2_cache.h b/drivers/gpu/arm/mali400/common/mali_l2_cache.h
--- a/drivers/gpu/arm/mali400/common/mali_l2_cache.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_l2_cache.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_KERNEL_L2_CACHE_H__
+#define __MALI_KERNEL_L2_CACHE_H__
+
+#include "mali_osk.h"
+#include "mali_hw_core.h"
+
+#define MALI_MAX_NUMBER_OF_L2_CACHE_CORES  3
+/* Maximum 1 GP and 4 PP for an L2 cache core (Mali-400 MP4) */
+#define MALI_MAX_NUMBER_OF_GROUPS_PER_L2_CACHE 5
+
+/**
+ * Definition of the L2 cache core struct
+ * Used to track a L2 cache unit in the system.
+ * Contains information about the mapping of the registers
+ */
+struct mali_l2_cache_core {
+	/* Common HW core functionality */
+	struct mali_hw_core hw_core;
+
+	/* Synchronize L2 cache access */
+	_mali_osk_spinlock_irq_t *lock;
+
+	/* Unique core ID */
+	u32 core_id;
+
+	/* The power domain this L2 cache belongs to */
+	struct mali_pm_domain *pm_domain;
+
+	/* MALI_TRUE if power is on for this L2 cache */
+	mali_bool power_is_on;
+
+	/* A "timestamp" to avoid unnecessary flushes */
+	u32 last_invalidated_id;
+
+	/* Performance counter 0, MALI_HW_CORE_NO_COUNTER for disabled */
+	u32 counter_src0;
+
+	/* Performance counter 1, MALI_HW_CORE_NO_COUNTER for disabled */
+	u32 counter_src1;
+
+	/*
+	 * Performance counter 0 value base/offset
+	 * (allows accumulative reporting even after power off)
+	 */
+	u32 counter_value0_base;
+
+	/*
+	 * Performance counter 0 value base/offset
+	 * (allows accumulative reporting even after power off)
+	 */
+	u32 counter_value1_base;
+
+	/* Used by PM domains to link L2 caches of same domain */
+	_mali_osk_list_t pm_domain_list;
+};
+
+_mali_osk_errcode_t mali_l2_cache_initialize(void);
+void mali_l2_cache_terminate(void);
+
+struct mali_l2_cache_core *mali_l2_cache_create(
+	_mali_osk_resource_t *resource, u32 domain_index);
+void mali_l2_cache_delete(struct mali_l2_cache_core *cache);
+
+MALI_STATIC_INLINE u32 mali_l2_cache_get_id(struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	return cache->core_id;
+}
+
+MALI_STATIC_INLINE struct mali_pm_domain *mali_l2_cache_get_pm_domain(
+	struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	return cache->pm_domain;
+}
+
+void mali_l2_cache_power_up(struct mali_l2_cache_core *cache);
+void mali_l2_cache_power_down(struct mali_l2_cache_core *cache);
+
+void mali_l2_cache_core_set_counter_src(
+	struct mali_l2_cache_core *cache, u32 source_id, u32 counter);
+
+MALI_STATIC_INLINE u32 mali_l2_cache_core_get_counter_src0(
+	struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	return cache->counter_src0;
+}
+
+MALI_STATIC_INLINE u32 mali_l2_cache_core_get_counter_src1(
+	struct mali_l2_cache_core *cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(cache);
+	return cache->counter_src1;
+}
+
+void mali_l2_cache_core_get_counter_values(
+	struct mali_l2_cache_core *cache,
+	u32 *src0, u32 *value0, u32 *src1, u32 *value1);
+
+struct mali_l2_cache_core *mali_l2_cache_core_get_glob_l2_core(u32 index);
+u32 mali_l2_cache_core_get_glob_num_l2_cores(void);
+
+struct mali_group *mali_l2_cache_get_group(
+	struct mali_l2_cache_core *cache, u32 index);
+
+void mali_l2_cache_invalidate(struct mali_l2_cache_core *cache);
+void mali_l2_cache_invalidate_conditional(
+	struct mali_l2_cache_core *cache, u32 id);
+
+void mali_l2_cache_invalidate_all(void);
+void mali_l2_cache_invalidate_all_pages(u32 *pages, u32 num_pages);
+
+#endif /* __MALI_KERNEL_L2_CACHE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_mem_validation.c b/drivers/gpu/arm/mali400/common/mali_mem_validation.c
--- a/drivers/gpu/arm/mali400/common/mali_mem_validation.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_mem_validation.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2011-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_mem_validation.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+#define MALI_INVALID_MEM_ADDR 0xFFFFFFFF
+
+typedef struct {
+	u32 phys_base;        /**< Mali physical base of the memory, page aligned */
+	u32 size;             /**< size in bytes of the memory, multiple of page size */
+} _mali_mem_validation_t;
+
+static _mali_mem_validation_t mali_mem_validator = { MALI_INVALID_MEM_ADDR, MALI_INVALID_MEM_ADDR };
+
+_mali_osk_errcode_t mali_mem_validation_add_range(u32 start, u32 size)
+{
+	/* Check that no other MEM_VALIDATION resources exist */
+	if (MALI_INVALID_MEM_ADDR != mali_mem_validator.phys_base) {
+		MALI_PRINT_ERROR(("Failed to add frame buffer memory; another range is already specified\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Check restrictions on page alignment */
+	if ((0 != (start & (~_MALI_OSK_CPU_PAGE_MASK))) ||
+	    (0 != (size & (~_MALI_OSK_CPU_PAGE_MASK)))) {
+		MALI_PRINT_ERROR(("Failed to add frame buffer memory; incorrect alignment\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	mali_mem_validator.phys_base = start;
+	mali_mem_validator.size = size;
+	MALI_DEBUG_PRINT(2, ("Memory Validator installed for Mali physical address base=0x%08X, size=0x%08X\n",
+			     mali_mem_validator.phys_base, mali_mem_validator.size));
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_mem_validation_check(u32 phys_addr, u32 size)
+{
+	if (phys_addr < (phys_addr + size)) { /* Don't allow overflow (or zero size) */
+		if ((0 == (phys_addr & (~_MALI_OSK_CPU_PAGE_MASK))) &&
+		    (0 == (size & (~_MALI_OSK_CPU_PAGE_MASK)))) {
+			if ((phys_addr          >= mali_mem_validator.phys_base) &&
+			    ((phys_addr + (size - 1)) >= mali_mem_validator.phys_base) &&
+			    (phys_addr          <= (mali_mem_validator.phys_base + (mali_mem_validator.size - 1))) &&
+			    ((phys_addr + (size - 1)) <= (mali_mem_validator.phys_base + (mali_mem_validator.size - 1)))) {
+				MALI_DEBUG_PRINT(3, ("Accepted range 0x%08X + size 0x%08X (= 0x%08X)\n", phys_addr, size, (phys_addr + size - 1)));
+				return _MALI_OSK_ERR_OK;
+			}
+		}
+	}
+
+	MALI_PRINT_ERROR(("MALI PHYSICAL RANGE VALIDATION ERROR: The range supplied was: phys_base=0x%08X, size=0x%08X\n", phys_addr, size));
+
+	return _MALI_OSK_ERR_FAULT;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_mem_validation.h b/drivers/gpu/arm/mali400/common/mali_mem_validation.h
--- a/drivers/gpu/arm/mali400/common/mali_mem_validation.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_mem_validation.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) 2011-2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEM_VALIDATION_H__
+#define __MALI_MEM_VALIDATION_H__
+
+#include "mali_osk.h"
+
+_mali_osk_errcode_t mali_mem_validation_add_range(u32 start, u32 size);
+_mali_osk_errcode_t mali_mem_validation_check(u32 phys_addr, u32 size);
+
+#endif /* __MALI_MEM_VALIDATION_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_mmu.c b/drivers/gpu/arm/mali400/common/mali_mmu.c
--- a/drivers/gpu/arm/mali400/common/mali_mmu.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_mmu.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,433 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_ukk.h"
+
+#include "mali_mmu.h"
+#include "mali_hw_core.h"
+#include "mali_group.h"
+#include "mali_mmu_page_directory.h"
+
+/**
+ * Size of the MMU registers in bytes
+ */
+#define MALI_MMU_REGISTERS_SIZE 0x24
+
+/**
+ * MMU commands
+ * These are the commands that can be sent
+ * to the MMU unit.
+ */
+typedef enum mali_mmu_command {
+	MALI_MMU_COMMAND_ENABLE_PAGING = 0x00, /**< Enable paging (memory translation) */
+	MALI_MMU_COMMAND_DISABLE_PAGING = 0x01, /**< Disable paging (memory translation) */
+	MALI_MMU_COMMAND_ENABLE_STALL = 0x02, /**<  Enable stall on page fault */
+	MALI_MMU_COMMAND_DISABLE_STALL = 0x03, /**< Disable stall on page fault */
+	MALI_MMU_COMMAND_ZAP_CACHE = 0x04, /**< Zap the entire page table cache */
+	MALI_MMU_COMMAND_PAGE_FAULT_DONE = 0x05, /**< Page fault processed */
+	MALI_MMU_COMMAND_HARD_RESET = 0x06 /**< Reset the MMU back to power-on settings */
+} mali_mmu_command;
+
+static void mali_mmu_probe_trigger(void *data);
+static _mali_osk_errcode_t mali_mmu_probe_ack(void *data);
+
+MALI_STATIC_INLINE _mali_osk_errcode_t mali_mmu_raw_reset(struct mali_mmu_core *mmu);
+
+/* page fault queue flush helper pages
+ * note that the mapping pointers are currently unused outside of the initialization functions */
+static mali_dma_addr mali_page_fault_flush_page_directory = MALI_INVALID_PAGE;
+static mali_io_address mali_page_fault_flush_page_directory_mapping = NULL;
+static mali_dma_addr mali_page_fault_flush_page_table = MALI_INVALID_PAGE;
+static mali_io_address mali_page_fault_flush_page_table_mapping = NULL;
+static mali_dma_addr mali_page_fault_flush_data_page = MALI_INVALID_PAGE;
+static mali_io_address mali_page_fault_flush_data_page_mapping = NULL;
+
+/* an empty page directory (no address valid) which is active on any MMU not currently marked as in use */
+static mali_dma_addr mali_empty_page_directory_phys   = MALI_INVALID_PAGE;
+static mali_io_address mali_empty_page_directory_virt = NULL;
+
+
+_mali_osk_errcode_t mali_mmu_initialize(void)
+{
+	/* allocate the helper pages */
+	mali_empty_page_directory_phys = mali_allocate_empty_page(&mali_empty_page_directory_virt);
+	if (0 == mali_empty_page_directory_phys) {
+		MALI_DEBUG_PRINT_ERROR(("Mali MMU: Could not allocate empty page directory.\n"));
+		mali_empty_page_directory_phys = MALI_INVALID_PAGE;
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	if (_MALI_OSK_ERR_OK != mali_create_fault_flush_pages(&mali_page_fault_flush_page_directory,
+			&mali_page_fault_flush_page_directory_mapping,
+			&mali_page_fault_flush_page_table,
+			&mali_page_fault_flush_page_table_mapping,
+			&mali_page_fault_flush_data_page,
+			&mali_page_fault_flush_data_page_mapping)) {
+		MALI_DEBUG_PRINT_ERROR(("Mali MMU: Could not allocate fault flush pages\n"));
+		mali_free_empty_page(mali_empty_page_directory_phys, mali_empty_page_directory_virt);
+		mali_empty_page_directory_phys = MALI_INVALID_PAGE;
+		mali_empty_page_directory_virt = NULL;
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mmu_terminate(void)
+{
+	MALI_DEBUG_PRINT(3, ("Mali MMU: terminating\n"));
+
+	/* Free global helper pages */
+	mali_free_empty_page(mali_empty_page_directory_phys, mali_empty_page_directory_virt);
+	mali_empty_page_directory_phys = MALI_INVALID_PAGE;
+	mali_empty_page_directory_virt = NULL;
+
+	/* Free the page fault flush pages */
+	mali_destroy_fault_flush_pages(&mali_page_fault_flush_page_directory,
+				       &mali_page_fault_flush_page_directory_mapping,
+				       &mali_page_fault_flush_page_table,
+				       &mali_page_fault_flush_page_table_mapping,
+				       &mali_page_fault_flush_data_page,
+				       &mali_page_fault_flush_data_page_mapping);
+}
+
+struct mali_mmu_core *mali_mmu_create(_mali_osk_resource_t *resource, struct mali_group *group, mali_bool is_virtual)
+{
+	struct mali_mmu_core *mmu = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(resource);
+
+	MALI_DEBUG_PRINT(2, ("Mali MMU: Creating Mali MMU: %s\n", resource->description));
+
+	mmu = _mali_osk_calloc(1, sizeof(struct mali_mmu_core));
+	if (NULL != mmu) {
+		if (_MALI_OSK_ERR_OK == mali_hw_core_create(&mmu->hw_core, resource, MALI_MMU_REGISTERS_SIZE)) {
+			if (_MALI_OSK_ERR_OK == mali_group_add_mmu_core(group, mmu)) {
+				if (is_virtual) {
+					/* Skip reset and IRQ setup for virtual MMU */
+					return mmu;
+				}
+
+				if (_MALI_OSK_ERR_OK == mali_mmu_reset(mmu)) {
+					/* Setup IRQ handlers (which will do IRQ probing if needed) */
+					mmu->irq = _mali_osk_irq_init(resource->irq,
+								      mali_group_upper_half_mmu,
+								      group,
+								      mali_mmu_probe_trigger,
+								      mali_mmu_probe_ack,
+								      mmu,
+								      resource->description);
+					if (NULL != mmu->irq) {
+						return mmu;
+					} else {
+						MALI_PRINT_ERROR(("Mali MMU: Failed to setup interrupt handlers for MMU %s\n", mmu->hw_core.description));
+					}
+				}
+				mali_group_remove_mmu_core(group);
+			} else {
+				MALI_PRINT_ERROR(("Mali MMU: Failed to add core %s to group\n", mmu->hw_core.description));
+			}
+			mali_hw_core_delete(&mmu->hw_core);
+		}
+
+		_mali_osk_free(mmu);
+	} else {
+		MALI_PRINT_ERROR(("Failed to allocate memory for MMU\n"));
+	}
+
+	return NULL;
+}
+
+void mali_mmu_delete(struct mali_mmu_core *mmu)
+{
+	if (NULL != mmu->irq) {
+		_mali_osk_irq_term(mmu->irq);
+	}
+
+	mali_hw_core_delete(&mmu->hw_core);
+	_mali_osk_free(mmu);
+}
+
+static void mali_mmu_enable_paging(struct mali_mmu_core *mmu)
+{
+	int i;
+
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_ENABLE_PAGING);
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; ++i) {
+		if (mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS) & MALI_MMU_STATUS_BIT_PAGING_ENABLED) {
+			break;
+		}
+	}
+	if (MALI_REG_POLL_COUNT_FAST == i) {
+		MALI_PRINT_ERROR(("Enable paging request failed, MMU status is 0x%08X\n", mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS)));
+	}
+}
+
+/**
+ * Issues the enable stall command to the MMU and waits for HW to complete the request
+ * @param mmu The MMU to enable paging for
+ * @return MALI_TRUE if HW stall was successfully engaged, otherwise MALI_FALSE (req timed out)
+ */
+static mali_bool mali_mmu_enable_stall(struct mali_mmu_core *mmu)
+{
+	int i;
+	u32 mmu_status = mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS);
+
+	if (0 == (mmu_status & MALI_MMU_STATUS_BIT_PAGING_ENABLED)) {
+		MALI_DEBUG_PRINT(4, ("MMU stall is implicit when Paging is not enabled.\n"));
+		return MALI_TRUE;
+	}
+
+	if (mmu_status & MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE) {
+		MALI_DEBUG_PRINT(3, ("Aborting MMU stall request since it is in pagefault state.\n"));
+		return MALI_FALSE;
+	}
+
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_ENABLE_STALL);
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; ++i) {
+		mmu_status = mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS);
+		if (mmu_status & MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE) {
+			break;
+		}
+		if ((mmu_status & MALI_MMU_STATUS_BIT_STALL_ACTIVE) && (0 == (mmu_status & MALI_MMU_STATUS_BIT_STALL_NOT_ACTIVE))) {
+			break;
+		}
+		if (0 == (mmu_status & (MALI_MMU_STATUS_BIT_PAGING_ENABLED))) {
+			break;
+		}
+	}
+	if (MALI_REG_POLL_COUNT_FAST == i) {
+		MALI_DEBUG_PRINT(2, ("Enable stall request failed, MMU status is 0x%08X\n", mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS)));
+		return MALI_FALSE;
+	}
+
+	if (mmu_status & MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE) {
+		MALI_DEBUG_PRINT(2, ("Aborting MMU stall request since it has a pagefault.\n"));
+		return MALI_FALSE;
+	}
+
+	return MALI_TRUE;
+}
+
+/**
+ * Issues the disable stall command to the MMU and waits for HW to complete the request
+ * @param mmu The MMU to enable paging for
+ */
+static void mali_mmu_disable_stall(struct mali_mmu_core *mmu)
+{
+	int i;
+	u32 mmu_status = mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS);
+
+	if (0 == (mmu_status & MALI_MMU_STATUS_BIT_PAGING_ENABLED)) {
+		MALI_DEBUG_PRINT(3, ("MMU disable skipped since it was not enabled.\n"));
+		return;
+	}
+	if (mmu_status & MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE) {
+		MALI_DEBUG_PRINT(2, ("Aborting MMU disable stall request since it is in pagefault state.\n"));
+		return;
+	}
+
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_DISABLE_STALL);
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; ++i) {
+		u32 status = mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS);
+		if (0 == (status & MALI_MMU_STATUS_BIT_STALL_ACTIVE)) {
+			break;
+		}
+		if (status &  MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE) {
+			break;
+		}
+		if (0 == (mmu_status & MALI_MMU_STATUS_BIT_PAGING_ENABLED)) {
+			break;
+		}
+	}
+	if (MALI_REG_POLL_COUNT_FAST == i) MALI_DEBUG_PRINT(1, ("Disable stall request failed, MMU status is 0x%08X\n", mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS)));
+}
+
+void mali_mmu_page_fault_done(struct mali_mmu_core *mmu)
+{
+	MALI_DEBUG_PRINT(4, ("Mali MMU: %s: Leaving page fault mode\n", mmu->hw_core.description));
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_PAGE_FAULT_DONE);
+}
+
+MALI_STATIC_INLINE _mali_osk_errcode_t mali_mmu_raw_reset(struct mali_mmu_core *mmu)
+{
+	int i;
+
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_DTE_ADDR, 0xCAFEBABE);
+	MALI_DEBUG_ASSERT(0xCAFEB000 == mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_DTE_ADDR));
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_HARD_RESET);
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; ++i) {
+		if (mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_DTE_ADDR) == 0) {
+			break;
+		}
+	}
+	if (MALI_REG_POLL_COUNT_FAST == i) {
+		MALI_PRINT_ERROR(("Reset request failed, MMU status is 0x%08X\n", mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS)));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_mmu_reset(struct mali_mmu_core *mmu)
+{
+	_mali_osk_errcode_t err = _MALI_OSK_ERR_FAULT;
+	mali_bool stall_success;
+	MALI_DEBUG_ASSERT_POINTER(mmu);
+
+	stall_success = mali_mmu_enable_stall(mmu);
+	if (!stall_success) {
+		err = _MALI_OSK_ERR_BUSY;
+	}
+
+	MALI_DEBUG_PRINT(3, ("Mali MMU: mali_kernel_mmu_reset: %s\n", mmu->hw_core.description));
+
+	if (_MALI_OSK_ERR_OK == mali_mmu_raw_reset(mmu)) {
+		mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_INT_MASK, MALI_MMU_INTERRUPT_PAGE_FAULT | MALI_MMU_INTERRUPT_READ_BUS_ERROR);
+		/* no session is active, so just activate the empty page directory */
+		mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_DTE_ADDR, mali_empty_page_directory_phys);
+		mali_mmu_enable_paging(mmu);
+		err = _MALI_OSK_ERR_OK;
+	}
+	mali_mmu_disable_stall(mmu);
+
+	return err;
+}
+
+mali_bool mali_mmu_zap_tlb(struct mali_mmu_core *mmu)
+{
+	mali_bool stall_success = mali_mmu_enable_stall(mmu);
+
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_ZAP_CACHE);
+
+	if (MALI_FALSE == stall_success) {
+		/* False means that it is in Pagefault state. Not possible to disable_stall then */
+		return MALI_FALSE;
+	}
+
+	mali_mmu_disable_stall(mmu);
+	return MALI_TRUE;
+}
+
+void mali_mmu_zap_tlb_without_stall(struct mali_mmu_core *mmu)
+{
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_ZAP_CACHE);
+}
+
+
+void mali_mmu_invalidate_page(struct mali_mmu_core *mmu, u32 mali_address)
+{
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_ZAP_ONE_LINE, MALI_MMU_PDE_ENTRY(mali_address));
+}
+
+static void mali_mmu_activate_address_space(struct mali_mmu_core *mmu, u32 page_directory)
+{
+	/* The MMU must be in stalled or page fault mode, for this writing to work */
+	MALI_DEBUG_ASSERT(0 != (mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS)
+				& (MALI_MMU_STATUS_BIT_STALL_ACTIVE | MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE)));
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_DTE_ADDR, page_directory);
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_COMMAND, MALI_MMU_COMMAND_ZAP_CACHE);
+
+}
+
+void mali_mmu_activate_page_directory(struct mali_mmu_core *mmu, struct mali_page_directory *pagedir)
+{
+	mali_bool stall_success;
+	MALI_DEBUG_ASSERT_POINTER(mmu);
+
+	MALI_DEBUG_PRINT(5, ("Asked to activate page directory 0x%x on MMU %s\n", pagedir, mmu->hw_core.description));
+
+	stall_success = mali_mmu_enable_stall(mmu);
+	MALI_DEBUG_ASSERT(stall_success);
+	MALI_IGNORE(stall_success);
+	mali_mmu_activate_address_space(mmu, pagedir->page_directory);
+	mali_mmu_disable_stall(mmu);
+}
+
+void mali_mmu_activate_empty_page_directory(struct mali_mmu_core *mmu)
+{
+	mali_bool stall_success;
+
+	MALI_DEBUG_ASSERT_POINTER(mmu);
+	MALI_DEBUG_PRINT(3, ("Activating the empty page directory on MMU %s\n", mmu->hw_core.description));
+
+	stall_success = mali_mmu_enable_stall(mmu);
+
+	/* This function can only be called when the core is idle, so it could not fail. */
+	MALI_DEBUG_ASSERT(stall_success);
+	MALI_IGNORE(stall_success);
+
+	mali_mmu_activate_address_space(mmu, mali_empty_page_directory_phys);
+	mali_mmu_disable_stall(mmu);
+}
+
+void mali_mmu_activate_fault_flush_page_directory(struct mali_mmu_core *mmu)
+{
+	mali_bool stall_success;
+	MALI_DEBUG_ASSERT_POINTER(mmu);
+
+	MALI_DEBUG_PRINT(3, ("Activating the page fault flush page directory on MMU %s\n", mmu->hw_core.description));
+	stall_success = mali_mmu_enable_stall(mmu);
+	/* This function is expect to fail the stalling, since it might be in PageFault mode when it is called */
+	mali_mmu_activate_address_space(mmu, mali_page_fault_flush_page_directory);
+	if (MALI_TRUE == stall_success) mali_mmu_disable_stall(mmu);
+}
+
+/* Is called when we want the mmu to give an interrupt */
+static void mali_mmu_probe_trigger(void *data)
+{
+	struct mali_mmu_core *mmu = (struct mali_mmu_core *)data;
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_INT_RAWSTAT, MALI_MMU_INTERRUPT_PAGE_FAULT | MALI_MMU_INTERRUPT_READ_BUS_ERROR);
+}
+
+/* Is called when the irq probe wants the mmu to acknowledge an interrupt from the hw */
+static _mali_osk_errcode_t mali_mmu_probe_ack(void *data)
+{
+	struct mali_mmu_core *mmu = (struct mali_mmu_core *)data;
+	u32 int_stat;
+
+	int_stat = mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_INT_STATUS);
+
+	MALI_DEBUG_PRINT(2, ("mali_mmu_probe_irq_acknowledge: intstat 0x%x\n", int_stat));
+	if (int_stat & MALI_MMU_INTERRUPT_PAGE_FAULT) {
+		MALI_DEBUG_PRINT(2, ("Probe: Page fault detect: PASSED\n"));
+		mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_INT_CLEAR, MALI_MMU_INTERRUPT_PAGE_FAULT);
+	} else {
+		MALI_DEBUG_PRINT(1, ("Probe: Page fault detect: FAILED\n"));
+	}
+
+	if (int_stat & MALI_MMU_INTERRUPT_READ_BUS_ERROR) {
+		MALI_DEBUG_PRINT(2, ("Probe: Bus read error detect: PASSED\n"));
+		mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_INT_CLEAR, MALI_MMU_INTERRUPT_READ_BUS_ERROR);
+	} else {
+		MALI_DEBUG_PRINT(1, ("Probe: Bus read error detect: FAILED\n"));
+	}
+
+	if ((int_stat & (MALI_MMU_INTERRUPT_PAGE_FAULT | MALI_MMU_INTERRUPT_READ_BUS_ERROR)) ==
+	    (MALI_MMU_INTERRUPT_PAGE_FAULT | MALI_MMU_INTERRUPT_READ_BUS_ERROR)) {
+		return _MALI_OSK_ERR_OK;
+	}
+
+	return _MALI_OSK_ERR_FAULT;
+}
+
+#if 0
+void mali_mmu_print_state(struct mali_mmu_core *mmu)
+{
+	MALI_DEBUG_PRINT(2, ("MMU: State of %s is 0x%08x\n", mmu->hw_core.description, mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS)));
+}
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_mmu.h b/drivers/gpu/arm/mali400/common/mali_mmu.h
--- a/drivers/gpu/arm/mali400/common/mali_mmu.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_mmu.h	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MMU_H__
+#define __MALI_MMU_H__
+
+#include "mali_osk.h"
+#include "mali_mmu_page_directory.h"
+#include "mali_hw_core.h"
+
+/* Forward declaration from mali_group.h */
+struct mali_group;
+
+/**
+ * MMU register numbers
+ * Used in the register read/write routines.
+ * See the hardware documentation for more information about each register
+ */
+typedef enum mali_mmu_register {
+	MALI_MMU_REGISTER_DTE_ADDR = 0x0000, /**< Current Page Directory Pointer */
+	MALI_MMU_REGISTER_STATUS = 0x0004, /**< Status of the MMU */
+	MALI_MMU_REGISTER_COMMAND = 0x0008, /**< Command register, used to control the MMU */
+	MALI_MMU_REGISTER_PAGE_FAULT_ADDR = 0x000C, /**< Logical address of the last page fault */
+	MALI_MMU_REGISTER_ZAP_ONE_LINE = 0x010, /**< Used to invalidate the mapping of a single page from the MMU */
+	MALI_MMU_REGISTER_INT_RAWSTAT = 0x0014, /**< Raw interrupt status, all interrupts visible */
+	MALI_MMU_REGISTER_INT_CLEAR = 0x0018, /**< Indicate to the MMU that the interrupt has been received */
+	MALI_MMU_REGISTER_INT_MASK = 0x001C, /**< Enable/disable types of interrupts */
+	MALI_MMU_REGISTER_INT_STATUS = 0x0020 /**< Interrupt status based on the mask */
+} mali_mmu_register;
+
+/**
+ * MMU interrupt register bits
+ * Each cause of the interrupt is reported
+ * through the (raw) interrupt status registers.
+ * Multiple interrupts can be pending, so multiple bits
+ * can be set at once.
+ */
+typedef enum mali_mmu_interrupt {
+	MALI_MMU_INTERRUPT_PAGE_FAULT = 0x01, /**< A page fault occured */
+	MALI_MMU_INTERRUPT_READ_BUS_ERROR = 0x02 /**< A bus read error occured */
+} mali_mmu_interrupt;
+
+typedef enum mali_mmu_status_bits {
+	MALI_MMU_STATUS_BIT_PAGING_ENABLED      = 1 << 0,
+	MALI_MMU_STATUS_BIT_PAGE_FAULT_ACTIVE   = 1 << 1,
+	MALI_MMU_STATUS_BIT_STALL_ACTIVE        = 1 << 2,
+	MALI_MMU_STATUS_BIT_IDLE                = 1 << 3,
+	MALI_MMU_STATUS_BIT_REPLAY_BUFFER_EMPTY = 1 << 4,
+	MALI_MMU_STATUS_BIT_PAGE_FAULT_IS_WRITE = 1 << 5,
+	MALI_MMU_STATUS_BIT_STALL_NOT_ACTIVE    = 1 << 31,
+} mali_mmu_status_bits;
+
+/**
+ * Definition of the MMU struct
+ * Used to track a MMU unit in the system.
+ * Contains information about the mapping of the registers
+ */
+struct mali_mmu_core {
+	struct mali_hw_core hw_core; /**< Common for all HW cores */
+	_mali_osk_irq_t *irq;        /**< IRQ handler */
+};
+
+_mali_osk_errcode_t mali_mmu_initialize(void);
+
+void mali_mmu_terminate(void);
+
+struct mali_mmu_core *mali_mmu_create(_mali_osk_resource_t *resource, struct mali_group *group, mali_bool is_virtual);
+void mali_mmu_delete(struct mali_mmu_core *mmu);
+
+_mali_osk_errcode_t mali_mmu_reset(struct mali_mmu_core *mmu);
+mali_bool mali_mmu_zap_tlb(struct mali_mmu_core *mmu);
+void mali_mmu_zap_tlb_without_stall(struct mali_mmu_core *mmu);
+void mali_mmu_invalidate_page(struct mali_mmu_core *mmu, u32 mali_address);
+
+void mali_mmu_activate_page_directory(struct mali_mmu_core *mmu, struct mali_page_directory *pagedir);
+void mali_mmu_activate_empty_page_directory(struct mali_mmu_core *mmu);
+void mali_mmu_activate_fault_flush_page_directory(struct mali_mmu_core *mmu);
+
+void mali_mmu_page_fault_done(struct mali_mmu_core *mmu);
+
+MALI_STATIC_INLINE enum mali_interrupt_result mali_mmu_get_interrupt_result(struct mali_mmu_core *mmu)
+{
+	u32 rawstat_used = mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_INT_RAWSTAT);
+	if (0 == rawstat_used) {
+		return MALI_INTERRUPT_RESULT_NONE;
+	}
+
+	return MALI_INTERRUPT_RESULT_ERROR;
+}
+
+
+MALI_STATIC_INLINE u32 mali_mmu_get_int_status(struct mali_mmu_core *mmu)
+{
+	return mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_INT_STATUS);
+}
+
+MALI_STATIC_INLINE u32 mali_mmu_get_rawstat(struct mali_mmu_core *mmu)
+{
+	return mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_INT_RAWSTAT);
+}
+
+MALI_STATIC_INLINE void mali_mmu_mask_all_interrupts(struct mali_mmu_core *mmu)
+{
+	mali_hw_core_register_write(&mmu->hw_core, MALI_MMU_REGISTER_INT_MASK, 0);
+}
+
+MALI_STATIC_INLINE u32 mali_mmu_get_status(struct mali_mmu_core *mmu)
+{
+	return mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_STATUS);
+}
+
+MALI_STATIC_INLINE u32 mali_mmu_get_page_fault_addr(struct mali_mmu_core *mmu)
+{
+	return mali_hw_core_register_read(&mmu->hw_core, MALI_MMU_REGISTER_PAGE_FAULT_ADDR);
+}
+
+#endif /* __MALI_MMU_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.c b/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.c
--- a/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.c	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,495 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_ukk.h"
+#include "mali_uk_types.h"
+#include "mali_mmu_page_directory.h"
+#include "mali_memory.h"
+#include "mali_l2_cache.h"
+
+static _mali_osk_errcode_t fill_page(mali_io_address mapping, u32 data);
+
+u32 mali_allocate_empty_page(mali_io_address *virt_addr)
+{
+	_mali_osk_errcode_t err;
+	mali_io_address mapping;
+	mali_dma_addr address;
+
+	if (_MALI_OSK_ERR_OK != mali_mmu_get_table_page(&address, &mapping)) {
+		/* Allocation failed */
+		MALI_DEBUG_PRINT(2, ("Mali MMU: Failed to get table page for empty pgdir\n"));
+		return 0;
+	}
+
+	MALI_DEBUG_ASSERT_POINTER(mapping);
+
+	err = fill_page(mapping, 0);
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_mmu_release_table_page(address, mapping);
+		MALI_DEBUG_PRINT(2, ("Mali MMU: Failed to zero page\n"));
+		return 0;
+	}
+
+	*virt_addr = mapping;
+	return address;
+}
+
+void mali_free_empty_page(mali_dma_addr address, mali_io_address virt_addr)
+{
+	if (MALI_INVALID_PAGE != address) {
+		mali_mmu_release_table_page(address, virt_addr);
+	}
+}
+
+_mali_osk_errcode_t mali_create_fault_flush_pages(mali_dma_addr *page_directory,
+		mali_io_address *page_directory_mapping,
+		mali_dma_addr *page_table, mali_io_address *page_table_mapping,
+		mali_dma_addr *data_page, mali_io_address *data_page_mapping)
+{
+	_mali_osk_errcode_t err;
+
+	err = mali_mmu_get_table_page(data_page, data_page_mapping);
+	if (_MALI_OSK_ERR_OK == err) {
+		err = mali_mmu_get_table_page(page_table, page_table_mapping);
+		if (_MALI_OSK_ERR_OK == err) {
+			err = mali_mmu_get_table_page(page_directory, page_directory_mapping);
+			if (_MALI_OSK_ERR_OK == err) {
+				fill_page(*data_page_mapping, 0);
+				fill_page(*page_table_mapping, *data_page | MALI_MMU_FLAGS_DEFAULT);
+				fill_page(*page_directory_mapping, *page_table | MALI_MMU_FLAGS_PRESENT);
+				MALI_SUCCESS;
+			}
+			mali_mmu_release_table_page(*page_table, *page_table_mapping);
+			*page_table = MALI_INVALID_PAGE;
+		}
+		mali_mmu_release_table_page(*data_page, *data_page_mapping);
+		*data_page = MALI_INVALID_PAGE;
+	}
+	return err;
+}
+
+void mali_destroy_fault_flush_pages(
+	mali_dma_addr *page_directory, mali_io_address *page_directory_mapping,
+	mali_dma_addr *page_table, mali_io_address *page_table_mapping,
+	mali_dma_addr *data_page, mali_io_address *data_page_mapping)
+{
+	if (MALI_INVALID_PAGE != *page_directory) {
+		mali_mmu_release_table_page(*page_directory, *page_directory_mapping);
+		*page_directory = MALI_INVALID_PAGE;
+		*page_directory_mapping = NULL;
+	}
+
+	if (MALI_INVALID_PAGE != *page_table) {
+		mali_mmu_release_table_page(*page_table, *page_table_mapping);
+		*page_table = MALI_INVALID_PAGE;
+		*page_table_mapping = NULL;
+	}
+
+	if (MALI_INVALID_PAGE != *data_page) {
+		mali_mmu_release_table_page(*data_page, *data_page_mapping);
+		*data_page = MALI_INVALID_PAGE;
+		*data_page_mapping = NULL;
+	}
+}
+
+static _mali_osk_errcode_t fill_page(mali_io_address mapping, u32 data)
+{
+	int i;
+	MALI_DEBUG_ASSERT_POINTER(mapping);
+
+	for (i = 0; i < MALI_MMU_PAGE_SIZE / 4; i++) {
+		_mali_osk_mem_iowrite32_relaxed(mapping, i * sizeof(u32), data);
+	}
+	_mali_osk_mem_barrier();
+	MALI_SUCCESS;
+}
+
+_mali_osk_errcode_t mali_mmu_pagedir_map(struct mali_page_directory *pagedir, u32 mali_address, u32 size)
+{
+	const int first_pde = MALI_MMU_PDE_ENTRY(mali_address);
+	const int last_pde = MALI_MMU_PDE_ENTRY(mali_address + size - 1);
+	_mali_osk_errcode_t err;
+	mali_io_address pde_mapping;
+	mali_dma_addr pde_phys;
+	int i, page_count;
+	u32 start_address;
+	if (last_pde < first_pde)
+		return _MALI_OSK_ERR_INVALID_ARGS;
+
+	for (i = first_pde; i <= last_pde; i++) {
+		if (0 == (_mali_osk_mem_ioread32(pagedir->page_directory_mapped,
+						 i * sizeof(u32)) & MALI_MMU_FLAGS_PRESENT)) {
+			/* Page table not present */
+			MALI_DEBUG_ASSERT(0 == pagedir->page_entries_usage_count[i]);
+			MALI_DEBUG_ASSERT(NULL == pagedir->page_entries_mapped[i]);
+
+			err = mali_mmu_get_table_page(&pde_phys, &pde_mapping);
+			if (_MALI_OSK_ERR_OK != err) {
+				MALI_PRINT_ERROR(("Failed to allocate page table page.\n"));
+				return err;
+			}
+			pagedir->page_entries_mapped[i] = pde_mapping;
+
+			/* Update PDE, mark as present */
+			_mali_osk_mem_iowrite32_relaxed(pagedir->page_directory_mapped, i * sizeof(u32),
+							pde_phys | MALI_MMU_FLAGS_PRESENT);
+
+			MALI_DEBUG_ASSERT(0 == pagedir->page_entries_usage_count[i]);
+		}
+
+		if (first_pde == last_pde) {
+			pagedir->page_entries_usage_count[i] += size / MALI_MMU_PAGE_SIZE;
+		} else if (i == first_pde) {
+			start_address = i * MALI_MMU_VIRTUAL_PAGE_SIZE;
+			page_count = (start_address + MALI_MMU_VIRTUAL_PAGE_SIZE - mali_address) / MALI_MMU_PAGE_SIZE;
+			pagedir->page_entries_usage_count[i] += page_count;
+		} else if (i == last_pde) {
+			start_address = i * MALI_MMU_VIRTUAL_PAGE_SIZE;
+			page_count = (mali_address + size - start_address) / MALI_MMU_PAGE_SIZE;
+			pagedir->page_entries_usage_count[i] += page_count;
+		} else {
+			pagedir->page_entries_usage_count[i] = 1024;
+		}
+	}
+	_mali_osk_write_mem_barrier();
+
+	return _MALI_OSK_ERR_OK;
+}
+
+MALI_STATIC_INLINE void mali_mmu_zero_pte(mali_io_address page_table, u32 mali_address, u32 size)
+{
+	int i;
+	const int first_pte = MALI_MMU_PTE_ENTRY(mali_address);
+	const int last_pte = MALI_MMU_PTE_ENTRY(mali_address + size - 1);
+
+	for (i = first_pte; i <= last_pte; i++) {
+		_mali_osk_mem_iowrite32_relaxed(page_table, i * sizeof(u32), 0);
+	}
+}
+
+static u32 mali_page_directory_get_phys_address(struct mali_page_directory *pagedir, u32 index)
+{
+	return (_mali_osk_mem_ioread32(pagedir->page_directory_mapped,
+				       index * sizeof(u32)) & ~MALI_MMU_FLAGS_MASK);
+}
+
+
+_mali_osk_errcode_t mali_mmu_pagedir_unmap(struct mali_page_directory *pagedir, u32 mali_address, u32 size)
+{
+	const int first_pde = MALI_MMU_PDE_ENTRY(mali_address);
+	const int last_pde = MALI_MMU_PDE_ENTRY(mali_address + size - 1);
+	u32 left = size;
+	int i;
+	mali_bool pd_changed = MALI_FALSE;
+	u32 pages_to_invalidate[3]; /* hard-coded to 3: max two pages from the PT level plus max one page from PD level */
+	u32 num_pages_inv = 0;
+	mali_bool invalidate_all = MALI_FALSE; /* safety mechanism in case page_entries_usage_count is unreliable */
+
+	/* For all page directory entries in range. */
+	for (i = first_pde; i <= last_pde; i++) {
+		u32 size_in_pde, offset;
+
+		MALI_DEBUG_ASSERT_POINTER(pagedir->page_entries_mapped[i]);
+		MALI_DEBUG_ASSERT(0 != pagedir->page_entries_usage_count[i]);
+
+		/* Offset into page table, 0 if mali_address is 4MiB aligned */
+		offset = (mali_address & (MALI_MMU_VIRTUAL_PAGE_SIZE - 1));
+		if (left < MALI_MMU_VIRTUAL_PAGE_SIZE - offset) {
+			size_in_pde = left;
+		} else {
+			size_in_pde = MALI_MMU_VIRTUAL_PAGE_SIZE - offset;
+		}
+
+		pagedir->page_entries_usage_count[i] -= size_in_pde / MALI_MMU_PAGE_SIZE;
+
+		/* If entire page table is unused, free it */
+		if (0 == pagedir->page_entries_usage_count[i]) {
+			u32 page_phys;
+			void *page_virt;
+			MALI_DEBUG_PRINT(4, ("Releasing page table as this is the last reference\n"));
+			/* last reference removed, no need to zero out each PTE  */
+
+			page_phys = MALI_MMU_ENTRY_ADDRESS(_mali_osk_mem_ioread32(pagedir->page_directory_mapped, i * sizeof(u32)));
+			page_virt = pagedir->page_entries_mapped[i];
+			pagedir->page_entries_mapped[i] = NULL;
+			_mali_osk_mem_iowrite32_relaxed(pagedir->page_directory_mapped, i * sizeof(u32), 0);
+
+			mali_mmu_release_table_page(page_phys, page_virt);
+			pd_changed = MALI_TRUE;
+		} else {
+			MALI_DEBUG_ASSERT(num_pages_inv < 2);
+			if (num_pages_inv < 2) {
+				pages_to_invalidate[num_pages_inv] = mali_page_directory_get_phys_address(pagedir, i);
+				num_pages_inv++;
+			} else {
+				invalidate_all = MALI_TRUE;
+			}
+
+			/* If part of the page table is still in use, zero the relevant PTEs */
+			mali_mmu_zero_pte(pagedir->page_entries_mapped[i], mali_address, size_in_pde);
+		}
+
+		left -= size_in_pde;
+		mali_address += size_in_pde;
+	}
+	_mali_osk_write_mem_barrier();
+
+	/* L2 pages invalidation */
+	if (MALI_TRUE == pd_changed) {
+		MALI_DEBUG_ASSERT(num_pages_inv < 3);
+		if (num_pages_inv < 3) {
+			pages_to_invalidate[num_pages_inv] = pagedir->page_directory;
+			num_pages_inv++;
+		} else {
+			invalidate_all = MALI_TRUE;
+		}
+	}
+
+	if (invalidate_all) {
+		mali_l2_cache_invalidate_all();
+	} else {
+		mali_l2_cache_invalidate_all_pages(pages_to_invalidate, num_pages_inv);
+	}
+
+	MALI_SUCCESS;
+}
+
+struct mali_page_directory *mali_mmu_pagedir_alloc(void)
+{
+	struct mali_page_directory *pagedir;
+	_mali_osk_errcode_t err;
+	mali_dma_addr phys;
+
+	pagedir = _mali_osk_calloc(1, sizeof(struct mali_page_directory));
+	if (NULL == pagedir) {
+		return NULL;
+	}
+
+	err = mali_mmu_get_table_page(&phys, &pagedir->page_directory_mapped);
+	if (_MALI_OSK_ERR_OK != err) {
+		_mali_osk_free(pagedir);
+		return NULL;
+	}
+
+	pagedir->page_directory = (u32)phys;
+
+	/* Zero page directory */
+	fill_page(pagedir->page_directory_mapped, 0);
+
+	return pagedir;
+}
+
+void mali_mmu_pagedir_free(struct mali_page_directory *pagedir)
+{
+	const int num_page_table_entries = sizeof(pagedir->page_entries_mapped) / sizeof(pagedir->page_entries_mapped[0]);
+	int i;
+
+	/* Free referenced page tables and zero PDEs. */
+	for (i = 0; i < num_page_table_entries; i++) {
+		if (pagedir->page_directory_mapped && (_mali_osk_mem_ioread32(
+				pagedir->page_directory_mapped,
+				sizeof(u32)*i) & MALI_MMU_FLAGS_PRESENT)) {
+			mali_dma_addr phys = _mali_osk_mem_ioread32(pagedir->page_directory_mapped,
+					     i * sizeof(u32)) & ~MALI_MMU_FLAGS_MASK;
+			_mali_osk_mem_iowrite32_relaxed(pagedir->page_directory_mapped, i * sizeof(u32), 0);
+			mali_mmu_release_table_page(phys, pagedir->page_entries_mapped[i]);
+		}
+	}
+	_mali_osk_write_mem_barrier();
+
+	/* Free the page directory page. */
+	mali_mmu_release_table_page(pagedir->page_directory, pagedir->page_directory_mapped);
+
+	_mali_osk_free(pagedir);
+}
+
+
+void mali_mmu_pagedir_update(struct mali_page_directory *pagedir, u32 mali_address,
+			     mali_dma_addr phys_address, u32 size, u32 permission_bits)
+{
+	u32 end_address = mali_address + size;
+	u32 mali_phys = (u32)phys_address;
+
+	/* Map physical pages into MMU page tables */
+	for (; mali_address < end_address; mali_address += MALI_MMU_PAGE_SIZE, mali_phys += MALI_MMU_PAGE_SIZE) {
+		MALI_DEBUG_ASSERT_POINTER(pagedir->page_entries_mapped[MALI_MMU_PDE_ENTRY(mali_address)]);
+		_mali_osk_mem_iowrite32_relaxed(pagedir->page_entries_mapped[MALI_MMU_PDE_ENTRY(mali_address)],
+						MALI_MMU_PTE_ENTRY(mali_address) * sizeof(u32),
+						mali_phys | permission_bits);
+	}
+}
+
+void mali_mmu_pagedir_diag(struct mali_page_directory *pagedir, u32 fault_addr)
+{
+#if defined(DEBUG)
+	u32 pde_index, pte_index;
+	u32 pde, pte;
+
+	pde_index = MALI_MMU_PDE_ENTRY(fault_addr);
+	pte_index = MALI_MMU_PTE_ENTRY(fault_addr);
+
+
+	pde = _mali_osk_mem_ioread32(pagedir->page_directory_mapped,
+				     pde_index * sizeof(u32));
+
+
+	if (pde & MALI_MMU_FLAGS_PRESENT) {
+		u32 pte_addr = MALI_MMU_ENTRY_ADDRESS(pde);
+
+		pte = _mali_osk_mem_ioread32(pagedir->page_entries_mapped[pde_index],
+					     pte_index * sizeof(u32));
+
+		MALI_DEBUG_PRINT(2, ("\tMMU: %08x: Page table present: %08x\n"
+				     "\t\tPTE: %08x, page %08x is %s\n",
+				     fault_addr, pte_addr, pte,
+				     MALI_MMU_ENTRY_ADDRESS(pte),
+				     pte & MALI_MMU_FLAGS_DEFAULT ? "rw" : "not present"));
+	} else {
+		MALI_DEBUG_PRINT(2, ("\tMMU: %08x: Page table not present: %08x\n",
+				     fault_addr, pde));
+	}
+#else
+	MALI_IGNORE(pagedir);
+	MALI_IGNORE(fault_addr);
+#endif
+}
+
+/* For instrumented */
+struct dump_info {
+	u32 buffer_left;
+	u32 register_writes_size;
+	u32 page_table_dump_size;
+	u32 *buffer;
+};
+
+static _mali_osk_errcode_t writereg(u32 where, u32 what, const char *comment, struct dump_info *info)
+{
+	if (NULL != info) {
+		info->register_writes_size += sizeof(u32) * 2; /* two 32-bit words */
+
+		if (NULL != info->buffer) {
+			/* check that we have enough space */
+			if (info->buffer_left < sizeof(u32) * 2) MALI_ERROR(_MALI_OSK_ERR_NOMEM);
+
+			*info->buffer = where;
+			info->buffer++;
+
+			*info->buffer = what;
+			info->buffer++;
+
+			info->buffer_left -= sizeof(u32) * 2;
+		}
+	}
+
+	MALI_SUCCESS;
+}
+
+static _mali_osk_errcode_t mali_mmu_dump_page(mali_io_address page, u32 phys_addr, struct dump_info *info)
+{
+	if (NULL != info) {
+		/* 4096 for the page and 4 bytes for the address */
+		const u32 page_size_in_elements = MALI_MMU_PAGE_SIZE / 4;
+		const u32 page_size_in_bytes = MALI_MMU_PAGE_SIZE;
+		const u32 dump_size_in_bytes = MALI_MMU_PAGE_SIZE + 4;
+
+		info->page_table_dump_size += dump_size_in_bytes;
+
+		if (NULL != info->buffer) {
+			if (info->buffer_left < dump_size_in_bytes) MALI_ERROR(_MALI_OSK_ERR_NOMEM);
+
+			*info->buffer = phys_addr;
+			info->buffer++;
+
+			_mali_osk_memcpy(info->buffer, page, page_size_in_bytes);
+			info->buffer += page_size_in_elements;
+
+			info->buffer_left -= dump_size_in_bytes;
+		}
+	}
+
+	MALI_SUCCESS;
+}
+
+static _mali_osk_errcode_t dump_mmu_page_table(struct mali_page_directory *pagedir, struct dump_info *info)
+{
+	MALI_DEBUG_ASSERT_POINTER(pagedir);
+	MALI_DEBUG_ASSERT_POINTER(info);
+
+	if (NULL != pagedir->page_directory_mapped) {
+		int i;
+
+		MALI_CHECK_NO_ERROR(
+			mali_mmu_dump_page(pagedir->page_directory_mapped, pagedir->page_directory, info)
+		);
+
+		for (i = 0; i < 1024; i++) {
+			if (NULL != pagedir->page_entries_mapped[i]) {
+				MALI_CHECK_NO_ERROR(
+					mali_mmu_dump_page(pagedir->page_entries_mapped[i],
+							   _mali_osk_mem_ioread32(pagedir->page_directory_mapped,
+									   i * sizeof(u32)) & ~MALI_MMU_FLAGS_MASK, info)
+				);
+			}
+		}
+	}
+
+	MALI_SUCCESS;
+}
+
+static _mali_osk_errcode_t dump_mmu_registers(struct mali_page_directory *pagedir, struct dump_info *info)
+{
+	MALI_CHECK_NO_ERROR(writereg(0x00000000, pagedir->page_directory,
+				     "set the page directory address", info));
+	MALI_CHECK_NO_ERROR(writereg(0x00000008, 4, "zap???", info));
+	MALI_CHECK_NO_ERROR(writereg(0x00000008, 0, "enable paging", info));
+	MALI_SUCCESS;
+}
+
+_mali_osk_errcode_t _mali_ukk_query_mmu_page_table_dump_size(_mali_uk_query_mmu_page_table_dump_size_s *args)
+{
+	struct dump_info info = { 0, 0, 0, NULL };
+	struct mali_session_data *session_data;
+
+	session_data = (struct mali_session_data *)(uintptr_t)(args->ctx);
+	MALI_DEBUG_ASSERT_POINTER(session_data);
+	MALI_DEBUG_ASSERT_POINTER(args);
+
+	MALI_CHECK_NO_ERROR(dump_mmu_registers(session_data->page_directory, &info));
+	MALI_CHECK_NO_ERROR(dump_mmu_page_table(session_data->page_directory, &info));
+	args->size = info.register_writes_size + info.page_table_dump_size;
+	MALI_SUCCESS;
+}
+
+_mali_osk_errcode_t _mali_ukk_dump_mmu_page_table(_mali_uk_dump_mmu_page_table_s *args)
+{
+	struct dump_info info = { 0, 0, 0, NULL };
+	struct mali_session_data *session_data;
+
+	MALI_DEBUG_ASSERT_POINTER(args);
+
+	session_data = (struct mali_session_data *)(uintptr_t)(args->ctx);
+	MALI_DEBUG_ASSERT_POINTER(session_data);
+
+	info.buffer_left = args->size;
+	info.buffer = (u32 *)(uintptr_t)args->buffer;
+
+	args->register_writes = (uintptr_t)info.buffer;
+	MALI_CHECK_NO_ERROR(dump_mmu_registers(session_data->page_directory, &info));
+
+	args->page_table_dump = (uintptr_t)info.buffer;
+	MALI_CHECK_NO_ERROR(dump_mmu_page_table(session_data->page_directory, &info));
+
+	args->register_writes_size = info.register_writes_size;
+	args->page_table_dump_size = info.page_table_dump_size;
+
+	MALI_SUCCESS;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.h b/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.h
--- a/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_mmu_page_directory.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2011-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MMU_PAGE_DIRECTORY_H__
+#define __MALI_MMU_PAGE_DIRECTORY_H__
+
+#include "mali_osk.h"
+
+/**
+ * Size of an MMU page in bytes
+ */
+#define MALI_MMU_PAGE_SIZE 0x1000
+
+/*
+ * Size of the address space referenced by a page table page
+ */
+#define MALI_MMU_VIRTUAL_PAGE_SIZE 0x400000 /* 4 MiB */
+
+/**
+ * Page directory index from address
+ * Calculates the page directory index from the given address
+ */
+#define MALI_MMU_PDE_ENTRY(address) (((address)>>22) & 0x03FF)
+
+/**
+ * Page table index from address
+ * Calculates the page table index from the given address
+ */
+#define MALI_MMU_PTE_ENTRY(address) (((address)>>12) & 0x03FF)
+
+/**
+ * Extract the memory address from an PDE/PTE entry
+ */
+#define MALI_MMU_ENTRY_ADDRESS(value) ((value) & 0xFFFFFC00)
+
+#define MALI_INVALID_PAGE ((u32)(~0))
+
+/**
+ *
+ */
+typedef enum mali_mmu_entry_flags {
+	MALI_MMU_FLAGS_PRESENT = 0x01,
+	MALI_MMU_FLAGS_READ_PERMISSION = 0x02,
+	MALI_MMU_FLAGS_WRITE_PERMISSION = 0x04,
+	MALI_MMU_FLAGS_OVERRIDE_CACHE  = 0x8,
+	MALI_MMU_FLAGS_WRITE_CACHEABLE  = 0x10,
+	MALI_MMU_FLAGS_WRITE_ALLOCATE  = 0x20,
+	MALI_MMU_FLAGS_WRITE_BUFFERABLE  = 0x40,
+	MALI_MMU_FLAGS_READ_CACHEABLE  = 0x80,
+	MALI_MMU_FLAGS_READ_ALLOCATE  = 0x100,
+	MALI_MMU_FLAGS_MASK = 0x1FF,
+} mali_mmu_entry_flags;
+
+
+#define MALI_MMU_FLAGS_FORCE_GP_READ_ALLOCATE ( \
+		MALI_MMU_FLAGS_PRESENT | \
+		MALI_MMU_FLAGS_READ_PERMISSION |  \
+		MALI_MMU_FLAGS_WRITE_PERMISSION | \
+		MALI_MMU_FLAGS_OVERRIDE_CACHE | \
+		MALI_MMU_FLAGS_WRITE_CACHEABLE | \
+		MALI_MMU_FLAGS_WRITE_BUFFERABLE | \
+		MALI_MMU_FLAGS_READ_CACHEABLE | \
+		MALI_MMU_FLAGS_READ_ALLOCATE )
+
+#define MALI_MMU_FLAGS_DEFAULT ( \
+				 MALI_MMU_FLAGS_PRESENT | \
+				 MALI_MMU_FLAGS_READ_PERMISSION |  \
+				 MALI_MMU_FLAGS_WRITE_PERMISSION )
+
+
+struct mali_page_directory {
+	u32 page_directory; /**< Physical address of the memory session's page directory */
+	mali_io_address page_directory_mapped; /**< Pointer to the mapped version of the page directory into the kernel's address space */
+
+	mali_io_address page_entries_mapped[1024]; /**< Pointers to the page tables which exists in the page directory mapped into the kernel's address space */
+	u32   page_entries_usage_count[1024]; /**< Tracks usage count of the page table pages, so they can be releases on the last reference */
+};
+
+/* Map Mali virtual address space (i.e. ensure page tables exist for the virtual range)  */
+_mali_osk_errcode_t mali_mmu_pagedir_map(struct mali_page_directory *pagedir, u32 mali_address, u32 size);
+_mali_osk_errcode_t mali_mmu_pagedir_unmap(struct mali_page_directory *pagedir, u32 mali_address, u32 size);
+
+/* Back virtual address space with actual pages. Assumes input is contiguous and 4k aligned. */
+void mali_mmu_pagedir_update(struct mali_page_directory *pagedir, u32 mali_address,
+			     mali_dma_addr phys_address, u32 size, u32 permission_bits);
+
+u32 mali_allocate_empty_page(mali_io_address *virtual);
+void mali_free_empty_page(mali_dma_addr address, mali_io_address virt_addr);
+_mali_osk_errcode_t mali_create_fault_flush_pages(mali_dma_addr *page_directory,
+		mali_io_address *page_directory_mapping,
+		mali_dma_addr *page_table, mali_io_address *page_table_mapping,
+		mali_dma_addr *data_page, mali_io_address *data_page_mapping);
+void mali_destroy_fault_flush_pages(
+	mali_dma_addr *page_directory, mali_io_address *page_directory_mapping,
+	mali_dma_addr *page_table, mali_io_address *page_table_mapping,
+	mali_dma_addr *data_page, mali_io_address *data_page_mapping);
+
+struct mali_page_directory *mali_mmu_pagedir_alloc(void);
+void mali_mmu_pagedir_free(struct mali_page_directory *pagedir);
+
+void mali_mmu_pagedir_diag(struct mali_page_directory *pagedir, u32 fault_addr);
+
+#endif /* __MALI_MMU_PAGE_DIRECTORY_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_osk_bitops.h b/drivers/gpu/arm/mali400/common/mali_osk_bitops.h
--- a/drivers/gpu/arm/mali400/common/mali_osk_bitops.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_osk_bitops.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2010, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_bitops.h
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#ifndef __MALI_OSK_BITOPS_H__
+#define __MALI_OSK_BITOPS_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+MALI_STATIC_INLINE void _mali_internal_clear_bit(u32 bit, u32 *addr)
+{
+	MALI_DEBUG_ASSERT(bit < 32);
+	MALI_DEBUG_ASSERT(NULL != addr);
+
+	(*addr) &= ~(1 << bit);
+}
+
+MALI_STATIC_INLINE void _mali_internal_set_bit(u32 bit, u32 *addr)
+{
+	MALI_DEBUG_ASSERT(bit < 32);
+	MALI_DEBUG_ASSERT(NULL != addr);
+
+	(*addr) |= (1 << bit);
+}
+
+MALI_STATIC_INLINE u32 _mali_internal_test_bit(u32 bit, u32 value)
+{
+	MALI_DEBUG_ASSERT(bit < 32);
+	return value & (1 << bit);
+}
+
+MALI_STATIC_INLINE int _mali_internal_find_first_zero_bit(u32 value)
+{
+	u32 inverted;
+	u32 negated;
+	u32 isolated;
+	u32 leading_zeros;
+
+	/* Begin with xxx...x0yyy...y, where ys are 1, number of ys is in range  0..31 */
+	inverted = ~value; /* zzz...z1000...0 */
+	/* Using count_trailing_zeros on inverted value -
+	 * See ARM System Developers Guide for details of count_trailing_zeros */
+
+	/* Isolate the zero: it is preceeded by a run of 1s, so add 1 to it */
+	negated = (u32) - inverted ; /* -a == ~a + 1 (mod 2^n) for n-bit numbers */
+	/* negated = xxx...x1000...0 */
+
+	isolated = negated & inverted ; /* xxx...x1000...0 & zzz...z1000...0, zs are ~xs */
+	/* And so the first zero bit is in the same position as the 1 == number of 1s that preceeded it
+	 * Note that the output is zero if value was all 1s */
+
+	leading_zeros = _mali_osk_clz(isolated);
+
+	return 31 - leading_zeros;
+}
+
+
+/** @defgroup _mali_osk_bitops OSK Non-atomic Bit-operations
+ * @{ */
+
+/**
+ * These bit-operations do not work atomically, and so locks must be used if
+ * atomicity is required.
+ *
+ * Reference implementations for Little Endian are provided, and so it should
+ * not normally be necessary to re-implement these. Efficient bit-twiddling
+ * techniques are used where possible, implemented in portable C.
+ *
+ * Note that these reference implementations rely on _mali_osk_clz() being
+ * implemented.
+ */
+
+/** @brief Clear a bit in a sequence of 32-bit words
+ * @param nr bit number to clear, starting from the (Little-endian) least
+ * significant bit
+ * @param addr starting point for counting.
+ */
+MALI_STATIC_INLINE void _mali_osk_clear_nonatomic_bit(u32 nr, u32 *addr)
+{
+	addr += nr >> 5; /* find the correct word */
+	nr = nr & ((1 << 5) - 1); /* The bit number within the word */
+
+	_mali_internal_clear_bit(nr, addr);
+}
+
+/** @brief Set a bit in a sequence of 32-bit words
+ * @param nr bit number to set, starting from the (Little-endian) least
+ * significant bit
+ * @param addr starting point for counting.
+ */
+MALI_STATIC_INLINE void _mali_osk_set_nonatomic_bit(u32 nr, u32 *addr)
+{
+	addr += nr >> 5; /* find the correct word */
+	nr = nr & ((1 << 5) - 1); /* The bit number within the word */
+
+	_mali_internal_set_bit(nr, addr);
+}
+
+/** @brief Test a bit in a sequence of 32-bit words
+ * @param nr bit number to test, starting from the (Little-endian) least
+ * significant bit
+ * @param addr starting point for counting.
+ * @return zero if bit was clear, non-zero if set. Do not rely on the return
+ * value being related to the actual word under test.
+ */
+MALI_STATIC_INLINE u32 _mali_osk_test_bit(u32 nr, u32 *addr)
+{
+	addr += nr >> 5; /* find the correct word */
+	nr = nr & ((1 << 5) - 1); /* The bit number within the word */
+
+	return _mali_internal_test_bit(nr, *addr);
+}
+
+/* Return maxbit if not found */
+/** @brief Find the first zero bit in a sequence of 32-bit words
+ * @param addr starting point for search.
+ * @param maxbit the maximum number of bits to search
+ * @return the number of the first zero bit found, or maxbit if none were found
+ * in the specified range.
+ */
+MALI_STATIC_INLINE u32 _mali_osk_find_first_zero_bit(const u32 *addr, u32 maxbit)
+{
+	u32 total;
+
+	for (total = 0; total < maxbit; total += 32, ++addr) {
+		int result;
+		result = _mali_internal_find_first_zero_bit(*addr);
+
+		/* non-negative signifies the bit was found */
+		if (result >= 0) {
+			total += (u32)result;
+			break;
+		}
+	}
+
+	/* Now check if we reached maxbit or above */
+	if (total >= maxbit) {
+		total = maxbit;
+	}
+
+	return total; /* either the found bit nr, or maxbit if not found */
+}
+/** @} */ /* end group _mali_osk_bitops */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_OSK_BITOPS_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_osk.h b/drivers/gpu/arm/mali400/common/mali_osk.h
--- a/drivers/gpu/arm/mali400/common/mali_osk.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_osk.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1389 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk.h
+ * Defines the OS abstraction layer for the kernel device driver (OSK)
+ */
+
+#ifndef __MALI_OSK_H__
+#define __MALI_OSK_H__
+
+#include <linux/seq_file.h>
+#include "mali_osk_types.h"
+#include "mali_osk_specific.h"           /* include any per-os specifics */
+#include "mali_osk_locks.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @addtogroup uddapi Unified Device Driver (UDD) APIs
+ *
+ * @{
+ */
+
+/**
+ * @addtogroup oskapi UDD OS Abstraction for Kernel-side (OSK) APIs
+ *
+ * @{
+ */
+
+/** @addtogroup _mali_osk_lock OSK Mutual Exclusion Locks
+ * @{ */
+
+#ifdef DEBUG
+/** @brief Macro for asserting that the current thread holds a given lock
+ */
+#define MALI_DEBUG_ASSERT_LOCK_HELD(l) MALI_DEBUG_ASSERT(_mali_osk_lock_get_owner((_mali_osk_lock_debug_t *)l) == _mali_osk_get_tid());
+
+/** @brief returns a lock's owner (thread id) if debugging is enabled
+ */
+#else
+#define MALI_DEBUG_ASSERT_LOCK_HELD(l) do {} while(0)
+#endif
+
+#define _mali_osk_ctxprintf     seq_printf
+
+/** @} */ /* end group _mali_osk_lock */
+
+/** @addtogroup _mali_osk_miscellaneous
+ * @{ */
+
+/** @brief Find the containing structure of another structure
+ *
+ * This is the reverse of the operation 'offsetof'. This means that the
+ * following condition is satisfied:
+ *
+ *   ptr == _MALI_OSK_CONTAINER_OF( &ptr->member, type, member )
+ *
+ * When ptr is of type 'type'.
+ *
+ * Its purpose it to recover a larger structure that has wrapped a smaller one.
+ *
+ * @note no type or memory checking occurs to ensure that a wrapper structure
+ * does in fact exist, and that it is being recovered with respect to the
+ * correct member.
+ *
+ * @param ptr the pointer to the member that is contained within the larger
+ * structure
+ * @param type the type of the structure that contains the member
+ * @param member the name of the member in the structure that ptr points to.
+ * @return a pointer to a \a type object which contains \a member, as pointed
+ * to by \a ptr.
+ */
+#define _MALI_OSK_CONTAINER_OF(ptr, type, member) \
+	((type *)( ((char *)ptr) - offsetof(type,member) ))
+
+/** @addtogroup _mali_osk_wq
+ * @{ */
+
+/** @brief Initialize work queues (for deferred work)
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_wq_init(void);
+
+/** @brief Terminate work queues (for deferred work)
+ */
+void _mali_osk_wq_term(void);
+
+/** @brief Create work in the work queue
+ *
+ * Creates a work object which can be scheduled in the work queue. When
+ * scheduled, \a handler will be called with \a data as the argument.
+ *
+ * Refer to \ref _mali_osk_wq_schedule_work() for details on how work
+ * is scheduled in the queue.
+ *
+ * The returned pointer must be freed with \ref _mali_osk_wq_delete_work()
+ * when no longer needed.
+ */
+_mali_osk_wq_work_t *_mali_osk_wq_create_work(_mali_osk_wq_work_handler_t handler, void *data);
+
+/** @brief A high priority version of \a _mali_osk_wq_create_work()
+ *
+ * Creates a work object which can be scheduled in the high priority work queue.
+ *
+ * This is unfortunately needed to get low latency scheduling of the Mali cores.  Normally we would
+ * schedule the next job in hw_irq or tasklet, but often we can't since we need to synchronously map
+ * and unmap shared memory when a job is connected to external fences (timelines). And this requires
+ * taking a mutex.
+ *
+ * We do signal a lot of other (low priority) work also as part of the job being finished, and if we
+ * don't set this Mali scheduling thread as high priority, we see that the CPU scheduler often runs
+ * random things instead of starting the next GPU job when the GPU is idle.  So setting the gpu
+ * scheduler to high priority does give a visually more responsive system.
+ *
+ * Start the high priority work with: \a _mali_osk_wq_schedule_work_high_pri()
+ */
+_mali_osk_wq_work_t *_mali_osk_wq_create_work_high_pri(_mali_osk_wq_work_handler_t handler, void *data);
+
+/** @brief Delete a work object
+ *
+ * This will flush the work queue to ensure that the work handler will not
+ * be called after deletion.
+ */
+void _mali_osk_wq_delete_work(_mali_osk_wq_work_t *work);
+
+/** @brief Delete a work object
+ *
+ * This will NOT flush the work queue, so only call this if you are sure that the work handler will
+ * not be called after deletion.
+ */
+void _mali_osk_wq_delete_work_nonflush(_mali_osk_wq_work_t *work);
+
+/** @brief Cause a queued, deferred call of the work handler
+ *
+ * _mali_osk_wq_schedule_work provides a mechanism for enqueuing deferred calls
+ * to the work handler. After calling \ref _mali_osk_wq_schedule_work(), the
+ * work handler will be scheduled to run at some point in the future.
+ *
+ * Typically this is called by the IRQ upper-half to defer further processing of
+ * IRQ-related work to the IRQ bottom-half handler. This is necessary for work
+ * that cannot be done in an IRQ context by the IRQ upper-half handler. Timer
+ * callbacks also use this mechanism, because they are treated as though they
+ * operate in an IRQ context. Refer to \ref _mali_osk_timer_t for more
+ * information.
+ *
+ * Code that operates in a kernel-process context (with no IRQ context
+ * restrictions) may also enqueue deferred calls to the IRQ bottom-half. The
+ * advantage over direct calling is that deferred calling allows the caller and
+ * IRQ bottom half to hold the same mutex, with a guarantee that they will not
+ * deadlock just by using this mechanism.
+ *
+ * _mali_osk_wq_schedule_work() places deferred call requests on a queue, to
+ * allow for more than one thread to make a deferred call. Therfore, if it is
+ * called 'K' times, then the IRQ bottom-half will be scheduled 'K' times too.
+ * 'K' is a number that is implementation-specific.
+ *
+ * _mali_osk_wq_schedule_work() is guaranteed to not block on:
+ * - enqueuing a deferred call request.
+ * - the completion of the work handler.
+ *
+ * This is to prevent deadlock. For example, if _mali_osk_wq_schedule_work()
+ * blocked, then it would cause a deadlock when the following two conditions
+ * hold:
+ * - The work handler callback (of type _mali_osk_wq_work_handler_t) locks
+ * a mutex
+ * - And, at the same time, the caller of _mali_osk_wq_schedule_work() also
+ * holds the same mutex
+ *
+ * @note care must be taken to not overflow the queue that
+ * _mali_osk_wq_schedule_work() operates on. Code must be structured to
+ * ensure that the number of requests made to the queue is bounded. Otherwise,
+ * work will be lost.
+ *
+ * The queue that _mali_osk_wq_schedule_work implements is a FIFO of N-writer,
+ * 1-reader type. The writers are the callers of _mali_osk_wq_schedule_work
+ * (all OSK-registered IRQ upper-half handlers in the system, watchdog timers,
+ * callers from a Kernel-process context). The reader is a single thread that
+ * handles all OSK-registered work.
+ *
+ * @param work a pointer to the _mali_osk_wq_work_t object corresponding to the
+ * work to begin processing.
+ */
+void _mali_osk_wq_schedule_work(_mali_osk_wq_work_t *work);
+
+/** @brief Cause a queued, deferred call of the high priority work handler
+ *
+ * Function is the same as \a _mali_osk_wq_schedule_work() with the only
+ * difference that it runs in a high (real time) priority on the system.
+ *
+ * Should only be used as a substitue for doing the same work in interrupts.
+ *
+ * This is allowed to sleep, but the work should be small since it will block
+ * all other applications.
+*/
+void _mali_osk_wq_schedule_work_high_pri(_mali_osk_wq_work_t *work);
+
+/** @brief Flush the work queue
+ *
+ * This will flush the OSK work queue, ensuring all work in the queue has
+ * completed before returning.
+ *
+ * Since this blocks on the completion of work in the work-queue, the
+ * caller of this function \b must \b not hold any mutexes that are taken by
+ * any registered work handler. To do so may cause a deadlock.
+ *
+ */
+void _mali_osk_wq_flush(void);
+
+/** @brief Create work in the delayed work queue
+ *
+ * Creates a work object which can be scheduled in the work queue. When
+ * scheduled, a timer will be start and the \a handler will be called with
+ * \a data as the argument when timer out
+ *
+ * Refer to \ref _mali_osk_wq_delayed_schedule_work() for details on how work
+ * is scheduled in the queue.
+ *
+ * The returned pointer must be freed with \ref _mali_osk_wq_delayed_delete_work_nonflush()
+ * when no longer needed.
+ */
+_mali_osk_wq_delayed_work_t *_mali_osk_wq_delayed_create_work(_mali_osk_wq_work_handler_t handler, void *data);
+
+/** @brief Delete a work object
+ *
+ * This will NOT flush the work queue, so only call this if you are sure that the work handler will
+ * not be called after deletion.
+ */
+void _mali_osk_wq_delayed_delete_work_nonflush(_mali_osk_wq_delayed_work_t *work);
+
+/** @brief Cancel a delayed work without waiting for it to finish
+ *
+ * Note that the \a work callback function may still be running on return from
+ * _mali_osk_wq_delayed_cancel_work_async().
+ *
+ * @param work The delayed work to be cancelled
+ */
+void _mali_osk_wq_delayed_cancel_work_async(_mali_osk_wq_delayed_work_t *work);
+
+/** @brief Cancel a delayed work and wait for it to finish
+ *
+ * When this function returns, the \a work was either cancelled or it finished running.
+ *
+ * @param work The delayed work to be cancelled
+ */
+void _mali_osk_wq_delayed_cancel_work_sync(_mali_osk_wq_delayed_work_t *work);
+
+/** @brief Put \a work task in global workqueue after delay
+ *
+ * After waiting for a given time this puts a job in the kernel-global
+ * workqueue.
+ *
+ * If \a work was already on a queue, this function will return without doing anything
+ *
+ * @param work job to be done
+ * @param delay number of jiffies to wait or 0 for immediate execution
+ */
+void _mali_osk_wq_delayed_schedule_work(_mali_osk_wq_delayed_work_t *work, u32 delay);
+
+/** @} */ /* end group _mali_osk_wq */
+
+
+/** @addtogroup _mali_osk_irq
+ * @{ */
+
+/** @brief Initialize IRQ handling for a resource
+ *
+ * Registers an interrupt handler \a uhandler for the given IRQ number \a irqnum.
+ * \a data will be passed as argument to the handler when an interrupt occurs.
+ *
+ * If \a irqnum is -1, _mali_osk_irq_init will probe for the IRQ number using
+ * the supplied \a trigger_func and \a ack_func. These functions will also
+ * receive \a data as their argument.
+ *
+ * @param irqnum The IRQ number that the resource uses, as seen by the CPU.
+ * The value -1 has a special meaning which indicates the use of probing, and
+ * trigger_func and ack_func must be non-NULL.
+ * @param uhandler The interrupt handler, corresponding to a ISR handler for
+ * the resource
+ * @param int_data resource specific data, which will be passed to uhandler
+ * @param trigger_func Optional: a function to trigger the resource's irq, to
+ * probe for the interrupt. Use NULL if irqnum != -1.
+ * @param ack_func Optional: a function to acknowledge the resource's irq, to
+ * probe for the interrupt. Use NULL if irqnum != -1.
+ * @param probe_data resource-specific data, which will be passed to
+ * (if present) trigger_func and ack_func
+ * @param description textual description of the IRQ resource.
+ * @return on success, a pointer to a _mali_osk_irq_t object, which represents
+ * the IRQ handling on this resource. NULL on failure.
+ */
+_mali_osk_irq_t *_mali_osk_irq_init(u32 irqnum, _mali_osk_irq_uhandler_t uhandler, void *int_data, _mali_osk_irq_trigger_t trigger_func, _mali_osk_irq_ack_t ack_func, void *probe_data, const char *description);
+
+/** @brief Terminate IRQ handling on a resource.
+ *
+ * This will disable the interrupt from the device, and then waits for any
+ * currently executing IRQ handlers to complete.
+ *
+ * @note If work is deferred to an IRQ bottom-half handler through
+ * \ref _mali_osk_wq_schedule_work(), be sure to flush any remaining work
+ * with \ref _mali_osk_wq_flush() or (implicitly) with \ref _mali_osk_wq_delete_work()
+ *
+ * @param irq a pointer to the _mali_osk_irq_t object corresponding to the
+ * resource whose IRQ handling is to be terminated.
+ */
+void _mali_osk_irq_term(_mali_osk_irq_t *irq);
+
+/** @} */ /* end group _mali_osk_irq */
+
+
+/** @addtogroup _mali_osk_atomic
+ * @{ */
+
+/** @brief Decrement an atomic counter
+ *
+ * @note It is an error to decrement the counter beyond -(1<<23)
+ *
+ * @param atom pointer to an atomic counter */
+void _mali_osk_atomic_dec(_mali_osk_atomic_t *atom);
+
+/** @brief Decrement an atomic counter, return new value
+ *
+ * @param atom pointer to an atomic counter
+ * @return The new value, after decrement */
+u32 _mali_osk_atomic_dec_return(_mali_osk_atomic_t *atom);
+
+/** @brief Increment an atomic counter
+ *
+ * @note It is an error to increment the counter beyond (1<<23)-1
+ *
+ * @param atom pointer to an atomic counter */
+void _mali_osk_atomic_inc(_mali_osk_atomic_t *atom);
+
+/** @brief Increment an atomic counter, return new value
+ *
+ * @param atom pointer to an atomic counter */
+u32 _mali_osk_atomic_inc_return(_mali_osk_atomic_t *atom);
+
+/** @brief Initialize an atomic counter
+ *
+ * @note the parameter required is a u32, and so signed integers should be
+ * cast to u32.
+ *
+ * @param atom pointer to an atomic counter
+ * @param val the value to initialize the atomic counter.
+ */
+void _mali_osk_atomic_init(_mali_osk_atomic_t *atom, u32 val);
+
+/** @brief Read a value from an atomic counter
+ *
+ * This can only be safely used to determine the value of the counter when it
+ * is guaranteed that other threads will not be modifying the counter. This
+ * makes its usefulness limited.
+ *
+ * @param atom pointer to an atomic counter
+ */
+u32 _mali_osk_atomic_read(_mali_osk_atomic_t *atom);
+
+/** @brief Terminate an atomic counter
+ *
+ * @param atom pointer to an atomic counter
+ */
+void _mali_osk_atomic_term(_mali_osk_atomic_t *atom);
+
+/** @brief Assign a new val to atomic counter, and return the old atomic counter
+ *
+ * @param atom pointer to an atomic counter
+ * @param val the new value assign to the atomic counter
+ * @return the old value of the atomic counter
+ */
+u32 _mali_osk_atomic_xchg(_mali_osk_atomic_t *atom, u32 val);
+/** @} */  /* end group _mali_osk_atomic */
+
+
+/** @defgroup _mali_osk_memory OSK Memory Allocation
+ * @{ */
+
+/** @brief Allocate zero-initialized memory.
+ *
+ * Returns a buffer capable of containing at least \a n elements of \a size
+ * bytes each. The buffer is initialized to zero.
+ *
+ * If there is a need for a bigger block of memory (16KB or bigger), then
+ * consider to use _mali_osk_vmalloc() instead, as this function might
+ * map down to a OS function with size limitations.
+ *
+ * The buffer is suitably aligned for storage and subsequent access of every
+ * type that the compiler supports. Therefore, the pointer to the start of the
+ * buffer may be cast into any pointer type, and be subsequently accessed from
+ * such a pointer, without loss of information.
+ *
+ * When the buffer is no longer in use, it must be freed with _mali_osk_free().
+ * Failure to do so will cause a memory leak.
+ *
+ * @note Most toolchains supply memory allocation functions that meet the
+ * compiler's alignment requirements.
+ *
+ * @param n Number of elements to allocate
+ * @param size Size of each element
+ * @return On success, the zero-initialized buffer allocated. NULL on failure
+ */
+void *_mali_osk_calloc(u32 n, u32 size);
+
+/** @brief Allocate memory.
+ *
+ * Returns a buffer capable of containing at least \a size bytes. The
+ * contents of the buffer are undefined.
+ *
+ * If there is a need for a bigger block of memory (16KB or bigger), then
+ * consider to use _mali_osk_vmalloc() instead, as this function might
+ * map down to a OS function with size limitations.
+ *
+ * The buffer is suitably aligned for storage and subsequent access of every
+ * type that the compiler supports. Therefore, the pointer to the start of the
+ * buffer may be cast into any pointer type, and be subsequently accessed from
+ * such a pointer, without loss of information.
+ *
+ * When the buffer is no longer in use, it must be freed with _mali_osk_free().
+ * Failure to do so will cause a memory leak.
+ *
+ * @note Most toolchains supply memory allocation functions that meet the
+ * compiler's alignment requirements.
+ *
+ * Remember to free memory using _mali_osk_free().
+ * @param size Number of bytes to allocate
+ * @return On success, the buffer allocated. NULL on failure.
+ */
+void *_mali_osk_malloc(u32 size);
+
+/** @brief Free memory.
+ *
+ * Reclaims the buffer pointed to by the parameter \a ptr for the system.
+ * All memory returned from _mali_osk_malloc() and _mali_osk_calloc()
+ * must be freed before the application exits. Otherwise,
+ * a memory leak will occur.
+ *
+ * Memory must be freed once. It is an error to free the same non-NULL pointer
+ * more than once.
+ *
+ * It is legal to free the NULL pointer.
+ *
+ * @param ptr Pointer to buffer to free
+ */
+void _mali_osk_free(void *ptr);
+
+/** @brief Allocate memory.
+ *
+ * Returns a buffer capable of containing at least \a size bytes. The
+ * contents of the buffer are undefined.
+ *
+ * This function is potentially slower than _mali_osk_malloc() and _mali_osk_calloc(),
+ * but do support bigger sizes.
+ *
+ * The buffer is suitably aligned for storage and subsequent access of every
+ * type that the compiler supports. Therefore, the pointer to the start of the
+ * buffer may be cast into any pointer type, and be subsequently accessed from
+ * such a pointer, without loss of information.
+ *
+ * When the buffer is no longer in use, it must be freed with _mali_osk_free().
+ * Failure to do so will cause a memory leak.
+ *
+ * @note Most toolchains supply memory allocation functions that meet the
+ * compiler's alignment requirements.
+ *
+ * Remember to free memory using _mali_osk_free().
+ * @param size Number of bytes to allocate
+ * @return On success, the buffer allocated. NULL on failure.
+ */
+void *_mali_osk_valloc(u32 size);
+
+/** @brief Free memory.
+ *
+ * Reclaims the buffer pointed to by the parameter \a ptr for the system.
+ * All memory returned from _mali_osk_valloc() must be freed before the
+ * application exits. Otherwise a memory leak will occur.
+ *
+ * Memory must be freed once. It is an error to free the same non-NULL pointer
+ * more than once.
+ *
+ * It is legal to free the NULL pointer.
+ *
+ * @param ptr Pointer to buffer to free
+ */
+void _mali_osk_vfree(void *ptr);
+
+/** @brief Copies memory.
+ *
+ * Copies the \a len bytes from the buffer pointed by the parameter \a src
+ * directly to the buffer pointed by \a dst.
+ *
+ * It is an error for \a src to overlap \a dst anywhere in \a len bytes.
+ *
+ * @param dst Pointer to the destination array where the content is to be
+ * copied.
+ * @param src Pointer to the source of data to be copied.
+ * @param len Number of bytes to copy.
+ * @return \a dst is always passed through unmodified.
+ */
+void *_mali_osk_memcpy(void *dst, const void *src, u32 len);
+
+/** @brief Fills memory.
+ *
+ * Sets the first \a n bytes of the block of memory pointed to by \a s to
+ * the specified value
+ * @param s Pointer to the block of memory to fill.
+ * @param c Value to be set, passed as u32. Only the 8 Least Significant Bits (LSB)
+ * are used.
+ * @param n Number of bytes to be set to the value.
+ * @return \a s is always passed through unmodified
+ */
+void *_mali_osk_memset(void *s, u32 c, u32 n);
+/** @} */ /* end group _mali_osk_memory */
+
+
+/** @brief Checks the amount of memory allocated
+ *
+ * Checks that not more than \a max_allocated bytes are allocated.
+ *
+ * Some OS bring up an interactive out of memory dialogue when the
+ * system runs out of memory. This can stall non-interactive
+ * apps (e.g. automated test runs). This function can be used to
+ * not trigger the OOM dialogue by keeping allocations
+ * within a certain limit.
+ *
+ * @return MALI_TRUE when \a max_allocated bytes are not in use yet. MALI_FALSE
+ * when at least \a max_allocated bytes are in use.
+ */
+mali_bool _mali_osk_mem_check_allocated(u32 max_allocated);
+
+
+/** @addtogroup _mali_osk_low_level_memory
+ * @{ */
+
+/** @brief Issue a memory barrier
+ *
+ * This defines an arbitrary memory barrier operation, which forces an ordering constraint
+ * on memory read and write operations.
+ */
+void _mali_osk_mem_barrier(void);
+
+/** @brief Issue a write memory barrier
+ *
+ * This defines an write memory barrier operation which forces an ordering constraint
+ * on memory write operations.
+ */
+void _mali_osk_write_mem_barrier(void);
+
+/** @brief Map a physically contiguous region into kernel space
+ *
+ * This is primarily used for mapping in registers from resources, and Mali-MMU
+ * page tables. The mapping is only visable from kernel-space.
+ *
+ * Access has to go through _mali_osk_mem_ioread32 and _mali_osk_mem_iowrite32
+ *
+ * @param phys CPU-physical base address of the memory to map in. This must
+ * be aligned to the system's page size, which is assumed to be 4K.
+ * @param size the number of bytes of physically contiguous address space to
+ * map in
+ * @param description A textual description of the memory being mapped in.
+ * @return On success, a Mali IO address through which the mapped-in
+ * memory/registers can be accessed. NULL on failure.
+ */
+mali_io_address _mali_osk_mem_mapioregion(uintptr_t phys, u32 size, const char *description);
+
+/** @brief Unmap a physically contiguous address range from kernel space.
+ *
+ * The address range should be one previously mapped in through
+ * _mali_osk_mem_mapioregion.
+ *
+ * It is a programming error to do (but not limited to) the following:
+ * - attempt an unmap twice
+ * - unmap only part of a range obtained through _mali_osk_mem_mapioregion
+ * - unmap more than the range obtained through  _mali_osk_mem_mapioregion
+ * - unmap an address range that was not successfully mapped using
+ * _mali_osk_mem_mapioregion
+ * - provide a mapping that does not map to phys.
+ *
+ * @param phys CPU-physical base address of the memory that was originally
+ * mapped in. This must be aligned to the system's page size, which is assumed
+ * to be 4K
+ * @param size The number of bytes that were originally mapped in.
+ * @param mapping The Mali IO address through which the mapping is
+ * accessed.
+ */
+void _mali_osk_mem_unmapioregion(uintptr_t phys, u32 size, mali_io_address mapping);
+
+/** @brief Allocate and Map a physically contiguous region into kernel space
+ *
+ * This is used for allocating physically contiguous regions (such as Mali-MMU
+ * page tables) and mapping them into kernel space. The mapping is only
+ * visible from kernel-space.
+ *
+ * The alignment of the returned memory is guaranteed to be at least
+ * _MALI_OSK_CPU_PAGE_SIZE.
+ *
+ * Access must go through _mali_osk_mem_ioread32 and _mali_osk_mem_iowrite32
+ *
+ * @note This function is primarily to provide support for OSs that are
+ * incapable of separating the tasks 'allocate physically contiguous memory'
+ * and 'map it into kernel space'
+ *
+ * @param[out] phys CPU-physical base address of memory that was allocated.
+ * (*phys) will be guaranteed to be aligned to at least
+ * _MALI_OSK_CPU_PAGE_SIZE on success.
+ *
+ * @param[in] size the number of bytes of physically contiguous memory to
+ * allocate. This must be a multiple of _MALI_OSK_CPU_PAGE_SIZE.
+ *
+ * @return On success, a Mali IO address through which the mapped-in
+ * memory/registers can be accessed. NULL on failure, and (*phys) is unmodified.
+ */
+mali_io_address _mali_osk_mem_allocioregion(u32 *phys, u32 size);
+
+/** @brief Free a physically contiguous address range from kernel space.
+ *
+ * The address range should be one previously mapped in through
+ * _mali_osk_mem_allocioregion.
+ *
+ * It is a programming error to do (but not limited to) the following:
+ * - attempt a free twice on the same ioregion
+ * - free only part of a range obtained through _mali_osk_mem_allocioregion
+ * - free more than the range obtained through  _mali_osk_mem_allocioregion
+ * - free an address range that was not successfully mapped using
+ * _mali_osk_mem_allocioregion
+ * - provide a mapping that does not map to phys.
+ *
+ * @param phys CPU-physical base address of the memory that was originally
+ * mapped in, which was aligned to _MALI_OSK_CPU_PAGE_SIZE.
+ * @param size The number of bytes that were originally mapped in, which was
+ * a multiple of _MALI_OSK_CPU_PAGE_SIZE.
+ * @param mapping The Mali IO address through which the mapping is
+ * accessed.
+ */
+void _mali_osk_mem_freeioregion(u32 phys, u32 size, mali_io_address mapping);
+
+/** @brief Request a region of physically contiguous memory
+ *
+ * This is used to ensure exclusive access to a region of physically contigous
+ * memory.
+ *
+ * It is acceptable to implement this as a stub. However, it is then the job
+ * of the System Integrator to ensure that no other device driver will be using
+ * the physical address ranges used by Mali, while the Mali device driver is
+ * loaded.
+ *
+ * @param phys CPU-physical base address of the memory to request. This must
+ * be aligned to the system's page size, which is assumed to be 4K.
+ * @param size the number of bytes of physically contiguous address space to
+ * request.
+ * @param description A textual description of the memory being requested.
+ * @return _MALI_OSK_ERR_OK on success. Otherwise, a suitable
+ * _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_osk_mem_reqregion(uintptr_t phys, u32 size, const char *description);
+
+/** @brief Un-request a region of physically contiguous memory
+ *
+ * This is used to release a regious of physically contiguous memory previously
+ * requested through _mali_osk_mem_reqregion, so that other device drivers may
+ * use it. This will be called at time of Mali device driver termination.
+ *
+ * It is a programming error to attempt to:
+ * - unrequest a region twice
+ * - unrequest only part of a range obtained through _mali_osk_mem_reqregion
+ * - unrequest more than the range obtained through  _mali_osk_mem_reqregion
+ * - unrequest an address range that was not successfully requested using
+ * _mali_osk_mem_reqregion
+ *
+ * @param phys CPU-physical base address of the memory to un-request. This must
+ * be aligned to the system's page size, which is assumed to be 4K
+ * @param size the number of bytes of physically contiguous address space to
+ * un-request.
+ */
+void _mali_osk_mem_unreqregion(uintptr_t phys, u32 size);
+
+/** @brief Read from a location currently mapped in through
+ * _mali_osk_mem_mapioregion
+ *
+ * This reads a 32-bit word from a 32-bit aligned location. It is a programming
+ * error to provide unaligned locations, or to read from memory that is not
+ * mapped in, or not mapped through either _mali_osk_mem_mapioregion() or
+ * _mali_osk_mem_allocioregion().
+ *
+ * @param mapping Mali IO address to read from
+ * @param offset Byte offset from the given IO address to operate on, must be a multiple of 4
+ * @return the 32-bit word from the specified location.
+ */
+u32 _mali_osk_mem_ioread32(volatile mali_io_address mapping, u32 offset);
+
+/** @brief Write to a location currently mapped in through
+ * _mali_osk_mem_mapioregion without memory barriers
+ *
+ * This write a 32-bit word to a 32-bit aligned location without using memory barrier.
+ * It is a programming error to provide unaligned locations, or to write to memory that is not
+ * mapped in, or not mapped through either _mali_osk_mem_mapioregion() or
+ * _mali_osk_mem_allocioregion().
+ *
+ * @param mapping Mali IO address to write to
+ * @param offset Byte offset from the given IO address to operate on, must be a multiple of 4
+ * @param val the 32-bit word to write.
+ */
+void _mali_osk_mem_iowrite32_relaxed(volatile mali_io_address addr, u32 offset, u32 val);
+
+/** @brief Write to a location currently mapped in through
+ * _mali_osk_mem_mapioregion with write memory barrier
+ *
+ * This write a 32-bit word to a 32-bit aligned location. It is a programming
+ * error to provide unaligned locations, or to write to memory that is not
+ * mapped in, or not mapped through either _mali_osk_mem_mapioregion() or
+ * _mali_osk_mem_allocioregion().
+ *
+ * @param mapping Mali IO address to write to
+ * @param offset Byte offset from the given IO address to operate on, must be a multiple of 4
+ * @param val the 32-bit word to write.
+ */
+void _mali_osk_mem_iowrite32(volatile mali_io_address mapping, u32 offset, u32 val);
+
+/** @brief Flush all CPU caches
+ *
+ * This should only be implemented if flushing of the cache is required for
+ * memory mapped in through _mali_osk_mem_mapregion.
+ */
+void _mali_osk_cache_flushall(void);
+
+/** @brief Flush any caches necessary for the CPU and MALI to have the same view of a range of uncached mapped memory
+ *
+ * This should only be implemented if your OS doesn't do a full cache flush (inner & outer)
+ * after allocating uncached mapped memory.
+ *
+ * Some OS do not perform a full cache flush (including all outer caches) for uncached mapped memory.
+ * They zero the memory through a cached mapping, then flush the inner caches but not the outer caches.
+ * This is required for MALI to have the correct view of the memory.
+ */
+void _mali_osk_cache_ensure_uncached_range_flushed(void *uncached_mapping, u32 offset, u32 size);
+
+/** @brief Safely copy as much data as possible from src to dest
+ *
+ * Do not crash if src or dest isn't available.
+ *
+ * @param dest Destination buffer (limited to user space mapped Mali memory)
+ * @param src Source buffer
+ * @param size Number of bytes to copy
+ * @return Number of bytes actually copied
+ */
+u32 _mali_osk_mem_write_safe(void *dest, const void *src, u32 size);
+
+/** @} */ /* end group _mali_osk_low_level_memory */
+
+
+/** @addtogroup _mali_osk_notification
+ *
+ * User space notification framework
+ *
+ * Communication with user space of asynchronous events is performed through a
+ * synchronous call to the \ref u_k_api.
+ *
+ * Since the events are asynchronous, the events have to be queued until a
+ * synchronous U/K API call can be made by user-space. A U/K API call might also
+ * be received before any event has happened. Therefore the notifications the
+ * different subsystems wants to send to user space has to be queued for later
+ * reception, or a U/K API call has to be blocked until an event has occured.
+ *
+ * Typical uses of notifications are after running of jobs on the hardware or
+ * when changes to the system is detected that needs to be relayed to user
+ * space.
+ *
+ * After an event has occured user space has to be notified using some kind of
+ * message. The notification framework supports sending messages to waiting
+ * threads or queueing of messages until a U/K API call is made.
+ *
+ * The notification queue is a FIFO. There are no restrictions on the numbers
+ * of readers or writers in the queue.
+ *
+ * A message contains what user space needs to identifiy how to handle an
+ * event. This includes a type field and a possible type specific payload.
+ *
+ * A notification to user space is represented by a
+ * \ref _mali_osk_notification_t object. A sender gets hold of such an object
+ * using _mali_osk_notification_create(). The buffer given by the
+ * _mali_osk_notification_t::result_buffer field in the object is used to store
+ * any type specific data. The other fields are internal to the queue system
+ * and should not be touched.
+ *
+ * @{ */
+
+/** @brief Create a notification object
+ *
+ * Returns a notification object which can be added to the queue of
+ * notifications pending for user space transfer.
+ *
+ * The implementation will initialize all members of the
+ * \ref _mali_osk_notification_t object. In particular, the
+ * _mali_osk_notification_t::result_buffer member will be initialized to point
+ * to \a size bytes of storage, and that storage will be suitably aligned for
+ * storage of any structure. That is, the created buffer meets the same
+ * requirements as _mali_osk_malloc().
+ *
+ * The notification object must be deleted when not in use. Use
+ * _mali_osk_notification_delete() for deleting it.
+ *
+ * @note You \b must \b not call _mali_osk_free() on a \ref _mali_osk_notification_t,
+ * object, or on a _mali_osk_notification_t::result_buffer. You must only use
+ * _mali_osk_notification_delete() to free the resources assocaited with a
+ * \ref _mali_osk_notification_t object.
+ *
+ * @param type The notification type
+ * @param size The size of the type specific buffer to send
+ * @return Pointer to a notification object with a suitable buffer, or NULL on error.
+ */
+_mali_osk_notification_t *_mali_osk_notification_create(u32 type, u32 size);
+
+/** @brief Delete a notification object
+ *
+ * This must be called to reclaim the resources of a notification object. This
+ * includes:
+ * - The _mali_osk_notification_t::result_buffer
+ * - The \ref _mali_osk_notification_t itself.
+ *
+ * A notification object \b must \b not be used after it has been deleted by
+ * _mali_osk_notification_delete().
+ *
+ * In addition, the notification object may not be deleted while it is in a
+ * queue. That is, if it has been placed on a queue with
+ * _mali_osk_notification_queue_send(), then it must not be deleted until
+ * it has been received by a call to _mali_osk_notification_queue_receive().
+ * Otherwise, the queue may be corrupted.
+ *
+ * @param object the notification object to delete.
+ */
+void _mali_osk_notification_delete(_mali_osk_notification_t *object);
+
+/** @brief Create a notification queue
+ *
+ * Creates a notification queue which can be used to queue messages for user
+ * delivery and get queued messages from
+ *
+ * The queue is a FIFO, and has no restrictions on the numbers of readers or
+ * writers.
+ *
+ * When the queue is no longer in use, it must be terminated with
+ * \ref _mali_osk_notification_queue_term(). Failure to do so will result in a
+ * memory leak.
+ *
+ * @return Pointer to a new notification queue or NULL on error.
+ */
+_mali_osk_notification_queue_t *_mali_osk_notification_queue_init(void);
+
+/** @brief Destroy a notification queue
+ *
+ * Destroys a notification queue and frees associated resources from the queue.
+ *
+ * A notification queue \b must \b not be destroyed in the following cases:
+ * - while there are \ref _mali_osk_notification_t objects in the queue.
+ * - while there are writers currently acting upon the queue. That is, while
+ * a thread is currently calling \ref _mali_osk_notification_queue_send() on
+ * the queue, or while a thread may call
+ * \ref _mali_osk_notification_queue_send() on the queue in the future.
+ * - while there are readers currently waiting upon the queue. That is, while
+ * a thread is currently calling \ref _mali_osk_notification_queue_receive() on
+ * the queue, or while a thread may call
+ * \ref _mali_osk_notification_queue_receive() on the queue in the future.
+ *
+ * Therefore, all \ref _mali_osk_notification_t objects must be flushed and
+ * deleted by the code that makes use of the notification queues, since only
+ * they know the structure of the _mali_osk_notification_t::result_buffer
+ * (even if it may only be a flat sturcture).
+ *
+ * @note Since the queue is a FIFO, the code using notification queues may
+ * create its own 'flush' type of notification, to assist in flushing the
+ * queue.
+ *
+ * Once the queue has been destroyed, it must not be used again.
+ *
+ * @param queue The queue to destroy
+ */
+void _mali_osk_notification_queue_term(_mali_osk_notification_queue_t *queue);
+
+/** @brief Schedule notification for delivery
+ *
+ * When a \ref _mali_osk_notification_t object has been created successfully
+ * and set up, it may be added to the queue of objects waiting for user space
+ * transfer.
+ *
+ * The sending will not block if the queue is full.
+ *
+ * A \ref _mali_osk_notification_t object \b must \b not be put on two different
+ * queues at the same time, or enqueued twice onto a single queue before
+ * reception. However, it is acceptable for it to be requeued \em after reception
+ * from a call to _mali_osk_notification_queue_receive(), even onto the same queue.
+ *
+ * Again, requeuing must also not enqueue onto two different queues at the same
+ * time, or enqueue onto the same queue twice before reception.
+ *
+ * @param queue The notification queue to add this notification to
+ * @param object The entry to add
+ */
+void _mali_osk_notification_queue_send(_mali_osk_notification_queue_t *queue, _mali_osk_notification_t *object);
+
+/** @brief Receive a notification from a queue
+ *
+ * Receives a single notification from the given queue.
+ *
+ * If no notifciations are ready the thread will sleep until one becomes ready.
+ * Therefore, notifications may not be received into an
+ * IRQ or 'atomic' context (that is, a context where sleeping is disallowed).
+ *
+ * @param queue The queue to receive from
+ * @param result Pointer to storage of a pointer of type
+ * \ref _mali_osk_notification_t*. \a result will be written to such that the
+ * expression \a (*result) will evaluate to a pointer to a valid
+ * \ref _mali_osk_notification_t object, or NULL if none were received.
+ * @return _MALI_OSK_ERR_OK on success. _MALI_OSK_ERR_RESTARTSYSCALL if the sleep was interrupted.
+ */
+_mali_osk_errcode_t _mali_osk_notification_queue_receive(_mali_osk_notification_queue_t *queue, _mali_osk_notification_t **result);
+
+/** @brief Dequeues a notification from a queue
+ *
+ * Receives a single notification from the given queue.
+ *
+ * If no notifciations are ready the function call will return an error code.
+ *
+ * @param queue The queue to receive from
+ * @param result Pointer to storage of a pointer of type
+ * \ref _mali_osk_notification_t*. \a result will be written to such that the
+ * expression \a (*result) will evaluate to a pointer to a valid
+ * \ref _mali_osk_notification_t object, or NULL if none were received.
+ * @return _MALI_OSK_ERR_OK on success, _MALI_OSK_ERR_ITEM_NOT_FOUND if queue was empty.
+ */
+_mali_osk_errcode_t _mali_osk_notification_queue_dequeue(_mali_osk_notification_queue_t *queue, _mali_osk_notification_t **result);
+
+/** @} */ /* end group _mali_osk_notification */
+
+
+/** @addtogroup _mali_osk_timer
+ *
+ * Timers use the OS's representation of time, which are 'ticks'. This is to
+ * prevent aliasing problems between the internal timer time, and the time
+ * asked for.
+ *
+ * @{ */
+
+/** @brief Initialize a timer
+ *
+ * Allocates resources for a new timer, and initializes them. This does not
+ * start the timer.
+ *
+ * @return a pointer to the allocated timer object, or NULL on failure.
+ */
+_mali_osk_timer_t *_mali_osk_timer_init(void);
+
+/** @brief Start a timer
+ *
+ * It is an error to start a timer without setting the callback via
+ * _mali_osk_timer_setcallback().
+ *
+ * It is an error to use this to start an already started timer.
+ *
+ * The timer will expire in \a ticks_to_expire ticks, at which point, the
+ * callback function will be invoked with the callback-specific data,
+ * as registered by _mali_osk_timer_setcallback().
+ *
+ * @param tim the timer to start
+ * @param ticks_to_expire the amount of time in ticks for the timer to run
+ * before triggering.
+ */
+void _mali_osk_timer_add(_mali_osk_timer_t *tim, unsigned long ticks_to_expire);
+
+/** @brief Modify a timer
+ *
+ * Set the relative time at which a timer will expire, and start it if it is
+ * stopped. If \a ticks_to_expire 0 the timer fires immediately.
+ *
+ * It is an error to modify a timer without setting the callback via
+ *  _mali_osk_timer_setcallback().
+ *
+ * The timer will expire at \a ticks_to_expire from the time of the call, at
+ * which point, the callback function will be invoked with the
+ * callback-specific data, as set by _mali_osk_timer_setcallback().
+ *
+ * @param tim the timer to modify, and start if necessary
+ * @param ticks_to_expire the \em absolute time in ticks at which this timer
+ * should trigger.
+ *
+ */
+void _mali_osk_timer_mod(_mali_osk_timer_t *tim, unsigned long ticks_to_expire);
+
+/** @brief Stop a timer, and block on its completion.
+ *
+ * Stop the timer. When the function returns, it is guaranteed that the timer's
+ * callback will not be running on any CPU core.
+ *
+ * Since stoping the timer blocks on compeletion of the callback, the callback
+ * may not obtain any mutexes that the caller holds. Otherwise, a deadlock will
+ * occur.
+ *
+ * @note While the callback itself is guaranteed to not be running, work
+ * enqueued on the work-queue by the timer (with
+ * \ref _mali_osk_wq_schedule_work()) may still run. The timer callback and
+ * work handler must take this into account.
+ *
+ * It is legal to stop an already stopped timer.
+ *
+ * @param tim the timer to stop.
+ *
+ */
+void _mali_osk_timer_del(_mali_osk_timer_t *tim);
+
+/** @brief Stop a timer.
+ *
+ * Stop the timer. When the function returns, the timer's callback may still be
+ * running on any CPU core.
+ *
+ * It is legal to stop an already stopped timer.
+ *
+ * @param tim the timer to stop.
+ */
+void _mali_osk_timer_del_async(_mali_osk_timer_t *tim);
+
+/** @brief Check if timer is pending.
+ *
+ * Check if timer is active.
+ *
+ * @param tim the timer to check
+ * @return MALI_TRUE if time is active, MALI_FALSE if it is not active
+ */
+mali_bool _mali_osk_timer_pending(_mali_osk_timer_t *tim);
+
+/** @brief Set a timer's callback parameters.
+ *
+ * This must be called at least once before a timer is started/modified.
+ *
+ * After a timer has been stopped or expires, the callback remains set. This
+ * means that restarting the timer will call the same function with the same
+ * parameters on expiry.
+ *
+ * @param tim the timer to set callback on.
+ * @param callback Function to call when timer expires
+ * @param data Function-specific data to supply to the function on expiry.
+ */
+void _mali_osk_timer_setcallback(_mali_osk_timer_t *tim, _mali_osk_timer_callback_t callback, void *data);
+
+/** @brief Terminate a timer, and deallocate resources.
+ *
+ * The timer must first be stopped by calling _mali_osk_timer_del().
+ *
+ * It is a programming error for _mali_osk_timer_term() to be called on:
+ * - timer that is currently running
+ * - a timer that is currently executing its callback.
+ *
+ * @param tim the timer to deallocate.
+ */
+void _mali_osk_timer_term(_mali_osk_timer_t *tim);
+/** @} */ /* end group _mali_osk_timer */
+
+
+/** @defgroup _mali_osk_time OSK Time functions
+ *
+ * \ref _mali_osk_time use the OS's representation of time, which are
+ * 'ticks'. This is to prevent aliasing problems between the internal timer
+ * time, and the time asked for.
+ *
+ * OS tick time is measured as a u32. The time stored in a u32 may either be
+ * an absolute time, or a time delta between two events. Whilst it is valid to
+ * use math opeartors to \em change the tick value represented as a u32, it
+ * is often only meaningful to do such operations on time deltas, rather than
+ * on absolute time. However, it is meaningful to add/subtract time deltas to
+ * absolute times.
+ *
+ * Conversion between tick time and milliseconds (ms) may not be loss-less,
+ * and are \em implementation \em depenedant.
+ *
+ * Code use OS time must take this into account, since:
+ * - a small OS time may (or may not) be rounded
+ * - a large time may (or may not) overflow
+ *
+ * @{ */
+
+/** @brief Return whether ticka occurs after or at the same time as  tickb
+ *
+ * Systems where ticks can wrap must handle that.
+ *
+ * @param ticka ticka
+ * @param tickb tickb
+ * @return MALI_TRUE if ticka represents a time that occurs at or after tickb.
+ */
+mali_bool _mali_osk_time_after_eq(unsigned long ticka, unsigned long tickb);
+
+/** @brief Convert milliseconds to OS 'ticks'
+ *
+ * @param ms time interval in milliseconds
+ * @return the corresponding time interval in OS ticks.
+ */
+unsigned long _mali_osk_time_mstoticks(u32 ms);
+
+/** @brief Convert OS 'ticks' to milliseconds
+ *
+ * @param ticks time interval in OS ticks.
+ * @return the corresponding time interval in milliseconds
+ */
+u32 _mali_osk_time_tickstoms(unsigned long ticks);
+
+
+/** @brief Get the current time in OS 'ticks'.
+ * @return the current time in OS 'ticks'.
+ */
+unsigned long _mali_osk_time_tickcount(void);
+
+/** @brief Cause a microsecond delay
+ *
+ * The delay will have microsecond resolution, and is necessary for correct
+ * operation of the driver. At worst, the delay will be \b at least \a usecs
+ * microseconds, and so may be (significantly) more.
+ *
+ * This function may be implemented as a busy-wait, which is the most sensible
+ * implementation. On OSs where there are situations in which a thread must not
+ * sleep, this is definitely implemented as a busy-wait.
+ *
+ * @param usecs the number of microseconds to wait for.
+ */
+void _mali_osk_time_ubusydelay(u32 usecs);
+
+/** @brief Return time in nano seconds, since any given reference.
+ *
+ * @return Time in nano seconds
+ */
+u64 _mali_osk_time_get_ns(void);
+
+/** @brief Return time in nano seconds, since boot time.
+ *
+ * @return Time in nano seconds
+ */
+u64 _mali_osk_boot_time_get_ns(void);
+
+/** @} */ /* end group _mali_osk_time */
+
+/** @defgroup _mali_osk_math OSK Math
+ * @{ */
+
+/** @brief Count Leading Zeros (Little-endian)
+ *
+ * @note This function must be implemented to support the reference
+ * implementation of _mali_osk_find_first_zero_bit, as defined in
+ * mali_osk_bitops.h.
+ *
+ * @param val 32-bit words to count leading zeros on
+ * @return the number of leading zeros.
+ */
+u32 _mali_osk_clz(u32 val);
+
+/** @brief find last (most-significant) bit set
+ *
+ * @param val 32-bit words to count last bit set on
+ * @return last bit set.
+ */
+u32 _mali_osk_fls(u32 val);
+
+/** @} */ /* end group _mali_osk_math */
+
+/** @addtogroup _mali_osk_wait_queue OSK Wait Queue functionality
+ * @{ */
+
+/** @brief Initialize an empty Wait Queue */
+_mali_osk_wait_queue_t *_mali_osk_wait_queue_init(void);
+
+/** @brief Sleep if condition is false
+ *
+ * @param queue the queue to use
+ * @param condition function pointer to a boolean function
+ * @param data data parameter for condition function
+ *
+ * Put thread to sleep if the given \a condition function returns false. When
+ * being asked to wake up again, the condition will be re-checked and the
+ * thread only woken up if the condition is now true.
+ */
+void _mali_osk_wait_queue_wait_event(_mali_osk_wait_queue_t *queue, mali_bool(*condition)(void *), void *data);
+
+/** @brief Sleep if condition is false
+ *
+ * @param queue the queue to use
+ * @param condition function pointer to a boolean function
+ * @param data data parameter for condition function
+ * @param timeout timeout in ms
+ *
+ * Put thread to sleep if the given \a condition function returns false. When
+ * being asked to wake up again, the condition will be re-checked and the
+ * thread only woken up if the condition is now true.  Will return if time
+ * exceeds timeout.
+ */
+void _mali_osk_wait_queue_wait_event_timeout(_mali_osk_wait_queue_t *queue, mali_bool(*condition)(void *), void *data, u32 timeout);
+
+/** @brief Wake up all threads in wait queue if their respective conditions are
+ * true
+ *
+ * @param queue the queue whose threads should be woken up
+ *
+ * Wake up all threads in wait queue \a queue whose condition is now true.
+ */
+void _mali_osk_wait_queue_wake_up(_mali_osk_wait_queue_t *queue);
+
+/** @brief terminate a wait queue
+ *
+ * @param queue the queue to terminate.
+ */
+void _mali_osk_wait_queue_term(_mali_osk_wait_queue_t *queue);
+/** @} */ /* end group _mali_osk_wait_queue */
+
+
+/** @addtogroup _mali_osk_miscellaneous
+ * @{ */
+
+/** @brief Output a device driver debug message.
+ *
+ * The interpretation of \a fmt is the same as the \c format parameter in
+ * _mali_osu_vsnprintf().
+ *
+ * @param fmt a _mali_osu_vsnprintf() style format string
+ * @param ... a variable-number of parameters suitable for \a fmt
+ */
+void _mali_osk_dbgmsg(const char *fmt, ...);
+
+/** @brief Print fmt into buf.
+ *
+ * The interpretation of \a fmt is the same as the \c format parameter in
+ * _mali_osu_vsnprintf().
+ *
+ * @param buf a pointer to the result buffer
+ * @param size the total number of bytes allowed to write to \a buf
+ * @param fmt a _mali_osu_vsnprintf() style format string
+ * @param ... a variable-number of parameters suitable for \a fmt
+ * @return The number of bytes written to \a buf
+ */
+u32 _mali_osk_snprintf(char *buf, u32 size, const char *fmt, ...);
+
+/** @brief Abnormal process abort.
+ *
+ * Terminates the caller-process if this function is called.
+ *
+ * This function will be called from Debug assert-macros in mali_kernel_common.h.
+ *
+ * This function will never return - because to continue from a Debug assert
+ * could cause even more problems, and hinder debugging of the initial problem.
+ *
+ * This function is only used in Debug builds, and is not used in Release builds.
+ */
+void _mali_osk_abort(void);
+
+/** @brief Sets breakpoint at point where function is called.
+ *
+ * This function will be called from Debug assert-macros in mali_kernel_common.h,
+ * to assist in debugging. If debugging at this level is not required, then this
+ * function may be implemented as a stub.
+ *
+ * This function is only used in Debug builds, and is not used in Release builds.
+ */
+void _mali_osk_break(void);
+
+/** @brief Return an identificator for calling process.
+ *
+ * @return Identificator for calling process.
+ */
+u32 _mali_osk_get_pid(void);
+
+/** @brief Return an name for calling process.
+ *
+ * @return name for calling process.
+ */
+char *_mali_osk_get_comm(void);
+
+/** @brief Return an identificator for calling thread.
+ *
+ * @return Identificator for calling thread.
+ */
+u32 _mali_osk_get_tid(void);
+
+
+/** @brief Take a reference to the power manager system for the Mali device (synchronously).
+ *
+ * When function returns successfully, Mali is ON.
+ *
+ * @note Call \a _mali_osk_pm_dev_ref_put() to release this reference.
+ */
+_mali_osk_errcode_t _mali_osk_pm_dev_ref_get_sync(void);
+
+/** @brief Take a reference to the external power manager system for the Mali device (asynchronously).
+ *
+ * Mali might not yet be on after this function as returned.
+ * Please use \a _mali_osk_pm_dev_barrier() or \a _mali_osk_pm_dev_ref_get_sync()
+ * to wait for Mali to be powered on.
+ *
+ * @note Call \a _mali_osk_pm_dev_ref_dec() to release this reference.
+ */
+_mali_osk_errcode_t _mali_osk_pm_dev_ref_get_async(void);
+
+/** @brief Release the reference to the external power manger system for the Mali device.
+ *
+ * When reference count reach zero, the cores can be off.
+ *
+ * @note This must be used to release references taken with
+ * \a _mali_osk_pm_dev_ref_get_sync() or \a _mali_osk_pm_dev_ref_get_sync().
+ */
+void _mali_osk_pm_dev_ref_put(void);
+
+/** @brief Block until pending PM operations are done
+ */
+void _mali_osk_pm_dev_barrier(void);
+
+/** @} */ /* end group  _mali_osk_miscellaneous */
+
+/** @defgroup _mali_osk_bitmap OSK Bitmap
+ * @{ */
+
+/** @brief Allocate a unique number from the bitmap object.
+ *
+ * @param bitmap Initialized bitmap object.
+ * @return An unique existence in the bitmap object.
+ */
+u32 _mali_osk_bitmap_alloc(struct _mali_osk_bitmap *bitmap);
+
+/** @brief Free a interger to the bitmap object.
+ *
+ * @param bitmap Initialized bitmap object.
+ * @param obj An number allocated from bitmap object.
+ */
+void _mali_osk_bitmap_free(struct _mali_osk_bitmap *bitmap, u32 obj);
+
+/** @brief Allocate continuous number from the bitmap object.
+ *
+ * @param bitmap Initialized bitmap object.
+ * @return start number of the continuous number block.
+ */
+u32 _mali_osk_bitmap_alloc_range(struct _mali_osk_bitmap *bitmap, int cnt);
+
+/** @brief Free a block of continuous number block to the bitmap object.
+ *
+ * @param bitmap Initialized bitmap object.
+ * @param obj Start number.
+ * @param cnt The size of the continuous number block.
+ */
+void _mali_osk_bitmap_free_range(struct _mali_osk_bitmap *bitmap, u32 obj, int cnt);
+
+/** @brief Available count could be used to allocate in the given bitmap object.
+ *
+ */
+u32 _mali_osk_bitmap_avail(struct _mali_osk_bitmap *bitmap);
+
+/** @brief Initialize an bitmap object..
+ *
+ * @param bitmap An poiter of uninitialized bitmap object.
+ * @param num Size of thei bitmap object and decide the memory size allocated.
+ * @param reserve start number used to allocate.
+ */
+int _mali_osk_bitmap_init(struct _mali_osk_bitmap *bitmap, u32 num, u32 reserve);
+
+/** @brief Free the given bitmap object.
+ *
+ * @param bitmap Initialized bitmap object.
+ */
+void _mali_osk_bitmap_term(struct _mali_osk_bitmap *bitmap);
+/** @} */ /* end group  _mali_osk_bitmap */
+
+/** @} */ /* end group osuapi */
+
+/** @} */ /* end group uddapi */
+
+
+
+#ifdef __cplusplus
+}
+#endif
+
+/* Check standard inlines */
+#ifndef MALI_STATIC_INLINE
+#error MALI_STATIC_INLINE not defined on your OS
+#endif
+
+#ifndef MALI_NON_STATIC_INLINE
+#error MALI_NON_STATIC_INLINE not defined on your OS
+#endif
+
+#endif /* __MALI_OSK_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_osk_list.h b/drivers/gpu/arm/mali400/common/mali_osk_list.h
--- a/drivers/gpu/arm/mali400/common/mali_osk_list.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_osk_list.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_list.h
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#ifndef __MALI_OSK_LIST_H__
+#define __MALI_OSK_LIST_H__
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+MALI_STATIC_INLINE void __mali_osk_list_add(_mali_osk_list_t *new_entry, _mali_osk_list_t *prev, _mali_osk_list_t *next)
+{
+	next->prev = new_entry;
+	new_entry->next = next;
+	new_entry->prev = prev;
+	prev->next = new_entry;
+}
+
+MALI_STATIC_INLINE void __mali_osk_list_del(_mali_osk_list_t *prev, _mali_osk_list_t *next)
+{
+	next->prev = prev;
+	prev->next = next;
+}
+
+/** @addtogroup _mali_osk_list OSK Doubly-Linked Circular Lists
+ * @{ */
+
+/** Reference implementations of Doubly-linked Circular Lists are provided.
+ * There is often no need to re-implement these.
+ *
+ * @note The implementation may differ subtly from any lists the OS provides.
+ * For this reason, these lists should not be mixed with OS-specific lists
+ * inside the OSK/UKK implementation. */
+
+/** @brief Initialize a list to be a head of an empty list
+ * @param exp the list to initialize. */
+#define _MALI_OSK_INIT_LIST_HEAD(exp) _mali_osk_list_init(exp)
+
+/** @brief Define a list variable, which is uninitialized.
+ * @param exp the name of the variable that the list will be defined as. */
+#define _MALI_OSK_LIST_HEAD(exp) _mali_osk_list_t exp
+
+/** @brief Define a list variable, which is initialized.
+ * @param exp the name of the variable that the list will be defined as. */
+#define _MALI_OSK_LIST_HEAD_STATIC_INIT(exp) _mali_osk_list_t exp = { &exp, &exp }
+
+/** @brief Initialize a list element.
+ *
+ * All list elements must be initialized before use.
+ *
+ * Do not use on any list element that is present in a list without using
+ * _mali_osk_list_del first, otherwise this will break the list.
+ *
+ * @param list the list element to initialize
+ */
+MALI_STATIC_INLINE void _mali_osk_list_init(_mali_osk_list_t *list)
+{
+	list->next = list;
+	list->prev = list;
+}
+
+/** @brief Insert a single list element after an entry in a list
+ *
+ * As an example, if this is inserted to the head of a list, then this becomes
+ * the first element of the list.
+ *
+ * Do not use to move list elements from one list to another, as it will break
+ * the originating list.
+ *
+ *
+ * @param newlist the list element to insert
+ * @param list the list in which to insert. The new element will be the next
+ * entry in this list
+ */
+MALI_STATIC_INLINE void _mali_osk_list_add(_mali_osk_list_t *new_entry, _mali_osk_list_t *list)
+{
+	__mali_osk_list_add(new_entry, list, list->next);
+}
+
+/** @brief Insert a single list element before an entry in a list
+ *
+ * As an example, if this is inserted to the head of a list, then this becomes
+ * the last element of the list.
+ *
+ * Do not use to move list elements from one list to another, as it will break
+ * the originating list.
+ *
+ * @param newlist the list element to insert
+ * @param list the list in which to insert. The new element will be the previous
+ * entry in this list
+ */
+MALI_STATIC_INLINE void _mali_osk_list_addtail(_mali_osk_list_t *new_entry, _mali_osk_list_t *list)
+{
+	__mali_osk_list_add(new_entry, list->prev, list);
+}
+
+/** @brief Remove a single element from a list
+ *
+ * The element will no longer be present in the list. The removed list element
+ * will be uninitialized, and so should not be traversed. It must be
+ * initialized before further use.
+ *
+ * @param list the list element to remove.
+ */
+MALI_STATIC_INLINE void _mali_osk_list_del(_mali_osk_list_t *list)
+{
+	__mali_osk_list_del(list->prev, list->next);
+}
+
+/** @brief Remove a single element from a list, and re-initialize it
+ *
+ * The element will no longer be present in the list. The removed list element
+ * will initialized, and so can be used as normal.
+ *
+ * @param list the list element to remove and initialize.
+ */
+MALI_STATIC_INLINE void _mali_osk_list_delinit(_mali_osk_list_t *list)
+{
+	__mali_osk_list_del(list->prev, list->next);
+	_mali_osk_list_init(list);
+}
+
+/** @brief Determine whether a list is empty.
+ *
+ * An empty list is one that contains a single element that points to itself.
+ *
+ * @param list the list to check.
+ * @return non-zero if the list is empty, and zero otherwise.
+ */
+MALI_STATIC_INLINE mali_bool _mali_osk_list_empty(_mali_osk_list_t *list)
+{
+	return list->next == list;
+}
+
+/** @brief Move a list element from one list to another.
+ *
+ * The list element must be initialized.
+ *
+ * As an example, moving a list item to the head of a new list causes this item
+ * to be the first element in the new list.
+ *
+ * @param move the list element to move
+ * @param list the new list into which the element will be inserted, as the next
+ * element in the list.
+ */
+MALI_STATIC_INLINE void _mali_osk_list_move(_mali_osk_list_t *move_entry, _mali_osk_list_t *list)
+{
+	__mali_osk_list_del(move_entry->prev, move_entry->next);
+	_mali_osk_list_add(move_entry, list);
+}
+
+/** @brief Move an entire list
+ *
+ * The list element must be initialized.
+ *
+ * Allows you to move a list from one list head to another list head
+ *
+ * @param old_list The existing list head
+ * @param new_list The new list head (must be an empty list)
+ */
+MALI_STATIC_INLINE void _mali_osk_list_move_list(_mali_osk_list_t *old_list, _mali_osk_list_t *new_list)
+{
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(new_list));
+	if (!_mali_osk_list_empty(old_list)) {
+		new_list->next = old_list->next;
+		new_list->prev = old_list->prev;
+		new_list->next->prev = new_list;
+		new_list->prev->next = new_list;
+		old_list->next = old_list;
+		old_list->prev = old_list;
+	}
+}
+
+/** @brief Find the containing structure of a list
+ *
+ * When traversing a list, this is used to recover the containing structure,
+ * given that is contains a _mali_osk_list_t member.
+ *
+ * Each list must be of structures of one type, and must link the same members
+ * together, otherwise it will not be possible to correctly recover the
+ * sturctures that the lists link.
+ *
+ * @note no type or memory checking occurs to ensure that a structure does in
+ * fact exist for the list entry, and that it is being recovered with respect
+ * to the correct list member.
+ *
+ * @param ptr the pointer to the _mali_osk_list_t member in this structure
+ * @param type the type of the structure that contains the member
+ * @param member the member of the structure that ptr points to.
+ * @return a pointer to a \a type object which contains the _mali_osk_list_t
+ * \a member, as pointed to by the _mali_osk_list_t \a *ptr.
+ */
+#define _MALI_OSK_LIST_ENTRY(ptr, type, member) \
+	_MALI_OSK_CONTAINER_OF(ptr, type, member)
+
+/** @brief Enumerate a list safely
+ *
+ * With this macro, lists can be enumerated in a 'safe' manner. That is,
+ * entries can be deleted from the list without causing an error during
+ * enumeration. To achieve this, a 'temporary' pointer is required, which must
+ * be provided to the macro.
+ *
+ * Use it like a 'for()', 'while()' or 'do()' construct, and so it must be
+ * followed by a statement or compound-statement which will be executed for
+ * each list entry.
+ *
+ * Upon loop completion, providing that an early out was not taken in the
+ * loop body, then it is guaranteed that ptr->member == list, even if the loop
+ * body never executed.
+ *
+ * @param ptr a pointer to an object of type 'type', which points to the
+ * structure that contains the currently enumerated list entry.
+ * @param tmp a pointer to an object of type 'type', which must not be used
+ * inside the list-execution statement.
+ * @param list a pointer to a _mali_osk_list_t, from which enumeration will
+ * begin
+ * @param type the type of the structure that contains the _mali_osk_list_t
+ * member that is part of the list to be enumerated.
+ * @param member the _mali_osk_list_t member of the structure that is part of
+ * the list to be enumerated.
+ */
+#define _MALI_OSK_LIST_FOREACHENTRY(ptr, tmp, list, type, member)         \
+	for (ptr = _MALI_OSK_LIST_ENTRY((list)->next, type, member),      \
+	     tmp = _MALI_OSK_LIST_ENTRY(ptr->member.next, type, member);  \
+	     &ptr->member != (list);                                      \
+	     ptr = tmp,                                                   \
+	     tmp = _MALI_OSK_LIST_ENTRY(tmp->member.next, type, member))
+
+/** @brief Enumerate a list in reverse order safely
+ *
+ * This macro is identical to @ref _MALI_OSK_LIST_FOREACHENTRY, except that
+ * entries are enumerated in reverse order.
+ *
+ * @param ptr a pointer to an object of type 'type', which points to the
+ * structure that contains the currently enumerated list entry.
+ * @param tmp a pointer to an object of type 'type', which must not be used
+ * inside the list-execution statement.
+ * @param list a pointer to a _mali_osk_list_t, from which enumeration will
+ * begin
+ * @param type the type of the structure that contains the _mali_osk_list_t
+ * member that is part of the list to be enumerated.
+ * @param member the _mali_osk_list_t member of the structure that is part of
+ * the list to be enumerated.
+ */
+#define _MALI_OSK_LIST_FOREACHENTRY_REVERSE(ptr, tmp, list, type, member) \
+	for (ptr = _MALI_OSK_LIST_ENTRY((list)->prev, type, member),      \
+	     tmp = _MALI_OSK_LIST_ENTRY(ptr->member.prev, type, member);  \
+	     &ptr->member != (list);                                      \
+	     ptr = tmp,                                                   \
+	     tmp = _MALI_OSK_LIST_ENTRY(tmp->member.prev, type, member))
+
+/** @} */ /* end group _mali_osk_list */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_OSK_LIST_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_osk_mali.h b/drivers/gpu/arm/mali400/common/mali_osk_mali.h
--- a/drivers/gpu/arm/mali400/common/mali_osk_mali.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_osk_mali.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_mali.h
+ * Defines the OS abstraction layer which is specific for the Mali kernel device driver (OSK)
+ */
+
+#ifndef __MALI_OSK_MALI_H__
+#define __MALI_OSK_MALI_H__
+
+#include <linux/mali/mali_utgard.h>
+#include <mali_osk.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef CONFIG_MALI_DEVFREQ
+struct mali_device {
+	struct device *dev;
+#ifdef CONFIG_HAVE_CLK
+	struct clk *clock;
+#endif
+#ifdef CONFIG_REGULATOR
+	struct regulator *regulator;
+#endif
+#ifdef CONFIG_PM_DEVFREQ
+	struct devfreq_dev_profile devfreq_profile;
+	struct devfreq *devfreq;
+	unsigned long current_freq;
+	unsigned long current_voltage;
+#ifdef CONFIG_DEVFREQ_THERMAL
+	struct thermal_cooling_device *devfreq_cooling;
+#endif
+#endif
+	struct mali_pm_metrics_data mali_metrics;
+};
+#endif
+
+/** @addtogroup _mali_osk_miscellaneous
+ * @{ */
+
+/** @brief Struct with device specific configuration data
+ */
+typedef struct mali_gpu_device_data _mali_osk_device_data;
+
+#ifdef CONFIG_MALI_DT
+/** @brief Initialize those device resources when we use device tree
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_resource_initialize(void);
+#endif
+
+/** @brief Find Mali GPU HW resource
+ *
+ * @param addr Address of Mali GPU resource to find
+ * @param res Storage for resource information if resource is found.
+ * @return _MALI_OSK_ERR_OK on success, _MALI_OSK_ERR_ITEM_NOT_FOUND if resource is not found
+ */
+_mali_osk_errcode_t _mali_osk_resource_find(u32 addr, _mali_osk_resource_t *res);
+
+
+/** @brief Find Mali GPU HW base address
+ *
+ * @return 0 if resources are found, otherwise the Mali GPU component with lowest address.
+ */
+uintptr_t _mali_osk_resource_base_address(void);
+
+/** @brief Find the specific GPU resource.
+ *
+ * @return value
+ * 0x400 if Mali 400 specific GPU resource identified
+ * 0x450 if Mali 450 specific GPU resource identified
+ * 0x470 if Mali 470 specific GPU resource identified
+ *
+ */
+u32 _mali_osk_identify_gpu_resource(void);
+
+/** @brief Retrieve the Mali GPU specific data
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_device_data_get(_mali_osk_device_data *data);
+
+/** @brief Find the pmu domain config from device data.
+ *
+ * @param domain_config_array used to store pmu domain config found in device data.
+ * @param array_size is the size of array domain_config_array.
+ */
+void _mali_osk_device_data_pmu_config_get(u16 *domain_config_array, int array_size);
+
+/** @brief Get Mali PMU switch delay
+ *
+ *@return pmu switch delay if it is configured
+ */
+u32 _mali_osk_get_pmu_switch_delay(void);
+
+/** @brief Determines if Mali GPU has been configured with shared interrupts.
+ *
+ * @return MALI_TRUE if shared interrupts, MALI_FALSE if not.
+ */
+mali_bool _mali_osk_shared_interrupts(void);
+
+/** @brief Initialize the gpu secure mode.
+ * The gpu secure mode will initially be in a disabled state.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_gpu_secure_mode_init(void);
+
+/** @brief Deinitialize the gpu secure mode.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_gpu_secure_mode_deinit(void);
+
+/** @brief Reset GPU and enable the gpu secure mode.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_gpu_reset_and_secure_mode_enable(void);
+
+/** @brief Reset GPU and disable the gpu secure mode.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_gpu_reset_and_secure_mode_disable(void);
+
+/** @brief Check if the gpu secure mode has been enabled.
+ * @return MALI_TRUE if enabled, otherwise MALI_FALSE.
+ */
+mali_bool _mali_osk_gpu_secure_mode_is_enabled(void);
+
+/** @brief Check if the gpu secure mode is supported.
+ * @return MALI_TRUE if supported, otherwise MALI_FALSE.
+ */
+mali_bool _mali_osk_gpu_secure_mode_is_supported(void);
+
+
+/** @} */ /* end group _mali_osk_miscellaneous */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_OSK_MALI_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_osk_profiling.h b/drivers/gpu/arm/mali400/common/mali_osk_profiling.h
--- a/drivers/gpu/arm/mali400/common/mali_osk_profiling.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_osk_profiling.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_OSK_PROFILING_H__
+#define __MALI_OSK_PROFILING_H__
+
+#if defined(CONFIG_MALI400_PROFILING) && defined (CONFIG_TRACEPOINTS)
+
+#include "mali_linux_trace.h"
+#include "mali_profiling_events.h"
+#include "mali_profiling_gator_api.h"
+
+#define MALI_PROFILING_MAX_BUFFER_ENTRIES 1048576
+
+#define MALI_PROFILING_NO_HW_COUNTER = ((u32)-1)
+
+/** @defgroup _mali_osk_profiling External profiling connectivity
+ * @{ */
+
+/**
+ * Initialize the profiling module.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_profiling_init(mali_bool auto_start);
+
+/*
+ * Terminate the profiling module.
+ */
+void _mali_osk_profiling_term(void);
+
+/**
+ * Stop the profile sampling operation.
+ */
+void _mali_osk_profiling_stop_sampling(u32 pid);
+
+/**
+ * Start recording profiling data
+ *
+ * The specified limit will determine how large the capture buffer is.
+ * MALI_PROFILING_MAX_BUFFER_ENTRIES determines the maximum size allowed by the device driver.
+ *
+ * @param limit The desired maximum number of events to record on input, the actual maximum on output.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_profiling_start(u32 *limit);
+
+/**
+ * Add an profiling event
+ *
+ * @param event_id The event identificator.
+ * @param data0 First data parameter, depending on event_id specified.
+ * @param data1 Second data parameter, depending on event_id specified.
+ * @param data2 Third data parameter, depending on event_id specified.
+ * @param data3 Fourth data parameter, depending on event_id specified.
+ * @param data4 Fifth data parameter, depending on event_id specified.
+ */
+void    _mali_osk_profiling_add_event(u32 event_id, u32 data0, u32 data1, u32 data2, u32 data3, u32 data4);
+
+/**
+ * Report a hardware counter event.
+ *
+ * @param counter_id The ID of the counter.
+ * @param value The value of the counter.
+ */
+
+/* Call Linux tracepoint directly */
+#define _mali_osk_profiling_report_hw_counter(counter_id, value) trace_mali_hw_counter(counter_id, value)
+
+/**
+ * Report SW counters
+ *
+ * @param counters array of counter values
+ */
+void _mali_osk_profiling_report_sw_counters(u32 *counters);
+
+void _mali_osk_profiling_record_global_counters(int counter_id, u32 value);
+
+/**
+ * Stop recording profiling data
+ *
+ * @param count Returns the number of recorded events.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_profiling_stop(u32 *count);
+
+/**
+ * Retrieves the number of events that can be retrieved
+ *
+ * @return The number of recorded events that can be retrieved.
+ */
+u32 _mali_osk_profiling_get_count(void);
+
+/**
+ * Retrieve an event
+ *
+ * @param index Event index (start with 0 and continue until this function fails to retrieve all events)
+ * @param timestamp The timestamp for the retrieved event will be stored here.
+ * @param event_id The event ID for the retrieved event will be stored here.
+ * @param data The 5 data values for the retrieved event will be stored here.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_profiling_get_event(u32 index, u64 *timestamp, u32 *event_id, u32 data[5]);
+
+/**
+ * Clear the recorded buffer.
+ *
+ * This is needed in order to start another recording.
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t _mali_osk_profiling_clear(void);
+
+/**
+ * Checks if a recording of profiling data is in progress
+ *
+ * @return MALI_TRUE if recording of profiling data is in progress, MALI_FALSE if not
+ */
+mali_bool _mali_osk_profiling_is_recording(void);
+
+/**
+ * Checks if profiling data is available for retrival
+ *
+ * @return MALI_TRUE if profiling data is avaiable, MALI_FALSE if not
+ */
+mali_bool _mali_osk_profiling_have_recording(void);
+
+/** @} */ /* end group _mali_osk_profiling */
+
+#else /* defined(CONFIG_MALI400_PROFILING)  && defined(CONFIG_TRACEPOINTS) */
+
+/* Dummy add_event, for when profiling is disabled. */
+
+#define _mali_osk_profiling_add_event(event_id, data0, data1, data2, data3, data4)
+
+#endif /* defined(CONFIG_MALI400_PROFILING)  && defined(CONFIG_TRACEPOINTS) */
+
+#endif /* __MALI_OSK_PROFILING_H__ */
+
+
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_osk_types.h b/drivers/gpu/arm/mali400/common/mali_osk_types.h
--- a/drivers/gpu/arm/mali400/common/mali_osk_types.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_osk_types.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,471 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_types.h
+ * Defines types of the OS abstraction layer for the kernel device driver (OSK)
+ */
+
+#ifndef __MALI_OSK_TYPES_H__
+#define __MALI_OSK_TYPES_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @addtogroup uddapi Unified Device Driver (UDD) APIs
+ *
+ * @{
+ */
+
+/**
+ * @addtogroup oskapi UDD OS Abstraction for Kernel-side (OSK) APIs
+ *
+ * @{
+ */
+
+/** @defgroup _mali_osk_miscellaneous OSK Miscellaneous functions, constants and types
+ * @{ */
+
+/* Define integer types used by OSK. Note: these currently clash with Linux so we only define them if not defined already */
+#ifndef __KERNEL__
+typedef unsigned char      u8;
+typedef signed char        s8;
+typedef unsigned short     u16;
+typedef signed short       s16;
+typedef unsigned int       u32;
+typedef signed int         s32;
+typedef unsigned long long u64;
+#define BITS_PER_LONG (sizeof(long)*8)
+#else
+/* Ensure Linux types u32, etc. are defined */
+#include <linux/types.h>
+#endif
+
+/** @brief Mali Boolean type which uses MALI_TRUE and MALI_FALSE
+  */
+typedef unsigned long mali_bool;
+
+#ifndef MALI_TRUE
+#define MALI_TRUE ((mali_bool)1)
+#endif
+
+#ifndef MALI_FALSE
+#define MALI_FALSE ((mali_bool)0)
+#endif
+
+#define MALI_HW_CORE_NO_COUNTER     ((u32)-1)
+
+
+#define MALI_S32_MAX 0x7fffffff
+
+/**
+ * @brief OSK Error codes
+ *
+ * Each OS may use its own set of error codes, and may require that the
+ * User/Kernel interface take certain error code. This means that the common
+ * error codes need to be sufficiently rich to pass the correct error code
+ * thorugh from the OSK to U/K layer, across all OSs.
+ *
+ * The result is that some error codes will appear redundant on some OSs.
+ * Under all OSs, the OSK layer must translate native OS error codes to
+ * _mali_osk_errcode_t codes. Similarly, the U/K layer must translate from
+ * _mali_osk_errcode_t codes to native OS error codes.
+ */
+typedef enum {
+	_MALI_OSK_ERR_OK = 0, /**< Success. */
+	_MALI_OSK_ERR_FAULT = -1, /**< General non-success */
+	_MALI_OSK_ERR_INVALID_FUNC = -2, /**< Invalid function requested through User/Kernel interface (e.g. bad IOCTL number) */
+	_MALI_OSK_ERR_INVALID_ARGS = -3, /**< Invalid arguments passed through User/Kernel interface */
+	_MALI_OSK_ERR_NOMEM = -4, /**< Insufficient memory */
+	_MALI_OSK_ERR_TIMEOUT = -5, /**< Timeout occurred */
+	_MALI_OSK_ERR_RESTARTSYSCALL = -6, /**< Special: On certain OSs, must report when an interruptable mutex is interrupted. Ignore otherwise. */
+	_MALI_OSK_ERR_ITEM_NOT_FOUND = -7, /**< Table Lookup failed */
+	_MALI_OSK_ERR_BUSY = -8, /**< Device/operation is busy. Try again later */
+	_MALI_OSK_ERR_UNSUPPORTED = -9, /**< Optional part of the interface used, and is unsupported */
+} _mali_osk_errcode_t;
+
+/** @} */ /* end group _mali_osk_miscellaneous */
+
+/** @defgroup _mali_osk_wq OSK work queues
+ * @{ */
+
+/** @brief Private type for work objects */
+typedef struct _mali_osk_wq_work_s _mali_osk_wq_work_t;
+typedef struct _mali_osk_wq_delayed_work_s _mali_osk_wq_delayed_work_t;
+
+/** @brief Work queue handler function
+ *
+ * This function type is called when the work is scheduled by the work queue,
+ * e.g. as an IRQ bottom-half handler.
+ *
+ * Refer to \ref _mali_osk_wq_schedule_work() for more information on the
+ * work-queue and work handlers.
+ *
+ * @param arg resource-specific data
+ */
+typedef void (*_mali_osk_wq_work_handler_t)(void *arg);
+
+/* @} */ /* end group _mali_osk_wq */
+
+/** @defgroup _mali_osk_irq OSK IRQ handling
+ * @{ */
+
+/** @brief Private type for IRQ handling objects */
+typedef struct _mali_osk_irq_t_struct _mali_osk_irq_t;
+
+/** @brief Optional function to trigger an irq from a resource
+ *
+ * This function is implemented by the common layer to allow probing of a resource's IRQ.
+ * @param arg resource-specific data */
+typedef void (*_mali_osk_irq_trigger_t)(void *arg);
+
+/** @brief Optional function to acknowledge an irq from a resource
+ *
+ * This function is implemented by the common layer to allow probing of a resource's IRQ.
+ * @param arg resource-specific data
+ * @return _MALI_OSK_ERR_OK if the IRQ was successful, or a suitable _mali_osk_errcode_t on failure. */
+typedef _mali_osk_errcode_t (*_mali_osk_irq_ack_t)(void *arg);
+
+/** @brief IRQ 'upper-half' handler callback.
+ *
+ * This function is implemented by the common layer to do the initial handling of a
+ * resource's IRQ. This maps on to the concept of an ISR that does the minimum
+ * work necessary before handing off to an IST.
+ *
+ * The communication of the resource-specific data from the ISR to the IST is
+ * handled by the OSK implementation.
+ *
+ * On most systems, the IRQ upper-half handler executes in IRQ context.
+ * Therefore, the system may have restrictions about what can be done in this
+ * context
+ *
+ * If an IRQ upper-half handler requires more work to be done than can be
+ * acheived in an IRQ context, then it may defer the work with
+ * _mali_osk_wq_schedule_work(). Refer to \ref _mali_osk_wq_create_work() for
+ * more information.
+ *
+ * @param arg resource-specific data
+ * @return _MALI_OSK_ERR_OK if the IRQ was correctly handled, or a suitable
+ * _mali_osk_errcode_t otherwise.
+ */
+typedef _mali_osk_errcode_t (*_mali_osk_irq_uhandler_t)(void *arg);
+
+
+/** @} */ /* end group _mali_osk_irq */
+
+
+/** @defgroup _mali_osk_atomic OSK Atomic counters
+ * @{ */
+
+/** @brief Public type of atomic counters
+ *
+ * This is public for allocation on stack. On systems that support it, this is just a single 32-bit value.
+ * On others, it could be encapsulating an object stored elsewhere.
+ *
+ * Regardless of implementation, the \ref _mali_osk_atomic functions \b must be used
+ * for all accesses to the variable's value, even if atomicity is not required.
+ * Do not access u.val or u.obj directly.
+ */
+typedef struct {
+	union {
+		u32 val;
+		void *obj;
+	} u;
+} _mali_osk_atomic_t;
+/** @} */ /* end group _mali_osk_atomic */
+
+
+/** @defgroup _mali_osk_lock OSK Mutual Exclusion Locks
+ * @{ */
+
+
+/** @brief OSK Mutual Exclusion Lock ordered list
+ *
+ * This lists the various types of locks in the system and is used to check
+ * that locks are taken in the correct order.
+ *
+ * - Holding more than one lock of the same order at the same time is not
+ *   allowed.
+ * - Taking a lock of a lower order than the highest-order lock currently held
+ *   is not allowed.
+ *
+ */
+typedef enum {
+	/*  ||    Locks    ||  */
+	/*  ||   must be   ||  */
+	/* _||_  taken in _||_ */
+	/* \  /    this   \  / */
+	/*  \/    order!   \/  */
+
+	_MALI_OSK_LOCK_ORDER_FIRST = 0,
+
+	_MALI_OSK_LOCK_ORDER_SESSIONS,
+	_MALI_OSK_LOCK_ORDER_MEM_SESSION,
+	_MALI_OSK_LOCK_ORDER_MEM_INFO,
+	_MALI_OSK_LOCK_ORDER_MEM_PT_CACHE,
+	_MALI_OSK_LOCK_ORDER_DESCRIPTOR_MAP,
+	_MALI_OSK_LOCK_ORDER_PM_EXECUTION,
+	_MALI_OSK_LOCK_ORDER_EXECUTOR,
+	_MALI_OSK_LOCK_ORDER_TIMELINE_SYSTEM,
+	_MALI_OSK_LOCK_ORDER_SCHEDULER,
+	_MALI_OSK_LOCK_ORDER_SCHEDULER_DEFERRED,
+	_MALI_OSK_LOCK_ORDER_PROFILING,
+	_MALI_OSK_LOCK_ORDER_L2,
+	_MALI_OSK_LOCK_ORDER_L2_COMMAND,
+	_MALI_OSK_LOCK_ORDER_UTILIZATION,
+	_MALI_OSK_LOCK_ORDER_SESSION_PENDING_JOBS,
+	_MALI_OSK_LOCK_ORDER_PM_STATE,
+
+	_MALI_OSK_LOCK_ORDER_LAST,
+} _mali_osk_lock_order_t;
+
+
+/** @brief OSK Mutual Exclusion Lock flags type
+ *
+ * - Any lock can use the order parameter.
+ */
+typedef enum {
+	_MALI_OSK_LOCKFLAG_UNORDERED        = 0x1, /**< Indicate that the order of this lock should not be checked */
+	_MALI_OSK_LOCKFLAG_ORDERED          = 0x2,
+	/** @enum _mali_osk_lock_flags_t
+	 *
+	 * Flags from 0x10000--0x80000000 are RESERVED for User-mode */
+
+} _mali_osk_lock_flags_t;
+
+/** @brief Mutual Exclusion Lock Mode Optimization hint
+ *
+ * The lock mode is used to implement the read/write locking of locks when we call
+ * functions _mali_osk_mutex_rw_init/wait/signal/term/. In this case, the RO mode can
+ * be used to allow multiple concurrent readers, but no writers. The RW mode is used for
+ * writers, and so will wait for all readers to release the lock (if any present).
+ * Further readers and writers will wait until the writer releases the lock.
+ *
+ * The mode is purely an optimization hint: for example, it is permissible for
+ * all locks to behave in RW mode, regardless of that supplied.
+ *
+ * It is an error to attempt to use locks in anything other that RW mode when
+ * call functions _mali_osk_mutex_rw_wait/signal().
+ *
+ */
+typedef enum {
+	_MALI_OSK_LOCKMODE_UNDEF = -1,  /**< Undefined lock mode. For internal use only */
+	_MALI_OSK_LOCKMODE_RW    = 0x0, /**< Read-write mode, default. All readers and writers are mutually-exclusive */
+	_MALI_OSK_LOCKMODE_RO,          /**< Read-only mode, to support multiple concurrent readers, but mutual exclusion in the presence of writers. */
+	/** @enum _mali_osk_lock_mode_t
+	 *
+	 * Lock modes 0x40--0x7F are RESERVED for User-mode */
+} _mali_osk_lock_mode_t;
+
+/** @brief Private types for Mutual Exclusion lock objects */
+typedef struct _mali_osk_lock_debug_s _mali_osk_lock_debug_t;
+typedef struct _mali_osk_spinlock_s _mali_osk_spinlock_t;
+typedef struct _mali_osk_spinlock_irq_s _mali_osk_spinlock_irq_t;
+typedef struct _mali_osk_mutex_s _mali_osk_mutex_t;
+typedef struct _mali_osk_mutex_rw_s _mali_osk_mutex_rw_t;
+
+/** @} */ /* end group _mali_osk_lock */
+
+/** @defgroup _mali_osk_low_level_memory OSK Low-level Memory Operations
+ * @{ */
+
+/**
+ * @brief Private data type for use in IO accesses to/from devices.
+ *
+ * This represents some range that is accessible from the device. Examples
+ * include:
+ * - Device Registers, which could be readable and/or writeable.
+ * - Memory that the device has access to, for storing configuration structures.
+ *
+ * Access to this range must be made through the _mali_osk_mem_ioread32() and
+ * _mali_osk_mem_iowrite32() functions.
+ */
+typedef struct _mali_io_address *mali_io_address;
+
+/** @defgroup _MALI_OSK_CPU_PAGE CPU Physical page size macros.
+ *
+ * The order of the page size is supplied for
+ * ease of use by algorithms that might require it, since it is easier to know
+ * it ahead of time rather than calculating it.
+ *
+ * The Mali Page Mask macro masks off the lower bits of a physical address to
+ * give the start address of the page for that physical address.
+ *
+ * @note The Mali device driver code is designed for systems with 4KB page size.
+ * Changing these macros will not make the entire Mali device driver work with
+ * page sizes other than 4KB.
+ *
+ * @note The CPU Physical Page Size has been assumed to be the same as the Mali
+ * Physical Page Size.
+ *
+ * @{
+ */
+
+/** CPU Page Order, as log to base 2 of the Page size. @see _MALI_OSK_CPU_PAGE_SIZE */
+#define _MALI_OSK_CPU_PAGE_ORDER ((u32)12)
+/** CPU Page Size, in bytes.               */
+#define _MALI_OSK_CPU_PAGE_SIZE (((u32)1) << (_MALI_OSK_CPU_PAGE_ORDER))
+/** CPU Page Mask, which masks off the offset within a page */
+#define _MALI_OSK_CPU_PAGE_MASK (~((((u32)1) << (_MALI_OSK_CPU_PAGE_ORDER)) - ((u32)1)))
+/** @} */ /* end of group _MALI_OSK_CPU_PAGE */
+
+/** @defgroup _MALI_OSK_MALI_PAGE Mali Physical Page size macros
+ *
+ * Mali Physical page size macros. The order of the page size is supplied for
+ * ease of use by algorithms that might require it, since it is easier to know
+ * it ahead of time rather than calculating it.
+ *
+ * The Mali Page Mask macro masks off the lower bits of a physical address to
+ * give the start address of the page for that physical address.
+ *
+ * @note The Mali device driver code is designed for systems with 4KB page size.
+ * Changing these macros will not make the entire Mali device driver work with
+ * page sizes other than 4KB.
+ *
+ * @note The Mali Physical Page Size has been assumed to be the same as the CPU
+ * Physical Page Size.
+ *
+ * @{
+ */
+
+/** Mali Page Order, as log to base 2 of the Page size. @see _MALI_OSK_MALI_PAGE_SIZE */
+#define _MALI_OSK_MALI_PAGE_ORDER PAGE_SHIFT
+/** Mali Page Size, in bytes.               */
+#define _MALI_OSK_MALI_PAGE_SIZE PAGE_SIZE
+/** Mali Page Mask, which masks off the offset within a page */
+#define _MALI_OSK_MALI_PAGE_MASK PAGE_MASK
+/** @} */ /* end of group _MALI_OSK_MALI_PAGE*/
+
+/** @brief flags for mapping a user-accessible memory range
+ *
+ * Where a function with prefix '_mali_osk_mem_mapregion' accepts flags as one
+ * of the function parameters, it will use one of these. These allow per-page
+ * control over mappings. Compare with the mali_memory_allocation_flag type,
+ * which acts over an entire range
+ *
+ * These may be OR'd together with bitwise OR (|), but must be cast back into
+ * the type after OR'ing.
+ */
+typedef enum {
+	_MALI_OSK_MEM_MAPREGION_FLAG_OS_ALLOCATED_PHYSADDR = 0x1, /**< Physical address is OS Allocated */
+} _mali_osk_mem_mapregion_flags_t;
+/** @} */ /* end group _mali_osk_low_level_memory */
+
+/** @defgroup _mali_osk_notification OSK Notification Queues
+ * @{ */
+
+/** @brief Private type for notification queue objects */
+typedef struct _mali_osk_notification_queue_t_struct _mali_osk_notification_queue_t;
+
+/** @brief Public notification data object type */
+typedef struct _mali_osk_notification_t_struct {
+	u32 notification_type;   /**< The notification type */
+	u32 result_buffer_size; /**< Size of the result buffer to copy to user space */
+	void *result_buffer;    /**< Buffer containing any type specific data */
+} _mali_osk_notification_t;
+
+/** @} */ /* end group _mali_osk_notification */
+
+
+/** @defgroup _mali_osk_timer OSK Timer Callbacks
+ * @{ */
+
+/** @brief Function to call when a timer expires
+ *
+ * When a timer expires, this function is called. Note that on many systems,
+ * a timer callback will be executed in IRQ context. Therefore, restrictions
+ * may apply on what can be done inside the timer callback.
+ *
+ * If a timer requires more work to be done than can be acheived in an IRQ
+ * context, then it may defer the work with a work-queue. For example, it may
+ * use \ref _mali_osk_wq_schedule_work() to make use of a bottom-half handler
+ * to carry out the remaining work.
+ *
+ * Stopping the timer with \ref _mali_osk_timer_del() blocks on compeletion of
+ * the callback. Therefore, the callback may not obtain any mutexes also held
+ * by any callers of _mali_osk_timer_del(). Otherwise, a deadlock may occur.
+ *
+ * @param arg Function-specific data */
+typedef void (*_mali_osk_timer_callback_t)(void *arg);
+
+/** @brief Private type for Timer Callback Objects */
+typedef struct _mali_osk_timer_t_struct _mali_osk_timer_t;
+/** @} */ /* end group _mali_osk_timer */
+
+
+/** @addtogroup _mali_osk_list OSK Doubly-Linked Circular Lists
+ * @{ */
+
+/** @brief Public List objects.
+ *
+ * To use, add a _mali_osk_list_t member to the structure that may become part
+ * of a list. When traversing the _mali_osk_list_t objects, use the
+ * _MALI_OSK_CONTAINER_OF() macro to recover the structure from its
+ *_mali_osk_list_t member
+ *
+ * Each structure may have multiple _mali_osk_list_t members, so that the
+ * structure is part of multiple lists. When traversing lists, ensure that the
+ * correct _mali_osk_list_t member is used, because type-checking will be
+ * lost by the compiler.
+ */
+typedef struct _mali_osk_list_s {
+	struct _mali_osk_list_s *next;
+	struct _mali_osk_list_s *prev;
+} _mali_osk_list_t;
+/** @} */ /* end group _mali_osk_list */
+
+/** @addtogroup _mali_osk_miscellaneous
+ * @{ */
+
+/** @brief resource description struct
+ *
+ * Platform independent representation of a Mali HW resource
+ */
+typedef struct _mali_osk_resource {
+	const char *description;        /**< short description of the resource */
+	uintptr_t base;                 /**< Physical base address of the resource, as seen by Mali resources. */
+	const char *irq_name;           /**< Name of irq belong to this resource */
+	u32 irq;                        /**< IRQ number delivered to the CPU, or -1 to tell the driver to probe for it (if possible) */
+} _mali_osk_resource_t;
+/** @} */ /* end group _mali_osk_miscellaneous */
+
+/** @defgroup _mali_osk_wait_queue OSK Wait Queue functionality
+ * @{ */
+/** @brief Private type for wait queue objects */
+typedef struct _mali_osk_wait_queue_t_struct _mali_osk_wait_queue_t;
+/** @} */ /* end group _mali_osk_wait_queue */
+
+/** @} */ /* end group osuapi */
+
+/** @} */ /* end group uddapi */
+
+/** @brief Mali print ctx type which uses seq_file
+  */
+typedef struct seq_file _mali_osk_print_ctx;
+
+#define _MALI_OSK_BITMAP_INVALIDATE_INDEX -1
+
+typedef struct _mali_osk_bitmap {
+	u32         reserve;
+	u32         last;
+	u32         max;
+	u32         avail;
+	_mali_osk_spinlock_t   *lock;
+	unsigned long          *table;
+} _mali_osk_bitmap_t;
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_OSK_TYPES_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pm.c b/drivers/gpu/arm/mali400/common/mali_pm.c
--- a/drivers/gpu/arm/mali400/common/mali_pm.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pm.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1362 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_pm.h"
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_scheduler.h"
+#include "mali_group.h"
+#include "mali_pm_domain.h"
+#include "mali_pmu.h"
+
+#include "mali_executor.h"
+#include "mali_control_timer.h"
+
+#if defined(DEBUG)
+u32 num_pm_runtime_resume = 0;
+u32 num_pm_updates = 0;
+u32 num_pm_updates_up = 0;
+u32 num_pm_updates_down = 0;
+#endif
+
+#define MALI_PM_DOMAIN_DUMMY_MASK (1 << MALI_DOMAIN_INDEX_DUMMY)
+
+/* lock protecting power state (including pm_domains) */
+static _mali_osk_spinlock_irq_t *pm_lock_state = NULL;
+
+/* the wanted domain mask (protected by pm_lock_state) */
+static u32 pd_mask_wanted = 0;
+
+/* used to deferring the actual power changes */
+static _mali_osk_wq_work_t *pm_work = NULL;
+
+/* lock protecting power change execution */
+static _mali_osk_mutex_t *pm_lock_exec = NULL;
+
+/* PMU domains which are actually powered on (protected by pm_lock_exec) */
+static u32 pmu_mask_current = 0;
+
+/*
+ * domains which marked as powered on (protected by pm_lock_exec)
+ * This can be different from pmu_mask_current right after GPU power on
+ * if the PMU domains default to powered up.
+ */
+static u32 pd_mask_current = 0;
+
+static u16 domain_config[MALI_MAX_NUMBER_OF_DOMAINS] = {
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	1 << MALI_DOMAIN_INDEX_DUMMY
+};
+
+/* The relative core power cost */
+#define MALI_GP_COST 3
+#define MALI_PP_COST 6
+#define MALI_L2_COST 1
+
+/*
+ *We have MALI_MAX_NUMBER_OF_PP_PHYSICAL_CORES + 1 rows in this matrix
+ *because we mush store the mask of different pp cores: 0, 1, 2, 3, 4, 5, 6, 7, 8.
+ */
+static int mali_pm_domain_power_cost_result[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS + 1][MALI_MAX_NUMBER_OF_DOMAINS];
+/*
+ * Keep track of runtime PM state, so that we know
+ * how to resume during OS resume.
+ */
+#ifdef CONFIG_PM_RUNTIME
+static mali_bool mali_pm_runtime_active = MALI_FALSE;
+#else
+/* when kernel don't enable PM_RUNTIME, set the flag always true,
+ * for GPU will not power off by runtime */
+static mali_bool mali_pm_runtime_active = MALI_TRUE;
+#endif
+
+static void mali_pm_state_lock(void);
+static void mali_pm_state_unlock(void);
+static _mali_osk_errcode_t mali_pm_create_pm_domains(void);
+static void mali_pm_set_pmu_domain_config(void);
+static u32 mali_pm_get_registered_cores_mask(void);
+static void mali_pm_update_sync_internal(void);
+static mali_bool mali_pm_common_suspend(void);
+static void mali_pm_update_work(void *data);
+#if defined(DEBUG)
+const char *mali_pm_mask_to_string(u32 mask);
+const char *mali_pm_group_stats_to_string(void);
+#endif
+
+_mali_osk_errcode_t mali_pm_initialize(void)
+{
+	_mali_osk_errcode_t err;
+	struct mali_pmu_core *pmu;
+
+	pm_lock_state = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_ORDERED,
+			_MALI_OSK_LOCK_ORDER_PM_STATE);
+	if (NULL == pm_lock_state) {
+		mali_pm_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	pm_lock_exec = _mali_osk_mutex_init(_MALI_OSK_LOCKFLAG_ORDERED,
+					    _MALI_OSK_LOCK_ORDER_PM_STATE);
+	if (NULL == pm_lock_exec) {
+		mali_pm_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	pm_work = _mali_osk_wq_create_work(mali_pm_update_work, NULL);
+	if (NULL == pm_work) {
+		mali_pm_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	pmu = mali_pmu_get_global_pmu_core();
+	if (NULL != pmu) {
+		/*
+		 * We have a Mali PMU, set the correct domain
+		 * configuration (default or custom)
+		 */
+
+		u32 registered_cores_mask;
+
+		mali_pm_set_pmu_domain_config();
+
+		registered_cores_mask = mali_pm_get_registered_cores_mask();
+		mali_pmu_set_registered_cores_mask(pmu, registered_cores_mask);
+
+		MALI_DEBUG_ASSERT(0 == pd_mask_wanted);
+	}
+
+	/* Create all power domains needed (at least one dummy domain) */
+	err = mali_pm_create_pm_domains();
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_pm_terminate();
+		return err;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_pm_terminate(void)
+{
+	if (NULL != pm_work) {
+		_mali_osk_wq_delete_work(pm_work);
+		pm_work = NULL;
+	}
+
+	mali_pm_domain_terminate();
+
+	if (NULL != pm_lock_exec) {
+		_mali_osk_mutex_term(pm_lock_exec);
+		pm_lock_exec = NULL;
+	}
+
+	if (NULL != pm_lock_state) {
+		_mali_osk_spinlock_irq_term(pm_lock_state);
+		pm_lock_state = NULL;
+	}
+}
+
+struct mali_pm_domain *mali_pm_register_l2_cache(u32 domain_index,
+		struct mali_l2_cache_core *l2_cache)
+{
+	struct mali_pm_domain *domain;
+
+	domain = mali_pm_domain_get_from_mask(domain_config[domain_index]);
+	if (NULL == domain) {
+		MALI_DEBUG_ASSERT(0 == domain_config[domain_index]);
+		domain = mali_pm_domain_get_from_index(
+				 MALI_DOMAIN_INDEX_DUMMY);
+		domain_config[domain_index] = MALI_PM_DOMAIN_DUMMY_MASK;
+	} else {
+		MALI_DEBUG_ASSERT(0 != domain_config[domain_index]);
+	}
+
+	MALI_DEBUG_ASSERT(NULL != domain);
+
+	mali_pm_domain_add_l2_cache(domain, l2_cache);
+
+	return domain; /* return the actual domain this was registered in */
+}
+
+struct mali_pm_domain *mali_pm_register_group(u32 domain_index,
+		struct mali_group *group)
+{
+	struct mali_pm_domain *domain;
+
+	domain = mali_pm_domain_get_from_mask(domain_config[domain_index]);
+	if (NULL == domain) {
+		MALI_DEBUG_ASSERT(0 == domain_config[domain_index]);
+		domain = mali_pm_domain_get_from_index(
+				 MALI_DOMAIN_INDEX_DUMMY);
+		domain_config[domain_index] = MALI_PM_DOMAIN_DUMMY_MASK;
+	} else {
+		MALI_DEBUG_ASSERT(0 != domain_config[domain_index]);
+	}
+
+	MALI_DEBUG_ASSERT(NULL != domain);
+
+	mali_pm_domain_add_group(domain, group);
+
+	return domain; /* return the actual domain this was registered in */
+}
+
+mali_bool mali_pm_get_domain_refs(struct mali_pm_domain **domains,
+				  struct mali_group **groups,
+				  u32 num_domains)
+{
+	mali_bool ret = MALI_TRUE; /* Assume all is powered on instantly */
+	u32 i;
+
+	mali_pm_state_lock();
+
+	for (i = 0; i < num_domains; i++) {
+		MALI_DEBUG_ASSERT_POINTER(domains[i]);
+		pd_mask_wanted |= mali_pm_domain_ref_get(domains[i]);
+		if (MALI_FALSE == mali_pm_domain_power_is_on(domains[i])) {
+			/*
+			 * Tell caller that the corresponding group
+			 * was not already powered on.
+			 */
+			ret = MALI_FALSE;
+		} else {
+			/*
+			 * There is a time gap between we power on the domain and
+			 * set the power state of the corresponding groups to be on.
+			 */
+			if (NULL != groups[i] &&
+			    MALI_FALSE == mali_group_power_is_on(groups[i])) {
+				ret = MALI_FALSE;
+			}
+		}
+	}
+
+	MALI_DEBUG_PRINT(3, ("PM: wanted domain mask = 0x%08X (get refs)\n", pd_mask_wanted));
+
+	mali_pm_state_unlock();
+
+	return ret;
+}
+
+mali_bool mali_pm_put_domain_refs(struct mali_pm_domain **domains,
+				  u32 num_domains)
+{
+	u32 mask = 0;
+	mali_bool ret;
+	u32 i;
+
+	mali_pm_state_lock();
+
+	for (i = 0; i < num_domains; i++) {
+		MALI_DEBUG_ASSERT_POINTER(domains[i]);
+		mask |= mali_pm_domain_ref_put(domains[i]);
+	}
+
+	if (0 == mask) {
+		/* return false, all domains should still stay on */
+		ret = MALI_FALSE;
+	} else {
+		/* Assert that we are dealing with a change */
+		MALI_DEBUG_ASSERT((pd_mask_wanted & mask) == mask);
+
+		/* Update our desired domain mask */
+		pd_mask_wanted &= ~mask;
+
+		/* return true; one or more domains can now be powered down */
+		ret = MALI_TRUE;
+	}
+
+	MALI_DEBUG_PRINT(3, ("PM: wanted domain mask = 0x%08X (put refs)\n", pd_mask_wanted));
+
+	mali_pm_state_unlock();
+
+	return ret;
+}
+
+void mali_pm_init_begin(void)
+{
+	struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+
+	_mali_osk_pm_dev_ref_get_sync();
+
+	/* Ensure all PMU domains are on */
+	if (NULL != pmu) {
+		mali_pmu_power_up_all(pmu);
+	}
+}
+
+void mali_pm_init_end(void)
+{
+	struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+
+	/* Ensure all PMU domains are off */
+	if (NULL != pmu) {
+		mali_pmu_power_down_all(pmu);
+	}
+
+	_mali_osk_pm_dev_ref_put();
+}
+
+void mali_pm_update_sync(void)
+{
+	mali_pm_exec_lock();
+
+	if (MALI_TRUE == mali_pm_runtime_active) {
+		/*
+		 * Only update if GPU is powered on.
+		 * Deactivation of the last group will result in both a
+		 * deferred runtime PM suspend operation and
+		 * deferred execution of this function.
+		 * mali_pm_runtime_active will be false if runtime PM
+		 * executed first and thus the GPU is now fully powered off.
+		 */
+		mali_pm_update_sync_internal();
+	}
+
+	mali_pm_exec_unlock();
+}
+
+void mali_pm_update_async(void)
+{
+	_mali_osk_wq_schedule_work(pm_work);
+}
+
+void mali_pm_os_suspend(mali_bool os_suspend)
+{
+	int ret;
+
+	MALI_DEBUG_PRINT(3, ("Mali PM: OS suspend\n"));
+
+	/* Suspend execution of all jobs, and go to inactive state */
+	mali_executor_suspend();
+
+	if (os_suspend) {
+		mali_control_timer_suspend(MALI_TRUE);
+	}
+
+	mali_pm_exec_lock();
+
+	ret = mali_pm_common_suspend();
+
+	MALI_DEBUG_ASSERT(MALI_TRUE == ret);
+	MALI_IGNORE(ret);
+
+	mali_pm_exec_unlock();
+}
+
+void mali_pm_os_resume(void)
+{
+	struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+
+	MALI_DEBUG_PRINT(3, ("Mali PM: OS resume\n"));
+
+	mali_pm_exec_lock();
+
+#if defined(DEBUG)
+	mali_pm_state_lock();
+
+	/* Assert that things are as we left them in os_suspend(). */
+	MALI_DEBUG_ASSERT(0 == pd_mask_wanted);
+	MALI_DEBUG_ASSERT(0 == pd_mask_current);
+	MALI_DEBUG_ASSERT(0 == pmu_mask_current);
+
+	MALI_DEBUG_ASSERT(MALI_TRUE == mali_pm_domain_all_unused());
+
+	mali_pm_state_unlock();
+#endif
+
+	if (MALI_TRUE == mali_pm_runtime_active) {
+		/* Runtime PM was active, so reset PMU */
+		if (NULL != pmu) {
+			mali_pmu_reset(pmu);
+			pmu_mask_current = mali_pmu_get_mask(pmu);
+
+			MALI_DEBUG_PRINT(3, ("Mali PM: OS resume 0x%x \n", pmu_mask_current));
+		}
+
+		mali_pm_update_sync_internal();
+	}
+
+	mali_pm_exec_unlock();
+
+	/* Start executing jobs again */
+	mali_executor_resume();
+}
+
+mali_bool mali_pm_runtime_suspend(void)
+{
+	mali_bool ret;
+
+	MALI_DEBUG_PRINT(3, ("Mali PM: Runtime suspend\n"));
+
+	mali_pm_exec_lock();
+
+	/*
+	 * Put SW state directly into "off" state, and do not bother to power
+	 * down each power domain, because entire GPU will be powered off
+	 * when we return.
+	 * For runtime PM suspend, in contrast to OS suspend, there is a race
+	 * between this function and the mali_pm_update_sync_internal(), which
+	 * is fine...
+	 */
+	ret = mali_pm_common_suspend();
+	if (MALI_TRUE == ret) {
+		mali_pm_runtime_active = MALI_FALSE;
+	} else {
+		/*
+		 * Process the "power up" instead,
+		 * which could have been "lost"
+		 */
+		mali_pm_update_sync_internal();
+	}
+
+	mali_pm_exec_unlock();
+
+	return ret;
+}
+
+void mali_pm_runtime_resume(void)
+{
+	struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+
+	mali_pm_exec_lock();
+
+	mali_pm_runtime_active = MALI_TRUE;
+
+#if defined(DEBUG)
+	++num_pm_runtime_resume;
+
+	mali_pm_state_lock();
+
+	/*
+	 * Assert that things are as we left them in runtime_suspend(),
+	 * except for pd_mask_wanted which normally will be the reason we
+	 * got here (job queued => domains wanted)
+	 */
+	MALI_DEBUG_ASSERT(0 == pd_mask_current);
+	MALI_DEBUG_ASSERT(0 == pmu_mask_current);
+
+	mali_pm_state_unlock();
+#endif
+
+	if (NULL != pmu) {
+		mali_pmu_reset(pmu);
+		pmu_mask_current = mali_pmu_get_mask(pmu);
+		MALI_DEBUG_PRINT(3, ("Mali PM: Runtime resume 0x%x \n", pmu_mask_current));
+	}
+
+	/*
+	 * Normally we are resumed because a job has just been queued.
+	 * pd_mask_wanted should thus be != 0.
+	 * It is however possible for others to take a Mali Runtime PM ref
+	 * without having a job queued.
+	 * We should however always call mali_pm_update_sync_internal(),
+	 * because this will take care of any potential mismatch between
+	 * pmu_mask_current and pd_mask_current.
+	 */
+	mali_pm_update_sync_internal();
+
+	mali_pm_exec_unlock();
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_pm_dump_state_domain(struct mali_pm_domain *domain,
+			      char *buf, u32 size)
+{
+	int n = 0;
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tPower domain: id %u\n",
+				mali_pm_domain_get_id(domain));
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\t\tMask: 0x%04x\n",
+				mali_pm_domain_get_mask(domain));
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\t\tUse count: %u\n",
+				mali_pm_domain_get_use_count(domain));
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\t\tCurrent power state: %s\n",
+				(mali_pm_domain_get_mask(domain) & pd_mask_current) ?
+				"On" : "Off");
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\t\tWanted power state: %s\n",
+				(mali_pm_domain_get_mask(domain) & pd_mask_wanted) ?
+				"On" : "Off");
+
+	return n;
+}
+#endif
+
+static void mali_pm_state_lock(void)
+{
+	_mali_osk_spinlock_irq_lock(pm_lock_state);
+}
+
+static void mali_pm_state_unlock(void)
+{
+	_mali_osk_spinlock_irq_unlock(pm_lock_state);
+}
+
+void mali_pm_exec_lock(void)
+{
+	_mali_osk_mutex_wait(pm_lock_exec);
+}
+
+void mali_pm_exec_unlock(void)
+{
+	_mali_osk_mutex_signal(pm_lock_exec);
+}
+
+static void mali_pm_domain_power_up(u32 power_up_mask,
+				    struct mali_group *groups_up[MALI_MAX_NUMBER_OF_GROUPS],
+				    u32 *num_groups_up,
+				    struct mali_l2_cache_core *l2_up[MALI_MAX_NUMBER_OF_L2_CACHE_CORES],
+				    u32 *num_l2_up)
+{
+	u32 domain_bit;
+	u32 notify_mask = power_up_mask;
+
+	MALI_DEBUG_ASSERT(0 != power_up_mask);
+	MALI_DEBUG_ASSERT_POINTER(groups_up);
+	MALI_DEBUG_ASSERT_POINTER(num_groups_up);
+	MALI_DEBUG_ASSERT(0 == *num_groups_up);
+	MALI_DEBUG_ASSERT_POINTER(l2_up);
+	MALI_DEBUG_ASSERT_POINTER(num_l2_up);
+	MALI_DEBUG_ASSERT(0 == *num_l2_up);
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_exec);
+	MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_state);
+
+	MALI_DEBUG_PRINT(5,
+			 ("PM update:      Powering up domains: . [%s]\n",
+			  mali_pm_mask_to_string(power_up_mask)));
+
+	pd_mask_current |= power_up_mask;
+
+	domain_bit = _mali_osk_fls(notify_mask);
+	while (0 != domain_bit) {
+		u32 domain_id = domain_bit - 1;
+		struct mali_pm_domain *domain =
+			mali_pm_domain_get_from_index(
+				domain_id);
+		struct mali_l2_cache_core *l2_cache;
+		struct mali_l2_cache_core *l2_cache_tmp;
+		struct mali_group *group;
+		struct mali_group *group_tmp;
+
+		/* Mark domain as powered up */
+		mali_pm_domain_set_power_on(domain, MALI_TRUE);
+
+		/*
+		 * Make a note of the L2 and/or group(s) to notify
+		 * (need to release the PM state lock before doing so)
+		 */
+
+		_MALI_OSK_LIST_FOREACHENTRY(l2_cache,
+					    l2_cache_tmp,
+					    mali_pm_domain_get_l2_cache_list(
+						    domain),
+					    struct mali_l2_cache_core,
+					    pm_domain_list) {
+			MALI_DEBUG_ASSERT(*num_l2_up <
+					  MALI_MAX_NUMBER_OF_L2_CACHE_CORES);
+			l2_up[*num_l2_up] = l2_cache;
+			(*num_l2_up)++;
+		}
+
+		_MALI_OSK_LIST_FOREACHENTRY(group,
+					    group_tmp,
+					    mali_pm_domain_get_group_list(domain),
+					    struct mali_group,
+					    pm_domain_list) {
+			MALI_DEBUG_ASSERT(*num_groups_up <
+					  MALI_MAX_NUMBER_OF_GROUPS);
+			groups_up[*num_groups_up] = group;
+
+			(*num_groups_up)++;
+		}
+
+		/* Remove current bit and find next */
+		notify_mask &= ~(1 << (domain_id));
+		domain_bit = _mali_osk_fls(notify_mask);
+	}
+}
+static void mali_pm_domain_power_down(u32 power_down_mask,
+				      struct mali_group *groups_down[MALI_MAX_NUMBER_OF_GROUPS],
+				      u32 *num_groups_down,
+				      struct mali_l2_cache_core *l2_down[MALI_MAX_NUMBER_OF_L2_CACHE_CORES],
+				      u32 *num_l2_down)
+{
+	u32 domain_bit;
+	u32 notify_mask = power_down_mask;
+
+	MALI_DEBUG_ASSERT(0 != power_down_mask);
+	MALI_DEBUG_ASSERT_POINTER(groups_down);
+	MALI_DEBUG_ASSERT_POINTER(num_groups_down);
+	MALI_DEBUG_ASSERT(0 == *num_groups_down);
+	MALI_DEBUG_ASSERT_POINTER(l2_down);
+	MALI_DEBUG_ASSERT_POINTER(num_l2_down);
+	MALI_DEBUG_ASSERT(0 == *num_l2_down);
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_exec);
+	MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_state);
+
+	MALI_DEBUG_PRINT(5,
+			 ("PM update:      Powering down domains: [%s]\n",
+			  mali_pm_mask_to_string(power_down_mask)));
+
+	pd_mask_current &= ~power_down_mask;
+
+	domain_bit = _mali_osk_fls(notify_mask);
+	while (0 != domain_bit) {
+		u32 domain_id = domain_bit - 1;
+		struct mali_pm_domain *domain =
+			mali_pm_domain_get_from_index(domain_id);
+		struct mali_l2_cache_core *l2_cache;
+		struct mali_l2_cache_core *l2_cache_tmp;
+		struct mali_group *group;
+		struct mali_group *group_tmp;
+
+		/* Mark domain as powered down */
+		mali_pm_domain_set_power_on(domain, MALI_FALSE);
+
+		/*
+		 * Make a note of the L2s and/or groups to notify
+		 * (need to release the PM state lock before doing so)
+		 */
+
+		_MALI_OSK_LIST_FOREACHENTRY(l2_cache,
+					    l2_cache_tmp,
+					    mali_pm_domain_get_l2_cache_list(domain),
+					    struct mali_l2_cache_core,
+					    pm_domain_list) {
+			MALI_DEBUG_ASSERT(*num_l2_down <
+					  MALI_MAX_NUMBER_OF_L2_CACHE_CORES);
+			l2_down[*num_l2_down] = l2_cache;
+			(*num_l2_down)++;
+		}
+
+		_MALI_OSK_LIST_FOREACHENTRY(group,
+					    group_tmp,
+					    mali_pm_domain_get_group_list(domain),
+					    struct mali_group,
+					    pm_domain_list) {
+			MALI_DEBUG_ASSERT(*num_groups_down <
+					  MALI_MAX_NUMBER_OF_GROUPS);
+			groups_down[*num_groups_down] = group;
+			(*num_groups_down)++;
+		}
+
+		/* Remove current bit and find next */
+		notify_mask &= ~(1 << (domain_id));
+		domain_bit = _mali_osk_fls(notify_mask);
+	}
+}
+
+/*
+ * Execute pending power domain changes
+ * pm_lock_exec lock must be taken by caller.
+ */
+static void mali_pm_update_sync_internal(void)
+{
+	/*
+	 * This should only be called in non-atomic context
+	 * (normally as deferred work)
+	 *
+	 * Look at the pending power domain changes, and execute these.
+	 * Make sure group and schedulers are notified about changes.
+	 */
+
+	struct mali_pmu_core *pmu = mali_pmu_get_global_pmu_core();
+
+	u32 power_down_mask;
+	u32 power_up_mask;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_exec);
+
+#if defined(DEBUG)
+	++num_pm_updates;
+#endif
+
+	/* Hold PM state lock while we look at (and obey) the wanted state */
+	mali_pm_state_lock();
+
+	MALI_DEBUG_PRINT(5, ("PM update pre:  Wanted domain mask: .. [%s]\n",
+			     mali_pm_mask_to_string(pd_mask_wanted)));
+	MALI_DEBUG_PRINT(5, ("PM update pre:  Current domain mask: . [%s]\n",
+			     mali_pm_mask_to_string(pd_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM update pre:  Current PMU mask: .... [%s]\n",
+			     mali_pm_mask_to_string(pmu_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM update pre:  Group power stats: ... <%s>\n",
+			     mali_pm_group_stats_to_string()));
+
+	/* Figure out which cores we need to power on */
+	power_up_mask = pd_mask_wanted &
+			(pd_mask_wanted ^ pd_mask_current);
+
+	if (0 != power_up_mask) {
+		u32 power_up_mask_pmu;
+		struct mali_group *groups_up[MALI_MAX_NUMBER_OF_GROUPS];
+		u32 num_groups_up = 0;
+		struct mali_l2_cache_core *
+			l2_up[MALI_MAX_NUMBER_OF_L2_CACHE_CORES];
+		u32 num_l2_up = 0;
+		u32 i;
+
+#if defined(DEBUG)
+		++num_pm_updates_up;
+#endif
+
+		/*
+		 * Make sure dummy/global domain is always included when
+		 * powering up, since this is controlled by runtime PM,
+		 * and device power is on at this stage.
+		 */
+		power_up_mask |= MALI_PM_DOMAIN_DUMMY_MASK;
+
+		/* Power up only real PMU domains */
+		power_up_mask_pmu = power_up_mask & ~MALI_PM_DOMAIN_DUMMY_MASK;
+
+		/* But not those that happen to be powered on already */
+		power_up_mask_pmu &= (power_up_mask ^ pmu_mask_current) &
+				     power_up_mask;
+
+		if (0 != power_up_mask_pmu) {
+			MALI_DEBUG_ASSERT(NULL != pmu);
+			pmu_mask_current |= power_up_mask_pmu;
+			mali_pmu_power_up(pmu, power_up_mask_pmu);
+		}
+
+		/*
+		 * Put the domains themselves in power up state.
+		 * We get the groups and L2s to notify in return.
+		 */
+		mali_pm_domain_power_up(power_up_mask,
+					groups_up, &num_groups_up,
+					l2_up, &num_l2_up);
+
+		/* Need to unlock PM state lock before notifying L2 + groups */
+		mali_pm_state_unlock();
+
+		/* Notify each L2 cache that we have be powered up */
+		for (i = 0; i < num_l2_up; i++) {
+			mali_l2_cache_power_up(l2_up[i]);
+		}
+
+		/*
+		 * Tell execution module about all the groups we have
+		 * powered up. Groups will be notified as a result of this.
+		 */
+		mali_executor_group_power_up(groups_up, num_groups_up);
+
+		/* Lock state again before checking for power down */
+		mali_pm_state_lock();
+	}
+
+	/* Figure out which cores we need to power off */
+	power_down_mask = pd_mask_current &
+			  (pd_mask_wanted ^ pd_mask_current);
+
+	/*
+	 * Never power down the dummy/global domain here. This is to be done
+	 * from a suspend request (since this domain is only physicall powered
+	 * down at that point)
+	 */
+	power_down_mask &= ~MALI_PM_DOMAIN_DUMMY_MASK;
+
+	if (0 != power_down_mask) {
+		u32 power_down_mask_pmu;
+		struct mali_group *groups_down[MALI_MAX_NUMBER_OF_GROUPS];
+		u32 num_groups_down = 0;
+		struct mali_l2_cache_core *
+			l2_down[MALI_MAX_NUMBER_OF_L2_CACHE_CORES];
+		u32 num_l2_down = 0;
+		u32 i;
+
+#if defined(DEBUG)
+		++num_pm_updates_down;
+#endif
+
+		/*
+		 * Put the domains themselves in power down state.
+		 * We get the groups and L2s to notify in return.
+		 */
+		mali_pm_domain_power_down(power_down_mask,
+					  groups_down, &num_groups_down,
+					  l2_down, &num_l2_down);
+
+		/* Need to unlock PM state lock before notifying L2 + groups */
+		mali_pm_state_unlock();
+
+		/*
+		 * Tell execution module about all the groups we will be
+		 * powering down. Groups will be notified as a result of this.
+		 */
+		if (0 < num_groups_down) {
+			mali_executor_group_power_down(groups_down, num_groups_down);
+		}
+
+		/* Notify each L2 cache that we will be powering down */
+		for (i = 0; i < num_l2_down; i++) {
+			mali_l2_cache_power_down(l2_down[i]);
+		}
+
+		/*
+		 * Power down only PMU domains which should not stay on
+		 * Some domains might for instance currently be incorrectly
+		 * powered up if default domain power state is all on.
+		 */
+		power_down_mask_pmu = pmu_mask_current & (~pd_mask_current);
+
+		if (0 != power_down_mask_pmu) {
+			MALI_DEBUG_ASSERT(NULL != pmu);
+			pmu_mask_current &= ~power_down_mask_pmu;
+			mali_pmu_power_down(pmu, power_down_mask_pmu);
+
+		}
+	} else {
+		/*
+		 * Power down only PMU domains which should not stay on
+		 * Some domains might for instance currently be incorrectly
+		 * powered up if default domain power state is all on.
+		 */
+		u32 power_down_mask_pmu;
+
+		/* No need for state lock since we'll only update PMU */
+		mali_pm_state_unlock();
+
+		power_down_mask_pmu = pmu_mask_current & (~pd_mask_current);
+
+		if (0 != power_down_mask_pmu) {
+			MALI_DEBUG_ASSERT(NULL != pmu);
+			pmu_mask_current &= ~power_down_mask_pmu;
+			mali_pmu_power_down(pmu, power_down_mask_pmu);
+		}
+	}
+
+	MALI_DEBUG_PRINT(5, ("PM update post: Current domain mask: . [%s]\n",
+			     mali_pm_mask_to_string(pd_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM update post: Current PMU mask: .... [%s]\n",
+			     mali_pm_mask_to_string(pmu_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM update post: Group power stats: ... <%s>\n",
+			     mali_pm_group_stats_to_string()));
+}
+
+static mali_bool mali_pm_common_suspend(void)
+{
+	mali_pm_state_lock();
+
+	if (0 != pd_mask_wanted) {
+		MALI_DEBUG_PRINT(5, ("PM: Aborting suspend operation\n\n\n"));
+		mali_pm_state_unlock();
+		return MALI_FALSE;
+	}
+
+	MALI_DEBUG_PRINT(5, ("PM suspend pre: Wanted domain mask: .. [%s]\n",
+			     mali_pm_mask_to_string(pd_mask_wanted)));
+	MALI_DEBUG_PRINT(5, ("PM suspend pre: Current domain mask: . [%s]\n",
+			     mali_pm_mask_to_string(pd_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM suspend pre: Current PMU mask: .... [%s]\n",
+			     mali_pm_mask_to_string(pmu_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM suspend pre: Group power stats: ... <%s>\n",
+			     mali_pm_group_stats_to_string()));
+
+	if (0 != pd_mask_current) {
+		/*
+		 * We have still some domains powered on.
+		 * It is for instance very normal that at least the
+		 * dummy/global domain is marked as powered on at this point.
+		 * (because it is physically powered on until this function
+		 * returns)
+		 */
+
+		struct mali_group *groups_down[MALI_MAX_NUMBER_OF_GROUPS];
+		u32 num_groups_down = 0;
+		struct mali_l2_cache_core *
+			l2_down[MALI_MAX_NUMBER_OF_L2_CACHE_CORES];
+		u32 num_l2_down = 0;
+		u32 i;
+
+		/*
+		 * Put the domains themselves in power down state.
+		 * We get the groups and L2s to notify in return.
+		 */
+		mali_pm_domain_power_down(pd_mask_current,
+					  groups_down,
+					  &num_groups_down,
+					  l2_down,
+					  &num_l2_down);
+
+		MALI_DEBUG_ASSERT(0 == pd_mask_current);
+		MALI_DEBUG_ASSERT(MALI_TRUE == mali_pm_domain_all_unused());
+
+		/* Need to unlock PM state lock before notifying L2 + groups */
+		mali_pm_state_unlock();
+
+		/*
+		 * Tell execution module about all the groups we will be
+		 * powering down. Groups will be notified as a result of this.
+		 */
+		if (0 < num_groups_down) {
+			mali_executor_group_power_down(groups_down, num_groups_down);
+		}
+
+		/* Notify each L2 cache that we will be powering down */
+		for (i = 0; i < num_l2_down; i++) {
+			mali_l2_cache_power_down(l2_down[i]);
+		}
+
+		pmu_mask_current = 0;
+	} else {
+		MALI_DEBUG_ASSERT(0 == pmu_mask_current);
+
+		MALI_DEBUG_ASSERT(MALI_TRUE == mali_pm_domain_all_unused());
+
+		mali_pm_state_unlock();
+	}
+
+	MALI_DEBUG_PRINT(5, ("PM suspend post: Current domain mask:  [%s]\n",
+			     mali_pm_mask_to_string(pd_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM suspend post: Current PMU mask: ... [%s]\n",
+			     mali_pm_mask_to_string(pmu_mask_current)));
+	MALI_DEBUG_PRINT(5, ("PM suspend post: Group power stats: .. <%s>\n",
+			     mali_pm_group_stats_to_string()));
+
+	return MALI_TRUE;
+}
+
+static void mali_pm_update_work(void *data)
+{
+	MALI_IGNORE(data);
+	mali_pm_update_sync();
+}
+
+static _mali_osk_errcode_t mali_pm_create_pm_domains(void)
+{
+	int i;
+
+	/* Create all domains (including dummy domain) */
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		if (0x0 == domain_config[i]) continue;
+
+		if (NULL == mali_pm_domain_create(domain_config[i])) {
+			return _MALI_OSK_ERR_NOMEM;
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static void mali_pm_set_default_pm_domain_config(void)
+{
+	MALI_DEBUG_ASSERT(0 != _mali_osk_resource_base_address());
+
+	/* GP core */
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_GP, NULL)) {
+		domain_config[MALI_DOMAIN_INDEX_GP] = 0x01;
+	}
+
+	/* PP0 - PP3 core */
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP0, NULL)) {
+		if (mali_is_mali400()) {
+			domain_config[MALI_DOMAIN_INDEX_PP0] = 0x01 << 2;
+		} else if (mali_is_mali450()) {
+			domain_config[MALI_DOMAIN_INDEX_PP0] = 0x01 << 1;
+		} else if (mali_is_mali470()) {
+			domain_config[MALI_DOMAIN_INDEX_PP0] = 0x01 << 0;
+		}
+	}
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP1, NULL)) {
+		if (mali_is_mali400()) {
+			domain_config[MALI_DOMAIN_INDEX_PP1] = 0x01 << 3;
+		} else if (mali_is_mali450()) {
+			domain_config[MALI_DOMAIN_INDEX_PP1] = 0x01 << 2;
+		} else if (mali_is_mali470()) {
+			domain_config[MALI_DOMAIN_INDEX_PP1] = 0x01 << 1;
+		}
+	}
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP2, NULL)) {
+		if (mali_is_mali400()) {
+			domain_config[MALI_DOMAIN_INDEX_PP2] = 0x01 << 4;
+		} else if (mali_is_mali450()) {
+			domain_config[MALI_DOMAIN_INDEX_PP2] = 0x01 << 2;
+		} else if (mali_is_mali470()) {
+			domain_config[MALI_DOMAIN_INDEX_PP2] = 0x01 << 1;
+		}
+	}
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP3, NULL)) {
+		if (mali_is_mali400()) {
+			domain_config[MALI_DOMAIN_INDEX_PP3] = 0x01 << 5;
+		} else if (mali_is_mali450()) {
+			domain_config[MALI_DOMAIN_INDEX_PP3] = 0x01 << 2;
+		} else if (mali_is_mali470()) {
+			domain_config[MALI_DOMAIN_INDEX_PP3] = 0x01 << 1;
+		}
+	}
+
+	/* PP4 - PP7 */
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP4, NULL)) {
+		domain_config[MALI_DOMAIN_INDEX_PP4] = 0x01 << 3;
+	}
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP5, NULL)) {
+		domain_config[MALI_DOMAIN_INDEX_PP5] = 0x01 << 3;
+	}
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP6, NULL)) {
+		domain_config[MALI_DOMAIN_INDEX_PP6] = 0x01 << 3;
+	}
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+		    MALI_OFFSET_PP7, NULL)) {
+		domain_config[MALI_DOMAIN_INDEX_PP7] = 0x01 << 3;
+	}
+
+	/* L2gp/L2PP0/L2PP4 */
+	if (mali_is_mali400()) {
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+			    MALI400_OFFSET_L2_CACHE0, NULL)) {
+			domain_config[MALI_DOMAIN_INDEX_L20] = 0x01 << 1;
+		}
+	} else if (mali_is_mali450()) {
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+			    MALI450_OFFSET_L2_CACHE0, NULL)) {
+			domain_config[MALI_DOMAIN_INDEX_L20] = 0x01 << 0;
+		}
+
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+			    MALI450_OFFSET_L2_CACHE1, NULL)) {
+			domain_config[MALI_DOMAIN_INDEX_L21] = 0x01 << 1;
+		}
+
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+			    MALI450_OFFSET_L2_CACHE2, NULL)) {
+			domain_config[MALI_DOMAIN_INDEX_L22] = 0x01 << 3;
+		}
+	} else if (mali_is_mali470()) {
+		if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(
+			    MALI470_OFFSET_L2_CACHE1, NULL)) {
+			domain_config[MALI_DOMAIN_INDEX_L21] = 0x01 << 0;
+		}
+	}
+}
+
+static u32 mali_pm_get_registered_cores_mask(void)
+{
+	int i = 0;
+	u32 mask = 0;
+
+	for (i = 0; i < MALI_DOMAIN_INDEX_DUMMY; i++) {
+		mask |= domain_config[i];
+	}
+
+	return mask;
+}
+
+static void mali_pm_set_pmu_domain_config(void)
+{
+	int i = 0;
+
+	_mali_osk_device_data_pmu_config_get(domain_config, MALI_MAX_NUMBER_OF_DOMAINS - 1);
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS - 1; i++) {
+		if (0 != domain_config[i]) {
+			MALI_DEBUG_PRINT(2, ("Using customer pmu config:\n"));
+			break;
+		}
+	}
+
+	if (MALI_MAX_NUMBER_OF_DOMAINS - 1 == i) {
+		MALI_DEBUG_PRINT(2, ("Using hw detect pmu config:\n"));
+		mali_pm_set_default_pm_domain_config();
+	}
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS - 1; i++) {
+		if (domain_config[i]) {
+			MALI_DEBUG_PRINT(2, ("domain_config[%d] = 0x%x \n", i, domain_config[i]));
+		}
+	}
+	/* Can't override dummy domain mask */
+	domain_config[MALI_DOMAIN_INDEX_DUMMY] =
+		1 << MALI_DOMAIN_INDEX_DUMMY;
+}
+
+#if defined(DEBUG)
+const char *mali_pm_mask_to_string(u32 mask)
+{
+	static char bit_str[MALI_MAX_NUMBER_OF_DOMAINS + 1];
+	int bit;
+	int str_pos = 0;
+
+	/* Must be protected by lock since we use shared string buffer */
+	if (NULL != pm_lock_exec) {
+		MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_exec);
+	}
+
+	for (bit = MALI_MAX_NUMBER_OF_DOMAINS - 1; bit >= 0; bit--) {
+		if (mask & (1 << bit)) {
+			bit_str[str_pos] = 'X';
+		} else {
+			bit_str[str_pos] = '-';
+		}
+		str_pos++;
+	}
+
+	bit_str[MALI_MAX_NUMBER_OF_DOMAINS] = '\0';
+
+	return bit_str;
+}
+
+const char *mali_pm_group_stats_to_string(void)
+{
+	static char bit_str[MALI_MAX_NUMBER_OF_GROUPS + 1];
+	u32 num_groups = mali_group_get_glob_num_groups();
+	u32 i;
+
+	/* Must be protected by lock since we use shared string buffer */
+	if (NULL != pm_lock_exec) {
+		MALI_DEBUG_ASSERT_LOCK_HELD(pm_lock_exec);
+	}
+
+	for (i = 0; i < num_groups && i < MALI_MAX_NUMBER_OF_GROUPS; i++) {
+		struct mali_group *group;
+
+		group = mali_group_get_glob_group(i);
+
+		if (MALI_TRUE == mali_group_power_is_on(group)) {
+			bit_str[i] = 'X';
+		} else {
+			bit_str[i] = '-';
+		}
+	}
+
+	bit_str[i] = '\0';
+
+	return bit_str;
+}
+#endif
+
+/*
+ * num_pp is the number of PP cores which will be powered on given this mask
+ * cost is the total power cost of cores which will be powered on given this mask
+ */
+static void mali_pm_stat_from_mask(u32 mask, u32 *num_pp, u32 *cost)
+{
+	u32 i;
+
+	/* loop through all cores */
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		if (!(domain_config[i] & mask)) {
+			continue;
+		}
+
+		switch (i) {
+		case MALI_DOMAIN_INDEX_GP:
+			*cost += MALI_GP_COST;
+
+			break;
+		case MALI_DOMAIN_INDEX_PP0: /* Fall through */
+		case MALI_DOMAIN_INDEX_PP1: /* Fall through */
+		case MALI_DOMAIN_INDEX_PP2: /* Fall through */
+		case MALI_DOMAIN_INDEX_PP3:
+			if (mali_is_mali400()) {
+				if ((domain_config[MALI_DOMAIN_INDEX_L20] & mask)
+				    || (domain_config[MALI_DOMAIN_INDEX_DUMMY]
+					== domain_config[MALI_DOMAIN_INDEX_L20])) {
+					*num_pp += 1;
+				}
+			} else {
+				if ((domain_config[MALI_DOMAIN_INDEX_L21] & mask)
+				    || (domain_config[MALI_DOMAIN_INDEX_DUMMY]
+					== domain_config[MALI_DOMAIN_INDEX_L21])) {
+					*num_pp += 1;
+				}
+			}
+
+			*cost += MALI_PP_COST;
+			break;
+		case MALI_DOMAIN_INDEX_PP4: /* Fall through */
+		case MALI_DOMAIN_INDEX_PP5: /* Fall through */
+		case MALI_DOMAIN_INDEX_PP6: /* Fall through */
+		case MALI_DOMAIN_INDEX_PP7:
+			MALI_DEBUG_ASSERT(mali_is_mali450());
+
+			if ((domain_config[MALI_DOMAIN_INDEX_L22] & mask)
+			    || (domain_config[MALI_DOMAIN_INDEX_DUMMY]
+				== domain_config[MALI_DOMAIN_INDEX_L22])) {
+				*num_pp += 1;
+			}
+
+			*cost += MALI_PP_COST;
+			break;
+		case MALI_DOMAIN_INDEX_L20: /* Fall through */
+		case MALI_DOMAIN_INDEX_L21: /* Fall through */
+		case MALI_DOMAIN_INDEX_L22:
+			*cost += MALI_L2_COST;
+
+			break;
+		}
+	}
+}
+
+void mali_pm_power_cost_setup(void)
+{
+	/*
+	 * Two parallel arrays which store the best domain mask and its cost
+	 * The index is the number of PP cores, E.g. Index 0 is for 1 PP option,
+	 * might have mask 0x2 and with cost of 1, lower cost is better
+	 */
+	u32 best_mask[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS] = { 0 };
+	u32 best_cost[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS] = { 0 };
+	/* Array cores_in_domain is used to store the total pp cores in each pm domain. */
+	u32 cores_in_domain[MALI_MAX_NUMBER_OF_DOMAINS] = { 0 };
+	/* Domain_count is used to represent the max domain we have.*/
+	u32 max_domain_mask = 0;
+	u32 max_domain_id = 0;
+	u32 always_on_pp_cores = 0;
+
+	u32 num_pp, cost, mask;
+	u32 i, j , k;
+
+	/* Initialize statistics */
+	for (i = 0; i < MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS; i++) {
+		best_mask[i] = 0;
+		best_cost[i] = 0xFFFFFFFF; /* lower cost is better */
+	}
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS + 1; i++) {
+		for (j = 0; j < MALI_MAX_NUMBER_OF_DOMAINS; j++) {
+			mali_pm_domain_power_cost_result[i][j] = 0;
+		}
+	}
+
+	/* Caculate number of pp cores of a given domain config. */
+	for (i = MALI_DOMAIN_INDEX_PP0; i <= MALI_DOMAIN_INDEX_PP7; i++) {
+		if (0 < domain_config[i]) {
+			/* Get the max domain mask value used to caculate power cost
+			 * and we don't count in always on pp cores. */
+			if (MALI_PM_DOMAIN_DUMMY_MASK != domain_config[i]
+			    && max_domain_mask < domain_config[i]) {
+				max_domain_mask = domain_config[i];
+			}
+
+			if (MALI_PM_DOMAIN_DUMMY_MASK == domain_config[i]) {
+				always_on_pp_cores++;
+			}
+		}
+	}
+	max_domain_id = _mali_osk_fls(max_domain_mask);
+
+	/*
+	 * Try all combinations of power domains and check how many PP cores
+	 * they have and their power cost.
+	 */
+	for (mask = 0; mask < (1 << max_domain_id); mask++) {
+		num_pp = 0;
+		cost = 0;
+
+		mali_pm_stat_from_mask(mask, &num_pp, &cost);
+
+		/* This mask is usable for all MP1 up to num_pp PP cores, check statistics for all */
+		for (i = 0; i < num_pp; i++) {
+			if (best_cost[i] >= cost) {
+				best_cost[i] = cost;
+				best_mask[i] = mask;
+			}
+		}
+	}
+
+	/*
+	 * If we want to enable x pp cores, if x is less than number of always_on pp cores,
+	 * all of pp cores we will enable must be always_on pp cores.
+	 */
+	for (i = 0; i < mali_executor_get_num_cores_total(); i++) {
+		if (i < always_on_pp_cores) {
+			mali_pm_domain_power_cost_result[i + 1][MALI_MAX_NUMBER_OF_DOMAINS - 1]
+				= i + 1;
+		} else {
+			mali_pm_domain_power_cost_result[i + 1][MALI_MAX_NUMBER_OF_DOMAINS - 1]
+				= always_on_pp_cores;
+		}
+	}
+
+	/* In this loop, variable i represent for the number of non-always on pp cores we want to enabled. */
+	for (i = 0; i < (mali_executor_get_num_cores_total() - always_on_pp_cores); i++) {
+		if (best_mask[i] == 0) {
+			/* This MP variant is not available */
+			continue;
+		}
+
+		for (j = 0; j < MALI_MAX_NUMBER_OF_DOMAINS; j++) {
+			cores_in_domain[j] = 0;
+		}
+
+		for (j = MALI_DOMAIN_INDEX_PP0; j <= MALI_DOMAIN_INDEX_PP7; j++) {
+			if (0 < domain_config[j]
+			    && (MALI_PM_DOMAIN_DUMMY_MASK != domain_config[i])) {
+				cores_in_domain[_mali_osk_fls(domain_config[j]) - 1]++;
+			}
+		}
+
+		/* In this loop, j represent for the number we have already enabled.*/
+		for (j = 0; j <= i;) {
+			/* j used to visit all of domain to get the number of pp cores remained in it. */
+			for (k = 0; k < max_domain_id; k++) {
+				/* If domain k in best_mask[i] is enabled and this domain has extra pp cores,
+				 * we know we must pick at least one pp core from this domain.
+				 * And then we move to next enabled pm domain. */
+				if ((best_mask[i] & (0x1 << k)) && (0 < cores_in_domain[k])) {
+					cores_in_domain[k]--;
+					mali_pm_domain_power_cost_result[always_on_pp_cores + i + 1][k]++;
+					j++;
+					if (j > i) {
+						break;
+					}
+				}
+			}
+		}
+	}
+}
+
+/*
+ * When we are doing core scaling,
+ * this function is called to return the best mask to
+ * achieve the best pp group power cost.
+ */
+void mali_pm_get_best_power_cost_mask(int num_requested, int *dst)
+{
+	MALI_DEBUG_ASSERT((mali_executor_get_num_cores_total() >= num_requested) && (0 <= num_requested));
+
+	_mali_osk_memcpy(dst, mali_pm_domain_power_cost_result[num_requested], MALI_MAX_NUMBER_OF_DOMAINS * sizeof(int));
+}
+
+u32 mali_pm_get_current_mask(void)
+{
+	return pd_mask_current;
+}
+
+u32 mali_pm_get_wanted_mask(void)
+{
+	return pd_mask_wanted;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pm_domain.c b/drivers/gpu/arm/mali400/common/mali_pm_domain.c
--- a/drivers/gpu/arm/mali400/common/mali_pm_domain.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pm_domain.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_pm_domain.h"
+#include "mali_pmu.h"
+#include "mali_group.h"
+#include "mali_pm.h"
+
+static struct mali_pm_domain *mali_pm_domains[MALI_MAX_NUMBER_OF_DOMAINS] =
+{ NULL, };
+
+void mali_pm_domain_initialize(void)
+{
+	/* Domains will be initialized/created on demand */
+}
+
+void mali_pm_domain_terminate(void)
+{
+	int i;
+
+	/* Delete all domains that has been created */
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		mali_pm_domain_delete(mali_pm_domains[i]);
+		mali_pm_domains[i] = NULL;
+	}
+}
+
+struct mali_pm_domain *mali_pm_domain_create(u32 pmu_mask)
+{
+	struct mali_pm_domain *domain = NULL;
+	u32 domain_id = 0;
+
+	domain = mali_pm_domain_get_from_mask(pmu_mask);
+	if (NULL != domain) return domain;
+
+	MALI_DEBUG_PRINT(2,
+			 ("Mali PM domain: Creating Mali PM domain (mask=0x%08X)\n",
+			  pmu_mask));
+
+	domain = (struct mali_pm_domain *)_mali_osk_malloc(
+			 sizeof(struct mali_pm_domain));
+	if (NULL != domain) {
+		domain->power_is_on = MALI_FALSE;
+		domain->pmu_mask = pmu_mask;
+		domain->use_count = 0;
+		_mali_osk_list_init(&domain->group_list);
+		_mali_osk_list_init(&domain->l2_cache_list);
+
+		domain_id = _mali_osk_fls(pmu_mask) - 1;
+		/* Verify the domain_id */
+		MALI_DEBUG_ASSERT(MALI_MAX_NUMBER_OF_DOMAINS > domain_id);
+		/* Verify that pmu_mask only one bit is set */
+		MALI_DEBUG_ASSERT((1 << domain_id) == pmu_mask);
+		mali_pm_domains[domain_id] = domain;
+
+		return domain;
+	} else {
+		MALI_DEBUG_PRINT_ERROR(("Unable to create PM domain\n"));
+	}
+
+	return NULL;
+}
+
+void mali_pm_domain_delete(struct mali_pm_domain *domain)
+{
+	if (NULL == domain) {
+		return;
+	}
+
+	_mali_osk_list_delinit(&domain->group_list);
+	_mali_osk_list_delinit(&domain->l2_cache_list);
+
+	_mali_osk_free(domain);
+}
+
+void mali_pm_domain_add_group(struct mali_pm_domain *domain,
+			      struct mali_group *group)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	/*
+	 * Use addtail because virtual group is created last and it needs
+	 * to be at the end of the list (in order to be activated after
+	 * all children.
+	 */
+	_mali_osk_list_addtail(&group->pm_domain_list, &domain->group_list);
+}
+
+void mali_pm_domain_add_l2_cache(struct mali_pm_domain *domain,
+				 struct mali_l2_cache_core *l2_cache)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	MALI_DEBUG_ASSERT_POINTER(l2_cache);
+	_mali_osk_list_add(&l2_cache->pm_domain_list, &domain->l2_cache_list);
+}
+
+struct mali_pm_domain *mali_pm_domain_get_from_mask(u32 mask)
+{
+	u32 id = 0;
+
+	if (0 == mask) {
+		return NULL;
+	}
+
+	id = _mali_osk_fls(mask) - 1;
+
+	MALI_DEBUG_ASSERT(MALI_MAX_NUMBER_OF_DOMAINS > id);
+	/* Verify that pmu_mask only one bit is set */
+	MALI_DEBUG_ASSERT((1 << id) == mask);
+
+	return mali_pm_domains[id];
+}
+
+struct mali_pm_domain *mali_pm_domain_get_from_index(u32 id)
+{
+	MALI_DEBUG_ASSERT(MALI_MAX_NUMBER_OF_DOMAINS > id);
+
+	return mali_pm_domains[id];
+}
+
+u32 mali_pm_domain_ref_get(struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+
+	if (0 == domain->use_count) {
+		_mali_osk_pm_dev_ref_get_async();
+	}
+
+	++domain->use_count;
+	MALI_DEBUG_PRINT(4, ("PM domain %p: ref_get, use_count => %u\n", domain, domain->use_count));
+
+	/* Return our mask so caller can check this against wanted mask */
+	return domain->pmu_mask;
+}
+
+u32 mali_pm_domain_ref_put(struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+
+	--domain->use_count;
+	MALI_DEBUG_PRINT(4, ("PM domain %p: ref_put, use_count => %u\n", domain, domain->use_count));
+
+	if (0 == domain->use_count) {
+		_mali_osk_pm_dev_ref_put();
+	}
+
+	/*
+	 * Return the PMU mask which now could be be powered down
+	 * (the bit for this domain).
+	 * This is the responsibility of the caller (mali_pm)
+	 */
+	return (0 == domain->use_count ? domain->pmu_mask : 0);
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_pm_domain_get_id(struct mali_pm_domain *domain)
+{
+	u32 id = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	MALI_DEBUG_ASSERT(0 != domain->pmu_mask);
+
+	id = _mali_osk_fls(domain->pmu_mask) - 1;
+
+	MALI_DEBUG_ASSERT(MALI_MAX_NUMBER_OF_DOMAINS > id);
+	/* Verify that pmu_mask only one bit is set */
+	MALI_DEBUG_ASSERT((1 << id) == domain->pmu_mask);
+	/* Verify that we have stored the domain at right id/index */
+	MALI_DEBUG_ASSERT(domain == mali_pm_domains[id]);
+
+	return id;
+}
+#endif
+
+#if defined(DEBUG)
+mali_bool mali_pm_domain_all_unused(void)
+{
+	int i;
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_DOMAINS; i++) {
+		if (NULL == mali_pm_domains[i]) {
+			/* Nothing to check */
+			continue;
+		}
+
+		if (MALI_TRUE == mali_pm_domains[i]->power_is_on) {
+			/* Not ready for suspend! */
+			return MALI_FALSE;
+		}
+
+		if (0 != mali_pm_domains[i]->use_count) {
+			/* Not ready for suspend! */
+			return MALI_FALSE;
+		}
+	}
+
+	return MALI_TRUE;
+}
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pm_domain.h b/drivers/gpu/arm/mali400/common/mali_pm_domain.h
--- a/drivers/gpu/arm/mali400/common/mali_pm_domain.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pm_domain.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PM_DOMAIN_H__
+#define __MALI_PM_DOMAIN_H__
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+
+#include "mali_l2_cache.h"
+#include "mali_group.h"
+#include "mali_pmu.h"
+
+/* Instances are protected by PM state lock */
+struct mali_pm_domain {
+	mali_bool power_is_on;
+	s32 use_count;
+	u32 pmu_mask;
+
+	/* Zero or more groups can belong to this domain */
+	_mali_osk_list_t group_list;
+
+	/* Zero or more L2 caches can belong to this domain */
+	_mali_osk_list_t l2_cache_list;
+};
+
+
+void mali_pm_domain_initialize(void);
+void mali_pm_domain_terminate(void);
+
+struct mali_pm_domain *mali_pm_domain_create(u32 pmu_mask);
+void mali_pm_domain_delete(struct mali_pm_domain *domain);
+
+void mali_pm_domain_add_l2_cache(
+	struct mali_pm_domain *domain,
+	struct mali_l2_cache_core *l2_cache);
+void mali_pm_domain_add_group(struct mali_pm_domain *domain,
+			      struct mali_group *group);
+
+struct mali_pm_domain *mali_pm_domain_get_from_mask(u32 mask);
+struct mali_pm_domain *mali_pm_domain_get_from_index(u32 id);
+
+/* Ref counting */
+u32 mali_pm_domain_ref_get(struct mali_pm_domain *domain);
+u32 mali_pm_domain_ref_put(struct mali_pm_domain *domain);
+
+MALI_STATIC_INLINE _mali_osk_list_t *mali_pm_domain_get_group_list(
+	struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	return &domain->group_list;
+}
+
+MALI_STATIC_INLINE _mali_osk_list_t *mali_pm_domain_get_l2_cache_list(
+	struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	return &domain->l2_cache_list;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pm_domain_power_is_on(
+	struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	return domain->power_is_on;
+}
+
+MALI_STATIC_INLINE void mali_pm_domain_set_power_on(
+	struct mali_pm_domain *domain,
+	mali_bool power_is_on)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	domain->power_is_on = power_is_on;
+}
+
+MALI_STATIC_INLINE u32 mali_pm_domain_get_use_count(
+	struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	return domain->use_count;
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_pm_domain_get_id(struct mali_pm_domain *domain);
+
+MALI_STATIC_INLINE u32 mali_pm_domain_get_mask(struct mali_pm_domain *domain)
+{
+	MALI_DEBUG_ASSERT_POINTER(domain);
+	return domain->pmu_mask;
+}
+#endif
+
+#if defined(DEBUG)
+mali_bool mali_pm_domain_all_unused(void);
+#endif
+
+#endif /* __MALI_PM_DOMAIN_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pm.h b/drivers/gpu/arm/mali400/common/mali_pm.h
--- a/drivers/gpu/arm/mali400/common/mali_pm.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pm.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PM_H__
+#define __MALI_PM_H__
+
+#include "mali_osk.h"
+#include "mali_pm_domain.h"
+
+#define MALI_DOMAIN_INDEX_GP        0
+#define MALI_DOMAIN_INDEX_PP0       1
+#define MALI_DOMAIN_INDEX_PP1       2
+#define MALI_DOMAIN_INDEX_PP2       3
+#define MALI_DOMAIN_INDEX_PP3       4
+#define MALI_DOMAIN_INDEX_PP4       5
+#define MALI_DOMAIN_INDEX_PP5       6
+#define MALI_DOMAIN_INDEX_PP6       7
+#define MALI_DOMAIN_INDEX_PP7       8
+#define MALI_DOMAIN_INDEX_L20       9
+#define MALI_DOMAIN_INDEX_L21      10
+#define MALI_DOMAIN_INDEX_L22      11
+/*
+ * The dummy domain is used when there is no physical power domain
+ * (e.g. no PMU or always on cores)
+ */
+#define MALI_DOMAIN_INDEX_DUMMY    12
+#define MALI_MAX_NUMBER_OF_DOMAINS 13
+
+/**
+ * Initialize the Mali PM module
+ *
+ * PM module covers Mali PM core, PM domains and Mali PMU
+ */
+_mali_osk_errcode_t mali_pm_initialize(void);
+
+/**
+ * Terminate the Mali PM module
+ */
+void mali_pm_terminate(void);
+
+void mali_pm_exec_lock(void);
+void mali_pm_exec_unlock(void);
+
+
+struct mali_pm_domain *mali_pm_register_l2_cache(u32 domain_index,
+		struct mali_l2_cache_core *l2_cache);
+struct mali_pm_domain *mali_pm_register_group(u32 domain_index,
+		struct mali_group *group);
+
+mali_bool mali_pm_get_domain_refs(struct mali_pm_domain **domains,
+				  struct mali_group **groups,
+				  u32 num_domains);
+mali_bool mali_pm_put_domain_refs(struct mali_pm_domain **domains,
+				  u32 num_domains);
+
+void mali_pm_init_begin(void);
+void mali_pm_init_end(void);
+
+void mali_pm_update_sync(void);
+void mali_pm_update_async(void);
+
+/* Callback functions for system power management */
+void mali_pm_os_suspend(mali_bool os_suspend);
+void mali_pm_os_resume(void);
+
+mali_bool mali_pm_runtime_suspend(void);
+void mali_pm_runtime_resume(void);
+
+#if MALI_STATE_TRACKING
+u32 mali_pm_dump_state_domain(struct mali_pm_domain *domain,
+			      char *buf, u32 size);
+#endif
+
+void mali_pm_power_cost_setup(void);
+
+void mali_pm_get_best_power_cost_mask(int num_requested, int *dst);
+
+#if defined(DEBUG)
+const char *mali_pm_mask_to_string(u32 mask);
+#endif
+
+u32 mali_pm_get_current_mask(void);
+u32 mali_pm_get_wanted_mask(void);
+#endif /* __MALI_PM_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pm_metrics.c b/drivers/gpu/arm/mali400/common/mali_pm_metrics.c
--- a/drivers/gpu/arm/mali400/common/mali_pm_metrics.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pm_metrics.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include "mali_pm_metrics.h"
+#include "mali_osk_locks.h"
+#include "mali_osk_mali.h"
+#include <linux/ktime.h>
+
+#define MALI_PM_TIME_SHIFT 0
+#define MALI_UTILIZATION_MAX_PERIOD 80000000/* ns = 100ms */
+
+_mali_osk_errcode_t mali_pm_metrics_init(struct mali_device *mdev)
+{
+	int i = 0;
+
+	MALI_DEBUG_ASSERT(mdev != NULL);
+
+	mdev->mali_metrics.time_period_start = ktime_get();
+	mdev->mali_metrics.time_period_start_gp = mdev->mali_metrics.time_period_start;
+	mdev->mali_metrics.time_period_start_pp = mdev->mali_metrics.time_period_start;
+
+	mdev->mali_metrics.time_busy = 0;
+	mdev->mali_metrics.time_idle = 0;
+	mdev->mali_metrics.prev_busy = 0;
+	mdev->mali_metrics.prev_idle = 0;
+	mdev->mali_metrics.num_running_gp_cores = 0;
+	mdev->mali_metrics.num_running_pp_cores = 0;
+	mdev->mali_metrics.time_busy_gp = 0;
+	mdev->mali_metrics.time_idle_gp = 0;
+
+	for (i = 0; i < MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS; i++) {
+		mdev->mali_metrics.time_busy_pp[i] = 0;
+		mdev->mali_metrics.time_idle_pp[i] = 0;
+	}
+	mdev->mali_metrics.gpu_active = MALI_FALSE;
+
+	mdev->mali_metrics.lock = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_UNORDERED, _MALI_OSK_LOCK_ORDER_FIRST);
+	if (NULL == mdev->mali_metrics.lock) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_pm_metrics_term(struct mali_device *mdev)
+{
+	_mali_osk_spinlock_irq_term(mdev->mali_metrics.lock);
+}
+
+/*caller needs to hold mdev->mali_metrics.lock before calling this function*/
+void mali_pm_record_job_status(struct mali_device *mdev)
+{
+	ktime_t now;
+	ktime_t diff;
+	u64 ns_time;
+
+	MALI_DEBUG_ASSERT(mdev != NULL);
+
+	now = ktime_get();
+	diff = ktime_sub(now, mdev->mali_metrics.time_period_start);
+
+	ns_time = (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+	mdev->mali_metrics.time_busy += ns_time;
+	mdev->mali_metrics.time_period_start = now;
+}
+
+void mali_pm_record_gpu_idle(mali_bool is_gp)
+{
+	ktime_t now;
+	ktime_t diff;
+	u64 ns_time;
+	struct mali_device *mdev = dev_get_drvdata(&mali_platform_device->dev);
+
+	MALI_DEBUG_ASSERT(mdev != NULL);
+
+	_mali_osk_spinlock_irq_lock(mdev->mali_metrics.lock);
+	now = ktime_get();
+
+	if (MALI_TRUE == is_gp) {
+		--mdev->mali_metrics.num_running_gp_cores;
+		if (0 == mdev->mali_metrics.num_running_gp_cores) {
+			diff = ktime_sub(now, mdev->mali_metrics.time_period_start_gp);
+			ns_time = (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+			mdev->mali_metrics.time_busy_gp += ns_time;
+			mdev->mali_metrics.time_period_start_gp = now;
+
+			if (0 == mdev->mali_metrics.num_running_pp_cores) {
+				MALI_DEBUG_ASSERT(mdev->mali_metrics.gpu_active == MALI_TRUE);
+				diff = ktime_sub(now, mdev->mali_metrics.time_period_start);
+				ns_time = (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+				mdev->mali_metrics.time_busy += ns_time;
+				mdev->mali_metrics.time_period_start = now;
+				mdev->mali_metrics.gpu_active = MALI_FALSE;
+			}
+		}
+	} else {
+		--mdev->mali_metrics.num_running_pp_cores;
+		if (0 == mdev->mali_metrics.num_running_pp_cores) {
+			diff = ktime_sub(now, mdev->mali_metrics.time_period_start_pp);
+			ns_time = (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+			mdev->mali_metrics.time_busy_pp[0] += ns_time;
+			mdev->mali_metrics.time_period_start_pp = now;
+
+			if (0 == mdev->mali_metrics.num_running_gp_cores) {
+				MALI_DEBUG_ASSERT(mdev->mali_metrics.gpu_active == MALI_TRUE);
+				diff = ktime_sub(now, mdev->mali_metrics.time_period_start);
+				ns_time = (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+				mdev->mali_metrics.time_busy += ns_time;
+				mdev->mali_metrics.time_period_start = now;
+				mdev->mali_metrics.gpu_active = MALI_FALSE;
+			}
+		}
+	}
+
+	_mali_osk_spinlock_irq_unlock(mdev->mali_metrics.lock);
+}
+
+void mali_pm_record_gpu_active(mali_bool is_gp)
+{
+	ktime_t now;
+	ktime_t diff;
+	struct mali_device *mdev = dev_get_drvdata(&mali_platform_device->dev);
+
+	MALI_DEBUG_ASSERT(mdev != NULL);
+
+	_mali_osk_spinlock_irq_lock(mdev->mali_metrics.lock);
+	now = ktime_get();
+
+	if (MALI_TRUE == is_gp) {
+		mdev->mali_metrics.num_running_gp_cores++;
+		if (1 == mdev->mali_metrics.num_running_gp_cores) {
+			diff = ktime_sub(now, mdev->mali_metrics.time_period_start_gp);
+			mdev->mali_metrics.time_idle_gp += (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+			mdev->mali_metrics.time_period_start_gp = now;
+			if (0 == mdev->mali_metrics.num_running_pp_cores) {
+				MALI_DEBUG_ASSERT(mdev->mali_metrics.gpu_active == MALI_FALSE);
+				diff = ktime_sub(now, mdev->mali_metrics.time_period_start);
+				mdev->mali_metrics.time_idle += (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+				mdev->mali_metrics.time_period_start = now;
+				mdev->mali_metrics.gpu_active = MALI_TRUE;
+			}
+		} else {
+			MALI_DEBUG_ASSERT(mdev->mali_metrics.gpu_active == MALI_TRUE);
+		}
+	} else {
+		mdev->mali_metrics.num_running_pp_cores++;
+		if (1 == mdev->mali_metrics.num_running_pp_cores) {
+			diff = ktime_sub(now, mdev->mali_metrics.time_period_start_pp);
+			mdev->mali_metrics.time_idle_pp[0] += (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+			mdev->mali_metrics.time_period_start_pp = now;
+			if (0 == mdev->mali_metrics.num_running_gp_cores) {
+				MALI_DEBUG_ASSERT(mdev->mali_metrics.gpu_active == MALI_FALSE);
+				diff = ktime_sub(now, mdev->mali_metrics.time_period_start);
+				mdev->mali_metrics.time_idle += (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+				mdev->mali_metrics.time_period_start = now;
+				mdev->mali_metrics.gpu_active = MALI_TRUE;
+			}
+		} else {
+			MALI_DEBUG_ASSERT(mdev->mali_metrics.gpu_active == MALI_TRUE);
+		}
+	}
+
+	_mali_osk_spinlock_irq_unlock(mdev->mali_metrics.lock);
+}
+
+
+/*caller needs to hold mdev->mali_metrics.lock before calling this function*/
+static void mali_pm_get_dvfs_utilisation_calc(struct mali_device *mdev, ktime_t now)
+{
+	ktime_t diff;
+
+	MALI_DEBUG_ASSERT(mdev != NULL);
+
+	diff = ktime_sub(now, mdev->mali_metrics.time_period_start);
+
+	if (mdev->mali_metrics.gpu_active) {
+		mdev->mali_metrics.time_busy += (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+	} else {
+		mdev->mali_metrics.time_idle += (u64)(ktime_to_ns(diff) >> MALI_PM_TIME_SHIFT);
+	}
+}
+
+/* Caller needs to hold mdev->mali_metrics.lock before calling this function. */
+static void mali_pm_reset_dvfs_utilisation_unlocked(struct mali_device *mdev, ktime_t now)
+{
+	/* Store previous value */
+	mdev->mali_metrics.prev_idle = mdev->mali_metrics.time_idle;
+	mdev->mali_metrics.prev_busy = mdev->mali_metrics.time_busy;
+
+	/* Reset current values */
+	mdev->mali_metrics.time_period_start = now;
+	mdev->mali_metrics.time_period_start_gp = now;
+	mdev->mali_metrics.time_period_start_pp = now;
+	mdev->mali_metrics.time_idle = 0;
+	mdev->mali_metrics.time_busy = 0;
+
+	mdev->mali_metrics.time_busy_gp = 0;
+	mdev->mali_metrics.time_idle_gp = 0;
+	mdev->mali_metrics.time_busy_pp[0] = 0;
+	mdev->mali_metrics.time_idle_pp[0] = 0;
+}
+
+void mali_pm_reset_dvfs_utilisation(struct mali_device *mdev)
+{
+	_mali_osk_spinlock_irq_lock(mdev->mali_metrics.lock);
+	mali_pm_reset_dvfs_utilisation_unlocked(mdev, ktime_get());
+	_mali_osk_spinlock_irq_unlock(mdev->mali_metrics.lock);
+}
+
+void mali_pm_get_dvfs_utilisation(struct mali_device *mdev,
+				  unsigned long *total_out, unsigned long *busy_out)
+{
+	ktime_t now = ktime_get();
+	u64 busy = 0;
+	u64 total = 0;
+
+	_mali_osk_spinlock_irq_lock(mdev->mali_metrics.lock);
+
+	mali_pm_get_dvfs_utilisation_calc(mdev, now);
+
+	busy = mdev->mali_metrics.time_busy;
+	total = busy + mdev->mali_metrics.time_idle;
+
+	/* Reset stats if older than MALI_UTILIZATION_MAX_PERIOD (default
+	 * 100ms) */
+	if (total >= MALI_UTILIZATION_MAX_PERIOD) {
+		mali_pm_reset_dvfs_utilisation_unlocked(mdev, now);
+	} else if (total < (MALI_UTILIZATION_MAX_PERIOD / 2)) {
+		total += mdev->mali_metrics.prev_idle +
+			 mdev->mali_metrics.prev_busy;
+		busy += mdev->mali_metrics.prev_busy;
+	}
+
+	*total_out = (unsigned long)total;
+	*busy_out = (unsigned long)busy;
+	_mali_osk_spinlock_irq_unlock(mdev->mali_metrics.lock);
+}
+
+void mali_pm_metrics_spin_lock(void)
+{
+	struct mali_device *mdev = dev_get_drvdata(&mali_platform_device->dev);
+	_mali_osk_spinlock_irq_lock(mdev->mali_metrics.lock);
+}
+
+void mali_pm_metrics_spin_unlock(void)
+{
+	struct mali_device *mdev = dev_get_drvdata(&mali_platform_device->dev);
+	_mali_osk_spinlock_irq_unlock(mdev->mali_metrics.lock);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pm_metrics.h b/drivers/gpu/arm/mali400/common/mali_pm_metrics.h
--- a/drivers/gpu/arm/mali400/common/mali_pm_metrics.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pm_metrics.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PM_METRICS_H__
+#define __MALI_PM_METRICS_H__
+
+#ifdef CONFIG_MALI_DEVFREQ
+#include "mali_osk_locks.h"
+#include "mali_group.h"
+
+struct mali_device;
+
+/**
+ * Metrics data collected for use by the power management framework.
+ */
+struct mali_pm_metrics_data {
+	ktime_t time_period_start;
+	u64 time_busy;
+	u64 time_idle;
+	u64 prev_busy;
+	u64 prev_idle;
+	u32 num_running_gp_cores;
+	u32 num_running_pp_cores;
+	ktime_t time_period_start_gp;
+	u64 time_busy_gp;
+	u64 time_idle_gp;
+	ktime_t time_period_start_pp;
+	u64 time_busy_pp[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS];
+	u64 time_idle_pp[MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS];
+	mali_bool gpu_active;
+	_mali_osk_spinlock_irq_t *lock;
+};
+
+/**
+ * Initialize/start the Mali GPU pm_metrics metrics reporting.
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t mali_pm_metrics_init(struct mali_device *mdev);
+
+/**
+ * Terminate the Mali GPU pm_metrics metrics reporting
+ */
+void mali_pm_metrics_term(struct mali_device *mdev);
+
+/**
+ * Should be called when a job is about to execute a GPU job
+ */
+void mali_pm_record_gpu_active(mali_bool is_gp);
+
+/**
+ * Should be called when a job is finished
+ */
+void mali_pm_record_gpu_idle(mali_bool is_gp);
+
+void mali_pm_reset_dvfs_utilisation(struct mali_device *mdev);
+
+void mali_pm_get_dvfs_utilisation(struct mali_device *mdev, unsigned long *total_out, unsigned long *busy_out);
+
+void mali_pm_metrics_spin_lock(void);
+
+void mali_pm_metrics_spin_unlock(void);
+#else
+void mali_pm_record_gpu_idle(mali_bool is_gp) {}
+void mali_pm_record_gpu_active(mali_bool is_gp) {}
+#endif
+#endif /* __MALI_PM_METRICS_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pmu.c b/drivers/gpu/arm/mali400/common/mali_pmu.c
--- a/drivers/gpu/arm/mali400/common/mali_pmu.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pmu.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_pmu.c
+ * Mali driver functions for Mali 400 PMU hardware
+ */
+#include "mali_hw_core.h"
+#include "mali_pmu.h"
+#include "mali_pp.h"
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_pm.h"
+#include "mali_osk_mali.h"
+
+struct mali_pmu_core *mali_global_pmu_core = NULL;
+
+static _mali_osk_errcode_t mali_pmu_wait_for_command_finish(
+	struct mali_pmu_core *pmu);
+
+struct mali_pmu_core *mali_pmu_create(_mali_osk_resource_t *resource)
+{
+	struct mali_pmu_core *pmu;
+
+	MALI_DEBUG_ASSERT(NULL == mali_global_pmu_core);
+	MALI_DEBUG_PRINT(2, ("Mali PMU: Creating Mali PMU core\n"));
+
+	pmu = (struct mali_pmu_core *)_mali_osk_malloc(
+		      sizeof(struct mali_pmu_core));
+	if (NULL != pmu) {
+		pmu->registered_cores_mask = 0; /* to be set later */
+
+		if (_MALI_OSK_ERR_OK == mali_hw_core_create(&pmu->hw_core,
+				resource, PMU_REGISTER_ADDRESS_SPACE_SIZE)) {
+
+			pmu->switch_delay = _mali_osk_get_pmu_switch_delay();
+
+			mali_global_pmu_core = pmu;
+
+			return pmu;
+		}
+		_mali_osk_free(pmu);
+	}
+
+	return NULL;
+}
+
+void mali_pmu_delete(struct mali_pmu_core *pmu)
+{
+	MALI_DEBUG_ASSERT_POINTER(pmu);
+	MALI_DEBUG_ASSERT(pmu == mali_global_pmu_core);
+
+	MALI_DEBUG_PRINT(2, ("Mali PMU: Deleting Mali PMU core\n"));
+
+	mali_global_pmu_core = NULL;
+
+	mali_hw_core_delete(&pmu->hw_core);
+	_mali_osk_free(pmu);
+}
+
+void mali_pmu_set_registered_cores_mask(struct mali_pmu_core *pmu, u32 mask)
+{
+	pmu->registered_cores_mask = mask;
+}
+
+void mali_pmu_reset(struct mali_pmu_core *pmu)
+{
+	MALI_DEBUG_ASSERT_POINTER(pmu);
+	MALI_DEBUG_ASSERT(pmu->registered_cores_mask != 0);
+
+	/* Setup the desired defaults */
+	mali_hw_core_register_write_relaxed(&pmu->hw_core,
+					    PMU_REG_ADDR_MGMT_INT_MASK, 0);
+	mali_hw_core_register_write_relaxed(&pmu->hw_core,
+					    PMU_REG_ADDR_MGMT_SW_DELAY, pmu->switch_delay);
+}
+
+void mali_pmu_power_up_all(struct mali_pmu_core *pmu)
+{
+	u32 stat;
+
+	MALI_DEBUG_ASSERT_POINTER(pmu);
+	MALI_DEBUG_ASSERT(pmu->registered_cores_mask != 0);
+
+	mali_pm_exec_lock();
+
+	mali_pmu_reset(pmu);
+
+	/* Now simply power up the domains which are marked as powered down */
+	stat = mali_hw_core_register_read(&pmu->hw_core,
+					  PMU_REG_ADDR_MGMT_STATUS);
+	mali_pmu_power_up(pmu, stat);
+
+	mali_pm_exec_unlock();
+}
+
+void mali_pmu_power_down_all(struct mali_pmu_core *pmu)
+{
+	u32 stat;
+
+	MALI_DEBUG_ASSERT_POINTER(pmu);
+	MALI_DEBUG_ASSERT(pmu->registered_cores_mask != 0);
+
+	mali_pm_exec_lock();
+
+	/* Now simply power down the domains which are marked as powered up */
+	stat = mali_hw_core_register_read(&pmu->hw_core,
+					  PMU_REG_ADDR_MGMT_STATUS);
+	mali_pmu_power_down(pmu, (~stat) & pmu->registered_cores_mask);
+
+	mali_pm_exec_unlock();
+}
+
+_mali_osk_errcode_t mali_pmu_power_down(struct mali_pmu_core *pmu, u32 mask)
+{
+	u32 stat;
+	_mali_osk_errcode_t err;
+
+	MALI_DEBUG_ASSERT_POINTER(pmu);
+	MALI_DEBUG_ASSERT(pmu->registered_cores_mask != 0);
+	MALI_DEBUG_ASSERT(mask <= pmu->registered_cores_mask);
+	MALI_DEBUG_ASSERT(0 == (mali_hw_core_register_read(&pmu->hw_core,
+				PMU_REG_ADDR_MGMT_INT_RAWSTAT) &
+				PMU_REG_VAL_IRQ));
+
+	MALI_DEBUG_PRINT(3,
+			 ("PMU power down: ...................... [%s]\n",
+			  mali_pm_mask_to_string(mask)));
+
+	stat = mali_hw_core_register_read(&pmu->hw_core,
+					  PMU_REG_ADDR_MGMT_STATUS);
+
+	/*
+	 * Assert that we are not powering down domains which are already
+	 * powered down.
+	 */
+	MALI_DEBUG_ASSERT(0 == (stat & mask));
+
+	mask  &= ~(0x1 << MALI_DOMAIN_INDEX_DUMMY);
+
+	if (0 == mask || 0 == ((~stat) & mask)) return _MALI_OSK_ERR_OK;
+
+	mali_hw_core_register_write(&pmu->hw_core,
+				    PMU_REG_ADDR_MGMT_POWER_DOWN, mask);
+
+	/*
+	 * Do not wait for interrupt on Mali-300/400 if all domains are
+	 * powered off by our power down command, because the HW will simply
+	 * not generate an interrupt in this case.
+	 */
+	if (mali_is_mali450() || mali_is_mali470() || pmu->registered_cores_mask != (mask | stat)) {
+		err = mali_pmu_wait_for_command_finish(pmu);
+		if (_MALI_OSK_ERR_OK != err) {
+			return err;
+		}
+	} else {
+		mali_hw_core_register_write(&pmu->hw_core,
+					    PMU_REG_ADDR_MGMT_INT_CLEAR, PMU_REG_VAL_IRQ);
+	}
+
+#if defined(DEBUG)
+	/* Verify power status of domains after power down */
+	stat = mali_hw_core_register_read(&pmu->hw_core,
+					  PMU_REG_ADDR_MGMT_STATUS);
+	MALI_DEBUG_ASSERT(mask == (stat & mask));
+#endif
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_pmu_power_up(struct mali_pmu_core *pmu, u32 mask)
+{
+	u32 stat;
+	_mali_osk_errcode_t err;
+#if !defined(CONFIG_MALI_PMU_PARALLEL_POWER_UP)
+	u32 current_domain;
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(pmu);
+	MALI_DEBUG_ASSERT(pmu->registered_cores_mask != 0);
+	MALI_DEBUG_ASSERT(mask <= pmu->registered_cores_mask);
+	MALI_DEBUG_ASSERT(0 == (mali_hw_core_register_read(&pmu->hw_core,
+				PMU_REG_ADDR_MGMT_INT_RAWSTAT) &
+				PMU_REG_VAL_IRQ));
+
+	MALI_DEBUG_PRINT(3,
+			 ("PMU power up: ........................ [%s]\n",
+			  mali_pm_mask_to_string(mask)));
+
+	stat = mali_hw_core_register_read(&pmu->hw_core,
+					  PMU_REG_ADDR_MGMT_STATUS);
+	stat &= pmu->registered_cores_mask;
+
+	mask  &= ~(0x1 << MALI_DOMAIN_INDEX_DUMMY);
+	if (0 == mask || 0 == (stat & mask)) return _MALI_OSK_ERR_OK;
+
+	/*
+	 * Assert that we are only powering up domains which are currently
+	 * powered down.
+	 */
+	MALI_DEBUG_ASSERT(mask == (stat & mask));
+
+#if defined(CONFIG_MALI_PMU_PARALLEL_POWER_UP)
+	mali_hw_core_register_write(&pmu->hw_core,
+				    PMU_REG_ADDR_MGMT_POWER_UP, mask);
+
+	err = mali_pmu_wait_for_command_finish(pmu);
+	if (_MALI_OSK_ERR_OK != err) {
+		return err;
+	}
+#else
+	for (current_domain = 1;
+	     current_domain <= pmu->registered_cores_mask;
+	     current_domain <<= 1) {
+		if (current_domain & mask & stat) {
+			mali_hw_core_register_write(&pmu->hw_core,
+						    PMU_REG_ADDR_MGMT_POWER_UP,
+						    current_domain);
+
+			err = mali_pmu_wait_for_command_finish(pmu);
+			if (_MALI_OSK_ERR_OK != err) {
+				return err;
+			}
+		}
+	}
+#endif
+
+#if defined(DEBUG)
+	/* Verify power status of domains after power up */
+	stat = mali_hw_core_register_read(&pmu->hw_core,
+					  PMU_REG_ADDR_MGMT_STATUS);
+	MALI_DEBUG_ASSERT(0 == (stat & mask));
+#endif /* defined(DEBUG) */
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static _mali_osk_errcode_t mali_pmu_wait_for_command_finish(
+	struct mali_pmu_core *pmu)
+{
+	u32 rawstat;
+	u32 timeout = MALI_REG_POLL_COUNT_SLOW;
+
+	MALI_DEBUG_ASSERT(pmu);
+
+	/* Wait for the command to complete */
+	do {
+		rawstat = mali_hw_core_register_read(&pmu->hw_core,
+						     PMU_REG_ADDR_MGMT_INT_RAWSTAT);
+		--timeout;
+	} while (0 == (rawstat & PMU_REG_VAL_IRQ) && 0 < timeout);
+
+	MALI_DEBUG_ASSERT(0 < timeout);
+
+	if (0 == timeout) {
+		return _MALI_OSK_ERR_TIMEOUT;
+	}
+
+	mali_hw_core_register_write(&pmu->hw_core,
+				    PMU_REG_ADDR_MGMT_INT_CLEAR, PMU_REG_VAL_IRQ);
+
+	return _MALI_OSK_ERR_OK;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pmu.h b/drivers/gpu/arm/mali400/common/mali_pmu.h
--- a/drivers/gpu/arm/mali400/common/mali_pmu.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pmu.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_platform.h
+ * Platform specific Mali driver functions
+ */
+
+#ifndef __MALI_PMU_H__
+#define __MALI_PMU_H__
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_hw_core.h"
+
+/** @brief MALI inbuilt PMU hardware info and PMU hardware has knowledge of cores power mask
+ */
+struct mali_pmu_core {
+	struct mali_hw_core hw_core;
+	u32 registered_cores_mask;
+	u32 switch_delay;
+};
+
+/** @brief Register layout for hardware PMU
+ */
+typedef enum {
+	PMU_REG_ADDR_MGMT_POWER_UP                  = 0x00,     /*< Power up register */
+	PMU_REG_ADDR_MGMT_POWER_DOWN                = 0x04,     /*< Power down register */
+	PMU_REG_ADDR_MGMT_STATUS                    = 0x08,     /*< Core sleep status register */
+	PMU_REG_ADDR_MGMT_INT_MASK                  = 0x0C,     /*< Interrupt mask register */
+	PMU_REG_ADDR_MGMT_INT_RAWSTAT               = 0x10,     /*< Interrupt raw status register */
+	PMU_REG_ADDR_MGMT_INT_CLEAR                 = 0x18,     /*< Interrupt clear register */
+	PMU_REG_ADDR_MGMT_SW_DELAY                  = 0x1C,     /*< Switch delay register */
+	PMU_REGISTER_ADDRESS_SPACE_SIZE             = 0x28,     /*< Size of register space */
+} pmu_reg_addr_mgmt_addr;
+
+#define PMU_REG_VAL_IRQ 1
+
+extern struct mali_pmu_core *mali_global_pmu_core;
+
+/** @brief Initialisation of MALI PMU
+ *
+ * This is called from entry point of the driver in order to create and intialize the PMU resource
+ *
+ * @param resource it will be a pointer to a PMU resource
+ * @param number_of_pp_cores Number of found PP resources in configuration
+ * @param number_of_l2_caches Number of found L2 cache resources in configuration
+ * @return The created PMU object, or NULL in case of failure.
+ */
+struct mali_pmu_core *mali_pmu_create(_mali_osk_resource_t *resource);
+
+/** @brief It deallocates the PMU resource
+ *
+ * This is called on the exit of the driver to terminate the PMU resource
+ *
+ * @param pmu Pointer to PMU core object to delete
+ */
+void mali_pmu_delete(struct mali_pmu_core *pmu);
+
+/** @brief Set registered cores mask
+ *
+ * @param pmu Pointer to PMU core object
+ * @param mask All available/valid domain bits
+ */
+void mali_pmu_set_registered_cores_mask(struct mali_pmu_core *pmu, u32 mask);
+
+/** @brief Retrieves the Mali PMU core object (if any)
+ *
+ * @return The Mali PMU object, or NULL if no PMU exists.
+ */
+MALI_STATIC_INLINE struct mali_pmu_core *mali_pmu_get_global_pmu_core(void)
+{
+	return mali_global_pmu_core;
+}
+
+/** @brief Reset PMU core
+ *
+ * @param pmu Pointer to PMU core object to reset
+ */
+void mali_pmu_reset(struct mali_pmu_core *pmu);
+
+void mali_pmu_power_up_all(struct mali_pmu_core *pmu);
+
+void mali_pmu_power_down_all(struct mali_pmu_core *pmu);
+
+/** @brief Returns a mask of the currently powered up domains
+ *
+ * @param pmu Pointer to PMU core object
+ */
+MALI_STATIC_INLINE u32 mali_pmu_get_mask(struct mali_pmu_core *pmu)
+{
+	u32 stat = mali_hw_core_register_read(&pmu->hw_core, PMU_REG_ADDR_MGMT_STATUS);
+	return ((~stat) & pmu->registered_cores_mask);
+}
+
+/** @brief MALI GPU power down using MALI in-built PMU
+ *
+ * Called to power down the specified cores.
+ *
+ * @param pmu Pointer to PMU core object to power down
+ * @param mask Mask specifying which power domains to power down
+ * @return _MALI_OSK_ERR_OK on success otherwise, a suitable _mali_osk_errcode_t error.
+ */
+_mali_osk_errcode_t mali_pmu_power_down(struct mali_pmu_core *pmu, u32 mask);
+
+/** @brief MALI GPU power up using MALI in-built PMU
+ *
+ * Called to power up the specified cores.
+ *
+ * @param pmu Pointer to PMU core object to power up
+ * @param mask Mask specifying which power domains to power up
+ * @return _MALI_OSK_ERR_OK on success otherwise, a suitable _mali_osk_errcode_t error.
+ */
+_mali_osk_errcode_t mali_pmu_power_up(struct mali_pmu_core *pmu, u32 mask);
+
+#endif /* __MALI_PMU_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pp.c b/drivers/gpu/arm/mali400/common/mali_pp.c
--- a/drivers/gpu/arm/mali400/common/mali_pp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pp.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,502 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_pp_job.h"
+#include "mali_pp.h"
+#include "mali_hw_core.h"
+#include "mali_group.h"
+#include "regs/mali_200_regs.h"
+#include "mali_kernel_common.h"
+#include "mali_kernel_core.h"
+
+#if defined(CONFIG_MALI400_PROFILING)
+#include "mali_osk_profiling.h"
+#endif
+
+/* Number of frame registers on Mali-200 */
+#define MALI_PP_MALI200_NUM_FRAME_REGISTERS ((0x04C/4)+1)
+/* Number of frame registers on Mali-300 and later */
+#define MALI_PP_MALI400_NUM_FRAME_REGISTERS ((0x058/4)+1)
+
+static struct mali_pp_core *mali_global_pp_cores[MALI_MAX_NUMBER_OF_PP_CORES] = { NULL };
+static u32 mali_global_num_pp_cores = 0;
+
+/* Interrupt handlers */
+static void mali_pp_irq_probe_trigger(void *data);
+static _mali_osk_errcode_t mali_pp_irq_probe_ack(void *data);
+
+struct mali_pp_core *mali_pp_create(const _mali_osk_resource_t *resource, struct mali_group *group, mali_bool is_virtual, u32 bcast_id)
+{
+	struct mali_pp_core *core = NULL;
+
+	MALI_DEBUG_PRINT(2, ("Mali PP: Creating Mali PP core: %s\n", resource->description));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Base address of PP core: 0x%x\n", resource->base));
+
+	if (mali_global_num_pp_cores >= MALI_MAX_NUMBER_OF_PP_CORES) {
+		MALI_PRINT_ERROR(("Mali PP: Too many PP core objects created\n"));
+		return NULL;
+	}
+
+	core = _mali_osk_calloc(1, sizeof(struct mali_pp_core));
+	if (NULL != core) {
+		core->core_id = mali_global_num_pp_cores;
+		core->bcast_id = bcast_id;
+
+		if (_MALI_OSK_ERR_OK == mali_hw_core_create(&core->hw_core, resource, MALI200_REG_SIZEOF_REGISTER_BANK)) {
+			_mali_osk_errcode_t ret;
+
+			if (!is_virtual) {
+				ret = mali_pp_reset(core);
+			} else {
+				ret = _MALI_OSK_ERR_OK;
+			}
+
+			if (_MALI_OSK_ERR_OK == ret) {
+				ret = mali_group_add_pp_core(group, core);
+				if (_MALI_OSK_ERR_OK == ret) {
+					/* Setup IRQ handlers (which will do IRQ probing if needed) */
+					MALI_DEBUG_ASSERT(!is_virtual || -1 != resource->irq);
+
+					core->irq = _mali_osk_irq_init(resource->irq,
+								       mali_group_upper_half_pp,
+								       group,
+								       mali_pp_irq_probe_trigger,
+								       mali_pp_irq_probe_ack,
+								       core,
+								       resource->description);
+					if (NULL != core->irq) {
+						mali_global_pp_cores[mali_global_num_pp_cores] = core;
+						mali_global_num_pp_cores++;
+
+						return core;
+					} else {
+						MALI_PRINT_ERROR(("Mali PP: Failed to setup interrupt handlers for PP core %s\n", core->hw_core.description));
+					}
+					mali_group_remove_pp_core(group);
+				} else {
+					MALI_PRINT_ERROR(("Mali PP: Failed to add core %s to group\n", core->hw_core.description));
+				}
+			}
+			mali_hw_core_delete(&core->hw_core);
+		}
+
+		_mali_osk_free(core);
+	} else {
+		MALI_PRINT_ERROR(("Mali PP: Failed to allocate memory for PP core\n"));
+	}
+
+	return NULL;
+}
+
+void mali_pp_delete(struct mali_pp_core *core)
+{
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	_mali_osk_irq_term(core->irq);
+	mali_hw_core_delete(&core->hw_core);
+
+	/* Remove core from global list */
+	for (i = 0; i < mali_global_num_pp_cores; i++) {
+		if (mali_global_pp_cores[i] == core) {
+			mali_global_pp_cores[i] = NULL;
+			mali_global_num_pp_cores--;
+
+			if (i != mali_global_num_pp_cores) {
+				/* We removed a PP core from the middle of the array -- move the last
+				 * PP core to the current position to close the gap */
+				mali_global_pp_cores[i] = mali_global_pp_cores[mali_global_num_pp_cores];
+				mali_global_pp_cores[mali_global_num_pp_cores] = NULL;
+			}
+
+			break;
+		}
+	}
+
+	_mali_osk_free(core);
+}
+
+void mali_pp_stop_bus(struct mali_pp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	/* Will only send the stop bus command, and not wait for it to complete */
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_CTRL_MGMT, MALI200_REG_VAL_CTRL_MGMT_STOP_BUS);
+}
+
+_mali_osk_errcode_t mali_pp_stop_bus_wait(struct mali_pp_core *core)
+{
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	/* Send the stop bus command. */
+	mali_pp_stop_bus(core);
+
+	/* Wait for bus to be stopped */
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; i++) {
+		if (mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_STATUS) & MALI200_REG_VAL_STATUS_BUS_STOPPED)
+			break;
+	}
+
+	if (MALI_REG_POLL_COUNT_FAST == i) {
+		MALI_PRINT_ERROR(("Mali PP: Failed to stop bus on %s. Status: 0x%08x\n", core->hw_core.description, mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_STATUS)));
+		return _MALI_OSK_ERR_FAULT;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+/* Frame register reset values.
+ * Taken from the Mali400 TRM, 3.6. Pixel processor control register summary */
+static const u32 mali_frame_registers_reset_values[_MALI_PP_MAX_FRAME_REGISTERS] = {
+	0x0, /* Renderer List Address Register */
+	0x0, /* Renderer State Word Base Address Register */
+	0x0, /* Renderer Vertex Base Register */
+	0x2, /* Feature Enable Register */
+	0x0, /* Z Clear Value Register */
+	0x0, /* Stencil Clear Value Register */
+	0x0, /* ABGR Clear Value 0 Register */
+	0x0, /* ABGR Clear Value 1 Register */
+	0x0, /* ABGR Clear Value 2 Register */
+	0x0, /* ABGR Clear Value 3 Register */
+	0x0, /* Bounding Box Left Right Register */
+	0x0, /* Bounding Box Bottom Register */
+	0x0, /* FS Stack Address Register */
+	0x0, /* FS Stack Size and Initial Value Register */
+	0x0, /* Reserved */
+	0x0, /* Reserved */
+	0x0, /* Origin Offset X Register */
+	0x0, /* Origin Offset Y Register */
+	0x75, /* Subpixel Specifier Register */
+	0x0, /* Tiebreak mode Register */
+	0x0, /* Polygon List Format Register */
+	0x0, /* Scaling Register */
+	0x0 /* Tilebuffer configuration Register */
+};
+
+/* WBx register reset values */
+static const u32 mali_wb_registers_reset_values[_MALI_PP_MAX_WB_REGISTERS] = {
+	0x0, /* WBx Source Select Register */
+	0x0, /* WBx Target Address Register */
+	0x0, /* WBx Target Pixel Format Register */
+	0x0, /* WBx Target AA Format Register */
+	0x0, /* WBx Target Layout */
+	0x0, /* WBx Target Scanline Length */
+	0x0, /* WBx Target Flags Register */
+	0x0, /* WBx MRT Enable Register */
+	0x0, /* WBx MRT Offset Register */
+	0x0, /* WBx Global Test Enable Register */
+	0x0, /* WBx Global Test Reference Value Register */
+	0x0  /* WBx Global Test Compare Function Register */
+};
+
+/* Performance Counter 0 Enable Register reset value */
+static const u32 mali_perf_cnt_enable_reset_value = 0;
+
+_mali_osk_errcode_t mali_pp_hard_reset(struct mali_pp_core *core)
+{
+	/* Bus must be stopped before calling this function */
+	const u32 reset_wait_target_register = MALI200_REG_ADDR_MGMT_PERF_CNT_0_LIMIT;
+	const u32 reset_invalid_value = 0xC0FFE000;
+	const u32 reset_check_value = 0xC01A0000;
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+	MALI_DEBUG_PRINT(2, ("Mali PP: Hard reset of core %s\n", core->hw_core.description));
+
+	/* Set register to a bogus value. The register will be used to detect when reset is complete */
+	mali_hw_core_register_write_relaxed(&core->hw_core, reset_wait_target_register, reset_invalid_value);
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, MALI200_REG_VAL_IRQ_MASK_NONE);
+
+	/* Force core to reset */
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_CTRL_MGMT, MALI200_REG_VAL_CTRL_MGMT_FORCE_RESET);
+
+	/* Wait for reset to be complete */
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; i++) {
+		mali_hw_core_register_write(&core->hw_core, reset_wait_target_register, reset_check_value);
+		if (reset_check_value == mali_hw_core_register_read(&core->hw_core, reset_wait_target_register)) {
+			break;
+		}
+	}
+
+	if (MALI_REG_POLL_COUNT_FAST == i) {
+		MALI_PRINT_ERROR(("Mali PP: The hard reset loop didn't work, unable to recover\n"));
+	}
+
+	mali_hw_core_register_write(&core->hw_core, reset_wait_target_register, 0x00000000); /* set it back to the default */
+	/* Re-enable interrupts */
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_CLEAR, MALI200_REG_VAL_IRQ_MASK_ALL);
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, MALI200_REG_VAL_IRQ_MASK_USED);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_pp_reset_async(struct mali_pp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	MALI_DEBUG_PRINT(4, ("Mali PP: Reset of core %s\n", core->hw_core.description));
+
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, 0); /* disable the IRQs */
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_RAWSTAT, MALI200_REG_VAL_IRQ_MASK_ALL);
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_CTRL_MGMT, MALI400PP_REG_VAL_CTRL_MGMT_SOFT_RESET);
+}
+
+_mali_osk_errcode_t mali_pp_reset_wait(struct mali_pp_core *core)
+{
+	int i;
+	u32 rawstat = 0;
+
+	for (i = 0; i < MALI_REG_POLL_COUNT_FAST; i++) {
+		u32 status =  mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_STATUS);
+		if (!(status & MALI200_REG_VAL_STATUS_RENDERING_ACTIVE)) {
+			rawstat = mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_RAWSTAT);
+			if (rawstat == MALI400PP_REG_VAL_IRQ_RESET_COMPLETED) {
+				break;
+			}
+		}
+	}
+
+	if (i == MALI_REG_POLL_COUNT_FAST) {
+		MALI_PRINT_ERROR(("Mali PP: Failed to reset core %s, rawstat: 0x%08x\n",
+				  core->hw_core.description, rawstat));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Re-enable interrupts */
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_CLEAR, MALI200_REG_VAL_IRQ_MASK_ALL);
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, MALI200_REG_VAL_IRQ_MASK_USED);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_pp_reset(struct mali_pp_core *core)
+{
+	mali_pp_reset_async(core);
+	return mali_pp_reset_wait(core);
+}
+
+void mali_pp_job_start(struct mali_pp_core *core, struct mali_pp_job *job, u32 sub_job, mali_bool restart_virtual)
+{
+	u32 relative_address;
+	u32 start_index;
+	u32 nr_of_regs;
+	u32 *frame_registers = mali_pp_job_get_frame_registers(job);
+	u32 *wb0_registers = mali_pp_job_get_wb0_registers(job);
+	u32 *wb1_registers = mali_pp_job_get_wb1_registers(job);
+	u32 *wb2_registers = mali_pp_job_get_wb2_registers(job);
+	u32 counter_src0 = mali_pp_job_get_perf_counter_src0(job, sub_job);
+	u32 counter_src1 = mali_pp_job_get_perf_counter_src1(job, sub_job);
+
+	MALI_DEBUG_ASSERT_POINTER(core);
+
+	/* Write frame registers */
+
+	/*
+	 * There are two frame registers which are different for each sub job:
+	 * 1. The Renderer List Address Register (MALI200_REG_ADDR_FRAME)
+	 * 2. The FS Stack Address Register (MALI200_REG_ADDR_STACK)
+	 */
+	mali_hw_core_register_write_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_FRAME, mali_pp_job_get_addr_frame(job, sub_job), mali_frame_registers_reset_values[MALI200_REG_ADDR_FRAME / sizeof(u32)]);
+
+	/* For virtual jobs, the stack address shouldn't be broadcast but written individually */
+	if (!mali_pp_job_is_virtual(job) || restart_virtual) {
+		mali_hw_core_register_write_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_STACK, mali_pp_job_get_addr_stack(job, sub_job), mali_frame_registers_reset_values[MALI200_REG_ADDR_STACK / sizeof(u32)]);
+	}
+
+	/* Write registers between MALI200_REG_ADDR_FRAME and MALI200_REG_ADDR_STACK */
+	relative_address = MALI200_REG_ADDR_RSW;
+	start_index = MALI200_REG_ADDR_RSW / sizeof(u32);
+	nr_of_regs = (MALI200_REG_ADDR_STACK - MALI200_REG_ADDR_RSW) / sizeof(u32);
+
+	mali_hw_core_register_write_array_relaxed_conditional(&core->hw_core,
+			relative_address, &frame_registers[start_index],
+			nr_of_regs, &mali_frame_registers_reset_values[start_index]);
+
+	/* MALI200_REG_ADDR_STACK_SIZE */
+	relative_address = MALI200_REG_ADDR_STACK_SIZE;
+	start_index = MALI200_REG_ADDR_STACK_SIZE / sizeof(u32);
+
+	mali_hw_core_register_write_relaxed_conditional(&core->hw_core,
+			relative_address, frame_registers[start_index],
+			mali_frame_registers_reset_values[start_index]);
+
+	/* Skip 2 reserved registers */
+
+	/* Write remaining registers */
+	relative_address = MALI200_REG_ADDR_ORIGIN_OFFSET_X;
+	start_index = MALI200_REG_ADDR_ORIGIN_OFFSET_X / sizeof(u32);
+	nr_of_regs = MALI_PP_MALI400_NUM_FRAME_REGISTERS - MALI200_REG_ADDR_ORIGIN_OFFSET_X / sizeof(u32);
+
+	mali_hw_core_register_write_array_relaxed_conditional(&core->hw_core,
+			relative_address, &frame_registers[start_index],
+			nr_of_regs, &mali_frame_registers_reset_values[start_index]);
+
+	/* Write WBx registers */
+	if (wb0_registers[0]) { /* M200_WB0_REG_SOURCE_SELECT register */
+		mali_hw_core_register_write_array_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_WB0, wb0_registers, _MALI_PP_MAX_WB_REGISTERS, mali_wb_registers_reset_values);
+	}
+
+	if (wb1_registers[0]) { /* M200_WB1_REG_SOURCE_SELECT register */
+		mali_hw_core_register_write_array_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_WB1, wb1_registers, _MALI_PP_MAX_WB_REGISTERS, mali_wb_registers_reset_values);
+	}
+
+	if (wb2_registers[0]) { /* M200_WB2_REG_SOURCE_SELECT register */
+		mali_hw_core_register_write_array_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_WB2, wb2_registers, _MALI_PP_MAX_WB_REGISTERS, mali_wb_registers_reset_values);
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER != counter_src0) {
+		mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_0_SRC, counter_src0);
+		mali_hw_core_register_write_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_0_ENABLE, MALI200_REG_VAL_PERF_CNT_ENABLE, mali_perf_cnt_enable_reset_value);
+	}
+	if (MALI_HW_CORE_NO_COUNTER != counter_src1) {
+		mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_1_SRC, counter_src1);
+		mali_hw_core_register_write_relaxed_conditional(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_1_ENABLE, MALI200_REG_VAL_PERF_CNT_ENABLE, mali_perf_cnt_enable_reset_value);
+	}
+
+#ifdef CONFIG_MALI400_HEATMAPS_ENABLED
+	if (job->uargs.perf_counter_flag & _MALI_PERFORMANCE_COUNTER_FLAG_HEATMAP_ENABLE) {
+		mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_MGMT_PERFMON_CONTR, ((job->uargs.tilesx & 0x3FF) << 16) | 1);
+		mali_hw_core_register_write_relaxed(&core->hw_core,  MALI200_REG_ADDR_MGMT_PERFMON_BASE, job->uargs.heatmap_mem & 0xFFFFFFF8);
+	}
+#endif /* CONFIG_MALI400_HEATMAPS_ENABLED */
+
+	MALI_DEBUG_PRINT(3, ("Mali PP: Starting job 0x%08X part %u/%u on PP core %s\n", job, sub_job + 1, mali_pp_job_get_sub_job_count(job), core->hw_core.description));
+
+	/* Adding barrier to make sure all rester writes are finished */
+	_mali_osk_write_mem_barrier();
+
+	/* This is the command that starts the core.
+	 *
+	 * Don't actually run the job if PROFILING_SKIP_PP_JOBS are set, just
+	 * force core to assert the completion interrupt.
+	 */
+#if !defined(PROFILING_SKIP_PP_JOBS)
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_MGMT_CTRL_MGMT, MALI200_REG_VAL_CTRL_MGMT_START_RENDERING);
+#else
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_RAWSTAT, MALI200_REG_VAL_IRQ_END_OF_FRAME);
+#endif
+
+	/* Adding barrier to make sure previous rester writes is finished */
+	_mali_osk_write_mem_barrier();
+}
+
+u32 mali_pp_core_get_version(struct mali_pp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	return mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_VERSION);
+}
+
+struct mali_pp_core *mali_pp_get_global_pp_core(u32 index)
+{
+	if (mali_global_num_pp_cores > index) {
+		return mali_global_pp_cores[index];
+	}
+
+	return NULL;
+}
+
+u32 mali_pp_get_glob_num_pp_cores(void)
+{
+	return mali_global_num_pp_cores;
+}
+
+/* ------------- interrupt handling below ------------------ */
+static void mali_pp_irq_probe_trigger(void *data)
+{
+	struct mali_pp_core *core = (struct mali_pp_core *)data;
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, MALI200_REG_VAL_IRQ_MASK_USED);
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_RAWSTAT, MALI200_REG_VAL_IRQ_BUS_ERROR);
+	_mali_osk_mem_barrier();
+}
+
+static _mali_osk_errcode_t mali_pp_irq_probe_ack(void *data)
+{
+	struct mali_pp_core *core = (struct mali_pp_core *)data;
+	u32 irq_readout;
+
+	irq_readout = mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_STATUS);
+	if (MALI200_REG_VAL_IRQ_BUS_ERROR & irq_readout) {
+		mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_CLEAR, MALI200_REG_VAL_IRQ_BUS_ERROR);
+		_mali_osk_mem_barrier();
+		return _MALI_OSK_ERR_OK;
+	}
+
+	return _MALI_OSK_ERR_FAULT;
+}
+
+
+#if 0
+static void mali_pp_print_registers(struct mali_pp_core *core)
+{
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_VERSION = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_VERSION)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_CURRENT_REND_LIST_ADDR = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_CURRENT_REND_LIST_ADDR)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_STATUS = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_STATUS)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_INT_RAWSTAT = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_RAWSTAT)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_INT_MASK = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_INT_STATUS = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_STATUS)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_BUS_ERROR_STATUS = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_BUS_ERROR_STATUS)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_PERF_CNT_0_ENABLE = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_0_ENABLE)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_PERF_CNT_0_SRC = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_0_SRC)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_PERF_CNT_0_VALUE = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_0_VALUE)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_PERF_CNT_1_ENABLE = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_1_ENABLE)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_PERF_CNT_1_SRC = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_1_SRC)));
+	MALI_DEBUG_PRINT(2, ("Mali PP: Register MALI200_REG_ADDR_MGMT_PERF_CNT_1_VALUE = 0x%08X\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_1_VALUE)));
+}
+#endif
+
+#if 0
+void mali_pp_print_state(struct mali_pp_core *core)
+{
+	MALI_DEBUG_PRINT(2, ("Mali PP: State: 0x%08x\n", mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_STATUS)));
+}
+#endif
+
+void mali_pp_update_performance_counters(struct mali_pp_core *parent, struct mali_pp_core *child, struct mali_pp_job *job, u32 subjob)
+{
+	u32 val0 = 0;
+	u32 val1 = 0;
+	u32 counter_src0 = mali_pp_job_get_perf_counter_src0(job, subjob);
+	u32 counter_src1 = mali_pp_job_get_perf_counter_src1(job, subjob);
+#if defined(CONFIG_MALI400_PROFILING)
+	int counter_index = COUNTER_FP_0_C0 + (2 * child->core_id);
+#endif
+
+	if (MALI_HW_CORE_NO_COUNTER != counter_src0) {
+		val0 = mali_hw_core_register_read(&child->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_0_VALUE);
+		mali_pp_job_set_perf_counter_value0(job, subjob, val0);
+
+#if defined(CONFIG_MALI400_PROFILING)
+		_mali_osk_profiling_report_hw_counter(counter_index, val0);
+		_mali_osk_profiling_record_global_counters(counter_index, val0);
+#endif
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER != counter_src1) {
+		val1 = mali_hw_core_register_read(&child->hw_core, MALI200_REG_ADDR_MGMT_PERF_CNT_1_VALUE);
+		mali_pp_job_set_perf_counter_value1(job, subjob, val1);
+
+#if defined(CONFIG_MALI400_PROFILING)
+		_mali_osk_profiling_report_hw_counter(counter_index + 1, val1);
+		_mali_osk_profiling_record_global_counters(counter_index + 1, val1);
+#endif
+	}
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_pp_dump_state(struct mali_pp_core *core, char *buf, u32 size)
+{
+	int n = 0;
+
+	n += _mali_osk_snprintf(buf + n, size - n, "\tPP #%d: %s\n", core->core_id, core->hw_core.description);
+
+	return n;
+}
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pp.h b/drivers/gpu/arm/mali400/common/mali_pp.h
--- a/drivers/gpu/arm/mali400/common/mali_pp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pp.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PP_H__
+#define __MALI_PP_H__
+
+#include "mali_osk.h"
+#include "mali_pp_job.h"
+#include "mali_hw_core.h"
+
+struct mali_group;
+
+#define MALI_MAX_NUMBER_OF_PP_CORES        9
+
+/**
+ * Definition of the PP core struct
+ * Used to track a PP core in the system.
+ */
+struct mali_pp_core {
+	struct mali_hw_core  hw_core;           /**< Common for all HW cores */
+	_mali_osk_irq_t     *irq;               /**< IRQ handler */
+	u32                  core_id;           /**< Unique core ID */
+	u32                  bcast_id;          /**< The "flag" value used by the Mali-450 broadcast and DLBU unit */
+};
+
+_mali_osk_errcode_t mali_pp_initialize(void);
+void mali_pp_terminate(void);
+
+struct mali_pp_core *mali_pp_create(const _mali_osk_resource_t *resource, struct mali_group *group, mali_bool is_virtual, u32 bcast_id);
+void mali_pp_delete(struct mali_pp_core *core);
+
+void mali_pp_stop_bus(struct mali_pp_core *core);
+_mali_osk_errcode_t mali_pp_stop_bus_wait(struct mali_pp_core *core);
+void mali_pp_reset_async(struct mali_pp_core *core);
+_mali_osk_errcode_t mali_pp_reset_wait(struct mali_pp_core *core);
+_mali_osk_errcode_t mali_pp_reset(struct mali_pp_core *core);
+_mali_osk_errcode_t mali_pp_hard_reset(struct mali_pp_core *core);
+
+void mali_pp_job_start(struct mali_pp_core *core, struct mali_pp_job *job, u32 sub_job, mali_bool restart_virtual);
+
+u32 mali_pp_core_get_version(struct mali_pp_core *core);
+
+MALI_STATIC_INLINE u32 mali_pp_core_get_id(struct mali_pp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	return core->core_id;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_core_get_bcast_id(struct mali_pp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	return core->bcast_id;
+}
+
+struct mali_pp_core *mali_pp_get_global_pp_core(u32 index);
+u32 mali_pp_get_glob_num_pp_cores(void);
+
+/* Debug */
+u32 mali_pp_dump_state(struct mali_pp_core *core, char *buf, u32 size);
+
+/**
+ * Put instrumented HW counters from the core(s) to the job object (if enabled)
+ *
+ * parent and child is always the same, except for virtual jobs on Mali-450.
+ * In this case, the counters will be enabled on the virtual core (parent),
+ * but values need to be read from the child cores.
+ *
+ * @param parent The core used to see if the counters was enabled
+ * @param child The core to actually read the values from
+ * @job Job object to update with counter values (if enabled)
+ * @subjob Which subjob the counters are applicable for (core ID for virtual jobs)
+ */
+void mali_pp_update_performance_counters(struct mali_pp_core *parent, struct mali_pp_core *child, struct mali_pp_job *job, u32 subjob);
+
+MALI_STATIC_INLINE const char *mali_pp_core_description(struct mali_pp_core *core)
+{
+	return core->hw_core.description;
+}
+
+MALI_STATIC_INLINE enum mali_interrupt_result mali_pp_get_interrupt_result(struct mali_pp_core *core)
+{
+	u32 rawstat_used = mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_RAWSTAT) &
+			   MALI200_REG_VAL_IRQ_MASK_USED;
+	if (0 == rawstat_used) {
+		return MALI_INTERRUPT_RESULT_NONE;
+	} else if (MALI200_REG_VAL_IRQ_END_OF_FRAME == rawstat_used) {
+		return MALI_INTERRUPT_RESULT_SUCCESS;
+	}
+
+	return MALI_INTERRUPT_RESULT_ERROR;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_get_rawstat(struct mali_pp_core *core)
+{
+	MALI_DEBUG_ASSERT_POINTER(core);
+	return mali_hw_core_register_read(&core->hw_core,
+					  MALI200_REG_ADDR_MGMT_INT_RAWSTAT);
+}
+
+
+MALI_STATIC_INLINE u32 mali_pp_is_active(struct mali_pp_core *core)
+{
+	u32 status = mali_hw_core_register_read(&core->hw_core, MALI200_REG_ADDR_MGMT_STATUS);
+	return (status & MALI200_REG_VAL_STATUS_RENDERING_ACTIVE) ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE void mali_pp_mask_all_interrupts(struct mali_pp_core *core)
+{
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, MALI200_REG_VAL_IRQ_MASK_NONE);
+}
+
+MALI_STATIC_INLINE void mali_pp_enable_interrupts(struct mali_pp_core *core)
+{
+	mali_hw_core_register_write(&core->hw_core, MALI200_REG_ADDR_MGMT_INT_MASK, MALI200_REG_VAL_IRQ_MASK_USED);
+}
+
+MALI_STATIC_INLINE void mali_pp_write_addr_renderer_list(struct mali_pp_core *core,
+		struct mali_pp_job *job, u32 subjob)
+{
+	u32 addr = mali_pp_job_get_addr_frame(job, subjob);
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_FRAME, addr);
+}
+
+
+MALI_STATIC_INLINE void mali_pp_write_addr_stack(struct mali_pp_core *core, struct mali_pp_job *job)
+{
+	u32 addr = mali_pp_job_get_addr_stack(job, core->core_id);
+	mali_hw_core_register_write_relaxed(&core->hw_core, MALI200_REG_ADDR_STACK, addr);
+}
+
+#endif /* __MALI_PP_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pp_job.c b/drivers/gpu/arm/mali400/common/mali_pp_job.c
--- a/drivers/gpu/arm/mali400/common/mali_pp_job.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pp_job.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_pp.h"
+#include "mali_pp_job.h"
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_kernel_common.h"
+#include "mali_uk_types.h"
+#include "mali_executor.h"
+#if defined(CONFIG_DMA_SHARED_BUFFER) && !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+#include "linux/mali_memory_dma_buf.h"
+#endif
+#include "mali_memory_swap_alloc.h"
+#include "mali_scheduler.h"
+
+static u32 pp_counter_src0 = MALI_HW_CORE_NO_COUNTER;   /**< Performance counter 0, MALI_HW_CORE_NO_COUNTER for disabled */
+static u32 pp_counter_src1 = MALI_HW_CORE_NO_COUNTER;   /**< Performance counter 1, MALI_HW_CORE_NO_COUNTER for disabled */
+static _mali_osk_atomic_t pp_counter_per_sub_job_count; /**< Number of values in the two arrays which is != MALI_HW_CORE_NO_COUNTER */
+static u32 pp_counter_per_sub_job_src0[_MALI_PP_MAX_SUB_JOBS] = { MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER };
+static u32 pp_counter_per_sub_job_src1[_MALI_PP_MAX_SUB_JOBS] = { MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER, MALI_HW_CORE_NO_COUNTER };
+
+void mali_pp_job_initialize(void)
+{
+	_mali_osk_atomic_init(&pp_counter_per_sub_job_count, 0);
+}
+
+void mali_pp_job_terminate(void)
+{
+	_mali_osk_atomic_term(&pp_counter_per_sub_job_count);
+}
+
+struct mali_pp_job *mali_pp_job_create(struct mali_session_data *session,
+				       _mali_uk_pp_start_job_s __user *uargs, u32 id)
+{
+	struct mali_pp_job *job;
+	u32 perf_counter_flag;
+
+	job = _mali_osk_calloc(1, sizeof(struct mali_pp_job));
+	if (NULL != job) {
+		_mali_osk_list_init(&job->list);
+		_mali_osk_list_init(&job->session_fb_lookup_list);
+		_mali_osk_atomic_inc(&session->number_of_pp_jobs);
+
+		if (0 != _mali_osk_copy_from_user(&job->uargs, uargs, sizeof(_mali_uk_pp_start_job_s))) {
+			goto fail;
+		}
+
+		if (job->uargs.num_cores > _MALI_PP_MAX_SUB_JOBS) {
+			MALI_PRINT_ERROR(("Mali PP job: Too many sub jobs specified in job object\n"));
+			goto fail;
+		}
+
+		if (!mali_pp_job_use_no_notification(job)) {
+			job->finished_notification = _mali_osk_notification_create(_MALI_NOTIFICATION_PP_FINISHED, sizeof(_mali_uk_pp_job_finished_s));
+			if (NULL == job->finished_notification) goto fail;
+		}
+
+		perf_counter_flag = mali_pp_job_get_perf_counter_flag(job);
+
+		/* case when no counters came from user space
+		 * so pass the debugfs / DS-5 provided global ones to the job object */
+		if (!((perf_counter_flag & _MALI_PERFORMANCE_COUNTER_FLAG_SRC0_ENABLE) ||
+		      (perf_counter_flag & _MALI_PERFORMANCE_COUNTER_FLAG_SRC1_ENABLE))) {
+			u32 sub_job_count = _mali_osk_atomic_read(&pp_counter_per_sub_job_count);
+
+			/* These counters apply for all virtual jobs, and where no per sub job counter is specified */
+			job->uargs.perf_counter_src0 = pp_counter_src0;
+			job->uargs.perf_counter_src1 = pp_counter_src1;
+
+			/* We only copy the per sub job array if it is enabled with at least one counter */
+			if (0 < sub_job_count) {
+				job->perf_counter_per_sub_job_count = sub_job_count;
+				_mali_osk_memcpy(job->perf_counter_per_sub_job_src0, pp_counter_per_sub_job_src0, sizeof(pp_counter_per_sub_job_src0));
+				_mali_osk_memcpy(job->perf_counter_per_sub_job_src1, pp_counter_per_sub_job_src1, sizeof(pp_counter_per_sub_job_src1));
+			}
+		}
+
+		job->session = session;
+		job->id = id;
+
+		job->sub_jobs_num = job->uargs.num_cores ? job->uargs.num_cores : 1;
+		job->pid = _mali_osk_get_pid();
+		job->tid = _mali_osk_get_tid();
+
+		_mali_osk_atomic_init(&job->sub_jobs_completed, 0);
+		_mali_osk_atomic_init(&job->sub_job_errors, 0);
+		job->swap_status = MALI_NO_SWAP_IN;
+		job->user_notification = MALI_FALSE;
+		job->num_pp_cores_in_virtual = 0;
+
+		if (job->uargs.num_memory_cookies > session->allocation_mgr.mali_allocation_num) {
+			MALI_PRINT_ERROR(("Mali PP job: The number of memory cookies is invalid !\n"));
+			goto fail;
+		}
+
+		if (job->uargs.num_memory_cookies > 0) {
+			u32 size;
+			u32 __user *memory_cookies = (u32 __user *)(uintptr_t)job->uargs.memory_cookies;
+
+			size = sizeof(*memory_cookies) * (job->uargs.num_memory_cookies);
+
+			job->memory_cookies = _mali_osk_malloc(size);
+			if (NULL == job->memory_cookies) {
+				MALI_PRINT_ERROR(("Mali PP job: Failed to allocate %d bytes of memory cookies!\n", size));
+				goto fail;
+			}
+
+			if (0 != _mali_osk_copy_from_user(job->memory_cookies, memory_cookies, size)) {
+				MALI_PRINT_ERROR(("Mali PP job: Failed to copy %d bytes of memory cookies from user!\n", size));
+				goto fail;
+			}
+		}
+
+		if (_MALI_OSK_ERR_OK != mali_pp_job_check(job)) {
+			/* Not a valid job. */
+			goto fail;
+		}
+
+		mali_timeline_tracker_init(&job->tracker, MALI_TIMELINE_TRACKER_PP, NULL, job);
+		mali_timeline_fence_copy_uk_fence(&(job->tracker.fence), &(job->uargs.fence));
+
+		mali_mem_swap_in_pages(job);
+
+		return job;
+	}
+
+fail:
+	if (NULL != job) {
+		mali_pp_job_delete(job);
+	}
+
+	return NULL;
+}
+
+void mali_pp_job_delete(struct mali_pp_job *job)
+{
+	struct mali_session_data *session;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(&job->list));
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(&job->session_fb_lookup_list));
+
+	session = mali_pp_job_get_session(job);
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (NULL != job->memory_cookies) {
+#if defined(CONFIG_DMA_SHARED_BUFFER) && !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+		/* Unmap buffers attached to job */
+		mali_dma_buf_unmap_job(job);
+#endif
+		if (MALI_NO_SWAP_IN != job->swap_status) {
+			mali_mem_swap_out_pages(job);
+		}
+
+		_mali_osk_free(job->memory_cookies);
+	}
+
+	if (job->user_notification) {
+		mali_scheduler_return_pp_job_to_user(job,
+						     job->num_pp_cores_in_virtual);
+	}
+
+	if (NULL != job->finished_notification) {
+		_mali_osk_notification_delete(job->finished_notification);
+	}
+
+	_mali_osk_atomic_term(&job->sub_jobs_completed);
+	_mali_osk_atomic_term(&job->sub_job_errors);
+	_mali_osk_atomic_dec(&session->number_of_pp_jobs);
+	_mali_osk_free(job);
+
+	_mali_osk_wait_queue_wake_up(session->wait_queue);
+}
+
+void mali_pp_job_list_add(struct mali_pp_job *job, _mali_osk_list_t *list)
+{
+	struct mali_pp_job *iter;
+	struct mali_pp_job *tmp;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+
+	/* Find position in list/queue where job should be added. */
+	_MALI_OSK_LIST_FOREACHENTRY_REVERSE(iter, tmp, list,
+					    struct mali_pp_job, list) {
+		/* job should be started after iter if iter is in progress. */
+		if (0 < iter->sub_jobs_started) {
+			break;
+		}
+
+		/*
+		 * job should be started after iter if it has a higher
+		 * job id. A span is used to handle job id wrapping.
+		 */
+		if ((mali_pp_job_get_id(job) -
+		     mali_pp_job_get_id(iter)) <
+		    MALI_SCHEDULER_JOB_ID_SPAN) {
+			break;
+		}
+	}
+
+	_mali_osk_list_add(&job->list, &iter->list);
+}
+
+
+u32 mali_pp_job_get_perf_counter_src0(struct mali_pp_job *job, u32 sub_job)
+{
+	/* Virtual jobs always use the global job counter (or if there are per sub job counters at all) */
+	if (mali_pp_job_is_virtual(job) || 0 == job->perf_counter_per_sub_job_count) {
+		return job->uargs.perf_counter_src0;
+	}
+
+	/* Use per sub job counter if enabled... */
+	if (MALI_HW_CORE_NO_COUNTER != job->perf_counter_per_sub_job_src0[sub_job]) {
+		return job->perf_counter_per_sub_job_src0[sub_job];
+	}
+
+	/* ...else default to global job counter */
+	return job->uargs.perf_counter_src0;
+}
+
+u32 mali_pp_job_get_perf_counter_src1(struct mali_pp_job *job, u32 sub_job)
+{
+	/* Virtual jobs always use the global job counter (or if there are per sub job counters at all) */
+	if (mali_pp_job_is_virtual(job) || 0 == job->perf_counter_per_sub_job_count) {
+		/* Virtual jobs always use the global job counter */
+		return job->uargs.perf_counter_src1;
+	}
+
+	/* Use per sub job counter if enabled... */
+	if (MALI_HW_CORE_NO_COUNTER != job->perf_counter_per_sub_job_src1[sub_job]) {
+		return job->perf_counter_per_sub_job_src1[sub_job];
+	}
+
+	/* ...else default to global job counter */
+	return job->uargs.perf_counter_src1;
+}
+
+void mali_pp_job_set_pp_counter_global_src0(u32 counter)
+{
+	pp_counter_src0 = counter;
+}
+
+void mali_pp_job_set_pp_counter_global_src1(u32 counter)
+{
+	pp_counter_src1 = counter;
+}
+
+void mali_pp_job_set_pp_counter_sub_job_src0(u32 sub_job, u32 counter)
+{
+	MALI_DEBUG_ASSERT(sub_job < _MALI_PP_MAX_SUB_JOBS);
+
+	if (MALI_HW_CORE_NO_COUNTER == pp_counter_per_sub_job_src0[sub_job]) {
+		/* increment count since existing counter was disabled */
+		_mali_osk_atomic_inc(&pp_counter_per_sub_job_count);
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER == counter) {
+		/* decrement count since new counter is disabled */
+		_mali_osk_atomic_dec(&pp_counter_per_sub_job_count);
+	}
+
+	/* PS: A change from MALI_HW_CORE_NO_COUNTER to MALI_HW_CORE_NO_COUNTER will inc and dec, result will be 0 change */
+
+	pp_counter_per_sub_job_src0[sub_job] = counter;
+}
+
+void mali_pp_job_set_pp_counter_sub_job_src1(u32 sub_job, u32 counter)
+{
+	MALI_DEBUG_ASSERT(sub_job < _MALI_PP_MAX_SUB_JOBS);
+
+	if (MALI_HW_CORE_NO_COUNTER == pp_counter_per_sub_job_src1[sub_job]) {
+		/* increment count since existing counter was disabled */
+		_mali_osk_atomic_inc(&pp_counter_per_sub_job_count);
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER == counter) {
+		/* decrement count since new counter is disabled */
+		_mali_osk_atomic_dec(&pp_counter_per_sub_job_count);
+	}
+
+	/* PS: A change from MALI_HW_CORE_NO_COUNTER to MALI_HW_CORE_NO_COUNTER will inc and dec, result will be 0 change */
+
+	pp_counter_per_sub_job_src1[sub_job] = counter;
+}
+
+u32 mali_pp_job_get_pp_counter_global_src0(void)
+{
+	return pp_counter_src0;
+}
+
+u32 mali_pp_job_get_pp_counter_global_src1(void)
+{
+	return pp_counter_src1;
+}
+
+u32 mali_pp_job_get_pp_counter_sub_job_src0(u32 sub_job)
+{
+	MALI_DEBUG_ASSERT(sub_job < _MALI_PP_MAX_SUB_JOBS);
+	return pp_counter_per_sub_job_src0[sub_job];
+}
+
+u32 mali_pp_job_get_pp_counter_sub_job_src1(u32 sub_job)
+{
+	MALI_DEBUG_ASSERT(sub_job < _MALI_PP_MAX_SUB_JOBS);
+	return pp_counter_per_sub_job_src1[sub_job];
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_pp_job.h b/drivers/gpu/arm/mali400/common/mali_pp_job.h
--- a/drivers/gpu/arm/mali400/common/mali_pp_job.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_pp_job.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,591 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PP_JOB_H__
+#define __MALI_PP_JOB_H__
+
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_uk_types.h"
+#include "mali_session.h"
+#include "mali_kernel_common.h"
+#include "regs/mali_200_regs.h"
+#include "mali_kernel_core.h"
+#include "mali_dlbu.h"
+#include "mali_timeline.h"
+#include "mali_scheduler.h"
+#include "mali_executor.h"
+#if defined(CONFIG_DMA_SHARED_BUFFER) && !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+#include "linux/mali_memory_dma_buf.h"
+#endif
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+#include "linux/mali_dma_fence.h"
+#include <linux/fence.h>
+#endif
+
+typedef enum pp_job_status {
+	MALI_NO_SWAP_IN,
+	MALI_SWAP_IN_FAIL,
+	MALI_SWAP_IN_SUCC,
+} pp_job_status;
+
+/**
+ * This structure represents a PP job, including all sub jobs.
+ *
+ * The PP job object itself is not protected by any single lock,
+ * but relies on other locks instead (scheduler, executor and timeline lock).
+ * Think of the job object as moving between these sub systems through-out
+ * its lifetime. Different part of the PP job struct is used by different
+ * subsystems. Accessor functions ensure that correct lock is taken.
+ * Do NOT access any data members directly from outside this module!
+ */
+struct mali_pp_job {
+	/*
+	 * These members are typically only set at creation,
+	 * and only read later on.
+	 * They do not require any lock protection.
+	 */
+	_mali_uk_pp_start_job_s uargs;                     /**< Arguments from user space */
+	struct mali_session_data *session;                 /**< Session which submitted this job */
+	u32 pid;                                           /**< Process ID of submitting process */
+	u32 tid;                                           /**< Thread ID of submitting thread */
+	u32 id;                                            /**< Identifier for this job in kernel space (sequential numbering) */
+	u32 cache_order;                                   /**< Cache order used for L2 cache flushing (sequential numbering) */
+	struct mali_timeline_tracker tracker;              /**< Timeline tracker for this job */
+	_mali_osk_notification_t *finished_notification;   /**< Notification sent back to userspace on job complete */
+	u32 perf_counter_per_sub_job_count;                /**< Number of values in the two arrays which is != MALI_HW_CORE_NO_COUNTER */
+	u32 perf_counter_per_sub_job_src0[_MALI_PP_MAX_SUB_JOBS]; /**< Per sub job counters src0 */
+	u32 perf_counter_per_sub_job_src1[_MALI_PP_MAX_SUB_JOBS]; /**< Per sub job counters src1 */
+	u32 sub_jobs_num;                                  /**< Number of subjobs; set to 1 for Mali-450 if DLBU is used, otherwise equals number of PP cores */
+
+	pp_job_status swap_status;                         /**< Used to track each PP job swap status, if fail, we need to drop them in scheduler part */
+	mali_bool user_notification;                       /**< When we deferred delete PP job, we need to judge if we need to send job finish notification to user space */
+	u32 num_pp_cores_in_virtual;                       /**< How many PP cores we have when job finished */
+
+	/*
+	 * These members are used by both scheduler and executor.
+	 * They are "protected" by atomic operations.
+	 */
+	_mali_osk_atomic_t sub_jobs_completed;                            /**< Number of completed sub-jobs in this superjob */
+	_mali_osk_atomic_t sub_job_errors;                                /**< Bitfield with errors (errors for each single sub-job is or'ed together) */
+
+	/*
+	 * These members are used by scheduler, but only when no one else
+	 * knows about this job object but the working function.
+	 * No lock is thus needed for these.
+	 */
+	u32 *memory_cookies;                               /**< Memory cookies attached to job */
+
+	/*
+	 * These members are used by the scheduler,
+	 * protected by scheduler lock
+	 */
+	_mali_osk_list_t list;                             /**< Used to link jobs together in the scheduler queue */
+	_mali_osk_list_t session_fb_lookup_list;           /**< Used to link jobs together from the same frame builder in the session */
+
+	u32 sub_jobs_started;                              /**< Total number of sub-jobs started (always started in ascending order) */
+
+	/*
+	 * Set by executor/group on job completion, read by scheduler when
+	 * returning job to user. Hold executor lock when setting,
+	 * no lock needed when reading
+	 */
+	u32 perf_counter_value0[_MALI_PP_MAX_SUB_JOBS];    /**< Value of performance counter 0 (to be returned to user space), one for each sub job */
+	u32 perf_counter_value1[_MALI_PP_MAX_SUB_JOBS];    /**< Value of performance counter 1 (to be returned to user space), one for each sub job */
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	struct mali_dma_fence_context dma_fence_context; /**< The mali dma fence context to record dma fence waiters that this job wait for */
+	struct dma_fence *rendered_dma_fence; /**< the new dma fence link to this job */
+#endif
+};
+
+void mali_pp_job_initialize(void);
+void mali_pp_job_terminate(void);
+
+struct mali_pp_job *mali_pp_job_create(struct mali_session_data *session, _mali_uk_pp_start_job_s *uargs, u32 id);
+void mali_pp_job_delete(struct mali_pp_job *job);
+
+u32 mali_pp_job_get_perf_counter_src0(struct mali_pp_job *job, u32 sub_job);
+u32 mali_pp_job_get_perf_counter_src1(struct mali_pp_job *job, u32 sub_job);
+
+void mali_pp_job_set_pp_counter_global_src0(u32 counter);
+void mali_pp_job_set_pp_counter_global_src1(u32 counter);
+void mali_pp_job_set_pp_counter_sub_job_src0(u32 sub_job, u32 counter);
+void mali_pp_job_set_pp_counter_sub_job_src1(u32 sub_job, u32 counter);
+
+u32 mali_pp_job_get_pp_counter_global_src0(void);
+u32 mali_pp_job_get_pp_counter_global_src1(void);
+u32 mali_pp_job_get_pp_counter_sub_job_src0(u32 sub_job);
+u32 mali_pp_job_get_pp_counter_sub_job_src1(u32 sub_job);
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_id(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (NULL == job) ? 0 : job->id;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_set_cache_order(struct mali_pp_job *job,
+		u32 cache_order)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	job->cache_order = cache_order;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_cache_order(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (NULL == job) ? 0 : job->cache_order;
+}
+
+MALI_STATIC_INLINE u64 mali_pp_job_get_user_id(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.user_job_ptr;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_frame_builder_id(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.frame_builder_id;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_flush_id(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.flush_id;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_pid(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->pid;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_tid(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->tid;
+}
+
+MALI_STATIC_INLINE u32 *mali_pp_job_get_frame_registers(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.frame_registers;
+}
+
+MALI_STATIC_INLINE u32 *mali_pp_job_get_dlbu_registers(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.dlbu_registers;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_is_virtual(struct mali_pp_job *job)
+{
+#if (defined(CONFIG_MALI450) || defined(CONFIG_MALI470))
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (0 == job->uargs.num_cores) ? MALI_TRUE : MALI_FALSE;
+#else
+	return MALI_FALSE;
+#endif
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_addr_frame(struct mali_pp_job *job, u32 sub_job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	if (mali_pp_job_is_virtual(job)) {
+		return MALI_DLBU_VIRT_ADDR;
+	} else if (0 == sub_job) {
+		return job->uargs.frame_registers[MALI200_REG_ADDR_FRAME / sizeof(u32)];
+	} else if (sub_job < _MALI_PP_MAX_SUB_JOBS) {
+		return job->uargs.frame_registers_addr_frame[sub_job - 1];
+	}
+
+	return 0;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_addr_stack(struct mali_pp_job *job, u32 sub_job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	if (0 == sub_job) {
+		return job->uargs.frame_registers[MALI200_REG_ADDR_STACK / sizeof(u32)];
+	} else if (sub_job < _MALI_PP_MAX_SUB_JOBS) {
+		return job->uargs.frame_registers_addr_stack[sub_job - 1];
+	}
+
+	return 0;
+}
+
+void mali_pp_job_list_add(struct mali_pp_job *job, _mali_osk_list_t *list);
+
+MALI_STATIC_INLINE void mali_pp_job_list_addtail(struct mali_pp_job *job,
+		_mali_osk_list_t *list)
+{
+	_mali_osk_list_addtail(&job->list, list);
+}
+
+MALI_STATIC_INLINE void mali_pp_job_list_move(struct mali_pp_job *job,
+		_mali_osk_list_t *list)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	MALI_DEBUG_ASSERT(!_mali_osk_list_empty(&job->list));
+	_mali_osk_list_move(&job->list, list);
+}
+
+MALI_STATIC_INLINE void mali_pp_job_list_remove(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	_mali_osk_list_delinit(&job->list);
+}
+
+MALI_STATIC_INLINE u32 *mali_pp_job_get_wb0_registers(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.wb0_registers;
+}
+
+MALI_STATIC_INLINE u32 *mali_pp_job_get_wb1_registers(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.wb1_registers;
+}
+
+MALI_STATIC_INLINE u32 *mali_pp_job_get_wb2_registers(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.wb2_registers;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_wb0_source_addr(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.wb0_registers[MALI200_REG_ADDR_WB_SOURCE_ADDR / sizeof(u32)];
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_wb1_source_addr(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.wb1_registers[MALI200_REG_ADDR_WB_SOURCE_ADDR / sizeof(u32)];
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_wb2_source_addr(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.wb2_registers[MALI200_REG_ADDR_WB_SOURCE_ADDR / sizeof(u32)];
+}
+
+MALI_STATIC_INLINE void mali_pp_job_disable_wb0(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	job->uargs.wb0_registers[MALI200_REG_ADDR_WB_SOURCE_SELECT] = 0;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_disable_wb1(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	job->uargs.wb1_registers[MALI200_REG_ADDR_WB_SOURCE_SELECT] = 0;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_disable_wb2(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	job->uargs.wb2_registers[MALI200_REG_ADDR_WB_SOURCE_SELECT] = 0;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_all_writeback_unit_disabled(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	if (job->uargs.wb0_registers[MALI200_REG_ADDR_WB_SOURCE_SELECT] ||
+	    job->uargs.wb1_registers[MALI200_REG_ADDR_WB_SOURCE_SELECT] ||
+	    job->uargs.wb2_registers[MALI200_REG_ADDR_WB_SOURCE_SELECT]
+	   ) {
+		/* At least one output unit active */
+		return MALI_FALSE;
+	}
+
+	/* All outputs are disabled - we can abort the job */
+	return MALI_TRUE;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_fb_lookup_add(struct mali_pp_job *job)
+{
+	u32 fb_lookup_id;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+
+	fb_lookup_id = MALI_PP_JOB_FB_LOOKUP_LIST_MASK & job->uargs.frame_builder_id;
+
+	MALI_DEBUG_ASSERT(MALI_PP_JOB_FB_LOOKUP_LIST_SIZE > fb_lookup_id);
+
+	_mali_osk_list_addtail(&job->session_fb_lookup_list,
+			       &job->session->pp_job_fb_lookup_list[fb_lookup_id]);
+}
+
+MALI_STATIC_INLINE void mali_pp_job_fb_lookup_remove(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	_mali_osk_list_delinit(&job->session_fb_lookup_list);
+}
+
+MALI_STATIC_INLINE struct mali_session_data *mali_pp_job_get_session(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->session;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_has_started_sub_jobs(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	return (0 < job->sub_jobs_started) ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_has_unstarted_sub_jobs(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	return (job->sub_jobs_started < job->sub_jobs_num) ? MALI_TRUE : MALI_FALSE;
+}
+
+/* Function used when we are terminating a session with jobs. Return TRUE if it has a rendering job.
+   Makes sure that no new subjobs are started. */
+MALI_STATIC_INLINE void mali_pp_job_mark_unstarted_failed(struct mali_pp_job *job)
+{
+	u32 jobs_remaining;
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+
+	jobs_remaining = job->sub_jobs_num - job->sub_jobs_started;
+	job->sub_jobs_started += jobs_remaining;
+
+	/* Not the most optimal way, but this is only used in error cases */
+	for (i = 0; i < jobs_remaining; i++) {
+		_mali_osk_atomic_inc(&job->sub_jobs_completed);
+		_mali_osk_atomic_inc(&job->sub_job_errors);
+	}
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_is_complete(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (job->sub_jobs_num ==
+		_mali_osk_atomic_read(&job->sub_jobs_completed)) ?
+	       MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_first_unstarted_sub_job(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	return job->sub_jobs_started;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_sub_job_count(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->sub_jobs_num;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_unstarted_sub_job_count(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	MALI_DEBUG_ASSERT(job->sub_jobs_num >= job->sub_jobs_started);
+	return (job->sub_jobs_num - job->sub_jobs_started);
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_num_memory_cookies(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.num_memory_cookies;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_memory_cookie(
+	struct mali_pp_job *job, u32 index)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT(index < job->uargs.num_memory_cookies);
+	MALI_DEBUG_ASSERT_POINTER(job->memory_cookies);
+	return job->memory_cookies[index];
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_needs_dma_buf_mapping(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	if (0 < job->uargs.num_memory_cookies) {
+		return MALI_TRUE;
+	}
+
+	return MALI_FALSE;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_mark_sub_job_started(struct mali_pp_job *job, u32 sub_job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+
+	/* Assert that we are marking the "first unstarted sub job" as started */
+	MALI_DEBUG_ASSERT(job->sub_jobs_started == sub_job);
+
+	job->sub_jobs_started++;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_mark_sub_job_completed(struct mali_pp_job *job, mali_bool success)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	_mali_osk_atomic_inc(&job->sub_jobs_completed);
+	if (MALI_FALSE == success) {
+		_mali_osk_atomic_inc(&job->sub_job_errors);
+	}
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_was_success(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	if (0 == _mali_osk_atomic_read(&job->sub_job_errors)) {
+		return MALI_TRUE;
+	}
+	return MALI_FALSE;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_use_no_notification(
+	struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (job->uargs.flags & _MALI_PP_JOB_FLAG_NO_NOTIFICATION) ?
+	       MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_is_pilot_job(struct mali_pp_job *job)
+{
+	/*
+	 * A pilot job is currently identified as jobs which
+	 * require no callback notification.
+	 */
+	return mali_pp_job_use_no_notification(job);
+}
+
+MALI_STATIC_INLINE _mali_osk_notification_t *
+mali_pp_job_get_finished_notification(struct mali_pp_job *job)
+{
+	_mali_osk_notification_t *notification;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(job->finished_notification);
+
+	notification = job->finished_notification;
+	job->finished_notification = NULL;
+
+	return notification;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_is_window_surface(
+	struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (job->uargs.flags & _MALI_PP_JOB_FLAG_IS_WINDOW_SURFACE)
+	       ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE mali_bool mali_pp_job_is_protected_job(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (job->uargs.flags & _MALI_PP_JOB_FLAG_PROTECTED)
+	       ? MALI_TRUE : MALI_FALSE;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_perf_counter_flag(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->uargs.perf_counter_flag;
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_perf_counter_value0(struct mali_pp_job *job, u32 sub_job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->perf_counter_value0[sub_job];
+}
+
+MALI_STATIC_INLINE u32 mali_pp_job_get_perf_counter_value1(struct mali_pp_job *job, u32 sub_job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return job->perf_counter_value1[sub_job];
+}
+
+MALI_STATIC_INLINE void mali_pp_job_set_perf_counter_value0(struct mali_pp_job *job, u32 sub_job, u32 value)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	job->perf_counter_value0[sub_job] = value;
+}
+
+MALI_STATIC_INLINE void mali_pp_job_set_perf_counter_value1(struct mali_pp_job *job, u32 sub_job, u32 value)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_EXECUTOR_LOCK_HELD();
+	job->perf_counter_value1[sub_job] = value;
+}
+
+MALI_STATIC_INLINE _mali_osk_errcode_t mali_pp_job_check(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	if (mali_pp_job_is_virtual(job) && job->sub_jobs_num != 1) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+/**
+ * Returns MALI_TRUE if this job has more than two sub jobs and all sub jobs are unstarted.
+ *
+ * @param job Job to check.
+ * @return MALI_TRUE if job has more than two sub jobs and all sub jobs are unstarted, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_pp_job_is_large_and_unstarted(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	MALI_DEBUG_ASSERT(!mali_pp_job_is_virtual(job));
+
+	return (0 == job->sub_jobs_started && 2 < job->sub_jobs_num);
+}
+
+/**
+ * Get PP job's Timeline tracker.
+ *
+ * @param job PP job.
+ * @return Pointer to Timeline tracker for the job.
+ */
+MALI_STATIC_INLINE struct mali_timeline_tracker *mali_pp_job_get_tracker(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return &(job->tracker);
+}
+
+MALI_STATIC_INLINE u32 *mali_pp_job_get_timeline_point_ptr(
+	struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	return (u32 __user *)(uintptr_t)job->uargs.timeline_point_ptr;
+}
+
+
+#endif /* __MALI_PP_JOB_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_scheduler.c b/drivers/gpu/arm/mali400/common/mali_scheduler.c
--- a/drivers/gpu/arm/mali400/common/mali_scheduler.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_scheduler.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1548 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_scheduler.h"
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_osk_profiling.h"
+#include "mali_kernel_utilization.h"
+#include "mali_timeline.h"
+#include "mali_gp_job.h"
+#include "mali_pp_job.h"
+#include "mali_executor.h"
+#include "mali_group.h"
+#include <linux/wait.h>
+#include <linux/sched.h>
+#include "mali_pm_metrics.h"
+
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+#include "mali_memory_dma_buf.h"
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+#include "mali_dma_fence.h"
+#include <linux/dma-buf.h>
+#endif
+#endif
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+#include <linux/sched.h>
+#include <trace/events/gpu.h>
+#endif
+/*
+ * ---------- static defines/constants ----------
+ */
+
+/*
+ * If dma_buf with map on demand is used, we defer job queue
+ * if in atomic context, since both might sleep.
+ */
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+#if !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+#define MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE 1
+#endif
+#endif
+
+
+/*
+ * ---------- global variables (exported due to inline functions) ----------
+ */
+
+/* Lock protecting this module */
+_mali_osk_spinlock_irq_t *mali_scheduler_lock_obj = NULL;
+
+/* Queue of jobs to be executed on the GP group */
+struct mali_scheduler_job_queue job_queue_gp;
+
+/* Queue of PP jobs */
+struct mali_scheduler_job_queue job_queue_pp;
+
+_mali_osk_atomic_t mali_job_id_autonumber;
+_mali_osk_atomic_t mali_job_cache_order_autonumber;
+/*
+ * ---------- static variables ----------
+ */
+
+_mali_osk_wq_work_t *scheduler_wq_pp_job_delete = NULL;
+_mali_osk_spinlock_irq_t *scheduler_pp_job_delete_lock = NULL;
+static _MALI_OSK_LIST_HEAD_STATIC_INIT(scheduler_pp_job_deletion_queue);
+
+#if defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE)
+static _mali_osk_wq_work_t *scheduler_wq_pp_job_queue = NULL;
+static _mali_osk_spinlock_irq_t *scheduler_pp_job_queue_lock = NULL;
+static _MALI_OSK_LIST_HEAD_STATIC_INIT(scheduler_pp_job_queue_list);
+#endif
+
+/*
+ * ---------- Forward declaration of static functions ----------
+ */
+
+static mali_timeline_point mali_scheduler_submit_gp_job(
+	struct mali_session_data *session, struct mali_gp_job *job);
+static _mali_osk_errcode_t mali_scheduler_submit_pp_job(
+	struct mali_session_data *session, struct mali_pp_job *job, mali_timeline_point *point);
+
+static mali_bool mali_scheduler_queue_gp_job(struct mali_gp_job *job);
+static mali_bool mali_scheduler_queue_pp_job(struct mali_pp_job *job);
+
+static void mali_scheduler_return_gp_job_to_user(struct mali_gp_job *job,
+		mali_bool success);
+
+static void mali_scheduler_deferred_pp_job_delete(struct mali_pp_job *job);
+void mali_scheduler_do_pp_job_delete(void *arg);
+
+#if defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE)
+static void mali_scheduler_deferred_pp_job_queue(struct mali_pp_job *job);
+static void mali_scheduler_do_pp_job_queue(void *arg);
+#endif /* defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE) */
+
+/*
+ * ---------- Actual implementation ----------
+ */
+
+_mali_osk_errcode_t mali_scheduler_initialize(void)
+{
+	_mali_osk_atomic_init(&mali_job_id_autonumber, 0);
+	_mali_osk_atomic_init(&mali_job_cache_order_autonumber, 0);
+
+	_MALI_OSK_INIT_LIST_HEAD(&job_queue_gp.normal_pri);
+	_MALI_OSK_INIT_LIST_HEAD(&job_queue_gp.high_pri);
+	job_queue_gp.depth = 0;
+	job_queue_gp.big_job_num = 0;
+
+	_MALI_OSK_INIT_LIST_HEAD(&job_queue_pp.normal_pri);
+	_MALI_OSK_INIT_LIST_HEAD(&job_queue_pp.high_pri);
+	job_queue_pp.depth = 0;
+	job_queue_pp.big_job_num = 0;
+
+	mali_scheduler_lock_obj = _mali_osk_spinlock_irq_init(
+					  _MALI_OSK_LOCKFLAG_ORDERED,
+					  _MALI_OSK_LOCK_ORDER_SCHEDULER);
+	if (NULL == mali_scheduler_lock_obj) {
+		mali_scheduler_terminate();
+	}
+
+	scheduler_wq_pp_job_delete = _mali_osk_wq_create_work(
+					     mali_scheduler_do_pp_job_delete, NULL);
+	if (NULL == scheduler_wq_pp_job_delete) {
+		mali_scheduler_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	scheduler_pp_job_delete_lock = _mali_osk_spinlock_irq_init(
+					       _MALI_OSK_LOCKFLAG_ORDERED,
+					       _MALI_OSK_LOCK_ORDER_SCHEDULER_DEFERRED);
+	if (NULL == scheduler_pp_job_delete_lock) {
+		mali_scheduler_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+#if defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE)
+	scheduler_wq_pp_job_queue = _mali_osk_wq_create_work(
+					    mali_scheduler_do_pp_job_queue, NULL);
+	if (NULL == scheduler_wq_pp_job_queue) {
+		mali_scheduler_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	scheduler_pp_job_queue_lock = _mali_osk_spinlock_irq_init(
+					      _MALI_OSK_LOCKFLAG_ORDERED,
+					      _MALI_OSK_LOCK_ORDER_SCHEDULER_DEFERRED);
+	if (NULL == scheduler_pp_job_queue_lock) {
+		mali_scheduler_terminate();
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif /* defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE) */
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_scheduler_terminate(void)
+{
+#if defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE)
+	if (NULL != scheduler_pp_job_queue_lock) {
+		_mali_osk_spinlock_irq_term(scheduler_pp_job_queue_lock);
+		scheduler_pp_job_queue_lock = NULL;
+	}
+
+	if (NULL != scheduler_wq_pp_job_queue) {
+		_mali_osk_wq_delete_work(scheduler_wq_pp_job_queue);
+		scheduler_wq_pp_job_queue = NULL;
+	}
+#endif /* defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE) */
+
+	if (NULL != scheduler_pp_job_delete_lock) {
+		_mali_osk_spinlock_irq_term(scheduler_pp_job_delete_lock);
+		scheduler_pp_job_delete_lock = NULL;
+	}
+
+	if (NULL != scheduler_wq_pp_job_delete) {
+		_mali_osk_wq_delete_work(scheduler_wq_pp_job_delete);
+		scheduler_wq_pp_job_delete = NULL;
+	}
+
+	if (NULL != mali_scheduler_lock_obj) {
+		_mali_osk_spinlock_irq_term(mali_scheduler_lock_obj);
+		mali_scheduler_lock_obj = NULL;
+	}
+
+	_mali_osk_atomic_term(&mali_job_cache_order_autonumber);
+	_mali_osk_atomic_term(&mali_job_id_autonumber);
+}
+
+u32 mali_scheduler_job_physical_head_count(mali_bool gpu_mode_is_secure)
+{
+	/*
+	 * Count how many physical sub jobs are present from the head of queue
+	 * until the first virtual job is present.
+	 * Early out when we have reached maximum number of PP cores (8)
+	 */
+	u32 count = 0;
+	struct mali_pp_job *job;
+	struct mali_pp_job *temp;
+
+	/* Check for partially started normal pri jobs */
+	if (!_mali_osk_list_empty(&job_queue_pp.normal_pri)) {
+		MALI_DEBUG_ASSERT(0 < job_queue_pp.depth);
+
+		job = _MALI_OSK_LIST_ENTRY(job_queue_pp.normal_pri.next,
+					   struct mali_pp_job, list);
+
+		MALI_DEBUG_ASSERT_POINTER(job);
+
+		if (MALI_TRUE == mali_pp_job_has_started_sub_jobs(job)) {
+			/*
+			 * Remember; virtual jobs can't be queued and started
+			 * at the same time, so this must be a physical job
+			 */
+			if ((MALI_FALSE  == gpu_mode_is_secure && MALI_FALSE == mali_pp_job_is_protected_job(job))
+			    || (MALI_TRUE  == gpu_mode_is_secure && MALI_TRUE == mali_pp_job_is_protected_job(job))) {
+
+				count += mali_pp_job_unstarted_sub_job_count(job);
+				if (MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS <= count) {
+					return MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS;
+				}
+			}
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, temp, &job_queue_pp.high_pri,
+				    struct mali_pp_job, list) {
+		if ((MALI_FALSE == mali_pp_job_is_virtual(job))
+		    && ((MALI_FALSE  == gpu_mode_is_secure && MALI_FALSE == mali_pp_job_is_protected_job(job))
+			|| (MALI_TRUE  == gpu_mode_is_secure && MALI_TRUE == mali_pp_job_is_protected_job(job)))) {
+
+			count += mali_pp_job_unstarted_sub_job_count(job);
+			if (MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS <= count) {
+				return MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS;
+			}
+		} else {
+			/* Came across a virtual job, so stop counting */
+			return count;
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, temp, &job_queue_pp.normal_pri,
+				    struct mali_pp_job, list) {
+		if ((MALI_FALSE == mali_pp_job_is_virtual(job))
+		    && (MALI_FALSE == mali_pp_job_has_started_sub_jobs(job))
+		    && ((MALI_FALSE  == gpu_mode_is_secure && MALI_FALSE == mali_pp_job_is_protected_job(job))
+			|| (MALI_TRUE  == gpu_mode_is_secure && MALI_TRUE == mali_pp_job_is_protected_job(job)))) {
+
+			count += mali_pp_job_unstarted_sub_job_count(job);
+			if (MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS <= count) {
+				return MALI_MAX_NUMBER_OF_PHYSICAL_PP_GROUPS;
+			}
+		} else {
+			/* Came across a virtual job, so stop counting */
+			return count;
+		}
+	}
+	return count;
+}
+
+struct mali_pp_job *mali_scheduler_job_pp_next(void)
+{
+	struct mali_pp_job *job;
+	struct mali_pp_job *temp;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+
+	/* Check for partially started normal pri jobs */
+	if (!_mali_osk_list_empty(&job_queue_pp.normal_pri)) {
+		MALI_DEBUG_ASSERT(0 < job_queue_pp.depth);
+
+		job = _MALI_OSK_LIST_ENTRY(job_queue_pp.normal_pri.next,
+					   struct mali_pp_job, list);
+
+		MALI_DEBUG_ASSERT_POINTER(job);
+
+		if (MALI_TRUE == mali_pp_job_has_started_sub_jobs(job)) {
+			return job;
+		}
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, temp, &job_queue_pp.high_pri,
+				    struct mali_pp_job, list) {
+		return job;
+	}
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, temp, &job_queue_pp.normal_pri,
+				    struct mali_pp_job, list) {
+		return job;
+	}
+
+	return NULL;
+}
+
+mali_bool mali_scheduler_job_next_is_virtual(void)
+{
+	struct mali_pp_job *job;
+
+	job = mali_scheduler_job_pp_virtual_peek();
+	if (NULL != job) {
+		MALI_DEBUG_ASSERT(mali_pp_job_is_virtual(job));
+
+		return MALI_TRUE;
+	}
+
+	return MALI_FALSE;
+}
+
+struct mali_gp_job *mali_scheduler_job_gp_get(void)
+{
+	_mali_osk_list_t *queue;
+	struct mali_gp_job *job = NULL;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+	MALI_DEBUG_ASSERT(0 < job_queue_gp.depth);
+	MALI_DEBUG_ASSERT(job_queue_gp.big_job_num <= job_queue_gp.depth);
+
+	if (!_mali_osk_list_empty(&job_queue_gp.high_pri)) {
+		queue = &job_queue_gp.high_pri;
+	} else {
+		queue = &job_queue_gp.normal_pri;
+		MALI_DEBUG_ASSERT(!_mali_osk_list_empty(queue));
+	}
+
+	job = _MALI_OSK_LIST_ENTRY(queue->next, struct mali_gp_job, list);
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	mali_gp_job_list_remove(job);
+	job_queue_gp.depth--;
+	if (job->big_job) {
+		job_queue_gp.big_job_num --;
+		if (job_queue_gp.big_job_num < MALI_MAX_PENDING_BIG_JOB) {
+			/* wake up process */
+			wait_queue_head_t *queue = mali_session_get_wait_queue();
+			wake_up(queue);
+		}
+	}
+	return job;
+}
+
+struct mali_pp_job *mali_scheduler_job_pp_physical_peek(void)
+{
+	struct mali_pp_job *job = NULL;
+	struct mali_pp_job *tmp_job = NULL;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+
+	/*
+	 * For PP jobs we favour partially started jobs in normal
+	 * priority queue over unstarted jobs in high priority queue
+	 */
+
+	if (!_mali_osk_list_empty(&job_queue_pp.normal_pri)) {
+		MALI_DEBUG_ASSERT(0 < job_queue_pp.depth);
+
+		tmp_job = _MALI_OSK_LIST_ENTRY(job_queue_pp.normal_pri.next,
+					       struct mali_pp_job, list);
+		MALI_DEBUG_ASSERT(NULL != tmp_job);
+
+		if (MALI_FALSE == mali_pp_job_is_virtual(tmp_job)) {
+			job = tmp_job;
+		}
+	}
+
+	if (NULL == job ||
+	    MALI_FALSE == mali_pp_job_has_started_sub_jobs(job)) {
+		/*
+		 * There isn't a partially started job in normal queue, so
+		 * look in high priority queue.
+		 */
+		if (!_mali_osk_list_empty(&job_queue_pp.high_pri)) {
+			MALI_DEBUG_ASSERT(0 < job_queue_pp.depth);
+
+			tmp_job = _MALI_OSK_LIST_ENTRY(job_queue_pp.high_pri.next,
+						       struct mali_pp_job, list);
+			MALI_DEBUG_ASSERT(NULL != tmp_job);
+
+			if (MALI_FALSE == mali_pp_job_is_virtual(tmp_job)) {
+				job = tmp_job;
+			}
+		}
+	}
+
+	return job;
+}
+
+struct mali_pp_job *mali_scheduler_job_pp_virtual_peek(void)
+{
+	struct mali_pp_job *job = NULL;
+	struct mali_pp_job *tmp_job = NULL;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+
+	if (!_mali_osk_list_empty(&job_queue_pp.high_pri)) {
+		MALI_DEBUG_ASSERT(0 < job_queue_pp.depth);
+
+		tmp_job = _MALI_OSK_LIST_ENTRY(job_queue_pp.high_pri.next,
+					       struct mali_pp_job, list);
+
+		if (MALI_TRUE == mali_pp_job_is_virtual(tmp_job)) {
+			job = tmp_job;
+		}
+	}
+
+	if (NULL == job) {
+		if (!_mali_osk_list_empty(&job_queue_pp.normal_pri)) {
+			MALI_DEBUG_ASSERT(0 < job_queue_pp.depth);
+
+			tmp_job = _MALI_OSK_LIST_ENTRY(job_queue_pp.normal_pri.next,
+						       struct mali_pp_job, list);
+
+			if (MALI_TRUE == mali_pp_job_is_virtual(tmp_job)) {
+				job = tmp_job;
+			}
+		}
+	}
+
+	return job;
+}
+
+struct mali_pp_job *mali_scheduler_job_pp_physical_get(u32 *sub_job)
+{
+	struct mali_pp_job *job = mali_scheduler_job_pp_physical_peek();
+
+	MALI_DEBUG_ASSERT(MALI_FALSE == mali_pp_job_is_virtual(job));
+
+	if (NULL != job) {
+		*sub_job = mali_pp_job_get_first_unstarted_sub_job(job);
+
+		mali_pp_job_mark_sub_job_started(job, *sub_job);
+		if (MALI_FALSE == mali_pp_job_has_unstarted_sub_jobs(job)) {
+			/* Remove from queue when last sub job has been retrieved */
+			mali_pp_job_list_remove(job);
+		}
+
+		job_queue_pp.depth--;
+
+		/*
+		 * Job about to start so it is no longer be
+		 * possible to discard WB
+		 */
+		mali_pp_job_fb_lookup_remove(job);
+	}
+
+	return job;
+}
+
+struct mali_pp_job *mali_scheduler_job_pp_virtual_get(void)
+{
+	struct mali_pp_job *job = mali_scheduler_job_pp_virtual_peek();
+
+	MALI_DEBUG_ASSERT(MALI_TRUE == mali_pp_job_is_virtual(job));
+
+	if (NULL != job) {
+		MALI_DEBUG_ASSERT(0 ==
+				  mali_pp_job_get_first_unstarted_sub_job(job));
+		MALI_DEBUG_ASSERT(1 ==
+				  mali_pp_job_get_sub_job_count(job));
+
+		mali_pp_job_mark_sub_job_started(job, 0);
+
+		mali_pp_job_list_remove(job);
+
+		job_queue_pp.depth--;
+
+		/*
+		 * Job about to start so it is no longer be
+		 * possible to discard WB
+		 */
+		mali_pp_job_fb_lookup_remove(job);
+	}
+
+	return job;
+}
+
+mali_scheduler_mask mali_scheduler_activate_gp_job(struct mali_gp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	MALI_DEBUG_PRINT(4, ("Mali GP scheduler: Timeline activation for job %u (0x%08X).\n",
+			     mali_gp_job_get_id(job), job));
+
+	mali_scheduler_lock();
+
+	if (!mali_scheduler_queue_gp_job(job)) {
+		/* Failed to enqueue job, release job (with error) */
+
+		mali_scheduler_unlock();
+
+		mali_timeline_tracker_release(mali_gp_job_get_tracker(job));
+		mali_gp_job_signal_pp_tracker(job, MALI_FALSE);
+
+		/* This will notify user space and close the job object */
+		mali_scheduler_complete_gp_job(job, MALI_FALSE,
+					       MALI_TRUE, MALI_FALSE);
+
+		return MALI_SCHEDULER_MASK_EMPTY;
+	}
+
+	mali_scheduler_unlock();
+
+	return MALI_SCHEDULER_MASK_GP;
+}
+
+mali_scheduler_mask mali_scheduler_activate_pp_job(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	MALI_DEBUG_PRINT(4, ("Mali PP scheduler: Timeline activation for job %u (0x%08X).\n",
+			     mali_pp_job_get_id(job), job));
+
+	if (MALI_TRUE == mali_timeline_tracker_activation_error(
+		    mali_pp_job_get_tracker(job))) {
+		MALI_DEBUG_PRINT(3, ("Mali PP scheduler: Job %u (0x%08X) activated with error, aborting.\n",
+				     mali_pp_job_get_id(job), job));
+
+		mali_scheduler_lock();
+		mali_pp_job_fb_lookup_remove(job);
+		mali_pp_job_mark_unstarted_failed(job);
+		mali_scheduler_unlock();
+
+		mali_timeline_tracker_release(mali_pp_job_get_tracker(job));
+
+		/* This will notify user space and close the job object */
+		mali_scheduler_complete_pp_job(job, 0, MALI_TRUE, MALI_FALSE);
+
+		return MALI_SCHEDULER_MASK_EMPTY;
+	}
+
+#if defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE)
+	if (mali_pp_job_needs_dma_buf_mapping(job)) {
+		mali_scheduler_deferred_pp_job_queue(job);
+		return MALI_SCHEDULER_MASK_EMPTY;
+	}
+#endif /* defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE) */
+
+	mali_scheduler_lock();
+
+	if (!mali_scheduler_queue_pp_job(job)) {
+		/* Failed to enqueue job, release job (with error) */
+		mali_pp_job_fb_lookup_remove(job);
+		mali_pp_job_mark_unstarted_failed(job);
+		mali_scheduler_unlock();
+
+		mali_timeline_tracker_release(mali_pp_job_get_tracker(job));
+
+		/* This will notify user space and close the job object */
+		mali_scheduler_complete_pp_job(job, 0, MALI_TRUE, MALI_FALSE);
+
+		return MALI_SCHEDULER_MASK_EMPTY;
+	}
+
+	mali_scheduler_unlock();
+	return MALI_SCHEDULER_MASK_PP;
+}
+
+void mali_scheduler_complete_gp_job(struct mali_gp_job *job,
+				    mali_bool success,
+				    mali_bool user_notification,
+				    mali_bool dequeued)
+{
+	if (user_notification) {
+		mali_scheduler_return_gp_job_to_user(job, success);
+	}
+
+	if (dequeued) {
+		_mali_osk_pm_dev_ref_put();
+
+		if (mali_utilization_enabled()) {
+			mali_utilization_gp_end();
+		}
+		mali_pm_record_gpu_idle(MALI_TRUE);
+	}
+
+	mali_gp_job_delete(job);
+}
+
+void mali_scheduler_complete_pp_job(struct mali_pp_job *job,
+				    u32 num_cores_in_virtual,
+				    mali_bool user_notification,
+				    mali_bool dequeued)
+{
+	job->user_notification = user_notification;
+	job->num_pp_cores_in_virtual = num_cores_in_virtual;
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	if (NULL != job->rendered_dma_fence)
+		mali_dma_fence_signal_and_put(&job->rendered_dma_fence);
+#endif
+
+	if (dequeued) {
+#if defined(CONFIG_MALI_DVFS)
+		if (mali_pp_job_is_window_surface(job)) {
+			struct mali_session_data *session;
+			session = mali_pp_job_get_session(job);
+			mali_session_inc_num_window_jobs(session);
+		}
+#endif
+		_mali_osk_pm_dev_ref_put();
+
+		if (mali_utilization_enabled()) {
+			mali_utilization_pp_end();
+		}
+		mali_pm_record_gpu_idle(MALI_FALSE);
+	}
+
+	/* With ZRAM feature enabled, all pp jobs will be force to use deferred delete. */
+	mali_scheduler_deferred_pp_job_delete(job);
+}
+
+void mali_scheduler_abort_session(struct mali_session_data *session)
+{
+	struct mali_gp_job *gp_job;
+	struct mali_gp_job *gp_tmp;
+	struct mali_pp_job *pp_job;
+	struct mali_pp_job *pp_tmp;
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(removed_jobs_gp);
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(removed_jobs_pp);
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT(session->is_aborting);
+
+	MALI_DEBUG_PRINT(3, ("Mali scheduler: Aborting all queued jobs from session 0x%08X.\n",
+			     session));
+
+	mali_scheduler_lock();
+
+	/* Remove from GP normal priority queue */
+	_MALI_OSK_LIST_FOREACHENTRY(gp_job, gp_tmp, &job_queue_gp.normal_pri,
+				    struct mali_gp_job, list) {
+		if (mali_gp_job_get_session(gp_job) == session) {
+			mali_gp_job_list_move(gp_job, &removed_jobs_gp);
+			job_queue_gp.depth--;
+			job_queue_gp.big_job_num -= gp_job->big_job ? 1 : 0;
+		}
+	}
+
+	/* Remove from GP high priority queue */
+	_MALI_OSK_LIST_FOREACHENTRY(gp_job, gp_tmp, &job_queue_gp.high_pri,
+				    struct mali_gp_job, list) {
+		if (mali_gp_job_get_session(gp_job) == session) {
+			mali_gp_job_list_move(gp_job, &removed_jobs_gp);
+			job_queue_gp.depth--;
+			job_queue_gp.big_job_num -= gp_job->big_job ? 1 : 0;
+		}
+	}
+
+	/* Remove from PP normal priority queue */
+	_MALI_OSK_LIST_FOREACHENTRY(pp_job, pp_tmp,
+				    &job_queue_pp.normal_pri,
+				    struct mali_pp_job, list) {
+		if (mali_pp_job_get_session(pp_job) == session) {
+			mali_pp_job_fb_lookup_remove(pp_job);
+
+			job_queue_pp.depth -=
+				mali_pp_job_unstarted_sub_job_count(
+					pp_job);
+			mali_pp_job_mark_unstarted_failed(pp_job);
+
+			if (MALI_FALSE == mali_pp_job_has_unstarted_sub_jobs(pp_job)) {
+				if (mali_pp_job_is_complete(pp_job)) {
+					mali_pp_job_list_move(pp_job,
+							      &removed_jobs_pp);
+				} else {
+					mali_pp_job_list_remove(pp_job);
+				}
+			}
+		}
+	}
+
+	/* Remove from PP high priority queue */
+	_MALI_OSK_LIST_FOREACHENTRY(pp_job, pp_tmp,
+				    &job_queue_pp.high_pri,
+				    struct mali_pp_job, list) {
+		if (mali_pp_job_get_session(pp_job) == session) {
+			mali_pp_job_fb_lookup_remove(pp_job);
+
+			job_queue_pp.depth -=
+				mali_pp_job_unstarted_sub_job_count(
+					pp_job);
+			mali_pp_job_mark_unstarted_failed(pp_job);
+
+			if (MALI_FALSE == mali_pp_job_has_unstarted_sub_jobs(pp_job)) {
+				if (mali_pp_job_is_complete(pp_job)) {
+					mali_pp_job_list_move(pp_job,
+							      &removed_jobs_pp);
+				} else {
+					mali_pp_job_list_remove(pp_job);
+				}
+			}
+		}
+	}
+
+	/*
+	 * Release scheduler lock so we can release trackers
+	 * (which will potentially queue new jobs)
+	 */
+	mali_scheduler_unlock();
+
+	/* Release and complete all (non-running) found GP jobs  */
+	_MALI_OSK_LIST_FOREACHENTRY(gp_job, gp_tmp, &removed_jobs_gp,
+				    struct mali_gp_job, list) {
+		mali_timeline_tracker_release(mali_gp_job_get_tracker(gp_job));
+		mali_gp_job_signal_pp_tracker(gp_job, MALI_FALSE);
+		_mali_osk_list_delinit(&gp_job->list);
+		mali_scheduler_complete_gp_job(gp_job,
+					       MALI_FALSE, MALI_FALSE, MALI_TRUE);
+	}
+
+	/* Release and complete non-running PP jobs */
+	_MALI_OSK_LIST_FOREACHENTRY(pp_job, pp_tmp, &removed_jobs_pp,
+				    struct mali_pp_job, list) {
+		mali_timeline_tracker_release(mali_pp_job_get_tracker(pp_job));
+		_mali_osk_list_delinit(&pp_job->list);
+		mali_scheduler_complete_pp_job(pp_job, 0,
+					       MALI_FALSE, MALI_TRUE);
+	}
+}
+
+_mali_osk_errcode_t _mali_ukk_gp_start_job(void *ctx,
+		_mali_uk_gp_start_job_s *uargs)
+{
+	struct mali_session_data *session;
+	struct mali_gp_job *job;
+	mali_timeline_point point;
+	u32 __user *point_ptr = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(uargs);
+	MALI_DEBUG_ASSERT_POINTER(ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)ctx;
+
+	job = mali_gp_job_create(session, uargs, mali_scheduler_get_new_id(),
+				 NULL);
+	if (NULL == job) {
+		MALI_PRINT_ERROR(("Failed to create GP job.\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	point_ptr = (u32 __user *)(uintptr_t)mali_gp_job_get_timeline_point_ptr(job);
+
+	point = mali_scheduler_submit_gp_job(session, job);
+
+	if (0 != _mali_osk_put_user(((u32) point), point_ptr)) {
+		/*
+		 * Let user space know that something failed
+		 * after the job was started.
+		 */
+		return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_pp_start_job(void *ctx,
+		_mali_uk_pp_start_job_s *uargs)
+{
+	_mali_osk_errcode_t ret;
+	struct mali_session_data *session;
+	struct mali_pp_job *job;
+	mali_timeline_point point;
+	u32 __user *point_ptr = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(uargs);
+	MALI_DEBUG_ASSERT_POINTER(ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)ctx;
+
+	job = mali_pp_job_create(session, uargs, mali_scheduler_get_new_id());
+	if (NULL == job) {
+		MALI_PRINT_ERROR(("Failed to create PP job.\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	point_ptr = (u32 __user *)(uintptr_t)mali_pp_job_get_timeline_point_ptr(job);
+
+	/* Submit PP job. */
+	ret = mali_scheduler_submit_pp_job(session, job, &point);
+	job = NULL;
+
+	if (_MALI_OSK_ERR_OK == ret) {
+		if (0 != _mali_osk_put_user(((u32) point), point_ptr)) {
+			/*
+			* Let user space know that something failed
+			* after the jobs were started.
+			*/
+			return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+		}
+	}
+
+	return ret;
+}
+
+_mali_osk_errcode_t _mali_ukk_pp_and_gp_start_job(void *ctx,
+		_mali_uk_pp_and_gp_start_job_s *uargs)
+{
+	_mali_osk_errcode_t ret;
+	struct mali_session_data *session;
+	_mali_uk_pp_and_gp_start_job_s kargs;
+	struct mali_pp_job *pp_job;
+	struct mali_gp_job *gp_job;
+	u32 __user *point_ptr = NULL;
+	mali_timeline_point point;
+	_mali_uk_pp_start_job_s __user *pp_args;
+	_mali_uk_gp_start_job_s __user *gp_args;
+
+	MALI_DEBUG_ASSERT_POINTER(ctx);
+	MALI_DEBUG_ASSERT_POINTER(uargs);
+
+	session = (struct mali_session_data *) ctx;
+
+	if (0 != _mali_osk_copy_from_user(&kargs, uargs,
+					  sizeof(_mali_uk_pp_and_gp_start_job_s))) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	pp_args = (_mali_uk_pp_start_job_s __user *)(uintptr_t)kargs.pp_args;
+	gp_args = (_mali_uk_gp_start_job_s __user *)(uintptr_t)kargs.gp_args;
+
+	pp_job = mali_pp_job_create(session, pp_args,
+				    mali_scheduler_get_new_id());
+	if (NULL == pp_job) {
+		MALI_PRINT_ERROR(("Failed to create PP job.\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	gp_job = mali_gp_job_create(session, gp_args,
+				    mali_scheduler_get_new_id(),
+				    mali_pp_job_get_tracker(pp_job));
+	if (NULL == gp_job) {
+		MALI_PRINT_ERROR(("Failed to create GP job.\n"));
+		mali_pp_job_delete(pp_job);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	point_ptr = (u32 __user *)(uintptr_t)mali_pp_job_get_timeline_point_ptr(pp_job);
+
+	/* Submit GP job. */
+	mali_scheduler_submit_gp_job(session, gp_job);
+	gp_job = NULL;
+
+	/* Submit PP job. */
+	ret = mali_scheduler_submit_pp_job(session, pp_job, &point);
+	pp_job = NULL;
+
+	if (_MALI_OSK_ERR_OK == ret) {
+		if (0 != _mali_osk_put_user(((u32) point), point_ptr)) {
+			/*
+			* Let user space know that something failed
+			* after the jobs were started.
+			*/
+			return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+		}
+	}
+
+	return ret;
+}
+
+void _mali_ukk_pp_job_disable_wb(_mali_uk_pp_disable_wb_s *args)
+{
+	struct mali_session_data *session;
+	struct mali_pp_job *job;
+	struct mali_pp_job *tmp;
+	u32 fb_lookup_id;
+
+	MALI_DEBUG_ASSERT_POINTER(args);
+	MALI_DEBUG_ASSERT(NULL != (void *)(uintptr_t)args->ctx);
+
+	session = (struct mali_session_data *)(uintptr_t)args->ctx;
+
+	fb_lookup_id = args->fb_id & MALI_PP_JOB_FB_LOOKUP_LIST_MASK;
+
+	mali_scheduler_lock();
+
+	/* Iterate over all jobs for given frame builder_id. */
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp,
+				    &session->pp_job_fb_lookup_list[fb_lookup_id],
+				    struct mali_pp_job, session_fb_lookup_list) {
+		MALI_DEBUG_CODE(u32 disable_mask = 0);
+
+		if (mali_pp_job_get_frame_builder_id(job) !=
+		    (u32) args->fb_id) {
+			MALI_DEBUG_PRINT(4, ("Mali PP scheduler: Disable WB mismatching FB.\n"));
+			continue;
+		}
+
+		MALI_DEBUG_CODE(disable_mask |= 0xD << (4 * 3));
+
+		if (mali_pp_job_get_wb0_source_addr(job) == args->wb0_memory) {
+			MALI_DEBUG_CODE(disable_mask |= 0x1 << (4 * 1));
+			mali_pp_job_disable_wb0(job);
+		}
+
+		if (mali_pp_job_get_wb1_source_addr(job) == args->wb1_memory) {
+			MALI_DEBUG_CODE(disable_mask |= 0x2 << (4 * 2));
+			mali_pp_job_disable_wb1(job);
+		}
+
+		if (mali_pp_job_get_wb2_source_addr(job) == args->wb2_memory) {
+			MALI_DEBUG_CODE(disable_mask |= 0x3 << (4 * 3));
+			mali_pp_job_disable_wb2(job);
+		}
+		MALI_DEBUG_PRINT(3, ("Mali PP scheduler: Disable WB: 0x%X.\n",
+				     disable_mask));
+	}
+
+	mali_scheduler_unlock();
+}
+
+#if MALI_STATE_TRACKING
+u32 mali_scheduler_dump_state(char *buf, u32 size)
+{
+	int n = 0;
+
+	n += _mali_osk_snprintf(buf + n, size - n, "GP queues\n");
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tQueue depth: %u\n", job_queue_gp.depth);
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tNormal priority queue is %s\n",
+				_mali_osk_list_empty(&job_queue_gp.normal_pri) ?
+				"empty" : "not empty");
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tHigh priority queue is %s\n",
+				_mali_osk_list_empty(&job_queue_gp.high_pri) ?
+				"empty" : "not empty");
+
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"PP queues\n");
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tQueue depth: %u\n", job_queue_pp.depth);
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tNormal priority queue is %s\n",
+				_mali_osk_list_empty(&job_queue_pp.normal_pri)
+				? "empty" : "not empty");
+	n += _mali_osk_snprintf(buf + n, size - n,
+				"\tHigh priority queue is %s\n",
+				_mali_osk_list_empty(&job_queue_pp.high_pri)
+				? "empty" : "not empty");
+
+	n += _mali_osk_snprintf(buf + n, size - n, "\n");
+
+	return n;
+}
+#endif
+
+/*
+ * ---------- Implementation of static functions ----------
+ */
+
+static mali_timeline_point mali_scheduler_submit_gp_job(
+	struct mali_session_data *session, struct mali_gp_job *job)
+{
+	mali_timeline_point point;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	/* Add job to Timeline system. */
+	point = mali_timeline_system_add_tracker(session->timeline_system,
+			mali_gp_job_get_tracker(job), MALI_TIMELINE_GP);
+
+	return point;
+}
+
+static _mali_osk_errcode_t mali_scheduler_submit_pp_job(
+	struct mali_session_data *session, struct mali_pp_job *job, mali_timeline_point *point)
+
+{
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_OK;
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	struct ww_acquire_ctx ww_actx;
+	u32 i;
+	u32 num_memory_cookies = 0;
+	struct reservation_object **reservation_object_list = NULL;
+	unsigned int num_reservation_object = 0;
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	mali_scheduler_lock();
+	/*
+	 * Adding job to the lookup list used to quickly discard
+	 * writeback units of queued jobs.
+	 */
+	mali_pp_job_fb_lookup_add(job);
+	mali_scheduler_unlock();
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+
+	/* Allocate the reservation_object_list to list the dma reservation object of dependent dma buffer */
+	num_memory_cookies = mali_pp_job_num_memory_cookies(job);
+	if (0 < num_memory_cookies) {
+		reservation_object_list = kzalloc(sizeof(struct reservation_object *) * num_memory_cookies, GFP_KERNEL);
+		if (NULL == reservation_object_list) {
+			MALI_PRINT_ERROR(("Failed to alloc the reservation object list.\n"));
+			ret = _MALI_OSK_ERR_NOMEM;
+			goto failed_to_alloc_reservation_object_list;
+		}
+	}
+
+	/* Add the dma reservation object into reservation_object_list*/
+	for (i = 0; i < num_memory_cookies; i++) {
+		mali_mem_backend *mem_backend = NULL;
+		struct reservation_object *tmp_reservation_object = NULL;
+		u32 mali_addr  = mali_pp_job_get_memory_cookie(job, i);
+
+		mem_backend = mali_mem_backend_struct_search(session, mali_addr);
+
+		MALI_DEBUG_ASSERT_POINTER(mem_backend);
+
+		if (NULL == mem_backend) {
+			MALI_PRINT_ERROR(("Failed to find the memory backend for memory cookie[%d].\n", i));
+			goto failed_to_find_mem_backend;
+		}
+
+		if (MALI_MEM_DMA_BUF != mem_backend->type)
+			continue;
+
+		tmp_reservation_object = mem_backend->dma_buf.attachment->buf->resv;
+
+		if (NULL != tmp_reservation_object) {
+			mali_dma_fence_add_reservation_object_list(tmp_reservation_object,
+					reservation_object_list, &num_reservation_object);
+		}
+	}
+
+	/*
+	 * Add the mali dma fence callback to wait for all dependent dma buf,
+	 * and extend the timeline system to support dma fence,
+	 * then create the new internal dma fence to replace all last dma fence for dependent dma buf.
+	 */
+	if (0 < num_reservation_object) {
+		int error;
+		int num_dma_fence_waiter = 0;
+		/* Create one new dma fence.*/
+		job->rendered_dma_fence = mali_dma_fence_new(job->session->fence_context,
+					  _mali_osk_atomic_inc_return(&job->session->fence_seqno));
+
+		if (NULL == job->rendered_dma_fence) {
+			MALI_PRINT_ERROR(("Failed to creat one new dma fence.\n"));
+			ret = _MALI_OSK_ERR_FAULT;
+			goto failed_to_create_dma_fence;
+		}
+
+		/* In order to avoid deadlock, wait/wound mutex lock to lock all dma buffers*/
+
+		error = mali_dma_fence_lock_reservation_object_list(reservation_object_list,
+				num_reservation_object, &ww_actx);
+
+		if (0 != error) {
+			MALI_PRINT_ERROR(("Failed to lock all reservation objects.\n"));
+			ret = _MALI_OSK_ERR_FAULT;
+			goto failed_to_lock_reservation_object_list;
+		}
+
+		mali_dma_fence_context_init(&job->dma_fence_context,
+					    mali_timeline_dma_fence_callback, (void *)job);
+
+		/* Add dma fence waiters and dma fence callback. */
+		for (i = 0; i < num_reservation_object; i++) {
+			ret = mali_dma_fence_context_add_waiters(&job->dma_fence_context, reservation_object_list[i]);
+			if (_MALI_OSK_ERR_OK != ret) {
+				MALI_PRINT_ERROR(("Failed to add waiter into mali dma fence context.\n"));
+				goto failed_to_add_dma_fence_waiter;
+			}
+		}
+
+		for (i = 0; i < num_reservation_object; i++) {
+			reservation_object_add_excl_fence(reservation_object_list[i], job->rendered_dma_fence);
+		}
+
+		num_dma_fence_waiter = job->dma_fence_context.num_dma_fence_waiter;
+
+		/* Add job to Timeline system. */
+		(*point) = mali_timeline_system_add_tracker(session->timeline_system,
+				mali_pp_job_get_tracker(job), MALI_TIMELINE_PP);
+
+		if (0 != num_dma_fence_waiter) {
+			mali_dma_fence_context_dec_count(&job->dma_fence_context);
+		}
+
+		/* Unlock all wait/wound mutex lock. */
+		mali_dma_fence_unlock_reservation_object_list(reservation_object_list,
+				num_reservation_object, &ww_actx);
+	} else {
+		/* Add job to Timeline system. */
+		(*point) = mali_timeline_system_add_tracker(session->timeline_system,
+				mali_pp_job_get_tracker(job), MALI_TIMELINE_PP);
+	}
+
+	kfree(reservation_object_list);
+	return ret;
+#else
+	/* Add job to Timeline system. */
+	(*point) = mali_timeline_system_add_tracker(session->timeline_system,
+			mali_pp_job_get_tracker(job), MALI_TIMELINE_PP);
+#endif
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+failed_to_add_dma_fence_waiter:
+	mali_dma_fence_context_term(&job->dma_fence_context);
+	mali_dma_fence_unlock_reservation_object_list(reservation_object_list,
+			num_reservation_object, &ww_actx);
+failed_to_lock_reservation_object_list:
+	mali_dma_fence_signal_and_put(&job->rendered_dma_fence);
+failed_to_create_dma_fence:
+failed_to_find_mem_backend:
+	if (NULL != reservation_object_list)
+		kfree(reservation_object_list);
+failed_to_alloc_reservation_object_list:
+	mali_pp_job_fb_lookup_remove(job);
+#endif
+	return ret;
+}
+
+static mali_bool mali_scheduler_queue_gp_job(struct mali_gp_job *job)
+{
+	struct mali_session_data *session;
+	_mali_osk_list_t *queue;
+
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	session = mali_gp_job_get_session(job);
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (unlikely(session->is_aborting)) {
+		MALI_DEBUG_PRINT(4, ("Mali GP scheduler: Job %u (0x%08X) queued while session is aborting.\n",
+				     mali_gp_job_get_id(job), job));
+		return MALI_FALSE; /* job not queued */
+	}
+
+	mali_gp_job_set_cache_order(job, mali_scheduler_get_new_cache_order());
+
+	/* Determine which queue the job should be added to. */
+	if (session->use_high_priority_job_queue) {
+		queue = &job_queue_gp.high_pri;
+	} else {
+		queue = &job_queue_gp.normal_pri;
+	}
+
+	job_queue_gp.depth += 1;
+	job_queue_gp.big_job_num += (job->big_job) ? 1 : 0;
+
+	/* Add job to queue (mali_gp_job_queue_add find correct place). */
+	mali_gp_job_list_add(job, queue);
+
+	/*
+	 * We hold a PM reference for every job we hold queued (and running)
+	 * It is important that we take this reference after job has been
+	 * added the the queue so that any runtime resume could schedule this
+	 * job right there and then.
+	 */
+	_mali_osk_pm_dev_ref_get_async();
+
+	if (mali_utilization_enabled()) {
+		/*
+		 * We cheat a little bit by counting the GP as busy from the
+		 * time a GP job is queued. This will be fine because we only
+		 * loose the tiny idle gap between jobs, but we will instead
+		 * get less utilization work to do (less locks taken)
+		 */
+		mali_utilization_gp_start();
+	}
+
+	mali_pm_record_gpu_active(MALI_TRUE);
+
+	/* Add profiling events for job enqueued */
+	_mali_osk_profiling_add_event(
+		MALI_PROFILING_EVENT_TYPE_SINGLE |
+		MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+		MALI_PROFILING_EVENT_REASON_SINGLE_SW_GP_ENQUEUE,
+		mali_gp_job_get_pid(job),
+		mali_gp_job_get_tid(job),
+		mali_gp_job_get_frame_builder_id(job),
+		mali_gp_job_get_flush_id(job),
+		0);
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+	trace_gpu_job_enqueue(mali_gp_job_get_tid(job),
+			      mali_gp_job_get_id(job), "GP");
+#endif
+
+	MALI_DEBUG_PRINT(3, ("Mali GP scheduler: Job %u (0x%08X) queued\n",
+			     mali_gp_job_get_id(job), job));
+
+	return MALI_TRUE; /* job queued */
+}
+
+static mali_bool mali_scheduler_queue_pp_job(struct mali_pp_job *job)
+{
+	struct mali_session_data *session;
+	_mali_osk_list_t *queue = NULL;
+
+	MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD();
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	session = mali_pp_job_get_session(job);
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (unlikely(session->is_aborting)) {
+		MALI_DEBUG_PRINT(2, ("Mali PP scheduler: Job %u (0x%08X) queued while session is aborting.\n",
+				     mali_pp_job_get_id(job), job));
+		return MALI_FALSE; /* job not queued */
+	} else if (unlikely(MALI_SWAP_IN_FAIL == job->swap_status)) {
+		MALI_DEBUG_PRINT(2, ("Mali PP scheduler: Job %u (0x%08X) queued while swap in failed.\n",
+				     mali_pp_job_get_id(job), job));
+		return MALI_FALSE;
+	}
+
+	mali_pp_job_set_cache_order(job, mali_scheduler_get_new_cache_order());
+
+	if (session->use_high_priority_job_queue) {
+		queue = &job_queue_pp.high_pri;
+	} else {
+		queue = &job_queue_pp.normal_pri;
+	}
+
+	job_queue_pp.depth +=
+		mali_pp_job_get_sub_job_count(job);
+
+	/* Add job to queue (mali_gp_job_queue_add find correct place). */
+	mali_pp_job_list_add(job, queue);
+
+	/*
+	 * We hold a PM reference for every job we hold queued (and running)
+	 * It is important that we take this reference after job has been
+	 * added the the queue so that any runtime resume could schedule this
+	 * job right there and then.
+	 */
+	_mali_osk_pm_dev_ref_get_async();
+
+	if (mali_utilization_enabled()) {
+		/*
+		 * We cheat a little bit by counting the PP as busy from the
+		 * time a PP job is queued. This will be fine because we only
+		 * loose the tiny idle gap between jobs, but we will instead
+		 * get less utilization work to do (less locks taken)
+		 */
+		mali_utilization_pp_start();
+	}
+
+	mali_pm_record_gpu_active(MALI_FALSE);
+
+	/* Add profiling events for job enqueued */
+	_mali_osk_profiling_add_event(
+		MALI_PROFILING_EVENT_TYPE_SINGLE |
+		MALI_PROFILING_EVENT_CHANNEL_SOFTWARE |
+		MALI_PROFILING_EVENT_REASON_SINGLE_SW_PP_ENQUEUE,
+		mali_pp_job_get_pid(job),
+		mali_pp_job_get_tid(job),
+		mali_pp_job_get_frame_builder_id(job),
+		mali_pp_job_get_flush_id(job),
+		0);
+
+#if defined(CONFIG_GPU_TRACEPOINTS) && defined(CONFIG_TRACEPOINTS)
+	trace_gpu_job_enqueue(mali_pp_job_get_tid(job),
+			      mali_pp_job_get_id(job), "PP");
+#endif
+
+	MALI_DEBUG_PRINT(3, ("Mali PP scheduler: %s job %u (0x%08X) with %u parts queued.\n",
+			     mali_pp_job_is_virtual(job)
+			     ? "Virtual" : "Physical",
+			     mali_pp_job_get_id(job), job,
+			     mali_pp_job_get_sub_job_count(job)));
+
+	return MALI_TRUE; /* job queued */
+}
+
+static void mali_scheduler_return_gp_job_to_user(struct mali_gp_job *job,
+		mali_bool success)
+{
+	_mali_uk_gp_job_finished_s *jobres;
+	struct mali_session_data *session;
+	_mali_osk_notification_t *notification;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	session = mali_gp_job_get_session(job);
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	notification = mali_gp_job_get_finished_notification(job);
+	MALI_DEBUG_ASSERT_POINTER(notification);
+
+	jobres = notification->result_buffer;
+	MALI_DEBUG_ASSERT_POINTER(jobres);
+
+	jobres->pending_big_job_num = mali_scheduler_job_gp_big_job_count();
+
+	jobres->user_job_ptr = mali_gp_job_get_user_id(job);
+	if (MALI_TRUE == success) {
+		jobres->status = _MALI_UK_JOB_STATUS_END_SUCCESS;
+	} else {
+		jobres->status = _MALI_UK_JOB_STATUS_END_UNKNOWN_ERR;
+	}
+	jobres->heap_current_addr = mali_gp_job_get_current_heap_addr(job);
+	jobres->perf_counter0 = mali_gp_job_get_perf_counter_value0(job);
+	jobres->perf_counter1 = mali_gp_job_get_perf_counter_value1(job);
+
+	mali_session_send_notification(session, notification);
+}
+
+void mali_scheduler_return_pp_job_to_user(struct mali_pp_job *job,
+		u32 num_cores_in_virtual)
+{
+	u32 i;
+	u32 num_counters_to_copy;
+	_mali_uk_pp_job_finished_s *jobres;
+	struct mali_session_data *session;
+	_mali_osk_notification_t *notification;
+
+	if (MALI_TRUE == mali_pp_job_use_no_notification(job)) {
+		return;
+	}
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	session = mali_pp_job_get_session(job);
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	notification = mali_pp_job_get_finished_notification(job);
+	MALI_DEBUG_ASSERT_POINTER(notification);
+
+	jobres = notification->result_buffer;
+	MALI_DEBUG_ASSERT_POINTER(jobres);
+
+	jobres->user_job_ptr = mali_pp_job_get_user_id(job);
+	if (MALI_TRUE == mali_pp_job_was_success(job)) {
+		jobres->status = _MALI_UK_JOB_STATUS_END_SUCCESS;
+	} else {
+		jobres->status = _MALI_UK_JOB_STATUS_END_UNKNOWN_ERR;
+	}
+
+	if (mali_pp_job_is_virtual(job)) {
+		num_counters_to_copy = num_cores_in_virtual;
+	} else {
+		num_counters_to_copy = mali_pp_job_get_sub_job_count(job);
+	}
+
+	for (i = 0; i < num_counters_to_copy; i++) {
+		jobres->perf_counter0[i] =
+			mali_pp_job_get_perf_counter_value0(job, i);
+		jobres->perf_counter1[i] =
+			mali_pp_job_get_perf_counter_value1(job, i);
+		jobres->perf_counter_src0 =
+			mali_pp_job_get_pp_counter_global_src0();
+		jobres->perf_counter_src1 =
+			mali_pp_job_get_pp_counter_global_src1();
+	}
+
+	mali_session_send_notification(session, notification);
+}
+
+static void mali_scheduler_deferred_pp_job_delete(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	_mali_osk_spinlock_irq_lock(scheduler_pp_job_delete_lock);
+	mali_pp_job_list_addtail(job, &scheduler_pp_job_deletion_queue);
+	_mali_osk_spinlock_irq_unlock(scheduler_pp_job_delete_lock);
+
+	_mali_osk_wq_schedule_work(scheduler_wq_pp_job_delete);
+}
+
+void mali_scheduler_do_pp_job_delete(void *arg)
+{
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(list);
+	struct mali_pp_job *job;
+	struct mali_pp_job *tmp;
+
+	MALI_IGNORE(arg);
+
+	/*
+	 * Quickly "unhook" the jobs pending to be deleted, so we can release
+	 * the lock before we start deleting the job objects
+	 * (without any locks held)
+	 */
+	_mali_osk_spinlock_irq_lock(scheduler_pp_job_delete_lock);
+	_mali_osk_list_move_list(&scheduler_pp_job_deletion_queue, &list);
+	_mali_osk_spinlock_irq_unlock(scheduler_pp_job_delete_lock);
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp, &list,
+				    struct mali_pp_job, list) {
+		_mali_osk_list_delinit(&job->list);
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+		mali_dma_fence_context_term(&job->dma_fence_context);
+#endif
+
+		mali_pp_job_delete(job); /* delete the job object itself */
+	}
+}
+
+#if defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE)
+
+static void mali_scheduler_deferred_pp_job_queue(struct mali_pp_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	_mali_osk_spinlock_irq_lock(scheduler_pp_job_queue_lock);
+	mali_pp_job_list_addtail(job, &scheduler_pp_job_queue_list);
+	_mali_osk_spinlock_irq_unlock(scheduler_pp_job_queue_lock);
+
+	_mali_osk_wq_schedule_work(scheduler_wq_pp_job_queue);
+}
+
+static void mali_scheduler_do_pp_job_queue(void *arg)
+{
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(list);
+	struct mali_pp_job *job;
+	struct mali_pp_job *tmp;
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_IGNORE(arg);
+
+	/*
+	 * Quickly "unhook" the jobs pending to be queued, so we can release
+	 * the lock before we start queueing the job objects
+	 * (without any locks held)
+	 */
+	_mali_osk_spinlock_irq_lock(scheduler_pp_job_queue_lock);
+	_mali_osk_list_move_list(&scheduler_pp_job_queue_list, &list);
+	_mali_osk_spinlock_irq_unlock(scheduler_pp_job_queue_lock);
+
+	/* First loop through all jobs and do the pre-work (no locks needed) */
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp, &list,
+				    struct mali_pp_job, list) {
+		if (mali_pp_job_needs_dma_buf_mapping(job)) {
+			/*
+			 * This operation could fail, but we continue anyway,
+			 * because the worst that could happen is that this
+			 * job will fail due to a Mali page fault.
+			 */
+			mali_dma_buf_map_job(job);
+		}
+	}
+
+	mali_scheduler_lock();
+
+	/* Then loop through all jobs again to queue them (lock needed) */
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp, &list,
+				    struct mali_pp_job, list) {
+
+		/* Remove from scheduler_pp_job_queue_list before queueing */
+		mali_pp_job_list_remove(job);
+
+		if (mali_scheduler_queue_pp_job(job)) {
+			/* Job queued successfully */
+			schedule_mask |= MALI_SCHEDULER_MASK_PP;
+		} else {
+			/* Failed to enqueue job, release job (with error) */
+			mali_pp_job_fb_lookup_remove(job);
+			mali_pp_job_mark_unstarted_failed(job);
+
+			/* unlock scheduler in this uncommon case */
+			mali_scheduler_unlock();
+
+			schedule_mask |= mali_timeline_tracker_release(
+						 mali_pp_job_get_tracker(job));
+
+			/* Notify user space and close the job object */
+			mali_scheduler_complete_pp_job(job, 0, MALI_TRUE,
+						       MALI_FALSE);
+
+			mali_scheduler_lock();
+		}
+	}
+
+	mali_scheduler_unlock();
+
+	/* Trigger scheduling of jobs */
+	mali_executor_schedule_from_mask(schedule_mask, MALI_FALSE);
+}
+
+#endif /* defined(MALI_SCHEDULER_USE_DEFERRED_PP_JOB_QUEUE) */
+
+void mali_scheduler_gp_pp_job_queue_print(void)
+{
+	struct mali_gp_job *gp_job = NULL;
+	struct mali_gp_job *tmp_gp_job = NULL;
+	struct mali_pp_job *pp_job = NULL;
+	struct mali_pp_job *tmp_pp_job = NULL;
+
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+	MALI_DEBUG_ASSERT_LOCK_HELD(mali_executor_lock_obj);
+
+	/* dump job queup status */
+	if ((0 == job_queue_gp.depth) && (0 == job_queue_pp.depth)) {
+		MALI_PRINT(("No GP&PP job in the job queue.\n"));
+		return;
+	}
+
+	MALI_PRINT(("Total (%d) GP job in the job queue.\n", job_queue_gp.depth));
+	if (job_queue_gp.depth > 0) {
+		if (!_mali_osk_list_empty(&job_queue_gp.high_pri)) {
+			_MALI_OSK_LIST_FOREACHENTRY(gp_job, tmp_gp_job, &job_queue_gp.high_pri,
+						    struct mali_gp_job, list) {
+				MALI_PRINT(("GP job(%p) id = %d tid = %d pid = %d in the gp job high_pri queue\n", gp_job, gp_job->id, gp_job->tid, gp_job->pid));
+			}
+		}
+
+		if (!_mali_osk_list_empty(&job_queue_gp.normal_pri)) {
+			_MALI_OSK_LIST_FOREACHENTRY(gp_job, tmp_gp_job, &job_queue_gp.normal_pri,
+						    struct mali_gp_job, list) {
+				MALI_PRINT(("GP job(%p) id = %d tid = %d pid = %d in the gp job normal_pri queue\n", gp_job, gp_job->id, gp_job->tid, gp_job->pid));
+			}
+		}
+	}
+
+	MALI_PRINT(("Total (%d) PP job in the job queue.\n", job_queue_pp.depth));
+	if (job_queue_pp.depth > 0) {
+		if (!_mali_osk_list_empty(&job_queue_pp.high_pri)) {
+			_MALI_OSK_LIST_FOREACHENTRY(pp_job, tmp_pp_job, &job_queue_pp.high_pri,
+						    struct mali_pp_job, list) {
+				if (mali_pp_job_is_virtual(pp_job)) {
+					MALI_PRINT(("PP Virtual job(%p) id = %d tid = %d pid = %d in the pp job high_pri queue\n", pp_job, pp_job->id, pp_job->tid, pp_job->pid));
+				} else {
+					MALI_PRINT(("PP Physical job(%p) id = %d tid = %d pid = %d in the pp job high_pri queue\n", pp_job, pp_job->id, pp_job->tid, pp_job->pid));
+				}
+			}
+		}
+
+		if (!_mali_osk_list_empty(&job_queue_pp.normal_pri)) {
+			_MALI_OSK_LIST_FOREACHENTRY(pp_job, tmp_pp_job, &job_queue_pp.normal_pri,
+						    struct mali_pp_job, list) {
+				if (mali_pp_job_is_virtual(pp_job)) {
+					MALI_PRINT(("PP Virtual job(%p) id = %d tid = %d pid = %d in the pp job normal_pri queue\n", pp_job, pp_job->id, pp_job->tid, pp_job->pid));
+				} else {
+					MALI_PRINT(("PP Physical job(%p) id = %d tid = %d pid = %d in the pp job normal_pri queue\n", pp_job, pp_job->id, pp_job->tid, pp_job->pid));
+				}
+			}
+		}
+	}
+
+	/* dump group running job status */
+	mali_executor_running_status_print();
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_scheduler.h b/drivers/gpu/arm/mali400/common/mali_scheduler.h
--- a/drivers/gpu/arm/mali400/common/mali_scheduler.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_scheduler.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_SCHEDULER_H__
+#define __MALI_SCHEDULER_H__
+
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_scheduler_types.h"
+#include "mali_session.h"
+
+struct mali_scheduler_job_queue {
+	_MALI_OSK_LIST_HEAD(normal_pri); /* Queued jobs with normal priority */
+	_MALI_OSK_LIST_HEAD(high_pri);   /* Queued jobs with high priority */
+	u32 depth;                       /* Depth of combined queues. */
+	u32 big_job_num;
+};
+
+extern _mali_osk_spinlock_irq_t *mali_scheduler_lock_obj;
+
+/* Queue of jobs to be executed on the GP group */
+extern struct mali_scheduler_job_queue job_queue_gp;
+
+/* Queue of PP jobs */
+extern struct mali_scheduler_job_queue job_queue_pp;
+
+extern _mali_osk_atomic_t mali_job_id_autonumber;
+extern _mali_osk_atomic_t mali_job_cache_order_autonumber;
+
+#define MALI_DEBUG_ASSERT_SCHEDULER_LOCK_HELD() MALI_DEBUG_ASSERT_LOCK_HELD(mali_scheduler_lock_obj);
+
+_mali_osk_errcode_t mali_scheduler_initialize(void);
+void mali_scheduler_terminate(void);
+
+MALI_STATIC_INLINE void mali_scheduler_lock(void)
+{
+	_mali_osk_spinlock_irq_lock(mali_scheduler_lock_obj);
+	MALI_DEBUG_PRINT(5, ("Mali scheduler: scheduler lock taken.\n"));
+}
+
+MALI_STATIC_INLINE void mali_scheduler_unlock(void)
+{
+	MALI_DEBUG_PRINT(5, ("Mali scheduler: Releasing scheduler lock.\n"));
+	_mali_osk_spinlock_irq_unlock(mali_scheduler_lock_obj);
+}
+
+MALI_STATIC_INLINE u32 mali_scheduler_job_gp_count(void)
+{
+	return job_queue_gp.depth;
+}
+MALI_STATIC_INLINE u32 mali_scheduler_job_gp_big_job_count(void)
+{
+	return job_queue_gp.big_job_num;
+}
+
+u32 mali_scheduler_job_physical_head_count(mali_bool gpu_mode_is_secure);
+
+mali_bool mali_scheduler_job_next_is_virtual(void);
+struct mali_pp_job *mali_scheduler_job_pp_next(void);
+
+struct mali_gp_job *mali_scheduler_job_gp_get(void);
+struct mali_pp_job *mali_scheduler_job_pp_physical_peek(void);
+struct mali_pp_job *mali_scheduler_job_pp_virtual_peek(void);
+struct mali_pp_job *mali_scheduler_job_pp_physical_get(u32 *sub_job);
+struct mali_pp_job *mali_scheduler_job_pp_virtual_get(void);
+
+MALI_STATIC_INLINE u32 mali_scheduler_get_new_id(void)
+{
+	return _mali_osk_atomic_inc_return(&mali_job_id_autonumber);
+}
+
+MALI_STATIC_INLINE u32 mali_scheduler_get_new_cache_order(void)
+{
+	return _mali_osk_atomic_inc_return(&mali_job_cache_order_autonumber);
+}
+
+/**
+ * @brief Used by the Timeline system to queue a GP job.
+ *
+ * @note @ref mali_executor_schedule_from_mask() should be called if this
+ * function returns non-zero.
+ *
+ * @param job The GP job that is being activated.
+ *
+ * @return A scheduling bitmask that can be used to decide if scheduling is
+ * necessary after this call.
+ */
+mali_scheduler_mask mali_scheduler_activate_gp_job(struct mali_gp_job *job);
+
+/**
+ * @brief Used by the Timeline system to queue a PP job.
+ *
+ * @note @ref mali_executor_schedule_from_mask() should be called if this
+ * function returns non-zero.
+ *
+ * @param job The PP job that is being activated.
+ *
+ * @return A scheduling bitmask that can be used to decide if scheduling is
+ * necessary after this call.
+ */
+mali_scheduler_mask mali_scheduler_activate_pp_job(struct mali_pp_job *job);
+
+void mali_scheduler_complete_gp_job(struct mali_gp_job *job,
+				    mali_bool success,
+				    mali_bool user_notification,
+				    mali_bool dequeued);
+
+void mali_scheduler_complete_pp_job(struct mali_pp_job *job,
+				    u32 num_cores_in_virtual,
+				    mali_bool user_notification,
+				    mali_bool dequeued);
+
+void mali_scheduler_abort_session(struct mali_session_data *session);
+
+void mali_scheduler_return_pp_job_to_user(struct mali_pp_job *job,
+		u32 num_cores_in_virtual);
+
+#if MALI_STATE_TRACKING
+u32 mali_scheduler_dump_state(char *buf, u32 size);
+#endif
+
+void mali_scheduler_gp_pp_job_queue_print(void);
+
+#endif /* __MALI_SCHEDULER_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_scheduler_types.h b/drivers/gpu/arm/mali400/common/mali_scheduler_types.h
--- a/drivers/gpu/arm/mali400/common/mali_scheduler_types.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_scheduler_types.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_SCHEDULER_TYPES_H__
+#define __MALI_SCHEDULER_TYPES_H__
+
+#include "mali_osk.h"
+
+#define MALI_SCHEDULER_JOB_ID_SPAN 65535
+
+/**
+ * Bitmask used for defered scheduling of subsystems.
+ */
+typedef u32 mali_scheduler_mask;
+
+#define MALI_SCHEDULER_MASK_GP (1<<0)
+#define MALI_SCHEDULER_MASK_PP (1<<1)
+
+#define MALI_SCHEDULER_MASK_EMPTY 0
+#define MALI_SCHEDULER_MASK_ALL (MALI_SCHEDULER_MASK_GP | MALI_SCHEDULER_MASK_PP)
+
+#endif /* __MALI_SCHEDULER_TYPES_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_session.c b/drivers/gpu/arm/mali400/common/mali_session.c
--- a/drivers/gpu/arm/mali400/common/mali_session.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_session.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_session.h"
+#include "mali_ukk.h"
+#ifdef MALI_MEM_SWAP_TRACKING
+#include "mali_memory_swap_alloc.h"
+#endif
+
+_MALI_OSK_LIST_HEAD(mali_sessions);
+static u32 mali_session_count = 0;
+
+_mali_osk_spinlock_irq_t *mali_sessions_lock = NULL;
+wait_queue_head_t pending_queue;
+
+_mali_osk_errcode_t mali_session_initialize(void)
+{
+	_MALI_OSK_INIT_LIST_HEAD(&mali_sessions);
+	/* init wait queue for big varying job */
+	init_waitqueue_head(&pending_queue);
+
+	mali_sessions_lock = _mali_osk_spinlock_irq_init(
+				     _MALI_OSK_LOCKFLAG_ORDERED,
+				     _MALI_OSK_LOCK_ORDER_SESSIONS);
+	if (NULL == mali_sessions_lock) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_session_terminate(void)
+{
+	if (NULL != mali_sessions_lock) {
+		_mali_osk_spinlock_irq_term(mali_sessions_lock);
+		mali_sessions_lock = NULL;
+	}
+}
+
+void mali_session_add(struct mali_session_data *session)
+{
+	mali_session_lock();
+	_mali_osk_list_add(&session->link, &mali_sessions);
+	mali_session_count++;
+	mali_session_unlock();
+}
+
+void mali_session_remove(struct mali_session_data *session)
+{
+	mali_session_lock();
+	_mali_osk_list_delinit(&session->link);
+	mali_session_count--;
+	mali_session_unlock();
+}
+
+u32 mali_session_get_count(void)
+{
+	return mali_session_count;
+}
+
+mali_bool mali_session_pp_job_is_empty(void *data)
+{
+	struct mali_session_data *session = (struct mali_session_data *)data;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if ( 0 == _mali_osk_atomic_read(&session->number_of_pp_jobs)) {
+		return MALI_TRUE;
+	}
+	return MALI_FALSE;
+}
+
+wait_queue_head_t *mali_session_get_wait_queue(void)
+{
+	return &pending_queue;
+}
+
+/*
+ * Get the max completed window jobs from all active session,
+ * which will be used in window render frame per sec calculate
+ */
+#if defined(CONFIG_MALI_DVFS)
+u32 mali_session_max_window_num(void)
+{
+	struct mali_session_data *session, *tmp;
+	u32 max_window_num = 0;
+	u32 tmp_number = 0;
+
+	mali_session_lock();
+
+	MALI_SESSION_FOREACH(session, tmp, link) {
+		tmp_number = _mali_osk_atomic_xchg(
+				     &session->number_of_window_jobs, 0);
+		if (max_window_num < tmp_number) {
+			max_window_num = tmp_number;
+		}
+	}
+
+	mali_session_unlock();
+
+	return max_window_num;
+}
+#endif
+
+void mali_session_memory_tracking(_mali_osk_print_ctx *print_ctx)
+{
+	struct mali_session_data *session, *tmp;
+	u32 mali_mem_usage;
+	u32 total_mali_mem_size;
+#ifdef MALI_MEM_SWAP_TRACKING
+	u32 swap_pool_size;
+	u32 swap_unlock_size;
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(print_ctx);
+	mali_session_lock();
+	MALI_SESSION_FOREACH(session, tmp, link) {
+#ifdef MALI_MEM_SWAP_TRACKING
+		_mali_osk_ctxprintf(print_ctx, "  %-25s  %-10u  %-10u  %-15u  %-15u  %-10u  %-10u  %-10u\n",
+				    session->comm, session->pid,
+				    (atomic_read(&session->mali_mem_allocated_pages)) * _MALI_OSK_MALI_PAGE_SIZE,
+				    (unsigned int)session->max_mali_mem_allocated_size,
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_EXTERNAL])) * _MALI_OSK_MALI_PAGE_SIZE),
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_UMP])) * _MALI_OSK_MALI_PAGE_SIZE),
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_DMA_BUF])) * _MALI_OSK_MALI_PAGE_SIZE),
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_SWAP])) * _MALI_OSK_MALI_PAGE_SIZE)
+				   );
+#else
+		_mali_osk_ctxprintf(print_ctx, "  %-25s  %-10u  %-10u  %-15u  %-15u  %-10u  %-10u  \n",
+				    session->comm, session->pid,
+				    (unsigned int)((atomic_read(&session->mali_mem_allocated_pages)) * _MALI_OSK_MALI_PAGE_SIZE),
+				    (unsigned int)session->max_mali_mem_allocated_size,
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_EXTERNAL])) * _MALI_OSK_MALI_PAGE_SIZE),
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_UMP])) * _MALI_OSK_MALI_PAGE_SIZE),
+				    (unsigned int)((atomic_read(&session->mali_mem_array[MALI_MEM_DMA_BUF])) * _MALI_OSK_MALI_PAGE_SIZE)
+				   );
+#endif
+	}
+	mali_session_unlock();
+	mali_mem_usage  = _mali_ukk_report_memory_usage();
+	total_mali_mem_size = _mali_ukk_report_total_memory_size();
+	_mali_osk_ctxprintf(print_ctx, "Mali mem usage: %u\nMali mem limit: %u\n", mali_mem_usage, total_mali_mem_size);
+#ifdef MALI_MEM_SWAP_TRACKING
+	mali_mem_swap_tracking(&swap_pool_size, &swap_unlock_size);
+	_mali_osk_ctxprintf(print_ctx, "Mali swap mem pool : %u\nMali swap mem unlock: %u\n", swap_pool_size, swap_unlock_size);
+#endif
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_session.h b/drivers/gpu/arm/mali400/common/mali_session.h
--- a/drivers/gpu/arm/mali400/common/mali_session.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_session.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_SESSION_H__
+#define __MALI_SESSION_H__
+
+#include "mali_mmu_page_directory.h"
+#include "mali_osk.h"
+#include "mali_osk_list.h"
+#include "mali_memory_types.h"
+#include "mali_memory_manager.h"
+
+struct mali_timeline_system;
+struct mali_soft_system;
+
+/* Number of frame builder job lists per session. */
+#define MALI_PP_JOB_FB_LOOKUP_LIST_SIZE 16
+#define MALI_PP_JOB_FB_LOOKUP_LIST_MASK (MALI_PP_JOB_FB_LOOKUP_LIST_SIZE - 1)
+/*Max pending big job allowed in kernel*/
+#define MALI_MAX_PENDING_BIG_JOB (2)
+
+struct mali_session_data {
+	_mali_osk_notification_queue_t *ioctl_queue;
+
+	_mali_osk_wait_queue_t *wait_queue; /**The wait queue to wait for the number of pp job become 0.*/
+
+	_mali_osk_mutex_t *memory_lock; /**< Lock protecting the vm manipulation */
+	_mali_osk_mutex_t *cow_lock; /** < Lock protecting the cow memory free manipulation */
+#if 0
+	_mali_osk_list_t memory_head; /**< Track all the memory allocated in this session, for freeing on abnormal termination */
+#endif
+	struct mali_page_directory *page_directory; /**< MMU page directory for this session */
+
+	_MALI_OSK_LIST_HEAD(link); /**< Link for list of all sessions */
+	_MALI_OSK_LIST_HEAD(pp_job_list); /**< List of all PP jobs on this session */
+
+#if defined(CONFIG_MALI_DVFS)
+	_mali_osk_atomic_t number_of_window_jobs; /**< Record the window jobs completed on this session in a period */
+#endif
+	_mali_osk_atomic_t number_of_pp_jobs; /** < Record the pp jobs on this session */
+
+	_mali_osk_list_t pp_job_fb_lookup_list[MALI_PP_JOB_FB_LOOKUP_LIST_SIZE]; /**< List of PP job lists per frame builder id.  Used to link jobs from same frame builder. */
+	struct mali_soft_job_system *soft_job_system; /**< Soft job system for this session. */
+	struct mali_timeline_system *timeline_system; /**< Timeline system for this session. */
+
+	mali_bool is_aborting; /**< MALI_TRUE if the session is aborting, MALI_FALSE if not. */
+	mali_bool use_high_priority_job_queue; /**< If MALI_TRUE, jobs added from this session will use the high priority job queues. */
+	u32 pid;
+	char *comm;
+	atomic_t mali_mem_array[MALI_MEM_TYPE_MAX]; /**< The array to record mem types' usage for this session. */
+	atomic_t mali_mem_allocated_pages; /** The current allocated mali memory pages, which include mali os memory and mali dedicated memory.*/
+	size_t max_mali_mem_allocated_size; /**< The past max mali memory allocated size, which include mali os memory and mali dedicated memory. */
+	/* Added for new memroy system */
+	struct mali_allocation_manager allocation_mgr;
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	u32 fence_context;      /** <  The execution dma fence context this fence is run on. */
+	_mali_osk_atomic_t fence_seqno; /** < Alinear increasing sequence number for this dma fence context. */
+#endif
+};
+
+_mali_osk_errcode_t mali_session_initialize(void);
+void mali_session_terminate(void);
+
+/* List of all sessions. Actual list head in mali_kernel_core.c */
+extern _mali_osk_list_t mali_sessions;
+/* Lock to protect modification and access to the mali_sessions list */
+extern _mali_osk_spinlock_irq_t *mali_sessions_lock;
+
+MALI_STATIC_INLINE void mali_session_lock(void)
+{
+	_mali_osk_spinlock_irq_lock(mali_sessions_lock);
+}
+
+MALI_STATIC_INLINE void mali_session_unlock(void)
+{
+	_mali_osk_spinlock_irq_unlock(mali_sessions_lock);
+}
+
+void mali_session_add(struct mali_session_data *session);
+void mali_session_remove(struct mali_session_data *session);
+u32 mali_session_get_count(void);
+mali_bool mali_session_pp_job_is_empty(void *data);
+wait_queue_head_t *mali_session_get_wait_queue(void);
+
+#define MALI_SESSION_FOREACH(session, tmp, link) \
+	_MALI_OSK_LIST_FOREACHENTRY(session, tmp, &mali_sessions, struct mali_session_data, link)
+
+MALI_STATIC_INLINE struct mali_page_directory *mali_session_get_page_directory(struct mali_session_data *session)
+{
+	return session->page_directory;
+}
+
+MALI_STATIC_INLINE void mali_session_memory_lock(struct mali_session_data *session)
+{
+	MALI_DEBUG_ASSERT_POINTER(session);
+	_mali_osk_mutex_wait(session->memory_lock);
+}
+
+MALI_STATIC_INLINE void mali_session_memory_unlock(struct mali_session_data *session)
+{
+	MALI_DEBUG_ASSERT_POINTER(session);
+	_mali_osk_mutex_signal(session->memory_lock);
+}
+
+MALI_STATIC_INLINE void mali_session_send_notification(struct mali_session_data *session, _mali_osk_notification_t *object)
+{
+	_mali_osk_notification_queue_send(session->ioctl_queue, object);
+}
+
+#if defined(CONFIG_MALI_DVFS)
+
+MALI_STATIC_INLINE void mali_session_inc_num_window_jobs(struct mali_session_data *session)
+{
+	MALI_DEBUG_ASSERT_POINTER(session);
+	_mali_osk_atomic_inc(&session->number_of_window_jobs);
+}
+
+/*
+ * Get the max completed window jobs from all active session,
+ * which will be used in  window render frame per sec calculate
+ */
+u32 mali_session_max_window_num(void);
+
+#endif
+
+void mali_session_memory_tracking(_mali_osk_print_ctx *print_ctx);
+
+#endif /* __MALI_SESSION_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_soft_job.c b/drivers/gpu/arm/mali400/common/mali_soft_job.c
--- a/drivers/gpu/arm/mali400/common/mali_soft_job.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_soft_job.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,438 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_soft_job.h"
+#include "mali_osk.h"
+#include "mali_timeline.h"
+#include "mali_session.h"
+#include "mali_kernel_common.h"
+#include "mali_uk_types.h"
+#include "mali_scheduler.h"
+#include "mali_executor.h"
+
+MALI_STATIC_INLINE void mali_soft_job_system_lock(struct mali_soft_job_system *system)
+{
+	MALI_DEBUG_ASSERT_POINTER(system);
+	_mali_osk_spinlock_irq_lock(system->lock);
+	MALI_DEBUG_PRINT(5, ("Mali Soft Job: soft system %p lock taken\n", system));
+	MALI_DEBUG_ASSERT(0 == system->lock_owner);
+	MALI_DEBUG_CODE(system->lock_owner = _mali_osk_get_tid());
+}
+
+MALI_STATIC_INLINE void mali_soft_job_system_unlock(struct mali_soft_job_system *system)
+{
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_PRINT(5, ("Mali Soft Job: releasing soft system %p lock\n", system));
+	MALI_DEBUG_ASSERT(_mali_osk_get_tid() == system->lock_owner);
+	MALI_DEBUG_CODE(system->lock_owner = 0);
+	_mali_osk_spinlock_irq_unlock(system->lock);
+}
+
+#if defined(DEBUG)
+MALI_STATIC_INLINE void mali_soft_job_system_assert_locked(struct mali_soft_job_system *system)
+{
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT(_mali_osk_get_tid() == system->lock_owner);
+}
+#define MALI_ASSERT_SOFT_JOB_SYSTEM_LOCKED(system) mali_soft_job_system_assert_locked(system)
+#else
+#define MALI_ASSERT_SOFT_JOB_SYSTEM_LOCKED(system)
+#endif /* defined(DEBUG) */
+
+struct mali_soft_job_system *mali_soft_job_system_create(struct mali_session_data *session)
+{
+	struct mali_soft_job_system *system;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	system = (struct mali_soft_job_system *) _mali_osk_calloc(1, sizeof(struct mali_soft_job_system));
+	if (NULL == system) {
+		return NULL;
+	}
+
+	system->session = session;
+
+	system->lock = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_ORDERED, _MALI_OSK_LOCK_ORDER_SCHEDULER);
+	if (NULL == system->lock) {
+		mali_soft_job_system_destroy(system);
+		return NULL;
+	}
+	system->lock_owner = 0;
+	system->last_job_id = 0;
+
+	_MALI_OSK_INIT_LIST_HEAD(&(system->jobs_used));
+
+	return system;
+}
+
+void mali_soft_job_system_destroy(struct mali_soft_job_system *system)
+{
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	/* All jobs should be free at this point. */
+	MALI_DEBUG_ASSERT(_mali_osk_list_empty(&(system->jobs_used)));
+
+	if (NULL != system) {
+		if (NULL != system->lock) {
+			_mali_osk_spinlock_irq_term(system->lock);
+		}
+		_mali_osk_free(system);
+	}
+}
+
+static void mali_soft_job_system_free_job(struct mali_soft_job_system *system, struct mali_soft_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_soft_job_system_lock(job->system);
+
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_INVALID_ID != job->id);
+	MALI_DEBUG_ASSERT(system == job->system);
+
+	_mali_osk_list_del(&(job->system_list));
+
+	mali_soft_job_system_unlock(job->system);
+
+	_mali_osk_free(job);
+}
+
+MALI_STATIC_INLINE struct mali_soft_job *mali_soft_job_system_lookup_job(struct mali_soft_job_system *system, u32 job_id)
+{
+	struct mali_soft_job *job, *tmp;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_ASSERT_SOFT_JOB_SYSTEM_LOCKED(system);
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp, &system->jobs_used, struct mali_soft_job, system_list) {
+		if (job->id == job_id)
+			return job;
+	}
+
+	return NULL;
+}
+
+void mali_soft_job_destroy(struct mali_soft_job *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(job->system);
+
+	MALI_DEBUG_PRINT(4, ("Mali Soft Job: destroying soft job %u (0x%08X)\n", job->id, job));
+
+	if (NULL != job) {
+		if (0 < _mali_osk_atomic_dec_return(&job->refcount)) return;
+
+		_mali_osk_atomic_term(&job->refcount);
+
+		if (NULL != job->activated_notification) {
+			_mali_osk_notification_delete(job->activated_notification);
+			job->activated_notification = NULL;
+		}
+
+		mali_soft_job_system_free_job(job->system, job);
+	}
+}
+
+struct mali_soft_job *mali_soft_job_create(struct mali_soft_job_system *system, mali_soft_job_type type, u64 user_job)
+{
+	struct mali_soft_job *job;
+	_mali_osk_notification_t *notification = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT((MALI_SOFT_JOB_TYPE_USER_SIGNALED == type) ||
+			  (MALI_SOFT_JOB_TYPE_SELF_SIGNALED == type));
+
+	notification = _mali_osk_notification_create(_MALI_NOTIFICATION_SOFT_ACTIVATED, sizeof(_mali_uk_soft_job_activated_s));
+	if (unlikely(NULL == notification)) {
+		MALI_PRINT_ERROR(("Mali Soft Job: failed to allocate notification"));
+		return NULL;
+	}
+
+	job = _mali_osk_malloc(sizeof(struct mali_soft_job));
+	if (unlikely(NULL == job)) {
+		MALI_DEBUG_PRINT(2, ("Mali Soft Job: system alloc job failed. \n"));
+		return NULL;
+	}
+
+	mali_soft_job_system_lock(system);
+
+	job->system = system;
+	job->id = system->last_job_id++;
+	job->state = MALI_SOFT_JOB_STATE_ALLOCATED;
+
+	_mali_osk_list_add(&(job->system_list), &(system->jobs_used));
+
+	job->type = type;
+	job->user_job = user_job;
+	job->activated = MALI_FALSE;
+
+	job->activated_notification = notification;
+
+	_mali_osk_atomic_init(&job->refcount, 1);
+
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_ALLOCATED == job->state);
+	MALI_DEBUG_ASSERT(system == job->system);
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_INVALID_ID != job->id);
+
+	mali_soft_job_system_unlock(system);
+
+	return job;
+}
+
+mali_timeline_point mali_soft_job_start(struct mali_soft_job *job, struct mali_timeline_fence *fence)
+{
+	mali_timeline_point point;
+	struct mali_soft_job_system *system;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(fence);
+
+	MALI_DEBUG_ASSERT_POINTER(job->system);
+	system = job->system;
+
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+	MALI_DEBUG_ASSERT_POINTER(system->session->timeline_system);
+
+	mali_soft_job_system_lock(system);
+
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_ALLOCATED == job->state);
+	job->state = MALI_SOFT_JOB_STATE_STARTED;
+
+	mali_soft_job_system_unlock(system);
+
+	MALI_DEBUG_PRINT(4, ("Mali Soft Job: starting soft job %u (0x%08X)\n", job->id, job));
+
+	mali_timeline_tracker_init(&job->tracker, MALI_TIMELINE_TRACKER_SOFT, fence, job);
+	point = mali_timeline_system_add_tracker(system->session->timeline_system, &job->tracker, MALI_TIMELINE_SOFT);
+
+	return point;
+}
+
+static mali_bool mali_soft_job_is_activated(void *data)
+{
+	struct mali_soft_job *job;
+
+	job = (struct mali_soft_job *) data;
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	return job->activated;
+}
+
+_mali_osk_errcode_t mali_soft_job_system_signal_job(struct mali_soft_job_system *system, u32 job_id)
+{
+	struct mali_soft_job *job;
+	struct mali_timeline_system *timeline_system;
+	mali_scheduler_mask schedule_mask;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_soft_job_system_lock(system);
+
+	job = mali_soft_job_system_lookup_job(system, job_id);
+
+	if ((NULL == job) || (MALI_SOFT_JOB_TYPE_USER_SIGNALED != job->type)
+	    || !(MALI_SOFT_JOB_STATE_STARTED == job->state || MALI_SOFT_JOB_STATE_TIMED_OUT == job->state)) {
+		mali_soft_job_system_unlock(system);
+		MALI_PRINT_ERROR(("Mali Soft Job: invalid soft job id %u", job_id));
+		return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	}
+
+	if (MALI_SOFT_JOB_STATE_TIMED_OUT == job->state) {
+		job->state = MALI_SOFT_JOB_STATE_SIGNALED;
+		mali_soft_job_system_unlock(system);
+
+		MALI_DEBUG_ASSERT(MALI_TRUE == job->activated);
+		MALI_DEBUG_PRINT(4, ("Mali Soft Job: soft job %u (0x%08X) was timed out\n", job->id, job));
+		mali_soft_job_destroy(job);
+
+		return _MALI_OSK_ERR_TIMEOUT;
+	}
+
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_STARTED == job->state);
+
+	job->state = MALI_SOFT_JOB_STATE_SIGNALED;
+	mali_soft_job_system_unlock(system);
+
+	/* Since the job now is in signaled state, timeouts from the timeline system will be
+	 * ignored, and it is not possible to signal this job again. */
+
+	timeline_system = system->session->timeline_system;
+	MALI_DEBUG_ASSERT_POINTER(timeline_system);
+
+	/* Wait until activated. */
+	_mali_osk_wait_queue_wait_event(timeline_system->wait_queue, mali_soft_job_is_activated, (void *) job);
+
+	MALI_DEBUG_PRINT(4, ("Mali Soft Job: signaling soft job %u (0x%08X)\n", job->id, job));
+
+	schedule_mask = mali_timeline_tracker_release(&job->tracker);
+	mali_executor_schedule_from_mask(schedule_mask, MALI_FALSE);
+
+	mali_soft_job_destroy(job);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+static void mali_soft_job_send_activated_notification(struct mali_soft_job *job)
+{
+	if (NULL != job->activated_notification) {
+		_mali_uk_soft_job_activated_s *res = job->activated_notification->result_buffer;
+		res->user_job = job->user_job;
+		mali_session_send_notification(job->system->session, job->activated_notification);
+	}
+	job->activated_notification = NULL;
+}
+
+mali_scheduler_mask mali_soft_job_system_activate_job(struct mali_soft_job *job)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(job->system);
+	MALI_DEBUG_ASSERT_POINTER(job->system->session);
+
+	MALI_DEBUG_PRINT(4, ("Mali Soft Job: Timeline activation for soft job %u (0x%08X).\n", job->id, job));
+
+	mali_soft_job_system_lock(job->system);
+
+	if (unlikely(job->system->session->is_aborting)) {
+		MALI_DEBUG_PRINT(3, ("Mali Soft Job: Soft job %u (0x%08X) activated while session is aborting.\n", job->id, job));
+
+		mali_soft_job_system_unlock(job->system);
+
+		/* Since we are in shutdown, we can ignore the scheduling bitmask. */
+		mali_timeline_tracker_release(&job->tracker);
+		mali_soft_job_destroy(job);
+		return schedule_mask;
+	}
+
+	/* Send activated notification. */
+	mali_soft_job_send_activated_notification(job);
+
+	/* Wake up sleeping signaler. */
+	job->activated = MALI_TRUE;
+
+	/* If job type is self signaled, release tracker, move soft job to free list, and scheduler at once */
+	if (MALI_SOFT_JOB_TYPE_SELF_SIGNALED == job->type) {
+		MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_STARTED == job->state);
+
+		job->state = MALI_SOFT_JOB_STATE_SIGNALED;
+		mali_soft_job_system_unlock(job->system);
+
+		schedule_mask |= mali_timeline_tracker_release(&job->tracker);
+
+		mali_soft_job_destroy(job);
+	} else {
+		_mali_osk_wait_queue_wake_up(job->tracker.system->wait_queue);
+
+		mali_soft_job_system_unlock(job->system);
+	}
+
+	return schedule_mask;
+}
+
+mali_scheduler_mask mali_soft_job_system_timeout_job(struct mali_soft_job *job)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+	MALI_DEBUG_ASSERT_POINTER(job->system);
+	MALI_DEBUG_ASSERT_POINTER(job->system->session);
+	MALI_DEBUG_ASSERT(MALI_TRUE == job->activated);
+
+	MALI_DEBUG_PRINT(4, ("Mali Soft Job: Timeline timeout for soft job %u (0x%08X).\n", job->id, job));
+
+	mali_soft_job_system_lock(job->system);
+
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_STARTED  == job->state ||
+			  MALI_SOFT_JOB_STATE_SIGNALED == job->state);
+
+	if (unlikely(job->system->session->is_aborting)) {
+		/* The session is aborting.  This job will be released and destroyed by @ref
+		 * mali_soft_job_system_abort(). */
+		mali_soft_job_system_unlock(job->system);
+
+		return MALI_SCHEDULER_MASK_EMPTY;
+	}
+
+	if (MALI_SOFT_JOB_STATE_STARTED != job->state) {
+		MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_SIGNALED == job->state);
+
+		/* The job is about to be signaled, ignore timeout. */
+		MALI_DEBUG_PRINT(4, ("Mali Soft Job: Timeout on soft job %u (0x%08X) in signaled state.\n", job->id, job));
+		mali_soft_job_system_unlock(job->system);
+		return schedule_mask;
+	}
+
+	MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_STARTED == job->state);
+
+	job->state = MALI_SOFT_JOB_STATE_TIMED_OUT;
+	_mali_osk_atomic_inc(&job->refcount);
+
+	mali_soft_job_system_unlock(job->system);
+
+	schedule_mask = mali_timeline_tracker_release(&job->tracker);
+
+	mali_soft_job_destroy(job);
+
+	return schedule_mask;
+}
+
+void mali_soft_job_system_abort(struct mali_soft_job_system *system)
+{
+	struct mali_soft_job *job, *tmp;
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(jobs);
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+	MALI_DEBUG_ASSERT(system->session->is_aborting);
+
+	MALI_DEBUG_PRINT(3, ("Mali Soft Job: Aborting soft job system for session 0x%08X.\n", system->session));
+
+	mali_soft_job_system_lock(system);
+
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp, &system->jobs_used, struct mali_soft_job, system_list) {
+		MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_STARTED   == job->state ||
+				  MALI_SOFT_JOB_STATE_TIMED_OUT == job->state);
+
+		if (MALI_SOFT_JOB_STATE_STARTED == job->state) {
+			/* If the job has been activated, we have to release the tracker and destroy
+			 * the job.  If not, the tracker will be released and the job destroyed when
+			 * it is activated. */
+			if (MALI_TRUE == job->activated) {
+				MALI_DEBUG_PRINT(3, ("Mali Soft Job: Aborting unsignaled soft job %u (0x%08X).\n", job->id, job));
+
+				job->state = MALI_SOFT_JOB_STATE_SIGNALED;
+				_mali_osk_list_move(&job->system_list, &jobs);
+			}
+		} else if (MALI_SOFT_JOB_STATE_TIMED_OUT == job->state) {
+			MALI_DEBUG_PRINT(3, ("Mali Soft Job: Aborting timed out soft job %u (0x%08X).\n", job->id, job));
+
+			/* We need to destroy this soft job. */
+			_mali_osk_list_move(&job->system_list, &jobs);
+		}
+	}
+
+	mali_soft_job_system_unlock(system);
+
+	/* Release and destroy jobs. */
+	_MALI_OSK_LIST_FOREACHENTRY(job, tmp, &jobs, struct mali_soft_job, system_list) {
+		MALI_DEBUG_ASSERT(MALI_SOFT_JOB_STATE_SIGNALED  == job->state ||
+				  MALI_SOFT_JOB_STATE_TIMED_OUT == job->state);
+
+		if (MALI_SOFT_JOB_STATE_SIGNALED == job->state) {
+			mali_timeline_tracker_release(&job->tracker);
+		}
+
+		/* Move job back to used list before destroying. */
+		_mali_osk_list_move(&job->system_list, &system->jobs_used);
+
+		mali_soft_job_destroy(job);
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_soft_job.h b/drivers/gpu/arm/mali400/common/mali_soft_job.h
--- a/drivers/gpu/arm/mali400/common/mali_soft_job.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_soft_job.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_SOFT_JOB_H__
+#define __MALI_SOFT_JOB_H__
+
+#include "mali_osk.h"
+
+#include "mali_timeline.h"
+
+struct mali_timeline_fence;
+struct mali_session_data;
+struct mali_soft_job;
+struct mali_soft_job_system;
+
+/**
+ * Soft job types.
+ *
+ * Soft jobs of type MALI_SOFT_JOB_TYPE_USER_SIGNALED will only complete after activation if either
+ * they are signaled by user-space (@ref mali_soft_job_system_signaled_job) or if they are timed out
+ * by the Timeline system.
+ * Soft jobs of type MALI_SOFT_JOB_TYPE_SELF_SIGNALED will release job resource automatically
+ * in kernel when the job is activated.
+ */
+typedef enum mali_soft_job_type {
+	MALI_SOFT_JOB_TYPE_SELF_SIGNALED,
+	MALI_SOFT_JOB_TYPE_USER_SIGNALED,
+} mali_soft_job_type;
+
+/**
+ * Soft job state.
+ *
+ * mali_soft_job_system_start_job a job will first be allocated.The job's state set to MALI_SOFT_JOB_STATE_ALLOCATED.
+ * Once the job is added to the timeline system, the state changes to MALI_SOFT_JOB_STATE_STARTED.
+ *
+ * For soft jobs of type MALI_SOFT_JOB_TYPE_USER_SIGNALED the state is changed to
+ * MALI_SOFT_JOB_STATE_SIGNALED when @ref mali_soft_job_system_signal_job is called and the soft
+ * job's state is MALI_SOFT_JOB_STATE_STARTED or MALI_SOFT_JOB_STATE_TIMED_OUT.
+ *
+ * If a soft job of type MALI_SOFT_JOB_TYPE_USER_SIGNALED is timed out before being signaled, the
+ * state is changed to MALI_SOFT_JOB_STATE_TIMED_OUT.  This can only happen to soft jobs in state
+ * MALI_SOFT_JOB_STATE_STARTED.
+ *
+ */
+typedef enum mali_soft_job_state {
+	MALI_SOFT_JOB_STATE_ALLOCATED,
+	MALI_SOFT_JOB_STATE_STARTED,
+	MALI_SOFT_JOB_STATE_SIGNALED,
+	MALI_SOFT_JOB_STATE_TIMED_OUT,
+} mali_soft_job_state;
+
+#define MALI_SOFT_JOB_INVALID_ID ((u32) -1)
+
+/**
+ * Soft job struct.
+ *
+ * Soft job can be used to represent any kind of CPU work done in kernel-space.
+ */
+typedef struct mali_soft_job {
+	mali_soft_job_type            type;                   /**< Soft job type.  Must be one of MALI_SOFT_JOB_TYPE_*. */
+	u64                           user_job;               /**< Identifier for soft job in user space. */
+	_mali_osk_atomic_t            refcount;               /**< Soft jobs are reference counted to prevent premature deletion. */
+	struct mali_timeline_tracker  tracker;                /**< Timeline tracker for soft job. */
+	mali_bool                     activated;              /**< MALI_TRUE if the job has been activated, MALI_FALSE if not. */
+	_mali_osk_notification_t     *activated_notification; /**< Pre-allocated notification object for ACTIVATED_NOTIFICATION. */
+
+	/* Protected by soft job system lock. */
+	u32                           id;                     /**< Used by user-space to find corresponding soft job in kernel-space. */
+	mali_soft_job_state           state;                  /**< State of soft job, must be one of MALI_SOFT_JOB_STATE_*. */
+	struct mali_soft_job_system  *system;                 /**< The soft job system this job is in. */
+	_mali_osk_list_t              system_list;            /**< List element used by soft job system. */
+} mali_soft_job;
+
+/**
+ * Per-session soft job system.
+ *
+ * The soft job system is used to manage all soft jobs that belongs to a session.
+ */
+typedef struct mali_soft_job_system {
+	struct mali_session_data *session;                    /**< The session this soft job system belongs to. */
+	_MALI_OSK_LIST_HEAD(jobs_used);                       /**< List of all allocated soft jobs. */
+
+	_mali_osk_spinlock_irq_t *lock;                       /**< Lock used to protect soft job system and its soft jobs. */
+	u32 lock_owner;                                       /**< Contains tid of thread that locked the system or 0, if not locked. */
+	u32 last_job_id;                                      /**< Recored the last job id protected by lock. */
+} mali_soft_job_system;
+
+/**
+ * Create a soft job system.
+ *
+ * @param session The session this soft job system will belong to.
+ * @return The new soft job system, or NULL if unsuccessful.
+ */
+struct mali_soft_job_system *mali_soft_job_system_create(struct mali_session_data *session);
+
+/**
+ * Destroy a soft job system.
+ *
+ * @note The soft job must not have any started or activated jobs.  Call @ref
+ * mali_soft_job_system_abort first.
+ *
+ * @param system The soft job system we are destroying.
+ */
+void mali_soft_job_system_destroy(struct mali_soft_job_system *system);
+
+/**
+ * Create a soft job.
+ *
+ * @param system Soft job system to create soft job from.
+ * @param type Type of the soft job.
+ * @param user_job Identifier for soft job in user space.
+ * @return New soft job if successful, NULL if not.
+ */
+struct mali_soft_job *mali_soft_job_create(struct mali_soft_job_system *system, mali_soft_job_type type, u64 user_job);
+
+/**
+ * Destroy soft job.
+ *
+ * @param job Soft job to destroy.
+ */
+void mali_soft_job_destroy(struct mali_soft_job *job);
+
+/**
+ * Start a soft job.
+ *
+ * The soft job will be added to the Timeline system which will then activate it after all
+ * dependencies have been resolved.
+ *
+ * Create soft jobs with @ref mali_soft_job_create before starting them.
+ *
+ * @param job Soft job to start.
+ * @param fence Fence representing dependencies for this soft job.
+ * @return Point on soft job timeline.
+ */
+mali_timeline_point mali_soft_job_start(struct mali_soft_job *job, struct mali_timeline_fence *fence);
+
+/**
+ * Use by user-space to signal that a soft job has completed.
+ *
+ * @note Only valid for soft jobs with type MALI_SOFT_JOB_TYPE_USER_SIGNALED.
+ *
+ * @note The soft job must be in state MALI_SOFT_JOB_STATE_STARTED for the signal to be successful.
+ *
+ * @note If the soft job was signaled successfully, or it received a time out, the soft job will be
+ * destroyed after this call and should no longer be used.
+ *
+ * @note This function will block until the soft job has been activated.
+ *
+ * @param system The soft job system the job was started in.
+ * @param job_id ID of soft job we are signaling.
+ *
+ * @return _MALI_OSK_ERR_ITEM_NOT_FOUND if the soft job ID was invalid, _MALI_OSK_ERR_TIMEOUT if the
+ * soft job was timed out or _MALI_OSK_ERR_OK if we successfully signaled the soft job.
+ */
+_mali_osk_errcode_t mali_soft_job_system_signal_job(struct mali_soft_job_system *system, u32 job_id);
+
+/**
+ * Used by the Timeline system to activate a soft job.
+ *
+ * @param job The soft job that is being activated.
+ * @return A scheduling bitmask.
+ */
+mali_scheduler_mask mali_soft_job_system_activate_job(struct mali_soft_job *job);
+
+/**
+ * Used by the Timeline system to timeout a soft job.
+ *
+ * A soft job is timed out if it completes or is signaled later than MALI_TIMELINE_TIMEOUT_HZ after
+ * activation.
+ *
+ * @param job The soft job that is being timed out.
+ * @return A scheduling bitmask.
+ */
+mali_scheduler_mask mali_soft_job_system_timeout_job(struct mali_soft_job *job);
+
+/**
+ * Used to cleanup activated soft jobs in the soft job system on session abort.
+ *
+ * @param system The soft job system that is being aborted.
+ */
+void mali_soft_job_system_abort(struct mali_soft_job_system *system);
+
+#endif /* __MALI_SOFT_JOB_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.c b/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.c
--- a/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_spinlock_reentrant.h"
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+struct mali_spinlock_reentrant *mali_spinlock_reentrant_init(_mali_osk_lock_order_t lock_order)
+{
+	struct mali_spinlock_reentrant *spinlock;
+
+	spinlock = _mali_osk_calloc(1, sizeof(struct mali_spinlock_reentrant));
+	if (NULL == spinlock) {
+		return NULL;
+	}
+
+	spinlock->lock = _mali_osk_spinlock_irq_init(_MALI_OSK_LOCKFLAG_ORDERED, lock_order);
+	if (NULL == spinlock->lock) {
+		mali_spinlock_reentrant_term(spinlock);
+		return NULL;
+	}
+
+	return spinlock;
+}
+
+void mali_spinlock_reentrant_term(struct mali_spinlock_reentrant *spinlock)
+{
+	MALI_DEBUG_ASSERT_POINTER(spinlock);
+	MALI_DEBUG_ASSERT(0 == spinlock->counter && 0 == spinlock->owner);
+
+	if (NULL != spinlock->lock) {
+		_mali_osk_spinlock_irq_term(spinlock->lock);
+	}
+
+	_mali_osk_free(spinlock);
+}
+
+void mali_spinlock_reentrant_wait(struct mali_spinlock_reentrant *spinlock, u32 tid)
+{
+	MALI_DEBUG_ASSERT_POINTER(spinlock);
+	MALI_DEBUG_ASSERT_POINTER(spinlock->lock);
+	MALI_DEBUG_ASSERT(0 != tid);
+
+	MALI_DEBUG_PRINT(5, ("%s ^\n", __FUNCTION__));
+
+	if (tid != spinlock->owner) {
+		_mali_osk_spinlock_irq_lock(spinlock->lock);
+		MALI_DEBUG_ASSERT(0 == spinlock->owner && 0 == spinlock->counter);
+		spinlock->owner = tid;
+	}
+
+	MALI_DEBUG_PRINT(5, ("%s v\n", __FUNCTION__));
+
+	++spinlock->counter;
+}
+
+void mali_spinlock_reentrant_signal(struct mali_spinlock_reentrant *spinlock, u32 tid)
+{
+	MALI_DEBUG_ASSERT_POINTER(spinlock);
+	MALI_DEBUG_ASSERT_POINTER(spinlock->lock);
+	MALI_DEBUG_ASSERT(0 != tid && tid == spinlock->owner);
+
+	--spinlock->counter;
+	if (0 == spinlock->counter) {
+		spinlock->owner = 0;
+		MALI_DEBUG_PRINT(5, ("%s release last\n", __FUNCTION__));
+		_mali_osk_spinlock_irq_unlock(spinlock->lock);
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.h b/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.h
--- a/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_spinlock_reentrant.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_SPINLOCK_REENTRANT_H__
+#define __MALI_SPINLOCK_REENTRANT_H__
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+/**
+ * Reentrant spinlock.
+ */
+struct mali_spinlock_reentrant {
+	_mali_osk_spinlock_irq_t *lock;
+	u32               owner;
+	u32               counter;
+};
+
+/**
+ * Create a new reentrant spinlock.
+ *
+ * @param lock_order Lock order.
+ * @return New reentrant spinlock.
+ */
+struct mali_spinlock_reentrant *mali_spinlock_reentrant_init(_mali_osk_lock_order_t lock_order);
+
+/**
+ * Terminate reentrant spinlock and free any associated resources.
+ *
+ * @param spinlock Reentrant spinlock to terminate.
+ */
+void mali_spinlock_reentrant_term(struct mali_spinlock_reentrant *spinlock);
+
+/**
+ * Wait for reentrant spinlock to be signaled.
+ *
+ * @param spinlock Reentrant spinlock.
+ * @param tid Thread ID.
+ */
+void mali_spinlock_reentrant_wait(struct mali_spinlock_reentrant *spinlock, u32 tid);
+
+/**
+ * Signal reentrant spinlock.
+ *
+ * @param spinlock Reentrant spinlock.
+ * @param tid Thread ID.
+ */
+void mali_spinlock_reentrant_signal(struct mali_spinlock_reentrant *spinlock, u32 tid);
+
+/**
+ * Check if thread is holding reentrant spinlock.
+ *
+ * @param spinlock Reentrant spinlock.
+ * @param tid Thread ID.
+ * @return MALI_TRUE if thread is holding spinlock, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_spinlock_reentrant_is_held(struct mali_spinlock_reentrant *spinlock, u32 tid)
+{
+	MALI_DEBUG_ASSERT_POINTER(spinlock->lock);
+	return (tid == spinlock->owner && 0 < spinlock->counter);
+}
+
+#endif /* __MALI_SPINLOCK_REENTRANT_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_timeline.c b/drivers/gpu/arm/mali400/common/mali_timeline.c
--- a/drivers/gpu/arm/mali400/common/mali_timeline.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_timeline.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1748 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_timeline.h"
+#include "mali_kernel_common.h"
+#include "mali_scheduler.h"
+#include "mali_soft_job.h"
+#include "mali_timeline_fence_wait.h"
+#include "mali_timeline_sync_fence.h"
+#include "mali_executor.h"
+#include "mali_pp_job.h"
+
+#define MALI_TIMELINE_SYSTEM_LOCKED(system) (mali_spinlock_reentrant_is_held((system)->spinlock, _mali_osk_get_tid()))
+
+/*
+ * Following three elements are used to record how many
+ * gp, physical pp or virtual pp jobs are delayed in the whole
+ * timeline system, we can use these three value to decide
+ * if need to deactivate idle group.
+ */
+_mali_osk_atomic_t gp_tracker_count;
+_mali_osk_atomic_t phy_pp_tracker_count;
+_mali_osk_atomic_t virt_pp_tracker_count;
+
+static mali_scheduler_mask mali_timeline_system_release_waiter(struct mali_timeline_system *system,
+		struct mali_timeline_waiter *waiter);
+
+#if defined(CONFIG_SYNC)
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,5,0)
+#include <linux/list.h>
+#include <linux/workqueue.h>
+#include <linux/spinlock.h>
+
+struct mali_deferred_fence_put_entry {
+	struct hlist_node list;
+	struct sync_fence *fence;
+};
+
+static HLIST_HEAD(mali_timeline_sync_fence_to_free_list);
+static DEFINE_SPINLOCK(mali_timeline_sync_fence_to_free_lock);
+
+static void put_sync_fences(struct work_struct *ignore)
+{
+	struct hlist_head list;
+	struct hlist_node *tmp, *pos;
+	unsigned long flags;
+	struct mali_deferred_fence_put_entry *o;
+
+	spin_lock_irqsave(&mali_timeline_sync_fence_to_free_lock, flags);
+	hlist_move_list(&mali_timeline_sync_fence_to_free_list, &list);
+	spin_unlock_irqrestore(&mali_timeline_sync_fence_to_free_lock, flags);
+
+	hlist_for_each_entry_safe(o, pos, tmp, &list, list) {
+		sync_fence_put(o->fence);
+		kfree(o);
+	}
+}
+
+static DECLARE_DELAYED_WORK(delayed_sync_fence_put, put_sync_fences);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3,5,0) */
+
+/* Callback that is called when a sync fence a tracker is waiting on is signaled. */
+static void mali_timeline_sync_fence_callback(struct sync_fence *sync_fence, struct sync_fence_waiter *sync_fence_waiter)
+{
+	struct mali_timeline_system  *system;
+	struct mali_timeline_waiter  *waiter;
+	struct mali_timeline_tracker *tracker;
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+	u32 tid = _mali_osk_get_tid();
+	mali_bool is_aborting = MALI_FALSE;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0)
+	int fence_status = sync_fence->status;
+#else
+	int fence_status = atomic_read(&sync_fence->status);
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(sync_fence);
+	MALI_DEBUG_ASSERT_POINTER(sync_fence_waiter);
+
+	tracker = _MALI_OSK_CONTAINER_OF(sync_fence_waiter, struct mali_timeline_tracker, sync_fence_waiter);
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	system = tracker->system;
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	is_aborting = system->session->is_aborting;
+	if (!is_aborting && (0 > fence_status)) {
+		MALI_PRINT_ERROR(("Mali Timeline: sync fence fd %d signaled with error %d\n", tracker->fence.sync_fd, fence_status));
+		tracker->activation_error |= MALI_TIMELINE_ACTIVATION_ERROR_SYNC_BIT;
+	}
+
+	waiter = tracker->waiter_sync;
+	MALI_DEBUG_ASSERT_POINTER(waiter);
+
+	tracker->sync_fence = NULL;
+	tracker->fence.sync_fd = -1;
+
+	schedule_mask |= mali_timeline_system_release_waiter(system, waiter);
+
+	/* If aborting, wake up sleepers that are waiting for sync fence callbacks to complete. */
+	if (is_aborting) {
+		_mali_osk_wait_queue_wake_up(system->wait_queue);
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	/*
+	 * Older versions of Linux, before 3.5, doesn't support fput() in interrupt
+	 * context. For those older kernels, allocate a list object and put the
+	 * fence object on that and defer the call to sync_fence_put() to a workqueue.
+	 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3,5,0)
+	{
+		struct mali_deferred_fence_put_entry *obj;
+
+		obj = kzalloc(sizeof(struct mali_deferred_fence_put_entry), GFP_ATOMIC);
+		if (obj) {
+			unsigned long flags;
+			mali_bool schedule = MALI_FALSE;
+
+			obj->fence = sync_fence;
+
+			spin_lock_irqsave(&mali_timeline_sync_fence_to_free_lock, flags);
+			if (hlist_empty(&mali_timeline_sync_fence_to_free_list))
+				schedule = MALI_TRUE;
+			hlist_add_head(&obj->list, &mali_timeline_sync_fence_to_free_list);
+			spin_unlock_irqrestore(&mali_timeline_sync_fence_to_free_lock, flags);
+
+			if (schedule)
+				schedule_delayed_work(&delayed_sync_fence_put, 0);
+		}
+	}
+#else
+	sync_fence_put(sync_fence);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3,5,0) */
+
+	if (!is_aborting) {
+		mali_executor_schedule_from_mask(schedule_mask, MALI_TRUE);
+	}
+}
+#endif /* defined(CONFIG_SYNC) */
+
+static mali_scheduler_mask mali_timeline_tracker_time_out(struct mali_timeline_tracker *tracker)
+{
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_TRACKER_SOFT == tracker->type);
+
+	return mali_soft_job_system_timeout_job((struct mali_soft_job *) tracker->job);
+}
+
+static void mali_timeline_timer_callback(void *data)
+{
+	struct mali_timeline_system *system;
+	struct mali_timeline_tracker *tracker;
+	struct mali_timeline *timeline;
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+	u32 tid = _mali_osk_get_tid();
+
+	timeline = (struct mali_timeline *) data;
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	system = timeline->system;
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	if (!system->timer_enabled) {
+		mali_spinlock_reentrant_signal(system->spinlock, tid);
+		return;
+	}
+
+	tracker = timeline->tracker_tail;
+	timeline->timer_active = MALI_FALSE;
+
+	if (NULL != tracker && MALI_TRUE == tracker->timer_active) {
+		/* This is likely the delayed work that has been schedule out before cancelled. */
+		if (MALI_TIMELINE_TIMEOUT_HZ > (_mali_osk_time_tickcount() - tracker->os_tick_activate)) {
+			mali_spinlock_reentrant_signal(system->spinlock, tid);
+			return;
+		}
+
+		schedule_mask = mali_timeline_tracker_time_out(tracker);
+		tracker->timer_active = MALI_FALSE;
+	} else {
+		MALI_PRINT_ERROR(("Mali Timeline: Soft job timer callback without a waiting tracker.\n"));
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	mali_executor_schedule_from_mask(schedule_mask, MALI_FALSE);
+}
+
+void mali_timeline_system_stop_timer(struct mali_timeline_system *system)
+{
+	u32 i;
+	u32 tid = _mali_osk_get_tid();
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+	system->timer_enabled = MALI_FALSE;
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline = system->timelines[i];
+
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		if (NULL != timeline->delayed_work) {
+			_mali_osk_wq_delayed_cancel_work_sync(timeline->delayed_work);
+			timeline->timer_active = MALI_FALSE;
+		}
+	}
+}
+
+static void mali_timeline_destroy(struct mali_timeline *timeline)
+{
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	if (NULL != timeline) {
+		/* Assert that the timeline object has been properly cleaned up before destroying it. */
+		MALI_DEBUG_ASSERT(timeline->point_oldest == timeline->point_next);
+		MALI_DEBUG_ASSERT(NULL == timeline->tracker_head);
+		MALI_DEBUG_ASSERT(NULL == timeline->tracker_tail);
+		MALI_DEBUG_ASSERT(NULL == timeline->waiter_head);
+		MALI_DEBUG_ASSERT(NULL == timeline->waiter_tail);
+		MALI_DEBUG_ASSERT(NULL != timeline->system);
+		MALI_DEBUG_ASSERT(MALI_TIMELINE_MAX > timeline->id);
+
+		if (NULL != timeline->delayed_work) {
+			_mali_osk_wq_delayed_cancel_work_sync(timeline->delayed_work);
+			_mali_osk_wq_delayed_delete_work_nonflush(timeline->delayed_work);
+		}
+
+#if defined(CONFIG_SYNC)
+		if (NULL != timeline->sync_tl) {
+			sync_timeline_destroy(timeline->sync_tl);
+		}
+#endif /* defined(CONFIG_SYNC) */
+
+#ifndef CONFIG_SYNC
+		_mali_osk_free(timeline);
+#endif
+	}
+}
+
+static struct mali_timeline *mali_timeline_create(struct mali_timeline_system *system, enum mali_timeline_id id)
+{
+	struct mali_timeline *timeline;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT(id < MALI_TIMELINE_MAX);
+
+	timeline = (struct mali_timeline *) _mali_osk_calloc(1, sizeof(struct mali_timeline));
+	if (NULL == timeline) {
+		return NULL;
+	}
+
+	/* Initially the timeline is empty. */
+#if defined(MALI_TIMELINE_DEBUG_START_POINT)
+	/* Start the timeline a bit before wrapping when debugging. */
+	timeline->point_next = UINT_MAX - MALI_TIMELINE_MAX_POINT_SPAN - 128;
+#else
+	timeline->point_next = 1;
+#endif
+	timeline->point_oldest = timeline->point_next;
+
+	/* The tracker and waiter lists will initially be empty. */
+
+	timeline->system = system;
+	timeline->id = id;
+
+	timeline->delayed_work = _mali_osk_wq_delayed_create_work(mali_timeline_timer_callback, timeline);
+	if (NULL == timeline->delayed_work) {
+		mali_timeline_destroy(timeline);
+		return NULL;
+	}
+
+	timeline->timer_active = MALI_FALSE;
+
+#if defined(CONFIG_SYNC)
+	{
+		char timeline_name[32];
+
+		switch (id) {
+		case MALI_TIMELINE_GP:
+			_mali_osk_snprintf(timeline_name, 32, "mali-%u-gp", _mali_osk_get_pid());
+			break;
+		case MALI_TIMELINE_PP:
+			_mali_osk_snprintf(timeline_name, 32, "mali-%u-pp", _mali_osk_get_pid());
+			break;
+		case MALI_TIMELINE_SOFT:
+			_mali_osk_snprintf(timeline_name, 32, "mali-%u-soft", _mali_osk_get_pid());
+			break;
+		default:
+			MALI_PRINT_ERROR(("Mali Timeline: Invalid timeline id %d\n", id));
+			mali_timeline_destroy(timeline);
+			return NULL;
+		}
+
+		timeline->destroyed = MALI_FALSE;
+
+		timeline->sync_tl = mali_sync_timeline_create(timeline, timeline_name);
+		if (NULL == timeline->sync_tl) {
+			mali_timeline_destroy(timeline);
+			return NULL;
+		}
+
+		timeline->spinlock = mali_spinlock_reentrant_init(_MALI_OSK_LOCK_ORDER_TIMELINE_SYSTEM);
+		if (NULL == timeline->spinlock) {
+			mali_timeline_destroy(timeline);
+			return NULL;
+		}
+	}
+#endif /* defined(CONFIG_SYNC) */
+
+	return timeline;
+}
+
+static void mali_timeline_insert_tracker(struct mali_timeline *timeline, struct mali_timeline_tracker *tracker)
+{
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	if (mali_timeline_is_full(timeline)) {
+		/* Don't add tracker if timeline is full. */
+		tracker->point = MALI_TIMELINE_NO_POINT;
+		return;
+	}
+
+	tracker->timeline = timeline;
+	tracker->point    = timeline->point_next;
+
+	/* Find next available point. */
+	timeline->point_next++;
+	if (MALI_TIMELINE_NO_POINT == timeline->point_next) {
+		timeline->point_next++;
+	}
+
+	MALI_DEBUG_ASSERT(!mali_timeline_is_empty(timeline));
+
+	if (MALI_TIMELINE_TRACKER_GP == tracker->type) {
+		_mali_osk_atomic_inc(&gp_tracker_count);
+	} else if (MALI_TIMELINE_TRACKER_PP == tracker->type) {
+		if (mali_pp_job_is_virtual((struct mali_pp_job *)tracker->job)) {
+			_mali_osk_atomic_inc(&virt_pp_tracker_count);
+		} else {
+			_mali_osk_atomic_inc(&phy_pp_tracker_count);
+		}
+	}
+
+	/* Add tracker as new head on timeline's tracker list. */
+	if (NULL == timeline->tracker_head) {
+		/* Tracker list is empty. */
+		MALI_DEBUG_ASSERT(NULL == timeline->tracker_tail);
+
+		timeline->tracker_tail = tracker;
+
+		MALI_DEBUG_ASSERT(NULL == tracker->timeline_next);
+		MALI_DEBUG_ASSERT(NULL == tracker->timeline_prev);
+	} else {
+		MALI_DEBUG_ASSERT(NULL == timeline->tracker_head->timeline_next);
+
+		tracker->timeline_prev = timeline->tracker_head;
+		timeline->tracker_head->timeline_next = tracker;
+
+		MALI_DEBUG_ASSERT(NULL == tracker->timeline_next);
+	}
+	timeline->tracker_head = tracker;
+
+	MALI_DEBUG_ASSERT(NULL == timeline->tracker_head->timeline_next);
+	MALI_DEBUG_ASSERT(NULL == timeline->tracker_tail->timeline_prev);
+}
+
+/* Inserting the waiter object into the given timeline */
+static void mali_timeline_insert_waiter(struct mali_timeline *timeline, struct mali_timeline_waiter *waiter_new)
+{
+	struct mali_timeline_waiter *waiter_prev;
+	struct mali_timeline_waiter *waiter_next;
+
+	/* Waiter time must be between timeline head and tail, and there must
+	 * be less than MALI_TIMELINE_MAX_POINT_SPAN elements between */
+	MALI_DEBUG_ASSERT((waiter_new->point - timeline->point_oldest) < MALI_TIMELINE_MAX_POINT_SPAN);
+	MALI_DEBUG_ASSERT((-waiter_new->point + timeline->point_next) < MALI_TIMELINE_MAX_POINT_SPAN);
+
+	/* Finding out where to put this waiter, in the linked waiter list of the given timeline **/
+	waiter_prev = timeline->waiter_head; /* Insert new after  waiter_prev */
+	waiter_next = NULL;                  /* Insert new before waiter_next */
+
+	/* Iterating backwards from head (newest) to tail (oldest) until we
+	 * find the correct spot to insert the new waiter */
+	while (waiter_prev && mali_timeline_point_after(waiter_prev->point, waiter_new->point)) {
+		waiter_next = waiter_prev;
+		waiter_prev = waiter_prev->timeline_prev;
+	}
+
+	if (NULL == waiter_prev && NULL == waiter_next) {
+		/* list is empty */
+		timeline->waiter_head = waiter_new;
+		timeline->waiter_tail = waiter_new;
+	} else if (NULL == waiter_next) {
+		/* insert at head */
+		waiter_new->timeline_prev = timeline->waiter_head;
+		timeline->waiter_head->timeline_next = waiter_new;
+		timeline->waiter_head = waiter_new;
+	} else if (NULL == waiter_prev) {
+		/* insert at tail */
+		waiter_new->timeline_next = timeline->waiter_tail;
+		timeline->waiter_tail->timeline_prev = waiter_new;
+		timeline->waiter_tail = waiter_new;
+	} else {
+		/* insert between */
+		waiter_new->timeline_next = waiter_next;
+		waiter_new->timeline_prev = waiter_prev;
+		waiter_next->timeline_prev = waiter_new;
+		waiter_prev->timeline_next = waiter_new;
+	}
+}
+
+static void mali_timeline_update_delayed_work(struct mali_timeline *timeline)
+{
+	struct mali_timeline_system *system;
+	struct mali_timeline_tracker *oldest_tracker;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SOFT == timeline->id);
+
+	system = timeline->system;
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	/* Timer is disabled, early out. */
+	if (!system->timer_enabled) return;
+
+	oldest_tracker = timeline->tracker_tail;
+	if (NULL != oldest_tracker && 0 == oldest_tracker->trigger_ref_count) {
+		if (MALI_FALSE == oldest_tracker->timer_active) {
+			if (MALI_TRUE == timeline->timer_active) {
+				_mali_osk_wq_delayed_cancel_work_async(timeline->delayed_work);
+			}
+			_mali_osk_wq_delayed_schedule_work(timeline->delayed_work, MALI_TIMELINE_TIMEOUT_HZ);
+			oldest_tracker->timer_active = MALI_TRUE;
+			timeline->timer_active = MALI_TRUE;
+		}
+	} else if (MALI_TRUE == timeline->timer_active) {
+		_mali_osk_wq_delayed_cancel_work_async(timeline->delayed_work);
+		timeline->timer_active = MALI_FALSE;
+	}
+}
+
+static mali_scheduler_mask mali_timeline_update_oldest_point(struct mali_timeline *timeline)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	MALI_DEBUG_CODE({
+		struct mali_timeline_system *system = timeline->system;
+		MALI_DEBUG_ASSERT_POINTER(system);
+
+		MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+	});
+
+	if (NULL != timeline->tracker_tail) {
+		/* Set oldest point to oldest tracker's point */
+		timeline->point_oldest = timeline->tracker_tail->point;
+	} else {
+		/* No trackers, mark point list as empty */
+		timeline->point_oldest = timeline->point_next;
+	}
+
+	/* Release all waiters no longer on the timeline's point list.
+	 * Releasing a waiter can trigger this function to be called again, so
+	 * we do not store any pointers on stack. */
+	while (NULL != timeline->waiter_tail) {
+		u32 waiter_time_relative;
+		u32 time_head_relative;
+		struct mali_timeline_waiter *waiter = timeline->waiter_tail;
+
+		time_head_relative = timeline->point_next - timeline->point_oldest;
+		waiter_time_relative = waiter->point - timeline->point_oldest;
+
+		if (waiter_time_relative < time_head_relative) {
+			/* This and all following waiters are on the point list, so we are done. */
+			break;
+		}
+
+		/* Remove waiter from timeline's waiter list. */
+		if (NULL != waiter->timeline_next) {
+			waiter->timeline_next->timeline_prev = NULL;
+		} else {
+			/* This was the last waiter */
+			timeline->waiter_head = NULL;
+		}
+		timeline->waiter_tail = waiter->timeline_next;
+
+		/* Release waiter.  This could activate a tracker, if this was
+		 * the last waiter for the tracker. */
+		schedule_mask |= mali_timeline_system_release_waiter(timeline->system, waiter);
+	}
+
+	return schedule_mask;
+}
+
+void mali_timeline_tracker_init(struct mali_timeline_tracker *tracker,
+				mali_timeline_tracker_type type,
+				struct mali_timeline_fence *fence,
+				void *job)
+{
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_TRACKER_MAX > type);
+
+	/* Zero out all tracker members. */
+	_mali_osk_memset(tracker, 0, sizeof(*tracker));
+
+	tracker->type = type;
+	tracker->job = job;
+	tracker->trigger_ref_count = 1;  /* Prevents any callback from trigging while adding it */
+	tracker->os_tick_create = _mali_osk_time_tickcount();
+	MALI_DEBUG_CODE(tracker->magic = MALI_TIMELINE_TRACKER_MAGIC);
+
+	tracker->activation_error = MALI_TIMELINE_ACTIVATION_ERROR_NONE;
+
+	/* Copy fence. */
+	if (NULL != fence) {
+		_mali_osk_memcpy(&tracker->fence, fence, sizeof(struct mali_timeline_fence));
+	}
+}
+
+mali_scheduler_mask mali_timeline_tracker_release(struct mali_timeline_tracker *tracker)
+{
+	struct mali_timeline *timeline;
+	struct mali_timeline_system *system;
+	struct mali_timeline_tracker *tracker_next, *tracker_prev;
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+	u32 tid = _mali_osk_get_tid();
+
+	/* Upon entry a group lock will be held, but not a scheduler lock. */
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_TRACKER_MAGIC == tracker->magic);
+
+	/* Tracker should have been triggered */
+	MALI_DEBUG_ASSERT(0 == tracker->trigger_ref_count);
+
+	/* All waiters should have been released at this point */
+	MALI_DEBUG_ASSERT(NULL == tracker->waiter_head);
+	MALI_DEBUG_ASSERT(NULL == tracker->waiter_tail);
+
+	MALI_DEBUG_PRINT(3, ("Mali Timeline: releasing tracker for job 0x%08X\n", tracker->job));
+
+	timeline = tracker->timeline;
+	if (NULL == timeline) {
+		/* Tracker was not on a timeline, there is nothing to release. */
+		return MALI_SCHEDULER_MASK_EMPTY;
+	}
+
+	system = timeline->system;
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	/* Tracker should still be on timeline */
+	MALI_DEBUG_ASSERT(!mali_timeline_is_empty(timeline));
+	MALI_DEBUG_ASSERT(mali_timeline_is_point_on(timeline, tracker->point));
+
+	/* Tracker is no longer valid. */
+	MALI_DEBUG_CODE(tracker->magic = 0);
+
+	tracker_next = tracker->timeline_next;
+	tracker_prev = tracker->timeline_prev;
+	tracker->timeline_next = NULL;
+	tracker->timeline_prev = NULL;
+
+	/* Removing tracker from timeline's tracker list */
+	if (NULL == tracker_next) {
+		/* This tracker was the head */
+		timeline->tracker_head = tracker_prev;
+	} else {
+		tracker_next->timeline_prev = tracker_prev;
+	}
+
+	if (NULL == tracker_prev) {
+		/* This tracker was the tail */
+		timeline->tracker_tail = tracker_next;
+		MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+		/* Update the timeline's oldest time and release any waiters */
+		schedule_mask |= mali_timeline_update_oldest_point(timeline);
+		MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+	} else {
+		tracker_prev->timeline_next = tracker_next;
+	}
+
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	/* Update delayed work only when it is the soft job timeline */
+	if (MALI_TIMELINE_SOFT == tracker->timeline->id) {
+		mali_timeline_update_delayed_work(tracker->timeline);
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	return schedule_mask;
+}
+
+void mali_timeline_system_release_waiter_list(struct mali_timeline_system *system,
+		struct mali_timeline_waiter *tail,
+		struct mali_timeline_waiter *head)
+{
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(head);
+	MALI_DEBUG_ASSERT_POINTER(tail);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	head->tracker_next = system->waiter_empty_list;
+	system->waiter_empty_list = tail;
+}
+
+static mali_scheduler_mask mali_timeline_tracker_activate(struct mali_timeline_tracker *tracker)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+	struct mali_timeline_system *system;
+	struct mali_timeline *timeline;
+	u32 tid = _mali_osk_get_tid();
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_TRACKER_MAGIC == tracker->magic);
+
+	system = tracker->system;
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	tracker->os_tick_activate = _mali_osk_time_tickcount();
+
+	if (NULL != tracker->waiter_head) {
+		mali_timeline_system_release_waiter_list(system, tracker->waiter_tail, tracker->waiter_head);
+		tracker->waiter_head = NULL;
+		tracker->waiter_tail = NULL;
+	}
+
+	switch (tracker->type) {
+	case MALI_TIMELINE_TRACKER_GP:
+		schedule_mask = mali_scheduler_activate_gp_job((struct mali_gp_job *) tracker->job);
+
+		_mali_osk_atomic_dec(&gp_tracker_count);
+		break;
+	case MALI_TIMELINE_TRACKER_PP:
+		if (mali_pp_job_is_virtual((struct mali_pp_job *)tracker->job)) {
+			_mali_osk_atomic_dec(&virt_pp_tracker_count);
+		} else {
+			_mali_osk_atomic_dec(&phy_pp_tracker_count);
+		}
+		schedule_mask = mali_scheduler_activate_pp_job((struct mali_pp_job *) tracker->job);
+		break;
+	case MALI_TIMELINE_TRACKER_SOFT:
+		timeline = tracker->timeline;
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		schedule_mask |= mali_soft_job_system_activate_job((struct mali_soft_job *) tracker->job);
+
+		/* Start a soft timer to make sure the soft job be released in a limited time */
+		mali_spinlock_reentrant_wait(system->spinlock, tid);
+		mali_timeline_update_delayed_work(timeline);
+		mali_spinlock_reentrant_signal(system->spinlock, tid);
+		break;
+	case MALI_TIMELINE_TRACKER_WAIT:
+		mali_timeline_fence_wait_activate((struct mali_timeline_fence_wait_tracker *) tracker->job);
+		break;
+	case MALI_TIMELINE_TRACKER_SYNC:
+#if defined(CONFIG_SYNC)
+		mali_timeline_sync_fence_activate((struct mali_timeline_sync_fence_tracker *) tracker->job);
+#else
+		MALI_PRINT_ERROR(("Mali Timeline: sync tracker not supported\n", tracker->type));
+#endif /* defined(CONFIG_SYNC) */
+		break;
+	default:
+		MALI_PRINT_ERROR(("Mali Timeline - Illegal tracker type: %d\n", tracker->type));
+		break;
+	}
+
+	return schedule_mask;
+}
+
+void mali_timeline_system_tracker_get(struct mali_timeline_system *system, struct mali_timeline_tracker *tracker)
+{
+	u32 tid = _mali_osk_get_tid();
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	MALI_DEBUG_ASSERT(0 < tracker->trigger_ref_count);
+	tracker->trigger_ref_count++;
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+}
+
+mali_scheduler_mask mali_timeline_system_tracker_put(struct mali_timeline_system *system, struct mali_timeline_tracker *tracker, mali_timeline_activation_error activation_error)
+{
+	u32 tid = _mali_osk_get_tid();
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	MALI_DEBUG_ASSERT(0 < tracker->trigger_ref_count);
+	tracker->trigger_ref_count--;
+
+	tracker->activation_error |= activation_error;
+
+	if (0 == tracker->trigger_ref_count) {
+		schedule_mask |= mali_timeline_tracker_activate(tracker);
+		tracker = NULL;
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	return schedule_mask;
+}
+
+void mali_timeline_fence_copy_uk_fence(struct mali_timeline_fence *fence, _mali_uk_fence_t *uk_fence)
+{
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(fence);
+	MALI_DEBUG_ASSERT_POINTER(uk_fence);
+
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		fence->points[i] = uk_fence->points[i];
+	}
+
+	fence->sync_fd = uk_fence->sync_fd;
+}
+
+struct mali_timeline_system *mali_timeline_system_create(struct mali_session_data *session)
+{
+	u32 i;
+	struct mali_timeline_system *system;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_PRINT(4, ("Mali Timeline: creating timeline system\n"));
+
+	system = (struct mali_timeline_system *) _mali_osk_calloc(1, sizeof(struct mali_timeline_system));
+	if (NULL == system) {
+		return NULL;
+	}
+
+	system->spinlock = mali_spinlock_reentrant_init(_MALI_OSK_LOCK_ORDER_TIMELINE_SYSTEM);
+	if (NULL == system->spinlock) {
+		mali_timeline_system_destroy(system);
+		return NULL;
+	}
+
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		system->timelines[i] = mali_timeline_create(system, (enum mali_timeline_id)i);
+		if (NULL == system->timelines[i]) {
+			mali_timeline_system_destroy(system);
+			return NULL;
+		}
+	}
+
+#if defined(CONFIG_SYNC)
+	system->signaled_sync_tl = mali_sync_timeline_create(NULL, "mali-always-signaled");
+	if (NULL == system->signaled_sync_tl) {
+		mali_timeline_system_destroy(system);
+		return NULL;
+	}
+#endif /* defined(CONFIG_SYNC) */
+
+	system->waiter_empty_list = NULL;
+	system->session = session;
+	system->timer_enabled = MALI_TRUE;
+
+	system->wait_queue = _mali_osk_wait_queue_init();
+	if (NULL == system->wait_queue) {
+		mali_timeline_system_destroy(system);
+		return NULL;
+	}
+
+	return system;
+}
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE) ||defined(CONFIG_SYNC)
+/**
+ * Check if there are any trackers left on timeline.
+ *
+ * Used as a wait queue conditional.
+ *
+ * @param data Timeline.
+ * @return MALI_TRUE if there are no trackers on timeline, MALI_FALSE if not.
+ */
+static mali_bool mali_timeline_has_no_trackers(void *data)
+{
+	struct mali_timeline *timeline = (struct mali_timeline *) data;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	return mali_timeline_is_empty(timeline);
+}
+#if defined(CONFIG_SYNC)
+/**
+ * Cancel sync fence waiters waited upon by trackers on all timelines.
+ *
+ * Will return after all timelines have no trackers left.
+ *
+ * @param system Timeline system.
+ */
+static void mali_timeline_cancel_sync_fence_waiters(struct mali_timeline_system *system)
+{
+	u32 i;
+	u32 tid = _mali_osk_get_tid();
+	struct mali_timeline_tracker *tracker, *tracker_next;
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(tracker_list);
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+	MALI_DEBUG_ASSERT(system->session->is_aborting);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	/* Cancel sync fence waiters. */
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline = system->timelines[i];
+
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		tracker_next = timeline->tracker_tail;
+		while (NULL != tracker_next) {
+			tracker = tracker_next;
+			tracker_next = tracker->timeline_next;
+
+			if (NULL == tracker->sync_fence) continue;
+
+			MALI_DEBUG_PRINT(3, ("Mali Timeline: Cancelling sync fence wait for tracker 0x%08X.\n", tracker));
+
+			/* Cancel sync fence waiter. */
+			if (0 == sync_fence_cancel_async(tracker->sync_fence, &tracker->sync_fence_waiter)) {
+				/* Callback was not called, move tracker to local list. */
+				_mali_osk_list_add(&tracker->sync_fence_cancel_list, &tracker_list);
+			}
+		}
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	/* Manually call sync fence callback in order to release waiter and trigger activation of tracker. */
+	_MALI_OSK_LIST_FOREACHENTRY(tracker, tracker_next, &tracker_list, struct mali_timeline_tracker, sync_fence_cancel_list) {
+		mali_timeline_sync_fence_callback(tracker->sync_fence, &tracker->sync_fence_waiter);
+	}
+
+	/* Sleep until all sync fence callbacks are done and all timelines are empty. */
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline = system->timelines[i];
+
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		_mali_osk_wait_queue_wait_event(system->wait_queue, mali_timeline_has_no_trackers, (void *) timeline);
+	}
+}
+
+#endif /* defined(CONFIG_SYNC) */
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+static void mali_timeline_cancel_dma_fence_waiters(struct mali_timeline_system *system)
+{
+	u32 i, j;
+	u32 tid = _mali_osk_get_tid();
+	struct mali_pp_job *pp_job = NULL;
+	struct mali_pp_job *next_pp_job = NULL;
+	struct mali_timeline *timeline = NULL;
+	struct mali_timeline_tracker *tracker, *tracker_next;
+	_MALI_OSK_LIST_HEAD_STATIC_INIT(pp_job_list);
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+	MALI_DEBUG_ASSERT(system->session->is_aborting);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	/* Cancel dma fence waiters. */
+	timeline = system->timelines[MALI_TIMELINE_PP];
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	tracker_next = timeline->tracker_tail;
+	while (NULL != tracker_next) {
+		mali_bool fence_is_signaled = MALI_TRUE;
+		tracker = tracker_next;
+		tracker_next = tracker->timeline_next;
+
+		if (NULL == tracker->waiter_dma_fence) continue;
+		pp_job = (struct mali_pp_job *)tracker->job;
+		MALI_DEBUG_ASSERT_POINTER(pp_job);
+		MALI_DEBUG_PRINT(3, ("Mali Timeline: Cancelling dma fence waiter for tracker 0x%08X.\n", tracker));
+
+		for (j = 0; j < pp_job->dma_fence_context.num_dma_fence_waiter; j++) {
+			if (pp_job->dma_fence_context.mali_dma_fence_waiters[j]) {
+				/* Cancel a previously callback from the fence.
+				* This function returns true if the callback is successfully removed,
+				* or false if the fence has already been signaled.
+				*/
+				bool ret = dma_fence_remove_callback(pp_job->dma_fence_context.mali_dma_fence_waiters[j]->fence,
+								 &pp_job->dma_fence_context.mali_dma_fence_waiters[j]->base);
+				if (ret) {
+					fence_is_signaled = MALI_FALSE;
+				}
+			}
+		}
+
+		/* Callbacks were not called, move pp job to local list. */
+		if (MALI_FALSE == fence_is_signaled)
+			_mali_osk_list_add(&pp_job->list, &pp_job_list);
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	/* Manually call dma fence callback in order to release waiter and trigger activation of tracker. */
+	_MALI_OSK_LIST_FOREACHENTRY(pp_job, next_pp_job, &pp_job_list, struct mali_pp_job, list) {
+		mali_timeline_dma_fence_callback((void *)pp_job);
+	}
+
+	/* Sleep until all dma fence callbacks are done and all timelines are empty. */
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline = system->timelines[i];
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+		_mali_osk_wait_queue_wait_event(system->wait_queue, mali_timeline_has_no_trackers, (void *) timeline);
+	}
+}
+#endif
+#endif
+void mali_timeline_system_abort(struct mali_timeline_system *system)
+{
+	MALI_DEBUG_CODE(u32 tid = _mali_osk_get_tid(););
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+	MALI_DEBUG_ASSERT(system->session->is_aborting);
+
+	MALI_DEBUG_PRINT(3, ("Mali Timeline: Aborting timeline system for session 0x%08X.\n", system->session));
+
+#if defined(CONFIG_SYNC)
+	mali_timeline_cancel_sync_fence_waiters(system);
+#endif /* defined(CONFIG_SYNC) */
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	mali_timeline_cancel_dma_fence_waiters(system);
+#endif
+
+	/* Should not be any waiters or trackers left at this point. */
+	MALI_DEBUG_CODE({
+		u32 i;
+		mali_spinlock_reentrant_wait(system->spinlock, tid);
+		for (i = 0; i < MALI_TIMELINE_MAX; ++i)
+		{
+			struct mali_timeline *timeline = system->timelines[i];
+			MALI_DEBUG_ASSERT_POINTER(timeline);
+			MALI_DEBUG_ASSERT(timeline->point_oldest == timeline->point_next);
+			MALI_DEBUG_ASSERT(NULL == timeline->tracker_head);
+			MALI_DEBUG_ASSERT(NULL == timeline->tracker_tail);
+			MALI_DEBUG_ASSERT(NULL == timeline->waiter_head);
+			MALI_DEBUG_ASSERT(NULL == timeline->waiter_tail);
+		}
+		mali_spinlock_reentrant_signal(system->spinlock, tid);
+	});
+}
+
+void mali_timeline_system_destroy(struct mali_timeline_system *system)
+{
+	u32 i;
+	struct mali_timeline_waiter *waiter, *next;
+#if defined(CONFIG_SYNC)
+	u32 tid = _mali_osk_get_tid();
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+
+	MALI_DEBUG_PRINT(4, ("Mali Timeline: destroying timeline system\n"));
+
+	if (NULL != system) {
+
+		/* There should be no waiters left on this queue. */
+		if (NULL != system->wait_queue) {
+			_mali_osk_wait_queue_term(system->wait_queue);
+			system->wait_queue = NULL;
+		}
+
+		/* Free all waiters in empty list */
+		waiter = system->waiter_empty_list;
+		while (NULL != waiter) {
+			next = waiter->tracker_next;
+			_mali_osk_free(waiter);
+			waiter = next;
+		}
+
+#if defined(CONFIG_SYNC)
+		if (NULL != system->signaled_sync_tl) {
+			sync_timeline_destroy(system->signaled_sync_tl);
+		}
+
+		for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+			if ((NULL != system->timelines[i]) && (NULL != system->timelines[i]->spinlock)) {
+				mali_spinlock_reentrant_wait(system->timelines[i]->spinlock, tid);
+				system->timelines[i]->destroyed = MALI_TRUE;
+				mali_spinlock_reentrant_signal(system->timelines[i]->spinlock, tid);
+			}
+		}
+#endif /* defined(CONFIG_SYNC) */
+
+		for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+			if (NULL != system->timelines[i]) {
+				mali_timeline_destroy(system->timelines[i]);
+			}
+		}
+
+		if (NULL != system->spinlock) {
+			mali_spinlock_reentrant_term(system->spinlock);
+		}
+
+		_mali_osk_free(system);
+	}
+}
+
+/**
+ * Find how many waiters are needed for a given fence.
+ *
+ * @param fence The fence to check.
+ * @return Number of waiters needed for fence.
+ */
+static u32 mali_timeline_fence_num_waiters(struct mali_timeline_fence *fence)
+{
+	u32 i, num_waiters = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(fence);
+
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		if (MALI_TIMELINE_NO_POINT != fence->points[i]) {
+			++num_waiters;
+		}
+	}
+
+#if defined(CONFIG_SYNC)
+	if (-1 != fence->sync_fd) ++num_waiters;
+#endif /* defined(CONFIG_SYNC) */
+
+	return num_waiters;
+}
+
+static struct mali_timeline_waiter *mali_timeline_system_get_zeroed_waiter(struct mali_timeline_system *system)
+{
+	struct mali_timeline_waiter *waiter;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	waiter = system->waiter_empty_list;
+	if (NULL != waiter) {
+		/* Remove waiter from empty list and zero it */
+		system->waiter_empty_list = waiter->tracker_next;
+		_mali_osk_memset(waiter, 0, sizeof(*waiter));
+	}
+
+	/* Return NULL if list was empty. */
+	return waiter;
+}
+
+static void mali_timeline_system_allocate_waiters(struct mali_timeline_system *system,
+		struct mali_timeline_waiter **tail,
+		struct mali_timeline_waiter **head,
+		int max_num_waiters)
+{
+	u32 i, tid = _mali_osk_get_tid();
+	mali_bool do_alloc;
+	struct mali_timeline_waiter *waiter;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(tail);
+	MALI_DEBUG_ASSERT_POINTER(head);
+
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	*head = *tail = NULL;
+	do_alloc = MALI_FALSE;
+	i = 0;
+	while (i < max_num_waiters) {
+		if (MALI_FALSE == do_alloc) {
+			waiter = mali_timeline_system_get_zeroed_waiter(system);
+			if (NULL == waiter) {
+				do_alloc = MALI_TRUE;
+				mali_spinlock_reentrant_signal(system->spinlock, tid);
+				continue;
+			}
+		} else {
+			waiter = _mali_osk_calloc(1, sizeof(struct mali_timeline_waiter));
+			if (NULL == waiter) break;
+		}
+		++i;
+		if (NULL == *tail) {
+			*tail = waiter;
+			*head = waiter;
+		} else {
+			(*head)->tracker_next = waiter;
+			*head = waiter;
+		}
+	}
+	if (MALI_TRUE == do_alloc) {
+		mali_spinlock_reentrant_wait(system->spinlock, tid);
+	}
+}
+
+/**
+ * Create waiters for the given tracker. The tracker is activated when all waiters are release.
+ *
+ * @note Tracker can potentially be activated before this function returns.
+ *
+ * @param system Timeline system.
+ * @param tracker Tracker we will create waiters for.
+ * @param waiter_tail List of pre-allocated waiters.
+ * @param waiter_head List of pre-allocated waiters.
+ */
+static void mali_timeline_system_create_waiters_and_unlock(struct mali_timeline_system *system,
+		struct mali_timeline_tracker *tracker,
+		struct mali_timeline_waiter *waiter_tail,
+		struct mali_timeline_waiter *waiter_head)
+{
+	int i;
+	u32 tid = _mali_osk_get_tid();
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+#if defined(CONFIG_SYNC)
+	struct sync_fence *sync_fence = NULL;
+#endif /* defined(CONFIG_SYNC) */
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	MALI_DEBUG_ASSERT(NULL == tracker->waiter_head);
+	MALI_DEBUG_ASSERT(NULL == tracker->waiter_tail);
+	MALI_DEBUG_ASSERT(NULL != tracker->job);
+
+	/* Creating waiter object for all the timelines the fence is put on. Inserting this waiter
+	 * into the timelines sorted list of waiters */
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		mali_timeline_point point;
+		struct mali_timeline *timeline;
+		struct mali_timeline_waiter *waiter;
+
+		/* Get point on current timeline from tracker's fence. */
+		point = tracker->fence.points[i];
+
+		if (likely(MALI_TIMELINE_NO_POINT == point)) {
+			/* Fence contains no point on this timeline so we don't need a waiter. */
+			continue;
+		}
+
+		timeline = system->timelines[i];
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		if (unlikely(!mali_timeline_is_point_valid(timeline, point))) {
+			MALI_PRINT_ERROR(("Mali Timeline: point %d is not valid (oldest=%d, next=%d)\n",
+					  point, timeline->point_oldest, timeline->point_next));
+			continue;
+		}
+
+		if (likely(mali_timeline_is_point_released(timeline, point))) {
+			/* Tracker representing the point has been released so we don't need a
+			 * waiter. */
+			continue;
+		}
+
+		/* The point is on timeline. */
+		MALI_DEBUG_ASSERT(mali_timeline_is_point_on(timeline, point));
+
+		/* Get a new zeroed waiter object. */
+		if (likely(NULL != waiter_tail)) {
+			waiter = waiter_tail;
+			waiter_tail = waiter_tail->tracker_next;
+		} else {
+			MALI_PRINT_ERROR(("Mali Timeline: failed to allocate memory for waiter\n"));
+			continue;
+		}
+
+		/* Yanking the trigger ref count of the tracker. */
+		tracker->trigger_ref_count++;
+
+		waiter->point   = point;
+		waiter->tracker = tracker;
+
+		/* Insert waiter on tracker's singly-linked waiter list. */
+		if (NULL == tracker->waiter_head) {
+			/* list is empty */
+			MALI_DEBUG_ASSERT(NULL == tracker->waiter_tail);
+			tracker->waiter_tail = waiter;
+		} else {
+			tracker->waiter_head->tracker_next = waiter;
+		}
+		tracker->waiter_head = waiter;
+
+		/* Add waiter to timeline. */
+		mali_timeline_insert_waiter(timeline, waiter);
+	}
+#if defined(CONFIG_SYNC)
+	if (-1 != tracker->fence.sync_fd) {
+		int ret;
+		struct mali_timeline_waiter *waiter;
+
+		sync_fence = sync_fence_fdget(tracker->fence.sync_fd);
+		if (unlikely(NULL == sync_fence)) {
+			MALI_PRINT_ERROR(("Mali Timeline: failed to get sync fence from fd %d\n", tracker->fence.sync_fd));
+			goto exit;
+		}
+
+		/* Check if we have a zeroed waiter object available. */
+		if (unlikely(NULL == waiter_tail)) {
+			MALI_PRINT_ERROR(("Mali Timeline: failed to allocate memory for waiter\n"));
+			goto exit;
+		}
+
+		/* Start asynchronous wait that will release waiter when the fence is signaled. */
+		sync_fence_waiter_init(&tracker->sync_fence_waiter, mali_timeline_sync_fence_callback);
+		ret = sync_fence_wait_async(sync_fence, &tracker->sync_fence_waiter);
+		if (1 == ret) {
+			/* Fence already signaled, no waiter needed. */
+			tracker->fence.sync_fd = -1;
+			goto exit;
+		} else if (0 != ret) {
+			MALI_PRINT_ERROR(("Mali Timeline: sync fence fd %d signaled with error %d\n", tracker->fence.sync_fd, ret));
+			tracker->activation_error |= MALI_TIMELINE_ACTIVATION_ERROR_SYNC_BIT;
+			goto exit;
+		}
+
+		/* Grab new zeroed waiter object. */
+		waiter = waiter_tail;
+		waiter_tail = waiter_tail->tracker_next;
+
+		/* Increase the trigger ref count of the tracker. */
+		tracker->trigger_ref_count++;
+
+		waiter->point   = MALI_TIMELINE_NO_POINT;
+		waiter->tracker = tracker;
+
+		/* Insert waiter on tracker's singly-linked waiter list. */
+		if (NULL == tracker->waiter_head) {
+			/* list is empty */
+			MALI_DEBUG_ASSERT(NULL == tracker->waiter_tail);
+			tracker->waiter_tail = waiter;
+		} else {
+			tracker->waiter_head->tracker_next = waiter;
+		}
+		tracker->waiter_head = waiter;
+
+		/* Also store waiter in separate field for easy access by sync callback. */
+		tracker->waiter_sync = waiter;
+
+		/* Store the sync fence in tracker so we can retrieve in abort session, if needed. */
+		tracker->sync_fence = sync_fence;
+
+		sync_fence = NULL;
+	}
+#endif /* defined(CONFIG_SYNC)*/
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	if ((NULL != tracker->timeline) && (MALI_TIMELINE_PP == tracker->timeline->id)) {
+
+		struct mali_pp_job *job = (struct mali_pp_job *)tracker->job;
+
+		if (0 < job->dma_fence_context.num_dma_fence_waiter) {
+			struct mali_timeline_waiter *waiter;
+			/* Check if we have a zeroed waiter object available. */
+			if (unlikely(NULL == waiter_tail)) {
+				MALI_PRINT_ERROR(("Mali Timeline: failed to allocate memory for waiter\n"));
+				goto exit;
+			}
+
+			/* Grab new zeroed waiter object. */
+			waiter = waiter_tail;
+			waiter_tail = waiter_tail->tracker_next;
+
+			/* Increase the trigger ref count of the tracker. */
+			tracker->trigger_ref_count++;
+
+			waiter->point   = MALI_TIMELINE_NO_POINT;
+			waiter->tracker = tracker;
+
+			/* Insert waiter on tracker's singly-linked waiter list. */
+			if (NULL == tracker->waiter_head) {
+				/* list is empty */
+				MALI_DEBUG_ASSERT(NULL == tracker->waiter_tail);
+				tracker->waiter_tail = waiter;
+			} else {
+				tracker->waiter_head->tracker_next = waiter;
+			}
+			tracker->waiter_head = waiter;
+
+			/* Also store waiter in separate field for easy access by sync callback. */
+			tracker->waiter_dma_fence = waiter;
+		}
+	}
+#endif /* defined(CONFIG_MALI_DMA_BUF_FENCE)*/
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE) ||defined(CONFIG_SYNC)
+exit:
+#endif /* defined(CONFIG_MALI_DMA_BUF_FENCE) || defined(CONFIG_SYNC) */
+
+	if (NULL != waiter_tail) {
+		mali_timeline_system_release_waiter_list(system, waiter_tail, waiter_head);
+	}
+
+	/* Release the initial trigger ref count. */
+	tracker->trigger_ref_count--;
+
+	/* If there were no waiters added to this tracker we activate immediately. */
+	if (0 == tracker->trigger_ref_count) {
+		schedule_mask |= mali_timeline_tracker_activate(tracker);
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+#if defined(CONFIG_SYNC)
+	if (NULL != sync_fence) {
+		sync_fence_put(sync_fence);
+	}
+#endif /* defined(CONFIG_SYNC) */
+
+	mali_executor_schedule_from_mask(schedule_mask, MALI_FALSE);
+}
+
+mali_timeline_point mali_timeline_system_add_tracker(struct mali_timeline_system *system,
+		struct mali_timeline_tracker *tracker,
+		enum mali_timeline_id timeline_id)
+{
+	int num_waiters = 0;
+	struct mali_timeline_waiter *waiter_tail, *waiter_head;
+	u32 tid = _mali_osk_get_tid();
+
+	mali_timeline_point point = MALI_TIMELINE_NO_POINT;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	MALI_DEBUG_ASSERT(MALI_FALSE == system->session->is_aborting);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_TRACKER_MAX > tracker->type);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_TRACKER_MAGIC == tracker->magic);
+
+	MALI_DEBUG_PRINT(4, ("Mali Timeline: adding tracker for job %p, timeline: %d\n", tracker->job, timeline_id));
+
+	MALI_DEBUG_ASSERT(0 < tracker->trigger_ref_count);
+	tracker->system = system;
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	num_waiters = mali_timeline_fence_num_waiters(&tracker->fence);
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	if (MALI_TIMELINE_PP == timeline_id) {
+		struct mali_pp_job *job = (struct mali_pp_job *)tracker->job;
+		if (0 < job->dma_fence_context.num_dma_fence_waiter)
+			num_waiters++;
+	}
+#endif
+
+	/* Allocate waiters. */
+	mali_timeline_system_allocate_waiters(system, &waiter_tail, &waiter_head, num_waiters);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	/* Add tracker to timeline.  This will allocate a point for the tracker on the timeline. If
+	 * timeline ID is MALI_TIMELINE_NONE the tracker will NOT be added to a timeline and the
+	 * point will be MALI_TIMELINE_NO_POINT.
+	 *
+	 * NOTE: the tracker can fail to be added if the timeline is full.  If this happens, the
+	 * point will be MALI_TIMELINE_NO_POINT. */
+	MALI_DEBUG_ASSERT(timeline_id < MALI_TIMELINE_MAX || timeline_id == MALI_TIMELINE_NONE);
+	if (likely(timeline_id < MALI_TIMELINE_MAX)) {
+		struct mali_timeline *timeline = system->timelines[timeline_id];
+		mali_timeline_insert_tracker(timeline, tracker);
+		MALI_DEBUG_ASSERT(!mali_timeline_is_empty(timeline));
+	}
+
+	point = tracker->point;
+
+	/* Create waiters for tracker based on supplied fence.  Each waiter will increase the
+	 * trigger ref count. */
+	mali_timeline_system_create_waiters_and_unlock(system, tracker, waiter_tail, waiter_head);
+	tracker = NULL;
+
+	/* At this point the tracker object might have been freed so we should no longer
+	 * access it. */
+
+
+	/* The tracker will always be activated after calling add_tracker, even if NO_POINT is
+	 * returned. */
+	return point;
+}
+
+static mali_scheduler_mask mali_timeline_system_release_waiter(struct mali_timeline_system *system,
+		struct mali_timeline_waiter *waiter)
+{
+	struct mali_timeline_tracker *tracker;
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(waiter);
+
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_SYSTEM_LOCKED(system));
+
+	tracker = waiter->tracker;
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	/* At this point the waiter has been removed from the timeline's waiter list, but it is
+	 * still on the tracker's waiter list.  All of the tracker's waiters will be released when
+	 * the tracker is activated. */
+
+	waiter->point   = MALI_TIMELINE_NO_POINT;
+	waiter->tracker = NULL;
+
+	tracker->trigger_ref_count--;
+	if (0 == tracker->trigger_ref_count) {
+		/* This was the last waiter; activate tracker */
+		schedule_mask |= mali_timeline_tracker_activate(tracker);
+		tracker = NULL;
+	}
+
+	return schedule_mask;
+}
+
+mali_timeline_point mali_timeline_system_get_latest_point(struct mali_timeline_system *system,
+		enum mali_timeline_id timeline_id)
+{
+	mali_timeline_point point;
+	struct mali_timeline *timeline;
+	u32 tid = _mali_osk_get_tid();
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	if (MALI_TIMELINE_MAX <= timeline_id) {
+		return MALI_TIMELINE_NO_POINT;
+	}
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	timeline = system->timelines[timeline_id];
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	point = MALI_TIMELINE_NO_POINT;
+	if (timeline->point_oldest != timeline->point_next) {
+		point = timeline->point_next - 1;
+		if (MALI_TIMELINE_NO_POINT == point) point--;
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	return point;
+}
+
+void mali_timeline_initialize(void)
+{
+	_mali_osk_atomic_init(&gp_tracker_count, 0);
+	_mali_osk_atomic_init(&phy_pp_tracker_count, 0);
+	_mali_osk_atomic_init(&virt_pp_tracker_count, 0);
+}
+
+void mali_timeline_terminate(void)
+{
+	_mali_osk_atomic_term(&gp_tracker_count);
+	_mali_osk_atomic_term(&phy_pp_tracker_count);
+	_mali_osk_atomic_term(&virt_pp_tracker_count);
+}
+
+#if defined(MALI_TIMELINE_DEBUG_FUNCTIONS)
+
+static mali_bool is_waiting_on_timeline(struct mali_timeline_tracker *tracker, enum mali_timeline_id id)
+{
+	struct mali_timeline *timeline;
+	struct mali_timeline_system *system;
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	MALI_DEBUG_ASSERT_POINTER(tracker->timeline);
+	timeline = tracker->timeline;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline->system);
+	system = timeline->system;
+
+	if (MALI_TIMELINE_MAX > id) {
+		if (MALI_TIMELINE_NO_POINT != tracker->fence.points[id]) {
+			return mali_timeline_is_point_on(system->timelines[id], tracker->fence.points[id]);
+		} else {
+			return MALI_FALSE;
+		}
+	} else {
+		MALI_DEBUG_ASSERT(MALI_TIMELINE_NONE == id);
+		return MALI_FALSE;
+	}
+}
+
+static const char *timeline_id_to_string(enum mali_timeline_id id)
+{
+	switch (id) {
+	case MALI_TIMELINE_GP:
+		return "GP";
+	case MALI_TIMELINE_PP:
+		return "PP";
+	case MALI_TIMELINE_SOFT:
+		return "SOFT";
+	default:
+		return "NONE";
+	}
+}
+
+static const char *timeline_tracker_type_to_string(enum mali_timeline_tracker_type type)
+{
+	switch (type) {
+	case MALI_TIMELINE_TRACKER_GP:
+		return "GP";
+	case MALI_TIMELINE_TRACKER_PP:
+		return "PP";
+	case MALI_TIMELINE_TRACKER_SOFT:
+		return "SOFT";
+	case MALI_TIMELINE_TRACKER_WAIT:
+		return "WAIT";
+	case MALI_TIMELINE_TRACKER_SYNC:
+		return "SYNC";
+	default:
+		return "INVALID";
+	}
+}
+
+mali_timeline_tracker_state mali_timeline_debug_get_tracker_state(struct mali_timeline_tracker *tracker)
+{
+	struct mali_timeline *timeline = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	timeline = tracker->timeline;
+
+	if (0 != tracker->trigger_ref_count) {
+		return MALI_TIMELINE_TS_WAITING;
+	}
+
+	if (timeline && (timeline->tracker_tail == tracker || NULL != tracker->timeline_prev)) {
+		return MALI_TIMELINE_TS_ACTIVE;
+	}
+
+	if (timeline && (MALI_TIMELINE_NO_POINT == tracker->point)) {
+		return MALI_TIMELINE_TS_INIT;
+	}
+
+	return MALI_TIMELINE_TS_FINISH;
+}
+
+void mali_timeline_debug_print_tracker(struct mali_timeline_tracker *tracker, _mali_osk_print_ctx *print_ctx)
+{
+	const char *tracker_state = "IWAF";
+	char state_char = 'I';
+	char tracker_type[32] = {0};
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	state_char = *(tracker_state + mali_timeline_debug_get_tracker_state(tracker));
+	_mali_osk_snprintf(tracker_type, sizeof(tracker_type), "%s", timeline_tracker_type_to_string(tracker->type));
+
+#if defined(CONFIG_SYNC)
+	if (0 != tracker->trigger_ref_count) {
+		_mali_osk_ctxprintf(print_ctx, "TL:  %s %u %c - ref_wait:%u [%s(%u),%s(%u),%s(%u), fd:%d, fence:(0x%08X)]  job:(0x%08X)\n",
+				    tracker_type, tracker->point, state_char, tracker->trigger_ref_count,
+				    is_waiting_on_timeline(tracker, MALI_TIMELINE_GP) ? "WaitGP" : " ", tracker->fence.points[0],
+				    is_waiting_on_timeline(tracker, MALI_TIMELINE_PP) ? "WaitPP" : " ", tracker->fence.points[1],
+				    is_waiting_on_timeline(tracker, MALI_TIMELINE_SOFT) ? "WaitSOFT" : " ", tracker->fence.points[2],
+				    tracker->fence.sync_fd, (unsigned int)(uintptr_t)(tracker->sync_fence), (unsigned int)(uintptr_t)(tracker->job));
+	} else {
+		_mali_osk_ctxprintf(print_ctx, "TL:  %s %u %c  fd:%d  fence:(0x%08X)  job:(0x%08X)\n",
+				    tracker_type, tracker->point, state_char,
+				    tracker->fence.sync_fd, (unsigned int)(uintptr_t)(tracker->sync_fence), (unsigned int)(uintptr_t)(tracker->job));
+	}
+#else
+	if (0 != tracker->trigger_ref_count) {
+		_mali_osk_ctxprintf(print_ctx, "TL:  %s %u %c - ref_wait:%u [%s(%u),%s(%u),%s(%u)]  job:(0x%08X)\n",
+				    tracker_type, tracker->point, state_char, tracker->trigger_ref_count,
+				    is_waiting_on_timeline(tracker, MALI_TIMELINE_GP) ? "WaitGP" : " ", tracker->fence.points[0],
+				    is_waiting_on_timeline(tracker, MALI_TIMELINE_PP) ? "WaitPP" : " ", tracker->fence.points[1],
+				    is_waiting_on_timeline(tracker, MALI_TIMELINE_SOFT) ? "WaitSOFT" : " ", tracker->fence.points[2],
+				    (unsigned int)(uintptr_t)(tracker->job));
+	} else {
+		_mali_osk_ctxprintf(print_ctx, "TL:  %s %u %c  job:(0x%08X)\n",
+				    tracker_type, tracker->point, state_char,
+				    (unsigned int)(uintptr_t)(tracker->job));
+	}
+#endif
+}
+
+void mali_timeline_debug_print_timeline(struct mali_timeline *timeline, _mali_osk_print_ctx *print_ctx)
+{
+	struct mali_timeline_tracker *tracker = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	tracker = timeline->tracker_tail;
+	while (NULL != tracker) {
+		mali_timeline_debug_print_tracker(tracker, print_ctx);
+		tracker = tracker->timeline_next;
+	}
+}
+
+#if !(LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0))
+void mali_timeline_debug_direct_print_tracker(struct mali_timeline_tracker *tracker)
+{
+	const char *tracker_state = "IWAF";
+	char state_char = 'I';
+	char tracker_type[32] = {0};
+
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	state_char = *(tracker_state + mali_timeline_debug_get_tracker_state(tracker));
+	_mali_osk_snprintf(tracker_type, sizeof(tracker_type), "%s", timeline_tracker_type_to_string(tracker->type));
+
+#if defined(CONFIG_SYNC)
+	if (0 != tracker->trigger_ref_count) {
+		MALI_PRINT(("TL:  %s %u %c - ref_wait:%u [%s(%u),%s(%u),%s(%u), fd:%d, fence:(0x%08X)]  job:(0x%08X)\n",
+			    tracker_type, tracker->point, state_char, tracker->trigger_ref_count,
+			    is_waiting_on_timeline(tracker, MALI_TIMELINE_GP) ? "WaitGP" : " ", tracker->fence.points[0],
+			    is_waiting_on_timeline(tracker, MALI_TIMELINE_PP) ? "WaitPP" : " ", tracker->fence.points[1],
+			    is_waiting_on_timeline(tracker, MALI_TIMELINE_SOFT) ? "WaitSOFT" : " ", tracker->fence.points[2],
+			    tracker->fence.sync_fd, tracker->sync_fence, tracker->job));
+	} else {
+		MALI_PRINT(("TL:  %s %u %c  fd:%d  fence:(0x%08X)  job:(0x%08X)\n",
+			    tracker_type, tracker->point, state_char,
+			    tracker->fence.sync_fd, tracker->sync_fence, tracker->job));
+	}
+#else
+	if (0 != tracker->trigger_ref_count) {
+		MALI_PRINT(("TL:  %s %u %c - ref_wait:%u [%s(%u),%s(%u),%s(%u)]  job:(0x%08X)\n",
+			    tracker_type, tracker->point, state_char, tracker->trigger_ref_count,
+			    is_waiting_on_timeline(tracker, MALI_TIMELINE_GP) ? "WaitGP" : " ", tracker->fence.points[0],
+			    is_waiting_on_timeline(tracker, MALI_TIMELINE_PP) ? "WaitPP" : " ", tracker->fence.points[1],
+			    is_waiting_on_timeline(tracker, MALI_TIMELINE_SOFT) ? "WaitSOFT" : " ", tracker->fence.points[2],
+			    tracker->job));
+	} else {
+		MALI_PRINT(("TL:  %s %u %c  job:(0x%08X)\n",
+			    tracker_type, tracker->point, state_char,
+			    tracker->job));
+	}
+#endif
+}
+
+void mali_timeline_debug_direct_print_timeline(struct mali_timeline *timeline)
+{
+	struct mali_timeline_tracker *tracker = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	tracker = timeline->tracker_tail;
+	while (NULL != tracker) {
+		mali_timeline_debug_direct_print_tracker(tracker);
+		tracker = tracker->timeline_next;
+	}
+}
+
+#endif
+
+void mali_timeline_debug_print_system(struct mali_timeline_system *system, _mali_osk_print_ctx *print_ctx)
+{
+	int i;
+	int num_printed = 0;
+	u32 tid = _mali_osk_get_tid();
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	/* Print all timelines */
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline = system->timelines[i];
+
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		if (NULL == timeline->tracker_head) continue;
+
+		_mali_osk_ctxprintf(print_ctx, "TL: Timeline %s:\n",
+				    timeline_id_to_string((enum mali_timeline_id)i));
+
+		mali_timeline_debug_print_timeline(timeline, print_ctx);
+		num_printed++;
+	}
+
+	if (0 == num_printed) {
+		_mali_osk_ctxprintf(print_ctx, "TL: All timelines empty\n");
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+}
+
+#endif /* defined(MALI_TIMELINE_DEBUG_FUNCTIONS) */
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+void mali_timeline_dma_fence_callback(void *pp_job_ptr)
+{
+	struct mali_timeline_system  *system;
+	struct mali_timeline_waiter  *waiter;
+	struct mali_timeline_tracker *tracker;
+	struct mali_pp_job *pp_job = (struct mali_pp_job *)pp_job_ptr;
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+	u32 tid = _mali_osk_get_tid();
+	mali_bool is_aborting = MALI_FALSE;
+
+	MALI_DEBUG_ASSERT_POINTER(pp_job);
+
+	tracker = &pp_job->tracker;
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+
+	system = tracker->system;
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(system->session);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	waiter = tracker->waiter_dma_fence;
+	MALI_DEBUG_ASSERT_POINTER(waiter);
+
+	schedule_mask |= mali_timeline_system_release_waiter(system, waiter);
+
+	is_aborting = system->session->is_aborting;
+
+	/* If aborting, wake up sleepers that are waiting for dma fence callbacks to complete. */
+	if (is_aborting) {
+		_mali_osk_wait_queue_wake_up(system->wait_queue);
+	}
+
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+	if (!is_aborting) {
+		mali_executor_schedule_from_mask(schedule_mask, MALI_TRUE);
+	}
+}
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.c b/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.c
--- a/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_timeline_fence_wait.h"
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_spinlock_reentrant.h"
+
+/**
+ * Allocate a fence waiter tracker.
+ *
+ * @return New fence waiter if successful, NULL if not.
+ */
+static struct mali_timeline_fence_wait_tracker *mali_timeline_fence_wait_tracker_alloc(void)
+{
+	return (struct mali_timeline_fence_wait_tracker *) _mali_osk_calloc(1, sizeof(struct mali_timeline_fence_wait_tracker));
+}
+
+/**
+ * Free fence waiter tracker.
+ *
+ * @param wait Fence wait tracker to free.
+ */
+static void mali_timeline_fence_wait_tracker_free(struct mali_timeline_fence_wait_tracker *wait)
+{
+	MALI_DEBUG_ASSERT_POINTER(wait);
+	_mali_osk_atomic_term(&wait->refcount);
+	_mali_osk_free(wait);
+}
+
+/**
+ * Check if fence wait tracker has been activated.  Used as a wait queue condition.
+ *
+ * @param data Fence waiter.
+ * @return MALI_TRUE if tracker has been activated, MALI_FALSE if not.
+ */
+static mali_bool mali_timeline_fence_wait_tracker_is_activated(void *data)
+{
+	struct mali_timeline_fence_wait_tracker *wait;
+
+	wait = (struct mali_timeline_fence_wait_tracker *) data;
+	MALI_DEBUG_ASSERT_POINTER(wait);
+
+	return wait->activated;
+}
+
+/**
+ * Check if fence has been signaled.
+ *
+ * @param system Timeline system.
+ * @param fence Timeline fence.
+ * @return MALI_TRUE if fence is signaled, MALI_FALSE if not.
+ */
+static mali_bool mali_timeline_fence_wait_check_status(struct mali_timeline_system *system, struct mali_timeline_fence *fence)
+{
+	int i;
+	u32 tid = _mali_osk_get_tid();
+	mali_bool ret = MALI_TRUE;
+#if defined(CONFIG_SYNC)
+	struct sync_fence *sync_fence = NULL;
+#endif
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(fence);
+
+	mali_spinlock_reentrant_wait(system->spinlock, tid);
+
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline;
+		mali_timeline_point   point;
+
+		point = fence->points[i];
+
+		if (likely(MALI_TIMELINE_NO_POINT == point)) {
+			/* Fence contains no point on this timeline. */
+			continue;
+		}
+
+		timeline = system->timelines[i];
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		if (unlikely(!mali_timeline_is_point_valid(timeline, point))) {
+			MALI_PRINT_ERROR(("Mali Timeline: point %d is not valid (oldest=%d, next=%d)\n", point, timeline->point_oldest, timeline->point_next));
+		}
+
+		if (!mali_timeline_is_point_released(timeline, point)) {
+			ret = MALI_FALSE;
+			goto exit;
+		}
+	}
+
+#if defined(CONFIG_SYNC)
+	if (-1 != fence->sync_fd) {
+		sync_fence = sync_fence_fdget(fence->sync_fd);
+		if (likely(NULL != sync_fence)) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0)
+			if (0 == sync_fence->status) {
+#else
+			if (0 == atomic_read(&sync_fence->status)) {
+#endif
+				ret = MALI_FALSE;
+			}
+		} else {
+			MALI_PRINT_ERROR(("Mali Timeline: failed to get sync fence from fd %d\n", fence->sync_fd));
+		}
+	}
+#endif /* defined(CONFIG_SYNC) */
+
+exit:
+	mali_spinlock_reentrant_signal(system->spinlock, tid);
+
+#if defined(CONFIG_SYNC)
+	if (NULL != sync_fence) {
+		sync_fence_put(sync_fence);
+	}
+#endif /* defined(CONFIG_SYNC) */
+
+	return ret;
+}
+
+mali_bool mali_timeline_fence_wait(struct mali_timeline_system *system, struct mali_timeline_fence *fence, u32 timeout)
+{
+	struct mali_timeline_fence_wait_tracker *wait;
+	mali_timeline_point point;
+	mali_bool ret;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(fence);
+
+	MALI_DEBUG_PRINT(4, ("Mali Timeline: wait on fence\n"));
+
+	if (MALI_TIMELINE_FENCE_WAIT_TIMEOUT_IMMEDIATELY == timeout) {
+		return mali_timeline_fence_wait_check_status(system, fence);
+	}
+
+	wait = mali_timeline_fence_wait_tracker_alloc();
+	if (unlikely(NULL == wait)) {
+		MALI_PRINT_ERROR(("Mali Timeline: failed to allocate data for fence wait\n"));
+		return MALI_FALSE;
+	}
+
+	wait->activated = MALI_FALSE;
+	wait->system = system;
+
+	/* Initialize refcount to two references.  The reference first will be released by this
+	 * function after the wait is over.  The second reference will be released when the tracker
+	 * is activated. */
+	_mali_osk_atomic_init(&wait->refcount, 2);
+
+	/* Add tracker to timeline system, but not to a timeline. */
+	mali_timeline_tracker_init(&wait->tracker, MALI_TIMELINE_TRACKER_WAIT, fence, wait);
+	point = mali_timeline_system_add_tracker(system, &wait->tracker, MALI_TIMELINE_NONE);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_NO_POINT == point);
+	MALI_IGNORE(point);
+
+	/* Wait for the tracker to be activated or time out. */
+	if (MALI_TIMELINE_FENCE_WAIT_TIMEOUT_NEVER == timeout) {
+		_mali_osk_wait_queue_wait_event(system->wait_queue, mali_timeline_fence_wait_tracker_is_activated, (void *) wait);
+	} else {
+		_mali_osk_wait_queue_wait_event_timeout(system->wait_queue, mali_timeline_fence_wait_tracker_is_activated, (void *) wait, timeout);
+	}
+
+	ret = wait->activated;
+
+	if (0 == _mali_osk_atomic_dec_return(&wait->refcount)) {
+		mali_timeline_fence_wait_tracker_free(wait);
+	}
+
+	return ret;
+}
+
+void mali_timeline_fence_wait_activate(struct mali_timeline_fence_wait_tracker *wait)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(wait);
+	MALI_DEBUG_ASSERT_POINTER(wait->system);
+
+	MALI_DEBUG_PRINT(4, ("Mali Timeline: activation for fence wait tracker\n"));
+
+	MALI_DEBUG_ASSERT(MALI_FALSE == wait->activated);
+	wait->activated = MALI_TRUE;
+
+	_mali_osk_wait_queue_wake_up(wait->system->wait_queue);
+
+	/* Nothing can wait on this tracker, so nothing to schedule after release. */
+	schedule_mask = mali_timeline_tracker_release(&wait->tracker);
+	MALI_DEBUG_ASSERT(MALI_SCHEDULER_MASK_EMPTY == schedule_mask);
+	MALI_IGNORE(schedule_mask);
+
+	if (0 == _mali_osk_atomic_dec_return(&wait->refcount)) {
+		mali_timeline_fence_wait_tracker_free(wait);
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.h b/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.h
--- a/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_timeline_fence_wait.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_timeline_fence_wait.h
+ *
+ * This file contains functions used to wait until a Timeline fence is signaled.
+ */
+
+#ifndef __MALI_TIMELINE_FENCE_WAIT_H__
+#define __MALI_TIMELINE_FENCE_WAIT_H__
+
+#include "mali_osk.h"
+#include "mali_timeline.h"
+
+/**
+ * If used as the timeout argument in @ref mali_timeline_fence_wait, a timer is not used and the
+ * function only returns when the fence is signaled.
+ */
+#define MALI_TIMELINE_FENCE_WAIT_TIMEOUT_NEVER ((u32) -1)
+
+/**
+ * If used as the timeout argument in @ref mali_timeline_fence_wait, the function will return
+ * immediately with the current state of the fence.
+ */
+#define MALI_TIMELINE_FENCE_WAIT_TIMEOUT_IMMEDIATELY 0
+
+/**
+ * Fence wait tracker.
+ *
+ * The fence wait tracker is added to the Timeline system with the fence we are waiting on as a
+ * dependency.  We will then perform a blocking wait, possibly with a timeout, until the tracker is
+ * activated, which happens when the fence is signaled.
+ */
+struct mali_timeline_fence_wait_tracker {
+	mali_bool activated;                  /**< MALI_TRUE if the tracker has been activated, MALI_FALSE if not. */
+	_mali_osk_atomic_t refcount;          /**< Reference count. */
+	struct mali_timeline_system *system;  /**< Timeline system. */
+	struct mali_timeline_tracker tracker; /**< Timeline tracker. */
+};
+
+/**
+ * Wait for a fence to be signaled, or timeout is reached.
+ *
+ * @param system Timeline system.
+ * @param fence Fence to wait on.
+ * @param timeout Timeout in ms, or MALI_TIMELINE_FENCE_WAIT_TIMEOUT_NEVER or
+ * MALI_TIMELINE_FENCE_WAIT_TIMEOUT_IMMEDIATELY.
+ * @return MALI_TRUE if signaled, MALI_FALSE if timed out.
+ */
+mali_bool mali_timeline_fence_wait(struct mali_timeline_system *system, struct mali_timeline_fence *fence, u32 timeout);
+
+/**
+ * Used by the Timeline system to activate a fence wait tracker.
+ *
+ * @param fence_wait_tracker Fence waiter tracker.
+ */
+void mali_timeline_fence_wait_activate(struct mali_timeline_fence_wait_tracker *fence_wait_tracker);
+
+#endif /* __MALI_TIMELINE_FENCE_WAIT_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_timeline.h b/drivers/gpu/arm/mali400/common/mali_timeline.h
--- a/drivers/gpu/arm/mali400/common/mali_timeline.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_timeline.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,548 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_TIMELINE_H__
+#define __MALI_TIMELINE_H__
+
+#include "mali_osk.h"
+#include "mali_ukk.h"
+#include "mali_session.h"
+#include "mali_kernel_common.h"
+#include "mali_spinlock_reentrant.h"
+#include "mali_sync.h"
+#include "mali_scheduler_types.h"
+#include <linux/version.h>
+
+/**
+ * Soft job timeout.
+ *
+ * Soft jobs have to be signaled as complete after activation.  Normally this is done by user space,
+ * but in order to guarantee that every soft job is completed, we also have a timer.
+ */
+#define MALI_TIMELINE_TIMEOUT_HZ ((unsigned long) (HZ * 3 / 2)) /* 1500 ms. */
+
+/**
+ * Timeline type.
+ */
+typedef enum mali_timeline_id {
+	MALI_TIMELINE_GP   = MALI_UK_TIMELINE_GP,   /**< GP job timeline. */
+	MALI_TIMELINE_PP   = MALI_UK_TIMELINE_PP,   /**< PP job timeline. */
+	MALI_TIMELINE_SOFT = MALI_UK_TIMELINE_SOFT, /**< Soft job timeline. */
+	MALI_TIMELINE_MAX  = MALI_UK_TIMELINE_MAX
+} mali_timeline_id;
+
+/**
+ * Used by trackers that should not be added to a timeline (@ref mali_timeline_system_add_tracker).
+ */
+#define MALI_TIMELINE_NONE MALI_TIMELINE_MAX
+
+/**
+ * Tracker type.
+ */
+typedef enum mali_timeline_tracker_type {
+	MALI_TIMELINE_TRACKER_GP   = 0, /**< Tracker used by GP jobs. */
+	MALI_TIMELINE_TRACKER_PP   = 1, /**< Tracker used by PP jobs. */
+	MALI_TIMELINE_TRACKER_SOFT = 2, /**< Tracker used by soft jobs. */
+	MALI_TIMELINE_TRACKER_WAIT = 3, /**< Tracker used for fence wait. */
+	MALI_TIMELINE_TRACKER_SYNC = 4, /**< Tracker used for sync fence. */
+	MALI_TIMELINE_TRACKER_MAX  = 5,
+} mali_timeline_tracker_type;
+
+/**
+ * Tracker activation error.
+ */
+typedef u32 mali_timeline_activation_error;
+#define MALI_TIMELINE_ACTIVATION_ERROR_NONE      0
+#define MALI_TIMELINE_ACTIVATION_ERROR_SYNC_BIT  (1<<1)
+#define MALI_TIMELINE_ACTIVATION_ERROR_FATAL_BIT (1<<0)
+
+/**
+ * Type used to represent a point on a timeline.
+ */
+typedef u32 mali_timeline_point;
+
+/**
+ * Used to represent that no point on a timeline.
+ */
+#define MALI_TIMELINE_NO_POINT ((mali_timeline_point) 0)
+
+/**
+ * The maximum span of points on a timeline.  A timeline will be considered full if the difference
+ * between the oldest and newest points is equal or larger to this value.
+ */
+#define MALI_TIMELINE_MAX_POINT_SPAN 65536
+
+/**
+ * Magic value used to assert on validity of trackers.
+ */
+#define MALI_TIMELINE_TRACKER_MAGIC 0xabcdabcd
+
+struct mali_timeline;
+struct mali_timeline_waiter;
+struct mali_timeline_tracker;
+
+/**
+ * Timeline fence.
+ */
+struct mali_timeline_fence {
+	mali_timeline_point points[MALI_TIMELINE_MAX]; /**< For each timeline, a point or MALI_TIMELINE_NO_POINT. */
+	s32                 sync_fd;                   /**< A file descriptor representing a sync fence, or -1. */
+};
+
+/**
+ * Timeline system.
+ *
+ * The Timeline system has a set of timelines associated with a session.
+ */
+struct mali_timeline_system {
+	struct mali_spinlock_reentrant *spinlock;   /**< Spin lock protecting the timeline system */
+	struct mali_timeline           *timelines[MALI_TIMELINE_MAX]; /**< The timelines in this system */
+
+	/* Single-linked list of unused waiter objects.  Uses the tracker_next field in tracker. */
+	struct mali_timeline_waiter    *waiter_empty_list;
+
+	struct mali_session_data       *session;    /**< Session that owns this system. */
+
+	mali_bool                       timer_enabled; /**< Set to MALI_TRUE if soft job timer should be enabled, MALI_FALSE if not. */
+
+	_mali_osk_wait_queue_t         *wait_queue; /**< Wait queue. */
+
+#if defined(CONFIG_SYNC)
+	struct sync_timeline           *signaled_sync_tl; /**< Special sync timeline used to create pre-signaled sync fences */
+#endif /* defined(CONFIG_SYNC) */
+};
+
+/**
+ * Timeline.  Each Timeline system will have MALI_TIMELINE_MAX timelines.
+ */
+struct mali_timeline {
+	mali_timeline_point           point_next;   /**< The next available point. */
+	mali_timeline_point           point_oldest; /**< The oldest point not released. */
+
+	/* Double-linked list of trackers.  Sorted in ascending order by tracker->time_number with
+	 * tail pointing to the tracker with the oldest time. */
+	struct mali_timeline_tracker *tracker_head;
+	struct mali_timeline_tracker *tracker_tail;
+
+	/* Double-linked list of waiters.  Sorted in ascending order by waiter->time_number_wait
+	 * with tail pointing to the waiter with oldest wait time. */
+	struct mali_timeline_waiter  *waiter_head;
+	struct mali_timeline_waiter  *waiter_tail;
+
+	struct mali_timeline_system  *system;       /**< Timeline system this timeline belongs to. */
+	enum mali_timeline_id         id;           /**< Timeline type. */
+
+#if defined(CONFIG_SYNC)
+	struct sync_timeline         *sync_tl;      /**< Sync timeline that corresponds to this timeline. */
+	mali_bool destroyed;
+	struct mali_spinlock_reentrant *spinlock;       /**< Spin lock protecting the timeline system */
+#endif /* defined(CONFIG_SYNC) */
+
+	/* The following fields are used to time out soft job trackers. */
+	_mali_osk_wq_delayed_work_t  *delayed_work;
+	mali_bool                     timer_active;
+};
+
+/**
+ * Timeline waiter.
+ */
+struct mali_timeline_waiter {
+	mali_timeline_point           point;         /**< Point on timeline we are waiting for to be released. */
+	struct mali_timeline_tracker *tracker;       /**< Tracker that is waiting. */
+
+	struct mali_timeline_waiter  *timeline_next; /**< Next waiter on timeline's waiter list. */
+	struct mali_timeline_waiter  *timeline_prev; /**< Previous waiter on timeline's waiter list. */
+
+	struct mali_timeline_waiter  *tracker_next;  /**< Next waiter on tracker's waiter list. */
+};
+
+/**
+ * Timeline tracker.
+ */
+struct mali_timeline_tracker {
+	MALI_DEBUG_CODE(u32            magic); /**< Should always be MALI_TIMELINE_TRACKER_MAGIC for a valid tracker. */
+
+	mali_timeline_point            point; /**< Point on timeline for this tracker */
+
+	struct mali_timeline_tracker  *timeline_next; /**< Next tracker on timeline's tracker list */
+	struct mali_timeline_tracker  *timeline_prev; /**< Previous tracker on timeline's tracker list */
+
+	u32                            trigger_ref_count; /**< When zero tracker will be activated */
+	mali_timeline_activation_error activation_error;  /**< Activation error. */
+	struct mali_timeline_fence     fence;             /**< Fence used to create this tracker */
+
+	/* Single-linked list of waiters.  Sorted in order of insertions with
+	 * tail pointing to first waiter. */
+	struct mali_timeline_waiter   *waiter_head;
+	struct mali_timeline_waiter   *waiter_tail;
+
+#if defined(CONFIG_SYNC)
+	/* These are only used if the tracker is waiting on a sync fence. */
+	struct mali_timeline_waiter   *waiter_sync; /**< A direct pointer to timeline waiter representing sync fence. */
+	struct sync_fence_waiter       sync_fence_waiter; /**< Used to connect sync fence and tracker in sync fence wait callback. */
+	struct sync_fence             *sync_fence;   /**< The sync fence this tracker is waiting on. */
+	_mali_osk_list_t               sync_fence_cancel_list; /**< List node used to cancel sync fence waiters. */
+#endif /* defined(CONFIG_SYNC) */
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+	struct mali_timeline_waiter   *waiter_dma_fence; /**< A direct pointer to timeline waiter representing dma fence. */
+#endif
+
+	struct mali_timeline_system   *system;       /**< Timeline system. */
+	struct mali_timeline          *timeline;     /**< Timeline, or NULL if not on a timeline. */
+	enum mali_timeline_tracker_type type;        /**< Type of tracker. */
+	void                          *job;          /**< Owner of tracker. */
+
+	/* The following fields are used to time out soft job trackers. */
+	unsigned long                 os_tick_create;
+	unsigned long                 os_tick_activate;
+	mali_bool                     timer_active;
+};
+
+extern _mali_osk_atomic_t gp_tracker_count;
+extern _mali_osk_atomic_t phy_pp_tracker_count;
+extern _mali_osk_atomic_t virt_pp_tracker_count;
+
+/**
+ * What follows is a set of functions to check the state of a timeline and to determine where on a
+ * timeline a given point is.  Most of these checks will translate the timeline so the oldest point
+ * on the timeline is aligned with zero.  Remember that all of these calculation are done on
+ * unsigned integers.
+ *
+ * The following example illustrates the three different states a point can be in.  The timeline has
+ * been translated to put the oldest point at zero:
+ *
+ *
+ *
+ *                               [ point is in forbidden zone ]
+ *                                          64k wide
+ *                                MALI_TIMELINE_MAX_POINT_SPAN
+ *
+ *    [ point is on timeline     )                            ( point is released ]
+ *
+ *    0--------------------------##############################--------------------2^32 - 1
+ *    ^                          ^
+ *    \                          |
+ *     oldest point on timeline  |
+ *                               \
+ *                                next point on timeline
+ */
+
+/**
+ * Compare two timeline points
+ *
+ * Returns true if a is after b, false if a is before or equal to b.
+ *
+ * This funcion ignores MALI_TIMELINE_MAX_POINT_SPAN. Wrapping is supported and
+ * the result will be correct if the points is less then UINT_MAX/2 apart.
+ *
+ * @param a Point on timeline
+ * @param b Point on timeline
+ * @return MALI_TRUE if a is after b
+ */
+MALI_STATIC_INLINE mali_bool mali_timeline_point_after(mali_timeline_point a, mali_timeline_point b)
+{
+	return 0 > ((s32)b) - ((s32)a);
+}
+
+/**
+ * Check if a point is on timeline.  A point is on a timeline if it is greater than, or equal to,
+ * the oldest point, and less than the next point.
+ *
+ * @param timeline Timeline.
+ * @param point Point on timeline.
+ * @return MALI_TRUE if point is on timeline, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_timeline_is_point_on(struct mali_timeline *timeline, mali_timeline_point point)
+{
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_NO_POINT != point);
+
+	return (point - timeline->point_oldest) < (timeline->point_next - timeline->point_oldest);
+}
+
+/**
+ * Check if a point has been released.  A point is released if it is older than the oldest point on
+ * the timeline, newer than the next point, and also not in the forbidden zone.
+ *
+ * @param timeline Timeline.
+ * @param point Point on timeline.
+ * @return MALI_TRUE if point has been release, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_timeline_is_point_released(struct mali_timeline *timeline, mali_timeline_point point)
+{
+	mali_timeline_point point_normalized;
+	mali_timeline_point next_normalized;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_NO_POINT != point);
+
+	point_normalized = point - timeline->point_oldest;
+	next_normalized = timeline->point_next - timeline->point_oldest;
+
+	return point_normalized > (next_normalized + MALI_TIMELINE_MAX_POINT_SPAN);
+}
+
+/**
+ * Check if a point is valid.  A point is valid if is on the timeline or has been released.
+ *
+ * @param timeline Timeline.
+ * @param point Point on timeline.
+ * @return MALI_TRUE if point is valid, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_timeline_is_point_valid(struct mali_timeline *timeline, mali_timeline_point point)
+{
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	return mali_timeline_is_point_on(timeline, point) || mali_timeline_is_point_released(timeline, point);
+}
+
+/**
+ * Check if timeline is empty (has no points on it).  A timeline is empty if next == oldest.
+ *
+ * @param timeline Timeline.
+ * @return MALI_TRUE if timeline is empty, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_timeline_is_empty(struct mali_timeline *timeline)
+{
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	return timeline->point_next == timeline->point_oldest;
+}
+
+/**
+ * Check if timeline is full.  A valid timeline cannot span more than 64k points (@ref
+ * MALI_TIMELINE_MAX_POINT_SPAN).
+ *
+ * @param timeline Timeline.
+ * @return MALI_TRUE if timeline is full, MALI_FALSE if not.
+ */
+MALI_STATIC_INLINE mali_bool mali_timeline_is_full(struct mali_timeline *timeline)
+{
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	return MALI_TIMELINE_MAX_POINT_SPAN <= (timeline->point_next - timeline->point_oldest);
+}
+
+/**
+ * Create a new timeline system.
+ *
+ * @param session The session this timeline system will belong to.
+ * @return New timeline system.
+ */
+struct mali_timeline_system *mali_timeline_system_create(struct mali_session_data *session);
+
+/**
+ * Abort timeline system.
+ *
+ * This will release all pending waiters in the timeline system causing all trackers to be
+ * activated.
+ *
+ * @param system Timeline system to abort all jobs from.
+ */
+void mali_timeline_system_abort(struct mali_timeline_system *system);
+
+/**
+ * Destroy an empty timeline system.
+ *
+ * @note @ref mali_timeline_system_abort() should be called prior to this function.
+ *
+ * @param system Timeline system to destroy.
+ */
+void mali_timeline_system_destroy(struct mali_timeline_system *system);
+
+/**
+ * Stop the soft job timer.
+ *
+ * @param system Timeline system
+ */
+void mali_timeline_system_stop_timer(struct mali_timeline_system *system);
+
+/**
+ * Add a tracker to a timeline system and optionally also on a timeline.
+ *
+ * Once added to the timeline system, the tracker is guaranteed to be activated.  The tracker can be
+ * activated before this function returns.  Thus, it is also possible that the tracker is released
+ * before this function returns, depending on the tracker type.
+ *
+ * @note Tracker must be initialized (@ref mali_timeline_tracker_init) before being added to the
+ * timeline system.
+ *
+ * @param system Timeline system the tracker will be added to.
+ * @param tracker The tracker to be added.
+ * @param timeline_id Id of the timeline the tracker will be added to, or
+ *                    MALI_TIMELINE_NONE if it should not be added on a timeline.
+ * @return Point on timeline identifying this tracker, or MALI_TIMELINE_NO_POINT if not on timeline.
+ */
+mali_timeline_point mali_timeline_system_add_tracker(struct mali_timeline_system *system,
+		struct mali_timeline_tracker *tracker,
+		enum mali_timeline_id timeline_id);
+
+/**
+ * Get latest point on timeline.
+ *
+ * @param system Timeline system.
+ * @param timeline_id Id of timeline to get latest point from.
+ * @return Latest point on timeline, or MALI_TIMELINE_NO_POINT if the timeline is empty.
+ */
+mali_timeline_point mali_timeline_system_get_latest_point(struct mali_timeline_system *system,
+		enum mali_timeline_id timeline_id);
+
+/**
+ * Initialize tracker.
+ *
+ * Must be called before tracker is added to timeline system (@ref mali_timeline_system_add_tracker).
+ *
+ * @param tracker Tracker to initialize.
+ * @param type Type of tracker.
+ * @param fence Fence used to set up dependencies for tracker.
+ * @param job Pointer to job struct this tracker is associated with.
+ */
+void mali_timeline_tracker_init(struct mali_timeline_tracker *tracker,
+				mali_timeline_tracker_type type,
+				struct mali_timeline_fence *fence,
+				void *job);
+
+/**
+ * Grab trigger ref count on tracker.
+ *
+ * This will prevent tracker from being activated until the trigger ref count reaches zero.
+ *
+ * @note Tracker must have been initialized (@ref mali_timeline_tracker_init).
+ *
+ * @param system Timeline system.
+ * @param tracker Tracker.
+ */
+void mali_timeline_system_tracker_get(struct mali_timeline_system *system, struct mali_timeline_tracker *tracker);
+
+/**
+ * Release trigger ref count on tracker.
+ *
+ * If the trigger ref count reaches zero, the tracker will be activated.
+ *
+ * @param system Timeline system.
+ * @param tracker Tracker.
+ * @param activation_error Error bitmask if activated with error, or MALI_TIMELINE_ACTIVATION_ERROR_NONE if no error.
+ * @return Scheduling bitmask.
+ */
+mali_scheduler_mask mali_timeline_system_tracker_put(struct mali_timeline_system *system, struct mali_timeline_tracker *tracker, mali_timeline_activation_error activation_error);
+
+/**
+ * Release a tracker from the timeline system.
+ *
+ * This is used to signal that the job being tracker is finished, either due to normal circumstances
+ * (job complete/abort) or due to a timeout.
+ *
+ * We may need to schedule some subsystems after a tracker has been released and the returned
+ * bitmask will tell us if it is necessary.  If the return value is non-zero, this value needs to be
+ * sent as an input parameter to @ref mali_scheduler_schedule_from_mask() to do the scheduling.
+ *
+ * @note Tracker must have been activated before being released.
+ * @warning Not calling @ref mali_scheduler_schedule_from_mask() after releasing a tracker can lead
+ * to a deadlock.
+ *
+ * @param tracker Tracker being released.
+ * @return Scheduling bitmask.
+ */
+mali_scheduler_mask mali_timeline_tracker_release(struct mali_timeline_tracker *tracker);
+
+MALI_STATIC_INLINE mali_bool mali_timeline_tracker_activation_error(
+	struct mali_timeline_tracker *tracker)
+{
+	MALI_DEBUG_ASSERT_POINTER(tracker);
+	return (MALI_TIMELINE_ACTIVATION_ERROR_FATAL_BIT &
+		tracker->activation_error) ? MALI_TRUE : MALI_FALSE;
+}
+
+/**
+ * Copy data from a UK fence to a Timeline fence.
+ *
+ * @param fence Timeline fence.
+ * @param uk_fence UK fence.
+ */
+void mali_timeline_fence_copy_uk_fence(struct mali_timeline_fence *fence, _mali_uk_fence_t *uk_fence);
+
+void mali_timeline_initialize(void);
+
+void mali_timeline_terminate(void);
+
+MALI_STATIC_INLINE mali_bool mali_timeline_has_gp_job(void)
+{
+	return 0 < _mali_osk_atomic_read(&gp_tracker_count);
+}
+
+MALI_STATIC_INLINE mali_bool mali_timeline_has_physical_pp_job(void)
+{
+	return 0 < _mali_osk_atomic_read(&phy_pp_tracker_count);
+}
+
+MALI_STATIC_INLINE mali_bool mali_timeline_has_virtual_pp_job(void)
+{
+	return 0 < _mali_osk_atomic_read(&virt_pp_tracker_count);
+}
+
+#if defined(DEBUG)
+#define MALI_TIMELINE_DEBUG_FUNCTIONS
+#endif /* DEBUG */
+#if defined(MALI_TIMELINE_DEBUG_FUNCTIONS)
+
+/**
+ * Tracker state.  Used for debug printing.
+ */
+typedef enum mali_timeline_tracker_state {
+	MALI_TIMELINE_TS_INIT    = 0,
+	MALI_TIMELINE_TS_WAITING = 1,
+	MALI_TIMELINE_TS_ACTIVE  = 2,
+	MALI_TIMELINE_TS_FINISH  = 3,
+} mali_timeline_tracker_state;
+
+/**
+ * Get tracker state.
+ *
+ * @param tracker Tracker to check.
+ * @return State of tracker.
+ */
+mali_timeline_tracker_state mali_timeline_debug_get_tracker_state(struct mali_timeline_tracker *tracker);
+
+/**
+ * Print debug information about tracker.
+ *
+ * @param tracker Tracker to print.
+ */
+void mali_timeline_debug_print_tracker(struct mali_timeline_tracker *tracker, _mali_osk_print_ctx *print_ctx);
+
+/**
+ * Print debug information about timeline.
+ *
+ * @param timeline Timeline to print.
+ */
+void mali_timeline_debug_print_timeline(struct mali_timeline *timeline, _mali_osk_print_ctx *print_ctx);
+
+#if !(LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0))
+void mali_timeline_debug_direct_print_tracker(struct mali_timeline_tracker *tracker);
+void mali_timeline_debug_direct_print_timeline(struct mali_timeline *timeline);
+#endif
+
+/**
+ * Print debug information about timeline system.
+ *
+ * @param system Timeline system to print.
+ */
+void mali_timeline_debug_print_system(struct mali_timeline_system *system, _mali_osk_print_ctx *print_ctx);
+
+#endif /* defined(MALI_TIMELINE_DEBUG_FUNCTIONS) */
+
+#if defined(CONFIG_MALI_DMA_BUF_FENCE)
+/**
+ * The timeline dma fence callback when dma fence signal.
+ *
+ * @param pp_job_ptr The pointer to pp job that link to the signaled dma fence.
+ */
+void mali_timeline_dma_fence_callback(void *pp_job_ptr);
+#endif
+
+#endif /* __MALI_TIMELINE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.c b/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.c
--- a/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_timeline_sync_fence.h"
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_sync.h"
+
+#if defined(CONFIG_SYNC)
+
+/**
+ * Creates a sync fence tracker and a sync fence.  Adds sync fence tracker to Timeline system and
+ * returns sync fence.  The sync fence will be signaled when the sync fence tracker is activated.
+ *
+ * @param timeline Timeline.
+ * @param point Point on timeline.
+ * @return Sync fence that will be signaled when tracker is activated.
+ */
+static struct sync_fence *mali_timeline_sync_fence_create_and_add_tracker(struct mali_timeline *timeline, mali_timeline_point point)
+{
+	struct mali_timeline_sync_fence_tracker *sync_fence_tracker;
+	struct sync_fence                       *sync_fence;
+	struct mali_timeline_fence               fence;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_NO_POINT != point);
+
+	/* Allocate sync fence tracker. */
+	sync_fence_tracker = _mali_osk_calloc(1, sizeof(struct mali_timeline_sync_fence_tracker));
+	if (NULL == sync_fence_tracker) {
+		MALI_PRINT_ERROR(("Mali Timeline: sync_fence_tracker allocation failed\n"));
+		return NULL;
+	}
+
+	/* Create sync flag. */
+	MALI_DEBUG_ASSERT_POINTER(timeline->sync_tl);
+	sync_fence_tracker->flag = mali_sync_flag_create(timeline->sync_tl, point);
+	if (NULL == sync_fence_tracker->flag) {
+		MALI_PRINT_ERROR(("Mali Timeline: sync_flag creation failed\n"));
+		_mali_osk_free(sync_fence_tracker);
+		return NULL;
+	}
+
+	/* Create sync fence from sync flag. */
+	sync_fence = mali_sync_flag_create_fence(sync_fence_tracker->flag);
+	if (NULL == sync_fence) {
+		MALI_PRINT_ERROR(("Mali Timeline: sync_fence creation failed\n"));
+		mali_sync_flag_put(sync_fence_tracker->flag);
+		_mali_osk_free(sync_fence_tracker);
+		return NULL;
+	}
+
+	/* Setup fence for tracker. */
+	_mali_osk_memset(&fence, 0, sizeof(struct mali_timeline_fence));
+	fence.sync_fd = -1;
+	fence.points[timeline->id] = point;
+
+	/* Finally, add the tracker to Timeline system. */
+	mali_timeline_tracker_init(&sync_fence_tracker->tracker, MALI_TIMELINE_TRACKER_SYNC, &fence, sync_fence_tracker);
+	point = mali_timeline_system_add_tracker(timeline->system, &sync_fence_tracker->tracker, MALI_TIMELINE_NONE);
+	MALI_DEBUG_ASSERT(MALI_TIMELINE_NO_POINT == point);
+
+	return sync_fence;
+}
+
+s32 mali_timeline_sync_fence_create(struct mali_timeline_system *system, struct mali_timeline_fence *fence)
+{
+	u32 i;
+	struct sync_fence *sync_fence_acc = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(system);
+	MALI_DEBUG_ASSERT_POINTER(fence);
+
+	for (i = 0; i < MALI_TIMELINE_MAX; ++i) {
+		struct mali_timeline *timeline;
+		struct sync_fence *sync_fence;
+
+		if (MALI_TIMELINE_NO_POINT == fence->points[i]) continue;
+
+		timeline = system->timelines[i];
+		MALI_DEBUG_ASSERT_POINTER(timeline);
+
+		sync_fence = mali_timeline_sync_fence_create_and_add_tracker(timeline, fence->points[i]);
+		if (NULL == sync_fence) goto error;
+
+		if (NULL != sync_fence_acc) {
+			/* Merge sync fences. */
+			sync_fence_acc = mali_sync_fence_merge(sync_fence_acc, sync_fence);
+			if (NULL == sync_fence_acc) goto error;
+		} else {
+			/* This was the first sync fence created. */
+			sync_fence_acc = sync_fence;
+		}
+	}
+
+	if (-1 != fence->sync_fd) {
+		struct sync_fence *sync_fence;
+
+		sync_fence = sync_fence_fdget(fence->sync_fd);
+		if (NULL == sync_fence) goto error;
+
+		if (NULL != sync_fence_acc) {
+			sync_fence_acc = mali_sync_fence_merge(sync_fence_acc, sync_fence);
+			if (NULL == sync_fence_acc) goto error;
+		} else {
+			sync_fence_acc = sync_fence;
+		}
+	}
+
+	if (NULL == sync_fence_acc) {
+		MALI_DEBUG_ASSERT_POINTER(system->signaled_sync_tl);
+
+		/* There was nothing to wait on, so return an already signaled fence. */
+
+		sync_fence_acc = mali_sync_timeline_create_signaled_fence(system->signaled_sync_tl);
+		if (NULL == sync_fence_acc) goto error;
+	}
+
+	/* Return file descriptor for the accumulated sync fence. */
+	return mali_sync_fence_fd_alloc(sync_fence_acc);
+
+error:
+	if (NULL != sync_fence_acc) {
+		sync_fence_put(sync_fence_acc);
+	}
+
+	return -1;
+}
+
+void mali_timeline_sync_fence_activate(struct mali_timeline_sync_fence_tracker *sync_fence_tracker)
+{
+	mali_scheduler_mask schedule_mask = MALI_SCHEDULER_MASK_EMPTY;
+
+	MALI_DEBUG_ASSERT_POINTER(sync_fence_tracker);
+	MALI_DEBUG_ASSERT_POINTER(sync_fence_tracker->flag);
+
+	MALI_DEBUG_PRINT(4, ("Mali Timeline: activation for sync fence tracker\n"));
+
+	/* Signal flag and release reference. */
+	mali_sync_flag_signal(sync_fence_tracker->flag, 0);
+	mali_sync_flag_put(sync_fence_tracker->flag);
+
+	/* Nothing can wait on this tracker, so nothing to schedule after release. */
+	schedule_mask = mali_timeline_tracker_release(&sync_fence_tracker->tracker);
+	MALI_DEBUG_ASSERT(MALI_SCHEDULER_MASK_EMPTY == schedule_mask);
+
+	_mali_osk_free(sync_fence_tracker);
+}
+
+#endif /* defined(CONFIG_SYNC) */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.h b/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.h
--- a/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_timeline_sync_fence.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_timeline_sync_fence.h
+ *
+ * This file contains code related to creating sync fences from timeline fences.
+ */
+
+#ifndef __MALI_TIMELINE_SYNC_FENCE_H__
+#define __MALI_TIMELINE_SYNC_FENCE_H__
+
+#include "mali_timeline.h"
+
+#if defined(CONFIG_SYNC)
+
+/**
+ * Sync fence tracker.
+ */
+struct mali_timeline_sync_fence_tracker {
+	struct mali_sync_flag        *flag;    /**< Sync flag used to connect tracker and sync fence. */
+	struct mali_timeline_tracker  tracker; /**< Timeline tracker. */
+};
+
+/**
+ * Create a sync fence that will be signaled when @ref fence is signaled.
+ *
+ * @param system Timeline system.
+ * @param fence Fence to create sync fence from.
+ * @return File descriptor for new sync fence, or -1 on error.
+ */
+s32 mali_timeline_sync_fence_create(struct mali_timeline_system *system, struct mali_timeline_fence *fence);
+
+/**
+ * Used by the Timeline system to activate a sync fence tracker.
+ *
+ * @param sync_fence_tracker Sync fence tracker.
+ *
+ */
+void mali_timeline_sync_fence_activate(struct mali_timeline_sync_fence_tracker *sync_fence_tracker);
+
+#endif /* defined(CONFIG_SYNC) */
+
+#endif /* __MALI_TIMELINE_SYNC_FENCE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_ukk.h b/drivers/gpu/arm/mali400/common/mali_ukk.h
--- a/drivers/gpu/arm/mali400/common/mali_ukk.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_ukk.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,551 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_ukk.h
+ * Defines the kernel-side interface of the user-kernel interface
+ */
+
+#ifndef __MALI_UKK_H__
+#define __MALI_UKK_H__
+
+#include "mali_osk.h"
+#include "mali_uk_types.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @addtogroup uddapi Unified Device Driver (UDD) APIs
+ *
+ * @{
+ */
+
+/**
+ * @addtogroup u_k_api UDD User/Kernel Interface (U/K) APIs
+ *
+ * - The _mali_uk functions are an abstraction of the interface to the device
+ * driver. On certain OSs, this would be implemented via the IOCTL interface.
+ * On other OSs, it could be via extension of some Device Driver Class, or
+ * direct function call for Bare metal/RTOSs.
+ * - It is important to note that:
+ *   -  The Device Driver has implemented the _mali_ukk set of functions
+ *   -  The Base Driver calls the corresponding set of _mali_uku functions.
+ * - What requires porting is solely the calling mechanism from User-side to
+ * Kernel-side, and propagating back the results.
+ * - Each U/K function is associated with a (group, number) pair from
+ * \ref _mali_uk_functions to make it possible for a common function in the
+ * Base Driver and Device Driver to route User/Kernel calls from/to the
+ * correct _mali_uk function. For example, in an IOCTL system, the IOCTL number
+ * would be formed based on the group and number assigned to the _mali_uk
+ * function, as listed in \ref _mali_uk_functions. On the user-side, each
+ * _mali_uku function would just make an IOCTL with the IOCTL-code being an
+ * encoded form of the (group, number) pair. On the kernel-side, the Device
+ * Driver's IOCTL handler decodes the IOCTL-code back into a (group, number)
+ * pair, and uses this to determine which corresponding _mali_ukk should be
+ * called.
+ *   - Refer to \ref _mali_uk_functions for more information about this
+ * (group, number) pairing.
+ * - In a system where there is no distinction between user and kernel-side,
+ * the U/K interface may be implemented as:@code
+ * MALI_STATIC_INLINE _mali_osk_errcode_t _mali_uku_examplefunction( _mali_uk_examplefunction_s *args )
+ * {
+ *     return mali_ukk_examplefunction( args );
+ * }
+ * @endcode
+ * - Therefore, all U/K calls behave \em as \em though they were direct
+ * function calls (but the \b implementation \em need \em not be a direct
+ * function calls)
+ *
+ * @note Naming the _mali_uk functions the same on both User and Kernel sides
+ * on non-RTOS systems causes debugging issues when setting breakpoints. In
+ * this case, it is not clear which function the breakpoint is put on.
+ * Therefore the _mali_uk functions in user space are prefixed with \c _mali_uku
+ * and in kernel space with \c _mali_ukk. The naming for the argument
+ * structures is unaffected.
+ *
+ * - The _mali_uk functions are synchronous.
+ * - Arguments to the _mali_uk functions are passed in a structure. The only
+ * parameter passed to the _mali_uk functions is a pointer to this structure.
+ * This first member of this structure, ctx, is a pointer to a context returned
+ * by _mali_uku_open(). For example:@code
+ * typedef struct
+ * {
+ *     void *ctx;
+ *     u32 number_of_cores;
+ * } _mali_uk_get_gp_number_of_cores_s;
+ * @endcode
+ *
+ * - Each _mali_uk function has its own argument structure named after the
+ *  function. The argument is distinguished by the _s suffix.
+ * - The argument types are defined by the base driver and user-kernel
+ *  interface.
+ * - All _mali_uk functions return a standard \ref _mali_osk_errcode_t.
+ * - Only arguments of type input or input/output need be initialized before
+ * calling a _mali_uk function.
+ * - Arguments of type output and input/output are only valid when the
+ * _mali_uk function returns \ref _MALI_OSK_ERR_OK.
+ * - The \c ctx member is always invalid after it has been used by a
+ * _mali_uk function, except for the context management functions
+ *
+ *
+ * \b Interface \b restrictions
+ *
+ * The requirements of the interface mean that an implementation of the
+ * User-kernel interface may do no 'real' work. For example, the following are
+ * illegal in the User-kernel implementation:
+ * - Calling functions necessary for operation on all systems,  which would
+ * not otherwise get called on RTOS systems.
+ *     - For example, a  U/K interface that calls multiple _mali_ukk functions
+ * during one particular U/K call. This could not be achieved by the same code
+ * which uses direct function calls for the U/K interface.
+ * -  Writing in values to the args members, when otherwise these members would
+ * not hold a useful value for a direct function call U/K interface.
+ *     - For example, U/K interface implementation that take NULL members in
+ * their arguments structure from the user side, but those members are
+ * replaced with non-NULL values in the kernel-side of the U/K interface
+ * implementation. A scratch area for writing data is one such example. In this
+ * case, a direct function call U/K interface would segfault, because no code
+ * would be present to replace the NULL pointer with a meaningful pointer.
+ *     - Note that we discourage the case where the U/K implementation changes
+ * a NULL argument member to non-NULL, and then the Device Driver code (outside
+ * of the U/K layer) re-checks this member for NULL, and corrects it when
+ * necessary. Whilst such code works even on direct function call U/K
+ * intefaces, it reduces the testing coverage of the Device Driver code. This
+ * is because we have no way of testing the NULL == value path on an OS
+ * implementation.
+ *
+ * A number of allowable examples exist where U/K interfaces do 'real' work:
+ * - The 'pointer switching' technique for \ref _mali_ukk_get_system_info
+ *     - In this case, without the pointer switching on direct function call
+ * U/K interface, the Device Driver code still sees the same thing: a pointer
+ * to which it can write memory. This is because such a system has no
+ * distinction between a user and kernel pointer.
+ * - Writing an OS-specific value into the ukk_private member for
+ * _mali_ukk_mem_mmap().
+ *     - In this case, this value is passed around by Device Driver code, but
+ * its actual value is never checked. Device Driver code simply passes it from
+ * the U/K layer to the OSK layer, where it can be acted upon. In this case,
+ * \em some OS implementations of the U/K (_mali_ukk_mem_mmap()) and OSK
+ * (_mali_osk_mem_mapregion_init()) functions will collaborate on the
+ *  meaning of ukk_private member. On other OSs, it may be unused by both
+ * U/K and OSK layers
+ *     - Therefore, on error inside the U/K interface implementation itself,
+ * it will be as though the _mali_ukk function itself had failed, and cleaned
+ * up after itself.
+ *     - Compare this to a direct function call U/K implementation, where all
+ * error cleanup is handled by the _mali_ukk function itself. The direct
+ * function call U/K interface implementation is automatically atomic.
+ *
+ * The last example highlights a consequence of all U/K interface
+ * implementations: they must be atomic with respect to the Device Driver code.
+ * And therefore, should Device Driver code succeed but the U/K implementation
+ * fail afterwards (but before return to user-space), then the U/K
+ * implementation must cause appropriate cleanup actions to preserve the
+ * atomicity of the interface.
+ *
+ * @{
+ */
+
+
+/** @defgroup _mali_uk_context U/K Context management
+ *
+ * These functions allow for initialisation of the user-kernel interface once per process.
+ *
+ * Generally the context will store the OS specific object to communicate with the kernel device driver and further
+ * state information required by the specific implementation. The context is shareable among all threads in the caller process.
+ *
+ * On IOCTL systems, this is likely to be a file descriptor as a result of opening the kernel device driver.
+ *
+ * On a bare-metal/RTOS system with no distinction between kernel and
+ * user-space, the U/K interface simply calls the _mali_ukk variant of the
+ * function by direct function call. In this case, the context returned is the
+ * mali_session_data from _mali_ukk_open().
+ *
+ * The kernel side implementations of the U/K interface expect the first member of the argument structure to
+ * be the context created by _mali_uku_open(). On some OS implementations, the meaning of this context
+ * will be different between user-side and kernel-side. In which case, the kernel-side will need to replace this context
+ * with the kernel-side equivalent, because user-side will not have access to kernel-side data. The context parameter
+ * in the argument structure therefore has to be of type input/output.
+ *
+ * It should be noted that the caller cannot reuse the \c ctx member of U/K
+ * argument structure after a U/K call, because it may be overwritten. Instead,
+ * the context handle must always be stored  elsewhere, and copied into
+ * the appropriate U/K argument structure for each user-side call to
+ * the U/K interface. This is not usually a problem, since U/K argument
+ * structures are usually placed on the stack.
+ *
+ * @{ */
+
+/** @brief Begin a new Mali Device Driver session
+ *
+ * This is used to obtain a per-process context handle for all future U/K calls.
+ *
+ * @param context pointer to storage to return a (void*)context handle.
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_open(void **context);
+
+/** @brief End a Mali Device Driver session
+ *
+ * This should be called when the process no longer requires use of the Mali Device Driver.
+ *
+ * The context handle must not be used after it has been closed.
+ *
+ * @param context pointer to a stored (void*)context handle.
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_close(void **context);
+
+/** @} */ /* end group _mali_uk_context */
+
+
+/** @addtogroup _mali_uk_core U/K Core
+ *
+ * The core functions provide the following functionality:
+ * - verify that the user and kernel API are compatible
+ * - retrieve information about the cores and memory banks in the system
+ * - wait for the result of jobs started on a core
+ *
+ * @{ */
+
+/** @brief Waits for a job notification.
+ *
+ * Sleeps until notified or a timeout occurs. Returns information about the notification.
+ *
+ * @param args see _mali_uk_wait_for_notification_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_wait_for_notification(_mali_uk_wait_for_notification_s *args);
+
+/** @brief Post a notification to the notification queue of this application.
+ *
+ * @param args see _mali_uk_post_notification_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_post_notification(_mali_uk_post_notification_s *args);
+
+/** @brief Verifies if the user and kernel side of this API are compatible.
+ *
+ * This function is obsolete, but kept to allow old, incompatible user space
+ * clients to robustly detect the incompatibility.
+ *
+ * @param args see _mali_uk_get_api_version_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_api_version(_mali_uk_get_api_version_s *args);
+
+/** @brief Verifies if the user and kernel side of this API are compatible.
+ *
+ * @param args see _mali_uk_get_api_version_v2_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_api_version_v2(_mali_uk_get_api_version_v2_s *args);
+
+/** @brief Get the user space settings applicable for calling process.
+ *
+ * @param args see _mali_uk_get_user_settings_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_user_settings(_mali_uk_get_user_settings_s *args);
+
+/** @brief Get a user space setting applicable for calling process.
+ *
+ * @param args see _mali_uk_get_user_setting_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_user_setting(_mali_uk_get_user_setting_s *args);
+
+/* @brief Grant or deny high priority scheduling for this session.
+ *
+ * @param args see _mali_uk_request_high_priority_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_request_high_priority(_mali_uk_request_high_priority_s *args);
+
+/** @brief Make process sleep if the pending big job in kernel  >= MALI_MAX_PENDING_BIG_JOB
+ *
+ */
+_mali_osk_errcode_t _mali_ukk_pending_submit(_mali_uk_pending_submit_s *args);
+
+/** @} */ /* end group _mali_uk_core */
+
+
+/** @addtogroup _mali_uk_memory U/K Memory
+ *
+ * The memory functions provide functionality with and without a Mali-MMU present.
+ *
+ * For Mali-MMU based systems, the following functionality is provided:
+ * - Initialize and terminate MALI virtual address space
+ * - Allocate/deallocate physical memory to a MALI virtual address range and map into/unmap from the
+ * current process address space
+ * - Map/unmap external physical memory into the MALI virtual address range
+ *
+ * For Mali-nonMMU based systems:
+ * - Allocate/deallocate MALI memory
+ *
+ * @{ */
+
+/** @brief Map Mali Memory into the current user process
+ *
+ * Maps Mali memory into the current user process in a generic way.
+ *
+ * This function is to be used for Mali-MMU mode. The function is available in both Mali-MMU and Mali-nonMMU modes,
+ * but should not be called by a user process in Mali-nonMMU mode.
+ *
+ * The implementation and operation of _mali_ukk_mem_mmap() is dependant on whether the driver is built for Mali-MMU
+ * or Mali-nonMMU:
+ * - In the nonMMU case, _mali_ukk_mem_mmap() requires a physical address to be specified. For this reason, an OS U/K
+ * implementation should not allow this to be called from user-space. In any case, nonMMU implementations are
+ * inherently insecure, and so the overall impact is minimal. Mali-MMU mode should be used if security is desired.
+ * - In the MMU case, _mali_ukk_mem_mmap() the _mali_uk_mem_mmap_s::phys_addr
+ * member is used for the \em Mali-virtual address desired for the mapping. The
+ * implementation of _mali_ukk_mem_mmap() will allocate both the CPU-virtual
+ * and CPU-physical addresses, and can cope with mapping a contiguous virtual
+ * address range to a sequence of non-contiguous physical pages. In this case,
+ * the CPU-physical addresses are not communicated back to the user-side, as
+ * they are unnecsessary; the \em Mali-virtual address range must be used for
+ * programming Mali structures.
+ *
+ * In the second (MMU) case, _mali_ukk_mem_mmap() handles management of
+ * CPU-virtual and CPU-physical ranges, but the \em caller must manage the
+ * \em Mali-virtual address range from the user-side.
+ *
+ * @note Mali-virtual address ranges are entirely separate between processes.
+ * It is not possible for a process to accidentally corrupt another process'
+ * \em Mali-virtual address space.
+ *
+ * @param args see _mali_uk_mem_mmap_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_mem_mmap(_mali_uk_mem_mmap_s *args);
+
+/** @brief Unmap Mali Memory from the current user process
+ *
+ * Unmaps Mali memory from the current user process in a generic way. This only operates on Mali memory supplied
+ * from _mali_ukk_mem_mmap().
+ *
+ * @param args see _mali_uk_mem_munmap_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_mem_munmap(_mali_uk_mem_munmap_s *args);
+
+/** @brief Determine the buffer size necessary for an MMU page table dump.
+ * @param args see _mali_uk_query_mmu_page_table_dump_size_s in mali_utgard_uk_types.h
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_query_mmu_page_table_dump_size(_mali_uk_query_mmu_page_table_dump_size_s *args);
+/** @brief Dump MMU Page tables.
+ * @param args see _mali_uk_dump_mmu_page_table_s in mali_utgard_uk_types.h
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_dump_mmu_page_table(_mali_uk_dump_mmu_page_table_s *args);
+
+/** @brief Write user data to specified Mali memory without causing segfaults.
+ * @param args see _mali_uk_mem_write_safe_s in mali_utgard_uk_types.h
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_mem_write_safe(_mali_uk_mem_write_safe_s *args);
+
+/** @} */ /* end group _mali_uk_memory */
+
+
+/** @addtogroup _mali_uk_pp U/K Fragment Processor
+ *
+ * The Fragment Processor (aka PP (Pixel Processor)) functions provide the following functionality:
+ * - retrieving version of the fragment processors
+ * - determine number of fragment processors
+ * - starting a job on a fragment processor
+ *
+ * @{ */
+
+/** @brief Issue a request to start a new job on a Fragment Processor.
+ *
+ * If the request fails args->status is set to _MALI_UK_START_JOB_NOT_STARTED_DO_REQUEUE and you can
+ * try to start the job again.
+ *
+ * An existing job could be returned for requeueing if the new job has a higher priority than a previously started job
+ * which the hardware hasn't actually started processing yet. In this case the new job will be started instead and the
+ * existing one returned, otherwise the new job is started and the status field args->status is set to
+ * _MALI_UK_START_JOB_STARTED.
+ *
+ * Job completion can be awaited with _mali_ukk_wait_for_notification().
+ *
+ * @param ctx user-kernel context (mali_session)
+ * @param uargs see _mali_uk_pp_start_job_s in "mali_utgard_uk_types.h". Use _mali_osk_copy_from_user to retrieve data!
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_pp_start_job(void *ctx, _mali_uk_pp_start_job_s *uargs);
+
+/**
+ * @brief Issue a request to start new jobs on both Vertex Processor and Fragment Processor.
+ *
+ * @note Will call into @ref _mali_ukk_pp_start_job and @ref _mali_ukk_gp_start_job.
+ *
+ * @param ctx user-kernel context (mali_session)
+ * @param uargs see _mali_uk_pp_and_gp_start_job_s in "mali_utgard_uk_types.h". Use _mali_osk_copy_from_user to retrieve data!
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_pp_and_gp_start_job(void *ctx, _mali_uk_pp_and_gp_start_job_s *uargs);
+
+/** @brief Returns the number of Fragment Processors in the system
+ *
+ * @param args see _mali_uk_get_pp_number_of_cores_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_pp_number_of_cores(_mali_uk_get_pp_number_of_cores_s *args);
+
+/** @brief Returns the version that all Fragment Processor cores are compatible with.
+ *
+ * This function may only be called when _mali_ukk_get_pp_number_of_cores() indicated at least one Fragment
+ * Processor core is available.
+ *
+ * @param args see _mali_uk_get_pp_core_version_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_pp_core_version(_mali_uk_get_pp_core_version_s *args);
+
+/** @brief Disable Write-back unit(s) on specified job
+ *
+ * @param args see _mali_uk_get_pp_core_version_s in "mali_utgard_uk_types.h"
+ */
+void _mali_ukk_pp_job_disable_wb(_mali_uk_pp_disable_wb_s *args);
+
+
+/** @} */ /* end group _mali_uk_pp */
+
+
+/** @addtogroup _mali_uk_gp U/K Vertex Processor
+ *
+ * The Vertex Processor (aka GP (Geometry Processor)) functions provide the following functionality:
+ * - retrieving version of the Vertex Processors
+ * - determine number of Vertex Processors available
+ * - starting a job on a Vertex Processor
+ *
+ * @{ */
+
+/** @brief Issue a request to start a new job on a Vertex Processor.
+ *
+ * If the request fails args->status is set to _MALI_UK_START_JOB_NOT_STARTED_DO_REQUEUE and you can
+ * try to start the job again.
+ *
+ * An existing job could be returned for requeueing if the new job has a higher priority than a previously started job
+ * which the hardware hasn't actually started processing yet. In this case the new job will be started and the
+ * existing one returned, otherwise the new job is started and the status field args->status is set to
+ * _MALI_UK_START_JOB_STARTED.
+ *
+ * Job completion can be awaited with _mali_ukk_wait_for_notification().
+ *
+ * @param ctx user-kernel context (mali_session)
+ * @param uargs see _mali_uk_gp_start_job_s in "mali_utgard_uk_types.h". Use _mali_osk_copy_from_user to retrieve data!
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_gp_start_job(void *ctx, _mali_uk_gp_start_job_s *uargs);
+
+/** @brief Returns the number of Vertex Processors in the system.
+ *
+ * @param args see _mali_uk_get_gp_number_of_cores_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_gp_number_of_cores(_mali_uk_get_gp_number_of_cores_s *args);
+
+/** @brief Returns the version that all Vertex Processor cores are compatible with.
+ *
+ * This function may only be called when _mali_uk_get_gp_number_of_cores() indicated at least one Vertex
+ * Processor core is available.
+ *
+ * @param args see _mali_uk_get_gp_core_version_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_get_gp_core_version(_mali_uk_get_gp_core_version_s *args);
+
+/** @brief Resume or abort suspended Vertex Processor jobs.
+ *
+ * After receiving notification that a Vertex Processor job was suspended from
+ * _mali_ukk_wait_for_notification() you can use this function to resume or abort the job.
+ *
+ * @param args see _mali_uk_gp_suspend_response_s in "mali_utgard_uk_types.h"
+ * @return _MALI_OSK_ERR_OK on success, otherwise a suitable _mali_osk_errcode_t on failure.
+ */
+_mali_osk_errcode_t _mali_ukk_gp_suspend_response(_mali_uk_gp_suspend_response_s *args);
+
+/** @} */ /* end group _mali_uk_gp */
+
+#if defined(CONFIG_MALI400_PROFILING)
+/** @addtogroup _mali_uk_profiling U/K Timeline profiling module
+ * @{ */
+
+/** @brief Add event to profiling buffer.
+ *
+ * @param args see _mali_uk_profiling_add_event_s in "mali_utgard_uk_types.h"
+ */
+_mali_osk_errcode_t _mali_ukk_profiling_add_event(_mali_uk_profiling_add_event_s *args);
+
+/** @brief Get profiling stream fd.
+ *
+ * @param args see _mali_uk_profiling_stream_fd_get_s in "mali_utgard_uk_types.h"
+ */
+_mali_osk_errcode_t _mali_ukk_profiling_stream_fd_get(_mali_uk_profiling_stream_fd_get_s *args);
+
+/** @brief Profiling control set.
+ *
+ * @param args see _mali_uk_profiling_control_set_s in "mali_utgard_uk_types.h"
+ */
+_mali_osk_errcode_t _mali_ukk_profiling_control_set(_mali_uk_profiling_control_set_s *args);
+
+/** @} */ /* end group _mali_uk_profiling */
+#endif
+
+/** @addtogroup _mali_uk_vsync U/K VSYNC reporting module
+ * @{ */
+
+/** @brief Report events related to vsync.
+ *
+ * @note Events should be reported when starting to wait for vsync and when the
+ * waiting is finished. This information can then be used in kernel space to
+ * complement the GPU utilization metric.
+ *
+ * @param args see _mali_uk_vsync_event_report_s in "mali_utgard_uk_types.h"
+ */
+_mali_osk_errcode_t _mali_ukk_vsync_event_report(_mali_uk_vsync_event_report_s *args);
+
+/** @} */ /* end group _mali_uk_vsync */
+
+/** @addtogroup _mali_sw_counters_report U/K Software counter reporting
+ * @{ */
+
+/** @brief Report software counters.
+ *
+ * @param args see _mali_uk_sw_counters_report_s in "mali_uk_types.h"
+ */
+_mali_osk_errcode_t _mali_ukk_sw_counters_report(_mali_uk_sw_counters_report_s *args);
+
+/** @} */ /* end group _mali_sw_counters_report */
+
+/** @} */ /* end group u_k_api */
+
+/** @} */ /* end group uddapi */
+
+u32 _mali_ukk_report_memory_usage(void);
+
+u32 _mali_ukk_report_total_memory_size(void);
+
+u32 _mali_ukk_utilization_gp_pp(void);
+
+u32 _mali_ukk_utilization_gp(void);
+
+u32 _mali_ukk_utilization_pp(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_UKK_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_user_settings_db.c b/drivers/gpu/arm/mali400/common/mali_user_settings_db.c
--- a/drivers/gpu/arm/mali400/common/mali_user_settings_db.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_user_settings_db.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,147 @@
+/**
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_ukk.h"
+#include "mali_uk_types.h"
+#include "mali_user_settings_db.h"
+#include "mali_session.h"
+
+static u32 mali_user_settings[_MALI_UK_USER_SETTING_MAX];
+const char *_mali_uk_user_setting_descriptions[] = _MALI_UK_USER_SETTING_DESCRIPTIONS;
+
+static void mali_user_settings_notify(_mali_uk_user_setting_t setting, u32 value)
+{
+	mali_bool done = MALI_FALSE;
+
+	/*
+	 * This function gets a bit complicated because we can't hold the session lock while
+	 * allocating notification objects.
+	 */
+
+	while (!done) {
+		u32 i;
+		u32 num_sessions_alloc;
+		u32 num_sessions_with_lock;
+		u32 used_notification_objects = 0;
+		_mali_osk_notification_t **notobjs;
+
+		/* Pre allocate the number of notifications objects we need right now (might change after lock has been taken) */
+		num_sessions_alloc = mali_session_get_count();
+		if (0 == num_sessions_alloc) {
+			/* No sessions to report to */
+			return;
+		}
+
+		notobjs = (_mali_osk_notification_t **)_mali_osk_malloc(sizeof(_mali_osk_notification_t *) * num_sessions_alloc);
+		if (NULL == notobjs) {
+			MALI_PRINT_ERROR(("Failed to notify user space session about num PP core change (alloc failure)\n"));
+			return;
+		}
+
+		for (i = 0; i < num_sessions_alloc; i++) {
+			notobjs[i] = _mali_osk_notification_create(_MALI_NOTIFICATION_SETTINGS_CHANGED,
+					sizeof(_mali_uk_settings_changed_s));
+			if (NULL != notobjs[i]) {
+				_mali_uk_settings_changed_s *data;
+				data = notobjs[i]->result_buffer;
+
+				data->setting = setting;
+				data->value = value;
+			} else {
+				MALI_PRINT_ERROR(("Failed to notify user space session about setting change (alloc failure %u)\n", i));
+			}
+		}
+
+		mali_session_lock();
+
+		/* number of sessions will not change while we hold the lock */
+		num_sessions_with_lock = mali_session_get_count();
+
+		if (num_sessions_alloc >= num_sessions_with_lock) {
+			/* We have allocated enough notification objects for all the sessions atm */
+			struct mali_session_data *session, *tmp;
+			MALI_SESSION_FOREACH(session, tmp, link) {
+				MALI_DEBUG_ASSERT(used_notification_objects < num_sessions_alloc);
+				if (NULL != notobjs[used_notification_objects]) {
+					mali_session_send_notification(session, notobjs[used_notification_objects]);
+					notobjs[used_notification_objects] = NULL; /* Don't track this notification object any more */
+				}
+				used_notification_objects++;
+			}
+			done = MALI_TRUE;
+		}
+
+		mali_session_unlock();
+
+		/* Delete any remaining/unused notification objects */
+		for (; used_notification_objects < num_sessions_alloc; used_notification_objects++) {
+			if (NULL != notobjs[used_notification_objects]) {
+				_mali_osk_notification_delete(notobjs[used_notification_objects]);
+			}
+		}
+
+		_mali_osk_free(notobjs);
+	}
+}
+
+void mali_set_user_setting(_mali_uk_user_setting_t setting, u32 value)
+{
+	mali_bool notify = MALI_FALSE;
+
+	if (setting >= _MALI_UK_USER_SETTING_MAX) {
+		MALI_DEBUG_PRINT_ERROR(("Invalid user setting %ud\n"));
+		return;
+	}
+
+	if (mali_user_settings[setting] != value) {
+		notify = MALI_TRUE;
+	}
+
+	mali_user_settings[setting] = value;
+
+	if (notify) {
+		mali_user_settings_notify(setting, value);
+	}
+}
+
+u32 mali_get_user_setting(_mali_uk_user_setting_t setting)
+{
+	if (setting >= _MALI_UK_USER_SETTING_MAX) {
+		return 0;
+	}
+
+	return mali_user_settings[setting];
+}
+
+_mali_osk_errcode_t _mali_ukk_get_user_setting(_mali_uk_get_user_setting_s *args)
+{
+	_mali_uk_user_setting_t setting;
+	MALI_DEBUG_ASSERT_POINTER(args);
+
+	setting = args->setting;
+
+	if (_MALI_UK_USER_SETTING_MAX > setting) {
+		args->value = mali_user_settings[setting];
+		return _MALI_OSK_ERR_OK;
+	} else {
+		return _MALI_OSK_ERR_INVALID_ARGS;
+	}
+}
+
+_mali_osk_errcode_t _mali_ukk_get_user_settings(_mali_uk_get_user_settings_s *args)
+{
+	MALI_DEBUG_ASSERT_POINTER(args);
+
+	_mali_osk_memcpy(args->settings, mali_user_settings, sizeof(mali_user_settings));
+
+	return _MALI_OSK_ERR_OK;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/common/mali_user_settings_db.h b/drivers/gpu/arm/mali400/common/mali_user_settings_db.h
--- a/drivers/gpu/arm/mali400/common/mali_user_settings_db.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/common/mali_user_settings_db.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,39 @@
+/**
+ * Copyright (C) 2012-2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_USER_SETTINGS_DB_H__
+#define __MALI_USER_SETTINGS_DB_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "mali_uk_types.h"
+
+/** @brief Set Mali user setting in DB
+ *
+ * Update the DB with a new value for \a setting. If the value is different from theprevious set value running sessions will be notified of the change.
+ *
+ * @param setting the setting to be changed
+ * @param value the new value to set
+ */
+void mali_set_user_setting(_mali_uk_user_setting_t setting, u32 value);
+
+/** @brief Get current Mali user setting value from DB
+ *
+ * @param setting the setting to extract
+ * @return the value of the selected setting
+ */
+u32 mali_get_user_setting(_mali_uk_user_setting_t setting);
+
+#ifdef __cplusplus
+}
+#endif
+#endif  /* __MALI_KERNEL_USER_SETTING__ */
diff -ENwbur a/drivers/gpu/arm/mali400/.gitignore b/drivers/gpu/arm/mali400/.gitignore
--- a/drivers/gpu/arm/mali400/.gitignore	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/.gitignore	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1 @@
+__malidrv_build_info.c
diff -ENwbur a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard.h b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard.h
--- a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,531 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_utgard.h
+ * Defines types and interface exposed by the Mali Utgard device driver
+ */
+
+#ifndef __MALI_UTGARD_H__
+#define __MALI_UTGARD_H__
+
+#include "mali_osk_types.h"
+#ifdef CONFIG_MALI_DEVFREQ
+#include <linux/devfreq.h>
+#include "mali_pm_metrics.h"
+#ifdef CONFIG_DEVFREQ_THERMAL
+#include <linux/devfreq_cooling.h>
+#endif
+#endif
+
+#define MALI_GPU_NAME_UTGARD "mali-utgard"
+
+
+#define MALI_OFFSET_GP                    0x00000
+#define MALI_OFFSET_GP_MMU                0x03000
+
+#define MALI_OFFSET_PP0                   0x08000
+#define MALI_OFFSET_PP0_MMU               0x04000
+#define MALI_OFFSET_PP1                   0x0A000
+#define MALI_OFFSET_PP1_MMU               0x05000
+#define MALI_OFFSET_PP2                   0x0C000
+#define MALI_OFFSET_PP2_MMU               0x06000
+#define MALI_OFFSET_PP3                   0x0E000
+#define MALI_OFFSET_PP3_MMU               0x07000
+
+#define MALI_OFFSET_PP4                   0x28000
+#define MALI_OFFSET_PP4_MMU               0x1C000
+#define MALI_OFFSET_PP5                   0x2A000
+#define MALI_OFFSET_PP5_MMU               0x1D000
+#define MALI_OFFSET_PP6                   0x2C000
+#define MALI_OFFSET_PP6_MMU               0x1E000
+#define MALI_OFFSET_PP7                   0x2E000
+#define MALI_OFFSET_PP7_MMU               0x1F000
+
+#define MALI_OFFSET_L2_RESOURCE0          0x01000
+#define MALI_OFFSET_L2_RESOURCE1          0x10000
+#define MALI_OFFSET_L2_RESOURCE2          0x11000
+
+#define MALI400_OFFSET_L2_CACHE0          MALI_OFFSET_L2_RESOURCE0
+#define MALI450_OFFSET_L2_CACHE0          MALI_OFFSET_L2_RESOURCE1
+#define MALI450_OFFSET_L2_CACHE1          MALI_OFFSET_L2_RESOURCE0
+#define MALI450_OFFSET_L2_CACHE2          MALI_OFFSET_L2_RESOURCE2
+#define MALI470_OFFSET_L2_CACHE1          MALI_OFFSET_L2_RESOURCE0
+
+#define MALI_OFFSET_BCAST                 0x13000
+#define MALI_OFFSET_DLBU                  0x14000
+
+#define MALI_OFFSET_PP_BCAST              0x16000
+#define MALI_OFFSET_PP_BCAST_MMU          0x15000
+
+#define MALI_OFFSET_PMU                   0x02000
+#define MALI_OFFSET_DMA                   0x12000
+
+/* Mali-300 */
+
+#define MALI_GPU_RESOURCES_MALI300(base_addr, gp_irq, gp_mmu_irq, pp_irq, pp_mmu_irq) \
+	MALI_GPU_RESOURCES_MALI400_MP1(base_addr, gp_irq, gp_mmu_irq, pp_irq, pp_mmu_irq)
+
+#define MALI_GPU_RESOURCES_MALI300_PMU(base_addr, gp_irq, gp_mmu_irq, pp_irq, pp_mmu_irq) \
+	MALI_GPU_RESOURCES_MALI400_MP1_PMU(base_addr, gp_irq, gp_mmu_irq, pp_irq, pp_mmu_irq)
+
+/* Mali-400 */
+
+#define MALI_GPU_RESOURCES_MALI400_MP1(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI400_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq)
+
+#define MALI_GPU_RESOURCES_MALI400_MP1_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq) \
+	MALI_GPU_RESOURCES_MALI400_MP1(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU)
+
+#define MALI_GPU_RESOURCES_MALI400_MP2(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI400_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq)
+
+#define MALI_GPU_RESOURCES_MALI400_MP2_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq) \
+	MALI_GPU_RESOURCES_MALI400_MP2(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU)
+
+#define MALI_GPU_RESOURCES_MALI400_MP3(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI400_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq)
+
+#define MALI_GPU_RESOURCES_MALI400_MP3_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq) \
+	MALI_GPU_RESOURCES_MALI400_MP3(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU)
+
+#define MALI_GPU_RESOURCES_MALI400_MP4(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI400_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(3, base_addr + MALI_OFFSET_PP3, pp3_irq, base_addr + MALI_OFFSET_PP3_MMU, pp3_mmu_irq)
+
+#define MALI_GPU_RESOURCES_MALI400_MP4_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq) \
+	MALI_GPU_RESOURCES_MALI400_MP4(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+	/* Mali-450 */
+#define MALI_GPU_RESOURCES_MALI450_MP2(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU) \
+	MALI_GPU_RESOURCE_DMA(base_addr + MALI_OFFSET_DMA)
+
+#define MALI_GPU_RESOURCES_MALI450_MP2_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI450_MP2(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI450_MP3(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU)
+
+#define MALI_GPU_RESOURCES_MALI450_MP3_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI450_MP3(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI450_MP4(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(3, base_addr + MALI_OFFSET_PP3, pp3_irq, base_addr + MALI_OFFSET_PP3_MMU, pp3_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU) \
+	MALI_GPU_RESOURCE_DMA(base_addr + MALI_OFFSET_DMA)
+
+#define MALI_GPU_RESOURCES_MALI450_MP4_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI450_MP4(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI450_MP6(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp4_irq, pp4_mmu_irq, pp5_irq, pp5_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE2) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(3, base_addr + MALI_OFFSET_PP4, pp3_irq, base_addr + MALI_OFFSET_PP4_MMU, pp3_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(4, base_addr + MALI_OFFSET_PP5, pp4_irq, base_addr + MALI_OFFSET_PP5_MMU, pp4_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(5, base_addr + MALI_OFFSET_PP6, pp5_irq, base_addr + MALI_OFFSET_PP6_MMU, pp5_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU) \
+	MALI_GPU_RESOURCE_DMA(base_addr + MALI_OFFSET_DMA)
+
+#define MALI_GPU_RESOURCES_MALI450_MP6_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp4_irq, pp4_mmu_irq, pp5_irq, pp5_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI450_MP6(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp4_irq, pp4_mmu_irq, pp5_irq, pp5_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI450_MP8(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp4_irq, pp4_mmu_irq, pp5_irq, pp5_mmu_irq, pp6_irq, pp6_mmu_irq, pp7_irq, pp7_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE0) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(3, base_addr + MALI_OFFSET_PP3, pp3_irq, base_addr + MALI_OFFSET_PP3_MMU, pp3_mmu_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI450_OFFSET_L2_CACHE2) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(4, base_addr + MALI_OFFSET_PP4, pp4_irq, base_addr + MALI_OFFSET_PP4_MMU, pp4_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(5, base_addr + MALI_OFFSET_PP5, pp5_irq, base_addr + MALI_OFFSET_PP5_MMU, pp5_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(6, base_addr + MALI_OFFSET_PP6, pp6_irq, base_addr + MALI_OFFSET_PP6_MMU, pp6_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(7, base_addr + MALI_OFFSET_PP7, pp7_irq, base_addr + MALI_OFFSET_PP7_MMU, pp7_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU) \
+	MALI_GPU_RESOURCE_DMA(base_addr + MALI_OFFSET_DMA)
+
+#define MALI_GPU_RESOURCES_MALI450_MP8_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp4_irq, pp4_mmu_irq, pp5_irq, pp5_mmu_irq, pp6_irq, pp6_mmu_irq, pp7_irq, pp7_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI450_MP8(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp4_irq, pp4_mmu_irq, pp5_irq, pp5_mmu_irq, pp6_irq, pp6_mmu_irq, pp7_irq, pp7_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+	/* Mali - 470 */
+#define MALI_GPU_RESOURCES_MALI470_MP1(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI470_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU)
+
+#define MALI_GPU_RESOURCES_MALI470_MP1_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI470_MP1(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI470_MP2(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI470_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU)
+
+#define MALI_GPU_RESOURCES_MALI470_MP2_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI470_MP2(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI470_MP3(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI470_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU)
+
+#define MALI_GPU_RESOURCES_MALI470_MP3_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI470_MP3(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCES_MALI470_MP4(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_L2(base_addr + MALI470_OFFSET_L2_CACHE1) \
+	MALI_GPU_RESOURCE_GP_WITH_MMU(base_addr + MALI_OFFSET_GP, gp_irq, base_addr + MALI_OFFSET_GP_MMU, gp_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(0, base_addr + MALI_OFFSET_PP0, pp0_irq, base_addr + MALI_OFFSET_PP0_MMU, pp0_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(1, base_addr + MALI_OFFSET_PP1, pp1_irq, base_addr + MALI_OFFSET_PP1_MMU, pp1_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(2, base_addr + MALI_OFFSET_PP2, pp2_irq, base_addr + MALI_OFFSET_PP2_MMU, pp2_mmu_irq) \
+	MALI_GPU_RESOURCE_PP_WITH_MMU(3, base_addr + MALI_OFFSET_PP3, pp3_irq, base_addr + MALI_OFFSET_PP3_MMU, pp3_mmu_irq) \
+	MALI_GPU_RESOURCE_BCAST(base_addr + MALI_OFFSET_BCAST) \
+	MALI_GPU_RESOURCE_DLBU(base_addr + MALI_OFFSET_DLBU) \
+	MALI_GPU_RESOURCE_PP_BCAST(base_addr + MALI_OFFSET_PP_BCAST, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PP_MMU_BCAST(base_addr + MALI_OFFSET_PP_BCAST_MMU)
+
+#define MALI_GPU_RESOURCES_MALI470_MP4_PMU(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCES_MALI470_MP4(base_addr, gp_irq, gp_mmu_irq, pp0_irq, pp0_mmu_irq, pp1_irq, pp1_mmu_irq, pp2_irq, pp2_mmu_irq, pp3_irq, pp3_mmu_irq, pp_bcast_irq) \
+	MALI_GPU_RESOURCE_PMU(base_addr + MALI_OFFSET_PMU) \
+
+#define MALI_GPU_RESOURCE_L2(addr) \
+	{ \
+		.name = "Mali_L2", \
+			.flags = IORESOURCE_MEM, \
+				 .start = addr, \
+					  .end   = addr + 0x200, \
+	},
+
+#define MALI_GPU_RESOURCE_GP(gp_addr, gp_irq) \
+	{ \
+		.name = "Mali_GP", \
+			.flags = IORESOURCE_MEM, \
+				 .start = gp_addr, \
+					  .end =   gp_addr + 0x100, \
+	}, \
+	{ \
+		.name = "Mali_GP_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = gp_irq, \
+					  .end   = gp_irq, \
+	}, \
+
+#define MALI_GPU_RESOURCE_GP_WITH_MMU(gp_addr, gp_irq, gp_mmu_addr, gp_mmu_irq) \
+	{ \
+		.name = "Mali_GP", \
+			.flags = IORESOURCE_MEM, \
+				 .start = gp_addr, \
+					  .end =   gp_addr + 0x100, \
+	}, \
+	{ \
+		.name = "Mali_GP_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = gp_irq, \
+					  .end   = gp_irq, \
+	}, \
+	{ \
+		.name = "Mali_GP_MMU", \
+			.flags = IORESOURCE_MEM, \
+				 .start = gp_mmu_addr, \
+					  .end =   gp_mmu_addr + 0x100, \
+	}, \
+	{ \
+		.name = "Mali_GP_MMU_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = gp_mmu_irq, \
+					  .end =   gp_mmu_irq, \
+	},
+
+#define MALI_GPU_RESOURCE_PP(pp_addr, pp_irq) \
+	{ \
+		.name = "Mali_PP", \
+			.flags = IORESOURCE_MEM, \
+				 .start = pp_addr, \
+					  .end =   pp_addr + 0x1100, \
+	}, \
+	{ \
+		.name = "Mali_PP_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = pp_irq, \
+					  .end =   pp_irq, \
+	}, \
+
+#define MALI_GPU_RESOURCE_PP_WITH_MMU(id, pp_addr, pp_irq, pp_mmu_addr, pp_mmu_irq) \
+	{ \
+		.name = "Mali_PP" #id, \
+			.flags = IORESOURCE_MEM, \
+				 .start = pp_addr, \
+					  .end =   pp_addr + 0x1100, \
+	}, \
+	{ \
+		.name = "Mali_PP" #id "_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = pp_irq, \
+					  .end =   pp_irq, \
+	}, \
+	{ \
+		.name = "Mali_PP" #id "_MMU", \
+			.flags = IORESOURCE_MEM, \
+				 .start = pp_mmu_addr, \
+					  .end =   pp_mmu_addr + 0x100, \
+	}, \
+	{ \
+		.name = "Mali_PP" #id "_MMU_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = pp_mmu_irq, \
+					  .end =   pp_mmu_irq, \
+	},
+
+#define MALI_GPU_RESOURCE_MMU(mmu_addr, mmu_irq) \
+	{ \
+		.name = "Mali_MMU", \
+			.flags = IORESOURCE_MEM, \
+				 .start = mmu_addr, \
+					  .end =   mmu_addr + 0x100, \
+	}, \
+	{ \
+		.name = "Mali_MMU_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = mmu_irq, \
+					  .end =   mmu_irq, \
+	},
+
+#define MALI_GPU_RESOURCE_PMU(pmu_addr) \
+	{ \
+		.name = "Mali_PMU", \
+			.flags = IORESOURCE_MEM, \
+				 .start = pmu_addr, \
+					  .end =   pmu_addr + 0x100, \
+	},
+
+#define MALI_GPU_RESOURCE_DMA(dma_addr) \
+	{ \
+		.name = "Mali_DMA", \
+			.flags = IORESOURCE_MEM, \
+				 .start = dma_addr, \
+					  .end = dma_addr + 0x100, \
+	},
+
+#define MALI_GPU_RESOURCE_DLBU(dlbu_addr) \
+	{ \
+		.name = "Mali_DLBU", \
+			.flags = IORESOURCE_MEM, \
+				 .start = dlbu_addr, \
+					  .end = dlbu_addr + 0x100, \
+	},
+
+#define MALI_GPU_RESOURCE_BCAST(bcast_addr) \
+	{ \
+		.name = "Mali_Broadcast", \
+			.flags = IORESOURCE_MEM, \
+				 .start = bcast_addr, \
+					  .end = bcast_addr + 0x100, \
+	},
+
+#define MALI_GPU_RESOURCE_PP_BCAST(pp_addr, pp_irq) \
+	{ \
+		.name = "Mali_PP_Broadcast", \
+			.flags = IORESOURCE_MEM, \
+				 .start = pp_addr, \
+					  .end =   pp_addr + 0x1100, \
+	}, \
+	{ \
+		.name = "Mali_PP_Broadcast_IRQ", \
+			.flags = IORESOURCE_IRQ, \
+				 .start = pp_irq, \
+					  .end =   pp_irq, \
+	}, \
+
+#define MALI_GPU_RESOURCE_PP_MMU_BCAST(pp_mmu_bcast_addr) \
+	{ \
+		.name = "Mali_PP_MMU_Broadcast", \
+			.flags = IORESOURCE_MEM, \
+				 .start = pp_mmu_bcast_addr, \
+					  .end = pp_mmu_bcast_addr + 0x100, \
+	},
+
+	struct mali_gpu_utilization_data {
+		unsigned int utilization_gpu; /* Utilization for GP and all PP cores combined, 0 = no utilization, 256 = full utilization */
+		unsigned int utilization_gp;  /* Utilization for GP core only, 0 = no utilization, 256 = full utilization */
+		unsigned int utilization_pp;  /* Utilization for all PP cores combined, 0 = no utilization, 256 = full utilization */
+	};
+
+	struct mali_gpu_clk_item {
+		unsigned int clock; /* unit(MHz) */
+		unsigned int vol;
+	};
+
+	struct mali_gpu_clock {
+		struct mali_gpu_clk_item *item;
+		unsigned int num_of_steps;
+	};
+
+	struct device;
+	struct mali_gpu_device_data {
+		/* Shared GPU memory */
+		unsigned long shared_mem_size;
+
+		/*
+		 * Mali PMU switch delay.
+		 * Only needed if the power gates are connected to the PMU in a high fanout
+		 * network. This value is the number of Mali clock cycles it takes to
+		 * enable the power gates and turn on the power mesh.
+		 * This value will have no effect if a daisy chain implementation is used.
+		 */
+		u32 pmu_switch_delay;
+
+		/* Mali Dynamic power domain configuration in sequence from 0-11
+		 *  GP  PP0 PP1  PP2  PP3  PP4  PP5  PP6  PP7, L2$0 L2$1 L2$2
+		 */
+		u16 pmu_domain_config[12];
+
+		/* Dedicated GPU memory range (physical). */
+		unsigned long dedicated_mem_start;
+		unsigned long dedicated_mem_size;
+
+		/* Frame buffer memory to be accessible by Mali GPU (physical) */
+		unsigned long fb_start;
+		unsigned long fb_size;
+
+		/* Max runtime [ms] for jobs */
+		int max_job_runtime;
+
+		/* Report GPU utilization and related control in this interval (specified in ms) */
+		unsigned long control_interval;
+
+		/* Function that will receive periodic GPU utilization numbers */
+		void (*utilization_callback)(struct mali_gpu_utilization_data *data);
+
+		/* Fuction that platform callback for freq setting, needed when CONFIG_MALI_DVFS enabled */
+		int (*set_freq)(int setting_clock_step);
+		/* Function that platfrom report it's clock info which driver can set, needed when CONFIG_MALI_DVFS enabled */
+		void (*get_clock_info)(struct mali_gpu_clock **data);
+		/* Function that get the current clock info, needed when CONFIG_MALI_DVFS enabled */
+		int (*get_freq)(void);
+		/* Function that init the mali gpu secure mode */
+		int (*secure_mode_init)(void);
+		/* Function that deinit the mali gpu secure mode */
+		void (*secure_mode_deinit)(void);
+		/* Function that reset GPU and enable gpu secure mode */
+		int (*gpu_reset_and_secure_mode_enable)(void);
+		/* Function that Reset GPU and disable gpu secure mode */
+		int (*gpu_reset_and_secure_mode_disable)(void);
+		/* Function that platform specific suspend callback */
+		void (*platform_suspend)(struct device *dev);
+		/* Function that platform specific resume callback */
+		void (*platform_resume)(struct device *dev);
+		/* ipa related interface customer need register */
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+		struct devfreq_cooling_power *gpu_cooling_ops;
+#endif
+	};
+
+	/**
+	 * Pause the scheduling and power state changes of Mali device driver.
+	 * mali_dev_resume() must always be called as soon as possible after this function
+	 * in order to resume normal operation of the Mali driver.
+	 */
+	void mali_dev_pause(void);
+
+	/**
+	 * Resume scheduling and allow power changes in Mali device driver.
+	 * This must always be called after mali_dev_pause().
+	 */
+	void mali_dev_resume(void);
+
+	/** @brief Set the desired number of PP cores to use.
+	 *
+	 * The internal Mali PMU will be used, if present, to physically power off the PP cores.
+	 *
+	 * @param num_cores The number of desired cores
+	 * @return 0 on success, otherwise error. -EINVAL means an invalid number of cores was specified.
+	 */
+	int mali_perf_set_num_pp_cores(unsigned int num_cores);
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_ioctl.h b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_ioctl.h
--- a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_ioctl.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_ioctl.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+ * Class Path Exception
+ * Linking this library statically or dynamically with other modules is making a combined work based on this library.
+ * Thus, the terms and conditions of the GNU General Public License cover the whole combination.
+ * As a special exception, the copyright holders of this library give you permission to link this library with independent modules
+ * to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions
+ * of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify
+ * this library, you may extend this exception to your version of the library, but you are not obligated to do so.
+ * If you do not wish to do so, delete this exception statement from your version.
+ */
+
+#ifndef __MALI_UTGARD_IOCTL_H__
+#define __MALI_UTGARD_IOCTL_H__
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <linux/fs.h>       /* file system operations */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @file mali_kernel_ioctl.h
+ * Interface to the Linux device driver.
+ * This file describes the interface needed to use the Linux device driver.
+ * Its interface is designed to used by the HAL implementation through a thin arch layer.
+ */
+
+/**
+ * ioctl commands
+ */
+
+#define MALI_IOC_BASE           0x82
+#define MALI_IOC_CORE_BASE      (_MALI_UK_CORE_SUBSYSTEM      + MALI_IOC_BASE)
+#define MALI_IOC_MEMORY_BASE    (_MALI_UK_MEMORY_SUBSYSTEM    + MALI_IOC_BASE)
+#define MALI_IOC_PP_BASE        (_MALI_UK_PP_SUBSYSTEM        + MALI_IOC_BASE)
+#define MALI_IOC_GP_BASE        (_MALI_UK_GP_SUBSYSTEM        + MALI_IOC_BASE)
+#define MALI_IOC_PROFILING_BASE (_MALI_UK_PROFILING_SUBSYSTEM + MALI_IOC_BASE)
+#define MALI_IOC_VSYNC_BASE     (_MALI_UK_VSYNC_SUBSYSTEM + MALI_IOC_BASE)
+
+#define MALI_IOC_WAIT_FOR_NOTIFICATION      _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_WAIT_FOR_NOTIFICATION, _mali_uk_wait_for_notification_s)
+#define MALI_IOC_GET_API_VERSION            _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_GET_API_VERSION, u32)
+#define MALI_IOC_GET_API_VERSION_V2         _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_GET_API_VERSION, _mali_uk_get_api_version_v2_s)
+#define MALI_IOC_POST_NOTIFICATION          _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_POST_NOTIFICATION, _mali_uk_post_notification_s)
+#define MALI_IOC_GET_USER_SETTING           _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_GET_USER_SETTING, _mali_uk_get_user_setting_s)
+#define MALI_IOC_GET_USER_SETTINGS          _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_GET_USER_SETTINGS, _mali_uk_get_user_settings_s)
+#define MALI_IOC_REQUEST_HIGH_PRIORITY      _IOW (MALI_IOC_CORE_BASE, _MALI_UK_REQUEST_HIGH_PRIORITY, _mali_uk_request_high_priority_s)
+#define MALI_IOC_TIMELINE_GET_LATEST_POINT  _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_TIMELINE_GET_LATEST_POINT, _mali_uk_timeline_get_latest_point_s)
+#define MALI_IOC_TIMELINE_WAIT              _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_TIMELINE_WAIT, _mali_uk_timeline_wait_s)
+#define MALI_IOC_TIMELINE_CREATE_SYNC_FENCE _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_TIMELINE_CREATE_SYNC_FENCE, _mali_uk_timeline_create_sync_fence_s)
+#define MALI_IOC_SOFT_JOB_START             _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_SOFT_JOB_START, _mali_uk_soft_job_start_s)
+#define MALI_IOC_SOFT_JOB_SIGNAL            _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_SOFT_JOB_SIGNAL, _mali_uk_soft_job_signal_s)
+#define MALI_IOC_PENDING_SUBMIT             _IOWR(MALI_IOC_CORE_BASE, _MALI_UK_PENDING_SUBMIT, _mali_uk_pending_submit_s)
+
+#define MALI_IOC_MEM_ALLOC                  _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_ALLOC_MEM, _mali_uk_alloc_mem_s)
+#define MALI_IOC_MEM_FREE                   _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_FREE_MEM, _mali_uk_free_mem_s)
+#define MALI_IOC_MEM_BIND                   _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_BIND_MEM, _mali_uk_bind_mem_s)
+#define MALI_IOC_MEM_UNBIND                 _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_UNBIND_MEM, _mali_uk_unbind_mem_s)
+#define MALI_IOC_MEM_COW                    _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_COW_MEM, _mali_uk_cow_mem_s)
+#define MALI_IOC_MEM_COW_MODIFY_RANGE       _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_COW_MODIFY_RANGE, _mali_uk_cow_modify_range_s)
+#define MALI_IOC_MEM_RESIZE                 _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_RESIZE_MEM, _mali_uk_mem_resize_s)
+#define MALI_IOC_MEM_DMA_BUF_GET_SIZE       _IOR(MALI_IOC_MEMORY_BASE, _MALI_UK_DMA_BUF_GET_SIZE, _mali_uk_dma_buf_get_size_s)
+#define MALI_IOC_MEM_QUERY_MMU_PAGE_TABLE_DUMP_SIZE _IOR (MALI_IOC_MEMORY_BASE, _MALI_UK_QUERY_MMU_PAGE_TABLE_DUMP_SIZE, _mali_uk_query_mmu_page_table_dump_size_s)
+#define MALI_IOC_MEM_DUMP_MMU_PAGE_TABLE    _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_DUMP_MMU_PAGE_TABLE, _mali_uk_dump_mmu_page_table_s)
+#define MALI_IOC_MEM_WRITE_SAFE             _IOWR(MALI_IOC_MEMORY_BASE, _MALI_UK_MEM_WRITE_SAFE, _mali_uk_mem_write_safe_s)
+
+#define MALI_IOC_PP_START_JOB               _IOWR(MALI_IOC_PP_BASE, _MALI_UK_PP_START_JOB, _mali_uk_pp_start_job_s)
+#define MALI_IOC_PP_AND_GP_START_JOB        _IOWR(MALI_IOC_PP_BASE, _MALI_UK_PP_AND_GP_START_JOB, _mali_uk_pp_and_gp_start_job_s)
+#define MALI_IOC_PP_NUMBER_OF_CORES_GET     _IOR (MALI_IOC_PP_BASE, _MALI_UK_GET_PP_NUMBER_OF_CORES, _mali_uk_get_pp_number_of_cores_s)
+#define MALI_IOC_PP_CORE_VERSION_GET        _IOR (MALI_IOC_PP_BASE, _MALI_UK_GET_PP_CORE_VERSION, _mali_uk_get_pp_core_version_s)
+#define MALI_IOC_PP_DISABLE_WB              _IOW (MALI_IOC_PP_BASE, _MALI_UK_PP_DISABLE_WB, _mali_uk_pp_disable_wb_s)
+
+#define MALI_IOC_GP2_START_JOB              _IOWR(MALI_IOC_GP_BASE, _MALI_UK_GP_START_JOB, _mali_uk_gp_start_job_s)
+#define MALI_IOC_GP2_NUMBER_OF_CORES_GET    _IOR (MALI_IOC_GP_BASE, _MALI_UK_GET_GP_NUMBER_OF_CORES, _mali_uk_get_gp_number_of_cores_s)
+#define MALI_IOC_GP2_CORE_VERSION_GET       _IOR (MALI_IOC_GP_BASE, _MALI_UK_GET_GP_CORE_VERSION, _mali_uk_get_gp_core_version_s)
+#define MALI_IOC_GP2_SUSPEND_RESPONSE       _IOW (MALI_IOC_GP_BASE, _MALI_UK_GP_SUSPEND_RESPONSE,_mali_uk_gp_suspend_response_s)
+
+#define MALI_IOC_PROFILING_ADD_EVENT        _IOWR(MALI_IOC_PROFILING_BASE, _MALI_UK_PROFILING_ADD_EVENT, _mali_uk_profiling_add_event_s)
+#define MALI_IOC_PROFILING_REPORT_SW_COUNTERS  _IOW (MALI_IOC_PROFILING_BASE, _MALI_UK_PROFILING_REPORT_SW_COUNTERS, _mali_uk_sw_counters_report_s)
+#define MALI_IOC_PROFILING_MEMORY_USAGE_GET _IOR(MALI_IOC_PROFILING_BASE, _MALI_UK_PROFILING_MEMORY_USAGE_GET, _mali_uk_profiling_memory_usage_get_s)
+#define MALI_IOC_PROFILING_STREAM_FD_GET        _IOR(MALI_IOC_PROFILING_BASE, _MALI_UK_PROFILING_STREAM_FD_GET, _mali_uk_profiling_stream_fd_get_s)
+#define MALI_IOC_PROILING_CONTROL_SET   _IOR(MALI_IOC_PROFILING_BASE, _MALI_UK_PROFILING_CONTROL_SET, _mali_uk_profiling_control_set_s)
+
+#define MALI_IOC_VSYNC_EVENT_REPORT         _IOW (MALI_IOC_VSYNC_BASE, _MALI_UK_VSYNC_EVENT_REPORT, _mali_uk_vsync_event_report_s)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_UTGARD_IOCTL_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_events.h b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_events.h
--- a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_events.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_events.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+ * Class Path Exception
+ * Linking this library statically or dynamically with other modules is making a combined work based on this library.
+ * Thus, the terms and conditions of the GNU General Public License cover the whole combination.
+ * As a special exception, the copyright holders of this library give you permission to link this library with independent modules
+ * to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions
+ * of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify
+ * this library, you may extend this exception to your version of the library, but you are not obligated to do so.
+ * If you do not wish to do so, delete this exception statement from your version.
+ */
+
+#ifndef _MALI_UTGARD_PROFILING_EVENTS_H_
+#define _MALI_UTGARD_PROFILING_EVENTS_H_
+
+/*
+ * The event ID is a 32 bit value consisting of different fields
+ * reserved, 4 bits, for future use
+ * event type, 4 bits, cinstr_profiling_event_type_t
+ * event channel, 8 bits, the source of the event.
+ * event data, 16 bit field, data depending on event type
+ */
+
+/**
+ * Specifies what kind of event this is
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_TYPE_SINGLE  = 0 << 24,
+	MALI_PROFILING_EVENT_TYPE_START   = 1 << 24,
+	MALI_PROFILING_EVENT_TYPE_STOP    = 2 << 24,
+	MALI_PROFILING_EVENT_TYPE_SUSPEND = 3 << 24,
+	MALI_PROFILING_EVENT_TYPE_RESUME  = 4 << 24,
+} cinstr_profiling_event_type_t;
+
+
+/**
+ * Secifies the channel/source of the event
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_CHANNEL_SOFTWARE =  0 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_GP0      =  1 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP0      =  5 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP1      =  6 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP2      =  7 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP3      =  8 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP4      =  9 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP5      = 10 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP6      = 11 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_PP7      = 12 << 16,
+	MALI_PROFILING_EVENT_CHANNEL_GPU      = 21 << 16,
+} cinstr_profiling_event_channel_t;
+
+
+#define MALI_PROFILING_MAKE_EVENT_CHANNEL_GP(num) (((MALI_PROFILING_EVENT_CHANNEL_GP0 >> 16) + (num)) << 16)
+#define MALI_PROFILING_MAKE_EVENT_CHANNEL_PP(num) (((MALI_PROFILING_EVENT_CHANNEL_PP0 >> 16) + (num)) << 16)
+
+/**
+ * These events are applicable when the type MALI_PROFILING_EVENT_TYPE_SINGLE is used from software channel
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_NONE                  = 0,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_NEW_FRAME         = 1,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_FLUSH                 = 2,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_SWAP_BUFFERS      = 3,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_FB_EVENT              = 4,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_GP_ENQUEUE            = 5,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_PP_ENQUEUE            = 6,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_READBACK              = 7,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_WRITEBACK             = 8,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_ENTER_API_FUNC        = 10,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_LEAVE_API_FUNC        = 11,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_DISCARD_ATTACHMENTS   = 13,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_UMP_TRY_LOCK          = 53,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_UMP_LOCK              = 54,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_UMP_UNLOCK            = 55,
+	MALI_PROFILING_EVENT_REASON_SINGLE_LOCK_CONTENDED           = 56,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_MALI_FENCE_DUP    = 57,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_SET_PP_JOB_FENCE  = 58,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_WAIT_SYNC         = 59,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_CREATE_FENCE_SYNC = 60,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_CREATE_NATIVE_FENCE_SYNC = 61,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_FENCE_FLUSH       = 62,
+	MALI_PROFILING_EVENT_REASON_SINGLE_SW_EGL_FLUSH_SERVER_WAITS = 63,
+} cinstr_profiling_event_reason_single_sw_t;
+
+/**
+ * These events are applicable when the type MALI_PROFILING_EVENT_TYPE_START/STOP is used from software channel
+ * to inform whether the core is physical or virtual
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_REASON_START_STOP_HW_PHYSICAL  = 0,
+	MALI_PROFILING_EVENT_REASON_START_STOP_HW_VIRTUAL   = 1,
+} cinstr_profiling_event_reason_start_stop_hw_t;
+
+/**
+ * These events are applicable when the type MALI_PROFILING_EVENT_TYPE_START/STOP is used from software channel
+ */
+typedef enum {
+	/*MALI_PROFILING_EVENT_REASON_START_STOP_SW_NONE            = 0,*/
+	MALI_PROFILING_EVENT_REASON_START_STOP_SW_MALI            = 1,
+	MALI_PROFILING_EVENT_REASON_START_STOP_SW_CALLBACK_THREAD = 2,
+	MALI_PROFILING_EVENT_REASON_START_STOP_SW_WORKER_THREAD   = 3,
+	MALI_PROFILING_EVENT_REASON_START_STOP_SW_BOTTOM_HALF     = 4,
+	MALI_PROFILING_EVENT_REASON_START_STOP_SW_UPPER_HALF      = 5,
+} cinstr_profiling_event_reason_start_stop_sw_t;
+
+/**
+ * These events are applicable when the type MALI_PROFILING_EVENT_TYPE_SUSPEND/RESUME is used from software channel
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_NONE                     =  0, /* used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_PIPELINE_FULL            =  1, /* NOT used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_VSYNC                    = 26, /* used in some build configurations */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_FB_IFRAME_WAIT           = 27, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_FB_IFRAME_SYNC           = 28, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_VG_WAIT_FILTER_CLEANUP   = 29, /* used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_VG_WAIT_TEXTURE          = 30, /* used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_GLES_WAIT_MIPLEVEL       = 31, /* used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_GLES_WAIT_READPIXELS     = 32, /* used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_EGL_WAIT_SWAP_IMMEDIATE  = 33, /* NOT used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_ICS_QUEUE_BUFFER         = 34, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_ICS_DEQUEUE_BUFFER       = 35, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_UMP_LOCK                 = 36, /* Not currently used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_X11_GLOBAL_LOCK          = 37, /* Not currently used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_X11_SWAP                 = 38, /* Not currently used */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_MALI_EGL_IMAGE_SYNC_WAIT = 39, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_GP_JOB_HANDLING          = 40, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_PP_JOB_HANDLING          = 41, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_EGL_MALI_FENCE_MERGE     = 42, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_EGL_MALI_FENCE_DUP       = 43,
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_EGL_FLUSH_SERVER_WAITS   = 44,
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_EGL_WAIT_SYNC            = 45, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_FB_JOBS_WAIT             = 46, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_FB_NOFRAMES_WAIT         = 47, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_FB_NOJOBS_WAIT           = 48, /* USED */
+	MALI_PROFILING_EVENT_REASON_SUSPEND_RESUME_SW_SUBMIT_LIMITER_WAIT      = 49, /* USED */
+} cinstr_profiling_event_reason_suspend_resume_sw_t;
+
+/**
+ * These events are applicable when the type MALI_PROFILING_EVENT_TYPE_SINGLE is used from a HW channel (GPx+PPx)
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_REASON_SINGLE_HW_NONE          = 0,
+	MALI_PROFILING_EVENT_REASON_SINGLE_HW_INTERRUPT     = 1,
+	MALI_PROFILING_EVENT_REASON_SINGLE_HW_FLUSH         = 2,
+} cinstr_profiling_event_reason_single_hw_t;
+
+/**
+ * These events are applicable when the type MALI_PROFILING_EVENT_TYPE_SINGLE is used from the GPU channel
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_REASON_SINGLE_GPU_NONE              = 0,
+	MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE  = 1,
+	MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L20_COUNTERS      = 2,
+	MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L21_COUNTERS      = 3,
+	MALI_PROFILING_EVENT_REASON_SINGLE_GPU_L22_COUNTERS      = 4,
+} cinstr_profiling_event_reason_single_gpu_t;
+
+/**
+ * These values are applicable for the 3rd data parameter when
+ * the type MALI_PROFILING_EVENT_TYPE_START is used from the software channel
+ * with the MALI_PROFILING_EVENT_REASON_START_STOP_BOTTOM_HALF reason.
+ */
+typedef enum {
+	MALI_PROFILING_EVENT_DATA_CORE_GP0             =  1,
+	MALI_PROFILING_EVENT_DATA_CORE_PP0             =  5,
+	MALI_PROFILING_EVENT_DATA_CORE_PP1             =  6,
+	MALI_PROFILING_EVENT_DATA_CORE_PP2             =  7,
+	MALI_PROFILING_EVENT_DATA_CORE_PP3             =  8,
+	MALI_PROFILING_EVENT_DATA_CORE_PP4             =  9,
+	MALI_PROFILING_EVENT_DATA_CORE_PP5             = 10,
+	MALI_PROFILING_EVENT_DATA_CORE_PP6             = 11,
+	MALI_PROFILING_EVENT_DATA_CORE_PP7             = 12,
+	MALI_PROFILING_EVENT_DATA_CORE_GP0_MMU         = 22, /* GP0 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP0_MMU         = 26, /* PP0 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP1_MMU         = 27, /* PP1 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP2_MMU         = 28, /* PP2 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP3_MMU         = 29, /* PP3 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP4_MMU         = 30, /* PP4 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP5_MMU         = 31, /* PP5 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP6_MMU         = 32, /* PP6 + 21 */
+	MALI_PROFILING_EVENT_DATA_CORE_PP7_MMU         = 33, /* PP7 + 21 */
+
+} cinstr_profiling_event_data_core_t;
+
+#define MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP(num) (MALI_PROFILING_EVENT_DATA_CORE_GP0 + (num))
+#define MALI_PROFILING_MAKE_EVENT_DATA_CORE_GP_MMU(num) (MALI_PROFILING_EVENT_DATA_CORE_GP0_MMU + (num))
+#define MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP(num) (MALI_PROFILING_EVENT_DATA_CORE_PP0 + (num))
+#define MALI_PROFILING_MAKE_EVENT_DATA_CORE_PP_MMU(num) (MALI_PROFILING_EVENT_DATA_CORE_PP0_MMU + (num))
+
+
+#endif /*_MALI_UTGARD_PROFILING_EVENTS_H_*/
diff -ENwbur a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_gator_api.h b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_gator_api.h
--- a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_gator_api.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_profiling_gator_api.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,315 @@
+/*
+ * Copyright (C) 2013, 2015-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+ * Class Path Exception
+ * Linking this library statically or dynamically with other modules is making a combined work based on this library.
+ * Thus, the terms and conditions of the GNU General Public License cover the whole combination.
+ * As a special exception, the copyright holders of this library give you permission to link this library with independent modules
+ * to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions
+ * of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify
+ * this library, you may extend this exception to your version of the library, but you are not obligated to do so.
+ * If you do not wish to do so, delete this exception statement from your version.
+ */
+
+#ifndef __MALI_UTGARD_PROFILING_GATOR_API_H__
+#define __MALI_UTGARD_PROFILING_GATOR_API_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define MALI_PROFILING_API_VERSION 4
+
+#define MAX_NUM_L2_CACHE_CORES 3
+#define MAX_NUM_FP_CORES 8
+#define MAX_NUM_VP_CORES 1
+
+#define _MALI_SPCIAL_COUNTER_DESCRIPTIONS \
+	{                                           \
+		"Filmstrip_cnt0",                 \
+		"Frequency",       \
+		"Voltage",       \
+		"vertex",     \
+		"fragment",         \
+		"Total_alloc_pages",        \
+	};
+
+#define _MALI_MEM_COUTNER_DESCRIPTIONS \
+	{                                           \
+		"untyped_memory",                 \
+		"vertex_index_buffer",       \
+		"texture_buffer",       \
+		"varying_buffer",     \
+		"render_target",         \
+		"pbuffer_buffer",        \
+		"plbu_heap",            \
+		"pointer_array_buffer",             \
+		"slave_tilelist",          \
+		"untyped_gp_cmdlist",     \
+		"polygon_cmdlist",               \
+		"texture_descriptor",               \
+		"render_state_word",               \
+		"shader",               \
+		"stream_buffer",               \
+		"fragment_stack",               \
+		"uniform",               \
+		"untyped_frame_pool",               \
+		"untyped_surface",               \
+	};
+
+/** The list of events supported by the Mali DDK. */
+typedef enum {
+	/* Vertex processor activity */
+	ACTIVITY_VP_0 = 0,
+
+	/* Fragment processor activity */
+	ACTIVITY_FP_0,
+	ACTIVITY_FP_1,
+	ACTIVITY_FP_2,
+	ACTIVITY_FP_3,
+	ACTIVITY_FP_4,
+	ACTIVITY_FP_5,
+	ACTIVITY_FP_6,
+	ACTIVITY_FP_7,
+
+	/* L2 cache counters */
+	COUNTER_L2_0_C0,
+	COUNTER_L2_0_C1,
+	COUNTER_L2_1_C0,
+	COUNTER_L2_1_C1,
+	COUNTER_L2_2_C0,
+	COUNTER_L2_2_C1,
+
+	/* Vertex processor counters */
+	COUNTER_VP_0_C0,
+	COUNTER_VP_0_C1,
+
+	/* Fragment processor counters */
+	COUNTER_FP_0_C0,
+	COUNTER_FP_0_C1,
+	COUNTER_FP_1_C0,
+	COUNTER_FP_1_C1,
+	COUNTER_FP_2_C0,
+	COUNTER_FP_2_C1,
+	COUNTER_FP_3_C0,
+	COUNTER_FP_3_C1,
+	COUNTER_FP_4_C0,
+	COUNTER_FP_4_C1,
+	COUNTER_FP_5_C0,
+	COUNTER_FP_5_C1,
+	COUNTER_FP_6_C0,
+	COUNTER_FP_6_C1,
+	COUNTER_FP_7_C0,
+	COUNTER_FP_7_C1,
+
+	/*
+	 * If more hardware counters are added, the _mali_osk_hw_counter_table
+	 * below should also be updated.
+	 */
+
+	/* EGL software counters */
+	COUNTER_EGL_BLIT_TIME,
+
+	/* GLES software counters */
+	COUNTER_GLES_DRAW_ELEMENTS_CALLS,
+	COUNTER_GLES_DRAW_ELEMENTS_NUM_INDICES,
+	COUNTER_GLES_DRAW_ELEMENTS_NUM_TRANSFORMED,
+	COUNTER_GLES_DRAW_ARRAYS_CALLS,
+	COUNTER_GLES_DRAW_ARRAYS_NUM_TRANSFORMED,
+	COUNTER_GLES_DRAW_POINTS,
+	COUNTER_GLES_DRAW_LINES,
+	COUNTER_GLES_DRAW_LINE_LOOP,
+	COUNTER_GLES_DRAW_LINE_STRIP,
+	COUNTER_GLES_DRAW_TRIANGLES,
+	COUNTER_GLES_DRAW_TRIANGLE_STRIP,
+	COUNTER_GLES_DRAW_TRIANGLE_FAN,
+	COUNTER_GLES_NON_VBO_DATA_COPY_TIME,
+	COUNTER_GLES_UNIFORM_BYTES_COPIED_TO_MALI,
+	COUNTER_GLES_UPLOAD_TEXTURE_TIME,
+	COUNTER_GLES_UPLOAD_VBO_TIME,
+	COUNTER_GLES_NUM_FLUSHES,
+	COUNTER_GLES_NUM_VSHADERS_GENERATED,
+	COUNTER_GLES_NUM_FSHADERS_GENERATED,
+	COUNTER_GLES_VSHADER_GEN_TIME,
+	COUNTER_GLES_FSHADER_GEN_TIME,
+	COUNTER_GLES_INPUT_TRIANGLES,
+	COUNTER_GLES_VXCACHE_HIT,
+	COUNTER_GLES_VXCACHE_MISS,
+	COUNTER_GLES_VXCACHE_COLLISION,
+	COUNTER_GLES_CULLED_TRIANGLES,
+	COUNTER_GLES_CULLED_LINES,
+	COUNTER_GLES_BACKFACE_TRIANGLES,
+	COUNTER_GLES_GBCLIP_TRIANGLES,
+	COUNTER_GLES_GBCLIP_LINES,
+	COUNTER_GLES_TRIANGLES_DRAWN,
+	COUNTER_GLES_DRAWCALL_TIME,
+	COUNTER_GLES_TRIANGLES_COUNT,
+	COUNTER_GLES_INDEPENDENT_TRIANGLES_COUNT,
+	COUNTER_GLES_STRIP_TRIANGLES_COUNT,
+	COUNTER_GLES_FAN_TRIANGLES_COUNT,
+	COUNTER_GLES_LINES_COUNT,
+	COUNTER_GLES_INDEPENDENT_LINES_COUNT,
+	COUNTER_GLES_STRIP_LINES_COUNT,
+	COUNTER_GLES_LOOP_LINES_COUNT,
+
+	/* Special counter */
+
+	/* Framebuffer capture pseudo-counter */
+	COUNTER_FILMSTRIP,
+	COUNTER_FREQUENCY,
+	COUNTER_VOLTAGE,
+	COUNTER_VP_ACTIVITY,
+	COUNTER_FP_ACTIVITY,
+	COUNTER_TOTAL_ALLOC_PAGES,
+
+	/* Memory usage counter */
+	COUNTER_MEM_UNTYPED,
+	COUNTER_MEM_VB_IB,
+	COUNTER_MEM_TEXTURE,
+	COUNTER_MEM_VARYING,
+	COUNTER_MEM_RT,
+	COUNTER_MEM_PBUFFER,
+	/* memory usages for gp command */
+	COUNTER_MEM_PLBU_HEAP,
+	COUNTER_MEM_POINTER_ARRAY,
+	COUNTER_MEM_SLAVE_TILELIST,
+	COUNTER_MEM_UNTYPE_GP_CMDLIST,
+	/* memory usages for polygon list command */
+	COUNTER_MEM_POLYGON_CMDLIST,
+	/* memory usages for pp command */
+	COUNTER_MEM_TD,
+	COUNTER_MEM_RSW,
+	/* other memory usages */
+	COUNTER_MEM_SHADER,
+	COUNTER_MEM_STREAMS,
+	COUNTER_MEM_FRAGMENT_STACK,
+	COUNTER_MEM_UNIFORM,
+	/* Special mem usage, which is used for mem pool allocation */
+	COUNTER_MEM_UNTYPE_MEM_POOL,
+	COUNTER_MEM_UNTYPE_SURFACE,
+
+	NUMBER_OF_EVENTS
+} _mali_osk_counter_id;
+
+#define FIRST_ACTIVITY_EVENT    ACTIVITY_VP_0
+#define LAST_ACTIVITY_EVENT     ACTIVITY_FP_7
+
+#define FIRST_HW_COUNTER        COUNTER_L2_0_C0
+#define LAST_HW_COUNTER         COUNTER_FP_7_C1
+
+#define FIRST_SW_COUNTER        COUNTER_EGL_BLIT_TIME
+#define LAST_SW_COUNTER         COUNTER_GLES_LOOP_LINES_COUNT
+
+#define FIRST_SPECIAL_COUNTER   COUNTER_FILMSTRIP
+#define LAST_SPECIAL_COUNTER    COUNTER_TOTAL_ALLOC_PAGES
+
+#define FIRST_MEM_COUNTER               COUNTER_MEM_UNTYPED
+#define LAST_MEM_COUNTER                COUNTER_MEM_UNTYPE_SURFACE
+
+#define MALI_PROFILING_MEM_COUNTERS_NUM (LAST_MEM_COUNTER - FIRST_MEM_COUNTER + 1)
+#define MALI_PROFILING_SPECIAL_COUNTERS_NUM     (LAST_SPECIAL_COUNTER - FIRST_SPECIAL_COUNTER + 1)
+#define MALI_PROFILING_SW_COUNTERS_NUM  (LAST_SW_COUNTER - FIRST_SW_COUNTER + 1)
+
+/**
+ * Define the stream header type for porfiling stream.
+ */
+#define  STREAM_HEADER_FRAMEBUFFER 0x05         /* The stream packet header type for framebuffer dumping. */
+#define STREAM_HEADER_COUNTER_VALUE  0x09       /* The stream packet header type for hw/sw/memory counter sampling. */
+#define STREAM_HEADER_CORE_ACTIVITY 0x0a                /* The stream packet header type for activity counter sampling. */
+#define STREAM_HEADER_SIZE      5
+
+/**
+ * Define the packet header type of profiling control packet.
+ */
+#define PACKET_HEADER_ERROR            0x80             /* The response packet header type if error. */
+#define PACKET_HEADER_ACK              0x81             /* The response packet header type if OK. */
+#define PACKET_HEADER_COUNTERS_REQUEST 0x82             /* The control packet header type to request counter information from ddk. */
+#define PACKET_HEADER_COUNTERS_ACK         0x83         /* The response packet header type to send out counter information. */
+#define PACKET_HEADER_COUNTERS_ENABLE  0x84             /* The control packet header type to enable counters. */
+#define PACKET_HEADER_START_CAPTURE_VALUE            0x85               /* The control packet header type to start capture values. */
+
+#define PACKET_HEADER_SIZE      5
+
+/**
+ * Structure to pass performance counter data of a Mali core
+ */
+typedef struct _mali_profiling_core_counters {
+	u32 source0;
+	u32 value0;
+	u32 source1;
+	u32 value1;
+} _mali_profiling_core_counters;
+
+/**
+ * Structure to pass performance counter data of Mali L2 cache cores
+ */
+typedef struct _mali_profiling_l2_counter_values {
+	struct _mali_profiling_core_counters cores[MAX_NUM_L2_CACHE_CORES];
+} _mali_profiling_l2_counter_values;
+
+/**
+ * Structure to pass data defining Mali instance in use:
+ *
+ * mali_product_id - Mali product id
+ * mali_version_major - Mali version major number
+ * mali_version_minor - Mali version minor number
+ * num_of_l2_cores - number of L2 cache cores
+ * num_of_fp_cores - number of fragment processor cores
+ * num_of_vp_cores - number of vertex processor cores
+ */
+typedef struct _mali_profiling_mali_version {
+	u32 mali_product_id;
+	u32 mali_version_major;
+	u32 mali_version_minor;
+	u32 num_of_l2_cores;
+	u32 num_of_fp_cores;
+	u32 num_of_vp_cores;
+} _mali_profiling_mali_version;
+
+/**
+ * Structure to define the mali profiling counter struct.
+ */
+typedef struct mali_profiling_counter {
+	char counter_name[40];
+	u32 counter_id;
+	u32 counter_event;
+	u32 prev_counter_value;
+	u32 current_counter_value;
+	u32 key;
+	int enabled;
+} mali_profiling_counter;
+
+/*
+ * List of possible actions to be controlled by Streamline.
+ * The following numbers are used by gator to control the frame buffer dumping and s/w counter reporting.
+ * We cannot use the enums in mali_uk_types.h because they are unknown inside gator.
+ */
+#define FBDUMP_CONTROL_ENABLE (1)
+#define FBDUMP_CONTROL_RATE (2)
+#define SW_COUNTER_ENABLE (3)
+#define FBDUMP_CONTROL_RESIZE_FACTOR (4)
+#define MEM_COUNTER_ENABLE (5)
+#define ANNOTATE_PROFILING_ENABLE (6)
+
+void _mali_profiling_control(u32 action, u32 value);
+
+u32 _mali_profiling_get_l2_counters(_mali_profiling_l2_counter_values *values);
+
+int _mali_profiling_set_event(u32 counter_id, s32 event_id);
+
+u32 _mali_profiling_get_api_version(void);
+
+void _mali_profiling_get_mali_version(struct _mali_profiling_mali_version *values);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_UTGARD_PROFILING_GATOR_API_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_uk_types.h b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_uk_types.h
--- a/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_uk_types.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/include/linux/mali/mali_utgard_uk_types.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1100 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+ * Class Path Exception
+ * Linking this library statically or dynamically with other modules is making a combined work based on this library.
+ * Thus, the terms and conditions of the GNU General Public License cover the whole combination.
+ * As a special exception, the copyright holders of this library give you permission to link this library with independent modules
+ * to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting
+ * executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions
+ * of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify
+ * this library, you may extend this exception to your version of the library, but you are not obligated to do so.
+ * If you do not wish to do so, delete this exception statement from your version.
+ */
+
+/**
+ * @file mali_uk_types.h
+ * Defines the types and constants used in the user-kernel interface
+ */
+
+#ifndef __MALI_UTGARD_UK_TYPES_H__
+#define __MALI_UTGARD_UK_TYPES_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Iteration functions depend on these values being consecutive. */
+#define MALI_UK_TIMELINE_GP   0
+#define MALI_UK_TIMELINE_PP   1
+#define MALI_UK_TIMELINE_SOFT 2
+#define MALI_UK_TIMELINE_MAX  3
+
+#define MALI_UK_BIG_VARYING_SIZE  (1024*1024*2)
+
+typedef struct {
+	u32 points[MALI_UK_TIMELINE_MAX];
+	s32 sync_fd;
+} _mali_uk_fence_t;
+
+/**
+ * @addtogroup uddapi Unified Device Driver (UDD) APIs
+ *
+ * @{
+ */
+
+/**
+ * @addtogroup u_k_api UDD User/Kernel Interface (U/K) APIs
+ *
+ * @{
+ */
+
+/** @defgroup _mali_uk_core U/K Core
+ * @{ */
+
+/** Definition of subsystem numbers, to assist in creating a unique identifier
+ * for each U/K call.
+ *
+ * @see _mali_uk_functions */
+typedef enum {
+	_MALI_UK_CORE_SUBSYSTEM,      /**< Core Group of U/K calls */
+	_MALI_UK_MEMORY_SUBSYSTEM,    /**< Memory Group of U/K calls */
+	_MALI_UK_PP_SUBSYSTEM,        /**< Fragment Processor Group of U/K calls */
+	_MALI_UK_GP_SUBSYSTEM,        /**< Vertex Processor Group of U/K calls */
+	_MALI_UK_PROFILING_SUBSYSTEM, /**< Profiling Group of U/K calls */
+	_MALI_UK_VSYNC_SUBSYSTEM,     /**< VSYNC Group of U/K calls */
+} _mali_uk_subsystem_t;
+
+/** Within a function group each function has its unique sequence number
+ * to assist in creating a unique identifier for each U/K call.
+ *
+ * An ordered pair of numbers selected from
+ * ( \ref _mali_uk_subsystem_t,\ref  _mali_uk_functions) will uniquely identify the
+ * U/K call across all groups of functions, and all functions. */
+typedef enum {
+	/** Core functions */
+
+	_MALI_UK_OPEN                    = 0, /**< _mali_ukk_open() */
+	_MALI_UK_CLOSE,                       /**< _mali_ukk_close() */
+	_MALI_UK_WAIT_FOR_NOTIFICATION,       /**< _mali_ukk_wait_for_notification() */
+	_MALI_UK_GET_API_VERSION,             /**< _mali_ukk_get_api_version() */
+	_MALI_UK_POST_NOTIFICATION,           /**< _mali_ukk_post_notification() */
+	_MALI_UK_GET_USER_SETTING,            /**< _mali_ukk_get_user_setting() *//**< [out] */
+	_MALI_UK_GET_USER_SETTINGS,           /**< _mali_ukk_get_user_settings() *//**< [out] */
+	_MALI_UK_REQUEST_HIGH_PRIORITY,       /**< _mali_ukk_request_high_priority() */
+	_MALI_UK_TIMELINE_GET_LATEST_POINT,   /**< _mali_ukk_timeline_get_latest_point() */
+	_MALI_UK_TIMELINE_WAIT,               /**< _mali_ukk_timeline_wait() */
+	_MALI_UK_TIMELINE_CREATE_SYNC_FENCE,  /**< _mali_ukk_timeline_create_sync_fence() */
+	_MALI_UK_SOFT_JOB_START,              /**< _mali_ukk_soft_job_start() */
+	_MALI_UK_SOFT_JOB_SIGNAL,             /**< _mali_ukk_soft_job_signal() */
+	_MALI_UK_PENDING_SUBMIT,             /**< _mali_ukk_pending_submit() */
+
+	/** Memory functions */
+
+	_MALI_UK_ALLOC_MEM                = 0,   /**< _mali_ukk_alloc_mem() */
+	_MALI_UK_FREE_MEM,                       /**< _mali_ukk_free_mem() */
+	_MALI_UK_BIND_MEM,                       /**< _mali_ukk_mem_bind() */
+	_MALI_UK_UNBIND_MEM,                     /**< _mali_ukk_mem_unbind() */
+	_MALI_UK_COW_MEM,                        /**< _mali_ukk_mem_cow() */
+	_MALI_UK_COW_MODIFY_RANGE,               /**< _mali_ukk_mem_cow_modify_range() */
+	_MALI_UK_RESIZE_MEM,                     /**<._mali_ukk_mem_resize() */
+	_MALI_UK_QUERY_MMU_PAGE_TABLE_DUMP_SIZE, /**< _mali_ukk_mem_get_mmu_page_table_dump_size() */
+	_MALI_UK_DUMP_MMU_PAGE_TABLE,            /**< _mali_ukk_mem_dump_mmu_page_table() */
+	_MALI_UK_DMA_BUF_GET_SIZE,               /**< _mali_ukk_dma_buf_get_size() */
+	_MALI_UK_MEM_WRITE_SAFE,                 /**< _mali_uku_mem_write_safe() */
+
+	/** Common functions for each core */
+
+	_MALI_UK_START_JOB           = 0,     /**< Start a Fragment/Vertex Processor Job on a core */
+	_MALI_UK_GET_NUMBER_OF_CORES,         /**< Get the number of Fragment/Vertex Processor cores */
+	_MALI_UK_GET_CORE_VERSION,            /**< Get the Fragment/Vertex Processor version compatible with all cores */
+
+	/** Fragment Processor Functions  */
+
+	_MALI_UK_PP_START_JOB            = _MALI_UK_START_JOB,            /**< _mali_ukk_pp_start_job() */
+	_MALI_UK_GET_PP_NUMBER_OF_CORES  = _MALI_UK_GET_NUMBER_OF_CORES,  /**< _mali_ukk_get_pp_number_of_cores() */
+	_MALI_UK_GET_PP_CORE_VERSION     = _MALI_UK_GET_CORE_VERSION,     /**< _mali_ukk_get_pp_core_version() */
+	_MALI_UK_PP_DISABLE_WB,                                           /**< _mali_ukk_pp_job_disable_wb() */
+	_MALI_UK_PP_AND_GP_START_JOB,                                     /**< _mali_ukk_pp_and_gp_start_job() */
+
+	/** Vertex Processor Functions  */
+
+	_MALI_UK_GP_START_JOB            = _MALI_UK_START_JOB,            /**< _mali_ukk_gp_start_job() */
+	_MALI_UK_GET_GP_NUMBER_OF_CORES  = _MALI_UK_GET_NUMBER_OF_CORES,  /**< _mali_ukk_get_gp_number_of_cores() */
+	_MALI_UK_GET_GP_CORE_VERSION     = _MALI_UK_GET_CORE_VERSION,     /**< _mali_ukk_get_gp_core_version() */
+	_MALI_UK_GP_SUSPEND_RESPONSE,                                     /**< _mali_ukk_gp_suspend_response() */
+
+	/** Profiling functions */
+
+	_MALI_UK_PROFILING_ADD_EVENT     = 0, /**< __mali_uku_profiling_add_event() */
+	_MALI_UK_PROFILING_REPORT_SW_COUNTERS,/**< __mali_uku_profiling_report_sw_counters() */
+	_MALI_UK_PROFILING_MEMORY_USAGE_GET,  /**< __mali_uku_profiling_memory_usage_get() */
+	_MALI_UK_PROFILING_STREAM_FD_GET, /** < __mali_uku_profiling_stream_fd_get() */
+	_MALI_UK_PROFILING_CONTROL_SET, /** < __mali_uku_profiling_control_set() */
+
+	/** VSYNC reporting fuctions */
+	_MALI_UK_VSYNC_EVENT_REPORT      = 0, /**< _mali_ukk_vsync_event_report() */
+} _mali_uk_functions;
+
+/** @defgroup _mali_uk_getsysteminfo U/K Get System Info
+ * @{ */
+
+/**
+ * Type definition for the core version number.
+ * Used when returning the version number read from a core
+ *
+ * Its format is that of the 32-bit Version register for a particular core.
+ * Refer to the "Mali200 and MaliGP2 3D Graphics Processor Technical Reference
+ * Manual", ARM DDI 0415C, for more information.
+ */
+typedef u32 _mali_core_version;
+
+/** @} */ /* end group _mali_uk_core */
+
+
+/** @defgroup _mali_uk_gp U/K Vertex Processor
+ * @{ */
+
+/** @defgroup _mali_uk_gp_suspend_response_s Vertex Processor Suspend Response
+ * @{ */
+
+/** @brief Arguments for _mali_ukk_gp_suspend_response()
+ *
+ * When _mali_wait_for_notification() receives notification that a
+ * Vertex Processor job was suspended, you need to send a response to indicate
+ * what needs to happen with this job. You can either abort or resume the job.
+ *
+ * - set @c code to indicate response code. This is either @c _MALIGP_JOB_ABORT or
+ * @c _MALIGP_JOB_RESUME_WITH_NEW_HEAP to indicate you will provide a new heap
+ * for the job that will resolve the out of memory condition for the job.
+ * - copy the @c cookie value from the @c _mali_uk_gp_job_suspended_s notification;
+ * this is an identifier for the suspended job
+ * - set @c arguments[0] and @c arguments[1] to zero if you abort the job. If
+ * you resume it, @c argument[0] should specify the Mali start address for the new
+ * heap and @c argument[1] the Mali end address of the heap.
+ * - pass in the user-kernel context @c ctx that was returned from _mali_ukk_open()
+ *
+ */
+typedef enum _maligp_job_suspended_response_code {
+	_MALIGP_JOB_ABORT,                  /**< Abort the Vertex Processor job */
+	_MALIGP_JOB_RESUME_WITH_NEW_HEAP    /**< Resume the Vertex Processor job with a new heap */
+} _maligp_job_suspended_response_code;
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 cookie;                     /**< [in] cookie from the _mali_uk_gp_job_suspended_s notification */
+	_maligp_job_suspended_response_code code; /**< [in] abort or resume response code, see \ref _maligp_job_suspended_response_code */
+	u32 arguments[2];               /**< [in] 0 when aborting a job. When resuming a job, the Mali start and end address for a new heap to resume the job with */
+} _mali_uk_gp_suspend_response_s;
+
+/** @} */ /* end group _mali_uk_gp_suspend_response_s */
+
+/** @defgroup _mali_uk_gpstartjob_s Vertex Processor Start Job
+ * @{ */
+
+/** @brief Status indicating the result of the execution of a Vertex or Fragment processor job  */
+typedef enum {
+	_MALI_UK_JOB_STATUS_END_SUCCESS         = 1 << (16 + 0),
+	_MALI_UK_JOB_STATUS_END_OOM             = 1 << (16 + 1),
+	_MALI_UK_JOB_STATUS_END_ABORT           = 1 << (16 + 2),
+	_MALI_UK_JOB_STATUS_END_TIMEOUT_SW      = 1 << (16 + 3),
+	_MALI_UK_JOB_STATUS_END_HANG            = 1 << (16 + 4),
+	_MALI_UK_JOB_STATUS_END_SEG_FAULT       = 1 << (16 + 5),
+	_MALI_UK_JOB_STATUS_END_ILLEGAL_JOB     = 1 << (16 + 6),
+	_MALI_UK_JOB_STATUS_END_UNKNOWN_ERR     = 1 << (16 + 7),
+	_MALI_UK_JOB_STATUS_END_SHUTDOWN        = 1 << (16 + 8),
+	_MALI_UK_JOB_STATUS_END_SYSTEM_UNUSABLE = 1 << (16 + 9)
+} _mali_uk_job_status;
+
+#define MALIGP2_NUM_REGS_FRAME (6)
+
+/** @brief Arguments for _mali_ukk_gp_start_job()
+ *
+ * To start a Vertex Processor job
+ * - associate the request with a reference to a @c mali_gp_job_info by setting
+ * user_job_ptr to the address of the @c mali_gp_job_info of the job.
+ * - set @c priority to the priority of the @c mali_gp_job_info
+ * - specify a timeout for the job by setting @c watchdog_msecs to the number of
+ * milliseconds the job is allowed to run. Specifying a value of 0 selects the
+ * default timeout in use by the device driver.
+ * - copy the frame registers from the @c mali_gp_job_info into @c frame_registers.
+ * - set the @c perf_counter_flag, @c perf_counter_src0 and @c perf_counter_src1 to zero
+ * for a non-instrumented build. For an instrumented build you can use up
+ * to two performance counters. Set the corresponding bit in @c perf_counter_flag
+ * to enable them. @c perf_counter_src0 and @c perf_counter_src1 specify
+ * the source of what needs to get counted (e.g. number of vertex loader
+ * cache hits). For source id values, see ARM DDI0415A, Table 3-60.
+ * - pass in the user-kernel context @c ctx that was returned from _mali_ukk_open()
+ *
+ * When @c _mali_ukk_gp_start_job() returns @c _MALI_OSK_ERR_OK, status contains the
+ * result of the request (see \ref _mali_uk_start_job_status). If the job could
+ * not get started (@c _MALI_UK_START_JOB_NOT_STARTED_DO_REQUEUE) it should be
+ * tried again.
+ *
+ * After the job has started, @c _mali_wait_for_notification() will be notified
+ * that the job finished or got suspended. It may get suspended due to
+ * resource shortage. If it finished (see _mali_ukk_wait_for_notification())
+ * the notification will contain a @c _mali_uk_gp_job_finished_s result. If
+ * it got suspended the notification will contain a @c _mali_uk_gp_job_suspended_s
+ * result.
+ *
+ * The @c _mali_uk_gp_job_finished_s contains the job status (see \ref _mali_uk_job_status),
+ * the number of milliseconds the job took to render, and values of core registers
+ * when the job finished (irq status, performance counters, renderer list
+ * address). A job has finished succesfully when its status is
+ * @c _MALI_UK_JOB_STATUS_FINISHED. If the hardware detected a timeout while rendering
+ * the job, or software detected the job is taking more than watchdog_msecs to
+ * complete, the status will indicate @c _MALI_UK_JOB_STATUS_HANG.
+ * If the hardware detected a bus error while accessing memory associated with the
+ * job, status will indicate @c _MALI_UK_JOB_STATUS_SEG_FAULT.
+ * status will indicate @c _MALI_UK_JOB_STATUS_NOT_STARTED if the driver had to
+ * stop the job but the job didn't start on the hardware yet, e.g. when the
+ * driver shutdown.
+ *
+ * In case the job got suspended, @c _mali_uk_gp_job_suspended_s contains
+ * the @c user_job_ptr identifier used to start the job with, the @c reason
+ * why the job stalled (see \ref _maligp_job_suspended_reason) and a @c cookie
+ * to identify the core on which the job stalled.  This @c cookie will be needed
+ * when responding to this nofication by means of _mali_ukk_gp_suspend_response().
+ * (see _mali_ukk_gp_suspend_response()). The response is either to abort or
+ * resume the job. If the job got suspended due to an out of memory condition
+ * you may be able to resolve this by providing more memory and resuming the job.
+ *
+ */
+typedef struct {
+	u64 ctx;                          /**< [in,out] user-kernel context (trashed on output) */
+	u64 user_job_ptr;                   /**< [in] identifier for the job in user space, a @c mali_gp_job_info* */
+	u32 priority;                       /**< [in] job priority. A lower number means higher priority */
+	u32 frame_registers[MALIGP2_NUM_REGS_FRAME]; /**< [in] core specific registers associated with this job */
+	u32 perf_counter_flag;              /**< [in] bitmask indicating which performance counters to enable, see \ref _MALI_PERFORMANCE_COUNTER_FLAG_SRC0_ENABLE and related macro definitions */
+	u32 perf_counter_src0;              /**< [in] source id for performance counter 0 (see ARM DDI0415A, Table 3-60) */
+	u32 perf_counter_src1;              /**< [in] source id for performance counter 1 (see ARM DDI0415A, Table 3-60) */
+	u32 frame_builder_id;               /**< [in] id of the originating frame builder */
+	u32 flush_id;                       /**< [in] flush id within the originating frame builder */
+	_mali_uk_fence_t fence;             /**< [in] fence this job must wait on */
+	u64 timeline_point_ptr;            /**< [in,out] pointer to u32: location where point on gp timeline for this job will be written */
+	u32 varying_memsize;            /** < [in] size of varying memory to use deffer bind*/
+	u32 deferred_mem_num;
+	u64 deferred_mem_list;         /** < [in] memory hanlde list of varying buffer to use deffer bind */
+} _mali_uk_gp_start_job_s;
+
+#define _MALI_PERFORMANCE_COUNTER_FLAG_SRC0_ENABLE (1<<0) /**< Enable performance counter SRC0 for a job */
+#define _MALI_PERFORMANCE_COUNTER_FLAG_SRC1_ENABLE (1<<1) /**< Enable performance counter SRC1 for a job */
+#define _MALI_PERFORMANCE_COUNTER_FLAG_HEATMAP_ENABLE (1<<2) /**< Enable per tile (aka heatmap) generation with for a job (using the enabled counter sources) */
+
+/** @} */ /* end group _mali_uk_gpstartjob_s */
+
+typedef struct {
+	u64 user_job_ptr;               /**< [out] identifier for the job in user space */
+	_mali_uk_job_status status;     /**< [out] status of finished job */
+	u32 heap_current_addr;          /**< [out] value of the GP PLB PL heap start address register */
+	u32 perf_counter0;              /**< [out] value of performance counter 0 (see ARM DDI0415A) */
+	u32 perf_counter1;              /**< [out] value of performance counter 1 (see ARM DDI0415A) */
+	u32 pending_big_job_num;
+} _mali_uk_gp_job_finished_s;
+
+typedef struct {
+	u64 user_job_ptr;                    /**< [out] identifier for the job in user space */
+	u32 cookie;                          /**< [out] identifier for the core in kernel space on which the job stalled */
+} _mali_uk_gp_job_suspended_s;
+
+/** @} */ /* end group _mali_uk_gp */
+
+
+/** @defgroup _mali_uk_pp U/K Fragment Processor
+ * @{ */
+
+#define _MALI_PP_MAX_SUB_JOBS 8
+
+#define _MALI_PP_MAX_FRAME_REGISTERS ((0x058/4)+1)
+
+#define _MALI_PP_MAX_WB_REGISTERS ((0x02C/4)+1)
+
+#define _MALI_DLBU_MAX_REGISTERS 4
+
+/** Flag for _mali_uk_pp_start_job_s */
+#define _MALI_PP_JOB_FLAG_NO_NOTIFICATION (1<<0)
+#define _MALI_PP_JOB_FLAG_IS_WINDOW_SURFACE (1<<1)
+#define _MALI_PP_JOB_FLAG_PROTECTED (1<<2)
+
+/** @defgroup _mali_uk_ppstartjob_s Fragment Processor Start Job
+ * @{ */
+
+/** @brief Arguments for _mali_ukk_pp_start_job()
+ *
+ * To start a Fragment Processor job
+ * - associate the request with a reference to a mali_pp_job by setting
+ * @c user_job_ptr to the address of the @c mali_pp_job of the job.
+ * - set @c priority to the priority of the mali_pp_job
+ * - specify a timeout for the job by setting @c watchdog_msecs to the number of
+ * milliseconds the job is allowed to run. Specifying a value of 0 selects the
+ * default timeout in use by the device driver.
+ * - copy the frame registers from the @c mali_pp_job into @c frame_registers.
+ * For MALI200 you also need to copy the write back 0,1 and 2 registers.
+ * - set the @c perf_counter_flag, @c perf_counter_src0 and @c perf_counter_src1 to zero
+ * for a non-instrumented build. For an instrumented build you can use up
+ * to two performance counters. Set the corresponding bit in @c perf_counter_flag
+ * to enable them. @c perf_counter_src0 and @c perf_counter_src1 specify
+ * the source of what needs to get counted (e.g. number of vertex loader
+ * cache hits). For source id values, see ARM DDI0415A, Table 3-60.
+ * - pass in the user-kernel context in @c ctx that was returned from _mali_ukk_open()
+ *
+ * When _mali_ukk_pp_start_job() returns @c _MALI_OSK_ERR_OK, @c status contains the
+ * result of the request (see \ref _mali_uk_start_job_status). If the job could
+ * not get started (@c _MALI_UK_START_JOB_NOT_STARTED_DO_REQUEUE) it should be
+ * tried again.
+ *
+ * After the job has started, _mali_wait_for_notification() will be notified
+ * when the job finished. The notification will contain a
+ * @c _mali_uk_pp_job_finished_s result. It contains the @c user_job_ptr
+ * identifier used to start the job with, the job @c status (see \ref _mali_uk_job_status),
+ * the number of milliseconds the job took to render, and values of core registers
+ * when the job finished (irq status, performance counters, renderer list
+ * address). A job has finished succesfully when its status is
+ * @c _MALI_UK_JOB_STATUS_FINISHED. If the hardware detected a timeout while rendering
+ * the job, or software detected the job is taking more than @c watchdog_msecs to
+ * complete, the status will indicate @c _MALI_UK_JOB_STATUS_HANG.
+ * If the hardware detected a bus error while accessing memory associated with the
+ * job, status will indicate @c _MALI_UK_JOB_STATUS_SEG_FAULT.
+ * status will indicate @c _MALI_UK_JOB_STATUS_NOT_STARTED if the driver had to
+ * stop the job but the job didn't start on the hardware yet, e.g. when the
+ * driver shutdown.
+ *
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u64 user_job_ptr;               /**< [in] identifier for the job in user space */
+	u32 priority;                   /**< [in] job priority. A lower number means higher priority */
+	u32 frame_registers[_MALI_PP_MAX_FRAME_REGISTERS];         /**< [in] core specific registers associated with first sub job, see ARM DDI0415A */
+	u32 frame_registers_addr_frame[_MALI_PP_MAX_SUB_JOBS - 1]; /**< [in] ADDR_FRAME registers for sub job 1-7 */
+	u32 frame_registers_addr_stack[_MALI_PP_MAX_SUB_JOBS - 1]; /**< [in] ADDR_STACK registers for sub job 1-7 */
+	u32 wb0_registers[_MALI_PP_MAX_WB_REGISTERS];
+	u32 wb1_registers[_MALI_PP_MAX_WB_REGISTERS];
+	u32 wb2_registers[_MALI_PP_MAX_WB_REGISTERS];
+	u32 dlbu_registers[_MALI_DLBU_MAX_REGISTERS]; /**< [in] Dynamic load balancing unit registers */
+	u32 num_cores;                      /**< [in] Number of cores to set up (valid range: 1-8(M450) or 4(M400)) */
+	u32 perf_counter_flag;              /**< [in] bitmask indicating which performance counters to enable, see \ref _MALI_PERFORMANCE_COUNTER_FLAG_SRC0_ENABLE and related macro definitions */
+	u32 perf_counter_src0;              /**< [in] source id for performance counter 0 (see ARM DDI0415A, Table 3-60) */
+	u32 perf_counter_src1;              /**< [in] source id for performance counter 1 (see ARM DDI0415A, Table 3-60) */
+	u32 frame_builder_id;               /**< [in] id of the originating frame builder */
+	u32 flush_id;                       /**< [in] flush id within the originating frame builder */
+	u32 flags;                          /**< [in] See _MALI_PP_JOB_FLAG_* for a list of avaiable flags */
+	u32 tilesx;                         /**< [in] number of tiles in the x direction (needed for heatmap generation */
+	u32 tilesy;                         /**< [in] number of tiles in y direction (needed for reading the heatmap memory) */
+	u32 heatmap_mem;                    /**< [in] memory address to store counter values per tile (aka heatmap) */
+	u32 num_memory_cookies;             /**< [in] number of memory cookies attached to job */
+	u64 memory_cookies;               /**< [in] pointer to array of u32 memory cookies attached to job */
+	_mali_uk_fence_t fence;             /**< [in] fence this job must wait on */
+	u64 timeline_point_ptr;           /**< [in,out] pointer to location of u32 where point on pp timeline for this job will be written */
+} _mali_uk_pp_start_job_s;
+
+typedef struct {
+	u64 ctx;       /**< [in,out] user-kernel context (trashed on output) */
+	u64 gp_args;   /**< [in,out] GP uk arguments (see _mali_uk_gp_start_job_s) */
+	u64 pp_args;   /**< [in,out] PP uk arguments (see _mali_uk_pp_start_job_s) */
+} _mali_uk_pp_and_gp_start_job_s;
+
+/** @} */ /* end group _mali_uk_ppstartjob_s */
+
+typedef struct {
+	u64 user_job_ptr;                          /**< [out] identifier for the job in user space */
+	_mali_uk_job_status status;                /**< [out] status of finished job */
+	u32 perf_counter0[_MALI_PP_MAX_SUB_JOBS];  /**< [out] value of perfomance counter 0 (see ARM DDI0415A), one for each sub job */
+	u32 perf_counter1[_MALI_PP_MAX_SUB_JOBS];  /**< [out] value of perfomance counter 1 (see ARM DDI0415A), one for each sub job */
+	u32 perf_counter_src0;
+	u32 perf_counter_src1;
+} _mali_uk_pp_job_finished_s;
+
+typedef struct {
+	u32 number_of_enabled_cores;               /**< [out] the new number of enabled cores */
+} _mali_uk_pp_num_cores_changed_s;
+
+
+
+/**
+ * Flags to indicate write-back units
+ */
+typedef enum {
+	_MALI_UK_PP_JOB_WB0 = 1,
+	_MALI_UK_PP_JOB_WB1 = 2,
+	_MALI_UK_PP_JOB_WB2 = 4,
+} _mali_uk_pp_job_wbx_flag;
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 fb_id;                      /**< [in] Frame builder ID of job to disable WB units for */
+	u32 wb0_memory;
+	u32 wb1_memory;
+	u32 wb2_memory;
+} _mali_uk_pp_disable_wb_s;
+
+
+/** @} */ /* end group _mali_uk_pp */
+
+/** @defgroup _mali_uk_soft_job U/K Soft Job
+ * @{ */
+
+typedef struct {
+	u64 ctx;                            /**< [in,out] user-kernel context (trashed on output) */
+	u64 user_job;                       /**< [in] identifier for the job in user space */
+	u64 job_id_ptr;                     /**< [in,out] pointer to location of u32 where job id will be written */
+	_mali_uk_fence_t fence;             /**< [in] fence this job must wait on */
+	u32 point;                          /**< [out] point on soft timeline for this job */
+	u32 type;                           /**< [in] type of soft job */
+} _mali_uk_soft_job_start_s;
+
+typedef struct {
+	u64 user_job;                       /**< [out] identifier for the job in user space */
+} _mali_uk_soft_job_activated_s;
+
+typedef struct {
+	u64 ctx;                          /**< [in,out] user-kernel context (trashed on output) */
+	u32 job_id;                         /**< [in] id for soft job */
+} _mali_uk_soft_job_signal_s;
+
+/** @} */ /* end group _mali_uk_soft_job */
+
+typedef struct {
+	u32 counter_id;
+	u32 key;
+	int enable;
+} _mali_uk_annotate_profiling_mem_counter_s;
+
+typedef struct {
+	u32 sampling_rate;
+	int enable;
+} _mali_uk_annotate_profiling_enable_s;
+
+
+/** @addtogroup _mali_uk_core U/K Core
+ * @{ */
+
+/** @defgroup _mali_uk_waitfornotification_s Wait For Notification
+ * @{ */
+
+/** @brief Notification type encodings
+ *
+ * Each Notification type is an ordered pair of (subsystem,id), and is unique.
+ *
+ * The encoding of subsystem,id into a 32-bit word is:
+ * encoding = (( subsystem << _MALI_NOTIFICATION_SUBSYSTEM_SHIFT ) & _MALI_NOTIFICATION_SUBSYSTEM_MASK)
+ *            | (( id <<  _MALI_NOTIFICATION_ID_SHIFT ) & _MALI_NOTIFICATION_ID_MASK)
+ *
+ * @see _mali_uk_wait_for_notification_s
+ */
+typedef enum {
+	/** core notifications */
+
+	_MALI_NOTIFICATION_CORE_SHUTDOWN_IN_PROGRESS = (_MALI_UK_CORE_SUBSYSTEM << 16) | 0x20,
+	_MALI_NOTIFICATION_APPLICATION_QUIT = (_MALI_UK_CORE_SUBSYSTEM << 16) | 0x40,
+	_MALI_NOTIFICATION_SETTINGS_CHANGED = (_MALI_UK_CORE_SUBSYSTEM << 16) | 0x80,
+	_MALI_NOTIFICATION_SOFT_ACTIVATED = (_MALI_UK_CORE_SUBSYSTEM << 16) | 0x100,
+
+	/** Fragment Processor notifications */
+
+	_MALI_NOTIFICATION_PP_FINISHED = (_MALI_UK_PP_SUBSYSTEM << 16) | 0x10,
+	_MALI_NOTIFICATION_PP_NUM_CORE_CHANGE = (_MALI_UK_PP_SUBSYSTEM << 16) | 0x20,
+
+	/** Vertex Processor notifications */
+
+	_MALI_NOTIFICATION_GP_FINISHED = (_MALI_UK_GP_SUBSYSTEM << 16) | 0x10,
+	_MALI_NOTIFICATION_GP_STALLED = (_MALI_UK_GP_SUBSYSTEM << 16) | 0x20,
+
+	/** Profiling notifications */
+	_MALI_NOTIFICATION_ANNOTATE_PROFILING_MEM_COUNTER = (_MALI_UK_PROFILING_SUBSYSTEM << 16) | 0x10,
+	_MALI_NOTIFICATION_ANNOTATE_PROFILING_ENABLE = (_MALI_UK_PROFILING_SUBSYSTEM << 16) | 0x20,
+} _mali_uk_notification_type;
+
+/** to assist in splitting up 32-bit notification value in subsystem and id value */
+#define _MALI_NOTIFICATION_SUBSYSTEM_MASK 0xFFFF0000
+#define _MALI_NOTIFICATION_SUBSYSTEM_SHIFT 16
+#define _MALI_NOTIFICATION_ID_MASK 0x0000FFFF
+#define _MALI_NOTIFICATION_ID_SHIFT 0
+
+
+/** @brief Enumeration of possible settings which match mali_setting_t in user space
+ *
+ *
+ */
+typedef enum {
+	_MALI_UK_USER_SETTING_SW_EVENTS_ENABLE = 0,
+	_MALI_UK_USER_SETTING_COLORBUFFER_CAPTURE_ENABLED,
+	_MALI_UK_USER_SETTING_DEPTHBUFFER_CAPTURE_ENABLED,
+	_MALI_UK_USER_SETTING_STENCILBUFFER_CAPTURE_ENABLED,
+	_MALI_UK_USER_SETTING_PER_TILE_COUNTERS_CAPTURE_ENABLED,
+	_MALI_UK_USER_SETTING_BUFFER_CAPTURE_COMPOSITOR,
+	_MALI_UK_USER_SETTING_BUFFER_CAPTURE_WINDOW,
+	_MALI_UK_USER_SETTING_BUFFER_CAPTURE_OTHER,
+	_MALI_UK_USER_SETTING_BUFFER_CAPTURE_N_FRAMES,
+	_MALI_UK_USER_SETTING_BUFFER_CAPTURE_RESIZE_FACTOR,
+	_MALI_UK_USER_SETTING_SW_COUNTER_ENABLED,
+	_MALI_UK_USER_SETTING_MAX,
+} _mali_uk_user_setting_t;
+
+/* See mali_user_settings_db.c */
+extern const char *_mali_uk_user_setting_descriptions[];
+#define _MALI_UK_USER_SETTING_DESCRIPTIONS \
+	{                                           \
+		"sw_events_enable",                 \
+		"colorbuffer_capture_enable",       \
+		"depthbuffer_capture_enable",       \
+		"stencilbuffer_capture_enable",     \
+		"per_tile_counters_enable",         \
+		"buffer_capture_compositor",        \
+		"buffer_capture_window",            \
+		"buffer_capture_other",             \
+		"buffer_capture_n_frames",          \
+		"buffer_capture_resize_factor",     \
+		"sw_counters_enable",               \
+	};
+
+/** @brief struct to hold the value to a particular setting as seen in the kernel space
+ */
+typedef struct {
+	_mali_uk_user_setting_t setting;
+	u32 value;
+} _mali_uk_settings_changed_s;
+
+/** @brief Arguments for _mali_ukk_wait_for_notification()
+ *
+ * On successful return from _mali_ukk_wait_for_notification(), the members of
+ * this structure will indicate the reason for notification.
+ *
+ * Specifically, the source of the notification can be identified by the
+ * subsystem and id fields of the mali_uk_notification_type in the code.type
+ * member. The type member is encoded in a way to divide up the types into a
+ * subsystem field, and a per-subsystem ID field. See
+ * _mali_uk_notification_type for more information.
+ *
+ * Interpreting the data union member depends on the notification type:
+ *
+ * - type == _MALI_NOTIFICATION_CORE_SHUTDOWN_IN_PROGRESS
+ *     - The kernel side is shutting down. No further
+ * _mali_uk_wait_for_notification() calls should be made.
+ *     - In this case, the value of the data union member is undefined.
+ *     - This is used to indicate to the user space client that it should close
+ * the connection to the Mali Device Driver.
+ * - type == _MALI_NOTIFICATION_PP_FINISHED
+ *    - The notification data is of type _mali_uk_pp_job_finished_s. It contains the user_job_ptr
+ * identifier used to start the job with, the job status, the number of milliseconds the job took to render,
+ * and values of core registers when the job finished (irq status, performance counters, renderer list
+ * address).
+ *    - A job has finished succesfully when its status member is _MALI_UK_JOB_STATUS_FINISHED.
+ *    - If the hardware detected a timeout while rendering the job, or software detected the job is
+ * taking more than watchdog_msecs (see _mali_ukk_pp_start_job()) to complete, the status member will
+ * indicate _MALI_UK_JOB_STATUS_HANG.
+ *    - If the hardware detected a bus error while accessing memory associated with the job, status will
+ * indicate _MALI_UK_JOB_STATUS_SEG_FAULT.
+ *    - Status will indicate MALI_UK_JOB_STATUS_NOT_STARTED if the driver had to stop the job but the job
+ * didn't start the hardware yet, e.g. when the driver closes.
+ * - type == _MALI_NOTIFICATION_GP_FINISHED
+ *     - The notification data is of type _mali_uk_gp_job_finished_s. The notification is similar to that of
+ * type == _MALI_NOTIFICATION_PP_FINISHED, except that several other GP core register values are returned.
+ * The status values have the same meaning for type == _MALI_NOTIFICATION_PP_FINISHED.
+ * - type == _MALI_NOTIFICATION_GP_STALLED
+ *     - The nofication data is of type _mali_uk_gp_job_suspended_s. It contains the user_job_ptr
+ * identifier used to start the job with, the reason why the job stalled and a cookie to identify the core on
+ * which the job stalled.
+ *     - The reason member of gp_job_suspended is set to _MALIGP_JOB_SUSPENDED_OUT_OF_MEMORY
+ * when the polygon list builder unit has run out of memory.
+ */
+typedef struct {
+	u64 ctx;                       /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_notification_type type; /**< [out] Type of notification available */
+	union {
+		_mali_uk_gp_job_suspended_s gp_job_suspended;/**< [out] Notification data for _MALI_NOTIFICATION_GP_STALLED notification type */
+		_mali_uk_gp_job_finished_s  gp_job_finished; /**< [out] Notification data for _MALI_NOTIFICATION_GP_FINISHED notification type */
+		_mali_uk_pp_job_finished_s  pp_job_finished; /**< [out] Notification data for _MALI_NOTIFICATION_PP_FINISHED notification type */
+		_mali_uk_settings_changed_s setting_changed;/**< [out] Notification data for _MALI_NOTIFICAATION_SETTINGS_CHANGED notification type */
+		_mali_uk_soft_job_activated_s soft_job_activated; /**< [out] Notification data for _MALI_NOTIFICATION_SOFT_ACTIVATED notification type */
+		_mali_uk_annotate_profiling_mem_counter_s profiling_mem_counter;
+		_mali_uk_annotate_profiling_enable_s profiling_enable;
+	} data;
+} _mali_uk_wait_for_notification_s;
+
+/** @brief Arguments for _mali_ukk_post_notification()
+ *
+ * Posts the specified notification to the notification queue for this application.
+ * This is used to send a quit message to the callback thread.
+ */
+typedef struct {
+	u64 ctx;                       /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_notification_type type; /**< [in] Type of notification to post */
+} _mali_uk_post_notification_s;
+
+/** @} */ /* end group _mali_uk_waitfornotification_s */
+
+/** @defgroup _mali_uk_getapiversion_s Get API Version
+ * @{ */
+
+/** helpers for Device Driver API version handling */
+
+/** @brief Encode a version ID from a 16-bit input
+ *
+ * @note the input is assumed to be 16 bits. It must not exceed 16 bits. */
+#define _MAKE_VERSION_ID(x) (((x) << 16UL) | (x))
+
+/** @brief Check whether a 32-bit value is likely to be Device Driver API
+ * version ID. */
+#define _IS_VERSION_ID(x) (((x) & 0xFFFF) == (((x) >> 16UL) & 0xFFFF))
+
+/** @brief Decode a 16-bit version number from a 32-bit Device Driver API version
+ * ID */
+#define _GET_VERSION(x) (((x) >> 16UL) & 0xFFFF)
+
+/** @brief Determine whether two 32-bit encoded version IDs match */
+#define _IS_API_MATCH(x, y) (IS_VERSION_ID((x)) && IS_VERSION_ID((y)) && (GET_VERSION((x)) == GET_VERSION((y))))
+
+/**
+ * API version define.
+ * Indicates the version of the kernel API
+ * The version is a 16bit integer incremented on each API change.
+ * The 16bit integer is stored twice in a 32bit integer
+ * For example, for version 1 the value would be 0x00010001
+ */
+#define _MALI_API_VERSION 900
+#define _MALI_UK_API_VERSION _MAKE_VERSION_ID(_MALI_API_VERSION)
+
+/**
+ * The API version is a 16-bit integer stored in both the lower and upper 16-bits
+ * of a 32-bit value. The 16-bit API version value is incremented on each API
+ * change. Version 1 would be 0x00010001. Used in _mali_uk_get_api_version_s.
+ */
+typedef u32 _mali_uk_api_version;
+
+/** @brief Arguments for _mali_uk_get_api_version()
+ *
+ * The user-side interface version must be written into the version member,
+ * encoded using _MAKE_VERSION_ID(). It will be compared to the API version of
+ * the kernel-side interface.
+ *
+ * On successful return, the version member will be the API version of the
+ * kernel-side interface. _MALI_UK_API_VERSION macro defines the current version
+ * of the API.
+ *
+ * The compatible member must be checked to see if the version of the user-side
+ * interface is compatible with the kernel-side interface, since future versions
+ * of the interface may be backwards compatible.
+ */
+typedef struct {
+	u32 ctx;                        /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_api_version version;   /**< [in,out] API version of user-side interface. */
+	int compatible;                 /**< [out] @c 1 when @version is compatible, @c 0 otherwise */
+} _mali_uk_get_api_version_s;
+
+/** @brief Arguments for _mali_uk_get_api_version_v2()
+ *
+ * The user-side interface version must be written into the version member,
+ * encoded using _MAKE_VERSION_ID(). It will be compared to the API version of
+ * the kernel-side interface.
+ *
+ * On successful return, the version member will be the API version of the
+ * kernel-side interface. _MALI_UK_API_VERSION macro defines the current version
+ * of the API.
+ *
+ * The compatible member must be checked to see if the version of the user-side
+ * interface is compatible with the kernel-side interface, since future versions
+ * of the interface may be backwards compatible.
+ */
+typedef struct {
+	u64 ctx;                        /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_api_version version;   /**< [in,out] API version of user-side interface. */
+	int compatible;                 /**< [out] @c 1 when @version is compatible, @c 0 otherwise */
+} _mali_uk_get_api_version_v2_s;
+
+/** @} */ /* end group _mali_uk_getapiversion_s */
+
+/** @defgroup _mali_uk_get_user_settings_s Get user space settings */
+
+/** @brief struct to keep the matching values of the user space settings within certain context
+ *
+ * Each member of the settings array corresponds to a matching setting in the user space and its value is the value
+ * of that particular setting.
+ *
+ * All settings are given reference to the context pointed to by the ctx pointer.
+ *
+ */
+typedef struct {
+	u64 ctx;                       /**< [in,out] user-kernel context (trashed on output) */
+	u32 settings[_MALI_UK_USER_SETTING_MAX]; /**< [out] The values for all settings */
+} _mali_uk_get_user_settings_s;
+
+/** @brief struct to hold the value of a particular setting from the user space within a given context
+ */
+typedef struct {
+	u64 ctx;                       /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_user_setting_t setting; /**< [in] setting to get */
+	u32 value;                       /**< [out] value of setting */
+} _mali_uk_get_user_setting_s;
+
+/** @brief Arguments for _mali_ukk_request_high_priority() */
+typedef struct {
+	u64 ctx;                       /**< [in,out] user-kernel context (trashed on output) */
+} _mali_uk_request_high_priority_s;
+
+/** @brief Arguments for _mali_ukk_pending_submit() */
+typedef struct {
+	u64 ctx;                       /**< [in,out] user-kernel context (trashed on output) */
+} _mali_uk_pending_submit_s;
+
+/** @} */ /* end group _mali_uk_core */
+
+
+/** @defgroup _mali_uk_memory U/K Memory
+ * @{ */
+
+#define _MALI_MEMORY_ALLOCATE_RESIZEABLE  (1<<4) /* BUFFER can trim dow/grow*/
+#define _MALI_MEMORY_ALLOCATE_NO_BIND_GPU (1<<5) /*Not map to GPU when allocate, must call bind later*/
+#define _MALI_MEMORY_ALLOCATE_SWAPPABLE   (1<<6) /* Allocate swappale memory. */
+#define _MALI_MEMORY_ALLOCATE_DEFER_BIND (1<<7) /*Not map to GPU when allocate, must call bind later*/
+#define _MALI_MEMORY_ALLOCATE_SECURE (1<<8) /* Allocate secure memory. */
+
+
+typedef struct {
+	u64 ctx;                                          /**< [in,out] user-kernel context (trashed on output) */
+	u32 gpu_vaddr;                                    /**< [in] GPU virtual address */
+	u32 vsize;                                        /**< [in] vitrual size of the allocation */
+	u32 psize;                                        /**< [in] physical size of the allocation */
+	u32 flags;
+	u64 backend_handle;                               /**< [out] backend handle */
+	s32 secure_shared_fd;                           /** < [in] the mem handle for secure mem */
+} _mali_uk_alloc_mem_s;
+
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 gpu_vaddr;                /**< [in] use as handle to free allocation */
+	u32 free_pages_nr;      /** < [out] record the number of free pages */
+} _mali_uk_free_mem_s;
+
+
+#define _MALI_MEMORY_BIND_BACKEND_UMP             (1<<8)
+#define _MALI_MEMORY_BIND_BACKEND_DMA_BUF         (1<<9)
+#define _MALI_MEMORY_BIND_BACKEND_MALI_MEMORY     (1<<10)
+#define _MALI_MEMORY_BIND_BACKEND_EXTERNAL_MEMORY (1<<11)
+#define _MALI_MEMORY_BIND_BACKEND_EXT_COW         (1<<12)
+#define _MALI_MEMORY_BIND_BACKEND_HAVE_ALLOCATION (1<<13)
+
+
+#define _MALI_MEMORY_BIND_BACKEND_MASK (_MALI_MEMORY_BIND_BACKEND_UMP| \
+					_MALI_MEMORY_BIND_BACKEND_DMA_BUF |\
+					_MALI_MEMORY_BIND_BACKEND_MALI_MEMORY |\
+					_MALI_MEMORY_BIND_BACKEND_EXTERNAL_MEMORY |\
+					_MALI_MEMORY_BIND_BACKEND_EXT_COW |\
+					_MALI_MEMORY_BIND_BACKEND_HAVE_ALLOCATION)
+
+
+#define _MALI_MEMORY_GPU_READ_ALLOCATE            (1<<16)
+
+
+typedef struct {
+	u64 ctx;                                        /**< [in,out] user-kernel context (trashed on output) */
+	u32 vaddr;                                      /**< [in] mali address to map the physical memory to */
+	u32 size;                                       /**< [in] size */
+	u32 flags;                                      /**< [in] see_MALI_MEMORY_BIND_BACKEND_* */
+	u32 padding;                                    /** padding for 32/64 struct alignment */
+	union {
+		struct {
+			u32 secure_id;                  /**< [in] secure id */
+			u32 rights;                     /**< [in] rights necessary for accessing memory */
+			u32 flags;                      /**< [in] flags, see \ref _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE */
+		} bind_ump;
+		struct {
+			u32 mem_fd;                     /**< [in] Memory descriptor */
+			u32 rights;                     /**< [in] rights necessary for accessing memory */
+			u32 flags;                      /**< [in] flags, see \ref _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE */
+		} bind_dma_buf;
+		struct {
+			u32 phys_addr;                  /**< [in] physical address */
+			u32 rights;                     /**< [in] rights necessary for accessing memory */
+			u32 flags;                      /**< [in] flags, see \ref _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE */
+		} bind_ext_memory;
+	} mem_union;
+} _mali_uk_bind_mem_s;
+
+typedef struct {
+	u64 ctx;                                        /**< [in,out] user-kernel context (trashed on output) */
+	u32 flags;                                      /**< [in] see_MALI_MEMORY_BIND_BACKEND_* */
+	u32 vaddr;                                      /**<  [in] identifier for mapped memory object in kernel space  */
+} _mali_uk_unbind_mem_s;
+
+typedef struct {
+	u64 ctx;                                        /**< [in,out] user-kernel context (trashed on output) */
+	u32 target_handle;                              /**< [in] handle of allocation need to do COW */
+	u32 target_offset;                              /**< [in] offset in target allocation to do COW(for support COW  a memory allocated from memory_bank, PAGE_SIZE align)*/
+	u32 target_size;                                /**< [in] size of target allocation to do COW (for support memory bank, PAGE_SIZE align)(in byte) */
+	u32 range_start;                                /**< [in] re allocate range start offset, offset from the start of allocation (PAGE_SIZE align)*/
+	u32 range_size;                                 /**< [in] re allocate size (PAGE_SIZE align)*/
+	u32 vaddr;                                      /**< [in] mali address for the new allocaiton */
+	u32 backend_handle;                             /**< [out] backend handle */
+	u32 flags;
+} _mali_uk_cow_mem_s;
+
+typedef struct {
+	u64 ctx;                                        /**< [in,out] user-kernel context (trashed on output) */
+	u32 range_start;                                /**< [in] re allocate range start offset, offset from the start of allocation */
+	u32 size;                                       /**< [in] re allocate size*/
+	u32 vaddr;                                      /**< [in] mali address for the new allocaiton */
+	s32 change_pages_nr;                            /**< [out] record the page number change for cow operation */
+} _mali_uk_cow_modify_range_s;
+
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 mem_fd;                     /**< [in] Memory descriptor */
+	u32 size;                       /**< [out] size */
+} _mali_uk_dma_buf_get_size_s;
+
+/** Flag for _mali_uk_map_external_mem_s, _mali_uk_attach_ump_mem_s and _mali_uk_attach_dma_buf_s */
+#define _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE (1<<0)
+
+
+typedef struct {
+	u64 ctx;                                /**< [in,out] user-kernel context (trashed on output) */
+	u64 vaddr;                              /* the buffer to do resize*/
+	u32 psize;                              /* wanted physical size of this memory */
+} _mali_uk_mem_resize_s;
+
+/**
+ * @brief Arguments for _mali_uk[uk]_mem_write_safe()
+ */
+typedef struct {
+	u64 ctx;  /**< [in,out] user-kernel context (trashed on output) */
+	u64 src;  /**< [in] Pointer to source data */
+	u64 dest; /**< [in] Destination Mali buffer */
+	u32 size;   /**< [in,out] Number of bytes to write/copy on input, number of bytes actually written/copied on output */
+} _mali_uk_mem_write_safe_s;
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 size;                       /**< [out] size of MMU page table information (registers + page tables) */
+} _mali_uk_query_mmu_page_table_dump_size_s;
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 size;                       /**< [in] size of buffer to receive mmu page table information */
+	u64 buffer;                   /**< [in,out] buffer to receive mmu page table information */
+	u32 register_writes_size;       /**< [out] size of MMU register dump */
+	u64 register_writes;           /**< [out] pointer within buffer where MMU register dump is stored */
+	u32 page_table_dump_size;       /**< [out] size of MMU page table dump */
+	u64 page_table_dump;           /**< [out] pointer within buffer where MMU page table dump is stored */
+} _mali_uk_dump_mmu_page_table_s;
+
+/** @} */ /* end group _mali_uk_memory */
+
+
+/** @addtogroup _mali_uk_pp U/K Fragment Processor
+ * @{ */
+
+/** @brief Arguments for _mali_ukk_get_pp_number_of_cores()
+ *
+ * - pass in the user-kernel context @c ctx that was returned from _mali_ukk_open()
+ * - Upon successful return from _mali_ukk_get_pp_number_of_cores(), @c number_of_cores
+ * will contain the number of Fragment Processor cores in the system.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 number_of_total_cores;      /**< [out] Total number of Fragment Processor cores in the system */
+	u32 number_of_enabled_cores;    /**< [out] Number of enabled Fragment Processor cores */
+} _mali_uk_get_pp_number_of_cores_s;
+
+/** @brief Arguments for _mali_ukk_get_pp_core_version()
+ *
+ * - pass in the user-kernel context @c ctx that was returned from _mali_ukk_open()
+ * - Upon successful return from _mali_ukk_get_pp_core_version(), @c version contains
+ * the version that all Fragment Processor cores are compatible with.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	_mali_core_version version;     /**< [out] version returned from core, see \ref _mali_core_version  */
+	u32 padding;
+} _mali_uk_get_pp_core_version_s;
+
+/** @} */ /* end group _mali_uk_pp */
+
+
+/** @addtogroup _mali_uk_gp U/K Vertex Processor
+ * @{ */
+
+/** @brief Arguments for _mali_ukk_get_gp_number_of_cores()
+ *
+ * - pass in the user-kernel context @c ctx that was returned from _mali_ukk_open()
+ * - Upon successful return from _mali_ukk_get_gp_number_of_cores(), @c number_of_cores
+ * will contain the number of Vertex Processor cores in the system.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 number_of_cores;            /**< [out] number of Vertex Processor cores in the system */
+} _mali_uk_get_gp_number_of_cores_s;
+
+/** @brief Arguments for _mali_ukk_get_gp_core_version()
+ *
+ * - pass in the user-kernel context @c ctx that was returned from _mali_ukk_open()
+ * - Upon successful return from _mali_ukk_get_gp_core_version(), @c version contains
+ * the version that all Vertex Processor cores are compatible with.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	_mali_core_version version;     /**< [out] version returned from core, see \ref _mali_core_version */
+} _mali_uk_get_gp_core_version_s;
+
+/** @} */ /* end group _mali_uk_gp */
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 event_id;                   /**< [in] event id to register (see  enum mali_profiling_events for values) */
+	u32 data[5];                    /**< [in] event specific data */
+} _mali_uk_profiling_add_event_s;
+
+typedef struct {
+	u64 ctx;                     /**< [in,out] user-kernel context (trashed on output) */
+	u32 memory_usage;              /**< [out] total memory usage */
+	u32 vaddr;                                      /**< [in] mali address for the cow allocaiton */
+	s32 change_pages_nr;            /**< [out] record the page number change for cow operation */
+} _mali_uk_profiling_memory_usage_get_s;
+
+
+/** @addtogroup _mali_uk_memory U/K Memory
+ * @{ */
+
+/** @brief Arguments to _mali_ukk_mem_mmap()
+ *
+ * Use of the phys_addr member depends on whether the driver is compiled for
+ * Mali-MMU or nonMMU:
+ * - in the nonMMU case, this is the physical address of the memory as seen by
+ * the CPU (which may be a constant offset from that used by Mali)
+ * - in the MMU case, this is the Mali Virtual base address of the memory to
+ * allocate, and the particular physical pages used to back the memory are
+ * entirely determined by _mali_ukk_mem_mmap(). The details of the physical pages
+ * are not reported to user-space for security reasons.
+ *
+ * The cookie member must be stored for use later when freeing the memory by
+ * calling _mali_ukk_mem_munmap(). In the Mali-MMU case, the cookie is secure.
+ *
+ * The ukk_private word must be set to zero when calling from user-space. On
+ * Kernel-side, the  OS implementation of the U/K interface can use it to
+ * communicate data to the OS implementation of the OSK layer. In particular,
+ * _mali_ukk_get_big_block() directly calls _mali_ukk_mem_mmap directly, and
+ * will communicate its own ukk_private word through the ukk_private member
+ * here. The common code itself will not inspect or modify the ukk_private
+ * word, and so it may be safely used for whatever purposes necessary to
+ * integrate Mali Memory handling into the OS.
+ *
+ * The uku_private member is currently reserved for use by the user-side
+ * implementation of the U/K interface. Its value must be zero.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	void *mapping;                  /**< [out] Returns user-space virtual address for the mapping */
+	u32 size;                       /**< [in] Size of the requested mapping */
+	u32 phys_addr;                  /**< [in] Physical address - could be offset, depending on caller+callee convention */
+	mali_bool writeable;
+} _mali_uk_mem_mmap_s;
+
+/** @brief Arguments to _mali_ukk_mem_munmap()
+ *
+ * The cookie and mapping members must be that returned from the same previous
+ * call to _mali_ukk_mem_mmap(). The size member must correspond to cookie
+ * and mapping - that is, it must be the value originally supplied to a call to
+ * _mali_ukk_mem_mmap that returned the values of mapping and cookie.
+ *
+ * An error will be returned if an attempt is made to unmap only part of the
+ * originally obtained range, or to unmap more than was originally obtained.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	void *mapping;                  /**< [in] The mapping returned from mmap call */
+	u32 size;                       /**< [in] The size passed to mmap call */
+} _mali_uk_mem_munmap_s;
+/** @} */ /* end group _mali_uk_memory */
+
+/** @defgroup _mali_uk_vsync U/K VSYNC Wait Reporting Module
+ * @{ */
+
+/** @brief VSYNC events
+ *
+ * These events are reported when DDK starts to wait for vsync and when the
+ * vsync has occured and the DDK can continue on the next frame.
+ */
+typedef enum _mali_uk_vsync_event {
+	_MALI_UK_VSYNC_EVENT_BEGIN_WAIT = 0,
+	_MALI_UK_VSYNC_EVENT_END_WAIT
+} _mali_uk_vsync_event;
+
+/** @brief Arguments to _mali_ukk_vsync_event()
+ *
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_vsync_event event;     /**< [in] VSYNCH event type */
+} _mali_uk_vsync_event_report_s;
+
+/** @} */ /* end group _mali_uk_vsync */
+
+/** @defgroup _mali_uk_sw_counters_report U/K Software Counter Reporting
+ * @{ */
+
+/** @brief Software counter values
+ *
+ * Values recorded for each of the software counters during a single renderpass.
+ */
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u64 counters;                  /**< [in] The array of u32 counter values */
+	u32 num_counters;              /**< [in] The number of elements in counters array */
+} _mali_uk_sw_counters_report_s;
+
+/** @} */ /* end group _mali_uk_sw_counters_report */
+
+/** @defgroup _mali_uk_timeline U/K Mali Timeline
+ * @{ */
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	u32 timeline;                   /**< [in] timeline id */
+	u32 point;                      /**< [out] latest point on timeline */
+} _mali_uk_timeline_get_latest_point_s;
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_fence_t fence;         /**< [in] fence */
+	u32 timeout;                    /**< [in] timeout (0 for no wait, -1 for blocking) */
+	u32 status;                     /**< [out] status of fence (1 if signaled, 0 if timeout) */
+} _mali_uk_timeline_wait_s;
+
+typedef struct {
+	u64 ctx;                      /**< [in,out] user-kernel context (trashed on output) */
+	_mali_uk_fence_t fence;         /**< [in] mali fence to create linux sync fence from */
+	s32 sync_fd;                    /**< [out] file descriptor for new linux sync fence */
+} _mali_uk_timeline_create_sync_fence_s;
+
+/** @} */ /* end group _mali_uk_timeline */
+
+/** @} */ /* end group u_k_api */
+
+/** @} */ /* end group uddapi */
+
+typedef struct {
+	u64 ctx;                 /**< [in,out] user-kernel context (trashed on output) */
+	s32 stream_fd;   /**< [in] The profiling kernel base stream fd handle */
+} _mali_uk_profiling_stream_fd_get_s;
+
+typedef struct {
+	u64 ctx;        /**< [in,out] user-kernel context (trashed on output) */
+	u64 control_packet_data; /**< [in] the control packet data for control settings */
+	u32 control_packet_size;  /**< [in] The control packet size */
+	u64 response_packet_data; /** < [out] The response packet data */
+	u32 response_packet_size; /** < [in,out] The response packet data */
+} _mali_uk_profiling_control_set_s;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_UTGARD_UK_TYPES_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/Kbuild b/drivers/gpu/arm/mali400/Kbuild
--- a/drivers/gpu/arm/mali400/Kbuild	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/Kbuild	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,261 @@
+#
+# Copyright (C) 2010-2011 ARM Limited. All rights reserved.
+#
+# This program is free software and is provided to you under the terms of the GNU General Public License version 2
+# as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+#
+# A copy of the licence is included with the program, and can also be obtained from Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+
+# This file is called by the Linux build system.
+
+# set up defaults if not defined by the user
+TIMESTAMP ?= default
+OS_MEMORY_KERNEL_BUFFER_SIZE_IN_MB ?= 16
+USING_GPU_UTILIZATION ?= 0
+PROFILING_SKIP_PP_JOBS ?= 0
+PROFILING_SKIP_PP_AND_GP_JOBS ?= 0
+MALI_PP_SCHEDULER_FORCE_NO_JOB_OVERLAP ?= 0
+MALI_PP_SCHEDULER_KEEP_SUB_JOB_STARTS_ALIGNED ?= 0
+MALI_PP_SCHEDULER_FORCE_NO_JOB_OVERLAP_BETWEEN_APPS ?= 0
+MALI_UPPER_HALF_SCHEDULING ?= 1
+MALI_ENABLE_CPU_CYCLES ?= 0
+
+# For customer releases the Linux Device Drivers will be provided as ARM proprietary and GPL releases:
+# The ARM proprietary product will only include the license/proprietary directory
+# The GPL product will only include the license/gpl directory
+ifeq ($(wildcard $(src)/linux/license/gpl/*),)
+    ccflags-y += -I$(src)/linux/license/proprietary
+    ifeq ($(CONFIG_MALI400_PROFILING),y)
+        $(error Profiling is incompatible with non-GPL license)
+    endif
+    ifeq ($(CONFIG_PM_RUNTIME),y)
+        $(error Runtime PM is incompatible with non-GPL license)
+    endif
+    ifeq ($(CONFIG_DMA_SHARED_BUFFER),y)
+        $(error DMA-BUF is incompatible with non-GPL license)
+    endif
+    $(error Linux Device integration is incompatible with non-GPL license)
+else
+    ccflags-y += -I$(src)/linux/license/gpl
+endif
+
+ifeq ($(USING_GPU_UTILIZATION), 1)
+    ifeq ($(USING_DVFS), 1)
+        $(error USING_GPU_UTILIZATION conflict with USING_DVFS you can read the Integration Guide to choose which one do you need)
+    endif
+endif
+
+ifeq ($(CONFIG_MALI_PLATFORM_S5P4418),y)
+export MALI_PLATFORM=nexell
+endif
+
+ifeq ($(CONFIG_MALI_PLATFORM_S5P6818),y)
+export MALI_PLATFORM=nexell
+endif
+
+ifeq ($(CONFIG_ARCH_EXYNOS4),y)
+export MALI_PLATFORM=exynos4
+endif
+
+ifeq ($(MALI_PLATFORM_FILES),)
+EXTRA_DEFINES += -DMALI_FAKE_PLATFORM_DEVICE=1
+export MALI_PLATFORM_FILES_BUILDIN = $(notdir $(wildcard $(src)/platform/$(MALI_PLATFORM)/*.c))
+export MALI_PLATFORM_FILES_ADD_PREFIX = $(addprefix platform/$(MALI_PLATFORM)/,$(MALI_PLATFORM_FILES_BUILDIN))
+endif
+
+mali-y += \
+	linux/mali_osk_atomics.o \
+	linux/mali_osk_irq.o \
+	linux/mali_osk_wq.o \
+	linux/mali_osk_locks.o \
+	linux/mali_osk_wait_queue.o \
+	linux/mali_osk_low_level_mem.o \
+	linux/mali_osk_math.o \
+	linux/mali_osk_memory.o \
+	linux/mali_osk_misc.o \
+	linux/mali_osk_mali.o \
+	linux/mali_osk_notification.o \
+	linux/mali_osk_time.o \
+	linux/mali_osk_timers.o \
+	linux/mali_osk_bitmap.o
+
+mali-y += linux/mali_memory.o linux/mali_memory_os_alloc.o
+mali-y += linux/mali_memory_external.o
+mali-y += linux/mali_memory_block_alloc.o
+mali-y += linux/mali_memory_swap_alloc.o
+
+mali-y += \
+	linux/mali_memory_manager.o \
+	linux/mali_memory_virtual.o \
+	linux/mali_memory_util.o \
+	linux/mali_memory_cow.o \
+	linux/mali_memory_defer_bind.o
+
+mali-y += \
+	linux/mali_ukk_mem.o \
+	linux/mali_ukk_gp.o \
+	linux/mali_ukk_pp.o \
+	linux/mali_ukk_core.o \
+	linux/mali_ukk_soft_job.o \
+	linux/mali_ukk_timeline.o
+
+mali-$(CONFIG_MALI_DEVFREQ) += \
+	linux/mali_devfreq.o \
+	common/mali_pm_metrics.o
+
+# Source files which always are included in a build
+mali-y += \
+	common/mali_kernel_core.o \
+	linux/mali_kernel_linux.o \
+	common/mali_session.o \
+	linux/mali_device_pause_resume.o \
+	common/mali_kernel_vsync.o \
+	linux/mali_ukk_vsync.o \
+	linux/mali_kernel_sysfs.o \
+	common/mali_mmu.o \
+	common/mali_mmu_page_directory.o \
+	common/mali_mem_validation.o \
+	common/mali_hw_core.o \
+	common/mali_gp.o \
+	common/mali_pp.o \
+	common/mali_pp_job.o \
+	common/mali_gp_job.o \
+	common/mali_soft_job.o \
+	common/mali_scheduler.o \
+	common/mali_executor.o \
+	common/mali_group.o \
+	common/mali_dlbu.o \
+	common/mali_broadcast.o \
+	common/mali_pm.o \
+	common/mali_pmu.o \
+	common/mali_user_settings_db.o \
+	common/mali_kernel_utilization.o \
+	common/mali_control_timer.o \
+	common/mali_l2_cache.o \
+	common/mali_timeline.o \
+	common/mali_timeline_fence_wait.o \
+	common/mali_timeline_sync_fence.o \
+	common/mali_spinlock_reentrant.o \
+	common/mali_pm_domain.o \
+	linux/mali_osk_pm.o \
+	linux/mali_pmu_power_up_down.o \
+	__malidrv_build_info.o
+
+ifneq ($(wildcard $(src)/linux/mali_slp_global_lock.c),)
+	mali-y += linux/mali_slp_global_lock.o
+endif
+
+ifneq ($(MALI_PLATFORM_FILES),)
+	mali-y += $(MALI_PLATFORM_FILES:.c=.o)
+endif
+
+ifneq ($(MALI_PLATFORM_FILES_ADD_PREFIX),)
+	mali-y += $(MALI_PLATFORM_FILES_ADD_PREFIX:.c=.o)
+endif
+
+mali-$(CONFIG_MALI400_PROFILING) += linux/mali_ukk_profiling.o
+mali-$(CONFIG_MALI400_PROFILING) += linux/mali_osk_profiling.o
+
+mali-$(CONFIG_MALI400_INTERNAL_PROFILING) += linux/mali_profiling_internal.o timestamp-$(TIMESTAMP)/mali_timestamp.o
+ccflags-$(CONFIG_MALI400_INTERNAL_PROFILING) += -I$(src)/timestamp-$(TIMESTAMP)
+
+mali-$(CONFIG_DMA_SHARED_BUFFER) += linux/mali_memory_dma_buf.o
+mali-$(CONFIG_DMA_SHARED_BUFFER) += linux/mali_memory_secure.o
+mali-$(CONFIG_SYNC) += linux/mali_sync.o
+mali-$(CONFIG_MALI_DMA_BUF_FENCE) += linux/mali_dma_fence.o
+ccflags-$(CONFIG_SYNC) += -Idrivers/staging/android
+
+mali-$(CONFIG_MALI400_UMP) += linux/mali_memory_ump.o
+
+mali-$(CONFIG_MALI_DVFS) += common/mali_dvfs_policy.o
+
+# Tell the Linux build system from which .o file to create the kernel module
+obj-$(CONFIG_MALI400) := mali.o
+
+ccflags-y += $(EXTRA_DEFINES)
+
+# Set up our defines, which will be passed to gcc
+ccflags-y += -DMALI_PP_SCHEDULER_FORCE_NO_JOB_OVERLAP=$(MALI_PP_SCHEDULER_FORCE_NO_JOB_OVERLAP)
+ccflags-y += -DMALI_PP_SCHEDULER_KEEP_SUB_JOB_STARTS_ALIGNED=$(MALI_PP_SCHEDULER_KEEP_SUB_JOB_STARTS_ALIGNED)
+ccflags-y += -DMALI_PP_SCHEDULER_FORCE_NO_JOB_OVERLAP_BETWEEN_APPS=$(MALI_PP_SCHEDULER_FORCE_NO_JOB_OVERLAP_BETWEEN_APPS)
+ccflags-y += -DMALI_STATE_TRACKING=1
+ccflags-y += -DMALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_MB=$(OS_MEMORY_KERNEL_BUFFER_SIZE_IN_MB)
+ccflags-y += -DUSING_GPU_UTILIZATION=$(USING_GPU_UTILIZATION)
+ccflags-y += -DMALI_ENABLE_CPU_CYCLES=$(MALI_ENABLE_CPU_CYCLES)
+
+ifeq ($(MALI_UPPER_HALF_SCHEDULING),1)
+	ccflags-y += -DMALI_UPPER_HALF_SCHEDULING
+endif
+
+#build-in include path is different
+ifeq ($(MALI_PLATFORM_FILES),)
+ccflags-$(CONFIG_MALI400_UMP) += -I$(src)/../ump/include/
+else
+ccflags-$(CONFIG_MALI400_UMP) += -I$(src)/../../ump/include/ump
+endif
+ccflags-$(CONFIG_MALI400_DEBUG) += -DDEBUG
+
+# Use our defines when compiling
+ccflags-y += -I$(src) -I$(src)/include -I$(src)/common -I$(src)/linux -I$(src)/platform -Wno-date-time
+
+# Get subversion revision number, fall back to only ${MALI_RELEASE_NAME} if no svn info is available
+MALI_RELEASE_NAME=$(shell cat $(src)/.version 2> /dev/null)
+
+SVN_INFO = (cd $(src); svn info 2>/dev/null)
+
+ifneq ($(shell $(SVN_INFO) 2>/dev/null),)
+# SVN detected
+SVN_REV := $(shell $(SVN_INFO) | grep '^Revision: '| sed -e 's/^Revision: //' 2>/dev/null)
+DRIVER_REV := $(MALI_RELEASE_NAME)-r$(SVN_REV)
+CHANGE_DATE := $(shell $(SVN_INFO) | grep '^Last Changed Date: ' | cut -d: -f2- | cut -b2-)
+CHANGED_REVISION := $(shell $(SVN_INFO) | grep '^Last Changed Rev: ' | cut -d: -f2- | cut -b2-)
+REPO_URL := $(shell $(SVN_INFO) | grep '^URL: ' | cut -d: -f2- | cut -b2-)
+
+else # SVN
+GIT_REV := $(shell cd $(src); git describe --always 2>/dev/null)
+ifneq ($(GIT_REV),)
+# Git detected
+DRIVER_REV := $(MALI_RELEASE_NAME)-$(GIT_REV)
+CHANGE_DATE := $(shell cd $(src); git log -1 --format="%ci")
+CHANGED_REVISION := $(GIT_REV)
+REPO_URL := $(shell cd $(src); git describe --all --always 2>/dev/null)
+
+else # Git
+# No Git or SVN detected
+DRIVER_REV := $(MALI_RELEASE_NAME)
+CHANGE_DATE := $(MALI_RELEASE_NAME)
+CHANGED_REVISION := $(MALI_RELEASE_NAME)
+endif
+endif
+
+ccflags-y += -DSVN_REV_STRING=\"$(DRIVER_REV)\"
+
+VERSION_STRINGS :=
+VERSION_STRINGS += API_VERSION=$(shell cd $(src); grep "\#define _MALI_API_VERSION" $(FILES_PREFIX)include/linux/mali/mali_utgard_uk_types.h | cut -d' ' -f 3 )
+VERSION_STRINGS += REPO_URL=$(REPO_URL)
+VERSION_STRINGS += REVISION=$(DRIVER_REV)
+VERSION_STRINGS += CHANGED_REVISION=$(CHANGED_REVISION)
+VERSION_STRINGS += CHANGE_DATE=$(CHANGE_DATE)
+VERSION_STRINGS += BUILD_DATE=$(shell date)
+ifdef CONFIG_MALI400_DEBUG
+VERSION_STRINGS += BUILD=debug
+else
+VERSION_STRINGS += BUILD=release
+endif
+VERSION_STRINGS += TARGET_PLATFORM=$(TARGET_PLATFORM)
+VERSION_STRINGS += MALI_PLATFORM=$(MALI_PLATFORM)
+VERSION_STRINGS += KDIR=$(KDIR)
+VERSION_STRINGS += OS_MEMORY_KERNEL_BUFFER_SIZE_IN_MB=$(OS_MEMORY_KERNEL_BUFFER_SIZE_IN_MB)
+VERSION_STRINGS += USING_UMP=$(CONFIG_MALI400_UMP)
+VERSION_STRINGS += USING_PROFILING=$(CONFIG_MALI400_PROFILING)
+VERSION_STRINGS += USING_INTERNAL_PROFILING=$(CONFIG_MALI400_INTERNAL_PROFILING)
+VERSION_STRINGS += USING_GPU_UTILIZATION=$(USING_GPU_UTILIZATION)
+VERSION_STRINGS += USING_DVFS=$(CONFIG_MALI_DVFS)
+VERSION_STRINGS += USING_DMA_BUF_FENCE = $(CONFIG_MALI_DMA_BUF_FENCE)
+VERSION_STRINGS += MALI_UPPER_HALF_SCHEDULING=$(MALI_UPPER_HALF_SCHEDULING)
+
+# Create file with Mali driver configuration
+$(src)/__malidrv_build_info.c:
+	@echo 'const char *__malidrv_build_info(void) { return "malidrv: $(VERSION_STRINGS)";}' > $(src)/__malidrv_build_info.c
diff -ENwbur a/drivers/gpu/arm/mali400/Kconfig b/drivers/gpu/arm/mali400/Kconfig
--- a/drivers/gpu/arm/mali400/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/Kconfig	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,152 @@
+config MALI400
+	tristate "Mali-300/400/450 support"
+	depends on ARM || ARM64
+	select DMA_SHARED_BUFFER
+	---help---
+	  This enables support for the ARM Mali-300, Mali-400, and Mali-450
+	  GPUs.
+
+	  To compile this driver as a module, choose M here: the module will be
+	  called mali.
+
+config MALI450
+	bool "Enable Mali-450 support"
+	depends on MALI400
+	---help---
+	  This enables support for Mali-450 specific features.
+
+config MALI470
+	bool "Enable Mali-470 support"
+	depends on MALI400
+	---help---
+	  This enables support for Mali-470 specific features.
+
+config MALI400_DEBUG
+	bool "Enable debug in Mali driver"
+	depends on MALI400
+	---help---
+	  This enabled extra debug checks and messages in the Mali driver.
+
+choice
+	prompt "Platform configuration"
+	depends on (MALI400 || MALI450 || MALI470)
+	default MALI_PLATFORM_S5P6818 if ARM64
+	default MALI_PLATFORM_S5P4418 if ARM
+	help
+	  Select the SOC platform that contains a Mali utgard GPU
+
+config MALI_PLATFORM_S5P4418
+	depends on ARCH_S5P4418
+	bool "Nexell S5P4418"
+	select MALI_SHARED_INTERRUPTS
+	select MALI_DT
+	help
+	  Select S5P4418 SoC configuration
+
+config MALI_PLATFORM_S5P6818
+	depends on ARCH_S5P6818
+	bool "Nexell S5P6818"
+	select MALI_SHARED_INTERRUPTS
+	select MALI_DT
+	help
+	  Select S5P6818 SoC configuration
+endchoice
+
+config MALI400_PROFILING
+	bool "Enable Mali profiling"
+	depends on MALI400
+	select TRACEPOINTS
+	default y
+	---help---
+	  This enables gator profiling of Mali GPU events.
+
+config MALI400_INTERNAL_PROFILING
+	bool "Enable internal Mali profiling API"
+	depends on MALI400_PROFILING
+	default n
+	---help---
+	  This enables the internal legacy Mali profiling API.
+
+config MALI400_UMP
+	bool "Enable UMP support"
+	depends on MALI400
+	---help---
+	  This enables support for the UMP memory sharing API in the Mali driver.
+
+config MALI_DVFS
+	bool "Enable Mali dynamically frequency change"
+	depends on MALI400 && !MALI_DEVFREQ
+	default y
+	---help---
+	  This enables support for dynamic change frequency of Mali with the goal of lowering power consumption.
+
+config MALI_DMA_BUF_MAP_ON_ATTACH
+	bool "Map dma-buf attachments on attach"
+	depends on MALI400 && DMA_SHARED_BUFFER
+	default y
+	---help---
+	  This makes the Mali driver map dma-buf attachments after doing
+	  attach. If this is not set the dma-buf attachments will be mapped for
+	  every time the GPU need to access the buffer.
+
+	  Mapping for each access can cause lower performance.
+
+config MALI_SHARED_INTERRUPTS
+	bool "Support for shared interrupts"
+	depends on MALI400
+	default n
+	---help---
+	  Adds functionality required to properly support shared interrupts.  Without this support,
+	  the device driver will fail during insmod if it detects shared interrupts.  This also
+	  works when the GPU is not using shared interrupts, but might have a slight performance
+	  impact.
+
+config MALI_PMU_PARALLEL_POWER_UP
+	bool "Power up Mali PMU domains in parallel"
+	depends on MALI400
+	default n
+	---help---
+	  This makes the Mali driver power up all PMU power domains in parallel, instead of
+	  powering up domains one by one, with a slight delay in between. Powering on all power
+	  domains at the same time may cause peak currents higher than what some systems can handle.
+	  These systems must not enable this option.
+
+config MALI_DT
+	bool "Using device tree to initialize module"
+	depends on MALI400 && OF
+	default n
+	---help---
+	  This enable the Mali driver to choose the device tree path to get platform resoures
+	  and disable the old config method. Mali driver could run on the platform which the
+	  device tree is enabled in kernel and corresponding hardware description is implemented
+	  properly in device DTS file.
+
+config MALI_DEVFREQ
+	bool "Using devfreq to tuning frequency"
+	depends on MALI400 && PM_DEVFREQ
+	default n
+	---help---
+	Support devfreq for Mali.
+
+	Using the devfreq framework and, by default, the simpleondemand
+	governor, the frequency of Mali will be dynamically selected from the
+	available OPPs.
+
+config MALI_QUIET
+	bool "Make Mali driver very quiet"
+	depends on MALI400 && !MALI400_DEBUG
+	default n
+	---help---
+	  This forces the Mali driver to never print any messages.
+
+	  If unsure, say N.
+
+config MALI_DMA_BUF_FENCE
+	bool "Make DMA BUF Fence"
+	depends on MALI400
+	default n
+	---help---
+	  Choose this option if you want to use fences and reservations for
+	  synchronization of shared dma-buf access between different drivers.
+
+	  If unsure, say N.
diff -ENwbur a/drivers/gpu/arm/mali400/linux/license/gpl/mali_kernel_license.h b/drivers/gpu/arm/mali400/linux/license/gpl/mali_kernel_license.h
--- a/drivers/gpu/arm/mali400/linux/license/gpl/mali_kernel_license.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/license/gpl/mali_kernel_license.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2010, 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_kernel_license.h
+ * Defines for the macro MODULE_LICENSE.
+ */
+
+#ifndef __MALI_KERNEL_LICENSE_H__
+#define __MALI_KERNEL_LICENSE_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define MALI_KERNEL_LINUX_LICENSE     "GPL"
+#define MALI_LICENSE_IS_GPL 1
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_KERNEL_LICENSE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_devfreq.c b/drivers/gpu/arm/mali400/linux/mali_devfreq.c
--- a/drivers/gpu/arm/mali400/linux/mali_devfreq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_devfreq.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,310 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_osk_mali.h"
+#include "mali_kernel_common.h"
+
+#include <linux/clk.h>
+#include <linux/devfreq.h>
+#include <linux/regulator/consumer.h>
+#include <linux/regulator/driver.h>
+#ifdef CONFIG_DEVFREQ_THERMAL
+#include <linux/devfreq_cooling.h>
+#endif
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+#include <linux/pm_opp.h>
+#else /* Linux >= 3.13 */
+/* In 3.13 the OPP include header file, types, and functions were all
+ * renamed. Use the old filename for the include, and define the new names to
+ * the old, when an old kernel is detected.
+ */
+#include <linux/opp.h>
+#define dev_pm_opp opp
+#define dev_pm_opp_get_voltage opp_get_voltage
+#define dev_pm_opp_get_opp_count opp_get_opp_count
+#define dev_pm_opp_find_freq_ceil opp_find_freq_ceil
+#endif /* Linux >= 3.13 */
+
+#include "mali_pm_metrics.h"
+
+static int
+mali_devfreq_target(struct device *dev, unsigned long *target_freq, u32 flags)
+{
+	struct mali_device *mdev = dev_get_drvdata(dev);
+	struct dev_pm_opp *opp;
+	unsigned long freq = 0;
+	unsigned long voltage;
+	int err;
+
+	freq = *target_freq;
+
+	rcu_read_lock();
+	opp = devfreq_recommended_opp(dev, &freq, flags);
+	voltage = dev_pm_opp_get_voltage(opp);
+	rcu_read_unlock();
+	if (IS_ERR_OR_NULL(opp)) {
+		MALI_PRINT_ERROR(("Failed to get opp (%ld)\n", PTR_ERR(opp)));
+		return PTR_ERR(opp);
+	}
+
+	MALI_DEBUG_PRINT(2, ("mali_devfreq_target:set_freq = %lld flags = 0x%x\n", freq, flags));
+	/*
+	 * Only update if there is a change of frequency
+	 */
+	if (mdev->current_freq == freq) {
+		*target_freq = freq;
+		mali_pm_reset_dvfs_utilisation(mdev);
+		return 0;
+	}
+
+#ifdef CONFIG_REGULATOR
+	if (mdev->regulator && mdev->current_voltage != voltage
+	    && mdev->current_freq < freq) {
+		err = regulator_set_voltage(mdev->regulator, voltage, voltage);
+		if (err) {
+			MALI_PRINT_ERROR(("Failed to increase voltage (%d)\n", err));
+			return err;
+		}
+	}
+#endif
+
+	err = clk_set_rate(mdev->clock, freq);
+	if (err) {
+		MALI_PRINT_ERROR(("Failed to set clock %lu (target %lu)\n", freq, *target_freq));
+		return err;
+	}
+
+#ifdef CONFIG_REGULATOR
+	if (mdev->regulator && mdev->current_voltage != voltage
+	    && mdev->current_freq > freq) {
+		err = regulator_set_voltage(mdev->regulator, voltage, voltage);
+		if (err) {
+			MALI_PRINT_ERROR(("Failed to decrease voltage (%d)\n", err));
+			return err;
+		}
+	}
+#endif
+
+	*target_freq = freq;
+	mdev->current_voltage = voltage;
+	mdev->current_freq = freq;
+
+	mali_pm_reset_dvfs_utilisation(mdev);
+
+	return err;
+}
+
+static int
+mali_devfreq_cur_freq(struct device *dev, unsigned long *freq)
+{
+	struct mali_device *mdev = dev_get_drvdata(dev);
+
+	*freq = mdev->current_freq;
+
+	MALI_DEBUG_PRINT(2, ("mali_devfreq_cur_freq: freq = %d \n", *freq));
+	return 0;
+}
+
+static int
+mali_devfreq_status(struct device *dev, struct devfreq_dev_status *stat)
+{
+	struct mali_device *mdev = dev_get_drvdata(dev);
+
+	stat->current_frequency = mdev->current_freq;
+
+	mali_pm_get_dvfs_utilisation(mdev,
+				     &stat->total_time, &stat->busy_time);
+
+	stat->private_data = NULL;
+
+#ifdef CONFIG_DEVFREQ_THERMAL
+	memcpy(&mdev->devfreq->last_status, stat, sizeof(*stat));
+#endif
+
+	return 0;
+}
+
+/* setup platform specific opp in platform.c*/
+int __weak setup_opps(void)
+{
+	return 0;
+}
+
+/* term platform specific opp in platform.c*/
+int __weak term_opps(struct device *dev)
+{
+	return 0;
+}
+
+static int mali_devfreq_init_freq_table(struct mali_device *mdev,
+					struct devfreq_dev_profile *dp)
+{
+	int err, count;
+	int i = 0;
+	unsigned long freq = 0;
+	struct dev_pm_opp *opp;
+
+	err = setup_opps();
+	if (err)
+		return err;
+
+	rcu_read_lock();
+	count = dev_pm_opp_get_opp_count(mdev->dev);
+	if (count < 0) {
+		rcu_read_unlock();
+		return count;
+	}
+	rcu_read_unlock();
+
+	MALI_DEBUG_PRINT(2, ("mali devfreq table count %d\n", count));
+
+	dp->freq_table = kmalloc_array(count, sizeof(dp->freq_table[0]),
+				       GFP_KERNEL);
+	if (!dp->freq_table)
+		return -ENOMEM;
+
+	rcu_read_lock();
+	for (i = 0; i < count; i++, freq++) {
+		opp = dev_pm_opp_find_freq_ceil(mdev->dev, &freq);
+		if (IS_ERR(opp))
+			break;
+
+		dp->freq_table[i] = freq;
+		MALI_DEBUG_PRINT(2, ("mali devfreq table array[%d] = %d\n", i, freq));
+	}
+	rcu_read_unlock();
+
+	if (count != i)
+		MALI_PRINT_ERROR(("Unable to enumerate all OPPs (%d!=%d)\n",
+				  count, i));
+
+	dp->max_state = i;
+
+	return 0;
+}
+
+static void mali_devfreq_term_freq_table(struct mali_device *mdev)
+{
+	struct devfreq_dev_profile *dp = mdev->devfreq->profile;
+
+	kfree(dp->freq_table);
+	term_opps(mdev->dev);
+}
+
+static void mali_devfreq_exit(struct device *dev)
+{
+	struct mali_device *mdev = dev_get_drvdata(dev);
+
+	mali_devfreq_term_freq_table(mdev);
+}
+
+int mali_devfreq_init(struct mali_device *mdev)
+{
+#ifdef CONFIG_DEVFREQ_THERMAL
+	struct devfreq_cooling_power *callbacks = NULL;
+	_mali_osk_device_data data;
+#endif
+	struct devfreq_dev_profile *dp;
+	int err;
+
+	MALI_DEBUG_PRINT(2, ("Init Mali devfreq\n"));
+
+	if (!mdev->clock)
+		return -ENODEV;
+
+	mdev->current_freq = clk_get_rate(mdev->clock);
+
+	dp = &mdev->devfreq_profile;
+
+	dp->initial_freq = mdev->current_freq;
+	dp->polling_ms = 100;
+	dp->target = mali_devfreq_target;
+	dp->get_dev_status = mali_devfreq_status;
+	dp->get_cur_freq = mali_devfreq_cur_freq;
+	dp->exit = mali_devfreq_exit;
+
+	if (mali_devfreq_init_freq_table(mdev, dp))
+		return -EFAULT;
+
+	mdev->devfreq = devfreq_add_device(mdev->dev, dp,
+					   "simple_ondemand", NULL);
+	if (IS_ERR(mdev->devfreq)) {
+		mali_devfreq_term_freq_table(mdev);
+		return PTR_ERR(mdev->devfreq);
+	}
+
+	err = devfreq_register_opp_notifier(mdev->dev, mdev->devfreq);
+	if (err) {
+		MALI_PRINT_ERROR(("Failed to register OPP notifier (%d)\n", err));
+		goto opp_notifier_failed;
+	}
+
+#ifdef CONFIG_DEVFREQ_THERMAL
+	/* Initilization last_status it will be used when first power allocate called */
+	mdev->devfreq->last_status.current_frequency = mdev->current_freq;
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+		if (NULL != data.gpu_cooling_ops) {
+			callbacks = data.gpu_cooling_ops;
+			MALI_DEBUG_PRINT(2, ("Mali GPU Thermal: Callback handler installed \n"));
+		}
+	}
+
+	if (callbacks) {
+		mdev->devfreq_cooling = of_devfreq_cooling_register_power(
+						mdev->dev->of_node,
+						mdev->devfreq,
+						callbacks);
+		if (IS_ERR_OR_NULL(mdev->devfreq_cooling)) {
+			err = PTR_ERR(mdev->devfreq_cooling);
+			MALI_PRINT_ERROR(("Failed to register cooling device (%d)\n", err));
+			goto cooling_failed;
+		} else {
+			MALI_DEBUG_PRINT(2, ("Mali GPU Thermal Cooling installed \n"));
+		}
+	}
+#endif
+
+	return 0;
+
+#ifdef CONFIG_DEVFREQ_THERMAL
+cooling_failed:
+	devfreq_unregister_opp_notifier(mdev->dev, mdev->devfreq);
+#endif /* CONFIG_DEVFREQ_THERMAL */
+opp_notifier_failed:
+	err = devfreq_remove_device(mdev->devfreq);
+	if (err)
+		MALI_PRINT_ERROR(("Failed to terminate devfreq (%d)\n", err));
+	else
+		mdev->devfreq = NULL;
+
+	return err;
+}
+
+void mali_devfreq_term(struct mali_device *mdev)
+{
+	int err;
+
+	MALI_DEBUG_PRINT(2, ("Term Mali devfreq\n"));
+
+#ifdef CONFIG_DEVFREQ_THERMAL
+	devfreq_cooling_unregister(mdev->devfreq_cooling);
+#endif
+
+	devfreq_unregister_opp_notifier(mdev->dev, mdev->devfreq);
+
+	err = devfreq_remove_device(mdev->devfreq);
+	if (err)
+		MALI_PRINT_ERROR(("Failed to terminate devfreq (%d)\n", err));
+	else
+		mdev->devfreq = NULL;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_devfreq.h b/drivers/gpu/arm/mali400/linux/mali_devfreq.h
--- a/drivers/gpu/arm/mali400/linux/mali_devfreq.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_devfreq.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#ifndef _MALI_DEVFREQ_H_
+#define _MALI_DEVFREQ_H_
+
+int mali_devfreq_init(struct mali_device *mdev);
+
+void mali_devfreq_term(struct mali_device *mdev);
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_device_pause_resume.c b/drivers/gpu/arm/mali400/linux/mali_device_pause_resume.c
--- a/drivers/gpu/arm/mali400/linux/mali_device_pause_resume.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_device_pause_resume.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,36 @@
+/**
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_device_pause_resume.c
+ * Implementation of the Mali pause/resume functionality
+ */
+
+#include <linux/module.h>
+#include <linux/mali/mali_utgard.h>
+#include "mali_pm.h"
+
+void mali_dev_pause(void)
+{
+	/*
+	 * Deactive all groups to prevent hardware being touched
+	 * during the period of mali device pausing
+	 */
+	mali_pm_os_suspend(MALI_FALSE);
+}
+
+EXPORT_SYMBOL(mali_dev_pause);
+
+void mali_dev_resume(void)
+{
+	mali_pm_os_resume();
+}
+
+EXPORT_SYMBOL(mali_dev_resume);
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_dma_fence.c b/drivers/gpu/arm/mali400/linux/mali_dma_fence.c
--- a/drivers/gpu/arm/mali400/linux/mali_dma_fence.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_dma_fence.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,352 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/version.h>
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+#include "mali_dma_fence.h"
+#include <linux/atomic.h>
+#include <linux/workqueue.h>
+#endif
+
+static DEFINE_SPINLOCK(mali_dma_fence_lock);
+
+static bool mali_dma_fence_enable_signaling(struct dma_fence *fence)
+{
+	MALI_IGNORE(fence);
+	return true;
+}
+
+static const char *mali_dma_fence_get_driver_name(struct dma_fence *fence)
+{
+	MALI_IGNORE(fence);
+	return "mali";
+}
+
+static const char *mali_dma_fence_get_timeline_name(struct dma_fence *fence)
+{
+	MALI_IGNORE(fence);
+	return "mali_dma_fence";
+}
+
+static const struct dma_fence_ops mali_dma_fence_ops = {
+	.get_driver_name = mali_dma_fence_get_driver_name,
+	.get_timeline_name = mali_dma_fence_get_timeline_name,
+	.enable_signaling = mali_dma_fence_enable_signaling,
+	.signaled = NULL,
+	.wait = dma_fence_default_wait,
+	.release = NULL
+};
+
+static void mali_dma_fence_context_cleanup(struct mali_dma_fence_context *dma_fence_context)
+{
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+
+	for (i = 0; i < dma_fence_context->num_dma_fence_waiter; i++) {
+		if (dma_fence_context->mali_dma_fence_waiters[i]) {
+			dma_fence_remove_callback(dma_fence_context->mali_dma_fence_waiters[i]->fence,
+					      &dma_fence_context->mali_dma_fence_waiters[i]->base);
+			dma_fence_put(dma_fence_context->mali_dma_fence_waiters[i]->fence);
+			kfree(dma_fence_context->mali_dma_fence_waiters[i]);
+			dma_fence_context->mali_dma_fence_waiters[i] = NULL;
+		}
+	}
+
+	if (NULL != dma_fence_context->mali_dma_fence_waiters)
+		kfree(dma_fence_context->mali_dma_fence_waiters);
+
+	dma_fence_context->mali_dma_fence_waiters = NULL;
+	dma_fence_context->num_dma_fence_waiter = 0;
+}
+
+static void mali_dma_fence_context_work_func(struct work_struct *work_handle)
+{
+	struct mali_dma_fence_context *dma_fence_context;
+
+	MALI_DEBUG_ASSERT_POINTER(work_handle);
+
+	dma_fence_context = container_of(work_handle, struct mali_dma_fence_context, work_handle);
+
+	dma_fence_context->cb_func(dma_fence_context->pp_job_ptr);
+}
+
+static void mali_dma_fence_callback(struct dma_fence *fence, struct dma_fence_cb *cb)
+{
+	struct mali_dma_fence_waiter *dma_fence_waiter = NULL;
+	struct mali_dma_fence_context *dma_fence_context = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(fence);
+	MALI_DEBUG_ASSERT_POINTER(cb);
+
+	MALI_IGNORE(fence);
+
+	dma_fence_waiter = container_of(cb, struct mali_dma_fence_waiter, base);
+	dma_fence_context = dma_fence_waiter->parent;
+
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+
+	if (atomic_dec_and_test(&dma_fence_context->count))
+		schedule_work(&dma_fence_context->work_handle);
+}
+
+static _mali_osk_errcode_t mali_dma_fence_add_callback(struct mali_dma_fence_context *dma_fence_context, struct dma_fence *fence)
+{
+	int ret = 0;
+	struct mali_dma_fence_waiter *dma_fence_waiter;
+	struct mali_dma_fence_waiter **dma_fence_waiters;
+
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+	MALI_DEBUG_ASSERT_POINTER(fence);
+
+	dma_fence_waiters = krealloc(dma_fence_context->mali_dma_fence_waiters,
+				     (dma_fence_context->num_dma_fence_waiter + 1)
+				     * sizeof(struct mali_dma_fence_waiter *),
+				     GFP_KERNEL);
+
+	if (NULL == dma_fence_waiters) {
+		MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to realloc the dma fence waiters.\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	dma_fence_context->mali_dma_fence_waiters = dma_fence_waiters;
+
+	dma_fence_waiter = kzalloc(sizeof(struct mali_dma_fence_waiter), GFP_KERNEL);
+
+	if (NULL == dma_fence_waiter) {
+		MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to create mali dma fence waiter.\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	dma_fence_get(fence);
+
+	dma_fence_waiter->fence = fence;
+	dma_fence_waiter->parent = dma_fence_context;
+	atomic_inc(&dma_fence_context->count);
+
+	ret = dma_fence_add_callback(fence, &dma_fence_waiter->base,
+				 mali_dma_fence_callback);
+	if (0 > ret) {
+		dma_fence_put(fence);
+		kfree(dma_fence_waiter);
+		atomic_dec(&dma_fence_context->count);
+		if (-ENOENT == ret) {
+			/*-ENOENT if fence has already been signaled, return _MALI_OSK_ERR_OK*/
+			return _MALI_OSK_ERR_OK;
+		}
+		/* Failed to add the fence callback into fence, return _MALI_OSK_ERR_FAULT*/
+		MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to add callback into fence.\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	dma_fence_context->mali_dma_fence_waiters[dma_fence_context->num_dma_fence_waiter] = dma_fence_waiter;
+	dma_fence_context->num_dma_fence_waiter++;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+struct dma_fence *mali_dma_fence_new(u32  context, u32 seqno)
+{
+	struct dma_fence *fence = NULL;
+
+	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+
+	if (NULL == fence) {
+		MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to create dma fence.\n"));
+		return fence;
+	}
+
+	dma_fence_init(fence,
+		   &mali_dma_fence_ops,
+		   &mali_dma_fence_lock,
+		   context, seqno);
+
+	return fence;
+}
+
+void mali_dma_fence_signal_and_put(struct dma_fence **fence)
+{
+	MALI_DEBUG_ASSERT_POINTER(fence);
+	MALI_DEBUG_ASSERT_POINTER(*fence);
+
+	dma_fence_signal(*fence);
+	dma_fence_put(*fence);
+	*fence = NULL;
+}
+
+void mali_dma_fence_context_init(struct mali_dma_fence_context *dma_fence_context,
+				 mali_dma_fence_context_callback_func_t  cb_func,
+				 void *pp_job_ptr)
+{
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+
+	INIT_WORK(&dma_fence_context->work_handle, mali_dma_fence_context_work_func);
+	atomic_set(&dma_fence_context->count, 1);
+	dma_fence_context->num_dma_fence_waiter = 0;
+	dma_fence_context->mali_dma_fence_waiters = NULL;
+	dma_fence_context->cb_func = cb_func;
+	dma_fence_context->pp_job_ptr = pp_job_ptr;
+}
+
+_mali_osk_errcode_t mali_dma_fence_context_add_waiters(struct mali_dma_fence_context *dma_fence_context,
+		struct reservation_object *dma_reservation_object)
+{
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_OK;
+	struct dma_fence *exclusive_fence = NULL;
+	u32 shared_count = 0, i;
+	struct dma_fence **shared_fences = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+	MALI_DEBUG_ASSERT_POINTER(dma_reservation_object);
+
+	/* Get all the shared/exclusive fences in the reservation object of dma buf*/
+	ret = reservation_object_get_fences_rcu(dma_reservation_object, &exclusive_fence,
+						&shared_count, &shared_fences);
+	if (ret < 0) {
+		MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to get  shared or exclusive_fence dma fences from  the reservation object of dma buf.\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	if (exclusive_fence) {
+		ret = mali_dma_fence_add_callback(dma_fence_context, exclusive_fence);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to add callback into exclusive fence.\n"));
+			mali_dma_fence_context_cleanup(dma_fence_context);
+			goto ended;
+		}
+	}
+
+
+	for (i = 0; i < shared_count; i++) {
+		ret = mali_dma_fence_add_callback(dma_fence_context, shared_fences[i]);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to add callback into shared fence [%d].\n", i));
+			mali_dma_fence_context_cleanup(dma_fence_context);
+			break;
+		}
+	}
+
+ended:
+
+	if (exclusive_fence)
+		dma_fence_put(exclusive_fence);
+
+	if (shared_fences) {
+		for (i = 0; i < shared_count; i++) {
+			dma_fence_put(shared_fences[i]);
+		}
+		kfree(shared_fences);
+	}
+
+	return ret;
+}
+
+
+void mali_dma_fence_context_term(struct mali_dma_fence_context *dma_fence_context)
+{
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+	atomic_set(&dma_fence_context->count, 0);
+	if (dma_fence_context->work_handle.func) {
+		cancel_work_sync(&dma_fence_context->work_handle);
+	}
+	mali_dma_fence_context_cleanup(dma_fence_context);
+}
+
+void mali_dma_fence_context_dec_count(struct mali_dma_fence_context *dma_fence_context)
+{
+	MALI_DEBUG_ASSERT_POINTER(dma_fence_context);
+
+	if (atomic_dec_and_test(&dma_fence_context->count))
+		schedule_work(&dma_fence_context->work_handle);
+}
+
+
+void mali_dma_fence_add_reservation_object_list(struct reservation_object *dma_reservation_object,
+		struct reservation_object **dma_reservation_object_list,
+		u32 *num_dma_reservation_object)
+{
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(dma_reservation_object);
+	MALI_DEBUG_ASSERT_POINTER(dma_reservation_object_list);
+	MALI_DEBUG_ASSERT_POINTER(num_dma_reservation_object);
+
+	for (i = 0; i < *num_dma_reservation_object; i++) {
+		if (dma_reservation_object_list[i] == dma_reservation_object)
+			return;
+	}
+
+	dma_reservation_object_list[*num_dma_reservation_object] = dma_reservation_object;
+	(*num_dma_reservation_object)++;
+}
+
+int mali_dma_fence_lock_reservation_object_list(struct reservation_object **dma_reservation_object_list,
+		u32 num_dma_reservation_object, struct ww_acquire_ctx *ww_actx)
+{
+	u32 i;
+
+	struct reservation_object *reservation_object_to_slow_lock = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(dma_reservation_object_list);
+	MALI_DEBUG_ASSERT_POINTER(ww_actx);
+
+	ww_acquire_init(ww_actx, &reservation_ww_class);
+
+again:
+	for (i = 0; i < num_dma_reservation_object; i++) {
+		int ret;
+
+		if (dma_reservation_object_list[i] == reservation_object_to_slow_lock) {
+			reservation_object_to_slow_lock = NULL;
+			continue;
+		}
+
+		ret = ww_mutex_lock(&dma_reservation_object_list[i]->lock, ww_actx);
+
+		if (ret < 0) {
+			u32  slow_lock_index = i;
+
+			/* unlock all pre locks we have already locked.*/
+			while (i > 0) {
+				i--;
+				ww_mutex_unlock(&dma_reservation_object_list[i]->lock);
+			}
+
+			if (NULL != reservation_object_to_slow_lock)
+				ww_mutex_unlock(&reservation_object_to_slow_lock->lock);
+
+			if (ret == -EDEADLK) {
+				reservation_object_to_slow_lock = dma_reservation_object_list[slow_lock_index];
+				ww_mutex_lock_slow(&reservation_object_to_slow_lock->lock, ww_actx);
+				goto again;
+			}
+			ww_acquire_fini(ww_actx);
+			MALI_DEBUG_PRINT(1, ("Mali dma fence: failed to lock all dma reservation objects.\n", i));
+			return ret;
+		}
+	}
+
+	ww_acquire_done(ww_actx);
+	return 0;
+}
+
+void mali_dma_fence_unlock_reservation_object_list(struct reservation_object **dma_reservation_object_list,
+		u32 num_dma_reservation_object, struct ww_acquire_ctx *ww_actx)
+{
+	u32 i;
+
+	for (i = 0; i < num_dma_reservation_object; i++)
+		ww_mutex_unlock(&dma_reservation_object_list[i]->lock);
+
+	ww_acquire_fini(ww_actx);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_dma_fence.h b/drivers/gpu/arm/mali400/linux/mali_dma_fence.h
--- a/drivers/gpu/arm/mali400/linux/mali_dma_fence.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_dma_fence.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_dma_fence.h
+ *
+ * Mali interface for Linux dma buf fence objects.
+ */
+
+#ifndef _MALI_DMA_FENCE_H_
+#define _MALI_DMA_FENCE_H_
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
+#include <linux/fence.h>
+#include <linux/reservation.h>
+#endif
+
+struct mali_dma_fence_context;
+
+/* The mali dma fence context callback function */
+typedef void (*mali_dma_fence_context_callback_func_t)(void *pp_job_ptr);
+
+struct mali_dma_fence_waiter {
+	struct dma_fence_cb base;
+	struct mali_dma_fence_context *parent;
+	struct dma_fence *fence;
+};
+
+struct mali_dma_fence_context {
+	struct work_struct work_handle;
+	struct mali_dma_fence_waiter **mali_dma_fence_waiters;
+	u32 num_dma_fence_waiter;
+	atomic_t count;
+	void *pp_job_ptr; /* the mali pp job pointer */;
+	mali_dma_fence_context_callback_func_t cb_func;
+};
+
+/* Create a dma fence
+ * @param context The execution context this fence is run on
+ * @param seqno A linearly increasing sequence number for this context
+ * @return the new dma fence if success, or NULL on failure.
+ */
+struct dma_fence *mali_dma_fence_new(u32  context, u32 seqno);
+
+/* Signal and put dma fence
+ * @param fence The dma fence to signal and put
+ */
+void mali_dma_fence_signal_and_put(struct dma_fence **fence);
+
+/**
+ * Initialize a mali dma fence context for pp job.
+ * @param dma_fence_context The mali dma fence context to initialize.
+ * @param cb_func The dma fence context callback function to call when all dma fence release.
+ * @param pp_job_ptr The pp_job to call function with.
+ */
+void mali_dma_fence_context_init(struct mali_dma_fence_context *dma_fence_context,
+				 mali_dma_fence_context_callback_func_t  cb_func,
+				 void *pp_job_ptr);
+
+/**
+ * Add new mali dma fence waiter into mali dma fence context
+ * @param dma_fence_context The mali dma fence context
+ * @param dma_reservation_object the reservation object to create new mali dma fence waiters
+ * @return _MALI_OSK_ERR_OK if success, or not.
+ */
+_mali_osk_errcode_t mali_dma_fence_context_add_waiters(struct mali_dma_fence_context *dma_fence_context,
+		struct reservation_object *dma_reservation_object);
+
+/**
+ * Release the dma fence context
+ * @param dma_fence_text The mali dma fence context.
+ */
+void mali_dma_fence_context_term(struct mali_dma_fence_context *dma_fence_context);
+
+/**
+ * Decrease the dma fence context atomic count
+ * @param dma_fence_text The mali dma fence context.
+ */
+void mali_dma_fence_context_dec_count(struct mali_dma_fence_context *dma_fence_context);
+
+/**
+ * Get all reservation object
+ * @param dma_reservation_object The reservation object to add into the reservation object list
+ * @param dma_reservation_object_list The reservation object list to store all reservation object
+ * @param num_dma_reservation_object The number of all reservation object
+ */
+void mali_dma_fence_add_reservation_object_list(struct reservation_object *dma_reservation_object,
+		struct reservation_object **dma_reservation_object_list,
+		u32 *num_dma_reservation_object);
+
+/**
+ * Wait/wound mutex lock to lock all reservation object.
+ */
+int mali_dma_fence_lock_reservation_object_list(struct reservation_object **dma_reservation_object_list,
+		u32  num_dma_reservation_object, struct ww_acquire_ctx *ww_actx);
+
+/**
+ * Wait/wound mutex lock to unlock all reservation object.
+ */
+void mali_dma_fence_unlock_reservation_object_list(struct reservation_object **dma_reservation_object_list,
+		u32 num_dma_reservation_object, struct ww_acquire_ctx *ww_actx);
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_kernel_linux.c b/drivers/gpu/arm/mali400/linux/mali_kernel_linux.c
--- a/drivers/gpu/arm/mali400/linux/mali_kernel_linux.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_kernel_linux.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1154 @@
+/**
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_kernel_linux.c
+ * Implementation of the Linux device driver entrypoints
+ */
+#include <linux/module.h>   /* kernel module definitions */
+#include <linux/fs.h>       /* file system operations */
+#include <linux/cdev.h>     /* character device definitions */
+#include <linux/mm.h>       /* memory manager definitions */
+#include <linux/mali/mali_utgard_ioctl.h>
+#include <linux/version.h>
+#include <linux/device.h>
+#include "mali_kernel_license.h"
+#include <linux/platform_device.h>
+#include <linux/miscdevice.h>
+#include <linux/bug.h>
+#include <linux/of.h>
+#include <linux/clk.h>
+#include <linux/regulator/consumer.h>
+
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_kernel_core.h"
+#include "mali_osk.h"
+#include "mali_kernel_linux.h"
+#include "mali_ukk.h"
+#include "mali_ukk_wrappers.h"
+#include "mali_kernel_sysfs.h"
+#include "mali_pm.h"
+#include "mali_kernel_license.h"
+#include "mali_memory.h"
+#include "mali_memory_dma_buf.h"
+#include "mali_memory_manager.h"
+#include "mali_memory_swap_alloc.h"
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+#include "mali_profiling_internal.h"
+#endif
+#if defined(CONFIG_MALI400_PROFILING) && defined(CONFIG_MALI_DVFS)
+#include "mali_osk_profiling.h"
+#include "mali_dvfs_policy.h"
+
+static int is_first_resume = 1;
+/*Store the clk and vol for boot/insmod and mali_resume*/
+static struct mali_gpu_clk_item mali_gpu_clk[2];
+#endif
+
+/* Streamline support for the Mali driver */
+#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_MALI400_PROFILING)
+/* Ask Linux to create the tracepoints */
+#define CREATE_TRACE_POINTS
+#include "mali_linux_trace.h"
+
+EXPORT_TRACEPOINT_SYMBOL_GPL(mali_timeline_event);
+EXPORT_TRACEPOINT_SYMBOL_GPL(mali_hw_counter);
+EXPORT_TRACEPOINT_SYMBOL_GPL(mali_sw_counters);
+#endif /* CONFIG_TRACEPOINTS */
+
+#ifdef CONFIG_MALI_DEVFREQ
+#include "mali_devfreq.h"
+#include "mali_osk_mali.h"
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
+#include <linux/pm_opp.h>
+#else
+/* In 3.13 the OPP include header file, types, and functions were all
+ * renamed. Use the old filename for the include, and define the new names to
+ * the old, when an old kernel is detected.
+ */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+#include <linux/pm_opp.h>
+#else
+#include <linux/opp.h>
+#endif /* Linux >= 3.13*/
+#define dev_pm_opp_of_add_table of_init_opp_table
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+#define dev_pm_opp_of_remove_table of_free_opp_table
+#endif /* Linux >= 3.19 */
+#endif /* Linux >= 4.4.0 */
+#endif
+
+/* from the __malidrv_build_info.c file that is generated during build */
+extern const char *__malidrv_build_info(void);
+
+/* Module parameter to control log level */
+int mali_debug_level = 2;
+module_param(mali_debug_level, int, S_IRUSR | S_IWUSR | S_IWGRP | S_IRGRP | S_IROTH); /* rw-rw-r-- */
+MODULE_PARM_DESC(mali_debug_level, "Higher number, more dmesg output");
+
+extern int mali_max_job_runtime;
+module_param(mali_max_job_runtime, int, S_IRUSR | S_IWUSR | S_IWGRP | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_max_job_runtime, "Maximum allowed job runtime in msecs.\nJobs will be killed after this no matter what");
+
+extern int mali_l2_max_reads;
+module_param(mali_l2_max_reads, int, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_l2_max_reads, "Maximum reads for Mali L2 cache");
+
+extern unsigned int mali_dedicated_mem_start;
+module_param(mali_dedicated_mem_start, uint, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_dedicated_mem_start, "Physical start address of dedicated Mali GPU memory.");
+
+extern unsigned int mali_dedicated_mem_size;
+module_param(mali_dedicated_mem_size, uint, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_dedicated_mem_size, "Size of dedicated Mali GPU memory.");
+
+extern unsigned int mali_shared_mem_size;
+module_param(mali_shared_mem_size, uint, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_shared_mem_size, "Size of shared Mali GPU memory.");
+
+#if defined(CONFIG_MALI400_PROFILING)
+extern int mali_boot_profiling;
+module_param(mali_boot_profiling, int, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_boot_profiling, "Start profiling as a part of Mali driver initialization");
+#endif
+
+extern int mali_max_pp_cores_group_1;
+module_param(mali_max_pp_cores_group_1, int, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_max_pp_cores_group_1, "Limit the number of PP cores to use from first PP group.");
+
+extern int mali_max_pp_cores_group_2;
+module_param(mali_max_pp_cores_group_2, int, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_max_pp_cores_group_2, "Limit the number of PP cores to use from second PP group (Mali-450 only).");
+
+extern unsigned int mali_mem_swap_out_threshold_value;
+module_param(mali_mem_swap_out_threshold_value, uint, S_IRUSR | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_mem_swap_out_threshold_value, "Threshold value used to limit how much swappable memory cached in Mali driver.");
+
+#if defined(CONFIG_MALI_DVFS)
+/** the max fps the same as display vsync default 60, can set by module insert parameter */
+extern int mali_max_system_fps;
+module_param(mali_max_system_fps, int, S_IRUSR | S_IWUSR | S_IWGRP | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_max_system_fps, "Max system fps the same as display VSYNC.");
+
+/** a lower limit on their desired FPS default 58, can set by module insert parameter*/
+extern int mali_desired_fps;
+module_param(mali_desired_fps, int, S_IRUSR | S_IWUSR | S_IWGRP | S_IRGRP | S_IROTH);
+MODULE_PARM_DESC(mali_desired_fps, "A bit lower than max_system_fps which user desired fps");
+#endif
+
+#if MALI_ENABLE_CPU_CYCLES
+#include <linux/cpumask.h>
+#include <linux/timer.h>
+#include <asm/smp.h>
+static struct timer_list mali_init_cpu_clock_timers[8];
+static u32 mali_cpu_clock_last_value[8] = {0,};
+#endif
+
+/* Export symbols from common code: mali_user_settings.c */
+#include "mali_user_settings_db.h"
+EXPORT_SYMBOL(mali_set_user_setting);
+EXPORT_SYMBOL(mali_get_user_setting);
+
+static char mali_dev_name[] = "mali"; /* should be const, but the functions we call requires non-cost */
+
+/* This driver only supports one Mali device, and this variable stores this single platform device */
+struct platform_device *mali_platform_device = NULL;
+
+/* This driver only supports one Mali device, and this variable stores the exposed misc device (/dev/mali) */
+static struct miscdevice mali_miscdevice = { 0, };
+
+static int mali_miscdevice_register(struct platform_device *pdev);
+static void mali_miscdevice_unregister(void);
+
+static int mali_open(struct inode *inode, struct file *filp);
+static int mali_release(struct inode *inode, struct file *filp);
+#ifdef HAVE_UNLOCKED_IOCTL
+static long mali_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
+#else
+static int mali_ioctl(struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg);
+#endif
+
+static int mali_probe(struct platform_device *pdev);
+static int mali_remove(struct platform_device *pdev);
+
+static int mali_driver_suspend_scheduler(struct device *dev);
+static int mali_driver_resume_scheduler(struct device *dev);
+
+#ifdef CONFIG_PM_RUNTIME
+static int mali_driver_runtime_suspend(struct device *dev);
+static int mali_driver_runtime_resume(struct device *dev);
+static int mali_driver_runtime_idle(struct device *dev);
+#endif
+
+#if defined(MALI_FAKE_PLATFORM_DEVICE)
+#if defined(CONFIG_MALI_DT)
+extern int mali_platform_device_init(struct platform_device *device);
+extern int mali_platform_device_deinit(struct platform_device *device);
+#else
+extern int mali_platform_device_register(void);
+extern int mali_platform_device_unregister(void);
+#endif
+#endif
+
+/* Linux power management operations provided by the Mali device driver */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29))
+struct pm_ext_ops mali_dev_ext_pm_ops = {
+	.base =
+	{
+		.suspend = mali_driver_suspend_scheduler,
+		.resume = mali_driver_resume_scheduler,
+		.freeze = mali_driver_suspend_scheduler,
+		.thaw =   mali_driver_resume_scheduler,
+	},
+};
+#else
+static const struct dev_pm_ops mali_dev_pm_ops = {
+#ifdef CONFIG_PM_RUNTIME
+	.runtime_suspend = mali_driver_runtime_suspend,
+	.runtime_resume = mali_driver_runtime_resume,
+	.runtime_idle = mali_driver_runtime_idle,
+#endif
+	.suspend = mali_driver_suspend_scheduler,
+	.resume = mali_driver_resume_scheduler,
+	.freeze = mali_driver_suspend_scheduler,
+	.thaw = mali_driver_resume_scheduler,
+	.poweroff = mali_driver_suspend_scheduler,
+};
+#endif
+
+#ifdef CONFIG_MALI_DT
+static struct of_device_id base_dt_ids[] = {
+	{.compatible = "arm,mali-300"},
+	{.compatible = "arm,mali-400"},
+	{.compatible = "arm,mali-450"},
+	{.compatible = "arm,mali-470"},
+	{},
+};
+
+MODULE_DEVICE_TABLE(of, base_dt_ids);
+#endif
+
+/* The Mali device driver struct */
+static struct platform_driver mali_platform_driver = {
+	.probe  = mali_probe,
+	.remove = mali_remove,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 29))
+	.pm = &mali_dev_ext_pm_ops,
+#endif
+	.driver =
+	{
+		.name   = MALI_GPU_NAME_UTGARD,
+		.owner  = THIS_MODULE,
+		.bus = &platform_bus_type,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29))
+		.pm = &mali_dev_pm_ops,
+#endif
+#ifdef CONFIG_MALI_DT
+		.of_match_table = of_match_ptr(base_dt_ids),
+#endif
+	},
+};
+
+/* Linux misc device operations (/dev/mali) */
+struct file_operations mali_fops = {
+	.owner = THIS_MODULE,
+	.open = mali_open,
+	.release = mali_release,
+#ifdef HAVE_UNLOCKED_IOCTL
+	.unlocked_ioctl = mali_ioctl,
+#else
+	.ioctl = mali_ioctl,
+#endif
+	.compat_ioctl = mali_ioctl,
+	.mmap = mali_mmap
+};
+
+#if MALI_ENABLE_CPU_CYCLES
+void mali_init_cpu_time_counters(int reset, int enable_divide_by_64)
+{
+	/* The CPU assembly reference used is: ARM Architecture Reference Manual ARMv7-AR C.b */
+	u32 write_value;
+
+	/* See B4.1.116 PMCNTENSET, Performance Monitors Count Enable Set register, VMSA */
+	/* setting p15 c9 c12 1 to 0x8000000f==CPU_CYCLE_ENABLE |EVENT_3_ENABLE|EVENT_2_ENABLE|EVENT_1_ENABLE|EVENT_0_ENABLE */
+	asm volatile("mcr p15, 0, %0, c9, c12, 1" :: "r"(0x8000000f));
+
+
+	/* See B4.1.117 PMCR, Performance Monitors Control Register. Writing to p15, c9, c12, 0 */
+	write_value = 1 << 0; /* Bit 0 set. Enable counters */
+	if (reset) {
+		write_value |= 1 << 1; /* Reset event counters */
+		write_value |= 1 << 2; /* Reset cycle counter  */
+	}
+	if (enable_divide_by_64) {
+		write_value |= 1 << 3; /* Enable the Clock divider by 64 */
+	}
+	write_value |= 1 << 4; /* Export enable. Not needed */
+	asm volatile("MCR p15, 0, %0, c9, c12, 0\t\n" :: "r"(write_value));
+
+	/* PMOVSR Overflow Flag Status Register - Clear Clock and Event overflows */
+	asm volatile("MCR p15, 0, %0, c9, c12, 3\t\n" :: "r"(0x8000000f));
+
+
+	/* See B4.1.124 PMUSERENR - setting p15 c9 c14 to 1" */
+	/* User mode access to the Performance Monitors enabled. */
+	/* Lets User space read cpu clock cycles */
+	asm volatile("mcr p15, 0, %0, c9, c14, 0" :: "r"(1));
+}
+
+/** A timer function that configures the cycle clock counter on current CPU.
+ * The function \a mali_init_cpu_time_counters_on_all_cpus sets up this
+ * function to trigger on all Cpus during module load.
+ */
+static void mali_init_cpu_clock_timer_func(unsigned long data)
+{
+	int reset_counters, enable_divide_clock_counter_by_64;
+	int current_cpu = raw_smp_processor_id();
+	unsigned int sample0;
+	unsigned int sample1;
+
+	MALI_IGNORE(data);
+
+	reset_counters = 1;
+	enable_divide_clock_counter_by_64 = 0;
+	mali_init_cpu_time_counters(reset_counters, enable_divide_clock_counter_by_64);
+
+	sample0 = mali_get_cpu_cyclecount();
+	sample1 = mali_get_cpu_cyclecount();
+
+	MALI_DEBUG_PRINT(3, ("Init Cpu %d cycle counter- First two samples: %08x %08x \n", current_cpu, sample0, sample1));
+}
+
+/** A timer functions for storing current time on all cpus.
+ * Used for checking if the clocks have similar values or if they are drifting.
+ */
+static void mali_print_cpu_clock_timer_func(unsigned long data)
+{
+	int current_cpu = raw_smp_processor_id();
+	unsigned int sample0;
+
+	MALI_IGNORE(data);
+	sample0 = mali_get_cpu_cyclecount();
+	if (current_cpu < 8) {
+		mali_cpu_clock_last_value[current_cpu] = sample0;
+	}
+}
+
+/** Init the performance registers on all CPUs to count clock cycles.
+ * For init \a print_only should be 0.
+ * If \a print_only is 1, it will intead print the current clock value of all CPUs.
+ */
+void mali_init_cpu_time_counters_on_all_cpus(int print_only)
+{
+	int i = 0;
+	int cpu_number;
+	int jiffies_trigger;
+	int jiffies_wait;
+
+	jiffies_wait = 2;
+	jiffies_trigger = jiffies + jiffies_wait;
+
+	for (i = 0 ; i < 8 ; i++) {
+		init_timer(&mali_init_cpu_clock_timers[i]);
+		if (print_only) mali_init_cpu_clock_timers[i].function = mali_print_cpu_clock_timer_func;
+		else            mali_init_cpu_clock_timers[i].function = mali_init_cpu_clock_timer_func;
+		mali_init_cpu_clock_timers[i].expires = jiffies_trigger ;
+	}
+	cpu_number = cpumask_first(cpu_online_mask);
+	for (i = 0 ; i < 8 ; i++) {
+		int next_cpu;
+		add_timer_on(&mali_init_cpu_clock_timers[i], cpu_number);
+		next_cpu = cpumask_next(cpu_number, cpu_online_mask);
+		if (next_cpu >= nr_cpu_ids) break;
+		cpu_number = next_cpu;
+	}
+
+	while (jiffies_wait) jiffies_wait = schedule_timeout_uninterruptible(jiffies_wait);
+
+	for (i = 0 ; i < 8 ; i++) {
+		del_timer_sync(&mali_init_cpu_clock_timers[i]);
+	}
+
+	if (print_only) {
+		if ((0 == mali_cpu_clock_last_value[2]) && (0 == mali_cpu_clock_last_value[3])) {
+			/* Diff can be printed if we want to check if the clocks are in sync
+			int diff = mali_cpu_clock_last_value[0] - mali_cpu_clock_last_value[1];*/
+			MALI_DEBUG_PRINT(2, ("CPU cycle counters readout all: %08x %08x\n", mali_cpu_clock_last_value[0], mali_cpu_clock_last_value[1]));
+		} else {
+			MALI_DEBUG_PRINT(2, ("CPU cycle counters readout all: %08x %08x %08x %08x\n", mali_cpu_clock_last_value[0], mali_cpu_clock_last_value[1], mali_cpu_clock_last_value[2], mali_cpu_clock_last_value[3]));
+		}
+	}
+}
+#endif
+
+int mali_module_init(void)
+{
+	int err = 0;
+
+	MALI_DEBUG_PRINT(2, ("Inserting Mali v%d device driver. \n", _MALI_API_VERSION));
+	MALI_DEBUG_PRINT(2, ("Compiled: %s, time: %s.\n", __DATE__, __TIME__));
+	MALI_DEBUG_PRINT(2, ("Driver revision: %s\n", SVN_REV_STRING));
+
+#if MALI_ENABLE_CPU_CYCLES
+	mali_init_cpu_time_counters_on_all_cpus(0);
+	MALI_DEBUG_PRINT(2, ("CPU cycle counter setup complete\n"));
+	/* Printing the current cpu counters */
+	mali_init_cpu_time_counters_on_all_cpus(1);
+#endif
+
+	/* Initialize module wide settings */
+#ifdef MALI_FAKE_PLATFORM_DEVICE
+#ifndef CONFIG_MALI_DT
+	MALI_DEBUG_PRINT(2, ("mali_module_init() registering device\n"));
+	err = mali_platform_device_register();
+	if (0 != err) {
+		return err;
+	}
+#endif
+#endif
+
+	MALI_DEBUG_PRINT(2, ("mali_module_init() registering driver\n"));
+
+	err = platform_driver_register(&mali_platform_driver);
+
+	if (0 != err) {
+		MALI_DEBUG_PRINT(2, ("mali_module_init() Failed to register driver (%d)\n", err));
+#ifdef MALI_FAKE_PLATFORM_DEVICE
+#ifndef CONFIG_MALI_DT
+		mali_platform_device_unregister();
+#endif
+#endif
+		mali_platform_device = NULL;
+		return err;
+	}
+
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+	err = _mali_internal_profiling_init(mali_boot_profiling ? MALI_TRUE : MALI_FALSE);
+	if (0 != err) {
+		/* No biggie if we wheren't able to initialize the profiling */
+		MALI_PRINT_ERROR(("Failed to initialize profiling, feature will be unavailable\n"));
+	}
+#endif
+
+	/* Tracing the current frequency and voltage from boot/insmod*/
+#if defined(CONFIG_MALI400_PROFILING) && defined(CONFIG_MALI_DVFS)
+	/* Just call mali_get_current_gpu_clk_item(),to record current clk info.*/
+	mali_get_current_gpu_clk_item(&mali_gpu_clk[0]);
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+				      MALI_PROFILING_EVENT_CHANNEL_GPU |
+				      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+				      mali_gpu_clk[0].clock,
+				      mali_gpu_clk[0].vol / 1000,
+				      0, 0, 0);
+#endif
+
+	MALI_PRINT(("Mali device driver loaded\n"));
+
+	return 0; /* Success */
+}
+
+void mali_module_exit(void)
+{
+	MALI_DEBUG_PRINT(2, ("Unloading Mali v%d device driver.\n", _MALI_API_VERSION));
+
+	MALI_DEBUG_PRINT(2, ("mali_module_exit() unregistering driver\n"));
+
+	platform_driver_unregister(&mali_platform_driver);
+
+#if defined(MALI_FAKE_PLATFORM_DEVICE)
+#ifndef CONFIG_MALI_DT
+	MALI_DEBUG_PRINT(2, ("mali_module_exit() unregistering device\n"));
+	mali_platform_device_unregister();
+#endif
+#endif
+
+	/* Tracing the current frequency and voltage from rmmod*/
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+				      MALI_PROFILING_EVENT_CHANNEL_GPU |
+				      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+				      0,
+				      0,
+				      0, 0, 0);
+
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+	_mali_internal_profiling_term();
+#endif
+
+	MALI_PRINT(("Mali device driver unloaded\n"));
+}
+
+#ifdef CONFIG_MALI_DEVFREQ
+struct mali_device *mali_device_alloc(void)
+{
+	return kzalloc(sizeof(struct mali_device), GFP_KERNEL);
+}
+
+void mali_device_free(struct mali_device *mdev)
+{
+	kfree(mdev);
+}
+#endif
+
+static int mali_probe(struct platform_device *pdev)
+{
+	int err;
+#ifdef CONFIG_MALI_DEVFREQ
+	struct mali_device *mdev;
+#endif
+
+	MALI_DEBUG_PRINT(2, ("mali_probe(): Called for platform device %s\n", pdev->name));
+
+	if (NULL != mali_platform_device) {
+		/* Already connected to a device, return error */
+		MALI_PRINT_ERROR(("mali_probe(): The Mali driver is already connected with a Mali device."));
+		return -EEXIST;
+	}
+
+	mali_platform_device = pdev;
+
+#ifdef CONFIG_MALI_DT
+	/* If we use DT to initialize our DDK, we have to prepare somethings. */
+	err = mali_platform_device_init(mali_platform_device);
+	if (0 != err) {
+		MALI_PRINT_ERROR(("mali_probe(): Failed to initialize platform device."));
+		mali_platform_device = NULL;
+		return -EFAULT;
+	}
+#endif
+
+#ifdef CONFIG_MALI_DEVFREQ
+	mdev = mali_device_alloc();
+	if (!mdev) {
+		MALI_PRINT_ERROR(("Can't allocate mali device private data\n"));
+		return -ENOMEM;
+	}
+
+	mdev->dev = &pdev->dev;
+	dev_set_drvdata(mdev->dev, mdev);
+
+	/*Initilization clock and regulator*/
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)) && defined(CONFIG_OF) \
+                        && defined(CONFIG_REGULATOR)
+	mdev->regulator = regulator_get_optional(mdev->dev, "mali");
+	if (IS_ERR_OR_NULL(mdev->regulator)) {
+		MALI_DEBUG_PRINT(2, ("Continuing without Mali regulator control\n"));
+		mdev->regulator = NULL;
+		/* Allow probe to continue without regulator */
+	}
+#endif /* LINUX_VERSION_CODE >= 3, 12, 0 */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0)) && defined(CONFIG_OF) \
+                        && defined(CONFIG_PM_OPP)
+	/* Register the OPPs if they are available in device tree */
+	if (dev_pm_opp_of_add_table(mdev->dev) < 0)
+		MALI_DEBUG_PRINT(3, ("OPP table not found\n"));
+#endif
+
+	/* Need to name the gpu clock "clk_mali" in the device tree */
+	mdev->clock = clk_get(mdev->dev, "clk_mali");
+	if (IS_ERR_OR_NULL(mdev->clock)) {
+		MALI_DEBUG_PRINT(2, ("Continuing without Mali clock control\n"));
+		mdev->clock = NULL;
+		/* Allow probe to continue without clock. */
+	} else {
+		err = clk_prepare_enable(mdev->clock);
+		if (err) {
+			MALI_PRINT_ERROR(("Failed to prepare and enable clock (%d)\n", err));
+			goto clock_prepare_failed;
+		}
+	}
+
+	/* initilize pm metrics related */
+	if (mali_pm_metrics_init(mdev) < 0) {
+		MALI_DEBUG_PRINT(2, ("mali pm metrics init failed\n"));
+		goto pm_metrics_init_failed;
+	}
+
+	if (mali_devfreq_init(mdev) < 0) {
+		MALI_DEBUG_PRINT(2, ("mali devfreq init failed\n"));
+		goto devfreq_init_failed;
+	}
+#endif
+
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_wq_init()) {
+		/* Initialize the Mali GPU HW specified by pdev */
+		if (_MALI_OSK_ERR_OK == mali_initialize_subsystems()) {
+			/* Register a misc device (so we are accessible from user space) */
+			err = mali_miscdevice_register(pdev);
+			if (0 == err) {
+				/* Setup sysfs entries */
+				err = mali_sysfs_register(mali_dev_name);
+
+				if (0 == err) {
+					MALI_DEBUG_PRINT(2, ("mali_probe(): Successfully initialized driver for platform device %s\n", pdev->name));
+
+					return 0;
+				} else {
+					MALI_PRINT_ERROR(("mali_probe(): failed to register sysfs entries"));
+				}
+				mali_miscdevice_unregister();
+			} else {
+				MALI_PRINT_ERROR(("mali_probe(): failed to register Mali misc device."));
+			}
+			mali_terminate_subsystems();
+		} else {
+			MALI_PRINT_ERROR(("mali_probe(): Failed to initialize Mali device driver."));
+		}
+		_mali_osk_wq_term();
+	}
+
+#ifdef CONFIG_MALI_DEVFREQ
+	mali_devfreq_term(mdev);
+devfreq_init_failed:
+	mali_pm_metrics_term(mdev);
+pm_metrics_init_failed:
+	clk_disable_unprepare(mdev->clock);
+clock_prepare_failed:
+	clk_put(mdev->clock);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && defined(CONFIG_OF) \
+                        && defined(CONFIG_PM_OPP)
+	dev_pm_opp_of_remove_table(mdev->dev);
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)) && defined(CONFIG_OF) \
+                        && defined(CONFIG_REGULATOR)
+	regulator_put(mdev->regulator);
+#endif /* LINUX_VERSION_CODE >= 3, 12, 0 */
+	mali_device_free(mdev);
+#endif
+
+#ifdef CONFIG_MALI_DT
+	mali_platform_device_deinit(mali_platform_device);
+#endif
+	mali_platform_device = NULL;
+	return -EFAULT;
+}
+
+static int mali_remove(struct platform_device *pdev)
+{
+#ifdef CONFIG_MALI_DEVFREQ
+	struct mali_device *mdev = dev_get_drvdata(&pdev->dev);
+#endif
+
+	MALI_DEBUG_PRINT(2, ("mali_remove() called for platform device %s\n", pdev->name));
+	mali_sysfs_unregister();
+	mali_miscdevice_unregister();
+	mali_terminate_subsystems();
+	_mali_osk_wq_term();
+
+#ifdef CONFIG_MALI_DEVFREQ
+	mali_devfreq_term(mdev);
+
+	mali_pm_metrics_term(mdev);
+
+	if (mdev->clock) {
+		clk_disable_unprepare(mdev->clock);
+		clk_put(mdev->clock);
+		mdev->clock = NULL;
+	}
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && defined(CONFIG_OF) \
+                        && defined(CONFIG_PM_OPP)
+	dev_pm_opp_of_remove_table(mdev->dev);
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0)) && defined(CONFIG_OF) \
+                        && defined(CONFIG_REGULATOR)
+	regulator_put(mdev->regulator);
+#endif /* LINUX_VERSION_CODE >= 3, 12, 0 */
+	mali_device_free(mdev);
+#endif
+
+#ifdef CONFIG_MALI_DT
+	mali_platform_device_deinit(mali_platform_device);
+#endif
+	mali_platform_device = NULL;
+	return 0;
+}
+
+static int mali_miscdevice_register(struct platform_device *pdev)
+{
+	int err;
+
+	mali_miscdevice.minor = MISC_DYNAMIC_MINOR;
+	mali_miscdevice.name = mali_dev_name;
+	mali_miscdevice.fops = &mali_fops;
+	mali_miscdevice.parent = get_device(&pdev->dev);
+
+	err = misc_register(&mali_miscdevice);
+	if (0 != err) {
+		MALI_PRINT_ERROR(("Failed to register misc device, misc_register() returned %d\n", err));
+	}
+
+	return err;
+}
+
+static void mali_miscdevice_unregister(void)
+{
+	misc_deregister(&mali_miscdevice);
+}
+
+static int mali_driver_suspend_scheduler(struct device *dev)
+{
+	struct mali_gpu_device_data *device_data =
+		mali_platform_device->dev.platform_data;
+#ifdef CONFIG_MALI_DEVFREQ
+	struct mali_device *mdev = dev_get_drvdata(dev);
+	if (!mdev)
+		return -ENODEV;
+#endif
+
+#if defined(CONFIG_MALI_DEVFREQ) && \
+                (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+	devfreq_suspend_device(mdev->devfreq);
+#endif
+
+	mali_pm_os_suspend(MALI_TRUE);
+	/* Tracing the frequency and voltage after mali is suspended */
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+				      MALI_PROFILING_EVENT_CHANNEL_GPU |
+				      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+				      0,
+				      0,
+				      0, 0, 0);
+
+	if (device_data->platform_suspend)
+		device_data->platform_suspend(dev);
+
+	return 0;
+}
+
+static int mali_driver_resume_scheduler(struct device *dev)
+{
+	struct mali_gpu_device_data *device_data =
+		mali_platform_device->dev.platform_data;
+#ifdef CONFIG_MALI_DEVFREQ
+	struct mali_device *mdev = dev_get_drvdata(dev);
+	if (!mdev)
+		return -ENODEV;
+#endif
+
+	/* Tracing the frequency and voltage after mali is resumed */
+#if defined(CONFIG_MALI400_PROFILING) && defined(CONFIG_MALI_DVFS)
+	/* Just call mali_get_current_gpu_clk_item() once,to record current clk info.*/
+	if (is_first_resume == 1) {
+		mali_get_current_gpu_clk_item(&mali_gpu_clk[1]);
+		is_first_resume = 0;
+	}
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+				      MALI_PROFILING_EVENT_CHANNEL_GPU |
+				      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+				      mali_gpu_clk[1].clock,
+				      mali_gpu_clk[1].vol / 1000,
+				      0, 0, 0);
+#endif
+	if (device_data->platform_resume)
+		device_data->platform_resume(dev);
+
+	mali_pm_os_resume();
+
+#if defined(CONFIG_MALI_DEVFREQ) && \
+                (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+	devfreq_resume_device(mdev->devfreq);
+#endif
+
+	return 0;
+}
+
+#ifdef CONFIG_PM_RUNTIME
+static int mali_driver_runtime_suspend(struct device *dev)
+{
+	struct mali_gpu_device_data *device_data =
+		mali_platform_device->dev.platform_data;
+#ifdef CONFIG_MALI_DEVFREQ
+	struct mali_device *mdev = dev_get_drvdata(dev);
+	if (!mdev)
+		return -ENODEV;
+#endif
+
+	if (MALI_TRUE == mali_pm_runtime_suspend()) {
+		/* Tracing the frequency and voltage after mali is suspended */
+		_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+					      MALI_PROFILING_EVENT_CHANNEL_GPU |
+					      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+					      0,
+					      0,
+					      0, 0, 0);
+
+#if defined(CONFIG_MALI_DEVFREQ) && \
+                (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+		MALI_DEBUG_PRINT(4, ("devfreq_suspend_device: stop devfreq monitor\n"));
+		devfreq_suspend_device(mdev->devfreq);
+#endif
+
+		if (device_data->platform_suspend)
+			device_data->platform_suspend(dev);
+
+		return 0;
+	} else {
+		return -EBUSY;
+	}
+}
+
+static int mali_driver_runtime_resume(struct device *dev)
+{
+	struct mali_gpu_device_data *device_data =
+		mali_platform_device->dev.platform_data;
+#ifdef CONFIG_MALI_DEVFREQ
+	struct mali_device *mdev = dev_get_drvdata(dev);
+	if (!mdev)
+		return -ENODEV;
+#endif
+
+	/* Tracing the frequency and voltage after mali is resumed */
+#if defined(CONFIG_MALI400_PROFILING) && defined(CONFIG_MALI_DVFS)
+	/* Just call mali_get_current_gpu_clk_item() once,to record current clk info.*/
+	if (is_first_resume == 1) {
+		mali_get_current_gpu_clk_item(&mali_gpu_clk[1]);
+		is_first_resume = 0;
+	}
+	_mali_osk_profiling_add_event(MALI_PROFILING_EVENT_TYPE_SINGLE |
+				      MALI_PROFILING_EVENT_CHANNEL_GPU |
+				      MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE,
+				      mali_gpu_clk[1].clock,
+				      mali_gpu_clk[1].vol / 1000,
+				      0, 0, 0);
+#endif
+	if (device_data->platform_resume)
+		device_data->platform_resume(dev);
+
+	mali_pm_runtime_resume();
+
+#if defined(CONFIG_MALI_DEVFREQ) && \
+                (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+	MALI_DEBUG_PRINT(4, ("devfreq_resume_device: start devfreq monitor\n"));
+	devfreq_resume_device(mdev->devfreq);
+#endif
+	return 0;
+}
+
+static int mali_driver_runtime_idle(struct device *dev)
+{
+	/* Nothing to do */
+	return 0;
+}
+#endif
+
+static int mali_open(struct inode *inode, struct file *filp)
+{
+	struct mali_session_data *session_data;
+	_mali_osk_errcode_t err;
+
+	/* input validation */
+	if (mali_miscdevice.minor != iminor(inode)) {
+		MALI_PRINT_ERROR(("mali_open() Minor does not match\n"));
+		return -ENODEV;
+	}
+
+	/* allocated struct to track this session */
+	err = _mali_ukk_open((void **)&session_data);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	/* initialize file pointer */
+	filp->f_pos = 0;
+
+	/* link in our session data */
+	filp->private_data = (void *)session_data;
+
+	filp->f_mapping = mali_mem_swap_get_global_swap_file()->f_mapping;
+
+	return 0;
+}
+
+static int mali_release(struct inode *inode, struct file *filp)
+{
+	_mali_osk_errcode_t err;
+
+	/* input validation */
+	if (mali_miscdevice.minor != iminor(inode)) {
+		MALI_PRINT_ERROR(("mali_release() Minor does not match\n"));
+		return -ENODEV;
+	}
+
+	err = _mali_ukk_close((void **)&filp->private_data);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	return 0;
+}
+
+int map_errcode(_mali_osk_errcode_t err)
+{
+	switch (err) {
+	case _MALI_OSK_ERR_OK :
+		return 0;
+	case _MALI_OSK_ERR_FAULT:
+		return -EFAULT;
+	case _MALI_OSK_ERR_INVALID_FUNC:
+		return -ENOTTY;
+	case _MALI_OSK_ERR_INVALID_ARGS:
+		return -EINVAL;
+	case _MALI_OSK_ERR_NOMEM:
+		return -ENOMEM;
+	case _MALI_OSK_ERR_TIMEOUT:
+		return -ETIMEDOUT;
+	case _MALI_OSK_ERR_RESTARTSYSCALL:
+		return -ERESTARTSYS;
+	case _MALI_OSK_ERR_ITEM_NOT_FOUND:
+		return -ENOENT;
+	default:
+		return -EFAULT;
+	}
+}
+
+#ifdef HAVE_UNLOCKED_IOCTL
+static long mali_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+#else
+static int mali_ioctl(struct inode *inode, struct file *filp, unsigned int cmd, unsigned long arg)
+#endif
+{
+	int err;
+	struct mali_session_data *session_data;
+
+#ifndef HAVE_UNLOCKED_IOCTL
+	/* inode not used */
+	(void)inode;
+#endif
+
+	MALI_DEBUG_PRINT(7, ("Ioctl received 0x%08X 0x%08lX\n", cmd, arg));
+
+	session_data = (struct mali_session_data *)filp->private_data;
+	if (NULL == session_data) {
+		MALI_DEBUG_PRINT(7, ("filp->private_data was NULL\n"));
+		return -ENOTTY;
+	}
+
+	if (NULL == (void *)arg) {
+		MALI_DEBUG_PRINT(7, ("arg was NULL\n"));
+		return -ENOTTY;
+	}
+
+	switch (cmd) {
+	case MALI_IOC_WAIT_FOR_NOTIFICATION:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_wait_for_notification_s), sizeof(u64)));
+		err = wait_for_notification_wrapper(session_data, (_mali_uk_wait_for_notification_s __user *)arg);
+		break;
+
+	case MALI_IOC_GET_API_VERSION_V2:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_get_api_version_v2_s), sizeof(u64)));
+		err = get_api_version_v2_wrapper(session_data, (_mali_uk_get_api_version_v2_s __user *)arg);
+		break;
+
+	case MALI_IOC_GET_API_VERSION:
+		err = get_api_version_wrapper(session_data, (_mali_uk_get_api_version_s __user *)arg);
+		break;
+
+	case MALI_IOC_POST_NOTIFICATION:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_post_notification_s), sizeof(u64)));
+		err = post_notification_wrapper(session_data, (_mali_uk_post_notification_s __user *)arg);
+		break;
+
+	case MALI_IOC_GET_USER_SETTINGS:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_get_user_settings_s), sizeof(u64)));
+		err = get_user_settings_wrapper(session_data, (_mali_uk_get_user_settings_s __user *)arg);
+		break;
+
+	case MALI_IOC_REQUEST_HIGH_PRIORITY:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_request_high_priority_s), sizeof(u64)));
+		err = request_high_priority_wrapper(session_data, (_mali_uk_request_high_priority_s __user *)arg);
+		break;
+
+	case MALI_IOC_PENDING_SUBMIT:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_pending_submit_s), sizeof(u64)));
+		err = pending_submit_wrapper(session_data, (_mali_uk_pending_submit_s __user *)arg);
+		break;
+
+#if defined(CONFIG_MALI400_PROFILING)
+	case MALI_IOC_PROFILING_ADD_EVENT:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_profiling_add_event_s), sizeof(u64)));
+		err = profiling_add_event_wrapper(session_data, (_mali_uk_profiling_add_event_s __user *)arg);
+		break;
+
+	case MALI_IOC_PROFILING_REPORT_SW_COUNTERS:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_sw_counters_report_s), sizeof(u64)));
+		err = profiling_report_sw_counters_wrapper(session_data, (_mali_uk_sw_counters_report_s __user *)arg);
+		break;
+
+	case MALI_IOC_PROFILING_STREAM_FD_GET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_profiling_stream_fd_get_s), sizeof(u64)));
+		err = profiling_get_stream_fd_wrapper(session_data, (_mali_uk_profiling_stream_fd_get_s __user *)arg);
+		break;
+
+	case MALI_IOC_PROILING_CONTROL_SET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_profiling_control_set_s), sizeof(u64)));
+		err = profiling_control_set_wrapper(session_data, (_mali_uk_profiling_control_set_s __user *)arg);
+		break;
+#else
+
+	case MALI_IOC_PROFILING_ADD_EVENT:          /* FALL-THROUGH */
+	case MALI_IOC_PROFILING_REPORT_SW_COUNTERS: /* FALL-THROUGH */
+		MALI_DEBUG_PRINT(2, ("Profiling not supported\n"));
+		err = -ENOTTY;
+		break;
+#endif
+
+	case MALI_IOC_PROFILING_MEMORY_USAGE_GET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_profiling_memory_usage_get_s), sizeof(u64)));
+		err = mem_usage_get_wrapper(session_data, (_mali_uk_profiling_memory_usage_get_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_ALLOC:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_alloc_mem_s), sizeof(u64)));
+		err = mem_alloc_wrapper(session_data, (_mali_uk_alloc_mem_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_FREE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_free_mem_s), sizeof(u64)));
+		err = mem_free_wrapper(session_data, (_mali_uk_free_mem_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_BIND:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_bind_mem_s), sizeof(u64)));
+		err = mem_bind_wrapper(session_data, (_mali_uk_bind_mem_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_UNBIND:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_unbind_mem_s), sizeof(u64)));
+		err = mem_unbind_wrapper(session_data, (_mali_uk_unbind_mem_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_COW:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_cow_mem_s), sizeof(u64)));
+		err = mem_cow_wrapper(session_data, (_mali_uk_cow_mem_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_COW_MODIFY_RANGE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_cow_modify_range_s), sizeof(u64)));
+		err = mem_cow_modify_range_wrapper(session_data, (_mali_uk_cow_modify_range_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_RESIZE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_mem_resize_s), sizeof(u64)));
+		err = mem_resize_mem_wrapper(session_data, (_mali_uk_mem_resize_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_WRITE_SAFE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_mem_write_safe_s), sizeof(u64)));
+		err = mem_write_safe_wrapper(session_data, (_mali_uk_mem_write_safe_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_QUERY_MMU_PAGE_TABLE_DUMP_SIZE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_query_mmu_page_table_dump_size_s), sizeof(u64)));
+		err = mem_query_mmu_page_table_dump_size_wrapper(session_data, (_mali_uk_query_mmu_page_table_dump_size_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_DUMP_MMU_PAGE_TABLE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_dump_mmu_page_table_s), sizeof(u64)));
+		err = mem_dump_mmu_page_table_wrapper(session_data, (_mali_uk_dump_mmu_page_table_s __user *)arg);
+		break;
+
+	case MALI_IOC_MEM_DMA_BUF_GET_SIZE:
+#ifdef CONFIG_DMA_SHARED_BUFFER
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_dma_buf_get_size_s), sizeof(u64)));
+		err = mali_dma_buf_get_size(session_data, (_mali_uk_dma_buf_get_size_s __user *)arg);
+#else
+		MALI_DEBUG_PRINT(2, ("DMA-BUF not supported\n"));
+		err = -ENOTTY;
+#endif
+		break;
+
+	case MALI_IOC_PP_START_JOB:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_pp_start_job_s), sizeof(u64)));
+		err = pp_start_job_wrapper(session_data, (_mali_uk_pp_start_job_s __user *)arg);
+		break;
+
+	case MALI_IOC_PP_AND_GP_START_JOB:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_pp_and_gp_start_job_s), sizeof(u64)));
+		err = pp_and_gp_start_job_wrapper(session_data, (_mali_uk_pp_and_gp_start_job_s __user *)arg);
+		break;
+
+	case MALI_IOC_PP_NUMBER_OF_CORES_GET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_get_pp_number_of_cores_s), sizeof(u64)));
+		err = pp_get_number_of_cores_wrapper(session_data, (_mali_uk_get_pp_number_of_cores_s __user *)arg);
+		break;
+
+	case MALI_IOC_PP_CORE_VERSION_GET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_get_pp_core_version_s), sizeof(u64)));
+		err = pp_get_core_version_wrapper(session_data, (_mali_uk_get_pp_core_version_s __user *)arg);
+		break;
+
+	case MALI_IOC_PP_DISABLE_WB:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_pp_disable_wb_s), sizeof(u64)));
+		err = pp_disable_wb_wrapper(session_data, (_mali_uk_pp_disable_wb_s __user *)arg);
+		break;
+
+	case MALI_IOC_GP2_START_JOB:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_gp_start_job_s), sizeof(u64)));
+		err = gp_start_job_wrapper(session_data, (_mali_uk_gp_start_job_s __user *)arg);
+		break;
+
+	case MALI_IOC_GP2_NUMBER_OF_CORES_GET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_get_gp_number_of_cores_s), sizeof(u64)));
+		err = gp_get_number_of_cores_wrapper(session_data, (_mali_uk_get_gp_number_of_cores_s __user *)arg);
+		break;
+
+	case MALI_IOC_GP2_CORE_VERSION_GET:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_get_gp_core_version_s), sizeof(u64)));
+		err = gp_get_core_version_wrapper(session_data, (_mali_uk_get_gp_core_version_s __user *)arg);
+		break;
+
+	case MALI_IOC_GP2_SUSPEND_RESPONSE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_gp_suspend_response_s), sizeof(u64)));
+		err = gp_suspend_response_wrapper(session_data, (_mali_uk_gp_suspend_response_s __user *)arg);
+		break;
+
+	case MALI_IOC_VSYNC_EVENT_REPORT:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_vsync_event_report_s), sizeof(u64)));
+		err = vsync_event_report_wrapper(session_data, (_mali_uk_vsync_event_report_s __user *)arg);
+		break;
+
+	case MALI_IOC_TIMELINE_GET_LATEST_POINT:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_timeline_get_latest_point_s), sizeof(u64)));
+		err = timeline_get_latest_point_wrapper(session_data, (_mali_uk_timeline_get_latest_point_s __user *)arg);
+		break;
+	case MALI_IOC_TIMELINE_WAIT:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_timeline_wait_s), sizeof(u64)));
+		err = timeline_wait_wrapper(session_data, (_mali_uk_timeline_wait_s __user *)arg);
+		break;
+	case MALI_IOC_TIMELINE_CREATE_SYNC_FENCE:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_timeline_create_sync_fence_s), sizeof(u64)));
+		err = timeline_create_sync_fence_wrapper(session_data, (_mali_uk_timeline_create_sync_fence_s __user *)arg);
+		break;
+	case MALI_IOC_SOFT_JOB_START:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_soft_job_start_s), sizeof(u64)));
+		err = soft_job_start_wrapper(session_data, (_mali_uk_soft_job_start_s __user *)arg);
+		break;
+	case MALI_IOC_SOFT_JOB_SIGNAL:
+		BUILD_BUG_ON(!IS_ALIGNED(sizeof(_mali_uk_soft_job_signal_s), sizeof(u64)));
+		err = soft_job_signal_wrapper(session_data, (_mali_uk_soft_job_signal_s __user *)arg);
+		break;
+
+	default:
+		MALI_DEBUG_PRINT(2, ("No handler for ioctl 0x%08X 0x%08lX\n", cmd, arg));
+		err = -ENOTTY;
+	};
+
+	return err;
+}
+
+
+module_init(mali_module_init);
+module_exit(mali_module_exit);
+
+MODULE_LICENSE(MALI_KERNEL_LINUX_LICENSE);
+MODULE_AUTHOR("ARM Ltd.");
+MODULE_VERSION(SVN_REV_STRING);
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_kernel_linux.h b/drivers/gpu/arm/mali400/linux/mali_kernel_linux.h
--- a/drivers/gpu/arm/mali400/linux/mali_kernel_linux.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_kernel_linux.h	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_KERNEL_LINUX_H__
+#define __MALI_KERNEL_LINUX_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <linux/cdev.h>     /* character device definitions */
+#include <linux/idr.h>
+#include <linux/rbtree.h>
+#include "mali_kernel_license.h"
+#include "mali_osk_types.h"
+#include <linux/version.h>
+
+extern struct platform_device *mali_platform_device;
+
+/* After 3.19.0 kenrel droped CONFIG_PM_RUNTIME define,define by ourself */
+#if defined(CONFIG_PM) && LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)
+#define CONFIG_PM_RUNTIME 1
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_KERNEL_LINUX_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.c b/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.c
--- a/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.c	2018-05-06 08:49:49.178695419 +0200
@@ -0,0 +1,1410 @@
+/**
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+
+/**
+ * @file mali_kernel_sysfs.c
+ * Implementation of some sysfs data exports
+ */
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include "mali_kernel_license.h"
+#include "mali_kernel_common.h"
+#include "mali_ukk.h"
+
+#if MALI_LICENSE_IS_GPL
+
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+#include <asm/uaccess.h>
+#include <linux/module.h>
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_sysfs.h"
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+#include <linux/slab.h>
+#include "mali_osk_profiling.h"
+#endif
+
+#include <linux/mali/mali_utgard.h>
+#include "mali_pm.h"
+#include "mali_pmu.h"
+#include "mali_group.h"
+#include "mali_gp.h"
+#include "mali_pp.h"
+#include "mali_l2_cache.h"
+#include "mali_hw_core.h"
+#include "mali_kernel_core.h"
+#include "mali_user_settings_db.h"
+#include "mali_profiling_internal.h"
+#include "mali_gp_job.h"
+#include "mali_pp_job.h"
+#include "mali_executor.h"
+
+#define PRIVATE_DATA_COUNTER_MAKE_GP(src) (src)
+#define PRIVATE_DATA_COUNTER_MAKE_PP(src) ((1 << 24) | src)
+#define PRIVATE_DATA_COUNTER_MAKE_PP_SUB_JOB(src, sub_job) ((1 << 24) | (1 << 16) | (sub_job << 8) | src)
+#define PRIVATE_DATA_COUNTER_IS_PP(a) ((((a) >> 24) & 0xFF) ? MALI_TRUE : MALI_FALSE)
+#define PRIVATE_DATA_COUNTER_GET_SRC(a) (a & 0xFF)
+#define PRIVATE_DATA_COUNTER_IS_SUB_JOB(a) ((((a) >> 16) & 0xFF) ? MALI_TRUE : MALI_FALSE)
+#define PRIVATE_DATA_COUNTER_GET_SUB_JOB(a) (((a) >> 8) & 0xFF)
+
+#define POWER_BUFFER_SIZE 3
+
+static struct dentry *mali_debugfs_dir = NULL;
+
+typedef enum {
+	_MALI_DEVICE_SUSPEND,
+	_MALI_DEVICE_RESUME,
+	_MALI_DEVICE_DVFS_PAUSE,
+	_MALI_DEVICE_DVFS_RESUME,
+	_MALI_MAX_EVENTS
+} _mali_device_debug_power_events;
+
+static const char *const mali_power_events[_MALI_MAX_EVENTS] = {
+	[_MALI_DEVICE_SUSPEND] = "suspend",
+	[_MALI_DEVICE_RESUME] = "resume",
+	[_MALI_DEVICE_DVFS_PAUSE] = "dvfs_pause",
+	[_MALI_DEVICE_DVFS_RESUME] = "dvfs_resume",
+};
+
+static mali_bool power_always_on_enabled = MALI_FALSE;
+
+static int open_copy_private_data(struct inode *inode, struct file *filp)
+{
+	filp->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t group_enabled_read(struct file *filp, char __user *buf, size_t count, loff_t *offp)
+{
+	int r;
+	char buffer[64];
+	struct mali_group *group;
+
+	group = (struct mali_group *)filp->private_data;
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	r = snprintf(buffer, 64, "%u\n",
+		     mali_executor_group_is_disabled(group) ? 0 : 1);
+
+	return simple_read_from_buffer(buf, count, offp, buffer, r);
+}
+
+static ssize_t group_enabled_write(struct file *filp, const char __user *buf, size_t count, loff_t *offp)
+{
+	int r;
+	char buffer[64];
+	unsigned long val;
+	struct mali_group *group;
+
+	group = (struct mali_group *)filp->private_data;
+	MALI_DEBUG_ASSERT_POINTER(group);
+
+	if (count >= sizeof(buffer)) {
+		return -ENOMEM;
+	}
+
+	if (copy_from_user(&buffer[0], buf, count)) {
+		return -EFAULT;
+	}
+	buffer[count] = '\0';
+
+	r = kstrtoul(&buffer[0], 10, &val);
+	if (0 != r) {
+		return -EINVAL;
+	}
+
+	switch (val) {
+	case 1:
+		mali_executor_group_enable(group);
+		break;
+	case 0:
+		mali_executor_group_disable(group);
+		break;
+	default:
+		return -EINVAL;
+		break;
+	}
+
+	*offp += count;
+	return count;
+}
+
+static const struct file_operations group_enabled_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read = group_enabled_read,
+	.write = group_enabled_write,
+};
+
+static ssize_t hw_core_base_addr_read(struct file *filp, char __user *buf, size_t count, loff_t *offp)
+{
+	int r;
+	char buffer[64];
+	struct mali_hw_core *hw_core;
+
+	hw_core = (struct mali_hw_core *)filp->private_data;
+	MALI_DEBUG_ASSERT_POINTER(hw_core);
+
+	r = snprintf(buffer, 64, "0x%lX\n", hw_core->phys_addr);
+
+	return simple_read_from_buffer(buf, count, offp, buffer, r);
+}
+
+static const struct file_operations hw_core_base_addr_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read = hw_core_base_addr_read,
+};
+
+static ssize_t profiling_counter_src_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	u32 is_pp = PRIVATE_DATA_COUNTER_IS_PP((uintptr_t)filp->private_data);
+	u32 src_id = PRIVATE_DATA_COUNTER_GET_SRC((uintptr_t)filp->private_data);
+	mali_bool is_sub_job = PRIVATE_DATA_COUNTER_IS_SUB_JOB((uintptr_t)filp->private_data);
+	u32 sub_job = PRIVATE_DATA_COUNTER_GET_SUB_JOB((uintptr_t)filp->private_data);
+	char buf[64];
+	int r;
+	u32 val;
+
+	if (MALI_TRUE == is_pp) {
+		/* PP counter */
+		if (MALI_TRUE == is_sub_job) {
+			/* Get counter for a particular sub job */
+			if (0 == src_id) {
+				val = mali_pp_job_get_pp_counter_sub_job_src0(sub_job);
+			} else {
+				val = mali_pp_job_get_pp_counter_sub_job_src1(sub_job);
+			}
+		} else {
+			/* Get default counter for all PP sub jobs */
+			if (0 == src_id) {
+				val = mali_pp_job_get_pp_counter_global_src0();
+			} else {
+				val = mali_pp_job_get_pp_counter_global_src1();
+			}
+		}
+	} else {
+		/* GP counter */
+		if (0 == src_id) {
+			val = mali_gp_job_get_gp_counter_src0();
+		} else {
+			val = mali_gp_job_get_gp_counter_src1();
+		}
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER == val) {
+		r = snprintf(buf, 64, "-1\n");
+	} else {
+		r = snprintf(buf, 64, "%u\n", val);
+	}
+
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t profiling_counter_src_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	u32 is_pp = PRIVATE_DATA_COUNTER_IS_PP((uintptr_t)filp->private_data);
+	u32 src_id = PRIVATE_DATA_COUNTER_GET_SRC((uintptr_t)filp->private_data);
+	mali_bool is_sub_job = PRIVATE_DATA_COUNTER_IS_SUB_JOB((uintptr_t)filp->private_data);
+	u32 sub_job = PRIVATE_DATA_COUNTER_GET_SUB_JOB((uintptr_t)filp->private_data);
+	char buf[64];
+	long val;
+	int ret;
+
+	if (cnt >= sizeof(buf)) {
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&buf, ubuf, cnt)) {
+		return -EFAULT;
+	}
+
+	buf[cnt] = 0;
+
+	ret = kstrtol(buf, 10, &val);
+	if (ret < 0) {
+		return ret;
+	}
+
+	if (val < 0) {
+		/* any negative input will disable counter */
+		val = MALI_HW_CORE_NO_COUNTER;
+	}
+
+	if (MALI_TRUE == is_pp) {
+		/* PP counter */
+		if (MALI_TRUE == is_sub_job) {
+			/* Set counter for a particular sub job */
+			if (0 == src_id) {
+				mali_pp_job_set_pp_counter_sub_job_src0(sub_job, (u32)val);
+			} else {
+				mali_pp_job_set_pp_counter_sub_job_src1(sub_job, (u32)val);
+			}
+		} else {
+			/* Set default counter for all PP sub jobs */
+			if (0 == src_id) {
+				mali_pp_job_set_pp_counter_global_src0((u32)val);
+			} else {
+				mali_pp_job_set_pp_counter_global_src1((u32)val);
+			}
+		}
+	} else {
+		/* GP counter */
+		if (0 == src_id) {
+			mali_gp_job_set_gp_counter_src0((u32)val);
+		} else {
+			mali_gp_job_set_gp_counter_src1((u32)val);
+		}
+	}
+
+	*ppos += cnt;
+	return cnt;
+}
+
+static const struct file_operations profiling_counter_src_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read  = profiling_counter_src_read,
+	.write = profiling_counter_src_write,
+};
+
+static ssize_t l2_l2x_counter_srcx_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos, u32 src_id)
+{
+	char buf[64];
+	int r;
+	u32 val;
+	struct mali_l2_cache_core *l2_core = (struct mali_l2_cache_core *)filp->private_data;
+
+	if (0 == src_id) {
+		val = mali_l2_cache_core_get_counter_src0(l2_core);
+	} else {
+		val = mali_l2_cache_core_get_counter_src1(l2_core);
+	}
+
+	if (MALI_HW_CORE_NO_COUNTER == val) {
+		r = snprintf(buf, 64, "-1\n");
+	} else {
+		r = snprintf(buf, 64, "%u\n", val);
+	}
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t l2_l2x_counter_srcx_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos, u32 src_id)
+{
+	struct mali_l2_cache_core *l2_core = (struct mali_l2_cache_core *)filp->private_data;
+	char buf[64];
+	long val;
+	int ret;
+
+	if (cnt >= sizeof(buf)) {
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&buf, ubuf, cnt)) {
+		return -EFAULT;
+	}
+
+	buf[cnt] = 0;
+
+	ret = kstrtol(buf, 10, &val);
+	if (ret < 0) {
+		return ret;
+	}
+
+	if (val < 0) {
+		/* any negative input will disable counter */
+		val = MALI_HW_CORE_NO_COUNTER;
+	}
+
+	mali_l2_cache_core_set_counter_src(l2_core, src_id, (u32)val);
+
+	*ppos += cnt;
+	return cnt;
+}
+
+static ssize_t l2_all_counter_srcx_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos, u32 src_id)
+{
+	char buf[64];
+	long val;
+	int ret;
+	u32 l2_id;
+	struct mali_l2_cache_core *l2_cache;
+
+	if (cnt >= sizeof(buf)) {
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&buf, ubuf, cnt)) {
+		return -EFAULT;
+	}
+
+	buf[cnt] = 0;
+
+	ret = kstrtol(buf, 10, &val);
+	if (ret < 0) {
+		return ret;
+	}
+
+	if (val < 0) {
+		/* any negative input will disable counter */
+		val = MALI_HW_CORE_NO_COUNTER;
+	}
+
+	l2_id = 0;
+	l2_cache = mali_l2_cache_core_get_glob_l2_core(l2_id);
+	while (NULL != l2_cache) {
+		mali_l2_cache_core_set_counter_src(l2_cache, src_id, (u32)val);
+
+		/* try next L2 */
+		l2_id++;
+		l2_cache = mali_l2_cache_core_get_glob_l2_core(l2_id);
+	}
+
+	*ppos += cnt;
+	return cnt;
+}
+
+static ssize_t l2_l2x_counter_src0_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_l2x_counter_srcx_read(filp, ubuf, cnt, ppos, 0);
+}
+
+static ssize_t l2_l2x_counter_src1_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_l2x_counter_srcx_read(filp, ubuf, cnt, ppos, 1);
+}
+
+static ssize_t l2_l2x_counter_src0_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_l2x_counter_srcx_write(filp, ubuf, cnt, ppos, 0);
+}
+
+static ssize_t l2_l2x_counter_src1_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_l2x_counter_srcx_write(filp, ubuf, cnt, ppos, 1);
+}
+
+static ssize_t l2_all_counter_src0_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_all_counter_srcx_write(filp, ubuf, cnt, ppos, 0);
+}
+
+static ssize_t l2_all_counter_src1_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_all_counter_srcx_write(filp, ubuf, cnt, ppos, 1);
+}
+
+static const struct file_operations l2_l2x_counter_src0_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read  = l2_l2x_counter_src0_read,
+	.write = l2_l2x_counter_src0_write,
+};
+
+static const struct file_operations l2_l2x_counter_src1_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read  = l2_l2x_counter_src1_read,
+	.write = l2_l2x_counter_src1_write,
+};
+
+static const struct file_operations l2_all_counter_src0_fops = {
+	.owner = THIS_MODULE,
+	.write = l2_all_counter_src0_write,
+};
+
+static const struct file_operations l2_all_counter_src1_fops = {
+	.owner = THIS_MODULE,
+	.write = l2_all_counter_src1_write,
+};
+
+static ssize_t l2_l2x_counter_valx_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos, u32 src_id)
+{
+	char buf[64];
+	int r;
+	u32 src0 = 0;
+	u32 val0 = 0;
+	u32 src1 = 0;
+	u32 val1 = 0;
+	u32 val = -1;
+	struct mali_l2_cache_core *l2_core = (struct mali_l2_cache_core *)filp->private_data;
+
+	mali_l2_cache_core_get_counter_values(l2_core, &src0, &val0, &src1, &val1);
+
+	if (0 == src_id) {
+		if (MALI_HW_CORE_NO_COUNTER != val0) {
+			val = val0;
+		}
+	} else {
+		if (MALI_HW_CORE_NO_COUNTER != val1) {
+			val = val1;
+		}
+	}
+
+	r = snprintf(buf, 64, "%u\n", val);
+
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t l2_l2x_counter_val0_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_l2x_counter_valx_read(filp, ubuf, cnt, ppos, 0);
+}
+
+static ssize_t l2_l2x_counter_val1_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	return l2_l2x_counter_valx_read(filp, ubuf, cnt, ppos, 1);
+}
+
+static const struct file_operations l2_l2x_counter_val0_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read  = l2_l2x_counter_val0_read,
+};
+
+static const struct file_operations l2_l2x_counter_val1_fops = {
+	.owner = THIS_MODULE,
+	.open  = open_copy_private_data,
+	.read  = l2_l2x_counter_val1_read,
+};
+
+static ssize_t power_always_on_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	unsigned long val;
+	int ret;
+	char buf[32];
+
+	cnt = min(cnt, sizeof(buf) - 1);
+	if (copy_from_user(buf, ubuf, cnt)) {
+		return -EFAULT;
+	}
+	buf[cnt] = '\0';
+
+	ret = kstrtoul(buf, 10, &val);
+	if (0 != ret) {
+		return ret;
+	}
+
+	/* Update setting (not exactly thread safe) */
+	if (1 == val && MALI_FALSE == power_always_on_enabled) {
+		power_always_on_enabled = MALI_TRUE;
+		_mali_osk_pm_dev_ref_get_sync();
+	} else if (0 == val && MALI_TRUE == power_always_on_enabled) {
+		power_always_on_enabled = MALI_FALSE;
+		_mali_osk_pm_dev_ref_put();
+	}
+
+	*ppos += cnt;
+	return cnt;
+}
+
+static ssize_t power_always_on_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	if (MALI_TRUE == power_always_on_enabled) {
+		return simple_read_from_buffer(ubuf, cnt, ppos, "1\n", 2);
+	} else {
+		return simple_read_from_buffer(ubuf, cnt, ppos, "0\n", 2);
+	}
+}
+
+static const struct file_operations power_always_on_fops = {
+	.owner = THIS_MODULE,
+	.read  = power_always_on_read,
+	.write = power_always_on_write,
+};
+
+static ssize_t power_power_events_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	if (!strncmp(ubuf, mali_power_events[_MALI_DEVICE_SUSPEND], strlen(mali_power_events[_MALI_DEVICE_SUSPEND]) - 1)) {
+		mali_pm_os_suspend(MALI_TRUE);
+	} else if (!strncmp(ubuf, mali_power_events[_MALI_DEVICE_RESUME], strlen(mali_power_events[_MALI_DEVICE_RESUME]) - 1)) {
+		mali_pm_os_resume();
+	} else if (!strncmp(ubuf, mali_power_events[_MALI_DEVICE_DVFS_PAUSE], strlen(mali_power_events[_MALI_DEVICE_DVFS_PAUSE]) - 1)) {
+		mali_dev_pause();
+	} else if (!strncmp(ubuf, mali_power_events[_MALI_DEVICE_DVFS_RESUME], strlen(mali_power_events[_MALI_DEVICE_DVFS_RESUME]) - 1)) {
+		mali_dev_resume();
+	}
+	*ppos += cnt;
+	return cnt;
+}
+
+static loff_t power_power_events_seek(struct file *file, loff_t offset, int orig)
+{
+	file->f_pos = offset;
+	return 0;
+}
+
+static const struct file_operations power_power_events_fops = {
+	.owner = THIS_MODULE,
+	.write = power_power_events_write,
+	.llseek = power_power_events_seek,
+};
+
+#if MALI_STATE_TRACKING
+static int mali_seq_internal_state_show(struct seq_file *seq_file, void *v)
+{
+	u32 len = 0;
+	u32 size;
+	char *buf;
+
+	size = seq_get_buf(seq_file, &buf);
+
+	if (!size) {
+		return -ENOMEM;
+	}
+
+	/* Create the internal state dump. */
+	len  = snprintf(buf + len, size - len, "Mali device driver %s\n", SVN_REV_STRING);
+	len += snprintf(buf + len, size - len, "License: %s\n\n", MALI_KERNEL_LINUX_LICENSE);
+
+	len += _mali_kernel_core_dump_state(buf + len, size - len);
+
+	seq_commit(seq_file, len);
+
+	return 0;
+}
+
+static int mali_seq_internal_state_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, mali_seq_internal_state_show, NULL);
+}
+
+static const struct file_operations mali_seq_internal_state_fops = {
+	.owner = THIS_MODULE,
+	.open = mali_seq_internal_state_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+#endif /* MALI_STATE_TRACKING */
+
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+static ssize_t profiling_record_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	char buf[64];
+	int r;
+
+	r = snprintf(buf, 64, "%u\n", _mali_internal_profiling_is_recording() ? 1 : 0);
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t profiling_record_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	char buf[64];
+	unsigned long val;
+	int ret;
+
+	if (cnt >= sizeof(buf)) {
+		return -EINVAL;
+	}
+
+	if (copy_from_user(&buf, ubuf, cnt)) {
+		return -EFAULT;
+	}
+
+	buf[cnt] = 0;
+
+	ret = kstrtoul(buf, 10, &val);
+	if (ret < 0) {
+		return ret;
+	}
+
+	if (val != 0) {
+		u32 limit = MALI_PROFILING_MAX_BUFFER_ENTRIES; /* This can be made configurable at a later stage if we need to */
+
+		/* check if we are already recording */
+		if (MALI_TRUE == _mali_internal_profiling_is_recording()) {
+			MALI_DEBUG_PRINT(3, ("Recording of profiling events already in progress\n"));
+			return -EFAULT;
+		}
+
+		/* check if we need to clear out an old recording first */
+		if (MALI_TRUE == _mali_internal_profiling_have_recording()) {
+			if (_MALI_OSK_ERR_OK != _mali_internal_profiling_clear()) {
+				MALI_DEBUG_PRINT(3, ("Failed to clear existing recording of profiling events\n"));
+				return -EFAULT;
+			}
+		}
+
+		/* start recording profiling data */
+		if (_MALI_OSK_ERR_OK != _mali_internal_profiling_start(&limit)) {
+			MALI_DEBUG_PRINT(3, ("Failed to start recording of profiling events\n"));
+			return -EFAULT;
+		}
+
+		MALI_DEBUG_PRINT(3, ("Profiling recording started (max %u events)\n", limit));
+	} else {
+		/* stop recording profiling data */
+		u32 count = 0;
+		if (_MALI_OSK_ERR_OK != _mali_internal_profiling_stop(&count)) {
+			MALI_DEBUG_PRINT(2, ("Failed to stop recording of profiling events\n"));
+			return -EFAULT;
+		}
+
+		MALI_DEBUG_PRINT(2, ("Profiling recording stopped (recorded %u events)\n", count));
+	}
+
+	*ppos += cnt;
+	return cnt;
+}
+
+static const struct file_operations profiling_record_fops = {
+	.owner = THIS_MODULE,
+	.read  = profiling_record_read,
+	.write = profiling_record_write,
+};
+
+static void *profiling_events_start(struct seq_file *s, loff_t *pos)
+{
+	loff_t *spos;
+
+	/* check if we have data avaiable */
+	if (MALI_TRUE != _mali_internal_profiling_have_recording()) {
+		return NULL;
+	}
+
+	spos = kmalloc(sizeof(loff_t), GFP_KERNEL);
+	if (NULL == spos) {
+		return NULL;
+	}
+
+	*spos = *pos;
+	return spos;
+}
+
+static void *profiling_events_next(struct seq_file *s, void *v, loff_t *pos)
+{
+	loff_t *spos = v;
+
+	/* check if we have data avaiable */
+	if (MALI_TRUE != _mali_internal_profiling_have_recording()) {
+		return NULL;
+	}
+
+	/* check if the next entry actually is avaiable */
+	if (_mali_internal_profiling_get_count() <= (u32)(*spos + 1)) {
+		return NULL;
+	}
+
+	*pos = ++*spos;
+	return spos;
+}
+
+static void profiling_events_stop(struct seq_file *s, void *v)
+{
+	kfree(v);
+}
+
+static int profiling_events_show(struct seq_file *seq_file, void *v)
+{
+	loff_t *spos = v;
+	u32 index;
+	u64 timestamp;
+	u32 event_id;
+	u32 data[5];
+
+	index = (u32) * spos;
+
+	/* Retrieve all events */
+	if (_MALI_OSK_ERR_OK == _mali_internal_profiling_get_event(index, &timestamp, &event_id, data)) {
+		seq_printf(seq_file, "%llu %u %u %u %u %u %u\n", timestamp, event_id, data[0], data[1], data[2], data[3], data[4]);
+		return 0;
+	}
+
+	return 0;
+}
+
+static int profiling_events_show_human_readable(struct seq_file *seq_file, void *v)
+{
+#define MALI_EVENT_ID_IS_HW(event_id) (((event_id & 0x00FF0000) >= MALI_PROFILING_EVENT_CHANNEL_GP0) && ((event_id & 0x00FF0000) <= MALI_PROFILING_EVENT_CHANNEL_PP7))
+
+	static u64 start_time = 0;
+	loff_t *spos = v;
+	u32 index;
+	u64 timestamp;
+	u32 event_id;
+	u32 data[5];
+
+	index = (u32) * spos;
+
+	/* Retrieve all events */
+	if (_MALI_OSK_ERR_OK == _mali_internal_profiling_get_event(index, &timestamp, &event_id, data)) {
+		seq_printf(seq_file, "%llu %u %u %u %u %u %u # ", timestamp, event_id, data[0], data[1], data[2], data[3], data[4]);
+
+		if (0 == index) {
+			start_time = timestamp;
+		}
+
+		seq_printf(seq_file, "[%06u] ", index);
+
+		switch (event_id & 0x0F000000) {
+		case MALI_PROFILING_EVENT_TYPE_SINGLE:
+			seq_printf(seq_file, "SINGLE | ");
+			break;
+		case MALI_PROFILING_EVENT_TYPE_START:
+			seq_printf(seq_file, "START | ");
+			break;
+		case MALI_PROFILING_EVENT_TYPE_STOP:
+			seq_printf(seq_file, "STOP | ");
+			break;
+		case MALI_PROFILING_EVENT_TYPE_SUSPEND:
+			seq_printf(seq_file, "SUSPEND | ");
+			break;
+		case MALI_PROFILING_EVENT_TYPE_RESUME:
+			seq_printf(seq_file, "RESUME | ");
+			break;
+		default:
+			seq_printf(seq_file, "0x%01X | ", (event_id & 0x0F000000) >> 24);
+			break;
+		}
+
+		switch (event_id & 0x00FF0000) {
+		case MALI_PROFILING_EVENT_CHANNEL_SOFTWARE:
+			seq_printf(seq_file, "SW | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_GP0:
+			seq_printf(seq_file, "GP0 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP0:
+			seq_printf(seq_file, "PP0 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP1:
+			seq_printf(seq_file, "PP1 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP2:
+			seq_printf(seq_file, "PP2 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP3:
+			seq_printf(seq_file, "PP3 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP4:
+			seq_printf(seq_file, "PP4 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP5:
+			seq_printf(seq_file, "PP5 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP6:
+			seq_printf(seq_file, "PP6 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_PP7:
+			seq_printf(seq_file, "PP7 | ");
+			break;
+		case MALI_PROFILING_EVENT_CHANNEL_GPU:
+			seq_printf(seq_file, "GPU | ");
+			break;
+		default:
+			seq_printf(seq_file, "0x%02X | ", (event_id & 0x00FF0000) >> 16);
+			break;
+		}
+
+		if (MALI_EVENT_ID_IS_HW(event_id)) {
+			if (((event_id & 0x0F000000) == MALI_PROFILING_EVENT_TYPE_START) || ((event_id & 0x0F000000) == MALI_PROFILING_EVENT_TYPE_STOP)) {
+				switch (event_id & 0x0000FFFF) {
+				case MALI_PROFILING_EVENT_REASON_START_STOP_HW_PHYSICAL:
+					seq_printf(seq_file, "PHYSICAL | ");
+					break;
+				case MALI_PROFILING_EVENT_REASON_START_STOP_HW_VIRTUAL:
+					seq_printf(seq_file, "VIRTUAL | ");
+					break;
+				default:
+					seq_printf(seq_file, "0x%04X | ", event_id & 0x0000FFFF);
+					break;
+				}
+			} else {
+				seq_printf(seq_file, "0x%04X | ", event_id & 0x0000FFFF);
+			}
+		} else {
+			seq_printf(seq_file, "0x%04X | ", event_id & 0x0000FFFF);
+		}
+
+		seq_printf(seq_file, "T0 + 0x%016llX\n", timestamp - start_time);
+
+		return 0;
+	}
+
+	return 0;
+}
+
+static const struct seq_operations profiling_events_seq_ops = {
+	.start = profiling_events_start,
+	.next  = profiling_events_next,
+	.stop  = profiling_events_stop,
+	.show  = profiling_events_show
+};
+
+static int profiling_events_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &profiling_events_seq_ops);
+}
+
+static const struct file_operations profiling_events_fops = {
+	.owner = THIS_MODULE,
+	.open = profiling_events_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = seq_release,
+};
+
+static const struct seq_operations profiling_events_human_readable_seq_ops = {
+	.start = profiling_events_start,
+	.next  = profiling_events_next,
+	.stop  = profiling_events_stop,
+	.show  = profiling_events_show_human_readable
+};
+
+static int profiling_events_human_readable_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &profiling_events_human_readable_seq_ops);
+}
+
+static const struct file_operations profiling_events_human_readable_fops = {
+	.owner = THIS_MODULE,
+	.open = profiling_events_human_readable_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = seq_release,
+};
+
+#endif
+
+static int memory_debugfs_show(struct seq_file *s, void *private_data)
+{
+#ifdef MALI_MEM_SWAP_TRACKING
+	seq_printf(s, "  %-25s  %-10s  %-10s  %-15s  %-15s  %-10s  %-10s %-10s \n"\
+		   "=================================================================================================================================\n",
+		   "Name (:bytes)", "pid", "mali_mem", "max_mali_mem",
+		   "external_mem", "ump_mem", "dma_mem", "swap_mem");
+#else
+	seq_printf(s, "  %-25s  %-10s  %-10s  %-15s  %-15s  %-10s  %-10s \n"\
+		   "========================================================================================================================\n",
+		   "Name (:bytes)", "pid", "mali_mem", "max_mali_mem",
+		   "external_mem", "ump_mem", "dma_mem");
+#endif
+	mali_session_memory_tracking(s);
+	return 0;
+}
+
+static int memory_debugfs_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, memory_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations memory_usage_fops = {
+	.owner = THIS_MODULE,
+	.open = memory_debugfs_open,
+	.read  = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+
+static ssize_t utilization_gp_pp_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	char buf[64];
+	size_t r;
+	u32 uval = _mali_ukk_utilization_gp_pp();
+
+	r = snprintf(buf, 64, "%u\n", uval);
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t utilization_gp_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	char buf[64];
+	size_t r;
+	u32 uval = _mali_ukk_utilization_gp();
+
+	r = snprintf(buf, 64, "%u\n", uval);
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static ssize_t utilization_pp_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	char buf[64];
+	size_t r;
+	u32 uval = _mali_ukk_utilization_pp();
+
+	r = snprintf(buf, 64, "%u\n", uval);
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+
+static const struct file_operations utilization_gp_pp_fops = {
+	.owner = THIS_MODULE,
+	.read = utilization_gp_pp_read,
+};
+
+static const struct file_operations utilization_gp_fops = {
+	.owner = THIS_MODULE,
+	.read = utilization_gp_read,
+};
+
+static const struct file_operations utilization_pp_fops = {
+	.owner = THIS_MODULE,
+	.read = utilization_pp_read,
+};
+
+static ssize_t user_settings_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	unsigned long val;
+	int ret;
+	_mali_uk_user_setting_t setting;
+	char buf[32];
+
+	cnt = min(cnt, sizeof(buf) - 1);
+	if (copy_from_user(buf, ubuf, cnt)) {
+		return -EFAULT;
+	}
+	buf[cnt] = '\0';
+
+	ret = kstrtoul(buf, 10, &val);
+	if (0 != ret) {
+		return ret;
+	}
+
+	/* Update setting */
+	setting = (_mali_uk_user_setting_t)(filp->private_data);
+	mali_set_user_setting(setting, val);
+
+	*ppos += cnt;
+	return cnt;
+}
+
+static ssize_t user_settings_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+{
+	char buf[64];
+	size_t r;
+	u32 value;
+	_mali_uk_user_setting_t setting;
+
+	setting = (_mali_uk_user_setting_t)(filp->private_data);
+	value = mali_get_user_setting(setting);
+
+	r = snprintf(buf, 64, "%u\n", value);
+	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+}
+
+static const struct file_operations user_settings_fops = {
+	.owner = THIS_MODULE,
+	.open = open_copy_private_data,
+	.read = user_settings_read,
+	.write = user_settings_write,
+};
+
+static int mali_sysfs_user_settings_register(void)
+{
+	struct dentry *mali_user_settings_dir = debugfs_create_dir("userspace_settings", mali_debugfs_dir);
+
+	if (mali_user_settings_dir != NULL) {
+		long i;
+		for (i = 0; i < _MALI_UK_USER_SETTING_MAX; i++) {
+			debugfs_create_file(_mali_uk_user_setting_descriptions[i],
+					    0600, mali_user_settings_dir, (void *)i,
+					    &user_settings_fops);
+		}
+	}
+
+	return 0;
+}
+
+static ssize_t pp_num_cores_enabled_write(struct file *filp, const char __user *buf, size_t count, loff_t *offp)
+{
+	int ret;
+	char buffer[32];
+	unsigned long val;
+
+	if (count >= sizeof(buffer)) {
+		return -ENOMEM;
+	}
+
+	if (copy_from_user(&buffer[0], buf, count)) {
+		return -EFAULT;
+	}
+	buffer[count] = '\0';
+
+	ret = kstrtoul(&buffer[0], 10, &val);
+	if (0 != ret) {
+		return -EINVAL;
+	}
+
+	ret = mali_executor_set_perf_level(val, MALI_TRUE); /* override even if core scaling is disabled */
+	if (ret) {
+		return ret;
+	}
+
+	*offp += count;
+	return count;
+}
+
+static ssize_t pp_num_cores_enabled_read(struct file *filp, char __user *buf, size_t count, loff_t *offp)
+{
+	int r;
+	char buffer[64];
+
+	r = snprintf(buffer, 64, "%u\n", mali_executor_get_num_cores_enabled());
+
+	return simple_read_from_buffer(buf, count, offp, buffer, r);
+}
+
+static const struct file_operations pp_num_cores_enabled_fops = {
+	.owner = THIS_MODULE,
+	.write = pp_num_cores_enabled_write,
+	.read = pp_num_cores_enabled_read,
+	.llseek = default_llseek,
+};
+
+static ssize_t pp_num_cores_total_read(struct file *filp, char __user *buf, size_t count, loff_t *offp)
+{
+	int r;
+	char buffer[64];
+
+	r = snprintf(buffer, 64, "%u\n", mali_executor_get_num_cores_total());
+
+	return simple_read_from_buffer(buf, count, offp, buffer, r);
+}
+
+static const struct file_operations pp_num_cores_total_fops = {
+	.owner = THIS_MODULE,
+	.read = pp_num_cores_total_read,
+};
+
+static ssize_t pp_core_scaling_enabled_write(struct file *filp, const char __user *buf, size_t count, loff_t *offp)
+{
+	int ret;
+	char buffer[32];
+	unsigned long val;
+
+	if (count >= sizeof(buffer)) {
+		return -ENOMEM;
+	}
+
+	if (copy_from_user(&buffer[0], buf, count)) {
+		return -EFAULT;
+	}
+	buffer[count] = '\0';
+
+	ret = kstrtoul(&buffer[0], 10, &val);
+	if (0 != ret) {
+		return -EINVAL;
+	}
+
+	switch (val) {
+	case 1:
+		mali_executor_core_scaling_enable();
+		break;
+	case 0:
+		mali_executor_core_scaling_disable();
+		break;
+	default:
+		return -EINVAL;
+		break;
+	}
+
+	*offp += count;
+	return count;
+}
+
+static ssize_t pp_core_scaling_enabled_read(struct file *filp, char __user *buf, size_t count, loff_t *offp)
+{
+	return simple_read_from_buffer(buf, count, offp, mali_executor_core_scaling_is_enabled() ? "1\n" : "0\n", 2);
+}
+static const struct file_operations pp_core_scaling_enabled_fops = {
+	.owner = THIS_MODULE,
+	.write = pp_core_scaling_enabled_write,
+	.read = pp_core_scaling_enabled_read,
+	.llseek = default_llseek,
+};
+
+static ssize_t version_read(struct file *filp, char __user *buf, size_t count, loff_t *offp)
+{
+	int r = 0;
+	char buffer[64];
+
+	switch (mali_kernel_core_get_product_id()) {
+	case _MALI_PRODUCT_ID_MALI200:
+		r = snprintf(buffer, 64, "Mali-200\n");
+		break;
+	case _MALI_PRODUCT_ID_MALI300:
+		r = snprintf(buffer, 64, "Mali-300\n");
+		break;
+	case _MALI_PRODUCT_ID_MALI400:
+		r = snprintf(buffer, 64, "Mali-400 MP\n");
+		break;
+	case _MALI_PRODUCT_ID_MALI450:
+		r = snprintf(buffer, 64, "Mali-450 MP\n");
+		break;
+	case _MALI_PRODUCT_ID_MALI470:
+		r = snprintf(buffer, 64, "Mali-470 MP\n");
+		break;
+	case _MALI_PRODUCT_ID_UNKNOWN:
+		return -EINVAL;
+		break;
+	};
+
+	return simple_read_from_buffer(buf, count, offp, buffer, r);
+}
+
+static const struct file_operations version_fops = {
+	.owner = THIS_MODULE,
+	.read = version_read,
+};
+
+#if defined(DEBUG)
+static int timeline_debugfs_show(struct seq_file *s, void *private_data)
+{
+	struct mali_session_data *session, *tmp;
+	u32 session_seq = 1;
+
+	seq_printf(s, "timeline system info: \n=================\n\n");
+
+	mali_session_lock();
+	MALI_SESSION_FOREACH(session, tmp, link) {
+		seq_printf(s, "session %d <%p> start:\n", session_seq, session);
+		mali_timeline_debug_print_system(session->timeline_system, s);
+		seq_printf(s, "session %d end\n\n\n", session_seq++);
+	}
+	mali_session_unlock();
+
+	return 0;
+}
+
+static int timeline_debugfs_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, timeline_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations timeline_dump_fops = {
+	.owner = THIS_MODULE,
+	.open = timeline_debugfs_open,
+	.read  = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release
+};
+#endif
+
+int mali_sysfs_register(const char *mali_dev_name)
+{
+	mali_debugfs_dir = debugfs_create_dir(mali_dev_name, NULL);
+	if (ERR_PTR(-ENODEV) == mali_debugfs_dir) {
+		/* Debugfs not supported. */
+		mali_debugfs_dir = NULL;
+	} else {
+		if (NULL != mali_debugfs_dir) {
+			/* Debugfs directory created successfully; create files now */
+			struct dentry *mali_power_dir;
+			struct dentry *mali_gp_dir;
+			struct dentry *mali_pp_dir;
+			struct dentry *mali_l2_dir;
+			struct dentry *mali_profiling_dir;
+
+			debugfs_create_file("version", 0400, mali_debugfs_dir, NULL, &version_fops);
+
+			mali_power_dir = debugfs_create_dir("power", mali_debugfs_dir);
+			if (mali_power_dir != NULL) {
+				debugfs_create_file("always_on", 0600, mali_power_dir, NULL, &power_always_on_fops);
+				debugfs_create_file("power_events", 0200, mali_power_dir, NULL, &power_power_events_fops);
+			}
+
+			mali_gp_dir = debugfs_create_dir("gp", mali_debugfs_dir);
+			if (mali_gp_dir != NULL) {
+				u32 num_groups;
+				long i;
+
+				num_groups = mali_group_get_glob_num_groups();
+				for (i = 0; i < num_groups; i++) {
+					struct mali_group *group = mali_group_get_glob_group(i);
+
+					struct mali_gp_core *gp_core = mali_group_get_gp_core(group);
+					if (NULL != gp_core) {
+						struct dentry *mali_gp_gpx_dir;
+						mali_gp_gpx_dir = debugfs_create_dir("gp0", mali_gp_dir);
+						if (NULL != mali_gp_gpx_dir) {
+							debugfs_create_file("base_addr", 0400, mali_gp_gpx_dir, &gp_core->hw_core, &hw_core_base_addr_fops);
+							debugfs_create_file("enabled", 0600, mali_gp_gpx_dir, group, &group_enabled_fops);
+						}
+						break; /* no need to look for any other GP cores */
+					}
+
+				}
+			}
+
+			mali_pp_dir = debugfs_create_dir("pp", mali_debugfs_dir);
+			if (mali_pp_dir != NULL) {
+				u32 num_groups;
+				long i;
+
+				debugfs_create_file("num_cores_total", 0400, mali_pp_dir, NULL, &pp_num_cores_total_fops);
+				debugfs_create_file("num_cores_enabled", 0600, mali_pp_dir, NULL, &pp_num_cores_enabled_fops);
+				debugfs_create_file("core_scaling_enabled", 0600, mali_pp_dir, NULL, &pp_core_scaling_enabled_fops);
+
+				num_groups = mali_group_get_glob_num_groups();
+				for (i = 0; i < num_groups; i++) {
+					struct mali_group *group = mali_group_get_glob_group(i);
+
+					struct mali_pp_core *pp_core = mali_group_get_pp_core(group);
+					if (NULL != pp_core) {
+						char buf[16];
+						struct dentry *mali_pp_ppx_dir;
+						_mali_osk_snprintf(buf, sizeof(buf), "pp%u", mali_pp_core_get_id(pp_core));
+						mali_pp_ppx_dir = debugfs_create_dir(buf, mali_pp_dir);
+						if (NULL != mali_pp_ppx_dir) {
+							debugfs_create_file("base_addr", 0400, mali_pp_ppx_dir, &pp_core->hw_core, &hw_core_base_addr_fops);
+							if (!mali_group_is_virtual(group)) {
+								debugfs_create_file("enabled", 0600, mali_pp_ppx_dir, group, &group_enabled_fops);
+							}
+						}
+					}
+				}
+			}
+
+			mali_l2_dir = debugfs_create_dir("l2", mali_debugfs_dir);
+			if (mali_l2_dir != NULL) {
+				struct dentry *mali_l2_all_dir;
+				u32 l2_id;
+				struct mali_l2_cache_core *l2_cache;
+
+				mali_l2_all_dir = debugfs_create_dir("all", mali_l2_dir);
+				if (mali_l2_all_dir != NULL) {
+					debugfs_create_file("counter_src0", 0200, mali_l2_all_dir, NULL, &l2_all_counter_src0_fops);
+					debugfs_create_file("counter_src1", 0200, mali_l2_all_dir, NULL, &l2_all_counter_src1_fops);
+				}
+
+				l2_id = 0;
+				l2_cache = mali_l2_cache_core_get_glob_l2_core(l2_id);
+				while (NULL != l2_cache) {
+					char buf[16];
+					struct dentry *mali_l2_l2x_dir;
+					_mali_osk_snprintf(buf, sizeof(buf), "l2%u", l2_id);
+					mali_l2_l2x_dir = debugfs_create_dir(buf, mali_l2_dir);
+					if (NULL != mali_l2_l2x_dir) {
+						debugfs_create_file("counter_src0", 0600, mali_l2_l2x_dir, l2_cache, &l2_l2x_counter_src0_fops);
+						debugfs_create_file("counter_src1", 0600, mali_l2_l2x_dir, l2_cache, &l2_l2x_counter_src1_fops);
+						debugfs_create_file("counter_val0", 0600, mali_l2_l2x_dir, l2_cache, &l2_l2x_counter_val0_fops);
+						debugfs_create_file("counter_val1", 0600, mali_l2_l2x_dir, l2_cache, &l2_l2x_counter_val1_fops);
+						debugfs_create_file("base_addr", 0400, mali_l2_l2x_dir, &l2_cache->hw_core, &hw_core_base_addr_fops);
+					}
+
+					/* try next L2 */
+					l2_id++;
+					l2_cache = mali_l2_cache_core_get_glob_l2_core(l2_id);
+				}
+			}
+
+			debugfs_create_file("gpu_memory", 0444, mali_debugfs_dir, NULL, &memory_usage_fops);
+
+			debugfs_create_file("utilization_gp_pp", 0400, mali_debugfs_dir, NULL, &utilization_gp_pp_fops);
+			debugfs_create_file("utilization_gp", 0400, mali_debugfs_dir, NULL, &utilization_gp_fops);
+			debugfs_create_file("utilization_pp", 0400, mali_debugfs_dir, NULL, &utilization_pp_fops);
+
+			mali_profiling_dir = debugfs_create_dir("profiling", mali_debugfs_dir);
+			if (mali_profiling_dir != NULL) {
+				u32 max_sub_jobs;
+				long i;
+				struct dentry *mali_profiling_gp_dir;
+				struct dentry *mali_profiling_pp_dir;
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+				struct dentry *mali_profiling_proc_dir;
+#endif
+				/*
+				 * Create directory where we can set GP HW counters.
+				 */
+				mali_profiling_gp_dir = debugfs_create_dir("gp", mali_profiling_dir);
+				if (mali_profiling_gp_dir != NULL) {
+					debugfs_create_file("counter_src0", 0600, mali_profiling_gp_dir, (void *)PRIVATE_DATA_COUNTER_MAKE_GP(0), &profiling_counter_src_fops);
+					debugfs_create_file("counter_src1", 0600, mali_profiling_gp_dir, (void *)PRIVATE_DATA_COUNTER_MAKE_GP(1), &profiling_counter_src_fops);
+				}
+
+				/*
+				 * Create directory where we can set PP HW counters.
+				 * Possible override with specific HW counters for a particular sub job
+				 * (Disable core scaling before using the override!)
+				 */
+				mali_profiling_pp_dir = debugfs_create_dir("pp", mali_profiling_dir);
+				if (mali_profiling_pp_dir != NULL) {
+					debugfs_create_file("counter_src0", 0600, mali_profiling_pp_dir, (void *)PRIVATE_DATA_COUNTER_MAKE_PP(0), &profiling_counter_src_fops);
+					debugfs_create_file("counter_src1", 0600, mali_profiling_pp_dir, (void *)PRIVATE_DATA_COUNTER_MAKE_PP(1), &profiling_counter_src_fops);
+				}
+
+				max_sub_jobs = mali_executor_get_num_cores_total();
+				for (i = 0; i < max_sub_jobs; i++) {
+					char buf[16];
+					struct dentry *mali_profiling_pp_x_dir;
+					_mali_osk_snprintf(buf, sizeof(buf), "%u", i);
+					mali_profiling_pp_x_dir = debugfs_create_dir(buf, mali_profiling_pp_dir);
+					if (NULL != mali_profiling_pp_x_dir) {
+						debugfs_create_file("counter_src0",
+								    0600, mali_profiling_pp_x_dir,
+								    (void *)PRIVATE_DATA_COUNTER_MAKE_PP_SUB_JOB(0, i),
+								    &profiling_counter_src_fops);
+						debugfs_create_file("counter_src1",
+								    0600, mali_profiling_pp_x_dir,
+								    (void *)PRIVATE_DATA_COUNTER_MAKE_PP_SUB_JOB(1, i),
+								    &profiling_counter_src_fops);
+					}
+				}
+
+#if defined(CONFIG_MALI400_INTERNAL_PROFILING)
+				mali_profiling_proc_dir = debugfs_create_dir("proc", mali_profiling_dir);
+				if (mali_profiling_proc_dir != NULL) {
+					struct dentry *mali_profiling_proc_default_dir = debugfs_create_dir("default", mali_profiling_proc_dir);
+					if (mali_profiling_proc_default_dir != NULL) {
+						debugfs_create_file("enable", 0600, mali_profiling_proc_default_dir, (void *)_MALI_UK_USER_SETTING_SW_EVENTS_ENABLE, &user_settings_fops);
+					}
+				}
+				debugfs_create_file("record", 0600, mali_profiling_dir, NULL, &profiling_record_fops);
+				debugfs_create_file("events", 0400, mali_profiling_dir, NULL, &profiling_events_fops);
+				debugfs_create_file("events_human_readable", 0400, mali_profiling_dir, NULL, &profiling_events_human_readable_fops);
+#endif
+			}
+
+#if MALI_STATE_TRACKING
+			debugfs_create_file("state_dump", 0400, mali_debugfs_dir, NULL, &mali_seq_internal_state_fops);
+#endif
+
+#if defined(DEBUG)
+			debugfs_create_file("timeline_dump", 0400, mali_debugfs_dir, NULL, &timeline_dump_fops);
+#endif
+			if (mali_sysfs_user_settings_register()) {
+				/* Failed to create the debugfs entries for the user settings DB. */
+				MALI_DEBUG_PRINT(2, ("Failed to create user setting debugfs files. Ignoring...\n"));
+			}
+		}
+	}
+
+	/* Success! */
+	return 0;
+}
+
+int mali_sysfs_unregister(void)
+{
+	if (NULL != mali_debugfs_dir) {
+		debugfs_remove_recursive(mali_debugfs_dir);
+	}
+	return 0;
+}
+
+#else /* MALI_LICENSE_IS_GPL */
+
+/* Dummy implementations for non-GPL */
+
+int mali_sysfs_register(struct mali_dev *device, dev_t dev, const char *mali_dev_name)
+{
+	return 0;
+}
+
+int mali_sysfs_unregister(void)
+{
+	return 0;
+}
+
+#endif /* MALI_LICENSE_IS_GPL */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.h b/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.h
--- a/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_kernel_sysfs.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2011-2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_KERNEL_SYSFS_H__
+#define __MALI_KERNEL_SYSFS_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <linux/device.h>
+
+#define MALI_PROC_DIR "driver/mali"
+
+int mali_sysfs_register(const char *mali_dev_name);
+int mali_sysfs_unregister(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_KERNEL_LINUX_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_linux_trace.h b/drivers/gpu/arm/mali400/linux/mali_linux_trace.h
--- a/drivers/gpu/arm/mali400/linux/mali_linux_trace.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_linux_trace.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#if !defined (MALI_LINUX_TRACE_H) || defined (TRACE_HEADER_MULTI_READ)
+#define MALI_LINUX_TRACE_H
+
+#include <linux/types.h>
+
+#include <linux/stringify.h>
+#include <linux/tracepoint.h>
+
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE mali_linux_trace
+
+/**
+ * Define the tracepoint used to communicate the status of a GPU. Called
+ * when a GPU turns on or turns off.
+ *
+ * @param event_id The type of the event. This parameter is a bitfield
+ *  encoding the type of the event.
+ *
+ * @param d0 First data parameter.
+ * @param d1 Second data parameter.
+ * @param d2 Third data parameter.
+ * @param d3 Fourth data parameter.
+ * @param d4 Fifth data parameter.
+ */
+TRACE_EVENT(mali_timeline_event,
+
+	    TP_PROTO(unsigned int event_id, unsigned int d0, unsigned int d1,
+		     unsigned int d2, unsigned int d3, unsigned int d4),
+
+	    TP_ARGS(event_id, d0, d1, d2, d3, d4),
+
+	    TP_STRUCT__entry(
+		    __field(unsigned int, event_id)
+		    __field(unsigned int, d0)
+		    __field(unsigned int, d1)
+		    __field(unsigned int, d2)
+		    __field(unsigned int, d3)
+		    __field(unsigned int, d4)
+	    ),
+
+	    TP_fast_assign(
+		    __entry->event_id = event_id;
+		    __entry->d0 = d0;
+		    __entry->d1 = d1;
+		    __entry->d2 = d2;
+		    __entry->d3 = d3;
+		    __entry->d4 = d4;
+	    ),
+
+	    TP_printk("event=%d", __entry->event_id)
+	   );
+
+/**
+ * Define a tracepoint used to regsiter the value of a hardware counter.
+ * Hardware counters belonging to the vertex or fragment processor are
+ * reported via this tracepoint each frame, whilst L2 cache hardware
+ * counters are reported continuously.
+ *
+ * @param counter_id The counter ID.
+ * @param value The value of the counter.
+ */
+TRACE_EVENT(mali_hw_counter,
+
+	    TP_PROTO(unsigned int counter_id, unsigned int value),
+
+	    TP_ARGS(counter_id, value),
+
+	    TP_STRUCT__entry(
+		    __field(unsigned int, counter_id)
+		    __field(unsigned int, value)
+	    ),
+
+	    TP_fast_assign(
+		    __entry->counter_id = counter_id;
+	    ),
+
+	    TP_printk("event %d = %d", __entry->counter_id, __entry->value)
+	   );
+
+/**
+ * Define a tracepoint used to send a bundle of software counters.
+ *
+ * @param counters The bundle of counters.
+ */
+TRACE_EVENT(mali_sw_counters,
+
+	    TP_PROTO(pid_t pid, pid_t tid, void *surface_id, unsigned int *counters),
+
+	    TP_ARGS(pid, tid, surface_id, counters),
+
+	    TP_STRUCT__entry(
+		    __field(pid_t, pid)
+		    __field(pid_t, tid)
+		    __field(void *, surface_id)
+		    __field(unsigned int *, counters)
+	    ),
+
+	    TP_fast_assign(
+		    __entry->pid = pid;
+		    __entry->tid = tid;
+		    __entry->surface_id = surface_id;
+		    __entry->counters = counters;
+	    ),
+
+	    TP_printk("counters were %s", __entry->counters == NULL ? "NULL" : "not NULL")
+	   );
+
+/**
+ * Define a tracepoint used to gather core activity for systrace
+ * @param pid The process id for which the core activity originates from
+ * @param active If the core is active (1) or not (0)
+ * @param core_type The type of core active, either GP (1) or PP (0)
+ * @param core_id The core id that is active for the core_type
+ * @param frame_builder_id The frame builder id associated with this core activity
+ * @param flush_id The flush id associated with this core activity
+ */
+TRACE_EVENT(mali_core_active,
+
+	    TP_PROTO(pid_t pid, unsigned int active, unsigned int core_type, unsigned int core_id, unsigned int frame_builder_id, unsigned int flush_id),
+
+	    TP_ARGS(pid, active, core_type, core_id, frame_builder_id, flush_id),
+
+	    TP_STRUCT__entry(
+		    __field(pid_t, pid)
+		    __field(unsigned int, active)
+		    __field(unsigned int, core_type)
+		    __field(unsigned int, core_id)
+		    __field(unsigned int, frame_builder_id)
+		    __field(unsigned int, flush_id)
+	    ),
+
+	    TP_fast_assign(
+		    __entry->pid = pid;
+		    __entry->active = active;
+		    __entry->core_type = core_type;
+		    __entry->core_id = core_id;
+		    __entry->frame_builder_id = frame_builder_id;
+		    __entry->flush_id = flush_id;
+	    ),
+
+	    TP_printk("%s|%d|%s%i:%x|%d", __entry->active ? "S" : "F", __entry->pid, __entry->core_type ? "GP" : "PP", __entry->core_id, __entry->flush_id, __entry->frame_builder_id)
+	   );
+
+#endif /* MALI_LINUX_TRACE_H */
+
+/* This part must exist outside the header guard. */
+#include <trace/define_trace.h>
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.c b/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_memory.h"
+#include "mali_memory_block_alloc.h"
+#include "mali_osk.h"
+#include <linux/mutex.h>
+
+
+static mali_block_allocator *mali_mem_block_gobal_allocator = NULL;
+
+unsigned long _mali_blk_item_get_phy_addr(mali_block_item *item)
+{
+	return (item->phy_addr & ~(MALI_BLOCK_REF_MASK));
+}
+
+
+unsigned long _mali_blk_item_get_pfn(mali_block_item *item)
+{
+	return (item->phy_addr / MALI_BLOCK_SIZE);
+}
+
+
+u32 mali_mem_block_get_ref_count(mali_page_node *node)
+{
+	MALI_DEBUG_ASSERT(node->type == MALI_PAGE_NODE_BLOCK);
+	return (node->blk_it->phy_addr & MALI_BLOCK_REF_MASK);
+}
+
+
+/* Increase the refence count
+* It not atomic, so it need to get sp_lock before call this function
+*/
+
+u32 mali_mem_block_add_ref(mali_page_node *node)
+{
+	MALI_DEBUG_ASSERT(node->type == MALI_PAGE_NODE_BLOCK);
+	MALI_DEBUG_ASSERT(mali_mem_block_get_ref_count(node) < MALI_BLOCK_MAX_REF_COUNT);
+	return (node->blk_it->phy_addr++ & MALI_BLOCK_REF_MASK);
+}
+
+/* Decase the refence count
+* It not atomic, so it need to get sp_lock before call this function
+*/
+u32 mali_mem_block_dec_ref(mali_page_node *node)
+{
+	MALI_DEBUG_ASSERT(node->type == MALI_PAGE_NODE_BLOCK);
+	MALI_DEBUG_ASSERT(mali_mem_block_get_ref_count(node) > 0);
+	return (node->blk_it->phy_addr-- & MALI_BLOCK_REF_MASK);
+}
+
+
+static mali_block_allocator *mali_mem_block_allocator_create(u32 base_address, u32 size)
+{
+	mali_block_allocator *info;
+	u32 usable_size;
+	u32 num_blocks;
+	mali_page_node *m_node;
+	mali_block_item *mali_blk_items = NULL;
+	int i = 0;
+
+	usable_size = size & ~(MALI_BLOCK_SIZE - 1);
+	MALI_DEBUG_PRINT(3, ("Mali block allocator create for region starting at 0x%08X length 0x%08X\n", base_address, size));
+	MALI_DEBUG_PRINT(4, ("%d usable bytes\n", usable_size));
+	num_blocks = usable_size / MALI_BLOCK_SIZE;
+	MALI_DEBUG_PRINT(4, ("which becomes %d blocks\n", num_blocks));
+
+	if (usable_size == 0) {
+		MALI_DEBUG_PRINT(1, ("Memory block of size %d is unusable\n", size));
+		return NULL;
+	}
+
+	info = _mali_osk_calloc(1, sizeof(mali_block_allocator));
+	if (NULL != info) {
+		INIT_LIST_HEAD(&info->free);
+		spin_lock_init(&info->sp_lock);
+		info->total_num = num_blocks;
+		mali_blk_items = _mali_osk_calloc(1, sizeof(mali_block_item) * num_blocks);
+
+		if (mali_blk_items) {
+			info->items = mali_blk_items;
+			/* add blocks(4k size) to free list*/
+			for (i = 0 ; i < num_blocks ; i++) {
+				/* add block information*/
+				mali_blk_items[i].phy_addr = base_address + (i * MALI_BLOCK_SIZE);
+				/* add  to free list */
+				m_node = _mali_page_node_allocate(MALI_PAGE_NODE_BLOCK);
+				if (m_node == NULL)
+					goto fail;
+				_mali_page_node_add_block_item(m_node, &(mali_blk_items[i]));
+				list_add_tail(&m_node->list, &info->free);
+				atomic_add(1, &info->free_num);
+			}
+			return info;
+		}
+	}
+fail:
+	mali_mem_block_allocator_destroy();
+	return NULL;
+}
+
+void mali_mem_block_allocator_destroy(void)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	mali_block_allocator *info = mali_mem_block_gobal_allocator;
+	MALI_DEBUG_ASSERT_POINTER(info);
+	MALI_DEBUG_PRINT(4, ("Memory block destroy !\n"));
+
+	if (NULL == info)
+		return;
+
+	list_for_each_entry_safe(m_page, m_tmp , &info->free, list) {
+		MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_BLOCK);
+		list_del(&m_page->list);
+		kfree(m_page);
+	}
+
+	_mali_osk_free(info->items);
+	_mali_osk_free(info);
+}
+
+u32 mali_mem_block_release(mali_mem_backend *mem_bkend)
+{
+	mali_mem_allocation *alloc = mem_bkend->mali_allocation;
+	u32 free_pages_nr = 0;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_BLOCK);
+
+	/* Unmap the memory from the mali virtual address space. */
+	mali_mem_block_mali_unmap(alloc);
+	mutex_lock(&mem_bkend->mutex);
+	free_pages_nr = mali_mem_block_free(&mem_bkend->block_mem);
+	mutex_unlock(&mem_bkend->mutex);
+	return free_pages_nr;
+}
+
+
+int mali_mem_block_alloc(mali_mem_block_mem *block_mem, u32 size)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	size_t page_count = PAGE_ALIGN(size) / _MALI_OSK_MALI_PAGE_SIZE;
+	mali_block_allocator *info = mali_mem_block_gobal_allocator;
+	MALI_DEBUG_ASSERT_POINTER(info);
+
+	MALI_DEBUG_PRINT(4, ("BLOCK Mem: Allocate size = 0x%x\n", size));
+	/*do some init */
+	INIT_LIST_HEAD(&block_mem->pfns);
+
+	spin_lock(&info->sp_lock);
+	/*check if have enough space*/
+	if (atomic_read(&info->free_num) > page_count) {
+		list_for_each_entry_safe(m_page, m_tmp , &info->free, list) {
+			if (page_count > 0) {
+				MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_BLOCK);
+				MALI_DEBUG_ASSERT(mali_mem_block_get_ref_count(m_page) == 0);
+				list_move(&m_page->list, &block_mem->pfns);
+				block_mem->count++;
+				atomic_dec(&info->free_num);
+				_mali_page_node_ref(m_page);
+			} else {
+				break;
+			}
+			page_count--;
+		}
+	} else {
+		/* can't allocate from BLOCK memory*/
+		spin_unlock(&info->sp_lock);
+		return -1;
+	}
+
+	spin_unlock(&info->sp_lock);
+	return 0;
+}
+
+u32 mali_mem_block_free(mali_mem_block_mem *block_mem)
+{
+	u32 free_pages_nr = 0;
+
+	free_pages_nr = mali_mem_block_free_list(&block_mem->pfns);
+	MALI_DEBUG_PRINT(4, ("BLOCK Mem free : allocated size = 0x%x, free size = 0x%x\n", block_mem->count * _MALI_OSK_MALI_PAGE_SIZE,
+			     free_pages_nr * _MALI_OSK_MALI_PAGE_SIZE));
+	block_mem->count = 0;
+	MALI_DEBUG_ASSERT(list_empty(&block_mem->pfns));
+
+	return free_pages_nr;
+}
+
+
+u32 mali_mem_block_free_list(struct list_head *list)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	mali_block_allocator *info = mali_mem_block_gobal_allocator;
+	u32 free_pages_nr = 0;
+
+	if (info) {
+		spin_lock(&info->sp_lock);
+		list_for_each_entry_safe(m_page, m_tmp , list, list) {
+			if (1 == _mali_page_node_get_ref_count(m_page)) {
+				free_pages_nr++;
+			}
+			mali_mem_block_free_node(m_page);
+		}
+		spin_unlock(&info->sp_lock);
+	}
+	return free_pages_nr;
+}
+
+/* free the node,*/
+void mali_mem_block_free_node(struct mali_page_node *node)
+{
+	mali_block_allocator *info = mali_mem_block_gobal_allocator;
+
+	/* only handle BLOCK node */
+	if (node->type == MALI_PAGE_NODE_BLOCK && info) {
+		/*Need to make this atomic?*/
+		if (1 == _mali_page_node_get_ref_count(node)) {
+			/*Move to free list*/
+			_mali_page_node_unref(node);
+			list_move_tail(&node->list, &info->free);
+			atomic_add(1, &info->free_num);
+		} else {
+			_mali_page_node_unref(node);
+			list_del(&node->list);
+			kfree(node);
+		}
+	}
+}
+
+/* unref the node, but not free it */
+_mali_osk_errcode_t mali_mem_block_unref_node(struct mali_page_node *node)
+{
+	mali_block_allocator *info = mali_mem_block_gobal_allocator;
+	mali_page_node *new_node;
+
+	/* only handle BLOCK node */
+	if (node->type == MALI_PAGE_NODE_BLOCK && info) {
+		/*Need to make this atomic?*/
+		if (1 == _mali_page_node_get_ref_count(node)) {
+			/* allocate a  new node, Add to free list, keep the old node*/
+			_mali_page_node_unref(node);
+			new_node = _mali_page_node_allocate(MALI_PAGE_NODE_BLOCK);
+			if (new_node) {
+				memcpy(new_node, node, sizeof(mali_page_node));
+				list_add(&new_node->list, &info->free);
+				atomic_add(1, &info->free_num);
+			} else
+				return _MALI_OSK_ERR_FAULT;
+
+		} else {
+			_mali_page_node_unref(node);
+		}
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+
+int mali_mem_block_mali_map(mali_mem_block_mem *block_mem, struct mali_session_data *session, u32 vaddr, u32 props)
+{
+	struct mali_page_directory *pagedir = session->page_directory;
+	struct mali_page_node *m_page;
+	dma_addr_t phys;
+	u32 virt = vaddr;
+	u32 prop = props;
+
+	list_for_each_entry(m_page, &block_mem->pfns, list) {
+		MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_BLOCK);
+		phys = _mali_page_node_get_dma_addr(m_page);
+#if defined(CONFIG_ARCH_DMA_ADDR_T_64BIT)
+		/* Verify that the "physical" address is 32-bit and
+		 * usable for Mali, when on a system with bus addresses
+		 * wider than 32-bit. */
+		MALI_DEBUG_ASSERT(0 == (phys >> 32));
+#endif
+		mali_mmu_pagedir_update(pagedir, virt, (mali_dma_addr)phys, MALI_MMU_PAGE_SIZE, prop);
+		virt += MALI_MMU_PAGE_SIZE;
+	}
+
+	return 0;
+}
+
+void mali_mem_block_mali_unmap(mali_mem_allocation *alloc)
+{
+	struct mali_session_data *session;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	mali_session_memory_lock(session);
+	mali_mem_mali_map_free(session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+			       alloc->flags);
+	mali_session_memory_unlock(session);
+}
+
+
+int mali_mem_block_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma)
+{
+	int ret;
+	mali_mem_block_mem *block_mem = &mem_bkend->block_mem;
+	unsigned long addr = vma->vm_start;
+	struct mali_page_node *m_page;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_BLOCK);
+
+	list_for_each_entry(m_page, &block_mem->pfns, list) {
+		MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_BLOCK);
+		ret = vm_insert_pfn(vma, addr, _mali_page_node_get_pfn(m_page));
+
+		if (unlikely(0 != ret)) {
+			return -EFAULT;
+		}
+		addr += _MALI_OSK_MALI_PAGE_SIZE;
+
+	}
+
+	return 0;
+}
+
+
+_mali_osk_errcode_t mali_memory_core_resource_dedicated_memory(u32 start, u32 size)
+{
+	mali_block_allocator *allocator;
+
+	/* Do the low level linux operation first */
+
+	/* Request ownership of the memory */
+	if (_MALI_OSK_ERR_OK != _mali_osk_mem_reqregion(start, size, "Dedicated Mali GPU memory")) {
+		MALI_DEBUG_PRINT(1, ("Failed to request memory region for frame buffer (0x%08X - 0x%08X)\n", start, start + size - 1));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Create generic block allocator object to handle it */
+	allocator = mali_mem_block_allocator_create(start, size);
+
+	if (NULL == allocator) {
+		MALI_DEBUG_PRINT(1, ("Memory bank registration failed\n"));
+		_mali_osk_mem_unreqregion(start, size);
+		MALI_ERROR(_MALI_OSK_ERR_FAULT);
+	}
+
+	mali_mem_block_gobal_allocator = (mali_block_allocator *)allocator;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+mali_bool mali_memory_have_dedicated_memory(void)
+{
+	return mali_mem_block_gobal_allocator ? MALI_TRUE : MALI_FALSE;
+}
+
+u32 mali_mem_block_allocator_stat(void)
+{
+	mali_block_allocator *allocator = mali_mem_block_gobal_allocator;
+	MALI_DEBUG_ASSERT_POINTER(allocator);
+
+	return (allocator->total_num - atomic_read(&allocator->free_num)) * _MALI_OSK_MALI_PAGE_SIZE;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.h b/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_block_alloc.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010, 2013, 2015-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_BLOCK_ALLOCATOR_H__
+#define __MALI_BLOCK_ALLOCATOR_H__
+
+#include "mali_session.h"
+#include "mali_memory.h"
+#include <linux/spinlock.h>
+
+#include "mali_memory_types.h"
+
+#define MALI_BLOCK_SIZE (PAGE_SIZE)  /* 4 kB, manage BLOCK memory as page size */
+#define MALI_BLOCK_REF_MASK (0xFFF)
+#define MALI_BLOCK_MAX_REF_COUNT (0xFFF)
+
+
+
+typedef struct mali_block_allocator {
+	/*
+	* In free list, each node's ref_count is 0,
+	* ref_count added when allocated or referenced in COW
+	*/
+	mali_block_item *items; /* information for each block item*/
+	struct list_head free; /*free list of mali_memory_node*/
+	spinlock_t sp_lock; /*lock for reference count & free list opertion*/
+	u32 total_num; /* Number of total pages*/
+	atomic_t free_num; /*number of free pages*/
+} mali_block_allocator;
+
+unsigned long _mali_blk_item_get_phy_addr(mali_block_item *item);
+unsigned long _mali_blk_item_get_pfn(mali_block_item *item);
+u32 mali_mem_block_get_ref_count(mali_page_node *node);
+u32 mali_mem_block_add_ref(mali_page_node *node);
+u32 mali_mem_block_dec_ref(mali_page_node *node);
+u32 mali_mem_block_release(mali_mem_backend *mem_bkend);
+int mali_mem_block_alloc(mali_mem_block_mem *block_mem, u32 size);
+int mali_mem_block_mali_map(mali_mem_block_mem *block_mem, struct mali_session_data *session, u32 vaddr, u32 props);
+void mali_mem_block_mali_unmap(mali_mem_allocation *alloc);
+
+int mali_mem_block_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma);
+_mali_osk_errcode_t mali_memory_core_resource_dedicated_memory(u32 start, u32 size);
+mali_bool mali_memory_have_dedicated_memory(void);
+u32 mali_mem_block_free(mali_mem_block_mem *block_mem);
+u32 mali_mem_block_free_list(struct list_head *list);
+void mali_mem_block_free_node(struct mali_page_node *node);
+void mali_mem_block_allocator_destroy(void);
+_mali_osk_errcode_t mali_mem_block_unref_node(struct mali_page_node *node);
+u32 mali_mem_block_allocator_stat(void);
+
+#endif /* __MALI_BLOCK_ALLOCATOR_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory.c b/drivers/gpu/arm/mali400/linux/mali_memory.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,531 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <linux/platform_device.h>
+#include <linux/idr.h>
+
+#include "mali_osk.h"
+#include "mali_executor.h"
+
+#include "mali_memory.h"
+#include "mali_memory_os_alloc.h"
+#include "mali_memory_block_alloc.h"
+#include "mali_memory_util.h"
+#include "mali_memory_virtual.h"
+#include "mali_memory_manager.h"
+#include "mali_memory_cow.h"
+#include "mali_memory_swap_alloc.h"
+#include "mali_memory_defer_bind.h"
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+#include "mali_memory_secure.h"
+#endif
+
+extern unsigned int mali_dedicated_mem_size;
+extern unsigned int mali_shared_mem_size;
+
+#define MALI_VM_NUM_FAULT_PREFETCH (0x8)
+
+static void mali_mem_vma_open(struct vm_area_struct *vma)
+{
+	mali_mem_allocation *alloc = (mali_mem_allocation *)vma->vm_private_data;
+	MALI_DEBUG_PRINT(4, ("Open called on vma %p\n", vma));
+
+	/* If need to share the allocation, add ref_count here */
+	mali_allocation_ref(alloc);
+	return;
+}
+static void mali_mem_vma_close(struct vm_area_struct *vma)
+{
+	/* If need to share the allocation, unref ref_count here */
+	mali_mem_allocation *alloc = (mali_mem_allocation *)vma->vm_private_data;
+
+	mali_allocation_unref(&alloc);
+	vma->vm_private_data = NULL;
+}
+
+static int mali_mem_vma_fault(struct vm_fault *vmf)
+{
+	struct vm_area_struct *vma = vmf->vma;
+	mali_mem_allocation *alloc = (mali_mem_allocation *)vma->vm_private_data;
+	mali_mem_backend *mem_bkend = NULL;
+	int ret;
+	int prefetch_num = MALI_VM_NUM_FAULT_PREFETCH;
+
+	unsigned long address = vmf->address;
+	MALI_DEBUG_ASSERT(alloc->backend_handle);
+	MALI_DEBUG_ASSERT((unsigned long)alloc->cpu_mapping.addr <= address);
+
+	/* Get backend memory & Map on CPU */
+	mutex_lock(&mali_idr_mutex);
+	if (!(mem_bkend = idr_find(&mali_backend_idr, alloc->backend_handle))) {
+		MALI_DEBUG_PRINT(1, ("Can't find memory backend in mmap!\n"));
+		mutex_unlock(&mali_idr_mutex);
+		return VM_FAULT_SIGBUS;
+	}
+	mutex_unlock(&mali_idr_mutex);
+	MALI_DEBUG_ASSERT(mem_bkend->type == alloc->type);
+
+	if ((mem_bkend->type == MALI_MEM_COW && (MALI_MEM_BACKEND_FLAG_SWAP_COWED !=
+			(mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED))) &&
+	    (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_COW_CPU_NO_WRITE)) {
+		/*check if use page fault to do COW*/
+		MALI_DEBUG_PRINT(4, ("mali_vma_fault: do cow allocate on demand!, address=0x%x\n", address));
+		mutex_lock(&mem_bkend->mutex);
+		ret = mali_mem_cow_allocate_on_demand(mem_bkend,
+						      (address - vma->vm_start) / PAGE_SIZE);
+		mutex_unlock(&mem_bkend->mutex);
+
+		if (ret != _MALI_OSK_ERR_OK) {
+			return VM_FAULT_OOM;
+		}
+		prefetch_num = 1;
+
+		/* handle COW modified range cpu mapping
+		 we zap the mapping in cow_modify_range, it will trigger page fault
+		 when CPU access it, so here we map it to CPU*/
+		mutex_lock(&mem_bkend->mutex);
+		ret = mali_mem_cow_cpu_map_pages_locked(mem_bkend, vma, address, prefetch_num);
+		mutex_unlock(&mem_bkend->mutex);
+
+		if (unlikely(ret != _MALI_OSK_ERR_OK)) {
+			return VM_FAULT_SIGBUS;
+		}
+	} else if ((mem_bkend->type == MALI_MEM_SWAP) ||
+		   (mem_bkend->type == MALI_MEM_COW && (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED))) {
+		u32 offset_in_bkend = (address - vma->vm_start) / PAGE_SIZE;
+		int ret = _MALI_OSK_ERR_OK;
+
+		mutex_lock(&mem_bkend->mutex);
+		if (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_COW_CPU_NO_WRITE) {
+			ret = mali_mem_swap_cow_page_on_demand(mem_bkend, offset_in_bkend, &vmf->page);
+		} else {
+			ret = mali_mem_swap_allocate_page_on_demand(mem_bkend, offset_in_bkend, &vmf->page);
+		}
+		mutex_unlock(&mem_bkend->mutex);
+
+		if (ret != _MALI_OSK_ERR_OK) {
+			MALI_DEBUG_PRINT(2, ("Mali swap memory page fault process failed, address=0x%x\n", address));
+			return VM_FAULT_OOM;
+		} else {
+			return VM_FAULT_LOCKED;
+		}
+	} else {
+		MALI_PRINT_ERROR(("Mali vma fault! It never happen, indicating some logic errors in caller.\n"));
+		/*NOT support yet or OOM*/
+		return VM_FAULT_OOM;
+	}
+	return VM_FAULT_NOPAGE;
+}
+
+static struct vm_operations_struct mali_kernel_vm_ops = {
+	.open = mali_mem_vma_open,
+	.close = mali_mem_vma_close,
+	.fault = mali_mem_vma_fault,
+};
+
+
+/** @ map mali allocation to CPU address
+*
+* Supported backend types:
+* --MALI_MEM_OS
+* -- need to add COW?
+ *Not supported backend types:
+* -_MALI_MEMORY_BIND_BACKEND_UMP
+* -_MALI_MEMORY_BIND_BACKEND_DMA_BUF
+* -_MALI_MEMORY_BIND_BACKEND_EXTERNAL_MEMORY
+*
+*/
+int mali_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct mali_session_data *session;
+	mali_mem_allocation *mali_alloc = NULL;
+	u32 mali_addr = vma->vm_pgoff << PAGE_SHIFT;
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_backend *mem_bkend = NULL;
+	int ret = -EFAULT;
+
+	session = (struct mali_session_data *)filp->private_data;
+	if (NULL == session) {
+		MALI_PRINT_ERROR(("mmap called without any session data available\n"));
+		return -EFAULT;
+	}
+
+	MALI_DEBUG_PRINT(4, ("MMap() handler: start=0x%08X, phys=0x%08X, size=0x%08X vma->flags 0x%08x\n",
+			     (unsigned int)vma->vm_start, (unsigned int)(vma->vm_pgoff << PAGE_SHIFT),
+			     (unsigned int)(vma->vm_end - vma->vm_start), vma->vm_flags));
+
+	/* Operations used on any memory system */
+	/* do not need to anything in vm open/close now */
+
+	/* find mali allocation structure by vaddress*/
+	mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_addr, 0);
+	if (likely(mali_vma_node)) {
+		mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+		MALI_DEBUG_ASSERT(mali_addr == mali_vma_node->vm_node.start);
+		if (unlikely(mali_addr != mali_vma_node->vm_node.start)) {
+			/* only allow to use start address for mmap */
+			MALI_DEBUG_PRINT(1, ("mali_addr != mali_vma_node->vm_node.start\n"));
+			return -EFAULT;
+		}
+	} else {
+		MALI_DEBUG_ASSERT(NULL == mali_vma_node);
+		return -EFAULT;
+	}
+
+	mali_alloc->cpu_mapping.addr = (void __user *)vma->vm_start;
+
+	if (mali_alloc->flags & _MALI_MEMORY_ALLOCATE_DEFER_BIND) {
+		MALI_DEBUG_PRINT(1, ("ERROR : trying to access varying memory by CPU!\n"));
+		return -EFAULT;
+	}
+
+	/* Get backend memory & Map on CPU */
+	mutex_lock(&mali_idr_mutex);
+	if (!(mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle))) {
+		MALI_DEBUG_PRINT(1, ("Can't find memory backend in mmap!\n"));
+		mutex_unlock(&mali_idr_mutex);
+		return -EFAULT;
+	}
+	mutex_unlock(&mali_idr_mutex);
+
+	if (!(MALI_MEM_SWAP == mali_alloc->type ||
+	      (MALI_MEM_COW == mali_alloc->type && (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED)))) {
+		/* Set some bits which indicate that, the memory is IO memory, meaning
+		 * that no paging is to be performed and the memory should not be
+		 * included in crash dumps. And that the memory is reserved, meaning
+		 * that it's present and can never be paged out (see also previous
+		 * entry)
+		 */
+		vma->vm_flags |= VM_IO;
+		vma->vm_flags |= VM_DONTCOPY;
+		vma->vm_flags |= VM_PFNMAP;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0)
+		vma->vm_flags |= VM_RESERVED;
+#else
+		vma->vm_flags |= VM_DONTDUMP;
+		vma->vm_flags |= VM_DONTEXPAND;
+#endif
+	} else if (MALI_MEM_SWAP == mali_alloc->type) {
+		vma->vm_pgoff = mem_bkend->start_idx;
+	}
+
+	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+	vma->vm_ops = &mali_kernel_vm_ops;
+
+	mali_alloc->cpu_mapping.addr = (void __user *)vma->vm_start;
+
+	/* If it's a copy-on-write mapping, map to read only */
+	if (!(vma->vm_flags & VM_WRITE)) {
+		MALI_DEBUG_PRINT(4, ("mmap allocation with read only !\n"));
+		/* add VM_WRITE for do_page_fault will check this when a write fault */
+		vma->vm_flags |= VM_WRITE | VM_READ;
+		vma->vm_page_prot = PAGE_READONLY;
+		vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+		mem_bkend->flags |= MALI_MEM_BACKEND_FLAG_COW_CPU_NO_WRITE;
+		goto out;
+	}
+
+	if (mem_bkend->type == MALI_MEM_OS) {
+		ret = mali_mem_os_cpu_map(mem_bkend, vma);
+	} else if (mem_bkend->type == MALI_MEM_COW &&
+		   (MALI_MEM_BACKEND_FLAG_SWAP_COWED != (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED))) {
+		ret = mali_mem_cow_cpu_map(mem_bkend, vma);
+	} else if (mem_bkend->type == MALI_MEM_BLOCK) {
+		ret = mali_mem_block_cpu_map(mem_bkend, vma);
+	} else if ((mem_bkend->type == MALI_MEM_SWAP) || (mem_bkend->type == MALI_MEM_COW &&
+			(MALI_MEM_BACKEND_FLAG_SWAP_COWED == (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED)))) {
+		/*For swappable memory, CPU page table will be created by page fault handler. */
+		ret = 0;
+	} else if (mem_bkend->type == MALI_MEM_SECURE) {
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+		ret = mali_mem_secure_cpu_map(mem_bkend, vma);
+#else
+		MALI_DEBUG_PRINT(1, ("DMA not supported for mali secure memory\n"));
+		return -EFAULT;
+#endif
+	} else {
+		/* Not support yet*/
+		MALI_DEBUG_PRINT_ERROR(("Invalid type of backend memory! \n"));
+		return -EFAULT;
+	}
+
+	if (ret != 0) {
+		MALI_DEBUG_PRINT(1, ("ret != 0\n"));
+		return -EFAULT;
+	}
+out:
+	MALI_DEBUG_ASSERT(MALI_MEM_ALLOCATION_VALID_MAGIC == mali_alloc->magic);
+
+	vma->vm_private_data = (void *)mali_alloc;
+	mali_alloc->cpu_mapping.vma = vma;
+
+	mali_allocation_ref(mali_alloc);
+
+	return 0;
+}
+
+_mali_osk_errcode_t mali_mem_mali_map_prepare(mali_mem_allocation *descriptor)
+{
+	u32 size = descriptor->psize;
+	struct mali_session_data *session = descriptor->session;
+
+	MALI_DEBUG_ASSERT(MALI_MEM_ALLOCATION_VALID_MAGIC == descriptor->magic);
+
+	/* Map dma-buf into this session's page tables */
+
+	if (descriptor->flags & MALI_MEM_FLAG_MALI_GUARD_PAGE) {
+		size += MALI_MMU_PAGE_SIZE;
+	}
+
+	return mali_mmu_pagedir_map(session->page_directory, descriptor->mali_vma_node.vm_node.start, size);
+}
+
+_mali_osk_errcode_t mali_mem_mali_map_resize(mali_mem_allocation *descriptor, u32 new_size)
+{
+	u32 old_size = descriptor->psize;
+	struct mali_session_data *session = descriptor->session;
+
+	MALI_DEBUG_ASSERT(MALI_MEM_ALLOCATION_VALID_MAGIC == descriptor->magic);
+
+	if (descriptor->flags & MALI_MEM_FLAG_MALI_GUARD_PAGE) {
+		new_size  += MALI_MMU_PAGE_SIZE;
+	}
+
+	if (new_size > old_size) {
+		MALI_DEBUG_ASSERT(new_size <= descriptor->mali_vma_node.vm_node.size);
+		return mali_mmu_pagedir_map(session->page_directory, descriptor->mali_vma_node.vm_node.start + old_size, new_size - old_size);
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mem_mali_map_free(struct mali_session_data *session, u32 size, mali_address_t vaddr, u32 flags)
+{
+	if (flags & MALI_MEM_FLAG_MALI_GUARD_PAGE) {
+		size += MALI_MMU_PAGE_SIZE;
+	}
+
+	/* Umap and flush L2 */
+	mali_mmu_pagedir_unmap(session->page_directory, vaddr, size);
+	mali_executor_zap_all_active(session);
+}
+
+u32 _mali_ukk_report_memory_usage(void)
+{
+	u32 sum = 0;
+
+	if (MALI_TRUE == mali_memory_have_dedicated_memory()) {
+		sum += mali_mem_block_allocator_stat();
+	}
+
+	sum += mali_mem_os_stat();
+
+	return sum;
+}
+
+u32 _mali_ukk_report_total_memory_size(void)
+{
+	return mali_dedicated_mem_size + mali_shared_mem_size;
+}
+
+
+/**
+ * Per-session memory descriptor mapping table sizes
+ */
+#define MALI_MEM_DESCRIPTORS_INIT 64
+#define MALI_MEM_DESCRIPTORS_MAX 65536
+
+_mali_osk_errcode_t mali_memory_session_begin(struct mali_session_data *session_data)
+{
+	MALI_DEBUG_PRINT(5, ("Memory session begin\n"));
+
+	session_data->memory_lock = _mali_osk_mutex_init(_MALI_OSK_LOCKFLAG_ORDERED,
+				    _MALI_OSK_LOCK_ORDER_MEM_SESSION);
+
+	if (NULL == session_data->memory_lock) {
+		MALI_ERROR(_MALI_OSK_ERR_FAULT);
+	}
+
+	session_data->cow_lock = _mali_osk_mutex_init(_MALI_OSK_LOCKFLAG_UNORDERED, 0);
+	if (NULL == session_data->cow_lock) {
+		_mali_osk_mutex_term(session_data->memory_lock);
+		MALI_ERROR(_MALI_OSK_ERR_FAULT);
+	}
+
+	mali_memory_manager_init(&session_data->allocation_mgr);
+
+	MALI_DEBUG_PRINT(5, ("MMU session begin: success\n"));
+	MALI_SUCCESS;
+}
+
+void mali_memory_session_end(struct mali_session_data *session)
+{
+	MALI_DEBUG_PRINT(3, ("MMU session end\n"));
+
+	if (NULL == session) {
+		MALI_DEBUG_PRINT(1, ("No session data found during session end\n"));
+		return;
+	}
+	/* free allocation */
+	mali_free_session_allocations(session);
+	/* do some check in unint*/
+	mali_memory_manager_uninit(&session->allocation_mgr);
+
+	/* Free the lock */
+	_mali_osk_mutex_term(session->memory_lock);
+	_mali_osk_mutex_term(session->cow_lock);
+	return;
+}
+
+_mali_osk_errcode_t mali_memory_initialize(void)
+{
+	_mali_osk_errcode_t err;
+
+	idr_init(&mali_backend_idr);
+	mutex_init(&mali_idr_mutex);
+
+	err = mali_mem_swap_init();
+	if (err != _MALI_OSK_ERR_OK) {
+		return err;
+	}
+	err = mali_mem_os_init();
+	if (_MALI_OSK_ERR_OK == err) {
+		err = mali_mem_defer_bind_manager_init();
+	}
+
+	return err;
+}
+
+void mali_memory_terminate(void)
+{
+	mali_mem_swap_term();
+	mali_mem_defer_bind_manager_destory();
+	mali_mem_os_term();
+	if (mali_memory_have_dedicated_memory()) {
+		mali_mem_block_allocator_destroy();
+	}
+}
+
+
+struct mali_page_node *_mali_page_node_allocate(mali_page_node_type type)
+{
+	mali_page_node *page_node = NULL;
+
+	page_node = kzalloc(sizeof(mali_page_node), GFP_KERNEL);
+	MALI_DEBUG_ASSERT(NULL != page_node);
+
+	if (page_node) {
+		page_node->type = type;
+		INIT_LIST_HEAD(&page_node->list);
+	}
+
+	return page_node;
+}
+
+void _mali_page_node_ref(struct mali_page_node *node)
+{
+	if (node->type == MALI_PAGE_NODE_OS) {
+		/* add ref to this page */
+		get_page(node->page);
+	} else if (node->type == MALI_PAGE_NODE_BLOCK) {
+		mali_mem_block_add_ref(node);
+	} else if (node->type == MALI_PAGE_NODE_SWAP) {
+		atomic_inc(&node->swap_it->ref_count);
+	} else {
+		MALI_DEBUG_PRINT_ERROR(("Invalid type of mali page node! \n"));
+	}
+}
+
+void _mali_page_node_unref(struct mali_page_node *node)
+{
+	if (node->type == MALI_PAGE_NODE_OS) {
+		/* unref to this page */
+		put_page(node->page);
+	} else if (node->type == MALI_PAGE_NODE_BLOCK) {
+		mali_mem_block_dec_ref(node);
+	} else {
+		MALI_DEBUG_PRINT_ERROR(("Invalid type of mali page node! \n"));
+	}
+}
+
+
+void _mali_page_node_add_page(struct mali_page_node *node, struct page *page)
+{
+	MALI_DEBUG_ASSERT(MALI_PAGE_NODE_OS == node->type);
+	node->page = page;
+}
+
+
+void _mali_page_node_add_swap_item(struct mali_page_node *node, struct mali_swap_item *item)
+{
+	MALI_DEBUG_ASSERT(MALI_PAGE_NODE_SWAP == node->type);
+	node->swap_it = item;
+}
+
+void _mali_page_node_add_block_item(struct mali_page_node *node, mali_block_item *item)
+{
+	MALI_DEBUG_ASSERT(MALI_PAGE_NODE_BLOCK == node->type);
+	node->blk_it = item;
+}
+
+
+int _mali_page_node_get_ref_count(struct mali_page_node *node)
+{
+	if (node->type == MALI_PAGE_NODE_OS) {
+		/* get ref count of this page */
+		return page_count(node->page);
+	} else if (node->type == MALI_PAGE_NODE_BLOCK) {
+		return mali_mem_block_get_ref_count(node);
+	} else if (node->type == MALI_PAGE_NODE_SWAP) {
+		return atomic_read(&node->swap_it->ref_count);
+	} else {
+		MALI_DEBUG_PRINT_ERROR(("Invalid type of mali page node! \n"));
+	}
+	return -1;
+}
+
+
+dma_addr_t _mali_page_node_get_dma_addr(struct mali_page_node *node)
+{
+	if (node->type == MALI_PAGE_NODE_OS) {
+		return page_private(node->page);
+	} else if (node->type == MALI_PAGE_NODE_BLOCK) {
+		return _mali_blk_item_get_phy_addr(node->blk_it);
+	} else if (node->type == MALI_PAGE_NODE_SWAP) {
+		return node->swap_it->dma_addr;
+	} else {
+		MALI_DEBUG_PRINT_ERROR(("Invalid type of mali page node! \n"));
+	}
+	return 0;
+}
+
+
+unsigned long _mali_page_node_get_pfn(struct mali_page_node *node)
+{
+	if (node->type == MALI_PAGE_NODE_OS) {
+		return page_to_pfn(node->page);
+	} else if (node->type == MALI_PAGE_NODE_BLOCK) {
+		/* get phy addr for BLOCK page*/
+		return _mali_blk_item_get_pfn(node->blk_it);
+	} else if (node->type == MALI_PAGE_NODE_SWAP) {
+		return page_to_pfn(node->swap_it->page);
+	} else {
+		MALI_DEBUG_PRINT_ERROR(("Invalid type of mali page node! \n"));
+	}
+	return 0;
+}
+
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_cow.c b/drivers/gpu/arm/mali400/linux/mali_memory_cow.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_cow.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_cow.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,776 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/mm.h>
+#include <linux/list.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/highmem.h>
+#include <asm/cacheflush.h>
+#include <linux/sched.h>
+#ifdef CONFIG_ARM
+#include <asm/outercache.h>
+#endif
+#include <asm/dma-mapping.h>
+
+#include "mali_memory.h"
+#include "mali_kernel_common.h"
+#include "mali_uk_types.h"
+#include "mali_osk.h"
+#include "mali_kernel_linux.h"
+#include "mali_memory_cow.h"
+#include "mali_memory_block_alloc.h"
+#include "mali_memory_swap_alloc.h"
+
+/**
+* allocate pages for COW backend and flush cache
+*/
+static struct page *mali_mem_cow_alloc_page(void)
+
+{
+	mali_mem_os_mem os_mem;
+	struct mali_page_node *node;
+	struct page *new_page;
+
+	int ret = 0;
+	/* allocate pages from os mem */
+	ret = mali_mem_os_alloc_pages(&os_mem, _MALI_OSK_MALI_PAGE_SIZE);
+
+	if (ret) {
+		return NULL;
+	}
+
+	MALI_DEBUG_ASSERT(1 == os_mem.count);
+
+	node = _MALI_OSK_CONTAINER_OF(os_mem.pages.next, struct mali_page_node, list);
+	new_page = node->page;
+	node->page = NULL;
+	list_del(&node->list);
+	kfree(node);
+
+	return new_page;
+}
+
+
+static struct list_head *_mali_memory_cow_get_node_list(mali_mem_backend *target_bk,
+		u32 target_offset,
+		u32 target_size)
+{
+	MALI_DEBUG_ASSERT(MALI_MEM_OS == target_bk->type || MALI_MEM_COW == target_bk->type ||
+			  MALI_MEM_BLOCK == target_bk->type || MALI_MEM_SWAP == target_bk->type);
+
+	if (MALI_MEM_OS == target_bk->type) {
+		MALI_DEBUG_ASSERT(&target_bk->os_mem);
+		MALI_DEBUG_ASSERT(((target_size + target_offset) / _MALI_OSK_MALI_PAGE_SIZE) <= target_bk->os_mem.count);
+		return &target_bk->os_mem.pages;
+	} else if (MALI_MEM_COW == target_bk->type) {
+		MALI_DEBUG_ASSERT(&target_bk->cow_mem);
+		MALI_DEBUG_ASSERT(((target_size + target_offset) / _MALI_OSK_MALI_PAGE_SIZE) <= target_bk->cow_mem.count);
+		return  &target_bk->cow_mem.pages;
+	} else if (MALI_MEM_BLOCK == target_bk->type) {
+		MALI_DEBUG_ASSERT(&target_bk->block_mem);
+		MALI_DEBUG_ASSERT(((target_size + target_offset) / _MALI_OSK_MALI_PAGE_SIZE) <= target_bk->block_mem.count);
+		return  &target_bk->block_mem.pfns;
+	} else if (MALI_MEM_SWAP == target_bk->type) {
+		MALI_DEBUG_ASSERT(&target_bk->swap_mem);
+		MALI_DEBUG_ASSERT(((target_size + target_offset) / _MALI_OSK_MALI_PAGE_SIZE) <= target_bk->swap_mem.count);
+		return  &target_bk->swap_mem.pages;
+	}
+
+	return NULL;
+}
+
+/**
+* Do COW for os memory - support do COW for memory from bank memory
+* The range_start/size can be zero, which means it will call cow_modify_range
+* latter.
+* This function allocate new pages for COW backend from os mem for a modified range
+* It will keep the page which not in the modified range and Add ref to it
+*
+* @target_bk - target allocation's backend(the allocation need to do COW)
+* @target_offset - the offset in target allocation to do COW(for support COW  a memory allocated from memory_bank, 4K align)
+* @target_size - size of target allocation to do COW (for support memory bank)
+* @backend -COW backend
+* @range_start - offset of modified range (4K align)
+* @range_size - size of modified range
+*/
+_mali_osk_errcode_t mali_memory_cow_os_memory(mali_mem_backend *target_bk,
+		u32 target_offset,
+		u32 target_size,
+		mali_mem_backend *backend,
+		u32 range_start,
+		u32 range_size)
+{
+	mali_mem_cow *cow = &backend->cow_mem;
+	struct mali_page_node *m_page, *m_tmp, *page_node;
+	int target_page = 0;
+	struct page *new_page;
+	struct list_head *pages = NULL;
+
+	pages = _mali_memory_cow_get_node_list(target_bk, target_offset, target_size);
+
+	if (NULL == pages) {
+		MALI_DEBUG_PRINT_ERROR(("No memory page  need to cow ! \n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	MALI_DEBUG_ASSERT(0 == cow->count);
+
+	INIT_LIST_HEAD(&cow->pages);
+	mutex_lock(&target_bk->mutex);
+	list_for_each_entry_safe(m_page, m_tmp, pages, list) {
+		/* add page from (target_offset,target_offset+size) to cow backend */
+		if ((target_page >= target_offset / _MALI_OSK_MALI_PAGE_SIZE) &&
+		    (target_page < ((target_size + target_offset) / _MALI_OSK_MALI_PAGE_SIZE))) {
+
+			/* allocate a new page node, alway use OS memory for COW */
+			page_node = _mali_page_node_allocate(MALI_PAGE_NODE_OS);
+
+			if (NULL == page_node) {
+				mutex_unlock(&target_bk->mutex);
+				goto error;
+			}
+
+			INIT_LIST_HEAD(&page_node->list);
+
+			/* check if in the modified range*/
+			if ((cow->count >= range_start / _MALI_OSK_MALI_PAGE_SIZE) &&
+			    (cow->count < (range_start + range_size) / _MALI_OSK_MALI_PAGE_SIZE)) {
+				/* need to allocate a new page */
+				/* To simplify the case, All COW memory is allocated from os memory ?*/
+				new_page = mali_mem_cow_alloc_page();
+
+				if (NULL == new_page) {
+					kfree(page_node);
+					mutex_unlock(&target_bk->mutex);
+					goto error;
+				}
+
+				_mali_page_node_add_page(page_node, new_page);
+			} else {
+				/*Add Block memory case*/
+				if (m_page->type != MALI_PAGE_NODE_BLOCK) {
+					_mali_page_node_add_page(page_node, m_page->page);
+				} else {
+					page_node->type = MALI_PAGE_NODE_BLOCK;
+					_mali_page_node_add_block_item(page_node, m_page->blk_it);
+				}
+
+				/* add ref to this page */
+				_mali_page_node_ref(m_page);
+			}
+
+			/* add it to COW backend page list */
+			list_add_tail(&page_node->list, &cow->pages);
+			cow->count++;
+		}
+		target_page++;
+	}
+	mutex_unlock(&target_bk->mutex);
+	return _MALI_OSK_ERR_OK;
+error:
+	mali_mem_cow_release(backend, MALI_FALSE);
+	return _MALI_OSK_ERR_FAULT;
+}
+
+_mali_osk_errcode_t mali_memory_cow_swap_memory(mali_mem_backend *target_bk,
+		u32 target_offset,
+		u32 target_size,
+		mali_mem_backend *backend,
+		u32 range_start,
+		u32 range_size)
+{
+	mali_mem_cow *cow = &backend->cow_mem;
+	struct mali_page_node *m_page, *m_tmp, *page_node;
+	int target_page = 0;
+	struct mali_swap_item *swap_item;
+	struct list_head *pages = NULL;
+
+	pages = _mali_memory_cow_get_node_list(target_bk, target_offset, target_size);
+	if (NULL == pages) {
+		MALI_DEBUG_PRINT_ERROR(("No swap memory page need to cow ! \n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	MALI_DEBUG_ASSERT(0 == cow->count);
+
+	INIT_LIST_HEAD(&cow->pages);
+	mutex_lock(&target_bk->mutex);
+
+	backend->flags |= MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN;
+
+	list_for_each_entry_safe(m_page, m_tmp, pages, list) {
+		/* add page from (target_offset,target_offset+size) to cow backend */
+		if ((target_page >= target_offset / _MALI_OSK_MALI_PAGE_SIZE) &&
+		    (target_page < ((target_size + target_offset) / _MALI_OSK_MALI_PAGE_SIZE))) {
+
+			/* allocate a new page node, use swap memory for COW memory swap cowed flag. */
+			page_node = _mali_page_node_allocate(MALI_PAGE_NODE_SWAP);
+
+			if (NULL == page_node) {
+				mutex_unlock(&target_bk->mutex);
+				goto error;
+			}
+
+			/* check if in the modified range*/
+			if ((cow->count >= range_start / _MALI_OSK_MALI_PAGE_SIZE) &&
+			    (cow->count < (range_start + range_size) / _MALI_OSK_MALI_PAGE_SIZE)) {
+				/* need to allocate a new page */
+				/* To simplify the case, All COW memory is allocated from os memory ?*/
+				swap_item = mali_mem_swap_alloc_swap_item();
+
+				if (NULL == swap_item) {
+					kfree(page_node);
+					mutex_unlock(&target_bk->mutex);
+					goto error;
+				}
+
+				swap_item->idx = mali_mem_swap_idx_alloc();
+
+				if (_MALI_OSK_BITMAP_INVALIDATE_INDEX == swap_item->idx) {
+					MALI_DEBUG_PRINT(1, ("Failed to allocate swap index in swap CoW.\n"));
+					kfree(page_node);
+					kfree(swap_item);
+					mutex_unlock(&target_bk->mutex);
+					goto error;
+				}
+
+				_mali_page_node_add_swap_item(page_node, swap_item);
+			} else {
+				_mali_page_node_add_swap_item(page_node, m_page->swap_it);
+
+				/* add ref to this page */
+				_mali_page_node_ref(m_page);
+			}
+
+			list_add_tail(&page_node->list, &cow->pages);
+			cow->count++;
+		}
+		target_page++;
+	}
+	mutex_unlock(&target_bk->mutex);
+
+	return _MALI_OSK_ERR_OK;
+error:
+	mali_mem_swap_release(backend, MALI_FALSE);
+	return _MALI_OSK_ERR_FAULT;
+
+}
+
+
+_mali_osk_errcode_t _mali_mem_put_page_node(mali_page_node *node)
+{
+	if (node->type == MALI_PAGE_NODE_OS) {
+		return mali_mem_os_put_page(node->page);
+	} else if (node->type == MALI_PAGE_NODE_BLOCK) {
+		return mali_mem_block_unref_node(node);
+	} else if (node->type == MALI_PAGE_NODE_SWAP) {
+		return _mali_mem_swap_put_page_node(node);
+	} else
+		MALI_DEBUG_ASSERT(0);
+	return _MALI_OSK_ERR_FAULT;
+}
+
+
+/**
+* Modify a range of a exist COW backend
+* @backend -COW backend
+* @range_start - offset of modified range (4K align)
+* @range_size - size of modified range(in byte)
+*/
+_mali_osk_errcode_t mali_memory_cow_modify_range(mali_mem_backend *backend,
+		u32 range_start,
+		u32 range_size)
+{
+	mali_mem_allocation *alloc = NULL;
+	struct mali_session_data *session;
+	mali_mem_cow *cow = &backend->cow_mem;
+	struct mali_page_node *m_page, *m_tmp;
+	LIST_HEAD(pages);
+	struct page *new_page;
+	u32 count = 0;
+	s32 change_pages_nr = 0;
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_OK;
+
+	if (range_start % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+	if (range_size % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+
+	alloc = backend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == backend->type);
+	MALI_DEBUG_ASSERT(((range_start + range_size) / _MALI_OSK_MALI_PAGE_SIZE) <= cow->count);
+
+	mutex_lock(&backend->mutex);
+
+	/* free pages*/
+	list_for_each_entry_safe(m_page, m_tmp, &cow->pages, list) {
+
+		/* check if in the modified range*/
+		if ((count >= range_start / _MALI_OSK_MALI_PAGE_SIZE) &&
+		    (count < (range_start + range_size) / _MALI_OSK_MALI_PAGE_SIZE)) {
+			if (MALI_PAGE_NODE_SWAP != m_page->type) {
+				new_page = mali_mem_cow_alloc_page();
+
+				if (NULL == new_page) {
+					goto error;
+				}
+				if (1 != _mali_page_node_get_ref_count(m_page))
+					change_pages_nr++;
+				/* unref old page*/
+				_mali_osk_mutex_wait(session->cow_lock);
+				if (_mali_mem_put_page_node(m_page)) {
+					__free_page(new_page);
+					_mali_osk_mutex_signal(session->cow_lock);
+					goto error;
+				}
+				_mali_osk_mutex_signal(session->cow_lock);
+				/* add new page*/
+				/* always use OS for COW*/
+				m_page->type = MALI_PAGE_NODE_OS;
+				_mali_page_node_add_page(m_page, new_page);
+			} else {
+				struct mali_swap_item *swap_item;
+
+				swap_item = mali_mem_swap_alloc_swap_item();
+
+				if (NULL == swap_item) {
+					goto error;
+				}
+
+				swap_item->idx = mali_mem_swap_idx_alloc();
+
+				if (_MALI_OSK_BITMAP_INVALIDATE_INDEX == swap_item->idx) {
+					MALI_DEBUG_PRINT(1, ("Failed to allocate swap index in swap CoW modify range.\n"));
+					kfree(swap_item);
+					goto error;
+				}
+
+				if (1 != _mali_page_node_get_ref_count(m_page)) {
+					change_pages_nr++;
+				}
+
+				if (_mali_mem_put_page_node(m_page)) {
+					mali_mem_swap_free_swap_item(swap_item);
+					goto error;
+				}
+
+				_mali_page_node_add_swap_item(m_page, swap_item);
+			}
+		}
+		count++;
+	}
+	cow->change_pages_nr  = change_pages_nr;
+
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == alloc->type);
+
+	/* ZAP cpu mapping(modified range), and do cpu mapping here if need */
+	if (NULL != alloc->cpu_mapping.vma) {
+		MALI_DEBUG_ASSERT(0 != alloc->backend_handle);
+		MALI_DEBUG_ASSERT(NULL != alloc->cpu_mapping.vma);
+		MALI_DEBUG_ASSERT(alloc->cpu_mapping.vma->vm_end - alloc->cpu_mapping.vma->vm_start >= range_size);
+
+		if (MALI_MEM_BACKEND_FLAG_SWAP_COWED != (backend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED)) {
+			zap_vma_ptes(alloc->cpu_mapping.vma, alloc->cpu_mapping.vma->vm_start + range_start, range_size);
+
+			ret = mali_mem_cow_cpu_map_pages_locked(backend, alloc->cpu_mapping.vma, alloc->cpu_mapping.vma->vm_start  + range_start, range_size / _MALI_OSK_MALI_PAGE_SIZE);
+
+			if (unlikely(ret != _MALI_OSK_ERR_OK)) {
+				MALI_DEBUG_PRINT(2, ("mali_memory_cow_modify_range: cpu mapping failed !\n"));
+				ret =  _MALI_OSK_ERR_FAULT;
+			}
+		} else {
+			/* used to trigger page fault for swappable cowed memory. */
+			alloc->cpu_mapping.vma->vm_flags |= VM_PFNMAP;
+			alloc->cpu_mapping.vma->vm_flags |= VM_MIXEDMAP;
+
+			zap_vma_ptes(alloc->cpu_mapping.vma, alloc->cpu_mapping.vma->vm_start + range_start, range_size);
+			/* delete this flag to let swappble is ummapped regard to stauct page not page frame. */
+			alloc->cpu_mapping.vma->vm_flags &= ~VM_PFNMAP;
+			alloc->cpu_mapping.vma->vm_flags &= ~VM_MIXEDMAP;
+		}
+	}
+
+error:
+	mutex_unlock(&backend->mutex);
+	return ret;
+
+}
+
+
+/**
+* Allocate pages for COW backend
+* @alloc  -allocation for COW allocation
+* @target_bk - target allocation's backend(the allocation need to do COW)
+* @target_offset - the offset in target allocation to do COW(for support COW  a memory allocated from memory_bank, 4K align)
+* @target_size - size of target allocation to do COW (for support memory bank)(in byte)
+* @backend -COW backend
+* @range_start - offset of modified range (4K align)
+* @range_size - size of modified range(in byte)
+*/
+_mali_osk_errcode_t mali_memory_do_cow(mali_mem_backend *target_bk,
+				       u32 target_offset,
+				       u32 target_size,
+				       mali_mem_backend *backend,
+				       u32 range_start,
+				       u32 range_size)
+{
+	struct mali_session_data *session = backend->mali_allocation->session;
+
+	MALI_CHECK_NON_NULL(session, _MALI_OSK_ERR_INVALID_ARGS);
+
+	/* size & offset must be a multiple of the system page size */
+	if (target_size % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+	if (range_size % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+	if (target_offset % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+	if (range_start % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+
+	/* check backend type */
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == backend->type);
+
+	switch (target_bk->type) {
+	case MALI_MEM_OS:
+	case MALI_MEM_BLOCK:
+		return mali_memory_cow_os_memory(target_bk, target_offset, target_size, backend, range_start, range_size);
+		break;
+	case MALI_MEM_COW:
+		if (backend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED) {
+			return mali_memory_cow_swap_memory(target_bk, target_offset, target_size, backend, range_start, range_size);
+		} else {
+			return mali_memory_cow_os_memory(target_bk, target_offset, target_size, backend, range_start, range_size);
+		}
+		break;
+	case MALI_MEM_SWAP:
+		return mali_memory_cow_swap_memory(target_bk, target_offset, target_size, backend, range_start, range_size);
+		break;
+	case MALI_MEM_EXTERNAL:
+		/*NOT support yet*/
+		MALI_DEBUG_PRINT_ERROR(("External physical memory not supported ! \n"));
+		return _MALI_OSK_ERR_UNSUPPORTED;
+		break;
+	case MALI_MEM_DMA_BUF:
+		/*NOT support yet*/
+		MALI_DEBUG_PRINT_ERROR(("DMA buffer not supported ! \n"));
+		return _MALI_OSK_ERR_UNSUPPORTED;
+		break;
+	case MALI_MEM_UMP:
+		/*NOT support yet*/
+		MALI_DEBUG_PRINT_ERROR(("UMP buffer not supported ! \n"));
+		return _MALI_OSK_ERR_UNSUPPORTED;
+		break;
+	default:
+		/*Not support yet*/
+		MALI_DEBUG_PRINT_ERROR(("Invalid memory type not supported ! \n"));
+		return _MALI_OSK_ERR_UNSUPPORTED;
+		break;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+
+/**
+* Map COW backend memory to mali
+* Support OS/BLOCK for mali_page_node
+*/
+int mali_mem_cow_mali_map(mali_mem_backend *mem_bkend, u32 range_start, u32 range_size)
+{
+	mali_mem_allocation *cow_alloc;
+	struct mali_page_node *m_page;
+	struct mali_session_data *session;
+	struct mali_page_directory *pagedir;
+	u32 virt, start;
+
+	cow_alloc = mem_bkend->mali_allocation;
+	virt = cow_alloc->mali_vma_node.vm_node.start;
+	start = virt;
+
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend);
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == mem_bkend->type);
+	MALI_DEBUG_ASSERT_POINTER(cow_alloc);
+
+	session = cow_alloc->session;
+	pagedir = session->page_directory;
+	MALI_CHECK_NON_NULL(session, _MALI_OSK_ERR_INVALID_ARGS);
+	list_for_each_entry(m_page, &mem_bkend->cow_mem.pages, list) {
+		if ((virt - start >= range_start) && (virt - start < range_start + range_size)) {
+			dma_addr_t phys = _mali_page_node_get_dma_addr(m_page);
+#if defined(CONFIG_ARCH_DMA_ADDR_T_64BIT)
+			MALI_DEBUG_ASSERT(0 == (phys >> 32));
+#endif
+			mali_mmu_pagedir_update(pagedir, virt, (mali_dma_addr)phys,
+						MALI_MMU_PAGE_SIZE, MALI_MMU_FLAGS_DEFAULT);
+		}
+		virt += MALI_MMU_PAGE_SIZE;
+	}
+	return 0;
+}
+
+/**
+* Map COW backend to cpu
+* support OS/BLOCK memory
+*/
+int mali_mem_cow_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma)
+{
+	mali_mem_cow *cow = &mem_bkend->cow_mem;
+	struct mali_page_node *m_page;
+	int ret;
+	unsigned long addr = vma->vm_start;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_COW);
+
+	list_for_each_entry(m_page, &cow->pages, list) {
+		/* We should use vm_insert_page, but it does a dcache
+		 * flush which makes it way slower than remap_pfn_range or vm_insert_pfn.
+		ret = vm_insert_page(vma, addr, page);
+		*/
+		ret = vm_insert_pfn(vma, addr, _mali_page_node_get_pfn(m_page));
+
+		if (unlikely(0 != ret)) {
+			return ret;
+		}
+		addr += _MALI_OSK_MALI_PAGE_SIZE;
+	}
+
+	return 0;
+}
+
+/**
+* Map some pages(COW backend) to CPU vma@vaddr
+*@ mem_bkend - COW backend
+*@ vma
+*@ vaddr -start CPU vaddr mapped to
+*@ num - max number of pages to map to CPU vaddr
+*/
+_mali_osk_errcode_t mali_mem_cow_cpu_map_pages_locked(mali_mem_backend *mem_bkend,
+		struct vm_area_struct *vma,
+		unsigned long vaddr,
+		int num)
+{
+	mali_mem_cow *cow = &mem_bkend->cow_mem;
+	struct mali_page_node *m_page;
+	int ret;
+	int offset;
+	int count ;
+	unsigned long vstart = vma->vm_start;
+	count = 0;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_COW);
+	MALI_DEBUG_ASSERT(0 == vaddr % _MALI_OSK_MALI_PAGE_SIZE);
+	MALI_DEBUG_ASSERT(0 == vstart % _MALI_OSK_MALI_PAGE_SIZE);
+	offset = (vaddr - vstart) / _MALI_OSK_MALI_PAGE_SIZE;
+
+	list_for_each_entry(m_page, &cow->pages, list) {
+		if ((count >= offset) && (count < offset + num)) {
+			ret = vm_insert_pfn(vma, vaddr, _mali_page_node_get_pfn(m_page));
+
+			if (unlikely(0 != ret)) {
+				if (count == offset) {
+					return _MALI_OSK_ERR_FAULT;
+				} else {
+					/* ret is EBUSY when page isn't in modify range, but now it's OK*/
+					return _MALI_OSK_ERR_OK;
+				}
+			}
+			vaddr += _MALI_OSK_MALI_PAGE_SIZE;
+		}
+		count++;
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+/**
+* Release COW backend memory
+* free it directly(put_page--unref page), not put into pool
+*/
+u32 mali_mem_cow_release(mali_mem_backend *mem_bkend, mali_bool is_mali_mapped)
+{
+	mali_mem_allocation *alloc;
+	struct mali_session_data *session;
+	u32 free_pages_nr = 0;
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend);
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == mem_bkend->type);
+	alloc = mem_bkend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (MALI_MEM_BACKEND_FLAG_SWAP_COWED != (MALI_MEM_BACKEND_FLAG_SWAP_COWED & mem_bkend->flags)) {
+		/* Unmap the memory from the mali virtual address space. */
+		if (MALI_TRUE == is_mali_mapped)
+			mali_mem_os_mali_unmap(alloc);
+		/* free cow backend list*/
+		_mali_osk_mutex_wait(session->cow_lock);
+		free_pages_nr = mali_mem_os_free(&mem_bkend->cow_mem.pages, mem_bkend->cow_mem.count, MALI_TRUE);
+		_mali_osk_mutex_signal(session->cow_lock);
+
+		free_pages_nr += mali_mem_block_free_list(&mem_bkend->cow_mem.pages);
+
+		MALI_DEBUG_ASSERT(list_empty(&mem_bkend->cow_mem.pages));
+	} else {
+		free_pages_nr = mali_mem_swap_release(mem_bkend, is_mali_mapped);
+	}
+
+
+	MALI_DEBUG_PRINT(4, ("COW Mem free : allocated size = 0x%x, free size = 0x%x\n", mem_bkend->cow_mem.count * _MALI_OSK_MALI_PAGE_SIZE,
+			     free_pages_nr * _MALI_OSK_MALI_PAGE_SIZE));
+
+	mem_bkend->cow_mem.count = 0;
+	return free_pages_nr;
+}
+
+
+/* Dst node could os node or swap node. */
+void _mali_mem_cow_copy_page(mali_page_node *src_node, mali_page_node *dst_node)
+{
+	void *dst, *src;
+	struct page *dst_page;
+	dma_addr_t dma_addr;
+
+	MALI_DEBUG_ASSERT(src_node != NULL);
+	MALI_DEBUG_ASSERT(dst_node != NULL);
+	MALI_DEBUG_ASSERT(dst_node->type == MALI_PAGE_NODE_OS
+			  || dst_node->type == MALI_PAGE_NODE_SWAP);
+
+	if (dst_node->type == MALI_PAGE_NODE_OS) {
+		dst_page = dst_node->page;
+	} else {
+		dst_page = dst_node->swap_it->page;
+	}
+
+	dma_unmap_page(&mali_platform_device->dev, _mali_page_node_get_dma_addr(dst_node),
+		       _MALI_OSK_MALI_PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+	/* map it , and copy the content*/
+	dst = kmap_atomic(dst_page);
+
+	if (src_node->type == MALI_PAGE_NODE_OS ||
+	    src_node->type == MALI_PAGE_NODE_SWAP) {
+		struct page *src_page;
+
+		if (src_node->type == MALI_PAGE_NODE_OS) {
+			src_page = src_node->page;
+		} else {
+			src_page = src_node->swap_it->page;
+		}
+
+		/* Clear and invaliate cache */
+		/* In ARM architecture, speculative read may pull stale data into L1 cache
+		 * for kernel linear mapping page table. DMA_BIDIRECTIONAL could
+		 * invalidate the L1 cache so that following read get the latest data
+		*/
+		dma_unmap_page(&mali_platform_device->dev, _mali_page_node_get_dma_addr(src_node),
+			       _MALI_OSK_MALI_PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+		src = kmap_atomic(src_page);
+		memcpy(dst, src , _MALI_OSK_MALI_PAGE_SIZE);
+		kunmap_atomic(src);
+		dma_addr = dma_map_page(&mali_platform_device->dev, src_page,
+					0, _MALI_OSK_MALI_PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+		if (src_node->type == MALI_PAGE_NODE_SWAP) {
+			src_node->swap_it->dma_addr = dma_addr;
+		}
+	} else if (src_node->type == MALI_PAGE_NODE_BLOCK) {
+		/*
+		* use ioremap to map src for BLOCK memory
+		*/
+		src = ioremap_nocache(_mali_page_node_get_dma_addr(src_node), _MALI_OSK_MALI_PAGE_SIZE);
+		memcpy(dst, src , _MALI_OSK_MALI_PAGE_SIZE);
+		iounmap(src);
+	}
+	kunmap_atomic(dst);
+	dma_addr = dma_map_page(&mali_platform_device->dev, dst_page,
+				0, _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+
+	if (dst_node->type == MALI_PAGE_NODE_SWAP) {
+		dst_node->swap_it->dma_addr = dma_addr;
+	}
+}
+
+
+/*
+* allocate page on demand when CPU access it,
+* THis used in page fault handler
+*/
+_mali_osk_errcode_t mali_mem_cow_allocate_on_demand(mali_mem_backend *mem_bkend, u32 offset_page)
+{
+	struct page *new_page = NULL;
+	struct mali_page_node *new_node = NULL;
+	int i = 0;
+	struct mali_page_node *m_page, *found_node = NULL;
+	struct  mali_session_data *session = NULL;
+	mali_mem_cow *cow = &mem_bkend->cow_mem;
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == mem_bkend->type);
+	MALI_DEBUG_ASSERT(offset_page < mem_bkend->size / _MALI_OSK_MALI_PAGE_SIZE);
+	MALI_DEBUG_PRINT(4, ("mali_mem_cow_allocate_on_demand !, offset_page =0x%x\n", offset_page));
+
+	/* allocate new page here */
+	new_page = mali_mem_cow_alloc_page();
+	if (!new_page)
+		return _MALI_OSK_ERR_NOMEM;
+
+	new_node = _mali_page_node_allocate(MALI_PAGE_NODE_OS);
+	if (!new_node) {
+		__free_page(new_page);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	/* find the page in backend*/
+	list_for_each_entry(m_page, &cow->pages, list) {
+		if (i == offset_page) {
+			found_node = m_page;
+			break;
+		}
+		i++;
+	}
+	MALI_DEBUG_ASSERT(found_node);
+	if (NULL == found_node) {
+		__free_page(new_page);
+		kfree(new_node);
+		return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	}
+
+	_mali_page_node_add_page(new_node, new_page);
+
+	/* Copy the src page's content to new page */
+	_mali_mem_cow_copy_page(found_node, new_node);
+
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend->mali_allocation);
+	session = mem_bkend->mali_allocation->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+	if (1 != _mali_page_node_get_ref_count(found_node)) {
+		atomic_add(1, &session->mali_mem_allocated_pages);
+		if (atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > session->max_mali_mem_allocated_size) {
+			session->max_mali_mem_allocated_size = atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+		}
+		mem_bkend->cow_mem.change_pages_nr++;
+	}
+
+	_mali_osk_mutex_wait(session->cow_lock);
+	if (_mali_mem_put_page_node(found_node)) {
+		__free_page(new_page);
+		kfree(new_node);
+		_mali_osk_mutex_signal(session->cow_lock);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+	_mali_osk_mutex_signal(session->cow_lock);
+
+	list_replace(&found_node->list, &new_node->list);
+
+	kfree(found_node);
+
+	/* map to GPU side*/
+	_mali_osk_mutex_wait(session->memory_lock);
+	mali_mem_cow_mali_map(mem_bkend, offset_page * _MALI_OSK_MALI_PAGE_SIZE, _MALI_OSK_MALI_PAGE_SIZE);
+	_mali_osk_mutex_signal(session->memory_lock);
+	return _MALI_OSK_ERR_OK;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_cow.h b/drivers/gpu/arm/mali400/linux/mali_memory_cow.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_cow.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_cow.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_COW_H__
+#define __MALI_MEMORY_COW_H__
+
+#include "mali_osk.h"
+#include "mali_session.h"
+#include "mali_memory_types.h"
+
+int mali_mem_cow_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma);
+_mali_osk_errcode_t mali_mem_cow_cpu_map_pages_locked(mali_mem_backend *mem_bkend,
+		struct vm_area_struct *vma,
+		unsigned long vaddr,
+		int num);
+
+_mali_osk_errcode_t mali_memory_do_cow(mali_mem_backend *target_bk,
+				       u32 target_offset,
+				       u32 target_size,
+				       mali_mem_backend *backend,
+				       u32 range_start,
+				       u32 range_size);
+
+_mali_osk_errcode_t mali_memory_cow_modify_range(mali_mem_backend *backend,
+		u32 range_start,
+		u32 range_size);
+
+_mali_osk_errcode_t mali_memory_cow_os_memory(mali_mem_backend *target_bk,
+		u32 target_offset,
+		u32 target_size,
+		mali_mem_backend *backend,
+		u32 range_start,
+		u32 range_size);
+
+void _mali_mem_cow_copy_page(mali_page_node *src_node, mali_page_node *dst_node);
+
+int mali_mem_cow_mali_map(mali_mem_backend *mem_bkend, u32 range_start, u32 range_size);
+u32 mali_mem_cow_release(mali_mem_backend *mem_bkend, mali_bool is_mali_mapped);
+_mali_osk_errcode_t mali_mem_cow_allocate_on_demand(mali_mem_backend *mem_bkend, u32 offset_page);
+#endif
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.c b/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/mm.h>
+#include <linux/list.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/highmem.h>
+#include <asm/cacheflush.h>
+#include <linux/sched.h>
+#ifdef CONFIG_ARM
+#include <asm/outercache.h>
+#endif
+#include <asm/dma-mapping.h>
+
+#include "mali_memory.h"
+#include "mali_kernel_common.h"
+#include "mali_uk_types.h"
+#include "mali_osk.h"
+#include "mali_kernel_linux.h"
+#include "mali_memory_defer_bind.h"
+#include "mali_executor.h"
+#include "mali_osk.h"
+#include "mali_scheduler.h"
+#include "mali_gp_job.h"
+
+mali_defer_bind_manager *mali_dmem_man = NULL;
+
+static u32 mali_dmem_get_gp_varying_size(struct mali_gp_job *gp_job)
+{
+	return gp_job->required_varying_memsize / _MALI_OSK_MALI_PAGE_SIZE;
+}
+
+_mali_osk_errcode_t mali_mem_defer_bind_manager_init(void)
+{
+	mali_dmem_man = _mali_osk_calloc(1, sizeof(struct mali_defer_bind_manager));
+	if (!mali_dmem_man)
+		return _MALI_OSK_ERR_NOMEM;
+
+	atomic_set(&mali_dmem_man->num_used_pages, 0);
+	atomic_set(&mali_dmem_man->num_dmem, 0);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+void mali_mem_defer_bind_manager_destory(void)
+{
+	if (mali_dmem_man) {
+		MALI_DEBUG_ASSERT(0 == atomic_read(&mali_dmem_man->num_dmem));
+		kfree(mali_dmem_man);
+	}
+	mali_dmem_man = NULL;
+}
+
+
+/*allocate pages from OS memory*/
+_mali_osk_errcode_t mali_mem_defer_alloc_mem(u32 require, struct mali_session_data *session, mali_defer_mem_block *dblock)
+{
+	int retval = 0;
+	u32 num_pages = require;
+	mali_mem_os_mem os_mem;
+
+	retval = mali_mem_os_alloc_pages(&os_mem, num_pages * _MALI_OSK_MALI_PAGE_SIZE);
+
+	/* add to free pages list */
+	if (0 == retval) {
+		MALI_DEBUG_PRINT(4, ("mali_mem_defer_alloc_mem ,,*** pages allocate = 0x%x \n", num_pages));
+		list_splice(&os_mem.pages, &dblock->free_pages);
+		atomic_add(os_mem.count, &dblock->num_free_pages);
+		atomic_add(os_mem.count, &session->mali_mem_allocated_pages);
+		if (atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > session->max_mali_mem_allocated_size) {
+			session->max_mali_mem_allocated_size = atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+		}
+		return _MALI_OSK_ERR_OK;
+	} else
+		return _MALI_OSK_ERR_FAULT;
+}
+
+_mali_osk_errcode_t mali_mem_prepare_mem_for_job(struct mali_gp_job *next_gp_job, mali_defer_mem_block *dblock)
+{
+	u32 require_page;
+
+	if (!next_gp_job)
+		return _MALI_OSK_ERR_FAULT;
+
+	require_page = mali_dmem_get_gp_varying_size(next_gp_job);
+
+	MALI_DEBUG_PRINT(4, ("mali_mem_defer_prepare_mem_work, require alloc page 0x%x\n",
+			     require_page));
+	/* allocate more pages from OS */
+	if (_MALI_OSK_ERR_OK != mali_mem_defer_alloc_mem(require_page, next_gp_job->session, dblock)) {
+		MALI_DEBUG_PRINT(1, ("ERROR##mali_mem_defer_prepare_mem_work, allocate page failed!!"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	next_gp_job->bind_flag = MALI_DEFER_BIND_MEMORY_PREPARED;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+/* do preparetion for allocation before defer bind */
+_mali_osk_errcode_t mali_mem_defer_bind_allocation_prepare(mali_mem_allocation *alloc, struct list_head *list, u32 *required_varying_memsize)
+{
+	mali_mem_backend *mem_bkend = NULL;
+	struct mali_backend_bind_list *bk_list = _mali_osk_calloc(1, sizeof(struct mali_backend_bind_list));
+	if (NULL == bk_list)
+		return _MALI_OSK_ERR_FAULT;
+
+	INIT_LIST_HEAD(&bk_list->node);
+	/* Get backend memory */
+	mutex_lock(&mali_idr_mutex);
+	if (!(mem_bkend = idr_find(&mali_backend_idr, alloc->backend_handle))) {
+		MALI_DEBUG_PRINT(1, ("Can't find memory backend in defer bind!\n"));
+		mutex_unlock(&mali_idr_mutex);
+		_mali_osk_free(bk_list);
+		return _MALI_OSK_ERR_FAULT;
+	}
+	mutex_unlock(&mali_idr_mutex);
+
+	/* If the mem backend has already been bound, no need to bind again.*/
+	if (mem_bkend->os_mem.count > 0) {
+		_mali_osk_free(bk_list);
+		return _MALI_OSK_ERR_OK;
+	}
+
+	MALI_DEBUG_PRINT(4, ("bind_allocation_prepare:: allocation =%x vaddr=0x%x!\n", alloc, alloc->mali_vma_node.vm_node.start));
+
+	INIT_LIST_HEAD(&mem_bkend->os_mem.pages);
+
+	bk_list->bkend = mem_bkend;
+	bk_list->vaddr = alloc->mali_vma_node.vm_node.start;
+	bk_list->session = alloc->session;
+	bk_list->page_num = mem_bkend->size / _MALI_OSK_MALI_PAGE_SIZE;
+	*required_varying_memsize +=  mem_bkend->size;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_OS);
+
+	/* add to job to do list */
+	list_add(&bk_list->node, list);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+
+/* bind phyiscal memory to allocation
+This function will be called in IRQ handler*/
+static _mali_osk_errcode_t mali_mem_defer_bind_allocation(struct mali_backend_bind_list *bk_node,
+		struct list_head *pages)
+{
+	struct mali_session_data *session = bk_node->session;
+	mali_mem_backend *mem_bkend = bk_node->bkend;
+	MALI_DEBUG_PRINT(4, ("mali_mem_defer_bind_allocation, bind bkend = %x page num=0x%x vaddr=%x session=%x\n", mem_bkend, bk_node->page_num, bk_node->vaddr, session));
+
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_OS);
+	list_splice(pages, &mem_bkend->os_mem.pages);
+	mem_bkend->os_mem.count = bk_node->page_num;
+
+	if (mem_bkend->type == MALI_MEM_OS) {
+		mali_mem_os_mali_map(&mem_bkend->os_mem, session, bk_node->vaddr, 0,
+				     mem_bkend->os_mem.count, MALI_MMU_FLAGS_DEFAULT);
+	}
+	smp_wmb();
+	bk_node->flag = MALI_DEFER_BIND_MEMORY_BINDED;
+	mem_bkend->flags &= ~MALI_MEM_BACKEND_FLAG_NOT_BINDED;
+	mem_bkend->flags |= MALI_MEM_BACKEND_FLAG_BINDED;
+	return _MALI_OSK_ERR_OK;
+}
+
+
+static struct list_head *mali_mem_defer_get_free_page_list(u32 count, struct list_head *pages, mali_defer_mem_block *dblock)
+{
+	int i = 0;
+	struct mali_page_node *m_page, *m_tmp;
+
+	if (atomic_read(&dblock->num_free_pages) < count) {
+		return NULL;
+	} else {
+		list_for_each_entry_safe(m_page, m_tmp, &dblock->free_pages, list) {
+			if (i < count) {
+				list_move_tail(&m_page->list, pages);
+			} else {
+				break;
+			}
+			i++;
+		}
+		MALI_DEBUG_ASSERT(i == count);
+		atomic_sub(count, &dblock->num_free_pages);
+		return pages;
+	}
+}
+
+
+/* called in job start IOCTL to bind physical memory for each allocations
+@ bk_list backend list to do defer bind
+@ pages page list to do this bind
+@ count number of pages
+*/
+_mali_osk_errcode_t mali_mem_defer_bind(struct mali_gp_job *gp,
+					struct mali_defer_mem_block *dmem_block)
+{
+	struct mali_defer_mem *dmem = NULL;
+	struct mali_backend_bind_list *bkn, *bkn_tmp;
+	LIST_HEAD(pages);
+
+	if (gp->required_varying_memsize != (atomic_read(&dmem_block->num_free_pages) * _MALI_OSK_MALI_PAGE_SIZE)) {
+		MALI_DEBUG_PRINT_ERROR(("#BIND:  The memsize of varying buffer not match to the pagesize of the dmem_block!!## \n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	MALI_DEBUG_PRINT(4, ("#BIND: GP job=%x## \n", gp));
+	dmem = (mali_defer_mem *)_mali_osk_calloc(1, sizeof(struct mali_defer_mem));
+	if (dmem) {
+		INIT_LIST_HEAD(&dmem->node);
+		gp->dmem = dmem;
+	} else {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	atomic_add(1, &mali_dmem_man->num_dmem);
+	/* for each bk_list backend, do bind */
+	list_for_each_entry_safe(bkn, bkn_tmp , &gp->vary_todo, node) {
+		INIT_LIST_HEAD(&pages);
+		if (likely(mali_mem_defer_get_free_page_list(bkn->page_num, &pages, dmem_block))) {
+			list_del(&bkn->node);
+			mali_mem_defer_bind_allocation(bkn, &pages);
+			_mali_osk_free(bkn);
+		} else {
+			/* not enough memory will not happen */
+			MALI_DEBUG_PRINT_ERROR(("#BIND: NOT enough memory when binded !!## \n"));
+			_mali_osk_free(gp->dmem);
+			return _MALI_OSK_ERR_NOMEM;
+		}
+	}
+
+	if (!list_empty(&gp->vary_todo)) {
+		MALI_DEBUG_PRINT_ERROR(("#BIND:  The deferbind backend list isn't empty !!## \n"));
+		_mali_osk_free(gp->dmem);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	dmem->flag = MALI_DEFER_BIND_MEMORY_BINDED;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mem_defer_dmem_free(struct mali_gp_job *gp)
+{
+	if (gp->dmem) {
+		atomic_dec(&mali_dmem_man->num_dmem);
+		_mali_osk_free(gp->dmem);
+	}
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.h b/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_defer_bind.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#ifndef __MALI_MEMORY_DEFER_BIND_H_
+#define __MALI_MEMORY_DEFER_BIND_H_
+
+
+#include "mali_osk.h"
+#include "mali_session.h"
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/rbtree.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+
+
+#include "mali_memory_types.h"
+#include "mali_memory_os_alloc.h"
+#include "mali_uk_types.h"
+
+struct mali_gp_job;
+
+typedef struct mali_defer_mem {
+	struct list_head node;   /*dlist node in bind manager */
+	u32 flag;
+} mali_defer_mem;
+
+
+typedef struct mali_defer_mem_block {
+	struct list_head free_pages; /* page pool */
+	atomic_t num_free_pages;
+} mali_defer_mem_block;
+
+/* varying memory list need to bind */
+typedef struct mali_backend_bind_list {
+	struct list_head node;
+	struct mali_mem_backend *bkend;
+	u32 vaddr;
+	u32 page_num;
+	struct mali_session_data *session;
+	u32 flag;
+} mali_backend_bind_lists;
+
+
+typedef struct mali_defer_bind_manager {
+	atomic_t num_used_pages;
+	atomic_t num_dmem;
+} mali_defer_bind_manager;
+
+_mali_osk_errcode_t mali_mem_defer_bind_manager_init(void);
+void mali_mem_defer_bind_manager_destory(void);
+_mali_osk_errcode_t mali_mem_defer_bind(struct mali_gp_job *gp, struct mali_defer_mem_block *dmem_block);
+_mali_osk_errcode_t mali_mem_defer_bind_allocation_prepare(mali_mem_allocation *alloc, struct list_head *list,  u32 *required_varying_memsize);
+_mali_osk_errcode_t mali_mem_prepare_mem_for_job(struct mali_gp_job *next_gp_job, mali_defer_mem_block *dblock);
+void mali_mem_defer_dmem_free(struct mali_gp_job *gp);
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.c b/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/fs.h>      /* file system operations */
+#include <asm/uaccess.h>        /* user space access */
+#include <linux/dma-buf.h>
+#include <linux/scatterlist.h>
+#include <linux/rbtree.h>
+#include <linux/platform_device.h>
+#include <linux/wait.h>
+#include <linux/sched.h>
+#include <linux/mutex.h>
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_kernel_linux.h"
+
+#include "mali_memory.h"
+#include "mali_memory_dma_buf.h"
+#include "mali_memory_virtual.h"
+#include "mali_pp_job.h"
+
+/*
+ * Map DMA buf attachment \a mem into \a session at virtual address \a virt.
+ */
+static int mali_dma_buf_map(mali_mem_backend *mem_backend)
+{
+	mali_mem_allocation *alloc;
+	struct mali_dma_buf_attachment *mem;
+	struct  mali_session_data *session;
+	struct mali_page_directory *pagedir;
+	_mali_osk_errcode_t err;
+	struct scatterlist *sg;
+	u32 virt, flags;
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+
+	alloc = mem_backend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	mem = mem_backend->dma_buf.attachment;
+	MALI_DEBUG_ASSERT_POINTER(mem);
+
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT(mem->session == session);
+
+	virt = alloc->mali_vma_node.vm_node.start;
+	flags = alloc->flags;
+
+	mali_session_memory_lock(session);
+	mem->map_ref++;
+
+	MALI_DEBUG_PRINT(5, ("Mali DMA-buf: map attachment %p, new map_ref = %d\n", mem, mem->map_ref));
+
+	if (1 == mem->map_ref) {
+
+		/* First reference taken, so we need to map the dma buf */
+		MALI_DEBUG_ASSERT(!mem->is_mapped);
+
+		mem->sgt = dma_buf_map_attachment(mem->attachment, DMA_BIDIRECTIONAL);
+		if (IS_ERR_OR_NULL(mem->sgt)) {
+			MALI_DEBUG_PRINT_ERROR(("Failed to map dma-buf attachment\n"));
+			mem->map_ref--;
+			mali_session_memory_unlock(session);
+			return -EFAULT;
+		}
+
+		err = mali_mem_mali_map_prepare(alloc);
+		if (_MALI_OSK_ERR_OK != err) {
+			MALI_DEBUG_PRINT(1, ("Mapping of DMA memory failed\n"));
+			mem->map_ref--;
+			mali_session_memory_unlock(session);
+			return -ENOMEM;
+		}
+
+		pagedir = mali_session_get_page_directory(session);
+		MALI_DEBUG_ASSERT_POINTER(pagedir);
+
+		for_each_sg(mem->sgt->sgl, sg, mem->sgt->nents, i) {
+			u32 size = sg_dma_len(sg);
+			dma_addr_t phys = sg_dma_address(sg);
+
+			/* sg must be page aligned. */
+			MALI_DEBUG_ASSERT(0 == size % MALI_MMU_PAGE_SIZE);
+			MALI_DEBUG_ASSERT(0 == (phys & ~(uintptr_t)0xFFFFFFFF));
+
+			mali_mmu_pagedir_update(pagedir, virt, phys, size, MALI_MMU_FLAGS_DEFAULT);
+
+			virt += size;
+		}
+
+		if (flags & MALI_MEM_FLAG_MALI_GUARD_PAGE) {
+			u32 guard_phys;
+			MALI_DEBUG_PRINT(7, ("Mapping in extra guard page\n"));
+
+			guard_phys = sg_dma_address(mem->sgt->sgl);
+			mali_mmu_pagedir_update(pagedir, virt, guard_phys, MALI_MMU_PAGE_SIZE, MALI_MMU_FLAGS_DEFAULT);
+		}
+
+		mem->is_mapped = MALI_TRUE;
+		mali_session_memory_unlock(session);
+		/* Wake up any thread waiting for buffer to become mapped */
+		wake_up_all(&mem->wait_queue);
+	} else {
+		MALI_DEBUG_ASSERT(mem->is_mapped);
+		mali_session_memory_unlock(session);
+	}
+
+	return 0;
+}
+
+static void mali_dma_buf_unmap(mali_mem_allocation *alloc, struct mali_dma_buf_attachment *mem)
+{
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	MALI_DEBUG_ASSERT_POINTER(mem);
+	MALI_DEBUG_ASSERT_POINTER(mem->attachment);
+	MALI_DEBUG_ASSERT_POINTER(mem->buf);
+	MALI_DEBUG_ASSERT_POINTER(alloc->session);
+
+	mali_session_memory_lock(alloc->session);
+	mem->map_ref--;
+
+	MALI_DEBUG_PRINT(5, ("Mali DMA-buf: unmap attachment %p, new map_ref = %d\n", mem, mem->map_ref));
+
+	if (0 == mem->map_ref) {
+		dma_buf_unmap_attachment(mem->attachment, mem->sgt, DMA_BIDIRECTIONAL);
+		if (MALI_TRUE == mem->is_mapped) {
+			mali_mem_mali_map_free(alloc->session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+					       alloc->flags);
+		}
+		mem->is_mapped = MALI_FALSE;
+	}
+	mali_session_memory_unlock(alloc->session);
+	/* Wake up any thread waiting for buffer to become unmapped */
+	wake_up_all(&mem->wait_queue);
+}
+
+#if !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+int mali_dma_buf_map_job(struct mali_pp_job *job)
+{
+	struct mali_dma_buf_attachment *mem;
+	_mali_osk_errcode_t err;
+	int i;
+	int ret = 0;
+	u32 num_memory_cookies;
+	struct mali_session_data *session;
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_allocation *mali_alloc = NULL;
+	mali_mem_backend *mem_bkend = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	num_memory_cookies = mali_pp_job_num_memory_cookies(job);
+
+	session = mali_pp_job_get_session(job);
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	for (i = 0; i < num_memory_cookies; i++) {
+		u32 mali_addr  = mali_pp_job_get_memory_cookie(job, i);
+		mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_addr, 0);
+		MALI_DEBUG_ASSERT(NULL != mali_vma_node);
+		mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+		MALI_DEBUG_ASSERT(NULL != mali_alloc);
+		if (MALI_MEM_DMA_BUF != mali_alloc->type) {
+			continue;
+		}
+
+		/* Get backend memory & Map on CPU */
+		mutex_lock(&mali_idr_mutex);
+		mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle);
+		mutex_unlock(&mali_idr_mutex);
+		MALI_DEBUG_ASSERT(NULL != mem_bkend);
+
+		mem = mem_bkend->dma_buf.attachment;
+
+		MALI_DEBUG_ASSERT_POINTER(mem);
+		MALI_DEBUG_ASSERT(mem->session == mali_pp_job_get_session(job));
+
+		err = mali_dma_buf_map(mem_bkend);
+		if (0 != err) {
+			MALI_DEBUG_PRINT_ERROR(("Mali DMA-buf: Failed to map dma-buf for mali address %x\n", mali_addr));
+			ret = -EFAULT;
+			continue;
+		}
+	}
+	return ret;
+}
+
+void mali_dma_buf_unmap_job(struct mali_pp_job *job)
+{
+	struct mali_dma_buf_attachment *mem;
+	int i;
+	u32 num_memory_cookies;
+	struct mali_session_data *session;
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_allocation *mali_alloc = NULL;
+	mali_mem_backend *mem_bkend = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	num_memory_cookies = mali_pp_job_num_memory_cookies(job);
+
+	session = mali_pp_job_get_session(job);
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	for (i = 0; i < num_memory_cookies; i++) {
+		u32 mali_addr  = mali_pp_job_get_memory_cookie(job, i);
+		mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_addr, 0);
+		MALI_DEBUG_ASSERT(NULL != mali_vma_node);
+		mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+		MALI_DEBUG_ASSERT(NULL != mali_alloc);
+		if (MALI_MEM_DMA_BUF != mali_alloc->type) {
+			continue;
+		}
+
+		/* Get backend memory & Map on CPU */
+		mutex_lock(&mali_idr_mutex);
+		mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle);
+		mutex_unlock(&mali_idr_mutex);
+		MALI_DEBUG_ASSERT(NULL != mem_bkend);
+
+		mem = mem_bkend->dma_buf.attachment;
+
+		MALI_DEBUG_ASSERT_POINTER(mem);
+		MALI_DEBUG_ASSERT(mem->session == mali_pp_job_get_session(job));
+		mali_dma_buf_unmap(mem_bkend->mali_allocation, mem);
+	}
+}
+#endif /* !CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH */
+
+int mali_dma_buf_get_size(struct mali_session_data *session, _mali_uk_dma_buf_get_size_s __user *user_arg)
+{
+	_mali_uk_dma_buf_get_size_s args;
+	int fd;
+	struct dma_buf *buf;
+
+	/* get call arguments from user space. copy_from_user returns how many bytes which where NOT copied */
+	if (0 != copy_from_user(&args, (void __user *)user_arg, sizeof(_mali_uk_dma_buf_get_size_s))) {
+		return -EFAULT;
+	}
+
+	/* Do DMA-BUF stuff */
+	fd = args.mem_fd;
+
+	buf = dma_buf_get(fd);
+	if (IS_ERR_OR_NULL(buf)) {
+		MALI_DEBUG_PRINT_ERROR(("Failed to get dma-buf from fd: %d\n", fd));
+		return PTR_RET(buf);
+	}
+
+	if (0 != put_user(buf->size, &user_arg->size)) {
+		dma_buf_put(buf);
+		return -EFAULT;
+	}
+
+	dma_buf_put(buf);
+
+	return 0;
+}
+
+_mali_osk_errcode_t mali_mem_bind_dma_buf(mali_mem_allocation *alloc,
+		mali_mem_backend *mem_backend,
+		int fd, u32 flags)
+{
+	struct dma_buf *buf;
+	struct mali_dma_buf_attachment *dma_mem;
+	struct  mali_session_data *session = alloc->session;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	/* get dma buffer */
+	buf = dma_buf_get(fd);
+	if (IS_ERR_OR_NULL(buf)) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* Currently, mapping of the full buffer are supported. */
+	if (alloc->psize != buf->size) {
+		goto failed_alloc_mem;
+	}
+
+	dma_mem = _mali_osk_calloc(1, sizeof(struct mali_dma_buf_attachment));
+	if (NULL == dma_mem) {
+		goto failed_alloc_mem;
+	}
+
+	dma_mem->buf = buf;
+	dma_mem->session = session;
+	dma_mem->map_ref = 0;
+	init_waitqueue_head(&dma_mem->wait_queue);
+
+	dma_mem->attachment = dma_buf_attach(dma_mem->buf, &mali_platform_device->dev);
+	if (NULL == dma_mem->attachment) {
+		goto failed_dma_attach;
+	}
+
+	mem_backend->dma_buf.attachment = dma_mem;
+
+	alloc->flags |= MALI_MEM_FLAG_DONT_CPU_MAP;
+	if (flags & _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE) {
+		alloc->flags |= MALI_MEM_FLAG_MALI_GUARD_PAGE;
+	}
+
+
+#if defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+	/* Map memory into session's Mali virtual address space. */
+	if (0 != mali_dma_buf_map(mem_backend)) {
+		goto Failed_dma_map;
+	}
+#endif
+
+	return _MALI_OSK_ERR_OK;
+
+#if defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+Failed_dma_map:
+	mali_dma_buf_unmap(alloc, dma_mem);
+#endif
+	/* Wait for buffer to become unmapped */
+	wait_event(dma_mem->wait_queue, !dma_mem->is_mapped);
+	MALI_DEBUG_ASSERT(!dma_mem->is_mapped);
+	dma_buf_detach(dma_mem->buf, dma_mem->attachment);
+failed_dma_attach:
+	_mali_osk_free(dma_mem);
+failed_alloc_mem:
+	dma_buf_put(buf);
+	return _MALI_OSK_ERR_FAULT;
+}
+
+void mali_mem_unbind_dma_buf(mali_mem_backend *mem_backend)
+{
+	struct mali_dma_buf_attachment *mem;
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_ASSERT(MALI_MEM_DMA_BUF == mem_backend->type);
+
+	mem = mem_backend->dma_buf.attachment;
+	MALI_DEBUG_ASSERT_POINTER(mem);
+	MALI_DEBUG_ASSERT_POINTER(mem->attachment);
+	MALI_DEBUG_ASSERT_POINTER(mem->buf);
+	MALI_DEBUG_PRINT(3, ("Mali DMA-buf: release attachment %p\n", mem));
+
+#if defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+	MALI_DEBUG_ASSERT_POINTER(mem_backend->mali_allocation);
+	/* We mapped implicitly on attach, so we need to unmap on release */
+	mali_dma_buf_unmap(mem_backend->mali_allocation, mem);
+#endif
+	/* Wait for buffer to become unmapped */
+	wait_event(mem->wait_queue, !mem->is_mapped);
+	MALI_DEBUG_ASSERT(!mem->is_mapped);
+
+	dma_buf_detach(mem->buf, mem->attachment);
+	dma_buf_put(mem->buf);
+
+	_mali_osk_free(mem);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.h b/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_dma_buf.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_DMA_BUF_H__
+#define __MALI_MEMORY_DMA_BUF_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "mali_uk_types.h"
+#include "mali_osk.h"
+#include "mali_memory.h"
+
+struct mali_pp_job;
+
+struct mali_dma_buf_attachment;
+struct mali_dma_buf_attachment {
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attachment;
+	struct sg_table *sgt;
+	struct mali_session_data *session;
+	int map_ref;
+	struct mutex map_lock;
+	mali_bool is_mapped;
+	wait_queue_head_t wait_queue;
+};
+
+int mali_dma_buf_get_size(struct mali_session_data *session, _mali_uk_dma_buf_get_size_s __user *arg);
+
+void mali_mem_unbind_dma_buf(mali_mem_backend *mem_backend);
+
+_mali_osk_errcode_t mali_mem_bind_dma_buf(mali_mem_allocation *alloc,
+		mali_mem_backend *mem_backend,
+		int fd, u32 flags);
+
+#if !defined(CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH)
+int mali_dma_buf_map_job(struct mali_pp_job *job);
+void mali_dma_buf_unmap_job(struct mali_pp_job *job);
+#endif
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_MEMORY_DMA_BUF_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_external.c b/drivers/gpu/arm/mali400/linux/mali_memory_external.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_external.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_external.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_ukk.h"
+#include "mali_memory.h"
+#include "mali_mem_validation.h"
+#include "mali_uk_types.h"
+
+void mali_mem_unbind_ext_buf(mali_mem_backend *mem_backend)
+{
+	mali_mem_allocation *alloc;
+	struct mali_session_data *session;
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	alloc = mem_backend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	MALI_DEBUG_ASSERT(MALI_MEM_EXTERNAL == mem_backend->type);
+
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+	mali_session_memory_lock(session);
+	mali_mem_mali_map_free(session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+			       alloc->flags);
+	mali_session_memory_unlock(session);
+}
+
+_mali_osk_errcode_t mali_mem_bind_ext_buf(mali_mem_allocation *alloc,
+		mali_mem_backend *mem_backend,
+		u32 phys_addr,
+		u32 flag)
+{
+	struct mali_session_data *session;
+	_mali_osk_errcode_t err;
+	u32 virt, phys, size;
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	size = alloc->psize;
+	session = (struct mali_session_data *)(uintptr_t)alloc->session;
+	MALI_CHECK_NON_NULL(session, _MALI_OSK_ERR_INVALID_ARGS);
+
+	/* check arguments */
+	/* NULL might be a valid Mali address */
+	if (!size) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+
+	/* size must be a multiple of the system page size */
+	if (size % _MALI_OSK_MALI_PAGE_SIZE) MALI_ERROR(_MALI_OSK_ERR_INVALID_ARGS);
+
+	/* Validate the mali physical range */
+	if (_MALI_OSK_ERR_OK != mali_mem_validation_check(phys_addr, size)) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	if (flag & _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE) {
+		alloc->flags |= MALI_MEM_FLAG_MALI_GUARD_PAGE;
+	}
+
+	mali_session_memory_lock(session);
+
+	virt = alloc->mali_vma_node.vm_node.start;
+	phys = phys_addr;
+
+	err = mali_mem_mali_map_prepare(alloc);
+	if (_MALI_OSK_ERR_OK != err) {
+		mali_session_memory_unlock(session);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	mali_mmu_pagedir_update(session->page_directory, virt, phys, size, MALI_MMU_FLAGS_DEFAULT);
+
+	if (alloc->flags & MALI_MEM_FLAG_MALI_GUARD_PAGE) {
+		mali_mmu_pagedir_update(session->page_directory, virt + size, phys, _MALI_OSK_MALI_PAGE_SIZE, MALI_MMU_FLAGS_DEFAULT);
+	}
+	MALI_DEBUG_PRINT(3,
+			 ("Requested to map physical memory 0x%x-0x%x into virtual memory 0x%x\n",
+			  phys_addr, (phys_addr + size - 1),
+			  virt));
+	mali_session_memory_unlock(session);
+
+	MALI_SUCCESS;
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_external.h b/drivers/gpu/arm/mali400/linux/mali_memory_external.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_external.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_external.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,29 @@
+
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_EXTERNAL_H__
+#define __MALI_MEMORY_EXTERNAL_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+_mali_osk_errcode_t mali_mem_bind_ext_buf(mali_mem_allocation *alloc,
+		mali_mem_backend *mem_backend,
+		u32 phys_addr,
+		u32 flag);
+void mali_mem_unbind_ext_buf(mali_mem_backend *mem_backend);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory.h b/drivers/gpu/arm/mali400/linux/mali_memory.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_H__
+#define __MALI_MEMORY_H__
+
+#include "mali_osk.h"
+#include "mali_session.h"
+
+#include <linux/list.h>
+#include <linux/mm.h>
+
+#include "mali_memory_types.h"
+#include "mali_memory_os_alloc.h"
+
+_mali_osk_errcode_t mali_memory_initialize(void);
+void mali_memory_terminate(void);
+
+/** @brief Allocate a page table page
+ *
+ * Allocate a page for use as a page directory or page table. The page is
+ * mapped into kernel space.
+ *
+ * @return _MALI_OSK_ERR_OK on success, otherwise an error code
+ * @param table_page GPU pointer to the allocated page
+ * @param mapping CPU pointer to the mapping of the allocated page
+ */
+MALI_STATIC_INLINE _mali_osk_errcode_t
+mali_mmu_get_table_page(mali_dma_addr *table_page, mali_io_address *mapping)
+{
+	return mali_mem_os_get_table_page(table_page, mapping);
+}
+
+/** @brief Release a page table page
+ *
+ * Release a page table page allocated through \a mali_mmu_get_table_page
+ *
+ * @param pa the GPU address of the page to release
+ */
+MALI_STATIC_INLINE void
+mali_mmu_release_table_page(mali_dma_addr phys, void *virt)
+{
+	mali_mem_os_release_table_page(phys, virt);
+}
+
+/** @brief mmap function
+ *
+ * mmap syscalls on the Mali device node will end up here.
+ *
+ * This function allocates Mali memory and maps it on CPU and Mali.
+ */
+int mali_mmap(struct file *filp, struct vm_area_struct *vma);
+
+/** @brief Start a new memory session
+ *
+ * Called when a process opens the Mali device node.
+ *
+ * @param session Pointer to session to initialize
+ */
+_mali_osk_errcode_t mali_memory_session_begin(struct mali_session_data *session);
+
+/** @brief Close a memory session
+ *
+ * Called when a process closes the Mali device node.
+ *
+ * Memory allocated by the session will be freed
+ *
+ * @param session Pointer to the session to terminate
+ */
+void mali_memory_session_end(struct mali_session_data *session);
+
+/** @brief Prepare Mali page tables for mapping
+ *
+ * This function will prepare the Mali page tables for mapping the memory
+ * described by \a descriptor.
+ *
+ * Page tables will be reference counted and allocated, if not yet present.
+ *
+ * @param descriptor Pointer to the memory descriptor to the mapping
+ */
+_mali_osk_errcode_t mali_mem_mali_map_prepare(mali_mem_allocation *descriptor);
+
+/** @brief Resize Mali page tables for mapping
+ *
+ * This function will Resize the Mali page tables for mapping the memory
+ * described by \a descriptor.
+ *
+ * Page tables will be reference counted and allocated, if not yet present.
+ *
+ * @param descriptor Pointer to the memory descriptor to the mapping
+ * @param new_size The new size of descriptor
+ */
+_mali_osk_errcode_t mali_mem_mali_map_resize(mali_mem_allocation *descriptor, u32 new_size);
+
+/** @brief Free Mali page tables for mapping
+ *
+ * This function will unmap pages from Mali memory and free the page tables
+ * that are now unused.
+ *
+ * The updated pages in the Mali L2 cache will be invalidated, and the MMU TLBs will be zapped if necessary.
+ *
+ * @param descriptor Pointer to the memory descriptor to unmap
+ */
+void mali_mem_mali_map_free(struct mali_session_data *session, u32 size, mali_address_t vaddr, u32 flags);
+
+/** @brief Parse resource and prepare the OS memory allocator
+ *
+ * @param size Maximum size to allocate for Mali GPU.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t mali_memory_core_resource_os_memory(u32 size);
+
+/** @brief Parse resource and prepare the dedicated memory allocator
+ *
+ * @param start Physical start address of dedicated Mali GPU memory.
+ * @param size Size of dedicated Mali GPU memory.
+ * @return _MALI_OSK_ERR_OK on success, otherwise failure.
+ */
+_mali_osk_errcode_t mali_memory_core_resource_dedicated_memory(u32 start, u32 size);
+
+
+struct mali_page_node *_mali_page_node_allocate(mali_page_node_type type);
+
+void _mali_page_node_ref(struct mali_page_node *node);
+void _mali_page_node_unref(struct mali_page_node *node);
+void _mali_page_node_add_page(struct mali_page_node *node, struct page *page);
+
+void _mali_page_node_add_block_item(struct mali_page_node *node, mali_block_item *item);
+
+void _mali_page_node_add_swap_item(struct mali_page_node *node, struct mali_swap_item *item);
+
+int _mali_page_node_get_ref_count(struct mali_page_node *node);
+dma_addr_t _mali_page_node_get_dma_addr(struct mali_page_node *node);
+unsigned long _mali_page_node_get_pfn(struct mali_page_node *node);
+
+#endif /* __MALI_MEMORY_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_manager.c b/drivers/gpu/arm/mali400/linux/mali_memory_manager.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_manager.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_manager.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,993 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <linux/sched.h>
+
+#include <linux/platform_device.h>
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+#include <linux/dma-buf.h>
+#endif
+#include <linux/idr.h>
+
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_kernel_linux.h"
+#include "mali_scheduler.h"
+#include "mali_memory.h"
+#include "mali_memory_os_alloc.h"
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+#include "mali_memory_dma_buf.h"
+#include "mali_memory_secure.h"
+#endif
+#if defined(CONFIG_MALI400_UMP)
+#include "mali_memory_ump.h"
+#endif
+#include "mali_memory_manager.h"
+#include "mali_memory_virtual.h"
+#include "mali_memory_util.h"
+#include "mali_memory_external.h"
+#include "mali_memory_cow.h"
+#include "mali_memory_block_alloc.h"
+#include "mali_ukk.h"
+#include "mali_memory_swap_alloc.h"
+
+/*
+* New memory system interface
+*/
+
+/*inti idr for backend memory */
+struct idr mali_backend_idr;
+struct mutex mali_idr_mutex;
+
+/* init allocation manager */
+int mali_memory_manager_init(struct mali_allocation_manager *mgr)
+{
+	/* init Locks */
+	rwlock_init(&mgr->vm_lock);
+	mutex_init(&mgr->list_mutex);
+
+	/* init link */
+	INIT_LIST_HEAD(&mgr->head);
+
+	/* init RB tree */
+	mgr->allocation_mgr_rb = RB_ROOT;
+	mgr->mali_allocation_num = 0;
+	return 0;
+}
+
+/* Deinit allocation manager
+* Do some check for debug
+*/
+void mali_memory_manager_uninit(struct mali_allocation_manager *mgr)
+{
+	/* check RB tree is empty */
+	MALI_DEBUG_ASSERT(((void *)(mgr->allocation_mgr_rb.rb_node) == (void *)rb_last(&mgr->allocation_mgr_rb)));
+	/* check allocation List */
+	MALI_DEBUG_ASSERT(list_empty(&mgr->head));
+}
+
+/* Prepare memory descriptor */
+static mali_mem_allocation *mali_mem_allocation_struct_create(struct mali_session_data *session)
+{
+	mali_mem_allocation *mali_allocation;
+
+	/* Allocate memory */
+	mali_allocation = (mali_mem_allocation *)kzalloc(sizeof(mali_mem_allocation), GFP_KERNEL);
+	if (NULL == mali_allocation) {
+		MALI_DEBUG_PRINT(1, ("mali_mem_allocation_struct_create: descriptor was NULL\n"));
+		return NULL;
+	}
+
+	MALI_DEBUG_CODE(mali_allocation->magic = MALI_MEM_ALLOCATION_VALID_MAGIC);
+
+	/* do init */
+	mali_allocation->flags = 0;
+	mali_allocation->session = session;
+
+	INIT_LIST_HEAD(&mali_allocation->list);
+	_mali_osk_atomic_init(&mali_allocation->mem_alloc_refcount, 1);
+
+	/**
+	*add to session list
+	*/
+	mutex_lock(&session->allocation_mgr.list_mutex);
+	list_add_tail(&mali_allocation->list, &session->allocation_mgr.head);
+	session->allocation_mgr.mali_allocation_num++;
+	mutex_unlock(&session->allocation_mgr.list_mutex);
+
+	return mali_allocation;
+}
+
+void  mali_mem_allocation_struct_destory(mali_mem_allocation *alloc)
+{
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	MALI_DEBUG_ASSERT_POINTER(alloc->session);
+	mutex_lock(&alloc->session->allocation_mgr.list_mutex);
+	list_del(&alloc->list);
+	alloc->session->allocation_mgr.mali_allocation_num--;
+	mutex_unlock(&alloc->session->allocation_mgr.list_mutex);
+
+	kfree(alloc);
+}
+
+int mali_mem_backend_struct_create(mali_mem_backend **backend, u32 psize)
+{
+	mali_mem_backend *mem_backend = NULL;
+	s32 ret = -ENOSPC;
+	s32 index = -1;
+	*backend = (mali_mem_backend *)kzalloc(sizeof(mali_mem_backend), GFP_KERNEL);
+	if (NULL == *backend) {
+		MALI_DEBUG_PRINT(1, ("mali_mem_backend_struct_create: backend descriptor was NULL\n"));
+		return -1;
+	}
+	mem_backend = *backend;
+	mem_backend->size = psize;
+	mutex_init(&mem_backend->mutex);
+	INIT_LIST_HEAD(&mem_backend->list);
+	mem_backend->using_count = 0;
+
+
+	/* link backend with id */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
+again:
+	if (!idr_pre_get(&mali_backend_idr, GFP_KERNEL)) {
+		kfree(mem_backend);
+		return -ENOMEM;
+	}
+	mutex_lock(&mali_idr_mutex);
+	ret = idr_get_new_above(&mali_backend_idr, mem_backend, 1, &index);
+	mutex_unlock(&mali_idr_mutex);
+
+	if (-ENOSPC == ret) {
+		kfree(mem_backend);
+		return -ENOSPC;
+	}
+	if (-EAGAIN == ret)
+		goto again;
+#else
+	mutex_lock(&mali_idr_mutex);
+	ret = idr_alloc(&mali_backend_idr, mem_backend, 1, MALI_S32_MAX, GFP_KERNEL);
+	mutex_unlock(&mali_idr_mutex);
+	index = ret;
+	if (ret < 0) {
+		MALI_DEBUG_PRINT(1, ("mali_mem_backend_struct_create: Can't allocate idr for backend! \n"));
+		kfree(mem_backend);
+		return -ENOSPC;
+	}
+#endif
+	return index;
+}
+
+
+static void mali_mem_backend_struct_destory(mali_mem_backend **backend, s32 backend_handle)
+{
+	mali_mem_backend *mem_backend = *backend;
+
+	mutex_lock(&mali_idr_mutex);
+	idr_remove(&mali_backend_idr, backend_handle);
+	mutex_unlock(&mali_idr_mutex);
+	kfree(mem_backend);
+	*backend = NULL;
+}
+
+mali_mem_backend *mali_mem_backend_struct_search(struct mali_session_data *session, u32 mali_address)
+{
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_backend *mem_bkend = NULL;
+	mali_mem_allocation *mali_alloc = NULL;
+	MALI_DEBUG_ASSERT_POINTER(session);
+	mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_address, 0);
+	if (NULL == mali_vma_node)  {
+		MALI_DEBUG_PRINT(1, ("mali_mem_backend_struct_search:vma node was NULL\n"));
+		return NULL;
+	}
+	mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+	/* Get backend memory & Map on CPU */
+	mutex_lock(&mali_idr_mutex);
+	mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle);
+	mutex_unlock(&mali_idr_mutex);
+	MALI_DEBUG_ASSERT(NULL != mem_bkend);
+	return mem_bkend;
+}
+
+static _mali_osk_errcode_t mali_mem_resize(struct mali_session_data *session, mali_mem_backend *mem_backend, u32 physical_size)
+{
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+	int retval = 0;
+	mali_mem_allocation *mali_allocation = NULL;
+	mali_mem_os_mem tmp_os_mem;
+	s32 change_page_count;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_PRINT(4, (" mali_mem_resize_memory called! \n"));
+	MALI_DEBUG_ASSERT(0 == physical_size %  MALI_MMU_PAGE_SIZE);
+
+	mali_allocation = mem_backend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(mali_allocation);
+
+	MALI_DEBUG_ASSERT(MALI_MEM_FLAG_CAN_RESIZE & mali_allocation->flags);
+	MALI_DEBUG_ASSERT(MALI_MEM_OS == mali_allocation->type);
+
+	mutex_lock(&mem_backend->mutex);
+
+	/* Do resize*/
+	if (physical_size > mem_backend->size) {
+		u32 add_size = physical_size - mem_backend->size;
+
+		MALI_DEBUG_ASSERT(0 == add_size %  MALI_MMU_PAGE_SIZE);
+
+		/* Allocate new pages from os mem */
+		retval = mali_mem_os_alloc_pages(&tmp_os_mem, add_size);
+
+		if (retval) {
+			if (-ENOMEM == retval) {
+				ret = _MALI_OSK_ERR_NOMEM;
+			} else {
+				ret = _MALI_OSK_ERR_FAULT;
+			}
+			MALI_DEBUG_PRINT(2, ("_mali_ukk_mem_resize: memory allocation failed !\n"));
+			goto failed_alloc_memory;
+		}
+
+		MALI_DEBUG_ASSERT(tmp_os_mem.count == add_size / MALI_MMU_PAGE_SIZE);
+
+		/* Resize the memory of the backend */
+		ret = mali_mem_os_resize_pages(&tmp_os_mem, &mem_backend->os_mem, 0, tmp_os_mem.count);
+
+		if (ret) {
+			MALI_DEBUG_PRINT(2, ("_mali_ukk_mem_resize: memory	resizing failed !\n"));
+			goto failed_resize_pages;
+		}
+
+		/*Resize cpu mapping */
+		if (NULL != mali_allocation->cpu_mapping.vma) {
+			ret = mali_mem_os_resize_cpu_map_locked(mem_backend, mali_allocation->cpu_mapping.vma, mali_allocation->cpu_mapping.vma->vm_start  + mem_backend->size, add_size);
+			if (unlikely(ret != _MALI_OSK_ERR_OK)) {
+				MALI_DEBUG_PRINT(2, ("_mali_ukk_mem_resize: cpu mapping failed !\n"));
+				goto  failed_cpu_map;
+			}
+		}
+
+		/* Resize mali mapping */
+		_mali_osk_mutex_wait(session->memory_lock);
+		ret = mali_mem_mali_map_resize(mali_allocation, physical_size);
+
+		if (ret) {
+			MALI_DEBUG_PRINT(1, ("_mali_ukk_mem_resize: mali map resize fail !\n"));
+			goto failed_gpu_map;
+		}
+
+		ret = mali_mem_os_mali_map(&mem_backend->os_mem, session, mali_allocation->mali_vma_node.vm_node.start,
+					   mali_allocation->psize / MALI_MMU_PAGE_SIZE, add_size / MALI_MMU_PAGE_SIZE, mali_allocation->mali_mapping.properties);
+		if (ret) {
+			MALI_DEBUG_PRINT(2, ("_mali_ukk_mem_resize: mali mapping failed !\n"));
+			goto failed_gpu_map;
+		}
+
+		_mali_osk_mutex_signal(session->memory_lock);
+	} else {
+		u32 dec_size, page_count;
+		u32 vaddr = 0;
+		INIT_LIST_HEAD(&tmp_os_mem.pages);
+		tmp_os_mem.count = 0;
+
+		dec_size = mem_backend->size - physical_size;
+		MALI_DEBUG_ASSERT(0 == dec_size %  MALI_MMU_PAGE_SIZE);
+
+		page_count = dec_size / MALI_MMU_PAGE_SIZE;
+		vaddr = mali_allocation->mali_vma_node.vm_node.start + physical_size;
+
+		/* Resize the memory of the backend */
+		ret = mali_mem_os_resize_pages(&mem_backend->os_mem, &tmp_os_mem, physical_size / MALI_MMU_PAGE_SIZE, page_count);
+
+		if (ret) {
+			MALI_DEBUG_PRINT(4, ("_mali_ukk_mem_resize: mali map resize failed!\n"));
+			goto failed_resize_pages;
+		}
+
+		/* Resize mali map */
+		_mali_osk_mutex_wait(session->memory_lock);
+		mali_mem_mali_map_free(session, dec_size, vaddr, mali_allocation->flags);
+		_mali_osk_mutex_signal(session->memory_lock);
+
+		/* Zap cpu mapping */
+		if (0 != mali_allocation->cpu_mapping.addr) {
+			MALI_DEBUG_ASSERT(NULL != mali_allocation->cpu_mapping.vma);
+			zap_vma_ptes(mali_allocation->cpu_mapping.vma, mali_allocation->cpu_mapping.vma->vm_start + physical_size, dec_size);
+		}
+
+		/* Free those extra pages */
+		mali_mem_os_free(&tmp_os_mem.pages, tmp_os_mem.count, MALI_FALSE);
+	}
+
+	/* Resize memory allocation and memory backend */
+	change_page_count = (s32)(physical_size - mem_backend->size) / MALI_MMU_PAGE_SIZE;
+	mali_allocation->psize = physical_size;
+	mem_backend->size = physical_size;
+	mutex_unlock(&mem_backend->mutex);
+
+	if (change_page_count > 0) {
+		atomic_add(change_page_count, &session->mali_mem_allocated_pages);
+		if (atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > session->max_mali_mem_allocated_size) {
+			session->max_mali_mem_allocated_size = atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+		}
+
+	} else {
+		atomic_sub((s32)(-change_page_count), &session->mali_mem_allocated_pages);
+	}
+
+	return _MALI_OSK_ERR_OK;
+
+failed_gpu_map:
+	_mali_osk_mutex_signal(session->memory_lock);
+failed_cpu_map:
+	if (physical_size > mem_backend->size) {
+		mali_mem_os_resize_pages(&mem_backend->os_mem, &tmp_os_mem, mem_backend->size / MALI_MMU_PAGE_SIZE,
+					 (physical_size - mem_backend->size) / MALI_MMU_PAGE_SIZE);
+	} else {
+		mali_mem_os_resize_pages(&tmp_os_mem, &mem_backend->os_mem, 0, tmp_os_mem.count);
+	}
+failed_resize_pages:
+	if (0 != tmp_os_mem.count)
+		mali_mem_os_free(&tmp_os_mem.pages, tmp_os_mem.count, MALI_FALSE);
+failed_alloc_memory:
+
+	mutex_unlock(&mem_backend->mutex);
+	return ret;
+}
+
+
+/* Set GPU MMU properties */
+static void _mali_memory_gpu_map_property_set(u32 *properties, u32 flags)
+{
+	if (_MALI_MEMORY_GPU_READ_ALLOCATE & flags) {
+		*properties = MALI_MMU_FLAGS_FORCE_GP_READ_ALLOCATE;
+	} else {
+		*properties = MALI_MMU_FLAGS_DEFAULT;
+	}
+}
+
+_mali_osk_errcode_t mali_mem_add_mem_size(struct mali_session_data *session, u32 mali_addr, u32 add_size)
+{
+	mali_mem_backend *mem_backend = NULL;
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+	mali_mem_allocation *mali_allocation = NULL;
+	u32 new_physical_size;
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT(0 == add_size %  MALI_MMU_PAGE_SIZE);
+
+	/* Get the memory backend that need to be resize. */
+	mem_backend = mali_mem_backend_struct_search(session, mali_addr);
+
+	if (NULL == mem_backend)  {
+		MALI_DEBUG_PRINT(2, ("_mali_ukk_mem_resize: memory backend = NULL!\n"));
+		return ret;
+	}
+
+	mali_allocation = mem_backend->mali_allocation;
+
+	MALI_DEBUG_ASSERT_POINTER(mali_allocation);
+
+	new_physical_size = add_size + mem_backend->size;
+
+	if (new_physical_size > (mali_allocation->mali_vma_node.vm_node.size))
+		return ret;
+
+	MALI_DEBUG_ASSERT(new_physical_size != mem_backend->size);
+
+	ret = mali_mem_resize(session, mem_backend, new_physical_size);
+
+	return ret;
+}
+
+/**
+*  function@_mali_ukk_mem_allocate - allocate mali memory
+*/
+_mali_osk_errcode_t _mali_ukk_mem_allocate(_mali_uk_alloc_mem_s *args)
+{
+	struct mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	mali_mem_backend *mem_backend = NULL;
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+	int retval = 0;
+	mali_mem_allocation *mali_allocation = NULL;
+	struct mali_vma_node *mali_vma_node = NULL;
+
+	MALI_DEBUG_PRINT(4, (" _mali_ukk_mem_allocate, vaddr=0x%x, size =0x%x! \n", args->gpu_vaddr, args->psize));
+
+	/* Check if the address is allocated
+	*/
+	mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, args->gpu_vaddr, 0);
+
+	if (unlikely(mali_vma_node)) {
+		MALI_DEBUG_PRINT_ERROR(("The mali virtual address has already been used ! \n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+	/**
+	*create mali memory allocation
+	*/
+
+	mali_allocation = mali_mem_allocation_struct_create(session);
+
+	if (mali_allocation == NULL) {
+		MALI_DEBUG_PRINT(1, ("_mali_ukk_mem_allocate: Failed to create allocation struct! \n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+	mali_allocation->psize = args->psize;
+	mali_allocation->vsize = args->vsize;
+
+	/* MALI_MEM_OS if need to support mem resize,
+	 * or MALI_MEM_BLOCK if have dedicated memory,
+	 * or MALI_MEM_OS,
+	 * or MALI_MEM_SWAP.
+	 */
+	if (args->flags & _MALI_MEMORY_ALLOCATE_SWAPPABLE) {
+		mali_allocation->type = MALI_MEM_SWAP;
+	} else if (args->flags & _MALI_MEMORY_ALLOCATE_RESIZEABLE) {
+		mali_allocation->type = MALI_MEM_OS;
+		mali_allocation->flags |= MALI_MEM_FLAG_CAN_RESIZE;
+	} else if (args->flags & _MALI_MEMORY_ALLOCATE_SECURE) {
+		mali_allocation->type = MALI_MEM_SECURE;
+	} else if (MALI_TRUE == mali_memory_have_dedicated_memory()) {
+		mali_allocation->type = MALI_MEM_BLOCK;
+	} else {
+		mali_allocation->type = MALI_MEM_OS;
+	}
+
+	/**
+	*add allocation node to RB tree for index
+	*/
+	mali_allocation->mali_vma_node.vm_node.start = args->gpu_vaddr;
+	mali_allocation->mali_vma_node.vm_node.size = args->vsize;
+
+	mali_vma_offset_add(&session->allocation_mgr, &mali_allocation->mali_vma_node);
+
+	mali_allocation->backend_handle = mali_mem_backend_struct_create(&mem_backend, args->psize);
+	if (mali_allocation->backend_handle < 0) {
+		ret = _MALI_OSK_ERR_NOMEM;
+		MALI_DEBUG_PRINT(1, ("mali_allocation->backend_handle < 0! \n"));
+		goto failed_alloc_backend;
+	}
+
+
+	mem_backend->mali_allocation = mali_allocation;
+	mem_backend->type = mali_allocation->type;
+
+	mali_allocation->mali_mapping.addr = args->gpu_vaddr;
+
+	/* set gpu mmu propery */
+	_mali_memory_gpu_map_property_set(&mali_allocation->mali_mapping.properties, args->flags);
+	/* do prepare for MALI mapping */
+	if (!(args->flags & _MALI_MEMORY_ALLOCATE_NO_BIND_GPU) && mali_allocation->psize > 0) {
+		_mali_osk_mutex_wait(session->memory_lock);
+
+		ret = mali_mem_mali_map_prepare(mali_allocation);
+		if (0 != ret) {
+			_mali_osk_mutex_signal(session->memory_lock);
+			goto failed_prepare_map;
+		}
+		_mali_osk_mutex_signal(session->memory_lock);
+	}
+
+	if (mali_allocation->psize == 0) {
+		mem_backend->os_mem.count = 0;
+		INIT_LIST_HEAD(&mem_backend->os_mem.pages);
+		goto done;
+	}
+
+	if (args->flags & _MALI_MEMORY_ALLOCATE_DEFER_BIND) {
+		mali_allocation->flags |= _MALI_MEMORY_ALLOCATE_DEFER_BIND;
+		mem_backend->flags |= MALI_MEM_BACKEND_FLAG_NOT_BINDED;
+		/* init for defer bind backend*/
+		mem_backend->os_mem.count = 0;
+		INIT_LIST_HEAD(&mem_backend->os_mem.pages);
+
+		goto done;
+	}
+
+	if (likely(mali_allocation->psize > 0)) {
+
+		if (MALI_MEM_SECURE == mem_backend->type) {
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+			ret = mali_mem_secure_attach_dma_buf(&mem_backend->secure_mem, mem_backend->size, args->secure_shared_fd);
+			if (_MALI_OSK_ERR_OK != ret) {
+				MALI_DEBUG_PRINT(1, ("Failed to attach dma buf for secure memory! \n"));
+				goto failed_alloc_pages;
+			}
+#else
+			ret = _MALI_OSK_ERR_UNSUPPORTED;
+			MALI_DEBUG_PRINT(1, ("DMA not supported for mali secure memory! \n"));
+			goto failed_alloc_pages;
+#endif
+		} else {
+
+			/**
+			*allocate physical memory
+			*/
+			if (mem_backend->type == MALI_MEM_OS) {
+				retval = mali_mem_os_alloc_pages(&mem_backend->os_mem, mem_backend->size);
+			} else if (mem_backend->type == MALI_MEM_BLOCK) {
+				/* try to allocated from BLOCK memory first, then try OS memory if failed.*/
+				if (mali_mem_block_alloc(&mem_backend->block_mem, mem_backend->size)) {
+					retval = mali_mem_os_alloc_pages(&mem_backend->os_mem, mem_backend->size);
+					mem_backend->type = MALI_MEM_OS;
+					mali_allocation->type = MALI_MEM_OS;
+				}
+			} else if (MALI_MEM_SWAP == mem_backend->type) {
+				retval = mali_mem_swap_alloc_pages(&mem_backend->swap_mem, mali_allocation->mali_vma_node.vm_node.size, &mem_backend->start_idx);
+			}  else {
+				/* ONLY support mem_os type */
+				MALI_DEBUG_ASSERT(0);
+			}
+
+			if (retval) {
+				ret = _MALI_OSK_ERR_NOMEM;
+				MALI_DEBUG_PRINT(1, (" can't allocate enough pages! \n"));
+				goto failed_alloc_pages;
+			}
+		}
+	}
+
+	/**
+	*map to GPU side
+	*/
+	if (!(args->flags & _MALI_MEMORY_ALLOCATE_NO_BIND_GPU) && mali_allocation->psize > 0) {
+		_mali_osk_mutex_wait(session->memory_lock);
+		/* Map on Mali */
+
+		if (mem_backend->type == MALI_MEM_OS) {
+			ret = mali_mem_os_mali_map(&mem_backend->os_mem, session, args->gpu_vaddr, 0,
+						   mem_backend->size / MALI_MMU_PAGE_SIZE, mali_allocation->mali_mapping.properties);
+
+		} else if (mem_backend->type == MALI_MEM_BLOCK) {
+			mali_mem_block_mali_map(&mem_backend->block_mem, session, args->gpu_vaddr,
+						mali_allocation->mali_mapping.properties);
+		} else if (mem_backend->type == MALI_MEM_SWAP) {
+			ret = mali_mem_swap_mali_map(&mem_backend->swap_mem, session, args->gpu_vaddr,
+						     mali_allocation->mali_mapping.properties);
+		} else if (mem_backend->type == MALI_MEM_SECURE) {
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+			ret = mali_mem_secure_mali_map(&mem_backend->secure_mem, session, args->gpu_vaddr, mali_allocation->mali_mapping.properties);
+#endif
+		} else { /* unsupport type */
+			MALI_DEBUG_ASSERT(0);
+		}
+
+		_mali_osk_mutex_signal(session->memory_lock);
+	}
+done:
+	if (MALI_MEM_OS == mem_backend->type) {
+		atomic_add(mem_backend->os_mem.count, &session->mali_mem_allocated_pages);
+	} else if (MALI_MEM_BLOCK == mem_backend->type) {
+		atomic_add(mem_backend->block_mem.count, &session->mali_mem_allocated_pages);
+	} else if (MALI_MEM_SECURE == mem_backend->type) {
+		atomic_add(mem_backend->secure_mem.count, &session->mali_mem_allocated_pages);
+	} else {
+		MALI_DEBUG_ASSERT(MALI_MEM_SWAP == mem_backend->type);
+		atomic_add(mem_backend->swap_mem.count, &session->mali_mem_allocated_pages);
+		atomic_add(mem_backend->swap_mem.count, &session->mali_mem_array[mem_backend->type]);
+	}
+
+	if (atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > session->max_mali_mem_allocated_size) {
+		session->max_mali_mem_allocated_size = atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+	}
+	return _MALI_OSK_ERR_OK;
+
+failed_alloc_pages:
+	mali_mem_mali_map_free(session, mali_allocation->psize, mali_allocation->mali_vma_node.vm_node.start, mali_allocation->flags);
+failed_prepare_map:
+	mali_mem_backend_struct_destory(&mem_backend, mali_allocation->backend_handle);
+failed_alloc_backend:
+
+	mali_vma_offset_remove(&session->allocation_mgr, &mali_allocation->mali_vma_node);
+	mali_mem_allocation_struct_destory(mali_allocation);
+
+	return ret;
+}
+
+
+_mali_osk_errcode_t _mali_ukk_mem_free(_mali_uk_free_mem_s *args)
+{
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	u32 vaddr = args->gpu_vaddr;
+	mali_mem_allocation *mali_alloc = NULL;
+	struct mali_vma_node *mali_vma_node = NULL;
+
+	/* find mali allocation structure by vaddress*/
+	mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, vaddr, 0);
+	if (NULL == mali_vma_node) {
+		MALI_DEBUG_PRINT(1, ("_mali_ukk_mem_free: invalid addr: 0x%x\n", vaddr));
+		return _MALI_OSK_ERR_INVALID_ARGS;
+	}
+	MALI_DEBUG_ASSERT(NULL != mali_vma_node);
+	mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+
+	if (mali_alloc)
+		/* check ref_count */
+		args->free_pages_nr = mali_allocation_unref(&mali_alloc);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+/**
+* Function _mali_ukk_mem_bind -- bind a external memory to a new GPU address
+* It will allocate a new mem allocation and bind external memory to it.
+* Supported backend type are:
+* _MALI_MEMORY_BIND_BACKEND_UMP
+* _MALI_MEMORY_BIND_BACKEND_DMA_BUF
+* _MALI_MEMORY_BIND_BACKEND_EXTERNAL_MEMORY
+* CPU access is not supported yet
+*/
+_mali_osk_errcode_t _mali_ukk_mem_bind(_mali_uk_bind_mem_s *args)
+{
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	mali_mem_backend *mem_backend = NULL;
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+	mali_mem_allocation *mali_allocation = NULL;
+	MALI_DEBUG_PRINT(5, (" _mali_ukk_mem_bind, vaddr=0x%x, size =0x%x! \n", args->vaddr, args->size));
+
+	/**
+	* allocate mali allocation.
+	*/
+	mali_allocation = mali_mem_allocation_struct_create(session);
+
+	if (mali_allocation == NULL) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+	mali_allocation->psize = args->size;
+	mali_allocation->vsize = args->size;
+	mali_allocation->mali_mapping.addr = args->vaddr;
+
+	/* add allocation node to RB tree for index  */
+	mali_allocation->mali_vma_node.vm_node.start = args->vaddr;
+	mali_allocation->mali_vma_node.vm_node.size = args->size;
+	mali_vma_offset_add(&session->allocation_mgr, &mali_allocation->mali_vma_node);
+
+	/* allocate backend*/
+	if (mali_allocation->psize > 0) {
+		mali_allocation->backend_handle = mali_mem_backend_struct_create(&mem_backend, mali_allocation->psize);
+		if (mali_allocation->backend_handle < 0) {
+			goto Failed_alloc_backend;
+		}
+
+	} else {
+		goto Failed_alloc_backend;
+	}
+
+	mem_backend->size = mali_allocation->psize;
+	mem_backend->mali_allocation = mali_allocation;
+
+	switch (args->flags & _MALI_MEMORY_BIND_BACKEND_MASK) {
+	case  _MALI_MEMORY_BIND_BACKEND_UMP:
+#if defined(CONFIG_MALI400_UMP)
+		mali_allocation->type = MALI_MEM_UMP;
+		mem_backend->type = MALI_MEM_UMP;
+		ret = mali_mem_bind_ump_buf(mali_allocation, mem_backend,
+					    args->mem_union.bind_ump.secure_id, args->mem_union.bind_ump.flags);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_DEBUG_PRINT(1, ("Bind ump buf failed\n"));
+			goto  Failed_bind_backend;
+		}
+#else
+		MALI_DEBUG_PRINT(1, ("UMP not supported\n"));
+		goto Failed_bind_backend;
+#endif
+		break;
+	case  _MALI_MEMORY_BIND_BACKEND_DMA_BUF:
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+		mali_allocation->type = MALI_MEM_DMA_BUF;
+		mem_backend->type = MALI_MEM_DMA_BUF;
+		ret = mali_mem_bind_dma_buf(mali_allocation, mem_backend,
+					    args->mem_union.bind_dma_buf.mem_fd, args->mem_union.bind_dma_buf.flags);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_DEBUG_PRINT(1, ("Bind dma buf failed\n"));
+			goto Failed_bind_backend;
+		}
+#else
+		MALI_DEBUG_PRINT(1, ("DMA not supported\n"));
+		goto Failed_bind_backend;
+#endif
+		break;
+	case _MALI_MEMORY_BIND_BACKEND_MALI_MEMORY:
+		/* not allowed */
+		MALI_DEBUG_PRINT_ERROR(("Mali internal memory type not supported !\n"));
+		goto Failed_bind_backend;
+		break;
+
+	case _MALI_MEMORY_BIND_BACKEND_EXTERNAL_MEMORY:
+		mali_allocation->type = MALI_MEM_EXTERNAL;
+		mem_backend->type = MALI_MEM_EXTERNAL;
+		ret = mali_mem_bind_ext_buf(mali_allocation, mem_backend, args->mem_union.bind_ext_memory.phys_addr,
+					    args->mem_union.bind_ext_memory.flags);
+		if (_MALI_OSK_ERR_OK != ret) {
+			MALI_DEBUG_PRINT(1, ("Bind external buf failed\n"));
+			goto Failed_bind_backend;
+		}
+		break;
+
+	case _MALI_MEMORY_BIND_BACKEND_EXT_COW:
+		/* not allowed */
+		MALI_DEBUG_PRINT_ERROR(("External cow memory  type not supported !\n"));
+		goto Failed_bind_backend;
+		break;
+
+	default:
+		MALI_DEBUG_PRINT_ERROR(("Invalid memory type  not supported !\n"));
+		goto Failed_bind_backend;
+		break;
+	}
+	MALI_DEBUG_ASSERT(0 == mem_backend->size % MALI_MMU_PAGE_SIZE);
+	atomic_add(mem_backend->size / MALI_MMU_PAGE_SIZE, &session->mali_mem_array[mem_backend->type]);
+	return _MALI_OSK_ERR_OK;
+
+Failed_bind_backend:
+	mali_mem_backend_struct_destory(&mem_backend, mali_allocation->backend_handle);
+
+Failed_alloc_backend:
+	mali_vma_offset_remove(&session->allocation_mgr, &mali_allocation->mali_vma_node);
+	mali_mem_allocation_struct_destory(mali_allocation);
+
+	MALI_DEBUG_PRINT(1, (" _mali_ukk_mem_bind, return ERROR! \n"));
+	return ret;
+}
+
+
+/*
+* Function _mali_ukk_mem_unbind -- unbind a external memory to a new GPU address
+* This function unbind the backend memory and free the allocation
+* no ref_count for this type of memory
+*/
+_mali_osk_errcode_t _mali_ukk_mem_unbind(_mali_uk_unbind_mem_s *args)
+{
+	/**/
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	mali_mem_allocation *mali_allocation = NULL;
+	struct mali_vma_node *mali_vma_node = NULL;
+	u32 mali_addr = args->vaddr;
+	MALI_DEBUG_PRINT(5, (" _mali_ukk_mem_unbind, vaddr=0x%x! \n", args->vaddr));
+
+	/* find the allocation by vaddr */
+	mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_addr, 0);
+	if (likely(mali_vma_node)) {
+		MALI_DEBUG_ASSERT(mali_addr == mali_vma_node->vm_node.start);
+		mali_allocation = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+	} else {
+		MALI_DEBUG_ASSERT(NULL != mali_vma_node);
+		return _MALI_OSK_ERR_INVALID_ARGS;
+	}
+
+	if (NULL != mali_allocation)
+		/* check ref_count */
+		mali_allocation_unref(&mali_allocation);
+	return _MALI_OSK_ERR_OK;
+}
+
+/*
+* Function _mali_ukk_mem_cow --  COW for an allocation
+* This function allocate new pages for  a range (range, range+size) of allocation
+*  And Map it(keep use the not in range pages from target allocation ) to an GPU vaddr
+*/
+_mali_osk_errcode_t _mali_ukk_mem_cow(_mali_uk_cow_mem_s *args)
+{
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+	mali_mem_backend *target_backend = NULL;
+	mali_mem_backend *mem_backend = NULL;
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_allocation *mali_allocation = NULL;
+
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	/* Get the target backend for cow */
+	target_backend = mali_mem_backend_struct_search(session, args->target_handle);
+
+	if (NULL == target_backend || 0 == target_backend->size) {
+		MALI_DEBUG_ASSERT_POINTER(target_backend);
+		MALI_DEBUG_ASSERT(0 != target_backend->size);
+		return ret;
+	}
+
+	/*Cow not support resized mem */
+	MALI_DEBUG_ASSERT(MALI_MEM_FLAG_CAN_RESIZE != (MALI_MEM_FLAG_CAN_RESIZE & target_backend->mali_allocation->flags));
+
+	/* Check if the new mali address is allocated */
+	mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, args->vaddr, 0);
+
+	if (unlikely(mali_vma_node)) {
+		MALI_DEBUG_PRINT_ERROR(("The mali virtual address has already been used ! \n"));
+		return ret;
+	}
+
+	/* create new alloction for COW*/
+	mali_allocation = mali_mem_allocation_struct_create(session);
+	if (mali_allocation == NULL) {
+		MALI_DEBUG_PRINT(1, ("_mali_ukk_mem_cow: Failed to create allocation struct!\n"));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+	mali_allocation->psize = args->target_size;
+	mali_allocation->vsize = args->target_size;
+	mali_allocation->type = MALI_MEM_COW;
+
+	/*add allocation node to RB tree for index*/
+	mali_allocation->mali_vma_node.vm_node.start = args->vaddr;
+	mali_allocation->mali_vma_node.vm_node.size = mali_allocation->vsize;
+	mali_vma_offset_add(&session->allocation_mgr, &mali_allocation->mali_vma_node);
+
+	/* create new backend for COW memory */
+	mali_allocation->backend_handle = mali_mem_backend_struct_create(&mem_backend, mali_allocation->psize);
+	if (mali_allocation->backend_handle < 0) {
+		ret = _MALI_OSK_ERR_NOMEM;
+		MALI_DEBUG_PRINT(1, ("mali_allocation->backend_handle < 0! \n"));
+		goto failed_alloc_backend;
+	}
+	mem_backend->mali_allocation = mali_allocation;
+	mem_backend->type = mali_allocation->type;
+
+	if (target_backend->type == MALI_MEM_SWAP ||
+	    (MALI_MEM_COW == target_backend->type && (MALI_MEM_BACKEND_FLAG_SWAP_COWED & target_backend->flags))) {
+		mem_backend->flags |= MALI_MEM_BACKEND_FLAG_SWAP_COWED;
+		/**
+		 *     CoWed swap backends couldn't be mapped as non-linear vma, because if one
+		 * vma is set with flag VM_NONLINEAR, the vma->vm_private_data will be used by kernel,
+		 * while in mali driver, we use this variable to store the pointer of mali_allocation, so there
+		 * is a conflict.
+		 *     To resolve this problem, we have to do some fake things, we reserved about 64MB
+		 * space from index 0, there isn't really page's index will be set from 0 to (64MB>>PAGE_SHIFT_NUM),
+		 * and all of CoWed swap memory backends' start_idx will be assigned with 0, and these
+		 * backends will be mapped as linear and will add to priority tree of global swap file, while
+		 * these vmas will never be found by using normal page->index, these pages in those vma
+		 * also couldn't be swapped out.
+		 */
+		mem_backend->start_idx = 0;
+	}
+
+	/* Add the target backend's cow count, also allocate new pages for COW backend from os mem
+	*for a modified range and keep the page which not in the modified range and Add ref to it
+	*/
+	MALI_DEBUG_PRINT(3, ("Cow mapping: target_addr: 0x%x;  cow_addr: 0x%x,  size: %u\n", target_backend->mali_allocation->mali_vma_node.vm_node.start,
+			     mali_allocation->mali_vma_node.vm_node.start, mali_allocation->mali_vma_node.vm_node.size));
+
+	ret = mali_memory_do_cow(target_backend, args->target_offset, args->target_size, mem_backend, args->range_start, args->range_size);
+	if (_MALI_OSK_ERR_OK != ret) {
+		MALI_DEBUG_PRINT(1, ("_mali_ukk_mem_cow: Failed to cow!\n"));
+		goto failed_do_cow;
+	}
+
+	/**
+	*map to GPU side
+	*/
+	mali_allocation->mali_mapping.addr = args->vaddr;
+	/* set gpu mmu propery */
+	_mali_memory_gpu_map_property_set(&mali_allocation->mali_mapping.properties, args->flags);
+
+	_mali_osk_mutex_wait(session->memory_lock);
+	/* Map on Mali */
+	ret = mali_mem_mali_map_prepare(mali_allocation);
+	if (0 != ret) {
+		MALI_DEBUG_PRINT(1, (" prepare map fail! \n"));
+		goto failed_gpu_map;
+	}
+
+	if (!(mem_backend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED)) {
+		mali_mem_cow_mali_map(mem_backend, 0, mem_backend->size);
+	}
+
+	_mali_osk_mutex_signal(session->memory_lock);
+
+	mutex_lock(&target_backend->mutex);
+	target_backend->flags |= MALI_MEM_BACKEND_FLAG_COWED;
+	mutex_unlock(&target_backend->mutex);
+
+	atomic_add(args->range_size / MALI_MMU_PAGE_SIZE, &session->mali_mem_allocated_pages);
+	if (atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > session->max_mali_mem_allocated_size) {
+		session->max_mali_mem_allocated_size = atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+	}
+	return _MALI_OSK_ERR_OK;
+
+failed_gpu_map:
+	_mali_osk_mutex_signal(session->memory_lock);
+	mali_mem_cow_release(mem_backend, MALI_FALSE);
+	mem_backend->cow_mem.count = 0;
+failed_do_cow:
+	mali_mem_backend_struct_destory(&mem_backend, mali_allocation->backend_handle);
+failed_alloc_backend:
+	mali_vma_offset_remove(&session->allocation_mgr, &mali_allocation->mali_vma_node);
+	mali_mem_allocation_struct_destory(mali_allocation);
+
+	return ret;
+}
+
+_mali_osk_errcode_t _mali_ukk_mem_cow_modify_range(_mali_uk_cow_modify_range_s *args)
+{
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+	mali_mem_backend *mem_backend = NULL;
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+
+	MALI_DEBUG_PRINT(4, (" _mali_ukk_mem_cow_modify_range called! \n"));
+	/* Get the backend that need to be modified. */
+	mem_backend = mali_mem_backend_struct_search(session, args->vaddr);
+
+	if (NULL == mem_backend || 0 == mem_backend->size) {
+		MALI_DEBUG_ASSERT_POINTER(mem_backend);
+		MALI_DEBUG_ASSERT(0 != mem_backend->size);
+		return ret;
+	}
+
+	MALI_DEBUG_ASSERT(MALI_MEM_COW  == mem_backend->type);
+
+	ret =  mali_memory_cow_modify_range(mem_backend, args->range_start, args->size);
+	args->change_pages_nr = mem_backend->cow_mem.change_pages_nr;
+	if (_MALI_OSK_ERR_OK != ret)
+		return  ret;
+	_mali_osk_mutex_wait(session->memory_lock);
+	if (!(mem_backend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED)) {
+		mali_mem_cow_mali_map(mem_backend, args->range_start, args->size);
+	}
+	_mali_osk_mutex_signal(session->memory_lock);
+
+	atomic_add(args->change_pages_nr, &session->mali_mem_allocated_pages);
+	if (atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > session->max_mali_mem_allocated_size) {
+		session->max_mali_mem_allocated_size = atomic_read(&session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+_mali_osk_errcode_t _mali_ukk_mem_resize(_mali_uk_mem_resize_s *args)
+{
+	mali_mem_backend *mem_backend = NULL;
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_FAULT;
+
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_PRINT(4, (" mali_mem_resize_memory called! \n"));
+	MALI_DEBUG_ASSERT(0 == args->psize %  MALI_MMU_PAGE_SIZE);
+
+	/* Get the memory backend that need to be resize. */
+	mem_backend = mali_mem_backend_struct_search(session, args->vaddr);
+
+	if (NULL == mem_backend)  {
+		MALI_DEBUG_PRINT(2, ("_mali_ukk_mem_resize: memory backend = NULL!\n"));
+		return ret;
+	}
+
+	MALI_DEBUG_ASSERT(args->psize != mem_backend->size);
+
+	ret = mali_mem_resize(session, mem_backend, args->psize);
+
+	return ret;
+}
+
+_mali_osk_errcode_t _mali_ukk_mem_usage_get(_mali_uk_profiling_memory_usage_get_s *args)
+{
+	args->memory_usage = _mali_ukk_report_memory_usage();
+	if (0 != args->vaddr) {
+		mali_mem_backend *mem_backend = NULL;
+		struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+		/* Get the backend that need to be modified. */
+		mem_backend = mali_mem_backend_struct_search(session, args->vaddr);
+		if (NULL == mem_backend) {
+			MALI_DEBUG_ASSERT_POINTER(mem_backend);
+			return _MALI_OSK_ERR_FAULT;
+		}
+
+		if (MALI_MEM_COW == mem_backend->type)
+			args->change_pages_nr = mem_backend->cow_mem.change_pages_nr;
+	}
+	return _MALI_OSK_ERR_OK;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_manager.h b/drivers/gpu/arm/mali400/linux/mali_memory_manager.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_manager.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_manager.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_MANAGER_H__
+#define __MALI_MEMORY_MANAGER_H__
+
+#include "mali_osk.h"
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/rbtree.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+#include "mali_memory_types.h"
+#include "mali_memory_os_alloc.h"
+#include "mali_uk_types.h"
+
+struct mali_allocation_manager {
+	rwlock_t vm_lock;
+	struct rb_root allocation_mgr_rb;
+	struct list_head head;
+	struct mutex list_mutex;
+	u32 mali_allocation_num;
+};
+
+extern struct idr mali_backend_idr;
+extern struct mutex mali_idr_mutex;
+
+int mali_memory_manager_init(struct mali_allocation_manager *mgr);
+void mali_memory_manager_uninit(struct mali_allocation_manager *mgr);
+
+void  mali_mem_allocation_struct_destory(mali_mem_allocation *alloc);
+_mali_osk_errcode_t mali_mem_add_mem_size(struct mali_session_data *session, u32 mali_addr, u32 add_size);
+mali_mem_backend *mali_mem_backend_struct_search(struct mali_session_data *session, u32 mali_address);
+_mali_osk_errcode_t _mali_ukk_mem_allocate(_mali_uk_alloc_mem_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_free(_mali_uk_free_mem_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_bind(_mali_uk_bind_mem_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_unbind(_mali_uk_unbind_mem_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_cow(_mali_uk_cow_mem_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_cow_modify_range(_mali_uk_cow_modify_range_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_usage_get(_mali_uk_profiling_memory_usage_get_s *args);
+_mali_osk_errcode_t _mali_ukk_mem_resize(_mali_uk_mem_resize_s *args);
+
+#endif
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.c b/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,812 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/version.h>
+#include <linux/platform_device.h>
+#include <linux/workqueue.h>
+
+#include "mali_osk.h"
+#include "mali_memory.h"
+#include "mali_memory_os_alloc.h"
+#include "mali_kernel_linux.h"
+
+/* Minimum size of allocator page pool */
+#define MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES (MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_MB * 256)
+#define MALI_OS_MEMORY_POOL_TRIM_JIFFIES (10 * CONFIG_HZ) /* Default to 10s */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+/* Write combine dma_attrs */
+static unsigned long dma_attrs_wc;
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
+static int mali_mem_os_shrink(int nr_to_scan, gfp_t gfp_mask);
+#else
+static int mali_mem_os_shrink(struct shrinker *shrinker, int nr_to_scan, gfp_t gfp_mask);
+#endif
+#else
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 12, 0)
+static int mali_mem_os_shrink(struct shrinker *shrinker, struct shrink_control *sc);
+#else
+static unsigned long mali_mem_os_shrink(struct shrinker *shrinker, struct shrink_control *sc);
+static unsigned long mali_mem_os_shrink_count(struct shrinker *shrinker, struct shrink_control *sc);
+#endif
+#endif
+static void mali_mem_os_trim_pool(struct work_struct *work);
+
+struct mali_mem_os_allocator mali_mem_os_allocator = {
+	.pool_lock = __SPIN_LOCK_UNLOCKED(pool_lock),
+	.pool_pages = LIST_HEAD_INIT(mali_mem_os_allocator.pool_pages),
+	.pool_count = 0,
+
+	.allocated_pages = ATOMIC_INIT(0),
+	.allocation_limit = 0,
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 12, 0)
+	.shrinker.shrink = mali_mem_os_shrink,
+#else
+	.shrinker.count_objects = mali_mem_os_shrink_count,
+	.shrinker.scan_objects = mali_mem_os_shrink,
+#endif
+	.shrinker.seeks = DEFAULT_SEEKS,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0)
+	.timed_shrinker = __DELAYED_WORK_INITIALIZER(mali_mem_os_allocator.timed_shrinker, mali_mem_os_trim_pool, TIMER_DEFERRABLE),
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+	.timed_shrinker = __DEFERRED_WORK_INITIALIZER(mali_mem_os_allocator.timed_shrinker, mali_mem_os_trim_pool),
+#else
+	.timed_shrinker = __DELAYED_WORK_INITIALIZER(mali_mem_os_allocator.timed_shrinker, mali_mem_os_trim_pool),
+#endif
+};
+
+u32 mali_mem_os_free(struct list_head *os_pages, u32 pages_count, mali_bool cow_flag)
+{
+	LIST_HEAD(pages);
+	struct mali_page_node *m_page, *m_tmp;
+	u32 free_pages_nr = 0;
+
+	if (MALI_TRUE == cow_flag) {
+		list_for_each_entry_safe(m_page, m_tmp, os_pages, list) {
+			/*only handle OS node here */
+			if (m_page->type == MALI_PAGE_NODE_OS) {
+				if (1 == _mali_page_node_get_ref_count(m_page)) {
+					list_move(&m_page->list, &pages);
+					atomic_sub(1, &mali_mem_os_allocator.allocated_pages);
+					free_pages_nr ++;
+				} else {
+					_mali_page_node_unref(m_page);
+					m_page->page = NULL;
+					list_del(&m_page->list);
+					kfree(m_page);
+				}
+			}
+		}
+	} else {
+		list_cut_position(&pages, os_pages, os_pages->prev);
+		atomic_sub(pages_count, &mali_mem_os_allocator.allocated_pages);
+		free_pages_nr = pages_count;
+	}
+
+	/* Put pages on pool. */
+	spin_lock(&mali_mem_os_allocator.pool_lock);
+	list_splice(&pages, &mali_mem_os_allocator.pool_pages);
+	mali_mem_os_allocator.pool_count += free_pages_nr;
+	spin_unlock(&mali_mem_os_allocator.pool_lock);
+
+	if (MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES < mali_mem_os_allocator.pool_count) {
+		MALI_DEBUG_PRINT(5, ("OS Mem: Starting pool trim timer %u\n", mali_mem_os_allocator.pool_count));
+		queue_delayed_work(mali_mem_os_allocator.wq, &mali_mem_os_allocator.timed_shrinker, MALI_OS_MEMORY_POOL_TRIM_JIFFIES);
+	}
+	return free_pages_nr;
+}
+
+/**
+* put page without put it into page pool
+*/
+_mali_osk_errcode_t mali_mem_os_put_page(struct page *page)
+{
+	MALI_DEBUG_ASSERT_POINTER(page);
+	if (1 == page_count(page)) {
+		atomic_sub(1, &mali_mem_os_allocator.allocated_pages);
+		dma_unmap_page(&mali_platform_device->dev, page_private(page),
+			       _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+		ClearPagePrivate(page);
+	}
+	put_page(page);
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t mali_mem_os_resize_pages(mali_mem_os_mem *mem_from, mali_mem_os_mem *mem_to, u32 start_page, u32 page_count)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	u32 i = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(mem_from);
+	MALI_DEBUG_ASSERT_POINTER(mem_to);
+
+	if (mem_from->count < start_page + page_count) {
+		return _MALI_OSK_ERR_INVALID_ARGS;
+	}
+
+	list_for_each_entry_safe(m_page, m_tmp, &mem_from->pages, list) {
+		if (i >= start_page && i < start_page + page_count) {
+			list_move_tail(&m_page->list, &mem_to->pages);
+			mem_from->count--;
+			mem_to->count++;
+		}
+		i++;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+
+int mali_mem_os_alloc_pages(mali_mem_os_mem *os_mem, u32 size)
+{
+	struct page *new_page;
+	LIST_HEAD(pages_list);
+	size_t page_count = PAGE_ALIGN(size) / _MALI_OSK_MALI_PAGE_SIZE;
+	size_t remaining = page_count;
+	struct mali_page_node *m_page, *m_tmp;
+	u32 i;
+
+	MALI_DEBUG_ASSERT_POINTER(os_mem);
+
+	if (atomic_read(&mali_mem_os_allocator.allocated_pages) * _MALI_OSK_MALI_PAGE_SIZE + size > mali_mem_os_allocator.allocation_limit) {
+		MALI_DEBUG_PRINT(2, ("Mali Mem: Unable to allocate %u bytes. Currently allocated: %lu, max limit %lu\n",
+				     size,
+				     atomic_read(&mali_mem_os_allocator.allocated_pages) * _MALI_OSK_MALI_PAGE_SIZE,
+				     mali_mem_os_allocator.allocation_limit));
+		return -ENOMEM;
+	}
+
+	INIT_LIST_HEAD(&os_mem->pages);
+	os_mem->count = page_count;
+
+	/* Grab pages from pool. */
+	{
+		size_t pool_pages;
+		spin_lock(&mali_mem_os_allocator.pool_lock);
+		pool_pages = min(remaining, mali_mem_os_allocator.pool_count);
+		for (i = pool_pages; i > 0; i--) {
+			BUG_ON(list_empty(&mali_mem_os_allocator.pool_pages));
+			list_move(mali_mem_os_allocator.pool_pages.next, &pages_list);
+		}
+		mali_mem_os_allocator.pool_count -= pool_pages;
+		remaining -= pool_pages;
+		spin_unlock(&mali_mem_os_allocator.pool_lock);
+	}
+
+	/* Process pages from pool. */
+	i = 0;
+	list_for_each_entry_safe(m_page, m_tmp, &pages_list, list) {
+		BUG_ON(NULL == m_page);
+
+		list_move_tail(&m_page->list, &os_mem->pages);
+	}
+
+	/* Allocate new pages, if needed. */
+	for (i = 0; i < remaining; i++) {
+		dma_addr_t dma_addr;
+		gfp_t flags = __GFP_ZERO | __GFP_REPEAT | __GFP_NOWARN | __GFP_COLD;
+		int err;
+
+#if defined(CONFIG_ARM) && !defined(CONFIG_ARM_LPAE)
+		flags |= GFP_HIGHUSER;
+#else
+#ifdef CONFIG_ZONE_DMA32
+		flags |= GFP_DMA32;
+#else
+#ifdef CONFIG_ZONE_DMA
+		flags |= GFP_DMA;
+#else
+		/* arm64 utgard only work on < 4G, but the kernel
+		 * didn't provide method to allocte memory < 4G
+		 */
+		MALI_DEBUG_ASSERT(0);
+#endif
+#endif
+#endif
+
+		new_page = alloc_page(flags);
+
+		if (unlikely(NULL == new_page)) {
+			/* Calculate the number of pages actually allocated, and free them. */
+			os_mem->count = (page_count - remaining) + i;
+			atomic_add(os_mem->count, &mali_mem_os_allocator.allocated_pages);
+			mali_mem_os_free(&os_mem->pages, os_mem->count, MALI_FALSE);
+			return -ENOMEM;
+		}
+
+		/* Ensure page is flushed from CPU caches. */
+		dma_addr = dma_map_page(&mali_platform_device->dev, new_page,
+					0, _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+
+		err = dma_mapping_error(&mali_platform_device->dev, dma_addr);
+		if (unlikely(err)) {
+			MALI_DEBUG_PRINT_ERROR(("OS Mem: Failed to DMA map page %p: %u",
+						new_page, err));
+			__free_page(new_page);
+			os_mem->count = (page_count - remaining) + i;
+			atomic_add(os_mem->count, &mali_mem_os_allocator.allocated_pages);
+			mali_mem_os_free(&os_mem->pages, os_mem->count, MALI_FALSE);
+			return -EFAULT;
+		}
+
+		/* Store page phys addr */
+		SetPagePrivate(new_page);
+		set_page_private(new_page, dma_addr);
+
+		m_page = _mali_page_node_allocate(MALI_PAGE_NODE_OS);
+		if (unlikely(NULL == m_page)) {
+			MALI_PRINT_ERROR(("OS Mem: Can't allocate mali_page node! \n"));
+			dma_unmap_page(&mali_platform_device->dev, page_private(new_page),
+				       _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+			ClearPagePrivate(new_page);
+			__free_page(new_page);
+			os_mem->count = (page_count - remaining) + i;
+			atomic_add(os_mem->count, &mali_mem_os_allocator.allocated_pages);
+			mali_mem_os_free(&os_mem->pages, os_mem->count, MALI_FALSE);
+			return -EFAULT;
+		}
+		m_page->page = new_page;
+
+		list_add_tail(&m_page->list, &os_mem->pages);
+	}
+
+	atomic_add(page_count, &mali_mem_os_allocator.allocated_pages);
+
+	if (MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES > mali_mem_os_allocator.pool_count) {
+		MALI_DEBUG_PRINT(4, ("OS Mem: Stopping pool trim timer, only %u pages on pool\n", mali_mem_os_allocator.pool_count));
+		cancel_delayed_work(&mali_mem_os_allocator.timed_shrinker);
+	}
+
+	return 0;
+}
+
+
+_mali_osk_errcode_t mali_mem_os_mali_map(mali_mem_os_mem *os_mem, struct mali_session_data *session, u32 vaddr, u32 start_page, u32 mapping_pgae_num, u32 props)
+{
+	struct mali_page_directory *pagedir = session->page_directory;
+	struct mali_page_node *m_page;
+	u32 virt;
+	u32 prop = props;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+	MALI_DEBUG_ASSERT_POINTER(os_mem);
+
+	MALI_DEBUG_ASSERT(start_page <= os_mem->count);
+	MALI_DEBUG_ASSERT((start_page + mapping_pgae_num) <= os_mem->count);
+
+	if ((start_page + mapping_pgae_num) == os_mem->count) {
+
+		virt = vaddr + MALI_MMU_PAGE_SIZE * (start_page + mapping_pgae_num);
+
+		list_for_each_entry_reverse(m_page, &os_mem->pages, list) {
+
+			virt -= MALI_MMU_PAGE_SIZE;
+			if (mapping_pgae_num > 0) {
+				dma_addr_t phys = page_private(m_page->page);
+#if defined(CONFIG_ARCH_DMA_ADDR_T_64BIT)
+				/* Verify that the "physical" address is 32-bit and
+				* usable for Mali, when on a system with bus addresses
+				* wider than 32-bit. */
+				MALI_DEBUG_ASSERT(0 == (phys >> 32));
+#endif
+				mali_mmu_pagedir_update(pagedir, virt, (mali_dma_addr)phys, MALI_MMU_PAGE_SIZE, prop);
+			} else {
+				break;
+			}
+			mapping_pgae_num--;
+		}
+
+	} else {
+		u32 i = 0;
+		virt = vaddr;
+		list_for_each_entry(m_page, &os_mem->pages, list) {
+
+			if (i >= start_page) {
+				dma_addr_t phys = page_private(m_page->page);
+
+#if defined(CONFIG_ARCH_DMA_ADDR_T_64BIT)
+				/* Verify that the "physical" address is 32-bit and
+				* usable for Mali, when on a system with bus addresses
+				* wider than 32-bit. */
+				MALI_DEBUG_ASSERT(0 == (phys >> 32));
+#endif
+				mali_mmu_pagedir_update(pagedir, virt, (mali_dma_addr)phys, MALI_MMU_PAGE_SIZE, prop);
+			}
+			i++;
+			virt += MALI_MMU_PAGE_SIZE;
+		}
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+
+void mali_mem_os_mali_unmap(mali_mem_allocation *alloc)
+{
+	struct mali_session_data *session;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	mali_session_memory_lock(session);
+	mali_mem_mali_map_free(session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+			       alloc->flags);
+	mali_session_memory_unlock(session);
+}
+
+int mali_mem_os_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma)
+{
+	mali_mem_os_mem *os_mem = &mem_bkend->os_mem;
+	struct mali_page_node *m_page;
+	struct page *page;
+	int ret;
+	unsigned long addr = vma->vm_start;
+	MALI_DEBUG_ASSERT(MALI_MEM_OS == mem_bkend->type);
+
+	list_for_each_entry(m_page, &os_mem->pages, list) {
+		/* We should use vm_insert_page, but it does a dcache
+		 * flush which makes it way slower than remap_pfn_range or vm_insert_pfn.
+		ret = vm_insert_page(vma, addr, page);
+		*/
+		page = m_page->page;
+		ret = vm_insert_pfn(vma, addr, page_to_pfn(page));
+
+		if (unlikely(0 != ret)) {
+			return -EFAULT;
+		}
+		addr += _MALI_OSK_MALI_PAGE_SIZE;
+	}
+
+	return 0;
+}
+
+_mali_osk_errcode_t mali_mem_os_resize_cpu_map_locked(mali_mem_backend *mem_bkend, struct vm_area_struct *vma, unsigned long start_vaddr, u32 mappig_size)
+{
+	mali_mem_os_mem *os_mem = &mem_bkend->os_mem;
+	struct mali_page_node *m_page;
+	int ret;
+	int offset;
+	int mapping_page_num;
+	int count ;
+
+	unsigned long vstart = vma->vm_start;
+	count = 0;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_OS);
+	MALI_DEBUG_ASSERT(0 == start_vaddr % _MALI_OSK_MALI_PAGE_SIZE);
+	MALI_DEBUG_ASSERT(0 == vstart % _MALI_OSK_MALI_PAGE_SIZE);
+	offset = (start_vaddr - vstart) / _MALI_OSK_MALI_PAGE_SIZE;
+	MALI_DEBUG_ASSERT(offset <= os_mem->count);
+	mapping_page_num = mappig_size / _MALI_OSK_MALI_PAGE_SIZE;
+	MALI_DEBUG_ASSERT((offset + mapping_page_num) <= os_mem->count);
+
+	if ((offset + mapping_page_num) == os_mem->count) {
+
+		unsigned long vm_end = start_vaddr + mappig_size;
+
+		list_for_each_entry_reverse(m_page, &os_mem->pages, list) {
+
+			vm_end -= _MALI_OSK_MALI_PAGE_SIZE;
+			if (mapping_page_num > 0) {
+				ret = vm_insert_pfn(vma, vm_end, page_to_pfn(m_page->page));
+
+				if (unlikely(0 != ret)) {
+					/*will return -EBUSY If the page has already been mapped into table, but it's OK*/
+					if (-EBUSY == ret) {
+						break;
+					} else {
+						MALI_DEBUG_PRINT(1, ("OS Mem: mali_mem_os_resize_cpu_map_locked failed, ret = %d, offset is %d,page_count is %d\n",
+								     ret,  offset + mapping_page_num, os_mem->count));
+					}
+					return _MALI_OSK_ERR_FAULT;
+				}
+			} else {
+				break;
+			}
+			mapping_page_num--;
+
+		}
+	} else {
+
+		list_for_each_entry(m_page, &os_mem->pages, list) {
+			if (count >= offset) {
+
+				ret = vm_insert_pfn(vma, vstart, page_to_pfn(m_page->page));
+
+				if (unlikely(0 != ret)) {
+					/*will return -EBUSY If the page has already been mapped into table, but it's OK*/
+					if (-EBUSY == ret) {
+						break;
+					} else {
+						MALI_DEBUG_PRINT(1, ("OS Mem: mali_mem_os_resize_cpu_map_locked failed, ret = %d, count is %d, offset is %d,page_count is %d\n",
+								     ret, count, offset, os_mem->count));
+					}
+					return _MALI_OSK_ERR_FAULT;
+				}
+			}
+			count++;
+			vstart += _MALI_OSK_MALI_PAGE_SIZE;
+		}
+	}
+	return _MALI_OSK_ERR_OK;
+}
+
+u32 mali_mem_os_release(mali_mem_backend *mem_bkend)
+{
+
+	mali_mem_allocation *alloc;
+	struct mali_session_data *session;
+	u32 free_pages_nr = 0;
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend);
+	MALI_DEBUG_ASSERT(MALI_MEM_OS == mem_bkend->type);
+
+	alloc = mem_bkend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	/* Unmap the memory from the mali virtual address space. */
+	mali_mem_os_mali_unmap(alloc);
+	mutex_lock(&mem_bkend->mutex);
+	/* Free pages */
+	if (MALI_MEM_BACKEND_FLAG_COWED & mem_bkend->flags) {
+		/* Lock to avoid the free race condition for the cow shared memory page node. */
+		_mali_osk_mutex_wait(session->cow_lock);
+		free_pages_nr = mali_mem_os_free(&mem_bkend->os_mem.pages, mem_bkend->os_mem.count, MALI_TRUE);
+		_mali_osk_mutex_signal(session->cow_lock);
+	} else {
+		free_pages_nr = mali_mem_os_free(&mem_bkend->os_mem.pages, mem_bkend->os_mem.count, MALI_FALSE);
+	}
+	mutex_unlock(&mem_bkend->mutex);
+
+	MALI_DEBUG_PRINT(4, ("OS Mem free : allocated size = 0x%x, free size = 0x%x\n", mem_bkend->os_mem.count * _MALI_OSK_MALI_PAGE_SIZE,
+			     free_pages_nr * _MALI_OSK_MALI_PAGE_SIZE));
+
+	mem_bkend->os_mem.count = 0;
+	return free_pages_nr;
+}
+
+
+#define MALI_MEM_OS_PAGE_TABLE_PAGE_POOL_SIZE 128
+static struct {
+	struct {
+		mali_dma_addr phys;
+		mali_io_address mapping;
+	} page[MALI_MEM_OS_PAGE_TABLE_PAGE_POOL_SIZE];
+	size_t count;
+	spinlock_t lock;
+} mali_mem_page_table_page_pool = {
+	.count = 0,
+	.lock = __SPIN_LOCK_UNLOCKED(pool_lock),
+};
+
+_mali_osk_errcode_t mali_mem_os_get_table_page(mali_dma_addr *phys, mali_io_address *mapping)
+{
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_NOMEM;
+	dma_addr_t tmp_phys;
+
+	spin_lock(&mali_mem_page_table_page_pool.lock);
+	if (0 < mali_mem_page_table_page_pool.count) {
+		u32 i = --mali_mem_page_table_page_pool.count;
+		*phys = mali_mem_page_table_page_pool.page[i].phys;
+		*mapping = mali_mem_page_table_page_pool.page[i].mapping;
+
+		ret = _MALI_OSK_ERR_OK;
+	}
+	spin_unlock(&mali_mem_page_table_page_pool.lock);
+
+	if (_MALI_OSK_ERR_OK != ret) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		*mapping = dma_alloc_attrs(&mali_platform_device->dev,
+					   _MALI_OSK_MALI_PAGE_SIZE, &tmp_phys,
+					   GFP_KERNEL, dma_attrs_wc);
+#else
+		*mapping = dma_alloc_writecombine(&mali_platform_device->dev,
+						  _MALI_OSK_MALI_PAGE_SIZE, &tmp_phys, GFP_KERNEL);
+#endif
+		if (NULL != *mapping) {
+			ret = _MALI_OSK_ERR_OK;
+
+#if defined(CONFIG_ARCH_DMA_ADDR_T_64BIT)
+			/* Verify that the "physical" address is 32-bit and
+			 * usable for Mali, when on a system with bus addresses
+			 * wider than 32-bit. */
+			MALI_DEBUG_ASSERT(0 == (tmp_phys >> 32));
+#endif
+
+			*phys = (mali_dma_addr)tmp_phys;
+		}
+	}
+
+	return ret;
+}
+
+void mali_mem_os_release_table_page(mali_dma_addr phys, void *virt)
+{
+	spin_lock(&mali_mem_page_table_page_pool.lock);
+	if (MALI_MEM_OS_PAGE_TABLE_PAGE_POOL_SIZE > mali_mem_page_table_page_pool.count) {
+		u32 i = mali_mem_page_table_page_pool.count;
+		mali_mem_page_table_page_pool.page[i].phys = phys;
+		mali_mem_page_table_page_pool.page[i].mapping = virt;
+
+		++mali_mem_page_table_page_pool.count;
+
+		spin_unlock(&mali_mem_page_table_page_pool.lock);
+	} else {
+		spin_unlock(&mali_mem_page_table_page_pool.lock);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		dma_free_attrs(&mali_platform_device->dev,
+			       _MALI_OSK_MALI_PAGE_SIZE, virt, phys,
+			       dma_attrs_wc);
+#else
+		dma_free_writecombine(&mali_platform_device->dev,
+				      _MALI_OSK_MALI_PAGE_SIZE, virt, phys);
+#endif
+	}
+}
+
+void mali_mem_os_free_page_node(struct mali_page_node *m_page)
+{
+	struct page *page = m_page->page;
+	MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_OS);
+
+	if (1  == page_count(page)) {
+		dma_unmap_page(&mali_platform_device->dev, page_private(page),
+			       _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+		ClearPagePrivate(page);
+	}
+	__free_page(page);
+	m_page->page = NULL;
+	list_del(&m_page->list);
+	kfree(m_page);
+}
+
+/* The maximum number of page table pool pages to free in one go. */
+#define MALI_MEM_OS_CHUNK_TO_FREE 64UL
+
+/* Free a certain number of pages from the page table page pool.
+ * The pool lock must be held when calling the function, and the lock will be
+ * released before returning.
+ */
+static void mali_mem_os_page_table_pool_free(size_t nr_to_free)
+{
+	mali_dma_addr phys_arr[MALI_MEM_OS_CHUNK_TO_FREE];
+	void *virt_arr[MALI_MEM_OS_CHUNK_TO_FREE];
+	u32 i;
+
+	MALI_DEBUG_ASSERT(nr_to_free <= MALI_MEM_OS_CHUNK_TO_FREE);
+
+	/* Remove nr_to_free pages from the pool and store them locally on stack. */
+	for (i = 0; i < nr_to_free; i++) {
+		u32 pool_index = mali_mem_page_table_page_pool.count - i - 1;
+
+		phys_arr[i] = mali_mem_page_table_page_pool.page[pool_index].phys;
+		virt_arr[i] = mali_mem_page_table_page_pool.page[pool_index].mapping;
+	}
+
+	mali_mem_page_table_page_pool.count -= nr_to_free;
+
+	spin_unlock(&mali_mem_page_table_page_pool.lock);
+
+	/* After releasing the spinlock: free the pages we removed from the pool. */
+	for (i = 0; i < nr_to_free; i++) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+		dma_free_attrs(&mali_platform_device->dev, _MALI_OSK_MALI_PAGE_SIZE,
+			       virt_arr[i], (dma_addr_t)phys_arr[i], dma_attrs_wc);
+#else
+		dma_free_writecombine(&mali_platform_device->dev,
+				      _MALI_OSK_MALI_PAGE_SIZE,
+				      virt_arr[i], (dma_addr_t)phys_arr[i]);
+#endif
+	}
+}
+
+static void mali_mem_os_trim_page_table_page_pool(void)
+{
+	size_t nr_to_free = 0;
+	size_t nr_to_keep;
+
+	/* Keep 2 page table pages for each 1024 pages in the page cache. */
+	nr_to_keep = mali_mem_os_allocator.pool_count / 512;
+	/* And a minimum of eight pages, to accomodate new sessions. */
+	nr_to_keep += 8;
+
+	if (0 == spin_trylock(&mali_mem_page_table_page_pool.lock)) return;
+
+	if (nr_to_keep < mali_mem_page_table_page_pool.count) {
+		nr_to_free = mali_mem_page_table_page_pool.count - nr_to_keep;
+		nr_to_free = min((size_t)MALI_MEM_OS_CHUNK_TO_FREE, nr_to_free);
+	}
+
+	/* Pool lock will be released by the callee. */
+	mali_mem_os_page_table_pool_free(nr_to_free);
+}
+
+static unsigned long mali_mem_os_shrink_count(struct shrinker *shrinker, struct shrink_control *sc)
+{
+	return mali_mem_os_allocator.pool_count;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 35)
+static int mali_mem_os_shrink(int nr_to_scan, gfp_t gfp_mask)
+#else
+static int mali_mem_os_shrink(struct shrinker *shrinker, int nr_to_scan, gfp_t gfp_mask)
+#endif /* Linux < 2.6.35 */
+#else
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 12, 0)
+static int mali_mem_os_shrink(struct shrinker *shrinker, struct shrink_control *sc)
+#else
+static unsigned long mali_mem_os_shrink(struct shrinker *shrinker, struct shrink_control *sc)
+#endif /* Linux < 3.12.0 */
+#endif /* Linux < 3.0.0 */
+{
+	struct mali_page_node *m_page, *m_tmp;
+	unsigned long flags;
+	struct list_head *le, pages;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 0, 0)
+	int nr = nr_to_scan;
+#else
+	int nr = sc->nr_to_scan;
+#endif
+
+	if (0 == nr) {
+		return mali_mem_os_shrink_count(shrinker, sc);
+	}
+
+	if (0 == spin_trylock_irqsave(&mali_mem_os_allocator.pool_lock, flags)) {
+		/* Not able to lock. */
+		return -1;
+	}
+
+	if (0 == mali_mem_os_allocator.pool_count) {
+		/* No pages availble */
+		spin_unlock_irqrestore(&mali_mem_os_allocator.pool_lock, flags);
+		return 0;
+	}
+
+	/* Release from general page pool */
+	nr = min((size_t)nr, mali_mem_os_allocator.pool_count);
+	mali_mem_os_allocator.pool_count -= nr;
+	list_for_each(le, &mali_mem_os_allocator.pool_pages) {
+		--nr;
+		if (0 == nr) break;
+	}
+	list_cut_position(&pages, &mali_mem_os_allocator.pool_pages, le);
+	spin_unlock_irqrestore(&mali_mem_os_allocator.pool_lock, flags);
+
+	list_for_each_entry_safe(m_page, m_tmp, &pages, list) {
+		mali_mem_os_free_page_node(m_page);
+	}
+
+	if (MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES > mali_mem_os_allocator.pool_count) {
+		/* Pools are empty, stop timer */
+		MALI_DEBUG_PRINT(5, ("Stopping timer, only %u pages on pool\n", mali_mem_os_allocator.pool_count));
+		cancel_delayed_work(&mali_mem_os_allocator.timed_shrinker);
+	}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 12, 0)
+	return mali_mem_os_shrink_count(shrinker, sc);
+#else
+	return nr;
+#endif
+}
+
+static void mali_mem_os_trim_pool(struct work_struct *data)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	struct list_head *le;
+	LIST_HEAD(pages);
+	size_t nr_to_free;
+
+	MALI_IGNORE(data);
+
+	MALI_DEBUG_PRINT(3, ("OS Mem: Trimming pool %u\n", mali_mem_os_allocator.pool_count));
+
+	/* Release from general page pool */
+	spin_lock(&mali_mem_os_allocator.pool_lock);
+	if (MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES < mali_mem_os_allocator.pool_count) {
+		size_t count = mali_mem_os_allocator.pool_count - MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES;
+		const size_t min_to_free = min(64, MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES);
+
+		/* Free half the pages on the pool above the static limit. Or 64 pages, 256KB. */
+		nr_to_free = max(count / 2, min_to_free);
+
+		mali_mem_os_allocator.pool_count -= nr_to_free;
+		list_for_each(le, &mali_mem_os_allocator.pool_pages) {
+			--nr_to_free;
+			if (0 == nr_to_free) break;
+		}
+		list_cut_position(&pages, &mali_mem_os_allocator.pool_pages, le);
+	}
+	spin_unlock(&mali_mem_os_allocator.pool_lock);
+
+	list_for_each_entry_safe(m_page, m_tmp, &pages, list) {
+		mali_mem_os_free_page_node(m_page);
+	}
+
+	/* Release some pages from page table page pool */
+	mali_mem_os_trim_page_table_page_pool();
+
+	if (MALI_OS_MEMORY_KERNEL_BUFFER_SIZE_IN_PAGES < mali_mem_os_allocator.pool_count) {
+		MALI_DEBUG_PRINT(4, ("OS Mem: Starting pool trim timer %u\n", mali_mem_os_allocator.pool_count));
+		queue_delayed_work(mali_mem_os_allocator.wq, &mali_mem_os_allocator.timed_shrinker, MALI_OS_MEMORY_POOL_TRIM_JIFFIES);
+	}
+}
+
+_mali_osk_errcode_t mali_mem_os_init(void)
+{
+	mali_mem_os_allocator.wq = alloc_workqueue("mali-mem", WQ_UNBOUND, 1);
+	if (NULL == mali_mem_os_allocator.wq) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+	dma_attrs_wc |= DMA_ATTR_WRITE_COMBINE;
+#endif
+
+	register_shrinker(&mali_mem_os_allocator.shrinker);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mem_os_term(void)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	unregister_shrinker(&mali_mem_os_allocator.shrinker);
+	cancel_delayed_work_sync(&mali_mem_os_allocator.timed_shrinker);
+
+	if (NULL != mali_mem_os_allocator.wq) {
+		destroy_workqueue(mali_mem_os_allocator.wq);
+		mali_mem_os_allocator.wq = NULL;
+	}
+
+	spin_lock(&mali_mem_os_allocator.pool_lock);
+	list_for_each_entry_safe(m_page, m_tmp, &mali_mem_os_allocator.pool_pages, list) {
+		mali_mem_os_free_page_node(m_page);
+
+		--mali_mem_os_allocator.pool_count;
+	}
+	BUG_ON(mali_mem_os_allocator.pool_count);
+	spin_unlock(&mali_mem_os_allocator.pool_lock);
+
+	/* Release from page table page pool */
+	do {
+		u32 nr_to_free;
+
+		spin_lock(&mali_mem_page_table_page_pool.lock);
+
+		nr_to_free = min((size_t)MALI_MEM_OS_CHUNK_TO_FREE, mali_mem_page_table_page_pool.count);
+
+		/* Pool lock will be released by the callee. */
+		mali_mem_os_page_table_pool_free(nr_to_free);
+	} while (0 != mali_mem_page_table_page_pool.count);
+}
+
+_mali_osk_errcode_t mali_memory_core_resource_os_memory(u32 size)
+{
+	mali_mem_os_allocator.allocation_limit = size;
+
+	MALI_SUCCESS;
+}
+
+u32 mali_mem_os_stat(void)
+{
+	return atomic_read(&mali_mem_os_allocator.allocated_pages) * _MALI_OSK_MALI_PAGE_SIZE;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.h b/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_os_alloc.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_OS_ALLOC_H__
+#define __MALI_MEMORY_OS_ALLOC_H__
+
+#include "mali_osk.h"
+#include "mali_memory_types.h"
+
+
+/** @brief Release Mali OS memory
+ *
+ * The session memory_lock must be held when calling this function.
+ *
+ * @param mem_bkend Pointer to the mali_mem_backend to release
+ */
+u32 mali_mem_os_release(mali_mem_backend *mem_bkend);
+
+_mali_osk_errcode_t mali_mem_os_get_table_page(mali_dma_addr *phys, mali_io_address *mapping);
+
+void mali_mem_os_release_table_page(mali_dma_addr phys, void *virt);
+
+_mali_osk_errcode_t mali_mem_os_init(void);
+
+void mali_mem_os_term(void);
+
+u32 mali_mem_os_stat(void);
+
+void mali_mem_os_free_page_node(struct mali_page_node *m_page);
+
+int mali_mem_os_alloc_pages(mali_mem_os_mem *os_mem, u32 size);
+
+u32 mali_mem_os_free(struct list_head *os_pages, u32 pages_count, mali_bool cow_flag);
+
+_mali_osk_errcode_t mali_mem_os_put_page(struct page *page);
+
+_mali_osk_errcode_t mali_mem_os_resize_pages(mali_mem_os_mem *mem_from, mali_mem_os_mem *mem_to, u32 start_page, u32 page_count);
+
+_mali_osk_errcode_t mali_mem_os_mali_map(mali_mem_os_mem *os_mem, struct mali_session_data *session, u32 vaddr, u32 start_page, u32 mapping_pgae_num, u32 props);
+
+void mali_mem_os_mali_unmap(mali_mem_allocation *alloc);
+
+int mali_mem_os_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma);
+
+_mali_osk_errcode_t mali_mem_os_resize_cpu_map_locked(mali_mem_backend *mem_bkend, struct vm_area_struct *vma, unsigned long start_vaddr, u32 mappig_size);
+
+#endif /* __MALI_MEMORY_OS_ALLOC_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_secure.c b/drivers/gpu/arm/mali400/linux/mali_memory_secure.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_secure.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_secure.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_memory.h"
+#include "mali_memory_secure.h"
+#include "mali_osk.h"
+#include <linux/mutex.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+
+_mali_osk_errcode_t mali_mem_secure_attach_dma_buf(mali_mem_secure *secure_mem, u32 size, int mem_fd)
+{
+	struct dma_buf *buf;
+	MALI_DEBUG_ASSERT_POINTER(secure_mem);
+
+	/* get dma buffer */
+	buf = dma_buf_get(mem_fd);
+	if (IS_ERR_OR_NULL(buf)) {
+		MALI_DEBUG_PRINT_ERROR(("Failed to get dma buf!\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	if (size != buf->size) {
+		MALI_DEBUG_PRINT_ERROR(("The secure mem size not match to the dma buf size!\n"));
+		goto failed_alloc_mem;
+	}
+
+	secure_mem->buf =  buf;
+	secure_mem->attachment = dma_buf_attach(secure_mem->buf, &mali_platform_device->dev);
+	if (NULL == secure_mem->attachment) {
+		MALI_DEBUG_PRINT_ERROR(("Failed to get dma buf attachment!\n"));
+		goto failed_dma_attach;
+	}
+
+	secure_mem->sgt = dma_buf_map_attachment(secure_mem->attachment, DMA_BIDIRECTIONAL);
+	if (IS_ERR_OR_NULL(secure_mem->sgt)) {
+		MALI_DEBUG_PRINT_ERROR(("Failed to map dma buf attachment\n"));
+		goto  failed_dma_map;
+	}
+
+	secure_mem->count = size / MALI_MMU_PAGE_SIZE;
+
+	return _MALI_OSK_ERR_OK;
+
+failed_dma_map:
+	dma_buf_detach(secure_mem->buf, secure_mem->attachment);
+failed_dma_attach:
+failed_alloc_mem:
+	dma_buf_put(buf);
+	return _MALI_OSK_ERR_FAULT;
+}
+
+_mali_osk_errcode_t mali_mem_secure_mali_map(mali_mem_secure *secure_mem, struct mali_session_data *session, u32 vaddr, u32 props)
+{
+	struct mali_page_directory *pagedir;
+	struct scatterlist *sg;
+	u32 virt = vaddr;
+	u32 prop = props;
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(secure_mem);
+	MALI_DEBUG_ASSERT_POINTER(secure_mem->sgt);
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	pagedir = session->page_directory;
+
+	for_each_sg(secure_mem->sgt->sgl, sg, secure_mem->sgt->nents, i) {
+		u32 size = sg_dma_len(sg);
+		dma_addr_t phys = sg_dma_address(sg);
+
+		/* sg must be page aligned. */
+		MALI_DEBUG_ASSERT(0 == size % MALI_MMU_PAGE_SIZE);
+		MALI_DEBUG_ASSERT(0 == (phys & ~(uintptr_t)0xFFFFFFFF));
+
+		mali_mmu_pagedir_update(pagedir, virt, phys, size, prop);
+
+		MALI_DEBUG_PRINT(3, ("The secure mem physical address: 0x%x gpu virtual address: 0x%x! \n", phys, virt));
+		virt += size;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mem_secure_mali_unmap(mali_mem_allocation *alloc)
+{
+	struct mali_session_data *session;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	mali_session_memory_lock(session);
+	mali_mem_mali_map_free(session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+			       alloc->flags);
+	mali_session_memory_unlock(session);
+}
+
+
+int mali_mem_secure_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma)
+{
+
+	int ret = 0;
+	struct scatterlist *sg;
+	mali_mem_secure *secure_mem = &mem_bkend->secure_mem;
+	unsigned long addr = vma->vm_start;
+	int i;
+
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_SECURE);
+
+	for_each_sg(secure_mem->sgt->sgl, sg, secure_mem->sgt->nents, i) {
+		phys_addr_t phys;
+		dma_addr_t dev_addr;
+		u32 size, j;
+		dev_addr = sg_dma_address(sg);
+#if defined(CONFIG_ARM64) ||LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+		phys =  dma_to_phys(&mali_platform_device->dev, dev_addr);
+#else
+		phys = page_to_phys(pfn_to_page(dma_to_pfn(&mali_platform_device->dev, dev_addr)));
+#endif
+		size = sg_dma_len(sg);
+		MALI_DEBUG_ASSERT(0 == size % _MALI_OSK_MALI_PAGE_SIZE);
+
+		for (j = 0; j < size / _MALI_OSK_MALI_PAGE_SIZE; j++) {
+			ret = vm_insert_pfn(vma, addr, PFN_DOWN(phys));
+
+			if (unlikely(0 != ret)) {
+				return -EFAULT;
+			}
+			addr += _MALI_OSK_MALI_PAGE_SIZE;
+			phys += _MALI_OSK_MALI_PAGE_SIZE;
+
+			MALI_DEBUG_PRINT(3, ("The secure mem physical address: 0x%x , cpu virtual address: 0x%x! \n", phys, addr));
+		}
+	}
+	return ret;
+}
+
+u32 mali_mem_secure_release(mali_mem_backend *mem_bkend)
+{
+	struct mali_mem_secure *mem;
+	mali_mem_allocation *alloc = mem_bkend->mali_allocation;
+	u32 free_pages_nr = 0;
+	MALI_DEBUG_ASSERT(mem_bkend->type == MALI_MEM_SECURE);
+
+	mem = &mem_bkend->secure_mem;
+	MALI_DEBUG_ASSERT_POINTER(mem->attachment);
+	MALI_DEBUG_ASSERT_POINTER(mem->buf);
+	MALI_DEBUG_ASSERT_POINTER(mem->sgt);
+	/* Unmap the memory from the mali virtual address space. */
+	mali_mem_secure_mali_unmap(alloc);
+	mutex_lock(&mem_bkend->mutex);
+	dma_buf_unmap_attachment(mem->attachment, mem->sgt, DMA_BIDIRECTIONAL);
+	dma_buf_detach(mem->buf, mem->attachment);
+	dma_buf_put(mem->buf);
+	mutex_unlock(&mem_bkend->mutex);
+
+	free_pages_nr = mem->count;
+
+	return free_pages_nr;
+}
+
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_secure.h b/drivers/gpu/arm/mali400/linux/mali_memory_secure.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_secure.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_secure.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2010, 2013, 2015-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_SECURE_H__
+#define __MALI_MEMORY_SECURE_H__
+
+#include "mali_session.h"
+#include "mali_memory.h"
+#include <linux/spinlock.h>
+
+#include "mali_memory_types.h"
+
+_mali_osk_errcode_t mali_mem_secure_attach_dma_buf(mali_mem_secure *secure_mem, u32 size, int mem_fd);
+
+_mali_osk_errcode_t mali_mem_secure_mali_map(mali_mem_secure *secure_mem, struct mali_session_data *session, u32 vaddr, u32 props);
+
+void mali_mem_secure_mali_unmap(mali_mem_allocation *alloc);
+
+int mali_mem_secure_cpu_map(mali_mem_backend *mem_bkend, struct vm_area_struct *vma);
+
+u32 mali_mem_secure_release(mali_mem_backend *mem_bkend);
+
+#endif /* __MALI_MEMORY_SECURE_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.c b/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,942 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <linux/sched.h>
+#include <linux/idr.h>
+#include <linux/platform_device.h>
+#include <linux/workqueue.h>
+#include <linux/shmem_fs.h>
+#include <linux/file.h>
+#include <linux/swap.h>
+#include <linux/pagemap.h>
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_memory.h"
+#include "mali_memory_manager.h"
+#include "mali_memory_virtual.h"
+#include "mali_memory_cow.h"
+#include "mali_ukk.h"
+#include "mali_kernel_utilization.h"
+#include "mali_memory_swap_alloc.h"
+
+
+static struct _mali_osk_bitmap idx_mgr;
+static struct file *global_swap_file;
+static struct address_space *global_swap_space;
+static _mali_osk_wq_work_t *mali_mem_swap_out_workq = NULL;
+static u32 mem_backend_swapped_pool_size;
+#ifdef MALI_MEM_SWAP_TRACKING
+static u32 mem_backend_swapped_unlock_size;
+#endif
+/* Lock order: mem_backend_swapped_pool_lock  > each memory backend's mutex lock.
+ * This lock used to protect mem_backend_swapped_pool_size and mem_backend_swapped_pool. */
+static struct mutex mem_backend_swapped_pool_lock;
+static struct list_head mem_backend_swapped_pool;
+
+extern struct mali_mem_os_allocator mali_mem_os_allocator;
+
+#define MALI_SWAP_LOW_MEM_DEFAULT_VALUE (60*1024*1024)
+#define MALI_SWAP_INVALIDATE_MALI_ADDRESS (0)               /* Used to mark the given memory cookie is invalidate. */
+#define MALI_SWAP_GLOBAL_SWAP_FILE_SIZE (0xFFFFFFFF)
+#define MALI_SWAP_GLOBAL_SWAP_FILE_INDEX ((MALI_SWAP_GLOBAL_SWAP_FILE_SIZE) >> PAGE_SHIFT)
+#define MALI_SWAP_GLOBAL_SWAP_FILE_INDEX_RESERVE (1 << 15) /* Reserved for CoW nonlinear swap backend memory, the space size is 128MB. */
+
+unsigned int mali_mem_swap_out_threshold_value = MALI_SWAP_LOW_MEM_DEFAULT_VALUE;
+
+/**
+ * We have two situations to do shrinking things, one is we met low GPU utilization which shows GPU needn't touch too
+ * swappable backends in short time, and the other one is we add new swappable backends, the total pool size exceed
+ * the threshold value of the swapped pool size.
+ */
+typedef enum {
+	MALI_MEM_SWAP_SHRINK_WITH_LOW_UTILIZATION = 100,
+	MALI_MEM_SWAP_SHRINK_FOR_ADDING_NEW_BACKENDS = 257,
+} _mali_mem_swap_pool_shrink_type_t;
+
+static void mali_mem_swap_swapped_bkend_pool_check_for_low_utilization(void *arg);
+
+_mali_osk_errcode_t mali_mem_swap_init(void)
+{
+	gfp_t flags = __GFP_NORETRY | __GFP_NOWARN;
+
+	if (_MALI_OSK_ERR_OK != _mali_osk_bitmap_init(&idx_mgr, MALI_SWAP_GLOBAL_SWAP_FILE_INDEX, MALI_SWAP_GLOBAL_SWAP_FILE_INDEX_RESERVE)) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	global_swap_file = shmem_file_setup("mali_swap", MALI_SWAP_GLOBAL_SWAP_FILE_SIZE, VM_NORESERVE);
+	if (IS_ERR(global_swap_file)) {
+		_mali_osk_bitmap_term(&idx_mgr);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	global_swap_space = global_swap_file->f_path.dentry->d_inode->i_mapping;
+
+	mali_mem_swap_out_workq = _mali_osk_wq_create_work(mali_mem_swap_swapped_bkend_pool_check_for_low_utilization, NULL);
+	if (NULL == mali_mem_swap_out_workq) {
+		_mali_osk_bitmap_term(&idx_mgr);
+		fput(global_swap_file);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+#if defined(CONFIG_ARM) && !defined(CONFIG_ARM_LPAE)
+	flags |= GFP_HIGHUSER;
+#else
+#ifdef CONFIG_ZONE_DMA32
+	flags |= GFP_DMA32;
+#else
+#ifdef CONFIG_ZONE_DMA
+	flags |= GFP_DMA;
+#else
+	/* arm64 utgard only work on < 4G, but the kernel
+	 * didn't provide method to allocte memory < 4G
+	 */
+	MALI_DEBUG_ASSERT(0);
+#endif
+#endif
+#endif
+
+	/* When we use shmem_read_mapping_page to allocate/swap-in, it will
+	 * use these flags to allocate new page if need.*/
+	mapping_set_gfp_mask(global_swap_space, flags);
+
+	mem_backend_swapped_pool_size = 0;
+#ifdef MALI_MEM_SWAP_TRACKING
+	mem_backend_swapped_unlock_size = 0;
+#endif
+	mutex_init(&mem_backend_swapped_pool_lock);
+	INIT_LIST_HEAD(&mem_backend_swapped_pool);
+
+	MALI_DEBUG_PRINT(2, ("Mali SWAP: Swap out threshold vaule is %uM\n", mali_mem_swap_out_threshold_value >> 20));
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mem_swap_term(void)
+{
+	_mali_osk_bitmap_term(&idx_mgr);
+
+	fput(global_swap_file);
+
+	_mali_osk_wq_delete_work(mali_mem_swap_out_workq);
+
+	MALI_DEBUG_ASSERT(list_empty(&mem_backend_swapped_pool));
+	MALI_DEBUG_ASSERT(0 == mem_backend_swapped_pool_size);
+
+	return;
+}
+
+struct file *mali_mem_swap_get_global_swap_file(void)
+{
+	return  global_swap_file;
+}
+
+/* Judge if swappable backend in swapped pool. */
+static mali_bool mali_memory_swap_backend_in_swapped_pool(mali_mem_backend *mem_bkend)
+{
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend);
+
+	return !list_empty(&mem_bkend->list);
+}
+
+void mali_memory_swap_list_backend_delete(mali_mem_backend *mem_bkend)
+{
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend);
+
+	mutex_lock(&mem_backend_swapped_pool_lock);
+	mutex_lock(&mem_bkend->mutex);
+
+	if (MALI_FALSE == mali_memory_swap_backend_in_swapped_pool(mem_bkend)) {
+		mutex_unlock(&mem_bkend->mutex);
+		mutex_unlock(&mem_backend_swapped_pool_lock);
+		return;
+	}
+
+	MALI_DEBUG_ASSERT(!list_empty(&mem_bkend->list));
+
+	list_del_init(&mem_bkend->list);
+
+	mutex_unlock(&mem_bkend->mutex);
+
+	mem_backend_swapped_pool_size -= mem_bkend->size;
+
+	mutex_unlock(&mem_backend_swapped_pool_lock);
+}
+
+static void mali_mem_swap_out_page_node(mali_page_node *page_node)
+{
+	MALI_DEBUG_ASSERT(page_node);
+
+	dma_unmap_page(&mali_platform_device->dev, page_node->swap_it->dma_addr,
+		       _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+	set_page_dirty(page_node->swap_it->page);
+	put_page(page_node->swap_it->page);
+}
+
+void mali_mem_swap_unlock_single_mem_backend(mali_mem_backend *mem_bkend)
+{
+	mali_page_node *m_page;
+
+	MALI_DEBUG_ASSERT(1 == mutex_is_locked(&mem_bkend->mutex));
+
+	if (MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN == (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN)) {
+		return;
+	}
+
+	mem_bkend->flags |= MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN;
+
+	list_for_each_entry(m_page, &mem_bkend->swap_mem.pages, list) {
+		mali_mem_swap_out_page_node(m_page);
+	}
+
+	return;
+}
+
+static void mali_mem_swap_unlock_partial_locked_mem_backend(mali_mem_backend *mem_bkend, mali_page_node *page_node)
+{
+	mali_page_node *m_page;
+
+	MALI_DEBUG_ASSERT(1 == mutex_is_locked(&mem_bkend->mutex));
+
+	list_for_each_entry(m_page, &mem_bkend->swap_mem.pages, list) {
+		if (m_page == page_node) {
+			break;
+		}
+		mali_mem_swap_out_page_node(m_page);
+	}
+}
+
+static void mali_mem_swap_swapped_bkend_pool_shrink(_mali_mem_swap_pool_shrink_type_t shrink_type)
+{
+	mali_mem_backend *bkend, *tmp_bkend;
+	long system_free_size;
+	u32 last_gpu_utilization, gpu_utilization_threshold_value, temp_swap_out_threshold_value;
+
+	MALI_DEBUG_ASSERT(1 == mutex_is_locked(&mem_backend_swapped_pool_lock));
+
+	if (MALI_MEM_SWAP_SHRINK_WITH_LOW_UTILIZATION == shrink_type) {
+		/**
+		 * When we met that system memory is very low and Mali locked swappable memory size is less than
+		 * threshold value, and at the same time, GPU load is very low and don't need high performance,
+		 * at this condition, we can unlock more swap memory backend from swapped backends pool.
+		 */
+		gpu_utilization_threshold_value = MALI_MEM_SWAP_SHRINK_WITH_LOW_UTILIZATION;
+		temp_swap_out_threshold_value = (mali_mem_swap_out_threshold_value >> 2);
+	} else {
+		/* When we add swappable memory backends to swapped pool, we need to think that we couldn't
+		* hold too much swappable backends in Mali driver, and also we need considering performance.
+		* So there is a balance for swapping out memory backend, we should follow the following conditions:
+		* 1. Total memory size in global mem backend swapped pool is more than the defined threshold value.
+		* 2. System level free memory size is less than the defined threshold value.
+		* 3. Please note that GPU utilization problem isn't considered in this condition.
+		*/
+		gpu_utilization_threshold_value = MALI_MEM_SWAP_SHRINK_FOR_ADDING_NEW_BACKENDS;
+		temp_swap_out_threshold_value = mali_mem_swap_out_threshold_value;
+	}
+
+	/* Get system free pages number. */
+	system_free_size = global_page_state(NR_FREE_PAGES) * PAGE_SIZE;
+	last_gpu_utilization = _mali_ukk_utilization_gp_pp();
+
+	if ((last_gpu_utilization < gpu_utilization_threshold_value)
+	    && (system_free_size < mali_mem_swap_out_threshold_value)
+	    && (mem_backend_swapped_pool_size > temp_swap_out_threshold_value)) {
+		list_for_each_entry_safe(bkend, tmp_bkend, &mem_backend_swapped_pool, list) {
+			if (mem_backend_swapped_pool_size <= temp_swap_out_threshold_value) {
+				break;
+			}
+
+			mutex_lock(&bkend->mutex);
+
+			/* check if backend is in use. */
+			if (0 < bkend->using_count) {
+				mutex_unlock(&bkend->mutex);
+				continue;
+			}
+
+			mali_mem_swap_unlock_single_mem_backend(bkend);
+			list_del_init(&bkend->list);
+			mem_backend_swapped_pool_size -= bkend->size;
+#ifdef MALI_MEM_SWAP_TRACKING
+			mem_backend_swapped_unlock_size += bkend->size;
+#endif
+			mutex_unlock(&bkend->mutex);
+		}
+	}
+
+	return;
+}
+
+static void mali_mem_swap_swapped_bkend_pool_check_for_low_utilization(void *arg)
+{
+	MALI_IGNORE(arg);
+
+	mutex_lock(&mem_backend_swapped_pool_lock);
+
+	mali_mem_swap_swapped_bkend_pool_shrink(MALI_MEM_SWAP_SHRINK_WITH_LOW_UTILIZATION);
+
+	mutex_unlock(&mem_backend_swapped_pool_lock);
+}
+
+/**
+ * After PP job finished, we add all of swappable memory backend used by this PP
+ * job to the tail of the global swapped pool, and if the total size of swappable memory is more than threshold
+ * value, we also need to shrink the swapped pool start from the head of the list.
+ */
+void mali_memory_swap_list_backend_add(mali_mem_backend *mem_bkend)
+{
+	mutex_lock(&mem_backend_swapped_pool_lock);
+	mutex_lock(&mem_bkend->mutex);
+
+	if (mali_memory_swap_backend_in_swapped_pool(mem_bkend)) {
+		MALI_DEBUG_ASSERT(!list_empty(&mem_bkend->list));
+
+		list_del_init(&mem_bkend->list);
+		list_add_tail(&mem_bkend->list, &mem_backend_swapped_pool);
+		mutex_unlock(&mem_bkend->mutex);
+		mutex_unlock(&mem_backend_swapped_pool_lock);
+		return;
+	}
+
+	list_add_tail(&mem_bkend->list, &mem_backend_swapped_pool);
+
+	mutex_unlock(&mem_bkend->mutex);
+	mem_backend_swapped_pool_size += mem_bkend->size;
+
+	mali_mem_swap_swapped_bkend_pool_shrink(MALI_MEM_SWAP_SHRINK_FOR_ADDING_NEW_BACKENDS);
+
+	mutex_unlock(&mem_backend_swapped_pool_lock);
+	return;
+}
+
+
+u32 mali_mem_swap_idx_alloc(void)
+{
+	return _mali_osk_bitmap_alloc(&idx_mgr);
+}
+
+void mali_mem_swap_idx_free(u32 idx)
+{
+	_mali_osk_bitmap_free(&idx_mgr, idx);
+}
+
+static u32 mali_mem_swap_idx_range_alloc(u32 count)
+{
+	u32 index;
+
+	index = _mali_osk_bitmap_alloc_range(&idx_mgr, count);
+
+	return index;
+}
+
+static void mali_mem_swap_idx_range_free(u32 idx, int num)
+{
+	_mali_osk_bitmap_free_range(&idx_mgr, idx, num);
+}
+
+struct mali_swap_item *mali_mem_swap_alloc_swap_item(void)
+{
+	mali_swap_item *swap_item;
+
+	swap_item = kzalloc(sizeof(mali_swap_item), GFP_KERNEL);
+
+	if (NULL == swap_item) {
+		return NULL;
+	}
+
+	atomic_set(&swap_item->ref_count, 1);
+	swap_item->page = NULL;
+	atomic_add(1, &mali_mem_os_allocator.allocated_pages);
+
+	return swap_item;
+}
+
+void mali_mem_swap_free_swap_item(mali_swap_item *swap_item)
+{
+	struct inode *file_node;
+	long long start, end;
+
+	/* If this swap item is shared, we just reduce the reference counter. */
+	if (0 == atomic_dec_return(&swap_item->ref_count)) {
+		file_node = global_swap_file->f_path.dentry->d_inode;
+		start = swap_item->idx;
+		start = start << 12;
+		end = start + PAGE_SIZE;
+
+		shmem_truncate_range(file_node, start, (end - 1));
+
+		mali_mem_swap_idx_free(swap_item->idx);
+
+		atomic_sub(1, &mali_mem_os_allocator.allocated_pages);
+
+		kfree(swap_item);
+	}
+}
+
+/* Used to allocate new swap item for new memory allocation and cow page for write. */
+struct mali_page_node *_mali_mem_swap_page_node_allocate(void)
+{
+	struct mali_page_node *m_page;
+
+	m_page = _mali_page_node_allocate(MALI_PAGE_NODE_SWAP);
+
+	if (NULL == m_page) {
+		return NULL;
+	}
+
+	m_page->swap_it = mali_mem_swap_alloc_swap_item();
+
+	if (NULL == m_page->swap_it) {
+		kfree(m_page);
+		return NULL;
+	}
+
+	return m_page;
+}
+
+_mali_osk_errcode_t _mali_mem_swap_put_page_node(struct mali_page_node *m_page)
+{
+
+	mali_mem_swap_free_swap_item(m_page->swap_it);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void _mali_mem_swap_page_node_free(struct mali_page_node *m_page)
+{
+	_mali_mem_swap_put_page_node(m_page);
+
+	kfree(m_page);
+
+	return;
+}
+
+u32 mali_mem_swap_free(mali_mem_swap *swap_mem)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	u32 free_pages_nr = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(swap_mem);
+
+	list_for_each_entry_safe(m_page, m_tmp, &swap_mem->pages, list) {
+		MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_SWAP);
+
+		/* free the page node and release the swap item, if the ref count is 1,
+		 * then need also free the swap item. */
+		list_del(&m_page->list);
+		if (1 == _mali_page_node_get_ref_count(m_page)) {
+			free_pages_nr++;
+		}
+
+		_mali_mem_swap_page_node_free(m_page);
+	}
+
+	return free_pages_nr;
+}
+
+static u32 mali_mem_swap_cow_free(mali_mem_cow *cow_mem)
+{
+	struct mali_page_node *m_page, *m_tmp;
+	u32 free_pages_nr = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(cow_mem);
+
+	list_for_each_entry_safe(m_page, m_tmp, &cow_mem->pages, list) {
+		MALI_DEBUG_ASSERT(m_page->type == MALI_PAGE_NODE_SWAP);
+
+		/* free the page node and release the swap item, if the ref count is 1,
+		 * then need also free the swap item. */
+		list_del(&m_page->list);
+		if (1 == _mali_page_node_get_ref_count(m_page)) {
+			free_pages_nr++;
+		}
+
+		_mali_mem_swap_page_node_free(m_page);
+	}
+
+	return free_pages_nr;
+}
+
+u32 mali_mem_swap_release(mali_mem_backend *mem_bkend, mali_bool is_mali_mapped)
+{
+	mali_mem_allocation *alloc;
+	u32 free_pages_nr = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(mem_bkend);
+	alloc = mem_bkend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	if (is_mali_mapped) {
+		mali_mem_swap_mali_unmap(alloc);
+	}
+
+	mali_memory_swap_list_backend_delete(mem_bkend);
+
+	mutex_lock(&mem_bkend->mutex);
+	/* To make sure the given memory backend was unlocked from Mali side,
+	 * and then free this memory block. */
+	mali_mem_swap_unlock_single_mem_backend(mem_bkend);
+	mutex_unlock(&mem_bkend->mutex);
+
+	if (MALI_MEM_SWAP == mem_bkend->type) {
+		free_pages_nr = mali_mem_swap_free(&mem_bkend->swap_mem);
+	} else {
+		free_pages_nr = mali_mem_swap_cow_free(&mem_bkend->cow_mem);
+	}
+
+	return free_pages_nr;
+}
+
+mali_bool mali_mem_swap_in_page_node(struct mali_page_node *page_node)
+{
+	MALI_DEBUG_ASSERT(NULL != page_node);
+
+	page_node->swap_it->page = shmem_read_mapping_page(global_swap_space, page_node->swap_it->idx);
+
+	if (IS_ERR(page_node->swap_it->page)) {
+		MALI_DEBUG_PRINT_ERROR(("SWAP Mem: failed to swap in page with index: %d.\n", page_node->swap_it->idx));
+		return MALI_FALSE;
+	}
+
+	/* Ensure page is flushed from CPU caches. */
+	page_node->swap_it->dma_addr = dma_map_page(&mali_platform_device->dev, page_node->swap_it->page,
+				       0, _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+
+	return MALI_TRUE;
+}
+
+int mali_mem_swap_alloc_pages(mali_mem_swap *swap_mem, u32 size, u32 *bkend_idx)
+{
+	size_t page_count = PAGE_ALIGN(size) / PAGE_SIZE;
+	struct mali_page_node *m_page;
+	long system_free_size;
+	u32 i, index;
+	mali_bool ret;
+
+	MALI_DEBUG_ASSERT(NULL != swap_mem);
+	MALI_DEBUG_ASSERT(NULL != bkend_idx);
+	MALI_DEBUG_ASSERT(page_count <= MALI_SWAP_GLOBAL_SWAP_FILE_INDEX_RESERVE);
+
+	if (atomic_read(&mali_mem_os_allocator.allocated_pages) * _MALI_OSK_MALI_PAGE_SIZE + size > mali_mem_os_allocator.allocation_limit) {
+		MALI_DEBUG_PRINT(2, ("Mali Mem: Unable to allocate %u bytes. Currently allocated: %lu, max limit %lu\n",
+				     size,
+				     atomic_read(&mali_mem_os_allocator.allocated_pages) * _MALI_OSK_MALI_PAGE_SIZE,
+				     mali_mem_os_allocator.allocation_limit));
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	INIT_LIST_HEAD(&swap_mem->pages);
+	swap_mem->count = page_count;
+	index = mali_mem_swap_idx_range_alloc(page_count);
+
+	if (_MALI_OSK_BITMAP_INVALIDATE_INDEX == index) {
+		MALI_PRINT_ERROR(("Mali Swap: Failed to allocate continuous index for swappable Mali memory."));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	for (i = 0; i < page_count; i++) {
+		m_page = _mali_mem_swap_page_node_allocate();
+
+		if (NULL == m_page) {
+			MALI_DEBUG_PRINT_ERROR(("SWAP Mem: Failed to allocate mali page node."));
+			swap_mem->count = i;
+
+			mali_mem_swap_free(swap_mem);
+			mali_mem_swap_idx_range_free(index + i, page_count - i);
+			return _MALI_OSK_ERR_FAULT;
+		}
+
+		m_page->swap_it->idx = index + i;
+
+		ret = mali_mem_swap_in_page_node(m_page);
+
+		if (MALI_FALSE == ret) {
+			MALI_DEBUG_PRINT_ERROR(("SWAP Mem: Allocate new page from SHMEM file failed."));
+			_mali_mem_swap_page_node_free(m_page);
+			mali_mem_swap_idx_range_free(index + i + 1, page_count - i - 1);
+
+			swap_mem->count = i;
+			mali_mem_swap_free(swap_mem);
+			return _MALI_OSK_ERR_NOMEM;
+		}
+
+		list_add_tail(&m_page->list, &swap_mem->pages);
+	}
+
+	system_free_size = global_page_state(NR_FREE_PAGES) * PAGE_SIZE;
+
+	if ((system_free_size < mali_mem_swap_out_threshold_value)
+	    && (mem_backend_swapped_pool_size > (mali_mem_swap_out_threshold_value >> 2))
+	    && mali_utilization_enabled()) {
+		_mali_osk_wq_schedule_work(mali_mem_swap_out_workq);
+	}
+
+	*bkend_idx = index;
+	return 0;
+}
+
+void mali_mem_swap_mali_unmap(mali_mem_allocation *alloc)
+{
+	struct mali_session_data *session;
+
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	mali_session_memory_lock(session);
+	mali_mem_mali_map_free(session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+			       alloc->flags);
+	mali_session_memory_unlock(session);
+}
+
+
+/* Insert these pages from shmem to mali page table*/
+_mali_osk_errcode_t mali_mem_swap_mali_map(mali_mem_swap *swap_mem, struct mali_session_data *session, u32 vaddr, u32 props)
+{
+	struct mali_page_directory *pagedir = session->page_directory;
+	struct mali_page_node *m_page;
+	dma_addr_t phys;
+	u32 virt = vaddr;
+	u32 prop = props;
+
+	list_for_each_entry(m_page, &swap_mem->pages, list) {
+		MALI_DEBUG_ASSERT(NULL != m_page->swap_it->page);
+		phys = m_page->swap_it->dma_addr;
+
+		mali_mmu_pagedir_update(pagedir, virt, phys, MALI_MMU_PAGE_SIZE, prop);
+		virt += MALI_MMU_PAGE_SIZE;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+int mali_mem_swap_in_pages(struct mali_pp_job *job)
+{
+	u32 num_memory_cookies;
+	struct mali_session_data *session;
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_allocation *mali_alloc = NULL;
+	mali_mem_backend *mem_bkend = NULL;
+	struct mali_page_node *m_page;
+	mali_bool swap_in_success = MALI_TRUE;
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	num_memory_cookies = mali_pp_job_num_memory_cookies(job);
+	session = mali_pp_job_get_session(job);
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	for (i = 0; i < num_memory_cookies; i++) {
+
+		u32 mali_addr  = mali_pp_job_get_memory_cookie(job, i);
+
+		mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_addr, 0);
+		if (NULL == mali_vma_node) {
+			job->memory_cookies[i] = MALI_SWAP_INVALIDATE_MALI_ADDRESS;
+			swap_in_success = MALI_FALSE;
+			MALI_PRINT_ERROR(("SWAP Mem: failed to find mali_vma_node through Mali address: 0x%08x.\n", mali_addr));
+			continue;
+		}
+
+		mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+		MALI_DEBUG_ASSERT(NULL != mali_alloc);
+
+		if (MALI_MEM_SWAP != mali_alloc->type &&
+		    MALI_MEM_COW != mali_alloc->type) {
+			continue;
+		}
+
+		/* Get backend memory & Map on GPU */
+		mutex_lock(&mali_idr_mutex);
+		mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle);
+		mutex_unlock(&mali_idr_mutex);
+		MALI_DEBUG_ASSERT(NULL != mem_bkend);
+
+		/* We neednot hold backend's lock here, race safe.*/
+		if ((MALI_MEM_COW == mem_bkend->type) &&
+		    (!(mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED))) {
+			continue;
+		}
+
+		mutex_lock(&mem_bkend->mutex);
+
+		/* When swap_in_success is MALI_FALSE, it means this job has memory backend that could not be swapped in,
+		 * and it will be aborted in mali scheduler, so here, we just mark those memory cookies which
+		 * should not be swapped out when delete job to invalide */
+		if (MALI_FALSE == swap_in_success) {
+			job->memory_cookies[i] = MALI_SWAP_INVALIDATE_MALI_ADDRESS;
+			mutex_unlock(&mem_bkend->mutex);
+			continue;
+		}
+
+		/* Before swap in, checking if this memory backend has been swapped in by the latest flushed jobs. */
+		++mem_bkend->using_count;
+
+		if (1 < mem_bkend->using_count) {
+			MALI_DEBUG_ASSERT(MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN != (MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN & mem_bkend->flags));
+			mutex_unlock(&mem_bkend->mutex);
+			continue;
+		}
+
+		if (MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN != (MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN & mem_bkend->flags)) {
+			mutex_unlock(&mem_bkend->mutex);
+			continue;
+		}
+
+
+		list_for_each_entry(m_page, &mem_bkend->swap_mem.pages, list) {
+			if (MALI_FALSE == mali_mem_swap_in_page_node(m_page)) {
+				/* Don't have enough memory to swap in page, so release pages have already been swapped
+				 * in and then mark this pp job to be fail. */
+				mali_mem_swap_unlock_partial_locked_mem_backend(mem_bkend, m_page);
+				swap_in_success = MALI_FALSE;
+				break;
+			}
+		}
+
+		if (swap_in_success) {
+#ifdef MALI_MEM_SWAP_TRACKING
+			mem_backend_swapped_unlock_size -= mem_bkend->size;
+#endif
+			_mali_osk_mutex_wait(session->memory_lock);
+			mali_mem_swap_mali_map(&mem_bkend->swap_mem, session, mali_alloc->mali_mapping.addr, mali_alloc->mali_mapping.properties);
+			_mali_osk_mutex_signal(session->memory_lock);
+
+			/* Remove the unlock flag from mem backend flags, mark this backend has been swapped in. */
+			mem_bkend->flags &= ~(MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN);
+			mutex_unlock(&mem_bkend->mutex);
+		} else {
+			--mem_bkend->using_count;
+			/* Marking that this backend is not swapped in, need not to be processed anymore. */
+			job->memory_cookies[i] = MALI_SWAP_INVALIDATE_MALI_ADDRESS;
+			mutex_unlock(&mem_bkend->mutex);
+		}
+	}
+
+	job->swap_status = swap_in_success ? MALI_SWAP_IN_SUCC : MALI_SWAP_IN_FAIL;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+int mali_mem_swap_out_pages(struct mali_pp_job *job)
+{
+	u32 num_memory_cookies;
+	struct mali_session_data *session;
+	struct mali_vma_node *mali_vma_node = NULL;
+	mali_mem_allocation *mali_alloc = NULL;
+	mali_mem_backend *mem_bkend = NULL;
+	int i;
+
+	MALI_DEBUG_ASSERT_POINTER(job);
+
+	num_memory_cookies = mali_pp_job_num_memory_cookies(job);
+	session = mali_pp_job_get_session(job);
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+
+	for (i = 0; i < num_memory_cookies; i++) {
+		u32 mali_addr  = mali_pp_job_get_memory_cookie(job, i);
+
+		if (MALI_SWAP_INVALIDATE_MALI_ADDRESS == mali_addr) {
+			continue;
+		}
+
+		mali_vma_node = mali_vma_offset_search(&session->allocation_mgr, mali_addr, 0);
+
+		if (NULL == mali_vma_node) {
+			MALI_PRINT_ERROR(("SWAP Mem: failed to find mali_vma_node through Mali address: 0x%08x.\n", mali_addr));
+			continue;
+		}
+
+		mali_alloc = container_of(mali_vma_node, struct mali_mem_allocation, mali_vma_node);
+		MALI_DEBUG_ASSERT(NULL != mali_alloc);
+
+		if (MALI_MEM_SWAP != mali_alloc->type &&
+		    MALI_MEM_COW != mali_alloc->type) {
+			continue;
+		}
+
+		mutex_lock(&mali_idr_mutex);
+		mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle);
+		mutex_unlock(&mali_idr_mutex);
+		MALI_DEBUG_ASSERT(NULL != mem_bkend);
+
+		/* We neednot hold backend's lock here, race safe.*/
+		if ((MALI_MEM_COW == mem_bkend->type) &&
+		    (!(mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED))) {
+			continue;
+		}
+
+		mutex_lock(&mem_bkend->mutex);
+
+		MALI_DEBUG_ASSERT(0 < mem_bkend->using_count);
+
+		/* Reducing the using_count of mem backend means less pp job are using this memory backend,
+		 * if this count get to zero, it means no pp job is using it now, could put it to swap out list. */
+		--mem_bkend->using_count;
+
+		if (0 < mem_bkend->using_count) {
+			mutex_unlock(&mem_bkend->mutex);
+			continue;
+		}
+		mutex_unlock(&mem_bkend->mutex);
+
+		mali_memory_swap_list_backend_add(mem_bkend);
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+int mali_mem_swap_allocate_page_on_demand(mali_mem_backend *mem_bkend, u32 offset, struct page **pagep)
+{
+	struct mali_page_node *m_page, *found_node = NULL;
+	struct page *found_page;
+	mali_mem_swap *swap = NULL;
+	mali_mem_cow *cow = NULL;
+	dma_addr_t dma_addr;
+	u32 i = 0;
+
+	if (MALI_MEM_SWAP == mem_bkend->type) {
+		swap = &mem_bkend->swap_mem;
+		list_for_each_entry(m_page, &swap->pages, list) {
+			if (i == offset) {
+				found_node = m_page;
+				break;
+			}
+			i++;
+		}
+	} else {
+		MALI_DEBUG_ASSERT(MALI_MEM_COW == mem_bkend->type);
+		MALI_DEBUG_ASSERT(MALI_MEM_BACKEND_FLAG_SWAP_COWED == (MALI_MEM_BACKEND_FLAG_SWAP_COWED & mem_bkend->flags));
+
+		cow = &mem_bkend->cow_mem;
+		list_for_each_entry(m_page, &cow->pages, list) {
+			if (i == offset) {
+				found_node = m_page;
+				break;
+			}
+			i++;
+		}
+	}
+
+	if (NULL == found_node) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	found_page = shmem_read_mapping_page(global_swap_space, found_node->swap_it->idx);
+
+	if (!IS_ERR(found_page)) {
+		lock_page(found_page);
+		dma_addr = dma_map_page(&mali_platform_device->dev, found_page,
+					0, _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+		dma_unmap_page(&mali_platform_device->dev, dma_addr,
+			       _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+
+		*pagep = found_page;
+	} else {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+int mali_mem_swap_cow_page_on_demand(mali_mem_backend *mem_bkend, u32 offset, struct page **pagep)
+{
+	struct mali_page_node *m_page, *found_node = NULL, *new_node = NULL;
+	mali_mem_cow *cow = NULL;
+	u32 i = 0;
+
+	MALI_DEBUG_ASSERT(MALI_MEM_COW == mem_bkend->type);
+	MALI_DEBUG_ASSERT(MALI_MEM_BACKEND_FLAG_SWAP_COWED == (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED));
+	MALI_DEBUG_ASSERT(MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN == (MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN & mem_bkend->flags));
+	MALI_DEBUG_ASSERT(!mali_memory_swap_backend_in_swapped_pool(mem_bkend));
+
+	cow = &mem_bkend->cow_mem;
+	list_for_each_entry(m_page, &cow->pages, list) {
+		if (i == offset) {
+			found_node = m_page;
+			break;
+		}
+		i++;
+	}
+
+	if (NULL == found_node) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	new_node = _mali_mem_swap_page_node_allocate();
+
+	if (NULL == new_node) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	new_node->swap_it->idx = mali_mem_swap_idx_alloc();
+
+	if (_MALI_OSK_BITMAP_INVALIDATE_INDEX == new_node->swap_it->idx) {
+		MALI_DEBUG_PRINT(1, ("Failed to allocate swap index in swap CoW on demand.\n"));
+		kfree(new_node->swap_it);
+		kfree(new_node);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	if (MALI_FALSE == mali_mem_swap_in_page_node(new_node)) {
+		_mali_mem_swap_page_node_free(new_node);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	/* swap in found node for copy in kernel. */
+	if (MALI_FALSE == mali_mem_swap_in_page_node(found_node)) {
+		mali_mem_swap_out_page_node(new_node);
+		_mali_mem_swap_page_node_free(new_node);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	_mali_mem_cow_copy_page(found_node, new_node);
+
+	list_replace(&found_node->list, &new_node->list);
+
+	if (1 != _mali_page_node_get_ref_count(found_node)) {
+		atomic_add(1, &mem_bkend->mali_allocation->session->mali_mem_allocated_pages);
+		if (atomic_read(&mem_bkend->mali_allocation->session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE > mem_bkend->mali_allocation->session->max_mali_mem_allocated_size) {
+			mem_bkend->mali_allocation->session->max_mali_mem_allocated_size = atomic_read(&mem_bkend->mali_allocation->session->mali_mem_allocated_pages) * MALI_MMU_PAGE_SIZE;
+		}
+		mem_bkend->cow_mem.change_pages_nr++;
+	}
+
+	mali_mem_swap_out_page_node(found_node);
+	_mali_mem_swap_page_node_free(found_node);
+
+	/* When swap in the new page node, we have called dma_map_page for this page.\n */
+	dma_unmap_page(&mali_platform_device->dev, new_node->swap_it->dma_addr,
+		       _MALI_OSK_MALI_PAGE_SIZE, DMA_TO_DEVICE);
+
+	lock_page(new_node->swap_it->page);
+
+	*pagep = new_node->swap_it->page;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+#ifdef MALI_MEM_SWAP_TRACKING
+void mali_mem_swap_tracking(u32 *swap_pool_size, u32 *unlock_size)
+{
+	*swap_pool_size = mem_backend_swapped_pool_size;
+	*unlock_size =  mem_backend_swapped_unlock_size;
+}
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.h b/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_swap_alloc.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_SWAP_ALLOC_H__
+#define __MALI_MEMORY_SWAP_ALLOC_H__
+
+#include "mali_osk.h"
+#include "mali_session.h"
+
+#include "mali_memory_types.h"
+#include "mali_pp_job.h"
+
+/**
+ * Initialize memory swapping module.
+ */
+_mali_osk_errcode_t mali_mem_swap_init(void);
+
+void mali_mem_swap_term(void);
+
+/**
+ * Return global share memory file to other modules.
+ */
+struct file *mali_mem_swap_get_global_swap_file(void);
+
+/**
+ * Unlock the given memory backend and pages in it could be swapped out by kernel.
+ */
+void mali_mem_swap_unlock_single_mem_backend(mali_mem_backend *mem_bkend);
+
+/**
+ * Remove the given memory backend from global swap list.
+ */
+void mali_memory_swap_list_backend_delete(mali_mem_backend *mem_bkend);
+
+/**
+ * Add the given memory backend to global swap list.
+ */
+void mali_memory_swap_list_backend_add(mali_mem_backend *mem_bkend);
+
+/**
+ * Allocate 1 index from bitmap used as page index in global swap file.
+ */
+u32 mali_mem_swap_idx_alloc(void);
+
+void mali_mem_swap_idx_free(u32 idx);
+
+/**
+ * Allocate a new swap item without page index.
+ */
+struct mali_swap_item *mali_mem_swap_alloc_swap_item(void);
+
+/**
+ * Free a swap item, truncate the corresponding space in page cache and free index of page.
+ */
+void mali_mem_swap_free_swap_item(mali_swap_item *swap_item);
+
+/**
+ * Allocate a page node with swap item.
+ */
+struct mali_page_node *_mali_mem_swap_page_node_allocate(void);
+
+/**
+ * Reduce the reference count of given page node and if return 0, just free this page node.
+ */
+_mali_osk_errcode_t _mali_mem_swap_put_page_node(struct mali_page_node *m_page);
+
+void _mali_mem_swap_page_node_free(struct mali_page_node *m_page);
+
+/**
+ * Free a swappable memory backend.
+ */
+u32 mali_mem_swap_free(mali_mem_swap *swap_mem);
+
+/**
+ * Ummap and free.
+ */
+u32 mali_mem_swap_release(mali_mem_backend *mem_bkend, mali_bool is_mali_mapped);
+
+/**
+ * Read in a page from global swap file with the pre-allcated page index.
+ */
+mali_bool mali_mem_swap_in_page_node(struct mali_page_node *page_node);
+
+int mali_mem_swap_alloc_pages(mali_mem_swap *swap_mem, u32 size, u32 *bkend_idx);
+
+_mali_osk_errcode_t mali_mem_swap_mali_map(mali_mem_swap *swap_mem, struct mali_session_data *session, u32 vaddr, u32 props);
+
+void mali_mem_swap_mali_unmap(mali_mem_allocation *alloc);
+
+/**
+ * When pp job created, we need swap in all of memory backend needed by this pp job.
+ */
+int mali_mem_swap_in_pages(struct mali_pp_job *job);
+
+/**
+ * Put all of memory backends used this pp job to the global swap list.
+ */
+int mali_mem_swap_out_pages(struct mali_pp_job *job);
+
+/**
+ * This will be called in page fault to process CPU read&write.
+ */
+int mali_mem_swap_allocate_page_on_demand(mali_mem_backend *mem_bkend, u32 offset, struct page **pagep) ;
+
+/**
+ * Used to process cow on demand for swappable memory backend.
+ */
+int mali_mem_swap_cow_page_on_demand(mali_mem_backend *mem_bkend, u32 offset, struct page **pagep);
+
+#ifdef MALI_MEM_SWAP_TRACKING
+void mali_mem_swap_tracking(u32 *swap_pool_size, u32 *unlock_size);
+#endif
+#endif /* __MALI_MEMORY_SWAP_ALLOC_H__ */
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_types.h b/drivers/gpu/arm/mali400/linux/mali_memory_types.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_types.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_types.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_TYPES_H__
+#define __MALI_MEMORY_TYPES_H__
+
+#include <linux/mm.h>
+
+#if defined(CONFIG_MALI400_UMP)
+#include "ump_kernel_interface.h"
+#endif
+
+typedef u32 mali_address_t;
+
+typedef enum mali_mem_type {
+	MALI_MEM_OS,
+	MALI_MEM_EXTERNAL,
+	MALI_MEM_SWAP,
+	MALI_MEM_DMA_BUF,
+	MALI_MEM_UMP,
+	MALI_MEM_BLOCK,
+	MALI_MEM_COW,
+	MALI_MEM_SECURE,
+	MALI_MEM_TYPE_MAX,
+} mali_mem_type;
+
+typedef struct mali_block_item {
+	/* for block type, the block_phy is alway page size align
+	* so use low 12bit used for ref_cout.
+	*/
+	unsigned long phy_addr;
+} mali_block_item;
+
+/**
+ * idx is used to locate the given page in the address space of swap file.
+ * ref_count is used to mark how many memory backends are using this item.
+ */
+typedef struct mali_swap_item {
+	u32 idx;
+	atomic_t ref_count;
+	struct page *page;
+	dma_addr_t dma_addr;
+} mali_swap_item;
+
+typedef enum mali_page_node_type {
+	MALI_PAGE_NODE_OS,
+	MALI_PAGE_NODE_BLOCK,
+	MALI_PAGE_NODE_SWAP,
+} mali_page_node_type;
+
+typedef struct mali_page_node {
+	struct list_head list;
+	union {
+		struct page *page;
+		mali_block_item *blk_it; /*pointer to block item*/
+		mali_swap_item *swap_it;
+	};
+
+	u32 type;
+} mali_page_node;
+
+typedef struct mali_mem_os_mem {
+	struct list_head pages;
+	u32 count;
+} mali_mem_os_mem;
+
+typedef struct mali_mem_dma_buf {
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+	struct mali_dma_buf_attachment *attachment;
+#endif
+} mali_mem_dma_buf;
+
+typedef struct mali_mem_external {
+	dma_addr_t phys;
+	u32 size;
+} mali_mem_external;
+
+typedef struct mali_mem_ump {
+#if defined(CONFIG_MALI400_UMP)
+	ump_dd_handle handle;
+#endif
+} mali_mem_ump;
+
+typedef struct block_allocator_allocation {
+	/* The list will be released in reverse order */
+	struct block_info *last_allocated;
+	u32 mapping_length;
+	struct block_allocator *info;
+} block_allocator_allocation;
+
+typedef struct mali_mem_block_mem {
+	struct list_head pfns;
+	u32 count;
+} mali_mem_block_mem;
+
+typedef struct mali_mem_virt_mali_mapping {
+	mali_address_t addr; /* Virtual Mali address */
+	u32 properties;      /* MMU Permissions + cache, must match MMU HW */
+} mali_mem_virt_mali_mapping;
+
+typedef struct mali_mem_virt_cpu_mapping {
+	void __user *addr;
+	struct vm_area_struct *vma;
+} mali_mem_virt_cpu_mapping;
+
+#define MALI_MEM_ALLOCATION_VALID_MAGIC 0xdeda110c
+#define MALI_MEM_ALLOCATION_FREED_MAGIC 0x10101010
+
+typedef struct mali_mm_node {
+	/* MALI GPU vaddr start, use u32 for mmu only support 32bit address*/
+	uint32_t start; /* GPU vaddr */
+	uint32_t size;  /* GPU allocation virtual size */
+	unsigned allocated : 1;
+} mali_mm_node;
+
+typedef struct mali_vma_node {
+	struct mali_mm_node vm_node;
+	struct rb_node vm_rb;
+} mali_vma_node;
+
+
+typedef struct mali_mem_allocation {
+	MALI_DEBUG_CODE(u32 magic);
+	mali_mem_type type;                /**< Type of memory */
+	u32 flags;                         /**< Flags for this allocation */
+
+	struct mali_session_data *session; /**< Pointer to session that owns the allocation */
+
+	mali_mem_virt_cpu_mapping cpu_mapping; /**< CPU mapping */
+	mali_mem_virt_mali_mapping mali_mapping; /**< Mali mapping */
+
+	/* add for new memory system */
+	struct mali_vma_node mali_vma_node;
+	u32 vsize; /* virtual size*/
+	u32 psize; /* physical backend memory size*/
+	struct list_head list;
+	s32 backend_handle; /* idr for mem_backend */
+	_mali_osk_atomic_t mem_alloc_refcount;
+} mali_mem_allocation;
+
+struct mali_mem_os_allocator {
+	spinlock_t pool_lock;
+	struct list_head pool_pages;
+	size_t pool_count;
+
+	atomic_t allocated_pages;
+	size_t allocation_limit;
+
+	struct shrinker shrinker;
+	struct delayed_work timed_shrinker;
+	struct workqueue_struct *wq;
+};
+
+/* COW backend memory type */
+typedef struct mali_mem_cow {
+	struct list_head pages;  /**< all pages for this cow backend allocation,
+                                                                including new allocated pages for modified range*/
+	u32 count;               /**< number of pages */
+	s32 change_pages_nr;
+} mali_mem_cow;
+
+typedef struct mali_mem_swap {
+	struct list_head pages;
+	u32 count;
+} mali_mem_swap;
+
+typedef struct mali_mem_secure {
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+	struct dma_buf *buf;
+	struct dma_buf_attachment *attachment;
+	struct sg_table *sgt;
+#endif
+	u32 count;
+} mali_mem_secure;
+
+#define MALI_MEM_BACKEND_FLAG_COWED                   (0x1)  /* COW has happen on this backend */
+#define MALI_MEM_BACKEND_FLAG_COW_CPU_NO_WRITE        (0x2)  /* This is an COW backend, mapped as not allowed cpu to write */
+#define MALI_MEM_BACKEND_FLAG_SWAP_COWED              (0x4)  /* Mark the given backend is cowed from swappable memory. */
+/* Mark this backend is not swapped_in in MALI driver, and before using it,
+ * we should swap it in and set up corresponding page table. */
+#define MALI_MEM_BACKEND_FLAG_UNSWAPPED_IN            (0x8)
+#define MALI_MEM_BACKEND_FLAG_NOT_BINDED              (0x1 << 5) /* this backend it not back with physical memory, used for defer bind */
+#define MALI_MEM_BACKEND_FLAG_BINDED              (0x1 << 6) /* this backend it back with physical memory, used for defer bind */
+
+typedef struct mali_mem_backend {
+	mali_mem_type type;                /**< Type of backend memory */
+	u32 flags;                         /**< Flags for this allocation */
+	u32 size;
+	/* Union selected by type. */
+	union {
+		mali_mem_os_mem os_mem;       /**< MALI_MEM_OS */
+		mali_mem_external ext_mem;    /**< MALI_MEM_EXTERNAL */
+		mali_mem_dma_buf dma_buf;     /**< MALI_MEM_DMA_BUF */
+		mali_mem_ump ump_mem;         /**< MALI_MEM_UMP */
+		mali_mem_block_mem block_mem; /**< MALI_MEM_BLOCK */
+		mali_mem_cow cow_mem;
+		mali_mem_swap swap_mem;
+		mali_mem_secure secure_mem;
+	};
+	mali_mem_allocation *mali_allocation;
+	struct mutex mutex;
+	mali_mem_type cow_type;
+
+	struct list_head list;           /**< Used to link swappable memory backend to the global swappable list */
+	int using_count;                 /**< Mark how many PP jobs are using this memory backend */
+	u32 start_idx;                   /**< If the correspondign vma of this backend is linear, this value will be used to set vma->vm_pgoff */
+} mali_mem_backend;
+
+#define MALI_MEM_FLAG_MALI_GUARD_PAGE (_MALI_MAP_EXTERNAL_MAP_GUARD_PAGE)
+#define MALI_MEM_FLAG_DONT_CPU_MAP    (1 << 1)
+#define MALI_MEM_FLAG_CAN_RESIZE  (_MALI_MEMORY_ALLOCATE_RESIZEABLE)
+#endif /* __MALI_MEMORY_TYPES__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_ump.c b/drivers/gpu/arm/mali400/linux/mali_memory_ump.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_ump.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_ump.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_kernel_linux.h"
+#include "mali_memory.h"
+#include "ump_kernel_interface.h"
+
+static int mali_mem_ump_map(mali_mem_backend *mem_backend)
+{
+	ump_dd_handle ump_mem;
+	mali_mem_allocation *alloc;
+	struct mali_session_data *session;
+	u32 nr_blocks;
+	u32 i;
+	ump_dd_physical_block *ump_blocks;
+	struct mali_page_directory *pagedir;
+	u32 offset = 0;
+	_mali_osk_errcode_t err;
+
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_ASSERT(MALI_MEM_UMP == mem_backend->type);
+
+	alloc = mem_backend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	ump_mem = mem_backend->ump_mem.handle;
+	MALI_DEBUG_ASSERT(UMP_DD_HANDLE_INVALID != ump_mem);
+
+	nr_blocks = ump_dd_phys_block_count_get(ump_mem);
+	if (nr_blocks == 0) {
+		MALI_DEBUG_PRINT(1, ("No block count\n"));
+		return -EINVAL;
+	}
+
+	ump_blocks = _mali_osk_malloc(sizeof(*ump_blocks) * nr_blocks);
+	if (NULL == ump_blocks) {
+		return -ENOMEM;
+	}
+
+	if (UMP_DD_INVALID == ump_dd_phys_blocks_get(ump_mem, ump_blocks, nr_blocks)) {
+		_mali_osk_free(ump_blocks);
+		return -EFAULT;
+	}
+
+	pagedir = session->page_directory;
+
+	mali_session_memory_lock(session);
+
+	err = mali_mem_mali_map_prepare(alloc);
+	if (_MALI_OSK_ERR_OK != err) {
+		MALI_DEBUG_PRINT(1, ("Mapping of UMP memory failed\n"));
+
+		_mali_osk_free(ump_blocks);
+		mali_session_memory_unlock(session);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < nr_blocks; ++i) {
+		u32 virt = alloc->mali_vma_node.vm_node.start + offset;
+
+		MALI_DEBUG_PRINT(7, ("Mapping in 0x%08x size %d\n", ump_blocks[i].addr , ump_blocks[i].size));
+
+		mali_mmu_pagedir_update(pagedir, virt, ump_blocks[i].addr,
+					ump_blocks[i].size, MALI_MMU_FLAGS_DEFAULT);
+
+		offset += ump_blocks[i].size;
+	}
+
+	if (alloc->flags & _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE) {
+		u32 virt = alloc->mali_vma_node.vm_node.start + offset;
+
+		/* Map in an extra virtual guard page at the end of the VMA */
+		MALI_DEBUG_PRINT(6, ("Mapping in extra guard page\n"));
+
+		mali_mmu_pagedir_update(pagedir, virt, ump_blocks[0].addr, _MALI_OSK_MALI_PAGE_SIZE, MALI_MMU_FLAGS_DEFAULT);
+
+		offset += _MALI_OSK_MALI_PAGE_SIZE;
+	}
+	mali_session_memory_unlock(session);
+	_mali_osk_free(ump_blocks);
+	return 0;
+}
+
+static void mali_mem_ump_unmap(mali_mem_allocation *alloc)
+{
+	struct mali_session_data *session;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	session = alloc->session;
+	MALI_DEBUG_ASSERT_POINTER(session);
+	mali_session_memory_lock(session);
+	mali_mem_mali_map_free(session, alloc->psize, alloc->mali_vma_node.vm_node.start,
+			       alloc->flags);
+	mali_session_memory_unlock(session);
+}
+
+int mali_mem_bind_ump_buf(mali_mem_allocation *alloc, mali_mem_backend *mem_backend, u32  secure_id, u32 flags)
+{
+	ump_dd_handle ump_mem;
+	int ret;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_ASSERT(MALI_MEM_UMP == mem_backend->type);
+
+	MALI_DEBUG_PRINT(3,
+			 ("Requested to map ump memory with secure id %d into virtual memory 0x%08X, size 0x%08X\n",
+			  secure_id, alloc->mali_vma_node.vm_node.start, alloc->mali_vma_node.vm_node.size));
+
+	ump_mem = ump_dd_handle_create_from_secure_id(secure_id);
+	if (UMP_DD_HANDLE_INVALID == ump_mem) MALI_ERROR(_MALI_OSK_ERR_FAULT);
+	alloc->flags |= MALI_MEM_FLAG_DONT_CPU_MAP;
+	if (flags & _MALI_MAP_EXTERNAL_MAP_GUARD_PAGE) {
+		alloc->flags |= MALI_MEM_FLAG_MALI_GUARD_PAGE;
+	}
+
+	mem_backend->ump_mem.handle = ump_mem;
+
+	ret = mali_mem_ump_map(mem_backend);
+	if (0 != ret) {
+		ump_dd_reference_release(ump_mem);
+		return _MALI_OSK_ERR_FAULT;
+	}
+	MALI_DEBUG_PRINT(3, ("Returning from UMP bind\n"));
+	return _MALI_OSK_ERR_OK;
+}
+
+void mali_mem_unbind_ump_buf(mali_mem_backend *mem_backend)
+{
+	ump_dd_handle ump_mem;
+	mali_mem_allocation *alloc;
+	MALI_DEBUG_ASSERT_POINTER(mem_backend);
+	MALI_DEBUG_ASSERT(MALI_MEM_UMP == mem_backend->type);
+	ump_mem = mem_backend->ump_mem.handle;
+	MALI_DEBUG_ASSERT(UMP_DD_HANDLE_INVALID != ump_mem);
+
+	alloc = mem_backend->mali_allocation;
+	MALI_DEBUG_ASSERT_POINTER(alloc);
+	mali_mem_ump_unmap(alloc);
+	ump_dd_reference_release(ump_mem);
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_ump.h b/drivers/gpu/arm/mali400/linux/mali_memory_ump.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_ump.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_ump.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2011-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_UMP_BUF_H__
+#define __MALI_MEMORY_UMP_BUF_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "mali_uk_types.h"
+#include "mali_osk.h"
+#include "mali_memory.h"
+
+int mali_mem_bind_ump_buf(mali_mem_allocation *alloc, mali_mem_backend *mem_backend, u32  secure_id, u32 flags);
+void mali_mem_unbind_ump_buf(mali_mem_backend *mem_backend);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_MEMORY_DMA_BUF_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_util.c b/drivers/gpu/arm/mali400/linux/mali_memory_util.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_util.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_util.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_kernel_linux.h"
+#include "mali_scheduler.h"
+
+#include "mali_memory.h"
+#include "mali_memory_os_alloc.h"
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+#include "mali_memory_dma_buf.h"
+#include "mali_memory_secure.h"
+#endif
+#if defined(CONFIG_MALI400_UMP)
+#include "mali_memory_ump.h"
+#endif
+#include "mali_memory_external.h"
+#include "mali_memory_manager.h"
+#include "mali_memory_virtual.h"
+#include "mali_memory_cow.h"
+#include "mali_memory_block_alloc.h"
+#include "mali_memory_swap_alloc.h"
+
+
+
+/**
+*function @_mali_free_allocation_mem - free a memory allocation
+*/
+static u32 _mali_free_allocation_mem(mali_mem_allocation *mali_alloc)
+{
+	mali_mem_backend *mem_bkend = NULL;
+	u32 free_pages_nr = 0;
+
+	struct mali_session_data *session = mali_alloc->session;
+	MALI_DEBUG_PRINT(4, (" _mali_free_allocation_mem, psize =0x%x! \n", mali_alloc->psize));
+	if (0 == mali_alloc->psize)
+		goto out;
+
+	/* Get backend memory & Map on CPU */
+	mutex_lock(&mali_idr_mutex);
+	mem_bkend = idr_find(&mali_backend_idr, mali_alloc->backend_handle);
+	mutex_unlock(&mali_idr_mutex);
+	MALI_DEBUG_ASSERT(NULL != mem_bkend);
+
+	switch (mem_bkend->type) {
+	case MALI_MEM_OS:
+		free_pages_nr = mali_mem_os_release(mem_bkend);
+		atomic_sub(free_pages_nr, &session->mali_mem_allocated_pages);
+		break;
+	case MALI_MEM_UMP:
+#if defined(CONFIG_MALI400_UMP)
+		mali_mem_unbind_ump_buf(mem_bkend);
+		atomic_sub(mem_bkend->size / MALI_MMU_PAGE_SIZE, &session->mali_mem_array[mem_bkend->type]);
+#else
+		MALI_DEBUG_PRINT(1, ("UMP not supported\n"));
+#endif
+		break;
+	case MALI_MEM_DMA_BUF:
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+		mali_mem_unbind_dma_buf(mem_bkend);
+		atomic_sub(mem_bkend->size / MALI_MMU_PAGE_SIZE, &session->mali_mem_array[mem_bkend->type]);
+#else
+		MALI_DEBUG_PRINT(1, ("DMA not supported\n"));
+#endif
+		break;
+	case MALI_MEM_EXTERNAL:
+		mali_mem_unbind_ext_buf(mem_bkend);
+		atomic_sub(mem_bkend->size / MALI_MMU_PAGE_SIZE, &session->mali_mem_array[mem_bkend->type]);
+		break;
+
+	case MALI_MEM_BLOCK:
+		free_pages_nr = mali_mem_block_release(mem_bkend);
+		atomic_sub(free_pages_nr, &session->mali_mem_allocated_pages);
+		break;
+
+	case MALI_MEM_COW:
+		if (mem_bkend->flags & MALI_MEM_BACKEND_FLAG_SWAP_COWED) {
+			free_pages_nr = mali_mem_swap_release(mem_bkend, MALI_TRUE);
+		} else {
+			free_pages_nr = mali_mem_cow_release(mem_bkend, MALI_TRUE);
+		}
+		atomic_sub(free_pages_nr, &session->mali_mem_allocated_pages);
+		break;
+	case MALI_MEM_SWAP:
+		free_pages_nr = mali_mem_swap_release(mem_bkend, MALI_TRUE);
+		atomic_sub(free_pages_nr, &session->mali_mem_allocated_pages);
+		atomic_sub(free_pages_nr, &session->mali_mem_array[mem_bkend->type]);
+		break;
+	case MALI_MEM_SECURE:
+#if defined(CONFIG_DMA_SHARED_BUFFER)
+		free_pages_nr = mali_mem_secure_release(mem_bkend);
+		atomic_sub(free_pages_nr, &session->mali_mem_allocated_pages);
+#else
+		MALI_DEBUG_PRINT(1, ("DMA not supported for mali secure memory\n"));
+#endif
+		break;
+	default:
+		MALI_DEBUG_PRINT(1, ("mem type %d is not in the mali_mem_type enum.\n", mem_bkend->type));
+		break;
+	}
+
+	/*Remove backend memory idex */
+	mutex_lock(&mali_idr_mutex);
+	idr_remove(&mali_backend_idr, mali_alloc->backend_handle);
+	mutex_unlock(&mali_idr_mutex);
+	kfree(mem_bkend);
+out:
+	/* remove memory allocation  */
+	mali_vma_offset_remove(&session->allocation_mgr, &mali_alloc->mali_vma_node);
+	mali_mem_allocation_struct_destory(mali_alloc);
+	return free_pages_nr;
+}
+
+/**
+*  ref_count for allocation
+*/
+u32 mali_allocation_unref(struct mali_mem_allocation **alloc)
+{
+	u32 free_pages_nr = 0;
+	mali_mem_allocation *mali_alloc = *alloc;
+	*alloc = NULL;
+	if (0 == _mali_osk_atomic_dec_return(&mali_alloc->mem_alloc_refcount)) {
+		free_pages_nr = _mali_free_allocation_mem(mali_alloc);
+	}
+	return free_pages_nr;
+}
+
+void mali_allocation_ref(struct mali_mem_allocation *alloc)
+{
+	_mali_osk_atomic_inc(&alloc->mem_alloc_refcount);
+}
+
+void mali_free_session_allocations(struct mali_session_data *session)
+{
+	struct mali_mem_allocation *entry, *next;
+
+	MALI_DEBUG_PRINT(4, (" mali_free_session_allocations! \n"));
+
+	list_for_each_entry_safe(entry, next, &session->allocation_mgr.head, list) {
+		mali_allocation_unref(&entry);
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_util.h b/drivers/gpu/arm/mali400/linux/mali_memory_util.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_util.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_util.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_MEMORY_UTIL_H__
+#define __MALI_MEMORY_UTIL_H__
+
+u32 mali_allocation_unref(struct mali_mem_allocation **alloc);
+
+void mali_allocation_ref(struct mali_mem_allocation *alloc);
+
+void mali_free_session_allocations(struct mali_session_data *session);
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_virtual.c b/drivers/gpu/arm/mali400/linux/mali_memory_virtual.c
--- a/drivers/gpu/arm/mali400/linux/mali_memory_virtual.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_virtual.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+#include <linux/fs.h>
+#include <linux/dma-mapping.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_kernel_linux.h"
+#include "mali_scheduler.h"
+#include "mali_memory_os_alloc.h"
+#include "mali_memory_manager.h"
+#include "mali_memory_virtual.h"
+
+
+/**
+*internal helper to link node into the rb-tree
+*/
+static inline void _mali_vma_offset_add_rb(struct mali_allocation_manager *mgr,
+		struct mali_vma_node *node)
+{
+	struct rb_node **iter = &mgr->allocation_mgr_rb.rb_node;
+	struct rb_node *parent = NULL;
+	struct mali_vma_node *iter_node;
+
+	while (likely(*iter)) {
+		parent = *iter;
+		iter_node = rb_entry(*iter, struct mali_vma_node, vm_rb);
+
+		if (node->vm_node.start < iter_node->vm_node.start)
+			iter = &(*iter)->rb_left;
+		else if (node->vm_node.start > iter_node->vm_node.start)
+			iter = &(*iter)->rb_right;
+		else
+			MALI_DEBUG_ASSERT(0);
+	}
+
+	rb_link_node(&node->vm_rb, parent, iter);
+	rb_insert_color(&node->vm_rb, &mgr->allocation_mgr_rb);
+}
+
+/**
+ * mali_vma_offset_add() - Add offset node to RB Tree
+ */
+int mali_vma_offset_add(struct mali_allocation_manager *mgr,
+			struct mali_vma_node *node)
+{
+	int ret = 0;
+	write_lock(&mgr->vm_lock);
+
+	if (node->vm_node.allocated) {
+		goto out;
+	}
+
+	_mali_vma_offset_add_rb(mgr, node);
+	/* set to allocated */
+	node->vm_node.allocated = 1;
+
+out:
+	write_unlock(&mgr->vm_lock);
+	return ret;
+}
+
+/**
+ * mali_vma_offset_remove() - Remove offset node from RB tree
+ */
+void mali_vma_offset_remove(struct mali_allocation_manager *mgr,
+			    struct mali_vma_node *node)
+{
+	write_lock(&mgr->vm_lock);
+
+	if (node->vm_node.allocated) {
+		rb_erase(&node->vm_rb, &mgr->allocation_mgr_rb);
+		memset(&node->vm_node, 0, sizeof(node->vm_node));
+	}
+	write_unlock(&mgr->vm_lock);
+}
+
+/**
+* mali_vma_offset_search - Search the node in RB tree
+*/
+struct mali_vma_node *mali_vma_offset_search(struct mali_allocation_manager *mgr,
+		unsigned long start, unsigned long pages)
+{
+	struct mali_vma_node *node, *best;
+	struct rb_node *iter;
+	unsigned long offset;
+	read_lock(&mgr->vm_lock);
+
+	iter = mgr->allocation_mgr_rb.rb_node;
+	best = NULL;
+
+	while (likely(iter)) {
+		node = rb_entry(iter, struct mali_vma_node, vm_rb);
+		offset = node->vm_node.start;
+		if (start >= offset) {
+			iter = iter->rb_right;
+			best = node;
+			if (start == offset)
+				break;
+		} else {
+			iter = iter->rb_left;
+		}
+	}
+
+	if (best) {
+		offset = best->vm_node.start + best->vm_node.size;
+		if (offset <= start + pages)
+			best = NULL;
+	}
+	read_unlock(&mgr->vm_lock);
+
+	return best;
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_memory_virtual.h b/drivers/gpu/arm/mali400/linux/mali_memory_virtual.h
--- a/drivers/gpu/arm/mali400/linux/mali_memory_virtual.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_memory_virtual.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#ifndef __MALI_GPU_VMEM_H__
+#define __MALI_GPU_VMEM_H__
+
+#include "mali_osk.h"
+#include "mali_session.h"
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/rbtree.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+#include "mali_memory_types.h"
+#include "mali_memory_os_alloc.h"
+#include "mali_memory_manager.h"
+
+
+
+int mali_vma_offset_add(struct mali_allocation_manager *mgr,
+			struct mali_vma_node *node);
+
+void mali_vma_offset_remove(struct mali_allocation_manager *mgr,
+			    struct mali_vma_node *node);
+
+struct mali_vma_node *mali_vma_offset_search(struct mali_allocation_manager *mgr,
+		unsigned long start,    unsigned long pages);
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_atomics.c b/drivers/gpu/arm/mali400/linux/mali_osk_atomics.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_atomics.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_atomics.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_atomics.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include "mali_osk.h"
+#include <asm/atomic.h>
+#include "mali_kernel_common.h"
+
+void _mali_osk_atomic_dec(_mali_osk_atomic_t *atom)
+{
+	atomic_dec((atomic_t *)&atom->u.val);
+}
+
+u32 _mali_osk_atomic_dec_return(_mali_osk_atomic_t *atom)
+{
+	return atomic_dec_return((atomic_t *)&atom->u.val);
+}
+
+void _mali_osk_atomic_inc(_mali_osk_atomic_t *atom)
+{
+	atomic_inc((atomic_t *)&atom->u.val);
+}
+
+u32 _mali_osk_atomic_inc_return(_mali_osk_atomic_t *atom)
+{
+	return atomic_inc_return((atomic_t *)&atom->u.val);
+}
+
+void _mali_osk_atomic_init(_mali_osk_atomic_t *atom, u32 val)
+{
+	MALI_DEBUG_ASSERT_POINTER(atom);
+	atomic_set((atomic_t *)&atom->u.val, val);
+}
+
+u32 _mali_osk_atomic_read(_mali_osk_atomic_t *atom)
+{
+	return atomic_read((atomic_t *)&atom->u.val);
+}
+
+void _mali_osk_atomic_term(_mali_osk_atomic_t *atom)
+{
+	MALI_IGNORE(atom);
+}
+
+u32 _mali_osk_atomic_xchg(_mali_osk_atomic_t *atom, u32 val)
+{
+	return atomic_xchg((atomic_t *)&atom->u.val, val);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_bitmap.c b/drivers/gpu/arm/mali400/linux/mali_osk_bitmap.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_bitmap.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_bitmap.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2010, 2013-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_bitmap.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/bitmap.h>
+#include <linux/vmalloc.h>
+#include "common/mali_kernel_common.h"
+#include "mali_osk_types.h"
+#include "mali_osk.h"
+
+u32 _mali_osk_bitmap_alloc(struct _mali_osk_bitmap *bitmap)
+{
+	u32 obj;
+
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+
+	_mali_osk_spinlock_lock(bitmap->lock);
+
+	obj = find_next_zero_bit(bitmap->table, bitmap->max, bitmap->reserve);
+
+	if (obj < bitmap->max) {
+		set_bit(obj, bitmap->table);
+	} else {
+		obj = -1;
+	}
+
+	if (obj != -1)
+		--bitmap->avail;
+	_mali_osk_spinlock_unlock(bitmap->lock);
+
+	return obj;
+}
+
+void _mali_osk_bitmap_free(struct _mali_osk_bitmap *bitmap, u32 obj)
+{
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+
+	_mali_osk_bitmap_free_range(bitmap, obj, 1);
+}
+
+u32 _mali_osk_bitmap_alloc_range(struct _mali_osk_bitmap *bitmap, int cnt)
+{
+	u32 obj;
+
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+
+	if (0 >= cnt) {
+		return -1;
+	}
+
+	if (1 == cnt) {
+		return _mali_osk_bitmap_alloc(bitmap);
+	}
+
+	_mali_osk_spinlock_lock(bitmap->lock);
+	obj = bitmap_find_next_zero_area(bitmap->table, bitmap->max,
+					 bitmap->last, cnt, 0);
+
+	if (obj >= bitmap->max) {
+		obj = bitmap_find_next_zero_area(bitmap->table, bitmap->max,
+						 bitmap->reserve, cnt, 0);
+	}
+
+	if (obj < bitmap->max) {
+		bitmap_set(bitmap->table, obj, cnt);
+
+		bitmap->last = (obj + cnt);
+		if (bitmap->last >= bitmap->max) {
+			bitmap->last = bitmap->reserve;
+		}
+	} else {
+		obj = -1;
+	}
+
+	if (obj != -1) {
+		bitmap->avail -= cnt;
+	}
+
+	_mali_osk_spinlock_unlock(bitmap->lock);
+
+	return obj;
+}
+
+u32 _mali_osk_bitmap_avail(struct _mali_osk_bitmap *bitmap)
+{
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+
+	return bitmap->avail;
+}
+
+void _mali_osk_bitmap_free_range(struct _mali_osk_bitmap *bitmap, u32 obj, int cnt)
+{
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+
+	_mali_osk_spinlock_lock(bitmap->lock);
+	bitmap_clear(bitmap->table, obj, cnt);
+	bitmap->last = min(bitmap->last, obj);
+
+	bitmap->avail += cnt;
+	_mali_osk_spinlock_unlock(bitmap->lock);
+}
+
+int _mali_osk_bitmap_init(struct _mali_osk_bitmap *bitmap, u32 num, u32 reserve)
+{
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+	MALI_DEBUG_ASSERT(reserve <= num);
+
+	bitmap->reserve = reserve;
+	bitmap->last = reserve;
+	bitmap->max  = num;
+	bitmap->avail = num - reserve;
+	bitmap->lock = _mali_osk_spinlock_init(_MALI_OSK_LOCKFLAG_UNORDERED, _MALI_OSK_LOCK_ORDER_FIRST);
+	if (!bitmap->lock) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+	bitmap->table = kzalloc(BITS_TO_LONGS(bitmap->max) *
+				sizeof(long), GFP_KERNEL);
+	if (!bitmap->table) {
+		_mali_osk_spinlock_term(bitmap->lock);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void _mali_osk_bitmap_term(struct _mali_osk_bitmap *bitmap)
+{
+	MALI_DEBUG_ASSERT_POINTER(bitmap);
+
+	if (NULL != bitmap->lock) {
+		_mali_osk_spinlock_term(bitmap->lock);
+	}
+
+	if (NULL != bitmap->table) {
+		kfree(bitmap->table);
+	}
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_irq.c b/drivers/gpu/arm/mali400/linux/mali_osk_irq.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_irq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_irq.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_irq.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include <linux/slab.h> /* For memory allocation */
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include <linux/sched.h>
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+typedef struct _mali_osk_irq_t_struct {
+	u32 irqnum;
+	void *data;
+	_mali_osk_irq_uhandler_t uhandler;
+} mali_osk_irq_object_t;
+
+typedef irqreturn_t (*irq_handler_func_t)(int, void *, struct pt_regs *);
+static irqreturn_t irq_handler_upper_half(int port_name, void *dev_id);   /* , struct pt_regs *regs*/
+
+#if defined(DEBUG)
+
+struct test_interrupt_data {
+	_mali_osk_irq_ack_t ack_func;
+	void *probe_data;
+	mali_bool interrupt_received;
+	wait_queue_head_t wq;
+};
+
+static irqreturn_t test_interrupt_upper_half(int port_name, void *dev_id)
+{
+	irqreturn_t ret = IRQ_NONE;
+	struct test_interrupt_data *data = (struct test_interrupt_data *)dev_id;
+
+	if (_MALI_OSK_ERR_OK == data->ack_func(data->probe_data)) {
+		data->interrupt_received = MALI_TRUE;
+		wake_up(&data->wq);
+		ret = IRQ_HANDLED;
+	}
+
+	return ret;
+}
+
+static _mali_osk_errcode_t test_interrupt(u32 irqnum,
+		_mali_osk_irq_trigger_t trigger_func,
+		_mali_osk_irq_ack_t ack_func,
+		void *probe_data,
+		const char *description)
+{
+	unsigned long irq_flags = 0;
+	struct test_interrupt_data data = {
+		.ack_func = ack_func,
+		.probe_data = probe_data,
+		.interrupt_received = MALI_FALSE,
+	};
+
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	irq_flags |= IRQF_SHARED;
+#endif /* defined(CONFIG_MALI_SHARED_INTERRUPTS) */
+
+	if (0 != request_irq(irqnum, test_interrupt_upper_half, irq_flags, description, &data)) {
+		MALI_DEBUG_PRINT(2, ("Unable to install test IRQ handler for core '%s'\n", description));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	init_waitqueue_head(&data.wq);
+
+	trigger_func(probe_data);
+	wait_event_timeout(data.wq, data.interrupt_received, 100);
+
+	free_irq(irqnum, &data);
+
+	if (data.interrupt_received) {
+		MALI_DEBUG_PRINT(3, ("%s: Interrupt test OK\n", description));
+		return _MALI_OSK_ERR_OK;
+	} else {
+		MALI_PRINT_ERROR(("%s: Failed interrupt test on %u\n", description, irqnum));
+		return _MALI_OSK_ERR_FAULT;
+	}
+}
+
+#endif /* defined(DEBUG) */
+
+_mali_osk_irq_t *_mali_osk_irq_init(u32 irqnum, _mali_osk_irq_uhandler_t uhandler, void *int_data, _mali_osk_irq_trigger_t trigger_func, _mali_osk_irq_ack_t ack_func, void *probe_data, const char *description)
+{
+	mali_osk_irq_object_t *irq_object;
+	unsigned long irq_flags = 0;
+
+#if defined(CONFIG_MALI_SHARED_INTERRUPTS)
+	irq_flags |= IRQF_SHARED;
+#endif /* defined(CONFIG_MALI_SHARED_INTERRUPTS) */
+
+	irq_object = kmalloc(sizeof(mali_osk_irq_object_t), GFP_KERNEL);
+	if (NULL == irq_object) {
+		return NULL;
+	}
+
+	if (-1 == irqnum) {
+		/* Probe for IRQ */
+		if ((NULL != trigger_func) && (NULL != ack_func)) {
+			unsigned long probe_count = 3;
+			_mali_osk_errcode_t err;
+			int irq;
+
+			MALI_DEBUG_PRINT(2, ("Probing for irq\n"));
+
+			do {
+				unsigned long mask;
+
+				mask = probe_irq_on();
+				trigger_func(probe_data);
+
+				_mali_osk_time_ubusydelay(5);
+
+				irq = probe_irq_off(mask);
+				err = ack_func(probe_data);
+			} while (irq < 0 && (err == _MALI_OSK_ERR_OK) && probe_count--);
+
+			if (irq < 0 || (_MALI_OSK_ERR_OK != err)) irqnum = -1;
+			else irqnum = irq;
+		} else irqnum = -1; /* no probe functions, fault */
+
+		if (-1 != irqnum) {
+			/* found an irq */
+			MALI_DEBUG_PRINT(2, ("Found irq %d\n", irqnum));
+		} else {
+			MALI_DEBUG_PRINT(2, ("Probe for irq failed\n"));
+		}
+	}
+
+	irq_object->irqnum = irqnum;
+	irq_object->uhandler = uhandler;
+	irq_object->data = int_data;
+
+	if (-1 == irqnum) {
+		MALI_DEBUG_PRINT(2, ("No IRQ for core '%s' found during probe\n", description));
+		kfree(irq_object);
+		return NULL;
+	}
+
+#if defined(DEBUG)
+	/* Verify that the configured interrupt settings are working */
+	if (_MALI_OSK_ERR_OK != test_interrupt(irqnum, trigger_func, ack_func, probe_data, description)) {
+		MALI_DEBUG_PRINT(2, ("Test of IRQ(%d) handler for core '%s' failed\n", irqnum, description));
+		kfree(irq_object);
+		return NULL;
+	}
+#endif
+
+	if (0 != request_irq(irqnum, irq_handler_upper_half, irq_flags, description, irq_object)) {
+		MALI_DEBUG_PRINT(2, ("Unable to install IRQ handler for core '%s'\n", description));
+		kfree(irq_object);
+		return NULL;
+	}
+
+	return irq_object;
+}
+
+void _mali_osk_irq_term(_mali_osk_irq_t *irq)
+{
+	mali_osk_irq_object_t *irq_object = (mali_osk_irq_object_t *)irq;
+	free_irq(irq_object->irqnum, irq_object);
+	kfree(irq_object);
+}
+
+
+/** This function is called directly in interrupt context from the OS just after
+ * the CPU get the hw-irq from mali, or other devices on the same IRQ-channel.
+ * It is registered one of these function for each mali core. When an interrupt
+ * arrives this function will be called equal times as registered mali cores.
+ * That means that we only check one mali core in one function call, and the
+ * core we check for each turn is given by the \a dev_id variable.
+ * If we detect an pending interrupt on the given core, we mask the interrupt
+ * out by settging the core's IRQ_MASK register to zero.
+ * Then we schedule the mali_core_irq_handler_bottom_half to run as high priority
+ * work queue job.
+ */
+static irqreturn_t irq_handler_upper_half(int port_name, void *dev_id)   /* , struct pt_regs *regs*/
+{
+	irqreturn_t ret = IRQ_NONE;
+	mali_osk_irq_object_t *irq_object = (mali_osk_irq_object_t *)dev_id;
+
+	if (_MALI_OSK_ERR_OK == irq_object->uhandler(irq_object->data)) {
+		ret = IRQ_HANDLED;
+	}
+
+	return ret;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_locks.c b/drivers/gpu/arm/mali400/linux/mali_osk_locks.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_locks.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_locks.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,287 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_locks.c
+ * Implemenation of the OS abstraction layer for the kernel device driver
+ */
+
+#include "mali_osk_locks.h"
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+
+
+#ifdef DEBUG
+#ifdef LOCK_ORDER_CHECKING
+static DEFINE_SPINLOCK(lock_tracking_lock);
+static mali_bool add_lock_to_log_and_check(struct _mali_osk_lock_debug_s *lock, uint32_t tid);
+static void remove_lock_from_log(struct _mali_osk_lock_debug_s *lock, uint32_t tid);
+static const char *const lock_order_to_string(_mali_osk_lock_order_t order);
+#endif /* LOCK_ORDER_CHECKING */
+
+void _mali_osk_locks_debug_init(struct _mali_osk_lock_debug_s *checker, _mali_osk_lock_flags_t flags, _mali_osk_lock_order_t order)
+{
+	checker->orig_flags = flags;
+	checker->owner = 0;
+
+#ifdef LOCK_ORDER_CHECKING
+	checker->order = order;
+	checker->next = NULL;
+#endif
+}
+
+void _mali_osk_locks_debug_add(struct _mali_osk_lock_debug_s *checker)
+{
+	checker->owner = _mali_osk_get_tid();
+
+#ifdef LOCK_ORDER_CHECKING
+	if (!(checker->orig_flags & _MALI_OSK_LOCKFLAG_UNORDERED)) {
+		if (!add_lock_to_log_and_check(checker, _mali_osk_get_tid())) {
+			printk(KERN_ERR "%d: ERROR lock %p taken while holding a lock of a higher order.\n",
+			       _mali_osk_get_tid(), checker);
+			dump_stack();
+		}
+	}
+#endif
+}
+
+void _mali_osk_locks_debug_remove(struct _mali_osk_lock_debug_s *checker)
+{
+
+#ifdef LOCK_ORDER_CHECKING
+	if (!(checker->orig_flags & _MALI_OSK_LOCKFLAG_UNORDERED)) {
+		remove_lock_from_log(checker, _mali_osk_get_tid());
+	}
+#endif
+	checker->owner = 0;
+}
+
+
+#ifdef LOCK_ORDER_CHECKING
+/* Lock order checking
+ * -------------------
+ *
+ * To assure that lock ordering scheme defined by _mali_osk_lock_order_t is strictly adhered to, the
+ * following function will, together with a linked list and some extra members in _mali_osk_lock_debug_s,
+ * make sure that a lock that is taken has a higher order than the current highest-order lock a
+ * thread holds.
+ *
+ * This is done in the following manner:
+ * - A linked list keeps track of locks held by a thread.
+ * - A `next' pointer is added to each lock. This is used to chain the locks together.
+ * - When taking a lock, the `add_lock_to_log_and_check' makes sure that taking
+ *   the given lock is legal. It will follow the linked list  to find the last
+ *   lock taken by this thread. If the last lock's order was lower than the
+ *   lock that is to be taken, it appends the new lock to the list and returns
+ *   true, if not, it return false. This return value is assert()'ed on in
+ *   _mali_osk_lock_wait().
+ */
+
+static struct _mali_osk_lock_debug_s *lock_lookup_list;
+
+static void dump_lock_tracking_list(void)
+{
+	struct _mali_osk_lock_debug_s *l;
+	u32 n = 1;
+
+	/* print list for debugging purposes */
+	l = lock_lookup_list;
+
+	while (NULL != l) {
+		printk(" [lock: %p, tid_owner: %d, order: %d] ->", l, l->owner, l->order);
+		l = l->next;
+		MALI_DEBUG_ASSERT(n++ < 100);
+	}
+	printk(" NULL\n");
+}
+
+static int tracking_list_length(void)
+{
+	struct _mali_osk_lock_debug_s *l;
+	u32 n = 0;
+	l = lock_lookup_list;
+
+	while (NULL != l) {
+		l = l->next;
+		n++;
+		MALI_DEBUG_ASSERT(n < 100);
+	}
+	return n;
+}
+
+static mali_bool add_lock_to_log_and_check(struct _mali_osk_lock_debug_s *lock, uint32_t tid)
+{
+	mali_bool ret = MALI_FALSE;
+	_mali_osk_lock_order_t highest_order_for_tid = _MALI_OSK_LOCK_ORDER_FIRST;
+	struct _mali_osk_lock_debug_s *highest_order_lock = (struct _mali_osk_lock_debug_s *)0xbeefbabe;
+	struct _mali_osk_lock_debug_s *l;
+	unsigned long local_lock_flag;
+	u32 len;
+
+	spin_lock_irqsave(&lock_tracking_lock, local_lock_flag);
+	len = tracking_list_length();
+
+	l  = lock_lookup_list;
+	if (NULL == l) { /* This is the first lock taken by this thread -- record and return true */
+		lock_lookup_list = lock;
+		spin_unlock_irqrestore(&lock_tracking_lock, local_lock_flag);
+		return MALI_TRUE;
+	} else {
+		/* Traverse the locks taken and find the lock of the highest order.
+		 * Since several threads may hold locks, each lock's owner must be
+		 * checked so that locks not owned by this thread can be ignored. */
+		for (;;) {
+			MALI_DEBUG_ASSERT_POINTER(l);
+			if (tid == l->owner && l->order >= highest_order_for_tid) {
+				highest_order_for_tid = l->order;
+				highest_order_lock = l;
+			}
+
+			if (NULL != l->next) {
+				l = l->next;
+			} else {
+				break;
+			}
+		}
+
+		l->next = lock;
+		l->next = NULL;
+	}
+
+	/* We have now found the highest order lock currently held by this thread and can see if it is
+	 * legal to take the requested lock. */
+	ret = highest_order_for_tid < lock->order;
+
+	if (!ret) {
+		printk(KERN_ERR "Took lock of order %d (%s) while holding lock of order %d (%s)\n",
+		       lock->order, lock_order_to_string(lock->order),
+		       highest_order_for_tid, lock_order_to_string(highest_order_for_tid));
+		dump_lock_tracking_list();
+	}
+
+	if (len + 1 != tracking_list_length()) {
+		printk(KERN_ERR "************ lock: %p\n", lock);
+		printk(KERN_ERR "************ before: %d *** after: %d ****\n", len, tracking_list_length());
+		dump_lock_tracking_list();
+		MALI_DEBUG_ASSERT_POINTER(NULL);
+	}
+
+	spin_unlock_irqrestore(&lock_tracking_lock, local_lock_flag);
+	return ret;
+}
+
+static void remove_lock_from_log(struct _mali_osk_lock_debug_s *lock, uint32_t tid)
+{
+	struct _mali_osk_lock_debug_s *curr;
+	struct _mali_osk_lock_debug_s *prev = NULL;
+	unsigned long local_lock_flag;
+	u32 len;
+	u32 n = 0;
+
+	spin_lock_irqsave(&lock_tracking_lock, local_lock_flag);
+	len = tracking_list_length();
+	curr = lock_lookup_list;
+
+	if (NULL == curr) {
+		printk(KERN_ERR "Error: Lock tracking list was empty on call to remove_lock_from_log\n");
+		dump_lock_tracking_list();
+	}
+
+	MALI_DEBUG_ASSERT_POINTER(curr);
+
+
+	while (lock != curr) {
+		prev = curr;
+
+		MALI_DEBUG_ASSERT_POINTER(curr);
+		curr = curr->next;
+		MALI_DEBUG_ASSERT(n++ < 100);
+	}
+
+	if (NULL == prev) {
+		lock_lookup_list = curr->next;
+	} else {
+		MALI_DEBUG_ASSERT_POINTER(curr);
+		MALI_DEBUG_ASSERT_POINTER(prev);
+		prev->next = curr->next;
+	}
+
+	lock->next = NULL;
+
+	if (len - 1 != tracking_list_length()) {
+		printk(KERN_ERR "************ lock: %p\n", lock);
+		printk(KERN_ERR "************ before: %d *** after: %d ****\n", len, tracking_list_length());
+		dump_lock_tracking_list();
+		MALI_DEBUG_ASSERT_POINTER(NULL);
+	}
+
+	spin_unlock_irqrestore(&lock_tracking_lock, local_lock_flag);
+}
+
+static const char *const lock_order_to_string(_mali_osk_lock_order_t order)
+{
+	switch (order) {
+	case _MALI_OSK_LOCK_ORDER_SESSIONS:
+		return "_MALI_OSK_LOCK_ORDER_SESSIONS";
+		break;
+	case _MALI_OSK_LOCK_ORDER_MEM_SESSION:
+		return "_MALI_OSK_LOCK_ORDER_MEM_SESSION";
+		break;
+	case _MALI_OSK_LOCK_ORDER_MEM_INFO:
+		return "_MALI_OSK_LOCK_ORDER_MEM_INFO";
+		break;
+	case _MALI_OSK_LOCK_ORDER_MEM_PT_CACHE:
+		return "_MALI_OSK_LOCK_ORDER_MEM_PT_CACHE";
+		break;
+	case _MALI_OSK_LOCK_ORDER_DESCRIPTOR_MAP:
+		return "_MALI_OSK_LOCK_ORDER_DESCRIPTOR_MAP";
+		break;
+	case _MALI_OSK_LOCK_ORDER_PM_EXECUTION:
+		return "_MALI_OSK_LOCK_ORDER_PM_EXECUTION";
+		break;
+	case _MALI_OSK_LOCK_ORDER_EXECUTOR:
+		return "_MALI_OSK_LOCK_ORDER_EXECUTOR";
+		break;
+	case _MALI_OSK_LOCK_ORDER_TIMELINE_SYSTEM:
+		return "_MALI_OSK_LOCK_ORDER_TIMELINE_SYSTEM";
+		break;
+	case _MALI_OSK_LOCK_ORDER_SCHEDULER:
+		return "_MALI_OSK_LOCK_ORDER_SCHEDULER";
+		break;
+	case _MALI_OSK_LOCK_ORDER_SCHEDULER_DEFERRED:
+		return "_MALI_OSK_LOCK_ORDER_SCHEDULER_DEFERRED";
+		break;
+	case _MALI_OSK_LOCK_ORDER_DMA_COMMAND:
+		return "_MALI_OSK_LOCK_ORDER_DMA_COMMAND";
+		break;
+	case _MALI_OSK_LOCK_ORDER_PROFILING:
+		return "_MALI_OSK_LOCK_ORDER_PROFILING";
+		break;
+	case _MALI_OSK_LOCK_ORDER_L2:
+		return "_MALI_OSK_LOCK_ORDER_L2";
+		break;
+	case _MALI_OSK_LOCK_ORDER_L2_COMMAND:
+		return "_MALI_OSK_LOCK_ORDER_L2_COMMAND";
+		break;
+	case _MALI_OSK_LOCK_ORDER_UTILIZATION:
+		return "_MALI_OSK_LOCK_ORDER_UTILIZATION";
+		break;
+	case _MALI_OSK_LOCK_ORDER_SESSION_PENDING_JOBS:
+		return "_MALI_OSK_LOCK_ORDER_SESSION_PENDING_JOBS";
+		break;
+	case _MALI_OSK_LOCK_ORDER_PM_STATE:
+		return "_MALI_OSK_LOCK_ORDER_PM_STATE";
+		break;
+	default:
+		return "<UNKNOWN_LOCK_ORDER>";
+	}
+}
+#endif /* LOCK_ORDER_CHECKING */
+#endif /* DEBUG */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_locks.h b/drivers/gpu/arm/mali400/linux/mali_osk_locks.h
--- a/drivers/gpu/arm/mali400/linux/mali_osk_locks.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_locks.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,326 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_locks.h
+ * Defines OS abstraction of lock and mutex
+ */
+#ifndef _MALI_OSK_LOCKS_H
+#define _MALI_OSK_LOCKS_H
+
+#include <linux/spinlock.h>
+#include <linux/rwsem.h>
+#include <linux/mutex.h>
+
+#include <linux/slab.h>
+
+#include "mali_osk_types.h"
+
+#ifdef _cplusplus
+extern "C" {
+#endif
+
+	/* When DEBUG is enabled, this struct will be used to track owner, mode and order checking */
+#ifdef DEBUG
+	struct _mali_osk_lock_debug_s {
+		u32 owner;
+		_mali_osk_lock_flags_t orig_flags;
+		_mali_osk_lock_order_t order;
+		struct _mali_osk_lock_debug_s *next;
+	};
+#endif
+
+	/* Anstraction of spinlock_t */
+	struct _mali_osk_spinlock_s {
+#ifdef DEBUG
+		struct _mali_osk_lock_debug_s checker;
+#endif
+		spinlock_t spinlock;
+	};
+
+	/* Abstration of spinlock_t and lock flag which is used to store register's state before locking */
+	struct _mali_osk_spinlock_irq_s {
+#ifdef DEBUG
+		struct _mali_osk_lock_debug_s checker;
+#endif
+
+		spinlock_t spinlock;
+		unsigned long flags;
+	};
+
+	/* Abstraction of rw_semaphore in OS */
+	struct _mali_osk_mutex_rw_s {
+#ifdef DEBUG
+		struct _mali_osk_lock_debug_s checker;
+		_mali_osk_lock_mode_t mode;
+#endif
+
+		struct rw_semaphore rw_sema;
+	};
+
+	/* Mutex and mutex_interruptible functions share the same osk mutex struct */
+	struct _mali_osk_mutex_s {
+#ifdef DEBUG
+		struct _mali_osk_lock_debug_s checker;
+#endif
+		struct mutex mutex;
+	};
+
+#ifdef DEBUG
+	/** @brief _mali_osk_locks_debug_init/add/remove() functions are declared when DEBUG is enabled and
+	 * defined in file mali_osk_locks.c. When LOCK_ORDER_CHECKING is enabled, calling these functions when we
+	 * init/lock/unlock a lock/mutex, we could track lock order of a given tid. */
+	void _mali_osk_locks_debug_init(struct _mali_osk_lock_debug_s *checker, _mali_osk_lock_flags_t flags, _mali_osk_lock_order_t order);
+	void _mali_osk_locks_debug_add(struct _mali_osk_lock_debug_s *checker);
+	void _mali_osk_locks_debug_remove(struct _mali_osk_lock_debug_s *checker);
+
+	/** @brief This function can return a given lock's owner when DEBUG     is enabled. */
+	static inline u32 _mali_osk_lock_get_owner(struct _mali_osk_lock_debug_s *lock)
+	{
+		return lock->owner;
+	}
+#else
+#define _mali_osk_locks_debug_init(x, y, z) do {} while (0)
+#define _mali_osk_locks_debug_add(x) do {} while (0)
+#define _mali_osk_locks_debug_remove(x) do {} while (0)
+#endif
+
+	/** @brief Before use _mali_osk_spin_lock, init function should be used to allocate memory and initial spinlock*/
+	static inline _mali_osk_spinlock_t *_mali_osk_spinlock_init(_mali_osk_lock_flags_t flags, _mali_osk_lock_order_t order)
+	{
+		_mali_osk_spinlock_t *lock = NULL;
+
+		lock = kmalloc(sizeof(_mali_osk_spinlock_t), GFP_KERNEL);
+		if (NULL == lock) {
+			return NULL;
+		}
+		spin_lock_init(&lock->spinlock);
+		_mali_osk_locks_debug_init((struct _mali_osk_lock_debug_s *)lock, flags, order);
+		return lock;
+	}
+
+	/** @brief Lock a spinlock */
+	static inline void  _mali_osk_spinlock_lock(_mali_osk_spinlock_t *lock)
+	{
+		BUG_ON(NULL == lock);
+		spin_lock(&lock->spinlock);
+		_mali_osk_locks_debug_add((struct _mali_osk_lock_debug_s *)lock);
+	}
+
+	/** @brief Unlock a spinlock */
+	static inline void _mali_osk_spinlock_unlock(_mali_osk_spinlock_t *lock)
+	{
+		BUG_ON(NULL == lock);
+		_mali_osk_locks_debug_remove((struct _mali_osk_lock_debug_s *)lock);
+		spin_unlock(&lock->spinlock);
+	}
+
+	/** @brief Free a memory block which the argument lock pointed to and its type must be
+	 * _mali_osk_spinlock_t *. */
+	static inline void _mali_osk_spinlock_term(_mali_osk_spinlock_t *lock)
+	{
+		/* Parameter validation  */
+		BUG_ON(NULL == lock);
+
+		/* Linux requires no explicit termination of spinlocks, semaphores, or rw_semaphores */
+		kfree(lock);
+	}
+
+	/** @brief Before _mali_osk_spinlock_irq_lock/unlock/term() is called, init function should be
+	 * called to initial spinlock and flags in struct _mali_osk_spinlock_irq_t. */
+	static inline _mali_osk_spinlock_irq_t *_mali_osk_spinlock_irq_init(_mali_osk_lock_flags_t flags, _mali_osk_lock_order_t order)
+	{
+		_mali_osk_spinlock_irq_t *lock = NULL;
+		lock = kmalloc(sizeof(_mali_osk_spinlock_irq_t), GFP_KERNEL);
+
+		if (NULL == lock) {
+			return NULL;
+		}
+
+		lock->flags = 0;
+		spin_lock_init(&lock->spinlock);
+		_mali_osk_locks_debug_init((struct _mali_osk_lock_debug_s *)lock, flags, order);
+		return lock;
+	}
+
+	/** @brief Lock spinlock and save the register's state */
+	static inline void _mali_osk_spinlock_irq_lock(_mali_osk_spinlock_irq_t *lock)
+	{
+		unsigned long tmp_flags;
+
+		BUG_ON(NULL == lock);
+		spin_lock_irqsave(&lock->spinlock, tmp_flags);
+		lock->flags = tmp_flags;
+		_mali_osk_locks_debug_add((struct _mali_osk_lock_debug_s *)lock);
+	}
+
+	/** @brief Unlock spinlock with saved register's state */
+	static inline void _mali_osk_spinlock_irq_unlock(_mali_osk_spinlock_irq_t *lock)
+	{
+		BUG_ON(NULL == lock);
+		_mali_osk_locks_debug_remove((struct _mali_osk_lock_debug_s *)lock);
+		spin_unlock_irqrestore(&lock->spinlock, lock->flags);
+	}
+
+	/** @brief Destroy a given memory block which lock pointed to, and the lock type must be
+	 * _mali_osk_spinlock_irq_t *. */
+	static inline void _mali_osk_spinlock_irq_term(_mali_osk_spinlock_irq_t *lock)
+	{
+		/* Parameter validation  */
+		BUG_ON(NULL == lock);
+
+		/* Linux requires no explicit termination of spinlocks, semaphores, or rw_semaphores */
+		kfree(lock);
+	}
+
+	/** @brief Before _mali_osk_mutex_rw_wait/signal/term() is called, we should call
+	 * _mali_osk_mutex_rw_init() to kmalloc a memory block and initial part of elements in it. */
+	static inline _mali_osk_mutex_rw_t *_mali_osk_mutex_rw_init(_mali_osk_lock_flags_t flags, _mali_osk_lock_order_t order)
+	{
+		_mali_osk_mutex_rw_t *lock = NULL;
+
+		lock = kmalloc(sizeof(_mali_osk_mutex_rw_t), GFP_KERNEL);
+
+		if (NULL == lock) {
+			return NULL;
+		}
+
+		init_rwsem(&lock->rw_sema);
+		_mali_osk_locks_debug_init((struct _mali_osk_lock_debug_s *)lock, flags, order);
+		return lock;
+	}
+
+	/** @brief When call _mali_osk_mutex_rw_wait/signal() functions, the second argument mode
+	 * should be assigned with value _MALI_OSK_LOCKMODE_RO or _MALI_OSK_LOCKMODE_RW */
+	static inline void _mali_osk_mutex_rw_wait(_mali_osk_mutex_rw_t *lock, _mali_osk_lock_mode_t mode)
+	{
+		BUG_ON(NULL == lock);
+		BUG_ON(!(_MALI_OSK_LOCKMODE_RO == mode || _MALI_OSK_LOCKMODE_RW == mode));
+
+		if (mode == _MALI_OSK_LOCKMODE_RO) {
+			down_read(&lock->rw_sema);
+		} else {
+			down_write(&lock->rw_sema);
+		}
+
+#ifdef DEBUG
+		if (mode == _MALI_OSK_LOCKMODE_RW) {
+			lock->mode = mode;
+		} else { /* mode == _MALI_OSK_LOCKMODE_RO */
+			lock->mode = mode;
+		}
+		_mali_osk_locks_debug_add((struct _mali_osk_lock_debug_s *)lock);
+#endif
+	}
+
+	/** @brief Up lock->rw_sema with up_read/write() accordinf argument mode's value. */
+	static inline void  _mali_osk_mutex_rw_signal(_mali_osk_mutex_rw_t *lock, _mali_osk_lock_mode_t mode)
+	{
+		BUG_ON(NULL == lock);
+		BUG_ON(!(_MALI_OSK_LOCKMODE_RO == mode || _MALI_OSK_LOCKMODE_RW == mode));
+#ifdef DEBUG
+		/* make sure the thread releasing the lock actually was the owner */
+		if (mode == _MALI_OSK_LOCKMODE_RW) {
+			_mali_osk_locks_debug_remove((struct _mali_osk_lock_debug_s *)lock);
+			/* This lock now has no owner */
+			lock->checker.owner = 0;
+		}
+#endif
+
+		if (mode == _MALI_OSK_LOCKMODE_RO) {
+			up_read(&lock->rw_sema);
+		} else {
+			up_write(&lock->rw_sema);
+		}
+	}
+
+	/** @brief Free a given memory block which lock pointed to and its type must be
+	 * _mali_sok_mutex_rw_t *. */
+	static inline void _mali_osk_mutex_rw_term(_mali_osk_mutex_rw_t *lock)
+	{
+		/* Parameter validation  */
+		BUG_ON(NULL == lock);
+
+		/* Linux requires no explicit termination of spinlocks, semaphores, or rw_semaphores */
+		kfree(lock);
+	}
+
+	/** @brief Mutex & mutex_interruptible share the same init and term function, because they have the
+	 * same osk mutex struct, and the difference between them is which locking function they use */
+	static inline _mali_osk_mutex_t *_mali_osk_mutex_init(_mali_osk_lock_flags_t flags, _mali_osk_lock_order_t order)
+	{
+		_mali_osk_mutex_t *lock = NULL;
+
+		lock = kmalloc(sizeof(_mali_osk_mutex_t), GFP_KERNEL);
+
+		if (NULL == lock) {
+			return NULL;
+		}
+		mutex_init(&lock->mutex);
+
+		_mali_osk_locks_debug_init((struct _mali_osk_lock_debug_s *)lock, flags, order);
+		return lock;
+	}
+
+	/** @brief  Lock the lock->mutex with mutex_lock_interruptible function */
+	static inline _mali_osk_errcode_t _mali_osk_mutex_wait_interruptible(_mali_osk_mutex_t *lock)
+	{
+		_mali_osk_errcode_t err = _MALI_OSK_ERR_OK;
+
+		BUG_ON(NULL == lock);
+
+		if (mutex_lock_interruptible(&lock->mutex)) {
+			printk(KERN_WARNING "Mali: Can not lock mutex\n");
+			err = _MALI_OSK_ERR_RESTARTSYSCALL;
+		}
+
+		_mali_osk_locks_debug_add((struct _mali_osk_lock_debug_s *)lock);
+		return err;
+	}
+
+	/** @brief Unlock the lock->mutex which is locked with mutex_lock_interruptible() function. */
+	static inline void _mali_osk_mutex_signal_interruptible(_mali_osk_mutex_t *lock)
+	{
+		BUG_ON(NULL == lock);
+		_mali_osk_locks_debug_remove((struct _mali_osk_lock_debug_s *)lock);
+		mutex_unlock(&lock->mutex);
+	}
+
+	/** @brief Lock the lock->mutex just with mutex_lock() function which could not be interruptted. */
+	static inline void _mali_osk_mutex_wait(_mali_osk_mutex_t *lock)
+	{
+		BUG_ON(NULL == lock);
+		mutex_lock(&lock->mutex);
+		_mali_osk_locks_debug_add((struct _mali_osk_lock_debug_s *)lock);
+	}
+
+	/** @brief Unlock the lock->mutex which is locked with mutex_lock() function. */
+	static inline void _mali_osk_mutex_signal(_mali_osk_mutex_t *lock)
+	{
+		BUG_ON(NULL == lock);
+		_mali_osk_locks_debug_remove((struct _mali_osk_lock_debug_s *)lock);
+		mutex_unlock(&lock->mutex);
+	}
+
+	/** @brief Free a given memory block which lock point. */
+	static inline void _mali_osk_mutex_term(_mali_osk_mutex_t *lock)
+	{
+		/* Parameter validation  */
+		BUG_ON(NULL == lock);
+
+		/* Linux requires no explicit termination of spinlocks, semaphores, or rw_semaphores */
+		kfree(lock);
+	}
+
+#ifdef _cplusplus
+}
+#endif
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_low_level_mem.c b/drivers/gpu/arm/mali400/linux/mali_osk_low_level_mem.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_low_level_mem.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_low_level_mem.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_low_level_mem.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include <asm/io.h>
+#include <linux/ioport.h>
+#include <linux/slab.h>
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_ukk.h"
+
+void _mali_osk_mem_barrier(void)
+{
+	mb();
+}
+
+void _mali_osk_write_mem_barrier(void)
+{
+	wmb();
+}
+
+mali_io_address _mali_osk_mem_mapioregion(uintptr_t phys, u32 size, const char *description)
+{
+	return (mali_io_address)ioremap_nocache(phys, size);
+}
+
+void _mali_osk_mem_unmapioregion(uintptr_t phys, u32 size, mali_io_address virt)
+{
+	iounmap((void *)virt);
+}
+
+_mali_osk_errcode_t inline _mali_osk_mem_reqregion(uintptr_t phys, u32 size, const char *description)
+{
+#if MALI_LICENSE_IS_GPL
+	return _MALI_OSK_ERR_OK; /* GPL driver gets the mem region for the resources registered automatically */
+#else
+	return ((NULL == request_mem_region(phys, size, description)) ? _MALI_OSK_ERR_NOMEM : _MALI_OSK_ERR_OK);
+#endif
+}
+
+void inline _mali_osk_mem_unreqregion(uintptr_t phys, u32 size)
+{
+#if !MALI_LICENSE_IS_GPL
+	release_mem_region(phys, size);
+#endif
+}
+
+void inline _mali_osk_mem_iowrite32_relaxed(volatile mali_io_address addr, u32 offset, u32 val)
+{
+	__raw_writel(cpu_to_le32(val), ((u8 *)addr) + offset);
+}
+
+u32 inline _mali_osk_mem_ioread32(volatile mali_io_address addr, u32 offset)
+{
+	return ioread32(((u8 *)addr) + offset);
+}
+
+void inline _mali_osk_mem_iowrite32(volatile mali_io_address addr, u32 offset, u32 val)
+{
+	iowrite32(val, ((u8 *)addr) + offset);
+}
+
+void _mali_osk_cache_flushall(void)
+{
+	/** @note Cached memory is not currently supported in this implementation */
+}
+
+void _mali_osk_cache_ensure_uncached_range_flushed(void *uncached_mapping, u32 offset, u32 size)
+{
+	_mali_osk_write_mem_barrier();
+}
+
+u32 _mali_osk_mem_write_safe(void __user *dest, const void __user *src, u32 size)
+{
+#define MALI_MEM_SAFE_COPY_BLOCK_SIZE 4096
+	u32 retval = 0;
+	void *temp_buf;
+
+	temp_buf = kmalloc(MALI_MEM_SAFE_COPY_BLOCK_SIZE, GFP_KERNEL);
+	if (NULL != temp_buf) {
+		u32 bytes_left_to_copy = size;
+		u32 i;
+		for (i = 0; i < size; i += MALI_MEM_SAFE_COPY_BLOCK_SIZE) {
+			u32 size_to_copy;
+			u32 size_copied;
+			u32 bytes_left;
+
+			if (bytes_left_to_copy > MALI_MEM_SAFE_COPY_BLOCK_SIZE) {
+				size_to_copy = MALI_MEM_SAFE_COPY_BLOCK_SIZE;
+			} else {
+				size_to_copy = bytes_left_to_copy;
+			}
+
+			bytes_left = copy_from_user(temp_buf, ((char *)src) + i, size_to_copy);
+			size_copied = size_to_copy - bytes_left;
+
+			bytes_left = copy_to_user(((char *)dest) + i, temp_buf, size_copied);
+			size_copied -= bytes_left;
+
+			bytes_left_to_copy -= size_copied;
+			retval += size_copied;
+
+			if (size_copied != size_to_copy) {
+				break; /* Early out, we was not able to copy this entire block */
+			}
+		}
+
+		kfree(temp_buf);
+	}
+
+	return retval;
+}
+
+_mali_osk_errcode_t _mali_ukk_mem_write_safe(_mali_uk_mem_write_safe_s *args)
+{
+	void __user *src;
+	void __user *dst;
+	struct mali_session_data *session;
+
+	MALI_DEBUG_ASSERT_POINTER(args);
+
+	session = (struct mali_session_data *)(uintptr_t)args->ctx;
+
+	if (NULL == session) {
+		return _MALI_OSK_ERR_INVALID_ARGS;
+	}
+
+	src = (void __user *)(uintptr_t)args->src;
+	dst = (void __user *)(uintptr_t)args->dest;
+
+	/* Return number of bytes actually copied */
+	args->size = _mali_osk_mem_write_safe(dst, src, args->size);
+	return _MALI_OSK_ERR_OK;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_mali.c b/drivers/gpu/arm/mali400/linux/mali_osk_mali.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_mali.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_mali.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,491 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_mali.c
+ * Implementation of the OS abstraction layer which is specific for the Mali kernel device driver
+ */
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/mali/mali_utgard.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+
+#include "mali_osk_mali.h"
+#include "mali_kernel_common.h" /* MALI_xxx macros */
+#include "mali_osk.h"           /* kernel side OS functions */
+#include "mali_kernel_linux.h"
+
+static mali_bool mali_secure_mode_enabled = MALI_FALSE;
+static mali_bool mali_secure_mode_supported = MALI_FALSE;
+
+/* Function that init the mali gpu secure mode */
+void (*mali_secure_mode_deinit)(void) = NULL;
+/* Function that reset GPU and enable the mali gpu secure mode */
+int (*mali_gpu_reset_and_secure_mode_enable)(void) = NULL;
+/* Function that reset GPU and disable the mali gpu secure mode */
+int (*mali_gpu_reset_and_secure_mode_disable)(void) = NULL;
+
+#ifdef CONFIG_MALI_DT
+
+#define MALI_OSK_INVALID_RESOURCE_ADDRESS 0xFFFFFFFF
+
+/**
+ * Define the max number of resource we could have.
+ */
+#define MALI_OSK_MAX_RESOURCE_NUMBER 27
+
+/**
+ * Define the max number of resource with interrupts, and they are
+ * the first 20 elements in array mali_osk_resource_bank.
+ */
+#define MALI_OSK_RESOURCE_WITH_IRQ_NUMBER 20
+
+/**
+ * pp core start and end location in mali_osk_resource_bank array.
+ */
+#define MALI_OSK_RESOURCE_PP_LOCATION_START 2
+#define MALI_OSK_RESOURCE_PP_LOCATION_END 17
+
+/**
+ * L2 cache start and end location in mali_osk_resource_bank array.
+ */
+#define MALI_OSK_RESOURCE_L2_LOCATION_START 20
+#define MALI_OSK_RESOURCE_l2_LOCATION_END 22
+
+/**
+ * DMA unit location.
+ */
+#define MALI_OSK_RESOURCE_DMA_LOCATION 26
+
+static _mali_osk_resource_t mali_osk_resource_bank[MALI_OSK_MAX_RESOURCE_NUMBER] = {
+	{.description = "Mali_GP", .base = MALI_OFFSET_GP, .irq_name = "IRQGP",},
+	{.description = "Mali_GP_MMU", .base = MALI_OFFSET_GP_MMU, .irq_name = "IRQGPMMU",},
+	{.description = "Mali_PP0", .base = MALI_OFFSET_PP0, .irq_name = "IRQPP0",},
+	{.description = "Mali_PP0_MMU", .base = MALI_OFFSET_PP0_MMU, .irq_name = "IRQPPMMU0",},
+	{.description = "Mali_PP1", .base = MALI_OFFSET_PP1, .irq_name = "IRQPP1",},
+	{.description = "Mali_PP1_MMU", .base = MALI_OFFSET_PP1_MMU, .irq_name = "IRQPPMMU1",},
+	{.description = "Mali_PP2", .base = MALI_OFFSET_PP2, .irq_name = "IRQPP2",},
+	{.description = "Mali_PP2_MMU", .base = MALI_OFFSET_PP2_MMU, .irq_name = "IRQPPMMU2",},
+	{.description = "Mali_PP3", .base = MALI_OFFSET_PP3, .irq_name = "IRQPP3",},
+	{.description = "Mali_PP3_MMU", .base = MALI_OFFSET_PP3_MMU, .irq_name = "IRQPPMMU3",},
+	{.description = "Mali_PP4", .base = MALI_OFFSET_PP4, .irq_name = "IRQPP4",},
+	{.description = "Mali_PP4_MMU", .base = MALI_OFFSET_PP4_MMU, .irq_name = "IRQPPMMU4",},
+	{.description = "Mali_PP5", .base = MALI_OFFSET_PP5, .irq_name = "IRQPP5",},
+	{.description = "Mali_PP5_MMU", .base = MALI_OFFSET_PP5_MMU, .irq_name = "IRQPPMMU5",},
+	{.description = "Mali_PP6", .base = MALI_OFFSET_PP6, .irq_name = "IRQPP6",},
+	{.description = "Mali_PP6_MMU", .base = MALI_OFFSET_PP6_MMU, .irq_name = "IRQPPMMU6",},
+	{.description = "Mali_PP7", .base = MALI_OFFSET_PP7, .irq_name = "IRQPP7",},
+	{.description = "Mali_PP7_MMU", .base = MALI_OFFSET_PP7_MMU, .irq_name = "IRQPPMMU",},
+	{.description = "Mali_PP_Broadcast", .base = MALI_OFFSET_PP_BCAST, .irq_name = "IRQPP",},
+	{.description = "Mali_PMU", .base = MALI_OFFSET_PMU, .irq_name = "IRQPMU",},
+	{.description = "Mali_L2", .base = MALI_OFFSET_L2_RESOURCE0,},
+	{.description = "Mali_L2", .base = MALI_OFFSET_L2_RESOURCE1,},
+	{.description = "Mali_L2", .base = MALI_OFFSET_L2_RESOURCE2,},
+	{.description = "Mali_PP_MMU_Broadcast", .base = MALI_OFFSET_PP_BCAST_MMU,},
+	{.description = "Mali_Broadcast", .base = MALI_OFFSET_BCAST,},
+	{.description = "Mali_DLBU", .base = MALI_OFFSET_DLBU,},
+	{.description = "Mali_DMA", .base = MALI_OFFSET_DMA,},
+};
+
+static int _mali_osk_get_compatible_name(const char **out_string)
+{
+	struct device_node *node = mali_platform_device->dev.of_node;
+
+	MALI_DEBUG_ASSERT(NULL != node);
+
+	return of_property_read_string(node, "compatible", out_string);
+}
+
+_mali_osk_errcode_t _mali_osk_resource_initialize(void)
+{
+	mali_bool mali_is_450 = MALI_FALSE, mali_is_470 = MALI_FALSE;
+	int i, pp_core_num = 0, l2_core_num = 0;
+	struct resource *res;
+	const char *compatible_name = NULL;
+
+	if (0 == _mali_osk_get_compatible_name(&compatible_name)) {
+		if (0 == strncmp(compatible_name, "arm,mali-450", strlen("arm,mali-450"))) {
+			mali_is_450 = MALI_TRUE;
+			MALI_DEBUG_PRINT(2, ("mali-450 device tree detected."));
+		} else if (0 == strncmp(compatible_name, "arm,mali-470", strlen("arm,mali-470"))) {
+			mali_is_470 = MALI_TRUE;
+			MALI_DEBUG_PRINT(2, ("mali-470 device tree detected."));
+		}
+	}
+
+	for (i = 0; i < MALI_OSK_RESOURCE_WITH_IRQ_NUMBER; i++) {
+		res = platform_get_resource_byname(mali_platform_device, IORESOURCE_IRQ, mali_osk_resource_bank[i].irq_name);
+		if (res) {
+			mali_osk_resource_bank[i].irq = res->start;
+		} else {
+			mali_osk_resource_bank[i].base = MALI_OSK_INVALID_RESOURCE_ADDRESS;
+		}
+	}
+
+	for (i = MALI_OSK_RESOURCE_PP_LOCATION_START; i <= MALI_OSK_RESOURCE_PP_LOCATION_END; i++) {
+		if (MALI_OSK_INVALID_RESOURCE_ADDRESS != mali_osk_resource_bank[i].base) {
+			pp_core_num++;
+		}
+	}
+
+	/* We have to divide by 2, because we caculate twice for only one pp(pp_core and pp_mmu_core). */
+	if (0 != pp_core_num % 2) {
+		MALI_DEBUG_PRINT(2, ("The value of pp core number isn't normal."));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	pp_core_num /= 2;
+
+	/**
+	 * we can caculate the number of l2 cache core according the number of pp core number
+	 * and device type(mali400/mali450/mali470).
+	 */
+	l2_core_num = 1;
+	if (mali_is_450) {
+		if (pp_core_num > 4) {
+			l2_core_num = 3;
+		} else if (pp_core_num <= 4) {
+			l2_core_num = 2;
+		}
+	}
+
+	for (i = MALI_OSK_RESOURCE_l2_LOCATION_END; i > MALI_OSK_RESOURCE_L2_LOCATION_START + l2_core_num - 1; i--) {
+		mali_osk_resource_bank[i].base = MALI_OSK_INVALID_RESOURCE_ADDRESS;
+	}
+
+	/* If device is not mali-450 type, we have to remove related resource from resource bank. */
+	if (!(mali_is_450 || mali_is_470)) {
+		for (i = MALI_OSK_RESOURCE_l2_LOCATION_END + 1; i < MALI_OSK_MAX_RESOURCE_NUMBER; i++) {
+			mali_osk_resource_bank[i].base = MALI_OSK_INVALID_RESOURCE_ADDRESS;
+		}
+	}
+
+	if (mali_is_470)
+		mali_osk_resource_bank[MALI_OSK_RESOURCE_DMA_LOCATION].base = MALI_OSK_INVALID_RESOURCE_ADDRESS;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_osk_resource_find(u32 addr, _mali_osk_resource_t *res)
+{
+	int i;
+
+	if (NULL == mali_platform_device) {
+		return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	}
+
+	/* Traverse all of resources in resources bank to find the matching one. */
+	for (i = 0; i < MALI_OSK_MAX_RESOURCE_NUMBER; i++) {
+		if (mali_osk_resource_bank[i].base == addr) {
+			if (NULL != res) {
+				res->base = addr + _mali_osk_resource_base_address();
+				res->description = mali_osk_resource_bank[i].description;
+				res->irq = mali_osk_resource_bank[i].irq;
+			}
+			return _MALI_OSK_ERR_OK;
+		}
+	}
+
+	return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+}
+
+uintptr_t _mali_osk_resource_base_address(void)
+{
+	struct resource *reg_res = NULL;
+	uintptr_t ret = 0;
+
+	reg_res = platform_get_resource(mali_platform_device, IORESOURCE_MEM, 0);
+
+	if (NULL != reg_res) {
+		ret = reg_res->start;
+	}
+
+	return ret;
+}
+
+void _mali_osk_device_data_pmu_config_get(u16 *domain_config_array, int array_size)
+{
+	struct device_node *node = mali_platform_device->dev.of_node;
+	struct property *prop;
+	const __be32 *p;
+	int length = 0, i = 0;
+	u32 u;
+
+	MALI_DEBUG_PRINT(2, ("Get pmu config from device tree configuration.\n"));
+
+	MALI_DEBUG_ASSERT(NULL != node);
+
+	if (!of_get_property(node, "pmu_domain_config", &length)) {
+		return;
+	}
+
+	if (array_size != length / sizeof(u32)) {
+		MALI_PRINT_ERROR(("Wrong pmu domain config in device tree."));
+		return;
+	}
+
+	of_property_for_each_u32(node, "pmu_domain_config", prop, p, u) {
+		domain_config_array[i] = (u16)u;
+		i++;
+	}
+
+	return;
+}
+
+u32 _mali_osk_get_pmu_switch_delay(void)
+{
+	struct device_node *node = mali_platform_device->dev.of_node;
+	u32 switch_delay;
+
+	MALI_DEBUG_ASSERT(NULL != node);
+
+	if (0 == of_property_read_u32(node, "pmu_switch_delay", &switch_delay)) {
+		return switch_delay;
+	} else {
+		MALI_DEBUG_PRINT(2, ("Couldn't find pmu_switch_delay in device tree configuration.\n"));
+	}
+
+	return 0;
+}
+
+#else /* CONFIG_MALI_DT */
+
+_mali_osk_errcode_t _mali_osk_resource_find(u32 addr, _mali_osk_resource_t *res)
+{
+	int i;
+	uintptr_t phys_addr;
+
+	if (NULL == mali_platform_device) {
+		/* Not connected to a device */
+		return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	}
+
+	phys_addr = addr + _mali_osk_resource_base_address();
+	for (i = 0; i < mali_platform_device->num_resources; i++) {
+		if (IORESOURCE_MEM == resource_type(&(mali_platform_device->resource[i])) &&
+		    mali_platform_device->resource[i].start == phys_addr) {
+			if (NULL != res) {
+				res->base = phys_addr;
+				res->description = mali_platform_device->resource[i].name;
+
+				/* Any (optional) IRQ resource belonging to this resource will follow */
+				if ((i + 1) < mali_platform_device->num_resources &&
+				    IORESOURCE_IRQ == resource_type(&(mali_platform_device->resource[i + 1]))) {
+					res->irq = mali_platform_device->resource[i + 1].start;
+				} else {
+					res->irq = -1;
+				}
+			}
+			return _MALI_OSK_ERR_OK;
+		}
+	}
+
+	return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+}
+
+uintptr_t _mali_osk_resource_base_address(void)
+{
+	uintptr_t lowest_addr = (uintptr_t)(0 - 1);
+	uintptr_t ret = 0;
+
+	if (NULL != mali_platform_device) {
+		int i;
+		for (i = 0; i < mali_platform_device->num_resources; i++) {
+			if (mali_platform_device->resource[i].flags & IORESOURCE_MEM &&
+			    mali_platform_device->resource[i].start < lowest_addr) {
+				lowest_addr = mali_platform_device->resource[i].start;
+				ret = lowest_addr;
+			}
+		}
+	}
+
+	return ret;
+}
+
+void _mali_osk_device_data_pmu_config_get(u16 *domain_config_array, int array_size)
+{
+	_mali_osk_device_data data = { 0, };
+
+	MALI_DEBUG_PRINT(2, ("Get pmu config from platform device data.\n"));
+	if (_MALI_OSK_ERR_OK == _mali_osk_device_data_get(&data)) {
+		/* Copy the custom customer power domain config */
+		_mali_osk_memcpy(domain_config_array, data.pmu_domain_config, sizeof(data.pmu_domain_config));
+	}
+
+	return;
+}
+
+u32 _mali_osk_get_pmu_switch_delay(void)
+{
+	_mali_osk_errcode_t err;
+	_mali_osk_device_data data = { 0, };
+
+	err = _mali_osk_device_data_get(&data);
+
+	if (_MALI_OSK_ERR_OK == err) {
+		return data.pmu_switch_delay;
+	}
+
+	return 0;
+}
+#endif /* CONFIG_MALI_DT */
+
+_mali_osk_errcode_t _mali_osk_device_data_get(_mali_osk_device_data *data)
+{
+	MALI_DEBUG_ASSERT_POINTER(data);
+
+	if (NULL != mali_platform_device) {
+		struct mali_gpu_device_data *os_data = NULL;
+
+		os_data = (struct mali_gpu_device_data *)mali_platform_device->dev.platform_data;
+		if (NULL != os_data) {
+			/* Copy data from OS dependant struct to Mali neutral struct (identical!) */
+			BUILD_BUG_ON(sizeof(*os_data) != sizeof(*data));
+			_mali_osk_memcpy(data, os_data, sizeof(*os_data));
+
+			return _MALI_OSK_ERR_OK;
+		}
+	}
+
+	return _MALI_OSK_ERR_ITEM_NOT_FOUND;
+}
+
+u32 _mali_osk_identify_gpu_resource(void)
+{
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI_OFFSET_L2_RESOURCE1, NULL))
+		/* Mali 450 */
+		return 0x450;
+
+	if (_MALI_OSK_ERR_OK == _mali_osk_resource_find(MALI_OFFSET_DLBU, NULL))
+		/* Mali 470 */
+		return 0x470;
+
+	/* Mali 400 */
+	return 0x400;
+}
+
+mali_bool _mali_osk_shared_interrupts(void)
+{
+	u32 irqs[128];
+	u32 i, j, irq, num_irqs_found = 0;
+
+	MALI_DEBUG_ASSERT_POINTER(mali_platform_device);
+	MALI_DEBUG_ASSERT(128 >= mali_platform_device->num_resources);
+
+	for (i = 0; i < mali_platform_device->num_resources; i++) {
+		if (IORESOURCE_IRQ & mali_platform_device->resource[i].flags) {
+			irq = mali_platform_device->resource[i].start;
+
+			for (j = 0; j < num_irqs_found; ++j) {
+				if (irq == irqs[j]) {
+					return MALI_TRUE;
+				}
+			}
+
+			irqs[num_irqs_found++] = irq;
+		}
+	}
+
+	return MALI_FALSE;
+}
+
+_mali_osk_errcode_t _mali_osk_gpu_secure_mode_init(void)
+{
+	_mali_osk_device_data data = { 0, };
+
+	if (_MALI_OSK_ERR_OK ==  _mali_osk_device_data_get(&data)) {
+		if ((NULL != data.secure_mode_init) && (NULL != data.secure_mode_deinit)
+		    && (NULL != data.gpu_reset_and_secure_mode_enable) && (NULL != data.gpu_reset_and_secure_mode_disable)) {
+			int err = data.secure_mode_init();
+			if (err) {
+				MALI_DEBUG_PRINT(1, ("Failed to init gpu secure mode.\n"));
+				return _MALI_OSK_ERR_FAULT;
+			}
+
+			mali_secure_mode_deinit = data.secure_mode_deinit;
+			mali_gpu_reset_and_secure_mode_enable = data.gpu_reset_and_secure_mode_enable;
+			mali_gpu_reset_and_secure_mode_disable = data.gpu_reset_and_secure_mode_disable;
+
+			mali_secure_mode_supported = MALI_TRUE;
+			mali_secure_mode_enabled = MALI_FALSE;
+			return _MALI_OSK_ERR_OK;
+		}
+	}
+	MALI_DEBUG_PRINT(3, ("GPU secure mode not supported.\n"));
+	return _MALI_OSK_ERR_UNSUPPORTED;
+
+}
+
+_mali_osk_errcode_t _mali_osk_gpu_secure_mode_deinit(void)
+{
+	if (NULL !=  mali_secure_mode_deinit) {
+		mali_secure_mode_deinit();
+		mali_secure_mode_enabled = MALI_FALSE;
+		mali_secure_mode_supported = MALI_FALSE;
+		return _MALI_OSK_ERR_OK;
+	}
+	MALI_DEBUG_PRINT(3, ("GPU secure mode not supported.\n"));
+	return _MALI_OSK_ERR_UNSUPPORTED;
+
+}
+
+
+_mali_osk_errcode_t _mali_osk_gpu_reset_and_secure_mode_enable(void)
+{
+	/* the mali executor lock must be held before enter this function. */
+
+	MALI_DEBUG_ASSERT(MALI_FALSE == mali_secure_mode_enabled);
+
+	if (NULL !=  mali_gpu_reset_and_secure_mode_enable) {
+		if (mali_gpu_reset_and_secure_mode_enable()) {
+			MALI_DEBUG_PRINT(1, ("Failed to reset GPU or enable gpu secure mode.\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+		mali_secure_mode_enabled = MALI_TRUE;
+		return _MALI_OSK_ERR_OK;
+	}
+	MALI_DEBUG_PRINT(1, ("GPU secure mode not supported.\n"));
+	return _MALI_OSK_ERR_UNSUPPORTED;
+}
+
+_mali_osk_errcode_t _mali_osk_gpu_reset_and_secure_mode_disable(void)
+{
+	/* the mali executor lock must be held before enter this function. */
+
+	MALI_DEBUG_ASSERT(MALI_TRUE == mali_secure_mode_enabled);
+
+	if (NULL != mali_gpu_reset_and_secure_mode_disable) {
+		if (mali_gpu_reset_and_secure_mode_disable()) {
+			MALI_DEBUG_PRINT(1, ("Failed to reset GPU or disable gpu secure mode.\n"));
+			return _MALI_OSK_ERR_FAULT;
+		}
+		mali_secure_mode_enabled = MALI_FALSE;
+
+		return _MALI_OSK_ERR_OK;
+
+	}
+	MALI_DEBUG_PRINT(1, ("GPU secure mode not supported.\n"));
+	return _MALI_OSK_ERR_UNSUPPORTED;
+
+}
+
+mali_bool _mali_osk_gpu_secure_mode_is_enabled(void)
+{
+	return mali_secure_mode_enabled;
+}
+
+mali_bool _mali_osk_gpu_secure_mode_is_supported(void)
+{
+	return mali_secure_mode_supported;
+}
+
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_math.c b/drivers/gpu/arm/mali400/linux/mali_osk_math.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_math.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_math.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2010, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_math.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include "mali_osk.h"
+#include <linux/bitops.h>
+
+u32 _mali_osk_clz(u32 input)
+{
+	return 32 - fls(input);
+}
+
+u32 _mali_osk_fls(u32 input)
+{
+	return fls(input);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_memory.c b/drivers/gpu/arm/mali400/linux/mali_osk_memory.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_memory.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_memory.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010-2011, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_memory.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include "mali_osk.h"
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+
+void inline *_mali_osk_calloc(u32 n, u32 size)
+{
+	return kcalloc(n, size, GFP_KERNEL);
+}
+
+void inline *_mali_osk_malloc(u32 size)
+{
+	return kmalloc(size, GFP_KERNEL);
+}
+
+void inline _mali_osk_free(void *ptr)
+{
+	kfree(ptr);
+}
+
+void inline *_mali_osk_valloc(u32 size)
+{
+	return vmalloc(size);
+}
+
+void inline _mali_osk_vfree(void *ptr)
+{
+	vfree(ptr);
+}
+
+void inline *_mali_osk_memcpy(void *dst, const void *src, u32  len)
+{
+	return memcpy(dst, src, len);
+}
+
+void inline *_mali_osk_memset(void *s, u32 c, u32 n)
+{
+	return memset(s, c, n);
+}
+
+mali_bool _mali_osk_mem_check_allocated(u32 max_allocated)
+{
+	/* No need to prevent an out-of-memory dialogue appearing on Linux,
+	 * so we always return MALI_TRUE.
+	 */
+	return MALI_TRUE;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_misc.c b/drivers/gpu/arm/mali400/linux/mali_osk_misc.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_misc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_misc.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_misc.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
+#include <asm/cacheflush.h>
+#include <linux/sched.h>
+#include <linux/seq_file.h>
+#include <linux/module.h>
+#include "mali_osk.h"
+
+#if !defined(CONFIG_MALI_QUIET)
+void _mali_osk_dbgmsg(const char *fmt, ...)
+{
+	va_list args;
+	va_start(args, fmt);
+	vprintk(fmt, args);
+	va_end(args);
+}
+#endif /* !defined(CONFIG_MALI_QUIET) */
+
+u32 _mali_osk_snprintf(char *buf, u32 size, const char *fmt, ...)
+{
+	int res;
+	va_list args;
+	va_start(args, fmt);
+
+	res = vscnprintf(buf, (size_t)size, fmt, args);
+
+	va_end(args);
+	return res;
+}
+
+void _mali_osk_abort(void)
+{
+	/* make a simple fault by dereferencing a NULL pointer */
+	dump_stack();
+	*(int *)0 = 0;
+}
+
+void _mali_osk_break(void)
+{
+	_mali_osk_abort();
+}
+
+u32 _mali_osk_get_pid(void)
+{
+	/* Thread group ID is the process ID on Linux */
+	return (u32)current->tgid;
+}
+
+char *_mali_osk_get_comm(void)
+{
+	return (char *)current->comm;
+}
+
+
+u32 _mali_osk_get_tid(void)
+{
+	/* pid is actually identifying the thread on Linux */
+	u32 tid = current->pid;
+
+	/* If the pid is 0 the core was idle.  Instead of returning 0 we return a special number
+	 * identifying which core we are on. */
+	if (0 == tid) {
+		tid = -(1 + raw_smp_processor_id());
+	}
+
+	return tid;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_notification.c b/drivers/gpu/arm/mali400/linux/mali_osk_notification.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_notification.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_notification.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_notification.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+
+/**
+ * Declaration of the notification queue object type
+ * Contains a linked list of notification pending delivery to user space.
+ * It also contains a wait queue of exclusive waiters blocked in the ioctl
+ * When a new notification is posted a single thread is resumed.
+ */
+struct _mali_osk_notification_queue_t_struct {
+	spinlock_t mutex; /**< Mutex protecting the list */
+	wait_queue_head_t receive_queue; /**< Threads waiting for new entries to the queue */
+	struct list_head head; /**< List of notifications waiting to be picked up */
+};
+
+typedef struct _mali_osk_notification_wrapper_t_struct {
+	struct list_head list;           /**< Internal linked list variable */
+	_mali_osk_notification_t data;   /**< Notification data */
+} _mali_osk_notification_wrapper_t;
+
+_mali_osk_notification_queue_t *_mali_osk_notification_queue_init(void)
+{
+	_mali_osk_notification_queue_t         *result;
+
+	result = (_mali_osk_notification_queue_t *)kmalloc(sizeof(_mali_osk_notification_queue_t), GFP_KERNEL);
+	if (NULL == result) return NULL;
+
+	spin_lock_init(&result->mutex);
+	init_waitqueue_head(&result->receive_queue);
+	INIT_LIST_HEAD(&result->head);
+
+	return result;
+}
+
+_mali_osk_notification_t *_mali_osk_notification_create(u32 type, u32 size)
+{
+	/* OPT Recycling of notification objects */
+	_mali_osk_notification_wrapper_t *notification;
+
+	notification = (_mali_osk_notification_wrapper_t *)kmalloc(sizeof(_mali_osk_notification_wrapper_t) + size,
+			GFP_KERNEL | __GFP_HIGH | __GFP_REPEAT);
+	if (NULL == notification) {
+		MALI_DEBUG_PRINT(1, ("Failed to create a notification object\n"));
+		return NULL;
+	}
+
+	/* Init the list */
+	INIT_LIST_HEAD(&notification->list);
+
+	if (0 != size) {
+		notification->data.result_buffer = ((u8 *)notification) + sizeof(_mali_osk_notification_wrapper_t);
+	} else {
+		notification->data.result_buffer = NULL;
+	}
+
+	/* set up the non-allocating fields */
+	notification->data.notification_type = type;
+	notification->data.result_buffer_size = size;
+
+	/* all ok */
+	return &(notification->data);
+}
+
+void _mali_osk_notification_delete(_mali_osk_notification_t *object)
+{
+	_mali_osk_notification_wrapper_t *notification;
+	MALI_DEBUG_ASSERT_POINTER(object);
+
+	notification = container_of(object, _mali_osk_notification_wrapper_t, data);
+
+	/* Free the container */
+	kfree(notification);
+}
+
+void _mali_osk_notification_queue_term(_mali_osk_notification_queue_t *queue)
+{
+	_mali_osk_notification_t *result;
+	MALI_DEBUG_ASSERT_POINTER(queue);
+
+	while (_MALI_OSK_ERR_OK == _mali_osk_notification_queue_dequeue(queue, &result)) {
+		_mali_osk_notification_delete(result);
+	}
+
+	/* not much to do, just free the memory */
+	kfree(queue);
+}
+void _mali_osk_notification_queue_send(_mali_osk_notification_queue_t *queue, _mali_osk_notification_t *object)
+{
+#if defined(MALI_UPPER_HALF_SCHEDULING)
+	unsigned long irq_flags;
+#endif
+
+	_mali_osk_notification_wrapper_t *notification;
+	MALI_DEBUG_ASSERT_POINTER(queue);
+	MALI_DEBUG_ASSERT_POINTER(object);
+
+	notification = container_of(object, _mali_osk_notification_wrapper_t, data);
+
+#if defined(MALI_UPPER_HALF_SCHEDULING)
+	spin_lock_irqsave(&queue->mutex, irq_flags);
+#else
+	spin_lock(&queue->mutex);
+#endif
+
+	list_add_tail(&notification->list, &queue->head);
+
+#if defined(MALI_UPPER_HALF_SCHEDULING)
+	spin_unlock_irqrestore(&queue->mutex, irq_flags);
+#else
+	spin_unlock(&queue->mutex);
+#endif
+
+	/* and wake up one possible exclusive waiter */
+	wake_up(&queue->receive_queue);
+}
+
+_mali_osk_errcode_t _mali_osk_notification_queue_dequeue(_mali_osk_notification_queue_t *queue, _mali_osk_notification_t **result)
+{
+#if defined(MALI_UPPER_HALF_SCHEDULING)
+	unsigned long irq_flags;
+#endif
+
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_ITEM_NOT_FOUND;
+	_mali_osk_notification_wrapper_t *wrapper_object;
+
+#if defined(MALI_UPPER_HALF_SCHEDULING)
+	spin_lock_irqsave(&queue->mutex, irq_flags);
+#else
+	spin_lock(&queue->mutex);
+#endif
+
+	if (!list_empty(&queue->head)) {
+		wrapper_object = list_entry(queue->head.next, _mali_osk_notification_wrapper_t, list);
+		*result = &(wrapper_object->data);
+		list_del_init(&wrapper_object->list);
+		ret = _MALI_OSK_ERR_OK;
+	}
+
+#if defined(MALI_UPPER_HALF_SCHEDULING)
+	spin_unlock_irqrestore(&queue->mutex, irq_flags);
+#else
+	spin_unlock(&queue->mutex);
+#endif
+
+	return ret;
+}
+
+_mali_osk_errcode_t _mali_osk_notification_queue_receive(_mali_osk_notification_queue_t *queue, _mali_osk_notification_t **result)
+{
+	/* check input */
+	MALI_DEBUG_ASSERT_POINTER(queue);
+	MALI_DEBUG_ASSERT_POINTER(result);
+
+	/* default result */
+	*result = NULL;
+
+	if (wait_event_interruptible(queue->receive_queue,
+				     _MALI_OSK_ERR_OK == _mali_osk_notification_queue_dequeue(queue, result))) {
+		return _MALI_OSK_ERR_RESTARTSYSCALL;
+	}
+
+	return _MALI_OSK_ERR_OK; /* all ok */
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_pm.c b/drivers/gpu/arm/mali400/linux/mali_osk_pm.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_pm.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_pm.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,83 @@
+/**
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_pm.c
+ * Implementation of the callback functions from common power management
+ */
+
+#include <linux/sched.h>
+
+#include "mali_kernel_linux.h"
+#ifdef CONFIG_PM_RUNTIME
+#include <linux/pm_runtime.h>
+#endif /* CONFIG_PM_RUNTIME */
+#include <linux/platform_device.h>
+#include <linux/version.h>
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+/* Can NOT run in atomic context */
+_mali_osk_errcode_t _mali_osk_pm_dev_ref_get_sync(void)
+{
+#ifdef CONFIG_PM_RUNTIME
+	int err;
+	MALI_DEBUG_ASSERT_POINTER(mali_platform_device);
+	err = pm_runtime_get_sync(&(mali_platform_device->dev));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37))
+	pm_runtime_mark_last_busy(&(mali_platform_device->dev));
+#endif
+	if (0 > err) {
+		MALI_PRINT_ERROR(("Mali OSK PM: pm_runtime_get_sync() returned error code %d\n", err));
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif
+	return _MALI_OSK_ERR_OK;
+}
+
+/* Can run in atomic context */
+_mali_osk_errcode_t _mali_osk_pm_dev_ref_get_async(void)
+{
+#ifdef CONFIG_PM_RUNTIME
+	int err;
+	MALI_DEBUG_ASSERT_POINTER(mali_platform_device);
+	err = pm_runtime_get(&(mali_platform_device->dev));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37))
+	pm_runtime_mark_last_busy(&(mali_platform_device->dev));
+#endif
+	if (0 > err && -EINPROGRESS != err) {
+		MALI_PRINT_ERROR(("Mali OSK PM: pm_runtime_get() returned error code %d\n", err));
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif
+	return _MALI_OSK_ERR_OK;
+}
+
+
+/* Can run in atomic context */
+void _mali_osk_pm_dev_ref_put(void)
+{
+#ifdef CONFIG_PM_RUNTIME
+	MALI_DEBUG_ASSERT_POINTER(mali_platform_device);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37))
+	pm_runtime_mark_last_busy(&(mali_platform_device->dev));
+	pm_runtime_put_autosuspend(&(mali_platform_device->dev));
+#else
+	pm_runtime_put(&(mali_platform_device->dev));
+#endif
+#endif
+}
+
+void _mali_osk_pm_dev_barrier(void)
+{
+#ifdef CONFIG_PM_RUNTIME
+	pm_runtime_barrier(&(mali_platform_device->dev));
+#endif
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_profiling.c b/drivers/gpu/arm/mali400/linux/mali_osk_profiling.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_profiling.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_profiling.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,1282 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/hrtimer.h>
+#include <linux/module.h>
+#include <linux/file.h>
+#include <linux/poll.h>
+#include <linux/anon_inodes.h>
+#include <linux/sched.h>
+
+#include <mali_profiling_gator_api.h>
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_ukk.h"
+#include "mali_uk_types.h"
+#include "mali_osk_profiling.h"
+#include "mali_linux_trace.h"
+#include "mali_gp.h"
+#include "mali_pp.h"
+#include "mali_l2_cache.h"
+#include "mali_user_settings_db.h"
+#include "mali_executor.h"
+#include "mali_memory_manager.h"
+
+#define MALI_PROFILING_STREAM_DATA_DEFAULT_SIZE 100
+#define MALI_PROFILING_STREAM_HOLD_TIME 1000000         /*1 ms */
+
+#define MALI_PROFILING_STREAM_BUFFER_SIZE       (1 << 12)
+#define MALI_PROFILING_STREAM_BUFFER_NUM        100
+
+/**
+ * Define the mali profiling stream struct.
+ */
+typedef struct mali_profiling_stream {
+	u8 data[MALI_PROFILING_STREAM_BUFFER_SIZE];
+	u32 used_size;
+	struct list_head list;
+} mali_profiling_stream;
+
+typedef struct mali_profiling_stream_list {
+	spinlock_t spin_lock;
+	struct list_head free_list;
+	struct list_head queue_list;
+} mali_profiling_stream_list;
+
+static const char mali_name[] = "4xx";
+static const char utgard_setup_version[] = "ANNOTATE_SETUP 1\n";
+
+static u32 profiling_sample_rate = 0;
+static u32 first_sw_counter_index = 0;
+
+static mali_bool l2_cache_counter_if_enabled = MALI_FALSE;
+static u32 num_counters_enabled = 0;
+static u32 mem_counters_enabled = 0;
+
+static _mali_osk_atomic_t stream_fd_if_used;
+
+static wait_queue_head_t stream_fd_wait_queue;
+static mali_profiling_counter *global_mali_profiling_counters = NULL;
+static u32 num_global_mali_profiling_counters = 0;
+
+static mali_profiling_stream_list *global_mali_stream_list = NULL;
+static mali_profiling_stream *mali_counter_stream = NULL;
+static mali_profiling_stream *mali_core_activity_stream = NULL;
+static u64 mali_core_activity_stream_dequeue_time = 0;
+static spinlock_t mali_activity_lock;
+static u32 mali_activity_cores_num =  0;
+static struct hrtimer profiling_sampling_timer;
+
+const char *_mali_mem_counter_descriptions[] = _MALI_MEM_COUTNER_DESCRIPTIONS;
+const char *_mali_special_counter_descriptions[] = _MALI_SPCIAL_COUNTER_DESCRIPTIONS;
+
+static u32 current_profiling_pid = 0;
+
+static void _mali_profiling_stream_list_destory(mali_profiling_stream_list *profiling_stream_list)
+{
+	mali_profiling_stream *profiling_stream, *tmp_profiling_stream;
+	MALI_DEBUG_ASSERT_POINTER(profiling_stream_list);
+
+	list_for_each_entry_safe(profiling_stream, tmp_profiling_stream, &profiling_stream_list->free_list, list) {
+		list_del(&profiling_stream->list);
+		kfree(profiling_stream);
+	}
+
+	list_for_each_entry_safe(profiling_stream, tmp_profiling_stream, &profiling_stream_list->queue_list, list) {
+		list_del(&profiling_stream->list);
+		kfree(profiling_stream);
+	}
+
+	kfree(profiling_stream_list);
+}
+
+static void _mali_profiling_global_stream_list_free(void)
+{
+	mali_profiling_stream *profiling_stream, *tmp_profiling_stream;
+	unsigned long irq_flags;
+
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+	spin_lock_irqsave(&global_mali_stream_list->spin_lock, irq_flags);
+	list_for_each_entry_safe(profiling_stream, tmp_profiling_stream, &global_mali_stream_list->queue_list, list) {
+		profiling_stream->used_size = 0;
+		list_move(&profiling_stream->list, &global_mali_stream_list->free_list);
+	}
+	spin_unlock_irqrestore(&global_mali_stream_list->spin_lock, irq_flags);
+}
+
+static _mali_osk_errcode_t _mali_profiling_global_stream_list_dequeue(struct list_head *stream_list, mali_profiling_stream **new_mali_profiling_stream)
+{
+	unsigned long irq_flags;
+	_mali_osk_errcode_t ret = _MALI_OSK_ERR_OK;
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+	MALI_DEBUG_ASSERT_POINTER(stream_list);
+
+	spin_lock_irqsave(&global_mali_stream_list->spin_lock, irq_flags);
+
+	if (!list_empty(stream_list)) {
+		*new_mali_profiling_stream = list_entry(stream_list->next, mali_profiling_stream, list);
+		list_del_init(&(*new_mali_profiling_stream)->list);
+	} else {
+		ret = _MALI_OSK_ERR_NOMEM;
+	}
+
+	spin_unlock_irqrestore(&global_mali_stream_list->spin_lock, irq_flags);
+
+	return ret;
+}
+
+static void _mali_profiling_global_stream_list_queue(struct list_head *stream_list, mali_profiling_stream *current_mali_profiling_stream)
+{
+	unsigned long irq_flags;
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+	MALI_DEBUG_ASSERT_POINTER(stream_list);
+
+	spin_lock_irqsave(&global_mali_stream_list->spin_lock, irq_flags);
+	list_add_tail(&current_mali_profiling_stream->list, stream_list);
+	spin_unlock_irqrestore(&global_mali_stream_list->spin_lock, irq_flags);
+}
+
+static mali_bool _mali_profiling_global_stream_queue_list_if_empty(void)
+{
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+	return list_empty(&global_mali_stream_list->queue_list);
+}
+
+static u32 _mali_profiling_global_stream_queue_list_next_size(void)
+{
+	unsigned long irq_flags;
+	u32 size = 0;
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+
+	spin_lock_irqsave(&global_mali_stream_list->spin_lock, irq_flags);
+	if (!list_empty(&global_mali_stream_list->queue_list)) {
+		mali_profiling_stream *next_mali_profiling_stream =
+			list_entry(global_mali_stream_list->queue_list.next, mali_profiling_stream, list);
+		size = next_mali_profiling_stream->used_size;
+	}
+	spin_unlock_irqrestore(&global_mali_stream_list->spin_lock, irq_flags);
+	return size;
+}
+
+/* The mali profiling stream file operations functions. */
+static ssize_t _mali_profiling_stream_read(
+	struct file *filp,
+	char __user *buffer,
+	size_t      size,
+	loff_t      *f_pos);
+
+static unsigned int  _mali_profiling_stream_poll(struct file *filp, poll_table *wait);
+
+static int  _mali_profiling_stream_release(struct inode *inode, struct file *filp);
+
+/* The timeline stream file operations structure. */
+static const struct file_operations mali_profiling_stream_fops = {
+	.release = _mali_profiling_stream_release,
+	.read    = _mali_profiling_stream_read,
+	.poll    = _mali_profiling_stream_poll,
+};
+
+static ssize_t _mali_profiling_stream_read(
+	struct file *filp,
+	char __user *buffer,
+	size_t      size,
+	loff_t      *f_pos)
+{
+	u32 copy_len = 0;
+	mali_profiling_stream *current_mali_profiling_stream;
+	u32 used_size;
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+
+	while (!_mali_profiling_global_stream_queue_list_if_empty()) {
+		used_size = _mali_profiling_global_stream_queue_list_next_size();
+		if (used_size <= ((u32)size - copy_len)) {
+			current_mali_profiling_stream = NULL;
+			_mali_profiling_global_stream_list_dequeue(&global_mali_stream_list->queue_list,
+					&current_mali_profiling_stream);
+			MALI_DEBUG_ASSERT_POINTER(current_mali_profiling_stream);
+			if (copy_to_user(&buffer[copy_len], current_mali_profiling_stream->data, current_mali_profiling_stream->used_size)) {
+				current_mali_profiling_stream->used_size = 0;
+				_mali_profiling_global_stream_list_queue(&global_mali_stream_list->free_list, current_mali_profiling_stream);
+				return -EFAULT;
+			}
+			copy_len += current_mali_profiling_stream->used_size;
+			current_mali_profiling_stream->used_size = 0;
+			_mali_profiling_global_stream_list_queue(&global_mali_stream_list->free_list, current_mali_profiling_stream);
+		} else {
+			break;
+		}
+	}
+	return (ssize_t)copy_len;
+}
+
+static unsigned int  _mali_profiling_stream_poll(struct file *filp, poll_table *wait)
+{
+	poll_wait(filp, &stream_fd_wait_queue, wait);
+	if (!_mali_profiling_global_stream_queue_list_if_empty())
+		return POLLIN;
+	return 0;
+}
+
+static int  _mali_profiling_stream_release(struct inode *inode, struct file *filp)
+{
+	_mali_osk_atomic_init(&stream_fd_if_used, 0);
+	return 0;
+}
+
+/* The funs for control packet and stream data.*/
+static void _mali_profiling_set_packet_size(unsigned char *const buf, const u32 size)
+{
+	u32 i;
+
+	for (i = 0; i < sizeof(size); ++i)
+		buf[i] = (size >> 8 * i) & 0xFF;
+}
+
+static u32 _mali_profiling_get_packet_size(unsigned char *const buf)
+{
+	u32 i;
+	u32 size = 0;
+	for (i = 0; i < sizeof(size); ++i)
+		size |= (u32)buf[i] << 8 * i;
+	return size;
+}
+
+static u32 _mali_profiling_read_packet_int(unsigned char *const buf, u32 *const pos, u32 const packet_size)
+{
+	u64 int_value = 0;
+	u8 shift = 0;
+	u8 byte_value = ~0;
+
+	while ((byte_value & 0x80) != 0) {
+		if ((*pos) >= packet_size)
+			return -1;
+		byte_value = buf[*pos];
+		*pos += 1;
+		int_value |= (u32)(byte_value & 0x7f) << shift;
+		shift += 7;
+	}
+
+	if (shift < 8 * sizeof(int_value) && (byte_value & 0x40) != 0) {
+		int_value |= -(1 << shift);
+	}
+
+	return int_value;
+}
+
+static u32 _mali_profiling_pack_int(u8 *const buf, u32 const buf_size, u32 const pos, s32 value)
+{
+	u32 add_bytes = 0;
+	int more = 1;
+	while (more) {
+		/* low order 7 bits of val */
+		char byte_value = value & 0x7f;
+		value >>= 7;
+
+		if ((value == 0 && (byte_value & 0x40) == 0) || (value == -1 && (byte_value & 0x40) != 0)) {
+			more = 0;
+		} else {
+			byte_value |= 0x80;
+		}
+
+		if ((pos + add_bytes) >= buf_size)
+			return 0;
+		buf[pos + add_bytes] = byte_value;
+		add_bytes++;
+	}
+
+	return add_bytes;
+}
+
+static int _mali_profiling_pack_long(uint8_t *const buf, u32 const buf_size, u32 const pos, s64 val)
+{
+	int add_bytes = 0;
+	int more = 1;
+	while (more) {
+		/* low order 7 bits of x */
+		char byte_value = val & 0x7f;
+		val >>= 7;
+
+		if ((val == 0 && (byte_value & 0x40) == 0) || (val == -1 && (byte_value & 0x40) != 0)) {
+			more = 0;
+		} else {
+			byte_value |= 0x80;
+		}
+
+		MALI_DEBUG_ASSERT((pos + add_bytes) < buf_size);
+		buf[pos + add_bytes] = byte_value;
+		add_bytes++;
+	}
+
+	return add_bytes;
+}
+
+static void _mali_profiling_stream_add_counter(mali_profiling_stream *profiling_stream, s64 current_time, u32 key, u32 counter_value)
+{
+	u32 add_size = STREAM_HEADER_SIZE;
+	MALI_DEBUG_ASSERT_POINTER(profiling_stream);
+	MALI_DEBUG_ASSERT((profiling_stream->used_size) < MALI_PROFILING_STREAM_BUFFER_SIZE);
+
+	profiling_stream->data[profiling_stream->used_size] = STREAM_HEADER_COUNTER_VALUE;
+
+	add_size += _mali_profiling_pack_long(profiling_stream->data, MALI_PROFILING_STREAM_BUFFER_SIZE,
+					      profiling_stream->used_size + add_size, current_time);
+	add_size += _mali_profiling_pack_int(profiling_stream->data, MALI_PROFILING_STREAM_BUFFER_SIZE,
+					     profiling_stream->used_size + add_size, (s32)0);
+	add_size += _mali_profiling_pack_int(profiling_stream->data, MALI_PROFILING_STREAM_BUFFER_SIZE,
+					     profiling_stream->used_size + add_size, (s32)key);
+	add_size += _mali_profiling_pack_int(profiling_stream->data, MALI_PROFILING_STREAM_BUFFER_SIZE,
+					     profiling_stream->used_size + add_size, (s32)counter_value);
+
+	_mali_profiling_set_packet_size(profiling_stream->data + profiling_stream->used_size + 1,
+					add_size - STREAM_HEADER_SIZE);
+
+	profiling_stream->used_size += add_size;
+}
+
+/* The callback function for sampling timer.*/
+static enum hrtimer_restart  _mali_profiling_sampling_counters(struct hrtimer *timer)
+{
+	u32 counter_index;
+	s64 current_time;
+	MALI_DEBUG_ASSERT_POINTER(global_mali_profiling_counters);
+	MALI_DEBUG_ASSERT_POINTER(global_mali_stream_list);
+
+	MALI_DEBUG_ASSERT(NULL == mali_counter_stream);
+	if (_MALI_OSK_ERR_OK == _mali_profiling_global_stream_list_dequeue(
+		    &global_mali_stream_list->free_list, &mali_counter_stream)) {
+
+		MALI_DEBUG_ASSERT_POINTER(mali_counter_stream);
+		MALI_DEBUG_ASSERT(0 == mali_counter_stream->used_size);
+
+		/* Capture l2 cache counter values if enabled */
+		if (MALI_TRUE == l2_cache_counter_if_enabled) {
+			int i, j = 0;
+			_mali_profiling_l2_counter_values l2_counters_values;
+			_mali_profiling_get_l2_counters(&l2_counters_values);
+
+			for (i  = COUNTER_L2_0_C0; i <= COUNTER_L2_2_C1; i++) {
+				if (0 == (j % 2))
+					_mali_osk_profiling_record_global_counters(i, l2_counters_values.cores[j / 2].value0);
+				else
+					_mali_osk_profiling_record_global_counters(i, l2_counters_values.cores[j / 2].value1);
+				j++;
+			}
+		}
+
+		current_time = (s64)_mali_osk_boot_time_get_ns();
+
+		/* Add all enabled counter values into stream */
+		for (counter_index = 0; counter_index < num_global_mali_profiling_counters; counter_index++) {
+			/* No need to sample these couners here. */
+			if (global_mali_profiling_counters[counter_index].enabled) {
+				if ((global_mali_profiling_counters[counter_index].counter_id >= FIRST_MEM_COUNTER &&
+				     global_mali_profiling_counters[counter_index].counter_id <= LAST_MEM_COUNTER)
+				    || (global_mali_profiling_counters[counter_index].counter_id == COUNTER_VP_ACTIVITY)
+				    || (global_mali_profiling_counters[counter_index].counter_id == COUNTER_FP_ACTIVITY)
+				    || (global_mali_profiling_counters[counter_index].counter_id == COUNTER_FILMSTRIP)) {
+
+					continue;
+				}
+
+				if (global_mali_profiling_counters[counter_index].counter_id >= COUNTER_L2_0_C0 &&
+				    global_mali_profiling_counters[counter_index].counter_id <= COUNTER_L2_2_C1) {
+
+					u32 prev_val = global_mali_profiling_counters[counter_index].prev_counter_value;
+
+					_mali_profiling_stream_add_counter(mali_counter_stream, current_time, global_mali_profiling_counters[counter_index].key,
+									   global_mali_profiling_counters[counter_index].current_counter_value - prev_val);
+
+					prev_val = global_mali_profiling_counters[counter_index].current_counter_value;
+
+					global_mali_profiling_counters[counter_index].prev_counter_value = prev_val;
+				} else {
+
+					if (global_mali_profiling_counters[counter_index].counter_id == COUNTER_TOTAL_ALLOC_PAGES) {
+						u32 total_alloc_mem = _mali_ukk_report_memory_usage();
+						global_mali_profiling_counters[counter_index].current_counter_value = total_alloc_mem / _MALI_OSK_MALI_PAGE_SIZE;
+					}
+					_mali_profiling_stream_add_counter(mali_counter_stream, current_time, global_mali_profiling_counters[counter_index].key,
+									   global_mali_profiling_counters[counter_index].current_counter_value);
+					if (global_mali_profiling_counters[counter_index].counter_id < FIRST_SPECIAL_COUNTER)
+						global_mali_profiling_counters[counter_index].current_counter_value = 0;
+				}
+			}
+		}
+		_mali_profiling_global_stream_list_queue(&global_mali_stream_list->queue_list, mali_counter_stream);
+		mali_counter_stream = NULL;
+	} else {
+		MALI_DEBUG_PRINT(1, ("Not enough mali profiling stream buffer!\n"));
+	}
+
+	wake_up_interruptible(&stream_fd_wait_queue);
+
+	/*Enable the sampling timer again*/
+	if (0 != num_counters_enabled && 0 != profiling_sample_rate) {
+		hrtimer_forward_now(&profiling_sampling_timer, ns_to_ktime(profiling_sample_rate));
+		return HRTIMER_RESTART;
+	}
+	return HRTIMER_NORESTART;
+}
+
+static void _mali_profiling_sampling_core_activity_switch(int counter_id, int core, u32 activity, u32 pid)
+{
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&mali_activity_lock, irq_flags);
+	if (activity == 0)
+		mali_activity_cores_num--;
+	else
+		mali_activity_cores_num++;
+	spin_unlock_irqrestore(&mali_activity_lock, irq_flags);
+
+	if (NULL != global_mali_profiling_counters) {
+		int i ;
+		for (i = 0; i < num_global_mali_profiling_counters; i++) {
+			if (counter_id == global_mali_profiling_counters[i].counter_id && global_mali_profiling_counters[i].enabled) {
+				u64 current_time = _mali_osk_boot_time_get_ns();
+				u32 add_size = STREAM_HEADER_SIZE;
+
+				if (NULL != mali_core_activity_stream) {
+					if ((mali_core_activity_stream_dequeue_time +  MALI_PROFILING_STREAM_HOLD_TIME < current_time) ||
+					    (MALI_PROFILING_STREAM_DATA_DEFAULT_SIZE > MALI_PROFILING_STREAM_BUFFER_SIZE
+					     - mali_core_activity_stream->used_size)) {
+						_mali_profiling_global_stream_list_queue(&global_mali_stream_list->queue_list, mali_core_activity_stream);
+						mali_core_activity_stream = NULL;
+						wake_up_interruptible(&stream_fd_wait_queue);
+					}
+				}
+
+				if (NULL == mali_core_activity_stream) {
+					if (_MALI_OSK_ERR_OK == _mali_profiling_global_stream_list_dequeue(
+						    &global_mali_stream_list->free_list, &mali_core_activity_stream)) {
+						mali_core_activity_stream_dequeue_time = current_time;
+					} else {
+						MALI_DEBUG_PRINT(1, ("Not enough mali profiling stream buffer!\n"));
+						wake_up_interruptible(&stream_fd_wait_queue);
+						break;
+					}
+
+				}
+
+				mali_core_activity_stream->data[mali_core_activity_stream->used_size] = STREAM_HEADER_CORE_ACTIVITY;
+
+				add_size += _mali_profiling_pack_long(mali_core_activity_stream->data,
+								      MALI_PROFILING_STREAM_BUFFER_SIZE, mali_core_activity_stream->used_size + add_size, (s64)current_time);
+				add_size += _mali_profiling_pack_int(mali_core_activity_stream->data,
+								     MALI_PROFILING_STREAM_BUFFER_SIZE, mali_core_activity_stream->used_size + add_size, core);
+				add_size += _mali_profiling_pack_int(mali_core_activity_stream->data,
+								     MALI_PROFILING_STREAM_BUFFER_SIZE, mali_core_activity_stream->used_size + add_size, (s32)global_mali_profiling_counters[i].key);
+				add_size += _mali_profiling_pack_int(mali_core_activity_stream->data,
+								     MALI_PROFILING_STREAM_BUFFER_SIZE, mali_core_activity_stream->used_size + add_size, activity);
+				add_size += _mali_profiling_pack_int(mali_core_activity_stream->data,
+								     MALI_PROFILING_STREAM_BUFFER_SIZE, mali_core_activity_stream->used_size + add_size, pid);
+
+				_mali_profiling_set_packet_size(mali_core_activity_stream->data + mali_core_activity_stream->used_size + 1,
+								add_size - STREAM_HEADER_SIZE);
+
+				mali_core_activity_stream->used_size += add_size;
+
+				if (0 == mali_activity_cores_num) {
+					_mali_profiling_global_stream_list_queue(&global_mali_stream_list->queue_list, mali_core_activity_stream);
+					mali_core_activity_stream = NULL;
+					wake_up_interruptible(&stream_fd_wait_queue);
+				}
+
+				break;
+			}
+		}
+	}
+}
+
+static mali_bool _mali_profiling_global_counters_init(void)
+{
+	int core_id, counter_index, counter_number, counter_id;
+	u32 num_l2_cache_cores;
+	u32 num_pp_cores;
+	u32 num_gp_cores = 1;
+
+	MALI_DEBUG_ASSERT(NULL == global_mali_profiling_counters);
+	num_pp_cores = mali_pp_get_glob_num_pp_cores();
+	num_l2_cache_cores =    mali_l2_cache_core_get_glob_num_l2_cores();
+
+	num_global_mali_profiling_counters = 3 * (num_gp_cores + num_pp_cores) + 2 * num_l2_cache_cores
+					     + MALI_PROFILING_SW_COUNTERS_NUM
+					     + MALI_PROFILING_SPECIAL_COUNTERS_NUM
+					     + MALI_PROFILING_MEM_COUNTERS_NUM;
+	global_mali_profiling_counters = _mali_osk_calloc(num_global_mali_profiling_counters, sizeof(mali_profiling_counter));
+
+	if (NULL == global_mali_profiling_counters)
+		return MALI_FALSE;
+
+	counter_index = 0;
+	/*Vertex processor counters */
+	for (core_id = 0; core_id < num_gp_cores; core_id ++) {
+		global_mali_profiling_counters[counter_index].counter_id = ACTIVITY_VP_0 + core_id;
+		_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+				   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_VP_%d_active", mali_name, core_id);
+
+		for (counter_number = 0; counter_number < 2; counter_number++) {
+			counter_index++;
+			global_mali_profiling_counters[counter_index].counter_id = COUNTER_VP_0_C0 + (2 * core_id) + counter_number;
+			_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+					   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_VP_%d_cnt%d", mali_name, core_id, counter_number);
+		}
+	}
+
+	/* Fragment processors' counters */
+	for (core_id = 0; core_id < num_pp_cores; core_id++) {
+		counter_index++;
+		global_mali_profiling_counters[counter_index].counter_id = ACTIVITY_FP_0 + core_id;
+		_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+				   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_FP_%d_active", mali_name, core_id);
+
+		for (counter_number = 0; counter_number < 2; counter_number++) {
+			counter_index++;
+			global_mali_profiling_counters[counter_index].counter_id = COUNTER_FP_0_C0 + (2 * core_id) + counter_number;
+			_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+					   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_FP_%d_cnt%d", mali_name, core_id, counter_number);
+		}
+	}
+
+	/* L2 Cache counters */
+	for (core_id = 0; core_id < num_l2_cache_cores; core_id++) {
+		for (counter_number = 0; counter_number < 2; counter_number++) {
+			counter_index++;
+			global_mali_profiling_counters[counter_index].counter_id = COUNTER_L2_0_C0 + (2 * core_id) + counter_number;
+			_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+					   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_L2_%d_cnt%d", mali_name, core_id, counter_number);
+		}
+	}
+
+	/* Now set up the software counter entries */
+	for (counter_id = FIRST_SW_COUNTER; counter_id <= LAST_SW_COUNTER; counter_id++) {
+		counter_index++;
+
+		if (0 == first_sw_counter_index)
+			first_sw_counter_index = counter_index;
+
+		global_mali_profiling_counters[counter_index].counter_id = counter_id;
+		_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+				   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_SW_%d", mali_name, counter_id - FIRST_SW_COUNTER);
+	}
+
+	/* Now set up the special counter entries */
+	for (counter_id = FIRST_SPECIAL_COUNTER; counter_id <= LAST_SPECIAL_COUNTER; counter_id++) {
+
+		counter_index++;
+		_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+				   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_%s",
+				   mali_name, _mali_special_counter_descriptions[counter_id - FIRST_SPECIAL_COUNTER]);
+
+		global_mali_profiling_counters[counter_index].counter_id = counter_id;
+	}
+
+	/* Now set up the mem counter entries*/
+	for (counter_id = FIRST_MEM_COUNTER; counter_id <= LAST_MEM_COUNTER; counter_id++) {
+
+		counter_index++;
+		_mali_osk_snprintf(global_mali_profiling_counters[counter_index].counter_name,
+				   sizeof(global_mali_profiling_counters[counter_index].counter_name), "ARM_Mali-%s_%s",
+				   mali_name, _mali_mem_counter_descriptions[counter_id - FIRST_MEM_COUNTER]);
+
+		global_mali_profiling_counters[counter_index].counter_id = counter_id;
+	}
+
+	MALI_DEBUG_ASSERT((counter_index + 1) == num_global_mali_profiling_counters);
+
+	return MALI_TRUE;
+}
+
+void _mali_profiling_notification_mem_counter(struct mali_session_data *session, u32 counter_id, u32 key, int enable)
+{
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (NULL != session) {
+		_mali_osk_notification_t *notification;
+		_mali_osk_notification_queue_t *queue;
+
+		queue = session->ioctl_queue;
+		MALI_DEBUG_ASSERT(NULL != queue);
+
+		notification = _mali_osk_notification_create(_MALI_NOTIFICATION_ANNOTATE_PROFILING_MEM_COUNTER,
+				sizeof(_mali_uk_annotate_profiling_mem_counter_s));
+
+		if (NULL != notification) {
+			_mali_uk_annotate_profiling_mem_counter_s *data = notification->result_buffer;
+			data->counter_id = counter_id;
+			data->key = key;
+			data->enable = enable;
+
+			_mali_osk_notification_queue_send(queue, notification);
+		} else {
+			MALI_PRINT_ERROR(("Failed to create notification object!\n"));
+		}
+	} else {
+		MALI_PRINT_ERROR(("Failed to find the right session!\n"));
+	}
+}
+
+void _mali_profiling_notification_enable(struct mali_session_data *session, u32 sampling_rate, int enable)
+{
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (NULL != session) {
+		_mali_osk_notification_t *notification;
+		_mali_osk_notification_queue_t *queue;
+
+		queue = session->ioctl_queue;
+		MALI_DEBUG_ASSERT(NULL != queue);
+
+		notification = _mali_osk_notification_create(_MALI_NOTIFICATION_ANNOTATE_PROFILING_ENABLE,
+				sizeof(_mali_uk_annotate_profiling_enable_s));
+
+		if (NULL != notification) {
+			_mali_uk_annotate_profiling_enable_s *data = notification->result_buffer;
+			data->sampling_rate = sampling_rate;
+			data->enable = enable;
+
+			_mali_osk_notification_queue_send(queue, notification);
+		} else {
+			MALI_PRINT_ERROR(("Failed to create notification object!\n"));
+		}
+	} else {
+		MALI_PRINT_ERROR(("Failed to find the right session!\n"));
+	}
+}
+
+
+_mali_osk_errcode_t _mali_osk_profiling_init(mali_bool auto_start)
+{
+	int i;
+	mali_profiling_stream *new_mali_profiling_stream = NULL;
+	mali_profiling_stream_list *new_mali_profiling_stream_list = NULL;
+	if (MALI_TRUE == auto_start) {
+		mali_set_user_setting(_MALI_UK_USER_SETTING_SW_EVENTS_ENABLE, MALI_TRUE);
+	}
+
+	/*Init the global_mali_stream_list*/
+	MALI_DEBUG_ASSERT(NULL == global_mali_stream_list);
+	new_mali_profiling_stream_list = (mali_profiling_stream_list *)kmalloc(sizeof(mali_profiling_stream_list), GFP_KERNEL);
+
+	if (NULL == new_mali_profiling_stream_list) {
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	spin_lock_init(&new_mali_profiling_stream_list->spin_lock);
+	INIT_LIST_HEAD(&new_mali_profiling_stream_list->free_list);
+	INIT_LIST_HEAD(&new_mali_profiling_stream_list->queue_list);
+
+	spin_lock_init(&mali_activity_lock);
+	mali_activity_cores_num =  0;
+
+	for (i = 0; i < MALI_PROFILING_STREAM_BUFFER_NUM; i++) {
+		new_mali_profiling_stream = (mali_profiling_stream *)kmalloc(sizeof(mali_profiling_stream), GFP_KERNEL);
+		if (NULL == new_mali_profiling_stream) {
+			_mali_profiling_stream_list_destory(new_mali_profiling_stream_list);
+			return _MALI_OSK_ERR_NOMEM;
+		}
+
+		INIT_LIST_HEAD(&new_mali_profiling_stream->list);
+		new_mali_profiling_stream->used_size = 0;
+		list_add_tail(&new_mali_profiling_stream->list, &new_mali_profiling_stream_list->free_list);
+
+	}
+
+	_mali_osk_atomic_init(&stream_fd_if_used, 0);
+	init_waitqueue_head(&stream_fd_wait_queue);
+
+	hrtimer_init(&profiling_sampling_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+
+	profiling_sampling_timer.function = _mali_profiling_sampling_counters;
+
+	global_mali_stream_list = new_mali_profiling_stream_list;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void _mali_osk_profiling_term(void)
+{
+	if (0 != profiling_sample_rate) {
+		hrtimer_cancel(&profiling_sampling_timer);
+		profiling_sample_rate = 0;
+	}
+	_mali_osk_atomic_term(&stream_fd_if_used);
+
+	if (NULL != global_mali_profiling_counters) {
+		_mali_osk_free(global_mali_profiling_counters);
+		global_mali_profiling_counters = NULL;
+		num_global_mali_profiling_counters = 0;
+	}
+
+	if (NULL != global_mali_stream_list) {
+		_mali_profiling_stream_list_destory(global_mali_stream_list);
+		global_mali_stream_list = NULL;
+	}
+
+}
+
+void _mali_osk_profiling_stop_sampling(u32 pid)
+{
+	if (pid == current_profiling_pid) {
+
+		int i;
+		/* Reset all counter states when closing connection.*/
+		for (i = 0; i < num_global_mali_profiling_counters; ++i) {
+			_mali_profiling_set_event(global_mali_profiling_counters[i].counter_id, MALI_HW_CORE_NO_COUNTER);
+			global_mali_profiling_counters[i].enabled = 0;
+			global_mali_profiling_counters[i].prev_counter_value = 0;
+			global_mali_profiling_counters[i].current_counter_value = 0;
+		}
+		l2_cache_counter_if_enabled = MALI_FALSE;
+		num_counters_enabled = 0;
+		mem_counters_enabled = 0;
+		_mali_profiling_control(FBDUMP_CONTROL_ENABLE, 0);
+		_mali_profiling_control(SW_COUNTER_ENABLE, 0);
+		/* Delete sampling timer when closing connection. */
+		if (0 != profiling_sample_rate) {
+			hrtimer_cancel(&profiling_sampling_timer);
+			profiling_sample_rate = 0;
+		}
+		current_profiling_pid = 0;
+	}
+}
+
+void    _mali_osk_profiling_add_event(u32 event_id, u32 data0, u32 data1, u32 data2, u32 data3, u32 data4)
+{
+	/*Record the freq & volt to global_mali_profiling_counters here. */
+	if (0 != profiling_sample_rate) {
+		u32 channel;
+		u32 state;
+		channel = (event_id >> 16) & 0xFF;
+		state = ((event_id >> 24) & 0xF) << 24;
+
+		switch (state) {
+		case MALI_PROFILING_EVENT_TYPE_SINGLE:
+			if ((MALI_PROFILING_EVENT_CHANNEL_GPU >> 16) == channel) {
+				u32 reason = (event_id & 0xFFFF);
+				if (MALI_PROFILING_EVENT_REASON_SINGLE_GPU_FREQ_VOLT_CHANGE == reason) {
+					_mali_osk_profiling_record_global_counters(COUNTER_FREQUENCY, data0);
+					_mali_osk_profiling_record_global_counters(COUNTER_VOLTAGE, data1);
+				}
+			}
+			break;
+		case MALI_PROFILING_EVENT_TYPE_START:
+			if ((MALI_PROFILING_EVENT_CHANNEL_GP0 >> 16) == channel) {
+				_mali_profiling_sampling_core_activity_switch(COUNTER_VP_ACTIVITY, 0, 1, data1);
+			} else if (channel >= (MALI_PROFILING_EVENT_CHANNEL_PP0 >> 16) &&
+				   (MALI_PROFILING_EVENT_CHANNEL_PP7 >> 16) >= channel) {
+				u32 core_id = channel - (MALI_PROFILING_EVENT_CHANNEL_PP0 >> 16);
+				_mali_profiling_sampling_core_activity_switch(COUNTER_FP_ACTIVITY, core_id, 1, data1);
+			}
+			break;
+		case MALI_PROFILING_EVENT_TYPE_STOP:
+			if ((MALI_PROFILING_EVENT_CHANNEL_GP0 >> 16) == channel) {
+				_mali_profiling_sampling_core_activity_switch(COUNTER_VP_ACTIVITY, 0, 0, 0);
+			} else if (channel >= (MALI_PROFILING_EVENT_CHANNEL_PP0 >> 16) &&
+				   (MALI_PROFILING_EVENT_CHANNEL_PP7 >> 16) >= channel) {
+				u32 core_id = channel - (MALI_PROFILING_EVENT_CHANNEL_PP0 >> 16);
+				_mali_profiling_sampling_core_activity_switch(COUNTER_FP_ACTIVITY, core_id, 0, 0);
+			}
+			break;
+		default:
+			break;
+		}
+	}
+	trace_mali_timeline_event(event_id, data0, data1, data2, data3, data4);
+}
+
+void _mali_osk_profiling_report_sw_counters(u32 *counters)
+{
+	trace_mali_sw_counters(_mali_osk_get_pid(), _mali_osk_get_tid(), NULL, counters);
+}
+
+void _mali_osk_profiling_record_global_counters(int counter_id, u32 value)
+{
+	if (NULL != global_mali_profiling_counters) {
+		int i ;
+		for (i = 0; i < num_global_mali_profiling_counters; i++) {
+			if (counter_id == global_mali_profiling_counters[i].counter_id && global_mali_profiling_counters[i].enabled) {
+				global_mali_profiling_counters[i].current_counter_value = value;
+				break;
+			}
+		}
+	}
+}
+
+_mali_osk_errcode_t _mali_ukk_profiling_add_event(_mali_uk_profiling_add_event_s *args)
+{
+	/* Always add process and thread identificator in the first two data elements for events from user space */
+	_mali_osk_profiling_add_event(args->event_id, _mali_osk_get_pid(), _mali_osk_get_tid(), args->data[2], args->data[3], args->data[4]);
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_sw_counters_report(_mali_uk_sw_counters_report_s *args)
+{
+	u32 *counters = (u32 *)(uintptr_t)args->counters;
+
+	_mali_osk_profiling_report_sw_counters(counters);
+
+	if (NULL != global_mali_profiling_counters) {
+		int i;
+		for (i = 0; i < MALI_PROFILING_SW_COUNTERS_NUM; i ++) {
+			if (global_mali_profiling_counters[first_sw_counter_index + i].enabled) {
+				global_mali_profiling_counters[first_sw_counter_index + i].current_counter_value = *(counters + i);
+			}
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_profiling_stream_fd_get(_mali_uk_profiling_stream_fd_get_s *args)
+{
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (1 == _mali_osk_atomic_inc_return(&stream_fd_if_used)) {
+
+		s32 fd = anon_inode_getfd("[mali_profiling_stream]", &mali_profiling_stream_fops,
+					  session,
+					  O_RDONLY | O_CLOEXEC);
+
+		args->stream_fd = fd;
+		if (0 > fd) {
+			_mali_osk_atomic_dec(&stream_fd_if_used);
+			return _MALI_OSK_ERR_FAULT;
+		}
+		args->stream_fd = fd;
+	} else {
+		_mali_osk_atomic_dec(&stream_fd_if_used);
+		args->stream_fd = -1;
+		return _MALI_OSK_ERR_BUSY;
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_ukk_profiling_control_set(_mali_uk_profiling_control_set_s *args)
+{
+	u32 control_packet_size;
+	u32 output_buffer_size;
+
+	struct  mali_session_data *session = (struct mali_session_data *)(uintptr_t)args->ctx;
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (NULL == global_mali_profiling_counters && MALI_FALSE == _mali_profiling_global_counters_init()) {
+		MALI_PRINT_ERROR(("Failed to create global_mali_profiling_counters.\n"));
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	control_packet_size = args->control_packet_size;
+	output_buffer_size = args->response_packet_size;
+
+	if (0 != control_packet_size) {
+		u8 control_type;
+		u8 *control_packet_data;
+		u8 *response_packet_data;
+		u32 version_length = sizeof(utgard_setup_version) - 1;
+
+		control_packet_data = (u8 *)(uintptr_t)args->control_packet_data;
+		MALI_DEBUG_ASSERT_POINTER(control_packet_data);
+		response_packet_data = (u8 *)(uintptr_t)args->response_packet_data;
+		MALI_DEBUG_ASSERT_POINTER(response_packet_data);
+
+		/*Decide if need to ignore Utgard setup version.*/
+		if (control_packet_size >= version_length) {
+			if (0 == memcmp(control_packet_data, utgard_setup_version, version_length)) {
+				if (control_packet_size == version_length) {
+					args->response_packet_size = 0;
+					return _MALI_OSK_ERR_OK;
+				} else {
+					control_packet_data += version_length;
+					control_packet_size -= version_length;
+				}
+			}
+		}
+
+		current_profiling_pid = _mali_osk_get_pid();
+
+		control_type = control_packet_data[0];
+		switch (control_type) {
+		case PACKET_HEADER_COUNTERS_REQUEST: {
+			int i;
+
+			if (PACKET_HEADER_SIZE > control_packet_size ||
+			    control_packet_size !=  _mali_profiling_get_packet_size(control_packet_data + 1)) {
+				MALI_PRINT_ERROR(("Wrong control packet  size, type 0x%x,size 0x%x.\n", control_packet_data[0], control_packet_size));
+				return _MALI_OSK_ERR_FAULT;
+			}
+
+			/* Send supported counters */
+			if (PACKET_HEADER_SIZE > output_buffer_size)
+				return _MALI_OSK_ERR_FAULT;
+
+			*response_packet_data = PACKET_HEADER_COUNTERS_ACK;
+			args->response_packet_size = PACKET_HEADER_SIZE;
+
+			for (i = 0; i < num_global_mali_profiling_counters; ++i) {
+				u32 name_size = strlen(global_mali_profiling_counters[i].counter_name);
+
+				if ((args->response_packet_size + name_size + 1) > output_buffer_size) {
+					MALI_PRINT_ERROR(("Response packet data is too large..\n"));
+					return _MALI_OSK_ERR_FAULT;
+				}
+
+				memcpy(response_packet_data + args->response_packet_size,
+				       global_mali_profiling_counters[i].counter_name, name_size + 1);
+
+				args->response_packet_size += (name_size + 1);
+
+				if (global_mali_profiling_counters[i].counter_id == COUNTER_VP_ACTIVITY) {
+					args->response_packet_size += _mali_profiling_pack_int(response_packet_data,
+								      output_buffer_size, args->response_packet_size, (s32)1);
+				} else if (global_mali_profiling_counters[i].counter_id == COUNTER_FP_ACTIVITY) {
+					args->response_packet_size += _mali_profiling_pack_int(response_packet_data,
+								      output_buffer_size, args->response_packet_size, (s32)mali_pp_get_glob_num_pp_cores());
+				} else {
+					args->response_packet_size += _mali_profiling_pack_int(response_packet_data,
+								      output_buffer_size, args->response_packet_size, (s32) - 1);
+				}
+			}
+
+			_mali_profiling_set_packet_size(response_packet_data + 1, args->response_packet_size);
+			break;
+		}
+
+		case PACKET_HEADER_COUNTERS_ENABLE: {
+			int i;
+			u32 request_pos = PACKET_HEADER_SIZE;
+			mali_bool sw_counter_if_enabled = MALI_FALSE;
+
+			if (PACKET_HEADER_SIZE > control_packet_size ||
+			    control_packet_size !=  _mali_profiling_get_packet_size(control_packet_data + 1)) {
+				MALI_PRINT_ERROR(("Wrong control packet  size , type 0x%x,size 0x%x.\n", control_packet_data[0], control_packet_size));
+				return _MALI_OSK_ERR_FAULT;
+			}
+
+			/* Init all counter states before enable requested counters.*/
+			for (i = 0; i < num_global_mali_profiling_counters; ++i) {
+				_mali_profiling_set_event(global_mali_profiling_counters[i].counter_id, MALI_HW_CORE_NO_COUNTER);
+				global_mali_profiling_counters[i].enabled = 0;
+				global_mali_profiling_counters[i].prev_counter_value = 0;
+				global_mali_profiling_counters[i].current_counter_value = 0;
+
+				if (global_mali_profiling_counters[i].counter_id >= FIRST_MEM_COUNTER &&
+				    global_mali_profiling_counters[i].counter_id <= LAST_MEM_COUNTER) {
+					_mali_profiling_notification_mem_counter(session, global_mali_profiling_counters[i].counter_id, 0, 0);
+				}
+			}
+
+			l2_cache_counter_if_enabled = MALI_FALSE;
+			num_counters_enabled = 0;
+			mem_counters_enabled = 0;
+			_mali_profiling_control(FBDUMP_CONTROL_ENABLE, 0);
+			_mali_profiling_control(SW_COUNTER_ENABLE, 0);
+			_mali_profiling_notification_enable(session, 0, 0);
+
+			/* Enable requested counters */
+			while (request_pos < control_packet_size) {
+				u32 begin = request_pos;
+				u32 event;
+				u32 key;
+
+				/* Check the counter name which should be ended with null */
+				while (request_pos < control_packet_size && control_packet_data[request_pos] != '\0') {
+					++request_pos;
+				}
+
+				if (request_pos >= control_packet_size)
+					return _MALI_OSK_ERR_FAULT;
+
+				++request_pos;
+				event = _mali_profiling_read_packet_int(control_packet_data, &request_pos, control_packet_size);
+				key = _mali_profiling_read_packet_int(control_packet_data, &request_pos, control_packet_size);
+
+				for (i = 0; i < num_global_mali_profiling_counters; ++i) {
+					u32 name_size = strlen((char *)(control_packet_data + begin));
+
+					if (strncmp(global_mali_profiling_counters[i].counter_name, (char *)(control_packet_data + begin), name_size) == 0) {
+						if (!sw_counter_if_enabled && (FIRST_SW_COUNTER <= global_mali_profiling_counters[i].counter_id
+									       && global_mali_profiling_counters[i].counter_id <= LAST_SW_COUNTER)) {
+							sw_counter_if_enabled = MALI_TRUE;
+							_mali_profiling_control(SW_COUNTER_ENABLE, 1);
+						}
+
+						if (COUNTER_FILMSTRIP == global_mali_profiling_counters[i].counter_id) {
+							_mali_profiling_control(FBDUMP_CONTROL_ENABLE, 1);
+							_mali_profiling_control(FBDUMP_CONTROL_RATE, event & 0xff);
+							_mali_profiling_control(FBDUMP_CONTROL_RESIZE_FACTOR, (event >> 8) & 0xff);
+						}
+
+						if (global_mali_profiling_counters[i].counter_id >= FIRST_MEM_COUNTER &&
+						    global_mali_profiling_counters[i].counter_id <= LAST_MEM_COUNTER) {
+							_mali_profiling_notification_mem_counter(session, global_mali_profiling_counters[i].counter_id,
+									key, 1);
+							mem_counters_enabled++;
+						}
+
+						global_mali_profiling_counters[i].counter_event = event;
+						global_mali_profiling_counters[i].key = key;
+						global_mali_profiling_counters[i].enabled = 1;
+
+						_mali_profiling_set_event(global_mali_profiling_counters[i].counter_id,
+									  global_mali_profiling_counters[i].counter_event);
+						num_counters_enabled++;
+						break;
+					}
+				}
+
+				if (i == num_global_mali_profiling_counters) {
+					MALI_PRINT_ERROR(("Counter name does not match for type %u.\n", control_type));
+					return _MALI_OSK_ERR_FAULT;
+				}
+			}
+
+			if (PACKET_HEADER_SIZE <= output_buffer_size) {
+				*response_packet_data = PACKET_HEADER_ACK;
+				_mali_profiling_set_packet_size(response_packet_data + 1, PACKET_HEADER_SIZE);
+				args->response_packet_size = PACKET_HEADER_SIZE;
+			} else {
+				return _MALI_OSK_ERR_FAULT;
+			}
+
+			break;
+		}
+
+		case PACKET_HEADER_START_CAPTURE_VALUE: {
+			u32 live_rate;
+			u32 request_pos = PACKET_HEADER_SIZE;
+
+			if (PACKET_HEADER_SIZE > control_packet_size ||
+			    control_packet_size !=  _mali_profiling_get_packet_size(control_packet_data + 1)) {
+				MALI_PRINT_ERROR(("Wrong control packet  size , type 0x%x,size 0x%x.\n", control_packet_data[0], control_packet_size));
+				return _MALI_OSK_ERR_FAULT;
+			}
+
+			/* Read samping rate in nanoseconds and live rate, start capture.*/
+			profiling_sample_rate =  _mali_profiling_read_packet_int(control_packet_data,
+						 &request_pos, control_packet_size);
+
+			live_rate = _mali_profiling_read_packet_int(control_packet_data, &request_pos, control_packet_size);
+
+			if (PACKET_HEADER_SIZE <= output_buffer_size) {
+				*response_packet_data = PACKET_HEADER_ACK;
+				_mali_profiling_set_packet_size(response_packet_data + 1, PACKET_HEADER_SIZE);
+				args->response_packet_size = PACKET_HEADER_SIZE;
+			} else {
+				return _MALI_OSK_ERR_FAULT;
+			}
+
+			if (0 != num_counters_enabled && 0 != profiling_sample_rate) {
+				_mali_profiling_global_stream_list_free();
+				if (mem_counters_enabled > 0) {
+					_mali_profiling_notification_enable(session, profiling_sample_rate, 1);
+				}
+				hrtimer_start(&profiling_sampling_timer,
+					      ktime_set(profiling_sample_rate / 1000000000, profiling_sample_rate % 1000000000),
+					      HRTIMER_MODE_REL_PINNED);
+			}
+
+			break;
+		}
+		default:
+			MALI_PRINT_ERROR(("Unsupported  profiling packet header type %u.\n", control_type));
+			args->response_packet_size  = 0;
+			return _MALI_OSK_ERR_FAULT;
+		}
+	} else {
+		_mali_osk_profiling_stop_sampling(current_profiling_pid);
+		_mali_profiling_notification_enable(session, 0, 0);
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+/**
+ * Called by gator.ko to set HW counters
+ *
+ * @param counter_id The counter ID.
+ * @param event_id Event ID that the counter should count (HW counter value from TRM).
+ *
+ * @return 1 on success, 0 on failure.
+ */
+int _mali_profiling_set_event(u32 counter_id, s32 event_id)
+{
+	if (COUNTER_VP_0_C0 == counter_id) {
+		mali_gp_job_set_gp_counter_src0(event_id);
+	} else if (COUNTER_VP_0_C1 == counter_id) {
+		mali_gp_job_set_gp_counter_src1(event_id);
+	} else if (COUNTER_FP_0_C0 <= counter_id && COUNTER_FP_7_C1 >= counter_id) {
+		/*
+		 * Two compatibility notes for this function:
+		 *
+		 * 1) Previously the DDK allowed per core counters.
+		 *
+		 *    This did not make much sense on Mali-450 with the "virtual PP core" concept,
+		 *    so this option was removed, and only the same pair of HW counters was allowed on all cores,
+		 *    beginning with r3p2 release.
+		 *
+		 *    Starting with r4p0, it is now possible to set different HW counters for the different sub jobs.
+		 *    This should be almost the same, since sub job 0 is designed to run on core 0,
+		 *    sub job 1 on core 1, and so on.
+		 *
+		 *    The scheduling of PP sub jobs is not predictable, and this often led to situations where core 0 ran 2
+		 *    sub jobs, while for instance core 1 ran zero. Having the counters set per sub job would thus increase
+		 *    the predictability of the returned data (as you would be guaranteed data for all the selected HW counters).
+		 *
+		 *    PS: Core scaling needs to be disabled in order to use this reliably (goes for both solutions).
+		 *
+		 *    The framework/#defines with Gator still indicates that the counter is for a particular core,
+		 *    but this is internally used as a sub job ID instead (no translation needed).
+		 *
+		 *  2) Global/default vs per sub job counters
+		 *
+		 *     Releases before r3p2 had only per PP core counters.
+		 *     r3p2 releases had only one set of default/global counters which applied to all PP cores
+		 *     Starting with r4p0, we have both a set of default/global counters,
+		 *     and individual counters per sub job (equal to per core).
+		 *
+		 *     To keep compatibility with Gator/DS-5/streamline, the following scheme is used:
+		 *
+		 *     r3p2 release; only counters set for core 0 is handled,
+		 *     this is applied as the default/global set of counters, and will thus affect all cores.
+		 *
+		 *     r4p0 release; counters set for core 0 is applied as both the global/default set of counters,
+		 *     and counters for sub job 0.
+		 *     Counters set for core 1-7 is only applied for the corresponding sub job.
+		 *
+		 *     This should allow the DS-5/Streamline GUI to have a simple mode where it only allows setting the
+		 *     values for core 0, and thus this will be applied to all PP sub jobs/cores.
+		 *     Advanced mode will also be supported, where individual pairs of HW counters can be selected.
+		 *
+		 *     The GUI will (until it is updated) still refer to cores instead of sub jobs, but this is probably
+		 *     something we can live with!
+		 *
+		 *     Mali-450 note: Each job is not divided into a deterministic number of sub jobs, as the HW DLBU
+		 *     automatically distributes the load between whatever number of cores is available at this particular time.
+		 *     A normal PP job on Mali-450 is thus considered a single (virtual) job, and it will thus only be possible
+		 *     to use a single pair of HW counters (even if the job ran on multiple PP cores).
+		 *     In other words, only the global/default pair of PP HW counters will be used for normal Mali-450 jobs.
+		 */
+		u32 sub_job = (counter_id - COUNTER_FP_0_C0) >> 1;
+		u32 counter_src = (counter_id - COUNTER_FP_0_C0) & 1;
+		if (0 == counter_src) {
+			mali_pp_job_set_pp_counter_sub_job_src0(sub_job, event_id);
+			if (0 == sub_job) {
+				mali_pp_job_set_pp_counter_global_src0(event_id);
+			}
+		} else {
+			mali_pp_job_set_pp_counter_sub_job_src1(sub_job, event_id);
+			if (0 == sub_job) {
+				mali_pp_job_set_pp_counter_global_src1(event_id);
+			}
+		}
+	} else if (COUNTER_L2_0_C0 <= counter_id && COUNTER_L2_2_C1 >= counter_id) {
+		u32 core_id = (counter_id - COUNTER_L2_0_C0) >> 1;
+		struct mali_l2_cache_core *l2_cache_core = mali_l2_cache_core_get_glob_l2_core(core_id);
+
+		if (NULL != l2_cache_core) {
+			u32 counter_src = (counter_id - COUNTER_L2_0_C0) & 1;
+			mali_l2_cache_core_set_counter_src(l2_cache_core,
+							   counter_src, event_id);
+			l2_cache_counter_if_enabled = MALI_TRUE;
+		}
+	} else {
+		return 0; /* Failure, unknown event */
+	}
+
+	return 1; /* success */
+}
+
+/**
+ * Called by gator.ko to retrieve the L2 cache counter values for all L2 cache cores.
+ * The L2 cache counters are unique in that they are polled by gator, rather than being
+ * transmitted via the tracepoint mechanism.
+ *
+ * @param values Pointer to a _mali_profiling_l2_counter_values structure where
+ *               the counter sources and values will be output
+ * @return 0 if all went well; otherwise, return the mask with the bits set for the powered off cores
+ */
+u32 _mali_profiling_get_l2_counters(_mali_profiling_l2_counter_values *values)
+{
+	u32 l2_cores_num = mali_l2_cache_core_get_glob_num_l2_cores();
+	u32 i;
+
+	MALI_DEBUG_ASSERT(l2_cores_num <= 3);
+
+	for (i = 0; i < l2_cores_num; i++) {
+		struct mali_l2_cache_core *l2_cache = mali_l2_cache_core_get_glob_l2_core(i);
+
+		if (NULL == l2_cache) {
+			continue;
+		}
+
+		mali_l2_cache_core_get_counter_values(l2_cache,
+						      &values->cores[i].source0,
+						      &values->cores[i].value0,
+						      &values->cores[i].source1,
+						      &values->cores[i].value1);
+	}
+
+	return 0;
+}
+
+/**
+ * Called by gator to control the production of profiling information at runtime.
+ */
+void _mali_profiling_control(u32 action, u32 value)
+{
+	switch (action) {
+	case FBDUMP_CONTROL_ENABLE:
+		mali_set_user_setting(_MALI_UK_USER_SETTING_COLORBUFFER_CAPTURE_ENABLED, (value == 0 ? MALI_FALSE : MALI_TRUE));
+		break;
+	case FBDUMP_CONTROL_RATE:
+		mali_set_user_setting(_MALI_UK_USER_SETTING_BUFFER_CAPTURE_N_FRAMES, value);
+		break;
+	case SW_COUNTER_ENABLE:
+		mali_set_user_setting(_MALI_UK_USER_SETTING_SW_COUNTER_ENABLED, value);
+		break;
+	case FBDUMP_CONTROL_RESIZE_FACTOR:
+		mali_set_user_setting(_MALI_UK_USER_SETTING_BUFFER_CAPTURE_RESIZE_FACTOR, value);
+		break;
+	default:
+		break;  /* Ignore unimplemented actions */
+	}
+}
+
+/**
+ * Called by gator to get mali api version.
+ */
+u32 _mali_profiling_get_api_version(void)
+{
+	return MALI_PROFILING_API_VERSION;
+}
+
+/**
+* Called by gator to get the data about Mali instance in use:
+* product id, version, number of cores
+*/
+void _mali_profiling_get_mali_version(struct _mali_profiling_mali_version *values)
+{
+	values->mali_product_id = (u32)mali_kernel_core_get_product_id();
+	values->mali_version_major = mali_kernel_core_get_gpu_major_version();
+	values->mali_version_minor = mali_kernel_core_get_gpu_minor_version();
+	values->num_of_l2_cores = mali_l2_cache_core_get_glob_num_l2_cores();
+	values->num_of_fp_cores = mali_executor_get_num_cores_total();
+	values->num_of_vp_cores = 1;
+}
+
+
+EXPORT_SYMBOL(_mali_profiling_set_event);
+EXPORT_SYMBOL(_mali_profiling_get_l2_counters);
+EXPORT_SYMBOL(_mali_profiling_control);
+EXPORT_SYMBOL(_mali_profiling_get_api_version);
+EXPORT_SYMBOL(_mali_profiling_get_mali_version);
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_specific.h b/drivers/gpu/arm/mali400/linux/mali_osk_specific.h
--- a/drivers/gpu/arm/mali400/linux/mali_osk_specific.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_specific.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2010, 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_specific.h
+ * Defines per-OS Kernel level specifics, such as unusual workarounds for
+ * certain OSs.
+ */
+
+#ifndef __MALI_OSK_SPECIFIC_H__
+#define __MALI_OSK_SPECIFIC_H__
+
+#include <asm/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/gfp.h>
+#include <linux/hardirq.h>
+
+
+#include "mali_osk_types.h"
+#include "mali_kernel_linux.h"
+
+#define MALI_STATIC_INLINE static inline
+#define MALI_NON_STATIC_INLINE inline
+
+typedef struct dma_pool *mali_dma_pool;
+
+typedef u32 mali_dma_addr;
+
+#if MALI_ENABLE_CPU_CYCLES
+/* Reads out the clock cycle performance counter of the current cpu.
+   It is useful for cost-free (2 cycle) measuring of the time spent
+   in a code path. Sample before and after, the diff number of cycles.
+   When the CPU is idle it will not increase this clock counter.
+   It means that the counter is accurate if only spin-locks are used,
+   but mutexes may lead to too low values since the cpu might "idle"
+   waiting for the mutex to become available.
+   The clock source is configured on the CPU during mali module load,
+   but will not give useful output after a CPU has been power cycled.
+   It is therefore important to configure the system to not turn of
+   the cpu cores when using this functionallity.*/
+static inline unsigned int mali_get_cpu_cyclecount(void)
+{
+	unsigned int value;
+	/* Reading the CCNT Register - CPU clock counter */
+	asm volatile("MRC p15, 0, %0, c9, c13, 0\t\n": "=r"(value));
+	return value;
+}
+
+void mali_init_cpu_time_counters(int reset, int enable_divide_by_64);
+#endif
+
+
+MALI_STATIC_INLINE u32 _mali_osk_copy_from_user(void *to, void *from, u32 n)
+{
+	return (u32)copy_from_user(to, from, (unsigned long)n);
+}
+
+MALI_STATIC_INLINE mali_bool _mali_osk_in_atomic(void)
+{
+	return in_atomic();
+}
+
+#define _mali_osk_put_user(x, ptr) put_user(x, ptr)
+
+#endif /* __MALI_OSK_SPECIFIC_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_time.c b/drivers/gpu/arm/mali400/linux/mali_osk_time.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_time.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_time.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_time.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include "mali_osk.h"
+#include <linux/jiffies.h>
+#include <linux/time.h>
+#include <asm/delay.h>
+
+mali_bool _mali_osk_time_after_eq(unsigned long ticka, unsigned long tickb)
+{
+	return time_after_eq(ticka, tickb) ?
+	       MALI_TRUE : MALI_FALSE;
+}
+
+unsigned long _mali_osk_time_mstoticks(u32 ms)
+{
+	return msecs_to_jiffies(ms);
+}
+
+u32 _mali_osk_time_tickstoms(unsigned long ticks)
+{
+	return jiffies_to_msecs(ticks);
+}
+
+unsigned long _mali_osk_time_tickcount(void)
+{
+	return jiffies;
+}
+
+void _mali_osk_time_ubusydelay(u32 usecs)
+{
+	udelay(usecs);
+}
+
+u64 _mali_osk_time_get_ns(void)
+{
+	struct timespec tsval;
+	getnstimeofday(&tsval);
+	return (u64)timespec_to_ns(&tsval);
+}
+
+u64 _mali_osk_boot_time_get_ns(void)
+{
+	struct timespec tsval;
+	get_monotonic_boottime(&tsval);
+	return (u64)timespec_to_ns(&tsval);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_timers.c b/drivers/gpu/arm/mali400/linux/mali_osk_timers.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_timers.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_timers.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_timers.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include <linux/timer.h>
+#include <linux/slab.h>
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+struct _mali_osk_timer_t_struct {
+	struct timer_list timer;
+};
+
+typedef void (*timer_timeout_function_t)(unsigned long);
+
+_mali_osk_timer_t *_mali_osk_timer_init(void)
+{
+	_mali_osk_timer_t *t = (_mali_osk_timer_t *)kmalloc(sizeof(_mali_osk_timer_t), GFP_KERNEL);
+	if (NULL != t) init_timer(&t->timer);
+	return t;
+}
+
+void _mali_osk_timer_add(_mali_osk_timer_t *tim, unsigned long ticks_to_expire)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	tim->timer.expires = jiffies + ticks_to_expire;
+	add_timer(&(tim->timer));
+}
+
+void _mali_osk_timer_mod(_mali_osk_timer_t *tim, unsigned long ticks_to_expire)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	mod_timer(&(tim->timer), jiffies + ticks_to_expire);
+}
+
+void _mali_osk_timer_del(_mali_osk_timer_t *tim)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	del_timer_sync(&(tim->timer));
+}
+
+void _mali_osk_timer_del_async(_mali_osk_timer_t *tim)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	del_timer(&(tim->timer));
+}
+
+mali_bool _mali_osk_timer_pending(_mali_osk_timer_t *tim)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	return 1 == timer_pending(&(tim->timer));
+}
+
+void _mali_osk_timer_setcallback(_mali_osk_timer_t *tim, _mali_osk_timer_callback_t callback, void *data)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	tim->timer.data = (unsigned long)data;
+	tim->timer.function = (timer_timeout_function_t)callback;
+}
+
+void _mali_osk_timer_term(_mali_osk_timer_t *tim)
+{
+	MALI_DEBUG_ASSERT_POINTER(tim);
+	kfree(tim);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_wait_queue.c b/drivers/gpu/arm/mali400/linux/mali_osk_wait_queue.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_wait_queue.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_wait_queue.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_wait_queue.c
+ * Implemenation of the OS abstraction layer for the kernel device driver
+ */
+
+#include <linux/wait.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+
+struct _mali_osk_wait_queue_t_struct {
+	wait_queue_head_t wait_queue;
+};
+
+_mali_osk_wait_queue_t *_mali_osk_wait_queue_init(void)
+{
+	_mali_osk_wait_queue_t *ret = NULL;
+
+	ret = kmalloc(sizeof(_mali_osk_wait_queue_t), GFP_KERNEL);
+
+	if (NULL == ret) {
+		return ret;
+	}
+
+	init_waitqueue_head(&ret->wait_queue);
+	MALI_DEBUG_ASSERT(!waitqueue_active(&ret->wait_queue));
+
+	return ret;
+}
+
+void _mali_osk_wait_queue_wait_event(_mali_osk_wait_queue_t *queue, mali_bool(*condition)(void *), void *data)
+{
+	MALI_DEBUG_ASSERT_POINTER(queue);
+	MALI_DEBUG_PRINT(6, ("Adding to wait queue %p\n", queue));
+	wait_event(queue->wait_queue, condition(data));
+}
+
+void _mali_osk_wait_queue_wait_event_timeout(_mali_osk_wait_queue_t *queue, mali_bool(*condition)(void *), void *data, u32 timeout)
+{
+	MALI_DEBUG_ASSERT_POINTER(queue);
+	MALI_DEBUG_PRINT(6, ("Adding to wait queue %p\n", queue));
+	wait_event_timeout(queue->wait_queue, condition(data), _mali_osk_time_mstoticks(timeout));
+}
+
+void _mali_osk_wait_queue_wake_up(_mali_osk_wait_queue_t *queue)
+{
+	MALI_DEBUG_ASSERT_POINTER(queue);
+
+	/* if queue is empty, don't attempt to wake up its elements */
+	if (!waitqueue_active(&queue->wait_queue)) return;
+
+	MALI_DEBUG_PRINT(6, ("Waking up elements in wait queue %p ....\n", queue));
+
+	wake_up_all(&queue->wait_queue);
+
+	MALI_DEBUG_PRINT(6, ("... elements in wait queue %p woken up\n", queue));
+}
+
+void _mali_osk_wait_queue_term(_mali_osk_wait_queue_t *queue)
+{
+	/* Parameter validation  */
+	MALI_DEBUG_ASSERT_POINTER(queue);
+
+	/* Linux requires no explicit termination of wait queues */
+	kfree(queue);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_osk_wq.c b/drivers/gpu/arm/mali400/linux/mali_osk_wq.c
--- a/drivers/gpu/arm/mali400/linux/mali_osk_wq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_osk_wq.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2010-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_osk_wq.c
+ * Implementation of the OS abstraction layer for the kernel device driver
+ */
+
+#include <linux/slab.h> /* For memory allocation */
+#include <linux/workqueue.h>
+#include <linux/version.h>
+#include <linux/sched.h>
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_kernel_license.h"
+#include "mali_kernel_linux.h"
+
+typedef struct _mali_osk_wq_work_s {
+	_mali_osk_wq_work_handler_t handler;
+	void *data;
+	mali_bool high_pri;
+	struct work_struct work_handle;
+} mali_osk_wq_work_object_t;
+
+typedef struct _mali_osk_wq_delayed_work_s {
+	_mali_osk_wq_work_handler_t handler;
+	void *data;
+	struct delayed_work work;
+} mali_osk_wq_delayed_work_object_t;
+
+#if MALI_LICENSE_IS_GPL
+static struct workqueue_struct *mali_wq_normal = NULL;
+static struct workqueue_struct *mali_wq_high = NULL;
+#endif
+
+static void _mali_osk_wq_work_func(struct work_struct *work);
+
+_mali_osk_errcode_t _mali_osk_wq_init(void)
+{
+#if MALI_LICENSE_IS_GPL
+	MALI_DEBUG_ASSERT(NULL == mali_wq_normal);
+	MALI_DEBUG_ASSERT(NULL == mali_wq_high);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	mali_wq_normal = alloc_workqueue("mali", WQ_UNBOUND, 0);
+	mali_wq_high = alloc_workqueue("mali_high_pri", WQ_HIGHPRI | WQ_UNBOUND, 0);
+#else
+	mali_wq_normal = create_workqueue("mali");
+	mali_wq_high = create_workqueue("mali_high_pri");
+#endif
+	if (NULL == mali_wq_normal || NULL == mali_wq_high) {
+		MALI_PRINT_ERROR(("Unable to create Mali workqueues\n"));
+
+		if (mali_wq_normal) destroy_workqueue(mali_wq_normal);
+		if (mali_wq_high)   destroy_workqueue(mali_wq_high);
+
+		mali_wq_normal = NULL;
+		mali_wq_high   = NULL;
+
+		return _MALI_OSK_ERR_FAULT;
+	}
+#endif /* MALI_LICENSE_IS_GPL */
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void _mali_osk_wq_flush(void)
+{
+#if MALI_LICENSE_IS_GPL
+	flush_workqueue(mali_wq_high);
+	flush_workqueue(mali_wq_normal);
+#else
+	flush_scheduled_work();
+#endif
+}
+
+void _mali_osk_wq_term(void)
+{
+#if MALI_LICENSE_IS_GPL
+	MALI_DEBUG_ASSERT(NULL != mali_wq_normal);
+	MALI_DEBUG_ASSERT(NULL != mali_wq_high);
+
+	flush_workqueue(mali_wq_normal);
+	destroy_workqueue(mali_wq_normal);
+
+	flush_workqueue(mali_wq_high);
+	destroy_workqueue(mali_wq_high);
+
+	mali_wq_normal = NULL;
+	mali_wq_high   = NULL;
+#else
+	flush_scheduled_work();
+#endif
+}
+
+_mali_osk_wq_work_t *_mali_osk_wq_create_work(_mali_osk_wq_work_handler_t handler, void *data)
+{
+	mali_osk_wq_work_object_t *work = kmalloc(sizeof(mali_osk_wq_work_object_t), GFP_KERNEL);
+
+	if (NULL == work) return NULL;
+
+	work->handler = handler;
+	work->data = data;
+	work->high_pri = MALI_FALSE;
+
+	INIT_WORK(&work->work_handle, _mali_osk_wq_work_func);
+
+	return work;
+}
+
+_mali_osk_wq_work_t *_mali_osk_wq_create_work_high_pri(_mali_osk_wq_work_handler_t handler, void *data)
+{
+	mali_osk_wq_work_object_t *work = kmalloc(sizeof(mali_osk_wq_work_object_t), GFP_KERNEL);
+
+	if (NULL == work) return NULL;
+
+	work->handler = handler;
+	work->data = data;
+	work->high_pri = MALI_TRUE;
+
+	INIT_WORK(&work->work_handle, _mali_osk_wq_work_func);
+
+	return work;
+}
+
+void _mali_osk_wq_delete_work(_mali_osk_wq_work_t *work)
+{
+	mali_osk_wq_work_object_t *work_object = (mali_osk_wq_work_object_t *)work;
+	_mali_osk_wq_flush();
+	kfree(work_object);
+}
+
+void _mali_osk_wq_delete_work_nonflush(_mali_osk_wq_work_t *work)
+{
+	mali_osk_wq_work_object_t *work_object = (mali_osk_wq_work_object_t *)work;
+	kfree(work_object);
+}
+
+void _mali_osk_wq_schedule_work(_mali_osk_wq_work_t *work)
+{
+	mali_osk_wq_work_object_t *work_object = (mali_osk_wq_work_object_t *)work;
+#if MALI_LICENSE_IS_GPL
+	queue_work(mali_wq_normal, &work_object->work_handle);
+#else
+	schedule_work(&work_object->work_handle);
+#endif
+}
+
+void _mali_osk_wq_schedule_work_high_pri(_mali_osk_wq_work_t *work)
+{
+	mali_osk_wq_work_object_t *work_object = (mali_osk_wq_work_object_t *)work;
+#if MALI_LICENSE_IS_GPL
+	queue_work(mali_wq_high, &work_object->work_handle);
+#else
+	schedule_work(&work_object->work_handle);
+#endif
+}
+
+static void _mali_osk_wq_work_func(struct work_struct *work)
+{
+	mali_osk_wq_work_object_t *work_object;
+
+	work_object = _MALI_OSK_CONTAINER_OF(work, mali_osk_wq_work_object_t, work_handle);
+
+#if MALI_LICENSE_IS_GPL
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,36)
+	/* We want highest Dynamic priority of the thread so that the Jobs depending
+	** on this thread could be scheduled in time. Without this, this thread might
+	** sometimes need to wait for some threads in user mode to finish its round-robin
+	** time, causing *bubble* in the Mali pipeline. Thanks to the new implementation
+	** of high-priority workqueue in new kernel, this only happens in older kernel.
+	*/
+	if (MALI_TRUE == work_object->high_pri) {
+		set_user_nice(current, -19);
+	}
+#endif
+#endif /* MALI_LICENSE_IS_GPL */
+
+	work_object->handler(work_object->data);
+}
+
+static void _mali_osk_wq_delayed_work_func(struct work_struct *work)
+{
+	mali_osk_wq_delayed_work_object_t *work_object;
+
+	work_object = _MALI_OSK_CONTAINER_OF(work, mali_osk_wq_delayed_work_object_t, work.work);
+	work_object->handler(work_object->data);
+}
+
+mali_osk_wq_delayed_work_object_t *_mali_osk_wq_delayed_create_work(_mali_osk_wq_work_handler_t handler, void *data)
+{
+	mali_osk_wq_delayed_work_object_t *work = kmalloc(sizeof(mali_osk_wq_delayed_work_object_t), GFP_KERNEL);
+
+	if (NULL == work) return NULL;
+
+	work->handler = handler;
+	work->data = data;
+
+	INIT_DELAYED_WORK(&work->work, _mali_osk_wq_delayed_work_func);
+
+	return work;
+}
+
+void _mali_osk_wq_delayed_delete_work_nonflush(_mali_osk_wq_delayed_work_t *work)
+{
+	mali_osk_wq_delayed_work_object_t *work_object = (mali_osk_wq_delayed_work_object_t *)work;
+	kfree(work_object);
+}
+
+void _mali_osk_wq_delayed_cancel_work_async(_mali_osk_wq_delayed_work_t *work)
+{
+	mali_osk_wq_delayed_work_object_t *work_object = (mali_osk_wq_delayed_work_object_t *)work;
+	cancel_delayed_work(&work_object->work);
+}
+
+void _mali_osk_wq_delayed_cancel_work_sync(_mali_osk_wq_delayed_work_t *work)
+{
+	mali_osk_wq_delayed_work_object_t *work_object = (mali_osk_wq_delayed_work_object_t *)work;
+	cancel_delayed_work_sync(&work_object->work);
+}
+
+void _mali_osk_wq_delayed_schedule_work(_mali_osk_wq_delayed_work_t *work, u32 delay)
+{
+	mali_osk_wq_delayed_work_object_t *work_object = (mali_osk_wq_delayed_work_object_t *)work;
+
+#if MALI_LICENSE_IS_GPL
+	queue_delayed_work(mali_wq_normal, &work_object->work, delay);
+#else
+	schedule_delayed_work(&work_object->work, delay);
+#endif
+
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_pmu_power_up_down.c b/drivers/gpu/arm/mali400/linux/mali_pmu_power_up_down.c
--- a/drivers/gpu/arm/mali400/linux/mali_pmu_power_up_down.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_pmu_power_up_down.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,23 @@
+/**
+ * Copyright (C) 2010, 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_pmu_power_up_down.c
+ */
+
+#include <linux/module.h>
+#include "mali_executor.h"
+
+int mali_perf_set_num_pp_cores(unsigned int num_cores)
+{
+	return mali_executor_set_perf_level(num_cores, MALI_FALSE);
+}
+
+EXPORT_SYMBOL(mali_perf_set_num_pp_cores);
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_profiling_events.h b/drivers/gpu/arm/mali400/linux/mali_profiling_events.h
--- a/drivers/gpu/arm/mali400/linux/mali_profiling_events.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_profiling_events.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2012, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PROFILING_EVENTS_H__
+#define __MALI_PROFILING_EVENTS_H__
+
+/* Simple wrapper in order to find the OS specific location of this file */
+#include <linux/mali/mali_utgard_profiling_events.h>
+
+#endif /* __MALI_PROFILING_EVENTS_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_profiling_gator_api.h b/drivers/gpu/arm/mali400/linux/mali_profiling_gator_api.h
--- a/drivers/gpu/arm/mali400/linux/mali_profiling_gator_api.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_profiling_gator_api.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2012-2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PROFILING_GATOR_API_H__
+#define __MALI_PROFILING_GATOR_API_H__
+
+/* Simple wrapper in order to find the OS specific location of this file */
+#include <linux/mali/mali_utgard_profiling_gator_api.h>
+
+#endif /* __MALI_PROFILING_GATOR_API_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_profiling_internal.c b/drivers/gpu/arm/mali400/linux/mali_profiling_internal.c
--- a/drivers/gpu/arm/mali400/linux/mali_profiling_internal.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_profiling_internal.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,275 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_kernel_common.h"
+#include "mali_osk.h"
+#include "mali_osk_mali.h"
+#include "mali_ukk.h"
+#include "mali_timestamp.h"
+#include "mali_osk_profiling.h"
+#include "mali_user_settings_db.h"
+#include "mali_profiling_internal.h"
+
+typedef struct mali_profiling_entry {
+	u64 timestamp;
+	u32 event_id;
+	u32 data[5];
+} mali_profiling_entry;
+
+typedef enum mali_profiling_state {
+	MALI_PROFILING_STATE_UNINITIALIZED,
+	MALI_PROFILING_STATE_IDLE,
+	MALI_PROFILING_STATE_RUNNING,
+	MALI_PROFILING_STATE_RETURN,
+} mali_profiling_state;
+
+static _mali_osk_mutex_t *lock = NULL;
+static mali_profiling_state prof_state = MALI_PROFILING_STATE_UNINITIALIZED;
+static mali_profiling_entry *profile_entries = NULL;
+static _mali_osk_atomic_t profile_insert_index;
+static u32 profile_mask = 0;
+
+static inline void add_event(u32 event_id, u32 data0, u32 data1, u32 data2, u32 data3, u32 data4);
+
+void probe_mali_timeline_event(void *data, TP_PROTO(unsigned int event_id, unsigned int d0, unsigned int d1, unsigned
+			       int d2, unsigned int d3, unsigned int d4))
+{
+	add_event(event_id, d0, d1, d2, d3, d4);
+}
+
+_mali_osk_errcode_t _mali_internal_profiling_init(mali_bool auto_start)
+{
+	profile_entries = NULL;
+	profile_mask = 0;
+	_mali_osk_atomic_init(&profile_insert_index, 0);
+
+	lock = _mali_osk_mutex_init(_MALI_OSK_LOCKFLAG_ORDERED, _MALI_OSK_LOCK_ORDER_PROFILING);
+	if (NULL == lock) {
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	prof_state = MALI_PROFILING_STATE_IDLE;
+
+	if (MALI_TRUE == auto_start) {
+		u32 limit = MALI_PROFILING_MAX_BUFFER_ENTRIES; /* Use maximum buffer size */
+
+		mali_set_user_setting(_MALI_UK_USER_SETTING_SW_EVENTS_ENABLE, MALI_TRUE);
+		if (_MALI_OSK_ERR_OK != _mali_internal_profiling_start(&limit)) {
+			return _MALI_OSK_ERR_FAULT;
+		}
+	}
+
+	return _MALI_OSK_ERR_OK;
+}
+
+void _mali_internal_profiling_term(void)
+{
+	u32 count;
+
+	/* Ensure profiling is stopped */
+	_mali_internal_profiling_stop(&count);
+
+	prof_state = MALI_PROFILING_STATE_UNINITIALIZED;
+
+	if (NULL != profile_entries) {
+		_mali_osk_vfree(profile_entries);
+		profile_entries = NULL;
+	}
+
+	if (NULL != lock) {
+		_mali_osk_mutex_term(lock);
+		lock = NULL;
+	}
+}
+
+_mali_osk_errcode_t _mali_internal_profiling_start(u32 *limit)
+{
+	_mali_osk_errcode_t ret;
+	mali_profiling_entry *new_profile_entries;
+
+	_mali_osk_mutex_wait(lock);
+
+	if (MALI_PROFILING_STATE_RUNNING == prof_state) {
+		_mali_osk_mutex_signal(lock);
+		return _MALI_OSK_ERR_BUSY;
+	}
+
+	new_profile_entries = _mali_osk_valloc(*limit * sizeof(mali_profiling_entry));
+
+	if (NULL == new_profile_entries) {
+		_mali_osk_mutex_signal(lock);
+		_mali_osk_vfree(new_profile_entries);
+		return _MALI_OSK_ERR_NOMEM;
+	}
+
+	if (MALI_PROFILING_MAX_BUFFER_ENTRIES < *limit) {
+		*limit = MALI_PROFILING_MAX_BUFFER_ENTRIES;
+	}
+
+	profile_mask = 1;
+	while (profile_mask <= *limit) {
+		profile_mask <<= 1;
+	}
+	profile_mask >>= 1;
+
+	*limit = profile_mask;
+
+	profile_mask--; /* turns the power of two into a mask of one less */
+
+	if (MALI_PROFILING_STATE_IDLE != prof_state) {
+		_mali_osk_mutex_signal(lock);
+		_mali_osk_vfree(new_profile_entries);
+		return _MALI_OSK_ERR_INVALID_ARGS; /* invalid to call this function in this state */
+	}
+
+	profile_entries = new_profile_entries;
+
+	ret = _mali_timestamp_reset();
+
+	if (_MALI_OSK_ERR_OK == ret) {
+		prof_state = MALI_PROFILING_STATE_RUNNING;
+	} else {
+		_mali_osk_vfree(profile_entries);
+		profile_entries = NULL;
+	}
+
+	register_trace_mali_timeline_event(probe_mali_timeline_event, NULL);
+
+	_mali_osk_mutex_signal(lock);
+	return ret;
+}
+
+static inline void add_event(u32 event_id, u32 data0, u32 data1, u32 data2, u32 data3, u32 data4)
+{
+	u32 cur_index = (_mali_osk_atomic_inc_return(&profile_insert_index) - 1) & profile_mask;
+
+	profile_entries[cur_index].timestamp = _mali_timestamp_get();
+	profile_entries[cur_index].event_id = event_id;
+	profile_entries[cur_index].data[0] = data0;
+	profile_entries[cur_index].data[1] = data1;
+	profile_entries[cur_index].data[2] = data2;
+	profile_entries[cur_index].data[3] = data3;
+	profile_entries[cur_index].data[4] = data4;
+
+	/* If event is "leave API function", add current memory usage to the event
+	 * as data point 4.  This is used in timeline profiling to indicate how
+	 * much memory was used when leaving a function. */
+	if (event_id == (MALI_PROFILING_EVENT_TYPE_SINGLE | MALI_PROFILING_EVENT_CHANNEL_SOFTWARE | MALI_PROFILING_EVENT_REASON_SINGLE_SW_LEAVE_API_FUNC)) {
+		profile_entries[cur_index].data[4] = _mali_ukk_report_memory_usage();
+	}
+}
+
+_mali_osk_errcode_t _mali_internal_profiling_stop(u32 *count)
+{
+	_mali_osk_mutex_wait(lock);
+
+	if (MALI_PROFILING_STATE_RUNNING != prof_state) {
+		_mali_osk_mutex_signal(lock);
+		return _MALI_OSK_ERR_INVALID_ARGS; /* invalid to call this function in this state */
+	}
+
+	/* go into return state (user to retreive events), no more events will be added after this */
+	prof_state = MALI_PROFILING_STATE_RETURN;
+
+	unregister_trace_mali_timeline_event(probe_mali_timeline_event, NULL);
+
+	_mali_osk_mutex_signal(lock);
+
+	tracepoint_synchronize_unregister();
+
+	*count = _mali_osk_atomic_read(&profile_insert_index);
+	if (*count > profile_mask) *count = profile_mask;
+
+	return _MALI_OSK_ERR_OK;
+}
+
+u32 _mali_internal_profiling_get_count(void)
+{
+	u32 retval = 0;
+
+	_mali_osk_mutex_wait(lock);
+	if (MALI_PROFILING_STATE_RETURN == prof_state) {
+		retval = _mali_osk_atomic_read(&profile_insert_index);
+		if (retval > profile_mask) retval = profile_mask;
+	}
+	_mali_osk_mutex_signal(lock);
+
+	return retval;
+}
+
+_mali_osk_errcode_t _mali_internal_profiling_get_event(u32 index, u64 *timestamp, u32 *event_id, u32 data[5])
+{
+	u32 raw_index = _mali_osk_atomic_read(&profile_insert_index);
+
+	_mali_osk_mutex_wait(lock);
+
+	if (index < profile_mask) {
+		if ((raw_index & ~profile_mask) != 0) {
+			index += raw_index;
+			index &= profile_mask;
+		}
+
+		if (prof_state != MALI_PROFILING_STATE_RETURN) {
+			_mali_osk_mutex_signal(lock);
+			return _MALI_OSK_ERR_INVALID_ARGS; /* invalid to call this function in this state */
+		}
+
+		if (index >= raw_index) {
+			_mali_osk_mutex_signal(lock);
+			return _MALI_OSK_ERR_FAULT;
+		}
+
+		*timestamp = profile_entries[index].timestamp;
+		*event_id = profile_entries[index].event_id;
+		data[0] = profile_entries[index].data[0];
+		data[1] = profile_entries[index].data[1];
+		data[2] = profile_entries[index].data[2];
+		data[3] = profile_entries[index].data[3];
+		data[4] = profile_entries[index].data[4];
+	} else {
+		_mali_osk_mutex_signal(lock);
+		return _MALI_OSK_ERR_FAULT;
+	}
+
+	_mali_osk_mutex_signal(lock);
+	return _MALI_OSK_ERR_OK;
+}
+
+_mali_osk_errcode_t _mali_internal_profiling_clear(void)
+{
+	_mali_osk_mutex_wait(lock);
+
+	if (MALI_PROFILING_STATE_RETURN != prof_state) {
+		_mali_osk_mutex_signal(lock);
+		return _MALI_OSK_ERR_INVALID_ARGS; /* invalid to call this function in this state */
+	}
+
+	prof_state = MALI_PROFILING_STATE_IDLE;
+	profile_mask = 0;
+	_mali_osk_atomic_init(&profile_insert_index, 0);
+
+	if (NULL != profile_entries) {
+		_mali_osk_vfree(profile_entries);
+		profile_entries = NULL;
+	}
+
+	_mali_osk_mutex_signal(lock);
+	return _MALI_OSK_ERR_OK;
+}
+
+mali_bool _mali_internal_profiling_is_recording(void)
+{
+	return prof_state == MALI_PROFILING_STATE_RUNNING ? MALI_TRUE : MALI_FALSE;
+}
+
+mali_bool _mali_internal_profiling_have_recording(void)
+{
+	return prof_state == MALI_PROFILING_STATE_RETURN ? MALI_TRUE : MALI_FALSE;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_profiling_internal.h b/drivers/gpu/arm/mali400/linux/mali_profiling_internal.h
--- a/drivers/gpu/arm/mali400/linux/mali_profiling_internal.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_profiling_internal.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_PROFILING_INTERNAL_H__
+#define __MALI_PROFILING_INTERNAL_H__
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "mali_osk.h"
+
+int _mali_internal_profiling_init(mali_bool auto_start);
+void _mali_internal_profiling_term(void);
+
+mali_bool _mali_internal_profiling_is_recording(void);
+mali_bool _mali_internal_profiling_have_recording(void);
+_mali_osk_errcode_t _mali_internal_profiling_clear(void);
+_mali_osk_errcode_t _mali_internal_profiling_get_event(u32 index, u64 *timestamp, u32 *event_id, u32 data[5]);
+u32 _mali_internal_profiling_get_count(void);
+int _mali_internal_profiling_stop(u32 *count);
+int _mali_internal_profiling_start(u32 *limit);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_PROFILING_INTERNAL_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_sync.c b/drivers/gpu/arm/mali400/linux/mali_sync.c
--- a/drivers/gpu/arm/mali400/linux/mali_sync.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_sync.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,451 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_sync.h"
+
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_timeline.h"
+#include "mali_executor.h"
+
+#include <linux/file.h>
+#include <linux/seq_file.h>
+#include <linux/module.h>
+
+struct mali_sync_pt {
+	struct sync_pt         sync_pt;
+	struct mali_sync_flag *flag;
+	struct sync_timeline *sync_tl;  /**< Sync timeline this pt is connected to. */
+};
+
+/**
+ * The sync flag is used to connect sync fences to the Mali Timeline system.  Sync fences can be
+ * created from a sync flag, and when the flag is signaled, the sync fences will also be signaled.
+ */
+struct mali_sync_flag {
+	struct sync_timeline *sync_tl;  /**< Sync timeline this flag is connected to. */
+	u32                   point;    /**< Point on timeline. */
+	int                   status;   /**< 0 if unsignaled, 1 if signaled without error or negative if signaled with error. */
+	struct kref           refcount; /**< Reference count. */
+};
+
+/**
+ * Mali sync timeline is used to connect mali timeline to sync_timeline.
+ * When fence timeout can print more detailed mali timeline system info.
+ */
+struct mali_sync_timeline_container {
+	struct sync_timeline sync_timeline;
+	struct mali_timeline *timeline;
+};
+
+MALI_STATIC_INLINE struct mali_sync_pt *to_mali_sync_pt(struct sync_pt *pt)
+{
+	return container_of(pt, struct mali_sync_pt, sync_pt);
+}
+
+MALI_STATIC_INLINE struct mali_sync_timeline_container *to_mali_sync_tl_container(struct sync_timeline *sync_tl)
+{
+	return container_of(sync_tl, struct mali_sync_timeline_container, sync_timeline);
+}
+
+static struct sync_pt *timeline_dup(struct sync_pt *pt)
+{
+	struct mali_sync_pt *mpt, *new_mpt;
+	struct sync_pt *new_pt;
+
+	MALI_DEBUG_ASSERT_POINTER(pt);
+	mpt = to_mali_sync_pt(pt);
+
+	new_pt = sync_pt_create(mpt->sync_tl, sizeof(struct mali_sync_pt));
+	if (NULL == new_pt) return NULL;
+
+	new_mpt = to_mali_sync_pt(new_pt);
+
+	mali_sync_flag_get(mpt->flag);
+	new_mpt->flag = mpt->flag;
+	new_mpt->sync_tl = mpt->sync_tl;
+
+	return new_pt;
+}
+
+static int timeline_has_signaled(struct sync_pt *pt)
+{
+	struct mali_sync_pt *mpt;
+
+	MALI_DEBUG_ASSERT_POINTER(pt);
+	mpt = to_mali_sync_pt(pt);
+
+	MALI_DEBUG_ASSERT_POINTER(mpt->flag);
+
+	return mpt->flag->status;
+}
+
+static int timeline_compare(struct sync_pt *pta, struct sync_pt *ptb)
+{
+	struct mali_sync_pt *mpta;
+	struct mali_sync_pt *mptb;
+	u32 a, b;
+
+	MALI_DEBUG_ASSERT_POINTER(pta);
+	MALI_DEBUG_ASSERT_POINTER(ptb);
+	mpta = to_mali_sync_pt(pta);
+	mptb = to_mali_sync_pt(ptb);
+
+	MALI_DEBUG_ASSERT_POINTER(mpta->flag);
+	MALI_DEBUG_ASSERT_POINTER(mptb->flag);
+
+	a = mpta->flag->point;
+	b = mptb->flag->point;
+
+	if (a == b) return 0;
+
+	return ((b - a) < (a - b) ? -1 : 1);
+}
+
+static void timeline_free_pt(struct sync_pt *pt)
+{
+	struct mali_sync_pt *mpt;
+
+	MALI_DEBUG_ASSERT_POINTER(pt);
+	mpt = to_mali_sync_pt(pt);
+
+	mali_sync_flag_put(mpt->flag);
+}
+
+static void timeline_release(struct sync_timeline *sync_timeline)
+{
+	struct mali_sync_timeline_container *mali_sync_tl = NULL;
+	struct mali_timeline *mali_tl = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(sync_timeline);
+
+	mali_sync_tl = to_mali_sync_tl_container(sync_timeline);
+	MALI_DEBUG_ASSERT_POINTER(mali_sync_tl);
+
+	mali_tl = mali_sync_tl->timeline;
+
+	/* always signaled timeline didn't have mali container */
+	if (mali_tl) {
+		if (NULL != mali_tl->spinlock) {
+			mali_spinlock_reentrant_term(mali_tl->spinlock);
+		}
+		_mali_osk_free(mali_tl);
+	}
+
+	module_put(THIS_MODULE);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0)
+static void timeline_print_pt(struct seq_file *s, struct sync_pt *sync_pt)
+{
+	struct mali_sync_pt *mpt;
+
+	MALI_DEBUG_ASSERT_POINTER(s);
+	MALI_DEBUG_ASSERT_POINTER(sync_pt);
+
+	mpt = to_mali_sync_pt(sync_pt);
+
+	/* It is possible this sync point is just under construct,
+	 * make sure the flag is valid before accessing it
+	*/
+	if (mpt->flag) {
+		seq_printf(s, "%u", mpt->flag->point);
+	} else {
+		seq_printf(s, "uninitialized");
+	}
+}
+
+static void timeline_print_obj(struct seq_file *s, struct sync_timeline *sync_tl)
+{
+	struct mali_sync_timeline_container *mali_sync_tl = NULL;
+	struct mali_timeline *mali_tl = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(sync_tl);
+
+	mali_sync_tl = to_mali_sync_tl_container(sync_tl);
+	MALI_DEBUG_ASSERT_POINTER(mali_sync_tl);
+
+	mali_tl = mali_sync_tl->timeline;
+
+	if (NULL != mali_tl) {
+		seq_printf(s, "oldest (%u) ", mali_tl->point_oldest);
+		seq_printf(s, "next (%u)", mali_tl->point_next);
+		seq_printf(s, "\n");
+
+#if defined(MALI_TIMELINE_DEBUG_FUNCTIONS)
+		{
+			u32 tid = _mali_osk_get_tid();
+			struct mali_timeline_system *system = mali_tl->system;
+
+			mali_spinlock_reentrant_wait(mali_tl->spinlock, tid);
+			if (!mali_tl->destroyed) {
+				mali_spinlock_reentrant_wait(system->spinlock, tid);
+				mali_timeline_debug_print_timeline(mali_tl, s);
+				mali_spinlock_reentrant_signal(system->spinlock, tid);
+			}
+			mali_spinlock_reentrant_signal(mali_tl->spinlock, tid);
+
+			/* dump job queue status and group running status */
+			mali_executor_status_dump();
+		}
+#endif
+	}
+}
+#else
+static void timeline_pt_value_str(struct sync_pt *pt, char *str, int size)
+{
+	struct mali_sync_pt *mpt;
+
+	MALI_DEBUG_ASSERT_POINTER(str);
+	MALI_DEBUG_ASSERT_POINTER(pt);
+
+	mpt = to_mali_sync_pt(pt);
+
+	/* It is possible this sync point is just under construct,
+	 * make sure the flag is valid before accessing it
+	*/
+	if (mpt->flag) {
+		_mali_osk_snprintf(str, size, "%u", mpt->flag->point);
+	} else {
+		_mali_osk_snprintf(str, size, "uninitialized");
+	}
+}
+
+static void timeline_value_str(struct sync_timeline *timeline, char *str, int size)
+{
+	struct mali_sync_timeline_container *mali_sync_tl = NULL;
+	struct mali_timeline *mali_tl = NULL;
+
+	MALI_DEBUG_ASSERT_POINTER(timeline);
+
+	mali_sync_tl = to_mali_sync_tl_container(timeline);
+	MALI_DEBUG_ASSERT_POINTER(mali_sync_tl);
+
+	mali_tl = mali_sync_tl->timeline;
+
+	if (NULL != mali_tl) {
+		_mali_osk_snprintf(str, size, "oldest (%u) ", mali_tl->point_oldest);
+		_mali_osk_snprintf(str, size, "next (%u)", mali_tl->point_next);
+		_mali_osk_snprintf(str, size, "\n");
+
+#if defined(MALI_TIMELINE_DEBUG_FUNCTIONS)
+		{
+			u32 tid = _mali_osk_get_tid();
+			struct mali_timeline_system *system = mali_tl->system;
+
+			mali_spinlock_reentrant_wait(mali_tl->spinlock, tid);
+			if (!mali_tl->destroyed) {
+				mali_spinlock_reentrant_wait(system->spinlock, tid);
+				mali_timeline_debug_direct_print_timeline(mali_tl);
+				mali_spinlock_reentrant_signal(system->spinlock, tid);
+			}
+			mali_spinlock_reentrant_signal(mali_tl->spinlock, tid);
+
+			/* dump job queue status and group running status */
+			mali_executor_status_dump();
+		}
+#endif
+	}
+}
+#endif
+
+
+static struct sync_timeline_ops mali_timeline_ops = {
+	.driver_name    = "Mali",
+	.dup            = timeline_dup,
+	.has_signaled   = timeline_has_signaled,
+	.compare        = timeline_compare,
+	.free_pt        = timeline_free_pt,
+	.release_obj    = timeline_release,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 17, 0)
+	.print_pt       = timeline_print_pt,
+	.print_obj      = timeline_print_obj,
+#else
+	.pt_value_str = timeline_pt_value_str,
+	.timeline_value_str = timeline_value_str,
+#endif
+};
+
+struct sync_timeline *mali_sync_timeline_create(struct mali_timeline *timeline, const char *name)
+{
+	struct sync_timeline *sync_tl;
+	struct mali_sync_timeline_container *mali_sync_tl;
+
+	sync_tl = sync_timeline_create(&mali_timeline_ops, sizeof(struct mali_sync_timeline_container), name);
+	if (NULL == sync_tl) return NULL;
+
+	mali_sync_tl = to_mali_sync_tl_container(sync_tl);
+	mali_sync_tl->timeline = timeline;
+
+	/* Grab a reference on the module to ensure the callbacks are present
+	 * as long some timeline exists. The reference is released when the
+	 * timeline is freed.
+	 * Since this function is called from a ioctl on an open file we know
+	 * we already have a reference, so using __module_get is safe. */
+	__module_get(THIS_MODULE);
+
+	return sync_tl;
+}
+
+s32 mali_sync_fence_fd_alloc(struct sync_fence *sync_fence)
+{
+	s32 fd = -1;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0)
+	fd = get_unused_fd();
+#else
+	fd = get_unused_fd_flags(0);
+#endif
+
+	if (fd < 0) {
+		sync_fence_put(sync_fence);
+		return -1;
+	}
+	sync_fence_install(sync_fence, fd);
+
+	return fd;
+}
+
+struct sync_fence *mali_sync_fence_merge(struct sync_fence *sync_fence1, struct sync_fence *sync_fence2)
+{
+	struct sync_fence *sync_fence;
+
+	MALI_DEBUG_ASSERT_POINTER(sync_fence1);
+	MALI_DEBUG_ASSERT_POINTER(sync_fence1);
+
+	sync_fence = sync_fence_merge("mali_merge_fence", sync_fence1, sync_fence2);
+	sync_fence_put(sync_fence1);
+	sync_fence_put(sync_fence2);
+
+	return sync_fence;
+}
+
+struct sync_fence *mali_sync_timeline_create_signaled_fence(struct sync_timeline *sync_tl)
+{
+	struct mali_sync_flag *flag;
+	struct sync_fence *sync_fence;
+
+	MALI_DEBUG_ASSERT_POINTER(sync_tl);
+
+	flag = mali_sync_flag_create(sync_tl, 0);
+	if (NULL == flag) return NULL;
+
+	sync_fence = mali_sync_flag_create_fence(flag);
+
+	mali_sync_flag_signal(flag, 0);
+	mali_sync_flag_put(flag);
+
+	return sync_fence;
+}
+
+struct mali_sync_flag *mali_sync_flag_create(struct sync_timeline *sync_tl, mali_timeline_point point)
+{
+	struct mali_sync_flag *flag;
+
+	if (NULL == sync_tl) return NULL;
+
+	flag = _mali_osk_calloc(1, sizeof(*flag));
+	if (NULL == flag) return NULL;
+
+	flag->sync_tl = sync_tl;
+	flag->point = point;
+
+	flag->status = 0;
+	kref_init(&flag->refcount);
+
+	return flag;
+}
+
+void mali_sync_flag_get(struct mali_sync_flag *flag)
+{
+	MALI_DEBUG_ASSERT_POINTER(flag);
+	kref_get(&flag->refcount);
+}
+
+/**
+ * Free sync flag.
+ *
+ * @param ref kref object embedded in sync flag that should be freed.
+ */
+static void mali_sync_flag_free(struct kref *ref)
+{
+	struct mali_sync_flag *flag;
+
+	MALI_DEBUG_ASSERT_POINTER(ref);
+	flag = container_of(ref, struct mali_sync_flag, refcount);
+
+	_mali_osk_free(flag);
+}
+
+void mali_sync_flag_put(struct mali_sync_flag *flag)
+{
+	MALI_DEBUG_ASSERT_POINTER(flag);
+	kref_put(&flag->refcount, mali_sync_flag_free);
+}
+
+void mali_sync_flag_signal(struct mali_sync_flag *flag, int error)
+{
+	MALI_DEBUG_ASSERT_POINTER(flag);
+
+	MALI_DEBUG_ASSERT(0 == flag->status);
+	flag->status = (0 > error) ? error : 1;
+
+	_mali_osk_write_mem_barrier();
+
+	sync_timeline_signal(flag->sync_tl);
+}
+
+/**
+ * Create a sync point attached to given sync flag.
+ *
+ * @note Sync points must be triggered in *exactly* the same order as they are created.
+ *
+ * @param flag Sync flag.
+ * @return New sync point if successful, NULL if not.
+ */
+static struct sync_pt *mali_sync_flag_create_pt(struct mali_sync_flag *flag)
+{
+	struct sync_pt *pt;
+	struct mali_sync_pt *mpt;
+
+	MALI_DEBUG_ASSERT_POINTER(flag);
+	MALI_DEBUG_ASSERT_POINTER(flag->sync_tl);
+
+	pt = sync_pt_create(flag->sync_tl, sizeof(struct mali_sync_pt));
+	if (NULL == pt) return NULL;
+
+	mali_sync_flag_get(flag);
+
+	mpt = to_mali_sync_pt(pt);
+	mpt->flag = flag;
+	mpt->sync_tl = flag->sync_tl;
+
+	return pt;
+}
+
+struct sync_fence *mali_sync_flag_create_fence(struct mali_sync_flag *flag)
+{
+	struct sync_pt    *sync_pt;
+	struct sync_fence *sync_fence;
+
+	MALI_DEBUG_ASSERT_POINTER(flag);
+	MALI_DEBUG_ASSERT_POINTER(flag->sync_tl);
+
+	sync_pt = mali_sync_flag_create_pt(flag);
+	if (NULL == sync_pt) return NULL;
+
+	sync_fence = sync_fence_create("mali_flag_fence", sync_pt);
+	if (NULL == sync_fence) {
+		sync_pt_free(sync_pt);
+		return NULL;
+	}
+
+	return sync_fence;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_sync.h b/drivers/gpu/arm/mali400/linux/mali_sync.h
--- a/drivers/gpu/arm/mali400/linux/mali_sync.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_sync.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_sync.h
+ *
+ * Mali interface for Linux sync objects.
+ */
+
+#ifndef _MALI_SYNC_H_
+#define _MALI_SYNC_H_
+
+#if defined(CONFIG_SYNC)
+
+#include <linux/seq_file.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
+#include <linux/sync.h>
+#else
+#include <sync.h>
+#endif
+
+
+#include "mali_osk.h"
+
+struct mali_sync_flag;
+struct mali_timeline;
+
+/**
+ * Create a sync timeline.
+ *
+ * @param name Name of the sync timeline.
+ * @return The new sync timeline if successful, NULL if not.
+ */
+struct sync_timeline *mali_sync_timeline_create(struct mali_timeline *timeline, const char *name);
+
+/**
+ * Creates a file descriptor representing the sync fence.  Will release sync fence if allocation of
+ * file descriptor fails.
+ *
+ * @param sync_fence Sync fence.
+ * @return File descriptor representing sync fence if successful, or -1 if not.
+ */
+s32 mali_sync_fence_fd_alloc(struct sync_fence *sync_fence);
+
+/**
+ * Merges two sync fences.  Both input sync fences will be released.
+ *
+ * @param sync_fence1 First sync fence.
+ * @param sync_fence2 Second sync fence.
+ * @return New sync fence that is the result of the merger if successful, or NULL if not.
+ */
+struct sync_fence *mali_sync_fence_merge(struct sync_fence *sync_fence1, struct sync_fence *sync_fence2);
+
+/**
+ * Create a sync fence that is already signaled.
+ *
+ * @param tl Sync timeline.
+ * @return New signaled sync fence if successful, NULL if not.
+ */
+struct sync_fence *mali_sync_timeline_create_signaled_fence(struct sync_timeline *sync_tl);
+
+/**
+ * Create a sync flag.
+ *
+ * @param sync_tl Sync timeline.
+ * @param point Point on Mali timeline.
+ * @return New sync flag if successful, NULL if not.
+ */
+struct mali_sync_flag *mali_sync_flag_create(struct sync_timeline *sync_tl, u32 point);
+
+/**
+ * Grab sync flag reference.
+ *
+ * @param flag Sync flag.
+ */
+void mali_sync_flag_get(struct mali_sync_flag *flag);
+
+/**
+ * Release sync flag reference.  If this was the last reference, the sync flag will be freed.
+ *
+ * @param flag Sync flag.
+ */
+void mali_sync_flag_put(struct mali_sync_flag *flag);
+
+/**
+ * Signal sync flag.  All sync fences created from this flag will be signaled.
+ *
+ * @param flag Sync flag to signal.
+ * @param error Negative error code, or 0 if no error.
+ */
+void mali_sync_flag_signal(struct mali_sync_flag *flag, int error);
+
+/**
+ * Create a sync fence attached to given sync flag.
+ *
+ * @param flag Sync flag.
+ * @return New sync fence if successful, NULL if not.
+ */
+struct sync_fence *mali_sync_flag_create_fence(struct mali_sync_flag *flag);
+
+#endif /* defined(CONFIG_SYNC) */
+
+#endif /* _MALI_SYNC_H_ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_core.c b/drivers/gpu/arm/mali400/linux/mali_ukk_core.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_core.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_core.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <linux/slab.h>     /* memort allocation functions */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+int get_api_version_wrapper(struct mali_session_data *session_data, _mali_uk_get_api_version_s __user *uargs)
+{
+	_mali_uk_get_api_version_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != get_user(kargs.version, &uargs->version)) return -EFAULT;
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_get_api_version(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	if (0 != put_user(kargs.version, &uargs->version)) return -EFAULT;
+	if (0 != put_user(kargs.compatible, &uargs->compatible)) return -EFAULT;
+
+	return 0;
+}
+
+int get_api_version_v2_wrapper(struct mali_session_data *session_data, _mali_uk_get_api_version_v2_s __user *uargs)
+{
+	_mali_uk_get_api_version_v2_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != get_user(kargs.version, &uargs->version)) return -EFAULT;
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_get_api_version_v2(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	if (0 != put_user(kargs.version, &uargs->version)) return -EFAULT;
+	if (0 != put_user(kargs.compatible, &uargs->compatible)) return -EFAULT;
+
+	return 0;
+}
+
+int wait_for_notification_wrapper(struct mali_session_data *session_data, _mali_uk_wait_for_notification_s __user *uargs)
+{
+	_mali_uk_wait_for_notification_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_wait_for_notification(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	if (_MALI_NOTIFICATION_CORE_SHUTDOWN_IN_PROGRESS != kargs.type) {
+		kargs.ctx = (uintptr_t)NULL; /* prevent kernel address to be returned to user space */
+		if (0 != copy_to_user(uargs, &kargs, sizeof(_mali_uk_wait_for_notification_s))) return -EFAULT;
+	} else {
+		if (0 != put_user(kargs.type, &uargs->type)) return -EFAULT;
+	}
+
+	return 0;
+}
+
+int post_notification_wrapper(struct mali_session_data *session_data, _mali_uk_post_notification_s __user *uargs)
+{
+	_mali_uk_post_notification_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+
+	if (0 != get_user(kargs.type, &uargs->type)) {
+		return -EFAULT;
+	}
+
+	err = _mali_ukk_post_notification(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
+int get_user_settings_wrapper(struct mali_session_data *session_data, _mali_uk_get_user_settings_s __user *uargs)
+{
+	_mali_uk_get_user_settings_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_get_user_settings(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	kargs.ctx = 0; /* prevent kernel address to be returned to user space */
+	if (0 != copy_to_user(uargs, &kargs, sizeof(_mali_uk_get_user_settings_s))) return -EFAULT;
+
+	return 0;
+}
+
+int request_high_priority_wrapper(struct mali_session_data *session_data, _mali_uk_request_high_priority_s __user *uargs)
+{
+	_mali_uk_request_high_priority_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_request_high_priority(&kargs);
+
+	kargs.ctx = 0;
+
+	return map_errcode(err);
+}
+
+int pending_submit_wrapper(struct mali_session_data *session_data, _mali_uk_pending_submit_s __user *uargs)
+{
+	_mali_uk_pending_submit_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_pending_submit(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_gp.c b/drivers/gpu/arm/mali400/linux/mali_ukk_gp.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_gp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_gp.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2010, 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+int gp_start_job_wrapper(struct mali_session_data *session_data, _mali_uk_gp_start_job_s __user *uargs)
+{
+	_mali_osk_errcode_t err;
+
+	/* If the job was started successfully, 0 is returned.  If there was an error, but the job
+	 * was started, we return -ENOENT.  For anything else returned, the job was not started. */
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	err = _mali_ukk_gp_start_job(session_data, uargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	return 0;
+}
+
+int gp_get_core_version_wrapper(struct mali_session_data *session_data, _mali_uk_get_gp_core_version_s __user *uargs)
+{
+	_mali_uk_get_gp_core_version_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err =  _mali_ukk_get_gp_core_version(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	/* no known transactions to roll-back */
+
+	if (0 != put_user(kargs.version, &uargs->version)) return -EFAULT;
+
+	return 0;
+}
+
+int gp_suspend_response_wrapper(struct mali_session_data *session_data, _mali_uk_gp_suspend_response_s __user *uargs)
+{
+	_mali_uk_gp_suspend_response_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_gp_suspend_response_s))) return -EFAULT;
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_gp_suspend_response(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	if (0 != put_user(kargs.cookie, &uargs->cookie)) return -EFAULT;
+
+	/* no known transactions to roll-back */
+	return 0;
+}
+
+int gp_get_number_of_cores_wrapper(struct mali_session_data *session_data, _mali_uk_get_gp_number_of_cores_s __user *uargs)
+{
+	_mali_uk_get_gp_number_of_cores_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_get_gp_number_of_cores(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	/* no known transactions to roll-back */
+
+	if (0 != put_user(kargs.number_of_cores, &uargs->number_of_cores)) return -EFAULT;
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_mem.c b/drivers/gpu/arm/mali400/linux/mali_ukk_mem.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_mem.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_mem.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,333 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+int mem_alloc_wrapper(struct mali_session_data *session_data, _mali_uk_alloc_mem_s __user *uargs)
+{
+	_mali_uk_alloc_mem_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_alloc_mem_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_allocate(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	if (0 != put_user(kargs.backend_handle, &uargs->backend_handle)) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+int mem_free_wrapper(struct mali_session_data *session_data, _mali_uk_free_mem_s __user *uargs)
+{
+	_mali_uk_free_mem_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_free_mem_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_free(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	if (0 != put_user(kargs.free_pages_nr, &uargs->free_pages_nr)) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+int mem_bind_wrapper(struct mali_session_data *session_data, _mali_uk_bind_mem_s __user *uargs)
+{
+	_mali_uk_bind_mem_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_bind_mem_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_bind(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
+int mem_unbind_wrapper(struct mali_session_data *session_data, _mali_uk_unbind_mem_s __user *uargs)
+{
+	_mali_uk_unbind_mem_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_unbind_mem_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_unbind(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
+
+int mem_cow_wrapper(struct mali_session_data *session_data, _mali_uk_cow_mem_s __user *uargs)
+{
+	_mali_uk_cow_mem_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_cow_mem_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_cow(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	if (0 != put_user(kargs.backend_handle, &uargs->backend_handle)) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+int mem_cow_modify_range_wrapper(struct mali_session_data *session_data, _mali_uk_cow_modify_range_s __user *uargs)
+{
+	_mali_uk_cow_modify_range_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_cow_modify_range_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_cow_modify_range(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	if (0 != put_user(kargs.change_pages_nr, &uargs->change_pages_nr)) {
+		return -EFAULT;
+	}
+	return 0;
+}
+
+
+int mem_resize_mem_wrapper(struct mali_session_data *session_data, _mali_uk_mem_resize_s __user *uargs)
+{
+	_mali_uk_mem_resize_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_mem_resize_s))) {
+		return -EFAULT;
+	}
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_mem_resize(&kargs);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
+int mem_write_safe_wrapper(struct mali_session_data *session_data, _mali_uk_mem_write_safe_s __user *uargs)
+{
+	_mali_uk_mem_write_safe_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_mem_write_safe_s))) {
+		return -EFAULT;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+
+	/* Check if we can access the buffers */
+	if (!access_ok(VERIFY_WRITE, kargs.dest, kargs.size)
+	    || !access_ok(VERIFY_READ, kargs.src, kargs.size)) {
+		return -EINVAL;
+	}
+
+	/* Check if size wraps */
+	if ((kargs.size + kargs.dest) <= kargs.dest
+	    || (kargs.size + kargs.src) <= kargs.src) {
+		return -EINVAL;
+	}
+
+	err = _mali_ukk_mem_write_safe(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	if (0 != put_user(kargs.size, &uargs->size)) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+
+
+int mem_query_mmu_page_table_dump_size_wrapper(struct mali_session_data *session_data, _mali_uk_query_mmu_page_table_dump_size_s __user *uargs)
+{
+	_mali_uk_query_mmu_page_table_dump_size_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_query_mmu_page_table_dump_size(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	if (0 != put_user(kargs.size, &uargs->size)) return -EFAULT;
+
+	return 0;
+}
+
+int mem_dump_mmu_page_table_wrapper(struct mali_session_data *session_data, _mali_uk_dump_mmu_page_table_s __user *uargs)
+{
+	_mali_uk_dump_mmu_page_table_s kargs;
+	_mali_osk_errcode_t err;
+	void __user *user_buffer;
+	void *buffer = NULL;
+	int rc = -EFAULT;
+
+	/* validate input */
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	/* the session_data pointer was validated by caller */
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_dump_mmu_page_table_s)))
+		goto err_exit;
+
+	user_buffer = (void __user *)(uintptr_t)kargs.buffer;
+	if (!access_ok(VERIFY_WRITE, user_buffer, kargs.size))
+		goto err_exit;
+
+	/* allocate temporary buffer (kernel side) to store mmu page table info */
+	if (kargs.size <= 0)
+		return -EINVAL;
+	/* Allow at most 8MiB buffers, this is more than enough to dump a fully
+	 * populated page table. */
+	if (kargs.size > SZ_8M)
+		return -EINVAL;
+
+	buffer = (void *)(uintptr_t)_mali_osk_valloc(kargs.size);
+	if (NULL == buffer) {
+		rc = -ENOMEM;
+		goto err_exit;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+	kargs.buffer = (uintptr_t)buffer;
+	err = _mali_ukk_dump_mmu_page_table(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		rc = map_errcode(err);
+		goto err_exit;
+	}
+
+	/* copy mmu page table info back to user space and update pointers */
+	if (0 != copy_to_user(user_buffer, buffer, kargs.size))
+		goto err_exit;
+
+	kargs.register_writes = kargs.register_writes -
+				(uintptr_t)buffer + (uintptr_t)user_buffer;
+	kargs.page_table_dump = kargs.page_table_dump -
+				(uintptr_t)buffer + (uintptr_t)user_buffer;
+
+	if (0 != copy_to_user(uargs, &kargs, sizeof(kargs)))
+		goto err_exit;
+
+	rc = 0;
+
+err_exit:
+	if (buffer) _mali_osk_vfree(buffer);
+	return rc;
+}
+
+int mem_usage_get_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_memory_usage_get_s __user *uargs)
+{
+	_mali_osk_errcode_t err;
+	_mali_uk_profiling_memory_usage_get_s kargs;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_profiling_memory_usage_get_s))) {
+		return -EFAULT;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_mem_usage_get(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	kargs.ctx = (uintptr_t)NULL; /* prevent kernel address to be returned to user space */
+	if (0 != copy_to_user(uargs, &kargs, sizeof(_mali_uk_profiling_memory_usage_get_s))) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_pp.c b/drivers/gpu/arm/mali400/linux/mali_ukk_pp.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_pp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_pp.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2010, 2012-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+int pp_start_job_wrapper(struct mali_session_data *session_data, _mali_uk_pp_start_job_s __user *uargs)
+{
+	_mali_osk_errcode_t err;
+
+	/* If the job was started successfully, 0 is returned.  If there was an error, but the job
+	 * was started, we return -ENOENT.  For anything else returned, the job was not started. */
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	err = _mali_ukk_pp_start_job(session_data, uargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	return 0;
+}
+
+int pp_and_gp_start_job_wrapper(struct mali_session_data *session_data, _mali_uk_pp_and_gp_start_job_s __user *uargs)
+{
+	_mali_osk_errcode_t err;
+
+	/* If the jobs were started successfully, 0 is returned.  If there was an error, but the
+	 * jobs were started, we return -ENOENT.  For anything else returned, the jobs were not
+	 * started. */
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	err = _mali_ukk_pp_and_gp_start_job(session_data, uargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	return 0;
+}
+
+int pp_get_number_of_cores_wrapper(struct mali_session_data *session_data, _mali_uk_get_pp_number_of_cores_s __user *uargs)
+{
+	_mali_uk_get_pp_number_of_cores_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+
+	err = _mali_ukk_get_pp_number_of_cores(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	kargs.ctx = (uintptr_t)NULL; /* prevent kernel address to be returned to user space */
+	if (0 != copy_to_user(uargs, &kargs, sizeof(_mali_uk_get_pp_number_of_cores_s))) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+int pp_get_core_version_wrapper(struct mali_session_data *session_data, _mali_uk_get_pp_core_version_s __user *uargs)
+{
+	_mali_uk_get_pp_core_version_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_get_pp_core_version(&kargs);
+	if (_MALI_OSK_ERR_OK != err) return map_errcode(err);
+
+	if (0 != put_user(kargs.version, &uargs->version)) return -EFAULT;
+
+	return 0;
+}
+
+int pp_disable_wb_wrapper(struct mali_session_data *session_data, _mali_uk_pp_disable_wb_s __user *uargs)
+{
+	_mali_uk_pp_disable_wb_s kargs;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session_data, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_pp_disable_wb_s))) return -EFAULT;
+
+	kargs.ctx = (uintptr_t)session_data;
+	_mali_ukk_pp_job_disable_wb(&kargs);
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_profiling.c b/drivers/gpu/arm/mali400/linux/mali_ukk_profiling.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_profiling.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_profiling.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+#include <linux/slab.h>
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+int profiling_add_event_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_add_event_s __user *uargs)
+{
+	_mali_uk_profiling_add_event_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_profiling_add_event_s))) {
+		return -EFAULT;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_profiling_add_event(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
+int profiling_report_sw_counters_wrapper(struct mali_session_data *session_data, _mali_uk_sw_counters_report_s __user *uargs)
+{
+	_mali_uk_sw_counters_report_s kargs;
+	_mali_osk_errcode_t err;
+	u32 *counter_buffer;
+	u32 __user *counters;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_sw_counters_report_s))) {
+		return -EFAULT;
+	}
+
+	/* make sure that kargs.num_counters is [at least somewhat] sane */
+	if (kargs.num_counters > 10000) {
+		MALI_DEBUG_PRINT(1, ("User space attempted to allocate too many counters.\n"));
+		return -EINVAL;
+	}
+
+	counter_buffer = (u32 *)kmalloc(sizeof(u32) * kargs.num_counters, GFP_KERNEL);
+	if (NULL == counter_buffer) {
+		return -ENOMEM;
+	}
+
+	counters = (u32 *)(uintptr_t)kargs.counters;
+
+	if (0 != copy_from_user(counter_buffer, counters, sizeof(u32) * kargs.num_counters)) {
+		kfree(counter_buffer);
+		return -EFAULT;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+	kargs.counters = (uintptr_t)counter_buffer;
+
+	err = _mali_ukk_sw_counters_report(&kargs);
+
+	kfree(counter_buffer);
+
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
+int profiling_get_stream_fd_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_stream_fd_get_s __user *uargs)
+{
+	_mali_uk_profiling_stream_fd_get_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_profiling_stream_fd_get_s))) {
+		return -EFAULT;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_profiling_stream_fd_get(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	if (0 != copy_to_user(uargs, &kargs, sizeof(_mali_uk_profiling_stream_fd_get_s))) {
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+int profiling_control_set_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_control_set_s __user *uargs)
+{
+	_mali_uk_profiling_control_set_s kargs;
+	_mali_osk_errcode_t err;
+	u8 *kernel_control_data = NULL;
+	u8 *kernel_response_data = NULL;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != get_user(kargs.control_packet_size, &uargs->control_packet_size)) return -EFAULT;
+	if (0 != get_user(kargs.response_packet_size, &uargs->response_packet_size)) return -EFAULT;
+
+	kargs.ctx = (uintptr_t)session_data;
+
+
+	/* Sanity check about the size */
+	if (kargs.control_packet_size > PAGE_SIZE || kargs.response_packet_size > PAGE_SIZE)
+		return -EINVAL;
+
+	if (0 !=  kargs.control_packet_size) {
+
+		if (0 == kargs.response_packet_size)
+			return -EINVAL;
+
+		kernel_control_data = _mali_osk_calloc(1, kargs.control_packet_size);
+		if (NULL == kernel_control_data) {
+			return -ENOMEM;
+		}
+
+		kernel_response_data = _mali_osk_calloc(1, kargs.response_packet_size);
+		if (NULL == kernel_response_data) {
+			_mali_osk_free(kernel_control_data);
+			return -ENOMEM;
+		}
+
+		kargs.control_packet_data = (uintptr_t)kernel_control_data;
+		kargs.response_packet_data = (uintptr_t)kernel_response_data;
+
+		if (0 != copy_from_user((void *)(uintptr_t)kernel_control_data, (void *)(uintptr_t)uargs->control_packet_data, kargs.control_packet_size)) {
+			_mali_osk_free(kernel_control_data);
+			_mali_osk_free(kernel_response_data);
+			return -EFAULT;
+		}
+
+		err = _mali_ukk_profiling_control_set(&kargs);
+		if (_MALI_OSK_ERR_OK != err) {
+			_mali_osk_free(kernel_control_data);
+			_mali_osk_free(kernel_response_data);
+			return map_errcode(err);
+		}
+
+		if (0 != kargs.response_packet_size && 0 != copy_to_user(((void *)(uintptr_t)uargs->response_packet_data), ((void *)(uintptr_t)kargs.response_packet_data), kargs.response_packet_size)) {
+			_mali_osk_free(kernel_control_data);
+			_mali_osk_free(kernel_response_data);
+			return -EFAULT;
+		}
+
+		if (0 != put_user(kargs.response_packet_size, &uargs->response_packet_size)) {
+			_mali_osk_free(kernel_control_data);
+			_mali_osk_free(kernel_response_data);
+			return -EFAULT;
+		}
+
+		_mali_osk_free(kernel_control_data);
+		_mali_osk_free(kernel_response_data);
+	} else {
+
+		err = _mali_ukk_profiling_control_set(&kargs);
+		if (_MALI_OSK_ERR_OK != err) {
+			return map_errcode(err);
+		}
+
+	}
+	return 0;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_soft_job.c b/drivers/gpu/arm/mali400/linux/mali_ukk_soft_job.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_soft_job.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_soft_job.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+#include "mali_soft_job.h"
+#include "mali_timeline.h"
+
+int soft_job_start_wrapper(struct mali_session_data *session, _mali_uk_soft_job_start_s __user *uargs)
+{
+	_mali_uk_soft_job_start_s kargs;
+	u32 type, point;
+	u64 user_job;
+	struct mali_timeline_fence fence;
+	struct mali_soft_job *job = NULL;
+	u32 __user *job_id_ptr = NULL;
+
+	/* If the job was started successfully, 0 is returned.  If there was an error, but the job
+	 * was started, we return -ENOENT.  For anything else returned, the job was not started. */
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+	MALI_CHECK_NON_NULL(session, -EINVAL);
+
+	MALI_DEBUG_ASSERT_POINTER(session->soft_job_system);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(kargs))) {
+		return -EFAULT;
+	}
+
+	type = kargs.type;
+	user_job = kargs.user_job;
+	job_id_ptr = (u32 __user *)(uintptr_t)kargs.job_id_ptr;
+
+	mali_timeline_fence_copy_uk_fence(&fence, &kargs.fence);
+
+	if ((MALI_SOFT_JOB_TYPE_USER_SIGNALED != type) && (MALI_SOFT_JOB_TYPE_SELF_SIGNALED != type)) {
+		MALI_DEBUG_PRINT_ERROR(("Invalid soft job type specified\n"));
+		return -EINVAL;
+	}
+
+	/* Create soft job. */
+	job = mali_soft_job_create(session->soft_job_system, (enum mali_soft_job_type)type, user_job);
+	if (unlikely(NULL == job)) {
+		return map_errcode(_MALI_OSK_ERR_NOMEM);
+	}
+
+	/* Write job id back to user space. */
+	if (0 != put_user(job->id, job_id_ptr)) {
+		MALI_PRINT_ERROR(("Mali Soft Job: failed to put job id"));
+		mali_soft_job_destroy(job);
+		return map_errcode(_MALI_OSK_ERR_NOMEM);
+	}
+
+	/* Start soft job. */
+	point = mali_soft_job_start(job, &fence);
+
+	if (0 != put_user(point, &uargs->point)) {
+		/* Let user space know that something failed after the job was started. */
+		return -ENOENT;
+	}
+
+	return 0;
+}
+
+int soft_job_signal_wrapper(struct mali_session_data *session, _mali_uk_soft_job_signal_s __user *uargs)
+{
+	u32 job_id;
+	_mali_osk_errcode_t err;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (0 != get_user(job_id, &uargs->job_id)) return -EFAULT;
+
+	err = mali_soft_job_system_signal_job(session->soft_job_system, job_id);
+
+	return map_errcode(err);
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_timeline.c b/drivers/gpu/arm/mali400/linux/mali_ukk_timeline.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_timeline.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_timeline.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+#include "mali_timeline.h"
+#include "mali_timeline_fence_wait.h"
+#include "mali_timeline_sync_fence.h"
+
+int timeline_get_latest_point_wrapper(struct mali_session_data *session, _mali_uk_timeline_get_latest_point_s __user *uargs)
+{
+	u32 val;
+	mali_timeline_id timeline;
+	mali_timeline_point point;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (0 != get_user(val, &uargs->timeline)) return -EFAULT;
+
+	if (MALI_UK_TIMELINE_MAX <= val) {
+		return -EINVAL;
+	}
+
+	timeline = (mali_timeline_id)val;
+
+	point = mali_timeline_system_get_latest_point(session->timeline_system, timeline);
+
+	if (0 != put_user(point, &uargs->point)) return -EFAULT;
+
+	return 0;
+}
+
+int timeline_wait_wrapper(struct mali_session_data *session, _mali_uk_timeline_wait_s __user *uargs)
+{
+	u32 timeout, status;
+	mali_bool ret;
+	_mali_uk_fence_t uk_fence;
+	struct mali_timeline_fence fence;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (0 != copy_from_user(&uk_fence, &uargs->fence, sizeof(_mali_uk_fence_t))) return -EFAULT;
+	if (0 != get_user(timeout, &uargs->timeout)) return -EFAULT;
+
+	mali_timeline_fence_copy_uk_fence(&fence, &uk_fence);
+
+	ret = mali_timeline_fence_wait(session->timeline_system, &fence, timeout);
+	status = (MALI_TRUE == ret ? 1 : 0);
+
+	if (0 != put_user(status, &uargs->status)) return -EFAULT;
+
+	return 0;
+}
+
+int timeline_create_sync_fence_wrapper(struct mali_session_data *session, _mali_uk_timeline_create_sync_fence_s __user *uargs)
+{
+	s32 sync_fd = -1;
+	_mali_uk_fence_t uk_fence;
+	struct mali_timeline_fence fence;
+
+	MALI_DEBUG_ASSERT_POINTER(session);
+
+	if (0 != copy_from_user(&uk_fence, &uargs->fence, sizeof(_mali_uk_fence_t))) return -EFAULT;
+	mali_timeline_fence_copy_uk_fence(&fence, &uk_fence);
+
+#if defined(CONFIG_SYNC)
+	sync_fd = mali_timeline_sync_fence_create(session->timeline_system, &fence);
+#else
+	sync_fd = -1;
+#endif /* defined(CONFIG_SYNC) */
+
+	if (0 != put_user(sync_fd, &uargs->sync_fd)) return -EFAULT;
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_vsync.c b/drivers/gpu/arm/mali400/linux/mali_ukk_vsync.c
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_vsync.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_vsync.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+#include <linux/fs.h>       /* file system operations */
+#include <asm/uaccess.h>    /* user space access */
+
+#include "mali_ukk.h"
+#include "mali_osk.h"
+#include "mali_kernel_common.h"
+#include "mali_session.h"
+#include "mali_ukk_wrappers.h"
+
+
+int vsync_event_report_wrapper(struct mali_session_data *session_data, _mali_uk_vsync_event_report_s __user *uargs)
+{
+	_mali_uk_vsync_event_report_s kargs;
+	_mali_osk_errcode_t err;
+
+	MALI_CHECK_NON_NULL(uargs, -EINVAL);
+
+	if (0 != copy_from_user(&kargs, uargs, sizeof(_mali_uk_vsync_event_report_s))) {
+		return -EFAULT;
+	}
+
+	kargs.ctx = (uintptr_t)session_data;
+	err = _mali_ukk_vsync_event_report(&kargs);
+	if (_MALI_OSK_ERR_OK != err) {
+		return map_errcode(err);
+	}
+
+	return 0;
+}
+
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_ukk_wrappers.h b/drivers/gpu/arm/mali400/linux/mali_ukk_wrappers.h
--- a/drivers/gpu/arm/mali400/linux/mali_ukk_wrappers.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_ukk_wrappers.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_ukk_wrappers.h
+ * Defines the wrapper functions for each user-kernel function
+ */
+
+#ifndef __MALI_UKK_WRAPPERS_H__
+#define __MALI_UKK_WRAPPERS_H__
+
+#include "mali_uk_types.h"
+#include "mali_osk.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int wait_for_notification_wrapper(struct mali_session_data *session_data, _mali_uk_wait_for_notification_s __user *uargs);
+int get_api_version_wrapper(struct mali_session_data *session_data, _mali_uk_get_api_version_s __user *uargs);
+int get_api_version_v2_wrapper(struct mali_session_data *session_data, _mali_uk_get_api_version_v2_s __user *uargs);
+int get_user_settings_wrapper(struct mali_session_data *session_data, _mali_uk_get_user_settings_s __user *uargs);
+int post_notification_wrapper(struct mali_session_data *session_data, _mali_uk_post_notification_s __user *uargs);
+int request_high_priority_wrapper(struct mali_session_data *session_data, _mali_uk_request_high_priority_s __user *uargs);
+int pending_submit_wrapper(struct mali_session_data *session_data, _mali_uk_pending_submit_s __user *uargs);
+
+int mem_alloc_wrapper(struct mali_session_data *session_data, _mali_uk_alloc_mem_s __user *uargs);
+int mem_free_wrapper(struct mali_session_data *session_data, _mali_uk_free_mem_s __user *uargs);
+int mem_bind_wrapper(struct mali_session_data *session_data, _mali_uk_bind_mem_s __user *uargs);
+int mem_unbind_wrapper(struct mali_session_data *session_data, _mali_uk_unbind_mem_s __user *uargs);
+int mem_cow_wrapper(struct mali_session_data *session_data, _mali_uk_cow_mem_s __user *uargs);
+int mem_cow_modify_range_wrapper(struct mali_session_data *session_data, _mali_uk_cow_modify_range_s __user *uargs);
+int mem_resize_mem_wrapper(struct mali_session_data *session_data, _mali_uk_mem_resize_s __user *uargs);
+int mem_write_safe_wrapper(struct mali_session_data *session_data, _mali_uk_mem_write_safe_s __user *uargs);
+int mem_query_mmu_page_table_dump_size_wrapper(struct mali_session_data *session_data, _mali_uk_query_mmu_page_table_dump_size_s __user *uargs);
+int mem_dump_mmu_page_table_wrapper(struct mali_session_data *session_data, _mali_uk_dump_mmu_page_table_s __user *uargs);
+int mem_usage_get_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_memory_usage_get_s __user *uargs);
+
+int timeline_get_latest_point_wrapper(struct mali_session_data *session, _mali_uk_timeline_get_latest_point_s __user *uargs);
+int timeline_wait_wrapper(struct mali_session_data *session, _mali_uk_timeline_wait_s __user *uargs);
+int timeline_create_sync_fence_wrapper(struct mali_session_data *session, _mali_uk_timeline_create_sync_fence_s __user *uargs);
+int soft_job_start_wrapper(struct mali_session_data *session, _mali_uk_soft_job_start_s __user *uargs);
+int soft_job_signal_wrapper(struct mali_session_data *session, _mali_uk_soft_job_signal_s __user *uargs);
+int pp_start_job_wrapper(struct mali_session_data *session_data, _mali_uk_pp_start_job_s __user *uargs);
+int pp_and_gp_start_job_wrapper(struct mali_session_data *session_data, _mali_uk_pp_and_gp_start_job_s __user *uargs);
+int pp_get_number_of_cores_wrapper(struct mali_session_data *session_data, _mali_uk_get_pp_number_of_cores_s __user *uargs);
+int pp_get_core_version_wrapper(struct mali_session_data *session_data, _mali_uk_get_pp_core_version_s __user *uargs);
+int pp_disable_wb_wrapper(struct mali_session_data *session_data, _mali_uk_pp_disable_wb_s __user *uargs);
+int gp_start_job_wrapper(struct mali_session_data *session_data, _mali_uk_gp_start_job_s __user *uargs);
+int gp_get_number_of_cores_wrapper(struct mali_session_data *session_data, _mali_uk_get_gp_number_of_cores_s __user *uargs);
+int gp_get_core_version_wrapper(struct mali_session_data *session_data, _mali_uk_get_gp_core_version_s __user *uargs);
+int gp_suspend_response_wrapper(struct mali_session_data *session_data, _mali_uk_gp_suspend_response_s __user *uargs);
+
+int profiling_add_event_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_add_event_s __user *uargs);
+int profiling_report_sw_counters_wrapper(struct mali_session_data *session_data, _mali_uk_sw_counters_report_s __user *uargs);
+int profiling_get_stream_fd_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_stream_fd_get_s __user *uargs);
+int profiling_control_set_wrapper(struct mali_session_data *session_data, _mali_uk_profiling_control_set_s __user *uargs);
+
+int vsync_event_report_wrapper(struct mali_session_data *session_data, _mali_uk_vsync_event_report_s __user *uargs);
+
+
+int map_errcode(_mali_osk_errcode_t err);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __MALI_UKK_WRAPPERS_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/linux/mali_uk_types.h b/drivers/gpu/arm/mali400/linux/mali_uk_types.h
--- a/drivers/gpu/arm/mali400/linux/mali_uk_types.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/linux/mali_uk_types.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2012, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_UK_TYPES_H__
+#define __MALI_UK_TYPES_H__
+
+/* Simple wrapper in order to find the OS specific location of this file */
+#include <linux/mali/mali_utgard_uk_types.h>
+
+#endif /* __MALI_UK_TYPES_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/Makefile b/drivers/gpu/arm/mali400/Makefile
--- a/drivers/gpu/arm/mali400/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/Makefile	2018-05-06 08:49:49.174695256 +0200
@@ -0,0 +1,206 @@
+#
+# Copyright (C) 2010-2016 ARM Limited. All rights reserved.
+#
+# This program is free software and is provided to you under the terms of the GNU General Public License version 2
+# as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+#
+# A copy of the licence is included with the program, and can also be obtained from Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+
+USE_UMPV2=0
+USING_PROFILING ?= 1
+USING_INTERNAL_PROFILING ?= 0
+USING_DVFS ?= 1
+USING_DMA_BUF_FENCE ?= 0
+MALI_HEATMAPS_ENABLED ?= 0
+MALI_DMA_BUF_MAP_ON_ATTACH ?= 1
+MALI_PMU_PARALLEL_POWER_UP ?= 0
+USING_DT ?= 0
+MALI_MEM_SWAP_TRACKING ?= 0
+USING_DEVFREQ ?= 0
+
+# The Makefile sets up "arch" based on the CONFIG, creates the version info
+# string and the __malidrv_build_info.c file, and then call the Linux build
+# system to actually build the driver. After that point the Kbuild file takes
+# over.
+
+# set up defaults if not defined by the user
+ARCH ?= arm
+
+OSKOS=linux
+FILES_PREFIX=
+
+check_cc2 = \
+	$(shell if $(1) -S -o /dev/null -xc /dev/null > /dev/null 2>&1; \
+	then \
+		echo "$(2)"; \
+	else \
+		echo "$(3)"; \
+	fi ;)
+
+# This conditional makefile exports the global definition ARM_INTERNAL_BUILD. Customer releases will not include arm_internal.mak
+-include ../../../arm_internal.mak
+
+# Give warning of old config parameters are used
+ifneq ($(CONFIG),)
+$(warning "You have specified the CONFIG variable which is no longer in used. Use TARGET_PLATFORM instead.")
+endif
+
+ifneq ($(CPU),)
+$(warning "You have specified the CPU variable which is no longer in used. Use TARGET_PLATFORM instead.")
+endif
+
+# Include the mapping between TARGET_PLATFORM and KDIR + MALI_PLATFORM
+-include MALI_CONFIGURATION
+export KDIR ?= $(KDIR-$(TARGET_PLATFORM))
+export MALI_PLATFORM ?= $(MALI_PLATFORM-$(TARGET_PLATFORM))
+
+ifneq ($(TARGET_PLATFORM),)
+ifeq ($(MALI_PLATFORM),)
+$(error "Invalid TARGET_PLATFORM: $(TARGET_PLATFORM)")
+endif
+endif
+
+# validate lookup result
+ifeq ($(KDIR),)
+$(error No KDIR found for platform $(TARGET_PLATFORM))
+endif
+
+ifeq ($(USING_GPU_UTILIZATION), 1)
+    ifeq ($(USING_DVFS), 1)
+        $(error USING_GPU_UTILIZATION conflict with USING_DVFS you can read the Integration Guide to choose which one do you need)
+    endif
+endif
+
+ifeq ($(USING_UMP),1)
+export CONFIG_MALI400_UMP=y
+export EXTRA_DEFINES += -DCONFIG_MALI400_UMP=1
+ifeq ($(USE_UMPV2),1)
+UMP_SYMVERS_FILE ?= ../umpv2/Module.symvers
+else
+UMP_SYMVERS_FILE ?= ../ump/Module.symvers
+endif
+KBUILD_EXTRA_SYMBOLS = $(realpath $(UMP_SYMVERS_FILE))
+$(warning $(KBUILD_EXTRA_SYMBOLS))
+endif
+
+# Define host system directory
+KDIR-$(shell uname -m):=/lib/modules/$(shell uname -r)/build
+
+include $(KDIR)/.config
+
+ifeq ($(ARCH), arm)
+# when compiling for ARM we're cross compiling
+export CROSS_COMPILE ?= $(call check_cc2, arm-linux-gnueabi-gcc, arm-linux-gnueabi-, arm-none-linux-gnueabi-)
+endif
+
+# report detected/selected settings
+ifdef ARM_INTERNAL_BUILD
+$(warning TARGET_PLATFORM $(TARGET_PLATFORM))
+$(warning KDIR $(KDIR))
+$(warning MALI_PLATFORM $(MALI_PLATFORM))
+endif
+
+# Set up build config
+export CONFIG_MALI400=m
+export CONFIG_MALI450=y
+export CONFIG_MALI470=y
+
+export EXTRA_DEFINES += -DCONFIG_MALI400=1
+export EXTRA_DEFINES += -DCONFIG_MALI450=1
+export EXTRA_DEFINES += -DCONFIG_MALI470=1
+
+ifneq ($(MALI_PLATFORM),)
+export EXTRA_DEFINES += -DMALI_FAKE_PLATFORM_DEVICE=1
+export MALI_PLATFORM_FILES = $(wildcard platform/$(MALI_PLATFORM)/*.c)
+endif
+
+ifeq ($(USING_PROFILING),1)
+ifeq ($(CONFIG_TRACEPOINTS),)
+$(warning CONFIG_TRACEPOINTS required for profiling)
+else
+export CONFIG_MALI400_PROFILING=y
+export EXTRA_DEFINES += -DCONFIG_MALI400_PROFILING=1
+ifeq ($(USING_INTERNAL_PROFILING),1)
+export CONFIG_MALI400_INTERNAL_PROFILING=y
+export EXTRA_DEFINES += -DCONFIG_MALI400_INTERNAL_PROFILING=1
+endif
+ifeq ($(MALI_HEATMAPS_ENABLED),1)
+export MALI_HEATMAPS_ENABLED=y
+export EXTRA_DEFINES += -DCONFIG_MALI400_HEATMAPS_ENABLED
+endif
+endif
+endif
+
+ifeq ($(MALI_DMA_BUF_MAP_ON_ATTACH),1)
+export CONFIG_MALI_DMA_BUF_MAP_ON_ATTACH=y
+export EXTRA_DEFINES += -DCONFIG_MALI_DMA_BUF_MAP_ON_ATTACH
+endif
+
+ifeq ($(MALI_SHARED_INTERRUPTS),1)
+export CONFIG_MALI_SHARED_INTERRUPTS=y
+export EXTRA_DEFINES += -DCONFIG_MALI_SHARED_INTERRUPTS
+endif
+
+ifeq ($(USING_DVFS),1)
+export CONFIG_MALI_DVFS=y
+export EXTRA_DEFINES += -DCONFIG_MALI_DVFS
+endif
+
+ifeq ($(USING_DMA_BUF_FENCE),1)
+export CONFIG_MALI_DMA_BUF_FENCE=y
+export EXTRA_DEFINES += -DCONFIG_MALI_DMA_BUF_FENCE
+endif
+
+ifeq ($(MALI_PMU_PARALLEL_POWER_UP),1)
+export CONFIG_MALI_PMU_PARALLEL_POWER_UP=y
+export EXTRA_DEFINES += -DCONFIG_MALI_PMU_PARALLEL_POWER_UP
+endif
+
+ifdef CONFIG_OF
+ifeq ($(USING_DT),1)
+export CONFIG_MALI_DT=y
+export EXTRA_DEFINES += -DCONFIG_MALI_DT
+endif
+endif
+
+ifeq ($(USING_DEVFREQ), 1)
+ifdef CONFIG_PM_DEVFREQ
+export CONFIG_MALI_DEVFREQ=y
+export EXTRA_DEFINES += -DCONFIG_MALI_DEVFREQ=1
+else
+$(warning "You want to support DEVFREQ but kernel didn't support DEVFREQ.")
+endif
+endif
+
+ifneq ($(BUILD),release)
+# Debug
+export CONFIG_MALI400_DEBUG=y
+else
+# Release
+ifeq ($(MALI_QUIET),1)
+export CONFIG_MALI_QUIET=y
+export EXTRA_DEFINES += -DCONFIG_MALI_QUIET
+endif
+endif
+
+ifeq ($(MALI_SKIP_JOBS),1)
+EXTRA_DEFINES += -DPROFILING_SKIP_PP_JOBS=1 -DPROFILING_SKIP_GP_JOBS=1
+endif
+
+ifeq ($(MALI_MEM_SWAP_TRACKING),1)
+EXTRA_DEFINES += -DMALI_MEM_SWAP_TRACKING=1
+endif
+
+all: $(UMP_SYMVERS_FILE)
+	$(MAKE) ARCH=$(ARCH) -C $(KDIR) M=$(CURDIR) modules
+	@rm $(FILES_PREFIX)__malidrv_build_info.c $(FILES_PREFIX)__malidrv_build_info.o
+
+clean:
+	$(MAKE) ARCH=$(ARCH) -C $(KDIR) M=$(CURDIR) clean
+
+kernelrelease:
+	$(MAKE) ARCH=$(ARCH) -C $(KDIR) kernelrelease
+
+export CONFIG KBUILD_EXTRA_SYMBOLS
diff -ENwbur a/drivers/gpu/arm/mali400/platform/arm/arm.c b/drivers/gpu/arm/mali400/platform/arm/arm.c
--- a/drivers/gpu/arm/mali400/platform/arm/arm.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/arm/arm.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,623 @@
+/*
+ * Copyright (C) 2010, 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file mali_platform.c
+ * Platform specific Mali driver functions for:
+ * - Realview Versatile platforms with ARM11 Mpcore and virtex 5.
+ * - Versatile Express platforms with ARM Cortex-A9 and virtex 6.
+ */
+#include <linux/platform_device.h>
+#include <linux/version.h>
+#include <linux/pm.h>
+#include "mali_kernel_linux.h"
+#ifdef CONFIG_PM_RUNTIME
+#include <linux/pm_runtime.h>
+#endif
+#include <asm/io.h>
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_common.h"
+#include <linux/dma-mapping.h>
+#include <linux/moduleparam.h>
+
+#include "arm_core_scaling.h"
+#include "mali_executor.h"
+
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+#include <linux/devfreq_cooling.h>
+#include <linux/thermal.h>
+#endif
+
+static int mali_core_scaling_enable = 0;
+
+void mali_gpu_utilization_callback(struct mali_gpu_utilization_data *data);
+static u32 mali_read_phys(u32 phys_addr);
+#if defined(CONFIG_ARCH_REALVIEW)
+static void mali_write_phys(u32 phys_addr, u32 value);
+#endif
+
+#if defined(CONFIG_ARCH_VEXPRESS) && defined(CONFIG_ARM64)
+
+#define SECURE_MODE_CONTROL_HANDLER     0x6F02006C
+void *secure_mode_mapped_addr = NULL;
+/**
+ * Reset GPU and enable/disable Mali secure mode.
+ * @Return value:
+ * 0: success
+ * non-0: failure.
+ */
+
+static int mali_gpu_reset_and_secure_mode_enable_juno(void)
+{
+	u32 phys_offset    = SECURE_MODE_CONTROL_HANDLER & 0x00001FFF;
+	MALI_DEBUG_ASSERT(NULL != secure_mode_mapped_addr);
+
+	iowrite32(1, ((u8 *)secure_mode_mapped_addr) + phys_offset);
+
+	if (1 == (u32)ioread32(((u8 *)secure_mode_mapped_addr) + phys_offset)) {
+		MALI_DEBUG_PRINT(3, ("Mali reset GPU and enable secured mode successfully! \n"));
+		return 0;
+	}
+
+	MALI_PRINT_ERROR(("Failed to reset GPU and enable Mali secured mode !!! \n"));
+
+	return -1;
+
+}
+
+static int mali_gpu_reset_and_secure_mode_disable_juno(void)
+{
+	u32 phys_offset    = SECURE_MODE_CONTROL_HANDLER & 0x00001FFF;
+	MALI_DEBUG_ASSERT(NULL != secure_mode_mapped_addr);
+
+	iowrite32(0, ((u8 *)secure_mode_mapped_addr) + phys_offset);
+
+	if (0 == (u32)ioread32(((u8 *)secure_mode_mapped_addr) + phys_offset)) {
+		MALI_DEBUG_PRINT(3, ("Mali reset GPU and disable secured mode successfully! \n"));
+		return 0;
+	}
+
+	MALI_PRINT_ERROR(("Failed to reset GPU and disable mali secured mode !!! \n"));
+	return -1;
+}
+
+static int mali_secure_mode_init_juno(void)
+{
+	u32 phys_addr_page = SECURE_MODE_CONTROL_HANDLER & 0xFFFFE000;
+	u32 phys_offset    = SECURE_MODE_CONTROL_HANDLER & 0x00001FFF;
+	u32 map_size       = phys_offset + sizeof(u32);
+
+	MALI_DEBUG_ASSERT(NULL == secure_mode_mapped_addr);
+
+	secure_mode_mapped_addr = ioremap_nocache(phys_addr_page, map_size);
+	if (NULL != secure_mode_mapped_addr) {
+		return mali_gpu_reset_and_secure_mode_disable_juno();
+	}
+	MALI_DEBUG_PRINT(2, ("Failed to ioremap for Mali secured mode! \n"));
+	return -1;
+}
+
+static void mali_secure_mode_deinit_juno(void)
+{
+	if (NULL != secure_mode_mapped_addr) {
+		mali_gpu_reset_and_secure_mode_disable_juno();
+		iounmap(secure_mode_mapped_addr);
+		secure_mode_mapped_addr = NULL;
+	}
+}
+#endif
+
+#ifndef CONFIG_MALI_DT
+static void mali_platform_device_release(struct device *device);
+
+#if defined(CONFIG_ARCH_VEXPRESS)
+
+#if defined(CONFIG_ARM64)
+/* Juno + Mali-450 MP6 in V7 FPGA */
+static struct resource mali_gpu_resources_m450_mp6[] = {
+	MALI_GPU_RESOURCES_MALI450_MP6_PMU(0x6F040000, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200)
+};
+
+static struct resource mali_gpu_resources_m470_mp4[] = {
+	MALI_GPU_RESOURCES_MALI470_MP4_PMU(0x6F040000, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200, 200)
+};
+
+static struct resource mali_gpu_resources_m470_mp3[] = {
+	MALI_GPU_RESOURCES_MALI470_MP3_PMU(0x6F040000, 200, 200, 200, 200, 200, 200, 200, 200, 200)
+};
+
+static struct resource mali_gpu_resources_m470_mp2[] = {
+	MALI_GPU_RESOURCES_MALI470_MP2_PMU(0x6F040000, 200, 200, 200, 200, 200, 200, 200)
+};
+
+static struct resource mali_gpu_resources_m470_mp1[] = {
+	MALI_GPU_RESOURCES_MALI470_MP1_PMU(0x6F040000, 200, 200, 200, 200, 200)
+};
+
+#else
+static struct resource mali_gpu_resources_m450_mp8[] = {
+	MALI_GPU_RESOURCES_MALI450_MP8_PMU(0xFC040000, -1, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 68)
+};
+
+static struct resource mali_gpu_resources_m450_mp6[] = {
+	MALI_GPU_RESOURCES_MALI450_MP6_PMU(0xFC040000, -1, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 70, 68)
+};
+
+static struct resource mali_gpu_resources_m450_mp4[] = {
+	MALI_GPU_RESOURCES_MALI450_MP4_PMU(0xFC040000, -1, 70, 70, 70, 70, 70, 70, 70, 70, 70, 68)
+};
+
+static struct resource mali_gpu_resources_m470_mp4[] = {
+	MALI_GPU_RESOURCES_MALI470_MP4_PMU(0xFC040000, -1, 70, 70, 70, 70, 70, 70, 70, 70, 70, 68)
+};
+#endif /* CONFIG_ARM64 */
+
+#elif defined(CONFIG_ARCH_REALVIEW)
+
+static struct resource mali_gpu_resources_m300[] = {
+	MALI_GPU_RESOURCES_MALI300_PMU(0xC0000000, -1, -1, -1, -1)
+};
+
+static struct resource mali_gpu_resources_m400_mp1[] = {
+	MALI_GPU_RESOURCES_MALI400_MP1_PMU(0xC0000000, -1, -1, -1, -1)
+};
+
+static struct resource mali_gpu_resources_m400_mp2[] = {
+	MALI_GPU_RESOURCES_MALI400_MP2_PMU(0xC0000000, -1, -1, -1, -1, -1, -1)
+};
+
+#endif
+#endif
+
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+
+#define FALLBACK_STATIC_TEMPERATURE 55000
+
+static struct thermal_zone_device *gpu_tz;
+
+/* Calculate gpu static power example for reference */
+static unsigned long arm_model_static_power(unsigned long voltage)
+{
+	int temperature, temp;
+	int temp_squared, temp_cubed, temp_scaling_factor;
+	const unsigned long coefficient = (410UL << 20) / (729000000UL >> 10);
+	const unsigned long voltage_cubed = (voltage * voltage * voltage) >> 10;
+	unsigned long static_power;
+
+	if (gpu_tz) {
+		int ret;
+
+		ret = gpu_tz->ops->get_temp(gpu_tz, &temperature);
+		if (ret) {
+			MALI_DEBUG_PRINT(2, ("Error reading temperature for gpu thermal zone: %d\n", ret));
+			temperature = FALLBACK_STATIC_TEMPERATURE;
+		}
+	} else {
+		temperature = FALLBACK_STATIC_TEMPERATURE;
+	}
+
+	/* Calculate the temperature scaling factor. To be applied to the
+	 * voltage scaled power.
+	 */
+	temp = temperature / 1000;
+	temp_squared = temp * temp;
+	temp_cubed = temp_squared * temp;
+	temp_scaling_factor =
+		(2 * temp_cubed)
+		- (80 * temp_squared)
+		+ (4700 * temp)
+		+ 32000;
+
+	static_power = (((coefficient * voltage_cubed) >> 20)
+			* temp_scaling_factor)
+		       / 1000000;
+
+	return static_power;
+}
+
+/* Calculate gpu dynamic power example for reference */
+static unsigned long arm_model_dynamic_power(unsigned long freq,
+		unsigned long voltage)
+{
+	/* The inputs: freq (f) is in Hz, and voltage (v) in mV.
+	 * The coefficient (c) is in mW/(MHz mV mV).
+	 *
+	 * This function calculates the dynamic power after this formula:
+	 * Pdyn (mW) = c (mW/(MHz*mV*mV)) * v (mV) * v (mV) * f (MHz)
+	 */
+	const unsigned long v2 = (voltage * voltage) / 1000; /* m*(V*V) */
+	const unsigned long f_mhz = freq / 1000000; /* MHz */
+	const unsigned long coefficient = 3600; /* mW/(MHz*mV*mV) */
+	unsigned long dynamic_power;
+
+	dynamic_power = (coefficient * v2 * f_mhz) / 1000000; /* mW */
+
+	return dynamic_power;
+}
+
+struct devfreq_cooling_power arm_cooling_ops = {
+	.get_static_power = arm_model_static_power,
+	.get_dynamic_power = arm_model_dynamic_power,
+};
+#endif
+
+static struct mali_gpu_device_data mali_gpu_data = {
+#ifndef CONFIG_MALI_DT
+	.pmu_switch_delay = 0xFF, /* do not have to be this high on FPGA, but it is good for testing to have a delay */
+#if defined(CONFIG_ARCH_VEXPRESS)
+	.shared_mem_size = 256 * 1024 * 1024, /* 256MB */
+#endif
+#endif
+	.max_job_runtime = 60000, /* 60 seconds */
+
+#if defined(CONFIG_ARCH_REALVIEW)
+	.dedicated_mem_start = 0x80000000, /* Physical start address (use 0xD0000000 for old indirect setup) */
+	.dedicated_mem_size = 0x10000000, /* 256MB */
+#endif
+#if defined(CONFIG_ARM64)
+	/* Some framebuffer drivers get the framebuffer dynamically, such as through GEM,
+	* in which the memory resource can't be predicted in advance.
+	*/
+	.fb_start = 0x0,
+	.fb_size = 0xFFFFF000,
+#else
+	.fb_start = 0xe0000000,
+	.fb_size = 0x01000000,
+#endif
+	.control_interval = 1000, /* 1000ms */
+	.utilization_callback = mali_gpu_utilization_callback,
+	.get_clock_info = NULL,
+	.get_freq = NULL,
+	.set_freq = NULL,
+#if defined(CONFIG_ARCH_VEXPRESS) && defined(CONFIG_ARM64)
+	.secure_mode_init = mali_secure_mode_init_juno,
+	.secure_mode_deinit = mali_secure_mode_deinit_juno,
+	.gpu_reset_and_secure_mode_enable = mali_gpu_reset_and_secure_mode_enable_juno,
+	.gpu_reset_and_secure_mode_disable = mali_gpu_reset_and_secure_mode_disable_juno,
+#else
+	.secure_mode_init = NULL,
+	.secure_mode_deinit = NULL,
+	.gpu_reset_and_secure_mode_enable = NULL,
+	.gpu_reset_and_secure_mode_disable = NULL,
+#endif
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+	.gpu_cooling_ops = &arm_cooling_ops,
+#endif
+};
+
+#ifndef CONFIG_MALI_DT
+static struct platform_device mali_gpu_device = {
+	.name = MALI_GPU_NAME_UTGARD,
+	.id = 0,
+	.dev.release = mali_platform_device_release,
+	.dev.dma_mask = &mali_gpu_device.dev.coherent_dma_mask,
+	.dev.coherent_dma_mask = DMA_BIT_MASK(32),
+
+	.dev.platform_data = &mali_gpu_data,
+};
+
+int mali_platform_device_register(void)
+{
+	int err = -1;
+	int num_pp_cores = 0;
+#if defined(CONFIG_ARCH_REALVIEW)
+	u32 m400_gp_version;
+#endif
+
+	MALI_DEBUG_PRINT(4, ("mali_platform_device_register() called\n"));
+
+	/* Detect present Mali GPU and connect the correct resources to the device */
+#if defined(CONFIG_ARCH_VEXPRESS)
+
+#if defined(CONFIG_ARM64)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
+	mali_gpu_device.dev.archdata.dma_ops = &dummy_dma_ops;
+#else
+	mali_gpu_device.dev.archdata.dma_ops = dma_ops;
+#endif
+	if ((mali_read_phys(0x6F000000) & 0x00600450) == 0x00600450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP6 device\n"));
+		num_pp_cores = 6;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m450_mp6);
+		mali_gpu_device.resource = mali_gpu_resources_m450_mp6;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00400430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP4 device\n"));
+		num_pp_cores = 4;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m470_mp4);
+		mali_gpu_device.resource = mali_gpu_resources_m470_mp4;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00300430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP3 device\n"));
+		num_pp_cores = 3;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m470_mp3);
+		mali_gpu_device.resource = mali_gpu_resources_m470_mp3;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00200430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP2 device\n"));
+		num_pp_cores = 2;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m470_mp2);
+		mali_gpu_device.resource = mali_gpu_resources_m470_mp2;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00100430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP1 device\n"));
+		num_pp_cores = 1;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m470_mp1);
+		mali_gpu_device.resource = mali_gpu_resources_m470_mp1;
+	}
+#else
+	if (mali_read_phys(0xFC000000) == 0x00000450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP8 device\n"));
+		num_pp_cores = 8;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m450_mp8);
+		mali_gpu_device.resource = mali_gpu_resources_m450_mp8;
+	} else if (mali_read_phys(0xFC000000) == 0x40600450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP6 device\n"));
+		num_pp_cores = 6;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m450_mp6);
+		mali_gpu_device.resource = mali_gpu_resources_m450_mp6;
+	} else if (mali_read_phys(0xFC000000) == 0x40400450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP4 device\n"));
+		num_pp_cores = 4;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m450_mp4);
+		mali_gpu_device.resource = mali_gpu_resources_m450_mp4;
+	} else if (mali_read_phys(0xFC000000) == 0xFFFFFFFF) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP4 device\n"));
+		num_pp_cores = 4;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m470_mp4);
+		mali_gpu_device.resource = mali_gpu_resources_m470_mp4;
+	}
+#endif /* CONFIG_ARM64 */
+
+#elif defined(CONFIG_ARCH_REALVIEW)
+
+	m400_gp_version = mali_read_phys(0xC000006C);
+	if ((m400_gp_version & 0xFFFF0000) == 0x0C070000) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-300 device\n"));
+		num_pp_cores = 1;
+		mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m300);
+		mali_gpu_device.resource = mali_gpu_resources_m300;
+		mali_write_phys(0xC0010020, 0xA); /* Enable direct memory mapping for FPGA */
+	} else if ((m400_gp_version & 0xFFFF0000) == 0x0B070000) {
+		u32 fpga_fw_version = mali_read_phys(0xC0010000);
+		if (fpga_fw_version == 0x130C008F || fpga_fw_version == 0x110C008F) {
+			/* Mali-400 MP1 r1p0 or r1p1 */
+			MALI_DEBUG_PRINT(4, ("Registering Mali-400 MP1 device\n"));
+			num_pp_cores = 1;
+			mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m400_mp1);
+			mali_gpu_device.resource = mali_gpu_resources_m400_mp1;
+			mali_write_phys(0xC0010020, 0xA); /* Enable direct memory mapping for FPGA */
+		} else if (fpga_fw_version == 0x130C000F) {
+			/* Mali-400 MP2 r1p1 */
+			MALI_DEBUG_PRINT(4, ("Registering Mali-400 MP2 device\n"));
+			num_pp_cores = 2;
+			mali_gpu_device.num_resources = ARRAY_SIZE(mali_gpu_resources_m400_mp2);
+			mali_gpu_device.resource = mali_gpu_resources_m400_mp2;
+			mali_write_phys(0xC0010020, 0xA); /* Enable direct memory mapping for FPGA */
+		}
+	}
+
+#endif
+	/* Register the platform device */
+	err = platform_device_register(&mali_gpu_device);
+	if (0 == err) {
+#ifdef CONFIG_PM_RUNTIME
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37))
+		pm_runtime_set_autosuspend_delay(&(mali_gpu_device.dev), 1000);
+		pm_runtime_use_autosuspend(&(mali_gpu_device.dev));
+#endif
+		pm_runtime_enable(&(mali_gpu_device.dev));
+#endif
+		MALI_DEBUG_ASSERT(0 < num_pp_cores);
+		mali_core_scaling_init(num_pp_cores);
+
+		return 0;
+	}
+
+	return err;
+}
+
+void mali_platform_device_unregister(void)
+{
+	MALI_DEBUG_PRINT(4, ("mali_platform_device_unregister() called\n"));
+
+	mali_core_scaling_term();
+#ifdef CONFIG_PM_RUNTIME
+	pm_runtime_disable(&(mali_gpu_device.dev));
+#endif
+	platform_device_unregister(&mali_gpu_device);
+
+	platform_device_put(&mali_gpu_device);
+
+#if defined(CONFIG_ARCH_REALVIEW)
+	mali_write_phys(0xC0010020, 0x9); /* Restore default (legacy) memory mapping */
+#endif
+}
+
+static void mali_platform_device_release(struct device *device)
+{
+	MALI_DEBUG_PRINT(4, ("mali_platform_device_release() called\n"));
+}
+
+#else /* CONFIG_MALI_DT */
+int mali_platform_device_init(struct platform_device *device)
+{
+	int num_pp_cores = 0;
+	int err = -1;
+#if defined(CONFIG_ARCH_REALVIEW)
+	u32 m400_gp_version;
+#endif
+
+	/* Detect present Mali GPU and connect the correct resources to the device */
+#if defined(CONFIG_ARCH_VEXPRESS)
+
+#if defined(CONFIG_ARM64)
+	if ((mali_read_phys(0x6F000000) & 0x00600450) == 0x00600450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP6 device\n"));
+		num_pp_cores = 6;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00400430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP4 device\n"));
+		num_pp_cores = 4;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00300430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP3 device\n"));
+		num_pp_cores = 3;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00200430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP2 device\n"));
+		num_pp_cores = 2;
+	} else if ((mali_read_phys(0x6F000000) & 0x00F00430) == 0x00100430) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP1 device\n"));
+		num_pp_cores = 1;
+	}
+#else
+	if (mali_read_phys(0xFC000000) == 0x00000450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP8 device\n"));
+		num_pp_cores = 8;
+	} else if (mali_read_phys(0xFC000000) == 0x40400450) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-450 MP4 device\n"));
+		num_pp_cores = 4;
+	} else if (mali_read_phys(0xFC000000) == 0xFFFFFFFF) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-470 MP4 device\n"));
+		num_pp_cores = 4;
+	}
+#endif
+
+#elif defined(CONFIG_ARCH_REALVIEW)
+
+	m400_gp_version = mali_read_phys(0xC000006C);
+	if ((m400_gp_version & 0xFFFF0000) == 0x0C070000) {
+		MALI_DEBUG_PRINT(4, ("Registering Mali-300 device\n"));
+		num_pp_cores = 1;
+		mali_write_phys(0xC0010020, 0xA); /* Enable direct memory mapping for FPGA */
+	} else if ((m400_gp_version & 0xFFFF0000) == 0x0B070000) {
+		u32 fpga_fw_version = mali_read_phys(0xC0010000);
+		if (fpga_fw_version == 0x130C008F || fpga_fw_version == 0x110C008F) {
+			/* Mali-400 MP1 r1p0 or r1p1 */
+			MALI_DEBUG_PRINT(4, ("Registering Mali-400 MP1 device\n"));
+			num_pp_cores = 1;
+			mali_write_phys(0xC0010020, 0xA); /* Enable direct memory mapping for FPGA */
+		} else if (fpga_fw_version == 0x130C000F) {
+			/* Mali-400 MP2 r1p1 */
+			MALI_DEBUG_PRINT(4, ("Registering Mali-400 MP2 device\n"));
+			num_pp_cores = 2;
+			mali_write_phys(0xC0010020, 0xA); /* Enable direct memory mapping for FPGA */
+		}
+	}
+#endif
+
+	/* After kernel 3.15 device tree will default set dev
+	 * related parameters in of_platform_device_create_pdata.
+	 * But kernel changes from version to version,
+	 * For example 3.10 didn't include device->dev.dma_mask parameter setting,
+	 * if we didn't include here will cause dma_mapping error,
+	 * but in kernel 3.15 it include  device->dev.dma_mask parameter setting,
+	 * so it's better to set must need paramter by DDK itself.
+	 */
+	if (!device->dev.dma_mask)
+		device->dev.dma_mask = &device->dev.coherent_dma_mask;
+	device->dev.archdata.dma_ops = dma_ops;
+
+	err = platform_device_add_data(device, &mali_gpu_data, sizeof(mali_gpu_data));
+
+	if (0 == err) {
+#ifdef CONFIG_PM_RUNTIME
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37))
+		pm_runtime_set_autosuspend_delay(&(device->dev), 1000);
+		pm_runtime_use_autosuspend(&(device->dev));
+#endif
+		pm_runtime_enable(&(device->dev));
+#endif
+		MALI_DEBUG_ASSERT(0 < num_pp_cores);
+		mali_core_scaling_init(num_pp_cores);
+	}
+
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+	/* Get thermal zone */
+	gpu_tz = thermal_zone_get_zone_by_name("soc_thermal");
+	if (IS_ERR(gpu_tz)) {
+		MALI_DEBUG_PRINT(2, ("Error getting gpu thermal zone (%ld), not yet ready?\n",
+				     PTR_ERR(gpu_tz)));
+		gpu_tz = NULL;
+
+		err =  -EPROBE_DEFER;
+	}
+#endif
+
+	return err;
+}
+
+int mali_platform_device_deinit(struct platform_device *device)
+{
+	MALI_IGNORE(device);
+
+	MALI_DEBUG_PRINT(4, ("mali_platform_device_deinit() called\n"));
+
+	mali_core_scaling_term();
+#ifdef CONFIG_PM_RUNTIME
+	pm_runtime_disable(&(device->dev));
+#endif
+
+#if defined(CONFIG_ARCH_REALVIEW)
+	mali_write_phys(0xC0010020, 0x9); /* Restore default (legacy) memory mapping */
+#endif
+
+	return 0;
+}
+
+#endif /* CONFIG_MALI_DT */
+
+static u32 mali_read_phys(u32 phys_addr)
+{
+	u32 phys_addr_page = phys_addr & 0xFFFFE000;
+	u32 phys_offset    = phys_addr & 0x00001FFF;
+	u32 map_size       = phys_offset + sizeof(u32);
+	u32 ret = 0xDEADBEEF;
+	void *mem_mapped = ioremap_nocache(phys_addr_page, map_size);
+	if (NULL != mem_mapped) {
+		ret = (u32)ioread32(((u8 *)mem_mapped) + phys_offset);
+		iounmap(mem_mapped);
+	}
+
+	return ret;
+}
+
+#if defined(CONFIG_ARCH_REALVIEW)
+static void mali_write_phys(u32 phys_addr, u32 value)
+{
+	u32 phys_addr_page = phys_addr & 0xFFFFE000;
+	u32 phys_offset    = phys_addr & 0x00001FFF;
+	u32 map_size       = phys_offset + sizeof(u32);
+	void *mem_mapped = ioremap_nocache(phys_addr_page, map_size);
+	if (NULL != mem_mapped) {
+		iowrite32(value, ((u8 *)mem_mapped) + phys_offset);
+		iounmap(mem_mapped);
+	}
+}
+#endif
+
+static int param_set_core_scaling(const char *val, const struct kernel_param *kp)
+{
+	int ret = param_set_int(val, kp);
+
+	if (1 == mali_core_scaling_enable) {
+		mali_core_scaling_sync(mali_executor_get_num_cores_enabled());
+	}
+	return ret;
+}
+
+static struct kernel_param_ops param_ops_core_scaling = {
+	.set = param_set_core_scaling,
+	.get = param_get_int,
+};
+
+module_param_cb(mali_core_scaling_enable, &param_ops_core_scaling, &mali_core_scaling_enable, 0644);
+MODULE_PARM_DESC(mali_core_scaling_enable, "1 means to enable core scaling policy, 0 means to disable core scaling policy");
+
+void mali_gpu_utilization_callback(struct mali_gpu_utilization_data *data)
+{
+	if (1 == mali_core_scaling_enable) {
+		mali_core_scaling_update(data);
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.c b/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.c
--- a/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file arm_core_scaling.c
+ * Example core scaling policy.
+ */
+
+#include "arm_core_scaling.h"
+
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_common.h"
+
+#include <linux/workqueue.h>
+
+static int num_cores_total;
+static int num_cores_enabled;
+
+static struct work_struct wq_work;
+
+static void set_num_cores(struct work_struct *work)
+{
+	int err = mali_perf_set_num_pp_cores(num_cores_enabled);
+	MALI_DEBUG_ASSERT(0 == err);
+	MALI_IGNORE(err);
+}
+
+static void enable_one_core(void)
+{
+	if (num_cores_enabled < num_cores_total) {
+		++num_cores_enabled;
+		schedule_work(&wq_work);
+		MALI_DEBUG_PRINT(3, ("Core scaling: Enabling one more core\n"));
+	}
+
+	MALI_DEBUG_ASSERT(1 <= num_cores_enabled);
+	MALI_DEBUG_ASSERT(num_cores_total >= num_cores_enabled);
+}
+
+static void disable_one_core(void)
+{
+	if (1 < num_cores_enabled) {
+		--num_cores_enabled;
+		schedule_work(&wq_work);
+		MALI_DEBUG_PRINT(3, ("Core scaling: Disabling one core\n"));
+	}
+
+	MALI_DEBUG_ASSERT(1 <= num_cores_enabled);
+	MALI_DEBUG_ASSERT(num_cores_total >= num_cores_enabled);
+}
+
+static void enable_max_num_cores(void)
+{
+	if (num_cores_enabled < num_cores_total) {
+		num_cores_enabled = num_cores_total;
+		schedule_work(&wq_work);
+		MALI_DEBUG_PRINT(3, ("Core scaling: Enabling maximum number of cores\n"));
+	}
+
+	MALI_DEBUG_ASSERT(num_cores_total == num_cores_enabled);
+}
+
+void mali_core_scaling_init(int num_pp_cores)
+{
+	INIT_WORK(&wq_work, set_num_cores);
+
+	num_cores_total   = num_pp_cores;
+	num_cores_enabled = num_pp_cores;
+
+	/* NOTE: Mali is not fully initialized at this point. */
+}
+
+void mali_core_scaling_sync(int num_cores)
+{
+	num_cores_enabled = num_cores;
+}
+
+void mali_core_scaling_term(void)
+{
+	flush_scheduled_work();
+}
+
+#define PERCENT_OF(percent, max) ((int) ((percent)*(max)/100.0 + 0.5))
+
+void mali_core_scaling_update(struct mali_gpu_utilization_data *data)
+{
+	/*
+	 * This function implements a very trivial PP core scaling algorithm.
+	 *
+	 * It is _NOT_ of production quality.
+	 * The only intention behind this algorithm is to exercise and test the
+	 * core scaling functionality of the driver.
+	 * It is _NOT_ tuned for neither power saving nor performance!
+	 *
+	 * Other metrics than PP utilization need to be considered as well
+	 * in order to make a good core scaling algorithm.
+	 */
+
+	MALI_DEBUG_PRINT(3, ("Utilization: (%3d, %3d, %3d), cores enabled: %d/%d\n", data->utilization_gpu, data->utilization_gp, data->utilization_pp, num_cores_enabled, num_cores_total));
+
+	/* NOTE: this function is normally called directly from the utilization callback which is in
+	 * timer context. */
+
+	if (PERCENT_OF(90, 256) < data->utilization_pp) {
+		enable_max_num_cores();
+	} else if (PERCENT_OF(50, 256) < data->utilization_pp) {
+		enable_one_core();
+	} else if (PERCENT_OF(40, 256) < data->utilization_pp) {
+		/* do nothing */
+	} else if (PERCENT_OF(0, 256) < data->utilization_pp) {
+		disable_one_core();
+	} else {
+		/* do nothing */
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.h b/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.h
--- a/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/arm/arm_core_scaling.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file arm_core_scaling.h
+ * Example core scaling policy.
+ */
+
+#ifndef __ARM_CORE_SCALING_H__
+#define __ARM_CORE_SCALING_H__
+
+struct mali_gpu_utilization_data;
+
+/**
+ * Initialize core scaling policy.
+ *
+ * @note The core scaling policy will assume that all PP cores are on initially.
+ *
+ * @param num_pp_cores Total number of PP cores.
+ */
+void mali_core_scaling_init(int num_pp_cores);
+
+/**
+ * Terminate core scaling policy.
+ */
+void mali_core_scaling_term(void);
+
+/**
+ * Update core scaling policy with new utilization data.
+ *
+ * @param data Utilization data.
+ */
+void mali_core_scaling_update(struct mali_gpu_utilization_data *data);
+
+void mali_core_scaling_sync(int num_cores);
+
+#endif /* __ARM_CORE_SCALING_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/platform/arm/juno_opp.c b/drivers/gpu/arm/mali400/platform/arm/juno_opp.c
--- a/drivers/gpu/arm/mali400/platform/arm/juno_opp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/arm/juno_opp.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2010, 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file juno_opp.c
+ * Example: Set up opp table
+ * Using ARM64 juno specific SCPI_PROTOCOL get frequence inform
+ * Customer need implement your own platform releated logic
+ */
+#ifdef CONFIG_ARCH_VEXPRESS
+#ifdef CONFIG_MALI_DEVFREQ
+#ifdef CONFIG_ARM64
+#ifdef CONFIG_ARM_SCPI_PROTOCOL
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/scpi_protocol.h>
+#include <linux/version.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+#include <linux/pm_opp.h>
+#else /* Linux >= 3.13 */
+/* In 3.13 the OPP include header file, types, and functions were all
+ * renamed. Use the old filename for the include, and define the new names to
+ * the old, when an old kernel is detected.
+ */
+#include <linux/opp.h>
+#define dev_pm_opp_add opp_add
+#define dev_pm_opp_remove opp_remove
+#endif /* Linux >= 3.13 */
+
+#include "mali_kernel_common.h"
+
+static int init_juno_opps_from_scpi(struct device *dev)
+{
+	struct scpi_dvfs_info *sinfo;
+	struct scpi_ops *sops;
+
+	int i;
+
+	sops = get_scpi_ops();
+	if (NULL == sops) {
+		MALI_DEBUG_PRINT(2, ("Mali didn't get any scpi ops \n"));
+		return -1;
+	}
+
+	/* Hard coded for Juno. 2 is GPU domain */
+	sinfo = sops->dvfs_get_info(2);
+	if (IS_ERR_OR_NULL(sinfo))
+		return PTR_ERR(sinfo);
+
+	for (i = 0; i < sinfo->count; i++) {
+		struct scpi_opp *e = &sinfo->opps[i];
+
+		MALI_DEBUG_PRINT(2, ("Mali OPP from SCPI: %u Hz @ %u mV\n", e->freq, e->m_volt));
+
+		dev_pm_opp_add(dev, e->freq, e->m_volt * 1000);
+	}
+
+	return 0;
+}
+
+int setup_opps(void)
+{
+	struct device_node *np;
+	struct platform_device *pdev;
+	int err;
+
+	np = of_find_node_by_name(NULL, "gpu");
+	if (!np) {
+		pr_err("Failed to find DT entry for Mali\n");
+		return -EFAULT;
+	}
+
+	pdev = of_find_device_by_node(np);
+	if (!pdev) {
+		pr_err("Failed to find device for Mali\n");
+		of_node_put(np);
+		return -EFAULT;
+	}
+
+	err = init_juno_opps_from_scpi(&pdev->dev);
+
+	of_node_put(np);
+
+	return err;
+}
+
+int term_opps(struct device *dev)
+{
+	struct scpi_dvfs_info *sinfo;
+	struct scpi_ops *sops;
+
+	int i;
+
+	sops = get_scpi_ops();
+	if (NULL == sops) {
+		MALI_DEBUG_PRINT(2, ("Mali didn't get any scpi ops \n"));
+		return -1;
+	}
+
+	/* Hard coded for Juno. 2 is GPU domain */
+	sinfo = sops->dvfs_get_info(2);
+	if (IS_ERR_OR_NULL(sinfo))
+		return PTR_ERR(sinfo);
+
+	for (i = 0; i < sinfo->count; i++) {
+		struct scpi_opp *e = &sinfo->opps[i];
+
+		MALI_DEBUG_PRINT(2, ("Mali Remove OPP: %u Hz \n", e->freq));
+
+		dev_pm_opp_remove(dev, e->freq);
+	}
+
+	return 0;
+
+}
+#endif
+#endif
+#endif
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/platform/nexell/s5pxx18.c b/drivers/gpu/arm/mali400/platform/nexell/s5pxx18.c
--- a/drivers/gpu/arm/mali400/platform/nexell/s5pxx18.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/nexell/s5pxx18.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,309 @@
+/*
+ * Copyright (C) 2010, 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file s5pxx18.c
+ * Platform specific Mali driver functions for:
+ * - Nexell s5p6818 platforms with ARM CortexA53 8 cores.
+ * - Nexell s5p4418 platforms with ARM CortexA9 4 cores.
+ */
+#include <linux/platform_device.h>
+#include <linux/version.h>
+#include <linux/pm.h>
+#include "mali_kernel_linux.h"
+#ifdef CONFIG_PM_RUNTIME
+#include <linux/pm_runtime.h>
+#endif
+#include <asm/io.h>
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_common.h"
+#include <linux/dma-mapping.h>
+#include <linux/moduleparam.h>
+#include <linux/reset.h>
+#include <linux/clk.h>
+
+#include <linux/soc/nexell/cpufreq.h>
+#include <linux/pm_qos.h>
+#include "s5pxx18_core_scaling.h"
+#include "mali_executor.h"
+
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+#include <linux/devfreq_cooling.h>
+#include <linux/thermal.h>
+#endif
+
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+#include <dt-bindings/tieoff/s5p6818-tieoff.h>
+#include <soc/nexell/tieoff.h>
+#endif
+
+static int mali_core_scaling_enable = 0;
+static struct clk *clk_mali;
+static struct reset_control *rst_mali;
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+static bool nexell_qos_added;
+static struct pm_qos_request nexell_gpu_qos;
+static int bus_clk_step;
+static struct delayed_work qos_work;
+#endif
+
+void mali_gpu_utilization_callback(struct mali_gpu_utilization_data *data);
+
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+static void s5p6818_mali_axibus_lpi_exit(void)
+{
+	/* Set PBUS CSYSREQ to High */
+	nx_tieoff_set(NX_TIEOFF_Inst_VR_PBUS_AXILPI_S0_CSYSREQ, 1);
+
+	/* Set MBUS CSYSREQ to High */
+	nx_tieoff_set(NX_TIEOFF_Inst_VR_MBUS_AXILPI_S0_CSYSREQ, 1);
+}
+
+static void s5p6818_mali_axibus_lpi_enter(void)
+{
+	/* Set PBUS LPI CSYSREQ to Low */
+	nx_tieoff_set(NX_TIEOFF_Inst_VR_PBUS_AXILPI_S0_CSYSREQ, 0);
+
+	/* Set MBUS LPI CSYSREQ to Low */
+	nx_tieoff_set(NX_TIEOFF_Inst_VR_MBUS_AXILPI_S0_CSYSREQ, 0);
+}
+#endif
+
+static void nexell_platform_resume(struct device *dev)
+{
+	clk_prepare_enable(clk_mali);
+	reset_control_reset(rst_mali);
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+	s5p6818_mali_axibus_lpi_exit();
+#endif
+}
+
+static void nexell_platform_suspend(struct device *dev)
+{
+	if (rst_mali) {
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+		s5p6818_mali_axibus_lpi_enter();
+#endif
+		reset_control_assert(rst_mali);
+	}
+
+	if (clk_mali)
+		clk_disable_unprepare(clk_mali);
+}
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+static struct mali_gpu_clk_item gpu_clocks[] = {
+	{
+		.clock = 100,	/* NX_BUS_CLK_IDLE_KHZ */
+	}, {
+		.clock = 200,	/* Fake clock */
+	}, {
+		.clock = 300,	/* Fake clock */
+	}, {
+		.clock = 400,	/* NX_BUS_CLK_GPU_KHZ */
+	}
+};
+
+struct mali_gpu_clock gpu_clock = {
+	.item = gpu_clocks,
+	.num_of_steps = ARRAY_SIZE(gpu_clocks),
+};
+
+static void
+nexell_gpu_qos_work_handler(struct work_struct *work)
+{
+	u32 clk_khz = gpu_clocks[bus_clk_step].clock * 1000;
+
+	if (clk_khz != NX_BUS_CLK_IDLE_KHZ)
+		clk_khz = NX_BUS_CLK_GPU_KHZ;
+
+	if (!nexell_qos_added) {
+		pm_qos_add_request(&nexell_gpu_qos, PM_QOS_BUS_THROUGHPUT,
+				clk_khz);
+		nexell_qos_added = true;
+	} else {
+		pm_qos_update_request(&nexell_gpu_qos, clk_khz);
+	}
+}
+
+static void nexell_get_clock_info(struct mali_gpu_clock **data)
+{
+	*data = &gpu_clock;
+}
+
+static int nexell_get_freq(void)
+{
+	return bus_clk_step;
+}
+
+static int nexell_set_freq(int setting_clock_step)
+{
+	if (bus_clk_step != setting_clock_step) {
+		bus_clk_step = setting_clock_step;
+
+		INIT_DELAYED_WORK(&qos_work, nexell_gpu_qos_work_handler);
+		queue_delayed_work(system_power_efficient_wq, &qos_work, 0);
+	}
+
+	return 0;
+}
+#endif
+
+static struct mali_gpu_device_data mali_gpu_data = {
+	.max_job_runtime = 60000, /* 60 seconds */
+
+	/* Some framebuffer drivers get the framebuffer dynamically, such as through GEM,
+	* in which the memory resource can't be predicted in advance.
+	*/
+	.fb_start = 0x0,
+	.fb_size = 0xFFFFF000,
+	.control_interval = 1000, /* 1000ms */
+	.utilization_callback = mali_gpu_utilization_callback,
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	.get_clock_info = nexell_get_clock_info,
+	.get_freq = nexell_get_freq,
+	.set_freq = nexell_set_freq,
+#endif
+	.secure_mode_init = NULL,
+	.secure_mode_deinit = NULL,
+	.gpu_reset_and_secure_mode_enable = NULL,
+	.gpu_reset_and_secure_mode_disable = NULL,
+	.platform_suspend = nexell_platform_suspend,
+	.platform_resume = nexell_platform_resume,
+};
+
+int mali_platform_device_init(struct platform_device *device)
+{
+	int num_pp_cores = 2;
+	int err = -1;
+	struct device *dev = &device->dev;
+
+	clk_mali = devm_clk_get(dev, "clk_mali");
+	if (IS_ERR_OR_NULL(clk_mali)) {
+		dev_err(dev, "failed to get mali clock\n");
+		return -ENODEV;
+	}
+
+	clk_prepare_enable(clk_mali);
+
+	rst_mali = devm_reset_control_get(dev, "vr-reset");
+
+	if (IS_ERR(rst_mali)) {
+		dev_err(dev, "failed to get reset_control\n");
+		return -EINVAL;
+	}
+
+	reset_control_reset(rst_mali);
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+	s5p6818_mali_axibus_lpi_exit();
+#endif
+
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+	num_pp_cores = 4;
+#endif
+	/* After kernel 3.15 device tree will default set dev
+	 * related parameters in of_platform_device_create_pdata.
+	 * But kernel changes from version to version,
+	 * For example 3.10 didn't include device->dev.dma_mask parameter setting,
+	 * if we didn't include here will cause dma_mapping error,
+	 * but in kernel 3.15 it include  device->dev.dma_mask parameter setting,
+	 * so it's better to set must need paramter by DDK itself.
+	 */
+	if (!device->dev.dma_mask)
+		device->dev.dma_mask = &device->dev.coherent_dma_mask;
+#ifndef CONFIG_ARM64
+	device->dev.archdata.dma_ops = &arm_dma_ops;
+#endif
+
+	err = platform_device_add_data(device, &mali_gpu_data, sizeof(mali_gpu_data));
+
+	if (0 == err) {
+#ifdef CONFIG_PM_RUNTIME
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37))
+		pm_runtime_set_autosuspend_delay(&(device->dev), 1000);
+		pm_runtime_use_autosuspend(&(device->dev));
+#endif
+		pm_runtime_enable(&(device->dev));
+#endif
+		MALI_DEBUG_ASSERT(0 < num_pp_cores);
+		mali_core_scaling_init(num_pp_cores);
+	}
+
+#if defined(CONFIG_MALI_DEVFREQ) && defined(CONFIG_DEVFREQ_THERMAL)
+	/* Get thermal zone */
+	gpu_tz = thermal_zone_get_zone_by_name("soc_thermal");
+	if (IS_ERR(gpu_tz)) {
+		MALI_DEBUG_PRINT(2, ("Error getting gpu thermal zone (%ld), not yet ready?\n",
+				     PTR_ERR(gpu_tz)));
+		gpu_tz = NULL;
+
+		err =  -EPROBE_DEFER;
+	}
+#endif
+
+	return err;
+}
+
+int mali_platform_device_deinit(struct platform_device *device)
+{
+	MALI_IGNORE(device);
+
+	MALI_DEBUG_PRINT(4, ("mali_platform_device_deinit() called\n"));
+
+	mali_core_scaling_term();
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	if (nexell_qos_added) {
+		pm_qos_remove_request(&nexell_gpu_qos);
+		nexell_qos_added = false;
+	}
+#endif
+
+	if (rst_mali) {
+#ifdef CONFIG_MALI_PLATFORM_S5P6818
+		s5p6818_mali_axibus_lpi_enter();
+#endif
+		reset_control_assert(rst_mali);
+	}
+
+	if (clk_mali)
+		clk_disable_unprepare(clk_mali);
+
+#ifdef CONFIG_PM_RUNTIME
+	pm_runtime_disable(&(device->dev));
+#endif
+
+	return 0;
+}
+
+static int param_set_core_scaling(const char *val, const struct kernel_param *kp)
+{
+	int ret = param_set_int(val, kp);
+
+	if (1 == mali_core_scaling_enable) {
+		mali_core_scaling_sync(mali_executor_get_num_cores_enabled());
+	}
+	return ret;
+}
+
+static struct kernel_param_ops param_ops_core_scaling = {
+	.set = param_set_core_scaling,
+	.get = param_get_int,
+};
+
+module_param_cb(mali_core_scaling_enable, &param_ops_core_scaling, &mali_core_scaling_enable, 0644);
+MODULE_PARM_DESC(mali_core_scaling_enable, "1 means to enable core scaling policy, 0 means to disable core scaling policy");
+
+void mali_gpu_utilization_callback(struct mali_gpu_utilization_data *data)
+{
+	if (1 == mali_core_scaling_enable) {
+		mali_core_scaling_update(data);
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.c b/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.c
--- a/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.c	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file arm_core_scaling.c
+ * Example core scaling policy.
+ */
+
+#include "s5pxx18_core_scaling.h"
+
+#include <linux/mali/mali_utgard.h>
+#include "mali_kernel_common.h"
+
+#include <linux/workqueue.h>
+
+static int num_cores_total;
+static int num_cores_enabled;
+
+static struct work_struct wq_work;
+
+static void set_num_cores(struct work_struct *work)
+{
+	int err = mali_perf_set_num_pp_cores(num_cores_enabled);
+	MALI_DEBUG_ASSERT(0 == err);
+	MALI_IGNORE(err);
+}
+
+static void enable_one_core(void)
+{
+	if (num_cores_enabled < num_cores_total) {
+		++num_cores_enabled;
+		schedule_work(&wq_work);
+		MALI_DEBUG_PRINT(3, ("Core scaling: Enabling one more core\n"));
+	}
+
+	MALI_DEBUG_ASSERT(1 <= num_cores_enabled);
+	MALI_DEBUG_ASSERT(num_cores_total >= num_cores_enabled);
+}
+
+static void disable_one_core(void)
+{
+	if (1 < num_cores_enabled) {
+		--num_cores_enabled;
+		schedule_work(&wq_work);
+		MALI_DEBUG_PRINT(3, ("Core scaling: Disabling one core\n"));
+	}
+
+	MALI_DEBUG_ASSERT(1 <= num_cores_enabled);
+	MALI_DEBUG_ASSERT(num_cores_total >= num_cores_enabled);
+}
+
+static void enable_max_num_cores(void)
+{
+	if (num_cores_enabled < num_cores_total) {
+		num_cores_enabled = num_cores_total;
+		schedule_work(&wq_work);
+		MALI_DEBUG_PRINT(3, ("Core scaling: Enabling maximum number of cores\n"));
+	}
+
+	MALI_DEBUG_ASSERT(num_cores_total == num_cores_enabled);
+}
+
+void mali_core_scaling_init(int num_pp_cores)
+{
+	INIT_WORK(&wq_work, set_num_cores);
+
+	num_cores_total   = num_pp_cores;
+	num_cores_enabled = num_pp_cores;
+
+	/* NOTE: Mali is not fully initialized at this point. */
+}
+
+void mali_core_scaling_sync(int num_cores)
+{
+	num_cores_enabled = num_cores;
+}
+
+void mali_core_scaling_term(void)
+{
+	flush_scheduled_work();
+}
+
+#define PERCENT_OF(percent, max) ((int) ((percent)*(max)/100.0 + 0.5))
+
+void mali_core_scaling_update(struct mali_gpu_utilization_data *data)
+{
+	/*
+	 * This function implements a very trivial PP core scaling algorithm.
+	 *
+	 * It is _NOT_ of production quality.
+	 * The only intention behind this algorithm is to exercise and test the
+	 * core scaling functionality of the driver.
+	 * It is _NOT_ tuned for neither power saving nor performance!
+	 *
+	 * Other metrics than PP utilization need to be considered as well
+	 * in order to make a good core scaling algorithm.
+	 */
+
+	MALI_DEBUG_PRINT(3, ("Utilization: (%3d, %3d, %3d), cores enabled: %d/%d\n",
+				data->utilization_gpu, data->utilization_gp,
+				data->utilization_pp, num_cores_enabled,
+				num_cores_total));
+
+	/* NOTE: this function is normally called directly from the utilization
+	 * callback which is in timer context. */
+
+	if (PERCENT_OF(90, 256) < data->utilization_pp) {
+		enable_max_num_cores();
+	} else if (PERCENT_OF(50, 256) < data->utilization_pp) {
+		enable_one_core();
+	} else if (PERCENT_OF(40, 256) < data->utilization_pp) {
+		/* do nothing */
+	} else if (PERCENT_OF(0, 256) < data->utilization_pp) {
+		disable_one_core();
+	} else {
+		/* do nothing */
+	}
+}
diff -ENwbur a/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.h b/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.h
--- a/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/platform/nexell/s5pxx18_core_scaling.h	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+/**
+ * @file arm_core_scaling.h
+ * Example core scaling policy.
+ */
+
+#ifndef __ARM_CORE_SCALING_H__
+#define __ARM_CORE_SCALING_H__
+
+struct mali_gpu_utilization_data;
+
+/**
+ * Initialize core scaling policy.
+ *
+ * @note The core scaling policy will assume that all PP cores are on initially.
+ *
+ * @param num_pp_cores Total number of PP cores.
+ */
+void mali_core_scaling_init(int num_pp_cores);
+
+/**
+ * Terminate core scaling policy.
+ */
+void mali_core_scaling_term(void);
+
+/**
+ * Update core scaling policy with new utilization data.
+ *
+ * @param data Utilization data.
+ */
+void mali_core_scaling_update(struct mali_gpu_utilization_data *data);
+
+void mali_core_scaling_sync(int num_cores);
+
+#endif /* __ARM_CORE_SCALING_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/readme.txt b/drivers/gpu/arm/mali400/readme.txt
--- a/drivers/gpu/arm/mali400/readme.txt	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/readme.txt	2018-05-06 08:49:49.182695581 +0200
@@ -0,0 +1,28 @@
+Building the Mali Device Driver for Linux
+-----------------------------------------
+
+Build the Mali Device Driver for Linux by running the following make command:
+
+KDIR=<kdir_path> USING_UMP=<ump_option> BUILD=<build_option> make
+
+where
+    kdir_path: Path to your Linux Kernel directory
+    ump_option: 1 = Enable UMP support(*)
+                0 = disable UMP support
+    build_option: debug = debug build of driver
+                  release = release build of driver
+
+(*)  For newer Linux Kernels, the Module.symvers file for the UMP device driver
+     must be available. The UMP_SYMVERS_FILE variable in the Makefile should
+     point to this file. This file is generated when the UMP driver is built.
+
+The result will be a mali.ko file, which can be loaded into the Linux kernel
+by using the insmod command.
+
+Use of UMP is not recommended. The dma-buf API in the Linux kernel has
+replaced UMP. The Mali Device Driver will be built with dma-buf support if the
+kernel config includes enabled dma-buf.
+
+The kernel needs to be provided with a platform_device struct for the Mali GPU
+device. See the mali_utgard.h header file for how to set up the Mali GPU
+resources.
diff -ENwbur a/drivers/gpu/arm/mali400/regs/mali_200_regs.h b/drivers/gpu/arm/mali400/regs/mali_200_regs.h
--- a/drivers/gpu/arm/mali400/regs/mali_200_regs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/regs/mali_200_regs.h	2018-05-06 08:49:49.186695742 +0200
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2010, 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef _MALI200_REGS_H_
+#define _MALI200_REGS_H_
+
+/**
+ *  Enum for management register addresses.
+ */
+enum mali200_mgmt_reg {
+	MALI200_REG_ADDR_MGMT_VERSION                              = 0x1000,
+	MALI200_REG_ADDR_MGMT_CURRENT_REND_LIST_ADDR               = 0x1004,
+	MALI200_REG_ADDR_MGMT_STATUS                               = 0x1008,
+	MALI200_REG_ADDR_MGMT_CTRL_MGMT                            = 0x100c,
+
+	MALI200_REG_ADDR_MGMT_INT_RAWSTAT                          = 0x1020,
+	MALI200_REG_ADDR_MGMT_INT_CLEAR                            = 0x1024,
+	MALI200_REG_ADDR_MGMT_INT_MASK                             = 0x1028,
+	MALI200_REG_ADDR_MGMT_INT_STATUS                           = 0x102c,
+
+	MALI200_REG_ADDR_MGMT_BUS_ERROR_STATUS                     = 0x1050,
+
+	MALI200_REG_ADDR_MGMT_PERF_CNT_0_ENABLE                    = 0x1080,
+	MALI200_REG_ADDR_MGMT_PERF_CNT_0_SRC                       = 0x1084,
+	MALI200_REG_ADDR_MGMT_PERF_CNT_0_LIMIT                     = 0x1088,
+	MALI200_REG_ADDR_MGMT_PERF_CNT_0_VALUE                     = 0x108c,
+
+	MALI200_REG_ADDR_MGMT_PERF_CNT_1_ENABLE                    = 0x10a0,
+	MALI200_REG_ADDR_MGMT_PERF_CNT_1_SRC                       = 0x10a4,
+	MALI200_REG_ADDR_MGMT_PERF_CNT_1_VALUE                     = 0x10ac,
+
+	MALI200_REG_ADDR_MGMT_PERFMON_CONTR                        = 0x10b0,
+	MALI200_REG_ADDR_MGMT_PERFMON_BASE                         = 0x10b4,
+
+	MALI200_REG_SIZEOF_REGISTER_BANK                           = 0x10f0
+
+};
+
+#define MALI200_REG_VAL_PERF_CNT_ENABLE 1
+
+enum mali200_mgmt_ctrl_mgmt {
+	MALI200_REG_VAL_CTRL_MGMT_STOP_BUS         = (1 << 0),
+	MALI200_REG_VAL_CTRL_MGMT_FLUSH_CACHES     = (1 << 3),
+	MALI200_REG_VAL_CTRL_MGMT_FORCE_RESET      = (1 << 5),
+	MALI200_REG_VAL_CTRL_MGMT_START_RENDERING  = (1 << 6),
+	MALI400PP_REG_VAL_CTRL_MGMT_SOFT_RESET     = (1 << 7), /* Only valid for Mali-300 and later */
+};
+
+enum mali200_mgmt_irq {
+	MALI200_REG_VAL_IRQ_END_OF_FRAME          = (1 << 0),
+	MALI200_REG_VAL_IRQ_END_OF_TILE           = (1 << 1),
+	MALI200_REG_VAL_IRQ_HANG                  = (1 << 2),
+	MALI200_REG_VAL_IRQ_FORCE_HANG            = (1 << 3),
+	MALI200_REG_VAL_IRQ_BUS_ERROR             = (1 << 4),
+	MALI200_REG_VAL_IRQ_BUS_STOP              = (1 << 5),
+	MALI200_REG_VAL_IRQ_CNT_0_LIMIT           = (1 << 6),
+	MALI200_REG_VAL_IRQ_CNT_1_LIMIT           = (1 << 7),
+	MALI200_REG_VAL_IRQ_WRITE_BOUNDARY_ERROR  = (1 << 8),
+	MALI400PP_REG_VAL_IRQ_INVALID_PLIST_COMMAND = (1 << 9),
+	MALI400PP_REG_VAL_IRQ_CALL_STACK_UNDERFLOW  = (1 << 10),
+	MALI400PP_REG_VAL_IRQ_CALL_STACK_OVERFLOW   = (1 << 11),
+	MALI400PP_REG_VAL_IRQ_RESET_COMPLETED       = (1 << 12),
+};
+
+#define MALI200_REG_VAL_IRQ_MASK_ALL  ((enum mali200_mgmt_irq) (\
+				       MALI200_REG_VAL_IRQ_END_OF_FRAME                           |\
+				       MALI200_REG_VAL_IRQ_END_OF_TILE                            |\
+				       MALI200_REG_VAL_IRQ_HANG                                   |\
+				       MALI200_REG_VAL_IRQ_FORCE_HANG                             |\
+				       MALI200_REG_VAL_IRQ_BUS_ERROR                              |\
+				       MALI200_REG_VAL_IRQ_BUS_STOP                               |\
+				       MALI200_REG_VAL_IRQ_CNT_0_LIMIT                            |\
+				       MALI200_REG_VAL_IRQ_CNT_1_LIMIT                            |\
+				       MALI200_REG_VAL_IRQ_WRITE_BOUNDARY_ERROR                   |\
+				       MALI400PP_REG_VAL_IRQ_INVALID_PLIST_COMMAND                  |\
+				       MALI400PP_REG_VAL_IRQ_CALL_STACK_UNDERFLOW                   |\
+				       MALI400PP_REG_VAL_IRQ_CALL_STACK_OVERFLOW                    |\
+				       MALI400PP_REG_VAL_IRQ_RESET_COMPLETED))
+
+#define MALI200_REG_VAL_IRQ_MASK_USED ((enum mali200_mgmt_irq) (\
+				       MALI200_REG_VAL_IRQ_END_OF_FRAME                           |\
+				       MALI200_REG_VAL_IRQ_FORCE_HANG                             |\
+				       MALI200_REG_VAL_IRQ_BUS_ERROR                              |\
+				       MALI200_REG_VAL_IRQ_WRITE_BOUNDARY_ERROR                   |\
+				       MALI400PP_REG_VAL_IRQ_INVALID_PLIST_COMMAND                  |\
+				       MALI400PP_REG_VAL_IRQ_CALL_STACK_UNDERFLOW                   |\
+				       MALI400PP_REG_VAL_IRQ_CALL_STACK_OVERFLOW))
+
+#define MALI200_REG_VAL_IRQ_MASK_NONE ((enum mali200_mgmt_irq)(0))
+
+enum mali200_mgmt_status {
+	MALI200_REG_VAL_STATUS_RENDERING_ACTIVE     = (1 << 0),
+	MALI200_REG_VAL_STATUS_BUS_STOPPED          = (1 << 4),
+};
+
+enum mali200_render_unit {
+	MALI200_REG_ADDR_FRAME = 0x0000,
+	MALI200_REG_ADDR_RSW   = 0x0004,
+	MALI200_REG_ADDR_STACK = 0x0030,
+	MALI200_REG_ADDR_STACK_SIZE = 0x0034,
+	MALI200_REG_ADDR_ORIGIN_OFFSET_X  = 0x0040
+};
+
+enum mali200_wb_unit {
+	MALI200_REG_ADDR_WB0 = 0x0100,
+	MALI200_REG_ADDR_WB1 = 0x0200,
+	MALI200_REG_ADDR_WB2 = 0x0300
+};
+
+enum mali200_wb_unit_regs {
+	MALI200_REG_ADDR_WB_SOURCE_SELECT = 0x0000,
+	MALI200_REG_ADDR_WB_SOURCE_ADDR   = 0x0004,
+};
+
+/* This should be in the top 16 bit of the version register of Mali PP */
+#define MALI200_PP_PRODUCT_ID 0xC807
+#define MALI300_PP_PRODUCT_ID 0xCE07
+#define MALI400_PP_PRODUCT_ID 0xCD07
+#define MALI450_PP_PRODUCT_ID 0xCF07
+#define MALI470_PP_PRODUCT_ID 0xCF08
+
+
+
+#endif /* _MALI200_REGS_H_ */
diff -ENwbur a/drivers/gpu/arm/mali400/regs/mali_gp_regs.h b/drivers/gpu/arm/mali400/regs/mali_gp_regs.h
--- a/drivers/gpu/arm/mali400/regs/mali_gp_regs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/regs/mali_gp_regs.h	2018-05-06 08:49:49.186695742 +0200
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2010, 2012-2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef _MALIGP2_CONROL_REGS_H_
+#define _MALIGP2_CONROL_REGS_H_
+
+/**
+ * These are the different geometry processor control registers.
+ * Their usage is to control and monitor the operation of the
+ * Vertex Shader and the Polygon List Builder in the geometry processor.
+ * Addresses are in 32-bit word relative sizes.
+ * @see [P0081] "Geometry Processor Data Structures" for details
+ */
+
+typedef enum {
+	MALIGP2_REG_ADDR_MGMT_VSCL_START_ADDR           = 0x00,
+	MALIGP2_REG_ADDR_MGMT_VSCL_END_ADDR             = 0x04,
+	MALIGP2_REG_ADDR_MGMT_PLBUCL_START_ADDR         = 0x08,
+	MALIGP2_REG_ADDR_MGMT_PLBUCL_END_ADDR           = 0x0c,
+	MALIGP2_REG_ADDR_MGMT_PLBU_ALLOC_START_ADDR     = 0x10,
+	MALIGP2_REG_ADDR_MGMT_PLBU_ALLOC_END_ADDR       = 0x14,
+	MALIGP2_REG_ADDR_MGMT_CMD                       = 0x20,
+	MALIGP2_REG_ADDR_MGMT_INT_RAWSTAT               = 0x24,
+	MALIGP2_REG_ADDR_MGMT_INT_CLEAR                 = 0x28,
+	MALIGP2_REG_ADDR_MGMT_INT_MASK                  = 0x2C,
+	MALIGP2_REG_ADDR_MGMT_INT_STAT                  = 0x30,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_ENABLE         = 0x3C,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_1_ENABLE         = 0x40,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_SRC            = 0x44,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_1_SRC            = 0x48,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_VALUE          = 0x4C,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_1_VALUE          = 0x50,
+	MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_LIMIT          = 0x54,
+	MALIGP2_REG_ADDR_MGMT_STATUS                    = 0x68,
+	MALIGP2_REG_ADDR_MGMT_VERSION                   = 0x6C,
+	MALIGP2_REG_ADDR_MGMT_VSCL_START_ADDR_READ      = 0x80,
+	MALIGP2_REG_ADDR_MGMT_PLBCL_START_ADDR_READ     = 0x84,
+	MALIGP2_CONTR_AXI_BUS_ERROR_STAT                = 0x94,
+	MALIGP2_REGISTER_ADDRESS_SPACE_SIZE             = 0x98,
+} maligp_reg_addr_mgmt_addr;
+
+#define MALIGP2_REG_VAL_PERF_CNT_ENABLE 1
+
+/**
+ * Commands to geometry processor.
+ *  @see MALIGP2_CTRL_REG_CMD
+ */
+typedef enum {
+	MALIGP2_REG_VAL_CMD_START_VS                    = (1 << 0),
+	MALIGP2_REG_VAL_CMD_START_PLBU                  = (1 << 1),
+	MALIGP2_REG_VAL_CMD_UPDATE_PLBU_ALLOC   = (1 << 4),
+	MALIGP2_REG_VAL_CMD_RESET                               = (1 << 5),
+	MALIGP2_REG_VAL_CMD_FORCE_HANG                  = (1 << 6),
+	MALIGP2_REG_VAL_CMD_STOP_BUS                    = (1 << 9),
+	MALI400GP_REG_VAL_CMD_SOFT_RESET                = (1 << 10), /* only valid for Mali-300 and later */
+} mgp_contr_reg_val_cmd;
+
+
+/**  @defgroup MALIGP2_IRQ
+ * Interrupt status of geometry processor.
+ *  @see MALIGP2_CTRL_REG_INT_RAWSTAT, MALIGP2_REG_ADDR_MGMT_INT_CLEAR,
+ *       MALIGP2_REG_ADDR_MGMT_INT_MASK, MALIGP2_REG_ADDR_MGMT_INT_STAT
+ * @{
+ */
+#define MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST      (1 << 0)
+#define MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST    (1 << 1)
+#define MALIGP2_REG_VAL_IRQ_PLBU_OUT_OF_MEM     (1 << 2)
+#define MALIGP2_REG_VAL_IRQ_VS_SEM_IRQ          (1 << 3)
+#define MALIGP2_REG_VAL_IRQ_PLBU_SEM_IRQ        (1 << 4)
+#define MALIGP2_REG_VAL_IRQ_HANG                (1 << 5)
+#define MALIGP2_REG_VAL_IRQ_FORCE_HANG          (1 << 6)
+#define MALIGP2_REG_VAL_IRQ_PERF_CNT_0_LIMIT    (1 << 7)
+#define MALIGP2_REG_VAL_IRQ_PERF_CNT_1_LIMIT    (1 << 8)
+#define MALIGP2_REG_VAL_IRQ_WRITE_BOUND_ERR     (1 << 9)
+#define MALIGP2_REG_VAL_IRQ_SYNC_ERROR          (1 << 10)
+#define MALIGP2_REG_VAL_IRQ_AXI_BUS_ERROR       (1 << 11)
+#define MALI400GP_REG_VAL_IRQ_AXI_BUS_STOPPED     (1 << 12)
+#define MALI400GP_REG_VAL_IRQ_VS_INVALID_CMD      (1 << 13)
+#define MALI400GP_REG_VAL_IRQ_PLB_INVALID_CMD     (1 << 14)
+#define MALI400GP_REG_VAL_IRQ_RESET_COMPLETED     (1 << 19)
+#define MALI400GP_REG_VAL_IRQ_SEMAPHORE_UNDERFLOW (1 << 20)
+#define MALI400GP_REG_VAL_IRQ_SEMAPHORE_OVERFLOW  (1 << 21)
+#define MALI400GP_REG_VAL_IRQ_PTR_ARRAY_OUT_OF_BOUNDS  (1 << 22)
+
+/* Mask defining all IRQs in Mali GP */
+#define MALIGP2_REG_VAL_IRQ_MASK_ALL \
+	(\
+	 MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST      | \
+	 MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST    | \
+	 MALIGP2_REG_VAL_IRQ_PLBU_OUT_OF_MEM     | \
+	 MALIGP2_REG_VAL_IRQ_VS_SEM_IRQ          | \
+	 MALIGP2_REG_VAL_IRQ_PLBU_SEM_IRQ        | \
+	 MALIGP2_REG_VAL_IRQ_HANG                | \
+	 MALIGP2_REG_VAL_IRQ_FORCE_HANG          | \
+	 MALIGP2_REG_VAL_IRQ_PERF_CNT_0_LIMIT    | \
+	 MALIGP2_REG_VAL_IRQ_PERF_CNT_1_LIMIT    | \
+	 MALIGP2_REG_VAL_IRQ_WRITE_BOUND_ERR     | \
+	 MALIGP2_REG_VAL_IRQ_SYNC_ERROR          | \
+	 MALIGP2_REG_VAL_IRQ_AXI_BUS_ERROR       | \
+	 MALI400GP_REG_VAL_IRQ_AXI_BUS_STOPPED     | \
+	 MALI400GP_REG_VAL_IRQ_VS_INVALID_CMD      | \
+	 MALI400GP_REG_VAL_IRQ_PLB_INVALID_CMD     | \
+	 MALI400GP_REG_VAL_IRQ_RESET_COMPLETED     | \
+	 MALI400GP_REG_VAL_IRQ_SEMAPHORE_UNDERFLOW | \
+	 MALI400GP_REG_VAL_IRQ_SEMAPHORE_OVERFLOW  | \
+	 MALI400GP_REG_VAL_IRQ_PTR_ARRAY_OUT_OF_BOUNDS)
+
+/* Mask defining the IRQs in Mali GP which we use */
+#define MALIGP2_REG_VAL_IRQ_MASK_USED \
+	(\
+	 MALIGP2_REG_VAL_IRQ_VS_END_CMD_LST      | \
+	 MALIGP2_REG_VAL_IRQ_PLBU_END_CMD_LST    | \
+	 MALIGP2_REG_VAL_IRQ_PLBU_OUT_OF_MEM     | \
+	 MALIGP2_REG_VAL_IRQ_FORCE_HANG          | \
+	 MALIGP2_REG_VAL_IRQ_WRITE_BOUND_ERR     | \
+	 MALIGP2_REG_VAL_IRQ_SYNC_ERROR          | \
+	 MALIGP2_REG_VAL_IRQ_AXI_BUS_ERROR       | \
+	 MALI400GP_REG_VAL_IRQ_VS_INVALID_CMD      | \
+	 MALI400GP_REG_VAL_IRQ_PLB_INVALID_CMD     | \
+	 MALI400GP_REG_VAL_IRQ_SEMAPHORE_UNDERFLOW | \
+	 MALI400GP_REG_VAL_IRQ_SEMAPHORE_OVERFLOW  | \
+	 MALI400GP_REG_VAL_IRQ_PTR_ARRAY_OUT_OF_BOUNDS)
+
+/* Mask defining non IRQs on MaliGP2*/
+#define MALIGP2_REG_VAL_IRQ_MASK_NONE 0
+
+/** }@ defgroup MALIGP2_IRQ*/
+
+/** @defgroup MALIGP2_STATUS
+ * The different Status values to the geometry processor.
+ *  @see MALIGP2_CTRL_REG_STATUS
+ * @{
+ */
+#define MALIGP2_REG_VAL_STATUS_VS_ACTIVE         0x0002
+#define MALIGP2_REG_VAL_STATUS_BUS_STOPPED       0x0004
+#define MALIGP2_REG_VAL_STATUS_PLBU_ACTIVE       0x0008
+#define MALIGP2_REG_VAL_STATUS_BUS_ERROR         0x0040
+#define MALIGP2_REG_VAL_STATUS_WRITE_BOUND_ERR   0x0100
+/** }@ defgroup MALIGP2_STATUS*/
+
+#define MALIGP2_REG_VAL_STATUS_MASK_ACTIVE (\
+		MALIGP2_REG_VAL_STATUS_VS_ACTIVE|\
+		MALIGP2_REG_VAL_STATUS_PLBU_ACTIVE)
+
+
+#define MALIGP2_REG_VAL_STATUS_MASK_ERROR (\
+		MALIGP2_REG_VAL_STATUS_BUS_ERROR |\
+		MALIGP2_REG_VAL_STATUS_WRITE_BOUND_ERR )
+
+/* This should be in the top 16 bit of the version register of gp.*/
+#define MALI200_GP_PRODUCT_ID 0xA07
+#define MALI300_GP_PRODUCT_ID 0xC07
+#define MALI400_GP_PRODUCT_ID 0xB07
+#define MALI450_GP_PRODUCT_ID 0xD07
+
+/**
+ * The different sources for instrumented on the geometry processor.
+ *  @see MALIGP2_REG_ADDR_MGMT_PERF_CNT_0_SRC
+ */
+
+enum MALIGP2_cont_reg_perf_cnt_src {
+	MALIGP2_REG_VAL_PERF_CNT1_SRC_NUMBER_OF_VERTICES_PROCESSED = 0x0a,
+};
+
+#endif
diff -ENwbur a/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.c b/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.c
--- a/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.c	2018-05-06 08:49:49.186695742 +0200
@@ -0,0 +1,13 @@
+/*
+ * Copyright (C) 2010-2011, 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_timestamp.h"
+
+/* This file is intentionally left empty, as all functions are inlined in mali_profiling_sampler.h */
diff -ENwbur a/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.h b/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.h
--- a/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/timestamp-arm11-cc/mali_timestamp.h	2018-05-06 08:49:49.186695742 +0200
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2010-2011, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_TIMESTAMP_H__
+#define __MALI_TIMESTAMP_H__
+
+#include "mali_osk.h"
+
+MALI_STATIC_INLINE _mali_osk_errcode_t _mali_timestamp_reset(void)
+{
+	/*
+	 * reset counters and overflow flags
+	 */
+
+	u32 mask = (1 << 0) | /* enable all three counters */
+		   (0 << 1) | /* reset both Count Registers to 0x0 */
+		   (1 << 2) | /* reset the Cycle Counter Register to 0x0 */
+		   (0 << 3) | /* 1 = Cycle Counter Register counts every 64th processor clock cycle */
+		   (0 << 4) | /* Count Register 0 interrupt enable */
+		   (0 << 5) | /* Count Register 1 interrupt enable */
+		   (0 << 6) | /* Cycle Counter interrupt enable */
+		   (0 << 8) | /* Count Register 0 overflow flag (clear or write, flag on read) */
+		   (0 << 9) | /* Count Register 1 overflow flag (clear or write, flag on read) */
+		   (1 << 10); /* Cycle Counter Register overflow flag (clear or write, flag on read) */
+
+	__asm__ __volatile__("MCR    p15, 0, %0, c15, c12, 0" : : "r"(mask));
+
+	return _MALI_OSK_ERR_OK;
+}
+
+MALI_STATIC_INLINE u64 _mali_timestamp_get(void)
+{
+	u32 result;
+
+	/* this is for the clock cycles */
+	__asm__ __volatile__("MRC    p15, 0, %0, c15, c12, 1" : "=r"(result));
+
+	return (u64)result;
+}
+
+#endif /* __MALI_TIMESTAMP_H__ */
diff -ENwbur a/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.c b/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.c
--- a/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.c	2018-05-06 08:49:49.186695742 +0200
@@ -0,0 +1,13 @@
+/*
+ * Copyright (C) 2010-2011, 2013, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include "mali_timestamp.h"
+
+/* This file is intentionally left empty, as all functions are inlined in mali_profiling_sampler.h */
diff -ENwbur a/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.h b/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.h
--- a/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/arm/mali400/timestamp-default/mali_timestamp.h	2018-05-06 08:49:49.186695742 +0200
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2010-2011, 2013-2014, 2016 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation, and any use by you of this program is subject to the terms of such GNU licence.
+ *
+ * A copy of the licence is included with the program, and can also be obtained from Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef __MALI_TIMESTAMP_H__
+#define __MALI_TIMESTAMP_H__
+
+#include "mali_osk.h"
+
+MALI_STATIC_INLINE _mali_osk_errcode_t _mali_timestamp_reset(void)
+{
+	return _MALI_OSK_ERR_OK;
+}
+
+MALI_STATIC_INLINE u64 _mali_timestamp_get(void)
+{
+	return _mali_osk_boot_time_get_ns();
+}
+
+#endif /* __MALI_TIMESTAMP_H__ */
diff -ENwbur a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
--- a/drivers/gpu/drm/Kconfig	2018-05-06 08:47:36.357304664 +0200
+++ b/drivers/gpu/drm/Kconfig	2018-05-06 08:49:49.186695742 +0200
@@ -278,6 +278,8 @@

 source "drivers/gpu/drm/pl111/Kconfig"

+source "drivers/gpu/drm/nexell/Kconfig"
+
 # Keep legacy drivers last

 menuconfig DRM_LEGACY
diff -ENwbur a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
--- a/drivers/gpu/drm/Makefile	2018-05-06 08:47:36.357304664 +0200
+++ b/drivers/gpu/drm/Makefile	2018-05-06 08:49:49.186695742 +0200
@@ -101,3 +101,4 @@
 obj-$(CONFIG_DRM_MXSFB)	+= mxsfb/
 obj-$(CONFIG_DRM_TINYDRM) += tinydrm/
 obj-$(CONFIG_DRM_PL111) += pl111/
+obj-$(CONFIG_DRM_NX) 	+= nexell/
diff -ENwbur a/drivers/gpu/drm/nexell/Kconfig b/drivers/gpu/drm/nexell/Kconfig
--- a/drivers/gpu/drm/nexell/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/Kconfig	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,51 @@
+config DRM_NX
+	tristate "DRM Support for NEXELL Display Controller"
+	depends on DRM && (ARCH_S5P6818 || ARCH_S5P4418)
+	select DRM_KMS_HELPER
+	select DRM_KMS_FB_HELPER
+	select VIDEOMODE_HELPERS
+	select FB_SYS_FILLRECT
+	select FB_SYS_COPYAREA
+	select FB_SYS_IMAGEBLIT
+	select VT_HW_CONSOLE_BINDING if FRAMEBUFFER_CONSOLE
+	help
+	  Choose this option if you have a Nexell soc chipset.
+	  This driver provides kernel mode setting and buffer
+	  management to userspace. If M is selected the module
+	  will be called nexell drm.
+
+config DRM_NX_RGB
+	bool "RGB LCD support"
+	depends on DRM_NX
+	select DRM_PANEL
+	help
+	 This selects support for RGB LCD display out.
+	 If you want to enable RGB LCD display,
+	 you should selet this option.
+
+config DRM_NX_LVDS
+	bool "LVDS LCD support"
+	depends on DRM_NX
+	select DRM_PANEL
+	help
+	 This selects support for LVDS LCD display out.
+	 If you want to enable LVDS LCD display,
+	 you should selet this option.
+
+config DRM_NX_MIPI_DSI
+	bool "MiPi DSI support"
+	depends on DRM_NX
+	select DRM_PANEL
+	select DRM_MIPI_DSI
+	help
+	 This selects support for MiPi-DSI display device.
+	 If you want to enable MiPi-DSI display device,
+	 you should selet this option.
+
+config DRM_NX_HDMI
+	bool "HDMI support"
+	depends on DRM_NX
+	help
+	 This selects support for HDMI display out.
+	 If you want to enable HDMI display,
+	 you should selet this option.
diff -ENwbur a/drivers/gpu/drm/nexell/Makefile b/drivers/gpu/drm/nexell/Makefile
--- a/drivers/gpu/drm/nexell/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/Makefile	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,14 @@
+#
+# Makefile for the drm device driver.  This driver provides support for the
+# Direct Rendering Infrastructure (DRI) in XFree86 4.1.0 and higher.
+
+ccflags-y := -Iinclude/drm -Idrivers/gpu/drm/nexell
+nx_drm-y  := nx_drm_drv.o nx_drm_connector.o nx_drm_encoder.o \
+			nx_drm_crtc.o nx_drm_plane.o nx_drm_fb.o nx_drm_gem.o
+
+obj-$(CONFIG_DRM_NX)			+= soc/
+obj-$(CONFIG_DRM_NX_RGB)		+= nx_drm_lcd.o
+obj-$(CONFIG_DRM_NX_LVDS)		+= nx_drm_lcd.o
+obj-$(CONFIG_DRM_NX_MIPI_DSI)	+= nx_drm_lcd.o
+obj-$(CONFIG_DRM_NX_HDMI)		+= nx_drm_hdmi.o
+obj-$(CONFIG_DRM_NX)			+= nx_drm.o
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_connector.c b/drivers/gpu/drm/nexell/nx_drm_connector.c
--- a/drivers/gpu/drm/nexell/nx_drm_connector.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_connector.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,254 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_connector.h"
+#include "nx_drm_encoder.h"
+#include "soc/s5pxx18_drm_dp.h"
+
+static int nx_drm_connector_get_modes(struct drm_connector *connector)
+{
+	struct nx_drm_device *display = to_nx_connector(connector)->display;
+	struct nx_drm_ops *ops = display->ops;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	if (ops && ops->get_modes)
+		return ops->get_modes(display->dev, connector);
+
+	DRM_ERROR("fail : create a new display mode.\n");
+	return 0;
+}
+
+static int nx_drm_connector_mode_valid(struct drm_connector *connector,
+			struct drm_display_mode *mode)
+{
+	struct nx_drm_device *display = to_nx_connector(connector)->display;
+	struct nx_drm_ops *ops = display->ops;
+
+	DRM_DEBUG_KMS("enter\n");
+	DRM_DEBUG_KMS("bpp specified : %s, %d\n",
+		connector->cmdline_mode.bpp_specified ? "yes" : "no",
+		connector->cmdline_mode.bpp);
+
+	if (ops && ops->check_mode)
+		return ops->check_mode(display->dev, mode);
+
+	return MODE_BAD;
+}
+
+struct drm_encoder *nx_drm_best_encoder(struct drm_connector *connector)
+{
+	struct nx_drm_connector *nx_connector = to_nx_connector(connector);
+	struct drm_encoder *encoder = nx_connector->encoder;
+
+	if (encoder)
+		DRM_DEBUG_KMS("encoodr id:%d (enc.%d) panel %s\n",
+			encoder->base.id, to_nx_encoder(encoder)->pipe,
+			dp_panel_type_name(
+				dp_panel_get_type(nx_connector->display)));
+
+	DRM_DEBUG_KMS("connector id:%d\n", connector->base.id);
+	return encoder;
+}
+
+static struct drm_connector_helper_funcs nx_drm_connector_helper_funcs = {
+	.get_modes = nx_drm_connector_get_modes,
+	.mode_valid = nx_drm_connector_mode_valid,
+	.best_encoder = nx_drm_best_encoder,
+};
+
+static enum drm_connector_status nx_drm_connector_detect(
+			struct drm_connector *connector, bool force)
+{
+	struct nx_drm_connector *nx_connector = to_nx_connector(connector);
+	struct nx_drm_device *display = nx_connector->display;
+	struct nx_drm_ops *ops = display->ops;
+	enum drm_connector_status status = connector_status_disconnected;
+
+	DRM_DEBUG_KMS("enter connector id:%d\n", connector->base.id);
+
+	if (ops && ops->is_connected) {
+		if (ops->is_connected(display->dev, connector))
+			status = connector_status_connected;
+		else
+			status = connector_status_disconnected;
+	}
+
+	DRM_DEBUG_KMS("status: %s\n",
+		status == connector_status_connected ? "connected" :
+	    "disconnected");
+
+	return status;
+}
+
+static void nx_drm_connector_destroy(struct drm_connector *connector)
+{
+	struct nx_drm_connector *nx_connector = to_nx_connector(connector);
+	struct drm_device *drm = connector->dev;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	drm_connector_unregister(connector);
+	drm_connector_cleanup(connector);
+	devm_kfree(drm->dev, nx_connector);
+}
+
+static int nx_drm_connector_dpms(struct drm_connector *connector, int mode)
+{
+	DRM_DEBUG_KMS("enter [CONNECTOR:%d]  dpms:%d\n",
+		connector->base.id, mode);
+
+	return drm_helper_connector_dpms(connector, mode);
+}
+
+static struct drm_connector_funcs nx_drm_connector_funcs = {
+	.dpms = nx_drm_connector_dpms,
+	.detect = nx_drm_connector_detect,
+	.destroy = nx_drm_connector_destroy,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+};
+
+void nx_drm_connector_destroy_and_detach(struct drm_connector *connector)
+{
+	struct drm_encoder *encoder;
+
+	BUG_ON(!connector);
+	encoder = connector->encoder;
+
+	if (encoder)
+		encoder->funcs->destroy(encoder);
+
+	if (connector)
+		connector->funcs->destroy(connector);
+}
+EXPORT_SYMBOL(nx_drm_connector_destroy_and_detach);
+
+struct drm_connector *nx_drm_connector_create_and_attach(
+			struct drm_device *drm,
+			struct nx_drm_device *display, int pipe,
+			unsigned int possible_crtcs,
+			enum dp_panel_type panel_type, void *context)
+{
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_drm_connector *nx_connector;
+	struct drm_connector *connector;
+	struct drm_encoder *encoder;
+
+	/* bitmask of potential CRTC bindings */
+	int con_type = 0, enc_type = 0;
+	bool interlace_allowed = false;
+	uint8_t polled = 0;
+	int err;
+
+	/*
+	 * if no possible crtcs, you can connect all crtcs.
+	 */
+	if (0 == possible_crtcs)
+		possible_crtcs = (1 << priv->num_crtcs) - 1;
+
+	DRM_DEBUG_KMS("enter pipe.%d crtc mask:0x%x\n", pipe, possible_crtcs);
+
+	BUG_ON(!display);
+
+	switch (panel_type) {
+	case dp_panel_type_rgb:
+		con_type = DRM_MODE_CONNECTOR_VGA;
+		enc_type = DRM_MODE_ENCODER_TMDS;
+		break;
+	case dp_panel_type_lvds:
+		con_type = DRM_MODE_CONNECTOR_LVDS;
+		enc_type = DRM_MODE_ENCODER_LVDS;
+		break;
+	case dp_panel_type_mipi:	/* MiPi DSI */
+		con_type = DRM_MODE_CONNECTOR_DSI;
+		enc_type = DRM_MODE_ENCODER_DSI;
+		break;
+	case dp_panel_type_hdmi:
+		con_type = DRM_MODE_CONNECTOR_HDMIA;
+		enc_type = DRM_MODE_ENCODER_TMDS;
+		interlace_allowed = true;
+		break;
+	case dp_panel_type_vidi:
+		con_type = DRM_MODE_CONNECTOR_VIRTUAL;
+		enc_type = DRM_MODE_ENCODER_VIRTUAL;
+		break;
+	default:
+		con_type = DRM_MODE_CONNECTOR_Unknown;
+		DRM_ERROR("fail : unknown drm connector type(%d)\n",
+			panel_type);
+		return NULL;
+	}
+	polled = DRM_CONNECTOR_POLL_HPD;	/* for hpd_irq_event */
+
+	nx_connector = kzalloc(sizeof(*nx_connector), GFP_KERNEL);
+	if (!nx_connector)
+		return NULL;
+
+	connector = &nx_connector->connector;
+	connector->polled = polled;
+	connector->interlace_allowed = interlace_allowed;
+
+	/* create encoder */
+	encoder = nx_drm_encoder_create(drm, display, enc_type,
+					pipe, possible_crtcs, context);
+	if (IS_ERR(encoder))
+		goto err_alloc;
+
+	/* create connector and attach */
+	drm_connector_helper_add(connector, &nx_drm_connector_helper_funcs);
+	drm_connector_init(drm, connector, &nx_drm_connector_funcs, con_type);
+	err = drm_connector_register(connector);
+	if (err)
+		goto err_encoder;
+
+	//connector->encoder = encoder;
+	err = drm_mode_connector_attach_encoder(connector, encoder);
+	if (err) {
+		DRM_ERROR("fail : attach a connector to a encoder\n");
+		goto err_connector;
+	}
+
+	nx_connector->display = display;
+	nx_connector->context = context;
+	nx_connector->encoder = encoder;
+
+	/* inititalize dpms status */
+	connector->dpms = nx_drm_dp_encoder_get_dpms(encoder);
+
+	DRM_DEBUG_KMS("done, encoder id:%d , connector id:%d, dpms %s\n",
+		encoder->base.id, connector->base.id,
+		connector->dpms == DRM_MODE_DPMS_ON ? "on" : "off");
+
+	return connector;
+
+err_connector:
+	drm_connector_unregister(connector);
+err_encoder:
+	drm_connector_cleanup(connector);
+	if (encoder)
+		encoder->funcs->destroy(encoder);
+err_alloc:
+	kfree(nx_connector);
+
+	return NULL;
+}
+EXPORT_SYMBOL(nx_drm_connector_create_and_attach);
+
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_connector.h b/drivers/gpu/drm/nexell/nx_drm_connector.h
--- a/drivers/gpu/drm/nexell/nx_drm_connector.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_connector.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_CONNECTOR_H_
+#define _NX_DRM_CONNECTOR_H_
+
+#include "soc/s5pxx18_drm_dp.h"
+
+struct nx_drm_connector {
+	struct drm_connector connector;
+	struct drm_encoder *encoder;
+	struct nx_drm_device *display;
+	void *context;		/* device context */
+};
+
+#define to_nx_connector(c)		\
+		container_of(c, struct nx_drm_connector, connector)
+
+struct drm_connector *nx_drm_connector_create_and_attach(
+			struct drm_device *drm,
+			struct nx_drm_device *display,
+			int pipe, unsigned int possible_crtcs,
+			enum dp_panel_type panel_type, void *context);
+
+void nx_drm_connector_destroy_and_detach(struct drm_connector *connector);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_crtc.c b/drivers/gpu/drm/nexell/nx_drm_crtc.c
--- a/drivers/gpu/drm/nexell/nx_drm_crtc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_crtc.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,674 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include <linux/of.h>
+#include <linux/of_graph.h>
+#include <linux/of_address.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_crtc.h"
+#include "nx_drm_plane.h"
+#include "nx_drm_gem.h"
+#include "nx_drm_fb.h"
+#include "soc/s5pxx18_drm_dp.h"
+
+/*
+ * for multiple framebuffers.
+ */
+static int  fb_align_rgb = 1;
+static bool fb_vblank_wait;
+MODULE_PARM_DESC(fb_align, "frame buffer's align (0~4096)");
+MODULE_PARM_DESC(fb_vblank, "frame buffer wait vblank for pan display");
+
+module_param_named(fb_align, fb_align_rgb, int, 0600);
+module_param_named(fb_vblank, fb_vblank_wait, bool, 0600);
+
+static void nx_drm_crtc_dpms(struct drm_crtc *crtc, int mode)
+{
+	struct drm_device *drm = crtc->dev;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+
+	DRM_DEBUG_KMS("enter [CRTC:%d] dpms:%d\n", crtc->base.id, mode);
+
+	if (nx_crtc->dpms_mode == mode) {
+		DRM_DEBUG_KMS("dpms %d same as previous one.\n", mode);
+		return;
+	}
+
+	mutex_lock(&drm->struct_mutex);
+
+	switch (mode) {
+	case DRM_MODE_DPMS_ON:
+		nx_crtc->dpms_mode = mode;
+		break;
+	case DRM_MODE_DPMS_STANDBY:
+	case DRM_MODE_DPMS_SUSPEND:
+	case DRM_MODE_DPMS_OFF:
+		nx_crtc->dpms_mode = mode;
+		break;
+	default:
+		DRM_ERROR("fail : unspecified mode %d\n", mode);
+		goto err_dpms;
+	}
+
+	nx_drm_dp_crtc_dpms(crtc, mode);
+
+err_dpms:
+	mutex_unlock(&drm->struct_mutex);
+}
+
+static void nx_drm_crtc_prepare(struct drm_crtc *crtc)
+{
+	DRM_DEBUG_KMS("enter\n");
+}
+
+static void nx_drm_crtc_commit(struct drm_crtc *crtc)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+
+	DRM_DEBUG_KMS("enter current [CRTC:%d] dpms:%d\n",
+		crtc->base.id, nx_crtc->dpms_mode);
+
+	/*
+	 * when set_crtc is requested from user or at booting time,
+	 * crtc->commit would be called without dpms call so if dpms is
+	 * no power on then crtc->dpms should be called
+	 * with DRM_MODE_DPMS_ON for the hardware power to be on.
+	 */
+	if (nx_crtc->dpms_mode != DRM_MODE_DPMS_ON)
+		nx_drm_crtc_dpms(crtc, DRM_MODE_DPMS_ON);
+
+	nx_drm_dp_crtc_commit(crtc);
+}
+
+static bool nx_drm_crtc_mode_fixup(struct drm_crtc *crtc,
+			const struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+static int nx_drm_crtc_mode_set(struct drm_crtc *crtc,
+			struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode,
+			int x, int y,
+			struct drm_framebuffer *old_fb)
+{
+	struct drm_framebuffer *fb = crtc->primary->fb;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct drm_plane *plane = crtc->primary;
+	struct videomode vm;
+	unsigned int crtc_w, crtc_h, src_w, src_h;
+	int ret = 0;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	drm_display_mode_to_videomode(mode, &vm);
+	drm_mode_copy(&nx_crtc->current_mode, mode);
+
+	/*
+	 * copy the mode data adjusted by mode_fixup() into crtc->mode
+	 * so that hardware can be seet to proper mode.
+	 */
+	memcpy(&crtc->mode, adjusted_mode, sizeof(*adjusted_mode));
+
+	crtc_w = vm.hactive;
+	crtc_h = vm.vactive;
+	src_w = fb->width - x;
+	src_h = fb->height - y;
+
+	ret = nx_drm_dp_plane_mode_set(crtc,
+				crtc->primary, fb,
+				0, 0, crtc_w, crtc_h, x, y, src_w, src_h);
+	if (0 > ret)
+		return ret;
+
+	plane->crtc = crtc;
+	to_nx_plane(plane)->enabled = true;
+
+	return ret;
+}
+
+static int nx_drm_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
+			struct drm_framebuffer *old_fb)
+{
+	struct drm_device *drm = crtc->dev;
+	struct drm_framebuffer *fb = crtc->primary->fb;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_drm_fbdev *fbdev = priv->framebuffer_dev->fbdev;
+	struct videomode vm;
+	unsigned int crtc_w, crtc_h, src_w, src_h;
+	int align = fb_align_rgb;
+	bool doublefb = fbdev->fb_buffers > 1 ? true : false;
+	bool vblank = false;
+	int ret;
+
+	drm_display_mode_to_videomode(&nx_crtc->current_mode, &vm);
+
+	/* when framebuffer changing is requested, crtc's dpms should be on */
+	if (nx_crtc->dpms_mode > DRM_MODE_DPMS_ON) {
+		DRM_ERROR("fail : framebuffer changing request.\n");
+		return -EPERM;
+	}
+
+	crtc_w = fb->width;  /* vm.hactive; */
+	crtc_h = fb->height; /* vm.vactive; */
+	src_w = fb->width - x;
+	src_h = fb->height - y;
+
+	DRM_DEBUG_KMS("crtc.%d [%d:%d] pos[%d:%d] src[%d:%d] fb[%d:%d]\n",
+		nx_crtc->pipe, crtc_w, crtc_h, x, y, src_w, src_h,
+		fb->width, fb->height);
+
+	/* for multiple buffers */
+	if (doublefb) {
+		if (y >= fb->height)
+			src_h = fb->height;
+
+		if (fb_vblank_wait &&
+			drm->driver->enable_vblank) {
+			drm->driver->enable_vblank(drm, nx_crtc->pipe);
+			vblank = true;
+		}
+	}
+
+	ret = nx_drm_dp_plane_update(crtc->primary, fb, 0, 0,
+				   crtc_w, crtc_h, x, y, src_w, src_h, align);
+
+	if (!ret && vblank)
+		drm_wait_one_vblank(drm, nx_crtc->pipe);
+
+	return ret;
+}
+
+static void nx_drm_crtc_disable(struct drm_crtc *crtc)
+{
+	struct drm_plane *plane;
+	int ret;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	nx_drm_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+
+	drm_for_each_plane(plane, crtc->dev) {
+		if (plane->crtc != crtc)
+			continue;
+		ret = plane->funcs->disable_plane(plane, NULL);
+		if (ret)
+			DRM_ERROR("fail : disable plane %d\n", ret);
+	}
+}
+
+static struct drm_crtc_helper_funcs nx_crtc_helper_funcs = {
+	.dpms = nx_drm_crtc_dpms,
+	.prepare = nx_drm_crtc_prepare,
+	.commit = nx_drm_crtc_commit,
+	.mode_fixup = nx_drm_crtc_mode_fixup,
+	.mode_set = nx_drm_crtc_mode_set,
+	.mode_set_base = nx_drm_crtc_mode_set_base,
+	.disable = nx_drm_crtc_disable,
+};
+
+static int nx_drm_crtc_page_flip(struct drm_crtc *crtc,
+			struct drm_framebuffer *fb,
+			struct drm_pending_vblank_event *event,
+			uint32_t flags,
+			struct drm_modeset_acquire_ctx *ctx)
+{
+	struct drm_device *drm = crtc->dev;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct drm_framebuffer *old_fb = crtc->primary->fb;
+	unsigned int crtc_w, crtc_h;
+	int pipe = nx_crtc->pipe;
+	int ret;
+
+	DRM_DEBUG_KMS("page flip crtc.%d\n", nx_crtc->pipe);
+
+	/* when the page flip is requested, crtc's dpms should be on */
+	if (nx_crtc->dpms_mode > DRM_MODE_DPMS_ON) {
+		DRM_ERROR("fail : page flip request.\n");
+		return -EINVAL;
+	}
+
+	if (!event)
+		return -EINVAL;
+
+	spin_lock_irq(&drm->event_lock);
+
+	if (nx_crtc->event) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	ret = drm_crtc_vblank_get(crtc);
+	if (ret) {
+		DRM_ERROR("fail : to acquire vblank counter\n");
+		goto out;
+	}
+
+	nx_crtc->event = event;
+	spin_unlock_irq(&drm->event_lock);
+
+	/*
+	 * the pipe from user always is 0 so we can set pipe number
+	 * of current owner to event.
+	 */
+	event->pipe = pipe;
+
+	crtc->primary->fb = fb;
+	crtc_w = fb->width - crtc->x;
+	crtc_h = fb->height - crtc->y;
+
+	ret = nx_drm_dp_plane_update(crtc->primary, fb, 0, 0,
+			crtc_w, crtc_h, crtc->x, crtc->y, crtc_w, crtc_h, 0);
+
+	if (ret) {
+		DRM_DEBUG("fail : plane update for page flip %d\n", ret);
+		crtc->primary->fb = old_fb;
+		spin_lock_irq(&drm->event_lock);
+		nx_crtc->event = NULL;
+		drm_crtc_vblank_put(crtc);
+		spin_unlock_irq(&drm->event_lock);
+		return ret;
+	}
+
+	return 0;
+
+out:
+	spin_unlock_irq(&drm->event_lock);
+	return ret;
+}
+
+static void nx_drm_crtc_destroy(struct drm_crtc *crtc)
+{
+	struct nx_drm_priv *priv = crtc->dev->dev_private;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	int pipe = nx_crtc->pipe;
+
+	DRM_DEBUG_KMS("enter crtc.%d\n", nx_crtc->pipe);
+
+	priv->crtcs[pipe] = NULL;
+
+	drm_crtc_cleanup(crtc);
+	kfree(nx_crtc);
+}
+
+static struct drm_crtc_funcs nx_crtc_funcs = {
+	.set_config = drm_crtc_helper_set_config,
+	.page_flip = nx_drm_crtc_page_flip,
+	.destroy = nx_drm_crtc_destroy,
+};
+
+int nx_drm_crtc_enable_vblank(struct drm_device *drm, unsigned int pipe)
+{
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(priv->crtcs[pipe]);
+
+	DRM_DEBUG_KMS("enter pipe.%d\n", pipe);
+
+	if (nx_crtc->dpms_mode != DRM_MODE_DPMS_ON)
+		return -EPERM;
+
+	nx_drm_dp_crtc_irq_on(&nx_crtc->crtc, pipe);
+
+	return 0;
+}
+
+void nx_drm_crtc_disable_vblank(struct drm_device *drm, unsigned int pipe)
+{
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(priv->crtcs[pipe]);
+
+	DRM_DEBUG_KMS("enter pipe.%d\n", pipe);
+
+	nx_drm_dp_crtc_irq_off(&nx_crtc->crtc, pipe);
+}
+
+#ifdef DEBUG_FPS_TIME
+#define	SHOW_PERIOD_SEC		1
+#define	FPS_HZ	(60)
+#define	DUMP_FPS_TIME(p) {	\
+	static long ts[2] = { 0, }, vb_count;	\
+	long new = ktime_to_ms(ktime_get());	\
+	if (0 == (vb_count++ % (FPS_HZ * SHOW_PERIOD_SEC)))	\
+		pr_info("[dp.%d] %ld ms\n", p, new - ts[p]);	\
+	ts[p] = new;	\
+	}
+#else
+#define	DUMP_FPS_TIME(p)
+#endif
+
+static irqreturn_t nx_drm_crtc_interrupt(int irq, void *arg)
+{
+	struct drm_device *drm = arg;
+	struct nx_drm_priv *priv = drm->dev_private;
+	int i;
+
+	for (i = 0; i < priv->num_crtcs; i++) {
+		struct drm_crtc *crtc = priv->crtcs[i];
+		struct nx_drm_crtc *nx_crtc;
+
+		if (!crtc)
+			continue;
+
+		nx_crtc = to_nx_crtc(crtc);
+
+		if (irq == nx_crtc->pipe_irq) {
+			struct drm_pending_vblank_event *event = NULL;
+			int pipe = nx_crtc->pipe;
+
+			drm_crtc_handle_vblank(crtc);
+
+			spin_lock(&drm->event_lock);
+
+			event = nx_crtc->event;
+			if (event) {
+				if (nx_crtc->post_closed) {
+					drm_crtc_vblank_put(crtc);
+					//event->base.destroy(&event->base);
+                    drm_event_cancel_free(crtc->dev, &event->base);
+				} else {
+					drm_crtc_send_vblank_event(crtc, event);
+					drm_crtc_vblank_put(crtc);
+				}
+				nx_crtc->event = NULL;
+				nx_crtc->post_closed = false;
+			}
+
+			spin_unlock(&drm->event_lock);
+
+			DUMP_FPS_TIME(pipe);
+
+			/* clear irq */
+			nx_drm_dp_crtc_irq_done(crtc, pipe);
+			break;
+		}
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int nx_drm_crtc_irq_install(struct drm_device *drm,
+			struct drm_crtc *crtc)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct drm_driver *drv = drm->driver;
+	int irq = nx_crtc->pipe_irq;
+	int ret = 0;
+
+	if (NULL == drv->irq_handler)
+		drv->irq_handler = nx_drm_crtc_interrupt;
+
+	if (drm->irq_enabled)
+		drm->irq_enabled = false;
+
+	ret = drm_irq_install(drm, irq);
+	if (0 > ret)
+		DRM_ERROR("fail : crtc.%d irq %d !!!\n", nx_crtc->pipe, irq);
+
+	DRM_INFO("irq %d install for crtc.%d\n", irq, nx_crtc->pipe);
+
+	return ret;
+}
+
+static int __of_graph_get_port_num_index(struct drm_device *drm,
+			int *pipe, int pipe_size)
+{
+	struct device *dev = drm->dev;
+	struct device_node *parent = dev->of_node;
+	struct device_node *node, *port;
+	int num = 0;
+
+	node = of_get_child_by_name(parent, "ports");
+	if (node)
+		parent = node;
+
+	for_each_child_of_node(parent, port) {
+		u32 port_id = 0;
+
+		if (of_node_cmp(port->name, "port") != 0)
+			continue;
+		if (of_property_read_u32(port, "reg", &port_id))
+			continue;
+
+		pipe[num] = port_id;
+		num++;
+
+		if (num > (pipe_size - 1))
+			break;
+	}
+	of_node_put(node);
+
+	return num;
+}
+
+#define parse_read_prop(n, s, v)	{ \
+	u32 _v;	\
+	if (!of_property_read_u32(n, s, &_v))	\
+		v = _v;	\
+	}
+
+static int nx_drm_crtc_parse_dt_setup(struct drm_device *drm,
+			struct drm_crtc *crtc, int pipe)
+{
+	struct device_node *np;
+	struct device *dev = drm->dev;
+	struct device_node *node = dev->of_node;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct dp_plane_top *top = &nx_crtc->top;
+	const char *strings[10];
+	int i, size = 0, err;
+	int irq = INVALID_IRQ;
+
+	DRM_DEBUG_KMS("crtc.%d for %s\n", pipe, dev_name(dev));
+
+	/*
+	 * parse base address
+	 */
+	err = nx_drm_dp_crtc_res_parse(to_platform_device(drm->dev), pipe, &irq,
+				nx_crtc->resets, &nx_crtc->num_resets);
+	if (0 > err)
+		return -EINVAL;
+
+	nx_crtc->pipe_irq = irq;
+
+	if (INVALID_IRQ != nx_crtc->pipe_irq) {
+		err = nx_drm_crtc_irq_install(drm, crtc);
+		if (0 > err)
+			return -EINVAL;
+	}
+
+	/*
+	 * parse port properties.
+	 */
+	np = of_graph_get_port_by_id(node, pipe);
+	if (!np)
+		return -EINVAL;
+
+	parse_read_prop(np, "back_color", top->back_color);
+	parse_read_prop(np, "color_key", top->color_key);
+
+	size = of_property_read_string_array(np, "plane-names", strings, 10);
+	top->num_planes = size;
+
+	for (i = 0; size > i; i++) {
+		if (!strcmp("primary", strings[i])) {
+			top->plane_type[i] = DRM_PLANE_TYPE_PRIMARY;
+			top->plane_flag[i] = PLANE_FLAG_RGB;
+		} else if (!strcmp("cursor", strings[i])) {
+			top->plane_type[i] = DRM_PLANE_TYPE_CURSOR;
+			top->plane_flag[i] = PLANE_FLAG_RGB;
+		} else if (!strcmp("rgb", strings[i])) {
+			top->plane_type[i] = DRM_PLANE_TYPE_OVERLAY;
+			top->plane_flag[i] = PLANE_FLAG_RGB;
+		} else if (!strcmp("video", strings[i])) {
+			top->plane_type[i] = DRM_PLANE_TYPE_OVERLAY;
+			top->plane_flag[i] = PLANE_FLAG_VIDEO;	/* video */
+			top->video_prior = i;	/* priority */
+		} else {
+			top->plane_flag[i] = PLANE_FLAG_UNKNOWN;
+			DRM_ERROR("fail : unknown plane name [%d] %s\n",
+				i, strings[i]);
+		}
+		DRM_DEBUG_KMS("crtc.%d planes[%d]: %s, bg:0x%08x, key:0x%08x\n",
+			pipe, i, strings[i], top->back_color, top->color_key);
+	}
+
+	return 0;
+}
+
+static int nx_drm_crtc_create_planes(struct drm_device *drm,
+			struct drm_crtc *crtc)
+{
+	struct drm_plane **planes;
+	struct drm_plane *plane, *plane_primary = NULL, *plane_cursor = NULL;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct dp_plane_top *top = &nx_crtc->top;
+	int i = 0, ret = 0;
+	int num = 0, plane_num = 0;
+
+	/* setup crtc's planes */
+	planes = kzalloc(sizeof(struct drm_plane *) * top->num_planes,
+				GFP_KERNEL);
+	if (!planes)
+		return -ENOMEM;
+
+	for (i = 0; top->num_planes > i; i++) {
+		enum drm_plane_type drm_type = top->plane_type[i];
+		bool video = top->plane_flag[i] == PLANE_FLAG_VIDEO ?
+						true : false;
+
+		if (PLANE_FLAG_UNKNOWN == top->plane_flag[i])
+			continue;
+
+		plane_num = video ? PLANE_VIDEO_NUM : num++;
+
+		plane = nx_drm_plane_init(
+				drm, crtc, drm_crtc_mask(crtc), drm_type, plane_num);
+		if (IS_ERR(plane)) {
+			ret = PTR_ERR(plane);
+			goto err_plane;
+		}
+
+		switch( drm_type ) {
+		case DRM_PLANE_TYPE_PRIMARY:
+			top->primary_plane = num - 1;
+			plane_primary = plane;
+			break;
+		case DRM_PLANE_TYPE_CURSOR:
+			plane_cursor = plane;
+			break;
+		default:
+			break;
+		}
+		planes[i] = plane;
+	}
+	ret = drm_crtc_init_with_planes(drm,
+			crtc, plane_primary, plane_cursor, &nx_crtc_funcs, NULL);
+	if (0 > ret)
+		goto err_plane;
+	drm_crtc_helper_add(crtc, &nx_crtc_helper_funcs);
+	kfree(planes);
+
+	return 0;
+
+err_plane:
+	for (i = 0; top->num_planes > i; i++) {
+		plane = planes[i];
+		if (plane)
+			plane->funcs->destroy(plane);
+	}
+
+	kfree(planes);
+
+	return ret;
+}
+
+int nx_drm_crtc_init(struct drm_device *drm)
+{
+	struct nx_drm_crtc **nx_crtcs;
+	int pipes[10], num_crtcs = 0;
+	int size = ARRAY_SIZE(pipes);
+	int i = 0, ret = 0;
+	int align = fb_align_rgb;
+
+	/* get ports 'reg' property value */
+	num_crtcs = __of_graph_get_port_num_index(drm, pipes, size);
+
+	if (PAGE_SIZE >= align && align > 0)
+		fb_align_rgb = align;
+	else
+		fb_align_rgb = 1;
+
+	DRM_INFO("num of crtcs %d, FB %d align, FB vblank %s\n",
+		num_crtcs, fb_align_rgb, fb_vblank_wait ? "Wait" : "Pass");
+
+	/* setup crtc's planes */
+	nx_crtcs = kzalloc(sizeof(struct nx_drm_crtc *) * num_crtcs,
+				GFP_KERNEL);
+	if (!nx_crtcs)
+		return -ENOMEM;
+
+	for (i = 0; num_crtcs > i; i++) {
+		struct nx_drm_priv *priv;
+		struct nx_drm_crtc *nx_crtc;
+		int pipe = pipes[i];	/* reg property */
+
+		nx_crtc = kzalloc(sizeof(struct nx_drm_crtc), GFP_KERNEL);
+		if (!nx_crtc)
+			goto err_crtc;
+
+		priv = drm->dev_private;
+		priv->crtcs[i] = &nx_crtc->crtc;	/* sequentially link */
+		priv->num_crtcs++;
+		priv->possible_pipes |= (1 << pipe);
+
+		nx_crtc->pipe = pipe;
+		nx_crtc->dpms_mode = DRM_MODE_DPMS_OFF;
+		nx_crtc->pipe_irq = INVALID_IRQ;
+
+		ret = nx_drm_crtc_parse_dt_setup(drm, &nx_crtc->crtc, pipe);
+		if (0 > ret)
+			return ret;
+
+		nx_drm_dp_crtc_init(drm, &nx_crtc->crtc, pipe);
+		ret = nx_drm_crtc_create_planes(drm, &nx_crtc->crtc);
+		if (0 > ret)
+			goto err_crtc;
+
+		nx_crtcs[i]	= nx_crtc;
+		DRM_INFO("crtc[%d]: pipe.%d (irq.%d)\n",
+			i, pipe, nx_crtc->pipe_irq);
+	}
+
+	kfree(nx_crtcs);
+
+	DRM_DEBUG_KMS("done\n");
+	return 0;
+
+err_crtc:
+	for (i = 0; num_crtcs > i; i++)
+		kfree(nx_crtcs[i]);
+
+	kfree(nx_crtcs);
+
+	return ret;
+}
+
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_crtc.h b/drivers/gpu/drm/nexell/nx_drm_crtc.h
--- a/drivers/gpu/drm/nexell/nx_drm_crtc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_crtc.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_CRTC_H_
+#define _NX_DRM_CRTC_H_
+
+#include "soc/s5pxx18_drm_dp.h"
+
+struct nx_drm_crtc {
+	struct drm_crtc crtc;
+	struct drm_display_mode	current_mode;
+	int pipe;		/* hw crtc index */
+	int pipe_irq;
+	struct dp_plane_top top;
+	struct drm_pending_vblank_event *event;
+	unsigned int dpms_mode;
+	struct reset_control *resets[2];
+	int num_resets;
+	bool post_closed;
+	bool suspended;
+};
+
+#define to_nx_crtc(x)	\
+		container_of(x, struct nx_drm_crtc, crtc)
+
+int nx_drm_crtc_init(struct drm_device *dev);
+int nx_drm_crtc_enable_vblank(struct drm_device *dev, unsigned int pipe);
+void nx_drm_crtc_disable_vblank(struct drm_device *dev, unsigned int pipe);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_drv.c b/drivers/gpu/drm/nexell/nx_drm_drv.c
--- a/drivers/gpu/drm/nexell/nx_drm_drv.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_drv.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,442 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include <drm/drm_fb_helper.h>
+#include <linux/of_platform.h>
+#include <linux/component.h>
+
+#include <drm/nexell_drm.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_crtc.h"
+#include "nx_drm_connector.h"
+#include "nx_drm_encoder.h"
+#include "nx_drm_fb.h"
+#include "nx_drm_plane.h"
+#include "nx_drm_gem.h"
+
+/*
+ * DRM Configuration
+ *
+ * CRTC		    : MLC top control (and display interrupt, reset, clock, ...)
+ * Plane	    : MLC layer control
+ * Encoder	    : DPC control
+ * Connector	: DRM connetcor for LCD, LVDS, MiPi, HDMI,...
+ * Panel	    : Display device control (LCD, LVDS, MiPi, HDMI,...)
+ *
+ */
+
+static void nx_drm_output_poll_changed(struct drm_device *drm)
+{
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_framebuffer_dev *nx_framebuffer = priv->framebuffer_dev;
+
+	DRM_DEBUG_KMS("enter : fbdev %s\n",
+		nx_framebuffer ? "exist" : "non exist");
+
+	mutex_lock(&priv->lock);
+
+	if (nx_framebuffer && nx_framebuffer->fbdev)
+		drm_fb_helper_hotplug_event(
+			(struct drm_fb_helper *)nx_framebuffer->fbdev);
+	else
+		nx_drm_framebuffer_init(drm);
+
+	mutex_unlock(&priv->lock);
+	DRM_DEBUG_DRIVER("exit.\n");
+}
+
+static struct drm_mode_config_funcs nx_mode_config_funcs = {
+	.fb_create = nx_drm_fb_mode_create,
+	.output_poll_changed = nx_drm_output_poll_changed,
+};
+
+static void nx_drm_mode_config_init(struct drm_device *drm)
+{
+	drm->mode_config.min_width = 0;
+	drm->mode_config.min_height = 0;
+
+	/*
+	 * set max width and height as default value
+	 * this value would be used to check framebuffer size limitation
+	 * at drm_mode_addfb().
+	 */
+	drm->mode_config.max_width = MAX_FB_MODE_WIDTH;
+	drm->mode_config.max_height = MAX_FB_MODE_HEIGHT;
+	drm->mode_config.funcs = &nx_mode_config_funcs;
+
+	DRM_DEBUG_KMS("min %d*%d, max %d*%d\n",
+		 drm->mode_config.min_width, drm->mode_config.min_height,
+		 drm->mode_config.max_width, drm->mode_config.max_height);
+}
+
+static struct drm_ioctl_desc nx_drm_ioctls[] = {
+	DRM_IOCTL_DEF_DRV(NX_GEM_CREATE, nx_drm_gem_create_ioctl,
+			DRM_UNLOCKED | DRM_AUTH),
+	DRM_IOCTL_DEF_DRV(NX_GEM_SYNC, nx_drm_gem_sync_ioctl,
+			DRM_UNLOCKED | DRM_AUTH),
+	DRM_IOCTL_DEF_DRV(NX_GEM_GET, nx_drm_gem_get_ioctl,
+			DRM_UNLOCKED),
+};
+
+static const struct file_operations nx_drm_fops = {
+	.owner = THIS_MODULE,
+	.open = drm_open,
+	.release = drm_release,
+	.unlocked_ioctl = drm_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = drm_compat_ioctl,
+#endif
+	.poll = drm_poll,
+	.read = drm_read,
+	.llseek = no_llseek,
+	.mmap = nx_drm_gem_fops_mmap,
+};
+
+static void nx_drm_lastclose(struct drm_device *drm)
+{
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_drm_fbdev *fbdev;
+
+	if (!priv || !priv->framebuffer_dev)
+		return;
+
+	fbdev = priv->framebuffer_dev->fbdev;
+	if (fbdev)
+		drm_fb_helper_restore_fbdev_mode_unlocked(
+				(struct drm_fb_helper *)fbdev);
+}
+
+static void nx_drm_postclose(struct drm_device *drm, struct drm_file *file)
+{
+	struct drm_pending_vblank_event *event;
+	struct nx_drm_crtc *nx_crtc;
+	struct nx_drm_priv *priv = drm->dev_private;
+	unsigned long flags;
+	int i;
+
+	for (i = 0; i < priv->num_crtcs; i++) {
+		nx_crtc = to_nx_crtc(priv->crtcs[i]);
+		event = nx_crtc->event;
+		if (event && event->base.file_priv == file) {
+			spin_lock_irqsave(&drm->event_lock, flags);
+			nx_crtc->post_closed = true;
+			spin_unlock_irqrestore(&drm->event_lock, flags);
+		}
+	}
+}
+
+static struct drm_driver nx_drm_driver = {
+	.driver_features = DRIVER_HAVE_IRQ | DRIVER_MODESET |
+		DRIVER_GEM | DRIVER_PRIME | DRIVER_IRQ_SHARED,
+	.fops = &nx_drm_fops,	/* replace fops */
+	.lastclose = nx_drm_lastclose,
+	.postclose = nx_drm_postclose,
+
+	.enable_vblank = nx_drm_crtc_enable_vblank,
+	.disable_vblank = nx_drm_crtc_disable_vblank,
+
+	.prime_handle_to_fd = drm_gem_prime_handle_to_fd,
+	.prime_fd_to_handle = drm_gem_prime_fd_to_handle,
+
+	.gem_free_object = nx_drm_gem_free_object,
+
+	.gem_prime_export = nx_drm_gem_prime_export,
+	.gem_prime_import = drm_gem_prime_import,
+	.gem_prime_get_sg_table = nx_drm_gem_prime_get_sg_table,
+
+	.gem_prime_import_sg_table = nx_drm_gem_prime_import_sg_table,
+
+	.dumb_create = nx_drm_gem_dumb_create,
+	.dumb_map_offset = nx_drm_gem_dumb_map_offset,
+	.dumb_destroy = drm_gem_dumb_destroy,
+
+	.ioctls = nx_drm_ioctls,
+	.num_ioctls = ARRAY_SIZE(nx_drm_ioctls),
+
+	.name = "nexell",
+	.desc = "nexell SoC DRM",
+	.date  = "20160219",
+	.major = 2,
+	.minor = 0,
+};
+
+static int nx_drm_bind(struct device *dev)
+{
+	struct drm_device *drm;
+	struct nx_drm_priv *priv;
+	int ret;
+
+	drm = drm_dev_alloc(&nx_drm_driver, dev);
+	if (IS_ERR(drm))
+		return PTR_ERR(drm);
+
+	priv = kzalloc(sizeof(struct nx_drm_priv), GFP_KERNEL);
+	if (!priv) {
+		ret = -ENOMEM;
+		goto err_free_drm;
+	}
+
+	mutex_init(&priv->lock);
+	drm->dev_private = (void *)priv;
+	dev_set_drvdata(dev, drm);
+
+	/* drm->mode_config initialization */
+	drm_mode_config_init(drm);
+	nx_drm_mode_config_init(drm);
+
+	/* Try to nexell crtcs. */
+	ret = nx_drm_crtc_init(drm);
+	if (ret)
+		goto err_mode_config_cleanup;
+
+	ret = drm_vblank_init(drm, priv->num_crtcs);
+	if (ret)
+		goto err_unbind_all;
+
+	/* Try to bind all sub drivers. */
+	ret = component_bind_all(drm->dev, drm);
+	if (ret)
+		goto err_mode_config_cleanup;
+
+
+	/* init kms poll for handling hpd */
+	drm_kms_helper_poll_init(drm);
+
+	/* register the DRM device */
+	ret = drm_dev_register(drm, 0);
+	if (ret < 0)
+		goto err_cleanup_poll;
+
+	/* force connectors detection for LCD */
+	if (priv->force_detect)
+		drm_helper_hpd_irq_event(drm);
+	return 0;
+
+err_cleanup_poll:
+	drm_kms_helper_poll_fini(drm);
+err_unbind_all:
+	component_unbind_all(drm->dev, drm);
+
+err_mode_config_cleanup:
+	drm_mode_config_cleanup(drm);
+	kfree(priv);
+err_free_drm:
+	drm_dev_unref(drm);
+
+	return ret;
+}
+
+static void nx_drm_unbind(struct device *dev)
+{
+	struct drm_device *drm = dev_get_drvdata(dev);
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	nx_drm_framebuffer_fini(drm);
+
+	drm_kms_helper_poll_fini(drm);
+	drm_mode_config_cleanup(drm);
+	kfree(drm->dev_private);
+
+	drm->dev_private = NULL;
+}
+
+static const struct component_master_ops nx_drm_ops = {
+	.bind = nx_drm_bind,
+	.unbind = nx_drm_unbind,
+};
+
+static int match_dev(struct device *dev, void *data)
+{
+	return dev == (struct device *)data;
+}
+
+#ifdef CHECK_DRIVER_NAME
+static int match_drv(struct device_driver *drv, void *data)
+{
+	const char *t = data, *f = drv->name;
+
+	return strstr(f, t) ? 1 : 0;
+}
+#endif
+
+static int match_component(struct device *dev, void *data)
+{
+	const char *name = data;
+	const char *t = name, *f = dev_name(dev);
+
+	return strstr(f, t) ? 1 : 0;
+}
+
+static int nx_drm_probe(struct platform_device *pdev)
+{
+	struct component_match *match = NULL;
+	const char *const dev_names[] = {
+		/* node name (x:name) */
+#ifdef CONFIG_DRM_NX_RGB
+		"display_drm_rgb",
+#endif
+#ifdef CONFIG_DRM_NX_LVDS
+		"display_drm_lvds",
+#endif
+#ifdef CONFIG_DRM_NX_MIPI_DSI
+		"display_drm_mipi",
+#endif
+#ifdef CONFIG_DRM_NX_HDMI
+		"display_drm_hdmi",
+#endif
+	};
+	int found = 0;
+	int i;
+
+	DRM_DEBUG_DRIVER("enter %s\n", dev_name(&pdev->dev));
+
+	for (i = 0; i < ARRAY_SIZE(dev_names); i++) {
+		struct device *dev;
+
+		dev = bus_find_device(&platform_bus_type, NULL,
+				      (void *)dev_names[i], match_component);
+		if (!dev) {
+			DRM_INFO("not found device name: %s\n", dev_names[i]);
+			continue;
+		}
+
+		#ifdef CHECK_DRIVER_NAME
+		if (!bus_for_each_drv(dev->bus, NULL,
+			(void *)dev_names[i], match_drv)) {
+			DRM_INFO("not found driver: %s\n", dev_names[i]);
+			continue;
+		}
+		#endif
+
+		component_match_add(&pdev->dev, &match, match_dev, dev);
+		found++;
+	}
+
+	if (!found)
+		return -EINVAL;
+
+	pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
+
+	/* call master bind */
+	return component_master_add_with_match(&pdev->dev, &nx_drm_ops, match);
+}
+
+static int nx_drm_remove(struct platform_device *pdev)
+{
+	component_master_del(&pdev->dev, &nx_drm_ops);
+	return 0;
+}
+
+static const struct of_device_id dt_of_match[] = {
+	{.compatible = "nexell,s5pxx18-drm"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, dt_of_match);
+
+
+static int nx_drm_pm_suspend(struct device *dev)
+{
+	struct drm_connector *connector;
+	struct drm_device *drm = dev_get_drvdata(dev);
+	struct nx_drm_priv *priv = drm->dev_private;
+	int i;
+
+	DRM_DEBUG_DRIVER("enter %s\n", dev_name(dev));
+
+	drm_modeset_lock_all(drm);
+
+	for (i = 0; i < priv->num_crtcs; i++)
+		to_nx_crtc(priv->crtcs[i])->suspended = true;
+
+	list_for_each_entry(connector, &drm->mode_config.connector_list, head) {
+		int old_dpms = connector->dpms;
+		struct nx_drm_device *display =
+				to_nx_connector(connector)->display;
+
+		if (display)
+			display->suspended = true;
+
+		if (connector->funcs->dpms)
+			connector->funcs->dpms(connector, DRM_MODE_DPMS_OFF);
+
+		/* Set the old mode back to the connector for resume */
+		connector->dpms = old_dpms;
+	}
+
+	drm_modeset_unlock_all(drm);
+
+	return 0;
+}
+
+static int nx_drm_pm_resume(struct device *dev)
+{
+	struct drm_connector *connector;
+	struct drm_device *drm = dev_get_drvdata(dev);
+	struct nx_drm_priv *priv = drm->dev_private;
+	int i;
+
+	DRM_DEBUG_DRIVER("enter %s\n", dev_name(dev));
+
+	drm_modeset_lock_all(drm);
+
+	for (i = 0; i < priv->num_crtcs; i++)
+		nx_drm_dp_crtc_reset(priv->crtcs[i]);
+
+	list_for_each_entry(connector, &drm->mode_config.connector_list, head) {
+		if (connector->funcs->dpms) {
+			int dpms = connector->dpms;
+			struct nx_drm_device *display =
+					to_nx_connector(connector)->display;
+
+			connector->dpms = DRM_MODE_DPMS_OFF;
+			connector->funcs->dpms(connector, dpms);
+			if (display)
+				display->suspended = false;
+		}
+	}
+
+	for (i = 0; i < priv->num_crtcs; i++)
+		to_nx_crtc(priv->crtcs[i])->suspended = false;
+
+	drm_modeset_unlock_all(drm);
+
+	return 0;
+}
+
+static const struct dev_pm_ops nx_drm_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(nx_drm_pm_suspend, nx_drm_pm_resume)
+};
+
+static struct platform_driver nx_drm_platform_drv = {
+	.probe = nx_drm_probe,
+	.remove = nx_drm_remove,
+	.driver = {
+		   .owner = THIS_MODULE,
+		   .name = "nexell,display_drm",
+		   .of_match_table = dt_of_match,
+		   .pm	= &nx_drm_pm_ops,
+		   },
+};
+module_platform_driver(nx_drm_platform_drv);
+
+MODULE_AUTHOR("jhkim <jhkim@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell DRM Driver");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_drv.h b/drivers/gpu/drm/nexell/nx_drm_drv.h
--- a/drivers/gpu/drm/nexell/nx_drm_drv.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_drv.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_DRV_H_
+#define _NX_DRM_DRV_H_
+
+#include <linux/module.h>
+#include <linux/reset.h>
+
+#define MAX_CRTCS	2	/* Multi Layer Controller(MLC) nums (0, 1) */
+#define MAX_CONNECTOR	4	/* RGB, LVDS, MiPi, HDMI */
+
+#define MAX_FB_MODE_WIDTH	4096
+#define MAX_FB_MODE_HEIGHT	4096
+
+struct nx_drm_priv {
+	struct nx_framebuffer_dev *framebuffer_dev;
+	unsigned int possible_pipes;
+	bool force_detect;
+	struct drm_crtc *crtcs[MAX_CRTCS];
+	int num_crtcs;
+	struct mutex lock;
+};
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_encoder.c b/drivers/gpu/drm/nexell/nx_drm_encoder.c
--- a/drivers/gpu/drm/nexell/nx_drm_encoder.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_encoder.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,266 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include <linux/of_address.h>
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+#include <linux/pm_qos.h>
+#include <linux/soc/nexell/cpufreq.h>
+#endif
+
+#include "nx_drm_drv.h"
+#include "nx_drm_crtc.h"
+#include "nx_drm_encoder.h"
+#include "nx_drm_connector.h"
+#include "soc/s5pxx18_drm_dp.h"
+
+#define	nx_drm_dp_encoder_set_pipe(d, p)	{	\
+		struct dp_control_dev *dpc = drm_dev_get_dpc(d);	\
+		dpc->module = p;	\
+	}
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+static struct pm_qos_request dev_qos_req;
+
+static inline void dev_qos_update(int khz)
+{
+	int active = pm_qos_request_active(&dev_qos_req);
+
+	if (!active)
+		pm_qos_add_request(&dev_qos_req, PM_QOS_BUS_THROUGHPUT, khz);
+	else
+		pm_qos_update_request(&dev_qos_req, khz);
+}
+
+static void nx_drm_qos_up(struct drm_encoder *encoder)
+{
+	int khz = NX_BUS_CLK_DISP_KHZ;
+
+	DRM_DEBUG_KMS("[ENCODER:%d] qos up to %d khz\n",
+		encoder->base.id, khz);
+	dev_qos_update(khz);
+}
+
+static void nx_drm_qos_down(struct drm_encoder *encoder)
+{
+	struct drm_encoder *enc;
+	struct drm_device *drm = encoder->dev;
+	int khz = NX_BUS_CLK_IDLE_KHZ;
+	bool power = false;
+
+	list_for_each_entry(enc, &drm->mode_config.encoder_list, head) {
+		power = to_nx_encoder(enc)->enabled;
+		if (power)
+			break;
+	}
+
+	if (!power) {
+		DRM_DEBUG_KMS("[ENCODER:%d] qos idle to %d khz\n",
+			encoder->base.id, khz);
+		dev_qos_update(khz);
+	}
+}
+#else
+#define nx_drm_qos_up(encoder)
+#define nx_drm_qos_down(encoder)
+#endif
+
+static void nx_drm_encoder_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct nx_drm_encoder *nx_encoder = to_nx_encoder(encoder);
+	struct nx_drm_device *display = nx_encoder->display;
+	struct nx_drm_panel *panel = &display->panel;
+	struct nx_drm_ops *ops = display->ops;
+
+	DRM_DEBUG_KMS("enter [ENCODER:%d] %s dpms:%d, %s, power %s\n",
+		encoder->base.id,
+		dp_panel_type_name(dp_panel_get_type(display)),
+		mode, panel->is_connected ? "connected" : "disconnected",
+		nx_encoder->enabled ? "on" : "off");
+
+	if (nx_encoder->dpms == mode) {
+		DRM_DEBUG_KMS("desired dpms mode is same as previous one.\n");
+		return;
+	}
+
+	switch (mode) {
+	case DRM_MODE_DPMS_ON:
+		if (panel->is_connected) {
+			nx_drm_qos_up(encoder);
+			nx_drm_dp_encoder_dpms(encoder, true);
+			if (ops && ops->dpms)
+				ops->dpms(display->dev, mode);
+			nx_encoder->enabled = true;
+		}
+		break;
+	case DRM_MODE_DPMS_STANDBY:
+	case DRM_MODE_DPMS_SUSPEND:
+	case DRM_MODE_DPMS_OFF:
+		if (nx_encoder->enabled) {
+			if (ops && ops->dpms)
+				ops->dpms(display->dev, mode);
+			nx_drm_dp_encoder_dpms(encoder, false);
+			nx_encoder->enabled = false;
+			nx_drm_qos_down(encoder);
+		}
+		break;
+
+	default:
+		DRM_ERROR("fail : unspecified mode %d\n", mode);
+		break;
+	}
+
+	nx_encoder->dpms = mode;
+	DRM_DEBUG_KMS("done\n");
+}
+
+static bool nx_drm_encoder_mode_fixup(struct drm_encoder *encoder,
+			const struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode)
+{
+	struct drm_connector *connector;
+	struct drm_device *drm = encoder->dev;
+	struct nx_drm_encoder *nx_encoder = to_nx_encoder(encoder);
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(encoder->crtc);
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct nx_drm_ops *ops = display->ops;
+	int pipe = nx_crtc->pipe;
+
+	DRM_DEBUG_KMS("enter, encoder id:%d crtc pipe.%d\n",
+		encoder->base.id, pipe);
+
+	/*
+	 * set display controllor pipe.
+	 */
+	nx_encoder->pipe = pipe;
+	nx_drm_dp_encoder_set_pipe(display, pipe);
+	nx_drm_dp_encoder_prepare(encoder, pipe, true);
+
+	list_for_each_entry(connector, &drm->mode_config.connector_list, head) {
+		if (connector->encoder == encoder) {
+			if (ops && ops->mode_fixup)
+				return ops->mode_fixup(display->dev,
+						connector, mode, adjusted_mode);
+		}
+	}
+
+	return true;
+}
+
+static void nx_drm_encoder_mode_set(struct drm_encoder *encoder,
+			struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode)
+{
+	struct drm_device *drm = encoder->dev;
+	struct drm_connector *connector;
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct nx_drm_ops *ops = display->ops;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	list_for_each_entry(connector, &drm->mode_config.connector_list, head) {
+		if (connector->encoder == encoder) {
+			if (ops && ops->mode_set)
+				ops->mode_set(display->dev, adjusted_mode);
+		}
+	}
+
+	nx_drm_dp_display_mode_to_sync(adjusted_mode, display);
+}
+
+static void nx_drm_encoder_prepare(struct drm_encoder *encoder)
+{
+	DRM_DEBUG_KMS("enter\n");
+}
+
+static void nx_drm_encoder_commit(struct drm_encoder *encoder)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct nx_drm_ops *ops = display->ops;
+	struct nx_drm_panel *panel = &display->panel;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	if (!panel->is_connected)
+		return;
+
+	if (ops && ops->commit)
+		ops->commit(display->dev);
+
+	nx_drm_dp_encoder_commit(encoder);
+
+	/* display output device */
+	if (ops && ops->dpms)
+		ops->dpms(display->dev, DRM_MODE_DPMS_ON);
+}
+
+static struct drm_encoder_helper_funcs nx_encoder_helper_funcs = {
+	.dpms = nx_drm_encoder_dpms,
+	.mode_fixup = nx_drm_encoder_mode_fixup,
+	.mode_set = nx_drm_encoder_mode_set,
+	.prepare = nx_drm_encoder_prepare,
+	.commit = nx_drm_encoder_commit,
+};
+
+static void nx_drm_encoder_destroy(struct drm_encoder *encoder)
+{
+	struct nx_drm_encoder *nx_encoder = to_nx_encoder(encoder);
+
+	nx_drm_dp_encoder_unprepare(encoder);
+
+	drm_encoder_cleanup(encoder);
+	kfree(nx_encoder);
+}
+
+static struct drm_encoder_funcs nx_encoder_funcs = {
+	.destroy = nx_drm_encoder_destroy,
+};
+
+struct drm_encoder *nx_drm_encoder_create(struct drm_device *drm,
+			struct nx_drm_device *display, int enc_type,
+			int pipe, int possible_crtcs, void *context)
+{
+	struct nx_drm_encoder *nx_encoder;
+	struct drm_encoder *encoder;
+
+	DRM_DEBUG_KMS("enter pipe.%d crtc mask:0x%x\n", pipe, possible_crtcs);
+
+	BUG_ON(!display || 0 == possible_crtcs);
+
+	nx_encoder = kzalloc(sizeof(*nx_encoder), GFP_KERNEL);
+	if (!nx_encoder)
+		return ERR_PTR(-ENOMEM);
+
+	nx_encoder->dpms = DRM_MODE_DPMS_OFF;
+	nx_encoder->pipe = pipe;
+	nx_encoder->display = display;
+	nx_encoder->context = context;
+
+	encoder = &nx_encoder->encoder;
+	encoder->possible_crtcs = possible_crtcs;
+
+	drm_encoder_init(drm, encoder, &nx_encoder_funcs, enc_type, NULL);
+	drm_encoder_helper_add(encoder, &nx_encoder_helper_funcs);
+
+	DRM_DEBUG_KMS("exit, encoder id:%d\n", encoder->base.id);
+
+	return encoder;
+}
+EXPORT_SYMBOL(nx_drm_encoder_create);
+
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_encoder.h b/drivers/gpu/drm/nexell/nx_drm_encoder.h
--- a/drivers/gpu/drm/nexell/nx_drm_encoder.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_encoder.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_ENCODER_H_
+#define _NX_DRM_ENCODER_H_
+
+#include "soc/s5pxx18_drm_dp.h"
+
+struct nx_drm_encoder {
+	struct drm_encoder encoder;
+	int pipe;
+	struct nx_drm_device *display;
+	int dpms;
+	bool enabled;
+	void *context;		/* device context */
+};
+
+#define to_nx_encoder(e)	\
+		container_of(e, struct nx_drm_encoder, encoder)
+
+struct drm_encoder *nx_drm_encoder_create(struct drm_device *drm,
+			struct nx_drm_device *display, int enc_type,
+			int pipe, int possible_crtcs, void *context);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_fb.c b/drivers/gpu/drm/nexell/nx_drm_fb.c
--- a/drivers/gpu/drm/nexell/nx_drm_fb.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_fb.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,468 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include <linux/module.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_fb.h"
+#include "nx_drm_gem.h"
+
+#define PREFERRED_BPP		32
+
+static int fb_buffer_count = 1;
+static bool fb_format_bgr;
+
+MODULE_PARM_DESC(fb_buffers, "frame buffer count");
+module_param_named(fb_buffers, fb_buffer_count, int, 0600);
+
+MODULE_PARM_DESC(fb_bgr, "frame buffer BGR pixel format");
+module_param_named(fb_bgr, fb_format_bgr, bool, 0600);
+
+static void nx_drm_fb_destroy(struct drm_framebuffer *fb)
+{
+	struct nx_drm_fb *nx_fb = to_nx_drm_fb(fb);
+	int i;
+
+	for (i = 0; i < 4; i++) {
+		if (nx_fb->obj[i])
+			drm_gem_object_unreference_unlocked(
+					&nx_fb->obj[i]->base);
+	}
+
+	drm_framebuffer_cleanup(fb);
+	kfree(nx_fb);
+}
+
+static int nx_drm_fb_create_handle(struct drm_framebuffer *fb,
+			struct drm_file *file_priv, unsigned int *handle)
+{
+	struct nx_drm_fb *nx_fb = to_nx_drm_fb(fb);
+
+	return drm_gem_handle_create(file_priv, &nx_fb->obj[0]->base, handle);
+}
+
+static int nx_drm_fb_dirty(struct drm_framebuffer *fb,
+			struct drm_file *file_priv, unsigned flags,
+			unsigned color, struct drm_clip_rect *clips,
+			unsigned num_clips)
+{
+	/* TODO */
+	return 0;
+}
+
+static struct drm_framebuffer_funcs nx_drm_framebuffer_funcs = {
+	.destroy = nx_drm_fb_destroy,
+	.create_handle = nx_drm_fb_create_handle,
+	.dirty = nx_drm_fb_dirty,
+};
+
+static struct fb_ops nx_fb_ops = {
+	.owner		= THIS_MODULE,
+	.fb_fillrect	= sys_fillrect,
+	.fb_copyarea	= sys_copyarea,
+	.fb_imageblit	= sys_imageblit,
+	.fb_check_var	= drm_fb_helper_check_var,
+	.fb_set_par	= drm_fb_helper_set_par,
+	.fb_blank	= drm_fb_helper_blank,
+	.fb_pan_display	= drm_fb_helper_pan_display,
+	.fb_setcmap	= drm_fb_helper_setcmap,
+};
+
+static struct nx_drm_fb *nx_drm_fb_alloc(struct drm_device *drm,
+			const struct drm_mode_fb_cmd2 *mode_cmd,
+			struct nx_gem_object **nx_obj,
+			unsigned int num_planes)
+{
+	struct nx_drm_fb *nx_fb;
+	int ret;
+	int i;
+
+	nx_fb = kzalloc(sizeof(*nx_fb), GFP_KERNEL);
+	if (!nx_fb)
+		return ERR_PTR(-ENOMEM);
+
+	drm_helper_mode_fill_fb_struct(drm, &nx_fb->fb, mode_cmd);
+
+	for (i = 0; i < num_planes; i++)
+		nx_fb->obj[i] = nx_obj[i];
+
+	ret = drm_framebuffer_init(drm, &nx_fb->fb, &nx_drm_framebuffer_funcs);
+	if (ret) {
+		dev_err(drm->dev, "failed to initialize framebuffer:%d\n", ret);
+		kfree(nx_fb);
+		return ERR_PTR(ret);
+	}
+
+	return nx_fb;
+}
+
+static struct drm_framebuffer *nx_drm_fb_create(struct drm_device *drm,
+			struct drm_file *file_priv,
+			const struct drm_mode_fb_cmd2 *mode_cmd)
+{
+	struct nx_drm_fb *nx_fb;
+	struct nx_gem_object *nx_objs[4];
+	struct drm_gem_object *obj;
+	unsigned int hsub;
+	unsigned int vsub;
+	int ret;
+	int i;
+
+	hsub = drm_format_horz_chroma_subsampling(mode_cmd->pixel_format);
+	vsub = drm_format_vert_chroma_subsampling(mode_cmd->pixel_format);
+
+	for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
+		unsigned int width = mode_cmd->width / (i ? hsub : 1);
+		unsigned int height = mode_cmd->height / (i ? vsub : 1);
+		unsigned int min_size;
+
+		obj = drm_gem_object_lookup(file_priv,
+				mode_cmd->handles[i]);
+		if (!obj) {
+			dev_err(drm->dev, "Failed to lookup GEM object\n");
+			ret = -ENXIO;
+			goto err_gem_object_unreference;
+		}
+
+		min_size = (height - 1) * mode_cmd->pitches[i]
+			+ width
+			* drm_format_plane_cpp(mode_cmd->pixel_format, i)
+			+ mode_cmd->offsets[i];
+
+		if (obj->size < min_size) {
+			drm_gem_object_unreference_unlocked(obj);
+			ret = -EINVAL;
+			goto err_gem_object_unreference;
+		}
+		nx_objs[i] = to_nx_gem_obj(obj);
+	}
+
+	nx_fb = nx_drm_fb_alloc(drm, mode_cmd, nx_objs, i);
+	if (IS_ERR(nx_fb)) {
+		ret = PTR_ERR(nx_fb);
+		goto err_gem_object_unreference;
+	}
+
+	return &nx_fb->fb;
+
+err_gem_object_unreference:
+	for (i--; i >= 0; i--)
+		drm_gem_object_unreference_unlocked(&nx_objs[i]->base);
+
+	return ERR_PTR(ret);
+}
+
+struct drm_framebuffer *nx_drm_fb_mode_create(struct drm_device *drm,
+			struct drm_file *file_priv,
+			const struct drm_mode_fb_cmd2 *mode_cmd)
+{
+	DRM_DEBUG_KMS("enter\n");
+
+	return nx_drm_fb_create(drm, file_priv, mode_cmd);
+}
+
+static uint32_t nx_drm_mode_fb_format(uint32_t bpp, uint32_t depth, bool bgr)
+{
+	uint32_t fmt;
+
+	switch (bpp) {
+	case 8:
+		fmt = DRM_FORMAT_C8;
+		break;
+	case 16:
+		if (depth == 15)
+			fmt = bgr ? DRM_FORMAT_XBGR1555 : DRM_FORMAT_XRGB1555;
+		else
+			fmt = bgr ? DRM_FORMAT_BGR565 : DRM_FORMAT_RGB565;
+		break;
+	case 24:
+		fmt = bgr ? DRM_FORMAT_BGR888 : DRM_FORMAT_RGB888;
+		break;
+	case 32:
+		if (depth == 24)
+			fmt = bgr ? DRM_FORMAT_XBGR8888 : DRM_FORMAT_XRGB8888;
+		else
+			fmt = bgr ? DRM_FORMAT_ABGR8888 : DRM_FORMAT_ARGB8888;
+		break;
+	default:
+		DRM_ERROR("bad bpp, assuming x8r8g8b8 pixel format\n");
+		fmt = DRM_FORMAT_XRGB8888;
+		break;
+	}
+
+	return fmt;
+}
+
+static int nx_drm_fb_helper_probe(struct drm_fb_helper *fb_helper,
+			struct drm_fb_helper_surface_size *sizes)
+{
+	struct nx_drm_fbdev *fbdev = to_nx_drm_fbdev(fb_helper);
+	struct drm_mode_fb_cmd2 mode_cmd = { 0 };
+	struct drm_device *drm = fb_helper->dev;
+	struct nx_gem_object *nx_obj;
+	struct drm_framebuffer *fb;
+	unsigned int bytes_per_pixel;
+	unsigned long offset;
+	struct fb_info *info;
+	size_t size;
+	unsigned int flags = 0;
+	int buffers = fbdev->fb_buffers;
+	int ret;
+
+	DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d) buffers(%d)\n",
+			sizes->surface_width, sizes->surface_height,
+			sizes->surface_bpp, buffers);
+
+	bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
+
+	mode_cmd.width = sizes->surface_width;
+	mode_cmd.height = sizes->surface_height;
+	mode_cmd.pitches[0] = sizes->surface_width * bytes_per_pixel;
+	mode_cmd.pixel_format = nx_drm_mode_fb_format(sizes->surface_bpp,
+		sizes->surface_depth, fb_format_bgr);
+
+	/* for double buffer */
+	size = mode_cmd.pitches[0] * (mode_cmd.height * buffers);
+	nx_obj = nx_drm_gem_create(drm, size, flags);
+	if (IS_ERR(nx_obj))
+		return -ENOMEM;
+
+	info = framebuffer_alloc(0, drm->dev);
+	if (!info) {
+		dev_err(drm->dev, "Failed to allocate framebuffer info.\n");
+		ret = -ENOMEM;
+		goto err_drm_gem_free_object;
+	}
+
+	fbdev->fb = nx_drm_fb_alloc(drm, &mode_cmd, &nx_obj, 1);
+	if (IS_ERR(fbdev->fb)) {
+		dev_err(drm->dev, "Failed to allocate DRM framebuffer.\n");
+		ret = PTR_ERR(fbdev->fb);
+		goto err_framebuffer_release;
+	}
+
+	fb = &fbdev->fb->fb;
+	fb_helper->fb = fb;
+	fb_helper->fbdev = info;
+
+	info->par = fb_helper;
+	info->flags = FBINFO_FLAG_DEFAULT;
+	info->fbops = &nx_fb_ops;
+
+	ret = fb_alloc_cmap(&info->cmap, 256, 0);
+	if (ret) {
+		dev_err(drm->dev, "Failed to allocate color map.\n");
+		goto err_drm_fb_destroy;
+	}
+
+	drm_fb_helper_fill_fix(info, fb->pitches[0], fb->format->depth);
+	drm_fb_helper_fill_var(info, fb_helper,
+			sizes->fb_width, sizes->fb_height);
+
+	/* for double buffer */
+	info->var.yres_virtual = fb->height * buffers;
+
+	offset = info->var.xoffset * bytes_per_pixel;
+	offset += info->var.yoffset * fb->pitches[0];
+
+	drm->mode_config.fb_base = (resource_size_t)nx_obj->dma_addr;
+	info->screen_base = nx_obj->cpu_addr + offset;
+	info->fix.smem_start = (unsigned long)(nx_obj->dma_addr + offset);
+	info->screen_size = size;
+	info->fix.smem_len = size;
+
+	if (fb_helper->crtc_info &&
+		fb_helper->crtc_info->desired_mode) {
+		struct videomode vm;
+		struct drm_display_mode *mode =
+				fb_helper->crtc_info->desired_mode;
+
+		drm_display_mode_to_videomode(mode, &vm);
+		info->var.left_margin = vm.hsync_len + vm.hback_porch;
+		info->var.right_margin = vm.hfront_porch;
+		info->var.upper_margin = vm.vsync_len + vm.vback_porch;
+		info->var.lower_margin = vm.vfront_porch;
+		/* pico second */
+		info->var.pixclock = KHZ2PICOS(vm.pixelclock/1000);
+	}
+
+	return 0;
+
+err_drm_fb_destroy:
+	drm_framebuffer_unregister_private(fb);
+	nx_drm_fb_destroy(fb);
+
+err_framebuffer_release:
+	framebuffer_release(info);
+
+err_drm_gem_free_object:
+	nx_drm_gem_destroy(nx_obj);
+
+	return ret;
+}
+
+static const struct drm_fb_helper_funcs nx_drm_fb_helper = {
+	.fb_probe = nx_drm_fb_helper_probe,
+};
+
+static struct nx_drm_fbdev *nx_drm_fbdev_init(struct drm_device *drm,
+			unsigned int preferred_bpp, unsigned int num_crtc,
+			unsigned int max_conn_count)
+{
+	struct nx_drm_fbdev *fbdev;
+	struct drm_fb_helper *fb_helper;
+	int ret;
+
+	fbdev = kzalloc(sizeof(*fbdev), GFP_KERNEL);
+	if (!fbdev)
+		return ERR_PTR(-ENOMEM);
+
+	fb_helper = &fbdev->fb_helper;
+	fbdev->fb_buffers = 1;
+
+	if (fb_buffer_count > 0)
+		fbdev->fb_buffers = fb_buffer_count;
+
+	DRM_INFO("FB counts = %d\n", fbdev->fb_buffers);
+
+	drm_fb_helper_prepare(drm, fb_helper, &nx_drm_fb_helper);
+
+	ret = drm_fb_helper_init(drm, fb_helper, max_conn_count);
+	if (ret < 0) {
+		dev_err(drm->dev, "Failed to initialize drm fb fb_helper.\n");
+		goto err_free;
+	}
+
+	ret = drm_fb_helper_single_add_all_connectors(fb_helper);
+	if (ret < 0) {
+		dev_err(drm->dev, "Failed to add connectors.\n");
+		goto err_drm_fb_helper_fini;
+
+	}
+
+	/* disable all the possible outputs/crtcs before entering KMS mode */
+	drm_helper_disable_unused_functions(drm);
+
+	ret = drm_fb_helper_initial_config(fb_helper, preferred_bpp);
+	if (ret < 0) {
+		dev_err(drm->dev, "Failed to set initial hw configuration.\n");
+		goto err_drm_fb_helper_fini;
+	}
+
+	return fbdev;
+
+err_drm_fb_helper_fini:
+	drm_fb_helper_fini(fb_helper);
+err_free:
+	kfree(fbdev);
+
+	return ERR_PTR(ret);
+}
+
+static void nx_drm_fbdev_fini(struct nx_drm_fbdev *fbdev)
+{
+	if (fbdev->fb_helper.fbdev) {
+		struct fb_info *info;
+		int ret;
+
+		info = fbdev->fb_helper.fbdev;
+		ret = unregister_framebuffer(info);
+		if (ret < 0)
+			DRM_DEBUG_KMS("failed unregister_framebuffer()\n");
+
+		if (info->cmap.len)
+			fb_dealloc_cmap(&info->cmap);
+
+		framebuffer_release(info);
+	}
+
+	if (fbdev->fb) {
+		drm_framebuffer_unregister_private(&fbdev->fb->fb);
+		nx_drm_fb_destroy(&fbdev->fb->fb);
+	}
+
+	drm_fb_helper_fini(&fbdev->fb_helper);
+	kfree(fbdev);
+}
+
+int nx_drm_framebuffer_init(struct drm_device *drm)
+{
+	struct nx_drm_fbdev *fbdev;
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_framebuffer_dev *nx_framebuffer;
+	unsigned int num_crtc;
+	int bpp;
+	int ret = 0;
+
+	if (!drm->mode_config.num_crtc ||
+		!drm->mode_config.num_connector)
+		return 0;
+
+	DRM_DEBUG_KMS("enter crtc num:%d, connector num:%d\n",
+		      drm->mode_config.num_crtc,
+		      drm->mode_config.num_connector);
+
+	nx_framebuffer = kzalloc(sizeof(*nx_framebuffer), GFP_KERNEL);
+	if (!nx_framebuffer)
+		return -ENOMEM;
+
+	priv->framebuffer_dev = nx_framebuffer;
+	num_crtc = drm->mode_config.num_crtc;
+	bpp = PREFERRED_BPP;
+
+	fbdev = nx_drm_fbdev_init(drm, bpp, num_crtc, MAX_CONNECTOR);
+	if (IS_ERR(fbdev)) {
+		ret = PTR_ERR(fbdev);
+		goto err_drm_fb_dev_free;
+	}
+
+	nx_framebuffer->fbdev = fbdev;
+
+	return 0;
+
+err_drm_fb_dev_free:
+	kfree(nx_framebuffer);
+	return ret;
+}
+
+void nx_drm_framebuffer_fini(struct drm_device *drm)
+{
+	struct nx_drm_priv *priv = drm->dev_private;
+	struct nx_framebuffer_dev *nx_framebuffer = priv->framebuffer_dev;
+	struct nx_drm_fbdev *fbdev = nx_framebuffer->fbdev;
+
+	nx_drm_fbdev_fini(fbdev);
+	kfree(nx_framebuffer);
+	priv->framebuffer_dev = NULL;
+}
+
+/*
+ * fb with gem
+ */
+struct nx_gem_object *nx_drm_fb_get_gem_obj(struct drm_framebuffer *fb,
+			unsigned int plane)
+{
+	struct nx_drm_fb *nx_fb = to_nx_drm_fb(fb);
+
+	if (plane >= 4)
+		return NULL;
+
+	return nx_fb->obj[plane];
+}
+EXPORT_SYMBOL_GPL(nx_drm_fb_get_gem_obj);
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_fb.h b/drivers/gpu/drm/nexell/nx_drm_fb.h
--- a/drivers/gpu/drm/nexell/nx_drm_fb.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_fb.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_FB_H_
+#define _NX_DRM_FB_H_
+
+#include <drm/drm_fb_helper.h>
+#include <linux/fb.h>
+#include <video/videomode.h>
+
+struct nx_drm_fb {
+	struct drm_framebuffer	fb;
+	struct nx_gem_object *obj[4];
+};
+
+struct nx_drm_fbdev {
+	struct drm_fb_helper fb_helper;
+	struct nx_drm_fb *fb;
+	int fb_buffers;
+};
+
+struct nx_framebuffer_dev {
+	struct nx_drm_fbdev *fbdev;
+};
+
+static inline struct nx_drm_fbdev *to_nx_drm_fbdev(struct drm_fb_helper *helper)
+{
+	return container_of(helper, struct nx_drm_fbdev, fb_helper);
+}
+
+static inline struct nx_drm_fb *to_nx_drm_fb(struct drm_framebuffer *fb)
+{
+	return container_of(fb, struct nx_drm_fb, fb);
+}
+
+int nx_drm_framebuffer_init(struct drm_device *dev);
+void nx_drm_framebuffer_fini(struct drm_device *dev);
+
+struct drm_framebuffer *nx_drm_fb_mode_create(struct drm_device *dev,
+			struct drm_file *file_priv,
+			const struct drm_mode_fb_cmd2 *mode_cmd);
+
+/*
+ * nexell framebuffer with gem
+ */
+struct nx_gem_object *nx_drm_fb_get_gem_obj(struct drm_framebuffer *fb,
+			unsigned int plane);
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_gem.c b/drivers/gpu/drm/nexell/nx_drm_gem.c
--- a/drivers/gpu/drm/nexell/nx_drm_gem.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_gem.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,1710 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_vma_manager.h>
+#include <linux/dma-buf.h>
+#include <linux/shmem_fs.h>
+#include <linux/reservation.h>
+#include <drm/nexell_drm.h>
+
+#include "nx_drm_gem.h"
+
+static const char * const gem_type_name[] = {
+	[NEXELL_BO_DMA] = "dma, non-cachable",
+	[NEXELL_BO_DMA_CACHEABLE] = "dma, cachable",
+	[NEXELL_BO_SYSTEM] = "system, non-cachable",
+	[NEXELL_BO_SYSTEM_CACHEABLE] = "system, cachable",
+	[NEXELL_BO_SYSTEM_NONCONTIG] = "system non-contig, non-cachable",
+	[NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE] = "system non-contig, cachable",
+};
+
+#define	LATE_CREATE_MMAP_OFFSET
+
+static int nx_drm_gem_handle_create(struct drm_gem_object *obj,
+			struct drm_file *file_priv,
+			unsigned int *handle)
+{
+	int ret;
+
+	/*
+	 * allocate a id of idr table where the obj is registered
+	 * and handle has the id what user can see.
+	 */
+	ret = drm_gem_handle_create(file_priv, obj, handle);
+	if (ret)
+		return ret;
+
+	/* drop reference from allocate - handle holds it now. */
+	drm_gem_object_unreference_unlocked(obj);
+
+	return 0;
+}
+
+static struct nx_gem_object *nx_drm_gem_object_new(struct drm_device *drm,
+			size_t size)
+{
+	struct nx_gem_object *nx_obj;
+	struct drm_gem_object *obj;
+	int ret;
+
+	DRM_DEBUG_DRIVER("size:%zu\n", size);
+
+	nx_obj = kzalloc(sizeof(*nx_obj), GFP_KERNEL);
+	if (!nx_obj)
+		return ERR_PTR(-ENOMEM);
+
+	obj = &nx_obj->base;
+
+	ret = drm_gem_object_init(drm, obj, size);
+	if (ret)
+		goto error;
+
+#ifndef LATE_CREATE_MMAP_OFFSET
+	ret = drm_gem_create_mmap_offset(obj);
+	if (ret) {
+		drm_gem_object_release(obj);
+		goto error;
+	}
+#endif
+	mutex_init(&nx_obj->lock);
+	INIT_LIST_HEAD(&nx_obj->vmas);
+
+	return nx_obj;
+
+error:
+	kfree(nx_obj);
+
+	return ERR_PTR(ret);
+}
+
+static void nx_drm_gem_object_delete(struct nx_gem_object *nx_obj)
+{
+	struct drm_gem_object *obj;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	obj = &nx_obj->base;
+
+	drm_gem_object_release(obj);
+
+	kfree(nx_obj);
+}
+
+static inline bool __gem_is_cacheable(uint32_t flags)
+{
+	bool cachable = false;
+
+	if (flags == NEXELL_BO_DMA_CACHEABLE ||
+		flags == NEXELL_BO_SYSTEM_CACHEABLE ||
+		flags == NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE)
+		cachable = true;
+
+	DRM_DEBUG_DRIVER("cachable:%s\n", cachable ? "O" : "X");
+	return cachable;
+}
+
+static inline bool __gem_is_system(uint32_t flags)
+{
+	bool system = false;
+
+	if (flags == NEXELL_BO_SYSTEM ||
+		flags == NEXELL_BO_SYSTEM_CACHEABLE ||
+		flags == NEXELL_BO_SYSTEM_NONCONTIG ||
+		flags == NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE)
+		system = true;
+
+	DRM_DEBUG_DRIVER("system:%s\n", system ? "O" : "X");
+	return system;
+}
+
+static inline bool __gem_is_system_noncontig(uint32_t flags)
+{
+	if (flags == NEXELL_BO_SYSTEM_NONCONTIG ||
+		flags == NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE)
+		return true;
+
+	return false;
+}
+
+static inline struct page *__gem_page_page(struct page *page)
+{
+	return (struct page *)((unsigned long)page & ~(1UL));
+}
+
+static inline bool __gem_page_is_dirty(struct page *page)
+{
+	return !!((unsigned long)page & 1UL);
+}
+
+static inline void __gem_page_dirty(struct page **page)
+{
+	*page = (struct page *)((unsigned long)(*page) | 1UL);
+}
+
+static inline void __gem_page_clean(struct page **page)
+{
+	*page = (struct page *)((unsigned long)(*page) & ~(1UL));
+}
+
+static inline void __gem_page_dev_sync(struct device *dev, struct page *page,
+		size_t size, enum dma_data_direction dir)
+{
+	struct scatterlist sg;
+
+	sg_init_table(&sg, 1);
+	sg_set_page(&sg, page, size, 0);
+
+	sg_dma_address(&sg) = page_to_phys(page);
+	dma_sync_sg_for_device(dev, &sg, 1, dir);
+}
+
+static inline void __gem_page_cpu_sync(struct device *dev, struct page *page,
+		size_t size, enum dma_data_direction dir)
+{
+	struct scatterlist sg;
+
+	DRM_DEBUG_DRIVER("cpu sync\n");
+
+	sg_init_table(&sg, 1);
+	sg_set_page(&sg, page, size, 0);
+
+	sg_dma_address(&sg) = page_to_phys(page);
+	dma_sync_sg_for_cpu(dev, &sg, 1, dir);
+}
+
+static const unsigned int sys_contig_orders[] = {8, 4, 0};
+static const int num_orders = ARRAY_SIZE(sys_contig_orders);
+
+static inline unsigned int order_to_size(int order)
+{
+	return PAGE_SIZE << order;
+}
+
+static struct page *__alloc_order_pages(struct device *dev,
+			size_t size, unsigned int max_order)
+{
+	gfp_t high_gfp, low_gfp;
+	struct page *page;
+	unsigned int order;
+	int i;
+
+	high_gfp = (GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN |
+			     __GFP_NORETRY) & ~__GFP_RECLAIM;
+	low_gfp = (GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN);
+
+	for (i = 0; i < num_orders; i++) {
+		gfp_t gfp_flags = low_gfp;
+
+		if (order_to_size(sys_contig_orders[i]) > size)
+			continue;
+
+		if (sys_contig_orders[i] > max_order)
+			continue;
+
+		order = sys_contig_orders[i];
+		if (order > 4)
+			gfp_flags = high_gfp;
+
+		page = alloc_pages(gfp_flags | __GFP_COMP, order);
+
+		/*
+		 * For debug status :
+		 * DRM_DEBUG_DRIVER("va:%p, i:%d order:%d,%d, size:%u\n",
+		 * page_address(page), i, max_order, order,
+		 * order_to_size(order));
+		 */
+
+		if (!page)
+			continue;
+
+		/* cached flush */
+		__gem_page_dev_sync(NULL, page, PAGE_SIZE << order,
+						DMA_BIDIRECTIONAL);
+
+		return page;
+	}
+
+	return NULL;
+}
+
+static void *__drm_gem_sys_remap(struct nx_gem_object *nx_obj, size_t size)
+{
+	struct scatterlist *sg;
+	struct sg_table *sgt = nx_obj->sgt;
+	int npages = PAGE_ALIGN(size) / PAGE_SIZE;
+	struct page **pages = vmalloc(sizeof(struct page *) * npages);
+	struct page **tmp = pages;
+	pgprot_t prot;
+	void *cpu_addr = NULL;
+	int i, j;
+
+	if (!pages)
+		return NULL;
+
+	if (!sgt)
+		goto out;
+
+	if (__gem_is_cacheable(nx_obj->flags))
+		prot = PAGE_KERNEL;
+	else
+		prot = pgprot_writecombine(PAGE_KERNEL);
+
+	for_each_sg(sgt->sgl, sg, sgt->nents, i) {
+		int npages_this_entry = PAGE_ALIGN(sg->length) / PAGE_SIZE;
+		struct page *page = sg_page(sg);
+
+		BUG_ON(i >= npages);
+		for (j = 0; j < npages_this_entry; j++)
+			*(tmp++) = page++;
+	}
+
+	cpu_addr = vmap(pages, npages, VM_MAP, prot);
+
+out:
+	vfree(pages);
+
+	if (!cpu_addr)
+		return ERR_PTR(-ENOMEM);
+
+	DRM_DEBUG_DRIVER("map va:%p, size:%zu\n", cpu_addr, size);
+
+	return cpu_addr;
+}
+
+static int nx_drm_gem_sys_alloc(struct nx_gem_object *nx_obj,
+			size_t size)
+{
+	struct drm_device *drm;
+	dma_addr_t dma_addr;
+	struct sg_table *sgt;
+	struct scatterlist *sg;
+	struct list_head pages;
+	struct page *page, *tmp_page;
+	size_t remaining = PAGE_ALIGN(size), length;
+	unsigned int order = sys_contig_orders[0];
+	int i = 0;
+
+	drm = nx_obj->base.dev;
+	INIT_LIST_HEAD(&pages);
+
+	while (remaining > 0) {
+		page = __alloc_order_pages(drm->dev, remaining, order);
+		if (!page)
+			goto free_pages;
+
+		list_add_tail(&page->lru, &pages);
+
+		order = compound_order(page);
+		length = PAGE_SIZE << order;
+		remaining -= length;
+		dma_addr = phys_to_dma(drm->dev, page_to_phys(page));
+
+		if (!nx_obj->dma_addr)
+			nx_obj->dma_addr = dma_addr;
+
+		DRM_DEBUG_DRIVER("[%3d] va:%p, pa:%pad, size:%zu, remain:%zu\n",
+			i, page_address(page), &dma_addr, length, remaining);
+
+		i++;
+	}
+
+	sgt = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
+	if (!sgt)
+		goto free_pages;
+
+	if (sg_alloc_table(sgt, i, GFP_KERNEL))
+		goto free_sgtable;
+
+	sg = sgt->sgl;
+	list_for_each_entry_safe(page, tmp_page, &pages, lru) {
+		sg_set_page(sg, page, PAGE_SIZE << compound_order(page), 0);
+		sg_dma_address(sg) = sg_phys(sg);
+		sg = sg_next(sg);
+		list_del(&page->lru);
+	}
+
+	nx_obj->sgt = sgt;
+	nx_obj->cpu_addr = __drm_gem_sys_remap(nx_obj, size);
+	nx_obj->size = size;
+
+	DRM_DEBUG_DRIVER("va:%p, sgt:%p, nents:%d\n",
+		nx_obj->cpu_addr, sgt,  sgt->nents);
+
+	return 0;
+
+free_sgtable:
+	kfree(sgt);
+
+free_pages:
+	list_for_each_entry_safe(page, tmp_page, &pages, lru)
+		__free_pages(page, compound_order(page));
+
+	return -ENOMEM;
+}
+
+static void nx_drm_gem_sys_free(struct nx_gem_object *nx_obj)
+{
+	struct scatterlist *sg;
+	struct sg_table *sgt = nx_obj->sgt;
+	int i;
+
+	vunmap(nx_obj->cpu_addr);
+
+	for_each_sg(sgt->sgl, sg, sgt->nents, i) {
+		struct page *page = sg_page(sg);
+
+		DRM_DEBUG_DRIVER("[%3d] %p, va:%p, pa:0x%lx, size:%ld\n",
+			i, page, page_address(page),
+			(unsigned long)phys_to_dma(nx_obj->base.dev->dev,
+			virt_to_phys(page_address(page))),
+			PAGE_SIZE << compound_order(page));
+
+		__free_pages(page, compound_order(page));
+	}
+
+	sg_free_table(sgt);
+	kfree(sgt);
+}
+
+static int nx_drm_gem_sys_mmap(struct nx_gem_object *nx_obj,
+			struct vm_area_struct *vma)
+{
+	struct sg_table *sgt = nx_obj->sgt;
+	unsigned long addr = vma->vm_start;
+	unsigned long offset = vma->vm_pgoff * PAGE_SIZE;
+	struct scatterlist *sg;
+	int i;
+	int ret;
+
+	for_each_sg(sgt->sgl, sg, sgt->nents, i) {
+		struct page *page = sg_page(sg);
+		unsigned long remainder = vma->vm_end - addr;
+		unsigned long len = sg->length;
+
+		DRM_DEBUG_DRIVER("vma:0x%lx~0x%lx, va:%p, size:%ld\n",
+			addr, vma->vm_end, page_address(page), len);
+
+		if (offset >= sg->length) {
+			offset -= sg->length;
+			continue;
+		} else if (offset) {
+			page += offset / PAGE_SIZE;
+			len = sg->length - offset;
+			offset = 0;
+		}
+
+		len = min(len, remainder);
+		ret = remap_pfn_range(vma, addr,
+				page_to_pfn(page), len, vma->vm_page_prot);
+		if (ret)
+			return ret;
+
+		addr += len;
+		if (addr >= vma->vm_end)
+			break;
+	}
+
+	return 0;
+}
+
+static int nx_drm_gem_sys_contig_alloc(
+			struct nx_gem_object *nx_obj, size_t size)
+{
+	struct drm_device *drm;
+	struct sg_table *sgt;
+	void *cpu_addr;
+	dma_addr_t dma_addr;
+	struct page *page;
+	unsigned long i;
+	int order = get_order(size);
+	int ret = -ENOMEM;
+
+	drm = nx_obj->base.dev;
+
+	if (order >= MAX_ORDER) {
+		dev_err(drm->dev,
+			"failed allocate buffer %zu over max order:%d (%d)\n",
+			size, order_to_size(MAX_ORDER - 1), MAX_ORDER);
+		return ret;
+	}
+
+	page = alloc_pages(GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN, order);
+	if (!page) {
+		dev_err(drm->dev,
+			"failed allocate buffer %zu, ret:%d\n", size, ret);
+		return ret;
+	}
+
+	split_page(page, order);
+
+	size = PAGE_ALIGN(size);
+	for (i = size >> PAGE_SHIFT; i < (1 << order); i++)
+		__free_page(page + i);
+
+	sgt = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
+	if (!sgt)
+		goto free_pages;
+
+	ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
+	if (ret)
+		goto free_sgtable;
+
+	sg_set_page(sgt->sgl, page, size, 0);
+	sg_dma_address(sgt->sgl) = sg_phys(sgt->sgl);
+
+	cpu_addr = page_address(page);
+	dma_addr = phys_to_dma(drm->dev, virt_to_phys(cpu_addr));
+
+	/* set gem object params */
+	nx_obj->sgt = sgt;
+	nx_obj->cpu_addr = __drm_gem_sys_remap(nx_obj, size);
+	nx_obj->dma_addr = dma_addr;
+	nx_obj->size = size;
+
+	/* cached flush */
+	__gem_page_dev_sync(drm->dev, page, size, DMA_BIDIRECTIONAL);
+
+	DRM_DEBUG_DRIVER("va:%p->%p, pa:%pad, size:%zu\n",
+		page_address(page), nx_obj->cpu_addr, &nx_obj->dma_addr, size);
+
+	return 0;
+
+free_sgtable:
+	kfree(sgt);
+
+free_pages:
+	for (i = 0; i < size >> PAGE_SHIFT; i++)
+		__free_page(page + i);
+
+	return ret;
+}
+
+static void nx_drm_gem_sys_contig_free(struct nx_gem_object *nx_obj)
+{
+	struct sg_table *sgt = nx_obj->sgt;
+	struct page *page = sg_page(sgt->sgl);
+	unsigned long pages = PAGE_ALIGN(nx_obj->size) >> PAGE_SHIFT;
+	int i;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, size:%zu\n",
+		page_address(page), &nx_obj->dma_addr, nx_obj->size);
+
+	vunmap(nx_obj->cpu_addr);
+
+	for (i = 0; i < pages; i++)
+		__free_page(page + i);
+
+	sg_free_table(sgt);
+	kfree(sgt);
+}
+
+static int nx_drm_gem_sys_contig_mmap(struct nx_gem_object *nx_obj,
+			struct vm_area_struct *vma)
+{
+	struct drm_device *drm;
+	unsigned long nr_vma_pages, nr_pages;
+	unsigned long pfn, off;
+	dma_addr_t dma_addr;
+	size_t size;
+	int ret = -ENXIO;
+
+	drm = nx_obj->base.dev;
+	dma_addr = nx_obj->dma_addr;
+	size = vma->vm_end - vma->vm_start;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, vma:0x%lx~0x%lx, size:%zu\n",
+		nx_obj->cpu_addr, &dma_addr, vma->vm_start, vma->vm_end, size);
+
+	nr_vma_pages = (size) >> PAGE_SHIFT;
+	nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+	pfn = dma_to_phys(drm->dev, dma_addr) >> PAGE_SHIFT;
+	off = vma->vm_pgoff;
+
+	if (off < nr_pages && nr_vma_pages <= (nr_pages - off)) {
+		ret = remap_pfn_range(vma, vma->vm_start,
+				      pfn + off, size, vma->vm_page_prot);
+	}
+
+	return 0;
+}
+
+static int nx_drm_gem_dma_alloc(
+			struct nx_gem_object *nx_obj, size_t size)
+{
+	struct drm_device *drm = nx_obj->base.dev;
+	struct sg_table *sgt;
+	void *cpu_addr;
+	dma_addr_t dma_addr;
+	int ret = -ENOMEM;
+
+	size = PAGE_ALIGN(size);
+
+	cpu_addr = dma_alloc_writecombine(drm->dev, size, &dma_addr,
+				GFP_KERNEL | __GFP_NOWARN);
+	if (!cpu_addr) {
+		dev_err(drm->dev, "failed to allocate buffer with size %zu\n",
+			size);
+		return -ENOMEM;
+	}
+
+	sgt = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
+	if (!sgt)
+		goto free_pages;
+
+	if (dma_get_sgtable(drm->dev, sgt, cpu_addr, dma_addr, size))
+		goto free_sgtable;
+
+	/* set gem object params */
+	nx_obj->sgt = sgt;
+	nx_obj->cpu_addr = cpu_addr;
+	nx_obj->dma_addr = dma_addr;
+	nx_obj->size = size;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, size:%zu\n",
+			cpu_addr, &dma_addr, size);
+
+	return 0;
+
+free_sgtable:
+	kfree(sgt);
+
+free_pages:
+	dma_free_writecombine(drm->dev, size, cpu_addr, dma_addr);
+
+	return ret;
+}
+
+static void nx_drm_gem_dma_free(struct nx_gem_object *nx_obj)
+{
+	struct drm_device *drm = nx_obj->base.dev;
+	struct sg_table *sgt = nx_obj->sgt;
+	void *cpu_addr;
+	dma_addr_t dma_addr;
+	size_t size;
+
+	cpu_addr = nx_obj->cpu_addr;
+	dma_addr = nx_obj->dma_addr;
+	size = nx_obj->size;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, size:%zu\n",
+			cpu_addr, &dma_addr, nx_obj->size);
+
+	if (cpu_addr)
+		dma_free_writecombine(drm->dev, size, cpu_addr, dma_addr);
+
+	if (sgt) {
+		sg_free_table(sgt);
+		kfree(sgt);
+	}
+}
+
+static int nx_drm_gem_dma_mmap(struct nx_gem_object *nx_obj,
+			struct vm_area_struct *vma)
+{
+	struct drm_device *drm;
+	void *cpu_addr;
+	dma_addr_t dma_addr;
+	size_t size;
+
+	drm = nx_obj->base.dev;
+	cpu_addr = nx_obj->cpu_addr;
+	dma_addr = nx_obj->dma_addr;
+	size = vma->vm_end - vma->vm_start;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, vma:0x%lx~0x%lx, size:%zu\n",
+		cpu_addr, &dma_addr, vma->vm_start, vma->vm_end, size);
+
+	return dma_mmap_writecombine(drm->dev, vma, cpu_addr, dma_addr, size);
+}
+
+static int nx_drm_gem_buf_alloc(struct nx_gem_object *nx_obj, size_t size)
+{
+	uint32_t flags = nx_obj->flags;
+	int ret;
+
+	switch (flags) {
+	case NEXELL_BO_SYSTEM:
+	case NEXELL_BO_SYSTEM_CACHEABLE:
+		ret = nx_drm_gem_sys_contig_alloc(nx_obj, size);
+		break;
+
+	case NEXELL_BO_SYSTEM_NONCONTIG:
+	case NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE:
+		ret = nx_drm_gem_sys_alloc(nx_obj, size);
+		break;
+
+	case NEXELL_BO_DMA:
+	case NEXELL_BO_DMA_CACHEABLE:
+	default:
+		ret = nx_drm_gem_dma_alloc(nx_obj, size);
+		break;
+	}
+
+	return ret;
+}
+
+static void nx_drm_gem_buf_free(struct nx_gem_object *nx_obj)
+{
+	struct drm_gem_object *obj = &nx_obj->base;
+	uint32_t flags = nx_obj->flags;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, attach:%s\n",
+		nx_obj->cpu_addr, &nx_obj->dma_addr,
+		obj->import_attach ? "o" : "x");
+
+	if (nx_obj->cpu_addr) {
+		switch (flags) {
+		case NEXELL_BO_SYSTEM:
+		case NEXELL_BO_SYSTEM_CACHEABLE:
+			nx_drm_gem_sys_contig_free(nx_obj);
+			break;
+
+		case NEXELL_BO_SYSTEM_NONCONTIG:
+		case NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE:
+			nx_drm_gem_sys_free(nx_obj);
+			break;
+
+		case NEXELL_BO_DMA:
+		case NEXELL_BO_DMA_CACHEABLE:
+		default:
+			nx_drm_gem_dma_free(nx_obj);
+			break;
+		}
+	} else if (obj->import_attach) {
+		drm_prime_gem_destroy(obj, nx_obj->import_sgt);
+	}
+
+	if (nx_obj->pages)
+		vfree(nx_obj->pages);
+}
+
+static int nx_drm_gem_buf_pages(struct nx_gem_object *nx_obj, size_t size)
+{
+	int num_pages = PAGE_ALIGN(size) / PAGE_SIZE;
+	struct sg_table *sgt = nx_obj->sgt;
+	struct scatterlist *sg;
+	int i, j, k = 0;
+
+	DRM_DEBUG_DRIVER("num_pages:%d\n", num_pages);
+
+	if (!nx_obj->sgt)
+		return 0;
+
+	nx_obj->pages = vmalloc(sizeof(struct page *) * num_pages);
+	if (!nx_obj->pages)
+		return -ENOMEM;
+
+	for_each_sg(sgt->sgl, sg, sgt->nents, i) {
+		struct page *page = sg_page(sg);
+
+		for (j = 0; j < sg->length / PAGE_SIZE; j++)
+			nx_obj->pages[k++] = page++;
+	}
+
+	return 0;
+}
+
+static void __vm_set_cache_attr(struct vm_area_struct *vma, uint32_t flags)
+{
+	bool cached = __gem_is_cacheable(flags);
+
+	if (cached) {
+		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+	} else {
+		bool system = __gem_is_system(flags);
+
+		if (system)
+			vma->vm_page_prot = pgprot_noncached(
+					vm_get_page_prot(vma->vm_flags));
+	}
+
+	DRM_DEBUG_DRIVER("flags: %s\n",	gem_type_name[flags]);
+}
+
+static int nx_drm_gem_buf_mmap(struct nx_gem_object *nx_obj,
+			struct vm_area_struct *vma)
+{
+	uint32_t flags = nx_obj->flags;
+	int ret;
+
+	DRM_DEBUG_DRIVER("va:%p, pa:%pad, s:0x%lx, e:0x%lx, size:%zu\n",
+		nx_obj->cpu_addr, &nx_obj->dma_addr, vma->vm_start, vma->vm_end,
+		nx_obj->size);
+
+	/*
+	 * update cache vm prot
+	 */
+	__vm_set_cache_attr(vma, flags);
+
+	/*
+	 * Clear the VM_PFNMAP flag that was set by drm_gem_mmap(), and set the
+	 * vm_pgoff (used as a fake buffer offset by DRM) to 0 as we want
+	 * to map the whole buffer.
+	 */
+	vma->vm_flags &= ~VM_PFNMAP;
+	vma->vm_pgoff = 0;
+
+	switch (flags) {
+	case NEXELL_BO_SYSTEM:
+	case NEXELL_BO_SYSTEM_CACHEABLE:
+		ret = nx_drm_gem_sys_contig_mmap(nx_obj, vma);
+		break;
+
+	case NEXELL_BO_SYSTEM_NONCONTIG:
+	case NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE:
+		ret = nx_drm_gem_sys_mmap(nx_obj, vma);
+		break;
+
+	case NEXELL_BO_DMA:
+	case NEXELL_BO_DMA_CACHEABLE:
+	default:
+		if (__gem_is_cacheable(flags))
+			ret = nx_drm_gem_sys_contig_mmap(nx_obj, vma);
+		else
+			ret = nx_drm_gem_dma_mmap(nx_obj, vma);
+		break;
+	}
+
+	if (ret)
+		drm_gem_vm_close(vma);
+
+	return ret;
+}
+
+/*
+ * struct vm_operations_struct
+ */
+struct gem_vma_list {
+	struct list_head list;
+	struct vm_area_struct *vma;
+};
+
+static void __gem_vma_list_add(struct vm_area_struct *vma)
+{
+	struct drm_gem_object *obj = vma->vm_private_data;
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+	struct gem_vma_list *vma_list;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	vma_list = kmalloc(sizeof(struct gem_vma_list), GFP_KERNEL);
+	if (!vma_list)
+		return;
+
+	vma_list->vma = vma;
+	mutex_lock(&nx_obj->lock);
+	list_add(&vma_list->list, &nx_obj->vmas);
+	mutex_unlock(&nx_obj->lock);
+
+	DRM_DEBUG_DRIVER("adding %p\n", vma);
+}
+
+static void __gem_vma_list_del(struct vm_area_struct *vma)
+{
+	struct drm_gem_object *obj = vma->vm_private_data;
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+	struct gem_vma_list *vma_list, *tmp;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	mutex_lock(&nx_obj->lock);
+	list_for_each_entry_safe(vma_list, tmp, &nx_obj->vmas, list) {
+		if (vma_list->vma != vma)
+			continue;
+		list_del(&vma_list->list);
+		kfree(vma_list);
+		DRM_DEBUG_DRIVER("deleting %p\n", vma);
+		break;
+	}
+	mutex_unlock(&nx_obj->lock);
+}
+
+static int __gem_map_vm_sync(struct drm_gem_object *obj,
+			enum dma_data_direction dir)
+{
+	struct gem_vma_list *vma_list;
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+	int pages = PAGE_ALIGN(nx_obj->size) / PAGE_SIZE;
+	struct drm_device *drm = obj->dev;
+	uint32_t flags = nx_obj->flags;
+	int i;
+
+	DRM_DEBUG_DRIVER("map syncing\n");
+
+	if (!__gem_is_cacheable(flags))
+		return 0;
+
+	mutex_lock(&nx_obj->lock);
+	for (i = 0; i < pages; i++) {
+		struct page *page = nx_obj->pages[i];
+
+		if (__gem_page_is_dirty(page))
+			__gem_page_dev_sync(drm->dev, __gem_page_page(page),
+							PAGE_SIZE, dir);
+
+		__gem_page_clean(nx_obj->pages + i);
+	}
+
+	list_for_each_entry(vma_list, &nx_obj->vmas, list) {
+		struct vm_area_struct *vma = vma_list->vma;
+
+		zap_page_range(vma, vma->vm_start,
+					vma->vm_end - vma->vm_start);
+	}
+	mutex_unlock(&nx_obj->lock);
+
+	return 0;
+}
+
+static void __gem_unmap_vm_sync(struct drm_gem_object *obj,
+			enum dma_data_direction dir)
+{
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+	int pages = PAGE_ALIGN(nx_obj->size) / PAGE_SIZE;
+	struct drm_device *drm = obj->dev;
+	uint32_t flags = nx_obj->flags;
+	int i;
+
+	DRM_DEBUG_DRIVER("unmap syncing\n");
+
+	if (!__gem_is_cacheable(flags))
+		return;
+
+	mutex_lock(&nx_obj->lock);
+	for (i = 0; i < pages; i++) {
+		struct page *page = nx_obj->pages[i];
+
+		if (__gem_page_is_dirty(page))
+			__gem_page_cpu_sync(drm->dev, __gem_page_page(page),
+							PAGE_SIZE, dir);
+	}
+	mutex_unlock(&nx_obj->lock);
+}
+
+/*
+ * called file_operations mmap: nx_drm_gem_fops_mmap
+ */
+static int nx_drm_gem_vm_fault(struct vm_fault *vmf)
+{
+	struct drm_gem_object *obj = vmf->vma->vm_private_data;
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+	unsigned long pfn;
+	pgoff_t offset;
+	int ret = 0;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	if (nx_obj->pages) {
+		mutex_lock(&nx_obj->lock);
+		offset = ((unsigned long)vmf->address -
+					vmf->vma->vm_start) >> PAGE_SHIFT;
+
+		__gem_page_dirty(nx_obj->pages + offset);
+		if (!WARN_ON(!nx_obj->pages || !nx_obj->pages[offset])) {
+			pfn = page_to_pfn(
+				__gem_page_page(nx_obj->pages[offset]));
+			ret = vm_insert_pfn(vmf->vma,
+				(unsigned long)vmf->address, pfn);
+		}
+		mutex_unlock(&nx_obj->lock);
+	}
+
+	switch (ret) {
+	case -EAGAIN:
+	case 0:
+	case -ERESTARTSYS:
+	case -EINTR:
+	case -EBUSY:
+		ret = VM_FAULT_NOPAGE;
+		break;
+	case -ENOMEM:
+		ret = VM_FAULT_OOM;
+		break;
+	default:
+		ret = VM_FAULT_SIGBUS;
+		break;
+	}
+
+	return ret;
+}
+
+static void nx_drm_gem_vm_open(struct vm_area_struct *vma)
+{
+	struct drm_gem_object *obj = vma->vm_private_data;
+
+	__gem_vma_list_add(vma);
+	drm_gem_object_reference(obj);
+}
+
+static void nx_drm_gem_vm_close(struct vm_area_struct *vma)
+{
+	struct drm_gem_object *obj = vma->vm_private_data;
+
+	__gem_vma_list_del(vma);
+	drm_gem_object_unreference_unlocked(obj);
+}
+
+static const struct vm_operations_struct gem_vm_ops = {
+	.fault = nx_drm_gem_vm_fault,
+	.open = nx_drm_gem_vm_open,
+	.close = nx_drm_gem_vm_close,
+};
+
+static int nx_drm_gem_vm_map(struct drm_gem_object *obj,
+			unsigned long obj_size, struct vm_area_struct *vma)
+{
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+	uint32_t flags = nx_obj->flags;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	/* Check for valid size. */
+	if (obj_size < vma->vm_end - vma->vm_start)
+		return -EINVAL;
+
+	vma->vm_flags |= VM_IO |
+				VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
+	vma->vm_ops = &gem_vm_ops;
+	vma->vm_private_data = obj;
+
+	if (__gem_is_cacheable(flags))
+		__gem_vma_list_add(vma);
+	else
+		vma->vm_page_prot =
+			pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+
+
+	/* Take a ref for this mapping of the object, so that the fault
+	 * handler can dereference the mmap offset's pointer to the object.
+	 * This reference is cleaned up by the corresponding vm_close
+	 * (which should happen whether the vma was created by this call, or
+	 * by a vm_open due to mremap or partial unmap or whatever).
+	 */
+	drm_gem_object_reference(obj);
+
+	return 0;
+}
+
+static int nx_drm_gem_mmap_vma(struct file *filp, struct vm_area_struct *vma)
+{
+	struct drm_file *priv = filp->private_data;
+	struct drm_device *drm = priv->minor->dev;
+	struct drm_gem_object *obj = NULL;
+	struct drm_vma_offset_node *node;
+	int ret;
+
+	if (drm_dev_is_unplugged(drm))
+		return -ENODEV;
+
+	drm_vma_offset_lock_lookup(drm->vma_offset_manager);
+	node = drm_vma_offset_exact_lookup_locked(drm->vma_offset_manager,
+						  vma->vm_pgoff,
+						  vma_pages(vma));
+	if (likely(node)) {
+		obj = container_of(node, struct drm_gem_object, vma_node);
+		/*
+		 * When the object is being freed, after it hits 0-refcnt it
+		 * proceeds to tear down the object. In the process it will
+		 * attempt to remove the VMA offset and so acquire this
+		 * mgr->vm_lock.  Therefore if we find an object with a 0-refcnt
+		 * that matches our range, we know it is in the process of being
+		 * destroyed and will be freed as soon as we release the lock -
+		 * so we have to check for the 0-refcnted object and treat it as
+		 * invalid.
+		 */
+		if (!kref_get_unless_zero(&obj->refcount))
+			obj = NULL;
+	}
+	drm_vma_offset_unlock_lookup(drm->vma_offset_manager);
+
+	if (!obj)
+		return -EINVAL;
+
+	if (!drm_vma_node_is_allowed(node, priv)) {
+		drm_gem_object_unreference_unlocked(obj);
+		return -EACCES;
+	}
+
+	ret = nx_drm_gem_vm_map(obj,
+				drm_vma_node_size(node) << PAGE_SHIFT, vma);
+
+	drm_gem_object_unreference_unlocked(obj);
+
+	return ret;
+}
+
+/*
+ * provide dma_buf_ops
+ */
+struct nx_drm_prime_attachment {
+	struct sg_table *sgt;
+	enum dma_data_direction dir;
+};
+
+static int nx_drm_gem_map_attach(struct dma_buf *dma_buf,
+			struct device *target_dev,
+			struct dma_buf_attachment *attach)
+{
+	struct nx_drm_prime_attachment *prime_attach;
+	struct drm_gem_object *obj = dma_buf->priv;
+	struct drm_device *drm = obj->dev;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	prime_attach = kzalloc(sizeof(*prime_attach), GFP_KERNEL);
+	if (!prime_attach)
+		return -ENOMEM;
+
+	prime_attach->dir = DMA_NONE;
+	attach->priv = prime_attach;
+
+	if (!drm->driver->gem_prime_pin)
+		return 0;
+
+	return drm->driver->gem_prime_pin(obj);
+}
+
+static void nx_drm_gem_map_detach(struct dma_buf *dma_buf,
+			struct dma_buf_attachment *attach)
+{
+	struct nx_drm_prime_attachment *prime_attach = attach->priv;
+	struct drm_gem_object *obj = dma_buf->priv;
+	struct drm_device *drm = obj->dev;
+	struct sg_table *sgt;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	if (drm->driver->gem_prime_unpin)
+		drm->driver->gem_prime_unpin(obj);
+
+	if (!prime_attach)
+		return;
+
+	sgt = prime_attach->sgt;
+
+	if (sgt) {
+		if (prime_attach->dir != DMA_NONE)
+			__gem_unmap_vm_sync(obj, prime_attach->dir);
+		sg_free_table(sgt);
+	}
+
+	kfree(sgt);
+	kfree(prime_attach);
+	attach->priv = NULL;
+}
+
+static struct sg_table *nx_drm_gem_map_dma_buf(
+			struct dma_buf_attachment *attach,
+			enum dma_data_direction dir)
+{
+	struct nx_drm_prime_attachment *prime_attach = attach->priv;
+	struct drm_gem_object *obj = attach->dmabuf->priv;
+	struct sg_table *sgt;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	if (WARN_ON(dir == DMA_NONE || !prime_attach))
+		return ERR_PTR(-EINVAL);
+
+	/* return the cached mapping when possible */
+	if (prime_attach->dir == dir)
+		return prime_attach->sgt;
+
+	/*
+	 * two mappings with different directions for the same attachment are
+	 * not allowed
+	 */
+	if (WARN_ON(prime_attach->dir != DMA_NONE))
+		return ERR_PTR(-EBUSY);
+
+	sgt = obj->dev->driver->gem_prime_get_sg_table(obj);
+
+	if (!IS_ERR(sgt)) {
+		int ret = __gem_map_vm_sync(obj, dir);
+
+		if (ret < 0) {
+			sg_free_table(sgt);
+			kfree(sgt);
+			sgt = ERR_PTR(-ENOMEM);
+		} else {
+			prime_attach->sgt = sgt;
+			prime_attach->dir = dir;
+		}
+	}
+
+	return sgt;
+}
+
+static void nx_drm_gem_unmap_dma_buf(struct dma_buf_attachment *attach,
+			struct sg_table *sgt,
+			enum dma_data_direction dir)
+{
+	/* nothing to be done here */
+	DRM_DEBUG_DRIVER("enter\n");
+}
+
+static void nx_drm_gem_dmabuf_release(struct dma_buf *dma_buf)
+{
+	struct drm_gem_object *obj = dma_buf->priv;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	/* drop the reference on the export fd holds */
+	drm_gem_object_unreference_unlocked(obj);
+}
+
+static void *nx_drm_gem_dmabuf_kmap(struct dma_buf *dma_buf,
+			unsigned long page_num)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+	return NULL;
+}
+
+static void nx_drm_gem_dmabuf_kunmap(struct dma_buf *dma_buf,
+			unsigned long page_num, void *addr)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+}
+
+static void *nx_drm_gem_dmabuf_kmap_atomic(struct dma_buf *dma_buf,
+					unsigned long page_num)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+	return NULL;
+}
+
+static void nx_drm_gem_dmabuf_kunmap_atomic(struct dma_buf *dma_buf,
+			unsigned long page_num, void *addr)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+}
+
+static int nx_drm_gem_dmabuf_mmap(struct dma_buf *dma_buf,
+			struct vm_area_struct *vma)
+{
+	struct drm_gem_object *obj = dma_buf->priv;
+	struct drm_device *drm = obj->dev;
+	struct nx_gem_object *nx_obj;
+	int ret;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	mutex_lock(&drm->struct_mutex);
+	ret = nx_drm_gem_vm_map(obj, obj->size, vma);
+	mutex_unlock(&drm->struct_mutex);
+	if (ret < 0)
+		return ret;
+
+	nx_obj = to_nx_gem_obj(obj);
+
+	return nx_drm_gem_buf_mmap(nx_obj, vma);
+}
+
+static void *nx_drm_gem_dmabuf_vmap(struct dma_buf *dma_buf)
+{
+	struct drm_gem_object *obj = dma_buf->priv;
+	struct nx_gem_object *nx_obj = to_nx_gem_obj(obj);
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	return nx_obj->cpu_addr;
+}
+
+static void nx_drm_gem_dmabuf_vunmap(struct dma_buf *dma_buf, void *cpu_addr)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+}
+
+static const struct dma_buf_ops gem_dmabuf_ops =  {
+	.attach = nx_drm_gem_map_attach,
+	.detach = nx_drm_gem_map_detach,
+	.map_dma_buf = nx_drm_gem_map_dma_buf,
+	.unmap_dma_buf = nx_drm_gem_unmap_dma_buf,
+	.release = nx_drm_gem_dmabuf_release,
+	.map = nx_drm_gem_dmabuf_kmap,
+	.map_atomic = nx_drm_gem_dmabuf_kmap_atomic,
+	.unmap = nx_drm_gem_dmabuf_kunmap,
+	.unmap_atomic = nx_drm_gem_dmabuf_kunmap_atomic,
+	.mmap = nx_drm_gem_dmabuf_mmap,
+	.vmap = nx_drm_gem_dmabuf_vmap,
+	.vunmap = nx_drm_gem_dmabuf_vunmap,
+};
+
+/*
+ * struct nx_gem_object elements
+ */
+struct nx_gem_object *nx_drm_gem_create(struct drm_device *drm,
+			size_t size, uint32_t flags)
+{
+	struct nx_gem_object *nx_obj;
+	int ret;
+
+	if (flags > NEXELL_BO_MAX - 1)
+		flags = 0;
+
+	DRM_DEBUG_DRIVER("size:%zu, flags:0x%x[%s]\n",
+		size, flags, gem_type_name[flags]);
+
+	/*
+	 * must be routn up of PAGE_SIZE
+	 */
+	size = round_up(size, PAGE_SIZE);
+
+	nx_obj = nx_drm_gem_object_new(drm, size);
+	if (IS_ERR(nx_obj))
+		return nx_obj;
+
+	/*
+	 * set memory type and
+	 * cache attribute from user side.
+	 */
+	nx_obj->flags = flags;
+
+	ret = nx_drm_gem_buf_alloc(nx_obj, size);
+	if (ret)
+		goto error;
+
+	ret = nx_drm_gem_buf_pages(nx_obj, size);
+	if (ret) {
+		nx_drm_gem_buf_free(nx_obj);
+		goto error;
+	}
+
+	return nx_obj;
+
+error:
+	nx_drm_gem_object_delete(nx_obj);
+
+	return ERR_PTR(ret);
+}
+
+void nx_drm_gem_destroy(struct nx_gem_object *nx_obj)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+
+	nx_drm_gem_buf_free(nx_obj);
+	nx_drm_gem_object_delete(nx_obj);
+}
+
+/*
+ * struct drm_driver elements
+ */
+int nx_drm_gem_dumb_create(struct drm_file *file_priv,
+			struct drm_device *drm,
+			struct drm_mode_create_dumb *args)
+{
+	struct nx_gem_object *nx_obj;
+	struct drm_gem_object *obj;
+	uint32_t *handle = &args->handle;
+	uint32_t flags = args->flags;
+	int ret;
+
+	args->pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
+
+	/*
+	 * The pitch should be aligned by 8
+	 * due to restriction of mali driver
+	 */
+	args->pitch = ALIGN(args->pitch, 8);
+	args->size = (uint64_t)args->pitch * args->height;
+
+	DRM_DEBUG_DRIVER("widht:%d, bpp:%d, pitch:%d, flags:0x%x\n",
+		args->width, args->bpp, args->pitch, flags);
+
+	/* create gem buffer */
+	nx_obj = nx_drm_gem_create(drm, args->size, flags);
+	if (IS_ERR(nx_obj))
+		return PTR_ERR(nx_obj);
+
+	obj = &nx_obj->base;
+
+	/* create gem handle */
+	ret = nx_drm_gem_handle_create(obj, file_priv, handle);
+	if (ret)
+		goto err_handle_create;
+
+	return 0;
+
+err_handle_create:
+	nx_drm_gem_destroy(nx_obj);
+
+	return ret;
+}
+
+int nx_drm_gem_dumb_map_offset(struct drm_file *file_priv,
+			struct drm_device *drm, uint32_t handle,
+			uint64_t *offset)
+{
+	struct drm_gem_object *obj;
+	int ret = 0;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	mutex_lock(&drm->struct_mutex);
+
+	obj = drm_gem_object_lookup(file_priv, handle);
+	if (!obj) {
+		dev_err(drm->dev, "failed to lookup GEM object\n");
+		mutex_unlock(&drm->struct_mutex);
+		return -EINVAL;
+	}
+
+#ifdef LATE_CREATE_MMAP_OFFSET
+	/*
+	 * create a fake mmap offset for an object
+	 */
+	ret = drm_gem_create_mmap_offset(obj);
+	if (ret)
+		goto out;
+
+	*offset = drm_vma_node_offset_addr(&obj->vma_node);
+
+out:
+#else
+	*offset = drm_vma_node_offset_addr(&obj->vma_node);
+#endif
+
+	drm_gem_object_unreference(obj);
+
+	mutex_unlock(&drm->struct_mutex);
+
+	DRM_DEBUG_DRIVER("offset:0x%llx\n", *offset);
+
+	return ret;
+}
+
+void nx_drm_gem_free_object(struct drm_gem_object *obj)
+{
+	DRM_DEBUG_DRIVER("enter\n");
+	nx_drm_gem_destroy(to_nx_gem_obj(obj));
+}
+
+struct dma_buf *nx_drm_gem_prime_export(struct drm_device *drm,
+			struct drm_gem_object *obj, int flags)
+{
+	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+
+	DRM_DEBUG_DRIVER("enter\n");
+	/* we want to be able to write in mmapped buffer */
+	flags |= O_RDWR;
+
+	exp_info.ops = &gem_dmabuf_ops;
+	exp_info.size = obj->size;
+	exp_info.flags = flags;
+	exp_info.priv = obj;
+
+	if (drm->driver->gem_prime_res_obj)
+		exp_info.resv = drm->driver->gem_prime_res_obj(obj);
+
+	return drm_gem_dmabuf_export(drm, &exp_info);
+}
+
+struct sg_table *nx_drm_gem_prime_get_sg_table(struct drm_gem_object *obj)
+{
+	struct list_head pages;
+	struct page *page, *tmp_page;
+	struct scatterlist *sg;
+	struct sg_table *sgt;
+	struct nx_gem_object *nx_obj;
+	bool noncontig;
+	int nents = 1;
+	int i = 0, n = 0;
+
+	nx_obj = to_nx_gem_obj(obj);
+	sgt = nx_obj->sgt;
+
+	noncontig = __gem_is_system_noncontig(nx_obj->flags);
+
+	DRM_DEBUG_DRIVER("enter sgt:%p %s [%s]\n",
+			sgt, noncontig ? "non-contig" : "contig",
+			gem_type_name[nx_obj->flags]);
+
+	/* Non-Contiguous memory */
+	if (noncontig) {
+		INIT_LIST_HEAD(&pages);
+		nents = sgt->nents;
+		for_each_sg(sgt->sgl, sg, nents, i) {
+			page = sg_page(sg);
+			list_add_tail(&page->lru, &pages);
+		}
+	}
+
+	/* new scatter/gather table */
+	sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
+	if (!sgt)
+		return NULL;
+
+	if (unlikely(sg_alloc_table(sgt, nents, GFP_KERNEL)))
+		goto out;
+
+	sg = sgt->sgl;
+
+	/* set new sgtables */
+	if (noncontig) {
+		list_for_each_entry_safe(page, tmp_page, &pages, lru) {
+			sg_set_page(sg, page,
+				PAGE_SIZE << compound_order(page), 0);
+			sg_dma_address(sg) = sg_phys(sg);
+
+			DRM_DEBUG_DRIVER("[%d] sg pa:0x%lx, va:%p, size:%d\n",
+				n++, (unsigned long)page_to_phys(page),
+				page_address(sg_page(sg)), sg_dma_len(sg));
+
+			sg = sg_next(sg);
+			list_del(&page->lru);
+		}
+	} else {
+		struct scatterlist *s = nx_obj->sgt->sgl;
+
+#ifdef CONFIG_NEED_SG_DMA_LENGTH
+		sg->dma_length = s->length;
+#endif
+		sg_dma_address(sg) = sg_phys(s);
+		sg_set_page(sg, phys_to_page(sg_phys(s)),
+					PAGE_ALIGN(obj->size), 0);
+
+		DRM_DEBUG_DRIVER("sg pa:%pad, va:%p size:%d\n",
+			&nx_obj->dma_addr, nx_obj->cpu_addr, (int)obj->size);
+	}
+
+	/*
+	 * will be delete in nx_drm_gem_map_detach
+	 */
+	return sgt;
+
+out:
+	kfree(sgt);
+	return NULL;
+}
+
+struct drm_gem_object *nx_drm_gem_prime_import_sg_table(
+			struct drm_device *drm,
+			struct dma_buf_attachment *attach,
+			struct sg_table *sgt)
+{
+	struct nx_gem_object *nx_obj;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	/* Create a CMA GEM buffer. */
+	nx_obj = nx_drm_gem_object_new(drm, attach->dmabuf->size);
+	if (IS_ERR(nx_obj))
+		return ERR_CAST(nx_obj);
+
+	nx_obj->dma_addr = sg_dma_address(sgt->sgl);
+	nx_obj->import_sgt = sgt;
+
+	DRM_DEBUG_DRIVER("dma_addr:%pad, size:%zu\n",
+			&nx_obj->dma_addr, attach->dmabuf->size);
+
+	return &nx_obj->base;
+}
+
+/*
+ * struct file_operations
+ */
+int nx_drm_gem_fops_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct nx_gem_object *nx_obj;
+	struct drm_gem_object *obj;
+	int ret;
+
+	DRM_DEBUG_DRIVER("enter 0x%lx~0x%lx 0x%lx, pgoff 0x%lx\n",
+		vma->vm_start, vma->vm_end, vma->vm_end - vma->vm_start,
+		vma->vm_pgoff);
+
+	/*
+	 * search vma with offset in drm vma manager.
+	 */
+	ret = nx_drm_gem_mmap_vma(filp, vma);
+	if (ret)
+		return ret;
+
+	obj = vma->vm_private_data;
+	nx_obj = to_nx_gem_obj(obj);
+
+	/* occur vm fault */
+	return 0;
+}
+
+/*
+ * struct drm_ioctl_desc
+ */
+int nx_drm_gem_create_ioctl(struct drm_device *drm, void *data,
+			struct drm_file *file_priv)
+{
+	struct nx_gem_create *args = data;
+	struct nx_gem_object *nx_obj;
+	struct drm_gem_object *obj;
+	uint32_t *handle = &args->handle;
+	uint32_t flags = args->flags;
+	size_t size = args->size;
+	int ret;
+
+	DRM_DEBUG_DRIVER("size:%lld, flags:0x%x\n", args->size, flags);
+
+	nx_obj = nx_drm_gem_create(drm, size, flags);
+	if (IS_ERR(nx_obj))
+		return PTR_ERR(nx_obj);
+
+	obj = &nx_obj->base;
+
+	/* create gem handle */
+	ret = nx_drm_gem_handle_create(obj, file_priv, handle);
+	if (ret)
+		goto err_handle_create;
+
+	return 0;
+
+err_handle_create:
+	nx_drm_gem_destroy(nx_obj);
+
+	return ret;
+}
+
+int nx_drm_gem_sync_ioctl(struct drm_device *drm, void *data,
+			struct drm_file *file_priv)
+{
+	struct nx_gem_object *nx_obj;
+	struct drm_gem_object *obj;
+	struct nx_gem_create *args = data;
+	bool system;
+
+	mutex_lock(&drm->struct_mutex);
+
+	obj = drm_gem_object_lookup(file_priv, args->handle);
+	if (!obj) {
+		dev_err(drm->dev, "failed to lookup GEM object\n");
+		mutex_unlock(&drm->struct_mutex);
+		return -EINVAL;
+	}
+
+	nx_obj = to_nx_gem_obj(obj);
+	system = __gem_is_system(nx_obj->flags);
+
+	DRM_DEBUG_DRIVER("enter flags: 0x%x [%s]\n",
+			nx_obj->flags, gem_type_name[nx_obj->flags]);
+
+	/* non-cachable */
+	if (!__gem_is_cacheable(nx_obj->flags))
+		goto out;
+
+	if (system) {
+		struct sg_table *sgt = nx_obj->sgt;
+
+		dma_sync_sg_for_device(drm->dev,
+				sgt->sgl, sgt->nents, DMA_BIDIRECTIONAL);
+	} else {
+		dma_sync_single_for_device(drm->dev,
+				nx_obj->dma_addr,
+				nx_obj->size, DMA_BIDIRECTIONAL);
+	}
+
+out:
+	drm_gem_object_unreference(obj);
+
+	mutex_unlock(&drm->struct_mutex);
+
+	DRM_DEBUG_DRIVER("sync va:%p pa:%pad\n",
+			nx_obj->cpu_addr, &nx_obj->dma_addr);
+
+	return 0;
+}
+
+int nx_drm_gem_get_ioctl(struct drm_device *drm, void *data,
+			struct drm_file *file_priv)
+{
+	struct nx_gem_info *args = data;
+	struct nx_gem_object *nx_obj;
+	struct drm_gem_object *obj;
+
+	DRM_DEBUG_DRIVER("enter\n");
+
+	mutex_lock(&drm->struct_mutex);
+
+	obj = drm_gem_object_lookup(file_priv, args->handle);
+	if (!obj) {
+		dev_err(drm->dev, "failed to lookup GEM object\n");
+		mutex_unlock(&drm->struct_mutex);
+		return -EINVAL;
+	}
+
+	nx_obj = to_nx_gem_obj(obj);
+	args->size = obj->size;
+
+	drm_gem_object_unreference(obj);
+	mutex_unlock(&drm->struct_mutex);
+
+	DRM_DEBUG_DRIVER("get dma pa:%pad, va:%p\n",
+			&nx_obj->dma_addr, nx_obj->cpu_addr);
+
+	return 0;
+}
+
+/*
+ * gem fence
+ */
+int nx_drm_gem_wait_fence(struct drm_gem_object *obj)
+{
+#ifdef CONFIG_MALI_DMA_BUF_FENCE
+	struct dma_buf *dmabuf;
+	struct reservation_object_list *fobj;
+	struct reservation_object *resv;
+	struct dma_fence *fence;
+	struct nx_gem_object *nx_obj;
+	long timeout = 100 * HZ;
+	bool interruptible = true;
+	int i;
+
+	if (!obj || !obj->dma_buf)
+		return 0;
+
+	nx_obj = to_nx_gem_obj(obj);
+	dmabuf = obj->dma_buf;
+	resv = dmabuf->resv;
+	fobj = reservation_object_get_list(resv);
+	fence = reservation_object_get_excl(resv);
+
+	if (fence) {
+		if (!dma_fence_is_signaled(fence))
+			timeout = dma_fence_wait_timeout(fence,
+						interruptible, timeout);
+	}
+
+	for (i = 0; fobj && timeout > 0 && i < fobj->shared_count; ++i) {
+		fence = rcu_dereference_protected(fobj->shared[i],
+					reservation_object_held(resv));
+		if (!dma_fence_is_signaled(fence))
+			timeout = dma_fence_wait_timeout(fence,
+					interruptible, timeout);
+	}
+
+	DRM_DEBUG_KMS("fence:%p, dma pa:%pad, va:%p\n",
+		fence, &nx_obj->dma_addr, nx_obj->cpu_addr);
+
+	if (timeout < 0)
+		return timeout;
+
+	if (timeout == 0)
+		return -EBUSY;
+
+	reservation_object_add_excl_fence(resv, NULL);
+#endif
+	return 0;
+}
+
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_gem.h b/drivers/gpu/drm/nexell/nx_drm_gem.h
--- a/drivers/gpu/drm/nexell/nx_drm_gem.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_gem.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _NX_DRM_GEM_H_
+#define _NX_DRM_GEM_H_
+
+#include <drm/drm_gem.h>
+
+/*
+ * nexell drm gem object
+ */
+struct nx_gem_object {
+	struct drm_gem_object base;
+	dma_addr_t dma_addr;
+	void *cpu_addr;
+	size_t size;
+	uint32_t flags;
+	struct sg_table *sgt;		 /* for system memory */
+	struct sg_table *import_sgt; /* for prime import */
+	struct mutex lock;
+	struct page **pages;
+	struct list_head vmas;
+};
+
+static inline struct nx_gem_object *to_nx_gem_obj(struct drm_gem_object *obj)
+{
+	return container_of(obj, struct nx_gem_object, base);
+}
+
+static inline struct drm_gem_object *to_gem_obj(struct nx_gem_object *nx_obj)
+{
+	return &nx_obj->base;
+}
+
+/*
+ * struct nx_gem_object elements
+ */
+struct nx_gem_object *nx_drm_gem_create(struct drm_device *drm,
+			size_t size, unsigned int flags);
+void nx_drm_gem_destroy(struct nx_gem_object *nx_obj);
+
+/*
+ * struct drm_driver elements
+ */
+int nx_drm_gem_dumb_create(struct drm_file *file_priv,
+			struct drm_device *dev,
+			struct drm_mode_create_dumb *args);
+int nx_drm_gem_dumb_map_offset(struct drm_file *file_priv,
+			struct drm_device *dev, uint32_t handle,
+			uint64_t *offset);
+void nx_drm_gem_free_object(struct drm_gem_object *obj);
+
+struct dma_buf *nx_drm_gem_prime_export(struct drm_device *drm,
+			struct drm_gem_object *obj,
+			int flags);
+struct sg_table *nx_drm_gem_prime_get_sg_table(struct drm_gem_object *obj);
+struct drm_gem_object *nx_drm_gem_prime_import_sg_table(
+			struct drm_device *dev,
+			struct dma_buf_attachment *attach,
+			struct sg_table *sgt);
+
+/* struct file_operations elements */
+int nx_drm_gem_fops_mmap(struct file *filp, struct vm_area_struct *vma);
+
+/*
+ * struct drm_ioctl_desc
+ */
+int nx_drm_gem_create_ioctl(struct drm_device *drm, void *data,
+			struct drm_file *file_priv);
+int nx_drm_gem_sync_ioctl(struct drm_device *drm, void *data,
+			struct drm_file *file_priv);
+int nx_drm_gem_get_ioctl(struct drm_device *drm, void *data,
+			struct drm_file *file_priv);
+
+/*
+ * gem fence
+ */
+int nx_drm_gem_wait_fence(struct drm_gem_object *obj);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_hdmi.c b/drivers/gpu/drm/nexell/nx_drm_hdmi.c
--- a/drivers/gpu/drm/nexell/nx_drm_hdmi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_hdmi.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,731 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include <drm/drm_edid.h>
+
+#include <linux/wait.h>
+#include <linux/spinlock.h>
+#include <linux/component.h>
+#include <linux/of_platform.h>
+#include <linux/of_address.h>
+#include <linux/of_graph.h>
+#include <linux/of_gpio.h>
+#include <video/of_display_timing.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <drm/nexell_drm.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_plane.h"
+#include "nx_drm_crtc.h"
+#include "nx_drm_encoder.h"
+#include "nx_drm_connector.h"
+#include "nx_drm_fb.h"
+#include "soc/s5pxx18_dp_hdmi.h"
+
+struct hdmi_resource {
+	struct i2c_adapter *ddc_adpt;
+	const struct edid *edid;
+	bool dvi_mode;
+	int hpd_gpio;
+	int hpd_irq;
+};
+
+struct hdmi_context {
+	struct drm_connector *connector;
+	int crtc_pipe;
+	unsigned int possible_crtcs_mask;
+	struct nx_drm_device *display;
+	struct delayed_work	 work;
+	struct gpio_desc *enable_gpio;
+	struct hdmi_resource hdmi_res;
+	spinlock_t lock;
+	bool plug;
+	int q_range;
+};
+
+#define ctx_to_hdmi(c)	(struct hdmi_resource *)(&c->hdmi_res)
+
+static bool panel_hdmi_is_connected(struct device *dev,
+			struct drm_connector *connector)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+
+	panel->is_connected = ctx->plug;
+
+	DRM_INFO("HDMI: %s\n",
+		ctx->plug ? "connect" : "disconnect");
+
+	return ctx->plug;
+}
+
+static void panel_hdmi_dump_edid_modes(struct drm_connector *connector,
+			int num_modes, bool dump)
+{
+	struct drm_display_mode *mode, *t;
+
+	if( !dump )
+		return;
+	if( !num_modes ) {
+		DRM_INFO("EDID list empty\n");
+		return;
+	}
+
+	list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
+		DRM_DEBUG_KMS("EDID [%4d x %4d %3d fps, 0x%08x(%s), %d] %s\n",
+			mode->hdisplay, mode->vdisplay, mode->vrefresh,
+			mode->flags, mode->flags & DRM_MODE_FLAG_3D_MASK ?
+			"3D" : "2D",
+			mode->clock*1000, mode->name);
+	}
+}
+
+static int panel_hdmi_preferred_modes(struct device *dev,
+			struct drm_connector *connector, int num_modes)
+{
+	static int lpref_width, lpref_height, lpref_refresh, lpref_flags;
+	struct drm_display_mode *mode, *oldpref, *newpref;
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+	struct videomode *vm = &panel->vm;
+	struct drm_display_mode *t;
+	bool prefShown = false;
+
+	DRM_DEBUG_KMS("enter %d:%d:%d\n",
+		vm->hactive, vm->vactive, panel->vrefresh);
+
+	/*
+	 * if not support EDID, use default resolution
+	 */
+	if (!num_modes) {
+		DRM_ERROR("no mode got from EDID\n");
+		mode = drm_mode_create(connector->dev);
+		if (!mode) {
+			DRM_ERROR("fail : create a new display mode !\n");
+			return 0;
+		}
+		drm_display_mode_from_videomode(vm, mode);
+
+		mode->vrefresh = panel->vrefresh;
+		mode->width_mm = panel->width_mm;
+		mode->height_mm = panel->height_mm;
+		connector->display_info.width_mm = mode->width_mm;
+		connector->display_info.height_mm = mode->height_mm;
+
+		mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
+		drm_mode_probed_add(connector, mode);
+		return 1;
+	}
+
+	/*
+	 * set preferred mode from EDID modes
+	 */
+	oldpref = newpref = NULL;
+	list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
+		if( mode->type & DRM_MODE_TYPE_PREFERRED ) {
+			if(mode->hdisplay != lpref_width ||
+					mode->vdisplay != lpref_height ||
+					mode->vrefresh != lpref_refresh ||
+					mode->flags != lpref_flags)
+			{
+				DRM_INFO("preferred mode from EDID: %dx%d%c@%d\n",
+					mode->hdisplay, mode->vdisplay,
+					mode->flags & DRM_MODE_FLAG_INTERLACE ? 'i' : 'p',
+					mode->vrefresh);
+				lpref_width = mode->hdisplay;
+				lpref_height = mode->vdisplay;
+				lpref_refresh = mode->vrefresh;
+				lpref_flags = mode->flags;
+				prefShown = true;
+			}
+			oldpref = mode;
+		}
+		if (mode->hdisplay == vm->hactive &&
+			mode->vdisplay == vm->vactive &&
+			mode->vrefresh == panel->vrefresh
+			&& !(mode->flags & DRM_MODE_FLAG_INTERLACE) ==
+				!(vm->flags & DISPLAY_FLAGS_INTERLACED))
+		{
+			newpref = mode;
+		}
+	}
+	if( newpref != NULL && oldpref != newpref ) {
+		if( prefShown ) {
+			DRM_INFO("override preferred mode by %dx%d%c@%d\n",
+					vm->hactive, vm->vactive,
+					vm->flags & DISPLAY_FLAGS_INTERLACED ? 'i' : 'p',
+					panel->vrefresh);
+		}
+		newpref->type |= DRM_MODE_TYPE_PREFERRED;
+		if( oldpref != NULL )
+			oldpref->type &= ~DRM_MODE_TYPE_PREFERRED;
+	}
+	return num_modes;
+}
+
+static int panel_hdmi_get_modes(struct device *dev,
+			struct drm_connector *connector)
+{
+	struct edid *edid;
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct hdmi_resource *hdmi = &ctx->hdmi_res;
+	int num_modes = 0;
+
+	if (!hdmi->ddc_adpt)
+		return -ENODEV;
+
+	edid = drm_get_edid(connector, hdmi->ddc_adpt);
+	if (edid) {
+		hdmi->dvi_mode = !drm_detect_hdmi_monitor(edid);
+		DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
+			(hdmi->dvi_mode ? "dvi monitor" : "hdmi monitor"),
+			edid->width_cm, edid->height_cm);
+
+		drm_mode_connector_update_edid_property(connector, edid);
+		num_modes = drm_add_edid_modes(connector, edid);
+		panel_hdmi_dump_edid_modes(connector, num_modes, false);
+	}
+
+	return panel_hdmi_preferred_modes(dev, connector, num_modes);
+}
+
+static int panel_hdmi_check_mode(struct device *dev,
+			struct drm_display_mode *mode)
+{
+	bool ret;
+
+	ret = nx_dp_hdmi_mode_valid(mode);
+	if (!ret)
+		return MODE_BAD;
+
+	DRM_DEBUG_KMS("OK MODE %d x %d mm, %s, %d khz %d fps\n",
+		mode->width_mm, mode->height_mm,
+		mode->flags & DRM_MODE_FLAG_INTERLACE ?
+		"interlace" : "progressive", mode->clock,
+		mode->vrefresh);
+	DRM_DEBUG_KMS("ha:%d, hf:%d, hb:%d, hs:%d\n",
+		mode->hdisplay, mode->hsync_start - mode->hdisplay,
+		mode->htotal - mode->hsync_end,
+		mode->hsync_end - mode->hsync_start);
+	DRM_DEBUG_KMS("va:%d, vf:%d, vb:%d, vs:%d\n",
+		mode->vdisplay, mode->vsync_start - mode->vdisplay,
+		mode->vtotal - mode->vsync_end,
+		mode->vsync_end - mode->vsync_start);
+	DRM_DEBUG_KMS("flags:0x%x\n", mode->flags);
+
+	return MODE_OK;
+}
+
+bool panel_hdmi_mode_fixup(struct device *dev,
+			struct drm_connector *connector,
+			const struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+void panel_hdmi_mode_set(struct device *dev,
+			struct drm_display_mode *mode)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_device *display = ctx->display;
+	struct hdmi_resource *hdmi = ctx_to_hdmi(ctx);
+
+	DRM_DEBUG_KMS("enter\n");
+
+	nx_dp_hdmi_mode_set(display, mode, hdmi->dvi_mode, ctx->q_range);
+}
+
+static void panel_hdmi_commit(struct device *dev)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	int pipe = drm_dev_get_dpc(ctx->display)->module;
+
+	nx_dp_hdmi_mode_commit(ctx->display, pipe);
+}
+
+static void panel_hdmi_enable(struct device *dev)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_device *display = ctx->display;
+
+	if (display->suspended)
+		return;
+
+	nx_dp_hdmi_power(display, true);
+}
+
+static void panel_hdmi_disable(struct device *dev)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_device *display = ctx->display;
+
+	if (display->suspended)
+		return;
+
+	nx_dp_hdmi_power(display, false);
+}
+
+static void panel_hdmi_dmps(struct device *dev, int mode)
+{
+	DRM_DEBUG_KMS("dpms.%d\n", mode);
+
+	switch (mode) {
+	case DRM_MODE_DPMS_ON:
+		panel_hdmi_enable(dev);
+		break;
+
+	case DRM_MODE_DPMS_STANDBY:
+	case DRM_MODE_DPMS_SUSPEND:
+	case DRM_MODE_DPMS_OFF:
+		panel_hdmi_disable(dev);
+		break;
+	default:
+		DRM_ERROR("fail : unspecified mode %d\n", mode);
+		break;
+	}
+}
+
+static struct nx_drm_ops panel_hdmi_ops = {
+	.is_connected = panel_hdmi_is_connected,
+	.get_modes = panel_hdmi_get_modes,
+	.check_mode = panel_hdmi_check_mode,
+	.mode_fixup = panel_hdmi_mode_fixup,
+	.mode_set = panel_hdmi_mode_set,
+	.commit = panel_hdmi_commit,
+	.dpms = panel_hdmi_dmps,
+};
+
+static struct nx_drm_device hdmi_dp_dev = {
+	.ops = &panel_hdmi_ops,
+};
+
+static int panel_hdmi_bind(struct device *dev,
+			struct device *master, void *data)
+{
+	struct drm_device *drm = data;
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct hdmi_resource *hdmi = &ctx->hdmi_res;
+	struct platform_driver *pdrv = to_platform_driver(dev->driver);
+	int pipe = ctx->crtc_pipe;
+	unsigned int possible_crtcs = ctx->possible_crtcs_mask;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	ctx->connector = nx_drm_connector_create_and_attach(drm, ctx->display,
+					pipe, possible_crtcs,
+					dp_panel_type_hdmi, ctx);
+	if (IS_ERR(ctx->connector)) {
+		if (pdrv->remove)
+			pdrv->remove(to_platform_device(dev));
+		return 0;
+	}
+
+	/*
+	 * check connect status at boot time
+	 */
+	if (nx_dp_hdmi_is_connected()) {
+		struct nx_drm_priv *priv = drm->dev_private;
+
+		ctx->plug = nx_dp_hdmi_is_connected();
+		priv->force_detect = true;
+	}
+
+	/*
+	 * Enable the interrupt after the connector has been
+	 * connected.
+	 */
+	enable_irq(hdmi->hpd_irq);
+
+	DRM_DEBUG_KMS("done\n");
+	return 0;
+}
+
+static void panel_hdmi_unbind(struct device *dev,
+			struct device *master, void *data)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+	struct hdmi_resource *hdmi = &ctx->hdmi_res;
+
+	if (ctx->connector)
+		nx_drm_connector_destroy_and_detach(ctx->connector);
+
+	if (INVALID_IRQ != hdmi->hpd_irq)
+		disable_irq(hdmi->hpd_irq);
+}
+
+static const struct component_ops panel_comp_ops = {
+	.bind = panel_hdmi_bind,
+	.unbind = panel_hdmi_unbind,
+};
+
+static void panel_hdmi_hpd_work(struct work_struct *work)
+{
+	struct hdmi_context *ctx;
+	bool plug;
+
+	ctx = container_of(work, struct hdmi_context, work.work);
+	if (!ctx->connector)
+		return;
+
+	plug = nx_dp_hdmi_is_connected();
+	if (plug == ctx->plug)
+		return;
+
+	ctx->plug = plug;
+
+	DRM_INFO("HDMI %s\n", plug ? "plug" : "unplug");
+
+	drm_helper_hpd_irq_event(ctx->connector->dev);
+}
+
+#define HOTPLUG_DEBOUNCE_MS		1000
+
+static irqreturn_t panel_hdmi_hpd_irq(int irq, void *data)
+{
+	struct hdmi_context *ctx = data;
+	u32 event;
+
+	event = nx_dp_hdmi_hpd_event(irq);
+
+	if (event & (HDMI_EVENT_PLUG | HDMI_EVENT_UNPLUG))
+		mod_delayed_work(system_wq, &ctx->work,
+				msecs_to_jiffies(HOTPLUG_DEBOUNCE_MS));
+
+	return IRQ_HANDLED;
+}
+
+#define parse_read_prop(n, s, v)	{ \
+	u32 _v;	\
+	if (!of_property_read_u32(n, s, &_v))	\
+		v = _v;	\
+	}
+
+static int panel_hdmi_parse_dt_hdmi(struct platform_device *pdev,
+			struct hdmi_context *ctx)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct device_node *np;
+	struct hdmi_resource *hdmi = &ctx->hdmi_res;
+	unsigned long flags = IRQF_ONESHOT;
+	int hpd_gpio = 0, hpd_irq;
+	int err;
+
+	/*
+	 * parse hdmi default resolution
+	 */
+	np = of_find_node_by_name(node, "mode");
+	if (np) {
+		struct nx_drm_panel *panel = &ctx->display->panel;
+		struct videomode *vm = &panel->vm;
+
+		parse_read_prop(np, "width", vm->hactive);
+		parse_read_prop(np, "height", vm->vactive);
+		vm->flags = of_property_read_bool(np, "interlaced") ?
+			DISPLAY_FLAGS_INTERLACED : 0;
+		parse_read_prop(np, "refresh", panel->vrefresh);
+	}
+
+	/*
+	 * video quantization range
+	 */
+	if (of_property_read_u32(node, "q_range", &ctx->q_range)) {
+		DRM_DEBUG_KMS("fail : to get q_range property !\n");
+	}
+
+	/*
+	 * EDID ddc
+	 */
+	np = of_parse_phandle(node, "ddc-i2c-bus", 0);
+	if (!np) {
+		DRM_ERROR("fail : to find ddc adapter node for HPD !\n");
+		return -ENODEV;
+	}
+
+	hdmi->ddc_adpt = of_find_i2c_adapter_by_node(np);
+	if (!hdmi->ddc_adpt) {
+		DRM_ERROR("fail : get ddc adapter !\n");
+		return -EPROBE_DEFER;
+	}
+
+	/*
+	 * HPD
+	 */
+	hpd_gpio = of_get_named_gpio(node, "hpd-gpio", 0);
+	if (gpio_is_valid(hpd_gpio)) {
+		err = gpio_request_one(hpd_gpio, GPIOF_DIR_IN,
+						"HDMI hotplug detect");
+		if (0 > err) {
+			DRM_ERROR("fail : gpio_request_one(): %d, err %d\n",
+				hpd_gpio, err);
+			return err;
+		}
+
+		err = gpio_to_irq(hpd_gpio);
+		if (0 > err) {
+			DRM_ERROR("fail : gpio_to_irq(): %d -> %d\n",
+				hpd_gpio, err);
+			gpio_free(hpd_gpio);
+			return err;
+		}
+
+		flags = IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING |
+				IRQF_ONESHOT;
+		DRM_INFO("hdp gpio %d\n", hpd_gpio);
+	} else {
+		err = platform_get_irq(pdev, 0);
+		if (0 > err) {
+			DRM_ERROR("fail : hdmi platform_get_irq !\n");
+			return -EINVAL;
+		}
+	}
+
+	hpd_irq = err;
+	INIT_DELAYED_WORK(&ctx->work, panel_hdmi_hpd_work);
+
+	err = devm_request_threaded_irq(dev, hpd_irq, NULL,
+				panel_hdmi_hpd_irq, flags, "hdmi-hpd", ctx);
+	if (0 > err) {
+		DRM_ERROR("fail : to request IRQ#%u: %d\n", hpd_irq, err);
+		gpio_free(hpd_irq);
+		return err;
+	}
+
+	hdmi->hpd_gpio = hpd_gpio;
+	hdmi->hpd_irq = hpd_irq;
+
+	DRM_INFO("irq %d install for hdp\n", hpd_irq);
+
+	/*
+	 * Disable the interrupt until the connector has been
+	 * initialized to avoid a race in the hotplug interrupt
+	 * handler.
+	 */
+	disable_irq(hpd_irq);
+
+	return 0;
+}
+
+static int panel_hdmi_parse_dt(struct platform_device *pdev,
+			struct hdmi_context *ctx)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	struct nx_drm_device *display = ctx->display;
+	struct nx_drm_panel *panel = &ctx->display->panel;
+	struct gpio_desc *desc;
+	int err;
+
+	DRM_INFO("Load HDMI panel\n");
+
+	parse_read_prop(node, "crtc-pipe", ctx->crtc_pipe);
+
+	/*
+	 * get possible crtcs
+	 */
+	parse_read_prop(node, "crtcs-possible-mask", ctx->possible_crtcs_mask);
+
+	/*
+	 * parse panel output for HDMI
+	 */
+	err = nx_drm_dp_panel_dev_register(dev,
+				node, dp_panel_type_hdmi, display);
+	if (0 > err)
+		return err;
+
+	/*
+	 * parse HDMI configs
+	 */
+	err = panel_hdmi_parse_dt_hdmi(pdev, ctx);
+	if (0 > err)
+		return err;
+
+	desc = devm_gpiod_get_optional(dev, "enable", GPIOD_ASIS);
+	if (-EBUSY == (long)ERR_CAST(desc)) {
+		DRM_INFO("fail : enable-gpios is busy : %s !!!\n",
+			node->full_name);
+		desc = NULL;
+	}
+
+	if (!IS_ERR(desc) && desc) {
+		enum of_gpio_flags flags;
+		int gpio;
+
+		gpio = of_get_named_gpio_flags(node, "enable-gpios", 0, &flags);
+		if (!gpio_is_valid(gpio)) {
+			DRM_ERROR("invalid gpio.%d\n", gpio);
+			return -EINVAL;
+		}
+
+		/* enable at boottime */
+		gpiod_direction_output(desc,
+					flags == GPIO_ACTIVE_HIGH ? 1 : 0);
+		ctx->enable_gpio = desc;
+
+		DRM_INFO("HDMI enable-gpio.%d act %s\n", gpio,
+				flags == GPIO_ACTIVE_HIGH ? "high" : "low ");
+	}
+
+	parse_read_prop(node, "width-mm", panel->width_mm);
+	parse_read_prop(node, "height-mm", panel->height_mm);
+
+	return 0;
+}
+
+static int panel_hdmi_driver_setup(struct platform_device *pdev,
+			struct hdmi_context *ctx)
+{
+	struct device *dev = &pdev->dev;
+	struct nx_drm_res *res = &ctx->display->res;
+	int err;
+
+	err = nx_drm_dp_panel_res_parse(dev, res, dp_panel_type_hdmi);
+	if (0 > err)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int panel_hdmi_probe(struct platform_device *pdev)
+{
+	struct hdmi_resource *hdmi;
+	struct hdmi_context *ctx;
+	struct device *dev = &pdev->dev;
+	int err;
+
+	DRM_DEBUG_KMS("enter (%s)\n", dev_name(dev));
+
+	ctx = devm_kzalloc(dev, sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	ctx->display = &hdmi_dp_dev;
+	ctx->display->dev = dev;
+
+	spin_lock_init(&ctx->lock);
+
+	hdmi = &ctx->hdmi_res;
+	hdmi->hpd_gpio = -1;
+	hdmi->hpd_irq = INVALID_IRQ;
+
+	err = panel_hdmi_driver_setup(pdev, ctx);
+	if (0 > err)
+		return err;
+
+	err = panel_hdmi_parse_dt(pdev, ctx);
+	if (0 > err)
+		return err;
+
+	dev_set_drvdata(dev, ctx);
+
+	component_add(dev, &panel_comp_ops);
+
+	DRM_DEBUG_KMS("done\n");
+
+	return err;
+}
+
+static int panel_hdmi_remove(struct platform_device *pdev)
+{
+	struct hdmi_resource *hdmi;
+	struct hdmi_context *ctx = dev_get_drvdata(&pdev->dev);
+	struct device *dev = &pdev->dev;
+
+	if (!ctx)
+		return 0;
+
+	cancel_delayed_work_sync(&ctx->work);
+
+	hdmi = &ctx->hdmi_res;
+	if (INVALID_IRQ != hdmi->hpd_irq)
+		devm_free_irq(&pdev->dev, hdmi->hpd_irq, ctx);
+
+	if (hdmi->ddc_adpt)
+		put_device(&hdmi->ddc_adpt->dev);
+
+	nx_drm_dp_panel_res_free(dev, &ctx->display->res);
+	nx_drm_dp_panel_dev_release(dev, ctx->display);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int panel_hdmi_suspend(struct device *dev)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+
+	if (!ctx || !ctx->display)
+		return 0;
+
+	/*
+	 * if hdmi is connected, prevent to go suspend mode.
+	 * to protect current leakage from HDMI port
+	 */
+	if (ctx->plug) {
+		dev_warn(dev, "HDMI is connected -> prevent suspend !!!\n");
+		return -EIO;
+	}
+
+	ctx->plug = false;
+
+	cancel_delayed_work_sync(&ctx->work);
+	drm_helper_hpd_irq_event(ctx->connector->dev);
+
+	return nx_drm_dp_panel_res_suspend(dev, ctx->display);
+}
+
+static int panel_hdmi_resume(struct device *dev)
+{
+	struct hdmi_context *ctx = dev_get_drvdata(dev);
+
+	if (!ctx || !ctx->display)
+		return 0;
+
+	return nx_drm_dp_panel_res_resume(dev, ctx->display);
+}
+#endif
+
+static const struct dev_pm_ops panel_hdmi_pm = {
+	SET_SYSTEM_SLEEP_PM_OPS(
+		panel_hdmi_suspend, panel_hdmi_resume
+	)
+};
+
+static const struct of_device_id panel_hdmi_of_match[] = {
+	{.compatible = "nexell,s5pxx18-drm-hdmi"},
+	{}
+};
+MODULE_DEVICE_TABLE(of, panel_hdmi_of_match);
+
+struct platform_driver panel_hdmi_driver = {
+	.probe = panel_hdmi_probe,
+	.remove = panel_hdmi_remove,
+	.driver = {
+		.name = "nexell,display_drm_hdmi",
+		.owner = THIS_MODULE,
+		.of_match_table = panel_hdmi_of_match,
+		.pm = &panel_hdmi_pm,
+	},
+};
+module_platform_driver(panel_hdmi_driver);
+
+MODULE_AUTHOR("jhkim <jhkim@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell HDMI DRM Driver");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_lcd.c b/drivers/gpu/drm/nexell/nx_drm_lcd.c
--- a/drivers/gpu/drm/nexell/nx_drm_lcd.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_lcd.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,680 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include <drm/drm_panel.h>
+#include <drm/drm_mipi_dsi.h>
+
+#include <linux/component.h>
+#include <linux/of_platform.h>
+#include <linux/of_address.h>
+#include <linux/of_graph.h>
+#include <linux/of_gpio.h>
+#include <video/of_display_timing.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <drm/nexell_drm.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_plane.h"
+#include "nx_drm_crtc.h"
+#include "nx_drm_encoder.h"
+#include "nx_drm_connector.h"
+#include "nx_drm_fb.h"
+#include "soc/s5pxx18_drm_dp.h"
+
+struct mipi_resource {
+	struct mipi_dsi_host mipi_host;
+	struct mipi_dsi_device *mipi_dev;
+	unsigned long flags;
+	enum mipi_dsi_pixel_format format;
+	unsigned int lanes;
+};
+
+struct lcd_context {
+	struct drm_connector *connector;
+	int crtc_pipe;
+	unsigned int possible_crtcs_mask;
+	struct nx_drm_device *display;
+	struct mutex lock;
+	bool local_timing;
+	struct gpio_descs *enable_gpios;
+	enum of_gpio_flags gpios_active[4];
+	int gpios_delay[4];
+	struct mipi_resource mipi_res;
+};
+
+#define ctx_to_mipi(c)	(struct mipi_resource *)(&c->mipi_res)
+#define host_to_mipi(h)	container_of(h, struct mipi_resource, mipi_host)
+#define mipi_to_ctx(d)	container_of(d, struct lcd_context, mipi_res)
+
+static bool panel_lcd_is_connected(struct device *dev,
+			struct drm_connector *connector)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+	struct device_node *panel_node = panel->panel_node;
+		enum dp_panel_type panel_type = dp_panel_get_type(ctx->display);
+
+	DRM_DEBUG_KMS("%s panel node %s\n",
+		dp_panel_type_name(panel_type), panel_node ?
+		"exist" : "not exist");
+
+	if (panel_node) {
+		struct drm_panel *drm_panel = of_drm_find_panel(panel_node);
+
+		if (drm_panel) {
+			int ret;
+
+			panel->panel = drm_panel;
+			drm_panel_attach(drm_panel, connector);
+
+			if (panel->check_panel)
+				return panel->is_connected;
+
+			nx_drm_dp_lcd_prepare(ctx->display, drm_panel);
+			ret = drm_panel_prepare(drm_panel);
+			if (!ret) {
+				drm_panel_unprepare(drm_panel);
+				nx_drm_dp_lcd_unprepare(ctx->display,
+						drm_panel);
+				panel->is_connected = true;
+			} else {
+				drm_panel_detach(drm_panel);
+				panel->is_connected = false;
+			}
+			panel->check_panel = true;
+
+			DRM_INFO("%s: check panel %s\n",
+				dp_panel_type_name(panel_type),
+				panel->is_connected ?
+				"connected" : "disconnected");
+
+			return panel->is_connected;
+		}
+
+		/*
+		 * builded with module (.ko file).
+		 */
+		DRM_DEBUG_KMS("Not find panel driver for %s ...\n",
+			dp_panel_type_name(panel_type));
+		return false;
+	}
+
+	if (!panel_node && false == ctx->local_timing) {
+		DRM_DEBUG_DRIVER("not exist %s panel & timing %s !\n",
+			dp_panel_type_name(panel_type), dev_name(dev));
+		return false;
+	}
+
+	/*
+	 * support DT's timing node
+	 * when not use panel driver
+	 */
+	panel->is_connected = true;
+
+	return true;
+}
+
+static int panel_lcd_get_modes(struct device *dev,
+			struct drm_connector *connector)
+{
+	struct drm_display_mode *mode;
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+
+	DRM_DEBUG_KMS("enter panel %s\n",
+		panel->panel ? "attached" : "detached");
+
+	if (panel->panel)
+		return drm_panel_get_modes(panel->panel);
+
+	mode = drm_mode_create(connector->dev);
+	if (!mode) {
+		DRM_ERROR("fail : create a new display mode !\n");
+		return 0;
+	}
+
+	drm_display_mode_from_videomode(&panel->vm, mode);
+	mode->width_mm = panel->width_mm;
+	mode->height_mm = panel->height_mm;
+	connector->display_info.width_mm = mode->width_mm;
+	connector->display_info.height_mm = mode->height_mm;
+
+	drm_mode_set_name(mode);
+	drm_mode_probed_add(connector, mode);
+
+	DRM_DEBUG_KMS("exit, (%dx%d, flags=0x%x)\n",
+		mode->hdisplay, mode->vdisplay, mode->flags);
+
+	return 1;
+}
+
+static int panel_lcd_check_mode(struct device *dev,
+			struct drm_display_mode *mode)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+
+	drm_display_mode_to_videomode(mode, &panel->vm);
+
+	panel->width_mm = mode->width_mm;
+	panel->height_mm = mode->height_mm;
+
+	DRM_DEBUG_KMS("SYNC -> LCD %d x %d mm\n",
+		panel->width_mm, panel->height_mm);
+	DRM_DEBUG_KMS("ha:%d, hf:%d, hb:%d, hs:%d\n",
+		panel->vm.hactive, panel->vm.hfront_porch,
+		panel->vm.hback_porch, panel->vm.hsync_len);
+	DRM_DEBUG_KMS("va:%d, vf:%d, vb:%d, vs:%d\n",
+		panel->vm.vactive, panel->vm.vfront_porch,
+		panel->vm.vback_porch, panel->vm.vsync_len);
+	DRM_DEBUG_KMS("flags:0x%x\n", panel->vm.flags);
+
+	return MODE_OK;
+}
+
+bool panel_lcd_mode_fixup(struct device *dev,
+			struct drm_connector *connector,
+			const struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+static void panel_lcd_mode_set(struct device *dev,
+		struct drm_display_mode *mode)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+
+	nx_drm_dp_lcd_mode_set(ctx->display, mode);
+}
+
+static void panel_lcd_commit(struct device *dev)
+{
+}
+
+static void panel_lcd_enable(struct device *dev, struct drm_panel *panel)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_device *display = ctx->display;
+	bool suspended = display->suspended;
+
+	if (suspended)
+		nx_drm_dp_panel_res_resume(dev, display);
+
+	nx_drm_dp_lcd_prepare(display, panel);
+
+	drm_panel_prepare(panel);
+	drm_panel_enable(panel);
+
+	nx_drm_dp_lcd_enable(display, panel);
+}
+
+static void panel_lcd_disable(struct device *dev, struct drm_panel *panel)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_device *display = ctx->display;
+	bool suspend = display->suspended;
+
+	if (suspend)
+		nx_drm_dp_panel_res_suspend(dev, display);
+
+	drm_panel_unprepare(panel);
+	drm_panel_disable(panel);
+
+	nx_drm_dp_lcd_unprepare(display, panel);
+	nx_drm_dp_lcd_disable(display, panel);
+}
+
+static void panel_lcd_dmps(struct device *dev, int mode)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+	struct drm_panel *drm_panel = panel->panel;
+	struct gpio_desc **desc;
+	int i;
+
+	DRM_DEBUG_KMS("dpms.%d\n", mode);
+
+	switch (mode) {
+	case DRM_MODE_DPMS_ON:
+		panel_lcd_enable(dev, drm_panel);
+
+		if (ctx->enable_gpios) {
+			desc = ctx->enable_gpios->desc;
+			for (i = 0; ctx->enable_gpios->ndescs > i; i++) {
+				DRM_DEBUG_KMS("LCD gpio.%d ative %s %dms\n",
+					desc_to_gpio(desc[i]),
+					ctx->gpios_active[i] == GPIO_ACTIVE_HIGH
+					? "high" : "low ",
+					ctx->gpios_delay[i]);
+
+				gpiod_set_value_cansleep(desc[i],
+						ctx->gpios_active[i] ==
+						GPIO_ACTIVE_HIGH ? 1 : 0);
+				if (ctx->gpios_delay[i])
+					mdelay(ctx->gpios_delay[i]);
+			}
+		}
+		break;
+
+	case DRM_MODE_DPMS_STANDBY:
+	case DRM_MODE_DPMS_SUSPEND:
+	case DRM_MODE_DPMS_OFF:
+		panel_lcd_disable(dev, drm_panel);
+
+		if (ctx->enable_gpios) {
+			desc = ctx->enable_gpios->desc;
+			for (i = 0; ctx->enable_gpios->ndescs > i; i++)
+				gpiod_set_value_cansleep(desc[i],
+						ctx->gpios_active[i] ==
+						GPIO_ACTIVE_HIGH ? 0 : 1);
+		}
+		break;
+	default:
+		DRM_ERROR("fail : unspecified mode %d\n", mode);
+		break;
+	}
+}
+
+static int panel_mipi_attach(struct mipi_dsi_host *host,
+			struct mipi_dsi_device *device)
+{
+	struct mipi_resource *mipi = host_to_mipi(host);
+	struct lcd_context *ctx = mipi_to_ctx(mipi);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+
+	mipi->lanes = device->lanes;
+	mipi->format = device->format;
+	mipi->flags = device->mode_flags;
+	mipi->mipi_dev = device;
+
+	/* set panel node */
+	panel->panel_node = device->dev.of_node;
+
+	DRM_INFO("mipi: %s lanes:%d, format:%d, flags:%lx\n",
+		dev_name(&device->dev), device->lanes,
+		device->format, device->mode_flags);
+
+	return 0;
+}
+
+static int panel_mipi_detach(struct mipi_dsi_host *host,
+			struct mipi_dsi_device *device)
+{
+	struct mipi_resource *mipi = host_to_mipi(host);
+	struct lcd_context *ctx = mipi_to_ctx(mipi);
+	struct nx_drm_panel *panel = &ctx->display->panel;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	panel->panel_node = NULL;
+
+	return 0;
+}
+
+static ssize_t panel_mipi_transfer(struct mipi_dsi_host *host,
+			const struct mipi_dsi_msg *msg)
+{
+	return nx_drm_dp_mipi_transfer(host, msg);
+}
+
+static struct mipi_dsi_host_ops panel_mipi_ops = {
+	.attach = panel_mipi_attach,
+	.detach = panel_mipi_detach,
+	.transfer = panel_mipi_transfer,
+};
+
+static struct nx_drm_ops panel_lcd_ops = {
+	.is_connected = panel_lcd_is_connected,
+	.get_modes = panel_lcd_get_modes,
+	.check_mode = panel_lcd_check_mode,
+	.mode_fixup = panel_lcd_mode_fixup,
+	.mode_set = panel_lcd_mode_set,
+	.commit = panel_lcd_commit,
+	.dpms = panel_lcd_dmps,
+};
+
+static int panel_lcd_bind(struct device *dev,
+			struct device *master, void *data)
+{
+	struct drm_device *drm = data;
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	struct platform_driver *pdrv = to_platform_driver(dev->driver);
+	enum dp_panel_type panel_type = dp_panel_get_type(ctx->display);
+	int pipe = ctx->crtc_pipe;
+	unsigned int possible_crtcs = ctx->possible_crtcs_mask;
+	int err = 0;
+
+	DRM_INFO("Bind %s panel\n", dp_panel_type_name(panel_type));
+
+	ctx->connector = nx_drm_connector_create_and_attach(drm,
+					ctx->display, pipe, possible_crtcs,
+					panel_type, ctx);
+	if (IS_ERR(ctx->connector))
+		goto err_bind;
+
+	if (IS_ENABLED(CONFIG_DRM_NX_MIPI_DSI)) {
+		if (dp_panel_type_mipi == panel_type) {
+			struct mipi_resource *mipi = ctx_to_mipi(ctx);
+
+			err = mipi_dsi_host_register(&mipi->mipi_host);
+		}
+	}
+
+	if (!err) {
+		struct nx_drm_priv *priv = drm->dev_private;
+
+		if (panel_lcd_is_connected(dev, ctx->connector))
+			priv->force_detect = true;
+
+		return 0;
+	}
+
+err_bind:
+	if (pdrv->remove)
+		pdrv->remove(to_platform_device(dev));
+
+	return 0;
+}
+
+static void panel_lcd_unbind(struct device *dev,
+			struct device *master, void *data)
+{
+	struct lcd_context *ctx = dev_get_drvdata(dev);
+	enum dp_panel_type panel_type = dp_panel_get_type(ctx->display);
+
+	if (ctx->connector)
+		nx_drm_connector_destroy_and_detach(ctx->connector);
+
+	if (IS_ENABLED(CONFIG_DRM_NX_MIPI_DSI)) {
+		if (dp_panel_type_mipi == panel_type) {
+			struct mipi_resource *mipi = ctx_to_mipi(ctx);
+
+			mipi_dsi_host_unregister(&mipi->mipi_host);
+		}
+	}
+}
+
+static const struct component_ops panel_comp_ops = {
+	.bind = panel_lcd_bind,
+	.unbind = panel_lcd_unbind,
+};
+
+#define parse_read_prop(n, s, v)	{ \
+	u32 _v;	\
+	if (!of_property_read_u32(n, s, &_v))	\
+		v = _v;	\
+	}
+
+static const struct of_device_id panel_lcd_of_match[];
+
+static int panel_lcd_parse_dt(struct platform_device *pdev,
+			struct lcd_context *ctx, enum dp_panel_type panel_type)
+{
+	struct device *dev = &pdev->dev;
+	struct nx_drm_panel *panel = &ctx->display->panel;
+	struct nx_drm_device *display = ctx->display;
+	struct device_node *node = dev->of_node;
+	struct device_node *np;
+	struct display_timing timing;
+	int err;
+
+	DRM_DEBUG_KMS("enter\n");
+
+	parse_read_prop(node, "crtc-pipe", ctx->crtc_pipe);
+
+	/*
+	 * get possible crtcs
+	 */
+	parse_read_prop(node, "crtcs-possible-mask", ctx->possible_crtcs_mask);
+
+	/*
+	 * parse panel output for RGB/LVDS/MiPi-DSI
+	 */
+	err = nx_drm_dp_panel_dev_register(dev, node, panel_type, display);
+	if (0 > err)
+		return err;
+
+	/*
+	 * get panel timing from local.
+	 */
+	np = of_graph_get_remote_port_parent(node);
+	panel->panel_node = np;
+	if (!np) {
+		struct gpio_descs *gpios;
+		struct gpio_desc **desc = NULL;
+		int i, ngpios = 0;
+
+		DRM_INFO("not use remote panel node (%s) !\n",
+			node->full_name);
+
+		/* parse panel gpios */
+		gpios = devm_gpiod_get_array(dev, "enable", GPIOD_ASIS);
+		if (-EBUSY == (long)ERR_CAST(gpios)) {
+			DRM_INFO("fail : enable-gpios is busy : %s !!!\n",
+				node->full_name);
+			gpios = NULL;
+		}
+
+		if (!IS_ERR(gpios) && gpios) {
+			ngpios = gpios->ndescs;
+			desc = gpios->desc;
+			ctx->enable_gpios = gpios;	/* set enable_gpios */
+			of_property_read_u32_array(node,
+				"enable-gpios-delay", ctx->gpios_delay,
+				(ngpios-1));
+		}
+
+		for (i = 0; ngpios > i; i++) {
+			enum of_gpio_flags flags;
+			int gpio;
+
+			gpio = of_get_named_gpio_flags(node,
+						"enable-gpios", i, &flags);
+			if (!gpio_is_valid(gpio)) {
+				DRM_ERROR("invalid gpio #%d: %d\n", i, gpio);
+				return -EINVAL;
+			}
+
+			ctx->gpios_active[i] = flags;
+
+			/* disable at boottime */
+			gpiod_direction_output(desc[i],
+					flags == GPIO_ACTIVE_HIGH ? 0 : 1);
+
+			DRM_INFO("LCD enable-gpio.%d act %s\n",
+				gpio, flags == GPIO_ACTIVE_HIGH ?
+				"high" : "low ");
+		}
+
+		/* parse panel lcd size */
+		parse_read_prop(node, "width-mm", panel->width_mm);
+		parse_read_prop(node, "height-mm", panel->height_mm);
+
+		/*
+		 * parse display timing (sync)
+		 * refer to "drivers/video/of_display_timing.c"
+		 * -> of_parse_display_timing
+		 */
+		err = of_get_display_timing(node, "display-timing", &timing);
+		if (0 == err) {
+			videomode_from_timing(&timing, &panel->vm);
+			ctx->local_timing = true;
+		}
+	}
+
+	/*
+	 * parse display control config
+	 */
+	np = of_find_node_by_name(node, "dp_control");
+	if (!np) {
+		DRM_ERROR("fail : not find panel's control node (%s) !\n",
+			node->full_name);
+		return -EINVAL;
+	}
+
+	nx_drm_dp_panel_ctrl_parse(np, display);
+	nx_drm_dp_panel_ctrl_dump(ctx->display);
+
+	return 0;
+}
+
+static int panel_lcd_driver_setup(struct platform_device *pdev,
+			struct lcd_context *ctx, enum dp_panel_type *panel_type)
+{
+	const struct of_device_id *id;
+	enum dp_panel_type type;
+	struct device *dev = &pdev->dev;
+	struct nx_drm_res *res = &ctx->display->res;
+	int err;
+
+	/*
+	 * get panel type with of id
+	 */
+	id = of_match_node(panel_lcd_of_match, pdev->dev.of_node);
+	type = (enum dp_panel_type)id->data;
+
+	DRM_INFO("Load %s panel\n", dp_panel_type_name(type));
+
+	err = nx_drm_dp_panel_res_parse(dev, res, type);
+	if (0 > err)
+		return -EINVAL;
+
+	*panel_type = type;
+
+	return 0;
+}
+
+static int panel_lcd_probe(struct platform_device *pdev)
+{
+	struct lcd_context *ctx;
+	enum dp_panel_type panel_type;
+	struct device *dev = &pdev->dev;
+	size_t size;
+	int err;
+
+	DRM_DEBUG_KMS("enter (%s)\n", dev_name(dev));
+
+	size = sizeof(*ctx) + sizeof(struct nx_drm_device);
+	ctx = devm_kzalloc(dev, size, GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	ctx->display = (void *)ctx + sizeof(*ctx);
+	ctx->display->dev = dev;
+	ctx->display->ops = &panel_lcd_ops;
+
+	mutex_init(&ctx->lock);
+
+	err = panel_lcd_driver_setup(pdev, ctx, &panel_type);
+	if (0 > err)
+		return err;
+
+	err = panel_lcd_parse_dt(pdev, ctx, panel_type);
+	if (0 > err)
+		return err;
+
+	panel_type = dp_panel_get_type(ctx->display);
+
+	if (IS_ENABLED(CONFIG_DRM_NX_MIPI_DSI)) {
+		if (dp_panel_type_mipi == panel_type) {
+			struct mipi_resource *mipi = ctx_to_mipi(ctx);
+
+			mipi->mipi_host.ops = &panel_mipi_ops;
+			mipi->mipi_host.dev = dev;
+		}
+	}
+
+	dev_set_drvdata(dev, ctx);
+	component_add(dev, &panel_comp_ops);
+
+	DRM_DEBUG_KMS("done\n");
+	return err;
+}
+
+static int panel_lcd_remove(struct platform_device *pdev)
+{
+	struct lcd_context *ctx = dev_get_drvdata(&pdev->dev);
+	struct device *dev = &pdev->dev;
+
+	if (!ctx)
+		return 0;
+
+	nx_drm_dp_panel_res_free(dev, &ctx->display->res);
+	nx_drm_dp_panel_dev_release(dev, ctx->display);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int panel_lcd_suspend(struct device *dev)
+{
+	return 0;
+}
+
+static int panel_lcd_resume(struct device *dev)
+{
+	return 0;
+}
+#endif
+
+static const struct dev_pm_ops panel_lcd_pm = {
+	SET_SYSTEM_SLEEP_PM_OPS(
+		panel_lcd_suspend, panel_lcd_resume
+	)
+};
+
+static const struct of_device_id panel_lcd_of_match[] = {
+#ifdef CONFIG_DRM_NX_RGB
+	{
+		.compatible = "nexell,s5pxx18-drm-rgb",
+		.data = (void *)dp_panel_type_rgb
+	},
+#endif
+#ifdef CONFIG_DRM_NX_LVDS
+	{
+		.compatible = "nexell,s5pxx18-drm-lvds",
+		.data = (void *)dp_panel_type_lvds
+	},
+#endif
+#ifdef CONFIG_DRM_NX_MIPI_DSI
+	{
+		.compatible = "nexell,s5pxx18-drm-mipi",
+		.data = (void *)dp_panel_type_mipi
+	},
+#endif
+	{}
+};
+MODULE_DEVICE_TABLE(of, panel_lcd_of_match);
+
+struct platform_driver panel_lcd_driver = {
+	.probe = panel_lcd_probe,
+	.remove = panel_lcd_remove,
+	.driver = {
+		.name = "nexell,display_drm_lcd",
+		.owner = THIS_MODULE,
+		.of_match_table = panel_lcd_of_match,
+		.pm = &panel_lcd_pm,
+	},
+};
+module_platform_driver(panel_lcd_driver);
+
+MODULE_AUTHOR("jhkim <jhkim@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell LCD DRM Driver");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_plane.c b/drivers/gpu/drm/nexell/nx_drm_plane.c
--- a/drivers/gpu/drm/nexell/nx_drm_plane.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_plane.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <uapi/drm/drm_fourcc.h>
+
+#include "nx_drm_drv.h"
+#include "nx_drm_crtc.h"
+#include "nx_drm_plane.h"
+#include "soc/s5pxx18_drm_dp.h"
+
+static const uint32_t support_formats_rgb[] = {
+	DRM_FORMAT_RGB565,
+	DRM_FORMAT_BGR565,
+	DRM_FORMAT_RGB888,
+	DRM_FORMAT_BGR888,
+	DRM_FORMAT_XRGB8888,
+	DRM_FORMAT_XBGR8888,
+	DRM_FORMAT_ARGB8888,
+	DRM_FORMAT_ABGR8888,
+};
+
+static const uint32_t support_formats_vid[] = {
+	/* 1 buffer */
+	DRM_FORMAT_YUYV,
+	/* 3 buffer */
+	DRM_FORMAT_YUV420,
+	DRM_FORMAT_YVU420,
+	DRM_FORMAT_YUV422,
+	DRM_FORMAT_YVU422,
+	DRM_FORMAT_YUV444,
+	DRM_FORMAT_YVU444,
+};
+
+static int nx_drm_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
+			struct drm_framebuffer *fb, int crtc_x,
+			int crtc_y, unsigned int crtc_w,
+			unsigned int crtc_h, uint32_t src_x,
+			uint32_t src_y, uint32_t src_w, uint32_t src_h,
+			struct drm_modeset_acquire_ctx *ctx)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	int ret;
+
+	ret = nx_drm_dp_plane_update(plane, fb, crtc_x, crtc_y,
+			      crtc_w, crtc_h, src_x >> 16, src_y >> 16,
+			      src_w >> 16, src_h >> 16, 0);
+
+	if (!ret)
+		nx_plane->enabled = true;
+
+	/* link to plane's crtc */
+	plane->crtc = crtc;
+
+	return ret;
+}
+
+static int nx_drm_plane_disable(struct drm_plane *plane,
+		struct drm_modeset_acquire_ctx *ctx)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+
+	if (!nx_plane->enabled)
+		return 0;
+
+	nx_drm_dp_plane_disable(plane);
+	nx_plane->enabled = false;
+
+	return 0;
+}
+
+static void nx_drm_plane_destroy(struct drm_plane *plane)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+
+	DRM_DEBUG_KMS("enter\n");
+
+	nx_drm_plane_disable(plane, NULL);
+	drm_plane_cleanup(plane);
+	kfree(nx_plane);
+}
+
+static int nx_drm_plane_set_property(struct drm_plane *plane,
+			struct drm_property *property, uint64_t val)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	union color_property *color = &nx_plane->color;
+
+	DRM_DEBUG_KMS("enter %s:0x%llx\n", property->name, val);
+
+	if (nx_plane->is_yuv_plane) {
+		if (property == color->yuv.colorkey) {
+			color->colorkey = val;
+			nx_drm_dp_plane_set_color(
+				plane, dp_color_colorkey, val);
+		}
+	} else {
+		if (property == color->rgb.transcolor) {
+			color->transcolor = val;
+			nx_drm_dp_plane_set_color(plane, dp_color_transp, val);
+		}
+
+		if (property == color->rgb.alphablend) {
+			color->alphablend = val;
+			nx_drm_dp_plane_set_color(plane, dp_color_alpha, val);
+		}
+	}
+
+	if (property == nx_plane->video.priority) {
+		nx_plane->video.value = val;
+		nx_drm_dp_plane_set_priority(plane, val);
+	}
+
+	return 0;
+}
+
+static struct drm_plane_funcs nx_plane_funcs = {
+	.update_plane = nx_drm_update_plane,
+	.disable_plane = nx_drm_plane_disable,
+	.destroy = nx_drm_plane_destroy,
+	.set_property = nx_drm_plane_set_property,
+};
+
+static void	nx_drm_plane_create_proeprties(struct drm_device *drm,
+			struct drm_crtc *crtc, struct drm_plane *plane)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	union color_property *color = &nx_plane->color;
+	struct video_property *video = &nx_plane->video;
+	struct dp_plane_top *top;
+
+	if (nx_plane->is_yuv_plane) {
+		/* YUV color for video plane */
+		color->yuv.colorkey = drm_property_create_range(
+					drm, 0, "colorkey", 0, 0xffffffff);
+		color->colorkey = 0x0;
+		drm_object_attach_property(&plane->base,
+				   color->yuv.colorkey, color->colorkey);
+	} else {
+		/* RGB color for RGB plane */
+		color->rgb.transcolor = drm_property_create_range(
+					drm, 0, "transcolor", 0, 0xffffffff);
+		color->transcolor = 0;
+		drm_object_attach_property(&plane->base,
+				   color->rgb.transcolor, color->transcolor);
+
+		color->rgb.alphablend = drm_property_create_range(
+					drm, 0, "alphablend", 0, 0xffffffff);
+		color->alphablend = 0;
+		drm_object_attach_property(&plane->base,
+				   color->rgb.alphablend, color->alphablend);
+	}
+
+	video->priority = drm_property_create_range(
+					drm, 0, "video-priority", 0, 2);
+
+	top = &to_nx_crtc(crtc)->top;
+	video->value = top->video_prior;
+	drm_object_attach_property(&plane->base,
+				   video->priority, video->value);
+}
+
+struct drm_plane *nx_drm_plane_init(struct drm_device *drm,
+			struct drm_crtc *crtc,
+			unsigned long possible_crtcs,
+			enum drm_plane_type drm_type,
+			int plane_num)
+{
+	struct drm_plane *plane;
+	struct nx_drm_plane *nx_plane;
+	bool video = plane_num == PLANE_VIDEO_NUM ? true : false;
+	uint32_t const *formats = video ?
+				support_formats_vid : support_formats_rgb;
+	int format_count = video ?
+				ARRAY_SIZE(support_formats_vid) :
+				ARRAY_SIZE(support_formats_rgb);
+	int err;
+
+	DRM_DEBUG_KMS("plane.%d\n", plane_num);
+
+	nx_plane = kzalloc(sizeof(struct nx_drm_plane), GFP_KERNEL);
+	if (!nx_plane)
+		return ERR_PTR(-ENOMEM);
+
+	nx_plane->is_yuv_plane = video;
+	plane = &nx_plane->plane;
+
+	nx_drm_dp_plane_init(drm, crtc, plane, plane_num);
+
+	err = drm_universal_plane_init(drm, plane, possible_crtcs,
+			&nx_plane_funcs, formats, format_count, NULL, drm_type, NULL);
+	if (err) {
+		DRM_ERROR("fail : initialize plane\n");
+		kfree(nx_plane);
+		return ERR_PTR(err);
+	}
+
+	nx_drm_plane_create_proeprties(drm, crtc, plane);
+
+	DRM_DEBUG_KMS("done plane id:%d\n", plane->base.id);
+
+	return (struct drm_plane *)plane;
+}
+
diff -ENwbur a/drivers/gpu/drm/nexell/nx_drm_plane.h b/drivers/gpu/drm/nexell/nx_drm_plane.h
--- a/drivers/gpu/drm/nexell/nx_drm_plane.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/nx_drm_plane.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_PLANE_H_
+#define _NX_DRM_PLANE_H_
+
+#include "soc/s5pxx18_drm_dp.h"
+
+/* properties */
+union color_property {
+	struct {
+		unsigned int transcolor;
+		unsigned int alphablend;
+		struct {
+			struct drm_property *transcolor;
+			struct drm_property *alphablend;
+		} rgb;
+	};
+	struct {
+		unsigned int colorkey;
+		struct {
+			struct drm_property *colorkey;
+		} yuv;
+	};
+};
+
+struct video_property {
+	struct drm_property *priority;
+	int value;
+};
+
+struct nx_drm_plane {
+	struct drm_plane plane;
+	struct dp_plane_layer layer;
+	bool enabled;
+	union color_property color;
+	struct video_property video;
+	bool is_yuv_plane;
+};
+
+#define to_nx_plane(x)	\
+		container_of(x, struct nx_drm_plane, plane)
+
+struct drm_plane *nx_drm_plane_init(struct drm_device *drm,
+			struct drm_crtc *crtc,
+			unsigned long possible_crtcs,
+			enum drm_plane_type type,
+			int plane_num);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/Makefile b/drivers/gpu/drm/nexell/soc/Makefile
--- a/drivers/gpu/drm/nexell/soc/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/Makefile	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,14 @@
+#
+# Makefile for the drm device driver.  This driver provides support for the
+# Direct Rendering Infrastructure (DRI) in XFree86 4.1.0 and higher.
+
+obj-y += s5pxx18_drm_dp.o s5pxx18_dp_dev.o	\
+		s5pxx18_soc_mlc.o s5pxx18_soc_dpc.o s5pxx18_soc_disptop.o	\
+		s5pxx18_soc_disptop_clk.o
+
+obj-$(CONFIG_DRM_NX_RGB) += s5pxx18_dp_rgb.o
+obj-$(CONFIG_DRM_NX_LVDS) += s5pxx18_soc_lvds.o s5pxx18_dp_lvds.o
+obj-$(CONFIG_DRM_NX_MIPI_DSI) += s5pxx18_soc_mipi.o s5pxx18_dp_mipi.o
+obj-$(CONFIG_DRM_NX_HDMI) += s5pxx18_hdmi_presets.o s5pxx18_reg_hdmi.o s5pxx18_dp_hdmi.o
+
+
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.c b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,891 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/io.h>
+#include <linux/reset.h>
+
+#include "s5pxx18_dp_dev.h"
+
+#define	WAIT_VBLANK(m, n, o)
+#define	LAYER_VIDEO		PLANE_VIDEO_NUM
+
+#define	LAYER_VIDEO_FMT_MASK	0xffffff
+
+/* 12345'678'[8] -> 12345 [5], 123456'78'[8] -> 123456[6] */
+static inline u_short R8G8B8toR5G6B5(unsigned int RGB)
+{
+	u8 R = (u8) ((RGB >> 16) & 0xff);
+	u8 G = (u8) ((RGB >> 8) & 0xff);
+	u8 B = (u8) ((RGB >> 0) & 0xff);
+	u_short R5G6B5 =
+		((R & 0xF8) << 8) | ((G & 0xFC) << 3) | ((B & 0xF8) >> 3);
+
+	return R5G6B5;
+}
+
+/* 12345 [5] -> 12345'123'[8], 123456[6] -> 123456'12'[8] */
+static inline unsigned int R5G6B5toR8G8B8(u_short RGB)
+{
+	u8 R5 = (RGB >> 11) & 0x1f;
+	u8 G6 = (RGB >> 5) & 0x3f;
+	u8 B5 = (RGB >> 0) & 0x1f;
+	u8 R8 = ((R5 << 3) & 0xf8) | ((R5 >> 2) & 0x7);
+	u8 G8 = ((G6 << 2) & 0xfc) | ((G6 >> 4) & 0x3);
+	u8 B8 = ((B5 << 3) & 0xf8) | ((B5 >> 2) & 0x7);
+	unsigned int R8B8G8 = (R8 << 16) | (G8 << 8) | (B8);
+
+	return R8B8G8;
+}
+
+/* 123'45678'[8] -> 123[3], 12'345678'[8] -> 12 [2] */
+static inline u8 R8G8B8toR3G3B2(unsigned int RGB)
+{
+	u8 R = (u8) ((RGB >> 16) & 0xff);
+	u8 G = (u8) ((RGB >> 8) & 0xff);
+	u8 B = (u8) ((RGB >> 0) & 0xff);
+	u8 R3G3B2 = ((R & 0xE0) | ((G & 0xE0) >> 3) | ((B & 0xC0) >> 6));
+
+	return R3G3B2;
+}
+
+/* 123[3] -> 123'123'12' [8], 12 [2] -> 12'12'12'12'[8] */
+static inline unsigned int R3G3B2toR8G8B8(u8 RGB)
+{
+	u8 R3 = (RGB >> 5) & 0x7;
+	u8 G3 = (RGB >> 2) & 0x7;
+	u8 B2 = (RGB >> 0) & 0x3;
+	u8 R8 = ((R3 << 5) | (R3 << 2) | (R3 >> 1));
+	u8 G8 = ((G3 << 5) | (G3 << 2) | (G3 >> 1));
+	u8 B8 = ((B2 << 6) | (B2 << 4) | (B2 << 2) | B2);
+	unsigned int R8B8G8 = (R8 << 16) | (G8 << 8) | (B8);
+
+	return R8B8G8;
+}
+
+static inline void dp_wait_vblank_done(int module, int layer)
+{
+	bool on = nx_mlc_get_layer_enable(module, layer);
+	int count = 20000;
+
+	while (on) {
+		bool dflag = nx_mlc_get_dirty_flag(module, layer);
+
+		if (0 > --count || !dflag)
+			break;
+	}
+}
+
+static inline void dp_plane_adjust(int module, int layer, bool now)
+{
+	if (now)
+		nx_mlc_set_dirty_flag(module, layer);
+}
+
+void nx_soc_dp_cont_dpc_base(int module, void __iomem *base)
+{
+	BUG_ON(!base);
+	pr_debug("%s: dev.%d\n", __func__, module);
+
+	nx_dpc_set_base_address(module, base);
+}
+
+void nx_soc_dp_cont_mlc_base(int module, void __iomem *base)
+{
+	BUG_ON(!base);
+	pr_debug("%s: crtc.%d\n", __func__, module);
+
+	nx_mlc_set_base_address(module, base);
+}
+
+void nx_soc_dp_cont_top_base(int module, void __iomem *base)
+{
+	BUG_ON(!base);
+	pr_debug("%s: dev top\n", __func__);
+
+	nx_disp_top_set_base_address(base);
+}
+
+void nx_soc_dp_cont_top_clk_base(int id, void __iomem *base)
+{
+	BUG_ON(!base);
+	pr_debug("%s: dev id %d\n", __func__, id);
+
+	nx_disp_top_clkgen_set_base_address(id, base);
+}
+
+void nx_soc_dp_cont_top_clk_on(int id)
+{
+	pr_debug("%s: dev id %d\n", __func__, id);
+	nx_disp_top_clkgen_set_clock_pclk_mode(id, nx_pclkmode_always);
+}
+
+void nx_soc_dp_cont_dpc_clk_on(struct dp_control_dev *dpc)
+{
+	int module = dpc->module;
+
+	pr_debug("%s: dev.%d DONE\n", __func__, module);
+	nx_dpc_set_clock_pclk_mode(module, nx_pclkmode_always);
+}
+
+int nx_soc_dp_cont_prepare(struct dp_control_dev *dpc)
+{
+	struct dp_sync_info *sync = &dpc->sync;
+	struct dp_ctrl_info *ctl = &dpc->ctrl;
+	int module = dpc->module;
+	unsigned int out_format = ctl->out_format;
+	unsigned int delay_mask = ctl->delay_mask;
+	int rgb_pvd = 0, hsync_cp1 = 7, vsync_fram = 7, de_cp2 = 7;
+	int v_vso = 1, v_veo = 1, e_vso = 1, e_veo = 1;
+
+	int interlace = sync->interlace;
+	int invert_field = ctl->invert_field;
+	int swap_rb = ctl->swap_rb;
+	unsigned int yc_order = ctl->yc_order;
+	int vck_select = ctl->vck_select;
+	int vclk_invert = ctl->clk_inv_lv0 | ctl->clk_inv_lv1;
+	int emb_sync = (out_format == DPC_FORMAT_CCIR656 ? 1 : 0);
+
+	enum nx_dpc_dither r_dither, g_dither, b_dither;
+	int rgb_mode = 0;
+	bool lcd_rgb = dpc->panel_type == dp_panel_type_rgb ?
+			true : false;
+
+	/* set delay mask */
+	if (delay_mask & DP_SYNC_DELAY_RGB_PVD)
+		rgb_pvd = ctl->d_rgb_pvd;
+	if (delay_mask & DP_SYNC_DELAY_HSYNC_CP1)
+		hsync_cp1 = ctl->d_hsync_cp1;
+	if (delay_mask & DP_SYNC_DELAY_VSYNC_FRAM)
+		vsync_fram = ctl->d_vsync_fram;
+	if (delay_mask & DP_SYNC_DELAY_DE_CP)
+		de_cp2 = ctl->d_de_cp2;
+
+	if (ctl->vs_start_offset != 0 ||
+	    ctl->vs_end_offset != 0 ||
+	    ctl->ev_start_offset != 0 || ctl->ev_end_offset != 0) {
+		v_vso = ctl->vs_start_offset;
+		v_veo = ctl->vs_end_offset;
+		e_vso = ctl->ev_start_offset;
+		e_veo = ctl->ev_end_offset;
+	}
+
+	if ((nx_dpc_format_rgb555 == out_format) ||
+	    (nx_dpc_format_mrgb555a == out_format) ||
+	    (nx_dpc_format_mrgb555b == out_format)) {
+		r_dither = g_dither = b_dither = nx_dpc_dither_5bit;
+		rgb_mode = 1;
+	} else if ((nx_dpc_format_rgb565 == out_format) ||
+		   (nx_dpc_format_mrgb565 == out_format)) {
+		r_dither = b_dither = nx_dpc_dither_5bit;
+		g_dither = nx_dpc_dither_6bit, rgb_mode = 1;
+	} else if ((nx_dpc_format_rgb666 == out_format) ||
+		   (nx_dpc_format_mrgb666 == out_format)) {
+		r_dither = g_dither = b_dither = nx_dpc_dither_6bit;
+		rgb_mode = 1;
+	} else {
+		r_dither = g_dither = b_dither = nx_dpc_dither_bypass;
+		rgb_mode = 1;
+	}
+
+	/* CLKGEN0/1 */
+	nx_dpc_set_clock_source(module, 0, ctl->clk_src_lv0 == 3 ?
+				6 : ctl->clk_src_lv0);
+	nx_dpc_set_clock_divisor(module, 0, ctl->clk_div_lv0);
+	nx_dpc_set_clock_out_delay(module, 0, ctl->clk_delay_lv0);
+	nx_dpc_set_clock_source(module, 1, ctl->clk_src_lv1);
+	nx_dpc_set_clock_divisor(module, 1, ctl->clk_div_lv1);
+	nx_dpc_set_clock_out_delay(module, 1, ctl->clk_delay_lv1);
+
+	/* LCD out */
+	if (lcd_rgb) {
+		nx_dpc_set_mode(module, out_format, interlace, invert_field,
+				rgb_mode, swap_rb, yc_order, emb_sync, emb_sync,
+				vck_select, vclk_invert, 0);
+		nx_dpc_set_hsync(module, sync->h_active_len,
+				 sync->h_sync_width, sync->h_front_porch,
+				 sync->h_back_porch, sync->h_sync_invert);
+		nx_dpc_set_vsync(module, sync->v_active_len,
+				 sync->v_sync_width, sync->v_front_porch,
+				 sync->v_back_porch, sync->v_sync_invert,
+				 sync->v_active_len, sync->v_sync_width,
+				 sync->v_front_porch, sync->v_back_porch);
+		nx_dpc_set_vsync_offset(module, v_vso, v_veo, e_vso, e_veo);
+		nx_dpc_set_delay(module, rgb_pvd, hsync_cp1, vsync_fram,
+				 de_cp2);
+		nx_dpc_set_dither(module, r_dither, g_dither, b_dither);
+	} else {
+		enum polarity fd_polarity = polarity_activehigh;
+		enum polarity hs_polarity = sync->h_sync_invert ?
+				polarity_activelow : polarity_activehigh;
+		enum polarity vs_polarity = sync->v_sync_invert ?
+				polarity_activelow : polarity_activehigh;
+
+		nx_dpc_set_sync(module,
+				progressive,
+				sync->h_active_len,
+				sync->v_active_len,
+				sync->h_sync_width,
+				sync->h_front_porch,
+				sync->h_back_porch,
+				sync->v_sync_width,
+				sync->v_front_porch,
+				sync->v_back_porch,
+				fd_polarity, hs_polarity,
+				vs_polarity, 0, 0, 0, 0, 0, 0, 0);
+
+		/* EvenVSW, EvenVFP, EvenVBP, VSP, VCP, EvenVSP, EvenVCP */
+		nx_dpc_set_delay(module, rgb_pvd, hsync_cp1,
+				vsync_fram, de_cp2);
+		nx_dpc_set_output_format(module, out_format, 0);
+		nx_dpc_set_dither(module, r_dither, g_dither, b_dither);
+		nx_dpc_set_quantization_mode(module, qmode_256, qmode_256);
+	}
+
+	pr_debug("%s: %s\n", __func__, dp_panel_type_name(dpc->panel_type));
+	pr_debug("dev.%d (x=%4d, hfp=%3d, hbp=%3d, hsw=%3d, hi=%d)\n",
+		 module, sync->h_active_len, sync->h_front_porch,
+		 sync->h_back_porch, sync->h_sync_width, sync->h_sync_invert);
+	pr_debug("dev.%d (y=%4d, vfp=%3d, vbp=%3d, vsw=%3d, vi=%d)\n",
+		 module, sync->v_active_len, sync->v_front_porch,
+		 sync->v_back_porch, sync->v_sync_width, sync->h_sync_invert);
+	pr_debug("dev.%d clk 0[s=%d, d=%3d], 1[s=%d, d=%3d], inv[%d:%d]\n",
+	     module, ctl->clk_src_lv0, ctl->clk_div_lv0,
+	     ctl->clk_src_lv1, ctl->clk_div_lv1, ctl->clk_inv_lv0,
+	     ctl->clk_inv_lv1);
+	pr_debug("dev.%d v_vso=%d, v_veo=%d, e_vso=%d, e_veo=%d\n",
+		module, v_vso, v_veo, e_vso, e_veo);
+	pr_debug("dev.%d delay RGB=%d, HS=%d, VS=%d, DE=%d fmt:0x%x\n",
+		module, rgb_pvd, hsync_cp1, vsync_fram, de_cp2, out_format);
+
+	return 0;
+}
+
+int nx_soc_dp_cont_power_status(struct dp_control_dev *dpc)
+{
+	return 0;
+}
+
+void nx_soc_dp_cont_power_on(struct dp_control_dev *dpc, bool on)
+{
+	int module = dpc->module;
+	int count = 200;
+	int vbl;
+
+	pr_debug("%s: %s dev.%d power %s\n",
+		__func__, dp_panel_type_name(dpc->panel_type),
+		module, on ? "on" : "off");
+
+	nx_dpc_clear_interrupt_pending_all(module);
+
+	if (on) {
+		nx_dpc_set_reg_flush(module);	/* for HDMI */
+		nx_dpc_set_dpc_enable(module, 1);
+		nx_dpc_set_clock_divisor_enable(module, 1);
+	} else {
+		nx_dpc_set_dpc_enable(module, 0);
+		nx_dpc_set_clock_divisor_enable(module, 0);
+	}
+
+	/*
+	 * wait for video sync
+	 * for hdmi and output devices.
+	 */
+	vbl = nx_dpc_get_interrupt_enable_all(module);
+	while (on) {
+		if (!vbl) {
+			msleep(20);
+			break;
+		}
+
+		vbl = nx_dpc_get_interrupt_pending_all(module);
+		mdelay(1);
+		if (0 > --count || vbl)
+			break;
+	}
+}
+
+void nx_soc_dp_cont_irq_on(int module, bool on)
+{
+	pr_debug("%s: dev.%d, %s\n", __func__, module, on ? "on" : "off");
+
+	nx_dpc_clear_interrupt_pending_all(module);
+	nx_dpc_set_interrupt_enable_all(module, on ? 1 : 0);
+}
+
+void nx_soc_dp_cont_irq_done(int module)
+{
+	nx_dpc_clear_interrupt_pending_all(module);
+}
+
+void nx_soc_dp_plane_top_prepare(struct dp_plane_top *top)
+{
+	int module = top->module;
+
+	pr_debug("%s: crtc.%d\n", __func__, module);
+	nx_mlc_set_clock_pclk_mode(module, nx_pclkmode_always);
+	nx_mlc_set_clock_bclk_mode(module, nx_bclkmode_always);
+}
+
+void nx_soc_dp_plane_top_set_format(struct dp_plane_top *top,
+			int width, int height)
+{
+	int module = top->module;
+	enum nx_mlc_priority priority;
+	int prior = top->video_prior;
+	unsigned int bgcolor = top->back_color;
+
+	switch (prior) {
+	case 0:
+		priority = nx_mlc_priority_videofirst;
+		break;	/* PRIORITY-video>0>1>2 */
+	case 1:
+		priority = nx_mlc_priority_videosecond;
+		break;	/* PRIORITY-0>video>1>2 */
+	case 2:
+		priority = nx_mlc_priority_videothird;
+		break;	/* PRIORITY-0>1>video>2 */
+	case 3:
+		priority = nx_mlc_priority_videofourth;
+		break;	/* PRIORITY-0>1>2>video */
+	default:
+		pr_err(
+			"fail : not support video priority num(0~3),(%d)\n",
+		    prior);
+		return;
+	}
+
+	top->width = width;
+	top->height = height;
+
+	pr_debug("%s: crtc.%d, %d by %d, prior %d, bg 0x%x\n",
+		__func__, module, top->width, top->height, prior, bgcolor);
+
+	nx_mlc_set_screen_size(module, top->width, top->height);
+	nx_mlc_set_background(module, bgcolor & 0x00FFFFFF);
+	nx_mlc_set_layer_priority(module, priority);
+	nx_mlc_set_top_dirty_flag(module);
+}
+
+void nx_soc_dp_plane_top_set_bg_color(struct dp_plane_top *top)
+{
+	int module = top->module;
+	unsigned int bgcolor = top->back_color;
+
+	pr_debug("%s: crtc.%d, bg 0x%x\n",
+		__func__, module, bgcolor);
+
+	nx_mlc_set_background(module, bgcolor & 0x00FFFFFF);
+	nx_mlc_set_top_dirty_flag(module);
+}
+
+int nx_soc_dp_plane_top_set_enable(struct dp_plane_top *top, bool on)
+{
+	struct dp_plane_layer *layer;
+	int module = top->module;
+
+	pr_debug("%s: crtc.%d, %s %dx%d\n",
+		__func__, module, on ? "on" : "off", top->width, top->height);
+
+	if (on) {
+		int m_lock_size = 16;
+
+		nx_mlc_set_field_enable(module, top->interlace);
+		nx_mlc_set_rgblayer_gama_table_power_mode(module, 0, 0, 0);
+		nx_mlc_set_rgblayer_gama_table_sleep_mode(module, 1, 1, 1);
+		nx_mlc_set_rgblayer_gamma_enable(module, 0);
+		nx_mlc_set_dither_enable_when_using_gamma(module, 0);
+		nx_mlc_set_gamma_priority(module, 0);
+		nx_mlc_set_top_power_mode(module, 1);
+		nx_mlc_set_top_sleep_mode(module, 0);
+		nx_mlc_set_mlc_enable(module, 1);
+
+		list_for_each_entry(layer, &top->plane_list, list) {
+			nx_mlc_set_lock_size(module, layer->num, m_lock_size);
+			if (layer->enable) {
+				nx_mlc_set_layer_enable(module, layer->num, 1);
+				dp_plane_adjust(module, layer->num, true);
+				pr_debug("%s: %s on\n", __func__, layer->name);
+			}
+		}
+
+	} else {
+		list_for_each_entry(layer, &top->plane_list, list) {
+			if (layer->enable) {
+				nx_mlc_set_layer_enable(module, layer->num, 0);
+				dp_plane_adjust(module, layer->num, true);
+			}
+		}
+
+		nx_mlc_set_top_power_mode(module, 0);
+		nx_mlc_set_top_sleep_mode(module, 1);
+		nx_mlc_set_mlc_enable(module, 0);
+	}
+
+	nx_mlc_set_top_dirty_flag(module);
+	top->enable = on;
+
+	return 0;
+}
+
+int nx_soc_dp_plane_rgb_set_format(struct dp_plane_layer *layer,
+			unsigned int format, int pixelbyte, bool adjust)
+{
+	int module = layer->module;
+	int num = layer->num;
+	int en_alpha = 0;
+	int m_lock_size = 16;
+
+	pr_debug("%s: %s, fmt:0x%x, pixel=%d\n",
+		 __func__, layer->name, format, pixelbyte);
+
+	if (layer->format == format &&
+		layer->pixelbyte == pixelbyte)
+		return 0;
+
+	layer->format = format;
+	layer->pixelbyte = pixelbyte;
+
+	/* set alphablend */
+	if (format == nx_mlc_rgbfmt_a1r5g5b5 ||
+	    format == nx_mlc_rgbfmt_a1b5g5r5 ||
+	    format == nx_mlc_rgbfmt_a4r4g4b4 ||
+	    format == nx_mlc_rgbfmt_a4b4g4r4 ||
+	    format == nx_mlc_rgbfmt_a8r3g3b2 ||
+	    format == nx_mlc_rgbfmt_a8b3g3r2 ||
+	    format == nx_mlc_rgbfmt_a8r8g8b8 ||
+	    format == nx_mlc_rgbfmt_a8b8g8r8)
+		en_alpha = 1;
+
+	/* nx_mlc_set_transparency(module,layer,0,layer->color.transcolor); */
+	nx_mlc_set_lock_size(module, layer->num, m_lock_size);
+	nx_mlc_set_color_inversion(module, num, 0, layer->color.invertcolor);
+	nx_mlc_set_alpha_blending(module, num, en_alpha,
+			layer->color.alphablend);
+	nx_mlc_set_format_rgb(module, num, (enum nx_mlc_rgbfmt)format);
+	nx_mlc_set_rgblayer_invalid_position(module, num, 0, 0, 0, 0, 0, 0);
+	nx_mlc_set_rgblayer_invalid_position(module, num, 1, 0, 0, 0, 0, 0);
+	dp_plane_adjust(module, num, adjust);
+
+	return 0;
+}
+
+int nx_soc_dp_plane_rgb_set_position(struct dp_plane_layer *layer,
+			int src_x, int src_y, int src_w, int src_h,
+			int dst_x, int dst_y, int dst_w, int dst_h,
+			bool adjust)
+
+{
+	int module = layer->module;
+	int num = layer->num;
+
+	int sx = src_x;
+	int sy = src_y;
+	int sw = src_w;
+	int sh = src_h;
+	int w, h;
+
+	if (layer->left == sx && layer->top == sy &&
+	layer->width == sw && layer->height == sh &&
+	layer->dst_left == dst_x && layer->dst_top == dst_y &&
+	layer->dst_width == dst_w && layer->dst_height == dst_h)
+		return 0;
+
+	layer->left = sx;
+	layer->top = sy;
+	layer->width = sw;
+	layer->height = sh;
+
+	layer->dst_left = dst_x;
+	layer->dst_top = dst_y;
+	layer->dst_width = dst_w;
+	layer->dst_height = dst_h;
+
+	w = dst_x + sw;
+	h = dst_y + sh;
+
+	/* max rectangle 2048 */
+	if (w > 2048)
+		w = 2048;
+
+	if (h > 2048)
+		h = 2048;
+
+	pr_debug("%s: %s, (%d, %d, %d, %d) to (%d, %d, %d, %d) adjust=%d\n",
+		 __func__, layer->name, sx, sy, sw, sh,
+		 dst_x, dst_y, w, h, adjust);
+
+	nx_mlc_set_position(module, num, dst_x, dst_y, w - 1, h - 1);
+	dp_plane_adjust(module, num, adjust);
+
+	return 0;
+}
+
+void nx_soc_dp_plane_rgb_set_address(struct dp_plane_layer *layer,
+			unsigned int addr, unsigned int pixelbyte,
+			unsigned int stride, int align, bool adjust)
+{
+	int module = layer->module;
+	int num = layer->num;
+	int cl = layer->left, ct = layer->top;
+
+	unsigned int phys = addr + (cl*pixelbyte) + (ct * stride);
+
+	if (align)
+		phys = ALIGN(phys, align);
+
+	pr_debug("%s: %s, pa=0x%x, hs=%d, vs=%d, l:%d, t:%d, adjust=%d\n",
+		__func__, layer->name, phys, pixelbyte, stride, cl, ct, adjust);
+	pr_debug("%s: %s, pa=0x%x -> 0x%x aligned %d\n",
+		__func__, layer->name, (addr + (cl*pixelbyte) + (ct * stride)),
+		phys, align);
+
+	if (adjust)
+		dp_wait_vblank_done(module, num);
+
+	nx_mlc_set_rgblayer_stride(module, num, pixelbyte, stride);
+	nx_mlc_set_rgblayer_address(module, num, phys);
+	dp_plane_adjust(module, num, adjust);
+}
+
+void nx_soc_dp_plane_rgb_set_enable(struct dp_plane_layer *layer,
+			bool on, bool adjust)
+{
+	int module = layer->module;
+	int num = layer->num;
+
+	pr_debug("%s: %s, %s (%d)\n",
+		__func__, layer->name, on ? "on" : "off", layer->enable);
+
+	if (on != layer->enable) {
+		nx_mlc_set_layer_enable(module, num, (on ? 1 : 0));
+		dp_plane_adjust(module, num, adjust);
+	}
+
+	layer->enable = on;
+	if (!on) {
+		layer->format = 0x0;
+		layer->pixelbyte = 0;
+		layer->left = 0;
+		layer->top = 0;
+		layer->width = 0;
+		layer->height = 0;
+		layer->dst_left = 0;
+		layer->dst_top = 0;
+		layer->dst_width = 0;
+		layer->dst_height = 0;
+	}
+}
+
+void nx_soc_dp_plane_rgb_set_color(struct dp_plane_layer *layer,
+			unsigned int type, unsigned int color,
+			bool on, bool adjust)
+{
+	int module = layer->module;
+	int num = layer->num;
+
+	pr_debug("%s: %s, type:%d color:0x%x, pixel %d, %s\n",
+		__func__, layer->name, type, color, layer->pixelbyte,
+		on ? "on" : "off");
+
+	switch (type) {
+	case dp_color_alpha:
+		if (color <= 0)
+			color = 0;
+		if (color >= 15)
+			color = 15;
+
+		layer->color.alpha = (on ? color : 15);
+
+		nx_mlc_set_alpha_blending(module, num,
+			 (on ? 1 : 0), (u32)color);
+
+		dp_plane_adjust(module, num, adjust);
+		break;
+
+	case dp_color_transp:
+		if (1 == layer->pixelbyte) {
+			color = R8G8B8toR3G3B2((unsigned int)color);
+			color = R3G3B2toR8G8B8((u8) color);
+		}
+
+		if (2 == layer->pixelbyte) {
+			color = R8G8B8toR5G6B5((unsigned int)color);
+			color = R5G6B5toR8G8B8((u_short) color);
+		}
+
+		layer->color.transcolor = (on ? color : 0);
+
+		nx_mlc_set_transparency(module, num,
+			(on ? 1 : 0), (u32)(color & 0x00FFFFFF));
+
+		dp_plane_adjust(module, num, adjust);
+		break;
+
+	case dp_color_invert:
+		if (1 == layer->pixelbyte) {
+			color = R8G8B8toR3G3B2((unsigned int)color);
+			color = R3G3B2toR8G8B8((u8) color);
+		}
+
+		if (2 == layer->pixelbyte) {
+			color = R8G8B8toR5G6B5((unsigned int)color);
+			color = R5G6B5toR8G8B8((u_short) color);
+		}
+
+		layer->color.invertcolor = (on ? color : 0);
+
+		nx_mlc_set_color_inversion(module, num,
+			(on ? 1 : 0),
+			(u32)(color & 0x00FFFFFF));
+
+		dp_plane_adjust(module, num, adjust);
+		break;
+	default:
+		break;
+	}
+}
+
+int nx_soc_dp_plane_video_set_format(struct dp_plane_layer *layer,
+			unsigned int format, bool adjust)
+{
+	int module = layer->module;
+	int m_lock_size = 16;
+
+	if (layer->format == format)
+		return 0;
+
+	layer->format = format;
+	format &= LAYER_VIDEO_FMT_MASK;
+
+	pr_debug("%s: %s, format=0x%x\n",
+		__func__, layer->name, format);
+
+	nx_mlc_set_lock_size(module, LAYER_VIDEO, m_lock_size);
+	nx_mlc_set_format_yuv(module, (enum nx_mlc_yuvfmt)format);
+	dp_plane_adjust(module, LAYER_VIDEO, adjust);
+
+	return 0;
+}
+
+int nx_soc_dp_plane_video_set_position(struct dp_plane_layer *layer,
+			int src_x, int src_y, int src_w, int src_h,
+			int dst_x, int dst_y, int dst_w, int dst_h,
+			bool adjust)
+{
+	int module = layer->module;
+	int sx = src_x, sy = src_y;
+	int sw = src_w, sh = src_h;
+	int dx = dst_x, dy = dst_y;
+	int dw = dst_w, dh = dst_h;
+	int hf = 1, vf = 1;
+	int w = 0, h = 0;
+
+	if (layer->left == sx && layer->top == sy &&
+	layer->width == sw && layer->height == sh &&
+	layer->dst_left == dst_x && layer->dst_top == dst_y &&
+	layer->dst_width == dst_w && layer->dst_height == dst_h)
+		return 0;
+
+	layer->left = sx;
+	layer->top = sy;
+	layer->width = sw;
+	layer->height = sh;
+
+	layer->dst_left = dst_x;
+	layer->dst_top = dst_y;
+	layer->dst_width = dst_w;
+	layer->dst_height = dst_h;
+
+	/*
+	 * max scale size 2048
+	 * if ove scale size, fix max
+	 */
+	if (dw > 2048)
+		dw = 2048;
+
+	if (dh > 2048)
+		dh = 2048;
+
+	w = dx + dw;
+	h = dy + dh;
+
+	/* max rectangle 2048 */
+	if (w > 2048)
+		w = 2048;
+
+	if (h > 2048)
+		h = 2048;
+
+	pr_debug("%s: %s, (%d, %d, %d, %d) to (%d, %d, %d, %d, %d, %d) adjust=%d\n",
+		 __func__, layer->name, sx, sy, sw, sh,
+		 dx, dy, dw, dh, w, h, adjust);
+
+	if (sw == dw && sh == dh)
+		hf = 0, vf = 0;
+
+	layer->h_filter = hf;
+	layer->v_filter = vf;
+
+	/* set scale and position */
+	nx_mlc_set_video_layer_scale(module, sw, sh, dw, dh, hf, hf, vf, vf);
+	nx_mlc_set_position(module, LAYER_VIDEO, dx, dy, w - 1, h - 1);
+	dp_plane_adjust(module, LAYER_VIDEO, adjust);
+
+	return 0;
+}
+
+void nx_soc_dp_plane_video_set_address_1p(struct dp_plane_layer *layer,
+			unsigned int addr, unsigned int stride,
+			bool adjust)
+{
+	int module = layer->module;
+	int cl = layer->left, ct = layer->top;
+	unsigned int phys = addr + (cl/2) + (ct * stride);
+
+	pr_debug("%s: %s, lu:0x%x->0x%x,%d\n",
+		__func__, layer->name, addr, phys, stride);
+
+	nx_mlc_set_video_layer_address_yuyv(module, phys, stride);
+	dp_plane_adjust(module, LAYER_VIDEO, adjust);
+}
+
+void nx_soc_dp_plane_video_set_address_3p(struct dp_plane_layer *layer,
+			unsigned int lu_a, unsigned int lu_s,
+			unsigned int cb_a, unsigned int cb_s,
+			unsigned int cr_a, unsigned int cr_s,
+			bool adjust)
+{
+	int module = layer->module;
+	int cl = layer->left;
+	int ct = layer->top;
+	int ls = 1, us = 1;
+	int lh = 1, uh = 1;
+	unsigned int format;
+
+	format = layer->format & LAYER_VIDEO_FMT_MASK;
+
+	switch (format) {
+	case nx_mlc_yuvfmt_420:
+			us = 2, uh = 2;
+			break;
+	case nx_mlc_yuvfmt_422:
+			us = 2, uh = 1;
+			break;
+	case nx_mlc_yuvfmt_444:
+			us = 1, uh = 1;
+			break;
+	}
+
+	lu_a = lu_a + (cl/ls) + (ct/lh * lu_s);
+	cb_a = cb_a + (cl/us) + (ct/uh * cb_s);
+	cr_a = cr_a + (cl/us) + (ct/uh * cr_s);
+
+	pr_debug("%s: %s, lu:0x%x,%d, cb:0x%x,%d, cr:0x%x,%d\n",
+		__func__, layer->name, lu_a, lu_s, cb_a, cb_s, cr_a, cr_s);
+
+	if (adjust)
+		dp_wait_vblank_done(module, LAYER_VIDEO);
+
+	nx_mlc_set_video_layer_stride(module, lu_s, cb_s, cr_s);
+	nx_mlc_set_video_layer_address(module, lu_a, cb_a, cr_a);
+	dp_plane_adjust(module, LAYER_VIDEO, adjust);
+}
+
+void nx_soc_dp_plane_video_set_enable(struct dp_plane_layer *layer,
+			bool on, bool adjust)
+{
+	int module = layer->module;
+	int hl, hc, vl, vc;
+
+	pr_debug("%s: %s, %s\n", __func__, layer->name, on ? "on" : "off");
+
+	if (adjust)
+		dp_wait_vblank_done(module, LAYER_VIDEO);
+
+	if (on) {
+		nx_mlc_set_video_layer_line_buffer_power_mode(module, 1);
+		nx_mlc_set_video_layer_line_buffer_sleep_mode(module, 0);
+		nx_mlc_set_layer_enable(module, LAYER_VIDEO, 1);
+		dp_plane_adjust(module, LAYER_VIDEO, adjust);
+	} else {
+		nx_mlc_set_layer_enable(module, LAYER_VIDEO, 0);
+		dp_plane_adjust(module, LAYER_VIDEO, adjust);
+		WAIT_VBLANK(module, LAYER_VIDEO, 1);
+
+		nx_mlc_get_video_layer_scale_filter(module, &hl, &hc, &vl, &vc);
+		if (hl | hc | vl | vc)
+			nx_mlc_set_video_layer_scale_filter(module, 0, 0, 0, 0);
+		nx_mlc_set_video_layer_line_buffer_power_mode(module, 0);
+		nx_mlc_set_video_layer_line_buffer_sleep_mode(module, 1);
+		dp_plane_adjust(module, LAYER_VIDEO, adjust);
+	}
+
+	layer->enable = on;
+	if (!on) {
+		layer->format = 0x0;
+		layer->left = 0;
+		layer->top = 0;
+		layer->width = 0;
+		layer->height = 0;
+		layer->dst_left = 0;
+		layer->dst_top = 0;
+		layer->dst_width = 0;
+		layer->dst_height = 0;
+	}
+}
+
+void nx_soc_dp_plane_video_set_priority(struct dp_plane_layer *layer,
+			int priority)
+{
+	struct dp_plane_top *top = layer->plane_top;
+	int module = layer->module;
+
+	switch (priority) {
+	case 0:
+		priority = nx_mlc_priority_videofirst;
+		break;	/* PRIORITY-video>0>1>2 */
+	case 1:
+		priority = nx_mlc_priority_videosecond;
+		break;	/* PRIORITY-0>video>1>2 */
+	case 2:
+		priority = nx_mlc_priority_videothird;
+		break;	/* PRIORITY-0>1>video>2 */
+	case 3:
+		priority = nx_mlc_priority_videofourth;
+		break;	/* PRIORITY-0>1>2>video */
+	default:
+		pr_err(
+			"fail : not support video priority num(0~3),(%d)\n",
+		    priority);
+		return;
+	}
+	top->video_prior = priority;
+
+	pr_debug("%s: crtc.%d, priority:%d\n", __func__, module, priority);
+
+	nx_mlc_set_layer_priority(module, priority);
+	nx_mlc_set_top_dirty_flag(module);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.h b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_dev.h	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,376 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_DP_DEV_H_
+#define _S5PXX18_DP_DEV_H_
+
+#include <drm/drm_mipi_dsi.h>
+
+#include "s5pxx18_soc_mlc.h"
+#include "s5pxx18_soc_dpc.h"
+#include "s5pxx18_soc_disptop.h"
+#include "s5pxx18_soc_disp.h"
+#include "s5pxx18_soc_mipi.h"
+#include "s5pxx18_soc_lvds.h"
+#include "s5pxx18_soc_disptop_clk.h"
+
+/*
+ * display sync info
+ */
+struct dp_sync_info {
+	int h_active_len;
+	int h_sync_width;
+	int h_back_porch;
+	int h_front_porch;
+	int h_sync_invert;	/* default active low */
+	int v_active_len;
+	int v_sync_width;
+	int v_back_porch;
+	int v_front_porch;
+	int v_sync_invert;	/* default active low */
+	int pixel_clock_hz;	/* HZ */
+	int interlace;
+};
+
+/*
+ * display control info
+ */
+/* the data output format. */
+#define	DPC_FORMAT_RGB555		0  /* RGB555 Format */
+#define	DPC_FORMAT_RGB565		1  /* RGB565 Format */
+#define	DPC_FORMAT_RGB666		2  /* RGB666 Format */
+#define	DPC_FORMAT_RGB888		3  /* RGB888 Format */
+#define	DPC_FORMAT_MRGB555A		4  /* MRGB555A Format */
+#define	DPC_FORMAT_MRGB555B		5  /* MRGB555B Format */
+#define	DPC_FORMAT_MRGB565		6  /* MRGB565 Format */
+#define	DPC_FORMAT_MRGB666		7  /* MRGB666 Format */
+#define	DPC_FORMAT_MRGB888A		8  /* MRGB888A Format */
+#define	DPC_FORMAT_MRGB888B		9  /* MRGB888B Format */
+#define	DPC_FORMAT_CCIR656		10 /* ITU-R BT.656 / 601(8-bit) */
+#define	DPC_FORMAT_CCIR601A		12 /* ITU-R BT.601A */
+#define	DPC_FORMAT_CCIR601B		13 /* ITU-R BT.601B */
+#define	DPC_FORMAT_4096COLOR		1  /* 4096 Color Format */
+#define	DPC_FORMAT_16GRAY		3  /* 16 Level Gray Format */
+
+/* the data output order in case of ITU-R BT.656 / 601. */
+#define	DPC_YCORDER_CbYCrY		0 /* Cb, Y, Cr, Y */
+#define	DPC_YCORDER_CrYCbY		1 /* Cr, Y, Cb, Y */
+#define	DPC_YCORDER_YCbYCr		2 /* Y, Cb, Y, Cr */
+#define	DPC_YCORDER_YCrYCb		3 /* Y, Cr, Y, Cb */
+
+/* the PAD output clock. */
+#define	DPC_PADCLKSEL_VCLK		0 /* VCLK */
+#define	DPC_PADCLKSEL_VCLK2		1 /* VCLK2 */
+
+/* the PAD output delay. */
+#define	DP_SYNC_DELAY_RGB_PVD		(1<<0)
+#define	DP_SYNC_DELAY_HSYNC_CP1		(1<<1)
+#define	DP_SYNC_DELAY_VSYNC_FRAM	(1<<2)
+#define	DP_SYNC_DELAY_DE_CP		(1<<3)
+
+struct dp_ctrl_info {
+	/* clock generator */
+	int clk_src_lv0;
+	int clk_div_lv0;
+	int clk_src_lv1;
+	int clk_div_lv1;
+
+	/* sync generator format */
+	unsigned int out_format;
+	int invert_field;	/* 0= Normal Field 1: Invert Field */
+	int swap_rb;
+	unsigned int yc_order;	/* for CCIR output */
+
+	/* extern sync delay  */
+	int delay_mask;		/* if not 0, set defalut delays */
+	int d_rgb_pvd;		/* delay value RGB/PVD signal   , 0 ~ 16, 0 */
+	int d_hsync_cp1;	/* delay value HSYNC/CP1 signal , 0 ~ 63, 12 */
+	int d_vsync_fram;	/* delay value VSYNC/FRAM signal, 0 ~ 63, 12 */
+	int d_de_cp2;		/* delay value DE/CP2 signal    , 0 ~ 63, 12 */
+
+	/* extern sync delay */
+	int vs_start_offset;	/* start veritcal sync offset, defatult 0 */
+	int vs_end_offset;	 /* end veritcla sync offset  , defatult 0 */
+	int ev_start_offset; /* start even veritcal sync offset, defatult 0 */
+	int ev_end_offset;   /* end even veritcal sync offset, defatult 0 */
+
+	/* pad clock seletor */
+	int vck_select;		/* 0=vclk0, 1=vclk2 */
+	int clk_inv_lv0;	/* OUTCLKINVn */
+	int clk_delay_lv0;	/* OUTCLKDELAYn */
+	int clk_inv_lv1;	/* OUTCLKINVn */
+	int clk_delay_lv1;	/* OUTCLKDELAYn */
+	int clk_sel_div1;	/* 0=clk1_inv, 1=clk1_div_2_ns */
+};
+
+/* this enumerates display type. */
+enum dp_panel_type {
+	dp_panel_type_none,
+	dp_panel_type_rgb,
+	dp_panel_type_lvds,
+	dp_panel_type_mipi,
+	dp_panel_type_hdmi,
+	dp_panel_type_vidi,
+};
+
+struct dp_control_ops;
+
+struct dp_control_dev {
+	int module;
+	void *base;
+	struct dp_sync_info sync;
+	struct dp_ctrl_info ctrl;
+	enum dp_panel_type panel_type;
+	void *dp_output;
+	struct dp_control_ops *ops;
+	void *regs[sizeof(struct nx_dpc_register_set)/sizeof(void *)];
+};
+
+struct dp_control_ops {
+	void (*set_base)(struct dp_control_dev *dpc, void **base, int num);
+	int  (*prepare)(struct dp_control_dev *dpc, unsigned int flags);
+	int  (*unprepare)(struct dp_control_dev *dpc);
+	int  (*enable)(struct dp_control_dev *dpc, unsigned int flags);
+	int  (*disable)(struct dp_control_dev *dpc);
+	int  (*suspend)(struct dp_control_dev *dpc);
+	void (*mode_set)(struct dp_control_dev *dpc);
+	int  (*resume)(struct dp_control_dev *dpc);
+};
+
+enum {
+	dp_clock_rconv = 0,
+	dp_clock_lcd = 1,
+	dp_clock_mipi = 2,
+	dp_clock_lvds = 3,
+	dp_clock_hdmi = 4,
+	dp_clock_end,
+};
+
+struct dp_rgb_dev {
+	bool mpu_lcd;
+};
+
+struct dp_mipi_dev {
+	int lp_bitrate;	/* to lcd setup, low power bitrate (150, 100, 80 Mhz) */
+	int hs_bitrate; /* to lcd data, high speed bitrate (1000, ... Mhz) */
+	unsigned int hs_pllpms;
+	unsigned int hs_bandctl;
+	unsigned int lp_pllpms;
+	unsigned int lp_bandctl;
+};
+
+enum dp_lvds_format {
+	dp_lvds_format_vesa = 0,
+	dp_lvds_format_jeida = 1,
+	dp_lvds_format_loc = 2,
+};
+
+struct dp_lvds_dev {
+	unsigned int lvds_format;	/* 0:VESA, 1:JEIDA, 2: Location */
+	int pol_inv_hs;		/* hsync polarity invert for VESA, JEIDA */
+	int pol_inv_vs;		/* bsync polarity invert for VESA, JEIDA */
+	int pol_inv_de;		/* de polarity invert for VESA, JEIDA */
+	int pol_inv_ck;		/* input clock(pixel clock) polarity invert */
+	int voltage_level;
+	void *reset_control;
+	int num_resets;
+};
+
+struct dp_hdmi_dev {
+	int color_range;
+	const void *hdmiconf;
+};
+
+struct dp_mipi_xfer {
+	u8  id;
+	u8  data[2];
+	u16 flags;
+	const u8 *tx_buf;
+	u16 tx_len;
+	u8 *rx_buf;
+	u16 rx_len;
+};
+
+/*
+ * plane'a top layer
+ */
+#define	PLANE_FLAG_RGB		(0<<0)
+#define	PLANE_FLAG_VIDEO	(1<<0)
+#define	PLANE_FLAG_UNKNOWN	(0xFFFFFFF)
+
+struct dp_plane_top {
+	struct device *dev;
+	void *base;
+	int module;
+	int width;
+	int height;
+	int primary_plane;
+	int video_prior;	/* 0: video>RGBn, 1: RGB0>video>RGB1,
+				   2: RGB0 > RGB1 > vidoe .. */
+	int num_planes;
+	unsigned int plane_type[10];
+	unsigned int plane_flag[10];
+	struct list_head plane_list;
+	unsigned int back_color;
+	unsigned int color_key;
+	int interlace;
+	int enable;
+	void *regs[sizeof(struct nx_mlc_register_set)/sizeof(void *)];
+};
+
+/*
+ * plane's each layers
+ */
+enum dp_plane_type {
+	dp_plane_rgb,
+	dp_plane_video,
+};
+#define	PLANE_VIDEO_NUM			(3) /* Planes = 0,1 (RGB), 3 (VIDEO) */
+
+/* for prototype layer index */
+enum dp_color_type {
+	dp_color_colorkey,
+	dp_color_alpha,
+	dp_color_bright,
+	dp_color_hue,
+	dp_color_contrast,
+	dp_color_saturation,
+	dp_color_gamma,
+	dp_color_transp,
+	dp_color_invert,
+};
+
+struct dp_plane_layer {
+	struct device *dev;
+	struct dp_plane_top *plane_top;
+	struct list_head list;
+	char name[16];
+	int module, num;
+	enum dp_plane_type type;
+	unsigned int format;
+
+	/* source */
+	int left;
+	int top;
+	int width;
+	int height;
+	int pixelbyte;
+	int stride;
+	unsigned int h_filter;
+	unsigned int v_filter;
+	int enable;
+
+	/* target */
+	int dst_left;
+	int dst_top;
+	int dst_width;
+	int dst_height;
+
+	/* color */
+	union {
+		struct {
+			unsigned int transcolor;
+			unsigned int invertcolor;
+			unsigned int alphablend;
+		};
+		struct {
+			int alpha;	/* def= 15, 0 <= Range <= 16 */
+			int bright;	/* def= 0, -128 <= Range <= 128*/
+			int contrast; /* def= 0, 0 <= Range <= 8 */
+			double hue;	/* def= 0, 0 <= Range <= 360 */
+			double saturation; /* def = 0, -100 <= Range <= 100 */
+			int satura;
+			int gamma;
+		};
+	} color;
+};
+
+const char *dp_panel_type_name(enum dp_panel_type panel);
+
+void nx_soc_dp_cont_dpc_base(int module, void __iomem *base);
+void nx_soc_dp_cont_mlc_base(int module, void __iomem *base);
+void nx_soc_dp_cont_top_base(int module, void __iomem *base);
+void nx_soc_dp_cont_top_clk_base(int id, void __iomem *base);
+void nx_soc_dp_cont_top_clk_on(int id);
+
+void nx_soc_dp_cont_dpc_clk_on(struct dp_control_dev *dpc);
+int  nx_soc_dp_cont_prepare(struct dp_control_dev *dpc);
+int  nx_soc_dp_cont_power_status(struct dp_control_dev *dpc);
+void nx_soc_dp_cont_power_on(struct dp_control_dev *dpc, bool on);
+void nx_soc_dp_cont_irq_on(int module, bool on);
+void nx_soc_dp_cont_irq_done(int module);
+
+void nx_soc_dp_plane_top_prepare(struct dp_plane_top *top);
+void nx_soc_dp_plane_top_set_format(struct dp_plane_top *top,
+			int width, int height);
+void nx_soc_dp_plane_top_set_bg_color(struct dp_plane_top *top);
+int nx_soc_dp_plane_top_set_enable(struct dp_plane_top *top, bool on);
+
+int nx_soc_dp_plane_rgb_set_format(struct dp_plane_layer *layer,
+			unsigned int format, int pixelbyte, bool adjust);
+int nx_soc_dp_plane_rgb_set_position(struct dp_plane_layer *layer,
+			int src_x, int src_y, int src_w, int src_h,
+			int dst_x, int dst_y, int dst_w, int dst_h,
+			bool adjust);
+void nx_soc_dp_plane_rgb_set_address(struct dp_plane_layer *layer,
+			unsigned int paddr, unsigned int pixelbyte,
+			unsigned int stride, int align, bool adjust);
+void nx_soc_dp_plane_rgb_set_enable(struct dp_plane_layer *layer,
+			bool on, bool adjust);
+void nx_soc_dp_plane_rgb_set_color(struct dp_plane_layer *layer,
+			unsigned int type, unsigned int color,
+			bool on, bool adjust);
+
+int nx_soc_dp_plane_video_set_format(struct dp_plane_layer *layer,
+			unsigned int format, bool adjust);
+int nx_soc_dp_plane_video_set_position(struct dp_plane_layer *layer,
+			int src_x, int src_y, int src_w, int src_h,
+			int dst_x, int dst_y, int dst_w, int dst_h,
+			bool adjust);
+void nx_soc_dp_plane_video_set_address_1p(struct dp_plane_layer *layer,
+			unsigned int addr, unsigned int stride,
+			bool adjust);
+void nx_soc_dp_plane_video_set_address_3p(struct dp_plane_layer *layer,
+			unsigned int lu_a, unsigned int lu_s,
+			unsigned int cb_a, unsigned int cb_s,
+			unsigned int cr_a, unsigned int cr_s,
+			bool adjust);
+void nx_soc_dp_plane_video_set_enable(struct dp_plane_layer *layer,
+			bool on, bool adjust);
+void nx_soc_dp_plane_video_set_priority(struct dp_plane_layer *layer,
+			int priority);
+
+#ifdef CONFIG_DRM_NX_RGB
+int nx_dp_device_rgb_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc);
+#endif
+
+#ifdef CONFIG_DRM_NX_LVDS
+int nx_dp_device_lvds_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc,
+			void *resets, int num_resets);
+#endif
+
+#ifdef CONFIG_DRM_NX_MIPI_DSI
+int nx_dp_device_mipi_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc);
+int nx_soc_dp_mipi_tx_transfer(struct dp_mipi_xfer *xfer);
+int nx_soc_dp_mipi_rx_transfer(struct dp_mipi_xfer *xfer);
+int nx_soc_dp_mipi_ransfer_done(void);
+#endif
+
+#endif /* __S5PXX18_DP_DEV_H__ */
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.c b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.c	2018-05-06 08:49:49.566711163 +0200
@@ -0,0 +1,1001 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
+#include <linux/hdmi.h>
+#include "s5pxx18_dp_hdmi.h"
+#include "s5pxx18_reg_hdmi.h"
+
+#define DEFAULT_SAMPLE_RATE		48000
+#define DEFAULT_BITS_PER_SAMPLE		16
+#define DEFAULT_AUDIO_CODEC		HDMI_AUDIO_PCM
+#define DEFAULT_HDMIPHY_TX_LEVEL	23
+#define HDMI_PHY_TABLE_SIZE		30
+
+#define	display_to_dpc(d)	(&d->ctrl.dpc)
+
+static int hdmi_hpd_status(void)
+{
+	return hdmi_read(HDMI_HPD_STATUS);
+}
+
+static void hdmi_reset(struct reset_control *rsc[], int num)
+{
+	int count = (num - 1);	/* skip hdmi phy reset */
+	int i;
+
+	pr_debug("%s: resets %d\n", __func__, num);
+
+	for (i = 0; count > i; i++)
+		reset_control_assert(rsc[i]);
+
+	mdelay(1);
+
+	for (i = 0; count > i; i++)
+		reset_control_deassert(rsc[i]);
+}
+
+static bool hdmi_wait_phy_ready(void)
+{
+	u32 val;
+	int count = 500;
+	bool ret = false;
+
+	do {
+		val = hdmi_read(HDMI_PHY_STATUS_0);
+		if (val & 0x01) {
+			ret = true;
+			break;
+		}
+		mdelay(10);
+	} while (count--);
+
+	pr_info("HDMI: PHY [%s][0x%x] ...\n",
+	       ret ? "Ready Done" : "Fail : Not Ready", val);
+
+	return ret;
+}
+
+#ifdef DEFAULT_HDMIPHY_TX_LEVEL
+static int hdmi_tx_level_get(void)
+{
+	u32 val;
+	int lv;
+
+	val = hdmi_read(HDMI_PHY_REG3C);
+	lv = (val & 0x80) >> 7;
+	val = hdmi_read(HDMI_PHY_REG40);
+	val &= 0x0f;
+	val <<= 1;
+	lv |= val;
+
+	return lv;
+}
+
+static int hdmi_tx_level_set(int level, bool enable)
+{
+	u32 val;
+	u32 dat;
+
+	if (level > 31) {
+		pr_err("%s: hdmi invalid tx level %d, 0 ~ 31\n",
+		       __func__, level);
+		return -EINVAL;
+	}
+
+	if (!enable)
+		return 0;
+
+	val = hdmi_tx_level_get();
+	if (val == level)
+		return 0;
+
+	hdmi_write(HDMI_PHY_REG7C, (0 << 7));
+	hdmi_write(HDMI_PHY_REG7C, (0 << 7));
+
+	dat = hdmi_read(HDMI_PHY_REG3C);
+	dat = hdmi_read(HDMI_PHY_REG3C);
+
+	val = level & 0x1;
+	val <<= 7;
+	dat &= ~0x80;
+	dat |= val;
+
+	hdmi_write(HDMI_PHY_REG3C, dat);
+	hdmi_write(HDMI_PHY_REG3C, dat);
+
+	dat = hdmi_read(HDMI_PHY_REG40);
+	dat = hdmi_read(HDMI_PHY_REG40);
+
+	val = (level & 0x1f) >> 1;
+	dat &= ~0x0f;
+	dat |= val;
+
+	hdmi_write(HDMI_PHY_REG40, dat);
+	hdmi_write(HDMI_PHY_REG40, dat);
+	hdmi_write(HDMI_PHY_REG7C, (1 << 7));
+	hdmi_write(HDMI_PHY_REG7C, (1 << 7));
+
+	return 0;
+
+}
+#endif
+
+static void hdmi_phy_set(const struct hdmi_conf *conf, int size)
+{
+	const u8 *data = conf->phy_data;
+	u32 addr = HDMI_PHY_REG04;
+	int i;
+
+	hdmi_write(HDMI_PHY_REG7C, (0 << 7));
+	hdmi_write(HDMI_PHY_REG04, (0 << 4));
+	hdmi_write(HDMI_PHY_REG24, (1 << 7));
+
+	for (i = 0; size > i; i++, addr += 4)
+		hdmi_write(addr, data[i]);
+
+#ifdef DEFAULT_HDMIPHY_TX_LEVEL
+	hdmi_tx_level_set(DEFAULT_HDMIPHY_TX_LEVEL, true);
+#endif
+
+	hdmi_write(HDMI_PHY_REG7C, 0x80);
+	hdmi_write(HDMI_PHY_REG7C, (1 << 7));
+}
+
+static void hdmi_dp_set(struct dp_control_dev *dpc, struct videomode *vm)
+{
+	struct dp_ctrl_info *ctrl = &dpc->ctrl;
+
+	/*
+	 * FIX dpc clock source, from HDMI phy
+	 */
+	ctrl->clk_src_lv0 = 4;
+	ctrl->clk_div_lv0 = 1;
+	ctrl->clk_src_lv1 = 7;
+	ctrl->clk_div_lv1 = 1;
+
+	ctrl = &dpc->ctrl;
+	ctrl->out_format = outputformat_rgb888;
+	ctrl->delay_mask = (DP_SYNC_DELAY_RGB_PVD | DP_SYNC_DELAY_HSYNC_CP1 |
+			    DP_SYNC_DELAY_VSYNC_FRAM | DP_SYNC_DELAY_DE_CP);
+	ctrl->d_rgb_pvd = 0;
+	ctrl->d_hsync_cp1 = 0;
+	ctrl->d_vsync_fram = 0;
+	ctrl->d_de_cp2 = 7;
+
+	/* HFP + HSW + HBP + AVWidth-VSCLRPIXEL- 1; */
+	ctrl->vs_start_offset = (vm->hfront_porch + vm->hsync_len +
+				 vm->hback_porch + vm->hactive - 1);
+	ctrl->vs_end_offset = 0;
+
+	/* HFP + HSW + HBP + AVWidth-EVENVSCLRPIXEL- 1 */
+	ctrl->ev_start_offset = (vm->hfront_porch + vm->hsync_len +
+				 vm->hback_porch + vm->hactive - 1);
+	ctrl->ev_end_offset = 0;
+}
+
+static void hdmi_clock_on(void)
+{
+	bool enabled =
+		nx_disp_top_clkgen_get_clock_divisor_enable(to_mipi_clkgen);
+
+	/* check for mipi-dsi */
+	if (!enabled)
+		nx_disp_top_clkgen_set_clock_divisor_enable(to_mipi_clkgen, 0);
+
+	nx_disp_top_clkgen_set_clock_pclk_mode(to_mipi_clkgen,
+					       nx_pclkmode_always);
+	nx_disp_top_clkgen_set_clock_source(to_mipi_clkgen,
+			HDMI_SPDIF_CLKOUT, 2);
+	nx_disp_top_clkgen_set_clock_divisor(to_mipi_clkgen,
+			HDMI_SPDIF_CLKOUT, 2);
+	/*
+	 * skip : do not change mipi source
+	 * nx_disp_top_clkgen_set_clock_source(to_mipi_clkgen, 1, 7);
+	 */
+	nx_disp_top_clkgen_set_clock_divisor_enable(to_mipi_clkgen, 1);
+}
+
+static void hdmi_standby(void)
+{
+	nx_disp_top_hdmi_set_vsync_hsstart_end(0, 0);
+	nx_disp_top_hdmi_set_vsync_start(0);
+	nx_disp_top_hdmi_set_hactive_start(0);
+	nx_disp_top_hdmi_set_hactive_end(0);
+}
+
+static void hdmi_conf_set(const struct hdmi_conf *conf)
+{
+	const struct hdmi_preset *preset = conf->preset;
+	const struct hdmi_res_mode *mode = &preset->mode;
+	u32 h_blank, h_line, h_sync_start, h_sync_end;
+	u32 v_blank, v2_blank, v_line;
+	u32 v_sync_line_bef_1, v_sync_line_bef_2;
+
+	u32 fixed_ffff = 0xffff;
+
+	/*
+	 * calculate sync variables
+	 */
+	h_blank = mode->h_fp + mode->h_sw + mode->h_bp;
+	v_blank = mode->v_fp + mode->v_sw + mode->v_bp;
+	v_line = mode->v_as + v_blank;	/* total v */
+	v2_blank = mode->v_as + v_blank;	/* total v */
+	h_line = mode->h_as + mode->h_fp + mode->h_sw + mode->h_bp;
+	h_sync_start = mode->h_fp;
+	h_sync_end = mode->h_fp + mode->h_sw;
+	v_sync_line_bef_1 = mode->v_fp;
+	v_sync_line_bef_2 = mode->v_fp + mode->v_sw;
+
+	pr_debug("%s : %s ha:%4d, hf:%3d, hb:%3d, hs:%3d\n",
+		 __func__, mode->name,
+		 mode->h_as, mode->h_fp, mode->h_bp, mode->h_sw);
+	pr_debug("%s : %s va:%4d, vf:%3d, vb:%3d, vs:%3d\n",
+		 __func__, mode->name,
+		 mode->v_as, mode->v_fp, mode->v_bp, mode->v_sw);
+
+	/* no blue screen mode, encoding order as it is */
+	hdmi_write(HDMI_CON_0, (0 << 5) | (1 << 4));
+
+	/* set HDMI_BLUE_SCREEN_* to 0x0 */
+	hdmi_write(HDMI_BLUE_SCREEN_R_0, 0x5555);
+	hdmi_write(HDMI_BLUE_SCREEN_R_1, 0x5555);
+	hdmi_write(HDMI_BLUE_SCREEN_G_0, 0x5555);
+	hdmi_write(HDMI_BLUE_SCREEN_G_1, 0x5555);
+	hdmi_write(HDMI_BLUE_SCREEN_B_0, 0x5555);
+	hdmi_write(HDMI_BLUE_SCREEN_B_1, 0x5555);
+
+	/* set HDMI_CON_1 to 0x0 */
+	hdmi_write(HDMI_CON_1, 0x0);
+	hdmi_write(HDMI_CON_2, 0x0);
+
+	/* set interrupt : enable hpd_plug, hpd_unplug */
+	hdmi_write(HDMI_INTC_CON_0, (1 << 6) | (1 << 3) | (1 << 2));
+
+	/* set STATUS_EN to 0x17 */
+	hdmi_write(HDMI_STATUS_EN, 0x17);
+
+	/* set HPD to 0x0 : later check hpd */
+	hdmi_write(HDMI_HPD_STATUS, 0x0);
+
+	/* set MODE_SEL to 0x02 */
+	hdmi_write(HDMI_MODE_SEL, 0x2);
+
+	/* set H_BLANK_*, V1_BLANK_*, V2_BLANK_*, V_LINE_*,
+	 * H_LINE_*, H_SYNC_START_*, H_SYNC_END_ *
+	 * V_SYNC_LINE_BEF_1_*, V_SYNC_LINE_BEF_2_*
+	 */
+	hdmi_write(HDMI_H_BLANK_0, h_blank % 256);
+	hdmi_write(HDMI_H_BLANK_1, h_blank >> 8);
+	hdmi_write(HDMI_V1_BLANK_0, v_blank % 256);
+	hdmi_write(HDMI_V1_BLANK_1, v_blank >> 8);
+	hdmi_write(HDMI_V2_BLANK_0, v2_blank % 256);
+	hdmi_write(HDMI_V2_BLANK_1, v2_blank >> 8);
+	hdmi_write(HDMI_V_LINE_0, v_line % 256);
+	hdmi_write(HDMI_V_LINE_1, v_line >> 8);
+	hdmi_write(HDMI_H_LINE_0, h_line % 256);
+	hdmi_write(HDMI_H_LINE_1, h_line >> 8);
+
+	if (mode->flags & RES_FIELD_NHSYNC) {
+		hdmi_write(HDMI_HSYNC_POL, 0x1);
+	} else {
+		hdmi_write(HDMI_HSYNC_POL, 0x0);
+	}
+	if (mode->flags & RES_FIELD_NVSYNC) {
+		hdmi_write(HDMI_VSYNC_POL, 0x1);
+	} else {
+		hdmi_write(HDMI_VSYNC_POL, 0x0);
+	}
+
+	hdmi_write(HDMI_INT_PRO_MODE, 0x0);
+
+	hdmi_write(HDMI_H_SYNC_START_0, (h_sync_start % 256) - 2);
+	hdmi_write(HDMI_H_SYNC_START_1, h_sync_start >> 8);
+	hdmi_write(HDMI_H_SYNC_END_0, (h_sync_end % 256) - 2);
+	hdmi_write(HDMI_H_SYNC_END_1, h_sync_end >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_BEF_1_0, v_sync_line_bef_1 % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_BEF_1_1, v_sync_line_bef_1 >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_BEF_2_0, v_sync_line_bef_2 % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_BEF_2_1, v_sync_line_bef_2 >> 8);
+
+	/* Set V_SYNC_LINE_AFT*, V_SYNC_LINE_AFT_PXL*, VACT_SPACE* */
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_1_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_1_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_2_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_2_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_3_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_3_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_4_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_4_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_5_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_5_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_6_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_6_1, fixed_ffff >> 8);
+
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_1_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_1_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_2_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_2_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_3_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_3_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_4_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_4_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_5_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_5_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_6_0, fixed_ffff % 256);
+	hdmi_write(HDMI_V_SYNC_LINE_AFT_PXL_6_1, fixed_ffff >> 8);
+
+	hdmi_write(HDMI_VACT_SPACE_1_0, fixed_ffff % 256);
+	hdmi_write(HDMI_VACT_SPACE_1_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_VACT_SPACE_2_0, fixed_ffff % 256);
+	hdmi_write(HDMI_VACT_SPACE_2_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_VACT_SPACE_3_0, fixed_ffff % 256);
+	hdmi_write(HDMI_VACT_SPACE_3_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_VACT_SPACE_4_0, fixed_ffff % 256);
+	hdmi_write(HDMI_VACT_SPACE_4_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_VACT_SPACE_5_0, fixed_ffff % 256);
+	hdmi_write(HDMI_VACT_SPACE_5_1, fixed_ffff >> 8);
+	hdmi_write(HDMI_VACT_SPACE_6_0, fixed_ffff % 256);
+	hdmi_write(HDMI_VACT_SPACE_6_1, fixed_ffff >> 8);
+
+	hdmi_write(HDMI_CSC_MUX, 0x0);
+	hdmi_write(HDMI_SYNC_GEN_MUX, 0x0);
+
+	hdmi_write(HDMI_SEND_START_0, 0xfd);
+	hdmi_write(HDMI_SEND_START_1, 0x01);
+	hdmi_write(HDMI_SEND_END_0, 0x0d);
+	hdmi_write(HDMI_SEND_END_1, 0x3a);
+	hdmi_write(HDMI_SEND_END_2, 0x08);
+
+	/* Set DC_CONTROL to 0x00 */
+	hdmi_write(HDMI_DC_CONTROL, 0x0);
+
+	/* Set VIDEO_PATTERN_GEN to 0x00 */
+	hdmi_write(HDMI_VIDEO_PATTERN_GEN, 0x0);
+	/*hdmi_write(HDMI_VIDEO_PATTERN_GEN, 0x1); */
+	/*hdmi_write(HDMI_VIDEO_PATTERN_GEN, 0x3);, internal */
+
+	hdmi_write(HDMI_GCP_CON, 0x0a);
+}
+
+static void hdmi_stop_vsi(void)
+{
+	hdmi_writeb(HDMI_VSI_CON, HDMI_VSI_CON_DO_NOT_TRANSMIT);
+}
+
+static u8 hdmi_chksum(u32 start, u8 len, u32 hdr_sum)
+{
+	int i;
+
+	/* hdr_sum : header0 + header1 + header2
+	 * start : start address of packet byte1
+	 * len : packet bytes - 1 */
+	for (i = 0; i < len; ++i)
+		hdr_sum += hdmi_read(start + i * 4);
+
+	return (u8) (0x100 - (hdr_sum & 0xff));
+}
+
+static void hdmi_reg_infoframe(const struct hdmi_conf *conf,
+			       union hdmi_infoframe *infoframe,
+			       int color_range)
+{
+	const struct hdmi_preset *preset = conf->preset;
+	const struct hdmi_format *format = conf->format;
+	bool dvi_mode = conf->preset->dvi_mode;
+	u32 hdr_sum;
+	u8 chksum;
+
+	pr_debug("%s: infoframe type = 0x%x, %s\n", __func__,
+		infoframe->any.type, dvi_mode ? "dvi monitor" : "hdmi monitor");
+
+	if (dvi_mode) {
+		hdmi_writeb(HDMI_VSI_CON, HDMI_VSI_CON_DO_NOT_TRANSMIT);
+		hdmi_writeb(HDMI_AVI_CON, HDMI_AVI_CON_DO_NOT_TRANSMIT);
+		hdmi_write(HDMI_AUI_CON, HDMI_AUI_CON_NO_TRAN);
+		return;
+	}
+
+	switch (infoframe->any.type) {
+	case HDMI_INFOFRAME_TYPE_VENDOR:
+		hdmi_writeb(HDMI_VSI_CON, HDMI_VSI_CON_EVERY_VSYNC);
+		hdmi_writeb(HDMI_VSI_HEADER0, infoframe->any.type);
+		hdmi_writeb(HDMI_VSI_HEADER1, infoframe->any.version);
+
+		/* 0x000C03 : 24bit IEEE Registration Identifier */
+		hdmi_writeb(HDMI_VSI_DATA(1), 0x03);
+		hdmi_writeb(HDMI_VSI_DATA(2), 0x0c);
+		hdmi_writeb(HDMI_VSI_DATA(3), 0x00);
+		hdmi_writeb(HDMI_VSI_DATA(4),
+			    HDMI_VSI_DATA04_VIDEO_FORMAT(format->vformat));
+		hdmi_writeb(HDMI_VSI_DATA(5),
+			    HDMI_VSI_DATA05_3D_STRUCTURE(format->type_3d));
+
+		if (format->type_3d == HDMI_3D_TYPE_SB_HALF) {
+			infoframe->any.length += 1;
+			hdmi_writeb(HDMI_VSI_DATA(6),
+				    (u8)
+				    HDMI_VSI_DATA06_3D_EXT_DATA
+				    (HDMI_H_SUB_SAMPLE));
+		}
+
+		hdmi_writeb(HDMI_VSI_HEADER2, infoframe->any.length);
+		hdr_sum =
+		    infoframe->any.type + infoframe->any.version +
+		    infoframe->any.length;
+		chksum =
+		    hdmi_chksum(HDMI_VSI_DATA(1), infoframe->any.length,
+				hdr_sum);
+
+		pr_debug("%s: VSI checksum = 0x%x\n", __func__, chksum);
+		hdmi_writeb(HDMI_VSI_DATA(0), chksum);
+		break;
+
+	case HDMI_INFOFRAME_TYPE_AVI:
+		hdmi_writeb(HDMI_AVI_CON, HDMI_AVI_CON_EVERY_VSYNC);
+		hdmi_writeb(HDMI_AVI_HEADER0, infoframe->any.type);
+		hdmi_writeb(HDMI_AVI_HEADER1, infoframe->any.version);
+		hdmi_writeb(HDMI_AVI_HEADER2, infoframe->any.length);
+		hdr_sum = infoframe->any.type +
+		    infoframe->any.version + infoframe->any.length;
+
+		hdmi_writeb(HDMI_AVI_BYTE(1), HDMI_OUTPUT_RGB888 << 5 |
+			    AVI_ACTIVE_FORMAT_VALID |
+			    AVI_UNDERSCANNED_DISPLAY_VALID);
+
+		hdmi_writeb(HDMI_AVI_BYTE(2), preset->aspect_ratio |
+			    AVI_SAME_AS_PIC_ASPECT_RATIO | AVI_ITU709);
+
+		if (color_range == AVI_FULL_RANGE)
+			hdmi_writeb(HDMI_AVI_BYTE(3), AVI_FULL_RANGE);
+		else
+			hdmi_writeb(HDMI_AVI_BYTE(3), AVI_LIMITED_RANGE);
+
+		hdmi_writeb(HDMI_AVI_BYTE(4), preset->vic);
+		chksum = hdmi_chksum(HDMI_AVI_BYTE(1),
+				     infoframe->any.length, hdr_sum);
+
+		pr_debug("%s: AVI checksum = 0x%x\n", __func__, chksum);
+		hdmi_writeb(HDMI_AVI_CHECK_SUM, chksum);
+		break;
+
+	case HDMI_INFOFRAME_TYPE_AUDIO:
+		hdmi_write(HDMI_AUI_CON, HDMI_AUI_CON_TRANS_EVERY_VSYNC);
+		hdmi_writeb(HDMI_AUI_HEADER0, infoframe->any.type);
+		hdmi_writeb(HDMI_AUI_HEADER1, infoframe->any.version);
+		hdmi_writeb(HDMI_AUI_HEADER2, infoframe->any.length);
+
+#ifdef SPEAKER_PLACEMENT
+		/* speaker placement */
+		if (audio_channel_count == 6)
+			hdmi_writeb(HDMI_AUI_BYTE(4), 0x0b);
+		else if (audio_channel_count == 8)
+			hdmi_writeb(HDMI_AUI_BYTE(4), 0x13);
+		else
+			hdmi_writeb(HDMI_AUI_BYTE(4), 0x00);
+#endif
+		hdr_sum = infoframe->any.type + infoframe->any.version +
+		    infoframe->any.length;
+		chksum = hdmi_chksum(HDMI_AUI_BYTE(1),
+				     infoframe->any.length, hdr_sum);
+		pr_debug("%s: AUI checksum = 0x%x\n", __func__, chksum);
+		hdmi_writeb(HDMI_AUI_CHECK_SUM, chksum);
+		break;
+
+	default:
+		pr_err("%s: unknown type(0x%x)\n",
+		       __func__, infoframe->any.type);
+		break;
+	}
+}
+
+static void hdmi_infoframe_set(const struct hdmi_conf *conf, int color_range)
+{
+	union hdmi_infoframe infoframe;
+	const struct hdmi_format *format;
+
+	format = conf->format;
+
+	pr_debug("%s: format [%s]\n", __func__,
+		 format->vformat == HDMI_VIDEO_FORMAT_3D ? "3D" : "2D");
+
+	/* vendor infoframe */
+	if (format->vformat != HDMI_VIDEO_FORMAT_3D) {
+		hdmi_stop_vsi();
+	} else {
+		infoframe.any.type = HDMI_INFOFRAME_TYPE_VENDOR;
+		infoframe.any.version = HDMI_VSI_VERSION;
+		infoframe.any.length = HDMI_VSI_LENGTH;
+		hdmi_reg_infoframe(conf, &infoframe, color_range);
+	}
+
+	/* avi infoframe */
+	infoframe.any.type = HDMI_INFOFRAME_TYPE_AVI;
+	infoframe.any.version = HDMI_AVI_VERSION;
+	infoframe.any.length = HDMI_AVI_LENGTH;
+	hdmi_reg_infoframe(conf, &infoframe, color_range);
+
+	/* audio infoframe */
+	infoframe.any.type = HDMI_INFOFRAME_TYPE_AUDIO;
+	infoframe.any.version = HDMI_AUI_VERSION;
+	infoframe.any.length = HDMI_AUI_LENGTH;
+	hdmi_reg_infoframe(conf, &infoframe, color_range);
+}
+
+static void hdmi_audio_enable(bool on)
+{
+	if (on)
+		hdmi_write_mask(HDMI_CON_0, ~0, HDMI_ASP_ENABLE);
+	else
+		hdmi_write_mask(HDMI_CON_0, 0, HDMI_ASP_ENABLE);
+}
+
+static void hdmi_set_acr(int sample_rate, bool dvi_mode)
+{
+	u32 n, cts;
+
+	pr_debug("%s %s\n",
+		 __func__, dvi_mode ? "dvi monitor" : "hdmi monitor");
+
+	if (dvi_mode) {
+		hdmi_write(HDMI_ACR_CON, HDMI_ACR_CON_TX_MODE_NO_TX);
+		return;
+	}
+
+	if (sample_rate == 32000) {
+		n = 4096;
+		cts = 27000;
+	} else if (sample_rate == 44100) {
+		n = 6272;
+		cts = 30000;
+	} else if (sample_rate == 48000) {
+		n = 6144;
+		cts = 27000;
+	} else if (sample_rate == 88200) {
+		n = 12544;
+		cts = 30000;
+	} else if (sample_rate == 96000) {
+		n = 12288;
+		cts = 27000;
+	} else if (sample_rate == 176400) {
+		n = 25088;
+		cts = 30000;
+	} else if (sample_rate == 192000) {
+		n = 24576;
+		cts = 27000;
+	} else {
+		n = 0;
+		cts = 0;
+	}
+
+	hdmi_write(HDMI_ACR_N0, HDMI_ACR_N0_VAL(n));
+	hdmi_write(HDMI_ACR_N1, HDMI_ACR_N1_VAL(n));
+	hdmi_write(HDMI_ACR_N2, HDMI_ACR_N2_VAL(n));
+
+	/* transfer ACR packet */
+	hdmi_write(HDMI_ACR_CON, HDMI_ACR_CON_TX_MODE_MESURED_CTS);
+}
+
+void hdmi_spdif_init(int audio_codec, int bits_per_sample)
+{
+	u32 val;
+	int bps, rep_time;
+
+	hdmi_write(HDMI_I2S_CLK_CON, HDMI_I2S_CLK_ENABLE);
+
+	val = HDMI_SPDIFIN_CFG_NOISE_FILTER_2_SAMPLE |
+	    HDMI_SPDIFIN_CFG_PCPD_MANUAL |
+	    HDMI_SPDIFIN_CFG_WORD_LENGTH_MANUAL |
+	    HDMI_SPDIFIN_CFG_UVCP_REPORT |
+	    HDMI_SPDIFIN_CFG_HDMI_2_BURST | HDMI_SPDIFIN_CFG_DATA_ALIGN_32;
+
+	hdmi_write(HDMI_SPDIFIN_CONFIG_1, val);
+	hdmi_write(HDMI_SPDIFIN_CONFIG_2, 0);
+
+	bps = audio_codec == HDMI_AUDIO_PCM ? bits_per_sample : 16;
+	rep_time = audio_codec == HDMI_AUDIO_AC3 ? 1536 * 2 - 1 : 0;
+	val = HDMI_SPDIFIN_USER_VAL_REPETITION_TIME_LOW(rep_time) |
+	    HDMI_SPDIFIN_USER_VAL_WORD_LENGTH_24;
+	hdmi_write(HDMI_SPDIFIN_USER_VALUE_1, val);
+	val = HDMI_SPDIFIN_USER_VAL_REPETITION_TIME_HIGH(rep_time);
+	hdmi_write(HDMI_SPDIFIN_USER_VALUE_2, val);
+	hdmi_write(HDMI_SPDIFIN_USER_VALUE_3, 0);
+	hdmi_write(HDMI_SPDIFIN_USER_VALUE_4, 0);
+
+	val = HDMI_I2S_IN_ENABLE | HDMI_I2S_AUD_SPDIF | HDMI_I2S_MUX_ENABLE;
+	hdmi_write(HDMI_I2S_IN_MUX_CON, val);
+
+	hdmi_write(HDMI_I2S_MUX_CH, HDMI_I2S_CH_ALL_EN);
+	hdmi_write(HDMI_I2S_MUX_CUV, HDMI_I2S_CUV_RL_EN);
+
+	hdmi_write_mask(HDMI_SPDIFIN_CLK_CTRL, 0, HDMI_SPDIFIN_CLK_ON);
+	hdmi_write_mask(HDMI_SPDIFIN_CLK_CTRL, ~0, HDMI_SPDIFIN_CLK_ON);
+
+	hdmi_write(HDMI_SPDIFIN_OP_CTRL, HDMI_SPDIFIN_STATUS_CHECK_MODE);
+	hdmi_write(HDMI_SPDIFIN_OP_CTRL, HDMI_SPDIFIN_STATUS_CHECK_MODE_HDMI);
+}
+
+static void hdmi_audio_init(const struct hdmi_conf *conf)
+{
+	u32 sample_rate, bits_per_sample;
+	u32 audio_codec;
+
+	sample_rate = DEFAULT_SAMPLE_RATE;
+	bits_per_sample = DEFAULT_BITS_PER_SAMPLE;
+	audio_codec = DEFAULT_AUDIO_CODEC;
+
+	hdmi_set_acr(sample_rate, conf->preset->dvi_mode);
+	hdmi_spdif_init(audio_codec, bits_per_sample);
+}
+
+void hdmi_dvi_mode_set(bool dvi_mode)
+{
+	u32 val;
+
+	pr_debug("%s %s\n",
+		 __func__, dvi_mode ? "dvi monitor" : "hdmi monitor");
+
+	hdmi_write_mask(HDMI_MODE_SEL, dvi_mode ? HDMI_MODE_DVI_EN :
+			HDMI_MODE_HDMI_EN, HDMI_MODE_MASK);
+
+	if (dvi_mode)
+		val = HDMI_VID_PREAMBLE_DIS | HDMI_GUARD_BAND_DIS;
+	else
+		val = HDMI_VID_PREAMBLE_EN | HDMI_GUARD_BAND_EN;
+
+	hdmi_write(HDMI_CON_2, val);
+}
+
+static inline void hdmi_enable(const struct hdmi_conf *conf, bool on)
+{
+	const struct hdmi_preset *preset = conf->preset;
+	const struct hdmi_res_mode *mode = &preset->mode;
+
+	int h_as = mode->h_as;
+	int h_sw = mode->h_sw;
+	int h_bp = mode->h_bp;
+	int v_as = mode->v_as;
+	int v_sw = mode->v_sw;
+	int v_bp = mode->v_bp;
+	int h_s_offs = 0;
+
+	int v_sync_s = v_sw + v_bp + v_as - 1;
+	int h_active_s = h_sw + h_bp + h_s_offs;
+	int h_active_e = h_as + h_sw + h_bp + h_s_offs;
+	int v_sync_hs_se0 = h_sw + h_bp + 1 + h_s_offs;
+	int v_sync_hs_se1 = v_sync_hs_se0 + 1;
+
+	pr_debug("%s : %s %s\n",
+		__func__, mode->name, on ? "on" : "off");
+
+	if (!on) {
+		hdmi_write(HDMI_CON_0, hdmi_read(HDMI_CON_0) & ~0x01);
+		return;
+	}
+
+	hdmi_write(HDMI_CON_0, hdmi_read(HDMI_CON_0) | 0x01);
+	msleep(20);
+
+	nx_disp_top_hdmi_set_vsync_start(v_sync_s);
+	nx_disp_top_hdmi_set_hactive_start(h_active_s);
+	nx_disp_top_hdmi_set_hactive_end(h_active_e);
+	nx_disp_top_hdmi_set_vsync_hsstart_end(v_sync_hs_se0, v_sync_hs_se1);
+}
+
+static int mode_get_fixup_refresh(const struct drm_display_mode *mode)
+{
+	int vrefresh = mode->vrefresh;
+	unsigned tot;
+
+	if( vrefresh == 0 ) {
+		if( mode->htotal == 0 || mode->vtotal == 0 )
+			return 0;
+		tot = mode->htotal * mode->vtotal;
+		vrefresh = (((mode->flags & DRM_MODE_FLAG_INTERLACE) ? 2000 : 1000) * mode->clock + tot / 2) / tot;
+	}
+	return vrefresh;
+}
+
+static int hdmi_find_mode(const struct drm_display_mode *dmode)
+{
+	const struct hdmi_conf *conf;
+	int size = num_hdmi_presets;
+	int i, cand = -EINVAL;
+
+	pr_debug("[%s] Search hac=%4d, vac=%4d, %2d fps, [array:%d]\n",
+		 __func__, dmode->hdisplay, dmode->vdisplay, dmode->vrefresh, size);
+
+	conf = hdmi_conf;
+
+	for (i = 0; size > i; i++) {
+		const struct hdmi_preset *preset = conf[i].preset;
+		const struct hdmi_res_mode *mode = &preset->mode;
+
+		/* Note: different CEA video modes may have equal resolution and pixel clock
+		 * but different refresh values
+		 * Monitors may also support many modes differing only by pixel clock.
+		 */
+		if (mode->h_as != dmode->hdisplay || mode->v_as != dmode->vdisplay ||
+				mode->pixelclock != dmode->clock * 1000 ||
+				mode->refresh != mode_get_fixup_refresh(dmode) ||
+				!(mode->flags & RES_FIELD_INTERLACED) != !(dmode->flags & DRM_MODE_FLAG_INTERLACE))
+			continue;
+
+		pr_debug("[%s] Ok Find %2d %s ha=%4d, va=%4d, %2d fps, %dhz\n",
+			 __func__, i, mode->name, mode->h_as, mode->v_as,
+			 mode->refresh, mode->pixelclock);
+		cand = i;
+		/* don't require to match aspect ratio,
+		 * but return one with exact match when exists */
+		if( dmode->picture_aspect_ratio == HDMI_PICTURE_ASPECT_NONE ||
+				preset->aspect_ratio == HDMI_PICTURE_ASPECT_NONE ||
+				dmode->picture_aspect_ratio == preset->aspect_ratio )
+			break;
+	}
+	return cand;
+}
+
+static void hdmi_ops_base(struct dp_control_dev *dpc,
+				void __iomem **base, int num)
+{
+	u32 hdp_mask = (1 << 6) | (1 << 3) | (1 << 2);
+
+	hdmi_set_base(base[0]);
+
+	/* HPD interrupt control: INTC_CON */
+	hdmi_write(HDMI_INTC_CON_0, hdp_mask);
+}
+
+int hdmi_ops_resume(struct dp_control_dev *dpc)
+{
+
+	u32 hdp_mask = (1 << 6) | (1 << 3) | (1 << 2);
+
+	pr_debug("%s\n", __func__);
+
+	/* HPD interrupt control: INTC_CON */
+	hdmi_write(HDMI_INTC_CON_0, hdp_mask);
+
+	return 0;
+}
+
+int nx_dp_hdmi_suspend(struct nx_drm_device *display)
+{
+	pr_debug("%s\n", __func__);
+
+	return 0;
+}
+
+bool nx_dp_hdmi_is_connected(void)
+{
+	int state = hdmi_hpd_status();
+
+	pr_debug("%s: %s\n", __func__, state ? "connected" : "disconnected");
+
+	return state ? true : false;
+}
+
+u32 nx_dp_hdmi_hpd_event(int irq)
+{
+	u32 flags, event = 0;
+
+	flags = hdmi_read(HDMI_INTC_FLAG_0);
+
+	pr_debug("%s: flags 0x%x\n", __func__, flags);
+
+	if (flags & HDMI_INTC_FLAG_HPD_UNPLUG) {
+		hdmi_write_mask(HDMI_INTC_FLAG_0, ~0,
+				HDMI_INTC_FLAG_HPD_UNPLUG);
+		event |= HDMI_EVENT_UNPLUG;
+		pr_debug("%s: UNPLUG\n", __func__);
+	}
+
+	if (flags & HDMI_INTC_FLAG_HPD_PLUG) {
+		hdmi_write_mask(HDMI_INTC_FLAG_0, ~0, HDMI_INTC_FLAG_HPD_PLUG);
+		event |= HDMI_EVENT_PLUG;
+		pr_debug("%s: PLUG\n", __func__);
+	}
+
+	if (flags & HDMI_INTC_FLAG_HDCP) {
+		event |= HDMI_EVENT_HDCP;
+		pr_debug("%s: hdcp not implenent !\n", __func__);
+	}
+
+	return event;
+}
+
+bool nx_dp_hdmi_mode_valid(const struct drm_display_mode *mode)
+{
+	return hdmi_find_mode(mode) >= 0;
+}
+
+static void hdmi_mode_to_display_mode(const struct hdmi_res_mode *hm,
+			struct drm_display_mode *dmode)
+{
+	dmode->hdisplay = hm->h_as;
+	dmode->hsync_start = dmode->hdisplay + hm->h_fp;
+	dmode->hsync_end = dmode->hsync_start + hm->h_sw;
+	dmode->htotal = dmode->hsync_end + hm->h_bp;
+
+	dmode->vdisplay = hm->v_as;
+	dmode->vsync_start = dmode->vdisplay + hm->v_fp;
+	dmode->vsync_end = dmode->vsync_start + hm->v_sw;
+	dmode->vtotal = dmode->vsync_end + hm->v_bp;
+
+}
+
+int nx_dp_hdmi_mode_set(struct nx_drm_device *display,
+			struct drm_display_mode *mode,
+			bool dvi_mode, int q_range)
+{
+	struct videomode vm;
+	struct dp_hdmi_dev *out;
+	const struct hdmi_conf *conf;
+	const struct hdmi_preset *preset;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	int err;
+
+	BUG_ON(!dpc);
+
+	drm_display_mode_to_videomode(mode, &vm);
+
+	pr_debug("%s %s\n",
+		 __func__, dvi_mode ? "dvi monitor" : "hdmi monitor");
+
+	err = hdmi_find_mode(mode);
+	if (0 > err) {
+		pr_err("%s: not found vm mode !\n", __func__);
+		return -ENODEV;
+	}
+
+	conf = &hdmi_conf[err];
+	preset = conf->preset;
+	DRM_INFO("set %s mode to %s\n",
+			dvi_mode ? "dvi" : "hdmi", preset->mode.name);
+	out = dpc->dp_output;
+	/* video quantization range is configuable
+	 * but fixed to limited range at artik710
+	 */
+	if (q_range == 0)
+		out->color_range = AVI_LIMITED_RANGE;
+	else /* (q_range == 1) */
+		out->color_range = AVI_FULL_RANGE;
+
+	out->hdmiconf = conf;
+
+	/*
+	 * set display control config
+	 */
+	hdmi_dp_set(dpc, &vm);
+
+	/* set display mode values */
+	hdmi_mode_to_display_mode(&preset->mode, mode);
+
+	pr_debug("%s %s done\n", __func__, preset->mode.name);
+	return 0;
+}
+
+int nx_dp_hdmi_mode_commit(struct nx_drm_device *display, int pipe)
+{
+	struct dp_hdmi_dev *out;
+	const struct hdmi_conf *conf;
+	const struct hdmi_preset *preset;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct nx_drm_res *res = &display->res;
+	u32 input = 0;
+
+	pr_debug("%s pipe.%d\n", __func__, pipe);
+
+	out = dpc->dp_output;
+	conf = out->hdmiconf;
+
+	if (!conf)
+		return -EINVAL;
+
+	preset = conf->preset;
+	pr_debug("%s %s\n", __func__, preset->mode.name);
+
+	/* HDMI setup */
+	hdmi_reset(res->dev_resets, res->num_dev_resets);
+
+	hdmi_phy_set(conf, HDMI_PHY_TABLE_SIZE);
+
+	if (false == hdmi_wait_phy_ready())
+		return -EIO;
+
+	switch (pipe) {
+	case 0:
+		input = primary_mlc;
+		break;
+	case 1:
+		input = secondary_mlc;
+		break;
+	case 3:
+		input = resolution_conv;
+		break;
+	default:
+		pr_err("%s: not support input mux %d\n", __func__, input);
+		return -EINVAL;
+	}
+
+	nx_disp_top_set_hdmimux(1, input);
+
+	hdmi_clock_on();
+	hdmi_standby();
+
+	hdmi_conf_set(conf);
+	hdmi_infoframe_set(conf, out->color_range);
+
+	hdmi_audio_init(conf);
+	hdmi_audio_enable(true);
+	hdmi_dvi_mode_set(preset->dvi_mode);
+
+	pr_debug("%s done\n", __func__);
+
+	return 0;
+}
+
+void nx_dp_hdmi_power(struct nx_drm_device *display, bool on)
+{
+	struct dp_hdmi_dev *out;
+	const struct hdmi_conf *conf;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	bool dvi_mode;
+
+	pr_debug("%s %s\n", __func__, on ? "on" : "off");
+
+	out = dpc->dp_output;
+	conf = out->hdmiconf;
+
+	if (!conf || !conf->preset)
+		return;
+
+	dvi_mode = conf->preset->dvi_mode;
+
+	if (on)
+		hdmi_enable(conf, true);
+	else
+		hdmi_enable(conf, false);
+
+	if (on && dvi_mode)
+		hdmi_write(HDMI_GCP_CON, HDMI_GCP_CON_NO_TRAN);
+}
+
+static struct dp_control_ops hdmi_dp_ops = {
+	.set_base = hdmi_ops_base,
+	.resume = hdmi_ops_resume,
+};
+
+int nx_dp_device_hdmi_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc)
+{
+	struct dp_hdmi_dev *out;
+
+	out = kzalloc(sizeof(*out), GFP_KERNEL);
+	if (!out)
+		return -ENOMEM;
+
+	dpc->panel_type = dp_panel_type_hdmi;
+	dpc->dp_output = out;
+	dpc->ops = &hdmi_dp_ops;
+
+	return 0;
+}
+
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.h b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_hdmi.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_DP_HDMI_H_
+#define _S5PXX18_DP_HDMI_H_
+
+#include <drm/drmP.h>
+#include <video/videomode.h>
+
+#include "s5pxx18_drm_dp.h"
+
+enum {
+	RES_FIELD_INTERLACED	= 0x1,
+	RES_FIELD_NVSYNC		= 0x2,
+	RES_FIELD_NHSYNC		= 0x4
+};
+
+struct hdmi_res_mode {
+	int pixelclock;
+	int h_as, h_sw, h_bp, h_fp;
+	int v_as, v_sw, v_bp, v_fp;
+	u16 refresh;
+	unsigned long flags;
+	char *name;
+};
+
+enum color_range {
+	AVI_FULL_RANGE = 0,
+	AVI_LIMITED_RANGE
+};
+
+struct hdmi_preset {
+	struct hdmi_res_mode mode;
+	enum hdmi_picture_aspect aspect_ratio;
+	bool dvi_mode;
+	u8 vic;
+};
+
+enum hdmi_vformat {
+	HDMI_VIDEO_FORMAT_2D = 0x0,
+	HDMI_VIDEO_FORMAT_3D = 0x2
+};
+
+enum hdmi_3d_type {
+	HDMI_3D_TYPE_FP = 0x0, /** Frame Packing */
+	HDMI_3D_TYPE_TB = 0x6, /** Top-and-Bottom */
+	HDMI_3D_TYPE_SB_HALF = 0x8 /** Side-by-Side Half */
+};
+
+struct hdmi_format {
+	enum hdmi_vformat vformat;
+	enum hdmi_3d_type type_3d;
+};
+
+struct hdmi_conf {
+	const struct hdmi_preset *preset;
+	const struct hdmi_format *format;
+	const u8 *phy_data;
+};
+
+/* VENDOR header */
+#define HDMI_VSI_VERSION		0x01
+#define HDMI_VSI_LENGTH			0x05
+
+/* AVI header */
+#define HDMI_AVI_VERSION		0x02
+#define HDMI_AVI_LENGTH			0x0d
+#define AVI_UNDERSCAN			(2 << 0)
+#define AVI_ACTIVE_FORMAT_VALID	(1 << 4)
+#define AVI_SAME_AS_PIC_ASPECT_RATIO 0x8
+#define AVI_ITU709				(2 << 6)
+#define AVI_LIMITED_RANGE		(1 << 2)
+#define AVI_FULL_RANGE			(2 << 2)
+
+/* AUI header info */
+#define HDMI_AUI_VERSION		0x01
+#define HDMI_AUI_LENGTH			0x0a
+
+enum HDMI_3D_EXT_DATA {
+	/* refer to Table H-3 3D_Ext_Data - Additional video format
+	 * information for Side-by-side(half) 3D structure */
+
+	/** Horizontal sub-sampleing */
+	HDMI_H_SUB_SAMPLE = 0x1
+};
+
+enum HDMI_OUTPUT_FMT {
+	HDMI_OUTPUT_RGB888 = 0x0,
+	HDMI_OUTPUT_YUV444 = 0x2
+};
+
+enum HDMI_AUDIO_CODEC {
+	HDMI_AUDIO_PCM,
+	HDMI_AUDIO_AC3,
+	HDMI_AUDIO_MP3
+};
+
+/* HPD events */
+#define	HDMI_EVENT_PLUG		(1<<0)
+#define	HDMI_EVENT_UNPLUG	(1<<1)
+#define	HDMI_EVENT_HDCP		(1<<2)
+
+extern const struct hdmi_conf hdmi_conf[];
+extern const int num_hdmi_presets;
+
+int nx_dp_device_hdmi_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc);
+
+u32  nx_dp_hdmi_hpd_event(int irq);
+bool nx_dp_hdmi_is_connected(void);
+bool nx_dp_hdmi_mode_valid(const struct drm_display_mode*);
+int nx_dp_hdmi_mode_set(struct nx_drm_device *display,
+			struct drm_display_mode *mode,
+			bool dvi_mode, int q_range);
+int  nx_dp_hdmi_mode_commit(struct nx_drm_device *display, int crtc);
+void nx_dp_hdmi_power(struct nx_drm_device *display, bool on);
+int nx_dp_hdmi_resume(struct nx_drm_device *display);
+int nx_dp_hdmi_suspend(struct nx_drm_device *display);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_lvds.c b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_lvds.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_lvds.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_lvds.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,273 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+
+#include "s5pxx18_dp_dev.h"
+
+#define	DEF_VOLTAGE_LEVEL	(0x20)
+
+static void lvds_phy_reset(struct reset_control *rsc[], int num)
+{
+	int count = num;
+	int i;
+
+	pr_debug("%s: resets %d\n", __func__, num);
+
+	for (i = 0; count > i; i++)
+		reset_control_assert(rsc[i]);
+
+	mdelay(1);
+
+	for (i = 0; count > i; i++)
+		reset_control_deassert(rsc[i]);
+}
+
+static void nx_soc_dp_lvds_set_base(struct dp_control_dev *dpc,
+			void __iomem **base, int num)
+{
+	BUG_ON(!base);
+	pr_debug("%s: dev lvds\n", __func__);
+
+	nx_lvds_set_base_address(0, base[0]);
+}
+
+static void nx_soc_dp_lvds_mode_set(struct dp_control_dev *dpc)
+{
+	unsigned int val;
+	int clkid = dp_clock_lvds;
+	enum dp_lvds_format format = dp_lvds_format_jeida;
+	struct dp_lvds_dev *dev = dpc->dp_output;
+	struct dp_ctrl_info *ctrl = &dpc->ctrl;
+	struct reset_control **rsc = dev->reset_control;
+	u32 voltage = DEF_VOLTAGE_LEVEL;
+
+	/*
+	 *-------- predefined type.
+	 * only change iTA to iTE in VESA mode
+	 * wire [34:0] loc_VideoIn =
+	 * {4'hf, 4'h0, i_VDEN, i_VSYNC, i_HSYNC, i_VD[23:0] };
+	 */
+	u32 VSYNC = 25;
+	u32 HSYNC = 24;
+	u32 VDEN  = 26; /* bit position */
+	u32 ONE   = 34;
+	u32 ZERO  = 27;
+
+	/*====================================================
+	 * current not use location mode
+	 ===================================================*/
+	u32 LOC_A[7] = {ONE,ONE,ONE,ONE,ONE,ONE,ONE};
+	u32 LOC_B[7] = {ONE,ONE,ONE,ONE,ONE,ONE,ONE};
+	u32 LOC_C[7] = {VDEN,VSYNC,HSYNC,ONE, HSYNC, VSYNC, VDEN};
+	u32 LOC_D[7] = {ZERO,ZERO,ZERO,ZERO,ZERO,ZERO,ZERO};
+	u32 LOC_E[7] = {ZERO,ZERO,ZERO,ZERO,ZERO,ZERO,ZERO};
+
+	if (dev) {
+		format = dev->lvds_format;
+		voltage = dev->voltage_level;
+	}
+
+	pr_debug("%s: format: %d\n", __func__, format);
+
+	/*
+	 * select TOP MUX
+	 */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, 0);
+	nx_disp_top_clkgen_set_clock_source(clkid, 0, ctrl->clk_src_lv0);
+	nx_disp_top_clkgen_set_clock_divisor(clkid, 0, ctrl->clk_div_lv0);
+	nx_disp_top_clkgen_set_clock_source(clkid, 1, ctrl->clk_src_lv1);
+	nx_disp_top_clkgen_set_clock_divisor(clkid, 1, ctrl->clk_div_lv1);
+
+	/*
+	 * LVDS Control Pin Setting
+	 */
+	val =	(0<<30)  	/* CPU_I_VBLK_FLAG_SEL */
+			|	(0<<29)  /* CPU_I_BVLK_FLAG */
+			|	(1<<28)  /* SKINI_BST  */
+			|	(1<<27)  /* DLYS_BST  */
+			|	(0<<26)  /* I_AUTO_SEL */
+			|	(format<<19)  /* JEiDA data packing */
+			|	(0x1B<<13)  /* I_LOCK_PPM_SET, PPM setting for PLL lock */
+			|	(0x638<<1)  /* I_DESKEW_CNT_SEL, period of de-skew region */
+			;
+	nx_lvds_set_lvdsctrl0(0, val);
+
+	val =	(0<<28) /* I_ATE_MODE, funtion mode */
+			|	(0<<27) /* I_TEST_CON_MODE, DA (test ctrl mode) */
+			|	(0<<24) /* I_TX4010X_DUMMY */
+			|	(0<<15) /* SKCCK 0 */
+			|	(0<<12) /* SKC4 (TX output skew control pin at ODD ch4) */
+			|	(0<<9)  /* SKC3 (TX output skew control pin at ODD ch3) */
+			|	(0<<6)  /* SKC2 (TX output skew control pin at ODD ch2) */
+			|	(0<<3)  /* SKC1 (TX output skew control pin at ODD ch1) */
+			|	(0<<0)  /* SKC0 (TX output skew control pin at ODD ch0) */
+				;
+	nx_lvds_set_lvdsctrl1(0, val);
+
+	val =	(0<<15) /* CK_POL_SEL, Input clock, bypass */
+			|	(0<<14) /* VSEL, VCO Freq. range. 0: Low(40MHz~90MHz), 1:High(90MHz~160MHz) */
+			|	(0x1<<12) /* S (Post-scaler) */
+			|	(0xA<<6) /* M (Main divider) */
+			|	(0xA<<0) /* P (Pre-divider) */
+			;
+	nx_lvds_set_lvdsctrl2(0, val);
+
+	val =	(0x03<<6) /* SK_BIAS, Bias current ctrl pin */
+			|	(0<<5) /* SKEWINI, skew selection pin, 0 : bypass, 1 : skew enable */
+			|	(0<<4) /* SKEW_EN_H, skew block power down, 0 : power down, 1 : operating */
+			|	(1<<3) /* CNTB_TDLY, delay control pin */
+			|	(0<<2) /* SEL_DATABF, input clock 1/2 division control pin */
+			|	(0x3<<0) /* SKEW_REG_CUR, regulator bias current selection in in SKEW block */
+			;
+	nx_lvds_set_lvdsctrl3(0, val);
+
+	val =	(0<<28) /* FLT_CNT, filter control pin for PLL */
+			|	(0<<27) /* VOD_ONLY_CNT, the pre-emphasis's pre-diriver control pin (VOD only) */
+			|	(0<<26) /* CNNCT_MODE_SEL, connectivity mode selection, 0:TX operating, 1:con check */
+			|	(0<<24) /* CNNCT_CNT, connectivity ctrl pin, 0:tx operating, 1: con check */
+			|	(0<<23) /* VOD_HIGH_S, VOD control pin, 1 : Vod only */
+			|	(0<<22) /* SRC_TRH, source termination resistor select pin */
+			|       (voltage<<14)
+			|	(0x01<<6) /* CNT_PEN_H, TX driver pre-emphasis level control */
+			|	(0x4<<3) /* FC_CODE, vos control pin */
+			|	(0<<2) /* OUTCON, TX Driver state selectioin pin, 0:Hi-z, 1:Low */
+			|	(0<<1) /* LOCK_CNT, Lock signal selection pin, enable */
+			|	(0<<0) /* AUTO_DSK_SEL, auto deskew selection pin, normal */
+			;
+	nx_lvds_set_lvdsctrl4(0, val);
+
+	val =	(0<<24)	/* I_BIST_RESETB */
+			|	(0<<23)	/* I_BIST_EN */
+			|	(0<<21)	/* I_BIST_PAT_SEL */
+			|	(0<<14) /* I_BIST_USER_PATTERN */
+			|	(0<<13)	/* I_BIST_FORCE_ERROR */
+			|	(0<<7)	/* I_BIST_SKEW_CTRL */
+			|	(0<<5)	/* I_BIST_CLK_INV */
+			|	(0<<3)	/* I_BIST_DATA_INV */
+			|	(0<<0)	/* I_BIST_CH_SEL */
+			;
+	nx_lvds_set_lvdstmode0(0, val);
+
+	/* user do not need to modify this codes. */
+	val = (LOC_A[4]  <<24) | (LOC_A[3]  <<18) | (LOC_A[2]  <<12) | (LOC_A[1]  <<6) | (LOC_A[0]  <<0);
+	nx_lvds_set_lvdsloc0(0, val);
+
+	val = (LOC_B[2]  <<24) | (LOC_B[1]  <<18) | (LOC_B[0]  <<12) | (LOC_A[6]  <<6) | (LOC_A[5]  <<0);
+	nx_lvds_set_lvdsloc1(0, val);
+
+	val = (LOC_C[0]  <<24) | (LOC_B[6]  <<18) | (LOC_B[5]  <<12) | (LOC_B[4]  <<6) | (LOC_B[3]  <<0);
+	nx_lvds_set_lvdsloc2(0, val);
+
+	val = (LOC_C[5]  <<24) | (LOC_C[4]  <<18) | (LOC_C[3]  <<12) | (LOC_C[2]  <<6) | (LOC_C[1]  <<0);
+	nx_lvds_set_lvdsloc3(0, val);
+
+	val = (LOC_D[3]  <<24) | (LOC_D[2]  <<18) | (LOC_D[1]  <<12) | (LOC_D[0]  <<6) | (LOC_C[6]  <<0);
+	nx_lvds_set_lvdsloc4(0, val);
+
+	val = (LOC_E[1]  <<24) | (LOC_E[0]  <<18) | (LOC_D[6]  <<12) | (LOC_D[5]  <<6) | (LOC_D[4]  <<0);
+	nx_lvds_set_lvdsloc5(0, val);
+
+	val = (LOC_E[6]  <<24) | (LOC_E[5]  <<18) | (LOC_E[4]  <<12) | (LOC_E[3]  <<6) | (LOC_E[2]  <<0);
+	nx_lvds_set_lvdsloc6(0, val);
+
+	nx_lvds_set_lvdslocmask0(0, 0xffffffff);
+	nx_lvds_set_lvdslocmask1(0, 0xffffffff);
+
+	nx_lvds_set_lvdslocpol0(0, (0<<19) | (0<<18));
+
+	/*
+	 * LVDS PHY Reset, make sure last.
+	 */
+	lvds_phy_reset(rsc, dev->num_resets);
+}
+
+static int nx_soc_dp_lvds_set_unprepare(struct dp_control_dev *dpc)
+{
+	return 0;
+}
+
+static int nx_soc_dp_lvds_set_enable(struct dp_control_dev *dpc,
+			unsigned int flags)
+{
+	int clkid = dp_clock_lvds;
+	int module = dpc->module;
+
+	pr_debug("%s dev.%d\n", __func__, module);
+
+  	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, 1);
+	nx_disp_top_set_lvdsmux(1, module);
+
+	return 0;
+}
+
+static int nx_soc_dp_lvds_set_disable(struct dp_control_dev *dpc)
+{
+	int clkid = dp_clock_lvds;
+
+	pr_debug("%s\n", __func__);
+
+	/* SPDIF and MIPI */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, 0);
+
+	/* START: CLKGEN, MIPI is started in setup function */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, false);
+
+	return 0;
+}
+
+static struct dp_control_ops lvds_dp_ops = {
+	.set_base = nx_soc_dp_lvds_set_base,
+	.mode_set = nx_soc_dp_lvds_mode_set,
+	.unprepare = nx_soc_dp_lvds_set_unprepare,
+	.enable = nx_soc_dp_lvds_set_enable,
+	.disable = nx_soc_dp_lvds_set_disable,
+};
+
+int nx_dp_device_lvds_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc,
+			void *resets, int num_resets)
+{
+	struct dp_lvds_dev *out;
+	u32 format;
+	u32 voltage;
+
+	out = kzalloc(sizeof(*out), GFP_KERNEL);
+	if (!out)
+		return -ENOMEM;
+
+	out->voltage_level = DEF_VOLTAGE_LEVEL;
+
+	if (!of_property_read_u32(np, "format", &format))
+		out->lvds_format = format;
+
+	if (!of_property_read_u32(np, "voltage_level", &voltage))
+		out->voltage_level = voltage;
+
+	out->reset_control = (void *)resets;
+	out->num_resets = num_resets;
+	dpc->panel_type = dp_panel_type_lvds;
+	dpc->dp_output = out;
+	dpc->ops = &lvds_dp_ops;
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_mipi.c b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_mipi.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_mipi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_mipi.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,519 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/of.h>
+#include <linux/slab.h>
+#include <video/mipi_display.h>
+
+#include "s5pxx18_dp_dev.h"
+
+#define	PLLPMS_1000MHZ		0x33E8
+#define	BANDCTL_1000MHZ		0xF
+#define PLLPMS_960MHZ       0x2280
+#define BANDCTL_960MHZ      0xF
+#define	PLLPMS_900MHZ		0x2258
+#define	BANDCTL_900MHZ		0xE
+#define	PLLPMS_840MHZ		0x2230
+#define	BANDCTL_840MHZ		0xD
+#define	PLLPMS_750MHZ		0x43E8
+#define	BANDCTL_750MHZ		0xC
+#define	PLLPMS_660MHZ		0x21B8
+#define	BANDCTL_660MHZ		0xB
+#define	PLLPMS_600MHZ		0x2190
+#define	BANDCTL_600MHZ		0xA
+#define	PLLPMS_540MHZ		0x2168
+#define	BANDCTL_540MHZ		0x9
+#define	PLLPMS_512MHZ		0x03200
+#define	BANDCTL_512MHZ		0x9
+#define	PLLPMS_480MHZ		0x2281
+#define	BANDCTL_480MHZ		0x8
+#define	PLLPMS_420MHZ		0x2231
+#define	BANDCTL_420MHZ		0x7
+#define	PLLPMS_402MHZ		0x2219
+#define	BANDCTL_402MHZ		0x7
+#define	PLLPMS_330MHZ		0x21B9
+#define	BANDCTL_330MHZ		0x6
+#define	PLLPMS_300MHZ		0x2191
+#define	BANDCTL_300MHZ		0x5
+#define	PLLPMS_210MHZ		0x2232
+#define	BANDCTL_210MHZ		0x4
+#define	PLLPMS_180MHZ		0x21E2
+#define	BANDCTL_180MHZ		0x3
+#define	PLLPMS_150MHZ		0x2192
+#define	BANDCTL_150MHZ		0x2
+#define	PLLPMS_100MHZ		0x3323
+#define	BANDCTL_100MHZ		0x1
+#define	PLLPMS_80MHZ		0x3283
+#define	BANDCTL_80MHZ		0x0
+
+#define	MIPI_INDEX			0
+#define	MIPI_EXC_PRE_VALUE	1
+
+static int dp_mipi_phy_pll(int bitrate, unsigned int *pllpms,
+			unsigned int *bandctl)
+{
+	unsigned int pms, ctl;
+
+	switch (bitrate) {
+	case 1000:
+		pms = PLLPMS_1000MHZ;
+		ctl = BANDCTL_1000MHZ;
+		break;
+	case 960:
+		pms = PLLPMS_960MHZ;
+		ctl = BANDCTL_960MHZ;
+		break;
+	case 900:
+		pms = PLLPMS_900MHZ;
+		ctl = BANDCTL_900MHZ;
+		break;
+	case 840:
+		pms = PLLPMS_840MHZ;
+		ctl = BANDCTL_840MHZ;
+		break;
+	case 750:
+		pms = PLLPMS_750MHZ;
+		ctl = BANDCTL_750MHZ;
+		break;
+	case 660:
+		pms = PLLPMS_660MHZ;
+		ctl = BANDCTL_660MHZ;
+		break;
+	case 600:
+		pms = PLLPMS_600MHZ;
+		ctl = BANDCTL_600MHZ;
+		break;
+	case 540:
+		pms = PLLPMS_540MHZ;
+		ctl = BANDCTL_540MHZ;
+		break;
+	case 512:
+		pms = PLLPMS_512MHZ;
+		ctl = BANDCTL_512MHZ;
+		break;
+	case 480:
+		pms = PLLPMS_480MHZ;
+		ctl = BANDCTL_480MHZ;
+		break;
+	case 420:
+		pms = PLLPMS_420MHZ;
+		ctl = BANDCTL_420MHZ;
+		break;
+	case 402:
+		pms = PLLPMS_402MHZ;
+		ctl = BANDCTL_402MHZ;
+		break;
+	case 330:
+		pms = PLLPMS_330MHZ;
+		ctl = BANDCTL_330MHZ;
+		break;
+	case 300:
+		pms = PLLPMS_300MHZ;
+		ctl = BANDCTL_300MHZ;
+		break;
+	case 210:
+		pms = PLLPMS_210MHZ;
+		ctl = BANDCTL_210MHZ;
+		break;
+	case 180:
+		pms = PLLPMS_180MHZ;
+		ctl = BANDCTL_180MHZ;
+		break;
+	case 150:
+		pms = PLLPMS_150MHZ;
+		ctl = BANDCTL_150MHZ;
+		break;
+	case 100:
+		pms = PLLPMS_100MHZ;
+		ctl = BANDCTL_100MHZ;
+		break;
+	case 80:
+		pms = PLLPMS_80MHZ;
+		ctl = BANDCTL_80MHZ;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	*pllpms = pms;
+	*bandctl = ctl;
+
+	return 0;
+}
+
+static void nx_soc_dp_mipi_set_base(struct dp_control_dev *dpc,
+			void __iomem **base, int num)
+{
+	BUG_ON(!base);
+	pr_debug("%s: dev mipi\n", __func__);
+
+	nx_mipi_set_base_address(0, base[0]);
+}
+
+static int nx_soc_dp_mipi_set_prepare(struct dp_control_dev *dpc,
+			unsigned int flags)
+{
+	struct dp_mipi_dev *dev = dpc->dp_output;
+	int index = MIPI_INDEX;
+	u32 esc_pre_value = MIPI_EXC_PRE_VALUE;
+	int ret = 0;
+
+	ret = dp_mipi_phy_pll(dev->hs_bitrate,
+			&dev->hs_pllpms, &dev->hs_bandctl);
+	if (0 > ret)
+		return ret;
+
+	ret = dp_mipi_phy_pll(dev->lp_bitrate,
+			&dev->lp_pllpms, &dev->lp_bandctl);
+	if (0 > ret)
+		return ret;
+
+	pr_debug("%s: mipi lp:%dmhz:0x%x:0x%x, hs:%dmhz:0x%x:0x%x\n",
+	      __func__, dev->lp_bitrate, dev->lp_pllpms, dev->lp_bandctl,
+	      dev->hs_bitrate, dev->hs_pllpms, dev->hs_bandctl);
+
+	if (flags) {
+		nx_mipi_dsi_set_pll(index, 1, 0xFFFFFFFF,
+				    dev->lp_pllpms, dev->lp_bandctl, 0, 0);
+		msleep(20);
+
+#ifdef CONFIG_ARCH_S5P4418
+		/*
+		 * disable the escape clock generating prescaler
+		 * before soft reset.
+		 */
+		nx_mipi_dsi_set_clock(index, 0, 0, 1, 1, 1, 0, 0, 0, 0, 10);
+		mdelay(1);
+#endif
+		nx_mipi_dsi_software_reset(index);
+		nx_mipi_dsi_set_clock(index, 0, 0, 1, 1, 1, 0, 0, 0, 1,
+				      esc_pre_value);
+		nx_mipi_dsi_set_phy(index, 0, 1, 1, 0, 0, 0, 0, 0);
+
+		nx_mipi_dsi_set_escape_lp(index, nx_mipi_dsi_lpmode_lp,
+					  nx_mipi_dsi_lpmode_lp);
+		msleep(20);
+	}
+
+	return 0;
+}
+
+static int nx_soc_dp_mipi_set_enable(struct dp_control_dev *dpc,
+			unsigned int flags)
+{
+	struct dp_mipi_dev *dev = dpc->dp_output;
+	struct dp_sync_info *sync = &dpc->sync;
+	struct dp_ctrl_info *ctrl = &dpc->ctrl;
+	int clkid = dp_clock_mipi;
+	int index = MIPI_INDEX;
+	u32 esc_pre_value = MIPI_EXC_PRE_VALUE;
+	int module = dpc->module;
+	int HFP = sync->h_front_porch;
+	int HBP = sync->h_back_porch;
+	int HS = sync->h_sync_width;
+	int VFP = sync->v_front_porch;
+	int VBP = sync->v_back_porch;
+	int VS = sync->v_sync_width;
+	int width = sync->h_active_len;
+	int height = sync->v_active_len;
+
+	int en_prescaler = 1;
+
+	/*
+	 * disable the escape clock generating prescaler
+	 * before soft reset.
+	 */
+#ifdef CONFIG_ARCH_S5P4418
+	en_prescaler = 0;
+#endif
+
+	pr_debug("%s: flags=0x%x\n", __func__, flags);
+
+	if (flags)
+		nx_mipi_dsi_set_escape_lp(index, nx_mipi_dsi_lpmode_hs,
+						  nx_mipi_dsi_lpmode_hs);
+
+	nx_mipi_dsi_set_pll(index, 1, 0xFFFFFFFF,
+			    dev->hs_pllpms, dev->hs_bandctl, 0, 0);
+	mdelay(1);
+
+	nx_mipi_dsi_set_clock(index, 0, 0, 1, 1, 1, 0, 0, 0, en_prescaler, 10);
+
+	mdelay(1);
+
+	nx_mipi_dsi_software_reset(index);
+	nx_mipi_dsi_set_clock(index, 1, 0, 1, 1, 1, 1, 1, 1, 1, esc_pre_value);
+	nx_mipi_dsi_set_phy(index, 3, 1, 1, 1, 1, 1, 0, 0);
+	nx_mipi_dsi_set_config_video_mode(index, 1, 0, 1,
+					  nx_mipi_dsi_syncmode_event, 1, 1, 1,
+					  1, 1, 0, nx_mipi_dsi_format_rgb888,
+					  HFP, HBP, HS, VFP, VBP, VS, 0);
+
+	nx_mipi_dsi_set_size(index, width, height);
+
+	/* set mux */
+	nx_disp_top_set_mipimux(1, module);
+
+	/*  0 is spdif, 1 is mipi vclk */
+	nx_disp_top_clkgen_set_clock_source(clkid, 1, ctrl->clk_src_lv0);
+	nx_disp_top_clkgen_set_clock_divisor(clkid, 1,
+					     ctrl->clk_div_lv1 *
+					     ctrl->clk_div_lv0);
+
+	/* SPDIF and MIPI */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, 1);
+
+	/* START: CLKGEN, MIPI is started in setup function */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, true);
+	nx_mipi_dsi_set_enable(0, true);
+
+	return 0;
+}
+
+static int nx_soc_dp_mipi_set_unprepare(struct dp_control_dev *dpc)
+{
+	int index = MIPI_INDEX;
+
+	pr_debug("%s\n", __func__);
+	nx_mipi_dsi_set_clock(index, 0, 0, 1, 1, 1, 0, 0, 0, 0, 10);
+
+	return 0;
+}
+
+static int nx_soc_dp_mipi_set_disable(struct dp_control_dev *dpc)
+{
+	int clkid = dp_clock_mipi;
+
+	pr_debug("%s\n", __func__);
+
+	/* SPDIF and MIPI */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, 0);
+
+	/* START: CLKGEN, MIPI is started in setup function */
+	nx_disp_top_clkgen_set_clock_divisor_enable(clkid, false);
+	nx_mipi_dsi_set_enable(0, false);
+
+	return 0;
+}
+
+int nx_soc_dp_mipi_ransfer_done(void)
+{
+	int module = 0, count = 100;
+	u32 value;
+
+	do {
+		mdelay(1);
+		value = nx_mipi_dsi_read_fifo_status(module);
+		if (((1<<22) & value))
+			break;
+	} while (count-- > 0);
+
+	if (0 > count)
+		return -EINVAL;
+
+	return 0;
+}
+
+int nx_soc_dp_mipi_tx_transfer(struct dp_mipi_xfer *xfer)
+{
+	const u8 *txb;
+	u16 size;
+	u32 data;
+	int module = 0;
+
+	if (xfer->tx_len > DSI_TX_FIFO_SIZE)
+		pr_warn("warn: tx %d size over fifo %d\n", (int)xfer->tx_len,
+			DSI_TX_FIFO_SIZE);
+
+	/*
+	 * write payload
+	 */
+	size = xfer->tx_len;
+	txb  = xfer->tx_buf;
+
+	while (size >= 4) {
+		data = (txb[3] << 24) | (txb[2] << 16) |
+			(txb[1] << 8) | (txb[0]);
+		nx_mipi_dsi_write_payload(module, data);
+		txb += 4, size -= 4;
+		data = 0;
+	}
+
+	switch (size) {
+	case 3:
+		data |= txb[2] << 16;
+	case 2:
+		data |= txb[1] << 8;
+	case 1:
+		data |= txb[0];
+		nx_mipi_dsi_write_payload(module, data);
+		break;
+	case 0:
+		break;	/* no payload */
+	}
+
+	/*
+	 * write paket hdr
+	 */
+	data = (xfer->data[1] << 16) |
+		   (xfer->data[0] <<  8) | xfer->id;
+
+	nx_mipi_dsi_write_pkheader(module, data);
+
+	return 0;
+}
+
+int nx_soc_dp_mipi_rx_transfer(struct dp_mipi_xfer *xfer)
+{
+	int module = 0;
+	u8 *rxb = xfer->rx_buf;
+	int rx_len = 0;
+	u16 size;
+	u32 data;
+	u32 count = 0;
+	int err = -EINVAL;
+
+	nx_mipi_clear_interrupt_pending(module, 50);
+
+	while (1) {
+		/* Completes receiving data. */
+		if (nx_mipi_get_interrupt_pending(module, 50))
+			break;
+
+		mdelay(1);
+
+		if (count > 500) {
+			pr_err("%s: DSI Error : recevice data\n", __func__);
+			err = -EINVAL;
+			goto clear_fifo;
+		} else {
+			count++;
+		}
+	}
+
+	data = nx_mipi_dsi_read_fifo(module);
+
+	switch (data & 0x3f) {
+	case MIPI_DSI_RX_GENERIC_SHORT_READ_RESPONSE_2BYTE:
+	case MIPI_DSI_RX_DCS_SHORT_READ_RESPONSE_2BYTE:
+		if (xfer->rx_len >= 2) {
+			rxb[1] = data >> 16;
+			rx_len++;
+		}
+
+		/* Fall through */
+	case MIPI_DSI_RX_GENERIC_SHORT_READ_RESPONSE_1BYTE:
+	case MIPI_DSI_RX_DCS_SHORT_READ_RESPONSE_1BYTE:
+		rxb[0] = data >> 8;
+		rx_len++;
+		xfer->rx_len = rx_len;
+		err = rx_len;
+		goto clear_fifo;
+
+	case MIPI_DSI_RX_ACKNOWLEDGE_AND_ERROR_REPORT:
+		pr_debug("DSI Error Report: 0x%04x\n",
+			(data >> 8) & 0xffff);
+		err = rx_len;
+		goto clear_fifo;
+	}
+
+	size = (data >> 8) & 0xffff;
+
+	if (size > xfer->rx_len)
+		size = xfer->rx_len;
+	else if (size < xfer->rx_len)
+		xfer->rx_len = size;
+
+	size = xfer->rx_len - rx_len;
+	rx_len += size;
+
+
+	/* Receive payload */
+	while (size >= 4) {
+		data = nx_mipi_dsi_read_fifo(module);
+		rxb[0] = (data >>  0) & 0xff;
+		rxb[1] = (data >>  8) & 0xff;
+		rxb[2] = (data >> 16) & 0xff;
+		rxb[3] = (data >> 24) & 0xff;
+		rxb += 4, size -= 4;
+	}
+
+	if (size) {
+		data = nx_mipi_dsi_read_fifo(module);
+		switch (size) {
+		case 3:
+			rxb[2] = (data >> 16) & 0xff;
+		case 2:
+			rxb[1] = (data >> 8) & 0xff;
+		case 1:
+			rxb[0] = data & 0xff;
+		}
+	}
+
+	if (rx_len == xfer->rx_len)
+		err = rx_len;
+
+clear_fifo:
+	size = DSI_RX_FIFO_SIZE / 4;
+	do {
+		data = nx_mipi_dsi_read_fifo(module);
+		if (data == DSI_RX_FIFO_EMPTY)
+			break;
+	} while (--size);
+
+	return err;
+}
+
+static struct dp_control_ops mipi_dp_ops = {
+	.set_base = nx_soc_dp_mipi_set_base,
+	.prepare = nx_soc_dp_mipi_set_prepare,
+	.unprepare = nx_soc_dp_mipi_set_unprepare,
+	.enable = nx_soc_dp_mipi_set_enable,
+	.disable = nx_soc_dp_mipi_set_disable,
+};
+
+#define parse_read_prop(n, s, v)	{ \
+	u32 _v;	\
+	if (!of_property_read_u32(n, s, &_v))	\
+		v = _v;	\
+	}
+
+int nx_dp_device_mipi_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc)
+{
+	struct dp_mipi_dev *out;
+	u32 lp_rate = 0, hs_rate = 0;
+
+	out = kzalloc(sizeof(*out), GFP_KERNEL);
+	if (!out)
+		return -ENOMEM;
+
+	parse_read_prop(np, "lp_bitrate", lp_rate);
+	parse_read_prop(np, "hs_bitrate", hs_rate);
+
+	out->lp_bitrate = lp_rate;
+	out->hs_bitrate = hs_rate;
+
+	dpc->panel_type = dp_panel_type_mipi;
+	dpc->dp_output = out;
+	dpc->ops = &mipi_dp_ops;
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_rgb.c b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_rgb.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_dp_rgb.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_dp_rgb.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+
+#include "s5pxx18_dp_dev.h"
+
+#define parse_read_prop(n, s, v)	{ \
+	u32 _v;	\
+	if (!of_property_read_u32(n, s, &_v))	\
+		v = _v;	\
+	}
+
+int nx_dp_device_rgb_register(struct device *dev,
+			struct device_node *np, struct dp_control_dev *dpc)
+{
+	struct dp_rgb_dev *out;
+	u32 mpu_lcd = 0;
+
+	out = kzalloc(sizeof(*out), GFP_KERNEL);
+	if (!out)
+		return -ENOMEM;
+
+	parse_read_prop(np, "panel-mpu", mpu_lcd);
+	out->mpu_lcd = mpu_lcd ? true : false;
+
+	dpc->panel_type = dp_panel_type_rgb;
+	dpc->dp_output = out;
+
+	return 0;
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.c b/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,1282 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <drm/drmP.h>
+#include <drm/drm_fb_helper.h>
+#include <uapi/drm/drm_fourcc.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/dma-buf.h>
+#include <linux/clk.h>
+#include <drm/drm_encoder.h>
+
+#include "../nx_drm_drv.h"
+#include "../nx_drm_crtc.h"
+#include "../nx_drm_plane.h"
+#include "../nx_drm_fb.h"
+#include "../nx_drm_gem.h"
+#include "../nx_drm_encoder.h"
+#include "../nx_drm_connector.h"
+
+#include "s5pxx18_drm_dp.h"
+#include "s5pxx18_dp_hdmi.h"
+
+#define	display_to_dpc(d)	(&d->ctrl.dpc)
+
+static const char * const panel_type_name[] = {
+	[dp_panel_type_none] = "unknown",
+	[dp_panel_type_rgb]  = "RGB",
+	[dp_panel_type_lvds] = "LVDS",
+	[dp_panel_type_mipi] = "MIPI",
+	[dp_panel_type_hdmi] = "HDMI",
+};
+
+enum dp_panel_type dp_panel_get_type(struct nx_drm_device *display)
+{
+	struct nx_drm_ctrl *ctrl = &display->ctrl;
+
+	return ctrl->dpc.panel_type;
+}
+
+const char *dp_panel_type_name(enum dp_panel_type panel)
+{
+	return panel_type_name[panel];
+}
+
+static int convert_dp_rgb_format(uint32_t pixel_format,
+			uint32_t bpp, uint32_t depth, uint32_t *format)
+{
+	uint32_t fmt;
+    struct drm_format_name_buf fmt_name_buf;
+
+	switch (pixel_format) {
+	/* 16 bpp RGB */
+	case DRM_FORMAT_XRGB1555:
+		fmt = nx_mlc_rgbfmt_x1r5g5b5;
+		break;
+	case DRM_FORMAT_XBGR1555:
+		fmt = nx_mlc_rgbfmt_x1b5g5r5;
+		break;
+	case DRM_FORMAT_RGB565:
+		fmt = nx_mlc_rgbfmt_r5g6b5;
+		break;
+	case DRM_FORMAT_BGR565:
+		fmt = nx_mlc_rgbfmt_b5g6r5;
+		break;
+	/* 24 bpp RGB */
+	case DRM_FORMAT_RGB888:
+		fmt = nx_mlc_rgbfmt_r8g8b8;
+		break;
+	case DRM_FORMAT_BGR888:
+		fmt = nx_mlc_rgbfmt_b8g8r8;
+		break;
+	/* 32 bpp RGB */
+	case DRM_FORMAT_XRGB8888:
+		fmt = nx_mlc_rgbfmt_x8r8g8b8;
+		break;
+	case DRM_FORMAT_XBGR8888:
+		fmt = nx_mlc_rgbfmt_x8b8g8r8;
+		break;
+	case DRM_FORMAT_ARGB8888:
+		fmt = nx_mlc_rgbfmt_a8r8g8b8;
+		break;
+	case DRM_FORMAT_ABGR8888:
+		fmt = nx_mlc_rgbfmt_a8b8g8r8;
+		break;
+	default:
+		DRM_ERROR("fail : not support %s pixel format\n",
+			drm_get_format_name(pixel_format, &fmt_name_buf));
+		return -EINVAL;
+	}
+
+	*format = fmt;
+	return 0;
+}
+
+static uint32_t convert_dp_vid_format(uint32_t fourcc,
+			uint32_t *format, bool *isVUloc)
+{
+	uint32_t fmt;
+    struct drm_format_name_buf fmt_name_buf;
+	bool isVU = false;
+
+	switch (fourcc) {
+	case DRM_FORMAT_YUV420:
+	case DRM_FORMAT_YVU420:
+		fmt = nx_mlc_yuvfmt_420 | 0x1<<31;
+		isVU = fourcc == DRM_FORMAT_YVU420;
+		break;
+	case DRM_FORMAT_YUV422:
+	case DRM_FORMAT_YVU422:
+		fmt = nx_mlc_yuvfmt_422 | 0x1<<31;
+		isVU = fourcc == DRM_FORMAT_YVU422;
+		break;
+	case DRM_FORMAT_YUV444:
+	case DRM_FORMAT_YVU444:
+		fmt = nx_mlc_yuvfmt_444 | 0x1<<31;
+		isVU = fourcc == DRM_FORMAT_YVU444;
+		break;
+	case DRM_FORMAT_YUYV:
+		fmt = nx_mlc_yuvfmt_yuyv | 0x1<<31;
+		break;
+	default:
+		DRM_ERROR("fail : fail, not support fourcc %s\n",
+		       drm_get_format_name(fourcc, &fmt_name_buf));
+		return -EINVAL;
+	}
+
+	*format = fmt;
+	*isVUloc = isVU;
+	return 0;
+}
+
+static void dp_crtc_resume(struct drm_crtc *crtc)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct dp_plane_top *top = &nx_crtc->top;
+	int module = top->module;
+	void *from = top->regs;
+	void *to = nx_mlc_get_base_address(module);
+	int size = sizeof(top->regs);
+
+	DRM_DEBUG_KMS("crtc.%d restore %d bytes\n", module, size);
+
+	/* restore multiple layer */
+	memcpy(to, from, size);
+
+	nx_soc_dp_plane_top_prepare(top);
+}
+
+static void dp_crtc_suspend(struct drm_crtc *crtc)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct dp_plane_top *top = &nx_crtc->top;
+	int module = top->module;
+	void *from = nx_mlc_get_base_address(module);
+	void *to = top->regs;
+	int size = sizeof(top->regs);
+
+	DRM_DEBUG_KMS("crtc.%d store %d bytes\n", module, size);
+
+	/* store multiple layer */
+	memcpy(to, from, size);
+}
+
+static void dp_encoder_resume(struct drm_encoder *encoder)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	int module = dpc->module;
+	void *from = dpc->regs;
+	void *to = nx_dpc_get_base_address(module);
+	int size = sizeof(dpc->regs);
+
+	DRM_DEBUG_KMS("dev.%d restore %d for %s\n",
+		module, size, dp_panel_type_name(dpc->panel_type));
+
+	/* restore display contrllor */
+	memcpy(to, from, size);
+
+	nx_soc_dp_cont_dpc_clk_on(dpc);
+}
+
+static void dp_encoder_suspend(struct drm_encoder *encoder)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	int module = dpc->module;
+	void *from = nx_dpc_get_base_address(module);
+	void *to = dpc->regs;
+	int size = sizeof(dpc->regs);
+
+	DRM_DEBUG_KMS("dev.%d store %d for %s\n",
+		module, size, dp_panel_type_name(dpc->panel_type));
+
+	/* store display contrllor */
+	memcpy(to, from, size);
+}
+
+#define parse_read_prop(n, s, v)	{ \
+	u32 _v;	\
+	if (!of_property_read_u32(n, s, &_v))	\
+		v = _v;	\
+	}
+
+int nx_drm_dp_panel_res_parse(struct device *dev,
+			struct nx_drm_res *res, enum dp_panel_type panel_type)
+{
+	struct device_node *node = dev->of_node;
+	struct device_node *np;
+	const __be32 *list;
+	bool reset;
+	const char *strings[8];
+	u32 addr, length;
+	int size, i, err;
+
+	/*
+	 * set base resources
+	 */
+	res->base = of_iomap(node, 0);
+	if (!res->base) {
+		DRM_ERROR("fail : %s of_iomap\n", dev_name(dev));
+		return -EINVAL;
+	}
+
+	DRM_DEBUG_KMS("top base  : 0x%lx\n", (unsigned long)res->base);
+
+	err = of_property_read_string(node, "reset-names", &strings[0]);
+	if (!err) {
+		res->reset = devm_reset_control_get_shared(dev, strings[0]);
+		if (res->reset) {
+			bool stat = reset_control_status(res->reset);
+
+			if (stat)
+				reset_control_reset(res->reset);
+		}
+		DRM_DEBUG_KMS("top reset : %s\n", strings[0]);
+	}
+
+	nx_soc_dp_cont_top_base(0, res->base);
+
+	/*
+	 * set sub device resources
+	 */
+	np = of_get_child_by_name(node, "dp-resource");
+	if (!np)
+		return 0;
+
+	/* register base */
+	list = of_get_property(np, "reg_base", &size);
+	size /= 8;
+	if (size > MAX_RES_NUM) {
+		DRM_ERROR("error: over devs dt size %d (max %d)\n",
+			size, MAX_RES_NUM);
+		return -EINVAL;
+	}
+
+	for (i = 0; size > i; i++) {
+		addr = be32_to_cpu(*list++);
+		length = PAGE_ALIGN(be32_to_cpu(*list++));
+
+		res->dev_bases[i] = ioremap(addr, length);
+		if (!res->dev_bases[i])
+			return -EINVAL;
+
+		DRM_DEBUG_KMS("dev base  :  0x%x (0x%x) %p\n",
+			addr, size, res->dev_bases[i]);
+	}
+	res->num_devs = size;
+
+	/* clock gen base : 2 contents */
+	list = of_get_property(np, "clk_base", &size);
+	size /= 8;
+	if (size > MAX_RES_NUM) {
+		DRM_ERROR("error: over clks dt size %d (max %d)\n",
+			size, MAX_RES_NUM);
+		return -EINVAL;
+	}
+
+	for (i = 0; size > i; i++) {
+		addr = be32_to_cpu(*list++);
+		res->dev_clk_bases[i] = ioremap(addr, PAGE_SIZE);
+		res->dev_clk_ids[i] = be32_to_cpu(*list++);
+		DRM_DEBUG_KMS("dev clock : [%d] clk 0x%x, %d\n",
+			i, addr, res->dev_clk_ids[i]);
+	}
+	res->num_dev_clks = size;
+
+	/* tieoffs : 2 contents */
+	list = of_get_property(np, "soc,tieoff", &size);
+	size /= 8;
+	if (size > MAX_RES_NUM) {
+		DRM_ERROR("error: over tieoff dt size %d (max %d)\n",
+			size, MAX_RES_NUM);
+		return -EINVAL;
+	}
+	res->num_tieoffs = size;
+
+	for (i = 0; size > i; i++) {
+		res->tieoffs[i][0] = be32_to_cpu(*list++);
+		res->tieoffs[i][1] = be32_to_cpu(*list++);
+		DRM_DEBUG_KMS("dev tieoff: [%d] res->tieoffs <0x%x %d>\n",
+			i, res->tieoffs[i][0], res->tieoffs[i][1]);
+	}
+
+	for (i = 0; size > i; i++)
+		nx_tieoff_set(res->tieoffs[i][0], res->tieoffs[i][1]);
+
+	/* resets */
+	size = of_property_read_string_array(np,
+			"reset-names", strings, MAX_RES_NUM);
+	for (i = 0; size > i; i++) {
+		res->dev_resets[i] = of_reset_control_get(np, strings[i]);
+		DRM_DEBUG_KMS("dev reset : [%d] %s\n", i, strings[i]);
+	}
+	res->num_dev_resets = size;
+
+	for (i = 0; size > i; i++) {
+		reset = reset_control_status(res->dev_resets[i]);
+		if (reset)
+			reset_control_assert(res->dev_resets[i]);
+	}
+
+	for (i = 0; size > i; i++)
+		reset_control_deassert(res->dev_resets[i]);
+
+	/* set pclk */
+	for (i = 0; res->num_dev_clks > i; i++) {
+		nx_soc_dp_cont_top_clk_base(
+				res->dev_clk_ids[i], res->dev_clk_bases[i]);
+		nx_soc_dp_cont_top_clk_on(res->dev_clk_ids[i]);
+	}
+
+	return 0;
+}
+
+void nx_drm_dp_panel_res_free(struct device *dev,
+			struct nx_drm_res *res)
+{
+	int i;
+
+	for (i = 0; res->num_devs > i; i++) {
+		if (res->dev_bases[i])
+			iounmap(res->dev_bases[i]);
+	}
+
+	for (i = 0; res->num_dev_clks > i; i++) {
+		if (res->dev_clk_bases[i])
+			iounmap(res->dev_clk_bases[i]);
+	}
+
+	if (res->base)
+		iounmap(res->base);
+}
+
+int nx_drm_dp_panel_res_resume(struct device *dev,
+			struct nx_drm_device *display)
+{
+	struct nx_drm_res *res = &display->res;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+	enum dp_panel_type panel_type = dpc->panel_type;
+	bool stat;
+	int i;
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(panel_type));
+
+	/* top reset */
+	if (res->reset) {
+		stat = reset_control_status(res->reset);
+		if (stat)
+			reset_control_reset(res->reset);
+	}
+
+	/* release tieoff */
+	for (i = 0; res->num_tieoffs > i; i += 2)
+		nx_tieoff_set(res->tieoffs[i][0], res->tieoffs[i][1]);
+
+	/*
+	 * assert/deassert device reset
+	 */
+	for (i = 0; res->num_dev_resets > i; i++) {
+		stat = reset_control_status(res->dev_resets[i]);
+		if (stat)
+			reset_control_assert(res->dev_resets[i]);
+	}
+
+	for (i = 0; res->num_dev_resets > i; i++)
+			reset_control_deassert(res->dev_resets[i]);
+
+	/* set pclk */
+	for (i = 0; res->num_dev_clks > i; i++)
+		nx_soc_dp_cont_top_clk_on(res->dev_clk_ids[i]);
+
+	if (ops && ops->resume)
+		ops->resume(dpc);
+
+	return 0;
+}
+
+int nx_drm_dp_panel_res_suspend(struct device *dev,
+			struct nx_drm_device *display)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(dpc->panel_type));
+
+	if (ops && ops->suspend)
+		ops->suspend(dpc);
+
+	return 0;
+}
+
+int nx_drm_dp_panel_dev_register(struct device *dev,
+			struct device_node *np, enum dp_panel_type type,
+			struct nx_drm_device *display)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct nx_drm_res *res = &display->res;
+	int err = -EINVAL;
+
+	if (dp_panel_type_rgb == type) {
+
+		#ifdef CONFIG_DRM_NX_RGB
+		err = nx_dp_device_rgb_register(dev, np, dpc);
+		#endif
+
+	} else if (dp_panel_type_lvds == type) {
+
+		#ifdef CONFIG_DRM_NX_LVDS
+		err = nx_dp_device_lvds_register(dev, np, dpc,
+				(void *)res->dev_resets, res->num_dev_resets);
+		#endif
+
+	} else if (dp_panel_type_mipi == type) {
+
+		#ifdef CONFIG_DRM_NX_MIPI_DSI
+		err = nx_dp_device_mipi_register(dev, np, dpc);
+		#endif
+
+	} else if (dp_panel_type_hdmi == type) {
+
+		#ifdef CONFIG_DRM_NX_HDMI
+		err = nx_dp_device_hdmi_register(dev, np, dpc);
+		#endif
+
+	} else {
+		DRM_ERROR("not support panel type [%d] !!!\n", type);
+		return -EINVAL;
+	}
+
+	if (0 > err) {
+		DRM_ERROR("not selected panel [%s] !!!\n",
+			dp_panel_type_name(type));
+		return err;
+	}
+
+	if (dpc->ops &&
+		dpc->ops->set_base)
+		dpc->ops->set_base(dpc, res->dev_bases, res->num_devs);
+
+	return 0;
+}
+
+void nx_drm_dp_panel_dev_release(struct device *dev,
+			struct nx_drm_device *display)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+
+	kfree(dpc->dp_output);
+}
+
+int nx_drm_dp_panel_ctrl_parse(struct device_node *np,
+			struct nx_drm_device *display)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_ctrl_info *ctl = &dpc->ctrl;
+
+	parse_read_prop(np, "clk_src_lv0", ctl->clk_src_lv0);
+	parse_read_prop(np, "clk_div_lv0", ctl->clk_div_lv0);
+	parse_read_prop(np, "clk_src_lv1", ctl->clk_src_lv1);
+	parse_read_prop(np, "clk_div_lv1", ctl->clk_div_lv1);
+	parse_read_prop(np, "out_format", ctl->out_format);
+	parse_read_prop(np, "invert_field", ctl->invert_field);
+	parse_read_prop(np, "swap_rb", ctl->swap_rb);
+	parse_read_prop(np, "yc_order", ctl->yc_order);
+	parse_read_prop(np, "delay_mask", ctl->delay_mask);
+	parse_read_prop(np, "d_rgb_pvd", ctl->d_rgb_pvd);
+	parse_read_prop(np, "d_hsync_cp1", ctl->d_hsync_cp1);
+	parse_read_prop(np, "d_vsync_fram", ctl->d_vsync_fram);
+	parse_read_prop(np, "d_de_cp2", ctl->d_de_cp2);
+	parse_read_prop(np, "vs_start_offset", ctl->vs_start_offset);
+	parse_read_prop(np, "vs_end_offset", ctl->vs_end_offset);
+	parse_read_prop(np, "ev_start_offset", ctl->ev_start_offset);
+	parse_read_prop(np, "ev_end_offset", ctl->ev_end_offset);
+	parse_read_prop(np, "vck_select", ctl->vck_select);
+	parse_read_prop(np, "clk_inv_lv0", ctl->clk_inv_lv0);
+	parse_read_prop(np, "clk_delay_lv0", ctl->clk_delay_lv0);
+	parse_read_prop(np, "clk_inv_lv1", ctl->clk_inv_lv1);
+	parse_read_prop(np, "clk_delay_lv1", ctl->clk_delay_lv1);
+	parse_read_prop(np, "clk_sel_div1", ctl->clk_sel_div1);
+
+	return 0;
+}
+
+void nx_drm_dp_panel_ctrl_dump(struct nx_drm_device *display)
+{
+	struct nx_drm_panel *panel = &display->panel;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_ctrl_info *ctrl = &dpc->ctrl;
+
+	DRM_DEBUG_KMS("SYNC -> LCD %d x %d mm\n",
+		panel->width_mm, panel->height_mm);
+	DRM_DEBUG_KMS("ha:%d, hs:%d, hb:%d, hf:%d\n",
+	    panel->vm.hactive, panel->vm.hsync_len,
+	    panel->vm.hback_porch, panel->vm.hfront_porch);
+	DRM_DEBUG_KMS("va:%d, vs:%d, vb:%d, vf:%d\n",
+		panel->vm.vactive, panel->vm.vsync_len,
+	    panel->vm.vback_porch, panel->vm.vfront_porch);
+	DRM_DEBUG_KMS("flags:0x%x\n", panel->vm.flags);
+
+	DRM_DEBUG_KMS("CTRL (%s)\n", dp_panel_type_name(dpc->panel_type));
+	DRM_DEBUG_KMS("cs0:%d, cd0:%d, cs1:%d, cd1:%d\n",
+	    ctrl->clk_src_lv0, ctrl->clk_div_lv0,
+	    ctrl->clk_src_lv1, ctrl->clk_div_lv1);
+	DRM_DEBUG_KMS("fmt:0x%x, inv:%d, swap:%d, yb:0x%x\n",
+	    ctrl->out_format, ctrl->invert_field,
+	    ctrl->swap_rb, ctrl->yc_order);
+	DRM_DEBUG_KMS("dm:0x%x, drp:%d, dhs:%d, dvs:%d, dde:0x%x\n",
+	    ctrl->delay_mask, ctrl->d_rgb_pvd,
+	    ctrl->d_hsync_cp1, ctrl->d_vsync_fram, ctrl->d_de_cp2);
+	DRM_DEBUG_KMS("vss:%d, vse:%d, evs:%d, eve:%d\n",
+	    ctrl->vs_start_offset, ctrl->vs_end_offset,
+	    ctrl->ev_start_offset, ctrl->ev_end_offset);
+	DRM_DEBUG_KMS("sel:%d, i0:%d, d0:%d, i1:%d, d1:%d, s1:%d\n",
+	    ctrl->vck_select, ctrl->clk_inv_lv0, ctrl->clk_delay_lv0,
+	    ctrl->clk_inv_lv1, ctrl->clk_delay_lv1, ctrl->clk_sel_div1);
+}
+
+int nx_drm_dp_crtc_res_parse(struct platform_device *pdev, int pipe,
+			int *irqno, struct reset_control **resets,
+			int *num_resets)
+{
+	struct device *dev = &pdev->dev;
+	struct device_node *node = dev->of_node;
+	const char *strings[10];
+	void *base[8];
+	int i, n, size = 0;
+	int offset = 4;	/* mlc. or dpc. */
+	int err;
+
+	DRM_DEBUG_KMS("crtc.%d for %s\n", pipe, dev_name(dev));
+
+	/*
+	 * parse base address
+	 */
+	size = of_property_read_string_array(node,
+			"reg-names", strings, ARRAY_SIZE(strings));
+	if (size > ARRAY_SIZE(strings))
+		return -EINVAL;
+
+	for (n = 0, i = 0; size > i; i++) {
+		const char *c = strings[i] + offset;
+		unsigned long no;
+
+		if (0 > kstrtoul(c, 0, &no))
+			continue;
+
+		if (pipe != no)
+			continue;
+
+		base[n] = of_iomap(node, i);
+		if (!base[n]) {
+			DRM_DEBUG_KMS("fail : %s iomap\n", strings[i]);
+			return -EINVAL;
+		}
+		n++;
+	}
+
+	/*
+	 * parse interrupts.
+	 */
+	size = of_property_read_string_array(node,
+			"interrupts-names", strings, ARRAY_SIZE(strings));
+	if (size > ARRAY_SIZE(strings))
+		return -EINVAL;
+
+	for (n = 0, i = 0; size > i; i++) {
+		const char *c = strings[i] + offset;
+		unsigned long no;
+
+		if (0 > kstrtoul(c, 0, &no))
+			continue;
+
+		if (pipe != no)
+			continue;
+
+		err = platform_get_irq(pdev, i);
+		if (0 > err)
+			return -EINVAL;
+
+		*irqno = err;
+	}
+
+	/*
+	 * parse reset address
+	 */
+	size = of_property_read_string_array(node,
+				"reset-names", strings, ARRAY_SIZE(strings));
+
+	for (i = 0; size > i; i++, resets++) {
+		*resets = devm_reset_control_get_shared(dev, strings[i]);
+		if (*resets) {
+			bool stat = reset_control_status(*resets);
+
+			if (stat)
+				reset_control_reset(*resets);
+		}
+		DRM_DEBUG_KMS("reset[%d]: %s:%p\n", i, strings[i], *resets);
+	}
+	*num_resets = size;
+
+	nx_soc_dp_cont_dpc_base(pipe, base[0]);
+	nx_soc_dp_cont_mlc_base(pipe, base[1]);
+
+	return 0;
+}
+
+void nx_drm_dp_crtc_dpms(struct drm_crtc *crtc, int mode)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct dp_plane_top *top = &nx_crtc->top;
+	bool suspend = nx_crtc->suspended;
+	int on = (mode == DRM_MODE_DPMS_ON ? 1 : 0);
+
+	DRM_DEBUG_KMS("crtc.%d mode: %s\n",
+		top->module, mode == DRM_MODE_DPMS_ON ? "on" :
+		mode == DRM_MODE_DPMS_OFF ? "off" :
+		mode == DRM_MODE_DPMS_STANDBY ? "standby" :
+		mode == DRM_MODE_DPMS_SUSPEND ? "suspend" : "unknown");
+
+	if (suspend) {
+		if (on)
+			dp_crtc_resume(crtc);
+		else
+			dp_crtc_suspend(crtc);
+	}
+
+	nx_soc_dp_plane_top_set_enable(top, on);
+}
+
+void nx_drm_dp_crtc_commit(struct drm_crtc *crtc)
+{
+	struct drm_framebuffer *fb = crtc->primary->fb;
+	struct nx_gem_object *nx_obj;
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct nx_drm_plane *nx_plane = to_nx_plane(crtc->primary);
+	struct dp_plane_top *top = &nx_crtc->top;
+	struct dp_plane_layer *layer = &nx_plane->layer;
+	dma_addr_t dma_addr;
+
+	int module = top->module;
+	int num = layer->num;
+	int pixel = fb->format->cpp[0];
+	int width = fb->width;
+	int height = fb->height;
+	int hstride = width * pixel;
+
+	nx_obj = nx_drm_fb_get_gem_obj(fb, 0);
+	dma_addr = nx_obj->dma_addr;
+
+	DRM_DEBUG_KMS("crtc.%d plane.%d (%s) :\n",
+			module, num, nx_plane->layer.name);
+	DRM_DEBUG_KMS("crtc[%d x %d] addr:0x%x\n",
+			width, height, (unsigned int)dma_addr);
+
+	/* set video color key */
+	nx_soc_dp_plane_rgb_set_color(layer,
+		dp_color_transp, top->color_key, true, false);
+
+	nx_soc_dp_plane_rgb_set_address(layer,
+			dma_addr, pixel, hstride, 0, true);
+	nx_soc_dp_plane_rgb_set_enable(layer, true, true);
+}
+
+void nx_drm_dp_crtc_irq_on(struct drm_crtc *crtc, int pipe)
+{
+	nx_soc_dp_cont_irq_on(pipe, true);
+}
+
+void nx_drm_dp_crtc_irq_off(struct drm_crtc *crtc, int pipe)
+{
+	nx_soc_dp_cont_irq_on(pipe, false);
+}
+
+void nx_drm_dp_crtc_irq_done(struct drm_crtc *crtc, int pipe)
+{
+	nx_soc_dp_cont_irq_done(pipe);
+}
+
+void nx_drm_dp_crtc_init(struct drm_device *drm,
+			struct drm_crtc *crtc, int index)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct dp_plane_top *top = &nx_crtc->top;
+
+	top->module = index;
+	top->dev = drm->dev;
+	INIT_LIST_HEAD(&top->plane_list);
+}
+
+void nx_drm_dp_crtc_reset(struct drm_crtc *crtc)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	int i = 0;
+	bool stat;
+
+	DRM_DEBUG_KMS("crtc.%d\n", nx_crtc->top.module);
+
+	for (i = 0; nx_crtc->num_resets > i; i++) {
+		stat = reset_control_status(nx_crtc->resets[i]);
+		if (stat)
+			reset_control_reset(nx_crtc->resets[i]);
+	}
+}
+
+void nx_drm_dp_plane_set_color(struct drm_plane *plane,
+			enum dp_color_type type, unsigned int color)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	struct dp_plane_layer *layer = &nx_plane->layer;
+
+	DRM_DEBUG_KMS("crtc.%d type:%d color:0x%x\n",
+		layer->module, type, color);
+
+	if (dp_color_colorkey == type) {
+		struct dp_plane_top *top = layer->plane_top;
+
+		list_for_each_entry(layer, &top->plane_list, list) {
+			DRM_DEBUG_KMS("primary.%d layer.%d [%s]\n",
+				top->primary_plane, layer->num, layer->name);
+			if (layer->num == top->primary_plane)
+				break;
+		}
+		nx_soc_dp_plane_rgb_set_color(layer,
+			dp_color_transp, color, true, true);
+	} else {
+		if (dp_plane_video != layer->type)
+			nx_soc_dp_plane_rgb_set_color(layer,
+					type, color, true, true);
+	}
+}
+
+void nx_drm_dp_plane_set_priority(struct drm_plane *plane, int priority)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	struct dp_plane_layer *layer = &nx_plane->layer;
+
+	nx_soc_dp_plane_video_set_priority(layer, priority);
+}
+
+int nx_drm_dp_plane_mode_set(struct drm_crtc *crtc,
+			struct drm_plane *plane,
+			struct drm_framebuffer *fb,
+			int crtc_x, int crtc_y,
+			unsigned int crtc_w, unsigned int crtc_h,
+			uint32_t src_x, uint32_t src_y,
+			uint32_t src_w, uint32_t src_h)
+{
+	struct nx_drm_crtc *nx_crtc = to_nx_crtc(crtc);
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	struct dp_plane_top *top = &nx_crtc->top;
+	struct dp_plane_layer *layer = &nx_plane->layer;
+	int pixel = fb->format->cpp[0];
+	unsigned int format;
+	int ret;
+    struct drm_format_name_buf fmt_name_buf;
+
+	ret = convert_dp_rgb_format(fb->format->format,
+			fb->format->cpp[0], fb->format->depth, &format);
+	if (0 > ret)
+		return ret;
+
+	DRM_DEBUG_KMS("crtc.%d plane.%d :\n",
+			top->module, layer->num);
+	DRM_DEBUG_KMS("crtc[%d x %d] src[%d,%d,%d,%d]\n",
+			crtc_w, crtc_h, src_x, src_y, src_w, src_h);
+	DRM_DEBUG_KMS("%s -> 0x%x, pixel:%d, back:0x%x\n",
+			drm_get_format_name(fb->format->format, &fmt_name_buf), format,
+			pixel, top->back_color);
+
+	nx_soc_dp_plane_top_prepare(top);
+	nx_soc_dp_plane_top_set_bg_color(top);
+	nx_soc_dp_plane_top_set_format(top, crtc_w, crtc_h);
+	nx_soc_dp_plane_rgb_set_format(layer, format, pixel, true);
+	nx_soc_dp_plane_rgb_set_position(layer, src_x, src_y, src_w, src_h,
+			crtc_x, crtc_y, crtc_w, crtc_h, false);
+
+	return 0;
+}
+
+int nx_drm_dp_plane_wait_sync(struct drm_plane *plane,
+			struct drm_framebuffer *fb, bool sync)
+{
+	struct drm_gem_object *obj;
+	struct dp_plane_layer *layer;
+	int plane_num = 0;
+	long ts;
+	int ret;
+
+	obj = to_gem_obj(nx_drm_fb_get_gem_obj(fb, plane_num));
+	layer = &to_nx_plane(plane)->layer;
+	ts = ktime_to_ms(ktime_get());
+
+	ret = nx_drm_gem_wait_fence(obj);
+
+	ts = ktime_to_ms(ktime_get()) - ts;
+
+	DRM_DEBUG_KMS("crtc.%d plane.%d (%s) : wait:%3ldms, ret:%d\n",
+		layer->module, layer->num, layer->name, ts, ret);
+
+	return ret;
+}
+
+int nx_drm_dp_plane_update(struct drm_plane *plane,
+			struct drm_framebuffer *fb,
+			int crtc_x, int crtc_y,
+			unsigned int crtc_w, unsigned int crtc_h,
+			uint32_t src_x, uint32_t src_y,
+			uint32_t src_w, uint32_t src_h, int align)
+{
+	struct nx_drm_plane *nx_plane;
+	struct dp_plane_layer *layer;
+	struct nx_gem_object *nx_obj[4];
+	dma_addr_t dma_addrs[4];
+	unsigned int pitches[4], offsets[4];
+	enum dp_plane_type type;
+	int num_planes = 0;
+	unsigned int format;
+	int ret, i = 0;
+    struct drm_format_name_buf fmt_name_buf;
+
+	nx_plane = to_nx_plane(plane);
+	layer = &nx_plane->layer;
+	type = layer->type;
+	num_planes = drm_format_num_planes(fb->format->format);
+
+	DRM_DEBUG_KMS("crtc.%d plane.%d (%s) : planes %d\n",
+		layer->module, layer->num, layer->name, num_planes);
+	DRM_DEBUG_KMS("%s crtc[%d,%d,%d,%d] src[%d,%d,%d,%d]\n",
+		drm_get_format_name(fb->format->format, &fmt_name_buf),
+		crtc_x, crtc_y, crtc_w, crtc_h, src_x, src_y, src_w, src_h);
+
+	for (i = 0; num_planes > i; i++) {
+		nx_obj[i] = nx_drm_fb_get_gem_obj(fb, i);
+		dma_addrs[i] = nx_obj[i]->dma_addr;
+		offsets[i] = fb->offsets[i];
+		pitches[i] = fb->pitches[i];
+	}
+
+	/* update rgb plane */
+	if (dp_plane_rgb == type) {
+		int pixel = (fb->format->cpp[0]);
+
+		ret = convert_dp_rgb_format(fb->format->format,
+				fb->format->cpp[0], fb->format->depth, &format);
+		if (0 > ret)
+			return ret;
+
+		nx_soc_dp_plane_rgb_set_format(layer, format, pixel, true);
+		nx_soc_dp_plane_rgb_set_position(layer,
+				src_x, src_y, src_w, src_h,
+				crtc_x, crtc_y, crtc_w, crtc_h, true);
+
+		ret = nx_drm_dp_plane_wait_sync(plane, fb, false);
+		if (!ret)
+			nx_soc_dp_plane_rgb_set_address(layer,
+				dma_addrs[0], pixel, crtc_w * pixel, align,
+				true);
+
+		nx_soc_dp_plane_rgb_set_enable(layer, true, true);
+
+	/* update video plane */
+	} else {
+		dma_addr_t lua, uvdma[2];
+		int lus, uvs[2];
+		bool isVU;
+
+		ret = convert_dp_vid_format(fb->format->format,
+					&format, &isVU);
+		if (0 > ret)
+			return ret;
+
+		nx_soc_dp_plane_video_set_format(layer, format, true);
+		nx_soc_dp_plane_video_set_position(layer,
+				src_x, src_y, src_w, src_h,
+				crtc_x, crtc_y, crtc_w, crtc_h, true);
+
+		switch (num_planes) {
+		case 1:
+			lua = dma_addrs[0], lus = pitches[0];
+			nx_soc_dp_plane_video_set_address_1p(layer,
+				lua, lus, true);
+			break;
+
+		case 2:
+		case 3:
+			lua = dma_addrs[0];
+			uvdma[isVU] = offsets[1] ? lua + offsets[1] : dma_addrs[1];
+			uvdma[!isVU] = offsets[2] ? lua + offsets[2] : dma_addrs[2];
+			lus = pitches[0], uvs[isVU] = pitches[1], uvs[!isVU] = pitches[2];
+
+			nx_soc_dp_plane_video_set_address_3p(layer, lua, lus,
+				uvdma[0], uvs[0], uvdma[1], uvs[1], true);
+			break;
+		default:
+			ret = -EINVAL;
+			break;
+		}
+
+		if (0 > ret)
+			return ret;
+
+		nx_soc_dp_plane_video_set_enable(layer, true, true);
+	}
+	return 0;
+}
+
+int nx_drm_dp_plane_disable(struct drm_plane *plane)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	struct dp_plane_layer *layer = &nx_plane->layer;
+
+	DRM_DEBUG_KMS("enter (%s)\n",
+		dp_plane_rgb == layer->type ? "RGB" : "VIDEO");
+
+	if (dp_plane_rgb == layer->type)
+		nx_soc_dp_plane_rgb_set_enable(layer, false, true);
+	else
+		nx_soc_dp_plane_video_set_enable(layer, false, true);
+
+	return 0;
+}
+
+void nx_drm_dp_plane_init(struct drm_device *drm,
+			struct drm_crtc *crtc,
+			struct drm_plane *plane, int plane_num)
+{
+	struct nx_drm_plane *nx_plane = to_nx_plane(plane);
+	struct dp_plane_layer *layer = &nx_plane->layer;
+	struct dp_plane_top *top;
+	enum dp_plane_type type;
+	int module;
+
+	top = &(to_nx_crtc(crtc))->top;
+	module = top->module;
+	type = plane_num == PLANE_VIDEO_NUM ?
+				dp_plane_video : dp_plane_rgb;
+
+	layer->dev = drm->dev;
+	layer->plane_top = top;
+	layer->module = top->module;
+	layer->num = plane_num;
+	layer->type = type;
+
+	sprintf(layer->name, "%d-%s%d",
+		module, dp_plane_video == type ? "vid" : "rgb", plane_num);
+
+	if (dp_plane_video == type) {
+		layer->color.alpha = 15;
+		layer->color.bright = 0;
+		layer->color.contrast = 0;
+		layer->color.satura = 0;
+	}
+
+	list_add_tail(&layer->list, &top->plane_list);
+
+	DRM_DEBUG_KMS("crtc.%d plane.%d (%s)\n",
+		layer->module, layer->num, layer->name);
+}
+
+void nx_drm_dp_display_mode_to_sync(struct drm_display_mode *mode,
+			struct nx_drm_device *display)
+{
+	struct videomode vm;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_sync_info *sync = &dpc->sync;
+
+	drm_display_mode_to_videomode(mode, &vm);
+
+	sync->interlace =
+		vm.flags & DISPLAY_FLAGS_INTERLACED ? 1 : 0;
+
+	sync->h_active_len = vm.hactive;
+	sync->h_sync_width = vm.hsync_len;
+	sync->h_back_porch = vm.hback_porch;
+	sync->h_front_porch = vm.hfront_porch;
+	sync->h_sync_invert =
+		vm.flags & DISPLAY_FLAGS_HSYNC_HIGH ? 1 : 0;
+
+	sync->v_active_len = vm.vactive;
+	sync->v_sync_width = vm.vsync_len;
+	sync->v_back_porch = vm.vback_porch;
+	sync->v_front_porch = vm.vfront_porch;
+	sync->v_sync_invert =
+		vm.flags & DISPLAY_FLAGS_VSYNC_HIGH ? 1 : 0;
+	sync->pixel_clock_hz = vm.pixelclock;
+}
+
+void nx_drm_dp_encoder_commit(struct drm_encoder *encoder)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(dpc->panel_type));
+
+	/*
+	 * when set_crtc is requested from user or at booting time,
+	 * encoder->commit would be called without dpms call so if dpms is
+	 * no power on then encoder->dpms should be called
+	 * with DRM_MODE_DPMS_ON for the hardware power to be on.
+	 */
+	nx_soc_dp_cont_prepare(dpc);
+	nx_soc_dp_cont_power_on(dpc, true);
+}
+
+int nx_drm_dp_encoder_get_dpms(struct drm_encoder *encoder)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	bool poweron;
+
+	poweron = nx_soc_dp_cont_power_status(dpc);
+
+	return poweron ? DRM_MODE_DPMS_ON : DRM_MODE_DPMS_OFF;
+}
+
+void nx_drm_dp_encoder_dpms(struct drm_encoder *encoder, bool poweron)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	bool suspend = display->suspended;
+
+	DRM_DEBUG_KMS("%s power %s\n",
+		dp_panel_type_name(dpc->panel_type), poweron ? "on" : "off");
+
+	if (suspend) {
+		if (poweron)
+			dp_encoder_resume(encoder);
+		else
+			dp_encoder_suspend(encoder);
+	}
+
+	if (poweron)
+		nx_soc_dp_cont_prepare(dpc);
+
+	nx_soc_dp_cont_power_on(dpc, poweron);
+}
+
+void nx_drm_dp_encoder_prepare(struct drm_encoder *encoder,
+			int index, bool irqon)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+
+	/*
+	 * set display module index
+	 */
+	dpc->module = index;
+
+	nx_soc_dp_cont_dpc_clk_on(dpc);
+}
+
+void nx_drm_dp_encoder_unprepare(struct drm_encoder *encoder)
+{
+	struct nx_drm_device *display = to_nx_encoder(encoder)->display;
+	struct dp_control_dev *dpc = display_to_dpc(display);
+
+	nx_soc_dp_cont_irq_on(dpc->module, false);
+}
+
+int nx_drm_dp_lcd_prepare(struct nx_drm_device *display,
+			struct drm_panel *panel)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(dpc->panel_type));
+
+	if (ops && ops->prepare)
+		ops->prepare(dpc, panel ? 1 : 0);
+
+	return 0;
+}
+
+void nx_drm_dp_lcd_mode_set(struct nx_drm_device *display,
+			const struct drm_display_mode *mode)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+	char clk_name[16];
+	struct clk *clk;
+	unsigned long clk_rate = 800000000;
+
+	sprintf(clk_name, "pll%d", dpc->ctrl.clk_src_lv0);
+	clk = clk_get(NULL, clk_name);
+	if( clk ) {
+		clk_rate = clk_get_rate(clk);
+		clk_put(clk);
+	}else{
+		DRM_ERROR("unable to get rate of %s; assuming %lu\n",
+				clk_name, clk_rate);
+	}
+	dpc->ctrl.clk_div_lv0 = (clk_rate/1000 + mode->clock / 2) / mode->clock;
+	dpc->sync.h_sync_invert = !(mode->flags & DRM_MODE_FLAG_NHSYNC);
+	dpc->sync.v_sync_invert = !(mode->flags & DRM_MODE_FLAG_NVSYNC);
+	DRM_INFO("%s: lv0 divisor set to %d\n", dp_panel_type_name(dpc->panel_type),
+			dpc->ctrl.clk_div_lv0);
+	if (ops && ops->mode_set)
+		ops->mode_set(dpc);
+}
+
+int nx_drm_dp_lcd_enable(struct nx_drm_device *display,
+				struct drm_panel *panel)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+	int module = dpc->module;
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(dpc->panel_type));
+
+	if (dp_panel_type_rgb == dpc->panel_type) {
+		/*
+		 *  0 : Primary MLC  , 1 : Primary MPU,
+		 *  2 : Secondary MLC, 3 : ResConv(LCDIF)
+		 */
+		struct dp_rgb_dev *rgb = dpc->dp_output;
+		int pin = 0;
+
+		BUG_ON(!rgb);
+
+		switch (module) {
+		case 0:
+			pin = rgb->mpu_lcd ? 1 : 0;
+			break;
+		case 1:
+			pin = rgb->mpu_lcd ? 3 : 2;
+			break;
+		default:
+			pr_err("fail : %s not support module %d\n",
+				__func__, module);
+			return -EINVAL;
+		}
+
+		nx_disp_top_set_primary_mux(pin);
+		return 0;
+	}
+
+	if (ops && ops->enable)
+		ops->enable(dpc, panel ? 1 : 0);
+
+	return 0;
+}
+
+int nx_drm_dp_lcd_unprepare(struct nx_drm_device *display,
+				struct drm_panel *panel)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(dpc->panel_type));
+
+	if (ops && ops->unprepare)
+		ops->unprepare(dpc);
+
+	return 0;
+}
+
+int nx_drm_dp_lcd_disable(struct nx_drm_device *display,
+				struct drm_panel *panel)
+{
+	struct dp_control_dev *dpc = display_to_dpc(display);
+	struct dp_control_ops *ops = dpc->ops;
+
+	DRM_DEBUG_KMS("%s\n", dp_panel_type_name(dpc->panel_type));
+
+	if (ops && ops->disable)
+		ops->disable(dpc);
+
+	return 0;
+}
+
+#ifdef CONFIG_DRM_NX_MIPI_DSI
+static void dp_mipi_dsi_dump_messages(const struct mipi_dsi_msg *msg, bool dump)
+{
+	const char *txb = msg->tx_buf;
+	const char *rxb = msg->rx_buf;
+	int i = 0;
+
+	if (!dump)
+		return;
+
+	pr_info("%s\n", __func__);
+	pr_info("ch   :%d\n", msg->channel);
+	pr_info("type :0x%x\n", msg->type);
+	pr_info("flags:0x%x\n", msg->flags);
+
+	for (i = 0; msg->tx_len > i; i++)
+		pr_info("T[%2d]: 0x%02x\n", i, txb[i]);
+
+	for (i = 0; msg->rx_len > i; i++)
+		pr_info("R[%2d]: 0x%02x\n", i, rxb[i]);
+}
+
+#define	IS_SHORT(t)	(9 > (t & 0x0f))
+
+int nx_drm_dp_mipi_transfer(struct mipi_dsi_host *host,
+			const struct mipi_dsi_msg *msg)
+{
+	struct dp_mipi_xfer xfer;
+	int err;
+
+	dp_mipi_dsi_dump_messages(msg, false);
+
+	if (!msg->tx_len)
+		return -EINVAL;
+
+	/* set id */
+	xfer.id = msg->type | (msg->channel << 6);
+
+	/* short type msg */
+	if (IS_SHORT(msg->type)) {
+		const char *txb = msg->tx_buf;
+
+		if (msg->tx_len > 2)
+			return -EINVAL;
+
+		xfer.tx_len  = 0;	/* no payload */
+		xfer.data[0] = txb[0];
+		xfer.data[1] = (msg->tx_len == 2) ? txb[1] : 0;
+
+	} else {
+		xfer.tx_len  = msg->tx_len;
+		xfer.data[0] = msg->tx_len & 0xff;
+		xfer.data[1] = msg->tx_len >> 8;
+		xfer.tx_buf = msg->tx_buf;
+	}
+
+	xfer.rx_len = msg->rx_len;
+	xfer.rx_buf = msg->rx_buf;
+	xfer.flags = msg->flags;
+
+	err = nx_soc_dp_mipi_tx_transfer(&xfer);
+
+	if (xfer.rx_len)
+		err = nx_soc_dp_mipi_rx_transfer(&xfer);
+
+	nx_soc_dp_mipi_ransfer_done();
+
+	return err;
+}
+#else
+int nx_drm_dp_mipi_transfer(struct mipi_dsi_host *host,
+			const struct mipi_dsi_msg *msg)
+{
+	return 0;
+}
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.h b/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_drm_dp.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_DRM_DP_H_
+#define _S5PXX18_DRM_DP_H_
+
+#include <video/videomode.h>
+#include <soc/nexell/tieoff.h>
+
+#include "s5pxx18_dp_dev.h"
+
+#define INVALID_IRQ  ((unsigned)-1)
+
+struct nx_drm_ops {
+	bool (*is_connected)(struct device *dev,
+			struct drm_connector *connector);
+	int (*get_modes)(struct device *dev, struct drm_connector *connector);
+	int (*check_mode)(struct device *dev, struct drm_display_mode *mode);
+
+	void (*commit)(struct device *dev);
+	void (*dpms)(struct device *dev, int mode);
+
+	bool (*mode_fixup)(struct device *dev,
+			struct drm_connector *connector,
+			const struct drm_display_mode *mode,
+			struct drm_display_mode *adjusted_mode);
+	void (*mode_set)(struct device *dev, struct drm_display_mode *mode);
+};
+
+struct nx_drm_ctrl {
+	 struct dp_control_dev dpc;
+};
+
+struct nx_drm_panel {
+	struct device_node *panel_node;
+	struct drm_panel *panel;
+	int width_mm;
+	int height_mm;
+	struct videomode vm;
+	int vrefresh;
+	bool check_panel;
+	bool is_connected;
+};
+
+#define	MAX_RES_NUM		8
+
+struct nx_drm_res {
+	void *base;
+	struct reset_control *reset;
+	/* sub devices */
+	void *dev_bases[MAX_RES_NUM];
+	int   num_devs;
+	void *dev_clk_bases[MAX_RES_NUM];
+	int   dev_clk_ids[MAX_RES_NUM];
+	int   num_dev_clks;
+	struct reset_control *dev_resets[MAX_RES_NUM];
+	int   num_dev_resets;
+	u32 tieoffs[MAX_RES_NUM][2];
+	int   num_tieoffs;
+};
+
+struct nx_drm_device {
+	struct device *dev;
+	struct nx_drm_ops *ops;
+	struct nx_drm_panel panel;
+	struct nx_drm_ctrl ctrl;
+	struct nx_drm_res res;
+	bool suspended;
+};
+
+#define	drm_dev_get_dpc(d)	(&d->ctrl.dpc)
+
+enum dp_panel_type dp_panel_get_type(struct nx_drm_device *display);
+const char *dp_panel_type_name(enum dp_panel_type panel);
+
+void nx_drm_dp_crtc_init(struct drm_device *drm, struct drm_crtc *crtc,
+			int index);
+void nx_drm_dp_crtc_commit(struct drm_crtc *crtc);
+void nx_drm_dp_crtc_dpms(struct drm_crtc *crtc, int mode);
+void nx_drm_dp_crtc_irq_on(struct drm_crtc *crtc, int pipe);
+void nx_drm_dp_crtc_irq_off(struct drm_crtc *crtc, int pipe);
+void nx_drm_dp_crtc_irq_done(struct drm_crtc *crtc, int pipe);
+void nx_drm_dp_crtc_reset(struct drm_crtc *crtc);
+
+void nx_drm_dp_plane_init(struct drm_device *drm, struct drm_crtc *crtc,
+			struct drm_plane *plane, int plane_num);
+int nx_drm_dp_plane_mode_set(struct drm_crtc *crtc,
+			struct drm_plane *plane, struct drm_framebuffer *fb,
+			int crtc_x, int crtc_y,
+			unsigned int crtc_w, unsigned int crtc_h,
+			uint32_t src_x, uint32_t src_y,
+			uint32_t src_w, uint32_t src_h);
+int nx_drm_dp_plane_update(struct drm_plane *plane,
+			struct drm_framebuffer *fb,
+			int crtc_x, int crtc_y,
+			unsigned int crtc_w, unsigned int crtc_h,
+			uint32_t src_x, uint32_t src_y,
+			uint32_t src_w, uint32_t src_h, int align);
+int nx_drm_dp_plane_disable(struct drm_plane *plane);
+void nx_drm_dp_plane_set_color(struct drm_plane *plane,
+			enum dp_color_type type, unsigned int color);
+void nx_drm_dp_plane_set_priority(struct drm_plane *plane, int priority);
+
+void nx_drm_dp_display_mode_to_sync(struct drm_display_mode *mode,
+			struct nx_drm_device *display);
+
+void nx_drm_dp_encoder_prepare(struct drm_encoder *encoder,
+			int index, bool irqon);
+void nx_drm_dp_encoder_unprepare(struct drm_encoder *encoder);
+void nx_drm_dp_encoder_commit(struct drm_encoder *encoder);
+void nx_drm_dp_encoder_dpms(struct drm_encoder *encoder, bool poweron);
+int nx_drm_dp_encoder_get_dpms(struct drm_encoder *encoder);
+
+int nx_drm_dp_lcd_prepare(struct nx_drm_device *display,
+			struct drm_panel *panel);
+int nx_drm_dp_lcd_enable(struct nx_drm_device *display,
+			struct drm_panel *panel);
+int nx_drm_dp_lcd_unprepare(struct nx_drm_device *display,
+			struct drm_panel *panel);
+int nx_drm_dp_lcd_disable(struct nx_drm_device *display,
+			struct drm_panel *panel);
+void nx_drm_dp_lcd_mode_set(struct nx_drm_device *display,
+		const struct drm_display_mode*);
+
+int nx_drm_dp_mipi_transfer(struct mipi_dsi_host *host,
+			const struct mipi_dsi_msg *msg);
+
+int nx_drm_dp_panel_res_parse(struct device *dev,
+			struct nx_drm_res *res, enum dp_panel_type panel_type);
+void nx_drm_dp_panel_res_free(struct device *dev,
+			struct nx_drm_res *res);
+
+int nx_drm_dp_panel_res_resume(struct device *dev,
+			struct nx_drm_device *display);
+int nx_drm_dp_panel_res_suspend(struct device *dev,
+			struct nx_drm_device *display);
+
+int nx_drm_dp_panel_dev_register(struct device *dev,
+			struct device_node *np, enum dp_panel_type type,
+			struct nx_drm_device *display);
+void nx_drm_dp_panel_dev_release(struct device *dev,
+			struct nx_drm_device *display);
+
+void nx_drm_dp_panel_ctrl_dump(struct nx_drm_device *display);
+
+int nx_drm_dp_crtc_res_parse(struct platform_device *pdev, int pipe,
+			int *irqno, struct reset_control **resets,
+			int *num_resets);
+
+int  nx_drm_dp_panel_ctrl_parse(struct device_node *np,
+			struct nx_drm_device *display);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_hdmi_presets.c b/drivers/gpu/drm/nexell/soc/s5pxx18_hdmi_presets.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_hdmi_presets.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_hdmi_presets.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,968 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
+#include <linux/hdmi.h>
+
+#include "s5pxx18_dp_hdmi.h"
+
+
+/*
+ * HDMI preset configs
+ */
+
+/* CEAVideoModes */
+static const struct hdmi_preset hdmi_conf_640x480p60 = {
+	.mode = {
+		.pixelclock = 25175000,
+		.h_as = 640, .h_sw = 96, .h_bp = 48, .h_fp = 16,
+		.v_as = 480, .v_sw = 2, .v_bp = 33, .v_fp = 10,
+		.refresh = 60,		/* 59.9405 */
+		.name = "vic1,640x480@60Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 1
+};
+
+static const struct hdmi_preset hdmi_conf_720x480p60_4a3 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 720, .h_sw = 62, .h_bp = 60, .h_fp = 16,
+		.v_as = 480, .v_sw = 6, .v_bp = 30, .v_fp = 9,
+		.refresh = 60,		/* 59.9401 */
+		.name = "vic2,720x480@60Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 2
+};
+
+static const struct hdmi_preset hdmi_conf_720x480p60_16a9 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 720, .h_sw = 62, .h_bp = 60, .h_fp = 16,
+		.v_as = 480, .v_sw = 6, .v_bp = 30, .v_fp = 9,
+		.refresh = 60,		/* 59.9401 */
+		.name = "vic3,720x480@60Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 3
+};
+
+static const struct hdmi_preset hdmi_conf_1280x720p60 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1280, .h_sw = 40, .h_bp = 220, .h_fp = 110,
+		.v_as = 720, .v_sw = 5, .v_bp = 20, .v_fp = 5,
+		.refresh = 60,
+		.name = "vic4,1280x720@60Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 4
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080i60 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 88,
+		.v_as = 1080, .v_sw = 10, .v_bp = 31, .v_fp = 4,
+		.refresh = 60,
+		.name = "vic5,1920x1080i@60Hz 16:9",
+		.flags = RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 5
+};
+
+static const struct hdmi_preset hdmi_conf_1440x480i60_4a3 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 114, .h_fp = 38,
+		.v_as = 480, .v_sw = 6, .v_bp = 31, .v_fp = 8,
+		.refresh = 60,		/* 59.9401 */
+		.name = "vic6,1440x480i@60Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 6
+};
+
+static const struct hdmi_preset hdmi_conf_1440x480i60_16a9 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 114, .h_fp = 38,
+		.v_as = 480, .v_sw = 6, .v_bp = 31, .v_fp = 8,
+		.refresh = 60,		/* 59.9401 */
+		.name = "vic7,1440x480i@60Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 7
+};
+
+static const struct hdmi_preset hdmi_conf_1440x240p60_4a3 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 114, .h_fp = 38,
+		.v_as = 240, .v_sw = 3, .v_bp = 15, .v_fp = 4,
+		.refresh = 60,		/* 60.0544 */
+		.name = "vic8,1440x240@60Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 8
+};
+
+static const struct hdmi_preset hdmi_conf_1440x240p60_16a9 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 114, .h_fp = 38,
+		.v_as = 240, .v_sw = 3, .v_bp = 15, .v_fp = 4,
+		.refresh = 60,		/* 60.0544 */
+		.name = "vic9,1440x240@60Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 9
+};
+
+static const struct hdmi_preset hdmi_conf_1440x480p60_4a3 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 120, .h_fp = 32,
+		.v_as = 480, .v_sw = 6, .v_bp = 30, .v_fp = 9,
+		.refresh = 60,		/* 59.9401 */
+		.name = "vic14,1440x480@60Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 14
+};
+
+static const struct hdmi_preset hdmi_conf_1440x480p60_16a9 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 120, .h_fp = 32,
+		.v_as = 480, .v_sw = 6, .v_bp = 30, .v_fp = 9,
+		.refresh = 60,		/* 59.9401 */
+		.name = "vic15,1440x480@60Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 15
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080p60 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 88,
+		.v_as = 1080, .v_sw = 5, .v_bp = 36, .v_fp = 4,
+		.refresh = 60,
+		.name = "vic16,1920x1080@60Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 16
+};
+
+static const struct hdmi_preset hdmi_conf_720x576p50_4a3 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 720, .h_sw = 64, .h_bp = 68, .h_fp = 12,
+		.v_as = 576, .v_sw = 5, .v_bp = 39, .v_fp = 5,
+		.refresh = 50,
+		.name = "vic17,720x576@50Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 17
+};
+
+static const struct hdmi_preset hdmi_conf_720x576p50_16a9 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 720, .h_sw = 64, .h_bp = 68, .h_fp = 12,
+		.v_as = 576, .v_sw = 5, .v_bp = 39, .v_fp = 5,
+		.refresh = 50,
+		.name = "vic18,720x576@50Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 18
+};
+
+static const struct hdmi_preset hdmi_conf_1280x720p50 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1280, .h_sw = 40, .h_bp = 220, .h_fp = 440,
+		.v_as = 720, .v_sw = 5, .v_bp = 20, .v_fp = 5,
+		.refresh = 50,
+		.name = "vic19,1280x720@50Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 19
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080i50 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 528,
+		.v_as = 1080, .v_sw = 10, .v_bp = 31, .v_fp = 4,
+		.refresh = 50,
+		.name = "vic20,1920x1080i@50Hz 16:9",
+		.flags = RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 20
+};
+
+static const struct hdmi_preset hdmi_conf_1440x576i50_4a3 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 126, .h_bp = 138, .h_fp = 24,
+		.v_as = 576, .v_sw = 6, .v_bp = 39, .v_fp = 4,
+		.refresh = 50,
+		.name = "vic21,1440x576i@50Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 21
+};
+
+static const struct hdmi_preset hdmi_conf_1440x576i50_16a9 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 126, .h_bp = 138, .h_fp = 24,
+		.v_as = 576, .v_sw = 6, .v_bp = 39, .v_fp = 4,
+		.refresh = 50,
+		.name = "vic22,1440x576i@50Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 22
+};
+
+static const struct hdmi_preset hdmi_conf_1440x288p50_4a3 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 126, .h_bp = 138, .h_fp = 24,
+		.v_as = 288, .v_sw = 3, .v_bp = 19, .v_fp = 2,
+		.refresh = 50,		/* 50.0801 */
+		.name = "vic23,1440x288@50Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 23
+};
+
+static const struct hdmi_preset hdmi_conf_1440x288p50_16a9 = {
+	.mode = {
+		.pixelclock = 27000000,
+		.h_as = 1440, .h_sw = 126, .h_bp = 138, .h_fp = 24,
+		.v_as = 288, .v_sw = 3, .v_bp = 19, .v_fp = 2,
+		.refresh = 50,		/* 50.0801 */
+		.name = "vic24,1440x288@50Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 24
+};
+
+static const struct hdmi_preset hdmi_conf_1440x576p50_4a3 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 128, .h_bp = 136, .h_fp = 24,
+		.v_as = 576, .v_sw = 5, .v_bp = 39, .v_fp = 5,
+		.refresh = 50,
+		.name = "vic29,1440x576@50Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 29
+};
+
+static const struct hdmi_preset hdmi_conf_1440x576p50_16a9 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 128, .h_bp = 136, .h_fp = 24,
+		.v_as = 576, .v_sw = 5, .v_bp = 39, .v_fp = 5,
+		.refresh = 50,
+		.name = "vic30,1440x576@50Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 30
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080p50 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 528,
+		.v_as = 1080, .v_sw = 5, .v_bp = 36, .v_fp = 4,
+		.refresh = 50,
+		.name = "vic31,1920x1080@50Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 31
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080p24 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 638,
+		.v_as = 1080, .v_sw = 5, .v_bp = 36, .v_fp = 4,
+		.refresh = 24,
+		.name = "vic32,1920x1080@24Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 32
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080p25 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 528,
+		.v_as = 1080, .v_sw = 5, .v_bp = 36, .v_fp = 4,
+		.refresh = 25,
+		.name = "vic33,1920x1080@25Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 33
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080p30 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 88,
+		.v_as = 1080, .v_sw = 5, .v_bp = 36, .v_fp = 4,
+		.refresh = 30,
+		.name = "vic34,1920x1080@30Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 34
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080i100 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 528,
+		.v_as = 1080, .v_sw = 10, .v_bp = 31, .v_fp = 4,
+		.refresh = 100,
+		.name = "vic40,1920x1080i@100Hz 16:9",
+		.flags = RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 40
+};
+
+static const struct hdmi_preset hdmi_conf_1280x720p100 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1280, .h_sw = 40, .h_bp = 220, .h_fp = 440,
+		.v_as = 720, .v_sw = 5, .v_bp = 20, .v_fp = 5,
+		.refresh = 100,
+		.name = "vic41,1280x720@100Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 41
+};
+
+static const struct hdmi_preset hdmi_conf_720x576p100_4a3 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 720, .h_sw = 64, .h_bp = 68, .h_fp = 12,
+		.v_as = 576, .v_sw = 5, .v_bp = 39, .v_fp = 5,
+		.refresh = 100,
+		.name = "vic42,720x576@100Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 42
+};
+
+static const struct hdmi_preset hdmi_conf_720x576p100_16a9 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 720, .h_sw = 64, .h_bp = 68, .h_fp = 12,
+		.v_as = 576, .v_sw = 5, .v_bp = 39, .v_fp = 5,
+		.refresh = 100,
+		.name = "vic43,720x576@100Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 43
+};
+
+static const struct hdmi_preset hdmi_conf_1440x576i100_4a3 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 126, .h_bp = 138, .h_fp = 24,
+		.v_as = 576, .v_sw = 6, .v_bp = 39, .v_fp = 4,
+		.refresh = 100,		/* 50 */
+		.name = "vic44,1440x576i@100Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 44
+};
+
+static const struct hdmi_preset hdmi_conf_1440x576i100_16a9 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 126, .h_bp = 138, .h_fp = 24,
+		.v_as = 576, .v_sw = 6, .v_bp = 39, .v_fp = 4,
+		.refresh = 100,		/* 50 */
+		.name = "vic45,1440x576i@100Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 45
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1080i120 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1920, .h_sw = 44, .h_bp = 148, .h_fp = 88,
+		.v_as = 1080, .v_sw = 10, .v_bp = 31, .v_fp = 4,
+		.refresh = 120,
+		.name = "vic46,1920x1080i@120Hz 16:9",
+		.flags = RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 46
+};
+
+static const struct hdmi_preset hdmi_conf_1280x720p120 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1280, .h_sw = 40, .h_bp = 220, .h_fp = 110,
+		.v_as = 720, .v_sw = 5, .v_bp = 20, .v_fp = 5,
+		.refresh = 120,
+		.name = "vic47,1280x720@120Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 47
+};
+
+static const struct hdmi_preset hdmi_conf_720x480p120_4a3 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 720, .h_sw = 62, .h_bp = 60, .h_fp = 16,
+		.v_as = 480, .v_sw = 6, .v_bp = 30, .v_fp = 9,
+		.refresh = 120,		/* 119.88 */
+		.name = "vic48,720x480@120Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 48
+};
+
+static const struct hdmi_preset hdmi_conf_720x480p120_16a9 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 720, .h_sw = 62, .h_bp = 60, .h_fp = 16,
+		.v_as = 480, .v_sw = 6, .v_bp = 30, .v_fp = 9,
+		.refresh = 120,		/* 119.88 */
+		.name = "vic49,720x480@120Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 49
+};
+
+static const struct hdmi_preset hdmi_conf_1440x480i120_4a3 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 114, .h_fp = 38,
+		.v_as = 480, .v_sw = 6, .v_bp = 31, .v_fp = 8,
+		.refresh = 120,		/* 119.88 */
+		.name = "vic50,1440x480i@120Hz 4:3",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_4_3,
+	.vic = 50
+};
+
+static const struct hdmi_preset hdmi_conf_1440x480i120_16a9 = {
+	.mode = {
+		.pixelclock = 54000000,
+		.h_as = 1440, .h_sw = 124, .h_bp = 114, .h_fp = 38,
+		.v_as = 480, .v_sw = 6, .v_bp = 31, .v_fp = 8,
+		.refresh = 120,		/* 119.88 */
+		.name = "vic51,1440x480i@120Hz 16:9",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC | RES_FIELD_INTERLACED
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 51
+};
+
+static const struct hdmi_preset hdmi_conf_1280x720p25 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1280, .h_sw = 40, .h_bp = 220, .h_fp = 2420,
+		.v_as = 720, .v_sw = 5, .v_bp = 20, .v_fp = 5,
+		.refresh = 25,
+		.name = "vic61,1280x720@25Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 61
+};
+
+static const struct hdmi_preset hdmi_conf_1280x720p30 = {
+	.mode = {
+		.pixelclock = 74250000,
+		.h_as = 1280, .h_sw = 40, .h_bp = 220, .h_fp = 1760,
+		.v_as = 720, .v_sw = 5, .v_bp = 20, .v_fp = 5,
+		.refresh = 30,
+		.name = "vic62,1280x720@30Hz 16:9",
+		.flags = 0
+	},
+	.aspect_ratio = HDMI_PICTURE_ASPECT_16_9,
+	.vic = 62
+};
+
+
+/* DDCEstablishedModes */
+
+static const struct hdmi_preset hdmi_conf_1024x768p70 = {
+	.mode = {
+		.pixelclock = 75000000,
+		.h_as = 1024, .h_sw = 136, .h_bp = 144, .h_fp = 24,
+		.v_as = 768, .v_sw = 6, .v_bp = 29, .v_fp = 3,
+		.refresh = 70,		/* 70.0694 */
+		.name = "1024x768@70Hz",
+		.flags = RES_FIELD_NHSYNC | RES_FIELD_NVSYNC
+	}
+};
+
+/* DMTModes */
+
+static const struct hdmi_preset hdmi_conf_800x600p85 = {
+	.mode = {
+		.pixelclock = 56250000,
+		.h_as = 800, .h_sw = 64, .h_bp = 152, .h_fp = 32,
+		.v_as = 600, .v_sw = 3, .v_bp = 27, .v_fp = 1,
+		.refresh = 85,		/* 85.0613 */
+		.name = "800x600@85Hz",
+		.flags = 0
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1280x768p60 = {
+	.mode = {
+		.pixelclock = 79500000,
+		.h_as = 1280, .h_sw = 128, .h_bp = 192, .h_fp = 64,
+		.v_as = 768, .v_sw = 7, .v_bp = 20, .v_fp = 3,
+		.refresh = 60,		/* 59.8702 */
+		.name = "1280x768@60Hz",
+		.flags = RES_FIELD_NHSYNC
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1280x800p120 = {
+	.mode = {
+		.pixelclock = 146250000,
+		.h_as = 1280, .h_sw = 32, .h_bp = 80, .h_fp = 48,
+		.v_as = 800, .v_sw = 6, .v_bp = 38, .v_fp = 3,
+		.refresh = 120,		/* 119.909 */
+		.name = "1280x800@120Hz RB",
+		.flags = RES_FIELD_NVSYNC
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1280x960p85 = {
+	.mode = {
+		.pixelclock = 148500000,
+		.h_as = 1280, .h_sw = 160, .h_bp = 224, .h_fp = 64,
+		.v_as = 960, .v_sw = 3, .v_bp = 47, .v_fp = 1,
+		.refresh = 85,		/* 85.0025 */
+		.name = "1280x960@85Hz",
+		.flags = 0
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1280x1024p85 = {
+	.mode = {
+		.pixelclock = 157500000,
+		.h_as = 1280, .h_sw = 160, .h_bp = 224, .h_fp = 64,
+		.v_as = 1024, .v_sw = 3, .v_bp = 44, .v_fp = 1,
+		.refresh = 85,		/* 85.0241 */
+		.name = "1280x1024@85Hz",
+		.flags = 0
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1360x768p120 = {
+	.mode = {
+		.pixelclock = 148250000,
+		.h_as = 1360, .h_sw = 32, .h_bp = 80, .h_fp = 48,
+		.v_as = 768, .v_sw = 5, .v_bp = 37, .v_fp = 3,
+		.refresh = 120,		/* 119.967 */
+		.name = "1360x768@120Hz RB",
+		.flags = RES_FIELD_NVSYNC
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1400x1050p75 = {
+	.mode = {
+		.pixelclock = 156000000,
+		.h_as = 1400, .h_sw = 144, .h_bp = 248, .h_fp = 104,
+		.v_as = 1050, .v_sw = 4, .v_bp = 42, .v_fp = 3,
+		.refresh = 75,		/* 74.8667 */
+		.name = "1400x1050@75Hz",
+		.flags = RES_FIELD_NHSYNC
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1440x900p85 = {
+	.mode = {
+		.pixelclock = 157000000,
+		.h_as = 1440, .h_sw = 152, .h_bp = 256, .h_fp = 104,
+		.v_as = 900, .v_sw = 6, .v_bp = 39, .v_fp = 3,
+		.refresh = 85,		/* 84.8421 */
+		.name = "1440x900@85Hz",
+		.flags = RES_FIELD_NHSYNC
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1680x1050p60 = {
+	.mode = {
+		.pixelclock = 146250000,
+		.h_as = 1680, .h_sw = 176, .h_bp = 280, .h_fp = 104,
+		.v_as = 1050, .v_sw = 6, .v_bp = 30, .v_fp = 3,
+		.refresh = 60,		/* 59.9543 */
+		.name = "1680x1050@60Hz",
+		.flags = RES_FIELD_NHSYNC
+	}
+};
+
+static const struct hdmi_preset hdmi_conf_1920x1200p60 = {
+	.mode = {
+		.pixelclock = 154000000,
+		.h_as = 1920, .h_sw = 32, .h_bp = 80, .h_fp = 48,
+		.v_as = 1200, .v_sw = 6, .v_bp = 26, .v_fp = 3,
+		.refresh = 60,		/* 59.9502 */
+		.name = "1920x1200@60Hz RB",
+		.flags = RES_FIELD_NVSYNC
+	}
+};
+
+/*
+ * PHY preset data tables
+ */
+static const u8 hdmiphy_preset_25_2[32] = {
+	0x52, 0x3f, 0x55, 0x40, 0x01, 0x00, 0xc8, 0x82,
+	0xc8, 0xbd, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x01, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xf4, 0x24, 0x00, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_25_175[32] = {
+	0xd1, 0x1f, 0x50, 0x40, 0x20, 0x1e, 0xc8, 0x81,
+	0xe8, 0xbd, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xf4, 0x24, 0x00, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_27[32] = {
+	0xd1, 0x22, 0x51, 0x40, 0x08, 0xfc, 0xe0, 0x98,
+	0xe8, 0xcb, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xe4, 0x24, 0x00, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_27_027[32] = {
+	0xd1, 0x2d, 0x72, 0x40, 0x64, 0x12, 0xc8, 0x43,
+	0xe8, 0x0e, 0xd9, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xe3, 0x24, 0x00, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_54[32] = {
+	0x54, 0x2d, 0x35, 0x40, 0x01, 0x00, 0xc8, 0x82,
+	0xc8, 0x0e, 0xd9, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xe4, 0x24, 0x01, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_54_054[32] = {
+	0xd1, 0x2d, 0x32, 0x40, 0x64, 0x12, 0xc8, 0x43,
+	0xe8, 0x0e, 0xd9, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xe3, 0x24, 0x01, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_74_175[32] = {
+	0xd1, 0x1f, 0x10, 0x40, 0x5b, 0xef, 0xc8, 0x81,
+	0xe8, 0xb9, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xa6, 0x24, 0x01, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_74_25[32] = {
+	0xd1, 0x1f, 0x10, 0x40, 0x40, 0xf8, 0xc8, 0x81,
+	0xe8, 0xba, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x08,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0xa5, 0x24, 0x01, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_148_352[32] = {
+	0xd1, 0x1f, 0x00, 0x40, 0x5b, 0xef, 0xc8, 0x81,
+	0xe8, 0xb9, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x0a,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0x4b, 0x25, 0x03, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const u8 hdmiphy_preset_148_5[32] = {
+	0xd1, 0x1f, 0x00, 0x40, 0x40, 0xf8, 0xc8, 0x81,
+	0xe8, 0xba, 0xd8, 0x45, 0xa0, 0xac, 0x80, 0x08,
+	0x80, 0x09, 0x84, 0x05, 0x22, 0x24, 0x86, 0x54,
+	0x4b, 0x25, 0x03, 0x00, 0x00, 0x01, 0x80, 0x10,
+};
+
+static const struct hdmi_format _format_2d = {
+	.vformat = HDMI_VIDEO_FORMAT_2D,
+};
+
+const struct hdmi_conf hdmi_conf[] = {
+	/* CEAVideoModes */
+	{
+		.preset = &hdmi_conf_640x480p60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_25_175
+	}, {
+		.preset = &hdmi_conf_720x480p60_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_720x480p60_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1280x720p60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1920x1080i60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1440x480i60_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x480i60_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x240p60_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x240p60_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x480p60_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1440x480p60_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1920x1080p60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_720x576p50_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_720x576p50_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1280x720p50,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1920x1080i50,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1440x576i50_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x576i50_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x288p50_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x288p50_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_27
+	}, {
+		.preset = &hdmi_conf_1440x576p50_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1440x576p50_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1920x1080p50,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_1920x1080p24,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1920x1080p25,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1920x1080p30,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1920x1080i100,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_1280x720p100,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_720x576p100_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_720x576p100_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1440x576i100_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1440x576i100_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1920x1080i120,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_1280x720p120,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_720x480p120_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_720x480p120_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1440x480i120_4a3,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1440x480i120_16a9,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54
+	}, {
+		.preset = &hdmi_conf_1280x720p25,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	}, {
+		.preset = &hdmi_conf_1280x720p30,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25
+	},
+	/* DDCEstablishedModes */
+	{
+		.preset = &hdmi_conf_1024x768p70,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25		// hdmiphy_preset_75
+	},
+	/* DMTModes */
+	{
+		.preset = &hdmi_conf_800x600p85,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_54_054		// hdmiphy_preset_56_25
+	}, {
+		.preset = &hdmi_conf_1280x768p60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_74_25		// hdmiphy_preset_79_5
+	}, {
+		.preset = &hdmi_conf_1280x800p120,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_352		// hdmiphy_preset_146_25
+	}, {
+		.preset = &hdmi_conf_1280x960p85,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5
+	}, {
+		.preset = &hdmi_conf_1280x1024p85,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5		// hdmiphy_preset_157_5
+	}, {
+		.preset = &hdmi_conf_1360x768p120,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_352		// hdmiphy_preset_148_25
+	}, {
+		.preset = &hdmi_conf_1400x1050p75,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5		// hdmiphy_preset_156
+	}, {
+		.preset = &hdmi_conf_1440x900p85,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5		// hdmiphy_preset_157
+	}, {
+		.preset = &hdmi_conf_1680x1050p60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_352		// hdmiphy_preset_146_25
+	}, {
+		.preset = &hdmi_conf_1920x1200p60,
+		.format = &_format_2d,
+		.phy_data = hdmiphy_preset_148_5		// hdmiphy_preset_154
+	}
+};
+
+const int num_hdmi_presets = ARRAY_SIZE(hdmi_conf);
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.c b/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+static void __iomem *hdmi_io_base;
+
+void hdmi_set_base(void __iomem *base)
+{
+	hdmi_io_base = base;
+}
+
+void hdmi_write(u32 reg, u32 val)
+{
+	writel(val, hdmi_io_base + reg);
+}
+
+void hdmi_write_mask(u32 reg, u32 val, u32 mask)
+{
+	u32 old = readl(hdmi_io_base + reg);
+
+	val = (val & mask) | (old & ~mask);
+	writel(val, hdmi_io_base + reg);
+}
+
+void hdmi_writeb(u32 reg, u8 val)
+{
+	writeb(val, hdmi_io_base + reg);
+}
+
+void hdmi_write_bytes(u32 reg, u8 *buf, int bytes)
+{
+	int i;
+
+	for (i = 0; i < bytes; ++i)
+		writeb(buf[i], hdmi_io_base + reg + i * 4);
+}
+
+u32 hdmi_read(u32 reg)
+{
+	return readl(hdmi_io_base + reg);
+}
+
+u8 hdmi_readb(u32 reg)
+{
+	return readb(hdmi_io_base + reg);
+}
+
+void hdmi_read_bytes(u32 reg, u8 *buf, int bytes)
+{
+	int i;
+
+	for (i = 0; i < bytes; ++i)
+		buf[i] = readb(hdmi_io_base + reg + i * 4);
+}
+
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.h b/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_reg_hdmi.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,1006 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_REG_HDMI_H_
+#define _S5PXX18_REG_HDMI_H_
+
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_disptop.h"
+
+/*
+ * <s5p6818>
+ * HDMI PHY		: 0xC0000000 + 0f0000 = 0xC00f0000
+ * HDMI CEC...	: 0xC0000000 + 100000 = 0xC0100000
+ * HDMI LINK	: 0xC0000000 + 200000 = 0xC0200000
+ *
+ * <s5p4418>
+ * HDMI PHY		: 0xC0000000 + 100400 = 0xC0100400
+ * HDMI CEC...	: 0xC0000000 + 100000 = 0xC0100000
+ * HDMI LINK	: 0xC0000000 + 200000 = 0xC0200000
+ */
+#ifdef CONFIG_ARCH_S5P6818
+#define HDMI_PHY_OFFSET		0x000f0000
+#define HDMI_CEC_OFFSET     0x00100000
+#define HDMI_ADDR_OFFSET	0x00200000
+#else
+#define HDMI_PHY_OFFSET		0x00100400
+#define HDMI_CEC_OFFSET     0x00100000
+#define HDMI_ADDR_OFFSET	0x00200000
+#endif
+
+/*
+ * Register part
+ */
+#define HDMI_CTRL_BASE(x)	((x) + HDMI_ADDR_OFFSET)
+#define HDMI_CORE_BASE(x)	((x) + HDMI_ADDR_OFFSET + 0x00010000)
+#define HDMI_SPDIF_BASE(x)	((x) + HDMI_ADDR_OFFSET + 0x00030000)
+#define HDMI_I2S_BASE(x)	((x) + HDMI_ADDR_OFFSET + 0x00040000)
+
+#define HDMI_PHY_BASE(x)        ((x) + HDMI_PHY_OFFSET  + 0x00000000)
+#define HDMI_CEC_BASE(x)        ((x) + HDMI_CEC_OFFSET  + 0x00000000)
+#define HDMI_AES_BASE(x)        ((x) + HDMI_ADDR_OFFSET + 0x00020000)
+
+/* Control registers */
+#define HDMI_INTC_CON_0			HDMI_CTRL_BASE(0x0000)
+#define HDMI_INTC_FLAG_0		HDMI_CTRL_BASE(0x0004)
+#define HDMI_HDCP_KEY_LOAD		HDMI_CTRL_BASE(0x0008)
+#define HDMI_HPD_STATUS			HDMI_CTRL_BASE(0x000C)
+#define HDMI_INTC_CON_1			HDMI_CTRL_BASE(0x0010)
+#define HDMI_INTC_FLAG_1		HDMI_CTRL_BASE(0x0014)
+#define HDMI_PHY_STATUS_0		HDMI_CTRL_BASE(0x0020)
+#define HDMI_PHY_STATUS_PLL		HDMI_CTRL_BASE(0x0028)
+#define HDMI_PHY_CON_0			HDMI_CTRL_BASE(0x0030)
+#define HDMI_HPD_CTRL			HDMI_CTRL_BASE(0x0040)
+#define HDMI_HPD			HDMI_CTRL_BASE(0x0044)
+#define HDMI_HPD_TH_(n)			HDMI_CTRL_BASE(0x0050 + 4*(n))
+
+/* Core registers */
+#define HDMI_CON_0			HDMI_CORE_BASE(0x000)
+#define HDMI_CON_1			HDMI_CORE_BASE(0x004)
+#define HDMI_CON_2			HDMI_CORE_BASE(0x008)
+#define HDMI_STATUS			HDMI_CORE_BASE(0x010)
+#define HDMI_STATUS_EN			HDMI_CORE_BASE(0x020)
+#define HDMI_HDCP_SHA1_REN0		HDMI_CORE_BASE(0x024)
+#define HDMI_HDCP_SHA1_REN1		HDMI_CORE_BASE(0x028)
+#define HDMI_MODE_SEL			HDMI_CORE_BASE(0x040)
+#define HDMI_ENC_EN			HDMI_CORE_BASE(0x044)
+#define HDMI_YMAX			HDMI_CORE_BASE(0x060)
+#define HDMI_YMIN			HDMI_CORE_BASE(0x064)
+#define HDMI_CMAX			HDMI_CORE_BASE(0x068)
+#define HDMI_CMIN			HDMI_CORE_BASE(0x06C)
+#define HDMI_H_BLANK_0			HDMI_CORE_BASE(0x0A0)
+#define HDMI_H_BLANK_1			HDMI_CORE_BASE(0x0A4)
+#define HDMI_V2_BLANK_0			HDMI_CORE_BASE(0x0B0)
+#define HDMI_V2_BLANK_1			HDMI_CORE_BASE(0x0B4)
+#define HDMI_V1_BLANK_0			HDMI_CORE_BASE(0x0B8)
+#define HDMI_V1_BLANK_1			HDMI_CORE_BASE(0x0BC)
+#define HDMI_V_LINE_0			HDMI_CORE_BASE(0x0C0)
+#define HDMI_V_LINE_1			HDMI_CORE_BASE(0x0C4)
+#define HDMI_H_LINE_0			HDMI_CORE_BASE(0x0C8)
+#define HDMI_H_LINE_1			HDMI_CORE_BASE(0x0CC)
+#define HDMI_HSYNC_POL			HDMI_CORE_BASE(0x0E0)
+#define HDMI_VSYNC_POL			HDMI_CORE_BASE(0x0E4)
+#define HDMI_INT_PRO_MODE		HDMI_CORE_BASE(0x0E8)
+#define HDMI_SEND_START_0		HDMI_CORE_BASE(0x0F0)
+#define HDMI_SEND_START_1		HDMI_CORE_BASE(0x0F4)
+#define HDMI_SEND_END_0			HDMI_CORE_BASE(0x100)
+#define HDMI_SEND_END_1			HDMI_CORE_BASE(0x104)
+#define HDMI_SEND_END_2			HDMI_CORE_BASE(0x108)
+#define HDMI_V_BLANK_F0_0		HDMI_CORE_BASE(0x110)
+#define HDMI_V_BLANK_F0_1		HDMI_CORE_BASE(0x114)
+#define HDMI_V_BLANK_F1_0		HDMI_CORE_BASE(0x118)
+#define HDMI_V_BLANK_F1_1		HDMI_CORE_BASE(0x11C)
+#define HDMI_H_SYNC_START_0		HDMI_CORE_BASE(0x120)
+#define HDMI_H_SYNC_START_1		HDMI_CORE_BASE(0x124)
+#define HDMI_H_SYNC_END_0		HDMI_CORE_BASE(0x128)
+#define HDMI_H_SYNC_END_1		HDMI_CORE_BASE(0x12C)
+#define HDMI_V_SYNC_LINE_BEF_2_0	HDMI_CORE_BASE(0x130)
+#define HDMI_V_SYNC_LINE_BEF_2_1	HDMI_CORE_BASE(0x134)
+#define HDMI_V_SYNC_LINE_BEF_1_0	HDMI_CORE_BASE(0x138)
+#define HDMI_V_SYNC_LINE_BEF_1_1	HDMI_CORE_BASE(0x13C)
+#define HDMI_V_SYNC_LINE_AFT_2_0	HDMI_CORE_BASE(0x140)
+#define HDMI_V_SYNC_LINE_AFT_2_1	HDMI_CORE_BASE(0x144)
+#define HDMI_V_SYNC_LINE_AFT_1_0	HDMI_CORE_BASE(0x148)
+#define HDMI_V_SYNC_LINE_AFT_1_1	HDMI_CORE_BASE(0x14C)
+#define HDMI_V_SYNC_LINE_AFT_PXL_2_0	HDMI_CORE_BASE(0x150)
+#define HDMI_V_SYNC_LINE_AFT_PXL_2_1	HDMI_CORE_BASE(0x154)
+#define HDMI_V_SYNC_LINE_AFT_PXL_1_0	HDMI_CORE_BASE(0x158)
+#define HDMI_V_SYNC_LINE_AFT_PXL_1_1	HDMI_CORE_BASE(0x15C)
+#define HDMI_V_BLANK_F2_0		HDMI_CORE_BASE(0x160)
+#define HDMI_V_BLANK_F2_1		HDMI_CORE_BASE(0x164)
+#define HDMI_V_BLANK_F3_0		HDMI_CORE_BASE(0x168)
+#define HDMI_V_BLANK_F3_1		HDMI_CORE_BASE(0x16C)
+#define HDMI_V_BLANK_F4_0		HDMI_CORE_BASE(0x170)
+#define HDMI_V_BLANK_F4_1		HDMI_CORE_BASE(0x174)
+#define HDMI_V_BLANK_F5_0		HDMI_CORE_BASE(0x178)
+#define HDMI_V_BLANK_F5_1		HDMI_CORE_BASE(0x17C)
+#define HDMI_V_SYNC_LINE_AFT_3_0	HDMI_CORE_BASE(0x180)
+#define HDMI_V_SYNC_LINE_AFT_3_1	HDMI_CORE_BASE(0x184)
+#define HDMI_V_SYNC_LINE_AFT_4_0	HDMI_CORE_BASE(0x188)
+#define HDMI_V_SYNC_LINE_AFT_4_1	HDMI_CORE_BASE(0x18C)
+#define HDMI_V_SYNC_LINE_AFT_5_0	HDMI_CORE_BASE(0x190)
+#define HDMI_V_SYNC_LINE_AFT_5_1	HDMI_CORE_BASE(0x194)
+#define HDMI_V_SYNC_LINE_AFT_6_0	HDMI_CORE_BASE(0x198)
+#define HDMI_V_SYNC_LINE_AFT_6_1	HDMI_CORE_BASE(0x19C)
+#define HDMI_V_SYNC_LINE_AFT_PXL_3_0	HDMI_CORE_BASE(0x1A0)
+#define HDMI_V_SYNC_LINE_AFT_PXL_3_1	HDMI_CORE_BASE(0x1A4)
+#define HDMI_V_SYNC_LINE_AFT_PXL_4_0	HDMI_CORE_BASE(0x1A8)
+#define HDMI_V_SYNC_LINE_AFT_PXL_4_1	HDMI_CORE_BASE(0x1AC)
+#define HDMI_V_SYNC_LINE_AFT_PXL_5_0	HDMI_CORE_BASE(0x1B0)
+#define HDMI_V_SYNC_LINE_AFT_PXL_5_1	HDMI_CORE_BASE(0x1B4)
+#define HDMI_V_SYNC_LINE_AFT_PXL_6_0	HDMI_CORE_BASE(0x1B8)
+#define HDMI_V_SYNC_LINE_AFT_PXL_6_1	HDMI_CORE_BASE(0x1BC)
+#define HDMI_VACT_SPACE_1_0		HDMI_CORE_BASE(0x1C0)
+#define HDMI_VACT_SPACE_1_1		HDMI_CORE_BASE(0x1C4)
+#define HDMI_VACT_SPACE_2_0		HDMI_CORE_BASE(0x1C8)
+#define HDMI_VACT_SPACE_2_1		HDMI_CORE_BASE(0x1CC)
+#define HDMI_VACT_SPACE_3_0		HDMI_CORE_BASE(0x1D0)
+#define HDMI_VACT_SPACE_3_1		HDMI_CORE_BASE(0x1D4)
+#define HDMI_VACT_SPACE_4_0		HDMI_CORE_BASE(0x1D8)
+#define HDMI_VACT_SPACE_4_1		HDMI_CORE_BASE(0x1DC)
+#define HDMI_VACT_SPACE_5_0		HDMI_CORE_BASE(0x1E0)
+#define HDMI_VACT_SPACE_5_1		HDMI_CORE_BASE(0x1E4)
+#define HDMI_VACT_SPACE_6_0		HDMI_CORE_BASE(0x1E8)
+#define HDMI_VACT_SPACE_6_1		HDMI_CORE_BASE(0x1EC)
+#define HDMI_CSC_MUX			HDMI_CORE_BASE(0x1F0)
+#define HDMI_SYNC_GEN_MUX		HDMI_CORE_BASE(0x1F4)
+#define HDMI_GCP_CON			HDMI_CORE_BASE(0x200)
+#define HDMI_GCP_CON_EX		HDMI_CORE_BASE(0x204)
+#define HDMI_GCP_BYTE1		HDMI_CORE_BASE(0x210)
+#define HDMI_GCP_BYTE2		HDMI_CORE_BASE(0x214)
+#define HDMI_GCP_BYTE3		HDMI_CORE_BASE(0x218)
+#define HDMI_ASP_CON		HDMI_CORE_BASE(0x300)
+#define HDMI_ASP_SP_FLAT	HDMI_CORE_BASE(0x304)
+#define HDMI_ASP_CHCFG0		HDMI_CORE_BASE(0x310)
+#define HDMI_ASP_CHCFG1		HDMI_CORE_BASE(0x314)
+#define HDMI_ASP_CHCFG2		HDMI_CORE_BASE(0x318)
+#define HDMI_ASP_CHCFG3		HDMI_CORE_BASE(0x31c)
+#define HDMI_ACR_CON		HDMI_CORE_BASE(0x400)
+#define HDMI_ACR_MCTS0		HDMI_CORE_BASE(0x410)
+#define HDMI_ACR_MCTS1		HDMI_CORE_BASE(0x414)
+#define HDMI_ACR_MCTS2		HDMI_CORE_BASE(0x418)
+#define HDMI_ACR_CTS0		HDMI_CORE_BASE(0x420)
+#define HDMI_ACR_CTS1		HDMI_CORE_BASE(0x424)
+#define HDMI_ACR_CTS2		HDMI_CORE_BASE(0x428)
+#define HDMI_ACR_N0		HDMI_CORE_BASE(0x430)
+#define HDMI_ACR_N1		HDMI_CORE_BASE(0x434)
+#define HDMI_ACR_N2		HDMI_CORE_BASE(0x438)
+#define HDMI_ACR_LSB2		HDMI_CORE_BASE(0x440)
+#define HDMI_ACR_TXCNT		HDMI_CORE_BASE(0x444)
+#define HDMI_ACR_TXINTERNAL	HDMI_CORE_BASE(0x448)
+#define HDMI_ACR_CTS_OFFSET	HDMI_CORE_BASE(0x44C)
+#define HDMI_ACP_CON		HDMI_CORE_BASE(0x500)
+#define HDMI_ACP_TYPE		HDMI_CORE_BASE(0x514)
+#define HDMI_ACP_DATA(n)	HDMI_CORE_BASE(0x520 + 4 * (n))
+#define HDMI_ISRC_CON		HDMI_CORE_BASE(0x600)
+#define HDMI_ISRC1_HEADER1	HDMI_CORE_BASE(0x614)
+#define HDMI_ISRC1_DATA(n)	HDMI_CORE_BASE(0x620 + 4 * (n))
+#define HDMI_ISRC2_DATA(n)	HDMI_CORE_BASE(0x6A0 + 4 * (n))
+#define HDMI_AVI_CON		HDMI_CORE_BASE(0x700)
+#define HDMI_AVI_HEADER0	HDMI_CORE_BASE(0x710)
+#define HDMI_AVI_HEADER1	HDMI_CORE_BASE(0x714)
+#define HDMI_AVI_HEADER2	HDMI_CORE_BASE(0x718)
+#define HDMI_AVI_CHECK_SUM	HDMI_CORE_BASE(0x71C)
+#define HDMI_AVI_BYTE(n)	HDMI_CORE_BASE(0x720 + 4 * (n - 1))
+#define HDMI_AUI_CON		HDMI_CORE_BASE(0x800)
+#define HDMI_AUI_HEADER0	HDMI_CORE_BASE(0x810)
+#define HDMI_AUI_HEADER1	HDMI_CORE_BASE(0x814)
+#define HDMI_AUI_HEADER2	HDMI_CORE_BASE(0x818)
+#define HDMI_AUI_CHECK_SUM	HDMI_CORE_BASE(0x81C)
+#define HDMI_AUI_BYTE(n)	HDMI_CORE_BASE(0x820 + 4 * (n - 1))
+#define HDMI_MPG_CON		HDMI_CORE_BASE(0x900)
+#define HDMI_MPG_CHECK_SUM	HDMI_CORE_BASE(0x91C)
+#define HDMI_MPG_BYTE(n)	HDMI_CORE_BASE(0x920 + 4 * (n - 1))
+#define HDMI_SPD_CON		HDMI_CORE_BASE(0xA00)
+#define HDMI_SPD_HEADER0	HDMI_CORE_BASE(0xA10)
+#define HDMI_SPD_HEADER1	HDMI_CORE_BASE(0xA14)
+#define HDMI_SPD_HEADER2	HDMI_CORE_BASE(0xA18)
+#define HDMI_SPD_DATA0(n)	HDMI_CORE_BASE(0xA20 + 4 * (n))
+#define HDMI_GAMUT_CON		HDMI_CORE_BASE(0xB00)
+#define HDMI_GAMUT_HEADER0	HDMI_CORE_BASE(0xB10)
+#define HDMI_GAMUT_HEADER1	HDMI_CORE_BASE(0xB14)
+#define HDMI_GAMUT_HEADER2	HDMI_CORE_BASE(0xB18)
+#define HDMI_GAMUT_METADATA(n)	HDMI_CORE_BASE(0xB20 + 4 * (n))
+#define HDMI_VSI_CON		HDMI_CORE_BASE(0xC00)
+#define HDMI_VSI_HEADER0	HDMI_CORE_BASE(0xC10)
+#define HDMI_VSI_HEADER1	HDMI_CORE_BASE(0xC14)
+#define HDMI_VSI_HEADER2	HDMI_CORE_BASE(0xC18)
+#define HDMI_VSI_DATA(n)	HDMI_CORE_BASE(0xC20 + 4 * (n))
+#define HDMI_DC_CONTROL		HDMI_CORE_BASE(0xD00)
+#define HDMI_VIDEO_PATTERN_GEN	HDMI_CORE_BASE(0xD04)
+#define HDMI_HPD_GEN0		HDMI_CORE_BASE(0xD08)
+#define HDMI_HPD_GEN1		HDMI_CORE_BASE(0xD0C)
+#define HDMI_HPD_GEN2		HDMI_CORE_BASE(0xD10)
+#define HDMI_HPD_GEN3		HDMI_CORE_BASE(0xD14)
+#define HDMI_DIM_CON		HDMI_CORE_BASE(0xD30)
+#define HDMI_AN_SEED_SEL        HDMI_CORE_BASE(0xE48)
+#define HDMI_AN_SEED_0          HDMI_CORE_BASE(0xE58)
+#define HDMI_AN_SEED_1          HDMI_CORE_BASE(0xE5C)
+#define HDMI_AN_SEED_2          HDMI_CORE_BASE(0xE60)
+#define HDMI_AN_SEED_3          HDMI_CORE_BASE(0xE64)
+
+#define HDMI_HDCP_SHA1_(n)	HDMI_CORE_BASE(0x7000 + 4 * (n))
+#define HDMI_HDCP_KSV_LIST_(n)	HDMI_CORE_BASE(0x7050 + 4 * (n))
+#define HDMI_HDCP_KSV_LIST_CON	HDMI_CORE_BASE(0x7064)
+#define HDMI_HDCP_SHA_RESULT	HDMI_CORE_BASE(0x7070)
+#define HDMI_HDCP_CTRL1		HDMI_CORE_BASE(0x7080)
+#define HDMI_HDCP_CTRL2		HDMI_CORE_BASE(0x7084)
+#define HDMI_HDCP_CHECK_RESULT	HDMI_CORE_BASE(0x7090)
+#define HDMI_HDCP_BKSV_(n)	HDMI_CORE_BASE(0x70A0 + 4 * (n))
+#define HDMI_HDCP_AKSV_(n)	HDMI_CORE_BASE(0x70C0 + 4 * (n))
+#define HDMI_HDCP_AN_(n)	HDMI_CORE_BASE(0x70E0 + 4 * (n))
+
+#define HDMI_HDCP_BCAPS			HDMI_CORE_BASE(0x7100)
+#define HDMI_HDCP_BSTATUS_0		HDMI_CORE_BASE(0x7110)
+#define HDMI_HDCP_BSTATUS_1		HDMI_CORE_BASE(0x7114)
+#define HDMI_HDCP_RI_0			HDMI_CORE_BASE(0x7140)
+#define HDMI_HDCP_RI_1			HDMI_CORE_BASE(0x7144)
+#define HDMI_HDCP_OFFSET_TX_0		HDMI_CORE_BASE(0x7160)
+#define HDMI_HDCP_OFFSET_TX_1		HDMI_CORE_BASE(0x7164)
+#define HDMI_HDCP_OFFSET_TX_2		HDMI_CORE_BASE(0x7168)
+#define HDMI_HDCP_OFFSET_TX_3		HDMI_CORE_BASE(0x716C)
+#define HDMI_HDCP_CYCLE_AA		HDMI_CORE_BASE(0x7170)
+#define HDMI_HDCP_I2C_INT		HDMI_CORE_BASE(0x7180)
+#define HDMI_HDCP_AN_INT		HDMI_CORE_BASE(0x7190)
+#define HDMI_HDCP_WDT_INT		HDMI_CORE_BASE(0x71a0)
+#define HDMI_HDCP_RI_INT		HDMI_CORE_BASE(0x71b0)
+#define HDMI_HDCP_RI_COMPARE_0		HDMI_CORE_BASE(0x71d0)
+#define HDMI_HDCP_RI_COMPARE_1		HDMI_CORE_BASE(0x71d4)
+#define HDMI_HDCP_FRAME_COUNT		HDMI_CORE_BASE(0x71e0)
+
+#define HDMI_RGB_ROUND_EN	HDMI_CORE_BASE(0xD500)
+#define HDMI_VACT_SPACE_R_0	HDMI_CORE_BASE(0xD504)
+#define HDMI_VACT_SPACE_R_1	HDMI_CORE_BASE(0xD508)
+
+#define HDMI_VACT_SPACE_G_0				HDMI_CORE_BASE(0xD50C)
+#define HDMI_VACT_SPACE_G_1				HDMI_CORE_BASE(0xD510)
+
+#define HDMI_VACT_SPACE_B_0				HDMI_CORE_BASE(0xD514)
+#define HDMI_VACT_SPACE_B_1				HDMI_CORE_BASE(0xD518)
+
+#define HDMI_BLUE_SCREEN_B_0			HDMI_CORE_BASE(0xD520)
+#define HDMI_BLUE_SCREEN_B_1			HDMI_CORE_BASE(0xD524)
+#define HDMI_BLUE_SCREEN_G_0			HDMI_CORE_BASE(0xD528)
+#define HDMI_BLUE_SCREEN_G_1			HDMI_CORE_BASE(0xD52C)
+#define HDMI_BLUE_SCREEN_R_0			HDMI_CORE_BASE(0xD530)
+#define HDMI_BLUE_SCREEN_R_1			HDMI_CORE_BASE(0xD534)
+
+#define HDMI_SPDIFIN_CLK_CTRL			HDMI_SPDIF_BASE(0x000)
+#define HDMI_SPDIFIN_OP_CTRL			HDMI_SPDIF_BASE(0x004)
+#define HDMI_SPDIFIN_IRQ_MASK			HDMI_SPDIF_BASE(0x008)
+#define HDMI_SPDIFIN_IRQ_STATUS			HDMI_SPDIF_BASE(0x00c)
+#define HDMI_SPDIFIN_CONFIG_1			HDMI_SPDIF_BASE(0x010)
+#define HDMI_SPDIFIN_CONFIG_2			HDMI_SPDIF_BASE(0x014)
+#define HDMI_SPDIFIN_USER_VALUE_1		HDMI_SPDIF_BASE(0x020)
+#define HDMI_SPDIFIN_USER_VALUE_2		HDMI_SPDIF_BASE(0x024)
+#define HDMI_SPDIFIN_USER_VALUE_3		HDMI_SPDIF_BASE(0x028)
+#define HDMI_SPDIFIN_USER_VALUE_4		HDMI_SPDIF_BASE(0x02c)
+#define HDMI_SPDIFIN_CH_STATUS_0_1		HDMI_SPDIF_BASE(0x030)
+#define HDMI_SPDIFIN_CH_STATUS_0_2		HDMI_SPDIF_BASE(0x034)
+#define HDMI_SPDIFIN_CH_STATUS_0_3		HDMI_SPDIF_BASE(0x038)
+#define HDMI_SPDIFIN_CH_STATUS_0_4		HDMI_SPDIF_BASE(0x03c)
+#define HDMI_SPDIFIN_CH_STATUS_1		HDMI_SPDIF_BASE(0x040)
+#define HDMI_SPDIFIN_FRAME_PERIOD_1		HDMI_SPDIF_BASE(0x048)
+#define HDMI_SPDIFIN_FRAME_PERIOD_2		HDMI_SPDIF_BASE(0x04c)
+#define HDMI_SPDIFIN_PC_INFO_1			HDMI_SPDIF_BASE(0x050)
+#define HDMI_SPDIFIN_PC_INFO_2			HDMI_SPDIF_BASE(0x054)
+#define HDMI_SPDIFIN_PD_INFO_1			HDMI_SPDIF_BASE(0x058)
+#define HDMI_SPDIFIN_PD_INFO_2			HDMI_SPDIF_BASE(0x05c)
+#define HDMI_SPDIFIN_DATA_BUF_0_1		HDMI_SPDIF_BASE(0x060)
+#define HDMI_SPDIFIN_DATA_BUF_0_2		HDMI_SPDIF_BASE(0x064)
+#define HDMI_SPDIFIN_DATA_BUF_0_3		HDMI_SPDIF_BASE(0x068)
+#define HDMI_SPDIFIN_USER_BUF_0			HDMI_SPDIF_BASE(0x06c)
+#define HDMI_SPDIFIN_DATA_BUF_1_1		HDMI_SPDIF_BASE(0x070)
+#define HDMI_SPDIFIN_DATA_BUF_1_2		HDMI_SPDIF_BASE(0x074)
+#define HDMI_SPDIFIN_DATA_BUF_1_3		HDMI_SPDIF_BASE(0x078)
+#define HDMI_SPDIFIN_USER_BUF_1			HDMI_SPDIF_BASE(0x07c)
+
+#define HDMI_I2S_CLK_CON				HDMI_I2S_BASE(0x000)
+#define HDMI_I2S_CON_1					HDMI_I2S_BASE(0x004)
+#define HDMI_I2S_CON_2					HDMI_I2S_BASE(0x008)
+#define HDMI_I2S_PIN_SEL_0				HDMI_I2S_BASE(0x00c)
+#define HDMI_I2S_PIN_SEL_1				HDMI_I2S_BASE(0x010)
+#define HDMI_I2S_PIN_SEL_2				HDMI_I2S_BASE(0x014)
+#define HDMI_I2S_PIN_SEL_3				HDMI_I2S_BASE(0x018)
+#define HDMI_I2S_DSD_CON				HDMI_I2S_BASE(0x01c)
+#define HDMI_I2S_IN_MUX_CON				HDMI_I2S_BASE(0x020)
+#define HDMI_I2S_CH_ST_CON				HDMI_I2S_BASE(0x024)
+#define HDMI_I2S_CH_ST_0				HDMI_I2S_BASE(0x028)
+#define HDMI_I2S_CH_ST_1				HDMI_I2S_BASE(0x02c)
+#define HDMI_I2S_CH_ST_2				HDMI_I2S_BASE(0x030)
+#define HDMI_I2S_CH_ST_3				HDMI_I2S_BASE(0x034)
+#define HDMI_I2S_CH_ST_4				HDMI_I2S_BASE(0x038)
+#define HDMI_I2S_CH_ST_SH_0				HDMI_I2S_BASE(0x03c)
+#define HDMI_I2S_CH_ST_SH_1				HDMI_I2S_BASE(0x040)
+#define HDMI_I2S_CH_ST_SH_2				HDMI_I2S_BASE(0x044)
+#define HDMI_I2S_CH_ST_SH_3				HDMI_I2S_BASE(0x048)
+#define HDMI_I2S_CH_ST_SH_4				HDMI_I2S_BASE(0x04c)
+#define HDMI_I2S_VD_DATA				HDMI_I2S_BASE(0x050)
+#define HDMI_I2S_MUX_CH					HDMI_I2S_BASE(0x054)
+#define HDMI_I2S_MUX_CUV				HDMI_I2S_BASE(0x058)
+#define HDMI_I2S_IRQ_MASK				HDMI_I2S_BASE(0x05c)
+#define HDMI_I2S_IRQ_STATUS				HDMI_I2S_BASE(0x060)
+
+#define HDMI_I2S_CH0_L_0				HDMI_I2S_BASE(0x0064)
+#define HDMI_I2S_CH0_L_1				HDMI_I2S_BASE(0x0068)
+#define HDMI_I2S_CH0_L_2				HDMI_I2S_BASE(0x006C)
+#define HDMI_I2S_CH0_L_3				HDMI_I2S_BASE(0x0070)
+#define HDMI_I2S_CH0_R_0				HDMI_I2S_BASE(0x0074)
+#define HDMI_I2S_CH0_R_1				HDMI_I2S_BASE(0x0078)
+#define HDMI_I2S_CH0_R_2				HDMI_I2S_BASE(0x007C)
+#define HDMI_I2S_CH0_R_3				HDMI_I2S_BASE(0x0080)
+#define HDMI_I2S_CH1_L_0				HDMI_I2S_BASE(0x0084)
+#define HDMI_I2S_CH1_L_1				HDMI_I2S_BASE(0x0088)
+#define HDMI_I2S_CH1_L_2				HDMI_I2S_BASE(0x008C)
+#define HDMI_I2S_CH1_L_3				HDMI_I2S_BASE(0x0090)
+#define HDMI_I2S_CH1_R_0				HDMI_I2S_BASE(0x0094)
+#define HDMI_I2S_CH1_R_1				HDMI_I2S_BASE(0x0098)
+#define HDMI_I2S_CH1_R_2				HDMI_I2S_BASE(0x009C)
+#define HDMI_I2S_CH1_R_3				HDMI_I2S_BASE(0x00A0)
+#define HDMI_I2S_CH2_L_0				HDMI_I2S_BASE(0x00A4)
+#define HDMI_I2S_CH2_L_1				HDMI_I2S_BASE(0x00A8)
+#define HDMI_I2S_CH2_L_2				HDMI_I2S_BASE(0x00AC)
+#define HDMI_I2S_CH2_L_3				HDMI_I2S_BASE(0x00B0)
+#define HDMI_I2S_CH2_R_0				HDMI_I2S_BASE(0x00B4)
+#define HDMI_I2S_CH2_R_1				HDMI_I2S_BASE(0x00B8)
+#define HDMI_I2S_CH2_R_2				HDMI_I2S_BASE(0x00BC)
+#define HDMI_I2S_Ch2_R_3				HDMI_I2S_BASE(0x00C0)
+#define HDMI_I2S_CH3_L_0				HDMI_I2S_BASE(0x00C4)
+#define HDMI_I2S_CH3_L_1				HDMI_I2S_BASE(0x00C8)
+#define HDMI_I2S_CH3_L_2				HDMI_I2S_BASE(0x00CC)
+#define HDMI_I2S_CH3_R_0				HDMI_I2S_BASE(0x00D0)
+#define HDMI_I2S_CH3_R_1				HDMI_I2S_BASE(0x00D4)
+#define HDMI_I2S_CH3_R_2				HDMI_I2S_BASE(0x00D8)
+#define HDMI_I2S_CUV_L_R				HDMI_I2S_BASE(0x00DC)
+
+#define HDMI_CEC_TX_STAT_0			HDMI_CEC_BASE(0x0000)
+#define HDMI_CEC_TX_STAT_1			HDMI_CEC_BASE(0x0004)
+#define HDMI_CEC_RX_STAT_0			HDMI_CEC_BASE(0x0008)
+#define HDMI_CEC_RX_STAT_1			HDMI_CEC_BASE(0x000C)
+#define HDMI_CEC_IRQ_MASK			HDMI_CEC_BASE(0x0010)
+#define HDMI_CEC_IRQ_CLEA			HDMI_CEC_BASE(0x0014)
+#define HDMI_CEC_LOGIC_ADDRESS			HDMI_CEC_BASE(0x0020)
+#define HDMI_CEC_CLK_DIVISOR_0			HDMI_CEC_BASE(0x0030)
+#define HDMI_CEC_CLK_DIVISOR_1			HDMI_CEC_BASE(0x0034)
+#define HDMI_CEC_CLK_DIVISOR_2			HDMI_CEC_BASE(0x0038)
+#define HDMI_CEC_CLK_DIVISOR_3			HDMI_CEC_BASE(0x003C)
+
+#define HDMI_CEC_TX_CONTROL			HDMI_CEC_BASE(0x0040)
+#define HDMI_CEC_TX_BYTES			HDMI_CEC_BASE(0x0044)
+#define HDMI_CEC_TX_STAT_2			HDMI_CEC_BASE(0x0060)
+#define HDMI_CEC_TX_STAT_3			HDMI_CEC_BASE(0x0064)
+#define HDMI_CEC_TX_BUFF0			HDMI_CEC_BASE(0x0080)
+#define HDMI_CEC_TX_BUFF1			HDMI_CEC_BASE(0x0084)
+#define HDMI_CEC_TX_BUFF2			HDMI_CEC_BASE(0x0088)
+#define HDMI_CEC_TX_BUFF3			HDMI_CEC_BASE(0x008C)
+#define HDMI_CEC_TX_BUFF4			HDMI_CEC_BASE(0x0090)
+#define HDMI_CEC_TX_BUFF5			HDMI_CEC_BASE(0x0094)
+#define HDMI_CEC_TX_BUFF6			HDMI_CEC_BASE(0x0098)
+#define HDMI_CEC_TX_BUFF7			HDMI_CEC_BASE(0x009C)
+#define HDMI_CEC_TX_BUFF8			HDMI_CEC_BASE(0x00A0)
+#define HDMI_CEC_TX_BUFF9			HDMI_CEC_BASE(0x00A4)
+#define HDMI_CEC_TX_BUFF10			HDMI_CEC_BASE(0x00A8)
+#define HDMI_CEC_TX_BUFF11			HDMI_CEC_BASE(0x00AC)
+#define HDMI_CEC_TX_BUFF12			HDMI_CEC_BASE(0x00B0)
+#define HDMI_CEC_TX_BUFF13			HDMI_CEC_BASE(0x00B4)
+#define HDMI_CEC_TX_BUFF14			HDMI_CEC_BASE(0x00B8)
+#define HDMI_CEC_TX_BUFF15			HDMI_CEC_BASE(0x00BC)
+
+#define HDMI_CEC_RX_CONTROL			HDMI_CEC_BASE(0x00C0)
+#define HDMI_CEC_RX_STAT_2			HDMI_CEC_BASE(0x00E0)
+#define HDMI_CEC_RX_STAT_3			HDMI_CEC_BASE(0x00E4)
+#define HDMI_CEC_RX_BUFF0			HDMI_CEC_BASE(0x0100)
+#define HDMI_CEC_RX_BUFF1			HDMI_CEC_BASE(0x0104)
+#define HDMI_CEC_RX_BUFF2			HDMI_CEC_BASE(0x0108)
+#define HDMI_CEC_RX_BUFF3			HDMI_CEC_BASE(0x010C)
+#define HDMI_CEC_RX_BUFF4			HDMI_CEC_BASE(0x0110)
+#define HDMI_CEC_RX_BUFF5			HDMI_CEC_BASE(0x0114)
+#define HDMI_CEC_RX_BUFF6			HDMI_CEC_BASE(0x0118)
+#define HDMI_CEC_RX_BUFF7			HDMI_CEC_BASE(0x011C)
+#define HDMI_CEC_RX_BUFF8			HDMI_CEC_BASE(0x0120)
+#define HDMI_CEC_RX_BUFF9			HDMI_CEC_BASE(0x0124)
+#define HDMI_CEC_RX_BUFF10			HDMI_CEC_BASE(0x0128)
+#define HDMI_CEC_RX_BUFF11			HDMI_CEC_BASE(0x012C)
+#define HDMI_CEC_RX_BUFF12			HDMI_CEC_BASE(0x0130)
+#define HDMI_CEC_RX_BUFF13			HDMI_CEC_BASE(0x0134)
+#define HDMI_CEC_RX_BUFF14			HDMI_CEC_BASE(0x0138)
+#define HDMI_CEC_RX_BUFF15			HDMI_CEC_BASE(0x013C)
+
+#define HDMI_CEC_RX_FILTER_CTRL		HDMI_CEC_BASE(0x0180)
+#define HDMI_CEC_RX_FILTER_TH		HDMI_CEC_BASE(0x0184)
+
+/* AES */
+#define HDMI_AES_START			HDMI_AES_BASE(0x0000)
+#define HDMI_AES_SIZE_L			HDMI_AES_BASE(0x0020)
+#define HDMI_AES_SIZE_H			HDMI_AES_BASE(0x0024)
+#define HDMI_AES_DATA			HDMI_AES_BASE(0x0040)
+
+/* PHY registers */
+#define HDMI_PHY_REG00              HDMI_PHY_BASE(0x0000)
+#define HDMI_PHY_REG04              HDMI_PHY_BASE(0x0004)
+#define HDMI_PHY_REG08              HDMI_PHY_BASE(0x0008)
+#define HDMI_PHY_REG0C              HDMI_PHY_BASE(0x000C)
+#define HDMI_PHY_REG10              HDMI_PHY_BASE(0x0010)
+#define HDMI_PHY_REG14              HDMI_PHY_BASE(0x0014)
+#define HDMI_PHY_REG18              HDMI_PHY_BASE(0x0018)
+#define HDMI_PHY_REG1C              HDMI_PHY_BASE(0x001C)
+#define HDMI_PHY_REG20              HDMI_PHY_BASE(0x0020)
+#define HDMI_PHY_REG24              HDMI_PHY_BASE(0x0024)
+#define HDMI_PHY_REG28              HDMI_PHY_BASE(0x0028)
+#define HDMI_PHY_REG2C              HDMI_PHY_BASE(0x002C)
+#define HDMI_PHY_REG30              HDMI_PHY_BASE(0x0030)
+#define HDMI_PHY_REG34              HDMI_PHY_BASE(0x0034)
+#define HDMI_PHY_REG38              HDMI_PHY_BASE(0x0038)
+#define HDMI_PHY_REG3C              HDMI_PHY_BASE(0x003C)
+#define HDMI_PHY_REG40              HDMI_PHY_BASE(0x0040)
+#define HDMI_PHY_REG44              HDMI_PHY_BASE(0x0044)
+#define HDMI_PHY_REG48              HDMI_PHY_BASE(0x0048)
+#define HDMI_PHY_REG4C              HDMI_PHY_BASE(0x004C)
+#define HDMI_PHY_REG50              HDMI_PHY_BASE(0x0050)
+#define HDMI_PHY_REG54              HDMI_PHY_BASE(0x0054)
+#define HDMI_PHY_REG58              HDMI_PHY_BASE(0x0058)
+#define HDMI_PHY_REG5C              HDMI_PHY_BASE(0x005C)
+#define HDMI_PHY_REG60              HDMI_PHY_BASE(0x0060)
+#define HDMI_PHY_REG64              HDMI_PHY_BASE(0x0064)
+#define HDMI_PHY_REG68              HDMI_PHY_BASE(0x0068)
+#define HDMI_PHY_REG6C              HDMI_PHY_BASE(0x006C)
+#define HDMI_PHY_REG70              HDMI_PHY_BASE(0x0070)
+#define HDMI_PHY_REG74              HDMI_PHY_BASE(0x0074)
+#define HDMI_PHY_REG78              HDMI_PHY_BASE(0x0078)
+#define HDMI_PHY_REG7C              HDMI_PHY_BASE(0x007C)
+#define HDMI_PHY_REG80              HDMI_PHY_BASE(0x0080)
+
+/*
+ * Bit definition part
+ */
+
+/* AVI bit definition */
+#define HDMI_AVI_CON_DO_NOT_TRANSMIT	(0 << 1)
+#define HDMI_AVI_CON_EVERY_VSYNC		(1 << 1)
+#define AVI_ACTIVE_FORMAT_VALID			(1 << 4)
+#define AVI_UNDERSCANNED_DISPLAY_VALID	(1 << 1)
+
+/* AUI bit definition */
+#define HDMI_AUI_CON_NO_TRAN			(0 << 0)
+
+/* VSI bit definition */
+#define HDMI_VSI_CON_DO_NOT_TRANSMIT	(0 << 0)
+
+/* HDMI_INTC_CON_0 */
+#define HDMI_INTC_POL					(1 << 7)
+#define HDMI_INTC_EN_GLOBAL				(1 << 6)
+#define HDMI_INTC_EN_I2S				(1 << 5)
+#define HDMI_INTC_EN_CEC				(1 << 4)
+#define HDMI_INTC_EN_HPD_PLUG			(1 << 3)
+#define HDMI_INTC_EN_HPD_UNPLUG			(1 << 2)
+#define HDMI_INTC_EN_SPDIF				(1 << 1)
+#define HDMI_INTC_EN_HDCP				(1 << 0)
+
+/* HDMI_INTC_FLAG_0 */
+#define HDMI_INTC_FLAG_I2S				(1 << 5)
+#define HDMI_INTC_FLAG_CEC				(1 << 4)
+#define HDMI_INTC_FLAG_HPD_PLUG			(1 << 3)
+#define HDMI_INTC_FLAG_HPD_UNPLUG		(1 << 2)
+#define HDMI_INTC_FLAG_SPDIF			(1 << 1)
+#define HDMI_INTC_FLAG_HDCP				(1 << 0)
+
+/* HDMI_HDCP_KEY_LOAD */
+#define HDMI_HDCP_KEY_LOAD_DONE			(1 << 0)
+
+/* AUDIO_CLKSEL */
+#define HDMI_AUDIO_SPDIF_CLK			(1 << 0)
+#define HDMI_AUDIO_PCLK				(0 << 0)
+
+/* HDMI_PHY_RSTOUT */
+#define HDMI_PHY_SW_RSTOUT			(1 << 0)
+
+/* HDMI_PHY_VPLL */
+#define HDMI_PHY_VPLL_LOCK			(1 << 7)
+#define HDMI_PHY_VPLL_CODE_MASK			(0x7 << 0)
+
+/* HDMI_PHY_CMU */
+#define HDMI_PHY_CMU_LOCK			(1 << 7)
+#define HDMI_PHY_CMU_CODE_MASK			(0x7 << 0)
+
+/* HDMI_CORE_RSTOUT */
+#define HDMI_CORE_SW_RSTOUT			(1 << 0)
+
+/* Core Register */
+
+/* HDMI_CON_0 */
+#define HDMI_BLUE_SCR_EN			(1 << 5)
+#define HDMI_BLUE_SCR_DIS			(0 << 5)
+#define HDMI_ENC_OPTION				(1 << 4)
+#define HDMI_ASP_ENABLE				(1 << 2)
+#define HDMI_ASP_DISABLE			(0 << 2)
+#define HDMI_PWDN_ENB_NORMAL			(1 << 1)
+#define HDMI_PWDN_ENB_PD			(0 << 1)
+#define HDMI_EN					(1 << 0)
+#define HDMI_DIS				(~(1 << 0))
+
+/* HDMI_CON_1 */
+#define HDMI_PX_LMT_CTRL_BYPASS			(0 << 5)
+#define HDMI_PX_LMT_CTRL_RGB			(1 << 5)
+#define HDMI_PX_LMT_CTRL_YPBPR			(2 << 5)
+#define HDMI_PX_LMT_CTRL_RESERVED		(3 << 5)
+#define HDMI_CON_PXL_REP_RATIO_MASK		(1 << 1 | 1 << 0)
+#define HDMI_DOUBLE_PIXEL_REPETITION		(0x01)
+
+/* HDMI_CON_2 */
+#define HDMI_VID_PREAMBLE_EN			(0 << 5)
+#define HDMI_VID_PREAMBLE_DIS			(1 << 5)
+#define HDMI_GUARD_BAND_EN			(0 << 1)
+#define HDMI_GUARD_BAND_DIS			(1 << 1)
+
+/* STATUS */
+#define HDMI_AUTHEN_ACK_AUTH			(1 << 7)
+#define HDMI_AUTHEN_ACK_NOT			(0 << 7)
+#define HDMI_AUD_FIFO_OVF_FULL			(1 << 6)
+#define HDMI_AUD_FIFO_OVF_NOT			(0 << 6)
+#define HDMI_UPDATE_RI_INT_OCC			(1 << 4)
+#define HDMI_UPDATE_RI_INT_NOT			(0 << 4)
+#define HDMI_UPDATE_RI_INT_CLEAR		(1 << 4)
+#define HDMI_UPDATE_PJ_INT_OCC			(1 << 3)
+#define HDMI_UPDATE_PJ_INT_NOT			(0 << 3)
+#define HDMI_UPDATE_PJ_INT_CLEAR		(1 << 3)
+#define HDMI_WRITE_INT_OCC			(1 << 2)
+#define HDMI_WRITE_INT_NOT			(0 << 2)
+#define HDMI_WRITE_INT_CLEAR			(1 << 2)
+#define HDMI_WATCHDOG_INT_OCC			(1 << 1)
+#define HDMI_WATCHDOG_INT_NOT			(0 << 1)
+#define HDMI_WATCHDOG_INT_CLEAR			(1 << 1)
+#define HDMI_WTFORACTIVERX_INT_OCC		(1)
+#define HDMI_WTFORACTIVERX_INT_NOT		(0)
+#define HDMI_WTFORACTIVERX_INT_CLEAR		(1)
+
+/* PHY_STATUS */
+#define HDMI_PHY_STATUS_READY			(1)
+
+/* HDMI_MODE_SEL */
+#define HDMI_MODE_HDMI_EN			(1 << 1)
+#define HDMI_MODE_DVI_EN			(1 << 0)
+#define HDMI_MODE_MASK				(3 << 0)
+
+/* STATUS_EN */
+#define HDMI_AUD_FIFO_OVF_EN			(1 << 6)
+#define HDMI_AUD_FIFO_OVF_DIS			(0 << 6)
+#define HDMI_UPDATE_RI_INT_EN			(1 << 4)
+#define HDMI_UPDATE_RI_INT_DIS			(0 << 4)
+#define HDMI_UPDATE_PJ_INT_EN			(1 << 3)
+#define HDMI_UPDATE_PJ_INT_DIS			(0 << 3)
+#define HDMI_WRITE_INT_EN			(1 << 2)
+#define HDMI_WRITE_INT_DIS			(0 << 2)
+#define HDMI_WATCHDOG_INT_EN			(1 << 1)
+#define HDMI_WATCHDOG_INT_DIS			(0 << 1)
+#define HDMI_WTFORACTIVERX_INT_EN		(1)
+#define HDMI_WTFORACTIVERX_INT_DIS		(0)
+#define HDMI_INT_EN_ALL	(HDMI_UPDATE_RI_INT_EN|\
+	HDMI_UPDATE_PJ_INT_DIS|\
+	HDMI_WRITE_INT_EN|\
+	HDMI_WATCHDOG_INT_EN|\
+	HDMI_WTFORACTIVERX_INT_EN)
+#define HDMI_INT_DIS_ALL			(~0x1F)
+
+/* HPD */
+#define HDMI_SW_HPD_PLUGGED			(1 << 1)
+#define HDMI_SW_HPD_UNPLUGGED			(0 << 1)
+#define HDMI_HPD_SEL_I_HPD			(1)
+#define HDMI_HPD_SEL_SW_HPD			(0)
+
+/* MODE_SEL */
+#define HDMI_MODE_EN				(1 << 1)
+#define HDMI_MODE_DIS				(0 << 1)
+#define HDMI_DVI_MODE_EN			(1)
+#define HDMI_DVI_MODE_DIS			(0)
+
+/* ENC_EN */
+#define HDMI_HDCP_ENC_ENABLE			(1)
+#define HDMI_HDCP_ENC_DISABLE			(0)
+
+/* VSYNC_POL */
+#define HDMI_V_SYNC_POL_ACT_LOW			(1)
+#define HDMI_V_SYNC_POL_ACT_HIGH		(0)
+
+/* INT_PRO_MODE */
+#define HDMI_INTERLACE_MODE			(1)
+#define HDMI_PROGRESSIVE_MODE			(0)
+
+/* ASP_CON */
+#define HDMI_AUD_DST_DOUBLE			(1 << 7)
+#define HDMI_AUD_NO_DST_DOUBLE			(0 << 7)
+#define HDMI_AUD_TYPE_SAMPLE			(0 << 5)
+#define HDMI_AUD_TYPE_ONE_BIT			(1 << 5)
+#define HDMI_AUD_TYPE_HBR			(2 << 5)
+#define HDMI_AUD_TYPE_DST			(3 << 5)
+#define HDMI_AUD_MODE_TWO_CH			(0 << 4)
+#define HDMI_AUD_MODE_MULTI_CH			(1 << 4)
+#define HDMI_AUD_SP_AUD3_EN			(1 << 3)
+#define HDMI_AUD_SP_AUD2_EN			(1 << 2)
+#define HDMI_AUD_SP_AUD1_EN			(1 << 1)
+#define HDMI_AUD_SP_AUD0_EN			(1 << 0)
+#define HDMI_AUD_SP_ALL_DIS			(0 << 0)
+
+#define HDMI_AUD_SET_SP_PRE(x)			((x) & 0xF)
+
+/* ASP_SP_FLAT */
+#define HDMI_ASP_SP_FLAT_AUD_SAMPLE		(0)
+
+/* ASP_CHCFG0/1/2/3 */
+#define HDMI_SPK3R_SEL_I_PCM0L			(0 << 27)
+#define HDMI_SPK3R_SEL_I_PCM0R			(1 << 27)
+#define HDMI_SPK3R_SEL_I_PCM1L			(2 << 27)
+#define HDMI_SPK3R_SEL_I_PCM1R			(3 << 27)
+#define HDMI_SPK3R_SEL_I_PCM2L			(4 << 27)
+#define HDMI_SPK3R_SEL_I_PCM2R			(5 << 27)
+#define HDMI_SPK3R_SEL_I_PCM3L			(6 << 27)
+#define HDMI_SPK3R_SEL_I_PCM3R			(7 << 27)
+#define HDMI_SPK3L_SEL_I_PCM0L			(0 << 24)
+#define HDMI_SPK3L_SEL_I_PCM0R			(1 << 24)
+#define HDMI_SPK3L_SEL_I_PCM1L			(2 << 24)
+#define HDMI_SPK3L_SEL_I_PCM1R			(3 << 24)
+#define HDMI_SPK3L_SEL_I_PCM2L			(4 << 24)
+#define HDMI_SPK3L_SEL_I_PCM2R			(5 << 24)
+#define HDMI_SPK3L_SEL_I_PCM3L			(6 << 24)
+#define HDMI_SPK3L_SEL_I_PCM3R			(7 << 24)
+#define HDMI_SPK2R_SEL_I_PCM0L			(0 << 19)
+#define HDMI_SPK2R_SEL_I_PCM0R			(1 << 19)
+#define HDMI_SPK2R_SEL_I_PCM1L			(2 << 19)
+#define HDMI_SPK2R_SEL_I_PCM1R			(3 << 19)
+#define HDMI_SPK2R_SEL_I_PCM2L			(4 << 19)
+#define HDMI_SPK2R_SEL_I_PCM2R			(5 << 19)
+#define HDMI_SPK2R_SEL_I_PCM3L			(6 << 19)
+#define HDMI_SPK2R_SEL_I_PCM3R			(7 << 19)
+#define HDMI_SPK2L_SEL_I_PCM0L			(0 << 16)
+#define HDMI_SPK2L_SEL_I_PCM0R			(1 << 16)
+#define HDMI_SPK2L_SEL_I_PCM1L			(2 << 16)
+#define HDMI_SPK2L_SEL_I_PCM1R			(3 << 16)
+#define HDMI_SPK2L_SEL_I_PCM2L			(4 << 16)
+#define HDMI_SPK2L_SEL_I_PCM2R			(5 << 16)
+#define HDMI_SPK2L_SEL_I_PCM3L			(6 << 16)
+#define HDMI_SPK2L_SEL_I_PCM3R			(7 << 16)
+#define HDMI_SPK1R_SEL_I_PCM0L			(0 << 11)
+#define HDMI_SPK1R_SEL_I_PCM0R			(1 << 11)
+#define HDMI_SPK1R_SEL_I_PCM1L			(2 << 11)
+#define HDMI_SPK1R_SEL_I_PCM1R			(3 << 11)
+#define HDMI_SPK1R_SEL_I_PCM2L			(4 << 11)
+#define HDMI_SPK1R_SEL_I_PCM2R			(5 << 11)
+#define HDMI_SPK1R_SEL_I_PCM3L			(6 << 11)
+#define HDMI_SPK1R_SEL_I_PCM3R			(7 << 11)
+#define HDMI_SPK1L_SEL_I_PCM0L			(0 << 8)
+#define HDMI_SPK1L_SEL_I_PCM0R			(1 << 8)
+#define HDMI_SPK1L_SEL_I_PCM1L			(2 << 8)
+#define HDMI_SPK1L_SEL_I_PCM1R			(3 << 8)
+#define HDMI_SPK1L_SEL_I_PCM2L			(4 << 8)
+#define HDMI_SPK1L_SEL_I_PCM2R			(5 << 8)
+#define HDMI_SPK1L_SEL_I_PCM3L			(6 << 8)
+#define HDMI_SPK1L_SEL_I_PCM3R			(7 << 8)
+#define HDMI_SPK0R_SEL_I_PCM0L			(0 << 3)
+#define HDMI_SPK0R_SEL_I_PCM0R			(1 << 3)
+#define HDMI_SPK0R_SEL_I_PCM1L			(2 << 3)
+#define HDMI_SPK0R_SEL_I_PCM1R			(3 << 3)
+#define HDMI_SPK0R_SEL_I_PCM2L			(4 << 3)
+#define HDMI_SPK0R_SEL_I_PCM2R			(5 << 3)
+#define HDMI_SPK0R_SEL_I_PCM3L			(6 << 3)
+#define HDMI_SPK0R_SEL_I_PCM3R			(7 << 3)
+#define HDMI_SPK0L_SEL_I_PCM0L			(0)
+#define HDMI_SPK0L_SEL_I_PCM0R			(1)
+#define HDMI_SPK0L_SEL_I_PCM1L			(2)
+#define HDMI_SPK0L_SEL_I_PCM1R			(3)
+#define HDMI_SPK0L_SEL_I_PCM2L			(4)
+#define HDMI_SPK0L_SEL_I_PCM2R			(5)
+#define HDMI_SPK0L_SEL_I_PCM3L			(6)
+#define HDMI_SPK0L_SEL_I_PCM3R			(7)
+
+/* ACR_CON */
+#define HDMI_ACR_CON_TX_MODE_NO_TX		(0 << 0)
+#define HDMI_ACR_CON_TX_MODE_MESURED_CTS	(4 << 0)
+#define HDMI_ACR_N0_VAL(x)			(x & 0xff)
+#define HDMI_ACR_N1_VAL(x)			((x >> 8) & 0xff)
+#define HDMI_ACR_N2_VAL(x)			((x >> 16) & 0xff)
+#define HDMI_ACR_LSB2_MASK			(0xFF)
+#define HDMI_ACR_TXCNT_MASK			(0x1F)
+#define HDMI_ACR_TX_INTERNAL_MASK		(0xFF)
+#define HDMI_ACR_CTS_OFFSET_MASK		(0xFF)
+
+/* GCP_CON */
+#define HDMI_GCP_CON_EN_1ST_VSYNC		(1 << 3)
+#define HDMI_GCP_CON_EN_2ST_VSYNC		(1 << 2)
+#define HDMI_GCP_CON_TRANS_EVERY_VSYNC		(2)
+#define HDMI_GCP_CON_NO_TRAN			(0)
+#define HDMI_GCP_CON_TRANS_ONCE			(1)
+#define HDMI_GCP_CON_TRANS_EVERY_VSYNC		(2)
+
+/* GCP_BYTE1 */
+#define HDMI_GCP_BYTE1_MASK			(0xFF)
+
+/* GCP_BYTE2 */
+#define HDMI_GCP_BYTE2_PP_MASK			(0xF << 4)
+#define HDMI_GCP_24BPP				(1 << 2)
+#define HDMI_GCP_30BPP				(1 << 0 | 1 << 2)
+#define HDMI_GCP_36BPP				(1 << 1 | 1 << 2)
+#define HDMI_GCP_48BPP				(1 << 0 | 1 << 1 | 1 << 2)
+
+/* GCP_BYTE3 */
+#define HDMI_GCP_BYTE3_MASK			(0xFF)
+
+/* ACP Packet Register */
+
+/* ACP_CON */
+#define HDMI_ACP_FR_RATE_MASK			(0x1F << 3)
+#define HDMI_ACP_CON_NO_TRAN			(0)
+#define HDMI_ACP_CON_TRANS_ONCE			(1)
+#define HDMI_ACP_CON_TRANS_EVERY_VSYNC		(2)
+
+/* ACP_TYPE */
+#define HDMI_ACP_TYPE_MASK			(0xFF)
+
+/* ACP_DATA00~16 */
+#define HDMI_ACP_DATA_MASK			(0xFF)
+
+/* ISRC1/2 Packet Register */
+
+/* ISRC_CON */
+#define HDMI_ISRC_FR_RATE_MASK			(0x1F << 3)
+#define HDMI_ISRC_EN				(1 << 2)
+#define HDMI_ISRC_DIS				(0 << 2)
+
+/* ISRC1_HEADER1 */
+#define HDMI_ISRC1_HEADER_MASK			(0xFF)
+
+/* ISRC1_DATA 00~15 */
+#define HDMI_ISRC1_DATA_MASK			(0xFF)
+
+/* ISRC2_DATA 00~15 */
+#define HDMI_ISRC2_DATA_MASK			(0xFF)
+
+/* AVI InfoFrame Register */
+
+/* AVI_DATA01~13 */
+#define HDMI_AVI_PIXEL_REPETITION_DOUBLE	(1<<0)
+#define HDMI_AVI_PICTURE_ASPECT_4_3			(1<<4)
+#define HDMI_AVI_PICTURE_ASPECT_16_9		(1<<5)
+
+/* Audio InfoFrame Register */
+
+/* AUI_CON */
+#define HDMI_AUI_CON_NO_TRAN			(0 << 0)
+#define HDMI_AUI_CON_TRANS_ONCE			(1 << 0)
+#define HDMI_AUI_CON_TRANS_EVERY_VSYNC		(2 << 0)
+
+/* VSI_CON */
+#define HDMI_VSI_CON_DO_NOT_TRANSMIT		(0 << 0)
+#define HDMI_VSI_CON_EVERY_VSYNC		(1 << 1)
+
+/* VSI_DATA00 ~ 27 */
+#define HDMI_VSI_DATA04_VIDEO_FORMAT(x)		(x << 5)
+#define HDMI_VSI_DATA05_3D_STRUCTURE(x)		(x << 4)
+#define HDMI_VSI_DATA06_3D_EXT_DATA(x)		(x << 4)
+
+/* HDCP_KSV_LIST_CON */
+#define HDMI_HDCP_KSV_WRITE_DONE		(0x1 << 3)
+#define HDMI_HDCP_KSV_LIST_EMPTY		(0x1 << 2)
+#define HDMI_HDCP_KSV_END			(0x1 << 1)
+#define HDMI_HDCP_KSV_READ			(0x1 << 0)
+
+/* HDCP_CTRL1 */
+#define HDMI_HDCP_EN_PJ_EN			(1 << 4)
+#define HDMI_HDCP_EN_PJ_DIS			(~(1 << 4))
+#define HDMI_HDCP_SET_REPEATER_TIMEOUT		(1 << 2)
+#define HDMI_HDCP_CLEAR_REPEATER_TIMEOUT	(~(1 << 2))
+#define HDMI_HDCP_CP_DESIRED_EN			(1 << 1)
+#define HDMI_HDCP_CP_DESIRED_DIS		(~(1 << 1))
+#define HDMI_HDCP_ENABLE_1_1_FEATURE_EN		(1)
+#define HDMI_HDCP_ENABLE_1_1_FEATURE_DIS	(~(1))
+
+/* HDCP_CHECK_RESULT */
+#define HDMI_HDCP_PI_MATCH_RESULT_Y		((0x1 << 3) | (0x1 << 2))
+#define HDMI_HDCP_PI_MATCH_RESULT_N		((0x1 << 3) | (0x0 << 2))
+#define HDMI_HDCP_RI_MATCH_RESULT_Y		((0x1 << 1) | (0x1 << 0))
+#define HDMI_HDCP_RI_MATCH_RESULT_N		((0x1 << 1) | (0x0 << 0))
+#define HDMI_HDCP_CLR_ALL_RESULTS		(0)
+#define HDMI_HDCP_BCAPS_REPEATER		(1 << 6)
+#define HDMI_HDCP_BCAPS_READY			(1 << 5)
+#define HDMI_HDCP_BCAPS_FAST			(1 << 4)
+#define HDMI_HDCP_BCAPS_1_1_FEATURES		(1 << 1)
+#define HDMI_HDCP_BCAPS_FAST_REAUTH		(1)
+
+/* SPDIFIN */
+#define HDMI_SPDIFIN_READY_CLK_DOWN			(1 << 1)
+#define HDMI_SPDIFIN_CLK_ON				(1 << 0)
+#define HDMI_SPDIFIN_SW_RESET				(0 << 0)
+#define HDMI_SPDIFIN_STATUS_CHECK_MODE			(1 << 0)
+#define HDMI_SPDIFIN_STATUS_CHECK_MODE_HDMI		(3 << 0)
+#define HDMI_SPDIFIN_IRQ_OVERFLOW_EN			(1 << 7)
+#define HDMI_SPDIFIN_IRQ_ABNORMAL_PD_EN			(1 << 6)
+#define HDMI_SPDIFIN_IRQ_SH_NOT_DETECTED_RIGHTTIME_EN	(1 << 5)
+#define HDMI_SPDIFIN_IRQ_SH_DETECTED_EN			(1 << 4)
+#define HDMI_SPDIFIN_IRQ_SH_NOT_DETECTED_EN		(1 << 3)
+#define HDMI_SPDIFIN_IRQ_WRONG_PREAMBLE_EN		(1 << 2)
+#define HDMI_SPDIFIN_IRQ_CH_STATUS_RECOVERED_EN		(1 << 1)
+#define HDMI_SPDIFIN_IRQ_WRONG_SIG_EN			(1 << 0)
+#define HDMI_SPDIFIN_CFG_NOISE_FILTER_2_SAMPLE		(1 << 6)
+#define HDMI_SPDIFIN_CFG_PCPD_MANUAL			(1 << 4)
+#define HDMI_SPDIFIN_CFG_WORD_LENGTH_MANUAL		(1 << 3)
+#define HDMI_SPDIFIN_CFG_UVCP_REPORT			(1 << 2)
+#define HDMI_SPDIFIN_CFG_HDMI_2_BURST			(1 << 1)
+#define HDMI_SPDIFIN_CFG_DATA_ALIGN_32			(1 << 0)
+#define HDMI_SPDIFIN_CFG2_NO_CLK_DIV			(0)
+#define HDMI_SPDIFIN_USER_VAL_REPETITION_TIME_LOW(x)	((x & 0xf) << 4)
+#define HDMI_SPDIFIN_USER_VAL_WORD_LENGTH_24		(0xb << 0)
+#define HDMI_SPDIFIN_USER_VAL_REPETITION_TIME_HIGH(x)	((x >> 4) & 0xff)
+
+/* I2S */
+#define HDMI_I2S_CLK_DISABLE			(0)
+#define HDMI_I2S_CLK_ENABLE			(1)
+#define HDMI_I2S_SCLK_FALLING_EDGE		(0 << 1)
+#define HDMI_I2S_SCLK_RISING_EDGE		(1 << 1)
+#define HDMI_I2S_L_CH_LOW_POL			(0)
+#define HDMI_I2S_L_CH_HIGH_POL			(1)
+#define HDMI_I2S_MSB_FIRST_MODE			(0 << 6)
+#define HDMI_I2S_LSB_FIRST_MODE			(1 << 6)
+#define HDMI_I2S_BIT_CH_32FS			(0 << 4)
+#define HDMI_I2S_BIT_CH_48FS			(1 << 4)
+#define HDMI_I2S_BIT_CH_RESERVED		(2 << 4)
+#define HDMI_I2S_SDATA_16BIT			(1 << 2)
+#define HDMI_I2S_SDATA_20BIT			(2 << 2)
+#define HDMI_I2S_SDATA_24BIT			(3 << 2)
+#define HDMI_I2S_BASIC_FORMAT			(0)
+#define HDMI_I2S_L_JUST_FORMAT			(2)
+#define HDMI_I2S_R_JUST_FORMAT			(3)
+#define HDMI_I2S_CON_2_CLR			(~(0xFF))
+#define HDMI_I2S_SET_BIT_CH(x)			(((x) & 0x7) << 4)
+#define HDMI_I2S_SET_SDATA_BIT(x)		(((x) & 0x7) << 2)
+#define HDMI_I2S_SEL_SCLK(x)			(((x) & 0x7) << 4)
+#define HDMI_I2S_SEL_LRCK(x)			((x) & 0x7)
+#define HDMI_I2S_SEL_SDATA1(x)			(((x) & 0x7) << 4)
+#define HDMI_I2S_SEL_SDATA0(x)			((x) & 0x7)
+#define HDMI_I2S_SEL_SDATA3(x)			(((x) & 0x7) << 4)
+#define HDMI_I2S_SEL_SDATA2(x)			((x) & 0x7)
+#define HDMI_I2S_SEL_DSD(x)			((x) & 0x7)
+#define HDMI_I2S_DSD_CLK_RI_EDGE		(1 << 1)
+#define HDMI_I2S_DSD_CLK_FA_EDGE		(0 << 1)
+#define HDMI_I2S_DSD_ENABLE			(1 << 0)
+#define HDMI_I2S_DSD_DISABLE			(0 << 0)
+#define HDMI_I2S_NOISE_FILTER_ZERO		(0 << 5)
+#define HDMI_I2S_NOISE_FILTER_2_STAGE		(1 << 5)
+#define HDMI_I2S_NOISE_FILTER_3_STAGE		(2 << 5)
+#define HDMI_I2S_NOISE_FILTER_4_STAGE		(3 << 5)
+#define HDMI_I2S_NOISE_FILTER_5_STAGE		(4 << 5)
+#define HDMI_I2S_IN_ENABLE			(1 << 4)
+#define HDMI_I2S_IN_DISABLE			(0 << 4)
+#define HDMI_I2S_AUD_SPDIF			(0 << 2)
+#define HDMI_I2S_AUD_I2S			(1 << 2)
+#define HDMI_I2S_AUD_DSD			(2 << 2)
+#define HDMI_I2S_CUV_SPDIF_ENABLE		(0 << 1)
+#define HDMI_I2S_CUV_I2S_ENABLE			(1 << 1)
+#define HDMI_I2S_MUX_DISABLE			(0 << 0)
+#define HDMI_I2S_MUX_ENABLE			(1 << 0)
+
+#define HDMI_I2S_CH_STATUS_RELOAD		(1 << 0)
+#define HDMI_I2S_CH_ST_CON_CLR			(~(1))
+#define HDMI_I2S_CH_STATUS_MODE_0		(0 << 6)
+#define HDMI_I2S_2AUD_CH_WITHOUT_PREEMPH	(0 << 3)
+#define HDMI_I2S_2AUD_CH_WITH_PREEMPH		(1 << 3)
+#define HDMI_I2S_DEFAULT_EMPHASIS		(0 << 3)
+#define HDMI_I2S_COPYRIGHT			(0 << 2)
+#define HDMI_I2S_NO_COPYRIGHT			(1 << 2)
+#define HDMI_I2S_LINEAR_PCM			(0 << 1)
+#define HDMI_I2S_NO_LINEAR_PCM			(1 << 1)
+#define HDMI_I2S_CONSUMER_FORMAT		(0)
+#define HDMI_I2S_PROF_FORMAT			(1)
+#define HDMI_I2S_CH_ST_0_CLR			(~(0xFF))
+#define HDMI_I2S_CD_PLAYER			(0x00)
+#define HDMI_I2S_DAT_PLAYER			(0x03)
+#define HDMI_I2S_DCC_PLAYER			(0x43)
+#define HDMI_I2S_MINI_DISC_PLAYER		(0x49)
+#define HDMI_I2S_CHANNEL_NUM_MASK		(0xF << 4)
+#define HDMI_I2S_SOURCE_NUM_MASK		(0xF)
+#define HDMI_I2S_SET_CHANNEL_NUM(x)		(((x) & (0xF)) << 4)
+#define HDMI_I2S_SET_SOURCE_NUM(x)		((x) & (0xF))
+#define HDMI_I2S_CLK_ACCUR_LEVEL_1		(1 << 4)
+#define HDMI_I2S_CLK_ACCUR_LEVEL_2		(0 << 4)
+#define HDMI_I2S_CLK_ACCUR_LEVEL_3		(2 << 4)
+#define HDMI_I2S_SAMPLING_FREQ_44_1		(0x0)
+#define HDMI_I2S_SAMPLING_FREQ_48		(0x2)
+#define HDMI_I2S_SAMPLING_FREQ_32		(0x3)
+#define HDMI_I2S_SAMPLING_FREQ_96		(0xA)
+#define HDMI_I2S_SET_SAMPLING_FREQ(x)		((x) & (0xF))
+#define HDMI_I2S_ORG_SAMPLING_FREQ_44_1		(0xF << 4)
+#define HDMI_I2S_ORG_SAMPLING_FREQ_88_2		(0x7 << 4)
+#define HDMI_I2S_ORG_SAMPLING_FREQ_22_05	(0xB << 4)
+#define HDMI_I2S_ORG_SAMPLING_FREQ_176_4	(0x3 << 4)
+#define HDMI_I2S_WORD_LENGTH_NOT_DEFINE		(0x0 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX24_20BITS	(0x1 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX24_22BITS	(0x2 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX24_23BITS	(0x4 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX24_24BITS	(0x5 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX24_21BITS	(0x6 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX20_16BITS	(0x1 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX20_18BITS	(0x2 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX20_19BITS	(0x4 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX20_20BITS	(0x5 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX20_17BITS	(0x6 << 1)
+#define HDMI_I2S_WORD_LENGTH_MAX_24BITS		(1)
+#define HDMI_I2S_WORD_LENGTH_MAX_20BITS		(0)
+#define HDMI_I2S_VD_AUD_SAMPLE_RELIABLE		(0)
+#define HDMI_I2S_VD_AUD_SAMPLE_UNRELIABLE	(1)
+#define HDMI_I2S_CH3_R_EN			(1 << 7)
+#define HDMI_I2S_CH3_L_EN			(1 << 6)
+#define HDMI_I2S_CH2_R_EN			(1 << 5)
+#define HDMI_I2S_CH2_L_EN			(1 << 4)
+#define HDMI_I2S_CH1_R_EN			(1 << 3)
+#define HDMI_I2S_CH1_L_EN			(1 << 2)
+#define HDMI_I2S_CH0_R_EN			(1 << 1)
+#define HDMI_I2S_CH0_L_EN			(1)
+#define HDMI_I2S_CH_ALL_EN			(0xFF)
+#define HDMI_I2S_MUX_CH_CLR			(~HDMI_I2S_CH_ALL_EN)
+#define HDMI_I2S_CUV_R_EN			(1 << 1)
+#define HDMI_I2S_CUV_L_EN			(1 << 0)
+#define HDMI_I2S_CUV_RL_EN			(0x03)
+#define HDMI_I2S_INT2_DIS			(0 << 1)
+#define HDMI_I2S_INT2_EN			(1 << 1)
+#define HDMI_I2S_INT2_STATUS			(1 << 1)
+#define HDMI_I2S_CUV_R_DATA_MASK		(0x7 << 4)
+#define HDMI_I2S_CUV_L_DATA_MASK		(0x7)
+
+/* HDCP_SHA_RESULT */
+#define HDMI_HDCP_SHA_VALID_NO_RD		(0 << 1)
+#define HDMI_HDCP_SHA_VALID_RD			(1 << 1)
+#define HDMI_HDCP_SHA_VALID				(1)
+#define HDMI_HDCP_SHA_NO_VALID			(0)
+
+/* DC_CONTRAL */
+#define HDMI_DC_CTL_12				(1 << 1)
+#define HDMI_DC_CTL_8				(0)
+#define HDMI_DC_CTL_10				(1)
+
+/* CEC Bit Definition */
+#define HDMI_CEC_IRQ_TX_DONE			(1<<0)
+#define HDMI_CEC_IRQ_TX_ERROR			(1<<1)
+#define HDMI_CEC_IRQ_RX_DONE			(1<<4)
+#define HDMI_CEC_IRQ_RX_ERROR			(1<<5)
+#define HDMI_CEC_TX_CTRL_START			(1<<0)
+#define HDMI_CEC_TX_CTRL_BCAST			(1<<1)
+#define HDMI_CEC_TX_CTRL_RETRY			(0x04<<4)
+#define HDMI_CEC_TX_CTRL_RESET			(1<<7)
+#define HDMI_CEC_RX_CTRL_ENABLE			(1<<0)
+#define HDMI_CEC_RX_CTRL_RESET			(1<<7)
+#define HDMI_CEC_LOGIC_ADDR_MASK		(0xF)
+#define HDMI_CEC_STATUS_TX_RUNNING		(1<<0)
+#define HDMI_CEC_STATUS_TX_TRANSFERRING		(1<<1)
+#define HDMI_CEC_STATUS_TX_DONE			(1<<2)
+#define HDMI_CEC_STATUS_TX_ERROR		(1<<3)
+#define HDMI_CEC_STATUS_TX_BYTES		(0xFF<<8)
+#define HDMI_CEC_STATUS_RX_RUNNING		(1<<0)
+#define HDMI_CEC_STATUS_RX_RECEIVING		(1<<1)
+#define HDMI_CEC_STATUS_RX_DONE			(1<<2)
+#define HDMI_CEC_STATUS_RX_ERROR		(1<<3)
+#define HDMI_CEC_STATUS_RX_BCAST		(1<<4)
+#define HDMI_CEC_STATUS_RX_BYTES		(0xFF<<8)
+
+void hdmi_set_base(void __iomem *base);
+void hdmi_write(u32 reg, u32 val);
+void hdmi_write_mask(u32 reg, u32 val, u32 mask);
+void hdmi_writeb(u32 reg, u8 val);
+void hdmi_write_bytes(u32 reg, u8 *buf, int bytes);
+u32 hdmi_read(u32 reg);
+u8 hdmi_readb(u32 reg);
+void hdmi_read_bytes(u32 reg, u8 *buf, int bytes);
+
+#endif /* __ARCH_ARM_REGS_HDMI_H */
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disp.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disp.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disp.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_DISP_H_
+#define _S5PXX18_SOC_DISP_H_
+
+/*
+ *	Display Clock Control types
+ */
+enum nx_pclkmode {
+	nx_pclkmode_dynamic = 0UL,
+	nx_pclkmode_always	= 1UL
+};
+
+enum nx_bclkmode {
+	nx_bclkmode_disable	= 0UL,
+	nx_bclkmode_dynamic	= 2UL,
+	nx_bclkmode_always	= 3UL
+};
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.c b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_disptop.h"
+
+static struct {
+	struct nx_disp_top_register_set *pregister;
+} __g_module_variables = { NULL, };
+
+int nx_disp_top_initialize(void)
+{
+	static int binit;
+	u32 i;
+
+	if (0 == binit) {
+		for (i = 0; i < NUMBER_OF_DISPTOP_MODULE; i++)
+			__g_module_variables.pregister = NULL;
+		binit = 1;
+	}
+	return 1;
+}
+
+u32 nx_disp_top_get_number_of_module(void)
+{
+	return NUMBER_OF_DISPTOP_MODULE;
+}
+
+u32 nx_disp_top_get_physical_address(void)
+{
+	static const u32 physical_addr[] = PHY_BASEADDR_DISPTOP_LIST;
+
+	return (u32)(physical_addr[0] + PHY_BASEADDR_DISPLAYTOP_MODULE_OFFSET);
+}
+
+u32 nx_disp_top_get_size_of_register_set(void)
+{
+	return sizeof(struct nx_disp_top_register_set);
+}
+
+void nx_disp_top_set_base_address(void *base_address)
+{
+	__g_module_variables.pregister =
+	    (struct nx_disp_top_register_set *)base_address;
+}
+
+void *nx_disp_top_get_base_address(void)
+{
+	return (void *)__g_module_variables.pregister;
+}
+
+void nx_disp_top_set_resconvmux(int benb, u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = (benb << 31) | (sel << 0);
+	writel((u32)regvalue, &pregister->resconv_mux_ctrl);
+}
+
+void nx_disp_top_set_hdmimux(int benb, u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = (benb << 31) | (sel << 0);
+	writel((u32)regvalue, &pregister->interconv_mux_ctrl);
+}
+
+void nx_disp_top_set_mipimux(int benb, u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = (benb << 31) | (sel << 0);
+	writel((u32)regvalue, &pregister->mipi_mux_ctrl);
+}
+
+void nx_disp_top_set_lvdsmux(int benb, u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = (benb << 31) | (sel << 0);
+	writel((u32)regvalue, &pregister->lvds_mux_ctrl);
+}
+
+void nx_disp_top_set_primary_mux(u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+
+	pregister = __g_module_variables.pregister;
+	writel((u32)sel, &pregister->tftmpu_mux);
+}
+
+void nx_disp_top_hdmi_set_vsync_start(u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+
+	pregister = __g_module_variables.pregister;
+	writel((u32)sel, &pregister->hdmisyncctrl0);
+}
+
+void nx_disp_top_hdmi_set_vsync_hsstart_end(u32 start, u32 end)
+{
+	register struct nx_disp_top_register_set *pregister;
+
+	pregister = __g_module_variables.pregister;
+	writel((u32)(end << 16) | (start << 0), &pregister->hdmisyncctrl3);
+}
+
+void nx_disp_top_hdmi_set_hactive_start(u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+
+	pregister = __g_module_variables.pregister;
+	writel((u32)sel, &pregister->hdmisyncctrl1);
+}
+
+void nx_disp_top_hdmi_set_hactive_end(u32 sel)
+{
+	register struct nx_disp_top_register_set *pregister;
+
+	pregister = __g_module_variables.pregister;
+	writel((u32)sel, &pregister->hdmisyncctrl2);
+}
+
+void nx_disp_top_set_hdmifield(u32 enable, u32 init_val, u32 vsynctoggle,
+			u32 hsynctoggle, u32 vsyncclr, u32 hsyncclr,
+			u32 field_use, u32 muxsel)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = ((enable & 0x01) << 0) | ((init_val & 0x01) << 1) |
+		   ((vsynctoggle & 0x3fff) << 2) |
+		   ((hsynctoggle & 0x3fff) << 17);
+	writel(regvalue, &pregister->hdmifieldctrl);
+	regvalue = ((field_use & 0x01) << 31) | ((muxsel & 0x01) << 30) |
+		   ((hsyncclr) << 15) | ((vsyncclr) << 0);
+	writel(regvalue, &pregister->greg0);
+}
+
+void nx_disp_top_set_padclock(u32 mux_index, u32 padclk_cfg)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = readl(&pregister->greg1);
+	if (padmux_secondary_mlc == mux_index) {
+		regvalue = regvalue & (~(0x7 << 3));
+		regvalue = regvalue | (padclk_cfg << 3);
+	} else if (padmux_resolution_conv == mux_index) {
+		regvalue = regvalue & (~(0x7 << 6));
+		regvalue = regvalue | (padclk_cfg << 6);
+	} else {
+		regvalue = regvalue & (~(0x7 << 0));
+		regvalue = regvalue | (padclk_cfg << 0);
+	}
+	writel(regvalue, &pregister->greg1);
+}
+
+void nx_disp_top_set_lcdif_enb(int enb)
+{
+	register struct nx_disp_top_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables.pregister;
+	regvalue = readl(&pregister->greg1);
+	regvalue = regvalue & (~(0x1 << 9));
+	regvalue = regvalue | ((enb & 0x1) << 9);
+	writel(regvalue, &pregister->greg1);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.c b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,319 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_disptop_clk.h"
+#include "s5pxx18_soc_disptop.h"
+
+static struct {
+	struct nx_disptop_clkgen_register_set *__g_pregister;
+} __g_module_variables[NUMBER_OF_DISPTOP_CLKGEN_MODULE] = {
+	{ NULL,},
+};
+
+int nx_disp_top_clkgen_initialize(void)
+{
+	static int binit;
+	u32 i;
+
+	if (0 == binit) {
+		for (i = 0; i < NUMBER_OF_DISPTOP_CLKGEN_MODULE; i++)
+			__g_module_variables[i].__g_pregister = NULL;
+		binit = 1;
+	}
+	return 1;
+}
+
+u32 nx_disp_top_clkgen_get_number_of_module(void)
+{
+	return NUMBER_OF_DISPTOP_CLKGEN_MODULE;
+}
+
+u32 nx_disp_top_clkgen_get_physical_address(u32 module_index)
+{
+	static const u32 physical_addr[] =
+		PHY_BASEADDR_DISPTOP_CLKGEN_LIST;
+
+	return (u32)physical_addr[module_index];
+}
+
+u32 nx_disp_top_clkgen_get_size_of_register_set(void)
+{
+	return sizeof(struct nx_disptop_clkgen_register_set);
+}
+
+void nx_disp_top_clkgen_set_base_address(u32 module_index, void *base_address)
+{
+	__g_module_variables[module_index].__g_pregister =
+	    (struct nx_disptop_clkgen_register_set *)base_address;
+}
+
+void *nx_disp_top_clkgen_get_base_address(u32 module_index)
+{
+	return (void *)__g_module_variables[module_index].__g_pregister;
+}
+
+void nx_disp_top_clkgen_set_clock_bclk_mode(u32 module_index,
+				 enum nx_bclkmode mode)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 regvalue;
+	u32 clkmode = 0;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+	switch (mode) {
+	case nx_bclkmode_disable:
+		clkmode = 0;
+	case nx_bclkmode_dynamic:
+		clkmode = 2;
+		break;
+	case nx_bclkmode_always:
+		clkmode = 3;
+		break;
+	default:
+		break;
+	}
+
+	regvalue = pregister->clkenb;
+	regvalue &= ~3ul;
+	regvalue |= (clkmode & 0x03);
+
+	writel(regvalue, &pregister->clkenb);
+}
+
+enum nx_bclkmode nx_disp_top_clkgen_get_clock_bclk_mode(u32 module_index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	u32 mode = 0;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+	mode = (pregister->clkenb & 3ul);
+
+	switch (mode) {
+	case 0:
+		return nx_bclkmode_disable;
+	case 2:
+		return nx_bclkmode_dynamic;
+	case 3:
+		return nx_bclkmode_always;
+	default:
+		break;
+	}
+	return nx_bclkmode_disable;
+}
+
+void nx_disp_top_clkgen_set_clock_pclk_mode(u32 module_index,
+				 enum nx_pclkmode mode)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 regvalue;
+	const u32 pclkmode_pos = 3;
+	u32 clkmode = 0;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+	switch (mode) {
+	case nx_pclkmode_dynamic:
+		clkmode = 0;
+		break;
+	case nx_pclkmode_always:
+		clkmode = 1;
+		break;
+	default:
+		break;
+	}
+
+	regvalue = pregister->clkenb;
+	regvalue &= ~(1ul << pclkmode_pos);
+	regvalue |= (clkmode & 0x01) << pclkmode_pos;
+
+	writel(regvalue, &pregister->clkenb);
+}
+
+enum nx_pclkmode nx_disp_top_clkgen_get_clock_pclk_mode(u32 module_index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 pclkmode_pos = 3;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	if (pregister->clkenb & (1ul << pclkmode_pos))
+		return nx_pclkmode_always;
+
+	return nx_pclkmode_dynamic;
+}
+
+void nx_disp_top_clkgen_set_clock_source(u32 module_index, u32 index,
+					u32 clk_src)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 read_value;
+
+	const u32 clksrcsel_pos = 2;
+	const u32 clksrcsel_mask = 0x07 << clksrcsel_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	read_value = pregister->CLKGEN[index << 1];
+	read_value &= ~clksrcsel_mask;
+	read_value |= clk_src << clksrcsel_pos;
+
+	writel(read_value, &pregister->CLKGEN[index << 1]);
+}
+
+u32 nx_disp_top_clkgen_get_clock_source(u32 module_index, u32 index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 clksrcsel_pos = 2;
+	const u32 clksrcsel_mask = 0x07 << clksrcsel_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	return (pregister->CLKGEN[index << 1] &
+		clksrcsel_mask) >> clksrcsel_pos;
+}
+
+void nx_disp_top_clkgen_set_clock_divisor(u32 module_index, u32 index,
+					 u32 divisor)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 clkdiv_pos = 5;
+	const u32 clkdiv_mask = 0xff << clkdiv_pos;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	read_value = pregister->CLKGEN[index << 1];
+	read_value &= ~clkdiv_mask;
+	read_value |= (divisor - 1) << clkdiv_pos;
+	writel(read_value, &pregister->CLKGEN[index << 1]);
+}
+
+u32 nx_disp_top_clkgen_get_clock_divisor(u32 module_index, u32 index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 clkdiv_pos = 5;
+	const u32 clkdiv_mask = 0xff << clkdiv_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	return ((pregister->CLKGEN[index << 1] &
+		 clkdiv_mask) >> clkdiv_pos) + 1;
+}
+
+void nx_disp_top_clkgen_set_clock_divisor_enable(u32 module_index, int enable)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 read_value;
+	const u32 clkgenenb_pos = 2;
+	const u32 clkgenenb_mask = 1ul << clkgenenb_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	read_value = pregister->clkenb;
+	read_value &= ~clkgenenb_mask;
+	read_value |= (u32)enable << clkgenenb_pos;
+
+	writel(read_value, &pregister->clkenb);
+}
+
+int nx_disp_top_clkgen_get_clock_divisor_enable(u32 module_index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 clkgenenb_pos = 2;
+	const u32 clkgenenb_mask = 1ul << clkgenenb_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	return (int)((pregister->clkenb &
+		      clkgenenb_mask) >> clkgenenb_pos);
+}
+
+void nx_disp_top_clkgen_set_clock_out_inv(u32 module_index, u32 index,
+					 int out_clk_inv)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 read_value;
+	const u32 outclkinv_pos = 1;
+	const u32 outclkinv_mask = 1ul << outclkinv_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	read_value = pregister->CLKGEN[index << 1];
+	read_value &= ~outclkinv_mask;
+	read_value |= out_clk_inv << outclkinv_pos;
+
+	writel(read_value, &pregister->CLKGEN[index << 1]);
+}
+
+int nx_disp_top_clkgen_get_clock_out_inv(u32 module_index, u32 index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 outclkinv_pos = 1;
+	const u32 outclkinv_mask = 1ul << outclkinv_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	return (int)((pregister->CLKGEN[index << 1] &
+		      outclkinv_mask) >> outclkinv_pos);
+}
+
+int nx_disp_top_clkgen_set_input_inv(u32 module_index,
+				u32 index, int in_clk_inv)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 read_value;
+	const u32 inclkinv_pos = 4 + index;
+	const u32 inclkinv_mask = 1ul << inclkinv_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	read_value = pregister->clkenb;
+	read_value &= ~inclkinv_mask;
+	read_value |= in_clk_inv << inclkinv_pos;
+
+	writel(read_value, &pregister->clkenb);
+	return true;
+}
+
+int nx_disp_top_clkgen_get_input_inv(u32 module_index, u32 index)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	const u32 inclkinv_pos = 4 + index;
+	const u32 inclkinv_mask = 1ul << inclkinv_pos;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	return (int)((pregister->clkenb &
+		      inclkinv_mask) >> inclkinv_pos);
+}
+
+void nx_disp_top_clkgen_set_clock_out_select(u32 module_index, u32 index,
+					    int bbypass)
+{
+	register struct nx_disptop_clkgen_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].__g_pregister;
+
+	read_value = pregister->CLKGEN[index << 1];
+	read_value = read_value & (~0x01);
+	read_value = read_value | bbypass;
+
+	writel(read_value, &pregister->CLKGEN[index << 1]);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop_clk.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_DISPTOP_CLK_H_
+#define _S5PXX18_SOC_DISPTOP_CLK_H_
+
+#include "s5pxx18_soc_disp.h"
+
+#define	PHY_BASEADDR_DISPTOP_CLKGEN_LIST	\
+		{ PHY_BASEADDR_DISPTOP_CLKGEN0_MODULE, \
+		  PHY_BASEADDR_DISPTOP_CLKGEN1_MODULE, \
+		  PHY_BASEADDR_DISPTOP_CLKGEN2_MODULE, \
+		  PHY_BASEADDR_DISPTOP_CLKGEN3_MODULE, \
+		  PHY_BASEADDR_DISPTOP_CLKGEN4_MODULE, \
+		}
+
+struct nx_disptop_clkgen_register_set {
+	u32 clkenb;
+	u32 CLKGEN[4];
+};
+
+int nx_disp_top_clkgen_initialize(void);
+u32 nx_disp_top_clkgen_get_number_of_module(void);
+u32 nx_disp_top_clkgen_get_physical_address(u32 module_index);
+u32 nx_disp_top_clkgen_get_size_of_register_set(void);
+void nx_disp_top_clkgen_set_base_address(u32 module_index,
+				void *base_address);
+void *nx_disp_top_clkgen_get_base_address(u32 module_index);
+void nx_disp_top_clkgen_set_clock_pclk_mode(u32 module_index,
+				enum nx_pclkmode mode);
+enum nx_pclkmode nx_disp_top_clkgen_get_clock_pclk_mode(u32 module_index);
+void nx_disp_top_clkgen_set_clock_source(u32 module_index, u32 index,
+				u32 clk_src);
+u32 nx_disp_top_clkgen_get_clock_source(u32 module_index, u32 index);
+void nx_disp_top_clkgen_set_clock_divisor(u32 module_index, u32 index,
+				u32 divisor);
+u32 nx_disp_top_clkgen_get_clock_divisor(u32 module_index, u32 index);
+void nx_disp_top_clkgen_set_clock_divisor_enable(u32 module_index,
+				int enable);
+int nx_disp_top_clkgen_get_clock_divisor_enable(u32 module_index);
+void nx_disp_top_clkgen_set_clock_bclk_mode(u32 module_index,
+				enum nx_bclkmode mode);
+enum nx_bclkmode nx_disp_top_clkgen_get_clock_bclk_mode(u32 module_index);
+
+void nx_disp_top_clkgen_set_clock_out_inv(u32 module_index, u32 index,
+				int out_clk_inv);
+int nx_disp_top_clkgen_get_clock_out_inv(u32 module_index, u32 index);
+int nx_disp_top_clkgen_set_input_inv(u32 module_index, u32 index,
+				int out_clk_inv);
+int nx_disp_top_clkgen_get_input_inv(u32 module_index, u32 index);
+
+void nx_disp_top_clkgen_set_clock_out_select(u32 module_index, u32 index,
+				int bbypass);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_disptop.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,391 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_DISPTOP_H_
+#define _S5PXX18_SOC_DISPTOP_H_
+
+#include "s5pxx18_soc_disp.h"
+
+#define NUMBER_OF_DISPTOP_MODULE	1
+#define PHY_BASEADDR_DISPLAYTOP_MODULE 0xC0100000
+#define	PHY_BASEADDR_DISPTOP_LIST	\
+		{ PHY_BASEADDR_DISPLAYTOP_MODULE }
+
+#define OTHER_ADDR_OFFSET                                                      \
+	(((PHY_BASEADDR_DISPLAYTOP_MODULE / 0x00100000) % 2) ? 0x000000        \
+							     : 0x100000)
+#define PHY_BASEADDR_DISPLAYTOP_MODULE_OFFSET (OTHER_ADDR_OFFSET + 0x001000)
+#define PHY_BASEADDR_DUALDISPLAY_MODULE                                        \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x002000)
+#define PHY_BASEADDR_RESCONV_MODULE                                            \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x003000)
+#define PHY_BASEADDR_LCDINTERFACE_MODULE                                       \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x004000)
+#define PHY_BASEADDR_HDMI_MODULE (PHY_BASEADDR_DISPLAYTOP_MODULE + 0x000000)
+#define PHY_BASEADDR_LVDS_MODULE                                               \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x00a000)
+
+#define NUMBER_OF_DUALDISPLAY_MODULE 1
+#define INTNUM_OF_DUALDISPLAY_MODULE_PRIMIRQ                                   \
+	INTNUM_OF_DISPLAYTOP_MODULE_DUALDISPLAY_PRIMIRQ
+#define INTNUM_OF_DUALDISPLAY_MODULE_SECONDIRQ                                 \
+	INTNUM_OF_DISPLAYTOP_MODULE_DUALDISPLAY_SECONDIRQ
+#define RESETINDEX_OF_DUALDISPLAY_MODULE_I_NRST                                \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_DUALDISPLAY_NRST
+#define PADINDEX_OF_DUALDISPLAY_O_NCS                                          \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PADPRIMVCLK
+#define PADINDEX_OF_DUALDISPLAY_O_NRD                                          \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_HSYNC
+#define PADINDEX_OF_DUALDISPLAY_O_RS                                           \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_VSYNC
+#define PADINDEX_OF_DUALDISPLAY_O_NWR                                          \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADDE
+#define PADINDEX_OF_DUALDISPLAY_PADPRIMVCLK                                    \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PADPRIMVCLK
+#define PADINDEX_OF_DUALDISPLAY_O_PRIM_PADN_HSYNC                              \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_HSYNC
+#define PADINDEX_OF_DUALDISPLAY_O_PRIM_PADN_VSYNC                              \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_VSYNC
+#define PADINDEX_OF_DUALDISPLAY_O_PRIM_PADDE                                   \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADDE
+#define PADINDEX_OF_DUALDISPLAY_PRIM_0_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_0_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_1_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_1_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_2_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_2_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_3_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_3_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_4_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_4_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_5_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_5_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_6_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_6_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_7_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_7_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_8_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_8_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_9_                                        \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_9_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_10_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_10_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_11_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_11_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_12_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_12_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_13_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_13_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_14_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_14_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_15_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_15_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_16_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_16_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_17_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_17_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_18_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_18_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_19_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_19_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_20_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_20_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_21_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_21_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_22_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_22_
+#define PADINDEX_OF_DUALDISPLAY_PRIM_23_                                       \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_23_
+#define PADINDEX_OF_DUALDISPLAY_PADSECONDVCLK                                  \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PADPRIMVCLK
+#define PADINDEX_OF_DUALDISPLAY_O_SECOND_PADN_HSYNC                            \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_HSYNC
+#define PADINDEX_OF_DUALDISPLAY_O_SECOND_PADN_VSYNC                            \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_VSYNC
+#define PADINDEX_OF_DUALDISPLAY_O_SECOND_PADDE                                 \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADDE
+#define PADINDEX_OF_DUALDISPLAY_SECOND_0_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_0_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_1_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_1_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_2_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_2_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_3_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_3_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_4_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_4_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_5_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_5_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_6_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_6_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_7_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_7_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_8_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_8_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_9_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_9_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_10_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_10_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_11_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_11_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_12_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_12_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_13_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_13_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_14_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_14_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_15_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_15_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_16_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_16_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_17_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_17_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_18_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_18_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_19_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_19_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_20_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_20_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_21_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_21_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_22_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_22_
+#define PADINDEX_OF_DUALDISPLAY_SECOND_23_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_23_
+
+#define NUMBER_OF_RESCONV_MODULE 1
+#define INTNUM_OF_RESCONV_MODULE INTNUM_OF_DISPLAYTOP_MODULE_RESCONV_IRQ
+#define RESETINDEX_OF_RESCONV_MODULE_I_NRST                                    \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_RESCONV_NRST
+#define RESETINDEX_OF_RESCONV_MODULE RESETINDEX_OF_RESCONV_MODULE_I_NRST
+#define NUMBER_OF_LCDINTERFACE_MODULE 1
+#define RESETINDEX_OF_LCDINTERFACE_MODULE_I_NRST                               \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_LCDIF_NRST
+#define PADINDEX_OF_LCDINTERFACE_O_VCLK                                        \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PADPRIMVCLK
+#define PADINDEX_OF_LCDINTERFACE_O_NHSYNC                                      \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_HSYNC
+#define PADINDEX_OF_LCDINTERFACE_O_NVSYNC                                      \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADN_VSYNC
+#define PADINDEX_OF_LCDINTERFACE_O_DE                                          \
+	PADINDEX_OF_DISPLAYTOP_O_DUAL_DISPLAY_PRIM_PADDE
+#define PADINDEX_OF_LCDINTERFACE_RGB24_0_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_0_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_1_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_1_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_2_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_2_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_3_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_3_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_4_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_4_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_5_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_5_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_6_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_6_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_7_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_7_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_8_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_8_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_9_                                      \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_9_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_10_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_10_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_11_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_11_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_12_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_12_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_13_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_13_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_14_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_14_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_15_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_15_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_16_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_16_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_17_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_17_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_18_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_18_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_19_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_19_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_20_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_20_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_21_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_21_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_22_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_22_
+#define PADINDEX_OF_LCDINTERFACE_RGB24_23_                                     \
+	PADINDEX_OF_DISPLAYTOP_DUAL_DISPLAY_PRIM_23_
+
+#define NUMBER_OF_HDMI_MODULE 1
+#define INTNUM_OF_HDMI_MODULE INTNUM_OF_DISPLAYTOP_MODULE_HDMI_IRQ
+#define RESETINDEX_OF_HDMI_MODULE_I_NRST                                       \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_HDMI_NRST
+#define RESETINDEX_OF_HDMI_MODULE_I_NRST_VIDEO                                 \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_HDMI_VIDEO_NRST
+#define RESETINDEX_OF_HDMI_MODULE_I_NRST_SPDIF                                 \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_HDMI_SPDIF_NRST
+#define RESETINDEX_OF_HDMI_MODULE_I_NRST_TMDS                                  \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_HDMI_TMDS_NRST
+#define RESETINDEX_OF_HDMI_MODULE_I_NRST_PHY                                   \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_HDMI_PHY_NRST
+#define PADINDEX_OF_HDMI_I_PHY_CLKI PADINDEX_OF_DISPLAYTOP_I_HDMI_CLKI
+#define PADINDEX_OF_HDMI_O_PHY_CLKO PADINDEX_OF_DISPLAYTOP_O_HDMI_CLKO
+#define PADINDEX_OF_HDMI_IO_PHY_REXT PADINDEX_OF_DISPLAYTOP_IO_HDMI_REXT
+#define PADINDEX_OF_HDMI_O_PHY_TX0P PADINDEX_OF_DISPLAYTOP_O_HDMI_TX0P
+#define PADINDEX_OF_HDMI_O_PHY_TX0N PADINDEX_OF_DISPLAYTOP_O_HDMI_TX0N
+#define PADINDEX_OF_HDMI_O_PHY_TX1P PADINDEX_OF_DISPLAYTOP_O_HDMI_TX1P
+#define PADINDEX_OF_HDMI_O_PHY_TX1N PADINDEX_OF_DISPLAYTOP_O_HDMI_TX1N
+#define PADINDEX_OF_HDMI_O_PHY_TX2P PADINDEX_OF_DISPLAYTOP_O_HDMI_TX2P
+#define PADINDEX_OF_HDMI_O_PHY_TX2N PADINDEX_OF_DISPLAYTOP_O_HDMI_TX2N
+#define PADINDEX_OF_HDMI_O_PHY_TXCP PADINDEX_OF_DISPLAYTOP_O_HDMI_TXCP
+#define PADINDEX_OF_HDMI_O_PHY_TXCN PADINDEX_OF_DISPLAYTOP_O_HDMI_TXCN
+#define PADINDEX_OF_HDMI_I_HOTPLUG PADINDEX_OF_DISPLAYTOP_I_HDMI_HOTPLUG_5V
+#define PADINDEX_OF_HDMI_IO_PAD_CEC PADINDEX_OF_DISPLAYTOP_IO_HDMI_CEC
+#define NUMBER_OF_LVDS_MODULE 1
+
+#define RESETINDEX_OF_LVDS_MODULE_I_RESETN                                     \
+	RESETINDEX_OF_DISPLAYTOP_MODULE_I_LVDS_NRST
+#define RESETINDEX_OF_LVDS_MODULE RESETINDEX_OF_LVDS_MODULE_I_RESETN
+
+#define PADINDEX_OF_LVDS_TAP PADINDEX_OF_DISPLAYTOP_LVDS_TXP_A
+#define PADINDEX_OF_LVDS_TAN PADINDEX_OF_DISPLAYTOP_LVDS_TXN_A
+#define PADINDEX_OF_LVDS_TBP PADINDEX_OF_DISPLAYTOP_LVDS_TXP_B
+#define PADINDEX_OF_LVDS_TBN PADINDEX_OF_DISPLAYTOP_LVDS_TXN_B
+#define PADINDEX_OF_LVDS_TCP PADINDEX_OF_DISPLAYTOP_LVDS_TXP_C
+#define PADINDEX_OF_LVDS_TCN PADINDEX_OF_DISPLAYTOP_LVDS_TXN_C
+#define PADINDEX_OF_LVDS_TDP PADINDEX_OF_DISPLAYTOP_LVDS_TXP_D
+#define PADINDEX_OF_LVDS_TDN PADINDEX_OF_DISPLAYTOP_LVDS_TXN_D
+#define PADINDEX_OF_LVDS_TCLKP PADINDEX_OF_DISPLAYTOP_LVDS_TXP_CLK
+#define PADINDEX_OF_LVDS_TCLKN PADINDEX_OF_DISPLAYTOP_LVDS_TXN_CLK
+#define PADINDEX_OF_LVDS_ROUT PADINDEX_OF_DISPLAYTOP_LVDS_ROUT
+#define PADINDEX_OF_LVDS_TEP PADINDEX_OF_DISPLAYTOP_LVDS_TXN_E
+#define PADINDEX_OF_LVDS_TEN PADINDEX_OF_DISPLAYTOP_LVDS_TXN_E
+#define NUMBER_OF_DISPTOP_CLKGEN_MODULE 5
+
+enum disptop_clkgen_module_index {
+	res_conv_clkgen = 0,
+	lcdif_clkgen = 1,
+	to_mipi_clkgen = 2,
+	to_lvds_clkgen = 3,
+	hdmi_clkgen = 4,
+};
+
+enum disptop_res_conv_iclk_cclk {
+	res_conv_iclk = 0,
+	res_conv_cclk = 1,
+};
+
+enum disptop_res_conv_oclk {
+	res_conv_oclk = 1,
+};
+
+enum disptop_lcdif_clk {
+	lcdif_pixel_clkx_n = 0,
+	lcdif_pixel_clk = 1,
+};
+
+#define HDMI_SPDIF_CLKGEN 2
+#define HDMI_SPDIF_CLKOUT 0
+#define HDMI_I_VCLK_CLKOUT 0
+#define PHY_BASEADDR_DISPTOP_CLKGEN0_MODULE                                    \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x006000)
+#define PHY_BASEADDR_DISPTOP_CLKGEN1_MODULE                                    \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x007000)
+#define PHY_BASEADDR_DISPTOP_CLKGEN2_MODULE                                    \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x005000)
+#define PHY_BASEADDR_DISPTOP_CLKGEN3_MODULE                                    \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x008000)
+#define PHY_BASEADDR_DISPTOP_CLKGEN4_MODULE                                    \
+	(PHY_BASEADDR_DISPLAYTOP_MODULE + OTHER_ADDR_OFFSET + 0x009000)
+
+struct nx_disp_top_register_set {
+	u32 resconv_mux_ctrl;
+	u32 interconv_mux_ctrl;
+	u32 mipi_mux_ctrl;
+	u32 lvds_mux_ctrl;
+	u32 hdmifixctrl0;
+	u32 hdmisyncctrl0;
+	u32 hdmisyncctrl1;
+	u32 hdmisyncctrl2;
+	u32 hdmisyncctrl3;
+	u32 tftmpu_mux;
+	u32 hdmifieldctrl;
+	u32 greg0;
+	u32 greg1;
+	u32 greg2;
+	u32 greg3;
+	u32 greg4;
+	u32 greg5;
+};
+
+int nx_disp_top_initialize(void);
+u32 nx_disp_top_get_number_of_module(void);
+
+u32 nx_disp_top_get_physical_address(void);
+u32 nx_disp_top_get_size_of_register_set(void);
+void nx_disp_top_set_base_address(void *base_address);
+void *nx_disp_top_get_base_address(void);
+int nx_disp_top_open_module(void);
+int nx_disp_top_close_module(void);
+int nx_disp_top_check_busy(void);
+
+enum mux_index {
+	primary_mlc = 0,
+	secondary_mlc = 1,
+	resolution_conv = 2,
+};
+enum prim_pad_mux_index {
+	padmux_primary_mlc = 0,
+	padmux_primary_mpu = 1,
+	padmux_secondary_mlc = 2,
+	padmux_resolution_conv = 3,
+};
+
+void nx_disp_top_set_resconvmux(int benb, u32 sel);
+void nx_disp_top_set_hdmimux(int benb, u32 sel);
+void nx_disp_top_set_mipimux(int benb, u32 sel);
+void nx_disp_top_set_lvdsmux(int benb, u32 sel);
+void nx_disp_top_set_primary_mux(u32 sel);
+void nx_disp_top_hdmi_set_vsync_start(u32 sel);
+void nx_disp_top_hdmi_set_vsync_hsstart_end(u32 start, u32 end);
+void nx_disp_top_hdmi_set_hactive_start(u32 sel);
+void nx_disp_top_hdmi_set_hactive_end(u32 sel);
+
+void nx_disp_top_set_hdmifield(u32 enable, u32 init_val, u32 vsynctoggle,
+			       u32 hsynctoggle, u32 vsyncclr, u32 hsyncclr,
+			       u32 field_use, u32 muxsel);
+
+enum padclk_config {
+	padclk_clk = 0,
+	padclk_inv_clk = 1,
+	padclk_reserved_clk = 2,
+	padclk_reserved_inv_clk = 3,
+	padclk_clk_div2_0 = 4,
+	padclk_clk_div2_90 = 5,
+	padclk_clk_div2_180 = 6,
+	padclk_clk_div2_270 = 7,
+};
+
+void nx_disp_top_set_padclock(u32 mux_index, u32 padclk_cfg);
+void nx_disp_top_set_lcdif_enb(int enb);
+void nx_disp_top_set_hdmifield(u32 enable, u32 init_val, u32 vsynctoggle,
+			       u32 hsynctoggle, u32 vsyncclr, u32 hsyncclr,
+			       u32 field_use, u32 muxsel);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.c b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,1580 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_dpc.h"
+
+static struct {
+	struct nx_dpc_register_set *pregister;
+} __g_module_variables[NUMBER_OF_DPC_MODULE] = { { NULL,},};
+
+int nx_dpc_initialize(void)
+{
+	static int binit;
+	u32 i;
+
+	if (0 == binit) {
+		for (i = 0; i < NUMBER_OF_DPC_MODULE; i++)
+			__g_module_variables[i].pregister = NULL;
+		binit = 1;
+	}
+	return 1;
+}
+
+u32 nx_dpc_get_number_of_module(void)
+{
+	return NUMBER_OF_DPC_MODULE;
+}
+
+u32 nx_dpc_get_physical_address(u32 module_index)
+{
+	const u32 physical_addr[] = PHY_BASEADDR_DPC_LIST;
+
+	return physical_addr[module_index];
+}
+
+void nx_dpc_set_base_address(u32 module_index, void *base_address)
+{
+	__g_module_variables[module_index].pregister =
+	    (struct nx_dpc_register_set *)base_address;
+}
+
+void *nx_dpc_get_base_address(u32 module_index)
+{
+	return (void *)__g_module_variables[module_index].pregister;
+}
+
+void nx_dpc_set_interrupt_enable(u32 module_index, int32_t int_num, int enable)
+{
+	const u32 intenb_pos = 11;
+	const u32 intenb_mask = 1ul << intenb_pos;
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1ul << intpend_pos;
+
+	register u32 regvalue;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->dpcctrl0;
+	regvalue &= ~(intenb_mask | intpend_mask);
+	regvalue |= (u32) enable << intenb_pos;
+
+	writel(regvalue, &pregister->dpcctrl0);
+}
+
+int nx_dpc_get_interrupt_enable(u32 module_index, int32_t int_num)
+{
+	const u32 intenb_pos = 11;
+	const u32 intenb_mask = 1ul << intenb_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->dpcctrl0 &
+		      intenb_mask) >> intenb_pos);
+}
+
+void nx_dpc_set_interrupt_enable32(u32 module_index, u32 enable_flag)
+{
+	const u32 intenb_pos = 11;
+	const u32 intenb_mask = 1 << intenb_pos;
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1 << intpend_pos;
+
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcctrl0 & ~(intpend_mask | intenb_mask);
+
+	writel((u32) (read_value | (enable_flag & 0x01) << intenb_pos),
+	       &pregister->dpcctrl0);
+}
+
+u32 nx_dpc_get_interrupt_enable32(u32 module_index)
+{
+	const u32 intenb_pos = 11;
+	const u32 intenb_mask = 1 << intenb_pos;
+
+	return (u32) ((__g_module_variables[module_index].pregister->dpcctrl0 &
+		       intenb_mask) >> intenb_pos);
+}
+
+int nx_dpc_get_interrupt_pending(u32 module_index, int32_t int_num)
+{
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1ul << intpend_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->dpcctrl0 &
+		      intpend_mask) >> intpend_pos);
+}
+
+u32 nx_dpc_get_interrupt_pending32(u32 module_index)
+{
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1 << intpend_pos;
+
+	return (u32) ((__g_module_variables[module_index].pregister->dpcctrl0 &
+		       intpend_mask) >> intpend_pos);
+}
+
+void nx_dpc_clear_interrupt_pending(u32 module_index, int32_t int_num)
+{
+	const u32 intpend_pos = 10;
+	register struct nx_dpc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->dpcctrl0;
+	regvalue |= 1ul << intpend_pos;
+
+	writel(regvalue, &pregister->dpcctrl0);
+}
+
+void nx_dpc_clear_interrupt_pending32(u32 module_index, u32 pending_flag)
+{
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1 << intpend_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcctrl0 & ~intpend_mask;
+
+	writel((u32) (read_value | ((pending_flag & 0x01) << intpend_pos)),
+	       &pregister->dpcctrl0);
+}
+
+void nx_dpc_set_interrupt_enable_all(u32 module_index, int enable)
+{
+	const u32 intenb_pos = 11;
+	const u32 intenb_mask = 1ul << intenb_pos;
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1ul << intpend_pos;
+	register u32 regvalue;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->dpcctrl0;
+	regvalue &= ~(intenb_mask | intpend_mask);
+	regvalue |= (u32) enable << intenb_pos;
+
+	writel(regvalue, &pregister->dpcctrl0);
+}
+
+int nx_dpc_get_interrupt_enable_all(u32 module_index)
+{
+	const u32 intenb_pos = 11;
+	const u32 intenb_mask = 1ul << intenb_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->dpcctrl0 &
+		      intenb_mask) >> intenb_pos);
+}
+
+int nx_dpc_get_interrupt_pending_all(u32 module_index)
+{
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1ul << intpend_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->dpcctrl0 &
+		      intpend_mask) >> intpend_pos);
+}
+
+void nx_dpc_clear_interrupt_pending_all(u32 module_index)
+{
+	const u32 intpend_pos = 10;
+	register struct nx_dpc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->dpcctrl0;
+	regvalue |= 1ul << intpend_pos;
+
+	writel(regvalue, &pregister->dpcctrl0);
+}
+
+int32_t nx_dpc_get_interrupt_pending_number(u32 module_index)
+{
+	const u32 intenb_pos = 11;
+	const u32 intpend_pos = 10;
+	register struct nx_dpc_register_set *pregister;
+	register u32 pend;
+
+	pregister = __g_module_variables[module_index].pregister;
+	pend = ((pregister->dpcctrl0 >> intenb_pos) &&
+		(pregister->dpcctrl0 >> intpend_pos));
+
+	if (pend & 0x01)
+		return 0;
+
+	return -1;
+}
+
+void nx_dpc_set_clock_pclk_mode(u32 module_index, enum nx_pclkmode mode)
+{
+	const u32 pclkmode_pos = 3;
+	register u32 regvalue;
+	register struct nx_dpc_register_set *pregister;
+	u32 clkmode = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+	switch (mode) {
+	case nx_pclkmode_dynamic:
+		clkmode = 0;
+		break;
+	case nx_pclkmode_always:
+		clkmode = 1;
+		break;
+	default:
+		break;
+	}
+	regvalue = pregister->dpcclkenb;
+	regvalue &= ~(1ul << pclkmode_pos);
+	regvalue |= (clkmode & 0x01) << pclkmode_pos;
+
+	writel(regvalue, &pregister->dpcclkenb);
+}
+
+enum nx_pclkmode nx_dpc_get_clock_pclk_mode(u32 module_index)
+{
+	const u32 pclkmode_pos = 3;
+
+	if (__g_module_variables[module_index].pregister->dpcclkenb &
+	    (1ul << pclkmode_pos)) {
+		return nx_pclkmode_always;
+	}
+	return nx_pclkmode_dynamic;
+}
+
+void nx_dpc_set_clock_source(u32 module_index, u32 index, u32 clk_src)
+{
+	const u32 clksrcsel_pos = 2;
+	const u32 clksrcsel_mask = 0x07 << clksrcsel_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkgen[index][0];
+	read_value &= ~clksrcsel_mask;
+	read_value |= clk_src << clksrcsel_pos;
+
+	writel(read_value, &pregister->dpcclkgen[index][0]);
+}
+
+u32 nx_dpc_get_clock_source(u32 module_index, u32 index)
+{
+	const u32 clksrcsel_pos = 2;
+	const u32 clksrcsel_mask = 0x07 << clksrcsel_pos;
+
+	return (__g_module_variables[module_index]
+		.pregister->dpcclkgen[index][0] &
+		clksrcsel_mask) >> clksrcsel_pos;
+}
+
+void nx_dpc_set_clock_divisor(u32 module_index, u32 index, u32 divisor)
+{
+	const u32 clkdiv_pos = 5;
+	const u32 clkdiv_mask = ((1 << 8) - 1) << clkdiv_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkgen[index][0];
+	read_value &= ~clkdiv_mask;
+	read_value |= (divisor - 1) << clkdiv_pos;
+
+	writel(read_value, &pregister->dpcclkgen[index][0]);
+}
+
+u32 nx_dpc_get_clock_divisor(u32 module_index, u32 index)
+{
+	const u32 clkdiv_pos = 5;
+	const u32 clkdiv_mask = ((1 << 8) - 1) << clkdiv_pos;
+
+	return ((__g_module_variables[module_index]
+		 .pregister->dpcclkgen[index][0] &
+		 clkdiv_mask) >> clkdiv_pos) + 1;
+}
+
+void nx_dpc_set_clock_out_inv(u32 module_index, u32 index, int out_clk_inv)
+{
+	const u32 outclkinv_pos = 1;
+	const u32 outclkinv_mask = 1ul << outclkinv_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkgen[index][0];
+	read_value &= ~outclkinv_mask;
+	read_value |= out_clk_inv << outclkinv_pos;
+
+	writel(read_value, &pregister->dpcclkgen[index][0]);
+}
+
+int nx_dpc_get_clock_out_inv(u32 module_index, u32 index)
+{
+	const u32 outclkinv_pos = 1;
+	const u32 outclkinv_mask = 1ul << outclkinv_pos;
+
+	return (int)((__g_module_variables[module_index]
+		      .pregister->dpcclkgen[index][0] &
+		      outclkinv_mask) >> outclkinv_pos);
+}
+
+void nx_dpc_set_clock_out_select(u32 module_index, u32 index, int bbypass)
+{
+	const u32 outclksel_pos = 0;
+	const u32 outclksel_mask = 1ul << outclksel_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkgen[index][0];
+	read_value &= ~outclksel_mask;
+	if (0 == bbypass)
+		read_value |= outclksel_mask;
+
+	writel(read_value, &pregister->dpcclkgen[index][0]);
+}
+
+int nx_dpc_get_clock_out_select(u32 module_index, u32 index)
+{
+	const u32 outclksel_pos = 0;
+	const u32 outclksel_mask = 1ul << outclksel_pos;
+
+	if (__g_module_variables[module_index].pregister->dpcclkgen[index][0] &
+	    outclksel_mask) {
+		return 0;
+	} else {
+		return 1;
+	}
+}
+
+void nx_dpc_set_clock_polarity(u32 module_index, int bpolarity)
+{
+	const u32 clkpol_pos = 2;
+	const u32 clkpol_mask = 1ul << clkpol_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcctrl1;
+	read_value &= ~clkpol_mask;
+	if (1 == bpolarity)
+		read_value |= clkpol_mask;
+
+	writel(read_value, &pregister->dpcctrl1);
+}
+
+int nx_dpc_get_clock_polarity(u32 module_index)
+{
+	const u32 clkpol_pos = 2;
+	const u32 clkpol_mask = 1ul << clkpol_pos;
+
+	if (__g_module_variables[module_index].pregister->dpcctrl1 &
+	    clkpol_mask) {
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+void nx_dpc_set_clock_out_enb(u32 module_index, u32 index, int out_clk_enb)
+{
+	const u32 outclkenb_pos = 15;
+	const u32 outclkenb_mask = 1ul << outclkenb_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkgen[index][0];
+	read_value &= ~outclkenb_mask;
+
+	if (1 == out_clk_enb)
+		read_value |= outclkenb_mask;
+
+	writel(read_value, &pregister->dpcclkgen[index][0]);
+}
+
+int nx_dpc_get_clock_out_enb(u32 module_index, u32 index)
+{
+	const u32 outclkenb_pos = 15;
+	const u32 outclkenb_mask = 1ul << outclkenb_pos;
+
+	if (__g_module_variables[module_index].pregister->dpcclkgen[index][0] &
+	    outclkenb_mask) {
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+void nx_dpc_set_clock_out_delay(u32 module_index, u32 index, u32 delay)
+{
+	const u32 outclkdelay_pos = 0;
+	const u32 outclkdelay_mask = 0x1f << outclkdelay_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkgen[index][1];
+	read_value &= ~outclkdelay_mask;
+	read_value |= (u32) delay << outclkdelay_pos;
+
+	writel(read_value, &pregister->dpcclkgen[index][1]);
+}
+
+u32 nx_dpc_get_clock_out_delay(u32 module_index, u32 index)
+{
+	register struct nx_dpc_register_set *pregister;
+	const u32 outclkdelay_pos = 0;
+	const u32 outclkdelay_mask = 0x1f << outclkdelay_pos;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	return (u32)((pregister->dpcclkgen[index][1] & outclkdelay_mask) >>
+		outclkdelay_pos);
+}
+
+void nx_dpc_set_clock_divisor_enable(u32 module_index, int enable)
+{
+	const u32 clkgenenb_pos = 2;
+	const u32 clkgenenb_mask = 1ul << clkgenenb_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcclkenb;
+	read_value &= ~clkgenenb_mask;
+	read_value |= (u32) enable << clkgenenb_pos;
+
+	writel(read_value, &pregister->dpcclkenb);
+}
+
+int nx_dpc_get_clock_divisor_enable(u32 module_index)
+{
+	const u32 clkgenenb_pos = 2;
+	const u32 clkgenenb_mask = 1ul << clkgenenb_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->dpcclkenb &
+		      clkgenenb_mask) >> clkgenenb_pos);
+}
+
+void nx_dpc_set_dpc_enable(u32 module_index, int benb)
+{
+	const u32 intpend_pos = 10;
+	const u32 intpend_mask = 1ul << intpend_pos;
+	const u32 dpcenb_pos = 15;
+	const u32 dpcenb_mask = 1ul << dpcenb_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->dpcctrl0;
+	read_value &= ~(intpend_mask | dpcenb_mask);
+	read_value |= (u32) benb << dpcenb_pos;
+
+	writel(read_value, &pregister->dpcctrl0);
+}
+
+int nx_dpc_get_dpc_enable(u32 module_index)
+{
+	const u32 dpcenb_pos = 15;
+	const u32 dpcenb_mask = 1ul << dpcenb_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->dpcctrl0 &
+		      dpcenb_mask) >> dpcenb_pos);
+}
+
+void nx_dpc_set_delay(u32 module_index, u32 delay_rgb_pvd, u32 delay_hs_cp1,
+		      u32 delay_vs_fram, u32 delay_de_cp2)
+{
+	const u32 intpend_mask = 1u << 10;
+	const u32 delayrgb_pos = 4;
+	const u32 delayrgb_mask = 0xfu << delayrgb_pos;
+	register u32 temp;
+	const u32 delayde_pos = 0;
+	const u32 delayvs_pos = 8;
+	const u32 delayhs_pos = 0;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = pregister->dpcctrl0;
+	temp &= (u32)~(intpend_mask | delayrgb_mask);
+	temp = (u32)(temp | (delay_rgb_pvd << delayrgb_pos));
+
+	writel(temp, &pregister->dpcctrl0);
+
+	writel((u32) ((delay_vs_fram << delayvs_pos) |
+		      (delay_hs_cp1 << delayhs_pos)), &pregister->dpcdelay0);
+
+	writel((u32) (delay_de_cp2 << delayde_pos), &pregister->dpcdelay1);
+}
+
+void nx_dpc_get_delay(u32 module_index, u32 *pdelayrgb_pvd, u32 *pdelayhs_cp1,
+			u32 *pdelayvs_fram, u32 *pdelayde_cp2)
+{
+	const u32 delayrgb_pos = 4;
+	const u32 delayrgb_mask = 0xfu << delayrgb_pos;
+	const u32 delayde_pos = 0;
+	const u32 delayde_mask = 0x3fu << delayde_pos;
+	const u32 delayvs_pos = 8;
+	const u32 delayvs_mask = 0x3fu << delayvs_pos;
+	const u32 delayhs_pos = 0;
+	const u32 delayhs_mask = 0x3fu << delayhs_pos;
+	register u32 temp;
+
+	temp = __g_module_variables[module_index].pregister->dpcctrl0;
+	if (NULL != pdelayrgb_pvd)
+		*pdelayrgb_pvd = (u32) ((temp & delayrgb_mask) >> delayrgb_pos);
+	temp = __g_module_variables[module_index].pregister->dpcdelay0;
+	if (NULL != pdelayhs_cp1)
+		*pdelayhs_cp1 = (u32) ((temp & delayhs_mask) >> delayhs_pos);
+	if (NULL != pdelayvs_fram)
+		*pdelayvs_fram = (u32) ((temp & delayvs_mask) >> delayvs_pos);
+	temp = __g_module_variables[module_index].pregister->dpcdelay1;
+	if (NULL != pdelayde_cp2)
+		*pdelayde_cp2 = (u32) ((temp & delayde_mask) >> delayde_pos);
+}
+
+void nx_dpc_set_dither(u32 module_index, enum nx_dpc_dither dither_r,
+			enum nx_dpc_dither dither_g,
+			enum nx_dpc_dither dither_b)
+{
+	const u32 dither_mask = 0x3fu;
+	const u32 rdither_pos = 0;
+	const u32 gdither_pos = 2;
+	const u32 bdither_pos = 4;
+	register u32 temp;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = pregister->dpcctrl1;
+	temp &= (u32) ~dither_mask;
+	temp = (u32)(temp |
+		      ((dither_b << bdither_pos) | (dither_g << gdither_pos) |
+		       (dither_r << rdither_pos)));
+
+	writel(temp, &pregister->dpcctrl1);
+}
+
+void nx_dpc_get_dither(u32 module_index, enum nx_dpc_dither *pditherr,
+			enum nx_dpc_dither *pditherg,
+			enum nx_dpc_dither *pditherb)
+{
+	const u32 rdither_pos = 0;
+	const u32 rdither_mask = 0x3u << rdither_pos;
+	const u32 gdither_pos = 2;
+	const u32 gdither_mask = 0x3u << gdither_pos;
+	const u32 bdither_pos = 4;
+	const u32 bdither_mask = 0x3u << bdither_pos;
+	register u32 temp;
+
+	temp = __g_module_variables[module_index].pregister->dpcctrl1;
+	if (NULL != pditherr)
+		*pditherr =
+		    (enum nx_dpc_dither)((temp & rdither_mask) >> rdither_pos);
+	if (NULL != pditherg)
+		*pditherg =
+		    (enum nx_dpc_dither)((temp & gdither_mask) >> gdither_pos);
+	if (NULL != pditherb)
+		*pditherb =
+		    (enum nx_dpc_dither)((temp & bdither_mask) >> bdither_pos);
+}
+
+void nx_dpc_set_mode(u32 module_index, enum nx_dpc_format format,
+			int binterlace, int binvertfield, int brgbmode,
+			int bswaprb, enum nx_dpc_ycorder ycorder, int bclipyc,
+			int bembeddedsync, enum nx_dpc_padclk clock,
+			int binvertclock, int bdualview)
+{
+	const u32 polfield_pos = 2;
+	const u32 seavenb_pos = 8;
+	const u32 scanmode_pos = 9;
+	const u32 intpend_pos = 10;
+	const u32 rgbmode_pos = 12;
+
+	const u32 dither_mask = 0x3f;
+	const u32 ycorder_pos = 6;
+	const u32 format_pos = 8;
+	const u32 ycrange_pos = 13;
+	const u32 swaprb_pos = 15;
+
+	const u32 padclksel_pos = 0;
+	const u32 padclksel_mask = 3u << padclksel_pos;
+	const u32 lcdtype_pos = 7;
+	const u32 lcdtype_mask = 3u << lcdtype_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u32 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = pregister->dpcctrl0;
+	temp &= (u32)~(1u << intpend_pos);
+	if (binterlace)
+		temp |= (u32)(1u << scanmode_pos);
+	else
+		temp &= (u32)~(1u << scanmode_pos);
+	if (binvertfield)
+		temp |= (u32)(1u << polfield_pos);
+	else
+		temp &= (u32)~(1u << polfield_pos);
+	if (brgbmode)
+		temp |= (u32)(1u << rgbmode_pos);
+	else
+		temp &= (u32)~(1u << rgbmode_pos);
+	if (bembeddedsync)
+		temp |= (u32)(1u << seavenb_pos);
+	else
+		temp &= (u32)~(1u << seavenb_pos);
+
+	writel(temp, &pregister->dpcctrl0);
+	temp = pregister->dpcctrl1;
+	temp &= (u32) dither_mask;
+	temp = (u32) (temp | (ycorder << ycorder_pos));
+	if (format >= 16) {
+		register u32 temp1;
+
+		temp1 = pregister->dpcctrl2;
+		temp1 = temp1 | (1 << 4);
+		writel(temp1, &pregister->dpcctrl2);
+	} else {
+		register u32 temp1;
+
+		temp1 = pregister->dpcctrl2;
+		temp1 = temp1 & ~(1 << 4);
+		writel(temp1, &pregister->dpcctrl2);
+	}
+	temp = (u32) (temp | ((format & 0xf) << format_pos));
+	if (!bclipyc)
+		temp |= (u32) (1u << ycrange_pos);
+	if (bswaprb)
+		temp |= (u32) (1u << swaprb_pos);
+
+	writel(temp, &pregister->dpcctrl1);
+	temp = pregister->dpcctrl2;
+	temp &= (u32)~(padclksel_mask | lcdtype_mask);
+	temp = (u32) (temp | (clock << padclksel_pos));
+
+	writel(temp, &pregister->dpcctrl2);
+
+	nx_dpc_set_clock_out_inv(module_index, 0, binvertclock);
+	nx_dpc_set_clock_out_inv(module_index, 1, binvertclock);
+}
+
+void nx_dpc_get_mode(u32 module_index, enum nx_dpc_format *pformat,
+			int *pbinterlace, int *pbinvertfield, int *pbrgbmode,
+			int *pbswaprb, enum nx_dpc_ycorder *pycorder,
+			int *pbclipyc, int *pbembeddedsync,
+			enum nx_dpc_padclk *pclock, int *pbinvertclock,
+			int *pbdualview)
+{
+	const u32 polfield = 1u << 2;
+	const u32 seavenb = 1u << 8;
+	const u32 scanmode = 1u << 9;
+	const u32 rgbmode = 1u << 12;
+
+	const u32 ycorder_pos = 6;
+	const u32 ycorder_mask = 0x3u << ycorder_pos;
+	const u32 format_pos = 8;
+	const u32 format_mask = 0xfu << format_pos;
+	const u32 ycrange = 1u << 13;
+	const u32 swaprb = 1u << 15;
+
+	const u32 padclksel_pos = 0;
+	const u32 padclksel_mask = 3u << padclksel_pos;
+	const u32 lcdtype_pos = 7;
+	const u32 lcdtype_mask = 3u << lcdtype_pos;
+	register u32 temp;
+
+	temp = __g_module_variables[module_index].pregister->dpcctrl0;
+	if (NULL != pbinterlace)
+		*pbinterlace = (temp & scanmode) ? 1 : 0;
+
+	if (NULL != pbinvertfield)
+		*pbinvertfield = (temp & polfield) ? 1 : 0;
+
+	if (NULL != pbrgbmode)
+		*pbrgbmode = (temp & rgbmode) ? 1 : 0;
+
+	if (NULL != pbembeddedsync)
+		*pbembeddedsync = (temp & seavenb) ? 1 : 0;
+
+	temp = __g_module_variables[module_index].pregister->dpcctrl1;
+
+	if (NULL != pycorder)
+		*pycorder =
+		    (enum nx_dpc_ycorder)((temp & ycorder_mask) >> ycorder_pos);
+
+	if (NULL != pformat)
+		*pformat =
+		    (enum nx_dpc_format)((temp & format_mask) >> format_pos);
+	if (NULL != pbclipyc)
+		*pbclipyc = (temp & ycrange) ? 0 : 1;
+	if (NULL != pbswaprb)
+		*pbswaprb = (temp & swaprb) ? 1 : 0;
+
+	temp = __g_module_variables[module_index].pregister->dpcctrl2;
+
+	if (NULL != pclock)
+		*pclock =
+		    (enum nx_dpc_padclk)((temp & padclksel_mask) >>
+					 padclksel_pos);
+
+	if (NULL != pbdualview)
+		*pbdualview = (2 == ((temp & lcdtype_mask) >> lcdtype_pos))
+		    ? 1 : 0;
+
+	if (NULL != pbinvertclock)
+		*pbinvertclock = nx_dpc_get_clock_out_inv(module_index, 1);
+}
+
+void nx_dpc_set_hsync(u32 module_index, u32 avwidth, u32 hsw, u32 hfp, u32 hbp,
+			int binvhsync)
+{
+	const u32 intpend = 1u << 10;
+	const u32 polhsync = 1u << 0;
+	register u32 temp;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((u32) (hsw + hbp + avwidth + hfp - 1), &pregister->dpchtotal);
+
+	writel((u32) (hsw - 1), &pregister->dpchswidth);
+
+	writel((u32) (hsw + hbp - 1), &pregister->dpchastart);
+
+	writel((u32) (hsw + hbp + avwidth - 1), &pregister->dpchaend);
+	temp = pregister->dpcctrl0;
+	temp &= ~intpend;
+	if (binvhsync)
+		temp |= (u32) polhsync;
+	else
+		temp &= (u32)~polhsync;
+
+	writel(temp, &pregister->dpcctrl0);
+}
+
+void nx_dpc_get_hsync(u32 module_index, u32 *pavwidth, u32 *phsw, u32 *phfp,
+			u32 *phbp, int *pbinvhsync)
+{
+	const u32 polhsync = 1u << 0;
+	u32 htotal, hsw, hab, hae;
+	u32 avw, hfp, hbp;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	htotal = (u32) pregister->dpchtotal + 1;
+	hsw = (u32) pregister->dpchswidth + 1;
+	hab = (u32) pregister->dpchastart + 1;
+	hae = (u32) pregister->dpchaend + 1;
+	hbp = hab - hsw;
+	avw = hae - hab;
+	hfp = htotal - hae;
+	if (NULL != pavwidth)
+		*pavwidth = avw;
+	if (NULL != phsw)
+		*phsw = hsw;
+	if (NULL != phfp)
+		*phfp = hfp;
+	if (NULL != phbp)
+		*phbp = hbp;
+	if (NULL != pbinvhsync)
+		*pbinvhsync = (pregister->dpcctrl0 & polhsync) ? 1 : 0;
+}
+
+void nx_dpc_set_vsync(u32 module_index, u32 avheight, u32 vsw, u32 vfp, u32 vbp,
+		      int binvvsync, u32 eavheight, u32 evsw, u32 evfp,
+		      u32 evbp)
+{
+	const u32 intpend = 1u << 10;
+	const u32 polvsync = 1u << 1;
+	register u32 temp;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((u32) (vsw + vbp + avheight + vfp - 1), &pregister->dpcvtotal);
+
+	writel((u32) (vsw - 1), &pregister->dpcvswidth);
+
+	writel((u32) (vsw + vbp - 1), &pregister->dpcvastart);
+
+	writel((u32) (vsw + vbp + avheight - 1), &pregister->dpcvaend);
+
+	writel((u32) (evsw + evbp + eavheight + evfp - 1),
+	       &pregister->dpcevtotal);
+
+	writel((u32) (evsw - 1), &pregister->dpcevswidth);
+
+	writel((u32) (evsw + evbp - 1), &pregister->dpcevastart);
+
+	writel((u32) (evsw + evbp + eavheight - 1), &pregister->dpcevaend);
+	temp = pregister->dpcctrl0;
+	temp &= ~intpend;
+	if (binvvsync)
+		temp |= (u32) polvsync;
+	else
+		temp &= (u32)~polvsync;
+
+	writel(temp, &pregister->dpcctrl0);
+}
+
+void nx_dpc_get_vsync(u32 module_index, u32 *pavheight, u32 *pvsw, u32 *pvfp,
+		      u32 *pvbp, int *pbinvvsync, u32 *peavheight,
+		      u32 *pevsw, u32 *pevfp, u32 *pevbp)
+{
+	const u32 polvsync = 1u << 1;
+	u32 vtotal, vsw, vab, vae;
+	u32 avh, vfp, vbp;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	vtotal = (u32) pregister->dpcvtotal + 1;
+	vsw = (u32) pregister->dpcvswidth + 1;
+	vab = (u32) pregister->dpcvastart + 1;
+	vae = (u32) pregister->dpcvaend + 1;
+	vbp = vab - vsw;
+	avh = vae - vab;
+	vfp = vtotal - vae;
+	if (NULL != pavheight)
+		*pavheight = avh;
+	if (NULL != pvsw)
+		*pvsw = vsw;
+	if (NULL != pvfp)
+		*pvfp = vfp;
+	if (NULL != pvbp)
+		*pvbp = vbp;
+	vtotal = (u32) pregister->dpcevtotal + 1;
+	vsw = (u32) pregister->dpcevswidth + 1;
+	vab = (u32) pregister->dpcevastart + 1;
+	vae = (u32) pregister->dpcevaend + 1;
+	vbp = vab - vsw;
+	avh = vae - vab;
+	vfp = vtotal - vae;
+	if (NULL != peavheight)
+		*peavheight = avh;
+	if (NULL != pevsw)
+		*pevsw = vsw;
+	if (NULL != pevfp)
+		*pevfp = vfp;
+	if (NULL != pevbp)
+		*pevbp = vbp;
+	if (NULL != pbinvvsync)
+		*pbinvvsync = (pregister->dpcctrl0 & polvsync) ? 1 : 0;
+}
+
+void nx_dpc_set_vsync_offset(u32 module_index, u32 vssoffset, u32 vseoffset,
+			     u32 evssoffset, u32 evseoffset)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((u32) vseoffset, &pregister->dpcvseoffset);
+
+	writel((u32) vssoffset, &pregister->dpcvssoffset);
+
+	writel((u32) evseoffset, &pregister->dpcevseoffset);
+
+	writel((u32) evssoffset, &pregister->dpcevssoffset);
+}
+
+void nx_dpc_get_vsync_offset(u32 module_index, u32 *pvssoffset,
+			     u32 *pvseoffset, u32 *pevssoffset,
+			     u32 *pevseoffset)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	if (NULL != pvseoffset)
+		*pvseoffset = (u32) pregister->dpcvseoffset;
+
+	if (NULL != pvssoffset)
+		*pvssoffset = (u32) pregister->dpcvssoffset;
+
+	if (NULL != pevseoffset)
+		*pevseoffset = (u32) pregister->dpcevseoffset;
+
+	if (NULL != pevssoffset)
+		*pevssoffset = (u32) pregister->dpcevssoffset;
+}
+
+void nx_dpc_set_horizontal_up_scaler(u32 module_index, int benb,
+				     u32 sourcewidth, u32 destwidth)
+{
+	const u32 upscalel_pos = 8;
+	const u32 upscaleh_pos = 0;
+	const u32 upscaleh_mask = ((1 << 15) - 1) << upscaleh_pos;
+	const u32 upscalerenb_pos = 0;
+	register struct nx_dpc_register_set *pregister;
+	register u32 regvalue;
+	register u32 up_scale;
+
+	pregister = __g_module_variables[module_index].pregister;
+	up_scale = ((sourcewidth - 1) * (1 << 11)) / (destwidth - 1);
+	regvalue = 0;
+	regvalue |= (((u32) benb << upscalerenb_pos) |
+		     (up_scale & 0xff) << upscalel_pos);
+
+	writel(regvalue, &pregister->dpcupscalecon0);
+
+	writel((up_scale >> 0x08) & upscaleh_mask, &pregister->dpcupscalecon1);
+
+	writel(sourcewidth - 1, &pregister->dpcupscalecon2);
+}
+
+void nx_dpc_get_horizontal_up_scaler(u32 module_index, int *pbenb,
+				     u32 *psourcewidth, u32 *pdestwidth)
+{
+	const u32 upscalerenb_pos = 0;
+	const u32 upscalerenb_mask = 1u << upscalerenb_pos;
+	register struct nx_dpc_register_set *pregister;
+
+	u32 up_scale;
+	u32 destwidth, srcwidth;
+
+	pregister = __g_module_variables[module_index].pregister;
+	up_scale = ((u32) (pregister->dpcupscalecon1 & 0x7fff) << 8) |
+	    ((u32) (pregister->dpcupscalecon0 >> 8) & 0xff);
+	srcwidth = pregister->dpcupscalecon2;
+	destwidth = (srcwidth * (1 << 11)) / up_scale;
+	if (NULL != pbenb)
+		*pbenb = (pregister->dpcupscalecon0 & upscalerenb_mask);
+	if (NULL != psourcewidth)
+		*psourcewidth = srcwidth + 1;
+	if (NULL != pdestwidth)
+		*pdestwidth = destwidth + 1;
+}
+
+void nx_dpc_set_sync(u32 module_index, enum syncgenmode sync_gen_mode,
+		     u32 avwidth, u32 avheight, u32 hsw, u32 hfp, u32 hbp,
+		     u32 vsw, u32 vfp, u32 vbp, enum polarity field_polarity,
+		     enum polarity hsyncpolarity, enum polarity vsyncpolarity,
+		     u32 even_vsw, u32 even_vfp, u32 even_vbp, u32 vsetpixel,
+		     u32 vsclrpixel, u32 evenvsetpixel, u32 evenvsclrpixel)
+{
+	register struct nx_dpc_register_set *pregister;
+	u32 regvalue = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((u32) (hfp + hsw + hbp + avwidth - 1), &pregister->dpchtotal);
+	writel((u32) (hsw - 1), &pregister->dpchswidth);
+	writel((u32) (hsw + hbp - 1), &pregister->dpchastart);
+	writel((u32) (hsw + hbp + avwidth - 1), &pregister->dpchaend);
+	writel((u32) (vfp + vsw + vbp + avheight - 1), &pregister->dpcvtotal);
+	writel((u32) (vsw - 1), &pregister->dpcvswidth);
+	writel((u32) (vsw + vbp - 1), &pregister->dpcvastart);
+	writel((u32) (vsw + vbp + avheight - 1), &pregister->dpcvaend);
+	writel((u32) vsetpixel, &pregister->dpcvseoffset);
+	writel((u32) (hfp + hsw + hbp + avwidth - vsclrpixel - 1),
+	       &pregister->dpcvssoffset);
+	writel((u32) evenvsetpixel, &pregister->dpcevseoffset);
+	writel((u32) (hfp + hsw + hbp + avwidth - evenvsclrpixel - 1),
+	       &pregister->dpcevssoffset);
+	if (1 == sync_gen_mode) {
+		writel((u32) (even_vfp + even_vsw + even_vbp + avheight - 1),
+		       &pregister->dpcevtotal);
+		writel((u32) (even_vsw - 1), &pregister->dpcevswidth);
+		writel((u32) (even_vsw + even_vbp - 1),
+		       &pregister->dpcevastart);
+		writel((u32) (even_vsw + even_vbp + avheight - 1),
+		       &pregister->dpcevaend);
+	}
+	regvalue = readl(&pregister->dpcctrl0) & 0xfff0ul;
+	regvalue |= (((u32) field_polarity << 2) | ((u32) vsyncpolarity << 1) |
+		     ((u32) hsyncpolarity << 0));
+	writel((u32) regvalue, &pregister->dpcctrl0);
+}
+
+void nx_dpc_set_output_format(u32 module_index, enum outputformat output_format,
+			      u8 output_video_config)
+{
+	const u32 format_table[] = {
+		(0 << 0), (1 << 0), (2 << 0), (3 << 0), (4 << 0), (5 << 0),
+		(6 << 0), (7 << 0), (8 << 0), (9 << 0), (0 << 0) | (1 << 7),
+		(1 << 0) | (1 << 7), (2 << 0) | (1 << 7), (3 << 0) | (1 << 7),
+		(4 << 0) | (1 << 7), (5 << 0) | (1 << 7), (6 << 0) | (1 << 7),
+		(7 << 0) | (1 << 7), (8 << 0) | (1 << 7), (9 << 0) | (1 << 7),
+		(10 << 0), (11 << 0), (12 << 0), (13 << 0), (14 << 0), (15 << 0)
+	};
+	u32 regvalue;
+	u32 regvalue0;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = readl(&pregister->dpcctrl1) & 0x30fful;
+
+	regvalue |= (format_table[output_format] << 8);
+	writel((u32) regvalue, &pregister->dpcctrl1);
+	regvalue0 = (u32) (readl(&pregister->dpcctrl1) & 0xff3f);
+	regvalue0 = (u32) ((output_video_config << 6) | regvalue0);
+	writel((u32) regvalue0, &pregister->dpcctrl1);
+}
+
+void nx_dpc_set_quantization_mode(u32 module_index, enum qmode rgb2yc,
+				  enum qmode yc2rgb)
+{
+	register struct nx_dpc_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = readl(&pregister->dpcctrl1) & 0x8ffful;
+	regvalue |= ((u32) rgb2yc << 13) | ((u32) yc2rgb << 12);
+	writel((u32) regvalue, &pregister->dpcctrl1);
+}
+
+void nx_dpc_set_enable(u32 module_index, int enable, int rgbmode,
+		       int use_ntscsync, int use_analog_output, int seavenable)
+{
+	u32 regvalue;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = readl(&pregister->dpcctrl0) & 0x0efful;
+	regvalue |= ((u32) enable << 15) | ((u32) use_ntscsync << 14) |
+	    ((u32) seavenable << 8) | ((u32) use_analog_output << 13) |
+	    ((u32) rgbmode << 12);
+	writel((u32) regvalue, &pregister->dpcctrl0);
+}
+
+void nx_dpc_set_out_video_clk_select(u32 module_index,
+				     enum outpadclksel out_pad_vclk_sel)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((u32) ((readl(&pregister->dpcctrl2)) | (out_pad_vclk_sel & 0x3)),
+	       &pregister->dpcctrl2);
+}
+
+void nx_dpc_set_reg_flush(u32 module_index)
+{
+	u32 reg;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = readl(&pregister->dpcdataflush);
+	writel((u32) (reg | (1ul << 4)), &pregister->dpcdataflush);
+}
+
+void nx_dpc_set_sramon(u32 module_index)
+{
+	u32 reg;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = (u32) (readl(&pregister->dpcctrl2) & 0xf3ff);
+	writel((u32) (reg | (1ul << 10)), &pregister->dpcctrl2);
+	reg = (u32) (readl(&pregister->dpcctrl2) & 0xf7ff);
+	writel((u32) (reg | (1ul << 11)), &pregister->dpcctrl2);
+}
+
+void nx_dpc_set_sync_lcdtype(u32 module_index, int stnlcd, int dual_view_enb,
+			     int bit_widh, u8 cpcycle)
+{
+	u32 reg;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	reg = (u32) (readl(&pregister->dpcctrl2) & 0xc0f);
+	writel((u32) (reg | (cpcycle << 12) | (bit_widh << 9) |
+		      (dual_view_enb << 8) | (stnlcd << 7)),
+	       &pregister->dpcctrl2);
+}
+
+void nx_dpc_set_up_scale_control(u32 module_index, int up_scale_enb,
+				 int filter_enb, u32 hscale, u16 source_width)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u32) ((hscale << 8) | ((u32) filter_enb << 1) | (up_scale_enb)),
+	       &pregister->dpcupscalecon0);
+	writel((u32) (hscale >> 8), &pregister->dpcupscalecon1);
+	writel(source_width, &pregister->dpcupscalecon2);
+}
+
+void nx_dpc_set_mputime(u32 module_index, u8 setup, u8 hold, u8 acc)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u32) ((setup << 8) | (hold & 0xff)), &pregister->dpcmputime0);
+	writel((u32) (acc), &pregister->dpcmputime1);
+}
+
+void nx_dpc_set_index(u32 module_index, u32 index)
+{
+	u32 regvalue;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u32) (index & 0xffff), &pregister->dpcmpuwrdatal);
+	writel((u32) ((index >> 16) & 0xff), &pregister->dpcmpuindex);
+	if (0x22 == index) {
+		regvalue = readl(&pregister->dpcctrl2);
+		writel((regvalue | 0x10), &pregister->dpcctrl2);
+	}
+}
+
+void nx_dpc_set_data(u32 module_index, u32 data)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u32) (data & 0xffff), &pregister->dpcmpuwrdatal);
+	writel((u32) ((data >> 16) & 0xff), &pregister->dpcmpudatah);
+}
+
+void nx_dpc_set_cmd_buffer_flush(u32 module_index)
+{
+	u32 reg;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = readl(&pregister->dpcdataflush);
+	writel((u32) (reg | (1 << 1)), &pregister->dpcdataflush);
+}
+
+void nx_dpc_set_cmd_buffer_clear(u32 module_index)
+{
+	u32 reg;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = readl(&pregister->dpcdataflush);
+	writel((u32) (reg | (1 << 0)), &pregister->dpcdataflush);
+}
+
+void nx_dpc_set_cmd_buffer_write(u32 module_index, u32 cmd_data)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u32) (cmd_data & 0xffff), &pregister->dpccmdbufferdatal);
+	writel((u32) (cmd_data >> 16), &pregister->dpccmdbufferdatah);
+}
+
+void nx_dpc_set(u32 module_index)
+{
+	u32 reg;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = readl(&pregister->dpcpolctrl);
+	writel((u32) (reg | 0x1), &pregister->dpcpolctrl);
+}
+
+u32 nx_dpc_get_data(u32 module_index)
+{
+	u32 reg = 0;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = readl(&pregister->dpcmpudatah);
+	reg = (reg << 16) | readl(&pregister->dpcmpurdatal);
+	return reg;
+}
+
+u32 nx_dpc_get_status(u32 module_index)
+{
+	u32 reg = 0;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	reg = readl(&pregister->dpcmpustatus);
+	reg = (reg << 16) | readl(&pregister->dpcmpurdatal);
+	return reg;
+}
+
+void nx_dpc_rgbmask(u32 module_index, u32 rgbmask)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((rgbmask >> 0) & 0xffff, &pregister->dpcrgbmask[0]);
+	writel((rgbmask >> 16) & 0x00ff, &pregister->dpcrgbmask[1]);
+}
+
+void nx_dpc_set_pad_location(u32 module_index, u32 index, u32 regvalue)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(regvalue, &pregister->dpcpadposition[index]);
+}
+
+u32 nx_dpc_get_field_flag(u32 module_index)
+{
+	register struct nx_dpc_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = readl(&pregister->dpcrgbshift);
+
+	return (u32)((regvalue >> 5) & 0x01);
+}
+
+void nx_dpc_set_enable_with_interlace(u32 module_index, int enable, int rgbmode,
+				      int use_ntscsync, int use_analog_output,
+				      int seavenable)
+{
+	u32 regvalue;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = readl(&pregister->dpcctrl0) & 0x0eff;
+	regvalue = readl(&pregister->dpcctrl0) & 0x0eff;
+	regvalue |= ((u32) enable << 15) | ((u32) use_ntscsync << 14) |
+	    ((u32) seavenable << 8) | ((u32) use_analog_output << 13) |
+	    ((u32) rgbmode << 12);
+
+	regvalue |= (1 << 9);
+	writel((u16) regvalue, &pregister->dpcctrl0);
+}
+
+void nx_dpc_set_encoder_control_reg(u32 module_index, u32 param_a, u32 param_b,
+				    u32 param_c)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(param_a, &pregister->ntsc_ecmda);
+	writel(param_b, &pregister->ntsc_ecmdb);
+	writel(param_c, &pregister->ntsc_ecmdc);
+}
+
+void nx_dpc_set_encoder_shcphase_control(u32 module_index, u32 chroma_param)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(chroma_param, &pregister->ntsc_sch);
+}
+
+void nx_dpc_set_encoder_timing_config_reg(u32 module_index, u32 icntl)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(icntl, &pregister->ntsc_icntl);
+}
+
+void nx_dpc_set_encoder_dacoutput_select(u32 module_index, u8 dacsel0,
+					 u8 dacsel1, u8 dacsel2, u8 dacsel3,
+					 u8 dacsel4, u8 dacsel5)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dacsel1 & 0xf) << 4) | (dacsel0 & 0xf),
+	       &pregister->ntsc_dacsel10);
+	writel(((dacsel3 & 0xf) << 4) | (dacsel2 & 0xf),
+	       &pregister->ntsc_dacsel32);
+	writel(((dacsel5 & 0xf) << 4) | (dacsel4 & 0xf),
+	       &pregister->ntsc_dacsel54);
+}
+
+void nx_dpc_set_encoder_sync_location(u32 module_index, u16 hsoe, u16 hsob,
+				      u16 vsob, u16 vsoe, u8 vsost, int novrst)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u16) ((((vsob & 0x100) >> 2) | ((hsob & 0x700) >> 5) |
+		       (hsoe & 0x700) >> 8)), &pregister->ntsc_hsvso);
+	writel((u16) (hsoe & 0xff), &pregister->ntsc_hsoe);
+	writel((u16) (hsob & 0xff), &pregister->ntsc_hsob);
+	writel((u16) (vsob & 0xff), &pregister->ntsc_vsob);
+	writel((u16) (((vsost & 0x3) << 6) | (novrst << 5) | (vsoe & 0x1f)),
+	       &pregister->ntsc_vsoe);
+}
+
+void nx_dpc_set_encoder_dacpower_enable(u32 module_index, u8 dacpd)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(dacpd, &pregister->ntsc_dacpd);
+}
+
+void nx_dpc_set_ycorder(u32 module_index, enum nx_dpc_ycorder ycorder)
+{
+	const u16 ycorder_pos = 6;
+	register struct nx_dpc_register_set *pregister;
+	u32 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = pregister->dpcctrl1 & (~(0xf << ycorder_pos));
+	temp = (u16) (temp | (ycorder << ycorder_pos));
+	writel(temp, &pregister->dpcctrl1);
+}
+
+void nx_dpc_set_luma_gain(u32 module_index, u32 luma_gain)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(luma_gain, &pregister->ntsc_cont);
+}
+
+void nx_dpc_set_encenable(u32 module_index, int benb)
+{
+	const u16 encmode = 1u << 14;
+	const u16 encrst = 1u << 13;
+	const u16 intpend = 1u << 10;
+	register struct nx_dpc_register_set *pregister;
+	register u16 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = readl(&pregister->dpcctrl0);
+	temp &= (u16)~intpend;
+	if (benb)
+		temp |= (u16) encrst;
+	else
+		temp &= (u16)~encrst;
+	writel((temp | encmode), &pregister->dpcctrl0);
+	writel(7, &pregister->ntsc_icntl);
+}
+
+int nx_dpc_get_encenable(u32 module_index)
+{
+	const u16 encrst = 1u << 13;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	return (readl(&pregister->dpcctrl0) & encrst) ? 1 : 0;
+}
+
+void nx_dpc_set_video_encoder_power_down(u32 module_index, int benb)
+{
+	const u16 pwdenc = 1u << 7;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (benb) {
+		writel(readl(&pregister->ntsc_ecmda) | (u16) pwdenc,
+		       &pregister->ntsc_ecmda);
+		writel(0, &pregister->ntsc_dacsel10);
+	} else {
+		writel(1, &pregister->ntsc_dacsel10);
+		writel(readl(&pregister->ntsc_ecmda) & (u16)~pwdenc,
+		       &pregister->ntsc_ecmda);
+	}
+}
+
+int nx_dpc_get_video_encoder_power_down(u32 module_index)
+{
+	const u16 pwdenc = 1u << 7;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	return (readl(&pregister->ntsc_ecmda) & pwdenc) ? 1 : 0;
+}
+
+void nx_dpc_set_video_encoder_mode(u32 module_index, enum nx_dpc_vbs vbs,
+				   int bpedestal)
+{
+	register struct nx_dpc_register_set *pregister;
+
+#define phalt (1u << 0)
+#define ifmt (1u << 1)
+#define ped (1u << 3)
+#define fscsel_ntsc (0u << 4)
+#define fscsel_pal (1u << 4)
+#define fscsel_palm (2u << 4)
+#define fscsel_paln (3u << 4)
+#define fdrst (1u << 6)
+#define pwdenc (1u << 7)
+	register u16 temp;
+	static const u8 ntsc_ecmda_table[] = {
+		(u8) (fscsel_ntsc | fdrst), (u8) (ifmt | fscsel_ntsc),
+		(u8) (fscsel_pal), (u8) (fscsel_palm | phalt),
+		(u8) (ifmt | fscsel_paln | phalt),
+		(u8) (ifmt | fscsel_pal | phalt | fdrst),
+		(u8) (fscsel_pal | phalt),
+		(u8) (ifmt | fscsel_ntsc)
+	};
+	pregister = __g_module_variables[module_index].pregister;
+	temp = readl(&pregister->ntsc_ecmda);
+	temp &= (u16) pwdenc;
+	temp = (u16) (temp | (u16) ntsc_ecmda_table[vbs]);
+	if (bpedestal)
+		temp |= (u16) ped;
+	writel(temp, &pregister->ntsc_ecmda);
+#undef phalt
+#undef ifmt
+#undef ped
+#undef fscsel_ntsc
+#undef fscsel_pal
+#undef fscsel_palm
+#undef fscsel_paln
+#undef fdrst
+#undef pwdenc
+}
+
+void nx_dpc_set_video_encoder_schlock_control(u32 module_index, int bfreerun)
+{
+	const u16 fdrst = 1u << 6;
+	register struct nx_dpc_register_set *pregister;
+	register u16 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = readl(&pregister->ntsc_ecmda);
+	if (bfreerun)
+		temp |= (u16) fdrst;
+	else
+		temp &= (u16)~fdrst;
+	writel(temp, &pregister->ntsc_ecmda);
+}
+
+int nx_dpc_get_video_encoder_schlock_control(u32 module_index)
+{
+	const u16 fdrst = 1u << 6;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	return (readl(&pregister->ntsc_ecmda) & fdrst) ? 1 : 0;
+}
+
+void nx_dpc_set_video_encoder_bandwidth(u32 module_index,
+					enum nx_dpc_bandwidth luma,
+					enum nx_dpc_bandwidth chroma)
+{
+	const u16 ybw_pos = 0;
+	const u16 cbw_pos = 2;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u16) ((chroma << cbw_pos) | (luma << ybw_pos)),
+	       &pregister->ntsc_ecmdb);
+}
+
+void nx_dpc_get_video_encoder_bandwidth(u32 module_index,
+					enum nx_dpc_bandwidth *pluma,
+					enum nx_dpc_bandwidth *pchroma)
+{
+	const u16 ybw_pos = 0;
+	const u16 ybw_mask = 3u << ybw_pos;
+	const u16 cbw_pos = 2;
+	const u16 cbw_mask = 3u << cbw_pos;
+	register struct nx_dpc_register_set *pregister;
+	register u16 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = readl(&pregister->ntsc_ecmdb);
+	if (NULL != pluma)
+		*pluma = (enum nx_dpc_bandwidth)((temp & ybw_mask) >> ybw_pos);
+	if (NULL != pchroma)
+		*pchroma =
+		    (enum nx_dpc_bandwidth)((temp & cbw_mask) >> cbw_pos);
+}
+
+void nx_dpc_set_video_encoder_color_control(u32 module_index, int8_t sch,
+					    int8_t hue, int8_t sat, int8_t crt,
+					    int8_t brt)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u16) sch, &pregister->ntsc_sch);
+	writel((u16) hue, &pregister->ntsc_hue);
+	writel((u16) sat, &pregister->ntsc_sat);
+	writel((u16) crt, &pregister->ntsc_cont);
+	writel((u16) brt, &pregister->ntsc_bright);
+}
+
+void nx_dpc_get_video_encoder_color_control(u32 module_index, int8_t *psch,
+					    int8_t *phue, int8_t *psat,
+					    int8_t *pcrt, int8_t *pbrt)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (NULL != psch)
+		*psch = (int8_t) readl(&pregister->ntsc_sch);
+	if (NULL != phue)
+		*phue = (int8_t) readl(&pregister->ntsc_hue);
+	if (NULL != psat)
+		*psat = (int8_t) readl(&pregister->ntsc_sat);
+	if (NULL != pcrt)
+		*pcrt = (int8_t) readl(&pregister->ntsc_cont);
+	if (NULL != pbrt)
+		*pbrt = (int8_t) readl(&pregister->ntsc_bright);
+}
+
+void nx_dpc_set_video_encoder_fscadjust(u32 module_index, int16_t adjust)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((u16) (adjust >> 8), &pregister->ntsc_fsc_adjh);
+	writel((u16) (adjust & 0xff), &pregister->ntsc_fsc_adjl);
+}
+
+u16 nx_dpc_get_video_encoder_fscadjust(u32 module_index)
+{
+	register u32 temp;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = (u32) readl(&pregister->ntsc_fsc_adjh);
+	temp <<= 8;
+	temp |= (((u32) readl(&pregister->ntsc_fsc_adjl)) & 0xff);
+	return (u16) temp;
+}
+
+void nx_dpc_set_video_encoder_timing(u32 module_index, u32 hsos, u32 hsoe,
+				     u32 vsos, u32 vsoe)
+{
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	hsos -= 1;
+	hsoe -= 1;
+	writel((u16) ((((vsos >> 8) & 1u) << 6) | (((hsos >> 8) & 7u) << 3) |
+		      (((hsoe >> 8) & 7u) << 0)), &pregister->ntsc_hsvso);
+	writel((u16) (hsos & 0xffu), &pregister->ntsc_hsob);
+	writel((u16) (hsoe & 0xffu), &pregister->ntsc_hsoe);
+	writel((u16) (vsos & 0xffu), &pregister->ntsc_vsob);
+	writel((u16) (vsoe & 0x1fu), &pregister->ntsc_vsoe);
+}
+
+void nx_dpc_get_video_encoder_timing(u32 module_index, u32 *phsos, u32 *phsoe,
+				     u32 *pvsos, u32 *pvsoe)
+{
+	register u16 hsvso;
+	register struct nx_dpc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	hsvso = readl(&pregister->ntsc_hsvso);
+	if (NULL != phsos)
+		*phsos = (u32) ((((hsvso >> 3) & 7u) << 8) |
+				(readl(&pregister->ntsc_hsob) & 0xffu)) + 1;
+	if (NULL != phsoe)
+		*phsoe = (u32) ((((hsvso >> 0) & 7u) << 8) |
+				(readl(&pregister->ntsc_hsoe) & 0xffu)) + 1;
+	if (NULL != pvsos)
+		*pvsos = (u32) ((((hsvso >> 6) & 1u) << 8) |
+				(readl(&pregister->ntsc_vsob) & 0xffu));
+	if (NULL != pvsoe)
+		*pvsoe = (u32) (readl(&pregister->ntsc_vsoe) & 0x1fu);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_dpc.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,454 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_DPC_H_
+#define _S5PXX18_SOC_DPC_H_
+
+#include "s5pxx18_soc_disp.h"
+
+#define	IRQ_OFFSET	32
+#define IRQ_DPC_P	(IRQ_OFFSET + 33)
+#define IRQ_DPC_S   (IRQ_OFFSET + 34)
+
+#define NUMBER_OF_DPC_MODULE	2
+#define PHY_BASEADDR_DPC0	0xC0102800
+#define PHY_BASEADDR_DPC1	0xC0102C00
+
+#define	PHY_BASEADDR_DPC_LIST	\
+		{ PHY_BASEADDR_DPC0, PHY_BASEADDR_DPC1 }
+
+struct nx_dpc_register_set {
+	u32 ntsc_stata;
+	u32 ntsc_ecmda;
+	u32 ntsc_ecmdb;
+	u32 ntsc_glk;
+	u32 ntsc_sch;
+	u32 ntsc_hue;
+	u32 ntsc_sat;
+	u32 ntsc_cont;
+	u32 ntsc_bright;
+	u32 ntsc_fsc_adjh;
+	u32 ntsc_fsc_adjl;
+	u32 ntsc_ecmdc;
+	u32 ntsc_csdly;
+	u32 __ntsc_reserved_0_[3];
+	u32 ntsc_dacsel10;
+	u32 ntsc_dacsel32;
+	u32 ntsc_dacsel54;
+	u32 ntsc_daclp;
+	u32 ntsc_dacpd;
+	u32 __ntsc_reserved_1_[(0x20 - 0x15)];
+	u32 ntsc_icntl;
+	u32 ntsc_hvoffst;
+	u32 ntsc_hoffst;
+	u32 ntsc_voffset;
+	u32 ntsc_hsvso;
+	u32 ntsc_hsob;
+	u32 ntsc_hsoe;
+	u32 ntsc_vsob;
+	u32 ntsc_vsoe;
+	u32 __reserved[(0xf8 / 4) - 0x29];
+	u32 dpchtotal;
+	u32 dpchswidth;
+	u32 dpchastart;
+	u32 dpchaend;
+	u32 dpcvtotal;
+	u32 dpcvswidth;
+	u32 dpcvastart;
+	u32 dpcvaend;
+	u32 dpcctrl0;
+	u32 dpcctrl1;
+	u32 dpcevtotal;
+	u32 dpcevswidth;
+	u32 dpcevastart;
+	u32 dpcevaend;
+	u32 dpcctrl2;
+	u32 dpcvseoffset;
+	u32 dpcvssoffset;
+	u32 dpcevseoffset;
+	u32 dpcevssoffset;
+	u32 dpcdelay0;
+	u32 dpcupscalecon0;
+	u32 dpcupscalecon1;
+	u32 dpcupscalecon2;
+
+	u32 dpcrnumgencon0;
+	u32 dpcrnumgencon1;
+	u32 dpcrnumgencon2;
+	u32 dpcrndconformula_l;
+	u32 dpcrndconformula_h;
+	u32 dpcfdtaddr;
+	u32 dpcfrdithervalue;
+	u32 dpcfgdithervalue;
+	u32 dpcfbdithervalue;
+	u32 dpcdelay1;
+	u32 dpcmputime0;
+	u32 dpcmputime1;
+	u32 dpcmpuwrdatal;
+	u32 dpcmpuindex;
+	u32 dpcmpustatus;
+	u32 dpcmpudatah;
+	u32 dpcmpurdatal;
+	u32 dpcdummy12;
+	u32 dpccmdbufferdatal;
+	u32 dpccmdbufferdatah;
+	u32 dpcpolctrl;
+	u32 dpcpadposition[8];
+	u32 dpcrgbmask[2];
+	u32 dpcrgbshift;
+	u32 dpcdataflush;
+	u32 __reserved06[((0x3c0) - (2 * 0x0ec)) / 4];
+
+	u32 dpcclkenb;
+	u32 dpcclkgen[2][2];
+};
+
+enum {
+	nx_dpc_int_vsync = 0
+};
+
+enum nx_dpc_format {
+	nx_dpc_format_rgb555 = 0ul,
+	nx_dpc_format_rgb565 = 1ul,
+	nx_dpc_format_rgb666 = 2ul,
+	nx_dpc_format_rgb666b = 18ul,
+	nx_dpc_format_rgb888 = 3ul,
+	nx_dpc_format_mrgb555a = 4ul,
+	nx_dpc_format_mrgb555b = 5ul,
+	nx_dpc_format_mrgb565 = 6ul,
+	nx_dpc_format_mrgb666 = 7ul,
+	nx_dpc_format_mrgb888a = 8ul,
+	nx_dpc_format_mrgb888b = 9ul,
+	nx_dpc_format_ccir656 = 10ul,
+	nx_dpc_format_ccir601a = 12ul,
+	nx_dpc_format_ccir601b = 13ul,
+	nx_dpc_format_srgb888 = 14ul,
+	nx_dpc_format_srgbd8888 = 15ul,
+	nx_dpc_format_4096color = 1ul,
+	nx_dpc_format_16gray = 3ul
+};
+
+enum nx_dpc_ycorder {
+	nx_dpc_ycorder_cb_ycr_y = 0ul,
+	nx_dpc_ycorder_cr_ycb_y = 1ul,
+	nx_dpc_ycorder_ycbycr = 2ul,
+	nx_dpc_ycorder_ycrycb = 3ul
+};
+
+enum nx_dpc_padclk {
+	nx_dpc_padclk_vclk = 0ul,
+	nx_dpc_padclk_vclk2 = 1ul,
+	nx_dpc_padclk_vclk3 = 2ul
+};
+
+enum nx_dpc_dither {
+	nx_dpc_dither_bypass = 0ul,
+	nx_dpc_dither_4bit = 1ul,
+	nx_dpc_dither_5bit = 2ul,
+	nx_dpc_dither_6bit = 3ul
+};
+
+enum nx_dpc_vbs {
+	nx_dpc_vbs_ntsc_m = 0ul,
+	nx_dpc_vbs_ntsc_n = 1ul,
+	nx_dpc_vbs_ntsc_443 = 2ul,
+	nx_dpc_vbs_pal_m = 3ul,
+	nx_dpc_vbs_pal_n = 4ul,
+	nx_dpc_vbs_pal_bghi = 5ul,
+	nx_dpc_vbs_pseudo_pal = 6ul,
+	nx_dpc_vbs_pseudo_ntsc = 7ul
+};
+
+enum nx_dpc_bandwidth {
+	nx_dpc_bandwidth_low = 0ul,
+	nx_dpc_bandwidth_medium = 1ul,
+	nx_dpc_bandwidth_high = 2ul
+};
+
+int nx_dpc_initialize(void);
+u32 nx_dpc_get_number_of_module(void);
+u32 nx_dpc_get_physical_address(u32 module_index);
+u32 nx_dpc_get_size_of_register_set(void);
+void nx_dpc_set_base_address(u32 module_index, void *base_address);
+void *nx_dpc_get_base_address(u32 module_index);
+int nx_dpc_open_module(u32 module_index);
+int nx_dpc_close_module(u32 module_index);
+int nx_dpc_check_busy(u32 module_index);
+int nx_dpc_can_power_down(u32 module_index);
+int32_t nx_dpc_get_interrupt_number(u32 module_index);
+void nx_dpc_set_interrupt_enable(u32 module_index, int32_t int_num,
+					int enable);
+int nx_dpc_get_interrupt_enable(u32 module_index, int32_t int_num);
+int nx_dpc_get_interrupt_pending(u32 module_index, int32_t int_num);
+void nx_dpc_clear_interrupt_pending(u32 module_index, int32_t int_num);
+void nx_dpc_set_interrupt_enable_all(u32 module_index, int enable);
+int nx_dpc_get_interrupt_enable_all(u32 module_index);
+int nx_dpc_get_interrupt_pending_all(u32 module_index);
+void nx_dpc_clear_interrupt_pending_all(u32 module_index);
+void nx_dpc_set_interrupt_enable32(u32 module_index, u32 enable_flag);
+u32 nx_dpc_get_interrupt_enable32(u32 module_index);
+u32 nx_dpc_get_interrupt_pending32(u32 module_index);
+void nx_dpc_clear_interrupt_pending32(u32 module_index,
+					     u32 pending_flag);
+int32_t nx_dpc_get_interrupt_pending_number(u32 module_index);
+void nx_dpc_set_clock_pclk_mode(u32 module_index, enum nx_pclkmode mode);
+enum nx_pclkmode nx_dpc_get_clock_pclk_mode(u32 module_index);
+void nx_dpc_set_clock_source(u32 module_index, u32 index, u32 clk_src);
+u32 nx_dpc_get_clock_source(u32 module_index, u32 index);
+void nx_dpc_set_clock_divisor(u32 module_index, u32 index, u32 divisor);
+u32 nx_dpc_get_clock_divisor(u32 module_index, u32 index);
+void nx_dpc_set_clock_out_inv(u32 module_index, u32 index,
+				     int out_clk_inv);
+int nx_dpc_get_clock_out_inv(u32 module_index, u32 index);
+void nx_dpc_set_clock_out_select(u32 module_index, u32 index,
+					int bbypass);
+int nx_dpc_get_clock_out_select(u32 module_index, u32 index);
+void nx_dpc_set_clock_polarity(u32 module_index, int bpolarity);
+int nx_dpc_get_clock_polarity(u32 module_index);
+void nx_dpc_set_clock_out_enb(u32 module_index, u32 index,
+				     int out_clk_enb);
+int nx_dpc_get_clock_out_enb(u32 module_index, u32 index);
+void nx_dpc_set_clock_out_delay(u32 module_index, u32 index, u32 delay);
+u32 nx_dpc_get_clock_out_delay(u32 module_index, u32 index);
+void nx_dpc_set_clock_divisor_enable(u32 module_index, int enable);
+int nx_dpc_get_clock_divisor_enable(u32 module_index);
+
+void nx_dpc_set_dpc_enable(u32 module_index, int benb);
+int nx_dpc_get_dpc_enable(u32 module_index);
+void nx_dpc_set_delay(u32 module_index, u32 delay_rgb_pvd,
+			     u32 delay_hs_cp1, u32 delay_vs_fram,
+			     u32 delay_de_cp2);
+void nx_dpc_get_delay(u32 module_index, u32 *pdelayrgb_pvd,
+			     u32 *pdelayhs_cp1, u32 *pdelayvs_fram,
+			     u32 *pdelayde_cp2);
+void nx_dpc_set_dither(u32 module_index, enum nx_dpc_dither dither_r,
+			      enum nx_dpc_dither dither_g,
+			      enum nx_dpc_dither dither_b);
+void nx_dpc_get_dither(u32 module_index, enum nx_dpc_dither *pditherr,
+			      enum nx_dpc_dither *pditherg,
+			      enum nx_dpc_dither *pditherb);
+void nx_dpc_set_horizontal_up_scaler(u32 module_index, int benb,
+					    u32 sourcewidth, u32 destwidth);
+void nx_dpc_get_horizontal_up_scaler(u32 module_index, int *pbenb,
+					    u32 *psourcewidth,
+					    u32 *pdestwidth);
+
+void nx_dpc_set_mode(u32 module_index, enum nx_dpc_format format,
+			    int binterlace, int binvertfield, int brgbmode,
+			    int bswaprb, enum nx_dpc_ycorder ycorder,
+			    int bclipyc, int bembeddedsync,
+			    enum nx_dpc_padclk clock, int binvertclock,
+			    int bdualview);
+void nx_dpc_get_mode(u32 module_index, enum nx_dpc_format *pformat,
+			    int *pbinterlace, int *pbinvertfield,
+			    int *pbrgbmode, int *pbswaprb,
+			    enum nx_dpc_ycorder *pycorder, int *pbclipyc,
+			    int *pbembeddedsync, enum nx_dpc_padclk *pclock,
+			    int *pbinvertclock, int *pbdualview);
+void nx_dpc_set_hsync(u32 module_index, u32 avwidth, u32 hsw, u32 hfp,
+			     u32 hbp, int binvhsync);
+void nx_dpc_get_hsync(u32 module_index, u32 *pavwidth, u32 *phsw,
+			     u32 *phfp, u32 *phbp, int *pbinvhsync);
+void nx_dpc_set_vsync(u32 module_index, u32 avheight, u32 vsw, u32 vfp,
+			     u32 vbp, int binvvsync, u32 eavheight, u32 evsw,
+			     u32 evfp, u32 evbp);
+void nx_dpc_get_vsync(u32 module_index, u32 *pavheight, u32 *pvsw,
+			     u32 *pvfp, u32 *pvbp, int *pbinvvsync,
+			     u32 *peavheight, u32 *pevsw, u32 *pevfp,
+			     u32 *pevbp);
+void nx_dpc_set_vsync_offset(u32 module_index, u32 vssoffset,
+				    u32 vseoffset, u32 evssoffset,
+				    u32 evseoffset);
+void nx_dpc_get_vsync_offset(u32 module_index, u32 *pvssoffset,
+				    u32 *pvseoffset, u32 *pevssoffset,
+				    u32 *pevseoffset);
+
+u32 nx_dpc_enable_pad_tft(u32 module_index, u32 mode_index);
+u32 nx_dpc_enable_pad_i80(u32 module_index, u32 mode_index);
+
+enum syncgenmode {
+	progressive = 0,
+	interlace = 1
+};
+
+enum polarity {
+	polarity_activehigh = 0,
+	polarity_activelow = 1
+};
+
+enum outputformat {
+	outputformat_rgb555 = 0,
+	outputformat_rgb565 = 1,
+	outputformat_rgb666 = 2,
+	outputformat_rgb888 = 3,
+	outputformat_mrgb555a = 4,
+	outputformat_mrgb555b = 5,
+	outputformat_mrgb565 = 6,
+	outputformat_mrgb666 = 7,
+	outputformat_mrgb888a = 8,
+	outputformat_mrgb888b = 9,
+	outputformat_bgr555 = 10,
+	outputformat_bgr565 = 11,
+	outputformat_bgr666 = 12,
+	outputformat_bgr888 = 13,
+	outputformat_mbgr555a = 14,
+	outputformat_mbgr555b = 15,
+	outputformat_mbgr565 = 16,
+	outputformat_mbgr666 = 17,
+	outputformat_mbgr888a = 18,
+	outputformat_mbgr888b = 19,
+	outputformat_ccir656 = 20,
+	outputformat_ccir601_8 = 21,
+	outputformat_ccir601_16a = 22,
+	outputformat_ccir601_16b = 23,
+	outputformat_srgb888 = 24,
+	outputformat_srgbd8888 = 25
+};
+
+enum outpadclksel {
+	padvclk = 0,
+	padvclk2 = 1,
+	padvclk3 = 2
+};
+
+enum qmode {
+	qmode_220 = 0,
+	qmode_256 = 1
+};
+
+void nx_dpc_set_sync(u32 module_index, enum syncgenmode sync_gen_mode,
+			    u32 avwidth, u32 avheight, u32 hsw, u32 hfp,
+			    u32 hbp, u32 vsw, u32 vfp, u32 vbp,
+			    enum polarity field_polarity,
+			    enum polarity hsyncpolarity,
+			    enum polarity vsyncpolarity, u32 even_vsw,
+			    u32 even_vfp, u32 even_vbp, u32 vsetpixel,
+			    u32 vsclrpixel, u32 evenvsetpixel,
+			    u32 evenvsclrpixel);
+void nx_dpc_set_output_format(u32 module_index,
+				     enum outputformat output_format,
+				     u8 output_video_config);
+void nx_dpc_set_quantization_mode(u32 module_index, enum qmode rgb2yc,
+					 enum qmode yc2rgb);
+void nx_dpc_set_enable(u32 module_index, int enable, int rgbmode,
+			      int use_ntscsync, int use_analog_output,
+			      int seavenable);
+void nx_dpc_set_enable_with_interlace(u32 module_index, int enable,
+					     int rgbmode, int use_ntscsync,
+					     int use_analog_output,
+					     int seavenable);
+void nx_dpc_set_enable_with_interlace(u32 module_index, int enable,
+					     int rgbmode, int use_ntscsync,
+					     int use_analog_output,
+					     int seavenable);
+void nx_dpc_set_out_video_clk_select(u32 module_index,
+					    enum outpadclksel out_pad_vclk_sel);
+void nx_dpc_set_reg_flush(u32 module_index);
+void nx_dpc_set_sramon(u32 module_index);
+void nx_dpc_set_sync_lcdtype(u32 module_index, int stnlcd,
+				    int dual_view_enb, int bit_widh,
+				    u8 cpcycle);
+void nx_dpc_set_up_scale_control(u32 module_index, int up_scale_enb,
+					int filter_enb, u32 hscale,
+					u16 source_width);
+
+void nx_dpc_set_mputime(u32 module_index, u8 setup, u8 hold, u8 acc);
+void nx_dpc_set_index(u32 module_index, u32 index);
+void nx_dpc_set_data(u32 module_index, u32 data);
+void nx_dpc_set_cmd_buffer_flush(u32 module_index);
+void nx_dpc_set_cmd_buffer_clear(u32 module_index);
+void nx_dpc_set_cmd_buffer_write(u32 module_index, u32 cmd_data);
+void nx_dpc_set(u32 module_index);
+u32 nx_dpc_get_data(u32 module_index);
+u32 nx_dpc_get_status(u32 module_index);
+void nx_dpc_rgbmask(u32 module_index, u32 rgbmask);
+void nx_dpc_set_pad_location(u32 module_index, u32 index, u32 regvalue);
+u32 nx_dpc_get_field_flag(u32 module_index);
+
+void nx_dpc_set_sync_v(u32 module_index, u32 avheight, u32 vsw, u32 vfp,
+			      u32 vbp);
+
+int nx_dpc_init_reg_test(u32 module_index);
+void nx_dpc_set_encoder_control_reg(u32 module_index, u32 param_a,
+					   u32 param_b, u32 param_c);
+void nx_dpc_set_encoder_shcphase_control(u32 module_index,
+						u32 chroma_param);
+void nx_dpc_set_encoder_timing_config_reg(u32 module_index, u32 inctl);
+void nx_dpc_set_encoder_dacoutput_select(u32 module_index, u8 dacsel0,
+						u8 dacsel1, u8 dacsel2,
+						u8 dacsel3, u8 dacsel4,
+						u8 dacsel5);
+void nx_dpc_set_encoder_sync_location(u32 module_index, u16 hsoe,
+					     u16 hsob, u16 vsob, u16 vsoe,
+					     u8 vsost, int novrst);
+void nx_dpc_set_encoder_dacpower_enable(u32 module_index, u8 dacpd);
+void nx_dpc_set_ycorder(u32 module_index, enum nx_dpc_ycorder ycorder);
+void nx_dpc_set_luma_gain(u32 module_index, u32 luma_gain);
+
+void nx_dpc_set_secondary_dpcsync(u32 module_index, int benb);
+int nx_dpc_get_secondary_dpcsync(u32 module_index);
+void nx_dpc_set_encenable(u32 module_index, int benb);
+int nx_dpc_get_encenable(u32 module_index);
+void nx_dpc_set_video_encoder_power_down(u32 module_index, int benb);
+int nx_dpc_get_video_encoder_power_down(u32 module_index);
+void nx_dpc_set_video_encoder_mode(u32 module_index, enum nx_dpc_vbs vbs,
+					  int bpedestal);
+void nx_dpc_set_video_encoder_schlock_control(u32 module_index,
+						     int bfreerun);
+int nx_dpc_get_video_encoder_schlock_control(u32 module_index);
+void nx_dpc_set_video_encoder_bandwidth(u32 module_index,
+					       enum nx_dpc_bandwidth luma,
+					       enum nx_dpc_bandwidth chroma);
+void nx_dpc_get_video_encoder_bandwidth(u32 module_index,
+					       enum nx_dpc_bandwidth *pluma,
+					       enum nx_dpc_bandwidth *pchroma);
+void nx_dpc_set_video_encoder_color_control(u32 module_index, int8_t sch,
+						   int8_t hue, int8_t sat,
+						   int8_t crt, int8_t brt);
+void nx_dpc_get_video_encoder_color_control(u32 module_index,
+						   int8_t *psch, int8_t *phue,
+						   int8_t *psat, int8_t *pcrt,
+						   int8_t *pbrt);
+void nx_dpc_set_video_encoder_fscadjust(u32 module_index,
+					       int16_t adjust);
+u16 nx_dpc_get_video_encoder_fscadjust(u32 module_index);
+void nx_dpc_set_video_encoder_timing(u32 module_index, u32 hsos,
+					    u32 hsoe, u32 vsos, u32 vsoe);
+void nx_dpc_get_video_encoder_timing(u32 module_index, u32 *phsos,
+					    u32 *phsoe, u32 *pvsos,
+					    u32 *pvsoe);
+void nx_dpc_set_sync_v(u32 module_index, u32 avheight, u32 vsw, u32 vfp,
+			      u32 vbp);
+
+int nx_dpc_init_reg_test(u32 module_index);
+void nx_dpc_set_encoder_control_reg(u32 module_index, u32 param_a,
+					   u32 param_b, u32 param_c);
+void nx_dpc_set_encoder_shcphase_control(u32 module_index,
+						u32 chroma_param);
+void nx_dpc_set_encoder_timing_config_reg(u32 module_index, u32 inctl);
+void nx_dpc_set_encoder_dacoutput_select(u32 module_index, u8 dacsel0,
+						u8 dacsel1, u8 dacsel2,
+						u8 dacsel3, u8 dacsel4,
+						u8 dacsel5);
+void nx_dpc_set_encoder_sync_location(u32 module_index, u16 hsoe,
+					     u16 hsob, u16 vsob, u16 vsoe,
+					     u8 vsost, int novrst);
+void nx_dpc_set_encoder_dacpower_enable(u32 module_index, u8 dacpd);
+void nx_dpc_set_ycorder(u32 module_index, enum nx_dpc_ycorder ycorder);
+void nx_dpc_set_luma_gain(u32 module_index, u32 luma_gain);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.c b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_disptop.h"
+#include "s5pxx18_soc_lvds.h"
+
+static struct nx_lvds_register_set *__g_pregister[NUMBER_OF_LVDS_MODULE];
+
+int nx_lvds_initialize(void)
+{
+	static int binit;
+	u32 i;
+
+	if (0 == binit) {
+		for (i = 0; i < NUMBER_OF_LVDS_MODULE; i++)
+			__g_pregister[i] = NULL;
+		binit = 1;
+	}
+
+	return 1;
+}
+
+u32 nx_lvds_get_number_of_module(void)
+{
+	return NUMBER_OF_LVDS_MODULE;
+}
+
+u32 nx_lvds_get_size_of_register_set(void)
+{
+	return sizeof(struct nx_lvds_register_set);
+}
+
+void nx_lvds_set_base_address(u32 module_index, void *base_address)
+{
+	__g_pregister[module_index] =
+	    (struct nx_lvds_register_set *)base_address;
+}
+
+void *nx_lvds_get_base_address(u32 module_index)
+{
+	return (void *)__g_pregister[module_index];
+}
+
+u32 nx_lvds_get_physical_address(u32 module_index)
+{
+	const u32 physical_addr[] = PHY_BASEADDR_LVDS_LIST;
+
+	return physical_addr[module_index];
+}
+
+int nx_lvds_open_module(u32 module_index)
+{
+	return true;
+}
+
+int nx_lvds_close_module(u32 module_index)
+{
+	return true;
+}
+
+int nx_lvds_check_busy(u32 module_index)
+{
+	return false;
+}
+
+void nx_lvds_set_lvdsctrl0(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsctrl0);
+}
+
+void nx_lvds_set_lvdsctrl1(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsctrl1);
+}
+
+void nx_lvds_set_lvdsctrl2(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsctrl2);
+}
+
+void nx_lvds_set_lvdsctrl3(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsctrl3);
+}
+
+void nx_lvds_set_lvdsctrl4(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsctrl4);
+}
+
+void nx_lvds_set_lvdstmode0(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdstmode0);
+}
+
+void nx_lvds_set_lvdsloc0(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc0);
+}
+
+void nx_lvds_set_lvdsloc1(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc1);
+}
+
+void nx_lvds_set_lvdsloc2(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc2);
+}
+
+void nx_lvds_set_lvdsloc3(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc3);
+}
+
+void nx_lvds_set_lvdsloc4(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc4);
+}
+
+void nx_lvds_set_lvdsloc5(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc5);
+}
+
+void nx_lvds_set_lvdsloc6(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdsloc6);
+}
+
+void nx_lvds_set_lvdslocmask0(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdslocmask0);
+}
+
+void nx_lvds_set_lvdslocmask1(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdslocmask1);
+}
+
+void nx_lvds_set_lvdslocpol0(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdslocpol0);
+}
+
+void nx_lvds_set_lvdslocpol1(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	writel(regvalue, &pregister->lvdslocpol1);
+}
+
+void nx_lvds_set_lvdsdummy(u32 module_index, u32 regvalue)
+{
+	register struct nx_lvds_register_set *pregister;
+	u32 oldvalue;
+
+	pregister = __g_pregister[module_index];
+	oldvalue = readl(&pregister->lvdsctrl1) & 0x00ffffff;
+	writel(oldvalue | ((regvalue & 0xff) << 24), &pregister->lvdsctrl1);
+}
+
+u32 nx_lvds_get_lvdsdummy(u32 module_index)
+{
+	register struct nx_lvds_register_set *pregister;
+	u32 oldvalue;
+
+	pregister = __g_pregister[module_index];
+	oldvalue = readl(&pregister->lvdsctrl1);
+	oldvalue = oldvalue >> 24;
+	return oldvalue;
+}
+
+u32 nx_lvds_get_lvdsctrl0(u32 module_index)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	return (u32) readl(&pregister->lvdsctrl0);
+}
+
+u32 nx_lvds_get_lvdsctrl1(u32 module_index)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	return (u32) readl(&pregister->lvdsctrl1);
+}
+
+u32 nx_lvds_get_lvdsctrl2(u32 module_index)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	return (u32) readl(&pregister->lvdsctrl2);
+}
+
+u32 nx_lvds_get_lvdsctrl3(u32 module_index)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	return (u32) readl(&pregister->lvdsctrl3);
+}
+
+u32 nx_lvds_get_lvdsctrl4(u32 module_index)
+{
+	register struct nx_lvds_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	return (u32) readl(&pregister->lvdsctrl4);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_lvds.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_LVDS_H_
+#define _S5PXX18_SOC_LVDS_H_
+
+/*
+ * refter to s5pxx18_soc_disptop.h
+ *
+ * #define NUMBER_OF_LVDS_MODULE 1
+ * #define PHY_BASEADDR_LVDS_MODULE	0xC010A000
+  */
+#define	PHY_BASEADDR_LVDS_LIST	\
+		{ PHY_BASEADDR_LVDS_MODULE }
+
+struct nx_lvds_register_set {
+	u32 lvdsctrl0;
+	u32 lvdsctrl1;
+	u32 lvdsctrl2;
+	u32 lvdsctrl3;
+	u32 lvdsctrl4;
+	u32 _reserved0[3];
+	u32 lvdsloc0;
+	u32 lvdsloc1;
+	u32 lvdsloc2;
+	u32 lvdsloc3;
+	u32 lvdsloc4;
+	u32 lvdsloc5;
+	u32 lvdsloc6;
+	u32 _reserved1;
+	u32 lvdslocmask0;
+	u32 lvdslocmask1;
+	u32 lvdslocpol0;
+	u32 lvdslocpol1;
+	u32 lvdstmode0;
+	u32 lvdstmode1;
+	u32 _reserved2[2];
+};
+
+int nx_lvds_initialize(void);
+u32 nx_lvds_get_number_of_module(void);
+u32 nx_lvds_get_size_of_register_set(void);
+void nx_lvds_set_base_address(u32 module_index, void *base_address);
+void *nx_lvds_get_base_address(u32 module_index);
+u32 nx_lvds_get_physical_address(u32 module_index);
+int nx_lvds_open_module(u32 module_index);
+int nx_lvds_close_module(u32 module_index);
+int nx_lvds_check_busy(u32 module_index);
+
+void nx_lvds_set_lvdsctrl0(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsctrl1(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsctrl2(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsctrl3(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsctrl4(u32 module_index, u32 regvalue);
+u32 nx_lvds_get_lvdsctrl0(u32 module_index);
+u32 nx_lvds_get_lvdsctrl1(u32 module_index);
+u32 nx_lvds_get_lvdsctrl2(u32 module_index);
+u32 nx_lvds_get_lvdsctrl3(u32 module_index);
+u32 nx_lvds_get_lvdsctrl4(u32 module_index);
+
+void nx_lvds_set_lvdstmode0(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc0(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc1(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc2(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc3(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc4(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc5(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdsloc6(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdslocmask0(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdslocmask1(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdslocpol0(u32 module_index, u32 regvalue);
+void nx_lvds_set_lvdslocpol1(u32 module_index, u32 regvalue);
+
+void nx_lvds_set_lvdslocpol1(u32 module_index, u32 regvalue);
+
+void nx_lvds_set_lvdsdummy(u32 module_index, u32 regvalue);
+u32 nx_lvds_get_lvdsdummy(u32 module_index);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.c b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,675 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_disptop.h"
+#include "s5pxx18_soc_mipi.h"
+
+static struct nx_mipi_register_set *__g_pregister[NUMBER_OF_MIPI_MODULE];
+
+#ifdef CONFIG_SECURE_REG_ACCESS
+#include <linux/soc/nexell/sec_reg.h>
+
+static u32 __mipi_phys = PHY_BASEADDR_MIPI_MODULE;
+
+#define	__writel(v, a)	\
+	write_sec_reg((void *)(__mipi_phys +	\
+		(long)((void *)a - (void *)__g_pregister[0])), v)
+
+#define	__readl(a)	\
+	read_sec_reg((void *)(__mipi_phys +	\
+		(long)((void *)a - (void *)__g_pregister[0])))
+#else
+#define	__writel(v, a)	writel(v, a)
+#define	__readl(a)	readl(a)
+#endif
+
+int nx_mipi_smoke_test(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+
+	if (0x000000FC != __readl(&pregister->csis_config_ch0))
+		return false;
+
+	if (0xB337FFFF != __readl(&pregister->dsim_intmsk))
+		return false;
+
+	__writel(0xDEADC0DE, &pregister->csis_dphyctrl);
+	__writel(0xFFFFFFFF, &pregister->csis_ctrl2);
+	__writel(0xDEADC0DE, &pregister->dsim_msync);
+
+	if (0xDE80001E != __readl(&pregister->csis_dphyctrl))
+		return false;
+
+	if (0xEEE00010 != (__readl(&pregister->csis_ctrl2) & (~1)))
+		return false;
+
+	if (0xDE80C0DE != __readl(&pregister->dsim_msync))
+		return false;
+
+	return true;
+}
+
+int nx_mipi_initialize(void)
+{
+	static int binit;
+
+	if (0 == binit)
+		binit = 1;
+
+	return 1;
+}
+
+u32 nx_mipi_get_number_of_module(void)
+{
+	return NUMBER_OF_MIPI_MODULE;
+}
+
+u32 nx_mipi_get_size_of_register_set(void)
+{
+	return sizeof(struct nx_mipi_register_set);
+}
+
+void nx_mipi_set_base_address(u32 module_index, void *base_address)
+{
+	__g_pregister[module_index] =
+	    (struct nx_mipi_register_set *)base_address;
+}
+
+void *nx_mipi_get_base_address(u32 module_index)
+{
+	return (void *)__g_pregister[module_index];
+}
+
+u32 nx_mipi_get_physical_address(u32 module_index)
+{
+	const u32 physical_addr[] = PHY_BASEADDR_MIPI_LIST;
+
+	return physical_addr[module_index];
+}
+
+int nx_mipi_open_module(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+
+	__writel(0, &pregister->csis_dphyctrl_1);
+	__writel((22 << 24), &pregister->csis_dphyctrl);
+
+	return true;
+}
+
+int nx_mipi_close_module(u32 module_index)
+{
+	return true;
+}
+
+int nx_mipi_check_busy(u32 module_index)
+{
+	return false;
+}
+
+#define __nx_mipi_valid_csi_intmask__ (~((1 << 3)))
+#define __nx_mipi_valid_dsi_intmask__	\
+	(~((1 << 26) | (1 << 23) | (1 << 22) | (1 << 19)))
+
+void nx_mipi_set_interrupt_enable(u32 module_index, u32 int_num, int enable)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	if (int_num < 32) {
+		regvalue = __readl(&pregister->csis_intmsk);
+		regvalue &= ~(1ul << int_num);
+		regvalue |= (u32)enable << int_num;
+		__writel(regvalue, &pregister->csis_intmsk);
+	} else {
+		regvalue = __readl(&pregister->dsim_intmsk);
+		regvalue &= ~(1ul << (int_num - 32));
+		regvalue |= (u32)enable << (int_num - 32);
+		__writel(regvalue, &pregister->dsim_intmsk);
+	}
+}
+
+int nx_mipi_get_interrupt_enable(u32 module_index, u32 int_num)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	int ret;
+
+	pregister = __g_pregister[module_index];
+
+	if (int_num < 32) {
+		regvalue = __readl(&pregister->csis_intmsk);
+		ret = (int)((regvalue >> int_num) & 0x01);
+	} else {
+		regvalue = __readl(&pregister->dsim_intmsk);
+		ret = (int)((regvalue >> (int_num - 32)) & 0x01);
+	}
+
+	return ret;
+}
+
+int nx_mipi_get_interrupt_pending(u32 module_index, u32 int_num)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	int ret;
+
+	pregister = __g_pregister[module_index];
+	if (int_num < 32) {
+		regvalue = __readl(&pregister->csis_intmsk);
+		regvalue &= __readl(&pregister->csis_intsrc);
+		ret = (int)((regvalue >> int_num) & 0x01);
+	} else {
+		regvalue = __readl(&pregister->dsim_intmsk);
+		regvalue &= __readl(&pregister->dsim_intsrc);
+		ret = (int)((regvalue >> (int_num - 32)) & 0x01);
+	}
+
+	return ret;
+}
+
+void nx_mipi_clear_interrupt_pending(u32 module_index, u32 int_num)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	if (int_num < 32)
+		__writel(1ul << int_num, &pregister->csis_intsrc);
+	else
+		__writel(1ul << (int_num - 32), &pregister->dsim_intsrc);
+}
+
+void nx_mipi_set_interrupt_enable_all(u32 module_index, int enable)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	if (enable) {
+		__writel(__nx_mipi_valid_csi_intmask__,
+			&pregister->csis_intmsk);
+		__writel(__nx_mipi_valid_dsi_intmask__,
+			&pregister->dsim_intmsk);
+	} else {
+		__writel(0, &pregister->csis_intmsk);
+		__writel(0, &pregister->dsim_intmsk);
+	}
+}
+
+int nx_mipi_get_interrupt_enable_all(u32 module_index)
+{
+	if (__readl(&__g_pregister[module_index]->csis_intmsk))
+		return true;
+
+	if (__readl(&__g_pregister[module_index]->dsim_intmsk))
+		return true;
+
+	return false;
+}
+
+int nx_mipi_get_interrupt_pending_all(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	regvalue = __readl(&pregister->csis_intmsk);
+	regvalue &= __readl(&pregister->csis_intsrc);
+
+	if (regvalue)
+		return true;
+
+	regvalue = __readl(&pregister->dsim_intmsk);
+	regvalue &= __readl(&pregister->dsim_intsrc);
+
+	if (regvalue)
+		return true;
+
+	return false;
+}
+
+void nx_mipi_clear_interrupt_pending_all(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	__writel(__nx_mipi_valid_csi_intmask__, &pregister->csis_intsrc);
+	__writel(__nx_mipi_valid_dsi_intmask__, &pregister->dsim_intsrc);
+}
+
+int32_t nx_mipi_get_interrupt_pending_number(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	int i;
+
+	pregister = __g_pregister[module_index];
+	regvalue = __readl(&pregister->csis_intmsk);
+	regvalue &= __readl(&pregister->csis_intsrc);
+
+	if (0 != regvalue) {
+		for (i = 0; i < 32; i++) {
+			if (regvalue & 1ul)
+				return i;
+			regvalue >>= 1;
+		}
+	}
+
+	regvalue = __readl(&pregister->dsim_intmsk);
+	regvalue &= __readl(&pregister->dsim_intsrc);
+	if (0 != regvalue) {
+		for (i = 0; i < 32; i++) {
+			if (regvalue & 1ul)
+				return i + 32;
+			regvalue >>= 1;
+		}
+	}
+	return -1;
+}
+
+#define writereg(regname, mask, value) do { \
+	regvalue = __readl(&pregister->regname);	\
+	regvalue = (regvalue & (~(mask))) | (value); \
+	__writel(regvalue, &pregister->regname);	\
+	} while (0)
+
+void nx_mipi_dsi_get_status(u32 module_index, u32 *pulps, u32 *pstop,
+			    u32 *pispllstable, u32 *pisinreset,
+			    u32 *pisbackward, u32 *pishsclockready)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	regvalue = __readl(&pregister->dsim_status);
+
+	if (pulps) {
+		*pulps = 0;
+		if (regvalue & (1 << 4))
+			*pulps |= (1 << 0);
+		if (regvalue & (1 << 5))
+			*pulps |= (1 << 1);
+		if (regvalue & (1 << 6))
+			*pulps |= (1 << 2);
+		if (regvalue & (1 << 7))
+			*pulps |= (1 << 3);
+		if (regvalue & (1 << 9))
+			*pulps |= (1 << 4);
+	}
+
+	if (pstop) {
+		*pstop = 0;
+		if (regvalue & (1 << 0))
+			*pstop |= (1 << 0);
+		if (regvalue & (1 << 1))
+			*pstop |= (1 << 1);
+		if (regvalue & (1 << 2))
+			*pstop |= (1 << 2);
+		if (regvalue & (1 << 3))
+			*pstop |= (1 << 3);
+		if (regvalue & (1 << 8))
+			*pstop |= (1 << 4);
+	}
+
+	if (pispllstable)
+		*pispllstable = (regvalue >> 31) & 1;
+
+	if (pisinreset)
+		*pisinreset = ((regvalue >> 20) & 1) ? 0 : 1;
+
+	if (pisbackward)
+		*pisbackward = (regvalue >> 16) & 1;
+
+	if (pishsclockready)
+		*pishsclockready = (regvalue >> 10) & 1;
+}
+
+void nx_mipi_dsi_software_reset(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	__writel(0x00010001, &pregister->dsim_swrst);
+
+	while (0 != (__readl(&pregister->dsim_status) & (1 << 20)))
+		;
+}
+
+void nx_mipi_dsi_set_clock(u32 module_index, int enable_txhsclock,
+			   int use_external_clock, int enable_byte_clock,
+			   int enable_escclock_clock_lane,
+			   int enable_escclock_data_lane0,
+			   int enable_escclock_data_lane1,
+			   int enable_escclock_data_lane2,
+			   int enable_escclock_data_lane3,
+			   int enable_escprescaler, u32 escprescalervalue)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	regvalue = 0;
+
+	regvalue |= (enable_txhsclock << 31);
+	regvalue |= (use_external_clock << 27);
+	regvalue |= (enable_byte_clock << 24);
+	regvalue |= (enable_escclock_clock_lane << 19);
+	regvalue |= (enable_escclock_data_lane0 << 20);
+	regvalue |= (enable_escclock_data_lane1 << 21);
+	regvalue |= (enable_escclock_data_lane2 << 22);
+	regvalue |= (enable_escclock_data_lane3 << 23);
+	regvalue |= (enable_escprescaler << 28);
+	regvalue |= escprescalervalue;
+
+	__writel(regvalue, &pregister->dsim_clkctrl);
+}
+
+void nx_mipi_dsi_set_timeout(u32 module_index, u32 bta_tout, u32 lpdrtout)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	regvalue = 0;
+	regvalue |= (bta_tout << 16);
+	regvalue |= (lpdrtout << 0);
+
+	__writel(regvalue, &pregister->dsim_timeout);
+}
+
+void nx_mipi_dsi_set_config_video_mode(u32 module_index,
+				       int enable_auto_flush_main_display_fifo,
+				       int enable_auto_vertical_count,
+				       int enable_burst,
+				       enum nx_mipi_dsi_syncmode sync_mode,
+				       int enable_eo_tpacket,
+				       int enable_hsync_end_packet,
+				       int enable_hfp, int enable_hbp,
+				       int enable_hsa,
+				       u32 number_of_virtual_channel,
+				       enum nx_mipi_dsi_format format,
+				       u32 number_of_words_in_hfp,
+				       u32 number_of_words_in_hbp,
+				       u32 number_of_words_in_hsync,
+				       u32 number_of_lines_in_vfp,
+				       u32 number_of_lines_in_vbp,
+				       u32 number_of_lines_in_vsync,
+				       u32 number_of_lines_in_command_allow)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	newvalue = (1 << 25);
+	newvalue |= ((1 - enable_auto_flush_main_display_fifo) << 29);
+	newvalue |= (enable_auto_vertical_count << 24);
+	newvalue |= (enable_burst << 26);
+	newvalue |= (sync_mode << 27);
+	newvalue |= ((1 - enable_eo_tpacket) << 28);
+	newvalue |= (enable_hsync_end_packet << 23);
+	newvalue |= ((1 - enable_hfp) << 22);
+	newvalue |= ((1 - enable_hbp) << 21);
+	newvalue |= ((1 - enable_hsa) << 20);
+	newvalue |= (number_of_virtual_channel << 18);
+	newvalue |= (format << 12);
+
+	writereg(dsim_config, 0xFFFFFF00, newvalue);
+
+	newvalue = (number_of_lines_in_command_allow << 28);
+	newvalue |= (number_of_lines_in_vfp << 16);
+	newvalue |= (number_of_lines_in_vbp << 0);
+
+	__writel(newvalue, &pregister->dsim_mvporch);
+
+	newvalue = (number_of_words_in_hfp << 16);
+	newvalue |= (number_of_words_in_hbp << 0);
+
+	__writel(newvalue, &pregister->dsim_mhporch);
+
+	newvalue = (number_of_words_in_hsync << 0);
+	newvalue |= (number_of_lines_in_vsync << 22);
+
+	__writel(newvalue, &pregister->dsim_msync);
+}
+
+void nx_mipi_dsi_set_config_command_mode(u32 module_index,
+					 int
+					 enable_auto_flush_main_display_fifo,
+					 int enable_eo_tpacket,
+					 u32 number_of_virtual_channel,
+					 enum nx_mipi_dsi_format format)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	newvalue = (0 << 25);
+	newvalue |= (enable_auto_flush_main_display_fifo << 29);
+	newvalue |= (enable_eo_tpacket << 28);
+	newvalue |= (number_of_virtual_channel << 18);
+	newvalue |= (format << 12);
+	writereg(dsim_config, 0xFFFFFF00, newvalue);
+}
+
+void nx_mipi_dsi_set_escape_mode(u32 module_index, u32 stop_state_count,
+				 int force_stop_state, int force_bta,
+				 enum nx_mipi_dsi_lpmode cmdin_lp,
+				 enum nx_mipi_dsi_lpmode txinlp)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	newvalue = (stop_state_count << 21);
+	newvalue |= (force_stop_state << 20);
+	newvalue |= (force_bta << 16);
+	newvalue |= (cmdin_lp << 7);
+	newvalue |= (txinlp << 6);
+	writereg(dsim_escmode, 0xFFFFFFC0, newvalue);
+}
+
+void nx_mipi_dsi_set_escape_lp(u32 module_index,
+				enum nx_mipi_dsi_lpmode cmdin_lp,
+				enum nx_mipi_dsi_lpmode txinlp)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue = 0;
+
+	pregister = __g_pregister[module_index];
+	newvalue |= (cmdin_lp << 7);
+	newvalue |= (txinlp << 6);
+	writereg(dsim_escmode, 0xC0, newvalue);
+}
+
+void nx_mipi_dsi_remote_reset_trigger(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	newvalue = (1 << 4);
+	writereg(dsim_escmode, (1 << 4), newvalue);
+
+	while (__readl(&pregister->dsim_escmode) & (1 << 4))
+		;
+}
+
+void nx_mipi_dsi_set_ulps(u32 module_index, int ulpsclocklane, int ulpsdatalane)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	regvalue = __readl(&pregister->dsim_escmode);
+
+	if (ulpsclocklane) {
+		regvalue &= ~(1 << 0);
+		regvalue |= (1 << 1);
+	} else {
+		regvalue |= (1 << 0);
+	}
+
+	if (ulpsdatalane) {
+		regvalue &= ~(1 << 2);
+		regvalue |= (1 << 3);
+	} else {
+		regvalue |= (1 << 2);
+	}
+
+	__writel(regvalue, &pregister->dsim_escmode);
+
+	if (ulpsclocklane)
+		while ((1 << 9) ==
+		       (__readl(&pregister->dsim_status) & (1 << 9)))
+			;
+	else
+		while (0 != (__readl(&pregister->dsim_status) & (1 << 9)))
+			;
+
+	if (ulpsdatalane)
+		while ((15 << 4) ==
+		       (__readl(&pregister->dsim_status) & (15 << 4)))
+			;
+	else
+		while (0 != (__readl(&pregister->dsim_status) & (15 << 4)))
+			;
+
+	if (!ulpsclocklane)
+		regvalue &= (3 << 0);
+
+	if (!ulpsdatalane)
+		regvalue |= (3 << 2);
+
+	__writel(regvalue, &pregister->dsim_escmode);
+}
+
+void nx_mipi_dsi_set_size(u32 module_index, u32 width, u32 height)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	newvalue = (height << 16);
+	newvalue |= (width << 0);
+	writereg(dsim_mdresol, 0x0FFFFFFF, newvalue);
+}
+
+void nx_mipi_dsi_set_enable(u32 module_index, int enable)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_pregister[module_index];
+	writereg(dsim_mdresol, (1 << 31), (enable << 31));
+}
+
+void nx_mipi_dsi_set_phy(u32 module_index, u32 number_of_data_lanes,
+			 int enable_clock_lane, int enable_data_lane0,
+			 int enable_data_lane1, int enable_data_lane2,
+			 int enable_data_lane3, int swap_clock_lane,
+			 int swap_data_lane)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	newvalue = (number_of_data_lanes << 5);
+	newvalue |= (enable_clock_lane << 0);
+	newvalue |= (enable_data_lane0 << 1);
+	newvalue |= (enable_data_lane1 << 2);
+	newvalue |= (enable_data_lane2 << 3);
+	newvalue |= (enable_data_lane3 << 4);
+	writereg(dsim_config, 0xFF, newvalue);
+	newvalue = (swap_clock_lane << 1);
+	newvalue |= (swap_data_lane << 0);
+	writereg(dsim_phyacchr1, 0x3, newvalue);
+}
+
+void nx_mipi_dsi_set_pll(u32 module_index, int enable, u32 pllstabletimer,
+			 u32 m_pllpms, u32 m_bandctl, u32 m_dphyctl,
+			 u32 b_dphyctl)
+{
+	register struct nx_mipi_register_set *pregister;
+	register u32 regvalue;
+	u32 newvalue;
+
+	pregister = __g_pregister[module_index];
+	if (!enable) {
+		newvalue = (enable << 23);
+		newvalue |= (m_pllpms << 1);
+		newvalue |= (m_bandctl << 24);
+		writereg(dsim_pllctrl, 0x0FFFFFFF, newvalue);
+	}
+
+	__writel(m_dphyctl, &pregister->dsim_phyacchr);
+	__writel(pllstabletimer, &pregister->dsim_plltmr);
+	__writel((b_dphyctl << 9), &pregister->dsim_phyacchr1);
+
+	if (enable) {
+		newvalue = (enable << 23);
+		newvalue |= (m_pllpms << 1);
+		newvalue |= (m_bandctl << 24);
+		writereg(dsim_pllctrl, 0x0FFFFFFF, newvalue);
+	}
+}
+
+void nx_mipi_dsi_write_pkheader(u32 module_index, u32 data)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	__writel(data, &pregister->dsim_pkthdr);
+}
+
+void nx_mipi_dsi_write_payload(u32 module_index, u32 data)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	__writel(data, &pregister->dsim_payload);
+}
+
+u32 nx_mipi_dsi_read_fifo(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+	return __readl(&pregister->dsim_rxfifo);
+}
+
+u32 nx_mipi_dsi_read_fifo_status(u32 module_index)
+{
+	register struct nx_mipi_register_set *pregister;
+
+	pregister = __g_pregister[module_index];
+
+	return __readl(&pregister->dsim_fifoctrl);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mipi.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_MIPI_H_
+#define _S5PXX18_SOC_MIPI_H_
+
+#define NUMBER_OF_MIPI_MODULE 1
+#define PHY_BASEADDR_MIPI_MODULE	0xC00D0000
+#define	PHY_BASEADDR_MIPI_LIST	\
+		{ PHY_BASEADDR_MIPI_MODULE }
+
+#define nx_mipi_numberof_csi_channels 2
+
+struct nx_mipi_register_set {
+	u32 csis_control;
+	u32 csis_dphyctrl;
+	u32 csis_config_ch0;
+	u32 csis_dphysts;
+	u32 csis_intmsk;
+	u32 csis_intsrc;
+	u32 csis_ctrl2;
+	u32 csis_version;
+	u32 csis_dphyctrl_0;
+	u32 csis_dphyctrl_1;
+	u32 __reserved0;
+	u32 csis_resol_ch0;
+	u32 __reserved1;
+	u32 __reserved2;
+	u32 sdw_config_ch0;
+	u32 sdw_resol_ch0;
+	u32 csis_config_ch1;
+	u32 csis_resol_ch1;
+	u32 sdw_config_ch1;
+	u32 sdw_resol_ch1;
+	u32 csis_config_ch2;
+	u32 csis_resol_ch2;
+	u32 sdw_config_ch2;
+	u32 sdw_resol_ch2;
+	u32 csis_config_ch3;
+	u32 csis_resol_ch3;
+	u32 sdw_config_ch3;
+	u32 sdw_resol_3;
+	u32 __reserved3[(16 + 128) / 4];
+
+	u32 dsim_status;
+	u32 dsim_swrst;
+	u32 dsim_clkctrl;
+	u32 dsim_timeout;
+	u32 dsim_config;
+	u32 dsim_escmode;
+	u32 dsim_mdresol;
+	u32 dsim_mvporch;
+	u32 dsim_mhporch;
+	u32 dsim_msync;
+	u32 dsim_sdresol;
+	u32 dsim_intsrc;
+	u32 dsim_intmsk;
+	u32 dsim_pkthdr;
+	u32 dsim_payload;
+	u32 dsim_rxfifo;
+	u32 dsim_fifothld;
+	u32 dsim_fifoctrl;
+	u32 dsim_memacchr;
+	u32 dsim_pllctrl;
+	u32 dsim_plltmr;
+	u32 dsim_phyacchr;
+	u32 dsim_phyacchr1;
+
+	u32 __reserved4[(0x2000 - 0x015C) / 4];
+	u32 mipi_csis_pktdata[0x2000 / 4];
+};
+
+enum nx_mipi_dsi_syncmode {
+	nx_mipi_dsi_syncmode_event = 0,
+	nx_mipi_dsi_syncmode_pulse = 1,
+};
+
+enum nx_mipi_dsi_format {
+	nx_mipi_dsi_format_command3 = 0,
+	nx_mipi_dsi_format_command8 = 1,
+	nx_mipi_dsi_format_command12 = 2,
+	nx_mipi_dsi_format_command16 = 3,
+	nx_mipi_dsi_format_rgb565 = 4,
+	nx_mipi_dsi_format_rgb666_packed = 5,
+	nx_mipi_dsi_format_rgb666 = 6,
+	nx_mipi_dsi_format_rgb888 = 7
+};
+
+enum nx_mipi_dsi_lpmode {
+	nx_mipi_dsi_lpmode_hs = 0,
+	nx_mipi_dsi_lpmode_lp = 1
+};
+
+enum nx_mipi_phy_b_dphyctl {
+	nx_mipi_phy_b_dphyctl_m_txclkesc_20_mhz = 0x1F4,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_19_mhz = 0x1DB,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_18_mhz = 0x1C2,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_17_mhz = 0x1A9,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_16_mhz = 0x190,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_15_mhz = 0x177,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_14_mhz = 0x15E,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_13_mhz = 0x145,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_12_mhz = 0x12C,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_11_mhz = 0x113,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_10_mhz = 0x0FA,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_9_mhz = 0x0E1,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_8_mhz = 0x0C8,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_7_mhz = 0x0AF,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_6_mhz = 0x096,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_5_mhz = 0x07D,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_4_mhz = 0x064,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_3_mhz = 0x04B,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_2_mhz = 0x032,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_1_mhz = 0x019,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_0_10_mhz = 0x003,
+	nx_mipi_phy_b_dphyctl_m_txclkesc_0_01_mhz = 0x000
+};
+
+enum {
+	nx_mipi_rst = 0,
+	nx_mipi_rst_dsi_i,
+	nx_mipi_rst_csi_i,
+	nx_mipi_rst_phy_s,
+	nx_mipi_rst_phy_m
+};
+
+enum nx_mipi_int {
+	nx_mipi_int_csi_even_before = 31,
+	nx_mipi_int_csi_even_after = 30,
+	nx_mipi_int_csi_odd_before = 29,
+	nx_mipi_int_csi_odd_after = 28,
+	nx_mipi_int_csi_frame_start_ch3 = 27,
+	nx_mipi_int_csi_frame_start_ch2 = 26,
+	nx_mipi_int_csi_frame_start_ch1 = 25,
+	nx_mipi_int_csi_frame_start_ch0 = 24,
+	nx_mipi_int_csi_frame_end_ch3 = 23,
+	nx_mipi_int_csi_frame_end_ch2 = 22,
+	nx_mipi_int_csi_frame_end_ch1 = 21,
+	nx_mipi_int_csi_frame_end_ch0 = 20,
+	nx_mipi_int_csi_err_sot_hs_ch3 = 19,
+	nx_mipi_int_csi_err_sot_hs_ch2 = 18,
+	nx_mipi_int_csi_err_sot_hs_ch1 = 17,
+	nx_mipi_int_csi_err_sot_hs_ch0 = 16,
+	nx_mipi_int_csi_err_lost_fs_ch3 = 15,
+	nx_mipi_int_csi_err_lost_fs_ch2 = 14,
+	nx_mipi_int_csi_err_lost_fs_ch1 = 13,
+	nx_mipi_int_csi_err_lost_fs_ch0 = 12,
+	nx_mipi_int_csi_err_lost_fe_ch3 = 11,
+	nx_mipi_int_csi_err_lost_fe_ch2 = 10,
+	nx_mipi_int_csi_err_lost_fe_ch1 = 9,
+	nx_mipi_int_csi_err_lost_fe_ch0 = 8,
+	nx_mipi_int_csi_err_over_ch3 = 7,
+	nx_mipi_int_csi_err_over_ch2 = 6,
+	nx_mipi_int_csi_err_over_ch1 = 5,
+	nx_mipi_int_csi_err_over_ch0 = 4,
+
+	nx_mipi_int_csi_err_ecc = 2,
+	nx_mipi_int_csi_err_crc = 1,
+	nx_mipi_int_csi_err_id = 0,
+	nx_mipi_int_dsi_pll_stable = 32 + 31,
+	nx_mipi_int_dsi_sw_rst_release = 32 + 30,
+	nx_mipi_int_dsi_sfrplfifoempty = 32 + 29,
+	nx_mipi_int_dsi_sfrphfifoempty = 32 + 28,
+	nx_mipi_int_dsi_sync_override = 32 + 27,
+
+	nx_mipi_int_dsi_bus_turn_over = 32 + 25,
+	nx_mipi_int_dsi_frame_done = 32 + 24,
+
+	nx_mipi_int_dsi_lpdr_tout = 32 + 21,
+	nx_mipi_int_dsi_ta_tout = 32 + 20,
+
+	nx_mipi_int_dsi_rx_dat_done = 32 + 18,
+	nx_mipi_int_dsi_rx_te = 32 + 17,
+	nx_mipi_int_dsi_rx_ack = 32 + 16,
+	nx_mipi_int_dsi_err_rx_ecc = 32 + 15,
+	nx_mipi_int_dsi_err_rx_crc = 32 + 14,
+	nx_mipi_int_dsi_err_esc3 = 32 + 13,
+	nx_mipi_int_dsi_err_esc2 = 32 + 12,
+	nx_mipi_int_dsi_err_esc1 = 32 + 11,
+	nx_mipi_int_dsi_err_esc0 = 32 + 10,
+	nx_mipi_int_dsi_err_sync3 = 32 + 9,
+	nx_mipi_int_dsi_err_sync2 = 32 + 8,
+	nx_mipi_int_dsi_err_sync1 = 32 + 7,
+	nx_mipi_int_dsi_err_sync0 = 32 + 6,
+	nx_mipi_int_dsi_err_control3 = 32 + 5,
+	nx_mipi_int_dsi_err_control2 = 32 + 4,
+	nx_mipi_int_dsi_err_control1 = 32 + 3,
+	nx_mipi_int_dsi_err_control0 = 32 + 2,
+	nx_mipi_int_dsi_err_content_lp0 = 32 + 1,
+	nx_mipi_int_dsi_err_content_lp1 = 32 + 0,
+};
+
+#define DSI_TX_FIFO_SIZE	2048
+#define DSI_RX_FIFO_SIZE	256
+#define DSI_RX_FIFO_EMPTY	0x30800002
+
+void nx_mipi_dsi_get_status(u32 module_index, u32 *pulps, u32 *pstop,
+				u32 *pispllstable, u32 *pisinreset,
+				u32 *pisbackward, u32 *pishsclockready);
+
+void nx_mipi_dsi_software_reset(u32 module_index);
+
+void nx_mipi_dsi_set_clock(u32 module_index, int enable_txhsclock,
+				int use_external_clock, int enable_byte_clock,
+				int enable_escclock_clock_lane,
+				int enable_escclock_data_lane0,
+				int enable_escclock_data_lane1,
+				int enable_escclock_data_lane2,
+				int enable_escclock_data_lane3,
+				int enable_escprescaler,
+				u32 escprescalervalue);
+
+void nx_mipi_dsi_set_timeout(u32 module_index, u32 bta_tout,
+				u32 lpdrtout);
+
+void nx_mipi_dsi_set_config_video_mode(u32 module_index,
+				int enable_auto_flush_main_display_fifo,
+				int enable_auto_vertical_count,
+				int enable_burst,
+				enum nx_mipi_dsi_syncmode
+				sync_mode, int enable_eo_tpacket,
+				int enable_hsync_end_packet,
+				int enable_hfp, int enable_hbp,
+				int enable_hsa,
+				u32 number_of_virtual_channel,
+				enum nx_mipi_dsi_format format,
+				u32 number_of_words_in_hfp,
+				u32 number_of_words_in_hbp,
+				u32 number_of_words_in_hsync,
+				u32 number_of_lines_in_vfp,
+				u32 number_of_lines_in_vbp,
+				u32 number_of_lines_in_vsync,
+				u32 number_of_lines_in_command_allow);
+
+void nx_mipi_dsi_set_config_command_mode(u32 module_index,
+				int enable_auto_flush_main_display_fifo,
+				int enable_eo_tpacket,
+				u32 number_of_virtual_channel,
+				enum nx_mipi_dsi_format format);
+
+void nx_mipi_dsi_set_escape_mode(u32 module_index, u32 stop_state_count,
+				int force_stop_state, int force_bta,
+				enum nx_mipi_dsi_lpmode cmdin_lp,
+				enum nx_mipi_dsi_lpmode txinlp);
+void nx_mipi_dsi_set_escape_lp(u32 module_index,
+				enum nx_mipi_dsi_lpmode cmdin_lp,
+				enum nx_mipi_dsi_lpmode txinlp);
+
+void nx_mipi_dsi_remote_reset_trigger(u32 module_index);
+void nx_mipi_dsi_set_ulps(u32 module_index, int ulpsclocklane,
+				int ulpsdatalane);
+void nx_mipi_dsi_set_size(u32 module_index, u32 width, u32 height);
+void nx_mipi_dsi_set_enable(u32 module_index, int enable);
+void nx_mipi_dsi_set_phy(u32 module_index, u32 number_of_data_lanes,
+				int enable_clock_lane, int enable_data_lane0,
+				int enable_data_lane1, int enable_data_lane2,
+				int enable_data_lane3, int swap_clock_lane,
+				int swap_data_lane);
+
+void nx_mipi_dsi_set_pll(u32 module_index, int enable,
+				u32 pllstabletimer, u32 m_pllpms, u32 m_bandctl,
+				u32 m_dphyctl, u32 b_dphyctl);
+
+void nx_mipi_dsi_write_pkheader(u32 module_index, u32 data);
+void nx_mipi_dsi_write_payload(u32 module_index, u32 data);
+u32 nx_mipi_dsi_read_fifo(u32 module_index);
+u32 nx_mipi_dsi_read_fifo_status(u32 module_index);
+
+int nx_mipi_smoke_test(u32 module_index);
+int nx_mipi_initialize(void);
+u32 nx_mipi_get_number_of_module(void);
+u32 nx_mipi_get_size_of_register_set(void);
+void nx_mipi_set_base_address(u32 module_index, void *base_address);
+void *nx_mipi_get_base_address(u32 module_index);
+u32 nx_mipi_get_physical_address(u32 module_index);
+int nx_mipi_open_module(u32 module_index);
+int nx_mipi_close_module(u32 module_index);
+int nx_mipi_check_busy(u32 module_index);
+
+void nx_mipi_set_interrupt_enable(u32 module_index,
+				u32 int_num, int enable);
+int nx_mipi_get_interrupt_enable(u32 module_index, u32 int_num);
+int nx_mipi_get_interrupt_pending(u32 module_index, u32 int_num);
+void nx_mipi_clear_interrupt_pending(u32 module_index, u32 int_num);
+void nx_mipi_set_interrupt_enable_all(u32 module_index, int enable);
+int nx_mipi_get_interrupt_enable_all(u32 module_index);
+int nx_mipi_get_interrupt_pending_all(u32 module_index);
+void nx_mipi_clear_interrupt_pending_all(u32 module_index);
+int32_t nx_mipi_get_interrupt_pending_number(u32 module_index);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.c b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.c
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.c	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,1871 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_mlc.h"
+
+static struct {
+	struct nx_mlc_register_set *pregister;
+} __g_module_variables[NUMBER_OF_MLC_MODULE] = { { NULL, },};
+
+int nx_mlc_initialize(void)
+{
+	static int binit;
+	u32 i;
+
+	if (0 == binit) {
+		for (i = 0; i < NUMBER_OF_MLC_MODULE; i++)
+			__g_module_variables[i].pregister = NULL;
+		binit = 1;
+	}
+	return 1;
+}
+
+u32 nx_mlc_get_physical_address(u32 module_index)
+{
+	const u32 physical_addr[] = PHY_BASEADDR_MLC_LIST;
+
+	return physical_addr[module_index];
+}
+
+void nx_mlc_set_base_address(u32 module_index, void *base_address)
+{
+	__g_module_variables[module_index].pregister =
+	    (struct nx_mlc_register_set *)base_address;
+}
+
+void *nx_mlc_get_base_address(u32 module_index)
+{
+	return (void *)__g_module_variables[module_index].pregister;
+}
+
+void nx_mlc_set_clock_pclk_mode(u32 module_index, enum nx_pclkmode mode)
+{
+	const u32 pclkmode_pos = 3;
+	u32 clkmode = 0;
+
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	switch (mode) {
+	case nx_pclkmode_dynamic:
+		clkmode = 0;
+		break;
+	case nx_pclkmode_always:
+		clkmode = 1;
+		break;
+	default:
+		break;
+	}
+	regvalue = pregister->mlcclkenb;
+	regvalue &= ~(1ul << pclkmode_pos);
+	regvalue |= (clkmode & 0x01) << pclkmode_pos;
+
+	writel(regvalue, &pregister->mlcclkenb);
+}
+
+enum nx_pclkmode nx_mlc_get_clock_pclk_mode(u32 module_index)
+{
+	const u32 pclkmode_pos = 3;
+
+	if (__g_module_variables[module_index].pregister->mlcclkenb &
+	    (1ul << pclkmode_pos)) {
+		return nx_pclkmode_always;
+	}
+	return nx_pclkmode_dynamic;
+}
+
+void nx_mlc_set_clock_bclk_mode(u32 module_index, enum nx_bclkmode mode)
+{
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+	u32 clkmode = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+	switch (mode) {
+	case nx_bclkmode_disable:
+		clkmode = 0;
+		break;
+	case nx_bclkmode_dynamic:
+		clkmode = 2;
+		break;
+	case nx_bclkmode_always:
+		clkmode = 3;
+		break;
+	default:
+		break;
+	}
+	regvalue = pregister->mlcclkenb;
+	regvalue &= ~(0x3);
+	regvalue |= clkmode & 0x3;
+
+	writel(regvalue, &pregister->mlcclkenb);
+}
+
+enum nx_bclkmode nx_mlc_get_clock_bclk_mode(u32 module_index)
+{
+	const u32 bclkmode = 3ul << 0;
+
+	switch (__g_module_variables[module_index].pregister->mlcclkenb &
+		bclkmode) {
+	case 0:
+		return nx_bclkmode_disable;
+	case 2:
+		return nx_bclkmode_dynamic;
+	case 3:
+		return nx_bclkmode_always;
+	}
+	return nx_bclkmode_disable;
+}
+
+void nx_mlc_set_top_power_mode(u32 module_index, int bpower)
+{
+	const u32 pixelbuffer_pwd_pos = 11;
+	const u32 pixelbuffer_pwd_mask = 1ul << pixelbuffer_pwd_pos;
+	const u32 dittyflag_mask = 1ul << 3;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(pixelbuffer_pwd_mask | dittyflag_mask);
+	regvalue |= (bpower << pixelbuffer_pwd_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_top_power_mode(u32 module_index)
+{
+	const u32 pixelbuffer_pwd_pos = 11;
+	const u32 pixelbuffer_pwd_mask = 1ul << pixelbuffer_pwd_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlccontrolt & pixelbuffer_pwd_mask) >>
+		     pixelbuffer_pwd_pos);
+}
+
+void nx_mlc_set_top_sleep_mode(u32 module_index, int bsleep)
+{
+	const u32 pixelbuffer_sld_pos = 10;
+	const u32 pixelbuffer_sld_mask = 1ul << pixelbuffer_sld_pos;
+	const u32 dittyflag_mask = 1ul << 3;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	bsleep = (int)((u32) bsleep ^ 1);
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(pixelbuffer_sld_mask | dittyflag_mask);
+	regvalue |= (bsleep << pixelbuffer_sld_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_top_sleep_mode(u32 module_index)
+{
+	const u32 pixelbuffer_sld_pos = 11;
+	const u32 pixelbuffer_sld_mask = 1ul << pixelbuffer_sld_pos;
+
+	return (int)(((__g_module_variables[module_index].pregister->
+		       mlccontrolt & pixelbuffer_sld_mask) >>
+		      pixelbuffer_sld_pos) ^ 0x01);
+}
+
+void nx_mlc_set_top_dirty_flag(u32 module_index)
+{
+	const u32 dirtyflag = 1ul << 3;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue |= dirtyflag;
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_top_dirty_flag(u32 module_index)
+{
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+
+	return (int)((readl(&__g_module_variables[module_index]
+			    .pregister->mlccontrolt) &
+		      dirtyflag_mask) >> dirtyflag_pos);
+}
+
+void nx_mlc_set_mlc_enable(u32 module_index, int benb)
+{
+	const u32 mlcenb_pos = 1;
+	const u32 mlcenb_mask = 1ul << mlcenb_pos;
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(mlcenb_mask | dirtyflag_mask);
+	regvalue |= (benb << mlcenb_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_mlc_enable(u32 module_index)
+{
+	const u32 mlcenb_pos = 1;
+	const u32 mlcenb_mask = 1ul << mlcenb_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlccontrolt & mlcenb_mask) >> mlcenb_pos);
+}
+
+void nx_mlc_set_field_enable(u32 module_index, int benb)
+{
+	const u32 fieldenb_pos = 0;
+	const u32 fieldenb_mask = 1ul << fieldenb_pos;
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(fieldenb_mask | dirtyflag_mask);
+	regvalue |= (benb << fieldenb_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_field_enable(u32 module_index)
+{
+	const u32 fieldenb_pos = 0;
+	const u32 fieldenb_mask = 1ul << fieldenb_pos;
+
+	return (int)(__g_module_variables[module_index].pregister->mlccontrolt &
+		     fieldenb_mask);
+}
+
+void nx_mlc_set_layer_priority(u32 module_index, enum nx_mlc_priority priority)
+{
+	const u32 priority_pos = 8;
+	const u32 priority_mask = 0x03 << priority_pos;
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(priority_mask | dirtyflag_mask);
+	regvalue |= (priority << priority_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+void nx_mlc_set_screen_size(u32 module_index, u32 width, u32 height)
+{
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = ((height - 1) << 16) | (width - 1);
+
+	writel(regvalue, &pregister->mlcscreensize);
+}
+
+void nx_mlc_get_screen_size(u32 module_index, u32 *pwidth, u32 *pheight)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	if (NULL != pwidth)
+		*pwidth = (pregister->mlcscreensize & 0x0fff) + 1;
+
+	if (NULL != pheight)
+		*pheight = ((pregister->mlcscreensize >> 16) & 0x0fff) + 1;
+}
+
+void nx_mlc_set_background(u32 module_index, u32 color)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(color, &pregister->mlcbgcolor);
+}
+
+void nx_mlc_set_dirty_flag(u32 module_index, u32 layer)
+{
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+	const u32 dirtyflg_mask = 1ul << 4;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue |= dirtyflg_mask;
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	} else if (3 == layer) {
+		regvalue = pregister->mlcvideolayer.mlccontrol;
+		regvalue |= dirtyflg_mask;
+
+		writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+	}
+}
+
+int nx_mlc_get_dirty_flag(u32 module_index, u32 layer)
+{
+	const u32 dirtyflg_pos = 4;
+	const u32 dirtyflg_mask = 1ul << dirtyflg_pos;
+
+	if (0 == layer || 1 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcrgblayer[layer]
+			      .mlccontrol & dirtyflg_mask) >> dirtyflg_pos);
+	} else if (2 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcrgblayer2.mlccontrol &
+			      dirtyflg_mask) >> dirtyflg_pos);
+	} else if (3 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcvideolayer.mlccontrol &
+			      dirtyflg_mask) >> dirtyflg_pos);
+	}
+	return 0;
+}
+
+void nx_mlc_set_layer_enable(u32 module_index, u32 layer, int benb)
+{
+	const u32 layerenb_pos = 5;
+	const u32 layerenb_mask = 0x01 << layerenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(layerenb_mask | dirtyflag_mask);
+		regvalue |= (benb << layerenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	} else if (3 == layer) {
+		regvalue = pregister->mlcvideolayer.mlccontrol;
+		regvalue &= ~(layerenb_mask | dirtyflag_mask);
+		regvalue |= (benb << layerenb_pos);
+
+		writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+	}
+}
+
+int nx_mlc_get_layer_enable(u32 module_index, u32 layer)
+{
+	const u32 layerenb_pos = 5;
+	const u32 layerenb_mask = 0x01 << layerenb_pos;
+
+	if (0 == layer || 1 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcrgblayer[layer]
+			      .mlccontrol & layerenb_mask) >> layerenb_pos);
+	} else if (3 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcvideolayer.mlccontrol &
+			      layerenb_mask) >> layerenb_pos);
+	}
+	return 0;
+}
+
+void nx_mlc_set_lock_size(u32 module_index, u32 layer, u32 locksize)
+{
+	const u32 locksize_mask = 3ul << 12;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	locksize >>= 3;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(locksize_mask | dirtyflag_mask);
+		regvalue |= (locksize << 12);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	}
+}
+
+void nx_mlc_set_alpha_blending(u32 module_index, u32 layer, int benb, u32 alpha)
+{
+	const u32 blendenb_pos = 2;
+	const u32 blendenb_mask = 0x01 << blendenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 alpha_pos = 28;
+	const u32 alpha_mask = 0xf << alpha_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(blendenb_mask | dirtyflag_mask);
+		regvalue |= (benb << blendenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+		regvalue = pregister->mlcrgblayer[layer].mlctpcolor;
+		regvalue &= ~alpha_mask;
+		regvalue |= alpha << alpha_pos;
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlctpcolor);
+	} else if (3 == layer) {
+		regvalue = pregister->mlcvideolayer.mlccontrol;
+		regvalue &= ~(blendenb_mask | dirtyflag_mask);
+		regvalue |= (benb << blendenb_pos);
+
+		writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+
+		writel(alpha << alpha_pos,
+		       &pregister->mlcvideolayer.mlctpcolor);
+	}
+}
+
+void nx_mlc_set_transparency(u32 module_index, u32 layer, int benb, u32 color)
+{
+	const u32 tpenb_pos = 0;
+	const u32 tpenb_mask = 0x01 << tpenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 tpcolor_pos = 0;
+	const u32 tpcolor_mask = ((1 << 24) - 1) << tpcolor_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(tpenb_mask | dirtyflag_mask);
+		regvalue |= (benb << tpenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+		regvalue = pregister->mlcrgblayer[layer].mlctpcolor;
+		regvalue &= ~tpcolor_mask;
+		regvalue |= (color & tpcolor_mask);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlctpcolor);
+	}
+}
+
+void nx_mlc_set_color_inversion(u32 module_index, u32 layer, int benb,
+				u32 color)
+{
+	const u32 invenb_pos = 1;
+	const u32 invenb_mask = 0x01 << invenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 invcolor_pos = 0;
+	const u32 invcolor_mask = ((1 << 24) - 1) << invcolor_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(invenb_mask | dirtyflag_mask);
+		regvalue |= (benb << invenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+		regvalue = pregister->mlcrgblayer[layer].mlcinvcolor;
+		regvalue &= ~invcolor_mask;
+		regvalue |= (color & invcolor_mask);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlcinvcolor);
+	}
+}
+
+u32 nx_mlc_get_extended_color(u32 module_index, u32 color,
+			      enum nx_mlc_rgbfmt format)
+{
+	u32 rgb[3] = {
+		0,
+	};
+	u32 bw[3] = {
+		0,
+	};
+	u32 bp[3] = {
+		0,
+	};
+	u32 blank = 0;
+	u32 fill = 0;
+	u32 i = 0;
+
+	switch (format) {
+	case nx_mlc_rgbfmt_r5g6b5:
+		bw[0] = 5;
+		bw[1] = 6;
+		bw[2] = 5;
+		bp[0] = 11;
+		bp[1] = 5;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_b5g6r5:
+		bw[0] = 5;
+		bw[1] = 6;
+		bw[2] = 5;
+		bp[0] = 0;
+		bp[1] = 5;
+		bp[2] = 11;
+		break;
+	case nx_mlc_rgbfmt_x1r5g5b5:
+	case nx_mlc_rgbfmt_a1r5g5b5:
+		bw[0] = 5;
+		bw[1] = 5;
+		bw[2] = 5;
+		bp[0] = 10;
+		bp[1] = 5;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_x1b5g5r5:
+	case nx_mlc_rgbfmt_a1b5g5r5:
+		bw[0] = 5;
+		bw[1] = 5;
+		bw[2] = 5;
+		bp[0] = 0;
+		bp[1] = 5;
+		bp[2] = 10;
+		break;
+	case nx_mlc_rgbfmt_x4r4g4b4:
+	case nx_mlc_rgbfmt_a4r4g4b4:
+		bw[0] = 4;
+		bw[1] = 4;
+		bw[2] = 4;
+		bp[0] = 8;
+		bp[1] = 4;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_x4b4g4r4:
+	case nx_mlc_rgbfmt_a4b4g4r4:
+		bw[0] = 4;
+		bw[1] = 4;
+		bw[2] = 4;
+		bp[0] = 0;
+		bp[1] = 4;
+		bp[2] = 8;
+		break;
+	case nx_mlc_rgbfmt_x8r3g3b2:
+	case nx_mlc_rgbfmt_a8r3g3b2:
+		bw[0] = 3;
+		bw[1] = 3;
+		bw[2] = 2;
+		bp[0] = 5;
+		bp[1] = 2;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_x8b3g3r2:
+	case nx_mlc_rgbfmt_a8b3g3r2:
+		bw[0] = 2;
+		bw[1] = 3;
+		bw[2] = 3;
+		bp[0] = 0;
+		bp[1] = 2;
+		bp[2] = 5;
+		break;
+	case nx_mlc_rgbfmt_r8g8b8:
+	case nx_mlc_rgbfmt_a8r8g8b8:
+		bw[0] = 8;
+		bw[1] = 8;
+		bw[2] = 8;
+		bp[0] = 16;
+		bp[1] = 8;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_b8g8r8:
+	case nx_mlc_rgbfmt_a8b8g8r8:
+		bw[0] = 8;
+		bw[1] = 8;
+		bw[2] = 8;
+		bp[0] = 0;
+		bp[1] = 8;
+		bp[2] = 16;
+		break;
+	default:
+		break;
+	}
+	for (i = 0; i < 3; i++) {
+		rgb[i] = (color >> bp[i]) & ((u32) (1 << bw[i]) - 1);
+		fill = bw[i];
+		blank = 8 - fill;
+		rgb[i] <<= blank;
+		while (blank > 0) {
+			rgb[i] |= (rgb[i] >> fill);
+			blank -= fill;
+			fill += fill;
+		}
+	}
+
+	return (rgb[0] << 16) | (rgb[1] << 8) | (rgb[2] << 0);
+}
+
+void nx_mlc_set_format_rgb(u32 module_index, u32 layer,
+			   enum nx_mlc_rgbfmt format)
+{
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 format_mask = 0xffff0000ul;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(format_mask | dirtyflag_mask);
+		regvalue |= (u32) format;
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	}
+}
+
+void nx_mlc_set_format_yuv(u32 module_index, enum nx_mlc_yuvfmt format)
+{
+	const u32 format_mask = 0xffff0000ul;
+	register u32 temp;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = pregister->mlcvideolayer.mlccontrol;
+	temp &= ~format_mask;
+	temp |= (u32) format;
+
+	writel(temp, &pregister->mlcvideolayer.mlccontrol);
+}
+
+void nx_mlc_set_position(u32 module_index, u32 layer, int32_t sx, int32_t sy,
+			 int32_t ex, int32_t ey)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		writel((((u32) sx & 0xffful) << 16) | ((u32) ex & 0xffful),
+		       &pregister->mlcrgblayer[layer].mlcleftright);
+
+		writel((((u32) sy & 0xffful) << 16) | ((u32) ey & 0xffful),
+		       &pregister->mlcrgblayer[layer].mlctopbottom);
+	} else if (2 == layer) {
+		writel((((u32) sx & 0xffful) << 16) | ((u32) ex & 0xffful),
+		       &pregister->mlcrgblayer2.mlcleftright);
+
+		writel((((u32) sy & 0xffful) << 16) | ((u32) ey & 0xffful),
+		       &pregister->mlcrgblayer2.mlctopbottom);
+	} else if (3 == layer) {
+		writel((((u32) sx & 0xffful) << 16) | ((u32) ex & 0xffful),
+		       &pregister->mlcvideolayer.mlcleftright);
+
+		writel((((u32) sy & 0xffful) << 16) | ((u32) ey & 0xffful),
+		       &pregister->mlcvideolayer.mlctopbottom);
+	}
+}
+
+void nx_mlc_set_dither_enable_when_using_gamma(u32 module_index, int benable)
+{
+	const u32 ditherenb_bitpos = 0;
+	const u32 ditherenb_mask = 1 << ditherenb_bitpos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~ditherenb_mask;
+	read_value |= ((u32) benable << ditherenb_bitpos);
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_dither_enable_when_using_gamma(u32 module_index)
+{
+	const u32 ditherenb_bitpos = 0;
+	const u32 ditherenb_mask = 1 << ditherenb_bitpos;
+
+	return (int)(__g_module_variables[module_index].pregister->
+		     mlcgammacont & ditherenb_mask);
+}
+
+void nx_mlc_set_gamma_priority(u32 module_index, int bvideolayer)
+{
+	const u32 alphaselect_bitpos = 5;
+	const u32 alphaselect_mask = 1 << alphaselect_bitpos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~alphaselect_mask;
+	read_value |= ((u32) bvideolayer << alphaselect_bitpos);
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_gamma_priority(u32 module_index)
+{
+	const u32 alphaselect_bitpos = 5;
+	const u32 alphaselect_mask = 1 << alphaselect_bitpos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlcgammacont & alphaselect_mask) >> alphaselect_bitpos);
+}
+
+void nx_mlc_set_rgblayer_invalid_position(u32 module_index, u32 layer,
+					  u32 region, int32_t sx, int32_t sy,
+					  int32_t ex, int32_t ey, int benb)
+{
+	const u32 invalidenb_pos = 28;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		if (0 == region) {
+			writel(((benb << invalidenb_pos) |
+				((sx & 0x7ff) << 16) | (ex & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidleftright0);
+
+			writel((((sy & 0x7ff) << 16) | (ey & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidtopbottom0);
+		} else {
+			writel(((benb << invalidenb_pos) |
+				((sx & 0x7ff) << 16) | (ex & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidleftright1);
+
+			writel((((sy & 0x7ff) << 16) | (ey & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidtopbottom1);
+		}
+	}
+}
+
+void nx_mlc_set_rgblayer_stride(u32 module_index, u32 layer, int32_t hstride,
+				int32_t vstride)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		writel(hstride, &pregister->mlcrgblayer[layer].mlchstride);
+		writel(vstride, &pregister->mlcrgblayer[layer].mlcvstride);
+	} else if (2 == layer) {
+		writel(hstride, &pregister->mlcrgblayer2.mlchstride);
+		writel(vstride, &pregister->mlcrgblayer2.mlcvstride);
+	}
+}
+
+void nx_mlc_set_rgblayer_address(u32 module_index, u32 layer, u32 addr)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer)
+		writel(addr, &pregister->mlcrgblayer[layer].mlcaddress);
+	else if (2 == layer)
+		writel(addr, &pregister->mlcrgblayer2.mlcaddress);
+}
+
+void nx_mlc_set_rgblayer_gama_table_power_mode(u32 module_index, int bred,
+					       int bgreen, int bblue)
+{
+	const u32 bgammatable_pwd_bitpos = 11;
+	const u32 ggammatable_pwd_bitpos = 9;
+	const u32 rgammatable_pwd_bitpos = 3;
+	const u32 bgammatable_pwd_mask = (1 << bgammatable_pwd_bitpos);
+	const u32 ggammatable_pwd_mask = (1 << ggammatable_pwd_bitpos);
+	const u32 rgammatable_pwd_mask = (1 << rgammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~(bgammatable_pwd_mask | ggammatable_pwd_mask |
+			rgammatable_pwd_mask);
+	read_value |= (((u32) bred << rgammatable_pwd_bitpos) |
+		       ((u32) bgreen << ggammatable_pwd_bitpos) |
+		       ((u32) bblue << bgammatable_pwd_bitpos));
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_rgblayer_gama_table_power_mode(u32 module_index, int *pbred,
+					       int *pbgreen, int *pbblue)
+{
+	const u32 bgammatable_pwd_bitpos = 11;
+	const u32 ggammatable_pwd_bitpos = 9;
+	const u32 rgammatable_pwd_bitpos = 3;
+	const u32 bgammatable_pwd_mask = (1 << bgammatable_pwd_bitpos);
+	const u32 ggammatable_pwd_mask = (1 << ggammatable_pwd_bitpos);
+	const u32 rgammatable_pwd_mask = (1 << rgammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (NULL != pbred)
+		*pbred = (read_value & rgammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbgreen)
+		*pbgreen = (read_value & ggammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbblue)
+		*pbblue = (read_value & bgammatable_pwd_mask) ? 1 : 0;
+}
+
+void nx_mlc_set_rgblayer_gama_table_sleep_mode(u32 module_index, int bred,
+					       int bgreen, int bblue)
+{
+	const u32 bgammatable_sld_bitpos = 10;
+	const u32 ggammatable_sld_bitpos = 8;
+	const u32 rgammatable_sld_bitpos = 2;
+	const u32 bgammatable_sld_mask = (1 << bgammatable_sld_bitpos);
+	const u32 ggammatable_sld_mask = (1 << ggammatable_sld_bitpos);
+	const u32 rgammatable_sld_mask = (1 << rgammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (bred)
+		read_value &= ~rgammatable_sld_mask;
+	else
+		read_value |= rgammatable_sld_mask;
+
+	if (bgreen)
+		read_value &= ~ggammatable_sld_mask;
+	else
+		read_value |= ggammatable_sld_mask;
+
+	if (bblue)
+		read_value &= ~bgammatable_sld_mask;
+	else
+		read_value |= bgammatable_sld_mask;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_rgblayer_gama_table_sleep_mode(u32 module_index, int *pbred,
+					       int *pbgreen, int *pbblue)
+{
+	const u32 bgammatable_sld_bitpos = 10;
+	const u32 ggammatable_sld_bitpos = 8;
+	const u32 rgammatable_sld_bitpos = 2;
+	const u32 bgammatable_sld_mask = (1 << bgammatable_sld_bitpos);
+	const u32 ggammatable_sld_mask = (1 << ggammatable_sld_bitpos);
+	const u32 rgammatable_sld_mask = (1 << rgammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+
+	if (NULL != pbred)
+		*pbred = (read_value & rgammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbgreen)
+		*pbgreen = (read_value & ggammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbblue)
+		*pbblue = (read_value & bgammatable_sld_mask) ? 0 : 1;
+}
+
+void nx_mlc_set_rgblayer_rgamma_table(u32 module_index, u32 dwaddress,
+				      u32 dwdata)
+{
+	register struct nx_mlc_register_set *pregister;
+	const u32 tableaddr_bitpos = 24;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dwaddress << tableaddr_bitpos) | dwdata),
+	       &pregister->mlcrgammatablewrite);
+}
+
+void nx_mlc_set_rgblayer_ggamma_table(u32 module_index, u32 dwaddress,
+				      u32 dwdata)
+{
+	register struct nx_mlc_register_set *pregister;
+	const u32 tableaddr_bitpos = 24;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dwaddress << tableaddr_bitpos) | dwdata),
+	       &pregister->mlcggammatablewrite);
+}
+
+void nx_mlc_set_rgblayer_bgamma_table(u32 module_index, u32 dwaddress,
+				      u32 dwdata)
+{
+	register struct nx_mlc_register_set *pregister;
+	const u32 tableaddr_bitpos = 24;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dwaddress << tableaddr_bitpos) | dwdata),
+	       &pregister->mlcbgammatablewrite);
+}
+
+void nx_mlc_set_rgblayer_gamma_enable(u32 module_index, int benable)
+{
+	const u32 rgbgammaemb_bitpos = 1;
+	const u32 rgbgammaemb_mask = 1 << rgbgammaemb_bitpos;
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~rgbgammaemb_mask;
+	read_value |= (u32) benable << rgbgammaemb_bitpos;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_rgblayer_gamma_enable(u32 module_index)
+{
+	const u32 rgbgammaemb_bitpos = 1;
+	const u32 rgbgammaemb_mask = 1 << rgbgammaemb_bitpos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlcgammacont & rgbgammaemb_mask) >> rgbgammaemb_bitpos);
+}
+
+void nx_mlc_set_video_layer_stride(u32 module_index, int32_t lu_stride,
+				   int32_t cb_stride, int32_t cr_stride)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel(lu_stride, &pregister->mlcvideolayer.mlcvstride);
+	writel(cb_stride, &pregister->mlcvideolayer.mlcvstridecb);
+	writel(cr_stride, &pregister->mlcvideolayer.mlcvstridecr);
+}
+
+void nx_mlc_set_video_layer_address(u32 module_index, u32 lu_addr, u32 cb_addr,
+				    u32 cr_addr)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(lu_addr, &pregister->mlcvideolayer.mlcaddress);
+	writel(cb_addr, &pregister->mlcvideolayer.mlcaddresscb);
+	writel(cr_addr, &pregister->mlcvideolayer.mlcaddresscr);
+}
+
+void nx_mlc_set_video_layer_address_yuyv(u32 module_index, u32 addr,
+					 int32_t stride)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(addr, &pregister->mlcvideolayer.mlcaddress);
+	writel(stride, &pregister->mlcvideolayer.mlcvstride);
+}
+
+void nx_mlc_set_video_layer_scale_factor(u32 module_index, u32 hscale,
+					 u32 vscale, int bhlumaenb,
+					 int bhchromaenb, int bvlumaenb,
+					 int bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 scale_mask = ((1 << 23) - 1);
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel(((bhlumaenb << filter_luma_pos) |
+		(bhchromaenb << filter_choma_pos) | (hscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlchscale);
+
+	writel(((bvlumaenb << filter_luma_pos) |
+		(bvchromaenb << filter_choma_pos) | (vscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_video_layer_scale_filter(u32 module_index, int bhlumaenb,
+					 int bhchromaenb, int bvlumaenb,
+					 int bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 scale_mask = ((1 << 23) - 1);
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcvideolayer.mlchscale;
+	read_value &= scale_mask;
+	read_value |=
+	    (bhlumaenb << filter_luma_pos) | (bhchromaenb << filter_choma_pos);
+
+	writel(read_value, &pregister->mlcvideolayer.mlchscale);
+	read_value = pregister->mlcvideolayer.mlcvscale;
+	read_value &= scale_mask;
+	read_value |=
+	    (bvlumaenb << filter_luma_pos) | (bvchromaenb << filter_choma_pos);
+
+	writel(read_value, &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_get_video_layer_scale_filter(u32 module_index, int *bhlumaenb,
+					 int *bhchromaenb, int *bvlumaenb,
+					 int *bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 filter_mask = 1ul;
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcvideolayer.mlchscale;
+	*bhlumaenb = (read_value >> filter_luma_pos) & filter_mask;
+	*bhchromaenb = (read_value >> filter_choma_pos) & filter_mask;
+	read_value = pregister->mlcvideolayer.mlcvscale;
+	*bvlumaenb = (read_value >> filter_luma_pos) & filter_mask;
+	*bvchromaenb = (read_value >> filter_choma_pos) & filter_mask;
+}
+
+void nx_mlc_set_video_layer_scale(u32 module_index, u32 sw, u32 sh, u32 dw,
+				  u32 dh, int bhlumaenb, int bhchromaenb,
+				  int bvlumaenb, int bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 scale_mask = ((1 << 23) - 1);
+	register u32 hscale, vscale, cal_sh;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	if ((bhlumaenb || bhchromaenb) && (dw > sw)) {
+		sw--;
+		dw--;
+	}
+	hscale = (sw << 11) / dw;
+
+	if ((bvlumaenb || bvchromaenb) && (dh > sh)) {
+		sh--;
+		dh--;
+		vscale = (sh << 11) / dh;
+
+		cal_sh = ((vscale * dh) >> 11);
+		if (sh <= cal_sh)
+			vscale--;
+
+	} else {
+		vscale = (sh << 11) / dh;
+	}
+
+	writel(((bhlumaenb << filter_luma_pos) |
+		(bhchromaenb << filter_choma_pos) | (hscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlchscale);
+
+	writel(((bvlumaenb << filter_luma_pos) |
+		(bvchromaenb << filter_choma_pos) | (vscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_video_layer_luma_enhance(u32 module_index, u32 contrast,
+					 int32_t brightness)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((((u32) brightness & 0xfful) << 8) | contrast,
+	       &pregister->mlcvideolayer.mlcluenh);
+}
+
+void nx_mlc_set_video_layer_chroma_enhance(u32 module_index, u32 quadrant,
+					   int32_t cb_a, int32_t cb_b,
+					   int32_t cr_a, int32_t cr_b)
+{
+	register struct nx_mlc_register_set *pregister;
+	register u32 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = (((u32) cr_b & 0xfful) << 24) | (((u32) cr_a & 0xfful) << 16) |
+	    (((u32) cb_b & 0xfful) << 8) | (((u32) cb_a & 0xfful) << 0);
+	if (0 < quadrant) {
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[quadrant - 1]);
+	} else {
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[0]);
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[1]);
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[2]);
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[3]);
+	}
+}
+
+void nx_mlc_set_video_layer_line_buffer_power_mode(u32 module_index,
+						   int benable)
+{
+	const u32 linebuff_pwd_pos = 15;
+	const u32 linebuff_pwd_mask = 1ul << linebuff_pwd_pos;
+	const u32 dirtyflag_mask = 1ul << 4;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlcvideolayer.mlccontrol;
+	regvalue &= ~(linebuff_pwd_mask | dirtyflag_mask);
+	regvalue |= ((u32) benable << linebuff_pwd_pos);
+
+	writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+}
+
+int nx_mlc_get_video_layer_line_buffer_power_mode(u32 module_index)
+{
+	const u32 linebuff_pwd_pos = 15;
+	const u32 linebuff_pwd_mask = 1ul << linebuff_pwd_pos;
+
+	return (int)((__g_module_variables[module_index]
+		      .pregister->mlcvideolayer.mlccontrol &
+		      linebuff_pwd_mask) >> linebuff_pwd_pos);
+}
+
+void nx_mlc_set_video_layer_line_buffer_sleep_mode(u32 module_index,
+						   int benable)
+{
+	const u32 linebuff_slmd_pos = 14;
+	const u32 linebuff_slmd_mask = 1ul << linebuff_slmd_pos;
+	const u32 dirtyflag_mask = 1ul << 4;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	benable = (int)((u32) benable ^ 1);
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlcvideolayer.mlccontrol;
+	regvalue &= ~(linebuff_slmd_mask | dirtyflag_mask);
+	regvalue |= (benable << linebuff_slmd_pos);
+
+	writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+}
+
+int nx_mlc_get_video_layer_line_buffer_sleep_mode(u32 module_index)
+{
+	const u32 linebuff_slmd_pos = 14;
+	const u32 linebuff_slmd_mask = 1ul << linebuff_slmd_pos;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (linebuff_slmd_mask & pregister->mlcvideolayer.mlccontrol)
+		return 0;
+	else
+		return 1;
+}
+
+void nx_mlc_set_video_layer_gama_table_power_mode(u32 module_index, int by,
+						  int bu, int bv)
+{
+	const u32 vgammatable_pwd_bitpos = 17;
+	const u32 ugammatable_pwd_bitpos = 15;
+	const u32 ygammatable_pwd_bitpos = 13;
+	const u32 vgammatable_pwd_mask = (1 << vgammatable_pwd_bitpos);
+	const u32 ugammatable_pwd_mask = (1 << ugammatable_pwd_bitpos);
+	const u32 ygammatable_pwd_mask = (1 << ygammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~(ygammatable_pwd_mask | ugammatable_pwd_mask |
+			vgammatable_pwd_mask);
+	read_value |= (((u32) by << ygammatable_pwd_bitpos) |
+		       ((u32) bu << ugammatable_pwd_bitpos) |
+		       ((u32) bv << vgammatable_pwd_bitpos));
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_video_layer_gama_table_power_mode(u32 module_index, int *pby,
+						  int *pbu, int *pbv)
+{
+	const u32 vgammatable_pwd_bitpos = 17;
+	const u32 ugammatable_pwd_bitpos = 15;
+	const u32 ygammatable_pwd_bitpos = 13;
+	const u32 vgammatable_pwd_mask = (1 << vgammatable_pwd_bitpos);
+	const u32 ugammatable_pwd_mask = (1 << ugammatable_pwd_bitpos);
+	const u32 ygammatable_pwd_mask = (1 << ygammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (NULL != pby)
+		*pby = (read_value & ygammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbu)
+		*pbu = (read_value & ugammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbv)
+		*pbv = (read_value & vgammatable_pwd_mask) ? 1 : 0;
+}
+
+void nx_mlc_set_video_layer_gama_table_sleep_mode(u32 module_index, int by,
+						  int bu, int bv)
+{
+	const u32 vgammatable_sld_bitpos = 16;
+	const u32 ugammatable_sld_bitpos = 14;
+	const u32 ygammatable_sld_bitpos = 12;
+	const u32 vgammatable_sld_mask = (1 << vgammatable_sld_bitpos);
+	const u32 ugammatable_sld_mask = (1 << ugammatable_sld_bitpos);
+	const u32 ygammatable_sld_mask = (1 << ygammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (by)
+		read_value &= ~ygammatable_sld_mask;
+	else
+		read_value |= ygammatable_sld_mask;
+
+	if (bu)
+		read_value &= ~ugammatable_sld_mask;
+	else
+		read_value |= ugammatable_sld_mask;
+
+	if (bv)
+		read_value &= ~vgammatable_sld_mask;
+	else
+		read_value |= vgammatable_sld_mask;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_video_layer_gama_table_sleep_mode(u32 module_index, int *pby,
+						  int *pbu, int *pbv)
+{
+	const u32 vgammatable_sld_bitpos = 16;
+	const u32 ugammatable_sld_bitpos = 14;
+	const u32 ygammatable_sld_bitpos = 12;
+	const u32 vgammatable_sld_mask = (1 << vgammatable_sld_bitpos);
+	const u32 ugammatable_sld_mask = (1 << ugammatable_sld_bitpos);
+	const u32 ygammatable_sld_mask = (1 << ygammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+
+	if (NULL != pby)
+		*pby = (read_value & vgammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbu)
+		*pbu = (read_value & ugammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbv)
+		*pbv = (read_value & ygammatable_sld_mask) ? 0 : 1;
+}
+
+void nx_mlc_set_video_layer_gamma_enable(u32 module_index, int benable)
+{
+	const u32 yuvgammaemb_bitpos = 4;
+	const u32 yuvgammaemb_mask = 1 << yuvgammaemb_bitpos;
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~yuvgammaemb_mask;
+	read_value |= (u32) benable << yuvgammaemb_bitpos;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_video_layer_gamma_enable(u32 module_index)
+{
+	const u32 yuvgammaemb_bitpos = 4;
+	const u32 yuvgammaemb_mask = 1 << yuvgammaemb_bitpos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlcgammacont & yuvgammaemb_mask) >> yuvgammaemb_bitpos);
+}
+
+void nx_mlc_set_gamma_table_poweroff(u32 module_index, int enb)
+{
+	register struct nx_mlc_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (enb == 1) {
+		regvalue = pregister->mlcgammacont;
+		regvalue = regvalue & 0xf3;
+		writel(regvalue, &pregister->mlcgammacont);
+	}
+}
+
+void nx_mlc_set_mlctop_control_parameter(u32 module_index, int field_enable,
+					 int mlcenable, u8 priority,
+					 enum g3daddrchangeallowed
+					 g3daddr_change_allowed)
+{
+	register u32 mlctopcontrolreg;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	mlctopcontrolreg = (readl(&pregister->mlccontrolt)) & 0xfffffcfc;
+	mlctopcontrolreg = (u32) (mlctopcontrolreg |
+				  ((priority << 8) | ((1 == mlcenable) << 1) |
+				   (1 ==
+				    field_enable)) | (g3daddr_change_allowed <<
+						      12));
+	writel(mlctopcontrolreg, &pregister->mlccontrolt);
+}
+
+void nx_mlc_set_rgb0layer_control_parameter(u32 module_index, int layer_enable,
+					    int grp3denable, int tp_enable,
+					    u32 transparency_color,
+					    int inv_enable, u32 inverse_color,
+					    int blend_enable, u8 alpha_value,
+					    enum mlc_rgbfmt rbgformat,
+					    enum locksizesel lock_size_select)
+{
+	u32 layer_format;
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 lock_size = (u32) (lock_size_select & 0x3);
+	u32 rgb0controlreg;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	layer_format = nx_mlc_get_rgbformat(rbgformat);
+	pregister = __g_module_variables[module_index].pregister;
+	control_enb =
+	    (u32) ((grp3denable << 8) | (layer_enable << 5) |
+		   (blend_enable << 2) | (inv_enable << 1) | tp_enable) & 0x127;
+	alpha_argument = (u32) (alpha_value & 0xf);
+
+	rgb0controlreg = readl(&pregister->mlcrgblayer[0].mlccontrol) & 0x10;
+	regvalue =
+	    (u32) (((layer_format << 16) | control_enb | (lock_size << 12)) |
+		   rgb0controlreg);
+	writel(regvalue, &pregister->mlcrgblayer[0].mlccontrol);
+
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcrgblayer[0].mlctpcolor);
+	regvalue = inverse_color;
+	writel(regvalue, &pregister->mlcrgblayer[0].mlcinvcolor);
+}
+
+u32 nx_mlc_get_rgbformat(enum mlc_rgbfmt rbgformat)
+{
+	u32 rgbformatvalue;
+	const u32 format_table[] = {
+		0x4432ul, 0x4342ul, 0x4211ul, 0x4120ul, 0x4003ul, 0x4554ul,
+		0x3342ul, 0x2211ul, 0x1120ul, 0x1003ul, 0x4653ul, 0x4653ul,
+		0x0653ul, 0x4ed3ul, 0x4f84ul, 0xc432ul, 0xc342ul, 0xc211ul,
+		0xc120ul, 0xb342ul, 0xa211ul, 0x9120ul, 0xc653ul, 0xc653ul,
+		0x8653ul, 0xced3ul, 0xcf84ul, 0x443aul
+	};
+
+	return rgbformatvalue = format_table[rbgformat];
+}
+
+void nx_mlc_set_rgb1layer_control_parameter(u32 module_index, int layer_enable,
+					    int grp3denable, int tp_enable,
+					    u32 transparency_color,
+					    int inv_enable, u32 inverse_color,
+					    int blend_enable, u8 alpha_value,
+					    enum mlc_rgbfmt rbgformat,
+					    enum locksizesel lock_size_select)
+{
+	u32 layer_format;
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 lock_size = (u32) (lock_size_select & 0x3);
+	u32 rgb0controlreg;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	layer_format = nx_mlc_get_rgbformat(rbgformat);
+	pregister = __g_module_variables[module_index].pregister;
+
+	rgb0controlreg = readl(&pregister->mlcrgblayer[1].mlccontrol) & 0x10;
+	control_enb =
+	    (u32) ((grp3denable << 8) | (layer_enable << 5) |
+		   (blend_enable << 2) | (inv_enable << 1) | tp_enable) & 0x127;
+	alpha_argument = (u32) (alpha_value & 0xf);
+	regvalue =
+	    (u32) (((layer_format << 16) | control_enb | (lock_size << 12)) |
+		   rgb0controlreg);
+	writel(regvalue, &pregister->mlcrgblayer[1].mlccontrol);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcrgblayer[1].mlctpcolor);
+	regvalue = inverse_color;
+	writel(regvalue, &pregister->mlcrgblayer[1].mlcinvcolor);
+}
+
+void nx_mlc_set_rgb2layer_control_parameter(u32 module_index, int layer_enable,
+					    int grp3denable, int tp_enable,
+					    u32 transparency_color,
+					    int inv_enable, u32 inverse_color,
+					    int blend_enable, u8 alpha_value,
+					    enum mlc_rgbfmt rbgformat,
+					    enum locksizesel lock_size_select)
+{
+	u32 layer_format;
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 lock_size = (u32) (lock_size_select & 0x3);
+	u32 rgb0controlreg;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	layer_format = nx_mlc_get_rgbformat(rbgformat);
+	pregister = __g_module_variables[module_index].pregister;
+
+	rgb0controlreg = readl(&pregister->mlcrgblayer2.mlccontrol) & 0x10;
+	control_enb =
+	    (u32) ((grp3denable << 8) | (layer_enable << 5) |
+		   (blend_enable << 2) | (inv_enable << 1) | tp_enable) & 0x127;
+	alpha_argument = (u32) (alpha_value & 0xf);
+	regvalue =
+	    (u32) (((layer_format << 16) | control_enb | (lock_size << 12)) |
+		   rgb0controlreg);
+	writel(regvalue, &pregister->mlcrgblayer2.mlccontrol);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcrgblayer2.mlctpcolor);
+	regvalue = inverse_color;
+	writel(regvalue, &pregister->mlcrgblayer2.mlcinvcolor);
+}
+
+void nx_mlc_set_video_layer_control_parameter(u32 module_index,
+					      int layer_enable, int tp_enable,
+					      u32 transparency_color,
+					      int inv_enable, u32 inverse_color,
+					      int blend_enable, u8 alpha_value,
+					      enum nx_mlc_yuvfmt yuvformat)
+{
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+	u32 video_control_reg;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	video_control_reg = readl(&pregister->mlcvideolayer.mlccontrol);
+	control_enb =
+	    (u32) ((yuvformat) | (layer_enable << 5) | (blend_enable << 2) |
+		   (inv_enable << 1) | tp_enable) & 0x30027;
+	alpha_argument = (u32) (alpha_value & 0xf);
+	regvalue = (u32) (control_enb | video_control_reg);
+	writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcvideolayer.mlctpcolor);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcvideolayer.mlcinvcolor);
+}
+
+void nx_mlc_set_srammode(u32 module_index, enum latyername layer_name,
+			 enum srammode sram_mode)
+{
+	u32 control_reg_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	switch (layer_name) {
+	case topmlc:
+		control_reg_value = readl(&pregister->mlccontrolt);
+		writel((u32) (control_reg_value | (sram_mode << 10)),
+		       &pregister->mlccontrolt);
+		control_reg_value = 0;
+		break;
+	case rgb0:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[0].mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcrgblayer[0].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb1:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[1].mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcrgblayer[1].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb2:
+		control_reg_value = readl(&pregister->mlcrgblayer2.mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcrgblayer2.mlccontrol);
+		control_reg_value = 0;
+		break;
+	case video:
+		control_reg_value = readl(&pregister->mlcvideolayer.mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcvideolayer.mlccontrol);
+		control_reg_value = 0;
+		break;
+	default:
+		break;
+	}
+}
+
+void nx_mlc_set_layer_reg_finish(u32 module_index, enum latyername layer_name)
+{
+	u32 control_reg_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	switch (layer_name) {
+	case topmlc:
+		control_reg_value = readl(&pregister->mlccontrolt);
+		writel((u32) (control_reg_value | (1ul << 3)),
+		       &pregister->mlccontrolt);
+		control_reg_value = 0;
+		break;
+	case rgb0:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[0].mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcrgblayer[0].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb1:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[1].mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcrgblayer[1].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb2:
+		control_reg_value = readl(&pregister->mlcrgblayer2.mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcrgblayer2.mlccontrol);
+		control_reg_value = 0;
+		break;
+	case video:
+		control_reg_value = readl(&pregister->mlcvideolayer.mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcvideolayer.mlccontrol);
+		control_reg_value = 0;
+		break;
+	default:
+		break;
+	}
+}
+
+void nx_mlc_set_video_layer_coordinate(u32 module_index, int vfilterenable,
+				       int hfilterenable, int vfilterenable_c,
+				       int hfilterenable_c,
+				       u16 video_layer_with,
+				       u16 video_layer_height, int16_t left,
+				       int16_t right, int16_t top,
+				       int16_t bottom)
+{
+	int32_t source_width, source_height;
+	int32_t destination_width;
+	int32_t destination_height;
+	int32_t hscale, vscale;
+	int32_t hfilterenb, vfilterenb;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((int32_t) (((left & 0x0fff) << 16) | (right & 0x0fff)),
+	       &pregister->mlcvideolayer.mlcleftright);
+	writel((int32_t) (((top & 0x0fff) << 16) | (bottom & 0x0fff)),
+	       &pregister->mlcvideolayer.mlctopbottom);
+	source_width = (int32_t) (video_layer_with - 1);
+	source_height = (int32_t) (video_layer_height - 1);
+	destination_width = (int32_t) (right - left);
+	destination_height = (int32_t) (bottom - top);
+
+	hscale =
+	    (int32_t) ((source_width * (1ul << 11) + (destination_width / 2)) /
+		       destination_width);
+	vscale =
+	    (int32_t) ((source_height * (1ul << 11) +
+			(destination_height / 2)) / destination_height);
+
+	hfilterenb = (u32) (((hfilterenable_c << 29) | (hfilterenable) << 28)) &
+	    0x30000000;
+	vfilterenb = (u32) (((vfilterenable_c << 29) | (vfilterenable) << 28)) &
+	    0x30000000;
+	writel((u32) (hfilterenb | (hscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlchscale);
+	writel((u32) (vfilterenb | (vscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_video_layer_filter_scale(u32 module_index, u32 hscale,
+					 u32 vscale)
+{
+	register struct nx_mlc_register_set *pregister;
+	u32 mlchscale = 0;
+	u32 mlcvscale = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+	mlchscale = readl(&pregister->mlcvideolayer.mlchscale) & (~0x00ffffff);
+	mlcvscale = readl(&pregister->mlcvideolayer.mlcvscale) & (~0x00ffffff);
+
+	writel((u32) (mlchscale | (hscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlchscale);
+	writel((u32) (mlcvscale | (vscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_gamma_control_parameter(u32 module_index, int rgbgammaenb,
+					int yuvgammaenb, int yuvalphaarray,
+					int dither_enb)
+{
+	u32 register_data;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	register_data = readl(&pregister->mlcgammacont);
+	register_data = (register_data & 0xf0c) |
+	    ((yuvalphaarray << 5) | (yuvgammaenb << 4) |
+	     (rgbgammaenb << 1) | (dither_enb << 0));
+	writel(register_data, &pregister->mlcgammacont);
+}
+
+void nx_mlc_set_layer_alpha256(u32 module_index, u32 layer, u32 alpha)
+{
+	u32 register_data;
+	register struct nx_mlc_register_set *pregister;
+
+	if (alpha < 0)
+		alpha = 0;
+	if (alpha > 255)
+		alpha = 255;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (layer == 0) {
+		register_data =
+		    readl(&pregister->mlcrgblayer[0].mlctpcolor) & 0x00ffffff;
+		register_data = register_data | (alpha << 24);
+		writel(register_data, &pregister->mlcrgblayer[0].mlctpcolor);
+	} else if (layer == 1) {
+		register_data =
+		    readl(&pregister->mlcrgblayer[1].mlctpcolor) & 0x00ffffff;
+		register_data = register_data | (alpha << 24);
+		writel(register_data, &pregister->mlcrgblayer[1].mlctpcolor);
+	} else if (layer == 2) {
+		register_data =
+		    readl(&pregister->mlcrgblayer[1].mlctpcolor) & 0x00ffffff;
+		register_data = register_data | (alpha << 24);
+		writel(register_data, &pregister->mlcrgblayer2.mlctpcolor);
+	} else {
+		register_data =
+		    readl(&pregister->mlcvideolayer.mlctpcolor) & 0x00ffffff;
+		register_data = register_data | (alpha << 24);
+		writel(register_data, &pregister->mlcvideolayer.mlctpcolor);
+	}
+}
+
+int nx_mlc_is_under_flow(u32 module_index)
+{
+	const u32 underflow_pend_pos = 31;
+	const u32 underflow_pend_mask = 1ul << underflow_pend_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlccontrolt & underflow_pend_mask) >> underflow_pend_pos);
+}
+
+void nx_mlc_set_gamma_table(u32 module_index, int enb,
+		struct nx_mlc_gamma_table_parameter *p_gammatable)
+{
+	register struct nx_mlc_register_set *pregister;
+	u32 i, regval = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (enb == 1) {
+		regval = readl(&pregister->mlcgammacont);
+
+		regval = (1 << 11) | (1 << 9) | (1 << 3);
+		writel(regval, &pregister->mlcgammacont);
+
+		regval = regval | (1 << 10) | (1 << 8) | (1 << 2);
+		writel(regval, &pregister->mlcgammacont);
+
+		for (i = 0; i < 256; i++) {
+			nx_mlc_set_rgblayer_rgamma_table(
+				module_index, i, p_gammatable->r_table[i]);
+			nx_mlc_set_rgblayer_ggamma_table(
+				module_index, i, p_gammatable->g_table[i]);
+			nx_mlc_set_rgblayer_bgamma_table(
+				module_index, i, p_gammatable->b_table[i]);
+		}
+
+		regval = regval | (p_gammatable->alphaselect << 5) |
+		    (p_gammatable->yuvgammaenb << 4 |
+		     p_gammatable->allgammaenb << 4) |
+		    (p_gammatable->rgbgammaenb << 1 |
+		     p_gammatable->allgammaenb << 1) |
+		    (p_gammatable->ditherenb << 1);
+		writel(regval, &pregister->mlcgammacont);
+	} else {
+		regval = regval & ~(1 << 10) & ~(1 << 8) & ~(1 << 2);
+		writel(regval, &pregister->mlcgammacont);
+
+		regval = regval & ~(1 << 11) & ~(1 << 9) & ~(1 << 3);
+		writel(regval, &pregister->mlcgammacont);
+	}
+}
+
+void nx_mlc_get_rgblayer_stride(u32 module_index, u32 layer, int32_t *hstride,
+				int32_t *vstride)
+{
+	unsigned int hs, vs;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	hs = readl(&pregister->mlcrgblayer[layer].mlchstride);
+	vs = readl(&pregister->mlcrgblayer[layer].mlcvstride);
+
+	if (hstride)
+		*(int32_t *)hstride = hs;
+
+	if (vstride)
+		*(int32_t *)vstride = vs;
+}
+
+void nx_mlc_get_rgblayer_address(u32 module_index, u32 layer,
+				 u32 *phys_address)
+{
+	u32 pa;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	pa = readl(&pregister->mlcrgblayer[layer].mlcaddress);
+
+	if (phys_address)
+		*(u32 *)phys_address = pa;
+}
+
+void nx_mlc_get_position(u32 module_index, u32 layer, int *left, int *top,
+			 int *right, int *bottom)
+{
+	int lr, tb;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lr = readl(&pregister->mlcrgblayer[layer].mlcleftright);
+	tb = readl(&pregister->mlcrgblayer[layer].mlctopbottom);
+
+	if (left)
+		*(int *)left = ((lr >> 16) & 0xFFUL);
+
+	if (top)
+		*(int *)top = ((tb >> 16) & 0xFFUL);
+
+	if (right)
+		*(int *)right = ((lr >> 0) & 0xFFUL);
+
+	if (bottom)
+		*(int *)bottom = ((tb >> 0) & 0xFFUL);
+}
+
+void nx_mlc_get_video_layer_address_yuyv(u32 module_index, u32 *address,
+					 u32 *stride)
+{
+	u32 a, s;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	a = readl(&pregister->mlcvideolayer.mlcaddress);
+	s = readl(&pregister->mlcvideolayer.mlcvstride);
+
+	if (address)
+		*(u32 *)address = a;
+
+	if (stride)
+		*(u32 *)stride = s;
+}
+
+void nx_mlc_get_video_layer_address(u32 module_index, u32 *lu_address,
+				    u32 *cb_address, u32 *cr_address)
+{
+	u32 lua, cba, cra;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lua = readl(&pregister->mlcvideolayer.mlcaddress);
+	cba = readl(&pregister->mlcvideolayer.mlcaddresscb);
+	cra = readl(&pregister->mlcvideolayer.mlcaddresscr);
+
+	if (lu_address)
+		*(u32 *)lu_address = lua;
+
+	if (cb_address)
+		*(u32 *)cb_address = cba;
+
+	if (cr_address)
+		*(u32 *)cr_address = cra;
+}
+
+void nx_mlc_get_video_layer_stride(u32 module_index, u32 *lu_stride,
+				   u32 *cb_stride, u32 *cr_stride)
+{
+	u32 lus, cbs, crs;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lus = readl(&pregister->mlcvideolayer.mlcvstride);
+	cbs = readl(&pregister->mlcvideolayer.mlcvstridecb);
+	crs = readl(&pregister->mlcvideolayer.mlcvstridecr);
+
+	if (lu_stride)
+		*(u32 *)lu_stride = lus;
+
+	if (cb_stride)
+		*(u32 *)cb_stride = cbs;
+
+	if (cr_stride)
+		*(u32 *)cr_stride = crs;
+}
+
+void nx_mlc_get_video_position(u32 module_index, int *left, int *top,
+			       int *right, int *bottom)
+{
+	int lr, tb;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lr = readl(&pregister->mlcvideolayer.mlcleftright);
+	tb = readl(&pregister->mlcvideolayer.mlctopbottom);
+
+	if (left)
+		*(int *)left = ((lr >> 16) & 0xFFUL);
+
+	if (top)
+		*(int *)top = ((tb >> 16) & 0xFFUL);
+
+	if (right)
+		*(int *)right = ((lr >> 0) & 0xFFUL);
+
+	if (bottom)
+		*(int *)bottom = ((tb >> 0) & 0xFFUL);
+}
diff -ENwbur a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.h b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.h
--- a/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/nexell/soc/s5pxx18_soc_mlc.h	2018-05-06 08:49:49.570711325 +0200
@@ -0,0 +1,439 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_MLC_H_
+#define _S5PXX18_SOC_MLC_H_
+
+#include "s5pxx18_soc_disp.h"
+
+#define NUMBER_OF_MLC_MODULE 2
+#define PHY_BASEADDR_MLC0	0xC0102000
+#define PHY_BASEADDR_MLC1	0xC0102400
+
+#define	PHY_BASEADDR_MLC_LIST	\
+		{ PHY_BASEADDR_MLC0, PHY_BASEADDR_MLC1 }
+
+struct nx_mlc_register_set {
+	u32 mlccontrolt;
+	u32 mlcscreensize;
+	u32 mlcbgcolor;
+	struct {
+		u32 mlcleftright;
+		u32 mlctopbottom;
+		u32 mlcinvalidleftright0;
+		u32 mlcinvalidtopbottom0;
+		u32 mlcinvalidleftright1;
+		u32 mlcinvalidtopbottom1;
+		u32 mlccontrol;
+		int32_t mlchstride;
+		int32_t mlcvstride;
+		u32 mlctpcolor;
+		u32 mlcinvcolor;
+		u32 mlcaddress;
+		u32 __reserved0;
+	} mlcrgblayer[2];
+	struct {
+		u32 mlcleftright;
+		u32 mlctopbottom;
+		u32 mlccontrol;
+		u32 mlcvstride;
+		u32 mlctpcolor;
+
+		u32 mlcinvcolor;
+		u32 mlcaddress;
+		u32 mlcaddresscb;
+		u32 mlcaddresscr;
+		int32_t mlcvstridecb;
+		int32_t mlcvstridecr;
+		u32 mlchscale;
+		u32 mlcvscale;
+		u32 mlcluenh;
+		u32 mlcchenh[4];
+	} mlcvideolayer;
+	struct {
+		u32 mlcleftright;
+		u32 mlctopbottom;
+		u32 mlcinvalidleftright0;
+		u32 mlcinvalidtopbottom0;
+		u32 mlcinvalidleftright1;
+		u32 mlcinvalidtopbottom1;
+		u32 mlccontrol;
+		int32_t mlchstride;
+		int32_t mlcvstride;
+		u32 mlctpcolor;
+		u32 mlcinvcolor;
+		u32 mlcaddress;
+	} mlcrgblayer2;
+	u32 mlcpaletetable2;
+	u32 mlcgammacont;
+	u32 mlcrgammatablewrite;
+	u32 mlcggammatablewrite;
+	u32 mlcbgammatablewrite;
+	u32 yuvlayergammatable_red;
+	u32 yuvlayergammatable_green;
+	u32 yuvlayergammatable_blue;
+
+	u32 dimctrl;
+	u32 dimlut0;
+	u32 dimlut1;
+	u32 dimbusyflag;
+	u32 dimprdarrr0;
+	u32 dimprdarrr1;
+	u32 dimram0rddata;
+	u32 dimram1rddata;
+	u32 __reserved2[(0x3c0 - 0x12c) / 4];
+	u32 mlcclkenb;
+};
+
+enum nx_mlc_priority {
+	nx_mlc_priority_videofirst = 0ul,
+	nx_mlc_priority_videosecond = 1ul,
+	nx_mlc_priority_videothird = 2ul,
+	nx_mlc_priority_videofourth = 3ul
+};
+
+enum nx_mlc_rgbfmt {
+	nx_mlc_rgbfmt_r5g6b5 = 0x44320000ul,
+	nx_mlc_rgbfmt_b5g6r5 = 0xc4320000ul,
+	nx_mlc_rgbfmt_x1r5g5b5 = 0x43420000ul,
+	nx_mlc_rgbfmt_x1b5g5r5 = 0xc3420000ul,
+	nx_mlc_rgbfmt_x4r4g4b4 = 0x42110000ul,
+	nx_mlc_rgbfmt_x4b4g4r4 = 0xc2110000ul,
+	nx_mlc_rgbfmt_x8r3g3b2 = 0x41200000ul,
+	nx_mlc_rgbfmt_x8b3g3r2 = 0xc1200000ul,
+	nx_mlc_rgbfmt_a1r5g5b5 = 0x33420000ul,
+	nx_mlc_rgbfmt_a1b5g5r5 = 0xb3420000ul,
+	nx_mlc_rgbfmt_a4r4g4b4 = 0x22110000ul,
+	nx_mlc_rgbfmt_a4b4g4r4 = 0xa2110000ul,
+	nx_mlc_rgbfmt_a8r3g3b2 = 0x11200000ul,
+	nx_mlc_rgbfmt_a8b3g3r2 = 0x91200000ul,
+	nx_mlc_rgbfmt_r8g8b8 = 0x46530000ul,
+	nx_mlc_rgbfmt_b8g8r8 = 0xc6530000ul,
+	nx_mlc_rgbfmt_x8r8g8b8 = 0x46530000ul,
+	nx_mlc_rgbfmt_x8b8g8r8 = 0xc6530000ul,
+	nx_mlc_rgbfmt_a8r8g8b8 = 0x06530000ul,
+	nx_mlc_rgbfmt_a8b8g8r8 = 0x86530000ul
+};
+
+enum nx_mlc_yuvfmt {
+	nx_mlc_yuvfmt_420 = 0ul << 16,
+	nx_mlc_yuvfmt_422 = 1ul << 16,
+	nx_mlc_yuvfmt_444 = 3ul << 16,
+	nx_mlc_yuvfmt_yuyv = 2ul << 16,
+	nx_mlc_yuvfmt_422_cbcr = 4ul << 16,
+	nx_mlc_yuvfmt_420_cbcr = 5ul << 16,
+};
+
+#ifdef __arm
+#pragma diag_default 66
+#endif
+
+int nx_mlc_initialize(void);
+u32 nx_mlc_get_number_of_module(void);
+u32 nx_mlc_get_physical_address(u32 module_index);
+u32 nx_mlc_get_size_of_register_set(void);
+void nx_mlc_set_base_address(u32 module_index, void *base_address);
+void *nx_mlc_get_base_address(u32 module_index);
+int nx_mlc_open_module(u32 module_index);
+int nx_mlc_close_module(u32 module_index);
+int nx_mlc_check_busy(u32 module_index);
+int nx_mlc_can_power_down(u32 module_index);
+void nx_mlc_set_clock_pclk_mode(u32 module_index, enum nx_pclkmode mode);
+enum nx_pclkmode nx_mlc_get_clock_pclk_mode(u32 module_index);
+void nx_mlc_set_clock_bclk_mode(u32 module_index, enum nx_bclkmode mode);
+enum nx_bclkmode nx_mlc_get_clock_bclk_mode(u32 module_index);
+
+void nx_mlc_set_top_power_mode(u32 module_index, int bpower);
+int nx_mlc_get_top_power_mode(u32 module_index);
+void nx_mlc_set_top_sleep_mode(u32 module_index, int bsleep);
+int nx_mlc_get_top_sleep_mode(u32 module_index);
+void nx_mlc_set_top_dirty_flag(u32 module_index);
+int nx_mlc_get_top_dirty_flag(u32 module_index);
+void nx_mlc_set_mlc_enable(u32 module_index, int benb);
+int nx_mlc_get_mlc_enable(u32 module_index);
+void nx_mlc_set_field_enable(u32 module_index, int benb);
+int nx_mlc_get_field_enable(u32 module_index);
+void nx_mlc_set_layer_priority(u32 module_index,
+				      enum nx_mlc_priority priority);
+void nx_mlc_set_screen_size(u32 module_index, u32 width, u32 height);
+void nx_mlc_get_screen_size(u32 module_index, u32 *pwidth,
+				   u32 *pheight);
+void nx_mlc_set_background(u32 module_index, u32 color);
+
+void nx_mlc_set_dirty_flag(u32 module_index, u32 layer);
+int nx_mlc_get_dirty_flag(u32 module_index, u32 layer);
+void nx_mlc_set_layer_enable(u32 module_index, u32 layer, int benb);
+int nx_mlc_get_layer_enable(u32 module_index, u32 layer);
+void nx_mlc_set_lock_size(u32 module_index, u32 layer, u32 locksize);
+void nx_mlc_set_alpha_blending(u32 module_index, u32 layer, int benb,
+				      u32 alpha);
+void nx_mlc_set_transparency(u32 module_index, u32 layer, int benb,
+				    u32 color);
+void nx_mlc_set_color_inversion(u32 module_index, u32 layer, int benb,
+				       u32 color);
+u32 nx_mlc_get_extended_color(u32 module_index, u32 color,
+				     enum nx_mlc_rgbfmt format);
+void nx_mlc_set_format_rgb(u32 module_index, u32 layer,
+				  enum nx_mlc_rgbfmt format);
+void nx_mlc_set_format_yuv(u32 module_index, enum nx_mlc_yuvfmt format);
+void nx_mlc_set_position(u32 module_index, u32 layer, int32_t sx,
+				int32_t sy, int32_t ex, int32_t ey);
+void nx_mlc_set_dither_enable_when_using_gamma(u32 module_index,
+						      int benable);
+int nx_mlc_get_dither_enable_when_using_gamma(u32 module_index);
+void nx_mlc_set_gamma_priority(u32 module_index, int bvideolayer);
+int nx_mlc_get_gamma_priority(u32 module_index);
+
+void nx_mlc_set_rgblayer_invalid_position(u32 module_index, u32 layer,
+						 u32 region, int32_t sx,
+						 int32_t sy, int32_t ex,
+						 int32_t ey, int benb);
+void nx_mlc_set_rgblayer_stride(u32 module_index, u32 layer,
+				       int32_t hstride, int32_t vstride);
+void nx_mlc_set_rgblayer_address(u32 module_index, u32 layer, u32 addr);
+void nx_mlc_set_rgblayer_gama_table_power_mode(u32 module_index,
+						      int bred, int bgreen,
+						      int bblue);
+void nx_mlc_get_rgblayer_gama_table_power_mode(u32 module_index,
+						      int *pbred, int *pbgreen,
+						      int *pbblue);
+void nx_mlc_set_rgblayer_gama_table_sleep_mode(u32 module_index,
+						      int bred, int bgreen,
+						      int bblue);
+void nx_mlc_get_rgblayer_gama_table_sleep_mode(u32 module_index,
+						      int *pbred, int *pbgreen,
+						      int *pbblue);
+void nx_mlc_set_rgblayer_rgamma_table(u32 module_index, u32 dwaddress,
+					     u32 dwdata);
+void nx_mlc_set_rgblayer_ggamma_table(u32 module_index, u32 dwaddress,
+					     u32 dwdata);
+void nx_mlc_set_rgblayer_bgamma_table(u32 module_index, u32 dwaddress,
+					     u32 dwdata);
+void nx_mlc_set_rgblayer_gamma_enable(u32 module_index, int benable);
+int nx_mlc_get_rgblayer_gamma_enable(u32 module_index);
+
+void nx_mlc_set_video_layer_stride(u32 module_index, int32_t lu_stride,
+					  int32_t cb_stride, int32_t cr_stride);
+void nx_mlc_set_video_layer_address(u32 module_index, u32 lu_addr,
+					   u32 cb_addr, u32 cr_addr);
+void nx_mlc_set_video_layer_address_yuyv(u32 module_index, u32 addr,
+						int32_t stride);
+void nx_mlc_set_video_layer_scale_factor(u32 module_index, u32 hscale,
+						u32 vscale, int bhlumaenb,
+						int bhchromaenb, int bvlumaenb,
+						int bvchromaenb);
+void nx_mlc_set_video_layer_scale_filter(u32 module_index, int bhlumaenb,
+						int bhchromaenb, int bvlumaenb,
+						int bvchromaenb);
+void nx_mlc_get_video_layer_scale_filter(u32 module_index,
+						int *bhlumaenb,
+						int *bhchromaenb,
+						int *bvlumaenb,
+						int *bvchromaenb);
+void nx_mlc_set_video_layer_scale(u32 module_index, u32 sw, u32 sh,
+					 u32 dw, u32 dh, int bhlumaenb,
+					 int bhchromaenb, int bvlumaenb,
+					 int bvchromaenb);
+void nx_mlc_set_video_layer_luma_enhance(u32 module_index, u32 contrast,
+						int32_t brightness);
+void nx_mlc_set_video_layer_chroma_enhance(u32 module_index,
+						  u32 quadrant, int32_t cb_a,
+						  int32_t cb_b, int32_t cr_a,
+						  int32_t cr_b);
+void nx_mlc_set_video_layer_line_buffer_power_mode(u32 module_index,
+							  int benable);
+int nx_mlc_get_video_layer_line_buffer_power_mode(u32 module_index);
+void nx_mlc_set_video_layer_line_buffer_sleep_mode(u32 module_index,
+							  int benable);
+int nx_mlc_get_video_layer_line_buffer_sleep_mode(u32 module_index);
+void nx_mlc_set_video_layer_gamma_enable(u32 module_index, int benable);
+int nx_mlc_get_video_layer_gamma_enable(u32 module_index);
+
+void nx_mlc_set_gamma_table_poweroff(u32 module_index, int enb);
+
+enum mlc_rgbfmt {
+	rgbfmt_r5g6b5 = 0,
+	rgbfmt_x1r5g5b5 = 1,
+	rgbfmt_x4r4g4b4 = 2,
+	rgbfmt_x8r3g3b2 = 3,
+	rgbfmt_x8l8 = 4,
+	rgbfmt_l16 = 5,
+	rgbfmt_a1r5g5b5 = 6,
+	rgbfmt_a4r4g4b4 = 7,
+	rgbfmt_a8r3g3b2 = 8,
+	rgbfmt_a8l8 = 9,
+	rgbfmt_r8g8b8 = 10,
+	rgbfmt_x8r8g8b8 = 11,
+	rgbfmt_a8r8g8b8 = 12,
+	rgbfmt_g8r8_g8b8 = 13,
+	rgbfmt_r8g8_b8g8 = 14,
+	rgbfmt_b5g6r5 = 15,
+	rgbfmt_x1b5g5r5 = 16,
+	rgbfmt_x4b4g4r4 = 17,
+	rgbfmt_x8b3g3r2 = 18,
+	rgbfmt_a1b5g5r5 = 19,
+	rgbfmt_a4b4g4r4 = 20,
+	rgbfmt_a8b3g3r2 = 21,
+	rgbfmt_b8g8r8 = 22,
+	rgbfmt_x8b8g8r8 = 23,
+	rgbfmt_a8b8g8r8 = 24,
+	rgbfmt_g8b8_g8r8 = 25,
+	rgbfmt_b8g8_r8g8 = 26,
+	rgbfmt_pataletb = 27
+};
+
+enum latyername {
+	topmlc = 0,
+	rgb0 = 1,
+	rgb1 = 2,
+	rgb2 = 3,
+	video = 4
+};
+
+enum srammode {
+	poweroff = 0,
+	sleepmode = 2,
+	run = 3
+};
+
+enum locksizesel {
+	locksize_4 = 0,
+	locksize_8 = 1,
+	locksize_16 = 2
+};
+
+enum g3daddrchangeallowed {
+	prim = 0,
+	secon = 1,
+	primorsecon = 2,
+	primandsecon = 3
+};
+
+void nx_mlc_set_mlctop_control_parameter(u32 module_index,
+						int field_enable, int mlcenable,
+						u8 priority,
+						enum g3daddrchangeallowed
+						g3daddr_change_allowed);
+void nx_mlc_set_rgb0layer_control_parameter(u32 module_index,
+						   int layer_enable,
+						   int grp3denable,
+						   int tp_enable,
+						   u32 transparency_color,
+						   int inv_enable,
+						   u32 inverse_color,
+						   int blend_enable,
+						   u8 alpha_value,
+						   enum mlc_rgbfmt rbgformat,
+						   enum locksizesel
+						   lock_size_select);
+
+u32 nx_mlc_get_rgbformat(enum mlc_rgbfmt rbgformat);
+void nx_mlc_set_rgb1layer_control_parameter(u32 module_index,
+						   int layer_enable,
+						   int grp3denable,
+						   int tp_enable,
+						   u32 transparency_color,
+						   int inv_enable,
+						   u32 inverse_color,
+						   int blend_enable,
+						   u8 alpha_value,
+						   enum mlc_rgbfmt rbgformat,
+						   enum locksizesel
+						   lock_size_select);
+
+void nx_mlc_set_rgb2layer_control_parameter(u32 module_index,
+						   int layer_enable,
+						   int grp3denable,
+						   int tp_enable,
+						   u32 transparency_color,
+						   int inv_enable,
+						   u32 inverse_color,
+						   int blend_enable,
+						   u8 alpha_value,
+						   enum mlc_rgbfmt rbgformat,
+						   enum locksizesel
+						   lock_size_select);
+
+void nx_mlc_set_video_layer_control_parameter(u32 module_index,
+						     int layer_enable,
+						     int tp_enable,
+						     u32 transparency_color,
+						     int inv_enable,
+						     u32 inverse_color,
+						     int blend_enable,
+						     u8 alpha_value,
+						     enum nx_mlc_yuvfmt
+						     yuvformat);
+
+void nx_mlc_set_srammode(u32 module_index, enum latyername layer_name,
+				enum srammode sram_mode);
+
+void nx_mlc_set_layer_reg_finish(u32 module_index,
+					enum latyername layer_name);
+
+void nx_mlc_set_video_layer_coordinate(u32 module_index,
+					      int vfilterenable,
+					      int hfilterenable,
+					      int vfilterenable_c,
+					      int hfilterenable_c,
+					      u16 video_layer_with,
+					      u16 video_layer_height,
+					      int16_t left, int16_t right,
+					      int16_t top, int16_t bottom);
+
+void nx_mlc_set_video_layer_filter_scale(u32 module_index, u32 hscale,
+						u32 vscale);
+void nx_mlcsetgammasrammode(u32 module_index, enum srammode sram_mode);
+void nx_mlc_set_gamma_control_parameter(u32 module_index,
+					       int rgbgammaenb, int yuvgammaenb,
+					       int yuvalphaarray,
+					       int dither_enb);
+
+void nx_mlc_set_layer_alpha256(u32 module_index, u32 layer, u32 alpha);
+int nx_mlc_is_under_flow(u32 module_index);
+
+struct nx_mlc_gamma_table_parameter {
+	u32 r_table[256];
+	u32 g_table[256];
+	u32 b_table[256];
+	u32 ditherenb;
+	u32 alphaselect;
+	u32 yuvgammaenb;
+	u32 rgbgammaenb;
+	u32 allgammaenb;
+};
+
+void nx_mlc_set_gamma_table(u32 module_index, int enb,
+		struct nx_mlc_gamma_table_parameter *p_gammatable);
+void nx_mlc_get_rgblayer_stride(u32 module_index, u32 layer,
+				       int32_t *hstride, int32_t *vstride);
+void nx_mlc_get_rgblayer_address(u32 module_index, u32 layer,
+					u32 *phys_address);
+void nx_mlc_get_position(u32 module_index, u32 layer, int *left,
+				int *top, int *right, int *bottom);
+void nx_mlc_get_video_layer_address_yuyv(u32 module_index, u32 *address,
+						u32 *stride);
+void nx_mlc_get_video_layer_address(u32 module_index, u32 *lu_address,
+					   u32 *cb_address, u32 *cr_address);
+void nx_mlc_get_video_layer_stride(u32 module_index, u32 *lu_stride,
+					  u32 *cb_stride, u32 *cr_stride);
+void nx_mlc_get_video_layer_stride(u32 module_index, u32 *lu_stride,
+					  u32 *cb_stride, u32 *cr_stride);
+void nx_mlc_get_video_position(u32 module_index, int *left, int *top,
+				      int *right, int *bottom);
+
+#endif
diff -ENwbur a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
--- a/drivers/gpu/drm/panel/Kconfig	2018-05-06 08:47:36.785322040 +0200
+++ b/drivers/gpu/drm/panel/Kconfig	2018-05-06 08:49:49.626713598 +0200
@@ -117,4 +117,11 @@
 	  Say Y here if you want to enable support for the Sitronix
 	  ST7789V controller for 240x320 LCD panels

+config DRM_PANEL_NANOPI
+	tristate "NanoPi M3 LVDS/RGB panel"
+	depends on OF && TOUCHSCREEN_1WIRE
+	help
+	  DRM panel driver for RGB and LVDS output of NanoPi M3 device.
+	  Say Y if you have display panel connected to one of these outputs.
+
 endmenu
diff -ENwbur a/drivers/gpu/drm/panel/Makefile b/drivers/gpu/drm/panel/Makefile
--- a/drivers/gpu/drm/panel/Makefile	2018-05-06 08:47:36.785322040 +0200
+++ b/drivers/gpu/drm/panel/Makefile	2018-05-06 08:49:49.626713598 +0200
@@ -11,3 +11,4 @@
 obj-$(CONFIG_DRM_PANEL_SHARP_LQ101R1SX01) += panel-sharp-lq101r1sx01.o
 obj-$(CONFIG_DRM_PANEL_SHARP_LS043T1LE01) += panel-sharp-ls043t1le01.o
 obj-$(CONFIG_DRM_PANEL_SITRONIX_ST7789V) += panel-sitronix-st7789v.o
+obj-$(CONFIG_DRM_PANEL_NANOPI) += panel-nanopi.o
diff -ENwbur a/drivers/gpu/drm/panel/panel-nanopi.c b/drivers/gpu/drm/panel/panel-nanopi.c
--- a/drivers/gpu/drm/panel/panel-nanopi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/gpu/drm/panel/panel-nanopi.c	2018-05-06 08:49:49.626713598 +0200
@@ -0,0 +1,602 @@
+#include <linux/module.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <drm/drmP.h>
+#include <drm/drm_panel.h>
+#include <video/videomode.h>
+#include <soc/nexell/panel-nanopi.h>
+
+
+static char connected_rgb[8], connected_lvds[8];
+module_param_string(rgb, connected_rgb, sizeof(connected_rgb), 0444);
+module_param_string(lvds, connected_lvds, sizeof(connected_lvds), 0444);
+
+
+struct panel_nanopi {
+	struct drm_panel base;
+	const struct nanopi_panel_desc *desc;
+};
+
+static inline struct panel_nanopi *to_panel_nanopi(struct drm_panel *panel)
+{
+	return container_of(panel, struct panel_nanopi, base);
+}
+
+static int panel_nanopi_get_modes(struct drm_panel *panel)
+{
+	struct panel_nanopi *p = to_panel_nanopi(panel);
+	struct drm_connector *connector = panel->connector;
+	struct drm_device *drm = panel->drm;
+	struct drm_display_mode *mode;
+	const struct drm_display_mode *m = p->desc->mode;
+
+	if( !p->desc )
+		return 0;
+	mode = drm_mode_duplicate(drm, m);
+	if( !mode ) {
+		dev_err(drm->dev, "failed to add mode %ux%u@%u\n",
+			m->hdisplay, m->vdisplay, m->vrefresh);
+		return 0;
+	}
+	mode->type |= DRM_MODE_TYPE_DRIVER;
+	mode->type |= DRM_MODE_TYPE_PREFERRED;
+	drm_mode_set_name(mode);
+	drm_mode_probed_add(connector, mode);
+	connector->display_info.bpc = p->desc->bpc;
+	connector->display_info.width_mm = p->desc->p_width;
+	connector->display_info.height_mm = p->desc->p_height;
+	return 1;
+}
+
+static int panel_nanopi_disable(struct drm_panel *panel)
+{
+	return 0;
+}
+
+static int panel_nanopi_unprepare(struct drm_panel *panel)
+{
+	return 0;
+}
+
+static int panel_nanopi_prepare(struct drm_panel *panel)
+{
+	return 0;
+}
+
+static int panel_nanopi_enable(struct drm_panel *panel)
+{
+	return 0;
+}
+
+static const struct drm_panel_funcs panel_nanopi_funcs = {
+	.get_modes = panel_nanopi_get_modes,
+	.prepare = panel_nanopi_prepare,
+	.unprepare = panel_nanopi_unprepare,
+	.enable = panel_nanopi_enable,
+	.disable = panel_nanopi_disable
+};
+
+static const struct drm_display_mode mode_hd101 = {
+	.clock = 66670,
+	.hdisplay = 1280,
+	.hsync_start = 1280 + 16,
+	.hsync_end = 1280 + 16 + 30,
+	.htotal = 1280 + 16 + 30 + 16,
+	.vdisplay = 800,
+	.vsync_start = 800 + 8,
+	.vsync_end = 800 + 8 + 12,
+	.vtotal = 800 + 8 + 12 + 8,
+	.vrefresh = 60,
+	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
+			DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_hd700 = {
+	.clock = 67184,
+	.hdisplay = 800,
+	.hsync_start = 800 + 20,
+	.hsync_end = 800 + 20 + 24,
+	.htotal = 800 + 20 + 24 + 20,
+	.vdisplay = 1280,
+	.vsync_start = 1280 + 4,
+	.vsync_end = 1280 + 4 + 8,
+	.vtotal = 1280 + 4 + 8 + 4,
+	.vrefresh = 60,
+	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
+			DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_s70 = {
+	.clock = 28630,
+	.hdisplay = 800,
+	.hsync_start = 800 + 48,
+	.hsync_end = 800 + 48 + 10,
+	.htotal = 800 + 48 + 10 + 36,
+	.vdisplay = 480,
+	.vsync_start = 480 + 22,
+	.vsync_end = 480 + 22 + 8,
+	.vtotal = 480 + 22 + 8 + 15,
+	.vrefresh = 61,
+};
+
+static const struct drm_display_mode mode_s702 = {
+	.clock = 28502,
+	.hdisplay = 800,
+	.hsync_start = 800 + 44,
+	.hsync_end = 800 + 44 + 20,
+	.htotal = 800 + 44 + 20 + 26,
+	.vdisplay = 480,
+	.vsync_start = 480 + 22,
+	.vsync_end = 480 + 22 + 8,
+	.vtotal = 480 + 22 + 8 + 15,
+	.vrefresh = 61,
+	.flags = DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_s70d = {
+	.clock = 31531,
+	.hdisplay = 800,
+	.hsync_start = 800 + 80,
+	.hsync_end = 800 + 80 + 10,
+	.htotal = 800 + 80 + 10 + 78,
+	.vdisplay = 480,
+	.vsync_start = 480 + 22,
+	.vsync_end = 480 + 22 + 8,
+	.vtotal = 480 + 22 + 8 + 24,
+	.vrefresh = 61,
+};
+
+static const struct drm_display_mode mode_x710 = {
+	.clock = 49971,
+	.hdisplay = 1024,
+	.hsync_start = 1024 + 84,
+	.hsync_end = 1024 + 84 + 88,
+	.htotal = 1024 + 84 + 88 + 84,
+	.vdisplay = 600,
+	.vsync_start = 600 + 10,
+	.vsync_end = 600 + 10 + 20,
+	.vtotal = 600 + 10 + 20 + 10,
+	.vrefresh = 61,
+};
+
+static const struct drm_display_mode mode_s430 = {
+	.clock = 28492,
+	.hdisplay = 480,
+	.hsync_start = 480 + 64,
+	.hsync_end = 480 + 64 + 16,
+	.htotal = 480 + 64 + 16 + 0,
+	.vdisplay = 800,
+	.vsync_start = 800 + 32,
+	.vsync_end = 800 + 32 + 16,
+	.vtotal = 800 + 32 + 16 + 0,
+	.vrefresh = 60,
+	.flags = DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_h43 = {
+	.clock = 9933,
+	.hdisplay = 480,
+	.hsync_start = 480 + 5,
+	.hsync_end = 480 + 5 + 2,
+	.htotal = 480 + 5 + 2 + 40,
+	.vdisplay = 272,
+	.vsync_start = 272 + 8,
+	.vsync_end = 272 + 8 + 2,
+	.vtotal = 272 + 8 + 2 + 8,
+	.vrefresh = 65,
+};
+
+static const struct drm_display_mode mode_p43 = {
+	.clock = 9968,
+	.hdisplay = 480,
+	.hsync_start = 480 + 5,
+	.hsync_end = 480 + 5 + 2,
+	.htotal = 480 + 5 + 2 + 40,
+	.vdisplay = 272,
+	.vsync_start = 272 + 8,
+	.vsync_end = 272 + 8 + 2,
+	.vtotal = 272 + 8 + 2 + 9,
+	.vrefresh = 65,
+	.flags = DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_w35 = {
+	.clock = 6726,
+	.hdisplay = 320,
+	.hsync_start = 320 + 4,
+	.hsync_end = 320 + 4 + 4,
+	.htotal = 320 + 4 + 4 + 70,
+	.vdisplay = 240,
+	.vsync_start = 240 + 4,
+	.vsync_end = 240 + 4 + 4,
+	.vtotal = 240 + 4 + 4 + 12,
+	.vrefresh = 65,
+	.flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC |
+			DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_w50 = {
+	.clock = 34558,
+	.hdisplay = 800,
+	.hsync_start = 800 + 40,
+	.hsync_end = 800 + 40 + 48,
+	.htotal = 800 + 40 + 48 + 40,
+	.vdisplay = 480,
+	.vsync_start = 480 + 20,
+	.vsync_end = 480 + 20 + 12,
+	.vtotal = 480 + 20 + 12 + 20,
+	.vrefresh = 70,
+};
+
+static const struct drm_display_mode mode_w101 = {
+	.clock = 49447,
+	.hdisplay = 1024,
+	.hsync_start = 1024 + 40,
+	.hsync_end = 1024 + 40 + 200,
+	.htotal = 1024 + 40 + 200 + 40,
+	.vdisplay = 600,
+	.vsync_start = 600 + 8,
+	.vsync_end = 600 + 8 + 16,
+	.vtotal = 600 + 8 + 16 + 8,
+	.vrefresh = 60,
+	.flags = DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_a97 = {
+	.clock = 50567,
+	.hdisplay = 1024,
+	.hsync_start = 1024 + 12,
+	.hsync_end = 1024 + 12 + 4,
+	.htotal = 1024 + 12 + 4 + 12,
+	.vdisplay = 768,
+	.vsync_start = 768 + 8,
+	.vsync_end = 768 + 8 + 4,
+	.vtotal = 768 + 8 + 4 + 8,
+	.vrefresh = 61,
+};
+
+static const struct drm_display_mode mode_lq150 = {
+	.clock = 53790,
+	.hdisplay = 1024,
+	.hsync_start = 1024 + 12,
+	.hsync_end = 1024 + 12 + 40,
+	.htotal = 1024 + 12 + 40 + 12,
+	.vdisplay = 768,
+	.vsync_start = 768 + 8,
+	.vsync_end = 768 + 8 + 40,
+	.vtotal = 768 + 8 + 40 + 8,
+	.vrefresh = 60,
+};
+
+static const struct drm_display_mode mode_l80 = {
+	.clock = 24895,
+	.hdisplay = 640,
+	.hsync_start = 640 + 35,
+	.hsync_end = 640 + 35 + 73,
+	.htotal = 640 + 35 + 73 + 53,
+	.vdisplay = 480,
+	.vsync_start = 480 + 3,
+	.vsync_end = 480 + 3 + 6,
+	.vtotal = 480 + 3 + 6 + 29,
+	.vrefresh = 60,
+};
+
+static const struct drm_display_mode mode_bp101 = {
+	.clock = 65802,
+	.hdisplay = 1280,
+	.hsync_start = 1280 + 20,
+	.hsync_end = 1280 + 20 + 24,
+	.htotal = 1280 + 20 + 24 + 20,
+	.vdisplay = 800,
+	.vsync_start = 800 + 4,
+	.vsync_end = 800 + 4 + 8,
+	.vtotal = 800 + 4 + 8 + 4,
+	.vrefresh = 60,
+	.flags = DRM_MODE_FLAG_NCSYNC
+};
+
+static const struct drm_display_mode mode_atops = {
+	.clock = 34540,
+	.hdisplay = 800,
+	.hsync_start = 800 + 210,
+	.hsync_end = 800 + 210 + 20,
+	.htotal = 800 + 210 + 20 + 46,
+	.vdisplay = 480,
+	.vsync_start = 480 + 22,
+	.vsync_end = 480 + 22 + 10,
+	.vtotal = 480 + 22 + 10 + 23,
+	.vrefresh = 60,
+};
+
+static const struct nanopi_panel_desc nanopi_panels[] = {
+	{
+		.name = "hd101",
+		.onewireType = 25,
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 218,
+		.p_height = 136,
+		.mode = &mode_hd101,
+	},{
+		.name = "hd101b",
+		.onewireType = 0,	/* unknown */
+		.i2c_touch_drv = "Goodix-TS",
+		.i2c_touch_reg = 0x5d,
+		.bpc  = 8,
+		.p_width = 218,
+		.p_height = 136,
+		.mode = &mode_hd101,
+	},{
+		.name = "hd700",
+		.onewireType = 18,
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 94,
+		.p_height = 151,
+		.mode = &mode_hd700,
+	},{
+		.name = "hd702",
+		.onewireType = 30,
+		.i2c_touch_drv = "Goodix-TS",
+		.i2c_touch_reg = 0x5d,
+		.bpc  = 8,
+		.p_width = 94,
+		.p_height = 151,
+		.mode = &mode_hd700,
+	},{
+		.name = "s70",
+		.onewireType = 3,
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 155,
+		.p_height = 93,
+		.mode = &mode_s70,
+	},{
+		.name = "s702",
+		.onewireType = 24,
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 155,
+		.p_height = 93,
+		.mode = &mode_s702,
+	},{
+		.name = "s70d",
+		.onewireType = 26,
+		.bpc  = 8,
+		.p_width = 155,
+		.p_height = 93,
+		.mode = &mode_s70d,
+	},{
+		.name = "x710",
+		.onewireType = 28,
+		.i2c_touch_drv = "it7260",
+		.i2c_touch_reg = 0x46,
+		.bpc  = 8,
+		.p_width = 154,
+		.p_height = 90,
+		.mode = &mode_x710,
+	},{
+		.name = "s430",
+		.onewireType = 31,
+		.i2c_touch_drv = "hx8528-a",
+		.i2c_touch_reg = 0x48,
+		.bpc  = 8,
+		.p_width = 108,
+		.p_height = 64,
+		.mode = &mode_s430,
+	},{
+		.name = "h43",
+		.onewireType = 14,
+		.bpc  = 8,
+		.p_width = 96,
+		.p_height = 54,
+		.mode = &mode_h43,
+	},{
+		.name = "p43",
+		.onewireType = 19,
+		.bpc  = 8,
+		.p_width = 96,
+		.p_height = 54,
+		.mode = &mode_p43,
+	},{
+		.name = "w35",
+		.onewireType = 8,
+		.bpc  = 6,
+		.p_width = 70,
+		.p_height = 52,
+		.mode = &mode_w35,
+	},{
+		.name = "w50",
+		.onewireType = 4,
+		.bpc  = 8,
+		.p_width = 108,
+		.p_height = 64,
+		.mode = &mode_w50,
+	},{
+		.name = "w101",
+		.onewireType = 15,
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 204,
+		.p_height = 120,
+		.mode = &mode_w101,
+	},{
+		.name = "a97",
+		.onewireType = 0,	/* unknown */
+		.bpc  = 8,
+		.p_width = 200,
+		.p_height = 150,
+		.mode = &mode_a97,
+	},{
+		.name = "lq150",
+		.onewireType = 0,	/* unknown */
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 304,
+		.p_height = 228,
+		.mode = &mode_lq150,
+	},{
+		.name = "l80",
+		.onewireType = 5,
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 160,
+		.p_height = 120,
+		.mode = &mode_l80,
+	},{
+		.name = "bp101",
+		.onewireType = 0,	/* unknown */
+		.i2c_touch_drv = "onewire",
+		.bpc  = 8,
+		.p_width = 218,
+		.p_height = 136,
+		.mode = &mode_bp101,
+	},{
+		.name = "atops",
+		.bpc  = 6,
+		.p_width = 155,
+		.p_height = 93,
+		.mode = &mode_atops,
+	},
+};
+
+static const struct nanopi_panel_desc *getPanelDescByName(const char *name)
+{
+	const struct nanopi_panel_desc *desc = NULL;
+	int i;
+
+	for(i = 0; i < ARRAY_SIZE(nanopi_panels) && desc == NULL; ++i) {
+		if( !strcmp(nanopi_panels[i].name, name) )
+			desc = nanopi_panels + i;
+	}
+	if( desc == NULL ) {
+		pr_err("unknown panel \"%s\"\n", name);
+		pr_info("available panels:");
+		for(i = 0; i < ARRAY_SIZE(nanopi_panels); ++i)
+			pr_cont(" %s", nanopi_panels[i].name);
+		pr_cont("\n");
+	}
+	return desc;
+}
+
+const struct nanopi_panel_desc *nanopi_panelrgb_get_connected(void)
+{
+	const struct nanopi_panel_desc *desc = NULL;
+	int i, onewireType;
+
+	if( connected_rgb[0] )
+		return getPanelDescByName(connected_rgb);
+	onewireType = onewire_get_lcd_type();
+	if( onewireType > 0 ) {
+		for(i = 0; i < ARRAY_SIZE(nanopi_panels) && desc == NULL; ++i) {
+			if( nanopi_panels[i].onewireType == onewireType )
+				desc = nanopi_panels + i;
+		}
+		if( desc == NULL ) {
+			pr_err("unknown FriendlyArm panel type detected: %d\n", onewireType);
+			pr_info("please file kernel issue on https://github.com/rafaello7/linux-nanopi-m3"
+				   " with information about the connected panel type\n");
+			pr_info("panel type may be set now only manually by add u-boot bootargs param: "
+					"panel-nanopi.lcd=<your panel>\n");
+		}
+	}
+	return desc;
+}
+EXPORT_SYMBOL_GPL(nanopi_panelrgb_get_connected);
+
+bool nanopi_panelrgb_issensor_1wire(int onewireType)
+{
+	const struct nanopi_panel_desc *desc = NULL;
+	int i;
+
+	if( connected_rgb[0] )
+		desc = getPanelDescByName(connected_rgb);
+	else{
+		for(i = 0; i < ARRAY_SIZE(nanopi_panels) && desc == NULL; ++i) {
+			if( nanopi_panels[i].onewireType == onewireType )
+				desc = nanopi_panels + i;
+		}
+	}
+	return desc && desc->i2c_touch_drv &&
+		!strcmp(desc->i2c_touch_drv, "onewire");
+}
+
+static int panel_nanopi_platform_probe(struct platform_device *pdev)
+{
+	int err;
+	struct panel_nanopi *panel;
+	const struct nanopi_panel_desc *desc;
+	bool isLvds;
+
+	isLvds = of_property_read_bool(pdev->dev.of_node, "lvds");
+	if( isLvds )
+		desc = connected_lvds[0] ? getPanelDescByName(connected_lvds) : NULL;
+	else
+		desc = nanopi_panelrgb_get_connected();
+	if( desc == NULL )
+		return -ENODEV;
+	panel = devm_kzalloc(&pdev->dev, sizeof(*panel), GFP_KERNEL);
+	if (!panel)
+		return -ENOMEM;
+	panel->desc = desc;
+	drm_panel_init(&panel->base);
+	panel->base.dev = &pdev->dev;
+	panel->base.funcs = &panel_nanopi_funcs;
+
+	err = drm_panel_add(&panel->base);
+	if( err < 0 )
+		return err;
+	dev_set_drvdata(&pdev->dev, panel);
+	dev_info(&pdev->dev, "added %s panel for %s\n", isLvds ? "lvds" : "rgb",
+			desc->name);
+	return 0;
+}
+
+static int panel_nanopi_platform_remove(struct platform_device *pdev)
+{
+	struct panel_nanopi *panel = dev_get_drvdata(&pdev->dev);
+
+	drm_panel_detach(&panel->base);
+	drm_panel_remove(&panel->base);
+	return 0;
+}
+
+static const struct of_device_id platform_of_match[] = {
+	{
+		.compatible = "nanopi,nano-panel",
+	}, {
+		/* sentinel */
+	}
+};
+MODULE_DEVICE_TABLE(of, platform_of_match);
+
+static struct platform_driver panel_nanopi_platform_driver = {
+	.driver = {
+		.name = "panel-nanopi",
+		.of_match_table = platform_of_match,
+	},
+	.probe = panel_nanopi_platform_probe,
+	.remove = panel_nanopi_platform_remove,
+};
+
+static int __init panel_nanopi_init(void)
+{
+	int err;
+
+	err = platform_driver_register(&panel_nanopi_platform_driver);
+	if (err < 0)
+		return err;
+
+	return 0;
+}
+module_init(panel_nanopi_init);
+
+static void __exit panel_nanopi_exit(void)
+{
+	platform_driver_unregister(&panel_nanopi_platform_driver);
+}
+module_exit(panel_nanopi_exit);
+
+MODULE_AUTHOR("Rafaello7 <fatwildcat@gmail.com>");
+MODULE_DESCRIPTION("DRM driver for NanoPi M3 panel");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/gpu/Makefile b/drivers/gpu/Makefile
--- a/drivers/gpu/Makefile	2018-05-06 08:47:36.357304664 +0200
+++ b/drivers/gpu/Makefile	2018-05-06 08:49:49.174695256 +0200
@@ -2,5 +2,5 @@
 # taken to initialize them in the correct order. Link order is the only way
 # to ensure this currently.
 obj-$(CONFIG_TEGRA_HOST1X)	+= host1x/
-obj-y			+= drm/ vga/
+obj-y			+= drm/ vga/ arm/
 obj-$(CONFIG_IMX_IPUV3_CORE)	+= ipu-v3/
diff -ENwbur a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
--- a/drivers/hwmon/Kconfig	2018-05-06 08:47:36.869325451 +0200
+++ b/drivers/hwmon/Kconfig	2018-05-06 08:49:49.710717005 +0200
@@ -1869,6 +1869,13 @@
 	  If you say yes here you get support for the temperature
 	  and power sensors for APM X-Gene SoC.

+config NANOPI_THERMISTOR
+	tristate "NanoPi M3 temperature from onboard thermistor"
+	depends on ARCH_S5P6818
+	help
+	  Measures NanoPi M3 temperature using thermistor connected to
+	  ADC (analog to digital converter) of s5p6818 soc.
+
 if ACPI

 comment "ACPI drivers"
diff -ENwbur a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
--- a/drivers/hwmon/Makefile	2018-05-06 08:47:36.869325451 +0200
+++ b/drivers/hwmon/Makefile	2018-05-06 08:49:49.710717005 +0200
@@ -171,6 +171,7 @@
 obj-$(CONFIG_SENSORS_WM831X)	+= wm831x-hwmon.o
 obj-$(CONFIG_SENSORS_WM8350)	+= wm8350-hwmon.o
 obj-$(CONFIG_SENSORS_XGENE)	+= xgene-hwmon.o
+obj-$(CONFIG_NANOPI_THERMISTOR) += nanopi-thermistor.o

 obj-$(CONFIG_PMBUS)		+= pmbus/

diff -ENwbur a/drivers/hwmon/nanopi-thermistor.c b/drivers/hwmon/nanopi-thermistor.c
--- a/drivers/hwmon/nanopi-thermistor.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/hwmon/nanopi-thermistor.c	2018-05-06 08:49:49.722717492 +0200
@@ -0,0 +1,240 @@
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/iio/consumer.h>
+#include <linux/hwmon.h>
+
+
+struct nanopi_thermistor_device {
+	struct iio_channel *therm_adc;
+	struct device *hwmon_dev;
+};
+
+/* Thermistor temperature is calculated from thermistor resistance with
+ * respect to two nearest resistance values: one lower and one higher.
+ *
+ * Temperature calculation formula:
+ *
+ *					T1 * T2 * log2(R1/R2)
+ *	T =	---------------------------------------------------
+ *		T1 * log2(R1) - T2 * log2(R2) + (T2 - T1) * log2(R)
+ *
+ * where:
+ *		T1, T2	- reference temperatures
+ *		R1		- thermistor resistance at T1
+ *		R2		- thermistor resistance at T2
+ *		R		- measured resistance
+ *		T		- temperature being calculated
+ *		log2(n)	- logarithm at base 2
+ */
+
+/* Reference resistances with pre-calculated values for temperature formula.
+ *	Rprev	- resistance from previous row (mOhm)
+ *	Rcur	- resistance from current row  (mOhm)
+ *	Tprew	- temperature for previous row (mK)
+ *	Tcur	- temperature for current row  (mK)
+ */
+static const struct {
+	unsigned mohm;		/* thermistor resistance (mOhm) */
+	unsigned cnum;		/* 2^32 * (log2(Rprev) - log2(Rcur)) */
+	unsigned cdenom;	/* 2^48 * (log2(Rprev) / Tcur - log2(Rcur) / Tprev) */
+	unsigned f;			/* 2^48 * (Tprev - Tcur) / (Tprev * Tcur) */
+} mohm2temp[] = {
+	{ 189204600,           0,          0,          0 },		/* -40 */
+	{ 145024000,  1647787795, -233745012,   25346838 },		/* -35 */
+	{ 112004800,  1600867930, -218394555,   24304401 },		/* -30 */
+	{  87133800,  1555878504, -204331715,   23324977 },		/* -25 */
+	{  68260000,  1512653326, -191444168,   22403588 },		/* -20 */
+	{  53834600,  1471055118, -179627764,   21535736 },		/* -15 */
+	{  42733400,  1430952525, -168790799,   20717354 },		/* -10 */
+	{  34133800,  1392269797, -158839901,   19944751 },		/*  -5 */
+	{  27429900,  1354854610, -149711764,   19214575 },		/*   0 */
+	{  22171800,  1318655735, -141327720,   18523776 },		/*   5 */
+	{  18023400,  1283571192, -133630102,   17869572 },		/*  10 */
+	{  14731900,  1249524882, -126562571,   17249424 },		/*  15 */
+	{  12106000,  1216426020, -120078852,   16661008 },		/*  20 */
+	{  10000000,  1184218072, -114130761,   16102195 },		/*  25 */
+	{   8302200,  1152917003, -108659623,   15571032 },		/*  30 */
+	{   6926800,  1122295002, -103665081,   15065725 },		/*  35 */
+	{   5807100,  1092515732,  -99065950,   14584623 },		/*  40 */
+	{   4891300,  1063433580,  -94851850,   14126203 },		/*  45 */
+	{   4139000,  1034810969,  -91033798,   13689062 },		/*  50 */
+	{   3518100,  1007108659,  -87482425,   13271903 },		/*  55 */
+	{   3003600,   979698336,  -84293403,   12873527 },		/*  60 */
+	{   2575400,   953036810,  -81346055,   12492822 },		/*  65 */
+	{   2212700,   940549134,  -76013040,   12128759 },		/*  70 */
+	{   1917600,   886936723,  -78909246,   11780382 },		/*  75 */
+	{   1664900,   875599038,  -74081352,   11446802 },		/*  80 */
+	{   1451300,   850789018,  -72080121,   11127193 },		/*  85 */
+	{   1270100,   826367517,  -70277052,   10820785 },		/*  90 */
+	{   1115900,   802017895,  -68711577,   10526862 },		/*  95 */
+	{    984200,   778180754,  -67287444,   10244754 },		/* 100 */
+	{    871300,   754977826,  -65968962,    9973836 },		/* 105 */
+	{    774300,   731333721,  -64929971,    9713524 },		/* 110 */
+	{    690500,   709748618,  -63726441,    9463273 },		/* 115 */
+	{    618100,   686340710,  -63009676,    9222569 },		/* 120 */
+	{    555300,   663885417,  -62296769,    8990933 },		/* 125 */
+};
+
+/* Calculates f * log2(val)
+ */
+static int ilog2mult(int val, int f)
+{
+	enum { POW2_30 = 1073741824 }; /* 2^30 */
+	long long n = val, res = 0, add = f;
+
+	/* loop invariant: res + add * log2(n) == f * log2(val) */
+	while( add > 1 ) {
+		if( n < POW2_30 ) {
+			n *= n;
+			add /= 2;
+		}else{
+			res += add;
+			n /= 2;
+		}
+	}
+	/* add == 1; adding log2(n) */
+	while( n ) {
+		++res;
+		n /= 2;
+	}
+	return res;
+}
+
+/* Calculates thermistor temperature based on ADC value
+ */
+static long adcval_to_temperature(int adcval)
+{
+	int i;
+	long long uvolt, mohm;
+
+	if( adcval <= 0 || adcval >= 4096 ) /* should never occur */
+		return 0;
+	uvolt = 1800000LL * adcval / 4096;	// voltage measured by ADC (0V .. 1.8V)
+	mohm =  4700000LL * uvolt / (1800000 - uvolt); // thermistor resistance
+	i = 1;
+	while(i < ARRAY_SIZE(mohm2temp)-1 && mohm2temp[i].mohm >= mohm)
+		++i;
+	return 0x10000LL * mohm2temp[i].cnum /
+		(mohm2temp[i].cdenom + ilog2mult(mohm, mohm2temp[i].f)) - 273150;
+}
+
+static umode_t nanopi_thermistor_is_visible(const void *drvdata,
+		enum hwmon_sensor_types type, u32 attr, int channel)
+{
+	return S_IRUGO;
+}
+
+static int nanopi_thermistor_read(struct device *dev,
+		enum hwmon_sensor_types type, u32 attr, int channel, long *val)
+{
+	int ret = 0, adcval;
+	struct nanopi_thermistor_device *nthdev;
+
+	nthdev = dev_get_drvdata(dev);
+	switch( attr ) {
+	case hwmon_temp_input:
+		ret = iio_read_channel_processed(nthdev->therm_adc, &adcval);
+		*val = adcval_to_temperature(adcval);
+		break;
+	case hwmon_temp_max:
+		*val = 85000;
+		break;
+	}
+	return 0;
+}
+
+static const struct hwmon_ops nanopi_thermistor_hwmon_ops = {
+	.is_visible	= nanopi_thermistor_is_visible,
+	.read		= nanopi_thermistor_read,
+};
+
+static const u32 nanopi_thermistor_config[] = {
+	HWMON_T_INPUT | HWMON_T_MAX,
+	0
+};
+
+static const struct hwmon_channel_info nanopi_thermistor_channel_info = {
+	.type = hwmon_temp,
+	.config = nanopi_thermistor_config
+};
+
+static const struct hwmon_channel_info *nanopi_thermistor_channel_info_tab[] = {
+	&nanopi_thermistor_channel_info,
+	NULL
+};
+
+static const struct hwmon_chip_info nanopi_thermistor_chip_info = {
+	.ops = &nanopi_thermistor_hwmon_ops,
+	.info = nanopi_thermistor_channel_info_tab
+};
+
+static int nanopi_thermistor_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct nanopi_thermistor_device *nthdev;
+
+	nthdev = devm_kzalloc(&pdev->dev, sizeof(struct nanopi_thermistor_device),
+			GFP_KERNEL);
+	if( nthdev == NULL )
+		return -ENOMEM;
+	nthdev->therm_adc = devm_iio_channel_get(&pdev->dev, "nanopi-thermistor");
+	if( IS_ERR(nthdev->therm_adc) ) {
+		if (PTR_ERR(nthdev->therm_adc) == -ENODEV)
+			return -EPROBE_DEFER;
+		return PTR_ERR(nthdev->therm_adc);
+	}
+	nthdev->hwmon_dev = devm_hwmon_device_register_with_info(&pdev->dev,
+			"nanopi_thermistor", nthdev, &nanopi_thermistor_chip_info, NULL);
+	if( IS_ERR(nthdev->hwmon_dev) ) {
+		ret = PTR_ERR(nthdev->hwmon_dev);
+		dev_err(&pdev->dev, "hwmon registration error %d\n", ret);
+	}else{
+		dev_info(&pdev->dev, "registered device\n");
+		//platform_set_drvdata(pdev, nthdev);
+	}
+	return ret;
+}
+
+static int nanopi_thermistor_remove(struct platform_device *pdev)
+{
+	dev_info(&pdev->dev, "unregistered device\n");
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nanopi_thermistor_of_match[] = {
+	{ .compatible = "friendlyarm,nanopi-thermistor" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, nanopi_thermistor_of_match);
+#endif
+
+static struct platform_driver nanopi_thermistor_platform_driver = {
+	.probe = nanopi_thermistor_probe,
+	.remove = nanopi_thermistor_remove,
+	.driver = {
+		.name = "nanopi-thermistor",
+		.of_match_table = of_match_ptr(nanopi_thermistor_of_match),
+	},
+};
+
+static int __init nanopi_thermistor_init(void)
+{
+	int ret = platform_driver_register(&nanopi_thermistor_platform_driver);
+	pr_info("nanopi-thermistor: registered platform driver\n");
+	return ret;
+}
+
+static void __exit nanopi_thermistor_exit(void)
+{
+	platform_driver_unregister(&nanopi_thermistor_platform_driver);
+	pr_info("nanopi-thermistor: unregistered platform driver\n");
+}
+
+module_init(nanopi_thermistor_init);
+module_exit(nanopi_thermistor_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rafaello7 <fatwildcat@gmail.com>");
+MODULE_DESCRIPTION("NanoPi M3 temperature read from thermistor connected to s5p6818 ADC");
diff -ENwbur a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
--- a/drivers/i2c/busses/i2c-s3c2410.c	2018-05-06 08:47:36.901326750 +0200
+++ b/drivers/i2c/busses/i2c-s3c2410.c	2018-05-06 08:49:49.742718303 +0200
@@ -38,10 +38,15 @@
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>

+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+#include <linux/pm_qos.h>
+#include <linux/soc/nexell/cpufreq.h>
+#endif
+
 #include <asm/irq.h>

 #include <linux/platform_data/i2c-s3c2410.h>
-
+#include <linux/reset.h>
 /* see s3c2410x user guide, v1.1, section 9 (p447) for more info */

 #define S3C2410_IICCON			0x00
@@ -125,9 +130,12 @@
 	struct s3c2410_platform_i2c	*pdata;
 	int			gpios[2];
 	struct pinctrl          *pctrl;
-#if defined(CONFIG_ARM_S3C24XX_CPUFREQ)
+#if defined(CONFIG_ARM_S3C24XX_CPUFREQ) || defined(CONFIG_ARM_S5Pxx18_DEVFREQ)
 	struct notifier_block	freq_transition;
 #endif
+#if defined(CONFIG_ARM_S5Pxx18_DEVFREQ)
+	unsigned long		clk_in;
+#endif
 	struct regmap		*sysreg;
 	unsigned int		sys_i2c_cfg;
 };
@@ -158,6 +166,8 @@
 	  .data = (void *)(QUIRK_S3C2440 | QUIRK_NO_GPIO) },
 	{ .compatible = "samsung,exynos5-sata-phy-i2c",
 	  .data = (void *)(QUIRK_S3C2440 | QUIRK_POLL | QUIRK_NO_GPIO) },
+	{ .compatible = "nexell,s5p6818-i2c",
+	  .data = (void *)(QUIRK_S3C2440 | QUIRK_NO_GPIO) },
 	{},
 };
 MODULE_DEVICE_TABLE(of, s3c24xx_i2c_match);
@@ -948,6 +958,126 @@
 				    CPUFREQ_TRANSITION_NOTIFIER);
 }

+#elif defined(CONFIG_ARM_S5Pxx18_DEVFREQ)
+
+#define freq_to_i2c(_n) container_of(_n, struct s3c24xx_i2c, freq_transition)
+
+static int s3c24xx_i2c_clockrate_by_clkin(struct s3c24xx_i2c *i2c,
+					  unsigned long clkin,
+					  unsigned int *got)
+{
+	struct s3c2410_platform_i2c *pdata = i2c->pdata;
+	unsigned int divs, div1;
+	unsigned long target_frequency;
+	u32 iiccon;
+	int freq;
+
+	i2c->clkrate = clkin;
+	clkin /= 1000;		/* clkin now in KHz */
+
+	dev_dbg(i2c->dev, "pdata desired frequency %lu\n", pdata->frequency);
+
+	target_frequency = pdata->frequency ? pdata->frequency : 100000;
+
+	target_frequency /= 1000; /* Target frequency now in KHz */
+
+	freq = s3c24xx_i2c_calcdivisor(clkin, target_frequency, &div1, &divs);
+
+	if (freq > target_frequency) {
+		dev_err(i2c->dev,
+			"Unable to achieve desired frequency %luKHz."	\
+			" Lowest achievable %dKHz\n", target_frequency, freq);
+		return -EINVAL;
+	}
+
+	*got = freq;
+
+	iiccon = readl(i2c->regs + S3C2410_IICCON);
+	iiccon &= ~(S3C2410_IICCON_SCALEMASK | S3C2410_IICCON_TXDIV_512);
+	iiccon |= (divs-1);
+
+	if (div1 == 512)
+		iiccon |= S3C2410_IICCON_TXDIV_512;
+
+	if (i2c->quirks & QUIRK_POLL)
+		iiccon |= S3C2410_IICCON_SCALE(2);
+
+	writel(iiccon, i2c->regs + S3C2410_IICCON);
+
+	if (i2c->quirks & QUIRK_S3C2440) {
+		unsigned long sda_delay;
+
+		if (pdata->sda_delay) {
+			sda_delay = clkin * pdata->sda_delay;
+			sda_delay = DIV_ROUND_UP(sda_delay, 1000000);
+			sda_delay = DIV_ROUND_UP(sda_delay, 5);
+			if (sda_delay > 3)
+				sda_delay = 3;
+			sda_delay |= S3C2410_IICLC_FILTER_ON;
+		} else
+			sda_delay = 0;
+
+		dev_dbg(i2c->dev, "IICLC=%08lx\n", sda_delay);
+		writel(sda_delay, i2c->regs + S3C2440_IICLC);
+	}
+
+	return 0;
+}
+
+static int s3c24xx_i2c_cpufreq_transition(struct notifier_block *nb,
+					  unsigned long val, void *data)
+{
+	unsigned long freq;
+	unsigned int got;
+	int ret;
+	struct s3c24xx_i2c *i2c = freq_to_i2c(nb);
+	unsigned long clkin = clk_get_rate(i2c->clk);
+
+	if (val == 0 || val == PM_QOS_DEFAULT_VALUE)
+		val = NX_BUS_CLK_LOW_KHZ;
+
+	/* change KHz to MHz */
+	freq = (val * 1000) / 2;
+
+	if (i2c->clk_in == 0) {
+		i2c->clk_in = clkin;
+		dev_info(i2c->dev, "Original clock in freq: %lu\n", clkin);
+	}
+
+	dev_dbg(i2c->dev, "[nx-devfreq] freq %lu, clk_in %lu\n",
+		freq, i2c->clk_in);
+
+	if (freq != i2c->clk_in) {
+		dev_dbg(i2c->dev, "Changed source clk from %lu -> %lu\n",
+			 i2c->clk_in, freq);
+
+		i2c_lock_adapter(&i2c->adap);
+		ret = s3c24xx_i2c_clockrate_by_clkin(i2c, freq, &got);
+		i2c_unlock_adapter(&i2c->adap);
+
+		if (ret < 0) {
+			dev_err(i2c->dev, "cannot find frequency\n");
+		} else {
+			dev_dbg(i2c->dev, "setting freq %d\n", got);
+			i2c->clk_in = freq;
+		}
+	}
+
+	return 0;
+}
+
+static inline int s3c24xx_i2c_register_cpufreq(struct s3c24xx_i2c *i2c)
+{
+	i2c->freq_transition.notifier_call = s3c24xx_i2c_cpufreq_transition;
+
+	return nx_bus_add_notifier(&i2c->freq_transition);
+}
+
+static inline void s3c24xx_i2c_deregister_cpufreq(struct s3c24xx_i2c *i2c)
+{
+	nx_bus_remove_notifier(&i2c->freq_transition);
+	pm_qos_remove_notifier(PM_QOS_BUS_THROUGHPUT, &i2c->freq_transition);
+}
 #else
 static inline int s3c24xx_i2c_register_cpufreq(struct s3c24xx_i2c *i2c)
 {
@@ -1164,6 +1294,22 @@
 		return ret;
 	}

+	/*
+	 * patch for s5p6818
+	 * s5p6818 i2c must be reset before enabled
+	 */
+#ifdef CONFIG_RESET_CONTROLLER
+	if (of_device_is_compatible(pdev->dev.of_node, "nexell,s5p6818-i2c")) {
+		struct reset_control *rst =
+			devm_reset_control_get(i2c->dev, "i2c-reset");
+		if (IS_ERR(rst)) {
+			dev_err(&pdev->dev,
+				"I2C controller failed to get reset_control\n");
+			return -EINVAL;
+		}
+		reset_control_reset(rst);
+	}
+#endif
 	ret = s3c24xx_i2c_init(i2c);
 	clk_disable(i2c->clk);
 	if (ret != 0) {
@@ -1267,6 +1413,22 @@
 	ret = clk_enable(i2c->clk);
 	if (ret)
 		return ret;
+	/*
+	 * patch for s5p6818
+	 * s5p6818 i2c must be reset when resuming
+	 */
+#ifdef CONFIG_RESET_CONTROLLER
+	if (of_device_is_compatible(dev->of_node, "nexell,s5p6818-i2c")) {
+		struct reset_control *rst =
+			devm_reset_control_get(i2c->dev, "i2c-reset");
+		if (IS_ERR(rst)) {
+			dev_err(dev,
+				"I2C controller failed to get reset_control\n");
+			return -EINVAL;
+		}
+		reset_control_reset(rst);
+	}
+#endif
 	s3c24xx_i2c_init(i2c);
 	clk_disable(i2c->clk);
 	i2c->suspended = 0;
diff -ENwbur a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
--- a/drivers/iio/adc/Kconfig	2018-05-06 08:47:36.921327562 +0200
+++ b/drivers/iio/adc/Kconfig	2018-05-06 08:49:49.762719115 +0200
@@ -890,4 +890,11 @@
 	  The driver can also be build as a module. If so, the module will be called
 	  xilinx-xadc.

+config NX_ADC
+	bool "Nexell ADC driver support"
+	depends on (ARCH_S5P6818 || ARCH_S5P4418) && OF
+	help
+	  This option enables support for Nexell s5pxx18 series
+	  of SoC for Analog Devices.
+
 endmenu
diff -ENwbur a/drivers/iio/adc/Makefile b/drivers/iio/adc/Makefile
--- a/drivers/iio/adc/Makefile	2018-05-06 08:47:36.921327562 +0200
+++ b/drivers/iio/adc/Makefile	2018-05-06 08:49:49.762719115 +0200
@@ -82,3 +82,4 @@
 obj-$(CONFIG_VIPERBOARD_ADC) += viperboard_adc.o
 xilinx-xadc-y := xilinx-xadc-core.o xilinx-xadc-events.o
 obj-$(CONFIG_XILINX_XADC) += xilinx-xadc.o
+obj-$(CONFIG_NX_ADC) += nexell_adc.o
diff -ENwbur a/drivers/iio/adc/nexell_adc.c b/drivers/iio/adc/nexell_adc.c
--- a/drivers/iio/adc/nexell_adc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/iio/adc/nexell_adc.c	2018-05-06 08:49:49.766719279 +0200
@@ -0,0 +1,637 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/suspend.h>
+#include <linux/notifier.h>
+#include <linux/of.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <linux/reset.h>
+
+#include <linux/iio/iio.h>
+#include <linux/iio/sysfs.h>
+#include <linux/iio/driver.h>
+#include <linux/iio/machine.h>
+
+/*
+ * ADC definitions
+ */
+#define	ADC_MAX_SAMPLE_RATE		(1*1000*1000)	/* with 6bit */
+#define	ADC_MAX_SAMPLE_BITS		6
+#define	ADC_MAX_PRESCALE		256		/* 8bit */
+#define	ADC_MIN_PRESCALE		20
+
+#define ADC_TIMEOUT		(msecs_to_jiffies(100))
+
+
+/* Register definitions for ADC_V1 */
+#define ADC_V1_CON(x)		((x) + 0x00)
+#define ADC_V1_DAT(x)		((x) + 0x04)
+#define ADC_V1_INTENB(x)	((x) + 0x08)
+#define ADC_V1_INTCLR(x)	((x) + 0x0c)
+
+/* Bit definitions for ADC_V1 */
+#define ADC_V1_CON_APEN		(1u << 14)
+#define ADC_V1_CON_APSV(x)	(((x) & 0xff) << 6)
+#define ADC_V1_CON_ASEL(x)	(((x) & 0x7) << 3)
+#define ADC_V1_CON_STBY		(1u << 2)
+#define ADC_V1_CON_ADEN		(1u << 0)
+#define ADC_V1_INTENB_ENB	(1u << 0)
+#define ADC_V1_INTCLR_CLR	(1u << 0)
+
+
+/* Register definitions for ADC_V2 */
+#define ADC_V2_CON(x)		((x) + 0x00)
+#define ADC_V2_DAT(x)		((x) + 0x04)
+#define ADC_V2_INTENB(x)	((x) + 0x08)
+#define ADC_V2_INTCLR(x)	((x) + 0x0c)
+#define ADC_V2_PRESCON(x)	((x) + 0x10)
+
+/* Bit definitions for ADC_V2 */
+#define ADC_V2_CON_DATA_SEL(x)	(((x) & 0xf) << 10)
+#define ADC_V2_CON_CLK_CNT(x)	(((x) & 0xf) << 6)
+#define ADC_V2_CON_ASEL(x)	(((x) & 0x7) << 3)
+#define ADC_V2_CON_STBY		(1u << 2)
+#define ADC_V2_CON_ADEN		(1u << 0)
+#define ADC_V2_INTENB_ENB	(1u << 0)
+#define ADC_V2_INTCLR_CLR	(1u << 0)
+#define ADC_V2_PRESCON_APEN	(1u << 15)
+#define ADC_V2_PRESCON_PRES(x)	(((x) & 0x3ff) << 0)
+
+#define ADC_V2_DATA_SEL_VAL	(0)	/* 0:5clk, 1:4clk, 2:3clk, 3:2clk */
+					/* 4:1clk: 5:not delayed, else: 4clk */
+#define ADC_V2_CLK_CNT_VAL	(6)	/* 28nm ADC */
+
+
+/*
+ * ADC data
+ */
+struct nexell_adc_info {
+	struct nexell_adc_data *data;
+	void __iomem *adc_base;
+	ulong clk_rate;
+	ulong sample_rate;
+	ulong max_sample_rate;
+	ulong min_sample_rate;
+	int value;
+	int prescale;
+	spinlock_t lock;
+	struct completion completion;
+	int irq;
+	struct clk *clk;
+	struct iio_map *map;
+	struct reset_control *rst;
+};
+
+struct nexell_adc_data {
+	int version;
+
+	int (*adc_con)(struct nexell_adc_info *adc);
+	int (*read_polling)(struct nexell_adc_info *adc, int ch);
+	int (*read_val)(struct iio_dev *indio_dev,
+			struct iio_chan_spec const *chan,
+			int *val,
+			int *val2,
+			long mask);
+};
+
+static const char * const str_adc_label[] = {
+	"ADC0", "ADC1", "ADC2", "ADC3",
+	"ADC4", "ADC5", "ADC6", "ADC7",
+};
+
+#define ADC_CHANNEL(_index, _id) {			\
+	.type = IIO_VOLTAGE,				\
+	.indexed = 1,					\
+	.channel = _index,				\
+	.address = _index,				\
+	.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),	\
+	.datasheet_name = _id,				\
+}
+
+static struct iio_chan_spec nexell_adc_iio_channels[] = {
+	ADC_CHANNEL(0, "adc0"),
+	ADC_CHANNEL(1, "adc1"),
+	ADC_CHANNEL(2, "adc2"),
+	ADC_CHANNEL(3, "adc3"),
+	ADC_CHANNEL(4, "adc4"),
+	ADC_CHANNEL(5, "adc5"),
+	ADC_CHANNEL(6, "adc6"),
+	ADC_CHANNEL(7, "adc7"),
+};
+
+
+static int nexell_adc_remove_devices(struct device *dev, void *c)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+
+	platform_device_unregister(pdev);
+
+	return 0;
+}
+
+
+static int setup_adc_con(struct nexell_adc_info *adc)
+{
+	if (adc->data->adc_con)
+		adc->data->adc_con(adc);
+
+	return 0;
+}
+
+static void nexell_adc_v1_ch_start(void __iomem *reg, int ch)
+{
+	unsigned int adcon = 0;
+
+	adcon = readl(ADC_V1_CON(reg)) & ~ADC_V1_CON_ASEL(7);
+	adcon &= ~ADC_V1_CON_ADEN;
+	adcon |= ADC_V1_CON_ASEL(ch);	/* channel */
+	writel(adcon, ADC_V1_CON(reg));
+	adcon  = readl(ADC_V1_CON(reg));
+
+	adcon |= ADC_V1_CON_ADEN;	/* start */
+	writel(adcon, ADC_V1_CON(reg));
+}
+
+static int nexell_adc_v1_read_polling(struct nexell_adc_info *adc, int ch)
+{
+	void __iomem *reg = adc->adc_base;
+	unsigned long wait = loops_per_jiffy * (HZ/10);
+
+	nexell_adc_v1_ch_start(reg, ch);
+
+	while (wait > 0) {
+		if (!(readl(ADC_V1_CON(reg)) & ADC_V1_CON_ADEN)) {
+			/* get value */
+			adc->value = readl(ADC_V1_DAT(reg)); /* get value */
+			/* pending clear */
+			writel(ADC_V1_INTCLR_CLR, ADC_V1_INTCLR(reg));
+			break;
+		}
+		wait--;
+	}
+	if (wait == 0)
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+static int nexell_adc_v1_adc_con(struct nexell_adc_info *adc)
+{
+	unsigned int adcon = 0;
+	void __iomem *reg = adc->adc_base;
+
+	adcon = ADC_V1_CON_APSV(adc->prescale);
+        adcon &= ~ADC_V1_CON_STBY;
+	writel(adcon, ADC_V1_CON(reg));
+	adcon |= ADC_V1_CON_APEN;
+	writel(adcon, ADC_V1_CON(reg));
+
+	/* *****************************************************
+	 * Turn-around invalid value after Power On
+	 * *****************************************************/
+	nexell_adc_v1_read_polling(adc, 0);
+	adc->value = 0;
+
+	writel(ADC_V1_INTCLR_CLR, ADC_V1_INTCLR(reg));
+	writel(ADC_V1_INTENB_ENB, ADC_V1_INTENB(reg));
+	init_completion(&adc->completion);
+
+	return 0;
+}
+
+static int nexell_adc_v1_read_val(struct iio_dev *indio_dev,
+		struct iio_chan_spec const *chan,
+		int *val,
+		int *val2,
+		long mask)
+{
+	struct nexell_adc_info *adc = iio_priv(indio_dev);
+	int ch = chan->channel;
+	int ret = 0;
+
+	reinit_completion(&adc->completion);
+
+	if (adc->data->read_polling)
+		ret = adc->data->read_polling(adc, ch);
+	if (ret < 0) {
+		dev_warn(&indio_dev->dev,
+				"Conversion timed out! resetting...\n");
+		reset_control_reset(adc->rst);
+		setup_adc_con(adc);
+		ret = -ETIMEDOUT;
+	}
+
+	return ret;
+}
+
+static const struct nexell_adc_data nexell_adc_s5p4418_data = {
+	.version	= 1,
+	.adc_con	= nexell_adc_v1_adc_con,
+	.read_polling	= nexell_adc_v1_read_polling,
+	.read_val	= nexell_adc_v1_read_val,
+};
+
+static void nexell_adc_v2_ch_start(void __iomem *reg, int ch)
+{
+	unsigned int adcon = 0;
+
+	adcon = readl(ADC_V2_CON(reg)) & ~ADC_V2_CON_ASEL(7);
+	adcon &= ~ADC_V2_CON_ADEN;
+	adcon |= ADC_V2_CON_ASEL(ch);	/* channel */
+	writel(adcon, ADC_V2_CON(reg));
+	adcon  = readl(ADC_V2_CON(reg));
+
+	adcon |= ADC_V2_CON_ADEN;	/* start */
+	writel(adcon, ADC_V2_CON(reg));
+}
+
+static int nexell_adc_v2_read_polling(struct nexell_adc_info *adc, int ch)
+{
+	void __iomem *reg = adc->adc_base;
+	unsigned long wait = loops_per_jiffy * (HZ/10);
+
+	nexell_adc_v2_ch_start(reg, ch);
+
+	while (wait > 0) {
+		if (readl(ADC_V2_INTCLR(reg)) & ADC_V2_INTCLR_CLR) {
+			/* pending clear */
+			writel(ADC_V2_INTCLR_CLR, ADC_V2_INTCLR(reg));
+			/* get value */
+			adc->value = readl(ADC_V2_DAT(reg)); /* get value */
+			break;
+		}
+		wait--;
+	}
+	if (wait == 0)
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+static int nexell_adc_v2_adc_con(struct nexell_adc_info *adc)
+{
+	unsigned int adcon = 0;
+	unsigned int pres = 0;
+	void __iomem *reg = adc->adc_base;
+
+	adcon = ADC_V2_CON_DATA_SEL(ADC_V2_DATA_SEL_VAL) |
+		ADC_V2_CON_CLK_CNT(ADC_V2_CLK_CNT_VAL);
+	adcon &= ~ADC_V2_CON_STBY;
+	writel(adcon, ADC_V2_CON(reg));
+
+	pres = ADC_V2_PRESCON_PRES(adc->prescale);
+	writel(pres, ADC_V2_PRESCON(reg));
+	pres |= ADC_V2_PRESCON_APEN;
+	writel(pres, ADC_V2_PRESCON(reg));
+
+	/* *****************************************************
+	 * Turn-around invalid value after Power On
+	 * *****************************************************/
+	nexell_adc_v2_read_polling(adc, 0);
+	adc->value = 0;
+
+	writel(ADC_V2_INTCLR_CLR, ADC_V2_INTCLR(reg));
+	writel(ADC_V2_INTENB_ENB, ADC_V2_INTENB(reg));
+	init_completion(&adc->completion);
+
+	return 0;
+}
+
+static int nexell_adc_v2_read_val(struct iio_dev *indio_dev,
+		struct iio_chan_spec const *chan,
+		int *val,
+		int *val2,
+		long mask)
+{
+	struct nexell_adc_info *adc = iio_priv(indio_dev);
+	void __iomem *reg = adc->adc_base;
+	int ch = chan->channel;
+	unsigned long timeout;
+	int ret = 0;
+
+	reinit_completion(&adc->completion);
+
+	nexell_adc_v2_ch_start(reg, ch);
+
+	timeout = wait_for_completion_timeout(&adc->completion, ADC_TIMEOUT);
+	if (timeout == 0) {
+		dev_warn(&indio_dev->dev,
+				"Conversion timed out! resetting...\n");
+		reset_control_reset(adc->rst);
+		setup_adc_con(adc);
+		ret = -ETIMEDOUT;
+	}
+
+	return ret;
+}
+
+static const struct nexell_adc_data nexell_adc_s5p6818_data = {
+	.version	= 2,
+	.adc_con	= nexell_adc_v2_adc_con,
+	.read_polling	= nexell_adc_v2_read_polling,
+	.read_val	= nexell_adc_v2_read_val,
+};
+
+
+#ifdef CONFIG_OF
+static const struct of_device_id nexell_adc_match[] = {
+	{
+		.compatible = "nexell,s5p6818-adc",
+		.data = &nexell_adc_s5p6818_data,
+	}, {
+		.compatible = "nexell,s5p4418-adc",
+		.data = &nexell_adc_s5p4418_data,
+	},
+	{}
+};
+MODULE_DEVICE_TABLE(of, nexell_adc_match);
+
+static struct nexell_adc_data *nexell_adc_get_data(struct platform_device *pdev)
+{
+	const struct of_device_id *match;
+
+	match = of_match_node(nexell_adc_match, pdev->dev.of_node);
+	return (struct nexell_adc_data *)match->data;
+}
+#endif
+
+/*
+ * ADC functions
+ */
+static irqreturn_t nexell_adc_v2_isr(int irq, void *dev_id)
+{
+	struct nexell_adc_info *adc = (struct nexell_adc_info *)dev_id;
+	void __iomem *reg = adc->adc_base;
+
+	writel(ADC_V2_INTCLR_CLR, ADC_V2_INTCLR(reg)); /* pending clear */
+	adc->value = readl(ADC_V2_DAT(reg)); /* get value */
+
+	complete(&adc->completion);
+
+	return IRQ_HANDLED;
+}
+
+static int nexell_adc_setup(struct nexell_adc_info *adc,
+		struct platform_device *pdev)
+{
+	ulong min_rate;
+	uint32_t sample_rate;
+	int prescale = 0;
+	int num_ch;
+
+	of_property_read_u32(pdev->dev.of_node, "sample_rate", &sample_rate);
+
+	prescale = (adc->clk_rate) / (sample_rate * ADC_MAX_SAMPLE_BITS);
+	min_rate = (adc->clk_rate) / (ADC_MAX_PRESCALE * ADC_MAX_SAMPLE_BITS);
+
+	if (sample_rate > ADC_MAX_SAMPLE_RATE ||
+			min_rate > sample_rate) {
+		dev_err(&pdev->dev, "not support %u(%d ~ %lu) sample rate\n",
+			sample_rate, ADC_MAX_SAMPLE_RATE, min_rate);
+		return -EINVAL;
+	}
+
+	adc->sample_rate = sample_rate;
+	adc->max_sample_rate = ADC_MAX_SAMPLE_RATE;
+	adc->min_sample_rate = min_rate;
+	adc->prescale = prescale;
+
+	setup_adc_con(adc);
+
+	num_ch = ARRAY_SIZE(nexell_adc_iio_channels);
+	dev_info(&pdev->dev, "CHs %d, %ld(%ld ~ %ld) sample rate, scale=%d(bit %d)\n",
+		num_ch,
+		adc->sample_rate,
+		adc->max_sample_rate, adc->min_sample_rate,
+		prescale, ADC_MAX_SAMPLE_BITS);
+
+	return 0;
+}
+
+static int nexell_read_raw(struct iio_dev *indio_dev,
+		struct iio_chan_spec const *chan,
+		int *val,
+		int *val2,
+		long mask)
+{
+	struct nexell_adc_info *adc = iio_priv(indio_dev);
+	int ret;
+
+	mutex_lock(&indio_dev->mlock);
+
+	if (adc->data->read_val) {
+		ret = adc->data->read_val(indio_dev, chan, val, val2, mask);
+		if (ret < 0)
+			goto out;
+	}
+
+	*val = adc->value;
+	*val2 = 0;
+	ret = IIO_VAL_INT;
+
+	dev_dbg(&indio_dev->dev, "ch=%d, val=0x%x\n", chan->channel, *val);
+
+out:
+	mutex_unlock(&indio_dev->mlock);
+
+	return ret;
+}
+
+static const struct iio_info nexell_adc_iio_info = {
+	.read_raw = &nexell_read_raw,
+	.driver_module = THIS_MODULE,
+};
+
+static int nexell_adc_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	return 0;
+}
+
+static int nexell_adc_resume(struct platform_device *pdev)
+{
+	struct iio_dev *indio_dev = platform_get_drvdata(pdev);
+	struct nexell_adc_info *adc = iio_priv(indio_dev);
+
+	reset_control_reset(adc->rst);
+
+	setup_adc_con(adc);
+
+	return 0;
+}
+
+
+static int nexell_adc_probe(struct platform_device *pdev)
+{
+	struct iio_dev *iio = NULL;
+	struct nexell_adc_info *adc = NULL;
+	struct iio_chan_spec *spec;
+	struct resource	*mem;
+	struct device_node *np = pdev->dev.of_node;
+	int i = 0, irq;
+	int ret = -ENODEV;
+
+	if (!np)
+		return ret;
+
+	iio = devm_iio_device_alloc(&pdev->dev, sizeof(struct nexell_adc_info));
+	if (!iio) {
+		dev_err(&pdev->dev, "failed allocating iio ADC device\n");
+		return -ENOMEM;
+	}
+
+	adc = iio_priv(iio);
+
+	adc->data = nexell_adc_get_data(pdev);
+	if (!adc->data) {
+		dev_err(&pdev->dev, "failed getting nexell ADC data\n");
+		return -EINVAL;
+	}
+
+	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	adc->adc_base = devm_ioremap_resource(&pdev->dev, mem);
+	if (IS_ERR(adc->adc_base))
+		return PTR_ERR(adc->adc_base);
+
+	/* setup: clock */
+	adc->clk = devm_clk_get(&pdev->dev, "adc");
+	if (IS_ERR(adc->clk)) {
+		dev_err(&pdev->dev, "failed getting clock for ADC\n");
+		return PTR_ERR(adc->clk);
+	}
+	adc->clk_rate = clk_get_rate(adc->clk);
+	clk_prepare_enable(adc->clk);
+
+
+	/* setup: reset */
+	adc->rst = devm_reset_control_get(&pdev->dev, "adc-reset");
+	if (IS_ERR(adc->rst)) {
+		dev_err(&pdev->dev, "failed to get reset\n");
+		return PTR_ERR(adc->rst);
+	}
+
+	reset_control_reset(adc->rst);
+
+
+	/* setup: irq */
+	if (adc->data->version == 2) {
+		irq = platform_get_irq(pdev, 0);
+		if (irq < 0) {
+			dev_err(&pdev->dev, "failed get irq resource\n");
+			goto err_unprepare_clk;
+		}
+
+		ret = devm_request_irq(&pdev->dev, irq, nexell_adc_v2_isr,
+				0, dev_name(&pdev->dev), adc);
+		if (ret < 0) {
+			dev_err(&pdev->dev, "failed get irq (%d)\n", irq);
+			goto err_unprepare_clk;
+		}
+
+		adc->irq = irq;
+	}
+
+	/* setup: adc */
+	ret = nexell_adc_setup(adc, pdev);
+	if (0 > ret) {
+		dev_err(&pdev->dev, "failed setup iio ADC device\n");
+		goto err_unprepare_clk;
+	}
+
+	platform_set_drvdata(pdev, iio);
+
+	iio->name = dev_name(&pdev->dev);
+	iio->dev.parent = &pdev->dev;
+	iio->info = &nexell_adc_iio_info;
+	iio->modes = INDIO_DIRECT_MODE;
+	iio->channels = nexell_adc_iio_channels;
+	iio->num_channels = ARRAY_SIZE(nexell_adc_iio_channels);
+	iio->dev.of_node = pdev->dev.of_node;
+
+	/*
+	 * sys interface : user interface
+	 */
+	spec = nexell_adc_iio_channels;
+	for (i = 0; iio->num_channels > i; i++)
+		spec[i].datasheet_name = str_adc_label[i];
+
+	ret = devm_iio_device_register(&pdev->dev, iio);
+	if (ret)
+		goto err_unprepare_clk;
+
+
+	ret = of_platform_populate(np, nexell_adc_match, NULL, &pdev->dev);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed adding child nodes\n");
+		goto err_of_populate;
+	}
+
+	dev_dbg(&pdev->dev, "ADC init success\n");
+
+	return 0;
+
+err_of_populate:
+	device_for_each_child(&pdev->dev, NULL,
+			nexell_adc_remove_devices);
+err_unprepare_clk:
+	clk_disable_unprepare(adc->clk);
+
+	return ret;
+}
+
+static int nexell_adc_remove(struct platform_device *pdev)
+{
+	struct iio_dev *iio = platform_get_drvdata(pdev);
+	struct nexell_adc_info *adc = iio_priv(iio);
+
+	device_for_each_child(&pdev->dev, NULL,
+			nexell_adc_remove_devices);
+	clk_disable_unprepare(adc->clk);
+	platform_set_drvdata(pdev, NULL);
+
+	return 0;
+}
+
+static struct platform_driver nexell_adc_driver = {
+	.probe		= nexell_adc_probe,
+	.remove		= nexell_adc_remove,
+	.suspend	= nexell_adc_suspend,
+	.resume		= nexell_adc_resume,
+	.driver		= {
+		.name	= "nexell-adc",
+		.owner	= THIS_MODULE,
+		.of_match_table = nexell_adc_match,
+	},
+};
+
+module_platform_driver(nexell_adc_driver);
+
+MODULE_AUTHOR("Bon-gyu, KOO <freestyle@nexell.co.kr>");
+MODULE_DESCRIPTION("ADC driver for the Nexell s5pxx18");
+MODULE_LICENSE("GPL v2");
diff -ENwbur a/drivers/input/touchscreen/himax_ts.c b/drivers/input/touchscreen/himax_ts.c
--- a/drivers/input/touchscreen/himax_ts.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/input/touchscreen/himax_ts.c	2018-05-06 08:49:49.882723986 +0200
@@ -0,0 +1,535 @@
+/*
+ * Touch Screen driver for Himax touchscreen controllers used in
+ * DataImage's I2C connected touchscreen panels.
+ *   Copyright (c) 2012 Anders Electronics
+ *   Copyright 2012 CompuLab Ltd, Dmitry Lifshitz <lifshitz@compulab.co.il>
+ *
+ * Based on migor_ts.c
+ *   Copyright (c) 2008 Magnus Damm
+ *   Copyright (c) 2007 Ujjwal Pande <ujjwal@kenati.com>
+ *
+ * This file is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU  General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc.
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/input.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/pm.h>
+#include <linux/slab.h>
+#include <linux/io.h>
+#include <linux/i2c.h>
+#include <linux/timer.h>
+#include <linux/input/mt.h>
+
+
+#define HX_MAX_X        480
+#define HX_MAX_Y        800
+
+#define HX_PNT_SIZE     4
+#define HX_EMPTY        0xFFFF
+
+#ifndef CONFIG_TOUCHSCREEN_HIMAX_SINGLE
+#define CONFIG_HIMAX_MULTITOUCH		1
+#endif
+
+struct himax_ts_initseq_entry {
+    char *cmd;
+    int count;
+    int delay_ms;
+};
+
+struct himax_ts_props_entry {
+    int model;
+    struct himax_ts_initseq_entry *initseq;
+    int initseq_size;
+    int packet_size;
+    int touch_points;
+    bool invert_x;
+    bool invert_y;
+    bool xy_order;
+};
+
+struct himax_ts_priv {
+    struct i2c_client *client;
+    struct himax_ts_props_entry *ts_props;
+    struct input_dev *input;
+    int prev_touches;
+    int irq;
+    char *buf;
+};
+
+static char hx85x_ic_poweron_cmd[]  = {0x81};
+static char hx85x_mcu_poweron_cmd[] = {0x35, 0x02};
+static char hx85x_senseon_cmd[]     = {0x83};
+static char hx85x_senseoff_cmd[]    = {0x82};
+static char hx85x_get_id_cmd[]      = {0x31};
+static char hx85x_get_event_cmd[]   = {0x85};
+static char hx85x_get_sleep_cmd[]   = {0x63};
+
+static char hx8526_flash_poweron_cmd[]  = {0x36, 0x0F, 0x53};
+static char hx8526_fetch_flash_cmd[]    = {0xDD, 0x04, 0x02};
+
+static char hx8520_flash_poweron_cmd[]  = {0x36, 0x01};
+static char hx8520_speed_mode_cmd[] = {0x9D, 0x80};
+
+static struct himax_ts_initseq_entry hx8526_initseq[] = {
+    {hx85x_ic_poweron_cmd,     ARRAY_SIZE(hx85x_ic_poweron_cmd), 120},
+    {hx85x_mcu_poweron_cmd,    ARRAY_SIZE(hx85x_mcu_poweron_cmd), 10},
+    {hx8526_flash_poweron_cmd, ARRAY_SIZE(hx8526_flash_poweron_cmd), 10},
+    {hx8526_fetch_flash_cmd,   ARRAY_SIZE(hx8526_fetch_flash_cmd), 10},
+};
+
+static struct himax_ts_initseq_entry hx8520_initseq[] = {
+    {hx85x_ic_poweron_cmd,     ARRAY_SIZE(hx85x_ic_poweron_cmd), 120},
+    {hx8520_speed_mode_cmd,    ARRAY_SIZE(hx8520_speed_mode_cmd), 10},
+    {hx85x_mcu_poweron_cmd,    ARRAY_SIZE(hx85x_mcu_poweron_cmd), 10},
+    {hx8520_flash_poweron_cmd, ARRAY_SIZE(hx8520_flash_poweron_cmd), 10},
+};
+
+static struct himax_ts_props_entry himax_ts_props[] = {
+    {
+        .model      = 0x8520,
+        .initseq    = hx8520_initseq,
+        .initseq_size   = ARRAY_SIZE(hx8520_initseq),
+        .packet_size    = 16,
+        .touch_points   = 2,
+        .invert_y   = true,
+    },
+    {
+        .model      = 0x8526,
+        .initseq    = hx8526_initseq,
+        .initseq_size   = ARRAY_SIZE(hx8526_initseq),
+        .packet_size    = 32,
+        .touch_points   = 5,
+        .xy_order   = true,
+    },
+    {
+        .model      = 0x8528,
+        .initseq    = hx8526_initseq,
+        .initseq_size   = ARRAY_SIZE(hx8526_initseq),
+        .packet_size    = 16,
+        .touch_points   = 2,
+        .xy_order   = true,
+    },
+};
+
+static void himax_ts_set_coords(struct himax_ts_props_entry *props,
+                u32 *px, u32 *py)
+{
+    u32 x = *px;
+    u32 y = *py;
+
+    if (!props->xy_order)
+        swap(x, y);
+
+    if (props->invert_x && x != HX_EMPTY)
+        x = HX_MAX_X - x;
+
+    if (props->invert_y && y != HX_EMPTY)
+        y = HX_MAX_Y - y;
+
+    *px = x;
+    *py = y;
+}
+
+static irqreturn_t himax_ts_isr(int irq, void *data)
+{
+    struct himax_ts_priv *priv = data;
+    struct himax_ts_props_entry *props = priv->ts_props;
+    struct input_dev *input = priv->input;
+    int packet_size = props->packet_size;
+    char *buf = priv->buf;
+    int curr_touches, touch_count;
+    u32 x, y;
+#ifdef CONFIG_HIMAX_MULTITOUCH
+	bool was_touched, now_touched, report_event;
+	int i ;
+#endif
+
+    memset(buf, 0, packet_size);
+
+    if (i2c_master_send(priv->client, hx85x_get_event_cmd, 1) != 1) {
+        dev_err(&priv->client->dev, "Unable to write get event cmd\n");
+        return IRQ_HANDLED;
+    }
+
+    if (i2c_master_recv(priv->client, buf, packet_size) != packet_size) {
+        dev_err(&priv->client->dev, "Unable to read events data\n");
+        return IRQ_HANDLED;
+    }
+
+    /*
+     * Two last bytes in the buffer correspond to invalid data. Next two
+     * from the end, correspond to touch counter and touch points ids.
+     */
+
+    /* Retrieve touch points counter. 0x0F corresponds to 0 touches */
+    touch_count = buf[packet_size - 2 - 2] & 0x0F;
+    if (touch_count == 0x0F)
+        touch_count = 0;
+
+    /* According to the Himax code examples, this value can be invalid */
+    if (touch_count > props->touch_points)
+        return IRQ_HANDLED;
+
+    /* Retrieve touch points ids. 0xFF corresponds to 0 touches */
+    curr_touches = buf[packet_size - 2 - 1];
+    if (curr_touches == 0xFF)
+        curr_touches = 0;
+
+#ifdef CONFIG_HIMAX_MULTITOUCH
+    for (i = 0; i < props->touch_points; i++) {
+        x = (buf[i * HX_PNT_SIZE + 0] << 8) | buf[i * HX_PNT_SIZE + 1];
+        y = (buf[i * HX_PNT_SIZE + 2] << 8) | buf[i * HX_PNT_SIZE + 3];
+
+        himax_ts_set_coords(props, &x, &y);
+
+        report_event = false;
+        was_touched = priv->prev_touches & (1 << i);
+        now_touched = curr_touches & (1 << i);
+
+        /* Check for touch state and coordinates consistency */
+        if (now_touched && (x <= HX_MAX_X && y <= HX_MAX_Y)) {
+            report_event = true;
+			dev_dbg(&priv->client->dev, "# %d x=%d y=%d", i, x, y);
+        } else if (was_touched && (x == HX_EMPTY && y == HX_EMPTY)) {
+            report_event = true;
+            dev_dbg(&priv->client->dev, "# %d released", i);
+        }
+
+        if (report_event) {
+            if (now_touched) {
+				input_report_abs(input, ABS_MT_POSITION_X, x);
+				input_report_abs(input, ABS_MT_POSITION_Y, y);
+
+				input_report_abs(input, ABS_MT_PRESSURE, 200);
+				input_report_abs(input, ABS_MT_TOUCH_MAJOR, 200);
+				input_report_abs(input, ABS_MT_TRACKING_ID, i);
+            }
+            input_mt_sync(input);
+        }
+    }
+#else
+	if (touch_count == 1) {
+		x = (buf[0 * HX_PNT_SIZE + 0] << 8) | buf[0 * HX_PNT_SIZE + 1];
+    	y = (buf[0 * HX_PNT_SIZE + 2] << 8) | buf[0 * HX_PNT_SIZE + 3];
+
+    	himax_ts_set_coords(props, &x, &y);
+    	input_report_abs(input, ABS_X, x);
+		input_report_abs(input, ABS_Y, y);
+		input_report_abs(input, ABS_PRESSURE, 200);
+		input_report_key(input, BTN_TOUCH, 1);
+    } else if (touch_count == 0) {
+    	input_report_abs(input, ABS_PRESSURE, 0);
+		input_report_key(input, BTN_TOUCH, 0);
+    }
+#endif
+    input_sync(input);
+
+    priv->prev_touches = curr_touches;
+
+    return IRQ_HANDLED;
+}
+
+static int himax_ts_setup(struct himax_ts_priv *priv)
+{
+    struct himax_ts_props_entry *props = priv->ts_props;
+    struct i2c_client *client = priv->client;
+    char *cmd = hx85x_get_sleep_cmd;
+    char buf = 0x00;
+    int count, i;
+
+    if (i2c_master_send(client, cmd, 1) != 1)
+        goto err_stop_seq;
+
+    if (i2c_master_recv(client, &buf, 1) != 1) {
+        dev_err(&client->dev, "Failed to read get sleep data\n");
+        return -EBUSY;
+    }
+
+    if (buf != 0) {
+        dev_dbg(&client->dev, "already initialized 0x%02X\n", buf);
+        return 0;
+    }
+
+    for (i = 0; i < props->initseq_size; i++) {
+        cmd = props->initseq[i].cmd;
+        count = props->initseq[i].count;
+
+        if (i2c_master_send(client, cmd, count) != count)
+            goto err_stop_seq;
+
+        msleep(props->initseq[i].delay_ms);
+    }
+
+    return 0;
+
+err_stop_seq:
+    dev_err(&client->dev, "Failed to send I2C command 0x%02X\n", cmd[0]);
+    return -EBUSY;
+}
+
+static int himax_ts_open(struct input_dev *dev)
+{
+    struct himax_ts_priv *priv = input_get_drvdata(dev);
+    struct i2c_client *client = priv->client;
+
+    if (i2c_master_send(client, hx85x_senseon_cmd, 1) != 1) {
+        dev_err(&priv->client->dev, "failed to write sense on cmd\n");
+        return -EBUSY;
+    }
+
+    msleep(100);
+
+    return 0;
+}
+
+static void himax_ts_close(struct input_dev *dev)
+{
+    struct himax_ts_priv *priv = input_get_drvdata(dev);
+    struct i2c_client *client = priv->client;
+
+    if (i2c_master_send(client, hx85x_senseoff_cmd, 1) != 1)
+        dev_err(&priv->client->dev, "failed to write sense off cmd\n");
+}
+
+static struct input_dev *himax_ts_init_input(struct himax_ts_priv *priv)
+{
+    struct input_dev *input;
+
+    input = input_allocate_device();
+    if (!input) {
+        dev_err(&priv->client->dev, "Failed to allocate input dev\n");
+        return NULL;
+    }
+
+    input->name = priv->client->name;
+    input->phys = priv->client->adapter->name,
+    input->id.bustype = BUS_I2C;
+    input->dev.parent = &priv->client->dev;
+    input->open = himax_ts_open;
+    input->close = himax_ts_close;
+
+	set_bit(EV_SYN, input->evbit);
+	set_bit(EV_ABS, input->evbit);
+	set_bit(EV_KEY, input->evbit);
+
+#ifdef CONFIG_HIMAX_MULTITOUCH
+	set_bit(ABS_MT_TRACKING_ID, input->absbit);
+	set_bit(ABS_MT_TOUCH_MAJOR, input->absbit);
+	set_bit(ABS_MT_WIDTH_MAJOR, input->absbit);
+	set_bit(ABS_MT_POSITION_X, input->absbit);
+	set_bit(ABS_MT_POSITION_Y, input->absbit);
+	set_bit(INPUT_PROP_DIRECT, input->propbit);
+
+	input_set_abs_params(input, ABS_MT_POSITION_X, 0, HX_MAX_X, 0, 0);
+	input_set_abs_params(input, ABS_MT_POSITION_Y, 0, HX_MAX_Y, 0, 0);
+	input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 0xFF, 0, 0);
+	input_set_abs_params(input, ABS_MT_WIDTH_MAJOR, 0, 200, 0, 0);
+	input_set_abs_params(input, ABS_MT_TRACKING_ID, 0, priv->ts_props->touch_points, 0, 0);
+#else
+	set_bit(ABS_X, input->absbit);
+	set_bit(ABS_Y, input->absbit);
+	set_bit(ABS_PRESSURE, input->absbit);
+	set_bit(BTN_TOUCH, input->keybit);
+
+	input_set_abs_params(input, ABS_X, 0, HX_MAX_X, 0, 0);
+	input_set_abs_params(input, ABS_Y, 0, HX_MAX_Y, 0, 0);
+	input_set_abs_params(input, ABS_PRESSURE, 0, 0xFF, 0, 0);
+#endif
+    input_set_drvdata(input, priv);
+
+    return input;
+}
+
+static int himax_ts_probe(struct i2c_client *client,
+            const struct i2c_device_id *idp)
+{
+    struct himax_ts_priv *priv;
+    struct himax_ts_props_entry *ts_props = NULL;
+    int error, i;
+    char buf[3];
+    int chip_model;
+
+    if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+        dev_err(&client->dev, "I2C_FUNC_I2C check failed\n");
+        return -EBUSY;
+    }
+
+    if (i2c_master_send(client, hx85x_get_id_cmd, 1) == 1 &&
+        i2c_master_recv(client, buf, 3) == 3) {
+        dev_info(&client->dev, "Found device ID: 0x%02X%02X%02X\n",
+             buf[0], buf[1], buf[2]);
+    } else {
+        dev_err(&client->dev, "Unable to get DevId\n");
+        return -ENODEV;
+    }
+
+    chip_model = (buf[0] << 8) | buf[1];
+
+    for (i = 0; i < ARRAY_SIZE(himax_ts_props); i++) {
+        if (chip_model == himax_ts_props[i].model) {
+            ts_props = &himax_ts_props[i];
+            break;
+        }
+    }
+
+    if (!ts_props) {
+        dev_err(&client->dev, "Unsupported device model\n");
+        return -ENODEV;
+    } else if (ts_props->model != idp->driver_data) {
+        dev_warn(&client->dev,
+        "Requested model 0x%04X not found, proceed with 0x%04X setup\n",
+            (unsigned int)idp->driver_data, ts_props->model);
+    }
+
+    priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+    if (!priv) {
+        dev_err(&client->dev, "failed to allocate driver data\n");
+        return -ENOMEM;
+    }
+
+    priv->client = client;
+    priv->irq = client->irq;
+    priv->ts_props = ts_props;
+
+    error = himax_ts_setup(priv);
+    if (error)
+        goto err_free_mem;
+
+    priv->buf = kzalloc(priv->ts_props->packet_size, GFP_KERNEL);
+    if (!priv->buf) {
+        dev_err(&client->dev, "failed to allocate read buffer\n");
+        error = -ENOMEM;
+        goto err_free_mem;
+    }
+
+    priv->input = himax_ts_init_input(priv);
+    if (!priv->input) {
+        error = -ENOMEM;
+        goto err_free_mem;
+    }
+
+    error = input_register_device(priv->input);
+    if (error) {
+        dev_err(&client->dev, "Failed to register input device.\n");
+        goto err_free_mem;
+    }
+
+    error = request_threaded_irq(priv->irq, NULL, himax_ts_isr,
+                    IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+                    client->name, priv);
+    if (error) {
+        dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
+        goto err_free_dev;
+    }
+
+    i2c_set_clientdata(client, priv);
+    device_init_wakeup(&client->dev, 1);
+    return 0;
+
+err_free_dev:
+    input_unregister_device(priv->input);
+    priv->input = NULL;
+err_free_mem:
+    input_free_device(priv->input);
+    kfree(priv->buf);
+    kfree(priv);
+
+    return error;
+}
+
+static int himax_ts_remove(struct i2c_client *client)
+{
+    struct himax_ts_priv *priv = i2c_get_clientdata(client);
+
+    free_irq(priv->irq, priv);
+    i2c_set_clientdata(client, NULL);
+    input_unregister_device(priv->input);
+    kfree(priv->buf);
+    kfree(priv);
+
+    return 0;
+}
+
+static int himax_ts_suspend(struct device *dev)
+{
+    struct i2c_client *client = to_i2c_client(dev);
+    struct himax_ts_priv *priv = i2c_get_clientdata(client);
+
+    if (device_may_wakeup(&client->dev))
+        enable_irq_wake(priv->irq);
+    else if (i2c_master_send(client, hx85x_senseoff_cmd, 1) != 1)
+        dev_err(&priv->client->dev, "failed to write sense off cmd\n");
+
+    return 0;
+}
+
+static int himax_ts_resume(struct device *dev)
+{
+    struct i2c_client *client = to_i2c_client(dev);
+    struct himax_ts_priv *priv = i2c_get_clientdata(client);
+
+    himax_ts_setup(priv);
+
+    if (i2c_master_send(client, hx85x_senseon_cmd, 1) != 1)
+        dev_err(&priv->client->dev, "failed to write sense on cmd\n");
+
+    msleep(100);
+
+    if (device_may_wakeup(&client->dev))
+        disable_irq_wake(priv->irq);
+
+    return 0;
+}
+
+static SIMPLE_DEV_PM_OPS(himax_ts_pm, himax_ts_suspend, himax_ts_resume);
+
+static const struct i2c_device_id himax_ts_id[] = {
+    { "hx8520-c"    , 0x8520 },
+    { "hx8526-a"    , 0x8526 },
+    { "hx8528-a"    , 0x8528 },
+    { },
+};
+
+MODULE_DEVICE_TABLE(i2c, himax_ts_id);
+
+static struct i2c_driver himax_ts_driver = {
+    .driver = {
+        .owner = THIS_MODULE,
+        .name = "himax_ts",
+        .pm = &himax_ts_pm,
+    },
+    .probe = himax_ts_probe,
+    .remove = himax_ts_remove,
+    .id_table = himax_ts_id,
+};
+
+static int __init himax_ts_init(void)
+{
+    return i2c_add_driver(&himax_ts_driver);
+}
+
+static void __exit himax_ts_exit(void)
+{
+    i2c_del_driver(&himax_ts_driver);
+}
+
+module_init(himax_ts_init);
+module_exit(himax_ts_exit);
+
+MODULE_DESCRIPTION("Himax Touchscreen driver");
+MODULE_LICENSE("GPL v2");
diff -ENwbur a/drivers/input/touchscreen/it7260_mts.c b/drivers/input/touchscreen/it7260_mts.c
--- a/drivers/input/touchscreen/it7260_mts.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/input/touchscreen/it7260_mts.c	2018-05-06 08:49:49.882723986 +0200
@@ -0,0 +1,452 @@
+/*
+ * multi touch screen driver for it7260
+ * base on multi-touch protocol A
+ *
+ * Copyright (C) Guangzhou FriendlyARM Computer Tech. Co., Ltd.
+ * (http://www.friendlyarm.com)
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/pm.h>
+#include <linux/slab.h>
+#include <asm/io.h>
+#include <linux/i2c.h>
+#include <linux/timer.h>
+
+/* buffer address */
+#define CMD_BUF		0x20	/* command buffer (write only) */
+#define SYS_CMD_BUF	0x40	/* systerm command buffer (write only) */
+#define QUERY_BUF	0x80	/* query buffer (read only) */
+#define CMD_RSP_BUF	0xA0	/* command response buffer (read only) */
+#define SYS_CMD_RSP_BUF	0xC0	/* systerm command response buffer (read only) */
+#define POINT_INFO_BUF	0xE0	/* point information buffer (read only) */
+
+struct it7260_ts_priv {
+	struct i2c_client *client;
+	struct input_dev *input;
+	struct delayed_work work;
+	struct mutex mutex;
+	int irq;
+};
+
+/**
+* i2c_master_read_it7260 - issue two I2C message in master receive mode
+* @client: handler to slave device
+* @buf_index: buffer address
+* @buf_data: where to store data read from slave
+* @len_data: the bytes of buf_data to read
+*
+* returns negative errno, or else the number of bytes read
+*/
+static int i2c_master_read_it7260(struct i2c_client *client,
+		unsigned char buf_index, unsigned char *buf_data,
+		unsigned short len_data)
+{
+	int ret;
+	struct i2c_msg msgs[2] = {
+		{
+			.addr = client->addr,
+			.flags = I2C_M_NOSTART,
+			.len = 1,
+			.buf = &buf_index,
+		},
+		{
+			.addr = client->addr,
+			.flags = I2C_M_RD,
+			.len = len_data,
+			.buf = buf_data,
+		}
+	};
+
+	ret = i2c_transfer(client->adapter, msgs, 2);
+
+	return (ret == 2) ? len_data : ret;
+}
+
+/**
+* i2c_master_write_it7260 - issue a single I2C message in master transmit mode
+* @client: handler to slave device
+* @buf_index: buffer address
+* @buf_data: data that wile be write to the slave
+* @len_data: the bytes of buf_data to write
+*
+* returns negative errno, or else the number of bytes written
+*/
+static int i2c_master_write_it7260(struct i2c_client *client,
+		unsigned char buf_index, unsigned char const *buf_data,
+		unsigned short len_data)
+{
+	unsigned char buf[2];
+	int ret;
+
+	struct i2c_msg msgs[1] = {
+		{
+			.addr = client->addr,
+			.flags = 0, /* default write flag */
+			.len = len_data + 1,
+			.buf = buf,
+		}
+	};
+
+	buf[0] = buf_index;
+	memcpy(&buf[1], buf_data, len_data);
+
+	ret = i2c_transfer(client->adapter, msgs, 1);
+
+	return (ret == 1) ? sizeof(buf) : ret;
+}
+
+/**
+* it7260_ts_poscheck - delayed work
+*
+* get the informations of contacts from slave and report it
+*/
+#define PT_MAX		3
+static void it7260_ts_poscheck(struct work_struct *work)
+{
+	struct it7260_ts_priv *priv = container_of(work,
+							struct it7260_ts_priv, work.work);
+	unsigned char buf[14];
+	unsigned short xpos[PT_MAX] = {0}, ypos[PT_MAX] = {0};
+	unsigned char event[PT_MAX] = {0};
+	unsigned char query = 0;
+	int touch_point = 0;
+	int ret, i;
+
+	mutex_lock(&priv->mutex);
+
+	i2c_master_read_it7260(priv->client, QUERY_BUF, &query, 1);
+	if (!(query & 0x80)) {
+		goto up;
+	}
+
+	memset(buf, 0, sizeof(buf));
+
+	ret = i2c_master_read_it7260(priv->client, POINT_INFO_BUF, buf, 14);
+	if (ret != 14) {
+		dev_err(&priv->client->dev, "failed to read point info buffer\n");
+		goto out;
+	}
+
+	/* touch key */
+	if (buf[0] == 0x41) {
+		dev_dbg(&priv->client->dev, "the key number %d\n", buf[1]);
+		if (buf[1] == 0x04)
+			input_report_key(priv->input, KEY_MENU, !!buf[2]);
+		else if (buf[1] == 0x03)
+			input_report_key(priv->input, KEY_HOMEPAGE, !!buf[2]);
+		else if (buf[1] == 0x02)
+			input_report_key(priv->input, KEY_BACK, !!buf[2]);
+		else if (buf[1] == 0x01)
+			input_report_key(priv->input, KEY_SEARCH, !!buf[2]);
+		else
+			goto out;
+
+		goto sync;
+	}
+
+	/* finger 0 */
+	if (buf[0] & 0x01) {
+		xpos[0] = ((buf[3] & 0x0F) << 8) | buf[2];
+		ypos[0] = ((buf[3] & 0xF0) << 4) | buf[4];
+		event[0] = buf[5] & 0x0F;
+	}
+
+	/* finger 1 */
+	if (buf[0] & 0x02) {
+		xpos[1] = ((buf[7] & 0x0F) << 8) | buf[6];
+		ypos[1] = ((buf[7] & 0xF0) << 4) | buf[8];
+		event[1] = buf[9] & 0x0F;
+	}
+
+	/* finger 2 */
+	if (buf[0] & 0x04) {
+		xpos[2] = ((buf[11] & 0x0F) << 8) | buf[10];
+		ypos[2] = ((buf[11] & 0xF0) << 4) | buf[12];
+		event[2] = buf[13] & 0x0F;
+	}
+
+	for (i = 0; i < PT_MAX; i++) {
+		if (xpos[i] || ypos[i] || event[i]) {
+			touch_point++;
+#ifdef CONFIG_TOUCHSCREEN_IT7260_SINGLE
+			input_report_abs(priv->input, ABS_X, xpos[i]);
+			input_report_abs(priv->input, ABS_Y, ypos[i]);
+			input_report_abs(priv->input, ABS_PRESSURE, (event[i] << 4));
+			input_report_key(priv->input, BTN_TOUCH, 1);
+			break;
+#else
+			input_report_abs(priv->input, ABS_MT_POSITION_X, xpos[i]);
+			input_report_abs(priv->input, ABS_MT_POSITION_Y, ypos[i]);
+			input_report_abs(priv->input, ABS_MT_PRESSURE,   (event[i] << 4));
+			input_report_abs(priv->input, ABS_MT_TOUCH_MAJOR, event[i]);
+			input_report_abs(priv->input, ABS_MT_TRACKING_ID, i);
+			input_mt_sync(priv->input);
+#endif
+#if 0
+			printk("finger %d >  (%4d, %4d),  event = %d\n",
+					i, ypos[i], xpos[i], event[i]);
+#endif
+		}
+	}
+
+up:
+	if (!touch_point) {
+		/* All fingers are removed */
+#ifdef CONFIG_TOUCHSCREEN_IT7260_SINGLE
+		input_report_abs(priv->input, ABS_PRESSURE, 0);
+		input_report_key(priv->input, BTN_TOUCH, 0);
+#else
+		input_mt_sync(priv->input);
+#endif
+	}
+
+sync:
+	input_sync(priv->input);
+
+out:
+	mutex_unlock(&priv->mutex);
+	enable_irq(priv->irq);
+}
+
+static irqreturn_t it7260_ts_isr(int irq, void *dev_id)
+{
+	struct it7260_ts_priv *priv = dev_id;
+
+	disable_irq_nosync(irq);
+	schedule_delayed_work(&priv->work, HZ / 50);
+
+	return IRQ_HANDLED;
+}
+
+/**
+* it7260_identify_capsensor - identify capacitance sensor model
+*
+* returns error ENODEV, or else success 0
+*/
+static int it7260_identify_capsensor(struct i2c_client *client)
+{
+	unsigned char buf[16] = {0};
+	unsigned char query = 0;
+	unsigned retry = 0;
+
+	do {
+		i2c_master_read_it7260(client, QUERY_BUF, &query, 1);
+	} while (query & 0x01 && ++retry < 2000);
+
+	if( query & 1 ) {
+		dev_info(&client->dev, "no chip found");
+		return -ENODEV;
+	}
+	/* 0x00: the command of identify cap sensor */
+	buf[0] = 0x00;
+	i2c_master_write_it7260(client, CMD_BUF, buf, 1);
+
+	retry = 0;
+	do {
+		i2c_master_read_it7260(client, QUERY_BUF, &query, 1);
+	} while (query & 0x01 && ++retry < 2000);
+
+	if( query & 1 ) {
+		dev_info(&client->dev, "chip read error");
+		return -ENODEV;
+	}
+	memset(&buf, 0, sizeof(buf));
+
+	i2c_master_read_it7260(client, CMD_RSP_BUF, buf, 10);
+	dev_info(&client->dev, "Found chip %s\n", &buf[1]);
+
+	if (buf[1] != 'I' || buf[2] != 'T' || buf[3] != 'E')
+		return -ENODEV;
+
+	return 0;
+}
+
+static int it7260_ts_probe(struct i2c_client *client,
+			const struct i2c_device_id *idp)
+{
+	struct it7260_ts_priv *priv;
+	struct input_dev *input;
+	int error;
+
+	error = it7260_identify_capsensor(client);
+	if (error) {
+		dev_err(&client->dev, "cannot identify the touch screen\n");
+		goto err0;
+	}
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv) {
+		dev_err(&client->dev, "failed to allocate driver data\n");
+		error = -ENOMEM;
+		goto err0;
+	}
+
+	mutex_init(&priv->mutex);
+
+	dev_set_drvdata(&client->dev, priv);
+
+	input = input_allocate_device();
+	if (!input) {
+		dev_err(&client->dev, "failed to allocate input device\n");
+		error = -ENOMEM;
+		goto err1;
+	}
+
+	input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+
+	input_set_capability(input, EV_KEY, KEY_MENU);
+	input_set_capability(input, EV_KEY, KEY_BACK);
+	input_set_capability(input, EV_KEY, KEY_HOMEPAGE);
+	input_set_capability(input, EV_KEY, KEY_SEARCH);
+
+#ifdef CONFIG_TOUCHSCREEN_IT7260_SINGLE
+	set_bit(ABS_X, input->absbit);
+	set_bit(ABS_Y, input->absbit);
+	set_bit(ABS_PRESSURE, input->absbit);
+	set_bit(BTN_TOUCH, input->keybit);
+
+	input_set_abs_params(input, ABS_X, 0, 1024, 0, 0);
+	input_set_abs_params(input, ABS_Y, 0,  600, 0, 0);
+	input_set_abs_params(input, ABS_PRESSURE, 0, 255, 0, 0);
+#else
+	input_set_abs_params(input, ABS_MT_POSITION_X, 0, 1024, 0, 0);
+	input_set_abs_params(input, ABS_MT_POSITION_Y, 0,  600, 0, 0);
+	input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0,  16, 0, 0);
+	input_set_abs_params(input, ABS_MT_WIDTH_MAJOR, 0, 2, 0, 0);
+	input_set_abs_params(input, ABS_MT_TRACKING_ID, 0, 5, 0, 0);
+#endif
+
+	input->name = "it7260_ts";
+	input->phys = "I2C";
+	input->id.bustype = BUS_I2C;
+
+	input_set_drvdata(input, priv);
+
+	priv->client = client;
+	priv->input = input;
+	INIT_DELAYED_WORK(&priv->work, it7260_ts_poscheck);
+	priv->irq = client->irq;
+
+	error = input_register_device(input);
+	if (error) {
+		dev_err(&client->dev, "failed to register input device\n");
+		goto err1;
+	}
+
+	error = request_irq(priv->irq, it7260_ts_isr, IRQF_TRIGGER_LOW,
+						client->name, priv);
+	if (error) {
+		dev_err(&client->dev, "unable to request touchscreen IRQ\n");
+		goto err2;
+	}
+
+	device_init_wakeup(&client->dev, 1);
+	return 0;
+
+err2:
+	input_unregister_device(input);
+	input = NULL;
+err1:
+	input_free_device(input);
+	kfree(priv);
+err0:
+	dev_set_drvdata(&client->dev, NULL);
+	return error;
+}
+
+static int it7260_ts_remove(struct i2c_client *client)
+{
+	struct it7260_ts_priv *priv = dev_get_drvdata(&client->dev);
+
+	free_irq(priv->irq, priv);
+	input_unregister_device(priv->input);
+	kfree(priv);
+
+	dev_set_drvdata(&client->dev, NULL);
+
+	return 0;
+}
+
+static int __maybe_unused it7260_ts_suspend(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+
+	int ret = -1;
+	u8 suspend_cmd[] = {0x04, 0x00, 0x02};
+	struct it7260_ts_priv *priv = i2c_get_clientdata(client);
+
+	if (device_may_wakeup(&client->dev)) {
+		enable_irq_wake(priv->irq);
+		if (sizeof(suspend_cmd) == i2c_master_write_it7260(client,
+					CMD_BUF, suspend_cmd, 3))
+			ret = 0;
+	}
+
+	return ret;
+}
+
+static int __maybe_unused it7260_ts_resume(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+
+	int ret = -1;
+	unsigned char query;
+	struct it7260_ts_priv *priv = i2c_get_clientdata(client);
+
+	if (device_may_wakeup(&client->dev)) {
+		i2c_master_read_it7260(client, QUERY_BUF, &query, 1);
+		disable_irq_wake(priv->irq);
+		ret = 0;
+	}
+
+	return ret;
+}
+
+static SIMPLE_DEV_PM_OPS(it7260_ts_pm_ops,
+			 it7260_ts_suspend, it7260_ts_resume);
+
+static const struct i2c_device_id it7260_ts_id[] = {
+	{"it7260", 0},
+	{}			/* should not omitted */
+};
+MODULE_DEVICE_TABLE(i2c, it7260_ts_id);
+
+#ifdef CONFIG_OF
+static const struct of_device_id it7260_ts_of_match[] = {
+	{ .compatible = "ite,it7260" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, it7260_ts_of_match);
+#endif
+
+static struct i2c_driver it7260_ts_driver = {
+	.driver = {
+		.name = "it7260-ts",
+		.of_match_table = of_match_ptr(it7260_ts_of_match),
+		.pm = &it7260_ts_pm_ops,
+	},
+	.probe = it7260_ts_probe,
+	.remove = it7260_ts_remove,
+	.id_table = it7260_ts_id,
+};
+
+static int __init it7260_ts_init(void)
+{
+	return i2c_add_driver(&it7260_ts_driver);
+}
+
+static void __exit it7260_ts_exit(void)
+{
+	i2c_del_driver(&it7260_ts_driver);
+}
+
+module_init(it7260_ts_init);
+module_exit(it7260_ts_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("CJOK <cjok.liao@gmail.com>");
+MODULE_DESCRIPTION("it7260 touchscreen driver");
+
diff -ENwbur a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
--- a/drivers/input/touchscreen/Kconfig	2018-05-06 08:47:37.033332109 +0200
+++ b/drivers/input/touchscreen/Kconfig	2018-05-06 08:49:49.878723822 +0200
@@ -1246,4 +1246,51 @@
 	  To compile this driver as a module, choose M here: the
 	  module will be called bu21023_ts.

+config TOUCHSCREEN_IT7260
+	tristate "ITE it7260 TouchScreen driver"
+	depends on ARCH_S5P6818
+	help
+	  Say Y here to support ITE it7260 based touchscreen on
+	  FriendlyARM NanoPi2 development board.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called it7260_mts.ko.
+
+config TOUCHSCREEN_HIMAX
+	tristate "Himax touchscreen support"
+	depends on I2C
+	help
+	  Say Y here if you have a Himax touchscreen and your
+	  board-specific setup code includes that in its table
+	  of I2C devices.
+
+	  If unsure, say N.
+
+config TOUCHSCREEN_1WIRE
+	tristate "1-Wire host and Touch Screen Driver"
+	depends on ARCH_S5P6818
+	help
+	  Say Y here to enable the 1-Wire host and Touch Screen driver for
+	  FriendlyARM NanoPi3
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called onewire.
+
+config SENSOR_LOADER_1WIRE
+	tristate "Touch sensor loader for NanoPi M3"
+	depends on ARCH_S5P6818
+	help
+	  Loads appropriate touch sensor driver depend on panel
+	  detected on onewire.
+
+	  If you have NanoPi and one of RGB panels from FriendlyArm
+	  than say Y or M here.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called onewire-touch.
+
 endif
diff -ENwbur a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
--- a/drivers/input/touchscreen/Makefile	2018-05-06 08:47:37.033332109 +0200
+++ b/drivers/input/touchscreen/Makefile	2018-05-06 08:49:49.878723822 +0200
@@ -104,3 +104,7 @@
 obj-$(CONFIG_TOUCHSCREEN_ZFORCE)	+= zforce_ts.o
 obj-$(CONFIG_TOUCHSCREEN_COLIBRI_VF50)	+= colibri-vf50-ts.o
 obj-$(CONFIG_TOUCHSCREEN_ROHM_BU21023)	+= rohm_bu21023.o
+obj-$(CONFIG_TOUCHSCREEN_IT7260)	+= it7260_mts.o
+obj-$(CONFIG_TOUCHSCREEN_HIMAX)		+= himax_ts.o
+obj-$(CONFIG_TOUCHSCREEN_1WIRE)		+= onewire.o
+obj-$(CONFIG_SENSOR_LOADER_1WIRE)	+= onewire-touch.o
diff -ENwbur a/drivers/input/touchscreen/onewire.c b/drivers/input/touchscreen/onewire.c
--- a/drivers/input/touchscreen/onewire.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/input/touchscreen/onewire.c	2018-05-06 08:49:49.882723986 +0200
@@ -0,0 +1,488 @@
+/* Onewire protocol support for touch panels from FriendlyARM
+ * Based on FriendlyARM driver for 3.x kernel.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+#include <linux/clk.h>
+#include <linux/interrupt.h>
+#include <linux/backlight.h>
+#include <soc/nexell/panel-nanopi.h>
+
+
+enum {
+	REQ_KEY		= 0x30,
+	REQ_TS		= 0x40,
+	REQ_INFO	= 0x60,
+	REQ_BLINIT	= 0x7f,
+};
+
+/* timer register */
+#define REG_TCFG0	0x00
+#define REG_TCFG1	0x04
+#define REG_TCON	0x08
+#define REG_TCNTB0	0x0C
+#define REG_TCMPB0	0x10
+#define REG_CSTAT	0x44
+
+#define TCON_BIT_AUTO (1 << 3)
+#define TCON_BIT_INVT (1 << 2)
+#define TCON_BIT_UP (1 << 1)
+#define TCON_BIT_RUN (1 << 0)
+#define TCFG0_BIT_CH(ch) (ch == 0 || ch == 1 ? 0 : 8)
+#define TCFG1_BIT_CH(ch) (ch * 4)
+#define TCON_BIT_CH(ch) (ch ? ch * 4 + 4 : 0)
+#define TINT_CSTAT_BIT_CH(ch) (ch + 5)
+#define TINT_CSTAT_MASK (0x1F)
+#define TIMER_TCNT_OFFS (0xC)
+
+
+enum OneWireState {
+	IDLE,
+	START,
+	REQUEST,
+	WAITING,
+	RESPONSE,
+};
+
+
+struct onewire_device {
+	struct device *dev;			// platform device
+	u32 irq_timer;				// hardware timer number used for irq's
+	struct gpio_desc *gpiod;	// onewire gpio
+	void __iomem *regs;			// timer registers
+	struct backlight_device *bl;
+	unsigned rate25Hz;			// timer rate for 25 Hz
+	unsigned rate9600Hz;		// timer rate for 9600 Hz
+	enum OneWireState state;
+	unsigned total_received;
+	bool backlight_init_success;
+	bool has_key_data;
+	bool has_ts_data;
+	unsigned char backlight_req;	// pending backlight brightness change
+									// request; 0 for none
+	unsigned io_bit_count;
+	u8 io_data[4];					// data being sent or received
+	unsigned char one_wire_request; // request (being) sent (if non-IDLE state)
+	bool isTouchDown;				// last reported touch state: down/up
+};
+
+static int lcd_type;
+static DECLARE_WAIT_QUEUE_HEAD(onewire_waitqueue);
+
+int onewire_get_lcd_type(void)
+{
+	wait_event(onewire_waitqueue, lcd_type);
+	return lcd_type;
+}
+
+/* Set timer clock as:  pclk / (2^mux * scl)
+ * mux: 0 .. 4
+ * scl: 1 .. 256
+ */
+static void timer_clock(struct onewire_device *onew, int mux, int scl)
+{
+	unsigned ch = onew->irq_timer;
+	u32 val = readl(onew->regs + REG_TCFG0) & ~(0xFF << TCFG0_BIT_CH(ch));
+
+	writel(val | ((scl - 1) << TCFG0_BIT_CH(ch)), onew->regs + REG_TCFG0);
+	val = readl(onew->regs + REG_TCFG1) & ~(0xF << TCFG1_BIT_CH(ch));
+	writel(val | (mux << TCFG1_BIT_CH(ch)), onew->regs + REG_TCFG1);
+}
+
+/* Set timer counter
+ */
+static void timer_count(struct onewire_device *onew, unsigned cnt)
+{
+	unsigned ch = onew->irq_timer;
+
+	writel((cnt - 1), onew->regs + REG_TCNTB0 + (TIMER_TCNT_OFFS * ch));
+	writel((cnt - 1), onew->regs + REG_TCMPB0 + (TIMER_TCNT_OFFS * ch));
+}
+
+/* Starts timer countdown
+ */
+static void timer_start(struct onewire_device *onew, bool irqon, bool repeat)
+{
+	unsigned ch = onew->irq_timer;
+	int on = irqon ? 1 : 0;
+	u32 val;
+
+	val = readl(onew->regs + REG_CSTAT) & ~(TINT_CSTAT_MASK << 5 | 0x1 << ch);
+	writel(val | (0x1 << TINT_CSTAT_BIT_CH(ch) | on << ch),
+	       onew->regs + REG_CSTAT);
+	val = readl(onew->regs + REG_TCON) & ~(0xE << TCON_BIT_CH(ch));
+	writel(val | (TCON_BIT_UP << TCON_BIT_CH(ch)), onew->regs + REG_TCON);
+
+	val &= ~(TCON_BIT_UP << TCON_BIT_CH(ch));
+	if( repeat )
+		val |= TCON_BIT_AUTO << TCON_BIT_CH(ch);
+	else
+		val &= ~(TCON_BIT_AUTO << TCON_BIT_CH(ch));
+	val |= TCON_BIT_RUN << TCON_BIT_CH(ch);
+	writel(val, onew->regs + REG_TCON);
+}
+
+/* Stops timer countdown
+ */
+static void timer_stop(struct onewire_device *onew)
+{
+	unsigned ch = onew->irq_timer;
+	u32 val;
+
+	val = readl(onew->regs + REG_CSTAT) & ~(TINT_CSTAT_MASK << 5 | 0x1 << ch);
+	writel(val | 1 << TINT_CSTAT_BIT_CH(ch), onew->regs + REG_CSTAT);
+	val = readl(onew->regs + REG_TCON) & ~(TCON_BIT_RUN << TCON_BIT_CH(ch));
+	writel(val, onew->regs + REG_TCON);
+}
+
+/* Clear timer interrupt state
+ */
+static void timer_clear_irq(struct onewire_device *onew)
+{
+	u32 val;
+
+	val = readl(onew->regs + REG_CSTAT) & ~(TINT_CSTAT_MASK << 5);
+	val |= (0x1 << TINT_CSTAT_BIT_CH(onew->irq_timer));
+	writel(val, onew->regs + REG_CSTAT);
+}
+
+static u8 crc8sum(u8 *pdata, unsigned nbytes)
+{
+	// msb, polynomial == 7
+	static const u8 t[] = { 0x7, 0xe, 0x1c, 0x38, 0x70, 0xe0, 0xc7, 0x89 };
+	unsigned crc = 0xac;
+
+	while( nbytes-- ) {
+		unsigned i, m = crc ^ *pdata++;
+
+		crc = 0;
+		for(i = 0; m; ++i ) {
+			if( m & 1 )
+				crc ^= t[i];
+			m >>= 1;
+		}
+	}
+	return crc;
+}
+
+static int onew_backlight_update_status(struct backlight_device *bl)
+{
+	struct onewire_device *onew = bl_get_data(bl);
+	int brightness = bl->props.brightness;
+
+	if (bl->props.power != FB_BLANK_UNBLANK ||
+			bl->props.fb_blank != FB_BLANK_UNBLANK ||
+			bl->props.state & (BL_CORE_SUSPENDED | BL_CORE_FBBLANK))
+		brightness = 0;
+
+	onew->backlight_req = 0x80 + brightness;
+	return 0;
+}
+
+static const struct backlight_ops onewire_backlight_ops = {
+	.options	= BL_CORE_SUSPENDRESUME,
+	.update_status	= onew_backlight_update_status,
+};
+
+static void notify_info_data(struct onewire_device *onew)
+{
+	dev_info(onew->dev, "lcd type: %d, year: %d, week: %d\n",
+			onew->io_data[0], onew->io_data[1], onew->io_data[2]);
+	if( onew->io_data[0] != 255 ) {
+		lcd_type = onew->io_data[0];
+		if( lcd_type == 24 )
+			onew->has_key_data = true;
+		wake_up_all(&onewire_waitqueue);
+		if( nanopi_panelrgb_issensor_1wire(lcd_type) )
+			onew->has_ts_data = true;
+	}
+}
+
+static void notify_bl_data(struct onewire_device *onew)
+{
+	struct backlight_properties props;
+
+	dev_info(onew->dev, "backlight data: %x,%x,%x\n",
+			onew->io_data[0], onew->io_data[1], onew->io_data[2]);
+	onew->backlight_init_success = true;
+
+	memset(&props, 0, sizeof(props));
+	props.type = BACKLIGHT_PLATFORM;
+	props.brightness = 96;
+	props.max_brightness = 127;
+	onew->bl = devm_backlight_device_register(onew->dev, dev_name(onew->dev),
+					onew->dev, onew, &onewire_backlight_ops, &props);
+	if( IS_ERR(onew->bl) ) {
+		dev_err(onew->dev, "failed to register backlight: %ld\n",
+				PTR_ERR(onew->bl));
+		onew->bl = NULL;
+	}else{
+		dev_info(onew->dev, "added backlight device");
+	}
+}
+
+static void ts_if_report_key(int key)
+{
+	pr_info("onewire received key %d\n", key);
+}
+
+static void notify_ts_data(struct onewire_device *onew)
+{
+	unsigned x, y, down;
+
+	x = ((onew->io_data[0] & 0xf0) << 4) + onew->io_data[1];
+	y = ((onew->io_data[0] &  0xf) << 8) + onew->io_data[2];
+	down = (x != 0xFFF) && (y != 0xFFF);
+	if( down ) {
+		pr_info("onewire touch (%d, %d)\n", x, y);
+		onew->isTouchDown = true;
+	}else if( onew->isTouchDown ) {
+		pr_info("onewire fingers up\n");
+		onew->isTouchDown = false;
+	}
+}
+
+static bool start_one_wire_session(struct onewire_device *onew)
+{
+	unsigned char req;
+
+	if( lcd_type == 0 ) {
+		req = REQ_INFO;
+	} else if (!onew->backlight_init_success) {
+		req = REQ_BLINIT;
+	} else if (onew->backlight_req) {
+		req = onew->backlight_req;
+		onew->backlight_req = 0;
+	} else if (onew->has_key_data) {
+		req = REQ_KEY;
+	} else if (onew->has_ts_data) {
+		req = REQ_TS;
+	} else {
+		return false;
+	}
+
+	// prepare data for transfering
+	onew->io_data[0] = req;
+	onew->io_data[1] = crc8sum(&req, 1);
+	onew->one_wire_request = req;
+	return true;
+}
+
+static unsigned total_error;
+
+static irqreturn_t onewire_irq_threaded_handler(int irq, void *data)
+{
+	struct onewire_device *onew = platform_get_drvdata(data);
+
+	++onew->total_received;
+	if( crc8sum(onew->io_data, 4) == 0 ) {
+		switch( onew->one_wire_request ) {
+			case REQ_INFO:
+				notify_info_data(onew);
+				break;
+			case REQ_KEY:
+				ts_if_report_key(onew->io_data[2]);
+				break;
+			case REQ_TS:
+				notify_ts_data(onew);
+				break;
+			case REQ_BLINIT:
+				notify_bl_data(onew);
+				break;
+		}
+	}else{ // CRC mismatch
+		++total_error;
+	}
+	if( lcd_type == 0 && onew->total_received > 15 ) {
+		dev_info(onew->dev, "no panel\n");
+		lcd_type = -1;
+		wake_up_all(&onewire_waitqueue);
+	}
+	if( lcd_type >= 0 ) {
+		timer_count(onew, onew->rate25Hz);
+		timer_start(onew, true, false);
+	}
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t onewire_irq_handler(int irq, void *data)
+{
+	struct onewire_device *onew = platform_get_drvdata(data);
+
+	timer_clear_irq(onew);
+
+	onew->io_bit_count--;
+	switch( onew->state ) {
+	case IDLE:
+		timer_stop(onew);
+		if( start_one_wire_session(onew) ) {
+			// init transfer and start timer
+			gpiod_direction_output(onew->gpiod, 0);
+			onew->io_bit_count = 1;
+			onew->state = START;
+			timer_count(onew, onew->rate9600Hz);
+			timer_start(onew, true, true);
+		}else{
+			timer_count(onew, onew->rate25Hz);
+			timer_start(onew, true, false);
+		}
+		break;
+	case START:
+		if (onew->io_bit_count == 0) {
+			onew->io_bit_count = 16;
+			onew->state = REQUEST;
+		}
+		break;
+
+	case REQUEST:
+		// Send a bit
+		gpiod_set_value(onew->gpiod,
+				onew->io_data[onew->io_bit_count < 8] &
+				(1 << (onew->io_bit_count & 0x7)));
+		if (onew->io_bit_count == 0) {
+			onew->io_bit_count = 2;
+			onew->state = WAITING;
+		}
+		break;
+
+	case WAITING:
+		if (onew->io_bit_count == 0) {
+			onew->io_bit_count = 32;
+			onew->io_data[0] = onew->io_data[1] = 0;
+			onew->io_data[2] = onew->io_data[3] = 0;
+			onew->state = RESPONSE;
+		}
+		if (onew->io_bit_count == 1) {
+			gpiod_direction_input(onew->gpiod);
+			gpiod_set_value(onew->gpiod, 1);
+		}
+		break;
+
+	default:	// RESPONSE
+		// Get a bit
+		onew->io_data[3 - (onew->io_bit_count >> 3)] |=
+			gpiod_get_value(onew->gpiod) ? 1 << (onew->io_bit_count & 0x7) : 0;
+		if (onew->io_bit_count == 0) {
+			gpiod_direction_output(onew->gpiod, 1);
+			timer_stop(onew);
+			onew->state = IDLE;
+			return IRQ_WAKE_THREAD;
+		}
+		break;
+	}
+	return IRQ_HANDLED;
+}
+
+static int onewire_probe(struct platform_device *pdev)
+{
+	struct onewire_device *onew;
+	int irq, err;
+	struct resource *res;
+	struct clk *pclk;
+	unsigned rate;
+
+	onew = devm_kzalloc(&pdev->dev, sizeof(struct onewire_device),
+			GFP_KERNEL);
+	if( onew == NULL )
+		return -ENOMEM;
+	err = of_property_read_u32(pdev->dev.of_node, "irq-timer",
+			&onew->irq_timer);
+	if( err ) {
+		dev_err(&pdev->dev, "OF property irq-timer missing");
+		return err;
+	}
+	onew->gpiod = devm_gpiod_get(&pdev->dev, "channel", GPIOD_ASIS);
+	if( IS_ERR(onew->gpiod) ) {
+		dev_err(&pdev->dev, "unable to get gpio: %ld\n",
+				PTR_ERR(onew->gpiod));
+		return PTR_ERR(onew->gpiod);
+	}
+	gpiod_direction_output(onew->gpiod, 1);
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if( res == NULL ) {
+		dev_err(&pdev->dev, "failed to get registers base address\n");
+		return -ENXIO;
+	}
+	onew->regs = devm_ioremap_resource(&pdev->dev, res);
+	if( onew->regs == NULL ) {
+		dev_err(&pdev->dev, "failed to iomap registers\n");
+		return -EIO;
+	}
+	pclk = clk_get(NULL, "sys-bpclk");
+	if( IS_ERR(pclk) ) {
+		dev_err(&pdev->dev, "get pclk error %ld\n", PTR_ERR(pclk));
+		return PTR_ERR(pclk);
+	}
+	rate = clk_get_rate(pclk);
+	clk_put(pclk);
+	irq = platform_get_irq(pdev, 0);
+	if( irq < 0 ) {
+		dev_err(&pdev->dev, "unable to get irq: %d\n", irq);
+		return irq;
+	}
+	onew->dev = &pdev->dev;
+	platform_set_drvdata(pdev, onew);
+	timer_stop(onew);
+	onew->state = IDLE;
+	err = devm_request_threaded_irq(&pdev->dev, irq, onewire_irq_handler,
+			onewire_irq_threaded_handler, 0, "onewire", pdev);
+	if( err ) {
+		dev_err(&pdev->dev, "failed to request irq: %d\n", err);
+		return err;
+	}
+	dev_info(&pdev->dev, "probe success\n");
+	// divide pclk by 22; for pclk frequency 200 MHz the calculated
+	// rate9600Hz is 947 giving 9599.69 Hz
+	timer_clock(onew, 1, 11);
+	onew->rate25Hz = (rate + 11 * 25) / (22 * 25);
+	onew->rate9600Hz = (rate + 11 * 9600) / (22 * 9600);
+	onewire_irq_handler(irq, pdev);
+	return 0;
+}
+
+static int onewire_remove(struct platform_device *pdev)
+{
+	struct onewire_device *onew = platform_get_drvdata(pdev);
+
+	timer_stop(onew);
+	gpiod_set_value(onew->gpiod, 0);
+	dev_info(&pdev->dev, "removed\n");
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id onewire_of_match[] = {
+	{ .compatible = "friendlyarm,onewire" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, onewire_of_match);
+#endif
+
+struct platform_driver onewire_platform_driver = {
+	.probe = onewire_probe,
+	.remove = onewire_remove,
+	.driver = {
+		.name = "onewire",
+		.of_match_table = of_match_ptr(onewire_of_match),
+	},
+};
+
+static int __init onewire_init(void)
+{
+	return platform_driver_register(&onewire_platform_driver);
+}
+
+static void __exit onewire_exit(void)
+{
+	platform_driver_unregister(&onewire_platform_driver);
+}
+
+/* early init needed for possible LCD panel detection */
+subsys_initcall(onewire_init);
+module_exit(onewire_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rafaello7 <fatwildcat@gmail.com>");
+MODULE_DESCRIPTION("FriendlyArm onewire protocol driver");
diff -ENwbur a/drivers/input/touchscreen/onewire-touch.c b/drivers/input/touchscreen/onewire-touch.c
--- a/drivers/input/touchscreen/onewire-touch.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/input/touchscreen/onewire-touch.c	2018-05-06 08:49:49.882723986 +0200
@@ -0,0 +1,96 @@
+/* Registers appropriate touchscreen input device for NanoPi M3
+ * based on LCD panel type connected to RGB connector.
+ * The panel type is reported by LCD panel on onewire channel.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/of_irq.h>
+#include <soc/nexell/panel-nanopi.h>
+
+
+static int onewire_touch_probe(struct platform_device *pdev)
+{
+	struct i2c_client *touchsensor;
+	struct i2c_board_info bdi;
+	struct i2c_adapter *adap;
+	struct device_node *i2c_bus_np;
+	const struct nanopi_panel_desc *panel_desc;
+
+	panel_desc = nanopi_panelrgb_get_connected();
+	if( panel_desc == NULL || !panel_desc->i2c_touch_drv ||
+			!strcmp(panel_desc->i2c_touch_drv, "onewire"))
+		return -ENODEV;
+	memset(&bdi, 0, sizeof(bdi));
+	strlcpy(bdi.type, panel_desc->i2c_touch_drv, sizeof(bdi.type));
+	bdi.addr = panel_desc->i2c_touch_reg;
+	bdi.irq = platform_get_irq(pdev, 0);
+	if( bdi.irq < 0 ) {
+		dev_err(&pdev->dev, "unable to get irq: %d\n", bdi.irq);
+		return bdi.irq;
+	}
+	i2c_bus_np = of_parse_phandle(pdev->dev.of_node, "i2c-bus", 0);
+	if( i2c_bus_np == NULL ) {
+		dev_err(&pdev->dev, "no i2c-bus property\n");
+		return -EINVAL;
+	}
+	adap = of_find_i2c_adapter_by_node(i2c_bus_np);
+	of_node_put(i2c_bus_np);
+	if( adap == NULL ) {
+		dev_err(&pdev->dev, "i2c-bus for touch sensor not found\n");
+		return -EPROBE_DEFER;
+	}
+	touchsensor = i2c_new_device(adap, &bdi);
+	put_device(&adap->dev);
+	if( touchsensor == NULL ) {
+		dev_err(&pdev->dev, "touch sensor registration error\n");
+		return -ENXIO;
+	}
+	platform_set_drvdata(pdev, touchsensor);
+	dev_info(&pdev->dev, "probe success\n");
+	return 0;
+}
+
+static int onewire_touch_remove(struct platform_device *pdev)
+{
+	struct i2c_client *touchsensor = platform_get_drvdata(pdev);
+
+	i2c_unregister_device(touchsensor);
+	dev_info(&pdev->dev, "removed\n");
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id onewire_touch_of_match[] = {
+	{ .compatible = "friendlyarm,onewire-touch" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, onewire_touch_of_match);
+#endif
+
+struct platform_driver onewire_touch_platform_driver = {
+	.probe = onewire_touch_probe,
+	.remove = onewire_touch_remove,
+	.driver = {
+		.name = "onewire-touch",
+		.of_match_table = of_match_ptr(onewire_touch_of_match),
+	},
+};
+
+static int __init onewire_touch_init(void)
+{
+	return platform_driver_register(&onewire_touch_platform_driver);
+}
+
+static void __exit onewire_touch_exit(void)
+{
+	platform_driver_unregister(&onewire_touch_platform_driver);
+}
+
+module_init(onewire_touch_init);
+module_exit(onewire_touch_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rafaello7 <fatwildcat@gmail.com>");
+MODULE_DESCRIPTION("FriendlyArm onewire touch sensor driver");
diff -ENwbur a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
--- a/drivers/media/platform/Kconfig	2018-05-06 08:47:37.213339417 +0200
+++ b/drivers/media/platform/Kconfig	2018-05-06 08:49:50.058731126 +0200
@@ -615,3 +615,27 @@
 	  will be called rcar_drif.

 endif # SDR_PLATFORM_DRIVERS
+
+config VIDEO_NEXELL_CODEC
+	tristate "Nexell Video Codec"
+	depends on VIDEO_V4L2
+	select VIDEOBUF2_CORE
+	select VIDEOBUF2_DMA_CONTIG
+	default n
+	---help---
+	  This is a v4l2 driver for Nexell Video Codec.
+
+config NANO_VIDEODEV
+	tristate "Video overlay device on NanoPi M3"
+	depends on VIDEO_V4L2 && DRM_NX
+	select VIDEOBUF2_CORE
+	select VIDEOBUF2_DMA_CONTIG
+	default n
+	---help---
+	  Exposes MLC (Multi Layer Controler) video layer of s5p6818 soc
+	  as a video4linux overlay output device. The device is available
+	  as /dev/video1
+
+	  Note that this layer is also available via drm, but it is unused
+	  by X-window system. Using this layer by both drm and this device
+	  may have unpredictable results.
diff -ENwbur a/drivers/media/platform/Makefile b/drivers/media/platform/Makefile
--- a/drivers/media/platform/Makefile	2018-05-06 08:47:37.213339417 +0200
+++ b/drivers/media/platform/Makefile	2018-05-06 08:49:50.058731126 +0200
@@ -76,6 +76,8 @@

 obj-$(CONFIG_VIDEO_STM32_DCMI)		+= stm32/

+obj-$(CONFIG_VIDEO_NEXELL_CODEC)	+= nxp-vpu/
+
 ccflags-y += -I$(srctree)/drivers/media/i2c

 obj-$(CONFIG_VIDEO_MEDIATEK_VPU)	+= mtk-vpu/
@@ -90,4 +92,6 @@

 obj-$(CONFIG_VIDEO_QCOM_VENUS)		+= qcom/venus/

+obj-$(CONFIG_NANO_VIDEODEV)			+= nano-videodev/
+
 obj-y					+= meson/
diff -ENwbur a/drivers/media/platform/nano-videodev/Makefile b/drivers/media/platform/nano-videodev/Makefile
--- a/drivers/media/platform/nano-videodev/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nano-videodev/Makefile	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,3 @@
+nano-videodev-objs := nano-videodev-v4l2.o s5pxx18_dp_dev.o s5pxx18_soc_mlc.o
+obj-$(CONFIG_NANO_VIDEODEV) += nano-videodev.o
+
diff -ENwbur a/drivers/media/platform/nano-videodev/nano-videodev-v4l2.c b/drivers/media/platform/nano-videodev/nano-videodev-v4l2.c
--- a/drivers/media/platform/nano-videodev/nano-videodev-v4l2.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nano-videodev/nano-videodev-v4l2.c	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,1010 @@
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/miscdevice.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/delay.h>
+#include <media/v4l2-dev.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-ioctl.h>
+#include <media/videobuf2-v4l2.h>
+#include <media/videobuf2-dma-contig.h>
+#include "s5pxx18_dp_dev.h"
+
+
+static bool single_plane_mode;
+module_param(single_plane_mode, bool, 0444);
+
+
+/* Pixel format description table.
+ * The video layer supports only YUV formats (Y - luminance, U - red value,
+ * V - blue). There is only one non-planar format, YUYV. Remaining formats are
+ * planar. Three planes may be in one memory chunk or in three. Luminance plane
+ * is first one. Red plane may be before blue plane (YUV) or after (YVU).
+ * Single color value may be for every pixel (YUV444/YVU444), for two adjacent
+ * horizontal pixels (YUV422/YVU422) or for 2x2 pixel square (YUV420/YVU420).
+ */
+static const struct NanoVideoFormat {
+	uint32_t fourcc;
+	enum nx_mlc_yuvfmt nxfmt;
+	bool isVU;				// for planar format: YUV = false, YVU = true
+	unsigned num_planes;
+	unsigned bpp;			// bytes per pixel (in planar format: of Y plane)
+    unsigned hsub, vsub;	// horizontal/vertical subsample
+} supported_video_formats[] = {
+	/* 1-buffer */
+	{
+		V4L2_PIX_FMT_YUV420,  nx_mlc_yuvfmt_420,  false, 1, 1, 2, 2
+	},{
+		V4L2_PIX_FMT_YVU420,  nx_mlc_yuvfmt_420,  true,  1, 1, 2, 2
+	},{
+		V4L2_PIX_FMT_YUV422P, nx_mlc_yuvfmt_422,  false, 1, 1, 2, 1
+	},{
+		V4L2_PIX_FMT_YUV444,  nx_mlc_yuvfmt_444,  false, 1, 1, 1, 1
+	},{
+		V4L2_PIX_FMT_YUYV,	  nx_mlc_yuvfmt_yuyv, false, 1, 2, 0, 0
+	},
+	/* 3-buffer */
+	{
+		V4L2_PIX_FMT_YUV420M, nx_mlc_yuvfmt_420,  false, 3, 1, 2, 2
+	},{
+		V4L2_PIX_FMT_YVU420M, nx_mlc_yuvfmt_420,  true,  3, 1, 2, 2
+	},{
+		V4L2_PIX_FMT_YUV422M, nx_mlc_yuvfmt_422,  false, 3, 1, 2, 1
+	},{
+		V4L2_PIX_FMT_YVU422M, nx_mlc_yuvfmt_422,  true,  3, 1, 2, 1
+	},{
+		V4L2_PIX_FMT_YUV444M, nx_mlc_yuvfmt_444,  false, 3, 1, 1, 1
+	},{
+		V4L2_PIX_FMT_YVU444M, nx_mlc_yuvfmt_444,  true,  3, 1, 1, 1
+	}
+};
+
+struct nx_videolayer {
+	int module;
+	bool isEnabled;
+	bool isVidiocOverlayOn;
+
+	/* buffer wanted to display now (if displaying is enabled) */
+	struct vb2_buffer *bufWantDisplay;
+
+	/* Buffers whose (may be) currently displayed.
+	 * Buffer deactivation occurs asynchronously at vsync signal.
+	 */
+	struct vb2_buffer *bufsActiveTillDirty[2];
+
+	spinlock_t wq_lock;
+	bool isWorkActive;
+	struct workqueue_struct *workqueue;
+	struct work_struct buf_switch_wait_work;
+
+	/* source */
+	const struct NanoVideoFormat *format;
+	int width;
+	int height;
+	bool useSingleBuf;
+
+	/* target */
+	int dst_left;
+	int dst_top;
+	int dst_width;
+	int dst_height;
+
+	/* color */
+	int hue;		/* -180 .. 180, default 0 */
+	int saturation; /* 0 .. 127, default 64 */
+};
+
+struct nano_video_device {
+	struct v4l2_device v4l2_dev;
+	struct video_device vdev;
+	struct vb2_queue queue;
+	struct mutex lock;
+	struct nx_videolayer vl;
+};
+
+static unsigned round_up8(unsigned val)
+{
+	return (val + 7) / 8 * 8;
+}
+
+enum PlaneUpdateKind {
+	PUK_INPUT_FORMAT,
+	PUK_VB2_BUF,
+	PUK_OVERLAY_WINDOW
+};
+
+static int dp_plane_update(struct nx_videolayer *vl, enum PlaneUpdateKind puk,
+		struct vb2_buffer *switchBuf)
+{
+	dma_addr_t uvdma[2];
+	bool enable, isDirtyPre, isDirtyPost, haveWork;
+	unsigned pitchesY;
+	phys_addr_t physaddr;
+	struct vb2_buffer *bufPrev, *doneBufs[2] = { NULL, NULL };
+	unsigned long flags;
+
+	if( puk != PUK_VB2_BUF )
+		switchBuf = vl->bufWantDisplay;
+	enable = vl->isVidiocOverlayOn && vl->format &&
+		switchBuf && vl->width && vl->height &&
+		vl->dst_width && vl->dst_height;
+	isDirtyPre = nx_soc_dp_plane_video_is_dirty(vl->module);
+	if( enable ) {
+		const struct NanoVideoFormat *nvf = vl->format;
+
+		if( !vl->isEnabled || puk == PUK_OVERLAY_WINDOW ) {
+			nx_soc_dp_plane_video_set_position(vl->module,
+					0, 0, vl->width, vl->height,
+					vl->dst_left, vl->dst_top,
+					vl->dst_width, vl->dst_height);
+		}
+		if( !vl->isEnabled || puk == PUK_INPUT_FORMAT )
+			nx_soc_dp_plane_video_set_format(vl->module, nvf->nxfmt);
+		if( !vl->isEnabled || puk == PUK_VB2_BUF ) {
+			pitchesY = round_up8(vl->width * nvf->bpp);
+			physaddr = vb2_dma_contig_plane_dma_addr(switchBuf, 0);
+			if( nvf->hsub ) {	// planar format
+				unsigned pitchesUV = pitchesY / nvf->hsub;
+				if( !vl->useSingleBuf && switchBuf->num_planes == 3 ) {
+					uvdma[nvf->isVU] =
+						vb2_dma_contig_plane_dma_addr(switchBuf, 1);
+					uvdma[!nvf->isVU] =
+						vb2_dma_contig_plane_dma_addr(switchBuf, 2);
+				}else{
+					uvdma[nvf->isVU] = physaddr + pitchesY * vl->height;
+					uvdma[!nvf->isVU] = uvdma[nvf->isVU] +
+						pitchesUV * vl->height / nvf->vsub;
+				}
+				nx_soc_dp_plane_video_set_address_3p( vl->module, 0, 0,
+						nvf->nxfmt, physaddr, pitchesY,
+						uvdma[0], pitchesUV, uvdma[1], pitchesUV);
+			}else{
+				nx_soc_dp_plane_video_set_address_1p(vl->module, 0, 0,
+						physaddr, pitchesY);
+			}
+		}
+	}
+	if( enable != vl->isEnabled )
+		nx_soc_dp_plane_video_set_enable(vl->module, enable);
+
+	spin_lock_irqsave(&vl->wq_lock, flags);
+	isDirtyPost = nx_soc_dp_plane_video_is_dirty(vl->module);
+	bufPrev = vl->isEnabled ? vl->bufWantDisplay : NULL;
+	if( isDirtyPost ) {
+		if( bufPrev != switchBuf &&
+				bufPrev != vl->bufsActiveTillDirty[0] &&
+				bufPrev != vl->bufsActiveTillDirty[1])
+			doneBufs[0] = bufPrev;
+	}else{
+		if( vl->bufsActiveTillDirty[0] != bufPrev &&
+				vl->bufsActiveTillDirty[0] != switchBuf )
+			doneBufs[0] = vl->bufsActiveTillDirty[0];
+		if( vl->bufsActiveTillDirty[1] != bufPrev &&
+				vl->bufsActiveTillDirty[1] != switchBuf )
+			doneBufs[1] = vl->bufsActiveTillDirty[1];
+		vl->bufsActiveTillDirty[0] = bufPrev;
+		if( isDirtyPre && bufPrev != switchBuf ) {
+			// in doubt which one is active now
+			vl->bufsActiveTillDirty[1] = switchBuf;
+		}else
+			vl->bufsActiveTillDirty[1] = NULL;
+	}
+	vl->bufWantDisplay = switchBuf;
+	vl->isEnabled = enable;
+	if( !vl->isWorkActive ) {
+		haveWork = ((vl->bufsActiveTillDirty[0] &&
+				vl->bufsActiveTillDirty[0] != vl->bufWantDisplay) ||
+			(vl->bufsActiveTillDirty[1] &&
+			 vl->bufsActiveTillDirty[1] != vl->bufWantDisplay));
+		vl->isWorkActive = haveWork;
+	}else
+		haveWork = false;
+	nx_soc_dp_plane_video_set_dirty(vl->module);
+	spin_unlock_irqrestore(&vl->wq_lock, flags);
+
+	if( doneBufs[0] )
+		vb2_buffer_done(doneBufs[0], VB2_BUF_STATE_DONE);
+	if( doneBufs[1] )
+		vb2_buffer_done(doneBufs[1], VB2_BUF_STATE_DONE);
+	if( haveWork )
+		queue_work(vl->workqueue, &vl->buf_switch_wait_work);
+	return 0;
+}
+
+static void buf_switch_wait_work(struct work_struct *work)
+{
+	struct nx_videolayer *vl;
+	bool isDirty, haveWork;
+	struct vb2_buffer *doneBufs[2] = { NULL, NULL };
+	unsigned long flags;
+	unsigned timeout = 50;
+
+	vl = container_of(work, struct nx_videolayer, buf_switch_wait_work);
+
+	/* Waiting for dirty flag cleanup to give back unused buffers. */
+	while( 1 ) {
+		spin_lock_irqsave(&vl->wq_lock, flags);
+
+		// timed wait as of dirty flag may be not cleaned when display is off
+		isDirty = --timeout && nx_soc_dp_plane_video_is_dirty(vl->module);
+		if( isDirty ) {
+			haveWork = (vl->bufsActiveTillDirty[0] &&
+					vl->bufsActiveTillDirty[0] != vl->bufWantDisplay) ||
+				(vl->bufsActiveTillDirty[1] &&
+				 vl->bufsActiveTillDirty[1] != vl->bufWantDisplay);
+		}else{
+			if( vl->bufsActiveTillDirty[0] != vl->bufWantDisplay )
+				doneBufs[0] = vl->bufsActiveTillDirty[0];
+			if( vl->bufsActiveTillDirty[1] != vl->bufWantDisplay )
+				doneBufs[1] = vl->bufsActiveTillDirty[1];
+			vl->bufsActiveTillDirty[0] = vl->isEnabled ?
+				vl->bufWantDisplay : NULL;
+			vl->bufsActiveTillDirty[1] = NULL;
+			haveWork = false;
+		}
+		vl->isWorkActive = haveWork;
+		spin_unlock_irqrestore(&vl->wq_lock, flags);
+
+		if( ! haveWork )
+			break;
+		msleep(2);
+	}
+	if( doneBufs[0] )
+		vb2_buffer_done(doneBufs[0], VB2_BUF_STATE_DONE);
+	if( doneBufs[1] )
+		vb2_buffer_done(doneBufs[1], VB2_BUF_STATE_DONE);
+}
+
+static int nano_video_vidioc_querycap(struct file *file, void *fh,
+			       struct v4l2_capability *cap)
+{
+	/* Reporting both single- and multi-plane support in multiplane mode
+	 * due to ugly libv4l-mplane plugin in libv4l library used by v4l2sink
+	 * gstreamer plugin. The libv4l-mplane plugin, when enabled, makes the
+	 * device visible as single-plane only and causes the v4l2sink fail to
+	 * play. When both single- and multi-plane support is reported by device,
+	 * the plugin is not turned on and v4l2sink plays video correctly.
+	 */
+	unsigned caps = V4L2_CAP_VIDEO_OUTPUT_OVERLAY | V4L2_CAP_READWRITE |
+		V4L2_CAP_STREAMING | V4L2_CAP_VIDEO_OUTPUT |
+		(single_plane_mode ? 0 : V4L2_CAP_VIDEO_OUTPUT_MPLANE);
+
+	strlcpy(cap->driver, "nano-videodev", sizeof(cap->driver));
+	strlcpy(cap->card, "Nexell gpu overlay video", sizeof(cap->card));
+	strlcpy(cap->bus_info, "platform:mlc0", sizeof(cap->bus_info));
+	cap->capabilities |= caps;
+	cap->device_caps |= caps;
+	return 0;
+}
+
+static int nano_video_vidioc_enum_fmt_vid_out(struct file *file,
+		void *fh, struct v4l2_fmtdesc *f)
+{
+	if( f->index >= ARRAY_SIZE(supported_video_formats) )
+		return -EINVAL;
+	if( single_plane_mode && supported_video_formats[f->index].num_planes > 1)
+		return -EINVAL;
+	f->pixelformat = supported_video_formats[f->index].fourcc;
+	return 0;
+}
+
+static int nano_video_vidioc_enum_framesizes(struct file *file, void *fh,
+				      struct v4l2_frmsizeenum *fsize)
+{
+	if( fsize->index != 0 )
+		return -EINVAL;
+	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
+	fsize->stepwise.min_width = 2;
+	fsize->stepwise.max_width = 2048;
+	fsize->stepwise.step_width = 2;
+	fsize->stepwise.min_height = 2;
+	fsize->stepwise.max_height = 2048;
+	fsize->stepwise.step_height = 2;
+	return 0;
+}
+
+#if 0
+static int nano_video_vidioc_enum_frameintervals(struct file *file, void *fh,
+					  struct v4l2_frmivalenum *fival)
+{
+	if( fival->index != 0 )
+		return -EINVAL;
+	fival->type = V4L2_FRMIVAL_TYPE_CONTINUOUS;
+	fival->stepwise.min.numerator = 0;
+	fival->stepwise.min.denominator = 1;
+	fival->stepwise.step.numerator = 1;
+	fival->stepwise.step.denominator = 1;
+	fival->stepwise.max.numerator = INT_MAX;
+	fival->stepwise.max.denominator = 1;
+	return 0;
+}
+#endif
+
+static int nano_video_vidioc_g_fmt_vid_out(struct file *file, void *fh,
+				    struct v4l2_format *f)
+{
+	const struct nx_videolayer *vl = video_drvdata(file);
+	const struct NanoVideoFormat *nvf = vl->format;
+	unsigned stride;
+
+	f->fmt.pix.width = vl->width;
+	f->fmt.pix.height = vl->height;
+	f->fmt.pix.field = V4L2_FIELD_NONE;
+	f->fmt.pix.pixelformat = nvf->fourcc;
+	f->fmt.pix.bytesperline = stride = round_up8(vl->width * nvf->bpp);
+	f->fmt.pix.sizeimage = stride * vl->height;
+	if( nvf->hsub )
+		f->fmt.pix.sizeimage += 2 * stride / nvf->hsub * vl->height / nvf->vsub;
+	return 0;
+}
+
+static int nano_video_vidioc_s_fmt_vid_out(struct file *file, void *fh,
+				    struct v4l2_format *f)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+	const struct NanoVideoFormat *nvf;
+	unsigned i, stride;
+
+	for(i = 0; i < ARRAY_SIZE(supported_video_formats) &&
+		supported_video_formats[i].fourcc != f->fmt.pix.pixelformat; ++i)
+		;
+	if( i == ARRAY_SIZE(supported_video_formats) ) {
+		pr_err("nano-videodev: unsupported fourcc %.4s\n",
+			   (const char*)&f->fmt.pix.pixelformat);
+		return -EINVAL;
+	}
+	nvf = supported_video_formats + i;
+	if( single_plane_mode && nvf->num_planes > 1 ) {
+		pr_err("nano-videodev: format %.4s is multi-plane, invalid\n",
+			   (const char*)&f->fmt.pix.pixelformat);
+		return -EINVAL;
+	}
+	vl->format = nvf;
+	f->fmt.pix.width += f->fmt.pix.width & 1;
+	f->fmt.pix.height += f->fmt.pix.height & 1;
+	vl->width = f->fmt.pix.width;
+	vl->height = f->fmt.pix.height;
+	vl->useSingleBuf = true;
+	dp_plane_update(vl, PUK_INPUT_FORMAT, NULL);
+	f->fmt.pix.bytesperline = stride = round_up8(vl->width * nvf->bpp);
+	f->fmt.pix.sizeimage = stride * vl->height;
+	if( nvf->hsub )
+		f->fmt.pix.sizeimage += 2 * stride / nvf->hsub * vl->height / nvf->vsub;
+	return 0;
+}
+
+static int nano_video_vidioc_try_fmt_vid_out(struct file *file, void *fh,
+				    struct v4l2_format *f)
+{
+	const struct NanoVideoFormat *nvf;
+	unsigned i, stride;
+
+	for(i = 0; i < ARRAY_SIZE(supported_video_formats) &&
+		supported_video_formats[i].fourcc != f->fmt.pix.pixelformat; ++i)
+		;
+	if( i == ARRAY_SIZE(supported_video_formats) ) {
+		pr_err("nano-videodev: unsupported fourcc %.4s\n",
+			   (const char*)&f->fmt.pix.pixelformat);
+		return -EINVAL;
+	}
+	nvf = supported_video_formats + i;
+	if( single_plane_mode && nvf->num_planes > 1 ) {
+		pr_err("nano-videodev: format %.4s is multi-plane, invalid\n",
+			   (const char*)&f->fmt.pix.pixelformat);
+		return -EINVAL;
+	}
+	f->fmt.pix.width += f->fmt.pix.width & 1;
+	f->fmt.pix.height += f->fmt.pix.height & 1;
+	f->fmt.pix.bytesperline = stride = round_up8(f->fmt.pix.width * nvf->bpp);
+	f->fmt.pix.sizeimage = stride * f->fmt.pix.height;
+	if( nvf->hsub )
+		f->fmt.pix.sizeimage += 2 * stride / nvf->hsub * f->fmt.pix.height /
+			nvf->vsub;
+	return 0;
+}
+
+static void fill_bytesperline_and_sizeimage_mp(struct v4l2_format *f,
+		const struct NanoVideoFormat *nvf)
+{
+	unsigned stride;
+
+	stride = round_up8(f->fmt.pix_mp.width * nvf->bpp);
+	f->fmt.pix_mp.plane_fmt[0].bytesperline = stride;
+	f->fmt.pix_mp.plane_fmt[0].sizeimage = stride * f->fmt.pix_mp.height;
+	if( nvf->hsub ) {	// planar format
+		unsigned strideUV = stride / nvf->hsub;
+		unsigned sizeUV = strideUV * f->fmt.pix_mp.height / nvf->vsub;
+		if( f->fmt.pix_mp.num_planes == 3 ) {
+			f->fmt.pix_mp.plane_fmt[1].bytesperline =
+				f->fmt.pix_mp.plane_fmt[2].bytesperline = strideUV;
+			f->fmt.pix_mp.plane_fmt[1].sizeimage =
+				f->fmt.pix_mp.plane_fmt[2].sizeimage = sizeUV;
+		}else	// planes in one buffer
+			f->fmt.pix_mp.plane_fmt[0].sizeimage += 2 * sizeUV;
+	}
+}
+
+static int nano_video_vidioc_g_fmt_vid_out_mplane(struct file *file, void *fh,
+					   struct v4l2_format *f)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+	const struct NanoVideoFormat *nvf = vl->format;
+
+	f->fmt.pix_mp.width = vl->width;
+	f->fmt.pix_mp.height = vl->height;
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	f->fmt.pix_mp.pixelformat = nvf->fourcc;
+	f->fmt.pix_mp.num_planes = vl->useSingleBuf ? 1 : nvf->num_planes;
+	fill_bytesperline_and_sizeimage_mp(f, nvf);
+	return 0;
+}
+
+static int nano_video_vidioc_try_fmt_vid_out_mplane(struct file *file, void *fh,
+					   struct v4l2_format *f)
+{
+	const struct NanoVideoFormat *nvf = NULL;
+	unsigned i;
+
+	for(i = 0; i < ARRAY_SIZE(supported_video_formats) &&
+			supported_video_formats[i].fourcc != f->fmt.pix_mp.pixelformat; ++i)
+		;
+	if( i == ARRAY_SIZE(supported_video_formats) ) {
+		pr_err("nano-videodev: unsupported fourcc %.4s\n",
+				(const char*)&f->fmt.pix_mp.pixelformat);
+		return -EINVAL;
+	}
+	nvf = supported_video_formats + i;
+	f->fmt.pix_mp.width += f->fmt.pix_mp.width & 1;
+	f->fmt.pix_mp.height += f->fmt.pix_mp.height & 1;
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	if( f->fmt.pix_mp.num_planes != 1 )
+		f->fmt.pix_mp.num_planes = nvf->num_planes;
+	fill_bytesperline_and_sizeimage_mp(f, nvf);
+	return 0;
+}
+
+static int nano_video_vidioc_s_fmt_vid_out_mplane(struct file *file, void *fh,
+					   struct v4l2_format *f)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+	const struct NanoVideoFormat *nvf = NULL;
+	unsigned i;
+
+	for(i = 0; i < ARRAY_SIZE(supported_video_formats) &&
+			supported_video_formats[i].fourcc != f->fmt.pix_mp.pixelformat; ++i)
+		;
+	if( i == ARRAY_SIZE(supported_video_formats) ) {
+		pr_err("nano-videodev: unsupported fourcc %.4s\n",
+				(const char*)&f->fmt.pix_mp.pixelformat);
+		return -EINVAL;
+	}
+	nvf = supported_video_formats + i;
+	vl->format = nvf;
+	f->fmt.pix_mp.width += f->fmt.pix_mp.width & 1;
+	f->fmt.pix_mp.height += f->fmt.pix_mp.height & 1;
+	vl->width = f->fmt.pix_mp.width;
+	vl->height = f->fmt.pix_mp.height;
+	vl->useSingleBuf = f->fmt.pix_mp.num_planes == 1;
+	dp_plane_update(vl, PUK_INPUT_FORMAT, NULL);
+	f->fmt.pix_mp.field = V4L2_FIELD_NONE;
+	if( ! vl->useSingleBuf )
+		f->fmt.pix_mp.num_planes = nvf->num_planes;
+	fill_bytesperline_and_sizeimage_mp(f, nvf);
+	return 0;
+}
+
+static int nano_video_vidioc_g_fmt_vid_out_overlay(struct file *file, void *fh,
+					    struct v4l2_format *f)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+	f->fmt.win.w.left = vl->dst_left;
+	f->fmt.win.w.top = vl->dst_top;
+	f->fmt.win.w.width = vl->dst_width;
+	f->fmt.win.w.height = vl->dst_height;
+	f->fmt.win.field = V4L2_FIELD_NONE;
+	return 0;
+}
+
+static int nano_video_vidioc_s_fmt_vid_out_overlay(struct file *file, void *fh,
+					    struct v4l2_format *f)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+
+	vl->dst_left = f->fmt.win.w.left;
+	vl->dst_top = f->fmt.win.w.top;
+	vl->dst_width = f->fmt.win.w.width;
+	vl->dst_height = f->fmt.win.w.height;
+	dp_plane_update(vl, PUK_OVERLAY_WINDOW, NULL);
+	return 0;
+}
+
+static int nano_video_vidioc_overlay(struct file *file, void *fh, unsigned i)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+
+	vl->isVidiocOverlayOn = i != 0;
+	dp_plane_update(vl, PUK_OVERLAY_WINDOW, NULL);
+	return 0;
+}
+
+static int nano_video_vidioc_queryctrl(struct file *file, void *fh,
+				struct v4l2_queryctrl *a)
+{
+	static const unsigned supportedIds[] = {
+		V4L2_CID_BRIGHTNESS,
+		V4L2_CID_CONTRAST,
+		V4L2_CID_SATURATION,
+		V4L2_CID_HUE,
+		V4L2_CID_ALPHA_COMPONENT,
+		V4L2_CID_PRIVATE_BASE
+	};
+	unsigned i, controlId, nextId = 0;
+
+	controlId = a->id &
+		~(V4L2_CTRL_FLAG_NEXT_CTRL|V4L2_CTRL_FLAG_NEXT_COMPOUND);
+	if( a->id & V4L2_CTRL_FLAG_NEXT_CTRL ) {
+		for(i = 0; i < ARRAY_SIZE(supportedIds); ++i) {
+			if( supportedIds[i] > controlId && (nextId == 0 ||
+						nextId > supportedIds[i]) )
+				nextId = supportedIds[i];
+		}
+		if( nextId == 0 )
+			return -EINVAL;
+		controlId = nextId;
+	}
+	a->id = controlId;
+	switch( controlId ) {
+	case V4L2_CID_BRIGHTNESS:
+		a->type = V4L2_CTRL_TYPE_INTEGER;
+		strlcpy(a->name, "brightness", sizeof(a->name));
+		a->minimum = -128;
+		a->maximum = 127;
+		a->step = 1;
+		a->default_value = 0;
+		a->flags = 0;
+		break;
+	case V4L2_CID_CONTRAST:
+		a->type = V4L2_CTRL_TYPE_INTEGER;
+		strlcpy(a->name, "contrast", sizeof(a->name));
+		a->minimum = 0;
+		a->maximum = 7;
+		a->step = 1;
+		a->default_value = 0;
+		a->flags = 0;
+		break;
+	case V4L2_CID_SATURATION:
+		a->type = V4L2_CTRL_TYPE_INTEGER;
+		strlcpy(a->name, "saturation", sizeof(a->name));
+		a->minimum = 0;
+		a->maximum = 127;
+		a->step = 1;
+		a->default_value = 64;
+		a->flags = 0;
+		break;
+	case V4L2_CID_HUE:
+		a->type = V4L2_CTRL_TYPE_INTEGER;
+		strlcpy(a->name, "saturation", sizeof(a->name));
+		a->minimum = -180;
+		a->maximum = 179;
+		a->step = 1;
+		a->default_value = 0;
+		a->flags = 0;
+		break;
+	case V4L2_CID_ALPHA_COMPONENT:
+		a->type = V4L2_CTRL_TYPE_INTEGER;
+		strlcpy(a->name, "alpha", sizeof(a->name));
+		a->minimum = 0;
+		a->maximum = 255;
+		a->step = 1;
+		a->default_value = 255;
+		a->flags = 0;
+		break;
+	case V4L2_CID_PRIVATE_BASE:
+		a->type = V4L2_CTRL_TYPE_INTEGER;
+		strlcpy(a->name, "layer z-order", sizeof(a->name));
+		a->minimum = 0;
+		a->maximum = 3;
+		a->step = 1;
+		a->default_value = 2;
+		a->flags = 0;
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static void setHueSaturationOnMlc(const struct nx_videolayer *vl)
+{
+	/* sin(0) .. sin(90) multiplied by 65535 */
+	static const unsigned short sine_table[91] = {
+		    0,  1143,  2287,  3429,  4571,  5711,  6850,  7986,  9120, 10251,
+		11380, 12504, 13625, 14742, 15854, 16961, 18063, 19160, 20251, 21336,
+		22414, 23485, 24549, 25606, 26655, 27696, 28728, 29752, 30766, 31771,
+		32767, 33753, 34728, 35692, 36646, 37589, 38520, 39439, 40347, 41242,
+		42125, 42994, 43851, 44694, 45524, 46340, 47141, 47929, 48701, 49459,
+		50202, 50930, 51642, 52338, 53018, 53683, 54330, 54962, 55576, 56174,
+		56754, 57318, 57863, 58392, 58902, 59394, 59869, 60325, 60762, 61182,
+		61582, 61964, 62327, 62671, 62996, 63301, 63588, 63855, 64102, 64330,
+		64539, 64728, 64897, 65046, 65175, 65285, 65375, 65445, 65495, 65525,
+		65535
+	};
+	int sine, cosine;
+
+	if( vl->hue < -90 ) {
+		sine = -sine_table[ vl->hue + 180 ];
+		cosine = -sine_table[ -90 - vl->hue ];
+	}else if( vl->hue < 0 ) {
+		sine = -sine_table[ -vl->hue ];
+		cosine = sine_table[ 90 + vl->hue ];
+	}else if( vl->hue < 90 ) {
+		sine = sine_table[ vl->hue ];
+		cosine = sine_table[ 90 - vl->hue ];
+	}else{
+		sine = sine_table[ 180 - vl->hue ];
+		cosine = -sine_table[ vl->hue - 90 ];
+	}
+	sine = (sine * vl->saturation) / 65535;
+	cosine = (cosine * vl->saturation) / 65535;
+	nx_mlc_set_video_layer_chroma_enhance(vl->module, 0,
+			cosine, -sine, sine, cosine);
+}
+
+int nano_video_vidioc_g_ctrl(struct file *file, void *fh,
+			     struct v4l2_control *a)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+
+	switch( a->id ) {
+	case V4L2_CID_BRIGHTNESS:
+		a->value = nx_mlc_get_video_layer_brightness(vl->module);
+		break;
+	case V4L2_CID_CONTRAST:
+		a->value = nx_mlc_get_video_layer_contrast(vl->module);
+		break;
+	case V4L2_CID_SATURATION:
+		a->value = vl->saturation;
+		break;
+	case V4L2_CID_HUE:
+		a->value = vl->hue;
+		break;
+	case V4L2_CID_ALPHA_COMPONENT:
+		a->value = nx_mlc_get_layer_alpha256(vl->module, 3);
+		break;
+	case V4L2_CID_PRIVATE_BASE:
+		a->value = nx_soc_dp_plane_video_get_priority(vl->module);
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int nano_video_vidioc_s_ctrl(struct file *file, void *fh,
+			     struct v4l2_control *a)
+{
+	struct nx_videolayer *vl = video_drvdata(file);
+
+	switch( a->id ) {
+	case V4L2_CID_BRIGHTNESS:
+		nx_mlc_set_video_layer_brightness(vl->module,
+				clamp_val(a->value, -128, 127));
+		break;
+	case V4L2_CID_CONTRAST:
+		nx_mlc_set_video_layer_contrast(vl->module,
+				clamp_val(a->value, 0, 7));
+		break;
+	case V4L2_CID_SATURATION:
+		vl->saturation = clamp_val(a->value, 0, 127);
+		setHueSaturationOnMlc(vl);
+		break;
+	case V4L2_CID_HUE:
+		vl->hue = clamp_val(a->value, -180, 180);
+		setHueSaturationOnMlc(vl);
+		break;
+	case V4L2_CID_ALPHA_COMPONENT:
+		nx_mlc_set_layer_alpha256(vl->module, 3, clamp_val(a->value, 0, 255));
+		break;
+	case V4L2_CID_PRIVATE_BASE:
+		nx_soc_dp_plane_video_set_priority(vl->module,
+				clamp_val(a->value, 0, 3));
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static const struct v4l2_ioctl_ops nano_video_ioctl_ops = {
+	.vidioc_querycap				= nano_video_vidioc_querycap,
+	.vidioc_enum_fmt_vid_out		= nano_video_vidioc_enum_fmt_vid_out,
+	.vidioc_enum_framesizes			= nano_video_vidioc_enum_framesizes,
+	//.vidioc_enum_frameintervals		= nano_video_vidioc_enum_frameintervals,
+	.vidioc_g_fmt_vid_out			= nano_video_vidioc_g_fmt_vid_out,
+	.vidioc_try_fmt_vid_out			= nano_video_vidioc_try_fmt_vid_out,
+	.vidioc_s_fmt_vid_out			= nano_video_vidioc_s_fmt_vid_out,
+	.vidioc_g_fmt_vid_out_overlay	= nano_video_vidioc_g_fmt_vid_out_overlay,
+	.vidioc_s_fmt_vid_out_overlay	= nano_video_vidioc_s_fmt_vid_out_overlay,
+	.vidioc_overlay					= nano_video_vidioc_overlay,
+	.vidioc_queryctrl				= nano_video_vidioc_queryctrl,
+	.vidioc_g_ctrl					= nano_video_vidioc_g_ctrl,
+	.vidioc_s_ctrl					= nano_video_vidioc_s_ctrl,
+	.vidioc_reqbufs					= vb2_ioctl_reqbufs,
+	.vidioc_create_bufs       		= vb2_ioctl_create_bufs,
+	.vidioc_prepare_buf       		= vb2_ioctl_prepare_buf,
+	.vidioc_querybuf          		= vb2_ioctl_querybuf,
+	.vidioc_qbuf              		= vb2_ioctl_qbuf,
+	.vidioc_dqbuf             		= vb2_ioctl_dqbuf,
+	.vidioc_expbuf            		= vb2_ioctl_expbuf,
+	.vidioc_streamon          		= vb2_ioctl_streamon,
+	.vidioc_streamoff         		= vb2_ioctl_streamoff,
+
+};
+
+static const struct v4l2_ioctl_ops nano_video_ioctl_ops_mp = {
+	.vidioc_querycap				= nano_video_vidioc_querycap,
+	.vidioc_enum_fmt_vid_out		= nano_video_vidioc_enum_fmt_vid_out,
+	.vidioc_enum_fmt_vid_out_mplane = nano_video_vidioc_enum_fmt_vid_out,
+	.vidioc_enum_framesizes			= nano_video_vidioc_enum_framesizes,
+	//.vidioc_enum_frameintervals		= nano_video_vidioc_enum_frameintervals,
+	.vidioc_g_fmt_vid_out			= nano_video_vidioc_g_fmt_vid_out,
+	.vidioc_g_fmt_vid_out_mplane	= nano_video_vidioc_g_fmt_vid_out_mplane,
+	.vidioc_try_fmt_vid_out			= nano_video_vidioc_try_fmt_vid_out,
+	.vidioc_try_fmt_vid_out_mplane	= nano_video_vidioc_try_fmt_vid_out_mplane,
+	.vidioc_s_fmt_vid_out			= nano_video_vidioc_s_fmt_vid_out,
+	.vidioc_s_fmt_vid_out_mplane	= nano_video_vidioc_s_fmt_vid_out_mplane,
+	.vidioc_g_fmt_vid_out_overlay	= nano_video_vidioc_g_fmt_vid_out_overlay,
+	.vidioc_s_fmt_vid_out_overlay	= nano_video_vidioc_s_fmt_vid_out_overlay,
+	.vidioc_queryctrl				= nano_video_vidioc_queryctrl,
+	.vidioc_g_ctrl					= nano_video_vidioc_g_ctrl,
+	.vidioc_s_ctrl					= nano_video_vidioc_s_ctrl,
+	.vidioc_overlay					= nano_video_vidioc_overlay,
+	.vidioc_reqbufs					= vb2_ioctl_reqbufs,
+	.vidioc_create_bufs       		= vb2_ioctl_create_bufs,
+	.vidioc_prepare_buf       		= vb2_ioctl_prepare_buf,
+	.vidioc_querybuf          		= vb2_ioctl_querybuf,
+	.vidioc_qbuf              		= vb2_ioctl_qbuf,
+	.vidioc_dqbuf             		= vb2_ioctl_dqbuf,
+	.vidioc_expbuf            		= vb2_ioctl_expbuf,
+	.vidioc_streamon          		= vb2_ioctl_streamon,
+	.vidioc_streamoff         		= vb2_ioctl_streamoff,
+
+};
+
+static const struct v4l2_file_operations nano_video_fops = {
+	.owner			= THIS_MODULE,
+	.open			= v4l2_fh_open,
+	.read			= vb2_fop_read,
+	.write			= vb2_fop_write,
+	.poll			= vb2_fop_poll,
+	.mmap			= vb2_fop_mmap,
+	.unlocked_ioctl = video_ioctl2,
+	.release		= vb2_fop_release,
+};
+
+static int nano_video_vb2_queue_setup(struct vb2_queue *q,
+		   unsigned int *num_buffers, unsigned int *num_planes,
+		   unsigned int sizes[], struct device *alloc_devs[])
+{
+	struct nx_videolayer *vl = vb2_get_drv_priv(q);
+	const struct NanoVideoFormat *nvf = vl->format;
+	unsigned stride, sizeLume, sizeUV;
+
+	stride = round_up8(vl->width * nvf->bpp);
+	sizeLume = stride * vl->height;
+	sizeUV = nvf->hsub ? stride / nvf->hsub * vl->height / nvf->vsub : 0;
+	if( *num_planes == 0 ) {
+		if( *num_buffers < 3 )
+			*num_buffers = 3;
+		*num_planes = vl->useSingleBuf ? 1 : nvf->num_planes;
+		if( *num_planes == 3 ) {
+			sizes[0] = sizeLume;
+			sizes[1] = sizes[2] = sizeUV;
+		}else
+			sizes[0] = sizeLume + 2 * sizeUV;
+	}else{	// checking additional buffers for VIDIOC_CREATE_BUFS
+		if( *num_planes == vl->useSingleBuf ? 1 : nvf->num_planes ) {
+			if( *num_planes == 3 ?
+				sizes[0] < sizeLume || sizes[1] < sizeUV || sizes[2] < sizeUV :
+				sizes[0] < sizeLume + 2 * sizeUV )
+			{
+				pr_err("nano-videodev: buffer size too small\n");
+				return -EINVAL;
+			}
+		}else{
+			pr_err("nano-videodev: num planes mismatch\n");
+			return -EINVAL;
+		}
+	}
+	return 0;
+}
+
+static void nano_video_vb2_buf_queue(struct vb2_buffer *vb)
+{
+	struct nx_videolayer *vl = vb2_get_drv_priv(vb->vb2_queue);
+
+	dp_plane_update(vl, PUK_VB2_BUF, vb);
+}
+
+static int nano_video_vb2_start_streaming(struct vb2_queue *q, unsigned count)
+{
+	struct nx_videolayer *vl = vb2_get_drv_priv(q);
+
+	vl->isVidiocOverlayOn = true;
+	dp_plane_update(vl, PUK_INPUT_FORMAT, NULL);
+	return 0;
+}
+
+static void nano_video_vb2_stop_streaming(struct vb2_queue *q)
+{
+	struct nx_videolayer *vl = vb2_get_drv_priv(q);
+
+	vl->isVidiocOverlayOn = false;
+	dp_plane_update(vl, PUK_VB2_BUF, NULL);
+	flush_work(&vl->buf_switch_wait_work);
+}
+
+static struct vb2_ops nano_video_vb2_queue_ops = {
+	.queue_setup			= nano_video_vb2_queue_setup,
+	.buf_queue				= nano_video_vb2_buf_queue,
+	.start_streaming		= nano_video_vb2_start_streaming,
+	.stop_streaming			= nano_video_vb2_stop_streaming,
+	.wait_prepare           = vb2_ops_wait_prepare,
+	.wait_finish            = vb2_ops_wait_finish,
+};
+
+static void nano_video_device_release(struct video_device *vdev)
+{
+	/* print out information to verify that module was unloaded correctly */
+	pr_info("nano-videodev: released video device\n");
+}
+
+static int nano_video_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct resource *res;
+	void *reg_base;
+	struct nano_video_device *nvdev;
+
+	nvdev = devm_kzalloc(&pdev->dev, sizeof(struct nano_video_device),
+			GFP_KERNEL);
+	if( nvdev == NULL )
+		return -ENOMEM;
+	strlcpy(nvdev->vdev.name, "nano-videodev", sizeof(nvdev->vdev.name));
+	nvdev->vdev.vfl_dir = VFL_DIR_TX;
+	nvdev->vdev.fops = &nano_video_fops;
+	nvdev->vdev.release = nano_video_device_release;
+	nvdev->vdev.ioctl_ops = single_plane_mode ?  &nano_video_ioctl_ops :
+		&nano_video_ioctl_ops_mp;
+	nvdev->vl.module = 0;
+	nvdev->vl.format = NULL;
+	nvdev->vl.hue = 0;
+	nvdev->vl.saturation = 64;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if(res == NULL) {
+		dev_err(&pdev->dev, "failed to get registers base address\n");
+		return -ENXIO;
+	}
+	reg_base = devm_ioremap_resource(&pdev->dev, res);
+	if( reg_base == NULL ) {
+		dev_err(&pdev->dev, "failed to iomap MLC\n");
+		return -EIO;
+	}
+	nx_mlc_set_base_address(nvdev->vl.module, reg_base);
+	ret = v4l2_device_register(&pdev->dev, &nvdev->v4l2_dev);
+	if( ret ) {
+		dev_err(&pdev->dev, "failed to register v4l2 device\n");
+		return ret;
+	}
+	mutex_init(&nvdev->lock);
+	spin_lock_init(&nvdev->vl.wq_lock);
+	nvdev->vl.workqueue = alloc_workqueue("nano-videodev",
+			WQ_UNBOUND | WQ_MEM_RECLAIM, 1);
+	INIT_WORK(&nvdev->vl.buf_switch_wait_work, buf_switch_wait_work);
+	if( ! nvdev->vl.workqueue ) {
+		dev_err(&pdev->dev, "unable to alloc workqueue\n");
+		ret = -ENOMEM;
+		goto err_unregister_v4l2;
+	}
+
+	nvdev->queue.type = single_plane_mode ? V4L2_BUF_TYPE_VIDEO_OUTPUT :
+		V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
+	nvdev->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_WRITE |
+		VB2_DMABUF;
+	nvdev->queue.dev = &pdev->dev;
+	nvdev->queue.lock = &nvdev->lock;
+	nvdev->queue.ops = &nano_video_vb2_queue_ops;
+	nvdev->queue.mem_ops = &vb2_dma_contig_memops;
+	nvdev->queue.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	nvdev->queue.drv_priv = &nvdev->vl;
+	ret = vb2_queue_init(&nvdev->queue);
+	if( ret ) {
+		dev_err(&pdev->dev, "queue init failed\n");
+		goto err_destroy_workqueue;
+	}
+	nvdev->vdev.queue = &nvdev->queue;
+	nvdev->vdev.v4l2_dev = &nvdev->v4l2_dev;
+	video_set_drvdata(&nvdev->vdev, &nvdev->vl);
+	ret = video_register_device(&nvdev->vdev, VFL_TYPE_GRABBER, 1);
+	if( ret ) {
+		dev_err(&pdev->dev, "failed to register video device\n");
+		goto err_queue_release;
+	}
+	dev_info(&pdev->dev, "registered video device %s\n", nvdev->vdev.name);
+	nvdev->vl.format = supported_video_formats; // first format is default
+	nvdev->vl.width = 640;
+	nvdev->vl.height = 360;
+	nx_mlc_get_screen_size(0, &nvdev->vl.dst_width,
+				   &nvdev->vl.dst_height);
+	if( nvdev->vl.dst_width > 1920 ) {
+		nvdev->vl.dst_left = (nvdev->vl.dst_width - 1920) / 2;
+		nvdev->vl.dst_width = 1920;
+	}
+	if( nvdev->vl.dst_height > 1080 ) {
+		nvdev->vl.dst_top = (nvdev->vl.dst_height - 1080) / 2;
+		nvdev->vl.dst_height = 1080;
+	}
+	platform_set_drvdata(pdev, nvdev);
+	setHueSaturationOnMlc(&nvdev->vl);
+	return 0;
+err_queue_release:
+	vb2_queue_release(&nvdev->queue);
+err_destroy_workqueue:
+	destroy_workqueue(nvdev->vl.workqueue);
+err_unregister_v4l2:
+	v4l2_device_unregister(&nvdev->v4l2_dev);
+	return ret;
+}
+
+static int nano_video_remove(struct platform_device *pdev)
+{
+	struct nano_video_device *nvdev = platform_get_drvdata(pdev);
+
+	video_unregister_device(&nvdev->vdev);
+	vb2_queue_release(&nvdev->queue);
+	destroy_workqueue(nvdev->vl.workqueue);
+	v4l2_device_unregister(&nvdev->v4l2_dev);
+	pr_info("nano-videodev: unregistered v4l2 device\n");
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nano_video_of_match[] = {
+	{ .compatible = "nexell,nano-videodev" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, nano_video_of_match);
+#endif
+
+static struct platform_driver nano_video_platform_driver = {
+	.probe = nano_video_probe,
+	.remove = nano_video_remove,
+	.driver = {
+		.name = "nano-videodev",
+		.of_match_table = of_match_ptr(nano_video_of_match),
+	},
+};
+
+static int __init nano_video_init(void)
+{
+	int ret = platform_driver_register(&nano_video_platform_driver);
+	pr_info("nano-videodev: registered platform driver\n");
+	return ret;
+}
+
+static void __exit nano_video_exit(void)
+{
+	platform_driver_unregister(&nano_video_platform_driver);
+	pr_info("nano-videodev: unregistered platform driver\n");
+}
+
+module_init(nano_video_init);
+module_exit(nano_video_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rafaello7 <fatwildcat@gmail.com>");
+MODULE_DESCRIPTION("Expose MLC video layer of s5p6818 as v4l2 device");
diff -ENwbur a/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.c b/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.c
--- a/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.c	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,182 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/module.h>
+#include "s5pxx18_dp_dev.h"
+
+#define	LAYER_VIDEO		PLANE_VIDEO_NUM
+
+
+void nx_soc_dp_plane_video_set_dirty(int module)
+{
+	nx_mlc_set_dirty_flag(module, LAYER_VIDEO);
+}
+
+bool nx_soc_dp_plane_video_is_dirty(int module)
+{
+	return nx_mlc_get_dirty_flag(module, LAYER_VIDEO);
+}
+
+void nx_soc_dp_plane_video_set_format(int module,
+			enum nx_mlc_yuvfmt format)
+{
+	int m_lock_size = 16;
+
+	pr_debug("%s: format=0x%x\n", __func__, format);
+	nx_mlc_set_lock_size(module, LAYER_VIDEO, m_lock_size);
+	nx_mlc_set_format_yuv(module, format);
+}
+
+void nx_soc_dp_plane_video_set_position(int module,
+			int src_x, int src_y, int src_w, int src_h,
+			int dst_x, int dst_y, int dst_w, int dst_h)
+{
+	int sx = src_x, sy = src_y;
+	int sw = src_w, sh = src_h;
+	int dx = dst_x, dy = dst_y;
+	int dw = dst_w, dh = dst_h;
+	int hf = 1, vf = 1;
+	int w = 0, h = 0;
+
+	/*
+	 * max scale size 2048
+	 * if ove scale size, fix max
+	 */
+	if (dw > 2048)
+		dw = 2048;
+
+	if (dh > 2048)
+		dh = 2048;
+
+	w = dx + dw;
+	h = dy + dh;
+
+	/* max rectangle 2048 */
+	if (w > 2048)
+		w = 2048;
+
+	if (h > 2048)
+		h = 2048;
+
+	pr_debug("%s: (%d, %d, %d, %d) to (%d, %d, %d, %d, %d, %d)\n",
+		 __func__, sx, sy, sw, sh, dx, dy, dw, dh, w, h);
+
+	if (sw == dw && sh == dh)
+		hf = 0, vf = 0;
+
+	/* set scale and position */
+	nx_mlc_set_video_layer_scale(module, sw, sh, dw, dh, hf, hf, vf, vf);
+	nx_mlc_set_position(module, LAYER_VIDEO, dx, dy, w - 1, h - 1);
+}
+
+void nx_soc_dp_plane_video_set_address_1p(int module,
+		int left, int top,
+		unsigned int addr, unsigned int stride)
+{
+	unsigned int phys = addr + (left/2) + (top * stride);
+
+	pr_debug("%s: lu:0x%x->0x%x,%d\n",
+		__func__, addr, phys, stride);
+
+	nx_mlc_set_video_layer_address_yuyv(module, phys, stride);
+}
+
+void nx_soc_dp_plane_video_set_address_3p(int module, int left, int top,
+		enum nx_mlc_yuvfmt format,
+		unsigned int lu_a, unsigned int lu_s,
+		unsigned int cb_a, unsigned int cb_s,
+		unsigned int cr_a, unsigned int cr_s)
+{
+	int ls = 1, us = 1;
+	int lh = 1, uh = 1;
+
+	switch (format) {
+	case nx_mlc_yuvfmt_420:
+		us = 2, uh = 2;
+		break;
+	case nx_mlc_yuvfmt_422:
+		us = 2, uh = 1;
+		break;
+	case nx_mlc_yuvfmt_444:
+		us = 1, uh = 1;
+		break;
+	default:
+		return;
+	}
+
+	lu_a = lu_a + (left/ls) + (top/lh * lu_s);
+	cb_a = cb_a + (left/us) + (top/uh * cb_s);
+	cr_a = cr_a + (left/us) + (top/uh * cr_s);
+
+	pr_debug("%s: lu:0x%x,%d, cb:0x%x,%d, cr:0x%x,%d\n",
+		__func__, lu_a, lu_s, cb_a, cb_s, cr_a, cr_s);
+
+	nx_mlc_set_video_layer_stride(module, lu_s, cb_s, cr_s);
+	nx_mlc_set_video_layer_address(module, lu_a, cb_a, cr_a);
+}
+
+void nx_soc_dp_plane_video_set_enable(int module, bool on)
+{
+	int hl, hc, vl, vc;
+
+	pr_debug("%s: %s\n", __func__, on ? "on" : "off");
+
+	if (on) {
+		nx_mlc_set_video_layer_line_buffer_power_mode(module, 1);
+		nx_mlc_set_video_layer_line_buffer_sleep_mode(module, 0);
+		nx_mlc_set_layer_enable(module, LAYER_VIDEO, 1);
+	} else {
+		nx_mlc_set_layer_enable(module, LAYER_VIDEO, 0);
+
+		nx_mlc_get_video_layer_scale_filter(module, &hl, &hc, &vl, &vc);
+		if (hl | hc | vl | vc)
+			nx_mlc_set_video_layer_scale_filter(module, 0, 0, 0, 0);
+		nx_mlc_set_video_layer_line_buffer_power_mode(module, 0);
+		nx_mlc_set_video_layer_line_buffer_sleep_mode(module, 1);
+	}
+}
+
+int nx_soc_dp_plane_video_get_priority(int module)
+{
+	return nx_mlc_get_layer_priority(module);
+}
+
+void nx_soc_dp_plane_video_set_priority(int module, int priority)
+{
+	switch (priority) {
+	case 0:
+		priority = nx_mlc_priority_videofirst;
+		break;	/* PRIORITY-video>0>1>2 */
+	case 1:
+		priority = nx_mlc_priority_videosecond;
+		break;	/* PRIORITY-0>video>1>2 */
+	case 2:
+		priority = nx_mlc_priority_videothird;
+		break;	/* PRIORITY-0>1>video>2 */
+	case 3:
+		priority = nx_mlc_priority_videofourth;
+		break;	/* PRIORITY-0>1>2>video */
+	default:
+		pr_err(
+			"fail : not support video priority num(0~3),(%d)\n",
+		    priority);
+		return;
+	}
+
+	nx_mlc_set_layer_priority(module, priority);
+	nx_mlc_set_top_dirty_flag(module);
+}
diff -ENwbur a/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.h b/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.h
--- a/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nano-videodev/s5pxx18_dp_dev.h	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_DP_DEV_H_
+#define _S5PXX18_DP_DEV_H_
+
+#include "s5pxx18_soc_mlc.h"
+
+#define	PLANE_VIDEO_NUM			(3) /* Planes = 0,1 (RGB), 3 (VIDEO) */
+
+/* for prototype layer index */
+enum dp_color_type {
+	dp_color_colorkey,
+	dp_color_alpha,
+	dp_color_bright,
+	dp_color_hue,
+	dp_color_contrast,
+	dp_color_saturation,
+	dp_color_gamma,
+	dp_color_transp,
+	dp_color_invert,
+};
+
+void nx_soc_dp_plane_video_set_format(int module,
+			enum nx_mlc_yuvfmt format);
+void nx_soc_dp_plane_video_set_position(int module,
+			int src_x, int src_y, int src_w, int src_h,
+			int dst_x, int dst_y, int dst_w, int dst_h);
+void nx_soc_dp_plane_video_set_address_1p(int module, int left, int top,
+		unsigned int addr, unsigned int stride);
+void nx_soc_dp_plane_video_set_address_3p(int module, int left, int top,
+		enum nx_mlc_yuvfmt format,
+		unsigned int lu_a, unsigned int lu_s,
+		unsigned int cb_a, unsigned int cb_s,
+		unsigned int cr_a, unsigned int cr_s);
+void nx_soc_dp_plane_video_set_enable(int module, bool on);
+int nx_soc_dp_plane_video_get_priority(int module);
+void nx_soc_dp_plane_video_set_priority(int module, int priority);
+bool nx_soc_dp_plane_video_is_dirty(int module);
+void nx_soc_dp_plane_video_set_dirty(int module);
+
+#endif /* __S5PXX18_DP_DEV_H__ */
diff -ENwbur a/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.c b/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.c
--- a/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.c	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,1818 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/types.h>
+#include <linux/io.h>
+
+#include "s5pxx18_soc_mlc.h"
+
+static struct {
+	struct nx_mlc_register_set *pregister;
+} __g_module_variables[NUMBER_OF_MLC_MODULE] = { { NULL, },};
+
+int nx_mlc_initialize(void)
+{
+	static int binit;
+	u32 i;
+
+	if (0 == binit) {
+		for (i = 0; i < NUMBER_OF_MLC_MODULE; i++)
+			__g_module_variables[i].pregister = NULL;
+		binit = 1;
+	}
+	return 1;
+}
+
+u32 nx_mlc_get_physical_address(u32 module_index)
+{
+	const u32 physical_addr[] = PHY_BASEADDR_MLC_LIST;
+
+	return physical_addr[module_index];
+}
+
+void nx_mlc_set_base_address(u32 module_index, void *base_address)
+{
+	__g_module_variables[module_index].pregister =
+	    (struct nx_mlc_register_set *)base_address;
+}
+
+void *nx_mlc_get_base_address(u32 module_index)
+{
+	return (void *)__g_module_variables[module_index].pregister;
+}
+
+void nx_mlc_set_top_dirty_flag(u32 module_index)
+{
+	const u32 dirtyflag = 1ul << 3;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue |= dirtyflag;
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_top_dirty_flag(u32 module_index)
+{
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+
+	return (int)((readl(&__g_module_variables[module_index]
+			    .pregister->mlccontrolt) &
+		      dirtyflag_mask) >> dirtyflag_pos);
+}
+
+void nx_mlc_set_mlc_enable(u32 module_index, int benb)
+{
+	const u32 mlcenb_pos = 1;
+	const u32 mlcenb_mask = 1ul << mlcenb_pos;
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(mlcenb_mask | dirtyflag_mask);
+	regvalue |= (benb << mlcenb_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_mlc_enable(u32 module_index)
+{
+	const u32 mlcenb_pos = 1;
+	const u32 mlcenb_mask = 1ul << mlcenb_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlccontrolt & mlcenb_mask) >> mlcenb_pos);
+}
+
+void nx_mlc_set_field_enable(u32 module_index, int benb)
+{
+	const u32 fieldenb_pos = 0;
+	const u32 fieldenb_mask = 1ul << fieldenb_pos;
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(fieldenb_mask | dirtyflag_mask);
+	regvalue |= (benb << fieldenb_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+int nx_mlc_get_field_enable(u32 module_index)
+{
+	const u32 fieldenb_pos = 0;
+	const u32 fieldenb_mask = 1ul << fieldenb_pos;
+
+	return (int)(__g_module_variables[module_index].pregister->mlccontrolt &
+		     fieldenb_mask);
+}
+
+enum nx_mlc_priority nx_mlc_get_layer_priority(u32 module_index)
+{
+	const u32 priority_pos = 8;
+	const u32 priority_mask = 0x03 << priority_pos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	return (regvalue & priority_mask) >> priority_pos;
+}
+
+void nx_mlc_set_layer_priority(u32 module_index, enum nx_mlc_priority priority)
+{
+	const u32 priority_pos = 8;
+	const u32 priority_mask = 0x03 << priority_pos;
+	const u32 dirtyflag_pos = 3;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlccontrolt;
+	regvalue &= ~(priority_mask | dirtyflag_mask);
+	regvalue |= (priority << priority_pos);
+
+	writel(regvalue, &pregister->mlccontrolt);
+}
+
+void nx_mlc_set_screen_size(u32 module_index, u32 width, u32 height)
+{
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = ((height - 1) << 16) | (width - 1);
+
+	writel(regvalue, &pregister->mlcscreensize);
+}
+
+void nx_mlc_get_screen_size(u32 module_index, u32 *pwidth, u32 *pheight)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	if (NULL != pwidth)
+		*pwidth = (pregister->mlcscreensize & 0x0fff) + 1;
+
+	if (NULL != pheight)
+		*pheight = ((pregister->mlcscreensize >> 16) & 0x0fff) + 1;
+}
+
+void nx_mlc_set_background(u32 module_index, u32 color)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(color, &pregister->mlcbgcolor);
+}
+
+void nx_mlc_set_dirty_flag(u32 module_index, u32 layer)
+{
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+	const u32 dirtyflg_mask = 1ul << 4;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue |= dirtyflg_mask;
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	} else if (3 == layer) {
+		regvalue = pregister->mlcvideolayer.mlccontrol;
+		regvalue |= dirtyflg_mask;
+
+		writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+	}
+}
+
+int nx_mlc_get_dirty_flag(u32 module_index, u32 layer)
+{
+	const u32 dirtyflg_pos = 4;
+	const u32 dirtyflg_mask = 1ul << dirtyflg_pos;
+
+	if (0 == layer || 1 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcrgblayer[layer]
+			      .mlccontrol & dirtyflg_mask) >> dirtyflg_pos);
+	} else if (2 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcrgblayer2.mlccontrol &
+			      dirtyflg_mask) >> dirtyflg_pos);
+	} else if (3 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcvideolayer.mlccontrol &
+			      dirtyflg_mask) >> dirtyflg_pos);
+	}
+	return 0;
+}
+
+void nx_mlc_set_layer_enable(u32 module_index, u32 layer, int benb)
+{
+	const u32 layerenb_pos = 5;
+	const u32 layerenb_mask = 0x01 << layerenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(layerenb_mask | dirtyflag_mask);
+		regvalue |= (benb << layerenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	} else if (3 == layer) {
+		regvalue = pregister->mlcvideolayer.mlccontrol;
+		regvalue &= ~(layerenb_mask | dirtyflag_mask);
+		regvalue |= (benb << layerenb_pos);
+
+		writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+	}
+}
+
+int nx_mlc_get_layer_enable(u32 module_index, u32 layer)
+{
+	const u32 layerenb_pos = 5;
+	const u32 layerenb_mask = 0x01 << layerenb_pos;
+
+	if (0 == layer || 1 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcrgblayer[layer]
+			      .mlccontrol & layerenb_mask) >> layerenb_pos);
+	} else if (3 == layer) {
+		return (int)((__g_module_variables[module_index]
+			      .pregister->mlcvideolayer.mlccontrol &
+			      layerenb_mask) >> layerenb_pos);
+	}
+	return 0;
+}
+
+void nx_mlc_set_lock_size(u32 module_index, u32 layer, u32 locksize)
+{
+	const u32 locksize_mask = 3ul << 12;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	locksize >>= 3;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(locksize_mask | dirtyflag_mask);
+		regvalue |= (locksize << 12);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	}
+}
+
+void nx_mlc_set_alpha_blending(u32 module_index, u32 layer, int benb, u32 alpha)
+{
+	const u32 blendenb_pos = 2;
+	const u32 blendenb_mask = 0x01 << blendenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 alpha_pos = 28;
+	const u32 alpha_mask = 0xf << alpha_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(blendenb_mask | dirtyflag_mask);
+		regvalue |= (benb << blendenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+		regvalue = pregister->mlcrgblayer[layer].mlctpcolor;
+		regvalue &= ~alpha_mask;
+		regvalue |= alpha << alpha_pos;
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlctpcolor);
+	} else if (3 == layer) {
+		regvalue = pregister->mlcvideolayer.mlccontrol;
+		regvalue &= ~(blendenb_mask | dirtyflag_mask);
+		regvalue |= (benb << blendenb_pos);
+
+		writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+
+		writel(alpha << alpha_pos,
+		       &pregister->mlcvideolayer.mlctpcolor);
+	}
+}
+
+void nx_mlc_set_transparency(u32 module_index, u32 layer, int benb, u32 color)
+{
+	const u32 tpenb_pos = 0;
+	const u32 tpenb_mask = 0x01 << tpenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 tpcolor_pos = 0;
+	const u32 tpcolor_mask = ((1 << 24) - 1) << tpcolor_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(tpenb_mask | dirtyflag_mask);
+		regvalue |= (benb << tpenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+		regvalue = pregister->mlcrgblayer[layer].mlctpcolor;
+		regvalue &= ~tpcolor_mask;
+		regvalue |= (color & tpcolor_mask);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlctpcolor);
+	}
+}
+
+void nx_mlc_set_color_inversion(u32 module_index, u32 layer, int benb,
+				u32 color)
+{
+	const u32 invenb_pos = 1;
+	const u32 invenb_mask = 0x01 << invenb_pos;
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 invcolor_pos = 0;
+	const u32 invcolor_mask = ((1 << 24) - 1) << invcolor_pos;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(invenb_mask | dirtyflag_mask);
+		regvalue |= (benb << invenb_pos);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+		regvalue = pregister->mlcrgblayer[layer].mlcinvcolor;
+		regvalue &= ~invcolor_mask;
+		regvalue |= (color & invcolor_mask);
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlcinvcolor);
+	}
+}
+
+u32 nx_mlc_get_extended_color(u32 module_index, u32 color,
+			      enum nx_mlc_rgbfmt format)
+{
+	u32 rgb[3] = {
+		0,
+	};
+	u32 bw[3] = {
+		0,
+	};
+	u32 bp[3] = {
+		0,
+	};
+	u32 blank = 0;
+	u32 fill = 0;
+	u32 i = 0;
+
+	switch (format) {
+	case nx_mlc_rgbfmt_r5g6b5:
+		bw[0] = 5;
+		bw[1] = 6;
+		bw[2] = 5;
+		bp[0] = 11;
+		bp[1] = 5;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_b5g6r5:
+		bw[0] = 5;
+		bw[1] = 6;
+		bw[2] = 5;
+		bp[0] = 0;
+		bp[1] = 5;
+		bp[2] = 11;
+		break;
+	case nx_mlc_rgbfmt_x1r5g5b5:
+	case nx_mlc_rgbfmt_a1r5g5b5:
+		bw[0] = 5;
+		bw[1] = 5;
+		bw[2] = 5;
+		bp[0] = 10;
+		bp[1] = 5;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_x1b5g5r5:
+	case nx_mlc_rgbfmt_a1b5g5r5:
+		bw[0] = 5;
+		bw[1] = 5;
+		bw[2] = 5;
+		bp[0] = 0;
+		bp[1] = 5;
+		bp[2] = 10;
+		break;
+	case nx_mlc_rgbfmt_x4r4g4b4:
+	case nx_mlc_rgbfmt_a4r4g4b4:
+		bw[0] = 4;
+		bw[1] = 4;
+		bw[2] = 4;
+		bp[0] = 8;
+		bp[1] = 4;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_x4b4g4r4:
+	case nx_mlc_rgbfmt_a4b4g4r4:
+		bw[0] = 4;
+		bw[1] = 4;
+		bw[2] = 4;
+		bp[0] = 0;
+		bp[1] = 4;
+		bp[2] = 8;
+		break;
+	case nx_mlc_rgbfmt_x8r3g3b2:
+	case nx_mlc_rgbfmt_a8r3g3b2:
+		bw[0] = 3;
+		bw[1] = 3;
+		bw[2] = 2;
+		bp[0] = 5;
+		bp[1] = 2;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_x8b3g3r2:
+	case nx_mlc_rgbfmt_a8b3g3r2:
+		bw[0] = 2;
+		bw[1] = 3;
+		bw[2] = 3;
+		bp[0] = 0;
+		bp[1] = 2;
+		bp[2] = 5;
+		break;
+	case nx_mlc_rgbfmt_r8g8b8:
+	case nx_mlc_rgbfmt_a8r8g8b8:
+		bw[0] = 8;
+		bw[1] = 8;
+		bw[2] = 8;
+		bp[0] = 16;
+		bp[1] = 8;
+		bp[2] = 0;
+		break;
+	case nx_mlc_rgbfmt_b8g8r8:
+	case nx_mlc_rgbfmt_a8b8g8r8:
+		bw[0] = 8;
+		bw[1] = 8;
+		bw[2] = 8;
+		bp[0] = 0;
+		bp[1] = 8;
+		bp[2] = 16;
+		break;
+	default:
+		break;
+	}
+	for (i = 0; i < 3; i++) {
+		rgb[i] = (color >> bp[i]) & ((u32) (1 << bw[i]) - 1);
+		fill = bw[i];
+		blank = 8 - fill;
+		rgb[i] <<= blank;
+		while (blank > 0) {
+			rgb[i] |= (rgb[i] >> fill);
+			blank -= fill;
+			fill += fill;
+		}
+	}
+
+	return (rgb[0] << 16) | (rgb[1] << 8) | (rgb[2] << 0);
+}
+
+void nx_mlc_set_format_rgb(u32 module_index, u32 layer,
+			   enum nx_mlc_rgbfmt format)
+{
+	const u32 dirtyflag_pos = 4;
+	const u32 dirtyflag_mask = 1ul << dirtyflag_pos;
+	const u32 format_mask = 0xffff0000ul;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		regvalue = pregister->mlcrgblayer[layer].mlccontrol;
+		regvalue &= ~(format_mask | dirtyflag_mask);
+		regvalue |= (u32) format;
+
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+	}
+}
+
+void nx_mlc_set_format_yuv(u32 module_index, enum nx_mlc_yuvfmt format)
+{
+	const u32 format_mask = 0xffff0000ul;
+	register u32 temp;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = pregister->mlcvideolayer.mlccontrol;
+	temp &= ~format_mask;
+	temp |= (u32) format;
+	writel(temp, &pregister->mlcvideolayer.mlccontrol);
+}
+
+void nx_mlc_set_position(u32 module_index, u32 layer, int32_t sx, int32_t sy,
+			 int32_t ex, int32_t ey)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		writel((((u32) sx & 0xffful) << 16) | ((u32) ex & 0xffful),
+		       &pregister->mlcrgblayer[layer].mlcleftright);
+
+		writel((((u32) sy & 0xffful) << 16) | ((u32) ey & 0xffful),
+		       &pregister->mlcrgblayer[layer].mlctopbottom);
+	} else if (2 == layer) {
+		writel((((u32) sx & 0xffful) << 16) | ((u32) ex & 0xffful),
+		       &pregister->mlcrgblayer2.mlcleftright);
+
+		writel((((u32) sy & 0xffful) << 16) | ((u32) ey & 0xffful),
+		       &pregister->mlcrgblayer2.mlctopbottom);
+	} else if (3 == layer) {
+		writel((((u32) sx & 0xffful) << 16) | ((u32) ex & 0xffful),
+		       &pregister->mlcvideolayer.mlcleftright);
+
+		writel((((u32) sy & 0xffful) << 16) | ((u32) ey & 0xffful),
+		       &pregister->mlcvideolayer.mlctopbottom);
+	}
+}
+
+void nx_mlc_set_dither_enable_when_using_gamma(u32 module_index, int benable)
+{
+	const u32 ditherenb_bitpos = 0;
+	const u32 ditherenb_mask = 1 << ditherenb_bitpos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~ditherenb_mask;
+	read_value |= ((u32) benable << ditherenb_bitpos);
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_dither_enable_when_using_gamma(u32 module_index)
+{
+	const u32 ditherenb_bitpos = 0;
+	const u32 ditherenb_mask = 1 << ditherenb_bitpos;
+
+	return (int)(__g_module_variables[module_index].pregister->
+		     mlcgammacont & ditherenb_mask);
+}
+
+void nx_mlc_set_gamma_priority(u32 module_index, int bvideolayer)
+{
+	const u32 alphaselect_bitpos = 5;
+	const u32 alphaselect_mask = 1 << alphaselect_bitpos;
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~alphaselect_mask;
+	read_value |= ((u32) bvideolayer << alphaselect_bitpos);
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_gamma_priority(u32 module_index)
+{
+	const u32 alphaselect_bitpos = 5;
+	const u32 alphaselect_mask = 1 << alphaselect_bitpos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlcgammacont & alphaselect_mask) >> alphaselect_bitpos);
+}
+
+void nx_mlc_set_rgblayer_invalid_position(u32 module_index, u32 layer,
+					  u32 region, int32_t sx, int32_t sy,
+					  int32_t ex, int32_t ey, int benb)
+{
+	const u32 invalidenb_pos = 28;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		if (0 == region) {
+			writel(((benb << invalidenb_pos) |
+				((sx & 0x7ff) << 16) | (ex & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidleftright0);
+
+			writel((((sy & 0x7ff) << 16) | (ey & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidtopbottom0);
+		} else {
+			writel(((benb << invalidenb_pos) |
+				((sx & 0x7ff) << 16) | (ex & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidleftright1);
+
+			writel((((sy & 0x7ff) << 16) | (ey & 0x7ff)),
+			       &pregister->mlcrgblayer[layer]
+			       .mlcinvalidtopbottom1);
+		}
+	}
+}
+
+void nx_mlc_set_rgblayer_stride(u32 module_index, u32 layer, int32_t hstride,
+				int32_t vstride)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer) {
+		writel(hstride, &pregister->mlcrgblayer[layer].mlchstride);
+		writel(vstride, &pregister->mlcrgblayer[layer].mlcvstride);
+	} else if (2 == layer) {
+		writel(hstride, &pregister->mlcrgblayer2.mlchstride);
+		writel(vstride, &pregister->mlcrgblayer2.mlcvstride);
+	}
+}
+
+void nx_mlc_set_rgblayer_address(u32 module_index, u32 layer, u32 addr)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (0 == layer || 1 == layer)
+		writel(addr, &pregister->mlcrgblayer[layer].mlcaddress);
+	else if (2 == layer)
+		writel(addr, &pregister->mlcrgblayer2.mlcaddress);
+}
+
+void nx_mlc_set_rgblayer_gama_table_power_mode(u32 module_index, int bred,
+					       int bgreen, int bblue)
+{
+	const u32 bgammatable_pwd_bitpos = 11;
+	const u32 ggammatable_pwd_bitpos = 9;
+	const u32 rgammatable_pwd_bitpos = 3;
+	const u32 bgammatable_pwd_mask = (1 << bgammatable_pwd_bitpos);
+	const u32 ggammatable_pwd_mask = (1 << ggammatable_pwd_bitpos);
+	const u32 rgammatable_pwd_mask = (1 << rgammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~(bgammatable_pwd_mask | ggammatable_pwd_mask |
+			rgammatable_pwd_mask);
+	read_value |= (((u32) bred << rgammatable_pwd_bitpos) |
+		       ((u32) bgreen << ggammatable_pwd_bitpos) |
+		       ((u32) bblue << bgammatable_pwd_bitpos));
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_rgblayer_gama_table_power_mode(u32 module_index, int *pbred,
+					       int *pbgreen, int *pbblue)
+{
+	const u32 bgammatable_pwd_bitpos = 11;
+	const u32 ggammatable_pwd_bitpos = 9;
+	const u32 rgammatable_pwd_bitpos = 3;
+	const u32 bgammatable_pwd_mask = (1 << bgammatable_pwd_bitpos);
+	const u32 ggammatable_pwd_mask = (1 << ggammatable_pwd_bitpos);
+	const u32 rgammatable_pwd_mask = (1 << rgammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (NULL != pbred)
+		*pbred = (read_value & rgammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbgreen)
+		*pbgreen = (read_value & ggammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbblue)
+		*pbblue = (read_value & bgammatable_pwd_mask) ? 1 : 0;
+}
+
+void nx_mlc_set_rgblayer_gama_table_sleep_mode(u32 module_index, int bred,
+					       int bgreen, int bblue)
+{
+	const u32 bgammatable_sld_bitpos = 10;
+	const u32 ggammatable_sld_bitpos = 8;
+	const u32 rgammatable_sld_bitpos = 2;
+	const u32 bgammatable_sld_mask = (1 << bgammatable_sld_bitpos);
+	const u32 ggammatable_sld_mask = (1 << ggammatable_sld_bitpos);
+	const u32 rgammatable_sld_mask = (1 << rgammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (bred)
+		read_value &= ~rgammatable_sld_mask;
+	else
+		read_value |= rgammatable_sld_mask;
+
+	if (bgreen)
+		read_value &= ~ggammatable_sld_mask;
+	else
+		read_value |= ggammatable_sld_mask;
+
+	if (bblue)
+		read_value &= ~bgammatable_sld_mask;
+	else
+		read_value |= bgammatable_sld_mask;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_rgblayer_gama_table_sleep_mode(u32 module_index, int *pbred,
+					       int *pbgreen, int *pbblue)
+{
+	const u32 bgammatable_sld_bitpos = 10;
+	const u32 ggammatable_sld_bitpos = 8;
+	const u32 rgammatable_sld_bitpos = 2;
+	const u32 bgammatable_sld_mask = (1 << bgammatable_sld_bitpos);
+	const u32 ggammatable_sld_mask = (1 << ggammatable_sld_bitpos);
+	const u32 rgammatable_sld_mask = (1 << rgammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+
+	if (NULL != pbred)
+		*pbred = (read_value & rgammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbgreen)
+		*pbgreen = (read_value & ggammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbblue)
+		*pbblue = (read_value & bgammatable_sld_mask) ? 0 : 1;
+}
+
+void nx_mlc_set_rgblayer_rgamma_table(u32 module_index, u32 dwaddress,
+				      u32 dwdata)
+{
+	register struct nx_mlc_register_set *pregister;
+	const u32 tableaddr_bitpos = 24;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dwaddress << tableaddr_bitpos) | dwdata),
+	       &pregister->mlcrgammatablewrite);
+}
+
+void nx_mlc_set_rgblayer_ggamma_table(u32 module_index, u32 dwaddress,
+				      u32 dwdata)
+{
+	register struct nx_mlc_register_set *pregister;
+	const u32 tableaddr_bitpos = 24;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dwaddress << tableaddr_bitpos) | dwdata),
+	       &pregister->mlcggammatablewrite);
+}
+
+void nx_mlc_set_rgblayer_bgamma_table(u32 module_index, u32 dwaddress,
+				      u32 dwdata)
+{
+	register struct nx_mlc_register_set *pregister;
+	const u32 tableaddr_bitpos = 24;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(((dwaddress << tableaddr_bitpos) | dwdata),
+	       &pregister->mlcbgammatablewrite);
+}
+
+void nx_mlc_set_rgblayer_gamma_enable(u32 module_index, int benable)
+{
+	const u32 rgbgammaemb_bitpos = 1;
+	const u32 rgbgammaemb_mask = 1 << rgbgammaemb_bitpos;
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~rgbgammaemb_mask;
+	read_value |= (u32) benable << rgbgammaemb_bitpos;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_rgblayer_gamma_enable(u32 module_index)
+{
+	const u32 rgbgammaemb_bitpos = 1;
+	const u32 rgbgammaemb_mask = 1 << rgbgammaemb_bitpos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlcgammacont & rgbgammaemb_mask) >> rgbgammaemb_bitpos);
+}
+
+void nx_mlc_set_video_layer_stride(u32 module_index, int32_t lu_stride,
+				   int32_t cb_stride, int32_t cr_stride)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel(lu_stride, &pregister->mlcvideolayer.mlcvstride);
+	writel(cb_stride, &pregister->mlcvideolayer.mlcvstridecb);
+	writel(cr_stride, &pregister->mlcvideolayer.mlcvstridecr);
+}
+
+void nx_mlc_set_video_layer_address(u32 module_index, u32 lu_addr, u32 cb_addr,
+				    u32 cr_addr)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(lu_addr, &pregister->mlcvideolayer.mlcaddress);
+	writel(cb_addr, &pregister->mlcvideolayer.mlcaddresscb);
+	writel(cr_addr, &pregister->mlcvideolayer.mlcaddresscr);
+}
+
+void nx_mlc_set_video_layer_address_yuyv(u32 module_index, u32 addr,
+					 int32_t stride)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel(addr, &pregister->mlcvideolayer.mlcaddress);
+	writel(stride, &pregister->mlcvideolayer.mlcvstride);
+}
+
+void nx_mlc_set_video_layer_scale_factor(u32 module_index, u32 hscale,
+					 u32 vscale, int bhlumaenb,
+					 int bhchromaenb, int bvlumaenb,
+					 int bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 scale_mask = ((1 << 23) - 1);
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel(((bhlumaenb << filter_luma_pos) |
+		(bhchromaenb << filter_choma_pos) | (hscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlchscale);
+
+	writel(((bvlumaenb << filter_luma_pos) |
+		(bvchromaenb << filter_choma_pos) | (vscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_video_layer_scale_filter(u32 module_index, int bhlumaenb,
+					 int bhchromaenb, int bvlumaenb,
+					 int bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 scale_mask = ((1 << 23) - 1);
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcvideolayer.mlchscale;
+	read_value &= scale_mask;
+	read_value |=
+	    (bhlumaenb << filter_luma_pos) | (bhchromaenb << filter_choma_pos);
+
+	writel(read_value, &pregister->mlcvideolayer.mlchscale);
+	read_value = pregister->mlcvideolayer.mlcvscale;
+	read_value &= scale_mask;
+	read_value |=
+	    (bvlumaenb << filter_luma_pos) | (bvchromaenb << filter_choma_pos);
+
+	writel(read_value, &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_get_video_layer_scale_filter(u32 module_index, int *bhlumaenb,
+					 int *bhchromaenb, int *bvlumaenb,
+					 int *bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 filter_mask = 1ul;
+	register struct nx_mlc_register_set *pregister;
+	register u32 read_value;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcvideolayer.mlchscale;
+	*bhlumaenb = (read_value >> filter_luma_pos) & filter_mask;
+	*bhchromaenb = (read_value >> filter_choma_pos) & filter_mask;
+	read_value = pregister->mlcvideolayer.mlcvscale;
+	*bvlumaenb = (read_value >> filter_luma_pos) & filter_mask;
+	*bvchromaenb = (read_value >> filter_choma_pos) & filter_mask;
+}
+
+void nx_mlc_set_video_layer_scale(u32 module_index, u32 sw, u32 sh, u32 dw,
+				  u32 dh, int bhlumaenb, int bhchromaenb,
+				  int bvlumaenb, int bvchromaenb)
+{
+	const u32 filter_luma_pos = 28;
+	const u32 filter_choma_pos = 29;
+	const u32 scale_mask = ((1 << 23) - 1);
+	register u32 hscale, vscale, cal_sh;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	if ((bhlumaenb || bhchromaenb) && (dw > sw)) {
+		sw--;
+		dw--;
+	}
+	hscale = (sw << 11) / dw;
+
+	if ((bvlumaenb || bvchromaenb) && (dh > sh)) {
+		sh--;
+		dh--;
+		vscale = (sh << 11) / dh;
+
+		cal_sh = ((vscale * dh) >> 11);
+		if (sh <= cal_sh)
+			vscale--;
+
+	} else {
+		vscale = (sh << 11) / dh;
+	}
+
+	writel(((bhlumaenb << filter_luma_pos) |
+		(bhchromaenb << filter_choma_pos) | (hscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlchscale);
+
+	writel(((bvlumaenb << filter_luma_pos) |
+		(bvchromaenb << filter_choma_pos) | (vscale & scale_mask)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+int32_t nx_mlc_get_video_layer_brightness(u32 module_index)
+{
+	struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	return (s8)(readl(&pregister->mlcvideolayer.mlcluenh) >> 8 & 0xff);
+}
+
+void nx_mlc_set_video_layer_brightness(u32 module_index, int32_t brightness)
+{
+	struct nx_mlc_register_set *pregister;
+	u32 val;
+
+	pregister = __g_module_variables[module_index].pregister;
+	val = readl(&pregister->mlcvideolayer.mlcluenh);
+	val &= ~0xff00;
+	val |= (brightness & 0xff) << 8;
+	writel(val, &pregister->mlcvideolayer.mlcluenh);
+}
+
+unsigned nx_mlc_get_video_layer_contrast(u32 module_index)
+{
+	struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	return readl(&pregister->mlcvideolayer.mlcluenh) & 0x7;
+}
+
+void nx_mlc_set_video_layer_contrast(u32 module_index, uint32_t contrast)
+{
+	struct nx_mlc_register_set *pregister;
+	u32 val;
+
+	pregister = __g_module_variables[module_index].pregister;
+	val = readl(&pregister->mlcvideolayer.mlcluenh);
+	val &= ~0x7;
+	val |= contrast & 0x7;
+	writel(val, &pregister->mlcvideolayer.mlcluenh);
+}
+
+void nx_mlc_set_video_layer_luma_enhance(u32 module_index, u32 contrast,
+					 int32_t brightness)
+{
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	writel((((u32) brightness & 0xfful) << 8) | contrast,
+	       &pregister->mlcvideolayer.mlcluenh);
+}
+
+void nx_mlc_set_video_layer_chroma_enhance(u32 module_index, u32 quadrant,
+					   int32_t cb_a, int32_t cb_b,
+					   int32_t cr_a, int32_t cr_b)
+{
+	register struct nx_mlc_register_set *pregister;
+	register u32 temp;
+
+	pregister = __g_module_variables[module_index].pregister;
+	temp = (((u32) cr_b & 0xfful) << 24) | (((u32) cr_a & 0xfful) << 16) |
+	    (((u32) cb_b & 0xfful) << 8) | (((u32) cb_a & 0xfful) << 0);
+	if (0 < quadrant) {
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[quadrant - 1]);
+	} else {
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[0]);
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[1]);
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[2]);
+		writel(temp, &pregister->mlcvideolayer.mlcchenh[3]);
+	}
+}
+
+void nx_mlc_set_video_layer_line_buffer_power_mode(u32 module_index,
+						   int benable)
+{
+	const u32 linebuff_pwd_pos = 15;
+	const u32 linebuff_pwd_mask = 1ul << linebuff_pwd_pos;
+	const u32 dirtyflag_mask = 1ul << 4;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlcvideolayer.mlccontrol;
+	regvalue &= ~(linebuff_pwd_mask | dirtyflag_mask);
+	regvalue |= ((u32) benable << linebuff_pwd_pos);
+
+	writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+}
+
+int nx_mlc_get_video_layer_line_buffer_power_mode(u32 module_index)
+{
+	const u32 linebuff_pwd_pos = 15;
+	const u32 linebuff_pwd_mask = 1ul << linebuff_pwd_pos;
+
+	return (int)((__g_module_variables[module_index]
+		      .pregister->mlcvideolayer.mlccontrol &
+		      linebuff_pwd_mask) >> linebuff_pwd_pos);
+}
+
+void nx_mlc_set_video_layer_line_buffer_sleep_mode(u32 module_index,
+						   int benable)
+{
+	const u32 linebuff_slmd_pos = 14;
+	const u32 linebuff_slmd_mask = 1ul << linebuff_slmd_pos;
+	const u32 dirtyflag_mask = 1ul << 4;
+	register u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	benable = (int)((u32) benable ^ 1);
+	pregister = __g_module_variables[module_index].pregister;
+	regvalue = pregister->mlcvideolayer.mlccontrol;
+	regvalue &= ~(linebuff_slmd_mask | dirtyflag_mask);
+	regvalue |= (benable << linebuff_slmd_pos);
+
+	writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+}
+
+int nx_mlc_get_video_layer_line_buffer_sleep_mode(u32 module_index)
+{
+	const u32 linebuff_slmd_pos = 14;
+	const u32 linebuff_slmd_mask = 1ul << linebuff_slmd_pos;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (linebuff_slmd_mask & pregister->mlcvideolayer.mlccontrol)
+		return 0;
+	else
+		return 1;
+}
+
+void nx_mlc_set_video_layer_gama_table_power_mode(u32 module_index, int by,
+						  int bu, int bv)
+{
+	const u32 vgammatable_pwd_bitpos = 17;
+	const u32 ugammatable_pwd_bitpos = 15;
+	const u32 ygammatable_pwd_bitpos = 13;
+	const u32 vgammatable_pwd_mask = (1 << vgammatable_pwd_bitpos);
+	const u32 ugammatable_pwd_mask = (1 << ugammatable_pwd_bitpos);
+	const u32 ygammatable_pwd_mask = (1 << ygammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~(ygammatable_pwd_mask | ugammatable_pwd_mask |
+			vgammatable_pwd_mask);
+	read_value |= (((u32) by << ygammatable_pwd_bitpos) |
+		       ((u32) bu << ugammatable_pwd_bitpos) |
+		       ((u32) bv << vgammatable_pwd_bitpos));
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_video_layer_gama_table_power_mode(u32 module_index, int *pby,
+						  int *pbu, int *pbv)
+{
+	const u32 vgammatable_pwd_bitpos = 17;
+	const u32 ugammatable_pwd_bitpos = 15;
+	const u32 ygammatable_pwd_bitpos = 13;
+	const u32 vgammatable_pwd_mask = (1 << vgammatable_pwd_bitpos);
+	const u32 ugammatable_pwd_mask = (1 << ugammatable_pwd_bitpos);
+	const u32 ygammatable_pwd_mask = (1 << ygammatable_pwd_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (NULL != pby)
+		*pby = (read_value & ygammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbu)
+		*pbu = (read_value & ugammatable_pwd_mask) ? 1 : 0;
+
+	if (NULL != pbv)
+		*pbv = (read_value & vgammatable_pwd_mask) ? 1 : 0;
+}
+
+void nx_mlc_set_video_layer_gama_table_sleep_mode(u32 module_index, int by,
+						  int bu, int bv)
+{
+	const u32 vgammatable_sld_bitpos = 16;
+	const u32 ugammatable_sld_bitpos = 14;
+	const u32 ygammatable_sld_bitpos = 12;
+	const u32 vgammatable_sld_mask = (1 << vgammatable_sld_bitpos);
+	const u32 ugammatable_sld_mask = (1 << ugammatable_sld_bitpos);
+	const u32 ygammatable_sld_mask = (1 << ygammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	if (by)
+		read_value &= ~ygammatable_sld_mask;
+	else
+		read_value |= ygammatable_sld_mask;
+
+	if (bu)
+		read_value &= ~ugammatable_sld_mask;
+	else
+		read_value |= ugammatable_sld_mask;
+
+	if (bv)
+		read_value &= ~vgammatable_sld_mask;
+	else
+		read_value |= vgammatable_sld_mask;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+void nx_mlc_get_video_layer_gama_table_sleep_mode(u32 module_index, int *pby,
+						  int *pbu, int *pbv)
+{
+	const u32 vgammatable_sld_bitpos = 16;
+	const u32 ugammatable_sld_bitpos = 14;
+	const u32 ygammatable_sld_bitpos = 12;
+	const u32 vgammatable_sld_mask = (1 << vgammatable_sld_bitpos);
+	const u32 ugammatable_sld_mask = (1 << ugammatable_sld_bitpos);
+	const u32 ygammatable_sld_mask = (1 << ygammatable_sld_bitpos);
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+
+	if (NULL != pby)
+		*pby = (read_value & vgammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbu)
+		*pbu = (read_value & ugammatable_sld_mask) ? 0 : 1;
+
+	if (NULL != pbv)
+		*pbv = (read_value & ygammatable_sld_mask) ? 0 : 1;
+}
+
+void nx_mlc_set_video_layer_gamma_enable(u32 module_index, int benable)
+{
+	const u32 yuvgammaemb_bitpos = 4;
+	const u32 yuvgammaemb_mask = 1 << yuvgammaemb_bitpos;
+	register u32 read_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	read_value = pregister->mlcgammacont;
+	read_value &= ~yuvgammaemb_mask;
+	read_value |= (u32) benable << yuvgammaemb_bitpos;
+
+	writel(read_value, &pregister->mlcgammacont);
+}
+
+int nx_mlc_get_video_layer_gamma_enable(u32 module_index)
+{
+	const u32 yuvgammaemb_bitpos = 4;
+	const u32 yuvgammaemb_mask = 1 << yuvgammaemb_bitpos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlcgammacont & yuvgammaemb_mask) >> yuvgammaemb_bitpos);
+}
+
+void nx_mlc_set_gamma_table_poweroff(u32 module_index, int enb)
+{
+	register struct nx_mlc_register_set *pregister;
+	u32 regvalue;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (enb == 1) {
+		regvalue = pregister->mlcgammacont;
+		regvalue = regvalue & 0xf3;
+		writel(regvalue, &pregister->mlcgammacont);
+	}
+}
+
+void nx_mlc_set_mlctop_control_parameter(u32 module_index, int field_enable,
+					 int mlcenable, u8 priority,
+					 enum g3daddrchangeallowed
+					 g3daddr_change_allowed)
+{
+	register u32 mlctopcontrolreg;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	mlctopcontrolreg = (readl(&pregister->mlccontrolt)) & 0xfffffcfc;
+	mlctopcontrolreg = (u32) (mlctopcontrolreg |
+				  ((priority << 8) | ((1 == mlcenable) << 1) |
+				   (1 ==
+				    field_enable)) | (g3daddr_change_allowed <<
+						      12));
+	writel(mlctopcontrolreg, &pregister->mlccontrolt);
+}
+
+void nx_mlc_set_rgb0layer_control_parameter(u32 module_index, int layer_enable,
+					    int grp3denable, int tp_enable,
+					    u32 transparency_color,
+					    int inv_enable, u32 inverse_color,
+					    int blend_enable, u8 alpha_value,
+					    enum mlc_rgbfmt rbgformat,
+					    enum locksizesel lock_size_select)
+{
+	u32 layer_format;
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 lock_size = (u32) (lock_size_select & 0x3);
+	u32 rgb0controlreg;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	layer_format = nx_mlc_get_rgbformat(rbgformat);
+	pregister = __g_module_variables[module_index].pregister;
+	control_enb =
+	    (u32) ((grp3denable << 8) | (layer_enable << 5) |
+		   (blend_enable << 2) | (inv_enable << 1) | tp_enable) & 0x127;
+	alpha_argument = (u32) (alpha_value & 0xf);
+
+	rgb0controlreg = readl(&pregister->mlcrgblayer[0].mlccontrol) & 0x10;
+	regvalue =
+	    (u32) (((layer_format << 16) | control_enb | (lock_size << 12)) |
+		   rgb0controlreg);
+	writel(regvalue, &pregister->mlcrgblayer[0].mlccontrol);
+
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcrgblayer[0].mlctpcolor);
+	regvalue = inverse_color;
+	writel(regvalue, &pregister->mlcrgblayer[0].mlcinvcolor);
+}
+
+u32 nx_mlc_get_rgbformat(enum mlc_rgbfmt rbgformat)
+{
+	u32 rgbformatvalue;
+	const u32 format_table[] = {
+		0x4432ul, 0x4342ul, 0x4211ul, 0x4120ul, 0x4003ul, 0x4554ul,
+		0x3342ul, 0x2211ul, 0x1120ul, 0x1003ul, 0x4653ul, 0x4653ul,
+		0x0653ul, 0x4ed3ul, 0x4f84ul, 0xc432ul, 0xc342ul, 0xc211ul,
+		0xc120ul, 0xb342ul, 0xa211ul, 0x9120ul, 0xc653ul, 0xc653ul,
+		0x8653ul, 0xced3ul, 0xcf84ul, 0x443aul
+	};
+
+	return rgbformatvalue = format_table[rbgformat];
+}
+
+void nx_mlc_set_rgb1layer_control_parameter(u32 module_index, int layer_enable,
+					    int grp3denable, int tp_enable,
+					    u32 transparency_color,
+					    int inv_enable, u32 inverse_color,
+					    int blend_enable, u8 alpha_value,
+					    enum mlc_rgbfmt rbgformat,
+					    enum locksizesel lock_size_select)
+{
+	u32 layer_format;
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 lock_size = (u32) (lock_size_select & 0x3);
+	u32 rgb0controlreg;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	layer_format = nx_mlc_get_rgbformat(rbgformat);
+	pregister = __g_module_variables[module_index].pregister;
+
+	rgb0controlreg = readl(&pregister->mlcrgblayer[1].mlccontrol) & 0x10;
+	control_enb =
+	    (u32) ((grp3denable << 8) | (layer_enable << 5) |
+		   (blend_enable << 2) | (inv_enable << 1) | tp_enable) & 0x127;
+	alpha_argument = (u32) (alpha_value & 0xf);
+	regvalue =
+	    (u32) (((layer_format << 16) | control_enb | (lock_size << 12)) |
+		   rgb0controlreg);
+	writel(regvalue, &pregister->mlcrgblayer[1].mlccontrol);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcrgblayer[1].mlctpcolor);
+	regvalue = inverse_color;
+	writel(regvalue, &pregister->mlcrgblayer[1].mlcinvcolor);
+}
+
+void nx_mlc_set_rgb2layer_control_parameter(u32 module_index, int layer_enable,
+					    int grp3denable, int tp_enable,
+					    u32 transparency_color,
+					    int inv_enable, u32 inverse_color,
+					    int blend_enable, u8 alpha_value,
+					    enum mlc_rgbfmt rbgformat,
+					    enum locksizesel lock_size_select)
+{
+	u32 layer_format;
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 lock_size = (u32) (lock_size_select & 0x3);
+	u32 rgb0controlreg;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	layer_format = nx_mlc_get_rgbformat(rbgformat);
+	pregister = __g_module_variables[module_index].pregister;
+
+	rgb0controlreg = readl(&pregister->mlcrgblayer2.mlccontrol) & 0x10;
+	control_enb =
+	    (u32) ((grp3denable << 8) | (layer_enable << 5) |
+		   (blend_enable << 2) | (inv_enable << 1) | tp_enable) & 0x127;
+	alpha_argument = (u32) (alpha_value & 0xf);
+	regvalue =
+	    (u32) (((layer_format << 16) | control_enb | (lock_size << 12)) |
+		   rgb0controlreg);
+	writel(regvalue, &pregister->mlcrgblayer2.mlccontrol);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcrgblayer2.mlctpcolor);
+	regvalue = inverse_color;
+	writel(regvalue, &pregister->mlcrgblayer2.mlcinvcolor);
+}
+
+void nx_mlc_set_video_layer_control_parameter(u32 module_index,
+					      int layer_enable, int tp_enable,
+					      u32 transparency_color,
+					      int inv_enable, u32 inverse_color,
+					      int blend_enable, u8 alpha_value,
+					      enum nx_mlc_yuvfmt yuvformat)
+{
+	u32 control_enb;
+	u32 alpha_argument;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+	u32 video_control_reg;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	video_control_reg = readl(&pregister->mlcvideolayer.mlccontrol);
+	control_enb =
+	    (u32) ((yuvformat) | (layer_enable << 5) | (blend_enable << 2) |
+		   (inv_enable << 1) | tp_enable) & 0x30027;
+	alpha_argument = (u32) (alpha_value & 0xf);
+	regvalue = (u32) (control_enb | video_control_reg);
+	writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcvideolayer.mlctpcolor);
+	regvalue = (u32) ((alpha_argument << 28) | transparency_color);
+	writel(regvalue, &pregister->mlcvideolayer.mlcinvcolor);
+}
+
+void nx_mlc_set_srammode(u32 module_index, enum latyername layer_name,
+			 enum srammode sram_mode)
+{
+	u32 control_reg_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	switch (layer_name) {
+	case topmlc:
+		control_reg_value = readl(&pregister->mlccontrolt);
+		writel((u32) (control_reg_value | (sram_mode << 10)),
+		       &pregister->mlccontrolt);
+		control_reg_value = 0;
+		break;
+	case rgb0:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[0].mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcrgblayer[0].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb1:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[1].mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcrgblayer[1].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb2:
+		control_reg_value = readl(&pregister->mlcrgblayer2.mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcrgblayer2.mlccontrol);
+		control_reg_value = 0;
+		break;
+	case video:
+		control_reg_value = readl(&pregister->mlcvideolayer.mlccontrol);
+		writel((u32) (control_reg_value | (sram_mode << 14)),
+		       &pregister->mlcvideolayer.mlccontrol);
+		control_reg_value = 0;
+		break;
+	default:
+		break;
+	}
+}
+
+void nx_mlc_set_layer_reg_finish(u32 module_index, enum latyername layer_name)
+{
+	u32 control_reg_value;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	switch (layer_name) {
+	case topmlc:
+		control_reg_value = readl(&pregister->mlccontrolt);
+		writel((u32) (control_reg_value | (1ul << 3)),
+		       &pregister->mlccontrolt);
+		control_reg_value = 0;
+		break;
+	case rgb0:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[0].mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcrgblayer[0].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb1:
+		control_reg_value =
+		    readl(&pregister->mlcrgblayer[1].mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcrgblayer[1].mlccontrol);
+		control_reg_value = 0;
+		break;
+	case rgb2:
+		control_reg_value = readl(&pregister->mlcrgblayer2.mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcrgblayer2.mlccontrol);
+		control_reg_value = 0;
+		break;
+	case video:
+		control_reg_value = readl(&pregister->mlcvideolayer.mlccontrol);
+		writel((u32) (control_reg_value | (1ul << 4)),
+		       &pregister->mlcvideolayer.mlccontrol);
+		control_reg_value = 0;
+		break;
+	default:
+		break;
+	}
+}
+
+void nx_mlc_set_video_layer_coordinate(u32 module_index, int vfilterenable,
+				       int hfilterenable, int vfilterenable_c,
+				       int hfilterenable_c,
+				       u16 video_layer_with,
+				       u16 video_layer_height, int16_t left,
+				       int16_t right, int16_t top,
+				       int16_t bottom)
+{
+	int32_t source_width, source_height;
+	int32_t destination_width;
+	int32_t destination_height;
+	int32_t hscale, vscale;
+	int32_t hfilterenb, vfilterenb;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	writel((int32_t) (((left & 0x0fff) << 16) | (right & 0x0fff)),
+	       &pregister->mlcvideolayer.mlcleftright);
+	writel((int32_t) (((top & 0x0fff) << 16) | (bottom & 0x0fff)),
+	       &pregister->mlcvideolayer.mlctopbottom);
+	source_width = (int32_t) (video_layer_with - 1);
+	source_height = (int32_t) (video_layer_height - 1);
+	destination_width = (int32_t) (right - left);
+	destination_height = (int32_t) (bottom - top);
+
+	hscale =
+	    (int32_t) ((source_width * (1ul << 11) + (destination_width / 2)) /
+		       destination_width);
+	vscale =
+	    (int32_t) ((source_height * (1ul << 11) +
+			(destination_height / 2)) / destination_height);
+
+	hfilterenb = (u32) (((hfilterenable_c << 29) | (hfilterenable) << 28)) &
+	    0x30000000;
+	vfilterenb = (u32) (((vfilterenable_c << 29) | (vfilterenable) << 28)) &
+	    0x30000000;
+	writel((u32) (hfilterenb | (hscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlchscale);
+	writel((u32) (vfilterenb | (vscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_video_layer_filter_scale(u32 module_index, u32 hscale,
+					 u32 vscale)
+{
+	register struct nx_mlc_register_set *pregister;
+	u32 mlchscale = 0;
+	u32 mlcvscale = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+	mlchscale = readl(&pregister->mlcvideolayer.mlchscale) & (~0x00ffffff);
+	mlcvscale = readl(&pregister->mlcvideolayer.mlcvscale) & (~0x00ffffff);
+
+	writel((u32) (mlchscale | (hscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlchscale);
+	writel((u32) (mlcvscale | (vscale & 0x00ffffff)),
+	       &pregister->mlcvideolayer.mlcvscale);
+}
+
+void nx_mlc_set_gamma_control_parameter(u32 module_index, int rgbgammaenb,
+					int yuvgammaenb, int yuvalphaarray,
+					int dither_enb)
+{
+	u32 register_data;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	register_data = readl(&pregister->mlcgammacont);
+	register_data = (register_data & 0xf0c) |
+	    ((yuvalphaarray << 5) | (yuvgammaenb << 4) |
+	     (rgbgammaenb << 1) | (dither_enb << 0));
+	writel(register_data, &pregister->mlcgammacont);
+}
+
+unsigned nx_mlc_get_layer_alpha256(u32 module_index, u32 layer)
+{
+	const u32 blendenb_pos = 2;
+	const u32 blendenb_mask = 0x01 << blendenb_pos;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (layer == 0 || layer == 1) {
+		regvalue = readl(&pregister->mlcrgblayer[layer].mlccontrol);
+		if( regvalue & blendenb_mask )
+			regvalue = readl(&pregister->mlcrgblayer[layer].mlctpcolor) >> 24;
+		else
+			regvalue = 255;
+	} else {
+		regvalue = readl(&pregister->mlcvideolayer.mlccontrol);
+		if( regvalue & blendenb_mask )
+			regvalue = readl(&pregister->mlcvideolayer.mlctpcolor) >> 24;
+		else
+			regvalue = 255;
+	}
+	return regvalue;
+}
+
+void nx_mlc_set_layer_alpha256(u32 module_index, u32 layer, u32 alpha)
+{
+	const u32 blendenb_pos = 2;
+	const u32 blendenb_mask = 0x01 << blendenb_pos;
+	u32 regvalue;
+	register struct nx_mlc_register_set *pregister;
+
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (layer == 0 || layer == 1) {
+		if( alpha < 255 ) {
+			regvalue = readl(&pregister->mlcrgblayer[layer].mlccontrol);
+			if( (regvalue & blendenb_mask) == 0 ) {
+				regvalue &= ~blendenb_mask;
+				regvalue |= 1 << blendenb_pos;
+				writel(regvalue, &pregister->mlcrgblayer[layer].mlccontrol);
+			}
+		}
+		regvalue =
+		    readl(&pregister->mlcrgblayer[layer].mlctpcolor) & 0x00ffffff;
+		regvalue |= alpha << 24;
+		writel(regvalue, &pregister->mlcrgblayer[layer].mlctpcolor);
+	} else {
+		if( alpha < 255 ) {
+			regvalue = readl(&pregister->mlcvideolayer.mlccontrol);
+			if( (regvalue & blendenb_mask) == 0 ) {
+				regvalue &= ~blendenb_mask;
+				regvalue |= 1 << blendenb_pos;
+				writel(regvalue, &pregister->mlcvideolayer.mlccontrol);
+			}
+		}
+
+		regvalue =
+		    readl(&pregister->mlcvideolayer.mlctpcolor) & 0x00ffffff;
+		regvalue |= alpha << 24;
+		writel(regvalue, &pregister->mlcvideolayer.mlctpcolor);
+	}
+}
+
+int nx_mlc_is_under_flow(u32 module_index)
+{
+	const u32 underflow_pend_pos = 31;
+	const u32 underflow_pend_mask = 1ul << underflow_pend_pos;
+
+	return (int)((__g_module_variables[module_index].pregister->
+		      mlccontrolt & underflow_pend_mask) >> underflow_pend_pos);
+}
+
+void nx_mlc_set_gamma_table(u32 module_index, int enb,
+		struct nx_mlc_gamma_table_parameter *p_gammatable)
+{
+	register struct nx_mlc_register_set *pregister;
+	u32 i, regval = 0;
+
+	pregister = __g_module_variables[module_index].pregister;
+	if (enb == 1) {
+		regval = readl(&pregister->mlcgammacont);
+
+		regval = (1 << 11) | (1 << 9) | (1 << 3);
+		writel(regval, &pregister->mlcgammacont);
+
+		regval = regval | (1 << 10) | (1 << 8) | (1 << 2);
+		writel(regval, &pregister->mlcgammacont);
+
+		for (i = 0; i < 256; i++) {
+			nx_mlc_set_rgblayer_rgamma_table(
+				module_index, i, p_gammatable->r_table[i]);
+			nx_mlc_set_rgblayer_ggamma_table(
+				module_index, i, p_gammatable->g_table[i]);
+			nx_mlc_set_rgblayer_bgamma_table(
+				module_index, i, p_gammatable->b_table[i]);
+		}
+
+		regval = regval | (p_gammatable->alphaselect << 5) |
+		    (p_gammatable->yuvgammaenb << 4 |
+		     p_gammatable->allgammaenb << 4) |
+		    (p_gammatable->rgbgammaenb << 1 |
+		     p_gammatable->allgammaenb << 1) |
+		    (p_gammatable->ditherenb << 1);
+		writel(regval, &pregister->mlcgammacont);
+	} else {
+		regval = regval & ~(1 << 10) & ~(1 << 8) & ~(1 << 2);
+		writel(regval, &pregister->mlcgammacont);
+
+		regval = regval & ~(1 << 11) & ~(1 << 9) & ~(1 << 3);
+		writel(regval, &pregister->mlcgammacont);
+	}
+}
+
+void nx_mlc_get_rgblayer_stride(u32 module_index, u32 layer, int32_t *hstride,
+				int32_t *vstride)
+{
+	unsigned int hs, vs;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	hs = readl(&pregister->mlcrgblayer[layer].mlchstride);
+	vs = readl(&pregister->mlcrgblayer[layer].mlcvstride);
+
+	if (hstride)
+		*(int32_t *)hstride = hs;
+
+	if (vstride)
+		*(int32_t *)vstride = vs;
+}
+
+void nx_mlc_get_rgblayer_address(u32 module_index, u32 layer,
+				 u32 *phys_address)
+{
+	u32 pa;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	pa = readl(&pregister->mlcrgblayer[layer].mlcaddress);
+
+	if (phys_address)
+		*(u32 *)phys_address = pa;
+}
+
+void nx_mlc_get_position(u32 module_index, u32 layer, int *left, int *top,
+			 int *right, int *bottom)
+{
+	int lr, tb;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lr = readl(&pregister->mlcrgblayer[layer].mlcleftright);
+	tb = readl(&pregister->mlcrgblayer[layer].mlctopbottom);
+
+	if (left)
+		*(int *)left = ((lr >> 16) & 0xFFUL);
+
+	if (top)
+		*(int *)top = ((tb >> 16) & 0xFFUL);
+
+	if (right)
+		*(int *)right = ((lr >> 0) & 0xFFUL);
+
+	if (bottom)
+		*(int *)bottom = ((tb >> 0) & 0xFFUL);
+}
+
+void nx_mlc_get_video_layer_address_yuyv(u32 module_index, u32 *address,
+					 u32 *stride)
+{
+	u32 a, s;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+	a = readl(&pregister->mlcvideolayer.mlcaddress);
+	s = readl(&pregister->mlcvideolayer.mlcvstride);
+
+	if (address)
+		*(u32 *)address = a;
+
+	if (stride)
+		*(u32 *)stride = s;
+}
+
+void nx_mlc_get_video_layer_address(u32 module_index, u32 *lu_address,
+				    u32 *cb_address, u32 *cr_address)
+{
+	u32 lua, cba, cra;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lua = readl(&pregister->mlcvideolayer.mlcaddress);
+	cba = readl(&pregister->mlcvideolayer.mlcaddresscb);
+	cra = readl(&pregister->mlcvideolayer.mlcaddresscr);
+
+	if (lu_address)
+		*(u32 *)lu_address = lua;
+
+	if (cb_address)
+		*(u32 *)cb_address = cba;
+
+	if (cr_address)
+		*(u32 *)cr_address = cra;
+}
+
+void nx_mlc_get_video_layer_stride(u32 module_index, u32 *lu_stride,
+				   u32 *cb_stride, u32 *cr_stride)
+{
+	u32 lus, cbs, crs;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lus = readl(&pregister->mlcvideolayer.mlcvstride);
+	cbs = readl(&pregister->mlcvideolayer.mlcvstridecb);
+	crs = readl(&pregister->mlcvideolayer.mlcvstridecr);
+
+	if (lu_stride)
+		*(u32 *)lu_stride = lus;
+
+	if (cb_stride)
+		*(u32 *)cb_stride = cbs;
+
+	if (cr_stride)
+		*(u32 *)cr_stride = crs;
+}
+
+void nx_mlc_get_video_position(u32 module_index, int *left, int *top,
+			       int *right, int *bottom)
+{
+	int lr, tb;
+	register struct nx_mlc_register_set *pregister;
+
+	pregister = __g_module_variables[module_index].pregister;
+
+	lr = readl(&pregister->mlcvideolayer.mlcleftright);
+	tb = readl(&pregister->mlcvideolayer.mlctopbottom);
+
+	if (left)
+		*(int *)left = ((lr >> 16) & 0xFFUL);
+
+	if (top)
+		*(int *)top = ((tb >> 16) & 0xFFUL);
+
+	if (right)
+		*(int *)right = ((lr >> 0) & 0xFFUL);
+
+	if (bottom)
+		*(int *)bottom = ((tb >> 0) & 0xFFUL);
+}
diff -ENwbur a/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.h b/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.h
--- a/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nano-videodev/s5pxx18_soc_mlc.h	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,431 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _S5PXX18_SOC_MLC_H_
+#define _S5PXX18_SOC_MLC_H_
+
+#define NUMBER_OF_MLC_MODULE 2
+#define PHY_BASEADDR_MLC0	0xC0102000
+#define PHY_BASEADDR_MLC1	0xC0102400
+
+#define	PHY_BASEADDR_MLC_LIST	\
+		{ PHY_BASEADDR_MLC0, PHY_BASEADDR_MLC1 }
+
+struct nx_mlc_register_set {
+	u32 mlccontrolt;
+	u32 mlcscreensize;
+	u32 mlcbgcolor;
+	struct {
+		u32 mlcleftright;
+		u32 mlctopbottom;
+		u32 mlcinvalidleftright0;
+		u32 mlcinvalidtopbottom0;
+		u32 mlcinvalidleftright1;
+		u32 mlcinvalidtopbottom1;
+		u32 mlccontrol;
+		int32_t mlchstride;
+		int32_t mlcvstride;
+		u32 mlctpcolor;
+		u32 mlcinvcolor;
+		u32 mlcaddress;
+		u32 __reserved0;
+	} mlcrgblayer[2];
+	struct {
+		u32 mlcleftright;
+		u32 mlctopbottom;
+		u32 mlccontrol;
+		u32 mlcvstride;
+		u32 mlctpcolor;
+
+		u32 mlcinvcolor;
+		u32 mlcaddress;
+		u32 mlcaddresscb;
+		u32 mlcaddresscr;
+		int32_t mlcvstridecb;
+		int32_t mlcvstridecr;
+		u32 mlchscale;
+		u32 mlcvscale;
+		u32 mlcluenh;
+		u32 mlcchenh[4];
+	} mlcvideolayer;
+	struct {
+		u32 mlcleftright;
+		u32 mlctopbottom;
+		u32 mlcinvalidleftright0;
+		u32 mlcinvalidtopbottom0;
+		u32 mlcinvalidleftright1;
+		u32 mlcinvalidtopbottom1;
+		u32 mlccontrol;
+		int32_t mlchstride;
+		int32_t mlcvstride;
+		u32 mlctpcolor;
+		u32 mlcinvcolor;
+		u32 mlcaddress;
+	} mlcrgblayer2;
+	u32 mlcpaletetable2;
+	u32 mlcgammacont;
+	u32 mlcrgammatablewrite;
+	u32 mlcggammatablewrite;
+	u32 mlcbgammatablewrite;
+	u32 yuvlayergammatable_red;
+	u32 yuvlayergammatable_green;
+	u32 yuvlayergammatable_blue;
+
+	u32 dimctrl;
+	u32 dimlut0;
+	u32 dimlut1;
+	u32 dimbusyflag;
+	u32 dimprdarrr0;
+	u32 dimprdarrr1;
+	u32 dimram0rddata;
+	u32 dimram1rddata;
+	u32 __reserved2[(0x3c0 - 0x12c) / 4];
+	u32 mlcclkenb;
+};
+
+enum nx_mlc_priority {
+	nx_mlc_priority_videofirst = 0ul,
+	nx_mlc_priority_videosecond = 1ul,
+	nx_mlc_priority_videothird = 2ul,
+	nx_mlc_priority_videofourth = 3ul
+};
+
+enum nx_mlc_rgbfmt {
+	nx_mlc_rgbfmt_r5g6b5 = 0x44320000ul,
+	nx_mlc_rgbfmt_b5g6r5 = 0xc4320000ul,
+	nx_mlc_rgbfmt_x1r5g5b5 = 0x43420000ul,
+	nx_mlc_rgbfmt_x1b5g5r5 = 0xc3420000ul,
+	nx_mlc_rgbfmt_x4r4g4b4 = 0x42110000ul,
+	nx_mlc_rgbfmt_x4b4g4r4 = 0xc2110000ul,
+	nx_mlc_rgbfmt_x8r3g3b2 = 0x41200000ul,
+	nx_mlc_rgbfmt_x8b3g3r2 = 0xc1200000ul,
+	nx_mlc_rgbfmt_a1r5g5b5 = 0x33420000ul,
+	nx_mlc_rgbfmt_a1b5g5r5 = 0xb3420000ul,
+	nx_mlc_rgbfmt_a4r4g4b4 = 0x22110000ul,
+	nx_mlc_rgbfmt_a4b4g4r4 = 0xa2110000ul,
+	nx_mlc_rgbfmt_a8r3g3b2 = 0x11200000ul,
+	nx_mlc_rgbfmt_a8b3g3r2 = 0x91200000ul,
+	nx_mlc_rgbfmt_r8g8b8 = 0x46530000ul,
+	nx_mlc_rgbfmt_b8g8r8 = 0xc6530000ul,
+	nx_mlc_rgbfmt_x8r8g8b8 = 0x46530000ul,
+	nx_mlc_rgbfmt_x8b8g8r8 = 0xc6530000ul,
+	nx_mlc_rgbfmt_a8r8g8b8 = 0x06530000ul,
+	nx_mlc_rgbfmt_a8b8g8r8 = 0x86530000ul
+};
+
+enum nx_mlc_yuvfmt {
+	nx_mlc_yuvfmt_420 = 0ul << 16,
+	nx_mlc_yuvfmt_422 = 1ul << 16,
+	nx_mlc_yuvfmt_444 = 3ul << 16,
+	nx_mlc_yuvfmt_yuyv = 2ul << 16,
+	//nx_mlc_yuvfmt_422_cbcr = 4ul << 16,
+	//nx_mlc_yuvfmt_420_cbcr = 5ul << 16,
+};
+
+int nx_mlc_initialize(void);
+u32 nx_mlc_get_number_of_module(void);
+u32 nx_mlc_get_physical_address(u32 module_index);
+u32 nx_mlc_get_size_of_register_set(void);
+void nx_mlc_set_base_address(u32 module_index, void *base_address);
+void *nx_mlc_get_base_address(u32 module_index);
+int nx_mlc_open_module(u32 module_index);
+int nx_mlc_close_module(u32 module_index);
+int nx_mlc_check_busy(u32 module_index);
+int nx_mlc_can_power_down(u32 module_index);
+
+void nx_mlc_set_top_dirty_flag(u32 module_index);
+int nx_mlc_get_top_dirty_flag(u32 module_index);
+void nx_mlc_set_mlc_enable(u32 module_index, int benb);
+int nx_mlc_get_mlc_enable(u32 module_index);
+void nx_mlc_set_field_enable(u32 module_index, int benb);
+int nx_mlc_get_field_enable(u32 module_index);
+enum nx_mlc_priority nx_mlc_get_layer_priority(u32 module_index);
+void nx_mlc_set_layer_priority(u32 module_index,
+				      enum nx_mlc_priority priority);
+void nx_mlc_set_screen_size(u32 module_index, u32 width, u32 height);
+void nx_mlc_get_screen_size(u32 module_index, u32 *pwidth,
+				   u32 *pheight);
+void nx_mlc_set_background(u32 module_index, u32 color);
+
+void nx_mlc_set_dirty_flag(u32 module_index, u32 layer);
+int nx_mlc_get_dirty_flag(u32 module_index, u32 layer);
+void nx_mlc_set_layer_enable(u32 module_index, u32 layer, int benb);
+int nx_mlc_get_layer_enable(u32 module_index, u32 layer);
+void nx_mlc_set_lock_size(u32 module_index, u32 layer, u32 locksize);
+void nx_mlc_set_alpha_blending(u32 module_index, u32 layer, int benb,
+				      u32 alpha);
+void nx_mlc_set_transparency(u32 module_index, u32 layer, int benb,
+				    u32 color);
+void nx_mlc_set_color_inversion(u32 module_index, u32 layer, int benb,
+				       u32 color);
+u32 nx_mlc_get_extended_color(u32 module_index, u32 color,
+				     enum nx_mlc_rgbfmt format);
+void nx_mlc_set_format_rgb(u32 module_index, u32 layer,
+				  enum nx_mlc_rgbfmt format);
+void nx_mlc_set_format_yuv(u32 module_index, enum nx_mlc_yuvfmt format);
+void nx_mlc_set_position(u32 module_index, u32 layer, int32_t sx,
+				int32_t sy, int32_t ex, int32_t ey);
+void nx_mlc_set_dither_enable_when_using_gamma(u32 module_index,
+						      int benable);
+int nx_mlc_get_dither_enable_when_using_gamma(u32 module_index);
+void nx_mlc_set_gamma_priority(u32 module_index, int bvideolayer);
+int nx_mlc_get_gamma_priority(u32 module_index);
+
+void nx_mlc_set_rgblayer_invalid_position(u32 module_index, u32 layer,
+						 u32 region, int32_t sx,
+						 int32_t sy, int32_t ex,
+						 int32_t ey, int benb);
+void nx_mlc_set_rgblayer_stride(u32 module_index, u32 layer,
+				       int32_t hstride, int32_t vstride);
+void nx_mlc_set_rgblayer_address(u32 module_index, u32 layer, u32 addr);
+void nx_mlc_set_rgblayer_gama_table_power_mode(u32 module_index,
+						      int bred, int bgreen,
+						      int bblue);
+void nx_mlc_get_rgblayer_gama_table_power_mode(u32 module_index,
+						      int *pbred, int *pbgreen,
+						      int *pbblue);
+void nx_mlc_set_rgblayer_gama_table_sleep_mode(u32 module_index,
+						      int bred, int bgreen,
+						      int bblue);
+void nx_mlc_get_rgblayer_gama_table_sleep_mode(u32 module_index,
+						      int *pbred, int *pbgreen,
+						      int *pbblue);
+void nx_mlc_set_rgblayer_rgamma_table(u32 module_index, u32 dwaddress,
+					     u32 dwdata);
+void nx_mlc_set_rgblayer_ggamma_table(u32 module_index, u32 dwaddress,
+					     u32 dwdata);
+void nx_mlc_set_rgblayer_bgamma_table(u32 module_index, u32 dwaddress,
+					     u32 dwdata);
+void nx_mlc_set_rgblayer_gamma_enable(u32 module_index, int benable);
+int nx_mlc_get_rgblayer_gamma_enable(u32 module_index);
+
+void nx_mlc_set_video_layer_stride(u32 module_index, int32_t lu_stride,
+					  int32_t cb_stride, int32_t cr_stride);
+void nx_mlc_set_video_layer_address(u32 module_index, u32 lu_addr,
+					   u32 cb_addr, u32 cr_addr);
+void nx_mlc_set_video_layer_address_yuyv(u32 module_index, u32 addr,
+						int32_t stride);
+void nx_mlc_set_video_layer_scale_factor(u32 module_index, u32 hscale,
+						u32 vscale, int bhlumaenb,
+						int bhchromaenb, int bvlumaenb,
+						int bvchromaenb);
+void nx_mlc_set_video_layer_scale_filter(u32 module_index, int bhlumaenb,
+						int bhchromaenb, int bvlumaenb,
+						int bvchromaenb);
+void nx_mlc_get_video_layer_scale_filter(u32 module_index,
+						int *bhlumaenb,
+						int *bhchromaenb,
+						int *bvlumaenb,
+						int *bvchromaenb);
+void nx_mlc_set_video_layer_scale(u32 module_index, u32 sw, u32 sh,
+					 u32 dw, u32 dh, int bhlumaenb,
+					 int bhchromaenb, int bvlumaenb,
+					 int bvchromaenb);
+int32_t nx_mlc_get_video_layer_brightness(u32 module_index);
+void nx_mlc_set_video_layer_brightness(u32 module_index, int32_t brightness);
+uint32_t nx_mlc_get_video_layer_contrast(u32 module_index);
+void nx_mlc_set_video_layer_contrast(u32 module_index, uint32_t contrast);
+void nx_mlc_set_video_layer_luma_enhance(u32 module_index, u32 contrast,
+						int32_t brightness);
+void nx_mlc_set_video_layer_chroma_enhance(u32 module_index,
+						  u32 quadrant, int32_t cb_a,
+						  int32_t cb_b, int32_t cr_a,
+						  int32_t cr_b);
+void nx_mlc_set_video_layer_line_buffer_power_mode(u32 module_index,
+							  int benable);
+int nx_mlc_get_video_layer_line_buffer_power_mode(u32 module_index);
+void nx_mlc_set_video_layer_line_buffer_sleep_mode(u32 module_index,
+							  int benable);
+int nx_mlc_get_video_layer_line_buffer_sleep_mode(u32 module_index);
+void nx_mlc_set_video_layer_gamma_enable(u32 module_index, int benable);
+int nx_mlc_get_video_layer_gamma_enable(u32 module_index);
+
+void nx_mlc_set_gamma_table_poweroff(u32 module_index, int enb);
+
+enum mlc_rgbfmt {
+	rgbfmt_r5g6b5 = 0,
+	rgbfmt_x1r5g5b5 = 1,
+	rgbfmt_x4r4g4b4 = 2,
+	rgbfmt_x8r3g3b2 = 3,
+	rgbfmt_x8l8 = 4,
+	rgbfmt_l16 = 5,
+	rgbfmt_a1r5g5b5 = 6,
+	rgbfmt_a4r4g4b4 = 7,
+	rgbfmt_a8r3g3b2 = 8,
+	rgbfmt_a8l8 = 9,
+	rgbfmt_r8g8b8 = 10,
+	rgbfmt_x8r8g8b8 = 11,
+	rgbfmt_a8r8g8b8 = 12,
+	rgbfmt_g8r8_g8b8 = 13,
+	rgbfmt_r8g8_b8g8 = 14,
+	rgbfmt_b5g6r5 = 15,
+	rgbfmt_x1b5g5r5 = 16,
+	rgbfmt_x4b4g4r4 = 17,
+	rgbfmt_x8b3g3r2 = 18,
+	rgbfmt_a1b5g5r5 = 19,
+	rgbfmt_a4b4g4r4 = 20,
+	rgbfmt_a8b3g3r2 = 21,
+	rgbfmt_b8g8r8 = 22,
+	rgbfmt_x8b8g8r8 = 23,
+	rgbfmt_a8b8g8r8 = 24,
+	rgbfmt_g8b8_g8r8 = 25,
+	rgbfmt_b8g8_r8g8 = 26,
+	rgbfmt_pataletb = 27
+};
+
+enum latyername {
+	topmlc = 0,
+	rgb0 = 1,
+	rgb1 = 2,
+	rgb2 = 3,
+	video = 4
+};
+
+enum srammode {
+	poweroff = 0,
+	sleepmode = 2,
+	run = 3
+};
+
+enum locksizesel {
+	locksize_4 = 0,
+	locksize_8 = 1,
+	locksize_16 = 2
+};
+
+enum g3daddrchangeallowed {
+	prim = 0,
+	secon = 1,
+	primorsecon = 2,
+	primandsecon = 3
+};
+
+void nx_mlc_set_mlctop_control_parameter(u32 module_index,
+						int field_enable, int mlcenable,
+						u8 priority,
+						enum g3daddrchangeallowed
+						g3daddr_change_allowed);
+void nx_mlc_set_rgb0layer_control_parameter(u32 module_index,
+						   int layer_enable,
+						   int grp3denable,
+						   int tp_enable,
+						   u32 transparency_color,
+						   int inv_enable,
+						   u32 inverse_color,
+						   int blend_enable,
+						   u8 alpha_value,
+						   enum mlc_rgbfmt rbgformat,
+						   enum locksizesel
+						   lock_size_select);
+
+u32 nx_mlc_get_rgbformat(enum mlc_rgbfmt rbgformat);
+void nx_mlc_set_rgb1layer_control_parameter(u32 module_index,
+						   int layer_enable,
+						   int grp3denable,
+						   int tp_enable,
+						   u32 transparency_color,
+						   int inv_enable,
+						   u32 inverse_color,
+						   int blend_enable,
+						   u8 alpha_value,
+						   enum mlc_rgbfmt rbgformat,
+						   enum locksizesel
+						   lock_size_select);
+
+void nx_mlc_set_rgb2layer_control_parameter(u32 module_index,
+						   int layer_enable,
+						   int grp3denable,
+						   int tp_enable,
+						   u32 transparency_color,
+						   int inv_enable,
+						   u32 inverse_color,
+						   int blend_enable,
+						   u8 alpha_value,
+						   enum mlc_rgbfmt rbgformat,
+						   enum locksizesel
+						   lock_size_select);
+
+void nx_mlc_set_video_layer_control_parameter(u32 module_index,
+						     int layer_enable,
+						     int tp_enable,
+						     u32 transparency_color,
+						     int inv_enable,
+						     u32 inverse_color,
+						     int blend_enable,
+						     u8 alpha_value,
+						     enum nx_mlc_yuvfmt
+						     yuvformat);
+
+void nx_mlc_set_srammode(u32 module_index, enum latyername layer_name,
+				enum srammode sram_mode);
+
+void nx_mlc_set_layer_reg_finish(u32 module_index,
+					enum latyername layer_name);
+
+void nx_mlc_set_video_layer_coordinate(u32 module_index,
+					      int vfilterenable,
+					      int hfilterenable,
+					      int vfilterenable_c,
+					      int hfilterenable_c,
+					      u16 video_layer_with,
+					      u16 video_layer_height,
+					      int16_t left, int16_t right,
+					      int16_t top, int16_t bottom);
+
+void nx_mlc_set_video_layer_filter_scale(u32 module_index, u32 hscale,
+						u32 vscale);
+void nx_mlcsetgammasrammode(u32 module_index, enum srammode sram_mode);
+void nx_mlc_set_gamma_control_parameter(u32 module_index,
+					       int rgbgammaenb, int yuvgammaenb,
+					       int yuvalphaarray,
+					       int dither_enb);
+
+unsigned nx_mlc_get_layer_alpha256(u32 module_index, u32 layer);
+void nx_mlc_set_layer_alpha256(u32 module_index, u32 layer, u32 alpha);
+int nx_mlc_is_under_flow(u32 module_index);
+
+struct nx_mlc_gamma_table_parameter {
+	u32 r_table[256];
+	u32 g_table[256];
+	u32 b_table[256];
+	u32 ditherenb;
+	u32 alphaselect;
+	u32 yuvgammaenb;
+	u32 rgbgammaenb;
+	u32 allgammaenb;
+};
+
+void nx_mlc_set_gamma_table(u32 module_index, int enb,
+		struct nx_mlc_gamma_table_parameter *p_gammatable);
+void nx_mlc_get_rgblayer_stride(u32 module_index, u32 layer,
+				       int32_t *hstride, int32_t *vstride);
+void nx_mlc_get_rgblayer_address(u32 module_index, u32 layer,
+					u32 *phys_address);
+void nx_mlc_get_position(u32 module_index, u32 layer, int *left,
+				int *top, int *right, int *bottom);
+void nx_mlc_get_video_layer_address_yuyv(u32 module_index, u32 *address,
+						u32 *stride);
+void nx_mlc_get_video_layer_address(u32 module_index, u32 *lu_address,
+					   u32 *cb_address, u32 *cr_address);
+void nx_mlc_get_video_layer_stride(u32 module_index, u32 *lu_stride,
+					  u32 *cb_stride, u32 *cr_stride);
+void nx_mlc_get_video_layer_stride(u32 module_index, u32 *lu_stride,
+					  u32 *cb_stride, u32 *cr_stride);
+void nx_mlc_get_video_position(u32 module_index, int *left, int *top,
+				      int *right, int *bottom);
+
+#endif
diff -ENwbur a/drivers/media/platform/nxp-vpu/blackbird_v2.3.10.h b/drivers/media/platform/nxp-vpu/blackbird_v2.3.10.h
--- a/drivers/media/platform/nxp-vpu/blackbird_v2.3.10.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/blackbird_v2.3.10.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,15880 @@
+/*==============================================================================
+ *    BIT ASSEMBLY CODE TABLE
+ *      generated with <blackbird.out>
+ *      generated at Mon May 13 19:25:54 2013
+ *==============================================================================
+ */
+const unsigned short bit_code[126976] = {
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c1e, 0xf0b4, 0xe04a, 0xaf10,
+	0x1857, 0xf074, 0xe009, 0x00ff, 0x1a58, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0c5c, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x036a, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0370,
+	0xe40e, 0x0374, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0398, 0xe40e, 0x00a4,
+	0xe41e, 0x03b9, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x0378,
+	0xe41e, 0x0fee, 0xe41e, 0x0458, 0xe41e, 0x0feb, 0xe41e, 0x02ad,
+	0xe40e, 0x00a4, 0xe41e, 0x0378, 0xe41e, 0x0543, 0xe40e, 0x00a4,
+	0xe41e, 0x0548, 0xe40e, 0x00a4, 0xe41e, 0x0579, 0xe40e, 0x00a4,
+	0x2811, 0xa184, 0x2a24, 0xa805, 0xe056, 0xe428, 0xe0c0, 0x0040,
+	0xa215, 0xae17, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe167, 0x05cb, 0xe166, 0x0064,
+	0xd022, 0x0003, 0xe184, 0x0396, 0x9e16, 0x3517, 0x3d17, 0xe42e,
+	0xa200, 0x3c86, 0x3cad, 0x3cbe, 0xe41e, 0x0429, 0xe41e, 0x0566,
+	0xe41e, 0x0686, 0xe41e, 0x0904, 0xe41e, 0x03ba, 0xf0dd, 0xe41e,
+	0x08bd, 0xe41a, 0x03f9, 0xa2fe, 0x3c10, 0x3c83, 0xe41e, 0x052f,
+	0xf03a, 0xa202, 0x3c86, 0xe41e, 0x0b38, 0xe41e, 0x06f6, 0xe16a,
+	0xe42e, 0xe42e, 0xa23e, 0x3cf0, 0xe41e, 0x08bd, 0xe408, 0x03d3,
+	0xe41e, 0x0b72, 0xa10e, 0xf13a, 0xa104, 0xf2ba, 0xa102, 0xf05a,
+	0xf04a, 0xe41e, 0x0951, 0xf6fe, 0xe41e, 0x08bd, 0xe408, 0x03d3,
+	0xe41e, 0x098a, 0xf68e, 0xe41e, 0x01db, 0xf22e, 0xe41e, 0x1459,
+	0xe41e, 0x098a, 0xa2fe, 0x3c10, 0xe41e, 0x1a99, 0xf5ca, 0x2800,
+	0x3c10, 0xe41e, 0x1ab1, 0xe092, 0xa200, 0xe41e, 0x0c40, 0xa200,
+	0x3c9b, 0xe41e, 0x141e, 0xa2fe, 0x3c10, 0xe082, 0xf096, 0xe42e,
+	0xe41e, 0x1460, 0xe41e, 0x1459, 0xe41e, 0x0951, 0xf44e, 0xe16b,
+	0xe42e, 0xe41e, 0x0b72, 0xf0da, 0xa102, 0xe40a, 0x0412, 0xa108,
+	0xf084, 0xf11a, 0xa108, 0xf0f6, 0xa102, 0xf06a, 0xa102, 0xf04a,
+	0xe41e, 0x0951, 0xf6fe, 0xe41e, 0x08bd, 0xe408, 0x0412, 0xe41e,
+	0x098a, 0xf68e, 0xe42e, 0xa200, 0xe161, 0x0100, 0xe188, 0x0aff,
+	0x3d11, 0xe0c0, 0x0041, 0xe005, 0x0034, 0xae11, 0xe042, 0xce20,
+	0xd111, 0x0100, 0xd112, 0x0180, 0xd113, 0x0002, 0xca28, 0xf7f8,
+	0xe42e, 0xe41e, 0x0413, 0xe41e, 0x0222, 0xe41e, 0x0148, 0xa204,
+	0x3cae, 0xe16a, 0xd130, 0x0000, 0xd03a, 0x0000, 0xd04c, 0x0000,
+	0xd008, 0x0000, 0xd022, 0x0000, 0xa200, 0xe0c2, 0x0100, 0xe0c2,
+	0x0128, 0xa2fe, 0x3c25, 0x3c26, 0x3c27, 0x3c28, 0x3c10, 0x3c29,
+	0x3c56, 0xe161, 0x05c7, 0x3511, 0x3d11, 0x3511, 0x3d11, 0xe41e,
+	0x0c2b, 0xe41e, 0x1a88, 0xe41e, 0x1f23, 0xe41e, 0x1607, 0xe42e,
+	0xa200, 0x3c86, 0xe41e, 0x0686, 0xe41e, 0x1a4b, 0xe41e, 0x04df,
+	0xe41e, 0x090e, 0xe41e, 0x067b, 0xe41e, 0x052f, 0xe40a, 0x04dc,
+	0xe41e, 0x1382, 0xe408, 0x0472, 0xe41e, 0x08bd, 0xe408, 0x04dc,
+	0xe40e, 0x04c3, 0xe41e, 0x020f, 0xe404, 0x04c3, 0xe41e, 0x067b,
+	0xa202, 0x3c86, 0x28bd, 0xf09a, 0xe41e, 0x0672, 0xa2fe, 0x3c84,
+	0xa202, 0x3cb4, 0xe40e, 0x04c3, 0x28a4, 0xf0b4, 0xa202, 0x3cb4,
+	0xe41e, 0x1460, 0xe41e, 0x0672, 0xa200, 0x3c3a, 0xe40e, 0x04c3,
+	0xe41e, 0x05d4, 0xf05a, 0xe41e, 0x05f3, 0xe40e, 0x04b5, 0xe41e,
+	0x1a7d, 0x2884, 0xe414, 0x0672, 0x2884, 0xe404, 0x04c3, 0x2884,
+	0xe41e, 0x1f8e, 0xe41e, 0x20e9, 0xe41e, 0x05c7, 0x28a5, 0xf0e8,
+	0x2a4e, 0x4e40, 0x2884, 0xe41b, 0x1f29, 0x284e, 0xe418, 0x1bc2,
+	0x2840, 0xe41a, 0x18cf, 0x287e, 0x3c82, 0x2840, 0xf058, 0xe41e,
+	0x0655, 0xe41e, 0x065a, 0xe41e, 0x065f, 0x2840, 0xaa02, 0x443f,
+	0xf03a, 0xe40e, 0x0468, 0xe41e, 0x20d0, 0xe41e, 0x1460, 0xe41e,
+	0x08d7, 0xf04a, 0xe41e, 0x19fe, 0x3ce9, 0xe41e, 0x18f8, 0x3c85,
+	0x2885, 0x3c56, 0x2884, 0xf024, 0x3c83, 0xe41e, 0x06f6, 0xe41e,
+	0x1a66, 0xe41e, 0x0b38, 0xe42e, 0xa202, 0x3c86, 0xf65e, 0xa200,
+	0xcc4a, 0xcc4c, 0x3c53, 0x3c62, 0x3cbd, 0x3cae, 0x3cb4, 0x3ca5,
+	0x3c97, 0x28ad, 0xe41a, 0x064c, 0xe41e, 0x0655, 0xe41e, 0x065a,
+	0xe41e, 0x065f, 0xa2fe, 0x3cba, 0x3cbb, 0x3cb9, 0xa200, 0x3cbc,
+	0xa2fe, 0x3ca4, 0xa204, 0x3cf0, 0xa2fc, 0x3c84, 0xa2fa, 0x3c85,
+	0xa2fe, 0xc009, 0x3c3f, 0x3c40, 0x3c41, 0x3c42, 0xc000, 0xe42e,
+	0x2811, 0xa184, 0xf068, 0x2824, 0xa804, 0xf038, 0xa202, 0xe42e,
+	0xa200, 0xe42e, 0xa200, 0xcc44, 0xd152, 0x0000, 0xd130, 0x0000,
+	0xd1e0, 0x0003, 0xd1ff, 0x03b0, 0xd1fd, 0x03d0, 0xd199, 0x0224,
+	0xd1fc, 0x0720, 0xd03a, 0x0000, 0xd04c, 0x0000, 0xd008, 0x0000,
+	0xd14b, 0x0200, 0x28b1, 0xcfce, 0xe41e, 0x025f, 0xe42e, 0xe0c0,
+	0x0059, 0xa102, 0xf0da, 0xe41e, 0x08bd, 0xf04a, 0xe41e, 0x01db,
+	0xf09e, 0xe41e, 0x1f66, 0x2a84, 0xb7f5, 0x3e84, 0xf03a, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe41e, 0x0686, 0xe41e, 0x207b, 0xe42e,
+	0xe0c0, 0x0042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0080, 0xd113,
+	0x0013, 0xca28, 0xf7f8, 0xe0c0, 0x0061, 0xe41e, 0x0c09, 0xa202,
+	0xe41e, 0x0c13, 0xe41e, 0x0a10, 0xe128, 0xe0c0, 0x0060, 0xf048,
+	0xe41e, 0x1a99, 0xf03e, 0xe41e, 0x1ac4, 0xe42e, 0xe0c0, 0x0040,
+	0xa201, 0xae17, 0xe042, 0xe005, 0x4f00, 0xae03, 0xe042, 0xce20,
+	0xd111, 0x0450, 0xd112, 0x00c8, 0xd113, 0x0003, 0xca28, 0xf7f8,
+	0xe42e, 0xe180, 0xa2fe, 0x3c29, 0x3c10, 0xe41e, 0x1f23, 0xe41e,
+	0x05b7, 0x2821, 0xf05a, 0x2816, 0xa104, 0xf02a, 0x28ea, 0x3ce9,
+	0xa200, 0x3c81, 0x3ce7, 0x3ce6, 0x3ce8, 0x3ce5, 0xe166, 0x05ab,
+	0xc710, 0x3d16, 0xe167, 0x0518, 0xe166, 0x0054, 0xa200, 0x3cb2,
+	0x287f, 0xa102, 0xcc44, 0xe184, 0x05a4, 0x9e06, 0x5cb2, 0xa802,
+	0xb690, 0x3d17, 0x28b2, 0xa002, 0x3cb2, 0xe190, 0xa200, 0x3c60,
+	0xe41e, 0x0c40, 0xe42e, 0x24b5, 0x4cb6, 0xce20, 0xd111, 0x0600,
+	0xd112, 0x0004, 0xd113, 0x0000, 0xca28, 0xf7f8, 0xe42e, 0xe161,
+	0x0200, 0xa200, 0xc73f, 0x3d11, 0x3cb2, 0xd022, 0x001f, 0xe184,
+	0x05c5, 0xe41e, 0x1f29, 0x28b2, 0xa002, 0x3cb2, 0xe42e, 0x2abc,
+	0x4e4f, 0x3ebc, 0x28a1, 0x3cb9, 0x2a3f, 0xf06b, 0x2a42, 0xf039,
+	0x3cba, 0xf02e, 0x3cbb, 0xe42e, 0x28a5, 0xf1c8, 0x28a5, 0xe016,
+	0x4440, 0xf168, 0xe41e, 0x0634, 0xf07a, 0xe41e, 0x0639, 0xf07a,
+	0x284f, 0xf0e8, 0xf0fe, 0xe41e, 0x063e, 0xf04a, 0x2838, 0xf0a8,
+	0xf07e, 0xe41e, 0x0645, 0xf04a, 0x284e, 0xf04a, 0xf01e, 0xa200,
+	0xe42e, 0xa202, 0xe42e, 0xa202, 0x3ca5, 0x2884, 0xe412, 0x1f29,
+	0x2884, 0xe412, 0x1f30, 0x2884, 0xe412, 0x1f37, 0xa2fc, 0x3c84,
+	0x3c3e, 0xe41e, 0x0608, 0xe41e, 0x0b21, 0xe41e, 0x090e, 0xe42e,
+	0xe41e, 0x0b72, 0xf15a, 0xa102, 0xf17a, 0xa108, 0xf114, 0xf14a,
+	0xa102, 0xf0da, 0xa102, 0xf0ba, 0xa102, 0xf09a, 0xa102, 0xf07a,
+	0xa104, 0xf056, 0xa102, 0xf04a, 0xa10e, 0xf022, 0xe42e, 0xe41e,
+	0x0951, 0xe40e, 0x0608, 0xcaa2, 0xaf0a, 0xa806, 0x184e, 0xf0a8,
+	0xe41e, 0x098a, 0xe41e, 0x22e7, 0xf5ca, 0x2894, 0xf5aa, 0xe41e,
+	0x0b69, 0xe41e, 0x0b21, 0xe42e, 0xe0c0, 0x0065, 0xaf04, 0xa802,
+	0xe42e, 0xe0c0, 0x0065, 0xaf16, 0xa802, 0xe42e, 0xe0c0, 0x0065,
+	0xaf06, 0xa806, 0xa102, 0xe016, 0xe42e, 0xe0c0, 0x0065, 0xaf06,
+	0xa806, 0xa104, 0xe016, 0xe42e, 0xe41e, 0x0b21, 0xe0c0, 0x0048,
+	0xc009, 0x3433, 0x3c34, 0xc000, 0xe42e, 0xc009, 0x2433, 0x4c34,
+	0xc000, 0xe42e, 0xc009, 0x3435, 0x3c36, 0xc000, 0xe42e, 0xe41e,
+	0x0b21, 0xe0c0, 0x0048, 0xc009, 0x3437, 0x3c38, 0xc000, 0xe42e,
+	0xc009, 0x2435, 0x4c36, 0xc000, 0xe42e, 0xc009, 0x2437, 0x4c38,
+	0xc000, 0xe42e, 0xe41e, 0x0b69, 0x28ad, 0xe42a, 0xe41e, 0x0655,
+	0xe0c2, 0x0048, 0xe42e, 0xe41e, 0x1fed, 0xe41e, 0x2020, 0xe41e,
+	0x0512, 0xe41e, 0x247d, 0xe41e, 0x2080, 0xe42e, 0xe0c0, 0x0059,
+	0xa102, 0xf2ca, 0xa102, 0xe42a, 0xa102, 0xf05a, 0xa102, 0xe40a,
+	0x06cc, 0xe42e, 0xe0c0, 0x006b, 0x34b5, 0x3cb6, 0xe0c0, 0x006c,
+	0x34b7, 0x3cb8, 0xe0c0, 0x0060, 0xaf08, 0x3088, 0xe0c0, 0x0060,
+	0xa81e, 0x3c87, 0xe0c0, 0x0061, 0xa83e, 0x3c8a, 0xe0c0, 0x0065,
+	0xa840, 0xf0ba, 0xa200, 0xe167, 0x0600, 0xc703, 0x3d17, 0xe41e,
+	0x05ab, 0xe004, 0x0088, 0x3ca7, 0xe42e, 0xc001, 0xe0c0, 0x0060,
+	0x3400, 0x3c01, 0xe0c0, 0x0061, 0xae14, 0x3406, 0x3c07, 0xc000,
+	0xe0c0, 0x0062, 0xaf02, 0x3021, 0xaf02, 0x30aa, 0xa200, 0xe0c0,
+	0x0067, 0xa802, 0x3cb1, 0xe42e, 0xe41e, 0x038c, 0xe41e, 0x0174,
+	0xe0c0, 0x0042, 0xce20, 0xd111, 0x0640, 0xd112, 0x00c0, 0xd113,
+	0x0003, 0xca29, 0xf7f9, 0xa200, 0xe41e, 0x0f91, 0xe004, 0x0040,
+	0xe41e, 0x0f91, 0xe0c0, 0x0060, 0x3c7f, 0xe0c0, 0x0061, 0x3c66,
+	0xe0c0, 0x006e, 0xe41e, 0x020a, 0xe167, 0x05fd, 0xe0c0, 0x0062,
+	0x3517, 0x3d17, 0xe0c0, 0x0063, 0x3d17, 0xe42e, 0xe0c0, 0x0059,
+	0xa102, 0xe40a, 0x0797, 0xa102, 0xe42a, 0xa102, 0xf05a, 0xa102,
+	0xe40a, 0x0804, 0xe42e, 0x2861, 0xae04, 0x4c91, 0xae02, 0x4c90,
+	0xe0c2, 0x0060, 0xc009, 0x203f, 0x4c40, 0xe0c2, 0x0061, 0x2041,
+	0x4c42, 0xc000, 0xe0c2, 0x0062, 0xe41e, 0x1612, 0xe0c2, 0x0067,
+	0xe41e, 0x1617, 0xe0c2, 0x0068, 0xe41e, 0x161c, 0xe0c2, 0x0069,
+	0xe41e, 0x1607, 0x2a23, 0xe41b, 0x0846, 0x2a3f, 0xe419, 0x0846,
+	0xae02, 0x4c23, 0xe0c2, 0x006a, 0x283f, 0xf0ba, 0xc009, 0x203b,
+	0x4c3c, 0xe0c2, 0x006b, 0x203d, 0x4c3e, 0xe0c2, 0x006c, 0xc000,
+	0x2072, 0x4c73, 0xe0c2, 0x006c, 0xe41e, 0x1463, 0xe0c2, 0x007b,
+	0x2057, 0x4c58, 0xae08, 0xe0c2, 0x006f, 0x28b0, 0xe0c2, 0x007a,
+	0x2054, 0x4c55, 0xa002, 0x3454, 0x3c55, 0xe0c2, 0x0070, 0x2885,
+	0xe0c2, 0x0071, 0x2c53, 0xe0c2, 0x0072, 0xe41e, 0x0805, 0xe0c2,
+	0x0073, 0xa200, 0xe0c2, 0x0074, 0x2886, 0x2ab4, 0xae21, 0xe056,
+	0x2aae, 0xae23, 0xe056, 0x2abd, 0xae29, 0xe056, 0xe0c2, 0x0076,
+	0xe41e, 0x0668, 0xe0c2, 0x0051, 0xe41e, 0x066d, 0xe0c2, 0x0052,
+	0x2884, 0xe0c2, 0x0077, 0x2a22, 0xe161, 0x05e4, 0x2111, 0x4d11,
+	0xf02b, 0xae02, 0xe0c2, 0x0078, 0x2111, 0x4d11, 0xf02b, 0xae02,
+	0xe0c2, 0x0079, 0x2025, 0x4c26, 0xe0c2, 0x007c, 0xe167, 0x05c7,
+	0x2117, 0x4d17, 0xe0c2, 0x007e, 0x2117, 0x4d17, 0xe0c2, 0x007d,
+	0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2, 0x0053, 0xe42e, 0xe41e,
+	0x1463, 0xe0c2, 0x0063, 0x2a23, 0xe41b, 0x0846, 0x2a3f, 0xe419,
+	0x0846, 0xae02, 0x4c23, 0xe0c2, 0x0064, 0x2027, 0x4c28, 0xe0c2,
+	0x006d, 0x2886, 0xe0c2, 0x0070, 0x2057, 0x4c58, 0xae08, 0xe0c2,
+	0x0071, 0x2025, 0x4c26, 0xe0c2, 0x0072, 0x2821, 0xf0ca, 0x2816,
+	0xa104, 0xf09a, 0x28eb, 0x3cb3, 0xa004, 0xe0c2, 0x0073, 0x28ea,
+	0x3ce9, 0xf07e, 0x2819, 0xa004, 0xe0c2, 0x0073, 0xa200, 0x3ce9,
+	0x28e9, 0xe0c2, 0x0074, 0xa200, 0xe0c2, 0x0075, 0x2a22, 0xe161,
+	0x05e4, 0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0076, 0x2111,
+	0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0077, 0x2886, 0xe016, 0x58f0,
+	0xe0c2, 0x0078, 0xe161, 0x05c7, 0x2111, 0x4d11, 0xe0c2, 0x007a,
+	0x2111, 0x4d11, 0xe0c2, 0x0079, 0xe41e, 0x1463, 0xaf32, 0xa802,
+	0xae0c, 0x2a24, 0xae05, 0xe056, 0x4c1d, 0xae02, 0x2a1b, 0xe017,
+	0xe056, 0xae10, 0x4c1f, 0xae10, 0x4c11, 0x2a19, 0xe01b, 0xae3f,
+	0xe056, 0xe0c2, 0x007b, 0xe42e, 0xe42e, 0x2885, 0xe41e, 0x25f3,
+	0xe092, 0x2842, 0xe016, 0x5440, 0x443f, 0x3c00, 0xa200, 0x2a40,
+	0xf079, 0x2aa4, 0xf053, 0x2ab9, 0xa80f, 0xe056, 0xf12e, 0x2a00,
+	0xf09b, 0x2aba, 0xa80f, 0xae07, 0xe056, 0x2abb, 0xa80f, 0xe056,
+	0xf08e, 0x2abb, 0xa80f, 0xae07, 0xe056, 0x2aba, 0xa80f, 0xe056,
+	0x3c01, 0x28a3, 0x2a23, 0xe41b, 0x0846, 0x2a3f, 0xe419, 0x0846,
+	0xae02, 0x4c23, 0xae0c, 0x4c00, 0xae04, 0x4c43, 0xae02, 0x4c3f,
+	0xae24, 0x2a3f, 0xe017, 0x4e40, 0xae1f, 0xe056, 0xe083, 0xae21,
+	0xe056, 0x2abc, 0xae0d, 0xe056, 0x4c01, 0xe42e, 0x283f, 0xe42a,
+	0x28a4, 0xf0c2, 0xc009, 0x203b, 0x4c3c, 0x103d, 0x1c3e, 0xc000,
+	0xf030, 0xa206, 0xe42e, 0xa208, 0xe42e, 0x2823, 0xf048, 0xa202,
+	0x0842, 0xe42e, 0x28a3, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005,
+	0x0018, 0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0100,
+	0x88ec, 0x0113, 0xca28, 0xf7f8, 0xe42e, 0x8917, 0x0034, 0x8917,
+	0x0033, 0x8917, 0x0035, 0x8917, 0x0036, 0x8917, 0x0037, 0x8917,
+	0x0038, 0x8117, 0x8117, 0x2117, 0x4d17, 0xcc60, 0x2117, 0x4d17,
+	0xcc62, 0x2117, 0x4d17, 0xcc64, 0x2117, 0x4d17, 0xcc72, 0xe42e,
+	0x8b17, 0x0034, 0x8b17, 0x0033, 0x8b17, 0x0035, 0x8b17, 0x0036,
+	0x8b17, 0x0037, 0x8b17, 0x0038, 0x8117, 0x8117, 0xc860, 0x3517,
+	0x3d17, 0xc862, 0x3517, 0x3d17, 0xc864, 0x3517, 0x3d17, 0xc872,
+	0x3517, 0x3d17, 0xe42e, 0xc001, 0x3c13, 0xc000, 0xe42e, 0xc001,
+	0x2813, 0xc000, 0xe42e, 0xc001, 0x3c14, 0xc000, 0xe42e, 0xc001,
+	0x2814, 0xc000, 0xe42e, 0xc001, 0x2430, 0x4c31, 0xc000, 0xae06,
+	0xc873, 0xe046, 0xe422, 0xe16b, 0xe42e, 0xc001, 0x280c, 0xf16a,
+	0xe41e, 0x0b21, 0xc001, 0xe0c0, 0x0049, 0x340e, 0x3c0f, 0x240e,
+	0x4c0f, 0xe0c1, 0x0048, 0x360e, 0x3e0f, 0x260e, 0x4e0f, 0xe045,
+	0xa200, 0xb626, 0xe003, 0x0200, 0xb606, 0xc000, 0xe42e, 0xe41e,
+	0x08bd, 0xe42a, 0xe0c0, 0x0045, 0xaf04, 0xa802, 0xe42e, 0xc001,
+	0x3c33, 0xc000, 0xe42e, 0xc001, 0x2833, 0xc000, 0xe42e, 0xc001,
+	0x3c11, 0xc000, 0xe42e, 0xc001, 0x2811, 0xc000, 0xe42e, 0xd148,
+	0x0040, 0xd144, 0x0000, 0xd145, 0x0000, 0xd168, 0x0000, 0xd16b,
+	0x0000, 0xd14b, 0x0200, 0xe004, 0x0019, 0xae18, 0xcec0, 0xd14c,
+	0x000c, 0xca9a, 0xf7f8, 0xe42e, 0xc001, 0x2400, 0x4c01, 0x0406,
+	0x0c07, 0x3408, 0x3c09, 0xd071, 0x202a, 0xe181, 0xc001, 0xe0c0,
+	0x0048, 0x3415, 0x3c16, 0x280c, 0xf13a, 0xe0c0, 0x0048, 0x340e,
+	0x3c0f, 0x240e, 0x4c0f, 0xe0c1, 0x0049, 0x3604, 0x3e05, 0x1404,
+	0x1c05, 0xe0c1, 0x0045, 0xaf05, 0xa803, 0xb611, 0x320c, 0xe0c0,
+	0x0048, 0x3402, 0xe008, 0xfe00, 0x3c03, 0xe0c0, 0x0048, 0xe008,
+	0x01ff, 0x3c0b, 0xa200, 0xcc78, 0xd022, 0x00ff, 0xe184, 0x0939,
+	0xcc7a, 0xe190, 0xe41e, 0x0a10, 0xe41e, 0x0a2f, 0xe41e, 0x08ef,
+	0xc001, 0xa200, 0x3c1a, 0x280b, 0xa102, 0xe412, 0x0959, 0xc001,
+	0xa202, 0x3c1a, 0xa200, 0xceaa, 0xc000, 0xa200, 0xe41e, 0x0c40,
+	0xe42e, 0xcaa0, 0xe190, 0xca9a, 0xf7f8, 0xca9c, 0xe418, 0x0a2f,
+	0xe42e, 0xcc44, 0xe184, 0x0962, 0xca9c, 0xe418, 0x0a2f, 0xcaa0,
+	0xca9b, 0xf7f9, 0xe190, 0xe42e, 0xe004, 0x0100, 0xceb0, 0xe004,
+	0x00ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e, 0x0000, 0xd15f,
+	0x0000, 0xe004, 0x0019, 0xae18, 0xe00a, 0x0620, 0xcec0, 0xd157,
+	0x0000, 0xd14a, 0x0000, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x0a2f,
+	0xca9a, 0xf7c8, 0xcaae, 0xa802, 0xf73a, 0xca9c, 0xe418, 0x0a2f,
+	0xa200, 0xe42e, 0xe41e, 0x0964, 0xe41e, 0x08bd, 0xf128, 0xe41e,
+	0x0b60, 0xcaa2, 0xe008, 0x00ff, 0xe41e, 0x08a3, 0xaf0e, 0xe418,
+	0x0951, 0xe41e, 0x08a7, 0xaf0e, 0xf6e8, 0xe41e, 0x08bd, 0xf0ea,
+	0xe004, 0x010b, 0xe008, 0x00ff, 0xe41e, 0x08a3, 0xe004, 0x010b,
+	0xa83e, 0xe41e, 0x08ab, 0xa200, 0xe42e, 0xe41e, 0x08a7, 0xf058,
+	0xa204, 0xe41e, 0x0959, 0xf57e, 0xa206, 0xe41e, 0x0959, 0xe41e,
+	0x08a7, 0xaf0a, 0x3c4e, 0xe41e, 0x08a7, 0xa83e, 0xe41e, 0x08ab,
+	0xe41e, 0x08a7, 0xa116, 0xe42a, 0xca9c, 0xe418, 0x0a2f, 0x2a51,
+	0xf06b, 0xe41e, 0x08af, 0xa10a, 0xe016, 0x3c4f, 0xe41e, 0x09d1,
+	0xe42e, 0xc001, 0xa200, 0x3c30, 0x3c31, 0x3c33, 0xe41e, 0x09df,
+	0xc001, 0xe41e, 0x0a10, 0xc001, 0xe128, 0xc000, 0xe42e, 0xc001,
+	0x2833, 0x4411, 0xc000, 0xae0e, 0xce92, 0xd14a, 0x0000, 0xd158,
+	0x0000, 0xe004, 0x01ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e,
+	0x0000, 0xd15f, 0x0000, 0xd161, 0x0003, 0xe004, 0x0019, 0xae18,
+	0xe00a, 0x0638, 0xcec0, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x0a2f,
+	0xca9a, 0xf7c8, 0xca9c, 0xf7a8, 0xca9e, 0xc001, 0x3c32, 0xcc92,
+	0xca94, 0x0030, 0x0c31, 0x3430, 0x3c31, 0xcc90, 0xc000, 0xe42e,
+	0xe004, 0x1495, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000,
+	0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x007f, 0xd037, 0x0000,
+	0xd038, 0x0000, 0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000,
+	0xd046, 0x0000, 0xd047, 0x0000, 0xd149, 0x0000, 0xe42e, 0xc001,
+	0x280c, 0xf20a, 0xe41e, 0x024f, 0xc001, 0xe004, 0x0440, 0xce50,
+	0x280d, 0xa806, 0xa108, 0xe012, 0xa806, 0xae06, 0x3c40, 0xe004,
+	0x010b, 0x5840, 0xce52, 0xe41e, 0x0257, 0xc001, 0xd14e, 0x0000,
+	0xd144, 0x0000, 0x2402, 0x4c03, 0xe000, 0x0200, 0x3402, 0x3c03,
+	0xf3ae, 0xd027, 0x0000, 0x280c, 0xe41a, 0x0a98, 0xc001, 0xd027,
+	0x0001, 0x280d, 0xf25a, 0xca48, 0xa802, 0xf7e8, 0x2402, 0x4c03,
+	0xce40, 0xd121, 0x0000, 0xd122, 0x0040, 0xe0c0, 0x0043, 0xa806,
+	0xae02, 0xa032, 0xce46, 0xe190, 0xe190, 0xe190, 0xe190, 0xca48,
+	0xa802, 0xf7e8, 0xe004, 0x0200, 0x0402, 0x0c03, 0x3402, 0x3c03,
+	0x1408, 0x1c09, 0xf054, 0x2400, 0x4c01, 0x3402, 0x3c03, 0x280c,
+	0xe418, 0x0adc, 0xc001, 0xe41e, 0x0b21, 0xc001, 0xd14e, 0x0000,
+	0xd144, 0x0000, 0xc000, 0xe42e, 0xe0c1, 0x0059, 0xa103, 0xa200,
+	0xb636, 0xe000, 0x001c, 0xe0c1, 0x0045, 0xe052, 0xe01a, 0xe42e,
+	0xc001, 0xa200, 0x3c0a, 0xe004, 0x0200, 0x3c0d, 0xe0c0, 0x0043,
+	0xa808, 0xf338, 0xe41e, 0x0a8c, 0xc001, 0x3c0c, 0x2402, 0x4c03,
+	0xe0c1, 0x0049, 0x3604, 0x3e05, 0x2604, 0x4e05, 0xe045, 0xf033,
+	0x0606, 0x0e07, 0xe003, 0x0200, 0x280c, 0xb602, 0x3c0c, 0xf1d3,
+	0xe001, 0x0200, 0x3e0d, 0x280c, 0xf188, 0x280a, 0xe408, 0x0aa2,
+	0xe41e, 0x01db, 0xc001, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xe40a,
+	0x0aa2, 0xe0c0, 0x005d, 0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202,
+	0xce00, 0x3c0a, 0xe40e, 0x0aa2, 0x280d, 0x2a0c, 0xf039, 0xe004,
+	0x0200, 0x3c0d, 0xc000, 0xe42e, 0xc001, 0xe41e, 0x024f, 0xc001,
+	0x280d, 0xe002, 0x0200, 0xe40a, 0x0b1e, 0x280d, 0xa806, 0xf1fa,
+	0xa108, 0xe012, 0xae06, 0x3c40, 0x280d, 0xaf04, 0xae20, 0xe000,
+	0x01c0, 0xce50, 0xe190, 0xca52, 0x5c40, 0x5840, 0x2a0d, 0xa807,
+	0xae07, 0x3e40, 0xe005, 0x010b, 0x5e40, 0xe056, 0x2a0d, 0xaf05,
+	0xae21, 0xe001, 0x0140, 0xce51, 0xe190, 0xce52, 0xe004, 0x01fc,
+	0x180d, 0xf022, 0xf14e, 0xc001, 0x280d, 0xa006, 0xaf04, 0xae20,
+	0xe000, 0x0440, 0xce50, 0x280d, 0xa806, 0xa108, 0xe012, 0xa806,
+	0xae06, 0x3c40, 0xe004, 0x010b, 0x5840, 0xce52, 0xc000, 0xe40e,
+	0x0257, 0xc001, 0xcaaa, 0x2a1a, 0xb616, 0xe0c1, 0x0048, 0x360e,
+	0x3e0f, 0x260e, 0x4e0f, 0xe042, 0xe049, 0x1608, 0x1e09, 0xf035,
+	0x1406, 0x1c07, 0xe0c2, 0x0048, 0xa200, 0xceaa, 0xc000, 0xe42e,
+	0xe41e, 0x0b21, 0xe0c0, 0x0045, 0xaf04, 0xa806, 0xa104, 0xe428,
+	0xa2fc, 0x2a84, 0xa003, 0xb616, 0xe418, 0x0b47, 0xe42e, 0xc001,
+	0x3c40, 0xe0c0, 0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0x0840,
+	0xe049, 0x1600, 0x1e01, 0xf033, 0x0406, 0x0c07, 0xe049, 0x1608,
+	0x1e09, 0xf035, 0x1406, 0x1c07, 0xe0c2, 0x0048, 0xc000, 0xe42e,
+	0xe41e, 0x0b21, 0xc001, 0xe0c0, 0x0048, 0x3417, 0x3c18, 0xc000,
+	0xe42e, 0xa200, 0xceaa, 0xc001, 0x2417, 0x4c18, 0xc000, 0xe0c2,
+	0x0048, 0xe42e, 0xe41e, 0x0964, 0xe41e, 0x08bd, 0xf0f8, 0xcaa2,
+	0xe049, 0xa83e, 0xe009, 0x00ff, 0xf03b, 0xaf0f, 0xf04b, 0xe41e,
+	0x0951, 0xf71e, 0xe41e, 0x08bd, 0xf0aa, 0xe004, 0x010b, 0xe008,
+	0x00ff, 0xe41e, 0x08a3, 0xe004, 0x010b, 0xf02e, 0xcaa2, 0xe008,
+	0x001f, 0xe41e, 0x08ab, 0xe41e, 0x08af, 0xe42e, 0xc001, 0x2832,
+	0xe016, 0xc871, 0xa011, 0xf288, 0xaf07, 0xe009, 0x07ff, 0x2831,
+	0xe008, 0x07ff, 0xe046, 0xf16a, 0xf0ee, 0xc001, 0xe161, 0x0601,
+	0x2901, 0xc871, 0xa011, 0xaf07, 0xe009, 0x07ff, 0xe008, 0x07ff,
+	0xe046, 0xf08a, 0xe049, 0xe011, 0xaf15, 0xf0e1, 0xf0d0, 0xa200,
+	0xf0be, 0xc868, 0xa80e, 0xf028, 0xa210, 0x3c35, 0x7835, 0xa203,
+	0x5a35, 0xaf03, 0xe046, 0xc000, 0xe42e, 0xc000, 0x284e, 0x2a4f,
+	0x3c95, 0x3e96, 0xc001, 0x2831, 0x2a32, 0x3c36, 0x3e37, 0xe0c0,
+	0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0xce20, 0xd111, 0x0000,
+	0xd112, 0x0080, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa,
+	0xc000, 0xe42e, 0xc000, 0x2895, 0x2a96, 0x3c4e, 0x3e4f, 0xc001,
+	0x2836, 0x2a37, 0x3c31, 0x3e32, 0xcc90, 0xcc93, 0xa200, 0x3c30,
+	0x3c33, 0xe0c0, 0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0xce20,
+	0xd111, 0x0000, 0xd112, 0x0080, 0xd113, 0x0013, 0xca28, 0xf7f8,
+	0xe41e, 0x0a10, 0xe128, 0xc000, 0xe42e, 0xc001, 0x2834, 0xc000,
+	0xe42e, 0xc001, 0x3430, 0x3c31, 0xc000, 0xe42e, 0xc001, 0x2430,
+	0x4c31, 0xc000, 0xe42e, 0xc001, 0x3c32, 0xc000, 0xe42e, 0xc001,
+	0x2832, 0xc000, 0xe42e, 0xc001, 0x3c10, 0xc000, 0xe42e, 0xc001,
+	0x2810, 0xc000, 0xe42e, 0xc001, 0x3c38, 0xc000, 0xe42e, 0xc001,
+	0x2838, 0xc000, 0xe42e, 0xc001, 0xe0c0, 0x0041, 0xe005, 0x0039,
+	0xae11, 0xe042, 0x3420, 0x3c21, 0xe004, 0x04e1, 0xae10, 0x3422,
+	0x3c23, 0xc000, 0xe42e, 0xc001, 0x2420, 0x4c21, 0xc000, 0xe42e,
+	0x3c63, 0xe08e, 0x3c64, 0xe41e, 0x0c4c, 0xe41e, 0x0c54, 0x2864,
+	0xe09e, 0x2863, 0x3c60, 0xe42e, 0x2860, 0xae08, 0xe000, 0x0538,
+	0xe09e, 0xe41e, 0x0888, 0xe42e, 0x2863, 0xae08, 0xe000, 0x0538,
+	0xe09e, 0xe41e, 0x086d, 0xe42e, 0x2860, 0xe408, 0x1afb, 0xe41e,
+	0x0c17, 0xf1b8, 0xe41e, 0x08e3, 0xf068, 0xe41e, 0x09df, 0xd04c,
+	0x0000, 0xe470, 0xc896, 0xf05a, 0xe41e, 0x0c7f, 0xd04c, 0x0000,
+	0xe41e, 0x08eb, 0xe005, 0x0080, 0xb615, 0xcc6f, 0xd04b, 0x0001,
+	0xa202, 0xe41e, 0x0c1b, 0xe470, 0xd04c, 0x0000, 0xe470, 0xc001,
+	0xa200, 0x3c10, 0xe41e, 0x09df, 0xc001, 0x2832, 0xcc96, 0x2811,
+	0xe016, 0x3c11, 0xc000, 0xe42e, 0xba0c, 0xf03a, 0xbcfc, 0xe42e,
+	0xba4c, 0xa20c, 0x3c9d, 0x289d, 0xa002, 0x3c9d, 0xa140, 0xf0d2,
+	0xba40, 0xf7aa, 0x589d, 0xa102, 0x34ab, 0x3cac, 0x289d, 0xe41e,
+	0x0cc9, 0x00ab, 0x0cac, 0xe42e, 0xe16b, 0xe42e, 0xba0c, 0xf03a,
+	0xbe7e, 0xe42e, 0xba4c, 0xa20c, 0x3c9d, 0x289d, 0xa002, 0x3c9d,
+	0xa140, 0xf162, 0xba40, 0xf7aa, 0x589d, 0xa102, 0x34ab, 0x3cac,
+	0x289d, 0xe41e, 0x0cc9, 0x00ab, 0x0cac, 0x3cac, 0x8cac, 0x0000,
+	0xa002, 0xaf02, 0xe012, 0xe42c, 0xe012, 0xe16a, 0xe42e, 0xe16b,
+	0xe42e, 0xa120, 0xf050, 0xa020, 0x3c9e, 0x749e, 0xe42e, 0x3c9e,
+	0xba5e, 0x589e, 0x769e, 0xe056, 0xe42e, 0xba40, 0xe42a, 0xc868,
+	0xa80e, 0x3c00, 0xe016, 0xe428, 0x7400, 0xe016, 0xe42e, 0x2a38,
+	0xa103, 0x282f, 0xe425, 0xf02b, 0x2830, 0xb7f4, 0xa002, 0x3c5e,
+	0xa104, 0xe424, 0xf04a, 0xa25a, 0x3c5f, 0xe42e, 0xbc0e, 0x3c00,
+	0xe42d, 0x2822, 0xf02a, 0xbc0e, 0x3c01, 0xe42d, 0x2801, 0xae06,
+	0x4c00, 0x3c5f, 0xe161, 0x0728, 0xe164, 0x0720, 0x8848, 0x0022,
+	0xe41e, 0x0d10, 0xe42d, 0x2838, 0xa104, 0xe428, 0x2849, 0xe161,
+	0x0788, 0xe164, 0x0724, 0x8849, 0x0022, 0xe41e, 0x0d10, 0xe42e,
+	0xe082, 0xa040, 0xe094, 0xa040, 0xe096, 0xe004, 0x00ff, 0x3c03,
+	0xa200, 0x3c05, 0x3c06, 0x3c07, 0x3c08, 0x3c09, 0xe184, 0x0d5c,
+	0xba40, 0xf0ba, 0xe0c6, 0x0080, 0x4403, 0xae10, 0xe0c7, 0x0080,
+	0x4603, 0xe056, 0x3d11, 0xf0ce, 0xa202, 0x5800, 0xae10, 0x3d11,
+	0x2206, 0x4e07, 0xa202, 0x5805, 0xe056, 0x3406, 0x3c07, 0x2822,
+	0xf22a, 0xba40, 0xf14a, 0xe0c6, 0x0080, 0x4403, 0xae10, 0xe0c7,
+	0x0080, 0x4603, 0xe056, 0x3d12, 0xe0c6, 0x0080, 0x4403, 0xae10,
+	0xe0c7, 0x0080, 0x4603, 0xe056, 0x3d13, 0xf0de, 0xa202, 0x5801,
+	0xae10, 0x3d12, 0x3d13, 0x2208, 0x4e09, 0xa202, 0x5805, 0xe056,
+	0x3408, 0x3c09, 0x2805, 0xa002, 0x3c05, 0x2006, 0x4c07, 0xe014,
+	0x3514, 0x3d14, 0x2208, 0x4e09, 0xe015, 0x3714, 0x3f14, 0xe42e,
+	0xe0c4, 0x3fff, 0xe40d, 0x0e58, 0x3c52, 0xf048, 0xa200, 0xa2fe,
+	0x3ca1, 0x2c52, 0xe01a, 0x4451, 0xe408, 0x0e58, 0xbc12, 0xe40d,
+	0x0e58, 0xa10a, 0xb4a8, 0xa104, 0xe400, 0x0e58, 0xb7b4, 0xa006,
+	0x3c38, 0x60a1, 0x3ca1, 0xbdfe, 0xe40d, 0x0e58, 0x2a51, 0xf09b,
+	0xe049, 0x1829, 0xf06a, 0x3e29, 0xe41e, 0x1adb, 0xe40a, 0x0e58,
+	0x7413, 0x3c39, 0xa200, 0x3c3f, 0x3c42, 0x281b, 0xf068, 0xba40,
+	0x3c3f, 0xf03a, 0xba40, 0x3c42, 0x2851, 0xf2fa, 0x2c1e, 0x5c3f,
+	0x3c44, 0xa200, 0x3c40, 0x283a, 0xf07a, 0xe41e, 0x0e5b, 0x3c40,
+	0xf168, 0x283e, 0x3ca4, 0x283f, 0x3c3a, 0x284e, 0xe01a, 0x3c3b,
+	0x2839, 0x3c3c, 0x2842, 0x3c3d, 0xa2fc, 0x3c3e, 0x284e, 0xf098,
+	0x2850, 0x1c39, 0xf06a, 0xa202, 0x3cbe, 0xf03e, 0xa200, 0x3c3a,
+	0x2c52, 0xf038, 0x2840, 0xf018, 0x283f, 0xe016, 0x441c, 0x3c43,
+	0x283f, 0x0842, 0xb674, 0x3c41, 0x284f, 0xf06a, 0xe41e, 0x0c8c,
+	0xe40d, 0x0e58, 0x3c45, 0xe41e, 0x1865, 0x2835, 0xf07a, 0xe41e,
+	0x0c8c, 0xe40d, 0x0e58, 0xe408, 0x0e58, 0x2838, 0xa104, 0xf038,
+	0xba40, 0x3c46, 0x282c, 0x3c48, 0x282e, 0x3c49, 0x2838, 0xf0ea,
+	0xba40, 0xf0ca, 0xbc3e, 0x3c48, 0xe40d, 0x0e58, 0x2838, 0xa104,
+	0xf058, 0xbc3e, 0x3c49, 0xe40d, 0x0e58, 0x2851, 0xf05a, 0xe41e,
+	0x1baf, 0xe41e, 0x0e77, 0x2838, 0xe016, 0xe41a, 0x0e7e, 0xe40a,
+	0x0e58, 0xe41e, 0x0cdf, 0xe40d, 0x0e58, 0x2851, 0xf06a, 0xe41e,
+	0x172e, 0xe40a, 0x0e58, 0xf1fe, 0x284e, 0xf1da, 0x284f, 0xf04a,
+	0xba40, 0xba40, 0xf18e, 0xba40, 0xf16a, 0xbc0c, 0xe40d, 0x0e58,
+	0xf12a, 0xa106, 0xf08a, 0xa104, 0xf79a, 0xe41e, 0x0c8c, 0xe40d,
+	0x0e58, 0xf74e, 0xe41e, 0x0c8c, 0xe40d, 0x0e58, 0xbc40, 0xe40d,
+	0x0e58, 0xf6ce, 0x2838, 0xe01a, 0x442d, 0xf03a, 0xbc04, 0xf29d,
+	0x3c47, 0xe0c6, 0x0033, 0xf25d, 0x0831, 0xa400, 0xa566, 0x3c4a,
+	0xa200, 0x3c4b, 0x3c4c, 0x3c4d, 0x2833, 0xf10a, 0xbc04, 0xf19d,
+	0x3c4b, 0xa102, 0xf0ba, 0xbe0c, 0xf14d, 0xae02, 0xa83e, 0x3c4c,
+	0xbe0c, 0xf0fd, 0xae02, 0xa83e, 0x3c4d, 0x282b, 0xf01a, 0x2a43,
+	0x2c52, 0xe419, 0x0e70, 0x3c52, 0x1c44, 0xf032, 0xa202, 0xe42e,
+	0xe16a, 0xa200, 0xe42e, 0x284f, 0xe016, 0xe42a, 0x283f, 0xe42a,
+	0x283a, 0xe42a, 0x283d, 0x1842, 0xe42a, 0x284e, 0xf048, 0x283b,
+	0xe016, 0xe42e, 0x283b, 0xe42a, 0x283c, 0x1839, 0xe016, 0xe42e,
+	0xe049, 0xc70f, 0x7e57, 0xaf21, 0xae02, 0xe046, 0xe42e, 0xd1f3,
+	0x0000, 0xe162, 0x0370, 0x2912, 0xcfe4, 0xe42e, 0xe161, 0x0370,
+	0x2838, 0xa102, 0xf03a, 0xe161, 0x0390, 0x2848, 0x3c04, 0xe162,
+	0x02b0, 0xe41e, 0x0ed9, 0xe42a, 0xd1f3, 0x0000, 0xe162, 0x02b0,
+	0x8848, 0x0022, 0xe184, 0x0e95, 0x2912, 0xcfe4, 0x2838, 0xa104,
+	0xe428, 0x2849, 0x3c04, 0xe161, 0x03b0, 0xe162, 0x02d0, 0xe41e,
+	0x0ed9, 0xe42a, 0xd1f3, 0x0020, 0xe162, 0x02d0, 0x8849, 0x0022,
+	0xe184, 0x0eab, 0x2912, 0xcfe4, 0xe41e, 0x0fcc, 0xe162, 0x02d0,
+	0x2902, 0xe41e, 0x0f8a, 0xe41e, 0x0fae, 0x3470, 0x3c71, 0x2902,
+	0xae02, 0xe000, 0x0260, 0xe09e, 0x2117, 0x4d17, 0x2317, 0x4f17,
+	0x1072, 0x1c73, 0x1272, 0x1e73, 0xe010, 0xe011, 0xe046, 0xb624,
+	0xb608, 0x3c7a, 0x2902, 0xe41e, 0x0f83, 0xa102, 0xb628, 0x3c78,
+	0x2902, 0xaf02, 0xe000, 0x02a0, 0xe09e, 0x2907, 0x3c79, 0xa202,
+	0xe42e, 0xe082, 0xe098, 0xba40, 0xf098, 0x8804, 0x0022, 0xe184,
+	0x0ee2, 0x2911, 0x3d12, 0xa202, 0xe42e, 0x286d, 0xe082, 0x3c08,
+	0x2014, 0x4c15, 0x583f, 0x3400, 0x3c01, 0x2c39, 0x583f, 0x083f,
+	0x3402, 0x3c03, 0x2804, 0x3c05, 0xe163, 0x0600, 0xa200, 0xc71f,
+	0x3d13, 0xbc06, 0xe40d, 0x0f44, 0xf06a, 0xa102, 0xf13a, 0xa102,
+	0xf1ba, 0xf31e, 0xe41e, 0x0c8c, 0xe40d, 0x0f44, 0xa002, 0x1002,
+	0x1c03, 0xe012, 0xf032, 0x0000, 0x0c01, 0x3402, 0x3c03, 0xa203,
+	0xf0de, 0xe41e, 0x0c8c, 0xe40d, 0x0f44, 0xa002, 0x0002, 0x0c03,
+	0x1000, 0x1c01, 0xf70e, 0xbc40, 0xa2ff, 0x3c0f, 0xe41e, 0x0f53,
+	0xf082, 0xa203, 0x283f, 0xf03a, 0x2a0f, 0xa803, 0x2904, 0xe046,
+	0x3d12, 0xe41e, 0x0f6e, 0x2805, 0xa102, 0x3c05, 0xa004, 0xe42a,
+	0xe40e, 0x0ef9, 0x2808, 0xa102, 0xe092, 0xe163, 0x0600, 0x2805,
+	0xf0a4, 0x2913, 0x8111, 0xf7e8, 0x2901, 0x3d12, 0x2805, 0xa102,
+	0x3c05, 0xf76e, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0x2884,
+	0xe424, 0xe0c2, 0x020b, 0xe0c2, 0x0214, 0x2884, 0xe41e, 0x0fae,
+	0x346e, 0x3c6f, 0xe42e, 0x3c06, 0x3e07, 0xe163, 0x0330, 0x2819,
+	0xa102, 0xe424, 0xae02, 0xa002, 0xcc44, 0xe184, 0x0f6b, 0x2d13,
+	0x2b0b, 0x1c06, 0x1a07, 0xf078, 0xf069, 0xe086, 0xe002, 0x0330,
+	0xaf02, 0xe42e, 0x8113, 0x8113, 0xa2fe, 0xe42e, 0x3c09, 0x2808,
+	0xe092, 0x286d, 0xa102, 0xcc44, 0xe184, 0x0f79, 0x2901, 0x1809,
+	0xf03a, 0x8111, 0xe42e, 0xe082, 0x1808, 0xe000, 0x0600, 0xe096,
+	0xa202, 0x3d03, 0xe42e, 0xaf02, 0xae04, 0xe000, 0x0201, 0xe09e,
+	0x2907, 0xe42e, 0xaf02, 0xae04, 0xe000, 0x0203, 0xe09e, 0x2907,
+	0xe42e, 0x3c0a, 0xe0c0, 0x0042, 0xe000, 0x0180, 0x080a, 0xa207,
+	0xe41e, 0x0fa5, 0xe0c0, 0x0041, 0xe005, 0x006c, 0xae0f, 0x0a0a,
+	0xe042, 0xa205, 0xe41e, 0x0fa5, 0xe42e, 0xce20, 0xd111, 0x0600,
+	0xd112, 0x0020, 0xce27, 0xca28, 0xf7f8, 0xe42e, 0x3c0a, 0xaf02,
+	0xae06, 0xe0c1, 0x0041, 0xe042, 0xe005, 0x006c, 0xae0f, 0xe042,
+	0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0xd113, 0x0003, 0xca28,
+	0xf7f8, 0xe004, 0x0600, 0xe09e, 0x2117, 0x4d17, 0x2a0a, 0xa803,
+	0xe42b, 0x2117, 0x4d17, 0xe42e, 0xe161, 0x0600, 0xa23e, 0xc71f,
+	0x3d11, 0x2848, 0xe000, 0x02b0, 0xe094, 0x2a48, 0x8848, 0x0022,
+	0xe184, 0x0fdf, 0x290a, 0xe000, 0x0600, 0xe092, 0x3f01, 0xa103,
+	0xd1f9, 0x0000, 0xe162, 0x0600, 0xd022, 0x001f, 0xe184, 0x0fe9,
+	0x2912, 0xcff0, 0xe42e, 0xe41e, 0x0fcc, 0xe42e, 0xd1f3, 0x0000,
+	0xe167, 0x02b0, 0xd022, 0x003f, 0xe184, 0x0ff7, 0x2917, 0xcfe4,
+	0xd1f9, 0x0000, 0xe167, 0x0600, 0xd022, 0x001f, 0xe184, 0x1001,
+	0x2917, 0xcff0, 0xe42e, 0xba4e, 0x3c11, 0xa200, 0x3c24, 0xd022,
+	0x0007, 0xe184, 0x1010, 0xba41, 0x5a24, 0xe056, 0x2a24, 0xa003,
+	0x3e24, 0x3c24, 0xa208, 0x3cf0, 0x2824, 0xaf0c, 0xe408, 0x111a,
+	0xa224, 0x3cf0, 0xe41e, 0x1373, 0xe40a, 0x111d, 0xa226, 0x3cf0,
+	0xba4e, 0x3c1f, 0xa112, 0xe404, 0x111a, 0xa154, 0xe400, 0x111a,
+	0xbc3e, 0x3c10, 0xa202, 0x3c22, 0xa200, 0x3c67, 0x2811, 0xa1c8,
+	0xf338, 0xbc06, 0x3c22, 0xa20a, 0x3cf0, 0xbc08, 0xe408, 0x111a,
+	0xa20c, 0x3cf0, 0xbc08, 0xe408, 0x111a, 0xba40, 0xba40, 0x3c67,
+	0xf23a, 0xa201, 0x3e69, 0x3e6b, 0xe160, 0x0000, 0xba40, 0xf11a,
+	0x2a69, 0xae03, 0xe056, 0x3c69, 0xe080, 0xe41e, 0x131e, 0x2a6b,
+	0xae03, 0xe056, 0x3c6b, 0xe080, 0xa201, 0xe41e, 0x1351, 0xf07e,
+	0x2a69, 0xae03, 0x3e69, 0x2a6b, 0xae03, 0x3e6b, 0xe080, 0xa002,
+	0xe090, 0xa110, 0xf648, 0xa20e, 0x3cf0, 0xbc18, 0xe40d, 0x111a,
+	0xa008, 0x3c13, 0xa202, 0x5813, 0x3414, 0x3c15, 0xa210, 0x3cf0,
+	0xbc04, 0x3c16, 0xe40d, 0x111a, 0xa102, 0xf034, 0xf0aa, 0xf33e,
+	0xa212, 0x3cf0, 0xbc18, 0xe40d, 0x111a, 0xa008, 0x3c17, 0xf2be,
+	0xba40, 0x3c18, 0xe41e, 0x0ca6, 0xe160, 0x0907, 0xe161, 0x0908,
+	0x3500, 0x3d01, 0xe41e, 0x0ca6, 0xe162, 0x0909, 0xe163, 0x090a,
+	0x3502, 0x3d03, 0xa214, 0x3cf0, 0xbdfe, 0xe40d, 0x111a, 0xe164,
+	0x090b, 0x3d04, 0xf10a, 0xa102, 0xcc44, 0xe162, 0x09e0, 0xe184,
+	0x10a4, 0xe41e, 0x0ca6, 0x3512, 0x3d12, 0xa216, 0x3cf0, 0xe41e,
+	0x124a, 0xf01e, 0xe40d, 0x111a, 0xa218, 0x3cf0, 0xbc20, 0xe40d,
+	0x111a, 0x3c19, 0xba40, 0x3c1a, 0xa21a, 0x3cf0, 0xbdfe, 0xe40d,
+	0x111a, 0xa002, 0x3c57, 0xa21c, 0x3cf0, 0xbdfe, 0xe40d, 0x111a,
+	0xa002, 0x3c58, 0x8457, 0x8258, 0xe018, 0x3c1e, 0xa222, 0x3cf0,
+	0x2c57, 0xe002, 0x0080, 0xe400, 0x111a, 0x2c58, 0xe002, 0x0080,
+	0xe400, 0x111a, 0x2c1e, 0xe002, 0x4000, 0xe400, 0x111a, 0xa200,
+	0x3c1c, 0xba40, 0x3c1b, 0xf098, 0xba40, 0x3c1c, 0x2858, 0xae02,
+	0x3c58, 0x2c1e, 0xae02, 0x3c1e, 0xe41e, 0x11ca, 0xa21e, 0x3cf0,
+	0x2a1b, 0xba40, 0xb636, 0x3c1d, 0xa220, 0x3cf0, 0xba40, 0xe161,
+	0x05e4, 0xc703, 0x3d11, 0xf16a, 0xe161, 0x05e4, 0xe41e, 0x0c8c,
+	0x3d11, 0xe41e, 0x0c8c, 0x3d11, 0xe41e, 0x0c8c, 0x2a1b, 0xf029,
+	0xae02, 0x3d11, 0xe41e, 0x0c8c, 0x2a1b, 0xf029, 0xae02, 0x3d11,
+	0xf12d, 0xa200, 0x3c90, 0x3c91, 0x2820, 0x3cea, 0x3ceb, 0xe41e,
+	0x1468, 0xba40, 0xe016, 0xe41a, 0x125a, 0xf05a, 0xe41e, 0x0cd5,
+	0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xa2fe, 0xe42e, 0xe41e,
+	0x0c8c, 0x3c29, 0xbc3e, 0xe40d, 0x11c0, 0x1810, 0xf11a, 0x0810,
+	0x3c10, 0xe41e, 0x1ab1, 0x3c65, 0xa205, 0xae23, 0xcc9f, 0xa202,
+	0xe41e, 0x0c40, 0xa203, 0x3e9b, 0x2865, 0xe40a, 0x11c0, 0xba40,
+	0x3c2d, 0xba40, 0x3c2a, 0xbc0e, 0xe40d, 0x11c0, 0x3c2b, 0xf03a,
+	0xe40d, 0x11c0, 0x282d, 0x2a2b, 0xe01b, 0xe052, 0xe408, 0x11c0,
+	0x2811, 0xa184, 0xf078, 0x282d, 0xf0aa, 0xe004, 0x0064, 0x3c11,
+	0xf06e, 0x282b, 0xf04a, 0xe004, 0x0042, 0x3c11, 0xbc3e, 0xe40d,
+	0x11c0, 0x3c2c, 0xbc3e, 0x3c2e, 0xe40d, 0x11c0, 0xba40, 0x3c2f,
+	0xba42, 0x3c30, 0xbe34, 0xe40d, 0x11c0, 0xa034, 0x3c31, 0xe404,
+	0x11c0, 0xa168, 0xe402, 0x11c0, 0xbe34, 0xe40d, 0x11c0, 0xa034,
+	0xe404, 0x11c0, 0xa168, 0xe402, 0x11c0, 0xbe18, 0xe40d, 0x11c0,
+	0x3c32, 0x3c36, 0xba40, 0x3c33, 0xba40, 0x3c34, 0xba40, 0x3c35,
+	0xa200, 0x3c37, 0x3c68, 0x2811, 0xa184, 0xf37a, 0x2829, 0x3c02,
+	0xe41e, 0x1b79, 0xe41e, 0x0ba5, 0xf30a, 0xba40, 0x3c37, 0xba40,
+	0x3c68, 0xf28a, 0xa201, 0x3e6a, 0x3e6c, 0xe160, 0x0000, 0xe080,
+	0xa10c, 0x1837, 0x1837, 0xf132, 0xba40, 0xf11a, 0x2a6a, 0xae03,
+	0xe056, 0x3c6a, 0xe080, 0xe41e, 0x131e, 0x2a6c, 0xae03, 0xe056,
+	0x3c6c, 0xe080, 0xa203, 0xe41e, 0x1351, 0xf07e, 0x2a6a, 0xae03,
+	0x3e6a, 0x2a6c, 0xae03, 0x3e6c, 0xe080, 0xa002, 0xe090, 0xa110,
+	0xf5f8, 0xbe18, 0xf06d, 0x3c36, 0xe41e, 0x0cd5, 0xa202, 0xe42e,
+	0xe0c1, 0x0059, 0xa107, 0xf049, 0x28ae, 0xa902, 0x3cae, 0xe16a,
+	0xa200, 0xe42e, 0xa214, 0x2e1e, 0xe003, 0x0063, 0xf2f7, 0xa216,
+	0x2e1e, 0xe003, 0x018c, 0xf2a7, 0xa22a, 0x2e1e, 0xe003, 0x0318,
+	0xf257, 0xa22c, 0x2e1e, 0xe003, 0x0654, 0xf207, 0xa23e, 0x2e1e,
+	0xe003, 0x0e10, 0xf1b7, 0xa240, 0x2e1e, 0xe003, 0x1400, 0xf167,
+	0xa250, 0x2e1e, 0xe003, 0x2000, 0xf117, 0xa254, 0x2e1e, 0xe003,
+	0x2200, 0xf0c7, 0xa264, 0x2e1e, 0xe003, 0x5640, 0xf077, 0xa266,
+	0x2e1e, 0xe003, 0x9000, 0xf027, 0xa268, 0x2a1f, 0xe045, 0xf023,
+	0x3c1f, 0x2a1f, 0xa115, 0xe004, 0x0129, 0xf2d7, 0xa103, 0xe004,
+	0x02a3, 0xf297, 0xa113, 0xe004, 0x06f6, 0xf257, 0xa103, 0xe004,
+	0x0dec, 0xf217, 0xa113, 0xe004, 0x17bb, 0xf1d7, 0xa103, 0xe004,
+	0x34bc, 0xf197, 0xa103, 0xe004, 0x3c00, 0xf157, 0xa113, 0xe004,
+	0x6000, 0xf117, 0xa103, 0xe004, 0x6600, 0xf0d7, 0xa111, 0xe004,
+	0x1437, 0xae08, 0xf087, 0xa103, 0xe004, 0x21c0, 0xae08, 0xf037,
+	0xe004, 0x17bb, 0xae12, 0x3409, 0x3c0a, 0x841e, 0xe182, 0x0180,
+	0xe019, 0x2009, 0x4c0a, 0xc407, 0xd022, 0x000f, 0xe184, 0x1242,
+	0xe046, 0xf034, 0x8117, 0xe190, 0xe08e, 0x2a19, 0xe062, 0xa520,
+	0x3c20, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x0026, 0xae11, 0xe042,
+	0xce20, 0xd111, 0x09e0, 0xd112, 0x0200, 0xd113, 0x0002, 0xca28,
+	0xf7f8, 0xe42e, 0xa200, 0x3c00, 0x3c01, 0x3c02, 0x3c03, 0x3c04,
+	0x3c05, 0x3c06, 0x3c07, 0x3c08, 0x3c09, 0x3c0a, 0xba40, 0xa2ff,
+	0x3e25, 0x3e26, 0xf16a, 0xba4e, 0xa201, 0x3e25, 0x3c26, 0xe002,
+	0x00ff, 0xf0f8, 0xa202, 0x3c07, 0xba5e, 0xba5f, 0x3c25, 0x3e26,
+	0xe016, 0xe017, 0xe056, 0xf028, 0xf04e, 0xa200, 0x3c26, 0x3c25,
+	0xba40, 0xf02a, 0xba40, 0xba40, 0x3c0a, 0xf0ca, 0xba44, 0x3c09,
+	0xba40, 0x3c08, 0xba40, 0x3c06, 0xf05a, 0xba4e, 0x3c05, 0xba4e,
+	0xba4e, 0xba40, 0x3c04, 0xf05a, 0xbc0a, 0x3c03, 0xbc0a, 0x3c02,
+	0xba40, 0x3c01, 0xf0ba, 0xba7e, 0xe161, 0x05c7, 0x3511, 0x3d11,
+	0xba7e, 0x3511, 0x3d11, 0xba40, 0x3c00, 0xba40, 0x3c90, 0xe016,
+	0xe161, 0x05bd, 0xe41a, 0x1302, 0xe40a, 0x12ff, 0xba40, 0x3c91,
+	0xe016, 0xe161, 0x05c2, 0xe41a, 0x1302, 0xe40a, 0x12ff, 0x2890,
+	0x4c91, 0xf02a, 0xba40, 0xba40, 0x3c23, 0xba40, 0xf0aa, 0xba40,
+	0xbc20, 0xbc20, 0xbc20, 0xbc20, 0xbc20, 0x3cea, 0xbc20, 0x3ceb,
+	0x28eb, 0xa120, 0xf0a0, 0x2819, 0x18eb, 0xf070, 0x28b3, 0xf09a,
+	0x287f, 0xa104, 0x18eb, 0xf052, 0x2ab3, 0xf029, 0x2a20, 0x3eeb,
+	0xa202, 0xae3e, 0x2a0a, 0xae3d, 0xe056, 0x2a09, 0xae37, 0xe056,
+	0x2a08, 0xae35, 0xe056, 0x2a07, 0xae33, 0xe056, 0x2a06, 0xae31,
+	0xe056, 0x2a05, 0xae21, 0xe056, 0x2a04, 0xae11, 0xe056, 0x2a03,
+	0xae0b, 0xe056, 0x2a02, 0xae05, 0xe056, 0x2a01, 0xae03, 0xe056,
+	0x2a00, 0xe056, 0xe41e, 0x1468, 0xe16a, 0xa202, 0xe42e, 0xe16a,
+	0xa200, 0xe42e, 0xe41e, 0x0c8c, 0xcc44, 0x3c61, 0xa002, 0x3d11,
+	0xba46, 0xba46, 0xe184, 0x1310, 0xe41e, 0x0c8c, 0xe41e, 0x0c8c,
+	0xba40, 0xba48, 0xa002, 0x3d11, 0xba48, 0xa002, 0x3d11, 0xba48,
+	0xa002, 0x3d11, 0xba48, 0x3d11, 0xa202, 0xe42e, 0xd022, 0x000f,
+	0xa10c, 0xf034, 0xd022, 0x003f, 0xe161, 0x0600, 0xa210, 0x3c06,
+	0x3c07, 0xa200, 0x3c08, 0x3c09, 0xe09c, 0xe09e, 0xe184, 0x134e,
+	0x2807, 0xf10a, 0xe41e, 0x0ca6, 0xe42d, 0x0806, 0xe000, 0x0100,
+	0xe008, 0x00ff, 0x3c07, 0x4c09, 0xe01a, 0xe016, 0xe09e, 0xa202,
+	0x3c09, 0x2807, 0xf028, 0x2806, 0x3c06, 0xe08d, 0xa003, 0xe09d,
+	0xa803, 0xf059, 0xe085, 0xae11, 0xe056, 0x3d11, 0xe094, 0xe08e,
+	0xe42e, 0x3e08, 0x3c06, 0xa211, 0x3e07, 0xa10c, 0xf064, 0xb690,
+	0xa00c, 0x3c06, 0xa240, 0x3c07, 0x2806, 0x2a08, 0xf02b, 0xa01c,
+	0xae08, 0x3c06, 0xe0c0, 0x0041, 0xe005, 0x0034, 0xae11, 0xe042,
+	0x0806, 0xce20, 0xd111, 0x0600, 0x2807, 0xce24, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x2811, 0xa184, 0xf0ba, 0xa116, 0xf09a,
+	0xa12e, 0xf07a, 0x2824, 0xe008, 0x0003, 0xf038, 0xa200, 0xe42e,
+	0xa202, 0xe42e, 0xa202, 0x3c51, 0xe41e, 0x08bd, 0xe408, 0x13e2,
+	0xe41e, 0x0b72, 0xf26a, 0xa102, 0xe40a, 0x13fe, 0xa108, 0xe404,
+	0x13b0, 0xe40a, 0x13fe, 0xa102, 0xe40a, 0x13c8, 0xa102, 0xe40a,
+	0x13b3, 0xa102, 0xe40a, 0x13be, 0xa102, 0xe40a, 0x13d2, 0xa102,
+	0xe40a, 0x13df, 0xa102, 0xe40a, 0x13df, 0xa102, 0xe40a, 0x13e9,
+	0xf082, 0x2851, 0xe40a, 0x140c, 0xe41e, 0x098a, 0xe40e, 0x13f9,
+	0xe41e, 0x0951, 0xf52e, 0x2851, 0xe40a, 0x140c, 0xe41e, 0x1459,
+	0xe41e, 0x098a, 0xe41e, 0x1a99, 0xe40e, 0x13f9, 0x2851, 0xe40a,
+	0x140c, 0xe41e, 0x1459, 0xe41e, 0x098a, 0xe41e, 0x1ac4, 0xf32e,
+	0x2851, 0xe40a, 0x140c, 0xe41e, 0x1459, 0xe41e, 0x098a, 0xe41e,
+	0x146d, 0xf28e, 0x2851, 0xe40a, 0x140c, 0xe41e, 0x1460, 0xe41e,
+	0x1459, 0xe41e, 0x098a, 0xba44, 0xe41e, 0x0cd5, 0xf1be, 0xe41e,
+	0x08bd, 0xf16a, 0xe41e, 0x01db, 0x2851, 0xe408, 0x1413, 0xe40e,
+	0x140c, 0xe41e, 0x098a, 0xba0e, 0xe002, 0x00ff, 0xf058, 0xba4e,
+	0xe41e, 0x0b96, 0xf798, 0xe41e, 0x0cd5, 0xe40e, 0x1384, 0xe41e,
+	0x0951, 0x2851, 0xe40a, 0x140c, 0xe40e, 0x1384, 0xe41e, 0x1459,
+	0xe41e, 0x098a, 0xe41e, 0x25f9, 0xe41e, 0x0d68, 0xe40a, 0x1384,
+	0x284e, 0x3c92, 0x284f, 0x3c93, 0xa200, 0x3c51, 0xe41e, 0x1435,
+	0xf078, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xa2fe, 0xe42e, 0xe41e,
+	0x141e, 0xe41e, 0x05b7, 0xe41e, 0x19fe, 0xf74e, 0xe165, 0x05e8,
+	0x2811, 0x3d15, 0x2857, 0x3d15, 0x2858, 0x3d15, 0x28eb, 0x3d15,
+	0x281b, 0x3d15, 0x2824, 0x3d15, 0x281f, 0x3d15, 0x2813, 0x3d15,
+	0x2816, 0x3d15, 0x2819, 0x3d15, 0xe42e, 0xe165, 0x05e8, 0x2811,
+	0x1915, 0xf1d8, 0x2857, 0x1915, 0xf1a8, 0x2858, 0x1915, 0xf178,
+	0x28eb, 0x1915, 0xf148, 0x281b, 0x1915, 0xf118, 0x2824, 0x1915,
+	0xe428, 0x281f, 0x1915, 0xe428, 0x2813, 0x1915, 0xe428, 0x2816,
+	0x1915, 0xe428, 0x2819, 0x1915, 0xe428, 0xe42e, 0xa202, 0x3cbd,
+	0xe42e, 0x28ad, 0xe428, 0xe41e, 0x064c, 0xa202, 0x3cad, 0xe42e,
+	0xa200, 0x3cad, 0xe42e, 0xc009, 0x2039, 0x4c3a, 0xc000, 0xe42e,
+	0xc009, 0x3439, 0x3c3a, 0xc000, 0xe42e, 0xa200, 0xba4f, 0xe042,
+	0xe003, 0x00ff, 0xf7cb, 0xe41e, 0x171e, 0xa200, 0xba4f, 0xe042,
+	0xe003, 0x00ff, 0xf7cb, 0xe41e, 0x1726, 0xf04a, 0xe41e, 0x1487,
+	0xe42a, 0xe41e, 0x0b96, 0xf6a8, 0xe41e, 0x0cd5, 0xe42e, 0xe41e,
+	0x1722, 0xf13a, 0xa102, 0xf14a, 0xa104, 0xf15a, 0xa102, 0xf16a,
+	0xa102, 0xf17a, 0xa150, 0xf18a, 0xe41e, 0x172a, 0xf04a, 0xba4f,
+	0xa102, 0xf7e8, 0xa202, 0xe42e, 0xe41e, 0x14b6, 0xf10e, 0xe41e,
+	0x14e5, 0xf0de, 0xe41e, 0x1533, 0xf0ae, 0xe41e, 0x1544, 0xf07e,
+	0xe41e, 0x158e, 0xf04e, 0xe41e, 0x1592, 0xf01e, 0xe42a, 0xc868,
+	0xa80e, 0xe016, 0xe428, 0xe41e, 0x0cd5, 0xe42e, 0xbc3e, 0xf1fd,
+	0x1810, 0xf11a, 0x0810, 0xf084, 0xa13e, 0xf060, 0xa03e, 0x3c10,
+	0xe41e, 0x1ab1, 0x3c65, 0xa200, 0xe41e, 0x0c40, 0xa201, 0x3e9b,
+	0x2865, 0xe42a, 0x2890, 0xe161, 0x05bd, 0xe418, 0x14d9, 0x2891,
+	0xe161, 0x05c2, 0xe418, 0x14d9, 0xa202, 0xe42e, 0xa200, 0xe16a,
+	0xe42e, 0x2911, 0xa102, 0xcc44, 0xe184, 0x14e3, 0x2901, 0xe41e,
+	0x0cc9, 0x2901, 0xe41e, 0x0cc9, 0xe42e, 0x2890, 0xe161, 0x05bf,
+	0xf038, 0xe161, 0x05c4, 0x4c91, 0xf11a, 0x2911, 0xe41e, 0x0cc9,
+	0xc009, 0x343f, 0x3c40, 0xc000, 0x2911, 0xe41e, 0x0cc9, 0xc009,
+	0x3441, 0x3c42, 0xc000, 0x2911, 0xf02e, 0xa230, 0x3c02, 0x2823,
+	0xe016, 0xe428, 0xba46, 0x3ca3, 0xa112, 0xb604, 0xe42a, 0xa012,
+	0xe049, 0xa200, 0xa107, 0xb426, 0xa105, 0xb426, 0xa105, 0xb5f6,
+	0xcc44, 0xe184, 0x1530, 0xba40, 0xf028, 0xf1be, 0xba42, 0xba40,
+	0xba48, 0xba40, 0x3c03, 0xba40, 0xba40, 0xba4e, 0x2803, 0xf05a,
+	0xba4a, 0xba4a, 0xba48, 0xf0ae, 0xba40, 0xf08a, 0xba4a, 0xba40,
+	0xf05a, 0xba4a, 0xba40, 0xf02a, 0xba48, 0x2802, 0xe41e, 0x0cc9,
+	0xe190, 0xa202, 0xe42e, 0xe41e, 0x172a, 0xf0da, 0xa102, 0xcc44,
+	0xe004, 0x00ff, 0xe184, 0x153d, 0xba4f, 0xe052, 0xe002, 0x00ff,
+	0xe016, 0xe42a, 0xa202, 0xe42e, 0xa202, 0xba4f, 0xe003, 0x00ff,
+	0xf039, 0xba4f, 0xa204, 0xba1f, 0xe003, 0x0031, 0xf049, 0xba5f,
+	0xa004, 0xe190, 0xba3f, 0x360e, 0x3e0f, 0xe005, 0x4454, 0x1a0e,
+	0xf069, 0xe005, 0x4731, 0x1a0f, 0xf029, 0xf24e, 0xe005, 0x4741,
+	0x1a0e, 0xf0b9, 0xe005, 0x3934, 0x1a0f, 0xf079, 0xba7f, 0xa008,
+	0xba0f, 0xa10d, 0xe40b, 0x1578, 0xc009, 0x2a2d, 0xc000, 0xe045,
+	0xa009, 0xc009, 0x3e2d, 0xc000, 0xe41e, 0x1621, 0xa202, 0xe42e,
+	0xba4f, 0xa002, 0xc009, 0x2a2d, 0xc000, 0xe045, 0xf4d1, 0xa202,
+	0xe42e, 0xba7e, 0xba40, 0xf098, 0xba41, 0xba4a, 0xf04b, 0xba46,
+	0xba46, 0x3cb0, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe41e, 0x1621,
+	0xa202, 0xe42e, 0xc009, 0xa2fe, 0x3426, 0x3c27, 0xa201, 0x3628,
+	0x3e29, 0x362a, 0x3e2b, 0xc000, 0xe41e, 0x0c8c, 0xc009, 0xe40d,
+	0x1607, 0x3426, 0x3c27, 0xba40, 0xe40d, 0x1607, 0xae2a, 0xe055,
+	0x3628, 0x3e29, 0xe408, 0x15fd, 0xba4c, 0xe40d, 0x1607, 0xae0c,
+	0xe055, 0xba40, 0xe40d, 0x1607, 0xae28, 0xe055, 0xba4a, 0xe40d,
+	0x1607, 0xe055, 0xba40, 0xe40d, 0x1607, 0xae26, 0xe055, 0xba40,
+	0xe40d, 0x1607, 0xae24, 0xe055, 0xba40, 0xe40d, 0x1607, 0xae22,
+	0xe055, 0xba40, 0xe40d, 0x1607, 0xae20, 0xe055, 0xba40, 0xe40d,
+	0x1607, 0xae1e, 0xe055, 0xba40, 0xe40d, 0x1607, 0xae1c, 0xe055,
+	0x3628, 0x3e29, 0xe04a, 0xaf28, 0xa802, 0xe016, 0xaf0d, 0xa83f,
+	0xa10b, 0xe01b, 0xe052, 0xf12a, 0xa201, 0xba46, 0xf21d, 0xae38,
+	0xe055, 0xba46, 0xf1dd, 0xae30, 0xe055, 0xba46, 0xf19d, 0xae28,
+	0xe055, 0xba46, 0xf15d, 0xae20, 0xe055, 0xba4e, 0xf11d, 0xe0c4,
+	0x4064, 0xf0ed, 0xe055, 0x362a, 0x3e2b, 0x2228, 0x4e29, 0xba40,
+	0xae1a, 0xe055, 0x3628, 0x3e29, 0xa202, 0xc000, 0xe42e, 0xc009,
+	0xa2fe, 0x3426, 0x3c27, 0xa200, 0x3428, 0x3c29, 0x342a, 0x3c2b,
+	0xc000, 0xe42e, 0xc009, 0x2426, 0x4c27, 0xc000, 0xe42e, 0xc009,
+	0x2428, 0x4c29, 0xc000, 0xe42e, 0xc009, 0x242a, 0x4c2b, 0xc000,
+	0xe42e, 0xe0c0, 0x0065, 0xa878, 0xa140, 0xf0ba, 0xe41e, 0x172a,
+	0xa102, 0xcc44, 0xe184, 0x162d, 0xba4e, 0xe190, 0xe40e, 0x16b1,
+	0xa201, 0xe41e, 0x170c, 0x2907, 0xa002, 0x3c0c, 0x3d17, 0xa120,
+	0xf6e0, 0x2b07, 0xe41e, 0x1722, 0xf05a, 0xe41e, 0x172a, 0xe041,
+	0xf05e, 0x2861, 0xa002, 0xae06, 0xe041, 0xa00f, 0xaf07, 0xae07,
+	0xe04a, 0xaf1f, 0xf0db, 0xa201, 0xe41e, 0x170c, 0x8117, 0x8117,
+	0x2907, 0xa202, 0x3d07, 0xa201, 0xe41e, 0x170a, 0xf50e, 0x3d17,
+	0xa201, 0xe41e, 0x170a, 0xe167, 0x0600, 0xe41e, 0x1722, 0x3d17,
+	0xe41e, 0x1722, 0xf04a, 0xe41e, 0x172a, 0xf04e, 0x2861, 0xa002,
+	0xae06, 0x3d17, 0x2a0c, 0xe41e, 0x170a, 0xa200, 0x3c0b, 0xa200,
+	0xe167, 0x0600, 0xc703, 0x3d17, 0xe167, 0x0600, 0xe41e, 0x1722,
+	0xf3ba, 0xe41e, 0x1722, 0xa108, 0xf0f8, 0xe004, 0x4741, 0x3d17,
+	0xe004, 0x3934, 0x3d17, 0x28a7, 0xa008, 0x3ca7, 0xe41e, 0x172a,
+	0xa108, 0xe41e, 0x1726, 0x280b, 0xa002, 0x3c0b, 0xba4f, 0x28a7,
+	0xa002, 0x3ca7, 0xa802, 0xf058, 0x280a, 0xae10, 0xe056, 0x3d17,
+	0x3e0a, 0x28a7, 0xa80e, 0xe41a, 0x16cc, 0xe41e, 0x172a, 0x180b,
+	0xf6b0, 0x28a7, 0xa80e, 0xf0ea, 0x2aa7, 0xa803, 0xf04b, 0x280a,
+	0xae10, 0x3d17, 0x2aa7, 0xa00f, 0xaf07, 0xae07, 0x3ea7, 0xe418,
+	0x16cc, 0xe40e, 0x16ca, 0x280b, 0xa002, 0x3c0b, 0x2901, 0xe41e,
+	0x0cc9, 0x3517, 0x3d17, 0x2901, 0xe41e, 0x0cc9, 0x3517, 0x3d17,
+	0x28a7, 0xa010, 0x3ca7, 0xe41e, 0x16cc, 0x2861, 0xa002, 0x180b,
+	0xf6b0, 0xf01a, 0xa202, 0xe42e, 0x24b7, 0x4cb8, 0xe000, 0x0088,
+	0x18a7, 0xf242, 0xe0c0, 0x0065, 0xaf12, 0xa802, 0xf0da, 0xa201,
+	0xe41e, 0x170c, 0x8117, 0x8117, 0x2907, 0xa202, 0x3d07, 0xa201,
+	0xe41e, 0x170a, 0xe42e, 0xe004, 0x0200, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x005d, 0xe008, 0x0200,
+	0xe190, 0xf7b8, 0xe004, 0x0090, 0x3ca7, 0x24b5, 0x4cb6, 0x08a7,
+	0xa110, 0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0xd113, 0x0000,
+	0xca28, 0xf7f8, 0xa200, 0xe167, 0x0600, 0xc703, 0x3d17, 0xe167,
+	0x0600, 0xe42e, 0xa200, 0xf02e, 0xa202, 0x3c0d, 0x24b5, 0x4cb6,
+	0xae07, 0xe042, 0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0x880d,
+	0x0113, 0xca28, 0xf7f8, 0xe167, 0x0600, 0xe42e, 0xc009, 0x3c2c,
+	0xc000, 0xe42e, 0xc009, 0x282c, 0xc000, 0xe42e, 0xc009, 0x3c2d,
+	0xc000, 0xe42e, 0xc009, 0x282d, 0xc000, 0xe42e, 0x2c39, 0x3c7b,
+	0xa202, 0x3c7c, 0xa200, 0x3c7d, 0x3c7e, 0x284e, 0xe016, 0xe428,
+	0x284f, 0xf0ca, 0xe41e, 0x17cd, 0xba40, 0xba40, 0xb7f0, 0xb634,
+	0x3c7c, 0xa200, 0x3c7b, 0xa202, 0xe42e, 0xba40, 0xf11a, 0x2819,
+	0xe42a, 0xae02, 0x3c09, 0x2014, 0x4c15, 0x583f, 0x3400, 0x3c01,
+	0x2c39, 0x583f, 0x083f, 0x3402, 0x3c03, 0xbc0c, 0xf058, 0xa202,
+	0x3c7d, 0xe42e, 0xbc0c, 0xe40d, 0x17ca, 0xe40a, 0x17c8, 0xa102,
+	0xf0ca, 0xa102, 0xf1fa, 0xa102, 0xf24a, 0xa102, 0xf39a, 0xa102,
+	0xe40a, 0x17a8, 0xe40e, 0x17b0, 0xe41e, 0x0c8c, 0xe40d, 0x17ca,
+	0xa002, 0x1002, 0x1c03, 0xe012, 0x3c0a, 0xf032, 0x0000, 0x0c01,
+	0xa203, 0xe41e, 0x17d4, 0x2a0a, 0x3e04, 0x4c4f, 0xe41a, 0x17ec,
+	0xf5ae, 0xbc40, 0xe40d, 0x17ca, 0xa2ff, 0xe41e, 0x17d4, 0xf53e,
+	0xe41e, 0x0c8c, 0xe40d, 0x17ca, 0xa002, 0x1002, 0x1c03, 0xe012,
+	0xf032, 0x0000, 0x0c01, 0x3c06, 0xa802, 0x443f, 0xbc21, 0xf33d,
+	0x5a3f, 0xe041, 0x3e07, 0xe41e, 0x181b, 0xe40e, 0x175a, 0xbc20,
+	0xf2ad, 0xa102, 0x583f, 0x083f, 0xe41e, 0x1836, 0xe40e, 0x175a,
+	0xe41e, 0x17cd, 0xa202, 0x3c7e, 0xa200, 0x3c7b, 0xe40e, 0x175a,
+	0xbc20, 0xf19d, 0x3c7b, 0x287b, 0x583f, 0x083f, 0xa2ff, 0xe41e,
+	0x17d4, 0xf7a8, 0x283f, 0xf09a, 0x2840, 0xf078, 0x287b, 0xae02,
+	0xa2ff, 0xe41e, 0x17d4, 0xf7b8, 0xa2fe, 0x3c7c, 0xe40e, 0x175a,
+	0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xc410, 0xe161, 0x02f1,
+	0xa200, 0xc71f, 0x3d31, 0xe42e, 0x3c04, 0x3e05, 0xe161, 0x02f0,
+	0x8809, 0x0022, 0xe184, 0x17e7, 0x2d11, 0x2b09, 0x1c04, 0x1a05,
+	0xf068, 0xf059, 0x8111, 0xa200, 0x3d09, 0xf05e, 0x8111, 0x8111,
+	0xa200, 0xe42e, 0xa202, 0xe42e, 0xe161, 0x02f0, 0x8809, 0x0022,
+	0xe184, 0x17fc, 0x2d11, 0x2b09, 0x1804, 0x1a05, 0xf050, 0xf049,
+	0x8111, 0xa200, 0x3d09, 0x8111, 0x8111, 0xe160, 0x0003, 0xe161,
+	0x02f1, 0x8809, 0x0022, 0xe184, 0x1818, 0x2909, 0xf11a, 0x2d01,
+	0x2e39, 0x5a3f, 0xe045, 0xf053, 0x2214, 0x4e15, 0x5a3f, 0xe046,
+	0xae02, 0x1804, 0xf052, 0xa200, 0x8111, 0x3d01, 0xe42e, 0x8131,
+	0xe190, 0xa202, 0xe42e, 0x2807, 0xa2ff, 0xe41e, 0x17d4, 0xf7c8,
+	0xe161, 0x02f0, 0x8809, 0x0022, 0xe184, 0x1831, 0x2d11, 0x2b09,
+	0x1c06, 0xf078, 0xf067, 0x2807, 0x3d11, 0xa2fe, 0x3d09, 0xf05e,
+	0x8111, 0x8111, 0xa200, 0xe42e, 0xa202, 0xe42e, 0x3c08, 0xe161,
+	0x02f0, 0x8809, 0x0022, 0xe184, 0x1846, 0x2d11, 0x2b09, 0x1808,
+	0xf056, 0xf043, 0x8111, 0xa200, 0x3d09, 0x8111, 0x8111, 0xe42e,
+	0x2819, 0x1812, 0xf122, 0x2812, 0xa102, 0xcc44, 0xe161, 0x0202,
+	0xe184, 0x185b, 0x2911, 0xf06a, 0x2909, 0xe412, 0x1f29, 0xa200,
+	0x3d11, 0xe082, 0xa006, 0xe092, 0x2819, 0xb62c, 0x3c12, 0x2816,
+	0xa104, 0xe428, 0xe41e, 0x19fe, 0xe42e, 0x2816, 0xa102, 0xf044,
+	0xf16a, 0xe40e, 0x18b3, 0x7417, 0xe160, 0x0903, 0x3d00, 0x283f,
+	0xe016, 0x442a, 0xe418, 0x0ca6, 0xe42d, 0xe161, 0x0904, 0xe162,
+	0x0905, 0x3501, 0x3d02, 0xe41e, 0x1916, 0xf38e, 0xa200, 0xe160,
+	0x0903, 0xe161, 0x0904, 0xe162, 0x0905, 0xe163, 0x0906, 0x3500,
+	0x3d01, 0x3502, 0x3d03, 0x2818, 0xf178, 0xe41e, 0x0ca6, 0xe42d,
+	0xe164, 0x0903, 0xe165, 0x0904, 0x3504, 0x3d05, 0x282a, 0xf0ca,
+	0x283f, 0xf0a8, 0xe41e, 0x0ca6, 0xe42d, 0xe166, 0x0905, 0xe167,
+	0x0906, 0x3506, 0x3d07, 0xe41e, 0x1966, 0xf10e, 0xe164, 0x0903,
+	0xe165, 0x0904, 0xe166, 0x0905, 0xe167, 0x0906, 0x3504, 0x3d05,
+	0x3506, 0x3d07, 0xf03e, 0xe41e, 0x19b7, 0x283f, 0x2a42, 0xf0f9,
+	0xf078, 0x2074, 0x4c75, 0x2276, 0x4e77, 0xe066, 0xf0ee, 0x2074,
+	0x4c75, 0xc009, 0x343b, 0x3c3c, 0xc000, 0xf07e, 0x2076, 0x4c77,
+	0xc009, 0x343d, 0x3c3e, 0xc000, 0x3472, 0x3c73, 0xe42e, 0x284f,
+	0x4c7e, 0xe418, 0x19fe, 0x28e5, 0xae02, 0xe000, 0x0578, 0xe092,
+	0x2072, 0x4c73, 0x3511, 0x3d11, 0x28e5, 0xe000, 0x059a, 0xe092,
+	0x2884, 0x3d11, 0x28e5, 0xa002, 0x3ce5, 0x28eb, 0x2a16, 0xa105,
+	0xb616, 0x2a21, 0xb616, 0x3c07, 0xe41e, 0x1f46, 0xf048, 0xe41e,
+	0x1a03, 0xf7be, 0xe41e, 0x1f56, 0xe428, 0xe41e, 0x1a03, 0xf7be,
+	0x28e9, 0xf04a, 0xa102, 0x3ce9, 0xf14e, 0x28e8, 0xf12a, 0x28e7,
+	0xe000, 0x05ab, 0xe092, 0x28e7, 0xa002, 0x3ce7, 0xa122, 0xf028,
+	0x3ce7, 0x28e8, 0xa102, 0x3ce8, 0x2901, 0xe049, 0x1a7f, 0xe425,
+	0xe41e, 0x08d7, 0xe049, 0xa2fa, 0xb7f2, 0xe42e, 0xa202, 0x5817,
+	0xaf02, 0x3c06, 0x284f, 0x2a82, 0xf0b8, 0xf0d9, 0xe164, 0x0906,
+	0x2114, 0x4d14, 0xe166, 0x0908, 0x2316, 0x4f16, 0xf09e, 0xa200,
+	0xa201, 0xf06e, 0xa200, 0xe161, 0x090a, 0x2311, 0x4f11, 0x3400,
+	0x3c01, 0x3602, 0x3e03, 0xe161, 0x0903, 0x2f01, 0x1202, 0x1e03,
+	0xf071, 0xe013, 0x1e06, 0xf085, 0x0c06, 0x0c06, 0xf05e, 0x1e06,
+	0xf037, 0x1c06, 0x1c06, 0x3404, 0x3c05, 0xe161, 0x0903, 0x0d01,
+	0x3474, 0x3c75, 0xe162, 0x0904, 0x0112, 0x0d12, 0x3476, 0x3c77,
+	0x284e, 0xf14a, 0x2074, 0x4c75, 0xe161, 0x090a, 0x3511, 0x3d11,
+	0x2004, 0x4c05, 0xe164, 0x0906, 0x3514, 0x3d14, 0xe161, 0x0903,
+	0xe166, 0x0908, 0x2d01, 0x3516, 0x3d16, 0xe42e, 0xe41e, 0x19c8,
+	0xe160, 0x090b, 0x2900, 0xf34a, 0x2000, 0x4c01, 0x0c39, 0xf306,
+	0x2a4e, 0xe017, 0xe046, 0xa102, 0xf2b4, 0xe160, 0x090b, 0xe188,
+	0x000f, 0x7d00, 0x3402, 0x3c03, 0xe41e, 0x19ee, 0xe163, 0x090b,
+	0x2903, 0xa102, 0xcc44, 0xe161, 0x09e0, 0xa200, 0xe184, 0x1989,
+	0x0111, 0x0d11, 0xae02, 0x3404, 0xe008, 0xffff, 0xaf02, 0x3c05,
+	0x8403, 0x8204, 0xe018, 0xae1e, 0x8205, 0xe01c, 0xe161, 0x09e0,
+	0x8802, 0x0022, 0xe184, 0x199d, 0x0111, 0x0d11, 0xf02e, 0xa200,
+	0x2a4e, 0xf059, 0xe161, 0x0907, 0x0111, 0x0d11, 0xe164, 0x0903,
+	0x0114, 0x0d14, 0x3474, 0x3c75, 0xe162, 0x0909, 0x0112, 0x0d12,
+	0xe166, 0x0905, 0x0116, 0x0d16, 0x3476, 0x3c77, 0xe42e, 0xe41e,
+	0x19c8, 0x284f, 0xe016, 0xf08a, 0x2000, 0x4c01, 0x0c39, 0xae02,
+	0x2a4e, 0xe017, 0xe046, 0x3474, 0x3c75, 0x3476, 0x3c77, 0xe42e,
+	0x2882, 0xf09a, 0xa200, 0xe162, 0x0901, 0x3512, 0x3d12, 0xe161,
+	0x0900, 0x3d01, 0x284f, 0xe016, 0xf0da, 0xe162, 0x0901, 0x2112,
+	0x4d12, 0xe161, 0x0900, 0x2f01, 0x1e39, 0xf047, 0xa203, 0x5a13,
+	0xe042, 0x3400, 0x3c01, 0x2839, 0xe161, 0x0900, 0x3d01, 0x2000,
+	0x4c01, 0xe162, 0x0901, 0x3512, 0x3d12, 0xe42e, 0xe0c0, 0x0041,
+	0xe005, 0x0026, 0xae11, 0xe042, 0xce20, 0xd111, 0x09e0, 0xd112,
+	0x0200, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e, 0x28e5, 0xe426,
+	0xe41e, 0x1a03, 0xf7ce, 0x28e5, 0xe426, 0xe161, 0x0578, 0xe162,
+	0x0578, 0x2111, 0x4d11, 0xa201, 0x3e00, 0xa203, 0x28e5, 0xa104,
+	0xf0e4, 0xcc44, 0xe184, 0x1a1d, 0x2112, 0x4d0a, 0x1111, 0x1d11,
+	0xf056, 0xe082, 0xa104, 0xe094, 0x3e00, 0xa003, 0xe084, 0xa004,
+	0xe092, 0x2800, 0xe000, 0x059a, 0xe098, 0xa002, 0xe096, 0x2904,
+	0x3c01, 0xe41e, 0x1f30, 0x28e5, 0x1800, 0xa104, 0xf0a4, 0xcc44,
+	0xe184, 0x1a37, 0x2911, 0x3d12, 0x2911, 0x3d12, 0x2913, 0x3d14,
+	0x28e5, 0xb5f0, 0x3ce5, 0x28e6, 0xe000, 0x05ab, 0xe092, 0x2801,
+	0x3d01, 0x28e6, 0xa002, 0x3ce6, 0xa122, 0xf028, 0x3ce6, 0x28e8,
+	0xa002, 0x3ce8, 0xe42e, 0xa200, 0x3cb2, 0xe004, 0x0054, 0xe09c,
+	0x287f, 0xa102, 0xcc44, 0xe184, 0x1a64, 0x9e06, 0x5cb2, 0xa802,
+	0xf0a8, 0x28b2, 0xe049, 0xe001, 0x0518, 0xe09f, 0x2b07, 0xa809,
+	0xe419, 0x1f37, 0x2ab2, 0xa003, 0x3eb2, 0xe42e, 0xe004, 0x0518,
+	0xe09e, 0xe004, 0x0054, 0xe09c, 0x287f, 0xa102, 0xcc44, 0xa200,
+	0x3cb2, 0xe184, 0x1a7a, 0x2b17, 0xaf05, 0xa803, 0x5ab2, 0xe056,
+	0x2ab2, 0xa003, 0x3eb2, 0x9f06, 0xe42e, 0x2840, 0xf078, 0xe41e,
+	0x1f72, 0x3c3e, 0xe41e, 0x1fbc, 0xf03e, 0x283e, 0x3c84, 0xe42e,
+	0xe161, 0x0600, 0xa200, 0x3d11, 0x3c02, 0xd022, 0x011f, 0xe184,
+	0x1a95, 0xe41e, 0x1b77, 0x2802, 0xa002, 0x3c02, 0xa200, 0x3c9b,
+	0xe42e, 0xba4e, 0xba40, 0xba40, 0xba40, 0xba40, 0xba46, 0xba4e,
+	0xbc3e, 0xf0dd, 0x3c00, 0x1810, 0xf038, 0xa2fe, 0x3c10, 0x2800,
+	0xe000, 0x0100, 0xe41e, 0x1b08, 0xa202, 0xe42e, 0xe16a, 0xa200,
+	0xe42e, 0xa204, 0x3c9b, 0x2810, 0xe000, 0x0100, 0xe41e, 0x1b43,
+	0xe42a, 0xe41e, 0x1003, 0xf056, 0xe41e, 0x1848, 0xa202, 0xe42e,
+	0xa2fe, 0x3c10, 0xa200, 0xe42e, 0xe41e, 0x0c8c, 0xf12d, 0x3c01,
+	0xe002, 0x00ff, 0xf0e0, 0x2801, 0x1829, 0xf038, 0xa2fe, 0x3c29,
+	0x28ae, 0xa802, 0x3cae, 0x2801, 0xe41e, 0x1b08, 0xa202, 0xe42e,
+	0xe16a, 0xa200, 0xe42e, 0xa202, 0x3c9b, 0x2829, 0xe41e, 0x1b43,
+	0xf0da, 0xe41e, 0x111f, 0x3c65, 0xa200, 0xe41e, 0x0c40, 0xa201,
+	0x3e9b, 0x2865, 0xf03a, 0xa202, 0xe42e, 0xe0c1, 0x0059, 0xa107,
+	0xf079, 0x28ae, 0xa104, 0xf04a, 0x28ae, 0xa902, 0x3cae, 0xa2fe,
+	0x3c29, 0xa200, 0xe42e, 0x2860, 0xa102, 0xf06a, 0x2499, 0x4c9a,
+	0xe41e, 0x1b91, 0xe470, 0xe41e, 0x1baa, 0xe41e, 0x1b98, 0xe470,
+	0x3c02, 0xe41e, 0x1b79, 0xa200, 0x3c06, 0x2802, 0xae14, 0x3404,
+	0x3c05, 0xe41e, 0x0c3b, 0x0404, 0x0c05, 0xce20, 0xd111, 0x0000,
+	0xe41e, 0x0c0e, 0x1806, 0xa00e, 0xaf06, 0xae02, 0xce24, 0xd113,
+	0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa, 0xe41e, 0x0c17, 0xf128,
+	0x2004, 0x4c05, 0xe000, 0x0200, 0x3404, 0x3c05, 0xe41e, 0x0c0e,
+	0x3c06, 0xe41e, 0x09df, 0xe41e, 0x0c0e, 0xe002, 0x0400, 0xf020,
+	0xf59e, 0xe161, 0x0600, 0xa202, 0x3d11, 0xe41e, 0x0c0e, 0x3d01,
+	0xe41e, 0x1b77, 0xe42e, 0x3c02, 0xe41e, 0x1b79, 0xe161, 0x0600,
+	0x2911, 0xe42a, 0x8111, 0x2111, 0x4d11, 0x2802, 0xae14, 0x3404,
+	0x3c05, 0x289b, 0xa102, 0xf0da, 0xe41e, 0x0c3b, 0x0404, 0x0c05,
+	0xe41e, 0x1b91, 0xa204, 0xe41e, 0x0c40, 0xe004, 0x0090, 0xf0ce,
+	0xe41e, 0x0c3b, 0x0404, 0x0c05, 0xe41e, 0x1b98, 0xa202, 0xe41e,
+	0x0c40, 0xe004, 0x0080, 0xcc66, 0xcc6a, 0xcc6e, 0xa01e, 0xcc6c,
+	0xa200, 0xcc60, 0xcc68, 0xcc70, 0xe128, 0xa202, 0xe42e, 0xa204,
+	0xf02e, 0xa206, 0x3c0a, 0xe41e, 0x1b87, 0xce20, 0xd111, 0x0600,
+	0xd112, 0x0004, 0x880a, 0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0,
+	0x0041, 0xe005, 0x002a, 0xae11, 0xe042, 0x2a02, 0xae07, 0xe042,
+	0xe42e, 0xce20, 0xa080, 0x3499, 0x3c9a, 0xd111, 0x0090, 0xf07e,
+	0xce20, 0xa080, 0xe41e, 0x1ba5, 0xd111, 0x0080, 0xd112, 0x0010,
+	0xd113, 0x0013, 0xca28, 0xf7f8, 0xe42e, 0xc009, 0x3410, 0x3c11,
+	0xc000, 0xe42e, 0xc009, 0x2410, 0x4c11, 0xc000, 0xe42e, 0x2819,
+	0xe42a, 0xa102, 0x3c00, 0x284e, 0xe01a, 0x2abe, 0xa003, 0xa803,
+	0xe052, 0xe418, 0x1cd9, 0xe41e, 0x1d0e, 0xe41e, 0x1d42, 0xe41e,
+	0x1d7a, 0xe42e, 0x287e, 0xf11a, 0x2074, 0x4c75, 0x1072, 0x1c73,
+	0x3474, 0x3c75, 0x2076, 0x4c77, 0x1072, 0x1c73, 0x3476, 0x3c77,
+	0xa200, 0x3472, 0x3c73, 0x3c3c, 0xa200, 0x3cbe, 0x2c39, 0x2a4f,
+	0x4e7e, 0xb612, 0x3c80, 0x2819, 0xf12a, 0xa102, 0x3c00, 0x2839,
+	0x3c50, 0x287d, 0xe41a, 0x1c9d, 0x2840, 0xe016, 0xe418, 0x1c6e,
+	0x2840, 0xe408, 0x1c32, 0xe41e, 0x1bf2, 0xe42e, 0x2884, 0xe41e,
+	0x1f29, 0xe42e, 0xc420, 0xe161, 0x0202, 0x8800, 0x0022, 0xe184,
+	0x1bfb, 0x2901, 0xf03a, 0x8131, 0xe42e, 0xe082, 0xe002, 0x0202,
+	0xaf04, 0x3c0a, 0x2841, 0x3d09, 0x287c, 0x3d09, 0x287b, 0x3d31,
+	0x8109, 0x2884, 0x3d11, 0xe082, 0xe000, 0x005c, 0xe094, 0xe002,
+	0x0260, 0xaf02, 0xe000, 0x0240, 0xe092, 0x2072, 0x4c73, 0x3511,
+	0x3d11, 0x2a41, 0xa105, 0x2112, 0x4d0a, 0xf03b, 0x2074, 0x4c75,
+	0x3512, 0x3d12, 0x2112, 0x4d0a, 0xf035, 0x2076, 0x4c77, 0x3512,
+	0x3d12, 0x280a, 0xe000, 0x02a0, 0xe092, 0xa206, 0x1841, 0xe01a,
+	0x3d01, 0xe42e, 0xe161, 0x0200, 0x8800, 0x0022, 0xe184, 0x1c3f,
+	0x2d11, 0x2b11, 0x1c7b, 0x1a7c, 0xf028, 0xf04b, 0x8111, 0x8111,
+	0xe42e, 0xa206, 0x3d01, 0xe082, 0xe000, 0x005e, 0xe094, 0xe002,
+	0x0260, 0xaf02, 0xe000, 0x0240, 0xe092, 0xe002, 0x0240, 0xaf02,
+	0x3c0a, 0x2072, 0x4c73, 0x2311, 0x4f09, 0xe066, 0x3511, 0x3d11,
+	0xf41e, 0xc420, 0xe161, 0x0202, 0x8800, 0x0022, 0xe184, 0x1c62,
+	0x2901, 0xf03a, 0x8131, 0xe42e, 0xa206, 0x3d09, 0xa202, 0x3d09,
+	0x2850, 0x3d31, 0x8109, 0xa2fe, 0x3d11, 0xe42e, 0xa200, 0xc420,
+	0xe161, 0x0202, 0x8800, 0x0022, 0xe184, 0x1c78, 0x2b31, 0xe01b,
+	0xe042, 0x1819, 0xe424, 0xa203, 0xae21, 0xe161, 0x0202, 0x8800,
+	0x0022, 0xe184, 0x1c96, 0x2909, 0xf11a, 0x2909, 0xf0e6, 0x2901,
+	0x1c50, 0xf036, 0x1014, 0x1c15, 0x0c50, 0xe046, 0xf062, 0xe042,
+	0xe049, 0xe082, 0xa004, 0xe094, 0x8111, 0x8111, 0x8131, 0xa200,
+	0x3d12, 0x2912, 0xe412, 0x1f29, 0xe42e, 0xe161, 0x0200, 0xe162,
+	0x02f0, 0x8800, 0x0022, 0xe184, 0x1cd7, 0x283f, 0xf098, 0x2912,
+	0x3c02, 0x2912, 0x3c03, 0xe01a, 0xb670, 0x3c04, 0xf15e, 0x2912,
+	0xaf02, 0x3c02, 0x2912, 0x3c03, 0xe01a, 0x3c04, 0x8112, 0x290a,
+	0xe01a, 0xae02, 0x4c04, 0x3c04, 0xa802, 0xf068, 0x2912, 0xaf02,
+	0x3c02, 0x290a, 0x3c03, 0x2804, 0x8112, 0x8112, 0xf08a, 0x2802,
+	0x3d11, 0x2803, 0x3d11, 0x2804, 0x3d11, 0xf0ae, 0x8111, 0x8111,
+	0x2901, 0xa201, 0x3f11, 0xf04a, 0x2901, 0xe412, 0x1f29, 0x8111,
+	0xe42e, 0x284f, 0xe428, 0x2819, 0xe42a, 0x2840, 0xe428, 0xe41e,
+	0x1f16, 0x4c1a, 0xe42a, 0x2c80, 0x3c50, 0xa200, 0x3c0f, 0x2850,
+	0xa002, 0x2214, 0x4e15, 0xa103, 0xe052, 0x3c50, 0x1c39, 0xe42a,
+	0x281a, 0x4caa, 0xf05a, 0xe41e, 0x1c6e, 0xe41e, 0x1c59, 0x281a,
+	0xf6f8, 0x28ae, 0xa920, 0x3cae, 0x280f, 0xa002, 0x3c0f, 0xa120,
+	0xf062, 0xe41e, 0x05b7, 0xe41e, 0x17cd, 0xf62e, 0xe41e, 0x05b7,
+	0xe41e, 0x19fe, 0x28ae, 0xa908, 0x3cae, 0xe42e, 0xe161, 0x0200,
+	0xe162, 0x02f0, 0x8800, 0x0022, 0xe184, 0x1d36, 0x283f, 0xf0c8,
+	0x2911, 0x3d12, 0x2911, 0x2b11, 0xa107, 0xb612, 0x3d12, 0xa200,
+	0x3d12, 0x3d12, 0xf14e, 0x2911, 0xae02, 0xa002, 0x1842, 0x3d12,
+	0x2911, 0x2b09, 0xa803, 0xb616, 0x3d0a, 0x2912, 0x8112, 0xaa02,
+	0x3d12, 0x2911, 0x2b11, 0xa805, 0xb616, 0x3d12, 0x8111, 0xe161,
+	0x0330, 0xe162, 0x02f0, 0xd022, 0x003f, 0xe184, 0x1d40, 0x2912,
+	0x3d11, 0xe42e, 0x283f, 0xf0d8, 0xe41e, 0x1dbc, 0x2808, 0xe000,
+	0x0370, 0xe096, 0xe41e, 0x1dfe, 0x2808, 0x0809, 0x3c6d, 0xe42e,
+	0xe41e, 0x1dbc, 0xe163, 0x0370, 0x2808, 0xe41e, 0x1ebc, 0x3c08,
+	0xe000, 0x0370, 0xe096, 0xe41e, 0x1dfe, 0x2808, 0xe000, 0x0370,
+	0xe096, 0x2809, 0xe41e, 0x1ebc, 0x0808, 0x3c6d, 0x1842, 0xe400,
+	0x1d79, 0x28ae, 0xa820, 0xe40a, 0x1d79, 0xe163, 0x0370, 0x2842,
+	0xf05a, 0xa23e, 0x3d13, 0xa200, 0x3d13, 0xa23e, 0x3d13, 0xa23c,
+	0x3d13, 0xe42e, 0x283f, 0xf158, 0xe41e, 0x1e37, 0x2808, 0xe000,
+	0x0390, 0xe096, 0xe41e, 0x1dfe, 0x2808, 0xe000, 0x03b0, 0xe096,
+	0xe41e, 0x1dfe, 0x2808, 0x0809, 0x3c6d, 0xe41e, 0x1eff, 0xe42e,
+	0xe41e, 0x1e37, 0xe163, 0x0390, 0x2808, 0xe41e, 0x1ebc, 0xe163,
+	0x03b0, 0x2808, 0xe41e, 0x1ebc, 0x3c08, 0x2808, 0xe000, 0x0390,
+	0xe096, 0xe41e, 0x1dfe, 0x2808, 0xe000, 0x0390, 0xe096, 0x2809,
+	0xe41e, 0x1ebc, 0x2808, 0xe000, 0x03b0, 0xe096, 0xe41e, 0x1dfe,
+	0x2808, 0xe000, 0x03b0, 0xe096, 0x2809, 0xe41e, 0x1ebc, 0x0808,
+	0x3c6d, 0xe41e, 0x1eff, 0xe42e, 0xe161, 0x0600, 0xa200, 0xc70f,
+	0x3d11, 0x283f, 0xb674, 0x3c05, 0xa200, 0x3c08, 0xc420, 0xe163,
+	0x0370, 0xa2fe, 0x3c06, 0xa203, 0xae21, 0xe013, 0xe161, 0x0202,
+	0xe162, 0x0600, 0x8800, 0x0022, 0xe184, 0x1ded, 0x2912, 0xf168,
+	0x2909, 0x1805, 0xf124, 0x2909, 0xf0f6, 0x2901, 0x1c39, 0xf036,
+	0x1014, 0x1c15, 0x0c39, 0xe046, 0xf076, 0xe042, 0xe049, 0xe084,
+	0xe002, 0x0601, 0x3c06, 0x8111, 0x8111, 0x8131, 0x2806, 0xe424,
+	0xe000, 0x0600, 0xe094, 0xa202, 0x3d02, 0x2806, 0xae02, 0x3d13,
+	0x2808, 0xa002, 0x3c08, 0x1819, 0xf4d8, 0xe42e, 0xe161, 0x0600,
+	0xa200, 0xc70f, 0x3d11, 0x283f, 0xb674, 0x3c05, 0xa200, 0x3c09,
+	0xc420, 0xa2fe, 0x3c07, 0xa221, 0xe161, 0x0202, 0xe162, 0x0600,
+	0x8800, 0x0022, 0xe184, 0x1e26, 0x2912, 0xf118, 0x2909, 0x1805,
+	0xf0d4, 0x2909, 0xf0a2, 0x2901, 0xe046, 0xf072, 0xe042, 0xe049,
+	0xe084, 0xe002, 0x0601, 0x3c07, 0x8111, 0x8111, 0x8131, 0x2807,
+	0xe424, 0xe000, 0x0600, 0xe094, 0xa202, 0x3d02, 0x2807, 0xae02,
+	0x3d13, 0x2809, 0xa002, 0x3c09, 0x1819, 0xf548, 0xe42e, 0xe161,
+	0x0600, 0xa200, 0xc70f, 0x3d11, 0x283f, 0xb674, 0x3c05, 0xa200,
+	0x3c0a, 0xc420, 0xe163, 0x0390, 0xe164, 0x03b0, 0xa2fe, 0x3c06,
+	0x3c07, 0xe161, 0x0202, 0xe162, 0x0600, 0xe165, 0x0240, 0x8800,
+	0x0022, 0xe184, 0x1e82, 0x2912, 0xf2c8, 0x2909, 0x1805, 0xf284,
+	0x2909, 0xf256, 0x2115, 0x4d0d, 0x1072, 0x1c73, 0xf110, 0x2806,
+	0xf064, 0x2115, 0x4d0d, 0x100c, 0x1c0d, 0xf196, 0x2115, 0x4d0d,
+	0x340c, 0x3c0d, 0xe084, 0xe002, 0x0601, 0x3c06, 0xf10e, 0x2807,
+	0xf064, 0x2115, 0x4d0d, 0x100e, 0x1c0f, 0xf092, 0x2115, 0x4d0d,
+	0x340e, 0x3c0f, 0xe084, 0xe002, 0x0601, 0x3c07, 0x8111, 0x8111,
+	0x8131, 0x8115, 0x8115, 0x2806, 0xf094, 0xe000, 0x0600, 0xe094,
+	0xa202, 0x3d02, 0x2806, 0xae02, 0x3d13, 0x2807, 0xf094, 0xe000,
+	0x0600, 0xe094, 0xa202, 0x3d02, 0x2807, 0xae02, 0x3d14, 0x280a,
+	0xa002, 0x3c0a, 0x1819, 0xe408, 0x1e46, 0xe086, 0xe002, 0x0390,
+	0x3c0c, 0xe088, 0xe002, 0x03b0, 0x3c0d, 0xf09a, 0xa102, 0xcc44,
+	0xe164, 0x03b0, 0xe184, 0x1ead, 0x2914, 0x3d13, 0x280c, 0xf09a,
+	0xa102, 0xcc44, 0xe163, 0x0390, 0xe184, 0x1eb7, 0x2913, 0x3d14,
+	0x280c, 0x080d, 0x3c08, 0xe42e, 0xe42a, 0xa102, 0x3c0c, 0xe086,
+	0xe098, 0xe161, 0x0600, 0x880c, 0x0022, 0xe184, 0x1ed7, 0x2903,
+	0xae02, 0xe000, 0x0202, 0xe094, 0x2902, 0xa802, 0xf03a, 0x2903,
+	0x3d11, 0x2902, 0xa804, 0xf04a, 0x2903, 0xa002, 0x3d11, 0x8113,
+	0xe082, 0xe002, 0x0600, 0xe42a, 0xa102, 0x3c0c, 0x3c0d, 0x2842,
+	0x3c0e, 0xe161, 0x0600, 0x880c, 0x0022, 0xe184, 0x1eec, 0x2901,
+	0xf044, 0xa802, 0x180e, 0xf06a, 0x8111, 0x280e, 0xe016, 0x3c0e,
+	0xf71e, 0x2901, 0x3d14, 0xa2fe, 0x3d01, 0x280e, 0xe016, 0x3c0e,
+	0x280d, 0xa102, 0x3c0d, 0xf662, 0x280c, 0xa002, 0xe42e, 0x286d,
+	0xa102, 0xe426, 0xcc44, 0xe163, 0x0390, 0xe164, 0x03b0, 0xe184,
+	0x1f0c, 0x2913, 0x1914, 0xe428, 0xe190, 0xe163, 0x0391, 0xe164,
+	0x03b0, 0x290b, 0x3d14, 0x2903, 0x3d14, 0xe42e, 0x2819, 0xe426,
+	0xa102, 0xcc44, 0xc420, 0xe161, 0x0202, 0xe184, 0x1f21, 0x2901,
+	0xe428, 0x8131, 0xe42e, 0xe161, 0x0518, 0xa200, 0xc71f, 0x3d11,
+	0xe42e, 0xe000, 0x0518, 0xe09e, 0x2907, 0xa80c, 0x3d07, 0xe42e,
+	0xe000, 0x0518, 0xe09e, 0x2907, 0xa80a, 0x3d07, 0xe42e, 0x3c81,
+	0xe000, 0x0518, 0xe09e, 0x2907, 0xa806, 0x3d07, 0x2881, 0xa002,
+	0x3c81, 0x187f, 0xe428, 0xa200, 0x3c81, 0xe42e, 0xe161, 0x0518,
+	0x287f, 0xa102, 0xcc44, 0xa201, 0xe184, 0x1f51, 0x2911, 0xa804,
+	0xe01a, 0xe041, 0x1a07, 0xa202, 0xb602, 0xe42e, 0xe161, 0x0518,
+	0x287f, 0xa102, 0xcc44, 0xa200, 0xe184, 0x1f61, 0x2b11, 0xa807,
+	0xe01b, 0xe042, 0x18eb, 0xa102, 0xe01a, 0xe42e, 0xe161, 0x0518,
+	0x287f, 0xa102, 0xcc44, 0xe184, 0x1f70, 0x2911, 0xe016, 0xe428,
+	0xe190, 0xe42e, 0x2881, 0x3c00, 0x2800, 0xe000, 0x0518, 0xe092,
+	0x2901, 0xf10a, 0x2800, 0xa002, 0x3c00, 0x187f, 0xf038, 0xa200,
+	0x3c00, 0x2800, 0x1881, 0xf718, 0xa200, 0x3c81, 0xa2fe, 0x3c84,
+	0xe42e, 0xa20e, 0x3d01, 0x2800, 0x3c84, 0xe42e, 0xe424, 0xc009,
+	0x3c32, 0xc000, 0x2841, 0xc009, 0xa804, 0xe01a, 0x5832, 0xe014,
+	0x2230, 0x4e31, 0xe051, 0x3630, 0x3e31, 0xc000, 0x2841, 0xc009,
+	0xa802, 0x5832, 0xe014, 0x222e, 0x4e2f, 0xe051, 0x362e, 0x3e2f,
+	0xc000, 0xe42e, 0xc009, 0x3c32, 0xa200, 0x2a32, 0xf0c5, 0x222e,
+	0x4e2f, 0x5e32, 0xa803, 0xe056, 0x2230, 0x4e31, 0x5e32, 0xa803,
+	0xae03, 0xe056, 0xc000, 0xe42e, 0xe424, 0xc009, 0x3c32, 0xa202,
+	0x5832, 0x2230, 0x4e31, 0xe055, 0x3630, 0x3e31, 0x222e, 0x4e2f,
+	0xe055, 0x362e, 0x3e2f, 0xc000, 0xe42e, 0xe0c1, 0x0044, 0xa80f,
+	0xe056, 0xe42e, 0xa200, 0xe41e, 0x1fcd, 0xe42e, 0xe0c1, 0x0044,
+	0xaf0d, 0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044,
+	0xaf17, 0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105,
+	0xf039, 0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d,
+	0xe0c1, 0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0640,
+	0xe167, 0x0500, 0x287f, 0xf166, 0xa102, 0xcc44, 0xe184, 0x2010,
+	0xa200, 0xe41e, 0x1fcd, 0xaf04, 0xe41e, 0x1fd6, 0xae20, 0x2e66,
+	0xe056, 0x9f17, 0x2057, 0x4c58, 0xae08, 0x9f17, 0xe41e, 0x2016,
+	0xe190, 0xe190, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2116, 0x4d16,
+	0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0xe42e,
+	0xe0c0, 0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa860,
+	0xe42a, 0xe0c0, 0x0061, 0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4,
+	0xc785, 0xe018, 0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803,
+	0xf7db, 0xa200, 0xe41e, 0x1fd2, 0xa80e, 0xaf04, 0xe41e, 0x1fd6,
+	0xe41e, 0x1fde, 0xe40b, 0x2049, 0xa81e, 0xe41e, 0x1fe3, 0xae09,
+	0xe056, 0xae20, 0xe0c1, 0x006e, 0xe009, 0x1fff, 0xe056, 0x9f17,
+	0xe0c0, 0x0060, 0xa822, 0xa122, 0xf04a, 0x2057, 0x4c58, 0xf03e,
+	0x2058, 0x4c57, 0xae08, 0x9f17, 0xe0c0, 0x0062, 0x9f17, 0xe0c0,
+	0x0063, 0x9f17, 0xe0c0, 0x0064, 0x9f17, 0xa201, 0xe0c3, 0x040d,
+	0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11, 0xe042,
+	0xce20, 0xd111, 0x0640, 0xd112, 0x00c0, 0x88ec, 0x0113, 0xca29,
+	0xf7f9, 0xe190, 0xe42e, 0xa2fe, 0x3c89, 0xa200, 0x3c88, 0xe42e,
+	0x2856, 0x3c89, 0x2889, 0xf032, 0xa200, 0x3c88, 0xa200, 0x3c8d,
+	0x3c8e, 0x2857, 0x3c8b, 0x2858, 0x3c8c, 0x2888, 0xe42a, 0x2889,
+	0xe424, 0x2889, 0xe0c2, 0x0143, 0x288a, 0xe0c2, 0x0144, 0xa200,
+	0xe0c2, 0x017f, 0xe0c2, 0x0149, 0xe41e, 0x1fcd, 0xe0c2, 0x017f,
+	0x288b, 0xa102, 0xae20, 0x4c8c, 0xa102, 0xe0c2, 0x0142, 0xa200,
+	0xae20, 0x2a87, 0xe042, 0xe0c2, 0x014e, 0xe42e, 0x2889, 0x2a8e,
+	0x1a8c, 0xe423, 0x288d, 0xae0e, 0x4c8e, 0xa203, 0xb615, 0x3e8f,
+	0x2a8f, 0xae03, 0xa903, 0xae1d, 0xe056, 0xe0c1, 0x014b, 0xf7e9,
+	0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0x2a8d, 0xa003, 0x3e8d,
+	0x1a8b, 0xf065, 0x2a8e, 0xa003, 0x3e8e, 0xa201, 0x3e8d, 0xe42e,
+	0x2888, 0xf15a, 0x288e, 0x188c, 0xf042, 0xe41e, 0x20ae, 0xf7be,
+	0xe0c0, 0x014b, 0xf7e8, 0xa204, 0xae1c, 0xe0c2, 0x014d, 0xa202,
+	0xe0c2, 0x014a, 0xe190, 0xe0c0, 0x014b, 0xf7e8, 0x2885, 0x3c89,
+	0xe42e, 0xe41e, 0x21c9, 0xe41e, 0x2267, 0xe41e, 0x0f47, 0xe41e,
+	0x2173, 0xe41e, 0x24b1, 0xa200, 0x3c59, 0x3c52, 0xe41e, 0x2368,
+	0x2c59, 0x1c44, 0xe402, 0x216e, 0xe41e, 0x0b72, 0xf12a, 0xa102,
+	0xf15a, 0xa108, 0xf0e4, 0xf12a, 0xa10a, 0xe40a, 0x215d, 0xa102,
+	0xe40a, 0x215d, 0xa102, 0xe40a, 0x214f, 0xa10e, 0xe404, 0x2162,
+	0xe41e, 0x0951, 0xf6ae, 0x2c44, 0x3c52, 0xe41e, 0x098a, 0x284e,
+	0xe01a, 0x2a92, 0xe01b, 0xe05a, 0xe408, 0x2162, 0x284f, 0x1893,
+	0xe408, 0x2162, 0xe41e, 0x0bc5, 0xe41e, 0x22e7, 0xf56a, 0x2894,
+	0xf07a, 0x2c44, 0x3c0d, 0xe41e, 0x23af, 0xe40e, 0x216a, 0xe41e,
+	0x0be2, 0x284e, 0x3c92, 0x284f, 0x3c93, 0xe41e, 0x0d68, 0xe40a,
+	0x20fc, 0xa201, 0x3e94, 0x2c52, 0x3c0d, 0x1c59, 0xe404, 0x20fc,
+	0xe410, 0x23af, 0x2c52, 0x1c44, 0xe402, 0x216e, 0xe41e, 0x05d4,
+	0xf05a, 0xe41e, 0x05f3, 0xe40e, 0x216e, 0xe40e, 0x20f6, 0xe41e,
+	0x098a, 0xba0e, 0xe002, 0x00ff, 0xf058, 0xba4e, 0xe41e, 0x0b96,
+	0xf798, 0xe41e, 0x0cd5, 0xe40e, 0x20fc, 0xe41e, 0x08bd, 0xf03a,
+	0xe41e, 0x01db, 0x2c59, 0x1c44, 0xe402, 0x216a, 0x2c44, 0x3c0d,
+	0xe41e, 0x23af, 0x2892, 0x3c4e, 0x2893, 0x3c4f, 0xe41e, 0x2575,
+	0xcbcc, 0xf7f8, 0xe42e, 0x2822, 0xae02, 0x4c37, 0xae0a, 0x2a36,
+	0xa83f, 0xe056, 0xae0a, 0x2a32, 0xa83f, 0xe056, 0xae02, 0x4c1d,
+	0xae02, 0x4c2d, 0xae02, 0x4c43, 0xcf80, 0x284e, 0xe01a, 0xae02,
+	0x4c1b, 0xae02, 0x4c1d, 0xae02, 0x4c43, 0xcfc2, 0x2857, 0xa102,
+	0xae02, 0x4c34, 0xae02, 0x4c3f, 0xae02, 0x4c42, 0xae02, 0x4c43,
+	0xcf00, 0xd1d3, 0x000b, 0xd185, 0x0001, 0x246e, 0x4c6f, 0xcfc6,
+	0xd1e5, 0x0001, 0xc420, 0xe161, 0x0201, 0xa200, 0xd022, 0x000f,
+	0xe184, 0x21ac, 0x2b31, 0xae02, 0xb42a, 0xcfe8, 0x2072, 0x4c73,
+	0xcfea, 0x2074, 0x4c75, 0xcfec, 0x2076, 0x4c77, 0xcfee, 0xe004,
+	0x0060, 0xcbcf, 0xa803, 0xf03b, 0xe004, 0x0070, 0xce30, 0xe161,
+	0x0260, 0xd022, 0x001f, 0xe184, 0x21c7, 0x2111, 0x4d11, 0xce32,
+	0xe42e, 0xa200, 0xe161, 0x07f6, 0xc707, 0x3d11, 0x2867, 0x4c68,
+	0xf028, 0xe42e, 0xe161, 0x07f6, 0xa20e, 0x3c00, 0x2867, 0xf39a,
+	0x2869, 0x5c00, 0xa802, 0xf108, 0x2a00, 0xa10f, 0xf049, 0xa202,
+	0x3d11, 0xf17e, 0x2a00, 0xa109, 0xf049, 0xa204, 0x3d11, 0xf11e,
+	0xa20a, 0x3d11, 0xf0ee, 0x286b, 0x5c00, 0xa802, 0xf08a, 0x2800,
+	0xa10a, 0xa205, 0xf024, 0xa203, 0x3f11, 0xf03e, 0xa206, 0x3d11,
+	0x2800, 0xa102, 0x3c00, 0xa102, 0xf5c8, 0x2869, 0xe00c, 0x00ff,
+	0x2a6b, 0xe056, 0x5c00, 0xa802, 0xf06a, 0xa203, 0x2800, 0xb655,
+	0x3f11, 0xf03e, 0xa206, 0x3d11, 0x2800, 0xa102, 0x3c00, 0xf6ea,
+	0xe161, 0x07f6, 0xa20e, 0x3c00, 0x2868, 0xe42a, 0x286a, 0x5c00,
+	0xa802, 0xf188, 0x2800, 0xa10e, 0xf088, 0x2a67, 0xf03b, 0x8111,
+	0xf1e9, 0xa202, 0x3d11, 0xf1be, 0x2a00, 0xa109, 0xf089, 0x2a67,
+	0xf03b, 0x8111, 0xf149, 0xa204, 0x3d11, 0xf11e, 0xa20a, 0x3d11,
+	0xf0ee, 0x286c, 0x5c00, 0xa802, 0xf08a, 0x2800, 0xa10a, 0xa205,
+	0xf024, 0xa203, 0x3f11, 0xf03e, 0xa208, 0x3d11, 0x2800, 0xa102,
+	0x3c00, 0xa102, 0xf548, 0x286a, 0x5c00, 0x4c67, 0xa802, 0xf068,
+	0xa203, 0x2800, 0xb655, 0x3f11, 0xf16e, 0x286c, 0xe00c, 0x00ff,
+	0x2a6a, 0xe052, 0x5c00, 0xa802, 0xf0c8, 0x286a, 0x5c00, 0xa802,
+	0xf06a, 0xa203, 0x2800, 0xb655, 0x3f11, 0xf05e, 0x8111, 0xf03e,
+	0xa208, 0x3d11, 0x2800, 0xa102, 0x3c00, 0xf5ea, 0xe42e, 0xa202,
+	0xe0c2, 0x013c, 0xa200, 0x3c00, 0x3c01, 0xe161, 0x07f6, 0xe162,
+	0x04c8, 0x2911, 0xa104, 0xf066, 0xa106, 0xe40a, 0x22b1, 0xa004,
+	0xf112, 0xa004, 0xae06, 0x3c04, 0x2800, 0xa10c, 0xf064, 0x2804,
+	0xae04, 0xe000, 0x0018, 0x3c04, 0xe004, 0x0450, 0x0804, 0x3c04,
+	0xf29e, 0xa201, 0x3e02, 0xa211, 0x3e03, 0xf04a, 0xe005, 0x00e0,
+	0x3e02, 0x2800, 0x2a00, 0xae09, 0xa10c, 0xf05a, 0xa102, 0xf058,
+	0xe005, 0x00a0, 0xa240, 0x3c03, 0x0a02, 0x3e02, 0xe0c0, 0x0041,
+	0xe005, 0x0034, 0xae11, 0xe042, 0x0802, 0xce20, 0xd111, 0x0600,
+	0x2803, 0xce24, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe004, 0x0600,
+	0x3c04, 0x2800, 0xa10c, 0xa20f, 0xf024, 0xa23f, 0xcc45, 0x2804,
+	0xe096, 0xe184, 0x22cb, 0x2912, 0x0801, 0xe0c2, 0x013e, 0x2b03,
+	0xaf11, 0xe0c3, 0x013f, 0x2912, 0x0801, 0xe0c2, 0x013e, 0x2b13,
+	0xe009, 0x00ff, 0xe0c3, 0x013f, 0xe162, 0x04c8, 0x2a01, 0xe001,
+	0x0010, 0x3e01, 0x2800, 0xa002, 0x3c00, 0xa10c, 0xe404, 0x2271,
+	0xe162, 0x04d8, 0xe40a, 0x2271, 0xe001, 0x0030, 0x3e01, 0xa104,
+	0xe408, 0x2271, 0xe16a, 0xa200, 0xe0c2, 0x013c, 0xe42e, 0xa200,
+	0x3c94, 0xe41e, 0x0c8c, 0xe40d, 0x2365, 0x2a43, 0xe419, 0x0e70,
+	0x1c44, 0xe402, 0x2365, 0xbc12, 0xe40d, 0x2365, 0xa10a, 0xb4a8,
+	0xa104, 0xe400, 0x2365, 0xbdfe, 0xe40d, 0x2365, 0x1829, 0xf03a,
+	0xa202, 0x3c94, 0x7413, 0x1839, 0xf03a, 0xa202, 0x3c94, 0x281b,
+	0xf0d8, 0xba40, 0x183f, 0xf03a, 0xa202, 0x3c94, 0x283f, 0xf06a,
+	0xba40, 0x1842, 0xf03a, 0xa202, 0x3c94, 0x284f, 0xf09a, 0xe41e,
+	0x0c8c, 0xe40d, 0x2365, 0x1c45, 0xf03a, 0xa202, 0x3c94, 0x2816,
+	0xa102, 0xf034, 0xf1da, 0xf3ae, 0x7417, 0xe160, 0x0903, 0x1d00,
+	0xf03a, 0xa202, 0x3c94, 0x283f, 0xe016, 0x442a, 0xf2fa, 0xe41e,
+	0x0ca6, 0xf34d, 0xe161, 0x0904, 0xe162, 0x0905, 0x1101, 0x1d02,
+	0xf03a, 0xa202, 0x3c94, 0xf22e, 0xe418, 0x0ca6, 0xf1fe, 0x2818,
+	0xf1d8, 0xe41e, 0x0ca6, 0xf22d, 0xe163, 0x0903, 0xe164, 0x0904,
+	0x1103, 0x1d04, 0xf03a, 0xa202, 0x3c94, 0x283f, 0xe016, 0x442a,
+	0xf0da, 0xe41e, 0x0ca6, 0xf12d, 0xe165, 0x0905, 0xe166, 0x0906,
+	0x1105, 0x1d06, 0xf03a, 0xa202, 0x3c94, 0xe41e, 0x0c0e, 0xae06,
+	0xc873, 0xe046, 0xf034, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0xa200, 0xe41e, 0x0c1b, 0xe41e, 0x0c17, 0xf0c8, 0xa202, 0xe41e,
+	0x08df, 0xe41e, 0x0c1b, 0xe41e, 0x08e7, 0xd036, 0x00ff, 0xd037,
+	0x0080, 0xe16a, 0x2c52, 0x3c59, 0xa200, 0x3c0c, 0xe41e, 0x23c6,
+	0x282d, 0xf138, 0x2c59, 0x1c44, 0xf0d2, 0xe41e, 0x240d, 0xf1ed,
+	0x2843, 0xe418, 0x240d, 0xf1ad, 0xcb86, 0xa102, 0xf740, 0xc894,
+	0xf728, 0xe41e, 0x0cd5, 0xe42e, 0xe41e, 0x23f9, 0x2c59, 0x1c44,
+	0xf0a2, 0xe41e, 0x240d, 0xf0ad, 0x2843, 0xe418, 0x240d, 0xf06d,
+	0xbb60, 0xf75a, 0xe41e, 0x0cd7, 0xe42e, 0xe16a, 0xe41e, 0x0b72,
+	0xa116, 0xe428, 0xe41e, 0x08bd, 0xe418, 0x01db, 0xe42e, 0x284f,
+	0xe016, 0x3c38, 0xa202, 0x3c0c, 0xe41e, 0x23c6, 0xa200, 0x3c0c,
+	0x2c59, 0x180d, 0xf0b2, 0xe41e, 0x244d, 0x2843, 0xe418, 0x244d,
+	0x2c53, 0xa002, 0x0843, 0x3c53, 0xf74e, 0xe42e, 0x2832, 0x1836,
+	0xe01a, 0xae04, 0x4c4b, 0xae0a, 0x4c4c, 0xae0a, 0x4c4d, 0xcf30,
+	0x2849, 0xae0a, 0x4c48, 0xae04, 0x4c38, 0xcf82, 0xd1c3, 0x0000,
+	0x284a, 0xcf96, 0x2849, 0xae08, 0x4c48, 0xae02, 0x4c7a, 0xae02,
+	0x4c79, 0xae02, 0x4c78, 0xae02, 0x4c46, 0xae04, 0x4c38, 0xcfc4,
+	0x885e, 0x01fa, 0x2470, 0x4c71, 0xcfc8, 0x280c, 0xf03a, 0x2838,
+	0xf03a, 0xd188, 0x0001, 0x2838, 0xa104, 0xe428, 0xd1e5, 0x0002,
+	0xe42e, 0xc868, 0xa80e, 0x3c9e, 0x749e, 0xe004, 0x01fe, 0xcc86,
+	0xba50, 0xcc88, 0x2838, 0xe01a, 0x0847, 0xae0c, 0x4c4a, 0xcc82,
+	0xd040, 0x0003, 0xc884, 0xf7f8, 0xe42e, 0xd185, 0x0002, 0xd1d0,
+	0x003f, 0xe190, 0xe180, 0xe41e, 0x0c1f, 0xe418, 0x0c7f, 0xe181,
+	0xcba0, 0xa810, 0xcba3, 0xe409, 0x2443, 0xf7b8, 0xe41e, 0x252d,
+	0xcbe0, 0xf7f8, 0x285a, 0xe41a, 0x2554, 0xcba0, 0xcba3, 0xe409,
+	0x2443, 0xf7c8, 0xd186, 0x0001, 0xd185, 0x0004, 0xe41e, 0x256b,
+	0xcb06, 0x3c59, 0xcb8a, 0xaf04, 0x442d, 0xf08a, 0xe004, 0x01fe,
+	0xcc86, 0xba50, 0xcc88, 0xd040, 0x0001, 0xe41e, 0x0c0e, 0xae06,
+	0xc873, 0xe046, 0xe422, 0xd1d0, 0x0000, 0xd1d1, 0x0000, 0xcb1c,
+	0xf7f8, 0xcbe0, 0xf7f8, 0xe16b, 0xe42e, 0xd185, 0x0002, 0xd186,
+	0x0000, 0xd1c2, 0x0001, 0xd1c5, 0x0000, 0xd1c4, 0x0000, 0xd1d0,
+	0x000e, 0xcba0, 0xf7f8, 0x2054, 0x4c55, 0xf098, 0xd1c2, 0x0000,
+	0xd1c5, 0x0003, 0xd1c4, 0x0003, 0xd1c8, 0x0000, 0xd1d0, 0x0020,
+	0xe41e, 0x252d, 0xa200, 0xe0c2, 0x012a, 0xcbe0, 0xf7f8, 0x285a,
+	0xe41a, 0x2554, 0xcba0, 0xf7f8, 0xd186, 0x0001, 0xd185, 0x0004,
+	0xe41e, 0x256b, 0xcb06, 0x3c59, 0xe42e, 0xa200, 0xe0c2, 0x0100,
+	0xe0c2, 0x013d, 0xe0c2, 0x0128, 0xcc8e, 0x2a88, 0xb692, 0xae08,
+	0xa91c, 0xe0c2, 0x017c, 0xa218, 0xe0c2, 0x017d, 0xa200, 0xe41e,
+	0x1fcd, 0x2a22, 0xe017, 0xae09, 0xe056, 0xa203, 0xae11, 0xe056,
+	0xe0c2, 0x0213, 0xa200, 0xe0c2, 0x0215, 0xa202, 0xe0c2, 0x0210,
+	0x2057, 0x4c58, 0xae08, 0xe0c2, 0x0101, 0xe0c2, 0x0205, 0xa200,
+	0xe41e, 0x1fcd, 0x2a22, 0xe017, 0xae07, 0xe056, 0xe0c2, 0x0102,
+	0xe42e, 0xe0c0, 0x0050, 0xe049, 0xe008, 0x007f, 0x3c08, 0xaf11,
+	0xe009, 0x007f, 0x3e09, 0x4608, 0x3e08, 0xa200, 0x2a08, 0xa803,
+	0xf03b, 0xe00a, 0x0002, 0x2a08, 0xa805, 0xf02b, 0xa912, 0x2a08,
+	0xa809, 0xf02b, 0xa940, 0x2a08, 0xa811, 0xf02b, 0xa980, 0xe0c2,
+	0x040c, 0xe0c1, 0x0046, 0xe004, 0x0002, 0xae10, 0xe042, 0x2a09,
+	0xa803, 0xf05b, 0xe161, 0x05cb, 0x2111, 0x4d11, 0xcf0e, 0xe0c1,
+	0x0046, 0xe004, 0x004a, 0xae10, 0xe042, 0x2a09, 0xa805, 0xf05b,
+	0xe161, 0x05cd, 0x2111, 0x4d11, 0xe0c2, 0x0103, 0xe0c1, 0x0046,
+	0xe004, 0x007a, 0xae10, 0xe042, 0x2a09, 0xa809, 0xf05b, 0xe161,
+	0x05cf, 0x2111, 0x4d11, 0xe0c2, 0x0211, 0xe0c1, 0x0046, 0xe004,
+	0x007a, 0xe000, 0x0040, 0xae10, 0xe042, 0x2a09, 0xa811, 0xf05b,
+	0xe161, 0x05d1, 0x2111, 0x4d11, 0xe0c2, 0x0212, 0x2843, 0xae02,
+	0x4c3f, 0xae02, 0x4c42, 0xe0c2, 0x0104, 0xe0c2, 0x0204, 0xa200,
+	0xe0c2, 0x0208, 0xe41e, 0x2579, 0xa20e, 0xe0c2, 0x0312, 0xe0c0,
+	0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a, 0x25a1, 0xe41e,
+	0x0274, 0xa202, 0xe0c2, 0x0106, 0xe42e, 0xcb02, 0xaf02, 0xe0c2,
+	0x0113, 0xe0c2, 0x030d, 0xcb15, 0xae03, 0xe056, 0xe0c2, 0x022b,
+	0xcb94, 0xe0c2, 0x0115, 0xcba4, 0xe0c2, 0x012a, 0xcb8a, 0xe0c2,
+	0x0114, 0xa802, 0x3c5a, 0xe42a, 0xcb14, 0xae0a, 0xcb19, 0xe056,
+	0xe0c2, 0x0120, 0xcb8c, 0xe0c2, 0x0121, 0xcb8e, 0xe0c2, 0x0122,
+	0xcb90, 0xe0c2, 0x0123, 0xe42e, 0xcbd0, 0xe0c2, 0x030c, 0xcbd2,
+	0xe0c2, 0x0309, 0xcbd8, 0xe0c2, 0x030a, 0xcbda, 0xe0c2, 0x030b,
+	0x285e, 0xe0c2, 0x0320, 0xe42a, 0x285f, 0xe0c2, 0x0321, 0xcbf6,
+	0xe0c2, 0x0322, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2,
+	0x0110, 0x2888, 0xe418, 0x20ae, 0xe42e, 0xe0c0, 0x0111, 0xf7e8,
+	0xe42e, 0xa202, 0xe0c2, 0x0302, 0xd022, 0x000f, 0xe163, 0x0380,
+	0x2883, 0xb608, 0xe184, 0x2587, 0x9f03, 0x8113, 0x8113, 0x8113,
+	0x2819, 0xf14a, 0xa102, 0xcc44, 0xe160, 0x0004, 0xe161, 0x0203,
+	0xe163, 0x0380, 0xe184, 0x259b, 0x2931, 0xf022, 0x2883, 0xb608,
+	0x9f03, 0x8113, 0x8113, 0x8113, 0xe190, 0xa200, 0xe0c2, 0x0302,
+	0xe42e, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17,
+	0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101,
+	0xe0c3, 0x015d, 0xe162, 0x02b0, 0x2912, 0xaf02, 0x3c0a, 0x2912,
+	0xaf02, 0x3c0b, 0x2838, 0xa104, 0xf068, 0xe162, 0x02d0, 0x2912,
+	0xaf02, 0x3c0b, 0x280a, 0x180b, 0xf0d8, 0xe162, 0x02b0, 0xd022,
+	0x001f, 0xe184, 0x25d0, 0x2912, 0xaf02, 0x3c0b, 0x180a, 0xf028,
+	0xe190, 0x280b, 0xae02, 0xe41e, 0x0f8a, 0xe049, 0xae11, 0x280a,
+	0xae02, 0xe41e, 0x0f8a, 0xe055, 0xae21, 0xe167, 0x01a2, 0x2907,
+	0xaf10, 0xe008, 0x001f, 0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2,
+	0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0,
+	0x0151, 0xf7e8, 0xe42e, 0xf044, 0xe41e, 0x1faa, 0xe42e, 0xa200,
+	0xe42e, 0xe165, 0x07e8, 0x284f, 0x3d15, 0x284e, 0x3d15, 0x2838,
+	0x3d15, 0x287e, 0x3d15, 0xe42e, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c1e, 0xf0b4, 0xe04a, 0xaf10,
+	0x1857, 0xf074, 0xe009, 0x00ff, 0x1a58, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0c35, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x036a, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0370,
+	0xe40e, 0x0374, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0398, 0xe40e, 0x00a4,
+	0xe41e, 0x03b9, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x0378,
+	0xe41e, 0x0eb9, 0xe41e, 0x045c, 0xe41e, 0x0eb8, 0xe41e, 0x02ad,
+	0xe40e, 0x00a4, 0xe41e, 0x0378, 0xe41e, 0x0535, 0xe40e, 0x00a4,
+	0xe41e, 0x053a, 0xe40e, 0x00a4, 0xe41e, 0x056b, 0xe40e, 0x00a4,
+	0x2811, 0xa184, 0x2a24, 0xa805, 0xe056, 0xe42a, 0xe0c0, 0x0040,
+	0xa201, 0xae17, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe167, 0x05cb, 0xe166, 0x0064,
+	0xd022, 0x0003, 0xe184, 0x0396, 0x9e16, 0x3517, 0x3d17, 0xe42e,
+	0xa200, 0x3c86, 0x3cad, 0x3cbe, 0xe41e, 0x042d, 0xe41e, 0x0558,
+	0xe41e, 0x0672, 0xe41e, 0x08d6, 0xe41e, 0x03ba, 0xf0dd, 0xe41e,
+	0x088b, 0xe41a, 0x03f9, 0xa2fe, 0x3c10, 0x3c83, 0xe41e, 0x0521,
+	0xf03a, 0xa202, 0x3c86, 0xe41e, 0x0b0e, 0xe41e, 0x06e2, 0xe16a,
+	0xe42e, 0xe42e, 0xa23e, 0x3cf0, 0xe41e, 0x088b, 0xe408, 0x03d3,
+	0xe41e, 0x0b48, 0xa10e, 0xf13a, 0xa104, 0xf2ba, 0xa102, 0xf05a,
+	0xf04a, 0xe41e, 0x0923, 0xf6fe, 0xe41e, 0x088b, 0xe408, 0x03d3,
+	0xe41e, 0x095c, 0xf68e, 0xe41e, 0x01db, 0xf22e, 0xe41e, 0x18ab,
+	0xe41e, 0x095c, 0xa2fe, 0x3c10, 0xe41e, 0x1ec1, 0xf5ca, 0x2800,
+	0x3c10, 0xe41e, 0x1ed9, 0xe092, 0xa200, 0xe41e, 0x0c19, 0xa200,
+	0x3c9b, 0xe41e, 0x1870, 0xa2fe, 0x3c10, 0xe082, 0xf096, 0xe42e,
+	0xe41e, 0x18b2, 0xe41e, 0x18ab, 0xe41e, 0x0923, 0xf44e, 0xe16b,
+	0xe42e, 0xe41e, 0x0b48, 0xf0da, 0xa102, 0xe40a, 0x0412, 0xa108,
+	0xf084, 0xf11a, 0xa108, 0xf0f6, 0xa102, 0xf06a, 0xa102, 0xf04a,
+	0xe41e, 0x0923, 0xf6fe, 0xe41e, 0x088b, 0xe408, 0x0412, 0xe41e,
+	0x095c, 0xf68e, 0xe41e, 0x0b3f, 0xe41e, 0x0b36, 0xe42e, 0xa200,
+	0xe161, 0x0100, 0xe188, 0x0aff, 0x3d11, 0xe0c0, 0x0041, 0xe005,
+	0x0034, 0xae11, 0xe042, 0xce20, 0xd111, 0x0100, 0xd112, 0x0180,
+	0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0xe41e, 0x0417, 0xe41e,
+	0x0222, 0xe41e, 0x0148, 0xa204, 0x3cae, 0xe16a, 0xd130, 0x0000,
+	0xd03a, 0x0000, 0xd04c, 0x0000, 0xd008, 0x0000, 0xd022, 0x0000,
+	0xa200, 0xe0c2, 0x0100, 0xe0c2, 0x0128, 0xa2fe, 0x3c25, 0x3c26,
+	0x3c27, 0x3c28, 0x3c10, 0x3c29, 0x3c56, 0xe161, 0x05c7, 0x3511,
+	0x3d11, 0x3511, 0x3d11, 0xe41e, 0x0c04, 0xe41e, 0x1eb0, 0xe41e,
+	0x2179, 0xe41e, 0x1a59, 0xe42e, 0xa200, 0x3c86, 0xe41e, 0x0672,
+	0xe41e, 0x1e75, 0xe41e, 0x04d4, 0xe41e, 0x08e0, 0xe41e, 0x0667,
+	0xe41e, 0x0521, 0xe40a, 0x04d1, 0xe41e, 0x17aa, 0xe408, 0x0476,
+	0xe41e, 0x088b, 0xe408, 0x04d1, 0xe40e, 0x04b8, 0xe41e, 0x020f,
+	0xe404, 0x04b8, 0xe41e, 0x0667, 0xa202, 0x3c86, 0x28bd, 0xf09a,
+	0xe41e, 0x065e, 0xa2fe, 0x3c84, 0xa202, 0x3cb4, 0xe40e, 0x04b8,
+	0xe41e, 0x05c6, 0xf05a, 0xe41e, 0x05e5, 0xe40e, 0x04aa, 0xe41e,
+	0x1ea7, 0x2884, 0xe414, 0x065e, 0x2884, 0xe404, 0x04b8, 0xe41e,
+	0x2300, 0xe41e, 0x05b9, 0x28a5, 0xf0e8, 0x2a4e, 0x4e40, 0x2884,
+	0xe41b, 0x217f, 0x284e, 0xe418, 0x1fe8, 0x2840, 0xe41a, 0x1cfb,
+	0x287e, 0x3c82, 0x2840, 0xf058, 0xe41e, 0x0641, 0xe41e, 0x0646,
+	0xe41e, 0x064b, 0x2840, 0xaa02, 0x443f, 0xf03a, 0xe40e, 0x046c,
+	0xe41e, 0x22e7, 0xe41e, 0x18b2, 0xe41e, 0x08a5, 0xf04a, 0xe41e,
+	0x1e2a, 0x3ce9, 0xe41e, 0x1d24, 0x3c85, 0x2885, 0x3c56, 0x2884,
+	0xf024, 0x3c83, 0xe41e, 0x06e2, 0xe41e, 0x1e90, 0xe41e, 0x0b0e,
+	0xe42e, 0xa202, 0x3c86, 0xf65e, 0xa200, 0xcc4a, 0xcc4c, 0x3c53,
+	0x3c62, 0x3cbd, 0x3cae, 0x3cb4, 0x3ca5, 0x3c97, 0x28ad, 0xe41a,
+	0x0638, 0xe41e, 0x0641, 0xe41e, 0x0646, 0xe41e, 0x064b, 0xe41e,
+	0x0ec4, 0xa2fe, 0x3cba, 0x3cbb, 0x3cb9, 0xa200, 0x3cbc, 0xa204,
+	0x3cf0, 0xa2fc, 0x3c84, 0xa2fa, 0x3c85, 0xa2fe, 0xc009, 0x3c3f,
+	0x3c40, 0x3c41, 0x3c42, 0xc000, 0xe42e, 0x2811, 0xa184, 0xf03a,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xa200, 0xcc44, 0xd152, 0x0000,
+	0xd130, 0x0000, 0xd1e0, 0x0003, 0xd1ff, 0x03b0, 0xd1fd, 0x03d0,
+	0xd199, 0x0224, 0xd1fc, 0x0720, 0xd03a, 0x0000, 0xd04c, 0x0000,
+	0xd008, 0x0000, 0xd14b, 0x0200, 0x28b1, 0xcfce, 0xe41e, 0x025f,
+	0xe42e, 0xe0c0, 0x0059, 0xa102, 0xf0da, 0xe41e, 0x088b, 0xf04a,
+	0xe41e, 0x01db, 0xf09e, 0xe41e, 0x21bc, 0x2a84, 0xb7f5, 0x3e84,
+	0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe41e, 0x0672, 0xe41e,
+	0x2292, 0xe42e, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0000, 0xd112,
+	0x0080, 0xd113, 0x0013, 0xca28, 0xf7f8, 0xe0c0, 0x0061, 0xe41e,
+	0x0be2, 0xa202, 0xe41e, 0x0bec, 0xe41e, 0x09e6, 0xe128, 0xe0c0,
+	0x0060, 0xf048, 0xe41e, 0x1ec1, 0xf03e, 0xe41e, 0x1eec, 0xe42e,
+	0xe0c0, 0x0040, 0xa201, 0xae17, 0xe042, 0xe005, 0x4f00, 0xae03,
+	0xe042, 0xce20, 0xd111, 0x0450, 0xd112, 0x00c8, 0xd113, 0x0003,
+	0xca28, 0xf7f8, 0xe42e, 0xe180, 0xa2fe, 0x3c29, 0x3c10, 0xe41e,
+	0x2179, 0xe41e, 0x05a9, 0x2821, 0xf05a, 0x2816, 0xa104, 0xf02a,
+	0x28ea, 0x3ce9, 0xa200, 0x3c81, 0x3ce7, 0x3ce6, 0x3ce8, 0x3ce5,
+	0xe166, 0x05ab, 0xc710, 0x3d16, 0xe167, 0x0518, 0xe166, 0x0054,
+	0xa200, 0x3cb2, 0x287f, 0xa102, 0xcc44, 0xe184, 0x0596, 0x9e06,
+	0x5cb2, 0xa802, 0xb690, 0x3d17, 0x28b2, 0xa002, 0x3cb2, 0xe190,
+	0xa200, 0x3c60, 0xe41e, 0x0c19, 0xe42e, 0x24b5, 0x4cb6, 0xce20,
+	0xd111, 0x0600, 0xd112, 0x0004, 0xd113, 0x0000, 0xca28, 0xf7f8,
+	0xe42e, 0xe161, 0x0200, 0xa200, 0xc73f, 0x3d11, 0x3cb2, 0xd022,
+	0x001f, 0xe184, 0x05b7, 0xe41e, 0x217f, 0x28b2, 0xa002, 0x3cb2,
+	0xe42e, 0x2abc, 0x4e4f, 0x3ebc, 0x28a1, 0x3cb9, 0x2a3f, 0xf06b,
+	0x2a42, 0xf039, 0x3cba, 0xf02e, 0x3cbb, 0xe42e, 0x28a5, 0xf1c8,
+	0x28a5, 0xe016, 0x4440, 0xf168, 0xe41e, 0x0620, 0xf07a, 0xe41e,
+	0x0625, 0xf07a, 0x284f, 0xf0e8, 0xf0fe, 0xe41e, 0x062a, 0xf04a,
+	0x2838, 0xf0a8, 0xf07e, 0xe41e, 0x0631, 0xf04a, 0x284e, 0xf04a,
+	0xf01e, 0xa200, 0xe42e, 0xa202, 0xe42e, 0xa202, 0x3ca5, 0x2884,
+	0xe412, 0x217f, 0x2884, 0xe412, 0x2186, 0x2884, 0xe412, 0x218d,
+	0xa2fc, 0x3c84, 0x3c3e, 0xe42e, 0xe41e, 0x0b48, 0xf15a, 0xa102,
+	0xf17a, 0xa108, 0xf114, 0xf14a, 0xa102, 0xf0da, 0xa102, 0xf0ba,
+	0xa102, 0xf09a, 0xa102, 0xf07a, 0xa104, 0xf056, 0xa102, 0xf04a,
+	0xa10e, 0xf022, 0xe42e, 0xe41e, 0x0923, 0xe40e, 0x05f4, 0xcaa2,
+	0xaf0a, 0xa806, 0x184e, 0xf0a8, 0xe41e, 0x095c, 0xe41e, 0x2387,
+	0xf5ca, 0x2894, 0xf5aa, 0xe41e, 0x0b3f, 0xe41e, 0x0af7, 0xe42e,
+	0xe0c0, 0x0065, 0xaf04, 0xa802, 0xe42e, 0xe0c0, 0x0065, 0xaf16,
+	0xa802, 0xe42e, 0xe0c0, 0x0065, 0xaf06, 0xa806, 0xa102, 0xe016,
+	0xe42e, 0xe0c0, 0x0065, 0xaf06, 0xa806, 0xa104, 0xe016, 0xe42e,
+	0xe41e, 0x0af7, 0xe0c0, 0x0048, 0xc009, 0x3433, 0x3c34, 0xc000,
+	0xe42e, 0xc009, 0x2433, 0x4c34, 0xc000, 0xe42e, 0xc009, 0x3435,
+	0x3c36, 0xc000, 0xe42e, 0xe41e, 0x0af7, 0xe0c0, 0x0048, 0xc009,
+	0x3437, 0x3c38, 0xc000, 0xe42e, 0xc009, 0x2435, 0x4c36, 0xc000,
+	0xe42e, 0xc009, 0x2437, 0x4c38, 0xc000, 0xe42e, 0xe41e, 0x0b3f,
+	0x28ad, 0xe42a, 0xe41e, 0x0641, 0xe0c2, 0x0048, 0xe42e, 0xe41e,
+	0x2204, 0xe41e, 0x2237, 0xe41e, 0x0504, 0xe41e, 0x24a9, 0xe41e,
+	0x2297, 0xe42e, 0xe0c0, 0x0059, 0xa102, 0xf2ca, 0xa102, 0xe42a,
+	0xa102, 0xf05a, 0xa102, 0xe40a, 0x06b8, 0xe42e, 0xe0c0, 0x006b,
+	0x34b5, 0x3cb6, 0xe0c0, 0x006c, 0x34b7, 0x3cb8, 0xe0c0, 0x0060,
+	0xaf08, 0x3088, 0xe0c0, 0x0060, 0xa81e, 0x3c87, 0xe0c0, 0x0061,
+	0xa83e, 0x3c8a, 0xe0c0, 0x0065, 0xa840, 0xf0ba, 0xa200, 0xe167,
+	0x0600, 0xc703, 0x3d17, 0xe41e, 0x059d, 0xe004, 0x0088, 0x3ca7,
+	0xe42e, 0xc001, 0xe0c0, 0x0060, 0x3400, 0x3c01, 0xe0c0, 0x0061,
+	0xae14, 0x3406, 0x3c07, 0xc000, 0xe0c0, 0x0062, 0xaf02, 0x3021,
+	0xaf02, 0x30aa, 0xa200, 0xe0c0, 0x0067, 0xa802, 0x3cb1, 0xe42e,
+	0xe41e, 0x038c, 0xe41e, 0x0174, 0xe0c0, 0x0042, 0xce20, 0xd111,
+	0x0640, 0xd112, 0x00c0, 0xd113, 0x0003, 0xca29, 0xf7f9, 0xa200,
+	0xe41e, 0x0e9b, 0xe004, 0x0040, 0xe41e, 0x0e9b, 0xe0c0, 0x0060,
+	0x3c7f, 0xe0c0, 0x0061, 0x3c66, 0xe0c0, 0x006e, 0xe41e, 0x020a,
+	0xe167, 0x05fd, 0xe0c0, 0x0062, 0x3517, 0x3d17, 0xe0c0, 0x0063,
+	0x3d17, 0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x077a, 0xa102,
+	0xe42a, 0xa102, 0xf05a, 0xa102, 0xe40a, 0x07e7, 0xe42e, 0x2861,
+	0xae04, 0x4c91, 0xae02, 0x4c90, 0xe0c2, 0x0060, 0xc009, 0x203f,
+	0x4c40, 0xe0c2, 0x0061, 0x2041, 0x4c42, 0xc000, 0xe0c2, 0x0062,
+	0xe41e, 0x1a64, 0xe0c2, 0x0067, 0xe41e, 0x1a69, 0xe0c2, 0x0068,
+	0xe41e, 0x1a6e, 0xe0c2, 0x0069, 0xe41e, 0x1a59, 0x2a23, 0xe41b,
+	0x081d, 0x2a3f, 0xe419, 0x081d, 0xae02, 0x4c23, 0xe0c2, 0x006a,
+	0x2072, 0x4c73, 0xe0c2, 0x006c, 0xe41e, 0x18b5, 0xe0c2, 0x007b,
+	0x2057, 0x4c58, 0xae08, 0xe0c2, 0x006f, 0x28b0, 0xe0c2, 0x007a,
+	0x2054, 0x4c55, 0xa002, 0x3454, 0x3c55, 0xe0c2, 0x0070, 0x2885,
+	0xe0c2, 0x0071, 0x2c53, 0xe0c2, 0x0072, 0xe41e, 0x07e8, 0xe0c2,
+	0x0073, 0xa200, 0xe0c2, 0x0074, 0x2886, 0x2a97, 0xae05, 0xe056,
+	0x2ab4, 0xae21, 0xe056, 0x2aae, 0xae23, 0xe056, 0x2abd, 0xae29,
+	0xe056, 0xe0c2, 0x0076, 0xe41e, 0x0654, 0xe0c2, 0x0051, 0xe41e,
+	0x0659, 0xe0c2, 0x0052, 0x2884, 0xe0c2, 0x0077, 0x2a22, 0xe161,
+	0x05e4, 0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0078, 0x2111,
+	0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0079, 0x2025, 0x4c26, 0xe0c2,
+	0x007c, 0xe167, 0x05c7, 0x2117, 0x4d17, 0xe0c2, 0x007e, 0x2117,
+	0x4d17, 0xe0c2, 0x007d, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2,
+	0x0053, 0xe42e, 0xe41e, 0x18b5, 0xe0c2, 0x0063, 0x2a23, 0xe41b,
+	0x081d, 0x2a3f, 0xe419, 0x081d, 0xae02, 0x4c23, 0xe0c2, 0x0064,
+	0x2027, 0x4c28, 0xe0c2, 0x006d, 0x2886, 0xe0c2, 0x0070, 0x2057,
+	0x4c58, 0xae08, 0xe0c2, 0x0071, 0x2025, 0x4c26, 0xe0c2, 0x0072,
+	0x2821, 0xf0ca, 0x2816, 0xa104, 0xf09a, 0x28eb, 0x3cb3, 0xa004,
+	0xe0c2, 0x0073, 0x28ea, 0x3ce9, 0xf07e, 0x2819, 0xa004, 0xe0c2,
+	0x0073, 0xa200, 0x3ce9, 0x28e9, 0xe0c2, 0x0074, 0xa200, 0xe0c2,
+	0x0075, 0x2a22, 0xe161, 0x05e4, 0x2111, 0x4d11, 0xf02b, 0xae02,
+	0xe0c2, 0x0076, 0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0077,
+	0x2886, 0xe016, 0x58f0, 0xe0c2, 0x0078, 0xe161, 0x05c7, 0x2111,
+	0x4d11, 0xe0c2, 0x007a, 0x2111, 0x4d11, 0xe0c2, 0x0079, 0xe41e,
+	0x18b5, 0xaf32, 0xa802, 0xae0c, 0x2a24, 0xae05, 0xe056, 0x4c1d,
+	0xae02, 0x2a1b, 0xe017, 0xe056, 0xae10, 0x4c1f, 0xae10, 0x4c11,
+	0x2a19, 0xe01b, 0xae3f, 0xe056, 0xe0c2, 0x007b, 0xe42e, 0xe42e,
+	0x2842, 0x3c00, 0xa200, 0x2a40, 0xf059, 0x2ab9, 0xa80f, 0xe056,
+	0xf12e, 0x2a00, 0xf09b, 0x2aba, 0xa80f, 0xae07, 0xe056, 0x2abb,
+	0xa80f, 0xe056, 0xf08e, 0x2abb, 0xa80f, 0xae07, 0xe056, 0x2aba,
+	0xa80f, 0xe056, 0x3c01, 0x28a3, 0x2a23, 0xe41b, 0x081d, 0x2a3f,
+	0xe419, 0x081d, 0xae02, 0x4c23, 0xae0c, 0x4c00, 0xae04, 0x4c43,
+	0xae02, 0x4c3f, 0xae24, 0x2a3f, 0xe017, 0x4e40, 0xae1f, 0xe056,
+	0x2abc, 0xae0d, 0xe056, 0x4c01, 0xe42e, 0x283f, 0xe42a, 0xc009,
+	0x203b, 0x4c3c, 0x103d, 0x1c3e, 0xc000, 0xf030, 0xa206, 0xe42e,
+	0xa208, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0018, 0xae11,
+	0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0100, 0x88ec, 0x0113,
+	0xca28, 0xf7f8, 0xe42e, 0x8917, 0x0034, 0x8917, 0x0033, 0x8917,
+	0x0035, 0x8917, 0x0036, 0x8917, 0x0037, 0x8917, 0x0038, 0x8117,
+	0x8117, 0x2117, 0x4d17, 0xcc60, 0x2117, 0x4d17, 0xcc62, 0x2117,
+	0x4d17, 0xcc64, 0x2117, 0x4d17, 0xcc72, 0xe42e, 0x8b17, 0x0034,
+	0x8b17, 0x0033, 0x8b17, 0x0035, 0x8b17, 0x0036, 0x8b17, 0x0037,
+	0x8b17, 0x0038, 0x8117, 0x8117, 0xc860, 0x3517, 0x3d17, 0xc862,
+	0x3517, 0x3d17, 0xc864, 0x3517, 0x3d17, 0xc872, 0x3517, 0x3d17,
+	0xe42e, 0xc001, 0x3c13, 0xc000, 0xe42e, 0xc001, 0x2813, 0xc000,
+	0xe42e, 0xc001, 0x3c14, 0xc000, 0xe42e, 0xc001, 0x2814, 0xc000,
+	0xe42e, 0xc001, 0x2430, 0x4c31, 0xc000, 0xae06, 0xc873, 0xe046,
+	0xe422, 0xe16b, 0xe42e, 0xc001, 0x280c, 0xf16a, 0xe41e, 0x0af7,
+	0xc001, 0xe0c0, 0x0049, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0xe0c1,
+	0x0048, 0x360e, 0x3e0f, 0x260e, 0x4e0f, 0xe045, 0xa200, 0xb626,
+	0xe003, 0x0200, 0xb606, 0xc000, 0xe42e, 0xe41e, 0x088b, 0xe42a,
+	0xe0c0, 0x0045, 0xaf04, 0xa802, 0xe42e, 0xc001, 0x3c33, 0xc000,
+	0xe42e, 0xc001, 0x2833, 0xc000, 0xe42e, 0xc001, 0x3c11, 0xc000,
+	0xe42e, 0xc001, 0x2811, 0xc000, 0xe42e, 0xd148, 0x0040, 0xd144,
+	0x0000, 0xd145, 0x0000, 0xd168, 0x0000, 0xd16b, 0x0000, 0xd14b,
+	0x0200, 0xc001, 0xa200, 0x3c34, 0xc000, 0xe004, 0x0019, 0xae18,
+	0xcec0, 0xd14c, 0x000c, 0xca9a, 0xf7f8, 0xe42e, 0xc001, 0x2400,
+	0x4c01, 0x0406, 0x0c07, 0x3408, 0x3c09, 0xd071, 0x202a, 0xe181,
+	0xc001, 0xe0c0, 0x0048, 0x3415, 0x3c16, 0x280c, 0xf13a, 0xe0c0,
+	0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0xe0c1, 0x0049, 0x3604,
+	0x3e05, 0x1404, 0x1c05, 0xe0c1, 0x0045, 0xaf05, 0xa803, 0xb611,
+	0x320c, 0xe0c0, 0x0048, 0x3402, 0xe008, 0xfe00, 0x3c03, 0xe0c0,
+	0x0048, 0xe008, 0x01ff, 0x3c0b, 0xa200, 0xcc78, 0xd022, 0x00ff,
+	0xe184, 0x090b, 0xcc7a, 0xe190, 0xe41e, 0x09e6, 0xe41e, 0x0a05,
+	0xe41e, 0x08bd, 0xc001, 0xa200, 0x3c1a, 0x280b, 0xa102, 0xe412,
+	0x092b, 0xc001, 0xa202, 0x3c1a, 0xa200, 0xceaa, 0xc000, 0xa200,
+	0xe41e, 0x0c19, 0xe42e, 0xcaa0, 0xe190, 0xca9a, 0xf7f8, 0xca9c,
+	0xe418, 0x0a05, 0xe42e, 0xcc44, 0xe184, 0x0934, 0xca9c, 0xe418,
+	0x0a05, 0xcaa0, 0xca9b, 0xf7f9, 0xe190, 0xe42e, 0xe004, 0x0100,
+	0xceb0, 0xe004, 0x00ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e,
+	0x0000, 0xd15f, 0x0000, 0xe004, 0x0019, 0xae18, 0xe00a, 0x0620,
+	0xcec0, 0xd157, 0x0000, 0xd14a, 0x0000, 0xd14c, 0x0003, 0xca9c,
+	0xe418, 0x0a05, 0xca9a, 0xf7c8, 0xcaae, 0xa802, 0xf73a, 0xca9c,
+	0xe418, 0x0a05, 0xa200, 0xe42e, 0xe41e, 0x0bde, 0xe408, 0x0bba,
+	0xe41e, 0x0936, 0xe41e, 0x088b, 0xf128, 0xe41e, 0x0b36, 0xcaa2,
+	0xe008, 0x00ff, 0xe41e, 0x0871, 0xaf0e, 0xe418, 0x0923, 0xe41e,
+	0x0875, 0xaf0e, 0xf6e8, 0xe41e, 0x088b, 0xf0ea, 0xe004, 0x010b,
+	0xe008, 0x00ff, 0xe41e, 0x0871, 0xe004, 0x010b, 0xa83e, 0xe41e,
+	0x0879, 0xa200, 0xe42e, 0xe41e, 0x0875, 0xf058, 0xa204, 0xe41e,
+	0x092b, 0xf57e, 0xa206, 0xe41e, 0x092b, 0xe41e, 0x0875, 0xaf0a,
+	0x3c4e, 0xe41e, 0x0875, 0xa83e, 0xe41e, 0x0879, 0xe41e, 0x0875,
+	0xa116, 0xe42a, 0xca9c, 0xe418, 0x0a05, 0xe41e, 0x087d, 0xa10a,
+	0xe016, 0x3c4f, 0xe41e, 0x09a5, 0xe42e, 0xc001, 0xa200, 0x3c30,
+	0x3c31, 0x3c33, 0xe41e, 0x09b5, 0xc001, 0xe41e, 0x09e6, 0xc001,
+	0xe128, 0xa200, 0x3c38, 0xc000, 0xe42e, 0xc001, 0x2833, 0x4411,
+	0xc000, 0xae0e, 0xce92, 0xd14a, 0x0000, 0xd158, 0x0000, 0xe004,
+	0x01ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e, 0x0000, 0xd15f,
+	0x0000, 0xd161, 0x0003, 0xe004, 0x0019, 0xae18, 0xe00a, 0x0638,
+	0xcec0, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x0a05, 0xca9a, 0xf7c8,
+	0xca9c, 0xf7a8, 0xca9e, 0xc001, 0x3c32, 0xcc92, 0xca94, 0x0030,
+	0x0c31, 0x3430, 0x3c31, 0xcc90, 0xc000, 0xe42e, 0xe004, 0x1495,
+	0xae20, 0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000, 0xd033, 0x0000,
+	0xd035, 0x0000, 0xd036, 0x007f, 0xd037, 0x0000, 0xd038, 0x0000,
+	0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000, 0xd046, 0x0000,
+	0xd047, 0x0000, 0xd149, 0x0000, 0xe42e, 0xc001, 0x280c, 0xf20a,
+	0xe41e, 0x024f, 0xc001, 0xe004, 0x0440, 0xce50, 0x280d, 0xa806,
+	0xa108, 0xe012, 0xa806, 0xae06, 0x3c40, 0xe004, 0x010b, 0x5840,
+	0xce52, 0xe41e, 0x0257, 0xc001, 0xd14e, 0x0000, 0xd144, 0x0000,
+	0x2402, 0x4c03, 0xe000, 0x0200, 0x3402, 0x3c03, 0xf3ae, 0xd027,
+	0x0000, 0x280c, 0xe41a, 0x0a6e, 0xc001, 0xd027, 0x0001, 0x280d,
+	0xf25a, 0xca48, 0xa802, 0xf7e8, 0x2402, 0x4c03, 0xce40, 0xd121,
+	0x0000, 0xd122, 0x0040, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa032,
+	0xce46, 0xe190, 0xe190, 0xe190, 0xe190, 0xca48, 0xa802, 0xf7e8,
+	0xe004, 0x0200, 0x0402, 0x0c03, 0x3402, 0x3c03, 0x1408, 0x1c09,
+	0xf054, 0x2400, 0x4c01, 0x3402, 0x3c03, 0x280c, 0xe418, 0x0ab2,
+	0xc001, 0xe41e, 0x0af7, 0xc001, 0xd14e, 0x0000, 0xd144, 0x0000,
+	0xc000, 0xe42e, 0xe0c1, 0x0059, 0xa103, 0xa200, 0xb636, 0xe000,
+	0x001c, 0xe0c1, 0x0045, 0xe052, 0xe01a, 0xe42e, 0xc001, 0xa200,
+	0x3c0a, 0xe004, 0x0200, 0x3c0d, 0xe0c0, 0x0043, 0xa808, 0xf338,
+	0xe41e, 0x0a62, 0xc001, 0x3c0c, 0x2402, 0x4c03, 0xe0c1, 0x0049,
+	0x3604, 0x3e05, 0x2604, 0x4e05, 0xe045, 0xf033, 0x0606, 0x0e07,
+	0xe003, 0x0200, 0x280c, 0xb602, 0x3c0c, 0xf1d3, 0xe001, 0x0200,
+	0x3e0d, 0x280c, 0xf188, 0x280a, 0xe408, 0x0a78, 0xe41e, 0x01db,
+	0xc001, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xe40a, 0x0a78, 0xe0c0,
+	0x005d, 0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3c0a,
+	0xe40e, 0x0a78, 0x280d, 0x2a0c, 0xf039, 0xe004, 0x0200, 0x3c0d,
+	0xc000, 0xe42e, 0xc001, 0xe41e, 0x024f, 0xc001, 0x280d, 0xe002,
+	0x0200, 0xe40a, 0x0af4, 0x280d, 0xa806, 0xf1fa, 0xa108, 0xe012,
+	0xae06, 0x3c40, 0x280d, 0xaf04, 0xae20, 0xe000, 0x01c0, 0xce50,
+	0xe190, 0xca52, 0x5c40, 0x5840, 0x2a0d, 0xa807, 0xae07, 0x3e40,
+	0xe005, 0x010b, 0x5e40, 0xe056, 0x2a0d, 0xaf05, 0xae21, 0xe001,
+	0x0140, 0xce51, 0xe190, 0xce52, 0xe004, 0x01fc, 0x180d, 0xf022,
+	0xf14e, 0xc001, 0x280d, 0xa006, 0xaf04, 0xae20, 0xe000, 0x0440,
+	0xce50, 0x280d, 0xa806, 0xa108, 0xe012, 0xa806, 0xae06, 0x3c40,
+	0xe004, 0x010b, 0x5840, 0xce52, 0xc000, 0xe40e, 0x0257, 0xc001,
+	0xcaaa, 0x2a1a, 0xb616, 0xe0c1, 0x0048, 0x360e, 0x3e0f, 0x260e,
+	0x4e0f, 0xe042, 0xe049, 0x1608, 0x1e09, 0xf035, 0x1406, 0x1c07,
+	0xe0c2, 0x0048, 0xa200, 0xceaa, 0xc000, 0xe42e, 0xe41e, 0x0af7,
+	0xe0c0, 0x0045, 0xaf04, 0xa806, 0xa104, 0xe428, 0xa2fc, 0x2a84,
+	0xa003, 0xb616, 0xe418, 0x0b1d, 0xe42e, 0xc001, 0x3c40, 0xe0c0,
+	0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0x0840, 0xe049, 0x1600,
+	0x1e01, 0xf033, 0x0406, 0x0c07, 0xe049, 0x1608, 0x1e09, 0xf035,
+	0x1406, 0x1c07, 0xe0c2, 0x0048, 0xc000, 0xe42e, 0xe41e, 0x0af7,
+	0xc001, 0xe0c0, 0x0048, 0x3417, 0x3c18, 0xc000, 0xe42e, 0xa200,
+	0xceaa, 0xc001, 0x2417, 0x4c18, 0xc000, 0xe0c2, 0x0048, 0xe42e,
+	0xe41e, 0x0936, 0xe41e, 0x088b, 0xf0f8, 0xcaa2, 0xe049, 0xa83e,
+	0xe009, 0x00ff, 0xf03b, 0xaf0f, 0xf04b, 0xe41e, 0x0923, 0xf71e,
+	0xe41e, 0x088b, 0xf0aa, 0xe004, 0x010b, 0xe008, 0x00ff, 0xe41e,
+	0x0871, 0xe004, 0x010b, 0xf02e, 0xcaa2, 0xe008, 0x001f, 0xe41e,
+	0x0879, 0xe41e, 0x087d, 0xe42e, 0xc001, 0x2832, 0xe016, 0xc871,
+	0xa011, 0xf288, 0xaf07, 0xe009, 0x07ff, 0x2831, 0xe008, 0x07ff,
+	0xe046, 0xf16a, 0xf0ee, 0xc001, 0xe161, 0x0601, 0x2901, 0xc871,
+	0xa011, 0xaf07, 0xe009, 0x07ff, 0xe008, 0x07ff, 0xe046, 0xf08a,
+	0xe049, 0xe011, 0xaf15, 0xf0e1, 0xf0d0, 0xa200, 0xf0be, 0xc868,
+	0xa80e, 0xf028, 0xa210, 0x3c35, 0x7835, 0xa203, 0x5a35, 0xaf03,
+	0xe046, 0xc000, 0xe42e, 0xc000, 0x284e, 0x2a4f, 0x3c95, 0x3e96,
+	0xc001, 0x2831, 0x2a32, 0x3c36, 0x3e37, 0xa202, 0x3c34, 0xe0c0,
+	0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0xce20, 0xd111, 0x0000,
+	0xd112, 0x0080, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa,
+	0xc000, 0xe42e, 0xc000, 0x2895, 0x2a96, 0x3c4e, 0x3e4f, 0xc001,
+	0x2836, 0x2a37, 0x3c31, 0x3e32, 0xcc90, 0xcc93, 0xa200, 0x3c34,
+	0x3c30, 0x3c33, 0xe0c0, 0x0046, 0xe005, 0x0000, 0xae11, 0xe042,
+	0xce20, 0xd111, 0x0000, 0xd112, 0x0080, 0xd113, 0x0013, 0xca28,
+	0xf7f8, 0xe41e, 0x09e6, 0xe128, 0xc000, 0xe42e, 0xc001, 0x2834,
+	0xc000, 0xe42e, 0xc001, 0x3430, 0x3c31, 0xc000, 0xe42e, 0xc001,
+	0x2430, 0x4c31, 0xc000, 0xe42e, 0xc001, 0x3c32, 0xc000, 0xe42e,
+	0xc001, 0x2832, 0xc000, 0xe42e, 0xc001, 0x3c10, 0xc000, 0xe42e,
+	0xc001, 0x2810, 0xc000, 0xe42e, 0xc001, 0x3c38, 0xc000, 0xe42e,
+	0xc001, 0x2838, 0xc000, 0xe42e, 0xc001, 0xe0c0, 0x0041, 0xe005,
+	0x0039, 0xae11, 0xe042, 0x3420, 0x3c21, 0xe004, 0x04e1, 0xae10,
+	0x3422, 0x3c23, 0xc000, 0xe42e, 0xc001, 0x2420, 0x4c21, 0xc000,
+	0xe42e, 0x3c63, 0xe08e, 0x3c64, 0xe41e, 0x0c25, 0xe41e, 0x0c2d,
+	0x2864, 0xe09e, 0x2863, 0x3c60, 0xe42e, 0x2860, 0xae08, 0xe000,
+	0x0538, 0xe09e, 0xe41e, 0x0856, 0xe42e, 0x2863, 0xae08, 0xe000,
+	0x0538, 0xe09e, 0xe41e, 0x083b, 0xe42e, 0x2860, 0xf0ca, 0xa102,
+	0xe40a, 0x1f23, 0xa102, 0xe40a, 0x1f23, 0xe41e, 0x1020, 0xd04c,
+	0x0000, 0xe470, 0xe41e, 0x0bf0, 0xf088, 0xe41e, 0x0c00, 0xf088,
+	0xe41e, 0x0eca, 0xe41e, 0x09b5, 0xd04c, 0x0000, 0xe470, 0xe41e,
+	0x1003, 0xe41e, 0x08b9, 0xf098, 0xa202, 0xe41e, 0x08b5, 0xd037,
+	0x0000, 0xd04c, 0x0000, 0xe470, 0xa200, 0xe41e, 0x08b5, 0xd037,
+	0x0080, 0xd04c, 0x0000, 0xe470, 0xe40e, 0x1f23, 0xe41e, 0x1020,
+	0xd04c, 0x0000, 0xe470, 0xc001, 0xa200, 0x3c10, 0xe41e, 0x1003,
+	0xc001, 0x2832, 0xcc96, 0x2811, 0xe016, 0x3c11, 0xc000, 0xe42e,
+	0xba0c, 0xf03a, 0xbcfc, 0xe42e, 0xba4c, 0xa20c, 0x3c9d, 0x289d,
+	0xa002, 0x3c9d, 0xa140, 0xf0d2, 0xba40, 0xf7aa, 0x589d, 0xa102,
+	0x34ab, 0x3cac, 0x289d, 0xe41e, 0x0cb5, 0x00ab, 0x0cac, 0xe42e,
+	0xe16b, 0xe42e, 0xba0c, 0xf03a, 0xbe7e, 0xe42e, 0xba4c, 0xa20c,
+	0x3c9d, 0x289d, 0xa002, 0x3c9d, 0xa140, 0xf162, 0xba40, 0xf7aa,
+	0x589d, 0xa102, 0x34ab, 0x3cac, 0x289d, 0xe41e, 0x0cb5, 0x00ab,
+	0x0cac, 0x3cac, 0x8cac, 0x0000, 0xa002, 0xaf02, 0xe012, 0xe42c,
+	0xe012, 0xe16a, 0xe42e, 0xe16b, 0xe42e, 0xa120, 0xf050, 0xa020,
+	0x3c9e, 0x749e, 0xe42e, 0x3c9e, 0xba5e, 0x589e, 0x769e, 0xe056,
+	0xe42e, 0xba40, 0xe42a, 0xc868, 0xa80e, 0x3c00, 0xe016, 0xe428,
+	0x7400, 0xe016, 0xe42e, 0xe0c4, 0x3fff, 0xe40d, 0x0db6, 0x3c52,
+	0xf048, 0xa200, 0xa2fe, 0x3ca1, 0xbc12, 0xe40d, 0x0db6, 0xa10a,
+	0xb4a8, 0xa104, 0xe400, 0x0db6, 0xb7b4, 0xa006, 0x3c38, 0x60a1,
+	0x3ca1, 0xbdfe, 0xe40d, 0x0db6, 0x2a51, 0xf09b, 0xe049, 0x1829,
+	0xf06a, 0x3e29, 0xe41e, 0x1f03, 0xe40a, 0x0db6, 0x7413, 0x3c39,
+	0xa200, 0x3c3f, 0x3c42, 0x281b, 0xf068, 0xba40, 0x3c3f, 0xf03a,
+	0xba40, 0x3c42, 0x2851, 0xf2da, 0x2c1e, 0x5c3f, 0x3c44, 0xa200,
+	0x3c40, 0x283a, 0xf05a, 0xe41e, 0x0db9, 0x3c40, 0xf148, 0x283f,
+	0x3c3a, 0x284e, 0xe01a, 0x3c3b, 0x2839, 0x3c3c, 0x2842, 0x3c3d,
+	0xa2fc, 0x3c3e, 0x284e, 0xf098, 0x2850, 0x1c39, 0xf06a, 0xa202,
+	0x3cbe, 0xf03e, 0xa200, 0x3c3a, 0x2c52, 0xf038, 0x2840, 0xf018,
+	0x283f, 0xe016, 0x441c, 0x3c43, 0x283f, 0x0842, 0xb674, 0x3c41,
+	0x284f, 0xf06a, 0xe41e, 0x0c78, 0xe40d, 0x0db6, 0x3c45, 0xe41e,
+	0x1ca7, 0x2835, 0xf07a, 0xe41e, 0x0c78, 0xe40d, 0x0db6, 0xe408,
+	0x0db6, 0x2838, 0xa104, 0xf038, 0xba40, 0x3c46, 0x282c, 0x3c48,
+	0x282e, 0x3c49, 0x2838, 0xf0ea, 0xba40, 0xf0ca, 0xbc3e, 0x3c48,
+	0xe40d, 0x0db6, 0x2838, 0xa104, 0xf058, 0xbc3e, 0x3c49, 0xe40d,
+	0x0db6, 0x2851, 0xf05a, 0xe41e, 0x1fd7, 0xe41e, 0x0dd5, 0x2838,
+	0xe016, 0xe41a, 0x0ddc, 0xe40a, 0x0db6, 0x2851, 0xf06a, 0xe41e,
+	0x1b80, 0xe40a, 0x0db6, 0xf1fe, 0x284e, 0xf1da, 0x284f, 0xf04a,
+	0xba40, 0xba40, 0xf18e, 0xba40, 0xf16a, 0xbc0c, 0xe40d, 0x0db6,
+	0xf12a, 0xa106, 0xf08a, 0xa104, 0xf79a, 0xe41e, 0x0c78, 0xe40d,
+	0x0db6, 0xf74e, 0xe41e, 0x0c78, 0xe40d, 0x0db6, 0xbc40, 0xe40d,
+	0x0db6, 0xf6ce, 0x2838, 0xe01a, 0x442d, 0xf03a, 0xbc04, 0xf2fd,
+	0x3c47, 0xe0c6, 0x0033, 0xf2bd, 0x0831, 0xa400, 0xa566, 0x3c4a,
+	0xa200, 0x3c4b, 0x3c4c, 0x3c4d, 0x2833, 0xf10a, 0xbc04, 0xf1fd,
+	0x3c4b, 0xa102, 0xf0ba, 0xbe0c, 0xf1ad, 0xae02, 0xa83e, 0x3c4c,
+	0xbe0c, 0xf15d, 0xae02, 0xa83e, 0x3c4d, 0x282b, 0xf07a, 0x2851,
+	0xf038, 0x74de, 0xf03e, 0xe41e, 0x1278, 0x2a43, 0x2c52, 0xe419,
+	0x0dce, 0x3c52, 0x1c44, 0xf032, 0xa202, 0xe42e, 0xe16a, 0xa200,
+	0xe42e, 0x284f, 0xe016, 0xe42a, 0x283f, 0xe42a, 0x283a, 0xe42a,
+	0x283d, 0x1842, 0xe42a, 0x284e, 0xf048, 0x283b, 0xe016, 0xe42e,
+	0x283b, 0xe42a, 0x283c, 0x1839, 0xe016, 0xe42e, 0xe049, 0xc70f,
+	0x7e57, 0xaf21, 0xae02, 0xe046, 0xe42e, 0xd1f3, 0x0000, 0xe162,
+	0x0370, 0x2912, 0xcfe4, 0xe42e, 0x2848, 0x3c04, 0xe161, 0x0370,
+	0xe162, 0x02b0, 0xe41e, 0x0df1, 0xe42a, 0xd1f3, 0x0000, 0xe162,
+	0x02b0, 0x8848, 0x0022, 0xe184, 0x0dee, 0x2912, 0xcfe4, 0xa202,
+	0xe42e, 0xe082, 0xe098, 0xba40, 0xf098, 0x8804, 0x0022, 0xe184,
+	0x0dfa, 0x2911, 0x3d12, 0xa202, 0xe42e, 0x286d, 0xe082, 0x3c08,
+	0x2014, 0x4c15, 0x3400, 0x3c01, 0x2c39, 0x3402, 0x3c03, 0x2804,
+	0x3c05, 0xe163, 0x0600, 0xa200, 0xc71f, 0x3d13, 0xbc06, 0xe40d,
+	0x0e5a, 0xf06a, 0xa102, 0xf13a, 0xa102, 0xf1ba, 0xf32e, 0xe41e,
+	0x0c78, 0xe40d, 0x0e5a, 0xa002, 0x1002, 0x1c03, 0xe012, 0xf032,
+	0x0000, 0x0c01, 0x3402, 0x3c03, 0xa203, 0xf0de, 0xe41e, 0x0c78,
+	0xe40d, 0x0e5a, 0xa002, 0x0002, 0x0c03, 0x1000, 0x1c01, 0xf70e,
+	0xbc40, 0xa2ff, 0x3c0f, 0xe41e, 0x0e64, 0xf082, 0xa203, 0x283f,
+	0xf03a, 0x2a0f, 0xa803, 0x2904, 0xe046, 0xf1d4, 0x3d12, 0xe41e,
+	0x0e7f, 0x2805, 0xa102, 0x3c05, 0xa004, 0xe42a, 0xe40e, 0x0e0e,
+	0x2808, 0xa102, 0xe092, 0xe163, 0x0600, 0x2805, 0xf0a4, 0x2913,
+	0x8111, 0xf7e8, 0x2901, 0x3d12, 0x2805, 0xa102, 0x3c05, 0xf76e,
+	0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0x2884, 0xe424, 0xe0c2,
+	0x020b, 0xe0c2, 0x0214, 0xe42e, 0x3c06, 0x3e07, 0xe163, 0x0330,
+	0x2819, 0xa102, 0xe424, 0xae02, 0xa002, 0xcc44, 0xe184, 0x0e7c,
+	0x2d13, 0x2b0b, 0x1c06, 0x1a07, 0xf078, 0xf069, 0xe086, 0xe002,
+	0x0330, 0xaf02, 0xe42e, 0x8113, 0x8113, 0xa2fe, 0xe42e, 0x3c09,
+	0x2808, 0xe092, 0x286d, 0xa102, 0xcc44, 0xe184, 0x0e8a, 0x2901,
+	0x1809, 0xf03a, 0x8111, 0xe42e, 0xe082, 0x1808, 0xe000, 0x0600,
+	0xe096, 0xa202, 0x3d03, 0xe42e, 0xaf02, 0xae04, 0xe000, 0x0203,
+	0xe09e, 0x2907, 0xe42e, 0x3c0a, 0xe0c0, 0x0042, 0xe000, 0x0180,
+	0x080a, 0xa207, 0xe41e, 0x0eaf, 0xe0c0, 0x0041, 0xe005, 0x006c,
+	0xae0f, 0x0a0a, 0xe042, 0xa205, 0xe41e, 0x0eaf, 0xe42e, 0xce20,
+	0xd111, 0x0600, 0xd112, 0x0020, 0xce27, 0xca28, 0xf7f8, 0xe42e,
+	0xe42e, 0xd1f3, 0x0000, 0xe167, 0x02b0, 0xd022, 0x001f, 0xe184,
+	0x0ec2, 0x2917, 0xcfe4, 0xe42e, 0xa200, 0xe41e, 0x109d, 0xe41e,
+	0x10a5, 0xe42e, 0x2862, 0xe42a, 0xe41e, 0x10aa, 0xe167, 0x05fd,
+	0x2717, 0x4f17, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0000,
+	0xd112, 0x0080, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa,
+	0xa204, 0x3c62, 0xe42e, 0xe161, 0x0600, 0x2c52, 0x3d11, 0xe41e,
+	0x10aa, 0xae10, 0x3511, 0x3d11, 0xe161, 0x05ff, 0x2f01, 0xae15,
+	0xaf10, 0xe045, 0xe003, 0x0200, 0xa200, 0xb62e, 0x3c97, 0xf357,
+	0x2862, 0xa104, 0xf098, 0xe41e, 0x10aa, 0xe000, 0x0200, 0xe41e,
+	0x10a5, 0xa200, 0x3c62, 0xe41e, 0x10aa, 0xe161, 0x05fd, 0x2711,
+	0x4f11, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0000, 0xd112,
+	0x0080, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa, 0xe41e,
+	0x10aa, 0xe000, 0x0200, 0xe41e, 0x10a5, 0xe161, 0x05ff, 0x2f01,
+	0xae15, 0xe045, 0xe41e, 0x0bf0, 0xf088, 0xa200, 0xb62e, 0x3c97,
+	0xf047, 0xe41e, 0x09b5, 0xf58e, 0xe161, 0x0602, 0xe41e, 0x0be7,
+	0xaf20, 0xe008, 0x00ff, 0x4d01, 0x3d11, 0xe41e, 0x0be7, 0x3d01,
+	0xe161, 0x0601, 0x2711, 0x4f11, 0xaf11, 0xe41e, 0x0be7, 0xe042,
+	0xa00e, 0xa20f, 0xe015, 0xe052, 0xe41e, 0x10a5, 0xe41e, 0x10a1,
+	0xe41e, 0x1043, 0xe41e, 0x10a1, 0xa002, 0xe41e, 0x109d, 0xe42e,
+	0x3c00, 0xe41e, 0x10a1, 0xe40a, 0x0fb5, 0xa102, 0x3c04, 0xe161,
+	0x0600, 0xe004, 0x270f, 0x3c02, 0xa2fe, 0x3c03, 0xe41e, 0x1057,
+	0x2901, 0x1800, 0xf12a, 0x2901, 0x1802, 0xf052, 0x2901, 0x3c02,
+	0x2804, 0x3c03, 0x2804, 0xa102, 0x3c04, 0xf712, 0x2803, 0xe404,
+	0x0fb5, 0x3c04, 0xe41e, 0x1057, 0xa200, 0xe41e, 0x08b5, 0x2901,
+	0x3c52, 0xe004, 0x270f, 0x3d11, 0x2111, 0x4d09, 0xaf10, 0xe41e,
+	0x1077, 0x2804, 0xe41e, 0x1043, 0xe004, 0x0000, 0xe005, 0x007f,
+	0xe41e, 0x106c, 0x2111, 0x4d01, 0xaf10, 0xe000, 0x0200, 0xe41e,
+	0x10af, 0x2911, 0xe008, 0x00ff, 0xae20, 0x4d01, 0xe41e, 0x0be2,
+	0xcc90, 0xe002, 0x0200, 0xe41e, 0x10b9, 0xb604, 0xb628, 0xe41e,
+	0x0bec, 0xcc92, 0xa202, 0xe41e, 0x0bfc, 0xe41e, 0x0bf0, 0xe428,
+	0xa202, 0xe41e, 0x08b5, 0xe41e, 0x1003, 0xa200, 0xe41e, 0x08b5,
+	0xd036, 0x00ff, 0xd037, 0x0080, 0xe42e, 0x2c44, 0x3c52, 0xe42e,
+	0x3c00, 0x3e01, 0xe04a, 0xe41e, 0x10c3, 0xe41e, 0x10a1, 0xf0ea,
+	0xa102, 0x3c04, 0xe161, 0x0600, 0xe41e, 0x1057, 0x2901, 0x1800,
+	0xf07a, 0x2804, 0xa102, 0x3c04, 0xf782, 0xa200, 0xe42e, 0xca28,
+	0xf7f8, 0xe004, 0x270f, 0x3d11, 0x2111, 0x4d09, 0xaf10, 0x2a01,
+	0xe41e, 0x108c, 0x2804, 0xe41e, 0x1043, 0x2801, 0xae0a, 0xe000,
+	0x0000, 0xa23f, 0xe41e, 0x106c, 0x2801, 0xae04, 0xe000, 0x0410,
+	0xe094, 0x2111, 0x4d01, 0xaf10, 0xe000, 0x0080, 0x3512, 0x3d12,
+	0x2911, 0xe008, 0x00ff, 0xae20, 0x4d01, 0xe41e, 0x0be2, 0xcc90,
+	0xe002, 0x0080, 0x3512, 0x3d12, 0xb604, 0xb628, 0xe41e, 0x0bec,
+	0xcc92, 0xa202, 0xe42e, 0xd115, 0x0001, 0xe190, 0xca28, 0xf7f8,
+	0xe41e, 0x10b4, 0xe41e, 0x1077, 0xd115, 0x0000, 0xe41e, 0x10b4,
+	0xe000, 0x0200, 0xe41e, 0x10af, 0xe41e, 0x10be, 0xe002, 0x0200,
+	0xe41e, 0x10b9, 0xb604, 0xb628, 0xe41e, 0x0bec, 0xcc92, 0xe42e,
+	0xe082, 0x3ce4, 0xca28, 0xf7f8, 0xe41e, 0x10c7, 0xe049, 0xae04,
+	0xe000, 0x0410, 0xe092, 0x2111, 0x4d09, 0xe41e, 0x108c, 0x2111,
+	0x4d09, 0xe000, 0x0080, 0x3511, 0x3d11, 0x2111, 0x4d09, 0xe002,
+	0x0080, 0x3511, 0x3d11, 0xb604, 0xb628, 0xe41e, 0x0bec, 0xcc92,
+	0x28e4, 0xe092, 0xe42e, 0xae06, 0xe005, 0x0142, 0xae11, 0xe042,
+	0xe0c1, 0x0046, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0600,
+	0xd112, 0x0004, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0x2804,
+	0xae06, 0xe005, 0x0142, 0xae11, 0xe042, 0xe0c1, 0x0046, 0xe042,
+	0xca29, 0xf7f9, 0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0xd113,
+	0x0003, 0xca28, 0xf7f8, 0xe42e, 0xcc66, 0xcc6a, 0xcc6e, 0xe042,
+	0xcc6c, 0xa200, 0xcc60, 0xcc68, 0xcc70, 0xe128, 0xe42e, 0xe167,
+	0x05fd, 0x2717, 0x4f17, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xe41e,
+	0x08b9, 0xe005, 0x0080, 0xb615, 0xce23, 0xd112, 0x0080, 0xd113,
+	0x0013, 0xca28, 0xf7f8, 0xe42e, 0xae0b, 0xe001, 0x0000, 0xce23,
+	0xe167, 0x05fd, 0x2717, 0x4f17, 0xe042, 0xce20, 0xd112, 0x0020,
+	0xd113, 0x0013, 0xca28, 0xf7f8, 0xe42e, 0xc009, 0x3c20, 0xc000,
+	0xe42e, 0xc009, 0x2820, 0xc000, 0xe42e, 0xc009, 0x341e, 0x3c1f,
+	0xc000, 0xe42e, 0xc009, 0x241e, 0x4c1f, 0xc000, 0xe42e, 0xc009,
+	0x3422, 0x3c23, 0xc000, 0xe42e, 0xc009, 0x2422, 0x4c23, 0xc000,
+	0xe42e, 0xc009, 0x3424, 0x3c25, 0xc000, 0xe42e, 0xc009, 0x2424,
+	0x4c25, 0xc000, 0xe42e, 0xc009, 0x3c21, 0xc000, 0xe42e, 0xc009,
+	0x2821, 0xc000, 0xe42e, 0xe41e, 0x10a1, 0xe40a, 0x10dc, 0xa102,
+	0x3c04, 0xe161, 0x0600, 0xe41e, 0x1057, 0x2901, 0x1852, 0xf07a,
+	0x2804, 0xa102, 0x3c04, 0xf782, 0xa200, 0xe42e, 0xa202, 0xe42e,
+	0xa206, 0xe41e, 0x0c19, 0xe004, 0x004e, 0xe0c2, 0x017c, 0xa218,
+	0xe0c2, 0x017d, 0xa200, 0x3cdf, 0x3ce0, 0xe41e, 0x113c, 0x28e0,
+	0xa002, 0x3ce0, 0x18d7, 0xf7a4, 0xa200, 0x3c59, 0x3c5b, 0x3c5c,
+	0xe41e, 0x1133, 0x3ce0, 0x2c59, 0x1c44, 0xe402, 0x112f, 0xe41e,
+	0x1133, 0x3cd9, 0x18e0, 0xe418, 0x11e7, 0x28d9, 0x3ce0, 0x28df,
+	0xe41a, 0x11ec, 0xe41e, 0x1214, 0x28df, 0xf07a, 0xe41e, 0x2450,
+	0xf0cc, 0xe16a, 0xa200, 0x3cdf, 0x284f, 0xe016, 0x3c38, 0xe41e,
+	0x2479, 0x2c53, 0xa002, 0x3c53, 0xe41e, 0x1235, 0xcb04, 0x345b,
+	0x3c5c, 0x28df, 0xe40a, 0x10fb, 0xcb86, 0xa102, 0xf550, 0xc894,
+	0xf538, 0xe41e, 0x0cc1, 0xa200, 0x3cdf, 0xe40e, 0x10fb, 0xa200,
+	0xe41e, 0x0c19, 0xe42e, 0x285b, 0xe41a, 0x1240, 0xe004, 0x0390,
+	0x085b, 0xe094, 0x2902, 0xe42e, 0xe161, 0x04b0, 0x2838, 0x3d11,
+	0x2848, 0x3d11, 0x284a, 0x3d11, 0x284b, 0x3d11, 0x284c, 0x3d11,
+	0x284d, 0x3d11, 0xcb86, 0x3d11, 0xcb96, 0x3d11, 0x28df, 0x3d11,
+	0xe41e, 0x0be7, 0x3511, 0x3d11, 0xe41e, 0x0bf0, 0x3d11, 0xe162,
+	0x02b0, 0xd022, 0x000f, 0xe184, 0x115e, 0x2912, 0x3d11, 0x8b11,
+	0x0034, 0x8b11, 0x0033, 0xc860, 0x3511, 0x3d11, 0xc862, 0x3511,
+	0x3d11, 0xc864, 0x3511, 0x3d11, 0x8b11, 0x0035, 0x8b11, 0x0036,
+	0x8b11, 0x0037, 0x8b11, 0x0038, 0x28e0, 0xae0e, 0xe005, 0x00fa,
+	0xae11, 0xe042, 0xe0c1, 0x0046, 0xe042, 0xca29, 0xf7f9, 0xce20,
+	0xd111, 0x04b0, 0xd112, 0x0028, 0xd113, 0x0002, 0xca28, 0xf7f8,
+	0xe42e, 0x28d9, 0xae0e, 0xe005, 0x00fa, 0xae11, 0xe042, 0xe0c1,
+	0x0046, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x04b0, 0xd112,
+	0x0028, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe161, 0x04b0, 0x2911,
+	0x3c38, 0x2911, 0x3c48, 0x2911, 0x3c4a, 0x2911, 0x3c4b, 0x2911,
+	0x3c4c, 0x2911, 0x3c4d, 0xe41e, 0x2435, 0x2911, 0xcf86, 0x2911,
+	0xcf96, 0x2911, 0x3cdf, 0x2511, 0x4d11, 0xe41e, 0x0be2, 0xcc90,
+	0x2911, 0xe41e, 0x0bec, 0xcc92, 0xe162, 0x02b0, 0xd022, 0x000f,
+	0xe184, 0x11c3, 0x2911, 0x3d12, 0xd1f3, 0x0000, 0xe162, 0x02b0,
+	0x8848, 0x0022, 0xe184, 0x11cd, 0x2912, 0xcfe4, 0x28d9, 0xe41e,
+	0x10c3, 0x8911, 0x0034, 0x8911, 0x0033, 0x2111, 0x4d11, 0xcc60,
+	0x2111, 0x4d11, 0xcc62, 0x2111, 0x4d11, 0xcc64, 0x8911, 0x0035,
+	0x8911, 0x0036, 0x8911, 0x0037, 0x8911, 0x0038, 0xe42e, 0xe41e,
+	0x113c, 0xe41e, 0x1189, 0xe42e, 0x2c59, 0x2ad9, 0xe41e, 0x0fb8,
+	0xe42a, 0xe41e, 0x0ccb, 0xe16a, 0xe42a, 0xe41e, 0x2435, 0xe41e,
+	0x11fc, 0xa202, 0x3cdf, 0xe42e, 0xa203, 0x5ad9, 0xe00d, 0x00ff,
+	0xe161, 0x0430, 0x8857, 0x0022, 0xe184, 0x1208, 0x2901, 0xe052,
+	0x3d11, 0x28e1, 0xe052, 0x3ce1, 0x28e2, 0xe052, 0x3ce2, 0xe42e,
+	0xa200, 0x3ce1, 0x3ce2, 0xe42e, 0x285b, 0xe41a, 0x1210, 0x285b,
+	0xe000, 0x0430, 0xe092, 0x28e1, 0x5cd9, 0xa802, 0x3ce3, 0x2911,
+	0x5cd9, 0xa802, 0xae02, 0x4ce3, 0x3ce3, 0x2911, 0x5cd9, 0xa802,
+	0xae04, 0x4ce3, 0x3ce3, 0x28e2, 0x5cd9, 0xa802, 0xae06, 0x4ce3,
+	0x3ce3, 0xcf12, 0xd18a, 0x0000, 0xe42e, 0x285b, 0xe000, 0x0430,
+	0xe092, 0x2901, 0x3ce2, 0xa202, 0x58d9, 0x3d01, 0x3ce1, 0xe42e,
+	0x285c, 0xae10, 0xe005, 0x00fe, 0xae11, 0xe042, 0xe0c1, 0x0046,
+	0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0390, 0x2857, 0xa006,
+	0xe008, 0x00fc, 0xce24, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0x3cd8, 0xa002, 0x3cd7, 0x2c1e, 0x3c44, 0xbc0c, 0x3cd6, 0xe42d,
+	0xe40a, 0x1299, 0xa102, 0xe40a, 0x12d1, 0xa102, 0xe40a, 0x12ee,
+	0xa106, 0xe406, 0x1270, 0xa102, 0xe40a, 0x13d8, 0xe16b, 0xe42e,
+	0xba40, 0x3cda, 0xe41e, 0x0c78, 0xe42d, 0xa002, 0x3cdb, 0xe42e,
+	0xa200, 0x3cde, 0x28d6, 0xa106, 0xe424, 0xa104, 0xe420, 0x2c44,
+	0x08db, 0xa102, 0xc70f, 0x7cdb, 0xe008, 0xffff, 0xe41e, 0x1412,
+	0x3cde, 0x74de, 0x3cdc, 0x84dc, 0x82db, 0xe018, 0x2e44, 0xe066,
+	0x3cdc, 0x28d6, 0xa108, 0xe404, 0x1340, 0xe40a, 0x13ae, 0xe40e,
+	0x13ae, 0xe161, 0x0600, 0x88d8, 0x0022, 0xe184, 0x12a3, 0xe41e,
+	0x0c78, 0xe42d, 0xa002, 0x3d11, 0xe161, 0x0600, 0xe162, 0x0390,
+	0xa200, 0x3cd9, 0x3c00, 0x3c5b, 0x3c5c, 0x2800, 0xa002, 0x3c00,
+	0x1901, 0xf0e6, 0xa200, 0x3c00, 0x28d9, 0xa002, 0x3cd9, 0x8111,
+	0x18d8, 0xf746, 0xa200, 0x3cd9, 0xe161, 0x0600, 0xf6fe, 0x28d9,
+	0x3d12, 0x285b, 0xa002, 0x3c5b, 0x1857, 0xf684, 0x3c5b, 0xe41e,
+	0x13f6, 0x285c, 0xa002, 0x3c5c, 0x1858, 0xe162, 0x0390, 0xf5e4,
+	0xe42e, 0xa200, 0x3c5c, 0xe162, 0x0390, 0x845c, 0x82d7, 0xe018,
+	0xaf02, 0xc70f, 0x7cd7, 0xaf20, 0x2a57, 0xa103, 0xcc45, 0xe184,
+	0x12e5, 0x3d12, 0xa002, 0xe049, 0x1ad7, 0xb616, 0xe41e, 0x13f6,
+	0x285c, 0xa002, 0x3c5c, 0x1858, 0xf674, 0xe42e, 0xe167, 0x0600,
+	0x28d8, 0xa102, 0xcc44, 0xe184, 0x12fc, 0xe41e, 0x0c78, 0xe42d,
+	0x3d17, 0xe41e, 0x0c78, 0xe42d, 0x3d17, 0xe162, 0x0390, 0x2857,
+	0xa102, 0x3c04, 0x28d7, 0xa102, 0x8604, 0x3d12, 0xa200, 0x3c5c,
+	0xe41e, 0x13f6, 0x285c, 0xa002, 0x3c5c, 0x1858, 0xf7a4, 0x28d7,
+	0xa104, 0x3cd9, 0x28d9, 0xae02, 0xe000, 0x0600, 0xe092, 0x2911,
+	0xc70f, 0x7c57, 0x3400, 0x3c02, 0x2911, 0xc70f, 0x7c57, 0x3401,
+	0x3c03, 0x2802, 0x3c5c, 0x1803, 0xf170, 0xca2c, 0xf7fa, 0xe41e,
+	0x13f8, 0x2800, 0xe000, 0x0390, 0xe094, 0x2801, 0x1800, 0xf054,
+	0x3c04, 0x28d9, 0x8604, 0x3d12, 0xe41e, 0x13f6, 0x285c, 0xa002,
+	0x3c5c, 0x1803, 0xf6d6, 0x28d9, 0xa102, 0x3cd9, 0xf542, 0xe42e,
+	0xe162, 0x09e0, 0xa2fe, 0x2e1e, 0xa01f, 0xaf09, 0x3e00, 0x8600,
+	0x3d12, 0x8457, 0x28dc, 0xe40a, 0x1397, 0x2857, 0x18da, 0xaf02,
+	0x3c5b, 0x2858, 0x18da, 0xaf02, 0x3c5c, 0x2857, 0xa102, 0x3c07,
+	0x2858, 0xa102, 0x3c08, 0xa2fe, 0x08da, 0x3c04, 0xa200, 0x08da,
+	0x3c05, 0xa200, 0x3c00, 0x3c01, 0x3c02, 0xa202, 0x3c03, 0xe41e,
+	0x1419, 0xf0aa, 0x2901, 0xe05a, 0x3d01, 0x2800, 0xa002, 0x3c00,
+	0x2800, 0x18dc, 0xf25a, 0x285b, 0x0804, 0xa400, 0x6407, 0x3c5b,
+	0x285c, 0x0805, 0xa400, 0x6408, 0x3c5c, 0x2802, 0xa002, 0x3c02,
+	0x1803, 0xf668, 0x3c02, 0x2803, 0x0801, 0x3c03, 0xa202, 0x1801,
+	0x3c01, 0x28da, 0xf078, 0x2804, 0x2a05, 0xe013, 0x3e04, 0x3c05,
+	0xf57e, 0x2804, 0x2a05, 0xe012, 0x3e04, 0x3c05, 0xf51e, 0xa200,
+	0x3c5c, 0xe162, 0x0390, 0xa200, 0x3c5b, 0xe41e, 0x1419, 0xe01a,
+	0x3d12, 0x285b, 0xa002, 0x3c5b, 0x1857, 0xf784, 0xe41e, 0x13f6,
+	0x285c, 0xa002, 0x3c5c, 0x1858, 0xf6d4, 0xe42e, 0x28da, 0xf038,
+	0x28dc, 0xf03e, 0x2c44, 0x18dc, 0x3c00, 0xa200, 0x3c5c, 0xe162,
+	0x0390, 0xa200, 0x3c5b, 0x8457, 0x825c, 0xe018, 0x085b, 0x2ad6,
+	0xa109, 0xf05b, 0x8458, 0x825b, 0xe018, 0x085c, 0x1800, 0x2ada,
+	0xf024, 0xe017, 0x3f12, 0x285b, 0xa002, 0x3c5b, 0x1857, 0xf6c4,
+	0xe41e, 0x13f6, 0x285c, 0xa002, 0x3c5c, 0x1858, 0xf614, 0xe42e,
+	0xe41e, 0x0c78, 0xe42d, 0xa002, 0x1c44, 0xe408, 0x126e, 0x28d8,
+	0xe41e, 0x1412, 0x3c00, 0xa200, 0x3c5c, 0xe162, 0x0390, 0x2857,
+	0xa102, 0xcc44, 0xe184, 0x13ed, 0x7400, 0x3d12, 0xe41e, 0x13f6,
+	0x285c, 0xa002, 0x3c5c, 0x1858, 0xf714, 0xe42e, 0xa204, 0xf02e,
+	0xa206, 0x3c09, 0x285c, 0xae10, 0xe005, 0x00fe, 0xae11, 0xe042,
+	0xe0c1, 0x0046, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0390,
+	0x2857, 0xa006, 0xe008, 0x00fc, 0xce24, 0x8809, 0x0113, 0xca28,
+	0xf7f8, 0xe42e, 0xa201, 0xf04a, 0xaf02, 0xa003, 0xf7e8, 0xe04a,
+	0xe42e, 0x825c, 0xe018, 0x085b, 0x3c59, 0xaf08, 0xe000, 0x09e0,
+	0xe092, 0x2c59, 0xa81e, 0x3c06, 0xa203, 0x5a06, 0x2901, 0xe052,
+	0xe42e, 0xba4e, 0x3c11, 0xa200, 0x3c24, 0xd022, 0x0007, 0xe184,
+	0x1436, 0xba41, 0x5a24, 0xe056, 0x2a24, 0xa003, 0x3e24, 0x3c24,
+	0xa208, 0x3cf0, 0x2824, 0xaf0c, 0xe408, 0x1540, 0xa224, 0x3cf0,
+	0xe41e, 0x179b, 0xe40a, 0x1543, 0xa226, 0x3cf0, 0xba4e, 0x3c1f,
+	0xa112, 0xe404, 0x1540, 0xa154, 0xe400, 0x1540, 0xbc3e, 0x3c10,
+	0xa202, 0x3c22, 0xa200, 0x3c67, 0x2811, 0xa1c8, 0xf338, 0xbc06,
+	0x3c22, 0xa20a, 0x3cf0, 0xbc08, 0xe408, 0x1540, 0xa20c, 0x3cf0,
+	0xbc08, 0xe408, 0x1540, 0xba40, 0xba40, 0x3c67, 0xf23a, 0xa201,
+	0x3e69, 0x3e6b, 0xe160, 0x0000, 0xba40, 0xf11a, 0x2a69, 0xae03,
+	0xe056, 0x3c69, 0xe080, 0xe41e, 0x1746, 0x2a6b, 0xae03, 0xe056,
+	0x3c6b, 0xe080, 0xa201, 0xe41e, 0x1779, 0xf07e, 0x2a69, 0xae03,
+	0x3e69, 0x2a6b, 0xae03, 0x3e6b, 0xe080, 0xa002, 0xe090, 0xa110,
+	0xf648, 0xa20e, 0x3cf0, 0xbc18, 0xe40d, 0x1540, 0xa008, 0x3c13,
+	0xa202, 0x5813, 0x3414, 0x3c15, 0xa210, 0x3cf0, 0xbc04, 0x3c16,
+	0xe40d, 0x1540, 0xa102, 0xf034, 0xf0aa, 0xf33e, 0xa212, 0x3cf0,
+	0xbc18, 0xe40d, 0x1540, 0xa008, 0x3c17, 0xf2be, 0xba40, 0x3c18,
+	0xe41e, 0x0c92, 0xe160, 0x0907, 0xe161, 0x0908, 0x3500, 0x3d01,
+	0xe41e, 0x0c92, 0xe162, 0x0909, 0xe163, 0x090a, 0x3502, 0x3d03,
+	0xa214, 0x3cf0, 0xbdfe, 0xe40d, 0x1540, 0xe164, 0x090b, 0x3d04,
+	0xf10a, 0xa102, 0xcc44, 0xe162, 0x09e0, 0xe184, 0x14ca, 0xe41e,
+	0x0c92, 0x3512, 0x3d12, 0xa216, 0x3cf0, 0xe41e, 0x1672, 0xf01e,
+	0xe40d, 0x1540, 0xa218, 0x3cf0, 0xbc20, 0xe40d, 0x1540, 0x3c19,
+	0xba40, 0x3c1a, 0xa21a, 0x3cf0, 0xbdfe, 0xe40d, 0x1540, 0xa002,
+	0x3c57, 0xa21c, 0x3cf0, 0xbdfe, 0xe40d, 0x1540, 0xa002, 0x3c58,
+	0x8457, 0x8258, 0xe018, 0x3c1e, 0xa222, 0x3cf0, 0x2c57, 0xe002,
+	0x0080, 0xe400, 0x1540, 0x2c58, 0xe002, 0x0080, 0xe400, 0x1540,
+	0x2c1e, 0xe002, 0x4000, 0xe400, 0x1540, 0xa200, 0x3c1c, 0xba40,
+	0x3c1b, 0xf098, 0xba40, 0x3c1c, 0x2858, 0xae02, 0x3c58, 0x2c1e,
+	0xae02, 0x3c1e, 0xe41e, 0x15f2, 0xa21e, 0x3cf0, 0x2a1b, 0xba40,
+	0xb636, 0x3c1d, 0xa220, 0x3cf0, 0xba40, 0xe161, 0x05e4, 0xc703,
+	0x3d11, 0xf16a, 0xe161, 0x05e4, 0xe41e, 0x0c78, 0x3d11, 0xe41e,
+	0x0c78, 0x3d11, 0xe41e, 0x0c78, 0x2a1b, 0xf029, 0xae02, 0x3d11,
+	0xe41e, 0x0c78, 0x2a1b, 0xf029, 0xae02, 0x3d11, 0xf12d, 0xa200,
+	0x3c90, 0x3c91, 0x2820, 0x3cea, 0x3ceb, 0xe41e, 0x18ba, 0xba40,
+	0xe016, 0xe41a, 0x1682, 0xf05a, 0xe41e, 0x0cc1, 0xa202, 0xe42e,
+	0xe16a, 0xa200, 0xe42e, 0xa2fe, 0xe42e, 0xe41e, 0x0c78, 0x3c29,
+	0xbc3e, 0xe40d, 0x15e8, 0x1810, 0xf11a, 0x0810, 0x3c10, 0xe41e,
+	0x1ed9, 0x3c65, 0xa205, 0xae23, 0xcc9f, 0xa202, 0xe41e, 0x0c19,
+	0xa203, 0x3e9b, 0x2865, 0xe40a, 0x15e8, 0xba40, 0x3c2d, 0xba40,
+	0x3c2a, 0xbc0e, 0xe40d, 0x15e8, 0x3c2b, 0xf05a, 0xe41e, 0x1258,
+	0xe40d, 0x15e8, 0x282d, 0x2a2b, 0xe01b, 0xe052, 0xe408, 0x15e8,
+	0x2811, 0xa184, 0xf078, 0x282d, 0xf0aa, 0xe004, 0x0064, 0x3c11,
+	0xf06e, 0x282b, 0xf04a, 0xe004, 0x0042, 0x3c11, 0xbc3e, 0xe40d,
+	0x15e8, 0x3c2c, 0xbc3e, 0x3c2e, 0xe40d, 0x15e8, 0xba40, 0x3c2f,
+	0xba42, 0x3c30, 0xbe34, 0xe40d, 0x15e8, 0xa034, 0x3c31, 0xe404,
+	0x15e8, 0xa168, 0xe402, 0x15e8, 0xbe34, 0xe40d, 0x15e8, 0xa034,
+	0xe404, 0x15e8, 0xa168, 0xe402, 0x15e8, 0xbe18, 0xe40d, 0x15e8,
+	0x3c32, 0x3c36, 0xba40, 0x3c33, 0xba40, 0x3c34, 0xba40, 0x3c35,
+	0xa200, 0x3c37, 0x3c68, 0x2811, 0xa184, 0xf37a, 0x2829, 0x3c02,
+	0xe41e, 0x1fa1, 0xe41e, 0x0b7b, 0xf30a, 0xba40, 0x3c37, 0xba40,
+	0x3c68, 0xf28a, 0xa201, 0x3e6a, 0x3e6c, 0xe160, 0x0000, 0xe080,
+	0xa10c, 0x1837, 0x1837, 0xf132, 0xba40, 0xf11a, 0x2a6a, 0xae03,
+	0xe056, 0x3c6a, 0xe080, 0xe41e, 0x1746, 0x2a6c, 0xae03, 0xe056,
+	0x3c6c, 0xe080, 0xa203, 0xe41e, 0x1779, 0xf07e, 0x2a6a, 0xae03,
+	0x3e6a, 0x2a6c, 0xae03, 0x3e6c, 0xe080, 0xa002, 0xe090, 0xa110,
+	0xf5f8, 0xbe18, 0xf06d, 0x3c36, 0xe41e, 0x0cc1, 0xa202, 0xe42e,
+	0xe0c1, 0x0059, 0xa107, 0xf049, 0x28ae, 0xa902, 0x3cae, 0xe16a,
+	0xa200, 0xe42e, 0xa214, 0x2e1e, 0xe003, 0x0063, 0xf2f7, 0xa216,
+	0x2e1e, 0xe003, 0x018c, 0xf2a7, 0xa22a, 0x2e1e, 0xe003, 0x0318,
+	0xf257, 0xa22c, 0x2e1e, 0xe003, 0x0654, 0xf207, 0xa23e, 0x2e1e,
+	0xe003, 0x0e10, 0xf1b7, 0xa240, 0x2e1e, 0xe003, 0x1400, 0xf167,
+	0xa250, 0x2e1e, 0xe003, 0x2000, 0xf117, 0xa254, 0x2e1e, 0xe003,
+	0x2200, 0xf0c7, 0xa264, 0x2e1e, 0xe003, 0x5640, 0xf077, 0xa266,
+	0x2e1e, 0xe003, 0x9000, 0xf027, 0xa268, 0x2a1f, 0xe045, 0xf023,
+	0x3c1f, 0x2a1f, 0xa115, 0xe004, 0x0129, 0xf2d7, 0xa103, 0xe004,
+	0x02a3, 0xf297, 0xa113, 0xe004, 0x06f6, 0xf257, 0xa103, 0xe004,
+	0x0dec, 0xf217, 0xa113, 0xe004, 0x17bb, 0xf1d7, 0xa103, 0xe004,
+	0x34bc, 0xf197, 0xa103, 0xe004, 0x3c00, 0xf157, 0xa113, 0xe004,
+	0x6000, 0xf117, 0xa103, 0xe004, 0x6600, 0xf0d7, 0xa111, 0xe004,
+	0x1437, 0xae08, 0xf087, 0xa103, 0xe004, 0x21c0, 0xae08, 0xf037,
+	0xe004, 0x17bb, 0xae12, 0x3409, 0x3c0a, 0x841e, 0xe182, 0x0180,
+	0xe019, 0x2009, 0x4c0a, 0xc407, 0xd022, 0x000f, 0xe184, 0x166a,
+	0xe046, 0xf034, 0x8117, 0xe190, 0xe08e, 0x2a19, 0xe062, 0xa520,
+	0x3c20, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x0026, 0xae11, 0xe042,
+	0xce20, 0xd111, 0x09e0, 0xd112, 0x0200, 0xd113, 0x0002, 0xca28,
+	0xf7f8, 0xe42e, 0xa200, 0x3c00, 0x3c01, 0x3c02, 0x3c03, 0x3c04,
+	0x3c05, 0x3c06, 0x3c07, 0x3c08, 0x3c09, 0x3c0a, 0xba40, 0xa2ff,
+	0x3e25, 0x3e26, 0xf16a, 0xba4e, 0xa201, 0x3e25, 0x3c26, 0xe002,
+	0x00ff, 0xf0f8, 0xa202, 0x3c07, 0xba5e, 0xba5f, 0x3c25, 0x3e26,
+	0xe016, 0xe017, 0xe056, 0xf028, 0xf04e, 0xa200, 0x3c26, 0x3c25,
+	0xba40, 0xf02a, 0xba40, 0xba40, 0x3c0a, 0xf0ca, 0xba44, 0x3c09,
+	0xba40, 0x3c08, 0xba40, 0x3c06, 0xf05a, 0xba4e, 0x3c05, 0xba4e,
+	0xba4e, 0xba40, 0x3c04, 0xf05a, 0xbc0a, 0x3c03, 0xbc0a, 0x3c02,
+	0xba40, 0x3c01, 0xf0ba, 0xba7e, 0xe161, 0x05c7, 0x3511, 0x3d11,
+	0xba7e, 0x3511, 0x3d11, 0xba40, 0x3c00, 0xba40, 0x3c90, 0xe016,
+	0xe161, 0x05bd, 0xe41a, 0x172a, 0xe40a, 0x1727, 0xba40, 0x3c91,
+	0xe016, 0xe161, 0x05c2, 0xe41a, 0x172a, 0xe40a, 0x1727, 0x2890,
+	0x4c91, 0xf02a, 0xba40, 0xba40, 0x3c23, 0xba40, 0xf0aa, 0xba40,
+	0xbc20, 0xbc20, 0xbc20, 0xbc20, 0xbc20, 0x3cea, 0xbc20, 0x3ceb,
+	0x28eb, 0xa120, 0xf0a0, 0x2819, 0x18eb, 0xf070, 0x28b3, 0xf09a,
+	0x287f, 0xa104, 0x18eb, 0xf052, 0x2ab3, 0xf029, 0x2a20, 0x3eeb,
+	0xa202, 0xae3e, 0x2a0a, 0xae3d, 0xe056, 0x2a09, 0xae37, 0xe056,
+	0x2a08, 0xae35, 0xe056, 0x2a07, 0xae33, 0xe056, 0x2a06, 0xae31,
+	0xe056, 0x2a05, 0xae21, 0xe056, 0x2a04, 0xae11, 0xe056, 0x2a03,
+	0xae0b, 0xe056, 0x2a02, 0xae05, 0xe056, 0x2a01, 0xae03, 0xe056,
+	0x2a00, 0xe056, 0xe41e, 0x18ba, 0xe16a, 0xa202, 0xe42e, 0xe16a,
+	0xa200, 0xe42e, 0xe41e, 0x0c78, 0xcc44, 0x3c61, 0xa002, 0x3d11,
+	0xba46, 0xba46, 0xe184, 0x1738, 0xe41e, 0x0c78, 0xe41e, 0x0c78,
+	0xba40, 0xba48, 0xa002, 0x3d11, 0xba48, 0xa002, 0x3d11, 0xba48,
+	0xa002, 0x3d11, 0xba48, 0x3d11, 0xa202, 0xe42e, 0xd022, 0x000f,
+	0xa10c, 0xf034, 0xd022, 0x003f, 0xe161, 0x0600, 0xa210, 0x3c06,
+	0x3c07, 0xa200, 0x3c08, 0x3c09, 0xe09c, 0xe09e, 0xe184, 0x1776,
+	0x2807, 0xf10a, 0xe41e, 0x0c92, 0xe42d, 0x0806, 0xe000, 0x0100,
+	0xe008, 0x00ff, 0x3c07, 0x4c09, 0xe01a, 0xe016, 0xe09e, 0xa202,
+	0x3c09, 0x2807, 0xf028, 0x2806, 0x3c06, 0xe08d, 0xa003, 0xe09d,
+	0xa803, 0xf059, 0xe085, 0xae11, 0xe056, 0x3d11, 0xe094, 0xe08e,
+	0xe42e, 0x3e08, 0x3c06, 0xa211, 0x3e07, 0xa10c, 0xf064, 0xb690,
+	0xa00c, 0x3c06, 0xa240, 0x3c07, 0x2806, 0x2a08, 0xf02b, 0xa01c,
+	0xae08, 0x3c06, 0xe0c0, 0x0041, 0xe005, 0x0034, 0xae11, 0xe042,
+	0x0806, 0xce20, 0xd111, 0x0600, 0x2807, 0xce24, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x2811, 0xa184, 0xf0ba, 0xa116, 0xf09a,
+	0xa12e, 0xf07a, 0x2824, 0xe008, 0x0003, 0xf038, 0xa200, 0xe42e,
+	0xa202, 0xe42e, 0xa202, 0x3c51, 0xe41e, 0x088b, 0xe408, 0x180a,
+	0xe41e, 0x0b48, 0xf26a, 0xa102, 0xe40a, 0x1826, 0xa108, 0xe404,
+	0x17d8, 0xe40a, 0x1826, 0xa102, 0xe40a, 0x17f0, 0xa102, 0xe40a,
+	0x17db, 0xa102, 0xe40a, 0x17e6, 0xa102, 0xe40a, 0x17fa, 0xa102,
+	0xe40a, 0x1807, 0xa102, 0xe40a, 0x1807, 0xa102, 0xe40a, 0x1811,
+	0xf082, 0x2851, 0xe40a, 0x185a, 0xe41e, 0x095c, 0xe40e, 0x1821,
+	0xe41e, 0x0923, 0xf52e, 0x2851, 0xe40a, 0x185a, 0xe41e, 0x18ab,
+	0xe41e, 0x095c, 0xe41e, 0x1ec1, 0xe40e, 0x1821, 0x2851, 0xe40a,
+	0x185a, 0xe41e, 0x18ab, 0xe41e, 0x095c, 0xe41e, 0x1eec, 0xf32e,
+	0x2851, 0xe40a, 0x185a, 0xe41e, 0x18ab, 0xe41e, 0x095c, 0xe41e,
+	0x18bf, 0xf28e, 0x2851, 0xe40a, 0x185a, 0xe41e, 0x18b2, 0xe41e,
+	0x18ab, 0xe41e, 0x095c, 0xba44, 0xe41e, 0x0cc1, 0xf1be, 0xe41e,
+	0x088b, 0xf16a, 0xe41e, 0x01db, 0x2851, 0xe408, 0x1865, 0xe40e,
+	0x185a, 0xe41e, 0x095c, 0xba0e, 0xe002, 0x00ff, 0xf058, 0xba4e,
+	0xe41e, 0x0b6c, 0xf798, 0xe41e, 0x0cc1, 0xe40e, 0x17ac, 0xe41e,
+	0x0923, 0x2851, 0xe40a, 0x185a, 0xe40e, 0x17ac, 0xe41e, 0x18ab,
+	0xe41e, 0x095c, 0x2851, 0xf10a, 0xa202, 0x3c62, 0xe41e, 0x0ccb,
+	0xe41a, 0x18b2, 0xe40a, 0x17ac, 0x284e, 0x3c92, 0x284f, 0x3c93,
+	0xa200, 0x3c51, 0xf13e, 0x284e, 0xe01a, 0x2a92, 0xe01b, 0xe05a,
+	0xf118, 0x284f, 0x1893, 0xf0e8, 0xe41e, 0x2387, 0xe40a, 0x17ac,
+	0x2801, 0xe408, 0x17ac, 0x2894, 0xf058, 0xe41e, 0x0ee3, 0xe40e,
+	0x17ac, 0xe41e, 0x0b3f, 0xa200, 0x3c51, 0xf05e, 0x284e, 0x3c92,
+	0x284f, 0x3c93, 0x2892, 0x3c4e, 0x2893, 0x3c4f, 0xa200, 0x3c51,
+	0xe41e, 0x1887, 0xf078, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xa2fe,
+	0xe42e, 0xe41e, 0x1870, 0xe41e, 0x05a9, 0xe41e, 0x1e2a, 0xf74e,
+	0xe165, 0x05e8, 0x2811, 0x3d15, 0x2857, 0x3d15, 0x2858, 0x3d15,
+	0x28eb, 0x3d15, 0x281b, 0x3d15, 0x2824, 0x3d15, 0x281f, 0x3d15,
+	0x2813, 0x3d15, 0x2816, 0x3d15, 0x2819, 0x3d15, 0xe42e, 0xe165,
+	0x05e8, 0x2811, 0x1915, 0xf1d8, 0x2857, 0x1915, 0xf1a8, 0x2858,
+	0x1915, 0xf178, 0x28eb, 0x1915, 0xf148, 0x281b, 0x1915, 0xf118,
+	0x2824, 0x1915, 0xe428, 0x281f, 0x1915, 0xe428, 0x2813, 0x1915,
+	0xe428, 0x2816, 0x1915, 0xe428, 0x2819, 0x1915, 0xe428, 0xe42e,
+	0xa202, 0x3cbd, 0xe42e, 0x28ad, 0xe428, 0xe41e, 0x0638, 0xa202,
+	0x3cad, 0xe42e, 0xa200, 0x3cad, 0xe42e, 0xc009, 0x2039, 0x4c3a,
+	0xc000, 0xe42e, 0xc009, 0x3439, 0x3c3a, 0xc000, 0xe42e, 0xa200,
+	0xba4f, 0xe042, 0xe003, 0x00ff, 0xf7cb, 0xe41e, 0x1b70, 0xa200,
+	0xba4f, 0xe042, 0xe003, 0x00ff, 0xf7cb, 0xe41e, 0x1b78, 0xf04a,
+	0xe41e, 0x18d9, 0xe42a, 0xe41e, 0x0b6c, 0xf6a8, 0xe41e, 0x0cc1,
+	0xe42e, 0xe41e, 0x1b74, 0xf13a, 0xa102, 0xf14a, 0xa104, 0xf15a,
+	0xa102, 0xf16a, 0xa102, 0xf17a, 0xa150, 0xf18a, 0xe41e, 0x1b7c,
+	0xf04a, 0xba4f, 0xa102, 0xf7e8, 0xa202, 0xe42e, 0xe41e, 0x1908,
+	0xf10e, 0xe41e, 0x1937, 0xf0de, 0xe41e, 0x1985, 0xf0ae, 0xe41e,
+	0x1996, 0xf07e, 0xe41e, 0x19e0, 0xf04e, 0xe41e, 0x19e4, 0xf01e,
+	0xe42a, 0xc868, 0xa80e, 0xe016, 0xe428, 0xe41e, 0x0cc1, 0xe42e,
+	0xbc3e, 0xf1fd, 0x1810, 0xf11a, 0x0810, 0xf084, 0xa13e, 0xf060,
+	0xa03e, 0x3c10, 0xe41e, 0x1ed9, 0x3c65, 0xa200, 0xe41e, 0x0c19,
+	0xa201, 0x3e9b, 0x2865, 0xe42a, 0x2890, 0xe161, 0x05bd, 0xe418,
+	0x192b, 0x2891, 0xe161, 0x05c2, 0xe418, 0x192b, 0xa202, 0xe42e,
+	0xa200, 0xe16a, 0xe42e, 0x2911, 0xa102, 0xcc44, 0xe184, 0x1935,
+	0x2901, 0xe41e, 0x0cb5, 0x2901, 0xe41e, 0x0cb5, 0xe42e, 0x2890,
+	0xe161, 0x05bf, 0xf038, 0xe161, 0x05c4, 0x4c91, 0xf11a, 0x2911,
+	0xe41e, 0x0cb5, 0xc009, 0x343f, 0x3c40, 0xc000, 0x2911, 0xe41e,
+	0x0cb5, 0xc009, 0x3441, 0x3c42, 0xc000, 0x2911, 0xf02e, 0xa230,
+	0x3c02, 0x2823, 0xe016, 0xe428, 0xba46, 0x3ca3, 0xa112, 0xb604,
+	0xe42a, 0xa012, 0xe049, 0xa200, 0xa107, 0xb426, 0xa105, 0xb426,
+	0xa105, 0xb5f6, 0xcc44, 0xe184, 0x1982, 0xba40, 0xf028, 0xf1be,
+	0xba42, 0xba40, 0xba48, 0xba40, 0x3c03, 0xba40, 0xba40, 0xba4e,
+	0x2803, 0xf05a, 0xba4a, 0xba4a, 0xba48, 0xf0ae, 0xba40, 0xf08a,
+	0xba4a, 0xba40, 0xf05a, 0xba4a, 0xba40, 0xf02a, 0xba48, 0x2802,
+	0xe41e, 0x0cb5, 0xe190, 0xa202, 0xe42e, 0xe41e, 0x1b7c, 0xf0da,
+	0xa102, 0xcc44, 0xe004, 0x00ff, 0xe184, 0x198f, 0xba4f, 0xe052,
+	0xe002, 0x00ff, 0xe016, 0xe42a, 0xa202, 0xe42e, 0xa202, 0xba4f,
+	0xe003, 0x00ff, 0xf039, 0xba4f, 0xa204, 0xba1f, 0xe003, 0x0031,
+	0xf049, 0xba5f, 0xa004, 0xe190, 0xba3f, 0x360e, 0x3e0f, 0xe005,
+	0x4454, 0x1a0e, 0xf069, 0xe005, 0x4731, 0x1a0f, 0xf029, 0xf24e,
+	0xe005, 0x4741, 0x1a0e, 0xf0b9, 0xe005, 0x3934, 0x1a0f, 0xf079,
+	0xba7f, 0xa008, 0xba0f, 0xa10d, 0xe40b, 0x19ca, 0xc009, 0x2a2d,
+	0xc000, 0xe045, 0xa009, 0xc009, 0x3e2d, 0xc000, 0xe41e, 0x1a73,
+	0xa202, 0xe42e, 0xba4f, 0xa002, 0xc009, 0x2a2d, 0xc000, 0xe045,
+	0xf4d1, 0xa202, 0xe42e, 0xba7e, 0xba40, 0xf098, 0xba41, 0xba4a,
+	0xf04b, 0xba46, 0xba46, 0x3cb0, 0xa202, 0xe42e, 0xa200, 0xe42e,
+	0xe41e, 0x1a73, 0xa202, 0xe42e, 0xc009, 0xa2fe, 0x3426, 0x3c27,
+	0xa201, 0x3628, 0x3e29, 0x362a, 0x3e2b, 0xc000, 0xe41e, 0x0c78,
+	0xc009, 0xe40d, 0x1a59, 0x3426, 0x3c27, 0xba40, 0xe40d, 0x1a59,
+	0xae2a, 0xe055, 0x3628, 0x3e29, 0xe408, 0x1a4f, 0xba4c, 0xe40d,
+	0x1a59, 0xae0c, 0xe055, 0xba40, 0xe40d, 0x1a59, 0xae28, 0xe055,
+	0xba4a, 0xe40d, 0x1a59, 0xe055, 0xba40, 0xe40d, 0x1a59, 0xae26,
+	0xe055, 0xba40, 0xe40d, 0x1a59, 0xae24, 0xe055, 0xba40, 0xe40d,
+	0x1a59, 0xae22, 0xe055, 0xba40, 0xe40d, 0x1a59, 0xae20, 0xe055,
+	0xba40, 0xe40d, 0x1a59, 0xae1e, 0xe055, 0xba40, 0xe40d, 0x1a59,
+	0xae1c, 0xe055, 0x3628, 0x3e29, 0xe04a, 0xaf28, 0xa802, 0xe016,
+	0xaf0d, 0xa83f, 0xa10b, 0xe01b, 0xe052, 0xf12a, 0xa201, 0xba46,
+	0xf21d, 0xae38, 0xe055, 0xba46, 0xf1dd, 0xae30, 0xe055, 0xba46,
+	0xf19d, 0xae28, 0xe055, 0xba46, 0xf15d, 0xae20, 0xe055, 0xba4e,
+	0xf11d, 0xe0c4, 0x4064, 0xf0ed, 0xe055, 0x362a, 0x3e2b, 0x2228,
+	0x4e29, 0xba40, 0xae1a, 0xe055, 0x3628, 0x3e29, 0xa202, 0xc000,
+	0xe42e, 0xc009, 0xa2fe, 0x3426, 0x3c27, 0xa200, 0x3428, 0x3c29,
+	0x342a, 0x3c2b, 0xc000, 0xe42e, 0xc009, 0x2426, 0x4c27, 0xc000,
+	0xe42e, 0xc009, 0x2428, 0x4c29, 0xc000, 0xe42e, 0xc009, 0x242a,
+	0x4c2b, 0xc000, 0xe42e, 0xe0c0, 0x0065, 0xa878, 0xa140, 0xf0ba,
+	0xe41e, 0x1b7c, 0xa102, 0xcc44, 0xe184, 0x1a7f, 0xba4e, 0xe190,
+	0xe40e, 0x1b03, 0xa201, 0xe41e, 0x1b5e, 0x2907, 0xa002, 0x3c0c,
+	0x3d17, 0xa120, 0xf6e0, 0x2b07, 0xe41e, 0x1b74, 0xf05a, 0xe41e,
+	0x1b7c, 0xe041, 0xf05e, 0x2861, 0xa002, 0xae06, 0xe041, 0xa00f,
+	0xaf07, 0xae07, 0xe04a, 0xaf1f, 0xf0db, 0xa201, 0xe41e, 0x1b5e,
+	0x8117, 0x8117, 0x2907, 0xa202, 0x3d07, 0xa201, 0xe41e, 0x1b5c,
+	0xf50e, 0x3d17, 0xa201, 0xe41e, 0x1b5c, 0xe167, 0x0600, 0xe41e,
+	0x1b74, 0x3d17, 0xe41e, 0x1b74, 0xf04a, 0xe41e, 0x1b7c, 0xf04e,
+	0x2861, 0xa002, 0xae06, 0x3d17, 0x2a0c, 0xe41e, 0x1b5c, 0xa200,
+	0x3c0b, 0xa200, 0xe167, 0x0600, 0xc703, 0x3d17, 0xe167, 0x0600,
+	0xe41e, 0x1b74, 0xf3ba, 0xe41e, 0x1b74, 0xa108, 0xf0f8, 0xe004,
+	0x4741, 0x3d17, 0xe004, 0x3934, 0x3d17, 0x28a7, 0xa008, 0x3ca7,
+	0xe41e, 0x1b7c, 0xa108, 0xe41e, 0x1b78, 0x280b, 0xa002, 0x3c0b,
+	0xba4f, 0x28a7, 0xa002, 0x3ca7, 0xa802, 0xf058, 0x280a, 0xae10,
+	0xe056, 0x3d17, 0x3e0a, 0x28a7, 0xa80e, 0xe41a, 0x1b1e, 0xe41e,
+	0x1b7c, 0x180b, 0xf6b0, 0x28a7, 0xa80e, 0xf0ea, 0x2aa7, 0xa803,
+	0xf04b, 0x280a, 0xae10, 0x3d17, 0x2aa7, 0xa00f, 0xaf07, 0xae07,
+	0x3ea7, 0xe418, 0x1b1e, 0xe40e, 0x1b1c, 0x280b, 0xa002, 0x3c0b,
+	0x2901, 0xe41e, 0x0cb5, 0x3517, 0x3d17, 0x2901, 0xe41e, 0x0cb5,
+	0x3517, 0x3d17, 0x28a7, 0xa010, 0x3ca7, 0xe41e, 0x1b1e, 0x2861,
+	0xa002, 0x180b, 0xf6b0, 0xf01a, 0xa202, 0xe42e, 0x24b7, 0x4cb8,
+	0xe000, 0x0088, 0x18a7, 0xf242, 0xe0c0, 0x0065, 0xaf12, 0xa802,
+	0xf0da, 0xa201, 0xe41e, 0x1b5e, 0x8117, 0x8117, 0x2907, 0xa202,
+	0x3d07, 0xa201, 0xe41e, 0x1b5c, 0xe42e, 0xe004, 0x0200, 0xe0c1,
+	0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x005d,
+	0xe008, 0x0200, 0xe190, 0xf7b8, 0xe004, 0x0090, 0x3ca7, 0x24b5,
+	0x4cb6, 0x08a7, 0xa110, 0xce20, 0xd111, 0x0600, 0xd112, 0x0004,
+	0xd113, 0x0000, 0xca28, 0xf7f8, 0xa200, 0xe167, 0x0600, 0xc703,
+	0x3d17, 0xe167, 0x0600, 0xe42e, 0xa200, 0xf02e, 0xa202, 0x3c0d,
+	0x24b5, 0x4cb6, 0xae07, 0xe042, 0xce20, 0xd111, 0x0600, 0xd112,
+	0x0004, 0x880d, 0x0113, 0xca28, 0xf7f8, 0xe167, 0x0600, 0xe42e,
+	0xc009, 0x3c2c, 0xc000, 0xe42e, 0xc009, 0x282c, 0xc000, 0xe42e,
+	0xc009, 0x3c2d, 0xc000, 0xe42e, 0xc009, 0x282d, 0xc000, 0xe42e,
+	0x2c39, 0x3c7b, 0xa202, 0x3c7c, 0xa200, 0x3c7d, 0x3c7e, 0x284e,
+	0xe016, 0xe428, 0x284f, 0xf0ca, 0xe41e, 0x1c11, 0xba40, 0xba40,
+	0xb7f0, 0xb634, 0x3c7c, 0xa200, 0x3c7b, 0xa202, 0xe42e, 0xba40,
+	0xf0ea, 0x2819, 0xe42a, 0xae02, 0x3c09, 0x2014, 0x4c15, 0x3400,
+	0x3c01, 0x2c39, 0x3402, 0x3c03, 0xbc0c, 0xf058, 0xa202, 0x3c7d,
+	0xe42e, 0xbc0c, 0xe40d, 0x1c0e, 0xe40a, 0x1c0c, 0xa102, 0xf0ca,
+	0xa102, 0xf1fa, 0xa102, 0xf24a, 0xa102, 0xf35a, 0xa102, 0xe40a,
+	0x1bf1, 0xe40e, 0x1bf9, 0xe41e, 0x0c78, 0xe40d, 0x1c0e, 0xa002,
+	0x1002, 0x1c03, 0xe012, 0x3c0a, 0xf032, 0x0000, 0x0c01, 0xa203,
+	0xe41e, 0x1c18, 0x2a0a, 0x3e04, 0x4c4f, 0xe41a, 0x1c30, 0xf5ae,
+	0xbc40, 0xe40d, 0x1c0e, 0xa2ff, 0xe41e, 0x1c18, 0xf53e, 0xe41e,
+	0x0c78, 0xe40d, 0x1c0e, 0xa002, 0x1002, 0x1c03, 0xe012, 0xf032,
+	0x0000, 0x0c01, 0x3c06, 0xbc20, 0xf2ad, 0x3c07, 0xe41e, 0x1c5d,
+	0xe40e, 0x1ba9, 0xbc20, 0xf23d, 0xa102, 0xe41e, 0x1c78, 0xe40e,
+	0x1ba9, 0xe41e, 0x1c11, 0xa202, 0x3c7e, 0xa200, 0x3c7b, 0xe40e,
+	0x1ba9, 0xbc20, 0xf14d, 0x3c7b, 0x287b, 0xa2ff, 0xe41e, 0x1c18,
+	0xf7c8, 0xf07e, 0x287b, 0xae02, 0xa2ff, 0xe41e, 0x1c18, 0xf7b8,
+	0xa2fe, 0x3c7c, 0xe40e, 0x1ba9, 0xa202, 0xe42e, 0xe16a, 0xa200,
+	0xe42e, 0xc410, 0xe161, 0x02f1, 0xa200, 0xc71f, 0x3d31, 0xe42e,
+	0x3c04, 0x3e05, 0xe161, 0x02f0, 0x8809, 0x0022, 0xe184, 0x1c2b,
+	0x2d11, 0x2b09, 0x1c04, 0x1a05, 0xf068, 0xf059, 0x8111, 0xa200,
+	0x3d09, 0xf05e, 0x8111, 0x8111, 0xa200, 0xe42e, 0xa202, 0xe42e,
+	0xe161, 0x02f0, 0x8809, 0x0022, 0xe184, 0x1c40, 0x2d11, 0x2b09,
+	0x1804, 0x1a05, 0xf050, 0xf049, 0x8111, 0xa200, 0x3d09, 0x8111,
+	0x8111, 0xe160, 0x0003, 0xe161, 0x02f1, 0x8809, 0x0022, 0xe184,
+	0x1c5a, 0x2909, 0xf0fa, 0x2d01, 0x2e39, 0xe045, 0xf043, 0x2214,
+	0x4e15, 0xe046, 0xae02, 0x1804, 0xf052, 0xa200, 0x8111, 0x3d01,
+	0xe42e, 0x8131, 0xe190, 0xa202, 0xe42e, 0x2807, 0xa2ff, 0xe41e,
+	0x1c18, 0xf7c8, 0xe161, 0x02f0, 0x8809, 0x0022, 0xe184, 0x1c73,
+	0x2d11, 0x2b09, 0x1c06, 0xf078, 0xf067, 0x2807, 0x3d11, 0xa2fe,
+	0x3d09, 0xf05e, 0x8111, 0x8111, 0xa200, 0xe42e, 0xa202, 0xe42e,
+	0x3c08, 0xe161, 0x02f0, 0x8809, 0x0022, 0xe184, 0x1c88, 0x2d11,
+	0x2b09, 0x1808, 0xf056, 0xf043, 0x8111, 0xa200, 0x3d09, 0x8111,
+	0x8111, 0xe42e, 0x2819, 0x1812, 0xf122, 0x2812, 0xa102, 0xcc44,
+	0xe161, 0x0202, 0xe184, 0x1c9d, 0x2911, 0xf06a, 0x2909, 0xe412,
+	0x217f, 0xa200, 0x3d11, 0xe082, 0xa006, 0xe092, 0x2819, 0xb62c,
+	0x3c12, 0x2816, 0xa104, 0xe428, 0xe41e, 0x1e2a, 0xe42e, 0x2816,
+	0xa102, 0xf044, 0xf14a, 0xe40e, 0x1cf1, 0x7417, 0xe160, 0x0903,
+	0x3d00, 0x282a, 0xe418, 0x0c92, 0xe42d, 0xe161, 0x0904, 0xe162,
+	0x0905, 0x3501, 0x3d02, 0xe41e, 0x1d42, 0xf36e, 0xa200, 0xe160,
+	0x0903, 0xe161, 0x0904, 0xe162, 0x0905, 0xe163, 0x0906, 0x3500,
+	0x3d01, 0x3502, 0x3d03, 0x2818, 0xf158, 0xe41e, 0x0c92, 0xe42d,
+	0xe164, 0x0903, 0xe165, 0x0904, 0x3504, 0x3d05, 0x282a, 0xf0aa,
+	0xe41e, 0x0c92, 0xe42d, 0xe166, 0x0905, 0xe167, 0x0906, 0x3506,
+	0x3d07, 0xe41e, 0x1d92, 0xf10e, 0xe164, 0x0903, 0xe165, 0x0904,
+	0xe166, 0x0905, 0xe167, 0x0906, 0x3504, 0x3d05, 0x3506, 0x3d07,
+	0xf03e, 0xe41e, 0x1de3, 0x2074, 0x4c75, 0x2276, 0x4e77, 0xe066,
+	0x3472, 0x3c73, 0xe42e, 0x284f, 0x4c7e, 0xe418, 0x1e2a, 0x28e5,
+	0xae02, 0xe000, 0x0578, 0xe092, 0x2072, 0x4c73, 0x3511, 0x3d11,
+	0x28e5, 0xe000, 0x059a, 0xe092, 0x2884, 0x3d11, 0x28e5, 0xa002,
+	0x3ce5, 0x28eb, 0x2a16, 0xa105, 0xb616, 0x2a21, 0xb616, 0x3c07,
+	0xe41e, 0x219c, 0xf048, 0xe41e, 0x1e2f, 0xf7be, 0xe41e, 0x21ac,
+	0xe428, 0xe41e, 0x1e2f, 0xf7be, 0x28e9, 0xf04a, 0xa102, 0x3ce9,
+	0xf14e, 0x28e8, 0xf12a, 0x28e7, 0xe000, 0x05ab, 0xe092, 0x28e7,
+	0xa002, 0x3ce7, 0xa122, 0xf028, 0x3ce7, 0x28e8, 0xa102, 0x3ce8,
+	0x2901, 0xe049, 0x1a7f, 0xe425, 0xe41e, 0x08a5, 0xe049, 0xa2fa,
+	0xb7f2, 0xe42e, 0xa202, 0x5817, 0xaf02, 0x3c06, 0x284f, 0x2a82,
+	0xf0b8, 0xf0d9, 0xe164, 0x0906, 0x2114, 0x4d14, 0xe166, 0x0908,
+	0x2316, 0x4f16, 0xf09e, 0xa200, 0xa201, 0xf06e, 0xa200, 0xe161,
+	0x090a, 0x2311, 0x4f11, 0x3400, 0x3c01, 0x3602, 0x3e03, 0xe161,
+	0x0903, 0x2f01, 0x1202, 0x1e03, 0xf071, 0xe013, 0x1e06, 0xf085,
+	0x0c06, 0x0c06, 0xf05e, 0x1e06, 0xf037, 0x1c06, 0x1c06, 0x3404,
+	0x3c05, 0xe161, 0x0903, 0x0d01, 0x3474, 0x3c75, 0xe162, 0x0904,
+	0x0112, 0x0d12, 0x3476, 0x3c77, 0x284e, 0xf14a, 0x2074, 0x4c75,
+	0xe161, 0x090a, 0x3511, 0x3d11, 0x2004, 0x4c05, 0xe164, 0x0906,
+	0x3514, 0x3d14, 0xe161, 0x0903, 0xe166, 0x0908, 0x2d01, 0x3516,
+	0x3d16, 0xe42e, 0xe41e, 0x1df4, 0xe160, 0x090b, 0x2900, 0xf34a,
+	0x2000, 0x4c01, 0x0c39, 0xf306, 0x2a4e, 0xe017, 0xe046, 0xa102,
+	0xf2b4, 0xe160, 0x090b, 0xe188, 0x000f, 0x7d00, 0x3402, 0x3c03,
+	0xe41e, 0x1e1a, 0xe163, 0x090b, 0x2903, 0xa102, 0xcc44, 0xe161,
+	0x09e0, 0xa200, 0xe184, 0x1db5, 0x0111, 0x0d11, 0xae02, 0x3404,
+	0xe008, 0xffff, 0xaf02, 0x3c05, 0x8403, 0x8204, 0xe018, 0xae1e,
+	0x8205, 0xe01c, 0xe161, 0x09e0, 0x8802, 0x0022, 0xe184, 0x1dc9,
+	0x0111, 0x0d11, 0xf02e, 0xa200, 0x2a4e, 0xf059, 0xe161, 0x0907,
+	0x0111, 0x0d11, 0xe164, 0x0903, 0x0114, 0x0d14, 0x3474, 0x3c75,
+	0xe162, 0x0909, 0x0112, 0x0d12, 0xe166, 0x0905, 0x0116, 0x0d16,
+	0x3476, 0x3c77, 0xe42e, 0xe41e, 0x1df4, 0x284f, 0xe016, 0xf08a,
+	0x2000, 0x4c01, 0x0c39, 0xae02, 0x2a4e, 0xe017, 0xe046, 0x3474,
+	0x3c75, 0x3476, 0x3c77, 0xe42e, 0x2882, 0xf09a, 0xa200, 0xe162,
+	0x0901, 0x3512, 0x3d12, 0xe161, 0x0900, 0x3d01, 0x284f, 0xe016,
+	0xf0da, 0xe162, 0x0901, 0x2112, 0x4d12, 0xe161, 0x0900, 0x2f01,
+	0x1e39, 0xf047, 0xa203, 0x5a13, 0xe042, 0x3400, 0x3c01, 0x2839,
+	0xe161, 0x0900, 0x3d01, 0x2000, 0x4c01, 0xe162, 0x0901, 0x3512,
+	0x3d12, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x0026, 0xae11, 0xe042,
+	0xce20, 0xd111, 0x09e0, 0xd112, 0x0200, 0xd113, 0x0003, 0xca28,
+	0xf7f8, 0xe42e, 0x28e5, 0xe426, 0xe41e, 0x1e2f, 0xf7ce, 0xe161,
+	0x0578, 0xe162, 0x0578, 0x2111, 0x4d11, 0xa201, 0x3e00, 0xa203,
+	0x28e5, 0xa104, 0xf0e4, 0xcc44, 0xe184, 0x1e47, 0x2112, 0x4d0a,
+	0x1111, 0x1d11, 0xf056, 0xe082, 0xa104, 0xe094, 0x3e00, 0xa003,
+	0xe084, 0xa004, 0xe092, 0x2800, 0xe000, 0x059a, 0xe098, 0xa002,
+	0xe096, 0x2904, 0x3c01, 0xe41e, 0x2186, 0x28e5, 0x1800, 0xa104,
+	0xf0a4, 0xcc44, 0xe184, 0x1e61, 0x2911, 0x3d12, 0x2911, 0x3d12,
+	0x2913, 0x3d14, 0x28e5, 0xb5f0, 0x3ce5, 0x28e6, 0xe000, 0x05ab,
+	0xe092, 0x2801, 0x3d01, 0x28e6, 0xa002, 0x3ce6, 0xa122, 0xf028,
+	0x3ce6, 0x28e8, 0xa002, 0x3ce8, 0xe42e, 0xa200, 0x3cb2, 0xe004,
+	0x0054, 0xe09c, 0x287f, 0xa102, 0xcc44, 0xe184, 0x1e8e, 0x9e06,
+	0x5cb2, 0xa802, 0xf0a8, 0x28b2, 0xe049, 0xe001, 0x0518, 0xe09f,
+	0x2b07, 0xa809, 0xe419, 0x218d, 0x2ab2, 0xa003, 0x3eb2, 0xe42e,
+	0xe004, 0x0518, 0xe09e, 0xe004, 0x0054, 0xe09c, 0x287f, 0xa102,
+	0xcc44, 0xa200, 0x3cb2, 0xe184, 0x1ea4, 0x2b17, 0xaf05, 0xa803,
+	0x5ab2, 0xe056, 0x2ab2, 0xa003, 0x3eb2, 0x9f06, 0xe42e, 0x2840,
+	0xf058, 0xe41e, 0x21c8, 0x3c3e, 0xf03e, 0x283e, 0x3c84, 0xe42e,
+	0xe161, 0x0600, 0xa200, 0x3d11, 0x3c02, 0xd022, 0x011f, 0xe184,
+	0x1ebd, 0xe41e, 0x1f9f, 0x2802, 0xa002, 0x3c02, 0xa200, 0x3c9b,
+	0xe42e, 0xba4e, 0xba40, 0xba40, 0xba40, 0xba40, 0xba46, 0xba4e,
+	0xbc3e, 0xf0dd, 0x3c00, 0x1810, 0xf038, 0xa2fe, 0x3c10, 0x2800,
+	0xe000, 0x0100, 0xe41e, 0x1f30, 0xa202, 0xe42e, 0xe16a, 0xa200,
+	0xe42e, 0xa204, 0x3c9b, 0x2810, 0xe000, 0x0100, 0xe41e, 0x1f6b,
+	0xe42a, 0xe41e, 0x1429, 0xf056, 0xe41e, 0x1c8a, 0xa202, 0xe42e,
+	0xa2fe, 0x3c10, 0xa200, 0xe42e, 0xe41e, 0x0c78, 0xf12d, 0x3c01,
+	0xe002, 0x00ff, 0xf0e0, 0x2801, 0x1829, 0xf038, 0xa2fe, 0x3c29,
+	0x28ae, 0xa802, 0x3cae, 0x2801, 0xe41e, 0x1f30, 0xa202, 0xe42e,
+	0xe16a, 0xa200, 0xe42e, 0xa202, 0x3c9b, 0x2829, 0xe41e, 0x1f6b,
+	0xf0da, 0xe41e, 0x1545, 0x3c65, 0xa200, 0xe41e, 0x0c19, 0xa201,
+	0x3e9b, 0x2865, 0xf03a, 0xa202, 0xe42e, 0xe0c1, 0x0059, 0xa107,
+	0xf079, 0x28ae, 0xa104, 0xf04a, 0x28ae, 0xa902, 0x3cae, 0xa2fe,
+	0x3c29, 0xa200, 0xe42e, 0x2860, 0xa102, 0xf06a, 0x2499, 0x4c9a,
+	0xe41e, 0x1fb9, 0xe470, 0xe41e, 0x1fd2, 0xe41e, 0x1fc0, 0xe470,
+	0x3c02, 0xe41e, 0x1fa1, 0xa200, 0x3c06, 0x2802, 0xae14, 0x3404,
+	0x3c05, 0xe41e, 0x0c14, 0x0404, 0x0c05, 0xce20, 0xd111, 0x0000,
+	0xe41e, 0x0be7, 0x1806, 0xa00e, 0xaf06, 0xae02, 0xce24, 0xd113,
+	0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa, 0xe41e, 0x0bf0, 0xf128,
+	0x2004, 0x4c05, 0xe000, 0x0200, 0x3404, 0x3c05, 0xe41e, 0x0be7,
+	0x3c06, 0xe41e, 0x09b5, 0xe41e, 0x0be7, 0xe002, 0x0400, 0xf020,
+	0xf59e, 0xe161, 0x0600, 0xa202, 0x3d11, 0xe41e, 0x0be7, 0x3d01,
+	0xe41e, 0x1f9f, 0xe42e, 0x3c02, 0xe41e, 0x1fa1, 0xe161, 0x0600,
+	0x2911, 0xe42a, 0x8111, 0x2111, 0x4d11, 0x2802, 0xae14, 0x3404,
+	0x3c05, 0x289b, 0xa102, 0xf0da, 0xe41e, 0x0c14, 0x0404, 0x0c05,
+	0xe41e, 0x1fb9, 0xa204, 0xe41e, 0x0c19, 0xe004, 0x0090, 0xf0ce,
+	0xe41e, 0x0c14, 0x0404, 0x0c05, 0xe41e, 0x1fc0, 0xa202, 0xe41e,
+	0x0c19, 0xe004, 0x0080, 0xcc66, 0xcc6a, 0xcc6e, 0xa01e, 0xcc6c,
+	0xa200, 0xcc60, 0xcc68, 0xcc70, 0xe128, 0xa202, 0xe42e, 0xa204,
+	0xf02e, 0xa206, 0x3c0a, 0xe41e, 0x1faf, 0xce20, 0xd111, 0x0600,
+	0xd112, 0x0004, 0x880a, 0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0,
+	0x0041, 0xe005, 0x002a, 0xae11, 0xe042, 0x2a02, 0xae07, 0xe042,
+	0xe42e, 0xce20, 0xa080, 0x3499, 0x3c9a, 0xd111, 0x0090, 0xf07e,
+	0xce20, 0xa080, 0xe41e, 0x1fcd, 0xd111, 0x0080, 0xd112, 0x0010,
+	0xd113, 0x0013, 0xca28, 0xf7f8, 0xe42e, 0xc009, 0x3410, 0x3c11,
+	0xc000, 0xe42e, 0xc009, 0x2410, 0x4c11, 0xc000, 0xe42e, 0x2819,
+	0xe42a, 0xa102, 0x3c00, 0x284e, 0xe01a, 0x2abe, 0xa003, 0xa803,
+	0xe052, 0xe418, 0x2096, 0xe41e, 0x20c9, 0xe41e, 0x20e7, 0xe42e,
+	0x287e, 0xf10a, 0x2074, 0x4c75, 0x1072, 0x1c73, 0x3474, 0x3c75,
+	0x2076, 0x4c77, 0x1072, 0x1c73, 0x3476, 0x3c77, 0xa200, 0x3472,
+	0x3c73, 0xa200, 0x3cbe, 0x2c39, 0x2a4f, 0x4e7e, 0xb612, 0x3c80,
+	0x2819, 0xf0ea, 0xa102, 0x3c00, 0x2839, 0x3c50, 0x287d, 0xe41a,
+	0x2071, 0xa202, 0xe418, 0x2042, 0xe41e, 0x2013, 0xe42e, 0x2884,
+	0xe41e, 0x217f, 0xe42e, 0xc420, 0xe161, 0x0202, 0x8800, 0x0022,
+	0xe184, 0x201c, 0x2901, 0xf03a, 0x8131, 0xe42e, 0xe082, 0xe002,
+	0x0202, 0xaf04, 0x3c0a, 0xa206, 0x3d09, 0x287c, 0x3d09, 0x287b,
+	0x3d31, 0x8109, 0x2884, 0x3d11, 0xe42e, 0xc420, 0xe161, 0x0202,
+	0x8800, 0x0022, 0xe184, 0x2036, 0x2901, 0xf03a, 0x8131, 0xe42e,
+	0xa206, 0x3d09, 0xa202, 0x3d09, 0x2850, 0x3d31, 0x8109, 0xa2fe,
+	0x3d11, 0xe42e, 0xa200, 0xc420, 0xe161, 0x0202, 0x8800, 0x0022,
+	0xe184, 0x204c, 0x2b31, 0xe01b, 0xe042, 0x1819, 0xe424, 0xa203,
+	0xae21, 0xe161, 0x0202, 0x8800, 0x0022, 0xe184, 0x206a, 0x2909,
+	0xf11a, 0x2909, 0xf0e6, 0x2901, 0x1c50, 0xf036, 0x1014, 0x1c15,
+	0x0c50, 0xe046, 0xf062, 0xe042, 0xe049, 0xe082, 0xa004, 0xe094,
+	0x8111, 0x8111, 0x8131, 0xa200, 0x3d12, 0x2912, 0xe412, 0x217f,
+	0xe42e, 0xe161, 0x0200, 0xe162, 0x02f0, 0x8800, 0x0022, 0xe184,
+	0x2094, 0x2912, 0x3c02, 0x2912, 0x3c03, 0xe01a, 0xb670, 0x3c04,
+	0x2804, 0x8112, 0x8112, 0xf08a, 0x2802, 0x3d11, 0x2803, 0x3d11,
+	0x2804, 0x3d11, 0xf0ae, 0x8111, 0x8111, 0x2901, 0xa201, 0x3f11,
+	0xf04a, 0x2901, 0xe412, 0x217f, 0x8111, 0xe42e, 0x284f, 0xe428,
+	0x2819, 0xe42a, 0xe41e, 0x216c, 0x4c1a, 0xe42a, 0x2c80, 0x3c50,
+	0xa200, 0x3c0f, 0x2850, 0xa002, 0x2214, 0x4e15, 0xa103, 0xe052,
+	0x3c50, 0x1c39, 0xe42a, 0x281a, 0x4caa, 0xf05a, 0xe41e, 0x2042,
+	0xe41e, 0x202d, 0x281a, 0xf6f8, 0x28ae, 0xa920, 0x3cae, 0x280f,
+	0xa002, 0x3c0f, 0xa120, 0xf062, 0xe41e, 0x05a9, 0xe41e, 0x1c11,
+	0xf62e, 0xe41e, 0x05a9, 0xe41e, 0x1e2a, 0x28ae, 0xa908, 0x3cae,
+	0xe42e, 0xe161, 0x0200, 0xe162, 0x02f0, 0x8800, 0x0022, 0xe184,
+	0x20db, 0x2911, 0x3d12, 0x2911, 0x2b11, 0xa107, 0xb612, 0x3d12,
+	0xa200, 0x3d12, 0x3d12, 0x8111, 0xe161, 0x0330, 0xe162, 0x02f0,
+	0xd022, 0x003f, 0xe184, 0x20e5, 0x2912, 0x3d11, 0xe42e, 0xe41e,
+	0x20f3, 0x2808, 0xe000, 0x0370, 0xe096, 0xe41e, 0x2134, 0x2808,
+	0x0809, 0x3c6d, 0xe42e, 0xe161, 0x0600, 0xa200, 0xc70f, 0x3d11,
+	0xa206, 0x3c05, 0xa200, 0x3c08, 0xc420, 0xe163, 0x0370, 0xa2fe,
+	0x3c06, 0xa203, 0xae21, 0xe013, 0xe161, 0x0202, 0xe162, 0x0600,
+	0x8800, 0x0022, 0xe184, 0x2123, 0x2912, 0xf168, 0x2909, 0x1805,
+	0xf124, 0x2909, 0xf0f6, 0x2901, 0x1c39, 0xf036, 0x1014, 0x1c15,
+	0x0c39, 0xe046, 0xf076, 0xe042, 0xe049, 0xe084, 0xe002, 0x0601,
+	0x3c06, 0x8111, 0x8111, 0x8131, 0x2806, 0xe424, 0xe000, 0x0600,
+	0xe094, 0xa202, 0x3d02, 0x2806, 0xae02, 0x3d13, 0x2808, 0xa002,
+	0x3c08, 0x1819, 0xf4d8, 0xe42e, 0xe161, 0x0600, 0xa200, 0xc70f,
+	0x3d11, 0xa206, 0x3c05, 0xa200, 0x3c09, 0xc420, 0xa2fe, 0x3c07,
+	0xa221, 0xe161, 0x0202, 0xe162, 0x0600, 0x8800, 0x0022, 0xe184,
+	0x215b, 0x2912, 0xf118, 0x2909, 0x1805, 0xf0d4, 0x2909, 0xf0a2,
+	0x2901, 0xe046, 0xf072, 0xe042, 0xe049, 0xe084, 0xe002, 0x0601,
+	0x3c07, 0x8111, 0x8111, 0x8131, 0x2807, 0xe424, 0xe000, 0x0600,
+	0xe094, 0xa202, 0x3d02, 0x2807, 0xae02, 0x3d13, 0x2809, 0xa002,
+	0x3c09, 0x1819, 0xf548, 0xe42e, 0x2819, 0xe426, 0xa102, 0xcc44,
+	0xc420, 0xe161, 0x0202, 0xe184, 0x2177, 0x2901, 0xe428, 0x8131,
+	0xe42e, 0xe161, 0x0518, 0xa200, 0xc71f, 0x3d11, 0xe42e, 0xe000,
+	0x0518, 0xe09e, 0x2907, 0xa80c, 0x3d07, 0xe42e, 0xe000, 0x0518,
+	0xe09e, 0x2907, 0xa80a, 0x3d07, 0xe42e, 0x3c81, 0xe000, 0x0518,
+	0xe09e, 0x2907, 0xa806, 0x3d07, 0x2881, 0xa002, 0x3c81, 0x187f,
+	0xe428, 0xa200, 0x3c81, 0xe42e, 0xe161, 0x0518, 0x287f, 0xa102,
+	0xcc44, 0xa201, 0xe184, 0x21a7, 0x2911, 0xa804, 0xe01a, 0xe041,
+	0x1a07, 0xa202, 0xb602, 0xe42e, 0xe161, 0x0518, 0x287f, 0xa102,
+	0xcc44, 0xa200, 0xe184, 0x21b7, 0x2b11, 0xa807, 0xe01b, 0xe042,
+	0x18eb, 0xa102, 0xe01a, 0xe42e, 0xe161, 0x0518, 0x287f, 0xa102,
+	0xcc44, 0xe184, 0x21c6, 0x2911, 0xe016, 0xe428, 0xe190, 0xe42e,
+	0x2881, 0x3c00, 0x2800, 0xe000, 0x0518, 0xe092, 0x2901, 0xf10a,
+	0x2800, 0xa002, 0x3c00, 0x187f, 0xf038, 0xa200, 0x3c00, 0x2800,
+	0x1881, 0xf718, 0xa200, 0x3c81, 0xa2fe, 0x3c84, 0xe42e, 0xa20e,
+	0x3d01, 0x2800, 0x3c84, 0xe42e, 0xe0c1, 0x0044, 0xa80f, 0xe056,
+	0xe42e, 0xa200, 0xe41e, 0x21e4, 0xe42e, 0xe0c1, 0x0044, 0xaf0d,
+	0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039,
+	0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0640, 0xe167,
+	0x0500, 0x287f, 0xf166, 0xa102, 0xcc44, 0xe184, 0x2227, 0xa200,
+	0xe41e, 0x21e4, 0xaf04, 0xe41e, 0x21ed, 0xae20, 0x2e66, 0xe056,
+	0x9f17, 0x2057, 0x4c58, 0xae08, 0x9f17, 0xe41e, 0x222d, 0xe190,
+	0xe190, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0,
+	0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a,
+	0xe0c0, 0x0061, 0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785,
+	0xe018, 0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db,
+	0xa200, 0xe41e, 0x21e9, 0xa80e, 0xaf04, 0xe41e, 0x21ed, 0xe41e,
+	0x21f5, 0xe40b, 0x2260, 0xa81e, 0xe41e, 0x21fa, 0xae09, 0xe056,
+	0xae20, 0xe0c1, 0x006e, 0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0,
+	0x0060, 0xa822, 0xa122, 0xf04a, 0x2057, 0x4c58, 0xf03e, 0x2058,
+	0x4c57, 0xae08, 0x9f17, 0xe0c0, 0x0062, 0x9f17, 0xe0c0, 0x0063,
+	0x9f17, 0xe0c0, 0x0064, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e,
+	0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11, 0xe042, 0xce20,
+	0xd111, 0x0640, 0xd112, 0x00c0, 0x88ec, 0x0113, 0xca29, 0xf7f9,
+	0xe190, 0xe42e, 0xa2fe, 0x3c89, 0xa200, 0x3c88, 0xe42e, 0x2856,
+	0x3c89, 0x2889, 0xf032, 0xa200, 0x3c88, 0xa200, 0x3c8d, 0x3c8e,
+	0x2857, 0x3c8b, 0x2858, 0x3c8c, 0x2888, 0xe42a, 0x2889, 0xe424,
+	0x2889, 0xe0c2, 0x0143, 0x288a, 0xe0c2, 0x0144, 0xa200, 0xe0c2,
+	0x017f, 0xe0c2, 0x0149, 0xe41e, 0x21e4, 0xe0c2, 0x017f, 0x288b,
+	0xa102, 0xae20, 0x4c8c, 0xa102, 0xe0c2, 0x0142, 0xa200, 0xae20,
+	0x2a87, 0xe042, 0xe0c2, 0x014e, 0xe42e, 0x2889, 0x2a8e, 0x1a8c,
+	0xe423, 0x288d, 0xae0e, 0x4c8e, 0xa203, 0xb615, 0x3e8f, 0x2a8f,
+	0xae03, 0xa903, 0xae1d, 0xe056, 0xe0c1, 0x014b, 0xf7e9, 0xe0c2,
+	0x014d, 0xa202, 0xe0c2, 0x014a, 0x2a8d, 0xa003, 0x3e8d, 0x1a8b,
+	0xf065, 0x2a8e, 0xa003, 0x3e8e, 0xa201, 0x3e8d, 0xe42e, 0x2888,
+	0xf15a, 0x288e, 0x188c, 0xf042, 0xe41e, 0x22c5, 0xf7be, 0xe0c0,
+	0x014b, 0xf7e8, 0xa204, 0xae1c, 0xe0c2, 0x014d, 0xa202, 0xe0c2,
+	0x014a, 0xe190, 0xe0c0, 0x014b, 0xf7e8, 0x2885, 0x3c89, 0xe42e,
+	0xe41e, 0x2375, 0xe41e, 0x0e5d, 0xe41e, 0x2331, 0xe41e, 0x24dd,
+	0xe41e, 0x0dd5, 0x282b, 0xf04a, 0xe41e, 0x10e0, 0xf20e, 0xa200,
+	0x3c59, 0x2c59, 0x1c44, 0xf1b2, 0x2c59, 0xa201, 0xe41e, 0x0f50,
+	0x2c52, 0x1c59, 0xf774, 0xf06a, 0xe41e, 0x2422, 0x2c52, 0x1c44,
+	0xf0e2, 0xe41e, 0x0ccb, 0xf6ea, 0xe41e, 0x05c6, 0xf05a, 0xe41e,
+	0x05e5, 0xe40e, 0x232e, 0xe41e, 0x2400, 0xf64e, 0xe41e, 0x2592,
+	0xe42e, 0xa202, 0xae0c, 0x2a32, 0xa83f, 0xe056, 0xae0a, 0x2a32,
+	0xa83f, 0xe056, 0xae06, 0xcf80, 0xa200, 0xae02, 0xa902, 0xae04,
+	0xcfc2, 0x282b, 0xe01a, 0xae0e, 0x4c57, 0xa102, 0xae02, 0x4c34,
+	0xae06, 0xcf00, 0xd1d3, 0x000b, 0xd185, 0x0001, 0xc420, 0xe161,
+	0x0201, 0xa200, 0xd022, 0x000f, 0xe184, 0x2358, 0x2b31, 0xae02,
+	0xb42a, 0xcfe8, 0x2072, 0x4c73, 0xcfea, 0x2074, 0x4c75, 0xcfec,
+	0x2076, 0x4c77, 0xcfee, 0xe004, 0x0060, 0xcbcf, 0xa803, 0xf03b,
+	0xe004, 0x0070, 0xce30, 0xe161, 0x0260, 0xd022, 0x001f, 0xe184,
+	0x2373, 0x2111, 0x4d11, 0xce32, 0xe42e, 0xa202, 0xe0c2, 0x013c,
+	0xa200, 0xa221, 0xd022, 0x00df, 0xe184, 0x2382, 0xe0c2, 0x013e,
+	0xe0c3, 0x013f, 0xa002, 0xa200, 0xe0c2, 0x013c, 0xe42e, 0xa200,
+	0x3c94, 0xe41e, 0x0c78, 0xe40d, 0x23fd, 0x3c52, 0x1c44, 0xe402,
+	0x23fd, 0xbc12, 0xe40d, 0x23fd, 0xa10a, 0xb4a8, 0xa104, 0xe400,
+	0x23fd, 0xbdfe, 0xe40d, 0x23fd, 0x1829, 0xf03a, 0xa202, 0x3c94,
+	0x7413, 0x1839, 0xf03a, 0xa202, 0x3c94, 0x284f, 0xf09a, 0xe41e,
+	0x0c78, 0xe40d, 0x23fd, 0x1c45, 0xf03a, 0xa202, 0x3c94, 0x2816,
+	0xa102, 0xf034, 0xf18a, 0xf33e, 0x7417, 0xe160, 0x0903, 0x1d00,
+	0xf03a, 0xa202, 0x3c94, 0x282a, 0xf2aa, 0xe41e, 0x0c92, 0xf3ed,
+	0xe161, 0x0904, 0xe162, 0x0905, 0x1101, 0x1d02, 0xf03a, 0xa202,
+	0x3c94, 0xf1de, 0x2818, 0xf1b8, 0xe41e, 0x0c92, 0xf2fd, 0xe163,
+	0x0903, 0xe164, 0x0904, 0x1103, 0x1d04, 0xf03a, 0xa202, 0x3c94,
+	0x282a, 0xf0da, 0xe41e, 0x0c92, 0xf21d, 0xe165, 0x0905, 0xe166,
+	0x0906, 0x1105, 0x1d06, 0xf03a, 0xa202, 0x3c94, 0x2835, 0xf06a,
+	0xbcfe, 0xf14d, 0xf03a, 0xa201, 0x3e94, 0x3c01, 0x2894, 0xf068,
+	0x2801, 0xf048, 0xe41e, 0x10cb, 0x3c94, 0xe41e, 0x0be7, 0xae06,
+	0xc873, 0xe046, 0xf034, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0xa200, 0xe41e, 0x0bf4, 0xe41e, 0x0bf0, 0xf068, 0xa202, 0xe41e,
+	0x08ad, 0xe41e, 0x0bf4, 0xe16a, 0x2c52, 0x3c59, 0xa200, 0x3c0c,
+	0xe41e, 0x2435, 0x2c59, 0x1c44, 0xf092, 0xe41e, 0x2450, 0xf09d,
+	0xcb86, 0xa102, 0xf780, 0xc894, 0xf768, 0xe41e, 0x0cc1, 0xe42e,
+	0xe16a, 0xe42e, 0x284f, 0xe016, 0x3c38, 0xa202, 0x3c0c, 0xe41e,
+	0x2435, 0xa200, 0x3c0c, 0x2c59, 0x180d, 0xf072, 0xe41e, 0x2479,
+	0x2c53, 0xa002, 0x3c53, 0xf78e, 0xe42e, 0xd1fa, 0x0000, 0x284b,
+	0xae0a, 0x4c4c, 0xae0a, 0x4c4d, 0xcf30, 0x2848, 0xae04, 0x4c38,
+	0xcf82, 0xd1c3, 0x0000, 0x284a, 0xcf96, 0x2848, 0xae0c, 0x4c38,
+	0xcfc4, 0x280c, 0xf03a, 0x2838, 0xf03a, 0xd188, 0x0001, 0xe42e,
+	0xd185, 0x0002, 0xd1d0, 0x003f, 0xcba0, 0xa810, 0xcba3, 0xe409,
+	0x246f, 0xf7b8, 0xe41e, 0x2555, 0xcbe0, 0xf7f8, 0x285a, 0xe41a,
+	0x2578, 0xcba0, 0xcba3, 0xe409, 0x246f, 0xf7c8, 0xd186, 0x0001,
+	0xd185, 0x0004, 0xe41e, 0x2588, 0xcb06, 0x3c59, 0xe42e, 0xd1d0,
+	0x0000, 0xd1d1, 0x0000, 0xcb1c, 0xf7f8, 0xcbe0, 0xf7f8, 0xe16b,
+	0xe42e, 0xd185, 0x0002, 0xd186, 0x0000, 0xd1c2, 0x0001, 0xd1c5,
+	0x0000, 0xd1c4, 0x0000, 0xd1d0, 0x000e, 0xcba0, 0xf7f8, 0x2054,
+	0x4c55, 0xf098, 0xd1c2, 0x0000, 0xd1c5, 0x0003, 0xd1c4, 0x0003,
+	0xd1c8, 0x0000, 0xd1d0, 0x0020, 0xe41e, 0x2555, 0xa200, 0xe0c2,
+	0x012a, 0xcbe0, 0xf7f8, 0x285a, 0xe41a, 0x2578, 0xcba0, 0xf7f8,
+	0xd186, 0x0001, 0xd185, 0x0004, 0xe41e, 0x2588, 0xcb06, 0x3c59,
+	0xe42e, 0xa200, 0xe0c2, 0x0100, 0xe0c2, 0x013d, 0xe0c2, 0x0128,
+	0xcc8e, 0x2a88, 0xb692, 0xae08, 0xa91c, 0xe0c2, 0x017c, 0xa218,
+	0xe0c2, 0x017d, 0xa200, 0xe41e, 0x21e4, 0x2a22, 0xe017, 0xae09,
+	0xe056, 0xa203, 0xae11, 0xe056, 0xe0c2, 0x0213, 0xa200, 0xe0c2,
+	0x0215, 0xa202, 0xe0c2, 0x0210, 0x2057, 0x4c58, 0xae08, 0xe0c2,
+	0x0101, 0xe0c2, 0x0205, 0xa200, 0xe41e, 0x21e4, 0x2a22, 0xe017,
+	0xae07, 0xe056, 0xe0c2, 0x0102, 0xe42e, 0xe0c0, 0x0050, 0xe049,
+	0xe008, 0x007f, 0x3c08, 0xaf11, 0xe009, 0x007f, 0x3e09, 0x4608,
+	0x3e08, 0xa200, 0x2a08, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2a08,
+	0xa805, 0xf02b, 0xa912, 0x2a08, 0xa809, 0xf02b, 0xa940, 0x2a08,
+	0xa811, 0xf02b, 0xa980, 0xe0c2, 0x040c, 0xe0c1, 0x0046, 0xe004,
+	0x0002, 0xae10, 0xe042, 0x2a09, 0xa803, 0xf05b, 0xe161, 0x05cb,
+	0x2111, 0x4d11, 0xcf0e, 0xe0c1, 0x0046, 0xe004, 0x004a, 0xae10,
+	0xe042, 0x2a09, 0xa805, 0xf05b, 0xe161, 0x05cd, 0x2111, 0x4d11,
+	0xe0c2, 0x0103, 0xe0c1, 0x0046, 0xe004, 0x007a, 0xae10, 0xe042,
+	0x2a09, 0xa809, 0xf05b, 0xe161, 0x05cf, 0x2111, 0x4d11, 0xe0c2,
+	0x0211, 0xe0c1, 0x0046, 0xe004, 0x007a, 0xe000, 0x0040, 0xae10,
+	0xe042, 0x2a09, 0xa811, 0xf05b, 0xe161, 0x05d1, 0x2111, 0x4d11,
+	0xe0c2, 0x0212, 0xa200, 0xe0c2, 0x0104, 0xe0c2, 0x0204, 0xa200,
+	0xe0c2, 0x0208, 0xe41e, 0x2596, 0xa20e, 0xe0c2, 0x0312, 0xe0c0,
+	0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a, 0x25be, 0xe41e,
+	0x0274, 0xa202, 0xe0c2, 0x0106, 0xe42e, 0xa200, 0xe0c2, 0x0113,
+	0xe0c2, 0x030d, 0xe0c2, 0x022b, 0xcb94, 0xe0c2, 0x0115, 0xcba4,
+	0xe0c2, 0x012a, 0xcb8a, 0xe0c2, 0x0114, 0xa802, 0x3c5a, 0xe42a,
+	0xcb14, 0xae0a, 0xcb19, 0xe056, 0xe0c2, 0x0120, 0xcb8c, 0xe0c2,
+	0x0121, 0xcb8e, 0xe0c2, 0x0122, 0xcb90, 0xe0c2, 0x0123, 0xe42e,
+	0xcbd0, 0xe0c2, 0x030c, 0xcbd2, 0xe0c2, 0x0309, 0xcbd8, 0xe0c2,
+	0x030a, 0xcbda, 0xe0c2, 0x030b, 0xa200, 0xe0c2, 0x0320, 0xe42e,
+	0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2, 0x0110, 0x2888, 0xe418,
+	0x22c5, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xa202, 0xe0c2,
+	0x0302, 0xd022, 0x000f, 0xe163, 0x0380, 0x2883, 0xb608, 0xe184,
+	0x25a4, 0x9f03, 0x8113, 0x8113, 0x8113, 0x2819, 0xf14a, 0xa102,
+	0xcc44, 0xe160, 0x0004, 0xe161, 0x0203, 0xe163, 0x0380, 0xe184,
+	0x25b8, 0x2931, 0xf022, 0x2883, 0xb608, 0x9f03, 0x8113, 0x8113,
+	0x8113, 0xe190, 0xa200, 0xe0c2, 0x0302, 0xe42e, 0xe167, 0x01a0,
+	0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17, 0xe009, 0x00ff, 0xae21,
+	0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101, 0xe0c3, 0x015d, 0xe162,
+	0x02b0, 0x2912, 0xaf02, 0x3c0a, 0x2912, 0xaf02, 0x3c0b, 0x280a,
+	0x180b, 0xf0d8, 0xe162, 0x02b0, 0xd022, 0x001f, 0xe184, 0x25e5,
+	0x2912, 0xaf02, 0x3c0b, 0x180a, 0xf028, 0xe190, 0x280b, 0xae02,
+	0xe41e, 0x0e94, 0xe049, 0xae11, 0x280a, 0xae02, 0xe41e, 0x0e94,
+	0xe055, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10, 0xe008, 0x001f,
+	0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0, 0x0150,
+	0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xe42e,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010,
+	0x060d, 0x0d14, 0x1414, 0x1c1c, 0x1c1c, 0x2020, 0x2025, 0x252a,
+	0x0a0e, 0x0e14, 0x1414, 0x1818, 0x1818, 0x1b1b, 0x1b1e, 0x1e22,
+	0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010,
+	0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010,
+	0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010,
+	0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010, 0x1010,
+	0x060a, 0x0a0d, 0x0b0d, 0x1010, 0x1010, 0x1212, 0x1212, 0x1217,
+	0x1717, 0x1717, 0x1719, 0x1919, 0x1919, 0x1919, 0x1b1b, 0x1b1b,
+	0x1b1b, 0x1b1b, 0x1d1d, 0x1d1d, 0x1d1d, 0x1d1f, 0x1f1f, 0x1f1f,
+	0x1f21, 0x2121, 0x2121, 0x2424, 0x2424, 0x2626, 0x2628, 0x282a,
+	0x090d, 0x0d0f, 0x0d0f, 0x1111, 0x1111, 0x1313, 0x1313, 0x1315,
+	0x1515, 0x1515, 0x1516, 0x1616, 0x1616, 0x1616, 0x1818, 0x1818,
+	0x1818, 0x1818, 0x1919, 0x1919, 0x1919, 0x191b, 0x1b1b, 0x1b1b,
+	0x1b1c, 0x1c1c, 0x1c1c, 0x1e1e, 0x1e1e, 0x2020, 0x2021, 0x2123,
+	0x0000, 0x0001, 0x0004, 0x0008, 0x0005, 0x0002, 0x0003, 0x0006,
+	0x0009, 0x000c, 0x000d, 0x000a, 0x0007, 0x000b, 0x000e, 0x000f,
+	0x0000, 0x0001, 0x0008, 0x0010, 0x0009, 0x0002, 0x0003, 0x000a,
+	0x0011, 0x0018, 0x0020, 0x0019, 0x0012, 0x000b, 0x0004, 0x0005,
+	0x000c, 0x0013, 0x001a, 0x0021, 0x0028, 0x0030, 0x0029, 0x0022,
+	0x001b, 0x0014, 0x000d, 0x0006, 0x0007, 0x000e, 0x0015, 0x001c,
+	0x0023, 0x002a, 0x0031, 0x0038, 0x0039, 0x0032, 0x002b, 0x0024,
+	0x001d, 0x0016, 0x000f, 0x0017, 0x001e, 0x0025, 0x002c, 0x0033,
+	0x003a, 0x003b, 0x0034, 0x002d, 0x0026, 0x001f, 0x0027, 0x002e,
+	0x0035, 0x003c, 0x003d, 0x0036, 0x002f, 0x0037, 0x003e, 0x003f,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c1e, 0xf0b4, 0xe04a, 0xaf10,
+	0x1857, 0xf074, 0xe009, 0x00ff, 0x1a58, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0c6b, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0368, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x036c,
+	0xe40e, 0x0370, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0380, 0xe40e, 0x00a4,
+	0xe41e, 0x03a1, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x100e,
+	0xe41e, 0x044b, 0xe41e, 0x100b, 0xe41e, 0x02ad, 0xe40e, 0x00a4,
+	0xe41e, 0x0537, 0xe40e, 0x00a4, 0xe41e, 0x053c, 0xe40e, 0x00a4,
+	0xe41e, 0x056d, 0xe40e, 0x00a4, 0xe167, 0x05cb, 0xe166, 0x0064,
+	0xd022, 0x0003, 0xe184, 0x037e, 0x9e16, 0x3517, 0x3d17, 0xe42e,
+	0xa200, 0x3c86, 0x3cad, 0x3cbe, 0xe41e, 0x0416, 0xe41e, 0x055a,
+	0xe41e, 0x0680, 0xe41e, 0x08ff, 0xe41e, 0x03a2, 0xf0dd, 0xe41e,
+	0x08b8, 0xe41a, 0x03e2, 0xa2fe, 0x3c10, 0x3c83, 0xe41e, 0x0523,
+	0xf03a, 0xa202, 0x3c86, 0xe41e, 0x0b47, 0xe41e, 0x06f0, 0xe16a,
+	0xe42e, 0xe42e, 0xa23e, 0x3cf0, 0xe41e, 0x08b8, 0xe408, 0x03bb,
+	0xe41e, 0x0b81, 0xa10e, 0xf13a, 0xa104, 0xf2ca, 0xa102, 0xf05a,
+	0xf04a, 0xe41e, 0x094c, 0xf6fe, 0xe41e, 0x08b8, 0xe408, 0x03bb,
+	0xe41e, 0x0985, 0xf68e, 0xe41e, 0x01db, 0xf23e, 0xe41e, 0x14a6,
+	0xe41e, 0x0985, 0xa2fe, 0x3c10, 0xe41e, 0x1af7, 0xf5ca, 0x2800,
+	0x3c10, 0xe41e, 0x1b12, 0xe092, 0xa200, 0xe41e, 0x0c4f, 0xa200,
+	0x3c9b, 0x28d6, 0xe41a, 0x146b, 0xa2fe, 0x3c10, 0xe082, 0xf096,
+	0xe42e, 0xe41e, 0x14ad, 0xe41e, 0x14a6, 0xe41e, 0x094c, 0xf43e,
+	0xe16b, 0xe42e, 0xe41e, 0x0b81, 0xf11a, 0xa102, 0xe40a, 0x03ff,
+	0xa108, 0xf0c4, 0xf15a, 0xa108, 0xf136, 0xa102, 0xf0aa, 0xa102,
+	0xf08a, 0xa106, 0xf0da, 0xa102, 0xf0ba, 0xe41e, 0x094c, 0xf6be,
+	0xe41e, 0x08b8, 0xe408, 0x03ff, 0xe41e, 0x0985, 0xf64e, 0xe42e,
+	0xa200, 0xe161, 0x0100, 0xe188, 0x0aff, 0x3d11, 0xe0c0, 0x0041,
+	0xe005, 0x0034, 0xae11, 0xe042, 0xce20, 0xd111, 0x0100, 0xd112,
+	0x0180, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0xe41e, 0x0400,
+	0xe41e, 0x0222, 0xe41e, 0x0148, 0xa204, 0x3cae, 0xe16a, 0xd130,
+	0x0000, 0xd03a, 0x0000, 0xd04c, 0x0000, 0xd008, 0x0000, 0xd022,
+	0x0000, 0xa200, 0xe0c2, 0x0100, 0xe0c2, 0x0128, 0xa2fe, 0x3c25,
+	0x3c26, 0x3c27, 0x3c28, 0x3c10, 0x3c29, 0x3c56, 0x3cda, 0x3cd7,
+	0xe161, 0x05c7, 0x3511, 0x3d11, 0x3511, 0x3d11, 0xe41e, 0x0c3a,
+	0xe41e, 0x1ae6, 0xe41e, 0x1fef, 0xe41e, 0x1654, 0xe41e, 0x26e2,
+	0xa200, 0x3cd8, 0xe42e, 0xa200, 0x3c86, 0xe41e, 0x0680, 0xe41e,
+	0x1aa9, 0xe41e, 0x04d9, 0xe41e, 0x0909, 0xe41e, 0x0675, 0xe41e,
+	0x0523, 0xe40a, 0x04d6, 0xe41e, 0x13a7, 0xe408, 0x0465, 0xe41e,
+	0x08b8, 0xe408, 0x04d6, 0xe40e, 0x04bd, 0xe41e, 0x020f, 0xe404,
+	0x04bd, 0xe41e, 0x0675, 0xa202, 0x3c86, 0x28bd, 0xf09a, 0xe41e,
+	0x066c, 0xa2fe, 0x3c84, 0xa202, 0x3cb4, 0xe40e, 0x04bd, 0x28a4,
+	0xf0b4, 0xa202, 0x3cb4, 0xe41e, 0x14ad, 0xe41e, 0x066c, 0xa200,
+	0x3c3a, 0xe40e, 0x04bd, 0xe41e, 0x05c8, 0xf05a, 0xe41e, 0x05ed,
+	0xe40e, 0x04ac, 0xe41e, 0x1adb, 0x2884, 0xe414, 0x066c, 0x2884,
+	0xe404, 0x04bd, 0x2884, 0xe41e, 0x2064, 0xe41e, 0x21bf, 0xe41e,
+	0x05bb, 0x28a5, 0xf128, 0x2a4e, 0x4e40, 0x2884, 0xe41b, 0x1ff5,
+	0x284e, 0xe418, 0x1c69, 0x28d6, 0xf038, 0x2a84, 0x3ed7, 0x2840,
+	0xe41a, 0x191c, 0x287e, 0x3c82, 0x2840, 0xf058, 0xe41e, 0x064f,
+	0xe41e, 0x0654, 0xe41e, 0x0659, 0xa200, 0xe41e, 0x26fc, 0x2840,
+	0xaa02, 0x443f, 0xf03a, 0xe40e, 0x045b, 0xe41e, 0x21a6, 0xe41e,
+	0x14ad, 0xe41e, 0x08d2, 0xf04a, 0xe41e, 0x1a5c, 0x3ce9, 0xe41e,
+	0x194b, 0x3c85, 0x2885, 0x3c56, 0x2884, 0xf024, 0x3c83, 0xe41e,
+	0x06f0, 0xe41e, 0x1ac4, 0xe41e, 0x0b47, 0xe42e, 0xa202, 0x3c86,
+	0xf65e, 0xa200, 0xcc4a, 0xcc4c, 0x3c53, 0x3c62, 0x3cbd, 0x3cae,
+	0x3cb4, 0x3ca5, 0x3c97, 0x3ca8, 0x3ca9, 0x28ad, 0xe41a, 0x0646,
+	0xe41e, 0x064f, 0xe41e, 0x0654, 0xe41e, 0x0659, 0xa2fe, 0x3cba,
+	0x3cbb, 0x3cb9, 0xa200, 0x3cbc, 0xa2fe, 0x3ca4, 0xa204, 0x3cf0,
+	0xa2fc, 0x3c84, 0xa2fa, 0x3c85, 0xa2fe, 0xc009, 0x3c3f, 0x3c40,
+	0x3c41, 0x3c42, 0xc000, 0xe42e, 0xa200, 0xe42e, 0xa200, 0xcc44,
+	0xd152, 0x0000, 0xd130, 0x0000, 0xd1e0, 0x0003, 0xd1ff, 0x03b0,
+	0xd1fd, 0x03d0, 0xd199, 0x0224, 0xd1fc, 0x0720, 0xd03a, 0x0000,
+	0xd04c, 0x0000, 0xd008, 0x0000, 0xd14b, 0x0200, 0x28b1, 0xcfce,
+	0xe41e, 0x025f, 0xe42e, 0xe0c0, 0x0059, 0xa102, 0xf0da, 0xe41e,
+	0x08b8, 0xf04a, 0xe41e, 0x01db, 0xf09e, 0xe41e, 0x2034, 0x2a84,
+	0xb7f5, 0x3e84, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe41e,
+	0x0680, 0xe41e, 0x2151, 0xe42e, 0xe0c0, 0x0042, 0xce20, 0xd111,
+	0x0000, 0xd112, 0x0080, 0xd113, 0x0013, 0xca28, 0xf7f8, 0xe0c0,
+	0x0061, 0xe41e, 0x0c18, 0xa202, 0xe41e, 0x0c22, 0xe41e, 0x0a1f,
+	0xe128, 0xe0c0, 0x0060, 0xf048, 0xe41e, 0x1af7, 0xf03e, 0xe41e,
+	0x1b28, 0xe42e, 0xe0c0, 0x0040, 0xa201, 0xae17, 0xe042, 0xe005,
+	0x4f00, 0xae03, 0xe042, 0xce20, 0xd111, 0x0450, 0xd112, 0x00c8,
+	0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e, 0xe180, 0xa2fe, 0x3c29,
+	0x3c10, 0xe41e, 0x1fef, 0xe41e, 0x05ab, 0x2821, 0xf05a, 0x2816,
+	0xa104, 0xf02a, 0x28ea, 0x3ce9, 0xa200, 0x3c81, 0x3ce7, 0x3ce6,
+	0x3ce8, 0x3ce5, 0xe166, 0x05ab, 0xc710, 0x3d16, 0xe167, 0x0518,
+	0xe166, 0x0054, 0xa200, 0x3cb2, 0x287f, 0xa102, 0xcc44, 0xe184,
+	0x0598, 0x9e06, 0x5cb2, 0xa802, 0xb690, 0x3d17, 0x28b2, 0xa002,
+	0x3cb2, 0xe190, 0xa200, 0x3c60, 0xe41e, 0x0c4f, 0xe42e, 0x24b5,
+	0x4cb6, 0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0xd113, 0x0000,
+	0xca28, 0xf7f8, 0xe42e, 0xe161, 0x0200, 0xa200, 0xc73f, 0x3d11,
+	0x3cb2, 0xd022, 0x001f, 0xe184, 0x05b9, 0xe41e, 0x1ff5, 0x28b2,
+	0xa002, 0x3cb2, 0xe42e, 0x2abc, 0x4e4f, 0x3ebc, 0x28a1, 0x3cb9,
+	0x2a3f, 0xf06b, 0x2a42, 0xf039, 0x3cba, 0xf02e, 0x3cbb, 0xe42e,
+	0x28a5, 0xf228, 0x28a5, 0xe016, 0x4440, 0xf1c8, 0x28a5, 0xe016,
+	0x44d6, 0xf188, 0xe41e, 0x062e, 0xf07a, 0xe41e, 0x0633, 0xf07a,
+	0x284f, 0xf108, 0xf11e, 0xe41e, 0x0638, 0xf06a, 0x28d6, 0xf0c8,
+	0x2838, 0xf0a8, 0xf07e, 0xe41e, 0x063f, 0xf04a, 0x284e, 0xf04a,
+	0xf01e, 0xa200, 0xe42e, 0xa202, 0xe42e, 0xa202, 0x3ca5, 0x2884,
+	0xe412, 0x1ff5, 0x2884, 0xe412, 0x1ffc, 0x2884, 0xe412, 0x2005,
+	0xa2fc, 0x3c84, 0x3c3e, 0xe41e, 0x0602, 0xe41e, 0x0b30, 0xe41e,
+	0x0909, 0xe42e, 0xe41e, 0x0b81, 0xf15a, 0xa102, 0xf17a, 0xa108,
+	0xf114, 0xf14a, 0xa102, 0xf0da, 0xa102, 0xf0ba, 0xa102, 0xf09a,
+	0xa102, 0xf07a, 0xa104, 0xf056, 0xa102, 0xf04a, 0xa10e, 0xf022,
+	0xe42e, 0xe41e, 0x094c, 0xe40e, 0x0602, 0xcaa2, 0xaf0a, 0xa806,
+	0x184e, 0xf0a8, 0xe41e, 0x0985, 0xe41e, 0x23c4, 0xf5ca, 0x2894,
+	0xf5aa, 0xe41e, 0x0b78, 0xe41e, 0x0b30, 0xe42e, 0xe0c0, 0x0065,
+	0xaf04, 0xa802, 0xe42e, 0xe0c0, 0x0065, 0xaf16, 0xa802, 0xe42e,
+	0xe0c0, 0x0065, 0xaf06, 0xa806, 0xa102, 0xe016, 0xe42e, 0xe0c0,
+	0x0065, 0xaf06, 0xa806, 0xa104, 0xe016, 0xe42e, 0xe41e, 0x0b30,
+	0xe0c0, 0x0048, 0xc009, 0x3433, 0x3c34, 0xc000, 0xe42e, 0xc009,
+	0x2433, 0x4c34, 0xc000, 0xe42e, 0xc009, 0x3435, 0x3c36, 0xc000,
+	0xe42e, 0xe41e, 0x0b30, 0xe0c0, 0x0048, 0xc009, 0x3437, 0x3c38,
+	0xc000, 0xe42e, 0xc009, 0x2435, 0x4c36, 0xc000, 0xe42e, 0xc009,
+	0x2437, 0x4c38, 0xc000, 0xe42e, 0xe41e, 0x0b78, 0x28ad, 0xe42a,
+	0xe41e, 0x064f, 0xe0c2, 0x0048, 0xe42e, 0xe41e, 0x20c3, 0xe41e,
+	0x20f6, 0xe41e, 0x0506, 0xe41e, 0x255a, 0xe41e, 0x2156, 0xe42e,
+	0xe0c0, 0x0059, 0xa102, 0xf2ca, 0xa102, 0xe42a, 0xa102, 0xf05a,
+	0xa102, 0xe40a, 0x06c6, 0xe42e, 0xe0c0, 0x006b, 0x34b5, 0x3cb6,
+	0xe0c0, 0x006c, 0x34b7, 0x3cb8, 0xe0c0, 0x0060, 0xaf08, 0x3088,
+	0xe0c0, 0x0060, 0xa81e, 0x3c87, 0xe0c0, 0x0061, 0xa83e, 0x3c8a,
+	0xe0c0, 0x0065, 0xa840, 0xf0ba, 0xa200, 0xe167, 0x0600, 0xc703,
+	0x3d17, 0xe41e, 0x059f, 0xe004, 0x0088, 0x3ca7, 0xe42e, 0xc001,
+	0xe0c0, 0x0060, 0x3400, 0x3c01, 0xe0c0, 0x0061, 0xae14, 0x3406,
+	0x3c07, 0xc000, 0xe0c0, 0x0062, 0xaf02, 0x3021, 0xaf02, 0x30aa,
+	0xa200, 0xe0c0, 0x0067, 0xa802, 0x3cb1, 0xe42e, 0xe41e, 0x0374,
+	0xe41e, 0x0174, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0640, 0xd112,
+	0x00c0, 0xd113, 0x0003, 0xca29, 0xf7f9, 0xa200, 0xe41e, 0x0fb1,
+	0xe004, 0x0040, 0xe41e, 0x0fb1, 0xe0c0, 0x0060, 0x3c7f, 0xe0c0,
+	0x0061, 0x3c66, 0xe0c0, 0x006e, 0xe41e, 0x020a, 0xe167, 0x05fd,
+	0xe0c0, 0x0062, 0x3517, 0x3d17, 0xe0c0, 0x0063, 0x3d17, 0xe42e,
+	0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0792, 0xa102, 0xe42a, 0xa102,
+	0xf05a, 0xa102, 0xe40a, 0x07ff, 0xe42e, 0x2861, 0xae04, 0x4c91,
+	0xae02, 0x4c90, 0xe0c2, 0x0060, 0xc009, 0x203f, 0x4c40, 0xe0c2,
+	0x0061, 0x2041, 0x4c42, 0xc000, 0xe0c2, 0x0062, 0xe41e, 0x165f,
+	0xe0c2, 0x0067, 0xe41e, 0x1664, 0xe0c2, 0x0068, 0xe41e, 0x1669,
+	0xe0c2, 0x0069, 0xe41e, 0x1654, 0x2a23, 0xe41b, 0x0841, 0x2a3f,
+	0xe419, 0x0841, 0xae02, 0x4c23, 0xe0c2, 0x006a, 0x283f, 0xf0ba,
+	0xc009, 0x203b, 0x4c3c, 0xe0c2, 0x006b, 0x203d, 0x4c3e, 0xe0c2,
+	0x006c, 0xc000, 0x2072, 0x4c73, 0xe0c2, 0x006c, 0xe41e, 0x14b0,
+	0xe0c2, 0x007b, 0x2057, 0x4c58, 0xae08, 0xe0c2, 0x006f, 0x28b0,
+	0xe0c2, 0x007a, 0x2054, 0x4c55, 0xa002, 0x3454, 0x3c55, 0xe0c2,
+	0x0070, 0x2885, 0xe0c2, 0x0071, 0x2c53, 0xe0c2, 0x0072, 0xe41e,
+	0x0800, 0xe0c2, 0x0073, 0x24a8, 0x4ca9, 0xe0c2, 0x0074, 0x2886,
+	0x2ab4, 0xae21, 0xe056, 0x2aae, 0xae23, 0xe056, 0x2abd, 0xae29,
+	0xe056, 0xe0c2, 0x0076, 0xe41e, 0x0662, 0xe0c2, 0x0051, 0xe41e,
+	0x0667, 0xe0c2, 0x0052, 0x2884, 0xe0c2, 0x0077, 0x2a22, 0xe161,
+	0x05e4, 0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0078, 0x2111,
+	0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0079, 0x2025, 0x4c26, 0xe0c2,
+	0x007c, 0xe167, 0x05c7, 0x2117, 0x4d17, 0xe0c2, 0x007e, 0x2117,
+	0x4d17, 0xe0c2, 0x007d, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2,
+	0x0053, 0xe42e, 0xe41e, 0x14b0, 0xe0c2, 0x0063, 0x2a23, 0xe41b,
+	0x0841, 0x2a3f, 0xe419, 0x0841, 0xae02, 0x4c23, 0xe0c2, 0x0064,
+	0x2027, 0x4c28, 0xe0c2, 0x006d, 0x2886, 0xe0c2, 0x0070, 0x2057,
+	0x4c58, 0xae08, 0xe0c2, 0x0071, 0x2025, 0x4c26, 0xe0c2, 0x0072,
+	0x2821, 0xf0ca, 0x2816, 0xa104, 0xf09a, 0x28eb, 0x3cb3, 0xa006,
+	0xe0c2, 0x0073, 0x28ea, 0x3ce9, 0xf07e, 0x28eb, 0xa006, 0xe0c2,
+	0x0073, 0xa200, 0x3ce9, 0x28e9, 0xe0c2, 0x0074, 0xa200, 0xe0c2,
+	0x0075, 0x2a22, 0xe161, 0x05e4, 0x2111, 0x4d11, 0xf02b, 0xae02,
+	0xe0c2, 0x0076, 0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0077,
+	0x2886, 0xe016, 0x58f0, 0xe0c2, 0x0078, 0xe161, 0x05c7, 0x2111,
+	0x4d11, 0xe0c2, 0x007a, 0x2111, 0x4d11, 0xe0c2, 0x0079, 0xe41e,
+	0x14b0, 0xaf32, 0xa802, 0xae0c, 0x2a24, 0xae05, 0xe056, 0x4c1d,
+	0xae02, 0x2a1b, 0xe017, 0xe056, 0xae10, 0x4c1f, 0xae10, 0x4c11,
+	0x2a19, 0xe01b, 0xae3f, 0xe056, 0xe0c2, 0x007b, 0xe42e, 0xe42e,
+	0x2885, 0xe41e, 0x26d1, 0xe092, 0x2842, 0xe016, 0x5440, 0x443f,
+	0x3c00, 0xa200, 0x2a40, 0xf079, 0x2aa4, 0xf053, 0x2ab9, 0xa80f,
+	0xe056, 0xf12e, 0x2a00, 0xf09b, 0x2aba, 0xa80f, 0xae07, 0xe056,
+	0x2abb, 0xa80f, 0xe056, 0xf08e, 0x2abb, 0xa80f, 0xae07, 0xe056,
+	0x2aba, 0xa80f, 0xe056, 0x3c01, 0x28a3, 0x2a23, 0xe41b, 0x0841,
+	0x2a3f, 0xe419, 0x0841, 0xae02, 0x4c23, 0xae0c, 0x4c00, 0xae04,
+	0x4c43, 0xae02, 0x4c3f, 0xae24, 0x2a3f, 0xe017, 0x4e40, 0xae1f,
+	0xe056, 0xe083, 0xae21, 0xe056, 0x2abc, 0xae0d, 0xe056, 0x4c01,
+	0xe42e, 0x283f, 0xe42a, 0x28a4, 0xf0c2, 0xc009, 0x203b, 0x4c3c,
+	0x103d, 0x1c3e, 0xc000, 0xf030, 0xa206, 0xe42e, 0xa208, 0xe42e,
+	0x2823, 0xf048, 0xa202, 0x0842, 0xe42e, 0x28a3, 0xe42e, 0x3cec,
+	0xe0c0, 0x0041, 0xe005, 0x0018, 0xae11, 0xe042, 0xce20, 0xd111,
+	0x0000, 0xd112, 0x0100, 0x88ec, 0x0113, 0xca28, 0xf7f8, 0xe42e,
+	0x8917, 0x0034, 0x8917, 0x0033, 0x8917, 0x0035, 0x8917, 0x0036,
+	0x8917, 0x0037, 0x8917, 0x0038, 0x8117, 0x8117, 0x2117, 0x4d17,
+	0xcc60, 0x2117, 0x4d17, 0xcc62, 0x2117, 0x4d17, 0xcc64, 0x2117,
+	0x4d17, 0xcc72, 0xe42e, 0x8b17, 0x0034, 0x8b17, 0x0033, 0x8b17,
+	0x0035, 0x8b17, 0x0036, 0x8b17, 0x0037, 0x8b17, 0x0038, 0x8117,
+	0x8117, 0xc860, 0x3517, 0x3d17, 0xc862, 0x3517, 0x3d17, 0xc864,
+	0x3517, 0x3d17, 0xc872, 0x3517, 0x3d17, 0xe42e, 0xc001, 0x3c13,
+	0xc000, 0xe42e, 0xc001, 0x2813, 0xc000, 0xe42e, 0xc001, 0x3c14,
+	0xc000, 0xe42e, 0xc001, 0x2814, 0xc000, 0xe42e, 0xc001, 0x2430,
+	0x4c31, 0xc000, 0xae06, 0xc873, 0xe046, 0xe422, 0xe16b, 0xe42e,
+	0xc001, 0x280c, 0xf16a, 0xe41e, 0x0b30, 0xc001, 0xe0c0, 0x0049,
+	0x340e, 0x3c0f, 0x240e, 0x4c0f, 0xe0c1, 0x0048, 0x360e, 0x3e0f,
+	0x260e, 0x4e0f, 0xe045, 0xa200, 0xb626, 0xe003, 0x0200, 0xb606,
+	0xc000, 0xe42e, 0xe41e, 0x08b8, 0xe42a, 0xe0c0, 0x0045, 0xaf04,
+	0xa802, 0xe42e, 0xc001, 0x3c33, 0xc000, 0xe42e, 0xc001, 0x2833,
+	0xc000, 0xe42e, 0xc001, 0x3c11, 0xc000, 0xe42e, 0xc001, 0x2811,
+	0xc000, 0xe42e, 0xd148, 0x0040, 0xd144, 0x0000, 0xd145, 0x0000,
+	0xd168, 0x0000, 0xd16b, 0x0000, 0xd14b, 0x0200, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xd14c, 0x000c, 0xca9a, 0xf7f8, 0xe42e, 0xc001,
+	0x2400, 0x4c01, 0x0406, 0x0c07, 0x3408, 0x3c09, 0xd071, 0x202a,
+	0xe181, 0xc001, 0xe0c0, 0x0048, 0x3415, 0x3c16, 0x280c, 0xf13a,
+	0xe0c0, 0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0xe0c1, 0x0049,
+	0x3604, 0x3e05, 0x1404, 0x1c05, 0xe0c1, 0x0045, 0xaf05, 0xa803,
+	0xb611, 0x320c, 0xe0c0, 0x0048, 0x3402, 0xe008, 0xfe00, 0x3c03,
+	0xe0c0, 0x0048, 0xe008, 0x01ff, 0x3c0b, 0xa200, 0xcc78, 0xd022,
+	0x00ff, 0xe184, 0x0934, 0xcc7a, 0xe190, 0xe41e, 0x0a1f, 0xe41e,
+	0x0a3e, 0xe41e, 0x08ea, 0xc001, 0xa200, 0x3c1a, 0x280b, 0xa102,
+	0xe412, 0x0954, 0xc001, 0xa202, 0x3c1a, 0xa200, 0xceaa, 0xc000,
+	0xa200, 0xe41e, 0x0c4f, 0xe42e, 0xcaa0, 0xe190, 0xca9a, 0xf7f8,
+	0xca9c, 0xe418, 0x0a3e, 0xe42e, 0xcc44, 0xe184, 0x095d, 0xca9c,
+	0xe418, 0x0a3e, 0xcaa0, 0xca9b, 0xf7f9, 0xe190, 0xe42e, 0xe004,
+	0x0100, 0xceb0, 0xe004, 0x00ff, 0xe014, 0xceb8, 0xd15d, 0x0000,
+	0xd15e, 0x0000, 0xd15f, 0x0000, 0xe004, 0x0019, 0xae18, 0xe00a,
+	0x0620, 0xcec0, 0xd157, 0x0000, 0xd14a, 0x0000, 0xd14c, 0x0003,
+	0xca9c, 0xe418, 0x0a3e, 0xca9a, 0xf7c8, 0xcaae, 0xa802, 0xf73a,
+	0xca9c, 0xe418, 0x0a3e, 0xa200, 0xe42e, 0xe41e, 0x095f, 0xe41e,
+	0x08b8, 0xf128, 0xe41e, 0x0b6f, 0xcaa2, 0xe008, 0x00ff, 0xe41e,
+	0x089e, 0xaf0e, 0xe418, 0x094c, 0xe41e, 0x08a2, 0xaf0e, 0xf6e8,
+	0xe41e, 0x08b8, 0xf0ea, 0xe004, 0x010b, 0xe008, 0x00ff, 0xe41e,
+	0x089e, 0xe004, 0x010b, 0xa83e, 0xe41e, 0x08a6, 0xa200, 0xe42e,
+	0xe41e, 0x08a2, 0xf058, 0xa204, 0xe41e, 0x0954, 0xf57e, 0xa206,
+	0xe41e, 0x0954, 0xe41e, 0x08a2, 0xaf0a, 0x3c4e, 0xe41e, 0x08a2,
+	0xa83e, 0xe41e, 0x08a6, 0xe41e, 0x08a2, 0xa116, 0xe42a, 0xca9c,
+	0xe418, 0x0a3e, 0xe41e, 0x08aa, 0xa10a, 0xe016, 0x3c4f, 0xe41e,
+	0x08aa, 0xa128, 0xe016, 0x3cd6, 0xf11a, 0xa200, 0xe41e, 0x0954,
+	0xe41e, 0x089e, 0xaf0e, 0xf0a8, 0xe41e, 0x08a2, 0xaf0c, 0xa802,
+	0xe016, 0x3c4f, 0xa202, 0xe41e, 0x0954, 0xe41e, 0x09e0, 0xe42e,
+	0xc001, 0xa200, 0x3c30, 0x3c31, 0x3c33, 0xe41e, 0x09ee, 0xc001,
+	0xe41e, 0x0a1f, 0xc001, 0xe128, 0xc000, 0xe42e, 0xc001, 0x2833,
+	0x4411, 0xc000, 0xae0e, 0xce92, 0xd14a, 0x0000, 0xd158, 0x0000,
+	0xe004, 0x01ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e, 0x0000,
+	0xd15f, 0x0000, 0xd161, 0x0003, 0xe004, 0x0019, 0xae18, 0xe00a,
+	0x0638, 0xcec0, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x0a3e, 0xca9a,
+	0xf7c8, 0xca9c, 0xf7a8, 0xca9e, 0xc001, 0x3c32, 0xcc92, 0xca94,
+	0x0030, 0x0c31, 0x3430, 0x3c31, 0xcc90, 0xc000, 0xe42e, 0xe004,
+	0x1495, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000, 0xd033,
+	0x0000, 0xd035, 0x0000, 0xd036, 0x007f, 0xd037, 0x0000, 0xd038,
+	0x0000, 0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000, 0xd046,
+	0x0000, 0xd047, 0x0000, 0xd149, 0x0000, 0xe42e, 0xc001, 0x280c,
+	0xf20a, 0xe41e, 0x024f, 0xc001, 0xe004, 0x0440, 0xce50, 0x280d,
+	0xa806, 0xa108, 0xe012, 0xa806, 0xae06, 0x3c40, 0xe004, 0x010b,
+	0x5840, 0xce52, 0xe41e, 0x0257, 0xc001, 0xd14e, 0x0000, 0xd144,
+	0x0000, 0x2402, 0x4c03, 0xe000, 0x0200, 0x3402, 0x3c03, 0xf3ae,
+	0xd027, 0x0000, 0x280c, 0xe41a, 0x0aa7, 0xc001, 0xd027, 0x0001,
+	0x280d, 0xf25a, 0xca48, 0xa802, 0xf7e8, 0x2402, 0x4c03, 0xce40,
+	0xd121, 0x0000, 0xd122, 0x0040, 0xe0c0, 0x0043, 0xa806, 0xae02,
+	0xa032, 0xce46, 0xe190, 0xe190, 0xe190, 0xe190, 0xca48, 0xa802,
+	0xf7e8, 0xe004, 0x0200, 0x0402, 0x0c03, 0x3402, 0x3c03, 0x1408,
+	0x1c09, 0xf054, 0x2400, 0x4c01, 0x3402, 0x3c03, 0x280c, 0xe418,
+	0x0aeb, 0xc001, 0xe41e, 0x0b30, 0xc001, 0xd14e, 0x0000, 0xd144,
+	0x0000, 0xc000, 0xe42e, 0xe0c1, 0x0059, 0xa103, 0xa200, 0xb636,
+	0xe000, 0x001c, 0xe0c1, 0x0045, 0xe052, 0xe01a, 0xe42e, 0xc001,
+	0xa200, 0x3c0a, 0xe004, 0x0200, 0x3c0d, 0xe0c0, 0x0043, 0xa808,
+	0xf338, 0xe41e, 0x0a9b, 0xc001, 0x3c0c, 0x2402, 0x4c03, 0xe0c1,
+	0x0049, 0x3604, 0x3e05, 0x2604, 0x4e05, 0xe045, 0xf033, 0x0606,
+	0x0e07, 0xe003, 0x0200, 0x280c, 0xb602, 0x3c0c, 0xf1d3, 0xe001,
+	0x0200, 0x3e0d, 0x280c, 0xf188, 0x280a, 0xe408, 0x0ab1, 0xe41e,
+	0x01db, 0xc001, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xe40a, 0x0ab1,
+	0xe0c0, 0x005d, 0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00,
+	0x3c0a, 0xe40e, 0x0ab1, 0x280d, 0x2a0c, 0xf039, 0xe004, 0x0200,
+	0x3c0d, 0xc000, 0xe42e, 0xc001, 0xe41e, 0x024f, 0xc001, 0x280d,
+	0xe002, 0x0200, 0xe40a, 0x0b2d, 0x280d, 0xa806, 0xf1fa, 0xa108,
+	0xe012, 0xae06, 0x3c40, 0x280d, 0xaf04, 0xae20, 0xe000, 0x01c0,
+	0xce50, 0xe190, 0xca52, 0x5c40, 0x5840, 0x2a0d, 0xa807, 0xae07,
+	0x3e40, 0xe005, 0x010b, 0x5e40, 0xe056, 0x2a0d, 0xaf05, 0xae21,
+	0xe001, 0x0140, 0xce51, 0xe190, 0xce52, 0xe004, 0x01fc, 0x180d,
+	0xf022, 0xf14e, 0xc001, 0x280d, 0xa006, 0xaf04, 0xae20, 0xe000,
+	0x0440, 0xce50, 0x280d, 0xa806, 0xa108, 0xe012, 0xa806, 0xae06,
+	0x3c40, 0xe004, 0x010b, 0x5840, 0xce52, 0xc000, 0xe40e, 0x0257,
+	0xc001, 0xcaaa, 0x2a1a, 0xb616, 0xe0c1, 0x0048, 0x360e, 0x3e0f,
+	0x260e, 0x4e0f, 0xe042, 0xe049, 0x1608, 0x1e09, 0xf035, 0x1406,
+	0x1c07, 0xe0c2, 0x0048, 0xa200, 0xceaa, 0xc000, 0xe42e, 0xe41e,
+	0x0b30, 0xe0c0, 0x0045, 0xaf04, 0xa806, 0xa104, 0xe428, 0xa2fc,
+	0x2a84, 0xa003, 0xb616, 0xe418, 0x0b56, 0xe42e, 0xc001, 0x3c40,
+	0xe0c0, 0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0x0840, 0xe049,
+	0x1600, 0x1e01, 0xf033, 0x0406, 0x0c07, 0xe049, 0x1608, 0x1e09,
+	0xf035, 0x1406, 0x1c07, 0xe0c2, 0x0048, 0xc000, 0xe42e, 0xe41e,
+	0x0b30, 0xc001, 0xe0c0, 0x0048, 0x3417, 0x3c18, 0xc000, 0xe42e,
+	0xa200, 0xceaa, 0xc001, 0x2417, 0x4c18, 0xc000, 0xe0c2, 0x0048,
+	0xe42e, 0xe41e, 0x095f, 0xe41e, 0x08b8, 0xf0f8, 0xcaa2, 0xe049,
+	0xa83e, 0xe009, 0x00ff, 0xf03b, 0xaf0f, 0xf04b, 0xe41e, 0x094c,
+	0xf71e, 0xe41e, 0x08b8, 0xf0aa, 0xe004, 0x010b, 0xe008, 0x00ff,
+	0xe41e, 0x089e, 0xe004, 0x010b, 0xf02e, 0xcaa2, 0xe008, 0x001f,
+	0xe41e, 0x08a6, 0xe41e, 0x08aa, 0xe42e, 0xc001, 0x2832, 0xe016,
+	0xc871, 0xa011, 0xf288, 0xaf07, 0xe009, 0x07ff, 0x2831, 0xe008,
+	0x07ff, 0xe046, 0xf16a, 0xf0ee, 0xc001, 0xe161, 0x0601, 0x2901,
+	0xc871, 0xa011, 0xaf07, 0xe009, 0x07ff, 0xe008, 0x07ff, 0xe046,
+	0xf08a, 0xe049, 0xe011, 0xaf15, 0xf0e1, 0xf0d0, 0xa200, 0xf0be,
+	0xc868, 0xa80e, 0xf028, 0xa210, 0x3c35, 0x7835, 0xa203, 0x5a35,
+	0xaf03, 0xe046, 0xc000, 0xe42e, 0xc000, 0x284e, 0x2a4f, 0x3c95,
+	0x3e96, 0xc001, 0x2831, 0x2a32, 0x3c36, 0x3e37, 0xe0c0, 0x0046,
+	0xe005, 0x0000, 0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112,
+	0x0080, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xca2c, 0xf7fa, 0xc000,
+	0xe42e, 0xc000, 0x2895, 0x2a96, 0x3c4e, 0x3e4f, 0xc001, 0x2836,
+	0x2a37, 0x3c31, 0x3e32, 0xcc90, 0xcc93, 0xa200, 0x3c30, 0x3c33,
+	0xe0c0, 0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0xce20, 0xd111,
+	0x0000, 0xd112, 0x0080, 0xd113, 0x0013, 0xca28, 0xf7f8, 0xe41e,
+	0x0a1f, 0xe128, 0xc000, 0xe42e, 0xc001, 0x2834, 0xc000, 0xe42e,
+	0xc001, 0x3430, 0x3c31, 0xc000, 0xe42e, 0xc001, 0x2430, 0x4c31,
+	0xc000, 0xe42e, 0xc001, 0x3c32, 0xc000, 0xe42e, 0xc001, 0x2832,
+	0xc000, 0xe42e, 0xc001, 0x3c10, 0xc000, 0xe42e, 0xc001, 0x2810,
+	0xc000, 0xe42e, 0xc001, 0x3c38, 0xc000, 0xe42e, 0xc001, 0x2838,
+	0xc000, 0xe42e, 0xc001, 0xe0c0, 0x0041, 0xe005, 0x0039, 0xae11,
+	0xe042, 0x3420, 0x3c21, 0xe004, 0x04e1, 0xae10, 0x3422, 0x3c23,
+	0xc000, 0xe42e, 0xc001, 0x2420, 0x4c21, 0xc000, 0xe42e, 0x3c63,
+	0xe08e, 0x3c64, 0xe41e, 0x0c5b, 0xe41e, 0x0c63, 0x2864, 0xe09e,
+	0x2863, 0x3c60, 0xe42e, 0x2860, 0xae08, 0xe000, 0x0538, 0xe09e,
+	0xe41e, 0x0883, 0xe42e, 0x2863, 0xae08, 0xe000, 0x0538, 0xe09e,
+	0xe41e, 0x0868, 0xe42e, 0x2860, 0xe408, 0x1b5f, 0xe41e, 0x0c26,
+	0xf1b8, 0xe41e, 0x08de, 0xf068, 0xe41e, 0x09ee, 0xd04c, 0x0000,
+	0xe470, 0xc896, 0xf05a, 0xe41e, 0x0c8e, 0xd04c, 0x0000, 0xe41e,
+	0x08e6, 0xe005, 0x0080, 0xb615, 0xcc6f, 0xd04b, 0x0001, 0xa202,
+	0xe41e, 0x0c2a, 0xe470, 0xd04c, 0x0000, 0xe470, 0xc001, 0xa200,
+	0x3c10, 0xe41e, 0x09ee, 0xc001, 0x2832, 0xcc96, 0x2811, 0xe016,
+	0x3c11, 0xc000, 0xe42e, 0xba0c, 0xf03a, 0xbcfc, 0xe42e, 0xba4c,
+	0xa20c, 0x3c9d, 0x289d, 0xa002, 0x3c9d, 0xa140, 0xf0d2, 0xba40,
+	0xf7aa, 0x589d, 0xa102, 0x34ab, 0x3cac, 0x289d, 0xe41e, 0x0cd8,
+	0x00ab, 0x0cac, 0xe42e, 0xe16b, 0xe42e, 0xba0c, 0xf03a, 0xbe7e,
+	0xe42e, 0xba4c, 0xa20c, 0x3c9d, 0x289d, 0xa002, 0x3c9d, 0xa140,
+	0xf162, 0xba40, 0xf7aa, 0x589d, 0xa102, 0x34ab, 0x3cac, 0x289d,
+	0xe41e, 0x0cd8, 0x00ab, 0x0cac, 0x3cac, 0x8cac, 0x0000, 0xa002,
+	0xaf02, 0xe012, 0xe42c, 0xe012, 0xe16a, 0xe42e, 0xe16b, 0xe42e,
+	0xa120, 0xf050, 0xa020, 0x3c9e, 0x749e, 0xe42e, 0x3c9e, 0xba5e,
+	0x589e, 0x769e, 0xe056, 0xe42e, 0xba40, 0xe42a, 0xc868, 0xa80e,
+	0x3c00, 0xe016, 0xe428, 0x7400, 0xe016, 0xe42e, 0x2a38, 0xa103,
+	0x282f, 0xe425, 0xf02b, 0x2830, 0xb7f4, 0xa002, 0x3c5e, 0xa104,
+	0xe424, 0xf04a, 0xa25a, 0x3c5f, 0xe42e, 0xbc0e, 0x3c00, 0xe42d,
+	0x2822, 0xf02a, 0xbc0e, 0x3c01, 0xe42d, 0x2801, 0xae06, 0x4c00,
+	0x3c5f, 0xe161, 0x0728, 0xe164, 0x0720, 0x8848, 0x0022, 0xe41e,
+	0x0d1f, 0xe42d, 0x2838, 0xa104, 0xe428, 0x2849, 0xe161, 0x0788,
+	0xe164, 0x0724, 0x8849, 0x0022, 0xe41e, 0x0d1f, 0xe42e, 0xe082,
+	0xa040, 0xe094, 0xa040, 0xe096, 0xe004, 0x00ff, 0x3c03, 0xa200,
+	0x3c05, 0x3c06, 0x3c07, 0x3c08, 0x3c09, 0xe184, 0x0d6b, 0xba40,
+	0xf0ba, 0xe0c6, 0x0080, 0x4403, 0xae10, 0xe0c7, 0x0080, 0x4603,
+	0xe056, 0x3d11, 0xf0ce, 0xa202, 0x5800, 0xae10, 0x3d11, 0x2206,
+	0x4e07, 0xa202, 0x5805, 0xe056, 0x3406, 0x3c07, 0x2822, 0xf22a,
+	0xba40, 0xf14a, 0xe0c6, 0x0080, 0x4403, 0xae10, 0xe0c7, 0x0080,
+	0x4603, 0xe056, 0x3d12, 0xe0c6, 0x0080, 0x4403, 0xae10, 0xe0c7,
+	0x0080, 0x4603, 0xe056, 0x3d13, 0xf0de, 0xa202, 0x5801, 0xae10,
+	0x3d12, 0x3d13, 0x2208, 0x4e09, 0xa202, 0x5805, 0xe056, 0x3408,
+	0x3c09, 0x2805, 0xa002, 0x3c05, 0x2006, 0x4c07, 0xe014, 0x3514,
+	0x3d14, 0x2208, 0x4e09, 0xe015, 0x3714, 0x3f14, 0xe42e, 0xe0c4,
+	0x3fff, 0xe40d, 0x0e6c, 0x3c52, 0xf048, 0xa200, 0xa2fe, 0x3ca1,
+	0x2c52, 0xe01a, 0x4451, 0xe408, 0x0e6c, 0xbc12, 0xe40d, 0x0e6c,
+	0xa10a, 0xb4a8, 0xa104, 0xe400, 0x0e6c, 0xb7b4, 0xa006, 0x3c38,
+	0x60a1, 0x3ca1, 0xbdfe, 0xe40d, 0x0e6c, 0x2a51, 0xf09b, 0xe049,
+	0x1829, 0xf06a, 0x3e29, 0xe41e, 0x1b3f, 0xe40a, 0x0e6c, 0x7413,
+	0x3c39, 0xa200, 0x3c3f, 0x3c42, 0x281b, 0xf068, 0xba40, 0x3c3f,
+	0xf03a, 0xba40, 0x3c42, 0x2851, 0xf2fa, 0x2c1e, 0x5c3f, 0x3c44,
+	0xa200, 0x3c40, 0x283a, 0xf07a, 0xe41e, 0x0e6f, 0x3c40, 0xf168,
+	0x283e, 0x3ca4, 0x283f, 0x3c3a, 0x284e, 0xe01a, 0x3c3b, 0x2839,
+	0x3c3c, 0x2842, 0x3c3d, 0xa2fc, 0x3c3e, 0x284e, 0xf098, 0x2850,
+	0x1c39, 0xf06a, 0xa202, 0x3cbe, 0xf03e, 0xa200, 0x3c3a, 0x2c52,
+	0xf038, 0x2840, 0xf018, 0x283f, 0xe016, 0x441c, 0x3c43, 0x283f,
+	0x0842, 0xb674, 0x3c41, 0x284f, 0xf06a, 0xe41e, 0x0c9b, 0xe40d,
+	0x0e6c, 0x3c45, 0xe41e, 0x18b2, 0x2835, 0xf07a, 0xe41e, 0x0c9b,
+	0xe40d, 0x0e6c, 0xe408, 0x0e6c, 0x2838, 0xa104, 0xf038, 0xba40,
+	0x3c46, 0x282c, 0x3c48, 0x282e, 0x3c49, 0x2838, 0xf0ea, 0xba40,
+	0xf0ca, 0xbc3e, 0x3c48, 0xe40d, 0x0e6c, 0x2838, 0xa104, 0xf058,
+	0xbc3e, 0x3c49, 0xe40d, 0x0e6c, 0x2851, 0xf0aa, 0x28d6, 0x444f,
+	0xf03a, 0xe41e, 0x1c57, 0xe41e, 0x1c13, 0xe41e, 0x0e8b, 0x2838,
+	0xe016, 0xe41a, 0x0e92, 0xe40a, 0x0e6c, 0xe41e, 0x0cee, 0xe40d,
+	0x0e6c, 0x2851, 0xf06a, 0xe41e, 0x177b, 0xe40a, 0x0e6c, 0xf1fe,
+	0x284e, 0xf1da, 0x284f, 0xf04a, 0xba40, 0xba40, 0xf18e, 0xba40,
+	0xf16a, 0xbc0c, 0xe40d, 0x0e6c, 0xf12a, 0xa106, 0xf08a, 0xa104,
+	0xf79a, 0xe41e, 0x0c9b, 0xe40d, 0x0e6c, 0xf74e, 0xe41e, 0x0c9b,
+	0xe40d, 0x0e6c, 0xbc40, 0xe40d, 0x0e6c, 0xf6ce, 0x2838, 0xe01a,
+	0x442d, 0xf03a, 0xbc04, 0xf29d, 0x3c47, 0xe0c6, 0x0033, 0xf25d,
+	0x0831, 0xa400, 0xa566, 0x3c4a, 0xa200, 0x3c4b, 0x3c4c, 0x3c4d,
+	0x2833, 0xf10a, 0xbc04, 0xf19d, 0x3c4b, 0xa102, 0xf0ba, 0xbe0c,
+	0xf14d, 0xae02, 0xa83e, 0x3c4c, 0xbe0c, 0xf0fd, 0xae02, 0xa83e,
+	0x3c4d, 0x282b, 0xf01a, 0x2a43, 0x2c52, 0xe419, 0x0e84, 0x3c52,
+	0x1c44, 0xf032, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0x284f,
+	0xe016, 0xe42a, 0x283f, 0xe42a, 0x283a, 0xe42a, 0x283d, 0x1842,
+	0xe42a, 0x284e, 0xf048, 0x283b, 0xe016, 0xe42e, 0x283b, 0xe42a,
+	0x283c, 0x1839, 0xe016, 0xe42e, 0xe049, 0xc70f, 0x7e57, 0xaf21,
+	0xae02, 0xe046, 0xe42e, 0xd1f3, 0x0000, 0xe162, 0x0370, 0x2912,
+	0xcfe4, 0xe42e, 0xe161, 0x0370, 0x2838, 0xa102, 0xf03a, 0xe161,
+	0x0390, 0x2848, 0x3c04, 0xe162, 0x02b0, 0xe41e, 0x0eed, 0xe42a,
+	0xd1f3, 0x0000, 0xe162, 0x02b0, 0x8848, 0x0022, 0xe184, 0x0ea9,
+	0x2912, 0xcfe4, 0x2838, 0xa104, 0xe428, 0x2849, 0x3c04, 0xe161,
+	0x03b0, 0xe162, 0x02d0, 0xe41e, 0x0eed, 0xe42a, 0xd1f3, 0x0020,
+	0xe162, 0x02d0, 0x8849, 0x0022, 0xe184, 0x0ebf, 0x2912, 0xcfe4,
+	0xe41e, 0x0fec, 0xe162, 0x02d0, 0x2902, 0xe41e, 0x0faa, 0xe41e,
+	0x0fce, 0x3470, 0x3c71, 0x2902, 0xae02, 0xe000, 0x0260, 0xe09e,
+	0x2117, 0x4d17, 0x2317, 0x4f17, 0x1072, 0x1c73, 0x1272, 0x1e73,
+	0xe010, 0xe011, 0xe046, 0xb624, 0xb608, 0x3c7a, 0x2902, 0xe41e,
+	0x0fa3, 0xa102, 0xb628, 0x3c78, 0x2902, 0xaf02, 0xe000, 0x02a0,
+	0xe09e, 0x2907, 0x3c79, 0xa202, 0xe42e, 0xe082, 0xe098, 0xba40,
+	0xf098, 0x8804, 0x0022, 0xe184, 0x0ef6, 0x2911, 0x3d12, 0xa202,
+	0xe42e, 0x286d, 0xe082, 0x3c08, 0x2014, 0x4c15, 0x583f, 0x3400,
+	0x3c01, 0x2c39, 0x583f, 0x083f, 0x3402, 0x3c03, 0x2804, 0x3c05,
+	0xe163, 0x0600, 0xa200, 0xc71f, 0x3d13, 0xbc0a, 0xe40d, 0x0f63,
+	0xf0aa, 0xa102, 0xf17a, 0xa102, 0xf26a, 0xa104, 0xf1da, 0xa102,
+	0xf1ba, 0xf38e, 0xe41e, 0x0c9b, 0xe40d, 0x0f63, 0xa002, 0x1002,
+	0x1c03, 0xe012, 0xf032, 0x0000, 0x0c01, 0x3402, 0x3c03, 0xa203,
+	0xf14e, 0xe41e, 0x0c9b, 0xe40d, 0x0f63, 0xa002, 0x0002, 0x0c03,
+	0x1000, 0x1c01, 0xf70e, 0xe41e, 0x0c9b, 0xe40d, 0x0f63, 0x283f,
+	0xa2fd, 0xf03e, 0xbc40, 0xa2ff, 0x3c0f, 0xe41e, 0x0f72, 0xf082,
+	0xa203, 0x283f, 0xf03a, 0x2a0f, 0xa803, 0x2904, 0xe046, 0x3d12,
+	0xe41e, 0x0f8e, 0x2805, 0xa102, 0x3c05, 0xa004, 0xe42a, 0xe40e,
+	0x0f0d, 0x2808, 0xa102, 0xe092, 0xe163, 0x0600, 0x2805, 0xf0a4,
+	0x2913, 0x8111, 0xf7e8, 0x2901, 0x3d12, 0x2805, 0xa102, 0x3c05,
+	0xf76e, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0x2884, 0xe424,
+	0xe0c2, 0x020b, 0xe0c2, 0x0214, 0x2884, 0xe41e, 0x0fce, 0x346e,
+	0x3c6f, 0xe42e, 0x3c06, 0x3e07, 0xe163, 0x0330, 0x2819, 0x2ad6,
+	0xb5f6, 0xe424, 0xae02, 0xa002, 0xcc44, 0xe184, 0x0f8b, 0x2d13,
+	0x2b0b, 0x1c06, 0x1a07, 0xf078, 0xf069, 0xe086, 0xe002, 0x0330,
+	0xaf02, 0xe42e, 0x8113, 0x8113, 0xa2fe, 0xe42e, 0x3c09, 0x2808,
+	0xe092, 0x286d, 0xa102, 0xcc44, 0xe184, 0x0f99, 0x2901, 0x1809,
+	0xf03a, 0x8111, 0xe42e, 0xe082, 0x1808, 0xe000, 0x0600, 0xe096,
+	0xa202, 0x3d03, 0xe42e, 0xaf02, 0xae04, 0xe000, 0x0201, 0xe09e,
+	0x2907, 0xe42e, 0xaf02, 0xae04, 0xe000, 0x0203, 0xe09e, 0x2907,
+	0xe42e, 0x3c0a, 0xe0c0, 0x0042, 0xe000, 0x0180, 0x080a, 0xa207,
+	0xe41e, 0x0fc5, 0xe0c0, 0x0041, 0xe005, 0x006c, 0xae0f, 0x0a0a,
+	0xe042, 0xa205, 0xe41e, 0x0fc5, 0xe42e, 0xce20, 0xd111, 0x0600,
+	0xd112, 0x0020, 0xce27, 0xca28, 0xf7f8, 0xe42e, 0x3c0a, 0xaf02,
+	0xae06, 0xe0c1, 0x0041, 0xe042, 0xe005, 0x006c, 0xae0f, 0xe042,
+	0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0xd113, 0x0003, 0xca28,
+	0xf7f8, 0xe004, 0x0600, 0xe09e, 0x2117, 0x4d17, 0x2a0a, 0xa803,
+	0xe42b, 0x2117, 0x4d17, 0xe42e, 0xe161, 0x0600, 0xa23e, 0xc71f,
+	0x3d11, 0x2848, 0xe000, 0x02b0, 0xe094, 0x2a48, 0x8848, 0x0022,
+	0xe184, 0x0fff, 0x290a, 0xe000, 0x0600, 0xe092, 0x3f01, 0xa103,
+	0xd1f9, 0x0000, 0xe162, 0x0600, 0xd022, 0x001f, 0xe184, 0x1009,
+	0x2912, 0xcff0, 0xe42e, 0xe41e, 0x0fec, 0xe42e, 0xd1f3, 0x0000,
+	0xe167, 0x02b0, 0xd022, 0x003f, 0xe184, 0x1017, 0x2917, 0xcfe4,
+	0xd1f9, 0x0000, 0xe167, 0x0600, 0xd022, 0x001f, 0xe184, 0x1021,
+	0x2917, 0xcff0, 0xe42e, 0xba4e, 0x3c11, 0xa200, 0x3c24, 0xd022,
+	0x0007, 0xe184, 0x1030, 0xba41, 0x5a24, 0xe056, 0x2a24, 0xa003,
+	0x3e24, 0x3c24, 0xa208, 0x3cf0, 0x2824, 0xaf0c, 0xe408, 0x113d,
+	0xa224, 0x3cf0, 0xe41e, 0x1396, 0xe40a, 0x1140, 0xa226, 0x3cf0,
+	0xba4e, 0x3c1f, 0xa112, 0xe404, 0x113d, 0xa154, 0xe400, 0x113d,
+	0xbc3e, 0x3c10, 0xa202, 0x3c22, 0xa200, 0x3c67, 0x2811, 0xa1c8,
+	0xf06a, 0xa124, 0xf04a, 0xa114, 0xf02a, 0xf33e, 0xbc06, 0x3c22,
+	0xa20a, 0x3cf0, 0xbc08, 0xe408, 0x113d, 0xa20c, 0x3cf0, 0xbc08,
+	0xe408, 0x113d, 0xba40, 0xba40, 0x3c67, 0xf23a, 0xa201, 0x3e69,
+	0x3e6b, 0xe160, 0x0000, 0xba40, 0xf11a, 0x2a69, 0xae03, 0xe056,
+	0x3c69, 0xe080, 0xe41e, 0x1341, 0x2a6b, 0xae03, 0xe056, 0x3c6b,
+	0xe080, 0xa201, 0xe41e, 0x1374, 0xf07e, 0x2a69, 0xae03, 0x3e69,
+	0x2a6b, 0xae03, 0x3e6b, 0xe080, 0xa002, 0xe090, 0xa110, 0xf648,
+	0xa20e, 0x3cf0, 0xbc18, 0xe40d, 0x113d, 0xa008, 0x3c13, 0xa202,
+	0x5813, 0x3414, 0x3c15, 0xa210, 0x3cf0, 0xbc04, 0x3c16, 0xe40d,
+	0x113d, 0xa102, 0xf034, 0xf0aa, 0xf33e, 0xa212, 0x3cf0, 0xbc18,
+	0xe40d, 0x113d, 0xa008, 0x3c17, 0xf2be, 0xba40, 0x3c18, 0xe41e,
+	0x0cb5, 0xe160, 0x0907, 0xe161, 0x0908, 0x3500, 0x3d01, 0xe41e,
+	0x0cb5, 0xe162, 0x0909, 0xe163, 0x090a, 0x3502, 0x3d03, 0xa214,
+	0x3cf0, 0xbdfe, 0xe40d, 0x113d, 0xe164, 0x090b, 0x3d04, 0xf10a,
+	0xa102, 0xcc44, 0xe162, 0x09e0, 0xe184, 0x10c9, 0xe41e, 0x0cb5,
+	0x3512, 0x3d12, 0xa216, 0x3cf0, 0xe41e, 0x126f, 0xf01e, 0xe40d,
+	0x113d, 0xa218, 0x3cf0, 0xbc20, 0xe40d, 0x113d, 0x3c19, 0xba40,
+	0x3c1a, 0xa21a, 0x3cf0, 0xbdfe, 0xe40d, 0x113d, 0xa002, 0x3c57,
+	0xa21c, 0x3cf0, 0xbdfe, 0xe40d, 0x113d, 0xa002, 0x3c58, 0x8457,
+	0x8258, 0xe018, 0x3c1e, 0xa222, 0x3cf0, 0x2c57, 0xe002, 0x0080,
+	0xe400, 0x113d, 0x2c58, 0xe002, 0x0080, 0xe400, 0x113d, 0x2c1e,
+	0xe002, 0x4000, 0xe400, 0x113d, 0xa200, 0x3c1c, 0xba40, 0x3c1b,
+	0xf098, 0xba40, 0x3c1c, 0x2858, 0xae02, 0x3c58, 0x2c1e, 0xae02,
+	0x3c1e, 0xe41e, 0x11ed, 0xa21e, 0x3cf0, 0x2a1b, 0xba40, 0xb636,
+	0x3c1d, 0xa220, 0x3cf0, 0xba40, 0xe161, 0x05e4, 0xc703, 0x3d11,
+	0xf16a, 0xe161, 0x05e4, 0xe41e, 0x0c9b, 0x3d11, 0xe41e, 0x0c9b,
+	0x3d11, 0xe41e, 0x0c9b, 0x2a1b, 0xf029, 0xae02, 0x3d11, 0xe41e,
+	0x0c9b, 0x2a1b, 0xf029, 0xae02, 0x3d11, 0xf10d, 0xa200, 0x3c90,
+	0x3c91, 0x2820, 0x3cea, 0x3ceb, 0xe41e, 0x14b5, 0xba40, 0xe016,
+	0xe41a, 0x127f, 0xf03a, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x0c9b, 0x3c29, 0xbc3e, 0xe40d, 0x11e3,
+	0x1810, 0xf11a, 0x0810, 0x3c10, 0xe41e, 0x1b12, 0x3c65, 0xa205,
+	0xae23, 0xcc9f, 0xa202, 0xe41e, 0x0c4f, 0xa203, 0x3e9b, 0x2865,
+	0xe40a, 0x11e3, 0xba40, 0x3c2d, 0xba40, 0x3c2a, 0xbc0e, 0xe40d,
+	0x11e3, 0x3c2b, 0xf03a, 0xe40d, 0x11e3, 0x282d, 0x2a2b, 0xe01b,
+	0xe052, 0xe408, 0x11e3, 0x2811, 0xa184, 0xf078, 0x282d, 0xf0aa,
+	0xe004, 0x0064, 0x3c11, 0xf06e, 0x282b, 0xf04a, 0xe004, 0x0042,
+	0x3c11, 0xbc3e, 0xe40d, 0x11e3, 0x3c2c, 0xbc3e, 0x3c2e, 0xe40d,
+	0x11e3, 0xba40, 0x3c2f, 0xba42, 0x3c30, 0xbe34, 0xe40d, 0x11e3,
+	0xa034, 0x3c31, 0xe404, 0x11e3, 0xa168, 0xe402, 0x11e3, 0xbe34,
+	0xe40d, 0x11e3, 0xa034, 0xe404, 0x11e3, 0xa168, 0xe402, 0x11e3,
+	0xbe18, 0xe40d, 0x11e3, 0x3c32, 0x3c36, 0xba40, 0x3c33, 0xba40,
+	0x3c34, 0xba40, 0x3c35, 0xa200, 0x3c37, 0x3c68, 0x2811, 0xa184,
+	0xf37a, 0x2829, 0x3c02, 0xe41e, 0x1bdd, 0xe41e, 0x0bb4, 0xf30a,
+	0xba40, 0x3c37, 0xba40, 0x3c68, 0xf28a, 0xa201, 0x3e6a, 0x3e6c,
+	0xe160, 0x0000, 0xe080, 0xa10c, 0x1837, 0x1837, 0xf132, 0xba40,
+	0xf11a, 0x2a6a, 0xae03, 0xe056, 0x3c6a, 0xe080, 0xe41e, 0x1341,
+	0x2a6c, 0xae03, 0xe056, 0x3c6c, 0xe080, 0xa203, 0xe41e, 0x1374,
+	0xf07e, 0x2a6a, 0xae03, 0x3e6a, 0x2a6c, 0xae03, 0x3e6c, 0xe080,
+	0xa002, 0xe090, 0xa110, 0xf5f8, 0xbe18, 0xf06d, 0x3c36, 0xe41e,
+	0x0ce4, 0xa202, 0xe42e, 0xe0c1, 0x0059, 0xa107, 0xf049, 0x28ae,
+	0xa902, 0x3cae, 0xe16a, 0xa200, 0xe42e, 0xa214, 0x2e1e, 0xe003,
+	0x0063, 0xf2f7, 0xa216, 0x2e1e, 0xe003, 0x018c, 0xf2a7, 0xa22a,
+	0x2e1e, 0xe003, 0x0318, 0xf257, 0xa22c, 0x2e1e, 0xe003, 0x0654,
+	0xf207, 0xa23e, 0x2e1e, 0xe003, 0x0e10, 0xf1b7, 0xa240, 0x2e1e,
+	0xe003, 0x1400, 0xf167, 0xa250, 0x2e1e, 0xe003, 0x2000, 0xf117,
+	0xa254, 0x2e1e, 0xe003, 0x2200, 0xf0c7, 0xa264, 0x2e1e, 0xe003,
+	0x5640, 0xf077, 0xa266, 0x2e1e, 0xe003, 0x9000, 0xf027, 0xa268,
+	0x2a1f, 0xe045, 0xf023, 0x3c1f, 0x2a1f, 0xa115, 0xe004, 0x0129,
+	0xf2d7, 0xa103, 0xe004, 0x02a3, 0xf297, 0xa113, 0xe004, 0x06f6,
+	0xf257, 0xa103, 0xe004, 0x0dec, 0xf217, 0xa113, 0xe004, 0x17bb,
+	0xf1d7, 0xa103, 0xe004, 0x34bc, 0xf197, 0xa103, 0xe004, 0x3c00,
+	0xf157, 0xa113, 0xe004, 0x6000, 0xf117, 0xa103, 0xe004, 0x6600,
+	0xf0d7, 0xa111, 0xe004, 0x1437, 0xae08, 0xf087, 0xa103, 0xe004,
+	0x21c0, 0xae08, 0xf037, 0xe004, 0x17bb, 0xae12, 0x3409, 0x3c0a,
+	0x841e, 0xe182, 0x0180, 0xe019, 0x2009, 0x4c0a, 0xc407, 0xd022,
+	0x000f, 0xe184, 0x1265, 0xe046, 0xf034, 0x8117, 0xe190, 0xe08e,
+	0xae02, 0x2a19, 0xae03, 0xe062, 0xa520, 0x3c20, 0xe42e, 0xe0c0,
+	0x0041, 0xe005, 0x0026, 0xae11, 0xe042, 0xce20, 0xd111, 0x09e0,
+	0xd112, 0x0200, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0xa200,
+	0x3c00, 0x3c01, 0x3c02, 0x3c03, 0x3c04, 0x3c05, 0x3c06, 0x3c07,
+	0x3c08, 0x3c09, 0x3c0a, 0xba40, 0xa2ff, 0x3e25, 0x3e26, 0xf16a,
+	0xba4e, 0xa201, 0x3e25, 0x3c26, 0xe002, 0x00ff, 0xf0f8, 0xa202,
+	0x3c07, 0xba5e, 0xba5f, 0x3c25, 0x3e26, 0xe016, 0xe017, 0xe056,
+	0xf028, 0xf04e, 0xa200, 0x3c26, 0x3c25, 0xba40, 0xf02a, 0xba40,
+	0xba40, 0x3c0a, 0xf0ca, 0xba44, 0x3c09, 0xba40, 0x3c08, 0xba40,
+	0x3c06, 0xf05a, 0xba4e, 0x3c05, 0xba4e, 0xba4e, 0xba40, 0x3c04,
+	0xf05a, 0xbc0a, 0x3c03, 0xbc0a, 0x3c02, 0xba40, 0x3c01, 0xf0ba,
+	0xba7e, 0xe161, 0x05c7, 0x3511, 0x3d11, 0xba7e, 0x3511, 0x3d11,
+	0xba40, 0x3c00, 0xba40, 0x3c90, 0xe016, 0xe161, 0x05bd, 0xe41a,
+	0x1325, 0xe40a, 0x1322, 0xba40, 0x3c91, 0xe016, 0xe161, 0x05c2,
+	0xe41a, 0x1325, 0xe40a, 0x1322, 0x2890, 0x4c91, 0xf02a, 0xba40,
+	0xba40, 0x3c23, 0xba40, 0xf08a, 0xba40, 0xbc20, 0xbc20, 0xbc20,
+	0xbc20, 0xbc20, 0xbc20, 0x28eb, 0xa120, 0xf0a0, 0x2819, 0x18eb,
+	0xf070, 0x28b3, 0xf09a, 0x287f, 0xa104, 0x18eb, 0xf052, 0x2ab3,
+	0xf029, 0x2a20, 0x3eeb, 0xa202, 0xae3e, 0x2a0a, 0xae3d, 0xe056,
+	0x2a09, 0xae37, 0xe056, 0x2a08, 0xae35, 0xe056, 0x2a07, 0xae33,
+	0xe056, 0x2a06, 0xae31, 0xe056, 0x2a05, 0xae21, 0xe056, 0x2a04,
+	0xae11, 0xe056, 0x2a03, 0xae0b, 0xe056, 0x2a02, 0xae05, 0xe056,
+	0x2a01, 0xae03, 0xe056, 0x2a00, 0xe056, 0xe41e, 0x14b5, 0xe16a,
+	0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xe41e, 0x0c9b, 0xcc44,
+	0x3c61, 0xa002, 0x3d11, 0xba46, 0xba46, 0xe184, 0x1333, 0xe41e,
+	0x0c9b, 0xe41e, 0x0c9b, 0xba40, 0xba48, 0xa002, 0x3d11, 0xba48,
+	0xa002, 0x3d11, 0xba48, 0xa002, 0x3d11, 0xba48, 0x3d11, 0xa202,
+	0xe42e, 0xd022, 0x000f, 0xa10c, 0xf034, 0xd022, 0x003f, 0xe161,
+	0x0600, 0xa210, 0x3c06, 0x3c07, 0xa200, 0x3c08, 0x3c09, 0xe09c,
+	0xe09e, 0xe184, 0x1371, 0x2807, 0xf10a, 0xe41e, 0x0cb5, 0xe42d,
+	0x0806, 0xe000, 0x0100, 0xe008, 0x00ff, 0x3c07, 0x4c09, 0xe01a,
+	0xe016, 0xe09e, 0xa202, 0x3c09, 0x2807, 0xf028, 0x2806, 0x3c06,
+	0xe08d, 0xa003, 0xe09d, 0xa803, 0xf059, 0xe085, 0xae11, 0xe056,
+	0x3d11, 0xe094, 0xe08e, 0xe42e, 0x3e08, 0x3c06, 0xa211, 0x3e07,
+	0xa10c, 0xf064, 0xb690, 0xa00c, 0x3c06, 0xa240, 0x3c07, 0x2806,
+	0x2a08, 0xf02b, 0xa01c, 0xae08, 0x3c06, 0xe0c0, 0x0041, 0xe005,
+	0x0034, 0xae11, 0xe042, 0x0806, 0xce20, 0xd111, 0x0600, 0x2807,
+	0xce24, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0x2811, 0xa184,
+	0xf0da, 0xa116, 0xf0ba, 0xa12e, 0xf09a, 0xa138, 0xf07a, 0x2824,
+	0xe008, 0x0023, 0xf038, 0xa200, 0xe42e, 0xa202, 0xe42e, 0xa202,
+	0x3c51, 0xe41e, 0x08b8, 0xe408, 0x141c, 0xe41e, 0x0b81, 0xf2ea,
+	0xa102, 0xe40a, 0x143b, 0xa108, 0xe404, 0x13dd, 0xe40a, 0x143b,
+	0xa102, 0xe40a, 0x1402, 0xa102, 0xe40a, 0x13ed, 0xa102, 0xe40a,
+	0x13f8, 0xa102, 0xe40a, 0x140c, 0xa102, 0xe40a, 0x1419, 0xa102,
+	0xe40a, 0x1419, 0xa102, 0xe40a, 0x1423, 0xa106, 0xe40a, 0x13e0,
+	0xa10a, 0xe40a, 0x1438, 0xa002, 0xa10e, 0xf082, 0x2851, 0xe40a,
+	0x144d, 0xe41e, 0x0985, 0xe40e, 0x1433, 0xe41e, 0x094c, 0xf4ae,
+	0x2851, 0xe40a, 0x144d, 0xe41e, 0x14a6, 0xe41e, 0x0985, 0xa202,
+	0x3cd6, 0xe41e, 0x1af7, 0xe40e, 0x1433, 0x2851, 0xe40a, 0x144d,
+	0xe41e, 0x14a6, 0xe41e, 0x0985, 0xe41e, 0x1af7, 0xe40e, 0x1433,
+	0x2851, 0xe40a, 0x144d, 0xe41e, 0x14a6, 0xe41e, 0x0985, 0xe41e,
+	0x1b28, 0xf32e, 0x2851, 0xe40a, 0x144d, 0xe41e, 0x14a6, 0xe41e,
+	0x0985, 0xe41e, 0x14ba, 0xf28e, 0x2851, 0xe40a, 0x144d, 0xe41e,
+	0x14ad, 0xe41e, 0x14a6, 0xe41e, 0x0985, 0xba44, 0xe41e, 0x0ce4,
+	0xf1be, 0xe41e, 0x08b8, 0xf16a, 0xe41e, 0x01db, 0x2851, 0xe408,
+	0x1456, 0xe40e, 0x144d, 0xe41e, 0x0985, 0xba0e, 0xe002, 0x00ff,
+	0xf058, 0xba4e, 0xe41e, 0x0ba5, 0xf798, 0xe41e, 0x0ce4, 0xe40e,
+	0x13a9, 0xe41e, 0x094c, 0x2851, 0xe40a, 0x144d, 0xe40e, 0x13a9,
+	0xa202, 0xe41e, 0x26fc, 0xe41e, 0x14a6, 0xe41e, 0x0985, 0xe41e,
+	0x26d7, 0xe41e, 0x0d77, 0xf048, 0xe41e, 0x26fc, 0xa200, 0xe40a,
+	0x13a9, 0x284e, 0x3c92, 0x284f, 0x3c93, 0xa200, 0x3c51, 0x28d6,
+	0xf048, 0xe41e, 0x1482, 0xf078, 0xa202, 0xe42e, 0xa200, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x146b, 0xe41e, 0x05ab, 0x28d6, 0xf098,
+	0xa202, 0xe41e, 0x26fc, 0xe41e, 0x05ab, 0xa200, 0xe41e, 0x26fc,
+	0xe41e, 0x1a5c, 0xf6ae, 0xe165, 0x05e8, 0x2811, 0x3d15, 0x2857,
+	0x3d15, 0x2858, 0x3d15, 0x28eb, 0x3d15, 0x281b, 0x3d15, 0x2824,
+	0x3d15, 0x281f, 0x3d15, 0x2813, 0x3d15, 0x2816, 0x3d15, 0x2819,
+	0x3d15, 0xe42e, 0xe165, 0x05e8, 0x2811, 0x1915, 0xf1d8, 0x2857,
+	0x1915, 0xf1a8, 0x2858, 0x1915, 0xf178, 0x28eb, 0x1915, 0xf148,
+	0x281b, 0x1915, 0xf118, 0x2824, 0x1915, 0xe428, 0x281f, 0x1915,
+	0xe428, 0x2813, 0x1915, 0xe428, 0x2816, 0x1915, 0xe428, 0x2819,
+	0x1915, 0xe428, 0xe42e, 0xa202, 0x3cbd, 0xe42e, 0x28ad, 0xe428,
+	0xe41e, 0x0646, 0xa202, 0x3cad, 0xe42e, 0xa200, 0x3cad, 0xe42e,
+	0xc009, 0x2039, 0x4c3a, 0xc000, 0xe42e, 0xc009, 0x3439, 0x3c3a,
+	0xc000, 0xe42e, 0xa200, 0xba4f, 0xe042, 0xe003, 0x00ff, 0xf7cb,
+	0xe41e, 0x176b, 0xa200, 0xba4f, 0xe042, 0xe003, 0x00ff, 0xf7cb,
+	0xe41e, 0x1773, 0xf04a, 0xe41e, 0x14d4, 0xe42a, 0xe41e, 0x0ba5,
+	0xf6a8, 0xe41e, 0x0ce4, 0xe42e, 0xe41e, 0x176f, 0xf13a, 0xa102,
+	0xf14a, 0xa104, 0xf15a, 0xa102, 0xf16a, 0xa102, 0xf17a, 0xa150,
+	0xf18a, 0xe41e, 0x1777, 0xf04a, 0xba4f, 0xa102, 0xf7e8, 0xa202,
+	0xe42e, 0xe41e, 0x1503, 0xf10e, 0xe41e, 0x1532, 0xf0de, 0xe41e,
+	0x1580, 0xf0ae, 0xe41e, 0x1591, 0xf07e, 0xe41e, 0x15db, 0xf04e,
+	0xe41e, 0x15df, 0xf01e, 0xe42a, 0xc868, 0xa80e, 0xe016, 0xe428,
+	0xe41e, 0x0ce4, 0xe42e, 0xbc3e, 0xf1fd, 0x1810, 0xf11a, 0x0810,
+	0xf084, 0xa13e, 0xf060, 0xa03e, 0x3c10, 0xe41e, 0x1b12, 0x3c65,
+	0xa200, 0xe41e, 0x0c4f, 0xa201, 0x3e9b, 0x2865, 0xe42a, 0x2890,
+	0xe161, 0x05bd, 0xe418, 0x1526, 0x2891, 0xe161, 0x05c2, 0xe418,
+	0x1526, 0xa202, 0xe42e, 0xa200, 0xe16a, 0xe42e, 0x2911, 0xa102,
+	0xcc44, 0xe184, 0x1530, 0x2901, 0xe41e, 0x0cd8, 0x2901, 0xe41e,
+	0x0cd8, 0xe42e, 0x2890, 0xe161, 0x05bf, 0xf038, 0xe161, 0x05c4,
+	0x4c91, 0xf11a, 0x2911, 0xe41e, 0x0cd8, 0xc009, 0x343f, 0x3c40,
+	0xc000, 0x2911, 0xe41e, 0x0cd8, 0xc009, 0x3441, 0x3c42, 0xc000,
+	0x2911, 0xf02e, 0xa230, 0x3c02, 0x2823, 0xe016, 0xe428, 0xba46,
+	0x3ca3, 0xa112, 0xb604, 0xe42a, 0xa012, 0xe049, 0xa200, 0xa107,
+	0xb426, 0xa105, 0xb426, 0xa105, 0xb5f6, 0xcc44, 0xe184, 0x157d,
+	0xba40, 0xf028, 0xf1be, 0xba42, 0xba40, 0xba48, 0xba40, 0x3c03,
+	0xba40, 0xba40, 0xba4e, 0x2803, 0xf05a, 0xba4a, 0xba4a, 0xba48,
+	0xf0ae, 0xba40, 0xf08a, 0xba4a, 0xba40, 0xf05a, 0xba4a, 0xba40,
+	0xf02a, 0xba48, 0x2802, 0xe41e, 0x0cd8, 0xe190, 0xa202, 0xe42e,
+	0xe41e, 0x1777, 0xf0da, 0xa102, 0xcc44, 0xe004, 0x00ff, 0xe184,
+	0x158a, 0xba4f, 0xe052, 0xe002, 0x00ff, 0xe016, 0xe42a, 0xa202,
+	0xe42e, 0xa202, 0xba4f, 0xe003, 0x00ff, 0xf039, 0xba4f, 0xa204,
+	0xba1f, 0xe003, 0x0031, 0xf049, 0xba5f, 0xa004, 0xe190, 0xba3f,
+	0x360e, 0x3e0f, 0xe005, 0x4454, 0x1a0e, 0xf069, 0xe005, 0x4731,
+	0x1a0f, 0xf029, 0xf24e, 0xe005, 0x4741, 0x1a0e, 0xf0b9, 0xe005,
+	0x3934, 0x1a0f, 0xf079, 0xba7f, 0xa008, 0xba0f, 0xa10d, 0xe40b,
+	0x15c5, 0xc009, 0x2a2d, 0xc000, 0xe045, 0xa009, 0xc009, 0x3e2d,
+	0xc000, 0xe41e, 0x166e, 0xa202, 0xe42e, 0xba4f, 0xa002, 0xc009,
+	0x2a2d, 0xc000, 0xe045, 0xf4d1, 0xa202, 0xe42e, 0xba7e, 0xba40,
+	0xf098, 0xba41, 0xba4a, 0xf04b, 0xba46, 0xba46, 0x3cb0, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe41e, 0x166e, 0xa202, 0xe42e, 0xc009,
+	0xa2fe, 0x3426, 0x3c27, 0xa201, 0x3628, 0x3e29, 0x362a, 0x3e2b,
+	0xc000, 0xe41e, 0x0c9b, 0xc009, 0xe40d, 0x1654, 0x3426, 0x3c27,
+	0xba40, 0xe40d, 0x1654, 0xae2a, 0xe055, 0x3628, 0x3e29, 0xe408,
+	0x164a, 0xba4c, 0xe40d, 0x1654, 0xae0c, 0xe055, 0xba40, 0xe40d,
+	0x1654, 0xae28, 0xe055, 0xba4a, 0xe40d, 0x1654, 0xe055, 0xba40,
+	0xe40d, 0x1654, 0xae26, 0xe055, 0xba40, 0xe40d, 0x1654, 0xae24,
+	0xe055, 0xba40, 0xe40d, 0x1654, 0xae22, 0xe055, 0xba40, 0xe40d,
+	0x1654, 0xae20, 0xe055, 0xba40, 0xe40d, 0x1654, 0xae1e, 0xe055,
+	0xba40, 0xe40d, 0x1654, 0xae1c, 0xe055, 0x3628, 0x3e29, 0xe04a,
+	0xaf28, 0xa802, 0xe016, 0xaf0d, 0xa83f, 0xa10b, 0xe01b, 0xe052,
+	0xf12a, 0xa201, 0xba46, 0xf21d, 0xae38, 0xe055, 0xba46, 0xf1dd,
+	0xae30, 0xe055, 0xba46, 0xf19d, 0xae28, 0xe055, 0xba46, 0xf15d,
+	0xae20, 0xe055, 0xba4e, 0xf11d, 0xe0c4, 0x4064, 0xf0ed, 0xe055,
+	0x362a, 0x3e2b, 0x2228, 0x4e29, 0xba40, 0xae1a, 0xe055, 0x3628,
+	0x3e29, 0xa202, 0xc000, 0xe42e, 0xc009, 0xa2fe, 0x3426, 0x3c27,
+	0xa200, 0x3428, 0x3c29, 0x342a, 0x3c2b, 0xc000, 0xe42e, 0xc009,
+	0x2426, 0x4c27, 0xc000, 0xe42e, 0xc009, 0x2428, 0x4c29, 0xc000,
+	0xe42e, 0xc009, 0x242a, 0x4c2b, 0xc000, 0xe42e, 0xe0c0, 0x0065,
+	0xa878, 0xa140, 0xf0ba, 0xe41e, 0x1777, 0xa102, 0xcc44, 0xe184,
+	0x167a, 0xba4e, 0xe190, 0xe40e, 0x16fe, 0xa201, 0xe41e, 0x1759,
+	0x2907, 0xa002, 0x3c0c, 0x3d17, 0xa120, 0xf6e0, 0x2b07, 0xe41e,
+	0x176f, 0xf05a, 0xe41e, 0x1777, 0xe041, 0xf05e, 0x2861, 0xa002,
+	0xae06, 0xe041, 0xa00f, 0xaf07, 0xae07, 0xe04a, 0xaf1f, 0xf0db,
+	0xa201, 0xe41e, 0x1759, 0x8117, 0x8117, 0x2907, 0xa202, 0x3d07,
+	0xa201, 0xe41e, 0x1757, 0xf50e, 0x3d17, 0xa201, 0xe41e, 0x1757,
+	0xe167, 0x0600, 0xe41e, 0x176f, 0x3d17, 0xe41e, 0x176f, 0xf04a,
+	0xe41e, 0x1777, 0xf04e, 0x2861, 0xa002, 0xae06, 0x3d17, 0x2a0c,
+	0xe41e, 0x1757, 0xa200, 0x3c0b, 0xa200, 0xe167, 0x0600, 0xc703,
+	0x3d17, 0xe167, 0x0600, 0xe41e, 0x176f, 0xf3ba, 0xe41e, 0x176f,
+	0xa108, 0xf0f8, 0xe004, 0x4741, 0x3d17, 0xe004, 0x3934, 0x3d17,
+	0x28a7, 0xa008, 0x3ca7, 0xe41e, 0x1777, 0xa108, 0xe41e, 0x1773,
+	0x280b, 0xa002, 0x3c0b, 0xba4f, 0x28a7, 0xa002, 0x3ca7, 0xa802,
+	0xf058, 0x280a, 0xae10, 0xe056, 0x3d17, 0x3e0a, 0x28a7, 0xa80e,
+	0xe41a, 0x1719, 0xe41e, 0x1777, 0x180b, 0xf6b0, 0x28a7, 0xa80e,
+	0xf0ea, 0x2aa7, 0xa803, 0xf04b, 0x280a, 0xae10, 0x3d17, 0x2aa7,
+	0xa00f, 0xaf07, 0xae07, 0x3ea7, 0xe418, 0x1719, 0xe40e, 0x1717,
+	0x280b, 0xa002, 0x3c0b, 0x2901, 0xe41e, 0x0cd8, 0x3517, 0x3d17,
+	0x2901, 0xe41e, 0x0cd8, 0x3517, 0x3d17, 0x28a7, 0xa010, 0x3ca7,
+	0xe41e, 0x1719, 0x2861, 0xa002, 0x180b, 0xf6b0, 0xf01a, 0xa202,
+	0xe42e, 0x24b7, 0x4cb8, 0xe000, 0x0088, 0x18a7, 0xf242, 0xe0c0,
+	0x0065, 0xaf12, 0xa802, 0xf0da, 0xa201, 0xe41e, 0x1759, 0x8117,
+	0x8117, 0x2907, 0xa202, 0x3d07, 0xa201, 0xe41e, 0x1757, 0xe42e,
+	0xe004, 0x0200, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202,
+	0xce00, 0xe0c0, 0x005d, 0xe008, 0x0200, 0xe190, 0xf7b8, 0xe004,
+	0x0090, 0x3ca7, 0x24b5, 0x4cb6, 0x08a7, 0xa110, 0xce20, 0xd111,
+	0x0600, 0xd112, 0x0004, 0xd113, 0x0000, 0xca28, 0xf7f8, 0xa200,
+	0xe167, 0x0600, 0xc703, 0x3d17, 0xe167, 0x0600, 0xe42e, 0xa200,
+	0xf02e, 0xa202, 0x3c0d, 0x24b5, 0x4cb6, 0xae07, 0xe042, 0xce20,
+	0xd111, 0x0600, 0xd112, 0x0004, 0x880d, 0x0113, 0xca28, 0xf7f8,
+	0xe167, 0x0600, 0xe42e, 0xc009, 0x3c2c, 0xc000, 0xe42e, 0xc009,
+	0x282c, 0xc000, 0xe42e, 0xc009, 0x3c2d, 0xc000, 0xe42e, 0xc009,
+	0x282d, 0xc000, 0xe42e, 0x2c39, 0x3c7b, 0xa202, 0x3c7c, 0xa200,
+	0x3c7d, 0x3c7e, 0x284e, 0xe016, 0xe428, 0x284f, 0xf0ca, 0xe41e,
+	0x181a, 0xba40, 0xba40, 0xb7f0, 0xb634, 0x3c7c, 0xa200, 0x3c7b,
+	0xa202, 0xe42e, 0xba40, 0xf11a, 0x2819, 0xe42a, 0xae02, 0x3c09,
+	0x2014, 0x4c15, 0x583f, 0x3400, 0x3c01, 0x2c39, 0x583f, 0x083f,
+	0x3402, 0x3c03, 0xbc0c, 0xf058, 0xa202, 0x3c7d, 0xe42e, 0xbc0c,
+	0xe40d, 0x1817, 0xe40a, 0x1815, 0xa102, 0xf0ca, 0xa102, 0xf1fa,
+	0xa102, 0xf24a, 0xa102, 0xf39a, 0xa102, 0xe40a, 0x17f5, 0xe40e,
+	0x17fd, 0xe41e, 0x0c9b, 0xe40d, 0x1817, 0xa002, 0x1002, 0x1c03,
+	0xe012, 0x3c0a, 0xf032, 0x0000, 0x0c01, 0xa203, 0xe41e, 0x1821,
+	0x2a0a, 0x3e04, 0x4c4f, 0xe41a, 0x1839, 0xf5ae, 0xbc40, 0xe40d,
+	0x1817, 0xa2ff, 0xe41e, 0x1821, 0xf53e, 0xe41e, 0x0c9b, 0xe40d,
+	0x1817, 0xa002, 0x1002, 0x1c03, 0xe012, 0xf032, 0x0000, 0x0c01,
+	0x3c06, 0xa802, 0x443f, 0xbc21, 0xf33d, 0x5a3f, 0xe041, 0x3e07,
+	0xe41e, 0x1868, 0xe40e, 0x17a7, 0xbc20, 0xf2ad, 0xa102, 0x583f,
+	0x083f, 0xe41e, 0x1883, 0xe40e, 0x17a7, 0xe41e, 0x181a, 0xa202,
+	0x3c7e, 0xa200, 0x3c7b, 0xe40e, 0x17a7, 0xbc20, 0xf19d, 0x3c7b,
+	0x287b, 0x583f, 0x083f, 0xa2ff, 0xe41e, 0x1821, 0xf7a8, 0x283f,
+	0xf09a, 0x2840, 0xf078, 0x287b, 0xae02, 0xa2ff, 0xe41e, 0x1821,
+	0xf7b8, 0xa2fe, 0x3c7c, 0xe40e, 0x17a7, 0xa202, 0xe42e, 0xe16a,
+	0xa200, 0xe42e, 0xc410, 0xe161, 0x02f1, 0xa200, 0xc71f, 0x3d31,
+	0xe42e, 0x3c04, 0x3e05, 0xe161, 0x02f0, 0x8809, 0x0022, 0xe184,
+	0x1834, 0x2d11, 0x2b09, 0x1c04, 0x1a05, 0xf068, 0xf059, 0x8111,
+	0xa200, 0x3d09, 0xf05e, 0x8111, 0x8111, 0xa200, 0xe42e, 0xa202,
+	0xe42e, 0xe161, 0x02f0, 0x8809, 0x0022, 0xe184, 0x1849, 0x2d11,
+	0x2b09, 0x1804, 0x1a05, 0xf050, 0xf049, 0x8111, 0xa200, 0x3d09,
+	0x8111, 0x8111, 0xe160, 0x0003, 0xe161, 0x02f1, 0x8809, 0x0022,
+	0xe184, 0x1865, 0x2909, 0xf11a, 0x2d01, 0x2e39, 0x5a3f, 0xe045,
+	0xf053, 0x2214, 0x4e15, 0x5a3f, 0xe046, 0xae02, 0x1804, 0xf052,
+	0xa200, 0x8111, 0x3d01, 0xe42e, 0x8131, 0xe190, 0xa202, 0xe42e,
+	0x2807, 0xa2ff, 0xe41e, 0x1821, 0xf7c8, 0xe161, 0x02f0, 0x8809,
+	0x0022, 0xe184, 0x187e, 0x2d11, 0x2b09, 0x1c06, 0xf078, 0xf067,
+	0x2807, 0x3d11, 0xa2fe, 0x3d09, 0xf05e, 0x8111, 0x8111, 0xa200,
+	0xe42e, 0xa202, 0xe42e, 0x3c08, 0xe161, 0x02f0, 0x8809, 0x0022,
+	0xe184, 0x1893, 0x2d11, 0x2b09, 0x1808, 0xf056, 0xf043, 0x8111,
+	0xa200, 0x3d09, 0x8111, 0x8111, 0xe42e, 0x2819, 0x1812, 0xf122,
+	0x2812, 0xa102, 0xcc44, 0xe161, 0x0202, 0xe184, 0x18a8, 0x2911,
+	0xf06a, 0x2909, 0xe412, 0x1ff5, 0xa200, 0x3d11, 0xe082, 0xa006,
+	0xe092, 0x2819, 0xb62c, 0x3c12, 0x2816, 0xa104, 0xe428, 0xe41e,
+	0x1a5c, 0xe42e, 0x2816, 0xa102, 0xf044, 0xf16a, 0xe40e, 0x1900,
+	0x7417, 0xe160, 0x0903, 0x3d00, 0x283f, 0xe016, 0x442a, 0xe418,
+	0x0cb5, 0xe42d, 0xe161, 0x0904, 0xe162, 0x0905, 0x3501, 0x3d02,
+	0xe41e, 0x1974, 0xf38e, 0xa200, 0xe160, 0x0903, 0xe161, 0x0904,
+	0xe162, 0x0905, 0xe163, 0x0906, 0x3500, 0x3d01, 0x3502, 0x3d03,
+	0x2818, 0xf178, 0xe41e, 0x0cb5, 0xe42d, 0xe164, 0x0903, 0xe165,
+	0x0904, 0x3504, 0x3d05, 0x282a, 0xf0ca, 0x283f, 0xf0a8, 0xe41e,
+	0x0cb5, 0xe42d, 0xe166, 0x0905, 0xe167, 0x0906, 0x3506, 0x3d07,
+	0xe41e, 0x19c4, 0xf10e, 0xe164, 0x0903, 0xe165, 0x0904, 0xe166,
+	0x0905, 0xe167, 0x0906, 0x3504, 0x3d05, 0x3506, 0x3d07, 0xf03e,
+	0xe41e, 0x1a15, 0x283f, 0x2a42, 0xf0f9, 0xf078, 0x2074, 0x4c75,
+	0x2276, 0x4e77, 0xe066, 0xf0ee, 0x2074, 0x4c75, 0xc009, 0x343b,
+	0x3c3c, 0xc000, 0xf07e, 0x2076, 0x4c77, 0xc009, 0x343d, 0x3c3e,
+	0xc000, 0x3472, 0x3c73, 0xe42e, 0x284f, 0x4c7e, 0xf03a, 0x28d6,
+	0xe016, 0xe418, 0x1a5c, 0x28e5, 0xae02, 0xe000, 0x0578, 0xe092,
+	0x2072, 0x4c73, 0x3511, 0x3d11, 0x28e5, 0xe000, 0x059a, 0xe092,
+	0x2884, 0x2ad8, 0xae1f, 0xe056, 0x3d11, 0x28e5, 0xa002, 0x3ce5,
+	0x28eb, 0x2a16, 0xa105, 0xb616, 0x2a21, 0xb616, 0x3c07, 0xe41e,
+	0x2014, 0xf048, 0xe41e, 0x1a61, 0xf7be, 0xe41e, 0x2024, 0xe428,
+	0xe41e, 0x1a61, 0xf7be, 0x28e9, 0xf04a, 0xa102, 0x3ce9, 0xf1fe,
+	0x28e8, 0xf1da, 0x28e7, 0xe000, 0x05ab, 0xe092, 0x28e7, 0xa002,
+	0x3ce7, 0xa124, 0xf028, 0x3ce7, 0x28e8, 0xa102, 0x3ce8, 0x2901,
+	0xe049, 0xe009, 0x8000, 0xf08b, 0x26a8, 0x4ea9, 0xa903, 0x36a8,
+	0x3ea9, 0xe008, 0x7fff, 0xe049, 0x1a7f, 0xe425, 0xe41e, 0x08d2,
+	0xe049, 0xa2fa, 0xb7f2, 0xe42e, 0xa202, 0x5817, 0xaf02, 0x3c06,
+	0x284f, 0x2a82, 0xf0b8, 0xf0d9, 0xe164, 0x0906, 0x2114, 0x4d14,
+	0xe166, 0x0908, 0x2316, 0x4f16, 0xf09e, 0xa200, 0xa201, 0xf06e,
+	0xa200, 0xe161, 0x090a, 0x2311, 0x4f11, 0x3400, 0x3c01, 0x3602,
+	0x3e03, 0xe161, 0x0903, 0x2f01, 0x1202, 0x1e03, 0xf071, 0xe013,
+	0x1e06, 0xf085, 0x0c06, 0x0c06, 0xf05e, 0x1e06, 0xf037, 0x1c06,
+	0x1c06, 0x3404, 0x3c05, 0xe161, 0x0903, 0x0d01, 0x3474, 0x3c75,
+	0xe162, 0x0904, 0x0112, 0x0d12, 0x3476, 0x3c77, 0x284e, 0xf14a,
+	0x2074, 0x4c75, 0xe161, 0x090a, 0x3511, 0x3d11, 0x2004, 0x4c05,
+	0xe164, 0x0906, 0x3514, 0x3d14, 0xe161, 0x0903, 0xe166, 0x0908,
+	0x2d01, 0x3516, 0x3d16, 0xe42e, 0xe41e, 0x1a26, 0xe160, 0x090b,
+	0x2900, 0xf34a, 0x2000, 0x4c01, 0x0c39, 0xf306, 0x2a4e, 0xe017,
+	0xe046, 0xa102, 0xf2b4, 0xe160, 0x090b, 0xe188, 0x000f, 0x7d00,
+	0x3402, 0x3c03, 0xe41e, 0x1a4c, 0xe163, 0x090b, 0x2903, 0xa102,
+	0xcc44, 0xe161, 0x09e0, 0xa200, 0xe184, 0x19e7, 0x0111, 0x0d11,
+	0xae02, 0x3404, 0xe008, 0xffff, 0xaf02, 0x3c05, 0x8403, 0x8204,
+	0xe018, 0xae1e, 0x8205, 0xe01c, 0xe161, 0x09e0, 0x8802, 0x0022,
+	0xe184, 0x19fb, 0x0111, 0x0d11, 0xf02e, 0xa200, 0x2a4e, 0xf059,
+	0xe161, 0x0907, 0x0111, 0x0d11, 0xe164, 0x0903, 0x0114, 0x0d14,
+	0x3474, 0x3c75, 0xe162, 0x0909, 0x0112, 0x0d12, 0xe166, 0x0905,
+	0x0116, 0x0d16, 0x3476, 0x3c77, 0xe42e, 0xe41e, 0x1a26, 0x284f,
+	0xe016, 0xf08a, 0x2000, 0x4c01, 0x0c39, 0xae02, 0x2a4e, 0xe017,
+	0xe046, 0x3474, 0x3c75, 0x3476, 0x3c77, 0xe42e, 0x2882, 0xf09a,
+	0xa200, 0xe162, 0x0901, 0x3512, 0x3d12, 0xe161, 0x0900, 0x3d01,
+	0x284f, 0xe016, 0xf0da, 0xe162, 0x0901, 0x2112, 0x4d12, 0xe161,
+	0x0900, 0x2f01, 0x1e39, 0xf047, 0xa203, 0x5a13, 0xe042, 0x3400,
+	0x3c01, 0x2839, 0xe161, 0x0900, 0x3d01, 0x2000, 0x4c01, 0xe162,
+	0x0901, 0x3512, 0x3d12, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x0026,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x09e0, 0xd112, 0x0200, 0xd113,
+	0x0003, 0xca28, 0xf7f8, 0xe42e, 0x28e5, 0xe426, 0xe41e, 0x1a61,
+	0xf7ce, 0x28e5, 0xe426, 0xe161, 0x0578, 0xe162, 0x0578, 0x2111,
+	0x4d11, 0xa201, 0x3e00, 0xa203, 0x28e5, 0xa104, 0xf0e4, 0xcc44,
+	0xe184, 0x1a7b, 0x2112, 0x4d0a, 0x1111, 0x1d11, 0xf056, 0xe082,
+	0xa104, 0xe094, 0x3e00, 0xa003, 0xe084, 0xa004, 0xe092, 0x2800,
+	0xe000, 0x059a, 0xe098, 0xa002, 0xe096, 0x2904, 0x3c01, 0xe41e,
+	0x1ffc, 0x28e5, 0x1800, 0xa104, 0xf0a4, 0xcc44, 0xe184, 0x1a95,
+	0x2911, 0x3d12, 0x2911, 0x3d12, 0x2913, 0x3d14, 0x28e5, 0xb5f0,
+	0x3ce5, 0x28e6, 0xe000, 0x05ab, 0xe092, 0x2801, 0x3d01, 0x28e6,
+	0xa002, 0x3ce6, 0xa124, 0xf028, 0x3ce6, 0x28e8, 0xa002, 0x3ce8,
+	0xe42e, 0xa200, 0x3cb2, 0xe004, 0x0054, 0xe09c, 0x287f, 0xa102,
+	0xcc44, 0xe184, 0x1ac2, 0x9e06, 0x5cb2, 0xa802, 0xf0a8, 0x28b2,
+	0xe049, 0xe001, 0x0518, 0xe09f, 0x2b07, 0xa809, 0xe419, 0x2005,
+	0x2ab2, 0xa003, 0x3eb2, 0xe42e, 0xe004, 0x0518, 0xe09e, 0xe004,
+	0x0054, 0xe09c, 0x287f, 0xa102, 0xcc44, 0xa200, 0x3cb2, 0xe184,
+	0x1ad8, 0x2b17, 0xaf05, 0xa803, 0x5ab2, 0xe056, 0x2ab2, 0xa003,
+	0x3eb2, 0x9f06, 0xe42e, 0x2840, 0xf078, 0xe41e, 0x2041, 0x3c3e,
+	0xe41e, 0x2092, 0xf03e, 0x283e, 0x3c84, 0xe42e, 0xe161, 0x0600,
+	0xa200, 0x3d11, 0x3c02, 0xd022, 0x013f, 0xe184, 0x1af3, 0xe41e,
+	0x1bdb, 0x2802, 0xa002, 0x3c02, 0xa200, 0x3c9b, 0xe42e, 0xba4e,
+	0xba40, 0xba40, 0xba40, 0xba40, 0xba46, 0xba4e, 0xbc3e, 0xf10d,
+	0x3c00, 0x1810, 0xf038, 0xa2fe, 0x3c10, 0x2800, 0xe000, 0x0100,
+	0x2ad6, 0xf02b, 0xa040, 0xe41e, 0x1b6c, 0xa202, 0xe42e, 0xe16a,
+	0xa200, 0xe42e, 0xa204, 0x3c9b, 0x2810, 0xe000, 0x0100, 0x2ad6,
+	0xf02b, 0xa040, 0xe41e, 0x1ba7, 0xe42a, 0xe41e, 0x1023, 0xf056,
+	0xe41e, 0x1895, 0xa202, 0xe42e, 0xa2fe, 0x3c10, 0xa200, 0xe42e,
+	0xe41e, 0x0c9b, 0xf12d, 0x3c01, 0xe002, 0x00ff, 0xf0e0, 0x2801,
+	0x1829, 0xf038, 0xa2fe, 0x3c29, 0x28ae, 0xa802, 0x3cae, 0x2801,
+	0xe41e, 0x1b6c, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xa202,
+	0x3c9b, 0x2829, 0xe41e, 0x1ba7, 0xf0da, 0xe41e, 0x1142, 0x3c65,
+	0xa200, 0xe41e, 0x0c4f, 0xa201, 0x3e9b, 0x2865, 0xf03a, 0xa202,
+	0xe42e, 0xe0c1, 0x0059, 0xa107, 0xf079, 0x28ae, 0xa104, 0xf04a,
+	0x28ae, 0xa902, 0x3cae, 0xa2fe, 0x3c29, 0xa200, 0xe42e, 0x2860,
+	0xa102, 0xf06a, 0x2499, 0x4c9a, 0xe41e, 0x1bf5, 0xe470, 0xe41e,
+	0x1c0e, 0xe41e, 0x1bfc, 0xe470, 0x3c02, 0xe41e, 0x1bdd, 0xa200,
+	0x3c06, 0x2802, 0xae14, 0x3404, 0x3c05, 0xe41e, 0x0c4a, 0x0404,
+	0x0c05, 0xce20, 0xd111, 0x0000, 0xe41e, 0x0c1d, 0x1806, 0xa00e,
+	0xaf06, 0xae02, 0xce24, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xca2c,
+	0xf7fa, 0xe41e, 0x0c26, 0xf128, 0x2004, 0x4c05, 0xe000, 0x0200,
+	0x3404, 0x3c05, 0xe41e, 0x0c1d, 0x3c06, 0xe41e, 0x09ee, 0xe41e,
+	0x0c1d, 0xe002, 0x0400, 0xf020, 0xf59e, 0xe161, 0x0600, 0xa202,
+	0x3d11, 0xe41e, 0x0c1d, 0x3d01, 0xe41e, 0x1bdb, 0xe42e, 0x3c02,
+	0xe41e, 0x1bdd, 0xe161, 0x0600, 0x2911, 0xe42a, 0x8111, 0x2111,
+	0x4d11, 0x2802, 0xae14, 0x3404, 0x3c05, 0x289b, 0xa102, 0xf0da,
+	0xe41e, 0x0c4a, 0x0404, 0x0c05, 0xe41e, 0x1bf5, 0xa204, 0xe41e,
+	0x0c4f, 0xe004, 0x0090, 0xf0ce, 0xe41e, 0x0c4a, 0x0404, 0x0c05,
+	0xe41e, 0x1bfc, 0xa202, 0xe41e, 0x0c4f, 0xe004, 0x0080, 0xcc66,
+	0xcc6a, 0xcc6e, 0xa01e, 0xcc6c, 0xa200, 0xcc60, 0xcc68, 0xcc70,
+	0xe128, 0xa202, 0xe42e, 0xa204, 0xf02e, 0xa206, 0x3c0a, 0xe41e,
+	0x1beb, 0xce20, 0xd111, 0x0600, 0xd112, 0x0004, 0x880a, 0x0113,
+	0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x002a, 0xae11,
+	0xe042, 0x2a02, 0xae07, 0xe042, 0xe42e, 0xce20, 0xa080, 0x3499,
+	0x3c9a, 0xd111, 0x0090, 0xf07e, 0xce20, 0xa080, 0xe41e, 0x1c09,
+	0xd111, 0x0080, 0xd112, 0x0010, 0xd113, 0x0013, 0xca28, 0xf7f8,
+	0xe42e, 0xc009, 0x3410, 0x3c11, 0xc000, 0xe42e, 0xc009, 0x2410,
+	0x4c11, 0xc000, 0xe42e, 0xe41e, 0x1c28, 0x2819, 0xe42a, 0xa102,
+	0x3c00, 0x284e, 0xe01a, 0x2abe, 0xa003, 0xa803, 0xe052, 0xe418,
+	0x1d80, 0xe41e, 0x1db5, 0xe41e, 0x1ded, 0xe41e, 0x1e20, 0xe42e,
+	0x28d6, 0xe42a, 0x2a19, 0xae05, 0xe001, 0x0200, 0x28d7, 0xf234,
+	0xe093, 0xa200, 0x3d11, 0xa2fc, 0x3d11, 0xa206, 0x3d11, 0x28d7,
+	0x3d11, 0x2a19, 0xae03, 0xe001, 0x0240, 0xe09b, 0x2a19, 0xae05,
+	0xe001, 0x0260, 0xe09d, 0x2a19, 0xe001, 0x02a0, 0xe09f, 0x2072,
+	0x4c73, 0x3515, 0x3d15, 0x3516, 0x3d16, 0x3516, 0x3d16, 0xa200,
+	0x3d07, 0xf05e, 0xa005, 0xe093, 0xa200, 0x3d01, 0xe42e, 0xc418,
+	0xe161, 0x0202, 0xa201, 0x2819, 0xf0c6, 0xa102, 0xcc44, 0xe184,
+	0x1c67, 0x2911, 0xf05a, 0x2909, 0xe41e, 0x1ff5, 0x3f11, 0x8131,
+	0xe42e, 0x287e, 0xf11a, 0x2074, 0x4c75, 0x1072, 0x1c73, 0x3474,
+	0x3c75, 0x2076, 0x4c77, 0x1072, 0x1c73, 0x3476, 0x3c77, 0xa200,
+	0x3472, 0x3c73, 0x3c3c, 0xa200, 0x3cbe, 0x2c39, 0x2a4f, 0x4e7e,
+	0xb612, 0x3c80, 0x2819, 0xf12a, 0xa102, 0x3c00, 0x2839, 0x3c50,
+	0x287d, 0xe41a, 0x1d44, 0x2840, 0xe016, 0xe418, 0x1d15, 0x2840,
+	0xe408, 0x1cd9, 0xe41e, 0x1c99, 0xe42e, 0x2884, 0xe41e, 0x1ff5,
+	0xe42e, 0xc420, 0xe161, 0x0202, 0x8800, 0x0022, 0xe184, 0x1ca2,
+	0x2901, 0xf03a, 0x8131, 0xe42e, 0xe082, 0xe002, 0x0202, 0xaf04,
+	0x3c0a, 0x2841, 0x3d09, 0x287c, 0x3d09, 0x287b, 0x3d31, 0x8109,
+	0x2884, 0x3d11, 0xe082, 0xe000, 0x005c, 0xe094, 0xe002, 0x0260,
+	0xaf02, 0xe000, 0x0240, 0xe092, 0x2072, 0x4c73, 0x3511, 0x3d11,
+	0x2a41, 0xa105, 0x2112, 0x4d0a, 0xf03b, 0x2074, 0x4c75, 0x3512,
+	0x3d12, 0x2112, 0x4d0a, 0xf035, 0x2076, 0x4c77, 0x3512, 0x3d12,
+	0x280a, 0xe000, 0x02a0, 0xe092, 0xa206, 0x1841, 0xe01a, 0x3d01,
+	0xe42e, 0xe161, 0x0200, 0x8800, 0x0022, 0xe184, 0x1ce6, 0x2d11,
+	0x2b11, 0x1c7b, 0x1a7c, 0xf028, 0xf04b, 0x8111, 0x8111, 0xe42e,
+	0xa206, 0x3d01, 0xe082, 0xe000, 0x005e, 0xe094, 0xe002, 0x0260,
+	0xaf02, 0xe000, 0x0240, 0xe092, 0xe002, 0x0240, 0xaf02, 0x3c0a,
+	0x2072, 0x4c73, 0x2311, 0x4f09, 0xe066, 0x3511, 0x3d11, 0xf41e,
+	0xc420, 0xe161, 0x0202, 0x8800, 0x0022, 0xe184, 0x1d09, 0x2901,
+	0xf03a, 0x8131, 0xe42e, 0xa206, 0x3d09, 0xa202, 0x3d09, 0x2850,
+	0x3d31, 0x8109, 0xa2fe, 0x3d11, 0xe42e, 0xa200, 0xc420, 0xe161,
+	0x0202, 0x8800, 0x0022, 0xe184, 0x1d1f, 0x2b31, 0xe01b, 0xe042,
+	0x1819, 0xe424, 0xa203, 0xae21, 0xe161, 0x0202, 0x8800, 0x0022,
+	0xe184, 0x1d3d, 0x2909, 0xf11a, 0x2909, 0xf0e6, 0x2901, 0x1c50,
+	0xf036, 0x1014, 0x1c15, 0x0c50, 0xe046, 0xf062, 0xe042, 0xe049,
+	0xe082, 0xa004, 0xe094, 0x8111, 0x8111, 0x8131, 0xa200, 0x3d12,
+	0x2912, 0xe412, 0x1ff5, 0xe42e, 0xe161, 0x0200, 0xe162, 0x02f0,
+	0x8800, 0x0022, 0xe184, 0x1d7e, 0x283f, 0xf098, 0x2912, 0x3c02,
+	0x2912, 0x3c03, 0xe01a, 0xb670, 0x3c04, 0xf15e, 0x2912, 0xaf02,
+	0x3c02, 0x2912, 0x3c03, 0xe01a, 0x3c04, 0x8112, 0x290a, 0xe01a,
+	0xae02, 0x4c04, 0x3c04, 0xa802, 0xf068, 0x2912, 0xaf02, 0x3c02,
+	0x290a, 0x3c03, 0x2804, 0x8112, 0x8112, 0xf08a, 0x2802, 0x3d11,
+	0x2803, 0x3d11, 0x2804, 0x3d11, 0xf0ae, 0x8111, 0x8111, 0x2901,
+	0xa201, 0x3f11, 0xf04a, 0x2901, 0xe412, 0x1ff5, 0x8111, 0xe42e,
+	0x284f, 0xe428, 0x2819, 0xe42a, 0x2840, 0xe428, 0xe41e, 0x1fe2,
+	0x4c1a, 0xe42a, 0x2c80, 0x3c50, 0xa200, 0x3c0f, 0x2850, 0xa002,
+	0x2214, 0x4e15, 0xa103, 0xe052, 0x3c50, 0x1c39, 0xe42a, 0x281a,
+	0x4caa, 0xf05a, 0xe41e, 0x1d15, 0xe41e, 0x1d00, 0x281a, 0xf6f8,
+	0x28ae, 0xa920, 0x3cae, 0x280f, 0xa002, 0x3c0f, 0xa120, 0xf062,
+	0xe41e, 0x05ab, 0xe41e, 0x181a, 0xf62e, 0xe41e, 0x05ab, 0xe41e,
+	0x1a5c, 0x28ae, 0xa908, 0x3cae, 0xe42e, 0xe161, 0x0200, 0xe162,
+	0x02f0, 0x8800, 0x0022, 0x28d6, 0xf03a, 0x8819, 0x0022, 0xe184,
+	0x1de1, 0x283f, 0xf0c8, 0x2911, 0x3d12, 0x2911, 0x2b11, 0xa107,
+	0xb612, 0x3d12, 0xa200, 0x3d12, 0x3d12, 0xf14e, 0x2911, 0xae02,
+	0xa002, 0x1842, 0x3d12, 0x2911, 0x2b09, 0xa803, 0xb616, 0x3d0a,
+	0x2912, 0x8112, 0xaa02, 0x3d12, 0x2911, 0x2b11, 0xa805, 0xb616,
+	0x3d12, 0x8111, 0xe161, 0x0330, 0xe162, 0x02f0, 0xd022, 0x003f,
+	0xe184, 0x1deb, 0x2912, 0x3d11, 0xe42e, 0x283f, 0xf148, 0xe41e,
+	0x1e7e, 0x2808, 0xe000, 0x0370, 0xe096, 0xe41e, 0x1ec0, 0x2808,
+	0x0809, 0x3c6d, 0xe000, 0x0370, 0xe096, 0xe41e, 0x1f7e, 0x086d,
+	0x3c6d, 0xe42e, 0xe41e, 0x1e7e, 0xe163, 0x0370, 0x2808, 0xe41e,
+	0x1f88, 0x3c08, 0xe000, 0x0370, 0xe096, 0xe41e, 0x1ec0, 0x2808,
+	0xe000, 0x0370, 0xe096, 0x2809, 0xe41e, 0x1f88, 0x0808, 0x3c6d,
+	0xe000, 0x0370, 0xe096, 0xe41e, 0x1f7e, 0x086d, 0x3c6d, 0xe42e,
+	0x283f, 0xf238, 0xe41e, 0x1ef9, 0x2808, 0xe000, 0x0390, 0xe096,
+	0xe41e, 0x1ec0, 0x2808, 0xe000, 0x03b0, 0xe096, 0xe41e, 0x1ec0,
+	0x2808, 0x0809, 0x3c6d, 0xe41e, 0x1fcb, 0x286d, 0xe000, 0x0390,
+	0xe096, 0xe41e, 0x1f7e, 0x286d, 0xe000, 0x03b0, 0xe096, 0xe41e,
+	0x1f7e, 0x086d, 0x3c6d, 0xe42e, 0xe41e, 0x1ef9, 0xe163, 0x0390,
+	0x2808, 0xe41e, 0x1f88, 0xe163, 0x03b0, 0x2808, 0xe41e, 0x1f88,
+	0x3c08, 0x2808, 0xe000, 0x0390, 0xe096, 0xe41e, 0x1ec0, 0x2808,
+	0xe000, 0x0390, 0xe096, 0x2809, 0xe41e, 0x1f88, 0x2808, 0xe000,
+	0x03b0, 0xe096, 0xe41e, 0x1ec0, 0x2808, 0xe000, 0x03b0, 0xe096,
+	0x2809, 0xe41e, 0x1f88, 0x0808, 0x3c6d, 0xe41e, 0x1fcb, 0x286d,
+	0xe000, 0x0390, 0xe096, 0xe41e, 0x1f7e, 0x286d, 0xe000, 0x03b0,
+	0xe096, 0xe41e, 0x1f7e, 0x086d, 0x3c6d, 0xe42e, 0xe161, 0x0600,
+	0xa200, 0xc70f, 0x3d11, 0x283f, 0xb674, 0x3c05, 0xa200, 0x3c08,
+	0xc420, 0xe163, 0x0370, 0xa2fe, 0x3c06, 0xa203, 0xae21, 0xe013,
+	0xe161, 0x0202, 0xe162, 0x0600, 0x8800, 0x0022, 0xe184, 0x1eaf,
+	0x2912, 0xf168, 0x2909, 0x1805, 0xf124, 0x2909, 0xf0f6, 0x2901,
+	0x1c39, 0xf036, 0x1014, 0x1c15, 0x0c39, 0xe046, 0xf076, 0xe042,
+	0xe049, 0xe084, 0xe002, 0x0601, 0x3c06, 0x8111, 0x8111, 0x8131,
+	0x2806, 0xe424, 0xe000, 0x0600, 0xe094, 0xa202, 0x3d02, 0x2806,
+	0xae02, 0x3d13, 0x2808, 0xa002, 0x3c08, 0x1819, 0xf4d8, 0xe42e,
+	0xe161, 0x0600, 0xa200, 0xc70f, 0x3d11, 0x283f, 0xb674, 0x3c05,
+	0xa200, 0x3c09, 0xc420, 0xa2fe, 0x3c07, 0xa221, 0xe161, 0x0202,
+	0xe162, 0x0600, 0x8800, 0x0022, 0xe184, 0x1ee8, 0x2912, 0xf118,
+	0x2909, 0x1805, 0xf0d4, 0x2909, 0xf0a2, 0x2901, 0xe046, 0xf072,
+	0xe042, 0xe049, 0xe084, 0xe002, 0x0601, 0x3c07, 0x8111, 0x8111,
+	0x8131, 0x2807, 0xe424, 0xe000, 0x0600, 0xe094, 0xa202, 0x3d02,
+	0x2807, 0xae02, 0x3d13, 0x2809, 0xa002, 0x3c09, 0x1819, 0xf548,
+	0xe42e, 0xe161, 0x0600, 0xa200, 0xc70f, 0x3d11, 0x283f, 0xb674,
+	0x3c05, 0xa200, 0x3c0a, 0xc420, 0xe163, 0x0390, 0xe164, 0x03b0,
+	0xa2fe, 0x3c06, 0x3c07, 0xe161, 0x0202, 0xe162, 0x0600, 0xe165,
+	0x0240, 0x8800, 0x0022, 0xe184, 0x1f44, 0x2912, 0xf2c8, 0x2909,
+	0x1805, 0xf284, 0x2909, 0xf256, 0x2115, 0x4d0d, 0x1072, 0x1c73,
+	0xf110, 0x2806, 0xf064, 0x2115, 0x4d0d, 0x100c, 0x1c0d, 0xf196,
+	0x2115, 0x4d0d, 0x340c, 0x3c0d, 0xe084, 0xe002, 0x0601, 0x3c06,
+	0xf10e, 0x2807, 0xf064, 0x2115, 0x4d0d, 0x100e, 0x1c0f, 0xf092,
+	0x2115, 0x4d0d, 0x340e, 0x3c0f, 0xe084, 0xe002, 0x0601, 0x3c07,
+	0x8111, 0x8111, 0x8131, 0x8115, 0x8115, 0x2806, 0xf094, 0xe000,
+	0x0600, 0xe094, 0xa202, 0x3d02, 0x2806, 0xae02, 0x3d13, 0x2807,
+	0xf094, 0xe000, 0x0600, 0xe094, 0xa202, 0x3d02, 0x2807, 0xae02,
+	0x3d14, 0x280a, 0xa002, 0x3c0a, 0x1819, 0xe408, 0x1f08, 0xe086,
+	0xe002, 0x0390, 0x3c0c, 0xe088, 0xe002, 0x03b0, 0x3c0d, 0xf09a,
+	0xa102, 0xcc44, 0xe164, 0x03b0, 0xe184, 0x1f6f, 0x2914, 0x3d13,
+	0x280c, 0xf09a, 0xa102, 0xcc44, 0xe163, 0x0390, 0xe184, 0x1f79,
+	0x2913, 0x3d14, 0x280c, 0x080d, 0x3c08, 0xe42e, 0x28d6, 0xf07a,
+	0x2819, 0xae02, 0x0842, 0x3d03, 0xa202, 0xe42e, 0xa200, 0xe42e,
+	0xe42a, 0xa102, 0x3c0c, 0xe086, 0xe098, 0xe161, 0x0600, 0x880c,
+	0x0022, 0xe184, 0x1fa3, 0x2903, 0xae02, 0xe000, 0x0202, 0xe094,
+	0x2902, 0xa802, 0xf03a, 0x2903, 0x3d11, 0x2902, 0xa804, 0xf04a,
+	0x2903, 0xa002, 0x3d11, 0x8113, 0xe082, 0xe002, 0x0600, 0xe42a,
+	0xa102, 0x3c0c, 0x3c0d, 0x2842, 0x3c0e, 0xe161, 0x0600, 0x880c,
+	0x0022, 0xe184, 0x1fb8, 0x2901, 0xf044, 0xa802, 0x180e, 0xf06a,
+	0x8111, 0x280e, 0xe016, 0x3c0e, 0xf71e, 0x2901, 0x3d14, 0xa2fe,
+	0x3d01, 0x280e, 0xe016, 0x3c0e, 0x280d, 0xa102, 0x3c0d, 0xf662,
+	0x280c, 0xa002, 0xe42e, 0x286d, 0xa102, 0xe426, 0xcc44, 0xe163,
+	0x0390, 0xe164, 0x03b0, 0xe184, 0x1fd8, 0x2913, 0x1914, 0xe428,
+	0xe190, 0xe163, 0x0391, 0xe164, 0x03b0, 0x290b, 0x3d14, 0x2903,
+	0x3d14, 0xe42e, 0x2819, 0xe426, 0xa102, 0xcc44, 0xc420, 0xe161,
+	0x0202, 0xe184, 0x1fed, 0x2901, 0xe428, 0x8131, 0xe42e, 0xe161,
+	0x0518, 0xa200, 0xc71f, 0x3d11, 0xe42e, 0xe000, 0x0518, 0xe09e,
+	0x2907, 0xa80c, 0x3d07, 0xe42e, 0xe008, 0x7fff, 0xe000, 0x0518,
+	0xe09e, 0x2907, 0xa80a, 0x3d07, 0xe42e, 0x3c81, 0xe000, 0x0518,
+	0xe09e, 0x2907, 0xa806, 0x3d07, 0x2881, 0xa002, 0x3c81, 0x187f,
+	0xe428, 0xa200, 0x3c81, 0xe42e, 0xe161, 0x0518, 0x287f, 0xa102,
+	0xcc44, 0xa201, 0xe184, 0x201f, 0x2911, 0xa804, 0xe01a, 0xe041,
+	0x1a07, 0xa202, 0xb602, 0xe42e, 0xe161, 0x0518, 0x287f, 0xa102,
+	0xcc44, 0xa200, 0xe184, 0x202f, 0x2b11, 0xa807, 0xe01b, 0xe042,
+	0x18eb, 0xa102, 0xe01a, 0xe42e, 0xe161, 0x0518, 0x287f, 0xa102,
+	0xcc44, 0xe049, 0xe184, 0x203d, 0x2911, 0xb5f1, 0xa202, 0xb60e,
+	0xe42e, 0x2881, 0x3c00, 0x2800, 0xe000, 0x0518, 0xe092, 0x2901,
+	0xf10a, 0x2800, 0xa002, 0x3c00, 0x187f, 0xf038, 0xa200, 0x3c00,
+	0x2800, 0x1881, 0xf718, 0xa200, 0x3c81, 0xa2fe, 0x3c84, 0xe42e,
+	0x2ad8, 0xae03, 0x24a8, 0x4ca9, 0xe056, 0x34a8, 0x3ca9, 0xa20e,
+	0x3d01, 0x2800, 0x3c84, 0xe42e, 0xe424, 0xc009, 0x3c32, 0xc000,
+	0x2841, 0xc009, 0xa804, 0xe01a, 0x5832, 0xe014, 0x2230, 0x4e31,
+	0xe051, 0x3630, 0x3e31, 0xc000, 0x2841, 0xc009, 0xa802, 0x5832,
+	0xe014, 0x222e, 0x4e2f, 0xe051, 0x362e, 0x3e2f, 0xc000, 0xe42e,
+	0xc009, 0x3c32, 0xa200, 0x2a32, 0xf0c5, 0x222e, 0x4e2f, 0x5e32,
+	0xa803, 0xe056, 0x2230, 0x4e31, 0x5e32, 0xa803, 0xae03, 0xe056,
+	0xc000, 0xe42e, 0xe424, 0xc009, 0x3c32, 0xa202, 0x5832, 0x2230,
+	0x4e31, 0xe055, 0x3630, 0x3e31, 0x222e, 0x4e2f, 0xe055, 0x362e,
+	0x3e2f, 0xc000, 0xe42e, 0xe0c1, 0x0044, 0xa80f, 0xe056, 0xe42e,
+	0xa200, 0xe41e, 0x20a3, 0xe42e, 0xe0c1, 0x0044, 0xaf0d, 0xae03,
+	0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803,
+	0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039, 0xa213,
+	0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1, 0x0420,
+	0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0640, 0xe167, 0x0500,
+	0x287f, 0xf166, 0xa102, 0xcc44, 0xe184, 0x20e6, 0xa200, 0xe41e,
+	0x20a3, 0xaf04, 0xe41e, 0x20ac, 0xae20, 0x2e66, 0xe056, 0x9f17,
+	0x2057, 0x4c58, 0xae08, 0x9f17, 0xe41e, 0x20ec, 0xe190, 0xe190,
+	0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17, 0x2116,
+	0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0, 0x0044,
+	0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a, 0xe0c0,
+	0x0061, 0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200,
+	0xe41e, 0x20a8, 0xa80e, 0xaf04, 0xe41e, 0x20ac, 0xe41e, 0x20b4,
+	0xe40b, 0x211f, 0xa81e, 0xe41e, 0x20b9, 0xae09, 0xe056, 0xae20,
+	0xe0c1, 0x006e, 0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0060,
+	0xa822, 0xa122, 0xf04a, 0x2057, 0x4c58, 0xf03e, 0x2058, 0x4c57,
+	0xae08, 0x9f17, 0xe0c0, 0x0062, 0x9f17, 0xe0c0, 0x0063, 0x9f17,
+	0xe0c0, 0x0064, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x3cec,
+	0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11, 0xe042, 0xce20, 0xd111,
+	0x0640, 0xd112, 0x00c0, 0x88ec, 0x0113, 0xca29, 0xf7f9, 0xe190,
+	0xe42e, 0xa2fe, 0x3c89, 0xa200, 0x3c88, 0xe42e, 0x2856, 0x3c89,
+	0x2889, 0xf032, 0xa200, 0x3c88, 0xa200, 0x3c8d, 0x3c8e, 0x2857,
+	0x3c8b, 0x2858, 0x3c8c, 0x2888, 0xe42a, 0x2889, 0xe424, 0x2889,
+	0xe0c2, 0x0143, 0x288a, 0xe0c2, 0x0144, 0xa200, 0xe0c2, 0x017f,
+	0xe0c2, 0x0149, 0xe41e, 0x20a3, 0xe0c2, 0x017f, 0x288b, 0xa102,
+	0xae20, 0x4c8c, 0xa102, 0xe0c2, 0x0142, 0xa200, 0xae20, 0x2a87,
+	0xe042, 0xe0c2, 0x014e, 0xe42e, 0x2889, 0x2a8e, 0x1a8c, 0xe423,
+	0x288d, 0xae0e, 0x4c8e, 0xa203, 0xb615, 0x3e8f, 0x2a8f, 0xae03,
+	0xa903, 0xae1d, 0xe056, 0xe0c1, 0x014b, 0xf7e9, 0xe0c2, 0x014d,
+	0xa202, 0xe0c2, 0x014a, 0x2a8d, 0xa003, 0x3e8d, 0x1a8b, 0xf065,
+	0x2a8e, 0xa003, 0x3e8e, 0xa201, 0x3e8d, 0xe42e, 0x2888, 0xf15a,
+	0x288e, 0x188c, 0xf042, 0xe41e, 0x2184, 0xf7be, 0xe0c0, 0x014b,
+	0xf7e8, 0xa204, 0xae1c, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a,
+	0xe190, 0xe0c0, 0x014b, 0xf7e8, 0x2885, 0x3c89, 0xe42e, 0xe41e,
+	0x22a6, 0xe41e, 0x2344, 0xe41e, 0x0f66, 0xe41e, 0x2250, 0xe41e,
+	0x258e, 0xa200, 0x3c59, 0x3c52, 0xe41e, 0x2445, 0x2c59, 0x1c44,
+	0xe402, 0x224b, 0xe41e, 0x0b81, 0xf19a, 0xa102, 0xf1ca, 0xa108,
+	0xf154, 0xf19a, 0xa10a, 0xe40a, 0x223a, 0xa102, 0xe40a, 0x223a,
+	0xa102, 0xe40a, 0x222c, 0xa104, 0xe40a, 0x21ed, 0xa102, 0xa10a,
+	0xe40a, 0x21f2, 0xa002, 0xe404, 0x223f, 0xe41e, 0x094c, 0xf63e,
+	0x2c44, 0x3c52, 0xe41e, 0x0985, 0x284e, 0xe01a, 0x2a92, 0xe01b,
+	0xe05a, 0xe408, 0x223f, 0x284f, 0x1893, 0xe408, 0x223f, 0xe41e,
+	0x0bd4, 0xe41e, 0x23c4, 0xf4fa, 0x2894, 0xf07a, 0x2c44, 0x3c0d,
+	0xe41e, 0x248c, 0xe40e, 0x2247, 0xe41e, 0x0bf1, 0x284e, 0x3c92,
+	0x284f, 0x3c93, 0xe41e, 0x0d77, 0xe40a, 0x21d2, 0xa201, 0x3e94,
+	0x2c52, 0x3c0d, 0x1c59, 0xe404, 0x21d2, 0xe410, 0x248c, 0x2c52,
+	0x1c44, 0xe402, 0x224b, 0xe41e, 0x05c8, 0xf05a, 0xe41e, 0x05ed,
+	0xe40e, 0x224b, 0xe40e, 0x21cc, 0xe41e, 0x0985, 0xba0e, 0xe002,
+	0x00ff, 0xf058, 0xba4e, 0xe41e, 0x0ba5, 0xf798, 0xe41e, 0x0ce4,
+	0xe40e, 0x21d2, 0xe41e, 0x08b8, 0xf03a, 0xe41e, 0x01db, 0x2c59,
+	0x1c44, 0xe402, 0x2247, 0x2c44, 0x3c0d, 0xe41e, 0x248c, 0x2892,
+	0x3c4e, 0x2893, 0x3c4f, 0xe41e, 0x2652, 0xcbcc, 0xf7f8, 0xe42e,
+	0x2822, 0xae02, 0x4c37, 0xae0a, 0x2a36, 0xa83f, 0xe056, 0xae0a,
+	0x2a32, 0xa83f, 0xe056, 0xae02, 0x4c1d, 0xae02, 0x4c2d, 0xae02,
+	0x4c43, 0xcf80, 0x284e, 0xe01a, 0xae02, 0x4c1b, 0xae02, 0x4c1d,
+	0xae02, 0x4c43, 0xcfc2, 0x2857, 0xa102, 0xae02, 0x4c34, 0xae02,
+	0x4c3f, 0xae02, 0x4c42, 0xae02, 0x4c43, 0xcf00, 0xd1d3, 0x000b,
+	0xd185, 0x0001, 0x246e, 0x4c6f, 0xcfc6, 0xd1e5, 0x0001, 0xc420,
+	0xe161, 0x0201, 0xa200, 0xd022, 0x000f, 0xe184, 0x2289, 0x2b31,
+	0xae02, 0xb42a, 0xcfe8, 0x2072, 0x4c73, 0xcfea, 0x2074, 0x4c75,
+	0xcfec, 0x2076, 0x4c77, 0xcfee, 0xe004, 0x0060, 0xcbcf, 0xa803,
+	0xf03b, 0xe004, 0x0070, 0xce30, 0xe161, 0x0260, 0xd022, 0x001f,
+	0xe184, 0x22a4, 0x2111, 0x4d11, 0xce32, 0xe42e, 0xa200, 0xe161,
+	0x07f6, 0xc707, 0x3d11, 0x2867, 0x4c68, 0xf028, 0xe42e, 0xe161,
+	0x07f6, 0xa20e, 0x3c00, 0x2867, 0xf39a, 0x2869, 0x5c00, 0xa802,
+	0xf108, 0x2a00, 0xa10f, 0xf049, 0xa202, 0x3d11, 0xf17e, 0x2a00,
+	0xa109, 0xf049, 0xa204, 0x3d11, 0xf11e, 0xa20a, 0x3d11, 0xf0ee,
+	0x286b, 0x5c00, 0xa802, 0xf08a, 0x2800, 0xa10a, 0xa205, 0xf024,
+	0xa203, 0x3f11, 0xf03e, 0xa206, 0x3d11, 0x2800, 0xa102, 0x3c00,
+	0xa102, 0xf5c8, 0x2869, 0xe00c, 0x00ff, 0x2a6b, 0xe056, 0x5c00,
+	0xa802, 0xf06a, 0xa203, 0x2800, 0xb655, 0x3f11, 0xf03e, 0xa206,
+	0x3d11, 0x2800, 0xa102, 0x3c00, 0xf6ea, 0xe161, 0x07f6, 0xa20e,
+	0x3c00, 0x2868, 0xe42a, 0x286a, 0x5c00, 0xa802, 0xf188, 0x2800,
+	0xa10e, 0xf088, 0x2a67, 0xf03b, 0x8111, 0xf1e9, 0xa202, 0x3d11,
+	0xf1be, 0x2a00, 0xa109, 0xf089, 0x2a67, 0xf03b, 0x8111, 0xf149,
+	0xa204, 0x3d11, 0xf11e, 0xa20a, 0x3d11, 0xf0ee, 0x286c, 0x5c00,
+	0xa802, 0xf08a, 0x2800, 0xa10a, 0xa205, 0xf024, 0xa203, 0x3f11,
+	0xf03e, 0xa208, 0x3d11, 0x2800, 0xa102, 0x3c00, 0xa102, 0xf548,
+	0x286a, 0x5c00, 0x4c67, 0xa802, 0xf068, 0xa203, 0x2800, 0xb655,
+	0x3f11, 0xf16e, 0x286c, 0xe00c, 0x00ff, 0x2a6a, 0xe052, 0x5c00,
+	0xa802, 0xf0c8, 0x286a, 0x5c00, 0xa802, 0xf06a, 0xa203, 0x2800,
+	0xb655, 0x3f11, 0xf05e, 0x8111, 0xf03e, 0xa208, 0x3d11, 0x2800,
+	0xa102, 0x3c00, 0xf5ea, 0xe42e, 0xa202, 0xe0c2, 0x013c, 0xa200,
+	0x3c00, 0x3c01, 0xe161, 0x07f6, 0xe162, 0x04c8, 0x2911, 0xa104,
+	0xf066, 0xa106, 0xe40a, 0x238e, 0xa004, 0xf112, 0xa004, 0xae06,
+	0x3c04, 0x2800, 0xa10c, 0xf064, 0x2804, 0xae04, 0xe000, 0x0018,
+	0x3c04, 0xe004, 0x0450, 0x0804, 0x3c04, 0xf29e, 0xa201, 0x3e02,
+	0xa211, 0x3e03, 0xf04a, 0xe005, 0x00e0, 0x3e02, 0x2800, 0x2a00,
+	0xae09, 0xa10c, 0xf05a, 0xa102, 0xf058, 0xe005, 0x00a0, 0xa240,
+	0x3c03, 0x0a02, 0x3e02, 0xe0c0, 0x0041, 0xe005, 0x0034, 0xae11,
+	0xe042, 0x0802, 0xce20, 0xd111, 0x0600, 0x2803, 0xce24, 0xd113,
+	0x0003, 0xca28, 0xf7f8, 0xe004, 0x0600, 0x3c04, 0x2800, 0xa10c,
+	0xa20f, 0xf024, 0xa23f, 0xcc45, 0x2804, 0xe096, 0xe184, 0x23a8,
+	0x2912, 0x0801, 0xe0c2, 0x013e, 0x2b03, 0xaf11, 0xe0c3, 0x013f,
+	0x2912, 0x0801, 0xe0c2, 0x013e, 0x2b13, 0xe009, 0x00ff, 0xe0c3,
+	0x013f, 0xe162, 0x04c8, 0x2a01, 0xe001, 0x0010, 0x3e01, 0x2800,
+	0xa002, 0x3c00, 0xa10c, 0xe404, 0x234e, 0xe162, 0x04d8, 0xe40a,
+	0x234e, 0xe001, 0x0030, 0x3e01, 0xa104, 0xe408, 0x234e, 0xe16a,
+	0xa200, 0xe0c2, 0x013c, 0xe42e, 0xa200, 0x3c94, 0xe41e, 0x0c9b,
+	0xe40d, 0x2442, 0x2a43, 0xe419, 0x0e84, 0x1c44, 0xe402, 0x2442,
+	0xbc12, 0xe40d, 0x2442, 0xa10a, 0xb4a8, 0xa104, 0xe400, 0x2442,
+	0xbdfe, 0xe40d, 0x2442, 0x1829, 0xf03a, 0xa202, 0x3c94, 0x7413,
+	0x1839, 0xf03a, 0xa202, 0x3c94, 0x281b, 0xf0d8, 0xba40, 0x183f,
+	0xf03a, 0xa202, 0x3c94, 0x283f, 0xf06a, 0xba40, 0x1842, 0xf03a,
+	0xa202, 0x3c94, 0x284f, 0xf09a, 0xe41e, 0x0c9b, 0xe40d, 0x2442,
+	0x1c45, 0xf03a, 0xa202, 0x3c94, 0x2816, 0xa102, 0xf034, 0xf1da,
+	0xf3ae, 0x7417, 0xe160, 0x0903, 0x1d00, 0xf03a, 0xa202, 0x3c94,
+	0x283f, 0xe016, 0x442a, 0xf2fa, 0xe41e, 0x0cb5, 0xf34d, 0xe161,
+	0x0904, 0xe162, 0x0905, 0x1101, 0x1d02, 0xf03a, 0xa202, 0x3c94,
+	0xf22e, 0xe418, 0x0cb5, 0xf1fe, 0x2818, 0xf1d8, 0xe41e, 0x0cb5,
+	0xf22d, 0xe163, 0x0903, 0xe164, 0x0904, 0x1103, 0x1d04, 0xf03a,
+	0xa202, 0x3c94, 0x283f, 0xe016, 0x442a, 0xf0da, 0xe41e, 0x0cb5,
+	0xf12d, 0xe165, 0x0905, 0xe166, 0x0906, 0x1105, 0x1d06, 0xf03a,
+	0xa202, 0x3c94, 0xe41e, 0x0c1d, 0xae06, 0xc873, 0xe046, 0xf034,
+	0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xa200, 0xe41e, 0x0c2a,
+	0xe41e, 0x0c26, 0xf0c8, 0xa202, 0xe41e, 0x08da, 0xe41e, 0x0c2a,
+	0xe41e, 0x08e2, 0xd036, 0x00ff, 0xd037, 0x0080, 0xe16a, 0x2c52,
+	0x3c59, 0xa200, 0x3c0c, 0xe41e, 0x24a3, 0x282d, 0xf138, 0x2c59,
+	0x1c44, 0xf0d2, 0xe41e, 0x24ea, 0xf1ed, 0x2843, 0xe418, 0x24ea,
+	0xf1ad, 0xcb86, 0xa102, 0xf740, 0xc894, 0xf728, 0xe41e, 0x0ce4,
+	0xe42e, 0xe41e, 0x24d6, 0x2c59, 0x1c44, 0xf0a2, 0xe41e, 0x24ea,
+	0xf0ad, 0x2843, 0xe418, 0x24ea, 0xf06d, 0xbb60, 0xf75a, 0xe41e,
+	0x0ce6, 0xe42e, 0xe16a, 0xe41e, 0x0b81, 0xa116, 0xe428, 0xe41e,
+	0x08b8, 0xe418, 0x01db, 0xe42e, 0x284f, 0xe016, 0x3c38, 0xa202,
+	0x3c0c, 0xe41e, 0x24a3, 0xa200, 0x3c0c, 0x2c59, 0x180d, 0xf0b2,
+	0xe41e, 0x252a, 0x2843, 0xe418, 0x252a, 0x2c53, 0xa002, 0x0843,
+	0x3c53, 0xf74e, 0xe42e, 0x2832, 0x1836, 0xe01a, 0xae04, 0x4c4b,
+	0xae0a, 0x4c4c, 0xae0a, 0x4c4d, 0xcf30, 0x2849, 0xae0a, 0x4c48,
+	0xae04, 0x4c38, 0xcf82, 0xd1c3, 0x0000, 0x284a, 0xcf96, 0x2849,
+	0xae08, 0x4c48, 0xae02, 0x4c7a, 0xae02, 0x4c79, 0xae02, 0x4c78,
+	0xae02, 0x4c46, 0xae04, 0x4c38, 0xcfc4, 0x885e, 0x01fa, 0x2470,
+	0x4c71, 0xcfc8, 0x280c, 0xf03a, 0x2838, 0xf03a, 0xd188, 0x0001,
+	0x2838, 0xa104, 0xe428, 0xd1e5, 0x0002, 0xe42e, 0xc868, 0xa80e,
+	0x3c9e, 0x749e, 0xe004, 0x01fe, 0xcc86, 0xba50, 0xcc88, 0x2838,
+	0xe01a, 0x0847, 0xae0c, 0x4c4a, 0xcc82, 0xd040, 0x0003, 0xc884,
+	0xf7f8, 0xe42e, 0xd185, 0x0002, 0xd1d0, 0x003f, 0xe190, 0xe180,
+	0xe41e, 0x0c2e, 0xe418, 0x0c8e, 0xe181, 0xcba0, 0xa810, 0xcba3,
+	0xe409, 0x2520, 0xf7b8, 0xe41e, 0x260a, 0xcbe0, 0xf7f8, 0x285a,
+	0xe41a, 0x2631, 0xcba0, 0xcba3, 0xe409, 0x2520, 0xf7c8, 0xd186,
+	0x0001, 0xd185, 0x0004, 0xe41e, 0x2648, 0xcb06, 0x3c59, 0xcb8a,
+	0xaf04, 0x442d, 0xf08a, 0xe004, 0x01fe, 0xcc86, 0xba50, 0xcc88,
+	0xd040, 0x0001, 0xe41e, 0x0c1d, 0xae06, 0xc873, 0xe046, 0xe422,
+	0xd1d0, 0x0000, 0xd1d1, 0x0000, 0xcb1c, 0xf7f8, 0xcbe0, 0xf7f8,
+	0xe16b, 0xe42e, 0xd185, 0x0002, 0xd186, 0x0000, 0xd1c2, 0x0001,
+	0xd1c5, 0x0000, 0xd1c4, 0x0000, 0xd1d0, 0x000e, 0xcba0, 0xf7f8,
+	0x2054, 0x4c55, 0xf098, 0xd1c2, 0x0000, 0xd1c5, 0x0003, 0xd1c4,
+	0x0003, 0xd1c8, 0x0000, 0xd1d0, 0x0020, 0xe41e, 0x260a, 0xa200,
+	0xe0c2, 0x012a, 0xcbe0, 0xf7f8, 0x285a, 0xe41a, 0x2631, 0xcba0,
+	0xf7f8, 0xd186, 0x0001, 0xd185, 0x0004, 0xe41e, 0x2648, 0xcb06,
+	0x3c59, 0xe42e, 0xa200, 0xe0c2, 0x0100, 0xe0c2, 0x013d, 0xe0c2,
+	0x0128, 0xcc8e, 0x2a88, 0xb692, 0xae08, 0xa91c, 0xe0c2, 0x017c,
+	0xa218, 0xe0c2, 0x017d, 0xa200, 0xe41e, 0x20a3, 0x2a22, 0xe017,
+	0xae09, 0xe056, 0xa203, 0xae11, 0xe056, 0xe0c2, 0x0213, 0xa200,
+	0xe0c2, 0x0215, 0xa202, 0xe0c2, 0x0210, 0x2057, 0x4c58, 0xae08,
+	0xe0c2, 0x0101, 0xe0c2, 0x0205, 0xa200, 0xe41e, 0x20a3, 0x2a22,
+	0xe017, 0xae07, 0xe056, 0xe0c2, 0x0102, 0xe42e, 0xe0c0, 0x0050,
+	0xe049, 0xe008, 0x007f, 0x3c08, 0xaf11, 0xe009, 0x007f, 0x3e09,
+	0x4608, 0x3e08, 0xa200, 0x2a08, 0xa803, 0xf03b, 0xe00a, 0x0002,
+	0x2a08, 0xa805, 0xf02b, 0xa912, 0x2a08, 0xa809, 0xf02b, 0xa940,
+	0x2a08, 0xa811, 0xf02b, 0xa980, 0xe0c2, 0x040c, 0xe0c1, 0x0046,
+	0xe004, 0x0002, 0xae10, 0xe042, 0x2a09, 0xa803, 0xf05b, 0xe161,
+	0x05cb, 0x2111, 0x4d11, 0xcf0e, 0xe0c1, 0x0046, 0xe004, 0x004a,
+	0xae10, 0xe042, 0x2a09, 0xa805, 0xf05b, 0xe161, 0x05cd, 0x2111,
+	0x4d11, 0xe0c2, 0x0103, 0xe0c1, 0x0046, 0xe004, 0x007a, 0xae10,
+	0xe042, 0x2a09, 0xa809, 0xf05b, 0xe161, 0x05cf, 0x2111, 0x4d11,
+	0xe0c2, 0x0211, 0xe0c1, 0x0046, 0xe004, 0x007a, 0xe000, 0x0040,
+	0xae10, 0xe042, 0x2a09, 0xa811, 0xf05b, 0xe161, 0x05d1, 0x2111,
+	0x4d11, 0xe0c2, 0x0212, 0x2843, 0xae02, 0x4c3f, 0xae02, 0x4c42,
+	0xe0c2, 0x0104, 0xe0c2, 0x0204, 0xa200, 0xe0c2, 0x0208, 0xe41e,
+	0x2656, 0xa20e, 0xe0c2, 0x0312, 0xe0c0, 0x0414, 0xe418, 0x018c,
+	0xe0c0, 0x0414, 0xe41a, 0x267f, 0xe41e, 0x0274, 0xa202, 0xe0c2,
+	0x0106, 0xe42e, 0xcb02, 0xaf02, 0xe0c2, 0x0113, 0xe0c2, 0x030d,
+	0xcb15, 0xae03, 0xe056, 0xe0c2, 0x022b, 0xcb94, 0xe0c2, 0x0115,
+	0xcba4, 0xe0c2, 0x012a, 0xcb8a, 0xe0c2, 0x0114, 0xa802, 0x3c5a,
+	0xe42a, 0xcb14, 0xae0a, 0xcb19, 0xe056, 0xe0c2, 0x0120, 0xcb8c,
+	0xe0c2, 0x0121, 0xcb8e, 0xe0c2, 0x0122, 0xcb90, 0xe0c2, 0x0123,
+	0xe42e, 0xcbd0, 0xe0c2, 0x030c, 0xcbd2, 0xe0c2, 0x0309, 0xcbd8,
+	0xe0c2, 0x030a, 0xcbda, 0xe0c2, 0x030b, 0x285e, 0xe0c2, 0x0320,
+	0xe42a, 0x285f, 0xe0c2, 0x0321, 0xcbf6, 0xe0c2, 0x0322, 0xe42e,
+	0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2, 0x0110, 0x2888, 0xe418,
+	0x2184, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xa202, 0xe0c2,
+	0x0302, 0xd022, 0x000f, 0xe163, 0x0380, 0x2883, 0xb608, 0xe184,
+	0x2664, 0x9f03, 0x8113, 0x8113, 0x8113, 0x2819, 0xf15a, 0x2ad6,
+	0xb5f6, 0xcc44, 0xe160, 0x0004, 0xe161, 0x0203, 0xe163, 0x0380,
+	0xe184, 0x2679, 0x2931, 0xf022, 0x2883, 0xb608, 0x9f03, 0x8113,
+	0x8113, 0x8113, 0xe190, 0xa200, 0xe0c2, 0x0302, 0xe42e, 0xe167,
+	0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17, 0xe009, 0x00ff,
+	0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101, 0xe0c3, 0x015d,
+	0xe162, 0x02b0, 0x2912, 0xaf02, 0x3c0a, 0x2912, 0xaf02, 0x3c0b,
+	0x2838, 0xa104, 0xf068, 0xe162, 0x02d0, 0x2912, 0xaf02, 0x3c0b,
+	0x280a, 0x180b, 0xf0d8, 0xe162, 0x02b0, 0xd022, 0x001f, 0xe184,
+	0x26ae, 0x2912, 0xaf02, 0x3c0b, 0x180a, 0xf028, 0xe190, 0x280b,
+	0xae02, 0xe41e, 0x0faa, 0xe049, 0xae11, 0x280a, 0xae02, 0xe41e,
+	0x0faa, 0xe055, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10, 0xe008,
+	0x001f, 0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0,
+	0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8,
+	0xe42e, 0xf044, 0xe41e, 0x2080, 0xe42e, 0xa200, 0xe42e, 0xe165,
+	0x07e8, 0x284f, 0x3d15, 0x284e, 0x3d15, 0x2838, 0x3d15, 0x287e,
+	0x3d15, 0xe42e, 0xe165, 0x0620, 0xa200, 0xe188, 0x001f, 0x3d15,
+	0xe41e, 0x277b, 0xd022, 0x0007, 0xe184, 0x26f0, 0xe41e, 0x275e,
+	0xe190, 0xe41e, 0x277b, 0xe165, 0x0620, 0xa2fe, 0x3d15, 0xa206,
+	0x3d15, 0xe41e, 0x275e, 0xe42e, 0x3c03, 0x18d8, 0xe42a, 0x2803,
+	0xf03a, 0x2829, 0x3cd9, 0x2803, 0x3cd8, 0xe41e, 0x2732, 0xe164,
+	0x0200, 0xe004, 0x00b0, 0xe41e, 0x2742, 0xe164, 0x0080, 0xe41e,
+	0x274a, 0xe164, 0x0082, 0xe41e, 0x274a, 0xe164, 0x0012, 0xe41e,
+	0x274a, 0xe164, 0x003a, 0xe004, 0x0005, 0xe41e, 0x2742, 0xe164,
+	0x0900, 0xe004, 0x000c, 0xe41e, 0x2742, 0xe41e, 0x273d, 0xa2fe,
+	0x3c29, 0x3c10, 0x2803, 0xe428, 0x3cd6, 0x28d9, 0x3c29, 0xe41e,
+	0x1b3f, 0xe42e, 0xe41e, 0x277b, 0xa200, 0x3c02, 0xe41e, 0x276f,
+	0xe165, 0x0620, 0xe166, 0x0600, 0xe42e, 0x2802, 0xe42a, 0xe41e,
+	0x275e, 0xe42e, 0xa102, 0xcc44, 0xe184, 0x2748, 0xe41e, 0x274a,
+	0xe190, 0xe42e, 0x2904, 0x3d15, 0x2916, 0x3d14, 0x2802, 0xa002,
+	0x3c02, 0xa140, 0xe424, 0xe41e, 0x275e, 0xe41e, 0x276f, 0xe165,
+	0x0620, 0xe166, 0x0600, 0xa200, 0x3c02, 0xe42e, 0x2400, 0x4c01,
+	0xce20, 0xd111, 0x0620, 0xd112, 0x0020, 0xd113, 0x0002, 0xca28,
+	0xf7f8, 0x2400, 0x4c01, 0xa080, 0x3400, 0x3c01, 0xe42e, 0x2400,
+	0x4c01, 0xce20, 0xd111, 0x0600, 0xd112, 0x0020, 0xd113, 0x0003,
+	0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x0037, 0xae11,
+	0xe042, 0x3400, 0x3c01, 0xe42e, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1ceb, 0xf0b4, 0xe04a, 0xaf10,
+	0x1855, 0xf074, 0xe009, 0x00ff, 0x1a56, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0691, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x0368, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x036c, 0xe40e, 0x00a4,
+	0xe41e, 0x0379, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x03c6,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x037b, 0xe40e, 0x00a4,
+	0xe41e, 0x0398, 0xe40e, 0x00a4, 0xe41e, 0x03e2, 0xe41e, 0x042c,
+	0xe41e, 0x086b, 0xe41e, 0x14ec, 0xe41e, 0x0bd4, 0xe41e, 0x03ff,
+	0xe42e, 0xa202, 0xe42e, 0xe41e, 0x0523, 0xe41e, 0x0174, 0xca28,
+	0xf7f8, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0800, 0xd112, 0x00c4,
+	0xd113, 0x0003, 0xca28, 0xf7f8, 0xe0c0, 0x0060, 0x3c98, 0xe0c0,
+	0x0061, 0x3cb4, 0xe41e, 0x0c09, 0xa200, 0xe0c2, 0x0054, 0xe42e,
+	0xe41e, 0x03b0, 0xe41e, 0x0c09, 0xa200, 0x3c91, 0x3c9e, 0x3c9f,
+	0x3ca0, 0x3ca1, 0xe161, 0x08c5, 0xe163, 0x08fc, 0x2513, 0x4d0b,
+	0xe0c1, 0x0054, 0xe052, 0xe0c2, 0x0054, 0x3511, 0x3d01, 0xe42e,
+	0xe162, 0x08d8, 0x2b02, 0xa811, 0xe163, 0x08fc, 0xa2fe, 0x3513,
+	0x3d0b, 0xf0cb, 0xe164, 0x08ce, 0xa203, 0x5b04, 0xe165, 0x08c5,
+	0x2115, 0x4d05, 0xe056, 0x3513, 0x3d0b, 0xe42e, 0xe41e, 0x0441,
+	0xd14b, 0x0200, 0xe41e, 0x0608, 0xe41e, 0x08ac, 0x28db, 0xe408,
+	0x03dd, 0xe41e, 0x06a9, 0x28e0, 0xa104, 0xe41a, 0x0bad, 0xe41e,
+	0x07a0, 0xf048, 0x28e0, 0xa104, 0xf70a, 0xe41e, 0x049a, 0xe41e,
+	0x07f8, 0xe42e, 0xe41e, 0x023a, 0xe41e, 0x0148, 0xd130, 0x0001,
+	0xd03a, 0x0001, 0xd008, 0x0000, 0xd039, 0x0000, 0xd049, 0x0000,
+	0xd047, 0x0000, 0xe0c0, 0x0062, 0xaf02, 0x3089, 0xaf06, 0x3096,
+	0xaf02, 0x308a, 0xa2fe, 0x3c22, 0xe0c2, 0x0079, 0xe42e, 0xd049,
+	0x0000, 0xd047, 0x0000, 0x2016, 0x4c17, 0xe0c2, 0x0071, 0x2822,
+	0xe0c2, 0x007a, 0x2821, 0xe0c2, 0x0079, 0x2897, 0xe0c2, 0x0073,
+	0x2899, 0xe0c2, 0x0074, 0x281c, 0xae02, 0x4c18, 0xae02, 0x4c19,
+	0xae10, 0x4c11, 0xae10, 0x4c10, 0xe0c2, 0x007b, 0x281f, 0xae10,
+	0x4c20, 0xe0c2, 0x0072, 0x2893, 0xe016, 0xe0c2, 0x0070, 0x2893,
+	0x58f0, 0xe0c2, 0x0078, 0xe42e, 0xe0c0, 0x0040, 0xa23d, 0xae17,
+	0xe042, 0xe005, 0x1f00, 0xae03, 0xe042, 0xca29, 0xf7f9, 0xce20,
+	0xd111, 0x06f0, 0xd112, 0x0100, 0xd113, 0x0003, 0xca28, 0xf7f8,
+	0xe42e, 0xa200, 0x3cdc, 0xcc4a, 0xcc4c, 0x3cdb, 0xd130, 0x0001,
+	0xd03a, 0x0001, 0xd008, 0x0000, 0xe41e, 0x1a2c, 0xe41e, 0x1a64,
+	0x283d, 0xe41a, 0x025f, 0xe0c0, 0x0050, 0xe049, 0xe008, 0x007f,
+	0x3cb7, 0xaf11, 0xe009, 0x007f, 0x3eb8, 0x46b7, 0x3eb7, 0xa200,
+	0x2ab7, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2ab7, 0xa805, 0xf03b,
+	0xe00a, 0x0009, 0x2ab7, 0xa809, 0xf03b, 0xe00a, 0x0020, 0x2ab7,
+	0xa811, 0xf03b, 0xe00a, 0x0040, 0x2ab7, 0xa821, 0xf03b, 0xe00a,
+	0x0010, 0x2ab7, 0xa841, 0xf03b, 0xe00a, 0x0002, 0xe0c2, 0x040c,
+	0xa200, 0x3ca4, 0x3ca5, 0x3ca6, 0xe0c0, 0x0060, 0xe049, 0xa81f,
+	0x3ea6, 0xaf08, 0x30a5, 0xaf02, 0xa202, 0x3cde, 0xe0c0, 0x0065,
+	0xaf04, 0xa80e, 0x3cdf, 0xa200, 0x3ce0, 0xe41e, 0x050f, 0xe41e,
+	0x192e, 0xe42e, 0xd049, 0x0000, 0xd047, 0x0000, 0x20a0, 0x4ca1,
+	0xe0c2, 0x0070, 0x28e0, 0xe418, 0x0bad, 0x289c, 0xe000, 0x08ca,
+	0xe094, 0x2902, 0xe0c2, 0x0071, 0x2895, 0xe0c2, 0x0072, 0x2850,
+	0xae02, 0x4c4f, 0xae02, 0x4c4e, 0xae04, 0x4c4a, 0xae02, 0x4c19,
+	0xae1e, 0x4c4b, 0xae06, 0x4c4c, 0xe0c2, 0x0073, 0x2053, 0x4c54,
+	0xe0c2, 0x006f, 0x281f, 0xae10, 0x4c20, 0xe0c2, 0x007c, 0x2822,
+	0xe0c2, 0x007e, 0x2821, 0xe0c2, 0x007d, 0xa200, 0x2a9c, 0xae05,
+	0xe001, 0x08e4, 0xe095, 0x2b02, 0xaf07, 0xa80f, 0xe056, 0x2ae0,
+	0xb612, 0xe0c2, 0x0074, 0xa200, 0x28e0, 0xae04, 0xe0c2, 0x0075,
+	0x2894, 0xe016, 0x2adb, 0xae29, 0xe056, 0x2adb, 0xae21, 0xe056,
+	0xe0c2, 0x0076, 0xe162, 0x08c7, 0x2902, 0xb7e8, 0x2a4b, 0xa109,
+	0xb7d6, 0x2a94, 0xb7d2, 0xf0c4, 0xe162, 0x08d8, 0xe164, 0x08cf,
+	0x2b02, 0xaf05, 0xa807, 0xf04b, 0x2b04, 0xf025, 0x2904, 0x2ae0,
+	0xb7d2, 0xe0c2, 0x0077, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2,
+	0x0053, 0xe41e, 0x0519, 0xe41e, 0x18e6, 0xe42e, 0xe42e, 0xe0c1,
+	0x0054, 0xe165, 0x08c5, 0x2115, 0x4d0d, 0xe052, 0x3515, 0x3d0d,
+	0xe42e, 0xe165, 0x08c3, 0x2115, 0x4d15, 0x2315, 0x4f15, 0xe056,
+	0xe0c2, 0x0054, 0xe42e, 0xe166, 0x0064, 0xe167, 0x08f0, 0xd022,
+	0x0003, 0xe184, 0x052d, 0x9e16, 0x3517, 0x3d17, 0xe167, 0x07dc,
+	0xd022, 0x0001, 0xe184, 0x0536, 0x9e16, 0x3517, 0x3d17, 0xe42e,
+	0xd148, 0x0040, 0xd144, 0x0000, 0xd145, 0x0000, 0xd168, 0x0000,
+	0xd14b, 0x0200, 0xe004, 0x0019, 0xae18, 0xcec0, 0xd14c, 0x000c,
+	0xca9a, 0xf7f8, 0xe42e, 0xcc44, 0xe184, 0x0554, 0xca9c, 0xe418,
+	0x0703, 0xcaa0, 0xca9b, 0xf7f9, 0xe190, 0xe42e, 0xa200, 0x3cd7,
+	0x3cd6, 0x3cd4, 0xe41e, 0x07a0, 0xf138, 0xe41e, 0x05aa, 0xe41e,
+	0x07a0, 0xf0e8, 0xe41e, 0x083e, 0xa206, 0xcaa3, 0xe009, 0x00ff,
+	0xb656, 0xe41e, 0x054b, 0x3c03, 0xe41e, 0x07a0, 0xf05a, 0xa214,
+	0x3cd3, 0xa200, 0xe42e, 0x2803, 0xaf0e, 0xf688, 0x2803, 0xa83e,
+	0x3cd3, 0xe41e, 0x0676, 0xe41e, 0x06b2, 0xa202, 0xe42e, 0xa200,
+	0x3cd7, 0x3cd6, 0x3cd4, 0xe41e, 0x07a0, 0xf198, 0xe41e, 0x05aa,
+	0xe41e, 0x07a0, 0xf148, 0xe41e, 0x083e, 0xcaa2, 0xe008, 0x00ff,
+	0x3c03, 0xe008, 0x007f, 0xa114, 0xf034, 0xa12a, 0xf056, 0xa202,
+	0xe41e, 0x054b, 0xf6ce, 0xe41e, 0x07a0, 0xf05a, 0xa214, 0x3cd3,
+	0xa200, 0xe42e, 0x2803, 0xaf0e, 0xf628, 0x2803, 0xa83e, 0x3cd3,
+	0xa202, 0xe42e, 0xd158, 0x0100, 0xe004, 0x00ff, 0xe014, 0xceb8,
+	0xd15d, 0x0000, 0xd15e, 0x0000, 0xd15f, 0x0000, 0xe004, 0x0019,
+	0xae18, 0xe00a, 0x0620, 0xcec0, 0xd157, 0x0000, 0xd14a, 0x0000,
+	0xd14c, 0x0003, 0xca9c, 0xe418, 0x0703, 0xca9a, 0xf7c8, 0xcaae,
+	0xa802, 0xf73a, 0xca9c, 0xe418, 0x0703, 0xa200, 0xe42e, 0x28d4,
+	0xe428, 0xe004, 0x0080, 0x2ac8, 0xb616, 0xce92, 0xd158, 0x0000,
+	0xe004, 0x01ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e, 0x0000,
+	0xd15f, 0x0000, 0xe004, 0x0019, 0xae18, 0xe00a, 0x0638, 0xcec0,
+	0xd161, 0x0003, 0xd14a, 0x0000, 0xd14c, 0x0003, 0xca9c, 0xe418,
+	0x0703, 0xca9a, 0xf7c8, 0xca9c, 0xf7a8, 0xca94, 0x3cd5, 0xca9e,
+	0x3cd4, 0x28d5, 0x00d7, 0x0cd6, 0x34d7, 0x3cd6, 0xcc90, 0xcc8c,
+	0x28d4, 0xcc92, 0xcc8e, 0xe428, 0x28c8, 0xe016, 0x3cc8, 0xe42e,
+	0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0615, 0xa102, 0xe40a, 0x0670,
+	0xa102, 0xe40a, 0x0624, 0xe40e, 0x0670, 0xe0c0, 0x0060, 0x34b9,
+	0x3cba, 0x34bf, 0x3cc0, 0xe0c0, 0x0061, 0xae14, 0x34bb, 0x3cbc,
+	0x04b9, 0x0cba, 0x34bd, 0x3cbe, 0x28c7, 0xf13a, 0xe0c0, 0x0048,
+	0x34d1, 0x3cd2, 0x24d1, 0x4cd2, 0xe0c1, 0x0049, 0x36c1, 0x3ec2,
+	0x14c1, 0x1cc2, 0xe0c1, 0x0045, 0xaf05, 0xa803, 0xb611, 0x3ec7,
+	0xe0c0, 0x0048, 0xe008, 0x01ff, 0x3cc5, 0xe0c0, 0x0048, 0x34bf,
+	0xe008, 0xfe00, 0x3cc0, 0xe0c0, 0x0048, 0x34c3, 0x3cc4, 0xa200,
+	0xcc92, 0xcc8e, 0xe180, 0xe41e, 0x0676, 0xe41e, 0x0222, 0xd071,
+	0x202a, 0xe181, 0xa200, 0x3cc9, 0x283c, 0xa104, 0xf10a, 0xa200,
+	0x34d7, 0x3cd6, 0xcc72, 0xe41e, 0x06b2, 0x2cc5, 0xa102, 0xf034,
+	0xba4f, 0xf7de, 0xc872, 0xe41e, 0x0838, 0xf0be, 0xe41e, 0x0703,
+	0xe41e, 0x0538, 0x28c5, 0xa102, 0xe412, 0x054b, 0xa200, 0xceaa,
+	0xa202, 0x3cc9, 0xa202, 0xb61a, 0xe16a, 0xe42e, 0xd030, 0x0000,
+	0xd031, 0x0000, 0xd032, 0x0000, 0xd034, 0x0000, 0xd033, 0x0000,
+	0xd035, 0x0000, 0xd036, 0x00ff, 0xd037, 0x0000, 0xd038, 0x0000,
+	0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000, 0xd149, 0x0000,
+	0xe42e, 0xc896, 0xf05a, 0xe41e, 0x06bf, 0x3cd9, 0xf058, 0xd04b,
+	0x0001, 0xa200, 0x3cd9, 0x28d8, 0xcc6e, 0xd04c, 0x0000, 0xe470,
+	0xa202, 0x3cd9, 0xe41e, 0x06bf, 0xcc96, 0xe42a, 0x28d8, 0xcc6e,
+	0xe42e, 0xc896, 0xe428, 0xd04b, 0x0001, 0x28d8, 0xcc6e, 0xd04c,
+	0x0000, 0xe42e, 0xa200, 0x3cc8, 0x3cd8, 0xe41e, 0x06bf, 0x3cd9,
+	0xd04b, 0x0001, 0x28d8, 0xcc6e, 0xe190, 0xe128, 0xe42e, 0x283c,
+	0xa104, 0xf04a, 0xe41e, 0x06ce, 0xf03e, 0xe41e, 0x05cf, 0xe004,
+	0x0080, 0x2ac8, 0xb616, 0x3cd8, 0xa200, 0xe42e, 0x28c7, 0xe428,
+	0xd027, 0x0000, 0xe41e, 0x0760, 0xd027, 0x0001, 0xca28, 0xf7f8,
+	0x24bf, 0x4cc0, 0xce20, 0x28c8, 0xae0e, 0xce22, 0xd112, 0x0080,
+	0xe0c0, 0x0043, 0xa806, 0xae02, 0xa022, 0xce26, 0xca28, 0xf7f8,
+	0x24bf, 0x4cc0, 0xe000, 0x0200, 0x34bf, 0x3cc0, 0x14bd, 0x1cbe,
+	0xf054, 0x24b9, 0x4cba, 0x34bf, 0x3cc0, 0xe41e, 0x07fa, 0x28c8,
+	0xe016, 0x3cc8, 0x28da, 0x00d7, 0x0cd6, 0x34d7, 0x3cd6, 0xcc8c,
+	0x28c7, 0xcc8e, 0xe42e, 0x28c7, 0xf1aa, 0xe41e, 0x024f, 0xe000,
+	0x0440, 0xce50, 0xe005, 0x010a, 0x28da, 0xa806, 0xa108, 0xe012,
+	0xa806, 0xae06, 0x3cfe, 0xe004, 0x010a, 0x58fe, 0xce52, 0xe41e,
+	0x0257, 0xd14e, 0x0000, 0xd144, 0x0000, 0xe42e, 0xd027, 0x0000,
+	0xe41e, 0x0760, 0xd027, 0x0001, 0x28da, 0xf25a, 0xca48, 0xa802,
+	0xf7e8, 0x24bf, 0x4cc0, 0xce40, 0xd121, 0x0000, 0xd122, 0x0040,
+	0xe0c0, 0x0043, 0xa806, 0xae02, 0xa032, 0xce46, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xca48, 0xa802, 0xf7e8, 0x24bf, 0x4cc0, 0xe000,
+	0x0200, 0x34bf, 0x3cc0, 0x14bd, 0x1cbe, 0xf054, 0x24b9, 0x4cba,
+	0x34bf, 0x3cc0, 0x28c7, 0xe418, 0x07b7, 0xe41e, 0x07fa, 0xd14e,
+	0x0000, 0xd144, 0x0000, 0xe42e, 0xe0c1, 0x0059, 0xa103, 0xa200,
+	0xb636, 0xe000, 0x001c, 0xe0c1, 0x0045, 0xe052, 0xe01a, 0xe42e,
+	0xe0c0, 0x0043, 0xa808, 0xf318, 0xa200, 0x3cc6, 0xe004, 0x0200,
+	0x3cda, 0xe41e, 0x0754, 0x3cc7, 0x24bf, 0x4cc0, 0xe0c1, 0x0049,
+	0x36d1, 0x3ed2, 0x26d1, 0x4ed2, 0xe045, 0xf033, 0x06bb, 0x0ebc,
+	0xe003, 0x0200, 0x28c7, 0xb602, 0x3cc7, 0xf173, 0xe001, 0x0200,
+	0x3eda, 0x28c7, 0xf128, 0x28c6, 0xf658, 0xe0c0, 0x005c, 0xe008,
+	0x4000, 0xf60a, 0xe0c0, 0x005d, 0xe00a, 0x4000, 0xe0c2, 0x005d,
+	0xa202, 0xce00, 0x3cc6, 0xf56e, 0x28da, 0x2ac7, 0xf039, 0xe004,
+	0x0200, 0x3cda, 0xe42e, 0xc868, 0xa80e, 0x3c00, 0x7400, 0xe42e,
+	0x28c7, 0xe42a, 0xe41e, 0x07fa, 0xe0c0, 0x0049, 0x34d1, 0x3cd2,
+	0x24d1, 0x4cd2, 0xe0c1, 0x0048, 0x36d1, 0x3ed2, 0x26d1, 0x4ed2,
+	0xe045, 0xa200, 0xb626, 0xe003, 0x0200, 0xb606, 0xe42e, 0xe41e,
+	0x024f, 0x28da, 0xe002, 0x0200, 0xe40a, 0x07f6, 0x28da, 0xa806,
+	0xf1fa, 0xa108, 0xe012, 0xae06, 0x3cfe, 0x28da, 0xaf04, 0xae20,
+	0xe000, 0x01c0, 0xce50, 0xe190, 0xca52, 0x5cfe, 0x58fe, 0x2ada,
+	0xa807, 0xae07, 0x3efe, 0xe005, 0x010a, 0x5efe, 0xe056, 0x2ada,
+	0xaf05, 0xae21, 0xe001, 0x0140, 0xce51, 0xe190, 0xce52, 0xe004,
+	0x01fc, 0x18da, 0xf022, 0xf13e, 0x28da, 0xa006, 0xaf04, 0xae20,
+	0xe000, 0x0440, 0xce50, 0x28da, 0xa806, 0xa108, 0xe012, 0xae06,
+	0xa83e, 0x3cfe, 0xe004, 0x010a, 0x58fe, 0xce52, 0xe40e, 0x0257,
+	0xe41e, 0x079b, 0x283c, 0xa104, 0xf1aa, 0xc872, 0xc001, 0x343b,
+	0x3c3c, 0xc000, 0x26d7, 0x4ed6, 0xae07, 0xe045, 0xf053, 0x26d7,
+	0x4ed6, 0xae07, 0xcc73, 0xe41e, 0x0833, 0xe049, 0xc001, 0x243b,
+	0x4c3c, 0xc000, 0xaf06, 0xe046, 0xb608, 0xf02e, 0xcaaa, 0x2ac9,
+	0xb616, 0xe0c1, 0x0048, 0x36d1, 0x3ed2, 0x26d1, 0x4ed2, 0xe042,
+	0xe049, 0x16bd, 0x1ebe, 0xf035, 0x14bb, 0x1cbc, 0xe0c2, 0x0048,
+	0xe0c2, 0x0052, 0xa200, 0xceaa, 0xc001, 0x243b, 0x4c3c, 0xc000,
+	0xe41e, 0x0838, 0xe42e, 0xc001, 0x2439, 0x4c3a, 0xc000, 0xe42e,
+	0xc001, 0xaf06, 0x3439, 0x3c3a, 0xc000, 0xe42e, 0xe41e, 0x07fa,
+	0xc001, 0xe0c0, 0x0048, 0x3417, 0x3c18, 0xc000, 0xe42e, 0xe0c0,
+	0x0045, 0xaf04, 0xa80e, 0xa104, 0xe428, 0x283c, 0xa104, 0xf06a,
+	0xe41e, 0x07a0, 0xe418, 0x01db, 0xe42e, 0xe41e, 0x05aa, 0xcaa2,
+	0xe008, 0x00ff, 0xe002, 0x000a, 0xe428, 0xe41e, 0x07a0, 0xe418,
+	0x01db, 0xe42e, 0xa200, 0xceaa, 0xc001, 0x2417, 0x4c18, 0xc000,
+	0xe0c2, 0x0048, 0xe42e, 0xe0c0, 0x0067, 0xe049, 0xa806, 0x3c3c,
+	0xe04a, 0xa810, 0xe01a, 0x3ce6, 0xa809, 0xe41b, 0x0a8f, 0xe41e,
+	0x0608, 0xf2ca, 0xa200, 0x3c91, 0x3c93, 0xe16a, 0x283c, 0xa104,
+	0xf108, 0xa23e, 0x3cf0, 0xe41e, 0x0af1, 0xe40a, 0x08a5, 0xe41e,
+	0x0556, 0xe41e, 0x1004, 0xe40d, 0x08a5, 0xe41d, 0x0847, 0xf06e,
+	0xe41e, 0x0f0b, 0xd1ff, 0x0000, 0xf11d, 0xa214, 0x3cf0, 0x2816,
+	0xf0d6, 0xe002, 0x0800, 0xf0a0, 0x2817, 0xf086, 0xe002, 0x0800,
+	0xf050, 0xa200, 0x3c93, 0xa202, 0xf05e, 0xa202, 0x3c93, 0xe16a,
+	0xa200, 0xe41e, 0x07f8, 0xe42e, 0xe41e, 0x0c2c, 0xf068, 0xe41e,
+	0x0a15, 0xe41e, 0x0a1a, 0xe42e, 0x2810, 0xa104, 0xe408, 0x08bb,
+	0xe40e, 0x090f, 0xe42e, 0xa200, 0x3c94, 0x3c95, 0xe162, 0x0670,
+	0xc73f, 0x3d12, 0xe16a, 0xe41e, 0x07a0, 0x3c91, 0x2891, 0xf10a,
+	0xe41e, 0x0847, 0xe0c0, 0x0045, 0xa808, 0xe01a, 0x3c91, 0xa208,
+	0x3c4b, 0x3c4c, 0xe41e, 0x0a0a, 0xe41e, 0x0a1a, 0xe42e, 0xe41e,
+	0x10ec, 0xd1ff, 0x0001, 0xf06c, 0xa208, 0x3c4b, 0x3c4c, 0xa202,
+	0x3c94, 0x28df, 0xf0da, 0xe41e, 0x0b8b, 0xf0aa, 0xe41e, 0x0c33,
+	0x209e, 0x4c9f, 0x2a91, 0xb436, 0x349e, 0x3c9f, 0xf07e, 0xe41e,
+	0x0a0a, 0xe41e, 0x0a1d, 0xe41e, 0x0a1a, 0x2041, 0x4c42, 0xe005,
+	0x0030, 0xae21, 0xe046, 0xf112, 0x2041, 0x4c42, 0xae06, 0xc873,
+	0xe046, 0xf0b6, 0xe049, 0xa83f, 0xf05b, 0x3e00, 0xe046, 0x7600,
+	0xf046, 0xba7f, 0xa140, 0xf7e0, 0xe41d, 0x0847, 0xe42e, 0xa200,
+	0x3c92, 0xa200, 0x3c51, 0x3c52, 0x3c57, 0x2892, 0xb63a, 0xe418,
+	0x0847, 0x2892, 0xe428, 0x28dd, 0xf0ba, 0xa200, 0x3cdd, 0x28d4,
+	0xcc92, 0x28d3, 0xa118, 0xe40a, 0x0964, 0xe40e, 0x096a, 0xe41e,
+	0x057f, 0xf2aa, 0x28d3, 0xa114, 0xf27a, 0x28d3, 0xa116, 0xf30a,
+	0x28d3, 0xa118, 0xf32a, 0x28d3, 0xa11a, 0xf35a, 0x28d3, 0xa11c,
+	0xf3aa, 0x28d3, 0xa11e, 0xe40a, 0x097c, 0x28d3, 0xa136, 0xe40a,
+	0x098f, 0x28d3, 0xa138, 0xe40a, 0x098f, 0x28d3, 0xa13a, 0xe40a,
+	0x098f, 0x28d3, 0xa13c, 0xe40a, 0x098f, 0x28d3, 0xa13e, 0xe40a,
+	0x098f, 0xe40e, 0x0915, 0xe41e, 0x0847, 0xa202, 0x3c91, 0xa208,
+	0x3c4b, 0x3c4c, 0xe41e, 0x0a0a, 0xe41e, 0x0a1a, 0xe42e, 0xa202,
+	0xe41e, 0x054b, 0xe40e, 0x0915, 0xe41e, 0x0556, 0xe41e, 0x09e6,
+	0xe40e, 0x0915, 0xe41e, 0x0bbe, 0xe41e, 0x0556, 0xe41e, 0x09a7,
+	0xe40e, 0x0915, 0xe41e, 0x0556, 0xe41e, 0x10a1, 0xe41e, 0x10dd,
+	0xd1ff, 0x0000, 0xe40e, 0x0915, 0xe41e, 0x0556, 0xe41e, 0x1004,
+	0xe41e, 0x14f5, 0xe41e, 0x107a, 0xe41e, 0x0c29, 0xa200, 0x3c91,
+	0xd1ff, 0x0000, 0x28db, 0xe408, 0x0995, 0xe40e, 0x0915, 0xe41e,
+	0x0556, 0xe41e, 0x194b, 0xe40e, 0x0915, 0xe41e, 0x14ec, 0xe41e,
+	0x0862, 0xa202, 0x3c92, 0xe161, 0x08c7, 0x289c, 0xe000, 0x08ca,
+	0xe094, 0xa2fe, 0x3d01, 0xa2fa, 0x3d02, 0xe40e, 0x0915, 0xa200,
+	0x3c94, 0x3c95, 0xe162, 0x0670, 0xc73f, 0x3d12, 0xe16a, 0xe41e,
+	0x1119, 0xd1ff, 0x0001, 0xf06c, 0xa208, 0x3c4b, 0x3c4c, 0xa202,
+	0x3c94, 0x28df, 0xe418, 0x0b8b, 0xe418, 0x0c33, 0xf058, 0xe41e,
+	0x0a0a, 0xe41e, 0x0a1d, 0x284a, 0xa106, 0x2a4b, 0xa109, 0xb636,
+	0xf05a, 0xe41e, 0x0a1a, 0xa202, 0x3c92, 0x2892, 0xe428, 0x2851,
+	0xa002, 0x3c51, 0xe41e, 0x0b21, 0xe428, 0x28e0, 0xe428, 0xa202,
+	0x3c94, 0x284e, 0x3c52, 0xa200, 0x3c57, 0xe41e, 0x0c8c, 0xe41e,
+	0x0a1d, 0xe41e, 0x0a1a, 0xa202, 0x3c92, 0xe42e, 0x284a, 0xa106,
+	0xe428, 0x2851, 0xa102, 0xe428, 0x28e0, 0xf0e8, 0xe41e, 0x1130,
+	0xd1ff, 0x0001, 0xf03c, 0xa202, 0x3c94, 0xe41e, 0x0c8c, 0xe41e,
+	0x0a1d, 0xe41e, 0x0a1a, 0xa202, 0x3c92, 0xe42e, 0x28e0, 0xe428,
+	0xe41e, 0x113c, 0xd1ff, 0x0001, 0xf03c, 0xa202, 0x3c94, 0xe41e,
+	0x0a1d, 0xe42e, 0xe41e, 0x1691, 0xe41e, 0x0c33, 0xe41e, 0x0c8c,
+	0xe41e, 0x18b9, 0xe41e, 0x181e, 0xe42e, 0xe41e, 0x0c4e, 0xe41e,
+	0x181e, 0xe42e, 0xe41e, 0x1879, 0xe42e, 0xe166, 0x08c7, 0x2906,
+	0xe424, 0xe41e, 0x1506, 0xe41e, 0x163c, 0x2894, 0xf038, 0xe16a,
+	0xf02e, 0xe16b, 0x284b, 0xa108, 0xe42a, 0xa2fe, 0xcf08, 0xd18c,
+	0x0001, 0xcb18, 0xf7f8, 0xa200, 0x3c87, 0x3c88, 0x3c86, 0xe41d,
+	0x0847, 0xe41e, 0x1b18, 0xe41e, 0x1b32, 0xe41e, 0x1b8a, 0x28a7,
+	0xe418, 0x1890, 0xe41e, 0x1ba2, 0xd1ff, 0x0002, 0x2886, 0xa002,
+	0x3c86, 0x2887, 0xa002, 0x3c87, 0x1855, 0xf6a4, 0xa200, 0x3c87,
+	0x2888, 0xa002, 0x3c88, 0x1856, 0xf312, 0xa202, 0x2a3e, 0xe419,
+	0x116b, 0xe40a, 0x0a82, 0x2810, 0xa104, 0xf5a8, 0xc894, 0x4c6b,
+	0xf578, 0x2894, 0xf208, 0xe41e, 0x0b57, 0xf1da, 0xe41e, 0x0556,
+	0xe41e, 0x113c, 0xd1ff, 0x0001, 0xf16d, 0x2888, 0x1857, 0xf138,
+	0x2856, 0x1857, 0xf106, 0xe41e, 0x1506, 0xe41e, 0x163c, 0xa200,
+	0x3c87, 0x2857, 0x3c88, 0x8488, 0x8255, 0xe018, 0x3c86, 0xe16a,
+	0xe40e, 0x0a37, 0xe16b, 0xe40e, 0x0a37, 0x2856, 0xcf08, 0xd18c,
+	0x0001, 0xcb18, 0xf7f8, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xd030,
+	0x0000, 0xd034, 0x0000, 0xd033, 0x0000, 0xd035, 0x0000, 0xd036,
+	0x007f, 0xd037, 0x0000, 0xd038, 0x0000, 0xe181, 0xe0c0, 0x0060,
+	0x34b9, 0x3cba, 0xe0c0, 0x0061, 0xae14, 0x34bb, 0x3cbc, 0x04b9,
+	0x0cba, 0x34bd, 0x3cbe, 0xe0c0, 0x0048, 0xe008, 0x01ff, 0x3cc5,
+	0xe0c0, 0x0048, 0x34bf, 0xe008, 0xfe00, 0x3cc0, 0xca28, 0xf7f8,
+	0x24bf, 0x4cc0, 0xce20, 0xd111, 0x0000, 0xd112, 0x0080, 0xe0c0,
+	0x0043, 0xa806, 0xae02, 0xa022, 0xce26, 0xca28, 0xf7f8, 0x24bf,
+	0x4cc0, 0xe000, 0x0200, 0x34bf, 0x3cc0, 0xe049, 0x16bd, 0x1ebe,
+	0xf055, 0x24b9, 0x4cba, 0x34bf, 0x3cc0, 0xce20, 0xd111, 0x0080,
+	0xd112, 0x0080, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa022, 0xce26,
+	0xca28, 0xf7f8, 0xe128, 0x28c5, 0xa102, 0xf034, 0xba4f, 0xf7de,
+	0xba3f, 0xe009, 0x0085, 0xe003, 0x0085, 0xa204, 0xb636, 0x3c3c,
+	0xe42e, 0xe41e, 0x057f, 0xf23a, 0x28d3, 0xa114, 0xf20a, 0x28d3,
+	0xa116, 0xf23a, 0x28d3, 0xa118, 0xf20a, 0x28d3, 0xa11a, 0xf1da,
+	0x28d3, 0xa11c, 0xf1aa, 0x28d3, 0xa11e, 0xf15a, 0x28d3, 0xa136,
+	0xf14a, 0x28d3, 0xa138, 0xf11a, 0x28d3, 0xa13a, 0xf0ea, 0x28d3,
+	0xa13c, 0xf0ba, 0x28d3, 0xa13e, 0xf08a, 0xf07e, 0xe41e, 0x0847,
+	0xa200, 0xe42e, 0xa202, 0xe42e, 0xa202, 0xe41e, 0x054b, 0xe40e,
+	0x0af1, 0xe41e, 0x057f, 0xf25a, 0x28d3, 0xa114, 0xf22a, 0x28d3,
+	0xa116, 0xf1fa, 0x28d3, 0xa118, 0xf1ea, 0x28d3, 0xa11a, 0xf19a,
+	0x28d3, 0xa11c, 0xf16a, 0x28d3, 0xa11e, 0xf13a, 0x28d3, 0xa136,
+	0xf14a, 0x28d3, 0xa138, 0xf11a, 0x28d3, 0xa13a, 0xf0ea, 0x28d3,
+	0xa13c, 0xe40a, 0x0b4c, 0x28d3, 0xa13e, 0xe40a, 0x0b4c, 0xf0be,
+	0xa200, 0xe42e, 0xa202, 0xe42e, 0xe41e, 0x0556, 0xe41e, 0x194b,
+	0xe40e, 0x0b21, 0xa202, 0xe41e, 0x054b, 0xe40e, 0x0b21, 0xe41e,
+	0x057f, 0xf23a, 0x28d3, 0xa114, 0xf20a, 0x28d3, 0xa116, 0xf1fa,
+	0x28d3, 0xa118, 0xf1aa, 0x28d3, 0xa11a, 0xf17a, 0x28d3, 0xa11c,
+	0xf14a, 0x28d3, 0xa11e, 0xf11a, 0x28d3, 0xa136, 0xf12a, 0x28d3,
+	0xa138, 0xf0fa, 0x28d3, 0xa13a, 0xf0ca, 0x28d3, 0xa13c, 0xf09a,
+	0x28d3, 0xa13e, 0xf06a, 0xf0be, 0xa200, 0xe42e, 0xa202, 0xe42e,
+	0xe41e, 0x0556, 0xe41e, 0x194b, 0xe40e, 0x0b57, 0xa202, 0xe41e,
+	0x054b, 0xe40e, 0x0b57, 0x28df, 0xf1da, 0xa102, 0xf06a, 0xa102,
+	0xf0ba, 0xa104, 0xf0ea, 0xf12e, 0x284b, 0x444c, 0xf13a, 0xa204,
+	0x3ce0, 0xa202, 0xe42e, 0x284b, 0x084c, 0xa102, 0xf0b6, 0xf06e,
+	0x284b, 0x4c4c, 0xa804, 0xf06a, 0xf01e, 0xa202, 0x3ce0, 0xa202,
+	0xe42e, 0xa200, 0x3ce0, 0xa200, 0xe42e, 0x283c, 0xa104, 0xf02a,
+	0xe42e, 0xe41e, 0x07a0, 0xe428, 0xe41e, 0x057f, 0x28d3, 0xa116,
+	0xe428, 0xa202, 0xe41e, 0x054b, 0xf75e, 0xe42e, 0x28dc, 0xe428,
+	0xc001, 0x2417, 0x4c18, 0xc000, 0xe0c2, 0x0051, 0xa202, 0x3cdc,
+	0xe42e, 0x28dc, 0xe428, 0xe41e, 0x07fa, 0xe0c0, 0x0048, 0xe0c2,
+	0x0051, 0xa202, 0x3cdc, 0xe42e, 0xa202, 0x3c8e, 0x283f, 0x2a10,
+	0xa105, 0xb636, 0x3c8b, 0xa200, 0x3c8c, 0xa202, 0x3c8f, 0xa204,
+	0x2a8f, 0xb452, 0x3c97, 0xa204, 0x2a10, 0xa105, 0xb633, 0x468f,
+	0xb632, 0x2a8b, 0x4e8c, 0xb616, 0x0897, 0x3c97, 0xa104, 0xf030,
+	0xa206, 0x3c97, 0xa200, 0x2a8f, 0xb432, 0x2a89, 0xb616, 0x3c99,
+	0x288d, 0x4c8e, 0xb630, 0x3c9a, 0x288f, 0x3c9b, 0x2a89, 0xb616,
+	0x3c9b, 0xa200, 0x3c9c, 0xa202, 0x3c9d, 0xa200, 0x3c9e, 0x3ca0,
+	0xe42e, 0xe165, 0x07e0, 0xa200, 0xd022, 0x001f, 0xe184, 0x0c11,
+	0x3d15, 0xa002, 0xe165, 0x08c3, 0xa200, 0x3515, 0x3d15, 0x3515,
+	0x3d15, 0xe165, 0x08c7, 0xa2fa, 0xc708, 0x3d15, 0x2816, 0xa01e,
+	0xaf08, 0xae08, 0x3ca2, 0x2817, 0xa01e, 0xaf08, 0xae08, 0x3ca3,
+	0xe42e, 0xa202, 0x3c9d, 0xe42e, 0xe41e, 0x0d15, 0xe41e, 0x0eee,
+	0xb60c, 0xb620, 0xe42e, 0xe41e, 0x0d15, 0x28e0, 0xe41a, 0x0d1d,
+	0xe41e, 0x0d4f, 0xe41e, 0x0ddd, 0xe41e, 0x0e42, 0x28e0, 0xf0e8,
+	0xa200, 0x3c9d, 0x209e, 0x4c9f, 0x2a91, 0xb436, 0x349e, 0x3c9f,
+	0x20a0, 0x4ca1, 0xa002, 0x34a0, 0x3ca1, 0xe42e, 0xe41e, 0x0d15,
+	0xa2fa, 0xe162, 0x08c7, 0x3d02, 0xe162, 0x08db, 0xe163, 0x08eb,
+	0xe164, 0x08ef, 0xd022, 0x0003, 0xe184, 0x0c5f, 0x290b, 0x3d0c,
+	0xd022, 0x0003, 0xe184, 0x0c65, 0x290b, 0x3d0c, 0xd022, 0x0003,
+	0xe184, 0x0c6b, 0x290a, 0x3d0c, 0xe162, 0x08c7, 0xe163, 0x08cb,
+	0xe164, 0x08cc, 0x290b, 0x3d0c, 0x290b, 0x3d0c, 0x290a, 0x3d0c,
+	0xe162, 0x08e8, 0x28a4, 0x4ca5, 0xae02, 0x4d02, 0x3d12, 0x28a4,
+	0xae02, 0x4ca5, 0xae08, 0x4ca6, 0xae14, 0x4d02, 0x3d02, 0xe41e,
+	0x0e42, 0xa200, 0x3c9d, 0xe42e, 0xe004, 0x004b, 0x0851, 0xe094,
+	0x2902, 0xa80c, 0xe428, 0x2851, 0xe408, 0x0cd8, 0x2852, 0xae02,
+	0xe000, 0x08d5, 0xe094, 0xa10a, 0xe096, 0x2902, 0x3d03, 0x2852,
+	0xe016, 0xae02, 0xe000, 0x08d5, 0xe094, 0xa10a, 0xe096, 0x2902,
+	0x3d03, 0xa206, 0x2a52, 0xb616, 0x2a4a, 0xa107, 0xb612, 0xe000,
+	0x0067, 0xe094, 0x2852, 0xae02, 0xe000, 0x08d1, 0xe096, 0x290a,
+	0xae0c, 0x4d0a, 0xae02, 0x4d0a, 0x3d03, 0xa206, 0x2a52, 0xb612,
+	0x2a4a, 0xa107, 0xb612, 0xe000, 0x0067, 0xe094, 0x2852, 0xe016,
+	0xae02, 0xe000, 0x08d1, 0xe096, 0x290a, 0xae0c, 0x4d0a, 0xae02,
+	0x4d0a, 0x3d03, 0xe162, 0x08d4, 0xa200, 0xc703, 0x3d12, 0xe42e,
+	0x2852, 0xae02, 0xe000, 0x08d1, 0xe094, 0xa102, 0xe096, 0x2902,
+	0x3d03, 0x2852, 0xe016, 0xae02, 0xe000, 0x08d5, 0xe094, 0xa102,
+	0xe096, 0x2902, 0x3d03, 0xa206, 0x2a52, 0xb616, 0x2a4a, 0xa107,
+	0xb612, 0xe000, 0x0067, 0xe094, 0x2852, 0xae02, 0xe000, 0x08d1,
+	0xe096, 0x290a, 0xae0c, 0x4d0a, 0xae02, 0x4d0a, 0x3d03, 0xa206,
+	0x2a52, 0xb612, 0x2a4a, 0xa107, 0xb612, 0xe000, 0x0067, 0xe094,
+	0x2852, 0xe016, 0xae02, 0xe000, 0x08d5, 0xe096, 0x290a, 0xae0c,
+	0x4d0a, 0xae02, 0x4d0a, 0x3d03, 0xe42e, 0x289c, 0xe426, 0xe162,
+	0x08ca, 0x2902, 0xe41e, 0x0e9a, 0xe42e, 0xe162, 0x08d8, 0x2836,
+	0xae02, 0x4c38, 0xae06, 0x4c37, 0xae06, 0x4c39, 0xae02, 0x4c5c,
+	0xae02, 0x4c8c, 0xae04, 0x4c5b, 0xae02, 0x2a36, 0x4e38, 0x4e5c,
+	0x468b, 0xb432, 0xae02, 0x2a5b, 0xb633, 0x468c, 0xb432, 0xae02,
+	0xa900, 0xae02, 0xa900, 0x3d12, 0xa200, 0xae02, 0xa900, 0xae08,
+	0xa900, 0xae04, 0x4c10, 0xae04, 0x4c4a, 0xae06, 0x4c4b, 0xae06,
+	0x4c4c, 0x3d12, 0x2853, 0x3d12, 0x2854, 0x3d12, 0xe42e, 0x284b,
+	0xa804, 0xe408, 0x0db1, 0xe162, 0x08c7, 0xe163, 0x08c8, 0xa203,
+	0x2b13, 0x1b0b, 0x2913, 0xe419, 0x0eab, 0x2903, 0x2ae0, 0xb7d2,
+	0x2a91, 0xb7f2, 0x2a4b, 0xa809, 0x4e91, 0x4ee0, 0xe41b, 0x0e56,
+	0x3d02, 0xe162, 0x08d8, 0xe163, 0x08dc, 0xe164, 0x08e0, 0xd022,
+	0x0003, 0xe184, 0x0d74, 0x2914, 0x3d13, 0xd022, 0x0003, 0xe184,
+	0x0d7a, 0x2912, 0x3d13, 0xe162, 0x08c7, 0xe163, 0x08c8, 0xe164,
+	0x08c9, 0x2914, 0x3d13, 0x2912, 0x3d13, 0x289b, 0xe016, 0xae04,
+	0xe000, 0x08df, 0xe094, 0xe163, 0x08eb, 0xe164, 0x08ef, 0xd022,
+	0x0003, 0xe184, 0x0d94, 0x290b, 0x3d0c, 0xd022, 0x0003, 0xe184,
+	0x0d9a, 0x290b, 0x3d0c, 0xd022, 0x0003, 0xe184, 0x0da0, 0x290a,
+	0x3d0c, 0x289b, 0xe016, 0xe000, 0x08c8, 0xe094, 0xe163, 0x08cb,
+	0xe164, 0x08cc, 0x290b, 0x3d0c, 0x290b, 0x3d0c, 0x290a, 0x3d0c,
+	0xe42e, 0x2ae0, 0xb7d2, 0xe41b, 0x0e78, 0xe162, 0x08c7, 0x3d02,
+	0xe162, 0x08db, 0xe163, 0x08eb, 0xe164, 0x08ef, 0xd022, 0x0003,
+	0xe184, 0x0dc3, 0x290b, 0x3d0c, 0xd022, 0x0003, 0xe184, 0x0dc9,
+	0x290b, 0x3d0c, 0xd022, 0x0003, 0xe184, 0x0dcf, 0x290a, 0x3d0c,
+	0xe162, 0x08c7, 0xe163, 0x08cb, 0xe164, 0x08cc, 0x290b, 0x3d0c,
+	0x290b, 0x3d0c, 0x290a, 0x3d0c, 0xe42e, 0xe162, 0x08e8, 0x28a4,
+	0x4ca5, 0xae02, 0x4d02, 0x3d12, 0x28a4, 0xae02, 0x4ca5, 0xae08,
+	0x4ca6, 0xae14, 0x4d02, 0x3d02, 0x284b, 0xa804, 0xe408, 0x0e23,
+	0xe162, 0x08cd, 0xe163, 0x08ce, 0xe164, 0x08cf, 0xa2fa, 0x3d04,
+	0xe161, 0x08c7, 0x2b01, 0xf0d5, 0xe161, 0x08d8, 0x2b01, 0xa819,
+	0xf08b, 0xa201, 0x2903, 0x2a4b, 0xa809, 0xe41b, 0x0e56, 0x3d04,
+	0x2903, 0x3d02, 0x2904, 0x3d03, 0xa203, 0x2b02, 0x1b03, 0x2902,
+	0xe419, 0x0eab, 0xe163, 0x08ca, 0x2903, 0xe424, 0xe162, 0x08e4,
+	0x2902, 0xa818, 0xe42a, 0x289b, 0xe016, 0xe000, 0x08cd, 0xe098,
+	0x2904, 0x3d03, 0xe42e, 0xe161, 0x08d8, 0xe162, 0x08c7, 0xe163,
+	0x08ca, 0xe164, 0x08cf, 0xa2fa, 0x3d04, 0x2902, 0xe424, 0x2911,
+	0xa818, 0xe42a, 0x2902, 0x3d04, 0x2911, 0xaf0c, 0xa806, 0xa106,
+	0xf078, 0xe41e, 0x0e78, 0x3d04, 0x2902, 0xe41e, 0x0ebd, 0x2904,
+	0x3d03, 0xe42e, 0x289c, 0xa002, 0xe000, 0x08ca, 0xe094, 0x2902,
+	0xf034, 0xe41e, 0x0ecf, 0xe162, 0x08ca, 0x2912, 0xe412, 0x0e9a,
+	0x289c, 0xe426, 0x2912, 0xe412, 0x0e9a, 0xe42e, 0xe165, 0x08c3,
+	0x2115, 0x4d15, 0x2315, 0x4f15, 0xe056, 0xe165, 0x07e0, 0x2a98,
+	0xf0b7, 0xa103, 0xcc45, 0xe184, 0x0e6a, 0x2b15, 0x3e01, 0xe049,
+	0x5e01, 0xa803, 0xf03b, 0xa2fa, 0xe42e, 0xe165, 0x08c3, 0x2115,
+	0x4d0d, 0xa203, 0x5a01, 0xe056, 0x3515, 0x3d0d, 0x2801, 0xe42e,
+	0xe165, 0x08c3, 0x2115, 0x4d15, 0x2315, 0x4f15, 0xe056, 0xe165,
+	0x07e0, 0x2a98, 0xf0b7, 0xa103, 0xcc45, 0xe184, 0x0e8c, 0x2b15,
+	0x3e01, 0xe049, 0x5e01, 0xa803, 0xf03b, 0xa2fa, 0xe42e, 0xe165,
+	0x08c5, 0x2115, 0x4d0d, 0xa203, 0x5a01, 0xe056, 0x3515, 0x3d0d,
+	0x2801, 0xe42e, 0xe424, 0x3c01, 0x2898, 0xa102, 0x1801, 0xe424,
+	0xe165, 0x08c5, 0x2115, 0x4d0d, 0xa203, 0x5a01, 0xe056, 0x3515,
+	0x3d0d, 0x2801, 0xe42e, 0xe424, 0x3c01, 0x2898, 0xa102, 0x1801,
+	0xe424, 0xe165, 0x08c3, 0x2115, 0x4d0d, 0xa203, 0x5a01, 0xe015,
+	0xe052, 0x3515, 0x3d0d, 0x2801, 0xe42e, 0xe424, 0x3c01, 0x2898,
+	0xa102, 0x1801, 0xe424, 0xe165, 0x08c5, 0x2115, 0x4d0d, 0xa203,
+	0x5a01, 0xe015, 0xe052, 0x3515, 0x3d0d, 0x2801, 0xe42e, 0xe424,
+	0x3c01, 0x2898, 0xa102, 0x1801, 0xe424, 0xe165, 0x07e0, 0x2a98,
+	0xf087, 0xa103, 0xcc45, 0xe184, 0x0edf, 0x2b15, 0x1a01, 0xf03b,
+	0xa2fa, 0xe42e, 0xc845, 0xf067, 0xe184, 0x0ee8, 0x290d, 0x3d15,
+	0x8115, 0x2801, 0x810d, 0x3d15, 0x2801, 0xe42e, 0xa200, 0x3c02,
+	0xe165, 0x08c3, 0x2115, 0x4d15, 0x2315, 0x4f15, 0xe056, 0xe165,
+	0x07e0, 0x2a98, 0xf0f7, 0xa103, 0xcc45, 0xe184, 0x0f08, 0x2b15,
+	0x3e01, 0xe049, 0x5e01, 0xa803, 0xf049, 0x2a02, 0xa003, 0x3e02,
+	0xe190, 0x2802, 0xe42e, 0xe41e, 0x079b, 0xba4e, 0xba4f, 0xae11,
+	0xe056, 0xba4f, 0xae21, 0xe056, 0xb7f4, 0xe005, 0x00ff, 0xae21,
+	0xe00b, 0xffff, 0xe045, 0xb7f6, 0x343a, 0x3c3b, 0xba4e, 0x3c3c,
+	0xe008, 0x0085, 0xe002, 0x0085, 0xa203, 0x3ef0, 0xe408, 0x0fe4,
+	0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056, 0xba4f,
+	0xae31, 0xe055, 0xa109, 0xa204, 0x3cf0, 0xe405, 0x0fe4, 0xa206,
+	0x3cf0, 0xba42, 0x3c10, 0xba40, 0x3c48, 0xba40, 0x3c49, 0xba44,
+	0x3c13, 0xba48, 0x3c14, 0xba40, 0x3c2c, 0xba40, 0x3c43, 0xba40,
+	0x3c3d, 0xba40, 0x3c44, 0xba40, 0x3c2d, 0xba40, 0x3c2e, 0xba42,
+	0x3c2f, 0xba40, 0x3c30, 0xba40, 0x3c45, 0xba40, 0x3c31, 0xba40,
+	0x3c3e, 0xba40, 0x3c3f, 0xba44, 0x3c40, 0xba42, 0x3c32, 0xba40,
+	0x3c1b, 0xba40, 0x3c46, 0x2813, 0xae04, 0xa004, 0xe0c2, 0x007d,
+	0xe0c2, 0x0079, 0xa202, 0x3c22, 0xa208, 0x3cf0, 0x2848, 0xe408,
+	0x0fe4, 0xa20a, 0x3cf0, 0x2849, 0xe408, 0x0fe4, 0xa206, 0x3cf0,
+	0x2810, 0xa104, 0xe40a, 0x0fe4, 0xa20e, 0x3cf0, 0x2844, 0xe40a,
+	0x0fe4, 0xa20c, 0x3cf0, 0x2843, 0xe408, 0x0fe4, 0x2810, 0xa104,
+	0xb7f4, 0xa004, 0x3c10, 0xf047, 0xba4e, 0xa103, 0xf7e1, 0xba4e,
+	0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056, 0xba4f, 0xae31,
+	0xe056, 0x3c17, 0x3c34, 0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f,
+	0xae21, 0xe056, 0xba4f, 0xae31, 0xe056, 0x3c16, 0x3c33, 0xa200,
+	0x2a3c, 0xe003, 0x00c5, 0xb636, 0x3c3c, 0xa100, 0xe40a, 0x0fe5,
+	0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056, 0xba4f,
+	0xae31, 0xe056, 0xe049, 0xa118, 0xf06a, 0xf287, 0xba4e, 0xa103,
+	0xf7e1, 0xf24e, 0xba44, 0x3c11, 0xba40, 0xba46, 0xba4e, 0xba4f,
+	0xae11, 0xe056, 0xba4f, 0xae21, 0xe056, 0xe161, 0x0758, 0x3511,
+	0x3d11, 0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056,
+	0xba4f, 0xae31, 0xe056, 0xe161, 0x0718, 0x3511, 0x3d11, 0xba4e,
+	0xba4e, 0xba4e, 0xba4e, 0xf02e, 0xe16b, 0xe41d, 0x0847, 0xe42e,
+	0xe161, 0x0718, 0xe162, 0x0758, 0xba48, 0x3c27, 0xf156, 0xa102,
+	0xcc44, 0xba46, 0xa00c, 0x3c00, 0xba46, 0xa008, 0x3c01, 0xe184,
+	0x1002, 0xba5e, 0xa002, 0x5800, 0x3511, 0x3d11, 0xba5e, 0xa002,
+	0x5801, 0x3512, 0x3d12, 0xe42e, 0xba42, 0xa102, 0x3c10, 0xba44,
+	0x3c11, 0xba42, 0x3c12, 0xba44, 0x3c13, 0xba48, 0x3c14, 0xba40,
+	0x3c15, 0xba56, 0xa002, 0xae02, 0x3c16, 0xba56, 0xa002, 0xae02,
+	0x3c17, 0xba40, 0x3c18, 0xba40, 0x3c19, 0xba40, 0x3c1a, 0xba40,
+	0x3c1b, 0xba40, 0xba40, 0x3c1c, 0xa200, 0x3c43, 0x3c45, 0xa202,
+	0x3c44, 0x3c46, 0xba40, 0xe40a, 0x1075, 0xba5a, 0xa002, 0x3c1d,
+	0xba5a, 0xa002, 0x3c1e, 0xba40, 0xf17a, 0xba46, 0xe049, 0xa11f,
+	0xf089, 0xba4e, 0xa002, 0x3c1f, 0xba4e, 0xa002, 0x3c20, 0xf0ce,
+	0xe049, 0xe000, 0x06f0, 0xe098, 0xe001, 0x0700, 0xe09b, 0x2904,
+	0x3c1f, 0x2905, 0x3c20, 0xba40, 0xf21a, 0xba40, 0xf178, 0xba4e,
+	0xa80e, 0xe000, 0x0710, 0xe098, 0x2904, 0x3c21, 0x8421, 0xe182,
+	0x03e8, 0xe018, 0xe0c2, 0x007d, 0xe0c2, 0x0079, 0xe004, 0x03e8,
+	0xba47, 0xa103, 0xb422, 0x3c22, 0xf09e, 0xba5e, 0xa002, 0xe0c2,
+	0x007d, 0xe0c2, 0x0079, 0xa240, 0x3c22, 0xba40, 0xf07a, 0xba4e,
+	0x3c23, 0xba4e, 0x3c24, 0xba4e, 0x3c25, 0xba40, 0x3c26, 0xe418,
+	0x0fe8, 0xe42e, 0x2810, 0xf064, 0xa104, 0xf040, 0xe41e, 0x020f,
+	0xf082, 0xa204, 0x3c10, 0x28a2, 0x3c16, 0x28a3, 0x3c17, 0xe16b,
+	0xe42e, 0xe161, 0x0758, 0xe162, 0x0798, 0x2827, 0xf126, 0xa102,
+	0xcc44, 0xe184, 0x109f, 0xba4e, 0xa002, 0x3c00, 0x8400, 0x8311,
+	0xe018, 0xae20, 0x8400, 0x8311, 0xe019, 0xe042, 0xaf10, 0x3d12,
+	0xe42e, 0xba40, 0x3c28, 0xba40, 0x3c29, 0xba40, 0x3c2a, 0xba40,
+	0x3c2b, 0xba40, 0x3c2c, 0xba40, 0x3c2d, 0xba40, 0x3c2e, 0xba42,
+	0x3c2f, 0xba40, 0x3c30, 0xba40, 0x3c31, 0xba42, 0x3c32, 0x2826,
+	0xe418, 0x1089, 0x2816, 0x3c33, 0x2817, 0x3c34, 0xba40, 0xf09a,
+	0xba56, 0xa002, 0xae02, 0x3c33, 0xba56, 0xa002, 0xae02, 0x3c34,
+	0xa200, 0x3c35, 0x282e, 0xf03a, 0xba40, 0x3c35, 0xa200, 0x3c37,
+	0xba40, 0x3c36, 0xf03a, 0xba44, 0x3c37, 0xa200, 0x3c39, 0xba40,
+	0x3c38, 0xe42a, 0xba44, 0x3c39, 0xe42e, 0x2833, 0xf086, 0x1816,
+	0xf060, 0x2834, 0xf046, 0x1817, 0xf020, 0xf06e, 0x2816, 0x3c33,
+	0x2817, 0x3c34, 0xe16b, 0xe42e, 0xa200, 0x3c51, 0x3c52, 0x3c57,
+	0x3c6b, 0xba3e, 0xe008, 0x0085, 0xe002, 0x0085, 0xe41a, 0x0f0b,
+	0xe41e, 0x0bc9, 0xe41e, 0x118c, 0xe41e, 0x07fa, 0x24d7, 0x4cd6,
+	0xc873, 0xaf07, 0xe046, 0x34d7, 0x3cd6, 0xcc8c, 0xd039, 0x0000,
+	0xa200, 0xe41e, 0x0838, 0xa208, 0x3c4b, 0x3c4c, 0x2041, 0x4c42,
+	0xa102, 0xe426, 0xe16a, 0xe41e, 0x11a6, 0xe42d, 0xe41e, 0x12eb,
+	0xe42e, 0xa200, 0x3c51, 0x3c52, 0x3c57, 0x3c6b, 0xe16a, 0xe41e,
+	0x1203, 0xe42d, 0x284b, 0xa108, 0xe418, 0x12a6, 0xe42d, 0x284a,
+	0xa106, 0xf048, 0x284e, 0xe016, 0x3c52, 0xe41e, 0x12eb, 0xe42e,
+	0x284e, 0x3c52, 0xa200, 0x3c57, 0x3c6b, 0xe16a, 0xe41e, 0x12a6,
+	0xe42d, 0xe41e, 0x12eb, 0xe42e, 0x2851, 0x2a56, 0xb615, 0xba50,
+	0xe046, 0x3c57, 0xba40, 0xe42a, 0xa200, 0x3c6b, 0xe162, 0x004a,
+	0xe163, 0x0610, 0xd022, 0x0038, 0xe184, 0x114f, 0x2912, 0x3d13,
+	0xe16a, 0xe41e, 0x1203, 0xf0dd, 0x284b, 0xa108, 0xe418, 0x12a6,
+	0xf08d, 0xe41e, 0x1308, 0xf05d, 0xe41e, 0x12eb, 0xf02d, 0xe42e,
+	0xe162, 0x0610, 0xe163, 0x004a, 0xd022, 0x0038, 0xe184, 0x1169,
+	0x2912, 0x3d13, 0xe42e, 0x283e, 0xf1ea, 0xba40, 0xf1c8, 0xe41e,
+	0x079b, 0xa200, 0xba4f, 0xae10, 0xe056, 0xba4f, 0xae10, 0xe056,
+	0xe002, 0x00aa, 0xf0ba, 0xa102, 0xf03a, 0xa200, 0xe42e, 0xba4e,
+	0xba4e, 0xba4e, 0xba4e, 0xba4e, 0xba4e, 0xba4e, 0xba4e, 0xba4e,
+	0xba4e, 0xba4e, 0xa202, 0xe42e, 0xe41e, 0x079b, 0xba4e, 0xba4f,
+	0xae11, 0xe056, 0xba4f, 0xae21, 0xe056, 0x3441, 0x3c42, 0xba4e,
+	0x283c, 0xa102, 0xe428, 0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f,
+	0xae21, 0xe056, 0xba4f, 0xae31, 0xe056, 0xe42e, 0x281b, 0xf02a,
+	0xba40, 0xba42, 0xa200, 0x2a3f, 0xf03b, 0xba40, 0x3c5c, 0x2a40,
+	0xf039, 0xba40, 0xf02e, 0xb800, 0x3c4b, 0x3c4c, 0xa106, 0xf088,
+	0xb808, 0x3c5d, 0xa12c, 0xf048, 0xa204, 0x3c4b, 0x3c4c, 0xe004,
+	0x004b, 0x0851, 0xe092, 0x2901, 0x3c85, 0x2861, 0x2a85, 0xa803,
+	0xb636, 0x2a85, 0xa103, 0xb436, 0xa802, 0x3c61, 0x2885, 0xa802,
+	0xf028, 0xba4c, 0xe41e, 0x131e, 0xa200, 0x2a2e, 0xf02b, 0xb804,
+	0x3c62, 0x2885, 0xa804, 0xf068, 0xa200, 0x2a3d, 0xf02b, 0xba42,
+	0x3c5b, 0x2833, 0x2a5b, 0xa803, 0xf03b, 0xa002, 0xaf02, 0x3c53,
+	0xa01e, 0xaf08, 0x3c55, 0x2834, 0x2a5b, 0xa805, 0xf03b, 0xa002,
+	0xaf02, 0x3c54, 0xa01e, 0xaf08, 0x3c56, 0xe41e, 0x1385, 0xe41e,
+	0x13e3, 0xe41e, 0x142d, 0xe41e, 0x1484, 0xa202, 0x3c4e, 0xa200,
+	0x3c5f, 0x3c60, 0xe42e, 0xa200, 0x2a19, 0xf02b, 0xb80a, 0x3c4a,
+	0xa106, 0xf05a, 0xb802, 0x3c4b, 0x3c4c, 0xf0ee, 0xba44, 0xae02,
+	0x3c4c, 0xe004, 0xaf50, 0x5c4c, 0xa806, 0x3c4b, 0xe004, 0xbb44,
+	0x5c4c, 0xa806, 0x3c4c, 0x284b, 0xa108, 0xf05a, 0x281a, 0xf03a,
+	0xba4e, 0x3c4d, 0xa200, 0x3c50, 0x3c4f, 0xa202, 0x3c4e, 0x2818,
+	0xf0ca, 0x2819, 0xf08a, 0x281c, 0xf068, 0xba40, 0x3c4e, 0xba40,
+	0x3c4f, 0xf03e, 0xba42, 0x3c50, 0x282a, 0xf28a, 0xa202, 0x2a19,
+	0xb616, 0x2a1c, 0xb612, 0xa002, 0x3c47, 0x2850, 0x084f, 0x2a18,
+	0xb616, 0x0847, 0x3c47, 0xba40, 0xf19a, 0xe161, 0x07b8, 0xe162,
+	0x07c4, 0xe163, 0x07d0, 0xe164, 0x07d6, 0x2847, 0xf0f6, 0xa102,
+	0xcc44, 0xe184, 0x125c, 0xba62, 0x3511, 0x3d11, 0xba62, 0x3512,
+	0x3d12, 0xba5a, 0x3d13, 0xba5a, 0x3d14, 0x284b, 0xa108, 0xe42a,
+	0xe004, 0x004b, 0x0851, 0xe092, 0x2901, 0x3c85, 0xba40, 0x3c61,
+	0xa200, 0x2a19, 0xf02b, 0xba40, 0x3c58, 0x2a1b, 0x284a, 0xa100,
+	0xb611, 0xa200, 0xf02b, 0xba40, 0x3c59, 0x284a, 0xa100, 0x2a85,
+	0xa107, 0xb632, 0xf07a, 0x284a, 0xa106, 0x2a85, 0xa805, 0xb636,
+	0xf038, 0xb808, 0x3c5d, 0x282b, 0x2a4a, 0xa107, 0xb612, 0x2a85,
+	0xa805, 0xb612, 0xf0ca, 0xba42, 0xe049, 0xa107, 0xf079, 0xba41,
+	0xf05b, 0xa002, 0xe049, 0xa121, 0xf7b7, 0x3c5e, 0x2833, 0x3c53,
+	0xa01e, 0xaf08, 0x3c55, 0x2834, 0x3c54, 0xa01e, 0xaf08, 0x2a4a,
+	0xa107, 0xf039, 0xa002, 0xaf02, 0x3c56, 0xe42e, 0xe004, 0x004b,
+	0x0851, 0xe092, 0x2901, 0x3c85, 0xe41e, 0x131e, 0xa200, 0x2a15,
+	0xf02b, 0xba42, 0x3c5a, 0x284a, 0xa104, 0x2a85, 0xa107, 0xb632,
+	0xf038, 0xb808, 0x3c5d, 0xa200, 0x3c5f, 0x3c60, 0x284a, 0xa106,
+	0xf118, 0x2885, 0xa102, 0xf09a, 0x2885, 0xa106, 0xf0b8, 0xa202,
+	0x3c5f, 0xa200, 0x3c60, 0xf06e, 0xba40, 0x3c5f, 0xf038, 0xba40,
+	0x3c60, 0x2885, 0xa802, 0xf0ea, 0xa200, 0x2a2e, 0xf02b, 0xb804,
+	0x3c62, 0x2a35, 0x284a, 0xa100, 0xb615, 0xa200, 0xf02b, 0xb804,
+	0x3c63, 0xe41e, 0x1385, 0xe41e, 0x13e3, 0xe42d, 0xe41e, 0x142d,
+	0xe41e, 0x1484, 0xe42e, 0xe41e, 0x020f, 0xf062, 0x2833, 0x3c53,
+	0x2834, 0x3c54, 0xe16b, 0x287b, 0xf026, 0xf05e, 0xa202, 0x3c7b,
+	0x3c7c, 0xe16b, 0xf0cd, 0x283c, 0xa104, 0xf08a, 0x2041, 0x4c42,
+	0xe005, 0x0030, 0xae21, 0xe046, 0xf022, 0xf02e, 0xe16b, 0xe42e,
+	0xe162, 0x0610, 0x284a, 0x1912, 0xf108, 0xe162, 0x0619, 0x2853,
+	0x1912, 0xf0b8, 0x2854, 0x1912, 0xf088, 0x2855, 0x1912, 0xf058,
+	0x2856, 0x1912, 0xf028, 0xf02e, 0xe16b, 0xe42e, 0xba49, 0x3e7a,
+	0xa111, 0xa200, 0xf021, 0xba40, 0x3c7d, 0x287a, 0x2a32, 0xa101,
+	0xf0a9, 0x2a7a, 0xa111, 0xf077, 0x2a7a, 0xa139, 0xb5ae, 0xf037,
+	0xae02, 0xa13e, 0x3c7b, 0x3c7c, 0x2a32, 0xa105, 0xf0c3, 0xa003,
+	0xf073, 0xa200, 0x2a7a, 0xa111, 0xb62e, 0x3c7e, 0xe42e, 0xba40,
+	0x3c7e, 0xe42e, 0x2832, 0xa802, 0x3c7e, 0xe42e, 0xa200, 0x3c7f,
+	0xa206, 0x3c80, 0xa202, 0x3c82, 0x2a2f, 0xa803, 0xf059, 0x2a2f,
+	0xa805, 0xf259, 0xe42e, 0xba40, 0xe42a, 0x3c7f, 0xba42, 0x3c80,
+	0xf09a, 0xa102, 0xf0aa, 0xa102, 0xf11a, 0xba40, 0x3c82, 0xe42a,
+	0xf1ce, 0xa21e, 0x3c81, 0xf19e, 0xba42, 0xae04, 0x3c81, 0xe004,
+	0x936c, 0x5c81, 0xa81e, 0x3c81, 0xf10e, 0xba42, 0xae04, 0x3c81,
+	0xe004, 0x1248, 0x5c81, 0xa81e, 0x3c81, 0xf07e, 0xa202, 0x3c7f,
+	0xa200, 0x3c80, 0xa21e, 0x3c81, 0xba44, 0xe049, 0xa10f, 0x087b,
+	0xa002, 0xf029, 0xba48, 0x3c7c, 0xe42e, 0xa200, 0xe162, 0x0065,
+	0xc705, 0x3d12, 0xa202, 0x2a85, 0xa103, 0xf05b, 0x2a85, 0xa107,
+	0xf1cb, 0xf33e, 0x2a4a, 0xa105, 0xf059, 0xba41, 0xa202, 0xb672,
+	0xf2ce, 0xa208, 0x2a7b, 0xa119, 0xb60e, 0x3c64, 0xb80e, 0xe049,
+	0xaf05, 0x3e65, 0xf02b, 0xb810, 0x0864, 0xae02, 0x3c64, 0xe004,
+	0xe42d, 0x5c64, 0xa806, 0xf19e, 0x2a4a, 0xa101, 0xf05b, 0x2a4a,
+	0xa107, 0xf06b, 0xf12e, 0xba41, 0xa200, 0xb632, 0xf0ee, 0xa208,
+	0x2a7b, 0xa119, 0xb60e, 0x3c64, 0xb810, 0x0864, 0xae02, 0x3c64,
+	0xe004, 0xe42d, 0x5c64, 0xa806, 0x3c64, 0x284a, 0xa104, 0x2a85,
+	0xa803, 0xb636, 0xf038, 0xba40, 0x3c65, 0x2865, 0xe42a, 0x284a,
+	0xa106, 0xf058, 0xb836, 0x3068, 0xaf02, 0x3065, 0x2865, 0xf05a,
+	0xba4a, 0x3c66, 0xba4a, 0x3c67, 0x2868, 0xf05a, 0xba4a, 0x3c69,
+	0xba4a, 0x3c6a, 0xe42e, 0xa200, 0x3c6d, 0x3c6e, 0x3c6f, 0xc411,
+	0xe162, 0x006f, 0x2a4a, 0xa101, 0x2885, 0xa102, 0xb631, 0x2864,
+	0xa106, 0xb631, 0xe41b, 0x15db, 0xe42d, 0xc411, 0xe162, 0x006f,
+	0x2a4a, 0xa107, 0x2885, 0xa106, 0xb631, 0xe41b, 0x15db, 0xe42d,
+	0xc411, 0xe162, 0x006f, 0x2a4a, 0xa107, 0x2885, 0xa106, 0xb611,
+	0xe419, 0x15db, 0xe42d, 0xc409, 0xe162, 0x006e, 0x2a4a, 0xa107,
+	0x2885, 0xa802, 0xb615, 0xe419, 0x15db, 0xe42d, 0xc411, 0xe162,
+	0x006f, 0x2a4a, 0xa105, 0x2885, 0xa802, 0xb631, 0xe41b, 0x15db,
+	0xe42d, 0xc409, 0xe162, 0x006e, 0x2a10, 0xa105, 0x2885, 0xa802,
+	0xb631, 0xe41b, 0x15db, 0xe42d, 0xe42e, 0xe004, 0x0024, 0x3c74,
+	0x2885, 0xa802, 0xe42a, 0x284a, 0xa104, 0xf05a, 0x284a, 0xa106,
+	0xf0aa, 0xf11e, 0xba42, 0xe000, 0x0051, 0x2a64, 0xa107, 0xb492,
+	0x3c70, 0xf09e, 0xba44, 0xe000, 0x0041, 0x2a64, 0xa107, 0xb492,
+	0xb492, 0x3c70, 0xa202, 0x2a4a, 0xa101, 0xf07b, 0x2a5f, 0xf091,
+	0xba42, 0xe000, 0x003d, 0xf08e, 0xba42, 0xe000, 0x0031, 0xf04e,
+	0xba44, 0xe000, 0x0035, 0x3c73, 0x2a4a, 0xa101, 0xf05b, 0xba44,
+	0xe000, 0x0029, 0xf04e, 0xba42, 0xe000, 0x0025, 0x3c74, 0x2a4a,
+	0xa105, 0x2885, 0xa802, 0xb635, 0xa200, 0xf049, 0xba42, 0xe000,
+	0x0020, 0x3c71, 0x284a, 0xa104, 0x2a85, 0xa107, 0xb632, 0xf08a,
+	0x2a4a, 0xa101, 0x2864, 0xa106, 0xb611, 0xa200, 0xf04b, 0xba42,
+	0xe000, 0x001c, 0x3c72, 0xe42e, 0xa200, 0x3c7f, 0x2885, 0xa802,
+	0xf0fa, 0x282f, 0xe418, 0x1346, 0xa202, 0x3c75, 0xa200, 0x3c76,
+	0x2830, 0xf06a, 0xba40, 0x3c75, 0xf03a, 0xba42, 0x3c76, 0xa200,
+	0x3c6c, 0x2831, 0xf17a, 0x2885, 0xa106, 0xf14a, 0xa204, 0x2a7b,
+	0xa113, 0xf083, 0x2810, 0xa104, 0x2a85, 0xa803, 0xb632, 0xf0a8,
+	0xb80c, 0x3c6c, 0xc401, 0xe162, 0x006d, 0xa106, 0xe41a, 0x15db,
+	0xe42d, 0x2843, 0x2a85, 0xa803, 0xb612, 0xf02a, 0xba40, 0x3c83,
+	0x2a83, 0x2885, 0xa802, 0xb636, 0x4445, 0xf02a, 0xba40, 0x3c84,
+	0xe004, 0x005d, 0x3c78, 0x3c79, 0x2884, 0xf198, 0x287a, 0xa110,
+	0xa203, 0xb601, 0xb806, 0xb611, 0xb472, 0xe000, 0x005d, 0x3c78,
+	0x3c79, 0x2885, 0xa802, 0xf0b8, 0x287a, 0xa110, 0xa203, 0xb601,
+	0xb806, 0xb611, 0xb472, 0xe000, 0x005d, 0x3c79, 0xba40, 0xe000,
+	0x0059, 0x3c77, 0x2810, 0xa104, 0x2a85, 0xa803, 0xb632, 0x2a2f,
+	0xb636, 0xe41a, 0x1346, 0xe42e, 0xe161, 0x0380, 0x2816, 0x3d11,
+	0x2817, 0x3d11, 0x2819, 0x3d11, 0xe42e, 0xe161, 0x0380, 0x2816,
+	0x1911, 0xf0a8, 0x2817, 0x1911, 0xf078, 0x2819, 0x1911, 0xf048,
+	0xa200, 0x3cdb, 0xe42e, 0xa202, 0x3cdb, 0xe42e, 0x2857, 0xae10,
+	0x4c55, 0xae10, 0x4c56, 0xcf24, 0xcf44, 0xcfc6, 0xcf04, 0xa200,
+	0x4c46, 0xae02, 0x4c84, 0xae04, 0x4c10, 0xae02, 0x4c2d, 0xae04,
+	0x4c4a, 0xae04, 0xe005, 0x004b, 0x0a51, 0xe093, 0x4d01, 0xae02,
+	0x4c51, 0xae02, 0x4c52, 0xae04, 0x4c6c, 0xae02, 0x4c75, 0xae02,
+	0x4c5f, 0xae02, 0x4c60, 0xae04, 0x4c64, 0xae04, 0x4c62, 0xae04,
+	0x4c63, 0xae0a, 0x4c5d, 0xae0a, 0x4c5e, 0xcf46, 0xcfc8, 0xcf06,
+	0xa200, 0x4c46, 0xae02, 0x4c84, 0xae02, 0x2a7a, 0xa111, 0xb42e,
+	0xae04, 0x4c7f, 0xae04, 0x4c80, 0xae08, 0x4c81, 0xae02, 0x4c82,
+	0xae02, 0x4c75, 0xae04, 0x4c76, 0xae0a, 0x4c7b, 0xae0a, 0x4c7c,
+	0xae02, 0x4c7d, 0xae02, 0x4c7e, 0xae02, 0x2a77, 0xe003, 0x0059,
+	0xe056, 0xae04, 0x2a78, 0xe003, 0x005d, 0xe056, 0xae04, 0x2a79,
+	0xe003, 0x005d, 0xe056, 0xcf48, 0xcf64, 0xa200, 0x2a70, 0xe003,
+	0x0041, 0xa83f, 0xe056, 0xae08, 0x2a74, 0xe003, 0x0024, 0xa81f,
+	0xe056, 0xae04, 0x2a72, 0xe003, 0x001c, 0xa807, 0xe056, 0xae04,
+	0x2a71, 0xe003, 0x0020, 0xa807, 0xe056, 0xae08, 0x2a73, 0xe003,
+	0x0031, 0xa81f, 0xe056, 0xcf4a, 0xe0c1, 0x0046, 0xe004, 0x0000,
+	0xae10, 0xe042, 0x2ab8, 0xa841, 0xf05b, 0xe161, 0x07de, 0x2111,
+	0x4d11, 0x4c6d, 0xcf4c, 0xcf1a, 0xe0c1, 0x0046, 0xe004, 0x0010,
+	0xae10, 0xe042, 0x2ab8, 0xa841, 0xf07b, 0xe161, 0x07de, 0x2111,
+	0x4d11, 0x2ae5, 0xe042, 0x4c6e, 0xcf4e, 0xcf1c, 0xe0c1, 0x0046,
+	0xe004, 0x0020, 0xae10, 0xe042, 0x2ab8, 0xa841, 0xf08b, 0xe161,
+	0x07de, 0x2111, 0x4d11, 0x2ae5, 0xae03, 0xe042, 0x4c6f, 0xcf50,
+	0xcf1e, 0xe0c1, 0x0046, 0xe004, 0x0030, 0xae10, 0xe042, 0x2ab8,
+	0xa803, 0xf05b, 0xe161, 0x08f0, 0x2111, 0x4d11, 0xcf00, 0xe165,
+	0x08c0, 0x2115, 0x4d15, 0xcf02, 0xe004, 0x0022, 0x2ab7, 0xa803,
+	0xb616, 0x2ab7, 0xa841, 0xf03b, 0xe00a, 0x0011, 0xcf14, 0x2053,
+	0x4c54, 0xcfc4, 0xe42e, 0xe082, 0xa104, 0xe400, 0x1638, 0x2855,
+	0xae10, 0x4c56, 0xcf24, 0xd190, 0x0200, 0xcb20, 0xcb23, 0xe409,
+	0x1638, 0xf7c8, 0xcb26, 0x3d02, 0xa100, 0xe42a, 0xa202, 0x3c6b,
+	0xe180, 0xe180, 0x2855, 0xa01e, 0xaf08, 0x3c02, 0x8402, 0x8256,
+	0xe018, 0xa008, 0xaf04, 0xae04, 0x3ce4, 0xae02, 0xe049, 0xe003,
+	0x0100, 0xf063, 0xe005, 0x0100, 0xe004, 0x0200, 0xf06e, 0xe009,
+	0x00ff, 0xf03b, 0xe003, 0x0100, 0xe046, 0x3ce5, 0xca28, 0xf7f8,
+	0xe083, 0xa103, 0xa200, 0xb486, 0xb482, 0xae04, 0xe000, 0x0000,
+	0xae10, 0xe0c1, 0x0046, 0xe042, 0x2ab8, 0xa841, 0xf0db, 0xe083,
+	0xa103, 0xa200, 0xf045, 0x08e5, 0xf027, 0x08e5, 0xe163, 0x07de,
+	0x2313, 0x4f13, 0xe042, 0xce20, 0xd111, 0x0200, 0x28e4, 0xce24,
+	0x28b7, 0xa840, 0xa904, 0xce26, 0xca28, 0xf7f8, 0xe181, 0xe42e,
+	0xd191, 0x0000, 0xe16b, 0xe42e, 0xe41e, 0x164e, 0xe41e, 0x16a7,
+	0xe41e, 0x1770, 0x2857, 0xe428, 0xe41e, 0x0274, 0xa202, 0xe0c2,
+	0x0106, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0x2810, 0xae08,
+	0xa902, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x0128, 0x2aa5, 0x4ea4,
+	0xb692, 0xae08, 0xa92c, 0xe0c2, 0x017c, 0xe004, 0x0014, 0xe0c2,
+	0x017d, 0x2055, 0x4c56, 0xae08, 0x2a10, 0xa105, 0xf039, 0x2053,
+	0x4c54, 0xe0c2, 0x0101, 0xa200, 0xe41e, 0x1a0c, 0xe0c2, 0x0102,
+	0xe0c1, 0x0046, 0xe004, 0x0050, 0xae10, 0xe042, 0x2ab8, 0xa805,
+	0xf05b, 0xe161, 0x08f2, 0x2111, 0x4d11, 0xe0c2, 0x0103, 0xe004,
+	0x004b, 0x0851, 0xe092, 0x2901, 0xae04, 0x4c4a, 0xae02, 0x4c52,
+	0xe0c2, 0x0104, 0xa200, 0x2a6c, 0xa101, 0xb432, 0xe0c2, 0x0105,
+	0xe42e, 0x2810, 0xae08, 0xa902, 0xe0c2, 0x0100, 0x2aa5, 0x4ea4,
+	0xb692, 0xae08, 0xa92c, 0xe0c2, 0x017c, 0xe004, 0x0014, 0xe0c2,
+	0x017d, 0xa200, 0xe41e, 0x1a0c, 0xe0c2, 0x0102, 0xe42e, 0xa200,
+	0xe0c2, 0x0320, 0xe165, 0x08d0, 0x2b15, 0xa803, 0xb452, 0x2b15,
+	0xa803, 0xb432, 0xae04, 0x2b15, 0xa803, 0xb452, 0x2b15, 0xa803,
+	0xb432, 0xae04, 0x2b15, 0xa803, 0xb452, 0x2b15, 0xa803, 0xb432,
+	0xae04, 0x2b15, 0xa803, 0xb452, 0x2b15, 0xa803, 0xb432, 0xae04,
+	0xc420, 0xe165, 0x08dc, 0x2b35, 0xaf0f, 0xa803, 0xb452, 0x2b35,
+	0xaf0f, 0xa803, 0xb432, 0xae04, 0x2a64, 0xb456, 0xa803, 0xb432,
+	0xae02, 0x4c61, 0xe0c2, 0x0303, 0xe165, 0x08d0, 0xe166, 0x0304,
+	0xd022, 0x0003, 0xe184, 0x16ea, 0x2915, 0xaf02, 0xae18, 0x2b15,
+	0xaf03, 0xe042, 0x9f16, 0xc420, 0xe165, 0x08dd, 0xa200, 0x2b35,
+	0xaf0d, 0xa807, 0xa101, 0xb673, 0xe042, 0x2b35, 0xaf0d, 0xa807,
+	0xa101, 0xb673, 0xae05, 0xe042, 0xe0c2, 0x0308, 0x2857, 0xe428,
+	0xa202, 0xe0c2, 0x0302, 0xe165, 0x08c8, 0x2905, 0xf082, 0xe165,
+	0x08c9, 0x2905, 0xf042, 0xe165, 0x08c7, 0x2905, 0xe0c2, 0x0380,
+	0x3ce7, 0xe165, 0x08c9, 0x2905, 0xf082, 0xe165, 0x08c8, 0x2905,
+	0xf042, 0xe165, 0x08c7, 0x2905, 0xe0c2, 0x0383, 0x3ce8, 0xe165,
+	0x08c7, 0x2905, 0xe0c2, 0x0386, 0x2a51, 0xf02b, 0x3ce8, 0xa200,
+	0xe0c2, 0x0302, 0xa20e, 0xe0c2, 0x0312, 0xe0c0, 0x0414, 0xe418,
+	0x018c, 0xe0c0, 0x0414, 0xe41a, 0x1736, 0xe42e, 0xe167, 0x01a0,
+	0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17, 0xe009, 0x00ff, 0xae21,
+	0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101, 0xe0c3, 0x015d, 0x2a4b,
+	0x2852, 0xf02a, 0x2a4c, 0xa107, 0xe004, 0x001b, 0xf039, 0xe004,
+	0x001f, 0x3c00, 0x28e7, 0xa53e, 0xa400, 0x2ae8, 0xa53f, 0xa401,
+	0xae11, 0xe055, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10, 0x4400,
+	0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0, 0x0150,
+	0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xe42e,
+	0xa202, 0xae04, 0x2a10, 0xa807, 0xe056, 0xae04, 0xe005, 0x004b,
+	0x0a51, 0xe093, 0x2b01, 0xa807, 0xe056, 0xae04, 0x2a4a, 0xa807,
+	0xe056, 0xae02, 0x2a52, 0xa803, 0xe056, 0xe0c2, 0x0204, 0xa204,
+	0x2a6c, 0xa101, 0xb612, 0x2a2c, 0xb612, 0xe162, 0x08d8, 0x2b02,
+	0xa811, 0xb612, 0x2a6c, 0xa101, 0xb492, 0xe0c2, 0x0208, 0xe0c1,
+	0x0046, 0xe004, 0x0090, 0xae10, 0xe042, 0x2ab8, 0xa821, 0xf05b,
+	0xe161, 0x07dc, 0x2111, 0x4d11, 0xe0c2, 0x0209, 0xa204, 0x2a6c,
+	0xa101, 0xb612, 0x2a2c, 0xb612, 0xe162, 0x08d8, 0x2b02, 0xa811,
+	0xb612, 0x4c2c, 0xe0c2, 0x0210, 0xe0c1, 0x0046, 0xe004, 0x00e0,
+	0xae10, 0xe042, 0x2ab8, 0xa809, 0xf05b, 0xe161, 0x08f4, 0x2111,
+	0x4d11, 0xe0c2, 0x0211, 0xe0c1, 0x0046, 0xe004, 0x00e0, 0xe000,
+	0x0080, 0xae10, 0xe042, 0x2ab8, 0xa811, 0xf05b, 0xe161, 0x08f6,
+	0x2111, 0x4d11, 0xe0c2, 0x0212, 0x2053, 0x4c54, 0xe0c2, 0x0205,
+	0xa204, 0xe163, 0x08c7, 0xe164, 0x08cf, 0x2b03, 0x1b04, 0xb616,
+	0x2b04, 0xb64a, 0xae0e, 0xe41e, 0x1a0c, 0xe0c2, 0x0213, 0xa200,
+	0xe162, 0x08d8, 0xe164, 0x08cf, 0x2b02, 0xaf07, 0xa803, 0xb672,
+	0x2b04, 0xb60a, 0xae0e, 0xe41e, 0x1a0c, 0xe0c2, 0x0215, 0xe165,
+	0x08c7, 0x2905, 0xe0c2, 0x020b, 0xe0c2, 0x0214, 0xe41e, 0x1aac,
+	0xe162, 0x08d8, 0xe163, 0x08c7, 0xe164, 0x08cf, 0xa200, 0x2b02,
+	0xaf0f, 0xa803, 0xb432, 0xae10, 0x2b02, 0xaf11, 0xe009, 0x00ff,
+	0xe056, 0x2b04, 0xb60a, 0xe0c2, 0x0218, 0xe425, 0xe165, 0x08cf,
+	0x2905, 0xe0c2, 0x0216, 0xe41e, 0x1aac, 0xe42e, 0xe162, 0x08cb,
+	0xe163, 0x08e8, 0xe164, 0x08e9, 0xe165, 0x08ea, 0xa200, 0x2b03,
+	0xa805, 0xb632, 0x2b02, 0xb60a, 0x3ca7, 0xe42a, 0xe004, 0x012c,
+	0xe0c2, 0x017f, 0xa200, 0xe41e, 0x1a0c, 0xe0c2, 0x017f, 0x2915,
+	0xe008, 0x7fff, 0xa01e, 0xaf08, 0x3ca8, 0x2915, 0xe008, 0x7fff,
+	0xa01e, 0xaf08, 0x3ca9, 0x84a8, 0x82a9, 0xe018, 0x3cad, 0xa200,
+	0x3caa, 0x3cab, 0x3cac, 0x28a8, 0xa102, 0xae20, 0x4ca9, 0xa102,
+	0xe0c2, 0x0142, 0x2903, 0xaf0e, 0xa200, 0xe0c2, 0x0149, 0x2904,
+	0xaf1e, 0xa802, 0xae08, 0x2b04, 0xaf15, 0xa81f, 0xe056, 0xe0c2,
+	0x014e, 0x289c, 0xe000, 0x08cb, 0xe09a, 0x2905, 0xe0c2, 0x0143,
+	0xe41e, 0x1ac7, 0x2b03, 0xa805, 0xf079, 0xe165, 0x08cb, 0x2905,
+	0xe0c2, 0x0144, 0xf06e, 0xe0c0, 0x0061, 0xa87e, 0xe0c2, 0x0144,
+	0xe42e, 0x28a7, 0xe42a, 0xe41e, 0x1890, 0xf7e8, 0xe0c0, 0x014b,
+	0xf7e8, 0xa200, 0xa904, 0xae0e, 0x4caa, 0xae0e, 0x4cab, 0xe0c2,
+	0x014d, 0xa202, 0xe0c2, 0x014a, 0xe0c0, 0x014b, 0xf7e8, 0xe42e,
+	0xa200, 0x2aac, 0x1aad, 0xe423, 0xe0c0, 0x014b, 0xf7e8, 0xa200,
+	0x2aac, 0xb422, 0xae02, 0x2aac, 0x1aad, 0xb42a, 0xae0e, 0x4caa,
+	0xae0e, 0x4cab, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0xa202,
+	0x2aac, 0xa003, 0x3eac, 0x2aaa, 0xa003, 0x3eaa, 0x1aa8, 0xe425,
+	0xa201, 0x3eaa, 0x2aab, 0xa003, 0x3eab, 0x1aa9, 0xe425, 0xa200,
+	0xe42e, 0xe0c0, 0x0065, 0xe008, 0x0100, 0xe42a, 0xca28, 0xf7f8,
+	0xe0c0, 0x006a, 0xce20, 0xd111, 0x0300, 0xd112, 0x0004, 0xd113,
+	0x0003, 0xca28, 0xf7f8, 0xe161, 0x0300, 0xe162, 0x08fa, 0xa202,
+	0xae30, 0xa920, 0x3511, 0x3d11, 0x2111, 0x4d11, 0x3512, 0x3d12,
+	0xca28, 0xf7f8, 0xe0c0, 0x006a, 0xce20, 0xd111, 0x0300, 0xd112,
+	0x0004, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0065,
+	0xaf10, 0xa802, 0xe42a, 0xe161, 0x0300, 0xe163, 0x08c3, 0xe164,
+	0x08c5, 0xa200, 0x3c01, 0xd022, 0x0007, 0xe184, 0x1908, 0xa200,
+	0xae08, 0x2313, 0x4f0b, 0x5e01, 0xa803, 0xb452, 0x2314, 0x4f0c,
+	0x5e01, 0xa803, 0xb492, 0x2a01, 0xa003, 0x3e01, 0xa807, 0xf719,
+	0x3d11, 0xe162, 0x08c7, 0x2902, 0xf0f4, 0xaf04, 0xe000, 0x0300,
+	0xe092, 0xa218, 0x2b02, 0xa807, 0xae05, 0xe046, 0x3c01, 0xa202,
+	0x5801, 0x4d01, 0x3d01, 0xe180, 0xe180, 0xca28, 0xf7f8, 0xe162,
+	0x08fa, 0x2112, 0x4d12, 0xce20, 0xd111, 0x0300, 0xd112, 0x0008,
+	0xd113, 0x0002, 0xca28, 0xf7f8, 0xe181, 0xe42e, 0xe0c0, 0x0065,
+	0xaf0a, 0xa802, 0xe42a, 0xa200, 0x3ce1, 0x3ce2, 0x3ce3, 0xe162,
+	0x0300, 0x3d12, 0x3d12, 0x3d12, 0x3d12, 0xca28, 0xf7f8, 0xe0c0,
+	0x006b, 0xce20, 0xd111, 0x0300, 0xd112, 0x0004, 0xd113, 0x0000,
+	0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0065, 0xaf0a, 0xa802, 0xe42a,
+	0x2ce1, 0xa87e, 0xa120, 0xe422, 0xa200, 0xe41e, 0x19a5, 0x28d4,
+	0xf7ca, 0x20d7, 0x4cd6, 0xc871, 0xaf07, 0xe046, 0xf760, 0xa202,
+	0xe41e, 0x19a5, 0x2ce1, 0xa002, 0x3ce1, 0xe161, 0x0300, 0x28d3,
+	0x3d11, 0xc870, 0xaf06, 0x3d11, 0xa200, 0x3d11, 0x3d11, 0xc870,
+	0xaf16, 0xf09a, 0xa220, 0x3ce1, 0xe161, 0x0301, 0xa200, 0x3d11,
+	0x3d11, 0x3d11, 0xca28, 0xf7f8, 0xe0c0, 0x006b, 0x2ee1, 0xa87f,
+	0xae07, 0xe042, 0xce20, 0xd111, 0x0300, 0xd112, 0x0004, 0xd113,
+	0x0000, 0xca28, 0xf7f8, 0xe161, 0x0300, 0x2ce1, 0xa87e, 0x3d11,
+	0x2ce2, 0x3d11, 0x2ce1, 0xaf10, 0x3d11, 0xa200, 0x3d11, 0xca28,
+	0xf7f8, 0xe0c0, 0x006b, 0xce20, 0xd111, 0x0300, 0xd112, 0x0004,
+	0xd113, 0x0000, 0xca28, 0xf7f8, 0xe42e, 0xf278, 0xe0c0, 0x006c,
+	0x1ce3, 0xf2c0, 0xe0c0, 0x0065, 0xaf14, 0xa802, 0xf068, 0xe0c0,
+	0x005c, 0xe008, 0x0200, 0xf098, 0xba4e, 0x2ce1, 0xa87e, 0xa203,
+	0xae11, 0xe042, 0x3ce1, 0xe42e, 0xe0c0, 0x005d, 0xe00a, 0x0200,
+	0xe0c2, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x005d, 0xe008, 0x0200,
+	0xf7c8, 0xa200, 0x3ce3, 0xf0ae, 0x2ce3, 0xa80e, 0xe42a, 0x2ce3,
+	0xa00e, 0xaf06, 0xae06, 0x3ce3, 0xf20e, 0x2ce3, 0xa80e, 0xf088,
+	0xe161, 0x0300, 0xa200, 0x3d11, 0x3d11, 0x3d11, 0x3d11, 0x2ce3,
+	0xa80e, 0xaf02, 0xe000, 0x0300, 0xe092, 0x2ce3, 0xa802, 0xf058,
+	0xba4e, 0xae10, 0x3d11, 0xf04e, 0xba4e, 0x4d01, 0x3d11, 0x2ce3,
+	0xa002, 0x3ce3, 0xa80e, 0xe428, 0xca28, 0xf7f8, 0xe0c0, 0x006b,
+	0xe000, 0x0088, 0x2ee3, 0xa103, 0xaf07, 0xae07, 0xe042, 0xce20,
+	0xd111, 0x0300, 0xd112, 0x0004, 0xd113, 0x0000, 0xca28, 0xf7f8,
+	0x2ce2, 0xa010, 0x3ce2, 0xe42e, 0xe0c1, 0x0044, 0xa80f, 0xe056,
+	0xe42e, 0xa200, 0xe41e, 0x1a0c, 0xe42e, 0xe0c1, 0x0044, 0xaf0d,
+	0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039,
+	0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0800, 0xe167,
+	0x0500, 0x2898, 0xf1b6, 0xa102, 0xcc44, 0xe184, 0x1a54, 0xa200,
+	0xe41e, 0x1a0c, 0xaf04, 0xe41e, 0x1a15, 0xae20, 0x2eb4, 0xe056,
+	0x9f17, 0x2055, 0x4c56, 0xae08, 0x2a10, 0xa105, 0xf039, 0x2053,
+	0x4c54, 0x9f17, 0xe41e, 0x1a5a, 0xe190, 0xe190, 0xa201, 0xe0c3,
+	0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0, 0x0044, 0xaf20, 0xa802,
+	0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a, 0xe0c0, 0x0061, 0xa83e,
+	0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500,
+	0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x1a11,
+	0xa80e, 0xaf04, 0xe41e, 0x1a15, 0xe41e, 0x1a1d, 0xe40b, 0x1a8d,
+	0xa81e, 0xe41e, 0x1a22, 0xae09, 0xe056, 0xae20, 0xe0c1, 0x006e,
+	0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0060, 0xa822, 0xa122,
+	0xf04a, 0x20a2, 0x4ca3, 0xf03e, 0x20a3, 0x4ca2, 0x9f17, 0xe0c0,
+	0x0062, 0x9f17, 0xe0c0, 0x0063, 0x9f17, 0xe0c0, 0x0064, 0x9f17,
+	0xa201, 0xe0c3, 0x040d, 0xe42e, 0x3c00, 0xa202, 0xe0c2, 0x040d,
+	0xe0c0, 0x0420, 0xa802, 0xf7da, 0x8400, 0xc785, 0xe018, 0xe000,
+	0x0501, 0xe09e, 0x2055, 0x4c56, 0xae08, 0x2a10, 0xa105, 0xf039,
+	0x2053, 0x4c54, 0x9f07, 0xa200, 0xe0c2, 0x040d, 0xe42e, 0x3c00,
+	0xa202, 0xe0c2, 0x040d, 0xe0c0, 0x0420, 0xa802, 0xf7da, 0x8400,
+	0xc785, 0xe018, 0xe000, 0x0501, 0xe09e, 0x20a8, 0x4ca9, 0xae08,
+	0x2a10, 0xa105, 0xf0b9, 0xe165, 0x08ea, 0x2915, 0xe008, 0x7fff,
+	0xae20, 0x2b15, 0xe009, 0x7fff, 0xe056, 0x9f07, 0xa200, 0xe0c2,
+	0x040d, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11,
+	0xe042, 0xce20, 0xd111, 0x0800, 0xd112, 0x00c0, 0x88ec, 0x0113,
+	0xca29, 0xf7f9, 0xe190, 0xe42e, 0x2887, 0xae10, 0x4c88, 0xcf52,
+	0xcfca, 0xcf08, 0xd18c, 0x0001, 0xd18b, 0x0000, 0xcb16, 0xf7f8,
+	0xd1e1, 0x0000, 0xcbc2, 0xf7f8, 0xe42e, 0xcb18, 0xf7f8, 0xd18b,
+	0x0001, 0xd1e1, 0x0001, 0xcb16, 0xcbc3, 0xf7e8, 0xf7d9, 0xe42e,
+	0xe41e, 0x1afc, 0xf12d, 0xd1a0, 0x0001, 0xcb40, 0xcb43, 0xf0a9,
+	0xf7d8, 0xf08d, 0xcb54, 0xcf66, 0xcf0a, 0xcfd0, 0xcb56, 0xcf6c,
+	0xe42e, 0xd1a1, 0x0000, 0xe16b, 0xd1a0, 0x0000, 0xcb40, 0xf7f8,
+	0xf72e, 0xe42e, 0xf17d, 0xd1b0, 0x0001, 0xe180, 0xe180, 0x28d9,
+	0xe41a, 0x06a0, 0xe181, 0xe41e, 0x1b56, 0xcb60, 0xcb63, 0xf089,
+	0xf7d8, 0xf06d, 0xcb68, 0xcf0e, 0xcb6a, 0xcf10, 0xe42e, 0xd1e0,
+	0x0000, 0xe41e, 0x1b56, 0xd1b1, 0x0000, 0xa200, 0xcf0e, 0xcf10,
+	0xe0c0, 0x0124, 0xe0c2, 0x0124, 0xe16b, 0xe42e, 0xa200, 0xe0c2,
+	0x0113, 0xcb90, 0xe0c2, 0x030d, 0xcb88, 0xe0c2, 0x0114, 0xcb8a,
+	0xe0c2, 0x0115, 0xcb8c, 0xe0c2, 0x0130, 0x2888, 0x1857, 0x4c87,
+	0xe016, 0xe0c2, 0x0131, 0xcb8e, 0xe0c2, 0x012a, 0xcb82, 0xe0c2,
+	0x0221, 0xcb84, 0xe0c2, 0x0220, 0x287b, 0xe0c2, 0x022c, 0xcbd0,
+	0xf7f8, 0xcb92, 0xe0c2, 0x030f, 0xf0da, 0xcbd2, 0xe0c2, 0x0309,
+	0xcbd4, 0xe0c2, 0x030c, 0xcbd6, 0xe0c2, 0x030a, 0xcbd8, 0xe0c2,
+	0x030b, 0xe42e, 0xcb80, 0xe0c2, 0x0116, 0xcbda, 0xcf12, 0xe161,
+	0x0224, 0xd022, 0x0007, 0xd186, 0x0000, 0xe184, 0x1b98, 0xcb86,
+	0x9f11, 0xe41e, 0x1b0d, 0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2,
+	0x0110, 0xe42e, 0x2895, 0xb43a, 0x3c95, 0x2896, 0xe42a, 0xf0fc,
+	0x2888, 0xae0e, 0x0887, 0xaf08, 0xe000, 0x0670, 0xe098, 0x2887,
+	0xa81e, 0x3c00, 0xa202, 0x5800, 0x4d04, 0x3d04, 0x2887, 0xa1aa,
+	0xe424, 0x2888, 0xa1ac, 0x2a88, 0xa80f, 0xa10f, 0xb636, 0xe424,
+	0xe0c0, 0x0042, 0x2a88, 0xaf07, 0xae0f, 0xe042, 0xe180, 0xe180,
+	0xca29, 0xf7f9, 0xce20, 0xd111, 0x0670, 0xd112, 0x0040, 0xd113,
+	0x0002, 0xca29, 0xf7f9, 0xe181, 0xe164, 0x0670, 0xa200, 0xc73f,
+	0x3d14, 0xe42e, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0000, 0x0001, 0x000c, 0x000a, 0x0010, 0x0028, 0x0018, 0x0014,
+	0x0020, 0x0050, 0x0012, 0x000f, 0x0040, 0x00a0, 0x0000, 0x0000,
+	0x0000, 0x0001, 0x000b, 0x000b, 0x000b, 0x0021, 0x000b, 0x000b,
+	0x000b, 0x0021, 0x000b, 0x000b, 0x0021, 0x0063, 0x0000, 0x0000,
+	0x0000, 0x0018, 0x0019, 0x001e, 0x0032, 0x003c, 0x0030, 0x0048,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c54, 0xf0b4, 0xe04a, 0xaf10,
+	0x1855, 0xf074, 0xe009, 0x00ff, 0x1a56, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x11ed, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0368,
+	0xe40e, 0x036a, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x04b3, 0xe40e, 0x00a4,
+	0xe41e, 0x04d9, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x04da,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x0557, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe41e, 0x05f4, 0xe40e, 0x00a4, 0xe0c0, 0x0059,
+	0xa102, 0xf28a, 0xa102, 0xe42a, 0xa102, 0xf05a, 0xa102, 0xe40a,
+	0x03ac, 0xe42e, 0xe0c0, 0x0060, 0xaf08, 0x30c1, 0xaf02, 0x30c2,
+	0xe0c0, 0x0060, 0xa81e, 0x3cc0, 0xe0c0, 0x0061, 0xa83e, 0x3cc4,
+	0xe0c0, 0x0065, 0xaf04, 0x30a5, 0xe0c0, 0x0065, 0xaf06, 0xa806,
+	0x3ca3, 0xe0c0, 0x0065, 0xaf0a, 0x30d8, 0xe0c0, 0x0066, 0x3ca4,
+	0xe42e, 0xc001, 0xe0c0, 0x0060, 0x3400, 0x3c01, 0xe0c0, 0x0061,
+	0xae14, 0x3406, 0x3c07, 0xc000, 0xe0c0, 0x0062, 0x3009, 0xe0c0,
+	0x0065, 0xaf0a, 0x30d8, 0xe42e, 0xe41e, 0x05d2, 0xe41e, 0x0174,
+	0xca28, 0xf7f8, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0200, 0xd112,
+	0x00c0, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe0c0, 0x0060, 0x3ca8,
+	0xe0c0, 0x0061, 0x3ca9, 0xe0c0, 0x006e, 0xe41e, 0x020a, 0xe42e,
+	0xe0c0, 0x0059, 0xa102, 0xe40a, 0x043b, 0xa102, 0xe42a, 0xa102,
+	0xf05a, 0xa102, 0xe40a, 0x047e, 0xe42e, 0x245d, 0x4c5e, 0xe0c2,
+	0x006f, 0x285b, 0xe0c2, 0x007a, 0x20a6, 0x4ca7, 0xa002, 0x34a6,
+	0x3ca7, 0xe0c2, 0x0070, 0x28a2, 0xe0c2, 0x0071, 0x28a0, 0xe0c2,
+	0x0072, 0xe41e, 0x0497, 0xe0c2, 0x0073, 0xa200, 0xe0c2, 0x0074,
+	0x280c, 0x2ad9, 0xae21, 0xe056, 0x2a4f, 0xae23, 0xe056, 0x2ada,
+	0xae29, 0xe056, 0xe0c2, 0x0076, 0xe41e, 0x0634, 0xe0c2, 0x0051,
+	0xe41e, 0x0637, 0xe0c2, 0x0052, 0x28a1, 0xe0c2, 0x0077, 0x2aaa,
+	0xe161, 0x02d8, 0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0078,
+	0x2111, 0x4d11, 0xf02b, 0xae02, 0xe0c2, 0x0079, 0x20ab, 0x4cac,
+	0xe0c2, 0x007c, 0xe167, 0x02dc, 0x2117, 0x4d17, 0xe0c2, 0x007e,
+	0x2117, 0x4d17, 0xe0c2, 0x007d, 0x28d4, 0xae20, 0x4cd5, 0x2ad1,
+	0xa807, 0xb7f6, 0xe0c2, 0x0078, 0x28d2, 0xae20, 0x4cd3, 0x2ad1,
+	0xa819, 0xb7f6, 0xe0c2, 0x0079, 0xc84a, 0xc84d, 0xae20, 0xe056,
+	0xe0c2, 0x0053, 0xe42e, 0xa200, 0xe0c2, 0x006d, 0x280c, 0xe0c2,
+	0x0070, 0x245d, 0x4c5e, 0xe0c2, 0x0071, 0x20ab, 0x4cac, 0xe0c2,
+	0x0072, 0xa208, 0x0809, 0xe0c2, 0x0073, 0xa202, 0x3cb3, 0x28b3,
+	0xe0c2, 0x0074, 0xa200, 0xe0c2, 0x0075, 0xa200, 0xe0c2, 0x0076,
+	0xa200, 0xe0c2, 0x0077, 0x280c, 0xe016, 0x58f0, 0xe0c2, 0x0078,
+	0xe161, 0x02dc, 0x2111, 0x4d11, 0xe0c2, 0x007a, 0x2111, 0x4d11,
+	0xe0c2, 0x0079, 0x2881, 0xae1c, 0x2a82, 0xe056, 0xae02, 0x2a80,
+	0xe056, 0xe0c2, 0x006e, 0x2826, 0xe016, 0xae10, 0x4c2d, 0xae10,
+	0x4c2c, 0xe0c2, 0x007b, 0xe41e, 0x047f, 0xe42e, 0xe42e, 0xe0c0,
+	0x0065, 0xaf0a, 0xa802, 0xf13a, 0xe162, 0x04c8, 0x2ce4, 0x3d12,
+	0x2ce5, 0x3d12, 0xe0c0, 0x006b, 0xca29, 0xf7f9, 0xce20, 0xd111,
+	0x04c8, 0xd112, 0x0004, 0xd113, 0x0000, 0xe1e1, 0xe42e, 0x2826,
+	0xae02, 0x4c3c, 0xae06, 0x4cd7, 0x2a43, 0xae07, 0x4e34, 0xae04,
+	0x4c3e, 0xae02, 0x4c3a, 0xae02, 0x4c39, 0xae04, 0x4c3d, 0xae02,
+	0x4c32, 0xae24, 0xe056, 0x2a73, 0xe40b, 0x04b2, 0xa205, 0x1a33,
+	0xae21, 0xe056, 0xe42e, 0xa200, 0x3c0c, 0xa200, 0xcc4a, 0xcc4c,
+	0xe41e, 0x05de, 0xe41e, 0x061f, 0xe41e, 0x036e, 0xa200, 0x3c0c,
+	0xe41e, 0x0f17, 0xe41e, 0x0900, 0xf0dd, 0xe41e, 0x0914, 0xe41e,
+	0x0bd4, 0xe41e, 0x0aab, 0xf06d, 0xe41e, 0x0580, 0xf03a, 0xa202,
+	0x3c0c, 0xe41e, 0x0a4b, 0xe41e, 0x1138, 0xe41e, 0x03c8, 0xe16a,
+	0xe42e, 0xe42e, 0xa202, 0x3c0c, 0xe41e, 0x036e, 0xe41e, 0x06a0,
+	0xe41e, 0x055e, 0xe41e, 0x1435, 0xe41e, 0x1468, 0xe41e, 0x060d,
+	0xe41e, 0x1236, 0xe41e, 0x14c9, 0xe41e, 0x0f21, 0xe41e, 0x0580,
+	0xe40a, 0x0530, 0xe41e, 0x0986, 0xe40a, 0x0530, 0xf0a0, 0x283b,
+	0xe016, 0x4432, 0x2a32, 0x563b, 0x3e3b, 0xf758, 0xe40e, 0x0530,
+	0xe41e, 0x020f, 0xe404, 0x0530, 0xe41e, 0x0a54, 0xf0da, 0xe41e,
+	0x0a4b, 0xe41e, 0x0680, 0xe41e, 0x0643, 0xa2fe, 0x3ca1, 0xa202,
+	0x3cd9, 0xe40e, 0x0530, 0xe41e, 0x0620, 0xe408, 0x0530, 0xe41e,
+	0x0625, 0x283b, 0xe41a, 0x070e, 0xe404, 0x054e, 0x283b, 0xe41a,
+	0x0749, 0xe41e, 0x078b, 0x283b, 0xe41a, 0x064d, 0x2832, 0x543b,
+	0x3c3b, 0xf07a, 0x2834, 0x3c43, 0x2840, 0x3c44, 0xe40e, 0x04f2,
+	0xe41e, 0x1522, 0x2a90, 0xf0c5, 0x2891, 0xe046, 0xf024, 0xf05e,
+	0x2a91, 0x2890, 0x3c91, 0x3e90, 0x2891, 0xe41e, 0x0813, 0xe41e,
+	0x062d, 0xa200, 0xe41e, 0x1385, 0xe41e, 0x0eea, 0xf05a, 0xe41e,
+	0x0680, 0xa200, 0x3cb3, 0xe41e, 0x0662, 0x3ca2, 0x28a2, 0x3cb4,
+	0xe41e, 0x03c8, 0xe41e, 0x06b5, 0xe41e, 0x1138, 0xe42e, 0xe41e,
+	0x036e, 0xe41e, 0x14c3, 0xe41e, 0x076d, 0xe42e, 0xa2fe, 0x3c46,
+	0x3c5c, 0xa200, 0x3ca0, 0x3c3b, 0x3c43, 0x3c44, 0x3ce4, 0x3cd1,
+	0x3cd2, 0x3cd3, 0x3cd4, 0x3cd5, 0x3cd6, 0xa200, 0x3cb9, 0x3cd9,
+	0x3cda, 0xe41e, 0x0626, 0xe41e, 0x062d, 0xa2fc, 0x3ca1, 0xa2fa,
+	0x3ca2, 0x2872, 0x2a73, 0xb616, 0x3c72, 0xa2fe, 0x3c90, 0xe42e,
+	0xa202, 0x3cf0, 0x2855, 0xe406, 0x05d0, 0xe002, 0x0078, 0xe400,
+	0x05d0, 0xa204, 0x3cf0, 0x2856, 0xe406, 0x05d0, 0xe002, 0x0078,
+	0xe400, 0x05d0, 0x2854, 0xe002, 0x1fe0, 0xf3b0, 0xe0c0, 0x0059,
+	0xa106, 0xf358, 0xe41e, 0x0ed0, 0xf04a, 0xe41e, 0x01db, 0xf31e,
+	0x28b7, 0x3cb8, 0x2809, 0xf0ba, 0xe41e, 0x06cb, 0x3c11, 0xe41e,
+	0x06cb, 0x3c14, 0x2811, 0x2a14, 0xb7ea, 0xf07e, 0xa2fa, 0x3c11,
+	0xe41e, 0x06cb, 0x3c14, 0x2814, 0x2aa1, 0xb7e9, 0x3ea1, 0x2811,
+	0xe41e, 0x06f6, 0x2811, 0xe41e, 0x06fe, 0x2811, 0xe41e, 0x0706,
+	0x2814, 0xe41e, 0x06f6, 0x2814, 0xe41e, 0x06fe, 0x2814, 0xe41e,
+	0x0706, 0x28b8, 0x3cb7, 0x28a1, 0xa002, 0xf03a, 0xa202, 0xe42e,
+	0xa200, 0xe42e, 0xe167, 0x02d0, 0xe166, 0x0064, 0xd022, 0x0003,
+	0xe184, 0x05dc, 0x9e16, 0x3517, 0x3d17, 0xe42e, 0xe41e, 0x0148,
+	0xe16a, 0xd130, 0x0002, 0xa2fe, 0x34a6, 0x3ca7, 0x3c28, 0xa200,
+	0x3caa, 0xe161, 0x02d8, 0xc703, 0x3d11, 0x3cab, 0x3cac, 0xe161,
+	0x02dc, 0xc703, 0x3d11, 0xe42e, 0xe41e, 0x076d, 0xa200, 0x3e0c,
+	0xe167, 0x0310, 0xe166, 0x0054, 0xa200, 0x3c00, 0x28a8, 0xa102,
+	0xcc44, 0xe184, 0x060a, 0x9e06, 0x5c00, 0xa802, 0xb690, 0x3d17,
+	0x2800, 0xa002, 0x3c00, 0xe190, 0xe42e, 0xa200, 0xcc44, 0xcc4a,
+	0xcc4c, 0xcc72, 0xd130, 0x0002, 0xd03a, 0x0002, 0xd04b, 0x0001,
+	0xd04c, 0x0000, 0xd008, 0x0000, 0xe41e, 0x025f, 0xe42e, 0xe42e,
+	0x2a3b, 0x2873, 0xb611, 0x3e3b, 0xe42e, 0xe42e, 0xe41e, 0x1121,
+	0xe0c0, 0x0048, 0x34ba, 0x3cbb, 0xe42e, 0xe41e, 0x1121, 0xe0c0,
+	0x0048, 0x34bc, 0x3cbd, 0xe42e, 0x24ba, 0x4cbb, 0xe42e, 0x24bc,
+	0x4cbd, 0xe42e, 0xe41e, 0x1121, 0xc001, 0xe0c0, 0x0048, 0x341b,
+	0x3c1c, 0xc000, 0xe42e, 0xa200, 0xceaa, 0xc001, 0x241b, 0x4c1c,
+	0xc000, 0xe0c2, 0x0048, 0xe42e, 0xe42e, 0x2809, 0xf088, 0x2a42,
+	0x28a1, 0xf0b9, 0xe166, 0x0301, 0x2916, 0xf07e, 0x2a42, 0x28a1,
+	0xf049, 0x28d0, 0x2aa1, 0x3ed0, 0x3cb6, 0xe41e, 0x06fe, 0xe41e,
+	0x068e, 0xe42e, 0x28b3, 0xf04a, 0xa102, 0x3cb3, 0xf14e, 0x28b2,
+	0xf12a, 0x28b1, 0xe000, 0x02e0, 0xe092, 0x28b1, 0xa002, 0x3cb1,
+	0xa122, 0xf028, 0x3cb1, 0x28b2, 0xa102, 0x3cb2, 0x2901, 0xe049,
+	0x1aa8, 0xe425, 0xe41e, 0x0eea, 0xe049, 0xa2fa, 0xb7f2, 0xe42e,
+	0xa200, 0x3c42, 0xa202, 0x3c41, 0xa2fc, 0x3c14, 0x3ca1, 0xe41e,
+	0x0749, 0xe41e, 0x064d, 0x28b6, 0xe424, 0xf73e, 0x28b6, 0xe424,
+	0x28b0, 0xe000, 0x02e0, 0xe092, 0x28b6, 0x3d01, 0x28b0, 0xa002,
+	0x3cb0, 0xa122, 0xf028, 0x3cb0, 0x28b2, 0xa002, 0x3cb2, 0xe42e,
+	0xa200, 0x3c00, 0xe004, 0x0054, 0xe09c, 0x28a8, 0xa102, 0xcc44,
+	0xe184, 0x06b3, 0x9e06, 0x5c00, 0xa802, 0xf048, 0x2800, 0xe41e,
+	0x0706, 0x2a00, 0xa003, 0x3e00, 0xe42e, 0xe167, 0x0310, 0xe004,
+	0x0054, 0xe09c, 0x28a8, 0xa102, 0xcc44, 0xa200, 0x3c00, 0xe184,
+	0x06c8, 0x2b17, 0xaf05, 0xa803, 0x5a00, 0xe056, 0x2a00, 0xa003,
+	0x3e00, 0x9f06, 0xe42e, 0x28b7, 0x3c00, 0x2800, 0xe000, 0x0310,
+	0xe092, 0x2901, 0xf0da, 0x2800, 0xa002, 0x3c00, 0x18a8, 0xf038,
+	0xa200, 0x3c00, 0x2800, 0x18b7, 0xf718, 0xa2fe, 0xe42e, 0xa20e,
+	0x3d01, 0x2800, 0xa002, 0x3cb7, 0x18a8, 0xf038, 0xa200, 0x3cb7,
+	0x2800, 0xe42e, 0xe161, 0x0310, 0x28a8, 0xa102, 0xcc44, 0xe184,
+	0x06f4, 0x2911, 0xe016, 0xe428, 0xe190, 0xe42e, 0xe424, 0xe000,
+	0x0310, 0xe092, 0x2901, 0xa80c, 0x3d01, 0xe42e, 0xe424, 0xe000,
+	0x0310, 0xe092, 0x2901, 0xa80a, 0x3d01, 0xe42e, 0xe424, 0xe000,
+	0x0310, 0xe092, 0x2901, 0xa806, 0x3d01, 0xe42e, 0x28a2, 0x3cb4,
+	0xa2fa, 0x3c11, 0x3c14, 0x2809, 0xf0d8, 0xe41e, 0x06cb, 0xf1e4,
+	0x3ca1, 0x3c14, 0xa2fa, 0x3c11, 0x2a42, 0x28a1, 0xe419, 0x06f6,
+	0xf13e, 0x2842, 0xf0a8, 0xe41e, 0x06cb, 0xf104, 0x3c14, 0xe41e,
+	0x06fe, 0x2814, 0xe41e, 0x0706, 0xe41e, 0x06cb, 0xf074, 0x3ca1,
+	0x3c11, 0xe41e, 0x06f6, 0xa200, 0xe42e, 0x2814, 0xe41e, 0x06f6,
+	0x2814, 0xe41e, 0x06fe, 0x2814, 0xe41e, 0x0706, 0x2811, 0xe41e,
+	0x06f6, 0x2811, 0xe41e, 0x06fe, 0x2811, 0xe41e, 0x0706, 0xa2fe,
+	0xe42e, 0x2842, 0xf148, 0xe166, 0x0300, 0x2916, 0xb608, 0x3c12,
+	0x2814, 0x3c13, 0xe166, 0x0301, 0x290e, 0xe41e, 0x06f6, 0xe166,
+	0x0300, 0x2916, 0x3d0e, 0x2814, 0x3d06, 0xe42e, 0xe166, 0x0300,
+	0x2916, 0xb608, 0x3c13, 0x2916, 0xb608, 0x3c12, 0xe42e, 0xa2fa,
+	0xe166, 0x0300, 0xc701, 0x3d16, 0xe42e, 0xa2fa, 0x3c12, 0x3c13,
+	0x3cb4, 0x3c11, 0x3cd0, 0xa202, 0x3cb3, 0xa200, 0x3cb1, 0x3cb0,
+	0x3cb2, 0x3cb5, 0xe166, 0x02e0, 0xc710, 0x3d16, 0xe41e, 0x0767,
+	0xa200, 0x3cb7, 0xe161, 0x0310, 0x2aa8, 0xe42b, 0xa103, 0x3e50,
+	0x8650, 0x3d11, 0xe42e, 0xe16a, 0x2a3b, 0xf089, 0x2814, 0x2a09,
+	0xf02b, 0x28a1, 0xa2ff, 0xe41e, 0x1542, 0xe41e, 0x1435, 0xe41e,
+	0x1468, 0x283b, 0xe41a, 0x025f, 0xe41e, 0x1252, 0xe41e, 0x08df,
+	0xe41e, 0x0a63, 0xf164, 0x283b, 0xf03a, 0xa2fe, 0x3c5c, 0x2846,
+	0x2a5c, 0xe046, 0xe402, 0x07b1, 0x2c54, 0x3c47, 0xe41e, 0x07ef,
+	0xf0ee, 0xe41e, 0x11de, 0xe41e, 0x07c5, 0xe41e, 0x08fb, 0xf69a,
+	0x2c54, 0x3c47, 0x1c57, 0xe410, 0x07ef, 0xf01e, 0xe16a, 0xd182,
+	0x0007, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xe41e, 0x089a, 0xf26d,
+	0xe41e, 0x08a7, 0xf23d, 0xa202, 0x3c48, 0x2c47, 0x1c57, 0xe410,
+	0x07ef, 0xe41e, 0x08b6, 0xf1ad, 0x2848, 0xa102, 0xe418, 0x0e87,
+	0x2848, 0xa102, 0xe41a, 0x0e1c, 0xf11d, 0x2c48, 0xa102, 0x3c48,
+	0xe41e, 0x08e8, 0xe41e, 0x08fb, 0xe428, 0xe41e, 0x11c2, 0xe428,
+	0x2848, 0xe41a, 0x089a, 0xf02d, 0xf65e, 0xe16a, 0xe42e, 0x2890,
+	0xf152, 0x2826, 0xf0d8, 0x283d, 0xa106, 0xf0a8, 0x2856, 0x2a53,
+	0xa01f, 0xaf09, 0xe046, 0xf04a, 0xa2fe, 0x3c90, 0xf07e, 0x2859,
+	0xe40a, 0x0804, 0xe002, 0x0001, 0x3c90, 0xe41e, 0x0eaa, 0xe41e,
+	0x08e8, 0xe41e, 0x08fb, 0xf058, 0x2c47, 0x1c57, 0xf02a, 0xf76e,
+	0x2859, 0x3c91, 0xe42e, 0xe41e, 0x02ad, 0x2812, 0xf032, 0x2814,
+	0xb608, 0x3c95, 0x2814, 0x3c9c, 0xa200, 0x3c92, 0xe41e, 0x0835,
+	0xe41e, 0x0863, 0xa204, 0x3c92, 0xe41e, 0x0835, 0xe41e, 0x0863,
+	0xe41e, 0x032b, 0xf078, 0xa206, 0x3c92, 0xe41e, 0x0835, 0xe41e,
+	0x0863, 0xe0c0, 0x0800, 0xf7e8, 0xe42e, 0xa200, 0x3c93, 0x3c9a,
+	0x2892, 0x3c94, 0x3c9b, 0x2890, 0xae08, 0x5832, 0x3c96, 0x3c9d,
+	0xa200, 0x3c97, 0x3c9e, 0x2891, 0xa002, 0x1890, 0xae08, 0x5832,
+	0x2a92, 0xa101, 0xf02b, 0xaf02, 0x3c98, 0x2855, 0xae08, 0x3c99,
+	0x2892, 0xa100, 0xf07a, 0xe41e, 0x032b, 0xf048, 0x2899, 0xaf02,
+	0x3c99, 0x2892, 0xa100, 0xf07a, 0x2896, 0xaf02, 0x3c96, 0x289d,
+	0xaf02, 0x3c9d, 0xe42e, 0xe0c0, 0x0800, 0xf7e8, 0xa202, 0xe0c2,
+	0x0802, 0xe41e, 0x032b, 0xae20, 0xe0c2, 0x0804, 0xa220, 0xae20,
+	0xe005, 0x1010, 0xe056, 0xe0c2, 0x0805, 0xa200, 0xe0c2, 0x0806,
+	0xa202, 0xae04, 0x4c93, 0xae04, 0x4c94, 0xae10, 0x4c95, 0xe0c2,
+	0x0807, 0x2096, 0x4c97, 0xe0c2, 0x0808, 0x2098, 0x4c99, 0xe0c2,
+	0x0809, 0xa202, 0xae04, 0x4c9a, 0xae04, 0x4c9b, 0xae10, 0x4c9c,
+	0xe0c2, 0x080a, 0x209d, 0x4c9e, 0xe0c2, 0x080b, 0xa202, 0xe0c2,
+	0x0800, 0xe42e, 0xa201, 0xb800, 0xe42d, 0xf08a, 0xa17e, 0xf7ca,
+	0xa102, 0xa87e, 0xe041, 0x3e48, 0xe42e, 0xa043, 0xf75e, 0x8455,
+	0x8246, 0xe018, 0x2e48, 0xa103, 0xe042, 0x3c47, 0x2c47, 0x1c54,
+	0xf042, 0x2c47, 0x1c57, 0xe422, 0xe16b, 0xe42e, 0x2840, 0xf04a,
+	0x2c48, 0xa102, 0xf028, 0xe42e, 0xe16b, 0xe42e, 0xba48, 0x3c64,
+	0x2814, 0x3c01, 0x2809, 0xf03a, 0x28a1, 0x3c01, 0x2801, 0xe41e,
+	0x153c, 0xf052, 0x2801, 0x2a64, 0xe41e, 0x1542, 0xae02, 0x4c65,
+	0xae04, 0xcb23, 0xa807, 0xe056, 0xcf22, 0xba40, 0xf06a, 0xba4e,
+	0xba40, 0xf03a, 0xba4e, 0xf7de, 0xd182, 0x0007, 0xe42e, 0xa200,
+	0x3c57, 0x3c58, 0x3c59, 0xcf64, 0xcf62, 0xd1b3, 0x0001, 0xe42e,
+	0x2c57, 0xa002, 0x3c57, 0xcf64, 0x2c58, 0xa002, 0x3c58, 0x1c55,
+	0xf078, 0xd1b3, 0x0004, 0x3c58, 0x2c59, 0xa002, 0x3c59, 0x2458,
+	0x4c59, 0xcf62, 0xe42e, 0x2c59, 0x1c45, 0xe01a, 0xe016, 0xe42e,
+	0xa23e, 0x3cf0, 0xe41e, 0x0ed0, 0xf0c8, 0xe41e, 0x0f9a, 0xe41e,
+	0x0ec2, 0xe002, 0x00b3, 0xf778, 0xe41e, 0x0b06, 0xf04a, 0xe42e,
+	0xe41e, 0x01db, 0xe16b, 0xe42e, 0xe41e, 0x1172, 0xe41e, 0x0ec2,
+	0xe002, 0x00b3, 0xf28a, 0xe41e, 0x0ec2, 0xe002, 0x00b8, 0xf28a,
+	0xe41e, 0x0ec2, 0xe002, 0x00b2, 0xf2aa, 0xe41e, 0x0ec2, 0xe002,
+	0x00b5, 0xe40a, 0x097b, 0xe41e, 0x0ec2, 0xe002, 0x0000, 0xf11a,
+	0xe41e, 0x0ec2, 0xe002, 0x00b7, 0xf04a, 0xe41e, 0x0f61, 0xf5de,
+	0xe41e, 0x0ed0, 0xe408, 0x093f, 0xe41e, 0x0f9a, 0xf56e, 0xf01e,
+	0xe40e, 0x0983, 0xe41e, 0x0f9a, 0xe41e, 0x0b06, 0xf4ee, 0xe41e,
+	0x0f9a, 0xa200, 0x3c3b, 0xe41e, 0x0b60, 0xf47e, 0xe41e, 0x0f9a,
+	0xba3e, 0x340a, 0x3c0b, 0xe004, 0x4454, 0x180a, 0xf078, 0xe004,
+	0x4731, 0x180b, 0xf038, 0xe40e, 0x0973, 0xe004, 0x4741, 0x180a,
+	0xf0c8, 0xe004, 0x3934, 0x180b, 0xf088, 0xba7e, 0xba0e, 0xa10c,
+	0xe40a, 0x0977, 0xa202, 0x3cd6, 0x28d8, 0xe40a, 0x0914, 0xe41e,
+	0x0d26, 0xe40e, 0x0914, 0xe41e, 0x0e05, 0xe40e, 0x0914, 0xe41e,
+	0x0dd4, 0xe40e, 0x0914, 0xe41e, 0x0f9a, 0xe41e, 0x0beb, 0xf06d,
+	0xe16a, 0xe40e, 0x0914, 0xe16a, 0xe42e, 0xe42e, 0xa204, 0x3c4f,
+	0xa200, 0x3c5f, 0xe41e, 0x0ed0, 0xe408, 0x09ca, 0xe41e, 0x1172,
+	0xe41e, 0x0ec2, 0xe002, 0x00b3, 0xe40a, 0x09e8, 0xe41e, 0x0ec2,
+	0xe002, 0x00b8, 0xe40a, 0x09f2, 0xe41e, 0x0ec2, 0xe002, 0x00b2,
+	0xe40a, 0x09f8, 0xe41e, 0x0ec2, 0xe002, 0x00b5, 0xe40a, 0x0a25,
+	0xe41e, 0x0ec2, 0xe002, 0x0000, 0xe40a, 0x09ce, 0xe41e, 0x0ec2,
+	0xe002, 0x0001, 0xe404, 0x09bf, 0xe41e, 0x0ec2, 0xe002, 0x00af,
+	0xe404, 0x0a2c, 0xe41e, 0x0ec2, 0xe002, 0x00b7, 0xf05a, 0xe41e,
+	0x0f61, 0xe40e, 0x098a, 0xe41e, 0x0ed0, 0xe408, 0x09ca, 0xe41e,
+	0x0f9a, 0xf41e, 0xe41e, 0x01db, 0xe40e, 0x0a43, 0xe41e, 0x0e12,
+	0xe41e, 0x0f9a, 0xe41e, 0x0b6b, 0xa202, 0xb61a, 0x3c5f, 0xe41d,
+	0x0e19, 0x2873, 0xe418, 0x1169, 0x28a3, 0x4ca5, 0xe01a, 0x4473,
+	0xe408, 0x0a47, 0x2873, 0xe408, 0x0a41, 0xe16a, 0xe40e, 0x098a,
+	0xa200, 0x3c3b, 0xe41e, 0x063a, 0xe41e, 0x0f9a, 0xe41e, 0x0b06,
+	0xe40e, 0x098a, 0xe41e, 0x0f9a, 0xe41e, 0x0b60, 0xe40e, 0x098a,
+	0xe41e, 0x0f9a, 0xba3e, 0x340a, 0x3c0b, 0xe004, 0x4454, 0x180a,
+	0xf078, 0xe004, 0x4731, 0x180b, 0xf038, 0xe40e, 0x0a1d, 0xe004,
+	0x4741, 0x180a, 0xf0c8, 0xe004, 0x3934, 0x180b, 0xf088, 0xba7e,
+	0xba0e, 0xa10c, 0xe40a, 0x0a21, 0xa202, 0x3cd6, 0x28d8, 0xe40a,
+	0x098a, 0xe41e, 0x0d26, 0xe40e, 0x098a, 0xe41e, 0x0e05, 0xe40e,
+	0x098a, 0xe41e, 0x0dd4, 0xe40e, 0x098a, 0xe41e, 0x0f9a, 0xe41e,
+	0x0beb, 0xe16a, 0xe40e, 0x098a, 0x285f, 0xe408, 0x0a33, 0xe41e,
+	0x0f9a, 0xe40e, 0x098a, 0xe41e, 0x0bd4, 0xe41e, 0x0aab, 0xe41e,
+	0x0ae2, 0xf08a, 0xf0d4, 0xe41e, 0x0f9a, 0xa202, 0x3c5f, 0xe40e,
+	0x098a, 0xa202, 0xe42e, 0xe41e, 0x0aab, 0xa200, 0xe42e, 0xa2fd,
+	0x3ea1, 0xa2fe, 0xe42e, 0xe165, 0x0350, 0x2855, 0x3d15, 0x2856,
+	0x3d15, 0x2826, 0x3d15, 0xe42e, 0xe165, 0x0350, 0x2855, 0x1915,
+	0xf088, 0x2856, 0x1915, 0xf058, 0x2826, 0x1915, 0xf028, 0xe42e,
+	0xa202, 0x3cda, 0xe42e, 0xe41e, 0x1172, 0xe41e, 0x0ec2, 0xe002,
+	0x00b3, 0xe40a, 0x0a9b, 0xe41e, 0x0ec2, 0xe002, 0x00b8, 0xe40a,
+	0x0a9b, 0xe41e, 0x0ec2, 0xe002, 0x00b2, 0xe40a, 0x0a9b, 0xe41e,
+	0x0ec2, 0xe002, 0x00b5, 0xe40a, 0x0a9b, 0xe41e, 0x0ec2, 0xe002,
+	0x0000, 0xe40a, 0x0a9b, 0xe41e, 0x0ec2, 0xe002, 0x0001, 0xe404,
+	0x0a9b, 0xe41e, 0x0ec2, 0xe002, 0x00af, 0xe404, 0x0a9d, 0xe41e,
+	0x0ec2, 0xe002, 0x00b7, 0xe408, 0x0a9b, 0xe41e, 0x0ed0, 0xe40a,
+	0x0aa9, 0xe41e, 0x01db, 0xe40e, 0x0aa9, 0x2846, 0x3c5c, 0xe41e,
+	0x0f9a, 0xe41e, 0x0ec2, 0xa102, 0x3c46, 0xe41e, 0x08be, 0xa200,
+	0xe42e, 0xa2fe, 0xe42e, 0xe166, 0x02dc, 0xe167, 0x02de, 0xa2fe,
+	0x3516, 0x3d0e, 0x3517, 0x3d0f, 0x2828, 0xe424, 0xa231, 0xa104,
+	0xf0e6, 0xa102, 0xb435, 0xf0ba, 0xa104, 0xb4cd, 0xf086, 0xa102,
+	0xf05a, 0xa104, 0xf026, 0xe42e, 0xa015, 0xa035, 0x3e50, 0x8450,
+	0x8229, 0xe018, 0x3c50, 0x8450, 0xe182, 0x03e8, 0xe018, 0x3517,
+	0x3d17, 0xe005, 0x03e9, 0x2828, 0xa102, 0xf06a, 0xa106, 0xf04a,
+	0xa106, 0xf02a, 0xa103, 0x3e50, 0x8450, 0x822a, 0xe018, 0x3516,
+	0x3d16, 0xe42e, 0x28a5, 0xf0aa, 0x2844, 0x443b, 0x4c40, 0xe40a,
+	0x0aeb, 0xe40e, 0x0b00, 0xe40e, 0x0b02, 0x28a3, 0xe40a, 0x0b00,
+	0xa102, 0xf05a, 0xa102, 0xf09a, 0xa102, 0xf0aa, 0x2844, 0x443b,
+	0x4c40, 0xe408, 0x0b00, 0xf04e, 0x2842, 0xe40a, 0x0b00, 0xf05e,
+	0xa200, 0xe42e, 0xa202, 0xe42e, 0xa2fe, 0xe42e, 0xa200, 0x3c25,
+	0x3c27, 0x3ce3, 0xa202, 0x3c29, 0x3c2a, 0x2825, 0x3c0d, 0x285d,
+	0x3c0e, 0x285e, 0x3c0f, 0x2a5d, 0xba56, 0xe40a, 0x0b4d, 0x3c5d,
+	0xe002, 0x0780, 0xf046, 0x3e5d, 0xf31e, 0xe190, 0x285d, 0x3c52,
+	0xa01e, 0xaf08, 0x3c55, 0x2a5e, 0xba56, 0xf28a, 0x3c5e, 0xe002,
+	0x0480, 0xf036, 0x3e5e, 0xf22e, 0x285e, 0x3c53, 0xa01e, 0xaf08,
+	0x3c56, 0x3c45, 0x8455, 0x8256, 0xe018, 0x3c54, 0xa206, 0x3cf0,
+	0xba46, 0xf14a, 0x34ab, 0x3cac, 0xa208, 0x3cf0, 0xba46, 0xf0ea,
+	0x3c28, 0xa20a, 0x3cf0, 0xba62, 0xba40, 0xf08a, 0xba52, 0xba40,
+	0xe41e, 0x0cdf, 0xf038, 0xa202, 0xe42e, 0x280d, 0x3c25, 0x280e,
+	0x3c5d, 0xa01e, 0xaf08, 0x3c55, 0x280f, 0x3c5e, 0xa01e, 0xaf08,
+	0x3c56, 0x3c45, 0x8455, 0x8256, 0xe018, 0x3c54, 0xa200, 0xe42e,
+	0xa202, 0x3ce3, 0xba40, 0xba48, 0xba4a, 0xba40, 0xba4a, 0xba4a,
+	0xba40, 0xba40, 0xe42e, 0xe0c1, 0x0059, 0xa107, 0xf049, 0x284f,
+	0xa802, 0x3c4f, 0xa204, 0x3ce3, 0x283b, 0xf0a8, 0xa200, 0x3c73,
+	0xba18, 0xa80e, 0xe40a, 0x0bcf, 0xba52, 0x3c72, 0xf08e, 0xba12,
+	0x1872, 0xf04a, 0x3c73, 0xe40e, 0x0bcf, 0xba52, 0xba44, 0xe40a,
+	0x0bcf, 0x2a34, 0x3e2f, 0xa102, 0xe049, 0xaf05, 0xe409, 0x0bcf,
+	0x3c34, 0xa202, 0x5834, 0x3040, 0xaf02, 0x3041, 0xaf02, 0x3042,
+	0xaf02, 0x3049, 0x2849, 0x4425, 0xf338, 0xba5f, 0x2825, 0xf08a,
+	0x2840, 0xf298, 0xba46, 0x2841, 0xf268, 0xba46, 0xf24e, 0x2840,
+	0x4c49, 0xe162, 0x0400, 0xe163, 0x0404, 0xf1d8, 0xba40, 0x3c7d,
+	0x4425, 0xf1e8, 0xba44, 0xf1ca, 0xa102, 0x3d12, 0x3d02, 0xa221,
+	0x5b12, 0x3f13, 0x3f13, 0x2841, 0xf0e8, 0xba40, 0x3c7e, 0x4425,
+	0xf0f8, 0xba44, 0xf0da, 0xa102, 0x3d12, 0x3d02, 0xa221, 0x5b02,
+	0x3f13, 0x3f03, 0xba40, 0xf03a, 0xba4e, 0xf7de, 0xe42e, 0x284f,
+	0xa902, 0x3c4f, 0xe16b, 0xe42e, 0x2825, 0xe428, 0xa200, 0x3c36,
+	0x3c35, 0x3c37, 0x3c33, 0x3c3a, 0x3c38, 0x3c30, 0xa202, 0x3c3c,
+	0x3c31, 0x3c3e, 0x3c26, 0xa206, 0x3c3d, 0x2853, 0xa01e, 0xaf08,
+	0x3c56, 0x3c45, 0xe42e, 0xba46, 0xa102, 0xf0ca, 0xa102, 0xf0fa,
+	0xa102, 0xf13a, 0xa102, 0xf17a, 0xa106, 0xf1ba, 0xa102, 0xf1fa,
+	0xe42e, 0xa202, 0x3c25, 0xe41e, 0x0c1c, 0xe42e, 0xa202, 0x3c25,
+	0xe41e, 0x0c4d, 0xe16a, 0xe42e, 0xa202, 0x3c25, 0xe41e, 0x0c5e,
+	0xe16a, 0xe42e, 0xa202, 0x3c25, 0xe41e, 0x0ccd, 0xe16a, 0xe42e,
+	0xa202, 0x3c25, 0xe41e, 0x0cb8, 0xe16a, 0xe42e, 0xa202, 0x3c25,
+	0xe41e, 0x0c71, 0xe16a, 0xe42e, 0xba46, 0x3c2c, 0xba46, 0x3c2d,
+	0xba40, 0x3c26, 0x2a53, 0xf04a, 0xa01f, 0xaf09, 0xf04e, 0xa03f,
+	0xaf0b, 0xae03, 0x3e56, 0xa210, 0x3cf0, 0xba42, 0xa102, 0xf1c8,
+	0xa212, 0x3cf0, 0xba42, 0xf188, 0xa214, 0x3cf0, 0xba42, 0xf148,
+	0xa216, 0x3cf0, 0xba56, 0xa218, 0x3cf0, 0xba40, 0xf0da, 0xa21a,
+	0x3cf0, 0xba4e, 0xba40, 0x3c80, 0xba42, 0xa002, 0x3c29, 0xba48,
+	0xa002, 0x3c2a, 0xe42e, 0xe16b, 0xe42e, 0xba44, 0xba40, 0xf04a,
+	0xba4e, 0xba4e, 0xba4e, 0xba5a, 0x3c81, 0xa20a, 0x3cf0, 0xba40,
+	0xf04a, 0xba5a, 0x3c82, 0xe42e, 0xe16b, 0xe42e, 0xe41e, 0x0cdf,
+	0xf0f8, 0xa200, 0x3c50, 0xd022, 0x0001, 0xe184, 0x0c6c, 0xba41,
+	0xf03b, 0xc73f, 0xba4e, 0x4e50, 0x3e50, 0xf029, 0xe42e, 0xe16b,
+	0xe42e, 0xe162, 0x0400, 0xe163, 0x0404, 0xa21c, 0x3cf0, 0xd022,
+	0x0003, 0xe184, 0x0c80, 0xba46, 0xa102, 0x3d02, 0xa221, 0x5b12,
+	0x3f13, 0xba43, 0x3e30, 0xa21e, 0x3cf0, 0xba43, 0x3e3d, 0xf2fb,
+	0xa103, 0x3233, 0xaf03, 0x3e31, 0xe017, 0x3e32, 0x283b, 0xf03a,
+	0x2831, 0xf258, 0x2a31, 0x8455, 0x8256, 0xe018, 0xf029, 0xaf02,
+	0x3c54, 0x2856, 0xf029, 0xaf02, 0x3c45, 0xba40, 0x3c39, 0xba40,
+	0x3c3c, 0xba40, 0x3c38, 0xba40, 0x3c36, 0xba40, 0x3c37, 0xba40,
+	0x3c35, 0xba40, 0x3c3a, 0xba40, 0xba40, 0x3c3e, 0xa203, 0xba40,
+	0xe42a, 0xba40, 0xba44, 0x3cd7, 0xba5e, 0xe42e, 0xe16b, 0xe42e,
+	0xa202, 0x2a26, 0xf04b, 0x083a, 0x0839, 0xf03e, 0x0831, 0x083a,
+	0xae02, 0xa102, 0xcc44, 0xe184, 0x0cc7, 0xba5e, 0xba40, 0xf02a,
+	0xe42e, 0xa20a, 0x3cf0, 0xe16b, 0xe42e, 0xba40, 0xba4e, 0xba40,
+	0xba4c, 0xba40, 0xf09a, 0xba66, 0xba40, 0xf06a, 0xba6a, 0xba40,
+	0xf03a, 0xba6a, 0xe42e, 0xa20a, 0x3cf0, 0xe16b, 0xe42e, 0xba41,
+	0xf21b, 0xe0c3, 0x013c, 0xa200, 0x3c7c, 0xe161, 0x0420, 0x287c,
+	0xe0c2, 0x013e, 0xa002, 0x3c7c, 0xa20c, 0x3cf0, 0xba4e, 0x3d11,
+	0xe0c2, 0x013f, 0xd022, 0x003e, 0xe184, 0x0cff, 0x287c, 0xe0c2,
+	0x013e, 0xa002, 0x3c7c, 0xba4e, 0xf28a, 0x3d11, 0xe0c2, 0x013f,
+	0xe190, 0xba40, 0xf1aa, 0xe0c2, 0x013c, 0xae02, 0xe055, 0xe004,
+	0x0040, 0x3c7c, 0xe162, 0x0460, 0xa20e, 0x3cf0, 0xd022, 0x003f,
+	0xe184, 0x0d1a, 0x287c, 0xe0c2, 0x013e, 0xa002, 0x3c7c, 0xba4e,
+	0x3d12, 0xe0c2, 0x013f, 0xe190, 0x4e27, 0x3e27, 0xe0c3, 0x013d,
+	0xa200, 0xe0c2, 0x013c, 0xe42e, 0xa202, 0xe42e, 0x2ad8, 0x28e4,
+	0xa120, 0xb615, 0x3ed8, 0xe42b, 0xa200, 0x3ce2, 0xe162, 0x04c8,
+	0x28d6, 0xf09a, 0xe004, 0x4741, 0x3d12, 0xe004, 0x3934, 0x3d12,
+	0xa208, 0x3ce2, 0xe41e, 0x0d83, 0xf168, 0xba4e, 0x2ae2, 0xa803,
+	0xf049, 0xae10, 0x3ce1, 0xf03e, 0x4ce1, 0x3d12, 0x2ae2, 0xa003,
+	0x3ee2, 0xa80f, 0xe41b, 0x0db3, 0x28d8, 0xf0aa, 0xe41e, 0x0d83,
+	0xf028, 0xf69e, 0x28e2, 0xa802, 0xf03a, 0x28e1, 0x3d12, 0xa211,
+	0x28e2, 0xa80e, 0xf0ba, 0xe045, 0xaf03, 0xf06b, 0xa103, 0x3e50,
+	0xa201, 0x8650, 0x3f12, 0xe41e, 0x0db3, 0xa201, 0xe162, 0x04c8,
+	0x28e3, 0x3d12, 0x28e2, 0x3d12, 0x3f12, 0xa200, 0x3d12, 0xe0c1,
+	0x006b, 0x28e4, 0xa002, 0xae06, 0xe041, 0xaf06, 0x3ce4, 0xca28,
+	0xf7f8, 0xce21, 0xd111, 0x04c8, 0xd112, 0x0004, 0xd113, 0x0000,
+	0xca28, 0xf7f8, 0xe42e, 0xc001, 0x2832, 0xf028, 0xf07e, 0x2430,
+	0x4c31, 0xae06, 0xc873, 0xe046, 0xf046, 0xa200, 0xc000, 0xe42e,
+	0xa202, 0xc000, 0xe42e, 0xa200, 0x3ce7, 0xe0c0, 0x005c, 0xe0c1,
+	0x0065, 0xaf12, 0xa802, 0xaf15, 0xa803, 0xe016, 0xe056, 0xf04a,
+	0xa200, 0x3cd8, 0xe42e, 0x28e8, 0xf05a, 0xe0c0, 0x005d, 0xe42a,
+	0xf7be, 0xe0c0, 0x005d, 0xe00a, 0x0200, 0xe0c2, 0x005d, 0xa202,
+	0xce00, 0x3ce8, 0xf71e, 0xd112, 0x0004, 0xe0c0, 0x006b, 0xe000,
+	0x0088, 0x0ce7, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x04c8, 0xd113,
+	0x0000, 0xe1e1, 0xe162, 0x04c8, 0x2ce5, 0x2ee7, 0xa010, 0xa011,
+	0x3ce5, 0x3ee7, 0xe0c0, 0x006c, 0xe002, 0x0088, 0xe046, 0xe416,
+	0x0d93, 0xa200, 0x3ce8, 0xe42e, 0xba4e, 0xba40, 0xae02, 0xba41,
+	0xe056, 0xae02, 0xba41, 0xe056, 0xae02, 0xba41, 0xe056, 0x3cd1,
+	0xba46, 0x28d1, 0xa810, 0xf06a, 0xba42, 0xa106, 0xf1d8, 0xba5a,
+	0x3cd2, 0x28d1, 0xa808, 0xf06a, 0xba42, 0xa106, 0xf158, 0xba5a,
+	0x3cd3, 0x28d1, 0xa804, 0xf06a, 0xba42, 0xa106, 0xf0d8, 0xba5a,
+	0x3cd4, 0x28d1, 0xa802, 0xf06a, 0xba42, 0xa106, 0xf058, 0xba5a,
+	0x3cd5, 0xa203, 0xe42e, 0xa201, 0xe42e, 0xba7e, 0xba40, 0xf098,
+	0xba41, 0xba4a, 0xf04b, 0xba46, 0xba46, 0x3c5b, 0xa203, 0xe42e,
+	0xa201, 0xe42e, 0x28b9, 0xe428, 0xe41e, 0x0626, 0xa202, 0x3cb9,
+	0xe42e, 0xa200, 0x3cb9, 0xe42e, 0xd180, 0x0002, 0xe41e, 0x122f,
+	0xcb00, 0xcb03, 0xe409, 0x0e83, 0xf7c8, 0xcb0c, 0x3060, 0xaf02,
+	0x3061, 0xaf02, 0x306f, 0xaf02, 0x3070, 0xaf02, 0x306a, 0xaf02,
+	0x3065, 0xaf02, 0xf03a, 0xcb16, 0x3c64, 0xa200, 0x2a70, 0x4e60,
+	0xe017, 0x4641, 0xb632, 0x3c6e, 0xcf24, 0xcb22, 0xaf08, 0xa802,
+	0x4c6f, 0xae02, 0x4c70, 0x2a60, 0xe055, 0xb636, 0x3c71, 0x286a,
+	0x4c70, 0x4c6f, 0xf08a, 0xd190, 0x0001, 0xcb20, 0xcb03, 0xe409,
+	0x0e83, 0xf7c8, 0x746a, 0xa200, 0x1860, 0x2a61, 0xf03b, 0xb808,
+	0xf2bd, 0xcf08, 0xe0c2, 0x012a, 0xa200, 0x2a60, 0xe017, 0x4e6e,
+	0x4e6a, 0xb652, 0xcf20, 0xd180, 0x0001, 0xcb00, 0xcb03, 0xf1c9,
+	0xf7d8, 0xcb20, 0xcb03, 0xf189, 0xf7d8, 0x7449, 0xe41e, 0x0ec6,
+	0xf13d, 0xa200, 0x2a60, 0xb636, 0xcf04, 0xa200, 0x2a6a, 0xe017,
+	0x4660, 0xb6d2, 0xcf04, 0xa200, 0x2a6e, 0xb652, 0xcf04, 0xa200,
+	0xe41e, 0x13bd, 0xe42e, 0xe16b, 0xa200, 0xcf02, 0xe42e, 0x3c50,
+	0xd192, 0x0002, 0xd182, 0x0001, 0xcb0c, 0xaf04, 0xa806, 0xf038,
+	0xa210, 0xcf0c, 0xa200, 0x3c60, 0x2a41, 0xb652, 0xcf04, 0xd190,
+	0x0002, 0xcb20, 0xcb03, 0xf0b9, 0xf7d8, 0x286f, 0xae02, 0x4c70,
+	0xb634, 0x3c71, 0x2850, 0xe41e, 0x13bd, 0xe42e, 0xe16b, 0xa200,
+	0xcf02, 0xe42e, 0x20a6, 0x4ca7, 0xe414, 0x13bd, 0x20a6, 0x4ca7,
+	0xe412, 0x0e87, 0x2ca0, 0xa002, 0x3ca0, 0xe42e, 0xc001, 0x3c13,
+	0xc000, 0xe42e, 0xc001, 0x2813, 0xc000, 0xe42e, 0xc001, 0x3c14,
+	0xc000, 0xe42e, 0xc001, 0x2814, 0xc000, 0xe42e, 0xc001, 0x2430,
+	0x4c31, 0xc000, 0xae06, 0xc873, 0xe046, 0xe422, 0xe16b, 0xe42e,
+	0xc001, 0x280c, 0xf16a, 0xe41e, 0x1121, 0xc001, 0xe0c0, 0x0049,
+	0x340e, 0x3c0f, 0x240e, 0x4c0f, 0xe0c1, 0x0048, 0x360e, 0x3e0f,
+	0x260e, 0x4e0f, 0xe045, 0xa200, 0xb626, 0xe003, 0x0200, 0xb606,
+	0xc000, 0xe42e, 0xe41e, 0x0ed0, 0xe42a, 0xe0c0, 0x0045, 0xaf04,
+	0xa802, 0xe42e, 0xc001, 0x3c33, 0xc000, 0xe42e, 0xc001, 0x2833,
+	0xc000, 0xe42e, 0xc001, 0x3c11, 0xc000, 0xe42e, 0xc001, 0x2811,
+	0xc000, 0xe42e, 0xd148, 0x0040, 0xd144, 0x0000, 0xd145, 0x0000,
+	0xd168, 0x0000, 0xd16b, 0x0000, 0xd14b, 0x0200, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xd14c, 0x000c, 0xca9a, 0xf7f8, 0xe42e, 0xc001,
+	0x2400, 0x4c01, 0x0406, 0x0c07, 0x3408, 0x3c09, 0xd071, 0x202a,
+	0xe181, 0xc001, 0xe0c0, 0x0048, 0x3415, 0x3c16, 0x280c, 0xf13a,
+	0xe0c0, 0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0xe0c1, 0x0049,
+	0x3604, 0x3e05, 0x1404, 0x1c05, 0xe0c1, 0x0045, 0xaf05, 0xa803,
+	0xb611, 0x320c, 0xe0c0, 0x0048, 0x3402, 0xe008, 0xfe00, 0x3c03,
+	0xe0c0, 0x0048, 0xe008, 0x01ff, 0x3c0b, 0xa200, 0xcc78, 0xd022,
+	0x00ff, 0xe184, 0x0f4c, 0xcc7a, 0xe190, 0xe41e, 0x1010, 0xe41e,
+	0x102f, 0xe41e, 0x0f02, 0xc001, 0xa200, 0x3c1a, 0x280b, 0xa102,
+	0xe412, 0x0f69, 0xc001, 0xa202, 0x3c1a, 0xa200, 0xceaa, 0xc000,
+	0xe42e, 0xcaa0, 0xe190, 0xca9a, 0xf7f8, 0xca9c, 0xe418, 0x102f,
+	0xe42e, 0xcc44, 0xe184, 0x0f72, 0xca9c, 0xe418, 0x102f, 0xcaa0,
+	0xca9b, 0xf7f9, 0xe190, 0xe42e, 0xe004, 0x0100, 0xceb0, 0xe004,
+	0x00ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e, 0x0000, 0xd15f,
+	0x0000, 0xe004, 0x0019, 0xae18, 0xe00a, 0x0620, 0xcec0, 0xd157,
+	0x0000, 0xd14a, 0x0000, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x102f,
+	0xca9a, 0xf7c8, 0xcaae, 0xa802, 0xf73a, 0xca9c, 0xe418, 0x102f,
+	0xa200, 0xe42e, 0xe41e, 0x0f74, 0xe41e, 0x0ed0, 0xf188, 0xe41e,
+	0x1160, 0xcaa2, 0xe008, 0x00ff, 0xf0a8, 0xe41e, 0x1198, 0xaf20,
+	0xa102, 0xf058, 0xa204, 0xe41e, 0x0f69, 0xf6de, 0xcaa2, 0xe008,
+	0x00ff, 0xe41e, 0x0eb6, 0xe41e, 0x0ed0, 0xf0fa, 0xe004, 0x01b7,
+	0xe008, 0x00ff, 0xe41e, 0x0eb6, 0xe004, 0x01b7, 0xe008, 0x00ff,
+	0xe41e, 0x0ebe, 0xa200, 0xe42e, 0xa206, 0xe41e, 0x0f69, 0xe41e,
+	0x0eba, 0xe41e, 0x0ebe, 0xca9c, 0xe418, 0x102f, 0xe41e, 0x0fd1,
+	0xe42e, 0xc001, 0xa200, 0x3c30, 0x3c31, 0x3c33, 0xe41e, 0x0fdf,
+	0xc001, 0xe41e, 0x1010, 0xc001, 0xe128, 0xc000, 0xe42e, 0xc001,
+	0x2833, 0x4411, 0xc000, 0xae0e, 0xce92, 0xd14a, 0x0000, 0xd158,
+	0x0100, 0xe004, 0x00ff, 0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e,
+	0x0000, 0xd15f, 0x0000, 0xd161, 0x0003, 0xe004, 0x0019, 0xae18,
+	0xe00a, 0x0620, 0xcec0, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x102f,
+	0xca9a, 0xf7c8, 0xca9c, 0xf7a8, 0xca9e, 0xc001, 0x3c32, 0xcc92,
+	0xca94, 0x0030, 0x0c31, 0x3430, 0x3c31, 0xcc90, 0xc000, 0xe42e,
+	0xe004, 0x1495, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000,
+	0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x007f, 0xd037, 0x0000,
+	0xd038, 0x0000, 0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000,
+	0xd046, 0x0000, 0xd047, 0x0000, 0xd149, 0x0000, 0xe42e, 0xc001,
+	0x280c, 0xf20a, 0xe41e, 0x024f, 0xc001, 0xe004, 0x0440, 0xce50,
+	0x280d, 0xa806, 0xa108, 0xe012, 0xa806, 0xae06, 0x3c40, 0xe004,
+	0x01b7, 0x5840, 0xce52, 0xe41e, 0x0257, 0xc001, 0xd14e, 0x0000,
+	0xd144, 0x0000, 0x2402, 0x4c03, 0xe000, 0x0200, 0x3402, 0x3c03,
+	0xf3ae, 0xd027, 0x0000, 0x280c, 0xe41a, 0x1098, 0xc001, 0xd027,
+	0x0001, 0x280d, 0xf25a, 0xca48, 0xa802, 0xf7e8, 0x2402, 0x4c03,
+	0xce40, 0xd121, 0x0000, 0xd122, 0x0040, 0xe0c0, 0x0043, 0xa806,
+	0xae02, 0xa032, 0xce46, 0xe190, 0xe190, 0xe190, 0xe190, 0xca48,
+	0xa802, 0xf7e8, 0xe004, 0x0200, 0x0402, 0x0c03, 0x3402, 0x3c03,
+	0x1408, 0x1c09, 0xf054, 0x2400, 0x4c01, 0x3402, 0x3c03, 0x280c,
+	0xe418, 0x10dc, 0xc001, 0xe41e, 0x1121, 0xc001, 0xd14e, 0x0000,
+	0xd144, 0x0000, 0xc000, 0xe42e, 0xe0c1, 0x0059, 0xa103, 0xa200,
+	0xb636, 0xe000, 0x001c, 0xe0c1, 0x0045, 0xe052, 0xe01a, 0xe42e,
+	0xc001, 0xa200, 0x3c0a, 0xe004, 0x0200, 0x3c0d, 0xe0c0, 0x0043,
+	0xa808, 0xf338, 0xe41e, 0x108c, 0xc001, 0x3c0c, 0x2402, 0x4c03,
+	0xe0c1, 0x0049, 0x3604, 0x3e05, 0x2604, 0x4e05, 0xe045, 0xf033,
+	0x0606, 0x0e07, 0xe003, 0x0200, 0x280c, 0xb602, 0x3c0c, 0xf1d3,
+	0xe001, 0x0200, 0x3e0d, 0x280c, 0xf188, 0x280a, 0xe408, 0x10a2,
+	0xe41e, 0x01db, 0xc001, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xe40a,
+	0x10a2, 0xe0c0, 0x005d, 0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202,
+	0xce00, 0x3c0a, 0xe40e, 0x10a2, 0x280d, 0x2a0c, 0xf039, 0xe004,
+	0x0200, 0x3c0d, 0xc000, 0xe42e, 0xc001, 0xe41e, 0x024f, 0xc001,
+	0x280d, 0xe002, 0x0200, 0xe40a, 0x111e, 0x280d, 0xa806, 0xf1fa,
+	0xa108, 0xe012, 0xae06, 0x3c40, 0x280d, 0xaf04, 0xae20, 0xe000,
+	0x01c0, 0xce50, 0xe190, 0xca52, 0x5c40, 0x5840, 0x2a0d, 0xa807,
+	0xae07, 0x3e40, 0xe005, 0x01b7, 0x5e40, 0xe056, 0x2a0d, 0xaf05,
+	0xae21, 0xe001, 0x0140, 0xce51, 0xe190, 0xce52, 0xe004, 0x01fc,
+	0x180d, 0xf022, 0xf14e, 0xc001, 0x280d, 0xa006, 0xaf04, 0xae20,
+	0xe000, 0x0440, 0xce50, 0x280d, 0xa806, 0xa108, 0xe012, 0xa806,
+	0xae06, 0x3c40, 0xe004, 0x01b7, 0x5840, 0xce52, 0xc000, 0xe40e,
+	0x0257, 0xc001, 0xcaaa, 0x2a1a, 0xb616, 0xe0c1, 0x0048, 0x360e,
+	0x3e0f, 0x260e, 0x4e0f, 0xe042, 0xe049, 0x1608, 0x1e09, 0xf035,
+	0x1406, 0x1c07, 0xe0c2, 0x0048, 0xa200, 0xceaa, 0xc000, 0xe42e,
+	0xe41e, 0x1121, 0xe0c0, 0x0045, 0xaf04, 0xa806, 0xa104, 0xe428,
+	0xa2fc, 0x2aa1, 0xa003, 0xb616, 0xe418, 0x1147, 0xe42e, 0xc001,
+	0x3c40, 0xe0c0, 0x0048, 0x340e, 0x3c0f, 0x240e, 0x4c0f, 0x0840,
+	0xe049, 0x1600, 0x1e01, 0xf033, 0x0406, 0x0c07, 0xe049, 0x1608,
+	0x1e09, 0xf035, 0x1406, 0x1c07, 0xe0c2, 0x0048, 0xc000, 0xe42e,
+	0xe41e, 0x1121, 0xc001, 0xe0c0, 0x0048, 0x3417, 0x3c18, 0xc000,
+	0xe42e, 0xa200, 0xceaa, 0xc001, 0x2417, 0x4c18, 0xc000, 0xe0c2,
+	0x0048, 0xe42e, 0xe41e, 0x0f74, 0xe41e, 0x0ed0, 0xf118, 0xcaa2,
+	0xe008, 0x00ff, 0xf0a8, 0xe41e, 0x1198, 0xaf20, 0xa102, 0xf058,
+	0xa204, 0xe41e, 0x0f69, 0xf6fe, 0xe41e, 0x0ed0, 0xf0aa, 0xe004,
+	0x01b7, 0xe008, 0x00ff, 0xe41e, 0x0eb6, 0xe004, 0x01b7, 0xf02e,
+	0xcaa2, 0xe008, 0x00ff, 0xe41e, 0x0ebe, 0xe41e, 0x0ec2, 0xe42e,
+	0xe162, 0x0190, 0xca80, 0x3512, 0x3d12, 0xca82, 0x3512, 0x3d12,
+	0xca84, 0x3512, 0x3d12, 0xca86, 0x3512, 0x3d12, 0xca8b, 0xa208,
+	0xca8b, 0xa003, 0xaf03, 0xe046, 0xe000, 0x0192, 0xe094, 0xca8a,
+	0xa802, 0xf048, 0x2512, 0x4d12, 0xe42e, 0x2d12, 0xe008, 0x00ff,
+	0xae20, 0x4d12, 0xae10, 0x2712, 0x4f12, 0xaf31, 0xe009, 0x00ff,
+	0xe056, 0xe42e, 0xc001, 0x2832, 0xf068, 0xba2c, 0xf158, 0xa202,
+	0x3c32, 0xf0fe, 0x2430, 0x4c31, 0xae06, 0xc873, 0xe046, 0xf096,
+	0xa12e, 0xb600, 0xa02e, 0x3c32, 0x7832, 0xa203, 0x3e32, 0xf048,
+	0xa202, 0xc000, 0xe42e, 0xa200, 0xc000, 0xe42e, 0xc001, 0xa200,
+	0x3c10, 0x2832, 0xf098, 0xa202, 0x3c33, 0x3c10, 0x3c11, 0xd036,
+	0x00ff, 0xd037, 0x0080, 0xc000, 0xe42e, 0xc001, 0xcb20, 0xa80c,
+	0xf7e8, 0x2832, 0xf1b8, 0x2833, 0xf078, 0xe41e, 0x0fdf, 0xc001,
+	0xd04c, 0x0000, 0xf13e, 0xc896, 0xf05a, 0xe41e, 0x1211, 0xd04c,
+	0x0000, 0xe41e, 0x0efe, 0xe005, 0x0080, 0xb615, 0xcc6f, 0xd04b,
+	0x0001, 0xa202, 0xe41e, 0x1227, 0xe470, 0xd04c, 0x0000, 0xc000,
+	0xe470, 0xa200, 0xe41e, 0x1227, 0xe41e, 0x0fdf, 0xe41e, 0x1223,
+	0xcc96, 0xe41e, 0x0efe, 0xe016, 0xe41e, 0x0efa, 0xe42e, 0xc001,
+	0x3c32, 0xc000, 0xe42e, 0xc001, 0x2832, 0xc000, 0xe42e, 0xc001,
+	0x3c10, 0xc000, 0xe42e, 0xc001, 0x2810, 0xc000, 0xe42e, 0xe180,
+	0xe41e, 0x122b, 0xe418, 0x1211, 0xe181, 0xe42e, 0x2825, 0xe016,
+	0xae08, 0xa904, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x013d, 0xa200,
+	0xe0c2, 0x0128, 0x2ac1, 0x4ec2, 0xb692, 0xae08, 0xa90c, 0xe0c2,
+	0x017c, 0xa208, 0xe0c2, 0x017d, 0xa200, 0xe41e, 0x1415, 0xe0c2,
+	0x0102, 0xe42e, 0xa200, 0xe0c2, 0x0320, 0xcc8e, 0x283b, 0xe408,
+	0x12fb, 0xe41e, 0x1236, 0xe0c0, 0x0050, 0xe049, 0xe008, 0x007f,
+	0x3c08, 0xaf11, 0xe009, 0x007f, 0x3e10, 0x4608, 0x3e08, 0xa200,
+	0x2a08, 0xa809, 0xf03b, 0xe00a, 0x0020, 0x2a08, 0xa811, 0xf03b,
+	0xe00a, 0x0040, 0xe0c2, 0x040c, 0x2855, 0xae20, 0x4c56, 0xae08,
+	0xe0c2, 0x0101, 0xe0c2, 0x0205, 0xcf60, 0xa200, 0xe0c2, 0x0103,
+	0xe0c2, 0x0113, 0xe0c2, 0x0120, 0xe0c2, 0x0121, 0xe0c2, 0x0122,
+	0xe0c2, 0x0123, 0xe0c2, 0x0303, 0xa27e, 0xe0c2, 0x012a, 0x2827,
+	0xe0c2, 0x013d, 0xe418, 0x13e5, 0x2814, 0xf104, 0xa204, 0xe0c2,
+	0x0208, 0xe0c2, 0x0210, 0xa200, 0xe41e, 0x1415, 0xe0c2, 0x0213,
+	0xe0c2, 0x0215, 0x2814, 0xe0c2, 0x020b, 0xa202, 0xe0c2, 0x0302,
+	0xa20e, 0xe0c2, 0x0312, 0xe0c0, 0x0414, 0xe418, 0x018c, 0xe0c0,
+	0x0414, 0xe41a, 0x1350, 0x2812, 0xf052, 0x2813, 0xf032, 0x28a1,
+	0xb608, 0xe0c2, 0x0380, 0x2813, 0xf042, 0x2812, 0x28a1, 0xb608,
+	0xe0c2, 0x0383, 0xa200, 0xe0c2, 0x0302, 0x2809, 0xf35a, 0xe0c1,
+	0x0046, 0xe004, 0x0000, 0xae10, 0xe042, 0x2a10, 0xa809, 0xf05b,
+	0xe167, 0x02d4, 0x2117, 0x4d17, 0xe0c2, 0x0211, 0xe0c1, 0x0046,
+	0xe004, 0x0080, 0xae10, 0xe042, 0x2a10, 0xa811, 0xf05b, 0xe167,
+	0x02d6, 0x2117, 0x4d17, 0xe0c2, 0x0212, 0xa200, 0xe0c2, 0x0215,
+	0xe41e, 0x1415, 0xe00a, 0x0100, 0xe0c2, 0x0213, 0x2811, 0xe0c2,
+	0x0214, 0xa202, 0xe0c2, 0x0210, 0xa200, 0xcf68, 0x2842, 0xf04a,
+	0xa200, 0xe0c2, 0x0208, 0x2834, 0xa104, 0xb5a0, 0xb434, 0xa004,
+	0xa960, 0xae04, 0x4c32, 0xae02, 0x4c33, 0xe0c2, 0x0204, 0x2849,
+	0xae02, 0x4c40, 0xae02, 0x4c41, 0xae02, 0x4c3b, 0xae02, 0x4c39,
+	0xae02, 0x4c7e, 0xae02, 0x4c7d, 0xae02, 0x4c38, 0xae04, 0x4c30,
+	0xae02, 0x4c3c, 0xae04, 0x4c3d, 0xae04, 0x2a34, 0xa003, 0xa807,
+	0xe056, 0xae02, 0x4c37, 0xae02, 0x2a25, 0xe017, 0xe056, 0xcf06,
+	0xe162, 0x0400, 0xd022, 0x0003, 0xe184, 0x132f, 0xae08, 0x4d12,
+	0xcf28, 0xa202, 0xae02, 0x4c35, 0xae0a, 0x4c32, 0xae02, 0x4c33,
+	0xe0c2, 0x0104, 0xe41e, 0x0274, 0xa202, 0xe0c2, 0x0106, 0xa200,
+	0xe0c2, 0x0103, 0xe0c2, 0x0113, 0xe0c2, 0x0120, 0xe0c2, 0x0121,
+	0xe0c2, 0x0122, 0xe0c2, 0x0123, 0xe0c2, 0x0303, 0xa202, 0xe42e,
+	0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17, 0xe009,
+	0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101, 0xe0c3,
+	0x015d, 0x2834, 0xa106, 0xe005, 0x001b, 0xf038, 0xe005, 0x001f,
+	0x3e50, 0x2812, 0xb608, 0x2a13, 0xb60b, 0xae11, 0xe055, 0xae21,
+	0xe167, 0x01a2, 0x2907, 0xaf10, 0x4450, 0xe055, 0xe0c3, 0x015c,
+	0xa202, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xa200, 0xe0c2,
+	0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xe42e, 0x2a2b, 0x2842, 0xb435,
+	0x3e2b, 0xa107, 0xf039, 0xa204, 0x3c2b, 0xe0c0, 0x0065, 0xaf0a,
+	0xa802, 0xf13a, 0xe162, 0x04c8, 0x2ce4, 0x3d12, 0x2ce5, 0x3d12,
+	0xe0c0, 0x006b, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x04c8, 0xd112,
+	0x0004, 0xd113, 0x0000, 0xe1e1, 0xe0c0, 0x0065, 0xe008, 0x0100,
+	0xf0ea, 0xca28, 0xf7f8, 0xe0c0, 0x006a, 0xce20, 0xd112, 0x0004,
+	0xd111, 0x04c0, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xa200, 0x3ce5,
+	0x3ce4, 0x3cd8, 0x3ce7, 0x3ce8, 0xe42e, 0x2809, 0xe40a, 0x13cc,
+	0x2864, 0xae06, 0xcb23, 0xa80f, 0xe055, 0xcf23, 0xd1b6, 0x0001,
+	0xd1b5, 0x0001, 0xcb6a, 0xf7f8, 0x2865, 0xae08, 0x4c60, 0xe0c2,
+	0x0114, 0x2836, 0xae0a, 0x4c64, 0xe0c2, 0x0115, 0xe0c0, 0x012a,
+	0xe0c2, 0x0116, 0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2, 0x0110,
+	0x28c1, 0x4cc2, 0xe418, 0x14fb, 0xe42e, 0xa802, 0xf14a, 0xe0c2,
+	0x013c, 0xa200, 0x3c7c, 0xe161, 0x0420, 0xd022, 0x003f, 0xe184,
+	0x13f8, 0x287c, 0xe0c2, 0x013e, 0xa002, 0x3c7c, 0x2911, 0xe0c2,
+	0x013f, 0xe190, 0x2827, 0xaf02, 0xf15a, 0xe0c2, 0x013c, 0xe004,
+	0x0040, 0x3c7c, 0xe162, 0x0460, 0xd022, 0x003f, 0xe184, 0x140f,
+	0x287c, 0xe0c2, 0x013e, 0xa002, 0x3c7c, 0x2912, 0xe0c2, 0x013f,
+	0xe190, 0xa200, 0xe0c2, 0x013c, 0xe42e, 0xe0c1, 0x0044, 0xa80f,
+	0xe056, 0xe42e, 0xa200, 0xe41e, 0x1415, 0xe42e, 0xe0c1, 0x0044,
+	0xaf0d, 0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044,
+	0xaf17, 0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105,
+	0xf039, 0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d,
+	0xe0c1, 0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0200,
+	0xe167, 0x0500, 0x28a8, 0xf166, 0xa102, 0xcc44, 0xe184, 0x1458,
+	0xa200, 0xe41e, 0x1415, 0xaf04, 0xe41e, 0x141e, 0xae20, 0x2ea9,
+	0xe056, 0x9f17, 0x2055, 0x4c56, 0xae08, 0x9f17, 0xe41e, 0x145e,
+	0xe190, 0xe190, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2116, 0x4d16,
+	0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0xe42e,
+	0xe0c0, 0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa860,
+	0xe42a, 0xe0c0, 0x0061, 0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4,
+	0xc785, 0xe018, 0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803,
+	0xf7db, 0xa200, 0xe41e, 0x141a, 0xa80e, 0xaf04, 0xe41e, 0x141e,
+	0xe41e, 0x1426, 0xe40b, 0x1491, 0xa81e, 0xe41e, 0x142b, 0xae09,
+	0xe056, 0xae20, 0xe0c1, 0x006e, 0xe009, 0x1fff, 0xe056, 0x9f17,
+	0xe0c0, 0x0060, 0xa822, 0xa122, 0xf04a, 0x2055, 0x4c56, 0xf03e,
+	0x2056, 0x4c55, 0xae08, 0x9f17, 0xe0c0, 0x0062, 0x9f17, 0xe0c0,
+	0x0063, 0x9f17, 0xe0c0, 0x0064, 0x9f17, 0xa201, 0xe0c3, 0x040d,
+	0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11, 0xe042,
+	0xce20, 0xd111, 0x0200, 0xd112, 0x00c0, 0x88ec, 0x0113, 0xca29,
+	0xf7f9, 0xe190, 0xe42e, 0xa2fe, 0x3cc3, 0xa200, 0x3cc1, 0x3cc2,
+	0xe42e, 0x28b4, 0x3cc3, 0x28c3, 0xf042, 0xa200, 0x3cc1, 0x3cc2,
+	0xa200, 0x3cc8, 0x3cc9, 0x2855, 0x3cc6, 0x2856, 0x3cc7, 0x28c1,
+	0x4cc2, 0xe42a, 0x28c3, 0xe424, 0x28c3, 0xe0c2, 0x0143, 0x28c4,
+	0xe0c2, 0x0144, 0xa200, 0xe0c2, 0x017f, 0xe0c2, 0x0149, 0xe41e,
+	0x1415, 0xe0c2, 0x017f, 0x28c6, 0xa102, 0xae20, 0x4cc7, 0xa102,
+	0xe0c2, 0x0142, 0xa200, 0xae20, 0x2ac2, 0xae09, 0x4ec0, 0xe042,
+	0xe0c2, 0x014e, 0xe42e, 0x28c3, 0xe41e, 0x153c, 0x3cc5, 0x2ac9,
+	0x1ac7, 0xe423, 0x28c8, 0xae0e, 0x4cc9, 0xa203, 0xb615, 0x3eca,
+	0x2ac5, 0xae03, 0x4eca, 0xae03, 0xa903, 0xae1d, 0xe056, 0xe0c1,
+	0x014b, 0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0x2ac8,
+	0xa003, 0x3ec8, 0x1ac6, 0xf065, 0x2ac9, 0xa003, 0x3ec9, 0xa201,
+	0x3ec8, 0xe42e, 0x28c1, 0x4cc2, 0xf15a, 0x28c9, 0x18c7, 0xf042,
+	0xe41e, 0x14fb, 0xf7be, 0xe0c0, 0x014b, 0xf7e8, 0xa204, 0xae1c,
+	0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0xe190, 0xe0c0, 0x014b,
+	0xf7e8, 0x28a2, 0x3cc3, 0xe42e, 0xe424, 0xe000, 0x0330, 0xe09c,
+	0x2906, 0xe42e, 0xe424, 0xe000, 0x0330, 0xe09c, 0x3f06, 0xe42e,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0080, 0x0060, 0x0008, 0x0006,
+	0x00b0, 0x0090, 0x000b, 0x0009, 0x0160, 0x0120, 0x0016, 0x0012,
+	0x02c0, 0x0240, 0x0058, 0x0012, 0x0580, 0x0480, 0x0160, 0x0012,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0063, 0x000d, 0x000f, 0x0011, 0x0013, 0x0015, 0x0017, 0x0000,
+	0xffff, 0xfffe, 0x0001, 0x0002, 0x0000, 0x0002, 0xffff, 0xffff,
+	0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xfffe,
+	0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe,
+	0xfffe, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd,
+	0xfffd, 0xfffd, 0xfffd, 0xfffd, 0x0000, 0x0001, 0x0001, 0x0001,
+	0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0002,
+	0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002,
+	0x0002, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003,
+	0x0003, 0x0002, 0x0001, 0xfffb, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c52, 0xf0b4, 0xe04a, 0xaf10,
+	0x1850, 0xf074, 0xe009, 0x00ff, 0x1a51, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x1343, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x0368, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0491, 0xe40e, 0x00a4,
+	0xe41e, 0x04e1, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x04e2,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x06e2, 0xe40e, 0x00a4,
+	0xe41e, 0x0705, 0xe40e, 0x00a4, 0xe0c1, 0x0044, 0xa80f, 0xe056,
+	0xe42e, 0xa200, 0xe41e, 0x036c, 0xe42e, 0xe0c1, 0x0044, 0xaf0d,
+	0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039,
+	0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0500, 0xe167,
+	0x0500, 0x284d, 0xf1b6, 0xa102, 0xcc44, 0xe184, 0x03b4, 0xa200,
+	0xe41e, 0x036c, 0xaf04, 0xe41e, 0x0375, 0xae20, 0x2e62, 0xe056,
+	0x9f17, 0x2ad3, 0xf04b, 0x2009, 0x4c0a, 0xf04e, 0x2050, 0x4c51,
+	0xae08, 0x9f17, 0xe41e, 0x03ba, 0xe190, 0xe190, 0xa201, 0xe0c3,
+	0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0, 0x0044, 0xaf20, 0xa802,
+	0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a, 0xe0c0, 0x0061, 0xa83e,
+	0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500,
+	0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x0371,
+	0xa80e, 0xaf04, 0xe41e, 0x0375, 0xe41e, 0x037d, 0xe40b, 0x03ed,
+	0xa81e, 0xe41e, 0x0382, 0xae09, 0xe056, 0xae20, 0xe0c1, 0x006e,
+	0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0060, 0xa822, 0xa122,
+	0xf04a, 0x2050, 0x4c51, 0xf03e, 0x2051, 0x4c50, 0xae08, 0x9f17,
+	0xe0c0, 0x0062, 0x9f17, 0xe0c0, 0x0063, 0x9f17, 0xe0c0, 0x0064,
+	0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x3cec, 0xe0c0, 0x0041,
+	0xe005, 0x0020, 0xae11, 0xe042, 0xce20, 0xd111, 0x0500, 0xd112,
+	0x00c0, 0x88ec, 0x0113, 0xca29, 0xf7f9, 0xe190, 0xe42e, 0xe0c0,
+	0x0067, 0x30d1, 0xaf02, 0x30d2, 0xaf02, 0x30d3, 0xaf02, 0x30c0,
+	0xe0c0, 0x0062, 0x3063, 0xaf10, 0x3010, 0xe42e, 0x2009, 0x4c0a,
+	0xe0c2, 0x0071, 0x2821, 0xe0c2, 0x007a, 0x2c20, 0xe0c2, 0x0079,
+	0x2a39, 0xae0f, 0x28c2, 0xa80e, 0xae02, 0x4c35, 0xae02, 0x4c30,
+	0xae02, 0x4c23, 0xae02, 0x4c22, 0xe056, 0xe0c2, 0x0075, 0x28ad,
+	0x2ae0, 0xae02, 0xe01b, 0xe056, 0xae0e, 0xf09b, 0x2ae0, 0xa81f,
+	0xe056, 0xae10, 0x2ae0, 0xaf09, 0xe056, 0xf03e, 0xae10, 0x4ce1,
+	0xe0c2, 0x007b, 0x2a7a, 0xb60b, 0xae09, 0x28e2, 0xe056, 0xe0c2,
+	0x0072, 0xa208, 0x0863, 0xe0c2, 0x0073, 0x2819, 0xe0c2, 0x0074,
+	0x281f, 0xe0c2, 0x0070, 0x281f, 0xe016, 0x58f0, 0xe0c2, 0x0078,
+	0xe42e, 0xe0c0, 0x0045, 0xaf08, 0x3091, 0xe0c0, 0x0060, 0xe049,
+	0xa81f, 0x3e76, 0xaf08, 0x3075, 0xaf02, 0x3071, 0xe0c0, 0x0065,
+	0xaf04, 0x301e, 0xaf02, 0xa806, 0x3c1d, 0xa200, 0x3ce3, 0xe0c0,
+	0x006c, 0xe002, 0x0088, 0x3cda, 0xe0c0, 0x0065, 0xaf0a, 0x30e3,
+	0xe42e, 0xa200, 0xcc4a, 0xcc4c, 0xd130, 0x0003, 0xd03a, 0x0003,
+	0xd008, 0x0000, 0xa200, 0xe0c2, 0x0128, 0xe41e, 0x0148, 0xe41e,
+	0x023a, 0xe41e, 0x04cc, 0xe41e, 0x0720, 0xe41e, 0x128c, 0xa200,
+	0x3c1f, 0xe41e, 0x041f, 0xa204, 0x3cdd, 0xe41e, 0x12f2, 0xe41e,
+	0x07d3, 0xf15d, 0x2830, 0xf04a, 0xe41e, 0x13cc, 0xe128, 0x2810,
+	0xf038, 0x280f, 0x3c15, 0x2863, 0x2a35, 0xb612, 0x3c63, 0xe41e,
+	0x0728, 0xf05a, 0xa202, 0x3c1f, 0xa202, 0x3c19, 0xe41e, 0x146e,
+	0xe41e, 0x042e, 0xe16a, 0xe42e, 0xe0c0, 0x0040, 0xa259, 0xae17,
+	0xe042, 0xe005, 0x1e00, 0xae03, 0xe042, 0xca29, 0xf7f9, 0xce20,
+	0xd111, 0x0200, 0xd112, 0x0100, 0xd113, 0x0003, 0xca28, 0xf7f8,
+	0xe42e, 0xe42e, 0xa200, 0xcc4a, 0xcc4c, 0xd130, 0x0003, 0xd03a,
+	0x0003, 0xd008, 0x0000, 0xe41e, 0x06da, 0xe41e, 0x0471, 0xe41e,
+	0x07be, 0xe41e, 0x1305, 0xa2fc, 0x3c1b, 0xa2fa, 0x3c1c, 0xa200,
+	0x3c1f, 0xa206, 0xe41e, 0x040d, 0xe41e, 0x038c, 0xe41e, 0x03c4,
+	0xe41e, 0x025f, 0xe41e, 0x1433, 0xf0b8, 0x2830, 0xe418, 0x067b,
+	0x2830, 0xe41a, 0x068a, 0xe41e, 0x1433, 0xe40a, 0x0544, 0xa202,
+	0x3c1f, 0xe0c0, 0x0045, 0xaf04, 0xa802, 0xe40a, 0x062c, 0x2819,
+	0xf1a6, 0x2819, 0xa102, 0x3c19, 0x28a4, 0xf0a4, 0xe41e, 0x12a6,
+	0x3c72, 0xe41e, 0x12b4, 0xe41e, 0x11ff, 0xe419, 0x11c2, 0x2a63,
+	0x28a1, 0xf02b, 0x28a3, 0x3c1c, 0x3ca4, 0xa2fe, 0x3ca1, 0x3ca3,
+	0xe40e, 0x062c, 0x2819, 0xf0a4, 0x28a1, 0x2a63, 0xf02b, 0x28a3,
+	0x3ca3, 0xe0c0, 0x0060, 0xaf08, 0xf5d8, 0xa2fe, 0x3ca1, 0x3c1c,
+	0xa2fc, 0x3c1b, 0xe40e, 0x062c, 0x2815, 0xf1ca, 0x2817, 0xa108,
+	0xf198, 0x28a4, 0xf064, 0xe41e, 0x12a6, 0x3c72, 0xe41e, 0x12b4,
+	0xe41e, 0x11ff, 0xe419, 0x11c2, 0x28a2, 0x2a63, 0xf02b, 0x28a6,
+	0x3ca5, 0x3c1c, 0x3ca4, 0xa200, 0x3c17, 0xa202, 0x3c74, 0xe40e,
+	0x062c, 0xa2fe, 0x3c1b, 0xa202, 0x3c1f, 0xe41e, 0x07af, 0xe40a,
+	0x062c, 0xa200, 0x3c1a, 0xa2fc, 0x3c1b, 0xa202, 0x3c1f, 0x2830,
+	0xe418, 0x0869, 0xe404, 0x050f, 0x2830, 0xe41a, 0x0819, 0xe404,
+	0x050f, 0x281f, 0xb61a, 0x3c1f, 0xe40d, 0x062c, 0x281e, 0xf0ea,
+	0x2824, 0xf0aa, 0x2891, 0xf05a, 0xa202, 0x3c1f, 0xe40e, 0x062c,
+	0xe41e, 0x067b, 0xf63e, 0xe40e, 0x05a8, 0x281d, 0xf1aa, 0xa102,
+	0xf04a, 0xa102, 0xf05a, 0xf0be, 0x2824, 0xf13a, 0xf08e, 0x2824,
+	0xa104, 0xf0f8, 0x2815, 0xf03a, 0xa204, 0x3c17, 0xe41e, 0x067b,
+	0xa200, 0x3c46, 0xa2fc, 0x3ca5, 0x3c1c, 0x3ca4, 0xe40e, 0x062c,
+	0x2815, 0xf19a, 0x282d, 0xf178, 0x28a4, 0xf064, 0xe41e, 0x12a6,
+	0x3c72, 0xe41e, 0x12b4, 0xe41e, 0x11ff, 0xe419, 0x11c2, 0xa2fa,
+	0x3c1c, 0xa2fc, 0x3c1b, 0x3ca4, 0xa206, 0x3c17, 0xa202, 0x3c74,
+	0xe40e, 0x062c, 0xe41e, 0x0e41, 0x286d, 0xe016, 0x4466, 0xf0ba,
+	0x28a5, 0xe000, 0x0312, 0xe092, 0xa201, 0x3f01, 0xa200, 0x3c1f,
+	0xe40e, 0x062c, 0x282d, 0x2a3f, 0xe017, 0x3e00, 0x2ac2, 0xa103,
+	0xe017, 0x4e00, 0xe052, 0xf1c8, 0xe162, 0x0300, 0xa200, 0xc711,
+	0x3d12, 0x3c44, 0x3c3e, 0x3c0d, 0x3c0c, 0x3cb5, 0x3cb6, 0x3c6c,
+	0x3c0b, 0x2852, 0x3c43, 0xa202, 0x3c42, 0xe004, 0x1000, 0xcf02,
+	0xd1b3, 0x0001, 0xe41e, 0x15dd, 0xa200, 0x3c46, 0xf1ce, 0xe41e,
+	0x020f, 0xa203, 0xb609, 0x3e1f, 0xe404, 0x062c, 0x2836, 0xe016,
+	0x4430, 0xf0a8, 0xe41e, 0x14c6, 0xa203, 0xb615, 0x3e1f, 0xe40a,
+	0x062c, 0xe40e, 0x0612, 0xe41e, 0x152a, 0xa203, 0xb615, 0x3e1f,
+	0xe40a, 0x062c, 0xe41e, 0x1049, 0x2891, 0xf0fa, 0x2815, 0xf0da,
+	0x2824, 0xa102, 0xf0a8, 0xe41e, 0x142e, 0xba3e, 0xe002, 0x01b6,
+	0xf048, 0xa202, 0x3c1a, 0x3c1f, 0x244a, 0x4c4b, 0xf068, 0xa2fe,
+	0x3ca5, 0x3ca4, 0xa2fa, 0x3c1c, 0x281b, 0xe0c2, 0x0077, 0x281c,
+	0xe0c2, 0x0071, 0xa202, 0x2a1b, 0xb60a, 0x044a, 0x0c4b, 0x344a,
+	0x3c4b, 0xe0c2, 0x0070, 0x2846, 0xe0c2, 0x0072, 0x2409, 0x4c0a,
+	0xe0c2, 0x006f, 0x282d, 0xf058, 0x2815, 0xf03a, 0xa208, 0x3c24,
+	0x28ae, 0xae2a, 0x4c24, 0x2aad, 0xae25, 0xe056, 0x2a2d, 0xae0d,
+	0xe056, 0xe0c2, 0x0073, 0x2a7a, 0xb60b, 0xae09, 0x28e2, 0xe056,
+	0xe0c2, 0x007c, 0x2821, 0xe0c2, 0x007e, 0x2c20, 0xe0c2, 0x007d,
+	0xe41e, 0x0798, 0x281a, 0xae20, 0x4c1f, 0xe0c2, 0x0076, 0xe0c0,
+	0x0076, 0x2add, 0xae23, 0xe056, 0xe0c2, 0x0076, 0xc84a, 0xc84d,
+	0xae20, 0xe056, 0xe0c2, 0x0053, 0xa200, 0xe0c2, 0x0074, 0xe41e,
+	0x146e, 0xe16a, 0xe42e, 0xa200, 0x2a30, 0xf05b, 0x282e, 0xe01a,
+	0xae0c, 0xa920, 0xcf00, 0xd199, 0x0000, 0xd190, 0x0004, 0xcb20,
+	0xf7f8, 0xe42e, 0xa200, 0x3cae, 0xd199, 0x0000, 0xd180, 0x0000,
+	0xd190, 0x0004, 0xcb20, 0xf7f8, 0xe41e, 0x1433, 0xb7f0, 0xe428,
+	0xba3e, 0xe002, 0x0100, 0xe404, 0x06d6, 0xa13e, 0xf030, 0xe40e,
+	0x06d6, 0xa102, 0xe404, 0x06d6, 0xe002, 0x000f, 0xf060, 0xba7e,
+	0xe41e, 0x0933, 0xe40e, 0x0690, 0xe002, 0x0081, 0xf068, 0xba7e,
+	0xe41e, 0x090b, 0xe40e, 0x0690, 0xa104, 0xf068, 0xba7e, 0xe41e,
+	0x0c1e, 0xe40e, 0x0690, 0xa102, 0xf068, 0xba7e, 0xe41e, 0x0a21,
+	0xe40e, 0x0690, 0xa104, 0xf068, 0xba7e, 0xe41e, 0x0912, 0xe40e,
+	0x0690, 0xa102, 0xf028, 0xe42e, 0xba7e, 0x2a74, 0xe40b, 0x0690,
+	0xa11a, 0xe408, 0x0690, 0xba7e, 0xe40e, 0x0690, 0xba7e, 0xe40e,
+	0x0690, 0xe42e, 0xa200, 0x3ce9, 0x3ce5, 0x3cd6, 0x3c3f, 0x3c46,
+	0x3cbe, 0xe42e, 0xe41e, 0x10af, 0xe41e, 0x0174, 0xca28, 0xf7f8,
+	0xe0c0, 0x0042, 0xce20, 0xd111, 0x0500, 0xd112, 0x00c4, 0xd113,
+	0x0003, 0xca29, 0xf7f9, 0xa204, 0xe41e, 0x040d, 0xe0c0, 0x0060,
+	0x3c4d, 0xe0c0, 0x0061, 0x3c62, 0xe0c0, 0x006e, 0xe41e, 0x020a,
+	0xe41e, 0x0743, 0xe41e, 0x038c, 0xe42e, 0xe41e, 0x0743, 0xe41e,
+	0x128c, 0xa202, 0x3c19, 0xe167, 0x0312, 0xe166, 0x0054, 0xa200,
+	0x3c06, 0x284d, 0xa102, 0xcc44, 0xe184, 0x071d, 0x9e06, 0x5c06,
+	0xa802, 0xb690, 0x3d17, 0x2806, 0xa002, 0x3c06, 0xe190, 0xe42e,
+	0xa2fe, 0x3c21, 0x3c7a, 0xe0c2, 0x0079, 0xe0c2, 0x007a, 0xe42e,
+	0xa23c, 0x3cf0, 0x2850, 0xf166, 0xe002, 0x0078, 0xf130, 0x2851,
+	0xf116, 0xe002, 0x0078, 0xf0e0, 0x2852, 0xe002, 0x1fe0, 0xf0a0,
+	0xe0c0, 0x0059, 0xa106, 0xf048, 0xe41e, 0x1433, 0xf038, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xa200, 0x3c4a, 0x3c4b, 0x3c72, 0x3c73,
+	0xa2fe, 0x3ca2, 0x3ca3, 0x3ca4, 0x3ca5, 0x3ca0, 0x3ca1, 0xa200,
+	0x3c6d, 0x3ca7, 0x3c74, 0xe161, 0x0312, 0x2a4d, 0xa103, 0x3e00,
+	0x8600, 0x3d11, 0xe42e, 0x28a7, 0x3c06, 0x2806, 0xe000, 0x0312,
+	0xe092, 0x2901, 0xf0da, 0x2806, 0xa002, 0x3c06, 0x184d, 0xf038,
+	0xa200, 0x3c06, 0x2806, 0x18a7, 0xf718, 0xa2fe, 0xe42e, 0xa208,
+	0xb652, 0x3d01, 0x2806, 0xa002, 0x3ca7, 0x184d, 0xf038, 0xa200,
+	0x3ca7, 0x2806, 0xe42e, 0xe424, 0xe000, 0x0312, 0xe092, 0xa200,
+	0x3d01, 0xe42e, 0xe000, 0x0312, 0xe092, 0x2901, 0xe056, 0x3d01,
+	0xe42e, 0xe000, 0x0312, 0xe092, 0x2901, 0xa806, 0x3d01, 0xe42e,
+	0xe424, 0xe000, 0x0312, 0xe092, 0x2901, 0xa80a, 0x3d01, 0xe42e,
+	0xe004, 0x0312, 0xe09e, 0xe004, 0x0054, 0xe09c, 0x284d, 0xa102,
+	0xcc44, 0xa200, 0x3c06, 0xe184, 0x07ac, 0x2b17, 0xaf05, 0xa803,
+	0x5a06, 0xe056, 0x2a06, 0xa003, 0x3e06, 0x9f06, 0xe42e, 0xe161,
+	0x0312, 0x284d, 0xa102, 0xcc44, 0xa200, 0xe184, 0x07ba, 0x2b11,
+	0xa80d, 0xe01b, 0xe042, 0x184d, 0xe01a, 0xe42e, 0xa200, 0x3c06,
+	0xe004, 0x0054, 0xe09c, 0x284d, 0xa102, 0xcc44, 0xe184, 0x07d1,
+	0x9e06, 0x5c06, 0xa802, 0xf048, 0x2806, 0xe412, 0x0789, 0x2a06,
+	0xa003, 0x3e06, 0xe42e, 0xa23e, 0x3cf0, 0xd130, 0x0003, 0xd199,
+	0x0004, 0xd190, 0x0004, 0xe41e, 0x1433, 0xa908, 0xcf32, 0xcb20,
+	0xf7b8, 0xe41e, 0x1433, 0xf348, 0xcb32, 0xaf08, 0xa102, 0xf1da,
+	0xa102, 0xf27a, 0xba3e, 0xe002, 0x01b0, 0xf058, 0xba7e, 0xe41e,
+	0x090b, 0xf68e, 0xba7e, 0xe002, 0x012f, 0xf640, 0xe000, 0x000f,
+	0xf614, 0xe41e, 0x0933, 0xf1cd, 0xa200, 0x3c30, 0x3c34, 0x3c35,
+	0x3c36, 0x3c37, 0x3c2e, 0xe42e, 0xe0c0, 0x0067, 0xaf10, 0xa802,
+	0xf088, 0xba6a, 0xe41e, 0x0af8, 0xf0bd, 0xa202, 0x3c30, 0xe42e,
+	0xba60, 0xe41e, 0x0d7f, 0xf46a, 0xa202, 0x3c30, 0xe42e, 0xe16b,
+	0xe42e, 0xa200, 0x3cae, 0xd199, 0x0000, 0xd180, 0x0000, 0xd190,
+	0x0004, 0xcb20, 0xf7f8, 0xe41e, 0x1433, 0xb7f0, 0xe428, 0xe41e,
+	0x149a, 0xba7e, 0xe002, 0x0100, 0xf394, 0xa13e, 0xf030, 0xe40e,
+	0x081f, 0xa102, 0xf334, 0xe002, 0x000f, 0xf060, 0xe41e, 0x0933,
+	0xf2dd, 0xe40e, 0x081f, 0xe002, 0x0081, 0xf058, 0xe41e, 0x090b,
+	0xe40e, 0x081f, 0xa104, 0xf058, 0xe41e, 0x0c1e, 0xe40e, 0x081f,
+	0xa102, 0xf058, 0xe41e, 0x0a21, 0xe40e, 0x081f, 0xa104, 0xf058,
+	0xe41e, 0x0912, 0xe40e, 0x081f, 0xa102, 0xf078, 0xe41e, 0x0e33,
+	0xe41e, 0x0a2c, 0xf0ba, 0xe42e, 0x2a74, 0xe40b, 0x081f, 0xa11a,
+	0xe408, 0x081f, 0xba7e, 0xe40e, 0x081f, 0xe41e, 0x0e3e, 0xe16b,
+	0xe42e, 0x28dd, 0xa802, 0x3cdd, 0x282e, 0xe01a, 0xae0c, 0xa920,
+	0xcf00, 0xd199, 0x0000, 0xd190, 0x0004, 0xcb20, 0xf7f8, 0xe41e,
+	0x1433, 0xb7f0, 0xe428, 0xe41e, 0x149a, 0x282e, 0xf08a, 0xba60,
+	0xe41e, 0x0e33, 0xe41e, 0x0d7f, 0xf09a, 0xe42e, 0xba6a, 0xe41e,
+	0x0e33, 0xe41e, 0x0af8, 0xf02d, 0xe42e, 0xe16a, 0xe41e, 0x142e,
+	0xf59e, 0xe41e, 0x0e3e, 0xe16b, 0xe42e, 0xba5e, 0x2860, 0xa120,
+	0x3c48, 0x7448, 0x2852, 0xe41e, 0x0d4d, 0x3c48, 0x7448, 0x3c01,
+	0x1852, 0xf034, 0x2852, 0x3c01, 0xba48, 0x3c27, 0xba40, 0xe40a,
+	0x08e5, 0xa201, 0xba40, 0xb431, 0xf7e8, 0xe0c3, 0x0078, 0xba40,
+	0xe40a, 0x08e5, 0x2c20, 0xe41e, 0x0d4d, 0x3c48, 0x7448, 0x3c2b,
+	0xe0c2, 0x0079, 0xba40, 0xe40a, 0x08e5, 0xba42, 0x3c24, 0xa106,
+	0xe016, 0x3c3f, 0xba44, 0xe000, 0x0220, 0xe09e, 0x2907, 0x3c26,
+	0x2824, 0xf1ca, 0xba44, 0x3c28, 0x3c0c, 0xa102, 0x3c29, 0x3c11,
+	0xa202, 0x5829, 0xa102, 0x3c2a, 0x3c12, 0x2824, 0xa104, 0xf0e8,
+	0xba44, 0x3c0d, 0xa102, 0x3c13, 0xa202, 0x5813, 0xa102, 0x3c14,
+	0xe004, 0x0040, 0x4c0d, 0xae0c, 0x4c0c, 0x2801, 0xe42e, 0x3c05,
+	0xf028, 0xba60, 0xa224, 0x3cf0, 0xba40, 0xf1ca, 0x2852, 0xe41e,
+	0x0e1d, 0x3c48, 0x7648, 0x3e01, 0xa116, 0xf076, 0x2805, 0xf058,
+	0xa224, 0x3cf0, 0xba40, 0xf0ea, 0x2805, 0xf038, 0xba48, 0x3c27,
+	0xa224, 0x3cf0, 0xba40, 0xf06a, 0x2805, 0xf028, 0xba42, 0x2801,
+	0xe42e, 0xa2fe, 0xe42e, 0xba4e, 0x3ce0, 0xa200, 0x3cd5, 0xe41e,
+	0x0c19, 0xe42e, 0xba40, 0xf08a, 0xba46, 0xa102, 0xe424, 0xa108,
+	0xe420, 0xba44, 0xe42a, 0xba46, 0xa102, 0xe428, 0xba40, 0xf08a,
+	0xba44, 0xba40, 0xba40, 0xf04a, 0xba4e, 0xba4e, 0xba4e, 0xe41e,
+	0x0d31, 0xe42a, 0xa202, 0x3cd5, 0xe41e, 0x0c19, 0xe41e, 0x0d31,
+	0xe42a, 0xba7e, 0xe42e, 0xa202, 0x3c02, 0xba40, 0xba4e, 0x3ce1,
+	0xba40, 0xf0da, 0xa202, 0x3cf0, 0xba46, 0xa102, 0xe404, 0x0a1f,
+	0xa108, 0xe400, 0x0a1f, 0xa00a, 0x3c02, 0xba44, 0xba46, 0x3ce2,
+	0xa11e, 0xf0f8, 0xa204, 0x3cf0, 0xba4e, 0x3c7a, 0xe40a, 0x0a1f,
+	0xa206, 0x3cf0, 0xba4f, 0xe40b, 0x0a1f, 0xae11, 0x4e7a, 0x3e7a,
+	0xba40, 0xf25a, 0xa208, 0x3cf0, 0xba42, 0xa102, 0xe408, 0x0a1f,
+	0xba40, 0xba40, 0xf1ca, 0xba5c, 0xa20a, 0x3cf0, 0xba40, 0xe40a,
+	0x0a1f, 0xba5c, 0xba40, 0xe40a, 0x0a1f, 0xba5c, 0xba40, 0xe40a,
+	0x0a1f, 0xba44, 0xba54, 0xa20a, 0x3cf0, 0xba40, 0xe40a, 0x0a1f,
+	0xba5c, 0xa20a, 0x3cf0, 0xba40, 0xe40a, 0x0a1f, 0xa20c, 0x3cf0,
+	0xba42, 0xe408, 0x0a1f, 0xa20a, 0x3cf0, 0xba40, 0xe40a, 0x0a1f,
+	0xa2fe, 0x3c21, 0xa20e, 0x3cf0, 0xba5e, 0xe40a, 0x0a1f, 0x3c20,
+	0xa20a, 0x3cf0, 0xba40, 0xba40, 0xe40a, 0x09a0, 0x2c20, 0xe41e,
+	0x0d4d, 0x3c48, 0xa210, 0x3cf0, 0x7448, 0xe40a, 0x0a1f, 0x3c21,
+	0xa20a, 0x3cf0, 0xba40, 0xe40a, 0x0a1f, 0xba58, 0x3c09, 0xa01e,
+	0xaf08, 0x3c50, 0xa20a, 0x3cf0, 0xba41, 0xba58, 0x3c0a, 0xa01e,
+	0xaf08, 0x3c51, 0xa20a, 0x3cf0, 0xba40, 0xe40a, 0x0a1f, 0xba40,
+	0x3cad, 0xa212, 0x3cf0, 0xba40, 0xe40a, 0x0a1f, 0x2a02, 0xa103,
+	0xb636, 0xb652, 0x3c48, 0xa215, 0x3ef0, 0x7648, 0x28c0, 0xf05a,
+	0xa214, 0x3cf0, 0xe409, 0x0a1f, 0xf18b, 0xa103, 0xe40b, 0x0a1f,
+	0xa103, 0xe04a, 0xe016, 0x3cc1, 0xa103, 0xe40b, 0x0a1f, 0xba4a,
+	0x3cc2, 0xba42, 0x3cc4, 0xba40, 0x3cc3, 0x28c2, 0xa104, 0xf054,
+	0xa214, 0x3cf0, 0xe40e, 0x0a1f, 0xa216, 0x3cf0, 0xba40, 0xe408,
+	0x0a1f, 0xba40, 0x3c0e, 0xf07a, 0xba40, 0xe418, 0x0d57, 0xba40,
+	0xe418, 0x0d6b, 0x2802, 0xa102, 0xe40a, 0x09f8, 0xba40, 0x3c18,
+	0xa218, 0x3cf0, 0xba40, 0xe40a, 0x0a1f, 0xba40, 0xba40, 0x3c22,
+	0xe40a, 0x0a03, 0xba40, 0x3c23, 0x2802, 0xa102, 0xe40a, 0x0a0d,
+	0xba40, 0xf03a, 0xba42, 0xba40, 0xba40, 0x3c2c, 0xa21a, 0x3cf0,
+	0xba40, 0xe408, 0x0a1f, 0xe41e, 0x0d31, 0xf0aa, 0xa204, 0x3cd5,
+	0xe41e, 0x0c19, 0x8450, 0x8251, 0xe018, 0x3c52, 0xe42e, 0xe16b,
+	0xe42e, 0xba62, 0xba40, 0xba40, 0xe41e, 0x0d31, 0xe42a, 0xa206,
+	0x3cd5, 0xe41e, 0x0c19, 0xe42e, 0xa200, 0x3cae, 0x3cac, 0xe0c0,
+	0x0059, 0xa106, 0xf048, 0x28dd, 0xa802, 0x3cdd, 0xba42, 0x3c24,
+	0xa106, 0xe016, 0x3c3f, 0xa201, 0xba40, 0xb431, 0xf7e8, 0x3e00,
+	0xe0c3, 0x0078, 0xba40, 0xe40a, 0x0af3, 0x2c20, 0xe41e, 0x0d4d,
+	0xa102, 0xf022, 0xa200, 0xa002, 0x3c48, 0x7448, 0x3c2b, 0xe0c2,
+	0x0079, 0x2824, 0xa104, 0xf0fa, 0x28a9, 0x3ca8, 0x0800, 0x3ca9,
+	0x84a9, 0x8220, 0xe018, 0x082b, 0x3c4e, 0x28b0, 0x3caf, 0x284e,
+	0x3cb0, 0xf1ee, 0x28a8, 0x0800, 0x3c00, 0x8400, 0x8220, 0xe018,
+	0x082b, 0x3c4e, 0x28b2, 0xf048, 0x284e, 0x18af, 0x3cb2, 0x28af,
+	0xc70f, 0x7cb2, 0x3c00, 0x28b0, 0xc70f, 0x7cb2, 0x1800, 0xae02,
+	0x3cb3, 0x284e, 0xc70f, 0x7cb2, 0x1800, 0xae02, 0x3cb4, 0xba40,
+	0xe40a, 0x0af3, 0xba40, 0x3c2d, 0xe40a, 0x0af1, 0xa200, 0x3c25,
+	0x2824, 0xa102, 0xf05a, 0xa104, 0xf058, 0x28c1, 0xf03a, 0xba40,
+	0x3c25, 0x282c, 0xf07a, 0x2824, 0xa104, 0xf042, 0xba40, 0xe408,
+	0x0af3, 0xba44, 0xe000, 0x0220, 0xe09e, 0x2907, 0x3c26, 0x28ad,
+	0xf05a, 0xba40, 0x3cae, 0xba40, 0x3cac, 0x283f, 0x44c1, 0x2ac2,
+	0xe01b, 0xe052, 0xf23a, 0xe162, 0x03b2, 0xd022, 0x0001, 0xe184,
+	0x0ac5, 0xb83c, 0xe40d, 0x0af3, 0xf0ea, 0xa102, 0x3c00, 0xba40,
+	0xf078, 0xa205, 0x5a00, 0xa103, 0x7400, 0xe046, 0xf04e, 0x5800,
+	0x7600, 0xe056, 0x3d12, 0xba40, 0xe40a, 0x0af3, 0x28c3, 0xf06a,
+	0xb83e, 0xe40d, 0x0af3, 0x3c00, 0x7400, 0xba48, 0x3c27, 0x2824,
+	0xe40a, 0x0af1, 0xba44, 0x3c28, 0x3c0c, 0xe40a, 0x0af3, 0xa102,
+	0x3c29, 0x3c11, 0xa202, 0x5829, 0xa102, 0x3c2a, 0x3c12, 0x2824,
+	0xa104, 0xf108, 0xba44, 0x3c0d, 0xe40a, 0x0af3, 0xa102, 0x3c13,
+	0xa202, 0x5813, 0xa102, 0x3c14, 0xe004, 0x0040, 0x4c0d, 0xae0c,
+	0x4c0c, 0xa202, 0xe42e, 0x28dd, 0xa902, 0x3cdd, 0xa200, 0xe42e,
+	0xba4e, 0x3c2b, 0xa202, 0x3cf0, 0xba40, 0xe40a, 0x0c17, 0xa204,
+	0x3cf0, 0xba40, 0xe408, 0x0c17, 0xba40, 0xba40, 0xba40, 0xba44,
+	0x3c02, 0xa10e, 0xe40a, 0x0b2c, 0xba40, 0x3c24, 0xba40, 0x3c39,
+	0xa208, 0x3cf0, 0xba44, 0xe408, 0x0c17, 0xba48, 0x3c27, 0xa204,
+	0x3cf0, 0xba40, 0xe408, 0x0c17, 0xa20a, 0x3cf0, 0xe41e, 0x0d3a,
+	0xe40a, 0x0c17, 0xa200, 0x3c34, 0x3c35, 0x3c36, 0x3c37, 0x3c3a,
+	0x3c25, 0x3c38, 0xe40e, 0x0bd6, 0xa202, 0x3c3a, 0xa200, 0x3c02,
+	0xa20c, 0x3cf0, 0xba44, 0x3c03, 0xa102, 0xe400, 0x0c17, 0xe404,
+	0x0b5e, 0xba44, 0x3c02, 0xa10c, 0xe418, 0x0d3a, 0xba40, 0x3c38,
+	0xba40, 0x3c39, 0xa210, 0x3cf0, 0xba42, 0xe408, 0x0c17, 0xba40,
+	0x3c34, 0xba40, 0x3c35, 0xba40, 0x3c36, 0xa212, 0x3cf0, 0xba44,
+	0xe408, 0x0c17, 0xba40, 0x3c37, 0xa202, 0x3cf0, 0xba40, 0xe40a,
+	0x0c17, 0xa204, 0x3cf0, 0xba44, 0xe408, 0x0c17, 0xa214, 0x3cf0,
+	0xba44, 0xa102, 0xe400, 0x0c17, 0xa002, 0x3c24, 0xa216, 0x3cf0,
+	0xba42, 0xe408, 0x0c17, 0xba40, 0x3c25, 0xa218, 0x3cf0, 0xba44,
+	0xa102, 0xe408, 0x0c17, 0xa21a, 0x3cf0, 0xba40, 0xe408, 0x0c17,
+	0x2802, 0xa10c, 0xf1e8, 0x2803, 0xf1ca, 0xa21c, 0x3cf0, 0xba46,
+	0x3c7a, 0x3ce2, 0xe40a, 0x0c17, 0xba50, 0xa002, 0xae04, 0x3c09,
+	0xba40, 0xe40a, 0x0c17, 0xba50, 0xae04, 0x3c0a, 0x2809, 0xa01e,
+	0xaf08, 0x3c50, 0x280a, 0xa01e, 0xaf08, 0x3c51, 0xe41e, 0x0df5,
+	0x287a, 0xf0da, 0xa11e, 0xf0b8, 0xba4e, 0x3c7a, 0xe40a, 0x0c17,
+	0xba4e, 0xe40a, 0x0c17, 0xae10, 0x4c7a, 0x3c7a, 0x2838, 0x4403,
+	0xf13a, 0xa21e, 0x3cf0, 0xba40, 0xe000, 0x03e8, 0xba4d, 0xe40b,
+	0x0c17, 0x3c21, 0x3e20, 0xe004, 0x1b77, 0xae10, 0xe00a, 0x0040,
+	0xc70f, 0x7c20, 0x3c20, 0x2838, 0xf05a, 0xba42, 0xae10, 0x4c2b,
+	0x3c2b, 0x2839, 0x4403, 0xf09a, 0xba40, 0x3c3b, 0xf068, 0xa220,
+	0x3cf0, 0xba40, 0xe40a, 0x0c17, 0x2836, 0x4403, 0xf06a, 0xa222,
+	0x3cf0, 0xba42, 0xe408, 0x0c17, 0xba48, 0x3c27, 0xba40, 0xf03a,
+	0xba4e, 0xf7de, 0x8450, 0x8251, 0xe018, 0x3c52, 0x2836, 0xf05a,
+	0xa202, 0xe41e, 0x08e7, 0xf344, 0x2838, 0xf078, 0xe004, 0x03e9,
+	0x3c21, 0xe004, 0x7530, 0x3c20, 0xa200, 0x3c22, 0x3c23, 0xa202,
+	0x3c28, 0x3c0c, 0x3c2d, 0xa200, 0x3c29, 0x3c2a, 0xe167, 0x0220,
+	0x2907, 0x3c26, 0x2839, 0xf1ba, 0x283a, 0xf038, 0xa200, 0xf17e,
+	0x283b, 0xf15a, 0xa204, 0x2a50, 0xa12d, 0xf057, 0xa002, 0xa12d,
+	0xf027, 0xa002, 0x3c00, 0xa204, 0x2a51, 0xa125, 0xf057, 0xa002,
+	0xa125, 0xf027, 0xa002, 0xae06, 0x4c00, 0xf01e, 0xe42e, 0xe16b,
+	0xe42e, 0xba3e, 0xe002, 0x01b2, 0xe428, 0xba7e, 0xa200, 0x3cdc,
+	0x2ae3, 0xe0c0, 0x0065, 0xaf0a, 0xa802, 0xe017, 0xe052, 0x3ce5,
+	0xe41e, 0x0c4b, 0xf1ea, 0x2adc, 0xa109, 0xf039, 0xa202, 0x3c16,
+	0x28e3, 0xe408, 0x0c78, 0x2816, 0xf068, 0xba2e, 0xa102, 0xe42a,
+	0xba4e, 0xf7ce, 0xba2e, 0xa102, 0xe42a, 0xba4e, 0xe002, 0x0070,
+	0xf7a8, 0xa202, 0x2a10, 0xf039, 0x3c0f, 0xf02e, 0x3c15, 0xf73e,
+	0x28e3, 0xf2f8, 0xe42e, 0xe164, 0x0630, 0xe163, 0x062c, 0xe162,
+	0x0628, 0xe004, 0x0044, 0x3d12, 0xe004, 0x0069, 0x3d12, 0xe004,
+	0x0076, 0x3d12, 0xe004, 0x0058, 0x3d12, 0xe162, 0x0628, 0xd022,
+	0x0003, 0xe184, 0x0c75, 0xba2e, 0xa102, 0xe42a, 0xba4e, 0x3d03,
+	0x2adc, 0xa803, 0xf049, 0xae10, 0x3cdb, 0xf03e, 0x4cdb, 0x3d14,
+	0x2913, 0x1912, 0x2adc, 0xa003, 0x3edc, 0xe428, 0xa202, 0xe42e,
+	0x2ae3, 0x28d6, 0xa120, 0xb615, 0x3ee3, 0xe40b, 0x0c33, 0x2816,
+	0xf168, 0xba2e, 0xa102, 0xf34a, 0xba4e, 0x2adc, 0xa803, 0xf049,
+	0xae10, 0x3cdb, 0xf03e, 0x4cdb, 0x3d14, 0x2adc, 0xa003, 0x3edc,
+	0xa80f, 0xe41b, 0x0d12, 0x28e3, 0xf36a, 0xf6ce, 0xba2e, 0xa102,
+	0xf1fa, 0xba4e, 0xe002, 0x0070, 0xf088, 0x2a10, 0xf049, 0xa203,
+	0x3e0f, 0xf03e, 0xa203, 0x3e15, 0xe000, 0x0070, 0x2adc, 0xa803,
+	0xf049, 0xae10, 0x3cdb, 0xf03e, 0x4cdb, 0x3d14, 0x2adc, 0xa003,
+	0x3edc, 0xa80f, 0xe41b, 0x0d12, 0x28e3, 0xf15a, 0xf60e, 0x2adc,
+	0xa803, 0xf03b, 0x28db, 0x3d14, 0xa211, 0x28dc, 0xa80e, 0xf0ba,
+	0xe045, 0xaf03, 0xf06b, 0xa103, 0x3e00, 0xa201, 0x8600, 0x3f14,
+	0xe41e, 0x0d12, 0xa201, 0xba2e, 0xa102, 0xf04a, 0xba4e, 0xa203,
+	0xf7be, 0x3ee5, 0xe162, 0x0630, 0x28d5, 0x3d12, 0x28dc, 0x3d12,
+	0x28e5, 0x3d12, 0xa200, 0x3d12, 0xe0c1, 0x006b, 0x28d6, 0xa002,
+	0xae06, 0xe041, 0xaf06, 0x3cd6, 0xca28, 0xf7f8, 0xe180, 0xce21,
+	0xd111, 0x0630, 0xd112, 0x0004, 0xd113, 0x0000, 0xe1e1, 0xe181,
+	0x28e3, 0xe428, 0xa200, 0x3cd8, 0xe0c0, 0x005c, 0xe0c1, 0x0065,
+	0xaf12, 0xa802, 0xaf15, 0xa803, 0xe016, 0xe056, 0xf04a, 0xa200,
+	0x3ce3, 0xe42e, 0x28d9, 0xf05a, 0xe0c0, 0x005d, 0xe42a, 0xf7be,
+	0xe0c0, 0x005d, 0xe00a, 0x0200, 0xe0c2, 0x005d, 0xa202, 0xce00,
+	0x3cd9, 0xf71e, 0xe0c0, 0x006b, 0xe000, 0x0088, 0x08d8, 0xca29,
+	0xf7f9, 0xe180, 0xce20, 0xd111, 0x0630, 0xd112, 0x0004, 0xd113,
+	0x0000, 0xe1e1, 0xe181, 0xe164, 0x0630, 0x28d7, 0x2ad8, 0xa010,
+	0xa011, 0x3cd7, 0x3ed8, 0x1ada, 0xe41b, 0x0cf2, 0xa200, 0x3cd9,
+	0xe42e, 0xe41e, 0x142e, 0xba2e, 0xa102, 0xe016, 0xe428, 0xba4e,
+	0xf7be, 0xe42e, 0x2802, 0xae04, 0xe000, 0x0200, 0xe09e, 0x2917,
+	0x3c09, 0xaf08, 0x3c50, 0x2917, 0x3c0a, 0xaf08, 0x3c51, 0x2917,
+	0x3c32, 0x2907, 0x3c31, 0xe01a, 0xe42e, 0xa102, 0xa201, 0xf04a,
+	0xaf02, 0xa003, 0xf7e8, 0xe04a, 0xe428, 0xa202, 0xe42e, 0xe004,
+	0x0040, 0xe165, 0x0332, 0xba4f, 0xf05b, 0x3e00, 0x3f15, 0xa102,
+	0xf7b0, 0xf06a, 0xa102, 0x3c01, 0x2a00, 0x8601, 0x3f15, 0x28aa,
+	0xa902, 0x3caa, 0xe42e, 0xe004, 0x0040, 0xe165, 0x0372, 0xba4f,
+	0xf05b, 0x3e00, 0x3f15, 0xa102, 0xf7b0, 0xf06a, 0xa102, 0x3c01,
+	0x2a00, 0x8601, 0x3f15, 0x28aa, 0xa904, 0x3caa, 0xe42e, 0xba48,
+	0x3c2f, 0xa104, 0xe402, 0x0dc2, 0xa202, 0x3c2e, 0xba4e, 0x3c2b,
+	0xba44, 0xe404, 0x0dc2, 0xa10c, 0xe400, 0x0dc2, 0xa008, 0xe41e,
+	0x0dc4, 0xba42, 0x3c24, 0xa102, 0xa201, 0x3ebe, 0xf046, 0xa203,
+	0x3e24, 0x3ebe, 0xba40, 0xba48, 0x3c27, 0xba40, 0xf03a, 0xba4e,
+	0xf7de, 0xa200, 0x3c39, 0x3c34, 0x3c35, 0x3c36, 0x3c37, 0x3c3a,
+	0x3c25, 0x3c38, 0x3c22, 0x3c23, 0xa202, 0x3c28, 0x3c0c, 0x3c2d,
+	0xe167, 0x0220, 0x2907, 0x3c26, 0x8450, 0x8251, 0xe018, 0x3c52,
+	0xa2fe, 0x3ce2, 0xe004, 0x03e9, 0x3c21, 0xe004, 0x7530, 0x3c20,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xf092, 0xa002, 0xf04a, 0xba4e,
+	0xba4f, 0xf21e, 0xba5e, 0xba5f, 0xf1ee, 0xa207, 0xe045, 0xf107,
+	0xae05, 0xe001, 0x0200, 0xe09f, 0x2917, 0x3c09, 0x2917, 0x3c0a,
+	0x2917, 0x3c32, 0x3c50, 0x2907, 0x3c31, 0x3c51, 0xe42e, 0xf07b,
+	0xe004, 0x00a0, 0xe005, 0x0078, 0xe40e, 0x0dea, 0xe004, 0x0140,
+	0xe005, 0x00f0, 0x3c09, 0x3e0a, 0xa01e, 0xa01f, 0xaf08, 0xaf09,
+	0x3c50, 0x3e51, 0xe41e, 0x0df5, 0xe42e, 0x280a, 0xe002, 0x0190,
+	0xf086, 0xe002, 0x0190, 0xf0a6, 0xe002, 0x0160, 0xf0f6, 0xf16e,
+	0x2850, 0x3c32, 0x2851, 0x3c31, 0xe42e, 0x2850, 0xae02, 0x3c32,
+	0x2851, 0xa002, 0xaf02, 0x3c31, 0xe42e, 0x2850, 0xae04, 0x3c32,
+	0x2851, 0xa006, 0xaf04, 0x3c31, 0xe42e, 0x2850, 0xae06, 0x3c32,
+	0x2851, 0xa00e, 0xaf06, 0x3c31, 0xe42e, 0xe049, 0xa103, 0xa15f,
+	0xa20c, 0xe427, 0xa167, 0xa20e, 0xe427, 0xe003, 0x0129, 0xa212,
+	0xe427, 0xe003, 0x04a4, 0xa216, 0xe427, 0xe003, 0x1290, 0xa21a,
+	0xe427, 0xa21c, 0xe42e, 0x28e9, 0xe428, 0xc001, 0x2417, 0x4c18,
+	0xc000, 0xe0c2, 0x0051, 0xa202, 0x3ce9, 0xe42e, 0xa200, 0x3ce9,
+	0xe42e, 0xa200, 0xcc8e, 0xe0c2, 0x030a, 0xe0c2, 0x0320, 0x2837,
+	0xae02, 0x4c36, 0xae02, 0x4c35, 0xae02, 0x4c34, 0xae04, 0x2ad1,
+	0xb472, 0x4c30, 0xae08, 0xa906, 0xe0c2, 0x0100, 0xa200, 0xe0c2,
+	0x0128, 0x2a75, 0x4e71, 0xb692, 0xae08, 0xa92c, 0xe0c2, 0x017c,
+	0xe004, 0x0014, 0xe0c2, 0x017d, 0xe0c0, 0x0050, 0xe049, 0xe008,
+	0x007f, 0x3cbc, 0xaf11, 0xe009, 0x007f, 0x3ebd, 0x46bc, 0x3ebc,
+	0xa200, 0x2abc, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2abc, 0xa805,
+	0xf03b, 0xe00a, 0x0009, 0x2abc, 0xa809, 0xf03b, 0xe00a, 0x0020,
+	0x2abc, 0xa811, 0xf03b, 0xe00a, 0x0040, 0xe0c2, 0x040c, 0x2835,
+	0x4c63, 0xf1fa, 0xe0c1, 0x0046, 0xe004, 0x0048, 0xae10, 0xe042,
+	0x2abd, 0xa809, 0xf05b, 0xe161, 0x05e4, 0x2111, 0x4d11, 0xe0c2,
+	0x0211, 0xe0c1, 0x0046, 0xe004, 0x0088, 0xae10, 0xe042, 0x2abd,
+	0xa811, 0xf05b, 0xe161, 0x05e6, 0x2111, 0x4d11, 0xe0c2, 0x0212,
+	0xe0c0, 0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0x2abd, 0xa805,
+	0xf05b, 0xe161, 0x05e2, 0x2111, 0x4d11, 0xe0c2, 0x0103, 0xe161,
+	0x05c0, 0x2111, 0x4d11, 0xcf42, 0xe0c1, 0x0046, 0xe004, 0x0040,
+	0xae10, 0xe042, 0x2abd, 0xa803, 0xf05b, 0xe161, 0x05e0, 0x2111,
+	0x4d11, 0xcf44, 0x2aaa, 0xe0c3, 0x013d, 0xa803, 0xa200, 0xe419,
+	0x1096, 0x2aaa, 0xa805, 0xa202, 0xe419, 0x1096, 0x2ad3, 0xf04b,
+	0x2009, 0x4c0a, 0xf04e, 0x2050, 0x4c51, 0xae08, 0xe0c2, 0x0101,
+	0xe0c2, 0x0205, 0x2850, 0xae20, 0x4c51, 0xae08, 0xcf60, 0x2837,
+	0xcf68, 0x2a24, 0xa105, 0xe017, 0x3e66, 0x283e, 0xae02, 0x4c18,
+	0xae06, 0x4c0d, 0xae06, 0x4c0c, 0xcf46, 0x282f, 0xae02, 0x4cd2,
+	0xae02, 0x4cd1, 0xae04, 0xa904, 0x4cad, 0xae02, 0x4c2e, 0xae04,
+	0x4c30, 0xae02, 0x2a30, 0xf029, 0xa902, 0xae04, 0x4c24, 0xae02,
+	0x4cae, 0xcf00, 0x2834, 0xae02, 0x4c35, 0xae02, 0x2a24, 0xa105,
+	0xf05b, 0x4c22, 0xae02, 0x4c23, 0xf02e, 0xae02, 0xae02, 0x4c37,
+	0xcf24, 0xa200, 0xe41e, 0x036c, 0xe0c2, 0x0102, 0x2863, 0x4466,
+	0xf078, 0x2a63, 0xe41e, 0x075b, 0x3c1b, 0x3ca2, 0x3ca5, 0x28a0,
+	0x2a66, 0xe41b, 0x0790, 0x2a63, 0xf07b, 0xa201, 0xe41e, 0x075b,
+	0x3ca6, 0x3ca5, 0x3c1b, 0x28a4, 0xe412, 0x12a6, 0x3c72, 0x28a5,
+	0xe41e, 0x1292, 0x3c73, 0x2872, 0xe41e, 0x12b4, 0x2866, 0x3c74,
+	0xf1a8, 0x2824, 0xe016, 0x303e, 0x28be, 0xf058, 0x28a2, 0xa205,
+	0xe412, 0x0782, 0x28a3, 0x3ca5, 0x28a2, 0x2a63, 0xf05b, 0x28a2,
+	0xe412, 0x0789, 0x28a6, 0x3ca3, 0x28bf, 0xf038, 0x28a1, 0x3ca0,
+	0x28a2, 0x3ca1, 0x28be, 0x3cbf, 0xa206, 0xae08, 0x4c24, 0xae06,
+	0xe0c2, 0x0204, 0xa204, 0x2a35, 0x4e63, 0xb632, 0xe0c2, 0x0210,
+	0x3c01, 0xa200, 0xe41e, 0x036c, 0x2a01, 0xae11, 0xe056, 0xe0c2,
+	0x0213, 0xa200, 0xe0c2, 0x0215, 0xa204, 0x2a63, 0x4666, 0x4e35,
+	0xb612, 0xe0c2, 0x0208, 0xf049, 0x2aa2, 0xe0c3, 0x020b, 0x2835,
+	0x4c63, 0xf07a, 0x28a6, 0x2a35, 0xf02b, 0x28a2, 0xe0c2, 0x0214,
+	0x28a1, 0xf174, 0xa202, 0xe0c2, 0x0302, 0x28a0, 0xf052, 0x28a1,
+	0xf032, 0x28a2, 0xb608, 0xe0c2, 0x0380, 0x28a1, 0xf052, 0x28a0,
+	0xf032, 0x28a2, 0xb608, 0xe0c2, 0x0383, 0xa200, 0xe0c2, 0x0302,
+	0xa204, 0x4c18, 0xae02, 0x4c25, 0xe0c2, 0x0303, 0xa20e, 0xe0c2,
+	0x0312, 0xe0c0, 0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a,
+	0x12bb, 0xa200, 0xe0c2, 0x0308, 0xa200, 0x3c75, 0x3c76, 0x3c71,
+	0xa202, 0x3c78, 0x28a4, 0xe412, 0x11ff, 0x28a5, 0x3c1c, 0xf024,
+	0x3ca4, 0xa202, 0x3c6b, 0xa201, 0x28ac, 0xb6d1, 0xae0b, 0xe0c3,
+	0x0104, 0x2a6d, 0xa105, 0xf05b, 0xa005, 0x2866, 0xb435, 0x3e6d,
+	0xe41e, 0x0274, 0xa202, 0xe0c2, 0x0106, 0xe0c0, 0x0065, 0xaf0c,
+	0xa80e, 0xe40a, 0x1018, 0xca29, 0xf7f9, 0xe180, 0xe0c1, 0x006a,
+	0xce21, 0xd111, 0x0618, 0xd112, 0x000c, 0xd113, 0x0003, 0xca29,
+	0xf7f9, 0xe181, 0xaf04, 0x30e4, 0x28e4, 0xe40a, 0x1018, 0xa210,
+	0x3c00, 0xe162, 0x0312, 0xe163, 0x0610, 0xa201, 0xd022, 0x0002,
+	0xe184, 0x0ffd, 0x2912, 0xa81e, 0xe055, 0xae09, 0x2912, 0xa81e,
+	0xe055, 0x3f13, 0x2800, 0xa102, 0xf03a, 0x3c00, 0xf6fe, 0xca29,
+	0xf7f9, 0xe162, 0x061a, 0x2112, 0x4d12, 0xe180, 0xce20, 0xd111,
+	0x0610, 0xd112, 0x0008, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe181,
+	0xe162, 0x0618, 0xc410, 0xa200, 0x2ae4, 0xb632, 0xae10, 0x3d12,
+	0xa220, 0x3d12, 0xe42e, 0xa200, 0xcc8e, 0xe0c2, 0x0320, 0xe0c2,
+	0x030a, 0x2837, 0xae02, 0x4c36, 0xae02, 0x4c35, 0xae02, 0x4c34,
+	0xae04, 0x2ad1, 0xb472, 0x4c30, 0xae08, 0xa906, 0xe0c2, 0x0100,
+	0x2a75, 0x4e71, 0xb692, 0xae08, 0xa92c, 0xe0c2, 0x017c, 0xe004,
+	0x0014, 0xe0c2, 0x017d, 0xa200, 0xe41e, 0x036c, 0xe0c2, 0x0102,
+	0xe42e, 0xe0c0, 0x0065, 0xaf0a, 0xa802, 0xf16a, 0xe162, 0x0630,
+	0x28d6, 0x3d12, 0x28d7, 0x3d12, 0xe0c0, 0x006b, 0xca29, 0xf7f9,
+	0xe180, 0xce20, 0xd111, 0x0630, 0xd112, 0x0004, 0xd113, 0x0000,
+	0xca28, 0xf7f8, 0xe181, 0xe0c0, 0x0065, 0xe008, 0x0100, 0xf10a,
+	0xca29, 0xf7f9, 0xe0c0, 0x006a, 0xe180, 0xce20, 0xd112, 0x0004,
+	0xd111, 0x0618, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe181, 0xa200,
+	0x3cd7, 0x3cd6, 0x3ce3, 0x3cd8, 0x3cd9, 0xe0c0, 0x0111, 0xf7e8,
+	0x2875, 0x4c71, 0xe42a, 0xa204, 0xae0e, 0x4c50, 0xa102, 0xae0e,
+	0x4c51, 0xa102, 0xe0c1, 0x014b, 0xf7e9, 0xe0c2, 0x014d, 0xa202,
+	0xe0c2, 0x014a, 0xe0c1, 0x014b, 0xf7e9, 0xe42e, 0xe161, 0x0332,
+	0xa201, 0xf05a, 0xe161, 0x0372, 0xe005, 0x0040, 0xa202, 0xe0c2,
+	0x013c, 0xd022, 0x003f, 0xe184, 0x10aa, 0x2911, 0xe0c3, 0x013e,
+	0xe0c2, 0x013f, 0xa003, 0xa200, 0xe0c2, 0x013c, 0xe42e, 0xe167,
+	0x05e0, 0xe166, 0x0064, 0xd022, 0x0003, 0xe184, 0x10b9, 0x9e16,
+	0x3517, 0x3d17, 0xe42e, 0xa201, 0x3ee6, 0x280e, 0xae0a, 0x4c5d,
+	0xe0c2, 0x0115, 0xa27f, 0x2858, 0xf028, 0x2a5e, 0xe0c3, 0x012a,
+	0xa27e, 0xe0c2, 0x0116, 0x28ab, 0xae08, 0x4c58, 0xe0c2, 0x0114,
+	0x2835, 0x4c63, 0xf07a, 0x2859, 0x4435, 0xe016, 0xae0a, 0x4c5d,
+	0xcf6a, 0x2858, 0xe41a, 0x10f1, 0x2858, 0xe016, 0x4c66, 0xf038,
+	0xe41e, 0x1810, 0xe41e, 0x1140, 0xe0c0, 0x0111, 0xf7e8, 0xa202,
+	0xe0c2, 0x0110, 0xe41e, 0x1231, 0x2875, 0x4c71, 0xe418, 0x11d7,
+	0xe42e, 0x2a0b, 0xe0c3, 0x030d, 0xa200, 0x2a66, 0xf03b, 0x2a6c,
+	0xb676, 0x2a5b, 0xb672, 0x2a0b, 0xb632, 0x3c00, 0xae06, 0x4c00,
+	0x3c00, 0xae0c, 0x4c00, 0xe0c2, 0x0309, 0x2866, 0x2a6c, 0xa105,
+	0xe017, 0xe052, 0xe016, 0x3c64, 0xa200, 0x2a6c, 0xa107, 0xb62a,
+	0x4466, 0x3c65, 0xae02, 0x4c64, 0x3ce6, 0xae04, 0x4ce6, 0x3ce6,
+	0xae08, 0x4ce6, 0xe0c2, 0x030c, 0xa200, 0x2a0b, 0x4664, 0xf08b,
+	0x28b5, 0xae0a, 0x4cb5, 0xae0a, 0x4cb6, 0xae0a, 0x4cb6, 0xe0c2,
+	0x030a, 0xa202, 0xae20, 0xe00a, 0x0842, 0x2a0b, 0x4665, 0xf09b,
+	0x2ab7, 0xae0b, 0x4eb7, 0xae0b, 0x4eb8, 0xae0b, 0x4eb8, 0xe056,
+	0xe0c2, 0x030b, 0x2824, 0xa104, 0xe42a, 0xe41e, 0x1810, 0xe42e,
+	0x286b, 0xe0c2, 0x0131, 0xa200, 0x3c6b, 0x285c, 0xe0c2, 0x0130,
+	0xe42e, 0x2069, 0x4c6a, 0xcf48, 0x2856, 0x4c58, 0x4c59, 0xf09a,
+	0xd1b3, 0x0008, 0xd1b3, 0x0010, 0x283f, 0xf058, 0xe40e, 0x1182,
+	0x283f, 0xf11a, 0x2859, 0x2ac5, 0xe016, 0xe017, 0xe052, 0xf0b8,
+	0xe162, 0x03b2, 0x2112, 0x4d0a, 0xcf4c, 0x2112, 0x4d0a, 0xcf54,
+	0xe40e, 0x1182, 0xe162, 0x0301, 0x2112, 0x4d12, 0xcf4c, 0x2112,
+	0x4d12, 0xcf4e, 0x2112, 0x4d12, 0xcf50, 0x2112, 0x4d12, 0xcf52,
+	0x2866, 0xf09a, 0x8112, 0xc418, 0x2112, 0x4d32, 0xcf54, 0x2112,
+	0x4d32, 0xcf58, 0x286c, 0xe016, 0x4466, 0x443e, 0xe40a, 0x11b3,
+	0xca28, 0xf7f8, 0xa202, 0xcf62, 0xcf64, 0xe0c0, 0x0046, 0xe005,
+	0x00a8, 0xae11, 0xe042, 0xca29, 0xf7f9, 0xe180, 0xce20, 0xd111,
+	0x05d0, 0xd112, 0x0008, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe181,
+	0xe0c0, 0x0046, 0xe005, 0x00a8, 0xae11, 0xe042, 0xca29, 0xf7f9,
+	0xe180, 0xce20, 0xd111, 0x0048, 0xd112, 0x0002, 0xd113, 0x001b,
+	0xca28, 0xf7f8, 0xe181, 0xd1a0, 0x0001, 0xcb40, 0xf7f8, 0x286c,
+	0xe016, 0x4466, 0x443e, 0xe42a, 0x2853, 0xcf64, 0x2054, 0x4c55,
+	0xcf62, 0xe42e, 0xe41e, 0x1023, 0xa200, 0x3c54, 0x3c55, 0xa202,
+	0x3c78, 0xe41e, 0x11d7, 0xe41e, 0x1271, 0xf7c8, 0xa200, 0x3c78,
+	0xe41e, 0x11d7, 0xe190, 0xe0c1, 0x014b, 0xf7e9, 0xe42e, 0x2854,
+	0x4c55, 0xe01a, 0x3c77, 0x2871, 0xf11a, 0x2854, 0xe41a, 0x124e,
+	0x2854, 0xaf02, 0xe000, 0x0460, 0xe09e, 0x2907, 0x2a54, 0xa803,
+	0xf029, 0xaf10, 0xe008, 0x001f, 0x3c79, 0x2879, 0xae02, 0x4c77,
+	0xae02, 0x4c78, 0xae0e, 0x4c54, 0xae0e, 0x4c55, 0xe0c1, 0x014b,
+	0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0xe42e, 0xe0c0,
+	0x0060, 0xe049, 0xa861, 0xe42b, 0xe049, 0xa81e, 0x3c76, 0xaf09,
+	0x3275, 0xaf03, 0x3271, 0x28a4, 0xe0c2, 0x0143, 0xa200, 0xe0c2,
+	0x017f, 0xe0c2, 0x0149, 0xa200, 0xe41e, 0x036c, 0xe0c2, 0x017f,
+	0x2850, 0xa102, 0xae20, 0x4c51, 0xa102, 0xe0c2, 0x0142, 0xe41e,
+	0x0371, 0xae20, 0x2a71, 0xae09, 0xe056, 0x2a75, 0xf02b, 0x4c76,
+	0xe0c2, 0x014e, 0xe0c0, 0x0061, 0xa87e, 0xe0c2, 0x0144, 0xa203,
+	0xe42e, 0x2854, 0xaf02, 0xe000, 0x0420, 0xe09e, 0x2907, 0x2a54,
+	0xa803, 0x4c5d, 0xf039, 0x285d, 0xae10, 0x3d07, 0x2854, 0xa002,
+	0x1850, 0xe41a, 0x1244, 0xe42e, 0xe180, 0xca28, 0xf7f8, 0x2873,
+	0x3c07, 0xa204, 0x3c06, 0xd111, 0x0420, 0xf0ae, 0xe180, 0xca28,
+	0xf7f8, 0x2872, 0x3c07, 0xa206, 0x3c06, 0xd111, 0x0460, 0xe0c0,
+	0x0041, 0xe005, 0x0037, 0xae11, 0xe042, 0x2a07, 0xae1d, 0xe042,
+	0x2a55, 0xae0f, 0xe042, 0xce20, 0x2850, 0xa002, 0xaf02, 0xa006,
+	0xa2f9, 0xe052, 0xce24, 0x8806, 0x0113, 0xca28, 0xf7f8, 0xe181,
+	0xe42e, 0x2854, 0xa002, 0x3c54, 0x1850, 0xe428, 0x3c54, 0x2855,
+	0xa002, 0x3c55, 0x1851, 0xe42e, 0x8112, 0xa204, 0x5818, 0xa102,
+	0x3ce7, 0x2902, 0x44e7, 0x3ce8, 0x2902, 0xaf02, 0x5c18, 0x5818,
+	0xae04, 0x4ce8, 0x3d0a, 0xe42e, 0xe161, 0x04a0, 0xa2fe, 0xc703,
+	0x3d11, 0xe42e, 0x3c06, 0xe004, 0x04a0, 0xe092, 0xa200, 0x2b11,
+	0xf075, 0xa002, 0xe049, 0xa109, 0xf7b9, 0xa200, 0xe42e, 0xe049,
+	0xe001, 0x04a0, 0xe093, 0x2a06, 0x3f11, 0xe42e, 0x3c06, 0xe004,
+	0x04a0, 0xe092, 0xa200, 0x2b11, 0x1a06, 0xf06b, 0xa002, 0xe049,
+	0xa109, 0xf7a9, 0xa200, 0xe42e, 0xe424, 0xe000, 0x04a0, 0xe092,
+	0xa2fe, 0x3d01, 0xe42e, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3,
+	0x0152, 0x2b17, 0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153,
+	0xe0c1, 0x0101, 0xe0c3, 0x015d, 0x2824, 0xa104, 0xe005, 0x001b,
+	0xf038, 0xe005, 0x001f, 0x3e00, 0x28a0, 0xa53e, 0xa400, 0x2aa1,
+	0xa53f, 0xa401, 0xae11, 0xe055, 0xae21, 0xe167, 0x01a2, 0x2907,
+	0xaf10, 0x4400, 0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2, 0x0150,
+	0xe0c0, 0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151,
+	0xf7e8, 0xe42e, 0xe0c0, 0x0045, 0xaf08, 0x3091, 0xe0c0, 0x0060,
+	0x3480, 0x3c81, 0x3486, 0x3c87, 0xe0c0, 0x0061, 0xae14, 0x3482,
+	0x3c83, 0x0480, 0x0c81, 0x3484, 0x3c85, 0x288c, 0xf13a, 0xe0c0,
+	0x0048, 0x3492, 0x3c93, 0x2492, 0x4c93, 0xe0c1, 0x0049, 0x3688,
+	0x3e89, 0x1488, 0x1c89, 0xe0c1, 0x0045, 0xaf05, 0xa803, 0xb611,
+	0x3e8c, 0xe0c0, 0x0048, 0xe008, 0x01ff, 0x3c8a, 0xe0c0, 0x0048,
+	0x3486, 0xe008, 0xfe00, 0x3c87, 0xa200, 0xcc92, 0xcc8e, 0xe180,
+	0xe41e, 0x13cc, 0xd071, 0x202a, 0xe181, 0xa200, 0x3c8e, 0xa200,
+	0x3498, 0x3c97, 0xcc72, 0xe41e, 0x1377, 0x2c8a, 0xa102, 0xf034,
+	0xba4f, 0xf7de, 0xc872, 0xe41e, 0x1496, 0xa202, 0x3c8e, 0xa202,
+	0xb61a, 0xe16a, 0xe42e, 0xcb40, 0xf7f8, 0xc896, 0xf11a, 0x288c,
+	0xf0a8, 0xe41e, 0x1390, 0x288c, 0xf08a, 0xa200, 0x2a9b, 0xe003,
+	0x01fc, 0xb62e, 0xe418, 0x138d, 0xa200, 0x3c9a, 0xf05e, 0xd04b,
+	0x0001, 0xa200, 0x3c9a, 0xe41e, 0x14a3, 0x2899, 0xcc6e, 0xd04c,
+	0x0000, 0xa214, 0xa102, 0xf7f0, 0xe470, 0x288c, 0xe428, 0xa202,
+	0x3c9a, 0xe41e, 0x1390, 0x288c, 0xcc96, 0xe42e, 0xc896, 0xe428,
+	0xd04b, 0x0001, 0x2899, 0xcc6e, 0xd04c, 0x0000, 0xe42e, 0xa200,
+	0x3c8d, 0x3c99, 0xe41e, 0x1390, 0xa200, 0x3c9a, 0x288c, 0xf07a,
+	0x289b, 0xa118, 0xf042, 0xe41e, 0x138d, 0xf79e, 0xd04b, 0x0001,
+	0x2899, 0xcc6e, 0xe190, 0xe128, 0xe42e, 0xe41e, 0x144a, 0xf04e,
+	0x288c, 0xe41a, 0x13a2, 0x289b, 0xaf12, 0x088d, 0xa802, 0x3c8d,
+	0x289b, 0xe008, 0x01ff, 0x3c9b, 0x288d, 0xae12, 0x089b, 0xaf04,
+	0x3c99, 0xe42e, 0xd027, 0x0000, 0xe41e, 0x13f3, 0xd027, 0x0001,
+	0x289b, 0xe42a, 0xca28, 0xf7f8, 0x2486, 0x4c87, 0xce20, 0x288d,
+	0xae0e, 0xce22, 0xd112, 0x0080, 0xe0c0, 0x0043, 0xa806, 0xae02,
+	0xa022, 0xce26, 0xca28, 0xf7f8, 0x2486, 0x4c87, 0xe000, 0x0200,
+	0x3486, 0x3c87, 0x1484, 0x1c85, 0xf054, 0x2480, 0x4c81, 0x3486,
+	0x3c87, 0xe41e, 0x1470, 0xe42e, 0xd030, 0x0000, 0xd031, 0x0000,
+	0xd032, 0x0000, 0xd034, 0x0000, 0xd033, 0x0000, 0xd035, 0x0000,
+	0xd036, 0x00ff, 0xd037, 0x0000, 0xd038, 0x0000, 0xd039, 0x0000,
+	0xd04b, 0x0001, 0xd04c, 0x0000, 0xd149, 0x0000, 0xe42e, 0xe0c1,
+	0x0059, 0xa103, 0xa200, 0xb636, 0xe000, 0x001c, 0xe0c1, 0x0045,
+	0xe052, 0xe01a, 0xe42e, 0xe0c0, 0x0043, 0xa808, 0xf318, 0xa200,
+	0x3c8b, 0xe004, 0x0200, 0x3c9b, 0xe41e, 0x13e7, 0x3c8c, 0x2486,
+	0x4c87, 0xe0c1, 0x0049, 0x3692, 0x3e93, 0x2692, 0x4e93, 0xe045,
+	0xf033, 0x0682, 0x0e83, 0xe003, 0x0200, 0x288c, 0xb606, 0x3c8c,
+	0xf173, 0xe001, 0x0200, 0x3e9b, 0x288c, 0xf128, 0x288b, 0xf658,
+	0xe0c0, 0x005c, 0xe008, 0x4000, 0xf60a, 0xe0c0, 0x005d, 0xe00a,
+	0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3c8b, 0xf56e, 0x289b,
+	0x2a8c, 0xf039, 0xe004, 0x0200, 0x3c9b, 0xe42e, 0xc868, 0xa80e,
+	0x3c00, 0x7400, 0xe42e, 0x288c, 0xe42a, 0xe41e, 0x1470, 0xe0c0,
+	0x0049, 0x3492, 0x3c93, 0x2492, 0x4c93, 0xe0c1, 0x0048, 0x3692,
+	0x3e93, 0x2692, 0x4e93, 0xe045, 0xa200, 0xb626, 0xe003, 0x0200,
+	0xb606, 0xe42e, 0xe004, 0x01b1, 0x2a30, 0xf03b, 0xe004, 0x8000,
+	0x3c7b, 0x288d, 0xae12, 0x089b, 0xaf04, 0xcc78, 0xcc76, 0x289b,
+	0xa806, 0x3c7d, 0xf0da, 0xae06, 0x3c7c, 0xa240, 0x187c, 0x3c7d,
+	0xc87a, 0x5c7d, 0x587d, 0x2e7b, 0x5e7c, 0xe042, 0xcc7a, 0x2c7b,
+	0x587d, 0xcc7a, 0x289b, 0xa008, 0x3c9b, 0xe42e, 0xe41e, 0x142e,
+	0xc872, 0x349c, 0x3c9d, 0xe41e, 0x1493, 0xe049, 0x249c, 0x4c9d,
+	0xaf06, 0xe046, 0xb608, 0x2a8e, 0xb616, 0xe0c1, 0x0048, 0x3692,
+	0x3e93, 0x2692, 0x4e93, 0xe042, 0xe049, 0x1684, 0x1e85, 0xf035,
+	0x1482, 0x1c83, 0xe0c2, 0x0048, 0xe0c2, 0x0052, 0x249c, 0x4c9d,
+	0xe41e, 0x1496, 0xe42e, 0x249e, 0x4c9f, 0xe42e, 0xaf06, 0x349e,
+	0x3c9f, 0xe42e, 0xe41e, 0x1470, 0xc001, 0xe0c0, 0x0048, 0x3417,
+	0x3c18, 0xc000, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xe41e, 0x14ae, 0xe418, 0x01db, 0xe42e, 0x288c, 0xe42a,
+	0xe41e, 0x1470, 0xe0c0, 0x0048, 0x3492, 0x3c93, 0x2492, 0x4c93,
+	0xe0c1, 0x0049, 0x3692, 0x3e93, 0x2692, 0x4e93, 0xe045, 0xf033,
+	0x0682, 0x0e83, 0xa109, 0xa200, 0xb62e, 0xe42e, 0xd1b3, 0x0001,
+	0xa223, 0x2824, 0xf0ca, 0x2a0c, 0xa021, 0xa102, 0xf08a, 0x283f,
+	0xf068, 0x280c, 0x2a0d, 0xe061, 0xa021, 0xa425, 0x3e60, 0x2824,
+	0xf068, 0xe161, 0x0300, 0xa200, 0xc711, 0x3d11, 0x2827, 0x3c42,
+	0xa200, 0x3c70, 0x3c43, 0x3c44, 0xcf64, 0xcf62, 0x2866, 0xf09a,
+	0x2851, 0xa102, 0xf068, 0xa202, 0xcf62, 0xcb60, 0xa020, 0xcf60,
+	0x2844, 0x4c70, 0xf14a, 0x2836, 0xf088, 0xe41e, 0x164f, 0xf0da,
+	0xe41e, 0x0895, 0x3c43, 0xf0be, 0xe41e, 0x1677, 0xf06a, 0xa200,
+	0xe41e, 0x08e7, 0x3c43, 0xf03e, 0x2852, 0x3c43, 0x2844, 0x1843,
+	0xf680, 0xf07a, 0xe41e, 0x15dd, 0x2843, 0x3c44, 0x1852, 0xf19a,
+	0xa202, 0x3c70, 0x2824, 0xa104, 0xe01a, 0x4422, 0xf068, 0xe41e,
+	0x157f, 0xd1b3, 0x0006, 0xf06e, 0xe41e, 0x166c, 0xd1b3, 0x0002,
+	0xe428, 0x286b, 0xa002, 0x3c6b, 0x2844, 0x1852, 0xe404, 0x14f0,
+	0xa202, 0xe42e, 0xd1b3, 0x0001, 0x2827, 0x3c42, 0xa200, 0x3c43,
+	0x3c44, 0x3c33, 0xcf64, 0xcf62, 0xa2fe, 0x3c40, 0x2844, 0x1843,
+	0xf072, 0xe41e, 0x15dd, 0x2843, 0x3c44, 0x1852, 0xf35a, 0xe41e,
+	0x157f, 0x2843, 0x0832, 0x3c43, 0x1852, 0xf034, 0x2852, 0x3c43,
+	0x2833, 0xa002, 0x3c33, 0x2844, 0x1852, 0xf26a, 0x282e, 0xf678,
+	0x2844, 0x1843, 0xf094, 0xba20, 0xa102, 0xf618, 0xd1b3, 0x0002,
+	0x286b, 0xa002, 0x3c6b, 0xe41e, 0x1659, 0x3c41, 0xf12a, 0xba60,
+	0xba48, 0x3c41, 0x2840, 0xba43, 0xf038, 0xe046, 0xf758, 0xba48,
+	0x3c27, 0x2841, 0x3c33, 0x8433, 0x8232, 0xe018, 0x3c43, 0xf47e,
+	0x2852, 0x3c43, 0xf44e, 0xa22c, 0xe41e, 0x1607, 0xa17e, 0xf048,
+	0xe41e, 0x142e, 0xba6a, 0xe41e, 0x142e, 0xa202, 0xe42e, 0x2827,
+	0x3c61, 0x2832, 0x0843, 0x3c45, 0x2843, 0x3c53, 0xc70f, 0x7c50,
+	0x3454, 0x3c55, 0x2853, 0x1852, 0xe40a, 0x15d8, 0xe41e, 0x1741,
+	0xe40a, 0x15db, 0x285d, 0x3c61, 0x2853, 0xa002, 0x3c53, 0xcf64,
+	0xe41e, 0x1691, 0xe01a, 0x3c78, 0x2054, 0x4c55, 0xcf62, 0x2830,
+	0xe40a, 0x15bd, 0x2836, 0xe408, 0x15b6, 0x2853, 0x1845, 0xe408,
+	0x158a, 0x2861, 0x3c27, 0xba20, 0xa102, 0xf2ba, 0xa222, 0xe41e,
+	0x1607, 0xa102, 0xf268, 0xe41e, 0x142e, 0xf23e, 0xe41e, 0x1643,
+	0xe40a, 0x158a, 0xe41e, 0x142e, 0xf1ce, 0xd190, 0x0008, 0xcb20,
+	0xf7f8, 0xe41e, 0x162a, 0xf05a, 0xba40, 0xe41e, 0x142e, 0xf11e,
+	0xe41e, 0x1612, 0xe40a, 0x158a, 0x2855, 0x1851, 0xf06a, 0xe41e,
+	0x1836, 0xa802, 0xe408, 0x158a, 0xba40, 0xe41e, 0x142e, 0xf01e,
+	0x2853, 0x3c44, 0xe42e, 0xe16a, 0xf7ce, 0x244a, 0x4c4b, 0xe016,
+	0x3c58, 0xe016, 0x3c59, 0x2842, 0x3c5d, 0xa200, 0x3c5b, 0x3c5f,
+	0x3c5c, 0x2844, 0x3c53, 0xc70f, 0x7c50, 0x3454, 0x3c55, 0x2853,
+	0x1843, 0xf112, 0xe41e, 0x1149, 0xe41e, 0x10bb, 0x2853, 0xa002,
+	0x3c53, 0xcf64, 0xe41e, 0x1691, 0xe01a, 0x3c78, 0x2054, 0x4c55,
+	0xcf62, 0xf6ee, 0x2843, 0x1844, 0x0846, 0x3c46, 0xe42e, 0x3c48,
+	0xc869, 0xa80f, 0xe042, 0x3c49, 0x7849, 0xa203, 0x5a48, 0xa103,
+	0xe052, 0xe42e, 0xc868, 0xa80e, 0xa102, 0xb6e8, 0xa002, 0x3c48,
+	0x7848, 0xa203, 0x5a48, 0xaf03, 0xa103, 0xe046, 0xe016, 0xe42a,
+	0xa22e, 0x0848, 0x3c48, 0x7848, 0xa203, 0xae2f, 0xa103, 0xe052,
+	0xe016, 0xe42e, 0xc868, 0xa80e, 0xa102, 0xb6e8, 0xa002, 0x3c48,
+	0x7848, 0xa203, 0x5a48, 0xaf03, 0xa103, 0xe046, 0xe016, 0xe42a,
+	0x2860, 0x0848, 0x3c48, 0x7848, 0xa203, 0x5a60, 0xa103, 0xe052,
+	0xa102, 0xe016, 0xe42e, 0xc869, 0xa80f, 0x3e48, 0x7848, 0xe016,
+	0xa023, 0x3e48, 0xe42a, 0x7848, 0xa102, 0xe016, 0xe42e, 0xe41e,
+	0x142e, 0x7860, 0xa102, 0xe016, 0xe428, 0xba2c, 0xe42a, 0xba4e,
+	0xf79e, 0xba20, 0xa102, 0xf03a, 0xba40, 0xf7ce, 0xba2a, 0xa83e,
+	0x3c41, 0xe42a, 0xa13e, 0xe42a, 0x2841, 0x1833, 0xf764, 0x2841,
+	0x1832, 0xf732, 0x2841, 0xe42e, 0x2824, 0xa104, 0xf058, 0xe41e,
+	0x15dd, 0xa202, 0xe42e, 0xe41e, 0x1863, 0xa200, 0xe42e, 0xe41e,
+	0x142e, 0xba20, 0xa102, 0xf03a, 0xba4e, 0xf7ce, 0xba2a, 0xa83e,
+	0xe42a, 0xa13e, 0xe42a, 0xa03e, 0xaf08, 0xf77a, 0xe42e, 0xa200,
+	0x3c58, 0x3c5f, 0x2824, 0xe418, 0x1149, 0xa200, 0xe41e, 0x10bb,
+	0xe42e, 0xd188, 0x0001, 0x2854, 0xa002, 0x3c54, 0x1850, 0xe428,
+	0xd1b3, 0x0004, 0x3c54, 0x2855, 0xa002, 0x3c55, 0x1851, 0xe42e,
+	0xba42, 0xe000, 0x0228, 0xe09e, 0x2907, 0x0861, 0xa402, 0xa53e,
+	0x3c5d, 0xe42e, 0x2837, 0xf75a, 0xba40, 0xf0da, 0xba40, 0xae0a,
+	0x0861, 0xe000, 0x022c, 0xe09e, 0x2907, 0x0861, 0xa402, 0xa53e,
+	0x3c5d, 0xe42e, 0xba48, 0x3c5d, 0xe42e, 0xe161, 0x0300, 0x280b,
+	0xf03a, 0xa203, 0xf03e, 0x2a5b, 0xb673, 0x3f11, 0xcc45, 0xe184,
+	0x16d5, 0xe41e, 0x16d7, 0xe42d, 0x3d11, 0xe41e, 0x16d7, 0xe42d,
+	0x3d11, 0x280b, 0xf03a, 0x8111, 0x8111, 0xe190, 0xe42e, 0xb80c,
+	0xa140, 0xe42d, 0xe42a, 0x5829, 0x7629, 0x1a2a, 0xf030, 0xe046,
+	0xe046, 0xe042, 0xe42e, 0x286c, 0xa802, 0xe40a, 0x1701, 0x280c,
+	0x3c28, 0x2811, 0x3c29, 0x2812, 0x3c2a, 0xe161, 0x0300, 0x2a0b,
+	0x3f11, 0xcc45, 0xe184, 0x1700, 0xe41e, 0x16d7, 0xe42d, 0x3d11,
+	0xe41e, 0x16d7, 0xe42d, 0x3d11, 0x280b, 0xf03a, 0x8111, 0x8111,
+	0xe190, 0x286c, 0xf20a, 0xa106, 0xf1ea, 0x280d, 0x3c28, 0x2813,
+	0x3c29, 0x2814, 0x3c2a, 0xe161, 0x0300, 0x2a0b, 0x3f01, 0xe161,
+	0x0309, 0x3f11, 0xcc45, 0xe184, 0x1721, 0xe41e, 0x16d7, 0xe42d,
+	0x3d11, 0xe41e, 0x16d7, 0xe42d, 0x3d11, 0x280b, 0xf03a, 0x8111,
+	0x8111, 0xe190, 0xe42e, 0x28b0, 0x18af, 0xf02a, 0x3c69, 0x284e,
+	0x18af, 0x3c6a, 0xe42e, 0xe161, 0x0300, 0xe162, 0x0309, 0xa206,
+	0x3d11, 0x3d12, 0xe41e, 0x173e, 0x3d11, 0x3d12, 0xe42d, 0xe41e,
+	0x173e, 0x3d11, 0x3d12, 0xe41e, 0x1723, 0xe42e, 0xb80c, 0xa140,
+	0xe42e, 0x2861, 0xcf36, 0x2830, 0xe408, 0x17c5, 0x2866, 0xf0da,
+	0xe41e, 0x1836, 0xcf38, 0xa802, 0x2ac1, 0xe017, 0xe052, 0xf05a,
+	0xe004, 0x1000, 0xcf02, 0xf0ee, 0xd190, 0x0002, 0xe180, 0xe180,
+	0x289a, 0xe41a, 0x1365, 0xe181, 0xcb20, 0xf7f8, 0xcb22, 0xe408,
+	0x17c0, 0xcb02, 0x30b8, 0xaf02, 0x30b7, 0xaf02, 0x30b6, 0xaf02,
+	0x30b5, 0xaf02, 0x30c5, 0xaf02, 0x300b, 0xaf02, 0x30ab, 0xaf02,
+	0x305c, 0xaf06, 0x305b, 0xaf02, 0x3058, 0xaf02, 0x3059, 0xaf02,
+	0x3056, 0xaf02, 0xe049, 0xa807, 0x3e6c, 0xaf04, 0xe049, 0xa83f,
+	0x3e5d, 0xaf0a, 0x3c5e, 0x2859, 0xf368, 0x2856, 0x2a56, 0xe418,
+	0x1723, 0xf1d9, 0x2866, 0xf0aa, 0x286c, 0xe41a, 0x172b, 0x286c,
+	0xe418, 0x16e3, 0xe40d, 0x17c0, 0xf07e, 0x2858, 0x4cc5, 0xe41a,
+	0x16bd, 0xe40d, 0x17c0, 0x2858, 0x2a61, 0x1a26, 0xb606, 0x2a66,
+	0xb612, 0x3c5f, 0xcf26, 0xd190, 0x0001, 0x2a24, 0xe419, 0x1149,
+	0xe180, 0xe180, 0x289a, 0xe41a, 0x1365, 0xe181, 0xcb20, 0xf7f8,
+	0xa202, 0x3cbb, 0xcb22, 0xe408, 0x17c0, 0xa200, 0xe41e, 0x10bb,
+	0xa202, 0xe42e, 0xa208, 0x3c6c, 0xe41e, 0x1687, 0xa202, 0xe42e,
+	0xd191, 0x0000, 0xe16a, 0xa200, 0xe42e, 0xd190, 0x0002, 0xcb20,
+	0xf7f8, 0xcb22, 0xe408, 0x180b, 0xcb02, 0xaf0e, 0xe049, 0xa807,
+	0x3e5c, 0xaf06, 0x305b, 0xaf02, 0x3058, 0xaf02, 0x3059, 0xaf08,
+	0xe049, 0xa83e, 0x3c5d, 0xaf0b, 0x3e5e, 0x2859, 0xf298, 0x2858,
+	0xf078, 0x2839, 0x443a, 0xf02a, 0xf03e, 0xe41e, 0x16bd, 0xe40d,
+	0x180b, 0x2834, 0xe016, 0x4458, 0x3c5f, 0x2858, 0x4434, 0xae02,
+	0x4c5f, 0xcf26, 0xd190, 0x0001, 0x2824, 0xe418, 0x1149, 0xe180,
+	0xe180, 0x289a, 0xe41a, 0x1365, 0xe181, 0xcb21, 0xf7f9, 0xcb22,
+	0xe408, 0x180b, 0xa200, 0xe41e, 0x10bb, 0xa202, 0xe42e, 0xe41e,
+	0x1687, 0xa202, 0xe42e, 0xd191, 0x0000, 0xe16a, 0xa200, 0xe42e,
+	0x2854, 0xaf04, 0xe000, 0x0400, 0xe09e, 0x2a54, 0xa807, 0xa107,
+	0xe013, 0xae05, 0x3e00, 0xa21f, 0x5a00, 0xa2fe, 0xe059, 0x2907,
+	0xe052, 0x2a59, 0xf05b, 0x5a00, 0xe056, 0x3d07, 0xf0ae, 0x2ab5,
+	0xae03, 0x4eb6, 0xae03, 0x4e0b, 0xae03, 0x5a00, 0xe056, 0x3d07,
+	0x2854, 0xa002, 0x1850, 0xe41a, 0x1848, 0xe42e, 0x2854, 0xe41a,
+	0x184a, 0x2854, 0xaf04, 0xe000, 0x0400, 0xe092, 0x2a54, 0xa807,
+	0xa107, 0xe013, 0xae05, 0x3e00, 0x2901, 0x5c00, 0xa81e, 0xe42e,
+	0xa204, 0xf02e, 0xa206, 0x3c06, 0xe0c0, 0x0041, 0xe005, 0x0026,
+	0xae11, 0xe042, 0x2a55, 0xae0d, 0xe042, 0xca29, 0xf7f9, 0xe180,
+	0xce20, 0xd111, 0x0400, 0xd112, 0x0020, 0x8806, 0x0113, 0xca28,
+	0xf7f8, 0xe181, 0xe42e, 0x2827, 0x3c61, 0x2832, 0x0843, 0x3c45,
+	0xe160, 0x0006, 0x2824, 0xf0a8, 0xe41e, 0x18a9, 0xe40a, 0x18a7,
+	0xe41e, 0x1910, 0xe40a, 0x18a7, 0xf09e, 0xe41e, 0x1947, 0xe40a,
+	0x18a7, 0xe41e, 0x19b1, 0xe40a, 0x18a7, 0xa200, 0x3c4f, 0x2843,
+	0x3c53, 0xc70f, 0x7c50, 0x3454, 0x3c55, 0x2827, 0x3c61, 0x3c5d,
+	0x2853, 0x1852, 0xe40a, 0x18a4, 0xe41e, 0x1a33, 0xe40a, 0x18a7,
+	0x285d, 0x3c61, 0x2853, 0xa002, 0x3c53, 0xcf64, 0xe41e, 0x1691,
+	0xe01a, 0x3c78, 0x2054, 0x4c55, 0xcf62, 0x2853, 0x1845, 0xe408,
+	0x1888, 0xba40, 0xe41e, 0x142e, 0x2853, 0x3c44, 0xe42e, 0xe16a,
+	0xf7ce, 0xd1b3, 0x0020, 0xa200, 0x3c67, 0xe161, 0x0800, 0xe004,
+	0x0800, 0x3c68, 0x2843, 0x3c53, 0x2853, 0x1852, 0xe402, 0x1905,
+	0x2861, 0xcf36, 0xd199, 0x0000, 0xa203, 0x2861, 0x1826, 0xb605,
+	0x3e5f, 0xa909, 0xcf27, 0xd190, 0x0002, 0xcb20, 0xf7f8, 0xcb22,
+	0xe408, 0x190a, 0xcb02, 0xaf04, 0x30b6, 0xaf02, 0x30b5, 0xaf04,
+	0x300b, 0xa200, 0x3c59, 0xcb02, 0xaf20, 0xe049, 0xa8fe, 0xae02,
+	0x4c5f, 0xae06, 0xa908, 0x3d11, 0xa83f, 0x3e5d, 0x2a5f, 0xf0bb,
+	0xcb2c, 0x3511, 0x3d11, 0xcb2e, 0x3511, 0x3d11, 0xcb30, 0x3511,
+	0x3d11, 0xf02e, 0x8131, 0xe082, 0xe002, 0x08f0, 0xf084, 0xe41e,
+	0x1a9f, 0x2867, 0xa002, 0x3c67, 0xe161, 0x0800, 0x285f, 0xf058,
+	0xd190, 0x0008, 0xcb20, 0xf7f8, 0x285d, 0x3c61, 0x2853, 0xa002,
+	0x3c53, 0xcb32, 0xa808, 0xe40a, 0x18b4, 0xba64, 0x2a53, 0x3e45,
+	0xa202, 0xe42e, 0xd191, 0x0000, 0x2843, 0x3c53, 0xa200, 0xe42e,
+	0x1a43, 0xa103, 0xcc45, 0x2867, 0xf07a, 0xe41e, 0x1a9f, 0xa200,
+	0x3c67, 0xe41e, 0x1aa1, 0xe161, 0x0800, 0xe184, 0x1936, 0xba40,
+	0xb809, 0xf22d, 0xae08, 0xe056, 0xae16, 0x2b01, 0xe056, 0x3d11,
+	0x8131, 0xe082, 0xe002, 0x08f0, 0xf0a4, 0xe41e, 0x1a9f, 0x2867,
+	0xa002, 0x3c67, 0xe41e, 0x1aa1, 0xe161, 0x0800, 0xe190, 0x2867,
+	0xf09a, 0xe41e, 0x1a9f, 0xa200, 0x3c67, 0xe41e, 0x1aa1, 0xa202,
+	0x3c67, 0xa202, 0xe42e, 0x2843, 0x3c53, 0xa200, 0xe42e, 0xd1b3,
+	0x0020, 0xa200, 0x3c67, 0xe161, 0x0800, 0x2843, 0xe005, 0x0800,
+	0x3c53, 0x3e68, 0x2853, 0x1852, 0xe402, 0x19a8, 0xba40, 0xe40a,
+	0x195c, 0x3d11, 0xe40e, 0x1987, 0xb802, 0xa10e, 0xe40d, 0x19ad,
+	0xf76a, 0xa00e, 0x3058, 0xaf02, 0x305a, 0xaf02, 0x305b, 0xaf02,
+	0x3c01, 0x285a, 0xae04, 0x4c01, 0xae0e, 0x4c58, 0xae02, 0x4c5b,
+	0xae02, 0x3d11, 0x2858, 0xf118, 0x285b, 0xb670, 0xcc44, 0xe184,
+	0x1982, 0xe41e, 0x16d7, 0xe40d, 0x19ad, 0x3d11, 0xe41e, 0x16d7,
+	0xe40d, 0x19ad, 0x3d11, 0xf04e, 0x2858, 0xf02a, 0x8131, 0xe082,
+	0xe002, 0x08f0, 0xf084, 0xe41e, 0x1a9f, 0x2867, 0xa002, 0x3c67,
+	0xe161, 0x0800, 0x2853, 0xa002, 0x3c53, 0xd199, 0x0002, 0xd190,
+	0x0008, 0xcb20, 0xf7f8, 0xcb32, 0xa808, 0xe40a, 0x1952, 0xcb02,
+	0xaf04, 0x30b6, 0xaf02, 0x30b5, 0xaf04, 0x300b, 0xaf0e, 0x3059,
+	0xba60, 0x2a53, 0x3e45, 0xa202, 0xe42e, 0x2843, 0x3c53, 0xa200,
+	0xe42e, 0x1a43, 0xa103, 0xcc45, 0x2867, 0xf07a, 0xe41e, 0x1a9f,
+	0xa200, 0x3c67, 0xe41e, 0x1aa1, 0xe161, 0x0800, 0xe184, 0x1a20,
+	0x2901, 0x3c00, 0xe049, 0xa803, 0xe40b, 0x19cb, 0x2861, 0x3c5d,
+	0x3f11, 0xe40e, 0x1a12, 0xaf02, 0x305b, 0xaf02, 0x3058, 0xaf12,
+	0x305a, 0x2858, 0xae04, 0x4c5a, 0xae12, 0xcf02, 0x2861, 0xcf36,
+	0x2858, 0x2a61, 0x1a26, 0xb606, 0x3c5f, 0xa908, 0xcf26, 0xd190,
+	0x0002, 0x2800, 0xe008, 0x07ff, 0x3c00, 0xcb20, 0xf7f8, 0xcb22,
+	0xe408, 0x1a2d, 0xcb02, 0xaf0e, 0x305c, 0xaf12, 0xa23f, 0xe051,
+	0x3e5d, 0xaf0e, 0x3c5e, 0x285c, 0xae08, 0x4c5e, 0xae0e, 0x4c5d,
+	0xae02, 0x4c5f, 0xae06, 0x4c00, 0x3d11, 0x2858, 0xf0fa, 0x285f,
+	0xf0ba, 0xcb2c, 0x3511, 0x3d11, 0xcb2e, 0x3511, 0x3d11, 0xcb30,
+	0x3511, 0x3d11, 0xf08e, 0x8131, 0xf06e, 0x8111, 0x8111, 0x285b,
+	0xf02a, 0x8131, 0xe082, 0xe002, 0x08f0, 0xf0a4, 0xe41e, 0x1a9f,
+	0x2867, 0xa002, 0x3c67, 0xe41e, 0x1aa1, 0xe161, 0x0800, 0x285d,
+	0x3c61, 0x2867, 0xf09a, 0xe41e, 0x1a9f, 0xa200, 0x3c67, 0xe41e,
+	0x1aa1, 0xa202, 0x3c67, 0xa202, 0xe42e, 0xd191, 0x0000, 0x2843,
+	0x3c53, 0xa200, 0xe42e, 0x2861, 0xcf36, 0x2868, 0xe092, 0x2911,
+	0x3059, 0x2a59, 0xe409, 0x1a92, 0xaf02, 0x305b, 0xaf02, 0x3058,
+	0xaf02, 0x305f, 0xaf02, 0xa23f, 0xe051, 0x3e5d, 0xaf0a, 0xa27f,
+	0xe051, 0x3e5e, 0xaf0c, 0x3c5c, 0x2858, 0xf0c8, 0xe162, 0x0301,
+	0xa20e, 0x2a5b, 0xb636, 0xcc44, 0xe184, 0x1a57, 0x2911, 0x3d12,
+	0xf0ee, 0x285f, 0xf0ba, 0x2111, 0x4d11, 0xcf2c, 0x2111, 0x4d11,
+	0xcf2e, 0x2111, 0x4d11, 0xcf30, 0xf02e, 0x8131, 0x285e, 0xae08,
+	0x4c59, 0xae02, 0x4c58, 0xae02, 0x4c5b, 0xae14, 0xcf02, 0x285f,
+	0xcf26, 0xd190, 0x0001, 0x2824, 0xe418, 0x1149, 0xe180, 0xe180,
+	0x289a, 0xe41a, 0x1365, 0xe181, 0xcb20, 0xf7f8, 0xcb22, 0xf188,
+	0xa200, 0xe41e, 0x10bb, 0xe082, 0x3c68, 0xe002, 0x08f0, 0xf094,
+	0xe41e, 0x1aa1, 0x2867, 0xa002, 0x3c67, 0xe004, 0x0800, 0x3c68,
+	0xa202, 0xe42e, 0xd181, 0x1000, 0xe41e, 0x1687, 0xf6de, 0xd191,
+	0x0000, 0xe16a, 0x2846, 0xa002, 0x3c46, 0xa200, 0xe42e, 0xa204,
+	0xf02e, 0xa206, 0x3c06, 0xe0c0, 0x0046, 0xe005, 0x00a9, 0x0a67,
+	0x0a67, 0xae11, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0800,
+	0xd112, 0x0100, 0x2806, 0xce26, 0xca28, 0xf7f8, 0xe42e, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0080, 0x0060, 0x0008, 0x0006,
+	0x00b0, 0x0090, 0x000b, 0x0009, 0x0160, 0x0120, 0x0016, 0x0012,
+	0x02c0, 0x0240, 0x0058, 0x0012, 0x0580, 0x0480, 0x0160, 0x0012,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0063, 0x000d, 0x000f, 0x0011, 0x0013, 0x0015, 0x0017, 0x0000,
+	0xffff, 0xfffe, 0x0001, 0x0002, 0x0000, 0x0002, 0xffff, 0xffff,
+	0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xfffe,
+	0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe,
+	0xfffe, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd,
+	0xfffd, 0xfffd, 0xfffd, 0xfffd, 0x0000, 0x0001, 0x0001, 0x0001,
+	0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0002,
+	0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002,
+	0x0002, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003,
+	0x0003, 0x0002, 0x0001, 0xfffb, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c32, 0xf0b4, 0xe04a, 0xaf10,
+	0x1830, 0xf074, 0xe009, 0x00ff, 0x1a31, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0b17, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x0368, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0429, 0xe40e, 0x00a4,
+	0xe41e, 0x0473, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x0474,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x055c, 0xe40e, 0x00a4,
+	0xe41e, 0x058d, 0xe40e, 0x00a4, 0xe0c1, 0x0044, 0xa80f, 0xe056,
+	0xe42e, 0xa200, 0xe41e, 0x036c, 0xe42e, 0xe0c1, 0x0044, 0xaf0d,
+	0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039,
+	0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166, 0x0400, 0xe167,
+	0x0500, 0x282c, 0xf166, 0xa102, 0xcc44, 0xe184, 0x03af, 0xa200,
+	0xe41e, 0x036c, 0xaf04, 0xe41e, 0x0375, 0xae20, 0x2e40, 0xe056,
+	0x9f17, 0x2030, 0x4c31, 0xae08, 0x9f17, 0xe41e, 0x03b5, 0xe190,
+	0xe190, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0,
+	0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a,
+	0xe0c0, 0x0061, 0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785,
+	0xe018, 0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db,
+	0xa200, 0xe41e, 0x0371, 0xa80e, 0xaf04, 0xe41e, 0x0375, 0xe41e,
+	0x037d, 0xe40b, 0x03e8, 0xa81e, 0xe41e, 0x0382, 0xae09, 0xe056,
+	0xae20, 0xe0c1, 0x006e, 0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0,
+	0x0060, 0xa822, 0xa122, 0xf04a, 0x2030, 0x4c31, 0xf03e, 0x2031,
+	0x4c30, 0xae08, 0x9f17, 0xe0c0, 0x0062, 0x9f17, 0xe0c0, 0x0063,
+	0x9f17, 0xe0c0, 0x0064, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e,
+	0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11, 0xe042, 0xce20,
+	0xd111, 0x0400, 0xd112, 0x00c0, 0x88ec, 0x0113, 0xca29, 0xf7f9,
+	0xe190, 0xe42e, 0xe42e, 0xe42e, 0xe0c0, 0x0060, 0xe049, 0xa81f,
+	0x3e45, 0xaf08, 0x3044, 0xe0c0, 0x0065, 0xaf04, 0xa80e, 0x3c5a,
+	0xe42e, 0xe41e, 0x0148, 0xe41e, 0x023a, 0xa200, 0xcc4a, 0xcc4c,
+	0xd130, 0x0003, 0xd04b, 0x0001, 0xd04c, 0x0000, 0xd008, 0x0000,
+	0xd03a, 0x0000, 0xa200, 0x3c7f, 0xe41e, 0x0acd, 0xa100, 0xf07a,
+	0xe41e, 0x074f, 0xa100, 0xf03a, 0xa202, 0x3c7f, 0xa23e, 0x3cf0,
+	0xe41e, 0x044d, 0xe41e, 0x0b7b, 0xe42e, 0xa200, 0xe0c2, 0x0074,
+	0xe0c2, 0x0076, 0xe0c2, 0x0077, 0xe0c2, 0x0079, 0xe0c2, 0x007a,
+	0x287f, 0xe016, 0x58f0, 0xe0c2, 0x0078, 0xa2fe, 0xe0c2, 0x0072,
+	0xe0c2, 0x006d, 0xe0c0, 0x0062, 0x3041, 0x2841, 0xae02, 0xa004,
+	0xe0c2, 0x0073, 0x20b5, 0x4cb6, 0xe0c2, 0x0071, 0x287f, 0xe0c2,
+	0x0070, 0xa202, 0xe42e, 0xe42e, 0xa200, 0xcc44, 0xcc4a, 0xcc4c,
+	0x3cb0, 0x3cb1, 0x3c33, 0x3c29, 0x3c28, 0x28b7, 0xf0b8, 0xa202,
+	0x3c50, 0x2831, 0xc70f, 0x7c50, 0x3c50, 0x8430, 0x8250, 0xe018,
+	0x3c50, 0xe41e, 0x041c, 0xe41e, 0x05a8, 0xd130, 0x0003, 0xd008,
+	0x0000, 0xd03a, 0x0000, 0xe41e, 0x0af8, 0xe41e, 0x038c, 0xe41e,
+	0x03bf, 0xe41e, 0x025f, 0xa2fe, 0xe0c2, 0x0077, 0xa2fa, 0xe0c2,
+	0x0071, 0xa202, 0xe0c2, 0x0076, 0xe41e, 0x0b45, 0xe408, 0x04f3,
+	0x2a2e, 0xe419, 0x074f, 0xe41e, 0x0790, 0xe40a, 0x04f8, 0xe41e,
+	0x05d9, 0xe42a, 0xa2fc, 0xe0c2, 0x0077, 0xd130, 0x0003, 0xd03a,
+	0x0003, 0xd04b, 0x0001, 0xd04c, 0x0000, 0xd008, 0x0000, 0xa200,
+	0xe0c2, 0x030a, 0x3c29, 0xe41e, 0x06e7, 0xe40a, 0x04f8, 0xe0c0,
+	0x0065, 0xaf04, 0xa80e, 0x3c3b, 0xf0fa, 0x283b, 0xa104, 0xf0c0,
+	0x2822, 0xf0aa, 0xa2fa, 0xe0c2, 0x0071, 0x2822, 0xe0c2, 0x0073,
+	0xe41e, 0x0b81, 0xe42e, 0xe41e, 0x038c, 0xe41e, 0x03bf, 0xe41e,
+	0x025f, 0xe41e, 0x07b0, 0xe424, 0x2825, 0xf0a8, 0xa200, 0x3c28,
+	0x2832, 0x3c27, 0xe41e, 0x065e, 0xa200, 0x3c29, 0xf05e, 0xe41e,
+	0x05fd, 0xe40a, 0x04f8, 0xe41e, 0x04fc, 0xe41e, 0x0b81, 0xe42e,
+	0xa200, 0xe0c2, 0x0076, 0xf78e, 0xa200, 0xe0c2, 0x0075, 0xe0c2,
+	0x0078, 0xe0c2, 0x0079, 0xe0c2, 0x007d, 0xe0c2, 0x007e, 0x2890,
+	0xf038, 0xe41e, 0x0960, 0x2c2b, 0xa002, 0x3c2b, 0xe0c2, 0x0070,
+	0x2822, 0xe0c2, 0x0073, 0x20b5, 0x4cb6, 0xe0c2, 0x006f, 0xa2fe,
+	0xe0c2, 0x007c, 0xe167, 0x0005, 0x2117, 0x4d17, 0xe0c2, 0x007e,
+	0x2117, 0x4d07, 0xe0c2, 0x007d, 0x2829, 0xe0c2, 0x0072, 0xc84a,
+	0xc84d, 0xae20, 0xe056, 0xe0c2, 0x0053, 0xe41e, 0x05c2, 0x2890,
+	0xf20a, 0xe0c0, 0x0077, 0x2a90, 0xb7d2, 0xe0c2, 0x0077, 0x2a44,
+	0xf03b, 0x288d, 0xf06a, 0xa2fe, 0xe0c2, 0x0071, 0xa202, 0xe42e,
+	0xa202, 0x3c8d, 0x2a79, 0x3e7b, 0x287a, 0x3c7d, 0xa2fe, 0xe0c2,
+	0x0071, 0xa2fc, 0xe0c2, 0x0077, 0xe41e, 0x0936, 0xe41e, 0x05e8,
+	0xe42e, 0x2834, 0xa002, 0x3c34, 0x1830, 0xe428, 0x3c34, 0x2835,
+	0xa002, 0x3c35, 0x1831, 0xe42e, 0xe41e, 0x079d, 0xe41e, 0x0174,
+	0xca29, 0xf7f9, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0400, 0xd112,
+	0x00c0, 0xd113, 0x0003, 0xca29, 0xf7f9, 0xe0c0, 0x0060, 0x3c2c,
+	0xe0c0, 0x0061, 0x3c40, 0xe41e, 0x099f, 0xe41e, 0x038c, 0xe42e,
+	0xe0c0, 0x0040, 0xa269, 0xae17, 0xe042, 0xe005, 0x0f00, 0xae03,
+	0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0300, 0xd112, 0x0100,
+	0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e, 0xe180, 0xe41e, 0x099f,
+	0xa200, 0x3c1d, 0x3c90, 0xe167, 0x04c0, 0xe166, 0x0054, 0xa200,
+	0x3c2d, 0x282c, 0xa102, 0xcc44, 0xe184, 0x05a5, 0x9e06, 0x5c2d,
+	0xa802, 0xb690, 0x3d17, 0x282d, 0xa002, 0x3c2d, 0xe190, 0xe42e,
+	0xa200, 0x3c3c, 0xe004, 0x0054, 0xe09c, 0x282c, 0xa102, 0xcc44,
+	0xe184, 0x05c0, 0x9e06, 0x5c3c, 0xa802, 0xf058, 0x283c, 0xe41e,
+	0x09da, 0xf05e, 0x283c, 0xa209, 0xe41e, 0x09d3, 0x2a3c, 0xa003,
+	0x3e3c, 0xe42e, 0xe004, 0x04c0, 0xe09e, 0xe004, 0x0054, 0xe09c,
+	0x282c, 0xa102, 0xcc44, 0xa200, 0x3c3c, 0xe184, 0x05d6, 0x2b17,
+	0xaf05, 0xa803, 0x5a3c, 0xe056, 0x2a3c, 0xa003, 0x3e3c, 0x9f06,
+	0xe42e, 0xe161, 0x04c0, 0x282c, 0xa102, 0xcc44, 0xa200, 0xe184,
+	0x05e4, 0x2b11, 0xa80d, 0xe01b, 0xe042, 0x182c, 0xe01a, 0xe42e,
+	0xe41e, 0x0923, 0xa200, 0x3c34, 0x3c35, 0xa202, 0x3c47, 0xe41e,
+	0x09f7, 0xe41e, 0x0551, 0xf7c8, 0xa200, 0x3c47, 0xe41e, 0x09f7,
+	0xe190, 0xe0c1, 0x014b, 0xf7e9, 0xe42e, 0x2824, 0xe0c2, 0x0115,
+	0xa202, 0xcf66, 0xa200, 0x3c33, 0x3c28, 0xcf64, 0xcf62, 0xa200,
+	0x3c51, 0x2833, 0x0850, 0x3c51, 0x2a51, 0x1a32, 0xf037, 0x2a32,
+	0x3e51, 0xe41e, 0x0635, 0x2a3a, 0xa003, 0x3e3a, 0x1851, 0xf0b4,
+	0x2851, 0x1832, 0xf6f4, 0x2822, 0xe41a, 0x0624, 0xe41e, 0x074a,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xa200, 0x3c59, 0xc873, 0x2089,
+	0x4c88, 0xe045, 0x2403, 0x4c02, 0xae06, 0xe046, 0xa122, 0xe424,
+	0xba48, 0xba54, 0xba40, 0x3c59, 0xe42e, 0x2833, 0xc70f, 0x7c30,
+	0x3434, 0x3c35, 0x2833, 0xe002, 0x0094, 0xf028, 0xe190, 0xe41e,
+	0x067e, 0xe40a, 0x0655, 0xe41e, 0x06cd, 0x2034, 0x4c35, 0xcf62,
+	0x2833, 0xe002, 0x00c8, 0xf028, 0xe190, 0x2833, 0x1851, 0xf6b8,
+	0xa204, 0xcf66, 0x2833, 0x3c28, 0xe42e, 0x2833, 0x3c28, 0x2851,
+	0x3c27, 0xe41e, 0x065e, 0x2833, 0xe16a, 0xf73e, 0x2c2b, 0xe016,
+	0x3c36, 0xe016, 0x3c37, 0xa200, 0x3c38, 0x2828, 0x3c33, 0xc70f,
+	0x7c30, 0x3434, 0x3c35, 0x2833, 0x1827, 0xf0c2, 0x2822, 0xe418,
+	0x0ac1, 0xe41e, 0x097a, 0xe41e, 0x06cd, 0x2034, 0x4c35, 0xcf62,
+	0xf73e, 0x2827, 0x1828, 0x0829, 0x3c29, 0xe42e, 0x2853, 0xae06,
+	0xcf26, 0xd190, 0x0002, 0xcb20, 0xf7f8, 0xcb22, 0xe408, 0x06c0,
+	0xcb02, 0xaf0e, 0x3038, 0xaf08, 0x3036, 0xaf02, 0x3037, 0xaf12,
+	0x3c39, 0x2836, 0x4c37, 0xe41a, 0x0aac, 0x2836, 0x4c37, 0xe418,
+	0x06e1, 0x2822, 0xf068, 0x8839, 0x0182, 0xe190, 0xcb04, 0x3c39,
+	0x2837, 0x4422, 0xe418, 0x0ac1, 0xe40d, 0x06c0, 0x2837, 0xf158,
+	0x2836, 0xcf26, 0x2839, 0xae08, 0x4c37, 0xae02, 0x4c36, 0xae16,
+	0xcf02, 0xd190, 0x0001, 0x2822, 0xe418, 0x0ac1, 0xf0ad, 0xcb20,
+	0xf7f8, 0xcb22, 0xe408, 0x06c0, 0xe41e, 0x097a, 0xa202, 0xe42e,
+	0xd191, 0x0000, 0xe16a, 0xe41e, 0x06cd, 0x2034, 0x4c35, 0xcf62,
+	0x2829, 0xa002, 0x3c29, 0xa200, 0xe42e, 0xa202, 0xcf10, 0x2833,
+	0xa002, 0x3c33, 0xcf64, 0x2834, 0xa002, 0x3c34, 0x1830, 0xe428,
+	0xa208, 0xcf66, 0xa200, 0x3c34, 0x2835, 0xa002, 0x3c35, 0x1831,
+	0xe42e, 0xa201, 0xe161, 0x04e0, 0x3f11, 0x3f11, 0xe42e, 0xc872,
+	0x3c88, 0x3489, 0xba42, 0x3c22, 0x3c26, 0xba48, 0x3c24, 0x2822,
+	0xf2d8, 0xa202, 0x3cb7, 0xa224, 0x3c56, 0xa228, 0x3c57, 0xa22c,
+	0x3c55, 0xa232, 0x3c54, 0xa202, 0x3c23, 0xba48, 0xa12c, 0xe406,
+	0x0748, 0x3c50, 0x2831, 0xc70f, 0x7c50, 0x3c50, 0x8430, 0x8250,
+	0xe018, 0x3c50, 0xba40, 0xf05a, 0xba40, 0xa235, 0xe042, 0x3c54,
+	0xba40, 0xf05a, 0xba40, 0xa22f, 0xe042, 0x3c55, 0xba40, 0xa225,
+	0xe042, 0x3c56, 0xa004, 0x3c57, 0xf27e, 0xa224, 0x3c56, 0xa228,
+	0x3c57, 0xa22c, 0x3c55, 0xa232, 0x3c54, 0xa238, 0x3c58, 0x2859,
+	0xf04a, 0x2823, 0xe016, 0xf02e, 0xa200, 0x3c23, 0xba40, 0x3c53,
+	0xba40, 0xf08a, 0xba41, 0xa22e, 0xe042, 0x3c55, 0xa234, 0xe042,
+	0x3c54, 0xba40, 0xa225, 0xe042, 0x3c56, 0xa004, 0x3c57, 0xba40,
+	0xa239, 0xe042, 0x3c58, 0xa202, 0x3c25, 0xa202, 0xe42e, 0xba7e,
+	0xa200, 0xe42e, 0xc868, 0xa80e, 0x3c2a, 0x742a, 0xe42e, 0xba7e,
+	0xe005, 0x0043, 0xae11, 0xa99d, 0xae11, 0xa99b, 0xae11, 0xa9ad,
+	0xe046, 0xe408, 0x078e, 0xe41e, 0x0a9c, 0x3c00, 0xe41e, 0x0a9c,
+	0x3c01, 0xba7e, 0x3402, 0x3c03, 0xe41e, 0x0a9c, 0x3cb5, 0xe41e,
+	0x0a9c, 0x3cb6, 0xe41e, 0x0aa1, 0x3404, 0x3c05, 0xe41e, 0x0aa1,
+	0x3406, 0x3c07, 0xe41e, 0x0aa1, 0x3408, 0x3c09, 0xba7e, 0x28b5,
+	0xa01e, 0xaf08, 0xae08, 0x3c70, 0x28b6, 0xa01e, 0xaf08, 0xae08,
+	0x3c71, 0x2870, 0xa01e, 0xaf08, 0x3c30, 0x2871, 0xa01e, 0xaf08,
+	0x3c31, 0x8430, 0x8231, 0xe018, 0x3c32, 0xe42e, 0x2800, 0xe42e,
+	0xe41e, 0x0aa1, 0xf09a, 0xd022, 0x0007, 0xe184, 0x0798, 0xba4e,
+	0xe190, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe167, 0x0080, 0xe0c0,
+	0x0064, 0x3517, 0x3d17, 0xe0c0, 0x0065, 0x3517, 0x3d17, 0xe0c0,
+	0x0066, 0x3517, 0x3d17, 0xe0c0, 0x0067, 0x3517, 0x3d17, 0xe42e,
+	0xa200, 0xcf24, 0xcf46, 0xcf68, 0xe0c2, 0x0104, 0xe0c2, 0x017f,
+	0xe0c2, 0x0149, 0xe0c2, 0x0308, 0xe0c2, 0x030d, 0xe0c2, 0x0309,
+	0xe0c2, 0x030a, 0xe0c2, 0x030b, 0xcc8e, 0xe0c2, 0x0320, 0xa246,
+	0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x0128, 0x2a44, 0xb692, 0xae08,
+	0xa92c, 0xe0c2, 0x017c, 0xe004, 0x0014, 0xe0c2, 0x017d, 0xe0c0,
+	0x0050, 0xe049, 0xe008, 0x007f, 0x3c48, 0xaf11, 0xe009, 0x007f,
+	0x3e49, 0x4648, 0x3e48, 0xa200, 0x2a48, 0xa803, 0xf03b, 0xe00a,
+	0x0002, 0x2a48, 0xa805, 0xf03b, 0xe00a, 0x0009, 0x2a48, 0xa809,
+	0xf03b, 0xe00a, 0x0020, 0x2a48, 0xa811, 0xf03b, 0xe00a, 0x0040,
+	0xe0c2, 0x040c, 0xe0c1, 0x0046, 0xe004, 0x0044, 0xae10, 0xe042,
+	0x2a49, 0xa809, 0xf05b, 0xe161, 0x0084, 0x2111, 0x4d11, 0xe0c2,
+	0x0211, 0xe0c1, 0x0046, 0xe004, 0x0080, 0xae10, 0xe042, 0x2a49,
+	0xa811, 0xf05b, 0xe161, 0x0086, 0x2111, 0x4d11, 0xe0c2, 0x0212,
+	0x2854, 0xa132, 0xae04, 0xe049, 0x2855, 0xa12c, 0xe055, 0xae03,
+	0x2856, 0xa124, 0xe055, 0xcf2b, 0xe0c1, 0x0046, 0xe004, 0x003c,
+	0xae10, 0xe042, 0x2a49, 0xa803, 0xf05b, 0xe161, 0x0080, 0x2111,
+	0x4d11, 0xcf44, 0xa220, 0x4c22, 0xae02, 0xcf00, 0xa200, 0xcf46,
+	0x2830, 0xae20, 0x4c31, 0xae08, 0xe0c2, 0x0101, 0xe0c2, 0x0205,
+	0xcf60, 0xe0c0, 0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0x2a49,
+	0xa805, 0xf05b, 0xe161, 0x0082, 0x2111, 0x4d11, 0xe0c2, 0x0103,
+	0xa200, 0xe41e, 0x036c, 0xe0c2, 0x0102, 0x2841, 0xb6d5, 0xb611,
+	0x287b, 0xe412, 0x09cc, 0x2879, 0x3c7b, 0xa205, 0xe412, 0x09d3,
+	0xe41e, 0x09af, 0xe0c2, 0x0077, 0x3c79, 0xb7a8, 0x3c7a, 0x2a41,
+	0xf15b, 0x2879, 0xa203, 0xe412, 0x09cc, 0xe41e, 0x09af, 0x3c7c,
+	0x3c7a, 0xa209, 0xe412, 0x09cc, 0x287a, 0xf082, 0xa2fa, 0xe0c2,
+	0x0071, 0xa2fe, 0xe0c2, 0x0077, 0xe42e, 0xa206, 0xae08, 0x4c22,
+	0xae06, 0xe0c2, 0x0204, 0xa204, 0x1841, 0xe0c2, 0x0210, 0xa200,
+	0xe0c2, 0x0215, 0xe41e, 0x036c, 0xe0c1, 0x0210, 0xa803, 0xae11,
+	0xe056, 0xe0c2, 0x0213, 0xa204, 0xe0c2, 0x0208, 0x2a79, 0xe0c3,
+	0x020b, 0x2841, 0xf04a, 0x287c, 0xe0c2, 0x0214, 0x287b, 0xe404,
+	0x08c3, 0xa202, 0xe0c2, 0x0302, 0x287b, 0xf032, 0x2879, 0xb608,
+	0xe0c2, 0x0380, 0xe004, 0x0055, 0xe0c2, 0x030c, 0xa208, 0x4c23,
+	0xe0c2, 0x0303, 0xa20e, 0xe0c2, 0x0312, 0xe0c0, 0x0414, 0xe418,
+	0x018c, 0xe0c0, 0x0414, 0xe41a, 0x08fa, 0xa200, 0xe0c2, 0x0308,
+	0xa200, 0xe0c2, 0x0302, 0xa200, 0x3c44, 0x3c45, 0xa202, 0x3c47,
+	0x287d, 0xf254, 0xe0c0, 0x0060, 0xe049, 0xaf08, 0xf20a, 0x3044,
+	0xa81f, 0x3e45, 0x287d, 0xe0c2, 0x0143, 0xa200, 0xe41e, 0x036c,
+	0xe0c2, 0x017f, 0x2830, 0xa102, 0xae20, 0x4c31, 0xa102, 0xe0c2,
+	0x0142, 0xe41e, 0x0371, 0xae20, 0x2a44, 0xf02b, 0x4c45, 0xe0c2,
+	0x014e, 0xe0c0, 0x0061, 0xa87e, 0xe0c2, 0x0144, 0x287a, 0x3c7d,
+	0xe0c2, 0x0071, 0xa202, 0x3c3a, 0xe41e, 0x0274, 0xa202, 0xe0c2,
+	0x0106, 0xe42e, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152,
+	0x2b17, 0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1,
+	0x0101, 0xe0c3, 0x015d, 0x2a7b, 0xae21, 0xe167, 0x01a2, 0x2907,
+	0xaf10, 0xe008, 0x001b, 0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2,
+	0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0,
+	0x0151, 0xf7e8, 0xe42e, 0xa246, 0xe0c2, 0x0100, 0x2a44, 0xb692,
+	0xae08, 0xa92c, 0xe0c2, 0x017c, 0xe004, 0x0014, 0xe0c2, 0x017d,
+	0xa200, 0xe41e, 0x036c, 0xe0c2, 0x0102, 0xe42e, 0xe0c0, 0x0060,
+	0xe049, 0xa81e, 0x3c45, 0xaf09, 0x3244, 0x287d, 0xe0c2, 0x0143,
+	0xa200, 0xe0c2, 0x017f, 0xe0c2, 0x0149, 0xa200, 0xe41e, 0x036c,
+	0xe0c2, 0x017f, 0x2830, 0xa102, 0xae20, 0x4c31, 0xa102, 0xe0c2,
+	0x0142, 0xe41e, 0x0371, 0xae20, 0x2a44, 0xf02b, 0x4c45, 0xe0c2,
+	0x014e, 0xe0c0, 0x0061, 0xa87e, 0xe0c2, 0x0144, 0xa203, 0xe42e,
+	0x2824, 0x3c43, 0xe0c0, 0x0111, 0xf7e8, 0x2844, 0xe42a, 0xa204,
+	0xae0e, 0x4c30, 0xa102, 0xae0e, 0x4c31, 0xa102, 0xe0c1, 0x014b,
+	0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0xe0c1, 0x014b,
+	0xf7e9, 0xe42e, 0xa27f, 0x2836, 0xf028, 0x2a39, 0xe0c3, 0x012a,
+	0x2836, 0xe0c2, 0x0114, 0x2841, 0xf06a, 0x2837, 0xe016, 0xae0a,
+	0x4c24, 0xcf6a, 0xe41e, 0x0996, 0xe0c0, 0x0111, 0xf7e8, 0xa202,
+	0xe0c2, 0x0110, 0x2844, 0xe418, 0x09f7, 0xe42e, 0x283a, 0xe0c2,
+	0x0131, 0xa200, 0x3c3a, 0x4c38, 0xe0c2, 0x0130, 0xe42e, 0xa2fe,
+	0x3c7b, 0x3c79, 0x3c7a, 0x3c7d, 0xa200, 0x3c7e, 0x2a2c, 0xa103,
+	0xcc45, 0xe161, 0x04c0, 0xe184, 0x09ad, 0x3d11, 0xe42e, 0x287e,
+	0x3c3c, 0x283c, 0xe000, 0x04c0, 0xe092, 0x2901, 0xf0ca, 0x283c,
+	0xa002, 0x3c3c, 0x182c, 0xf028, 0x3c3c, 0x283c, 0x187e, 0xf728,
+	0xa2fe, 0xe42e, 0xa20a, 0x3d01, 0xa202, 0x083c, 0x3c7e, 0x182c,
+	0xf028, 0x3c7e, 0x283c, 0xe42e, 0xe000, 0x04c0, 0xe092, 0x2901,
+	0xe052, 0x3d01, 0xe42e, 0xe000, 0x04c0, 0xe092, 0x2901, 0xe056,
+	0x3d01, 0xe42e, 0xe000, 0x04c0, 0xe092, 0x2901, 0xa802, 0x3d01,
+	0xe42e, 0x2834, 0x4c35, 0xe01a, 0x3c46, 0x2843, 0xae02, 0x4c46,
+	0xae02, 0x4c47, 0xae0e, 0x4c34, 0xae0e, 0x4c35, 0xe0c1, 0x014b,
+	0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0xe42e, 0x2834,
+	0x4c35, 0xe01a, 0x3c46, 0x2843, 0xae02, 0x4c46, 0xae02, 0x4c47,
+	0xae0e, 0x4c34, 0xae0e, 0x4c35, 0xe0c1, 0x014b, 0xf7e9, 0xe0c2,
+	0x014d, 0xa202, 0xe0c2, 0x014a, 0xe42e, 0xa218, 0x34b3, 0x3cb4,
+	0x249c, 0x4c9d, 0xd027, 0x0000, 0xe41e, 0x0bf9, 0xd027, 0x0001,
+	0xf2f8, 0x249c, 0x4c9d, 0xe41e, 0x0bce, 0xe095, 0xe41e, 0x0bd2,
+	0xe084, 0xaf02, 0xe000, 0x0500, 0xe092, 0xe41e, 0x0a82, 0xe084,
+	0xa802, 0xe41e, 0x0b9b, 0x00b0, 0x0cb1, 0x34b0, 0x3cb1, 0xf186,
+	0x2693, 0x4e94, 0xe046, 0xf142, 0x24b0, 0x4cb1, 0xa018, 0x34b0,
+	0x3cb1, 0x34b3, 0x3cb4, 0x249c, 0x4c9d, 0xd027, 0x0000, 0xe41e,
+	0x0bf9, 0xd027, 0x0001, 0xf048, 0xa200, 0xe42e, 0xe16b, 0xa200,
+	0x34b0, 0x3cb1, 0xa202, 0xe42e, 0xa202, 0x3ca2, 0xa240, 0x34b3,
+	0x3cb4, 0x249c, 0x4c9d, 0xd027, 0x0000, 0xe41e, 0x0bf9, 0xd027,
+	0x0001, 0xe408, 0x0a80, 0x249c, 0x4c9d, 0xe41e, 0x0bce, 0xe095,
+	0xe41e, 0x0bd2, 0xe084, 0xa00c, 0xaf02, 0xe000, 0x0500, 0xe092,
+	0xe084, 0xa802, 0xe41e, 0x0b9b, 0xe008, 0xffff, 0x3cb2, 0xa140,
+	0xf0f4, 0x28b2, 0x34b3, 0x3cb4, 0x249c, 0x4c9d, 0xd027, 0x0000,
+	0xe41e, 0x0bf9, 0xd027, 0x0001, 0xf048, 0xa200, 0xe42e, 0xe16b,
+	0xa202, 0xe42e, 0x2111, 0x4d09, 0xe005, 0x0043, 0xae11, 0xa99d,
+	0xae11, 0xa99b, 0xae11, 0xa9ad, 0xae11, 0xe046, 0xf05a, 0xa200,
+	0x3cb1, 0x3c2e, 0xe42e, 0xa241, 0x3eb1, 0xaf03, 0xe082, 0xe042,
+	0xe092, 0xa202, 0x3c2e, 0xe42e, 0xba4e, 0xba4f, 0xae11, 0xe056,
+	0xe42e, 0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056,
+	0xba4f, 0xae31, 0xe056, 0xe42e, 0x6858, 0xe42d, 0xe161, 0x04e0,
+	0xf088, 0xba4a, 0xa140, 0x3d11, 0xba4a, 0xa140, 0x3d11, 0xe42e,
+	0xe049, 0xa87e, 0xa140, 0x3d11, 0xaf0d, 0xa87f, 0xa141, 0x3f11,
+	0xe42e, 0xd1a5, 0x0000, 0xe161, 0x04e0, 0x2111, 0x4d11, 0xcf4c,
+	0xd1a0, 0x0001, 0xcb41, 0xf7f9, 0xe42e, 0xe41e, 0x023a, 0xa206,
+	0xae1e, 0xcec0, 0xd160, 0x0600, 0xe0c0, 0x0060, 0x3491, 0x3c92,
+	0xe0c1, 0x0061, 0xae15, 0x3693, 0x3e94, 0xe042, 0x3495, 0x3c96,
+	0xe0c0, 0x0048, 0x349c, 0x3c9d, 0x3497, 0xe008, 0xfe00, 0x3c98,
+	0x2c9d, 0xe008, 0x01ff, 0x3ca0, 0xe41e, 0x0a4c, 0xf07d, 0xe41e,
+	0x0b5c, 0xe41e, 0x0b47, 0xa202, 0xe42e, 0xa200, 0xe16a, 0xe42e,
+	0xa206, 0xae1e, 0xcec0, 0xd160, 0x0600, 0xe0c0, 0x0048, 0xe0c2,
+	0x0051, 0x349c, 0x3c9d, 0x3497, 0xe008, 0xfe00, 0x3c98, 0x2c9d,
+	0xe008, 0x01ff, 0x3ca0, 0xe41e, 0x0a0d, 0xf078, 0xe41e, 0x0b5c,
+	0xe41e, 0x0b47, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xcb40,
+	0xf7f8, 0xe41e, 0x0b1c, 0xe470, 0xca28, 0xf7f8, 0xe004, 0x0080,
+	0xce24, 0x28a1, 0xae0e, 0xce22, 0x2497, 0x4c98, 0xce20, 0xe0c0,
+	0x0043, 0xa806, 0xae02, 0xa022, 0xce26, 0xca28, 0xf7f8, 0x2497,
+	0x4c98, 0xe000, 0x0200, 0x3497, 0x3c98, 0x1495, 0x1c96, 0xf054,
+	0x2491, 0x4c92, 0x3497, 0x3c98, 0xd04c, 0x0000, 0x28a1, 0xae0e,
+	0xcc6e, 0x28a1, 0xe016, 0x3ca1, 0xe42e, 0x2890, 0xe42e, 0xa200,
+	0x3ca1, 0xce92, 0xe41e, 0x0b1c, 0xe41e, 0x0b1c, 0xe128, 0xd071,
+	0x2020, 0xe181, 0x2ca0, 0xa102, 0xf074, 0xcc44, 0xe184, 0x0b59,
+	0xba4e, 0xe190, 0xe190, 0xe42e, 0xe004, 0x1495, 0xae20, 0xcc9e,
+	0xd030, 0x0000, 0xd034, 0x0000, 0xd033, 0x0000, 0xd035, 0x0000,
+	0xd036, 0x00ff, 0xd037, 0x0000, 0xd038, 0x0000, 0xd039, 0x0000,
+	0xd04b, 0x0001, 0xd04c, 0x0000, 0xd046, 0x0000, 0xd047, 0x0000,
+	0xd149, 0x0000, 0xe42e, 0x249c, 0x4c9d, 0x08b2, 0x349c, 0x3c9d,
+	0xf07e, 0x249c, 0x4c9d, 0x04b0, 0x0cb1, 0x349c, 0x3c9d, 0x1495,
+	0x1c96, 0xf074, 0x249c, 0x4c9d, 0x1493, 0x1c94, 0x349c, 0x3c9d,
+	0x249c, 0x4c9d, 0xe0c2, 0x0048, 0xe0c2, 0x0052, 0xe42e, 0xa200,
+	0x34b0, 0x3cb1, 0xe42e, 0xf0a8, 0x2911, 0xe008, 0xffff, 0xae20,
+	0x2b11, 0xe009, 0xffff, 0xe042, 0xf0fe, 0x2911, 0xe008, 0x00ff,
+	0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xae10, 0x2b11, 0xe009,
+	0xff00, 0xaf11, 0xe042, 0x2aa2, 0xe42b, 0xe049, 0xaf31, 0xe009,
+	0x00ff, 0xe093, 0xe049, 0xaf21, 0xe009, 0x00ff, 0xe095, 0xe049,
+	0xaf11, 0xe009, 0x00ff, 0xe008, 0x00ff, 0xae10, 0xe056, 0xae10,
+	0xe085, 0xe056, 0xae10, 0xe083, 0xe056, 0xe42e, 0xe049, 0xa80f,
+	0xe046, 0xe42e, 0xca29, 0xf7f9, 0xd111, 0x0500, 0xce20, 0x2695,
+	0x4e96, 0xe045, 0xe004, 0x0040, 0xe065, 0xaf03, 0xce25, 0x3ea3,
+	0xe41e, 0x0bf0, 0xa240, 0x18a3, 0xe426, 0xce24, 0x28a3, 0xe000,
+	0x0500, 0xce22, 0x2491, 0x4c92, 0xce20, 0xe41e, 0x0bf0, 0xe42e,
+	0xe0c0, 0x0043, 0xa806, 0xae02, 0xa002, 0xce26, 0xca28, 0xf7f8,
+	0xe42e, 0x34c9, 0x3cca, 0xa200, 0x3c15, 0xe0c0, 0x0049, 0x34cb,
+	0x3ccc, 0xe0c0, 0x0045, 0xaf04, 0x301d, 0xe0c0, 0x0049, 0x3499,
+	0x3c9a, 0x10cb, 0x1ccc, 0x2a15, 0xb611, 0x3e15, 0x2699, 0x4e9a,
+	0x16c9, 0x1eca, 0xf033, 0x0693, 0x0e94, 0x16b3, 0x1eb4, 0xa200,
+	0xe423, 0x281d, 0x3c90, 0xe428, 0x2815, 0xf648, 0xe41e, 0x01db,
+	0xe0c0, 0x005c, 0xe008, 0x4000, 0xf5da, 0xe0c0, 0x005d, 0xe00a,
+	0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3c15, 0xf53e, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0080, 0x0060, 0x0008, 0x0006,
+	0x00b0, 0x0090, 0x000b, 0x0009, 0x0160, 0x0120, 0x0016, 0x0012,
+	0x02c0, 0x0240, 0x0058, 0x0012, 0x0580, 0x0480, 0x0160, 0x0012,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0063, 0x000d, 0x000f, 0x0011, 0x0013, 0x0015, 0x0017, 0x0000,
+	0xffff, 0xfffe, 0x0001, 0x0002, 0x0000, 0x0002, 0xffff, 0xffff,
+	0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xfffe,
+	0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe,
+	0xfffe, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd,
+	0xfffd, 0xfffd, 0xfffd, 0xfffd, 0x0000, 0x0001, 0x0001, 0x0001,
+	0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0002,
+	0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002,
+	0x0002, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003,
+	0x0003, 0x0002, 0x0001, 0xfffb, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c42, 0xf0b4, 0xe04a, 0xaf10,
+	0x1840, 0xf074, 0xe009, 0x00ff, 0x1a41, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0bb5, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0368,
+	0xe40e, 0x036a, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x036e, 0xe40e, 0x00a4,
+	0xe41e, 0x038d, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x038e,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x03e0, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe41e, 0x03e9, 0xe40e, 0x00a4, 0xe41e, 0x0148,
+	0xe41e, 0x093e, 0xe41e, 0x0417, 0xe41e, 0x09fd, 0xa200, 0xcc4a,
+	0xcc4c, 0xa200, 0x3c1f, 0xe41e, 0x095f, 0xe41e, 0x0b81, 0xf08a,
+	0xe41e, 0x070e, 0xe41e, 0x0561, 0xf03d, 0xa202, 0x3c1f, 0xe41e,
+	0x098d, 0xe41e, 0x0c17, 0xe16a, 0xe42e, 0xe42e, 0xa200, 0xcc44,
+	0xcc4a, 0xcc4c, 0x3c4a, 0x3c4b, 0xe41e, 0x095f, 0xe41e, 0x0b81,
+	0xf2ea, 0xe41e, 0x070e, 0xe41e, 0x08bc, 0xe41e, 0x0a14, 0xe41e,
+	0x0b7a, 0xe41e, 0x0746, 0xe41e, 0x0b11, 0xe41e, 0x0a1e, 0x28c1,
+	0xf1e8, 0xe41e, 0x0418, 0x281a, 0xe418, 0x0561, 0xe41e, 0x0582,
+	0xa202, 0xb61a, 0x3c1f, 0xf13d, 0xe41e, 0x0418, 0x28c1, 0xf0f8,
+	0xe41e, 0x041c, 0xf0f8, 0xe41e, 0x0418, 0xe41e, 0x08f8, 0xf07a,
+	0xe41e, 0x0418, 0xe41e, 0x0a28, 0xe41e, 0x042d, 0x2852, 0xe414,
+	0x0c38, 0x28c1, 0xe41e, 0x0927, 0xe41e, 0x0914, 0xe41e, 0x0461,
+	0xe41e, 0x0b7b, 0xe41e, 0x07ff, 0xe41e, 0x0b61, 0x285c, 0x3c5f,
+	0xe41e, 0x08e3, 0xe41e, 0x098d, 0xe41e, 0x0c17, 0xe16a, 0xe42e,
+	0xe41e, 0x0899, 0xe41e, 0x0a06, 0xe41e, 0x0b0c, 0xe41e, 0x0a7e,
+	0xe42e, 0xe180, 0xe41e, 0x093e, 0xa200, 0x3cbe, 0x3cc1, 0xa2fa,
+	0x3c5a, 0x3c5b, 0x3c5c, 0xa2fc, 0x3c52, 0xa2fe, 0x3c53, 0xa200,
+	0x3c57, 0x3c56, 0xe166, 0x0054, 0x9e06, 0xf16a, 0x2851, 0xa102,
+	0xcc44, 0xa200, 0x3c5e, 0xe184, 0x0411, 0x9e06, 0x5c5e, 0xa802,
+	0xf07a, 0x285e, 0xe000, 0x02d0, 0xe09e, 0xa208, 0x3d07, 0x285e,
+	0xa002, 0x3c5e, 0xe190, 0xe42e, 0xca28, 0xf7f8, 0xe42e, 0xe42e,
+	0x2861, 0xa002, 0x3c61, 0xe42e, 0x2860, 0xe42a, 0xa102, 0xf04a,
+	0xa102, 0xf05a, 0xf09e, 0x2829, 0xf078, 0xf04e, 0x2829, 0xa104,
+	0xf03a, 0xa200, 0xe42e, 0xa202, 0xe42e, 0x282b, 0x3c2d, 0x2829,
+	0xa104, 0xf05a, 0x282b, 0x3c2c, 0x3c2d, 0xf04e, 0x282c, 0x642b,
+	0x3c2d, 0xe41e, 0x04cd, 0xe41e, 0x0723, 0xe41e, 0x0a7e, 0xe41e,
+	0x0ab1, 0xe41e, 0x025f, 0xe41e, 0x0767, 0xe41e, 0x0761, 0xa200,
+	0x3446, 0x3c47, 0xe41e, 0x0462, 0xf0dd, 0x2046, 0x4c47, 0x1842,
+	0xf0c2, 0xe41e, 0x05f2, 0xf06d, 0x2c45, 0x1046, 0x1c47, 0xf7a4,
+	0xf72a, 0xe41e, 0x048a, 0xe16a, 0xd1e6, 0x0001, 0xcbe2, 0xf7f8,
+	0xe42e, 0xe42e, 0xe41e, 0x04a3, 0x2822, 0x1836, 0xf058, 0x2823,
+	0x1837, 0xf028, 0xf12e, 0x2829, 0xe01a, 0xa802, 0xf088, 0x2822,
+	0x3c36, 0x2823, 0x3c37, 0xa200, 0x3c38, 0xf03e, 0xa202, 0x3c38,
+	0x2838, 0xf03a, 0xe16b, 0xe42e, 0xe41e, 0x04f5, 0xe42d, 0x2046,
+	0x4c47, 0x1842, 0xe422, 0xcb86, 0xa102, 0xf770, 0xe41e, 0x04bd,
+	0xf748, 0xe42e, 0x2829, 0xf088, 0x2456, 0x4c57, 0xf05a, 0xa204,
+	0x4c10, 0xcf80, 0xcfc6, 0x2046, 0x4c47, 0xe41a, 0x04a3, 0x2046,
+	0x4c47, 0x1842, 0xe422, 0xe41e, 0x0529, 0x244a, 0x4c4b, 0xa002,
+	0x344a, 0x3c4b, 0xf75e, 0x282a, 0xcf82, 0xd1c3, 0x0000, 0x282b,
+	0xcf96, 0xd188, 0x0001, 0x2824, 0xa102, 0x1825, 0xe016, 0x3c26,
+	0x2825, 0xa002, 0x3c25, 0xae02, 0xe000, 0x0360, 0xe092, 0x2111,
+	0x4d11, 0xae06, 0x3427, 0x3c28, 0xe42e, 0x2826, 0xe428, 0xc872,
+	0x1027, 0x1c28, 0xa00e, 0xe424, 0xa10e, 0xe012, 0x3c49, 0xb60c,
+	0xe42a, 0x7849, 0xe428, 0x7449, 0xe42e, 0x2829, 0xa104, 0xf09a,
+	0x282f, 0x1830, 0xf022, 0x0833, 0x3c31, 0x282f, 0x3c30, 0xe42e,
+	0x2830, 0x182f, 0xf022, 0x0833, 0x3c32, 0x2831, 0x1832, 0xa400,
+	0x3c32, 0x2832, 0xae1c, 0xc70f, 0x7c31, 0x3c34, 0x2831, 0x1832,
+	0xae1c, 0xc70f, 0x7c31, 0x3c35, 0xe005, 0x3fff, 0x2834, 0xe066,
+	0x3c34, 0x2835, 0xe066, 0x3c35, 0xe42e, 0xd184, 0x0002, 0xd185,
+	0x0000, 0xe190, 0xd1d0, 0x003f, 0xcba0, 0xa810, 0xcba3, 0xf209,
+	0xf7c8, 0xe41e, 0x0803, 0xcbe0, 0xf7f8, 0x2848, 0xe41a, 0x0819,
+	0xe41e, 0x081d, 0xcba0, 0xcba3, 0xf139, 0xf7d8, 0xd185, 0x0001,
+	0xd184, 0x0004, 0xe41e, 0x082a, 0xcb06, 0x3446, 0x3c47, 0x2871,
+	0x4c72, 0xe42a, 0x2879, 0x1877, 0xe414, 0x0b3f, 0xe42e, 0xd1d0,
+	0x0000, 0xd1d1, 0x0000, 0xcb0c, 0xf7f8, 0xcbe0, 0xf7f8, 0xe16b,
+	0xe42e, 0xd184, 0x0002, 0xd185, 0x0000, 0x882b, 0x01ca, 0xd1c4,
+	0x0000, 0xd1c2, 0x0001, 0xd1c5, 0x0000, 0xd1d0, 0x000e, 0xcba0,
+	0xf7f8, 0x2456, 0x4c57, 0xf058, 0xd1c2, 0x0000, 0xd1c5, 0x0003,
+	0xd1d0, 0x0030, 0xe41e, 0x0803, 0xa200, 0xe0c2, 0x012a, 0xcbe0,
+	0xf7f8, 0x2848, 0xe41a, 0x0819, 0xe41e, 0x081d, 0xcba0, 0xf7f8,
+	0xd185, 0x0001, 0xd184, 0x0004, 0xe41e, 0x082a, 0xcb06, 0x3446,
+	0x3c47, 0x2871, 0x4c72, 0xe42a, 0x2879, 0x1877, 0xe414, 0x0b3f,
+	0xe42e, 0xa200, 0x3c10, 0xe16a, 0xba7e, 0x3418, 0x3c19, 0xe004,
+	0x5649, 0xae20, 0xe00a, 0x444f, 0xa201, 0x3ef0, 0xba7f, 0xe046,
+	0xf108, 0xe004, 0x2000, 0x3c33, 0xe41e, 0x0620, 0xf0ad, 0xe41e,
+	0x068a, 0x2822, 0x3c13, 0x3c36, 0x2823, 0x3c14, 0x3c37, 0xe42e,
+	0xe16b, 0xe42e, 0xba7e, 0x3420, 0x3c21, 0xa108, 0xa209, 0x3ef0,
+	0xf326, 0xba7e, 0xe190, 0xba5e, 0xe190, 0xba5e, 0xe190, 0xba7e,
+	0xe190, 0xba7e, 0xa20b, 0x3ef0, 0xf266, 0xe002, 0x0100, 0xa20d,
+	0x3ef0, 0xf210, 0xe000, 0x0100, 0x3c24, 0xe161, 0x0360, 0x2824,
+	0xa102, 0xcc44, 0xe184, 0x05ad, 0xba7e, 0xe190, 0xf14a, 0xba7e,
+	0x3511, 0x3d11, 0x1420, 0x1c21, 0xf0e0, 0xe190, 0xd039, 0x0000,
+	0xa200, 0x3c25, 0xa20f, 0x3ef0, 0xe41e, 0x05be, 0xf04d, 0xa200,
+	0x3cf0, 0xe42e, 0xd039, 0x0000, 0xe16b, 0xe42e, 0xa211, 0x3ef0,
+	0xba40, 0xf2f8, 0x7410, 0xf2d8, 0x7410, 0xf2b8, 0xba42, 0xa102,
+	0xb608, 0x3c29, 0x7410, 0xe190, 0xba48, 0x3c2b, 0x2810, 0xe016,
+	0xf0aa, 0xba40, 0xa215, 0x3ef0, 0xf1c8, 0xa217, 0x3ef0, 0xba40,
+	0xf188, 0xba42, 0x3c2a, 0xba40, 0x3c2e, 0xba58, 0x3c2f, 0xe41e,
+	0x06ab, 0xe086, 0x3c22, 0xe088, 0x3c23, 0xe41e, 0x068a, 0xa219,
+	0x3ef0, 0x7444, 0x3c45, 0xf058, 0x1842, 0xf030, 0x7410, 0xe42e,
+	0xe16b, 0xe42e, 0xba40, 0xf2b8, 0x7410, 0xf298, 0x7410, 0xf278,
+	0xba42, 0xa102, 0xb608, 0x1829, 0xf228, 0x7410, 0xe190, 0xba48,
+	0x3c2b, 0x2810, 0xe016, 0xf06a, 0xba40, 0xf198, 0xba40, 0xf178,
+	0xba42, 0x3c2a, 0xba40, 0x182e, 0xf128, 0xba58, 0x182f, 0xf0f8,
+	0xe41e, 0x06ab, 0xe086, 0x1822, 0xf0a8, 0xe088, 0x1823, 0xf078,
+	0x7444, 0x3c45, 0x1842, 0xf032, 0x7410, 0xe42e, 0xe16b, 0xe42e,
+	0xba1e, 0xe002, 0x5256, 0xe016, 0xa203, 0x3ef0, 0xe40a, 0x0688,
+	0xba5e, 0xba1e, 0xe002, 0x3430, 0xf0aa, 0xba1e, 0xe002, 0x3330,
+	0xe016, 0xa205, 0x3ef0, 0xe40a, 0x0688, 0xa202, 0x3c10, 0xba5e,
+	0xe190, 0xba5e, 0x3c22, 0xba5e, 0x3c23, 0xba5e, 0xe190, 0xba5e,
+	0xe190, 0xba5e, 0xe190, 0xba4e, 0xe190, 0xba5e, 0x3c12, 0xba4e,
+	0xe004, 0x0100, 0x3c11, 0xba7e, 0xe190, 0xba7e, 0xaf18, 0xa81e,
+	0xa10a, 0xa213, 0xf026, 0xa003, 0x3615, 0x3e16, 0x2810, 0xf098,
+	0x2018, 0x4c19, 0xa144, 0xf2b6, 0xba4f, 0xa102, 0xf28a, 0xf7de,
+	0xa211, 0x3615, 0x3e16, 0xa207, 0x3ef0, 0xa200, 0x3c17, 0xe161,
+	0x0330, 0x2822, 0x3d11, 0x2823, 0x3d11, 0x2018, 0x4c19, 0xa144,
+	0xf166, 0xba4f, 0xae05, 0x3f11, 0xba4f, 0xae05, 0x3f11, 0x2a17,
+	0xa003, 0x3e17, 0xa111, 0xf0d3, 0xa104, 0xf740, 0x2817, 0xa002,
+	0x3c17, 0x2817, 0xa002, 0xaf02, 0xa506, 0x3c17, 0xe16a, 0xe42e,
+	0xe16b, 0xe42e, 0x2822, 0xa01e, 0xaf08, 0x3c40, 0x2823, 0xa01e,
+	0xaf08, 0x3c41, 0x8440, 0x8241, 0xe018, 0x3c42, 0xa160, 0xa20d,
+	0xf116, 0xa166, 0xf0e6, 0xe002, 0x0129, 0xf0a6, 0xe002, 0x04a4,
+	0xf066, 0xe002, 0x1290, 0xf026, 0xa003, 0xa005, 0xa005, 0xa005,
+	0xa003, 0x3e44, 0xe42e, 0x2810, 0xf0da, 0x2817, 0xf0fa, 0x7417,
+	0xae02, 0xe000, 0x0330, 0xe092, 0x2911, 0xe096, 0x2911, 0xe098,
+	0xe42e, 0x2829, 0xf08a, 0xba40, 0xf06a, 0x2822, 0xe096, 0x2823,
+	0xe098, 0xe42e, 0xe005, 0x00a0, 0xba44, 0xf1ca, 0xa102, 0xf19a,
+	0xa102, 0xf16a, 0xa102, 0xf13a, 0xa102, 0xf10a, 0xa102, 0xf0ca,
+	0xa102, 0xf09a, 0xa201, 0xba4e, 0xe041, 0xe002, 0x00ff, 0xf7ca,
+	0xae05, 0xf08e, 0xa081, 0xe001, 0x0120, 0xa041, 0xa0a1, 0xa081,
+	0xa021, 0xe097, 0xe005, 0x0078, 0xba44, 0xf27a, 0xa102, 0xf24a,
+	0xa102, 0xf21a, 0xa102, 0xf1ea, 0xa102, 0xf1ba, 0xa102, 0xf17a,
+	0xa102, 0xba41, 0xf088, 0xf049, 0xe005, 0x00b4, 0xf16e, 0xe005,
+	0x0168, 0xf13e, 0xf049, 0xe005, 0x0240, 0xf0fe, 0xa201, 0xba4e,
+	0xe041, 0xe002, 0x00ff, 0xf7ca, 0xae05, 0xf07e, 0xe001, 0x00c0,
+	0xa061, 0xa0c1, 0xa019, 0xa019, 0xe099, 0xe42e, 0xd130, 0x0004,
+	0xd131, 0x0000, 0xd008, 0x0000, 0xd03a, 0x0004, 0xd1e0, 0x0001,
+	0xd1e1, 0x03b0, 0xd1f3, 0x0040, 0xd022, 0x00bf, 0xe184, 0x0721,
+	0xa200, 0xcfe8, 0xe42e, 0x2829, 0xae02, 0x4c10, 0xcf80, 0xcfc6,
+	0xd1d3, 0x000b, 0x2840, 0xa102, 0xae04, 0x4c29, 0xae02, 0x4c10,
+	0xcf00, 0x282e, 0xa200, 0xcf02, 0xd184, 0x0001, 0x2840, 0xae20,
+	0x4c41, 0xae08, 0xcfc4, 0xe167, 0x02c0, 0x2117, 0x4d17, 0xcfca,
+	0x2834, 0xcfce, 0xd1e6, 0x0000, 0xe42e, 0xe42e, 0x2810, 0xae08,
+	0xa908, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x0128, 0xa200, 0xe0c2,
+	0x013d, 0x2a71, 0x4e72, 0xb692, 0xae08, 0xa91c, 0xe0c2, 0x017c,
+	0xa218, 0xe0c2, 0x017d, 0xa200, 0xe41e, 0x0a5e, 0xe0c2, 0x0102,
+	0xe42e, 0xe41e, 0x0274, 0xa202, 0xe0c2, 0x0106, 0xe42e, 0xa200,
+	0xcc8e, 0xe0c2, 0x0128, 0x2810, 0xae08, 0xa908, 0xe0c2, 0x0100,
+	0x2a71, 0x4e72, 0xb692, 0xae08, 0xa91c, 0xe0c2, 0x017c, 0xe004,
+	0x000c, 0xe0c2, 0x017d, 0xa208, 0xae04, 0x4c10, 0xae04, 0x4c29,
+	0xae06, 0xe0c2, 0x0204, 0xa200, 0xe0c2, 0x0208, 0x2829, 0xae06,
+	0xe0c2, 0x0104, 0xe0c1, 0x0046, 0xe004, 0x0000, 0xae10, 0xe042,
+	0x2ac8, 0xa803, 0xf05b, 0xe161, 0x0700, 0x2111, 0x4d11, 0xcfc8,
+	0xe0c1, 0x0046, 0xe004, 0x0040, 0xae10, 0xe042, 0x2ac8, 0xa805,
+	0xf05b, 0xe161, 0x0702, 0x2111, 0x4d11, 0xe0c2, 0x0103, 0x282e,
+	0xe016, 0xe0c2, 0x0210, 0xa200, 0xe41e, 0x0a5e, 0xa203, 0xae11,
+	0xe056, 0xe0c2, 0x0213, 0xa200, 0xe0c2, 0x0215, 0xe0c1, 0x0046,
+	0xe004, 0x0070, 0xae10, 0xe042, 0x2ac8, 0xa809, 0xf05b, 0xe161,
+	0x0704, 0x2111, 0x4d11, 0xe0c2, 0x0211, 0xe0c1, 0x0046, 0xe004,
+	0x0070, 0xe000, 0x0040, 0xae10, 0xe042, 0x2ac8, 0xa811, 0xf05b,
+	0xe161, 0x0706, 0x2111, 0x4d11, 0xe0c2, 0x0212, 0x2840, 0xae20,
+	0x4c41, 0xae08, 0xe0c2, 0x0101, 0xe0c2, 0x0205, 0xa200, 0xe41e,
+	0x0a5e, 0xe0c2, 0x0102, 0xa200, 0xae0a, 0x4c2d, 0xe0c2, 0x0217,
+	0xe41e, 0x0831, 0xe41e, 0x0836, 0xa20e, 0xe0c2, 0x0312, 0xe0c0,
+	0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a, 0x0862, 0xa200,
+	0xe0c2, 0x030d, 0x2035, 0x4c34, 0xe0c2, 0x0310, 0xe42e, 0xe0c0,
+	0x0111, 0xf7e8, 0xe42e, 0xcb94, 0xe0c2, 0x0115, 0xcba4, 0xe0c2,
+	0x012a, 0xcb8a, 0xe0c2, 0x0114, 0xa802, 0x3c48, 0xe42a, 0xcb12,
+	0xe0c2, 0x0120, 0xcb8c, 0xe0c2, 0x0121, 0xcb8e, 0xe0c2, 0x0122,
+	0xe42e, 0xcbd0, 0xe0c2, 0x0311, 0xe42e, 0xcb40, 0xe0c2, 0x0224,
+	0xcb42, 0xe0c2, 0x0225, 0xcb44, 0xe0c2, 0x0226, 0xcb46, 0xe0c2,
+	0x0227, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2, 0x0110,
+	0xe42e, 0x2852, 0xe0c2, 0x020b, 0xe0c2, 0x0214, 0xa200, 0xe0c2,
+	0x030a, 0xe004, 0x0082, 0xa202, 0xae20, 0xe00a, 0x0842, 0xe0c2,
+	0x030b, 0xa202, 0xe0c2, 0x0302, 0x2829, 0xa104, 0xf082, 0x285b,
+	0xf032, 0x2852, 0xb608, 0xe0c2, 0x0380, 0xf09e, 0x285a, 0xf052,
+	0x285b, 0xf032, 0x2852, 0xb608, 0xe0c2, 0x0380, 0x285b, 0xf052,
+	0x285a, 0xf032, 0x2852, 0xb608, 0xe0c2, 0x0383, 0xa200, 0xe0c2,
+	0x0302, 0xe42e, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152,
+	0x2b17, 0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1,
+	0x0101, 0xe0c3, 0x015d, 0x2829, 0xa104, 0xe005, 0x001b, 0xf038,
+	0xe005, 0x001f, 0x3e00, 0x285a, 0xa53e, 0xa400, 0x2a5b, 0xa53f,
+	0xa401, 0xae11, 0xe055, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10,
+	0x4400, 0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0,
+	0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8,
+	0xe42e, 0xa2fa, 0x3c5a, 0x3c5b, 0xa2fe, 0x3c53, 0xa200, 0x3c54,
+	0x3c55, 0x3c58, 0x3c59, 0x3c57, 0x3c56, 0xa202, 0x285d, 0xe0c0,
+	0x0061, 0x3c50, 0xe41e, 0x0414, 0xe0c0, 0x0042, 0xce20, 0xd111,
+	0x0200, 0xd112, 0x00c4, 0xd113, 0x0003, 0xe41e, 0x0414, 0xe0c0,
+	0x0060, 0x3c51, 0xa202, 0xe42e, 0xa2fc, 0x3c52, 0xa2fa, 0x3c5c,
+	0xe0c0, 0x0054, 0x2654, 0x4e55, 0xe052, 0x3c55, 0x3454, 0xe41e,
+	0x08ca, 0xe42e, 0xa200, 0x3c5e, 0x2851, 0xa102, 0xcc44, 0xe184,
+	0x08e1, 0x2454, 0x4c55, 0x5c5e, 0xa802, 0xf0a8, 0x285e, 0xe049,
+	0xe001, 0x02d0, 0xe09f, 0x2b07, 0xa809, 0xe419, 0x0951, 0x285e,
+	0xa002, 0x3c5e, 0xe42e, 0xe004, 0x02d0, 0xe09e, 0x2851, 0xa102,
+	0xcc44, 0xa200, 0x3c5e, 0xe184, 0x08f4, 0x2b17, 0xaf05, 0xa803,
+	0x5a5e, 0xe056, 0x2a5e, 0xa003, 0x3e5e, 0x3454, 0x3c55, 0xe42e,
+	0x2853, 0xb7e8, 0xe094, 0xe092, 0xe084, 0xa002, 0x2a51, 0xe045,
+	0xb616, 0x3c52, 0xe094, 0xe083, 0xe045, 0xf059, 0xa2fe, 0x3c52,
+	0xa200, 0xe42e, 0x3c53, 0xe000, 0x02d0, 0xe09e, 0x2907, 0xf6d8,
+	0xa20a, 0x3d07, 0xa202, 0xe42e, 0x2852, 0xf114, 0x2829, 0xf0f4,
+	0xa104, 0xf0d2, 0x285a, 0xe41e, 0x0946, 0x285b, 0x3c5a, 0x2852,
+	0x3c5b, 0x2456, 0x4c57, 0xa002, 0x3c57, 0x3456, 0xe42e, 0x2a5d,
+	0xb630, 0xe045, 0x3e5d, 0xf098, 0xa2fa, 0x3c5c, 0x2852, 0xe424,
+	0x2829, 0xe424, 0xa104, 0xf062, 0x2a5d, 0x285b, 0xb7ea, 0x3c5c,
+	0xe42e, 0x2852, 0x3c5c, 0xe41e, 0x0946, 0xe42e, 0xe167, 0x02d0,
+	0xa200, 0xc71f, 0x3d17, 0xa202, 0x3c5d, 0xe42e, 0xe424, 0xe049,
+	0x1a51, 0xe423, 0xe000, 0x02d0, 0xe09e, 0x2907, 0xa808, 0x3d07,
+	0xe42e, 0xe000, 0x02d0, 0xe09e, 0x2907, 0xa802, 0x3d07, 0xe42e,
+	0xe000, 0x02d0, 0xe09e, 0xa208, 0x4d07, 0x3d07, 0xe42e, 0xe0c0,
+	0x0059, 0xa102, 0xf20a, 0xa102, 0xe42a, 0xa102, 0xf04a, 0xa102,
+	0xf24a, 0xe42e, 0xe0c0, 0x0060, 0xaf08, 0x3071, 0xaf02, 0x3072,
+	0xe0c0, 0x0060, 0xa81e, 0x3c70, 0xe0c0, 0x0061, 0xa83e, 0x3c74,
+	0xe0c1, 0x0065, 0xa809, 0xe0c0, 0x0065, 0xaf06, 0xa806, 0xb632,
+	0x3c60, 0xe42e, 0xe0c0, 0x0060, 0x34b0, 0x3cb1, 0xe0c0, 0x0061,
+	0xae14, 0x34b2, 0x3cb3, 0xe42e, 0xe42e, 0xe0c0, 0x0059, 0xa102,
+	0xe40a, 0x09d4, 0xa102, 0xe42a, 0xa102, 0xf05a, 0xa102, 0xe40a,
+	0x09fc, 0xe42e, 0x2022, 0x4c23, 0xe0c2, 0x006f, 0x2456, 0x4c57,
+	0xe0c2, 0x0070, 0x285c, 0xe0c2, 0x0071, 0x244a, 0x4c4b, 0xe0c2,
+	0x0072, 0x2829, 0xe0c2, 0x0073, 0xa200, 0xe0c2, 0x0074, 0x281f,
+	0xe0c2, 0x0076, 0x2852, 0x2ac1, 0xb7d2, 0xe0c2, 0x0077, 0xa200,
+	0xe0c2, 0x0078, 0xe0c2, 0x0079, 0x282f, 0xe0c2, 0x007a, 0xa2fe,
+	0xe0c2, 0x007c, 0x2811, 0xe0c2, 0x007e, 0x2812, 0xe0c2, 0x007d,
+	0x2454, 0x4c55, 0xe0c2, 0x0054, 0xc84a, 0xc84d, 0xae20, 0xe056,
+	0xe0c2, 0x0053, 0xa202, 0xe42e, 0xa202, 0xe0c2, 0x0074, 0xa200,
+	0xe0c2, 0x0076, 0xe0c2, 0x0077, 0xa202, 0x2af0, 0xb616, 0x58f0,
+	0xe0c2, 0x0078, 0x2811, 0xe0c2, 0x007a, 0x2812, 0xe0c2, 0x0079,
+	0xa2fe, 0xe0c2, 0x0072, 0xe0c2, 0x006d, 0xa208, 0xe0c2, 0x0073,
+	0x2013, 0x4c14, 0xe0c2, 0x0071, 0x2015, 0x4c16, 0xe0c2, 0x007b,
+	0x281f, 0xe0c2, 0x0070, 0xe42e, 0xe42e, 0xe0c0, 0x0041, 0xe005,
+	0x0020, 0xae11, 0xe042, 0xe41e, 0x0a1a, 0xe42e, 0xe41e, 0x0174,
+	0xe167, 0x0700, 0xe166, 0x0064, 0xd022, 0x0003, 0xe184, 0x0a12,
+	0x9e16, 0x3517, 0x3d17, 0xe42e, 0xe0c0, 0x0050, 0xe008, 0x007f,
+	0x3cc8, 0xe42e, 0xa00e, 0xaf06, 0xae06, 0xe42e, 0xe41e, 0x0a7e,
+	0xe41e, 0x0ab1, 0xe41e, 0x025f, 0xe41e, 0x0a49, 0xa202, 0xe42e,
+	0x2852, 0xf1f4, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe019,
+	0xe001, 0x0500, 0xe09f, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200,
+	0xe41e, 0x0a5e, 0xaf04, 0xe41e, 0x0a67, 0xae20, 0x2e50, 0xe056,
+	0x9f17, 0x2040, 0x4c41, 0xae08, 0x9f17, 0xa201, 0xe0c3, 0x040d,
+	0xe42e, 0xa200, 0x2ac8, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2ac8,
+	0xa805, 0xf02b, 0xa912, 0x2ac8, 0xa809, 0xf02b, 0xa940, 0x2ac8,
+	0xa811, 0xf02b, 0xa980, 0xe0c2, 0x040c, 0xe42e, 0xe0c1, 0x0044,
+	0xa80f, 0xe056, 0xe42e, 0xa200, 0xe41e, 0x0a5e, 0xe42e, 0xe0c1,
+	0x0044, 0xaf0d, 0xae03, 0xe056, 0xe008, 0x003f, 0xe42e, 0xe0c1,
+	0x0044, 0xaf17, 0xa803, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803,
+	0xa105, 0xf039, 0xa213, 0xe42e, 0xa201, 0xe42e, 0xa203, 0xe0c3,
+	0x040d, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xe160, 0x0003, 0xe166,
+	0x0200, 0xe167, 0x0500, 0x2851, 0xf166, 0xa102, 0xcc44, 0xe184,
+	0x0aa1, 0xa200, 0xe41e, 0x0a5e, 0xaf04, 0xe41e, 0x0a67, 0xae20,
+	0x2e50, 0xe056, 0x9f17, 0x2040, 0x4c41, 0xae08, 0x9f17, 0xe41e,
+	0x0aa7, 0xe190, 0xe190, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2116,
+	0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17,
+	0xe42e, 0xe0c0, 0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060,
+	0xa860, 0xe42a, 0xe0c0, 0x0061, 0xa83e, 0xa203, 0xe0c3, 0x040d,
+	0xcca4, 0xc785, 0xe018, 0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420,
+	0xa803, 0xf7db, 0xa200, 0xe41e, 0x0a63, 0xa80e, 0xaf04, 0xe41e,
+	0x0a67, 0xe41e, 0x0a6f, 0xe40b, 0x0ada, 0xa81e, 0xe41e, 0x0a74,
+	0xae09, 0xe056, 0xae20, 0xe0c1, 0x006e, 0xe009, 0x1fff, 0xe056,
+	0x9f17, 0xe0c0, 0x0060, 0xa822, 0xa122, 0xf04a, 0x2040, 0x4c41,
+	0xf03e, 0x2041, 0x4c40, 0xae08, 0x9f17, 0xe0c0, 0x0062, 0x9f17,
+	0xe0c0, 0x0063, 0x9f17, 0xe0c0, 0x0064, 0x9f17, 0xa201, 0xe0c3,
+	0x040d, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11,
+	0xe042, 0xce20, 0xd111, 0x0200, 0xd112, 0x00c0, 0x88ec, 0x0113,
+	0xca29, 0xf7f9, 0xe190, 0xe42e, 0xa2fe, 0x3c73, 0xa200, 0x3c71,
+	0xe42e, 0x285f, 0x3c73, 0x2873, 0xf032, 0xa200, 0x3c71, 0xa200,
+	0x3c78, 0x3c79, 0x2840, 0x3c76, 0x2841, 0x3c77, 0x2871, 0xe42a,
+	0x2873, 0xe424, 0x2873, 0xe0c2, 0x0143, 0x2874, 0xe0c2, 0x0144,
+	0xa200, 0xe0c2, 0x017f, 0xe0c2, 0x0149, 0xe41e, 0x0a5e, 0xe0c2,
+	0x017f, 0x2876, 0xa102, 0xae20, 0x4c77, 0xa102, 0xe0c2, 0x0142,
+	0xa200, 0xae20, 0x2a70, 0xe042, 0xe0c2, 0x014e, 0xe42e, 0x2873,
+	0x2a79, 0x1a77, 0xe423, 0x2878, 0xae0e, 0x4c79, 0xa203, 0xb615,
+	0x3e7a, 0x2a7a, 0xae03, 0xa903, 0xae1d, 0xe056, 0xe0c1, 0x014b,
+	0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0x2a78, 0xa003,
+	0x3e78, 0x1a76, 0xf065, 0x2a79, 0xa003, 0x3e79, 0xa201, 0x3e78,
+	0xe42e, 0x2871, 0xf15a, 0x2879, 0x1877, 0xf042, 0xe41e, 0x0b3f,
+	0xf7be, 0xe0c0, 0x014b, 0xf7e8, 0xa204, 0xae1c, 0xe0c2, 0x014d,
+	0xa202, 0xe0c2, 0x014a, 0xe190, 0xe0c0, 0x014b, 0xf7e8, 0x285c,
+	0x3c73, 0xe42e, 0xe42e, 0xe42e, 0xe42e, 0xe42e, 0xe42e, 0xe42e,
+	0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0b8e, 0xa102, 0xe40a,
+	0x0bb0, 0xa102, 0xe40a, 0x0b96, 0xe40e, 0x0bb0, 0xe41e, 0x023a,
+	0x24b0, 0x4cb1, 0x04b2, 0x0cb3, 0x34b4, 0x3cb5, 0xa206, 0xae1e,
+	0xcec0, 0xd160, 0x0600, 0xe0c0, 0x0048, 0xe0c2, 0x0051, 0x34ba,
+	0x3cbb, 0x34b6, 0xe008, 0xfe00, 0x3cb7, 0x2cbb, 0xe008, 0x01ff,
+	0x3cbc, 0xe41e, 0x0cd0, 0xf07d, 0xe41e, 0x0bf8, 0xe41e, 0x0be3,
+	0xa202, 0xe42e, 0xa200, 0xe16a, 0xe42e, 0xe41e, 0x0bb8, 0xe470,
+	0xca28, 0xf7f8, 0xe004, 0x0080, 0xce24, 0x28bf, 0xae0e, 0xce22,
+	0x24b6, 0x4cb7, 0xce20, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa022,
+	0xce26, 0xca28, 0xf7f8, 0x24b6, 0x4cb7, 0xe000, 0x0200, 0x34b6,
+	0x3cb7, 0x14b4, 0x1cb5, 0xf054, 0x24b0, 0x4cb1, 0x34b6, 0x3cb7,
+	0xd04c, 0x0000, 0x28bf, 0xae0e, 0xcc6e, 0x28bf, 0xe016, 0x3cbf,
+	0xe42e, 0x28c1, 0xe42e, 0xa200, 0x3cbf, 0xce92, 0xe41e, 0x0bb8,
+	0xe41e, 0x0bb8, 0xe128, 0xd071, 0x2020, 0xe181, 0x2cbc, 0xa102,
+	0xf074, 0xcc44, 0xe184, 0x0bf5, 0xba4e, 0xe190, 0xe190, 0xe42e,
+	0xe004, 0x1495, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000,
+	0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037, 0x0000,
+	0xd038, 0x0000, 0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000,
+	0xd046, 0x0000, 0xd047, 0x0000, 0xd149, 0x0000, 0xe42e, 0xe0c0,
+	0x0059, 0xa102, 0xe40a, 0x0c22, 0xa102, 0xe42a, 0xa102, 0xe40a,
+	0x0c22, 0xe42a, 0x24c5, 0x4cc6, 0x04ba, 0x0cbb, 0x34ba, 0x3cbb,
+	0x14b4, 0x1cb5, 0xf074, 0x24ba, 0x4cbb, 0x14b2, 0x1cb3, 0x34ba,
+	0x3cbb, 0x24ba, 0x4cbb, 0xe0c2, 0x0048, 0xe0c2, 0x0052, 0xe42e,
+	0xa200, 0x34c5, 0x3cc6, 0xe42e, 0xf0a8, 0x2911, 0xe008, 0xffff,
+	0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xf0fe, 0x2911, 0xe008,
+	0x00ff, 0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xae10, 0x2b11,
+	0xe009, 0xff00, 0xaf11, 0xe042, 0x2ac7, 0xe42b, 0xe049, 0xaf31,
+	0xe009, 0x00ff, 0xe093, 0xe049, 0xaf21, 0xe009, 0x00ff, 0xe095,
+	0xe049, 0xaf11, 0xe009, 0x00ff, 0xe008, 0x00ff, 0xae10, 0xe056,
+	0xae10, 0xe085, 0xe056, 0xae10, 0xe083, 0xe056, 0xe42e, 0xe049,
+	0xa80f, 0xe046, 0xe42e, 0xca29, 0xf7f9, 0xd111, 0x0600, 0xce20,
+	0x26b4, 0x4eb5, 0xe045, 0xe004, 0x0040, 0xe065, 0xaf03, 0xce25,
+	0x3ec0, 0xe41e, 0x0c91, 0xa240, 0x18c0, 0xe426, 0xce24, 0x28c0,
+	0xe000, 0x0600, 0xce22, 0x24b0, 0x4cb1, 0xce20, 0xe41e, 0x0c91,
+	0xe42e, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa002, 0xce26, 0xca28,
+	0xf7f8, 0xe42e, 0x34c9, 0x3cca, 0xa200, 0x3cbd, 0xe0c0, 0x0049,
+	0x34cb, 0x3ccc, 0xe0c0, 0x0045, 0xaf04, 0x30be, 0xe0c0, 0x0049,
+	0x34b8, 0x3cb9, 0x10cb, 0x1ccc, 0x2abd, 0xb611, 0x3ebd, 0x26b8,
+	0x4eb9, 0x16c9, 0x1eca, 0xf033, 0x06b2, 0x0eb3, 0x16c3, 0x1ec4,
+	0xa200, 0xe423, 0x28be, 0x3cc1, 0xe428, 0x28bd, 0xf648, 0xe41e,
+	0x01db, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xf5da, 0xe0c0, 0x005d,
+	0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3cbd, 0xf53e,
+	0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0cdb, 0xa102, 0xe42a, 0xa102,
+	0xe40a, 0x0d05, 0xe42e, 0xa200, 0x3cc7, 0xa244, 0x34c3, 0x3cc4,
+	0x24ba, 0x4cbb, 0xd027, 0x0000, 0xe41e, 0x0c9a, 0xd027, 0x0001,
+	0xe408, 0x0d03, 0x24ba, 0x4cbb, 0xe41e, 0x0c6f, 0xe095, 0xe41e,
+	0x0c73, 0xe084, 0xaf02, 0xe000, 0x0600, 0xe092, 0xe084, 0xa802,
+	0xe41e, 0x0c3c, 0xe008, 0xffff, 0x34c5, 0x3cc6, 0xa144, 0xf034,
+	0xa200, 0xe42e, 0xe16b, 0xa202, 0xe42e, 0xa228, 0x34c3, 0x3cc4,
+	0x24ba, 0x4cbb, 0xd027, 0x0000, 0xe41e, 0x0c9a, 0xd027, 0x0001,
+	0xe408, 0x0d50, 0x24ba, 0x4cbb, 0xe41e, 0x0c6f, 0xe095, 0xe41e,
+	0x0c73, 0xe084, 0xaf02, 0xe000, 0x0600, 0xe092, 0xe41e, 0x0d55,
+	0xe084, 0xa802, 0xe41e, 0x0c3c, 0x00c5, 0x0cc6, 0x34c5, 0x3cc6,
+	0xf286, 0x26b2, 0x4eb3, 0xe046, 0xf242, 0xe084, 0xa020, 0x001b,
+	0x0c1c, 0xaf02, 0xe000, 0x0600, 0xe092, 0xe084, 0xa802, 0xe41e,
+	0x0c3c, 0x3c24, 0xf154, 0x2824, 0xae06, 0xa028, 0x04c5, 0x0cc6,
+	0x34c5, 0x3cc6, 0x34c3, 0x3cc4, 0x24ba, 0x4cbb, 0xd027, 0x0000,
+	0xe41e, 0x0c9a, 0xd027, 0x0001, 0xf048, 0xa200, 0xe42e, 0xe16b,
+	0xa200, 0x34c5, 0x3cc6, 0xa202, 0xe42e, 0x2111, 0x4d11, 0x341b,
+	0x3c1c, 0x2111, 0x4d11, 0xe160, 0x0004, 0x8129, 0xe005, 0x5649,
+	0xae21, 0xe00b, 0x444f, 0xe046, 0xf08a, 0xa200, 0x3c1a, 0x341b,
+	0x3c1c, 0x34c5, 0x3cc6, 0xe42e, 0x221b, 0x4e1c, 0x36c5, 0x3ec6,
+	0xaf03, 0xe082, 0xe042, 0xe092, 0xa202, 0x3c1a, 0xe42e, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c47, 0xf0b4, 0xe04a, 0xaf10,
+	0x1844, 0xf074, 0xe009, 0x00ff, 0x1a45, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x06d4, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x0368, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x036c, 0xe40e, 0x00a4,
+	0xe41e, 0x038b, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x038c,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x040f, 0xe40e, 0x00a4,
+	0xe41e, 0x0526, 0xe40e, 0x00a4, 0xa200, 0x3cb6, 0xa200, 0xcc4a,
+	0xcc4c, 0xe41e, 0x0459, 0xe41e, 0x0485, 0xe41e, 0x0870, 0xe41e,
+	0x0669, 0xe41e, 0x0975, 0xf0ad, 0xe41e, 0x095b, 0xe41e, 0x04bf,
+	0xe41e, 0x0492, 0xf03a, 0xa202, 0x3cb6, 0xe41e, 0x0813, 0xe41e,
+	0x08d1, 0xe16a, 0xe42e, 0xe42e, 0xa202, 0x3cb6, 0xe41e, 0x0870,
+	0xe41e, 0x05aa, 0xe41e, 0x0486, 0xe41e, 0x0f72, 0xe41e, 0x0fa5,
+	0xe41e, 0x0473, 0xe41e, 0x0d3a, 0x2813, 0xe016, 0x3c33, 0xe41e,
+	0x0ae4, 0xe41e, 0x1135, 0xe41e, 0x0669, 0xe41e, 0x0492, 0xe40a,
+	0x03e2, 0x2833, 0x4434, 0xe408, 0x03cc, 0xe41e, 0x0a28, 0xe40d,
+	0x03e2, 0xe41e, 0x0964, 0x2817, 0xe408, 0x03fc, 0xe41e, 0x0cef,
+	0xf714, 0xf05a, 0xe41e, 0x04bf, 0xe40e, 0x03e2, 0xe41e, 0x020f,
+	0xe404, 0x03e2, 0xe41e, 0x0d08, 0x2834, 0xe41a, 0x0620, 0xe404,
+	0x03f3, 0x2834, 0xe41a, 0x062f, 0xe41e, 0x0c36, 0x2833, 0x4434,
+	0xe41a, 0x054a, 0x2833, 0x5434, 0xe41a, 0x0638, 0x2833, 0x5434,
+	0xe41a, 0x0d2d, 0x2833, 0x5434, 0x3c34, 0xf05a, 0x281a, 0x3cab,
+	0xe40e, 0x03a9, 0xe41e, 0x1185, 0xe41e, 0x0ef4, 0xe41e, 0x07a4,
+	0xf08a, 0xe41e, 0x07bb, 0xf05a, 0xe41e, 0x057b, 0xa200, 0x3ca7,
+	0xe41e, 0x055e, 0x3ca3, 0x28a3, 0x3ca8, 0xe41e, 0x08d1, 0xe41e,
+	0x05bf, 0xe41e, 0x0813, 0xe42e, 0xa200, 0x3ca7, 0xe41e, 0x095b,
+	0xe41e, 0x055e, 0x3ca3, 0x3ca8, 0xa2fe, 0x3ca2, 0xe41e, 0x1129,
+	0xe41e, 0x08d1, 0xe41e, 0x05bf, 0xe41e, 0x0813, 0xe42e, 0xe41e,
+	0x0870, 0xe42e, 0xe167, 0x02d4, 0xe166, 0x0064, 0xd022, 0x0003,
+	0xe184, 0x041c, 0x9e16, 0x3517, 0x3d17, 0xe42e, 0xe42e, 0xe161,
+	0x0550, 0xa200, 0x3d11, 0x2844, 0xae08, 0x1810, 0x3d11, 0xa200,
+	0x3d11, 0x2845, 0xae08, 0x1811, 0x3d11, 0xe42e, 0x3c03, 0xf028,
+	0xe42e, 0xa231, 0xa104, 0xf0e6, 0xa102, 0xb435, 0xf0ba, 0xa104,
+	0xb4cd, 0xf086, 0xa102, 0xf05a, 0xa104, 0xf026, 0xe42e, 0xa015,
+	0xa029, 0x3e01, 0x8401, 0xe182, 0x03e8, 0xe018, 0xe161, 0x0556,
+	0x3511, 0x3d11, 0xe005, 0x03e9, 0x2803, 0xa102, 0xf06a, 0xa106,
+	0xf04a, 0xa106, 0xf02a, 0xa103, 0xe161, 0x0554, 0x3711, 0x3f11,
+	0xe42e, 0xe41e, 0x0148, 0xe16a, 0xd130, 0x0005, 0xa2fe, 0x34b4,
+	0x3cb5, 0xe161, 0x0554, 0xc703, 0x3d11, 0xa202, 0x3cb7, 0xe161,
+	0x0550, 0xc703, 0x3d11, 0xa200, 0x3cb0, 0x3cb1, 0xe41e, 0x064d,
+	0xe41e, 0x1130, 0xe42e, 0xa200, 0xcc44, 0xcc4a, 0xcc4c, 0xcc72,
+	0xd130, 0x0005, 0xd03a, 0x0005, 0xd04b, 0x0001, 0xd04c, 0x0000,
+	0xd008, 0x0000, 0xe41e, 0x025f, 0xe42e, 0xe42e, 0xa200, 0x3c60,
+	0xa200, 0x3cb8, 0x3c34, 0x3c33, 0x3c17, 0xa2fc, 0x3ca2, 0xa2fa,
+	0x3ca3, 0xe42e, 0xa202, 0x3cf0, 0x2814, 0xa140, 0xf278, 0xa204,
+	0x3cf0, 0x2c10, 0xf23a, 0x2c11, 0xf21a, 0x2c10, 0xe002, 0x0780,
+	0xf1d0, 0x2c11, 0xe002, 0x0780, 0xf190, 0x8444, 0x8245, 0xe018,
+	0xe002, 0x1fe0, 0xf130, 0xe0c0, 0x0059, 0xa106, 0xf0d8, 0xe41e,
+	0x07a4, 0xf04a, 0xe41e, 0x01db, 0xf09e, 0xe41e, 0x05f4, 0x2aa2,
+	0xb7f5, 0x3ea2, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe16a,
+	0xa200, 0xcea6, 0xe41e, 0x07a4, 0xe408, 0x0508, 0xe41e, 0x1076,
+	0x28d3, 0xe002, 0x00af, 0xe406, 0x04fe, 0x28d3, 0xe002, 0x00b0,
+	0xf28a, 0x28d3, 0xe002, 0x00b1, 0xf2aa, 0x28d3, 0xe002, 0x00b2,
+	0xf26a, 0x28d3, 0xe002, 0x00b3, 0xf21a, 0x28d3, 0xe002, 0x00b4,
+	0xf1ea, 0x28d3, 0xe002, 0x00b5, 0xf1ea, 0x28d3, 0xe002, 0x00b6,
+	0xe40a, 0x04fd, 0x28d3, 0xe002, 0x00b7, 0xe40a, 0x04fe, 0x28d3,
+	0xe002, 0x00b8, 0xf0ca, 0x28d3, 0xe002, 0x00b9, 0xf082, 0xf07e,
+	0xe41e, 0x104a, 0xe41e, 0x09d5, 0xf43e, 0xf0de, 0xe41e, 0x104a,
+	0xe40e, 0x04bf, 0xe41e, 0x104a, 0xe41e, 0x09fb, 0xe40e, 0x04bf,
+	0xe41e, 0x01db, 0xe16a, 0xe42e, 0xa200, 0xcea6, 0xe41e, 0x07a4,
+	0xe408, 0x0519, 0xe41e, 0x1076, 0xe41e, 0x07a4, 0xe408, 0x0519,
+	0xe42e, 0xe41e, 0x01db, 0xe42e, 0x281d, 0xae02, 0x4c20, 0xae02,
+	0x4c1f, 0xae06, 0x4c1e, 0xae24, 0x4c1b, 0xe42e, 0xe41e, 0x064d,
+	0xe166, 0x0054, 0x9e06, 0xf16a, 0x28ad, 0xa102, 0xcc44, 0xa200,
+	0x3c01, 0xe184, 0x053f, 0x9e06, 0x5c01, 0xa802, 0xf07a, 0x2801,
+	0xe000, 0x0400, 0xe09e, 0xa208, 0x3d07, 0x2801, 0xa002, 0x3c01,
+	0xe190, 0xe42e, 0xe41e, 0x0815, 0xe0c0, 0x0048, 0xe0c2, 0x0051,
+	0xe42e, 0xe42e, 0x28a2, 0x2a54, 0xf07b, 0x2a1a, 0xa105, 0xf04b,
+	0xe166, 0x0598, 0x2916, 0x3ca9, 0xe41e, 0x0618, 0xa804, 0xe42a,
+	0x28a9, 0xe41e, 0x0608, 0xe41e, 0x0598, 0xe42e, 0x28a7, 0xa102,
+	0xb608, 0x3ca7, 0x28a6, 0xf12a, 0x28a5, 0xe000, 0x0578, 0xe092,
+	0x28a5, 0xa002, 0x3ca5, 0xa122, 0xf028, 0x3ca5, 0x28a6, 0xa102,
+	0x3ca6, 0x2901, 0xe049, 0x1aad, 0xe425, 0xe41e, 0x07bf, 0xe049,
+	0xa2fa, 0xb7f2, 0xe42e, 0xe166, 0x0599, 0x2906, 0xe41e, 0x0618,
+	0xa804, 0xf07a, 0x2906, 0x3ca9, 0xe41e, 0x0608, 0xe41e, 0x0598,
+	0xe166, 0x0598, 0x2906, 0xe41e, 0x0618, 0xa804, 0xf07a, 0x2906,
+	0x3ca9, 0xe41e, 0x0608, 0xe41e, 0x0598, 0xe41e, 0x0647, 0xe42e,
+	0x28a9, 0xe424, 0x28a4, 0xe000, 0x0578, 0xe092, 0x28a9, 0x3d01,
+	0x28a4, 0xa002, 0x3ca4, 0xa122, 0xf028, 0x3ca4, 0x28a6, 0xa002,
+	0x3ca6, 0xe42e, 0xa200, 0x3c06, 0xe004, 0x0054, 0xe09c, 0x28ad,
+	0xa102, 0xcc44, 0xe184, 0x05bd, 0x9e06, 0x5c06, 0xa802, 0xf048,
+	0x2806, 0xe41e, 0x0610, 0x2a06, 0xa003, 0x3e06, 0xe42e, 0xe167,
+	0x0400, 0xe004, 0x0054, 0xe09c, 0x28ad, 0xa102, 0xcc44, 0xa200,
+	0x3c06, 0xe184, 0x05d2, 0x2b17, 0xaf05, 0xa803, 0x5a06, 0xe056,
+	0x2a06, 0xa003, 0x3e06, 0x9f06, 0xe42e, 0x28aa, 0x3c06, 0x2806,
+	0xe000, 0x0400, 0xe092, 0x2901, 0xf0da, 0x2806, 0xa002, 0x3c06,
+	0x18ad, 0xf038, 0xa200, 0x3c06, 0x2806, 0x18aa, 0xf718, 0xa2fe,
+	0xe42e, 0xa20e, 0x3d01, 0x2806, 0xa002, 0x3caa, 0x18ad, 0xf038,
+	0xa200, 0x3caa, 0x2806, 0xe42e, 0xe161, 0x0400, 0x28ad, 0xa102,
+	0xcc44, 0xe184, 0x05fe, 0x2911, 0xe016, 0xe428, 0xe190, 0xe42e,
+	0xe424, 0xe000, 0x0400, 0xe092, 0x2901, 0xa80c, 0x3d01, 0xe42e,
+	0xe424, 0xe000, 0x0400, 0xe092, 0x2901, 0xa80a, 0x3d01, 0xe42e,
+	0xe424, 0xe000, 0x0400, 0xe092, 0x2901, 0xa806, 0x3d01, 0xe42e,
+	0xe049, 0xa200, 0xe425, 0xe001, 0x0400, 0xe093, 0x2901, 0xe42e,
+	0x28a3, 0x3ca8, 0xe41e, 0x05d5, 0xf094, 0x3ca2, 0x2a1a, 0xa105,
+	0x28a2, 0xe41b, 0x0600, 0xa200, 0xe42e, 0xa2fe, 0xe42e, 0xe166,
+	0x0598, 0x2916, 0xb608, 0x3ca1, 0x2916, 0xb608, 0x3ca0, 0xe42e,
+	0x281a, 0xa104, 0xe42a, 0xe166, 0x0599, 0x290e, 0xe41e, 0x0600,
+	0xe166, 0x0598, 0x2916, 0x3d0e, 0x28a2, 0x3d06, 0xe42e, 0xa2fa,
+	0xe166, 0x0598, 0xc701, 0x3d16, 0xe42e, 0xa2fa, 0x3ca0, 0x3ca1,
+	0x3ca8, 0xa202, 0x3ca7, 0xa200, 0x3ca5, 0x3ca4, 0x3ca6, 0x3ca9,
+	0xe166, 0x0578, 0xc710, 0x3d16, 0xe41e, 0x0647, 0xa200, 0x3caa,
+	0xe161, 0x0400, 0x2aad, 0xe42b, 0xa103, 0x3e01, 0x8601, 0x3d11,
+	0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0676, 0xa102, 0xe40a,
+	0x06b2, 0xa102, 0xe40a, 0x067c, 0xe40e, 0x06b2, 0x24c0, 0x4cc1,
+	0x04c2, 0x0cc3, 0x34c4, 0x3cc5, 0x28cc, 0xf13a, 0xe0c0, 0x0048,
+	0x34cf, 0x3cd0, 0x24cf, 0x4cd0, 0xe0c1, 0x0049, 0x36c8, 0x3ec9,
+	0x14c8, 0x1cc9, 0xe0c1, 0x0045, 0xaf05, 0xa803, 0xb611, 0x3ecc,
+	0xe0c0, 0x0048, 0xe008, 0x01ff, 0x3cca, 0xe0c0, 0x0048, 0x34c6,
+	0xe008, 0xfe00, 0x3cc7, 0xa200, 0xcc92, 0xcc8e, 0xe180, 0xe41e,
+	0x06b9, 0xe41e, 0x0222, 0xd071, 0x202a, 0xe181, 0xa200, 0x3cce,
+	0xe41e, 0x070b, 0xe41e, 0x102c, 0x28ca, 0xa102, 0xe412, 0x103f,
+	0xa200, 0xceaa, 0xa202, 0x3cce, 0xa202, 0xb61a, 0xe16a, 0xe42e,
+	0xe42e, 0xd030, 0x0000, 0xd031, 0x0000, 0xd032, 0x0000, 0xd034,
+	0x0000, 0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037,
+	0x0000, 0xd038, 0x0000, 0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c,
+	0x0000, 0xd149, 0x0000, 0xe42e, 0xc896, 0xf05a, 0xe41e, 0x0702,
+	0x3cdc, 0xf058, 0xd04b, 0x0001, 0xa200, 0x3cdc, 0x28d8, 0xcc6e,
+	0xd04c, 0x0000, 0xe470, 0xa202, 0x3cdc, 0xe41e, 0x0702, 0xcc96,
+	0xe42a, 0x28d8, 0xcc6e, 0xe42e, 0xc896, 0xe428, 0xd04b, 0x0001,
+	0x28d8, 0xcc6e, 0xd04c, 0x0000, 0xe42e, 0xa200, 0x3ccd, 0x3cd8,
+	0xe41e, 0x0702, 0x3cdc, 0xd04b, 0x0001, 0x28d8, 0xcc6e, 0xe190,
+	0xe128, 0xe42e, 0xe41e, 0x10e9, 0xe004, 0x0080, 0x2acd, 0xb616,
+	0x3cd8, 0xa200, 0xe42e, 0x28cc, 0xf1aa, 0xe41e, 0x024f, 0xe000,
+	0x0440, 0xce50, 0xe005, 0x01b1, 0x28d9, 0xa806, 0xa108, 0xe012,
+	0xa806, 0xae06, 0x3cfe, 0xe004, 0x01b1, 0x58fe, 0xce52, 0xe41e,
+	0x0257, 0xd14e, 0x0000, 0xd144, 0x0000, 0xe42e, 0xd027, 0x0000,
+	0xe41e, 0x0768, 0xd027, 0x0001, 0x28d9, 0xf25a, 0xca48, 0xa802,
+	0xf7e8, 0x24c6, 0x4cc7, 0xce40, 0xd121, 0x0000, 0xd122, 0x0040,
+	0xe0c0, 0x0043, 0xa806, 0xae02, 0xa032, 0xce46, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xca48, 0xa802, 0xf7e8, 0x24c6, 0x4cc7, 0xe000,
+	0x0200, 0x34c6, 0x3cc7, 0x14c4, 0x1cc5, 0xf054, 0x24c0, 0x4cc1,
+	0x34c6, 0x3cc7, 0x28cc, 0xe418, 0x07d2, 0xe41e, 0x0815, 0xd14e,
+	0x0000, 0xd144, 0x0000, 0xe42e, 0xe0c1, 0x0059, 0xa103, 0xa200,
+	0xb636, 0xe000, 0x001c, 0xe0c1, 0x0045, 0xe052, 0xe01a, 0xe42e,
+	0xa200, 0x3ccb, 0xe004, 0x0200, 0x3cd9, 0xe41e, 0x075c, 0x3ccc,
+	0x24c6, 0x4cc7, 0xe0c1, 0x0049, 0x36cf, 0x3ed0, 0x26cf, 0x4ed0,
+	0xe045, 0xf033, 0x06c2, 0x0ec3, 0xe003, 0x0200, 0x28cc, 0xb602,
+	0x3ccc, 0xf173, 0xe001, 0x0200, 0x3ed9, 0x28cc, 0xf128, 0x28cb,
+	0xf658, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xf60a, 0xe0c0, 0x005d,
+	0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3ccb, 0xf56e,
+	0x28d9, 0x2acc, 0xf039, 0xe004, 0x0200, 0x3cd9, 0xe42e, 0xc868,
+	0xa80e, 0x3c04, 0x7404, 0xe42e, 0x28cc, 0xe42a, 0xe41e, 0x0815,
+	0xe0c0, 0x0049, 0x34cf, 0x3cd0, 0x24cf, 0x4cd0, 0xe0c1, 0x0048,
+	0x36cf, 0x3ed0, 0x26cf, 0x4ed0, 0xe045, 0xa200, 0xb626, 0xe003,
+	0x0200, 0xb606, 0xe42e, 0xe0c0, 0x0045, 0xa808, 0xe42e, 0xe41e,
+	0x07a4, 0xe42a, 0xe0c0, 0x0045, 0xaf04, 0xa802, 0xe42e, 0xe0c1,
+	0x0045, 0xaf07, 0xa202, 0xa803, 0xe429, 0xa204, 0xa805, 0xe429,
+	0xa208, 0xe42e, 0xe41e, 0x024f, 0x28d9, 0xe002, 0x0200, 0xe40a,
+	0x0811, 0x28d9, 0xa806, 0xf1fa, 0xa108, 0xe012, 0xae06, 0x3cfe,
+	0x28d9, 0xaf04, 0xae20, 0xe000, 0x01c0, 0xce50, 0xe190, 0xca52,
+	0x5cfe, 0x58fe, 0x2ad9, 0xa807, 0xae07, 0x3efe, 0xe005, 0x01b1,
+	0x5efe, 0xe056, 0x2ad9, 0xaf05, 0xae21, 0xe001, 0x0140, 0xce51,
+	0xe190, 0xce52, 0xe004, 0x01fc, 0x18d9, 0xf022, 0xf13e, 0x28d9,
+	0xa006, 0xaf04, 0xae20, 0xe000, 0x0440, 0xce50, 0x28d9, 0xa806,
+	0xa108, 0xe012, 0xae06, 0xa83e, 0x3cfe, 0xe004, 0x01b1, 0x58fe,
+	0xce52, 0xe40e, 0x0257, 0xe41e, 0x079f, 0xf1ae, 0xc872, 0xc001,
+	0x343b, 0x3c3c, 0xc000, 0x26d7, 0x4ed6, 0xae07, 0xe045, 0xf053,
+	0x26d7, 0x4ed6, 0xae07, 0xcc73, 0xe41e, 0x084c, 0xe049, 0xc001,
+	0x243b, 0x4c3c, 0xc000, 0xaf06, 0xe046, 0xb608, 0xf02e, 0xcaaa,
+	0x2ace, 0xb616, 0xe0c1, 0x0048, 0x36cf, 0x3ed0, 0x26cf, 0x4ed0,
+	0xe042, 0xe049, 0x16c4, 0x1ec5, 0xf035, 0x14c2, 0x1cc3, 0xe0c2,
+	0x0048, 0xe0c2, 0x0052, 0xa200, 0xceaa, 0xc001, 0x243b, 0x4c3c,
+	0xc000, 0xe41e, 0x0851, 0xe42e, 0xc001, 0x2439, 0x4c3a, 0xc000,
+	0xe42e, 0xc001, 0xaf06, 0x3439, 0x3c3a, 0xc000, 0xe42e, 0xe0c0,
+	0x0045, 0xaf04, 0xa80e, 0xa104, 0xe428, 0xf06e, 0xe41e, 0x07a4,
+	0xe418, 0x01db, 0xe42e, 0xe41e, 0x10c2, 0xcaa2, 0xe008, 0x00ff,
+	0xe002, 0x00b1, 0xe428, 0xe41e, 0x07a4, 0xe418, 0x01db, 0xe42e,
+	0xe0c0, 0x0059, 0xa102, 0xf34a, 0xa102, 0xe42a, 0xa102, 0xf05a,
+	0xa102, 0xe40a, 0x08b5, 0xe42e, 0xe0c0, 0x0060, 0xaf08, 0x30e1,
+	0xaf02, 0x30e2, 0xe0c0, 0x0060, 0xa81e, 0x3ce0, 0xe0c0, 0x0061,
+	0xa83e, 0x3ce4, 0xe0c0, 0x0065, 0xaf04, 0xa80e, 0x3cba, 0xa200,
+	0x3c56, 0x3c55, 0xa202, 0x3cb9, 0x2856, 0xf11a, 0xe0c0, 0x006c,
+	0xe002, 0x0088, 0x3c5c, 0xe0c0, 0x006a, 0xce20, 0xd112, 0x000c,
+	0xd111, 0x0536, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e, 0xe0c0,
+	0x0060, 0x34c0, 0x3cc1, 0xe0c0, 0x0061, 0xae14, 0x34c2, 0x3cc3,
+	0xe0c0, 0x0062, 0xaf02, 0x3054, 0xe42e, 0xe41e, 0x0412, 0xe41e,
+	0x0174, 0xca28, 0xf7f8, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0210,
+	0xd112, 0x00c4, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe0c0, 0x0060,
+	0x3cad, 0xe0c0, 0x0061, 0x3cae, 0xe0c0, 0x006e, 0xe41e, 0x020a,
+	0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x091f, 0xa102, 0xe42a,
+	0xa102, 0xf05a, 0xa102, 0xe40a, 0x095a, 0xe42e, 0x2444, 0x4c45,
+	0xae08, 0xe0c2, 0x006f, 0x20b4, 0x4cb5, 0xa002, 0x34b4, 0x3cb5,
+	0xe0c2, 0x0070, 0x28a3, 0xe0c2, 0x0071, 0x28b8, 0xe0c2, 0x0072,
+	0xe41e, 0x051c, 0xe0c2, 0x0073, 0xa200, 0xe0c2, 0x0074, 0x28b6,
+	0x2a17, 0xae29, 0xe056, 0xe0c2, 0x0076, 0x28a2, 0xe0c2, 0x0077,
+	0xe161, 0x0550, 0x2111, 0x4d11, 0xe0c2, 0x0078, 0x2111, 0x4d11,
+	0xe0c2, 0x0079, 0x20b0, 0x4cb1, 0xe0c2, 0x007c, 0xe167, 0x0554,
+	0x2117, 0x4d17, 0xe0c2, 0x007e, 0x2117, 0x4d17, 0xe0c2, 0x007d,
+	0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2, 0x0053, 0xe42e, 0x24b3,
+	0x4cb2, 0xe0c2, 0x006d, 0x28b6, 0xe0c2, 0x0070, 0x2444, 0x4c45,
+	0xae08, 0xe0c2, 0x0071, 0x20b0, 0x4cb1, 0xe0c2, 0x0072, 0xa208,
+	0xe0c2, 0x0073, 0xa202, 0xe0c2, 0x0074, 0xa200, 0xe0c2, 0x0075,
+	0xe161, 0x0550, 0x2111, 0x4d11, 0xe0c2, 0x0076, 0x2111, 0x4d11,
+	0xe0c2, 0x0077, 0x28b6, 0xe016, 0x58f0, 0xe0c2, 0x0078, 0xe161,
+	0x0554, 0x2111, 0x4d11, 0xe0c2, 0x007a, 0x2111, 0x4d11, 0xe0c2,
+	0x0079, 0x2813, 0xe016, 0xae10, 0x4c15, 0xae10, 0x4c14, 0xe0c2,
+	0x007b, 0xe42e, 0xe42e, 0xe161, 0x05a8, 0x2810, 0x3d11, 0x2811,
+	0x3d11, 0x2813, 0x3d11, 0xe42e, 0xe161, 0x05a8, 0x2810, 0x1911,
+	0xf0a8, 0x2811, 0x1911, 0xf078, 0x2813, 0x1911, 0xf048, 0xa200,
+	0x3c17, 0xe42e, 0xa202, 0x3c17, 0xe42e, 0xa200, 0x3c28, 0xe16a,
+	0xa200, 0xcea6, 0xa23e, 0x3cf0, 0xe41e, 0x07a4, 0xe408, 0x09cf,
+	0xe41e, 0x1076, 0x28d3, 0xe002, 0x00af, 0xe406, 0x09c3, 0x28d3,
+	0xe002, 0x00b0, 0xf28a, 0x28d3, 0xe002, 0x00b1, 0xf35a, 0x28d3,
+	0xe002, 0x00b2, 0xf31a, 0x28d3, 0xe002, 0x00b3, 0xf27a, 0x28d3,
+	0xe002, 0x00b4, 0xf29a, 0x28d3, 0xe002, 0x00b5, 0xf2ba, 0x28d3,
+	0xe002, 0x00b6, 0xe40a, 0x09bd, 0x28d3, 0xe002, 0x00b7, 0xe40a,
+	0x09c3, 0x28d3, 0xe002, 0x00b8, 0xf17a, 0x28d3, 0xe002, 0x00b9,
+	0xf132, 0xf12e, 0xe41e, 0x1122, 0xe41e, 0x104a, 0xe41e, 0x09d5,
+	0xf1bd, 0xa202, 0x3c28, 0xe40e, 0x0977, 0x2828, 0xe428, 0xe41e,
+	0x104a, 0xe40e, 0x0977, 0x2828, 0xe428, 0xe41e, 0x104a, 0xe40e,
+	0x0977, 0xe41e, 0x104a, 0xe41e, 0x09fb, 0xe40e, 0x0977, 0x2828,
+	0xe428, 0xe41e, 0x0857, 0xe16b, 0xe42e, 0xba4e, 0x3c14, 0xba4e,
+	0x3c15, 0xba40, 0x3c13, 0xba5a, 0x3c10, 0xba5a, 0x3c11, 0x2813,
+	0xe016, 0x3c33, 0xe41e, 0x0ae4, 0xe41e, 0x041f, 0xba42, 0x3cb7,
+	0xba44, 0xa200, 0x3cb0, 0xba46, 0x3cb1, 0xba46, 0xe41e, 0x042e,
+	0xba62, 0xba41, 0xba57, 0xae25, 0xe056, 0x34b3, 0x3cb2, 0xba40,
+	0x3c16, 0xba6a, 0xe42e, 0xba46, 0xa104, 0xf08a, 0xa104, 0xf0fa,
+	0xa106, 0xf03a, 0xa108, 0xf10a, 0xe42e, 0xba46, 0xba40, 0xf02a,
+	0xba6e, 0xba5a, 0xba40, 0xba5a, 0xba42, 0xf19e, 0xba62, 0xba68,
+	0xba6c, 0xba6a, 0xf14e, 0xba7e, 0xba6c, 0xba6c, 0xba6c, 0xba60,
+	0xba60, 0xba60, 0xba60, 0xba60, 0xba60, 0xba6c, 0xba6c, 0xba6c,
+	0xba6c, 0xba6c, 0xba7e, 0xe190, 0xba40, 0xba7e, 0xa200, 0xe42e,
+	0xa200, 0x3c28, 0xe16a, 0xa200, 0xcea6, 0xe41e, 0x07a4, 0xe408,
+	0x0aa5, 0xe41e, 0x1076, 0x28d3, 0xe002, 0x00af, 0xe406, 0x0a9e,
+	0x28d3, 0xe002, 0x00b0, 0xf2ca, 0x28d3, 0xe002, 0x00b1, 0xf30a,
+	0x28d3, 0xe002, 0x00b2, 0xf30a, 0x28d3, 0xe002, 0x00b3, 0xf33a,
+	0x28d3, 0xe002, 0x00b4, 0xf18a, 0x28d3, 0xe002, 0x00b5, 0xf38a,
+	0x28d3, 0xe002, 0x00b6, 0xe40a, 0x0a8d, 0x28d3, 0xe002, 0x00b7,
+	0xe40a, 0x0a9a, 0x28d3, 0xe002, 0x00b8, 0xf06a, 0x28d3, 0xe002,
+	0x00b9, 0xf022, 0xe190, 0xe41e, 0x104a, 0xe40e, 0x0a2a, 0xe41e,
+	0x1122, 0xe41e, 0x104a, 0xe41e, 0x09d5, 0xe40e, 0x0a2a, 0xe41e,
+	0x104a, 0xe40e, 0x0a2a, 0xe41e, 0x104a, 0x2856, 0xe418, 0x0ba4,
+	0xe40e, 0x0a2a, 0xe41e, 0x0c2c, 0xe41e, 0x104a, 0xe41e, 0x0ab4,
+	0xa202, 0xb61a, 0x3c28, 0xe41d, 0x0c33, 0xe40e, 0x0a2a, 0xe41e,
+	0x104a, 0xe41e, 0x09fb, 0xe40e, 0x0a2a, 0xe41e, 0x0c2c, 0xe41e,
+	0x104a, 0xe41e, 0x0aff, 0xa202, 0xb61a, 0x3c28, 0xe41d, 0x0c33,
+	0xe40e, 0x0a2a, 0xe41e, 0x104a, 0xe40e, 0x0a2a, 0x2828, 0xe408,
+	0x0aa7, 0xe41e, 0x104a, 0xe40e, 0x0a2a, 0xe41e, 0x01db, 0x281a,
+	0x3c1b, 0x281e, 0xe016, 0x3c33, 0xe41e, 0x0ae4, 0xe41e, 0x041f,
+	0x2828, 0xe428, 0xe16b, 0xe42e, 0xba5e, 0xba40, 0xa102, 0xf028,
+	0xba6e, 0xba40, 0xba4e, 0x3c1c, 0x2816, 0xa102, 0xf038, 0xcfa0,
+	0xcba2, 0xba40, 0xe049, 0x3c1d, 0xa103, 0xf02b, 0xba40, 0x3c1e,
+	0xba40, 0x3c1f, 0xba40, 0x3c20, 0xba40, 0x3c21, 0xba4a, 0x3c22,
+	0x281d, 0x4c1e, 0xf038, 0xba40, 0x3c23, 0xba46, 0xba40, 0x3c27,
+	0xf098, 0xba40, 0xf07a, 0xcfa0, 0xcba4, 0x3c24, 0xcfa0, 0xcba4,
+	0x3c25, 0xa200, 0x3c1a, 0xe42e, 0x2810, 0xa01e, 0xaf08, 0x3c44,
+	0x2811, 0xa01e, 0xaf08, 0x3c45, 0x2833, 0xf06a, 0x2845, 0xa002,
+	0xaf02, 0xae02, 0x3c45, 0x8444, 0x8245, 0xe018, 0x3c47, 0x2c45,
+	0x3c48, 0x2833, 0xe42a, 0x2c45, 0xaf02, 0x3c48, 0xe42e, 0xba5e,
+	0xba42, 0x3c39, 0xba4e, 0x3c1c, 0x2816, 0xf03a, 0xcfa0, 0xcba2,
+	0xba40, 0x3c1d, 0xf068, 0xba40, 0x3c1e, 0xf048, 0xba40, 0xf02e,
+	0x3c1e, 0xba40, 0x3c1f, 0xba40, 0x3c20, 0xba40, 0x3c21, 0xba4a,
+	0x3c22, 0x2839, 0xa104, 0x2a1e, 0xa103, 0xe056, 0xf03a, 0xba40,
+	0x3c26, 0xba46, 0xba40, 0x3c23, 0xba40, 0x3c27, 0xf098, 0xba40,
+	0xf07a, 0xcfa0, 0xcba4, 0x3c24, 0xcfa0, 0xcba4, 0x3c25, 0xa202,
+	0x2a39, 0xa105, 0xb656, 0x3c1a, 0xe42e, 0xe41e, 0x07a4, 0xe408,
+	0x0b60, 0xe41e, 0x1076, 0x28d3, 0xe002, 0x00b0, 0xe40a, 0x0b62,
+	0x28d3, 0xe002, 0x00b2, 0xe40a, 0x0b62, 0x28d3, 0xe002, 0x00b5,
+	0xe40a, 0x0b62, 0x28d3, 0xe002, 0x00b3, 0xe40a, 0x0b62, 0x28d3,
+	0xe002, 0x00b6, 0xe40a, 0x0b62, 0x28d3, 0xe002, 0x00af, 0xe406,
+	0x0b64, 0x28d3, 0xe002, 0x00b1, 0xe40a, 0x0b60, 0xe40e, 0x0b62,
+	0xe41e, 0x01db, 0xe40e, 0x0b6e, 0xe41e, 0x104a, 0x8444, 0x82d3,
+	0xe018, 0x3c46, 0xe41e, 0x0b70, 0xa200, 0xe42e, 0xa2fe, 0xe42e,
+	0x2810, 0xe002, 0x0af0, 0xf024, 0xba44, 0x2821, 0xf058, 0xba40,
+	0x3c30, 0xba4a, 0x3c31, 0x281a, 0xf27a, 0xba40, 0x3c37, 0xf24a,
+	0x281e, 0xf03a, 0xa204, 0xf07e, 0x2834, 0xf04a, 0xa202, 0x2a1b,
+	0xf02b, 0xa208, 0x3c01, 0xe161, 0x0200, 0xe162, 0x0204, 0xe163,
+	0x0208, 0xe164, 0x020c, 0xa102, 0xcc44, 0xe184, 0x0ba0, 0xba4e,
+	0x3d11, 0xba4e, 0x3d12, 0xba40, 0xba4e, 0x3d13, 0xba4e, 0x3d14,
+	0xba40, 0xba40, 0x3c36, 0xe42e, 0x2a56, 0x285a, 0xa120, 0xb615,
+	0x3e56, 0xe42b, 0xa200, 0x3c58, 0xe162, 0x0520, 0xba4e, 0x2a58,
+	0xa803, 0xf049, 0xae10, 0x3c57, 0xf03e, 0x4c57, 0x3d12, 0x2a58,
+	0xa003, 0x3e58, 0xa80f, 0xe41b, 0x0c10, 0x2856, 0xf09a, 0xc894,
+	0xf6e8, 0x2858, 0x2858, 0xa802, 0xf03a, 0x2857, 0x3d12, 0xa211,
+	0x2858, 0xa80e, 0xf0ba, 0xe045, 0xaf03, 0xf06b, 0xa103, 0x3e01,
+	0xa201, 0x8601, 0x3f12, 0xe41e, 0x0c10, 0xe162, 0x0520, 0x2859,
+	0x3d12, 0x2858, 0x3d12, 0xa200, 0x3d12, 0x3d12, 0xe0c1, 0x006b,
+	0x285a, 0xa002, 0xae06, 0xe041, 0xaf06, 0x3c5a, 0xce21, 0xd111,
+	0x0520, 0xd112, 0x0004, 0xd113, 0x0000, 0xca28, 0xf7f8, 0xe42e,
+	0xa200, 0x3c5d, 0xe0c0, 0x005c, 0xe0c1, 0x0065, 0xaf12, 0xa802,
+	0xaf15, 0xa803, 0xe016, 0xe056, 0xf04a, 0xa200, 0x3c56, 0xe42e,
+	0x285e, 0xf05a, 0xe0c0, 0x005d, 0xe42a, 0xf7be, 0xe0c0, 0x005d,
+	0xe00a, 0x0200, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3c5e, 0xf71e,
+	0xd112, 0x0004, 0xe0c0, 0x006b, 0xe000, 0x0088, 0x085d, 0xce20,
+	0xd111, 0x0520, 0xd113, 0x0000, 0xca28, 0xf7f8, 0xe162, 0x0520,
+	0x285b, 0x2a5d, 0xa010, 0xa011, 0x3c5b, 0x3e5d, 0x1a5c, 0xe41b,
+	0x0bf0, 0xa200, 0x3c5e, 0xe42e, 0x2860, 0xe428, 0xe41e, 0x0542,
+	0xa202, 0x3c60, 0xe42e, 0xa200, 0x3c60, 0xe42e, 0xe16a, 0xa200,
+	0x3c42, 0x3c43, 0x2841, 0x2a34, 0xb616, 0x3c41, 0x2834, 0xf04a,
+	0x281a, 0xb634, 0x3c1a, 0xe41e, 0x0d54, 0x281c, 0xcfc8, 0xe16a,
+	0xe41e, 0x0b35, 0xf084, 0xe41e, 0x0dfa, 0xe41e, 0x0c5e, 0xe41e,
+	0x0c9a, 0xf76a, 0x8444, 0x8248, 0xe018, 0x3c46, 0x1841, 0xe410,
+	0x0c7a, 0xe16a, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xe16a, 0x2c46,
+	0x1c41, 0xe410, 0x0c7a, 0xe41e, 0x0cba, 0xe41e, 0x0cc7, 0xe42d,
+	0xe41e, 0x0ec1, 0xe41e, 0x0ca9, 0xe41e, 0x0c9a, 0xf048, 0xe41e,
+	0x0c9f, 0xf72a, 0x24d7, 0x4cd6, 0xae06, 0xc873, 0xe046, 0xe422,
+	0xe16b, 0xe42e, 0xe41e, 0x0cba, 0xe41e, 0x0c89, 0xe41e, 0x0ec1,
+	0xe41e, 0x0ca9, 0xe41e, 0x0c9a, 0xe428, 0x2c46, 0x1c41, 0xe42a,
+	0xf72e, 0xa2fe, 0x3c40, 0xd1ce, 0x0000, 0xd1c3, 0x0000, 0xcbc0,
+	0xf7f8, 0xd1c0, 0x0020, 0xd1e0, 0x0010, 0xcbc0, 0xf7f8, 0xd1e0,
+	0x000a, 0xe42e, 0x2c43, 0x1c48, 0xe01a, 0xe016, 0xe42e, 0xcb8a,
+	0xb60c, 0x3c40, 0xe016, 0xe42a, 0xc88e, 0xc895, 0xe017, 0xe042,
+	0xe42e, 0xd1c8, 0x0001, 0x2841, 0xa002, 0x3c41, 0x2842, 0xa002,
+	0x3c42, 0x1844, 0xe428, 0xd1c6, 0x0004, 0x3c42, 0x2843, 0xa002,
+	0x3c43, 0xe42e, 0x2843, 0xae0e, 0x4c42, 0xcf94, 0x2841, 0xcf98,
+	0xd1c3, 0x0000, 0xcbc0, 0xf7f8, 0xd1e0, 0x0005, 0xe42e, 0xcbc0,
+	0xf7f8, 0xe180, 0xe180, 0x28dc, 0xe41a, 0x06e3, 0xe181, 0xd1c0,
+	0x000f, 0xe005, 0x8000, 0xa103, 0xf155, 0xcb9c, 0xf138, 0xcb80,
+	0xf7b8, 0xd1e0, 0x000a, 0xd1c0, 0x0010, 0xcb8a, 0xb60c, 0x3c40,
+	0xf056, 0x2c47, 0x1841, 0x1840, 0xf054, 0xcbc0, 0xf7f8, 0xe16a,
+	0xe42e, 0xd1c0, 0x0000, 0xd1ce, 0x0000, 0xe16b, 0xe42e, 0x28ba,
+	0xf16a, 0xa102, 0xf06a, 0xa102, 0xf0ba, 0xa104, 0xf05a, 0xf0ae,
+	0x281b, 0xf098, 0xf0ce, 0x281b, 0xa102, 0xf096, 0xf03e, 0x281b,
+	0xf06a, 0xf03e, 0xa2fe, 0xe42e, 0xa202, 0xe42e, 0xa200, 0xe42e,
+	0xa200, 0xcfc2, 0x283b, 0xcfc8, 0xaf12, 0xe40a, 0x0d12, 0xcfc2,
+	0x283b, 0xcfc8, 0xa2fe, 0xcfca, 0xa200, 0xcfc2, 0x283a, 0xcfc8,
+	0xaf12, 0xe40a, 0x0d1e, 0xcfc2, 0x283a, 0xcfc8, 0xa2fe, 0xcfca,
+	0xa200, 0xcfc2, 0x283c, 0xcfc8, 0xaf12, 0xe40a, 0x0d2a, 0xcfc2,
+	0x283c, 0xcfc8, 0xa2fe, 0xcfca, 0xe42e, 0x281a, 0xa104, 0xe42a,
+	0x283a, 0x3c3b, 0x283c, 0x3c3a, 0x281c, 0x2a33, 0xae13, 0xe056,
+	0x3c3c, 0xe42e, 0xa20a, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x013d,
+	0xa200, 0xe0c2, 0x0128, 0x2ae1, 0x4ee2, 0xb692, 0xae08, 0xa91c,
+	0xe0c2, 0x017c, 0xe004, 0x004c, 0xe0c2, 0x017d, 0xa200, 0xe41e,
+	0x0f52, 0xe0c2, 0x0102, 0xe42e, 0xe0c0, 0x0050, 0xe049, 0xe008,
+	0x007f, 0x3c0c, 0xaf11, 0xe009, 0x007f, 0x3e0d, 0x460c, 0x3e0c,
+	0xa200, 0x2a0c, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2a0c, 0xa805,
+	0xf03b, 0xe00a, 0x0009, 0x2a0c, 0xa809, 0xf03b, 0xe00a, 0x0020,
+	0x2a0c, 0xa811, 0xf03b, 0xe00a, 0x0040, 0xe0c2, 0x040c, 0xe0c1,
+	0x0046, 0xe004, 0x0010, 0xae10, 0xe042, 0x2a0d, 0xa805, 0xf05b,
+	0xe167, 0x02d6, 0x2117, 0x4d17, 0xe0c2, 0x0103, 0x2844, 0xae20,
+	0x4c45, 0xae08, 0xe0c2, 0x0101, 0xd1c6, 0x0001, 0x2845, 0xae0e,
+	0x4c44, 0xcf96, 0x8444, 0x8245, 0xe018, 0xcf9a, 0x2824, 0xa87e,
+	0xae0c, 0x2a25, 0xa87f, 0xe056, 0xcf8e, 0xa200, 0xcfd6, 0x2826,
+	0xae02, 0x4c1e, 0xae02, 0x4c34, 0xcfc2, 0x2834, 0xf098, 0x2821,
+	0xae0c, 0x4c22, 0xae02, 0x4c23, 0xae04, 0x4c1a, 0xcf82, 0x281a,
+	0xcf88, 0xa200, 0xe41e, 0x0f52, 0xe0c2, 0x0102, 0x2833, 0xa908,
+	0xae04, 0x4c1a, 0xae04, 0x4c33, 0xae02, 0x4c34, 0xe0c2, 0x0104,
+	0x2a33, 0xe0c0, 0x005b, 0xae08, 0x4c1a, 0xae04, 0xe056, 0xae02,
+	0x4c34, 0xe0c2, 0x0204, 0x2834, 0xe41a, 0x0e6f, 0xe41e, 0x0e32,
+	0xe161, 0x02d0, 0x2111, 0x4d01, 0xcfc6, 0xe0c1, 0x0046, 0xe004,
+	0x0000, 0xae10, 0xe042, 0x2a0d, 0xa803, 0xf05b, 0xe167, 0x02d4,
+	0x2117, 0x4d17, 0xcfc4, 0xe41e, 0x0274, 0xa202, 0xe0c2, 0x0106,
+	0xe42e, 0xa20a, 0xe0c2, 0x0100, 0xe004, 0x004e, 0xe0c2, 0x017c,
+	0xe004, 0x004c, 0xe0c2, 0x017d, 0xa200, 0xe41e, 0x0f52, 0xe0c2,
+	0x0102, 0xe42e, 0xa200, 0x3cb8, 0xa2fe, 0x3c40, 0xcf8a, 0x2830,
+	0xae0c, 0x4c31, 0xae02, 0x4c37, 0xae02, 0x4c36, 0xcf84, 0xd1c6,
+	0x0002, 0xe161, 0x0200, 0xe162, 0x0204, 0xe163, 0x0208, 0xe164,
+	0x020c, 0x2911, 0xae10, 0x4d11, 0xae10, 0x4d11, 0xae10, 0x4d01,
+	0xcfce, 0x2912, 0xae10, 0x4d12, 0xae10, 0x4d12, 0xae10, 0x4d02,
+	0xcfd0, 0x2913, 0xae10, 0x4d13, 0xae10, 0x4d13, 0xae10, 0x4d03,
+	0xcfd2, 0x2914, 0xae10, 0x4d14, 0xae10, 0x4d14, 0xae10, 0x4d04,
+	0xcfd4, 0xe42e, 0x2010, 0x4c11, 0xe0c2, 0x0205, 0xa200, 0xe0c2,
+	0x0215, 0xe41e, 0x0f52, 0xa203, 0xae11, 0xe056, 0xe0c2, 0x0213,
+	0xa200, 0xe0c2, 0x0215, 0xa200, 0xe0c2, 0x0208, 0xa202, 0xe0c2,
+	0x0210, 0xe0c1, 0x0046, 0xe004, 0x0040, 0xae10, 0xe042, 0x2a0d,
+	0xa809, 0xf05b, 0xe167, 0x02d8, 0x2117, 0x4d17, 0xe0c2, 0x0211,
+	0xe0c1, 0x0046, 0xe004, 0x0040, 0xe000, 0x0040, 0xae10, 0xe042,
+	0x2a0d, 0xa811, 0xf05b, 0xe167, 0x02da, 0x2117, 0x4d17, 0xe0c2,
+	0x0212, 0x28a2, 0xe0c2, 0x0214, 0xe41e, 0x0fee, 0xe42e, 0xa202,
+	0xe0c2, 0x0302, 0xa20e, 0xe0c2, 0x0312, 0x28a0, 0xf052, 0x28a1,
+	0xf032, 0x28a2, 0xb608, 0xe0c2, 0x0380, 0x28a1, 0xf032, 0x28a2,
+	0xb608, 0xe0c2, 0x0383, 0x28a2, 0xb608, 0xe0c2, 0x0386, 0xe0c0,
+	0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a, 0x0e93, 0xa200,
+	0xe0c2, 0x0302, 0xe42e, 0xe167, 0x01a0, 0x2117, 0x4d17, 0xe0c2,
+	0x0152, 0x2917, 0xe008, 0x00ff, 0xae20, 0x4d07, 0xe0c2, 0x0153,
+	0xe0c0, 0x0101, 0xe0c2, 0x015d, 0x28a0, 0xb608, 0x2aa1, 0xb60b,
+	0xae11, 0xe055, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10, 0xe008,
+	0x001f, 0xe056, 0xe0c2, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0,
+	0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8,
+	0xe42e, 0xcba6, 0xe0c2, 0x0114, 0xcba8, 0xe0c2, 0x0115, 0xcbaa,
+	0xe0c2, 0x012a, 0xcbac, 0xe0c2, 0x0117, 0xcbae, 0xe0c2, 0x0120,
+	0xcbb0, 0xe0c2, 0x0121, 0xcbb2, 0xe0c2, 0x0123, 0xcbc0, 0xf7f8,
+	0xe0c0, 0x0111, 0xf7e8, 0xf08c, 0xe0c0, 0x0124, 0xe0c2, 0x0124,
+	0xa200, 0xe0c2, 0x0320, 0x2827, 0xe418, 0x0eee, 0xa202, 0xe0c2,
+	0x0110, 0x28e1, 0x4ce2, 0xe418, 0x1163, 0xe42e, 0xa200, 0xe0c2,
+	0x0224, 0xe0c2, 0x0225, 0xe42e, 0xe0c0, 0x0065, 0xaf0a, 0xa812,
+	0xe40a, 0x0f25, 0x2855, 0xf21a, 0xe167, 0x0400, 0xe166, 0x0528,
+	0xd022, 0x0007, 0xe184, 0x0f0b, 0x2917, 0xae08, 0x4d17, 0xae08,
+	0x4d17, 0xae08, 0x4d17, 0x3d16, 0xe190, 0xca28, 0xf7f8, 0xe167,
+	0x0538, 0x2117, 0x4d17, 0xce20, 0xd111, 0x0528, 0xd112, 0x0008,
+	0xd113, 0x0002, 0xca28, 0xf7f8, 0xe162, 0x0536, 0xa200, 0x2a55,
+	0xb632, 0xae10, 0x3d12, 0xa220, 0x3d12, 0xe0c0, 0x0065, 0xaf0a,
+	0xa802, 0xf12a, 0xe162, 0x0520, 0x285a, 0x3d12, 0x285b, 0x3d12,
+	0xe0c0, 0x006b, 0xce20, 0xd111, 0x0520, 0xd112, 0x0004, 0xd113,
+	0x0000, 0xca28, 0xf7f8, 0xe0c0, 0x0065, 0xaf0c, 0xa80e, 0xf0ca,
+	0xe0c0, 0x006a, 0xce20, 0xd112, 0x000c, 0xd111, 0x0536, 0xd113,
+	0x0002, 0xca28, 0xf7f8, 0xa200, 0x3c5b, 0x3c5a, 0x3c56, 0x3c5d,
+	0x3c5e, 0xe42e, 0xe0c1, 0x0044, 0xa80f, 0xe056, 0xe42e, 0xa200,
+	0xe41e, 0x0f52, 0xe42e, 0xe0c1, 0x0044, 0xaf0d, 0xae03, 0xe056,
+	0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xe42e,
+	0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039, 0xa213, 0xe42e,
+	0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1, 0x0420, 0xa803,
+	0xf7db, 0xe160, 0x0003, 0xe166, 0x0210, 0xe167, 0x0500, 0x28ad,
+	0xf166, 0xa102, 0xcc44, 0xe184, 0x0f95, 0xa200, 0xe41e, 0x0f52,
+	0xaf04, 0xe41e, 0x0f5b, 0xae20, 0x2eae, 0xe056, 0x9f17, 0x2044,
+	0x4c45, 0xae08, 0x9f17, 0xe41e, 0x0f9b, 0xe190, 0xe190, 0xa201,
+	0xe0c3, 0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16,
+	0x9f17, 0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0, 0x0044, 0xaf20,
+	0xa802, 0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a, 0xe0c0, 0x0061,
+	0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018, 0xe000,
+	0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e,
+	0x0f57, 0xa80e, 0xaf04, 0xe41e, 0x0f5b, 0xe41e, 0x0f63, 0xe40b,
+	0x0fce, 0xa81e, 0xe41e, 0x0f68, 0xae09, 0xe056, 0xae20, 0xe0c1,
+	0x006e, 0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0060, 0xa822,
+	0xa122, 0xf04a, 0x2044, 0x4c45, 0xf03e, 0x2045, 0x4c44, 0xae08,
+	0x9f17, 0xe0c0, 0x0062, 0x9f17, 0xe0c0, 0x0063, 0x9f17, 0xe0c0,
+	0x0064, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x3c01, 0xa202,
+	0xe0c2, 0x040d, 0xe0c0, 0x0420, 0xa802, 0xf7da, 0x8401, 0xc785,
+	0xe018, 0xe000, 0x0501, 0xe09e, 0x2044, 0x4c45, 0xae08, 0x9f07,
+	0xa200, 0xe0c2, 0x040d, 0xe42e, 0x3c01, 0xa202, 0xe0c2, 0x040d,
+	0xe0c0, 0x0420, 0xa802, 0xf7da, 0x8401, 0xc785, 0xe018, 0xe000,
+	0x0501, 0xe09e, 0x2044, 0x4c45, 0xae08, 0x9f07, 0xa200, 0xe0c2,
+	0x040d, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0020, 0xae11,
+	0xe042, 0xce20, 0xd111, 0x0210, 0xd112, 0x00c0, 0x88ec, 0x0113,
+	0xca29, 0xf7f9, 0xe190, 0xe42e, 0xd148, 0x0040, 0xd144, 0x0000,
+	0xd145, 0x0000, 0xd168, 0x0000, 0xd14b, 0x0200, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xd14c, 0x000c, 0xca9a, 0xf7f8, 0xe42e, 0xcc44,
+	0xe184, 0x1048, 0xca9c, 0xe418, 0x070b, 0xcaa0, 0xca9b, 0xf7f9,
+	0xe190, 0xe42e, 0xa200, 0x3cd7, 0x3cd6, 0x3cd4, 0xe41e, 0x07a4,
+	0xf178, 0xe41e, 0x10c2, 0xe41e, 0x07a4, 0xf128, 0xcaa3, 0xe009,
+	0x00ff, 0x3edb, 0xa204, 0xe41e, 0x103f, 0xcaa2, 0xaf10, 0xa102,
+	0xf71a, 0xa200, 0xe41e, 0x103f, 0xe41e, 0x07a4, 0xf06a, 0xe004,
+	0x00b1, 0x3cd3, 0xa200, 0xe42e, 0x28db, 0xe008, 0x00ff, 0x3cd3,
+	0xe41e, 0x06b9, 0xe41e, 0x06f5, 0xa202, 0xe42e, 0xa200, 0x3cd7,
+	0x3cd6, 0x3cd4, 0xe41e, 0x07a4, 0xf178, 0xe41e, 0x10c2, 0xe41e,
+	0x07a4, 0xf128, 0xcaa2, 0xe008, 0x00ff, 0x3cdb, 0xf0a8, 0xe41e,
+	0x109b, 0xaf20, 0xa102, 0xf058, 0xa204, 0xe41e, 0x103f, 0xf6ee,
+	0xe41e, 0x07a4, 0xf04a, 0xe004, 0x00b1, 0x3cdb, 0x28db, 0xe008,
+	0x00ff, 0x3cd3, 0xe42e, 0xe162, 0x05a0, 0xca80, 0x3512, 0x3d12,
+	0xca82, 0x3512, 0x3d12, 0xca84, 0x3512, 0x3d12, 0xca86, 0x3512,
+	0x3d12, 0xca8b, 0xa208, 0xca8b, 0xa003, 0xaf03, 0xe046, 0xe000,
+	0x05a2, 0xe094, 0xca8a, 0xa802, 0xf048, 0x2512, 0x4d12, 0xe42e,
+	0x2512, 0x4d12, 0xae10, 0x2712, 0x4f12, 0xaf31, 0xe009, 0x00ff,
+	0xe056, 0xe42e, 0xd153, 0x0000, 0xd158, 0x0100, 0xe004, 0x00ff,
+	0xe014, 0xceb8, 0xd15d, 0x0000, 0xd15e, 0x0000, 0xd15f, 0x0000,
+	0xe004, 0x0019, 0xae18, 0xe00a, 0x0620, 0xcec0, 0xd157, 0x0000,
+	0xd14a, 0x0000, 0xd14c, 0x0003, 0xca9c, 0xe418, 0x070b, 0xca9a,
+	0xf7c8, 0xcaae, 0xa802, 0xf73a, 0xca9c, 0xe418, 0x070b, 0xa200,
+	0xe42e, 0x28d4, 0xe428, 0xe004, 0x0080, 0x2acd, 0xb616, 0xce92,
+	0xd158, 0x0000, 0xe004, 0x01ff, 0xe014, 0xceb8, 0xd15d, 0x0000,
+	0xd15e, 0x0000, 0xd15f, 0x0000, 0xe004, 0x0019, 0xae18, 0xe00a,
+	0x0632, 0xcec0, 0xd161, 0x0002, 0xd14a, 0x0000, 0xd14c, 0x0003,
+	0xca9c, 0xe418, 0x070b, 0xca9a, 0xf7c8, 0xca9c, 0xf7a8, 0xca94,
+	0x3cd5, 0xca9e, 0x3cd4, 0x28d5, 0x00d7, 0x0cd6, 0x34d7, 0x3cd6,
+	0xcc90, 0xcc8c, 0x28d4, 0xcc92, 0xcc8e, 0xe428, 0x28cd, 0xe016,
+	0x3ccd, 0xe42e, 0xe41e, 0x0815, 0xe0c0, 0x0048, 0x34de, 0x3cdf,
+	0xe42e, 0xa200, 0xceaa, 0x24de, 0x4cdf, 0xe0c2, 0x0048, 0xe42e,
+	0xa2fe, 0x3ce3, 0xa200, 0x3ce1, 0xe42e, 0x28a8, 0x3ce3, 0x28e3,
+	0xf032, 0xa200, 0x3ce1, 0xa200, 0x3ce8, 0x3ce9, 0x2844, 0x3ce6,
+	0x2845, 0x3ce7, 0x28e1, 0xe42a, 0x28e3, 0xe424, 0x28e3, 0xe0c2,
+	0x0143, 0x28e4, 0xe0c2, 0x0144, 0xa200, 0xe0c2, 0x017f, 0xe0c2,
+	0x0149, 0xe41e, 0x0f52, 0xe0c2, 0x017f, 0x28e6, 0xa102, 0xae20,
+	0x4ce7, 0xa102, 0xe0c2, 0x0142, 0xa200, 0xae20, 0x2ae0, 0xe042,
+	0xe0c2, 0x014e, 0xe42e, 0x28e3, 0x2ae9, 0x1ae7, 0xe423, 0x28e8,
+	0xae0e, 0x4ce9, 0xa203, 0xb615, 0x3eea, 0x2aea, 0xae03, 0xa903,
+	0xae1d, 0xe056, 0xe0c1, 0x014b, 0xf7e9, 0xe0c2, 0x014d, 0xa202,
+	0xe0c2, 0x014a, 0x2ae8, 0xa003, 0x3ee8, 0x1ae6, 0xf065, 0x2ae9,
+	0xa003, 0x3ee9, 0xa201, 0x3ee8, 0xe42e, 0x28e1, 0xf15a, 0x28e9,
+	0x18e7, 0xf042, 0xe41e, 0x1163, 0xf7be, 0xe0c0, 0x014b, 0xf7e8,
+	0xa204, 0xae1c, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0xe190,
+	0xe0c0, 0x014b, 0xf7e8, 0x28a3, 0x3ce3, 0xe42e, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c, 0xcc8e, 0xe004,
+	0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f, 0x0003, 0xe190,
+	0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004, 0x0030, 0xce50,
+	0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004, 0x0020, 0xce50,
+	0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e, 0x0081, 0xe42a,
+	0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100, 0xe0c2, 0x041c,
+	0xe41e, 0x00b7, 0xe41e, 0x00f1, 0xae12, 0xe0c2, 0x041e, 0xe41e,
+	0x00e1, 0xe42e, 0xe41e, 0x00a5, 0xe42a, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215, 0xe008, 0x0100,
+	0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213, 0xe008, 0x0100,
+	0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x00b7, 0xe41e, 0x00f1, 0xae12, 0xe0c1,
+	0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204, 0xaf0b, 0xa87f,
+	0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056, 0xe0c2, 0x041e,
+	0xe41e, 0x00e1, 0xe42e, 0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x041f,
+	0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200, 0xe0c2, 0x041c,
+	0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052, 0xf1da, 0xe0c0,
+	0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060, 0xa81e, 0xe016,
+	0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea, 0xe0c0, 0x0044,
+	0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xe056,
+	0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0, 0x0044, 0xa203,
+	0xae19, 0xe052, 0xf0ba, 0xe41e, 0x0081, 0xf088, 0xe0c0, 0x0044,
+	0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500,
+	0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0, 0x0419, 0xf7ea,
+	0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28, 0xe0c1, 0x041b,
+	0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056, 0xe0c2, 0x041d,
+	0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2, 0x041c, 0xa228,
+	0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200, 0xe0c2, 0x041c,
+	0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c26, 0xf0b4, 0xe04a, 0xaf10,
+	0x1827, 0xf074, 0xe009, 0x00ff, 0x1a28, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x04de, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0368, 0xe40e, 0x00a4,
+	0xe41e, 0x0385, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x0450,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x039d, 0xe40e, 0x00a4,
+	0xe41e, 0x0148, 0xa200, 0xcc4a, 0xcc4c, 0xd130, 0x0007, 0xd131,
+	0x0000, 0xe41e, 0x0387, 0xe41e, 0x0494, 0xf09a, 0xe41e, 0x03a2,
+	0xf06d, 0xe41e, 0x0669, 0xe41e, 0x0544, 0xe42e, 0xe41e, 0x0544,
+	0xe16a, 0xa200, 0xe0c2, 0x0070, 0xe42e, 0xa202, 0xe42e, 0xe41e,
+	0x0491, 0xe0c0, 0x0040, 0xe005, 0x0049, 0xae17, 0xe042, 0xe005,
+	0x1f00, 0xae03, 0xe042, 0xce20, 0xd111, 0x08a0, 0xd112, 0x0040,
+	0xd113, 0x0003, 0xe41e, 0x0491, 0xe42e, 0xe41e, 0x089e, 0xe41e,
+	0x08fe, 0xe42e, 0xba4e, 0xa186, 0xe408, 0x03fe, 0xba4e, 0xa19c,
+	0xe408, 0x03fe, 0xba4e, 0xa19a, 0xe408, 0x03fe, 0xba4e, 0xa1ac,
+	0xe408, 0x03fe, 0xba4e, 0xba4f, 0xae11, 0xe056, 0x3c00, 0xba4e,
+	0xba4f, 0xae11, 0xe056, 0x3c01, 0xba7e, 0x3402, 0x3c03, 0xba4e,
+	0xba4f, 0xae11, 0xe055, 0x3e12, 0xba4e, 0xba4f, 0xae11, 0xe055,
+	0x3e13, 0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056,
+	0xba4f, 0xae31, 0xe056, 0x3404, 0x3c05, 0xba4e, 0xba4f, 0xae11,
+	0xe056, 0xba4f, 0xae21, 0xe056, 0xba4f, 0xae31, 0xe056, 0x3406,
+	0x3c07, 0xba7e, 0x3408, 0x3c09, 0xba7e, 0x2812, 0xa01e, 0xaf08,
+	0xae08, 0x3c10, 0x2813, 0xa01e, 0xaf08, 0xae08, 0x3c11, 0x2810,
+	0x3c22, 0xa01e, 0xaf08, 0x3c27, 0x2811, 0x3c23, 0xa01e, 0xaf08,
+	0x3c28, 0x8427, 0x8228, 0xe018, 0x3c26, 0xe42e, 0xe16b, 0xe42e,
+	0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056, 0xba4f,
+	0xae31, 0xe056, 0xf1da, 0xd022, 0x0007, 0xe184, 0x0410, 0xba4e,
+	0xe190, 0xe190, 0xd039, 0x0000, 0xba4e, 0x3c2b, 0xf088, 0xba4e,
+	0x3c20, 0xba4e, 0x3c51, 0xba4e, 0x3c50, 0xe42e, 0xba4e, 0xba4e,
+	0xba4e, 0xa202, 0x3c20, 0x3c51, 0xa200, 0x3c50, 0xe42e, 0xe16b,
+	0xe42e, 0xba4e, 0xba4f, 0xae11, 0xe056, 0xba4f, 0xae21, 0xe056,
+	0xba4f, 0xae31, 0xe056, 0x3c0a, 0xba7e, 0xe161, 0x0300, 0x8451,
+	0xe182, 0x0180, 0xe018, 0xa102, 0xcc44, 0xe184, 0x0444, 0xba5e,
+	0x3d11, 0x280a, 0xa104, 0x3c0a, 0xf02a, 0xe190, 0x280a, 0xe426,
+	0xa102, 0xcc44, 0xe184, 0x044d, 0xba4e, 0xe190, 0xe190, 0xe42e,
+	0xe41e, 0x06a6, 0xa200, 0x3c82, 0xcc4a, 0xcc4c, 0xd130, 0x0007,
+	0xd131, 0x0000, 0xe0c0, 0x005a, 0xe008, 0xffff, 0x3cee, 0xe41e,
+	0x09c4, 0xe41e, 0x08bd, 0xe41e, 0x093f, 0x2860, 0xe418, 0x0a7c,
+	0xe41e, 0x092f, 0xe41e, 0x0931, 0xe41e, 0x04bf, 0xe41e, 0x050a,
+	0xf09a, 0xa2fe, 0x3c33, 0xa2fc, 0x3c30, 0x3c34, 0xe41e, 0x0985,
+	0xf05e, 0xe41e, 0x025f, 0xe41e, 0x06b5, 0xe41e, 0x0680, 0xe41e,
+	0x09d3, 0xe41e, 0x054a, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2,
+	0x0053, 0xe42e, 0xe41e, 0x054a, 0xe16a, 0xa200, 0xe0c2, 0x0076,
+	0xe42e, 0xca28, 0xf7f8, 0xe42e, 0xe41e, 0x023a, 0xa206, 0xae1e,
+	0xcec0, 0xd160, 0x0600, 0xe0c0, 0x0060, 0x34b0, 0x3cb1, 0xe0c1,
+	0x0061, 0xae15, 0x36b2, 0x3eb3, 0xe042, 0x34b4, 0x3cb5, 0xe0c0,
+	0x0048, 0x34ba, 0x3cbb, 0x34b6, 0xe008, 0xfe00, 0x3cb7, 0x2cbb,
+	0xe008, 0x01ff, 0x3cbc, 0xe41e, 0x0633, 0xf07d, 0xe41e, 0x0525,
+	0xe41e, 0x050c, 0xa202, 0xe42e, 0xa200, 0xe16a, 0xe42e, 0xa206,
+	0xae1e, 0xcec0, 0xd160, 0x0600, 0xe0c0, 0x0048, 0xe0c2, 0x0051,
+	0x34ba, 0x3cbb, 0x34b6, 0xe008, 0xfe00, 0x3cb7, 0x28bb, 0xe008,
+	0x01ff, 0x3cbc, 0xe41e, 0x05f8, 0xf078, 0xe41e, 0x0525, 0xe41e,
+	0x050c, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xe41e, 0x04e1,
+	0xe470, 0xca28, 0xf7f8, 0xe004, 0x0080, 0xce24, 0x28bf, 0xae0e,
+	0xce22, 0x24b6, 0x4cb7, 0xce20, 0x24cd, 0x4cce, 0xa806, 0xae02,
+	0xa022, 0xce26, 0xca28, 0xf7f8, 0x24b6, 0x4cb7, 0xe000, 0x0200,
+	0x34b6, 0x3cb7, 0x14b4, 0x1cb5, 0xf054, 0x24b0, 0x4cb1, 0x34b6,
+	0x3cb7, 0xd04c, 0x0000, 0x28bf, 0xae0e, 0xcc6e, 0x28bf, 0xe016,
+	0x3cbf, 0xe42e, 0x28c1, 0xe42e, 0xa200, 0x3cbf, 0xce92, 0xe0c0,
+	0x0043, 0x34cd, 0x3cce, 0xe41e, 0x04e1, 0xe41e, 0x04e1, 0xe128,
+	0xd071, 0x2020, 0xe181, 0x2cbc, 0xa102, 0xf074, 0xcc44, 0xe184,
+	0x0522, 0xba4e, 0xe190, 0xe190, 0xe42e, 0xe004, 0x1495, 0xae20,
+	0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000, 0xd033, 0x0000, 0xd035,
+	0x0000, 0xd036, 0x00ff, 0xd037, 0x0000, 0xd038, 0x0000, 0xd039,
+	0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000, 0xd046, 0x0000, 0xd047,
+	0x0000, 0xd149, 0x0000, 0xe42e, 0x24ba, 0x4cbb, 0x08c2, 0x34ba,
+	0x3cbb, 0xf07e, 0x24ba, 0x4cbb, 0x04c5, 0x0cc6, 0x34ba, 0x3cbb,
+	0x14b4, 0x1cb5, 0xf074, 0x24ba, 0x4cbb, 0x14b2, 0x1cb3, 0x34ba,
+	0x3cbb, 0x24ba, 0x4cbb, 0xe0c2, 0x0048, 0xe0c2, 0x0052, 0xe42e,
+	0xa200, 0x34c5, 0x3cc6, 0xe42e, 0xf0a8, 0x2911, 0xe008, 0xffff,
+	0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xf0fe, 0x2911, 0xe008,
+	0x00ff, 0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xae10, 0x2b11,
+	0xe009, 0xff00, 0xaf11, 0xe042, 0x2ac7, 0xe42b, 0xe049, 0xaf31,
+	0xe009, 0x00ff, 0xe093, 0xe049, 0xaf21, 0xe009, 0x00ff, 0xe095,
+	0xe049, 0xaf11, 0xe009, 0x00ff, 0xe008, 0x00ff, 0xae10, 0xe056,
+	0xae10, 0xe085, 0xe056, 0xae10, 0xe083, 0xe056, 0xe42e, 0xe049,
+	0xa80f, 0xe046, 0xe42e, 0xca29, 0xf7f9, 0xd111, 0x0830, 0xce20,
+	0x26b4, 0x4eb5, 0xe045, 0xe004, 0x0040, 0xe065, 0xaf03, 0xce25,
+	0x3ec0, 0xe41e, 0x05b9, 0xa240, 0x18c0, 0xe426, 0xce24, 0x28c0,
+	0xe000, 0x0830, 0xce22, 0x24b0, 0x4cb1, 0xce20, 0xe41e, 0x05b9,
+	0xe42e, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa002, 0xce26, 0xca28,
+	0xf7f8, 0xe42e, 0x34c9, 0x3cca, 0xa200, 0x3cbd, 0xe0c0, 0x0049,
+	0x34cb, 0x3ccc, 0xe0c0, 0x0045, 0xaf04, 0x30be, 0xe0c0, 0x0049,
+	0x34b8, 0x3cb9, 0x10cb, 0x1ccc, 0x2abd, 0xb611, 0x3ebd, 0x26b8,
+	0x4eb9, 0x16c9, 0x1eca, 0xf033, 0x06b2, 0x0eb3, 0x16c3, 0x1ec4,
+	0xa200, 0xe423, 0x28be, 0x3cc1, 0xe428, 0x28bd, 0xf648, 0xe41e,
+	0x01db, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xf5da, 0xe0c0, 0x005d,
+	0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3cbd, 0xf53e,
+	0xa218, 0x34c3, 0x3cc4, 0x24ba, 0x4cbb, 0xd027, 0x0000, 0xe41e,
+	0x05c2, 0xd027, 0x0001, 0xf2b8, 0x24ba, 0x4cbb, 0xe41e, 0x0597,
+	0xe095, 0xe41e, 0x059b, 0xe084, 0xaf02, 0xe000, 0x0830, 0xe092,
+	0xe084, 0xa802, 0xe41e, 0x0564, 0x34c5, 0x3cc6, 0xf186, 0x26b2,
+	0x4eb3, 0xe046, 0xf142, 0x24c5, 0x4cc6, 0xa018, 0x34c5, 0x3cc6,
+	0x34c3, 0x3cc4, 0x24ba, 0x4cbb, 0xd027, 0x0000, 0xe41e, 0x05c2,
+	0xd027, 0x0001, 0xf048, 0xa200, 0xe42e, 0xe16b, 0xa200, 0x34c5,
+	0x3cc6, 0xa202, 0xe42e, 0xa202, 0x3cc7, 0xa240, 0x34c3, 0x3cc4,
+	0x24ba, 0x4cbb, 0xd027, 0x0000, 0xe41e, 0x05c2, 0xd027, 0x0001,
+	0xe408, 0x0667, 0x24ba, 0x4cbb, 0xe41e, 0x0597, 0xe095, 0xe41e,
+	0x059b, 0xe084, 0xa00c, 0xaf02, 0xe000, 0x0830, 0xe092, 0xe084,
+	0xa802, 0xe41e, 0x0564, 0xe008, 0xffff, 0x3cc2, 0xa140, 0xf0f4,
+	0x28c2, 0x34c3, 0x3cc4, 0x24ba, 0x4cbb, 0xd027, 0x0000, 0xe41e,
+	0x05c2, 0xd027, 0x0001, 0xf048, 0xa200, 0xe42e, 0xe16b, 0xa202,
+	0xe42e, 0xa200, 0xe0c2, 0x0074, 0xe0c2, 0x0076, 0xe0c2, 0x0077,
+	0x2012, 0x4c13, 0xe0c2, 0x0071, 0xa2fe, 0xe0c2, 0x0072, 0xe0c2,
+	0x006d, 0xa206, 0xe0c2, 0x0073, 0xa202, 0xe0c2, 0x0070, 0xe42e,
+	0xa200, 0xe0c2, 0x0075, 0xe0c2, 0x0078, 0xe0c2, 0x0079, 0x2833,
+	0xe0c2, 0x0071, 0x2882, 0xe0c2, 0x0072, 0x2820, 0xe0c2, 0x0073,
+	0xa202, 0xe0c2, 0x0076, 0x2834, 0xe0c2, 0x0077, 0x2012, 0x4c13,
+	0xe0c2, 0x006f, 0xa200, 0xe0c2, 0x0075, 0x2436, 0x4c3a, 0xe0c2,
+	0x0070, 0xe42e, 0xa200, 0xe0c2, 0x0076, 0xe42e, 0xa200, 0xcc4a,
+	0xcc4c, 0x3c20, 0x3c50, 0x3c24, 0x3c25, 0x3c6a, 0x3c6b, 0x3c29,
+	0x3c80, 0x3c82, 0xa2fe, 0x3c51, 0xe42e, 0xe41e, 0x08c8, 0xe40a,
+	0x0726, 0xe41e, 0x0400, 0xe40d, 0x0726, 0x2a2b, 0xe41b, 0x050a,
+	0xe408, 0x0726, 0xa218, 0xcf02, 0x2860, 0xe418, 0x0956, 0xe41e,
+	0x078c, 0xe41e, 0x0799, 0x2828, 0xa102, 0x3c25, 0x282b, 0xf1c8,
+	0xe41e, 0x0429, 0xe41e, 0x0838, 0xba4e, 0xba4f, 0xae11, 0xe056,
+	0xba4f, 0xae21, 0xe056, 0xba4f, 0xae31, 0xe056, 0x2a2b, 0xb612,
+	0x340b, 0x3c0c, 0x340b, 0x3c0c, 0xba7e, 0xa200, 0xe41e, 0x076d,
+	0xa202, 0xe41e, 0x076d, 0xe41e, 0x0794, 0xcb04, 0xa802, 0xf7e8,
+	0x282b, 0xe418, 0x072a, 0xf128, 0xa212, 0xcf02, 0xcb04, 0xa808,
+	0xf7ea, 0xcb04, 0xa810, 0xf0aa, 0xcb04, 0xaf08, 0xa802, 0xe41e,
+	0x076d, 0xcb04, 0xa806, 0xe418, 0x074e, 0xe0c0, 0x0111, 0xf7e8,
+	0xa202, 0xe0c2, 0x0110, 0x2860, 0xf0ba, 0xa202, 0x3c66, 0x286a,
+	0x4c6b, 0xe01a, 0x3c65, 0xe41e, 0x096f, 0xe41e, 0x09b6, 0xe41e,
+	0x0735, 0xe40a, 0x071d, 0xe40e, 0x06eb, 0xe0c0, 0x0111, 0xf7e8,
+	0x2860, 0xf03a, 0xe41e, 0x09aa, 0xe41e, 0x08f3, 0xe41e, 0x09d3,
+	0xa202, 0xe42e, 0xa206, 0xcf42, 0xa200, 0xe0c2, 0x0224, 0xa214,
+	0xcf02, 0xcb04, 0xa802, 0xf7ea, 0xe42e, 0x2829, 0xa002, 0x3c29,
+	0x2a26, 0xa103, 0xe046, 0xe400, 0x074c, 0x2824, 0xa002, 0x3c24,
+	0x1827, 0xe404, 0x074a, 0x2825, 0xa102, 0x3c25, 0xa200, 0x3c24,
+	0xe404, 0x074c, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xa202, 0x3c80,
+	0x2882, 0xa002, 0x3c82, 0x2036, 0x4c3a, 0xe40a, 0x075e, 0x2820,
+	0xe408, 0x0762, 0xa206, 0xcf42, 0xe40e, 0x076a, 0xa202, 0xcf42,
+	0xe40e, 0x076a, 0xa204, 0xcf42, 0xe0c0, 0x03b0, 0xcf44, 0xe0c0,
+	0x03b1, 0xcf46, 0xa214, 0xcf02, 0xe42e, 0xae10, 0xce30, 0x200b,
+	0x4c0c, 0xe426, 0xe004, 0x00ff, 0xcc44, 0x200b, 0x4c0c, 0xe002,
+	0x0400, 0xaf04, 0xf062, 0x200b, 0x4c0c, 0xaf04, 0xa102, 0xcc44,
+	0xe184, 0x0783, 0xba7e, 0xce32, 0x200b, 0x4c0c, 0xe002, 0x0400,
+	0xb60c, 0x340b, 0x3c0c, 0xe42e, 0x2820, 0xae20, 0x2a28, 0xae11,
+	0xe056, 0x4c27, 0xcf00, 0xe42e, 0x2825, 0xae10, 0x4c24, 0xcf06,
+	0xe42e, 0xa200, 0x2a61, 0x4e64, 0xb692, 0xae08, 0xa90c, 0xe0c2,
+	0x017c, 0xe004, 0x0004, 0xe0c2, 0x017d, 0xa20e, 0xe0c2, 0x0100,
+	0xa200, 0xe0c2, 0x0128, 0x2022, 0x4c23, 0xe0c2, 0x0101, 0xa200,
+	0xe41e, 0x0a2a, 0xe0c2, 0x0102, 0x2820, 0xa802, 0xae06, 0xe0c2,
+	0x0104, 0xe0c0, 0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a,
+	0x0802, 0xa20e, 0xe0c2, 0x0312, 0xa202, 0xe0c2, 0x0302, 0x2832,
+	0xe0c2, 0x0380, 0x2831, 0xe0c2, 0x0383, 0xa200, 0xe0c2, 0x0302,
+	0xa20e, 0xae0e, 0x2a20, 0xa807, 0xae07, 0xe056, 0xe0c2, 0x0204,
+	0x2831, 0xe0c2, 0x0216, 0x2830, 0xe0c2, 0x0214, 0x2022, 0x4c23,
+	0xe0c2, 0x0205, 0xa200, 0xe0c2, 0x0208, 0xa202, 0xe0c2, 0x0210,
+	0x2040, 0x4c41, 0xe0c2, 0x0211, 0x2042, 0x4c43, 0xe0c2, 0x0212,
+	0xa200, 0xe41e, 0x0a2a, 0xa203, 0xae11, 0xe056, 0xe0c2, 0x0213,
+	0xa200, 0xe0c2, 0x0215, 0x2850, 0xe0c2, 0x0217, 0xa202, 0xe0c2,
+	0x0106, 0xe42e, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152,
+	0x2b17, 0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1,
+	0x0101, 0xe0c3, 0x015d, 0xe005, 0x001b, 0x3e91, 0x2831, 0xa53e,
+	0xa400, 0x2a32, 0xa53f, 0xa401, 0xae11, 0xe055, 0xae21, 0xe167,
+	0x01a2, 0x2907, 0xaf10, 0x4491, 0xe055, 0xe0c3, 0x015c, 0xa202,
+	0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150,
+	0xe0c0, 0x0151, 0xf7e8, 0xe42e, 0xa202, 0xe42e, 0xa202, 0xe42e,
+	0xa202, 0xe0c2, 0x013c, 0xa200, 0x3c95, 0x3c93, 0x3c94, 0x3c52,
+	0x8451, 0xc783, 0xe018, 0x3c2a, 0x282a, 0xa102, 0xe404, 0x0898,
+	0x3c2a, 0xa200, 0x3c52, 0x2893, 0xa106, 0xf068, 0xa200, 0x3c93,
+	0x2894, 0xa002, 0x3c94, 0x8493, 0xc783, 0xe018, 0x2a94, 0xe042,
+	0x3c96, 0x2852, 0xa104, 0xe40a, 0x088f, 0xe160, 0x08a0, 0x2895,
+	0xae02, 0x2a52, 0xe042, 0x3c91, 0x8491, 0xe182, 0x0040, 0xe018,
+	0x3c91, 0xe161, 0x0300, 0xe082, 0x0c91, 0xe092, 0x2896, 0xae02,
+	0x2a52, 0xe042, 0x3c92, 0x8492, 0xe182, 0x0040, 0xe018, 0x3c92,
+	0xd022, 0x003f, 0xe184, 0x0888, 0x2a92, 0xe0c3, 0x013e, 0xa003,
+	0x3e92, 0x2910, 0xe083, 0xe042, 0xe094, 0x2902, 0xe0c2, 0x013f,
+	0xa200, 0xe190, 0x2852, 0xa002, 0x3c52, 0xe40e, 0x0859, 0xe190,
+	0x2895, 0xa002, 0x3c95, 0x2893, 0xa002, 0x3c93, 0xe40e, 0x0844,
+	0xe190, 0xa200, 0xe0c2, 0x013c, 0xa202, 0xe42e, 0xa200, 0x3c36,
+	0x3c3a, 0x3c3b, 0x3c3c, 0xa2fe, 0x3c63, 0x3c30, 0x3c31, 0x3c32,
+	0x3c33, 0xe0c0, 0x0061, 0x3c21, 0xe0c0, 0x0060, 0x3c35, 0xe41e,
+	0x0491, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0200, 0xd112, 0x00c0,
+	0xd113, 0x0003, 0xe41e, 0x0491, 0xe42e, 0xa2fe, 0x3c30, 0xe0c0,
+	0x0054, 0x263b, 0x4e3c, 0xe052, 0x3c3c, 0x343b, 0xa202, 0xe42e,
+	0x2831, 0xa002, 0xf068, 0xa200, 0x3c31, 0x3c30, 0x3c32, 0xf18e,
+	0x2831, 0x3c30, 0x2830, 0xa002, 0x2a35, 0xe045, 0xb616, 0x3c30,
+	0x2a31, 0xe045, 0xf059, 0xa2fe, 0x3c30, 0xa200, 0xe42e, 0x2a32,
+	0xe045, 0xf71b, 0x243b, 0x4c3c, 0x5c30, 0xa802, 0xf6c8, 0xa202,
+	0x5830, 0x263b, 0x4e3c, 0xe056, 0x3c3c, 0x343b, 0x2830, 0x3c33,
+	0x3c34, 0xa202, 0xe42e, 0x2830, 0x3c31, 0x2a20, 0xf029, 0x3c32,
+	0x2636, 0x4e3a, 0xa003, 0x3636, 0x3e3a, 0xe42e, 0xe0c0, 0x0050,
+	0xe049, 0xe008, 0x007f, 0x3c45, 0xaf11, 0xe009, 0x007f, 0x3e44,
+	0x4645, 0x3e45, 0xe0c1, 0x0046, 0xe004, 0x0000, 0xae10, 0xe042,
+	0xe41e, 0x092b, 0x2a44, 0xa809, 0xf03b, 0xe0c0, 0x0066, 0x3440,
+	0x3c41, 0xe0c1, 0x0046, 0xe004, 0x0010, 0xae10, 0xe042, 0xe41e,
+	0x092b, 0x2a44, 0xa811, 0xf03b, 0xe0c0, 0x0067, 0x3442, 0x3c43,
+	0xe41e, 0x0174, 0xe42e, 0xa00e, 0xaf06, 0xae06, 0xe42e, 0xe40e,
+	0x0a4a, 0xa200, 0x2a45, 0xa809, 0xf03b, 0xe00a, 0x0020, 0x2a45,
+	0xa811, 0xf03b, 0xe00a, 0x0040, 0xe0c2, 0x040c, 0xe42e, 0xa200,
+	0x3c6c, 0xe0c0, 0x0060, 0xa81e, 0x3c62, 0x2831, 0xf094, 0xe0c0,
+	0x0060, 0xaf08, 0x3061, 0x3060, 0xaf02, 0x3064, 0xf06e, 0xa200,
+	0x3c60, 0x3c61, 0x3c64, 0x3c62, 0xa202, 0xe42e, 0x2864, 0xae08,
+	0x4c62, 0xe0c2, 0x014e, 0x2827, 0xa102, 0xae20, 0x4c28, 0xa102,
+	0xe0c2, 0x0142, 0xe0c0, 0x006e, 0xe0c2, 0x017f, 0x2831, 0xe0c2,
+	0x0143, 0xe0c0, 0x0061, 0xa87e, 0xe0c2, 0x0144, 0xe42e, 0x2864,
+	0xe418, 0x09c2, 0x2865, 0xae02, 0x4c66, 0xae0e, 0x4c6a, 0xae0e,
+	0x086b, 0xe0c1, 0x014b, 0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2,
+	0x014a, 0x286c, 0xa002, 0x3c6c, 0xe42e, 0x2860, 0xf2fa, 0xa200,
+	0x3c29, 0x3c6a, 0x3c6b, 0xe0c2, 0x017f, 0xe0c2, 0x0149, 0xe41e,
+	0x0956, 0xa200, 0xe41e, 0x0a2a, 0xe0c2, 0x0102, 0x2829, 0x1826,
+	0xf0f2, 0xa202, 0x3c66, 0x286a, 0x4c6b, 0xe01a, 0x3c65, 0xe41e,
+	0x096f, 0xe41e, 0x09b6, 0x2829, 0xa002, 0x3c29, 0xf708, 0xe41e,
+	0x09aa, 0xe42e, 0xa200, 0x3c6a, 0x3c6b, 0x3c66, 0xa202, 0x3c65,
+	0xe41e, 0x096f, 0xe0c1, 0x014b, 0xf7e9, 0xe42e, 0x286a, 0xa002,
+	0x3c6a, 0x1827, 0xe404, 0x09c1, 0x286b, 0xa002, 0x3c6b, 0xa200,
+	0x3c6a, 0xe42e, 0xa202, 0xe42e, 0xe0c0, 0x0065, 0xaf10, 0x30a0,
+	0xe0c0, 0x006a, 0x34a1, 0x3ca2, 0x28a0, 0xf04a, 0xa206, 0xe41e,
+	0x09e0, 0xa202, 0xe42e, 0x28a0, 0xf0aa, 0xe160, 0x0808, 0xa202,
+	0xae10, 0x3d10, 0xa220, 0x3d10, 0xe41e, 0x09ef, 0xa202, 0xe42e,
+	0x3c92, 0xe41e, 0x0491, 0x24a1, 0x4ca2, 0xce20, 0xd111, 0x0808,
+	0xa218, 0xce24, 0x2892, 0xce26, 0xe41e, 0x0491, 0xe42e, 0xe160,
+	0x0800, 0xa200, 0xc707, 0x3d10, 0xe160, 0x0800, 0xa200, 0x3c91,
+	0x2835, 0xf216, 0xa006, 0xaf04, 0xa102, 0xcc44, 0xe184, 0x0a19,
+	0xa200, 0xae08, 0x263b, 0x4e3c, 0x5e91, 0xa803, 0xb492, 0x2a31,
+	0x1a91, 0xe017, 0x3e92, 0x2a32, 0x1a91, 0xe017, 0x4e92, 0x3e92,
+	0xb452, 0x2a30, 0x1a91, 0xb436, 0x2a91, 0xa003, 0x3e91, 0xa807,
+	0xf699, 0x3d10, 0xe41e, 0x0491, 0xe160, 0x080a, 0x2510, 0x4d10,
+	0xce20, 0xd111, 0x0800, 0xd112, 0x0008, 0xd113, 0x0002, 0xe41e,
+	0x0491, 0xe42e, 0xe0c1, 0x0044, 0xa80f, 0xe056, 0xe42e, 0xa200,
+	0xe41e, 0x0a2a, 0xe42e, 0xe0c1, 0x0044, 0xaf0d, 0xae03, 0xe056,
+	0xe008, 0x003f, 0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xe42e,
+	0xe0c1, 0x0044, 0xaf17, 0xa803, 0xa105, 0xf039, 0xa213, 0xe42e,
+	0xa201, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1, 0x0420, 0xa803,
+	0xf7db, 0xe160, 0x0003, 0xe166, 0x0200, 0xe167, 0x0500, 0x2835,
+	0xf156, 0xa102, 0xcc44, 0xe184, 0x0a6c, 0xa200, 0xe41e, 0x0a2a,
+	0xaf04, 0xe41e, 0x0a33, 0xae20, 0x2e21, 0xe056, 0x9f17, 0x2022,
+	0x4c23, 0x9f17, 0xe41e, 0x0a72, 0xe190, 0xe190, 0xa201, 0xe0c3,
+	0x040d, 0xe42e, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0xe42e, 0xe0c0, 0x0044, 0xaf20, 0xa802,
+	0xe428, 0xe0c0, 0x0060, 0xa860, 0xe42a, 0xe0c0, 0x0061, 0xa83e,
+	0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500,
+	0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x0a2f,
+	0xa80e, 0xaf04, 0xe41e, 0x0a33, 0xe41e, 0x0a3b, 0xe40b, 0x0aa5,
+	0xa81e, 0xe41e, 0x0a40, 0xae09, 0xe056, 0xae20, 0xe0c1, 0x006e,
+	0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0060, 0xa822, 0xa122,
+	0xf04a, 0x2022, 0x4c23, 0xf03e, 0x2023, 0x4c22, 0x9f17, 0xe0c0,
+	0x0062, 0x9f17, 0xe0c0, 0x0063, 0x9f17, 0xe0c0, 0x0064, 0x9f17,
+	0xa201, 0xe0c3, 0x040d, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005,
+	0x0020, 0xae11, 0xe042, 0xce20, 0xd111, 0x0200, 0xd112, 0x00c0,
+	0x88ec, 0x0113, 0xca29, 0xf7f9, 0xe190, 0xe42e, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0003, 0x0002, 0x0001, 0x0000, 0x0007, 0x0006, 0x0005, 0x0004,
+	0x000b, 0x000a, 0x0009, 0x0008, 0x000f, 0x000e, 0x000d, 0x000c,
+	0x0013, 0x0012, 0x0011, 0x0010, 0x0017, 0x0016, 0x0015, 0x0014,
+	0x001b, 0x001a, 0x0019, 0x0018, 0x001f, 0x001e, 0x001d, 0x001c,
+	0x0023, 0x0022, 0x0021, 0x0020, 0x0027, 0x0026, 0x0025, 0x0024,
+	0x002b, 0x002a, 0x0029, 0x0028, 0x002f, 0x002e, 0x002d, 0x002c,
+	0x0033, 0x0032, 0x0031, 0x0030, 0x0037, 0x0036, 0x0035, 0x0034,
+	0x003b, 0x003a, 0x0039, 0x0038, 0x003f, 0x003e, 0x003d, 0x003c,
+	0xfffe, 0xfffd, 0xfffd, 0xfffd, 0xcccc, 0xcccc, 0xcccc, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0318, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0318, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x0222, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0338, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x033a, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c2f, 0xf0b4, 0xe04a, 0xaf10,
+	0x182d, 0xf074, 0xe009, 0x00ff, 0x1a2e, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02a3, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02d9, 0xe41e, 0x0313, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x0303, 0xe42e, 0xe41e, 0x02c7, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02d9, 0xe41e, 0x0313,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x0303, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02a3, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x0330, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x034a, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x0330, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x023a, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0350, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x0352, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01cb, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa23e, 0x3cf0, 0xa202, 0x58f0, 0xe0c2, 0x0078, 0xa220,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802, 0xa220, 0xe0c2,
+	0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2, 0x0077, 0xa2fa,
+	0xe0c2, 0x0071, 0xe42e, 0xe0c0, 0x0045, 0xaf04, 0xa80e, 0xa104,
+	0xe428, 0xa202, 0xe0c2, 0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28,
+	0xf7f8, 0xca48, 0xa802, 0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190,
+	0xf7e2, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe0c0, 0x041f, 0xf7e8,
+	0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xe004,
+	0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0, 0x000d,
+	0xf7e8, 0xe42e, 0xc001, 0x3443, 0x3c42, 0xc000, 0xe42e, 0xc001,
+	0x2c43, 0x2e42, 0xc000, 0xe42a, 0x1c0e, 0xf0b4, 0xe04a, 0xaf10,
+	0x180c, 0xf074, 0xe009, 0x00ff, 0x1a0d, 0xf034, 0xa202, 0xe42e,
+	0xa2fe, 0xe42e, 0xe41e, 0x023a, 0xd160, 0x0620, 0xe004, 0x0019,
+	0xae18, 0xcec0, 0xe42e, 0xe41e, 0x024f, 0xe000, 0x0040, 0xce50,
+	0xa200, 0xd022, 0x00ff, 0xe184, 0x0236, 0xce52, 0xe190, 0xe41e,
+	0x0257, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72, 0xcc8c,
+	0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a, 0xd16f,
+	0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e, 0xe004,
+	0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e, 0xe004,
+	0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe41e,
+	0x02bb, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a, 0x0100,
+	0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b, 0xae12, 0xe0c2,
+	0x041e, 0xe41e, 0x031b, 0xe42e, 0xe41e, 0x02df, 0xe42a, 0xe0c0,
+	0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0, 0x0215,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0, 0x0213,
+	0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0, 0x020b,
+	0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02f1, 0xe41e, 0x032b,
+	0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1, 0x0204,
+	0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f, 0xe056,
+	0xe0c2, 0x041e, 0xe41e, 0x031b, 0xe42e, 0xe0c0, 0x041f, 0xf7e8,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8, 0xa200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052,
+	0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a, 0xe0c0, 0x0060,
+	0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017, 0xe056, 0xf0ea,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1, 0x0044, 0xaf17,
+	0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xe0c0,
+	0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e, 0x02bb, 0xf088,
+	0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a, 0xa202, 0xe0c2,
+	0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xa202, 0xe0c2, 0x0418, 0xe0c0,
+	0x0419, 0xf7ea, 0xe0c0, 0x041b, 0xaf20, 0xa01e, 0xaf08, 0xae28,
+	0xe0c1, 0x041b, 0xe009, 0xffff, 0xa01f, 0xaf09, 0xae09, 0xe056,
+	0xe0c2, 0x041d, 0xe42e, 0xe0c0, 0x041c, 0xe00a, 0x0200, 0xe0c2,
+	0x041c, 0xa228, 0xa102, 0xf7f0, 0xe0c0, 0x041c, 0xe00c, 0x0200,
+	0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802, 0xe42e,
+	0xe40e, 0x0edd, 0xe40e, 0x0354, 0xe40e, 0x0358, 0xe40e, 0x035c,
+	0xe40e, 0x0364, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0368,
+	0xe40e, 0x036a, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe41e, 0x0c24, 0xe40e, 0x00a4,
+	0xe41e, 0x0c54, 0xe40e, 0x00a4, 0xe41e, 0x025b, 0xe41e, 0x0c5e,
+	0xe41e, 0x02ad, 0xe40e, 0x00a4, 0xe41e, 0x0c55, 0xe40e, 0x00a4,
+	0xe40e, 0x00a4, 0xe41e, 0x0cba, 0xe40e, 0x00a4, 0xa202, 0xcf22,
+	0xa202, 0xe42e, 0xa204, 0xcf22, 0xa202, 0xe42e, 0xe008, 0x00ff,
+	0xae08, 0xa908, 0xcf22, 0xe190, 0xcb22, 0xaf18, 0xa802, 0xe42e,
+	0xe004, 0x0080, 0xae08, 0xa908, 0xcf22, 0xe190, 0xcb22, 0xaf18,
+	0xa802, 0xe42e, 0xa102, 0xcc44, 0xa201, 0xe184, 0x0399, 0xe004,
+	0x0080, 0xae08, 0xa908, 0xcf22, 0xe190, 0xcb22, 0xaf18, 0xa802,
+	0xae03, 0xe055, 0xe04a, 0xe42e, 0xd022, 0x0006, 0xa201, 0xe184,
+	0x03ab, 0xe004, 0x0080, 0xae08, 0xa908, 0xcf22, 0xe190, 0xcb22,
+	0xaf18, 0xa802, 0xae03, 0xe055, 0xe04a, 0xae02, 0xb634, 0xe42e,
+	0xd022, 0x0007, 0xa201, 0xe184, 0x03bf, 0xe004, 0x0080, 0xae08,
+	0xa908, 0xcf22, 0xe190, 0xcb22, 0xaf18, 0xa802, 0xae03, 0xe055,
+	0xe04a, 0xe42e, 0xe004, 0x0080, 0xae08, 0xa908, 0xcf22, 0xe190,
+	0xcb22, 0xaf18, 0xa802, 0xe42e, 0xe004, 0x00f0, 0xa908, 0xcf02,
+	0xe42e, 0xd130, 0x0007, 0xd131, 0x0002, 0xa203, 0xae03, 0x2812,
+	0xe016, 0xe055, 0xae03, 0x2819, 0xe055, 0xae03, 0x2818, 0xe055,
+	0xae03, 0x282b, 0xe055, 0xae11, 0x280c, 0xe055, 0xae11, 0x280d,
+	0xe055, 0xcf01, 0xa200, 0x3c80, 0x2a12, 0xe017, 0x2819, 0x4418,
+	0xe056, 0x3080, 0xe166, 0x0202, 0x290e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xae10, 0x4c2f, 0xcf24, 0xe41e, 0x0567, 0x2870, 0xf08a,
+	0x2812, 0xf048, 0xe41e, 0x0539, 0xf03e, 0xe41e, 0x054a, 0x2812,
+	0xe42a, 0xe166, 0x0206, 0x290e, 0xae10, 0x4d0e, 0xae10, 0x4d0e,
+	0xae10, 0x4d06, 0xcf30, 0xe166, 0x0209, 0x290e, 0xae10, 0x4d0e,
+	0xae10, 0x4d06, 0xcf32, 0x282e, 0xae10, 0x4c2d, 0xae10, 0x4c2c,
+	0xcf34, 0xe166, 0x020a, 0x2916, 0x2b16, 0xae21, 0xe056, 0xe166,
+	0x021d, 0x2b16, 0xae11, 0xe056, 0x2b16, 0xae31, 0xe056, 0xcf26,
+	0xe166, 0x020f, 0x290e, 0xae10, 0x4d0e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xcf28, 0xe166, 0x0212, 0x290e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xcf2a, 0xe166, 0x0222, 0x290e, 0xae10, 0x4d0e, 0xae10,
+	0x4d0e, 0xae10, 0x4d06, 0xcf2c, 0xe166, 0x0225, 0x290e, 0xae10,
+	0x4d0e, 0xae10, 0x4d06, 0xcf2e, 0xe166, 0x0227, 0x290e, 0xae10,
+	0x4d06, 0xae10, 0xe166, 0x0214, 0x4d0e, 0xae10, 0x4d06, 0xcf36,
+	0xe166, 0x0218, 0x290e, 0xae10, 0x4d0e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xe005, 0x00f8, 0xe00b, 0x8000, 0xcf3b, 0xcf3c, 0xe190,
+	0xe166, 0x021c, 0x290e, 0xae10, 0x4d0e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xe005, 0x00f8, 0xe00b, 0x8001, 0xcf3b, 0xcf3c, 0xe190,
+	0xe166, 0x022b, 0x290e, 0xae10, 0x4d0e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xe005, 0x00fc, 0xe00b, 0x8000, 0xcf3b, 0xcf3c, 0xe190,
+	0xe166, 0x022f, 0x290e, 0xae10, 0x4d0e, 0xae10, 0x4d0e, 0xae10,
+	0x4d06, 0xe005, 0x00fc, 0xe00b, 0x8001, 0xcf3b, 0xcf3c, 0xe190,
+	0xe42e, 0xa201, 0x281f, 0xe055, 0xae11, 0x2822, 0xe055, 0xae0d,
+	0x287f, 0xe055, 0xae07, 0x281e, 0xe055, 0xae0d, 0x281d, 0xe055,
+	0xae03, 0x281b, 0xe055, 0xcfa1, 0xa201, 0xe166, 0x0680, 0x2916,
+	0xe008, 0x00ff, 0xe055, 0x2916, 0xe008, 0x00ff, 0xae10, 0xe055,
+	0x2916, 0xe008, 0x00ff, 0xae20, 0xe055, 0x2916, 0xe008, 0x00ff,
+	0xae30, 0xe055, 0xcfa3, 0xa201, 0xe166, 0x0684, 0x2916, 0xe008,
+	0x00ff, 0xe055, 0x2916, 0xe008, 0x00ff, 0xae10, 0xe055, 0x2916,
+	0xe008, 0x00ff, 0xae20, 0xe055, 0x2916, 0xe008, 0x00ff, 0xae30,
+	0xe055, 0xcfa5, 0xa201, 0xe166, 0x068c, 0x2916, 0xe008, 0x00ff,
+	0xe055, 0x2916, 0xe008, 0x00ff, 0xae10, 0xe055, 0x2916, 0xe008,
+	0x00ff, 0xae20, 0xe055, 0x2916, 0xe008, 0x00ff, 0xae30, 0xe055,
+	0xcfa7, 0xa201, 0xe166, 0x0688, 0x2916, 0xe008, 0x00ff, 0xe055,
+	0x2916, 0xe008, 0x00ff, 0xae10, 0xe055, 0x2916, 0xe008, 0x00ff,
+	0xae20, 0xe055, 0x2916, 0xe008, 0x00ff, 0xae30, 0xe055, 0xcfa9,
+	0xe005, 0x0080, 0xae21, 0xe00b, 0x0100, 0xcfab, 0xe005, 0x011f,
+	0xae21, 0xe004, 0x013f, 0xe055, 0xcfad, 0xe005, 0x009f, 0xae21,
+	0xe004, 0x00bf, 0xe055, 0xcfb7, 0xa200, 0xcfb0, 0xe41e, 0x0560,
+	0xe42e, 0x2875, 0xae10, 0x4c76, 0xcf06, 0xe42e, 0xa200, 0x4c72,
+	0xae02, 0x4c74, 0xae02, 0x4c71, 0xae02, 0x4c73, 0xae08, 0x3c84,
+	0xe42e, 0xe004, 0x001f, 0xae20, 0xe00a, 0x0000, 0xcf40, 0xe004,
+	0x0100, 0xcf42, 0xe005, 0x011f, 0xae21, 0xe004, 0x013f, 0xe055,
+	0xcf45, 0xe42e, 0xe004, 0x00ff, 0xae20, 0xe00a, 0x0000, 0xcf60,
+	0xe004, 0x0100, 0xcf62, 0xe005, 0x011f, 0xae21, 0xe004, 0x013f,
+	0xe055, 0xcf65, 0x2828, 0xae02, 0x4c27, 0xae04, 0xcf68, 0xe42e,
+	0xe004, 0x001f, 0xae20, 0xe00a, 0x0000, 0xcfc0, 0xe42e, 0xe004,
+	0x0080, 0x3c00, 0xe166, 0x0230, 0xe160, 0x0002, 0x2800, 0xae10,
+	0x4d16, 0xcf38, 0x2a00, 0xae07, 0xd022, 0x0004, 0xe184, 0x057f,
+	0xe04a, 0xae10, 0x8116, 0x4d0e, 0xae10, 0x4d36, 0xcf3e, 0xa003,
+	0xa203, 0x2800, 0xa806, 0xa104, 0xb655, 0x2800, 0xe042, 0x3c00,
+	0xaf10, 0xf028, 0xf64e, 0xe42e, 0xa2fe, 0x3c34, 0x3c35, 0x3c36,
+	0x3c37, 0x3c3c, 0xa200, 0x3c38, 0x3c39, 0x3c3d, 0x3c3e, 0x3c3b,
+	0x3c3a, 0xe0c0, 0x0061, 0x3c32, 0xe0c0, 0x0060, 0x3c33, 0xe41e,
+	0x0ccc, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x0700, 0xd112, 0x00c0,
+	0xd113, 0x0003, 0xca29, 0xf7f9, 0xa204, 0xe41e, 0x13cd, 0xa202,
+	0xe42e, 0xa2fc, 0x3c34, 0xe0c0, 0x0054, 0x2638, 0x4e39, 0xe052,
+	0x3c39, 0x3438, 0xa202, 0xe42e, 0x2835, 0x3c34, 0x2834, 0xa002,
+	0x2a33, 0xe045, 0xb616, 0x3c34, 0x2a35, 0xe045, 0xf059, 0xa2fe,
+	0x3c34, 0xa200, 0xe42e, 0x2a36, 0xe045, 0xf71b, 0x2a37, 0xe045,
+	0xf6eb, 0x2438, 0x4c39, 0x5c34, 0xa802, 0xf698, 0x2814, 0xf08a,
+	0xa202, 0x5834, 0x2638, 0x4e39, 0xe056, 0x3c39, 0x3438, 0xa202,
+	0xe42e, 0xa200, 0x3c98, 0x3c99, 0x2a35, 0x282a, 0xf028, 0x2a34,
+	0x3e99, 0x2826, 0xf0fa, 0xa102, 0xf048, 0x2899, 0x3c37, 0xf0ae,
+	0xa102, 0xf048, 0x2836, 0x3c37, 0xf05e, 0xa2fe, 0x3c98, 0xa200,
+	0x3c37, 0x2825, 0xf0fa, 0xa102, 0xf048, 0x2899, 0x3c36, 0xf0ae,
+	0xa102, 0xf048, 0x2837, 0x3c36, 0xf05e, 0xa2fe, 0x3c98, 0xa200,
+	0x3c36, 0x2823, 0xf03a, 0x2834, 0x3c36, 0x2824, 0xf03a, 0x2834,
+	0x3c37, 0x282a, 0xf048, 0x2834, 0x3c3c, 0xf04e, 0x2834, 0x3c35,
+	0x3c3c, 0x243a, 0x4c3b, 0xa002, 0x3c3b, 0x343a, 0xa200, 0x2a35,
+	0xf045, 0xa203, 0x5a35, 0xe056, 0x2a36, 0xf045, 0xa203, 0x5a36,
+	0xe056, 0x2a37, 0xf045, 0xa203, 0x5a37, 0xe056, 0x2a34, 0xf045,
+	0xa203, 0x5a34, 0xe056, 0x343d, 0x3c3e, 0x2898, 0xf038, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe0c0, 0x0041, 0xe005, 0x0026, 0xae11,
+	0xe042, 0xe41e, 0x0678, 0x3442, 0x3c43, 0xe000, 0x08a0, 0xe41e,
+	0x0678, 0x3447, 0x3c48, 0xe000, 0x0ac0, 0xe0c0, 0x0046, 0xe005,
+	0x002c, 0xae15, 0xe042, 0xe41e, 0x0678, 0x344a, 0x3c4b, 0xe42e,
+	0xe41e, 0x0174, 0xe167, 0x06b5, 0xe166, 0x0064, 0xd022, 0x0003,
+	0xe184, 0x0664, 0x9e16, 0x3517, 0x3d17, 0xe0c0, 0x006c, 0x3444,
+	0x3c45, 0xe42e, 0xe0c0, 0x0050, 0xe049, 0xe008, 0x007f, 0x3c41,
+	0xaf11, 0xe009, 0x007f, 0x3e40, 0x4641, 0x3e41, 0xa202, 0xe42e,
+	0xa00e, 0xaf06, 0xae06, 0xe42e, 0xe41e, 0x068c, 0xe40a, 0x068a,
+	0xe41e, 0x06a2, 0xe40a, 0x068a, 0xe41e, 0x06e4, 0xe40a, 0x068a,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xba4e, 0xa188, 0xf128, 0xba4e,
+	0xa196, 0xf0f8, 0xba4e, 0xa192, 0xf0c8, 0xba4e, 0xa18c, 0xf098,
+	0xd022, 0x001b, 0xe184, 0x069d, 0xba4e, 0xe190, 0xa202, 0xe42e,
+	0xa200, 0xe42e, 0xba4e, 0x3c00, 0xba4e, 0x3c01, 0xba4e, 0x3c02,
+	0xba4e, 0x3c03, 0x2803, 0xae10, 0x4c02, 0xae10, 0x4c01, 0xae10,
+	0x4c00, 0x346a, 0x3c6b, 0xd022, 0x0007, 0xe184, 0x06b8, 0xba4e,
+	0xe190, 0xe190, 0xa200, 0xcc72, 0x3cb7, 0xa202, 0xe42e, 0xba3e,
+	0xe005, 0x0044, 0xae11, 0xa997, 0xae11, 0xa993, 0xae11, 0xa98d,
+	0xe046, 0xe41a, 0x068c, 0xe42e, 0xe41e, 0x06bf, 0xe41e, 0x06a2,
+	0xf09a, 0xe41e, 0x06e4, 0xf06a, 0xe41e, 0x08f0, 0xf03a, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xa202, 0x3c70, 0xe41e, 0x07a3, 0xf03a,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xa200, 0x3c82, 0xba4e, 0xba4f,
+	0xae11, 0xe056, 0xba4f, 0xae21, 0xe055, 0xe04a, 0xa802, 0x3c12,
+	0xe04a, 0xaf02, 0xa80e, 0x3c13, 0xe04a, 0xaf08, 0xa802, 0x3c14,
+	0xe04a, 0xaf0a, 0x3415, 0x3c16, 0x28b7, 0xa006, 0x3cb7, 0xe41e,
+	0x08cc, 0x2812, 0xf07a, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0754,
+	0xf3de, 0x2808, 0x3c94, 0x2809, 0x3c95, 0xba4e, 0xe005, 0x009d,
+	0xe046, 0xe408, 0x0756, 0xba4e, 0xe005, 0x0001, 0xe046, 0xe408,
+	0x0756, 0xba4e, 0xe005, 0x002a, 0xe046, 0xe408, 0x0756, 0xba4e,
+	0xe049, 0xba4e, 0xae10, 0xe055, 0xe04a, 0xe008, 0x3fff, 0x3c08,
+	0xe04a, 0xaf1c, 0xa806, 0x3c0a, 0xba4e, 0xe049, 0xba4e, 0xae10,
+	0xe055, 0xe04a, 0xe008, 0x3fff, 0x3c09, 0xe04a, 0xaf1c, 0xa806,
+	0x3c0b, 0x28b7, 0xa00e, 0x3cb7, 0x2808, 0x1894, 0xf07a, 0xf04e,
+	0x2809, 0x1895, 0xf03a, 0xa202, 0x3c82, 0x2808, 0xa01e, 0xaf08,
+	0x3c0c, 0x2809, 0xa01e, 0xaf08, 0x3c0d, 0xcca4, 0x820c, 0xe018,
+	0x3c0e, 0xf05a, 0xa202, 0xe42e, 0xa202, 0x3cf0, 0xa200, 0xe42e,
+	0x280a, 0x4c0b, 0xf068, 0x2808, 0x3c0f, 0x2809, 0x3c10, 0xe42e,
+	0xa202, 0x2a0a, 0xa103, 0xb6b6, 0xa103, 0xb6b6, 0xa103, 0xb656,
+	0x3c00, 0xa202, 0x2a0a, 0xa103, 0xb696, 0xa103, 0xb676, 0xa103,
+	0xb636, 0x3c01, 0xa202, 0x2a0b, 0xa103, 0xb6b6, 0xa103, 0xb6b6,
+	0xa103, 0xb656, 0x3c02, 0xa202, 0x2a0b, 0xa103, 0xb696, 0xa103,
+	0xb676, 0xa103, 0xb636, 0x3c03, 0x2808, 0xcca4, 0x8200, 0xe018,
+	0xc70f, 0x7c01, 0xe190, 0x3c0f, 0x2809, 0xcca4, 0x8202, 0xe018,
+	0xc70f, 0x7c03, 0xe190, 0x3c10, 0xe42e, 0x280f, 0xa01e, 0xaf08,
+	0x180c, 0x2a10, 0xa01f, 0xaf09, 0x1a0d, 0xf044, 0xf035, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe41e, 0x036e, 0x2812, 0xf068, 0xe41e,
+	0x0380, 0x3c17, 0xe41e, 0x0380, 0xe41e, 0x0380, 0x3c18, 0xf2fa,
+	0xe41e, 0x0380, 0x3c19, 0xe41e, 0x0380, 0x3c1a, 0xf1ca, 0xe41e,
+	0x0380, 0x3c1b, 0xe166, 0x0680, 0xa20e, 0x3c96, 0xe41e, 0x0919,
+	0xe41e, 0x0919, 0xe41e, 0x0919, 0xe41e, 0x0919, 0xe166, 0x0684,
+	0xa20c, 0x3c96, 0xe41e, 0x0919, 0xe41e, 0x0919, 0xe41e, 0x0919,
+	0xe41e, 0x0919, 0x2819, 0xf0ba, 0xe166, 0x0200, 0xa210, 0x3c96,
+	0xe41e, 0x092a, 0xe41e, 0x092a, 0xe41e, 0x092a, 0xe41e, 0x0380,
+	0x3c1c, 0xa20c, 0xe41e, 0x038a, 0x3c1d, 0xa206, 0xe41e, 0x038a,
+	0x3c1e, 0xa200, 0x3c20, 0xe41e, 0x0380, 0x3c1f, 0xf1da, 0xe41e,
+	0x0380, 0x3c20, 0xf19a, 0xe166, 0x0688, 0xa20c, 0x3c96, 0xe41e,
+	0x0936, 0xe41e, 0x0936, 0xe41e, 0x0936, 0xe41e, 0x0936, 0xe166,
+	0x068c, 0xa20c, 0x3c96, 0xe41e, 0x0936, 0xe41e, 0x0936, 0xe41e,
+	0x0936, 0xe41e, 0x0936, 0xa204, 0xe41e, 0x038a, 0x3c21, 0xa202,
+	0x5821, 0x3c21, 0xe406, 0x08ca, 0xa110, 0xe400, 0x08ca, 0xa20e,
+	0xe41e, 0x038a, 0x3c22, 0xe166, 0x06b0, 0xa208, 0x3c96, 0xe41e,
+	0x0946, 0xe41e, 0x0946, 0xe41e, 0x0946, 0xe41e, 0x0946, 0xe41e,
+	0x0946, 0x2812, 0xf1da, 0xe41e, 0x0380, 0x3c23, 0xe41e, 0x0380,
+	0x3c24, 0xa200, 0x3c25, 0x2823, 0xf058, 0xa204, 0xe41e, 0x038a,
+	0x3c25, 0xa200, 0x3c26, 0x2824, 0xf058, 0xa204, 0xe41e, 0x038a,
+	0x3c26, 0xe41e, 0x0380, 0x3c27, 0xe41e, 0x0380, 0x3c28, 0xe41e,
+	0x0380, 0x3c29, 0xf058, 0xe004, 0x0002, 0xe41e, 0x0e5d, 0x2812,
+	0xf048, 0xa202, 0x3c2a, 0xf04e, 0xe41e, 0x0380, 0x3c2a, 0xe167,
+	0x0230, 0xa200, 0x3c00, 0x2800, 0xa108, 0xf1ba, 0x2800, 0xe41e,
+	0x0e6c, 0xe165, 0x0900, 0xe004, 0x0108, 0x3c01, 0x2915, 0xe41e,
+	0x0376, 0x2b07, 0xf04a, 0xe41e, 0x03b0, 0xe049, 0x3f17, 0x2801,
+	0xa102, 0x3c01, 0xf748, 0xe190, 0x2800, 0xa002, 0x3c00, 0xf64e,
+	0xa200, 0x3c2f, 0xe41e, 0x0380, 0x3c2b, 0xf21a, 0xe41e, 0x03b0,
+	0x3c2f, 0x2812, 0xe40a, 0x08c8, 0xe41e, 0x03b0, 0x3c2c, 0xe41e,
+	0x03b0, 0x3c2d, 0xe41e, 0x03b0, 0x3c2e, 0xe166, 0x0203, 0xe41e,
+	0x0380, 0xf0da, 0xe41e, 0x03b0, 0x3d16, 0xe41e, 0x03b0, 0x3d16,
+	0xe41e, 0x03b0, 0x3d16, 0xe41e, 0x03b0, 0x3d16, 0xe166, 0x0207,
+	0xe41e, 0x0380, 0xf0aa, 0xe41e, 0x03b0, 0x3d16, 0xe41e, 0x03b0,
+	0x3d16, 0xe41e, 0x03b0, 0x3d16, 0xe41e, 0x0e88, 0xe165, 0x0650,
+	0xe166, 0x020a, 0xa200, 0x3c00, 0xa126, 0xf08a, 0x2915, 0xe41e,
+	0x0956, 0x2800, 0xa002, 0x3c00, 0xf78e, 0xa200, 0x3c00, 0xa126,
+	0xf08a, 0x2915, 0xe41e, 0x0956, 0x2800, 0xa002, 0x3c00, 0xf78e,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0x2813, 0xf078, 0xa201, 0x3e7b,
+	0x3e7c, 0x3e7d, 0x3e7f, 0xf1ce, 0xa102, 0xf088, 0xa201, 0x3e7b,
+	0x3e7f, 0xa203, 0x3e7c, 0x3e7d, 0xf13e, 0xa102, 0xf088, 0xa201,
+	0x3e7c, 0x3e7f, 0xa203, 0x3e7b, 0x3e7d, 0xf0ae, 0xa102, 0xf078,
+	0xa203, 0x3e7b, 0x3e7c, 0x3e7d, 0x3e7f, 0xf02e, 0xf60e, 0xe42e,
+	0x2812, 0xf228, 0xe41e, 0x0e45, 0xa200, 0x3c1b, 0xe166, 0x0680,
+	0xd022, 0x0007, 0xe184, 0x08fd, 0x3d16, 0xe190, 0xe190, 0xa200,
+	0xe166, 0x0688, 0xd022, 0x0007, 0xe184, 0x0907, 0x3d16, 0xe190,
+	0xe190, 0xa202, 0x3c23, 0x3c24, 0xa200, 0x3c25, 0x3c26, 0xa200,
+	0x3c27, 0x3c28, 0xf05e, 0xa203, 0x287d, 0xb611, 0x3e79, 0xa202,
+	0xe42e, 0xe41e, 0x0380, 0xf0ca, 0x2896, 0xe41e, 0x038a, 0x3d06,
+	0xe41e, 0x0380, 0x2b06, 0xf02a, 0xe013, 0x3f16, 0xf03e, 0xa200,
+	0x3d16, 0xe42e, 0xe41e, 0x0380, 0xf06a, 0x2896, 0xe41e, 0x038a,
+	0x3d16, 0xf04e, 0xe004, 0x00ff, 0x3d16, 0xe42e, 0xe41e, 0x0380,
+	0xf0ca, 0x2896, 0xe41e, 0x038a, 0x3d06, 0xe41e, 0x0380, 0x2b06,
+	0xf02a, 0xe013, 0x3f16, 0xf02e, 0x8116, 0xe42e, 0xe41e, 0x0380,
+	0xf0ca, 0x2896, 0xe41e, 0x038a, 0x3d06, 0xe41e, 0x0380, 0x2b06,
+	0xf02a, 0xe013, 0x3f16, 0xf02e, 0x3d16, 0xe42e, 0xe41e, 0x0376,
+	0x2b06, 0xf04a, 0xe41e, 0x039c, 0xe049, 0x3f16, 0xe42e, 0xa200,
+	0x3c66, 0xa2fe, 0x3c67, 0xa202, 0x3c70, 0x2812, 0x3c71, 0xe016,
+	0x3c73, 0xa200, 0x3c72, 0x3c74, 0xe41e, 0x052e, 0xe41e, 0x03d1,
+	0xe41e, 0x1330, 0xe41e, 0x1363, 0xe41e, 0x025f, 0xe41e, 0x1158,
+	0xe41e, 0x03cc, 0xe41e, 0x1152, 0xe41e, 0x09cf, 0xe41e, 0x0ab0,
+	0xe016, 0x4c69, 0x3c69, 0xe166, 0x0690, 0x2821, 0xa102, 0xf0fa,
+	0xa102, 0xcc44, 0xe184, 0x0995, 0xba4e, 0xe049, 0xba4e, 0xae10,
+	0xe055, 0xba4e, 0xae20, 0xe055, 0x3716, 0x3f16, 0xe190, 0xa200,
+	0x3c70, 0x3c73, 0x3c71, 0xa202, 0x3c72, 0x3c74, 0xe41e, 0x052e,
+	0xe41e, 0x04a1, 0x2821, 0xf21a, 0xa102, 0xf138, 0xe41e, 0x0ad4,
+	0xe41e, 0x03cc, 0xe41e, 0x09f3, 0xa200, 0x246a, 0x4c6b, 0xae06,
+	0xc873, 0xe045, 0xf047, 0xa202, 0x4c69, 0x3c69, 0xa202, 0xe42e,
+	0xe41e, 0x0aec, 0xe41e, 0x0ad4, 0xe41e, 0x03cc, 0xa200, 0xcc72,
+	0xe41e, 0x09fa, 0xa202, 0xe42e, 0xa200, 0xe42e, 0x2812, 0xe016,
+	0x4c23, 0x4c24, 0xf03a, 0x2822, 0x3c7a, 0xa202, 0xe42e, 0xa2fe,
+	0x3c77, 0xa200, 0x3c76, 0x3c68, 0xe16a, 0xa200, 0x3c75, 0x2a77,
+	0xa003, 0x3e77, 0xe41e, 0x0cf1, 0xf0fd, 0x2875, 0xa002, 0x3c75,
+	0x180c, 0xf764, 0x2876, 0xa002, 0x3c76, 0x180d, 0xf6f4, 0xe41e,
+	0x0d1a, 0xa202, 0xe42e, 0x2877, 0x3c67, 0x2a0e, 0xe045, 0x3e68,
+	0xe16a, 0xa200, 0xe42e, 0xe41e, 0x036e, 0xe41e, 0x0a75, 0xe41a,
+	0x0a98, 0xe42e, 0xa2fe, 0x3c77, 0xa200, 0x3c76, 0x3c75, 0x3c8b,
+	0xe16a, 0x2876, 0x2a21, 0xa103, 0xe052, 0x3c8b, 0x2876, 0x1821,
+	0xf072, 0x2876, 0xe418, 0x0ff8, 0xe41e, 0x036e, 0xf09e, 0xe41e,
+	0x102c, 0xe41e, 0x0372, 0xe004, 0x0011, 0xe41e, 0x1041, 0xe41e,
+	0x0a5c, 0xf19d, 0xe41e, 0x101b, 0xe004, 0x0010, 0xe41e, 0x1041,
+	0x2876, 0xa002, 0x3c76, 0x180d, 0xf5d4, 0xe41e, 0x0d1a, 0xa200,
+	0x3c8b, 0xe41e, 0x0a37, 0x288b, 0xa002, 0x3c8b, 0x1821, 0xf7a4,
+	0xa202, 0xe42e, 0xe41e, 0x0a98, 0xe16a, 0xa200, 0xe42e, 0xe004,
+	0x0800, 0x2a8b, 0xcca5, 0xc798, 0xe01c, 0xe09c, 0xe004, 0x0690,
+	0x2a8b, 0xcca5, 0xc782, 0xe01c, 0xe09e, 0x8116, 0x8116, 0x8116,
+	0x8116, 0x8116, 0x8116, 0x8116, 0x8116, 0x8116, 0x8116, 0x8116,
+	0x8116, 0x2116, 0x4d16, 0x2717, 0x4f17, 0xae07, 0xe046, 0xf046,
+	0xa202, 0x4c69, 0x3c69, 0xe42e, 0x2870, 0xf158, 0xa200, 0x3c75,
+	0x2867, 0x2a77, 0xa003, 0x3e77, 0xf044, 0x2877, 0x1867, 0xf0b2,
+	0xe41e, 0x0cf1, 0xf08d, 0x2875, 0xa002, 0x3c75, 0x180c, 0xf714,
+	0xa202, 0xe42e, 0xe16b, 0xa200, 0xe42e, 0xa2fe, 0x3c77, 0xa200,
+	0x3c76, 0xe16a, 0xa200, 0x3c75, 0x2867, 0x2a77, 0xa003, 0x3e77,
+	0xf044, 0x2877, 0x1867, 0xf122, 0xe41e, 0x0cf1, 0xf0fd, 0x2875,
+	0xa002, 0x3c75, 0x180c, 0xf714, 0x2876, 0xa002, 0x3c76, 0x180d,
+	0xf6a4, 0xe41e, 0x0d1a, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0xe16a, 0xe41e, 0x0d2f, 0xf12d, 0x2875, 0xa002, 0x3c75, 0x180c,
+	0x2a77, 0xa003, 0x3e77, 0xf764, 0xa200, 0x3c75, 0x2876, 0xa002,
+	0x3c76, 0x180d, 0xf6f4, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0xa200, 0x2615, 0x4e16, 0xe042, 0x2eb7, 0xe042, 0xae06, 0xc873,
+	0xe045, 0xf191, 0xc873, 0xe046, 0xe049, 0xf13a, 0xaf0a, 0xa102,
+	0xf0b4, 0xcc44, 0xe184, 0x0ac9, 0xba4e, 0xba4e, 0xe190, 0xba4e,
+	0xba4e, 0xe190, 0xe190, 0xe04a, 0xa83e, 0xf03a, 0xe09c, 0x9206,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xa200, 0x2615, 0x4e16, 0xe042,
+	0x2eb7, 0xe042, 0x2a21, 0xa103, 0xf0e5, 0xf04b, 0xcca5, 0xc783,
+	0xe01c, 0xae06, 0xc873, 0xe045, 0xf061, 0xc873, 0xe046, 0xe40e,
+	0x0abc, 0xe190, 0xa200, 0xe42e, 0xe166, 0x0690, 0xe167, 0x06a0,
+	0xa200, 0x2615, 0x4e16, 0xe042, 0x2eb7, 0xe042, 0x2a21, 0xa111,
+	0xf201, 0x2a21, 0xa103, 0xf1d7, 0xcca5, 0xc783, 0xe01c, 0x3517,
+	0x3d17, 0x2a21, 0xa103, 0xa103, 0xcc45, 0xe184, 0x0b0b, 0x2716,
+	0x4f16, 0xe042, 0x3517, 0x3d17, 0x266a, 0x4e6b, 0xe045, 0xa107,
+	0x2812, 0xf028, 0xa10f, 0x2cb7, 0xe041, 0x3716, 0x3f16, 0xe190,
+	0xa202, 0xe42e, 0xa206, 0xe41e, 0x13cd, 0xe41e, 0x1330, 0xe41e,
+	0x1363, 0xe41e, 0x025f, 0xe41e, 0x0b48, 0xa202, 0xe42e, 0x2834,
+	0xf1f4, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe019, 0xe001,
+	0x0500, 0xe09f, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e,
+	0x1310, 0xaf04, 0xe41e, 0x1319, 0xae20, 0x2e32, 0xe056, 0x9f17,
+	0x200c, 0x4c0d, 0xae08, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e,
+	0xa200, 0x2a41, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2a41, 0xa805,
+	0xf02b, 0xa912, 0x2a41, 0xa809, 0xf02b, 0xa940, 0x2a41, 0xa811,
+	0xf02b, 0xa980, 0xe0c2, 0x040c, 0xe42e, 0xe0c0, 0x0059, 0xa102,
+	0xf20a, 0xa102, 0xe42a, 0xa102, 0xf04a, 0xa102, 0xf24a, 0xe42e,
+	0xe0c0, 0x0060, 0xaf08, 0x3051, 0xaf02, 0x3052, 0xe0c0, 0x0060,
+	0xa81e, 0x3c50, 0xe0c0, 0x0061, 0xa83e, 0x3c54, 0xe0c1, 0x0065,
+	0xa809, 0xe0c0, 0x0065, 0xaf06, 0xa806, 0xb632, 0x3c4c, 0xe42e,
+	0xe0c0, 0x0060, 0x34a0, 0x3ca1, 0xe0c0, 0x0061, 0xae14, 0x34a2,
+	0x3ca3, 0xe42e, 0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0bf5,
+	0xa102, 0xe42a, 0xa102, 0xf05a, 0xa102, 0xe40a, 0x0c1b, 0xe42e,
+	0xa200, 0xe0c2, 0x0075, 0xe0c2, 0x0078, 0xe0c2, 0x0079, 0xe0c2,
+	0x007d, 0xe0c2, 0x007e, 0x2834, 0x2ab1, 0xb7d2, 0xe0c2, 0x0077,
+	0x2834, 0xe049, 0xa003, 0xb7b6, 0x2a14, 0xb7b6, 0x2ab1, 0xb7f2,
+	0x2a51, 0x4e52, 0x46b1, 0xb7f2, 0xe0c2, 0x0071, 0x2438, 0x4c39,
+	0xe0c2, 0x0054, 0x200c, 0x4c0d, 0xae08, 0xe0c2, 0x006f, 0x243a,
+	0x4c3b, 0xe0c2, 0x0070, 0x2868, 0xe0c2, 0x0072, 0x2812, 0xa802,
+	0xe0c2, 0x0073, 0xe41e, 0x0c1c, 0xe0c2, 0x007c, 0xa200, 0x2a36,
+	0xe009, 0x00ff, 0xe056, 0xae10, 0x2a37, 0xe009, 0x00ff, 0xe056,
+	0xae10, 0x2a35, 0xe009, 0x00ff, 0xe056, 0xae0e, 0x4c13, 0xae02,
+	0x4c14, 0xe0c2, 0x007a, 0x2878, 0xae02, 0x2a78, 0xa103, 0xb632,
+	0x2a69, 0xae21, 0xe056, 0xe0c2, 0x0076, 0xc84a, 0xc84d, 0xae20,
+	0xe056, 0xe0c2, 0x0053, 0xa202, 0xe42e, 0xa200, 0xe0c2, 0x0074,
+	0xe0c2, 0x0076, 0xe0c2, 0x0077, 0xe0c2, 0x0079, 0xe0c2, 0x007a,
+	0xa2fe, 0xe0c2, 0x0072, 0xe0c2, 0x006d, 0xa208, 0xe0c2, 0x0073,
+	0x2008, 0x4c09, 0xe0c2, 0x0071, 0x2813, 0xe0c2, 0x007b, 0xe41e,
+	0x0c1c, 0xe0c2, 0x0075, 0x2883, 0xe0c2, 0x0070, 0x28f0, 0xe0c2,
+	0x0078, 0xa202, 0xe42e, 0xe42e, 0x280a, 0xae04, 0x4c0b, 0xae1c,
+	0x4c08, 0xae1c, 0x4c09, 0xe42e, 0xe41e, 0x0148, 0xe41e, 0x023a,
+	0xe41e, 0x0ccf, 0xe41e, 0x063b, 0xd130, 0x0007, 0xd131, 0x0002,
+	0xd04b, 0x0001, 0xd04c, 0x0000, 0xd008, 0x0000, 0xd03a, 0x0000,
+	0xa200, 0xcc4a, 0xcc4c, 0xa200, 0x3c83, 0xe41e, 0x0b5d, 0xe41e,
+	0x0ea9, 0xf0da, 0xa200, 0x3cb7, 0xe41e, 0x067c, 0xa100, 0xf07a,
+	0xe41e, 0x0758, 0x2812, 0xf038, 0xa202, 0x3c83, 0xe41e, 0x0b8b,
+	0xe41e, 0x0f3f, 0xe16a, 0xe42e, 0xe42e, 0xe41e, 0x058c, 0xe41e,
+	0x0658, 0xe41e, 0x0dd4, 0xe41e, 0x1330, 0xe42e, 0xa200, 0xcc44,
+	0xcc4a, 0xcc4c, 0x3c69, 0x3c78, 0xd130, 0x0007, 0xd131, 0x0002,
+	0xd008, 0x0000, 0xd03a, 0x0000, 0xe41e, 0x0b5d, 0xe41e, 0x0ea9,
+	0xe40a, 0x0caa, 0xa200, 0x3cb7, 0xe41e, 0x05b1, 0xe41e, 0x066a,
+	0xe41e, 0x0ea0, 0xe41e, 0x1138, 0xe41e, 0x0dd9, 0xe41e, 0x0b1a,
+	0x28b1, 0xf298, 0xe41e, 0x0cdc, 0xe41e, 0x06cc, 0xf24a, 0xe41e,
+	0x0cdc, 0x28b1, 0xf208, 0xe41e, 0x0795, 0xf1da, 0xe41e, 0x0cdc,
+	0xe41e, 0x06db, 0xf18a, 0xe41e, 0x0cdc, 0x2829, 0xe418, 0x0cd4,
+	0xe41e, 0x0ce0, 0xf108, 0xe41e, 0x0cdc, 0xe41e, 0x05bc, 0xf0ba,
+	0xe41e, 0x0cdc, 0xe41e, 0x0b27, 0xe41e, 0x095f, 0xe41e, 0x05e1,
+	0xe41e, 0x0cd8, 0xe41e, 0x09c6, 0xe41e, 0x0ea2, 0xe41e, 0x11eb,
+	0xe41e, 0x0e29, 0xe41e, 0x0b8b, 0x2834, 0xa002, 0xe016, 0xe41a,
+	0x0f3f, 0xe42e, 0xa2fe, 0x3c34, 0x3c35, 0x3c36, 0x3c37, 0x3c3c,
+	0xe0c0, 0x0054, 0x3438, 0x3c39, 0xa200, 0x3cae, 0x3cb1, 0x3c3d,
+	0x3c3e, 0x3c3b, 0x3c3a, 0xe42e, 0xca28, 0xf7f8, 0xe42e, 0xe41e,
+	0x0e45, 0xe41e, 0x12e0, 0xe42e, 0xa204, 0xe41e, 0x0e5d, 0xe42e,
+	0xa206, 0xe41e, 0x0e5d, 0xe42e, 0x2878, 0xa002, 0x3c78, 0xe42e,
+	0x284c, 0xe42a, 0xa102, 0xf04a, 0xa102, 0xf05a, 0xf09e, 0x2812,
+	0xf078, 0xf04e, 0x2812, 0xa104, 0xf03a, 0xa200, 0xe42e, 0xa202,
+	0xe42e, 0xcb05, 0xe009, 0x2222, 0x2875, 0xae10, 0x4c76, 0xcf06,
+	0xf058, 0xe16a, 0xe41e, 0x0d41, 0xf0ae, 0xf03b, 0xe41e, 0x0d53,
+	0xcb05, 0xaf21, 0xa803, 0xf03b, 0xe41e, 0x0d96, 0x2884, 0xa908,
+	0xcf02, 0x2884, 0xa902, 0xcf02, 0x2a70, 0xcb02, 0xa802, 0xf7e8,
+	0xe429, 0xcb04, 0xaf14, 0xa802, 0xf7da, 0xe41e, 0x11ef, 0xe41e,
+	0x1241, 0xe42e, 0x2870, 0xcb05, 0xe009, 0x2222, 0xf07a, 0xf03b,
+	0xe41e, 0x0d53, 0xe41e, 0x0d7c, 0xe42e, 0xcb05, 0xaf21, 0xa803,
+	0xf03b, 0xe41e, 0x0d96, 0x2880, 0xe418, 0x0dba, 0xe42e, 0x2875,
+	0xae10, 0x4c76, 0xcf06, 0x2884, 0xa908, 0xcf02, 0x2884, 0xa906,
+	0xcf02, 0xcb02, 0xa802, 0xf7e8, 0xe41e, 0x11ef, 0xe41e, 0x1241,
+	0xe42e, 0x2a70, 0xa200, 0x3c46, 0x3c85, 0x3c49, 0x3c86, 0xf0b9,
+	0xe41e, 0x0d62, 0xe41e, 0x0d62, 0x2880, 0xf058, 0xe41e, 0x0da0,
+	0xe41e, 0x0da0, 0xe42e, 0x3e9a, 0x2870, 0xa845, 0xf05a, 0xf03b,
+	0xe41e, 0x0d7c, 0xe42e, 0x2a9a, 0xe009, 0x0200, 0xf03b, 0xe41e,
+	0x0d62, 0xe42e, 0x2044, 0x4c45, 0x2e46, 0xae11, 0xe042, 0xca29,
+	0xf7f9, 0xce20, 0x2a85, 0xe004, 0x0100, 0xf03b, 0xe004, 0x0120,
+	0xce22, 0xd112, 0x0020, 0xd113, 0x0019, 0x2885, 0xaa02, 0x3c85,
+	0x2c46, 0xa002, 0x3c46, 0xe42e, 0x2044, 0x4c45, 0x2e46, 0xae11,
+	0xe042, 0xca29, 0xf7f9, 0xce20, 0x2a85, 0xe004, 0x0100, 0xf03b,
+	0xe004, 0x0120, 0xce22, 0xd112, 0x0020, 0xd113, 0x0018, 0x2885,
+	0xaa02, 0x3c85, 0x2c46, 0xa002, 0x3c46, 0xe42e, 0x2870, 0xf088,
+	0x2880, 0xf04a, 0xe41e, 0x0dba, 0xe42e, 0xe41e, 0x0da0, 0xe42e,
+	0x2047, 0x4c48, 0x2e49, 0xae11, 0xe042, 0xca29, 0xf7f9, 0xce20,
+	0x2a86, 0xe004, 0x0080, 0xf03b, 0xe004, 0x00a0, 0xce22, 0xd112,
+	0x0020, 0xd113, 0x0019, 0x2886, 0xaa02, 0x3c86, 0x2c49, 0xa002,
+	0x3c49, 0xe42e, 0x2047, 0x4c48, 0x2e49, 0xae11, 0xe042, 0xca29,
+	0xf7f9, 0xce20, 0x2a86, 0xe004, 0x0080, 0xf03b, 0xe004, 0x00a0,
+	0xce22, 0xd112, 0x0020, 0xd113, 0x0018, 0x2886, 0xaa02, 0x3c86,
+	0x2c49, 0xa002, 0x3c49, 0xe42e, 0xa2fe, 0x3c53, 0xa200, 0x3c51,
+	0xe42e, 0x283f, 0x3c53, 0x2853, 0xf032, 0xa200, 0x3c51, 0xa200,
+	0x3c58, 0x3c59, 0x280c, 0x3c56, 0x280d, 0x3c57, 0x2851, 0xe42a,
+	0x2853, 0xe424, 0x2853, 0xe0c2, 0x0143, 0x2854, 0xe0c2, 0x0144,
+	0xa200, 0xe0c2, 0x017f, 0xe0c2, 0x0149, 0xe41e, 0x1310, 0xe0c2,
+	0x017f, 0x2856, 0xa102, 0xae20, 0x4c57, 0xa102, 0xe0c2, 0x0142,
+	0xa200, 0xae20, 0x2a50, 0xe042, 0xe0c2, 0x014e, 0xe42e, 0x2853,
+	0x2a59, 0x1a57, 0xe423, 0x2858, 0xae0e, 0x4c59, 0xa203, 0xb615,
+	0x3e5a, 0x2a5a, 0xae03, 0xa903, 0xae1d, 0xe056, 0xe0c1, 0x014b,
+	0xf7e9, 0xe0c2, 0x014d, 0xa202, 0xe0c2, 0x014a, 0x2a58, 0xa003,
+	0x3e58, 0x1a56, 0xf065, 0x2a59, 0xa003, 0x3e59, 0xa201, 0x3e58,
+	0xe42e, 0x2851, 0xf15a, 0x2859, 0x1857, 0xf042, 0xe41e, 0x0e07,
+	0xf7be, 0xe0c0, 0x014b, 0xf7e8, 0xa204, 0xae1c, 0xe0c2, 0x014d,
+	0xa202, 0xe0c2, 0x014a, 0xe190, 0xe0c0, 0x014b, 0xf7e8, 0x2a14,
+	0x2834, 0xb7f6, 0x3c3f, 0x3c53, 0xe42e, 0xa200, 0xe0c1, 0x0040,
+	0xe042, 0xe005, 0x0059, 0xae17, 0xe042, 0xe005, 0x1600, 0xae03,
+	0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111, 0x0200, 0xd112, 0x0450,
+	0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e, 0x3c90, 0x2042, 0x4c43,
+	0xca29, 0xf7f9, 0xce20, 0xd111, 0x0200, 0xd112, 0x0450, 0x2890,
+	0xce26, 0xca28, 0xf7f8, 0xe42e, 0xcca4, 0xe182, 0x0108, 0xe018,
+	0xae02, 0xe0c1, 0x0040, 0xe042, 0xe005, 0x0059, 0xae17, 0xe042,
+	0xe005, 0x1a50, 0xae03, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111,
+	0x0900, 0xd112, 0x0108, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0xa200, 0xe0c1, 0x0040, 0xe042, 0xe005, 0x0059, 0xae17, 0xe042,
+	0xe005, 0x1f50, 0xae03, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111,
+	0x0650, 0xd112, 0x0028, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0xa202, 0xe42e, 0xa202, 0xe42e, 0xe42e, 0xe42e, 0xe42e, 0xe42e,
+	0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x0eb6, 0xa102, 0xe40a,
+	0x0ed8, 0xa102, 0xe40a, 0x0ebe, 0xe40e, 0x0ed8, 0xe41e, 0x023a,
+	0x24a0, 0x4ca1, 0x04a2, 0x0ca3, 0x34a4, 0x3ca5, 0xa206, 0xae1e,
+	0xcec0, 0xd160, 0x0600, 0xe0c0, 0x0048, 0xe0c2, 0x0051, 0x34aa,
+	0x3cab, 0x34a6, 0xe008, 0xfe00, 0x3ca7, 0x2cab, 0xe008, 0x01ff,
+	0x3cac, 0xe41e, 0x10a1, 0xf07d, 0xe41e, 0x0f20, 0xe41e, 0x0f0b,
+	0xa202, 0xe42e, 0xa200, 0xe16a, 0xe42e, 0xe41e, 0x0ee0, 0xe470,
+	0xca28, 0xf7f8, 0xe004, 0x0080, 0xce24, 0x28af, 0xae0e, 0xce22,
+	0x24a6, 0x4ca7, 0xce20, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa022,
+	0xce26, 0xca28, 0xf7f8, 0x24a6, 0x4ca7, 0xe000, 0x0200, 0x34a6,
+	0x3ca7, 0x14a4, 0x1ca5, 0xf054, 0x24a0, 0x4ca1, 0x34a6, 0x3ca7,
+	0xd04c, 0x0000, 0x28af, 0xae0e, 0xcc6e, 0x28af, 0xe016, 0x3caf,
+	0xe42e, 0x28b1, 0xe42e, 0xa200, 0x3caf, 0xce92, 0xe41e, 0x0ee0,
+	0xe41e, 0x0ee0, 0xe128, 0xd071, 0x2020, 0xe181, 0x2cac, 0xa102,
+	0xf074, 0xcc44, 0xe184, 0x0f1d, 0xba4e, 0xe190, 0xe190, 0xe42e,
+	0xe004, 0x1495, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd034, 0x0000,
+	0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037, 0x0000,
+	0xd038, 0x0000, 0xd039, 0x0000, 0xd04b, 0x0001, 0xd04c, 0x0000,
+	0xd046, 0x0000, 0xd047, 0x0000, 0xd149, 0x0000, 0xe42e, 0xe0c0,
+	0x0059, 0xa102, 0xe40a, 0x0f4a, 0xa102, 0xe42a, 0xa102, 0xe40a,
+	0x0f4a, 0xe42a, 0x24b4, 0x4cb5, 0x04aa, 0x0cab, 0x34aa, 0x3cab,
+	0x14a4, 0x1ca5, 0xf074, 0x24aa, 0x4cab, 0x14a2, 0x1ca3, 0x34aa,
+	0x3cab, 0x24aa, 0x4cab, 0xe0c2, 0x0048, 0xe0c2, 0x0052, 0xe42e,
+	0xa200, 0x34b4, 0x3cb5, 0xe42e, 0xf0a8, 0x2911, 0xe008, 0xffff,
+	0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xf0fe, 0x2911, 0xe008,
+	0x00ff, 0xae20, 0x2b11, 0xe009, 0xffff, 0xe042, 0xae10, 0x2b11,
+	0xe009, 0xff00, 0xaf11, 0xe042, 0x2ab6, 0xe42b, 0xe049, 0xaf31,
+	0xe009, 0x00ff, 0xe093, 0xe049, 0xaf21, 0xe009, 0x00ff, 0xe095,
+	0xe049, 0xaf11, 0xe009, 0x00ff, 0xe008, 0x00ff, 0xae10, 0xe056,
+	0xae10, 0xe085, 0xe056, 0xae10, 0xe083, 0xe056, 0xe42e, 0xe049,
+	0xa80f, 0xe046, 0xe42e, 0xca29, 0xf7f9, 0xd111, 0x07c0, 0xce20,
+	0x26a4, 0x4ea5, 0xe045, 0xe004, 0x0040, 0xe065, 0xaf03, 0xce25,
+	0x3eb0, 0xe41e, 0x0fb9, 0xa240, 0x18b0, 0xe426, 0xce24, 0x28b0,
+	0xe000, 0x07c0, 0xce22, 0x24a0, 0x4ca1, 0xce20, 0xe41e, 0x0fb9,
+	0xe42e, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa002, 0xce26, 0xca28,
+	0xf7f8, 0xe42e, 0x34b8, 0x3cb9, 0xa200, 0x3cad, 0xe0c0, 0x0049,
+	0x34ba, 0x3cbb, 0xe0c0, 0x0045, 0xaf04, 0x30ae, 0xe0c0, 0x0049,
+	0x34a8, 0x3ca9, 0x10ba, 0x1cbb, 0x2aad, 0xb611, 0x3ead, 0x26a8,
+	0x4ea9, 0x16b8, 0x1eb9, 0xf033, 0x06a2, 0x0ea3, 0x16b2, 0x1eb3,
+	0xa200, 0xe423, 0x28ae, 0x3cb1, 0xe428, 0x28ad, 0xf648, 0xe41e,
+	0x01db, 0xe0c0, 0x005c, 0xe008, 0x4000, 0xf5da, 0xe0c0, 0x005d,
+	0xe00a, 0x4000, 0xe0c2, 0x005d, 0xa202, 0xce00, 0x3cad, 0xf53e,
+	0xe004, 0x06a0, 0x2a8b, 0xae03, 0xe042, 0xe09c, 0x2516, 0x4d16,
+	0x26aa, 0x4eab, 0xa019, 0xe042, 0xe049, 0xe008, 0x01ff, 0xe045,
+	0x36a6, 0x3ea7, 0x3cac, 0x24a6, 0x4ca7, 0x14a4, 0x1ca5, 0xf054,
+	0x04a0, 0x0ca1, 0x34a6, 0x3ca7, 0xe41e, 0x0f20, 0xe41e, 0x0f0b,
+	0xa200, 0xcc72, 0xe42e, 0xe004, 0x08c0, 0x2a8b, 0xae05, 0xe042,
+	0xe09c, 0x20a6, 0x4ca7, 0x3516, 0x3d16, 0x28ac, 0x3d16, 0x28af,
+	0x3d16, 0xe41e, 0x1053, 0xe42e, 0xe41e, 0x0f20, 0xe004, 0x08c0,
+	0x2a8b, 0xae05, 0xe042, 0xe09c, 0x2116, 0x4d16, 0x34a6, 0x3ca7,
+	0x2916, 0x3cac, 0x2916, 0x3caf, 0xae0e, 0xce92, 0xe41e, 0x1079,
+	0xe42e, 0x3c90, 0xca29, 0xf7f9, 0xd111, 0x0000, 0x288b, 0xae14,
+	0x264a, 0x4e4b, 0xe042, 0xce20, 0xd112, 0x0100, 0x2890, 0xce26,
+	0xca29, 0xf7f9, 0xe42e, 0xe004, 0x0800, 0x2a8b, 0xcca5, 0xc798,
+	0xe01c, 0xe09c, 0xc860, 0x3516, 0x3d16, 0xc862, 0x3516, 0x3d16,
+	0xc864, 0x3516, 0x3d16, 0xc866, 0x3d16, 0xc868, 0x3d16, 0xc86a,
+	0x3d16, 0xc86c, 0x3d16, 0xc86e, 0x3d16, 0xc870, 0x3d16, 0xc872,
+	0x3516, 0x3d16, 0xc88c, 0x3516, 0x3d16, 0xcb20, 0x3516, 0x3d16,
+	0xe42e, 0xe004, 0x0800, 0x2a8b, 0xcca5, 0xc798, 0xe01c, 0xe09c,
+	0x2116, 0x4d16, 0xcc60, 0x2116, 0x4d16, 0xcc62, 0x2116, 0x4d16,
+	0xcc64, 0x2916, 0xcc66, 0x2916, 0xcc68, 0x2916, 0xcc6a, 0x2916,
+	0xcc6c, 0x2916, 0xcc6e, 0x2916, 0xcc70, 0x2116, 0x4d16, 0xcc72,
+	0x2116, 0x4d16, 0xcc8c, 0x2116, 0x4d16, 0xaf08, 0xae08, 0xcf20,
+	0xe42e, 0xe0c0, 0x0059, 0xa102, 0xe40a, 0x10ac, 0xa102, 0xe42a,
+	0xa102, 0xe40a, 0x10e5, 0xe42e, 0xa202, 0x3cb6, 0xa240, 0x34b2,
+	0x3cb3, 0x24aa, 0x4cab, 0xd027, 0x0000, 0xe41e, 0x0fc2, 0xd027,
+	0x0001, 0xe408, 0x10e3, 0x24aa, 0x4cab, 0xe41e, 0x0f97, 0xe095,
+	0xe41e, 0x0f9b, 0xe084, 0xa00c, 0xaf02, 0xe000, 0x07c0, 0xe092,
+	0xe084, 0xa802, 0xe41e, 0x0f64, 0xe008, 0xffff, 0x34b4, 0x3cb5,
+	0xa140, 0xf114, 0x24b4, 0x4cb5, 0xa02c, 0x34b2, 0x3cb3, 0x24aa,
+	0x4cab, 0xd027, 0x0000, 0xe41e, 0x0fc2, 0xd027, 0x0001, 0xf048,
+	0xa200, 0xe42e, 0xe16b, 0xa202, 0xe42e, 0xa218, 0x34b2, 0x3cb3,
+	0x24aa, 0x4cab, 0xd027, 0x0000, 0xe41e, 0x0fc2, 0xd027, 0x0001,
+	0xf2f8, 0x24aa, 0x4cab, 0xe41e, 0x0f97, 0xe095, 0xe41e, 0x0f9b,
+	0xe084, 0xaf02, 0xe000, 0x07c0, 0xe092, 0xe41e, 0x1124, 0xe084,
+	0xa802, 0xe41e, 0x0f64, 0x00b4, 0x0cb5, 0x34b4, 0x3cb5, 0xf186,
+	0x26a2, 0x4ea3, 0xe046, 0xf142, 0x24b4, 0x4cb5, 0xa018, 0x34b4,
+	0x3cb5, 0x34b2, 0x3cb3, 0x24aa, 0x4cab, 0xd027, 0x0000, 0xe41e,
+	0x0fc2, 0xd027, 0x0001, 0xf048, 0xa200, 0xe42e, 0xe16b, 0xa200,
+	0x34b4, 0x3cb5, 0xa202, 0xe42e, 0x2111, 0x4d09, 0xe005, 0x0044,
+	0xae11, 0xa997, 0xae11, 0xa993, 0xae11, 0xa98d, 0xe046, 0xa241,
+	0xb611, 0x36b4, 0x3eb5, 0xaf03, 0xe082, 0xe042, 0xe092, 0xe42e,
+	0xa20e, 0xa940, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x013d, 0xa200,
+	0xe0c2, 0x0128, 0x2a51, 0x4e52, 0xb692, 0xae08, 0xa91c, 0xe0c2,
+	0x017c, 0xa218, 0xe0c2, 0x017d, 0xa200, 0xe41e, 0x1310, 0xe0c2,
+	0x0102, 0xe42e, 0xe41e, 0x0274, 0xa202, 0xe0c2, 0x0106, 0xe42e,
+	0xa20e, 0xa940, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x013d, 0x2a51,
+	0x4e52, 0xb692, 0xae08, 0xa91c, 0xe0c2, 0x017c, 0xa218, 0xe0c2,
+	0x017d, 0xe0c1, 0x0046, 0xe004, 0x0000, 0xae10, 0xe042, 0x2a40,
+	0xa805, 0xf05b, 0xe161, 0x06b7, 0x2111, 0x4d11, 0xe0c2, 0x0103,
+	0xa202, 0xe0c2, 0x0210, 0xe0c1, 0x0046, 0xe004, 0x0030, 0xae10,
+	0xe042, 0x2a40, 0xa809, 0xf05b, 0xe161, 0x06b9, 0x2111, 0x4d11,
+	0xe0c2, 0x0211, 0xe0c1, 0x0046, 0xe004, 0x0030, 0xe000, 0x0040,
+	0xae10, 0xe042, 0x2a40, 0xa811, 0xf05b, 0xe161, 0x06bb, 0x2111,
+	0x4d11, 0xe0c2, 0x0212, 0x200c, 0x4c0d, 0xae08, 0xe0c2, 0x0101,
+	0xe0c2, 0x0205, 0xa200, 0xe41e, 0x1310, 0xe0c2, 0x0102, 0x2812,
+	0xa802, 0xae06, 0xe0c2, 0x0104, 0xa20e, 0xae04, 0xa904, 0xae04,
+	0x4c12, 0xae06, 0xa900, 0xe0c2, 0x0204, 0xa200, 0xe0c2, 0x0208,
+	0xa200, 0xe41e, 0x1310, 0xa203, 0xae11, 0xe056, 0xe0c2, 0x0213,
+	0xa200, 0xe0c2, 0x0215, 0xe0c2, 0x0216, 0xe0c2, 0x0216, 0x2834,
+	0xe0c2, 0x020b, 0xe0c2, 0x0214, 0x281c, 0xe0c2, 0x0217, 0xe166,
+	0x06b0, 0x2916, 0xe0c2, 0x0154, 0x2116, 0x4d16, 0xe0c2, 0x0155,
+	0x2116, 0x4d16, 0xe0c2, 0x0156, 0xe41e, 0x12f8, 0xe41e, 0x12cb,
+	0xe41e, 0x124f, 0xa200, 0xe0c2, 0x0113, 0xe0c2, 0x030d, 0xe0c2,
+	0x022b, 0xa202, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xcbb2,
+	0xaf10, 0xa8fe, 0x3c87, 0xae30, 0xe0c2, 0x0115, 0xcbb2, 0xa820,
+	0xa27f, 0xb611, 0xe0c3, 0x012a, 0xcbb2, 0x3088, 0xe049, 0xa803,
+	0xae03, 0xe05a, 0xa814, 0xe01a, 0xae14, 0xcbb3, 0xa81f, 0xe056,
+	0xe0c2, 0x0114, 0x2888, 0xcbb5, 0xf178, 0xa105, 0x2089, 0x4c8a,
+	0xf039, 0xae02, 0xf06e, 0xa103, 0xf049, 0xe049, 0xae02, 0xe056,
+	0xe0c2, 0x030a, 0xe004, 0x0055, 0xe0c2, 0x030c, 0xe0c0, 0x03b0,
+	0x349b, 0x3c9c, 0xe42e, 0x2875, 0xa002, 0x180c, 0xe01a, 0x2a76,
+	0xe01b, 0xe052, 0xa201, 0xb691, 0x2875, 0xb431, 0x2876, 0xb451,
+	0xe04a, 0xa806, 0xa106, 0xb495, 0xb495, 0xe0c3, 0x0120, 0xcbb8,
+	0xe0c2, 0x0121, 0xcbba, 0xe0c2, 0x0122, 0xcbbc, 0xe0c2, 0x0123,
+	0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xa202, 0xe0c2, 0x0110, 0x2851,
+	0x4c52, 0xe42a, 0x2859, 0x1857, 0xe414, 0x0e07, 0xe42e, 0xa200,
+	0xe0c2, 0x030b, 0xa202, 0xe0c2, 0x0302, 0x2835, 0xb608, 0xe0c2,
+	0x0380, 0x2835, 0xb608, 0xe0c2, 0x0383, 0x2836, 0xb608, 0xe0c2,
+	0x0386, 0x2837, 0xb608, 0xe0c2, 0x0389, 0xa200, 0xe0c2, 0x0302,
+	0xe004, 0x0421, 0x3c89, 0xe004, 0x0842, 0x3c8a, 0xa200, 0xe0c2,
+	0x0303, 0x2879, 0xae0c, 0xe0c2, 0x0330, 0xa200, 0xe0c2, 0x0308,
+	0x2879, 0xe166, 0x06e0, 0xe167, 0x0331, 0xf038, 0xe166, 0x06c0,
+	0xd022, 0x0007, 0xe184, 0x128b, 0x2916, 0xae10, 0x4d16, 0xae10,
+	0x4d16, 0xae10, 0x4d16, 0x9f17, 0xe190, 0xa20e, 0xe0c2, 0x0312,
+	0xe0c0, 0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414, 0xe41a, 0x1299,
+	0xe42e, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17,
+	0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101,
+	0xe0c3, 0x015d, 0xe005, 0x001b, 0x3e00, 0x2835, 0xa53e, 0xa400,
+	0x2a36, 0xa53f, 0xa401, 0xae11, 0xe055, 0xae21, 0xe167, 0x01a2,
+	0x2907, 0xaf10, 0x4400, 0xe055, 0xe0c3, 0x015c, 0xa202, 0xe0c2,
+	0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xa200, 0xe0c2, 0x0150, 0xe0c0,
+	0x0151, 0xf7e8, 0xe42e, 0xa202, 0xe0c2, 0x013c, 0xa201, 0xe166,
+	0x0200, 0xd022, 0x00ff, 0xe184, 0x12da, 0x2916, 0xe0c3, 0x013e,
+	0xe0c2, 0x013f, 0xa003, 0xe190, 0xa200, 0xe0c2, 0x013c, 0xe42e,
+	0xa200, 0xe0c1, 0x0040, 0xe042, 0xe005, 0x0059, 0xae17, 0xe042,
+	0xe005, 0x1f80, 0xae03, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111,
+	0x06c0, 0xd112, 0x0040, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0xa200, 0xe0c1, 0x0040, 0xe042, 0xe005, 0x0059, 0xae17, 0xe042,
+	0xe005, 0x1fc0, 0xae03, 0xe042, 0xca29, 0xf7f9, 0xce20, 0xd111,
+	0x0200, 0xd112, 0x0100, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0xe0c1, 0x0044, 0xa80f, 0xe056, 0xe42e, 0xa200, 0xe41e, 0x1310,
+	0xe42e, 0xe0c1, 0x0044, 0xaf0d, 0xae03, 0xe056, 0xe008, 0x003f,
+	0xe42e, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xe42e, 0xe0c1, 0x0044,
+	0xaf17, 0xa803, 0xa105, 0xf039, 0xa213, 0xe42e, 0xa201, 0xe42e,
+	0xa203, 0xe0c3, 0x040d, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xe160,
+	0x0003, 0xe166, 0x0700, 0xe167, 0x0500, 0x2833, 0xf166, 0xa102,
+	0xcc44, 0xe184, 0x1353, 0xa200, 0xe41e, 0x1310, 0xaf04, 0xe41e,
+	0x1319, 0xae20, 0x2e32, 0xe056, 0x9f17, 0x200c, 0x4c0d, 0xae08,
+	0x9f17, 0xe41e, 0x1359, 0xe190, 0xe190, 0xa201, 0xe0c3, 0x040d,
+	0xe42e, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116,
+	0x4d16, 0x9f17, 0xe42e, 0xe0c0, 0x0044, 0xaf20, 0xa802, 0xe428,
+	0xe0c0, 0x0060, 0xa860, 0xe42a, 0xe0c0, 0x0061, 0xa83e, 0xa203,
+	0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500, 0xe09e,
+	0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x1315, 0xa80e,
+	0xaf04, 0xe41e, 0x1319, 0xe41e, 0x1321, 0xe40b, 0x138c, 0xa81e,
+	0xe41e, 0x1326, 0xae09, 0xe056, 0xae20, 0xe0c1, 0x006e, 0xe009,
+	0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0060, 0xa822, 0xa122, 0xf04a,
+	0x2056, 0x4c57, 0xf03e, 0x2057, 0x4c56, 0xae08, 0x9f17, 0xe0c0,
+	0x0062, 0x9f17, 0xe0c0, 0x0063, 0x9f17, 0xe0c0, 0x0064, 0x9f17,
+	0xa201, 0xe0c3, 0x040d, 0xe42e, 0x2834, 0xf1f4, 0xa203, 0xe0c3,
+	0x040d, 0xcca4, 0xc785, 0xe019, 0xe001, 0x0500, 0xe09f, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x1310, 0xaf04, 0xe41e,
+	0x1319, 0xae20, 0x2e32, 0xe056, 0x9f17, 0x200c, 0x4c0d, 0xae08,
+	0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0x3cec, 0xe0c0, 0x0041,
+	0xe005, 0x0020, 0xae11, 0xe042, 0xce20, 0xd111, 0x0700, 0xd112,
+	0x00c0, 0x88ec, 0x0113, 0xca29, 0xf7f9, 0xe190, 0xe42e, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0000, 0x0000, 0x0000, 0x0070, 0x0056, 0x008c, 0x0025, 0x00a2,
+	0x0065, 0x00cc, 0x00a2, 0x0080, 0x00e1, 0x0092, 0x00ac, 0x0093,
+	0x00d6, 0x0027, 0x009c, 0x0080, 0x0081, 0x0084, 0x004b, 0x0091,
+	0x00b2, 0x00ce, 0x00ef, 0x00fe, 0x00fe, 0x00a4, 0x0080, 0x00cc,
+	0x00aa, 0x0077, 0x00eb, 0x008c, 0x00e6, 0x00e4, 0x0080, 0x0082,
+	0x0082, 0x004a, 0x0094, 0x00b4, 0x00cb, 0x00ec, 0x00fe, 0x00fe,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x00fd, 0x0088, 0x00fe, 0x00ff, 0x00e4, 0x00db, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x00bd, 0x0081, 0x00f2, 0x00ff,
+	0x00e3, 0x00d5, 0x00ff, 0x00db, 0x0080, 0x0080, 0x0080, 0x006a,
+	0x007e, 0x00e3, 0x00fc, 0x00d6, 0x00d1, 0x00ff, 0x00ff, 0x0080,
+	0x0080, 0x0080, 0x0001, 0x0062, 0x00f8, 0x00ff, 0x00ec, 0x00e2,
+	0x00ff, 0x00ff, 0x0080, 0x0080, 0x0080, 0x00b5, 0x0085, 0x00ee,
+	0x00fe, 0x00dd, 0x00ea, 0x00ff, 0x009a, 0x0080, 0x0080, 0x0080,
+	0x004e, 0x0086, 0x00ca, 0x00f7, 0x00c6, 0x00b4, 0x00ff, 0x00db,
+	0x0080, 0x0080, 0x0080, 0x0001, 0x00b9, 0x00f9, 0x00ff, 0x00f3,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x00b8, 0x0096,
+	0x00f7, 0x00ff, 0x00ec, 0x00e0, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x004d, 0x006e, 0x00d8, 0x00ff, 0x00ec, 0x00e6, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0001, 0x0065, 0x00fb, 0x00ff,
+	0x00f1, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x00aa,
+	0x008b, 0x00f1, 0x00fc, 0x00ec, 0x00d1, 0x00ff, 0x00ff, 0x0080,
+	0x0080, 0x0080, 0x0025, 0x0074, 0x00c4, 0x00f3, 0x00e4, 0x00ff,
+	0x00ff, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0001, 0x00cc, 0x00fe,
+	0x00ff, 0x00f5, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00cf, 0x00a0, 0x00fa, 0x00ff, 0x00ee, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0066, 0x0067, 0x00e7, 0x00ff, 0x00d3,
+	0x00ab, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0001, 0x0098,
+	0x00fc, 0x00ff, 0x00f0, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x00b1, 0x0087, 0x00f3, 0x00ff, 0x00ea, 0x00e1, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0050, 0x0081, 0x00d3, 0x00ff,
+	0x00c2, 0x00e0, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0001,
+	0x0001, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x00f6, 0x0001, 0x00ff, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00c6, 0x0023, 0x00ed, 0x00df, 0x00c1, 0x00bb, 0x00a2, 0x00a0,
+	0x0091, 0x009b, 0x003e, 0x0083, 0x002d, 0x00c6, 0x00dd, 0x00ac,
+	0x00b0, 0x00dc, 0x009d, 0x00fc, 0x00dd, 0x0001, 0x0044, 0x002f,
+	0x0092, 0x00d0, 0x0095, 0x00a7, 0x00dd, 0x00a2, 0x00ff, 0x00df,
+	0x0080, 0x0001, 0x0095, 0x00f1, 0x00ff, 0x00dd, 0x00e0, 0x00ff,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x00b8, 0x008d, 0x00ea, 0x00fd,
+	0x00de, 0x00dc, 0x00ff, 0x00c7, 0x0080, 0x0080, 0x0080, 0x0051,
+	0x0063, 0x00b5, 0x00f2, 0x00b0, 0x00be, 0x00f9, 0x00ca, 0x00ff,
+	0x00ff, 0x0080, 0x0001, 0x0081, 0x00e8, 0x00fd, 0x00d6, 0x00c5,
+	0x00f2, 0x00c4, 0x00ff, 0x00ff, 0x0080, 0x0063, 0x0079, 0x00d2,
+	0x00fa, 0x00c9, 0x00c6, 0x00ff, 0x00ca, 0x0080, 0x0080, 0x0080,
+	0x0017, 0x005b, 0x00a3, 0x00f2, 0x00aa, 0x00bb, 0x00f7, 0x00d2,
+	0x00ff, 0x00ff, 0x0080, 0x0001, 0x00c8, 0x00f6, 0x00ff, 0x00ea,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x006d, 0x00b2,
+	0x00f1, 0x00ff, 0x00e7, 0x00f5, 0x00ff, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x002c, 0x0082, 0x00c9, 0x00fd, 0x00cd, 0x00c0, 0x00ff,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x0001, 0x0084, 0x00ef, 0x00fb,
+	0x00db, 0x00d1, 0x00ff, 0x00a5, 0x0080, 0x0080, 0x0080, 0x005e,
+	0x0088, 0x00e1, 0x00fb, 0x00da, 0x00be, 0x00ff, 0x00ff, 0x0080,
+	0x0080, 0x0080, 0x0016, 0x0064, 0x00ae, 0x00f5, 0x00ba, 0x00a1,
+	0x00ff, 0x00c7, 0x0080, 0x0080, 0x0080, 0x0001, 0x00b6, 0x00f9,
+	0x00ff, 0x00e8, 0x00eb, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x007c, 0x008f, 0x00f1, 0x00ff, 0x00e3, 0x00ea, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0023, 0x004d, 0x00b5, 0x00fb, 0x00c1,
+	0x00d3, 0x00ff, 0x00cd, 0x0080, 0x0080, 0x0080, 0x0001, 0x009d,
+	0x00f7, 0x00ff, 0x00ec, 0x00e7, 0x00ff, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x0079, 0x008d, 0x00eb, 0x00ff, 0x00e1, 0x00e3, 0x00ff,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x002d, 0x0063, 0x00bc, 0x00fb,
+	0x00c3, 0x00d9, 0x00ff, 0x00e0, 0x0080, 0x0080, 0x0080, 0x0001,
+	0x0001, 0x00fb, 0x00ff, 0x00d5, 0x00ff, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x00cb, 0x0001, 0x00f8, 0x00ff, 0x00ff, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0089, 0x0001, 0x00b1,
+	0x00ff, 0x00e0, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00fd, 0x0009, 0x00f8, 0x00fb, 0x00cf, 0x00d0, 0x00ff, 0x00c0,
+	0x0080, 0x0080, 0x0080, 0x00af, 0x000d, 0x00e0, 0x00f3, 0x00c1,
+	0x00b9, 0x00f9, 0x00c6, 0x00ff, 0x00ff, 0x0080, 0x0049, 0x0011,
+	0x00ab, 0x00dd, 0x00a1, 0x00b3, 0x00ec, 0x00a7, 0x00ff, 0x00ea,
+	0x0080, 0x0001, 0x005f, 0x00f7, 0x00fd, 0x00d4, 0x00b7, 0x00ff,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x00ef, 0x005a, 0x00f4, 0x00fa,
+	0x00d3, 0x00d1, 0x00ff, 0x00ff, 0x0080, 0x0080, 0x0080, 0x009b,
+	0x004d, 0x00c3, 0x00f8, 0x00bc, 0x00c3, 0x00ff, 0x00ff, 0x0080,
+	0x0080, 0x0080, 0x0001, 0x0018, 0x00ef, 0x00fb, 0x00da, 0x00db,
+	0x00ff, 0x00cd, 0x0080, 0x0080, 0x0080, 0x00c9, 0x0033, 0x00db,
+	0x00ff, 0x00c4, 0x00ba, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0045, 0x002e, 0x00be, 0x00ef, 0x00c9, 0x00da, 0x00ff, 0x00e4,
+	0x0080, 0x0080, 0x0080, 0x0001, 0x00bf, 0x00fb, 0x00ff, 0x00ff,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x00df, 0x00a5,
+	0x00f9, 0x00ff, 0x00d5, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x008d, 0x007c, 0x00f8, 0x00ff, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0001, 0x0010, 0x00f8, 0x00ff,
+	0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x00be,
+	0x0024, 0x00e6, 0x00ff, 0x00ec, 0x00ff, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0095, 0x0001, 0x00ff, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0001, 0x00e2, 0x00ff,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00f7, 0x00c0, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x00f0, 0x0080, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0001, 0x0086,
+	0x00fc, 0x00ff, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x00d5, 0x003e, 0x00fa, 0x00ff, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0037, 0x005d, 0x00ff, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00ca, 0x0018, 0x00d5, 0x00eb, 0x00ba, 0x00bf, 0x00dc, 0x00a0,
+	0x00f0, 0x00af, 0x00ff, 0x007e, 0x0026, 0x00b6, 0x00e8, 0x00a9,
+	0x00b8, 0x00e4, 0x00ae, 0x00ff, 0x00bb, 0x0080, 0x003d, 0x002e,
+	0x008a, 0x00db, 0x0097, 0x00b2, 0x00f0, 0x00aa, 0x00ff, 0x00d8,
+	0x0080, 0x0001, 0x0070, 0x00e6, 0x00fa, 0x00c7, 0x00bf, 0x00f7,
+	0x009f, 0x00ff, 0x00ff, 0x0080, 0x00a6, 0x006d, 0x00e4, 0x00fc,
+	0x00d3, 0x00d7, 0x00ff, 0x00ae, 0x0080, 0x0080, 0x0080, 0x0027,
+	0x004d, 0x00a2, 0x00e8, 0x00ac, 0x00b4, 0x00f5, 0x00b2, 0x00ff,
+	0x00ff, 0x0080, 0x0001, 0x0034, 0x00dc, 0x00f6, 0x00c6, 0x00c7,
+	0x00f9, 0x00dc, 0x00ff, 0x00ff, 0x0080, 0x007c, 0x004a, 0x00bf,
+	0x00f3, 0x00b7, 0x00c1, 0x00fa, 0x00dd, 0x00ff, 0x00ff, 0x0080,
+	0x0018, 0x0047, 0x0082, 0x00db, 0x009a, 0x00aa, 0x00f3, 0x00b6,
+	0x00ff, 0x00ff, 0x0080, 0x0001, 0x00b6, 0x00e1, 0x00f9, 0x00db,
+	0x00f0, 0x00ff, 0x00e0, 0x0080, 0x0080, 0x0080, 0x0095, 0x0096,
+	0x00e2, 0x00fc, 0x00d8, 0x00cd, 0x00ff, 0x00ab, 0x0080, 0x0080,
+	0x0080, 0x001c, 0x006c, 0x00aa, 0x00f2, 0x00b7, 0x00c2, 0x00fe,
+	0x00df, 0x00ff, 0x00ff, 0x0080, 0x0001, 0x0051, 0x00e6, 0x00fc,
+	0x00cc, 0x00cb, 0x00ff, 0x00c0, 0x0080, 0x0080, 0x0080, 0x007b,
+	0x0066, 0x00d1, 0x00f7, 0x00bc, 0x00c4, 0x00ff, 0x00e9, 0x0080,
+	0x0080, 0x0080, 0x0014, 0x005f, 0x0099, 0x00f3, 0x00a4, 0x00ad,
+	0x00ff, 0x00cb, 0x0080, 0x0080, 0x0080, 0x0001, 0x00de, 0x00f8,
+	0x00ff, 0x00d8, 0x00d5, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00a8, 0x00af, 0x00f6, 0x00fc, 0x00eb, 0x00cd, 0x00ff, 0x00ff,
+	0x0080, 0x0080, 0x0080, 0x002f, 0x0074, 0x00d7, 0x00ff, 0x00d3,
+	0x00d4, 0x00ff, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0001, 0x0079,
+	0x00ec, 0x00fd, 0x00d4, 0x00d6, 0x00ff, 0x00ff, 0x0080, 0x0080,
+	0x0080, 0x008d, 0x0054, 0x00d5, 0x00fc, 0x00c9, 0x00ca, 0x00ff,
+	0x00db, 0x0080, 0x0080, 0x0080, 0x002a, 0x0050, 0x00a0, 0x00f0,
+	0x00a2, 0x00b9, 0x00ff, 0x00cd, 0x0080, 0x0080, 0x0080, 0x0001,
+	0x0001, 0x00ff, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x00f4, 0x0001, 0x00ff, 0x0080, 0x0080, 0x0080,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x00ee, 0x0001, 0x00ff,
+	0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080, 0x0080,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00b0, 0x00f6, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00df, 0x00f1, 0x00fc, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f9,
+	0x00fd, 0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00f4, 0x00fc, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ea, 0x00fe, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f6, 0x00fe, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ef, 0x00fd,
+	0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00fe, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f8, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fb,
+	0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fd, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00fb, 0x00fe, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00fe, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe,
+	0x00fd, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00fa, 0x00ff, 0x00fe, 0x00ff, 0x00fe, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00d9, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00e1, 0x00fc, 0x00f1, 0x00fd, 0x00ff,
+	0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ea, 0x00fa,
+	0x00f1, 0x00fa, 0x00fd, 0x00ff, 0x00fd, 0x00fe, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00df, 0x00fe, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ee,
+	0x00fd, 0x00fe, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00f8, 0x00fe, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f9, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fd, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f7, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fd, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fc,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe,
+	0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00fa, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ba, 0x00fb, 0x00fa, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ea, 0x00fb, 0x00f4, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fb, 0x00fb,
+	0x00f3, 0x00fd, 0x00fe, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00fd, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ec, 0x00fd, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fb,
+	0x00fd, 0x00fd, 0x00fe, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00fe, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00fe, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00f8, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00fa, 0x00fe, 0x00fc, 0x00fe, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f8, 0x00fe,
+	0x00f9, 0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00fd, 0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f6, 0x00fd, 0x00fd, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fc,
+	0x00fe, 0x00fb, 0x00fe, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00fc, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f8, 0x00fe, 0x00fd,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00fd, 0x00ff, 0x00fe, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fb, 0x00fe, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00f5, 0x00fb,
+	0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00fd, 0x00fd, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fb, 0x00fd, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fc,
+	0x00fd, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fc, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00f9, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00fd, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00fa, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00fe, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff, 0x00ff,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x00ed, 0x00f6, 0x00fd, 0x00fd, 0x00fe, 0x00fe, 0x00fe, 0x00fe,
+	0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fa, 0x00fa,
+	0x00fc, 0x00fe, 0x00fe, 0x00e7, 0x00f3, 0x00f5, 0x00fd, 0x00fe,
+	0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fe, 0x00fe,
+	0x00fe, 0x00fb, 0x00fb, 0x00fe, 0x00fe, 0x00fe, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0080, 0x0000, 0x0000, 0x0000, 0x0070, 0x0010, 0x0000,
+	0x0000, 0x0060, 0x0020, 0x0000, 0x0000, 0x0050, 0x0030, 0x0000,
+	0x0000, 0x0040, 0x0040, 0x0000, 0x0000, 0x0030, 0x0050, 0x0000,
+	0x0000, 0x0020, 0x0060, 0x0000, 0x0000, 0x0010, 0x0070, 0x0000,
+	0x0000, 0x0080, 0x0000, 0x0000, 0x0006, 0x007b, 0x000c, 0x0004,
+	0x008b, 0x006c, 0x0024, 0x0021, 0x0009, 0x005d, 0x0032, 0x0018,
+	0x00d0, 0x004d, 0x004d, 0x0043, 0x0006, 0x0032, 0x005d, 0x0024,
+	0x0048, 0x0024, 0x006c, 0x002e, 0x0001, 0x000c, 0x007b, 0x0018,
+	0x0004, 0x0005, 0x0006, 0x0007, 0x0008, 0x0009, 0x000a, 0x000a,
+	0x000b, 0x000c, 0x000d, 0x000e, 0x000f, 0x0010, 0x0011, 0x0011,
+	0x0012, 0x0013, 0x0014, 0x0014, 0x0015, 0x0015, 0x0016, 0x0016,
+	0x0017, 0x0017, 0x0018, 0x0019, 0x0019, 0x001a, 0x001b, 0x001c,
+	0x001d, 0x001e, 0x001f, 0x0020, 0x0021, 0x0022, 0x0023, 0x0024,
+	0x0025, 0x0025, 0x0026, 0x0027, 0x0028, 0x0029, 0x002a, 0x002b,
+	0x002c, 0x002d, 0x002e, 0x002e, 0x002f, 0x0030, 0x0031, 0x0032,
+	0x0033, 0x0034, 0x0035, 0x0036, 0x0037, 0x0038, 0x0039, 0x003a,
+	0x003b, 0x003c, 0x003d, 0x003e, 0x003f, 0x0040, 0x0041, 0x0042,
+	0x0043, 0x0044, 0x0045, 0x0046, 0x0047, 0x0048, 0x0049, 0x004a,
+	0x004b, 0x004c, 0x004c, 0x004d, 0x004e, 0x004f, 0x0050, 0x0051,
+	0x0052, 0x0053, 0x0054, 0x0055, 0x0056, 0x0057, 0x0058, 0x0059,
+	0x005b, 0x005d, 0x005f, 0x0060, 0x0062, 0x0064, 0x0065, 0x0066,
+	0x0068, 0x006a, 0x006c, 0x006e, 0x0070, 0x0072, 0x0074, 0x0076,
+	0x007a, 0x007c, 0x007e, 0x0080, 0x0082, 0x0084, 0x0086, 0x0088,
+	0x008a, 0x008c, 0x008f, 0x0091, 0x0094, 0x0097, 0x009a, 0x009d,
+	0x0004, 0x0005, 0x0006, 0x0007, 0x0008, 0x0009, 0x000a, 0x000b,
+	0x000c, 0x000d, 0x000e, 0x000f, 0x0010, 0x0011, 0x0012, 0x0013,
+	0x0014, 0x0015, 0x0016, 0x0017, 0x0018, 0x0019, 0x001a, 0x001b,
+	0x001c, 0x001d, 0x001e, 0x001f, 0x0020, 0x0021, 0x0022, 0x0023,
+	0x0024, 0x0025, 0x0026, 0x0027, 0x0028, 0x0029, 0x002a, 0x002b,
+	0x002c, 0x002d, 0x002e, 0x002f, 0x0030, 0x0031, 0x0032, 0x0033,
+	0x0034, 0x0035, 0x0036, 0x0037, 0x0038, 0x0039, 0x003a, 0x003c,
+	0x003e, 0x0040, 0x0042, 0x0044, 0x0046, 0x0048, 0x004a, 0x004c,
+	0x004e, 0x0050, 0x0052, 0x0054, 0x0056, 0x0058, 0x005a, 0x005c,
+	0x005e, 0x0060, 0x0062, 0x0064, 0x0066, 0x0068, 0x006a, 0x006c,
+	0x006e, 0x0070, 0x0072, 0x0074, 0x0077, 0x007a, 0x007d, 0x0080,
+	0x0083, 0x0086, 0x0089, 0x008c, 0x008f, 0x0092, 0x0095, 0x0098,
+	0x009b, 0x009e, 0x00a1, 0x00a4, 0x00a7, 0x00aa, 0x00ad, 0x00b1,
+	0x00b5, 0x00b9, 0x00bd, 0x00c1, 0x00c5, 0x00c9, 0x00cd, 0x00d1,
+	0x00d5, 0x00d9, 0x00dd, 0x00e1, 0x00e5, 0x00ea, 0x00ef, 0x00f5,
+	0x00f9, 0x00fe, 0x0103, 0x0108, 0x010d, 0x0112, 0x0117, 0x011c,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x02f9, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x0313, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x02f9, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x0213, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0319, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x031b, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01c5, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa220, 0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802,
+	0xa220, 0xe0c2, 0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2,
+	0x0077, 0xa2fa, 0xe0c2, 0x0071, 0xe42e, 0xe428, 0xa202, 0xe0c2,
+	0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28, 0xf7f8, 0xca48, 0xa802,
+	0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190, 0xf7e2, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8,
+	0xe004, 0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0,
+	0x000d, 0xf7e8, 0xe42e, 0xe41e, 0x0213, 0xd160, 0x0620, 0xe004,
+	0x0019, 0xae18, 0xcec0, 0xe42e, 0xe41e, 0x0228, 0xe000, 0x0040,
+	0xce50, 0xa200, 0xd022, 0x00ff, 0xe184, 0x020f, 0xce52, 0xe190,
+	0xe41e, 0x0230, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72,
+	0xcc8c, 0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a,
+	0xd16f, 0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e,
+	0xe004, 0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e,
+	0xe004, 0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e,
+	0xe41e, 0x028d, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a,
+	0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02c3, 0xe41e, 0x02f4, 0xae12,
+	0xe0c2, 0x041e, 0xe41e, 0x02e7, 0xe42e, 0xe41e, 0x02b1, 0xe42a,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0,
+	0x0215, 0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0,
+	0x0213, 0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0,
+	0x020b, 0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02c3, 0xe41e,
+	0x02f4, 0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1,
+	0x0204, 0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f,
+	0xe056, 0xe0c2, 0x041e, 0xe41e, 0x02e7, 0xe42e, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203,
+	0xae19, 0xe052, 0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a,
+	0xe0c0, 0x0060, 0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017,
+	0xe056, 0xf0ea, 0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1,
+	0x0044, 0xaf17, 0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e,
+	0x028d, 0xf088, 0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4,
+	0xc785, 0xe018, 0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a,
+	0xa202, 0xe0c2, 0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xe0c0, 0x041b,
+	0xaf20, 0xa01e, 0xaf08, 0xae28, 0xe0c1, 0x041b, 0xe009, 0xffff,
+	0xa01f, 0xaf09, 0xae09, 0xe056, 0xe0c2, 0x041d, 0xe42e, 0xe0c0,
+	0x041c, 0xe00a, 0x0200, 0xe0c2, 0x041c, 0xe0c0, 0x041c, 0xe00c,
+	0x0200, 0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802,
+	0xe42e, 0xe40e, 0x1126, 0xe40e, 0x031d, 0xe40e, 0x0321, 0xe40e,
+	0x0325, 0xe40e, 0x032d, 0xe40e, 0x0331, 0xe40e, 0x0335, 0xe40e,
+	0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0339, 0xe40e, 0x00a4, 0xe40e,
+	0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x1146, 0xe40e, 0x00a4, 0xe40e,
+	0x00a4, 0xe40e, 0x062b, 0xe40e, 0x0649, 0xe41e, 0x033d, 0xe40e,
+	0x00a4, 0xe41e, 0x036a, 0xe40e, 0x00a4, 0xe41e, 0x0234, 0xe41e,
+	0x0376, 0xe41e, 0x0286, 0xe40e, 0x00a4, 0xe41e, 0x03e6, 0xe40e,
+	0x00a4, 0xe41e, 0x0415, 0xe40e, 0x00a4, 0xe41e, 0x0476, 0xe40e,
+	0x00a4, 0xe41e, 0x105c, 0xe40e, 0x00a4, 0xa210, 0xe0c2, 0x0100,
+	0xa200, 0xe0c2, 0x0128, 0xd130, 0x0008, 0xe41e, 0x0148, 0xe41e,
+	0x0213, 0xe41e, 0x05dc, 0xa200, 0x3c2a, 0x3c33, 0xcc72, 0xcc44,
+	0x3ccb, 0x3ccc, 0xe41e, 0x04a9, 0xf12a, 0xe41e, 0x08ae, 0xe41e,
+	0x1106, 0xe41e, 0x1131, 0x2815, 0xe40a, 0x0360, 0xe418, 0x0d87,
+	0xe41e, 0x10b9, 0xa202, 0xe0c2, 0x0070, 0xe42e, 0xa200, 0xe0c2,
+	0x0070, 0xe42e, 0xd130, 0x0008, 0x28be, 0xe428, 0x28bf, 0xf06a,
+	0xa200, 0x3c4d, 0xe41e, 0x1127, 0xe42e, 0xe42e, 0xd130, 0x0008,
+	0xa200, 0xcc44, 0xcc4a, 0xcc4c, 0xcfce, 0xe0c2, 0x0074, 0x3c65,
+	0xe0c0, 0x0065, 0xaf06, 0x3066, 0xaf02, 0x3067, 0xaf02, 0x3068,
+	0xe41e, 0x061b, 0xe41e, 0x0d0b, 0xe41e, 0x0d36, 0x28bf, 0xf24a,
+	0xc872, 0x3c07, 0x28c0, 0xf09a, 0xe0c0, 0x0066, 0x344a, 0x3c4b,
+	0xe0c0, 0x0067, 0xae04, 0x3c4c, 0xa200, 0x3c4d, 0xe41e, 0x1127,
+	0xe41e, 0x0213, 0xa200, 0x3cdf, 0x3ce0, 0xe41e, 0x11ed, 0xe41e,
+	0x1209, 0xe41e, 0x1226, 0xe41e, 0x1160, 0xe41e, 0x124a, 0xe41e,
+	0x1255, 0x2807, 0xcc72, 0xd130, 0x0008, 0xd1e0, 0x0000, 0xd1ff,
+	0x03b0, 0xd199, 0x0224, 0xd03a, 0x0000, 0xd04b, 0x0001, 0xd04c,
+	0x0000, 0xd008, 0x0000, 0xe41e, 0x064f, 0x28bf, 0xf02a, 0xf03e,
+	0x28be, 0xf01a, 0x2c2a, 0xa002, 0x3c2a, 0x2c33, 0xa002, 0x3c33,
+	0xe0c2, 0x0070, 0x2829, 0xe0c2, 0x0071, 0x281f, 0xe0c2, 0x0073,
+	0xd039, 0x0000, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2, 0x0053,
+	0xe41e, 0x05f0, 0xa202, 0xe0c2, 0x0076, 0xe42e, 0xe41e, 0x0409,
+	0xe41e, 0x0174, 0xe0c0, 0x0042, 0xce20, 0xd111, 0x04c0, 0xd112,
+	0x00c0, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe0c0, 0x0060, 0x3c32,
+	0xe0c0, 0x0061, 0x3c70, 0xe004, 0x0580, 0xe096, 0xe0c0, 0x0062,
+	0x3513, 0x3d13, 0xe0c0, 0x0063, 0x3513, 0x3d13, 0xe41e, 0x0d0b,
+	0xe42e, 0xe167, 0x0488, 0xe166, 0x0064, 0xd022, 0x0003, 0xe184,
+	0x0413, 0x9e16, 0x3517, 0x3d17, 0xe42e, 0xd130, 0x0008, 0x28bf,
+	0xf24a, 0xc872, 0x3c07, 0x28c0, 0xf09a, 0xe0c0, 0x0061, 0x344a,
+	0x3c4b, 0xe0c0, 0x0062, 0xae04, 0x3c4c, 0xa200, 0x3c4d, 0xe41e,
+	0x1127, 0xe41e, 0x0213, 0xa200, 0x3cdf, 0x3ce0, 0xe41e, 0x11ed,
+	0xe41e, 0x1209, 0xe41e, 0x1226, 0xe41e, 0x1160, 0xe41e, 0x124a,
+	0xe41e, 0x1255, 0x2807, 0xcc72, 0xe0c0, 0x0060, 0xa80e, 0xf0da,
+	0xa102, 0xf1fa, 0xa102, 0xf20a, 0xa102, 0xf20a, 0xa102, 0xa102,
+	0xa202, 0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x0060, 0xaf06, 0xa802,
+	0x3073, 0xf0ca, 0xe0c0, 0x0063, 0x3478, 0x3c79, 0xe0c1, 0x0064,
+	0x367a, 0x3e7b, 0xe056, 0xe01a, 0x3c73, 0xe41e, 0x05b9, 0xf0ee,
+	0xe41e, 0x05c4, 0xf0be, 0xa214, 0xf02e, 0xa216, 0x3c30, 0xa200,
+	0x3c2f, 0xe41e, 0x1267, 0xe41e, 0x1291, 0x28bf, 0xf02a, 0xf03e,
+	0x28be, 0xf01a, 0xa202, 0xe0c2, 0x0070, 0xe42e, 0xe41e, 0x1115,
+	0xa200, 0xce92, 0xe0c0, 0x0060, 0xa802, 0xf158, 0xe0c0, 0x0060,
+	0xaf04, 0xa802, 0x3073, 0xf0ca, 0xe0c0, 0x0063, 0x3478, 0x3c79,
+	0xe0c1, 0x0064, 0x367a, 0x3e7b, 0xe056, 0xe01a, 0x3c73, 0xe41e,
+	0x07ae, 0xf03e, 0xe41e, 0x0837, 0xc870, 0xaf06, 0x3c45, 0xe0c2,
+	0x0070, 0xe004, 0x0080, 0xcc6e, 0xbadf, 0xe0c0, 0x0042, 0xce20,
+	0xd111, 0x0000, 0xd112, 0x0100, 0xd113, 0x0012, 0xca28, 0xf7f8,
+	0xe42e, 0xe0c0, 0x0074, 0xa806, 0x3cc9, 0xe0c0, 0x0074, 0xaf04,
+	0x3cca, 0xe0c0, 0x0064, 0x3450, 0x3c51, 0x2850, 0xa01e, 0xaf08,
+	0x3c50, 0x2851, 0xa01e, 0xaf08, 0x3c51, 0xe0c0, 0x0065, 0x3418,
+	0x3c17, 0x2818, 0xa002, 0x3c18, 0x2c17, 0xc710, 0x7c18, 0xe008,
+	0xffff, 0xa002, 0xaf02, 0x3c88, 0xe0c0, 0x0062, 0xaf04, 0x301b,
+	0xaf06, 0x30b8, 0xe0c1, 0x0071, 0x3eb9, 0xaf02, 0x30c8, 0xaf02,
+	0x30c7, 0xaf04, 0xaf02, 0xe0c0, 0x0068, 0xe049, 0xa83f, 0xae3f,
+	0xaf3f, 0x3e24, 0xe049, 0xaf0b, 0x3226, 0xe049, 0xaf0d, 0xa807,
+	0x3e2c, 0xe049, 0xaf11, 0xa81f, 0xaf41, 0xae41, 0xae03, 0x3e2d,
+	0xe049, 0xaf19, 0xa81f, 0xaf41, 0xae41, 0xae03, 0x3e2e, 0x282c,
+	0x4c2d, 0x4c2e, 0xe01a, 0x3c25, 0xe0c0, 0x0069, 0x3038, 0xaf02,
+	0x3039, 0xaf02, 0x3c3a, 0xe0c0, 0x006a, 0x3c14, 0xe0c0, 0x006b,
+	0x3480, 0x3015, 0xaf02, 0xe008, 0x7fff, 0x3c7f, 0xf028, 0x3c15,
+	0x2880, 0xaf1e, 0x3091, 0x2880, 0xe008, 0x7fff, 0x3c80, 0xe0c0,
+	0x006c, 0x3481, 0x3c82, 0xe0c0, 0x006d, 0x3c1c, 0xa20a, 0x3c10,
+	0xa002, 0x3c12, 0xa202, 0x3c13, 0xa102, 0x3c22, 0xa200, 0x3c21,
+	0x3c20, 0x3c27, 0xa204, 0x3c11, 0xa234, 0x3c23, 0x8450, 0x8251,
+	0xe018, 0x3c52, 0xa201, 0xe002, 0x00c8, 0xb425, 0xe002, 0x0190,
+	0xb425, 0x3e36, 0xe0c0, 0x0075, 0xe166, 0x0600, 0x3516, 0x3d16,
+	0xe0c0, 0x0076, 0xe049, 0xa806, 0x3cd7, 0xe04a, 0xaf04, 0x30d9,
+	0xaf02, 0xa81e, 0x3cd8, 0x28d9, 0xe016, 0x3cd9, 0xae02, 0x4cd9,
+	0xae02, 0x4cd9, 0x3cd9, 0x28d8, 0xf028, 0xa21e, 0x3cd8, 0x2850,
+	0x2a51, 0xaf06, 0xaf07, 0x3c08, 0x3e09, 0x8408, 0x8209, 0xe018,
+	0x3cc1, 0xa104, 0xf032, 0xa204, 0x3cc1, 0x2851, 0xaf02, 0x3c08,
+	0x8408, 0x8250, 0xe018, 0x3cc3, 0x3cc6, 0xa202, 0x3c1e, 0xe0c0,
+	0x0043, 0xaf06, 0x30be, 0xaf02, 0x30bf, 0xaf02, 0x30c0, 0xaf02,
+	0x30ce, 0xa202, 0xe42e, 0xcb04, 0xaf20, 0xe000, 0x0490, 0xe09e,
+	0xc872, 0x3d07, 0xcb04, 0xaf20, 0xa002, 0x1850, 0xe428, 0xcb04,
+	0xe008, 0xffff, 0xae0e, 0xe005, 0x0000, 0xae11, 0xe042, 0xe0c1,
+	0x0042, 0xe042, 0xce20, 0xd111, 0x0490, 0xd112, 0x002e, 0xd113,
+	0x0002, 0xca28, 0xf7f8, 0xe42e, 0x204a, 0x4c4b, 0x2e4d, 0xae11,
+	0xe042, 0x0840, 0xe161, 0x0434, 0x3511, 0x3d11, 0x281f, 0xae04,
+	0xe005, 0x0012, 0xae11, 0xe042, 0xe0c1, 0x0042, 0xe042, 0xce20,
+	0xd111, 0x0434, 0xd112, 0x0004, 0xd113, 0x0002, 0xca28, 0xf7f8,
+	0xe42e, 0xa206, 0x3c2f, 0xa20e, 0x3c30, 0xe41e, 0x1267, 0xe41e,
+	0x07ae, 0xe41e, 0x1291, 0xe42e, 0xa206, 0x3c2f, 0xa210, 0x3c30,
+	0xe41e, 0x1267, 0xe41e, 0x0837, 0xe41e, 0x1291, 0xe42e, 0xa200,
+	0x3c2f, 0xa212, 0x3c30, 0xe41e, 0x1267, 0xa204, 0xba84, 0xe41e,
+	0x08a4, 0xe41e, 0x1291, 0xe42e, 0xe0c0, 0x0040, 0xe005, 0x0063,
+	0xae17, 0xe042, 0xe005, 0x1900, 0xae03, 0xe042, 0xce20, 0xd111,
+	0x0700, 0xd112, 0x0200, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0x2866, 0x4c67, 0x4c68, 0xe42a, 0xe167, 0x05f0, 0xc410, 0x2866,
+	0xae10, 0x3d17, 0x2852, 0x3d17, 0x8137, 0x2867, 0xae12, 0x2a31,
+	0xe017, 0xe056, 0x3d17, 0x2852, 0xae04, 0x3d17, 0x8137, 0x2868,
+	0xae14, 0x2a1f, 0xe056, 0x3d17, 0x281f, 0xae06, 0x3d17, 0xe0c0,
+	0x0068, 0xce20, 0xd111, 0x05f0, 0xd112, 0x000c, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x2866, 0x4c67, 0x4c68, 0xe42a, 0xe0c0,
+	0x0068, 0xce20, 0xd111, 0x05f0, 0xd112, 0x000c, 0xd113, 0x0003,
+	0xca28, 0xf7f8, 0xe42e, 0xa206, 0xe41e, 0x0153, 0xe0c0, 0x005a,
+	0xe008, 0xffff, 0x3cee, 0xe41e, 0x0213, 0xa200, 0x3cdf, 0x3ce0,
+	0xe41e, 0x11ed, 0xe41e, 0x1209, 0xe41e, 0x1226, 0xe41e, 0x13d7,
+	0xe41e, 0x1160, 0xe41e, 0x124a, 0xe41e, 0x1255, 0xe41e, 0x13df,
+	0xe42e, 0xe41e, 0x13c3, 0xa204, 0xe41e, 0x0153, 0xe42e, 0x2824,
+	0xa83e, 0xae06, 0xcf80, 0xe41e, 0x1291, 0xd1f3, 0x0000, 0x2835,
+	0xcfe4, 0xa200, 0xcfc2, 0xd1e8, 0x0055, 0x2850, 0xa102, 0xae02,
+	0x4c26, 0xae06, 0xcf00, 0xd1d3, 0x000d, 0xd185, 0x0001, 0xe41e,
+	0x108f, 0xe41e, 0x1094, 0x281b, 0xe418, 0x05cf, 0xe41e, 0x0693,
+	0x283d, 0x3c2b, 0xe41e, 0x10be, 0x2829, 0xf05a, 0x281e, 0xa002,
+	0xa802, 0x3c1e, 0xe41e, 0x08e6, 0xe41e, 0x0cd8, 0xe41e, 0x07a8,
+	0xa200, 0x3c53, 0x3c1f, 0xe41e, 0x06d0, 0x2865, 0xaa02, 0x3c65,
+	0x2853, 0x1852, 0xf794, 0xe41e, 0x0cf4, 0xe41e, 0x0af0, 0x2815,
+	0xe418, 0x0d90, 0xe42e, 0xe0c0, 0x0065, 0xa804, 0xf06a, 0xa200,
+	0x3c2a, 0x3cb6, 0xe016, 0x3c89, 0x2814, 0xf048, 0x2c2a, 0xf07a,
+	0xf0ae, 0x28b6, 0xf04a, 0x2a14, 0xe046, 0xf058, 0x3c29, 0xa202,
+	0x3cb6, 0xf05e, 0xa202, 0x3c29, 0x08b6, 0x3cb6, 0xa200, 0x3c72,
+	0xe0c0, 0x0065, 0xa802, 0xe418, 0x06c9, 0xe0c0, 0x0063, 0xa408,
+	0x3c3d, 0x2815, 0xf09a, 0x2829, 0xe41a, 0x0d8a, 0xe41e, 0x0d8d,
+	0x3c3d, 0xe419, 0x06c9, 0x2c2a, 0xe016, 0x3c31, 0xa004, 0x3c2f,
+	0xe42e, 0xa202, 0x3c29, 0x3c72, 0x2835, 0xe0c2, 0x0060, 0xe42e,
+	0x2a31, 0xa20a, 0xb636, 0x3c30, 0xe41e, 0x1267, 0xe41e, 0x0860,
+	0xa202, 0x3ccb, 0xe41e, 0x0703, 0xe41e, 0x08a4, 0xe41e, 0x1291,
+	0x2868, 0xe418, 0x06e7, 0x281f, 0xa002, 0x3c1f, 0xe42e, 0xe167,
+	0x05ec, 0xa200, 0x3d17, 0x2853, 0xa102, 0x3d17, 0xcaaa, 0xae06,
+	0x3517, 0x3d17, 0x281f, 0xae06, 0xe167, 0x05fa, 0x2317, 0x4f17,
+	0xe042, 0xce20, 0xd111, 0x05ec, 0xd112, 0x0004, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x282b, 0xcf96, 0x282c, 0xae0a, 0x2a2d,
+	0xa83f, 0xe056, 0xae0a, 0x2a2e, 0xa83f, 0xe056, 0xcf30, 0x2829,
+	0xcfc4, 0xcf82, 0xd188, 0x0001, 0xa200, 0xcf86, 0x3c3b, 0xa202,
+	0x3c3c, 0xe41e, 0x0739, 0xe41e, 0x07ab, 0x8a5e, 0x0039, 0xe41e,
+	0x0780, 0xc872, 0x1c5e, 0xe008, 0xffff, 0x3c5f, 0x2a15, 0xcb96,
+	0xe419, 0x0d96, 0x2853, 0x1852, 0xf042, 0x283b, 0xe40a, 0x0719,
+	0xcb86, 0xf02a, 0xbbfc, 0x2a15, 0xcb96, 0xf02b, 0x3c2b, 0xa202,
+	0xe42e, 0x2838, 0x2a39, 0xe42a, 0xf0a9, 0x28dc, 0xe42a, 0xa102,
+	0x3cdc, 0xa102, 0xe428, 0xa202, 0x3c3b, 0xe42e, 0x283c, 0x183a,
+	0x2a3c, 0xa003, 0x3e3c, 0xe428, 0xa202, 0x3c3c, 0x3c3b, 0xe42e,
+	0x2a38, 0x2839, 0xe42b, 0xa201, 0xf0a8, 0x28dc, 0xe428, 0xc870,
+	0x1c3a, 0xe424, 0xa209, 0x3ed1, 0x3edc, 0xe42e, 0x28d0, 0xa002,
+	0x3cd0, 0xa102, 0x183a, 0xe428, 0xa203, 0x3ed1, 0x3ed0, 0xe42e,
+	0xa200, 0x3cd1, 0x3cdc, 0xa202, 0x3cd0, 0xe42e, 0xcb1c, 0xf7f8,
+	0xd185, 0x0002, 0xd186, 0x0000, 0x2855, 0xae02, 0x4c54, 0xcf8a,
+	0x2859, 0xcf94, 0xa200, 0xcfdc, 0xcf84, 0x2858, 0xcfd2, 0xe42e,
+	0x2876, 0xf05a, 0xe41e, 0x0b5a, 0xe41e, 0x0b33, 0xcba0, 0xf7f8,
+	0x2854, 0xf0ba, 0xcb18, 0x3c00, 0x2855, 0xf04a, 0x2856, 0xae38,
+	0xcf8c, 0x2857, 0xcf90, 0xf03e, 0xcbd2, 0xcf9a, 0xd1d0, 0x003f,
+	0xa202, 0x3c76, 0xe41e, 0x0a51, 0x2a66, 0xcba0, 0xf7f8, 0xe419,
+	0x0c8d, 0xd186, 0x0001, 0xd185, 0x0004, 0xcb06, 0x3c53, 0xe42e,
+	0xe41e, 0x0a0e, 0xe42e, 0xe41e, 0x0a46, 0xe42e, 0xe004, 0x0042,
+	0xba8e, 0xbac0, 0xbae0, 0xbac0, 0xbac4, 0x8452, 0x8288, 0xe019,
+	0x2852, 0xe002, 0x0063, 0xf070, 0xe04a, 0xe002, 0x05cd, 0xf030,
+	0xa214, 0xf37e, 0x2852, 0xe002, 0x018c, 0xf070, 0xe04a, 0xe002,
+	0x2e68, 0xf030, 0xa228, 0xf2de, 0x2852, 0xe002, 0x0654, 0xf070,
+	0xe04a, 0xe002, 0x9e34, 0xf030, 0xa23c, 0xf23e, 0x2852, 0xe002,
+	0x0e10, 0xf080, 0xe004, 0x0d2f, 0xae0a, 0xe046, 0xf034, 0xa23e,
+	0xf18e, 0x2852, 0xe002, 0x1400, 0xf080, 0xe004, 0x0d2f, 0xae0c,
+	0xe046, 0xf034, 0xa240, 0xf0de, 0x2852, 0xe002, 0x2000, 0xf080,
+	0xe004, 0x03c0, 0xae10, 0xe046, 0xf034, 0xa250, 0xf02e, 0xa254,
+	0xe0c1, 0x0060, 0xaf09, 0xa803, 0xf06b, 0xe0c0, 0x0060, 0xaf10,
+	0xe008, 0x00ff, 0xba8e, 0xa200, 0xbbfc, 0x2810, 0xa108, 0xbbfc,
+	0x2811, 0xbbfc, 0x2811, 0xf048, 0x2812, 0xa108, 0xbbfc, 0x2813,
+	0xbbfc, 0xe190, 0xbac0, 0x2850, 0xa102, 0xbbfc, 0x2851, 0xa102,
+	0xbbfc, 0xe190, 0xbae0, 0xe190, 0xbae0, 0x2873, 0xf038, 0xbac0,
+	0xf0fe, 0xbae0, 0x2878, 0xaf02, 0xbbfc, 0x2879, 0xaf02, 0xbbfc,
+	0x287a, 0xaf02, 0xbbfc, 0x287b, 0xaf02, 0xbbfc, 0xe190, 0xbac0,
+	0xe41e, 0x08a4, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e, 0xa200,
+	0xbbfc, 0xa200, 0xbbfc, 0xbac0, 0x2820, 0xba80, 0x2821, 0xbbfc,
+	0xe408, 0x085d, 0x2822, 0xbbfc, 0xa200, 0xe190, 0xbbfc, 0xe190,
+	0xbac0, 0xe190, 0xbac1, 0xe190, 0x2823, 0xa134, 0xbbfe, 0xa200,
+	0xbbfe, 0x2824, 0xbbfe, 0x2825, 0xba80, 0x2826, 0xba80, 0x2827,
+	0xba80, 0xe41e, 0x08a4, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0x2853, 0xbbfc, 0x2829, 0xe016, 0xae02, 0xa00a, 0xbbfc, 0xa200,
+	0xbbfc, 0x2c2a, 0x7010, 0x2831, 0xf03a, 0xa200, 0xbbfc, 0x2811,
+	0xf098, 0x2c33, 0xae02, 0x7012, 0x2820, 0xe40a, 0x0879, 0xa200,
+	0xbbfe, 0x2827, 0xe40a, 0x087e, 0xa200, 0xbbfc, 0x2829, 0xf04a,
+	0xbac0, 0xe190, 0xbac0, 0x282f, 0xe40a, 0x088f, 0x2831, 0xe40a,
+	0x088e, 0xbac0, 0xe190, 0xbac0, 0xe40e, 0x088f, 0xbac0, 0x282b,
+	0x1823, 0xbbfe, 0x2825, 0xe40a, 0x08a0, 0x282c, 0xbbfc, 0xa102,
+	0xe40a, 0x08a0, 0x282d, 0xaf02, 0xbbfe, 0x282e, 0xaf02, 0xbbfe,
+	0xa202, 0xe42e, 0xa200, 0xe42e, 0xbae0, 0xc868, 0xa80e, 0xe42a,
+	0xa110, 0xe012, 0x3c48, 0xa200, 0x7048, 0xe42e, 0xa200, 0x3c34,
+	0xe004, 0x0190, 0x3c75, 0xe0c0, 0x0414, 0xe428, 0xa200, 0xe0c2,
+	0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xa201, 0xae09, 0xa907, 0xae09,
+	0xa907, 0xae09, 0xa907, 0xae09, 0xa901, 0xae09, 0xa907, 0xae09,
+	0xa905, 0xae09, 0xa905, 0xe0c3, 0x0152, 0xa241, 0xae11, 0xa911,
+	0xae11, 0xa911, 0xe0c3, 0x0153, 0xa201, 0xae21, 0xa902, 0xae02,
+	0xa902, 0xae04, 0xa900, 0x3cde, 0xe056, 0xe0c2, 0x015c, 0xa202,
+	0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xe42e, 0xe41e, 0x0c23,
+	0xa210, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x0128, 0x2a29, 0xe004,
+	0x016f, 0xf039, 0xe004, 0x0168, 0xe0c2, 0x017c, 0xa200, 0xe0c2,
+	0x017d, 0xe0c2, 0x013d, 0xe0c0, 0x0050, 0xe049, 0xe008, 0x007f,
+	0x3c00, 0xaf11, 0xe009, 0x007f, 0x3e01, 0x4600, 0x3e00, 0xa200,
+	0x2a00, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2a00, 0xa805, 0xf02b,
+	0xa912, 0x2a00, 0xa809, 0xf02b, 0xa940, 0x2a00, 0xa811, 0xf02b,
+	0xa980, 0xe0c2, 0x040c, 0xe0c1, 0x0046, 0xe004, 0x0000, 0xae10,
+	0xe042, 0x2a01, 0xa803, 0xf05b, 0xe161, 0x0488, 0x2111, 0x4d11,
+	0xcf0e, 0xe0c1, 0x0046, 0xe004, 0x0040, 0xae10, 0xe042, 0x2a01,
+	0xa805, 0xf05b, 0xe161, 0x048a, 0x2111, 0x4d11, 0xe0c2, 0x0103,
+	0xa200, 0xe0c2, 0x0208, 0xa200, 0xe0c2, 0x021c, 0xa202, 0xe0c2,
+	0x0210, 0xa200, 0xe0c2, 0x0215, 0xe41e, 0x0cff, 0xa203, 0xae09,
+	0xa901, 0xae09, 0xe056, 0xe0c2, 0x0213, 0xe0c1, 0x0046, 0xe004,
+	0x0070, 0xae10, 0xe042, 0x2a01, 0xa809, 0xf05b, 0xe161, 0x048c,
+	0x2111, 0x4d11, 0xe0c2, 0x0211, 0xe0c1, 0x0046, 0xe004, 0x0070,
+	0xe000, 0x0040, 0xae10, 0xe042, 0x2a01, 0xa811, 0xf05b, 0xe161,
+	0x048e, 0x2111, 0x4d11, 0xe0c2, 0x0212, 0xe0c0, 0x0064, 0x3c71,
+	0x2a72, 0xf02b, 0xa200, 0xe0c2, 0x0138, 0x2050, 0x4c51, 0xae08,
+	0xe0c2, 0x0101, 0xe0c2, 0x0205, 0x2a72, 0xaa03, 0x4671, 0xa803,
+	0xf04b, 0x2051, 0x4c50, 0xae08, 0xe0c2, 0x0142, 0xa200, 0xe41e,
+	0x0cff, 0xe0c2, 0x0102, 0x2829, 0xae06, 0xe0c2, 0x0104, 0xa210,
+	0xae08, 0x4c29, 0xae06, 0xe0c2, 0x0204, 0xe0c0, 0x0060, 0xa87e,
+	0xe0c2, 0x0143, 0xe0c0, 0x0069, 0xe0c2, 0x014f, 0xe004, 0x0580,
+	0xe096, 0x2113, 0x4d13, 0xe0c2, 0x021d, 0x2834, 0xe0c2, 0x020b,
+	0xe0c2, 0x0214, 0xa200, 0xe0c2, 0x0312, 0xa202, 0xe0c2, 0x0302,
+	0x2835, 0xe0c2, 0x0380, 0xe0c2, 0x018d, 0x3cdd, 0xa200, 0xe0c2,
+	0x0302, 0x2834, 0xe0c2, 0x0072, 0x3c35, 0xa002, 0x3c34, 0x1832,
+	0xf028, 0x3c34, 0xa200, 0xe0c2, 0x0113, 0xe0c2, 0x030d, 0xe0c2,
+	0x0320, 0xe0c2, 0x030a, 0xe0c2, 0x030b, 0xe004, 0x0055, 0xe0c2,
+	0x030c, 0xe004, 0x003f, 0xe0c2, 0x012a, 0xe166, 0x0600, 0x2116,
+	0x4d16, 0xe0c2, 0x011f, 0x2826, 0xe0c2, 0x0179, 0xe41e, 0x0bb0,
+	0xe004, 0x0582, 0xe096, 0x2313, 0x4f13, 0xe004, 0x0580, 0xe096,
+	0x2113, 0x4d13, 0x3513, 0x3d13, 0xe004, 0x0580, 0xe096, 0x3713,
+	0x3f13, 0xe41e, 0x0cbb, 0xe41e, 0x0ccd, 0xa202, 0xe0c2, 0x0106,
+	0xe0c2, 0x0139, 0xe41e, 0x024d, 0xa204, 0x2a3d, 0xa115, 0xb60a,
+	0x3cd5, 0x2a72, 0xa200, 0xf02b, 0xa208, 0xe0c2, 0x0140, 0x3cd6,
+	0x2a50, 0xa10f, 0xa200, 0xb62e, 0x3cd4, 0xe42e, 0xa2f0, 0x3c53,
+	0xe0c2, 0x003f, 0xe41e, 0x0c44, 0xe41e, 0x0768, 0xa200, 0x3c76,
+	0xa2f2, 0x3c53, 0x2853, 0xe0c2, 0x003f, 0xa00a, 0xf078, 0xe41e,
+	0x0c48, 0xa202, 0xe0c2, 0x021e, 0xf17e, 0xa102, 0xf0a8, 0xe41e,
+	0x0b99, 0xe41e, 0x0c48, 0xe41e, 0x0b92, 0xe41e, 0x0b88, 0xf0ce,
+	0xf094, 0x2839, 0xf048, 0xe41e, 0x0a51, 0xf0ae, 0xe41e, 0x0a49,
+	0xf07e, 0xe41e, 0x0c48, 0xe41e, 0x0c4c, 0xe41e, 0x0c44, 0xa200,
+	0x3ccc, 0x2853, 0xa002, 0x3c53, 0xf564, 0xe42e, 0x2853, 0xe0c2,
+	0x003f, 0xe41e, 0x0750, 0xe419, 0x1094, 0xe41e, 0x0b99, 0x2876,
+	0xf0c8, 0x2863, 0xa002, 0x3c63, 0x1850, 0xf028, 0x3c63, 0x2864,
+	0xe0c2, 0x0120, 0x2876, 0xe428, 0x2853, 0xf104, 0xa106, 0xa80e,
+	0xae06, 0x3cdb, 0xe41e, 0x0b78, 0x2a67, 0xe41e, 0x0b49, 0xe419,
+	0x0c50, 0xe41e, 0x076e, 0xd1f0, 0x000d, 0x2ad4, 0x2853, 0xa80e,
+	0xae06, 0x3cda, 0xf05b, 0x2863, 0xe016, 0x4cd1, 0x3cd1, 0x2a72,
+	0xe0c0, 0x011c, 0xf7ea, 0xf07b, 0xa200, 0x3c00, 0x3c01, 0xe0c2,
+	0x0114, 0xf10e, 0xe0c0, 0x011e, 0x3000, 0x44d5, 0x3c01, 0x4c00,
+	0xe0c2, 0x0114, 0xf07a, 0xe0c0, 0x0170, 0x3c02, 0xe0c0, 0x0174,
+	0x3c03, 0x2ad1, 0xe0c0, 0x0141, 0x3c64, 0xf09b, 0xe41e, 0x0b92,
+	0xa200, 0x3cd1, 0xa203, 0x4ed6, 0xe0c3, 0x0140, 0xe41e, 0x109d,
+	0x2a29, 0xf17b, 0xe0c0, 0x018f, 0x3c04, 0xe0c2, 0x0309, 0x28da,
+	0xe000, 0x02c0, 0xe092, 0xe162, 0x0190, 0xe163, 0x03b0, 0xc420,
+	0xd022, 0x0003, 0xe184, 0x0ab7, 0x9e12, 0x3511, 0x3d11, 0x9f33,
+	0x2a00, 0xe0c0, 0x0111, 0xf7e8, 0x2853, 0xe0c3, 0x0188, 0xf064,
+	0xa210, 0xe0c2, 0x0134, 0xd1d0, 0x0080, 0x2a29, 0x2864, 0xe0c2,
+	0x0119, 0x28d2, 0xe0c2, 0x011a, 0x2862, 0xe0c2, 0x011b, 0xa202,
+	0xe0c2, 0x0110, 0x2a76, 0xf1c9, 0x2115, 0x4d15, 0xcf8c, 0x2115,
+	0x4d15, 0xcf8e, 0x28da, 0xe000, 0x0280, 0xe092, 0x2801, 0x4c00,
+	0x3d11, 0x2802, 0xae10, 0x4c03, 0x3d11, 0x2804, 0x3d11, 0xe0c0,
+	0x0121, 0x3511, 0x3d11, 0xe0c0, 0x0122, 0x3511, 0x3d11, 0xe42e,
+	0xe41e, 0x0c48, 0x2866, 0xf10a, 0x2a52, 0xa80f, 0xf0db, 0xe167,
+	0x05f2, 0x2117, 0x4d17, 0x2a52, 0xa00f, 0xaf07, 0xae07, 0xa103,
+	0xe042, 0xe41e, 0x0cb1, 0x2867, 0xf0ba, 0x2852, 0xa806, 0xa106,
+	0x2a52, 0xa007, 0xaf05, 0xae05, 0xa103, 0xe418, 0x0c7b, 0x2852,
+	0xe0c2, 0x003f, 0xe41e, 0x0c44, 0xe41e, 0x0c48, 0xe190, 0xe0c0,
+	0x0118, 0xa802, 0xf78a, 0xe42e, 0xe0c0, 0x011c, 0xf7ea, 0xe0c0,
+	0x011e, 0xe0c2, 0x0114, 0x3000, 0xa804, 0x3c01, 0x2800, 0xe0c2,
+	0x0188, 0xf09a, 0xe0c0, 0x0170, 0x3c02, 0xe0c0, 0x0174, 0x3c03,
+	0xe0c2, 0x0123, 0xe42e, 0x28da, 0xe000, 0x0280, 0xe092, 0x2801,
+	0x4c00, 0x3d11, 0x2802, 0xae10, 0x4c03, 0x3d11, 0x2804, 0x3d11,
+	0xe0c0, 0x0121, 0x3511, 0x3d11, 0xe0c0, 0x0122, 0x3511, 0x3d11,
+	0xe42e, 0x28db, 0xe000, 0x0280, 0xe09a, 0x2915, 0x3054, 0xaf02,
+	0x3055, 0x2905, 0xaf10, 0x3c56, 0x2915, 0xa81e, 0x3c57, 0x2915,
+	0x3c58, 0xe42e, 0x2115, 0x4d15, 0xcf8c, 0x2115, 0x4d15, 0xcf8e,
+	0xe42e, 0xe0c0, 0x018f, 0x3c04, 0xe0c2, 0x0309, 0x28da, 0xe000,
+	0x02c0, 0xe092, 0xe162, 0x0190, 0xe163, 0x03b0, 0xc420, 0xd022,
+	0x0003, 0xe184, 0x0b76, 0x9e12, 0x3511, 0x3d11, 0x9f33, 0xe42e,
+	0x28db, 0xe000, 0x02c0, 0xe092, 0xe005, 0x0080, 0xd022, 0x0003,
+	0xe184, 0x0b86, 0xcfd5, 0xa011, 0x2111, 0x4d11, 0xcfd6, 0xe42e,
+	0x2864, 0xe0c2, 0x0119, 0x28d2, 0xe0c2, 0x011a, 0x2862, 0xe0c2,
+	0x011b, 0xe42e, 0xa200, 0x3c64, 0xe004, 0x2222, 0x3cd2, 0x3c62,
+	0xe42e, 0x2805, 0x3c59, 0x2a15, 0x4629, 0x282b, 0xe419, 0x0d93,
+	0x3c05, 0x2805, 0x0824, 0xa400, 0xa566, 0xe000, 0x07f0, 0xe09c,
+	0x2906, 0xae0c, 0x4d06, 0xae0c, 0x4c05, 0xe0c2, 0x0115, 0xe42e,
+	0x2829, 0xf09a, 0xe0c0, 0x0414, 0xe418, 0x018c, 0xe0c0, 0x0414,
+	0xe41a, 0x0bf8, 0x28d7, 0x2a50, 0xa113, 0xf071, 0x2a50, 0xa10d,
+	0xf037, 0xa402, 0xf02e, 0xa404, 0xe005, 0x0020, 0xe055, 0xe0c3,
+	0x0180, 0xe004, 0x0582, 0xe096, 0x2113, 0x4d13, 0xe0c2, 0x018c,
+	0x28d8, 0xe0c2, 0x018e, 0x28d9, 0xe0c2, 0x018a, 0xa201, 0x283d,
+	0xa11e, 0xa400, 0xa548, 0x3c03, 0xae04, 0xe000, 0x0740, 0xe09e,
+	0x2917, 0xe0c2, 0x0186, 0x2917, 0xe0c2, 0x0185, 0xe0c2, 0x0184,
+	0x2917, 0xe049, 0xae15, 0xe056, 0xae15, 0xe056, 0xe0c2, 0x0181,
+	0xe0c2, 0x0182, 0x2917, 0xae20, 0x4c75, 0xe0c2, 0x0183, 0xe42e,
+	0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xe167, 0x01a0,
+	0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17, 0xe009, 0x00ff, 0xae21,
+	0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101, 0xe0c3, 0x015d, 0x2add,
+	0xa53f, 0xa401, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10, 0xe008,
+	0x001b, 0xe056, 0xe0c2, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0,
+	0x0150, 0xf7ea, 0xe42e, 0xe004, 0x3211, 0xae20, 0xe00a, 0x2100,
+	0xe0c2, 0x0155, 0xe004, 0x9211, 0xae20, 0xe00a, 0x2100, 0xe0c2,
+	0x0158, 0xe004, 0x1000, 0xae20, 0xe00a, 0x0000, 0xe0c2, 0x0156,
+	0xe0c2, 0x0159, 0xe004, 0x0004, 0xe0c2, 0x0154, 0xe0c2, 0x0157,
+	0xa202, 0xe0c2, 0x015a, 0xe42e, 0xa202, 0xe0c2, 0x0110, 0xe42e,
+	0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xe0c0, 0x011c, 0xf7ea, 0xe42e,
+	0x2853, 0xa806, 0xae02, 0xe000, 0x05e0, 0xe09e, 0x28db, 0xe000,
+	0x0280, 0xe092, 0x2b11, 0xe01b, 0xae1f, 0xa200, 0xf0c9, 0x28db,
+	0xe000, 0x02c0, 0xe092, 0x2111, 0x4d11, 0xcfd6, 0xe049, 0xaf21,
+	0xe009, 0x7fff, 0x3f17, 0x3d17, 0x2853, 0xa806, 0xa106, 0x3c08,
+	0xe41a, 0x0c7b, 0x2808, 0xe42a, 0x2852, 0x1853, 0xa102, 0xe428,
+	0xe41e, 0x0c7b, 0xe42e, 0xe167, 0x05f6, 0x2117, 0x4d17, 0x2a53,
+	0xaf05, 0xae09, 0xe042, 0xce20, 0xd112, 0x0008, 0xd111, 0x05e0,
+	0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0x2853, 0xa80e, 0xaf02,
+	0xe000, 0x05e8, 0xe09e, 0xcb94, 0xe008, 0x003f, 0x2a65, 0xae0d,
+	0xe056, 0x2a53, 0xa803, 0xf049, 0xae10, 0x3d07, 0xf06e, 0x2b07,
+	0xe009, 0xff00, 0xe056, 0x3d07, 0x2853, 0xa80e, 0xa10e, 0xe41a,
+	0x0caa, 0xe42e, 0x2853, 0xa10e, 0xe167, 0x05f2, 0x2317, 0x4f17,
+	0xe042, 0xce20, 0xd111, 0x05e8, 0xd112, 0x0004, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x282b, 0xa118, 0xb608, 0xa54e, 0xe000,
+	0x0830, 0xe09c, 0x2906, 0xae04, 0xe0c2, 0x0176, 0xcca4, 0xc786,
+	0xe018, 0xa004, 0xe0c2, 0x0177, 0xe42e, 0x282b, 0xa11e, 0xa400,
+	0xa548, 0xe000, 0x0860, 0xe09c, 0x2906, 0xe0c2, 0x0189, 0xe42e,
+	0x2829, 0xe42a, 0xa202, 0x2a1c, 0xb616, 0xae02, 0x4c1e, 0xae20,
+	0x4c1c, 0xe0c2, 0x0108, 0x20c6, 0x4cc1, 0xe0c2, 0x0109, 0x2052,
+	0x4c1d, 0xe0c2, 0x010a, 0x20c2, 0x4cc3, 0xe0c2, 0x010b, 0x20c4,
+	0x4cc5, 0xe0c2, 0x010c, 0xe42e, 0x2829, 0xe42a, 0xe0c0, 0x010b,
+	0x34c2, 0x3cc3, 0xe0c0, 0x010c, 0x34c4, 0x3cc5, 0xe42e, 0xe0c1,
+	0x0044, 0xa80f, 0xe056, 0xe42e, 0xe0c1, 0x0044, 0xaf0d, 0xae03,
+	0xe056, 0xa87e, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1, 0x0420,
+	0xa803, 0xf7db, 0xe166, 0x04c0, 0xe167, 0x0500, 0x2832, 0xf1b6,
+	0xa102, 0xcc44, 0xe184, 0x0d31, 0xa200, 0xe41e, 0x0cff, 0xaf04,
+	0xe41e, 0x0d04, 0xae20, 0x4c70, 0x9f17, 0x2050, 0x4c51, 0xae08,
+	0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116,
+	0x4d16, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0xe0c0, 0x0044,
+	0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa83e, 0xa203, 0xe0c3,
+	0x040d, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500, 0xe09e, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x0cff, 0xaf04, 0xe0c1,
+	0x0061, 0xaf21, 0xa807, 0xa105, 0xf025, 0xe04a, 0xe41e, 0x0d04,
+	0xe0c1, 0x0044, 0xaf17, 0xa803, 0xe40b, 0x0d5f, 0xa81e, 0xae20,
+	0xe0c1, 0x0061, 0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0, 0x0064,
+	0xa802, 0xf048, 0x2050, 0x4c51, 0xf03e, 0x2051, 0x4c50, 0xae08,
+	0x9f17, 0xe0c0, 0x006a, 0x9f17, 0xe0c0, 0x006b, 0x9f17, 0xe0c0,
+	0x006c, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0xcca4, 0xc786,
+	0xe018, 0xe000, 0x04c0, 0xe09c, 0x2116, 0x4d06, 0xe42e, 0xe41e,
+	0x0d9f, 0xe42e, 0xe41e, 0x0e00, 0xe42e, 0xe41e, 0x0e01, 0xe42e,
+	0xe41e, 0x0e4b, 0xe42e, 0xe41e, 0x0e81, 0xe42e, 0xe41e, 0x0ee1,
+	0xe42e, 0xe41e, 0x0fd0, 0xe42e, 0xe41e, 0x102d, 0xe42e, 0xa254,
+	0x3ccd, 0xa268, 0x3c83, 0xa218, 0x3c85, 0xa266, 0x2ac8, 0xf03b,
+	0xe0c0, 0x0072, 0x3c84, 0xa210, 0x3c97, 0xe004, 0x07e0, 0x3c98,
+	0x2814, 0x2a52, 0x3c86, 0x3e8b, 0x2c17, 0xc710, 0x7c18, 0xe008,
+	0xffff, 0xa002, 0xaf02, 0x3c88, 0x3cbb, 0xe004, 0x6000, 0x2ac7,
+	0xf03b, 0xe0c0, 0x0073, 0x3c99, 0x2886, 0xe016, 0x3c87, 0xf06a,
+	0x2888, 0x3c86, 0xe004, 0x1000, 0x3c99, 0x8418, 0xe182, 0x7530,
+	0xe018, 0xae02, 0x2e17, 0xe41e, 0x0f7a, 0x3c9e, 0x849e, 0x827f,
+	0xe018, 0xa279, 0xe41e, 0x0f63, 0x349e, 0x3c9f, 0xae06, 0x2a83,
+	0xe41e, 0x0f63, 0x34a4, 0x3ca5, 0xa202, 0x3c89, 0xa205, 0x1a36,
+	0xae03, 0xa011, 0x3e8e, 0x2a8b, 0x5a8e, 0xe013, 0x36ae, 0x3eaf,
+	0x28b9, 0x2ab8, 0xf049, 0xe41e, 0x0f0a, 0x64cd, 0x3c8c, 0xa004,
+	0x6085, 0x6484, 0x3c8d, 0xa200, 0x3ce7, 0xe41e, 0x0f2e, 0xe42e,
+	0xe42e, 0x2829, 0x3c8a, 0xa201, 0x3e92, 0x3ecc, 0xe418, 0x0eec,
+	0xa200, 0x3c93, 0x3c94, 0x288a, 0xf238, 0x2889, 0xf05a, 0xa200,
+	0x3c89, 0x288c, 0xf37e, 0x2886, 0xa102, 0xf7ca, 0x2ab8, 0xf03b,
+	0x288c, 0xf30e, 0x848b, 0x82b5, 0xe019, 0xe04a, 0xaf02, 0x00a6,
+	0x0ca7, 0xe41e, 0x0f7a, 0xa21f, 0x3e8e, 0x2a86, 0xc70f, 0x7e8e,
+	0xe009, 0xffff, 0xa405, 0xe046, 0x6085, 0x64cd, 0xf1be, 0xa200,
+	0x3ca2, 0x3ca3, 0x2a92, 0xf08b, 0x288d, 0x2ae7, 0xf129, 0xa006,
+	0x2a84, 0xe066, 0xf0ee, 0x28c9, 0x308e, 0xaf02, 0x548e, 0xf08a,
+	0x288d, 0xa104, 0x6090, 0x2a8d, 0xa005, 0xe066, 0xf02e, 0x288d,
+	0x3c90, 0x2a92, 0xe42e, 0xc872, 0xe41e, 0x0f37, 0x288a, 0xf0ea,
+	0x2093, 0x4c94, 0xc710, 0x7c8b, 0xe008, 0xffff, 0xa002, 0xaf02,
+	0x3c8d, 0x2093, 0x4c94, 0x00a6, 0x0ca7, 0x34a6, 0x3ca7, 0x28b5,
+	0xa002, 0x3cb5, 0x288a, 0xf028, 0x3cb5, 0x288a, 0xf0f8, 0x2a86,
+	0xa103, 0x2095, 0x4c96, 0xe41e, 0x0f63, 0x34ac, 0x3cad, 0x1095,
+	0x1c96, 0xe012, 0x34aa, 0x3cab, 0xf0ae, 0x22aa, 0x4eab, 0x12ac,
+	0x1ead, 0x2887, 0xb606, 0xb611, 0x36aa, 0x3eab, 0x2892, 0x3ce7,
+	0xe42e, 0x28c9, 0xf08a, 0x2852, 0x1853, 0xa102, 0xf048, 0x2805,
+	0xe40e, 0x0ed6, 0x22a2, 0x4ea3, 0x20a4, 0x4ca5, 0xe041, 0xf0c7,
+	0xe045, 0xe045, 0x2890, 0xf0f5, 0x36a2, 0x3ea3, 0xa002, 0x6085,
+	0x6484, 0x3c90, 0xf08e, 0x36a2, 0x3ea3, 0x2890, 0xa102, 0x6085,
+	0x6484, 0x3c90, 0x2890, 0x6085, 0x6484, 0x3c90, 0x2ac9, 0x28cc,
+	0xa002, 0x3ccc, 0xf08b, 0xa103, 0xf22b, 0xa103, 0xf07b, 0xa103,
+	0xf0ab, 0xf24e, 0x2890, 0xe40e, 0x0ed6, 0x28cb, 0xf18a, 0xa200,
+	0x3ccb, 0xf06e, 0x28cc, 0x18ca, 0xf124, 0xa200, 0x3ccc, 0x2853,
+	0xa002, 0xf046, 0xcb97, 0xcb96, 0xf03e, 0x2a2b, 0x282b, 0xa105,
+	0x6290, 0xa004, 0xe066, 0x3c90, 0x3c8e, 0xf08e, 0xcb96, 0x3c8e,
+	0x2853, 0xa002, 0xf030, 0x282b, 0x3c8e, 0x288e, 0x2a3d, 0xe045,
+	0xf053, 0x2a3d, 0xa007, 0xe066, 0xe42e, 0x2a3d, 0xa107, 0xe062,
+	0xe42e, 0x0093, 0x0c94, 0x3493, 0x3c94, 0x285f, 0x189a, 0x00a2,
+	0x0ca3, 0x34a2, 0x3ca3, 0xe42e, 0x20aa, 0x4cab, 0x1095, 0x1c96,
+	0x8499, 0xe41e, 0x0fb1, 0x009e, 0x0c9f, 0xf052, 0x2a91, 0xf039,
+	0xa203, 0x3e92, 0xe41e, 0x0f49, 0x229e, 0x4e9f, 0xaf07, 0xe062,
+	0x34a0, 0x3ca1, 0xc710, 0x7c8b, 0xe008, 0xffff, 0xa002, 0xaf02,
+	0x3c9a, 0xe42e, 0x8486, 0x209e, 0x4c9f, 0xe41e, 0x0fa5, 0x8497,
+	0xe41e, 0x0fa5, 0x2a86, 0xa103, 0x0a97, 0xe41e, 0x0f63, 0x34a0,
+	0x3ca1, 0x288b, 0x3cb0, 0x20a0, 0x4ca1, 0xae04, 0x00a0, 0x0ca1,
+	0xae02, 0xc70f, 0x7cb0, 0xe008, 0xffff, 0xaf08, 0xa010, 0xaf08,
+	0x0836, 0xa51e, 0x0898, 0xe09e, 0x2907, 0xe42e, 0x847f, 0x8280,
+	0xe018, 0x34a8, 0x3ca9, 0xa200, 0x3495, 0x3c96, 0xe42e, 0x109e,
+	0x1c9f, 0x0095, 0x0c96, 0xa27f, 0xae31, 0xe066, 0x3495, 0x3c96,
+	0x22ae, 0x4eaf, 0xe046, 0xf032, 0x3695, 0x3e96, 0x2095, 0x2896,
+	0xe42e, 0x2a80, 0xe42b, 0x22a8, 0x4ea9, 0x1295, 0x1e96, 0xe066,
+	0xf051, 0x2a91, 0xf039, 0xa203, 0x3e92, 0x2281, 0x4e82, 0xe42b,
+	0x22a8, 0x4ea9, 0x1295, 0x1e96, 0x029e, 0x0e9f, 0x1281, 0x1e82,
+	0xa401, 0xe062, 0xe42e, 0x3eb0, 0xa201, 0xf032, 0xe012, 0xa203,
+	0x3eb4, 0x3cb1, 0xaf20, 0xc70f, 0x7cb0, 0x3cb2, 0xaf20, 0xae20,
+	0x4cb1, 0xc70f, 0x7cb0, 0x3cb3, 0x20b2, 0x4cb3, 0x2ab4, 0xe42b,
+	0xe012, 0xe42e, 0x36b0, 0x3eb1, 0xa201, 0x3eb2, 0x22b0, 0x4eb1,
+	0x5ab2, 0xe045, 0xf061, 0x2ab2, 0xa003, 0x3eb2, 0xa121, 0xf775,
+	0x2ab2, 0xf039, 0xa200, 0xe42e, 0xa103, 0x3eb2, 0xcc45, 0xa201,
+	0x3eb3, 0xe184, 0x0fa2, 0x2ab3, 0xae03, 0x3eb3, 0x22b0, 0x4eb1,
+	0x5ab2, 0xe045, 0xf061, 0xe013, 0xe04a, 0x2ab3, 0xa003, 0x3eb3,
+	0x2ab2, 0xa103, 0x3eb2, 0x28b3, 0xe42e, 0xae02, 0x34b1, 0xe008,
+	0xffff, 0xaf02, 0x3cb0, 0x82b1, 0xe018, 0xae1e, 0x82b0, 0xe01c,
+	0xe42e, 0xae02, 0x34b1, 0xe008, 0xffff, 0xaf02, 0x3cb0, 0x82b0,
+	0xe018, 0xaf1e, 0x82b1, 0xe01c, 0xe42e, 0xae02, 0x34b1, 0xe008,
+	0xffff, 0xaf02, 0x3cb0, 0x82b1, 0xe018, 0xa103, 0x3eb2, 0x58b2,
+	0x82b0, 0xa11f, 0xe013, 0x3eb2, 0xe019, 0x5eb2, 0xe042, 0xe42e,
+	0x34bd, 0x3cbc, 0x28bd, 0xa002, 0x3cbd, 0x2cbc, 0xc710, 0x7cbd,
+	0xe008, 0xffff, 0xa002, 0xaf02, 0x3c88, 0x18bb, 0xe42a, 0x2888,
+	0x3cbb, 0x28bc, 0x2abd, 0x3c17, 0x3e18, 0x8418, 0xe182, 0x7530,
+	0xe018, 0xae02, 0x2e17, 0xe41e, 0x0f7a, 0x3c9e, 0x849e, 0x827f,
+	0xe018, 0xa279, 0xe41e, 0x0f63, 0x349e, 0x3c9f, 0xae06, 0x2a83,
+	0xe41e, 0x0f63, 0x34a4, 0x3ca5, 0xa200, 0x3cb5, 0x34a6, 0x3ca7,
+	0x2886, 0xe428, 0xe016, 0x3c87, 0x2888, 0x3c86, 0xe42e, 0x3cb7,
+	0x2a86, 0xe046, 0xf028, 0xe42e, 0x28b6, 0x2ab7, 0xe046, 0xf034,
+	0xa200, 0x3cb6, 0x28b7, 0x3c86, 0x3c14, 0x2815, 0xe42a, 0x2886,
+	0xe016, 0x3c87, 0xf03a, 0x2a88, 0x3e86, 0x2a86, 0x28b6, 0xe045,
+	0xf0c6, 0x2095, 0x4c96, 0xe41e, 0x0f63, 0x34ac, 0x3cad, 0x1095,
+	0x1c96, 0xe012, 0x34aa, 0x3cab, 0xe42e, 0x3cba, 0x2815, 0xe42a,
+	0x287f, 0x2aba, 0xe046, 0xe42a, 0x3e7f, 0x8418, 0xe182, 0x7530,
+	0xe018, 0xae02, 0x2e17, 0xe41e, 0x0f7a, 0x3c9e, 0x849e, 0x827f,
+	0xe018, 0xa279, 0xe41e, 0x0f63, 0x349e, 0x3c9f, 0xae06, 0x2a83,
+	0xe41e, 0x0f63, 0x34a4, 0x3ca5, 0xa200, 0x3cb5, 0x34a6, 0x3ca7,
+	0xe42e, 0x2a15, 0xe42b, 0xf042, 0xa201, 0x3eb8, 0xe42e, 0x3cb9,
+	0x3c8c, 0xa203, 0x3eb8, 0xe42e, 0xe0c1, 0x0060, 0xa803, 0xf05b,
+	0xe0c0, 0x0061, 0xe41e, 0x1007, 0xe0c1, 0x0060, 0xa805, 0xf05b,
+	0xe0c0, 0x0062, 0xe41e, 0x1051, 0xe0c1, 0x0060, 0xa809, 0xf05b,
+	0xe0c0, 0x0063, 0xe41e, 0x0d9c, 0xe0c1, 0x0060, 0xa811, 0xf05b,
+	0xe0c0, 0x0064, 0xe41e, 0x0d99, 0xe0c1, 0x0060, 0xa821, 0xf04b,
+	0xe0c0, 0x0065, 0x3c1c, 0xe0c1, 0x0060, 0xa841, 0xf08b, 0xe0c0,
+	0x0066, 0x3038, 0xaf02, 0x3039, 0xaf02, 0x3c3a, 0xe42e, 0xa200,
+	0x3c63, 0x3cd3, 0x3c64, 0xe42e, 0xe161, 0x0200, 0xe004, 0x2222,
+	0xe188, 0x007f, 0x3d11, 0xe190, 0xe42e, 0xf149, 0x2a63, 0x28d3,
+	0xe000, 0x0200, 0xe09c, 0x2906, 0x3c62, 0xf089, 0xe004, 0x2222,
+	0x3cd2, 0xe0c0, 0x0173, 0x3506, 0xf05e, 0xe0c0, 0x0173, 0x3506,
+	0x3cd2, 0x28d3, 0xa002, 0x3cd3, 0xa002, 0x1850, 0xe428, 0x3cd3,
+	0xe42e, 0xa200, 0x3cc2, 0x3cc4, 0x3cc5, 0xe42e, 0xa200, 0x3c1d,
+	0xe42e, 0x281e, 0xf208, 0x281d, 0x181c, 0xf3f2, 0x2853, 0xa006,
+	0x18c2, 0xf3b4, 0x28c2, 0x08c1, 0x18c6, 0xf0b4, 0x28c4, 0xa002,
+	0xc70f, 0x7cc1, 0xaf20, 0x3cc4, 0x3cc2, 0x281c, 0x3c1d, 0xf2be,
+	0x281d, 0xa002, 0x3c1d, 0x28c2, 0x08c1, 0xc70f, 0x7cc6, 0xaf20,
+	0x3cc2, 0xf21e, 0x281d, 0x181c, 0xf202, 0x2853, 0xa006, 0x18c3,
+	0xf1c4, 0x28c3, 0x08c1, 0x1852, 0xf0c4, 0x28c5, 0xa002, 0xc70f,
+	0x7cc1, 0xaf20, 0x3cc5, 0x08c6, 0x3cc3, 0x281c, 0x3c1d, 0xf0be,
+	0x281d, 0xa002, 0x3c1d, 0x28c3, 0x08c1, 0xc70f, 0x7c52, 0xaf20,
+	0x3cc3, 0xf01e, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xa200, 0x3c4d,
+	0xe0c0, 0x0060, 0x344a, 0x3c4b, 0x347c, 0x3c7d, 0xe0c0, 0x0061,
+	0xae04, 0x3c4c, 0xe41e, 0x1127, 0xe42e, 0xd030, 0x0000, 0xd034,
+	0x0000, 0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037,
+	0x0080, 0xd038, 0x0000, 0xa200, 0x3c49, 0xe42e, 0xe470, 0x204a,
+	0x4c4b, 0x2e4d, 0xae11, 0xe042, 0xe0c2, 0x0049, 0x347c, 0x3c7d,
+	0xe42e, 0xd071, 0x242a, 0xe181, 0xa200, 0x34df, 0x3ce0, 0xe004,
+	0x0200, 0x3cf3, 0x3cf6, 0xe41e, 0x11ed, 0xe41e, 0x1209, 0xe41e,
+	0x1226, 0xe41e, 0x124a, 0xe41e, 0x1255, 0xe42e, 0xe41e, 0x1171,
+	0xe41e, 0x118d, 0xca48, 0xaf3c, 0xa802, 0xf05a, 0xa202, 0x3cf4,
+	0xae3c, 0xce48, 0xca48, 0xaf38, 0xa802, 0xf0aa, 0xe41e, 0x1160,
+	0xe41e, 0x124a, 0xa202, 0xae38, 0xce48, 0xe41e, 0x1255, 0xe470,
+	0x247c, 0x4c7d, 0x264a, 0x4e4b, 0xe046, 0x2e4c, 0xae11, 0xe045,
+	0xe425, 0x28f3, 0xe045, 0xf043, 0xe041, 0x3ef6, 0xe42e, 0x3cf6,
+	0xe42e, 0xca55, 0x28f6, 0xf048, 0xa200, 0xceaa, 0xf04e, 0x20df,
+	0x4ce0, 0xe045, 0x247c, 0x4c7d, 0xe042, 0x347c, 0x3c7d, 0x28f6,
+	0xe42a, 0x24df, 0x4ce0, 0xe042, 0x34df, 0x3ce0, 0x2af6, 0xe046,
+	0xe428, 0xa200, 0x34df, 0x3ce0, 0xe42e, 0xa200, 0x3c4f, 0x247c,
+	0x4c7d, 0x264a, 0x4e4b, 0xe046, 0xe049, 0xaf10, 0x3c4d, 0x2c4c,
+	0xae10, 0xe045, 0xf275, 0x28bf, 0xf1fa, 0xa202, 0xe0c2, 0x0074,
+	0x247c, 0x4c7d, 0xe0c2, 0x0049, 0x2ace, 0xf16b, 0xe0c0, 0x005c,
+	0xe008, 0x8000, 0xf11a, 0xe0c0, 0x005d, 0xe00a, 0x8000, 0xe0c2,
+	0x005d, 0xa202, 0xce00, 0xe0c1, 0x005d, 0xe009, 0x8000, 0xf7c9,
+	0xe0c0, 0x0004, 0xf798, 0xa200, 0x3c4d, 0x264a, 0x4e4b, 0x367c,
+	0x3e7d, 0x267c, 0x4e7d, 0xe0c3, 0x0049, 0x28bf, 0xe428, 0xd027,
+	0x0000, 0xe41e, 0x11ce, 0xd027, 0x0001, 0xe42e, 0xe0c0, 0x0048,
+	0xe0c1, 0x0049, 0xe046, 0xf040, 0x2e4c, 0xae11, 0xe042, 0xe005,
+	0x0200, 0xe046, 0xe420, 0x284f, 0xf728, 0xe0c0, 0x005c, 0xe008,
+	0x8000, 0xf6da, 0xe0c0, 0x005d, 0xe00a, 0x8000, 0xe0c2, 0x005d,
+	0xa202, 0xce00, 0x3c4f, 0xf63e, 0xe42e, 0xa220, 0xa20d, 0xe056,
+	0xa203, 0xe056, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd033, 0x0000,
+	0xd034, 0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037, 0x0080,
+	0xd038, 0x0000, 0xd039, 0x0000, 0xd046, 0x0000, 0xd047, 0x0000,
+	0xe42e, 0xe0c0, 0x0043, 0xaf0c, 0x30ce, 0xa202, 0xae0e, 0xe0c1,
+	0x0043, 0xa807, 0xae09, 0xe056, 0xce4e, 0xa222, 0xae28, 0xa217,
+	0xae37, 0xe056, 0xce4c, 0xa200, 0xce54, 0xa206, 0xae38, 0xe005,
+	0x0003, 0xe056, 0xce4a, 0xa200, 0xce58, 0xe42e, 0xe0c0, 0x005b,
+	0xa110, 0xf04a, 0xa106, 0xf05a, 0xe42e, 0xe004, 0x0038, 0xf03e,
+	0xe004, 0x0020, 0xe005, 0x0080, 0xe056, 0xe005, 0x1800, 0xe056,
+	0xcec0, 0xa208, 0xcec8, 0xa200, 0xce92, 0xce9e, 0xce88, 0xce8a,
+	0xced0, 0xced6, 0xcea4, 0xcec6, 0xa202, 0xce9c, 0xe004, 0x0200,
+	0xce96, 0xe42e, 0xa206, 0x2af6, 0xae11, 0xe056, 0xce5a, 0x247c,
+	0x4c7d, 0xce5c, 0xa200, 0xce5e, 0xe42e, 0xe004, 0x0f00, 0xae20,
+	0xe005, 0x0003, 0xe056, 0xe005, 0x0030, 0xe056, 0xca49, 0xaf21,
+	0xa803, 0xf04b, 0xa203, 0xae2f, 0xe056, 0xce4a, 0xe42e, 0xc872,
+	0xa050, 0xcc72, 0xa200, 0xe41e, 0x1286, 0xa200, 0xe41e, 0x1286,
+	0xa200, 0xe41e, 0x1286, 0xa202, 0xe41e, 0x1286, 0xa200, 0xce96,
+	0xceaa, 0x282f, 0xae0a, 0x4c30, 0xe41e, 0x1286, 0xe41e, 0x1115,
+	0xa200, 0xce92, 0xe42e, 0xca9b, 0xf7f9, 0xe42e, 0xe41e, 0x1283,
+	0xcec4, 0xe42e, 0xca48, 0xa802, 0xf7e8, 0xca4c, 0xa802, 0xf7ea,
+	0xe42e, 0xe41e, 0x128a, 0xe41e, 0x1283, 0xa200, 0x3cf4, 0xe004,
+	0x0030, 0xce98, 0x28f4, 0xf7fa, 0xe42e, 0xe082, 0x3c4e, 0xe161,
+	0x0180, 0xca80, 0x3511, 0x3d11, 0xca82, 0x3511, 0x3d11, 0xca84,
+	0x3511, 0x3d11, 0xca86, 0x3511, 0x3d11, 0x8b11, 0x0144, 0x8b11,
+	0x0145, 0x8b11, 0x0148, 0x8b11, 0x0149, 0x8b11, 0x014a, 0x8b11,
+	0x014b, 0x8b11, 0x0160, 0x8b11, 0x014e, 0x8b11, 0x014f, 0x8b11,
+	0x0152, 0x8b11, 0x0153, 0x8b11, 0x0155, 0x8b11, 0x0157, 0x8b11,
+	0x0163, 0x8b11, 0x0164, 0x8b11, 0x0165, 0xcacc, 0x3511, 0x3d11,
+	0xcace, 0x3511, 0x3d11, 0x8b11, 0x0168, 0xcad2, 0x3511, 0x3d11,
+	0xcad4, 0x3511, 0x3d11, 0x8b11, 0x016b, 0x8b11, 0x016c, 0x8b11,
+	0x016d, 0x8b11, 0x016e, 0xc860, 0x3511, 0x3d11, 0xc862, 0x3511,
+	0x3d11, 0xc864, 0x3511, 0x3d11, 0x8b11, 0x0033, 0x8b11, 0x0034,
+	0x8b11, 0x0035, 0x8b11, 0x0036, 0x8b11, 0x0037, 0x8b11, 0x0038,
+	0xc872, 0x3511, 0x3d11, 0x8b11, 0x003a, 0xc87a, 0x3511, 0x3d11,
+	0xc87c, 0x3511, 0x3d11, 0xc880, 0x3511, 0x3d11, 0xc882, 0x3511,
+	0x3d11, 0xc884, 0x3511, 0x3d11, 0xc886, 0x3511, 0x3d11, 0xc888,
+	0x3511, 0x3d11, 0xc88a, 0x3511, 0x3d11, 0xc88c, 0x3511, 0x3d11,
+	0xc890, 0x3511, 0x3d11, 0xc892, 0x3511, 0x3d11, 0xc894, 0x3511,
+	0x3d11, 0xc896, 0x3511, 0x3d11, 0xc898, 0x3511, 0x3d11, 0xc89e,
+	0x3511, 0x3d11, 0x284e, 0xe092, 0xe42e, 0xe082, 0x3c4e, 0xe161,
+	0x0180, 0x2111, 0x4d11, 0xce80, 0x2111, 0x4d11, 0xce82, 0x2111,
+	0x4d11, 0xce84, 0x2111, 0x4d11, 0xce86, 0x8911, 0x0144, 0x8911,
+	0x0145, 0x8911, 0x0148, 0x8911, 0x0149, 0x8911, 0x014a, 0x8911,
+	0x014b, 0x8911, 0x0160, 0x8911, 0x014e, 0x8911, 0x014f, 0x8911,
+	0x0152, 0x8911, 0x0153, 0x8911, 0x0155, 0x8911, 0x0157, 0x8911,
+	0x0163, 0x8911, 0x0164, 0x8911, 0x0165, 0x2111, 0x4d11, 0xcecc,
+	0x2111, 0x4d11, 0xcece, 0x8911, 0x0168, 0x2111, 0x4d11, 0xced2,
+	0x2111, 0x4d11, 0xced4, 0x8911, 0x016b, 0x8911, 0x016c, 0x8911,
+	0x016d, 0x8911, 0x016e, 0x2111, 0x4d11, 0xcc60, 0x2111, 0x4d11,
+	0xcc62, 0x2111, 0x4d11, 0xcc64, 0x8911, 0x0033, 0x8911, 0x0034,
+	0x8911, 0x0035, 0x8911, 0x0036, 0x8911, 0x0037, 0x8911, 0x0038,
+	0x2111, 0x4d11, 0xcc72, 0x8911, 0x003a, 0x2111, 0x4d11, 0xcc7a,
+	0x2111, 0x4d11, 0xcc7c, 0x2111, 0x4d11, 0xcc80, 0x2111, 0x4d11,
+	0xcc82, 0x2111, 0x4d11, 0xcc84, 0x2111, 0x4d11, 0xcc86, 0x2111,
+	0x4d11, 0xcc88, 0x2111, 0x4d11, 0xcc8a, 0x2111, 0x4d11, 0xcc8c,
+	0x2111, 0x4d11, 0xcc90, 0x2111, 0x4d11, 0xcc92, 0x2111, 0x4d11,
+	0xcc94, 0x2111, 0x4d11, 0xcc96, 0x2111, 0x4d11, 0xcc98, 0x2111,
+	0x4d11, 0xe005, 0x1415, 0xae21, 0xe056, 0xcc9e, 0xd14c, 0x0002,
+	0x284e, 0xe092, 0xe42e, 0xe082, 0x3c4e, 0xe161, 0x0180, 0xc872,
+	0x3511, 0x3d11, 0xcac6, 0x3cfa, 0x3d11, 0xf07a, 0xcacc, 0x3511,
+	0x3d11, 0xcace, 0x3511, 0x3d11, 0x284e, 0xe092, 0xe42e, 0x2afa,
+	0xe42b, 0x247c, 0x4c7d, 0xe046, 0x347c, 0x3c7d, 0xe42e, 0xe082,
+	0x3c4e, 0xe161, 0x0180, 0x2111, 0x4d11, 0xcc72, 0x2b11, 0xf15b,
+	0x2901, 0xaf10, 0xe008, 0x00ff, 0xe41e, 0x1286, 0x28fa, 0xa102,
+	0xf0ca, 0x3cfa, 0x2911, 0xe008, 0x00ff, 0xe41e, 0x1286, 0x28fa,
+	0xa102, 0xf03a, 0x3cfa, 0xf6de, 0x284e, 0xe092, 0xe42e, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x000f, 0x0d0b, 0x0907, 0x0501, 0x000f, 0x0d0b, 0x0907, 0x0501,
+	0x001e, 0x1a16, 0x120e, 0x0a02, 0x001e, 0x1a16, 0x120e, 0x0a02,
+	0x002d, 0x2721, 0x1b15, 0x0f03, 0x003c, 0x342c, 0x241c, 0x1404,
+	0x004b, 0x4137, 0x2d23, 0x1905, 0x005a, 0x4e42, 0x362a, 0x1e06,
+	0x0069, 0x5b4d, 0x3f31, 0x2307, 0x0078, 0x6858, 0x4838, 0x2808,
+	0x0087, 0x7563, 0x513f, 0x2d09, 0x00a5, 0x8f79, 0x634d, 0x370b,
+	0x00c3, 0xa98f, 0x755b, 0x410d, 0x00e1, 0xc3a5, 0x8769, 0x4b0f,
+	0x00e1, 0xc3a5, 0x8769, 0x4b0f, 0x00e1, 0xc3a5, 0x8769, 0x4b0f,
+	0x0020, 0x0008, 0x0008, 0x0008, 0x0030, 0x0010, 0x0008, 0x0010,
+	0x0030, 0x0010, 0x0008, 0x0010, 0x0030, 0x0010, 0x0008, 0x0010,
+	0x0030, 0x0010, 0x0008, 0x0010, 0x0040, 0x0018, 0x0008, 0x0018,
+	0x0040, 0x0018, 0x0008, 0x0018, 0x0050, 0x0018, 0x0010, 0x0018,
+	0x0050, 0x0018, 0x0010, 0x0020, 0x0060, 0x0020, 0x0018, 0x0020,
+	0x0060, 0x0020, 0x0018, 0x0020, 0x0080, 0x0040, 0x0018, 0x0028,
+	0x0080, 0x0040, 0x0018, 0x0030, 0x00a0, 0x0060, 0x0020, 0x0030,
+	0x00a0, 0x0060, 0x0020, 0x0038, 0x00c0, 0x0080, 0x0030, 0x0040,
+	0x00c0, 0x0080, 0x0030, 0x0048, 0x0100, 0x00c0, 0x0040, 0x0050,
+	0x0100, 0x00c0, 0x0040, 0x0058, 0x0140, 0x0100, 0x0060, 0x0068,
+	0x0140, 0x0100, 0x0060, 0x0070, 0x0180, 0x0140, 0x0070, 0x0080,
+	0x0180, 0x0140, 0x0070, 0x0090, 0x01c0, 0x0180, 0x0080, 0x00a0,
+	0x01c0, 0x0180, 0x0080, 0x00b8, 0x0200, 0x01c0, 0x00a0, 0x00c8,
+	0x0200, 0x01c0, 0x00a0, 0x00e8, 0x0300, 0x0200, 0x0180, 0x0180,
+	0x0300, 0x0200, 0x0180, 0x01a0, 0x0400, 0x0240, 0x0200, 0x01c0,
+	0x0400, 0x0240, 0x0200, 0x01e8, 0x0400, 0x0240, 0x0200, 0x0398,
+	0x0400, 0x0240, 0x0200, 0x03c8, 0x0400, 0x0240, 0x0200, 0x0400,
+	0x0400, 0x0240, 0x0200, 0x0440, 0x0400, 0x0240, 0x0200, 0x0688,
+	0x0400, 0x0240, 0x0200, 0x06d8, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0028, 0x0027, 0x0027, 0x0026, 0x0026, 0x0025, 0x0024, 0x0023,
+	0x0022, 0x0021, 0x0020, 0x001f, 0x001e, 0x001d, 0x001c, 0x001b,
+	0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007,
+	0x0008, 0x0009, 0x000a, 0x000b, 0x000c, 0x000d, 0x000e, 0x000f,
+	0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0016, 0x0017,
+	0x0018, 0x0019, 0x001a, 0x001b, 0x001c, 0x001d, 0x001d, 0x001e,
+	0x001f, 0x0020, 0x0020, 0x0021, 0x0022, 0x0022, 0x0023, 0x0023,
+	0x0024, 0x0024, 0x0025, 0x0025, 0x0025, 0x0026, 0x0026, 0x0026,
+	0x0027, 0x0027, 0x0027, 0x0027, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0001, 0x0001, 0x0001, 0x0001, 0x0002, 0x0002, 0x0002, 0x0002,
+	0x0003, 0x0003, 0x0003, 0x0004, 0x0006, 0x0006, 0x0007, 0x0008,
+	0x0009, 0x000c, 0x000f, 0x0011, 0x0014, 0x0017, 0x001c, 0x001f,
+	0x0022, 0x0025, 0x002a, 0x002e, 0x0030, 0x0037, 0x003a, 0x003e,
+	0x0043, 0x0049, 0x0050, 0x0057, 0x005f, 0x0068, 0x0072, 0x007d,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0001, 0x0002, 0x0002, 0x0002, 0x0002, 0x0003, 0x0003, 0x0003,
+	0x0004, 0x0004, 0x0004, 0x0005, 0x0006, 0x0006, 0x0007, 0x0008,
+	0x0009, 0x000a, 0x000b, 0x000d, 0x000e, 0x0010, 0x0012, 0x0014,
+	0x0017, 0x0019, 0x001d, 0x0020, 0x0024, 0x0028, 0x002d, 0x0033,
+	0x0039, 0x0040, 0x0048, 0x0051, 0x005b, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x02f9, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x0313, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x02f9, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x0213, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0319, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x031b, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01c5, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa220, 0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802,
+	0xa220, 0xe0c2, 0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2,
+	0x0077, 0xa2fa, 0xe0c2, 0x0071, 0xe42e, 0xe428, 0xa202, 0xe0c2,
+	0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28, 0xf7f8, 0xca48, 0xa802,
+	0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190, 0xf7e2, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8,
+	0xe004, 0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0,
+	0x000d, 0xf7e8, 0xe42e, 0xe41e, 0x0213, 0xd160, 0x0620, 0xe004,
+	0x0019, 0xae18, 0xcec0, 0xe42e, 0xe41e, 0x0228, 0xe000, 0x0040,
+	0xce50, 0xa200, 0xd022, 0x00ff, 0xe184, 0x020f, 0xce52, 0xe190,
+	0xe41e, 0x0230, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72,
+	0xcc8c, 0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a,
+	0xd16f, 0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e,
+	0xe004, 0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e,
+	0xe004, 0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e,
+	0xe41e, 0x028d, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a,
+	0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02c3, 0xe41e, 0x02f4, 0xae12,
+	0xe0c2, 0x041e, 0xe41e, 0x02e7, 0xe42e, 0xe41e, 0x02b1, 0xe42a,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0,
+	0x0215, 0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0,
+	0x0213, 0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0,
+	0x020b, 0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02c3, 0xe41e,
+	0x02f4, 0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1,
+	0x0204, 0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f,
+	0xe056, 0xe0c2, 0x041e, 0xe41e, 0x02e7, 0xe42e, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203,
+	0xae19, 0xe052, 0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a,
+	0xe0c0, 0x0060, 0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017,
+	0xe056, 0xf0ea, 0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1,
+	0x0044, 0xaf17, 0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e,
+	0x028d, 0xf088, 0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4,
+	0xc785, 0xe018, 0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a,
+	0xa202, 0xe0c2, 0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xe0c0, 0x041b,
+	0xaf20, 0xa01e, 0xaf08, 0xae28, 0xe0c1, 0x041b, 0xe009, 0xffff,
+	0xa01f, 0xaf09, 0xae09, 0xe056, 0xe0c2, 0x041d, 0xe42e, 0xe0c0,
+	0x041c, 0xe00a, 0x0200, 0xe0c2, 0x041c, 0xe0c0, 0x041c, 0xe00c,
+	0x0200, 0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802,
+	0xe42e, 0xe40e, 0x1424, 0xe40e, 0x031d, 0xe40e, 0x0321, 0xe40e,
+	0x0325, 0xe40e, 0x032d, 0xe40e, 0x0331, 0xe40e, 0x0335, 0xe40e,
+	0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0339, 0xe40e, 0x00a4, 0xe40e,
+	0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x00a4, 0xe40e,
+	0x00a4, 0xe40e, 0x0704, 0xe40e, 0x0715, 0xe41e, 0x03b2, 0xe40e,
+	0x00a4, 0xe41e, 0x03d0, 0xe40e, 0x00a4, 0xe41e, 0x0234, 0xe41e,
+	0x03dc, 0xe41e, 0x0286, 0xe40e, 0x00a4, 0xe41e, 0x0488, 0xe40e,
+	0x00a4, 0xe41e, 0x04b5, 0xe40e, 0x00a4, 0xe41e, 0x069e, 0xe40e,
+	0x00a4, 0xe41e, 0x06ca, 0xe40e, 0x00a4, 0x3cec, 0xe0c0, 0x0041,
+	0xe005, 0x0018, 0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112,
+	0x0100, 0x88ec, 0x0113, 0xca28, 0xf7f8, 0xe42e, 0x8917, 0x0034,
+	0x8917, 0x0033, 0x8917, 0x0035, 0x8917, 0x0036, 0x8917, 0x0037,
+	0x8917, 0x0038, 0x8117, 0x8117, 0x2117, 0x4d17, 0xcc60, 0x2117,
+	0x4d17, 0xcc62, 0x2117, 0x4d17, 0xcc64, 0x2117, 0x4d17, 0xcc72,
+	0xe42e, 0x2117, 0x4d17, 0xcc72, 0x2117, 0x4d17, 0xcc8c, 0x2917,
+	0xcc90, 0x2917, 0x28f4, 0xcc8e, 0x2917, 0x28f5, 0xcc92, 0x2917,
+	0xcc96, 0x2917, 0xcc98, 0x2117, 0x4d17, 0xcc9e, 0xe42e, 0x8b17,
+	0x0034, 0x8b17, 0x0033, 0x8b17, 0x0035, 0x8b17, 0x0036, 0x8b17,
+	0x0037, 0x8b17, 0x0038, 0x8117, 0x8117, 0xc860, 0x3517, 0x3d17,
+	0xc862, 0x3517, 0x3d17, 0xc864, 0x3517, 0x3d17, 0xc872, 0x3517,
+	0x3d17, 0xe42e, 0xc872, 0x3517, 0x3d17, 0xc88c, 0x3517, 0x3d17,
+	0xc890, 0x3d17, 0xc88e, 0x3d17, 0xca9e, 0x3d17, 0xc896, 0x3d17,
+	0xc898, 0x3d17, 0xe005, 0x1415, 0xae21, 0xc89e, 0xe056, 0x3517,
+	0x3d17, 0xe42e, 0xd130, 0x000b, 0xe41e, 0x0148, 0xe41e, 0x0213,
+	0xe41e, 0x04e6, 0xe41e, 0x068b, 0xe41e, 0x04e9, 0xf0ea, 0xe41e,
+	0x0d78, 0xe41e, 0x13d5, 0x283f, 0xe418, 0x10b0, 0xe41e, 0x1354,
+	0xa202, 0xe0c2, 0x0070, 0xe42e, 0xa200, 0xe0c2, 0x0070, 0xe42e,
+	0x28b5, 0xe428, 0x28b6, 0xf06a, 0xa200, 0x3c13, 0xe41e, 0x1533,
+	0xe42e, 0xe41e, 0x14d6, 0xe42e, 0xa202, 0xce02, 0xa240, 0xa102,
+	0xf7f8, 0xa200, 0xcc4a, 0xcc4c, 0x3cf9, 0x3cfa, 0xe0c2, 0x003f,
+	0xe0c2, 0x0074, 0x3c7c, 0xe41e, 0x1034, 0xe41e, 0x105f, 0x28b6,
+	0xf0fa, 0x28b7, 0xf09a, 0xe0c0, 0x0066, 0x3410, 0x3c11, 0xe0c0,
+	0x0067, 0xae04, 0x3c12, 0xa200, 0x3c13, 0xe41e, 0x1533, 0xd130,
+	0x000b, 0xd1b3, 0x0001, 0xd03a, 0x0003, 0xd04b, 0x0001, 0xd04c,
+	0x0000, 0xd008, 0x0000, 0xe41e, 0x0628, 0xe41e, 0x1359, 0x282c,
+	0xf05a, 0x28c5, 0xa002, 0xa802, 0x3cc5, 0xe41e, 0x0dbc, 0x283b,
+	0xf038, 0x2854, 0xcc72, 0x2830, 0xe41a, 0x0b80, 0x2830, 0xe418,
+	0x0be7, 0xe41e, 0x0724, 0x283f, 0xe418, 0x11de, 0x2e20, 0x2c2b,
+	0x0821, 0xe045, 0xb60e, 0x3c2b, 0x28b6, 0xf06a, 0xe41e, 0x14d6,
+	0xe41e, 0x13e7, 0xf05e, 0x28b5, 0xf03a, 0xe41e, 0x1500, 0x2c3b,
+	0xa002, 0x3c3b, 0xe0c2, 0x0070, 0xe002, 0x00f3, 0xf028, 0x283b,
+	0x2824, 0xe0c2, 0x0071, 0x282f, 0xe0c2, 0x0073, 0xd039, 0x0000,
+	0xa200, 0x3cd4, 0x3cd5, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2,
+	0x0053, 0xe0c0, 0x0065, 0xaf06, 0xa80e, 0xe418, 0x0462, 0x287c,
+	0xf058, 0xa202, 0xe0c2, 0x0076, 0xe42e, 0xa208, 0xe0c2, 0x0076,
+	0xe42e, 0xe42e, 0xe162, 0x05c0, 0xc410, 0x28f2, 0xae10, 0x3d12,
+	0x2852, 0x3d12, 0x8132, 0x28f3, 0xae12, 0x4c2c, 0x3d12, 0x2852,
+	0xae04, 0x3d12, 0x8132, 0x28f4, 0xae14, 0x4c2f, 0x3d12, 0x282f,
+	0xae06, 0x3d12, 0xe180, 0xe0c0, 0x0068, 0xce20, 0xd112, 0x000c,
+	0xd111, 0x05c0, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe181, 0xe42e,
+	0xe41e, 0x0db0, 0xe41e, 0x0174, 0xe0c0, 0x0042, 0xce20, 0xd111,
+	0x0600, 0xd112, 0x00c0, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe0c0,
+	0x0060, 0x3c3c, 0xe0c0, 0x0061, 0x3c70, 0xe004, 0x0700, 0xe096,
+	0xe0c0, 0x0062, 0x3513, 0x3d13, 0xe0c0, 0x0063, 0x3513, 0x3d13,
+	0xe167, 0x0704, 0xe0c0, 0x006c, 0x3517, 0x3d17, 0xe0c0, 0x006d,
+	0x3517, 0x3d17, 0xe41e, 0x1034, 0xe42e, 0x2830, 0xe428, 0x28b6,
+	0xf0fa, 0x28b7, 0xf09a, 0xe0c0, 0x0061, 0x3410, 0x3c11, 0xe0c0,
+	0x0062, 0xae04, 0x3c12, 0xa200, 0x3c13, 0xe41e, 0x1533, 0xe0c0,
+	0x0060, 0xf06a, 0xa102, 0xf09a, 0xa102, 0xf0aa, 0xe42e, 0xe41e,
+	0x0b08, 0xe41e, 0x0b0d, 0xf07e, 0xe41e, 0x0b51, 0xf04e, 0xe41e,
+	0x0b72, 0xf01e, 0x28b6, 0xf06a, 0xe41e, 0x14d6, 0xe41e, 0x13e7,
+	0xe42e, 0x28b5, 0xe42a, 0xe41e, 0x1500, 0xe42e, 0xa200, 0xcc72,
+	0xe42e, 0xe0c0, 0x0074, 0xa806, 0x3cd9, 0xe0c0, 0x0074, 0xaf04,
+	0x3cda, 0xe0c0, 0x0064, 0x347a, 0x3c7b, 0x3c71, 0xe0c0, 0x0065,
+	0x3421, 0x3c20, 0x2821, 0xa002, 0x3c21, 0x2c20, 0xc710, 0x7c21,
+	0xe008, 0xffff, 0xa002, 0xaf02, 0x3c3d, 0xe0c0, 0x0062, 0xaf06,
+	0x303e, 0xaf04, 0x30bb, 0xe0c1, 0x0071, 0x3ebc, 0xaf02, 0x30ca,
+	0xaf02, 0x30cb, 0xe0c0, 0x0075, 0xe166, 0x0510, 0x3516, 0x3d16,
+	0x287a, 0xa01e, 0xaf08, 0x3c50, 0x287b, 0xa01e, 0xaf08, 0x3c51,
+	0xe0c0, 0x0063, 0xaf06, 0x3030, 0xf1d8, 0xa200, 0x3c34, 0x3c35,
+	0x3c36, 0x3c37, 0x3c6b, 0xe0c0, 0x0066, 0x3022, 0xaf02, 0x3023,
+	0x2a23, 0x4622, 0x3e23, 0xaf02, 0xa80e, 0x3c46, 0xe0c0, 0x0066,
+	0xaf0a, 0x3048, 0xaf02, 0x30c9, 0x2823, 0x4422, 0x3c23, 0xe40e,
+	0x05bc, 0xe0c0, 0x0067, 0x3c55, 0x3037, 0xaf02, 0x3036, 0xaf02,
+	0x3035, 0xaf02, 0x3034, 0xaf02, 0x306b, 0x2834, 0xe408, 0x0624,
+	0x283d, 0xa11e, 0xe404, 0x0624, 0xe167, 0x0204, 0xc420, 0xa202,
+	0x3c47, 0x2850, 0xae08, 0x1937, 0xe40a, 0x0594, 0x2847, 0xa002,
+	0x3c47, 0xa10a, 0xe408, 0x0559, 0xa202, 0x3c55, 0xa20c, 0x3c47,
+	0x287b, 0xe002, 0x0190, 0xf086, 0xe002, 0x0190, 0xf0b6, 0xe002,
+	0x0160, 0xf116, 0xf19e, 0x2850, 0x3c32, 0x2851, 0x3c31, 0xe40e,
+	0x05aa, 0x2850, 0xae02, 0x3c32, 0x2851, 0xa002, 0xaf02, 0x3c31,
+	0xe40e, 0x05aa, 0x2850, 0xae04, 0x3c32, 0x2851, 0xa006, 0xaf04,
+	0x3c31, 0xe40e, 0x05aa, 0x2850, 0xae06, 0x3c32, 0x2851, 0xa00e,
+	0xaf06, 0x3c31, 0xe40e, 0x05aa, 0x812f, 0x8117, 0x2851, 0xae08,
+	0x1907, 0xe408, 0x055e, 0x2847, 0xae04, 0xe000, 0x0200, 0xe09e,
+	0x2917, 0xaf08, 0x3c50, 0x2917, 0xaf08, 0x3c51, 0x2917, 0x3c32,
+	0x2907, 0x3c31, 0xa200, 0x2a20, 0xe003, 0x7530, 0xb632, 0x2a21,
+	0xe003, 0x03e9, 0xb632, 0x3c38, 0xf08a, 0x2855, 0xf068, 0x2821,
+	0xa102, 0xe408, 0x0624, 0x3c38, 0xe0c0, 0x0069, 0x3008, 0xaf02,
+	0x3009, 0xaf02, 0x3c0a, 0xe0c0, 0x006a, 0x3c40, 0xe0c0, 0x006b,
+	0x303f, 0x3481, 0xaf02, 0xe008, 0x7fff, 0x3c80, 0xf028, 0x3c3f,
+	0x2881, 0xaf1e, 0x30ac, 0x2881, 0xe008, 0x7fff, 0x3c81, 0xe0c0,
+	0x006c, 0x3482, 0x3c83, 0xe0c0, 0x006d, 0x3c41, 0x8450, 0x8251,
+	0xe018, 0x3c52, 0xa201, 0xe002, 0x00c8, 0xb425, 0xe002, 0x0190,
+	0xb425, 0x3e44, 0xa202, 0x30b5, 0xe0c0, 0x0043, 0xaf06, 0xaf02,
+	0x30b6, 0xaf02, 0x30b7, 0xaf02, 0x30de, 0x2850, 0x2a51, 0xaf06,
+	0xaf07, 0x3c06, 0x3e07, 0x8406, 0x8207, 0xe018, 0x3cc6, 0xa104,
+	0xf032, 0xa204, 0x3cc6, 0x2851, 0xaf02, 0x3c06, 0x8406, 0x8250,
+	0xe018, 0x3cc2, 0x3cc7, 0xa202, 0x3cc5, 0xe0c0, 0x0076, 0xe049,
+	0xa807, 0x3e0d, 0xaf04, 0x300e, 0xaf02, 0xa81e, 0x3c0f, 0xa20e,
+	0x2a0e, 0xb612, 0xa200, 0x3c0e, 0x280f, 0xb7f4, 0xa81e, 0x3c0f,
+	0xa202, 0xe0c2, 0x0070, 0xe42e, 0xa200, 0xe0c2, 0x0070, 0xe42e,
+	0xa200, 0x3c1f, 0xe0c0, 0x0065, 0xa804, 0xf03a, 0xa200, 0x3c3b,
+	0x28b9, 0x1840, 0xe01a, 0x2ab9, 0xe01b, 0xe052, 0xe016, 0x2a40,
+	0xe01b, 0xe052, 0x2a40, 0x4e3b, 0xe017, 0xe056, 0xa203, 0xb611,
+	0x3e24, 0x3e2c, 0xa202, 0xf02b, 0x08b9, 0x3cb9, 0xe0c0, 0x0065,
+	0xa802, 0xe418, 0x065e, 0xe0c0, 0x0063, 0x3c27, 0xa208, 0x180d,
+	0x2a30, 0xb632, 0x3c28, 0x283f, 0xe42a, 0x282c, 0xe41a, 0x1199,
+	0xe41e, 0x119a, 0x3c27, 0xe419, 0x065e, 0xe42e, 0xa202, 0x3c24,
+	0x3c2c, 0x3c1f, 0xe0c0, 0x0060, 0xaf20, 0xae20, 0x4c3a, 0xe0c2,
+	0x0060, 0xe42e, 0xe167, 0x05d0, 0xa201, 0x3f17, 0x2aea, 0xe045,
+	0x3f17, 0xc872, 0x22f9, 0x4efa, 0xe046, 0x3517, 0x3d17, 0xc872,
+	0x34f9, 0x3cfa, 0x282f, 0xae06, 0xe167, 0x05ca, 0x2317, 0x4f17,
+	0xe042, 0xce20, 0xd111, 0x05d0, 0xd112, 0x0004, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0040, 0xe005, 0x006a, 0xae17,
+	0xe042, 0xe005, 0x1600, 0xae03, 0xe042, 0xce20, 0xd111, 0x0200,
+	0xd112, 0x018c, 0xd113, 0x0003, 0xe1e1, 0xe42e, 0xe0c0, 0x0060,
+	0xf06a, 0xa102, 0xf09a, 0xa102, 0xf0aa, 0xe42e, 0xe41e, 0x0b08,
+	0xe41e, 0x0b0d, 0xf06e, 0xe41e, 0x0b51, 0xf03e, 0xe41e, 0x0b72,
+	0xc868, 0xaf06, 0xc867, 0xe003, 0x0080, 0xae05, 0xe042, 0x3c06,
+	0xe0c2, 0x0070, 0xc86e, 0xd037, 0x00c0, 0xbad7, 0xcc6e, 0xe0c0,
+	0x0042, 0xce20, 0xd111, 0x0100, 0xd112, 0x0080, 0xd113, 0x0012,
+	0xe1e1, 0xe42e, 0xe0c1, 0x0060, 0xa803, 0xf05b, 0xe0c0, 0x0061,
+	0xe41e, 0x1142, 0xe0c1, 0x0060, 0xa805, 0xf05b, 0xe0c0, 0x0062,
+	0xe41e, 0x118e, 0xe0c1, 0x0060, 0xa809, 0xf05b, 0xe0c0, 0x0063,
+	0xe41e, 0x1168, 0xe0c1, 0x0060, 0xa811, 0xf05b, 0xe0c0, 0x0064,
+	0xe41e, 0x1109, 0xe0c1, 0x0060, 0xa821, 0xf04b, 0xe0c0, 0x0065,
+	0x3c41, 0xe0c1, 0x0060, 0xa841, 0xf08b, 0xe0c0, 0x0066, 0x3008,
+	0xaf02, 0x3009, 0xaf02, 0x3c0a, 0xe0c1, 0x0060, 0xa881, 0xf04b,
+	0xe0c0, 0x0067, 0x3c48, 0xe42e, 0xa206, 0xe41e, 0x0153, 0xe41e,
+	0x0213, 0xa226, 0xe41e, 0x033d, 0xe167, 0x0160, 0xe41e, 0x034e,
+	0xe167, 0x0170, 0xe41e, 0x0369, 0xe42e, 0xa224, 0xe41e, 0x033d,
+	0xe167, 0x0160, 0xe41e, 0x037f, 0xe167, 0x0170, 0xe41e, 0x039a,
+	0xa204, 0xe41e, 0x0153, 0xe42e, 0x2827, 0x3c62, 0xa200, 0x3cd3,
+	0x3ce2, 0x3ce3, 0x3ce4, 0x3ce5, 0x3ce6, 0x3ce7, 0x3c54, 0x3c53,
+	0x3cf7, 0x3cf8, 0x3cf5, 0x3cea, 0x3ce8, 0x3ce9, 0x3c01, 0x3c02,
+	0x3c03, 0x3c2f, 0xcf64, 0xcf62, 0xe0c2, 0x0113, 0xe0c2, 0x030d,
+	0xa202, 0xe0c2, 0x0130, 0xa2fe, 0x2a22, 0xb616, 0x3c16, 0xe004,
+	0x0055, 0xe0c2, 0x030c, 0x2836, 0xe016, 0x4430, 0xe408, 0x07c8,
+	0xa223, 0x2824, 0xe40a, 0x0756, 0x2a28, 0xa021, 0x3e61, 0xa200,
+	0x3c0b, 0xcc70, 0xa202, 0x3c0c, 0x2822, 0xe418, 0x0cd9, 0xa202,
+	0xe0c2, 0x0110, 0x280b, 0xa802, 0xf03a, 0xa202, 0x3cdb, 0xe41e,
+	0x0a3e, 0xe408, 0x07ba, 0x2802, 0xf1ea, 0x280b, 0xa802, 0xe418,
+	0x0863, 0x2858, 0x2a62, 0x1a26, 0xb606, 0x3c5f, 0xcf26, 0xe41e,
+	0x088d, 0x2824, 0xe418, 0x0ac7, 0x2858, 0xae04, 0x4c59, 0xcf02,
+	0x2835, 0xf06a, 0x2859, 0xe016, 0xae0a, 0x4c5d, 0xcf6a, 0xa202,
+	0xe0c2, 0x021e, 0xe41e, 0x0828, 0x283f, 0xe016, 0x4c22, 0xf038,
+	0x8a6e, 0x0039, 0x2802, 0xe418, 0x0895, 0x285d, 0x2ace, 0x3c62,
+	0x3e63, 0x283f, 0x2a22, 0xf18a, 0xc872, 0xf0ab, 0xc870, 0xc440,
+	0xa217, 0xe001, 0x046a, 0xe095, 0x0932, 0x0902, 0x3c06, 0x1c6e,
+	0xe008, 0xffff, 0x3c6f, 0x2a22, 0x2806, 0xf02b, 0x3c6e, 0x285d,
+	0x2a02, 0xe419, 0x1278, 0xe41e, 0x139f, 0x20e8, 0x4ce9, 0xcf62,
+	0xe40e, 0x0762, 0x2822, 0xe418, 0x0ceb, 0xa202, 0xe41e, 0x0886,
+	0x2836, 0xf048, 0xe41e, 0x0c70, 0xe42e, 0xe41e, 0x0c7a, 0xe42e,
+	0xa202, 0xe0c2, 0x0110, 0xa200, 0x3c4a, 0xf0fe, 0xa202, 0x3cdb,
+	0x2808, 0xf0ba, 0xbacf, 0xbae0, 0x284a, 0xba88, 0xbac1, 0x285d,
+	0x3c27, 0xba88, 0xd1b3, 0x0002, 0xa200, 0x3c49, 0xe41e, 0x0a3e,
+	0xe408, 0x0825, 0x8a6e, 0x0039, 0x2802, 0xf1ca, 0x2858, 0x2a62,
+	0x1a26, 0xb606, 0x3c5f, 0xcf26, 0xe41e, 0x088d, 0x2824, 0xe418,
+	0x0ac7, 0x2858, 0xae04, 0x4c59, 0xcf02, 0x2835, 0xf06a, 0x2859,
+	0xe016, 0xae0a, 0x4c5d, 0xcf6a, 0xa202, 0xe0c2, 0x021e, 0xe41e,
+	0x08ca, 0x285d, 0x2ace, 0x3c62, 0x3e63, 0xc872, 0x1c6e, 0xe008,
+	0xffff, 0x3c6f, 0x2a3f, 0x4602, 0x285d, 0xe419, 0x1278, 0xe41e,
+	0x139f, 0x20e8, 0x4ce9, 0xcf62, 0x2802, 0xe40a, 0x07de, 0x2849,
+	0xa002, 0x3c49, 0x1832, 0xe408, 0x07de, 0x284a, 0xa002, 0x3c4a,
+	0x1831, 0xe408, 0x07ce, 0xe40e, 0x07de, 0xe41e, 0x0c7a, 0xe42e,
+	0x2808, 0x2a09, 0xe42a, 0x2822, 0xf239, 0x2a02, 0xe42b, 0xf0d8,
+	0x2a0b, 0xaf03, 0x3e0b, 0xe429, 0xc870, 0x1c0a, 0xe424, 0xa210,
+	0x3c0b, 0xa202, 0x3c66, 0xe42e, 0x2a0b, 0xaf03, 0x3e0b, 0xe429,
+	0xc870, 0xc440, 0xa217, 0xe001, 0x046a, 0xe095, 0x0932, 0x0902,
+	0x1c0a, 0xe424, 0xa210, 0x3c0b, 0xa202, 0x3c66, 0xe42e, 0x2a54,
+	0xe42b, 0x280c, 0x180a, 0x2a0c, 0xa003, 0x3e0c, 0x2a0b, 0xaf03,
+	0x3e0b, 0xe428, 0xa202, 0x3c0c, 0x280b, 0xa940, 0x3c0b, 0x2866,
+	0xa908, 0x3c66, 0xe42e, 0x28f5, 0xe016, 0x3cf5, 0x2822, 0xe418,
+	0x0ceb, 0xa200, 0xe41e, 0x0886, 0x2822, 0xe418, 0x0cd9, 0x2809,
+	0xf038, 0xd038, 0x0000, 0x2862, 0x3c27, 0xe41e, 0x0bb4, 0x283f,
+	0x4422, 0xf0aa, 0xc870, 0xc440, 0xa217, 0xe001, 0x046a, 0xe095,
+	0x0932, 0x0902, 0x3c6e, 0xd1b3, 0x0002, 0xe42e, 0x2af4, 0xe419,
+	0x066a, 0x282f, 0xa002, 0x3c2f, 0xe42e, 0xd190, 0x0002, 0xcb20,
+	0xa804, 0xf7e8, 0xcb04, 0x3c5e, 0xe42e, 0x28ea, 0xe0c2, 0x003f,
+	0x2a36, 0x2822, 0xe409, 0x08ca, 0x2a24, 0xe40a, 0x08a3, 0xe40b,
+	0x0983, 0xe40e, 0x09ae, 0x2859, 0x7024, 0xe428, 0x285b, 0xae02,
+	0x4c5a, 0xae02, 0x4c58, 0x3c4f, 0xa200, 0x0824, 0x3c00, 0x285e,
+	0xa806, 0xae06, 0x4c4f, 0x6c00, 0x285c, 0x7058, 0xa20a, 0x1858,
+	0x3c00, 0x285e, 0xaf04, 0x6c00, 0x285a, 0xe418, 0x09e0, 0x2858,
+	0xe41a, 0x09ff, 0x8877, 0x0194, 0xd190, 0x0001, 0xcb20, 0xa802,
+	0xf7e8, 0xe42e, 0x2859, 0x7024, 0xe428, 0x285b, 0xae02, 0x4c5a,
+	0xae02, 0x4c58, 0x3c4f, 0xa200, 0x0824, 0x0824, 0x0824, 0x3c00,
+	0x285e, 0xa806, 0xae06, 0x4c4f, 0x6c00, 0xa20a, 0x1858, 0x3c00,
+	0x285e, 0xaf04, 0x6c00, 0x285a, 0xe418, 0x09e5, 0x2858, 0xe41a,
+	0x09f1, 0xcb3e, 0xe016, 0xa802, 0x4437, 0xe418, 0x0a29, 0xa201,
+	0xe0c3, 0x0134, 0xf098, 0x8877, 0x0194, 0xd190, 0x0001, 0xcb20,
+	0xa802, 0xf7e8, 0xe42e, 0xa20c, 0x3c4d, 0x2a4d, 0xe427, 0xa103,
+	0x3e4d, 0x285f, 0xe418, 0x090a, 0x285e, 0x5c4d, 0xa802, 0xe418,
+	0x0919, 0xf74e, 0xa20a, 0xe046, 0xae0c, 0xcf3a, 0xcf3c, 0xcb38,
+	0xe005, 0x00fe, 0xe066, 0xe049, 0xe003, 0x0080, 0xb7f6, 0xba8e,
+	0xe42e, 0xe41e, 0x091e, 0xe41e, 0x094e, 0xe42e, 0x2877, 0x5c4d,
+	0x5c4d, 0xa806, 0xe005, 0x02ac, 0xf07a, 0xe005, 0x02ec, 0xa106,
+	0xf03a, 0xe005, 0x032c, 0xe09f, 0x8117, 0xe165, 0x0482, 0xe166,
+	0x04c2, 0xa27c, 0xcc44, 0xa20a, 0x2a4d, 0xe046, 0xae0c, 0x3c06,
+	0xa200, 0xa201, 0x3cd6, 0xe184, 0x094c, 0x2806, 0x4d17, 0xcf3a,
+	0xcf3c, 0xcb38, 0xe008, 0x0fff, 0xb435, 0xf07a, 0x3f15, 0x3d16,
+	0xa201, 0x28d6, 0xa002, 0x3cd6, 0xe190, 0xe42e, 0xe165, 0x0482,
+	0xe166, 0x04c2, 0x28d6, 0xa104, 0xcc44, 0xe184, 0x095c, 0x2915,
+	0xae18, 0x4d16, 0xb914, 0xe41d, 0x0966, 0xa202, 0xae0c, 0x4d15,
+	0xae18, 0x4d16, 0xb914, 0xe41d, 0x0966, 0xe42e, 0xe16a, 0x810e,
+	0xa207, 0xba8d, 0xaf18, 0xba8c, 0x2906, 0xae30, 0xaf30, 0xe049,
+	0xe002, 0x007f, 0xe001, 0x007f, 0xf050, 0xf045, 0x2916, 0xba8e,
+	0xe42e, 0xe004, 0x0080, 0xba8e, 0x2906, 0xa83e, 0xba88, 0x2916,
+	0xaf0a, 0xba8a, 0xe42e, 0x285b, 0xae02, 0x4c5a, 0xae02, 0x4c58,
+	0x3c4f, 0x285e, 0xa806, 0xae06, 0x4c4f, 0xb900, 0x285a, 0xe418,
+	0x09e0, 0x285f, 0xf06a, 0xd190, 0x0001, 0xcb20, 0xa802, 0xf7e8,
+	0xa203, 0xe41e, 0x0ca7, 0x285c, 0xba80, 0x285e, 0xaf04, 0xb908,
+	0xa205, 0xe41e, 0x0ca7, 0x8877, 0x0194, 0xd190, 0x0004, 0xcb20,
+	0xa808, 0xf7e8, 0xa201, 0xe41e, 0x0ca7, 0xe42e, 0x2859, 0xba80,
+	0xe428, 0x285b, 0xae02, 0x4c5a, 0xae02, 0x4c58, 0x3c4f, 0x285e,
+	0xa806, 0xae06, 0x4c4f, 0xb902, 0x2858, 0xe41a, 0x09ff, 0xa203,
+	0xe41e, 0x0ca7, 0x285c, 0x7058, 0xa20a, 0x1858, 0x3c00, 0x285e,
+	0xaf04, 0x6c00, 0x285a, 0xe418, 0x09e0, 0xd190, 0x0001, 0xcb20,
+	0xa802, 0xf7e8, 0xa205, 0xe41e, 0x0ca7, 0x8877, 0x0194, 0xd190,
+	0x0004, 0xcb20, 0xa808, 0xf7e8, 0xa201, 0xe41e, 0x0ca7, 0xe42e,
+	0x286c, 0xa002, 0xb628, 0xba82, 0xe42e, 0x2837, 0xe40a, 0x09e0,
+	0x286c, 0xa140, 0xe404, 0x09ee, 0xba82, 0xe42e, 0x286c, 0xba8a,
+	0xe42e, 0x285b, 0xb670, 0xcc44, 0xe161, 0x06c0, 0xe184, 0x09fd,
+	0x2911, 0xa040, 0xb90c, 0x2911, 0xa040, 0xb90c, 0xe42e, 0xe162,
+	0x06c0, 0x285b, 0xb670, 0xcc44, 0xe184, 0x0a0c, 0x2912, 0xe41e,
+	0x0a0e, 0x2912, 0xe41e, 0x0a0e, 0xe190, 0xe42e, 0xe40a, 0x0a26,
+	0xe404, 0x0a1b, 0xa102, 0xe049, 0x5c29, 0xa002, 0xa040, 0xb90c,
+	0x462a, 0x7229, 0xe42e, 0xa002, 0xe012, 0xe049, 0x5c29, 0xa002,
+	0xe012, 0xa040, 0xb90c, 0x462a, 0x7229, 0xe42e, 0xa040, 0xb90c,
+	0xe42e, 0xe004, 0x017f, 0xcc44, 0xa202, 0xe0c2, 0x0134, 0xa200,
+	0xe184, 0x0a39, 0xe0c2, 0x0135, 0xa002, 0xe0c1, 0x0136, 0xe003,
+	0xff80, 0xf03b, 0xa200, 0xe42e, 0xa202, 0xe42e, 0xe41e, 0x101a,
+	0x2801, 0xe428, 0xa202, 0xe0c2, 0x0110, 0xa200, 0x3c5b, 0x3c5c,
+	0x3c77, 0x3c59, 0xe41e, 0x0a61, 0xe41e, 0x0fdd, 0xe41e, 0x13b8,
+	0x2a02, 0x2858, 0xe017, 0xe016, 0x4e30, 0xe055, 0xf099, 0xe0c0,
+	0x0130, 0xaf06, 0x305c, 0xe0c1, 0x0132, 0xb615, 0x3e77, 0xa200,
+	0xe42e, 0x2803, 0xf1da, 0x2824, 0xf05a, 0xe0c0, 0x018f, 0xe01a,
+	0x3c5b, 0x2824, 0xe016, 0xf088, 0xe0c0, 0x011e, 0xa802, 0x2a41,
+	0xf038, 0xe419, 0x135c, 0x3c58, 0x2a1f, 0xf03b, 0xa201, 0x3e58,
+	0x2a5b, 0xb611, 0x3e5b, 0xf04b, 0x28d3, 0xa940, 0x3cd3, 0x2a3f,
+	0x462c, 0x4602, 0x2827, 0xf0eb, 0xe41e, 0x1212, 0x2ad9, 0xf02b,
+	0x28d2, 0x2ad3, 0xa803, 0xf02b, 0x2862, 0x1862, 0xa504, 0xa4fc,
+	0x0862, 0x3c5d, 0x2a3f, 0x462c, 0x4602, 0x2827, 0xf0db, 0x2893,
+	0x2ad9, 0xf02b, 0x28c8, 0x2ad3, 0xa811, 0xf02b, 0x2863, 0x1863,
+	0xa504, 0xa4fc, 0x0863, 0x3cce, 0x285d, 0x1862, 0x3c6c, 0x2a37,
+	0xf18a, 0xf17b, 0x2862, 0xe000, 0x022c, 0xe09e, 0xe160, 0x0020,
+	0x286c, 0x1937, 0xe40a, 0x0abb, 0x286c, 0x1907, 0xe40a, 0x0abe,
+	0x285d, 0xe40e, 0x0abf, 0xa244, 0xe40e, 0x0abf, 0xa246, 0x3c6c,
+	0x286c, 0xe01a, 0x3c5a, 0x28d3, 0xaf02, 0x3cd3, 0xe42e, 0xe162,
+	0x06c0, 0x2869, 0xe09a, 0x2b15, 0x3e5b, 0x2915, 0x4d0d, 0x4c5a,
+	0x4c58, 0x4c5b, 0x4c5e, 0xe01a, 0xe016, 0x3c59, 0x2858, 0xae04,
+	0x4c59, 0xcf02, 0x2858, 0xf258, 0x2a5b, 0xcf4b, 0x2115, 0x4d15,
+	0xcf4c, 0xf0ab, 0x2115, 0x4d15, 0xcf4e, 0x2115, 0x4d15, 0xcf50,
+	0x2115, 0x4d15, 0xcf52, 0xd1a0, 0x0001, 0xcb40, 0xa802, 0xf7e8,
+	0xcb4c, 0x3512, 0x3d12, 0xf0ab, 0xcb4e, 0x3512, 0x3d12, 0xcb50,
+	0x3512, 0x3d12, 0xcb52, 0x3512, 0x3d12, 0xe08a, 0x3c69, 0xe42e,
+	0xd1a0, 0x0001, 0xcb40, 0xa802, 0xf7e8, 0xa200, 0x3c5b, 0xe42e,
+	0xbacf, 0xe004, 0x0100, 0xba9e, 0xe42e, 0xa204, 0x2ac9, 0xb632,
+	0x3c00, 0xbacf, 0xe004, 0x0120, 0xba9e, 0xbac0, 0xbae7, 0xbae0,
+	0x2800, 0xba86, 0xbae2, 0xbae3, 0xbac0, 0xbac1, 0xbae0, 0x2c20,
+	0xba9e, 0xbae0, 0x2821, 0xa102, 0xe01a, 0xba80, 0xf07a, 0x2c20,
+	0xe41e, 0x0c83, 0x3c4e, 0x2821, 0x704e, 0xbae0, 0x287a, 0x2a7b,
+	0xba98, 0xbae0, 0xba99, 0xbae0, 0xbac0, 0xbae0, 0xa200, 0x7000,
+	0xbac0, 0xbac0, 0x2800, 0xa102, 0xf02a, 0xbac0, 0xbae0, 0xbac0,
+	0x2822, 0xba80, 0xf03a, 0x2823, 0xba80, 0x2800, 0xa102, 0xe40a,
+	0x0b4b, 0xbac0, 0xbac0, 0xbac0, 0xe41e, 0x0c70, 0xc872, 0x3c54,
+	0xe42e, 0xbacf, 0xe004, 0x01b0, 0xba9e, 0x2850, 0xa116, 0xf090,
+	0x2851, 0xa112, 0xf060, 0x283d, 0xa11e, 0xf030, 0xa202, 0xf11e,
+	0x2850, 0xa12c, 0xf0d0, 0x2851, 0xa124, 0xf0a0, 0x283d, 0xa13c,
+	0xf070, 0xa01e, 0xf030, 0xa204, 0xf04e, 0xa206, 0xf02e, 0xa208,
+	0xba8e, 0xe42e, 0xbacf, 0xe004, 0x01b5, 0xba9e, 0xbae0, 0xa204,
+	0xba86, 0xa202, 0xba84, 0xbae3, 0xbac0, 0xe41e, 0x0c70, 0xe42e,
+	0xbacf, 0xe004, 0x01b6, 0xba9e, 0x2824, 0xba82, 0x2c3b, 0xf0aa,
+	0x2c2b, 0xf038, 0xbae0, 0xf06e, 0x1c20, 0xf046, 0x1821, 0xf022,
+	0xbae0, 0xbac0, 0xbae0, 0x2c20, 0xe41e, 0x0c83, 0x3c4e, 0x2c2b,
+	0x704e, 0xbae0, 0xbae0, 0x2824, 0xa102, 0xf038, 0x2825, 0xba80,
+	0x2846, 0xba84, 0xe000, 0x0220, 0xe09e, 0x2907, 0x3c26, 0x2827,
+	0xba88, 0x2824, 0xe42a, 0x2828, 0xba84, 0xa102, 0x3c29, 0xa202,
+	0x5829, 0xa102, 0x3c2a, 0xe42e, 0x2836, 0xe408, 0x0c4f, 0xe41e,
+	0x0c70, 0xbacf, 0x2861, 0xa120, 0x3c4e, 0xa202, 0x704e, 0x2852,
+	0xe41e, 0x0c83, 0x3c4e, 0x28ea, 0x704e, 0x2827, 0xba88, 0x2848,
+	0xba80, 0xe42a, 0x2c3b, 0xf0aa, 0x2c2b, 0xf038, 0xbae0, 0xf06e,
+	0x1c20, 0xf046, 0x1821, 0xf022, 0xbae0, 0xbac0, 0xbae0, 0x2c20,
+	0xe41e, 0x0c83, 0x3c4e, 0x2c2b, 0x704e, 0xbae0, 0x2824, 0xba82,
+	0x2846, 0xba84, 0x2824, 0xe42a, 0x2828, 0xba84, 0xe42e, 0xe41e,
+	0x0c7a, 0xbacf, 0xa240, 0xba8a, 0x2c3b, 0xe008, 0x00ff, 0xba8e,
+	0xbae0, 0xbac0, 0xbac0, 0xbac0, 0xbac0, 0x2855, 0xf0a8, 0x2847,
+	0xba84, 0x2824, 0xba80, 0xbac3, 0x2827, 0xba88, 0xbac0, 0xf3ee,
+	0xa20e, 0xba84, 0xbae2, 0x2847, 0xba84, 0x2838, 0xba80, 0xbac2,
+	0x2834, 0xba80, 0x2835, 0xba80, 0x2836, 0xba80, 0xbac2, 0x2837,
+	0xba80, 0xbae0, 0xbac2, 0x2824, 0xba84, 0xbac1, 0x2825, 0xba80,
+	0xbae2, 0xbac0, 0x2847, 0xa10c, 0xf0b8, 0xa204, 0xba86, 0x287a,
+	0xaf04, 0xa102, 0xba90, 0xbae0, 0x287b, 0xaf04, 0xba90, 0x2838,
+	0xf10a, 0x2821, 0xe002, 0x03e9, 0xe016, 0xba80, 0x8421, 0xe182,
+	0x0708, 0xe018, 0xc70f, 0x7c20, 0xba8c, 0x2c3b, 0xaf10, 0xba82,
+	0xa200, 0x7036, 0x7036, 0x2827, 0xba88, 0xbac0, 0xa200, 0x3cea,
+	0x2836, 0xe418, 0x0c4f, 0x2846, 0xe000, 0x0220, 0xe09e, 0x2907,
+	0x3c26, 0xa202, 0x3c28, 0xa200, 0x3c29, 0x3c2a, 0xe42e, 0x28ea,
+	0xf0ba, 0xc868, 0xa80e, 0xf06a, 0xa110, 0xe012, 0x3c4e, 0xa200,
+	0x704e, 0xba9e, 0xbae0, 0xbae0, 0x2852, 0xe41e, 0x0c8c, 0x3c4e,
+	0x2aea, 0x724e, 0xa116, 0xf046, 0x28ea, 0xf02a, 0xbae0, 0x28ea,
+	0xf03a, 0x2827, 0xba88, 0xbae0, 0x28ea, 0xf02a, 0xbac1, 0xe42e,
+	0xbac0, 0xc868, 0xa80e, 0xe42a, 0xa110, 0xe012, 0x3c4e, 0xa2fe,
+	0x704e, 0xe42e, 0xc868, 0xa80e, 0xe42a, 0xa110, 0xe012, 0x3c4e,
+	0xa200, 0x704e, 0xe42e, 0xa102, 0xa201, 0xf05a, 0xaf02, 0xa003,
+	0xe408, 0x0c86, 0xe04a, 0xe42e, 0xa102, 0xa15e, 0xf0d6, 0xa166,
+	0xf0d6, 0xe002, 0x0129, 0xf0c6, 0xe002, 0x04a4, 0xf0b6, 0xe002,
+	0x1290, 0xf0a6, 0xf0be, 0xa20c, 0xe42e, 0xa20e, 0xe42e, 0xa212,
+	0xe42e, 0xa216, 0xe42e, 0xa21a, 0xe42e, 0xa21c, 0xe42e, 0xf049,
+	0x20d4, 0x4cd5, 0xcc72, 0x2816, 0xf048, 0xc872, 0x34d4, 0x3cd5,
+	0x2816, 0xae06, 0xe000, 0x046a, 0xe092, 0xc860, 0x3511, 0x3d11,
+	0x8b11, 0x0034, 0x8b11, 0x0038, 0x8b11, 0x0033, 0x8b11, 0x0035,
+	0x8b11, 0x0037, 0x8b11, 0x0036, 0x3e16, 0xae07, 0xe001, 0x046a,
+	0xe093, 0x2111, 0x4d11, 0xcc60, 0x8911, 0x0034, 0x8911, 0x0038,
+	0x8911, 0x0033, 0x8911, 0x0035, 0x8911, 0x0037, 0x8911, 0x0036,
+	0xe42e, 0xe41e, 0x140b, 0xe004, 0x00a4, 0x3c18, 0xa200, 0x3c19,
+	0xa200, 0x3c1a, 0x3c1b, 0x2816, 0xa201, 0x3e16, 0xe424, 0xa201,
+	0xe41e, 0x0ca7, 0xe42e, 0x2824, 0xe408, 0x0cf4, 0xe004, 0x006b,
+	0xba8c, 0xbaeb, 0xe40e, 0x0cf7, 0xa23e, 0xba88, 0xbaeb, 0xe41e,
+	0x0cfc, 0xe41e, 0x0d2f, 0xe42e, 0xc872, 0x34d4, 0x3cd5, 0x281a,
+	0xe40a, 0x0d1f, 0x2818, 0xe002, 0x00a4, 0x3c1c, 0xe41e, 0x149c,
+	0xd04c, 0x0000, 0xe004, 0x00a4, 0x3c18, 0xe41e, 0x1474, 0xe004,
+	0x0800, 0x3c1e, 0xe161, 0x0080, 0xe41e, 0x0d5d, 0xc872, 0x34d4,
+	0x3cd5, 0x281c, 0xa102, 0x3c1c, 0xf718, 0xe41e, 0x1474, 0xa203,
+	0xe41e, 0x0ca7, 0xc870, 0xe008, 0x07ff, 0x3c1e, 0xe161, 0x0080,
+	0xbadf, 0xe41e, 0x0d5d, 0xc872, 0x34d4, 0x3cd5, 0xe42e, 0x281b,
+	0xe40a, 0x0d4d, 0x2819, 0x3c1c, 0xe41e, 0x14b1, 0xd04c, 0x0000,
+	0xa200, 0x3c19, 0xe41e, 0x1487, 0xe004, 0x0800, 0x3c1e, 0xe161,
+	0x00c0, 0xe41e, 0x0d5d, 0xc872, 0x34d4, 0x3cd5, 0x281c, 0xa102,
+	0x3c1c, 0xe408, 0x0d3a, 0xe41e, 0x1487, 0xa205, 0xe41e, 0x0ca7,
+	0xc870, 0xe008, 0x07ff, 0x3c1e, 0xe161, 0x00c0, 0xbadf, 0xe41e,
+	0x0d5d, 0xc872, 0x34d4, 0x3cd5, 0xe42e, 0xe082, 0xcc76, 0xa201,
+	0xe41e, 0x0ca7, 0xa201, 0x281e, 0xaf0a, 0xe40a, 0x0d6d, 0xa102,
+	0xcc44, 0xe184, 0x0d6c, 0xc87a, 0xbabe, 0x281e, 0xa83e, 0xe42a,
+	0x3c1e, 0xa140, 0xe012, 0x3c1d, 0xc87a, 0x5c1d, 0x701e, 0xe42e,
+	0xa200, 0xe0c2, 0x0128, 0xa200, 0x3c39, 0xe0c0, 0x0414, 0xf308,
+	0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xa201, 0xae09,
+	0xa907, 0xae09, 0xa907, 0xae09, 0xa907, 0xae09, 0xa901, 0xae09,
+	0xa907, 0xae09, 0xa905, 0xae09, 0xa905, 0xe0c3, 0x0152, 0xa241,
+	0xae11, 0xa911, 0xae11, 0xa911, 0xe0c3, 0x0153, 0xa201, 0xae21,
+	0xa902, 0xae02, 0xa902, 0xae04, 0xa900, 0x3c4b, 0xe056, 0xe0c2,
+	0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xe42e,
+	0xe167, 0x0502, 0xe166, 0x0064, 0xd022, 0x0003, 0xe184, 0x0dba,
+	0x9e16, 0x3517, 0x3d17, 0xe42e, 0xe41e, 0x0e05, 0xe41e, 0x0eb7,
+	0xe41e, 0x0f6e, 0xe41e, 0x0fbb, 0xe004, 0x0702, 0xe096, 0x2313,
+	0x4f13, 0xe004, 0x0700, 0xe096, 0x2113, 0x4d13, 0x3513, 0x3d13,
+	0xe004, 0x0700, 0xe096, 0x3713, 0x3f13, 0x2839, 0xe0c2, 0x0072,
+	0x3c3a, 0xa002, 0x3c39, 0x183c, 0xf028, 0x3c39, 0xe004, 0x0400,
+	0x3c68, 0x3c69, 0xd008, 0x000d, 0xd009, 0x0400, 0xd00a, 0x0436,
+	0xa202, 0x3c66, 0xe0c2, 0x0106, 0xe0c2, 0x0139, 0xe41e, 0x024d,
+	0xe0c0, 0x0065, 0xaf06, 0xa80e, 0xe42a, 0xaf04, 0x30f4, 0xe180,
+	0xe0c1, 0x0068, 0xce21, 0xd112, 0x000c, 0xd111, 0x05c0, 0xd113,
+	0x0003, 0xca29, 0xf7f9, 0xe181, 0xe42e, 0xa200, 0xe0c2, 0x0128,
+	0xe0c0, 0x0050, 0xe049, 0xe008, 0x00ff, 0x3ccc, 0xaf11, 0xe009,
+	0x00ff, 0x3ecd, 0x46cc, 0x3ecc, 0x2837, 0xae02, 0x4c36, 0xae02,
+	0x4c35, 0xae06, 0x4c30, 0xae08, 0xa916, 0xe0c2, 0x0100, 0x2050,
+	0x4c51, 0xae08, 0xe0c2, 0x0101, 0xa200, 0xe41e, 0x1028, 0xe0c2,
+	0x0102, 0xe0c0, 0x0046, 0xe005, 0x0000, 0xae11, 0xe042, 0x2acd,
+	0xa805, 0xf05b, 0xe167, 0x0504, 0x2117, 0x4d17, 0xe0c2, 0x0103,
+	0x282c, 0xae06, 0xe0c2, 0x0104, 0xa200, 0xe0c2, 0x0105, 0xe0c0,
+	0x0064, 0x3c75, 0x2a1f, 0xb612, 0xe0c2, 0x0138, 0x2050, 0x4c51,
+	0xae08, 0x2a1f, 0xaa03, 0x4675, 0xa803, 0xf04b, 0x2051, 0x4c50,
+	0xae08, 0xe0c2, 0x0142, 0xe0c0, 0x0060, 0xa87e, 0xe0c2, 0x0143,
+	0xe0c0, 0x0069, 0xe0c2, 0x014f, 0xe004, 0x3211, 0xae20, 0xe00a,
+	0x2100, 0xe0c2, 0x0155, 0xe004, 0x9211, 0xae20, 0xe00a, 0x2100,
+	0xe0c2, 0x0158, 0xe004, 0x1000, 0xae20, 0xe00a, 0x0000, 0xe0c2,
+	0x0156, 0xe0c2, 0x0159, 0xe004, 0x0104, 0xe0c2, 0x0154, 0xe0c2,
+	0x0157, 0xa202, 0xe0c2, 0x015a, 0x2827, 0xae04, 0xe0c2, 0x0176,
+	0xe049, 0xae02, 0xae05, 0xe042, 0xa004, 0xe0c2, 0x0177, 0xa200,
+	0x2acc, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2acc, 0xa805, 0xf03b,
+	0xe00a, 0x0009, 0x2acc, 0xa809, 0xf03b, 0xe00a, 0x0020, 0x2acc,
+	0xa811, 0xf03b, 0xe00a, 0x0040, 0xe0c2, 0x040c, 0x2a2c, 0xe004,
+	0x0077, 0xf039, 0xe004, 0x0070, 0xe0c2, 0x017c, 0xa200, 0xe0c2,
+	0x017d, 0xa200, 0xe0c2, 0x0113, 0xe166, 0x0510, 0x2116, 0x4d16,
+	0xe0c2, 0x011f, 0xe004, 0x003f, 0xe0c2, 0x012a, 0xe42e, 0xa200,
+	0xe0c2, 0x0312, 0xa200, 0xe0c2, 0x0320, 0xa204, 0xae02, 0x4c25,
+	0xe0c2, 0x0303, 0xa200, 0xe0c2, 0x0308, 0xa200, 0xe0c2, 0x030a,
+	0xe0c2, 0x030b, 0xe0c2, 0x030d, 0xe004, 0x0055, 0xe0c2, 0x030c,
+	0xa202, 0xe0c2, 0x0302, 0x283a, 0xe0c2, 0x0380, 0xa200, 0xe0c2,
+	0x0302, 0x282c, 0xf09a, 0xe0c0, 0x0414, 0xe418, 0x018c, 0xe0c0,
+	0x0414, 0xe41a, 0x0f43, 0xa200, 0x2a30, 0xb636, 0x2a35, 0xb632,
+	0xa904, 0xae0a, 0x4c0d, 0xe0c2, 0x0180, 0xa200, 0xe0c2, 0x0184,
+	0xe0c2, 0x0185, 0x2827, 0xaf02, 0x0844, 0xa51e, 0xe049, 0xae02,
+	0xe042, 0xe000, 0x026e, 0xe09e, 0x290f, 0xe0c2, 0x0186, 0xa206,
+	0x3c06, 0x2907, 0xae02, 0xc70f, 0x7c06, 0xe008, 0xffff, 0x2a0e,
+	0xf03b, 0xe049, 0xf02e, 0x2b07, 0xae14, 0xe056, 0xae14, 0xe056,
+	0xe0c2, 0x0181, 0xe0c2, 0x0182, 0x2827, 0xe000, 0x036c, 0xe09c,
+	0x2906, 0xae20, 0xe000, 0x1000, 0xaf1a, 0xae20, 0xe00a, 0x0190,
+	0xe0c2, 0x0183, 0x2827, 0xe000, 0x036c, 0xe09c, 0x2906, 0xe0c2,
+	0x0189, 0x280e, 0xe0c2, 0x018a, 0xa200, 0xe0c2, 0x018b, 0xe004,
+	0x0702, 0xe096, 0x2113, 0x4d13, 0xe0c2, 0x018c, 0x283a, 0xe0c2,
+	0x018d, 0xa200, 0x2a30, 0xb636, 0x2a35, 0xb632, 0xae06, 0xa902,
+	0xe0c2, 0x018e, 0xe42e, 0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151,
+	0xf7e8, 0xe167, 0x01a0, 0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17,
+	0xe009, 0x00ff, 0xae21, 0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101,
+	0xe0c3, 0x015d, 0x283a, 0xa53e, 0xa400, 0xae20, 0xe167, 0x01a2,
+	0x2b07, 0xaf11, 0xe009, 0x001b, 0xe056, 0xe0c2, 0x015c, 0xa202,
+	0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xe42e, 0xa216, 0xae08,
+	0x4c24, 0xae06, 0xe0c2, 0x0204, 0x2050, 0x4c51, 0xae08, 0xe0c2,
+	0x0205, 0xa200, 0xe0c2, 0x0208, 0xa200, 0x2a35, 0xb632, 0xe0c2,
+	0x0210, 0xe0c1, 0x0046, 0xe004, 0x0040, 0xae10, 0xe042, 0x2acd,
+	0xa809, 0xf05b, 0xe167, 0x0506, 0x2117, 0x4d17, 0xe0c2, 0x0211,
+	0xe0c1, 0x0046, 0xe004, 0x0080, 0xae10, 0xe042, 0x2acd, 0xa811,
+	0xf05b, 0xe167, 0x0508, 0x2117, 0x4d17, 0xe0c2, 0x0212, 0xa200,
+	0xe0c2, 0x0215, 0xa202, 0xae10, 0xe41e, 0x1028, 0xe0c2, 0x0213,
+	0x2839, 0xe0c2, 0x020b, 0xe0c2, 0x0214, 0xa200, 0xe0c2, 0x021c,
+	0xe004, 0x0700, 0xe096, 0x2113, 0x4d13, 0xe0c2, 0x021d, 0xa200,
+	0xe0c2, 0x021e, 0xe42e, 0x2830, 0xae06, 0x4c24, 0xae02, 0xcf00,
+	0x2050, 0x4c51, 0xae08, 0xcf60, 0x2837, 0xcf68, 0x2822, 0xae02,
+	0x4c23, 0xae02, 0x4c37, 0xcf24, 0x2828, 0xcf46, 0xe0c1, 0x0046,
+	0xe004, 0x00a0, 0xae10, 0xe042, 0x2acd, 0xa803, 0xf05b, 0xe167,
+	0x0502, 0x2117, 0x4d17, 0xcf44, 0xe42e, 0x28ce, 0xae0c, 0x4cce,
+	0xae0c, 0x4cce, 0xe0c2, 0x0115, 0x2866, 0xa802, 0xe0c2, 0x0131,
+	0x2866, 0xaf02, 0x3c66, 0x2858, 0xe0c2, 0x0114, 0xe016, 0x4403,
+	0xe418, 0x0ff3, 0xe42e, 0x2868, 0xe09a, 0x2a5b, 0x3f15, 0xe162,
+	0x0190, 0x9e12, 0x3515, 0x3d15, 0xcf4c, 0xf0db, 0x9e12, 0x3515,
+	0x3d15, 0xcf4e, 0x9e12, 0x3515, 0x3d15, 0xcf50, 0x9e12, 0x3515,
+	0x3d15, 0xcf52, 0x285b, 0xcf4a, 0xd1a0, 0x0002, 0xcb41, 0xa805,
+	0xf7e9, 0xe08a, 0x3c68, 0xe004, 0x06db, 0x2a5b, 0xb616, 0xe0c2,
+	0x0309, 0xe42e, 0xe0c0, 0x0111, 0xf7e8, 0xe0c0, 0x0118, 0x3001,
+	0xaf02, 0x3002, 0xaf02, 0x3003, 0x2854, 0x4c03, 0x3c54, 0xe42e,
+	0xe0c1, 0x0044, 0xa80f, 0xe056, 0xe42e, 0xe0c1, 0x0044, 0xaf0d,
+	0xae03, 0xe056, 0xa87e, 0xe42e, 0xa203, 0xe0c3, 0x040d, 0xe0c1,
+	0x0420, 0xa803, 0xf7db, 0xe166, 0x0600, 0xe167, 0x0500, 0x283c,
+	0xf1b6, 0xa102, 0xcc44, 0xe184, 0x105a, 0xa200, 0xe41e, 0x1028,
+	0xaf04, 0xe41e, 0x102d, 0xae20, 0x4c70, 0x9f17, 0x2050, 0x4c51,
+	0xae08, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0xe0c0,
+	0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0, 0x0060, 0xa83e, 0xa203,
+	0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018, 0xe000, 0x0500, 0xe09e,
+	0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200, 0xe41e, 0x1028, 0xaf04,
+	0xe0c1, 0x0061, 0xaf21, 0xa807, 0xa105, 0xf025, 0xe04a, 0xe41e,
+	0x102d, 0xe0c1, 0x0044, 0xaf17, 0xa803, 0xe40b, 0x1088, 0xa81e,
+	0xae20, 0xe0c1, 0x0061, 0xe009, 0x1fff, 0xe056, 0x9f17, 0xe0c0,
+	0x0064, 0xa802, 0xf048, 0x2050, 0x4c51, 0xf03e, 0x2051, 0x4c50,
+	0xae08, 0x9f17, 0xe0c0, 0x006a, 0x9f17, 0xe0c0, 0x006b, 0x9f17,
+	0xe0c0, 0x006c, 0x9f17, 0xa201, 0xe0c3, 0x040d, 0xe42e, 0xcca4,
+	0xc786, 0xe018, 0xe000, 0x0600, 0xe09c, 0x2116, 0x4d06, 0xe42e,
+	0xa232, 0x3cdd, 0xa240, 0x3c84, 0xa204, 0x3c86, 0xa23e, 0x2aca,
+	0xf03b, 0xe0c0, 0x0072, 0x3c85, 0xa20c, 0x3c87, 0xe004, 0x029c,
+	0x3c88, 0x2840, 0x2a52, 0x3c89, 0x3e8f, 0x283d, 0x3c8b, 0x3cbe,
+	0xe004, 0x6000, 0x2acb, 0xf03b, 0xe0c0, 0x0073, 0x3c8c, 0x2889,
+	0xe016, 0x3c8a, 0xf06a, 0x288b, 0x3c89, 0xe004, 0x1000, 0x3c8c,
+	0x8421, 0xe182, 0x7530, 0xe018, 0xae02, 0x2e20, 0xe41e, 0x1311,
+	0x3c98, 0x8498, 0x8280, 0xe018, 0xa279, 0xe41e, 0x12fa, 0x3498,
+	0x3c99, 0xae06, 0x2a84, 0xe41e, 0x12fa, 0x349e, 0x3c9f, 0xa202,
+	0x3c8d, 0xa205, 0x1a44, 0xae03, 0xa011, 0x3e94, 0x2a8f, 0x5a94,
+	0xe013, 0x36ae, 0x3eaf, 0x28bc, 0x2abb, 0xf049, 0xe41e, 0x12a1,
+	0x64dd, 0x3c90, 0xa004, 0x6086, 0x6485, 0x3c91, 0xe41e, 0x12c5,
+	0xe42e, 0x34c0, 0x3cbf, 0x28c0, 0xa002, 0x3cc0, 0x2cbf, 0xc710,
+	0x7cc0, 0xe008, 0xffff, 0xa002, 0xaf02, 0x3c8b, 0x18be, 0xe42a,
+	0x288b, 0x3cbe, 0x28bf, 0x2ac0, 0x3c20, 0x3e21, 0xa200, 0x3c2b,
+	0x8421, 0xe182, 0x7530, 0xe018, 0xae02, 0x2e20, 0xe41e, 0x1311,
+	0x3c98, 0x8498, 0x8280, 0xe018, 0xa279, 0xe41e, 0x12fa, 0x3498,
+	0x3c99, 0xae06, 0x2a84, 0xe41e, 0x12fa, 0x349e, 0x3c9f, 0xa200,
+	0x3cb8, 0x34a2, 0x3ca3, 0x2889, 0xe428, 0xe016, 0x3c8a, 0x288b,
+	0x3c89, 0xe42e, 0x3cba, 0x2a89, 0xe046, 0xf028, 0xe42e, 0x28b9,
+	0x2aba, 0xe046, 0xf034, 0xa200, 0x3cb9, 0x28ba, 0x3c89, 0x3c40,
+	0x283f, 0xe42a, 0x2889, 0xe016, 0x3c8a, 0xf03a, 0x2a8b, 0x3e89,
+	0x2a89, 0x28b9, 0xe045, 0xf0c6, 0x20a6, 0x4ca7, 0xe41e, 0x12fa,
+	0x34aa, 0x3cab, 0x10a6, 0x1ca7, 0xe012, 0x34a8, 0x3ca9, 0xe42e,
+	0x3cbd, 0xf028, 0x3c3f, 0x283f, 0xe42a, 0x2880, 0x2abd, 0xe046,
+	0xe42a, 0x3e80, 0x8421, 0xe182, 0x7530, 0xe018, 0xae02, 0x2e20,
+	0xe41e, 0x1311, 0x3c98, 0x8498, 0x8280, 0xe018, 0xa279, 0xe41e,
+	0x12fa, 0x3498, 0x3c99, 0xae06, 0x2a84, 0xe41e, 0x12fa, 0x349e,
+	0x3c9f, 0xa200, 0x3cb8, 0x34a2, 0x3ca3, 0xe42e, 0x2a3f, 0xe42b,
+	0xf042, 0xa201, 0x3ebb, 0xe42e, 0x3cbc, 0x3c90, 0xa203, 0x3ebb,
+	0xe42e, 0xe42e, 0x282c, 0x3c8e, 0xa201, 0x3ead, 0xe418, 0x1283,
+	0xa200, 0x3ca0, 0x3ca1, 0x3cdc, 0x288e, 0xf238, 0x288d, 0xf05a,
+	0xa200, 0x3c8d, 0x2890, 0xf31e, 0x2889, 0xa102, 0xf7ca, 0x2abb,
+	0xf03b, 0x2890, 0xf2ae, 0x848f, 0x82b8, 0xe019, 0xe04a, 0xaf02,
+	0x00a2, 0x0ca3, 0xe41e, 0x1311, 0xa21f, 0x3e94, 0x2a89, 0xc70f,
+	0x7e94, 0xe009, 0xffff, 0xa405, 0xe046, 0x6086, 0x64dd, 0xf15e,
+	0xa200, 0x3c9c, 0x3c9d, 0x28d9, 0x3006, 0xaf02, 0x5406, 0xf08a,
+	0x2891, 0xa104, 0x6093, 0x2a91, 0xa005, 0xe066, 0xf02e, 0x2891,
+	0x2aad, 0xf02b, 0x2885, 0x3c93, 0x2aad, 0xe42e, 0xc872, 0xe41e,
+	0x12ce, 0x288e, 0xf0ea, 0x20a0, 0x4ca1, 0xc710, 0x7c8f, 0xe008,
+	0xffff, 0xa002, 0xaf02, 0x3c91, 0x20a0, 0x4ca1, 0x00a2, 0x0ca3,
+	0x34a2, 0x3ca3, 0x28b8, 0xa002, 0x3cb8, 0x288e, 0xf028, 0x3cb8,
+	0x288e, 0xf0f8, 0x2a89, 0xa103, 0x20a6, 0x4ca7, 0xe41e, 0x12fa,
+	0x34aa, 0x3cab, 0x10a6, 0x1ca7, 0xe012, 0x34a8, 0x3ca9, 0xf0ae,
+	0x22a8, 0x4ea9, 0x12aa, 0x1eab, 0x288a, 0xb606, 0xb611, 0x36a8,
+	0x3ea9, 0xe42e, 0x28ea, 0xf038, 0x2893, 0x3cd7, 0x2aea, 0x1a52,
+	0xa007, 0xf0b5, 0x28d1, 0x3cd2, 0xe42b, 0xa103, 0x28d0, 0x3cd2,
+	0xe42b, 0x28cf, 0x3cd2, 0xe42e, 0x229c, 0x4e9d, 0x209e, 0x4c9f,
+	0xe041, 0xf0c7, 0xe045, 0xe045, 0x2893, 0xf0f5, 0x369c, 0x3e9d,
+	0xa002, 0x6086, 0x6485, 0x3c93, 0xf08e, 0x369c, 0x3e9d, 0x2893,
+	0xa102, 0x6086, 0x6485, 0x3c93, 0x28dc, 0xa002, 0x3cdc, 0x2ad9,
+	0xf08b, 0xa103, 0xf1cb, 0xa103, 0xf07b, 0xa103, 0xf0ab, 0xf19e,
+	0x2893, 0x3cc8, 0xf16e, 0x28db, 0xf12a, 0xa200, 0x3cdb, 0xf06e,
+	0x28dc, 0x18da, 0xf0c4, 0xa200, 0x3cdc, 0x2ad7, 0xa105, 0x6293,
+	0x28d7, 0xa004, 0xe066, 0x3c93, 0x3cc8, 0xf03e, 0x28d7, 0x3cc8,
+	0x28c8, 0x3cd7, 0x28ea, 0xf078, 0x28c8, 0x3ccf, 0x3cd0, 0x3cd1,
+	0x3cd2, 0xe42e, 0x28d1, 0x2ad9, 0xa805, 0xf029, 0x3cc8, 0x3cd2,
+	0x28d0, 0x3cd1, 0x28cf, 0x3cd0, 0x28d7, 0x3ccf, 0x28c8, 0xe42e,
+	0x00a0, 0x0ca1, 0x34a0, 0x3ca1, 0x286f, 0x1892, 0x009c, 0x0c9d,
+	0x349c, 0x3c9d, 0xe42e, 0x20a8, 0x4ca9, 0x10a6, 0x1ca7, 0x848c,
+	0xe41e, 0x1348, 0x0098, 0x0c99, 0xf052, 0x2aac, 0xf039, 0xa203,
+	0x3ead, 0xe41e, 0x12e0, 0x2298, 0x4e99, 0xaf07, 0xe062, 0x349a,
+	0x3c9b, 0xc710, 0x7c8f, 0xe008, 0xffff, 0xa002, 0xaf02, 0x3c92,
+	0xe42e, 0x8489, 0x2098, 0x4c99, 0xe41e, 0x133c, 0x8487, 0xe41e,
+	0x133c, 0x2a89, 0xa103, 0x0a87, 0xe41e, 0x12fa, 0x349a, 0x3c9b,
+	0x288f, 0x3cb0, 0x209a, 0x4c9b, 0xae04, 0x009a, 0x0c9b, 0xae02,
+	0xc70f, 0x7cb0, 0xe008, 0xffff, 0xaf08, 0xa010, 0xaf08, 0x0844,
+	0xa51e, 0x0888, 0xe09e, 0x2907, 0xe42e, 0x8480, 0x8281, 0xe018,
+	0x34a4, 0x3ca5, 0xa200, 0x34a6, 0x3ca7, 0xe42e, 0x1098, 0x1c99,
+	0x00a6, 0x0ca7, 0xa27f, 0xae31, 0xe066, 0x34a6, 0x3ca7, 0x22ae,
+	0x4eaf, 0xe046, 0xf032, 0x36a6, 0x3ea7, 0x20a6, 0x28a7, 0xe42e,
+	0x2a81, 0xe42b, 0x22a4, 0x4ea5, 0x12a6, 0x1ea7, 0xe066, 0xf051,
+	0x2aac, 0xf039, 0xa203, 0x3ead, 0x2282, 0x4e83, 0xe42b, 0x22a4,
+	0x4ea5, 0x12a6, 0x1ea7, 0x0298, 0x0e99, 0x1282, 0x1e83, 0xa401,
+	0xe062, 0xe42e, 0x3eb0, 0xa201, 0xf032, 0xe012, 0xa203, 0x3eb4,
+	0x3cb1, 0xaf20, 0xc70f, 0x7cb0, 0x3cb2, 0xaf20, 0xae20, 0x4cb1,
+	0xc70f, 0x7cb0, 0x3cb3, 0x20b2, 0x4cb3, 0x2ab4, 0xe42b, 0xe012,
+	0xe42e, 0x36b0, 0x3eb1, 0xa201, 0x3eb2, 0x22b0, 0x4eb1, 0x5ab2,
+	0xe045, 0xf061, 0x2ab2, 0xa003, 0x3eb2, 0xa121, 0xf775, 0x2ab2,
+	0xf039, 0xa200, 0xe42e, 0xa103, 0x3eb2, 0xcc45, 0xa201, 0x3eb3,
+	0xe184, 0x1339, 0x2ab3, 0xae03, 0x3eb3, 0x22b0, 0x4eb1, 0x5ab2,
+	0xe045, 0xf061, 0xe013, 0xe04a, 0x2ab3, 0xa003, 0x3eb3, 0x2ab2,
+	0xa103, 0x3eb2, 0x28b3, 0xe42e, 0xae02, 0x34b1, 0xe008, 0xffff,
+	0xaf02, 0x3cb0, 0x82b1, 0xe018, 0xae1e, 0x82b0, 0xe01c, 0xe42e,
+	0xae02, 0x34b1, 0xe008, 0xffff, 0xaf02, 0x3cb0, 0x82b0, 0xe018,
+	0xaf1e, 0x82b1, 0xe01c, 0xe42e, 0xa200, 0x3cc1, 0x3cc3, 0x3cc4,
+	0xe42e, 0xa200, 0x3c42, 0xe42e, 0x28c5, 0xf1f8, 0x2842, 0x1841,
+	0xf3d2, 0x2853, 0x18c1, 0xf3a4, 0x28c1, 0x08c6, 0x18c7, 0xf0b4,
+	0x28c3, 0xa002, 0xc70f, 0x7cc6, 0xaf20, 0x3cc3, 0x3cc1, 0x2841,
+	0x3c42, 0xf2ae, 0x2842, 0xa002, 0x3c42, 0x28c1, 0x08c6, 0xc70f,
+	0x7cc7, 0xaf20, 0x3cc1, 0xf20e, 0x2842, 0x1841, 0xf1f2, 0x2853,
+	0x18c2, 0xf1c4, 0x28c2, 0x08c6, 0x1852, 0xf0c4, 0x28c4, 0xa002,
+	0xc70f, 0x7cc6, 0xaf20, 0x3cc4, 0x08c7, 0x3cc2, 0x2841, 0x3c42,
+	0xf0be, 0x2842, 0xa002, 0x3c42, 0x28c2, 0x08c6, 0xc70f, 0x7c52,
+	0xaf20, 0x3cc2, 0xf01e, 0xa202, 0xe42e, 0xa200, 0xe42e, 0x2802,
+	0xf12a, 0xd188, 0x0001, 0x28ea, 0xa002, 0x3cea, 0xcf64, 0x28e8,
+	0xa002, 0x3ce8, 0x1850, 0xf078, 0xd1b3, 0x0004, 0x3ce8, 0x28e9,
+	0xa002, 0x3ce9, 0x2803, 0xe42a, 0x2853, 0xa002, 0x3c53, 0xe42e,
+	0x28e6, 0x3ce7, 0x28e5, 0x3ce6, 0x28e4, 0x3ce5, 0x28e3, 0x3ce4,
+	0x28e2, 0x3ce3, 0x286c, 0xa83e, 0xae02, 0x4c5a, 0xae02, 0x4c58,
+	0x3ce2, 0x2a3f, 0x462c, 0x28e7, 0x3058, 0xe429, 0xaf02, 0x305a,
+	0xaf02, 0xae3e, 0xaf3e, 0x3c6c, 0xe42e, 0xa200, 0x3c13, 0xe0c0,
+	0x0060, 0x3410, 0x3c11, 0xe0c0, 0x0061, 0xae04, 0x3c12, 0xe41e,
+	0x13fa, 0xe41e, 0x1533, 0xd071, 0x202a, 0xe181, 0xe42e, 0xd030,
+	0x0000, 0xd034, 0x0000, 0xd033, 0x0000, 0xd035, 0x0000, 0xd036,
+	0x007f, 0xd037, 0x0000, 0xc872, 0xa130, 0xcc72, 0xc870, 0xa130,
+	0xcc70, 0xe42e, 0xd030, 0x0000, 0xd034, 0x0000, 0xd033, 0x0000,
+	0xd035, 0x0000, 0xd036, 0x007f, 0xd037, 0x0000, 0xd038, 0x0000,
+	0xa200, 0x3c72, 0xe42e, 0xa210, 0xe000, 0x046a, 0xe094, 0xa200,
+	0xc703, 0x3d12, 0xe004, 0x0080, 0xc702, 0x3d12, 0xe000, 0x003f,
+	0x3d12, 0xa200, 0xc703, 0x3d12, 0xe004, 0x00c0, 0xc702, 0x3d12,
+	0xe000, 0x003f, 0x3d12, 0xe42e, 0x2816, 0xf06a, 0xa102, 0xf0ba,
+	0xa102, 0xf0ea, 0xe470, 0xe004, 0x0080, 0xe41e, 0x143c, 0xd04c,
+	0x0000, 0xe470, 0xe41e, 0x149c, 0xd04c, 0x0000, 0xe470, 0xe41e,
+	0x14b1, 0xd04c, 0x0000, 0xe470, 0xce24, 0xd111, 0x0000, 0xe082,
+	0x3c14, 0xe004, 0x0048, 0xe092, 0xd027, 0x0000, 0xe41e, 0x153d,
+	0xd027, 0x0001, 0x2010, 0x4c11, 0x2e13, 0xae11, 0xe042, 0xce20,
+	0x2004, 0x4c05, 0x8111, 0x9f01, 0xe0c0, 0x0043, 0xa806, 0xae02,
+	0xa020, 0xce26, 0xca28, 0xf7f8, 0x2c13, 0xe000, 0x0002, 0x3c13,
+	0x1c12, 0xf084, 0x2ab6, 0xf05b, 0xa203, 0xe0c3, 0x0074, 0xf02e,
+	0x3c13, 0x2010, 0x4c11, 0x2e13, 0xae11, 0xe042, 0x9f01, 0x3404,
+	0x3c05, 0x2814, 0xe092, 0xe42e, 0xe0c0, 0x0046, 0x2a18, 0xae11,
+	0xe042, 0xce20, 0xd111, 0x0080, 0xd112, 0x0040, 0xd113, 0x0013,
+	0xca28, 0xf7f8, 0x2818, 0xe000, 0x0001, 0x3c18, 0xe42e, 0xe167,
+	0x0704, 0x2517, 0x4d17, 0x2e19, 0xae11, 0xe042, 0xce20, 0xd111,
+	0x00c0, 0xd112, 0x0040, 0xd113, 0x0013, 0xca28, 0xf7f8, 0x2819,
+	0xe000, 0x0001, 0x3c19, 0xe42e, 0xe0c0, 0x0046, 0x2a18, 0xae11,
+	0xe042, 0xce20, 0xd111, 0x0080, 0xd112, 0x0040, 0xd113, 0x0012,
+	0xca28, 0xf7f8, 0x2818, 0xe000, 0x0001, 0x3c18, 0xa202, 0x3c1a,
+	0xe42e, 0x287c, 0xf1f8, 0xe167, 0x0704, 0x2517, 0x4d17, 0x2e19,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x00c0, 0xd112, 0x0040, 0xd113,
+	0x0012, 0xca28, 0xf7f8, 0x2819, 0xe000, 0x0001, 0x3c19, 0xe167,
+	0x0706, 0x2317, 0x4f17, 0xae05, 0x1e19, 0xf061, 0xa202, 0x3c1b,
+	0x3c7c, 0xa200, 0xe42e, 0xa202, 0x3c1b, 0xe42e, 0xc868, 0xaf06,
+	0xc867, 0xe003, 0x0000, 0xae05, 0xe042, 0x3c4c, 0xc86e, 0xd037,
+	0x0080, 0xbad7, 0xcc6e, 0xe004, 0x0080, 0xe41e, 0x143c, 0xe004,
+	0x0049, 0xe092, 0x9e01, 0x2210, 0x4e11, 0xe045, 0xf0b9, 0xe004,
+	0x0200, 0x184c, 0x2a12, 0xae11, 0xe045, 0x2010, 0x4c11, 0xe042,
+	0xf04e, 0x084c, 0xe002, 0x0200, 0x9f01, 0x3404, 0x3c05, 0xe42e,
+	0xc866, 0xcc78, 0xc860, 0xcc7a, 0xd111, 0x0000, 0xe004, 0x0048,
+	0xe092, 0xd027, 0x0000, 0xe41e, 0x153d, 0xd027, 0x0001, 0x2010,
+	0x4c11, 0x2e13, 0xae11, 0xe042, 0xce20, 0x2004, 0x4c05, 0x8111,
+	0xd112, 0x0080, 0xe0c0, 0x0043, 0xa806, 0xae02, 0xa020, 0xce26,
+	0xca28, 0xf7f8, 0xc868, 0xaf06, 0xc867, 0xe003, 0x0000, 0xae05,
+	0xe042, 0x2210, 0x4e11, 0xe042, 0x2e13, 0xae11, 0xe042, 0x9f01,
+	0x3404, 0x3c05, 0xe42e, 0x2010, 0x4c11, 0x2e13, 0xae11, 0xe042,
+	0xe0c2, 0x0049, 0x3404, 0x3c05, 0xe42e, 0xe0c1, 0x0043, 0xa809,
+	0xe429, 0xa200, 0x3c15, 0x2ab6, 0xf2eb, 0x2c13, 0xae10, 0x2e12,
+	0xae11, 0xe045, 0xe003, 0x0200, 0xe423, 0xa203, 0xe0c3, 0x0074,
+	0x2004, 0x4c05, 0xe0c2, 0x0049, 0xa200, 0x3c13, 0x2010, 0x4c11,
+	0x3404, 0x3c05, 0x2ade, 0xe42b, 0xe0c0, 0x005c, 0xe008, 0x8000,
+	0xe42a, 0xe0c0, 0x005d, 0xe00a, 0x8000, 0xe0c2, 0x005d, 0xa202,
+	0xce00, 0xe0c1, 0x005d, 0xe009, 0x8000, 0xf7c9, 0xe0c0, 0x0004,
+	0xf798, 0xe42e, 0x2004, 0x4c05, 0x9e81, 0xe045, 0xf041, 0x2c12,
+	0xae10, 0xe041, 0xe003, 0x0200, 0xe421, 0x2815, 0xf748, 0xe0c0,
+	0x005c, 0xe008, 0x8000, 0xf6fa, 0xe0c0, 0x005d, 0xe00a, 0x8000,
+	0xe0c2, 0x005d, 0xa202, 0xce00, 0x3c15, 0xf65e, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0080, 0x0060, 0x0008, 0x0006,
+	0x00b0, 0x0090, 0x000b, 0x0009, 0x0160, 0x0120, 0x0016, 0x0012,
+	0x02c0, 0x0240, 0x0058, 0x0012, 0x0580, 0x0480, 0x0160, 0x0012,
+	0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+	0x0063, 0x000d, 0x000f, 0x0011, 0x0013, 0x0015, 0x0017, 0x0000,
+	0xffff, 0xfffe, 0x0001, 0x0002, 0x0000, 0x0002, 0xffff, 0xffff,
+	0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xfffe,
+	0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe, 0xfffe,
+	0xfffe, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd, 0xfffd,
+	0xfffd, 0xfffd, 0xfffd, 0xfffd, 0x0000, 0x0001, 0x0001, 0x0001,
+	0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0001, 0x0002,
+	0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002, 0x0002,
+	0x0002, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003, 0x0003,
+	0x0003, 0x0002, 0x0001, 0xfffb, 0x0200, 0x0000, 0x0008, 0x0200,
+	0x0000, 0x0010, 0x0200, 0x0008, 0x0020, 0x0200, 0x0010, 0x0040,
+	0x0200, 0x0020, 0x0080, 0x0200, 0x0040, 0x00c0, 0x0200, 0x0060,
+	0x0100, 0x0200, 0x0080, 0x0140, 0x0200, 0x00c0, 0x0180, 0x0200,
+	0x0100, 0x01c0, 0x0200, 0x0140, 0x0200, 0x0200, 0x0180, 0x0280,
+	0x0200, 0x0200, 0x0300, 0x0200, 0x0200, 0x0300, 0x0200, 0x0200,
+	0x0300, 0x0200, 0x0200, 0x0300, 0x001a, 0x0019, 0x0018, 0x0017,
+	0x0016, 0x0015, 0x0014, 0x0013, 0x0012, 0x0011, 0x0010, 0x000f,
+	0x000e, 0x000d, 0x000c, 0x000a, 0x0000, 0x0001, 0x0008, 0x0010,
+	0x0009, 0x0002, 0x0003, 0x000a, 0x0011, 0x0018, 0x0020, 0x0019,
+	0x0012, 0x000b, 0x0004, 0x0005, 0x000c, 0x0013, 0x001a, 0x0021,
+	0x0028, 0x0030, 0x0029, 0x0022, 0x001b, 0x0014, 0x000d, 0x0006,
+	0x0007, 0x000e, 0x0015, 0x001c, 0x0023, 0x002a, 0x0031, 0x0038,
+	0x0039, 0x0032, 0x002b, 0x0024, 0x001d, 0x0016, 0x000f, 0x0017,
+	0x001e, 0x0025, 0x002c, 0x0033, 0x003a, 0x003b, 0x0034, 0x002d,
+	0x0026, 0x001f, 0x0027, 0x002e, 0x0035, 0x003c, 0x003d, 0x0036,
+	0x002f, 0x0037, 0x003e, 0x003f, 0x0000, 0x0008, 0x0010, 0x0018,
+	0x0001, 0x0009, 0x0002, 0x000a, 0x0011, 0x0019, 0x0020, 0x0028,
+	0x0030, 0x0038, 0x0039, 0x0031, 0x0029, 0x0021, 0x001a, 0x0012,
+	0x0003, 0x000b, 0x0004, 0x000c, 0x0013, 0x001b, 0x0022, 0x002a,
+	0x0032, 0x003a, 0x0023, 0x002b, 0x0033, 0x003b, 0x0014, 0x001c,
+	0x0005, 0x000d, 0x0006, 0x000e, 0x0015, 0x001d, 0x0024, 0x002c,
+	0x0034, 0x003c, 0x0025, 0x002d, 0x0035, 0x003d, 0x0016, 0x001e,
+	0x0007, 0x000f, 0x0017, 0x001f, 0x0026, 0x002e, 0x0036, 0x003e,
+	0x0027, 0x002f, 0x0037, 0x003f, 0x0000, 0x0001, 0x0002, 0x0003,
+	0x0008, 0x0009, 0x0010, 0x0011, 0x000a, 0x000b, 0x0004, 0x0005,
+	0x0006, 0x0007, 0x000f, 0x000e, 0x000d, 0x000c, 0x0013, 0x0012,
+	0x0018, 0x0019, 0x0020, 0x0021, 0x001a, 0x001b, 0x0014, 0x0015,
+	0x0016, 0x0017, 0x001c, 0x001d, 0x001e, 0x001f, 0x0022, 0x0023,
+	0x0028, 0x0029, 0x0030, 0x0031, 0x002a, 0x002b, 0x0024, 0x0025,
+	0x0026, 0x0027, 0x002c, 0x002d, 0x002e, 0x002f, 0x0032, 0x0033,
+	0x0038, 0x0039, 0x003a, 0x003b, 0x0034, 0x0035, 0x0036, 0x0037,
+	0x003c, 0x003d, 0x003e, 0x003f, 0x0010, 0x0010, 0x0010, 0x0010,
+	0x0010, 0x0010, 0x0010, 0x0010, 0x0010, 0x0010, 0x0010, 0x0010,
+	0x000e, 0x000e, 0x000e, 0x000e, 0x000c, 0x000c, 0x000c, 0x000c,
+	0x000a, 0x000a, 0x000a, 0x000a, 0x0008, 0x0008, 0x0008, 0x0008,
+	0x0008, 0x0008, 0x0008, 0x0008, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x021c, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x021c, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x01fb, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x023c, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x023e, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01c5, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa220, 0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802,
+	0xa220, 0xe0c2, 0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2,
+	0x0077, 0xa2fa, 0xe0c2, 0x0071, 0xe42e, 0xe428, 0xa202, 0xe0c2,
+	0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28, 0xf7f8, 0xca48, 0xa802,
+	0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190, 0xf7e2, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8,
+	0xe004, 0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0,
+	0x000d, 0xf7e8, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72,
+	0xcc8c, 0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a,
+	0xd16f, 0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e,
+	0xe004, 0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e,
+	0xe004, 0x0020, 0xce50, 0xe42e, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe40e, 0x0020, 0xe470, 0xe190, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x02f9, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe470, 0xe190, 0xe40e, 0x0313, 0xe470, 0xe190,
+	0xe470, 0xe190, 0xe40e, 0x003a, 0xe470, 0xe190, 0xe470, 0xe190,
+	0xe168, 0xd027, 0x0001, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058,
+	0xa200, 0xe0c2, 0x005a, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xa2fe,
+	0x3cee, 0x3cef, 0x3cec, 0xe0c0, 0x005c, 0xa802, 0xe0c2, 0x005d,
+	0xce00, 0xf33e, 0xe41e, 0x0164, 0xe09e, 0xa202, 0xae3e, 0x9f07,
+	0xe0c0, 0x005c, 0xe0c1, 0x0059, 0x3eed, 0xa203, 0x5aed, 0xe052,
+	0xf08a, 0xe0c1, 0x005d, 0xe055, 0xe0c3, 0x005d, 0xa202, 0xce00,
+	0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2, 0x0008, 0xf00e,
+	0x28ee, 0xe412, 0x013d, 0xe190, 0xe0c0, 0x005c, 0xe0c1, 0x0059,
+	0x3eed, 0xa203, 0x5aed, 0xe052, 0xf08a, 0xe0c1, 0x005d, 0xe055,
+	0xe0c3, 0x005d, 0xa202, 0xce00, 0xe0c0, 0x004a, 0xf08a, 0xe41e,
+	0x019c, 0xe408, 0x005c, 0xe40e, 0x0058, 0xe190, 0xe0c0, 0x043d,
+	0xa1ee, 0xf7d8, 0xe004, 0x0060, 0xe0c2, 0x0009, 0xa200, 0xe0c2,
+	0x0009, 0xe0c0, 0x000d, 0xf7e8, 0xe41e, 0x00b2, 0xe41e, 0x00e2,
+	0xe41e, 0x012c, 0xd071, 0x242a, 0xe181, 0xe41e, 0x0164, 0xe09e,
+	0xa202, 0x9f07, 0xe0c0, 0x0049, 0xe0c1, 0x005b, 0xa111, 0xf033,
+	0xe0c0, 0x0048, 0xe0c2, 0x0047, 0xe0c0, 0x0059, 0xae02, 0xe000,
+	0x02f9, 0xe16a, 0xc000, 0xe67c, 0xe0c0, 0x005a, 0xe008, 0xffff,
+	0x3cee, 0xe0c0, 0x005b, 0xe0c1, 0x005e, 0xae11, 0xe056, 0x3cef,
+	0xe40e, 0x0058, 0xa200, 0xe0c2, 0x0059, 0xe0c2, 0x0058, 0xe0c2,
+	0x0008, 0xe004, 0x0080, 0xe0c2, 0x017c, 0xe0c0, 0x0059, 0xf7ea,
+	0xa11e, 0xf198, 0xa202, 0xe0c2, 0x0058, 0xe004, 0xc521, 0xae20,
+	0xe005, 0x210a, 0xe056, 0xe0c2, 0x0070, 0xe004, 0x0000, 0xae20,
+	0xe00a, 0x9cea, 0xe0c2, 0x0071, 0xa200, 0xe0c2, 0x0059, 0xe0c2,
+	0x0058, 0xf64e, 0xa202, 0xe0c2, 0x0008, 0xe0c2, 0x0058, 0xd027,
+	0x0001, 0xe42e, 0xa200, 0xe0c1, 0x005b, 0xf21b, 0xa23c, 0xa103,
+	0xf37b, 0xa24c, 0xa103, 0xf34b, 0xa258, 0xa103, 0xf1db, 0xe004,
+	0x003a, 0xa103, 0xf2db, 0xe004, 0x003f, 0xa103, 0xf29b, 0xe004,
+	0x0045, 0xa103, 0xf25b, 0xa103, 0xf14b, 0xe004, 0x0063, 0xa103,
+	0xf1ab, 0xe004, 0x006a, 0xa107, 0xf1bb, 0xa200, 0xe0c1, 0x005e,
+	0xf17b, 0xa028, 0xf15e, 0xe0c1, 0x005e, 0xf12b, 0xa010, 0xf10e,
+	0xe004, 0x0049, 0xe0c1, 0x005e, 0xf0bb, 0xa010, 0xa103, 0xf08b,
+	0xa010, 0xf06e, 0xe0c1, 0x005e, 0xf03b, 0xe004, 0x0074, 0xae16,
+	0xe0c1, 0x0040, 0xe041, 0xce21, 0xd111, 0x0000, 0xd112, 0x2800,
+	0xd113, 0x000b, 0xe1e1, 0xe42e, 0xe41e, 0x0213, 0xe0c0, 0x0059,
+	0xa102, 0xe42a, 0xe0c0, 0x005b, 0xa810, 0xf058, 0xa206, 0xe41e,
+	0x0153, 0xe42e, 0xe004, 0x0319, 0xe67c, 0xe0c0, 0x005b, 0xa810,
+	0xf058, 0xa204, 0xe41e, 0x0153, 0xe42e, 0xe004, 0x031b, 0xe67c,
+	0xa200, 0xc401, 0xe188, 0x00eb, 0x3d11, 0xe161, 0x00f2, 0xe188,
+	0x0b0d, 0x3d11, 0xe42e, 0x3cec, 0xe0c0, 0x0041, 0xe005, 0x0000,
+	0xae11, 0xe042, 0xce20, 0xd111, 0x0000, 0xd112, 0x0c00, 0x88ec,
+	0x0113, 0xca28, 0xf7f8, 0xe42e, 0xe0c0, 0x0059, 0xa106, 0xf048,
+	0xe004, 0x0076, 0xe42e, 0xe0c0, 0x0059, 0xa10c, 0xf038, 0xe004,
+	0x0071, 0xe004, 0x0070, 0xe42e, 0xe0c0, 0x006b, 0xe167, 0x01a0,
+	0x3d07, 0xe0c0, 0x0414, 0xe428, 0xe0c1, 0x0044, 0xa809, 0xae33,
+	0xe0c0, 0x006a, 0xe167, 0x01a0, 0x3517, 0x3d17, 0xe0c0, 0x006b,
+	0xe056, 0x3517, 0x3d07, 0xe42e, 0xe167, 0x01a0, 0x2907, 0xe0c2,
+	0x0151, 0xa204, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xa804, 0xf7da,
+	0xa208, 0xe0c2, 0x0150, 0xe42e, 0xe0c0, 0x004a, 0xe42a, 0xe0c0,
+	0x005b, 0xa110, 0xf142, 0xe0c0, 0x0059, 0xa102, 0xe41a, 0x01be,
+	0xe0c0, 0x0059, 0xa106, 0xe41a, 0x01c5, 0xe0c0, 0x0047, 0xe0c2,
+	0x0048, 0xa200, 0xe0c2, 0x004a, 0xa202, 0xe42e, 0xe0c0, 0x0047,
+	0xe0c2, 0x0049, 0xa200, 0xe0c2, 0x004a, 0xe42e, 0xe0c0, 0x004a,
+	0xa802, 0xa220, 0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x004a, 0xa802,
+	0xa220, 0xe0c2, 0x0076, 0xa200, 0xe0c2, 0x0072, 0xa2fc, 0xe0c2,
+	0x0077, 0xa2fa, 0xe0c2, 0x0071, 0xe42e, 0xe428, 0xa202, 0xe0c2,
+	0x004a, 0xe0c0, 0x0111, 0xf7e8, 0xca28, 0xf7f8, 0xca48, 0xa802,
+	0xf7e8, 0xa208, 0xae14, 0xa102, 0xe190, 0xf7e2, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe0c0, 0x043d, 0xa1ee, 0xf7d8,
+	0xe004, 0x0078, 0xe0c2, 0x0009, 0xa200, 0xe0c2, 0x0009, 0xe0c0,
+	0x000d, 0xf7e8, 0xe42e, 0xe41e, 0x0213, 0xd160, 0x0620, 0xe004,
+	0x0019, 0xae18, 0xcec0, 0xe42e, 0xe41e, 0x0228, 0xe000, 0x0040,
+	0xce50, 0xa200, 0xd022, 0x00ff, 0xe184, 0x020f, 0xce52, 0xe190,
+	0xe41e, 0x0230, 0xe42e, 0xa204, 0xae22, 0xcc9e, 0xa200, 0xcc72,
+	0xcc8c, 0xcc8e, 0xe004, 0xa810, 0xae20, 0xe00a, 0x9322, 0xce4a,
+	0xd16f, 0x0003, 0xe190, 0xe190, 0xe190, 0xd16f, 0x0000, 0xe42e,
+	0xe004, 0x0030, 0xce50, 0xca50, 0xa802, 0xf7ea, 0xc000, 0xe42e,
+	0xe004, 0x0020, 0xce50, 0xe42e, 0xa200, 0xe0c2, 0x041c, 0xe42e,
+	0xe41e, 0x028d, 0xe42a, 0xe0c0, 0x0061, 0xe008, 0x001f, 0xe00a,
+	0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02c3, 0xe41e, 0x02f4, 0xae12,
+	0xe0c2, 0x041e, 0xe41e, 0x02e7, 0xe42e, 0xe41e, 0x02b1, 0xe42a,
+	0xe0c0, 0x041f, 0xf7e8, 0xe0c0, 0x0210, 0xa804, 0xf118, 0xe0c0,
+	0x0215, 0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0216, 0xf0be, 0xe0c0,
+	0x0213, 0xe008, 0x0100, 0xf04a, 0xe0c0, 0x0214, 0xf03e, 0xe0c0,
+	0x020b, 0xe00a, 0x0100, 0xe0c2, 0x041c, 0xe41e, 0x02c3, 0xe41e,
+	0x02f4, 0xae12, 0xe0c1, 0x0210, 0xa803, 0xae15, 0xe056, 0xe0c1,
+	0x0204, 0xaf0b, 0xa87f, 0xae07, 0xe056, 0xe0c1, 0x0204, 0xa80f,
+	0xe056, 0xe0c2, 0x041e, 0xe41e, 0x02e7, 0xe42e, 0xe0c0, 0x041f,
+	0xf7e8, 0xa200, 0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xa203,
+	0xae19, 0xe052, 0xf1da, 0xe0c0, 0x0060, 0xaf08, 0xa806, 0xf18a,
+	0xe0c0, 0x0060, 0xa81e, 0xe016, 0xe0c1, 0x0060, 0xa821, 0xe017,
+	0xe056, 0xf0ea, 0xe0c0, 0x0044, 0xaf12, 0xa806, 0xe016, 0xe0c1,
+	0x0044, 0xaf17, 0xa803, 0xe056, 0xf03a, 0xa202, 0xe42e, 0xa200,
+	0xe42e, 0xe0c0, 0x0044, 0xa203, 0xae19, 0xe052, 0xf0ba, 0xe41e,
+	0x028d, 0xf088, 0xe0c0, 0x0044, 0xaf12, 0xa806, 0xf038, 0xa202,
+	0xe42e, 0xa200, 0xe42e, 0xe0c0, 0x041c, 0xe008, 0x00ff, 0xcca4,
+	0xc785, 0xe018, 0xe000, 0x0500, 0xa002, 0xae04, 0xe0c2, 0x041a,
+	0xa202, 0xe0c2, 0x0418, 0xe0c0, 0x0419, 0xf7ea, 0xe0c0, 0x041b,
+	0xaf20, 0xa01e, 0xaf08, 0xae28, 0xe0c1, 0x041b, 0xe009, 0xffff,
+	0xa01f, 0xaf09, 0xae09, 0xe056, 0xe0c2, 0x041d, 0xe42e, 0xe0c0,
+	0x041c, 0xe00a, 0x0200, 0xe0c2, 0x041c, 0xe0c0, 0x041c, 0xe00c,
+	0x0200, 0xe0c2, 0x041c, 0xe42e, 0xe0c0, 0x0044, 0xaf04, 0xa802,
+	0xe42e, 0xe40e, 0x11cd, 0xe40e, 0x031d, 0xe40e, 0x0321, 0xe40e,
+	0x0325, 0xe40e, 0x032d, 0xe40e, 0x0331, 0xe40e, 0x0335, 0xe40e,
+	0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x0339, 0xe40e, 0x00a4, 0xe40e,
+	0x00a4, 0xe40e, 0x00a4, 0xe40e, 0x11ed, 0xe40e, 0x00a4, 0xe40e,
+	0x00a4, 0xe40e, 0x066b, 0xe40e, 0x0689, 0xe41e, 0x033d, 0xe40e,
+	0x00a4, 0xe41e, 0x036c, 0xe40e, 0x00a4, 0xe41e, 0x0234, 0xe41e,
+	0x0378, 0xe41e, 0x0286, 0xe40e, 0x00a4, 0xe41e, 0x03f0, 0xe40e,
+	0x00a4, 0xe41e, 0x042a, 0xe40e, 0x00a4, 0xe41e, 0x0495, 0xe40e,
+	0x00a4, 0xe41e, 0x10fa, 0xe40e, 0x00a4, 0xa210, 0xe0c2, 0x0100,
+	0xa200, 0xe0c2, 0x0128, 0xd130, 0x0008, 0xe41e, 0x0148, 0xe41e,
+	0x0213, 0xe41e, 0x061c, 0xa200, 0x3c2a, 0x3c33, 0xcc72, 0xcc44,
+	0x3ccb, 0x3ccc, 0xe41e, 0x14d7, 0xe41e, 0x04d0, 0xf12a, 0xe41e,
+	0x0938, 0xe41e, 0x11ad, 0xe41e, 0x11d8, 0x2815, 0xe40a, 0x0362,
+	0xe418, 0x0e1b, 0xe41e, 0x1157, 0xa202, 0xe0c2, 0x0070, 0xe42e,
+	0xa200, 0xe0c2, 0x0070, 0xe42e, 0xd130, 0x0008, 0x28be, 0xe428,
+	0x28bf, 0xf06a, 0xa200, 0x3c4d, 0xe41e, 0x11ce, 0xe42e, 0xe42e,
+	0xd130, 0x0008, 0xa200, 0xcc44, 0xcc4a, 0xcc4c, 0xcfce, 0xe0c2,
+	0x0074, 0x3c65, 0xe0c0, 0x0065, 0xaf06, 0x3066, 0xaf02, 0x3067,
+	0xaf02, 0x3068, 0xe41e, 0x065b, 0xe41e, 0x0d9f, 0xe41e, 0x0dca,
+	0x28bf, 0xf24a, 0xc872, 0x3c07, 0x28c0, 0xf09a, 0xe0c0, 0x0066,
+	0x344a, 0x3c4b, 0xe0c0, 0x0067, 0xae04, 0x3c4c, 0xa200, 0x3c4d,
+	0xe41e, 0x11ce, 0xe41e, 0x0213, 0xa200, 0x3cdf, 0x3ce0, 0xe41e,
+	0x1294, 0xe41e, 0x12b0, 0xe41e, 0x12cd, 0xe41e, 0x1207, 0xe41e,
+	0x12f1, 0xe41e, 0x12fc, 0x2807, 0xcc72, 0xd130, 0x0008, 0xd1e0,
+	0x0000, 0xd1ff, 0x03b0, 0xd199, 0x0224, 0xd03a, 0x0000, 0xd04b,
+	0x0001, 0xd04c, 0x0000, 0xd008, 0x0000, 0xe41e, 0x068f, 0x28bf,
+	0xf02a, 0xf03e, 0x28be, 0xf01a, 0x2c33, 0xae02, 0x083f, 0xa002,
+	0xe0c2, 0x0070, 0x283f, 0xf07a, 0x2c2a, 0xa002, 0x3c2a, 0x2c33,
+	0xa002, 0x3c33, 0x2829, 0xe0c2, 0x0071, 0x281f, 0xe0c2, 0x0073,
+	0xd039, 0x0000, 0xc84a, 0xc84d, 0xae20, 0xe056, 0xe0c2, 0x0053,
+	0xe41e, 0x0630, 0xe41e, 0x14da, 0xa202, 0xe0c2, 0x0076, 0xe42e,
+	0xe41e, 0x041e, 0xe41e, 0x0174, 0xe0c0, 0x0042, 0xce20, 0xd111,
+	0x04c0, 0xd112, 0x00c0, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe0c0,
+	0x0060, 0x3c32, 0xe0c0, 0x0061, 0x3c70, 0xe004, 0x0580, 0xe096,
+	0xe0c0, 0x0062, 0x3513, 0x3d13, 0xe0c0, 0x0063, 0x3513, 0x3d13,
+	0xe004, 0x0901, 0xe096, 0xe0c0, 0x006c, 0x3513, 0x3d13, 0xe0c0,
+	0x006d, 0x3513, 0x3d13, 0xe41e, 0x0d9f, 0xe42e, 0xe167, 0x0488,
+	0xe166, 0x0064, 0xd022, 0x0003, 0xe184, 0x0428, 0x9e16, 0x3517,
+	0x3d17, 0xe42e, 0xd130, 0x0008, 0x28bf, 0xf24a, 0xc872, 0x3c07,
+	0x28c0, 0xf09a, 0xe0c0, 0x0061, 0x344a, 0x3c4b, 0xe0c0, 0x0062,
+	0xae04, 0x3c4c, 0xa200, 0x3c4d, 0xe41e, 0x11ce, 0xe41e, 0x0213,
+	0xa200, 0x3cdf, 0x3ce0, 0xe41e, 0x1294, 0xe41e, 0x12b0, 0xe41e,
+	0x12cd, 0xe41e, 0x1207, 0xe41e, 0x12f1, 0xe41e, 0x12fc, 0x2807,
+	0xcc72, 0xe0c0, 0x0060, 0xa80e, 0xf0fa, 0xa102, 0xf25a, 0xa102,
+	0xf2aa, 0xa102, 0xf2aa, 0xa102, 0xf07a, 0xa102, 0xf1da, 0xa202,
+	0xe0c2, 0x0070, 0xe42e, 0xe0c0, 0x0060, 0xaf06, 0xa802, 0x3073,
+	0xf0ca, 0xe0c0, 0x0063, 0x3478, 0x3c79, 0xe0c1, 0x0064, 0x367a,
+	0x3e7b, 0xe056, 0xe01a, 0x3c73, 0xe0c0, 0x0060, 0xa808, 0xe01a,
+	0xe41e, 0x05eb, 0xf12e, 0xe0c0, 0x0060, 0xa808, 0xe01a, 0xe41e,
+	0x05fb, 0xf0be, 0xa214, 0xf02e, 0xa216, 0x3c30, 0xa200, 0x3c2f,
+	0xe41e, 0x130e, 0xe41e, 0x1369, 0x28bf, 0xf02a, 0xf03e, 0x28be,
+	0xf01a, 0xa202, 0xe0c2, 0x0070, 0xe42e, 0xe41e, 0x11bc, 0xa200,
+	0xce92, 0xe0c0, 0x0060, 0xa802, 0xf198, 0xe0c0, 0x0060, 0xaf04,
+	0xa802, 0x3073, 0xf0ca, 0xe0c0, 0x0063, 0x3478, 0x3c79, 0xe0c1,
+	0x0064, 0x367a, 0x3e7b, 0xe056, 0xe01a, 0x3c73, 0xe0c0, 0x0060,
+	0xa804, 0xe01a, 0xe41e, 0x0819, 0xf07e, 0xe0c0, 0x0060, 0xa804,
+	0xe01a, 0xe41e, 0x08b1, 0xc870, 0xaf06, 0x3c45, 0xe0c2, 0x0070,
+	0xe004, 0x0080, 0xcc6e, 0xbadf, 0xe0c0, 0x0042, 0xce20, 0xd111,
+	0x0000, 0xd112, 0x0100, 0xd113, 0x0012, 0xca28, 0xf7f8, 0xe42e,
+	0xe0c0, 0x0074, 0xa806, 0x3cc9, 0xe0c0, 0x0074, 0xaf04, 0x3cca,
+	0xe0c0, 0x0064, 0x3450, 0x3c51, 0x2850, 0xa01e, 0xaf08, 0x3c50,
+	0x2851, 0xa01e, 0xaf08, 0x3c51, 0xe0c0, 0x0065, 0x3418, 0x3c17,
+	0x2817, 0xae02, 0x3c17, 0x2818, 0xa002, 0x3c18, 0x2c17, 0xc710,
+	0x7c18, 0xe008, 0xffff, 0xa002, 0xaf02, 0x3c88, 0xe0c0, 0x0062,
+	0xaf04, 0x301b, 0xaf04, 0x30e1, 0xaf02, 0x30b8, 0xe0c1, 0x0071,
+	0x3eb9, 0xaf02, 0x30c8, 0xaf02, 0x30c7, 0xaf02, 0x30e6, 0xaf02,
+	0x30e5, 0xaf02, 0xe0c0, 0x0068, 0xe049, 0xa83f, 0xae3f, 0xaf3f,
+	0x3e24, 0xe049, 0xaf0b, 0x3226, 0xe049, 0xaf0d, 0xa807, 0x3e2c,
+	0xe049, 0xaf11, 0xa81f, 0xaf41, 0xae41, 0xae03, 0x3e2d, 0xe049,
+	0xaf19, 0xa81f, 0xaf41, 0xae41, 0xae03, 0x3e2e, 0x282c, 0x4c2d,
+	0x4c2e, 0xe01a, 0x3c25, 0xe0c0, 0x0069, 0x3038, 0xaf02, 0x3039,
+	0xaf02, 0x3c3a, 0xe0c0, 0x006a, 0x3c14, 0xe0c0, 0x006b, 0x3480,
+	0x3015, 0xaf02, 0xe008, 0x7fff, 0x3c7f, 0xf028, 0x3c15, 0x2880,
+	0xaf1e, 0x3091, 0x2880, 0xe008, 0x7fff, 0x3c80, 0xe0c0, 0x006c,
+	0x3481, 0x3c82, 0xe0c0, 0x006d, 0x3c1c, 0xa20a, 0x3c10, 0xa002,
+	0x3c12, 0xa202, 0x3c13, 0xa102, 0x3c22, 0xa200, 0x3c21, 0x3c20,
+	0x3c27, 0xa204, 0x3c11, 0xa234, 0x3c23, 0x8450, 0x8251, 0xe018,
+	0x3c52, 0xa201, 0xe002, 0x00c8, 0xb425, 0xe002, 0x0190, 0xb425,
+	0x3e36, 0xe0c0, 0x0075, 0xe166, 0x0600, 0x3516, 0x3d16, 0xe0c0,
+	0x0076, 0xe049, 0xa806, 0x3cd7, 0xe04a, 0xaf04, 0x30d9, 0xaf02,
+	0xa81e, 0x3cd8, 0x28d9, 0xe016, 0x3cd9, 0xae02, 0x4cd9, 0xae02,
+	0x4cd9, 0x3cd9, 0x28d8, 0xf028, 0xa21e, 0x3cd8, 0x2850, 0x2a51,
+	0xaf06, 0xaf07, 0x3c08, 0x3e09, 0x8408, 0x8209, 0xe018, 0x3cc1,
+	0xa104, 0xf032, 0xa204, 0x3cc1, 0x2851, 0xaf02, 0x3c08, 0x8408,
+	0x8250, 0xe018, 0x3cc3, 0xe161, 0x0906, 0x3d01, 0x3cc6, 0xa202,
+	0x3c1e, 0xe0c0, 0x0043, 0xaf06, 0x30be, 0xaf02, 0x30bf, 0xaf02,
+	0x30c0, 0xaf02, 0x30ce, 0xa202, 0xe42e, 0xcb04, 0xaf20, 0xe000,
+	0x0490, 0xe09e, 0xc872, 0x3d07, 0xcb04, 0xaf20, 0xa002, 0x1850,
+	0xe428, 0xcb04, 0xe008, 0xffff, 0xae0e, 0xe005, 0x0000, 0xae11,
+	0xe042, 0xe0c1, 0x0042, 0xe042, 0xce20, 0xd111, 0x0490, 0xd112,
+	0x002e, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0x204a, 0x4c4b,
+	0x2e4d, 0xae11, 0xe042, 0x0840, 0xe161, 0x0434, 0x3511, 0x3d11,
+	0x281f, 0xae04, 0xe005, 0x0012, 0xae11, 0xe042, 0xe0c1, 0x0042,
+	0xe042, 0xce20, 0xd111, 0x0434, 0xd112, 0x0004, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x3c07, 0xa206, 0x3c2f, 0xa20e, 0x2a07,
+	0xf02b, 0xa21e, 0x3c30, 0xe41e, 0x130e, 0x2807, 0xe41e, 0x0819,
+	0xe41e, 0x1369, 0xe42e, 0x3c07, 0xa206, 0x3c2f, 0xa210, 0x3c30,
+	0xe41e, 0x130e, 0x2807, 0xe41e, 0x08b1, 0xe41e, 0x1369, 0xe42e,
+	0xa200, 0x3c2f, 0x283f, 0xf06a, 0xa230, 0x3c30, 0xe41e, 0x130e,
+	0xf09e, 0xa212, 0x3c30, 0xe41e, 0x130e, 0xa204, 0xba84, 0xe41e,
+	0x092e, 0xe41e, 0x1369, 0xe42e, 0xe0c0, 0x0040, 0xe005, 0x0063,
+	0xae17, 0xe042, 0xe005, 0x1900, 0xae03, 0xe042, 0xce20, 0xd111,
+	0x0700, 0xd112, 0x0200, 0xd113, 0x0003, 0xca28, 0xf7f8, 0xe42e,
+	0x2866, 0x4c67, 0x4c68, 0xe42a, 0xe167, 0x05f0, 0xc410, 0x2866,
+	0xae10, 0x3d17, 0x2852, 0x3d17, 0x8137, 0x2867, 0xae12, 0x2a31,
+	0xe017, 0xe056, 0x3d17, 0x2852, 0xae04, 0x3d17, 0x8137, 0x2868,
+	0xae14, 0x2a1f, 0xe056, 0x3d17, 0x281f, 0xae06, 0x3d17, 0xe0c0,
+	0x0068, 0xce20, 0xd111, 0x05f0, 0xd112, 0x000c, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x2866, 0x4c67, 0x4c68, 0xe42a, 0xe0c0,
+	0x0068, 0xce20, 0xd111, 0x05f0, 0xd112, 0x000c, 0xd113, 0x0003,
+	0xca28, 0xf7f8, 0xe42e, 0xa206, 0xe41e, 0x0153, 0xe0c0, 0x005a,
+	0xe008, 0xffff, 0x3cee, 0xe41e, 0x0213, 0xa200, 0x3cdf, 0x3ce0,
+	0xe41e, 0x1294, 0xe41e, 0x12b0, 0xe41e, 0x12cd, 0xe41e, 0x14af,
+	0xe41e, 0x1207, 0xe41e, 0x12f1, 0xe41e, 0x12fc, 0xe41e, 0x14b7,
+	0xe42e, 0xe41e, 0x149b, 0xa204, 0xe41e, 0x0153, 0xe42e, 0x2824,
+	0xa83e, 0xae06, 0xcf80, 0xe41e, 0x1369, 0x283f, 0xf048, 0x2834,
+	0x3ce2, 0xf06e, 0x283e, 0x44e1, 0xf03a, 0x28e2, 0x3c35, 0xd1f3,
+	0x0000, 0x2835, 0xcfe4, 0xa200, 0xcfc2, 0xd1e8, 0x0055, 0x2850,
+	0xa102, 0xae02, 0x4c26, 0xae06, 0xcf00, 0xd1d3, 0x000d, 0xd185,
+	0x0001, 0xe41e, 0x112d, 0xe41e, 0x1132, 0x281b, 0xe418, 0x0608,
+	0xe41e, 0x06f1, 0x283f, 0x2ae6, 0x463e, 0xe419, 0x05eb, 0x283f,
+	0x2ae6, 0x463e, 0xe419, 0x05fb, 0x283d, 0x3c2b, 0xe41e, 0x1162,
+	0x283f, 0xf078, 0x2829, 0xf05a, 0x281e, 0xa002, 0xa802, 0x3c1e,
+	0xe41e, 0x0970, 0xe41e, 0x0d68, 0xe41e, 0x0813, 0xa200, 0x3c53,
+	0x3c1f, 0x2831, 0xa004, 0x3c2f, 0x283f, 0xe016, 0x44e5, 0xe418,
+	0x1514, 0xe41e, 0x0738, 0x2865, 0xaa02, 0x3c65, 0x2853, 0x1852,
+	0xf744, 0xe41e, 0x0d86, 0xe41e, 0x0b7a, 0x2815, 0xe418, 0x0e24,
+	0xe42e, 0x283f, 0xf208, 0xe0c0, 0x0065, 0xa804, 0xf06a, 0xa200,
+	0x3c2a, 0x3cb6, 0xe016, 0x3c89, 0x2814, 0xf048, 0x2c2a, 0xf07a,
+	0xf0ae, 0x28b6, 0xf04a, 0x2a14, 0xe046, 0xf058, 0x3c29, 0xa202,
+	0x3cb6, 0xf05e, 0xa202, 0x3c29, 0x08b6, 0x3cb6, 0x2829, 0xe016,
+	0x3c3e, 0xf05e, 0x283e, 0x44e1, 0xf02a, 0x3c29, 0xa200, 0x3c72,
+	0xe0c0, 0x0065, 0xa802, 0xe418, 0x0731, 0xe0c0, 0x0063, 0xa408,
+	0x3c3d, 0x2815, 0xf09a, 0x2829, 0xe41a, 0x0e1e, 0xe41e, 0x0e21,
+	0x3c3d, 0xe419, 0x0731, 0x2c2a, 0xe016, 0x3c31, 0xa004, 0x3c2f,
+	0xe42e, 0xa202, 0x3c29, 0x3c72, 0x2835, 0xe0c2, 0x0060, 0xe42e,
+	0x2a31, 0xa20a, 0xb636, 0x2a3f, 0xf02b, 0xa228, 0x3c30, 0xe41e,
+	0x130e, 0xe41e, 0x08d8, 0xa202, 0x3ccb, 0xe41e, 0x076e, 0xe41e,
+	0x092e, 0xe41e, 0x1369, 0x2868, 0xe418, 0x0752, 0x281f, 0xa002,
+	0x3c1f, 0xe42e, 0xe167, 0x05ec, 0xa200, 0x3d17, 0x2853, 0xa102,
+	0x3d17, 0xcaaa, 0xae06, 0x3517, 0x3d17, 0x281f, 0xae06, 0xe167,
+	0x05fa, 0x2317, 0x4f17, 0xe042, 0xce20, 0xd111, 0x05ec, 0xd112,
+	0x0004, 0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0x282b, 0xcf96,
+	0x282c, 0xae0a, 0x2a2d, 0xa83f, 0xe056, 0xae0a, 0x2a2e, 0xa83f,
+	0xe056, 0xcf30, 0x2829, 0xcfc4, 0xcf82, 0xd188, 0x0001, 0xa200,
+	0xcf86, 0x3c3b, 0xa202, 0x3c3c, 0xe41e, 0x07a4, 0xe41e, 0x0816,
+	0x8a5e, 0x0039, 0xe41e, 0x07eb, 0xc872, 0x1c5e, 0xe008, 0xffff,
+	0x3c5f, 0x2a15, 0xcb96, 0xe419, 0x0e2a, 0x2853, 0x1852, 0xf042,
+	0x283b, 0xe40a, 0x0784, 0xcb86, 0xf02a, 0xbbfc, 0x2a15, 0xcb96,
+	0xf02b, 0x3c2b, 0xa202, 0xe42e, 0x2838, 0x2a39, 0xe42a, 0xf0a9,
+	0x28dc, 0xe42a, 0xa102, 0x3cdc, 0xa102, 0xe428, 0xa202, 0x3c3b,
+	0xe42e, 0x283c, 0x183a, 0x2a3c, 0xa003, 0x3e3c, 0xe428, 0xa202,
+	0x3c3c, 0x3c3b, 0xe42e, 0x2a38, 0x2839, 0xe42b, 0xa201, 0xf0a8,
+	0x28dc, 0xe428, 0xc870, 0x1c3a, 0xe424, 0xa209, 0x3ed1, 0x3edc,
+	0xe42e, 0x28d0, 0xa002, 0x3cd0, 0xa102, 0x183a, 0xe428, 0xa203,
+	0x3ed1, 0x3ed0, 0xe42e, 0xa200, 0x3cd1, 0x3cdc, 0xa202, 0x3cd0,
+	0xe42e, 0xcb1c, 0xf7f8, 0xd185, 0x0002, 0xd186, 0x0000, 0x2855,
+	0xae02, 0x4c54, 0xcf8a, 0x2859, 0xcf94, 0xa200, 0xcfdc, 0xcf84,
+	0x2858, 0xcfd2, 0xe42e, 0x2876, 0xf05a, 0xe41e, 0x0be4, 0xe41e,
+	0x0bbd, 0xcba0, 0xf7f8, 0x2854, 0xf0ba, 0xcb18, 0x3c00, 0x2855,
+	0xf04a, 0x2856, 0xae38, 0xcf8c, 0x2857, 0xcf90, 0xf03e, 0xcbd2,
+	0xcf9a, 0xd1d0, 0x003f, 0xa202, 0x3c76, 0xe41e, 0x0adb, 0x2a66,
+	0xcba0, 0xf7f8, 0xe419, 0x0d1d, 0xd186, 0x0001, 0xd185, 0x0004,
+	0xcb06, 0x3c53, 0xe42e, 0xe41e, 0x0a98, 0xe42e, 0xe41e, 0x0ad0,
+	0xe42e, 0x3c07, 0xe005, 0x0064, 0xf03a, 0xe005, 0x0080, 0xba8f,
+	0xbac7, 0x8452, 0x8288, 0xe019, 0xaf03, 0x2852, 0xe002, 0x0063,
+	0xf070, 0xe04a, 0xe002, 0x05cd, 0xf030, 0xa214, 0xf37e, 0x2852,
+	0xe002, 0x018c, 0xf070, 0xe04a, 0xe002, 0x2e68, 0xf030, 0xa228,
+	0xf2de, 0x2852, 0xe002, 0x0654, 0xf070, 0xe04a, 0xe002, 0x9e34,
+	0xf030, 0xa23c, 0xf23e, 0x2852, 0xe002, 0x0e10, 0xf080, 0xe004,
+	0x0d2f, 0xae0a, 0xe046, 0xf034, 0xa23e, 0xf18e, 0x2852, 0xe002,
+	0x1400, 0xf080, 0xe004, 0x0d2f, 0xae0c, 0xe046, 0xf034, 0xa240,
+	0xf0de, 0x2852, 0xe002, 0x2000, 0xf080, 0xe004, 0x03c0, 0xae10,
+	0xe046, 0xf034, 0xa250, 0xf02e, 0xa254, 0xe0c1, 0x0060, 0xaf09,
+	0xa803, 0xf06b, 0xe0c0, 0x0060, 0xaf10, 0xe008, 0x00ff, 0x3ce3,
+	0xba8e, 0x2807, 0xbbfc, 0xa202, 0xbbfc, 0xa200, 0xbbfc, 0xbbfc,
+	0xbac1, 0x2810, 0xa108, 0xbbfc, 0x2811, 0xbbfc, 0x2811, 0xf048,
+	0x2812, 0xa108, 0xbbfc, 0x2813, 0xbbfc, 0xe190, 0xbac0, 0x2850,
+	0xa102, 0xbbfc, 0x2851, 0xa102, 0xbbfc, 0xe190, 0xbae0, 0xe190,
+	0xbae0, 0x2873, 0xf038, 0xbac0, 0xf0fe, 0xbae0, 0x2878, 0xaf02,
+	0xbbfc, 0x2879, 0xaf02, 0xbbfc, 0x287a, 0xaf02, 0xbbfc, 0x287b,
+	0xaf02, 0xbbfc, 0xe190, 0xbac0, 0x2807, 0xf05a, 0xbae0, 0xe41e,
+	0x14f3, 0xbac1, 0xe41e, 0x092e, 0xa202, 0xe42e, 0xe16a, 0xa200,
+	0xe42e, 0xbbfc, 0xbbfc, 0xbac0, 0x2820, 0xba80, 0x2821, 0xbbfc,
+	0xe408, 0x08d5, 0x2822, 0xbbfc, 0xa200, 0xe190, 0xbbfc, 0xe190,
+	0xbac0, 0xe190, 0xbac1, 0xe190, 0x2823, 0xa134, 0xbbfe, 0xa200,
+	0xbbfe, 0x2824, 0xbbfe, 0x2825, 0xba80, 0x2826, 0xba80, 0x2827,
+	0xba80, 0xe41e, 0x092e, 0xa202, 0xe42e, 0xe16a, 0xa200, 0xe42e,
+	0x2853, 0xbbfc, 0x2829, 0xe016, 0xae02, 0xe049, 0xe01b, 0x463f,
+	0xf029, 0xa00a, 0xbbfc, 0x283f, 0xbbfc, 0x2c2a, 0x7010, 0x2831,
+	0xf03a, 0xa200, 0xbbfc, 0x2811, 0xf098, 0x2c33, 0xae02, 0x7012,
+	0x2820, 0xe40a, 0x08f5, 0xa200, 0xbbfe, 0x2827, 0xe40a, 0x08fa,
+	0xa200, 0xbbfc, 0x2829, 0xf12a, 0xbac0, 0xe190, 0x2831, 0xe016,
+	0x443e, 0x44e1, 0x443f, 0xf09a, 0xbae0, 0xa20a, 0xbbfc, 0xa200,
+	0xbbfc, 0xa206, 0xbbfc, 0xf02e, 0xbac0, 0x282f, 0xe40a, 0x0919,
+	0x2831, 0xe40a, 0x0918, 0xbac0, 0xe190, 0xbac0, 0xe40e, 0x0919,
+	0xbac0, 0x282b, 0x1823, 0xbbfe, 0x2825, 0xe40a, 0x092a, 0x282c,
+	0xbbfc, 0xa102, 0xe40a, 0x092a, 0x282d, 0xaf02, 0xbbfe, 0x282e,
+	0xaf02, 0xbbfe, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xbae0, 0xc868,
+	0xa80e, 0xe42a, 0xa110, 0xe012, 0x3c48, 0xa200, 0x7048, 0xe42e,
+	0xa200, 0x3c34, 0xe004, 0x0190, 0x3c75, 0xe0c0, 0x0414, 0xe428,
+	0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xa201, 0xae09,
+	0xa907, 0xae09, 0xa907, 0xae09, 0xa907, 0xae09, 0xa901, 0xae09,
+	0xa907, 0xae09, 0xa905, 0xae09, 0xa905, 0xe0c3, 0x0152, 0xa241,
+	0xae11, 0xa911, 0xae11, 0xa911, 0xe0c3, 0x0153, 0xa201, 0xae21,
+	0xa902, 0xae02, 0xa902, 0xae04, 0xa900, 0x3cde, 0xe056, 0xe0c2,
+	0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0, 0x0150, 0xf7ea, 0xe42e,
+	0xe41e, 0x0cb3, 0xa210, 0xe0c2, 0x0100, 0xa200, 0xe0c2, 0x0128,
+	0x2a29, 0xe004, 0x016f, 0xf039, 0xe004, 0x0168, 0xe0c2, 0x017c,
+	0xa200, 0xe0c2, 0x017d, 0xe0c2, 0x013d, 0xe0c0, 0x0050, 0xe049,
+	0xe008, 0x007f, 0x3c00, 0xaf11, 0xe009, 0x007f, 0x3e01, 0x4600,
+	0x3e00, 0xa200, 0x2a00, 0xa803, 0xf03b, 0xe00a, 0x0002, 0x2a00,
+	0xa805, 0xf02b, 0xa912, 0x2a00, 0xa809, 0xf02b, 0xa940, 0x2a00,
+	0xa811, 0xf02b, 0xa980, 0xe0c2, 0x040c, 0xe0c1, 0x0046, 0xe004,
+	0x0000, 0xae10, 0xe042, 0x2a01, 0xa803, 0xf05b, 0xe161, 0x0488,
+	0x2111, 0x4d11, 0xcf0e, 0xe0c1, 0x0046, 0xe004, 0x0040, 0xae10,
+	0xe042, 0x2a01, 0xa805, 0xf05b, 0xe161, 0x048a, 0x2111, 0x4d11,
+	0xe0c2, 0x0103, 0xa200, 0xe0c2, 0x0208, 0xa200, 0xe0c2, 0x021c,
+	0xa202, 0xe0c2, 0x0210, 0xa200, 0xe0c2, 0x0215, 0xe41e, 0x0d93,
+	0xa203, 0xae09, 0xa901, 0xae09, 0xe056, 0xe0c2, 0x0213, 0xe0c1,
+	0x0046, 0xe004, 0x0070, 0xae10, 0xe042, 0x2a01, 0xa809, 0xf05b,
+	0xe161, 0x048c, 0x2111, 0x4d11, 0xe0c2, 0x0211, 0xe0c1, 0x0046,
+	0xe004, 0x0070, 0xe000, 0x0040, 0xae10, 0xe042, 0x2a01, 0xa811,
+	0xf05b, 0xe161, 0x048e, 0x2111, 0x4d11, 0xe0c2, 0x0212, 0xe0c0,
+	0x0064, 0x3c71, 0x2a72, 0xf02b, 0xa200, 0xe0c2, 0x0138, 0x2050,
+	0x4c51, 0xae08, 0xe0c2, 0x0101, 0xe0c2, 0x0205, 0x2a72, 0xaa03,
+	0x4671, 0xa803, 0xf04b, 0x2051, 0x4c50, 0xae08, 0xe0c2, 0x0142,
+	0xa200, 0xe41e, 0x0d93, 0xe0c2, 0x0102, 0x2829, 0xae06, 0xe0c2,
+	0x0104, 0xa210, 0xae08, 0x4c29, 0xae06, 0xe0c2, 0x0204, 0xe0c0,
+	0x0060, 0xa87e, 0xe0c2, 0x0143, 0xe0c0, 0x0069, 0xe0c2, 0x014f,
+	0xe004, 0x0580, 0xe096, 0x2113, 0x4d13, 0xe0c2, 0x021d, 0x2834,
+	0xe0c2, 0x020b, 0xe0c2, 0x0214, 0xa200, 0xe0c2, 0x0312, 0xa202,
+	0xe0c2, 0x0302, 0x2835, 0xe0c2, 0x0380, 0xe0c2, 0x018d, 0x3cdd,
+	0xa200, 0xe0c2, 0x0302, 0x2834, 0xe0c2, 0x0072, 0x3c35, 0xa002,
+	0x3c34, 0x1832, 0xf028, 0x3c34, 0xa200, 0xe0c2, 0x0113, 0xe0c2,
+	0x030d, 0xe0c2, 0x0320, 0xe0c2, 0x030a, 0xe0c2, 0x030b, 0xe004,
+	0x0055, 0xe0c2, 0x030c, 0xe004, 0x003f, 0xe0c2, 0x012a, 0xe166,
+	0x0600, 0x2116, 0x4d16, 0xe0c2, 0x011f, 0x2826, 0xe0c2, 0x0179,
+	0xe41e, 0x0c3a, 0xe004, 0x0582, 0xe096, 0x2313, 0x4f13, 0xe004,
+	0x0580, 0xe096, 0x2113, 0x4d13, 0x3513, 0x3d13, 0xe004, 0x0580,
+	0xe096, 0x3713, 0x3f13, 0xe41e, 0x0d4b, 0xe41e, 0x0d5d, 0xa202,
+	0xe0c2, 0x0106, 0xe0c2, 0x0139, 0xe41e, 0x024d, 0xa204, 0x2a3d,
+	0xa115, 0xb60a, 0x3cd5, 0x2a72, 0xa200, 0xf02b, 0xa208, 0xe0c2,
+	0x0140, 0x3cd6, 0x2a50, 0xa10f, 0xa200, 0xb62e, 0x3cd4, 0xe42e,
+	0xa2f0, 0x3c53, 0xe0c2, 0x003f, 0xe41e, 0x0cd4, 0xe41e, 0x07d3,
+	0xa200, 0x3c76, 0xa2f2, 0x3c53, 0x2853, 0xe0c2, 0x003f, 0xa00a,
+	0xf078, 0xe41e, 0x0cd8, 0xa202, 0xe0c2, 0x021e, 0xf17e, 0xa102,
+	0xf0a8, 0xe41e, 0x0c23, 0xe41e, 0x0cd8, 0xe41e, 0x0c1c, 0xe41e,
+	0x0c12, 0xf0ce, 0xf094, 0x2839, 0xf048, 0xe41e, 0x0adb, 0xf0ae,
+	0xe41e, 0x0ad3, 0xf07e, 0xe41e, 0x0cd8, 0xe41e, 0x0cdc, 0xe41e,
+	0x0cd4, 0xa200, 0x3ccc, 0x2853, 0xa002, 0x3c53, 0xf564, 0xe42e,
+	0x2853, 0xe0c2, 0x003f, 0xe41e, 0x07bb, 0xe419, 0x1132, 0xe41e,
+	0x0c23, 0x2876, 0xf0c8, 0x2863, 0xa002, 0x3c63, 0x1850, 0xf028,
+	0x3c63, 0x2864, 0xe0c2, 0x0120, 0x2876, 0xe428, 0x2853, 0xf104,
+	0xa106, 0xa80e, 0xae06, 0x3cdb, 0xe41e, 0x0c02, 0x2a67, 0xe41e,
+	0x0bd3, 0xe419, 0x0ce0, 0xe41e, 0x07d9, 0xd1f0, 0x000d, 0x2ad4,
+	0x2853, 0xa80e, 0xae06, 0x3cda, 0xf05b, 0x2863, 0xe016, 0x4cd1,
+	0x3cd1, 0x2a72, 0xe0c0, 0x011c, 0xf7ea, 0xf07b, 0xa200, 0x3c00,
+	0x3c01, 0xe0c2, 0x0114, 0xf10e, 0xe0c0, 0x011e, 0x3000, 0x44d5,
+	0x3c01, 0x4c00, 0xe0c2, 0x0114, 0xf07a, 0xe0c0, 0x0170, 0x3c02,
+	0xe0c0, 0x0174, 0x3c03, 0x2ad1, 0xe0c0, 0x0141, 0x3c64, 0xf09b,
+	0xe41e, 0x0c1c, 0xa200, 0x3cd1, 0xa203, 0x4ed6, 0xe0c3, 0x0140,
+	0xe41e, 0x113b, 0x2a29, 0xf17b, 0xe0c0, 0x018f, 0x3c04, 0xe0c2,
+	0x0309, 0x28da, 0xe000, 0x02c0, 0xe092, 0xe162, 0x0190, 0xe163,
+	0x03b0, 0xc420, 0xd022, 0x0003, 0xe184, 0x0b41, 0x9e12, 0x3511,
+	0x3d11, 0x9f33, 0x2a00, 0xe0c0, 0x0111, 0xf7e8, 0x2853, 0xe0c3,
+	0x0188, 0xf064, 0xa210, 0xe0c2, 0x0134, 0xd1d0, 0x0080, 0x2a29,
+	0x2864, 0xe0c2, 0x0119, 0x28d2, 0xe0c2, 0x011a, 0x2862, 0xe0c2,
+	0x011b, 0xa202, 0xe0c2, 0x0110, 0x2a76, 0xf1c9, 0x2115, 0x4d15,
+	0xcf8c, 0x2115, 0x4d15, 0xcf8e, 0x28da, 0xe000, 0x0280, 0xe092,
+	0x2801, 0x4c00, 0x3d11, 0x2802, 0xae10, 0x4c03, 0x3d11, 0x2804,
+	0x3d11, 0xe0c0, 0x0121, 0x3511, 0x3d11, 0xe0c0, 0x0122, 0x3511,
+	0x3d11, 0xe42e, 0xe41e, 0x0cd8, 0x2866, 0xf10a, 0x2a52, 0xa80f,
+	0xf0db, 0xe167, 0x05f2, 0x2117, 0x4d17, 0x2a52, 0xa00f, 0xaf07,
+	0xae07, 0xa103, 0xe042, 0xe41e, 0x0d41, 0x2867, 0xf0ba, 0x2852,
+	0xa806, 0xa106, 0x2a52, 0xa007, 0xaf05, 0xae05, 0xa103, 0xe418,
+	0x0d0b, 0x2852, 0xe0c2, 0x003f, 0xe41e, 0x0cd4, 0xe41e, 0x0cd8,
+	0xe190, 0xe0c0, 0x0118, 0xa802, 0xf78a, 0xe42e, 0xe0c0, 0x011c,
+	0xf7ea, 0xe0c0, 0x011e, 0xe0c2, 0x0114, 0x3000, 0xa804, 0x3c01,
+	0x2800, 0xe0c2, 0x0188, 0xf09a, 0xe0c0, 0x0170, 0x3c02, 0xe0c0,
+	0x0174, 0x3c03, 0xe0c2, 0x0123, 0xe42e, 0x28da, 0xe000, 0x0280,
+	0xe092, 0x2801, 0x4c00, 0x3d11, 0x2802, 0xae10, 0x4c03, 0x3d11,
+	0x2804, 0x3d11, 0xe0c0, 0x0121, 0x3511, 0x3d11, 0xe0c0, 0x0122,
+	0x3511, 0x3d11, 0xe42e, 0x28db, 0xe000, 0x0280, 0xe09a, 0x2915,
+	0x3054, 0xaf02, 0x3055, 0x2905, 0xaf10, 0x3c56, 0x2915, 0xa81e,
+	0x3c57, 0x2915, 0x3c58, 0xe42e, 0x2115, 0x4d15, 0xcf8c, 0x2115,
+	0x4d15, 0xcf8e, 0xe42e, 0xe0c0, 0x018f, 0x3c04, 0xe0c2, 0x0309,
+	0x28da, 0xe000, 0x02c0, 0xe092, 0xe162, 0x0190, 0xe163, 0x03b0,
+	0xc420, 0xd022, 0x0003, 0xe184, 0x0c00, 0x9e12, 0x3511, 0x3d11,
+	0x9f33, 0xe42e, 0x28db, 0xe000, 0x02c0, 0xe092, 0xe005, 0x0080,
+	0xd022, 0x0003, 0xe184, 0x0c10, 0xcfd5, 0xa011, 0x2111, 0x4d11,
+	0xcfd6, 0xe42e, 0x2864, 0xe0c2, 0x0119, 0x28d2, 0xe0c2, 0x011a,
+	0x2862, 0xe0c2, 0x011b, 0xe42e, 0xa200, 0x3c64, 0xe004, 0x2222,
+	0x3cd2, 0x3c62, 0xe42e, 0x2805, 0x3c59, 0x2a15, 0x4629, 0x282b,
+	0xe419, 0x0e27, 0x3c05, 0x2805, 0x0824, 0xa400, 0xa566, 0xe000,
+	0x07f0, 0xe09c, 0x2906, 0xae0c, 0x4d06, 0xae0c, 0x4c05, 0xe0c2,
+	0x0115, 0xe42e, 0x2829, 0xf09a, 0xe0c0, 0x0414, 0xe418, 0x018c,
+	0xe0c0, 0x0414, 0xe41a, 0x0c88, 0x28d7, 0x2a50, 0xa113, 0xf071,
+	0x2a50, 0xa10d, 0xf037, 0xa402, 0xf02e, 0xa404, 0xe005, 0x0020,
+	0xe055, 0xe0c3, 0x0180, 0xe004, 0x0582, 0x2a3f, 0x46e1, 0x463e,
+	0xf03b, 0xe004, 0x0903, 0xe096, 0x2113, 0x4d13, 0xe0c2, 0x018c,
+	0x28d8, 0xe0c2, 0x018e, 0x28d9, 0xe0c2, 0x018a, 0xa201, 0x283d,
+	0xa11e, 0xa400, 0xa548, 0x3c03, 0xae04, 0xe000, 0x0740, 0xe09e,
+	0x2917, 0xe0c2, 0x0186, 0x2917, 0xe0c2, 0x0185, 0xe0c2, 0x0184,
+	0x2917, 0xe049, 0xae15, 0xe056, 0xae15, 0xe056, 0xe0c2, 0x0181,
+	0xe0c2, 0x0182, 0x2917, 0xae20, 0x4c75, 0xe0c2, 0x0183, 0xe42e,
+	0xa200, 0xe0c2, 0x0150, 0xe0c0, 0x0151, 0xf7e8, 0xe167, 0x01a0,
+	0x2317, 0x4f17, 0xe0c3, 0x0152, 0x2b17, 0xe009, 0x00ff, 0xae21,
+	0x4f07, 0xe0c3, 0x0153, 0xe0c1, 0x0101, 0xe0c3, 0x015d, 0x2add,
+	0xa53f, 0xa401, 0xae21, 0xe167, 0x01a2, 0x2907, 0xaf10, 0xe008,
+	0x001b, 0xe056, 0xe0c2, 0x015c, 0xa202, 0xe0c2, 0x0150, 0xe0c0,
+	0x0150, 0xf7ea, 0xe42e, 0xe004, 0x3211, 0xae20, 0xe00a, 0x2100,
+	0xe0c2, 0x0155, 0xe004, 0x9211, 0xae20, 0xe00a, 0x2100, 0xe0c2,
+	0x0158, 0xe004, 0x1000, 0xae20, 0xe00a, 0x0000, 0xe0c2, 0x0156,
+	0xe0c2, 0x0159, 0xe004, 0x0004, 0xe0c2, 0x0154, 0xe0c2, 0x0157,
+	0xa202, 0xe0c2, 0x015a, 0xe42e, 0xa202, 0xe0c2, 0x0110, 0xe42e,
+	0xe0c0, 0x0111, 0xf7e8, 0xe42e, 0xe0c0, 0x011c, 0xf7ea, 0xe42e,
+	0x2853, 0xa806, 0xae02, 0xe000, 0x05e0, 0xe09e, 0x28db, 0xe000,
+	0x0280, 0xe092, 0x2b11, 0xe01b, 0xae1f, 0xa200, 0xf0c9, 0x28db,
+	0xe000, 0x02c0, 0xe092, 0x2111, 0x4d11, 0xcfd6, 0xe049, 0xaf21,
+	0xe009, 0x7fff, 0x3f17, 0x3d17, 0x2853, 0xa806, 0xa106, 0x3c08,
+	0xe41a, 0x0d0b, 0x2808, 0xe42a, 0x2852, 0x1853, 0xa102, 0xe428,
+	0xe41e, 0x0d0b, 0xe42e, 0xe167, 0x05f6, 0x2117, 0x4d17, 0x2a53,
+	0xaf05, 0xae09, 0xe042, 0xce20, 0xd112, 0x0008, 0xd111, 0x05e0,
+	0xd113, 0x0002, 0xca28, 0xf7f8, 0xe42e, 0x2853, 0xa80e, 0xaf02,
+	0xe000, 0x05e8, 0xe09e, 0xcb94, 0xe008, 0x003f, 0x2a65, 0xae0d,
+	0xe056, 0x2a53, 0xa803, 0xf049, 0xae10, 0x3d07, 0xf06e, 0x2b07,
+	0xe009, 0xff00, 0xe056, 0x3d07, 0x2853, 0xa80e, 0xa10e, 0xe41a,
+	0x0d3a, 0xe42e, 0x2853, 0xa10e, 0xe167, 0x05f2, 0x2317, 0x4f17,
+	0xe042, 0xce20, 0xd111, 0x05e8, 0xd112, 0x0004, 0xd113, 0x0002,
+	0xca28, 0xf7f8, 0xe42e, 0x282b, 0xa118, 0xb608, 0xa54e, 0xe000,
+	0x0830, 0xe09c, 0x2906, 0xae04, 0xe0c2, 0x0176, 0xcca4, 0xc786,
+	0xe018, 0xa004, 0xe0c2, 0x0177, 0xe42e, 0x282b, 0xa11e, 0xa400,
+	0xa548, 0xe000, 0x0860, 0xe09c, 0x2906, 0xe0c2, 0x0189, 0xe42e,
+	0x2829, 0xe42a, 0x283e, 0xe428, 0xa202, 0x2a1c, 0xb616, 0xae02,
+	0x4c1e, 0xae20, 0x4c1c, 0xe0c2, 0x0108, 0x20c6, 0x4cc1, 0xe0c2,
+	0x0109, 0x2052, 0x4c1d, 0xe0c2, 0x010a, 0x20c2, 0x4cc3, 0xe0c2,
+	0x010b, 0x20c4, 0x4cc5, 0xe0c2, 0x010c, 0xe42e, 0x2829, 0xe42a,
+	0x283e, 0xe428, 0xe0c0, 0x010b, 0x34c2, 0x3cc3, 0xe0c0, 0x010c,
+	0x34c4, 0x3cc5, 0xe42e, 0xe0c1, 0x0044, 0xa80f, 0xe056, 0xe42e,
+	0xe0c1, 0x0044, 0xaf0d, 0xae03, 0xe056, 0xa87e, 0xe42e, 0xa203,
+	0xe0c3, 0x040d, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xe166, 0x04c0,
+	0xe167, 0x0500, 0x2832, 0xf1b6, 0xa102, 0xcc44, 0xe184, 0x0dc5,
+	0xa200, 0xe41e, 0x0d93, 0xaf04, 0xe41e, 0x0d98, 0xae20, 0x4c70,
+	0x9f17, 0x2050, 0x4c51, 0xae08, 0x9f17, 0x2116, 0x4d16, 0x9f17,
+	0x2116, 0x4d16, 0x9f17, 0x2116, 0x4d16, 0x9f17, 0xa201, 0xe0c3,
+	0x040d, 0xe42e, 0xe0c0, 0x0044, 0xaf20, 0xa802, 0xe428, 0xe0c0,
+	0x0060, 0xa83e, 0xa203, 0xe0c3, 0x040d, 0xcca4, 0xc785, 0xe018,
+	0xe000, 0x0500, 0xe09e, 0xe0c1, 0x0420, 0xa803, 0xf7db, 0xa200,
+	0xe41e, 0x0d93, 0xaf04, 0xe0c1, 0x0061, 0xaf21, 0xa807, 0xa105,
+	0xf025, 0xe04a, 0xe41e, 0x0d98, 0xe0c1, 0x0044, 0xaf17, 0xa803,
+	0xe40b, 0x0df3, 0xa81e, 0xae20, 0xe0c1, 0x0061, 0xe009, 0x1fff,
+	0xe056, 0x9f17, 0xe0c0, 0x0064, 0xa802, 0xf048, 0x2050, 0x4c51,
+	0xf03e, 0x2051, 0x4c50, 0xae08, 0x9f17, 0xe0c0, 0x006a, 0x9f17,
+	0xe0c0, 0x006b, 0x9f17, 0xe0c0, 0x006c, 0x9f17, 0xa201, 0xe0c3,
+	0x040d, 0xe42e, 0xcca4, 0xc786, 0xe018, 0xe000, 0x04c0, 0xe09c,
+	0x2116, 0x4d06, 0xe42e, 0xe41e, 0x0e33, 0xe42e, 0xe41e, 0x0e94,
+	0xe42e, 0xe41e, 0x0e95, 0xe42e, 0xe41e, 0x0ee6, 0xe42e, 0xe41e,
+	0x0f1c, 0xe42e, 0xe41e, 0x0f7c, 0xe42e, 0xe41e, 0x106b, 0xe42e,
+	0xe41e, 0x10cb, 0xe42e, 0xa254, 0x3ccd, 0xa268, 0x3c83, 0xa218,
+	0x3c85, 0xa266, 0x2ac8, 0xf03b, 0xe0c0, 0x0072, 0x3c84, 0xa210,
+	0x3c97, 0xe004, 0x07e0, 0x3c98, 0x2814, 0x2a52, 0x3c86, 0x3e8b,
+	0x2c17, 0xc710, 0x7c18, 0xe008, 0xffff, 0xa002, 0xaf02, 0x3c88,
+	0x3cbb, 0xe004, 0x6000, 0x2ac7, 0xf03b, 0xe0c0, 0x0073, 0x3c99,
+	0x2886, 0xe016, 0x3c87, 0xf06a, 0x2888, 0x3c86, 0xe004, 0x1000,
+	0x3c99, 0x8418, 0xe182, 0x7530, 0xe018, 0xae02, 0x2e17, 0xe41e,
+	0x1015, 0x3c9e, 0x849e, 0x827f, 0xe018, 0xa279, 0xe41e, 0x0ffe,
+	0x349e, 0x3c9f, 0xae06, 0x2a83, 0xe41e, 0x0ffe, 0x34a4, 0x3ca5,
+	0xa202, 0x3c89, 0xa205, 0x1a36, 0xae03, 0xa011, 0x3e8e, 0x2a8b,
+	0x5a8e, 0xe013, 0x36ae, 0x3eaf, 0x28b9, 0x2ab8, 0xf049, 0xe41e,
+	0x0fa5, 0x64cd, 0x3c8c, 0xa004, 0x6085, 0x6484, 0x3c8d, 0xa200,
+	0x3ce7, 0xe41e, 0x0fc9, 0xe42e, 0xe42e, 0x2829, 0x3c8a, 0xa201,
+	0x3e92, 0x3ecc, 0xe418, 0x0f87, 0xa200, 0x3c93, 0x3c94, 0x288a,
+	0xf238, 0x2889, 0xf05a, 0xa200, 0x3c89, 0x288c, 0xf37e, 0x2886,
+	0xa102, 0xf7ca, 0x2ab8, 0xf03b, 0x288c, 0xf30e, 0x848b, 0x82b5,
+	0xe019, 0xe04a, 0xaf02, 0x00a6, 0x0ca7, 0xe41e, 0x1015, 0xa21f,
+	0x3e8e, 0x2a86, 0xc70f, 0x7e8e, 0xe009, 0xffff, 0xa405, 0xe046,
+	0x6085, 0x64cd, 0xf1be, 0xa200, 0x3ca2, 0x3ca3, 0x2a92, 0xf08b,
+	0x288d, 0x2ae7, 0xf129, 0xa006, 0x2a84, 0xe066, 0xf0ee, 0x28c9,
+	0x308e, 0xaf02, 0x548e, 0xf08a, 0x288d, 0xa104, 0x6090, 0x2a8d,
+	0xa005, 0xe066, 0xf02e, 0x288d, 0x3c90, 0x2a29, 0xf069, 0x2a3f,
+	0xf039, 0x3ce4, 0xf02e, 0x28e4, 0x2a92, 0xe42e, 0xc872, 0xe41e,
+	0x0fd2, 0x288a, 0xf0ea, 0x2093, 0x4c94, 0xc710, 0x7c8b, 0xe008,
+	0xffff, 0xa002, 0xaf02, 0x3c8d, 0x2093, 0x4c94, 0x00a6, 0x0ca7,
+	0x34a6, 0x3ca7, 0x28b5, 0xa002, 0x3cb5, 0x288a, 0xf028, 0x3cb5,
+	0x288a, 0xf0f8, 0x2a86, 0xa103, 0x2095, 0x4c96, 0xe41e, 0x0ffe,
+	0x34ac, 0x3cad, 0x1095, 0x1c96, 0xe012, 0x34aa, 0x3cab, 0xf0ae,
+	0x22aa, 0x4eab, 0x12ac, 0x1ead, 0x2887, 0xb606, 0xb611, 0x36aa,
+	0x3eab, 0x2892, 0x3ce7, 0xe42e, 0x28c9, 0xf08a, 0x2852, 0x1853,
+	0xa102, 0xf048, 0x2805, 0xe40e, 0x0f71, 0x22a2, 0x4ea3, 0x20a4,
+	0x4ca5, 0xe041, 0xf0c7, 0xe045, 0xe045, 0x2890, 0xf0f5, 0x36a2,
+	0x3ea3, 0xa002, 0x6085, 0x6484, 0x3c90, 0xf08e, 0x36a2, 0x3ea3,
+	0x2890, 0xa102, 0x6085, 0x6484, 0x3c90, 0x2890, 0x6085, 0x6484,
+	0x3c90, 0x2ac9, 0x28cc, 0xa002, 0x3ccc, 0xf08b, 0xa103, 0xf22b,
+	0xa103, 0xf07b, 0xa103, 0xf0ab, 0xf24e, 0x2890, 0xe40e, 0x0f71,
+	0x28cb, 0xf18a, 0xa200, 0x3ccb, 0xf06e, 0x28cc, 0x18ca, 0xf124,
+	0xa200, 0x3ccc, 0x2853, 0xa002, 0xf046, 0xcb97, 0xcb96, 0xf03e,
+	0x2a2b, 0x282b, 0xa105, 0x6290, 0xa004, 0xe066, 0x3c90, 0x3c8e,
+	0xf08e, 0xcb96, 0x3c8e, 0x2853, 0xa002, 0xf030, 0x282b, 0x3c8e,
+	0x288e, 0x2a3d, 0xe045, 0xf053, 0x2a3d, 0xa007, 0xe066, 0xe42e,
+	0x2a3d, 0xa107, 0xe062, 0xe42e, 0x0093, 0x0c94, 0x3493, 0x3c94,
+	0x285f, 0x189a, 0x00a2, 0x0ca3, 0x34a2, 0x3ca3, 0xe42e, 0x20aa,
+	0x4cab, 0x1095, 0x1c96, 0x8499, 0xe41e, 0x104c, 0x009e, 0x0c9f,
+	0xf052, 0x2a91, 0xf039, 0xa203, 0x3e92, 0xe41e, 0x0fe4, 0x229e,
+	0x4e9f, 0xaf07, 0xe062, 0x34a0, 0x3ca1, 0xc710, 0x7c8b, 0xe008,
+	0xffff, 0xa002, 0xaf02, 0x3c9a, 0xe42e, 0x8486, 0x209e, 0x4c9f,
+	0xe41e, 0x1040, 0x8497, 0xe41e, 0x1040, 0x2a86, 0xa103, 0x0a97,
+	0xe41e, 0x0ffe, 0x34a0, 0x3ca1, 0x288b, 0x3cb0, 0x20a0, 0x4ca1,
+	0xae04, 0x00a0, 0x0ca1, 0xae02, 0xc70f, 0x7cb0, 0xe008, 0xffff,
+	0xaf08, 0xa010, 0xaf08, 0x0836, 0xa51e, 0x0898, 0xe09e, 0x2907,
+	0xe42e, 0x847f, 0x8280, 0xe018, 0x34a8, 0x3ca9, 0xa200, 0x3495,
+	0x3c96, 0xe42e, 0x109e, 0x1c9f, 0x0095, 0x0c96, 0xa27f, 0xae31,
+	0xe066, 0x3495, 0x3c96, 0x22ae, 0x4eaf, 0xe046, 0xf032, 0x3695,
+	0x3e96, 0x2095, 0x2896, 0xe42e, 0x2a80, 0xe42b, 0x22a8, 0x4ea9,
+	0x1295, 0x1e96, 0xe066, 0xf051, 0x2a91, 0xf039, 0xa203, 0x3e92,
+	0x2281, 0x4e82, 0xe42b, 0x22a8, 0x4ea9, 0x1295, 0x1e96, 0x029e,
+	0x0e9f, 0x1281, 0x1e82, 0xa401, 0xe062, 0xe42e, 0x3eb0, 0xa201,
+	0xf032, 0xe012, 0xa203, 0x3eb4, 0x3cb1, 0xaf20, 0xc70f, 0x7cb0,
+	0x3cb2, 0xaf20, 0xae20, 0x4cb1, 0xc70f, 0x7cb0, 0x3cb3, 0x20b2,
+	0x4cb3, 0x2ab4, 0xe42b, 0xe012, 0xe42e, 0x36b0, 0x3eb1, 0xa201,
+	0x3eb2, 0x22b0, 0x4eb1, 0x5ab2, 0xe045, 0xf061, 0x2ab2, 0xa003,
+	0x3eb2, 0xa121, 0xf775, 0x2ab2, 0xf039, 0xa200, 0xe42e, 0xa103,
+	0x3eb2, 0xcc45, 0xa201, 0x3eb3, 0xe184, 0x103d, 0x2ab3, 0xae03,
+	0x3eb3, 0x22b0, 0x4eb1, 0x5ab2, 0xe045, 0xf061, 0xe013, 0xe04a,
+	0x2ab3, 0xa003, 0x3eb3, 0x2ab2, 0xa103, 0x3eb2, 0x28b3, 0xe42e,
+	0xae02, 0x34b1, 0xe008, 0xffff, 0xaf02, 0x3cb0, 0x82b1, 0xe018,
+	0xae1e, 0x82b0, 0xe01c, 0xe42e, 0xae02, 0x34b1, 0xe008, 0xffff,
+	0xaf02, 0x3cb0, 0x82b0, 0xe018, 0xaf1e, 0x82b1, 0xe01c, 0xe42e,
+	0xae02, 0x34b1, 0xe008, 0xffff, 0xaf02, 0x3cb0, 0x82b1, 0xe018,
+	0xa103, 0x3eb2, 0x58b2, 0x82b0, 0xa11f, 0xe013, 0x3eb2, 0xe019,
+	0x5eb2, 0xe042, 0xe42e, 0x34bd, 0x3cbc, 0x28bc, 0xae02, 0x3cbc,
+	0x28bd, 0xa002, 0x3cbd, 0x2cbc, 0xc710, 0x7cbd, 0xe008, 0xffff,
+	0xa002, 0xaf02, 0x3c88, 0x18bb, 0xe42a, 0x2888, 0x3cbb, 0x28bc,
+	0x2abd, 0x3c17, 0x3e18, 0x8418, 0xe182, 0x7530, 0xe018, 0xae02,
+	0x2e17, 0xe41e, 0x1015, 0x3c9e, 0x849e, 0x827f, 0xe018, 0xa279,
+	0xe41e, 0x0ffe, 0x349e, 0x3c9f, 0xae06, 0x2a83, 0xe41e, 0x0ffe,
+	0x34a4, 0x3ca5, 0xa200, 0x3cb5, 0x34a6, 0x3ca7, 0x2886, 0xe428,
+	0xe016, 0x3c87, 0x2888, 0x3c86, 0xe42e, 0x3cb7, 0x2a86, 0xe046,
+	0xf028, 0xe42e, 0x28b6, 0x2ab7, 0xe046, 0xf034, 0xa200, 0x3cb6,
+	0x28b7, 0x3c86, 0x3c14, 0x2815, 0xe42a, 0x2886, 0xe016, 0x3c87,
+	0xf03a, 0x2a88, 0x3e86, 0x2a86, 0x28b6, 0xe045, 0xf0c6, 0x2095,
+	0x4c96, 0xe41e, 0x0ffe, 0x34ac, 0x3cad, 0x1095, 0x1c96, 0xe012,
+	0x34aa, 0x3cab, 0xe42e, 0x3cba, 0x2815, 0xe42a, 0x287f, 0x2aba,
+	0xe046, 0xe42a, 0x3e7f, 0x8418, 0xe182, 0x7530, 0xe018, 0xae02,
+	0x2e17, 0xe41e, 0x1015, 0x3c9e, 0x849e, 0x827f, 0xe018, 0xa279,
+	0xe41e, 0x0ffe, 0x349e, 0x3c9f, 0xae06, 0x2a83, 0xe41e, 0x0ffe,
+	0x34a4, 0x3ca5, 0xa200, 0x3cb5, 0x34a6, 0x3ca7, 0xe42e, 0x2a15,
+	0xe42b, 0xf042, 0xa201, 0x3eb8, 0xe42e, 0x3cb9, 0x3c8c, 0xa203,
+	0x3eb8, 0xe42e, 0xe0c1, 0x0060, 0xa803, 0xf05b, 0xe0c0, 0x0061,
+	0xe41e, 0x10a5, 0xe0c1, 0x0060, 0xa805, 0xf05b, 0xe0c0, 0x0062,
+	0xe41e, 0x10ef, 0xe0c1, 0x0060, 0xa809, 0xf05b, 0xe0c0, 0x0063,
+	0xe41e, 0x0e30, 0xe0c1, 0x0060, 0xa811, 0xf05b, 0xe0c0, 0x0064,
+	0xe41e, 0x0e2d, 0xe0c1, 0x0060, 0xa821, 0xf04b, 0xe0c0, 0x0065,
+	0x3c1c, 0xe0c1, 0x0060, 0xa841, 0xf08b, 0xe0c0, 0x0066, 0x3038,
+	0xaf02, 0x3039, 0xaf02, 0x3c3a, 0xe42e, 0xa200, 0x3c63, 0x3cd3,
+	0x3c64, 0xe42e, 0xe161, 0x0200, 0xe004, 0x2222, 0xe188, 0x007f,
+	0x3d11, 0xe190, 0xe42e, 0xf149, 0x2a63, 0x28d3, 0xe000, 0x0200,
+	0xe09c, 0x2906, 0x3c62, 0xf089, 0xe004, 0x2222, 0x3cd2, 0xe0c0,
+	0x0173, 0x3506, 0xf05e, 0xe0c0, 0x0173, 0x3506, 0x3cd2, 0x28d3,
+	0xa002, 0x3cd3, 0xa002, 0x1850, 0xe428, 0x3cd3, 0xe42e, 0xa200,
+	0x3cc2, 0x3cc4, 0x3cc5, 0xe161, 0x0905, 0x3d11, 0x8111, 0x3d11,
+	0x3d11, 0xe42e, 0xa200, 0x3c1d, 0xe42e, 0x2a3e, 0xa200, 0xe429,
+	0x281e, 0xf208, 0x281d, 0x181c, 0xf3f2, 0x2853, 0xa006, 0x18c2,
+	0xf3b4, 0x28c2, 0x08c1, 0x18c6, 0xf0b4, 0x28c4, 0xa002, 0xc70f,
+	0x7cc1, 0xaf20, 0x3cc4, 0x3cc2, 0x281c, 0x3c1d, 0xf2be, 0x281d,
+	0xa002, 0x3c1d, 0x28c2, 0x08c1, 0xc70f, 0x7cc6, 0xaf20, 0x3cc2,
+	0xf21e, 0x281d, 0x181c, 0xf202, 0x2853, 0xa006, 0x18c3, 0xf1c4,
+	0x28c3, 0x08c1, 0x1852, 0xf0c4, 0x28c5, 0xa002, 0xc70f, 0x7cc1,
+	0xaf20, 0x3cc5, 0x08c6, 0x3cc3, 0x281c, 0x3c1d, 0xf0be, 0x281d,
+	0xa002, 0x3c1d, 0x28c3, 0x08c1, 0xc70f, 0x7c52, 0xaf20, 0x3cc3,
+	0xf01e, 0xa202, 0xe42e, 0xa200, 0xe42e, 0xa200, 0x3c4d, 0xe0c0,
+	0x0060, 0x344a, 0x3c4b, 0x347c, 0x3c7d, 0xe0c0, 0x0061, 0xae04,
+	0x3c4c, 0xe41e, 0x11ce, 0xe42e, 0xd030, 0x0000, 0xd034, 0x0000,
+	0xd033, 0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037, 0x0080,
+	0xd038, 0x0000, 0xa200, 0x3c49, 0xe42e, 0xe470, 0x204a, 0x4c4b,
+	0x2e4d, 0xae11, 0xe042, 0xe0c2, 0x0049, 0x347c, 0x3c7d, 0xe42e,
+	0xd071, 0x242a, 0xe181, 0xa200, 0x34df, 0x3ce0, 0xe004, 0x0200,
+	0x3cf3, 0x3cf6, 0xe41e, 0x1294, 0xe41e, 0x12b0, 0xe41e, 0x12cd,
+	0xe41e, 0x12f1, 0xe41e, 0x12fc, 0xe42e, 0xe41e, 0x1218, 0xe41e,
+	0x1234, 0xca48, 0xaf3c, 0xa802, 0xf05a, 0xa202, 0x3cf4, 0xae3c,
+	0xce48, 0xca48, 0xaf38, 0xa802, 0xf0aa, 0xe41e, 0x1207, 0xe41e,
+	0x12f1, 0xa202, 0xae38, 0xce48, 0xe41e, 0x12fc, 0xe470, 0x247c,
+	0x4c7d, 0x264a, 0x4e4b, 0xe046, 0x2e4c, 0xae11, 0xe045, 0xe425,
+	0x28f3, 0xe045, 0xf043, 0xe041, 0x3ef6, 0xe42e, 0x3cf6, 0xe42e,
+	0xca55, 0x28f6, 0xf048, 0xa200, 0xceaa, 0xf04e, 0x20df, 0x4ce0,
+	0xe045, 0x247c, 0x4c7d, 0xe042, 0x347c, 0x3c7d, 0x28f6, 0xe42a,
+	0x24df, 0x4ce0, 0xe042, 0x34df, 0x3ce0, 0x2af6, 0xe046, 0xe428,
+	0xa200, 0x34df, 0x3ce0, 0xe42e, 0xa200, 0x3c4f, 0x247c, 0x4c7d,
+	0x264a, 0x4e4b, 0xe046, 0xe049, 0xaf10, 0x3c4d, 0x2c4c, 0xae10,
+	0xe045, 0xf275, 0x28bf, 0xf1fa, 0xa202, 0xe0c2, 0x0074, 0x247c,
+	0x4c7d, 0xe0c2, 0x0049, 0x2ace, 0xf16b, 0xe0c0, 0x005c, 0xe008,
+	0x8000, 0xf11a, 0xe0c0, 0x005d, 0xe00a, 0x8000, 0xe0c2, 0x005d,
+	0xa202, 0xce00, 0xe0c1, 0x005d, 0xe009, 0x8000, 0xf7c9, 0xe0c0,
+	0x0004, 0xf798, 0xa200, 0x3c4d, 0x264a, 0x4e4b, 0x367c, 0x3e7d,
+	0x267c, 0x4e7d, 0xe0c3, 0x0049, 0x28bf, 0xe428, 0xd027, 0x0000,
+	0xe41e, 0x1275, 0xd027, 0x0001, 0xe42e, 0xe0c0, 0x0048, 0xe0c1,
+	0x0049, 0xe046, 0xf040, 0x2e4c, 0xae11, 0xe042, 0xe005, 0x0200,
+	0xe046, 0xe420, 0x284f, 0xf728, 0xe0c0, 0x005c, 0xe008, 0x8000,
+	0xf6da, 0xe0c0, 0x005d, 0xe00a, 0x8000, 0xe0c2, 0x005d, 0xa202,
+	0xce00, 0x3c4f, 0xf63e, 0xe42e, 0xa220, 0xa20d, 0xe056, 0xa203,
+	0xe056, 0xae20, 0xcc9e, 0xd030, 0x0000, 0xd033, 0x0000, 0xd034,
+	0x0000, 0xd035, 0x0000, 0xd036, 0x00ff, 0xd037, 0x0080, 0xd038,
+	0x0000, 0xd039, 0x0000, 0xd046, 0x0000, 0xd047, 0x0000, 0xe42e,
+	0xe0c0, 0x0043, 0xaf0c, 0x30ce, 0xa202, 0xae0e, 0xe0c1, 0x0043,
+	0xa807, 0xae09, 0xe056, 0xce4e, 0xa222, 0xae28, 0xa217, 0xae37,
+	0xe056, 0xce4c, 0xa200, 0xce54, 0xa206, 0xae38, 0xe005, 0x0003,
+	0xe056, 0xce4a, 0xa200, 0xce58, 0xe42e, 0xe0c0, 0x005b, 0xa110,
+	0xf04a, 0xa106, 0xf05a, 0xe42e, 0xe004, 0x0038, 0xf03e, 0xe004,
+	0x0020, 0xe005, 0x0080, 0xe056, 0xe005, 0x1800, 0xe056, 0xcec0,
+	0xa208, 0xcec8, 0xa200, 0xce92, 0xce9e, 0xce88, 0xce8a, 0xced0,
+	0xced6, 0xcea4, 0xcec6, 0xa202, 0xce9c, 0xe004, 0x0200, 0xce96,
+	0xe42e, 0xa206, 0x2af6, 0xae11, 0xe056, 0xce5a, 0x247c, 0x4c7d,
+	0xce5c, 0xa200, 0xce5e, 0xe42e, 0xe004, 0x0f00, 0xae20, 0xe005,
+	0x0003, 0xe056, 0xe005, 0x0030, 0xe056, 0xca49, 0xaf21, 0xa803,
+	0xf04b, 0xa203, 0xae2f, 0xe056, 0xce4a, 0xe42e, 0xc872, 0xa050,
+	0xcc72, 0xa200, 0xe41e, 0x135e, 0xa200, 0xe41e, 0x135e, 0xa200,
+	0xe41e, 0x135e, 0xa202, 0xe41e, 0x135e, 0xa200, 0xce96, 0xceaa,
+	0x282f, 0xae0a, 0x4c30, 0xe41e, 0x135e, 0x2830, 0xa11c, 0xf05a,
+	0x2830, 0xa128, 0xf02a, 0xf2be, 0xc872, 0xa030, 0xcc72, 0xa200,
+	0xae02, 0x2a31, 0xb436, 0xae0c, 0xa900, 0xae14, 0x2a30, 0xa11d,
+	0xb432, 0xae06, 0xa900, 0xae02, 0x4c3e, 0xae02, 0x2a3f, 0xe017,
+	0x463e, 0x46e1, 0xb432, 0xae02, 0xa902, 0x3c07, 0xaf20, 0xe008,
+	0x00ff, 0xe41e, 0x135e, 0x2807, 0xaf10, 0xe008, 0x00ff, 0xe41e,
+	0x135e, 0x2807, 0xe008, 0x00ff, 0xe41e, 0x135e, 0xe41e, 0x11bc,
+	0xa200, 0xce92, 0xe42e, 0xca9b, 0xf7f9, 0xe42e, 0xe41e, 0x135b,
+	0xcec4, 0xe42e, 0xca48, 0xa802, 0xf7e8, 0xca4c, 0xa802, 0xf7ea,
+	0xe42e, 0xe41e, 0x1362, 0xe41e, 0x135b, 0xa200, 0x3cf4, 0xe004,
+	0x0030, 0xce98, 0x28f4, 0xf7fa, 0xe42e, 0xe082, 0x3c4e, 0xe161,
+	0x0180, 0xca80, 0x3511, 0x3d11, 0xca82, 0x3511, 0x3d11, 0xca84,
+	0x3511, 0x3d11, 0xca86, 0x3511, 0x3d11, 0x8b11, 0x0144, 0x8b11,
+	0x0145, 0x8b11, 0x0148, 0x8b11, 0x0149, 0x8b11, 0x014a, 0x8b11,
+	0x014b, 0x8b11, 0x0160, 0x8b11, 0x014e, 0x8b11, 0x014f, 0x8b11,
+	0x0152, 0x8b11, 0x0153, 0x8b11, 0x0155, 0x8b11, 0x0157, 0x8b11,
+	0x0163, 0x8b11, 0x0164, 0x8b11, 0x0165, 0xcacc, 0x3511, 0x3d11,
+	0xcace, 0x3511, 0x3d11, 0x8b11, 0x0168, 0xcad2, 0x3511, 0x3d11,
+	0xcad4, 0x3511, 0x3d11, 0x8b11, 0x016b, 0x8b11, 0x016c, 0x8b11,
+	0x016d, 0x8b11, 0x016e, 0xc860, 0x3511, 0x3d11, 0xc862, 0x3511,
+	0x3d11, 0xc864, 0x3511, 0x3d11, 0x8b11, 0x0033, 0x8b11, 0x0034,
+	0x8b11, 0x0035, 0x8b11, 0x0036, 0x8b11, 0x0037, 0x8b11, 0x0038,
+	0xc872, 0x3511, 0x3d11, 0x8b11, 0x003a, 0xc87a, 0x3511, 0x3d11,
+	0xc87c, 0x3511, 0x3d11, 0xc880, 0x3511, 0x3d11, 0xc882, 0x3511,
+	0x3d11, 0xc884, 0x3511, 0x3d11, 0xc886, 0x3511, 0x3d11, 0xc888,
+	0x3511, 0x3d11, 0xc88a, 0x3511, 0x3d11, 0xc88c, 0x3511, 0x3d11,
+	0xc890, 0x3511, 0x3d11, 0xc892, 0x3511, 0x3d11, 0xc894, 0x3511,
+	0x3d11, 0xc896, 0x3511, 0x3d11, 0xc898, 0x3511, 0x3d11, 0xc89e,
+	0x3511, 0x3d11, 0x284e, 0xe092, 0xe42e, 0xe082, 0x3c4e, 0xe161,
+	0x0180, 0x2111, 0x4d11, 0xce80, 0x2111, 0x4d11, 0xce82, 0x2111,
+	0x4d11, 0xce84, 0x2111, 0x4d11, 0xce86, 0x8911, 0x0144, 0x8911,
+	0x0145, 0x8911, 0x0148, 0x8911, 0x0149, 0x8911, 0x014a, 0x8911,
+	0x014b, 0x8911, 0x0160, 0x8911, 0x014e, 0x8911, 0x014f, 0x8911,
+	0x0152, 0x8911, 0x0153, 0x8911, 0x0155, 0x8911, 0x0157, 0x8911,
+	0x0163, 0x8911, 0x0164, 0x8911, 0x0165, 0x2111, 0x4d11, 0xcecc,
+	0x2111, 0x4d11, 0xcece, 0x8911, 0x0168, 0x2111, 0x4d11, 0xced2,
+	0x2111, 0x4d11, 0xced4, 0x8911, 0x016b, 0x8911, 0x016c, 0x8911,
+	0x016d, 0x8911, 0x016e, 0x2111, 0x4d11, 0xcc60, 0x2111, 0x4d11,
+	0xcc62, 0x2111, 0x4d11, 0xcc64, 0x8911, 0x0033, 0x8911, 0x0034,
+	0x8911, 0x0035, 0x8911, 0x0036, 0x8911, 0x0037, 0x8911, 0x0038,
+	0x2111, 0x4d11, 0xcc72, 0x8911, 0x003a, 0x2111, 0x4d11, 0xcc7a,
+	0x2111, 0x4d11, 0xcc7c, 0x2111, 0x4d11, 0xcc80, 0x2111, 0x4d11,
+	0xcc82, 0x2111, 0x4d11, 0xcc84, 0x2111, 0x4d11, 0xcc86, 0x2111,
+	0x4d11, 0xcc88, 0x2111, 0x4d11, 0xcc8a, 0x2111, 0x4d11, 0xcc8c,
+	0x2111, 0x4d11, 0xcc90, 0x2111, 0x4d11, 0xcc92, 0x2111, 0x4d11,
+	0xcc94, 0x2111, 0x4d11, 0xcc96, 0x2111, 0x4d11, 0xcc98, 0x2111,
+	0x4d11, 0xe005, 0x1415, 0xae21, 0xe056, 0xcc9e, 0xd14c, 0x0002,
+	0x284e, 0xe092, 0xe42e, 0xe082, 0x3c4e, 0xe161, 0x0180, 0xc872,
+	0x3511, 0x3d11, 0xcac6, 0x3cfa, 0x3d11, 0xf07a, 0xcacc, 0x3511,
+	0x3d11, 0xcace, 0x3511, 0x3d11, 0x284e, 0xe092, 0xe42e, 0x2afa,
+	0xe42b, 0x247c, 0x4c7d, 0xe046, 0x347c, 0x3c7d, 0xe42e, 0xe082,
+	0x3c4e, 0xe161, 0x0180, 0x2111, 0x4d11, 0xcc72, 0x2b11, 0xf15b,
+	0x2901, 0xaf10, 0xe008, 0x00ff, 0xe41e, 0x135e, 0x28fa, 0xa102,
+	0xf0ca, 0x3cfa, 0x2911, 0xe008, 0x00ff, 0xe41e, 0x135e, 0x28fa,
+	0xa102, 0xf03a, 0x3cfa, 0xf6de, 0x284e, 0xe092, 0xe42e, 0xa200,
+	0x3c3f, 0xe42e, 0xe163, 0x0035, 0xe164, 0x0900, 0xa202, 0xe41e,
+	0x151d, 0xe163, 0x0580, 0xe164, 0x0901, 0xa208, 0xe41e, 0x151d,
+	0xe163, 0x00c2, 0xe164, 0x0905, 0xa208, 0xe41e, 0x151d, 0x283f,
+	0xaa02, 0x3c3f, 0xe42e, 0xa202, 0xbbfc, 0xa200, 0xbbfc, 0xa202,
+	0xbbfc, 0x28e1, 0xf06a, 0xa202, 0xbbfc, 0xa200, 0xbbfc, 0xf03e,
+	0xa200, 0xbbfc, 0xa200, 0xbbfc, 0xbbfc, 0xbbfc, 0xbbfc, 0x28e3,
+	0xba8e, 0xa200, 0xbbfc, 0xbac2, 0xa202, 0xbbfc, 0xa200, 0xbbfc,
+	0xa202, 0xbbfc, 0xbbfc, 0xe42e, 0x283f, 0xe428, 0xa21c, 0x3c30,
+	0xe41e, 0x130e, 0xe41e, 0x1369, 0xe42e, 0xa102, 0xcc44, 0xe184,
+	0x1524, 0x2d03, 0x2f04, 0x3d14, 0x3f13, 0xe42e, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+	0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190, 0xe190,
+};
diff -ENwbur a/drivers/media/platform/nxp-vpu/Makefile b/drivers/media/platform/nxp-vpu/Makefile
--- a/drivers/media/platform/nxp-vpu/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/Makefile	2018-05-06 08:49:50.070731614 +0200
@@ -0,0 +1,13 @@
+
+nxp-vpu-objs := nx_vpu_v4l2.o \
+				nx_vpu_dec_v4l2.o \
+				nx_vpu_enc_v4l2.o \
+				nx_port_func.o \
+				nx_vpu_api.o \
+				nx_vpu_encoder.o \
+				nx_vpu_decoder.o \
+				nx_jpu_api.o \
+				vpu_hw_interface.o \
+				nx_vpu_gdi.o
+
+obj-$(CONFIG_VIDEO_NEXELL_CODEC) += nxp-vpu.o
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_jpu_api.c b/drivers/media/platform/nxp-vpu/nx_jpu_api.c
--- a/drivers/media/platform/nxp-vpu/nx_jpu_api.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_jpu_api.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,1787 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef UNUSED
+#define UNUSED(p) ((void)(p))
+#endif
+
+#include <linux/delay.h>
+
+#include "vpu_hw_interface.h"		/* Register Access */
+#include "nx_vpu_api.h"
+#include "nx_port_func.h"
+#include "vpu_types.h"
+
+
+#define	INFO_MSG					0
+
+#define DC_TABLE_INDEX0				0
+#define AC_TABLE_INDEX0				1
+#define DC_TABLE_INDEX1				2
+#define AC_TABLE_INDEX1				3
+
+#define Q_COMPONENT0				0
+#define Q_COMPONENT1				0x40
+#define Q_COMPONENT2				0x80
+
+
+enum {
+	INT_JPU_DONE = 0,
+	INT_JPU_ERROR = 1,
+	INT_JPU_BBC_INTERRUPT = 2,
+	INT_JPU_BIT_BUF_EMPTY = 3,
+	INT_JPU_BIT_BUF_FULL = 3,
+	INT_JPU_PARIAL_OVERFLOW = 3
+};
+
+
+/* ----------------------------------------------------------------------------
+ * File: VpuJpegTable.h
+ *
+ * Copyright (c) 2006, Chips & Media.  All rights reserved.
+ * -------------------------------------------------------------------------- */
+#ifndef JPEG_TABLE_H
+#define JPEG_TABLE_H
+
+static unsigned char DefHuffmanBits[4][16] = {
+	{
+		/* DC index 0 (Luminance DC) */
+		0x00, 0x01, 0x05, 0x01, 0x01, 0x01, 0x01, 0x01,
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+	},
+	{
+		/* AC index 0 (Luminance AC) */
+		0x00, 0x02, 0x01, 0x03, 0x03, 0x02, 0x04, 0x03,
+		0x05, 0x05, 0x04, 0x04, 0x00, 0x00, 0x01, 0x7D
+	},
+	{
+		/* DC index 1 (Chrominance DC) */
+		0x00, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+		0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00
+	},
+	{
+		/* AC index 1 (Chrominance AC) */
+		0x00, 0x02, 0x01, 0x02, 0x04, 0x04, 0x03, 0x04,
+		0x07, 0x05, 0x04, 0x04, 0x00, 0x01, 0x02, 0x77
+	}
+};
+
+static unsigned char DefHuffmanValue[4][162] = {
+	{
+		/* DC index 0 (Luminance DC) */
+		0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+		0x0A, 0x0B,
+	},
+	{
+		/* AC index 0 (Luminance AC) */
+		0x01, 0x02, 0x03, 0x00, 0x04, 0x11, 0x05, 0x12, 0x21, 0x31,
+		0x41, 0x06, 0x13, 0x51, 0x61, 0x07, 0x22, 0x71, 0x14, 0x32,
+		0x81, 0x91, 0xA1, 0x08, 0x23, 0x42, 0xB1, 0xC1, 0x15, 0x52,
+		0xD1, 0xF0, 0x24, 0x33, 0x62, 0x72, 0x82, 0x09, 0x0A, 0x16,
+		0x17, 0x18, 0x19, 0x1A, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A,
+		0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x43, 0x44, 0x45,
+		0x46, 0x47, 0x48, 0x49, 0x4A, 0x53, 0x54, 0x55, 0x56, 0x57,
+		0x58, 0x59, 0x5A, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69,
+		0x6A, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x83,
+		0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x92, 0x93, 0x94,
+		0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0xA2, 0xA3, 0xA4, 0xA5,
+		0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6,
+		0xB7, 0xB8, 0xB9, 0xBA, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7,
+		0xC8, 0xC9, 0xCA, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7, 0xD8,
+		0xD9, 0xDA, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7, 0xE8,
+		0xE9, 0xEA, 0xF1, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8,
+		0xF9, 0xFA,
+	},
+	{
+		/* DC index 1 (Chrominance DC) */
+		0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
+		0x0A, 0x0B,
+	},
+	{
+		/* AC index 1 (Chrominance AC) */
+		0x00, 0x01, 0x02, 0x03, 0x11, 0x04, 0x05, 0x21, 0x31, 0x06,
+		0x12, 0x41, 0x51, 0x07, 0x61, 0x71, 0x13, 0x22, 0x32, 0x81,
+		0x08, 0x14, 0x42, 0x91, 0xA1, 0xB1, 0xC1, 0x09, 0x23, 0x33,
+		0x52, 0xF0, 0x15, 0x62, 0x72, 0xD1, 0x0A, 0x16, 0x24, 0x34,
+		0xE1, 0x25, 0xF1, 0x17, 0x18, 0x19, 0x1A, 0x26, 0x27, 0x28,
+		0x29, 0x2A, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x43, 0x44,
+		0x45, 0x46, 0x47, 0x48, 0x49, 0x4A, 0x53, 0x54, 0x55, 0x56,
+		0x57, 0x58, 0x59, 0x5A, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68,
+		0x69, 0x6A, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A,
+		0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x92,
+		0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9A, 0xA2, 0xA3,
+		0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xA9, 0xAA, 0xB2, 0xB3, 0xB4,
+		0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xC2, 0xC3, 0xC4, 0xC5,
+		0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6,
+		0xD7, 0xD8, 0xD9, 0xDA, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7,
+		0xE8, 0xE9, 0xEA, 0xF2, 0xF3, 0xF4, 0xF5, 0xF6, 0xF7, 0xF8,
+		0xF9, 0xFA,
+	}
+};
+
+#ifdef USE_PRE_DEF_QTABLE
+static unsigned char lumaQ[64] = {
+	0x06, 0x04, 0x04, 0x04, 0x05, 0x04, 0x06, 0x05,
+	0x05, 0x06, 0x09, 0x06, 0x05, 0x06, 0x09, 0x0B,
+	0x08, 0x06, 0x06, 0x08, 0x0B, 0x0C, 0x0A, 0x0A,
+	0x0B, 0x0A, 0x0A, 0x0C, 0x10, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x10, 0x0C, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C,
+};
+
+static unsigned char chromaBQ[64] = {
+	0x07, 0x07, 0x07, 0x0D, 0x0C, 0x0D, 0x18, 0x10,
+	0x10, 0x18, 0x14, 0x0E, 0x0E, 0x0E, 0x14, 0x14,
+	0x0E, 0x0E, 0x0E, 0x0E, 0x14, 0x11, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x11, 0x11, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x11, 0x0C, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C,
+	0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C, 0x0C,
+};
+#endif
+
+/* These are the sample quantization tables given in JPEG spec section K.1.
+ * The spec says that the values given produce "good" quality, and
+ * when divided by 2, "very good" quality. */
+static unsigned int std_luminance_quant_tbl[64] = {
+	16,  11,  10,  16,  24,  40,  51,  61,
+	12,  12,  14,  19,  26,  58,  60,  55,
+	14,  13,  16,  24,  40,  57,  69,  56,
+	14,  17,  22,  29,  51,  87,  80,  62,
+	18,  22,  37,  56,  68, 109, 103,  77,
+	24,  35,  55,  64,  81, 104, 113,  92,
+	49,  64,  78,  87, 103, 121, 120, 101,
+	72,  92,  95,  98, 112, 100, 103,  99
+};
+
+static unsigned int std_chrominance_quant_tbl[64] = {
+	17,  18,  24,  47,  99,  99,  99,  99,
+	18,  21,  26,  66,  99,  99,  99,  99,
+	24,  26,  56,  99,  99,  99,  99,  99,
+	47,  66,  99,  99,  99,  99,  99,  99,
+	99,  99,  99,  99,  99,  99,  99,  99,
+	99,  99,  99,  99,  99,  99,  99,  99,
+	99,  99,  99,  99,  99,  99,  99,  99,
+	99,  99,  99,  99,  99,  99,  99,  99
+};
+
+static unsigned char cInfoTable[5][24] = {
+	{ 0, 2, 2, 0, 0, 0, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 3, }, /* 420 */
+	{ 0, 2, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 3, }, /* 422H */
+	{ 0, 1, 2, 0, 0, 0, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 3, }, /* 422V */
+	{ 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 3, }, /* 444 */
+	{ 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 3, }, /* 400 */
+};
+
+#endif	/* JPEG_TABLE_H */
+
+
+/*-----------------------------------------------------------------------------
+ *      For Jpeg Encoder
+ *----------------------------------------------------------------------------*/
+static void SetupJpegEncPara(struct enc_jpeg_info *pJpgInfo, int quality)
+{
+	int scale_factor;
+	int i;
+	long temp;
+	unsigned char *p;
+	int format = pJpgInfo->format;
+	const int force_baseline = 1;
+
+	if (format == IMG_FORMAT_420) {
+		pJpgInfo->busReqNum = 2;
+		pJpgInfo->mcuBlockNum = 6;
+		pJpgInfo->compNum = 3;
+		pJpgInfo->compInfo[0] = 10;
+		pJpgInfo->compInfo[1] = 5;
+		pJpgInfo->compInfo[2] = 5;
+	} else if (format == IMG_FORMAT_422) {
+		pJpgInfo->busReqNum = 3;
+		pJpgInfo->mcuBlockNum = 4;
+		pJpgInfo->compNum = 3;
+		pJpgInfo->compInfo[0] = 9;
+		pJpgInfo->compInfo[1] = 5;
+		pJpgInfo->compInfo[2] = 5;
+	} else if (format == IMG_FORMAT_224) {
+		pJpgInfo->busReqNum  = 3;
+		pJpgInfo->mcuBlockNum = 4;
+		pJpgInfo->compNum = 3;
+		pJpgInfo->compInfo[0] = 6;
+		pJpgInfo->compInfo[1] = 5;
+		pJpgInfo->compInfo[2] = 5;
+	} else if (format == IMG_FORMAT_444) {
+		pJpgInfo->busReqNum = 4;
+		pJpgInfo->mcuBlockNum = 3;
+		pJpgInfo->compNum = 3;
+		pJpgInfo->compInfo[0] = 5;
+		pJpgInfo->compInfo[1] = 5;
+		pJpgInfo->compInfo[2] = 5;
+	} else if (format == IMG_FORMAT_400) {
+		pJpgInfo->busReqNum = 4;
+		pJpgInfo->mcuBlockNum = 1;
+		pJpgInfo->compNum = 1;
+		pJpgInfo->compInfo[0] = 5;
+		pJpgInfo->compInfo[1] = 0;
+		pJpgInfo->compInfo[2] = 0;
+	}
+
+	p = &cInfoTable[format][0];
+	NX_DrvMemcpy((void *)&pJpgInfo->cInfoTab[0], (void *)p, 6);
+	p += 6;
+	NX_DrvMemcpy((void *)&pJpgInfo->cInfoTab[1], (void *)p, 6);
+	p += 6;
+	NX_DrvMemcpy((void *)&pJpgInfo->cInfoTab[2], (void *)p, 6);
+	p += 6;
+	NX_DrvMemcpy((void *)&pJpgInfo->cInfoTab[3], (void *)p, 6);
+
+	if (quality <= 0)
+		quality = 1;
+	if (quality > 100)
+		quality = 100;
+
+	/* The basic table is used as-is (scaling 100) for a quality of 50.
+	* Qualities 50..100 are converted to scaling percentage 200 - 2*Q;
+	* note that at Q=100 the scaling is 0, which will cause
+	* jpeg_add_quant_table to make all the table entries 1
+	* (hence, minimum quantization loss).
+	* Qualities 1..50 are converted to scaling percentage 5000/Q. */
+	if (quality < 50)
+		scale_factor = 5000 / quality;
+	else
+		scale_factor = 200 - quality*2;
+
+	for (i = 0; i < 64; i++) {
+		temp = ((long)std_luminance_quant_tbl[i] * scale_factor + 50L)
+			/ 100L;
+		/* limit the values to the valid range */
+		if (temp <= 0L)
+			temp = 1L;
+		/* max quantizer needed for 12 bits */
+		if (temp > 32767L)
+			temp = 32767L;
+		/* limit to baseline range if requested */
+		if (force_baseline && temp > 255L)
+			temp = 255L;
+
+		pJpgInfo->qMatTab[DC_TABLE_INDEX0][i] = (unsigned char)temp;
+	}
+
+	for (i = 0; i < 64; i++) {
+		temp = ((long)std_chrominance_quant_tbl[i] * scale_factor + 50L)
+			/ 100L;
+		/* limit the values to the valid range */
+		if (temp <= 0L)
+			temp = 1L;
+		/* max quantizer needed for 12 bits */
+		if (temp > 32767L)
+			temp = 32767L;
+		/* limit to baseline range if requested */
+		if (force_baseline && temp > 255L)
+			temp = 255L;
+
+		pJpgInfo->qMatTab[AC_TABLE_INDEX0][i] = (unsigned char)temp;
+	}
+
+	/* setting of qmatrix table information */
+#ifdef USE_CNM_DEFAULT_QMAT_TABLE
+	NX_DrvMemcpy((void *)&pJpgInfo->qMatTab[DC_TABLE_INDEX0],
+		(void *)lumaQ, 64);
+	NX_DrvMemcpy((void *)&pJpgInfo->qMatTab[AC_TABLE_INDEX0],
+		(void *)chromaBQ, 64);
+#endif
+
+	NX_DrvMemcpy((void *)&pJpgInfo->qMatTab[DC_TABLE_INDEX1],
+		(void *)&pJpgInfo->qMatTab[DC_TABLE_INDEX0], 64);
+	NX_DrvMemcpy((void *)&pJpgInfo->qMatTab[AC_TABLE_INDEX1],
+		(void *)&pJpgInfo->qMatTab[AC_TABLE_INDEX0], 64);
+
+	/* setting of huffman table information */
+	/* Luma DC BitLength */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffBits[DC_TABLE_INDEX0],
+		(void *)&DefHuffmanBits[0][0], 16);
+
+	/* Luma DC HuffValue */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffVal[DC_TABLE_INDEX0],
+		(void *)&DefHuffmanValue[0][0], 16);
+	/* Luma AC BitLength */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffBits[AC_TABLE_INDEX0],
+		(void *)&DefHuffmanBits[1][0], 16);
+	/* Luma AC HuffValue */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffVal[AC_TABLE_INDEX0],
+		(void *)&DefHuffmanValue[1][0], 162);
+	/* Chroma DC BitLength */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffBits[DC_TABLE_INDEX1],
+		(void *)&DefHuffmanBits[2][0], 16);
+	/* Chroma DC HuffValue */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffVal[DC_TABLE_INDEX1],
+		(void *)&DefHuffmanValue[2][0], 16);
+	/* Chroma AC BitLength */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffBits[AC_TABLE_INDEX1],
+		(void *)&DefHuffmanBits[3][0], 16);
+	/* Chorma AC HuffValue */
+	NX_DrvMemcpy((void *)&pJpgInfo->huffVal[AC_TABLE_INDEX1],
+		(void *)&DefHuffmanValue[3][0], 162);
+}
+
+#define PUT_BYTE(_p, _b) \
+	{ \
+		*_p++ = (unsigned char)(_b); \
+		tot++; \
+	}
+
+static int EncodeJpegHeader(struct enc_jpeg_info *pJpgInfo)
+{
+	unsigned char *p = pJpgInfo->jpegHeader;
+	int tot = 0;
+	int i;
+	/* int jfifLen = 16, pad; */
+
+	/* SOI Header */
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xD8);
+
+#if 0
+	/* JFIF marker Header : Added by Ray Park for Normal Jpeg File */
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xE0);
+	PUT_BYTE(p, (jfifLen>>8));		/* Legnth */
+	PUT_BYTE(p, (jfifLen&0xFF));
+	PUT_BYTE(p, 'J');			/* Identifier */
+	PUT_BYTE(p, 'F');
+	PUT_BYTE(p, 'I');
+	PUT_BYTE(p, 'F');
+	PUT_BYTE(p, 0x00);
+	PUT_BYTE(p, 0x01);		/* Major Version */
+	PUT_BYTE(p, 0x01);		/* Minor Version */
+	PUT_BYTE(p, 0x00);		/* Density Units */
+	PUT_BYTE(p, 0x00);		/* X density */
+	PUT_BYTE(p, 0x01);
+	PUT_BYTE(p, 0x00);		/* Y density */
+	PUT_BYTE(p, 0x01);
+	PUT_BYTE(p, 0x00);		/* Thumbnail Width */
+	PUT_BYTE(p, 0x00);		/* THumbnail Height */
+#endif
+
+	/* APP9 Header */
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xE9);
+
+	PUT_BYTE(p, 0x00);
+	PUT_BYTE(p, 0x04);
+
+	PUT_BYTE(p, (pJpgInfo->frameIdx >> 8));
+	PUT_BYTE(p, (pJpgInfo->frameIdx & 0xFF));
+
+	/* DRI header */
+	if (pJpgInfo->rstIntval) {
+		PUT_BYTE(p, 0xFF);
+		PUT_BYTE(p, 0xDD);
+
+		PUT_BYTE(p, 0x00);
+		PUT_BYTE(p, 0x04);
+
+		PUT_BYTE(p, (pJpgInfo->rstIntval >> 8));
+		PUT_BYTE(p, (pJpgInfo->rstIntval & 0xff));
+	}
+
+	/* DQT Header */
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xDB);
+
+	PUT_BYTE(p, 0x00);
+	PUT_BYTE(p, 0x43);
+
+	PUT_BYTE(p, 0x00);
+
+	for (i = 0; i < 64; i++)
+		PUT_BYTE(p, pJpgInfo->qMatTab[0][i]);
+
+	if (pJpgInfo->format != IMG_FORMAT_400) {
+		PUT_BYTE(p, 0xFF);
+		PUT_BYTE(p, 0xDB);
+
+		PUT_BYTE(p, 0x00);
+		PUT_BYTE(p, 0x43);
+
+		PUT_BYTE(p, 0x01);
+
+		for (i = 0; i < 64; i++)
+			PUT_BYTE(p, pJpgInfo->qMatTab[1][i]);
+	}
+
+	/* DHT Header */
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xC4);
+
+	PUT_BYTE(p, 0x00);
+	PUT_BYTE(p, 0x1F);
+
+	PUT_BYTE(p, 0x00);
+
+	for (i = 0; i < 16; i++)
+		PUT_BYTE(p, pJpgInfo->huffBits[0][i]);
+
+	for (i = 0; i < 12; i++)
+		PUT_BYTE(p, pJpgInfo->huffVal[0][i]);
+
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xC4);
+
+	PUT_BYTE(p, 0x00);
+	PUT_BYTE(p, 0xB5);
+
+	PUT_BYTE(p, 0x10);
+
+	for (i = 0; i < 16; i++)
+		PUT_BYTE(p, pJpgInfo->huffBits[1][i]);
+
+	for (i = 0; i < 162; i++)
+		PUT_BYTE(p, pJpgInfo->huffVal[1][i]);
+
+	if (pJpgInfo->format != IMG_FORMAT_400) {
+		PUT_BYTE(p, 0xFF);
+		PUT_BYTE(p, 0xC4);
+
+		PUT_BYTE(p, 0x00);
+		PUT_BYTE(p, 0x1F);
+
+		PUT_BYTE(p, 0x01);
+
+		for (i = 0; i < 16; i++)
+			PUT_BYTE(p, pJpgInfo->huffBits[2][i]);
+
+		for (i = 0; i < 12; i++)
+			PUT_BYTE(p, pJpgInfo->huffVal[2][i]);
+
+		PUT_BYTE(p, 0xFF);
+		PUT_BYTE(p, 0xC4);
+
+		PUT_BYTE(p, 0x00);
+		PUT_BYTE(p, 0xB5);
+
+		PUT_BYTE(p, 0x11);
+
+		for (i = 0; i < 16; i++)
+			PUT_BYTE(p, pJpgInfo->huffBits[3][i]);
+
+		for (i = 0; i < 162; i++)
+			PUT_BYTE(p, pJpgInfo->huffVal[3][i]);
+	}
+
+	/* SOF header */
+	PUT_BYTE(p, 0xFF);
+	PUT_BYTE(p, 0xC0);
+
+	PUT_BYTE(p, (((8+(pJpgInfo->compNum*3)) >> 8) & 0xFF));
+	PUT_BYTE(p, ((8+(pJpgInfo->compNum*3)) & 0xFF));
+
+	PUT_BYTE(p, 0x08);
+
+	if (pJpgInfo->rotationEnable && (pJpgInfo->rotationAngle == 90 ||
+		pJpgInfo->rotationAngle == 270)) {
+		PUT_BYTE(p, (pJpgInfo->picWidth >> 8));
+		PUT_BYTE(p, (pJpgInfo->picWidth & 0xFF));
+		PUT_BYTE(p, (pJpgInfo->picHeight >> 8));
+		PUT_BYTE(p, (pJpgInfo->picHeight & 0xFF));
+	} else {
+		PUT_BYTE(p, (pJpgInfo->picHeight >> 8));
+		PUT_BYTE(p, (pJpgInfo->picHeight & 0xFF));
+		PUT_BYTE(p, (pJpgInfo->picWidth >> 8));
+		PUT_BYTE(p, (pJpgInfo->picWidth & 0xFF));
+	}
+
+	PUT_BYTE(p, pJpgInfo->compNum);
+
+	for (i = 0; i < pJpgInfo->compNum; i++) {
+		PUT_BYTE(p, (i+1));
+		PUT_BYTE(p, ((pJpgInfo->cInfoTab[i][1]<<4) & 0xF0) +
+			(pJpgInfo->cInfoTab[i][2] & 0x0F));
+		PUT_BYTE(p, pJpgInfo->cInfoTab[i][3]);
+	}
+
+	/* tot = p - para->pParaSet; */
+
+	if (tot % 8) {
+		int pad = tot % 8;
+
+		pad = 8 - pad;
+		for (i = 0; i < pad; i++)
+			PUT_BYTE(p, 0x00);
+	}
+
+	pJpgInfo->frameIdx++;
+	pJpgInfo->headerSize = tot;
+
+	return VPU_RET_OK;
+}
+
+static int GenerateJpegEncHuffmanTable(struct enc_jpeg_info *pJpgInfo,
+	int tabNum)
+{
+	static int huffsize[256];
+	static int huffcode[256];
+	int p, i, l, lastp, si, maxsymbol, code;
+	unsigned char *bitleng, *huffval;
+	unsigned int *ehufco, *ehufsi;
+
+	bitleng	= pJpgInfo->huffBits[tabNum];
+	huffval	= pJpgInfo->huffVal[tabNum];
+	ehufco	= pJpgInfo->huffCode[tabNum];
+	ehufsi	= pJpgInfo->huffSize[tabNum];
+
+	maxsymbol = tabNum & 1 ? 256 : 16;
+
+	/* Figure C.1: make table of Huffman code length for each symbol */
+	p = 0;
+	for (l = 1; l <= 16; l++) {
+		i = bitleng[l-1];
+		if (i < 0 || p + i > maxsymbol)
+			return -1;
+		while (i--)
+			huffsize[p++] = l;
+	}
+	lastp = p;
+
+	/* Figure C.2: generate the codes themselves */
+	/* We also validate that the counts represent a legal Huffman
+	 * code tree. */
+	code = 0;
+	si = huffsize[0];
+	p = 0;
+	while (p < lastp) {
+		while (huffsize[p] == si) {
+			huffcode[p++] = code;
+			code++;
+		}
+		if (code >= (1 << si))
+			return -1;
+		code <<= 1;
+		si++;
+	}
+
+	/* Figure C.3: generate encoding tables */
+	/* These are code and size indexed by symbol value */
+	for (i = 0; i < 256; i++)
+		ehufsi[i] = 0x00;
+
+	for (i = 0; i < 256; i++)
+		ehufco[i] = 0x00;
+
+	for (p = 0; p < lastp; p++) {
+		i = huffval[p];
+		if (i < 0 || i >= maxsymbol || ehufsi[i])
+			return -1;
+		ehufco[i] = huffcode[p];
+		ehufsi[i] = huffsize[p];
+	}
+
+	return 0;
+}
+
+static int LoadJpegEncHuffmanTable(struct enc_jpeg_info *pJpgInfo)
+{
+	int i, j, t;
+	int huffData;
+
+	for (i = 0; i < 4; i++)
+		GenerateJpegEncHuffmanTable(pJpgInfo, i);
+
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 0x3);
+
+	for (j = 0; j < 4; j++) {
+		t = (j == 0) ? AC_TABLE_INDEX0 : (j == 1) ? AC_TABLE_INDEX1 :
+			(j == 2) ? DC_TABLE_INDEX0 : DC_TABLE_INDEX1;
+
+		for (i = 0; i < 256; i++) {
+			/* DC */
+			if ((t == DC_TABLE_INDEX0 || t == DC_TABLE_INDEX1) &&
+				(i > 15))
+				break;
+
+			if ((pJpgInfo->huffSize[t][i] == 0) &&
+				(pJpgInfo->huffCode[t][i] == 0)) {
+				huffData = 0;
+			} else {
+				/* Code length (1 ~ 16), 4-bit */
+				huffData = (pJpgInfo->huffSize[t][i] - 1);
+				/* Code word, 16-bit */
+				huffData = (huffData << 16) |
+					(pJpgInfo->huffCode[t][i]);
+			}
+
+			VpuWriteReg(MJPEG_HUFF_DATA_REG, huffData);
+		}
+	}
+
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 0x0);
+
+	return 0;
+}
+
+static int LoadJpegEncQuantizaitonTable(struct enc_jpeg_info *pJpgInfo)
+{
+	long quotient, dividend = 0x80000;
+	int quantID, divisor, comp, i, t;
+
+	for (comp = 0; comp < 3; comp++) {
+		quantID = pJpgInfo->cInfoTab[comp][3];
+		if (quantID >= 4)
+			return -1;
+		t = (comp == 0) ? Q_COMPONENT0 :
+			(comp == 1) ? Q_COMPONENT1 : Q_COMPONENT2;
+		VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x3 + t);
+		for (i = 0; i < 64; i++) {
+			divisor = pJpgInfo->qMatTab[quantID][i];
+			quotient = dividend / divisor;
+			VpuWriteReg(MJPEG_QMAT_DATA_REG, (int)quotient);
+		}
+		VpuWriteReg(MJPEG_QMAT_CTRL_REG, t);
+	}
+
+	return 0;
+}
+
+int JPU_EncRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_run_frame_arg *runArg)
+{
+	int val, reason;
+	unsigned int rotMirMode;
+	struct vpu_enc_info *pInfo = &pInst->codecInfo.encInfo;
+	struct enc_jpeg_info *pJpgInfo = &pInfo->enc_codec_para.jpgEncInfo;
+	int yuv_format = pJpgInfo->format;
+	unsigned int mapEnable;
+	int stride = runArg->inImgBuffer.strideY;
+
+	NX_DbgMsg(INFO_MSG, ("Jpeg Encode Info : Rotate = %d, Mirror = %d\n",
+		pJpgInfo->rotationAngle, pJpgInfo->mirrorDirection));
+
+	if (pJpgInfo->headerSize == 0) {
+		SetupJpegEncPara(pJpgInfo, pInfo->jpegQuality);
+		EncodeJpegHeader(pJpgInfo);
+
+		NX_DrvMemcpy((void *)(unsigned long)pInfo->strmBufVirAddr,
+			(void *)pJpgInfo->jpegHeader, pJpgInfo->headerSize);
+
+		pInfo->strmBufPhyAddr += pJpgInfo->headerSize;
+		pInfo->strmBufSize -= pJpgInfo->headerSize;
+	}
+
+	pJpgInfo->alignedWidth = ((pInfo->srcWidth+15)/16)*16;
+	pJpgInfo->alignedHeight = ((pInfo->srcHeight+15)/16)*16;
+
+	VpuWriteReg(MJPEG_BBC_BAS_ADDR_REG, pInfo->strmBufPhyAddr);
+	VpuWriteReg(MJPEG_BBC_END_ADDR_REG, pInfo->strmBufPhyAddr +
+		pInfo->strmBufSize);
+	VpuWriteReg(MJPEG_BBC_WR_PTR_REG, pInfo->strmBufPhyAddr);
+	VpuWriteReg(MJPEG_BBC_RD_PTR_REG, pInfo->strmBufPhyAddr);
+	VpuWriteReg(MJPEG_BBC_CUR_POS_REG, 0);
+	/* 64 * 4 byte == 32 * 8 byte */
+	VpuWriteReg(MJPEG_BBC_DATA_CNT_REG, 256 / 4);
+	VpuWriteReg(MJPEG_BBC_EXT_ADDR_REG, pInfo->strmBufPhyAddr);
+	VpuWriteReg(MJPEG_BBC_INT_ADDR_REG, 0);
+
+	/* JpgEncGbuResetReg */
+	VpuWriteReg(MJPEG_GBU_BT_PTR_REG, 0);
+	VpuWriteReg(MJPEG_GBU_WD_PTR_REG, 0);
+	VpuWriteReg(MJPEG_GBU_BBSR_REG, 0);
+
+	VpuWriteReg(MJPEG_GBU_BBER_REG, ((256 / 4) * 2) - 1);
+	/* 64 * 4 byte == 32 * 8 byte */
+	VpuWriteReg(MJPEG_GBU_BBIR_REG, 256 / 4);
+	VpuWriteReg(MJPEG_GBU_BBHR_REG, 256 / 4);
+
+	VpuWriteReg(MJPEG_PIC_CTRL_REG, 0x18);
+
+	VpuWriteReg(MJPEG_PIC_SIZE_REG, pJpgInfo->alignedWidth<<16 |
+		pJpgInfo->alignedHeight);
+
+	rotMirMode = 0;
+
+	if (pJpgInfo->rotationEnable) {
+		switch (pJpgInfo->rotationAngle) {
+		case 90:
+			rotMirMode |= 0x1;
+			break;
+		case 180:
+			rotMirMode |= 0x2;
+			break;
+		case 270:
+			rotMirMode |= 0x3;
+			break;
+		default:
+			rotMirMode |= 0x0;
+		}
+	}
+
+	if (pJpgInfo->mirrorEnable) {
+		switch (pJpgInfo->mirrorDirection) {
+		case MIRDIR_VER:
+			rotMirMode |= 0x4;
+			break;
+		case MIRDIR_HOR:
+			rotMirMode |= 0x8;
+			break;
+		case MIRDIR_HOR_VER:
+			rotMirMode |= 0xC;
+			break;
+		default:
+			rotMirMode |= 0x0;
+		}
+	}
+
+	if (pJpgInfo->rotationEnable || pJpgInfo->rotationEnable)
+		rotMirMode |= 0x10;
+
+	VpuWriteReg(MJPEG_ROT_INFO_REG, rotMirMode);
+
+	if (rotMirMode & 0x01)
+		yuv_format = (pJpgInfo->format == IMG_FORMAT_422) ?
+			IMG_FORMAT_224 : (pJpgInfo->format == IMG_FORMAT_224) ?
+			IMG_FORMAT_422 : pJpgInfo->format;
+
+	if (yuv_format == IMG_FORMAT_422) {
+		if (rotMirMode & 1)
+			pJpgInfo->compInfo[0] = 6;
+		else
+			pJpgInfo->compInfo[0] = 9;
+	} else if (yuv_format == IMG_FORMAT_224) {
+		if (rotMirMode & 1)
+			pJpgInfo->compInfo[0] = 9;
+		else
+			pJpgInfo->compInfo[0] = 6;
+	}
+
+	VpuWriteReg(MJPEG_MCU_INFO_REG, pJpgInfo->mcuBlockNum << 16 |
+		pJpgInfo->compNum << 12 | pJpgInfo->compInfo[0] << 8 |
+		pJpgInfo->compInfo[1] << 4 | pJpgInfo->compInfo[2]);
+
+	VpuWriteReg(MJPEG_SCL_INFO_REG, 0);
+	VpuWriteReg(MJPEG_DPB_CONFIG_REG, VPU_FRAME_BUFFER_ENDIAN << 1 |
+		CBCR_INTERLEAVE);
+	VpuWriteReg(MJPEG_RST_INTVAL_REG, pJpgInfo->rstIntval);
+	VpuWriteReg(MJPEG_BBC_CTRL_REG, ((VPU_STREAM_ENDIAN & 3) << 1) | 1);
+
+	VpuWriteReg(MJPEG_OP_INFO_REG, pJpgInfo->busReqNum);
+
+	if (LoadJpegEncHuffmanTable(pJpgInfo) < 0)
+		return VPU_RET_ERR_PARAM;
+
+	if (LoadJpegEncQuantizaitonTable(pJpgInfo) < 0)
+		return VPU_RET_ERR_PARAM;
+
+	/* gdi status */
+	val = 0;
+	VpuWriteReg(GDI_CONTROL, 1);
+	while (!val)
+		val = VpuReadReg(GDI_STATUS);
+
+	mapEnable = 0;
+
+	VpuWriteReg(GDI_INFO_CONTROL, (mapEnable << 20) |
+		((pJpgInfo->format & 0x07) << 17) | (CBCR_INTERLEAVE << 16) |
+		stride);
+	VpuWriteReg(GDI_INFO_PIC_SIZE, (pJpgInfo->alignedWidth << 16) |
+		pJpgInfo->alignedHeight);
+
+	VpuWriteReg(GDI_INFO_BASE_Y,  runArg->inImgBuffer.phyAddr[0]);
+	VpuWriteReg(GDI_INFO_BASE_CB, runArg->inImgBuffer.phyAddr[1]);
+	VpuWriteReg(GDI_INFO_BASE_CR, runArg->inImgBuffer.phyAddr[2]);
+
+	VpuWriteReg(MJPEG_DPB_BASE00_REG, 0);
+
+	VpuWriteReg(GDI_CONTROL, 0);
+	VpuWriteReg(GDI_PIC_INIT_HOST, 1);
+
+	VpuWriteReg(MJPEG_PIC_START_REG, 1);
+
+	/* Wait Jpeg Interrupt */
+	reason = JPU_WaitInterrupt(pInst->devHandle, JPU_ENC_TIMEOUT);
+
+	if (reason == 0)
+		return VPU_RET_ERR_TIMEOUT;
+
+	if (reason != 1) {
+		NX_ErrMsg(("JPG Encode Error(reason = 0x%08x)\n", reason));
+		return VPU_RET_ERROR;
+	}
+
+	/* Post Porcessing */
+	val = VpuReadReg(MJPEG_PIC_STATUS_REG);
+	if ((val & 0x4) >> 2) {
+		NX_ErrMsg(("JPG Encode Error(reason = 0x%08x)\n", reason));
+		NX_ErrMsg((" : VPU_RET_ERR_WRONG_SEQ\n"));
+		return VPU_RET_ERR_WRONG_SEQ;
+	}
+
+	if (val != 0)
+		VpuWriteReg(MJPEG_PIC_STATUS_REG, val);
+
+	runArg->outStreamAddr = (uint64_t)pInfo->strmBufVirAddr;
+	runArg->outStreamSize = VpuReadReg(MJPEG_BBC_WR_PTR_REG) -
+		pInfo->strmBufPhyAddr + pJpgInfo->headerSize;
+
+	VpuWriteReg(MJPEG_BBC_FLUSH_CMD_REG, 0);
+
+	return VPU_RET_OK;
+}
+
+
+/*-----------------------------------------------------------------------------
+ *      For Jpeg Decoder
+ *----------------------------------------------------------------------------*/
+struct vld_stream {
+	uint32_t	dwUsedBits;
+	uint8_t *pbyStart;
+	uint32_t	dwPktSize;
+};
+
+static uint32_t vld_get_bits(struct vld_stream *pstVldStm, int32_t iBits)
+{
+	uint32_t dwUsedBits = pstVldStm->dwUsedBits;
+	int32_t iBitCnt = 8 - (dwUsedBits & 0x7);
+	uint8_t *pbyRead = (uint8_t *)pstVldStm->pbyStart + (dwUsedBits >> 3);
+	uint32_t dwRead;
+
+	pstVldStm->dwUsedBits += iBits;
+
+	dwRead  = *pbyRead++ << 24;
+	if (iBits > iBitCnt) {
+		dwRead  += *pbyRead++ << 16;
+		if (iBits > iBitCnt + 8) {
+			dwRead  += *pbyRead++ << 8;
+			if (iBits > iBitCnt + 16)
+				dwRead  += *pbyRead++;
+		}
+	}
+
+	return (dwRead << (8 - iBitCnt)) >> (32 - iBits);
+}
+
+static void vld_flush_bits(struct vld_stream *pstVldStm, int32_t iBits)
+{
+	pstVldStm->dwUsedBits += iBits;
+}
+
+static void SetJpegDecHuffmanTable(struct vpu_dec_info *pInfo)
+{
+	int i, j;
+	unsigned int HuffData;
+	int HuffLength;
+	int temp;
+
+	if (pInfo->userHuffTable == 0)
+		return;
+
+	/* MIN Table */
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 3);
+
+	/* DC Luma */
+	for (j = 0 ; j < 16 ; j++) {
+		HuffData = pInfo->huffMin[0][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* DC Chroma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMin[2][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* AC Luma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMin[1][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* AC Chroma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMin[3][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* MAX Tables */
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 0x403);
+	VpuWriteReg(MJPEG_HUFF_ADDR_REG, 0x440);
+
+	/* DC Luma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMax[0][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* DC Chroma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMax[2][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* AC Luma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMax[1][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* AC Chroma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffMax[3][j];
+		temp = (HuffData & 0x8000) >> 15;
+		temp = (temp << 15) | (temp << 14) | (temp << 13) |
+			(temp << 12) | (temp << 11) | (temp << 10) |
+			(temp << 9) | (temp << 8) | (temp << 7) |
+			(temp << 6) | (temp << 5) | (temp << 4) |
+			(temp << 3) | (temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFF) << 16) |
+			HuffData);
+	}
+
+	/* PTR Tables */
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 0x803);
+	VpuWriteReg(MJPEG_HUFF_ADDR_REG, 0x880);
+
+	/* DC Luma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffPtr[0][j];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	/* DC Chroma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffPtr[2][j];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	/* AC Luma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffPtr[1][j];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	/* AC Chroma */
+	for (j = 0; j < 16; j++) {
+		HuffData = pInfo->huffPtr[3][j];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	/* VAL Tables */
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 0xC03);
+
+	/* VAL DC Luma */
+	HuffLength = 0;
+	for (i = 0; i < 12; i++)
+		HuffLength += pInfo->huffBits[0][i];
+
+	/* 8-bit, 12 row, 1 category (DC Luma) */
+	for (i = 0; i < HuffLength; i++) {
+		HuffData = pInfo->huffValue[0][i];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	for (i = 0; i < 12 - HuffLength; i++)
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, 0xFFFFFFFF);
+
+	/* VAL DC Chroma */
+	HuffLength = 0;
+	for (i = 0; i < 12; i++)
+		HuffLength += pInfo->huffBits[2][i];
+
+	/* 8-bit, 12 row, 1 category (DC Chroma) */
+	for (i = 0; i < HuffLength; i++) {
+		HuffData = pInfo->huffValue[2][i];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	for (i = 0; i < 12 - HuffLength; i++)
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, 0xFFFFFFFF);
+
+	/* VAL AC Luma */
+	HuffLength = 0;
+	for (i = 0; i < 162; i++)
+		HuffLength += pInfo->huffBits[1][i];
+
+	/* 8-bit, 162 row, 1 category (AC Luma) */
+	for (i = 0; i < HuffLength; i++) {
+		HuffData = pInfo->huffValue[1][i];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	for (i = 0; i < 162 - HuffLength; i++)
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, 0xFFFFFFFF);
+
+	/* VAL AC Chroma */
+	HuffLength = 0;
+	for (i = 0; i < 162; i++)
+		HuffLength += pInfo->huffBits[3][i];
+
+	/* 8-bit, 162 row, 1 category (AC Chroma) */
+	for (i = 0; i < HuffLength; i++) {
+		HuffData = pInfo->huffValue[3][i];
+		temp = (HuffData & 0x80) >> 7;
+		temp = (temp << 23) | (temp << 22) | (temp << 21) |
+			(temp << 20) | (temp << 19) | (temp << 18) |
+			(temp << 17) | (temp << 16) | (temp << 15) |
+			(temp << 14) | (temp << 13) | (temp << 12) |
+			(temp << 11) | (temp << 10) | (temp << 9) |
+			(temp << 8) | (temp << 7) | (temp << 6) |
+			(temp << 5) | (temp << 4) | (temp << 3) |
+			(temp << 2) | (temp << 1) | (temp);
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, ((temp & 0xFFFFFF) << 8) |
+			HuffData);
+	}
+
+	for (i = 0; i < 162 - HuffLength; i++)
+		VpuWriteReg(MJPEG_HUFF_DATA_REG, 0xFFFFFFFF);
+
+	/* end SerPeriHuffTab */
+	VpuWriteReg(MJPEG_HUFF_CTRL_REG, 0x000);
+}
+
+static void SetJpegDecQuantizationTable(struct vpu_dec_info *pInfo)
+{
+	int i;
+	int table;
+	int val;
+
+	/* SetPeriQMatTab */
+	/* Comp 0 */
+	VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x03);
+	table = pInfo->infoTable[0][3];
+	for (i = 0; i < 64; i++) {
+		val = pInfo->quantTable[table][i];
+		VpuWriteReg(MJPEG_QMAT_DATA_REG, val);
+	}
+	VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x00);
+
+	/* Comp 1 */
+	VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x43);
+	table = pInfo->infoTable[1][3];
+	for (i = 0; i < 64; i++) {
+		val = pInfo->quantTable[table][i];
+		VpuWriteReg(MJPEG_QMAT_DATA_REG, val);
+	}
+	VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x00);
+
+	/* Comp 2 */
+	VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x83);
+	table = pInfo->infoTable[2][3];
+	for (i = 0; i < 64; i++) {
+		val = pInfo->quantTable[table][i];
+		VpuWriteReg(MJPEG_QMAT_DATA_REG, val);
+	}
+	VpuWriteReg(MJPEG_QMAT_CTRL_REG, 0x00);
+}
+
+static void SetupJpegDecGram(struct vpu_dec_info *pInfo)
+{
+	int dExtBitBufCurPos;
+	int dExtBitBufBaseAddr;
+	int dMibStatus = 1;
+
+	dExtBitBufCurPos = pInfo->pagePtr;
+	dExtBitBufBaseAddr = pInfo->strmBufPhyAddr;
+
+	VpuWriteReg(MJPEG_BBC_CUR_POS_REG, dExtBitBufCurPos);
+	VpuWriteReg(MJPEG_BBC_EXT_ADDR_REG, dExtBitBufBaseAddr +
+		(dExtBitBufCurPos << 8));
+	VpuWriteReg(MJPEG_BBC_INT_ADDR_REG, (dExtBitBufCurPos & 1) << 6);
+	/* 64 * 4 byte == 32 * 8 byte */
+	VpuWriteReg(MJPEG_BBC_DATA_CNT_REG, 256 / 4);
+	VpuWriteReg(MJPEG_BBC_COMMAND_REG, (VPU_STREAM_ENDIAN << 1) | 0);
+
+	while (dMibStatus == 1)
+		dMibStatus = VpuReadReg(MJPEG_BBC_BUSY_REG);
+
+	dMibStatus = 1;
+	dExtBitBufCurPos = dExtBitBufCurPos + 1;
+
+	VpuWriteReg(MJPEG_BBC_CUR_POS_REG, dExtBitBufCurPos);
+	VpuWriteReg(MJPEG_BBC_EXT_ADDR_REG, dExtBitBufBaseAddr +
+		(dExtBitBufCurPos << 8));
+	VpuWriteReg(MJPEG_BBC_INT_ADDR_REG, (dExtBitBufCurPos & 1) << 6);
+	/* 64 * 4 byte == 32 * 8 byte */
+	VpuWriteReg(MJPEG_BBC_DATA_CNT_REG, 256 / 4);
+	VpuWriteReg(MJPEG_BBC_COMMAND_REG, (VPU_STREAM_ENDIAN << 1) | 0);
+
+	while (dMibStatus == 1)
+		dMibStatus = VpuReadReg(MJPEG_BBC_BUSY_REG);
+
+	dMibStatus = 1;
+	dExtBitBufCurPos = dExtBitBufCurPos + 1;
+
+	/* next uint page pointe */
+	VpuWriteReg(MJPEG_BBC_CUR_POS_REG, dExtBitBufCurPos);
+
+	VpuWriteReg(MJPEG_BBC_CTRL_REG, ((VPU_STREAM_ENDIAN & 3) << 1) | 1);
+
+	VpuWriteReg(MJPEG_GBU_WD_PTR_REG, pInfo->wordPtr);
+	VpuWriteReg(MJPEG_GBU_BBSR_REG, 0);
+	VpuWriteReg(MJPEG_GBU_BBER_REG, ((256 / 4) * 2) - 1);
+
+	if (pInfo->pagePtr & 1) {
+		VpuWriteReg(MJPEG_GBU_BBIR_REG, 0);
+		VpuWriteReg(MJPEG_GBU_BBHR_REG, 0);
+	} else {
+		/* 64 * 4 byte == 32 * 8 byte */
+		VpuWriteReg(MJPEG_GBU_BBIR_REG, 256 / 4);
+		VpuWriteReg(MJPEG_GBU_BBHR_REG, 256 / 4);
+	}
+
+	VpuWriteReg(MJPEG_GBU_CTRL_REG, 4);
+	VpuWriteReg(MJPEG_GBU_FF_RPTR_REG, pInfo->bitPtr);
+}
+
+static int32_t DecodeJpegSOF(struct vpu_dec_info *pInfo,
+	struct vld_stream *pstStrm)
+{
+	int32_t iWidth, iHeight;
+	int32_t iCompNum;
+	int32_t iSampleFactor;
+	int32_t i;
+
+	/* frame header length */
+	vld_flush_bits(pstStrm, 16);
+	/* sample precision */
+	if (vld_get_bits(pstStrm, 8) != 8)
+		return -1;
+
+	iHeight = vld_get_bits(pstStrm, 16);
+	iWidth  = vld_get_bits(pstStrm, 16);
+
+	/* number of image components in frame */
+	iCompNum = vld_get_bits(pstStrm, 8);
+	if (iCompNum > 3)
+		return -1;
+
+	for (i = 0 ; i < iCompNum ; i++) {
+		/* CompId */
+		pInfo->infoTable[i][0] = vld_get_bits(pstStrm, 8);
+		/* HSampligFactor */
+		pInfo->infoTable[i][1] = vld_get_bits(pstStrm, 4);
+		/* VSampligFactor */
+		pInfo->infoTable[i][2] = vld_get_bits(pstStrm, 4);
+		/* QTableDestSelector */
+		pInfo->infoTable[i][3] = vld_get_bits(pstStrm, 8);
+	}
+
+	if (iCompNum == 1) {
+		pInfo->imgFormat = IMG_FORMAT_400;
+		pInfo->width = (iWidth + 7) & (~7);
+		pInfo->height = (iHeight + 7) & (~7);
+		pInfo->busReqNum = 4;
+		pInfo->mcuBlockNum = 1;
+		pInfo->compNum = 1;
+		pInfo->compInfo[0] = 5;
+		pInfo->compInfo[1] = 0;
+		pInfo->compInfo[2] = 0;
+		pInfo->mcuWidth = 8;
+		pInfo->mcuHeight = 8;
+	} else if (iCompNum == 3) {
+		iSampleFactor = ((pInfo->infoTable[0][1]&3) << 4) |
+			(pInfo->infoTable[0][2]&3);
+		switch (iSampleFactor) {
+		case 0x11:
+			pInfo->imgFormat = IMG_FORMAT_444;
+			pInfo->width = (iWidth + 7) & (~7);
+			pInfo->height = (iHeight + 7) & (~7);
+			pInfo->busReqNum = 4;
+			pInfo->mcuBlockNum = 3;
+			pInfo->compNum = 3;
+			pInfo->compInfo[0] = 5;
+			pInfo->compInfo[1] = 5;
+			pInfo->compInfo[2] = 5;
+			pInfo->mcuWidth = 8;
+			pInfo->mcuHeight = 8;
+			break;
+		case 0x12:
+			pInfo->imgFormat = IMG_FORMAT_224;
+			pInfo->width = (iWidth + 7) & (~7);
+			pInfo->height = (iHeight + 15) & (~15);
+			pInfo->busReqNum = 3;
+			pInfo->mcuBlockNum = 4;
+			pInfo->compNum = 3;
+			pInfo->compInfo[0] = 6;
+			pInfo->compInfo[1] = 5;
+			pInfo->compInfo[2] = 5;
+			pInfo->mcuWidth = 8;
+			pInfo->mcuHeight = 16;
+			break;
+		case 0x21:
+			pInfo->imgFormat = IMG_FORMAT_422;
+			pInfo->width = (iWidth + 15) & (~15);
+			pInfo->height = (iHeight + 7) & (~7);
+			pInfo->busReqNum = 3;
+			pInfo->mcuBlockNum = 4;
+			pInfo->compNum = 3;
+			pInfo->compInfo[0] = 9;
+			pInfo->compInfo[1] = 5;
+			pInfo->compInfo[2] = 5;
+			pInfo->mcuWidth = 16;
+			pInfo->mcuHeight = 8;
+			break;
+		case 0x22:
+			pInfo->imgFormat = IMG_FORMAT_420;
+			pInfo->width = (iWidth + 15) & (~15);
+			pInfo->height = (iHeight + 15) & (~15);
+			pInfo->busReqNum = 2;
+			pInfo->mcuBlockNum = 6;
+			pInfo->compNum = 3;
+			pInfo->compInfo[0] = 10;
+			pInfo->compInfo[1] = 5;
+			pInfo->compInfo[2] = 5;
+			pInfo->mcuWidth = 16;
+			pInfo->mcuHeight = 16;
+			break;
+		default:
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+static void DecodeJpegDHT(struct vpu_dec_info *pInfo,
+	struct vld_stream *pstStrm)
+{
+	int32_t i;
+	int32_t iLength;
+	int32_t iTC, iTH, iTcTh;
+	int32_t iBitCnt;
+
+	iLength = vld_get_bits(pstStrm, 16) - 2;
+	do {
+		/* table class */
+		iTC = vld_get_bits(pstStrm, 4);
+		/* table destination identifier */
+		iTH = vld_get_bits(pstStrm, 4);
+		iTcTh = ((iTH & 1) << 1) | (iTC & 1);
+
+		/* Get Huff Bits list */
+		iBitCnt = 0;
+		for (i = 0 ; i < 16 ; i++) {
+			pInfo->huffBits[iTcTh][i] = vld_get_bits(pstStrm, 8);
+			iBitCnt += pInfo->huffBits[iTcTh][i];
+			if (DefHuffmanBits[iTcTh][i] !=
+				pInfo->huffBits[iTcTh][i])
+				pInfo->userHuffTable = 1;
+		}
+
+		/* Get Huff Val list */
+		for (i = 0 ; i < iBitCnt ; i++) {
+			pInfo->huffValue[iTcTh][i] = vld_get_bits(pstStrm, 8);
+			if (DefHuffmanValue[iTcTh][i] !=
+				pInfo->huffValue[iTcTh][i])
+				pInfo->userHuffTable = 1;
+		}
+	} while (iLength > (pstStrm->dwUsedBits >> 3));
+}
+
+static int32_t DecodeJpegDQT(struct vpu_dec_info *pInfo,
+	struct vld_stream *pstStrm)
+{
+	int32_t i;
+	int32_t iLength;
+	int32_t iTQ;
+	uint8_t *pbyQTable;
+
+	iLength = vld_get_bits(pstStrm, 16) - 2;
+
+	do {
+		/* Pq */
+		if (vld_get_bits(pstStrm, 4) >= 1)
+			return -1;
+
+		iTQ = vld_get_bits(pstStrm, 4);
+		if (iTQ > 3)
+			return -1;
+
+		pbyQTable = pInfo->quantTable[iTQ];
+
+		for (i = 0 ; i < 64 ; i++) {
+			pbyQTable[i] = vld_get_bits(pstStrm, 8);
+			if (pbyQTable[i] == 0)
+				return -1;
+		}
+	} while (iLength > (pstStrm->dwUsedBits >> 3));
+
+	return 0;
+}
+
+static void DecodeJpegSOS(struct vpu_dec_info *pInfo,
+	struct vld_stream *pstStrm)
+{
+	int32_t i, j;
+	int32_t iCompNum, iCompId;
+	int32_t iDcHuffTabIdx[3];
+	int32_t iAcHuffTabIdx[3];
+
+	vld_flush_bits(pstStrm, 16);
+	iCompNum = vld_get_bits(pstStrm, 8);
+	for (i = 0 ; i < iCompNum ; i++) {
+		iCompId = vld_get_bits(pstStrm, 8);
+		iDcHuffTabIdx[i] = vld_get_bits(pstStrm, 4);
+		iAcHuffTabIdx[i] = vld_get_bits(pstStrm, 4);
+
+		for (j = 0 ; j < iCompNum ; j++) {
+			if (iCompId == pInfo->infoTable[j][0]) {
+				pInfo->infoTable[i][4] = iDcHuffTabIdx[i];
+				pInfo->infoTable[i][5] = iAcHuffTabIdx[i];
+			}
+		}
+	}
+}
+
+static void GenerateJpegDecHuffmanTable(struct vpu_dec_info *pInfo,
+	int32_t iTabNum)
+{
+	int32_t iPtrCnt = 0;
+	int32_t iHuffCode = 0;
+	int32_t iZeroFlag = 0;
+	int32_t iDataFlag = 0;
+	int32_t i;
+	uint8_t *pbyHuffBits = pInfo->huffBits[iTabNum];
+	uint8_t *pbyHuffPtr = pInfo->huffPtr[iTabNum];
+	uint32_t *uHuffMax = pInfo->huffMax[iTabNum];
+	uint32_t *uHuffMin = pInfo->huffMin[iTabNum];
+
+	for (i = 0; i < 16; i++) {
+		/* if there is bit cnt value */
+		if (pbyHuffBits[i]) {
+			pbyHuffPtr[i] = iPtrCnt;
+			iPtrCnt += pbyHuffBits[i];
+			uHuffMin[i] = iHuffCode;
+			uHuffMax[i] = iHuffCode + (pbyHuffBits[i] - 1);
+			iDataFlag = 1;
+			iZeroFlag = 0;
+		} else {
+			pbyHuffPtr[i] = 0xFF;
+			uHuffMin[i] = 0xFFFF;
+			uHuffMax[i] = 0xFFFF;
+			iZeroFlag = 1;
+		}
+
+		if (iDataFlag == 1)
+			iHuffCode = (iZeroFlag == 1) ? (iHuffCode << 1) :
+				((uHuffMax[i] + 1) << 1);
+	}
+}
+
+int JPU_DecSetSeqInfo(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *seqArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+
+	pInfo->thumbnailMode = seqArg->thumbnailMode;
+
+	if (JPU_DecParseHeader(pInfo,
+		(uint8_t *)(unsigned long)seqArg->seqData,
+		seqArg->seqDataSize) < 0)
+		return -1;
+
+	seqArg->imgFormat = pInfo->imgFormat;
+	seqArg->outWidth = pInfo->width;
+	seqArg->outHeight = pInfo->height;
+	seqArg->cropRight = seqArg->outWidth;
+	seqArg->cropBottom = seqArg->outHeight;
+	seqArg->minFrameBufCnt = 1;
+
+	return 0;
+}
+
+int JPU_DecRegFrameBuf(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_reg_frame_arg *pArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	int32_t i;
+
+	pInfo->cbcrInterleave = pArg->chromaInterleave;
+	pInfo->numFrameBuffer = pArg->numFrameBuffer;
+	pInfo->strideY = pArg->strideY;
+	pInfo->phyAddrs = *pArg->phyAddrs;
+	for (i = 0 ; i < pInfo->numFrameBuffer ; i++)
+		pInfo->frmBufferValid[i] = 0;
+
+	return 0;
+}
+
+int JPU_DecParseHeader(struct vpu_dec_info *pInfo, uint8_t *pbyStream,
+	int32_t iSize)
+{
+	uint32_t uPreFourByte = 0;
+	uint8_t *pbyStrm = pbyStream;
+	int32_t i, iStartCode;
+
+	if ((pbyStrm == NULL) || (iSize <= 0))
+		return -1;
+
+	/* SOI(Start Of Image) check */
+	if ((pbyStrm[0] != 0xFF) || (pbyStrm[1] != 0xD8))
+		return -1;
+
+	pbyStrm += 2;
+	do {
+		if (pbyStrm >= (pbyStream + iSize))
+			return -1;
+
+		uPreFourByte = (uPreFourByte << 8) + *pbyStrm++;
+		iStartCode = uPreFourByte & 0xFFFF;
+
+		if (iStartCode == 0xFFC0) {
+			/* SOF(Start of Frame)- Baseline DCT */
+			struct vld_stream stStrm = { 0, pbyStrm, iSize };
+
+			if (DecodeJpegSOF(pInfo, &stStrm) < 0)
+				return -1;
+			pbyStrm += (stStrm.dwUsedBits >> 3);
+		} else if (iStartCode == 0xFFC4) {
+			/* DHT(Define Huffman Table) */
+			struct vld_stream stStrm = { 0, pbyStrm, iSize };
+
+			DecodeJpegDHT(pInfo, &stStrm);
+			pbyStrm += (stStrm.dwUsedBits >> 3);
+		} else if (iStartCode == 0xFFDA) {
+			/* SOS(Start Of Scan) */
+			struct vld_stream stStrm = { 0, pbyStrm, iSize };
+
+			DecodeJpegSOS(pInfo, &stStrm);
+			pbyStrm += (stStrm.dwUsedBits >> 3);
+			break;
+		} else if (iStartCode == 0xFFDB) {
+			/* DQT(Define Quantization Table) */
+			struct vld_stream stStrm = { 0, pbyStrm, iSize };
+
+			if (DecodeJpegDQT(pInfo, &stStrm) < 0)
+				return -1;
+			pbyStrm += (stStrm.dwUsedBits >> 3);
+		} else if (iStartCode == 0xFFDD) {
+			/* DRI(Define Restart Interval) */
+			pInfo->rstInterval = (pbyStrm[2] << 8) | (pbyStrm[3]);
+			pbyStrm += 4;
+		} else if (iStartCode == 0xFFD8) {
+			/* SOI */
+			if (pInfo->thumbnailMode == 0) {
+				do {
+					if (pbyStrm >= (pbyStream + iSize))
+						return -1;
+					uPreFourByte = (uPreFourByte << 8)
+						+ *pbyStrm++;
+					iStartCode = uPreFourByte & 0xFFFF;
+				} while (iStartCode != 0xFFD9);
+			}
+		} else if (iStartCode == 0xFFD9) {
+			/* EOI(End Of Image) */
+			break;
+		}
+	} while (1);
+
+	pInfo->headerSize = (uint32_t)((long)pbyStrm - (long)pbyStream + 3);
+
+	{
+		int ecsPtr = pInfo->headerSize;
+
+		pInfo->pagePtr = ecsPtr / 256;
+		pInfo->wordPtr = (ecsPtr % 256) / 4;
+		if (pInfo->pagePtr & 1)
+			pInfo->wordPtr += 64;
+		if (pInfo->wordPtr & 1)
+			pInfo->wordPtr -= 1;
+
+		pInfo->bitPtr = (ecsPtr % 4) * 8;
+		if (((ecsPtr % 256) / 4) & 1)
+			pInfo->bitPtr += 32;
+	}
+
+	/* Generate Huffman table information */
+	for (i = 0; i < 4; i++)
+		GenerateJpegDecHuffmanTable(pInfo, i);
+
+	pInfo->qIdx = (pInfo->infoTable[0][3] << 2) |
+		(pInfo->infoTable[1][3] << 1) | (pInfo->infoTable[2][3]);
+	pInfo->huffDcIdx = (pInfo->infoTable[0][4] << 2) |
+		(pInfo->infoTable[1][4] << 1) | (pInfo->infoTable[2][4]);
+	pInfo->huffAcIdx = (pInfo->infoTable[0][5] << 2) |
+		(pInfo->infoTable[1][5] << 1) | (pInfo->infoTable[2][5]);
+
+	return 0;
+}
+
+int JPU_DecRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_frame_arg *pArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	unsigned int val, reason = 0;
+	int32_t i, idx;
+	const uint32_t *phyAddrs;
+
+	for (i = 0 ; i <= pInfo->numFrameBuffer ; i++) {
+		idx = pInfo->decodeIdx + i;
+
+		if (idx >= pInfo->numFrameBuffer)
+			idx -= pInfo->numFrameBuffer;
+
+		if (pInfo->frmBufferValid[idx] == 0) {
+			pInfo->decodeIdx = idx;
+			phyAddrs = pInfo->phyAddrs.addr[idx];
+			pArg->indexFrameDecoded = idx;
+			pArg->indexFrameDisplay = idx;
+			break;
+		}
+	}
+
+	if (i > pInfo->numFrameBuffer) {
+		NX_ErrMsg(("Frame Buffer for Decoding is not sufficient!!!\n"));
+		return -1;
+	}
+
+	VPU_SWReset(SW_RESET_SAFETY);
+
+	VpuWriteReg(MJPEG_BBC_RD_PTR_REG, pInfo->strmBufPhyAddr);
+	VpuWriteReg(MJPEG_BBC_WR_PTR_REG, pInfo->writePos);
+
+	VpuWriteReg(MJPEG_BBC_BAS_ADDR_REG, pInfo->readPos);
+	VpuWriteReg(MJPEG_BBC_END_ADDR_REG, pInfo->writePos);
+
+	VpuWriteReg(MJPEG_BBC_STRM_CTRL_REG, 0);
+
+	VpuWriteReg(MJPEG_GBU_TT_CNT_REG, 0);
+	VpuWriteReg(MJPEG_GBU_TT_CNT_REG+4, 0);
+
+	VpuWriteReg(MJPEG_PIC_SIZE_REG, (pInfo->width << 16) | (pInfo->height));
+	VpuWriteReg(MJPEG_PIC_CTRL_REG, (pInfo->huffAcIdx << 10) |
+		(pInfo->huffDcIdx << 7) | (pInfo->userHuffTable << 6) |
+		(1 << 2) | 0);
+
+	VpuWriteReg(MJPEG_ROT_INFO_REG, 0);
+
+	VpuWriteReg(MJPEG_MCU_INFO_REG, (pInfo->mcuBlockNum << 16) |
+		(pInfo->compNum << 12) | (pInfo->compInfo[0] << 8) |
+		(pInfo->compInfo[1] << 4) | (pInfo->compInfo[2]));
+	VpuWriteReg(MJPEG_OP_INFO_REG, pInfo->busReqNum);
+
+	if (pArg->downScaleWidth || pArg->downScaleHeight)
+		VpuWriteReg(MJPEG_SCL_INFO_REG,  (1 << 4) |
+			(pArg->downScaleWidth << 2) | (pArg->downScaleHeight));
+	else
+		VpuWriteReg(MJPEG_SCL_INFO_REG,  0);
+
+	VpuWriteReg(MJPEG_DPB_CONFIG_REG, VPU_FRAME_BUFFER_ENDIAN << 1 |
+		CBCR_INTERLEAVE);
+	VpuWriteReg(MJPEG_RST_INTVAL_REG, pInfo->rstInterval);
+
+	SetJpegDecHuffmanTable(pInfo);
+	SetJpegDecQuantizationTable(pInfo);
+
+	SetupJpegDecGram(pInfo);
+
+	/* RST index at the beginning */
+	VpuWriteReg(MJPEG_RST_INDEX_REG, 0);
+	VpuWriteReg(MJPEG_RST_COUNT_REG, 0);
+
+	VpuWriteReg(MJPEG_DPCM_DIFF_Y_REG, 0);
+	VpuWriteReg(MJPEG_DPCM_DIFF_CB_REG, 0);
+	VpuWriteReg(MJPEG_DPCM_DIFF_CR_REG, 0);
+
+	VpuWriteReg(MJPEG_GBU_FF_RPTR_REG, pInfo->bitPtr);
+	VpuWriteReg(MJPEG_GBU_CTRL_REG, 3);
+
+	val = 0;	/* gdi status */
+	VpuWriteReg(GDI_CONTROL, 1);
+	while (!val)
+		val = VpuReadReg(GDI_STATUS);
+
+	VpuWriteReg(GDI_INFO_CONTROL, (0 << 20) | (pInfo->imgFormat << 17) |
+		(CBCR_INTERLEAVE << 16) | (pInfo->strideY));
+
+	VpuWriteReg(GDI_INFO_PIC_SIZE, (pInfo->width << 16) | pInfo->height);
+
+	VpuWriteReg(GDI_INFO_BASE_Y, phyAddrs[0]);
+	VpuWriteReg(GDI_INFO_BASE_CB,  phyAddrs[1]);
+	VpuWriteReg(GDI_INFO_BASE_CR,  phyAddrs[2]);
+
+	VpuWriteReg(MJPEG_DPB_BASE00_REG, 0);
+
+	VpuWriteReg(GDI_CONTROL, 0);
+	VpuWriteReg(GDI_PIC_INIT_HOST, 1);
+
+	VpuWriteReg(MJPEG_PIC_START_REG, 1);
+
+	reason = JPU_WaitInterrupt(pInst->devHandle, JPU_DEC_TIMEOUT);
+	if (!reason) {
+		NX_ErrMsg(("JPU_DecRunFrame() Failed. Timeout(%d)\n",
+			JPU_DEC_TIMEOUT));
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	if (reason & (1 << INT_JPU_ERROR)) {
+		NX_ErrMsg(("JPU Decode Error(reason = 0x%08x)\n", reason));
+		return VPU_RET_ERROR;
+	}
+	if (reason & (1 << INT_JPU_BBC_INTERRUPT)) {
+		NX_ErrMsg(("JPU BBC Interrupt Error(reason = 0x%08x)\n",
+			reason));
+		return VPU_RET_ERROR;
+	}
+	if (reason & (1 << INT_JPU_BIT_BUF_FULL)) {
+		NX_ErrMsg(("JPU Overflow Error( reason = 0x%08x)\n", reason));
+		return VPU_RET_ERR_STRM_FULL;
+	}
+	if (!(reason & (1 << INT_JPU_DONE)))
+		return VPU_RET_ERR_RUN;
+
+	pArg->outWidth = pInfo->width >> pArg->downScaleWidth;
+	pArg->outHeight = pInfo->height >> pArg->downScaleHeight;
+	pArg->mcuWidth = pInfo->mcuWidth;
+	pArg->mcuHeight = pInfo->mcuHeight;
+	pArg->outRect.left = 0;
+	pArg->outRect.top = 0;
+	pArg->outRect.right = pArg->outWidth;
+	pArg->outRect.bottom = pArg->outHeight;
+	pArg->numOfErrMBs = VpuReadReg(MJPEG_PIC_ERRMB_REG);
+
+	pInfo->readPos = VpuReadReg(pInfo->streamRdPtrRegAddr);
+	pArg->strmReadPos = pInfo->readPos - pInfo->strmBufPhyAddr;
+	pArg->strmWritePos = pInfo->writePos - pInfo->strmBufPhyAddr;
+
+	pInfo->frmBufferValid[idx] = -1;
+
+	VpuWriteReg(MJPEG_BBC_FLUSH_CMD_REG, 0);
+
+	VPU_SWReset(SW_RESET_SAFETY);
+
+	return VPU_RET_OK;
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_port_func.c b/drivers/media/platform/nxp-vpu/nx_port_func.c
--- a/drivers/media/platform/nxp-vpu/nx_port_func.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_port_func.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/slab.h>
+#include <linux/videodev2.h>
+#include <linux/dma-mapping.h>
+#include <linux/delay.h>
+#include <media/videobuf2-dma-contig.h>
+#include "nx_port_func.h"
+
+
+struct nx_memory_info *nx_alloc_memory(void *drv, int32_t size, int32_t align)
+{
+	struct nx_memory_info *handle;
+
+	handle = devm_kzalloc(drv, sizeof(*handle), GFP_KERNEL);
+	if (NULL == handle)
+		goto Error_Exit;
+
+#ifndef USE_ION_MEMORY
+	handle->virAddr = dma_alloc_coherent(drv, size, &handle->phyAddr,
+		GFP_KERNEL);
+	if (!handle->virAddr) {
+		handle->phyAddr = 0;
+		goto Error_Exit;
+	}
+#else
+	size = (size + 4095) & ~4095;
+	handle->phyAddr = cma_alloc(drv, "nxp-ion", size, align);
+	if (handle->phyAddr == (-EINVAL)) {
+		dev_err(drv, "nx_alloc_memory is error\n");
+		handle->phyAddr = 0;
+		goto Error_Exit;
+	}
+
+	handle->virAddr = (void *)cma_get_virt(handle->phyAddr, size, 1);
+	if (handle->virAddr == 0) {
+		dev_err(drv, "Failed to cma_get_virt(0x%08x)\n",
+			(int)handle->phyAddr);
+		goto Error_Exit;
+	}
+#endif
+
+	NX_DrvMemset(handle->virAddr, 0, size);
+
+	handle->fd = drv;
+	handle->size = size;
+	handle->align = align;
+
+	return handle;
+
+Error_Exit:
+	dev_err(drv, "nx_alloc_memory is failed\n");
+
+	if (handle) {
+		if (handle->phyAddr) {
+#ifndef USE_ION_MEMORY
+			dma_free_coherent(drv, handle->size, handle->virAddr,
+				handle->phyAddr);
+#else
+			cma_free(handle->phyAddr);
+#endif
+		}
+	}
+
+	return NULL;
+}
+
+void nx_free_memory(struct nx_memory_info *mem)
+{
+	if (mem) {
+		if (0 != mem->phyAddr) {
+#ifndef USE_ION_MEMORY
+			dma_free_coherent(mem->fd, mem->size, mem->virAddr,
+				mem->phyAddr);
+#else
+			cma_free(mem->phyAddr);
+#endif
+		}
+	}
+}
+
+struct nx_vid_memory_info *nx_alloc_frame_memory(void *drv, int32_t width,
+	int32_t height, int32_t planes, uint32_t format, int32_t align)
+{
+	int32_t i, chroma_planes;
+	int32_t lWidth, lHeight;
+	int32_t cWidth, cHeight;
+	uint32_t lSize;		/* Luminance plane size */
+	uint32_t cSize;		/* Chrominance plane size */
+	struct nx_vid_memory_info *vid = NULL;
+	struct nx_memory_info *mem[NX_MAX_PLANES];
+
+	vid = devm_kzalloc(drv, sizeof(*vid), GFP_KERNEL);
+	if (NULL == vid)
+		goto Error_Exit;
+
+	for (i = 0 ; i < NX_MAX_PLANES ; i++)
+		mem[i] = NULL;
+
+	lWidth  = ALIGN(width,  32);
+	lHeight = ALIGN(height, 16);
+	lSize = lWidth * lHeight;
+
+	switch (format) {
+	case V4L2_PIX_FMT_YUV420M:
+		cWidth  = ALIGN(width/2,  16);
+		cHeight = ALIGN(height/2, 16);
+		chroma_planes = 2;
+		break;
+	case V4L2_PIX_FMT_NV12M:
+		cWidth  = lWidth;
+		cHeight = lHeight/2;
+		chroma_planes = 1;
+		break;
+	default:
+		NX_ErrMsg(("Unknown fourCC type.\n"));
+		goto Error_Exit;
+	}
+	cSize = cWidth * cHeight;
+
+	mem[0] = nx_alloc_memory(drv, lSize, align);
+	for (i = 1 ; i <= chroma_planes ; i++)
+		mem[i] = nx_alloc_memory(drv, cSize, align);
+
+	vid->width  = width;
+	vid->height = height;
+	vid->align = align;
+	vid->planes = planes;
+	vid->format = format;
+
+	for (i = 0 ; i <= chroma_planes ; i++) {
+		vid->fd[i] = mem[i]->fd;
+		vid->size[i] = mem[i]->size;
+		vid->strideY = lWidth;
+		vid->virAddr[i] = mem[i]->virAddr;
+		vid->phyAddr[i] = mem[i]->phyAddr;
+	}
+
+	return vid;
+
+Error_Exit:
+	if (vid) {
+		for (i = 0 ; i < planes ; i++)
+			nx_free_memory(mem[i]);
+	}
+
+	return NULL;
+}
+
+void nx_free_frame_memory(struct nx_vid_memory_info *vid)
+{
+	if (vid) {
+		int32_t i;
+
+		for (i = 0 ; i < vid->planes ; i++) {
+#ifndef USE_ION_MEMORY
+			dma_free_coherent(vid->fd[i], vid->size[i],
+				vid->virAddr[i], vid->phyAddr[i]);
+#else
+			cma_free(vid->phyAddr[i]);
+#endif
+		}
+
+	}
+}
+
+void NX_DrvMemset(void *ptr, int value, int size)
+{
+	memset(ptr, value, size);
+}
+
+void NX_DrvMemcpy(void *dst, void *src, int size)
+{
+	memcpy(dst, src, size);
+}
+
+void DrvMSleep(unsigned int mSeconds)
+{
+	msleep(mSeconds);
+}
+
+void DrvUSleep(unsigned int uSeconds)
+{
+	udelay(uSeconds);
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_port_func.h b/drivers/media/platform/nxp-vpu/nx_port_func.h
--- a/drivers/media/platform/nxp-vpu/nx_port_func.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_port_func.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_ALLOC_MEM_H__
+#define __NX_ALLOC_MEM_H__
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+
+
+/* #define USE_ION_MEMORY */
+
+#define FUNC_MSG		0
+
+
+#ifndef NX_DTAG
+#define NX_DTAG			"[DRV|VPU]"
+#endif
+
+#define NX_DbgMsg(COND, MSG)	do {					\
+					if (COND) {			\
+						printk(NX_DTAG);	\
+						pr_cont MSG;		\
+					}				\
+				} while (0)
+
+#define NX_ErrMsg(MSG)  do {						\
+				printk("%s%s(%d): ", NX_DTAG, __FILE__,\
+					__LINE__);			\
+				pr_cont MSG;				\
+			} while (0)
+
+#if FUNC_MSG
+	#define FUNC_IN()	printk("%s() %d IN.\n", __func__, __LINE__)
+	#define FUNC_OUT()	printk("%s() %d OUT.\n", __func__, __LINE__)
+#else
+	#define FUNC_IN()	do {} while (0)
+	#define FUNC_OUT()	do {} while (0)
+#endif
+
+#define NX_MAX_PLANES		4
+
+
+/*
+ * struct nx_memory_info - nexell private memory type
+ */
+struct nx_memory_info {
+	void *fd;
+	int32_t size;
+	int32_t align;
+	void *virAddr;
+	dma_addr_t phyAddr;
+};
+
+/*
+ * struct nx_vid_memory_info - nexell private video memory type
+ */
+struct nx_vid_memory_info {
+	int32_t width;
+	int32_t height;
+	int32_t align;
+	int32_t planes;
+	uint32_t format;			/* Pixel Format(N/A) */
+	int32_t strideY;			/* Luma plane stride */
+
+	void *fd[NX_MAX_PLANES];
+	int32_t size[NX_MAX_PLANES];		/* Each plane's size. */
+	void *virAddr[NX_MAX_PLANES];
+	uint32_t phyAddr[NX_MAX_PLANES];
+};
+
+/*
+ * nexell private memory allocator
+ */
+struct nx_memory_info *nx_alloc_memory(void *drv, int32_t size, int32_t align);
+void nx_free_memory(struct nx_memory_info *mem);
+
+/*
+ * video specific allocator wrapper
+ */
+struct nx_vid_memory_info *nx_alloc_frame_memory(void *drv, int32_t width,
+	int32_t height, int32_t planes, uint32_t format, int32_t align);
+void nx_free_frame_memory(struct nx_vid_memory_info *vid);
+
+void NX_DrvMemset(void *ptr, int value, int size);
+void NX_DrvMemcpy(void *dst, void *src, int size);
+
+void DrvMSleep(unsigned int mSeconds);
+void DrvUSleep(unsigned int uSeconds);
+
+#endif		/* __NX_ALLOC_MEM_H__ */
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_api.c b/drivers/media/platform/nxp-vpu/nx_vpu_api.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_api.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_api.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,661 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef UNUSED
+#define UNUSED(p) ((void)(p))
+#endif
+
+#include <linux/delay.h>
+#include <linux/io.h>
+
+#include <dt-bindings/tieoff/s5p6818-tieoff.h>
+
+#include "blackbird_v2.3.10.h"
+#include "vpu_hw_interface.h"		/* Register Access */
+#include "nx_vpu_api.h"
+
+
+#define	DBG_POWER			0
+#define	DBG_CLOCK			0
+#define	INFO_MSG			0
+
+
+/*--------------------------------------------------------------------------- */
+/* Static Global Variables */
+static int gstIsInitialized;
+static int gstIsVPUOn;
+static unsigned int gstVpuRegStore[64];
+
+static uint32_t *gstCodaClockEnRegVir;
+static uint32_t *gstIsolateBase;
+static uint32_t *gstAliveBase;
+
+
+static struct nx_vpu_codec_inst gstVpuInstance[NX_MAX_VPU_INSTANCE];
+
+
+/*--------------------------------------------------------------------------- */
+/*  Define Static Functions */
+static unsigned int VPU_IsBusy(void);
+
+
+/*----------------------------------------------------------------------------
+ *		Nexell Specific VPU Hardware On/Off Logic
+ *--------------------------------------------------------------------------- */
+#define VPU_ALIVEGATE_REG		0xC0010800
+#define VPU_NISOLATE_REG		0xC0010D00
+#define CODA960CLKENB_REG		0xC00C7000
+
+#define	POWER_PMU_VPU_MASK		0x00000002
+
+#if defined(CONFIG_ARCH_S5P6818)
+/*	Async XUI Power Down
+ *
+ *	Step 1. Waiting until CACTIVE to High
+ *	Step 2. Set CSYSREQ to Low
+ *	Step 3. Waiting until CSYSACK to Low
+ */
+static void NX_ASYNCXUI_PowerDown(void)
+{
+	int32_t tmpVal;
+
+	FUNC_IN();
+
+	/* Apply To Async XUI 0 */
+
+	/* Step 1. Waiting until CACTIVE to High */
+	do {
+		tmpVal = nx_tieoff_get(NX_TIEOFF_Inst_CODA960_ASYNCXIU0_CACTIVE_S);
+	} while (!tmpVal);
+
+	/* Step 2. Set CSYSREQ to Low */
+	nx_tieoff_set(NX_TIEOFF_Inst_ASYNCXUI0_CSYSREQ, 0);
+
+	/*Step 3. Waiting until CSYSACK to Low */
+	do {
+		tmpVal = nx_tieoff_get(NX_TIEOFF_Inst_CODA960_ASYNCXIU0_CSYSACK_S);
+	} while (tmpVal);
+
+	/* Apply To Async XUI 1 */
+
+	/* Step 1. Waiting until CACTIVE to High */
+	do {
+		tmpVal = nx_tieoff_get(NX_TIEOFF_Inst_CODA960_ASYNCXIU1_CACTIVE_S);
+	} while (!tmpVal);
+
+	/* Step 2. Set CSYSREQ to Low */
+	nx_tieoff_set(NX_TIEOFF_Inst_ASYNCXUI1_CSYSREQ, 0);
+
+	/* Step 3. Waiting until CSYSACK to Low */
+	do {
+		tmpVal = nx_tieoff_get(NX_TIEOFF_Inst_CODA960_ASYNCXIU1_CSYSACK_S);
+	} while (tmpVal);
+
+
+	FUNC_OUT();
+}
+
+/*	Async XUI Power Up
+ *
+ *	Step 1. Set CSYSREQ to High
+ *	Step 2. Waiting until CSYSACK to High
+ */
+static void NX_ASYNCXUI_PowerUp(void)
+{
+	int32_t tmpVal;
+
+	FUNC_IN();
+
+	/* Apply To Async XUI 0 */
+
+	/* Step 1. Set CSYSREQ to High */
+	nx_tieoff_set(NX_TIEOFF_Inst_ASYNCXUI0_CSYSREQ, 1);
+
+	/* Step 2. Waiting until CSYSACK to High */
+	do {
+		tmpVal = nx_tieoff_get(NX_TIEOFF_Inst_CODA960_ASYNCXIU0_CSYSACK_S);
+	} while (!tmpVal);
+
+	/* Apply To Async XUI 1 */
+
+	/* Step 1. Set CSYSREQ to High */
+	nx_tieoff_set(NX_TIEOFF_Inst_ASYNCXUI1_CSYSREQ, 1);
+
+	/* Step 2. Waiting until CSYSACK to High */
+	do {
+		tmpVal = nx_tieoff_get(NX_TIEOFF_Inst_CODA960_ASYNCXIU1_CSYSACK_S);
+	} while (!tmpVal);
+
+	FUNC_OUT();
+}
+#endif
+
+void NX_VPU_HwOn(void *dev, void *pVpuBaseAddr)
+{
+	uint32_t tmpVal;
+	uint32_t *pNPreCharge, *pNPowerUp, *pNPowerAck;
+
+	NX_DbgMsg(DBG_POWER, ("NX_VPU_HwOn() ++\n"));
+
+	/* Already Power On */
+	if (gstIsVPUOn)
+		return;
+
+	vpu_soc_peri_reset_enter(dev);
+
+	InitVpuRegister(pVpuBaseAddr);
+
+	/* Initialize ISolate Register's */
+	pNPreCharge  = gstIsolateBase + 1;
+	pNPowerUp    = gstIsolateBase + 2;
+	pNPowerAck   = gstIsolateBase + 3;
+
+	NX_DbgMsg(INFO_MSG, ("====================================\n"));
+	NX_DbgMsg(INFO_MSG, ("pVpuBaseAddr = %p\n", pVpuBaseAddr));
+	NX_DbgMsg(INFO_MSG, ("pIsolateBase = %p\n", gstIsolateBase));
+	NX_DbgMsg(INFO_MSG, ("pNPreCharge  = %p\n", pNPreCharge));
+	NX_DbgMsg(INFO_MSG, ("pNPowerUp    = %p\n", pNPowerUp));
+	NX_DbgMsg(INFO_MSG, ("pNPowerAck   = %p\n", pNPowerAck));
+	NX_DbgMsg(INFO_MSG, ("====================================\n"));
+
+	WriteReg32(gstAliveBase,  0x3);
+
+	/* Enable PreCharge */
+	tmpVal = ReadReg32(pNPreCharge);
+	tmpVal &= (~POWER_PMU_VPU_MASK);
+	WriteReg32(pNPreCharge, tmpVal);
+
+	/* Enable Power On */
+	tmpVal = ReadReg32(pNPowerUp);
+	tmpVal &= (~POWER_PMU_VPU_MASK);
+	WriteReg32(pNPowerUp, tmpVal);
+
+	/* Disable ISolate */
+	tmpVal = ReadReg32(gstIsolateBase);
+	tmpVal |= (POWER_PMU_VPU_MASK);
+	WriteReg32(gstIsolateBase, tmpVal);
+
+	mdelay(1);
+
+	NX_VPU_Clock(1);
+
+#if defined(CONFIG_ARCH_S5P6818)
+	NX_ASYNCXUI_PowerUp();
+#endif
+
+	vpu_soc_peri_reset_exit(dev);
+
+	gstIsVPUOn = 1;
+
+
+	NX_DbgMsg(DBG_POWER, ("NX_VPU_HwOn() --\n"));
+}
+
+void NX_VPU_HWOff(void *dev)
+{
+	FUNC_IN();
+
+	if (gstIsVPUOn) {
+		unsigned int tmpVal;
+		uint32_t *pNPreCharge, *pNPowerUp, *pNPowerAck;
+
+#if defined(CONFIG_ARCH_S5P6818)
+		NX_ASYNCXUI_PowerDown();
+#endif
+		/* H/W Reset */
+		vpu_soc_peri_reset_enter(dev);
+
+		NX_DbgMsg(DBG_POWER, ("NX_VPU_HWOff() ++\n"));
+
+		/* Initialize ISolate Register's */
+		pNPreCharge = gstIsolateBase + 1;
+		pNPowerUp = gstIsolateBase + 2;
+		pNPowerAck = gstIsolateBase + 3;
+
+		/* Enter Coda Reset State */
+		WriteReg32(gstAliveBase,  0x3);
+
+		/* Isolate VPU H/W */
+		tmpVal = ReadReg32(gstIsolateBase);
+		tmpVal &= (~POWER_PMU_VPU_MASK);
+		WriteReg32(gstIsolateBase, tmpVal);
+
+		/* Pre Charget Off */
+		tmpVal = ReadReg32(pNPreCharge);
+		tmpVal |= POWER_PMU_VPU_MASK;
+		WriteReg32(pNPreCharge, tmpVal);
+
+		/* Power Down */
+		tmpVal = ReadReg32(pNPowerUp);
+		tmpVal |= POWER_PMU_VPU_MASK;
+		WriteReg32(pNPowerUp, tmpVal);
+
+		/* Isolate VPU H/W */
+		tmpVal = ReadReg32(gstIsolateBase);
+		tmpVal &= (~POWER_PMU_VPU_MASK);
+		WriteReg32(gstIsolateBase, tmpVal);
+
+		gstIsVPUOn = 0;
+
+		NX_DbgMsg(DBG_POWER, ("NX_VPU_HWOff() --\n"));
+	}
+
+	FUNC_OUT();
+}
+
+int NX_VPU_GetCurPowerState(void)
+{
+	return gstIsVPUOn;
+}
+
+void NX_VPU_Clock(int on)
+{
+	FUNC_IN();
+
+	if (on) {
+		WriteReg32(gstCodaClockEnRegVir, 0x0000000F);
+		NX_DbgMsg(DBG_CLOCK, ("NX_VPU_Clock() ON\n"));
+	} else {
+		WriteReg32(gstCodaClockEnRegVir, 0x00000000);
+		NX_DbgMsg(DBG_CLOCK, ("NX_VPU_Clock() OFF\n"));
+	}
+
+	FUNC_OUT();
+}
+
+static unsigned int VPU_IsBusy(void)
+{
+	unsigned int ret = ReadRegNoMsg(BIT_BUSY_FLAG);
+
+	return ret != 0;
+}
+
+static int VPU_WaitBusBusy(int mSeconds, unsigned int busyFlagReg)
+{
+	while (mSeconds > 0) {
+		if (0x77 == VpuReadReg(busyFlagReg))
+			return VPU_RET_OK;
+		DrvMSleep(1);
+		mSeconds--;
+	}
+	return VPU_RET_ERR_TIMEOUT;
+}
+
+int VPU_WaitVpuBusy(int mSeconds, unsigned int busyFlagReg)
+{
+	while (mSeconds > 0) {
+		if (ReadRegNoMsg(busyFlagReg) == 0)
+			return VPU_RET_OK;
+
+		DrvMSleep(1);
+		mSeconds--;
+	}
+	return VPU_RET_ERR_TIMEOUT;
+}
+
+void VPU_GetVersionInfo(unsigned int *versionInfo, unsigned int *revision,
+	unsigned int *productId)
+{
+	unsigned int ver;
+	unsigned int rev;
+	unsigned int pid;
+
+	if (versionInfo && revision) {
+		VpuWriteReg(RET_FW_VER_NUM, 0);
+		VpuWriteReg(BIT_WORK_BUF_ADDR, 0);
+		VpuWriteReg(BIT_BUSY_FLAG, 1);
+		VpuWriteReg(BIT_RUN_INDEX, 0);
+		VpuWriteReg(BIT_RUN_COD_STD, 0);
+		VpuWriteReg(BIT_RUN_AUX_STD, 0);
+		VpuWriteReg(BIT_RUN_COMMAND, FIRMWARE_GET);
+		if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+			BIT_BUSY_FLAG)) {
+			NX_ErrMsg(("Version Read Failed!!!\n"));
+			return;
+		}
+
+		ver = VpuReadReg(RET_FW_VER_NUM);
+		rev = VpuReadReg(RET_FW_CODE_REV);
+
+		*versionInfo = ver;
+		*revision = rev;
+	}
+
+	pid = VpuReadReg(DBG_CONFIG_REPORT_1);
+	if ((pid&0xff00) == 0x3200)
+		pid = 0x3200;
+
+	if (productId)
+		*productId = pid;
+}
+
+void CheckVersion(void)
+{
+	unsigned int version;
+	unsigned int revision;
+	unsigned int productId;
+
+	VPU_GetVersionInfo(&version, &revision, &productId);
+
+	NX_DbgMsg(INFO_MSG, ("Firmware Version => projectId : %x | ",
+		(unsigned int)(version>>16)));
+	NX_DbgMsg(INFO_MSG, ("version : %04d.%04d.%08d | revision : r%d\n",
+		(unsigned int)((version>>(12))&0x0f),
+		(unsigned int)((version>>(8))&0x0f),
+		(unsigned int)((version)&0xff),
+		revision));
+	NX_DbgMsg(INFO_MSG, ("Hardware Version => %04x\n", productId));
+}
+
+
+/*--------------------------------------------------------------------------- */
+
+/* VPU_SWReset
+ * IN
+ *    forcedReset : 1 if there is no need to waiting for BUS transaction,
+ *                     0 for otherwise
+ * OUT
+ *    RetCode : RETCODE_FAILURE if failed to reset,
+ *                RETCODE_SUCCESS for otherwise
+ */
+
+/* SW Reset command */
+#define VPU_SW_RESET_BPU_CORE	0x008
+#define VPU_SW_RESET_BPU_BUS	0x010
+#define VPU_SW_RESET_VCE_CORE	0x020
+#define VPU_SW_RESET_VCE_BUS	0x040
+#define VPU_SW_RESET_GDI_CORE	0x080
+#define VPU_SW_RESET_GDI_BUS	0x100
+
+int VPU_SWReset(int resetMode)
+{
+	unsigned int cmd;
+
+	if (resetMode == SW_RESET_SAFETY || resetMode == SW_RESET_ON_BOOT) {
+		/* Waiting for completion of bus transaction */
+		/* Step1 : No more request */
+		/* no more request {3'b0,no_more_req_sec,3'b0,no_more_req} */
+		VpuWriteReg(GDI_BUS_CTRL, 0x11);
+
+		/* Step2 : Waiting for completion of bus transaction */
+		/* while (VpuReadReg(coreIdx, GDI_BUS_STATUS) != 0x77) */
+		if (VPU_WaitBusBusy(VPU_BUSY_CHECK_TIMEOUT, GDI_BUS_STATUS) ==
+			VPU_RET_ERR_TIMEOUT) {
+			VpuWriteReg(GDI_BUS_CTRL, 0x00);
+			return VPU_RET_ERR_TIMEOUT;
+		}
+
+		/* Step3 : clear GDI_BUS_CTRL */
+		VpuWriteReg(GDI_BUS_CTRL, 0x00);
+	}
+
+	cmd = 0;
+	/* Software Reset Trigger */
+	if (resetMode != SW_RESET_ON_BOOT)
+		cmd =  VPU_SW_RESET_BPU_CORE | VPU_SW_RESET_BPU_BUS;
+	cmd |= VPU_SW_RESET_VCE_CORE | VPU_SW_RESET_VCE_BUS;
+	if (resetMode == SW_RESET_ON_BOOT)
+		/* If you reset GDI, tiled map should be reconfigured */
+		cmd |= VPU_SW_RESET_GDI_CORE | VPU_SW_RESET_GDI_BUS;
+	VpuWriteReg(BIT_SW_RESET, cmd);
+
+	/* wait until reset is done */
+	if (VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT, BIT_SW_RESET_STATUS) ==
+		VPU_RET_ERR_TIMEOUT) {
+		VpuWriteReg(BIT_SW_RESET, 0x00);
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	VpuWriteReg(BIT_SW_RESET, 0);
+
+	return VPU_RET_OK;
+}
+
+/*----------------------------------------------------------------------------
+ *	VPU Initialization.
+ *--------------------------------------------------------------------------- */
+int NX_VpuInit(void *dev, void *baseAddr, void *firmVirAddr,
+	uint32_t firmPhyAddr)
+{
+	enum nx_vpu_ret ret = VPU_RET_OK;
+	int32_t i;
+	uint32_t tmpData;
+	uint32_t codeBufAddr, tmpBufAddr, paramBufAddr;
+
+	if (gstIsInitialized)
+		return VPU_RET_OK;
+
+	codeBufAddr = firmPhyAddr;
+	tmpBufAddr  = codeBufAddr + CODE_BUF_SIZE;
+	paramBufAddr = tmpBufAddr + TEMP_BUF_SIZE;
+
+	NX_VPU_HwOn(dev, baseAddr);
+
+	/* if BIT processor is not running. */
+	if (VpuReadReg(BIT_CUR_PC) == 0) {
+		for (i = 0; i < 64; i++)
+			VpuWriteReg(BIT_BASE + 0x100 + (i*4), 0x0);
+	}
+
+	VPU_SWReset(SW_RESET_ON_BOOT);
+
+	{
+		unsigned char *dst = (unsigned char *)firmVirAddr;
+
+		for (i = 0; i < ARRAY_SIZE(bit_code) ; i += 4) {
+			*dst++ = (unsigned char)(bit_code[i+3] >> 0);
+			*dst++ = (unsigned char)(bit_code[i+3] >> 8);
+
+			*dst++ = (unsigned char)(bit_code[i+2] >> 0);
+			*dst++ = (unsigned char)(bit_code[i+2] >> 8);
+
+			*dst++ = (unsigned char)(bit_code[i+1] >> 0);
+			*dst++ = (unsigned char)(bit_code[i+1] >> 8);
+
+			*dst++ = (unsigned char)(bit_code[i+0] >> 0);
+			*dst++ = (unsigned char)(bit_code[i+0] >> 8);
+		}
+	}
+
+	VpuWriteReg(BIT_INT_ENABLE, 0);
+	VpuWriteReg(BIT_CODE_RUN, 0);
+
+	for (i = 0 ; i < 2048 ; i++) {
+		tmpData = bit_code[i];
+		WriteRegNoMsg(BIT_CODE_DOWN, (i<<16)|tmpData);
+	}
+
+	VpuWriteReg(BIT_PARA_BUF_ADDR, paramBufAddr);
+	VpuWriteReg(BIT_CODE_BUF_ADDR, codeBufAddr);
+	VpuWriteReg(BIT_TEMP_BUF_ADDR, tmpBufAddr);
+
+	VpuWriteReg(BIT_BIT_STREAM_CTRL, VPU_STREAM_ENDIAN);
+
+	/* Interleave bit position is modified */
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, CBCR_INTERLEAVE<<2|VPU_FRAME_ENDIAN);
+
+	VpuWriteReg(BIT_BIT_STREAM_PARAM, 0);
+
+	VpuWriteReg(BIT_AXI_SRAM_USE, 0);
+	VpuWriteReg(BIT_INT_ENABLE, 0);
+	VpuWriteReg(BIT_ROLLBACK_STATUS, 0);
+
+	tmpData  = (1<<VPU_INT_BIT_BIT_BUF_FULL);
+	tmpData |= (1<<VPU_INT_BIT_BIT_BUF_EMPTY);
+	tmpData |= (1<<VPU_INT_BIT_DEC_MB_ROWS);
+	tmpData |= (1<<VPU_INT_BIT_SEQ_INIT);
+	tmpData |= (1<<VPU_INT_BIT_DEC_FIELD);
+	tmpData |= (1<<VPU_INT_BIT_PIC_RUN);
+	VpuWriteReg(BIT_INT_ENABLE, tmpData);
+	VpuWriteReg(BIT_INT_CLEAR, 0x1);
+
+	VpuWriteReg(BIT_USE_NX_EXPND, USE_NX_EXPND);
+	VpuWriteReg(BIT_BUSY_FLAG, 0x1);
+	VpuWriteReg(BIT_CODE_RESET, 1);
+	VpuWriteReg(BIT_CODE_RUN, 1);
+
+	if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+		BIT_BUSY_FLAG)) {
+		NX_ErrMsg(("NX_VpuInit() Failed. Timeout(%d)\n",
+			VPU_BUSY_CHECK_TIMEOUT));
+		return ret;
+	}
+
+	CheckVersion();
+
+	for (i = 0 ; i < NX_MAX_VPU_INSTANCE ; i++) {
+		gstVpuInstance[i].inUse = 0;
+		gstVpuInstance[i].paramPhyAddr = paramBufAddr;
+		gstVpuInstance[i].paramVirAddr = firmVirAddr +
+			CODE_BUF_SIZE + TEMP_BUF_SIZE;
+		gstVpuInstance[i].paramBufSize = PARA_BUF_SIZE;
+	}
+	gstIsInitialized = 1;
+
+	return ret;
+}
+
+int NX_VpuDeInit(void *dev)
+{
+	if (!gstIsInitialized) {
+		NX_ErrMsg(("VPU Already Denitialized!!!\n"));
+		return VPU_RET_ERR_INIT;
+	}
+
+	if (VPU_IsBusy()) {
+		NX_ErrMsg(("NX_VpuDeInit: VPU_IsBusy!!!\n"));
+	}
+
+	NX_VPU_HWOff(dev);
+
+	gstIsInitialized = 0;
+	return VPU_RET_OK;
+}
+
+int NX_VpuSuspend(void *dev)
+{
+	int i;
+
+	if (!gstIsInitialized)
+		return VPU_RET_ERR_INIT;
+
+	if (VPU_IsBusy())
+		return VPU_RET_BUSY;
+	for (i = 0 ; i < 64 ; i++)
+		gstVpuRegStore[i] = VpuReadReg(BIT_BASE+0x100 + (i * 4));
+
+	NX_VPU_HWOff(dev);
+
+	return VPU_RET_OK;
+}
+
+int NX_VpuResume(void *dev, void *pVpuBaseAddr)
+{
+	int i;
+	unsigned int value;
+
+	if (!gstIsInitialized)
+		return VPU_RET_ERR_INIT;
+
+	NX_VPU_HwOn(dev, pVpuBaseAddr);
+
+	VPU_SWReset(SW_RESET_ON_BOOT);
+
+	for (i = 0 ; i < 64 ; i++)
+		VpuWriteReg(BIT_BASE+0x100+(i * 4), gstVpuRegStore[i]);
+
+	VpuWriteReg(BIT_CODE_RUN, 0);
+	/* Bit Code */
+	for (i = 0; i < 2048; i++) {
+		value = bit_code[i];
+		VpuWriteReg(BIT_CODE_DOWN, ((i << 16) | value));
+	}
+
+	VpuWriteReg(BIT_BUSY_FLAG, 1);
+	VpuWriteReg(BIT_CODE_RESET, 1);
+	VpuWriteReg(BIT_CODE_RUN, 1);
+
+	VpuWriteReg(BIT_USE_NX_EXPND, USE_NX_EXPND);
+
+	if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+		BIT_BUSY_FLAG)) {
+		NX_ErrMsg(("NX_VpuResume() Failed. Timeout(%d)\n",
+			VPU_BUSY_CHECK_TIMEOUT));
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	return VPU_RET_OK;
+}
+
+struct nx_vpu_codec_inst *NX_VpuGetInstance(int index)
+{
+	return &gstVpuInstance[index];
+}
+
+int NX_VpuIsInitialized(void)
+{
+	return gstIsInitialized;
+}
+
+int swap_endian(unsigned char *data, int len)
+{
+	unsigned int *p;
+	unsigned int v1, v2, v3;
+	int i;
+	int swap = 0;
+
+	p = (unsigned int *)data;
+
+	for (i = 0; i < len/4; i += 2) {
+		v1 = p[i];
+		v2  = (v1 >> 24) & 0xFF;
+		v2 |= ((v1 >> 16) & 0xFF) <<  8;
+		v2 |= ((v1 >>  8) & 0xFF) << 16;
+		v2 |= ((v1 >>  0) & 0xFF) << 24;
+		v3 =  v2;
+		v1  = p[i+1];
+		v2  = (v1 >> 24) & 0xFF;
+		v2 |= ((v1 >> 16) & 0xFF) <<  8;
+		v2 |= ((v1 >>  8) & 0xFF) << 16;
+		v2 |= ((v1 >>  0) & 0xFF) << 24;
+		p[i]   =  v2;
+		p[i+1] = v3;
+	}
+
+	return swap;
+}
+
+int NX_VpuParaInitialized(void *dev)
+{
+	gstIsInitialized = 0;
+	gstIsVPUOn = 0;
+
+	gstCodaClockEnRegVir = (uint32_t *)devm_ioremap_nocache(dev,
+		CODA960CLKENB_REG, 4);
+	if (!gstCodaClockEnRegVir)
+		return -1;
+
+	gstIsolateBase = (uint32_t *)devm_ioremap_nocache(dev,
+		VPU_NISOLATE_REG, 128);
+	gstAliveBase = (uint32_t *)devm_ioremap_nocache(dev,
+		VPU_ALIVEGATE_REG, 128);
+	if (!gstIsolateBase || !gstAliveBase)
+		return -1;
+
+	return 0;
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_api.h b/drivers/media/platform/nxp-vpu/nx_vpu_api.h
--- a/drivers/media/platform/nxp-vpu/nx_vpu_api.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_api.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,541 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_VPU_API_H__
+#define	__NX_VPU_API_H__
+
+#include "nx_port_func.h"
+#include "vpu_types.h"
+#include "nx_vpu_config.h"
+#include <soc/nexell/tieoff.h>
+
+/* Codec Mode */
+enum {
+	AVC_DEC = 0,
+	VC1_DEC = 1,
+	MP2_DEC = 2,
+	MP4_DEC = 3,
+	DV3_DEC = 3,
+	RV_DEC = 4,
+	AVS_DEC = 5,
+	MJPG_DEC = 6,
+	VPX_DEC = 7,
+
+	AVC_ENC = 8,
+	MP4_ENC = 11,
+	MJPG_ENC = 13
+};
+
+/* MPEG4 Aux Mode */
+enum {
+	MP4_AUX_MPEG4 = 0,
+	MP4_AUX_DIVX3 = 1
+};
+
+/* VPX Aux Mode */
+enum {
+	VPX_AUX_THO = 0,
+	VPX_AUX_VP6 = 1,
+	VPX_AUX_VP8 = 2
+};
+
+/* AVC Aux Mode */
+enum {
+	AVC_AUX_AVC = 0,
+	AVC_AUX_MVC = 1
+};
+
+/* Interrupt Register Bit Enumerate */
+enum {
+	VPU_INT_BIT_INIT            = 0,
+	VPU_INT_BIT_SEQ_INIT        = 1,
+	VPU_INT_BIT_SEQ_END         = 2,
+	VPU_INT_BIT_PIC_RUN         = 3,
+	VPU_INT_BIT_FRAMEBUF_SET    = 4,
+	VPU_INT_BIT_ENC_HEADER      = 5,
+	VPU_INT_BIT_DEC_PARA_SET    = 7,
+	VPU_INT_BIT_DEC_BUF_FLUSH   = 8,
+	VPU_INT_BIT_USERDATA        = 9,
+	VPU_INT_BIT_DEC_FIELD       = 10,
+	VPU_INT_BIT_DEC_MB_ROWS     = 13,
+	VPU_INT_BIT_BIT_BUF_EMPTY   = 14,
+	VPU_INT_BIT_BIT_BUF_FULL    = 15
+};
+
+enum {
+	SW_RESET_SAFETY,
+	SW_RESET_FORCE,
+	SW_RESET_ON_BOOT
+};
+
+enum nx_vpu_bit_chg_para {
+	VPU_BIT_CHG_GOP		= 1,	        /* GOP */
+	VPU_BIT_CHG_INTRAQP	= (1 << 1),     /* Intra Qp */
+	VPU_BIT_CHG_BITRATE	= (1 << 2),     /* Bit Rate */
+	VPU_BIT_CHG_FRAMERATE	= (1 << 3),     /* Frame Rate */
+	VPU_BIT_CHG_INTRARF	= (1 << 4),     /* Intra Refresh */
+	VPU_BIT_CHG_SLICEMOD	= (1 << 5),     /* Slice Mode */
+	VPU_BIT_CHG_HECMODE	= (1 << 6),     /* HEC Mode */
+};
+
+enum bit_stream_mode {
+	BS_MODE_INTERRUPT,
+	BS_MODE_ROLLBACK,
+	BS_MODE_PIC_END
+};
+
+enum mp4_header_type {
+	VOL_HEADER,
+	VOS_HEADER,
+	VIS_HEADER
+};
+
+enum avc_header_type {
+	SPS_RBSP,
+	PPS_RBSP,
+	END_SEQ_RBSP,
+	END_STREAM_RBSP,
+	SPS_RBSP_MVC,
+	PPS_RBSP_MVC,
+};
+
+/* Define VPU Low-Level Return Value */
+enum nx_vpu_ret {
+	VPU_RET_ERR_STRM_FULL	= -24,	/* Bitstream Full */
+	VPU_RET_ERR_SRAM	= -23,	/* VPU SRAM Configruation Failed */
+	VPU_RET_ERR_INST	= -22,	/* VPU Have No Instance Space */
+	VPU_RET_BUSY		= -21,	/* VPU H/W Busy */
+	VPU_RET_ERR_TIMEOUT	= -20,	/* VPU Wait Timeout */
+	VPU_RET_ERR_MEM_ACCESS	= -19,	/* Memory Access Violation */
+
+	VPU_RET_ERR_CHG_PARAM	= -6,	/* VPU Not Changed */
+	VPU_RET_ERR_WRONG_SEQ	= -5,	/* Wrong Sequence */
+	VPU_RET_ERR_PARAM	= -4,	/* VPU Invalid Parameter */
+	VPU_RET_ERR_RUN		= -3,
+	VPU_RET_ERR_INIT	= -2,	/* VPU Not Initialized */
+	VPU_RET_ERROR		= -1,	/* General operation failed */
+	VPU_RET_OK		= 0,
+	VPU_RET_NEED_STREAM	= 1,	/* Need More Stream */
+};
+
+
+/* Common Memory Information */
+
+struct sec_axi_info {
+	int useBitEnable;
+	int useIpEnable;
+	int useDbkYEnable;
+	int useDbkCEnable;
+	int useOvlEnable;
+	int useBtpEnable;
+	unsigned int bufBitUse;
+	unsigned int bufIpAcDcUse;
+	unsigned int bufDbkYUse;
+	unsigned int bufDbkCUse;
+	unsigned int bufOvlUse;
+	unsigned int bufBtpUse;
+	int bufSize;
+};
+
+struct enc_mp4_param {
+	int mp4DataPartitionEnable;
+	int mp4ReversibleVlcEnable;
+	int mp4IntraDcVlcThr;
+	int mp4HecEnable;
+	int mp4Verid;
+};
+
+struct enc_h263_param {
+	int h263AnnexIEnable;
+	int h263AnnexJEnable;
+	int h263AnnexKEnable;
+	int h263AnnexTEnable;
+};
+
+struct enc_avc_param {
+	/* CMD_ENC_SEQ_264_PARA Register (0x1A0) */
+	int chromaQpOffset;		/* bit [4:0] */
+	int constrainedIntraPredFlag;	/* bit [5] */
+	int disableDeblk;		/* bit [7:6] */
+	int deblkFilterOffsetAlpha;	/* bit [11:8] */
+	int deblkFilterOffsetBeta;	/* bit [15:12] */
+
+	/* CMD_ENC_SEQ_OPTION Register */
+	int audEnable;			/* bit[2] AUD(Access Unit Delimiter) */
+
+	/* Crop Info */
+	int enableCrop;
+	int cropLeft;
+	int cropTop;
+	int cropRight;
+	int cropBottom;
+};
+
+struct enc_jpeg_info {
+	int picWidth;
+	int picHeight;
+	int alignedWidth;
+	int alignedHeight;
+	int frameIdx;
+	int format;
+
+	int rotationEnable;
+	int rotationAngle;
+	int mirrorEnable;
+	int mirrorDirection;
+
+	int rstIntval;
+	int busReqNum;
+	int mcuBlockNum;
+	int compNum;
+	int compInfo[3];
+
+	unsigned int huffCode[4][256];
+	unsigned int huffSize[4][256];
+	unsigned char huffVal[4][162];
+	unsigned char huffBits[4][256];
+	unsigned char qMatTab[4][64];
+	unsigned char cInfoTab[4][6];
+
+	uint8_t jpegHeader[1024];
+	int32_t headerSize;
+};
+
+struct vpu_enc_info {
+	int codecStd;
+
+	/* input picture */
+	int srcWidth;
+	int srcHeight;
+
+	/* encoding image size */
+	int encWidth;
+	int encHeight;
+
+	int gopSize;
+	int bitRate;
+	int frameRateNum;	        /* framerate */
+	int frameRateDen;
+
+	int rotateAngle;		/* 0/90/180/270 */
+	int mirrorDirection;	        /* 0/1/2/3 */
+
+	int sliceMode;
+	int sliceSizeMode;
+	int sliceSize;
+
+	int bwbEnable;
+	int cbcrInterleave;		/* Input Frame's CbCrInterleave */
+	int cbcrInterleaveRefFrame;	/* Reference Frame's CbCrInterleave */
+	int frameEndian;
+
+	int frameQp;
+	int jpegQuality;
+
+	/* Frame Buffers */
+	int minFrameBuffers;
+	int frameBufMapType;
+	struct nx_vid_memory_info frameBuffer[3];
+	uint64_t subSampleAPhyAddr;
+	uint64_t subSampleBPhyAddr;
+	struct sec_axi_info sec_axi_info;
+	/* for CMD_SET_FRAME_CACHE_CONFIG register */
+	unsigned int cacheConfig;
+
+	/* Mpeg4 Encoder Only (for data partition) */
+	uint64_t usbSampleDPPhyAddr;
+	uint32_t usbSampleDPSize;
+
+	int linear2TiledEnable;
+
+	/* Output Stream Buffer's Address & Size */
+	uint64_t strmBufVirAddr;
+	uint64_t strmBufPhyAddr;
+	int strmBufSize;
+
+	unsigned int ringBufferEnable;
+	unsigned int strmWritePrt;	/* Bitstream Write Ptr */
+	unsigned int strmReadPrt;	/* Bitstream Read Ptr */
+	unsigned int strmEndFlag;	/* Bitstream End Flag */
+
+	int userQpMax;			/* User Max Quantization */
+	int userGamma;			/* User Gamma Factor */
+
+	/* Rate Control */
+	int rcEnable;			/* Rate Control Enable */
+	int rcIntraQp;
+
+	/* (MB Mode(0), Frame Mode(1), Slice Mode(2), MB-NumMode(3) */
+	int rcIntervalMode;
+	int mbInterval;
+	int rcIntraCostWeigth;
+	int enableAutoSkip;
+	int initialDelay;
+	int vbvBufSize;
+	int intraRefresh;
+
+	union {
+		struct enc_avc_param avcEncParam;
+		struct enc_mp4_param mp4EncParam;
+		struct enc_h263_param h263EncParam;
+		struct enc_jpeg_info jpgEncInfo;
+	} enc_codec_para;
+
+	/* Motion Estimation */
+	int MEUseZeroPmv;
+	int MESearchRange;
+	int MEBlockMode;
+};
+
+struct low_delay_info {
+	int lowDelayEn;
+	int numRows;
+};
+
+struct vpu_dec_info {
+	int codecStd;
+
+	int width;
+	int height;
+
+	/* Input Stream Buffer Address */
+	uint64_t streamRdPtrRegAddr;	/* BIT_RD_PTR or MJPEG_BBC_RD_PTR_REG */
+	uint64_t streamWrPtrRegAddr;	/* BIT_WR_PTR or MJPEG_BBC_WR_PTR_REG */
+	uint64_t frameDisplayFlagRegAddr;
+
+	uint64_t strmBufPhyAddr;
+	uint64_t strmBufVirAddr;
+	int needMoreFrame;
+	int strmBufSize;
+	int bitStreamMode;
+
+	int bwbEnable;
+	int cbcrInterleave;
+
+	int seqInitEscape;
+
+	/* User Data */
+	int userDataEnable;
+	int userDataReportMode;
+	uint64_t userDataBufPhyAddr;
+	uint64_t userDataBufVirAddr;
+	int userDataBufSize;
+
+	/* Low Dealy Information */
+	struct low_delay_info low_delay_info;
+
+	unsigned int readPos;
+	unsigned int writePos;
+
+	/* Frame Buffer Information (Instance Global) */
+	int numFrameBuffer;
+	uint32_t strideY;
+	struct vpu_dec_phy_addr_info phyAddrs;
+	struct sec_axi_info sec_axi_info;
+	/* for CMD_SET_FRAME_CACHE_CONFIG register */
+	int cacheConfig;
+
+	int bytePosFrameStart;
+	int bytePosFrameEnd;
+
+	/* Options */
+	int enableReordering;		/* enable reordering */
+	int enableMp4Deblock;		/* Mpeg4 Deblocking Option */
+
+	/* MPEG-4/Divx5.0 or Higher/XVID/Divx4.0/old XVID
+		(Compress Type --> class) */
+	int mp4Class;
+
+	/* VC1 Specific Information */
+	int vc1BframeDisplayValid;
+
+	/* AVC Specific Information */
+	int avcErrorConcealMode;
+
+	int frameDelay;
+	int streamEndflag;
+	int streamEndian;
+	int frameDisplayFlag;
+	int clearDisplayIndexes;
+
+	/* Jpeg Specific Information */
+	int frmBufferValid[MAX_REG_FRAME];
+
+	unsigned int headerSize;
+	int thumbnailMode;
+	int decodeIdx;
+
+	int imgFormat;
+	int rstInterval;
+	int userHuffTable;
+
+	unsigned char huffBits[4][256];
+	unsigned char huffPtr[4][16];
+	unsigned int huffMin[4][16];
+	unsigned int huffMax[4][16];
+
+	unsigned char huffValue[4][162];
+	unsigned char infoTable[4][6];
+	unsigned char quantTable[4][64];
+
+	int huffDcIdx;
+	int huffAcIdx;
+	int qIdx;
+
+	int busReqNum;
+	int mcuBlockNum;
+	int compNum;
+	int compInfo[3];
+	int mcuWidth;
+	int mcuHeight;
+
+	int pagePtr;
+	int wordPtr;
+	int bitPtr;
+
+	int validFlg;
+};
+
+struct nx_vpu_codec_inst {
+	void *devHandle;
+	int inUse;
+	int instIndex;
+	int isInitialized;
+	int codecMode;
+	int auxMode;
+	uint64_t paramPhyAddr;	        /* Common Area */
+	char *paramVirAddr;
+	uint32_t paramBufSize;
+	uint64_t instBufPhyAddr;
+	union{
+		struct vpu_dec_info decInfo;
+		struct vpu_enc_info encInfo;
+	} codecInfo;
+};
+
+/* BIT_RUN command */
+enum nx_vpu_cmd {
+	SEQ_INIT = 1,
+	SEQ_END = 2,
+	PIC_RUN = 3,
+	SET_FRAME_BUF = 4,
+	ENCODE_HEADER = 5,
+	ENC_PARA_SET = 6,
+	DEC_PARA_SET = 7,
+	DEC_BUF_FLUSH = 8,
+	RC_CHANGE_PARAMETER = 9,
+	VPU_SLEEP = 10,
+	VPU_WAKE = 11,
+	ENC_ROI_INIT = 12,
+	FIRMWARE_GET = 0xf,
+
+	GET_ENC_INSTANCE = 0x100,
+	ENC_RUN = 0x101,
+
+	GET_DEC_INSTANCE = 0x200,
+	DEC_RUN = 0x201,
+};
+
+enum vpu_gdi_tiled_map_type {
+	VPU_LINEAR_FRAME_MAP  = 0,
+	VPU_TILED_FRAME_V_MAP = 1,
+	VPU_TILED_FRAME_H_MAP = 2,
+	VPU_TILED_FIELD_V_MAP = 3,
+	VPU_TILED_MIXED_V_MAP = 4,
+	VPU_TILED_FRAME_MB_RASTER_MAP = 5,
+	VPU_TILED_FIELD_MB_RASTER_MAP = 6,
+	VPU_TILED_MAP_TYPE_MAX
+};
+
+
+/* H/W Level APIs */
+void NX_VPU_HwOn(void *, void *);
+void NX_VPU_HWOff(void *);
+int NX_VPU_GetCurPowerState(void);
+void NX_VPU_Clock(int on);
+
+int NX_VpuInit(void *pv, void *baseAddr, void *firmVirAddr,
+	uint32_t firmPhyAddr);
+int NX_VpuDeInit(void *);
+
+int NX_VpuSuspend(void *dev);
+int NX_VpuResume(void *dev, void *pVpuBaseAddr);
+
+int VPU_WaitVpuBusy(int mSeconds, unsigned int busyFlagReg);
+
+int VPU_SWReset(int resetMode);
+
+struct nx_vpu_codec_inst *NX_VpuGetInstance(int index);
+int NX_VpuIsInitialized(void);
+int NX_VpuParaInitialized(void *dev);
+int swap_endian(unsigned char *data, int len);
+
+/* Encoder Specific APIs */
+int NX_VpuEncOpen(struct vpu_open_arg *pOpenArg, void *devHandle,
+	struct nx_vpu_codec_inst **ppInst);
+int NX_VpuEncClose(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present);
+int NX_VpuEncSetSeqParam(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_seq_arg *pSeqArg);
+int NX_VpuEncSetFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_set_frame_arg *pFrmArg);
+int NX_VpuEncGetHeader(struct nx_vpu_codec_inst *pInst,
+	union vpu_enc_get_header_arg *pHeader);
+int NX_VpuEncRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_run_frame_arg *pRunArg);
+int NX_VpuEncChgParam(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_chg_para_arg *pChgArg);
+
+/* Decoder Specific APIs */
+int NX_VpuDecOpen(struct vpu_open_arg *pOpenArg, void *devHandle,
+	struct nx_vpu_codec_inst **ppInst);
+int NX_VpuDecClose(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present);
+int NX_VpuDecSetSeqInfo(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pSeqArg);
+int NX_VpuDecRegFrameBuf(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_reg_frame_arg *pFrmArg);
+int NX_VpuFillStreamBuffer(struct nx_vpu_codec_inst*,
+		void *strmData, unsigned strmDataSize);
+int NX_VpuDecRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_frame_arg *pRunArg);
+int NX_VpuDecFlush(struct nx_vpu_codec_inst *pInst);
+int NX_VpuDecClrDspFlag(struct nx_vpu_codec_inst *pInst, unsigned index);
+
+/* Jpeg Encoder Specific APIs */
+int JPU_EncRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_run_frame_arg *pRunArg);
+
+/* Jpeg Decoder Specific APIs */
+int JPU_DecSetSeqInfo(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pSeqArg);
+int JPU_DecParseHeader(struct vpu_dec_info *pInfo, uint8_t *pbyStream,
+	int32_t iSize);
+int JPU_DecRegFrameBuf(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_reg_frame_arg *pFrmArg);
+int JPU_DecRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_frame_arg *pRunArg);
+
+
+extern void vpu_soc_peri_reset_enter(void *pv);
+extern void vpu_soc_peri_reset_exit(void *pv);
+
+extern int VPU_WaitBitInterrupt(void *devHandle, int mSeconds);
+extern int JPU_WaitInterrupt(void *devHandle, int timeOut);
+
+#endif/* __NX_VPU_API_H__ */
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_config.h b/drivers/media/platform/nxp-vpu/nx_vpu_config.h
--- a/drivers/media/platform/nxp-vpu/nx_vpu_config.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_config.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_VPU_CONFIG_H__
+#define __NX_VPU_CONFIG_H__
+
+
+#define	NX_MAX_VPU_INSTANCE		16
+
+/* VPU Clock Gating */
+#define	ENABLE_CLOCK_GATING
+/* #define	ENABLE_POWER_SAVING */
+
+#define	NX_DBG_INFO			0
+
+/* Debug Register Access */
+#define	NX_REG_ACC_DEBUG		0	/* Use Debug Function */
+#define	NX_REG_EN_MSG			0	/* Enable Debug Message */
+
+
+/*
+ *	Memory Size Config
+ *
+ *	 -----------------------   High Address
+ *	| Instance       (1MB)  |
+ *	 -----------------------
+ *	| Param Buffer   (1MB)  |
+ *	 -----------------------
+ *	| Temp Buf       (1MB)  |
+ *	 -----------------------
+ *	| Working Buffer (1MB)  |
+ *	 -----------------------
+ *	| Code Buffer    (1MB)  |
+ *	 -----------------------   Low Address
+ */
+
+
+#define PARA_BUF_SIZE		(12  * 1024)
+#define	TEMP_BUF_SIZE		(204 * 1024)
+#define	CODE_BUF_SIZE		(260 * 1024)
+
+#define	COMMON_BUF_SIZE		(CODE_BUF_SIZE+TEMP_BUF_SIZE+PARA_BUF_SIZE)
+
+#define	WORK_BUF_SIZE		(80  * 1024)
+#define	INST_BUF_SIZE		(NX_MAX_VPU_INSTANCE*WORK_BUF_SIZE)
+
+#define	DEC_STREAM_SIZE		        (1 * 1024 * 1024)
+
+#define	VPU_LITTLE_ENDIAN	        0
+#define	VPU_BIG_ENDIAN		        1
+
+#define VPU_FRAME_ENDIAN	        VPU_LITTLE_ENDIAN
+#define	VPU_FRAME_BUFFER_ENDIAN	        VPU_LITTLE_ENDIAN
+#define VPU_STREAM_ENDIAN	        VPU_LITTLE_ENDIAN
+
+
+#define	CBCR_INTERLEAVE			0
+#define VPU_ENABLE_BWB			1
+#define	ENC_FRAME_BUF_CBCR_INTERLEAVE	1
+
+
+/* AXI Expander Select */
+#define	USE_NX_EXPND			1
+
+/* Timeout */
+#define	VPU_BUSY_CHECK_TIMEOUT		500	/* 500 msec */
+#define VPU_ENC_TIMEOUT			1000	/* 1 sec */
+#define VPU_DEC_TIMEOUT			300	/* 300 msec */
+#define JPU_ENC_TIMEOUT			1000	/* 1 sec */
+#define JPU_DEC_TIMEOUT			1000	/* 1 sec */
+
+
+#define VPU_GBU_SIZE		        1024	/* No modification required */
+#define JPU_GBU_SIZE			512	/* No modification required */
+
+
+#define	MAX_REG_FRAME			31
+
+
+/*----------------------------------------------------------------------------
+ *	Encoder Configurations
+ */
+#define	VPU_ENC_MAX_FRAME_BUF		3
+#define VPU_ME_LINEBUFFER_MODE		2
+
+
+/*----------------------------------------------------------------------------
+ *	Decoder Configurations
+ */
+#define	VPU_REORDER_ENABLE		1
+#define VPU_GMC_PROCESS_METHOD	0
+#define VPU_AVC_X264_SUPPORT		1
+
+#define VPU_SPP_CHUNK_SIZE		1024	/* AVC SPP */
+
+#endif	/* __NX_VPU_CONFIG_H__ */
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_decoder.c b/drivers/media/platform/nxp-vpu/nx_vpu_decoder.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_decoder.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_decoder.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,1249 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef UNUSED
+#define UNUSED(p) ((void)(p))
+#endif
+
+#include <linux/platform_device.h>
+
+#include "vpu_hw_interface.h"           /* Register Access */
+#include "nx_vpu_api.h"
+#include "nx_vpu_gdi.h"
+
+
+#define DBG_USERDATA			0
+#define DBG_REGISTER			0
+#define DBG_ES_ADDR			0
+#define	INFO_MSG			0
+
+
+/*--------------------------------------------------------------------------- */
+/* Decoder Functions */
+static int FillBuffer(struct nx_vpu_codec_inst *pInst, unsigned char *stream,
+	int size);
+static int VPU_DecSeqInitCommand(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pArg);
+static int VPU_DecSeqComplete(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pArg);
+static int VPU_DecRegisterFrameBufCommand(struct nx_vpu_codec_inst
+	*pInst, struct vpu_dec_reg_frame_arg *pArg);
+static int VPU_DecStartOneFrameCommand(struct nx_vpu_codec_inst
+	*pInst, struct vpu_dec_frame_arg *pArg);
+static int VPU_DecGetOutputInfo(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_frame_arg *pArg);
+static int VPU_DecCloseCommand(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present);
+
+
+/*----------------------------------------------------------------------------
+ *			Decoder APIs
+ */
+
+int NX_VpuDecOpen(struct vpu_open_arg *pOpenArg, void *devHandle,
+	struct nx_vpu_codec_inst **ppInst)
+{
+	int val;
+	struct vpu_dec_info *pDecInfo;
+	struct nx_vpu_codec_inst *hInst = 0;
+
+	FUNC_IN();
+
+	*ppInst = 0;
+	if (!NX_VpuIsInitialized())
+		return VPU_RET_ERR_INIT;
+
+	hInst = NX_VpuGetInstance(pOpenArg->instIndex);
+	if (!hInst)
+		return VPU_RET_ERR_INST;
+
+	if (pOpenArg->codecStd == CODEC_STD_MPEG4) {
+		hInst->codecMode = MP4_DEC;
+		hInst->auxMode = MP4_AUX_MPEG4;
+	} else if (pOpenArg->codecStd == CODEC_STD_AVC) {
+		hInst->codecMode = AVC_DEC;
+		hInst->auxMode = AVC_AUX_AVC;
+	} else if (pOpenArg->codecStd == CODEC_STD_VC1) {
+		hInst->codecMode = VC1_DEC;
+	} else if (pOpenArg->codecStd == CODEC_STD_MPEG2) {
+		hInst->codecMode = MP2_DEC;
+		hInst->auxMode = 0;
+	} else if (pOpenArg->codecStd == CODEC_STD_H263) {
+		hInst->codecMode = MP4_DEC;
+		hInst->auxMode = 0;
+	} else if (pOpenArg->codecStd == CODEC_STD_DIV3) {
+		hInst->codecMode = DV3_DEC;
+		hInst->auxMode = MP4_AUX_DIVX3;
+	} else if (pOpenArg->codecStd == CODEC_STD_RV) {
+		hInst->codecMode = RV_DEC;
+	} else if (pOpenArg->codecStd == CODEC_STD_AVS) {
+		hInst->codecMode = AVS_DEC;
+	} else if (pOpenArg->codecStd == CODEC_STD_MJPG) {
+		hInst->codecMode = MJPG_DEC;
+	} else if (pOpenArg->codecStd == CODEC_STD_THO) {
+		hInst->codecMode = VPX_DEC;
+		hInst->auxMode = VPX_AUX_THO;
+	} else if (pOpenArg->codecStd == CODEC_STD_VP3) {
+		hInst->codecMode = VPX_DEC;
+		hInst->auxMode = VPX_AUX_THO;
+	} else if (pOpenArg->codecStd == CODEC_STD_VP8) {
+		hInst->codecMode = VPX_DEC;
+		hInst->auxMode = VPX_AUX_VP8;
+	} else {
+		NX_ErrMsg(("NX_VpuDecOpen() failed!!!\n"));
+		NX_ErrMsg(("Cannot support codec standard (%d)\n",
+			pOpenArg->codecStd));
+		return VPU_RET_ERR_PARAM;
+	}
+
+	/* Set Base Information */
+	hInst->inUse = 1;
+	hInst->instIndex = pOpenArg->instIndex;
+	hInst->devHandle = devHandle;
+
+	hInst->instBufPhyAddr = (uint64_t)pOpenArg->instanceBuf.phyAddr;
+	pDecInfo = &hInst->codecInfo.decInfo;
+
+	/* Clrear Instnace Information */
+	NX_DrvMemset(&hInst->codecInfo, 0, sizeof(hInst->codecInfo));
+	pDecInfo->codecStd = pOpenArg->codecStd;
+	pDecInfo->mp4Class = pOpenArg->mp4Class;
+
+	if (hInst->codecMode != MJPG_DEC) {
+		pDecInfo->streamRdPtrRegAddr = BIT_RD_PTR;
+		pDecInfo->streamWrPtrRegAddr = BIT_WR_PTR;
+		pDecInfo->frameDisplayFlagRegAddr = BIT_FRM_DIS_FLG;
+	} else {
+		pDecInfo->streamRdPtrRegAddr = MJPEG_BBC_RD_PTR_REG;
+		pDecInfo->streamWrPtrRegAddr = MJPEG_BBC_WR_PTR_REG;
+		pDecInfo->frameDisplayFlagRegAddr = 0;
+	}
+
+	pDecInfo->strmBufPhyAddr = (uint64_t)pOpenArg->streamBuf.phyAddr;
+	pDecInfo->strmBufVirAddr = (unsigned long)pOpenArg->streamBuf.virAddr;
+	pDecInfo->strmBufSize    = pOpenArg->streamBuf.size;
+	NX_DrvMemset((void *)(unsigned long)pDecInfo->strmBufVirAddr, 0,
+		pDecInfo->strmBufSize);
+
+	/* Set Other Parameters */
+	pDecInfo->frameDelay = -1;
+	pDecInfo->userDataEnable = 0;
+	pDecInfo->enableReordering = VPU_REORDER_ENABLE;
+	pDecInfo->vc1BframeDisplayValid = 0;
+	pDecInfo->avcErrorConcealMode = 0;
+	pDecInfo->enableMp4Deblock = 0;
+
+	if (pDecInfo->codecStd == CODEC_STD_AVC ||
+		pDecInfo->codecStd == CODEC_STD_MPEG2 ) {
+		pDecInfo->bitStreamMode = BS_MODE_PIC_END;
+		/*pDecInfo->bitStreamMode = BS_MODE_ROLLBACK; */
+	} else if (pDecInfo->codecStd == CODEC_STD_H263 ||
+		pDecInfo->codecStd == CODEC_STD_MPEG4) {
+		pDecInfo->bitStreamMode = BS_MODE_PIC_END;
+	} else {
+		pDecInfo->bitStreamMode = BS_MODE_ROLLBACK;
+	}
+
+	pDecInfo->streamEndflag = 0;/* Frame Unit Operation */
+	pDecInfo->bwbEnable = VPU_ENABLE_BWB;
+	pDecInfo->seqInitEscape = 0;
+	pDecInfo->streamEndian = VPU_STREAM_ENDIAN;
+
+	NX_DrvMemset(hInst->paramVirAddr, 0, PARA_BUF_SIZE);
+
+	VpuWriteReg(pDecInfo->streamWrPtrRegAddr, pDecInfo->strmBufPhyAddr);
+	VpuWriteReg(pDecInfo->streamRdPtrRegAddr, pDecInfo->strmBufPhyAddr);
+
+	pDecInfo->readPos  = pDecInfo->strmBufPhyAddr;
+	pDecInfo->writePos = pDecInfo->strmBufPhyAddr;
+
+	if (hInst->codecMode != MJPG_DEC) {
+		val = VpuReadReg(BIT_BIT_STREAM_PARAM);
+		val &= ~(1 << 2);
+		/* clear stream end flag at start */
+		VpuWriteReg(BIT_BIT_STREAM_PARAM, val);
+		pDecInfo->streamEndflag = val;
+	} else {
+		pDecInfo->streamEndflag = 0;
+		VpuWriteReg(MJPEG_BBC_BAS_ADDR_REG, pDecInfo->strmBufPhyAddr);
+		VpuWriteReg(MJPEG_BBC_END_ADDR_REG, pDecInfo->strmBufPhyAddr +
+			pDecInfo->strmBufSize);
+		VpuWriteReg(MJPEG_BBC_STRM_CTRL_REG, 0);
+	}
+
+	*ppInst = hInst;
+
+	NX_DbgMsg(INFO_MSG, ("===================================\n"));
+	NX_DbgMsg(INFO_MSG, (" VPU Open Information:\n"));
+	NX_DbgMsg(INFO_MSG, ("  Instance Index : %d\n", hInst->instIndex));
+	NX_DbgMsg(INFO_MSG, ("  BitStream Mode : %d\n",
+		pDecInfo->bitStreamMode));
+	NX_DbgMsg(INFO_MSG, ("  Codec Standard : %d\n", hInst->codecMode));
+	NX_DbgMsg(INFO_MSG, ("  Codec AUX Mode : %d\n", hInst->auxMode));
+	NX_DbgMsg(INFO_MSG, ("===================================\n"));
+
+	FUNC_OUT();
+	return VPU_RET_OK;
+}
+
+int NX_VpuDecSetSeqInfo(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pSeqArg)
+{
+	enum nx_vpu_ret ret;
+
+	FUNC_IN();
+
+	if (pInst->codecMode != MJPG_DEC) {
+		/* FillBuffer */
+		if (0 > FillBuffer(pInst,
+			(unsigned char *)(unsigned long)pSeqArg->seqData,
+			pSeqArg->seqDataSize)) {
+			NX_ErrMsg(("FillBuffer Error!!!\n"));
+			return VPU_RET_ERROR;
+		}
+
+#if 0
+		if (pInfo->bitStreamMode != BS_MODE_PIC_END) {
+			int streamSize;
+
+			if (pInfo->writePos > pInfo->readPos)
+				streamSize = pInfo->writePos - pInfo->readPos;
+			else
+				streamSize = pInfo->strmBufSize -
+					(pInfo->readPos - pInfo->writePos);
+
+			if (streamSize < VPU_GBU_SIZE*2)
+				return VPU_RET_NEED_STREAM;
+		}
+#endif
+
+		ret = VPU_DecSeqInitCommand(pInst, pSeqArg);
+		if (ret != VPU_RET_OK)
+			return ret;
+		ret = VPU_DecSeqComplete(pInst, pSeqArg);
+	} else {
+		ret = JPU_DecSetSeqInfo(pInst, pSeqArg);
+
+		/* Fill Data */
+		if (0 > FillBuffer(pInst,
+			(unsigned char *)(unsigned long)pSeqArg->seqData,
+			pSeqArg->seqDataSize)) {
+			NX_ErrMsg(("FillBuffer Failed.\n"));
+			return VPU_RET_ERROR;
+		}
+	}
+
+	FUNC_OUT();
+	return ret;
+}
+
+int NX_VpuDecRegFrameBuf(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_reg_frame_arg *pFrmArg)
+{
+	if (pInst->codecMode != MJPG_DEC)
+		return VPU_DecRegisterFrameBufCommand(pInst, pFrmArg);
+	else
+		return JPU_DecRegFrameBuf(pInst, pFrmArg);
+}
+
+int NX_VpuFillStreamBuffer(struct nx_vpu_codec_inst *pInst,
+		void *strmData, unsigned strmDataSize)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	enum nx_vpu_ret ret;
+
+	if (pInst->codecMode != MJPG_DEC) {
+		/* Fill Data */
+		if (0 > FillBuffer(pInst, strmData, strmDataSize)) {
+			NX_ErrMsg(("FillBuffer Failed.\n"));
+			return VPU_RET_ERROR;
+		}
+
+	} else {
+		if (pInfo->headerSize == 0) {
+			ret = JPU_DecParseHeader(pInfo, strmData, strmDataSize);
+			if (ret < 0) {
+				NX_ErrMsg(("JpgHeader is failed(Error = %d)!\n", ret));
+				return -1;
+			}
+		}
+		/* Fill Data */
+		if (0 > FillBuffer(pInst, strmData, strmDataSize)) {
+			NX_ErrMsg(("FillBuffer Failed.\n"));
+			return VPU_RET_ERROR;
+		}
+	}
+	return VPU_RET_OK;
+}
+
+int NX_VpuDecRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_frame_arg *pRunArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	enum nx_vpu_ret ret;
+
+
+	if (pInst->codecMode != MJPG_DEC) {
+#if 0
+		if (pInfo->bitStreamMode != BS_MODE_PIC_END) {
+			int streamSize;
+
+			if (pInfo->writePos > pInfo->readPos)
+				streamSize = pInfo->writePos - pInfo->readPos;
+			else
+				streamSize = pInfo->strmBufSize -
+					(pInfo->readPos - pInfo->writePos);
+
+			if (streamSize < VPU_GBU_SIZE*2) {
+				pRunArg->indexFrameDecoded = -1;
+				pRunArg->indexFrameDisplay = -1;
+				return VPU_RET_NEED_STREAM;
+			}
+		}
+#endif
+
+		ret = VPU_DecStartOneFrameCommand(pInst, pRunArg);
+		if (ret == VPU_RET_OK)
+			ret = VPU_DecGetOutputInfo(pInst, pRunArg);
+	} else {
+		if (pInfo->validFlg > 0) {
+			ret = JPU_DecRunFrame(pInst, pRunArg);
+			pInfo->validFlg -= 1;
+		} else {
+			ret = -1;
+		}
+	}
+
+	return ret;
+}
+
+int NX_VpuDecFlush(struct nx_vpu_codec_inst *pInst)
+{
+	unsigned int val;
+	struct vpu_dec_info *pDecInfo = &pInst->codecInfo.decInfo;
+
+	if (pInst->codecMode != MJPG_DEC) {
+		val = pDecInfo->frameDisplayFlag;
+		val &= ~pDecInfo->clearDisplayIndexes;
+		VpuWriteReg(pDecInfo->frameDisplayFlagRegAddr, val);
+		pDecInfo->clearDisplayIndexes = 0;
+		pDecInfo->writePos = pDecInfo->readPos;
+		VpuBitIssueCommand(pInst, DEC_BUF_FLUSH);
+
+		if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+			BIT_BUSY_FLAG))
+			return VPU_RET_ERR_TIMEOUT;
+
+		pDecInfo->frameDisplayFlag = VpuReadReg(
+			pDecInfo->frameDisplayFlagRegAddr);
+		pDecInfo->frameDisplayFlag = 0;
+		/* Clear End of Stream */
+		pDecInfo->streamEndflag &= ~(1 << 2);
+		pDecInfo->readPos = pDecInfo->strmBufPhyAddr;
+		pDecInfo->writePos = pDecInfo->strmBufPhyAddr;
+		NX_DrvMemset((void *)(unsigned long)pDecInfo->strmBufVirAddr,
+				0, pDecInfo->strmBufSize);
+	} else {
+		int i;
+
+		for (i = 0 ; i < pDecInfo->numFrameBuffer ; i++)
+			pDecInfo->frmBufferValid[i] = 0;
+	}
+
+	return VPU_RET_OK;
+}
+
+int NX_VpuDecClrDspFlag(struct nx_vpu_codec_inst *pInst,
+		unsigned indexFrameDisplay)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+
+	if (pInst->codecMode != MJPG_DEC)
+		pInfo->clearDisplayIndexes |= 1 << indexFrameDisplay;
+	else
+		pInfo->frmBufferValid[indexFrameDisplay] = 0;
+
+	return VPU_RET_OK;
+}
+
+int NX_VpuDecClose(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present)
+{
+	enum nx_vpu_ret ret;
+
+	if (pInst->codecMode == MJPG_DEC)
+		return VPU_RET_OK;
+
+	ret = VPU_DecCloseCommand(pInst, vpu_event_present);
+	if (ret != VPU_RET_OK)
+		NX_ErrMsg(("NX_VpuDecClose() failed.(%d)\n", ret));
+
+	return ret;
+}
+
+
+/*----------------------------------------------------------------------------
+ *		Decoder Specific Static Functions
+ */
+
+static int FillBuffer(struct nx_vpu_codec_inst *pInst, unsigned char *stream,
+	int size)
+{
+	uint32_t vWriteOffset, vReadOffset;/* Virtual Read/Write Position */
+	int32_t bufSize;
+	struct vpu_dec_info *pDecInfo = &pInst->codecInfo.decInfo;
+
+	/* EOS */
+	if (size == 0)
+		return 0;
+	if (!stream || size < 0)
+		return -1;
+
+	if (pDecInfo->codecStd == CODEC_STD_MJPG) {
+		stream += pDecInfo->headerSize;
+		size -= pDecInfo->headerSize;
+
+		pDecInfo->writePos = pDecInfo->strmBufPhyAddr;
+		pDecInfo->readPos  = pDecInfo->strmBufPhyAddr;
+
+		pDecInfo->validFlg += 1;
+	}
+
+	vWriteOffset = pDecInfo->writePos - pDecInfo->strmBufPhyAddr;
+	vReadOffset = pDecInfo->readPos - pDecInfo->strmBufPhyAddr;
+	bufSize  = pDecInfo->strmBufSize;
+
+	if (bufSize < vWriteOffset || bufSize < vReadOffset) {
+		NX_ErrMsg(("%s, stream_buffer(Addr=x0%08x, size=%d)\n",
+			__func__, (uint32_t)pDecInfo->strmBufVirAddr,
+			pDecInfo->strmBufSize));
+		NX_ErrMsg(("InBuffer(Addr=%p, size=%d)", stream, size));
+		NX_ErrMsg(("vWriteOffset = %d, vReadOffset = %d\n",
+			vWriteOffset, vReadOffset));
+		return -1;
+	}
+
+	if ((bufSize - vWriteOffset) > size) {
+		/* Just Memory Copy */
+#if 1
+		NX_DrvMemcpy((void *)(unsigned long)(pDecInfo->strmBufVirAddr +
+			vWriteOffset), stream, size);
+#else
+		if (copy_from_user((uint8_t *)(pDecInfo->strmBufVirAddr +
+			vWriteOffset), stream, size))
+			return -1;
+#endif
+		vWriteOffset += size;
+	} else {
+		/* Memory Copy */
+		int remain = bufSize - vWriteOffset;
+#if 1
+		NX_DrvMemcpy((void *)(unsigned long)(pDecInfo->strmBufVirAddr +
+			vWriteOffset), stream, remain);
+		NX_DrvMemcpy((void *)(unsigned long)(pDecInfo->strmBufVirAddr),
+			stream + remain, size-remain);
+#else
+		if (copy_from_user(
+			(void *)(unsigned long)(pDecInfo->strmBufVirAddr +
+			vWriteOffset), stream, remain))
+			return -1;
+		if (copy_from_user(
+			(void *)(unsigned long)(pDecInfo->strmBufVirAddr),
+			stream+remain, size-remain))
+			return -1;
+#endif
+		vWriteOffset = size-remain;
+	}
+
+	pDecInfo->writePos = vWriteOffset + pDecInfo->strmBufPhyAddr;
+	return 0;
+}
+
+static int VPU_DecSeqComplete(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pArg)
+{
+	unsigned int val, val2;
+	int errReason;
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+
+	if (pInfo->bitStreamMode == BS_MODE_INTERRUPT && pInfo->seqInitEscape) {
+		pInfo->streamEndflag &= ~(3<<3);
+		VpuWriteReg(BIT_BIT_STREAM_PARAM, pInfo->streamEndflag);
+		pInfo->seqInitEscape = 0;
+	}
+
+	pInfo->frameDisplayFlag = VpuReadReg(pInfo->frameDisplayFlagRegAddr);
+	pInfo->readPos = VpuReadReg(pInfo->streamRdPtrRegAddr);
+	pInfo->streamEndflag = VpuReadReg(BIT_BIT_STREAM_PARAM);
+
+	errReason = 0;
+	val = VpuReadReg(RET_DEC_SEQ_SUCCESS);
+	if (val & (1<<31))
+		return VPU_RET_ERR_MEM_ACCESS;
+
+	if (pInfo->bitStreamMode == BS_MODE_PIC_END ||
+		pInfo->bitStreamMode == BS_MODE_ROLLBACK) {
+		if (val & (1<<4)) {
+			errReason = VpuReadReg(RET_DEC_SEQ_SEQ_ERR_REASON);
+			NX_ErrMsg(("VPU decoder error: status=0x%x reason=0x%x\n", val,
+						errReason));
+			return VPU_RET_ERROR;
+		}
+	}
+
+	if (val == 0) {
+		errReason = VpuReadReg(RET_DEC_SEQ_SEQ_ERR_REASON);
+		NX_ErrMsg(("VPU decoder error: status=0 reason=0x%x\n", errReason));
+		return VPU_RET_ERROR;
+	}
+
+	val = VpuReadReg(RET_DEC_SEQ_SRC_SIZE);
+	pArg->outWidth  = ((val >> 16) & 0xffff);
+	pArg->outHeight = (val & 0xffff);
+
+	pArg->frameRateNum = VpuReadReg(RET_DEC_SEQ_FRATE_NR);
+	pArg->frameRateDen = VpuReadReg(RET_DEC_SEQ_FRATE_DR);
+
+	if (pInst->codecMode == AVC_DEC && pArg->frameRateDen > 0)
+		pArg->frameRateDen  *= 2;
+
+	if (pInst->codecMode  == MP4_DEC) {
+		val = VpuReadReg(RET_DEC_SEQ_INFO);
+		pArg->mp4ShortHeader = (val >> 2) & 1;
+		pArg->mp4PartitionEnable = val & 1;
+		pArg->mp4ReversibleVlcEnable =
+			pArg->mp4PartitionEnable ?
+			((val >> 1) & 1) : 0;
+		pArg->h263AnnexJEnable = (val >> 3) & 1;
+	} else if (pInst->codecMode == VPX_DEC && pInst->auxMode ==
+		VPX_AUX_VP8) {
+		/* h_scale[31:30] v_scale[29:28] pic_width[27:14]
+		 * pic_height[13:0] */
+		val = VpuReadReg(RET_DEC_SEQ_VP8_SCALE_INFO);
+		pArg->vp8HScaleFactor = (val >> 30) & 0x03;
+		pArg->vp8VScaleFactor = (val >> 28) & 0x03;
+		pArg->vp8ScaleWidth = (val >> 14) & 0x3FFF;
+		pArg->vp8ScaleHeight = (val >> 0) & 0x3FFF;
+	}
+
+	pArg->minFrameBufCnt = VpuReadReg(RET_DEC_SEQ_FRAME_NEED);
+	pArg->frameBufDelay = VpuReadReg(RET_DEC_SEQ_FRAME_DELAY);
+
+	if (pInst->codecMode == AVC_DEC || pInst->codecMode == MP2_DEC) {
+		val  = VpuReadReg(RET_DEC_SEQ_CROP_LEFT_RIGHT);
+		val2 = VpuReadReg(RET_DEC_SEQ_CROP_TOP_BOTTOM);
+		if (val == 0 && val2 == 0) {
+			pArg->cropLeft = 0;
+			pArg->cropRight = pArg->outWidth;
+			pArg->cropTop = 0;
+			pArg->cropBottom = pArg->outHeight;
+		} else {
+			pArg->cropLeft = ((val>>16) & 0xFFFF);
+			pArg->cropRight = pArg->outWidth - ((val & 0xFFFF));
+			pArg->cropTop = ((val2>>16) & 0xFFFF);
+			pArg->cropBottom = pArg->outHeight - ((val2 & 0xFFFF));
+		}
+
+		val = (pArg->outWidth * pArg->outHeight * 3 / 2) / 1024;
+		pArg->numSliceSize = val / 4;
+		pArg->worstSliceSize = val / 2;
+	} else {
+		pArg->cropLeft = 0;
+		pArg->cropRight = pArg->outWidth;
+		pArg->cropTop = 0;
+		pArg->cropBottom = pArg->outHeight;
+	}
+
+	val = VpuReadReg(RET_DEC_SEQ_HEADER_REPORT);
+	pArg->profile                =	(val >> 0) & 0xFF;
+	pArg->level                  =	(val >> 8) & 0xFF;
+	pArg->interlace              =	(val >> 16) & 0x01;
+	pArg->direct8x8Flag          =	(val >> 17) & 0x01;
+	pArg->vc1Psf                 =	(val >> 18) & 0x01;
+	pArg->constraint_set_flag[0] =	(val >> 19) & 0x01;
+	pArg->constraint_set_flag[1] =	(val >> 20) & 0x01;
+	pArg->constraint_set_flag[2] =	(val >> 21) & 0x01;
+	pArg->constraint_set_flag[3] =	(val >> 22) & 0x01;
+	pArg->avcIsExtSAR            =  (val >> 25) & 0x01;
+	pArg->maxNumRefFrmFlag       =  (val >> 31) & 0x01;
+
+	pArg->aspectRateInfo = VpuReadReg(RET_DEC_SEQ_ASPECT);
+
+	val = VpuReadReg(RET_DEC_SEQ_BIT_RATE);
+	pArg->bitrate = val;
+
+	if (pInst->codecMode == AVC_DEC) {
+		val = VpuReadReg(RET_DEC_SEQ_VUI_INFO);
+		pArg->vui_info.fixedFrameRateFlag    = val & 1;
+		pArg->vui_info.timingInfoPresent     = (val>>1) & 0x01;
+		pArg->vui_info.chromaLocBotField     = (val>>2) & 0x07;
+		pArg->vui_info.chromaLocTopField     = (val>>5) & 0x07;
+		pArg->vui_info.chromaLocInfoPresent  = (val>>8) & 0x01;
+		pArg->vui_info.colorPrimaries        = (val>>16) & 0xff;
+		pArg->vui_info.colorDescPresent      = (val>>24) & 0x01;
+		pArg->vui_info.isExtSAR              = (val>>25) & 0x01;
+		pArg->vui_info.vidFullRange          = (val>>26) & 0x01;
+		pArg->vui_info.vidFormat             = (val>>27) & 0x07;
+		pArg->vui_info.vidSigTypePresent     = (val>>30) & 0x01;
+		pArg->vui_info.vuiParamPresent       = (val>>31) & 0x01;
+
+		val = VpuReadReg(RET_DEC_SEQ_VUI_PIC_STRUCT);
+		pArg->vui_info.vuiPicStructPresent = (val & 0x1);
+		pArg->vui_info.vuiPicStruct = (val>>1);
+	}
+
+	if (pInst->codecMode == MP2_DEC) {
+		/* seq_ext info */
+		val = VpuReadReg(RET_DEC_SEQ_EXT_INFO);
+		pArg->mp2LowDelay = val & 1;
+		pArg->mp2DispVerSize = (val>>1) & 0x3fff;
+		pArg->mp2DispHorSize = (val>>15) & 0x3fff;
+	}
+
+	pInfo->writePos = VpuReadReg(pInfo->streamWrPtrRegAddr);
+	pInfo->readPos  = VpuReadReg(pInfo->streamRdPtrRegAddr);
+
+	pArg->strmWritePos = pInfo->writePos - pInfo->strmBufPhyAddr;
+	pArg->strmReadPos = pInfo->readPos - pInfo->strmBufPhyAddr;
+
+	pInfo->width = pArg->outWidth;
+	pInfo->height = pArg->outHeight;
+
+	pInst->isInitialized = 1;
+
+	return VPU_RET_OK;
+}
+
+static int VPU_DecSeqInitCommand(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_seq_init_arg *pArg)
+{
+	unsigned int val, reason;
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+
+	if (pArg->disableOutReorder) {
+		NX_DbgMsg(INFO_MSG, ("Disable Out Reordering!!!\n"));
+		pInfo->low_delay_info.lowDelayEn = 1;
+		pInfo->low_delay_info.numRows = 0;
+	}
+
+	if (pInfo->needMoreFrame) {
+		pInfo->needMoreFrame = 0;
+		VpuWriteReg(pInfo->streamWrPtrRegAddr, pInfo->writePos);
+		NX_DbgMsg(INFO_MSG, ("Need More Buffer!!!!!\n"));
+		goto WAIT_INTERRUPT;
+	}
+
+	pInfo->enableMp4Deblock = pArg->enablePostFilter;
+
+	VpuWriteReg(CMD_DEC_SEQ_BB_START, pInfo->strmBufPhyAddr);
+	VpuWriteReg(CMD_DEC_SEQ_BB_SIZE, pInfo->strmBufSize / 1024);
+
+#if (DBG_REGISTER)
+	{
+		int i;
+
+		VpuWriteReg(BIT_BIT_STREAM_PARAM, 0);
+
+		/* Clear Stream end flag */
+		i = (int)VpuReadReg(BIT_BIT_STREAM_PARAM);
+		if (i & (1 << (pInst->instIndex + 2)))
+			i -= 1 << (pInst->instIndex + 2);
+		VpuWriteReg(BIT_BIT_STREAM_PARAM, i);
+	}
+#endif
+
+	if (pArg->enableUserData) {
+		pInfo->userDataBufPhyAddr =
+			(uint64_t)pArg->userDataBuffer.phyAddr;
+		pInfo->userDataBufVirAddr =
+			(unsigned long)pArg->userDataBuffer.virAddr;
+		pInfo->userDataBufSize = pArg->userDataBuffer.size;
+		pInfo->userDataEnable = 1;
+		pInfo->userDataReportMode = 1;
+
+		val  = 0;
+		val |= (pInfo->userDataReportMode << 10);
+		/*  val |= (pInfo->userDataEnable << 5); */
+		VpuWriteReg(CMD_DEC_SEQ_USER_DATA_OPTION, val);
+		VpuWriteReg(CMD_DEC_SEQ_USER_DATA_BASE_ADDR,
+			pInfo->userDataBufPhyAddr);
+		VpuWriteReg(CMD_DEC_SEQ_USER_DATA_BUF_SIZE,
+			pInfo->userDataBufSize);
+	} else {
+		VpuWriteReg(CMD_DEC_SEQ_USER_DATA_OPTION, 0);
+		VpuWriteReg(CMD_DEC_SEQ_USER_DATA_BASE_ADDR, 0);
+		VpuWriteReg(CMD_DEC_SEQ_USER_DATA_BUF_SIZE, 0);
+	}
+	val  = 0;
+
+	if (!pInfo->low_delay_info.lowDelayEn)
+		val |= (pInfo->enableReordering<<1) & 0x2;
+
+	val |= (pInfo->enableMp4Deblock & 0x1);
+
+	/*Enable error conceal on missing reference in h.264/AVC */
+	val |= (pInfo->avcErrorConcealMode << 2);
+
+	VpuWriteReg(CMD_DEC_SEQ_OPTION, val);
+
+	switch (pInst->codecMode) {
+	case VC1_DEC:
+		/*  VpuWriteReg(CMD_DEC_SEQ_VC1_STREAM_FMT, 1);
+		VpuWriteReg(CMD_DEC_SEQ_VC1_STREAM_FMT, 2); */
+		VpuWriteReg(CMD_DEC_SEQ_VC1_STREAM_FMT, (0 << 3) & 0x08);
+		break;
+	case MP4_DEC:
+		VpuWriteReg(CMD_DEC_SEQ_MP4_ASP_CLASS,
+			(VPU_GMC_PROCESS_METHOD<<3) | pInfo->mp4Class);
+		break;
+	case AVC_DEC:
+		VpuWriteReg(CMD_DEC_SEQ_X264_MV_EN, VPU_AVC_X264_SUPPORT);
+		break;
+	}
+
+	if (pInst->codecMode == AVC_DEC)
+		VpuWriteReg(CMD_DEC_SEQ_SPP_CHUNK_SIZE, VPU_GBU_SIZE);
+
+	VpuWriteReg(pInfo->streamWrPtrRegAddr, pInfo->writePos);
+	VpuWriteReg(pInfo->streamRdPtrRegAddr, pInfo->readPos);
+
+	/* Clear Stream Flag */
+	pInfo->streamEndflag &= ~(1<<2);	/* Clear End of Stream */
+	pInfo->streamEndflag &= ~(3<<3);	/* Clear Bitstream Mode */
+	if (pInfo->bitStreamMode == BS_MODE_ROLLBACK) /*rollback mode */
+		pInfo->streamEndflag |= (1<<3);
+	else if (pInfo->bitStreamMode == BS_MODE_PIC_END)
+		pInfo->streamEndflag |= (2<<3);
+	else {	/* Interrupt Mode */
+		if (pInfo->seqInitEscape)
+			pInfo->streamEndflag |= (2<<3);
+	}
+
+	VpuWriteReg(BIT_BIT_STREAM_PARAM, pInfo->streamEndflag);
+	VpuWriteReg(BIT_BIT_STREAM_CTRL, pInfo->streamEndian);
+
+	val = 0;
+	val |= (pInfo->bwbEnable<<12);
+	val |= (pInfo->cbcrInterleave<<2);
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, val);
+
+	if (pInst->codecMode != MJPG_DEC)
+		VpuWriteReg(pInfo->frameDisplayFlagRegAddr, 0);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[DEC_SEQ_INIT]\n"));
+		NX_DbgMsg(DBG_REGISTER, ("[Strm_CTRL : 0x10C]%x\n",
+			VpuReadReg(BIT_BIT_STREAM_CTRL)));
+		for (reg = 0x180 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	VpuBitIssueCommand(pInst, SEQ_INIT);
+
+WAIT_INTERRUPT:
+	reason = VPU_WaitBitInterrupt(pInst->devHandle, VPU_DEC_TIMEOUT);
+	if (!reason) {
+		NX_ErrMsg(("VPU_DecSeqInitCommand() Failed. Timeout(%d)\n",
+			VPU_BUSY_CHECK_TIMEOUT));
+		NX_ErrMsg(("WritePos = 0x%.8x, ReadPos = 0x%.8x\n",
+			VpuReadReg(pInfo->streamWrPtrRegAddr),
+			VpuReadReg(pInfo->streamRdPtrRegAddr)));
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	if (reason & (1<<VPU_INT_BIT_SEQ_INIT)) {
+		return VPU_RET_OK;
+	} else if (reason & (1<<VPU_INT_BIT_BIT_BUF_EMPTY)) {
+		pInfo->needMoreFrame = 1;
+		return VPU_RET_NEED_STREAM;
+	} else {
+		return VPU_RET_ERROR;
+	}
+}
+
+static void setBufAddr(char *paramVirAddr, unsigned idx, unsigned value)
+{
+	((uint32_t*)paramVirAddr)[idx ^ 1] = cpu_to_le32(value);
+}
+
+static int VPU_DecRegisterFrameBufCommand(struct nx_vpu_codec_inst
+	*pInst, struct vpu_dec_reg_frame_arg *pArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	unsigned i, val;
+
+	pInfo->cbcrInterleave = pArg->chromaInterleave;
+	pInfo->cacheConfig =
+		MaverickCache2Config(1, pInfo->cbcrInterleave, 0, 0, 3, 0, 15);
+
+	SetTiledMapType(VPU_LINEAR_FRAME_MAP, pArg->strideY,
+		pInfo->cbcrInterleave);
+
+	for (i = 0; i < pArg->numFrameBuffer; i++) {
+		const uint32_t *phyAddr = pArg->phyAddrs->addr[i];
+
+		setBufAddr(pInst->paramVirAddr, 3 * i, phyAddr[0]);
+		setBufAddr(pInst->paramVirAddr, 3 * i + 1, phyAddr[1]);
+		if (pInfo->cbcrInterleave == 0)
+			setBufAddr(pInst->paramVirAddr, 3 * i + 2, phyAddr[2]);
+	}
+
+	pInfo->strideY = pArg->strideY;
+	pInfo->phyAddrs = *pArg->phyAddrs;
+
+	/* MV allocation and registe */
+	if (pInst->codecMode == AVC_DEC ||	pInst->codecMode == VC1_DEC ||
+		pInst->codecMode == MP4_DEC || pInst->codecMode == RV_DEC  ||
+		pInst->codecMode == AVS_DEC)
+	{
+		unsigned mvStartAddr = pArg->colMvBuffer->phyAddr;
+		int size_mvcolbuf =  ((pInfo->width+31)&~31) *
+			((pInfo->height+31)&~31);
+
+		size_mvcolbuf = (size_mvcolbuf*3) / 2;
+		size_mvcolbuf = (size_mvcolbuf+4) / 5;
+		size_mvcolbuf = ((size_mvcolbuf+7) / 8) * 8;
+
+		if (pInst->codecMode == AVC_DEC) {
+			for (i = 0; i < pArg->numFrameBuffer; i++) {
+				setBufAddr(pInst->paramVirAddr + 384, i, mvStartAddr);
+				mvStartAddr += size_mvcolbuf;
+			}
+		} else {
+			setBufAddr(pInst->paramVirAddr + 384, 0, mvStartAddr);
+		}
+	}
+
+	if (!ConfigDecSecAXI(pInfo->codecStd, &pInfo->sec_axi_info,
+		pInfo->width, pInfo->height, pArg->sramAddr, pArg->sramSize)) {
+		NX_ErrMsg(("ConfigDecSecAXI() failed !!!\n"));
+		NX_ErrMsg(("Width = %d, Heigth = %d\n",
+			pInfo->width, pInfo->height));
+		return VPU_RET_ERR_SRAM;
+	}
+
+	/* Tell the decoder how much frame buffers were allocated. */
+	VpuWriteReg(CMD_SET_FRAME_BUF_NUM, pArg->numFrameBuffer);
+	VpuWriteReg(CMD_SET_FRAME_BUF_STRIDE, pArg->strideY);
+	VpuWriteReg(CMD_SET_FRAME_AXI_BIT_ADDR, pInfo->sec_axi_info.bufBitUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_IPACDC_ADDR,
+		pInfo->sec_axi_info.bufIpAcDcUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_DBKY_ADDR,
+		pInfo->sec_axi_info.bufDbkYUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_DBKC_ADDR,
+		pInfo->sec_axi_info.bufDbkCUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_OVL_ADDR, pInfo->sec_axi_info.bufOvlUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_BTP_ADDR, pInfo->sec_axi_info.bufBtpUse);
+	VpuWriteReg(CMD_SET_FRAME_DELAY, pInfo->frameDelay);
+
+	/* Maverick Cache Configuration */
+	VpuWriteReg(CMD_SET_FRAME_CACHE_CONFIG, pInfo->cacheConfig);
+
+	if (pInst->codecMode == VPX_DEC) {
+		VpuWriteReg(CMD_SET_FRAME_MB_BUF_BASE,
+			pArg->pvbSliceBuffer->phyAddr);
+	}
+
+	if (pInst->codecMode == AVC_DEC) {
+		VpuWriteReg(CMD_SET_FRAME_SLICE_BB_START,
+			pArg->sliceBuffer->phyAddr);
+		VpuWriteReg(CMD_SET_FRAME_SLICE_BB_SIZE,
+			pArg->sliceBuffer->size/1024);
+	}
+
+	val = 0;
+	val |= (VPU_ENABLE_BWB<<12);
+	val |= (pInfo->cbcrInterleave<<2);
+	val |= VPU_FRAME_ENDIAN;
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, val);
+	VpuWriteReg(CMD_SET_FRAME_MAX_DEC_SIZE, 0);
+
+	VpuBitIssueCommand(pInst, SET_FRAME_BUF);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[DEC_SET_FRM_BUF_Reg]\n"));
+		for (reg = 0x180 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+		BIT_BUSY_FLAG)) {
+		NX_ErrMsg(("Error VPU_DecRegisterFrameBufCommand failed!!!\n"));
+		return VPU_RET_ERR_INIT;
+	}
+
+	if (VpuReadReg(RET_SET_FRAME_SUCCESS) & (1<<31))
+			return VPU_RET_ERR_MEM_ACCESS;
+
+	FUNC_OUT();
+	return VPU_RET_OK;
+}
+
+static int VPU_DecGetOutputInfo(struct nx_vpu_codec_inst *pInst,
+	struct vpu_dec_frame_arg *pArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	unsigned int val, val2;
+	struct vpu_rect rectInfo;
+
+	val = VpuReadReg(RET_DEC_PIC_SUCCESS);
+	if (val & (1<<31)) {
+		pArg->errReason  = VpuReadReg(GDI_WPROT_ERR_RSN);
+		pArg->errAddress = VpuReadReg(GDI_WPROT_ERR_ADR);
+		return VPU_RET_ERR_MEM_ACCESS;
+	}
+
+	if (pInst->codecMode == AVC_DEC) {
+		pArg->notSufficientPsBuffer = (val >> 3) & 0x1;
+		pArg->notSufficientSliceBuffer = (val >> 2) & 0x1;
+	}
+
+	pArg->indexFrameDecoded	= VpuReadReg(RET_DEC_PIC_DECODED_IDX);
+	pArg->indexFrameDisplay	= VpuReadReg(RET_DEC_PIC_DISPLAY_IDX);
+
+	val = VpuReadReg(RET_DEC_PIC_SIZE);/* decoding picture size */
+	pArg->outWidth  = (val>>16) & 0xFFFF;
+	pArg->outHeight = (val) & 0xFFFF;
+
+	/*if (pArg->indexFrameDecoded >= 0 && pArg->indexFrameDecoded <
+		MAX_REG_FRAME) */
+	{
+		if ((pInst->codecMode == VPX_DEC) && (pInst->auxMode ==
+			VPX_AUX_VP8)) {
+			/* VP8 specific header information
+			 * h_scale[31:30] v_scale[29:28] pic_width[27:14]
+			 * pic_height[13:0] */
+			val = VpuReadReg(RET_DEC_PIC_VP8_SCALE_INFO);
+			pArg->scale_info.hScaleFactor = (val >> 30) & 0x03;
+			pArg->scale_info.vScaleFactor = (val >> 28) & 0x03;
+			pArg->scale_info.picWidth = (val >> 14) & 0x3FFF;
+			pArg->scale_info.picHeight = (val >> 0) & 0x3FFF;
+
+			/* ref_idx_gold[31:24], ref_idx_altr[23:16],
+			 * ref_idx_last[15: 8],
+			 * version_number[3:1], show_frame[0] */
+			val = VpuReadReg(RET_DEC_PIC_VP8_PIC_REPORT);
+			pArg->pic_info.refIdxGold = (val >> 24) & 0x0FF;
+			pArg->pic_info.refIdxAltr = (val >> 16) & 0x0FF;
+			pArg->pic_info.refIdxLast = (val >> 8) & 0x0FF;
+			pArg->pic_info.versionNumber = (val >> 1) & 0x07;
+			pArg->pic_info.showFrame = (val >> 0) & 0x01;
+		}
+
+		/* default value */
+		rectInfo.left   = 0;
+		rectInfo.right  = pArg->outWidth;
+		rectInfo.top    = 0;
+		rectInfo.bottom = pArg->outHeight;
+
+		if (pInst->codecMode == AVC_DEC ||
+			pInst->codecMode == MP2_DEC) {
+			val = VpuReadReg(RET_DEC_PIC_CROP_LEFT_RIGHT);
+			val2 = VpuReadReg(RET_DEC_PIC_CROP_TOP_BOTTOM);
+
+			if (val == (unsigned int)-1 || val == 0) {
+				rectInfo.left  = 0;
+				rectInfo.right = pArg->outWidth;
+			} else {
+				rectInfo.left  = ((val>>16) & 0xFFFF);
+				rectInfo.right = pArg->outWidth - (val&0xFFFF);
+			}
+
+			if (val2 == (unsigned int)-1 || val2 == 0) {
+				rectInfo.top    = 0;
+				rectInfo.bottom = pArg->outHeight;
+			} else {
+				rectInfo.top    = ((val2>>16) & 0xFFFF);
+				rectInfo.bottom	= pArg->outHeight -
+					(val2&0xFFFF);
+			}
+		}
+
+		pArg->outRect.left   = rectInfo.left;
+		pArg->outRect.top    = rectInfo.top;
+		pArg->outRect.right  = rectInfo.right;
+		pArg->outRect.bottom = rectInfo.bottom;
+	}
+
+	val = VpuReadReg(RET_DEC_PIC_TYPE);
+	pArg->isInterace = (val >> 18) & 0x1;
+
+	if (pInst->codecMode == MP2_DEC) {
+		pArg->progressiveFrame  = (val >> 23) & 0x0003;
+		pArg->isInterace = (pArg->progressiveFrame == 0) ? (1) : (0);
+		pArg->picStructure  = (val >> 19) & 0x0003;
+	}
+
+	if (pArg->isInterace) {
+		pArg->topFieldFirst = (val >> 21) & 0x0001;
+		pArg->picTypeFirst = (val & 0x38) >> 3;
+		pArg->picType  = val & 0x7;
+		pArg->npf = (val >> 15) & 1;
+	} else {
+		pArg->topFieldFirst     = 0;
+		pArg->picTypeFirst   = 6;
+		pArg->picType = val & 0x7;
+	}
+
+	if (pInst->codecMode == AVC_DEC) {
+		if (val & 0x40) {
+			if (pArg->isInterace) {
+				pArg->picTypeFirst = 6;	/* IDR */
+				pArg->picType = 6;
+			} else {
+				pArg->picType = 6;	/* IDR */
+			}
+		}
+	}
+
+	pArg->fRateNumerator = VpuReadReg(RET_DEC_PIC_FRATE_NR);
+	pArg->fRateDenominator  = VpuReadReg(RET_DEC_PIC_FRATE_DR);
+	if (pInst->codecMode == AVC_DEC && pArg->fRateDenominator > 0)
+		pArg->fRateDenominator  *= 2;
+	if (pInst->codecMode == MP4_DEC) {
+		pArg->mp4ModuloTimeBase =
+			VpuReadReg(RET_DEC_PIC_MODULO_TIME_BASE);
+		pArg->mp4TimeIncrement =
+			VpuReadReg(RET_DEC_PIC_VOP_TIME_INCREMENT);
+	}
+
+	if (pInst->codecMode == VPX_DEC)
+		pArg->aspectRateInfo = 0;
+	else
+		pArg->aspectRateInfo = VpuReadReg(RET_DEC_PIC_ASPECT);
+
+	pArg->numOfErrMBs = VpuReadReg(RET_DEC_PIC_ERR_MB);
+	val = VpuReadReg(RET_DEC_PIC_SUCCESS);
+	pArg->isSuccess	= val;
+	pArg->sequenceChanged = ((val>>20) & 0x1);
+
+	if (pInst->codecMode == VC1_DEC && pArg->indexFrameDisplay != -3) {
+		if (pInfo->vc1BframeDisplayValid == 0) {
+			if (pArg->picType == 2)
+				pArg->indexFrameDisplay = -3;
+			else
+				pInfo->vc1BframeDisplayValid = 1;
+		}
+	}
+
+	if (pInfo->codecStd == CODEC_STD_VC1)
+		pArg->multiRes = (VpuReadReg(RET_DEC_PIC_POST) >> 1) & 3;
+
+	pInfo->readPos = VpuReadReg(pInfo->streamRdPtrRegAddr);
+	pInfo->frameDisplayFlag = VpuReadReg(pInfo->frameDisplayFlagRegAddr);
+
+	pInfo->bytePosFrameStart = VpuReadReg(BIT_BYTE_POS_FRAME_START);
+	pInfo->bytePosFrameEnd = VpuReadReg(BIT_BYTE_POS_FRAME_END);
+
+	pArg->strmReadPos = pInfo->readPos  - pInfo->strmBufPhyAddr;
+	pArg->strmWritePos = pInfo->writePos - pInfo->strmBufPhyAddr;
+
+	return VPU_RET_OK;
+}
+
+static int VPU_DecStartOneFrameCommand(struct nx_vpu_codec_inst
+	*pInst, struct vpu_dec_frame_arg *pArg)
+{
+	struct vpu_dec_info *pInfo = &pInst->codecInfo.decInfo;
+	unsigned int val, reason = 0;
+
+	if (pInfo->needMoreFrame) {
+		pInfo->needMoreFrame = 0;
+		VpuWriteReg(pInfo->streamWrPtrRegAddr, pInfo->writePos);
+		NX_DbgMsg(INFO_MSG, ("Need More Buffer!!!!!\n"));
+		goto WAIT_INTERRUPT;
+	}
+
+	VpuWriteReg(RET_DEC_PIC_CROP_LEFT_RIGHT, 0);
+	VpuWriteReg(RET_DEC_PIC_CROP_TOP_BOTTOM, 0);
+
+	VpuWriteReg(GDI_TILEDBUF_BASE, 0);
+
+	if ((pInfo->enableMp4Deblock & 2) &&
+		((pInfo->codecStd == CODEC_STD_MPEG4) ||
+		(pInfo->codecStd == CODEC_STD_MPEG2) ||
+		(pInfo->codecStd == CODEC_STD_H263) ||
+		(pInfo->codecStd == CODEC_STD_DIV3)))
+		VpuWriteReg(CMD_DEC_PIC_ROT_MODE, 1 << 5);
+	else
+		VpuWriteReg(CMD_DEC_PIC_ROT_MODE, 0);
+
+	if (pInfo->userDataEnable) {
+		VpuWriteReg(CMD_DEC_PIC_USER_DATA_BASE_ADDR,
+			pInfo->userDataBufPhyAddr);
+		VpuWriteReg(CMD_DEC_PIC_USER_DATA_BUF_SIZE,
+			pInfo->userDataBufSize);
+	} else {
+		VpuWriteReg(CMD_DEC_PIC_USER_DATA_BASE_ADDR, 0);
+		VpuWriteReg(CMD_DEC_PIC_USER_DATA_BUF_SIZE, 0);
+	}
+
+	val = 0;
+	/* if iframeSearch is Enable, other bit is ignore; */
+	if (pArg->iFrameSearchEnable != 0) {
+		val |= (pInfo->userDataReportMode << 10);
+		if (pInst->codecMode == AVC_DEC) {
+			if (pArg->iFrameSearchEnable == 1)
+				val |= (1 << 11) | (1 << 2);
+			else if (pArg->iFrameSearchEnable == 2)
+				val |= (1 << 2);
+		} else {
+			val |= ((pArg->iFrameSearchEnable & 0x1) << 2);
+		}
+	} else {
+		val |= (pInfo->userDataReportMode	<< 10);
+		if (!pArg->skipFrameMode)
+			val |= (pInfo->userDataEnable << 5);
+		val |= (pArg->skipFrameMode << 3);
+	}
+
+	if (pInst->codecMode == AVC_DEC && pInfo->low_delay_info.lowDelayEn)
+		val |= (pInfo->low_delay_info.lowDelayEn << 18);
+
+	VpuWriteReg(CMD_DEC_PIC_OPTION, val);
+
+	if (pInfo->low_delay_info.lowDelayEn)
+		VpuWriteReg(CMD_DEC_PIC_NUM_ROWS,
+			pInfo->low_delay_info.numRows);
+	else
+		VpuWriteReg(CMD_DEC_PIC_NUM_ROWS, 0);
+
+	val = 0;
+	val = (
+		(pInfo->sec_axi_info.useBitEnable&0x01)<<0 |
+		(pInfo->sec_axi_info.useIpEnable&0x01)<<1 |
+		(pInfo->sec_axi_info.useDbkYEnable&0x01)<<2 |
+		(pInfo->sec_axi_info.useDbkCEnable&0x01)<<3 |
+		(pInfo->sec_axi_info.useOvlEnable&0x01)<<4 |
+		(pInfo->sec_axi_info.useBtpEnable&0x01)<<5 |
+		(pInfo->sec_axi_info.useBitEnable&0x01)<<8 |
+		(pInfo->sec_axi_info.useIpEnable&0x01)<<9 |
+		(pInfo->sec_axi_info.useDbkYEnable&0x01)<<10 |
+		(pInfo->sec_axi_info.useDbkCEnable&0x01)<<11 |
+		(pInfo->sec_axi_info.useOvlEnable&0x01)<<12 |
+		(pInfo->sec_axi_info.useBtpEnable&0x01)<<13);
+
+	VpuWriteReg(BIT_AXI_SRAM_USE, val);
+
+	VpuWriteReg(pInfo->streamWrPtrRegAddr, pInfo->writePos);
+	VpuWriteReg(pInfo->streamRdPtrRegAddr, pInfo->readPos);
+
+	val = pInfo->frameDisplayFlag;
+	val &= ~pInfo->clearDisplayIndexes;
+	VpuWriteReg(pInfo->frameDisplayFlagRegAddr, val);
+	pInfo->clearDisplayIndexes = 0;
+
+	if (pArg->eos)
+		pInfo->streamEndflag |= 1<<2;
+	else
+		pInfo->streamEndflag &= ~(1<<2);
+
+	pInfo->streamEndflag &= ~(3<<3);
+	if (pInfo->bitStreamMode == BS_MODE_ROLLBACK)
+		pInfo->streamEndflag |= (1<<3);
+	else if (pInfo->bitStreamMode == BS_MODE_PIC_END)
+		pInfo->streamEndflag |= (2<<3);
+
+	VpuWriteReg(BIT_BIT_STREAM_PARAM, pInfo->streamEndflag);
+
+	val = 0;
+	val |= (pInfo->bwbEnable<<12);
+	val |= ((pInfo->cbcrInterleave)<<2);
+	/* val |= pInfo->frameEndian; */
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, val);
+
+	val = pInfo->streamEndian;
+	VpuWriteReg(BIT_BIT_STREAM_CTRL, val);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[DEC_FRAME]\n"));
+		for (reg = 0x180 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	VpuBitIssueCommand(pInst, PIC_RUN);
+
+WAIT_INTERRUPT:
+	reason = VPU_WaitBitInterrupt(pInst->devHandle, VPU_DEC_TIMEOUT);
+	if (!reason) {
+		NX_ErrMsg(("VPU_DecStartOneFrameCommand() Fail. Timeout(%d)\n",
+			VPU_BUSY_CHECK_TIMEOUT));
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	if (reason & (1<<VPU_INT_BIT_PIC_RUN)) {
+		return VPU_RET_OK;
+	} else if (reason &  (1<<VPU_INT_BIT_BIT_BUF_EMPTY)) {
+		pInfo->needMoreFrame = 1;
+		return VPU_RET_NEED_STREAM;
+	} else {
+		return VPU_RET_ERROR;
+	}
+}
+
+static int VPU_DecCloseCommand(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present)
+{
+	FUNC_IN();
+	if (pInst->isInitialized) {
+		VpuBitIssueCommand(pInst, SEQ_END);
+		if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+			BIT_BUSY_FLAG)) {
+			VpuWriteReg(BIT_INT_CLEAR, 0x1);
+			atomic_set((atomic_t *)vpu_event_present, 0);
+			NX_ErrMsg(("VPU_DecCloseCommand() Failed!!!\n"));
+			NX_ErrMsg(("Timeout(%d)\n", VPU_BUSY_CHECK_TIMEOUT));
+			VPU_SWReset(SW_RESET_SAFETY);
+			pInst->isInitialized = 0;
+			return VPU_RET_ERR_TIMEOUT;
+		}
+		pInst->isInitialized = 0;
+	}
+
+	VpuWriteReg(BIT_INT_CLEAR, 0x1);
+	atomic_set((atomic_t *)vpu_event_present, 0);
+	FUNC_OUT();
+	return VPU_RET_OK;
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_dec_v4l2.c b/drivers/media/platform/nxp-vpu/nx_vpu_dec_v4l2.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_dec_v4l2.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_dec_v4l2.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,1625 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/videodev2.h>
+#include <linux/videodev2_nxp_media.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/of.h>
+#include <linux/interrupt.h>
+
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-mem2mem.h>
+#include <media/videobuf2-core.h>
+#include <media/videobuf2-dma-contig.h>
+
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/cma.h>
+
+#include "vpu_hw_interface.h"
+#include "nx_vpu_v4l2.h"
+
+
+#define INFO_MSG		0
+
+#define PS_SAVE_SIZE (320 * 1024)
+
+static bool holes_for_nxvideodec;
+module_param(holes_for_nxvideodec, bool, 0644);
+MODULE_PARM_DESC(holes_for_nxvideodec,
+		"run in mode for nxvideodec gstreamer plugin");
+
+static int free_decoder_memory(struct nx_vpu_ctx*);
+
+static int nx_vpu_dec_ctx_ready(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+
+	NX_DbgMsg(INFO_MSG, ("src = %d, dpb = %d\n",
+		ctx->strm_queue_cnt, dec_ctx->dpb_queue_cnt));
+	switch( dec_ctx->state ) {
+	case NX_VPUDEC_SET_FRAMEBUF:
+		/* we need all buffers to configure VPU rotator */
+		return ctx->vq_img.start_streaming_called &&
+			dec_ctx->dpb_queue_cnt >= dec_ctx->declaredFrameBufferCnt;
+	case NX_VPUDEC_RUNNING:
+		dec_ctx->delay_frm = 1;
+		/* VPU refuses to decode slice when lacks at least two buffers from
+		 * the reported minimum */
+		return ctx->strm_queue_cnt > 0 &&
+			dec_ctx->dpb_queue_cnt >= dec_ctx->minFrameBufCnt - 1;
+	default:
+		return 0;
+	}
+}
+
+/*-----------------------------------------------------------------------------
+ *      functions for Parameter controls
+ *----------------------------------------------------------------------------*/
+static struct v4l2_queryctrl controls[] = {
+	{
+		.id = V4L2_CID_MPEG_VIDEO_THUMBNAIL_MODE,
+		.type = V4L2_CTRL_TYPE_BOOLEAN,
+		.name = "Enable thumbnail",
+		.minimum = 0,
+		.maximum = 1,
+		.step = 1,
+		.default_value = 0,
+	},
+};
+#define NUM_CTRLS ARRAY_SIZE(controls)
+
+static struct v4l2_queryctrl *get_ctrl(int id)
+{
+	int i;
+
+	FUNC_IN();
+
+	for (i = 0; i < NUM_CTRLS; ++i)
+		if (id == controls[i].id)
+			return &controls[i];
+	return NULL;
+}
+
+static int check_ctrl_val(struct nx_vpu_ctx *ctx, struct v4l2_control *ctrl)
+{
+	struct v4l2_queryctrl *c;
+
+	FUNC_IN();
+
+	c = get_ctrl(ctrl->id);
+	if (!c)
+		return -EINVAL;
+	if (ctrl->value < c->minimum || ctrl->value > c->maximum
+	    || (c->step != 0 && ctrl->value % c->step != 0)) {
+		NX_ErrMsg(("Invalid control value\n"));
+		NX_ErrMsg(("value = %d, min = %d, max = %d, step = %d\n",
+			ctrl->value, c->minimum, c->maximum, c->step));
+		return -ERANGE;
+	}
+
+	return 0;
+}
+/* -------------------------------------------------------------------------- */
+
+
+/*-----------------------------------------------------------------------------
+ *      functions for vidioc_queryctrl
+ *----------------------------------------------------------------------------*/
+static void fill_fmt_width_height(struct v4l2_format *f,
+		const struct nx_vpu_image_fmt *fmt,
+		unsigned width, unsigned height)
+{
+	struct v4l2_pix_format *pix = &f->fmt.pix;
+	unsigned bytesperline;
+
+	pix->width = width;
+	pix->height = height;
+
+	bytesperline = ALIGN(width, 8);
+	pix->bytesperline = bytesperline;
+	pix->sizeimage = bytesperline * pix->height;
+	if( fmt->hsub )
+		pix->sizeimage += 2 * bytesperline / fmt->hsub * pix->height / fmt->vsub;
+}
+
+static void fill_fmt_width_height_mplane(struct v4l2_format *f,
+		const struct nx_vpu_image_fmt *fmt,
+		unsigned width, unsigned height)
+{
+	struct v4l2_pix_format_mplane *pix_mp = &f->fmt.pix_mp;
+	unsigned bytesperline;
+
+	pix_mp->width = width;
+	pix_mp->height = height;
+
+	bytesperline = ALIGN(width, 8);
+	pix_mp->plane_fmt[0].bytesperline = bytesperline;
+	pix_mp->plane_fmt[0].sizeimage = bytesperline * pix_mp->height;
+	switch( pix_mp->num_planes ) {
+	case 1:
+		if( fmt->hsub ) {
+			pix_mp->plane_fmt[0].sizeimage +=
+				2 * bytesperline / fmt->hsub * pix_mp->height / fmt->vsub;
+		}
+		break;
+	case 2:
+		pix_mp->plane_fmt[1].bytesperline = bytesperline / fmt->hsub;
+		pix_mp->plane_fmt[1].sizeimage =
+			2 * bytesperline / fmt->hsub * pix_mp->height / fmt->vsub;
+		break;
+	default:	// 3
+		pix_mp->plane_fmt[1].bytesperline =
+			pix_mp->plane_fmt[2].bytesperline = bytesperline / fmt->hsub;
+		pix_mp->plane_fmt[1].sizeimage = pix_mp->plane_fmt[2].sizeimage =
+			bytesperline / fmt->hsub * pix_mp->height / fmt->vsub;
+		break;
+	}
+}
+
+static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format *pix = &f->fmt.pix;
+
+	FUNC_IN();
+
+	if( ctx->img_fmt == NULL || ctx->width == 0 || ctx->height == 0 ||
+			ctx->codec.dec.minFrameBufCnt == 0 )
+	{
+			NX_ErrMsg(("There is not cfg information!!"));
+			return -EINVAL;
+	}
+
+	pix->pixelformat = ctx->img_fmt->fourcc;
+	pix->field = ctx->codec.dec.interlace_flg[0];
+	fill_fmt_width_height(f, ctx->img_fmt, ctx->width, ctx->height);
+
+	NX_DbgMsg(INFO_MSG, ("vidioc_g_fmt_vid_cap: W = %d, H = %d\n",
+		pix->width, pix->height));
+
+	return 0;
+}
+
+static int vidioc_g_fmt_vid_cap_mplane(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format_mplane *pix_mp = &f->fmt.pix_mp;
+
+	FUNC_IN();
+
+	if( ctx->img_fmt == NULL || ctx->width == 0 || ctx->height == 0 ||
+			ctx->codec.dec.minFrameBufCnt == 0 )
+	{
+			NX_ErrMsg(("There is not cfg information!!"));
+			return -EINVAL;
+	}
+
+	pix_mp->num_planes = ctx->useSingleBuf || ctx->img_fmt->hsub == 0 ? 1 :
+		ctx->img_fmt->chromaInterleave ? 2 : 3;
+	pix_mp->pixelformat = ctx->img_fmt->fourcc;
+	pix_mp->field = ctx->codec.dec.interlace_flg[0];
+	fill_fmt_width_height_mplane(f, ctx->img_fmt, ctx->width, ctx->height);
+
+	/* TBD. Patch for fedora */
+	if (7 == sizeof(pix_mp->reserved)) {
+		pix_mp->reserved[0] = (__u8)ctx->codec.dec.minFrameBufCnt;
+		pix_mp->reserved[1] = (__u8)ctx->codec.dec.minFrameBufCnt;
+	} else if (8 == sizeof(pix_mp->reserved)) {
+		pix_mp->reserved[1] = (__u8)ctx->codec.dec.minFrameBufCnt;
+		pix_mp->reserved[2] = (__u8)ctx->codec.dec.minFrameBufCnt;
+	}
+
+	NX_DbgMsg(INFO_MSG, ("vidioc_g_fmt_vid_cap_mplane : W = %d, H = %d\n",
+		pix_mp->width, pix_mp->height));
+
+	return 0;
+}
+
+static int vidioc_g_fmt_vid_out(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format *pix = &f->fmt.pix;
+
+	FUNC_IN();
+
+	NX_DbgMsg(INFO_MSG, ("f->type = %d\n", f->type));
+
+	pix->width = 0;
+	pix->height = 0;
+	pix->field = V4L2_FIELD_NONE;
+	pix->bytesperline = ctx->strm_buf_size;
+	pix->sizeimage = ctx->strm_buf_size;
+	pix->pixelformat = ctx->strm_fmt->fourcc;
+
+	return 0;
+}
+
+static int vidioc_g_fmt_vid_out_mplane(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format_mplane *pix_mp = &f->fmt.pix_mp;
+
+	FUNC_IN();
+
+	NX_DbgMsg(INFO_MSG, ("f->type = %d\n", f->type));
+
+	pix_mp->width = 0;
+	pix_mp->height = 0;
+	pix_mp->field = V4L2_FIELD_NONE;
+	pix_mp->plane_fmt[0].bytesperline = ctx->strm_buf_size;
+	pix_mp->plane_fmt[0].sizeimage = ctx->strm_buf_size;
+	pix_mp->pixelformat = ctx->strm_fmt->fourcc;
+	pix_mp->num_planes = 1;
+
+	return 0;
+}
+
+static int nx_vidioc_try_cap_fmt(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format *pix_fmt = &f->fmt.pix;
+	const struct nx_vpu_image_fmt *fmt;
+
+	FUNC_IN();
+
+	fmt = nx_find_image_format(f->fmt.pix.pixelformat);
+	if (!fmt) {
+		NX_ErrMsg(("capture format %x not found\n",
+			pix_fmt->pixelformat));
+		return -EINVAL;
+	}
+	if( ! fmt->singleBuffer ) {
+		NX_ErrMsg(("format %.4s is multi-plane, invalid\n",
+			   (const char*)&pix_fmt->pixelformat));
+		return -EINVAL;
+	}
+
+	pix_fmt->field = ctx->codec.dec.interlace_flg[0];
+	fill_fmt_width_height(f, fmt, ctx->width, ctx->height);
+	return 0;
+}
+
+static int nx_vidioc_try_cap_fmt_mplane(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+	const struct nx_vpu_image_fmt *fmt;
+
+	FUNC_IN();
+
+	fmt = nx_find_image_format(f->fmt.pix_mp.pixelformat);
+	if (!fmt) {
+		NX_ErrMsg(("capture format %x not found\n",
+			pix_fmt_mp->pixelformat));
+		return -EINVAL;
+	}
+
+	/* num_planes equal to 1 means user proposes to store all planes
+	 * in single buffer */
+	if( pix_fmt_mp->num_planes != 1 )
+		pix_fmt_mp->num_planes = fmt->singleBuffer ? 1 :
+			fmt->chromaInterleave ? 2 : 3;
+	pix_fmt_mp->field = ctx->codec.dec.interlace_flg[0];
+	fill_fmt_width_height_mplane(f, fmt, ctx->width, ctx->height);
+	return 0;
+}
+
+static int nx_vidioc_try_out_fmt(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct v4l2_pix_format *pix_fmt = &f->fmt.pix;
+	const struct nx_vpu_stream_fmt *fmt;
+
+	FUNC_IN();
+
+	fmt = nx_find_stream_format(f);
+	if (!fmt) {
+		NX_ErrMsg(("out format %x not found\n", pix_fmt->pixelformat));
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int nx_vidioc_try_out_fmt_mplane(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+	const struct nx_vpu_stream_fmt *fmt;
+
+	FUNC_IN();
+
+	fmt = nx_find_stream_format(f);
+	if (!fmt) {
+		NX_ErrMsg(("out format %x not found\n",
+			pix_fmt_mp->pixelformat));
+		return -EINVAL;
+	}
+	pix_fmt_mp->num_planes = 1;
+	return 0;
+}
+
+static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	const struct nx_vpu_image_fmt *img_fmt;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if (ctx->vq_img.streaming) {
+		NX_ErrMsg(("%s queue busy\n", __func__));
+		return -EBUSY;
+	}
+
+	ret = nx_vidioc_try_cap_fmt(file, priv, f);
+	if (ret)
+		return ret;
+
+	img_fmt = nx_find_image_format(f->fmt.pix.pixelformat);
+
+	ctx->img_fmt = img_fmt;
+	ctx->useSingleBuf = true;
+
+	if( img_fmt->hsub ) {
+		ctx->buf_c_width = ctx->buf_y_width / img_fmt->hsub;
+		ctx->chroma_size = ctx->buf_c_width * ctx->buf_height / img_fmt->vsub;
+	}else{
+		ctx->buf_c_width = 0;
+		ctx->chroma_size = 0;
+	}
+	ctx->chromaInterleave = img_fmt->chromaInterleave;
+
+	return 0;
+}
+
+static int vidioc_s_fmt_vid_cap_mplane(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+	const struct nx_vpu_image_fmt *img_fmt;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if (ctx->vq_img.streaming) {
+		NX_ErrMsg(("%s queue busy\n", __func__));
+		return -EBUSY;
+	}
+
+	ret = nx_vidioc_try_cap_fmt_mplane(file, priv, f);
+	if (ret)
+		return ret;
+
+	img_fmt = nx_find_image_format(f->fmt.pix_mp.pixelformat);
+
+	ctx->img_fmt = img_fmt;
+	ctx->useSingleBuf = pix_fmt_mp->num_planes == 1;
+
+	if( img_fmt->hsub ) {
+		ctx->buf_c_width = ctx->buf_y_width / img_fmt->hsub;
+		ctx->chroma_size = ctx->buf_c_width * ctx->buf_height / img_fmt->vsub;
+	}else{
+		ctx->buf_c_width = 0;
+		ctx->chroma_size = 0;
+	}
+	ctx->chromaInterleave = img_fmt->chromaInterleave;
+
+	return 0;
+}
+
+static int vidioc_s_fmt_vid_out(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = 0;
+	struct v4l2_pix_format *pix_fmt = &f->fmt.pix;
+
+	FUNC_IN();
+
+	if (ctx->vq_strm.streaming) {
+		NX_ErrMsg(("%s queue busy\n", __func__));
+		return -EBUSY;
+	}
+
+	ret = nx_vidioc_try_out_fmt(file, priv, f);
+	if (ret)
+		return ret;
+
+	ctx->strm_fmt = nx_find_stream_format(f);
+	ctx->width = pix_fmt->width;
+	ctx->height = pix_fmt->height;
+
+	if (pix_fmt->sizeimage)
+		ctx->strm_buf_size = pix_fmt->sizeimage;
+	return ret;
+}
+
+static int vidioc_s_fmt_vid_out_mplane(struct file *file, void *priv,
+	struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = 0;
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+
+	FUNC_IN();
+
+	if (ctx->vq_strm.streaming) {
+		NX_ErrMsg(("%s queue busy\n", __func__));
+		return -EBUSY;
+	}
+
+	ret = nx_vidioc_try_out_fmt_mplane(file, priv, f);
+	if (ret)
+		return ret;
+
+	ctx->strm_fmt = nx_find_stream_format(f);
+	ctx->width = pix_fmt_mp->width;
+	ctx->height = pix_fmt_mp->height;
+
+	if (pix_fmt_mp->plane_fmt[0].sizeimage)
+		ctx->strm_buf_size = pix_fmt_mp->plane_fmt[0].sizeimage;
+	return ret;
+}
+
+static int vidioc_reqbufs(struct file *file, void *priv,
+	struct v4l2_requestbuffers *reqbufs)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret;
+
+	if (reqbufs->type == ctx->vq_strm.type ) {
+		ret = vb2_reqbufs(&ctx->vq_strm, reqbufs);
+	} else if (reqbufs->type == ctx->vq_img.type ) {
+		ret = vb2_reqbufs(&ctx->vq_img, reqbufs);
+	} else {
+		ret = -EINVAL;
+	}
+	return ret;
+}
+
+static int handle_end_of_stream(struct nx_vpu_ctx *ctx)
+{
+	int ret;
+
+	ret = nx_vpu_dec_try_cmd(ctx, DEC_BUF_FLUSH);
+
+	return ret;
+}
+
+static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+
+	if (buf->type == ctx->vq_strm.type) {
+		unsigned bytesused = buf->type == V4L2_BUF_TYPE_VIDEO_OUTPUT ?
+			buf->bytesused : buf->m.planes[0].bytesused;
+		if( bytesused == 0 && ctx->codec.dec.state != NX_VPUDEC_CLOSED ) {
+			return handle_end_of_stream(ctx);
+		} else {
+			return vb2_qbuf(&ctx->vq_strm, buf);
+		}
+	} else {
+		return vb2_qbuf(&ctx->vq_img, buf);
+	}
+}
+
+static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret;
+
+	FUNC_IN();
+
+	if (buf->type == ctx->vq_strm.type ) {
+		ret = vb2_dqbuf(&ctx->vq_strm, buf, file->f_flags & O_NONBLOCK);
+	} else {
+		if ( !holes_for_nxvideodec || ctx->codec.dec.delay_frm == 0) {
+			ret = vb2_dqbuf(&ctx->vq_img, buf, file->f_flags &
+				O_NONBLOCK);
+		} else if (ctx->codec.dec.delay_frm == 1) {
+			buf->index = -3;
+			ret = 0;
+		} else {
+			buf->index = -1;
+			ret = 0;
+		}
+	}
+
+	return ret;
+}
+
+static int vidioc_g_crop(struct file *file, void *priv, struct v4l2_crop *cr)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+
+	FUNC_IN();
+
+	cr->c.left = dec_ctx->crop_left;
+	cr->c.top = dec_ctx->crop_top;
+	cr->c.width = dec_ctx->crop_right - dec_ctx->crop_left;
+	cr->c.height = dec_ctx->crop_bot - dec_ctx->crop_top;
+
+	return 0;
+}
+
+/* Query a ctrl */
+static int vidioc_queryctrl(struct file *file, void *priv, struct v4l2_queryctrl
+	*qc)
+{
+	struct v4l2_queryctrl *ctrl;
+
+	FUNC_IN();
+	ctrl = get_ctrl(qc->id);
+	if( ctrl == NULL )
+		return -EINVAL;
+	*qc = *ctrl;
+	return 0;
+}
+
+static int vidioc_g_ctrl(struct file *file, void *priv, struct v4l2_control
+	*ctrl)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+
+	FUNC_IN();
+	if (ctrl->id == V4L2_CID_MPEG_VIDEO_THUMBNAIL_MODE) {
+		ctrl->value = ctx->codec.dec.thumbnailMode;
+	} else {
+		NX_DbgMsg(INFO_MSG, ("unsupported control id=0x%x\n", ctrl->id));
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int vidioc_s_ctrl(struct file *file, void *priv, struct v4l2_control
+	*ctrl)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = 0;
+
+	FUNC_IN();
+
+	ret = check_ctrl_val(ctx, ctrl);
+	if (ret != 0)
+		return ret;
+
+	if (ctrl->id == V4L2_CID_MPEG_VIDEO_THUMBNAIL_MODE) {
+		ctx->codec.dec.thumbnailMode = ctrl->value;
+	} else {
+		NX_ErrMsg(("Invalid control(ID = %x)\n", ctrl->id));
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+static int vidioc_g_ext_ctrls(struct file *file, void *priv,
+	struct v4l2_ext_controls *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	unsigned i;
+
+	FUNC_IN();
+	for(i = 0; i < f->count; ++i) {
+		if (f->controls[i].id == V4L2_CID_MPEG_VIDEO_THUMBNAIL_MODE) {
+			f->controls[i].value = ctx->codec.dec.thumbnailMode;
+		} else {
+			NX_ErrMsg(("Invalid control(ID = %x)\n", f->controls[i].id));
+			return -EINVAL;
+		}
+	}
+	return 0;
+}
+
+static int nx_vidioc_expbuf(struct file *file, void *fh,
+			     struct v4l2_exportbuffer *e)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	if( e->type == ctx->vq_strm.type ) {
+		return vb2_expbuf(&ctx->vq_strm, e);
+	}else if( e->type == ctx->vq_img.type ) {
+		return vb2_expbuf(&ctx->vq_img, e);
+	}else{
+		pr_err("nx_vidioc_expbuf: bad buffer type %d\n", e->type);
+		return -EINVAL;
+	}
+}
+
+static int nx_vidioc_try_decoder_cmd(struct file *file, void *fh,
+				      struct v4l2_decoder_cmd *a)
+{
+	if( a->cmd == V4L2_DEC_CMD_STOP )
+		return 0;
+	return -EINVAL;
+}
+
+static int nx_vidioc_decoder_cmd(struct file *file, void *fh,
+				  struct v4l2_decoder_cmd *a)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+
+	if( a->cmd != V4L2_DEC_CMD_STOP )
+		return -EINVAL;
+	return handle_end_of_stream(ctx);
+}
+
+static const struct v4l2_ioctl_ops nx_vpu_dec_ioctl_ops = {
+	.vidioc_querycap = vidioc_querycap,
+	.vidioc_enum_fmt_vid_cap = nx_vidioc_enum_fmt_vid_image,
+	.vidioc_enum_fmt_vid_out = nx_vidioc_enum_fmt_vid_stream,
+	.vidioc_enum_framesizes			= nx_vidioc_enum_framesizes,
+	.vidioc_g_fmt_vid_cap			= vidioc_g_fmt_vid_cap,
+	.vidioc_g_fmt_vid_out			= vidioc_g_fmt_vid_out,
+	.vidioc_try_fmt_vid_cap			= nx_vidioc_try_cap_fmt,
+	.vidioc_try_fmt_vid_out			= nx_vidioc_try_out_fmt,
+	.vidioc_s_fmt_vid_cap			= vidioc_s_fmt_vid_cap,
+	.vidioc_s_fmt_vid_out			= vidioc_s_fmt_vid_out,
+	.vidioc_reqbufs = vidioc_reqbufs,
+	.vidioc_querybuf = nx_vpu_vidioc_querybuf,
+	.vidioc_qbuf = vidioc_qbuf,
+	.vidioc_dqbuf = vidioc_dqbuf,
+	.vidioc_streamon = nx_vpu_vidioc_streamon,
+	.vidioc_streamoff = nx_vpu_vidioc_streamoff,
+	.vidioc_queryctrl = vidioc_queryctrl,
+	.vidioc_g_ctrl = vidioc_g_ctrl,
+	.vidioc_s_ctrl = vidioc_s_ctrl,
+	.vidioc_g_crop = vidioc_g_crop,
+	.vidioc_g_ext_ctrls = vidioc_g_ext_ctrls,
+	.vidioc_expbuf = nx_vidioc_expbuf,
+	.vidioc_try_decoder_cmd	= nx_vidioc_try_decoder_cmd,
+	.vidioc_decoder_cmd = nx_vidioc_decoder_cmd,
+};
+
+static const struct v4l2_ioctl_ops nx_vpu_dec_ioctl_ops_mplane = {
+	.vidioc_querycap = vidioc_querycap,
+	.vidioc_enum_fmt_vid_cap_mplane = nx_vidioc_enum_fmt_vid_image_mplane,
+	.vidioc_enum_fmt_vid_out_mplane = nx_vidioc_enum_fmt_vid_stream_mplane,
+	.vidioc_enum_framesizes			= nx_vidioc_enum_framesizes,
+	.vidioc_g_fmt_vid_cap_mplane = vidioc_g_fmt_vid_cap_mplane,
+	.vidioc_g_fmt_vid_out_mplane = vidioc_g_fmt_vid_out_mplane,
+	.vidioc_try_fmt_vid_cap_mplane = nx_vidioc_try_cap_fmt_mplane,
+	.vidioc_try_fmt_vid_out_mplane = nx_vidioc_try_out_fmt_mplane,
+	.vidioc_s_fmt_vid_cap_mplane = vidioc_s_fmt_vid_cap_mplane,
+	.vidioc_s_fmt_vid_out_mplane = vidioc_s_fmt_vid_out_mplane,
+	.vidioc_reqbufs = vidioc_reqbufs,
+	.vidioc_querybuf = nx_vpu_vidioc_querybuf,
+	.vidioc_qbuf = vidioc_qbuf,
+	.vidioc_dqbuf = vidioc_dqbuf,
+	.vidioc_streamon = nx_vpu_vidioc_streamon,
+	.vidioc_streamoff = nx_vpu_vidioc_streamoff,
+	.vidioc_queryctrl = vidioc_queryctrl,
+	.vidioc_g_ctrl = vidioc_g_ctrl,
+	.vidioc_s_ctrl = vidioc_s_ctrl,
+	.vidioc_g_crop = vidioc_g_crop,
+	.vidioc_g_ext_ctrls = vidioc_g_ext_ctrls,
+	.vidioc_expbuf = nx_vidioc_expbuf,
+	.vidioc_try_decoder_cmd	= nx_vidioc_try_decoder_cmd,
+	.vidioc_decoder_cmd = nx_vidioc_decoder_cmd,
+};
+
+/* -------------------------------------------------------------------------- */
+
+
+static void cleanup_dpb_queue(struct nx_vpu_ctx *ctx,
+		enum vb2_buffer_state state)
+{
+	struct nx_vpu_buf *buf;
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	int i, j;
+
+	for(i = 0; i < dec_ctx->frame_buffer_cnt; ++i) {
+		if( (buf = dec_ctx->dpb_bufs[i]) != NULL ) {
+			for( j = 0; j < buf->vb.num_planes; ++j )
+				vb2_set_plane_payload(&buf->vb, j, 0);
+			vb2_buffer_done(&buf->vb, state);
+			dec_ctx->dpb_bufs[i] = NULL;
+		}
+	}
+	dec_ctx->dpb_queue_cnt = 0;
+}
+
+static int nx_vpu_dec_start_streaming(struct vb2_queue *q, unsigned int count)
+{
+	unsigned long flags;
+	struct nx_vpu_ctx *ctx = q->drv_priv;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if( q->type == ctx->vq_strm.type ) {
+		ret = nx_vpu_dec_try_cmd(ctx, GET_DEC_INSTANCE);
+		if( ret ) {
+			spin_lock_irqsave(&ctx->dev->irqlock, flags);
+			nx_vpu_cleanup_queue(&ctx->strm_queue, &ctx->vq_strm,
+					VB2_BUF_STATE_QUEUED);
+			INIT_LIST_HEAD(&ctx->strm_queue);
+			ctx->strm_queue_cnt = 0;
+			spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
+		}else{
+		   	while( nx_vpu_dec_ctx_ready(ctx) )
+				nx_vpu_dec_try_cmd(ctx, DEC_RUN);
+		}
+	}else if( q->type == ctx->vq_img.type ) {
+		while ( nx_vpu_dec_ctx_ready(ctx) )
+			ret = nx_vpu_dec_try_cmd(ctx, DEC_RUN);
+		if( ret ) {
+			spin_lock_irqsave(&ctx->dev->irqlock, flags);
+			cleanup_dpb_queue(ctx, VB2_BUF_STATE_QUEUED);
+			spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
+		}
+	}
+	return ret;
+}
+
+static void nx_vpu_dec_stop_streaming(struct vb2_queue *q)
+{
+	unsigned long flags;
+	struct nx_vpu_ctx *ctx = q->drv_priv;
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+
+	FUNC_IN();
+
+	nx_vpu_dec_try_cmd(ctx, SEQ_END);
+	if (q->type == ctx->vq_img.type ) {
+		spin_lock_irqsave(&dev->irqlock, flags);
+		cleanup_dpb_queue(ctx, VB2_BUF_STATE_ERROR);
+		spin_unlock_irqrestore(&dev->irqlock, flags);
+	} else if ( q->type == ctx->vq_strm.type ) {
+		spin_lock_irqsave(&dev->irqlock, flags);
+
+		nx_vpu_cleanup_queue(&ctx->strm_queue, &ctx->vq_strm,
+				VB2_BUF_STATE_ERROR);
+		INIT_LIST_HEAD(&ctx->strm_queue);
+		ctx->strm_queue_cnt = 0;
+
+		spin_unlock_irqrestore(&dev->irqlock, flags);
+	}
+}
+
+static void nx_vpu_dec_buf_queue(struct vb2_buffer *vb)
+{
+	struct vb2_queue *vq = vb->vb2_queue;
+	struct nx_vpu_ctx *ctx = vq->drv_priv;
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	unsigned long flags;
+	struct nx_vpu_buf *buf = vb_to_vpu_buf(vb);
+
+	FUNC_IN();
+
+	spin_lock_irqsave(&dev->irqlock, flags);
+
+	if ( vq->type == ctx->vq_strm.type ) {
+		list_add_tail(&buf->list, &ctx->strm_queue);
+		ctx->strm_queue_cnt++;
+	} else if (vq->type == ctx->vq_img.type ) {
+		struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+		unsigned idx;
+		int num_planes = ctx->useSingleBuf || ctx->img_fmt->singleBuffer ? 1 :
+			ctx->img_fmt->chromaInterleave ? 2 : 3;
+		uint32_t phyAddr0 = nx_vpu_mem_plane_addr(vb, 0);
+
+		/* Match buffer by their memory physical address.
+		 * For given buffer index their memory address may change,
+		 * especially for imported DMA buffers */
+		for(idx = 0; idx < dec_ctx->frame_buffer_cnt; ++idx) {
+			if( dec_ctx->phyAddrs.addr[idx][0] == phyAddr0 )
+				break;
+		}
+		if( idx == dec_ctx->frame_buffer_cnt ) {
+			if( dec_ctx->frame_buffer_cnt == VPU_MAX_BUFFERS ) {
+				/* limit reached: old buffers removal not implemented for now
+				 */
+				WARN_ONCE(1, "nxp-vpu: buffer limit reached");
+				vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
+				return;
+			}
+			dec_ctx->phyAddrs.addr[idx][0] = phyAddr0;
+			if( num_planes > 1 ) {
+				dec_ctx->phyAddrs.addr[idx][1] = nx_vpu_mem_plane_addr(vb, 1);
+			} else if (ctx->chroma_size > 0) {
+				dec_ctx->phyAddrs.addr[idx][1] = ctx->luma_size +
+					dec_ctx->phyAddrs.addr[idx][0];
+			}
+
+			if( num_planes > 2 ) {
+				dec_ctx->phyAddrs.addr[idx][2] = nx_vpu_mem_plane_addr(vb, 2);
+			} else if (ctx->chroma_size > 0 && ctx->chromaInterleave == 0) {
+				dec_ctx->phyAddrs.addr[idx][2] = ctx->chroma_size +
+					dec_ctx->phyAddrs.addr[idx][1];
+			}
+			++dec_ctx->frame_buffer_cnt;
+		}
+		if( dec_ctx->dpb_bufs[idx] ) {
+			NX_ErrMsg(("buffer %d has the same payload address as buffer %d\n",
+						buf->vb.index, dec_ctx->dpb_bufs[idx]->vb.index));
+			vb2_buffer_done(&buf->vb, VB2_BUF_STATE_ERROR);
+			return;
+		}
+		dec_ctx->dpb_bufs[idx] = buf;
+		dec_ctx->dpb_queue_cnt++;
+		if( ctx->codec.dec.state != NX_VPUDEC_CLOSED ) {
+			int ret = NX_VpuDecClrDspFlag(ctx->hInst, idx);
+			if (ret != VPU_RET_OK) {
+				NX_ErrMsg(("ClrDspFlag error %d\n", ret));
+			}
+		}
+	} else {
+		NX_ErrMsg(("unsupported buffer type(%d)\n", vq->type));
+		return;
+	}
+
+	spin_unlock_irqrestore(&dev->irqlock, flags);
+
+	if (nx_vpu_dec_ctx_ready(ctx))
+		nx_vpu_dec_try_cmd(ctx, DEC_RUN);
+}
+
+static struct vb2_ops nx_vpu_dec_qops = {
+	.queue_setup            = nx_vpu_queue_setup,
+	.wait_prepare           = nx_vpu_unlock,
+	.wait_finish            = nx_vpu_lock,
+	.buf_prepare            = nx_vpu_buf_prepare,
+	.start_streaming        = nx_vpu_dec_start_streaming,
+	.stop_streaming         = nx_vpu_dec_stop_streaming,
+	.buf_queue              = nx_vpu_dec_buf_queue,
+};
+
+/* -------------------------------------------------------------------------- */
+
+
+const struct v4l2_ioctl_ops *get_dec_ioctl_ops(bool singlePlaneMode)
+{
+	return singlePlaneMode ? &nx_vpu_dec_ioctl_ops :
+		&nx_vpu_dec_ioctl_ops_mplane;
+}
+
+int nx_vpu_dec_open(struct nx_vpu_ctx *ctx, bool singlePlaneMode)
+{
+	int ret = 0;
+
+	FUNC_IN();
+
+	ctx->codec.dec.dpb_queue_cnt = 0;
+
+	/* Init videobuf2 queue for OUTPUT */
+	ctx->vq_strm.type = singlePlaneMode ? V4L2_BUF_TYPE_VIDEO_OUTPUT :
+		V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
+	ctx->vq_strm.drv_priv = ctx;
+	ctx->vq_strm.lock = &ctx->dev->dev_mutex;
+	ctx->vq_strm.buf_struct_size = sizeof(struct nx_vpu_buf);
+	ctx->vq_strm.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
+	ctx->vq_strm.mem_ops = &vb2_dma_contig_memops;
+	/*ctx->vq_strm.allow_zero_byteused = 1; */
+	ctx->vq_strm.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	ctx->vq_strm.ops = &nx_vpu_dec_qops;
+	ctx->vq_strm.dev = &ctx->dev->plat_dev->dev;
+	ret = vb2_queue_init(&ctx->vq_strm);
+	if (ret) {
+		NX_ErrMsg(("Failed to initialize videobuf2 queue(output)\n"));
+		return ret;
+	}
+
+	/* Init videobuf2 queue for CAPTURE */
+	ctx->vq_img.type = singlePlaneMode ? V4L2_BUF_TYPE_VIDEO_CAPTURE :
+		V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
+	ctx->vq_img.drv_priv = ctx;
+	ctx->vq_img.lock = &ctx->dev->dev_mutex;
+	ctx->vq_img.buf_struct_size = sizeof(struct nx_vpu_buf);
+	ctx->vq_img.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
+	ctx->vq_img.mem_ops = &vb2_dma_contig_memops;
+	ctx->vq_img.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	ctx->vq_img.ops = &nx_vpu_dec_qops;
+	ctx->vq_img.dev = &ctx->dev->plat_dev->dev;
+	ret = vb2_queue_init(&ctx->vq_img);
+	if (ret) {
+		NX_ErrMsg(("Failed to initialize videobuf2 queue(capture)\n"));
+		return ret;
+	}
+
+	return 0;
+}
+
+static void decoder_flush_disp_info(struct vpu_dec_ctx *dec_ctx)
+{
+	int32_t i;
+
+	for (i = 0 ; i < VPU_MAX_BUFFERS ; i++) {
+		dec_ctx->timeStamp[i] = 0;
+		dec_ctx->frm_type[i] = -1;
+		dec_ctx->multiResolution[i] = -0;
+		dec_ctx->interlace_flg[i] = -1;
+		dec_ctx->reliable_0_100[i] = 0;
+		dec_ctx->upSampledWidth[i] = 0;
+		dec_ctx->upSampledHeight[i] = 0;
+	}
+}
+
+int vpu_dec_open_instance(struct nx_vpu_ctx *ctx)
+{
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	struct nx_vpu_codec_inst *hInst = 0;
+	struct vpu_open_arg openArg;
+	int workBufSize = WORK_BUF_SIZE;
+	int ret = 0;
+
+	FUNC_IN();
+
+	memset(&openArg, 0, sizeof(openArg));
+
+	switch (ctx->strm_fmt->fourcc) {
+	case V4L2_PIX_FMT_H264:
+		ctx->codec_mode = CODEC_STD_AVC;
+		workBufSize += PS_SAVE_SIZE;
+		break;
+	case V4L2_PIX_FMT_MPEG2:
+		ctx->codec_mode = CODEC_STD_MPEG2;
+		break;
+	case V4L2_PIX_FMT_MPEG4:
+		ctx->codec_mode = CODEC_STD_MPEG4;
+		break;
+	case V4L2_PIX_FMT_XVID:
+		ctx->codec_mode = CODEC_STD_MPEG4;
+		openArg.mp4Class = 2;
+		break;
+	case V4L2_PIX_FMT_DIV4:
+	case V4L2_PIX_FMT_DIVX:
+		ctx->codec_mode = CODEC_STD_MPEG4;
+		openArg.mp4Class = 5;
+		break;
+	case V4L2_PIX_FMT_DIV5:
+	case V4L2_PIX_FMT_DIV6:
+		ctx->codec_mode = CODEC_STD_MPEG4;
+		openArg.mp4Class = 1;
+		break;
+	case V4L2_PIX_FMT_H263:
+		ctx->codec_mode = CODEC_STD_H263;
+		break;
+	case V4L2_PIX_FMT_DIV3:
+		ctx->codec_mode = CODEC_STD_DIV3;
+		break;
+	case V4L2_PIX_FMT_WMV9:
+	case V4L2_PIX_FMT_WVC1:
+		ctx->codec_mode = CODEC_STD_VC1;
+		break;
+	case V4L2_PIX_FMT_RV8:
+	case V4L2_PIX_FMT_RV9:
+		ctx->codec_mode = CODEC_STD_RV;
+		break;
+	case V4L2_PIX_FMT_FLV1:
+		/* Sorenson spark */
+		ctx->codec_mode = CODEC_STD_MPEG4;
+		openArg.mp4Class = 256;
+		break;
+	case V4L2_PIX_FMT_THEORA:
+		ctx->codec_mode = CODEC_STD_THO;
+		break;
+	case V4L2_PIX_FMT_VP8:
+		ctx->codec_mode = CODEC_STD_VP8;
+		break;
+	case V4L2_PIX_FMT_MJPEG:
+		ctx->codec_mode = CODEC_STD_MJPG;
+		break;
+	default:
+		NX_ErrMsg(("Invalid codec type(fourcc = %x)!!!\n",
+			ctx->strm_fmt->fourcc));
+		goto err_exit;
+	}
+	openArg.codecStd = ctx->codec_mode;
+
+	ctx->bit_stream_buf = nx_alloc_memory(&dev->plat_dev->dev,
+		STREAM_BUF_SIZE, 4096);
+	if (ctx->bit_stream_buf == NULL) {
+		NX_ErrMsg(("Bitstream_buf allocation failed.\n"));
+		goto err_exit;
+	}
+
+	ctx->instance_buf = nx_alloc_memory(&dev->plat_dev->dev,
+		workBufSize, 4096);
+	if (ctx->instance_buf == NULL) {
+		NX_ErrMsg(("instance_buf allocation failed.\n"));
+		goto err_exit;
+	}
+
+	if (ctx->codec_mode == CODEC_STD_AVC) {
+		dec_ctx->slice_buf = nx_alloc_memory(&dev->plat_dev->dev,
+				2048 * 2048 * 3 / 4, 4096);
+		if (0 == dec_ctx->slice_buf) {
+			NX_ErrMsg(("slice buf allocation failed(size = %d)\n",
+				2048 * 2048 * 3 / 4));
+			goto err_exit;
+		}
+	}
+
+	if (ctx->codec_mode == CODEC_STD_THO || ctx->codec_mode == CODEC_STD_VP3
+		|| ctx->codec_mode == CODEC_STD_VP8) {
+			dec_ctx->pv_slice_buf = nx_alloc_memory(&dev->plat_dev->dev,
+					17 * 4 * (2048 * 2048 / 256), 4096);
+		if (0 == dec_ctx->pv_slice_buf) {
+			NX_ErrMsg(("slice allocation failed(size=%d)\n",
+				17 * 4 * (2048 * 2048 / 256)));
+			goto err_exit;
+		}
+	}
+
+	openArg.instIndex = ctx->idx;
+	openArg.instanceBuf = *ctx->instance_buf;
+	openArg.streamBuf = *ctx->bit_stream_buf;
+
+	ret = NX_VpuDecOpen(&openArg, dev, &hInst);
+	if ((VPU_RET_OK != ret) || (0 == hInst)) {
+		NX_ErrMsg(("Cannot open VPU Instance!!\n"));
+		NX_ErrMsg(("  codecStd=%d, is_encoder=%d, hInst=%p)\n",
+			openArg.codecStd, openArg.isEncoder, hInst));
+		goto err_exit;
+	}
+
+	decoder_flush_disp_info(&ctx->codec.dec);
+
+	ctx->hInst = (void *)hInst;
+	dev->cur_num_instance++;
+
+	return ret;
+
+err_exit:
+	if (dec_ctx->pv_slice_buf) {
+		nx_free_memory(dec_ctx->pv_slice_buf);
+		dec_ctx->pv_slice_buf = NULL;
+	}
+	if (dec_ctx->slice_buf) {
+		nx_free_memory(dec_ctx->slice_buf);
+		dec_ctx->slice_buf = NULL;
+	}
+	if (ctx->instance_buf) {
+		nx_free_memory(ctx->instance_buf);
+		ctx->instance_buf = NULL;
+	}
+	if (ctx->bit_stream_buf) {
+		nx_free_memory(ctx->bit_stream_buf);
+		ctx->bit_stream_buf = NULL;
+	}
+	return ret;
+}
+
+int vpu_dec_parse_vid_cfg(struct nx_vpu_ctx *ctx, bool singlePlaneMode)
+{
+	int ret;
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	struct vpu_dec_seq_init_arg seqArg;
+	struct nx_vpu_buf *buf;
+	struct vb2_v4l2_buffer *vbuf;
+	unsigned long flags;
+	unsigned fourcc;
+	const struct nx_vpu_image_fmt *img_fmt;
+
+	FUNC_IN();
+
+	if (ctx->hInst == NULL) {
+		NX_ErrMsg(("Err : vpu is not opend\n"));
+		return -EAGAIN;
+	}
+
+	NX_DrvMemset(&seqArg, 0, sizeof(seqArg));
+
+	if (ctx->strm_queue_cnt > 0) {
+		unsigned long phyAddr;
+
+		/*spin_lock_irqsave(&ctx->dev->irqlock, flags);*/
+
+		if (list_empty(&ctx->strm_queue)) {
+			NX_DbgMsg(INFO_MSG, ("No src buffer.\n"));
+			/* spin_unlock_irqrestore(&ctx->dev->irqlock, flags); */
+			return -EAGAIN;
+		}
+
+		buf = list_entry(ctx->strm_queue.next, struct nx_vpu_buf, list);
+		phyAddr = nx_vpu_mem_plane_addr(&buf->vb, 0);
+		seqArg.seqDataSize = buf->vb.planes[0].bytesused;
+
+#ifdef USE_ION_MEMORY
+		{
+			int alignSz;
+
+			alignSz = (seqArg.seqDataSize + 4095) & (~4095);
+			seqArg.seqData = (unsigned char *)cma_get_virt(phyAddr,
+				alignSz, 1);
+		}
+#else
+		seqArg.seqData = (unsigned long)vb2_plane_vaddr(&buf->vb, 0);
+#endif
+
+		/*spin_unlock_irqrestore(&ctx->dev->irqlock, flags);*/
+	} else {
+		return -EAGAIN;
+	}
+
+	seqArg.outWidth = ctx->width;
+	seqArg.outHeight = ctx->height;
+
+	seqArg.thumbnailMode = dec_ctx->thumbnailMode;
+
+	ret = NX_VpuDecSetSeqInfo(ctx->hInst, &seqArg);
+	if (ret != VPU_RET_OK) {
+		NX_ErrMsg(("NX_VpuDecSetSeqInfo() failed.(ErrorCode=%d)\n",
+			ret));
+		return -EINVAL;
+	}
+
+	if (seqArg.minFrameBufCnt < 1 ||
+		seqArg.minFrameBufCnt > VPU_MAX_BUFFERS)
+	{
+		NX_ErrMsg(("Min FrameBufCnt Error(%d)!!!\n",
+			seqArg.minFrameBufCnt));
+		return -EINVAL;
+	}
+
+	ctx->width = seqArg.cropRight;
+	ctx->height = seqArg.cropBottom;
+	dec_ctx->minFrameBufCnt = seqArg.minFrameBufCnt;
+
+	dec_ctx->interlace_flg[0] = (seqArg.interlace == 0) ?
+		(V4L2_FIELD_NONE) : (V4L2_FIELD_INTERLACED);
+	dec_ctx->frame_buf_delay = seqArg.frameBufDelay;
+	ctx->buf_y_width = ALIGN(ctx->width, 8);
+	ctx->buf_height = ctx->height;
+	ctx->luma_size = ctx->buf_y_width * ctx->buf_height;
+
+	switch (seqArg.imgFormat) {
+	case IMG_FORMAT_420:
+		fourcc = singlePlaneMode ? V4L2_PIX_FMT_YUV420 : V4L2_PIX_FMT_YUV420M;
+		break;
+	case IMG_FORMAT_422:
+		fourcc = singlePlaneMode ? V4L2_PIX_FMT_YUV422P : V4L2_PIX_FMT_YUV422M;
+		break;
+	case IMG_FORMAT_444:
+		fourcc = singlePlaneMode ? V4L2_PIX_FMT_YUV444 : V4L2_PIX_FMT_YUV444M;
+		break;
+	case IMG_FORMAT_400:
+		fourcc = V4L2_PIX_FMT_GREY;
+		break;
+	default:
+		NX_ErrMsg(("Image format is not supported!!\n"));
+		return -EINVAL;
+	}
+	img_fmt = nx_find_image_format(fourcc);
+	if( img_fmt == NULL ) {
+		NX_ErrMsg(("internal error: format %.4s not found\n", (char*)&fourcc));
+		return -EINVAL;
+	}
+	if( singlePlaneMode && ! img_fmt->singleBuffer ) {
+		NX_ErrMsg(("internal error: format %.4s is multi-plane\n",
+					(char*)&fourcc));
+		return -EINVAL;
+	}
+	ctx->img_fmt = img_fmt;
+	if( img_fmt->hsub ) {
+		ctx->buf_c_width = ctx->buf_y_width / img_fmt->hsub;
+		ctx->chroma_size = ctx->buf_c_width * ctx->buf_height / img_fmt->vsub;
+	}else{
+		ctx->buf_c_width = 0;
+		ctx->chroma_size = 0;
+	}
+	ctx->chromaInterleave = img_fmt->chromaInterleave;
+
+	dec_ctx->start_Addr = 0;
+	dec_ctx->end_Addr = seqArg.strmReadPos;
+	ctx->strm_size = dec_ctx->end_Addr - dec_ctx->start_Addr;
+
+	dec_ctx->crop_left = seqArg.cropLeft;
+	dec_ctx->crop_right = seqArg.cropRight;
+	dec_ctx->crop_top = seqArg.cropTop;
+	dec_ctx->crop_bot = seqArg.cropBottom;
+
+	NX_DbgMsg(INFO_MSG, ("[PARSE]Min_Buff = %d\n",
+		dec_ctx->minFrameBufCnt));
+
+	spin_lock_irqsave(&ctx->dev->irqlock, flags);
+
+	buf = list_entry(ctx->strm_queue.next, struct nx_vpu_buf, list);
+	vbuf = to_vb2_v4l2_buffer(&buf->vb);
+	list_del(&buf->list);
+	ctx->strm_queue_cnt--;
+
+	buf->vb.planes[0].bytesused = ctx->strm_size;
+	vbuf->field = dec_ctx->interlace_flg[0];
+	vbuf->flags = ctx->codec.dec.frame_buf_delay;
+
+	vb2_buffer_done(&buf->vb, VB2_BUF_STATE_DONE);
+
+	spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
+
+	return ret;
+}
+
+static struct nx_memory_info *alloc_mvbuf(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	int mvSize;
+	void *drv = &ctx->dev->plat_dev->dev;
+
+	mvSize = ALIGN(ctx->width, 32) * ALIGN(ctx->height, 32);
+	mvSize = (mvSize * 3) / 2;
+	mvSize = (mvSize + 4) / 5;
+	mvSize = ((mvSize + 7) / 8) * 8;
+	mvSize = ALIGN(mvSize, 4096);
+
+	if ( mvSize == 0 || dec_ctx->frame_buffer_cnt == 0 ) {
+		NX_ErrMsg(("Invalid memory parameters!!!\n"));
+		NX_ErrMsg(("width=%d, height=%d, mvSize=%d buffer_cnt=%d\n",
+				ctx->width, ctx->height, mvSize, dec_ctx->frame_buffer_cnt));
+		return NULL;
+	}
+	return nx_alloc_memory(drv, mvSize * dec_ctx->frame_buffer_cnt, 4096);
+}
+
+int vpu_dec_init(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	struct vpu_dec_reg_frame_arg frameArg;
+	int ret = 0;
+	struct nx_memory_info *mvbuf = NULL; // new move buf to replace col_mv_buf
+
+	FUNC_IN();
+
+	if (ctx->hInst == NULL) {
+		NX_ErrMsg(("Err : vpu is not opend\n"));
+		return -EAGAIN;
+	}
+	frameArg.chromaInterleave = ctx->chromaInterleave;
+
+	if (ctx->codec_mode != CODEC_STD_MJPG) {
+		mvbuf = alloc_mvbuf(ctx);
+		if( mvbuf == NULL ) {
+			NX_ErrMsg(("Failed to allocate decoder buffers.\n"));
+			return -ENOMEM;
+		}
+
+		if (dec_ctx->slice_buf)
+			frameArg.sliceBuffer = dec_ctx->slice_buf;
+		frameArg.colMvBuffer = mvbuf;
+		if (dec_ctx->pv_slice_buf)
+			frameArg.pvbSliceBuffer = dec_ctx->pv_slice_buf;
+
+		frameArg.sramAddr = ctx->dev->sram_base_addr;
+		frameArg.sramSize = ctx->dev->sram_size;
+	}
+	frameArg.numFrameBuffer = dec_ctx->frame_buffer_cnt;
+	frameArg.strideY =  ctx->buf_y_width;
+	frameArg.phyAddrs = &dec_ctx->phyAddrs;
+
+	ret = NX_VpuDecRegFrameBuf(ctx->hInst, &frameArg);
+	if (ret == VPU_RET_OK) {
+		if( dec_ctx->col_mv_buf )
+			nx_free_memory(dec_ctx->col_mv_buf);
+		dec_ctx->col_mv_buf = mvbuf;
+		dec_ctx->registeredCount = dec_ctx->frame_buffer_cnt;
+	}else{
+		NX_ErrMsg(("NX_VpuDecRegFrameBuf() failed.(ErrorCode=%d)\n", ret));
+		if( mvbuf )
+			nx_free_memory(mvbuf);
+	}
+
+	return ret;
+}
+
+static void put_dec_info(struct nx_vpu_ctx *ctx,
+	struct vpu_dec_frame_arg *pDecArg, const u64 timestamp)
+{
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	int32_t idx = pDecArg->indexFrameDecoded;
+
+	if (idx < 0)
+		return;
+
+	if ((pDecArg->isInterace) || ((ctx->codec_mode == CODEC_STD_MPEG2) &&
+		(pDecArg->picStructure != 3)))
+		dec_ctx->interlace_flg[idx] = (pDecArg->topFieldFirst) ?
+			(V4L2_FIELD_SEQ_TB) : (V4L2_FIELD_SEQ_BT);
+	else
+		dec_ctx->interlace_flg[idx] = V4L2_FIELD_NONE;
+
+	switch (pDecArg->picType) {
+	case 0:
+	case 6:
+		dec_ctx->frm_type[idx] = V4L2_BUF_FLAG_KEYFRAME;
+		break;
+	case 1:
+	case 4:
+	case 5:
+		dec_ctx->frm_type[idx] = V4L2_BUF_FLAG_PFRAME;
+		break;
+	case 2:
+	case 3:
+		dec_ctx->frm_type[idx] = V4L2_BUF_FLAG_BFRAME;
+		break;
+	case 7:
+		dec_ctx->frm_type[idx] = -1;
+		break;
+	default:
+		NX_ErrMsg(("not defined frame type!!!\n"));
+		dec_ctx->frm_type[idx] = -1;
+	}
+
+	if (pDecArg->numOfErrMBs == 0) {
+		dec_ctx->cur_reliable = 100;
+	} else {
+		if (ctx->codec_mode != CODEC_STD_MJPG) {
+			int totalMbNum = ((pDecArg->outWidth + 15) >> 4) *
+				((pDecArg->outHeight + 15) >> 4);
+			dec_ctx->cur_reliable = (totalMbNum -
+				pDecArg->numOfErrMBs) * 100 / totalMbNum;
+		} else {
+			int32_t PosX = ((pDecArg->numOfErrMBs >> 12) & 0xFFF) *
+				pDecArg->mcuWidth;
+			int32_t PosY = (pDecArg->numOfErrMBs & 0xFFF) *
+				pDecArg->mcuHeight;
+			int32_t PosRst = ((pDecArg->numOfErrMBs >> 24) & 0xF) *
+				pDecArg->mcuWidth * pDecArg->mcuHeight;
+			dec_ctx->cur_reliable = (PosRst + (PosY *
+				pDecArg->outWidth) + PosX) * 100 /
+				(pDecArg->outWidth * pDecArg->outHeight);
+		}
+	}
+
+	if ((dec_ctx->interlace_flg[idx] == V4L2_FIELD_NONE) ||
+		(pDecArg->npf))
+		dec_ctx->reliable_0_100[idx] = dec_ctx->cur_reliable;
+	else
+		dec_ctx->reliable_0_100[idx] += dec_ctx->cur_reliable >> 1;
+
+	dec_ctx->timeStamp[idx] = timestamp;
+}
+
+int vpu_dec_decode_slice(struct nx_vpu_ctx *ctx, bool flush)
+{
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	int ret = 0;
+	unsigned long flags;
+	u64 timestamp;
+	struct vpu_dec_frame_arg decArg;
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	struct nx_vpu_buf *strmBuf, *doneBuf = NULL;
+	struct vb2_v4l2_buffer *vbuf;
+	void *strmData;
+	unsigned strmDataSize;
+
+
+	if (ctx->hInst == NULL) {
+		NX_ErrMsg(("Err : vpu is not opend\n"));
+		return -EAGAIN;
+	}
+
+	if( dec_ctx->frame_buffer_cnt > dec_ctx->registeredCount ) {
+		ret = vpu_dec_init(ctx);
+		if( ret ) {
+			NX_ErrMsg(("vpu_dec_decode_slice: additional buffers register "
+						"failed\n"));
+			return ret;
+		}
+	}
+
+	NX_DrvMemset(&decArg, 0, sizeof(decArg));
+
+	if ( !flush ) {
+		int alignSz;
+		unsigned long phyAddr;
+
+		/* spin_lock_irqsave(&dev->irqlock, flags); */
+
+		if (list_empty(&ctx->strm_queue)) {
+			NX_ErrMsg(("No src buffer.\n"));
+			/* spin_unlock_irqrestore(&ctx->dev->irqlock, flags); */
+			return -EAGAIN;
+		}
+
+		strmBuf = list_entry(ctx->strm_queue.next, struct nx_vpu_buf, list);
+		vbuf = to_vb2_v4l2_buffer(&strmBuf->vb);
+		phyAddr = nx_vpu_mem_plane_addr(&strmBuf->vb, 0);
+		strmDataSize = vb2_get_plane_payload(&strmBuf->vb, 0);
+		alignSz = (strmDataSize + 4095) & (~4095);
+#ifdef USE_ION_MEMORY
+		strmData = cma_get_virt(phyAddr, alignSz, 1);
+#else
+		strmData = vb2_plane_vaddr(&strmBuf->vb, 0);
+#endif
+
+		decArg.eos = 0;
+		timestamp = vbuf->vb2_buf.timestamp;
+
+		/* spin_unlock_irqrestore(&dev->irqlock, flags); */
+
+		if( strmDataSize ) {
+			ret = NX_VpuFillStreamBuffer(ctx->hInst, strmData, strmDataSize);
+			if( ret != VPU_RET_OK ) {
+				NX_ErrMsg(("NX_VpuFillStreamBuffer() failed. (ErrorCode=%d)\n", ret));
+				return ret;
+			}
+		}
+		list_del(&strmBuf->list);
+		ctx->strm_queue_cnt--;
+		vb2_buffer_done(&strmBuf->vb, VB2_BUF_STATE_DONE);
+	} else {
+		decArg.eos = 1;
+		timestamp = 0;
+	}
+
+	dec_ctx->start_Addr = dec_ctx->end_Addr;
+
+	ret = NX_VpuDecRunFrame(ctx->hInst, &decArg);
+	if (ret != VPU_RET_OK) {
+		NX_ErrMsg(("NX_VpuDecRunFrame() failed.(ErrorCode=%d)\n", ret));
+		return ret;
+	}
+	if( flush ) {
+		int ret = NX_VpuDecFlush(ctx->hInst);
+		if( ret )
+			NX_ErrMsg(("NX_VpuDecFlush err=%d\n", ret));
+	}
+
+	dec_ctx->end_Addr = decArg.strmReadPos;
+
+	if (dec_ctx->end_Addr >= dec_ctx->start_Addr)
+		ctx->strm_size = dec_ctx->end_Addr - dec_ctx->start_Addr;
+	else
+		ctx->strm_size = (STREAM_BUF_SIZE - dec_ctx->start_Addr)
+				+ dec_ctx->end_Addr;
+
+	put_dec_info(ctx, &decArg, timestamp);
+
+	dec_ctx->delay_frm = -1;
+	if (decArg.indexFrameDisplay >= 0 &&
+			decArg.indexFrameDisplay < dec_ctx->frame_buffer_cnt)
+	{
+
+		spin_lock_irqsave(&dev->irqlock, flags);
+
+		doneBuf = dec_ctx->dpb_bufs[decArg.indexFrameDisplay];
+		if ( doneBuf ) {
+			int i;
+			vbuf = to_vb2_v4l2_buffer(&doneBuf->vb);
+
+			vbuf->field = decArg.isInterace;
+			vbuf->flags = decArg.picType;
+			for (i = 0; i < doneBuf->vb.num_planes; i++)
+				vb2_set_plane_payload(&doneBuf->vb, i,
+						vb2_plane_size(&doneBuf->vb, i));
+			dec_ctx->dpb_bufs[decArg.indexFrameDisplay] = NULL;
+			dec_ctx->dpb_queue_cnt--;
+			dec_ctx->delay_frm = 0;
+		}else{
+			NX_ErrMsg(("decoder returned frame %d not associated with a buffer\n",
+					decArg.indexFrameDisplay));
+		}
+
+		spin_unlock_irqrestore(&dev->irqlock, flags);
+	}else if (decArg.indexFrameDisplay >= 0 ) {
+		NX_ErrMsg(("bad display frame number returned by decoder: %d\n",
+					decArg.indexFrameDisplay));
+	} else if (decArg.indexFrameDisplay == -3) {
+		NX_DbgMsg(INFO_MSG, ("delayed Output(%d)\n",
+			decArg.indexFrameDisplay));
+		dec_ctx->delay_frm = 1;
+	} else if (decArg.indexFrameDisplay == -2) {
+		NX_DbgMsg(INFO_MSG, ("Skip Frame\n"));
+	} else if( !flush ) {
+		NX_ErrMsg(("There is not decoded img!!! (idx=%d)\n",
+					decArg.indexFrameDisplay));
+	}
+
+	/*spin_lock_irqsave(&dev->irqlock, flags);*/
+
+	if( doneBuf ) {
+		int idx = decArg.indexFrameDisplay;
+
+		vbuf = to_vb2_v4l2_buffer(&doneBuf->vb);
+		vbuf->field = dec_ctx->interlace_flg[idx];
+		vbuf->flags = dec_ctx->frm_type[idx];
+		vbuf->vb2_buf.timestamp = dec_ctx->timeStamp[idx];
+		if( flush )
+			vbuf->flags |= V4L2_BUF_FLAG_LAST;
+		vb2_buffer_done(&doneBuf->vb, VB2_BUF_STATE_DONE);
+	}else if( flush ) {
+		// report end of stream using empty buffer
+		int i, idx = 0;
+		while( idx < dec_ctx->frame_buffer_cnt &&
+				dec_ctx->dpb_bufs[idx] == NULL)
+			++idx;
+		if( idx < dec_ctx->frame_buffer_cnt ) {
+			doneBuf = dec_ctx->dpb_bufs[idx];
+			dec_ctx->dpb_bufs[idx] = NULL;
+			vbuf = to_vb2_v4l2_buffer(&doneBuf->vb);
+			vbuf->flags = V4L2_BUF_FLAG_LAST;
+			for(i = 0; i < doneBuf->vb.num_planes; i++)
+				vb2_set_plane_payload(&doneBuf->vb, i, 0);
+			vb2_buffer_done(&doneBuf->vb, VB2_BUF_STATE_DONE);
+		}
+	}
+
+	/*spin_unlock_irqrestore(&dev->irqlock, flags);*/
+
+	return ret;
+}
+
+static int free_decoder_memory(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+
+	FUNC_IN();
+
+	if (!ctx) {
+		NX_ErrMsg(("invalid decoder handle!!!\n"));
+		return -1;
+	}
+
+	if (dec_ctx->col_mv_buf) {
+		nx_free_memory(dec_ctx->col_mv_buf);
+		dec_ctx->col_mv_buf = NULL;
+	}
+
+	if (dec_ctx->slice_buf) {
+		nx_free_memory(dec_ctx->slice_buf);
+		dec_ctx->slice_buf = NULL;
+	}
+
+	if (dec_ctx->pv_slice_buf) {
+		nx_free_memory(dec_ctx->pv_slice_buf);
+		dec_ctx->pv_slice_buf = NULL;
+	}
+
+	if (ctx->instance_buf) {
+		nx_free_memory(ctx->instance_buf);
+		ctx->instance_buf = NULL;
+	}
+
+	if (ctx->bit_stream_buf) {
+		nx_free_memory(ctx->bit_stream_buf);
+		ctx->bit_stream_buf = NULL;
+	}
+
+	return 0;
+}
+
+void nx_vpu_dec_close_instance(struct nx_vpu_ctx *ctx)
+{
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+
+	if (ctx->hInst) {
+		int ret = NX_VpuDecClose(ctx->hInst, (void*)&dev->vpu_event_present);
+		if (ret != 0)
+			NX_ErrMsg(("Failed to return an instance.\n"));
+		free_decoder_memory(ctx);
+		--dev->cur_num_instance;
+		ctx->hInst = NULL;
+	}
+}
+
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_encoder.c b/drivers/media/platform/nxp-vpu/nx_vpu_encoder.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_encoder.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_encoder.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,995 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef UNUSED
+#define UNUSED(p) ((void)(p))
+#endif
+
+#include <linux/platform_device.h>
+
+#include "vpu_hw_interface.h"           /* Register Access */
+#include "nx_vpu_api.h"
+#include "nx_vpu_gdi.h"
+
+
+#define DBG_REGISTER		0
+#define DBG_ES_ADDR		0
+#define INFO_MSG		0
+
+
+/*--------------------------------------------------------------------------- */
+/*  Define Static Functions */
+static void VPU_EncDefaultParam(struct vpu_enc_info *pInfo);
+static int VPU_EncSeqCommand(struct nx_vpu_codec_inst *pInst);
+static int VPU_EncSetFrameBufCommand(struct nx_vpu_codec_inst
+	*pInst, uint32_t sramAddr, uint32_t sramSize);
+static int VPU_EncOneFrameCommand(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_run_frame_arg *runArg);
+static int VPU_EncChangeParameterCommand(struct nx_vpu_codec_inst
+	*pInst, struct vpu_enc_chg_para_arg *chgArg);
+static int VPU_EncGetHeaderCommand(struct nx_vpu_codec_inst *pInst,
+	unsigned int headerType, void **ptr, int *size);
+static int VPU_EncCloseCommand(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present);
+
+
+/*----------------------------------------------------------------------------
+ *			Encoder APIs
+ */
+
+int NX_VpuEncOpen(struct vpu_open_arg *pOpenArg, void *devHandle,
+	struct nx_vpu_codec_inst **ppInst)
+{
+	struct vpu_enc_info *pEncInfo;
+	struct nx_vpu_codec_inst *hInst = 0;
+
+	*ppInst = 0;
+	if (!NX_VpuIsInitialized())
+		return VPU_RET_ERR_INIT;
+
+	hInst = NX_VpuGetInstance(pOpenArg->instIndex);
+	if (!hInst)
+		return VPU_RET_ERR_INST;
+
+	if (CODEC_STD_AVC == pOpenArg->codecStd) {
+		hInst->codecMode = AVC_ENC;
+		hInst->auxMode = 0;
+	} else if (CODEC_STD_MPEG4 == pOpenArg->codecStd) {
+		hInst->codecMode = MP4_ENC;
+		hInst->auxMode = 0;
+	} else if (CODEC_STD_H263 == pOpenArg->codecStd) {
+		hInst->codecMode = MP4_ENC;
+		hInst->auxMode = 1;
+	} else if (CODEC_STD_MJPG == pOpenArg->codecStd) {
+		hInst->codecMode = MJPG_ENC;
+		hInst->auxMode = 0;
+	} else {
+		NX_ErrMsg(("NX_VpuEncOpen() failed!!!\n"));
+		NX_ErrMsg(("Cannot support codec standard(%d)\n",
+			pOpenArg->codecStd));
+		return VPU_RET_ERR_PARAM;
+	}
+
+	NX_DrvMemset(&hInst->codecInfo, 0, sizeof(hInst->codecInfo));
+
+	hInst->inUse = 1;
+	hInst->instIndex = pOpenArg->instIndex;
+	hInst->devHandle = devHandle;
+
+	hInst->instBufPhyAddr = (uint64_t)pOpenArg->instanceBuf.phyAddr;
+
+	pEncInfo = &hInst->codecInfo.encInfo;
+	pEncInfo->codecStd = pOpenArg->codecStd;
+
+	VPU_EncDefaultParam(pEncInfo);
+
+	*ppInst = hInst;
+	return VPU_RET_OK;
+}
+
+int NX_VpuEncClose(struct nx_vpu_codec_inst *pInst, void *vpu_event_present)
+{
+	enum nx_vpu_ret ret;
+
+	if (MJPG_ENC == pInst->codecMode)
+		return VPU_RET_OK;
+
+	ret = VPU_EncCloseCommand(pInst, vpu_event_present);
+	if (ret != VPU_RET_OK)
+		NX_ErrMsg(("NX_VpuEncClose() failed.(%d)\n", ret));
+
+	return ret;
+}
+
+int NX_VpuEncSetSeqParam(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_seq_arg *pSeqArg)
+{
+	struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+
+	pEncInfo->srcWidth = pSeqArg->srcWidth;
+	pEncInfo->srcHeight = pSeqArg->srcHeight;
+	pEncInfo->encWidth = pSeqArg->srcWidth;
+	pEncInfo->encHeight = pSeqArg->srcHeight;
+	pEncInfo->gopSize = pSeqArg->gopSize;
+	pEncInfo->frameRateNum = pSeqArg->frameRateNum;
+	pEncInfo->frameRateDen = pSeqArg->frameRateDen;
+
+	pEncInfo->rcEnable = (pSeqArg->bitrate) ? (1) : (0);
+	pEncInfo->bitRate = (pSeqArg->bitrate/1024)&0x7FFF;
+	pEncInfo->userQpMax = pSeqArg->maxQP;
+	pEncInfo->enableAutoSkip = !pSeqArg->disableSkip;
+	pEncInfo->initialDelay = pSeqArg->initialDelay;
+	pEncInfo->vbvBufSize = pSeqArg->vbvBufferSize;
+	pEncInfo->userGamma = pSeqArg->gammaFactor;
+	pEncInfo->frameQp = pSeqArg->initQP;
+
+	pEncInfo->MESearchRange = pSeqArg->searchRange;
+	pEncInfo->intraRefresh = pSeqArg->intraRefreshMbs;
+
+	pEncInfo->cbcrInterleave = pSeqArg->chromaInterleave;
+	pEncInfo->cbcrInterleaveRefFrame = pSeqArg->refChromaInterleave;
+
+	pEncInfo->rotateAngle = pSeqArg->rotAngle / 90;
+	pEncInfo->mirrorDirection = pSeqArg->mirDirection;
+
+	pEncInfo->strmBufVirAddr = pSeqArg->strmBufVirAddr;
+	pEncInfo->strmBufPhyAddr = pSeqArg->strmBufPhyAddr;
+	pEncInfo->strmBufSize = pSeqArg->strmBufSize;
+
+	pEncInfo->jpegQuality = pSeqArg->quality;
+
+	if (pSeqArg->annexFlg) {
+		pEncInfo->enc_codec_para.h263EncParam.h263AnnexJEnable = 1;
+		pEncInfo->enc_codec_para.h263EncParam.h263AnnexTEnable = 1;
+	}
+
+	if (pSeqArg->enableAUDelimiter)
+		pEncInfo->enc_codec_para.avcEncParam.audEnable = 1;
+
+	NX_DbgMsg(INFO_MSG, ("NX_VpuEncSetSeqParam() information\n"));
+	NX_DbgMsg(INFO_MSG, ("Reloution : %d x %d\n",
+		pEncInfo->srcWidth, pEncInfo->srcHeight));
+	NX_DbgMsg(INFO_MSG, ("Fps : %d/%d\n",
+		pEncInfo->frameRateNum, pEncInfo->frameRateDen));
+	NX_DbgMsg(INFO_MSG, ("Target bitrate : %d kbps\n", pEncInfo->bitRate));
+	NX_DbgMsg(INFO_MSG, ("GOP : %d\n", pEncInfo->gopSize));
+	NX_DbgMsg(INFO_MSG, ("Max QP : %d\n", pEncInfo->userQpMax));
+	NX_DbgMsg(INFO_MSG, ("SR : %d\n", pEncInfo->MESearchRange));
+	NX_DbgMsg(INFO_MSG, ("Stream_buffer : 0x%llx, 0x%llx))\n",
+		pEncInfo->strmBufPhyAddr, pEncInfo->strmBufVirAddr));
+
+	if (CODEC_STD_MJPG == pEncInfo->codecStd) {
+		struct enc_jpeg_info *pJpgInfo =
+			&pEncInfo->enc_codec_para.jpgEncInfo;
+
+		if (0 != pEncInfo->rotateAngle) {
+			pJpgInfo->rotationEnable = 1;
+			pJpgInfo->rotationAngle = pEncInfo->rotateAngle;
+		}
+
+		if (0 != pEncInfo->mirrorDirection) {
+			pJpgInfo->mirrorEnable = 1;
+			pJpgInfo->mirrorDirection = pEncInfo->mirrorDirection;
+		}
+
+		if (pSeqArg->quality == 0 || pSeqArg->quality < 0 ||
+			pSeqArg->quality > 100)
+			pEncInfo->jpegQuality = 90;
+		else
+			pEncInfo->jpegQuality = pSeqArg->quality;
+
+		pJpgInfo->format = pSeqArg->imgFormat;
+		pJpgInfo->picWidth = pEncInfo->srcWidth;
+		pJpgInfo->picHeight = pEncInfo->srcHeight;
+
+		return VPU_RET_OK;
+	}
+
+	return VPU_EncSeqCommand(pInst);
+}
+
+/* Frame Buffer Address Allocation */
+int NX_VpuEncSetFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_set_frame_arg *pFrmArg)
+{
+	int i;
+	struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+
+	if (CODEC_STD_MJPG == pEncInfo->codecStd)
+		return VPU_RET_OK;
+
+	pEncInfo->minFrameBuffers = pFrmArg->numFrameBuffer;
+	for (i = 0 ; i < pEncInfo->minFrameBuffers ; i++)
+		pEncInfo->frameBuffer[i] = pFrmArg->frameBuffer[i];
+
+	pEncInfo->subSampleAPhyAddr = pFrmArg->subSampleBuffer[0].phyAddr;
+	pEncInfo->subSampleBPhyAddr = pFrmArg->subSampleBuffer[1].phyAddr;
+
+	return VPU_EncSetFrameBufCommand(pInst, pFrmArg->sramAddr,
+		pFrmArg->sramSize);
+}
+
+int NX_VpuEncGetHeader(struct nx_vpu_codec_inst *pInst,
+	union vpu_enc_get_header_arg *pHeader)
+{
+	enum nx_vpu_ret ret = VPU_RET_OK;
+	void *ptr;
+	int size;
+
+	if (AVC_ENC == pInst->codecMode) {
+		/* SPS */
+		ret = VPU_EncGetHeaderCommand(pInst, SPS_RBSP, &ptr, &size);
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncGetHeader() SPS_RBSP Error!\n"));
+			goto GET_HEADER_EXIT;
+		}
+		NX_DrvMemcpy(pHeader->avcHeader.spsData, ptr, size);
+		pHeader->avcHeader.spsSize = size;
+		/* PPS */
+		ret = VPU_EncGetHeaderCommand(pInst, PPS_RBSP, &ptr, &size);
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncGetHeader() PPS_RBSP Error!\n"));
+			goto GET_HEADER_EXIT;
+		}
+		NX_DrvMemcpy(pHeader->avcHeader.ppsData, ptr, size);
+		pHeader->avcHeader.ppsSize = size;
+	} else if (MP4_ENC == pInst->codecMode) {
+		ret = VPU_EncGetHeaderCommand(pInst, VOS_HEADER, &ptr, &size);
+		/* VOS */
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncGetHeader() VOS_HEADER Error!\n"));
+			goto GET_HEADER_EXIT;
+		}
+		NX_DrvMemcpy(pHeader->mp4Header.vosData, ptr, size);
+		pHeader->mp4Header.vosSize = size;
+		/* VOL */
+		ret = VPU_EncGetHeaderCommand(pInst, VOL_HEADER, &ptr, &size);
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncGetHeader() VOL_HEADER Error!\n"));
+			goto GET_HEADER_EXIT;
+		}
+		NX_DrvMemcpy(pHeader->mp4Header.volData, ptr, size);
+		pHeader->mp4Header.volSize = size;
+	}
+
+GET_HEADER_EXIT:
+	return ret;
+}
+
+int NX_VpuEncRunFrame(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_run_frame_arg *pRunArg)
+{
+	if (pInst->codecMode != MJPG_ENC)
+		return VPU_EncOneFrameCommand(pInst, pRunArg);
+	else
+		return JPU_EncRunFrame(pInst, pRunArg);
+}
+
+int NX_VpuEncChgParam(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_chg_para_arg *pChgArg)
+{
+	if (pInst->codecMode != MJPG_ENC)
+		return VPU_EncChangeParameterCommand(pInst, pChgArg);
+	else
+		return -1;
+}
+
+
+/*---------------------------------------------------------------------------
+ * Encoder Specific Static Functions
+ */
+
+static void VPU_EncDefaultParam(struct vpu_enc_info *pEncInfo)
+{
+	/* Set Default Frame Rate */
+	pEncInfo->frameRateNum = 30;
+	pEncInfo->frameRateDen = 1;
+
+	/* Set Slice Mode */
+	pEncInfo->sliceMode = 0;		/* one slice per picture */
+	pEncInfo->sliceSizeMode = 0;
+	pEncInfo->sliceSize = 0;
+
+	/* Set GOP Size */
+	pEncInfo->gopSize = 30;
+
+	/* Rate Control Related */
+	pEncInfo->rcEnable = 0;
+	pEncInfo->intraRefresh = 0;	        /* Disalbe Intra Refresh */
+	pEncInfo->rcIntraQp = -1;		/* Disable */
+
+	pEncInfo->bwbEnable = VPU_ENABLE_BWB;
+	pEncInfo->cbcrInterleave = CBCR_INTERLEAVE;
+	pEncInfo->cbcrInterleaveRefFrame = ENC_FRAME_BUF_CBCR_INTERLEAVE;
+	pEncInfo->frameEndian = VPU_FRAME_ENDIAN;
+
+	pEncInfo->rcIntervalMode = 0;	        /* Frame Mode */
+	pEncInfo->rcIntraCostWeigth = 400;
+	pEncInfo->enableAutoSkip = 0;
+	pEncInfo->initialDelay = 0;
+	pEncInfo->vbvBufSize = 0;
+
+	/* (0*32768 < gamma < 1*32768) */
+	pEncInfo->userGamma = (unsigned int)(0.75*32768);
+
+	if (CODEC_STD_AVC == pEncInfo->codecStd) {
+		struct enc_avc_param *pAvcParam =
+			&pEncInfo->enc_codec_para.avcEncParam;
+
+		pAvcParam->chromaQpOffset = 0;
+		pAvcParam->constrainedIntraPredFlag = 0;
+		pAvcParam->disableDeblk = 0;
+		pAvcParam->deblkFilterOffsetAlpha = 0;
+		pAvcParam->audEnable = 0;
+
+		pEncInfo->userQpMax = 51;
+	} else if (CODEC_STD_MPEG4 == pEncInfo->codecStd) {
+		struct enc_mp4_param *pMp4Param =
+			&pEncInfo->enc_codec_para.mp4EncParam;
+		pMp4Param->mp4DataPartitionEnable = 0;
+		pMp4Param->mp4ReversibleVlcEnable = 0;
+		pMp4Param->mp4IntraDcVlcThr = 0;
+		pMp4Param->mp4HecEnable	= 0;
+		pMp4Param->mp4Verid = 2;
+
+		pEncInfo->userQpMax = 31;
+	} else if (CODEC_STD_H263 == pEncInfo->codecStd) {
+		struct enc_h263_param *pH263Param =
+			&pEncInfo->enc_codec_para.h263EncParam;
+		pH263Param->h263AnnexIEnable = 0;
+		pH263Param->h263AnnexJEnable = 0;
+		pH263Param->h263AnnexKEnable = 0;
+		pH263Param->h263AnnexTEnable = 0;
+
+		pEncInfo->userQpMax = 31;
+	} else if (CODEC_STD_MJPG == pEncInfo->codecStd) {
+		struct enc_jpeg_info *pJpgInfo =
+			&pEncInfo->enc_codec_para.jpgEncInfo;
+		pJpgInfo->format = IMG_FORMAT_420;
+		pJpgInfo->frameIdx = 0;
+		pJpgInfo->rstIntval = 60;
+	}
+
+	/* Motion Estimation */
+	pEncInfo->MEUseZeroPmv = 0;
+	pEncInfo->MESearchRange = 1;
+	pEncInfo->MEBlockMode = 0;	/* Use All Macro Block Type */
+}
+
+static int VPU_EncSeqCommand(struct nx_vpu_codec_inst *pInst)
+{
+	struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+	unsigned int tmpData;
+
+	/* Write Bitstream Buffer Information */
+	VpuWriteReg(CMD_ENC_SEQ_BB_START, pEncInfo->strmBufPhyAddr);
+	VpuWriteReg(CMD_ENC_SEQ_BB_SIZE, pEncInfo->strmBufSize / 1024);
+
+	/* Set Source Image Information */
+	if (90 == pEncInfo->rotateAngle || 270 == pEncInfo->rotateAngle)
+		tmpData = (pEncInfo->srcHeight << 16) | pEncInfo->srcWidth;
+	else
+		tmpData = (pEncInfo->srcWidth << 16) | pEncInfo->srcHeight;
+
+	VpuWriteReg(CMD_ENC_SEQ_SRC_SIZE, tmpData);
+	VpuWriteReg(CMD_ENC_SEQ_SRC_F_RATE, (pEncInfo->frameRateNum) |
+		((pEncInfo->frameRateDen-1) << 16));
+
+	if (pEncInfo->codecStd == CODEC_STD_MPEG4) {
+		struct enc_mp4_param *pMp4Param =
+			&pEncInfo->enc_codec_para.mp4EncParam;
+		VpuWriteReg(CMD_ENC_SEQ_COD_STD, 3);
+		tmpData = pMp4Param->mp4IntraDcVlcThr << 2 |
+			      pMp4Param->mp4ReversibleVlcEnable << 1 |
+			      pMp4Param->mp4DataPartitionEnable;
+		tmpData |= ((pMp4Param->mp4HecEnable > 0) ? 1:0)<<5;
+		tmpData |= ((pMp4Param->mp4Verid == 2) ? 0:1) << 6;
+		VpuWriteReg(CMD_ENC_SEQ_MP4_PARA, tmpData);
+	} else if (pEncInfo->codecStd == CODEC_STD_H263) {
+		struct enc_h263_param *pH263Param =
+			&pEncInfo->enc_codec_para.h263EncParam;
+
+		VpuWriteReg(CMD_ENC_SEQ_COD_STD, 11);
+		tmpData = pH263Param->h263AnnexIEnable << 3 |
+			pH263Param->h263AnnexJEnable << 2 |
+			pH263Param->h263AnnexKEnable << 1|
+			pH263Param->h263AnnexTEnable;
+		VpuWriteReg(CMD_ENC_SEQ_263_PARA, tmpData);
+	} else if (pEncInfo->codecStd == CODEC_STD_AVC) {
+		struct enc_avc_param *pAvcParam =
+			&pEncInfo->enc_codec_para.avcEncParam;
+		VpuWriteReg(CMD_ENC_SEQ_COD_STD, 0x0);
+		tmpData = (pAvcParam->deblkFilterOffsetBeta & 15) << 12
+			| (pAvcParam->deblkFilterOffsetAlpha & 15) << 8
+			| pAvcParam->disableDeblk << 6
+			| pAvcParam->constrainedIntraPredFlag << 5
+			| (pAvcParam->chromaQpOffset & 31);
+		VpuWriteReg(CMD_ENC_SEQ_264_PARA, tmpData);
+	}
+
+	/* Slice Mode */
+	tmpData  = pEncInfo->sliceSize << 2 |  pEncInfo->sliceSizeMode << 1
+			| pEncInfo->sliceMode;
+	VpuWriteReg(CMD_ENC_SEQ_SLICE_MODE, tmpData);
+
+	/* Write GOP Size */
+	if (pEncInfo->rcEnable)
+		VpuWriteReg(CMD_ENC_SEQ_GOP_NUM, pEncInfo->gopSize);
+	else
+		VpuWriteReg(CMD_ENC_SEQ_GOP_NUM, 0);
+
+	/* Rate Control */
+	if (pEncInfo->rcEnable) {
+		tmpData = (!pEncInfo->enableAutoSkip) << 31 |
+		pEncInfo->initialDelay << 16 | pEncInfo->bitRate<<1 | 1;
+		VpuWriteReg(CMD_ENC_SEQ_RC_PARA, tmpData);
+	} else {
+		VpuWriteReg(CMD_ENC_SEQ_RC_PARA, 0);
+	}
+
+	VpuWriteReg(CMD_ENC_SEQ_RC_BUF_SIZE, pEncInfo->vbvBufSize);
+	VpuWriteReg(CMD_ENC_SEQ_INTRA_REFRESH, pEncInfo->intraRefresh);
+
+	if (pEncInfo->rcIntraQp >= 0) {
+		tmpData = (1 << 5);
+		VpuWriteReg(CMD_ENC_SEQ_INTRA_QP, pEncInfo->rcIntraQp);
+	} else {
+		tmpData = 0;
+		VpuWriteReg(CMD_ENC_SEQ_INTRA_QP, (unsigned int)-1);
+	}
+
+	if (pEncInfo->codecStd == CODEC_STD_AVC)
+		tmpData |= (pEncInfo->enc_codec_para.avcEncParam.audEnable<<2);
+
+	if (pEncInfo->userQpMax >= 0) {
+		tmpData |= (1<<6);
+		VpuWriteReg(CMD_ENC_SEQ_RC_QP_MAX, pEncInfo->userQpMax);
+	} else {
+		VpuWriteReg(CMD_ENC_SEQ_RC_QP_MAX, 0);
+	}
+
+	if (pEncInfo->userGamma >= 0) {
+		tmpData |= (1<<7);
+		VpuWriteReg(CMD_ENC_SEQ_RC_GAMMA, pEncInfo->userGamma);
+	} else {
+		VpuWriteReg(CMD_ENC_SEQ_RC_GAMMA, 0);
+	}
+
+	VpuWriteReg(CMD_ENC_SEQ_OPTION, tmpData);
+
+	VpuWriteReg(CMD_ENC_SEQ_RC_INTERVAL_MODE, (pEncInfo->mbInterval<<2)
+			| pEncInfo->rcIntervalMode);
+	VpuWriteReg(CMD_ENC_SEQ_INTRA_WEIGHT, pEncInfo->rcIntraCostWeigth);
+	VpuWriteReg(CMD_ENC_SEQ_ME_OPTION, (pEncInfo->MEBlockMode << 3)
+		| (pEncInfo->MEUseZeroPmv << 2) | pEncInfo->MESearchRange);
+
+	VpuWriteReg(BIT_WR_PTR, pEncInfo->strmBufPhyAddr);
+	VpuWriteReg(BIT_RD_PTR, pEncInfo->strmBufPhyAddr);
+
+	tmpData = 0;
+	tmpData |= (pEncInfo->bwbEnable<<12)|(pEncInfo->cbcrInterleave<<2);
+	tmpData |= pEncInfo->frameEndian;
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, tmpData);
+
+	/* Ring Buffer Disable */
+	if (pEncInfo->ringBufferEnable == 0) {
+		/* Line Buffer Interrupt Enable */
+		tmpData  = (0x1<<6);
+		/* The value of 1 means that bitstream buffer is reset at every
+		picture encoding command. */
+		tmpData |= (0x1<<5);
+		/* Enables dynamic picture stream buffer allocation in encoder
+		operations. */
+		tmpData |= (0x1<<4);
+		tmpData |= VPU_STREAM_ENDIAN;
+	} else {
+		/* Ring Buffer Enabled */
+		tmpData  = (0x1<<3);
+		tmpData |= VPU_STREAM_ENDIAN;
+	}
+
+	VpuWriteReg(BIT_BIT_STREAM_CTRL, tmpData);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[SEQ_INIT_Reg]\n"));
+		for (reg = 0x0 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+
+	VpuBitIssueCommand(pInst, SEQ_INIT);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[SEQ_INIT_Reg]\n"));
+		for (reg = 0x0 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	if (!VPU_WaitBitInterrupt(pInst->devHandle, VPU_DEC_TIMEOUT)) {
+		NX_ErrMsg(("VPU_EncSeqCommand() Failed. Timeout(%d)\n",
+			VPU_BUSY_CHECK_TIMEOUT));
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	/* Get Encoder Frame Buffer Information */
+	if (VpuReadReg(RET_ENC_SEQ_ENC_SUCCESS) & (1<<31))
+		return VPU_RET_ERR_MEM_ACCESS;
+
+	if (VpuReadReg(RET_ENC_SEQ_ENC_SUCCESS) == 0)
+		return VPU_RET_ERR_INIT;
+
+	if (pInst->codecMode == MJPG_ENC)
+		pEncInfo->minFrameBuffers = 0;
+	else
+		/* reconstructed frame + reference frame + subsample */
+		pEncInfo->minFrameBuffers = 2;
+
+	pEncInfo->strmWritePrt = VpuReadReg(BIT_WR_PTR);
+	pEncInfo->strmEndFlag = VpuReadReg(BIT_BIT_STREAM_PARAM);
+
+	NX_DbgMsg(INFO_MSG, ("VPU_EncSeqCommand() Success.\n"));
+	NX_DbgMsg(INFO_MSG, ("Writer Ptr = 0x%08x, Stream End Flag = %d\n",
+		pEncInfo->strmWritePrt, pEncInfo->strmEndFlag));
+
+	pInst->isInitialized = 1;
+	return VPU_RET_OK;
+}
+
+static int VPU_EncSetFrameBufCommand(struct nx_vpu_codec_inst *pInst,
+	uint32_t sramAddr, uint32_t sramSize)
+{
+	int i;
+	unsigned char frameAddr[22][3][4];
+	struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+	unsigned int frameBufStride = ((pEncInfo->srcWidth+15)&~15);
+	unsigned int val = 0;
+
+	NX_DrvMemset(frameAddr, 0, sizeof(frameAddr));
+
+	/* Set Second AXI Memory (SRAM) Configuration */
+	if (VPU_RET_OK != ConfigEncSecAXI(pEncInfo->codecStd,
+		&pEncInfo->sec_axi_info, pEncInfo->srcWidth,
+		pEncInfo->srcHeight, sramAddr, sramSize))
+		return VPU_RET_ERR_SRAM;
+
+	/* decoder(0), cbcr interleve(0), bypass(0), burst(0), merge(3),
+		maptype(linear), wayshape(15) */
+	pEncInfo->cacheConfig = MaverickCache2Config(0,
+		pEncInfo->cbcrInterleaveRefFrame, 0, 0, 3, 0, 15);
+
+	SetTiledMapType(VPU_LINEAR_FRAME_MAP, frameBufStride,
+		pEncInfo->cbcrInterleaveRefFrame);
+
+	if (pEncInfo->frameBufMapType) {
+		if (pEncInfo->frameBufMapType == VPU_TILED_FRAME_MB_RASTER_MAP
+		|| pEncInfo->frameBufMapType == VPU_TILED_FIELD_MB_RASTER_MAP)
+			val |= (pEncInfo->cbcrInterleaveRefFrame<<11) |
+				(0x03<<9)|(IMG_FORMAT_420<<6);
+		else
+			val |= (pEncInfo->cbcrInterleaveRefFrame<<11) |
+				(0x02<<9)|(IMG_FORMAT_420<<6);
+	}
+
+	/* Interleave bit position is modified */
+	val |= (pEncInfo->cbcrInterleaveRefFrame<<2);
+	val |= VPU_FRAME_ENDIAN;
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, val);
+
+	/* Let the decoder know the addresses of the frame buffers. */
+	for (i = 0; i < pEncInfo->minFrameBuffers; i++) {
+		struct nx_vid_memory_info *frameBuffer =
+			&pEncInfo->frameBuffer[i];
+
+		/* Y */
+		frameAddr[i][0][0] = (frameBuffer->phyAddr[0] >> 24) & 0xFF;
+		frameAddr[i][0][1] = (frameBuffer->phyAddr[0] >> 16) & 0xFF;
+		frameAddr[i][0][2] = (frameBuffer->phyAddr[0] >>  8) & 0xFF;
+		frameAddr[i][0][3] = (frameBuffer->phyAddr[0] >>  0) & 0xFF;
+		/* Cb */
+		frameAddr[i][1][0] = (frameBuffer->phyAddr[1] >> 24) & 0xFF;
+		frameAddr[i][1][1] = (frameBuffer->phyAddr[1] >> 16) & 0xFF;
+		frameAddr[i][1][2] = (frameBuffer->phyAddr[1] >>  8) & 0xFF;
+		frameAddr[i][1][3] = (frameBuffer->phyAddr[1] >>  0) & 0xFF;
+		/* Cr */
+		frameAddr[i][2][0] = (frameBuffer->phyAddr[2] >> 24) & 0xFF;
+		frameAddr[i][2][1] = (frameBuffer->phyAddr[2] >> 16) & 0xFF;
+		frameAddr[i][2][2] = (frameBuffer->phyAddr[2] >>  8) & 0xFF;
+		frameAddr[i][2][3] = (frameBuffer->phyAddr[2] >>  0) & 0xFF;
+	}
+
+	swap_endian((unsigned char *)frameAddr, sizeof(frameAddr));
+	NX_DrvMemcpy(pInst->paramVirAddr, frameAddr, sizeof(frameAddr));
+
+	/* Tell the codec how much frame buffers were allocated. */
+	VpuWriteReg(CMD_SET_FRAME_BUF_NUM, pEncInfo->minFrameBuffers);
+	VpuWriteReg(CMD_SET_FRAME_BUF_STRIDE, frameBufStride);
+	VpuWriteReg(CMD_SET_FRAME_AXI_BIT_ADDR,
+		pEncInfo->sec_axi_info.bufBitUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_IPACDC_ADDR,
+		pEncInfo->sec_axi_info.bufIpAcDcUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_DBKY_ADDR,
+		pEncInfo->sec_axi_info.bufDbkYUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_DBKC_ADDR,
+		pEncInfo->sec_axi_info.bufDbkCUse);
+	VpuWriteReg(CMD_SET_FRAME_AXI_OVL_ADDR,
+		pEncInfo->sec_axi_info.bufOvlUse);
+	VpuWriteReg(CMD_SET_FRAME_CACHE_CONFIG,
+		pEncInfo->cacheConfig);
+
+	/* Set Sub-Sampling buffer for ME-Reference and DBK-Reconstruction */
+	/* BPU will swap below two buffer internally every pic by pic */
+	VpuWriteReg(CMD_SET_FRAME_SUBSAMP_A, pEncInfo->subSampleAPhyAddr);
+	VpuWriteReg(CMD_SET_FRAME_SUBSAMP_B, pEncInfo->subSampleBPhyAddr);
+
+	if (pInst->codecMode == MP4_ENC) {
+		/* MPEG4 Encoder Data-Partitioned bitstream temporal buffer */
+		VpuWriteReg(CMD_SET_FRAME_DP_BUF_BASE,
+			pEncInfo->usbSampleDPPhyAddr);
+		VpuWriteReg(CMD_SET_FRAME_DP_BUF_SIZE,
+			pEncInfo->usbSampleDPSize);
+	}
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[ENC_SET_FRM_BUF_Reg]\n"));
+		for (reg = 0x180 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	VpuBitIssueCommand(pInst, SET_FRAME_BUF);
+	if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+		BIT_BUSY_FLAG)) {
+		NX_ErrMsg(("VPU_EncSetFrameBuffer() Failed. Timeout(%d)\n",
+			VPU_BUSY_CHECK_TIMEOUT));
+		return VPU_RET_ERR_TIMEOUT;
+	}
+
+	if (VpuReadReg(RET_SET_FRAME_SUCCESS) & (1<<31))
+		return VPU_RET_ERR_MEM_ACCESS;
+
+	return VPU_RET_OK;
+}
+
+static int VPU_EncGetHeaderCommand(struct nx_vpu_codec_inst *pInst,
+	unsigned int headerType, void **ptr, int *size)
+{
+	struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+	int flag = 0;
+	unsigned int wdPtr, rdPtr;
+	int headerSize;
+
+	if (pEncInfo->ringBufferEnable == 0) {
+		VpuWriteReg(CMD_ENC_HEADER_BB_START, pEncInfo->strmBufPhyAddr);
+		VpuWriteReg(CMD_ENC_HEADER_BB_SIZE, pEncInfo->strmBufSize/1024);
+	}
+
+	if (pInst->codecMode == AVC_ENC && headerType == SPS_RBSP) {
+		struct enc_avc_param *avcParam =
+			&pEncInfo->enc_codec_para.avcEncParam;
+		int CropH = 0, CropV = 0;
+
+		if (pEncInfo->encWidth & 0xF) {
+			flag = 1;
+			avcParam->cropRight = 16 - (pEncInfo->encWidth&0xF);
+			CropH  = avcParam->cropLeft << 16;
+			CropH |= avcParam->cropRight;
+		}
+
+		if (pEncInfo->encHeight & 0xF) {
+			flag = 1;
+			avcParam->cropBottom = 16 - (pEncInfo->encHeight&0xF);
+			CropV  = avcParam->cropTop << 16;
+			CropV |= avcParam->cropBottom;
+		}
+
+		VpuWriteReg(CMD_ENC_HEADER_FRAME_CROP_H, CropH);
+		VpuWriteReg(CMD_ENC_HEADER_FRAME_CROP_V, CropV);
+	}
+
+	/* 0: SPS, 1: PPS */
+	VpuWriteReg(CMD_ENC_HEADER_CODE, headerType | (flag << 3));
+
+	VpuWriteReg(BIT_RD_PTR, pEncInfo->strmBufPhyAddr);
+	VpuWriteReg(BIT_WR_PTR, pEncInfo->strmBufPhyAddr);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[ENC_HEADER_Reg]\n"));
+		for (reg = 0x180 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	VpuBitIssueCommand(pInst, ENCODE_HEADER);
+	if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+		BIT_BUSY_FLAG))
+		return VPU_RET_ERR_TIMEOUT;
+
+	if (pEncInfo->ringBufferEnable == 0) {
+		rdPtr = pEncInfo->strmBufPhyAddr;
+		wdPtr = VpuReadReg(BIT_WR_PTR);
+		headerSize = wdPtr - rdPtr;
+	} else {
+		rdPtr = VpuReadReg(BIT_RD_PTR);
+		wdPtr = VpuReadReg(BIT_WR_PTR);
+		headerSize = wdPtr - rdPtr;
+	}
+
+	pEncInfo->strmWritePrt = wdPtr;
+	pEncInfo->strmReadPrt = rdPtr;
+
+	*ptr = (void *)(unsigned long)pEncInfo->strmBufVirAddr;
+	*size = headerSize;
+
+	return VPU_RET_OK;
+}
+
+static int VPU_EncOneFrameCommand(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_run_frame_arg *pRunArg)
+{
+	unsigned int readPtr, writePtr;
+	int size, picFlag/*, frameIndex*/, val, reason;
+	unsigned int sliceNumber, picEncResult, picType;
+	struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+
+	/* For Linear Frame Buffer Mode */
+	VpuWriteReg(GDI_TILEDBUF_BASE, 0x00);
+
+	/* Mirror/Rotate Mode */
+	if (pEncInfo->rotateAngle == 0 && pEncInfo->mirrorDirection == 0)
+		VpuWriteReg(CMD_ENC_PIC_ROT_MODE, 0);
+	else
+		VpuWriteReg(CMD_ENC_PIC_ROT_MODE, (1 << 4) |
+			(pEncInfo->mirrorDirection << 2) |
+			(pEncInfo->rotateAngle));
+
+	/* If rate control is enabled, this register is ignored.
+	 *(MPEG-4/H.263 : 1~31, AVC : 0 ~51) */
+	VpuWriteReg(CMD_ENC_PIC_QS, pRunArg->quantParam);
+
+	if (pRunArg->forceSkipPicture) {
+		VpuWriteReg(CMD_ENC_PIC_OPTION, 1);
+	} else {
+		/* Registering Source Frame Buffer information */
+		/* Hide GDI IF under FW level */
+		if (pRunArg->inImgBuffer.planes == 2)
+			pEncInfo->cbcrInterleave = 1;
+
+		VpuWriteReg(CMD_ENC_PIC_SRC_INDEX, 2);
+		VpuWriteReg(CMD_ENC_PIC_SRC_STRIDE,
+			pRunArg->inImgBuffer.strideY);
+		VpuWriteReg(CMD_ENC_PIC_SRC_ADDR_Y,
+			pRunArg->inImgBuffer.phyAddr[0]);
+		VpuWriteReg(CMD_ENC_PIC_SRC_ADDR_CB,
+			pRunArg->inImgBuffer.phyAddr[1]);
+		VpuWriteReg(CMD_ENC_PIC_SRC_ADDR_CR,
+			pRunArg->inImgBuffer.phyAddr[2]);
+		VpuWriteReg(CMD_ENC_PIC_OPTION,
+			(pRunArg->forceIPicture << 1 & 0x2));
+	}
+
+	if (pEncInfo->ringBufferEnable == 0) {
+		VpuWriteReg(CMD_ENC_PIC_BB_START, pEncInfo->strmBufPhyAddr);
+		VpuWriteReg(CMD_ENC_PIC_BB_SIZE, pEncInfo->strmBufSize/1024);
+		VpuWriteReg(BIT_RD_PTR, pEncInfo->strmBufPhyAddr);
+	}
+
+	val = 0;
+	val = (
+		(pEncInfo->sec_axi_info.useBitEnable & 0x01)<<0 |
+		(pEncInfo->sec_axi_info.useIpEnable & 0x01)<<1 |
+		(pEncInfo->sec_axi_info.useDbkYEnable & 0x01)<<2 |
+		(pEncInfo->sec_axi_info.useDbkCEnable & 0x01)<<3 |
+
+		(pEncInfo->sec_axi_info.useOvlEnable & 0x01)<<4 |
+		(pEncInfo->sec_axi_info.useBtpEnable & 0x01)<<5 |
+
+		(pEncInfo->sec_axi_info.useBitEnable & 0x01)<<8 |
+		(pEncInfo->sec_axi_info.useIpEnable & 0x01)<<9 |
+		(pEncInfo->sec_axi_info.useDbkYEnable & 0x01)<<10|
+		(pEncInfo->sec_axi_info.useDbkCEnable & 0x01)<<11|
+
+		(pEncInfo->sec_axi_info.useOvlEnable & 0x01)<<12|
+		(pEncInfo->sec_axi_info.useBtpEnable & 0x01)<<13);
+
+	VpuWriteReg(BIT_AXI_SRAM_USE, val);
+
+	VpuWriteReg(BIT_WR_PTR, pEncInfo->strmBufPhyAddr);
+	VpuWriteReg(BIT_RD_PTR, pEncInfo->strmBufPhyAddr);
+	VpuWriteReg(BIT_BIT_STREAM_PARAM, pEncInfo->strmEndFlag);
+
+	val = 0;
+	val |= (pEncInfo->bwbEnable<<12) | (pEncInfo->cbcrInterleave<<2);
+	val |= pEncInfo->frameEndian;
+	VpuWriteReg(BIT_FRAME_MEM_CTRL, val);
+
+	if (pEncInfo->ringBufferEnable == 0) {
+		val = 0;
+		val |= (0x1<<6);
+		val |= (0x1<<5);
+		val |= (0x1<<4);
+	} else {
+		val |= (0x1<<3);
+	}
+	val |= VPU_STREAM_ENDIAN;
+	VpuWriteReg(BIT_BIT_STREAM_CTRL, val);
+
+#if (DBG_REGISTER)
+	{
+		int reg;
+
+		NX_DbgMsg(DBG_REGISTER, ("[ENC_RUN_Reg]\n"));
+		for (reg = 0x180 ; reg < 0x200 ; reg += 16) {
+			NX_DbgMsg(DBG_REGISTER, ("[Addr = %3x]%x %x %x %x\n",
+				reg, VpuReadReg(BIT_BASE + reg),
+				VpuReadReg(BIT_BASE + reg + 4),
+				VpuReadReg(BIT_BASE + reg + 8),
+				VpuReadReg(BIT_BASE + reg + 12)));
+		}
+	}
+#endif
+
+	VpuBitIssueCommand(pInst, PIC_RUN);
+
+	do {
+		reason = VPU_WaitBitInterrupt(pInst->devHandle,
+			VPU_ENC_TIMEOUT);
+
+		if (reason == 0)
+			return VPU_RET_ERR_TIMEOUT;
+		if (reason & (1<<VPU_INT_BIT_PIC_RUN))
+			break;
+		else if (reason &  (1<<VPU_INT_BIT_BIT_BUF_FULL))
+			return VPU_RET_ERR_STRM_FULL;
+	} while (1);
+
+	picEncResult = VpuReadReg(RET_ENC_PIC_SUCCESS);
+	if (picEncResult & (1<<31))
+		return VPU_RET_ERR_MEM_ACCESS;
+
+	picType = VpuReadReg(RET_ENC_PIC_TYPE);
+	readPtr  = VpuReadReg(BIT_RD_PTR);
+	writePtr = VpuReadReg(BIT_WR_PTR);
+
+	size = writePtr - readPtr;
+	sliceNumber = VpuReadReg(RET_ENC_PIC_SLICE_NUM);
+
+	picFlag = VpuReadReg(RET_ENC_PIC_FLAG);
+	pRunArg->reconImgIdx = VpuReadReg(RET_ENC_PIC_FRAME_IDX);
+
+	pEncInfo->strmEndFlag = VpuReadReg(BIT_BIT_STREAM_PARAM);
+
+	pRunArg->frameType = picType;
+	pRunArg->outStreamSize = size;
+	pRunArg->outStreamAddr = pEncInfo->strmBufVirAddr;
+
+	/*NX_DbgMsg(INFO_MSG, ("Encoded Size = %d, PicType = %d, picFlag = %d,
+		sliceNumber = %d\n", size, picType, picFlag, sliceNumber));*/
+
+	return VPU_RET_OK;
+}
+
+static int VPU_EncChangeParameterCommand(struct nx_vpu_codec_inst *pInst,
+	struct vpu_enc_chg_para_arg *pChgArg)
+{
+	int ret;
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_GOP)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_RC_GOP, pChgArg->gopSize);
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_INTRAQP)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_RC_INTRA_QP, pChgArg->intraQp);
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_BITRATE)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_RC_BITRATE, pChgArg->bitrate);
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_FRAMERATE)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_RC_FRAME_RATE,
+		(pChgArg->frameRateNum) | ((pChgArg->frameRateDen-1) << 16));
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_INTRARF)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_INTRA_MB_NUM,
+			pChgArg->intraRefreshMbs);
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_SLICEMOD)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_SLICE_MODE, (pChgArg->sliceMode) |
+		(pChgArg->sliceSizeMode << 2) | (pChgArg->sliceSizeNum << 3));
+
+	if (pChgArg->chgFlg & VPU_BIT_CHG_HECMODE)
+		VpuWriteReg(CMD_ENC_SEQ_PARA_HEC_MODE, pChgArg->hecMode);
+
+	VpuWriteReg(CMD_ENC_SEQ_PARA_CHANGE_ENABLE, pChgArg->chgFlg & 0x7F);
+
+	VpuBitIssueCommand(pInst, RC_CHANGE_PARAMETER);
+	if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+		BIT_BUSY_FLAG))
+		return VPU_RET_ERR_TIMEOUT;
+
+	ret = VpuReadReg(RET_ENC_SEQ_PARA_CHANGE_SECCESS);
+	if ((ret & 1) == 0)
+		return VPU_RET_ERR_CHG_PARAM;
+	if (ret >> 31)
+		return VPU_RET_ERR_MEM_ACCESS;
+
+	return VPU_RET_OK;
+}
+
+static int VPU_EncCloseCommand(struct nx_vpu_codec_inst *pInst,
+	void *vpu_event_present)
+{
+	FUNC_IN();
+
+	if (pInst->isInitialized) {
+		struct vpu_enc_info *pEncInfo = &pInst->codecInfo.encInfo;
+
+		VpuWriteReg(BIT_WR_PTR, pEncInfo->strmBufPhyAddr);
+		VpuWriteReg(BIT_RD_PTR, pEncInfo->strmBufPhyAddr);
+
+		VpuBitIssueCommand(pInst, SEQ_END);
+		if (VPU_RET_OK != VPU_WaitVpuBusy(VPU_BUSY_CHECK_TIMEOUT,
+			BIT_BUSY_FLAG)) {
+			VpuWriteReg(BIT_INT_CLEAR, 0x1);
+			atomic_set((atomic_t *)vpu_event_present, 0);
+			NX_ErrMsg(("VPU_EncCloseCommand() Failed!!!\n"));
+			NX_ErrMsg(("Timeout(%d)\n", VPU_BUSY_CHECK_TIMEOUT));
+			VPU_SWReset(SW_RESET_SAFETY);
+			pInst->isInitialized = 0;
+			return VPU_RET_ERR_TIMEOUT;
+		}
+		pInst->isInitialized = 0;
+	}
+
+	VpuWriteReg(BIT_INT_CLEAR, 0x1);	/* For Signal Break Out */
+	atomic_set((atomic_t *)vpu_event_present, 0);/* Clear Atomic */
+
+	FUNC_OUT();
+	return VPU_RET_OK;
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_enc_v4l2.c b/drivers/media/platform/nxp-vpu/nx_vpu_enc_v4l2.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_enc_v4l2.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_enc_v4l2.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,1668 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/videodev2.h>
+#include <linux/videodev2_nxp_media.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/of.h>
+#include <linux/interrupt.h>
+
+#include <media/v4l2-ctrls.h>
+#include <media/v4l2-event.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-mem2mem.h>
+#include <media/videobuf2-core.h>
+
+#include <media/videobuf2-dma-contig.h>
+
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/cma.h>
+
+#include "vpu_hw_interface.h"
+#include "nx_vpu_v4l2.h"
+
+
+#define INFO_MSG				0
+#define RECON_CHROMA_INTERLEAVE			0
+
+static int free_encoder_memory(struct nx_vpu_ctx*);
+static int alloc_encoder_memory(struct nx_vpu_ctx*);
+
+
+static int nx_vpu_enc_ctx_ready(struct nx_vpu_ctx *ctx)
+{
+	FUNC_IN();
+	NX_DbgMsg(INFO_MSG, ("src = %d, dst = %d\n", ctx->img_queue_cnt,
+		ctx->strm_queue_cnt));
+
+	if (ctx->codec.enc.vpu_cmd == ENC_RUN) {
+		if (ctx->strm_queue_cnt < 1) {
+			NX_DbgMsg(INFO_MSG, ("strm_queue_cnt error\n"));
+			return 0;
+		}
+		if (ctx->codec.enc.is_initialized && ctx->img_queue_cnt < 1) {
+			NX_DbgMsg(INFO_MSG, ("img_queue_cnt error\n"));
+			return 0;
+		}
+	}
+
+	return 1;
+}
+
+
+/*-----------------------------------------------------------------------------
+ *      functions for Parameter controls
+ *----------------------------------------------------------------------------*/
+static struct v4l2_queryctrl controls[] = {
+	{
+		.id = V4L2_CID_MPEG_VIDEO_FPS_NUM,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "frame per second",
+		.minimum = 0,
+		.maximum = (1 << 16) - 1,
+		.step = 1,
+		.default_value = 30,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_FPS_DEN,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "frame per second Density",
+		.minimum = 1,
+		.maximum = (1 << 16) - 1,
+		.step = 1,
+		.default_value = 1,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_GOP_SIZE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Size of key frame interval",
+		.minimum = 0,
+		.maximum = (1 << 16) - 1,
+		.step = 1,
+		.default_value = 30,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_CYCLIC_INTRA_REFRESH_MB,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Intra MB refresh number",
+		.minimum = 0,
+		.maximum = (1 << 16) - 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_SEARCH_RANGE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Search range of ME",
+		.minimum = 0,
+		.maximum = (1 << 16) - 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE,
+		.type = V4L2_CTRL_TYPE_BOOLEAN,
+		.name = "Enable rate control",
+		.minimum = 0,
+		.maximum = 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_BITRATE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Target bitrate",
+		.minimum = 0,
+		.maximum = 50 * 1024 * 1024,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_VBV_SIZE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "VBV size in byte",
+		.minimum = 0,
+		.maximum = 0x7FFFFFFF,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_RC_DELAY,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Reference decoder buffer delay",
+		.minimum = 0,
+		.maximum = 0x7FFF,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_RC_GAMMA_FACTOR,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "User gamma factor",
+		.minimum = 0,
+		.maximum = (1 << 16) - 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE,
+		.type = V4L2_CTRL_TYPE_BOOLEAN,
+		.name = "Enable skip frame mode",
+		.minimum = 0,
+		.maximum = 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H264_PROFILE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "H264 profile",
+		.minimum = V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		.maximum = V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+		.step = 1,
+		.default_value = V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "QP of I-frame in H.264",
+		.minimum = 0,
+		.maximum = 51,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "QP of P-frame in H.264",
+		.minimum = 0,
+		.maximum = 51,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H264_MAX_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Maximum QP for H.264",
+		.minimum = 0,
+		.maximum = 51,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H264_AUD_INSERT,
+		.type = V4L2_CTRL_TYPE_BOOLEAN,
+		.name = "Insert AUD before NAL unit",
+		.minimum = 0,
+		.maximum = 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	/*{
+		.id = V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "MPEG4 profile",
+		.minimum = V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE,
+		.maximum = V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE,
+		.step = 1,
+		.default_value = V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE,
+	},*/
+	{
+		.id = V4L2_CID_MPEG_VIDEO_MPEG4_I_FRAME_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "QP of I-frame in MPEG4",
+		.minimum = 0,
+		.maximum = 31,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_MPEG4_P_FRAME_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "QP of P-frame in MPEG4",
+		.minimum = 0,
+		.maximum = 31,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_MPEG4_MAX_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Maximum QP for MPEG4",
+		.minimum = 0,
+		.maximum = 31,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H263_PROFILE,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "H263 Profile",
+		.minimum = V4L2_MPEG_VIDEO_H263_PROFILE_P0,
+		.maximum = V4L2_MPEG_VIDEO_H263_PROFILE_P3,
+		.step = 1,
+		.default_value = V4L2_MPEG_VIDEO_H263_PROFILE_P0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H263_I_FRAME_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "QP of I-frame in H.263",
+		.minimum = 0,
+		.maximum = 31,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H263_P_FRAME_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "QP of P-frame in H.263",
+		.minimum = 0,
+		.maximum = 31,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_H263_MAX_QP,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Maximum QP for H.263",
+		.minimum = 0,
+		.maximum = 31,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_JPEG_COMPRESSION_QUALITY,
+		.type = V4L2_CTRL_TYPE_INTEGER,
+		.name = "Parameter for Jpeg Quality",
+		.minimum = 0,
+		.maximum = 100,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_FORCE_I_FRAME,
+		.type = V4L2_CTRL_TYPE_BOOLEAN,
+		.name = "Flag of forced intra frame",
+		.minimum = 0,
+		.maximum = 1,
+		.step = 1,
+		.default_value = 0,
+	},
+	{
+		.id = V4L2_CID_MPEG_VIDEO_FORCE_SKIP_FRAME,
+		.type = V4L2_CTRL_TYPE_BOOLEAN,
+		.name = "Flag of forced skip frame",
+		.minimum = 0,
+		.maximum = 1,
+		.step = 1,
+		.default_value = 0,
+	},
+};
+#define NUM_CTRLS ARRAY_SIZE(controls)
+
+static struct v4l2_queryctrl *get_ctrl(int id)
+{
+	int i;
+
+	FUNC_IN();
+
+	for (i = 0; i < NUM_CTRLS; ++i)
+		if (id == controls[i].id)
+			return &controls[i];
+	return NULL;
+}
+
+static int check_ctrl_val(struct nx_vpu_ctx *ctx, struct v4l2_control *ctrl)
+{
+	struct v4l2_queryctrl *c;
+
+	FUNC_IN();
+
+	c = get_ctrl(ctrl->id);
+	if (!c)
+		return -EINVAL;
+	if (ctrl->value < c->minimum || ctrl->value > c->maximum
+	    || (c->step != 0 && ctrl->value % c->step != 0)) {
+		NX_ErrMsg(("Invalid control value\n"));
+		NX_ErrMsg(("value = %d, min = %d, max = %d, step = %d\n",
+			ctrl->value, c->minimum, c->maximum, c->step));
+		return -ERANGE;
+	}
+
+	return 0;
+}
+/* -------------------------------------------------------------------------- */
+
+
+/*-----------------------------------------------------------------------------
+ *      functions for vidioc_queryctrl
+ *----------------------------------------------------------------------------*/
+
+/* Query a ctrl */
+static int vidioc_queryctrl(struct file *file, void *priv, struct v4l2_queryctrl
+	*qc)
+{
+	struct v4l2_queryctrl *c;
+
+	FUNC_IN();
+
+	c = get_ctrl(qc->id);
+	if (!c)
+		return -EINVAL;
+	*qc = *c;
+	return 0;
+}
+
+static int vidioc_g_fmt(struct file *file, void *priv, struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+
+	FUNC_IN();
+
+	if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		/* This is run on output (encoder dest) */
+		pix_fmt_mp->width = 0;
+		pix_fmt_mp->height = 0;
+		pix_fmt_mp->field = V4L2_FIELD_NONE;
+		pix_fmt_mp->pixelformat = ctx->strm_fmt->fourcc;
+		pix_fmt_mp->num_planes = 1;
+
+		pix_fmt_mp->plane_fmt[0].bytesperline = ctx->strm_buf_size;
+		pix_fmt_mp->plane_fmt[0].sizeimage = ctx->strm_buf_size;
+	} else if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		/* This is run on capture (encoder src) */
+		pix_fmt_mp->width = ctx->width;
+		pix_fmt_mp->height = ctx->height;
+		pix_fmt_mp->field = V4L2_FIELD_NONE;
+		pix_fmt_mp->pixelformat = ctx->img_fmt->fourcc;
+		pix_fmt_mp->num_planes = ctx->useSingleBuf ||
+			ctx->img_fmt->singleBuffer ? 1 :
+			ctx->img_fmt->chromaInterleave ? 2 : 3;
+
+		pix_fmt_mp->plane_fmt[0].bytesperline = ctx->buf_y_width;
+		pix_fmt_mp->plane_fmt[0].sizeimage = ctx->luma_size;
+		pix_fmt_mp->plane_fmt[1].bytesperline = ctx->buf_c_width;
+		pix_fmt_mp->plane_fmt[1].sizeimage = ctx->chroma_size;
+		pix_fmt_mp->plane_fmt[2].bytesperline = ctx->buf_c_width;
+		pix_fmt_mp->plane_fmt[2].sizeimage = ctx->chroma_size;
+
+	} else {
+		NX_ErrMsg(("invalid buf type\n"));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
+{
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+
+	FUNC_IN();
+
+	if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		const struct nx_vpu_image_fmt *fmt = nx_find_image_format(
+				f->fmt.pix_mp.pixelformat);
+		if (!fmt) {
+			NX_ErrMsg(("failed to try output format(ES), %x\n",
+				pix_fmt_mp->pixelformat));
+			return -EINVAL;
+		}
+
+		if (pix_fmt_mp->plane_fmt[0].sizeimage == 0) {
+			NX_ErrMsg(("must be set encoding output size\n"));
+			return -EINVAL;
+		}
+
+		pix_fmt_mp->plane_fmt[0].bytesperline =
+			pix_fmt_mp->plane_fmt[0].sizeimage;
+	} else if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		const struct nx_vpu_stream_fmt *fmt = nx_find_stream_format(f);
+		if (!fmt) {
+			NX_ErrMsg(("failed to try input format(IMG), %x\n",
+				pix_fmt_mp->pixelformat));
+			return -EINVAL;
+		}
+
+		pix_fmt_mp->num_planes = 1;
+	} else {
+		NX_ErrMsg(("invalid buf type\n"));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int vidioc_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(priv);
+	struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
+	int ret = 0;
+
+	FUNC_IN();
+
+	ret = vidioc_try_fmt(file, priv, f);
+	if (ret)
+		return ret;
+
+	if (ctx->vq_img.streaming || ctx->vq_strm.streaming) {
+		NX_ErrMsg(("%s queue busy\n", __func__));
+		ret = -EBUSY;
+		goto ERROR_EXIT;
+	}
+
+	if (f->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		const struct nx_vpu_image_fmt *fmt = nx_find_image_format(
+				f->fmt.pix_mp.pixelformat);
+		if (!fmt) {
+			NX_ErrMsg(("failed to set capture format\n"));
+			return -EINVAL;
+		}
+
+		ctx->codec.enc.vpu_cmd = GET_ENC_INSTANCE;
+
+		ctx->img_fmt = fmt;
+
+		ctx->strm_buf_size = pix_fmt_mp->plane_fmt[0].sizeimage;
+		pix_fmt_mp->plane_fmt[0].bytesperline = 0;
+		ret = nx_vpu_enc_try_run(ctx);
+	} else if (f->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		struct vpu_enc_ctx *enc_ctx = &ctx->codec.enc;
+
+		const struct nx_vpu_stream_fmt *fmt = nx_find_stream_format(f);
+		if (!fmt) {
+			NX_ErrMsg(("failed to set output format\n"));
+			return -EINVAL;
+		}
+
+		ctx->strm_fmt = fmt;
+		ctx->width = pix_fmt_mp->width;
+		ctx->height = pix_fmt_mp->height;
+		enc_ctx->reconChromaInterleave = RECON_CHROMA_INTERLEAVE;
+
+		enc_ctx->seq_para.srcWidth = ctx->width;
+		enc_ctx->seq_para.srcHeight = ctx->height;
+		enc_ctx->seq_para.chromaInterleave = ctx->chromaInterleave;
+		enc_ctx->seq_para.refChromaInterleave
+			= enc_ctx->reconChromaInterleave;
+
+		ctx->buf_y_width = ALIGN(ctx->width, 32);
+		ctx->buf_height = ALIGN(ctx->height, 16);
+		ctx->luma_size = ctx->buf_y_width * ctx->buf_height;
+
+		switch (fmt->fourcc) {
+		case V4L2_PIX_FMT_NV12M:
+			ctx->buf_c_width = ctx->buf_y_width >> 1;
+			ctx->chroma_size = ctx->buf_c_width * ctx->buf_height;
+			ctx->chromaInterleave = 1;
+			break;
+		case V4L2_PIX_FMT_YUV420M:
+			ctx->buf_c_width = ctx->buf_y_width >> 1;
+			ctx->chroma_size = ctx->buf_c_width *
+				ALIGN(ctx->buf_height/2, 16);
+			ctx->chromaInterleave = 0;
+			break;
+		case V4L2_PIX_FMT_YUV422M:
+			ctx->buf_c_width = ctx->buf_y_width >> 1;
+			ctx->chroma_size = ctx->buf_c_width * ctx->buf_height;
+			ctx->chromaInterleave = 0;
+			break;
+		case V4L2_PIX_FMT_YUV444M:
+			ctx->buf_c_width = ctx->buf_y_width;
+			ctx->chroma_size = ctx->luma_size;
+			ctx->chromaInterleave = 0;
+			break;
+		case V4L2_PIX_FMT_GREY:
+			ctx->buf_c_width = 0;
+			ctx->chroma_size = 0;
+			break;
+		default:
+			return -EINVAL;
+		}
+
+		pix_fmt_mp->plane_fmt[0].bytesperline = ctx->buf_y_width;
+		pix_fmt_mp->plane_fmt[0].sizeimage = ctx->luma_size;
+		pix_fmt_mp->plane_fmt[1].bytesperline = ctx->buf_c_width;
+		pix_fmt_mp->plane_fmt[1].sizeimage = ctx->chroma_size;
+		if (ctx->chromaInterleave == 0) {
+			pix_fmt_mp->plane_fmt[2].bytesperline
+				= ctx->buf_c_width;
+			pix_fmt_mp->plane_fmt[2].sizeimage = ctx->chroma_size;
+		}
+	} else {
+		NX_ErrMsg(("invalid buf type\n"));
+		return -EINVAL;
+	}
+
+ERROR_EXIT:
+	NX_DbgMsg(INFO_MSG, ("%s End!!(ret = %d)\n", __func__, ret));
+	return ret;
+}
+
+static int vidioc_reqbufs(struct file *file, void *priv,
+					  struct v4l2_requestbuffers *reqbufs)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = 0;
+
+	FUNC_IN();
+
+	/* if memory is not mmp or userptr return error */
+	if ((reqbufs->memory != V4L2_MEMORY_MMAP) &&
+		(reqbufs->memory != V4L2_MEMORY_USERPTR) &&
+		(reqbufs->memory != V4L2_MEMORY_DMABUF))
+		return -EINVAL;
+
+	/* For Output ES */
+	if (reqbufs->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		ret = vb2_reqbufs(&ctx->vq_strm, reqbufs);
+		if (ret != 0) {
+			NX_ErrMsg(("error in vb2_reqbufs() for Stream\n"));
+			return ret;
+		}
+
+		ret = alloc_encoder_memory(ctx);
+		if (ret) {
+			NX_ErrMsg(("Failed to allocate encoding buffers.\n"));
+			reqbufs->count = 0;
+			ret = vb2_reqbufs(&ctx->vq_strm, reqbufs);
+			return -ENOMEM;
+		}
+	} else if (reqbufs->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		ret = vb2_reqbufs(&ctx->vq_img, reqbufs);/* 10,  9(new) */
+		if (ret != 0) {
+			NX_ErrMsg(("error in vb2_reqbufs() for YUV\n"));
+			return ret;
+		}
+	} else {
+		NX_ErrMsg(("invalid buf type\n"));
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+/* Queue a buffer */
+static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+
+	FUNC_IN();
+
+	if (ctx->hInst == NULL) {
+		NX_ErrMsg(("%s : Invalid encoder handle!!!\n", __func__));
+		return -EIO;
+	}
+
+	if (buf->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		if (ctx->codec.enc.is_initialized == 0) {
+			NX_ErrMsg(("%s : Not initialized!!!\n",  __func__));
+			return -EIO;
+		}
+
+		return vb2_qbuf(&ctx->vq_img, buf);
+	} else if (buf->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		return vb2_qbuf(&ctx->vq_strm, buf);
+	}
+
+	return -EINVAL;
+}
+
+/* Dequeue a buffer */
+static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *buf)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+
+	FUNC_IN();
+
+	if (buf->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
+		return vb2_dqbuf(&ctx->vq_img, buf, file->f_flags & O_NONBLOCK);
+
+	return vb2_dqbuf(&ctx->vq_strm, buf, file->f_flags & O_NONBLOCK);
+}
+
+static int get_ctrl_val(struct vpu_enc_ctx *enc_ctx, struct v4l2_control *ctrl)
+{
+	struct vpu_enc_seq_arg *seq_para = &enc_ctx->seq_para;
+
+	FUNC_IN();
+
+	switch (ctrl->id) {
+	case V4L2_CID_MPEG_VIDEO_FPS_NUM:
+		ctrl->value = seq_para->frameRateNum;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FPS_DEN:
+		ctrl->value = seq_para->frameRateDen;
+		break;
+	case V4L2_CID_MPEG_VIDEO_GOP_SIZE:
+		ctrl->value = seq_para->gopSize;
+		break;
+	case V4L2_CID_MPEG_VIDEO_CYCLIC_INTRA_REFRESH_MB:
+		ctrl->value = seq_para->intraRefreshMbs;
+		break;
+	case V4L2_CID_MPEG_VIDEO_SEARCH_RANGE:
+		ctrl->value = seq_para->searchRange;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE:
+		ctrl->value = (seq_para->bitrate > 0) ? (1) : (0);
+		break;
+	case V4L2_CID_MPEG_VIDEO_BITRATE:
+		ctrl->value = seq_para->bitrate;
+		break;
+	case V4L2_CID_MPEG_VIDEO_VBV_SIZE:
+		ctrl->value = seq_para->vbvBufferSize;
+		break;
+	case V4L2_CID_MPEG_VIDEO_RC_DELAY:
+		ctrl->value = seq_para->initialDelay;
+		break;
+	case V4L2_CID_MPEG_VIDEO_RC_GAMMA_FACTOR:
+		ctrl->value = seq_para->gammaFactor;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE:
+		ctrl->value = !seq_para->disableSkip;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+		ctrl->value = V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_I_FRAME_QP:
+		ctrl->value = enc_ctx->userIQP;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_P_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_P_FRAME_QP:
+		ctrl->value = enc_ctx->userPQP;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_MAX_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_MAX_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_MAX_QP:
+		ctrl->value = seq_para->maxQP;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_AUD_INSERT:
+		ctrl->value = seq_para->enableAUDelimiter;
+		break;
+	case V4L2_CID_MPEG_VIDEO_MPEG4_PROFILE:
+		ctrl->value = V4L2_MPEG_VIDEO_MPEG4_PROFILE_SIMPLE;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H263_PROFILE:
+		ctrl->value = (seq_para->annexFlg) ?
+			(V4L2_MPEG_VIDEO_H263_PROFILE_P3) :
+			(V4L2_MPEG_VIDEO_H263_PROFILE_P0);
+		break;
+	case V4L2_CID_JPEG_COMPRESSION_QUALITY:
+		ctrl->value = seq_para->quality;
+		break;
+	default:
+		NX_ErrMsg(("Invalid control(ID = %x)\n", ctrl->id));
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int vidioc_g_ctrl(struct file *file, void *priv,
+			 struct v4l2_control *ctrl)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = 0;
+
+	FUNC_IN();
+	ret = get_ctrl_val(&ctx->codec.enc, ctrl);
+
+	return ret;
+}
+
+static int set_enc_param(struct vpu_enc_ctx *enc_ctx, struct v4l2_control *ctrl)
+{
+	int ret = 0;
+	struct vpu_enc_seq_arg *seq_para = &enc_ctx->seq_para;
+
+	FUNC_IN();
+
+	switch (ctrl->id) {
+	case V4L2_CID_MPEG_VIDEO_FPS_NUM:
+		seq_para->frameRateNum = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FPS_DEN:
+		seq_para->frameRateDen = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_GOP_SIZE:
+		seq_para->gopSize = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_CYCLIC_INTRA_REFRESH_MB:
+		seq_para->intraRefreshMbs = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_SEARCH_RANGE:
+		seq_para->searchRange = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FRAME_RC_ENABLE:
+		if (ctrl->value == 0)
+			seq_para->bitrate = 0;
+		break;
+	case V4L2_CID_MPEG_VIDEO_BITRATE:
+		seq_para->bitrate = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_VBV_SIZE:
+		seq_para->vbvBufferSize = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_RC_DELAY:
+		seq_para->initialDelay = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_RC_GAMMA_FACTOR:
+		seq_para->gammaFactor = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE:
+		seq_para->disableSkip = !ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_I_FRAME_QP:
+		enc_ctx->userIQP = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_P_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_P_FRAME_QP:
+		enc_ctx->userPQP = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_MAX_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_MAX_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_MAX_QP:
+		seq_para->maxQP = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_AUD_INSERT:
+		seq_para->enableAUDelimiter = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H263_PROFILE:
+		if (ctrl->value == V4L2_MPEG_VIDEO_H263_PROFILE_P3)
+			seq_para->annexFlg = 1;
+		break;
+	case V4L2_CID_JPEG_COMPRESSION_QUALITY:
+		seq_para->quality = ctrl->value;
+		break;
+	default:
+		NX_ErrMsg(("Invalid control(ID = %x)\n", ctrl->id));
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static int set_enc_run_param(struct vpu_enc_ctx *enc_ctx,
+	struct v4l2_control *ctrl)
+{
+	int ret = 0;
+	struct vpu_enc_run_frame_arg *run_info = &enc_ctx->run_info;
+	struct vpu_enc_chg_para_arg *chg_para = &enc_ctx->chg_para;
+	struct vpu_enc_seq_arg *seq_para = &enc_ctx->seq_para;
+
+	FUNC_IN();
+
+	switch (ctrl->id) {
+	case V4L2_CID_MPEG_VIDEO_FORCE_I_FRAME:
+		run_info->forceIPicture = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FORCE_SKIP_FRAME:
+		run_info->forceSkipPicture = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_H264_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H264_P_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_MPEG4_P_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_I_FRAME_QP:
+	case V4L2_CID_MPEG_VIDEO_H263_P_FRAME_QP:
+		if (ctrl->value > 0)
+			run_info->quantParam = ctrl->value;
+		else
+			run_info->quantParam = enc_ctx->userPQP;
+		break;
+	case V4L2_CID_MPEG_VIDEO_GOP_SIZE:
+		chg_para->chgFlg |= VPU_BIT_CHG_GOP;
+		chg_para->gopSize = ctrl->value;
+		seq_para->gopSize = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_BITRATE:
+		chg_para->chgFlg |= VPU_BIT_CHG_BITRATE;
+		chg_para->bitrate = ctrl->value;
+		seq_para->bitrate = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FPS_NUM:
+		chg_para->chgFlg |= VPU_BIT_CHG_FRAMERATE;
+		chg_para->frameRateNum = ctrl->value;
+		seq_para->frameRateNum = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_FPS_DEN:
+		chg_para->chgFlg |= VPU_BIT_CHG_FRAMERATE;
+		chg_para->frameRateDen = ctrl->value;
+		seq_para->frameRateDen = ctrl->value;
+		break;
+	case V4L2_CID_MPEG_VIDEO_CYCLIC_INTRA_REFRESH_MB:
+		chg_para->chgFlg |= VPU_BIT_CHG_INTRARF;
+		chg_para->intraRefreshMbs = ctrl->value;
+		seq_para->intraRefreshMbs = ctrl->value;
+		break;
+	case V4L2_CID_JPEG_COMPRESSION_QUALITY:
+		seq_para->quality = ctrl->value;
+		break;
+	default:
+		NX_ErrMsg(("Invalid control(ID = %x)\n", ctrl->id));
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
+static int vidioc_s_ctrl(struct file *file, void *priv, struct v4l2_control
+	*ctrl)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = 0;
+
+	FUNC_IN();
+
+	ret = check_ctrl_val(ctx, ctrl);
+	if (ret != 0)
+		return ret;
+
+	return set_enc_run_param(&ctx->codec.enc, ctrl);
+}
+
+static int vidioc_g_ext_ctrls(struct file *file, void *priv,
+			      struct v4l2_ext_controls *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_ext_control *ext_ctrl;
+	struct v4l2_control ctrl;
+	int i;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if ((f->which != V4L2_CTRL_CLASS_MPEG) &&
+		(f->which != V4L2_CID_JPEG_CLASS_BASE))
+		return -EINVAL;
+
+	for (i = 0; i < f->count; i++) {
+		ext_ctrl = (f->controls + i);
+
+		ctrl.id = ext_ctrl->id;
+
+		ret = get_ctrl_val(&ctx->codec.enc, &ctrl);
+		if (ret == 0) {
+			ext_ctrl->value = ctrl.value;
+		} else {
+			f->error_idx = i;
+			break;
+		}
+
+		NX_DbgMsg(INFO_MSG, ("[%d] id: 0x%08x, value: %d", i,
+			ext_ctrl->id, ext_ctrl->value));
+	}
+
+	return ret;
+}
+
+static int vidioc_s_ext_ctrls(struct file *file, void *priv,
+				struct v4l2_ext_controls *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_ext_control *ext_ctrl;
+	struct v4l2_control ctrl;
+	int i;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if ((f->which != V4L2_CTRL_CLASS_MPEG) &&
+		(f->which != V4L2_CID_JPEG_CLASS_BASE))
+		return -EINVAL;
+
+	for (i = 0; i < f->count; i++) {
+		ext_ctrl = (f->controls + i);
+
+		ctrl.id = ext_ctrl->id;
+		ctrl.value = ext_ctrl->value;
+
+		ret = check_ctrl_val(ctx, &ctrl);
+		if (ret != 0) {
+			f->error_idx = i;
+			break;
+		}
+
+		ret = set_enc_param(&ctx->codec.enc, &ctrl);
+		if (ret != 0) {
+			f->error_idx = i;
+			break;
+		}
+
+		NX_DbgMsg(INFO_MSG, ("[%d] id: 0x%08x, value: %d\n", i,
+			ext_ctrl->id, ext_ctrl->value));
+	}
+
+	return ret;
+}
+
+static int vidioc_try_ext_ctrls(struct file *file, void *priv,
+	struct v4l2_ext_controls *f)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct v4l2_ext_control *ext_ctrl;
+	struct v4l2_control ctrl;
+	int i;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if ((f->which != V4L2_CTRL_CLASS_MPEG) &&
+		(f->which != V4L2_CID_JPEG_CLASS_BASE))
+		return -EINVAL;
+
+	for (i = 0; i < f->count; i++) {
+		ext_ctrl = (f->controls + i);
+
+		ctrl.id = ext_ctrl->id;
+		ctrl.value = ext_ctrl->value;
+
+		ret = check_ctrl_val(ctx, &ctrl);
+		if (ret != 0) {
+			f->error_idx = i;
+			break;
+		}
+
+		NX_DbgMsg(INFO_MSG, ("[%d] id: 0x%08x, value: %d", i,
+			ext_ctrl->id, ext_ctrl->value));
+	}
+
+	return ret;
+}
+
+static const struct v4l2_ioctl_ops nx_vpu_enc_ioctl_ops = {
+	.vidioc_querycap = vidioc_querycap,
+	.vidioc_enum_fmt_vid_cap = nx_vidioc_enum_fmt_vid_stream,
+	.vidioc_enum_fmt_vid_cap_mplane = nx_vidioc_enum_fmt_vid_stream_mplane,
+	.vidioc_enum_fmt_vid_out = nx_vidioc_enum_fmt_vid_image,
+	.vidioc_enum_fmt_vid_out_mplane = nx_vidioc_enum_fmt_vid_image_mplane,
+	.vidioc_g_fmt_vid_cap_mplane = vidioc_g_fmt,
+	.vidioc_g_fmt_vid_out_mplane = vidioc_g_fmt,
+	.vidioc_try_fmt_vid_cap_mplane = vidioc_try_fmt,
+	.vidioc_try_fmt_vid_out_mplane = vidioc_try_fmt,
+	.vidioc_s_fmt_vid_cap_mplane = vidioc_s_fmt,
+	.vidioc_s_fmt_vid_out_mplane = vidioc_s_fmt,
+	.vidioc_reqbufs = vidioc_reqbufs,
+	.vidioc_querybuf = nx_vpu_vidioc_querybuf,
+	.vidioc_qbuf = vidioc_qbuf,
+	.vidioc_dqbuf = vidioc_dqbuf,
+	.vidioc_streamon = nx_vpu_vidioc_streamon,
+	.vidioc_streamoff = nx_vpu_vidioc_streamoff,
+	.vidioc_queryctrl = vidioc_queryctrl,
+	.vidioc_g_ctrl = vidioc_g_ctrl,
+	.vidioc_s_ctrl = vidioc_s_ctrl,
+	.vidioc_g_ext_ctrls = vidioc_g_ext_ctrls,
+	.vidioc_s_ext_ctrls = vidioc_s_ext_ctrls,
+	.vidioc_try_ext_ctrls = vidioc_try_ext_ctrls,
+};
+
+static int nx_vpu_enc_start_streaming(struct vb2_queue *q, unsigned int count)
+{
+	struct nx_vpu_ctx *ctx = q->drv_priv;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if (nx_vpu_enc_ctx_ready(ctx))
+		ret = nx_vpu_enc_try_run(ctx);
+
+	return ret;
+}
+
+static void nx_vpu_enc_stop_streaming(struct vb2_queue *q)
+{
+	unsigned long flags;
+	struct nx_vpu_ctx *ctx = q->drv_priv;
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+
+	FUNC_IN();
+
+	spin_lock_irqsave(&dev->irqlock, flags);
+
+	if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+		nx_vpu_cleanup_queue(&ctx->strm_queue, &ctx->vq_strm,
+				VB2_BUF_STATE_ERROR);
+		INIT_LIST_HEAD(&ctx->strm_queue);
+		ctx->strm_queue_cnt = 0;
+	} else if (q->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		nx_vpu_cleanup_queue(&ctx->img_queue, &ctx->vq_img,
+				VB2_BUF_STATE_ERROR);
+		INIT_LIST_HEAD(&ctx->img_queue);
+		ctx->img_queue_cnt = 0;
+	}
+
+	spin_unlock_irqrestore(&dev->irqlock, flags);
+}
+
+static void nx_vpu_enc_buf_queue(struct vb2_buffer *vb)
+{
+	struct vb2_queue *vq = vb->vb2_queue;
+	struct nx_vpu_ctx *ctx = vq->drv_priv;
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	unsigned long flags;
+	struct nx_vpu_buf *buf = vb_to_vpu_buf(vb);
+
+	FUNC_IN();
+
+	spin_lock_irqsave(&dev->irqlock, flags);
+
+	if (vq->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+
+		NX_DbgMsg(INFO_MSG, ("adding to dst: %p (%08lx)\n", vb,
+			(unsigned long)nx_vpu_mem_plane_addr(vb, 0)));
+
+		list_add_tail(&buf->list, &ctx->strm_queue);
+		ctx->strm_queue_cnt++;
+	} else if (vq->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) {
+		NX_DbgMsg(INFO_MSG, ("adding to src: %p(%08lx, %08lx)\n",
+			vb, (unsigned long)nx_vpu_mem_plane_addr(vb, 0),
+			(unsigned long)nx_vpu_mem_plane_addr(vb, 1)));
+
+		list_add_tail(&buf->list, &ctx->img_queue);
+		ctx->img_queue_cnt++;
+	} else {
+		NX_ErrMsg(("unsupported buffer type (%d)\n", vq->type));
+	}
+
+	spin_unlock_irqrestore(&dev->irqlock, flags);
+
+	if (nx_vpu_enc_ctx_ready(ctx))
+		nx_vpu_enc_try_run(ctx);
+}
+
+static struct vb2_ops nx_vpu_enc_qops = {
+	.queue_setup            = nx_vpu_queue_setup,
+	.wait_prepare           = nx_vpu_unlock,
+	.wait_finish            = nx_vpu_lock,
+	.buf_prepare            = nx_vpu_buf_prepare,
+	.start_streaming        = nx_vpu_enc_start_streaming,
+	.stop_streaming         = nx_vpu_enc_stop_streaming,
+	.buf_queue              = nx_vpu_enc_buf_queue,
+};
+
+/* -------------------------------------------------------------------------- */
+
+
+const struct v4l2_ioctl_ops *get_enc_ioctl_ops(void)
+{
+	return &nx_vpu_enc_ioctl_ops;
+};
+
+int nx_vpu_enc_open(struct nx_vpu_ctx *ctx)
+{
+	int ret = 0;
+
+	FUNC_IN();
+
+	/* Init videobuf2 queue for INPUT */
+	ctx->vq_img.type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
+	ctx->vq_img.drv_priv = ctx;
+	ctx->vq_img.lock = &ctx->dev->dev_mutex;
+	ctx->vq_img.buf_struct_size = sizeof(struct nx_vpu_buf);
+	ctx->vq_img.io_modes = VB2_USERPTR | VB2_DMABUF;
+	/* ctx->vq_strm.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF; */
+	ctx->vq_img.ops = &nx_vpu_enc_qops;
+	ctx->vq_img.mem_ops = &vb2_dma_contig_memops;
+	/*ctx->vq_img.allow_zero_byteused = 1; */
+	ctx->vq_img.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	ctx->vq_img.dev = &ctx->dev->plat_dev->dev;
+	ret = vb2_queue_init(&ctx->vq_img);
+	if (ret) {
+		NX_ErrMsg(("Failed to initialize videobuf2 queue(output)\n"));
+		return ret;
+	}
+
+	/* Init videobuf2 queue for OUTPUT */
+	ctx->vq_strm.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
+	ctx->vq_strm.drv_priv = ctx;
+	ctx->vq_strm.lock = &ctx->dev->dev_mutex;
+	ctx->vq_strm.buf_struct_size = sizeof(struct nx_vpu_buf);
+	ctx->vq_strm.io_modes = VB2_USERPTR | VB2_DMABUF;
+	/* ctx->vq_strm.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF; */
+	ctx->vq_strm.ops = &nx_vpu_enc_qops;
+	ctx->vq_strm.mem_ops = &vb2_dma_contig_memops;
+	ctx->vq_strm.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
+	ctx->vq_strm.dev = &ctx->dev->plat_dev->dev;
+	ret = vb2_queue_init(&ctx->vq_strm);
+	if (ret) {
+		NX_ErrMsg(("Failed to initialize videobuf2 queue(capture)\n"));
+		return ret;
+	}
+
+	return 0;
+}
+
+int vpu_enc_open_instance(struct nx_vpu_ctx *ctx)
+{
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	struct nx_vpu_codec_inst *hInst = 0;
+	struct vpu_open_arg openArg;
+	int ret;
+
+	FUNC_IN();
+
+	memset(&openArg, 0, sizeof(openArg));
+
+	switch (ctx->strm_fmt->fourcc) {
+	case V4L2_PIX_FMT_MPEG4:
+		ctx->codec_mode = CODEC_STD_MPEG4;
+		break;
+	case V4L2_PIX_FMT_H264:
+		ctx->codec_mode = CODEC_STD_AVC;
+		break;
+	case V4L2_PIX_FMT_H263:
+		ctx->codec_mode = CODEC_STD_H263;
+		break;
+	case V4L2_PIX_FMT_MJPEG:
+		ctx->codec_mode = CODEC_STD_MJPG;
+		break;
+	default:
+		NX_ErrMsg(("Invalid codec type (%x)!!!\n",
+			ctx->strm_fmt->fourcc));
+		goto err_exit;
+	}
+	openArg.codecStd = ctx->codec_mode;
+
+	/* Allocate Instance Memory & Stream Buffer */
+	ctx->instance_buf = nx_alloc_memory(&dev->plat_dev->dev, WORK_BUF_SIZE,
+		4096);
+	if (ctx->instance_buf == NULL) {
+		NX_ErrMsg(("hinstance_buf allocation failed.\n"));
+		goto err_exit;
+	}
+
+	openArg.instanceBuf = *ctx->instance_buf;
+	openArg.instIndex = ctx->idx;
+	openArg.isEncoder = 1;
+
+	ret = NX_VpuEncOpen(&openArg, dev, &hInst);
+	if ((VPU_RET_OK != ret) || (0 == hInst)) {
+		NX_ErrMsg(("Cannot open VPU Instance!!!\n"));
+		NX_ErrMsg(("  codecStd=%d, is_encoder=%d, hInst=%p)\n",
+			openArg.codecStd, openArg.isEncoder, hInst));
+		ret = -1;
+		goto err_exit;
+	}
+
+	ctx->hInst = (void *)hInst;
+	dev->cur_num_instance++;
+
+	return ret;
+
+err_exit:
+	if (ctx->instance_buf)
+		nx_free_memory(ctx->instance_buf);
+
+	return ret;
+}
+
+static void get_stream_buffer(struct nx_vpu_ctx *ctx,
+	struct nx_memory_info *stream_buf)
+{
+	struct nx_vpu_buf *dst_mb;
+
+	FUNC_IN();
+
+	/* spin_lock_irqsave(&ctx->dev->irqlock, flags); */
+
+	dst_mb = list_entry(ctx->strm_queue.next, struct nx_vpu_buf, list);
+
+	stream_buf->phyAddr = nx_vpu_mem_plane_addr(&dst_mb->vb, 0);
+	stream_buf->size = vb2_plane_size(&dst_mb->vb, 0);
+#ifdef USE_ION_MEMORY
+	stream_buf->virAddr = (unsigned int)cma_get_virt(stream_buf->phyAddr,
+		stream_buf->size, 1);
+#else
+	stream_buf->virAddr = vb2_plane_vaddr(&dst_mb->vb, 0);
+#endif
+
+	/* spin_unlock_irqrestore(&ctx->dev->irqlock, flags); */
+}
+
+int vpu_enc_init(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_enc_ctx *enc_ctx = &ctx->codec.enc;
+	struct vpu_enc_seq_arg *pSeqArg = &ctx->codec.enc.seq_para;
+	int ret = 0;
+
+	FUNC_IN();
+
+	if (ctx->hInst == NULL) {
+		NX_ErrMsg(("Err : vpu is not opened\n"));
+		return -EAGAIN;
+	}
+
+	pSeqArg->strmBufPhyAddr = (uint64_t)ctx->bit_stream_buf->phyAddr;
+	pSeqArg->strmBufVirAddr = (unsigned long)ctx->bit_stream_buf->virAddr;
+	pSeqArg->strmBufSize = ctx->bit_stream_buf->size;
+
+	if ((pSeqArg->strmBufPhyAddr == 0) || (pSeqArg->strmBufSize == 0)) {
+		NX_ErrMsg(("stream buffer error(addr = %llx, size = %d)\n",
+			pSeqArg->strmBufPhyAddr, pSeqArg->strmBufSize));
+		return -1;
+	}
+
+	if ((pSeqArg->srcWidth == 0) || (pSeqArg->srcWidth > 1920) ||
+		(pSeqArg->srcHeight == 0) || (pSeqArg->srcHeight > 1088)) {
+		NX_ErrMsg(("resolution pamameter error(W = %d, H = %d)\n",
+			pSeqArg->srcWidth, pSeqArg->srcHeight));
+		return -1;
+	}
+
+	if (ctx->codec_mode != CODEC_STD_MJPG) {
+		if (pSeqArg->bitrate) {
+			if (pSeqArg->gammaFactor == 0)
+				pSeqArg->gammaFactor = (int)(0.75 * 32768);
+		} else {
+			if (enc_ctx->userIQP == 0)
+				enc_ctx->userIQP = 26;
+			if (enc_ctx->userPQP == 0)
+				enc_ctx->userPQP = 26;
+		}
+
+		if (ctx->codec_mode == CODEC_STD_AVC) {
+			if ((pSeqArg->maxQP > 51) || (pSeqArg->maxQP == 0))
+				pSeqArg->maxQP = 51;
+		} else {
+			if ((pSeqArg->maxQP > 31) || (pSeqArg->maxQP == 0))
+				pSeqArg->maxQP = 31;
+
+			if (ctx->codec_mode == CODEC_STD_H263)
+				pSeqArg->searchRange = 3;
+		}
+	} else {
+		pSeqArg->frameRateNum = 1;
+		pSeqArg->frameRateDen = 1;
+		pSeqArg->gopSize = 1;
+
+		switch (ctx->img_fmt->fourcc) {
+		case V4L2_PIX_FMT_YUV420M:
+			pSeqArg->imgFormat = IMG_FORMAT_420;
+			pSeqArg->chromaInterleave = 0;
+			break;
+		case V4L2_PIX_FMT_YUV422M:
+			pSeqArg->imgFormat = IMG_FORMAT_422;
+			pSeqArg->chromaInterleave = 0;
+			break;
+		case V4L2_PIX_FMT_YUV444M:
+			pSeqArg->imgFormat = IMG_FORMAT_444;
+			pSeqArg->chromaInterleave = 0;
+			break;
+		case V4L2_PIX_FMT_GREY:
+			pSeqArg->imgFormat = IMG_FORMAT_400;
+			break;
+		case V4L2_PIX_FMT_NV12M:
+			pSeqArg->imgFormat = IMG_FORMAT_420;
+			pSeqArg->chromaInterleave = 1;
+			break;
+		case V4L2_PIX_FMT_NV16M:
+			pSeqArg->imgFormat = IMG_FORMAT_422;
+			pSeqArg->chromaInterleave = 1;
+			break;
+		case V4L2_PIX_FMT_NV24M:
+			pSeqArg->imgFormat = IMG_FORMAT_444;
+			pSeqArg->chromaInterleave = 1;
+			break;
+		default:
+			NX_ErrMsg(("Color format is not supported!!"));
+			return -EINVAL;
+		}
+	}
+
+	ret = NX_VpuEncSetSeqParam(ctx->hInst, pSeqArg);
+	if (ret != VPU_RET_OK) {
+		NX_ErrMsg(("NX_VpuEncSetSeqParam() failed.(ErrorCode=%d)\n",
+			ret));
+		return ret;
+	}
+
+	if (ctx->codec_mode != CODEC_STD_MJPG) {
+		struct vpu_enc_set_frame_arg  frameArg;
+		union vpu_enc_get_header_arg *pHdrArg
+			= &ctx->codec.enc.seq_info;
+
+		/* We use always 2 frame */
+		frameArg.numFrameBuffer = 2;
+
+		frameArg.frameBuffer[0] = *enc_ctx->ref_recon_buf[0];
+		frameArg.frameBuffer[1] = *enc_ctx->ref_recon_buf[1];
+		frameArg.subSampleBuffer[0] = *enc_ctx->sub_sample_buf[0];
+		frameArg.subSampleBuffer[1] = *enc_ctx->sub_sample_buf[1];
+
+		/* data partition mode always disabled (for MPEG4) */
+		frameArg.dataPartitionBuffer.phyAddr = 0;
+		frameArg.dataPartitionBuffer.virAddr = 0;
+
+		frameArg.sramAddr = ctx->dev->sram_base_addr;
+		frameArg.sramSize = ctx->dev->sram_size;
+
+		ret = NX_VpuEncSetFrame(ctx->hInst, &frameArg);
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncSetFrame() is failed!(ret = %d\n",
+				ret));
+			goto ERROR_EXIT;
+		}
+
+		ret = NX_VpuEncGetHeader(ctx->hInst, pHdrArg);
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncGetHeader() is failed!(ret = %d\n",
+				ret));
+			goto ERROR_EXIT;
+		}
+	}
+
+	enc_ctx->gop_frm_cnt = 0;
+
+ERROR_EXIT:
+	return ret;
+}
+
+void vpu_enc_get_seq_info(struct nx_vpu_ctx *ctx)
+{
+	struct nx_memory_info stream_buf;
+	union vpu_enc_get_header_arg *pHdr = &ctx->codec.enc.seq_info;
+	void *pvDst;
+
+	FUNC_IN();
+
+	if (ctx->codec_mode == CODEC_STD_AVC) {
+		get_stream_buffer(ctx, &stream_buf);
+		pvDst = stream_buf.virAddr;
+
+		NX_DrvMemcpy(pvDst, (void *)pHdr->avcHeader.spsData,
+			pHdr->avcHeader.spsSize);
+		pvDst += pHdr->avcHeader.spsSize;
+		NX_DrvMemcpy(pvDst, (void *)pHdr->avcHeader.ppsData,
+			pHdr->avcHeader.ppsSize);
+		ctx->strm_size = pHdr->avcHeader.spsSize +
+			pHdr->avcHeader.ppsSize;
+	} else if (ctx->codec_mode == CODEC_STD_MPEG4) {
+		get_stream_buffer(ctx, &stream_buf);
+		pvDst = stream_buf.virAddr;
+
+		NX_DrvMemcpy((void *)stream_buf.virAddr,
+			pHdr->mp4Header.vosData, pHdr->mp4Header.vosSize);
+		NX_DrvMemcpy((void *)stream_buf.virAddr +
+			pHdr->mp4Header.vosSize, pHdr->mp4Header.volData,
+			pHdr->mp4Header.volSize);
+		ctx->strm_size = pHdr->mp4Header.vosSize +
+			pHdr->mp4Header.volSize;
+	} else {
+		ctx->strm_size = 0;
+	}
+
+	{
+		struct nx_vpu_buf *dst_mb;
+		unsigned long flags;
+
+		spin_lock_irqsave(&ctx->dev->irqlock, flags);
+
+		dst_mb = list_entry(ctx->strm_queue.next, struct nx_vpu_buf,
+			list);
+		list_del(&dst_mb->list);
+		ctx->strm_queue_cnt--;
+
+		vb2_set_plane_payload(&dst_mb->vb, 0, ctx->strm_size);
+		vb2_buffer_done(&dst_mb->vb, VB2_BUF_STATE_DONE);
+
+		spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
+	}
+}
+
+int vpu_enc_encode_frame(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_enc_ctx *enc_ctx = &ctx->codec.enc;
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	struct nx_vpu_codec_inst *hInst = ctx->hInst;
+	int ret = 0, i;
+	unsigned long flags;
+	struct nx_vpu_buf *mb_entry;
+	struct vpu_enc_run_frame_arg *pRunArg = &enc_ctx->run_info;
+	struct nx_memory_info stream_buf;
+	int num_planes;
+
+	FUNC_IN();
+
+	if (ctx->hInst == NULL) {
+		NX_ErrMsg(("Err : vpu is not opened\n"));
+		return -EAGAIN;
+	}
+
+	if (enc_ctx->chg_para.chgFlg) {
+		ret = NX_VpuEncChgParam(hInst, &enc_ctx->chg_para);
+		if (ret != VPU_RET_OK) {
+			NX_ErrMsg(("NX_VpuEncChgParam() failed.(Err=%d)\n",
+				ret));
+			return ret;
+		}
+
+		NX_DrvMemset(&enc_ctx->chg_para, 0, sizeof(enc_ctx->chg_para));
+	}
+
+	get_stream_buffer(ctx, &stream_buf);
+
+	spin_lock_irqsave(&dev->irqlock, flags);
+
+	mb_entry = list_entry(ctx->img_queue.next, struct nx_vpu_buf, list);
+
+	num_planes = ctx->useSingleBuf || ctx->img_fmt->singleBuffer ? 1 :
+		ctx->img_fmt->chromaInterleave ? 2 : 3;
+	for (i = 0 ; i < num_planes ; i++) {
+		pRunArg->inImgBuffer.phyAddr[i] = nx_vpu_mem_plane_addr(
+			&mb_entry->vb, i);
+		pRunArg->inImgBuffer.strideY = ctx->buf_y_width;
+	}
+
+	if( num_planes == 1 && ctx->chroma_size > 0 ) {
+		pRunArg->inImgBuffer.phyAddr[1] = ctx->luma_size +
+			pRunArg->inImgBuffer.phyAddr[0];
+		if (ctx->chromaInterleave == 0)
+			pRunArg->inImgBuffer.phyAddr[2] = ctx->chroma_size +
+				pRunArg->inImgBuffer.phyAddr[1];
+	}
+
+	spin_unlock_irqrestore(&dev->irqlock, flags);
+
+	dev->curr_ctx = ctx->idx;
+
+	if (ctx->codec_mode != V4L2_PIX_FMT_MJPEG) {
+		if ((enc_ctx->gop_frm_cnt >= enc_ctx->seq_para.gopSize) ||
+			(enc_ctx->gop_frm_cnt == 0))
+			pRunArg->forceIPicture = 1;
+
+		enc_ctx->gop_frm_cnt = (pRunArg->forceIPicture) ?
+			(1) : (enc_ctx->gop_frm_cnt + 1);
+	}
+
+	ret = NX_VpuEncRunFrame(hInst, pRunArg);
+	if (ret != VPU_RET_OK) {
+		NX_ErrMsg(("NX_VpuEncRunFrame() failed.(ErrorCode=%d)\n", ret));
+		return ret;
+	}
+
+	memcpy(stream_buf.virAddr,
+		(void *)(unsigned long)pRunArg->outStreamAddr,
+		pRunArg->outStreamSize);
+	ctx->strm_size = pRunArg->outStreamSize;
+
+	spin_lock_irqsave(&dev->irqlock, flags);
+
+	if (ctx->img_queue_cnt > 0) {
+		mb_entry = list_entry(ctx->img_queue.next, struct nx_vpu_buf,
+			list);
+		list_del(&mb_entry->list);
+		ctx->img_queue_cnt--;
+
+		vb2_buffer_done(&mb_entry->vb, VB2_BUF_STATE_DONE);
+	}
+
+	if (ctx->strm_size > 0) {
+		struct vb2_v4l2_buffer *vbuf;
+		mb_entry = list_entry(ctx->strm_queue.next, struct nx_vpu_buf,
+			list);
+
+		list_del(&mb_entry->list);
+		ctx->strm_queue_cnt--;
+		vbuf = to_vb2_v4l2_buffer(&mb_entry->vb);
+
+		switch (pRunArg->frameType) {
+			case 0:
+			case 6:
+				vbuf->flags = V4L2_BUF_FLAG_KEYFRAME;
+				break;
+			case 1:
+				vbuf->flags = V4L2_BUF_FLAG_PFRAME;
+				break;
+			case 2:
+			case 3:
+				vbuf->flags = V4L2_BUF_FLAG_BFRAME;
+				break;
+			default:
+				vbuf->flags = V4L2_BUF_FLAG_PFRAME;
+				NX_ErrMsg(("not defined frame type!!!\n"));
+				break;
+		}
+		vb2_set_plane_payload(&mb_entry->vb, 0, ctx->strm_size);
+
+		vb2_buffer_done(&mb_entry->vb, VB2_BUF_STATE_DONE);
+	}
+
+	spin_unlock_irqrestore(&dev->irqlock, flags);
+
+	return ret;
+}
+
+static int alloc_encoder_memory(struct nx_vpu_ctx *ctx)
+{
+	int width, height, i;
+	struct vpu_enc_ctx *enc_ctx = &ctx->codec.enc;
+	void *drv = &ctx->dev->plat_dev->dev;
+
+	FUNC_IN();
+
+	width = ALIGN(ctx->width, 16);
+	height = ALIGN(ctx->height, 16);
+
+	if (ctx->codec_mode != CODEC_STD_MJPG) {
+		int num;
+		uint32_t format;
+
+		if (enc_ctx->reconChromaInterleave == 0) {
+			num = 3;
+			format = V4L2_PIX_FMT_YUV420M;
+		} else {
+			num = 2;
+			format = V4L2_PIX_FMT_NV12M;
+		}
+
+		for (i = 0 ; i < 2 ; i++) {
+			enc_ctx->ref_recon_buf[i] = nx_alloc_frame_memory(drv,
+				width, height, num, format, 64);
+
+			if (enc_ctx->ref_recon_buf[i] == 0) {
+				NX_ErrMsg(("alloc(%d,%d,..) failed(recon%d)\n",
+					width, height, i));
+				goto Error_Exit;
+			}
+
+			enc_ctx->sub_sample_buf[i] = nx_alloc_memory(drv,
+				width * height/4, 4096);
+			if (enc_ctx->sub_sample_buf[i] == 0) {
+				NX_ErrMsg(("sub_buf allocation failed\n"));
+				NX_ErrMsg(("  size = %d, align = %d)\n",
+					width * height, 16));
+				goto Error_Exit;
+			}
+		}
+	}
+
+	ctx->bit_stream_buf = nx_alloc_memory(drv, STREAM_BUF_SIZE, 4096);
+	if (0 == ctx->bit_stream_buf) {
+		NX_ErrMsg(("bit_stream_buf allocation failed.\n"));
+		NX_ErrMsg(("  size = %d, align = %d)\n",
+			STREAM_BUF_SIZE, 4096));
+		goto Error_Exit;
+	}
+
+	return 0;
+
+Error_Exit:
+	free_encoder_memory(ctx);
+	return -1;
+}
+
+static int free_encoder_memory(struct nx_vpu_ctx *ctx)
+{
+	struct vpu_enc_ctx *enc_ctx = &ctx->codec.enc;
+
+	FUNC_IN();
+
+	if (!ctx) {
+		NX_ErrMsg(("invalid encoder handle!!!\n"));
+		return -1;
+	}
+
+	/* Free Reconstruct Buffer & Reference Buffer */
+	if (enc_ctx->ref_recon_buf[0])
+		nx_free_frame_memory(enc_ctx->ref_recon_buf[0]);
+
+	if (enc_ctx->ref_recon_buf[1])
+		nx_free_frame_memory(enc_ctx->ref_recon_buf[1]);
+
+	/* Free SubSampleb Buffer */
+	if (enc_ctx->sub_sample_buf[0])
+		nx_free_memory(enc_ctx->sub_sample_buf[0]);
+
+	if (enc_ctx->sub_sample_buf[1])
+		nx_free_memory(enc_ctx->sub_sample_buf[1]);
+
+	/* Free Bitstream Buffer */
+	if (ctx->bit_stream_buf)
+		nx_free_memory(ctx->bit_stream_buf);
+
+	if (ctx->instance_buf)
+		nx_free_memory(ctx->instance_buf);
+
+	return 0;
+}
+
+void nx_vpu_enc_close_instance(struct nx_vpu_ctx *ctx)
+{
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+
+	if (ctx->hInst) {
+		int ret = NX_VpuEncClose(ctx->hInst, (void*)&dev->vpu_event_present);
+		if (ret != 0)
+			NX_ErrMsg(("Failed to return an instance.\n"));
+		free_encoder_memory(ctx);
+		--dev->cur_num_instance;
+		ctx->hInst = NULL;
+	}
+}
+
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_gdi.c b/drivers/media/platform/nxp-vpu/nx_vpu_gdi.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_gdi.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_gdi.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,670 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vpu_hw_interface.h"		/* Register Access */
+#include "nx_vpu_gdi.h"
+#include "nx_port_func.h"
+
+
+#define XY2CONFIG(A, B, C, D, E, F, G, H, I) \
+	((A)<<20 | (B)<<19 | (C)<<18 | (D)<<17 | (E)<<16 | (F)<<12 | (G)<<8 | \
+	 (H)<<4 | (I))
+#define XY2(A, B, C, D)                 ((A)<<12 | (B)<<8 | (C)<<4 | (D))
+#define XY2BANK(A, B, C, D, E, F) \
+	((A)<<13 | (B)<<12 | (C)<<8 | (D)<<5 | (E)<<4 | (F))
+#define RBC(A, B, C, D)                 ((A)<<10 | (B)<<6 | (C)<<4 | (D))
+#define RBC_SAME(A, B)                  ((A)<<10 | (B)<<6 | (A)<<4 | (B))
+
+#define NUM_MB_720	                ((1280/16) * (720/16))
+#define NUM_MB_1080	                ((1920/16) * (1088/16))
+#define NUM_MB_SD	                ((720/16) * (576/16))
+
+/* DRAM configuration for TileMap access */
+#define EM_RAS                          13
+#define EM_BANK                         3
+#define EM_CAS                          10
+#define EM_WIDTH                        2
+
+
+struct gdi_tiled_map {
+	int xy2ca_map[16];
+	int xy2ba_map[16];
+	int xy2ra_map[16];
+	int rbc2axi_map[32];
+	int MapType;
+
+	int xy2rbc_config;
+	int tb_separate_map;
+	int top_bot_split;
+	int tiledMap;
+	int ca_inc_hor;
+	int val;
+};
+
+enum {
+	CA_SEL  = 0,
+	BA_SEL  = 1,
+	RA_SEL  = 2,
+	Z_SEL   = 3,
+};
+
+enum {
+	X_SEL   = 0,
+	Y_SEL   = 1,
+};
+
+struct tiled_map_config {
+	int  xy2caMap[16];
+	int  xy2baMap[16];
+	int  xy2raMap[16];
+	int  rbc2axiMap[32];
+	int  mapType;
+	int  xy2rbcConfig;
+
+	int  tiledBaseAddr;
+	int  tbSeparateMap;
+	int  topBotSplit;
+	int  tiledMap;
+	int  caIncHor;
+	int  convLinear;
+};
+
+struct dram_config {
+	int  rasBit;
+	int  casBit;
+	int  bankBit;
+	int  busBit;
+};
+
+
+int SetTiledMapType(int mapType, int stride, int interleave)
+{
+	int ret;
+	int luma_map;
+	int chro_map;
+	int i;
+	struct tiled_map_config mapCfg;
+	struct dram_config dramCfg;
+
+	dramCfg.rasBit = EM_RAS;
+	dramCfg.casBit = EM_CAS;
+	dramCfg.bankBit = EM_BANK;
+	dramCfg.busBit = EM_WIDTH;
+
+	NX_DrvMemset(&mapCfg, 0, sizeof(mapCfg));
+
+	mapCfg.mapType = mapType;
+	mapCfg.xy2rbcConfig = 0;
+
+	/* inv = 1'b0, zero = 1'b1 , tbxor = 1'b0, xy = 1'b0, bit = 4'd0 */
+	luma_map = 64;
+	chro_map = 64;
+
+	for (i = 0; i < 16 ; i = i+1)
+		mapCfg.xy2caMap[i] = luma_map << 8 | chro_map;
+
+	for (i = 0; i < 4;  i = i+1)
+		mapCfg.xy2baMap[i] = luma_map << 8 | chro_map;
+
+	for (i = 0; i < 16; i = i+1)
+		mapCfg.xy2raMap[i] = luma_map << 8 | chro_map;
+
+	/* this will be removed after map size optimizing. */
+	ret = stride;
+	ret = 0;
+
+	if (dramCfg.casBit == 9 && dramCfg.bankBit == 2 &&
+		dramCfg.rasBit == 13) {
+		mapCfg.rbc2axiMap[0]  = RBC(Z_SEL,  0, Z_SEL,  0);
+		mapCfg.rbc2axiMap[1]  = RBC(Z_SEL,  0, Z_SEL,  0);
+		mapCfg.rbc2axiMap[2]  = RBC(Z_SEL,  0, Z_SEL,  0);
+		mapCfg.rbc2axiMap[3]  = RBC(CA_SEL, 0, CA_SEL, 0);
+		mapCfg.rbc2axiMap[4]  = RBC(CA_SEL, 1, CA_SEL, 1);
+		mapCfg.rbc2axiMap[5]  = RBC(CA_SEL, 2, CA_SEL, 2);
+		mapCfg.rbc2axiMap[6]  = RBC(CA_SEL, 3, CA_SEL, 3);
+		mapCfg.rbc2axiMap[7]  = RBC(CA_SEL, 4, CA_SEL, 4);
+		mapCfg.rbc2axiMap[8]  = RBC(CA_SEL, 5, CA_SEL, 5);
+		mapCfg.rbc2axiMap[9]  = RBC(CA_SEL, 6, CA_SEL, 6);
+		mapCfg.rbc2axiMap[10] = RBC(CA_SEL, 7, CA_SEL, 7);
+		mapCfg.rbc2axiMap[11] = RBC(CA_SEL, 8, CA_SEL, 8);
+
+		mapCfg.rbc2axiMap[12] = RBC(BA_SEL, 0, BA_SEL, 0);
+		mapCfg.rbc2axiMap[13] = RBC(BA_SEL, 1, BA_SEL, 1);
+
+		mapCfg.rbc2axiMap[14] = RBC(RA_SEL, 0,  RA_SEL, 0);
+		mapCfg.rbc2axiMap[15] = RBC(RA_SEL, 1,  RA_SEL, 1);
+		mapCfg.rbc2axiMap[16] = RBC(RA_SEL, 2,  RA_SEL, 2);
+		mapCfg.rbc2axiMap[17] = RBC(RA_SEL, 3,  RA_SEL, 3);
+		mapCfg.rbc2axiMap[18] = RBC(RA_SEL, 4,  RA_SEL, 4);
+		mapCfg.rbc2axiMap[19] = RBC(RA_SEL, 5,  RA_SEL, 5);
+		mapCfg.rbc2axiMap[20] = RBC(RA_SEL, 6,  RA_SEL, 6);
+		mapCfg.rbc2axiMap[21] = RBC(RA_SEL, 7,  RA_SEL, 7);
+		mapCfg.rbc2axiMap[22] = RBC(RA_SEL, 8,  RA_SEL, 8);
+		mapCfg.rbc2axiMap[23] = RBC(RA_SEL, 9,  RA_SEL, 9);
+		mapCfg.rbc2axiMap[24] = RBC(RA_SEL, 10, RA_SEL, 10);
+		mapCfg.rbc2axiMap[25] = RBC(RA_SEL, 11, RA_SEL, 11);
+		mapCfg.rbc2axiMap[26] = RBC(RA_SEL, 12, RA_SEL, 12);
+		mapCfg.rbc2axiMap[27] = RBC(RA_SEL, 13, RA_SEL, 13);
+		mapCfg.rbc2axiMap[28] = RBC(RA_SEL, 14, RA_SEL, 14);
+		mapCfg.rbc2axiMap[29] = RBC(RA_SEL, 15, RA_SEL, 15);
+		mapCfg.rbc2axiMap[30] = RBC(Z_SEL,  0,  Z_SEL,  0);
+		mapCfg.rbc2axiMap[31] = RBC(Z_SEL,  0,  Z_SEL,  0);
+		ret = 1;
+	} else if (dramCfg.casBit == 10 && dramCfg.bankBit == 3 &&
+		dramCfg.rasBit == 13) {
+		mapCfg.rbc2axiMap[0]  = RBC(Z_SEL,  0,  Z_SEL, 0);
+		mapCfg.rbc2axiMap[1]  = RBC(Z_SEL,  0,  Z_SEL, 0);
+		mapCfg.rbc2axiMap[2]  = RBC(CA_SEL, 0, CA_SEL, 0);
+		mapCfg.rbc2axiMap[3]  = RBC(CA_SEL, 1, CA_SEL, 1);
+		mapCfg.rbc2axiMap[4]  = RBC(CA_SEL, 2, CA_SEL, 2);
+		mapCfg.rbc2axiMap[5]  = RBC(CA_SEL, 3, CA_SEL, 3);
+		mapCfg.rbc2axiMap[6]  = RBC(CA_SEL, 4, CA_SEL, 4);
+		mapCfg.rbc2axiMap[7]  = RBC(CA_SEL, 5, CA_SEL, 5);
+		mapCfg.rbc2axiMap[8]  = RBC(CA_SEL, 6, CA_SEL, 6);
+		mapCfg.rbc2axiMap[9]  = RBC(CA_SEL, 7, CA_SEL, 7);
+		mapCfg.rbc2axiMap[10] = RBC(CA_SEL, 8, CA_SEL, 8);
+		mapCfg.rbc2axiMap[11] = RBC(CA_SEL, 9, CA_SEL, 9);
+
+		mapCfg.rbc2axiMap[12] = RBC(BA_SEL, 0, BA_SEL, 0);
+		mapCfg.rbc2axiMap[13] = RBC(BA_SEL, 1, BA_SEL, 1);
+		mapCfg.rbc2axiMap[14] = RBC(BA_SEL, 2, BA_SEL, 2);
+
+		mapCfg.rbc2axiMap[15] = RBC(RA_SEL, 0,  RA_SEL, 0);
+		mapCfg.rbc2axiMap[16] = RBC(RA_SEL, 1,  RA_SEL, 1);
+		mapCfg.rbc2axiMap[17] = RBC(RA_SEL, 2,  RA_SEL, 2);
+		mapCfg.rbc2axiMap[18] = RBC(RA_SEL, 3,  RA_SEL, 3);
+		mapCfg.rbc2axiMap[19] = RBC(RA_SEL, 4,  RA_SEL, 4);
+		mapCfg.rbc2axiMap[20] = RBC(RA_SEL, 5,  RA_SEL, 5);
+		mapCfg.rbc2axiMap[21] = RBC(RA_SEL, 6,  RA_SEL, 6);
+		mapCfg.rbc2axiMap[22] = RBC(RA_SEL, 7,  RA_SEL, 7);
+		mapCfg.rbc2axiMap[23] = RBC(RA_SEL, 8,  RA_SEL, 8);
+		mapCfg.rbc2axiMap[24] = RBC(RA_SEL, 9,  RA_SEL, 9);
+		mapCfg.rbc2axiMap[25] = RBC(RA_SEL, 10, RA_SEL, 10);
+		mapCfg.rbc2axiMap[26] = RBC(RA_SEL, 11, RA_SEL, 11);
+		mapCfg.rbc2axiMap[27] = RBC(RA_SEL, 12, RA_SEL, 12);
+		mapCfg.rbc2axiMap[28] = RBC(Z_SEL,  0,  Z_SEL,  0);
+		mapCfg.rbc2axiMap[29] = RBC(Z_SEL,  0,  Z_SEL,  0);
+		mapCfg.rbc2axiMap[30] = RBC(Z_SEL,  0,  Z_SEL,  0);
+		mapCfg.rbc2axiMap[31] = RBC(Z_SEL,  0,  Z_SEL,  0);
+		ret = 1;
+	}
+
+	/*xy2ca_map */
+	for (i = 0; i < 16; i++)
+		VpuWriteReg(GDI_XY2_CAS_0 + 4*i, mapCfg.xy2caMap[i]);
+
+	/*xy2baMap */
+	for (i = 0; i < 4; i++)
+		VpuWriteReg(GDI_XY2_BA_0  + 4*i, mapCfg.xy2baMap[i]);
+
+	/*xy2raMap */
+	for (i = 0; i < 16; i++)
+		VpuWriteReg(GDI_XY2_RAS_0 + 4*i, mapCfg.xy2raMap[i]);
+
+	/*xy2rbcConfig */
+	VpuWriteReg(GDI_XY2_RBC_CONFIG, mapCfg.xy2rbcConfig);
+
+	/*// fast access for reading */
+	mapCfg.tbSeparateMap = (mapCfg.xy2rbcConfig >> 19) & 0x1;
+	mapCfg.topBotSplit = (mapCfg.xy2rbcConfig >> 18) & 0x1;
+	mapCfg.tiledMap = (mapCfg.xy2rbcConfig >> 17) & 0x1;
+	mapCfg.caIncHor	= (mapCfg.xy2rbcConfig >> 16) & 0x1;
+
+	/* RAS, BA, CAS -> Axi Addr */
+	for (i = 0; i < 32; i++)
+		VpuWriteReg(GDI_RBC2_AXI_0 + 4*i, mapCfg.rbc2axiMap[i]);
+
+	return ret;
+}
+
+/*
+ *	Internal SRAM Memory Map (for Encding)
+ *
+ *	|                  |
+ *	|------------------| SRAM High Address
+ *	|                  |
+ *	|  Deblock Chroma  | <-- H.263 : if (width>720) use external ram
+ *	|                  |
+ *	|------------------|
+ *	|                  |
+ *	|  Deblock Luma    | <-- H.263 : if (width>720) use external ram
+ *	|                  |
+ *	|------------------|
+ *	|                  |
+ *	|  Prediction Buf  |
+ *	|     (AC/DC)      |
+ *	|                  |
+ *	|------------------|
+ *	|                  |
+ *	| Intra Prediction | <-- H.264 : if (width>720) use external ram
+ *	|                  |
+ *	|------------------|
+ *	|                  |
+ *	|  BIT Processor   |
+ *	|                  |
+ *	|------------------| SRAM Low Address
+ *	|                  |
+ */
+
+int ConfigEncSecAXI(int codStd, struct sec_axi_info *sa, int width,
+	int height, uint32_t sramAddr, uint32_t sramSize)
+{
+	int offset;
+	int MbNumX = ((width & 0xFFFF) + 15) / 16;
+	int MbNumY = ((height & 0xFFFF) + 15) / 16;
+	int totalMB = MbNumX * MbNumY;
+	uint32_t sramPhyAddr = sramAddr;
+
+	/* useIpEnable : Intra Prediction
+	 * useDbkYEnable : Deblocking Luminance
+	 * useDbkCEnable : Deblocking Chrominance
+	 * useBitEnable : BitAxiSecEn (USE Bit Processor)
+	 * useOvlEnable : Enabled Overlap Filter(VC-1 Only)
+	 * useBtpEnable : Enable BTP(Bit-Plane)(VC-1 Only)
+	 */
+	if (sramSize > 0) {
+		switch (codStd) {
+		case CODEC_STD_AVC:
+			sa->useIpEnable = 1;
+			sa->useBitEnable = 1;
+			sa->useDbkYEnable = 0;
+			sa->useDbkCEnable = 0;
+			sa->useOvlEnable = 0;
+			sa->useBtpEnable = 0;
+			break;
+		case CODEC_STD_MPEG4:
+			sa->useBitEnable = 1;
+			sa->useIpEnable = 1;
+			sa->useDbkYEnable = 1;
+			sa->useDbkCEnable = 1;
+			sa->useOvlEnable = 0;
+			sa->useBtpEnable = 0;
+			break;
+		case CODEC_STD_H263:
+			if (totalMB > NUM_MB_SD) {
+				sa->useDbkYEnable = 0;
+				sa->useDbkCEnable = 0;
+			} else {
+				sa->useDbkYEnable = 1;
+				sa->useDbkCEnable = 1;
+			}
+			sa->useBitEnable = 1;
+			sa->useIpEnable = 1;
+			sa->useOvlEnable = 0;
+			sa->useBtpEnable = 0;
+			break;
+		}
+	} else {
+		sa->useIpEnable = 0;
+		sa->useBitEnable = 0;
+		sa->useDbkYEnable = 0;
+		sa->useDbkCEnable = 0;
+		sa->useOvlEnable = 0;
+		sa->useBtpEnable = 0;
+	}
+
+	offset = 0;
+
+	/* BIT Processor */
+	if (sa->useBitEnable) {
+		sa->bufBitUse = sramPhyAddr + offset;
+		if (CODEC_STD_AVC == codStd)
+			offset = offset + MbNumX * 144;
+		else
+			offset = offset + MbNumX *  16;
+	}
+
+	/* Intra Prediction,(H.264 Only) */
+	if (sa->useIpEnable /*&& CODEC_STD_AVC == codStd*/) {
+		sa->bufIpAcDcUse = sramPhyAddr + offset;
+		offset = offset + (MbNumX * 64);
+	}
+
+	/* Deblock Luma */
+	if (sa->useDbkYEnable) {
+		sa->bufDbkYUse = sramPhyAddr + offset;
+		if (CODEC_STD_AVC == codStd)
+			offset = offset + (MbNumX * 64);
+		else if (CODEC_STD_H263 == codStd)
+			offset = offset + MbNumX * 128;
+	}
+
+	/* Deblock Chroma */
+	if (sa->useDbkCEnable) {
+		sa->bufDbkCUse = sramPhyAddr + offset;
+		if (CODEC_STD_AVC == codStd)
+			offset = offset + (MbNumX * 64);
+		else if (CODEC_STD_H263 == codStd)
+			offset = offset + MbNumX * 128;
+	}
+	sa->bufSize = offset;
+
+	if (sa->bufSize > sramSize) {
+		NX_ErrMsg(("ConfigEncSecAXI() Failed!!!"));
+		NX_ErrMsg(("(bufSz=%d, sramSz=%d)\n", sa->bufSize, sramSize));
+		return VPU_RET_ERR_SRAM;
+	}
+
+	return VPU_RET_OK;
+}
+
+int ConfigDecSecAXI(int codStd, struct sec_axi_info *sa, int width, int height,
+	uint32_t sramAddr, uint32_t sramSize)
+{
+	int offset;
+	int MbNumX = ((width & 0xFFFF) + 15) / 16;
+	int MbNumY = ((height & 0xFFFF) + 15) / 16;
+	int totalMB = MbNumX * MbNumY;
+	int sramPhyAddr = sramAddr;
+
+	/* useIpEnable : Intra Prediction
+	 * useDbkYEnable : Deblocking Luminance
+	 * useDbkCEnable : Deblocking Chrominance
+	 * useBitEnable : BitAxiSecEn (USE Bit Processor)
+	 * useOvlEnable : Enabled Overlap Filter(VC-1 Only)
+	 * useBtpEnable : Enable BTP(Bit-Plane)(VC-1 Only) */
+	if (sramSize > 0) {
+		switch (codStd) {
+		case CODEC_STD_AVC:
+			if ((totalMB > NUM_MB_SD) && (totalMB <= NUM_MB_720)) {
+				sa->useIpEnable = 1;
+				sa->useDbkYEnable = 0;
+				sa->useDbkCEnable = 0;
+			}
+			if (totalMB > NUM_MB_720) {
+				sa->useIpEnable = 1;
+				sa->useDbkYEnable = 0;
+				sa->useDbkCEnable = 0;
+			} else {
+				sa->useIpEnable = 1;
+				sa->useDbkYEnable = 0;
+				sa->useDbkCEnable = 0;
+			}
+			sa->useBitEnable = 1;
+			sa->useOvlEnable = 1;
+			sa->useBtpEnable = 1;
+			break;
+		case CODEC_STD_VC1:
+			sa->useBitEnable = 1;
+			sa->useIpEnable = 0;
+			sa->useDbkYEnable = 0;
+			sa->useDbkCEnable = 0;
+			sa->useOvlEnable = 1;
+			sa->useBtpEnable = 1;
+			break;
+		case CODEC_STD_MPEG4:
+		case CODEC_STD_H263:
+		case CODEC_STD_MPEG2:
+			sa->useBitEnable = 1;
+			sa->useIpEnable = 1;
+			sa->useDbkYEnable = 0;
+			sa->useDbkCEnable = 0;
+			sa->useOvlEnable = 1;
+			sa->useBtpEnable = 1;
+			break;
+		case CODEC_STD_RV:
+			sa->useBitEnable = 1;
+			sa->useIpEnable = 1;
+			sa->useDbkYEnable = 0;
+			sa->useDbkCEnable = 0;
+			sa->useOvlEnable = 1;
+			sa->useBtpEnable = 1;
+			break;
+		}
+	} else {
+		sa->useBitEnable = 0;
+		sa->useIpEnable = 0;
+		sa->useDbkYEnable = 0;
+		sa->useDbkCEnable = 0;
+		sa->useOvlEnable = 0;
+		sa->useBtpEnable = 0;
+	}
+
+	offset = 0;
+
+	/* BIT */
+	if (sa->useBitEnable) {
+		sa->useBitEnable = 1;
+		sa->bufBitUse = sramPhyAddr + offset;
+
+		switch (codStd) {
+		case CODEC_STD_AVC:
+			offset = offset + MbNumX * 144;
+			break;
+		case CODEC_STD_RV:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_VC1:
+			offset = offset + MbNumX * 64;
+			break;
+		case CODEC_STD_AVS:
+			offset = offset + (MbNumX + (MbNumX%4)) * 32;
+			break;
+		case CODEC_STD_MPEG2:
+			offset = offset + MbNumX * 0;
+			break;
+		case CODEC_STD_VP8:
+			offset = offset + MbNumX * 128;
+			break;
+		default:
+			offset = offset + MbNumX * 16;
+			break;/* MPEG-4, Divx3 */
+		}
+
+		if (offset > sramSize) {
+			sa->bufSize = 0;
+			return 0;
+		}
+	}
+
+	/* Intra Prediction, ACDC */
+	if (sa->useIpEnable) {
+		sa->bufIpAcDcUse = sramPhyAddr + offset;
+		sa->useIpEnable = 1;
+
+		switch (codStd) {
+		case CODEC_STD_AVC:
+			offset = offset + MbNumX * 64;
+			break;
+		case CODEC_STD_RV:
+			offset = offset + MbNumX * 64;
+			break;
+		case CODEC_STD_VC1:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_AVS:
+			offset = offset + MbNumX * 64;
+			break;
+		case CODEC_STD_MPEG2:
+			offset = offset + MbNumX * 0;
+			break;
+		case CODEC_STD_VP8:
+			offset = offset + MbNumX * 64;
+			break;
+		default:
+			offset = offset + MbNumX * 128;
+			break;/* MPEG-4, Divx3 */
+		}
+
+		if (offset > sramSize) {
+			sa->bufSize = 0;
+			return 0;
+		}
+	}
+
+	/* Deblock Chroma */
+	if (sa->useDbkCEnable) {
+		sa->bufDbkCUse = sramPhyAddr + offset;
+		sa->useDbkCEnable = 1;
+		switch (codStd) {
+		case CODEC_STD_AVC:
+			offset = offset + (MbNumX * 128);
+			break;
+		case CODEC_STD_RV:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_VC1:
+			offset = offset + MbNumX * 256;
+			break;
+		case CODEC_STD_AVS:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_MPEG2:
+			offset = offset + MbNumX * 64;
+			break;
+		case CODEC_STD_VP8:
+			offset = offset + MbNumX * 128;
+			break;
+		default:
+			offset = offset + MbNumX * 64;
+			break;
+		}
+
+		if (offset > sramSize) {
+			sa->bufSize = 0;
+			return 0;
+		}
+	}
+
+	/* Deblock Luma */
+	if (sa->useDbkYEnable) {
+		sa->bufDbkYUse = sramPhyAddr + offset;
+		sa->useDbkYEnable = 1;
+
+		switch (codStd) {
+		case CODEC_STD_AVC:
+			offset = offset + (MbNumX * 128);
+			break;
+		case CODEC_STD_RV:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_VC1:
+			offset = offset + MbNumX * 256;
+			break;
+		case CODEC_STD_AVS:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_MPEG2:
+			offset = offset + MbNumX * 128;
+			break;
+		case CODEC_STD_VP8:
+			offset = offset + MbNumX * 128;
+			break;
+		default:
+			offset = offset + MbNumX * 128;
+			break;
+		}
+
+		if (offset > sramSize) {
+			sa->bufSize = 0;
+			return 0;
+		}
+	}
+
+	/* VC1 Bit-plane */
+	if (sa->useBtpEnable) {
+		if (codStd != CODEC_STD_VC1) {
+			sa->useBtpEnable = 0;
+		} else {
+			int oneBTP;
+
+			offset = ((offset+255)&~255);
+			sa->bufBtpUse = sramPhyAddr + offset;
+			sa->useBtpEnable = 1;
+
+			oneBTP  = (((MbNumX+15)/16) * MbNumY + 1) * 2;
+			oneBTP  = (oneBTP%256) ? ((oneBTP/256)+1)*256 : oneBTP;
+
+			offset = offset + oneBTP * 3;
+		}
+	}
+
+	/*VC1 Overlap */
+	if (sa->useOvlEnable) {
+		if (codStd != CODEC_STD_VC1) {
+			sa->useOvlEnable = 0;
+		} else {
+			sa->bufOvlUse = sramPhyAddr + offset;
+			sa->useOvlEnable = 1;
+
+			offset = offset + MbNumX *  80;
+		}
+	}
+
+	sa->bufSize = offset;
+
+	if (sa->bufSize > sramSize) {
+		NX_ErrMsg(("ConfigDecSecAXI() Failed!!!"));
+		NX_ErrMsg(("bufSz=%d, sramSz=%d)\n", sa->bufSize, sramSize));
+		return VPU_RET_ERR_SRAM;
+	}
+
+	return 1;
+}
+
+/* Maverick Cache II */
+unsigned int MaverickCache2Config(int decoder, int interleave, int bypass,
+	int burst, int merge, int mapType, int wayshape)
+{
+	unsigned int cacheConfig = 0;
+
+	if (decoder) {
+		/* LINEAR_FRAME_MAP */
+		if (mapType == 0) {
+			/* VC1 opposite field padding is not allowable in UV
+			separated, burst 8 and linear map */
+			if (!interleave)
+				burst = 0;
+
+			wayshape = 15;
+
+			if (merge == 1)
+				merge = 3;
+
+			/*GDI constraint. Width should not be over 64 */
+			if ((merge == 1) && (burst))
+				burst = 0;
+		} else {
+			/*horizontal merge constraint in tiled map */
+			if (merge == 1)
+				merge = 3;
+		}
+	} else {
+		if (mapType == 0) {
+			wayshape = 15;
+
+			/*GDI constraint. Width should not be over 64 */
+			if ((merge == 1) && (burst))
+				burst = 0;
+		} else {
+			/*horizontal merge constraint in tiled map */
+			if (merge == 1)
+				merge = 3;
+		}
+	}
+
+	cacheConfig = (merge & 0x3) << 9;
+	cacheConfig = cacheConfig | ((wayshape & 0xf) << 5);
+	cacheConfig = cacheConfig | ((burst & 0x1) << 3);
+	cacheConfig = cacheConfig | (bypass & 0x3);
+
+	if (mapType != 0)
+		cacheConfig = cacheConfig | 0x00000004;
+
+	return cacheConfig;
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_gdi.h b/drivers/media/platform/nxp-vpu/nx_vpu_gdi.h
--- a/drivers/media/platform/nxp-vpu/nx_vpu_gdi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_gdi.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_VPU_GDI_H__
+#define	__NX_VPU_GDI_H__
+
+int SetTiledMapType(int mapType, int stride, int interleave);
+int ConfigEncSecAXI(int codStd, struct sec_axi_info *sa, int width,
+	int height, uint32_t sramAddr, uint32_t sramSize);
+int ConfigDecSecAXI(int codStd, struct sec_axi_info *sa, int width,
+	int height, uint32_t sramAddr, uint32_t sramSize);
+unsigned int MaverickCache2Config(int decoder, int interleave, int bypass,
+	int burst, int merge, int mapType, int wayshape);
+
+#endif		/*__NX_VPU_GDI_H__ */
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.c b/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.c
--- a/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,1496 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/reset.h>
+#include <linux/slab.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/interrupt.h>
+
+#include <linux/videodev2.h>
+#include <linux/videodev2_nxp_media.h>
+
+#include <linux/soc/nexell/nx-media-device.h>
+
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-mem2mem.h>
+#include <media/videobuf2-dma-contig.h>
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+#include <linux/pm_qos.h>
+#include <linux/soc/nexell/cpufreq.h>
+#endif
+
+#include "nx_vpu_v4l2.h"
+#include "vpu_hw_interface.h"
+
+#define	NX_VIDEO_NAME "nx-vpu"
+#define	NX_VIDEO_ENC_NAME "nx-vpu-enc"
+#define	NX_VIDEO_DEC_NAME "nx-vpu-dec"
+
+static bool single_plane_mode;
+module_param(single_plane_mode, bool, 0444);
+
+static unsigned additional_buffer_count = 2;
+module_param(additional_buffer_count, uint, 0644);
+MODULE_PARM_DESC(additional_buffer_count,
+		"number of buffers above minimum required by coda vpu");
+
+#define INFO_MSG		0
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+static struct pm_qos_request nx_vpu_qos;
+
+static void nx_vpu_qos_update(int val)
+{
+	if (!pm_qos_request_active(&nx_vpu_qos))
+		pm_qos_add_request(&nx_vpu_qos, PM_QOS_BUS_THROUGHPUT, val);
+	else
+		pm_qos_update_request(&nx_vpu_qos, val);
+}
+#endif
+
+dma_addr_t nx_vpu_mem_plane_addr(struct vb2_buffer *v, unsigned n)
+{
+#ifdef USE_ION_MEMORY
+	void *cookie = vb2_plane_cookie(v, n);
+	dma_addr_t addr = 0;
+
+	WARN_ON(vb2_ion_dma_address(cookie, &addr) != 0);
+	return (unsigned long)addr;
+#else
+	return vb2_dma_contig_plane_dma_addr(v, n);
+#endif
+}
+
+int nx_vpu_enc_try_run(struct nx_vpu_ctx *ctx)
+{
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	struct vpu_enc_ctx *enc_ctx = &ctx->codec.enc;
+	unsigned int ret = 0;
+	void *err = (void *)(&dev->plat_dev->dev);
+
+	FUNC_IN();
+
+	NX_DbgMsg(INFO_MSG, ("cmd = %x\n", enc_ctx->vpu_cmd));
+
+	mutex_lock(&dev->vpu_mutex);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(1);
+#endif
+
+	__set_bit(ctx->idx, &dev->ctx_work_bits);
+
+	switch (enc_ctx->vpu_cmd) {
+	case GET_ENC_INSTANCE:
+		dev->curr_ctx = ctx->idx;
+		ret = vpu_enc_open_instance(ctx);
+		if (ret != 0)
+			dev_err(err, "Failed to create a new instance\n");
+		else
+			enc_ctx->vpu_cmd = ENC_RUN;
+		break;
+
+	case ENC_RUN:
+		if (enc_ctx->is_initialized == 0) {
+			ret = vpu_enc_init(ctx);
+			if (ret != 0)
+				dev_err(err, "enc_init failed, ret=%d\n", ret);
+			else{
+				enc_ctx->is_initialized = 1;
+				vpu_enc_get_seq_info(ctx);
+			}
+		} else {
+			ret = vpu_enc_encode_frame(ctx);
+			if (ret != 0) {
+				dev_err(err, "encode_frame is failed, ret=%d\n",
+					ret);
+				break;
+			}
+		}
+		break;
+
+	case SEQ_END:
+		if (enc_ctx->is_initialized) {
+			dev->curr_ctx = ctx->idx;
+			nx_vpu_enc_close_instance(ctx);
+			enc_ctx->is_initialized = 0;
+		}
+		break;
+
+	default:
+		ret = -EAGAIN;
+	}
+
+	__clear_bit(ctx->idx, &dev->ctx_work_bits);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+
+	mutex_unlock(&dev->vpu_mutex);
+
+	return ret;
+}
+
+int nx_vpu_dec_try_cmd(struct nx_vpu_ctx *ctx, enum nx_vpu_cmd vpu_cmd)
+{
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	struct vpu_dec_ctx *dec_ctx = &ctx->codec.dec;
+	unsigned int ret = 0;
+	void *err = (void *)(&dev->plat_dev->dev);
+
+	FUNC_IN();
+
+	NX_DbgMsg(INFO_MSG, ("cmd = %x\n", vpu_cmd));
+
+	mutex_lock(&dev->vpu_mutex);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(1);
+#endif
+
+	__set_bit(ctx->idx, &dev->ctx_work_bits);
+
+	switch( vpu_cmd ) {
+	case GET_DEC_INSTANCE:
+		if( dec_ctx->state == NX_VPUDEC_CLOSED ) {
+			dev->curr_ctx = ctx->idx;
+			ret = vpu_dec_open_instance(ctx);
+			if (ret != 0)
+				dev_err(err, "Failed to create a new instance.\n");
+			else{
+				ret = vpu_dec_parse_vid_cfg(ctx, single_plane_mode);
+				if (ret != 0) {
+					dev_err(err, "vpu_dec_parse_vfg error %d", ret);
+					nx_vpu_dec_close_instance(ctx);
+				}else{
+					dec_ctx->state = NX_VPUDEC_SET_FRAMEBUF;
+				}
+			}
+		}else{
+			dev_err(err, "GET_DEC_INSTANCE: already initialized\n");
+		}
+		break;
+
+	case DEC_RUN:
+		switch( dec_ctx->state ) {
+		case NX_VPUDEC_SET_FRAMEBUF:
+			ret = vpu_dec_init(ctx);
+			if (ret != 0)
+				dev_err(err, "vpu_dec_init failed, ret=%d\n", ret);
+			dec_ctx->state = NX_VPUDEC_RUNNING;
+			break;
+		case NX_VPUDEC_RUNNING:
+			ret = vpu_dec_decode_slice(ctx, false);
+			if (ret != 0)
+				dev_err(err, "vpu_dec_decode_slice failed, err=%d", ret);
+			break;
+		default:
+			break;
+		}
+		break;
+
+	case DEC_BUF_FLUSH:
+		switch( dec_ctx->state ) {
+		case NX_VPUDEC_SET_FRAMEBUF:
+			ret = NX_VpuDecFlush(ctx->hInst);
+			if( ret )
+				dev_err(err, "NX_VpuDecFlush err=%d", ret);
+			dec_ctx->state = NX_VPUDEC_FLUSHED;
+			break;
+		case NX_VPUDEC_RUNNING:
+			ret = vpu_dec_decode_slice(ctx, true);
+			if( ret )
+				dev_err(err, "vpu_dec_decode_slice err=%d", ret);
+			dec_ctx->state = NX_VPUDEC_FLUSHED;
+			break;
+		default:
+			break;
+		}
+		break;
+
+	case SEQ_END:
+		if( dec_ctx->state == NX_VPUDEC_SET_FRAMEBUF ||
+				dec_ctx->state == NX_VPUDEC_RUNNING )
+		{
+			ret = NX_VpuDecFlush(ctx->hInst);
+			if( ret )
+				dev_err(err, "NX_VpuDecFlush err=%d", ret);
+		}
+		if( dec_ctx->state != NX_VPUDEC_CLOSED ) {
+			dev->curr_ctx = ctx->idx;
+			nx_vpu_dec_close_instance(ctx);
+			dec_ctx->state = NX_VPUDEC_CLOSED;
+		}
+		break;
+
+	default:
+		ret = -EAGAIN;
+	}
+
+	__clear_bit(ctx->idx, &dev->ctx_work_bits);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+
+	mutex_unlock(&dev->vpu_mutex);
+
+	return ret;
+}
+
+
+/*-----------------------------------------------------------------------------
+ *      functions for Input/Output format
+ *----------------------------------------------------------------------------*/
+static const struct nx_vpu_image_fmt image_formats[] = {
+	{
+		.fourcc = V4L2_PIX_FMT_YUV420M,
+		.hsub = 2, .vsub = 2,
+		.chromaInterleave = false,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_YUV420,
+		.hsub = 2, .vsub = 2,
+		.chromaInterleave = false,
+		.singleBuffer = true,
+	},
+#if 0
+	{
+		.fourcc = V4L2_PIX_FMT_YUV422P,
+		.hsub = 2, .vsub = 1,
+		.chromaInterleave = false,
+		.singleBuffer = true,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_YUV444,
+		.hsub = 1, .vsub = 1,
+		.chromaInterleave = false,
+		.singleBuffer = true,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_GREY,
+		.hsub = 0, .vsub = 0,
+		.singleBuffer = true,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_YUV422M,
+		.hsub = 2, .vsub = 1,
+		.chromaInterleave = false,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_YUV444M,
+		.hsub = 1, .vsub = 1,
+		.chromaInterleave = false,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV12M,
+		.hsub = 2, .vsub = 2,
+		.chromaInterleave = true,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV21M,
+		.hsub = 2, .vsub = 2,
+		.chromaInterleave = true,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV16M,
+		.hsub = 2, .vsub = 1,
+		.chromaInterleave = true,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV61M,
+		.hsub = 2, .vsub = 1,
+		.chromaInterleave = true,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV24M,
+		.hsub = 1, .vsub = 1,
+		.chromaInterleave = true,
+		.singleBuffer = false,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV42M,
+		.hsub = 1, .vsub = 1,
+		.chromaInterleave = true,
+		.singleBuffer = false,
+	},
+#endif
+};
+
+static const struct nx_vpu_stream_fmt stream_formats[] = {
+	{
+		.fourcc = V4L2_PIX_FMT_MPEG2,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_MPEG4,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_XVID,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_DIV3,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_DIV4,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_DIV5,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_DIV6,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_DIVX,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_H263,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_H264,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_WMV9,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_WVC1,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_RV8,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_RV9,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_VP8,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_FLV1,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_THEORA,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_MJPEG,
+	},
+};
+
+const struct nx_vpu_image_fmt *nx_find_image_format(unsigned fourcc)
+{
+	unsigned int i;
+
+	FUNC_IN();
+
+	for (i = 0 ; i < ARRAY_SIZE(image_formats); i++) {
+		if (image_formats[i].fourcc == fourcc)
+			return &image_formats[i];
+	}
+	return NULL;
+}
+
+const struct nx_vpu_stream_fmt *nx_find_stream_format(struct v4l2_format *f)
+{
+	unsigned int i;
+
+	FUNC_IN();
+
+	for (i = 0 ; i < ARRAY_SIZE(stream_formats); i++) {
+		if (stream_formats[i].fourcc == f->fmt.pix_mp.pixelformat)
+			return &stream_formats[i];
+	}
+	return NULL;
+}
+
+/*-----------------------------------------------------------------------------
+ *      functions for vidioc_queryctrl
+ *----------------------------------------------------------------------------*/
+
+/* Query capabilities of the device */
+int vidioc_querycap(struct file *file, void *priv, struct v4l2_capability *cap)
+{
+	struct nx_vpu_v4l2 *dev = video_drvdata(file);
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+
+	FUNC_IN();
+
+	strncpy(cap->driver, dev->plat_dev->name, sizeof(cap->driver) - 1);
+	strncpy(cap->card, dev->plat_dev->name, sizeof(cap->card) - 1);
+	snprintf(cap->bus_info, sizeof(cap->bus_info), "platform:%s",
+		 dev_name(&dev->plat_dev->dev));
+	cap->device_caps = (ctx->vq_strm.type == V4L2_BUF_TYPE_VIDEO_OUTPUT ?
+			V4L2_CAP_VIDEO_M2M : V4L2_CAP_VIDEO_M2M_MPLANE) |
+		V4L2_CAP_STREAMING;
+	cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS;
+
+	return 0;
+}
+
+int nx_vidioc_enum_fmt_vid_image(struct file *file, void *pirv,
+	struct v4l2_fmtdesc *f)
+{
+	int i, j = -1;
+
+	for( i = 0; i < ARRAY_SIZE(image_formats); ++i ) {
+		if( image_formats[i].singleBuffer ) {
+			if( ++j == f->index ) {
+				f->pixelformat = image_formats[i].fourcc;
+				return 0;
+			}
+		}
+	}
+	return -EINVAL;
+}
+
+int nx_vidioc_enum_fmt_vid_image_mplane(struct file *file, void *pirv,
+	struct v4l2_fmtdesc *f)
+{
+	if( f->index >= ARRAY_SIZE(image_formats) )
+		return -EINVAL;
+	f->pixelformat = image_formats[f->index].fourcc;
+	return 0;
+}
+
+int nx_vidioc_enum_fmt_vid_stream(struct file *file, void *prov,
+	struct v4l2_fmtdesc *f)
+{
+	if( f->index >= ARRAY_SIZE(stream_formats) )
+		return -EINVAL;
+	f->pixelformat = stream_formats[f->index].fourcc;
+	return 0;
+}
+
+int nx_vidioc_enum_fmt_vid_stream_mplane(struct file *file, void *priv,
+	struct v4l2_fmtdesc *f)
+{
+	if( f->index >= ARRAY_SIZE(stream_formats) )
+		return -EINVAL;
+	f->pixelformat = stream_formats[f->index].fourcc;
+	return 0;
+}
+
+int nx_vidioc_enum_framesizes(struct file *file, void *priv,
+				      struct v4l2_frmsizeenum *fsize)
+{
+	if( fsize->index != 0 )
+		return -EINVAL;
+	fsize->type = V4L2_FRMSIZE_TYPE_STEPWISE;
+	fsize->stepwise.min_width = 8;
+	fsize->stepwise.max_width = 1920;
+	fsize->stepwise.step_width = 8;
+	fsize->stepwise.min_height = 8;
+	fsize->stepwise.max_height = 1088;
+	fsize->stepwise.step_height = 2;
+	return 0;
+}
+
+#define	DST_QUEUE_OFF_BASE	(1 << 30)
+int nx_vpu_vidioc_querybuf(struct file *file, void *priv,
+		struct v4l2_buffer *buf)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int i, ret = 0;
+
+	FUNC_IN();
+
+	/* if memory is not mmp or userptr return error */
+	if ((buf->memory != V4L2_MEMORY_MMAP) &&
+		(buf->memory != V4L2_MEMORY_USERPTR) &&
+		(buf->memory != V4L2_MEMORY_DMABUF))
+		return -EINVAL;
+
+	if( buf->type == ctx->vq_strm.type ) {
+		ret = vb2_querybuf(&ctx->vq_strm, buf);
+		if (ret != 0) {
+			pr_err("error in vb2_querybuf() for E(D)\n");
+			return ret;
+		}
+	} else if( buf->type == ctx->vq_img.type ) {
+		ret = vb2_querybuf(&ctx->vq_img, buf);
+		if (ret != 0) {
+			pr_err("error in vb2_querybuf() for E(S)\n");
+			return ret;
+		}
+		/* Adjust MMAP memory offsets for the CAPTURE queue */
+		if( buf->memory == V4L2_MEMORY_MMAP ) {
+			if( buf->type == V4L2_BUF_TYPE_VIDEO_CAPTURE ) {
+				buf->m.offset += DST_QUEUE_OFF_BASE;
+			}else{
+				for (i = 0; i < buf->length; ++i)
+					buf->m.planes[i].m.mem_offset += DST_QUEUE_OFF_BASE;
+			}
+		}
+	} else {
+		pr_err("invalid buf type\n");
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+/* Stream on */
+int nx_vpu_vidioc_streamon(struct file *file, void *priv,
+			   enum v4l2_buf_type type)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = -EINVAL;
+
+	FUNC_IN();
+
+	if( type == ctx->vq_img.type )
+		ret = vb2_streamon(&ctx->vq_img, type);
+	else if( type == ctx->vq_strm.type )
+		ret = vb2_streamon(&ctx->vq_strm, type);
+
+	return ret;
+}
+
+/* Stream off, which equals to a pause */
+int nx_vpu_vidioc_streamoff(struct file *file, void *priv,
+			    enum v4l2_buf_type type)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	int ret = -EINVAL;
+
+	FUNC_IN();
+
+	if( type == ctx->vq_img.type )
+		ret = vb2_streamoff(&ctx->vq_img, type);
+	else if( type == ctx->vq_strm.type )
+		ret = vb2_streamoff(&ctx->vq_strm, type);
+
+	return ret;
+}
+
+
+/*-----------------------------------------------------------------------------
+ *      functions for VB2 Contorls(struct "vb2_ops")
+ *----------------------------------------------------------------------------*/
+
+int nx_vpu_queue_setup(struct vb2_queue *vq,
+			unsigned int *buf_count, unsigned int *plane_count,
+			unsigned int psize[], struct device *alloc_devs[])
+{
+	struct nx_vpu_ctx *ctx = vq->drv_priv;
+	int i;
+
+	FUNC_IN();
+
+	if (vq->type == ctx->vq_strm.type ) {
+		int planeCount = !ctx->is_encoder || ctx->useSingleBuf ||
+			ctx->img_fmt->singleBuffer ? 1 :
+			ctx->img_fmt->chromaInterleave ? 2 : 3;
+
+		if( *plane_count == 0 ) {
+			*plane_count = planeCount;
+			if( *buf_count < 1 )
+				*buf_count = 1;
+			if (*buf_count > VPU_MAX_BUFFERS)
+				*buf_count = VPU_MAX_BUFFERS;
+			psize[0] = ctx->strm_buf_size;
+		}else{	// checking additional buffers for VIDIOC_CREATE_BUFS
+			if( *plane_count != planeCount ) {
+				NX_ErrMsg(("strm: plane count mismatch"));
+				return -EINVAL;
+			}
+			if( *buf_count + vq->num_buffers > VPU_MAX_BUFFERS )
+				*buf_count = VPU_MAX_BUFFERS - vq->num_buffers;
+			if( psize[0] < ctx->strm_buf_size )
+				return -EINVAL;
+		}
+	} else if( vq->type == ctx->vq_img.type ) {
+		int planeCount = ctx->is_encoder || ctx->useSingleBuf ||
+			ctx->img_fmt->singleBuffer ? 1 :
+			ctx->img_fmt->chromaInterleave ? 2 : 3;
+
+		if( *plane_count == 0 ) {
+			int minBufCnt = ctx->is_encoder ? 1 :
+				ctx->codec.dec.minFrameBufCnt + additional_buffer_count;
+			*plane_count = planeCount;
+			if (*buf_count < minBufCnt)
+				*buf_count = minBufCnt;
+			if (*buf_count > VPU_MAX_BUFFERS)
+				*buf_count = VPU_MAX_BUFFERS;
+			switch( planeCount ) {
+			case 1:
+				psize[0] = ctx->luma_size + 2 * ctx->chroma_size;
+				break;
+			case 2:
+				psize[0] = ctx->luma_size;
+				psize[1] = 2 * ctx->chroma_size;
+				break;
+			default: // 3
+				psize[0] = ctx->luma_size;
+				psize[1] = psize[2] = ctx->chroma_size;
+				break;
+			}
+		}else{	// checking additional buffers for VIDIOC_CREATE_BUFS
+			if( *plane_count != planeCount ) {
+				NX_ErrMsg(("img: plane count mismatch"));
+				return -EINVAL;
+			}
+			if( *buf_count + vq->num_buffers > VPU_MAX_BUFFERS )
+				*buf_count = VPU_MAX_BUFFERS - vq->num_buffers;
+			switch( planeCount ) {
+			case 1:
+				if( psize[0] < ctx->luma_size + 2 * ctx->chroma_size )
+					return -EINVAL;
+				break;
+			case 2:
+				if(psize[0] < ctx->luma_size || psize[1] < 2 * ctx->chroma_size)
+					return -EINVAL;
+				break;
+			default: // 3
+				if( psize[0] < ctx->luma_size || psize[1] < ctx->chroma_size ||
+					   	psize[2] < ctx->chroma_size )
+					return -EINVAL;
+				break;
+			}
+		}
+		ctx->codec.dec.declaredFrameBufferCnt = vq->num_buffers + *buf_count;
+	} else {
+		NX_ErrMsg(("invalid queue type: %d\n", vq->type));
+		return -EINVAL;
+	}
+
+	NX_DbgMsg(INFO_MSG, ("buf_count: %d, plane_count: %d\n", *buf_count,
+		*plane_count));
+
+	for (i = 0; i < *plane_count; i++)
+		NX_DbgMsg(INFO_MSG, ("plane[%d] size=%d\n", i, psize[i]));
+
+	return 0;
+}
+
+void nx_vpu_unlock(struct vb2_queue *q)
+{
+	struct nx_vpu_ctx *ctx = q->drv_priv;
+
+	FUNC_IN();
+	mutex_unlock(&ctx->dev->dev_mutex);
+}
+
+void nx_vpu_lock(struct vb2_queue *q)
+{
+	struct nx_vpu_ctx *ctx = q->drv_priv;
+
+	FUNC_IN();
+	mutex_lock(&ctx->dev->dev_mutex);
+}
+
+int nx_vpu_buf_prepare(struct vb2_buffer *vb)
+{
+	struct vb2_queue *vq = vb->vb2_queue;
+	struct nx_vpu_ctx *ctx = vq->drv_priv;
+	int i, num_planes;
+	unsigned psize[3];
+	bool isStream;
+
+	if( vq != &ctx->vq_img && vq != &ctx->vq_strm ) {
+		NX_ErrMsg(("buffer not from my pool"));
+		return -EINVAL;
+	}
+	isStream = ctx->is_encoder == (vq == &ctx->vq_img);
+	num_planes = isStream || ctx->useSingleBuf || ctx->img_fmt->singleBuffer ?
+		1 : ctx->img_fmt->chromaInterleave ? 2 : 3;
+	if (num_planes != vb->num_planes) {
+		NX_ErrMsg(("invalid plane number for the format, right=%d, cur=%d\n",
+			num_planes, vb->num_planes));
+		return -EINVAL;
+	}
+	for (i = 0; i < num_planes; i++) {
+		if (!nx_vpu_mem_plane_addr(vb, i)) {
+			NX_ErrMsg(("failed to get %d plane cookie\n", i));
+			return -EINVAL;
+		}
+
+		NX_DbgMsg(INFO_MSG, ("index: %d, plane[%d] cookie: 0x%08lx\n",
+			vb->index, i,
+			(unsigned long)nx_vpu_mem_plane_addr(vb, i)));
+	}
+	if( ! isStream ) {
+		switch( num_planes ) {
+		case 1:
+			psize[0] = ctx->luma_size + 2 * ctx->chroma_size;
+			break;
+		case 2:
+			psize[0] = ctx->luma_size;
+			psize[1] = 2 * ctx->chroma_size;
+			break;
+		default: // 3
+			psize[0] = ctx->luma_size;
+			psize[1] = psize[2] = ctx->chroma_size;
+			break;
+		}
+		for( i = 0; i < num_planes; ++i ) {
+			unsigned cur_psize = vb2_plane_size(vb, i);
+			if( cur_psize < psize[i] ) {
+				NX_ErrMsg(("buffer for plane #%d too small, min=%d cur=%d\n",
+							i, psize[i], cur_psize));
+				return -EINVAL;
+			}
+		}
+	}
+	return 0;
+}
+
+void nx_vpu_cleanup_queue(struct list_head *lh, struct vb2_queue *vq,
+		enum vb2_buffer_state state)
+{
+	struct nx_vpu_buf *b;
+	int i;
+
+	FUNC_IN();
+
+	while (!list_empty(lh)) {
+		b = list_entry(lh->next, struct nx_vpu_buf, list);
+		for (i = 0; i < b->vb.num_planes; i++)
+			vb2_set_plane_payload(&b->vb, i, 0);
+		vb2_buffer_done(&b->vb, state);
+		list_del(&b->list);
+	}
+}
+
+/* -------------------------------------------------------------------------- */
+
+
+/*-----------------------------------------------------------------------------
+ *      Linux VPU/JPU Interrupt Handler
+ *----------------------------------------------------------------------------*/
+
+static irqreturn_t nx_vpu_irq(int irq, void *priv)
+{
+	struct nx_vpu_v4l2 *dev = priv;
+
+	FUNC_IN();
+	VpuWriteReg(BIT_INT_CLEAR, 0x1);
+
+	/* Reset the timeout watchdog */
+	atomic_set(&dev->vpu_event_present, 1);
+	wake_up_interruptible(&dev->vpu_wait_queue);
+
+	return IRQ_HANDLED;
+}
+
+static int VPU_WaitVpuInterrupt(struct nx_vpu_v4l2 *dev, int timeOut)
+{
+	int ret = wait_event_interruptible_timeout(dev->vpu_wait_queue,
+		atomic_read(&dev->vpu_event_present),
+		msecs_to_jiffies(timeOut));
+
+	if (0 == atomic_read(&dev->vpu_event_present)) {
+		/* Error */
+		if (ret == 0) {
+			NX_ErrMsg(("VPU HW Timeout!\n"));
+			atomic_set(&dev->vpu_event_present, 0);
+			VPU_SWReset(SW_RESET_SAFETY);
+			return -1;
+		}
+
+		while (timeOut > 0) {
+			if (0 != VpuReadReg(BIT_INT_REASON)) {
+				atomic_set(&dev->vpu_event_present, 0);
+				return 0;
+			}
+			DrvMSleep(1);
+			timeOut--;
+		}
+
+		/* Time out */
+		NX_ErrMsg(("VPU HW Error!!\n"));
+		VPU_SWReset(SW_RESET_SAFETY);
+		atomic_set(&dev->vpu_event_present, 0);
+		return -1;
+	}
+
+	atomic_set(&dev->vpu_event_present, 0);
+	return 0;
+}
+
+int VPU_WaitBitInterrupt(void *devHandle, int mSeconds)
+{
+	unsigned int reason = 0;
+
+#ifdef ENABLE_INTERRUPT_MODE
+	if (0 != VPU_WaitVpuInterrupt(devHandle, mSeconds)) {
+		reason = VpuReadReg(BIT_INT_REASON);
+		VpuWriteReg(BIT_INT_REASON, 0);
+		NX_ErrMsg(("VPU_WaitVpuInterrupt() TimeOut!!!\n"));
+		NX_ErrMsg(("reason = 0x%.8x, CurPC(0xBD 0xBF : %x %x %x))\n",
+			reason, VpuReadReg(BIT_CUR_PC), VpuReadReg(BIT_CUR_PC),
+			VpuReadReg(BIT_CUR_PC)));
+		return 0;
+	}
+
+	VpuWriteReg(BIT_INT_CLEAR, 1);  /* clear HW signal */
+	reason = VpuReadReg(BIT_INT_REASON);
+	VpuWriteReg(BIT_INT_REASON, 0);
+	return reason;
+#else
+	while (mSeconds > 0) {
+		reason = VpuReadReg(BIT_INT_REASON);
+		if (reason != 0) {
+			if (reason != (unsigned int)-1)
+				VpuWriteReg(BIT_INT_CLEAR, 1);
+			/* tell to F/W that HOST received an interrupt. */
+			VpuWriteReg(BIT_INT_REASON, 0);
+			break;
+		}
+		DrvMSleep(1);
+		mSeconds--;
+	}
+	return reason;
+#endif
+}
+
+static irqreturn_t nx_jpu_irq(int irq, void *priv)
+{
+	struct nx_vpu_v4l2 *dev = priv;
+	uint32_t val;
+
+	FUNC_IN();
+
+	val = VpuReadReg(MJPEG_PIC_STATUS_REG);
+	if (val != 0)
+		VpuWriteReg(MJPEG_PIC_STATUS_REG, val);
+	dev->jpu_intr_reason = val;
+
+	/* Reset the timeout watchdog */
+	atomic_set(&dev->jpu_event_present, 1);
+	wake_up_interruptible(&dev->jpu_wait_queue);
+
+	return IRQ_HANDLED;
+}
+
+int JPU_WaitInterrupt(void *devHandle, int timeOut)
+{
+	struct nx_vpu_v4l2 *dev = (struct nx_vpu_v4l2 *)devHandle;
+	uint32_t reason = 0;
+
+#ifdef ENABLE_INTERRUPT_MODE
+	if (0 == wait_event_interruptible_timeout(dev->jpu_wait_queue,
+		atomic_read(&dev->jpu_event_present),
+		msecs_to_jiffies(timeOut))) {
+		reason = VpuReadReg(MJPEG_PIC_STATUS_REG);
+		NX_ErrMsg(("JPU_WaitInterrupt() TimeOut!!!(reason = 0x%.8x)\n",
+			reason));
+		VPU_SWReset(SW_RESET_SAFETY);
+		return 0;
+	}
+
+	atomic_set(&dev->jpu_event_present, 0);
+	reason = dev->jpu_intr_reason;
+#else
+	while (timeOut > 0) {
+		DrvMSleep(1);
+
+		reason = VpuReadReg(MJPEG_PIC_STATUS_REG);
+		if ((reason & (1<<INT_JPU_DONE)) ||
+			(reason & (1<<INT_JPU_ERROR)) ||
+			(reason & (1<<INT_JPU_BBC_INTERRUPT)) ||
+			(reason & (1<<INT_JPU_BIT_BUF_EMPTY)))
+			break;
+
+		if (reason & (1<<INT_JPU_BIT_BUF_FULL)) {
+			NX_ErrMsg(("Stream Buffer Too Small!!!"));
+			VpuReadReg(MJPEG_PIC_STATUS_REG,
+				(1 << INT_JPU_BIT_BUF_FULL));
+			return reason;
+		}
+
+		timeOut--;
+		if (timeOut == 0) {
+			NX_ErrMsg(("JPU TimeOut!!!"));
+			break;
+		}
+	}
+#endif
+
+	return reason;
+}
+
+/* -------------------------------------------------------------------------- */
+
+
+static int nx_vpu_open(struct file *file)
+{
+	struct video_device *vdev = video_devdata(file);
+	struct nx_vpu_v4l2 *dev = video_drvdata(file);
+	struct nx_vpu_ctx *ctx = NULL;
+	void *err = (void *)(&dev->plat_dev->dev);
+	int ret = 0;
+
+	FUNC_IN();
+
+	if (mutex_lock_interruptible(&dev->vpu_mutex))
+		return -ERESTARTSYS;
+
+	ctx = devm_kzalloc(err, sizeof(*ctx), GFP_KERNEL);
+	if (!ctx) {
+		NX_ErrMsg(("Not enough memory.\n"));
+		ret = -ENOMEM;
+		goto err_ctx_mem;
+	}
+
+	/* get context number */
+	ctx->idx = 0;
+	while (dev->ctx[ctx->idx]) {
+		ctx->idx++;
+		if (ctx->idx >= NX_MAX_VPU_INSTANCE) {
+			dev_err(err, "Can't open nx vpu driver!!\n");
+			dev_err(err, "CurNumInstance = %d)\n",
+				dev->cur_num_instance);
+			ret = -EBUSY;
+			goto err_no_ctx;
+		}
+	}
+
+	v4l2_fh_init(&ctx->fh, vdev);
+	file->private_data = &ctx->fh;
+	v4l2_fh_add(&ctx->fh);
+
+	ctx->dev = dev;
+
+	INIT_LIST_HEAD(&ctx->img_queue);
+	INIT_LIST_HEAD(&ctx->strm_queue);
+	ctx->img_queue_cnt = 0;
+	ctx->strm_queue_cnt = 0;
+
+	/* Mark context as idle */
+	__clear_bit(ctx->idx, &dev->ctx_work_bits);
+	dev->ctx[ctx->idx] = ctx;
+
+	if (vdev == dev->vfd_enc) {
+		ctx->is_encoder = 1;
+		ret = nx_vpu_enc_open(ctx);
+	} else {
+		ctx->is_encoder = 0;
+		ret = nx_vpu_dec_open(ctx, single_plane_mode);
+	}
+	if (ret)
+		goto err_ctx_init;
+
+	/* FW Download, HW Init, Clock Set */
+	if (dev->cur_num_instance == 0) {
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+		nx_vpu_qos_update(NX_BUS_CLK_VPU_KHZ);
+#endif
+#ifdef ENABLE_POWER_SAVING
+		dev->curr_ctx = ctx->idx;
+
+		NX_VPU_Clock(1);
+		ret = NX_VpuInit(dev, dev->regs_base,
+			dev->firmware_buf->virAddr,
+			(uint32_t)dev->firmware_buf->phyAddr);
+
+#ifdef ENABLE_CLOCK_GATING
+		NX_VPU_Clock(0);
+#endif
+
+		if (ret)
+			goto err_hw_init;
+#endif
+	}
+
+	mutex_unlock(&dev->vpu_mutex);
+
+	return ret;
+
+	/* Deinit when failure occurred */
+#ifdef ENABLE_POWER_SAVING
+err_hw_init:
+#endif
+err_ctx_init:
+	if (ctx->idx < NX_MAX_VPU_INSTANCE){
+		dev->ctx[ctx->idx] = 0;
+	}
+err_no_ctx:
+
+err_ctx_mem:
+	mutex_unlock(&dev->vpu_mutex);
+
+	return ret;
+}
+
+static int nx_vpu_close(struct file *file)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+
+	FUNC_IN();
+
+	mutex_lock(&dev->dev_mutex);
+
+	if( ctx->is_encoder ) {
+		if(ctx->codec.enc.is_initialized) {
+			ctx->codec.enc.vpu_cmd = SEQ_END;
+			nx_vpu_enc_try_run(ctx);
+		}
+	}else{
+		if(ctx->codec.dec.state != NX_VPUDEC_CLOSED)
+			nx_vpu_dec_try_cmd(ctx, SEQ_END);
+	}
+
+	if (dev->cur_num_instance == 0) {
+#ifdef ENABLE_POWER_SAVING
+		/* H/W Power Off */
+		NX_VPU_Clock(1);
+		NX_VpuDeInit(dev);
+#endif
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+		nx_vpu_qos_update(NX_BUS_CLK_IDLE_KHZ);
+#endif
+	}
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+
+	vb2_queue_release(&ctx->vq_img);
+	vb2_queue_release(&ctx->vq_strm);
+
+	v4l2_fh_del(&ctx->fh);
+	v4l2_fh_exit(&ctx->fh);
+
+	/* Mark context as idle */
+	__clear_bit(ctx->idx, &dev->ctx_work_bits);
+
+	dev->ctx[ctx->idx] = 0;
+
+	mutex_unlock(&dev->dev_mutex);
+
+	return 0;
+}
+
+static unsigned int nx_vpu_poll(struct file *file, struct poll_table_struct
+	*wait)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	unsigned ret;
+
+	ret = vb2_poll(&ctx->vq_img, file, wait);
+	ret |= vb2_poll(&ctx->vq_strm, file, wait);
+	return ret;
+}
+
+static int nx_vpu_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	struct nx_vpu_ctx *ctx = fh_to_ctx(file->private_data);
+	struct nx_vpu_v4l2 *dev = ctx->dev;
+	uint32_t offset = vma->vm_pgoff << PAGE_SHIFT;
+	int ret;
+	bool isStream;
+
+	FUNC_IN();
+
+	if (mutex_lock_interruptible(&dev->dev_mutex))
+		return -ERESTARTSYS;
+
+	if (offset < DST_QUEUE_OFF_BASE) {
+		isStream = !ctx->is_encoder;
+	} else {
+		vma->vm_pgoff -= (DST_QUEUE_OFF_BASE >> PAGE_SHIFT);
+		isStream = ctx->is_encoder;
+	}
+	ret = vb2_mmap(isStream ? &ctx->vq_strm : &ctx->vq_img, vma);
+
+	mutex_unlock(&dev->dev_mutex);
+
+	return ret;
+}
+
+static const struct v4l2_file_operations nx_vpu_fops = {
+	.owner = THIS_MODULE,
+	.open = nx_vpu_open,
+	.release = nx_vpu_close,
+	.poll = nx_vpu_poll,
+	.unlocked_ioctl = video_ioctl2,
+	.mmap = nx_vpu_mmap,
+};
+
+void vpu_soc_peri_reset_enter(void *pv)
+{
+	struct nx_vpu_v4l2 *dev = (struct nx_vpu_v4l2 *)pv;
+
+	reset_control_assert(dev->coda_c);
+	reset_control_assert(dev->coda_a);
+	reset_control_assert(dev->coda_p);
+}
+
+void vpu_soc_peri_reset_exit(void *pv)
+{
+	struct nx_vpu_v4l2 *dev = (struct nx_vpu_v4l2 *)pv;
+
+	reset_control_deassert(dev->coda_c);
+	reset_control_deassert(dev->coda_a);
+	reset_control_deassert(dev->coda_p);
+}
+
+static int nx_vpu_init(struct nx_vpu_v4l2 *dev)
+{
+	int ret = 0;
+
+	FUNC_IN();
+
+	dev->firmware_buf = nx_alloc_memory(&dev->plat_dev->dev,
+		COMMON_BUF_SIZE, 4096);
+	if (dev->firmware_buf == NULL) {
+		dev_err(&dev->plat_dev->dev, "firmware allocation is failed!\n");
+		return -ENOMEM;
+	}
+
+	mutex_lock(&dev->vpu_mutex);
+
+	NX_VPU_Clock(1);
+
+	ret = NX_VpuInit(dev, dev->regs_base, dev->firmware_buf->virAddr,
+		dev->firmware_buf->phyAddr);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+
+	mutex_unlock(&dev->vpu_mutex);
+
+	dev->cur_num_instance = 0;
+	dev->cur_jpg_instance = 0;
+
+	return ret;
+}
+
+static int nx_vpu_deinit(struct nx_vpu_v4l2 *dev)
+{
+	int ret;
+
+	FUNC_IN();
+
+	NX_VPU_Clock(1);
+	ret = NX_VpuDeInit(dev);
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+
+	if (dev->firmware_buf != NULL)
+		nx_free_memory(dev->firmware_buf);
+
+	return ret;
+}
+
+static int nx_vpu_probe(struct platform_device *pdev)
+{
+	struct nx_vpu_v4l2 *dev;
+	struct video_device *vfd;
+	struct resource res;
+	int ret;
+	uint32_t info[2] = { };
+
+	FUNC_IN();
+
+	dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
+	if (!dev) {
+		NX_ErrMsg(("fail to kzalloc(size %zu) (%s)\n",
+			sizeof(struct nx_vpu_v4l2), NX_VIDEO_NAME));
+		return -ENOMEM;
+	}
+
+	spin_lock_init(&dev->irqlock);
+
+	dev->plat_dev = pdev;
+	if (!dev->plat_dev) {
+		dev_err(&pdev->dev, "No platform data specified\n");
+		return -ENODEV;
+	}
+
+	ret = of_address_to_resource(pdev->dev.of_node, 0, &res);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to get base address\n");
+		return -ENXIO;
+	}
+
+	dev->regs_base = devm_ioremap_nocache(&pdev->dev, res.start,
+		resource_size(&res));
+	if (!dev->regs_base) {
+		dev_err(&pdev->dev, "failed to ioremap\n");
+		return -EBUSY;
+	}
+
+	/* For VPU interrupt */
+	dev->vpu_irq = platform_get_irq(pdev, 0);
+	if (dev->vpu_irq < 0) {
+		dev_err(&pdev->dev, "failed to get vpu-irq num\n");
+		return -EBUSY;
+	}
+
+	ret = devm_request_irq(&pdev->dev, dev->vpu_irq, nx_vpu_irq, 0, pdev->name, dev);
+	if (ret != 0) {
+		dev_err(&pdev->dev, "Failed to install vpu-irq (%d)\n", ret);
+		return ret;
+	}
+	init_waitqueue_head(&dev->vpu_wait_queue);
+
+	/* For JPU interrupt */
+	dev->jpu_irq = platform_get_irq(pdev, 1);
+	if (dev->jpu_irq < 0) {
+		dev_err(&pdev->dev, "failed to get jpu-irq num\n");
+		return -EBUSY;
+	}
+
+	ret = devm_request_irq(&pdev->dev, dev->jpu_irq, nx_jpu_irq, 0, pdev->name, dev);
+	if (ret != 0) {
+		dev_err(&pdev->dev, "Failed to install jpu-irq (%d)\n", ret);
+		return ret;
+	}
+	init_waitqueue_head(&dev->jpu_wait_queue);
+
+	dev->coda_c = devm_reset_control_get(&pdev->dev, "vpu-c-reset");
+	if (IS_ERR(dev->coda_c)) {
+		dev_err(&pdev->dev, "failed to get reset control of vpu-c\n");
+		return -ENODEV;
+	}
+
+	dev->coda_a = devm_reset_control_get(&pdev->dev, "vpu-a-reset");
+	if (IS_ERR(dev->coda_a)) {
+		dev_err(&pdev->dev, "failed to get reset control of vpu-c\n");
+		return -ENODEV;
+	}
+
+	dev->coda_p = devm_reset_control_get(&pdev->dev, "vpu-p-reset");
+	if (IS_ERR(dev->coda_p)) {
+		dev_err(&pdev->dev, "failed to get reset control of vpu-c\n");
+		return -ENODEV;
+	}
+
+	ret = of_property_read_u32_array(pdev->dev.of_node, "sram", info, 2);
+	if (!ret) {
+		dev->sram_base_addr = info[0];
+		dev->sram_size = info[1];
+	}
+
+	mutex_init(&dev->dev_mutex);
+	mutex_init(&dev->vpu_mutex);
+
+	ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
+	if (ret) {
+		dev_err(&pdev->dev, "%s: failed to register v4l2_device: %d\n",
+			__func__, ret);
+		goto err_v4l2_dev_reg;
+	}
+
+	platform_set_drvdata(pdev, dev);
+
+	atomic_set(&dev->vpu_event_present, 0);
+	atomic_set(&dev->jpu_event_present, 0);
+
+	ret = NX_VpuParaInitialized(&pdev->dev);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed to ioremap\n");
+		goto err_vpu_init;
+	}
+
+	ret = nx_vpu_init(dev);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "nx_vpu_init() is Failed\n");
+		goto err_vpu_init;
+	}
+
+	/* encoder */
+	vfd = video_device_alloc();
+	if (!vfd) {
+		dev_err(&pdev->dev, "Fail to allocate video device\n");
+		ret = -ENOMEM;
+		goto err_enc_alloc;
+	}
+
+	vfd->fops = &nx_vpu_fops;
+	vfd->ioctl_ops = get_enc_ioctl_ops();
+	vfd->minor = -1;
+	vfd->release = video_device_release;
+	vfd->lock = &dev->dev_mutex;
+	vfd->v4l2_dev = &dev->v4l2_dev;
+	vfd->vfl_dir = VFL_DIR_M2M;
+	snprintf(vfd->name, sizeof(vfd->name), "%s", NX_VIDEO_ENC_NAME);
+	dev->vfd_enc = vfd;
+
+	v4l2_info(&dev->v4l2_dev, "encoder registered as /dev/video%d\n",
+		NX_VPU_START);
+	video_set_drvdata(vfd, dev);
+	ret = video_register_device(vfd, VFL_TYPE_GRABBER, NX_VPU_START);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to register video device\n");
+		goto err_enc_reg;
+	}
+
+	/* decoder */
+	vfd = video_device_alloc();
+	if (!vfd) {
+		dev_err(&pdev->dev, "Fail to allocate video device\n");
+		ret = -ENOMEM;
+		goto err_dec_alloc;
+	}
+
+	vfd->fops = &nx_vpu_fops;
+	vfd->ioctl_ops = get_dec_ioctl_ops(single_plane_mode);
+	vfd->minor = -1;
+	vfd->release = video_device_release;
+	vfd->lock = &dev->dev_mutex;
+	vfd->v4l2_dev = &dev->v4l2_dev;
+	vfd->vfl_dir = VFL_DIR_M2M;
+	snprintf(vfd->name, sizeof(vfd->name), "%s", NX_VIDEO_DEC_NAME);
+	dev->vfd_dec = vfd;
+
+	v4l2_info(&dev->v4l2_dev, "decoder registered as /dev/video%d\n",
+		NX_VPU_START + 1);
+	video_set_drvdata(vfd, dev);
+	ret = video_register_device(vfd, VFL_TYPE_GRABBER, NX_VPU_START + 1);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to register video device\n");
+		goto err_dec_reg;
+	}
+
+	return 0;
+
+	//video_unregister_device(dev->vfd_dec);
+err_dec_reg:
+	video_device_release(dev->vfd_dec);
+err_dec_alloc:
+	video_unregister_device(dev->vfd_enc);
+err_enc_reg:
+	video_device_release(dev->vfd_enc);
+err_enc_alloc:
+err_vpu_init:
+err_v4l2_dev_reg:
+	v4l2_device_unregister(&dev->v4l2_dev);
+
+	dev_err(&pdev->dev, "%s-- with error!!!\n", __func__);
+	return ret;
+}
+
+static int nx_vpu_remove(struct platform_device *pdev)
+{
+	struct nx_vpu_v4l2 *dev = platform_get_drvdata(pdev);
+
+	FUNC_IN();
+
+	if (unlikely(!dev))
+		return 0;
+
+	if (dev->cur_num_instance > 0) {
+		dev_err(&pdev->dev, "Warning Video Frimware is running.\n");
+		dev_err(&pdev->dev, "(Video(%d), Jpeg(%d)\n",
+			dev->cur_num_instance, dev->cur_jpg_instance);
+	}
+
+	video_unregister_device(dev->vfd_enc);
+	video_unregister_device(dev->vfd_dec);
+	v4l2_device_unregister(&dev->v4l2_dev);
+
+	nx_vpu_deinit(dev);
+
+	mutex_destroy(&dev->vpu_mutex);
+	mutex_destroy(&dev->dev_mutex);
+	devm_free_irq(&dev->plat_dev->dev, dev->jpu_irq, dev);
+	devm_free_irq(&dev->plat_dev->dev, dev->vpu_irq, dev);
+
+	return 0;
+}
+
+static int nx_vpu_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	struct nx_vpu_v4l2 *dev = platform_get_drvdata(pdev);
+
+	FUNC_IN();
+
+	mutex_lock(&dev->vpu_mutex);
+	NX_VPU_Clock(1);
+
+	NX_VpuSuspend(dev);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+	mutex_unlock(&dev->vpu_mutex);
+
+	FUNC_OUT();
+	return 0;
+}
+
+static int nx_vpu_resume(struct platform_device *pdev)
+{
+	struct nx_vpu_v4l2 *dev = platform_get_drvdata(pdev);
+
+	FUNC_IN();
+
+	mutex_lock(&dev->vpu_mutex);
+	NX_VPU_Clock(1);
+
+	NX_VpuResume(dev, dev->regs_base);
+
+#ifdef ENABLE_CLOCK_GATING
+	NX_VPU_Clock(0);
+#endif
+	mutex_unlock(&dev->vpu_mutex);
+
+	FUNC_OUT();
+	return 0;
+}
+
+static struct platform_device_id nx_vpu_driver_ids[] = {
+	{
+		.name = NX_VIDEO_NAME, .driver_data = 0,
+	},
+	{},
+};
+
+static const struct of_device_id nx_vpu_dt_match[] = {
+	{
+	.compatible = "nexell, nx-vpu",
+	},
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_vpu_dt_match);
+
+static struct platform_driver nx_vpu_driver = {
+	.probe = nx_vpu_probe,
+	.remove = nx_vpu_remove,
+	.suspend = nx_vpu_suspend,
+	.resume = nx_vpu_resume,
+	.id_table = nx_vpu_driver_ids,
+	.driver = {
+		.name = NX_VIDEO_NAME,
+		.owner = THIS_MODULE,
+		.of_match_table = of_match_ptr(nx_vpu_dt_match),
+	},
+};
+
+module_platform_driver(nx_vpu_driver);
+
+MODULE_AUTHOR("Kim SeongHee <kshblue@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell S5P6818 series SoC V4L2/Codec device driver");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.h b/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.h
--- a/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/nx_vpu_v4l2.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,279 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _nx_vpu_v4l2_H
+#define _nx_vpu_v4l2_H
+
+#include <linux/platform_device.h>
+#include <linux/irqreturn.h>
+#include <media/media-device.h>
+#include <media/v4l2-device.h>
+
+#include "nx_port_func.h"
+#include "nx_vpu_config.h"
+#include "nx_vpu_api.h"
+
+
+#define STREAM_BUF_SIZE                 (4*1024*1024)
+#define ENABLE_INTERRUPT_MODE
+
+#define fh_to_ctx(__fh) container_of(__fh, struct nx_vpu_ctx, fh)
+#define vb_to_vpu_buf(x) container_of(x, struct nx_vpu_buf, vb)
+
+
+struct nx_vpu_v4l2 {
+	struct v4l2_device v4l2_dev;
+	struct video_device *vfd_dec;
+	struct video_device *vfd_enc;
+	struct platform_device *plat_dev;
+
+	void *regs_base;
+	struct reset_control *coda_c;
+	struct reset_control *coda_a;
+	struct reset_control *coda_p;
+
+	uint32_t sram_base_addr;
+	uint32_t sram_size;
+
+	spinlock_t irqlock;	/* lock when operating on videobuf2 queues */
+	struct mutex dev_mutex;
+	struct mutex vpu_mutex;
+
+	wait_queue_head_t vpu_wait_queue;
+	wait_queue_head_t jpu_wait_queue;
+
+	atomic_t vpu_event_present;
+	atomic_t jpu_event_present;
+
+	uint32_t jpu_intr_reason;
+
+	struct nx_vpu_ctx *ctx[NX_MAX_VPU_INSTANCE];
+	int curr_ctx;
+	unsigned long ctx_work_bits;
+
+	/* instance management */
+	int cur_num_instance;
+	int cur_jpg_instance;
+
+	int vpu_irq;
+	int jpu_irq;
+
+	struct nx_memory_info *firmware_buf;
+};
+
+struct vpu_enc_ctx {
+	int is_initialized;
+	enum nx_vpu_cmd vpu_cmd;
+
+	int gop_frm_cnt;		/* gop frame counter */
+
+	int userIQP;
+	int userPQP;
+
+	struct nx_vid_memory_info *ref_recon_buf[2];
+	struct nx_memory_info *sub_sample_buf[2];
+
+	union vpu_enc_get_header_arg seq_info;
+	struct vpu_enc_seq_arg seq_para;
+	struct vpu_enc_run_frame_arg run_info;
+	struct vpu_enc_chg_para_arg chg_para;
+
+	int reconChromaInterleave;
+};
+
+enum NxVpuDecState {
+	NX_VPUDEC_CLOSED,
+	NX_VPUDEC_SET_FRAMEBUF,
+	NX_VPUDEC_RUNNING,
+	NX_VPUDEC_FLUSHED
+};
+
+struct vpu_dec_ctx {
+	enum NxVpuDecState state;
+	int delay_frm;
+	int frame_buf_delay;
+	int cur_reliable;
+
+	int frm_type[VPU_MAX_BUFFERS];
+	int interlace_flg[VPU_MAX_BUFFERS];
+	int reliable_0_100[VPU_MAX_BUFFERS];
+	u64 timeStamp[VPU_MAX_BUFFERS];
+	int multiResolution[VPU_MAX_BUFFERS];
+	int upSampledWidth[VPU_MAX_BUFFERS];
+	int upSampledHeight[VPU_MAX_BUFFERS];
+
+	struct timeval savedTimeStamp;
+
+	unsigned int start_Addr;
+	unsigned int end_Addr;
+
+	int minFrameBufCnt;
+	int declaredFrameBufferCnt;
+	int frame_buffer_cnt;
+	int registeredCount;
+	struct vpu_dec_phy_addr_info phyAddrs;
+
+	struct nx_memory_info *col_mv_buf;
+	struct nx_memory_info *slice_buf;
+	struct nx_memory_info *pv_slice_buf;
+
+	struct nx_vpu_buf *dpb_bufs[VPU_MAX_BUFFERS];
+	unsigned int dpb_queue_cnt;
+
+	int crop_left, crop_right, crop_top, crop_bot;
+
+	/* for Jpeg */
+	int32_t thumbnailMode;
+};
+
+/* YUV image format description - output for decoder, input for encoder.
+ * For non-planar formats (GRAY8) only fourcc value is meaningful and
+ * singleBuffer, which should be set to true.
+ *
+ * Planar format may be contiguous (chroma directly after luma, in one
+ * buffer) or non-contiguous (in two or three buffers). Chroma may be
+ * interleaved (two planes) or not (three planes).
+ */
+struct nx_vpu_image_fmt {
+	unsigned fourcc;
+	unsigned hsub, vsub;	// subpixel for planar formats, 0 for non-planar
+	bool chromaInterleave;
+	bool singleBuffer;		// whether planes are contiguous, in single buffer
+};
+
+struct nx_vpu_stream_fmt {
+	unsigned int fourcc;
+};
+
+struct nx_vpu_ctx {
+	struct nx_vpu_v4l2 *dev;
+	struct v4l2_fh fh;
+
+	int idx;
+
+	void *hInst;				/* VPU handle */
+	int is_encoder;
+	int codec_mode;
+
+	int width;
+	int height;
+
+	int buf_y_width;
+	int buf_c_width;
+	int buf_height;
+
+	int luma_size;
+	int chroma_size;
+
+	int chromaInterleave;
+
+	unsigned int strm_size;
+	unsigned int strm_buf_size;
+
+	struct nx_memory_info *instance_buf;
+	struct nx_memory_info *bit_stream_buf;
+
+#if 0
+	/* TBD. */
+	struct list_head ctrls;
+	struct list_head src_ctrls[VPU_MAX_BUFFERS];
+	struct list_head dst_ctrls[VPU_MAX_BUFFERS];
+	unsigned long src_ctrls_avail;
+	unsigned long dst_ctrls_avail;
+#endif
+
+	const struct nx_vpu_image_fmt *img_fmt;
+	const struct nx_vpu_stream_fmt *strm_fmt;
+	bool useSingleBuf;
+
+	struct vb2_queue vq_img;
+	struct vb2_queue vq_strm;
+	struct list_head img_queue;
+	struct list_head strm_queue;
+	unsigned int img_queue_cnt;
+	unsigned int strm_queue_cnt;
+
+	struct nx_vpu_codec_ops *c_ops;
+
+	union {
+		struct vpu_enc_ctx enc;
+		struct vpu_dec_ctx dec;
+	} codec;
+};
+
+struct nx_vpu_buf {
+	struct vb2_buffer vb;
+	struct list_head list;
+};
+
+
+dma_addr_t nx_vpu_mem_plane_addr(struct vb2_buffer *v, unsigned plane);
+int nx_vpu_enc_try_run(struct nx_vpu_ctx *ctx);
+int nx_vpu_dec_try_cmd(struct nx_vpu_ctx *ctx, enum nx_vpu_cmd);
+
+const struct nx_vpu_image_fmt *nx_find_image_format(unsigned fourcc);
+const struct nx_vpu_stream_fmt *nx_find_stream_format(struct v4l2_format *f);
+
+int vidioc_querycap(struct file *file, void *priv, struct v4l2_capability *cap);
+int nx_vidioc_enum_fmt_vid_image(struct file *file, void *pirv,
+	struct v4l2_fmtdesc *f);
+int nx_vidioc_enum_fmt_vid_image_mplane(struct file *file, void *pirv,
+	struct v4l2_fmtdesc *f);
+int nx_vidioc_enum_fmt_vid_stream(struct file *file, void *prov,
+	struct v4l2_fmtdesc *f);
+int nx_vidioc_enum_fmt_vid_stream_mplane(struct file *file, void *priv,
+	struct v4l2_fmtdesc *f);
+int nx_vidioc_enum_framesizes(struct file *file, void *priv,
+				      struct v4l2_frmsizeenum *fsize);
+int nx_vpu_vidioc_querybuf(struct file *file, void *priv,
+		struct v4l2_buffer *buf);
+int nx_vpu_vidioc_streamon(struct file *file, void *priv,
+		enum v4l2_buf_type type);
+int nx_vpu_vidioc_streamoff(struct file *file, void *priv,
+		enum v4l2_buf_type type);
+int nx_vpu_queue_setup(struct vb2_queue *vq,
+	unsigned int *buf_count, unsigned int *plane_count,
+	unsigned int psize[], struct device *alloc_devs[]);
+
+void nx_vpu_unlock(struct vb2_queue *q);
+void nx_vpu_lock(struct vb2_queue *q);
+int nx_vpu_buf_prepare(struct vb2_buffer *vb);
+void nx_vpu_cleanup_queue(struct list_head *lh, struct vb2_queue *vq,
+		enum vb2_buffer_state state);
+
+/* For Encoder V4L2 */
+const struct v4l2_ioctl_ops *get_enc_ioctl_ops(void);
+
+int nx_vpu_enc_open(struct nx_vpu_ctx *ctx);
+int vpu_enc_open_instance(struct nx_vpu_ctx *ctx);
+int vpu_enc_init(struct nx_vpu_ctx *ctx);
+void vpu_enc_get_seq_info(struct nx_vpu_ctx *ctx);
+int vpu_enc_encode_frame(struct nx_vpu_ctx *ctx);
+void nx_vpu_enc_close_instance(struct nx_vpu_ctx*);
+
+/* For Decoder V4L2 */
+const struct v4l2_ioctl_ops *get_dec_ioctl_ops(bool singlePlaneMode);
+
+int nx_vpu_dec_open(struct nx_vpu_ctx *ctx, bool singlePlaneMode);
+int vpu_dec_open_instance(struct nx_vpu_ctx *ctx);
+int vpu_dec_parse_vid_cfg(struct nx_vpu_ctx *ctx, bool singlePlaneMode);
+int vpu_dec_init(struct nx_vpu_ctx *ctx);
+int vpu_dec_decode_slice(struct nx_vpu_ctx *ctx, bool flush);
+void nx_vpu_dec_close_instance(struct nx_vpu_ctx*);
+
+#endif          /* #define _nx_vpu_v4l2_H */
diff -ENwbur a/drivers/media/platform/nxp-vpu/regdefine.h b/drivers/media/platform/nxp-vpu/regdefine.h
--- a/drivers/media/platform/nxp-vpu/regdefine.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/regdefine.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,617 @@
+/*
+ *  This file is a part of VPU Reference API project
+ *------------------------------------------------------------------------------
+ *
+ *       This confidential and proprietary software may be used only
+ *     as authorized by a licensing agreement from Chips&Media Inc.
+ *     In the event of publication, the following notice is applicable:
+ *
+ *            (C) COPYRIGHT 2006 - 2011  CHIPS&MEDIA INC.
+ *                      ALL RIGHTS RESERVED
+ *
+ *       The entire notice above must be reproduced on all authorized
+ *       copies.
+ *
+ */
+
+#ifndef REGDEFINE_H_INCLUDED
+#define REGDEFINE_H_INCLUDED
+
+/*----------------------------------------------------------------------------
+ * REGISTER BASE
+ *----------------------------------------------------------------------------*/
+#define BIT_BASE			0x0000
+#define GDMA_BASE			0x1000
+#define MBC_BASE			0x0400
+#define ME_BASE				0x0600
+#define MC_BASE				0x0C00
+#define DMAC_BASE			0x2000
+#define NPT_BASE			0x3000
+#define BW_BASE				0x03000000
+
+/*----------------------------------------------------------------------------
+ * HARDWARE REGISTER
+ *----------------------------------------------------------------------------*/
+#define BIT_CODE_RUN			(BIT_BASE + 0x000)
+#define BIT_CODE_DOWN			(BIT_BASE + 0x004)
+#define BIT_INT_REQ			(BIT_BASE + 0x008)
+#define BIT_INT_CLEAR			(BIT_BASE + 0x00C)
+#define BIT_INT_STS			(BIT_BASE + 0x010)
+#define BIT_CODE_RESET			(BIT_BASE + 0x014)
+#define BIT_CUR_PC			(BIT_BASE + 0x018)
+#define BIT_SW_RESET			(BIT_BASE + 0x024)
+#define BIT_SW_RESET_STATUS		(BIT_BASE + 0x034)
+
+/* Added by SeongO Park 20130220 */
+#define BIT_USE_NX_EXPND		(BIT_BASE + 0x038)
+
+#define H_MBY_SYNC_IN			(BIT_BASE + 0x058)
+#define H_MBY_SYNC_OUT			(BIT_BASE + 0x05C)
+
+/*----------------------------------------------------------------------------
+ * GLOBAL REGISTER
+ *----------------------------------------------------------------------------*/
+#define BIT_CODE_BUF_ADDR		(BIT_BASE + 0x100)
+#define BIT_WORK_BUF_ADDR		(BIT_BASE + 0x104)
+#define BIT_PARA_BUF_ADDR		(BIT_BASE + 0x108)
+#define BIT_BIT_STREAM_CTRL		(BIT_BASE + 0x10C)
+#define BIT_FRAME_MEM_CTRL		(BIT_BASE + 0x110)
+#define	BIT_BIT_STREAM_PARAM		(BIT_BASE + 0x114)
+#define	BIT_TEMP_BUF_ADDR		(BIT_BASE + 0x118)
+
+#define BIT_RD_PTR			(BIT_BASE + 0x120)
+#define BIT_WR_PTR			(BIT_BASE + 0x124)
+
+/* internal used in f/w. */
+#define BIT_ROLLBACK_STATUS		(BIT_BASE + 0x128)
+
+#define BIT_AXI_SRAM_USE		(BIT_BASE + 0x140)
+#define BIT_BYTE_POS_FRAME_START	(BIT_BASE + 0x144)
+#define BIT_BYTE_POS_FRAME_END		(BIT_BASE + 0x148)
+#define BIT_FRAME_CYCLE			(BIT_BASE + 0x14C)
+
+#define	BIT_FRM_DIS_FLG			(BIT_BASE + 0x150)
+
+#define BIT_BUSY_FLAG			(BIT_BASE + 0x160)
+#define BIT_RUN_COMMAND			(BIT_BASE + 0x164)
+#define BIT_RUN_INDEX			(BIT_BASE + 0x168)
+#define BIT_RUN_COD_STD			(BIT_BASE + 0x16C)
+#define BIT_INT_ENABLE			(BIT_BASE + 0x170)
+#define BIT_INT_REASON			(BIT_BASE + 0x174)
+#define BIT_RUN_AUX_STD			(BIT_BASE + 0x178)
+
+/* MSG REGISTER ADDRESS changed */
+#define BIT_MSG_0			(BIT_BASE + 0x130)
+#define BIT_MSG_1			(BIT_BASE + 0x134)
+#define BIT_MSG_2			(BIT_BASE + 0x138)
+#define BIT_MSG_3			(BIT_BASE + 0x13C)
+
+#define MBC_BUSY			(MBC_BASE + 0x040)
+#define MC_BUSY				(MC_BASE + 0x004)
+
+/* Added By Ray Park 20120225 */
+#define BIT_ME_LINEBUFFER_MODE		(ME_BASE + 0x004)
+#define BIT_ME_LINE_OVERFLOW		(ME_BASE + 0x008)
+#define BIT_ME_SEARCH_OVERFLOW		(ME_BASE + 0x00C)
+
+/*----------------------------------------------------------------------------
+ * [ENC SEQ INIT] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_ENC_SEQ_BB_START		(BIT_BASE + 0x180)
+#define CMD_ENC_SEQ_BB_SIZE		(BIT_BASE + 0x184)
+
+/* HecEnable,ConstIntraQp, FMO, QPREP, AUD, SLICE, MB BIT */
+#define CMD_ENC_SEQ_OPTION		(BIT_BASE + 0x188)
+
+#define CMD_ENC_SEQ_COD_STD		(BIT_BASE + 0x18C)
+#define CMD_ENC_SEQ_SRC_SIZE		(BIT_BASE + 0x190)
+#define CMD_ENC_SEQ_SRC_F_RATE		(BIT_BASE + 0x194)
+#define CMD_ENC_SEQ_MP4_PARA		(BIT_BASE + 0x198)
+#define CMD_ENC_SEQ_263_PARA		(BIT_BASE + 0x19C)
+#define CMD_ENC_SEQ_264_PARA		(BIT_BASE + 0x1A0)
+#define CMD_ENC_SEQ_SLICE_MODE		(BIT_BASE + 0x1A4)
+#define CMD_ENC_SEQ_GOP_NUM		(BIT_BASE + 0x1A8)
+#define CMD_ENC_SEQ_RC_PARA		(BIT_BASE + 0x1AC)
+#define CMD_ENC_SEQ_RC_BUF_SIZE		(BIT_BASE + 0x1B0)
+#define CMD_ENC_SEQ_INTRA_REFRESH	(BIT_BASE + 0x1B4)
+#define CMD_ENC_SEQ_INTRA_QP		(BIT_BASE + 0x1C4)
+#define CMD_ENC_SEQ_RC_QP_MAX		(BIT_BASE + 0x1C8)
+#define CMD_ENC_SEQ_RC_GAMMA		(BIT_BASE + 0x1CC)
+
+/* mbInterval[32:2], rcIntervalMode[1:0] */
+#define CMD_ENC_SEQ_RC_INTERVAL_MODE	(BIT_BASE + 0x1D0)
+
+#define CMD_ENC_SEQ_INTRA_WEIGHT	(BIT_BASE + 0x1D4)
+#define CMD_ENC_SEQ_ME_OPTION		(BIT_BASE + 0x1D8)
+#define CMD_ENC_SEQ_RC_PARA2		(BIT_BASE + 0x1DC)
+#define CMD_ENC_SEQ_QP_RANGE_SET	(BIT_BASE + 0x1E0)
+#define CMD_ENC_SEQ_RC_MAX_INTRA_SIZE	(BIT_BASE + 0x1F0)
+
+#define CMD_ENC_SEQ_FIRST_MBA		(BIT_BASE + 0x1E4)
+#define CMD_ENC_SEQ_HEIGHT_IN_MAP_UNITS	(BIT_BASE + 0x1E8)
+#define CMD_ENC_SEQ_OVERLAP_CLIP_SIZE	(BIT_BASE + 0x1EC)
+
+/*----------------------------------------------------------------------------
+ * [ENC SEQ END] COMMAND
+ *----------------------------------------------------------------------------*/
+#define RET_ENC_SEQ_ENC_SUCCESS		(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [ENC PIC RUN] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_ENC_PIC_SRC_INDEX		(BIT_BASE + 0x180)
+#define CMD_ENC_PIC_SRC_STRIDE		(BIT_BASE + 0x184)
+#define CMD_ENC_PIC_SRC_ADDR_Y		(BIT_BASE + 0x1A8)
+#define CMD_ENC_PIC_SRC_ADDR_CB		(BIT_BASE + 0x1AC)
+#define CMD_ENC_PIC_SRC_ADDR_CR		(BIT_BASE + 0x1B0)
+#define CMD_ENC_PIC_QS			(BIT_BASE + 0x18C)
+#define CMD_ENC_PIC_ROT_MODE		(BIT_BASE + 0x190)
+#define CMD_ENC_PIC_OPTION		(BIT_BASE + 0x194)
+#define CMD_ENC_PIC_BB_START		(BIT_BASE + 0x198)
+#define CMD_ENC_PIC_BB_SIZE		(BIT_BASE + 0x19C)
+#define CMD_ENC_PIC_PARA_BASE_ADDR	(BIT_BASE + 0x1A0)
+#define CMD_ENC_PIC_SUB_FRAME_SYNC	(BIT_BASE + 0x1A4)
+
+#define RET_ENC_PIC_FRAME_NUM		(BIT_BASE + 0x1C0)
+#define RET_ENC_PIC_TYPE		(BIT_BASE + 0x1C4)
+#define RET_ENC_PIC_FRAME_IDX		(BIT_BASE + 0x1C8)
+#define RET_ENC_PIC_SLICE_NUM		(BIT_BASE + 0x1CC)
+#define RET_ENC_PIC_FLAG		(BIT_BASE + 0x1D0)
+#define RET_ENC_PIC_SUCCESS		(BIT_BASE + 0x1D8)
+
+/*----------------------------------------------------------------------------
+ * [ENC SET FRAME BUF] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_SET_FRAME_SUBSAMP_A		(BIT_BASE + 0x188)
+#define CMD_SET_FRAME_SUBSAMP_B		(BIT_BASE + 0x18C)
+#define CMD_SET_FRAME_DP_BUF_BASE	(BIT_BASE + 0x1B0)
+#define CMD_SET_FRAME_DP_BUF_SIZE	(BIT_BASE + 0x1B4)
+
+/*----------------------------------------------------------------------------
+ * [ENC HEADER] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_ENC_HEADER_CODE		(BIT_BASE + 0x180)
+#define CMD_ENC_HEADER_BB_START		(BIT_BASE + 0x184)
+#define CMD_ENC_HEADER_BB_SIZE		(BIT_BASE + 0x188)
+#define CMD_ENC_HEADER_FRAME_CROP_H	(BIT_BASE + 0x18C)
+#define CMD_ENC_HEADER_FRAME_CROP_V	(BIT_BASE + 0x190)
+
+#define RET_ENC_HEADER_SUCCESS		(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [ENC_PARA_SET] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_ENC_PARA_SET_TYPE		(BIT_BASE + 0x180)
+#define RET_ENC_PARA_SET_SIZE		(BIT_BASE + 0x1c0)
+#define RET_ENC_PARA_SET_SUCCESS	(BIT_BASE + 0x1C4)
+
+/*----------------------------------------------------------------------------
+ * [ENC PARA CHANGE] COMMAND :
+ *----------------------------------------------------------------------------*/
+/* FrameRateEn[3], BitRateEn[2], IntraQpEn[1], GopEn[0] */
+#define CMD_ENC_SEQ_PARA_CHANGE_ENABLE	(BIT_BASE + 0x180)
+
+#define CMD_ENC_SEQ_PARA_RC_GOP		(BIT_BASE + 0x184)
+#define CMD_ENC_SEQ_PARA_RC_INTRA_QP	(BIT_BASE + 0x188)
+#define CMD_ENC_SEQ_PARA_RC_BITRATE	(BIT_BASE + 0x18C)
+#define CMD_ENC_SEQ_PARA_RC_FRAME_RATE	(BIT_BASE + 0x190)
+#define	CMD_ENC_SEQ_PARA_INTRA_MB_NUM	(BIT_BASE + 0x194)
+#define CMD_ENC_SEQ_PARA_SLICE_MODE	(BIT_BASE + 0x198)
+#define CMD_ENC_SEQ_PARA_HEC_MODE	(BIT_BASE + 0x19C)
+
+#define RET_ENC_SEQ_PARA_CHANGE_SECCESS	(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [DEC SEQ INIT] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_DEC_SEQ_BB_START		(BIT_BASE + 0x180)
+#define CMD_DEC_SEQ_BB_SIZE		(BIT_BASE + 0x184)
+#define CMD_DEC_SEQ_OPTION		(BIT_BASE + 0x188)
+
+#define CMD_DEC_SEQ_MP4_ASP_CLASS	(BIT_BASE + 0x19C)
+#define CMD_DEC_SEQ_VC1_STREAM_FMT	(BIT_BASE + 0x19C)
+#define CMD_DEC_SEQ_X264_MV_EN		(BIT_BASE + 0x19C)
+#define CMD_DEC_SEQ_SPP_CHUNK_SIZE	(BIT_BASE + 0x1A0)
+
+/* For MPEG2 only */
+#define CMD_DEC_SEQ_USER_DATA_OPTION	(BIT_BASE + 0x194)
+#define CMD_DEC_SEQ_USER_DATA_BASE_ADDR	(BIT_BASE + 0x1AC)
+#define CMD_DEC_SEQ_USER_DATA_BUF_SIZE	(BIT_BASE + 0x1B0)
+
+#define CMD_DEC_SEQ_INIT_ESCAPE		(BIT_BASE + 0x114)
+
+#define RET_DEC_SEQ_BIT_RATE		(BIT_BASE + 0x1B4)
+#define RET_DEC_SEQ_EXT_INFO		(BIT_BASE + 0x1B8)
+#define RET_DEC_SEQ_SUCCESS		(BIT_BASE + 0x1C0)
+#define RET_DEC_SEQ_SRC_SIZE		(BIT_BASE + 0x1C4)
+#define RET_DEC_SEQ_ASPECT		(BIT_BASE + 0x1C8)
+#define RET_DEC_SEQ_FRAME_NEED		(BIT_BASE + 0x1CC)
+#define RET_DEC_SEQ_FRAME_DELAY		(BIT_BASE + 0x1D0)
+#define RET_DEC_SEQ_INFO		(BIT_BASE + 0x1D4)
+#define RET_DEC_SEQ_VP8_SCALE_INFO	(BIT_BASE + 0x1D4)
+
+#define RET_DEC_SEQ_CROP_LEFT_RIGHT	(BIT_BASE + 0x1D8)
+#define RET_DEC_SEQ_CROP_TOP_BOTTOM	(BIT_BASE + 0x1DC)
+#define RET_DEC_SEQ_SEQ_ERR_REASON	(BIT_BASE + 0x1E0)
+
+#define RET_DEC_SEQ_FRATE_NR		(BIT_BASE + 0x1E4)
+#define RET_DEC_SEQ_FRATE_DR		(BIT_BASE + 0x1E8)
+#define RET_DEC_SEQ_HEADER_REPORT	(BIT_BASE + 0x1EC)
+#define RET_DEC_SEQ_VUI_INFO		(BIT_BASE + 0x18C)
+#define RET_DEC_SEQ_VUI_PIC_STRUCT	(BIT_BASE + 0x1A8)
+
+/*----------------------------------------------------------------------------
+ * [DEC SEQ END] COMMAND
+ *----------------------------------------------------------------------------*/
+#define RET_DEC_SEQ_END_SUCCESS		(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [DEC PIC RUN] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_DEC_PIC_ROT_MODE		(BIT_BASE + 0x180)
+#define CMD_DEC_PIC_ROT_INDEX		(BIT_BASE + 0x184)
+#define CMD_DEC_PIC_ROT_ADDR_Y		(BIT_BASE + 0x188)
+#define CMD_DEC_PIC_ROT_ADDR_CB		(BIT_BASE + 0x18C)
+#define CMD_DEC_PIC_ROT_ADDR_CR		(BIT_BASE + 0x190)
+#define CMD_DEC_PIC_ROT_STRIDE		(BIT_BASE + 0x1B8)
+
+#define CMD_DEC_PIC_OPTION		(BIT_BASE + 0x194)
+
+/* Added by SeongO Park 20120226*/
+#define	CMD_DEC_PIC_SKIP_NUM		(BIT_BASE + 0x198)
+
+#define CMD_DEC_PIC_USER_DATA_BASE_ADDR	(BIT_BASE + 0x1AC)
+#define CMD_DEC_PIC_USER_DATA_BUF_SIZE	(BIT_BASE + 0x1B0)
+
+#define CMD_DEC_PIC_NUM_ROWS		(BIT_BASE + 0x1B4)
+#define CMD_DEC_PIC_THO_PIC_PARA	(BIT_BASE + 0x198)
+#define CMD_DEC_PIC_THO_QMAT_ADDR	(BIT_BASE + 0x1A0)
+#define CMD_DEC_PIC_THO_MB_PARA_ADDR	(BIT_BASE + 0x1A4)
+#define RET_DEC_PIC_AVC_FPA_SEI0	(BIT_BASE + 0x19C)
+#define RET_DEC_PIC_AVC_FPA_SEI1	(BIT_BASE + 0x1A0)
+#define RET_DEC_PIC_AVC_FPA_SEI2	(BIT_BASE + 0x1A4)
+
+#define RET_DEC_NUM_MB_ROWS		(BIT_BASE + 0x1B4)
+#define RET_DEC_PIC_HRD_INFO		(BIT_BASE + 0x1B8)
+#define RET_DEC_PIC_SIZE		(BIT_BASE + 0x1BC)
+#define RET_DEC_PIC_FRAME_NUM		(BIT_BASE + 0x1C0)
+#define RET_DEC_PIC_FRAME_IDX		(BIT_BASE + 0x1C4)
+#define RET_DEC_PIC_DISPLAY_IDX		(BIT_BASE + 0x1C4)
+#define RET_DEC_PIC_ERR_MB		(BIT_BASE + 0x1C8)
+#define RET_DEC_PIC_TYPE		(BIT_BASE + 0x1CC)
+#define RET_DEC_PIC_POST		(BIT_BASE + 0x1D0)	/* for VC1 */
+#define RET_DEC_PIC_MVC_REPORT		(BIT_BASE + 0x1D0)	/* for MVC */
+#define RET_DEC_PIC_OPTION		(BIT_BASE + 0x1D4)
+#define RET_DEC_PIC_SUCCESS		(BIT_BASE + 0x1D8)
+#define RET_DEC_PIC_CUR_IDX		(BIT_BASE + 0x1DC)
+#define RET_DEC_PIC_DECODED_IDX		(BIT_BASE + 0x1DC)
+
+/* for AVC, MPEG-2 */
+#define	RET_DEC_PIC_CROP_LEFT_RIGHT	(BIT_BASE + 0x1E0)
+#define RET_DEC_PIC_CROP_TOP_BOTTOM	(BIT_BASE + 0x1E4)
+
+/* for MP4 */
+#define	RET_DEC_PIC_MODULO_TIME_BASE	(BIT_BASE + 0x1E0)
+#define RET_DEC_PIC_VOP_TIME_INCREMENT	(BIT_BASE + 0x1E4)
+
+#define RET_DEC_PIC_RV_TR		(BIT_BASE + 0x1E8)
+#define RET_DEC_PIC_VP8_PIC_REPORT	(BIT_BASE + 0x1E8)
+
+/* H.264, MEPEG2 */
+#define RET_DEC_PIC_ATSC_USER_DATA_INFO	(BIT_BASE + 0x1E8)
+
+#define RET_DEC_PIC_VUI_INFO		(BIT_BASE + 0x1EC)
+#define RET_DEC_PIC_ASPECT		(BIT_BASE + 0x1F0)
+#define RET_DEC_PIC_VP8_SCALE_INFO	(BIT_BASE + 0x1F0)
+#define RET_DEC_PIC_FRATE_NR		(BIT_BASE + 0x1F4)
+#define RET_DEC_PIC_FRATE_DR		(BIT_BASE + 0x1F8)
+#define RET_DEC_PIC_POC_TOP		(BIT_BASE + 0x1AC)
+#define RET_DEC_PIC_POC_BOT		(BIT_BASE + 0x1B0)
+
+/*----------------------------------------------------------------------------
+ * [DEC SET FRAME BUF] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_SET_FRAME_BUF_NUM		(BIT_BASE + 0x180)
+#define CMD_SET_FRAME_BUF_STRIDE	(BIT_BASE + 0x184)
+
+#define CMD_SET_FRAME_SLICE_BB_START	(BIT_BASE + 0x188)
+#define CMD_SET_FRAME_SLICE_BB_SIZE	(BIT_BASE + 0x18C)
+#define CMD_SET_FRAME_AXI_BIT_ADDR	(BIT_BASE + 0x190)
+#define CMD_SET_FRAME_AXI_IPACDC_ADDR	(BIT_BASE + 0x194)
+#define CMD_SET_FRAME_AXI_DBKY_ADDR	(BIT_BASE + 0x198)
+#define CMD_SET_FRAME_AXI_DBKC_ADDR	(BIT_BASE + 0x19C)
+#define CMD_SET_FRAME_AXI_OVL_ADDR	(BIT_BASE + 0x1A0)
+#define CMD_SET_FRAME_AXI_BTP_ADDR	(BIT_BASE + 0x1A4)
+
+#define CMD_SET_FRAME_CACHE_SIZE	(BIT_BASE + 0x1A8)
+#define CMD_SET_FRAME_CACHE_CONFIG	(BIT_BASE + 0x1AC)
+#define CMD_SET_FRAME_MB_BUF_BASE	(BIT_BASE + 0x1B0)
+#define CMD_SET_FRAME_MAX_DEC_SIZE	(BIT_BASE + 0x1B8)
+#define CMD_SET_FRAME_DELAY		(BIT_BASE + 0x1BC)
+
+#define RET_SET_FRAME_SUCCESS		(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [DEC_PARA_SET] COMMAND
+ *----------------------------------------------------------------------------*/
+#define CMD_DEC_PARA_SET_TYPE		(BIT_BASE + 0x180)
+#define CMD_DEC_PARA_SET_SIZE		(BIT_BASE + 0x184)
+
+#define RET_DEC_PARA_SET_SUCCESS	(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [DEC_BUF_FLUSH] COMMAND
+ *----------------------------------------------------------------------------*/
+#define RET_DEC_BUF_FLUSH_SUCCESS	(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [SLEEP/WAKE] COMMAND
+ *----------------------------------------------------------------------------*/
+#define RET_SLEEP_WAKE_SUCCESS		(BIT_BASE + 0x1C0)
+
+/*----------------------------------------------------------------------------
+ * [SET PIC INFO] COMMAND
+ *----------------------------------------------------------------------------*/
+#define GDI_PRI_RD_PRIO_L		(GDMA_BASE + 0x000)
+#define GDI_PRI_RD_PRIO_H		(GDMA_BASE + 0x004)
+#define GDI_PRI_WR_PRIO_L		(GDMA_BASE + 0x008)
+#define GDI_PRI_WR_PRIO_H		(GDMA_BASE + 0x00c)
+#define GDI_PRI_RD_LOCK_CNT		(GDMA_BASE + 0x010)
+#define GDI_PRI_WR_LOCK_CNT		(GDMA_BASE + 0x014)
+#define GDI_SEC_RD_PRIO_L		(GDMA_BASE + 0x018)
+#define GDI_SEC_RD_PRIO_H		(GDMA_BASE + 0x01c)
+#define GDI_SEC_WR_PRIO_L		(GDMA_BASE + 0x020)
+#define GDI_SEC_WR_PRIO_H		(GDMA_BASE + 0x024)
+#define GDI_SEC_RD_LOCK_CNT		(GDMA_BASE + 0x028)
+#define GDI_SEC_WR_LOCK_CNT		(GDMA_BASE + 0x02c)
+#define GDI_SEC_CLIENT_EN		(GDMA_BASE + 0x030)
+#define GDI_CONTROL			(GDMA_BASE + 0x034)
+#define GDI_PIC_INIT_HOST		(GDMA_BASE + 0x038)
+
+#define GDI_HW_VERINFO			(GDMA_BASE + 0x050)
+#define GDI_PINFO_REQ			(GDMA_BASE + 0x060)
+#define GDI_PINFO_ACK			(GDMA_BASE + 0x064)
+#define GDI_PINFO_ADDR			(GDMA_BASE + 0x068)
+#define GDI_PINFO_DATA			(GDMA_BASE + 0x06c)
+#define GDI_BWB_ENABLE			(GDMA_BASE + 0x070)
+#define GDI_BWB_SIZE			(GDMA_BASE + 0x074)
+#define GDI_BWB_STD_STRUCT		(GDMA_BASE + 0x078)
+#define GDI_BWB_STATUS			(GDMA_BASE + 0x07c)
+
+#define GDI_STATUS			(GDMA_BASE + 0x080)
+
+#define GDI_DEBUG_0			(GDMA_BASE + 0x084)
+#define GDI_DEBUG_1			(GDMA_BASE + 0x088)
+#define GDI_DEBUG_2			(GDMA_BASE + 0x08c)
+#define GDI_DEBUG_3			(GDMA_BASE + 0x090)
+#define GDI_DEBUG_PROBE_ADDR		(GDMA_BASE + 0x094)
+#define GDI_DEBUG_PROBE_DATA		(GDMA_BASE + 0x098)
+
+/* write protect  */
+#define GDI_WPROT_ERR_CLR		(GDMA_BASE + 0x0A0)
+#define GDI_WPROT_ERR_RSN		(GDMA_BASE + 0x0A4)
+#define GDI_WPROT_ERR_ADR		(GDMA_BASE + 0x0A8)
+#define GDI_WPROT_RGN_EN		(GDMA_BASE + 0x0AC)
+#define GDI_WPROT_RGN0_STA		(GDMA_BASE + 0x0B0)
+#define GDI_WPROT_RGN0_END		(GDMA_BASE + 0x0B4)
+#define GDI_WPROT_RGN1_STA		(GDMA_BASE + 0x0B8)
+#define GDI_WPROT_RGN1_END		(GDMA_BASE + 0x0BC)
+#define GDI_WPROT_RGN2_STA		(GDMA_BASE + 0x0C0)
+#define GDI_WPROT_RGN2_END		(GDMA_BASE + 0x0C4)
+#define GDI_WPROT_RGN3_STA		(GDMA_BASE + 0x0C8)
+#define GDI_WPROT_RGN3_END		(GDMA_BASE + 0x0CC)
+#define GDI_WPROT_RGN4_STA		(GDMA_BASE + 0x0D0)
+#define GDI_WPROT_RGN4_END		(GDMA_BASE + 0x0D4)
+#define GDI_WPROT_RGN5_STA		(GDMA_BASE + 0x0D8)
+#define GDI_WPROT_RGN5_END		(GDMA_BASE + 0x0DC)
+
+#define GDI_BUS_CTRL			(GDMA_BASE + 0x0F0)
+#define GDI_BUS_STATUS			(GDMA_BASE + 0x0F4)
+
+#define GDI_SIZE_ERR_FLAG		(GDMA_BASE + 0x0e0)
+#define GDI_ADR_RQ_SIZE_ERR_PRI0	(GDMA_BASE + 0x100)
+#define GDI_ADR_RQ_SIZE_ERR_PRI1	(GDMA_BASE + 0x104)
+#define GDI_ADR_RQ_SIZE_ERR_PRI1	(GDMA_BASE + 0x104)
+#define GDI_ADR_RQ_SIZE_ERR_PRI2	(GDMA_BASE + 0x108)
+#define GDI_ADR_WQ_SIZE_ERR_PRI0	(GDMA_BASE + 0x10c)
+#define GDI_ADR_WQ_SIZE_ERR_PRI1	(GDMA_BASE + 0x110)
+#define GDI_ADR_WQ_SIZE_ERR_PRI2	(GDMA_BASE + 0x114)
+
+#define GDI_ADR_RQ_SIZE_ERR_SEC0	(GDMA_BASE + 0x118)
+#define GDI_ADR_RQ_SIZE_ERR_SEC1	(GDMA_BASE + 0x11c)
+#define GDI_ADR_RQ_SIZE_ERR_SEC2	(GDMA_BASE + 0x120)
+
+#define GDI_ADR_WQ_SIZE_ERR_SEC0	(GDMA_BASE + 0x124)
+#define GDI_ADR_WQ_SIZE_ERR_SEC1	(GDMA_BASE + 0x128)
+#define GDI_ADR_WQ_SIZE_ERR_SEC2	(GDMA_BASE + 0x12c)
+
+#define GDI_INFO_CONTROL		(GDMA_BASE + 0x400)
+#define GDI_INFO_PIC_SIZE		(GDMA_BASE + 0x404)
+#define GDI_INFO_BASE_Y			(GDMA_BASE + 0x408)
+#define GDI_INFO_BASE_CB		(GDMA_BASE + 0x40C)
+#define GDI_INFO_BASE_CR		(GDMA_BASE + 0x410)
+
+#define GDI_XY2_CAS_0			(GDMA_BASE + 0x800)
+#define GDI_XY2_CAS_F			(GDMA_BASE + 0x83C)
+
+#define GDI_XY2_BA_0			(GDMA_BASE + 0x840)
+#define GDI_XY2_BA_1			(GDMA_BASE + 0x844)
+#define GDI_XY2_BA_2			(GDMA_BASE + 0x848)
+#define GDI_XY2_BA_3			(GDMA_BASE + 0x84C)
+
+#define GDI_XY2_RAS_0			(GDMA_BASE + 0x850)
+#define GDI_XY2_RAS_F			(GDMA_BASE + 0x88C)
+
+#define GDI_XY2_RBC_CONFIG		(GDMA_BASE + 0x890)
+#define GDI_RBC2_AXI_0			(GDMA_BASE + 0x8A0)
+#define GDI_RBC2_AXI_1F			(GDMA_BASE + 0x91C)
+#define GDI_TILEDBUF_BASE		(GDMA_BASE + 0x920)
+
+/*----------------------------------------------------------------------------
+ * Product, Reconfiguration Information
+ *----------------------------------------------------------------------------*/
+/* product name and version */
+#define DBG_CONFIG_REPORT_0		(GDMA_BASE + 0x040)
+
+/* interface configuration, hardware definition */
+#define DBG_CONFIG_REPORT_1		(GDMA_BASE + 0x044)
+
+/* standard definition */
+#define DBG_CONFIG_REPORT_2		(GDMA_BASE + 0x048)
+
+/* standard detail definition */
+#define DBG_CONFIG_REPORT_3		(GDMA_BASE + 0x04C)
+
+/* definition in cnm_define */
+#define DBG_CONFIG_REPORT_4		(GDMA_BASE + 0x050)
+
+#define DBG_CONFIG_REPORT_5		(GDMA_BASE + 0x054)
+#define DBG_CONFIG_REPORT_6		(GDMA_BASE + 0x058)
+#define DBG_CONFIG_REPORT_7		(GDMA_BASE + 0x05C)
+
+/*----------------------------------------------------------------------------
+ * MEMORY COPY MODULE REGISTER
+ *----------------------------------------------------------------------------*/
+#define	ADDR_DMAC_PIC_RUN		(DMAC_BASE+0x000)
+#define	ADDR_DMAC_PIC_STATUS		(DMAC_BASE+0x004)
+#define	ADDR_DMAC_PIC_OP_MODE		(DMAC_BASE+0x008)
+
+/* the result muse be 0x4d435059  */
+#define	ADDR_DMAC_ID			(DMAC_BASE+0x00c)
+
+#define	ADDR_DMAC_SRC_BASE_Y		(DMAC_BASE+0x010)
+#define	ADDR_DMAC_SRC_BASE_CB		(DMAC_BASE+0x014)
+#define	ADDR_DMAC_SRC_BASE_CR		(DMAC_BASE+0x018)
+#define	ADDR_DMAC_SRC_STRIDE		(DMAC_BASE+0x01c)
+
+#define	ADDR_DMAC_DST_BASE_Y		(DMAC_BASE+0x020)
+#define	ADDR_DMAC_DST_BASE_CB		(DMAC_BASE+0x024)
+#define	ADDR_DMAC_DST_BASE_CR		(DMAC_BASE+0x028)
+#define	ADDR_DMAC_DST_STRIDE		(DMAC_BASE+0x02c)
+
+#define	ADDR_DMAC_SRC_MB_POS_X		(DMAC_BASE+0x030)
+#define	ADDR_DMAC_SRC_MB_POS_Y		(DMAC_BASE+0x034)
+#define	ADDR_DMAC_SRC_MB_BLK_X		(DMAC_BASE+0x038)
+#define	ADDR_DMAC_SRC_MB_BLK_Y		(DMAC_BASE+0x03c)
+
+#define	ADDR_DMAC_DST_MB_POS_X		(DMAC_BASE+0x040)
+#define	ADDR_DMAC_DST_MB_POS_Y		(DMAC_BASE+0x044)
+#define	ADDR_DMAC_DST_MB_BLK_X		(DMAC_BASE+0x048)
+#define	ADDR_DMAC_DST_MB_BLK_Y		(DMAC_BASE+0x04c)
+
+#define	ADDR_DMAC_SET_COLOR_Y		(DMAC_BASE+0x050)
+#define	ADDR_DMAC_SET_COLOR_CB		(DMAC_BASE+0x054)
+#define	ADDR_DMAC_SET_COLOR_CR		(DMAC_BASE+0x058)
+
+#define	ADDR_DMAC_SUB_SAMPLE_X		(DMAC_BASE+0x060)
+#define	ADDR_DMAC_SUB_SAMPLE_Y		(DMAC_BASE+0x064)
+
+/*----------------------------------------------------------------------------
+ * NIEUPORT REGISTERS
+ *----------------------------------------------------------------------------*/
+#define MJPEG_PIC_START_REG		(NPT_BASE + 0x000)
+#define MJPEG_PIC_STATUS_REG		(NPT_BASE + 0x004)
+#define MJPEG_PIC_ERRMB_REG		(NPT_BASE + 0x008)
+#define MJPEG_PIC_SETMB_REG		(NPT_BASE + 0x00C)
+#define MJPEG_PIC_CTRL_REG		(NPT_BASE + 0x010)
+#define MJPEG_PIC_SIZE_REG		(NPT_BASE + 0x014)
+#define MJPEG_MCU_INFO_REG		(NPT_BASE + 0x018)
+#define MJPEG_ROT_INFO_REG		(NPT_BASE + 0x01C)
+
+#define MJPEG_SCL_INFO_REG		(NPT_BASE + 0x020)
+#define MJPEG_IF_INFO_REG		(NPT_BASE + 0x024)
+#define MJPEG_OP_INFO_REG		(NPT_BASE + 0x02C)
+
+#define MJPEG_DPB_CONFIG_REG		(NPT_BASE + 0x030)
+#define MJPEG_WRESP_CHECK_REG		(NPT_BASE + 0x034)
+
+#define MJPEG_DPB_BASE00_REG		(NPT_BASE + 0x040)
+#define MJPEG_DPB_BASE10_REG		(NPT_BASE + 0x044)
+#define MJPEG_DPB_BASE20_REG		(NPT_BASE + 0x048)
+#define MJPEG_DPB_BASE30_REG		(NPT_BASE + 0x04C)
+
+#define MJPEG_HUFF_CTRL_REG		(NPT_BASE + 0x080)
+#define MJPEG_HUFF_ADDR_REG		(NPT_BASE + 0x084)
+#define MJPEG_HUFF_DATA_REG		(NPT_BASE + 0x088)
+
+#define MJPEG_QMAT_CTRL_REG		(NPT_BASE + 0x090)
+#define MJPEG_QMAT_ADDR_REG		(NPT_BASE + 0x094)
+#define MJPEG_QMAT_DATA_REG		(NPT_BASE + 0x098)
+
+#define MJPEG_COEF_CTRL_REG		(NPT_BASE + 0x0A0)
+#define MJPEG_COEF_ADDR_REG		(NPT_BASE + 0x0A4)
+#define MJPEG_COEF_DATA_REG		(NPT_BASE + 0x0A8)
+
+#define MJPEG_RST_INTVAL_REG		(NPT_BASE + 0x0B0)
+#define MJPEG_RST_INDEX_REG		(NPT_BASE + 0x0B4)
+#define MJPEG_RST_COUNT_REG		(NPT_BASE + 0x0B8)
+
+#define	MJPEG_INTR_MASK_REG		(NPT_BASE + 0x0C0)
+#define MJPEG_CYCLE_INFO_REG		(NPT_BASE + 0x0C8)
+
+#define MJPEG_DPCM_DIFF_Y_REG		(NPT_BASE + 0x0F0)
+#define MJPEG_DPCM_DIFF_CB_REG		(NPT_BASE + 0x0F4)
+#define MJPEG_DPCM_DIFF_CR_REG		(NPT_BASE + 0x0F8)
+
+/* GBU */
+#define MJPEG_GBU_CTRL_REG		(NPT_BASE + 0x100)
+
+#define MJPEG_GBU_BT_PTR_REG		(NPT_BASE + 0x110)
+#define MJPEG_GBU_WD_PTR_REG		(NPT_BASE + 0x114)
+#define MJPEG_GBU_TT_CNT_REG		(NPT_BASE + 0x118)
+/*#define MJPEG_GBU_TT_CNT_REG+4	(NPT_BASE + 0x11C) */
+
+#define MJPEG_GBU_BBSR_REG		(NPT_BASE + 0x140)
+#define MJPEG_GBU_BBER_REG		(NPT_BASE + 0x144)
+#define MJPEG_GBU_BBIR_REG		(NPT_BASE + 0x148)
+#define MJPEG_GBU_BBHR_REG		(NPT_BASE + 0x14C)
+
+#define MJPEG_GBU_BCNT_REG		(NPT_BASE + 0x158)
+
+#define MJPEG_GBU_FF_RPTR_REG		(NPT_BASE + 0x160)
+#define MJPEG_GBU_FF_WPTR_REG		(NPT_BASE + 0x164)
+
+/* BBC */
+#define MJPEG_BBC_END_ADDR_REG		(NPT_BASE + 0x208)
+#define MJPEG_BBC_WR_PTR_REG		(NPT_BASE + 0x20C)
+#define MJPEG_BBC_RD_PTR_REG		(NPT_BASE + 0x210)
+
+#define MJPEG_BBC_EXT_ADDR_REG		(NPT_BASE + 0x214)
+#define MJPEG_BBC_INT_ADDR_REG		(NPT_BASE + 0x218)
+#define MJPEG_BBC_DATA_CNT_REG		(NPT_BASE + 0x21C)
+#define MJPEG_BBC_COMMAND_REG		(NPT_BASE + 0x220)
+#define MJPEG_BBC_BUSY_REG		(NPT_BASE + 0x224)
+
+#define MJPEG_BBC_CTRL_REG		(NPT_BASE + 0x228)
+#define MJPEG_BBC_CUR_POS_REG		(NPT_BASE + 0x22C)
+
+#define MJPEG_BBC_BAS_ADDR_REG		(NPT_BASE + 0x230)
+#define MJPEG_BBC_STRM_CTRL_REG		(NPT_BASE + 0x234)
+
+#define MJPEG_BBC_FLUSH_CMD_REG		(NPT_BASE + 0x238)
+
+/*----------------------------------------------------------------------------
+ * DMAC
+ *----------------------------------------------------------------------------*/
+#define DMAC_DMAC_RUN			(DMAC_BASE + 0x00)
+#define DMAC_SOFT_RESET			(DMAC_BASE + 0x04)
+#define DMAC_DMAC_MODE			(DMAC_BASE + 0x08)
+#define DMAC_DESC_ADDR			(DMAC_BASE + 0x0c)
+#define DMAC_DESC0			(DMAC_BASE + 0x10)
+#define DMAC_DESC1			(DMAC_BASE + 0x14)
+#define DMAC_DESC2			(DMAC_BASE + 0x18)
+#define DMAC_DESC3			(DMAC_BASE + 0x1c)
+#define DMAC_DESC4			(DMAC_BASE + 0x20)
+#define DMAC_DESC5			(DMAC_BASE + 0x24)
+#define DMAC_DESC6			(DMAC_BASE + 0x28)
+#define DMAC_DESC7			(DMAC_BASE + 0x2c)
+
+/*----------------------------------------------------------------------------
+ * [FIRMWARE VERSION] COMMAND
+ * [32:16] project number =>
+ * [16:0]  version => xxxx.xxxx.xxxxxxxx
+ *----------------------------------------------------------------------------*/
+#define RET_FW_VER_NUM			(BIT_BASE + 0x1c0)
+#define RET_FW_CODE_REV			(BIT_BASE + 0x1c4)
+
+#endif
diff -ENwbur a/drivers/media/platform/nxp-vpu/vpu_hw_interface.c b/drivers/media/platform/nxp-vpu/vpu_hw_interface.c
--- a/drivers/media/platform/nxp-vpu/vpu_hw_interface.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/vpu_hw_interface.c	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "vpu_hw_interface.h"
+
+#define DBG_VBS 0
+
+static void *gstBaseAddr;
+
+
+/*----------------------------------------------------------------------------
+ *	Register Interface
+ */
+
+void VpuWriteReg(uint32_t offset, uint32_t value)
+{
+	uint32_t *addr = (uint32_t *)((void *)(gstBaseAddr + offset));
+#if NX_REG_EN_MSG
+	NX_DbgMsg(NX_REG_EN_MSG, ("write(0x%08x, 0x%08x)addr(%p)\n", offset,
+		value, addr));
+#endif
+	*addr = value;
+}
+
+uint32_t VpuReadReg(uint32_t offset)
+{
+#if NX_REG_EN_MSG
+
+	NX_DbgMsg(NX_REG_EN_MSG, ("read(0x%08x, 0x%08x)\n", offset,
+		*((int32_t *)(gstBaseAddr + offset))));
+#endif
+	return *((uint32_t *)(gstBaseAddr+offset));
+}
+
+void WriteRegNoMsg(uint32_t offset, uint32_t value)
+{
+	uint32_t *addr = gstBaseAddr + offset;
+	*addr = value;
+}
+
+uint32_t ReadRegNoMsg(uint32_t offset)
+{
+	return *((uint32_t *)(gstBaseAddr+offset));
+}
+
+void WriteReg32(uint32_t *address, uint32_t value)
+{
+	*address = value;
+}
+
+uint32_t ReadReg32(uint32_t *address)
+{
+	return *address;
+}
+
+void InitVpuRegister(void *virAddr)
+{
+	gstBaseAddr = virAddr;
+}
+
+uint32_t *GetVpuRegBase(void)
+{
+	return gstBaseAddr;
+}
+
+/*----------------------------------------------------------------------------
+ *		Host Command
+ */
+void VpuBitIssueCommand(struct nx_vpu_codec_inst *inst, enum nx_vpu_cmd cmd)
+{
+	NX_DbgMsg(DBG_VBS, ("VpuBitIssueCommand : cmd = %d, address=0x%llx, ",
+		cmd, inst->instBufPhyAddr));
+	NX_DbgMsg(DBG_VBS, ("instIndex=%d, codecMode=%d, auxMode=%d\n",
+		inst->instIndex, inst->codecMode, inst->auxMode));
+
+	VpuWriteReg(BIT_WORK_BUF_ADDR, (uint32_t)inst->instBufPhyAddr);
+	VpuWriteReg(BIT_BUSY_FLAG, 1);
+	VpuWriteReg(BIT_RUN_INDEX, inst->instIndex);
+	VpuWriteReg(BIT_RUN_COD_STD, inst->codecMode);
+	VpuWriteReg(BIT_RUN_AUX_STD, inst->auxMode);
+	VpuWriteReg(BIT_RUN_COMMAND, cmd);
+}
diff -ENwbur a/drivers/media/platform/nxp-vpu/vpu_hw_interface.h b/drivers/media/platform/nxp-vpu/vpu_hw_interface.h
--- a/drivers/media/platform/nxp-vpu/vpu_hw_interface.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/vpu_hw_interface.h	2018-05-06 08:49:50.074731776 +0200
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __VPU_HW_INTERFACE_H__
+#define	__VPU_HW_INTERFACE_H__
+
+#include "nx_vpu_config.h"
+#include "regdefine.h"
+#include "nx_vpu_api.h"
+
+
+/*----------------------------------------------------------------------------
+ *		Register Interface
+ */
+
+
+/* Offset Based Register Access for VPU */
+void VpuWriteReg(uint32_t offset, uint32_t value);
+uint32_t VpuReadReg(uint32_t offset);
+void WriteRegNoMsg(uint32_t offset, uint32_t value);
+uint32_t ReadRegNoMsg(uint32_t offset);
+
+
+/* Direct Register Access API */
+void WriteReg32(uint32_t *address, uint32_t value);
+uint32_t ReadReg32(uint32_t *address);
+
+void InitVpuRegister(void *virAddr);
+uint32_t *GetVpuRegBase(void);
+
+/*----------------------------------------------------------------------------
+ *		Host Command Interface
+ */
+void VpuBitIssueCommand(struct nx_vpu_codec_inst *inst, enum nx_vpu_cmd cmd);
+
+#endif		/* __VPU_HW_INTERFACE_H__ */
diff -ENwbur a/drivers/media/platform/nxp-vpu/vpu_types.h b/drivers/media/platform/nxp-vpu/vpu_types.h
--- a/drivers/media/platform/nxp-vpu/vpu_types.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/media/platform/nxp-vpu/vpu_types.h	2018-05-06 08:49:50.078731938 +0200
@@ -0,0 +1,452 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __VPU_TYPES_H__
+#define __VPU_TYPES_H__
+
+#include <linux/types.h>
+
+#include "nx_port_func.h"
+
+#define VPU_MAX_BUFFERS                 32
+
+struct vpu_rect {
+	int32_t left;
+	int32_t top;
+	int32_t right;
+	int32_t bottom;
+};
+
+struct vpu_open_arg {
+	/* Input Arguments */
+	int32_t codecStd;
+	int32_t isEncoder;
+	int32_t mp4Class;
+
+	struct nx_memory_info instanceBuf;
+	struct nx_memory_info streamBuf;
+
+	/* Output Arguments */
+	int32_t instIndex;
+};
+
+struct vpu_enc_seq_arg {
+	/* input image size */
+	int32_t srcWidth;
+	int32_t srcHeight;
+
+	/* Set Stream Buffer Handle */
+	uint64_t strmBufVirAddr;
+	uint64_t strmBufPhyAddr;
+	int32_t strmBufSize;
+
+	int32_t frameRateNum;		/* frame rate */
+	int32_t frameRateDen;
+	int32_t gopSize;		/* group of picture size */
+
+	/* Rate Control */
+	int32_t bitrate;		/* Target Bitrate */
+	int32_t disableSkip;		/* Flag of Skip frame disable */
+
+	/* This value is valid if RCModule is 1.(MAX 0x7FFF)
+	 * 0 does not check Reference decoder buffer delay constraint. */
+	int32_t initialDelay;
+
+	/* Reference Decoder buffer size in bytes
+	  * This valid is ignored if RCModule is 1 and initialDelay is is 0.
+	  * (MAX 0x7FFFFFFF) */
+	int32_t vbvBufferSize;
+
+	int32_t gammaFactor;
+
+	/* Quantization Scale [ H.264/AVC(0~51), MPEG4(1~31) ] */
+	int32_t maxQP;			/* Max Quantization Scale */
+
+	/* This value is Initial QP when CBR
+	 *       (Initial QP is computed if initQP is 0)
+	 * This value is user QP when VBR. */
+	int32_t initQP;
+
+	/* Input Buffer Chroma Interleaved */
+	/* Input Buffer Chroma Interleaved Format */
+	int32_t chromaInterleave;
+	/* Reference Buffer's Chorma Interleaved Format */
+	int32_t refChromaInterleave;
+
+	/* ME_SEARCH_RAGME_[0~3] (recomand ME_SEARCH_RAGME_2)
+	 *	0 : H(-128~127), V(-64~63)
+	 *	1 : H(-64~ 63), V(-32~31)
+	 *	2 : H(-32~ 31), V(-16~15)
+	 *	3 : H(-16~ 15), V(-16~15) */
+	int32_t searchRange;
+
+	/* Other Options */
+	/* an Intra MB refresh number. It must be less than total MacroBlocks.*/
+	int32_t intraRefreshMbs;
+
+	int32_t rotAngle;
+	int32_t mirDirection;
+
+	/* AVC Only */
+	int32_t enableAUDelimiter;
+
+	/* JPEG Specific */
+	int32_t quality;
+	uint32_t imgFormat;
+
+	/* H.263 Only */
+	int32_t annexFlg;
+};
+
+struct vpu_enc_set_frame_arg {
+	/* Reconstruct Buffer */
+	int32_t numFrameBuffer;
+	struct nx_vid_memory_info frameBuffer[2];
+
+	/* Sub Sample Buffers(1 sub sample buffer size = Framebuffer size/4) */
+	struct nx_memory_info subSampleBuffer[2];
+
+	/* Data partition Buffer size(MAX WIDTH * MAX HEIGHT * 3 / 4) */
+	struct nx_memory_info dataPartitionBuffer;
+
+	/* For Sram */
+	uint32_t sramAddr;
+	uint32_t sramSize;
+};
+
+union vpu_enc_get_header_arg {
+	struct {
+		uint8_t vosData[512];
+		int32_t vosSize;
+		uint8_t volData[512];
+		int32_t volSize;
+		uint8_t voData[512];
+		int32_t voSize;
+	} mp4Header;
+	struct {
+		uint8_t spsData[512];
+		int32_t spsSize;
+		uint8_t ppsData[512];
+		int32_t ppsSize;
+	} avcHeader;
+	struct {
+		uint8_t jpegHeader[1024];
+		int32_t headerSize;
+	} jpgHeader;
+};
+
+struct vpu_enc_run_frame_arg {
+	/* Input Prameter */
+	struct nx_vid_memory_info inImgBuffer;
+
+	/* Rate Control Parameters */
+	int32_t changeFlag;
+	int32_t enableRc;
+	int32_t forceIPicture;
+	int32_t quantParam;		/* User quantization Parameter */
+	int32_t forceSkipPicture;
+
+	/* Output Parameter */
+	int32_t frameType;		/* I, P, B, SKIP,.. etc */
+	uint64_t outStreamAddr;		/* mmapped virtual address */
+	int32_t outStreamSize;		/* Stream buffer size */
+	int32_t reconImgIdx;		/*  reconstructed image buffer index */
+};
+
+struct vpu_enc_chg_para_arg {
+	int32_t chgFlg;
+	int32_t gopSize;
+	int32_t intraQp;
+	int32_t bitrate;
+	int32_t frameRateNum;
+	int32_t frameRateDen;
+	int32_t intraRefreshMbs;
+	int32_t sliceMode;
+	int32_t sliceSizeMode;
+	int32_t sliceSizeNum;
+	int32_t hecMode;
+};
+
+struct avc_vui_info {
+	int32_t fixedFrameRateFlag;
+	int32_t timingInfoPresent;
+	int32_t chromaLocBotField;
+	int32_t chromaLocTopField;
+	int32_t chromaLocInfoPresent;
+	int32_t colorPrimaries;
+	int32_t colorDescPresent;
+	int32_t isExtSAR;
+	int32_t vidFullRange;
+	int32_t vidFormat;
+	int32_t vidSigTypePresent;
+	int32_t vuiParamPresent;
+	int32_t vuiPicStructPresent;
+	int32_t vuiPicStruct;
+};
+
+/*
+ *	Decoder Structures
+ */
+
+struct vpu_dec_seq_init_arg {
+	/* Input Information */
+	uint64_t seqData;
+	int32_t seqDataSize;
+	int32_t disableOutReorder;
+
+	/* General Output Information */
+	int32_t outWidth;
+	int32_t outHeight;
+	int32_t frameRateNum;		/* Frame Rate Numerator */
+	int32_t frameRateDen;		/* Frame Rate Denominator */
+	uint32_t bitrate;
+
+	int32_t profile;
+	int32_t level;
+	int32_t interlace;
+	int32_t direct8x8Flag;
+	int32_t constraint_set_flag[4];
+	int32_t aspectRateInfo;
+
+	/* Frame Buffer Information */
+	int32_t minFrameBufCnt;
+	int32_t frameBufDelay;
+
+	/* 1 : Deblock filter, 0 : Disable post filter */
+	int32_t enablePostFilter;
+
+	/* Mpeg4 Specific Info */
+	int32_t mp4ShortHeader;
+	int32_t mp4PartitionEnable;
+	int32_t mp4ReversibleVlcEnable;
+	int32_t h263AnnexJEnable;
+	uint32_t mp4Class;
+
+	/* VP8 Specific Info */
+	int32_t vp8HScaleFactor;
+	int32_t vp8VScaleFactor;
+	int32_t vp8ScaleWidth;
+	int32_t vp8ScaleHeight;
+
+	/* H.264(AVC) Specific Info */
+	struct avc_vui_info vui_info;
+	int32_t avcIsExtSAR;
+	int32_t cropLeft;
+	int32_t cropTop;
+	int32_t cropRight;
+	int32_t cropBottom;
+	int32_t numSliceSize;
+	int32_t worstSliceSize;
+	int32_t maxNumRefFrmFlag;
+
+	/* VC-1 */
+	int32_t	vc1Psf;
+
+	/* Mpeg2 */
+	int32_t mp2LowDelay;
+	int32_t mp2DispVerSize;
+	int32_t mp2DispHorSize;
+	int32_t userDataNum;
+	int32_t userDataSize;
+	int32_t userDataBufFull;
+	int32_t enableUserData;
+	struct nx_memory_info userDataBuffer;
+
+	/* Jpeg */
+	int32_t thumbnailMode;
+
+	uint64_t strmReadPos;
+	uint64_t strmWritePos;
+
+	uint32_t imgFormat;
+};
+
+struct vpu_dec_phy_addr_info {
+	uint32_t addr[VPU_MAX_BUFFERS][NX_MAX_PLANES];
+};
+
+struct vpu_dec_reg_frame_arg {
+	/* Frame Buffers */
+	int32_t numFrameBuffer;
+	uint32_t strideY;
+	const struct vpu_dec_phy_addr_info *phyAddrs;
+
+	/* MV Buffer Address */
+	const struct nx_memory_info *colMvBuffer;
+
+	/* AVC Slice Buffer */
+	const struct nx_memory_info *sliceBuffer;
+
+	/* VPX Codec Specific */
+	const struct nx_memory_info *pvbSliceBuffer;
+
+	int32_t chromaInterleave;
+
+	/* For Sram */
+	uint32_t sramAddr;
+	uint32_t sramSize;
+};
+
+/* VP8 specific display information */
+struct vp8_scale_info {
+	uint32_t hScaleFactor	: 2;
+	uint32_t vScaleFactor	: 2;
+	uint32_t picWidth	: 14;
+	uint32_t picHeight	: 14;
+};
+
+/* VP8 specific header information */
+struct vp8_pic_info {
+	uint32_t showFrame	: 1;
+	uint32_t versionNumber	: 3;
+	uint32_t refIdxLast	: 8;
+	uint32_t refIdxAltr	: 8;
+	uint32_t refIdxGold	: 8;
+};
+
+struct vpu_dec_frame_arg {
+	/* Input Arguments */
+	int32_t iFrameSearchEnable;
+	int32_t skipFrameMode;
+	int32_t decSkipFrameNum;
+	int32_t eos;
+
+	/* Output Arguments */
+	int32_t outWidth;
+	int32_t outHeight;
+
+	struct vpu_rect outRect;
+
+	int32_t indexFrameDecoded;
+	int32_t indexFrameDisplay;
+
+	int32_t picType;
+	int32_t picTypeFirst;
+	int32_t isInterace;
+	int32_t picStructure;
+	int32_t topFieldFirst;
+	int32_t repeatFirstField;
+	int32_t progressiveFrame;
+	int32_t fieldSequence;
+	int32_t npf;
+
+	int32_t isSuccess;
+
+	int32_t errReason;
+	int32_t errAddress;
+	int32_t numOfErrMBs;
+	int32_t sequenceChanged;
+
+	uint32_t strmReadPos;
+	uint32_t strmWritePos;
+
+	/* AVC Specific Information */
+	int32_t avcFpaSeiExist;
+	int32_t avcFpaSeiValue1;
+	int32_t avcFpaSeiValue2;
+
+	/* Output Bitstream Information */
+	uint32_t frameStartPos;
+	uint32_t frameEndPos;
+
+	uint32_t notSufficientPsBuffer;
+	uint32_t notSufficientSliceBuffer;
+
+	uint32_t fRateNumerator;
+	uint32_t fRateDenominator;
+
+	/* Use struct vp8_scale_info & struct vp8_pic_info in VP8 */
+	uint32_t aspectRateInfo;
+
+	uint32_t mp4ModuloTimeBase;
+	uint32_t mp4TimeIncrement;
+
+	/* VP8 Scale Info */
+	struct vp8_scale_info scale_info;
+	struct vp8_pic_info pic_info;
+
+	/*  VC1 Info */
+	int32_t multiRes;
+
+	/* MPEG2 User Data */
+	int32_t userDataNum;
+	int32_t userDataSize;
+	int32_t userDataBufFull;
+	int32_t activeFormat;
+
+	int32_t iRet;
+
+	/* Jpeg Info */
+	/* 0:No scaling, 1:1/2 down scaling, 2:1/4 down scaling,
+		3:1/8 down scaling */
+	int32_t downScaleWidth;
+	int32_t downScaleHeight;
+
+	int32_t mcuWidth;
+	int32_t mcuHeight;
+};
+
+/*////////////////////////////////////////////////////////////////////////////
+ *		Command Arguments
+ */
+
+/* Define Codec Standard */
+enum {
+	CODEC_STD_AVC	= 0,
+	CODEC_STD_VC1	= 1,
+	CODEC_STD_MPEG2	= 2,
+	CODEC_STD_MPEG4	= 3,
+	CODEC_STD_H263	= 4,
+	CODEC_STD_DIV3	= 5,
+	CODEC_STD_RV	= 6,
+	CODEC_STD_AVS	= 7,
+	CODEC_STD_MJPG	= 8,
+
+	CODEC_STD_THO	= 9,
+	CODEC_STD_VP3	= 10,
+	CODEC_STD_VP8	= 11
+};
+
+/* Search Range */
+enum {
+	ME_SEARCH_RAGME_0,	/* Horizontal(-128 ~ 127), Vertical(-64 ~ 64) */
+	ME_SEARCH_RAGME_1,	/* Horizontal( -64 ~  63), Vertical(-32 ~ 32) */
+	ME_SEARCH_RAGME_2,	/* Horizontal( -32 ~  31), Vertical(-16 ~ 15) */
+	ME_SEARCH_RAGME_3,	/* Horizontal( -16 ~  15), Vertical(-16 ~ 15) */
+};
+
+/* Frame Buffer Format for JPEG */
+enum {
+	IMG_FORMAT_420 = 0,
+	IMG_FORMAT_422 = 1,
+	IMG_FORMAT_224 = 2,
+	IMG_FORMAT_444 = 3,
+	IMG_FORMAT_400 = 4
+};
+
+/* JPEG Mirror Direction */
+enum {
+	MIRDIR_NONE,
+	MIRDIR_VER,
+	MIRDIR_HOR,
+	MIRDIR_HOR_VER,
+};
+
+/*/////////////////////////////////////////////////////////////////////////// */
+
+#endif		/* __VPU_TYPES_H__ */
diff -ENwbur a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
--- a/drivers/media/v4l2-core/v4l2-ioctl.c	2018-05-06 08:47:37.317343639 +0200
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c	2018-05-06 08:49:50.166735509 +0200
@@ -31,6 +31,7 @@
 #include <media/v4l2-mc.h>

 #include <trace/events/v4l2.h>
+#include <linux/videodev2_nxp_media.h>

 /* Zero out the end of the struct pointed to by p.  Everything after, but
  * not including, the specified field is cleared. */
@@ -1181,6 +1182,8 @@
 	case V4L2_PIX_FMT_NV61M:	descr = "Y/CrCb 4:2:2 (N-C)"; break;
 	case V4L2_PIX_FMT_NV12MT:	descr = "Y/CbCr 4:2:0 (64x32 MB, N-C)"; break;
 	case V4L2_PIX_FMT_NV12MT_16X16:	descr = "Y/CbCr 4:2:0 (16x16 MB, N-C)"; break;
+	case V4L2_PIX_FMT_NV24M:	descr = "Y/CbCr 4:4:4 (N-C)"; break;
+	case V4L2_PIX_FMT_NV42M:	descr = "Y/CrCb 4:4:4 (N-C)"; break;
 	case V4L2_PIX_FMT_YUV420M:	descr = "Planar YUV 4:2:0 (N-C)"; break;
 	case V4L2_PIX_FMT_YVU420M:	descr = "Planar YVU 4:2:0 (N-C)"; break;
 	case V4L2_PIX_FMT_YUV422M:	descr = "Planar YUV 4:2:2 (N-C)"; break;
@@ -1284,6 +1287,17 @@
 		case V4L2_PIX_FMT_SE401:	descr = "GSPCA SE401"; break;
 		case V4L2_PIX_FMT_S5C_UYVY_JPG:	descr = "S5C73MX interleaved UYVY/JPEG"; break;
 		case V4L2_PIX_FMT_MT21C:	descr = "Mediatek Compressed Format"; break;
+		case V4L2_PIX_FMT_DIV3:		descr = "DivX MPEG-4 (DIV3)"; break;
+		case V4L2_PIX_FMT_DIV4:		descr = "DivX MPEG-4 (DIV4)"; break;
+		case V4L2_PIX_FMT_DIV5:		descr = "DivX MPEG-4 (DIV5)"; break;
+		case V4L2_PIX_FMT_DIV6:		descr = "DivX MPEG-4 (DIV6)"; break;
+		case V4L2_PIX_FMT_DIVX:		descr = "DivX MPEG-4"; break;
+		case V4L2_PIX_FMT_RV8:		descr = "RealVideo v8"; break;
+		case V4L2_PIX_FMT_RV9:		descr = "RealVideo v9"; break;
+		case V4L2_PIX_FMT_WMV9:		descr = "Windows Media v9"; break;
+		case V4L2_PIX_FMT_WVC1:		descr = "SMPTE VC1 by Windows"; break;
+		case V4L2_PIX_FMT_FLV1:		descr = "Flash Video v1"; break;
+		case V4L2_PIX_FMT_THEORA:	descr = "Theora"; break;
 		default:
 			WARN(1, "Unknown pixelformat 0x%08x\n", fmt->pixelformat);
 			if (fmt->description[0])
diff -ENwbur a/drivers/mfd/axp228-mfd.c b/drivers/mfd/axp228-mfd.c
--- a/drivers/mfd/axp228-mfd.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/mfd/axp228-mfd.c	2018-05-06 08:49:50.182736159 +0200
@@ -0,0 +1,1147 @@
+/*
+ * axp228-mfd.c  --  PMIC driver for the X-Powers AXP228
+ *
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongshin, Park <pjsin865@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/pm.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/of_gpio.h>
+
+#include <linux/mfd/core.h>
+#include <linux/mfd/axp228-mfd.h>
+#include <linux/mfd/axp228-cfg.h>
+
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
+
+#ifdef ENABLE_DEBUG
+#define DBG_MSG(format, args...) pr_err(format, ##args)
+#else
+#define DBG_MSG(format, args...) do {} while (0)
+#endif
+
+#define AXP_I2C_RETRY_CNT 3
+
+static uint8_t axp_reg_addr;
+struct axp_mfd_chip *g_chip;
+struct i2c_client *axp;
+EXPORT_SYMBOL_GPL(axp);
+
+static inline int __axp_read(struct i2c_client *client, int reg, uint8_t *val)
+{
+	int ret = 0;
+	int i = 0;
+
+	for (i = 0; i < AXP_I2C_RETRY_CNT; i++) {
+		ret = i2c_smbus_read_byte_data(client, reg);
+		if (ret >= 0)
+			break;
+
+		mdelay(10);
+	}
+
+	if (ret < 0) {
+		dev_err(&client->dev, "failed reading at 0x%02x\n",
+			reg);
+		return ret;
+	}
+
+	*val = (uint8_t)ret;
+	return 0;
+}
+
+static inline int __axp_reads(struct i2c_client *client, int reg, int len,
+			      uint8_t *val)
+{
+	int ret = 0;
+	int i = 0;
+
+	for (i = 0; i < AXP_I2C_RETRY_CNT; i++) {
+		ret = i2c_smbus_read_i2c_block_data(client, reg, len, val);
+		if (ret >= 0)
+			break;
+		mdelay(10);
+	}
+
+	if (ret < 0) {
+		dev_err(&client->dev, "failed reading from 0x%02x\n",
+			reg);
+		return ret;
+	}
+	return 0;
+}
+
+static inline int __axp_write(struct i2c_client *client, int reg, uint8_t val)
+{
+	int ret = 0;
+	int i = 0;
+
+	for (i = 0; i < AXP_I2C_RETRY_CNT; i++) {
+		ret = i2c_smbus_write_byte_data(client, reg, val);
+		if (ret >= 0)
+			break;
+		mdelay(10);
+	}
+
+	if (ret < 0) {
+		dev_err(&client->dev,
+			"failed writing 0x%02x to 0x%02x\n", val,
+			reg);
+		return ret;
+	}
+	return 0;
+}
+
+static inline int __axp_writes(struct i2c_client *client, int reg, int len,
+			       uint8_t *val)
+{
+	int ret = 0;
+	int i = 0;
+
+	for (i = 0; i < AXP_I2C_RETRY_CNT; i++) {
+		ret = i2c_smbus_write_i2c_block_data(client, reg, len, val);
+		if (ret >= 0)
+			break;
+		mdelay(10);
+	}
+
+	if (ret < 0) {
+		dev_err(&client->dev, "failed writings to 0x%02x\n",
+			reg);
+		return ret;
+	}
+	return 0;
+}
+
+int axp_register_notifier(struct device *dev, struct notifier_block *nb,
+			  uint64_t irqs)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+
+	chip->ops->enable_irqs(chip, irqs);
+	if (NULL != nb) {
+		return blocking_notifier_chain_register(&chip->notifier_list,
+							nb);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(axp_register_notifier);
+
+int axp_unregister_notifier(struct device *dev, struct notifier_block *nb,
+			    uint64_t irqs)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+
+	chip->ops->disable_irqs(chip, irqs);
+	if (NULL != nb) {
+		return blocking_notifier_chain_unregister(&chip->notifier_list,
+							  nb);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(axp_unregister_notifier);
+
+int axp_write(struct device *dev, int reg, uint8_t val)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+	int ret = 0;
+
+	mutex_lock(&chip->lock);
+	ret = __axp_write(to_i2c_client(dev), reg, val);
+	mutex_unlock(&chip->lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_write);
+
+int axp_writes(struct device *dev, int reg, int len, uint8_t *val)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+	int ret = 0;
+
+	mutex_lock(&chip->lock);
+	ret = __axp_writes(to_i2c_client(dev), reg, len, val);
+	mutex_unlock(&chip->lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_writes);
+
+int axp_read(struct device *dev, int reg, uint8_t *val)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+	int ret = 0;
+
+	mutex_lock(&chip->lock);
+	ret = __axp_read(to_i2c_client(dev), reg, val);
+	mutex_unlock(&chip->lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_read);
+
+int axp_reads(struct device *dev, int reg, int len, uint8_t *val)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+	int ret = 0;
+
+	mutex_lock(&chip->lock);
+	ret = __axp_reads(to_i2c_client(dev), reg, len, val);
+	mutex_unlock(&chip->lock);
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_reads);
+
+int axp_set_bits(struct device *dev, int reg, uint8_t bit_mask)
+{
+	uint8_t reg_val;
+	int ret = 0;
+	struct axp_mfd_chip *chip;
+
+	chip = dev_get_drvdata(dev);
+	mutex_lock(&chip->lock);
+	ret = __axp_read(chip->client, reg, &reg_val);
+	if (ret)
+		goto out;
+
+	if ((reg_val & bit_mask) != bit_mask) {
+		reg_val |= bit_mask;
+		ret = __axp_write(chip->client, reg, reg_val);
+	}
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_set_bits);
+
+int axp_clr_bits(struct device *dev, int reg, uint8_t bit_mask)
+{
+	uint8_t reg_val;
+	int ret = 0;
+	struct axp_mfd_chip *chip;
+
+	chip = dev_get_drvdata(dev);
+
+	mutex_lock(&chip->lock);
+
+	ret = __axp_read(chip->client, reg, &reg_val);
+	if (ret)
+		goto out;
+
+	if (reg_val & bit_mask) {
+		reg_val &= ~bit_mask;
+		ret = __axp_write(chip->client, reg, reg_val);
+	}
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_clr_bits);
+
+int axp_update(struct device *dev, int reg, uint8_t val, uint8_t mask)
+{
+	struct axp_mfd_chip *chip = dev_get_drvdata(dev);
+	uint8_t reg_val;
+	int ret = 0;
+
+	mutex_lock(&chip->lock);
+
+	ret = __axp_read(chip->client, reg, &reg_val);
+	if (ret)
+		goto out;
+
+	if ((reg_val & mask) != val) {
+		reg_val = (reg_val & ~mask) | val;
+		ret = __axp_write(chip->client, reg, reg_val);
+	}
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(axp_update);
+
+struct device *axp_get_dev(void) { return &axp->dev; }
+EXPORT_SYMBOL_GPL(axp_get_dev);
+
+static int axp22_init_chip(struct axp_mfd_chip *chip)
+{
+	uint8_t chip_id = 0;
+	uint8_t v[19] = {
+		0xd8,
+		AXP22_INTEN2, 0xff, AXP22_INTEN3, 0x00,
+		AXP22_INTEN4, 0x01, AXP22_INTEN5, 0x00,
+		AXP22_INTSTS1, 0xff, AXP22_INTSTS2, 0xff,
+		AXP22_INTSTS3, 0xff, AXP22_INTSTS4, 0xff,
+		AXP22_INTSTS5, 0xff
+		};
+	int err;
+
+	/*read chip id*/
+	err = __axp_read(chip->client, AXP22_IC_TYPE, &chip_id);
+	if (err) {
+		pr_err("[AXP22-MFD] try to read chip id failed!\n");
+		return err;
+	}
+
+	/*enable irqs and clear*/
+	err = __axp_writes(chip->client, AXP22_INTEN1, 19, v);
+	if (err) {
+		pr_err("[AXP22-MFD] try to clear irq failed!\n");
+		return err;
+	}
+
+	dev_info(chip->dev, "AXP (CHIP ID: 0x%02x) detected\n", chip_id);
+	chip->type = AXP22;
+
+	/* mask and clear all IRQs */
+	chip->irqs_enabled = 0xffffffff | (uint64_t)0xff << 32;
+	chip->ops->disable_irqs(chip, chip->irqs_enabled);
+
+	return 0;
+}
+
+static int axp22_disable_irqs(struct axp_mfd_chip *chip, uint64_t irqs)
+{
+	uint8_t v[9];
+	int ret;
+
+	chip->irqs_enabled &= ~irqs;
+
+	v[0] = ((chip->irqs_enabled) & 0xff);
+	v[1] = AXP22_INTEN2;
+	v[2] = ((chip->irqs_enabled) >> 8) & 0xff;
+	v[3] = AXP22_INTEN3;
+	v[4] = ((chip->irqs_enabled) >> 16) & 0xff;
+	v[5] = AXP22_INTEN4;
+	v[6] = ((chip->irqs_enabled) >> 24) & 0xff;
+	v[7] = AXP22_INTEN5;
+	v[8] = ((chip->irqs_enabled) >> 32) & 0xff;
+	ret = __axp_writes(chip->client, AXP22_INTEN1, 9, v);
+
+	return ret;
+}
+
+static int axp22_enable_irqs(struct axp_mfd_chip *chip, uint64_t irqs)
+{
+	uint8_t v[9];
+	int ret;
+
+	chip->irqs_enabled |= irqs;
+
+	v[0] = ((chip->irqs_enabled) & 0xff);
+	v[1] = AXP22_INTEN2;
+	v[2] = ((chip->irqs_enabled) >> 8) & 0xff;
+	v[3] = AXP22_INTEN3;
+	v[4] = ((chip->irqs_enabled) >> 16) & 0xff;
+	v[5] = AXP22_INTEN4;
+	v[6] = ((chip->irqs_enabled) >> 24) & 0xff;
+	v[7] = AXP22_INTEN5;
+	v[8] = ((chip->irqs_enabled) >> 32) & 0xff;
+	ret = __axp_writes(chip->client, AXP22_INTEN1, 9, v);
+
+	return ret;
+}
+
+static int axp22_read_irqs(struct axp_mfd_chip *chip, uint64_t *irqs)
+{
+	uint8_t v[5] = { 0, 0, 0, 0, 0 };
+	int ret;
+
+	ret = __axp_reads(chip->client, AXP22_INTSTS1, 5, v);
+	if (ret < 0)
+		return ret;
+
+	*irqs = (((uint64_t)v[4]) << 32) | (((uint64_t)v[3]) << 24) |
+		(((uint64_t)v[2]) << 16) | (((uint64_t)v[1]) << 8) |
+		((uint64_t)v[0]);
+	return 0;
+}
+
+static ssize_t axp22_offvol_show(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	uint8_t val = 0;
+
+	axp_read(dev, AXP22_VOFF_SET, &val);
+	return sprintf(buf, "%d\n", (val & 0x07) * 100 + 2600);
+}
+
+static ssize_t axp22_offvol_store(struct device *dev,
+				  struct device_attribute *attr,
+				  const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp < 2600)
+		tmp = 2600;
+	if (tmp > 3300)
+		tmp = 3300;
+
+	axp_read(dev, AXP22_VOFF_SET, &val);
+	val &= 0xf8;
+	val |= ((tmp - 2600) / 100);
+	axp_write(dev, AXP22_VOFF_SET, val);
+	return count;
+}
+
+static ssize_t axp22_noedelay_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	uint8_t val;
+
+	axp_read(dev, AXP22_OFF_CTL, &val);
+	if ((val & 0x03) == 0)
+		return sprintf(buf, "%d\n", 128);
+	else
+		return sprintf(buf, "%d\n", (val & 0x03) * 1000);
+}
+
+static ssize_t axp22_noedelay_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp < 1000)
+		tmp = 128;
+	if (tmp > 3000)
+		tmp = 3000;
+	axp_read(dev, AXP22_OFF_CTL, &val);
+	val &= 0xfc;
+	val |= ((tmp) / 1000);
+	axp_write(dev, AXP22_OFF_CTL, val);
+	return count;
+}
+
+static ssize_t axp22_pekopen_show(struct device *dev,
+				  struct device_attribute *attr, char *buf)
+{
+	uint8_t val;
+	int tmp = 0;
+
+	axp_read(dev, AXP22_POK_SET, &val);
+	switch (val >> 6) {
+	case 0:
+		tmp = 128;
+		break;
+	case 1:
+		tmp = 3000;
+		break;
+	case 2:
+		tmp = 1000;
+		break;
+	case 3:
+		tmp = 2000;
+		break;
+	default:
+		tmp = 0;
+		break;
+	}
+	return sprintf(buf, "%d\n", tmp);
+}
+
+static ssize_t axp22_pekopen_store(struct device *dev,
+				   struct device_attribute *attr,
+				   const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	axp_read(dev, AXP22_POK_SET, &val);
+	if (tmp < 1000)
+		val &= 0x3f;
+	else if (tmp < 2000) {
+		val &= 0x3f;
+		val |= 0x80;
+	} else if (tmp < 3000) {
+		val &= 0x3f;
+		val |= 0xc0;
+	} else {
+		val &= 0x3f;
+		val |= 0x40;
+	}
+	axp_write(dev, AXP22_POK_SET, val);
+	return count;
+}
+
+static ssize_t axp22_peklong_show(struct device *dev,
+				  struct device_attribute *attr, char *buf)
+{
+	uint8_t val = 0;
+
+	axp_read(dev, AXP22_POK_SET, &val);
+	return sprintf(buf, "%d\n", ((val >> 4) & 0x03) * 500 + 1000);
+}
+
+static ssize_t axp22_peklong_store(struct device *dev,
+				   struct device_attribute *attr,
+				   const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp < 1000)
+		tmp = 1000;
+	if (tmp > 2500)
+		tmp = 2500;
+	axp_read(dev, AXP22_POK_SET, &val);
+	val &= 0xcf;
+	val |= (((tmp - 1000) / 500) << 4);
+	axp_write(dev, AXP22_POK_SET, val);
+	return count;
+}
+
+static ssize_t axp22_peken_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	uint8_t val;
+
+	axp_read(dev, AXP22_POK_SET, &val);
+	return sprintf(buf, "%d\n", ((val >> 3) & 0x01));
+}
+
+static ssize_t axp22_peken_store(struct device *dev,
+				 struct device_attribute *attr, const char *buf,
+				 size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp)
+		tmp = 1;
+	axp_read(dev, AXP22_POK_SET, &val);
+	val &= 0xf7;
+	val |= (tmp << 3);
+	axp_write(dev, AXP22_POK_SET, val);
+	return count;
+}
+
+static ssize_t axp22_pekdelay_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	uint8_t val;
+
+	axp_read(dev, AXP22_POK_SET, &val);
+	return sprintf(buf, "%d\n", ((val >> 2) & 0x01) ? 64 : 8);
+}
+
+static ssize_t axp22_pekdelay_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp <= 8)
+		tmp = 0;
+	else
+		tmp = 1;
+	axp_read(dev, AXP22_POK_SET, &val);
+	val &= 0xfb;
+	val |= tmp << 2;
+	axp_write(dev, AXP22_POK_SET, val);
+	return count;
+}
+
+static ssize_t axp22_pekclose_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	uint8_t val;
+
+	axp_read(dev, AXP22_POK_SET, &val);
+	return sprintf(buf, "%d\n", ((val & 0x03) * 2000) + 4000);
+}
+
+static ssize_t axp22_pekclose_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp < 4000)
+		tmp = 4000;
+	if (tmp > 10000)
+		tmp = 10000;
+	tmp = (tmp - 4000) / 2000;
+	axp_read(dev, AXP22_POK_SET, &val);
+	val &= 0xfc;
+	val |= tmp;
+	axp_write(dev, AXP22_POK_SET, val);
+	return count;
+}
+
+static ssize_t axp22_ovtemclsen_show(struct device *dev,
+				     struct device_attribute *attr, char *buf)
+{
+	uint8_t val;
+
+	axp_read(dev, AXP22_HOTOVER_CTL, &val);
+	return sprintf(buf, "%d\n", ((val >> 2) & 0x01));
+}
+
+static ssize_t axp22_ovtemclsen_store(struct device *dev,
+				      struct device_attribute *attr,
+				      const char *buf, size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp);
+	if (err)
+		return err;
+
+	if (tmp)
+		tmp = 1;
+	axp_read(dev, AXP22_HOTOVER_CTL, &val);
+	val &= 0xfb;
+	val |= tmp << 2;
+	axp_write(dev, AXP22_HOTOVER_CTL, val);
+	return count;
+}
+
+static ssize_t axp22_reg_show(struct device *dev, struct device_attribute *attr,
+			      char *buf)
+{
+	uint8_t val;
+
+	axp_read(dev, axp_reg_addr, &val);
+	return sprintf(buf, "REG[%x]=%x\n", axp_reg_addr, val);
+}
+
+static ssize_t axp22_reg_store(struct device *dev,
+			       struct device_attribute *attr, const char *buf,
+			       size_t count)
+{
+	unsigned long tmp;
+	uint8_t val;
+	int err;
+
+	err = kstrtoul(buf, 16, &tmp);
+	if (err)
+		return err;
+
+	if (tmp < 256)
+		axp_reg_addr = tmp;
+	else {
+		val = tmp & 0x00FF;
+		axp_reg_addr = (tmp >> 8) & 0x00FF;
+		axp_write(dev, axp_reg_addr, val);
+	}
+	return count;
+}
+
+static ssize_t axp22_regs_show(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	uint8_t val[2];
+
+	axp_reads(dev, axp_reg_addr, 2, val);
+	return sprintf(buf, "REG[0x%x]=0x%x,REG[0x%x]=0x%x\n", axp_reg_addr,
+		       val[0], axp_reg_addr + 1, val[1]);
+}
+
+static ssize_t axp22_regs_store(struct device *dev,
+				struct device_attribute *attr, const char *buf,
+				size_t count)
+{
+	unsigned long tmp;
+	uint8_t val[3];
+	int err;
+
+	err = kstrtoul(buf, 16, &tmp);
+	if (err)
+		return err;
+
+	if (tmp < 256)
+		axp_reg_addr = tmp;
+	else {
+		axp_reg_addr = (tmp >> 16) & 0xFF;
+		val[0] = (tmp >> 8) & 0xFF;
+		val[1] = axp_reg_addr + 1;
+		val[2] = tmp & 0xFF;
+		axp_writes(dev, axp_reg_addr, 3, val);
+	}
+	return count;
+}
+
+static struct device_attribute axp22_mfd_attrs[] = {
+	AXP_MFD_ATTR(axp22_offvol),
+	AXP_MFD_ATTR(axp22_noedelay),
+	AXP_MFD_ATTR(axp22_pekopen),
+	AXP_MFD_ATTR(axp22_peklong),
+	AXP_MFD_ATTR(axp22_peken),
+	AXP_MFD_ATTR(axp22_pekdelay),
+	AXP_MFD_ATTR(axp22_pekclose),
+	AXP_MFD_ATTR(axp22_ovtemclsen),
+	AXP_MFD_ATTR(axp22_reg),
+	AXP_MFD_ATTR(axp22_regs),
+};
+
+void axp_run_irq_handler(void)
+{
+	DBG_MSG("## [%s():%d]\n", __func__, __LINE__);
+	(void)schedule_work(&g_chip->irq_work);
+}
+EXPORT_SYMBOL_GPL(axp_run_irq_handler);
+
+static void axp_mfd_register_dump(struct device *dev)
+{
+	int ret = 0;
+	u16 i = 0;
+	u8 value = 0;
+
+	dev_info(dev,
+		"##########################################################\n");
+	dev_info(dev,
+		"## %s()                               #\n", __func__);
+	dev_info(dev,
+		"##########################################################\n");
+	dev_info(dev,
+		"##      0  1  2  3   4  5  6  7   8  9  A  B   C  D  E  F\n");
+
+	for (i = 0; i <= 0xff; i++) {
+		if (i % 16 == 0)
+			dev_info(dev, "## %02X:", i);
+
+		if (i % 4 == 0)
+			dev_info(dev, " ");
+
+		ret = axp_read(dev, i, &value);
+		if (!ret)
+			dev_info(dev, "%02x ", value);
+		else
+			dev_info(dev, "xx ");
+
+		if ((i + 1) % 16 == 0)
+			dev_info(dev, "\n");
+	}
+	dev_info(dev,
+		"##########################################################\n");
+}
+
+#ifdef CONFIG_DEBUG_FS
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+static int axp_dbg_show(struct seq_file *s, void *unused)
+{
+	struct axp_mfd_chip *chip = s->private;
+	struct device *dev = chip->dev;
+
+	axp_mfd_register_dump(dev);
+	return 0;
+}
+
+static int axp_dbg_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, axp_dbg_show, inode->i_private);
+}
+
+static const struct file_operations debug_fops = {
+	.open = axp_dbg_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = single_release,
+};
+static void axp_debuginit(struct axp_mfd_chip *chip)
+{
+	(void)debugfs_create_file("axp228", S_IRUGO, NULL, chip, &debug_fops);
+}
+#else
+static void axp_debuginit(struct axp_mfd_chip *chip)
+{
+	struct device *dev = chip->dev;
+
+	axp_mfd_register_dump(dev);
+	return 0;
+}
+#endif
+
+static void axp_mfd_irq_work(struct work_struct *work)
+{
+	struct axp_mfd_chip *chip =
+	    container_of(work, struct axp_mfd_chip, irq_work);
+	uint64_t irqs = 0;
+
+	DBG_MSG("## [%s():%d]\n", __func__, __LINE__);
+
+	while (1) {
+		if (chip->ops->read_irqs(chip, &irqs)) {
+			pr_err("read irq fail\n");
+			break;
+		}
+		irqs &= chip->irqs_enabled;
+		if (irqs == 0)
+			break;
+
+		if (irqs > 0xffffffff) {
+			blocking_notifier_call_chain(&chip->notifier_list,
+						     (uint32_t)(irqs >> 32),
+						     (void *)1);
+		} else {
+			blocking_notifier_call_chain(&chip->notifier_list,
+						     (uint32_t)irqs, (void *)0);
+		}
+	}
+	/* enable_irq(chip->client->irq); */
+}
+
+static irqreturn_t axp_mfd_irq_handler(int irq, void *data)
+{
+	struct axp_mfd_chip *chip = data;
+
+	DBG_MSG("## [%s():%d]\n", __func__, __LINE__);
+
+	/* disable_irq_nosync(irq); */
+	(void)schedule_work(&chip->irq_work);
+
+	return IRQ_HANDLED;
+}
+
+static struct axp_mfd_chip_ops axp_mfd_ops[] = {
+	[0] = {
+		.init_chip = axp22_init_chip,
+		.enable_irqs = axp22_enable_irqs,
+		.disable_irqs = axp22_disable_irqs,
+		.read_irqs = axp22_read_irqs,
+	},
+};
+
+static const struct i2c_device_id axp_mfd_id_table[] = {
+	{ "axp22_mfd", 0 },
+	{},
+};
+MODULE_DEVICE_TABLE(i2c, axp_mfd_id_table);
+
+int axp_mfd_create_attrs(struct axp_mfd_chip *chip)
+{
+	int j, ret;
+
+	if (chip->type == AXP22) {
+		for (j = 0; j < ARRAY_SIZE(axp22_mfd_attrs); j++) {
+			ret = device_create_file(chip->dev,
+				&axp22_mfd_attrs[j]);
+			if (ret)
+				goto sysfs_failed;
+		}
+	} else {
+		ret = 0;
+	}
+	goto succeed;
+
+sysfs_failed:
+	while (j--)
+		device_remove_file(chip->dev, &axp22_mfd_attrs[j]);
+succeed:
+	return ret;
+}
+
+static int __remove_subdev(struct device *dev, void *unused)
+{
+	platform_device_unregister(to_platform_device(dev));
+	return 0;
+}
+
+static int axp_mfd_remove_subdevs(struct axp_mfd_chip *chip)
+{
+	return device_for_each_child(chip->dev, NULL, __remove_subdev);
+}
+
+static void axp_power_off(void)
+{
+	uint8_t val;
+	int ret = 0;
+
+	if (SHUTDOWNVOL >= 2600 && SHUTDOWNVOL <= 3300) {
+		if (SHUTDOWNVOL > 3200)
+			val = 0x7;
+		else if (SHUTDOWNVOL > 3100)
+			val = 0x6;
+		else if (SHUTDOWNVOL > 3000)
+			val = 0x5;
+		else if (SHUTDOWNVOL > 2900)
+			val = 0x4;
+		else if (SHUTDOWNVOL > 2800)
+			val = 0x3;
+		else if (SHUTDOWNVOL > 2700)
+			val = 0x2;
+		else if (SHUTDOWNVOL > 2600)
+			val = 0x1;
+		else
+			val = 0x0;
+
+		axp_update(&axp->dev, AXP22_VOFF_SET, val, 0x7);
+	}
+
+	val = 0xff;
+
+	pr_debug("[axp] send power-off command!\n");
+
+	mdelay(20);
+
+	if (POWER_START != 1) {
+		axp_read(&axp->dev, AXP22_STATUS, &val);
+		if (val & 0xF0) {
+			axp_read(&axp->dev, AXP22_MODE_CHGSTATUS, &val);
+			if (val & 0x20) {
+				/* pr_err("[axp] set flag!\n"); */
+				axp_write(&axp->dev, AXP22_BUFFERC, 0x0f);
+				mdelay(20);
+			}
+		}
+	}
+	axp_write(&axp->dev, AXP22_BUFFERC, 0x00);
+	mdelay(20);
+	ret = axp_set_bits(&axp->dev, AXP22_OFF_CTL, 0x80);
+	if (ret < 0) {
+		pr_err("[axp] power-off cmd error!, retry!");
+		ret = axp_set_bits(&axp->dev, AXP22_OFF_CTL, 0x80);
+	}
+}
+
+static struct mfd_cell axp_devs[] = {
+	{ .name = "axp228-regulator", },
+	/* { .name = "axp228-supplyer", }, */
+};
+
+#ifdef CONFIG_OF
+static const struct of_device_id axp228_pmic_dt_match[] = {
+	{ .compatible = "x-powers,axp228", .data = NULL },
+	{},
+};
+
+static struct axp_platform_data *
+	axp228_i2c_parse_dt_pdata(struct device *dev)
+{
+	struct axp_platform_data *pd;
+	struct device_node *np;
+	u32 val;
+
+	pd = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
+	if (!pd)
+		return NULL;
+
+	np = of_node_get(dev->of_node);
+
+	if (!of_property_read_u32(np, "nx,id", &val))
+		pd->id = val;
+	else
+		dev_err(dev, "%s() Error : id\n", __func__);
+
+
+	return pd;
+}
+#else
+static struct axp_platform_data *
+axp228_i2c_parse_dt_pdata(struct device *dev)
+{
+	return 0;
+}
+#endif
+
+static int axp_mfd_probe(struct i2c_client *client,
+			 const struct i2c_device_id *id)
+{
+	struct axp_mfd_chip *axp228 = NULL;
+	struct axp_platform_data *pdata = NULL;
+	int ret = 0;
+
+	DBG_MSG("## [%s():%d]\n", __func__, __LINE__);
+
+	axp228 = devm_kzalloc(&client->dev,
+		sizeof(struct axp_mfd_chip), GFP_KERNEL);
+	if (!axp228)
+		return -ENOMEM;
+
+	axp = client;
+
+	axp228->dev = &client->dev;
+	axp228->client = client;
+	axp228->irq = client->irq;
+	axp228->ops = &axp_mfd_ops[0];
+
+	i2c_set_clientdata(client, axp228);
+
+	if (client->dev.of_node) {
+		const struct of_device_id *match;
+
+		match = of_match_device(of_match_ptr(axp228_pmic_dt_match),
+					&client->dev);
+		if (!match) {
+			dev_err(
+			    &client->dev,
+			    "%s() Error: No device match found\n",
+			    __func__);
+			goto out_free_chip;
+		}
+	} else {
+		dev_err(&client->dev,
+			"%s() Error: No device match found\n",
+			__func__);
+		goto out_free_chip;
+	}
+
+	if (axp228->dev->of_node) {
+		pdata = axp228_i2c_parse_dt_pdata(axp228->dev);
+		if (!pdata)
+			goto out_free_chip;
+	}
+
+	axp228->pdata = pdata;
+
+	mutex_init(&axp228->lock);
+	INIT_WORK(&axp228->irq_work, axp_mfd_irq_work);
+	BLOCKING_INIT_NOTIFIER_HEAD(&axp228->notifier_list);
+
+#ifdef ENABLE_DEBUG
+	axp_mfd_register_dump(axp228->dev);
+#endif
+
+	axp_debuginit(axp228);
+
+	ret = axp228->ops->init_chip(axp228);
+	if (ret) {
+		dev_err(&client->dev, "%s() Error: init_chip()\n",
+			__func__);
+		goto out_free_chip;
+	}
+
+	g_chip = axp228;
+
+	if (client->irq > 0) {
+		ret = devm_request_threaded_irq(&client->dev,
+						axp228->irq,
+						NULL,
+						axp_mfd_irq_handler,
+						IRQF_TRIGGER_FALLING |
+						IRQF_ONESHOT,
+						client->name,
+						axp228);
+		if (ret) {
+			dev_err(&client->dev, "failed to request irq %d\n",
+				client->irq);
+			goto out_free_chip;
+		}
+	}
+
+	ret = mfd_add_devices(axp228->dev, -1, axp_devs, ARRAY_SIZE(axp_devs),
+			      NULL, 0, NULL);
+	if (ret)
+		goto out_free_irq;
+
+	pm_power_off = axp_power_off;
+
+	ret = axp_mfd_create_attrs(axp228);
+	if (ret)
+		return ret;
+
+	return 0;
+
+out_free_irq:
+	free_irq(client->irq, axp228);
+
+out_free_chip:
+	i2c_set_clientdata(client, NULL);
+	devm_kfree(&client->dev, axp228);
+
+	return ret;
+}
+
+static int axp_mfd_remove(struct i2c_client *client)
+{
+	struct axp_mfd_chip *chip = i2c_get_clientdata(client);
+
+	axp_mfd_remove_subdevs(chip);
+	devm_kfree(&client->dev, chip);
+	return 0;
+}
+
+static struct i2c_driver axp_mfd_driver = {
+	.driver	= {
+		.name = "axp_mfd",
+		.owner = THIS_MODULE,
+		.of_match_table = of_match_ptr(axp228_pmic_dt_match),
+	},
+	.probe = axp_mfd_probe,
+	.remove = axp_mfd_remove,
+	.id_table = axp_mfd_id_table,
+};
+
+static int __init axp_mfd_init(void) { return i2c_add_driver(&axp_mfd_driver); }
+subsys_initcall(axp_mfd_init);
+
+static void __exit axp_mfd_exit(void) { i2c_del_driver(&axp_mfd_driver); }
+module_exit(axp_mfd_exit);
+
+MODULE_DESCRIPTION("MFD Driver for X-Powers AXP228 PMIC");
+MODULE_AUTHOR("Jongsin Park <pjsin865@nexell.co.kr>");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
--- a/drivers/mfd/Kconfig	2018-05-06 08:47:37.329344127 +0200
+++ b/drivers/mfd/Kconfig	2018-05-06 08:49:50.178735995 +0200
@@ -125,6 +125,17 @@
 	bool
 	select MFD_SYSCON

+config MFD_AXP228
+	bool "X-Powers AXP228 PMIC Support"
+	depends on I2C=y
+	select MFD_CORE
+	help
+	  If you say yes here you get support for the X-Powers AXP228
+	  Power Management system device.
+	  This driver provides common support for accessing the device,
+	  additional drivers must be enabled in order to use the
+	  functionality of the device.
+
 config MFD_BCM590XX
 	tristate "Broadcom BCM590xx PMUs"
 	select MFD_CORE
diff -ENwbur a/drivers/mfd/Makefile b/drivers/mfd/Makefile
--- a/drivers/mfd/Makefile	2018-05-06 08:47:37.329344127 +0200
+++ b/drivers/mfd/Makefile	2018-05-06 08:49:50.178735995 +0200
@@ -10,6 +10,7 @@
 obj-$(CONFIG_MFD_ACT8945A)	+= act8945a.o
 obj-$(CONFIG_MFD_SM501)		+= sm501.o
 obj-$(CONFIG_MFD_ASIC3)		+= asic3.o tmio_core.o
+obj-$(CONFIG_MFD_AXP228)	+= axp228-mfd.o
 obj-$(CONFIG_MFD_BCM590XX)	+= bcm590xx.o
 obj-$(CONFIG_MFD_BD9571MWV)	+= bd9571mwv.o
 cros_ec_core-objs		:= cros_ec.o
diff -ENwbur a/drivers/misc/Kconfig b/drivers/misc/Kconfig
--- a/drivers/misc/Kconfig	2018-05-06 08:47:37.345344777 +0200
+++ b/drivers/misc/Kconfig	2018-05-06 08:49:50.194736646 +0200
@@ -506,6 +506,14 @@
            Enable this configuration option to enable the host side test driver
            for PCI Endpoint.

+config NX_SCALER
+	tristate "Nexell s5pxx18 series memory to memory scaler"
+	default n
+	---help---
+	  This option enables support for scaling for Nexell s5pxx18 serise
+	  SoC. Scaler reads an image from the memory and writes the image to
+	  the memory after up/down scaling.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff -ENwbur a/drivers/misc/Makefile b/drivers/misc/Makefile
--- a/drivers/misc/Makefile	2018-05-06 08:47:37.345344777 +0200
+++ b/drivers/misc/Makefile	2018-05-06 08:49:50.194736646 +0200
@@ -56,6 +56,7 @@
 obj-$(CONFIG_ASPEED_LPC_CTRL)	+= aspeed-lpc-ctrl.o
 obj-$(CONFIG_ASPEED_LPC_SNOOP)	+= aspeed-lpc-snoop.o
 obj-$(CONFIG_PCI_ENDPOINT_TEST)	+= pci_endpoint_test.o
+obj-$(CONFIG_NX_SCALER)		+= nx-scaler.o

 lkdtm-$(CONFIG_LKDTM)		+= lkdtm_core.o
 lkdtm-$(CONFIG_LKDTM)		+= lkdtm_bugs.o
diff -ENwbur a/drivers/misc/nx-scaler.c b/drivers/misc/nx-scaler.c
--- a/drivers/misc/nx-scaler.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/misc/nx-scaler.c	2018-05-06 08:49:50.210737295 +0200
@@ -0,0 +1,1405 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongkeun, Choi <jkchoi@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/module.h>
+#include <linux/miscdevice.h>
+#include <linux/interrupt.h>
+#include <linux/uaccess.h>
+#include <linux/version.h>
+#include <linux/dma-mapping.h>
+#include <linux/dma-buf.h>
+#include <linux/fs.h>
+#include <linux/io.h>
+#include <linux/clk.h>
+#include <linux/reset.h>
+
+#include <uapi/linux/media-bus-format.h>
+#include <uapi/linux/nx-scaler.h>
+
+#include <asm/irq.h>
+
+#include "nx-scaler.h"
+
+#define COMMAND_BUFFER_SIZE	PAGE_SIZE
+
+#define PHY_BASEADDR_SCALER_MODULE	0xC0066000
+#define	NUMBER_OF_SCALER_MODULE		1
+#define WAIT_TIMEOUT_HZ			(HZ/5) /* 200ms */
+
+static const char drv_name[] = "scaler";
+
+struct nx_scaler_register_set {
+	u32 scrunreg;
+	u32 sccfgreg;
+	u32 scintreg;
+	u32 scsrcaddreg;
+	u32 scsrcstride;
+	u32 scsrcsizereg;
+	u32 scdestaddreg0;
+	u32 scdeststride0;
+	u32 scdestaddreg1;
+	u32 scdeststride1;
+	u32 scdestsizereg;
+	u32 deltaxreg;
+	u32 deltayreg;
+	u32 hvsoftreg;
+	u32 cmdbufaddr;
+	u32 cmdbufcon;
+	u32 yvfilter[3][8];
+	u32 __reserved00[24];
+	int32_t yhfilter[5][32];
+};
+
+enum {
+	NX_SCALER_INT_DONE = 0,
+	NX_SCALER_INT_CMD_PROC = 1,
+};
+
+/**
+ * filter sets
+ */
+struct filter_table {
+	int yvfilter[3][8][4];
+	int yhfilter[5][32][2];
+};
+
+static struct filter_table _default_filter_table = {
+	.yvfilter = {
+		{
+			{
+				61, 58, 55, 52
+			},
+			{
+				50, 48, 45, 42
+			},
+			{
+				40, 38, 35, 32
+			},
+			{
+				30, 28, 25, 22
+			},
+			{
+				18, 16, 14, 13
+			},
+			{
+				12, 11, 10, 9
+			},
+			{
+				8, 7, 6, 5
+			},
+			{
+				4, 3, 2, 1
+			},
+		},
+		{
+			{
+				66, 68, 70, 72
+			},
+			{
+				73, 74, 76, 78
+			},
+			{
+				79, 80, 82, 84
+			},
+			{
+				85, 86, 87, 88
+			},
+			{
+				88, 87, 86, 85
+			},
+			{
+				84, 82, 80, 79
+			},
+			{
+				78, 76, 74, 73
+			},
+			{
+				72, 70, 68, 66
+			},
+		},
+		{
+			{
+				1,  2,  3,  4
+			},
+			{
+				5,  6,  7,  8
+			},
+			{
+				9, 10, 11, 12
+			},
+			{
+				13, 14, 16, 18
+			},
+			{
+				22, 25, 28, 30
+			},
+			{
+				32, 35, 38, 40
+			},
+			{
+				42, 45, 48, 50
+			},
+			{
+				52, 55, 58, 61
+			},
+		}
+	},
+	.yhfilter = {
+		{
+			{
+				-2, -5
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -10
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -11
+			},
+			{
+				-10, -9
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-7, -6
+			},
+			{
+				-5, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-3, -2
+			},
+			{
+				-2, -2
+			},
+			{
+				-1, 0
+			},
+		},
+		{
+			{
+				252, 248
+			},
+			{
+				244, 238
+			},
+			{
+				232, 227
+			},
+			{
+				222, 216
+			},
+			{
+				210, 204
+			},
+			{
+				198, 192
+			},
+			{
+				186, 181
+			},
+			{
+				176, 170
+			},
+			{
+				164, 158
+			},
+			{
+				152, 145
+			},
+			{
+				138, 133
+			},
+			{
+				128, 123
+			},
+			{
+				118, 113
+			},
+			{
+				108, 102
+			},
+			{
+				96, 92
+			},
+			{
+				88, 88
+			},
+			{
+				86, 80
+			},
+			{
+				75, 70
+			},
+			{
+				67, 64
+			},
+			{
+				61, 58
+			},
+			{
+				54, 50
+			},
+			{
+				44, 38
+			},
+			{
+				35, 32
+			},
+			{
+				30, 28
+			},
+			{
+				26, 24
+			},
+			{
+				22, 20
+			},
+			{
+				18, 16
+			},
+			{
+				14, 12
+			},
+			{
+				10, 8
+			},
+			{
+				6, 4
+			},
+			{
+				2, 0
+			},
+			{
+				-1, -2
+			},
+		},
+		{
+			{
+				264, 271
+			},
+			{
+				278, 282
+			},
+			{
+				286, 292
+			},
+			{
+				298, 302
+			},
+			{
+				306, 310
+			},
+			{
+				314, 318
+			},
+			{
+				322, 325
+			},
+			{
+				328, 332
+			},
+			{
+				336, 340
+			},
+			{
+				344, 348
+			},
+			{
+				352, 352
+			},
+			{
+				352, 354
+			},
+			{
+				356, 358
+			},
+			{
+				360, 362
+			},
+			{
+				364, 362
+			},
+			{
+				360, 354
+			},
+			{
+				354, 360
+			},
+			{
+				362, 364
+			},
+			{
+				362, 360
+			},
+			{
+				358, 356
+			},
+			{
+				354, 352
+			},
+			{
+				352, 352
+			},
+			{
+				348, 344
+			},
+			{
+				340, 336
+			},
+			{
+				332, 328
+			},
+			{
+				325, 322
+			},
+			{
+				318, 314
+			},
+			{
+				310, 306
+			},
+			{
+				302, 298
+			},
+			{
+				292, 286
+			},
+			{
+				282, 278
+			},
+			{
+				271, 264
+			},
+		},
+		{
+			{
+				-2, -1
+			},
+			{
+				0, 2
+			},
+			{
+				4, 6
+			},
+			{
+				8, 10
+			},
+			{
+				12, 14
+			},
+			{
+				16, 18
+			},
+			{
+				20, 22
+			},
+			{
+				24, 26
+			},
+			{
+				28, 30
+			},
+			{
+				32, 35
+			},
+			{
+				38, 44
+			},
+			{
+				50, 54
+			},
+			{
+				58, 61
+			},
+			{
+				64, 67
+			},
+			{
+				70, 75
+			},
+			{
+				80, 86
+			},
+			{
+				88, 88
+			},
+			{
+				92, 96
+			},
+			{
+				102, 108
+			},
+			{
+				113, 118
+			},
+			{
+				123, 128
+			},
+			{
+				133, 138
+			},
+			{
+				145, 152
+			},
+			{
+				158, 164
+			},
+			{
+				170, 176
+			},
+			{
+				181, 186
+			},
+			{
+				192, 198
+			},
+			{
+				204, 210
+			},
+			{
+				216, 222
+			},
+			{
+				227, 232
+			},
+			{
+				238, 244
+			},
+			{
+				248, 252
+			},
+		},
+		{
+			{
+				0, -1
+			},
+			{
+				-2, -2
+			},
+			{
+				-2, -3
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -4
+			},
+			{
+				-4, -5
+			},
+			{
+				-6, -7
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-9, -10
+			},
+			{
+				-11, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-12, -12
+			},
+			{
+				-10, -8
+			},
+			{
+				-8, -8
+			},
+			{
+				-5, -2
+			},
+		},
+	}
+};
+
+#define MAKE_YVFILTER(val0, val1, val2, val3) (\
+					       ((val3 & 0x000000ff) << 24) | \
+					       ((val2 & 0x000000ff) << 16) | \
+					       ((val1 & 0x000000ff) << 8)  | \
+					       ((val0 & 0x000000ff) << 0))
+
+#define MAKE_YHFILTER(val0, val1) (\
+				   ((val1 & 0x0000ffff) << 16) | \
+				   ((val0 & 0x0000ffff) << 0)    \
+				  )
+/**
+ * hw specific functions
+ */
+static struct {
+	struct nx_scaler_register_set *pregister;
+} __g_module_variables[NUMBER_OF_SCALER_MODULE] = {
+	{
+		NULL,
+	},
+};
+
+int nx_scaler_initialize(void)
+{
+	static bool scaler_binit;
+	u32 i;
+
+	scaler_binit = false;
+
+	if (false == scaler_binit) {
+		for (i = 0; i < NUMBER_OF_SCALER_MODULE; i++)
+			__g_module_variables[i].pregister = NULL;
+
+		scaler_binit = true;
+	}
+	return true;
+}
+
+void nx_scaler_set_yvfilter(u32 module_index, u32 filter_sel, u32 filter_index,
+			    u32 filter_val)
+{
+	writel((u32)filter_val,
+	       &__g_module_variables[module_index]
+	       .pregister->yvfilter[filter_sel][filter_index]);
+}
+
+void nx_scaler_set_yhfilter(u32 module_index, u32 filter_sel, u32 filter_index,
+			    u32 filter_val)
+{
+	writel((u32)filter_val,
+	       &__g_module_variables[module_index]
+	       .pregister->yhfilter[filter_sel][filter_index]);
+}
+
+void nx_scaler_set_base_address(u32 module_index, void *base_address)
+{
+	__g_module_variables[module_index].pregister =
+	    (struct nx_scaler_register_set *)base_address;
+}
+
+void nx_scaler_set_interrupt_enable_all(u32 module_index, int enable)
+{
+	const u32 sc_int_enb_mask = 0x03;
+	const u32 sc_int_enb_bitpos = 16;
+
+	if (enable)
+		writel((sc_int_enb_mask << sc_int_enb_bitpos),
+		&__g_module_variables[module_index].pregister->scintreg);
+	else
+		writel(0x00,
+		    &__g_module_variables[module_index].pregister->scintreg);
+}
+
+void nx_scaler_clear_interrupt_pending(u32 module_index, int32_t int_num)
+{
+	register u32 regval;
+	const u32 sc_int_clr_bitpos = 8;
+
+	regval = __g_module_variables[module_index].pregister->scintreg |
+		 (0x01 << (sc_int_clr_bitpos + int_num));
+	writel(regval, &__g_module_variables[module_index].pregister->scintreg);
+}
+
+void nx_scaler_clear_interrupt_pending_all(u32 module_index)
+{
+	const u32 sc_int_clr_bitpos = 8;
+	register u32 regval;
+
+	regval = __g_module_variables[module_index].pregister->scintreg |
+		 (0x03 << sc_int_clr_bitpos);
+	writel(regval, &__g_module_variables[module_index].pregister->scintreg);
+}
+
+void nx_scaler_set_filter_enable(u32 module_index, int enable)
+{
+	const u32 fenb_mask = (0x03 << 0);
+	register u32 temp;
+
+	temp = __g_module_variables[module_index].pregister->sccfgreg;
+
+	if (true == enable)
+		temp |= fenb_mask;
+	else
+		temp &= ~fenb_mask;
+
+	writel(temp, &__g_module_variables[module_index].pregister->sccfgreg);
+}
+
+void nx_scaler_set_mode(u32 module_index, int mode)
+{
+	const u32 mod_mask = (0x07 << 24);
+	const u32 mod_bitpos = 24;
+	register u32 temp;
+
+	temp = __g_module_variables[module_index].pregister->sccfgreg;
+	temp = (temp & ~mod_mask) | ((u32)mode << mod_bitpos);
+
+	writel(temp, &__g_module_variables[module_index].pregister->sccfgreg);
+}
+
+void nx_scaler_stop(u32 module_index)
+{
+	writel(0x00, &__g_module_variables[module_index].pregister->scrunreg);
+}
+
+void nx_scaler_set_cmd_buf_addr(u32 module_index, u32 addr)
+{
+	writel(addr, &__g_module_variables[module_index].pregister->cmdbufaddr);
+}
+
+void nx_scaler_run_cmd_buf(u32 module_index)
+{
+	writel(0x01, &__g_module_variables[module_index].pregister->cmdbufcon);
+}
+
+void nx_scaler_set_interrupt_enable(u32 module_index, int32_t int_num,
+				    int enable)
+{
+	const u32 sc_int_enb_bitpos = 16;
+
+	writel(((u32)enable << (sc_int_enb_bitpos + int_num)),
+	       &__g_module_variables[module_index].pregister->scintreg);
+}
+
+static inline void _hw_set_filter_table(struct nx_scaler *me,
+					struct filter_table *table)
+{
+	int i, j;
+
+	for (i = 0; i < 3; i++)
+		for (j = 0; j < 8; j++)
+			nx_scaler_set_yvfilter(0, i, j,
+					       MAKE_YVFILTER(
+						table->yvfilter[i][j][0],
+						table->yvfilter[i][j][1],
+						table->yvfilter[i][j][2],
+						table->yvfilter[i][j][3]));
+
+	for (i = 0; i < 5; i++)
+		for (j = 0; j < 32; j++)
+			nx_scaler_set_yhfilter(0, i, j,
+					       MAKE_YHFILTER(
+						table->yhfilter[i][j][0],
+						table->yhfilter[i][j][1]));
+}
+
+static int get_phy_addr_from_fd(struct device *dev, int fd, bool is_src,
+				dma_addr_t *phy_addr)
+{
+	struct dma_buf	*dmabuf;
+	struct dma_buf_attachment *attach;
+	struct sg_table *sgt;
+	u32 direction;
+
+	dmabuf = dma_buf_get(fd);
+	if (IS_ERR_OR_NULL(dmabuf)) {
+		pr_err("%s: can't get dambuf : fd{%d}\n", __func__, fd);
+		return -EINVAL;
+	}
+
+	attach = dma_buf_attach(dmabuf, dev);
+	if (IS_ERR(attach)) {
+		pr_err("fail to attach dmabuf\n");
+		return -EINVAL;
+	}
+
+	if (is_src)
+		direction = DMA_TO_DEVICE;
+	else
+		direction = DMA_FROM_DEVICE;
+
+	sgt = dma_buf_map_attachment(attach, direction);
+	if (IS_ERR(sgt)) {
+		pr_err("Error getting dmabuf scatterlist\n");
+		return -EINVAL;
+	}
+
+	*phy_addr = sg_dma_address(sgt->sgl);
+
+	dma_buf_unmap_attachment(attach, sgt, direction);
+	dma_buf_detach(dmabuf, attach);
+	dma_buf_put(dmabuf);
+
+	return 0;
+}
+
+static int _hw_init(struct nx_scaler *me)
+{
+	int ret = 0;
+	unsigned long rate;
+
+	if (me->pdev == NULL)
+		return 0;
+
+	nx_scaler_initialize();
+	nx_scaler_set_base_address(0, me->base);
+	me->irq = platform_get_irq(me->pdev, 0);
+
+	me->clk = clk_get(&me->pdev->dev, "scaler");
+	if (IS_ERR(me->clk)) {
+		pr_err("%s: controller clock not found\n",
+			dev_name(&me->pdev->dev));
+
+		return PTR_ERR(me->clk);
+	}
+
+	ret = clk_prepare_enable(me->clk);
+	if (ret) {
+		pr_err("scaler: clock failed to prepare & enable: %d\n", ret);
+		clk_put(me->clk);
+		return ret;
+	}
+
+	rate = clk_get_rate(me->clk);
+
+	if (reset_control_status(me->rst))
+		reset_control_reset(me->rst);
+
+	nx_scaler_set_interrupt_enable_all(0, false);
+	nx_scaler_clear_interrupt_pending_all(0);
+	nx_scaler_set_filter_enable(0, true);
+	nx_scaler_set_mode(0, 0);
+
+	return ret;
+}
+
+static void _hw_cleanup(struct nx_scaler *me)
+{
+	free_irq(me->irq, me);
+
+	nx_scaler_stop(0);
+	nx_scaler_set_interrupt_enable_all(0, false);
+	nx_scaler_clear_interrupt_pending_all(0);
+
+	clk_disable_unprepare(me->clk);
+}
+
+static int _hw_set_format(struct nx_scaler *me)
+{
+	nx_scaler_set_filter_enable(0, true);
+
+	return 0;
+}
+
+static inline void _make_cmd(u32 *c)
+{
+	u32 command = 0;
+
+	command |= (11-1) << 0;
+	command |= 3 << (10+0);
+	*c = command;
+}
+
+static void _set_running(struct nx_scaler *me)
+{
+	atomic_set(&me->running, 1);
+}
+
+static void _clear_running(struct nx_scaler *me)
+{
+	atomic_set(&me->running, 0);
+}
+
+static irqreturn_t _scaler_irq_handler(int irq, void *param)
+{
+	struct nx_scaler *me = (struct nx_scaler *)param;
+
+	nx_scaler_clear_interrupt_pending(0, NX_SCALER_INT_CMD_PROC);
+
+	_clear_running(me);
+	wake_up_interruptible(&me->wq_end);
+
+	return IRQ_HANDLED;
+}
+
+static int _make_command_buffer(struct nx_scaler *me,
+				     struct nx_scaler_ioctl_data *data)
+{
+	u32 *cmd_buffer;
+	u32 src_width, src_height, src_code;
+	u32 dst_width, dst_height, dst_code;
+	u32 cb_src_width, cb_src_height, cb_dst_width, cb_dst_height;
+	dma_addr_t src_phy_addr, dst_phy_addr;
+
+	dma_addr_t src_addr, dst_addr;
+	u32 src_y_pos = 0, src_c_pos = 0;
+
+	src_width = data->src_width;
+	src_height = data->src_height;
+	src_code = data->src_code;
+	dst_width = data->dst_width;
+	dst_height = data->dst_height;
+	dst_code = data->dst_code;
+
+	if ((data->crop.x > 0) || (data->crop.y > 0)) {
+		src_y_pos = ((data->crop.y) * data->src_stride[0])
+			+ data->crop.x;
+		src_c_pos = (((data->crop.y/2)) * data->src_stride[1])
+			+ (data->crop.x/2);
+	}
+
+	if (data->crop.width > 0)
+		src_width = data->crop.width;
+	if (data->crop.height > 0)
+		src_height = data->crop.height;
+
+	cmd_buffer = me->command_buffer_vir;
+
+	/* Y command buffer */
+	/* header */
+	_make_cmd(cmd_buffer); cmd_buffer++;
+	/* Source Address Register */
+	get_phy_addr_from_fd(&me->pdev->dev, data->src_fds[0], true,
+				&src_phy_addr);
+	src_addr = src_phy_addr;
+	*cmd_buffer = src_addr+src_y_pos;
+	cmd_buffer++;
+	/* Source Stride Register */
+	*cmd_buffer = data->src_stride[0]; cmd_buffer++;
+	/* Source Size Register */
+	*cmd_buffer = ((src_height - 1) << 16) | (src_width - 1);
+	cmd_buffer++;
+
+	/* Destination Address */
+	get_phy_addr_from_fd(&me->pdev->dev, data->dst_fds[0], false,
+				&dst_phy_addr);
+	dst_addr = dst_phy_addr;
+	*cmd_buffer = dst_addr;
+	cmd_buffer++;
+	/* Destination Stride Register */
+	*cmd_buffer = data->dst_stride[0];
+	cmd_buffer++;
+	/* not use Destination Address1, Destination Stride Register1 */
+	cmd_buffer++;
+	cmd_buffer++;
+	/* Destination Size Register */
+	*cmd_buffer = ((dst_height - 1) << 16) | (dst_width - 1);
+	cmd_buffer++;
+	/* Horizontal Delta Register */
+	*cmd_buffer = (src_width << 16) / (dst_width - 1);
+	cmd_buffer++;
+	/* Vertical Delta Register */
+	*cmd_buffer = (src_height << 16) / (dst_height - 1);
+	cmd_buffer++;
+	/* Ratio Reset Value Register : TODO fixed ??? */
+	*cmd_buffer = 0x00080010;
+	cmd_buffer++;
+
+	/* workaround */
+	*cmd_buffer = 0; cmd_buffer++;
+	*cmd_buffer = 0x00000001; cmd_buffer++;
+	*cmd_buffer = (1 << 29) | (1 << 10); cmd_buffer++;
+	*cmd_buffer = 0x00000003; cmd_buffer++;
+
+	/* CB command buffer */
+	if (src_code == MEDIA_BUS_FMT_YUYV8_2X8) {
+		/* 420 */
+		cb_src_width = src_width >> 1;
+		cb_src_height = src_height >> 1;
+	} else if (src_code == MEDIA_BUS_FMT_YUYV8_1_5X8) {
+		/* 420 */
+		cb_src_width = src_width >> 1;
+		cb_src_height = src_height >> 1;
+	} else if (src_code == MEDIA_BUS_FMT_YUYV8_1X16) {
+		/* 422 */
+		cb_src_width = src_width >> 1;
+		cb_src_height = src_height;
+	} else {
+		cb_src_width = src_width;
+		cb_src_height = src_height;
+	}
+
+	if (dst_code == MEDIA_BUS_FMT_YUYV8_2X8) {
+		/* 420 */
+		cb_dst_width = dst_width >> 1;
+		cb_dst_height = dst_height >> 1;
+	} else if (dst_code == MEDIA_BUS_FMT_YUYV8_1_5X8) {
+		/* 420 */
+		cb_dst_width = dst_width >> 1;
+		cb_dst_height = dst_height >> 1;
+	} else if (dst_code == MEDIA_BUS_FMT_YUYV8_1X16) {
+		/* 422 */
+		cb_dst_width = dst_width >> 1;
+		cb_dst_height = dst_height;
+	} else {
+		cb_dst_width = dst_width;
+		cb_dst_height = dst_height;
+	}
+
+	_make_cmd(cmd_buffer);
+	cmd_buffer++;
+	src_addr += (data->src_stride[0] * ALIGN(data->src_height, 16));
+	*cmd_buffer = src_addr + src_c_pos;
+	cmd_buffer++;
+	*cmd_buffer = data->src_stride[1];
+	cmd_buffer++;
+	*cmd_buffer = ((cb_src_height - 1) << 16) | (cb_src_width - 1);
+	cmd_buffer++;
+
+	dst_addr += (data->dst_stride[0] * ALIGN(data->dst_height, 16));
+	*cmd_buffer = dst_addr;
+	cmd_buffer++;
+	*cmd_buffer = data->dst_stride[1];
+	cmd_buffer++;
+	cmd_buffer++;
+	cmd_buffer++;
+	*cmd_buffer = ((cb_dst_height - 1) << 16) | (cb_dst_width - 1);
+	cmd_buffer++;
+	*cmd_buffer = (cb_src_width << 16) / (cb_dst_width - 1);
+	cmd_buffer++;
+	*cmd_buffer = (cb_src_height << 16) / (cb_dst_height - 1);
+	cmd_buffer++;
+	*cmd_buffer = 0x00080010; cmd_buffer++;
+
+	*cmd_buffer = 0;
+	cmd_buffer++;
+	*cmd_buffer = 0x00000001;
+	cmd_buffer++;
+	*cmd_buffer = (1 << 29) | (1 << 10);
+	cmd_buffer++;
+	*cmd_buffer = 0x00000003;
+	cmd_buffer++;
+
+	_make_cmd(cmd_buffer);
+	cmd_buffer++;
+
+	src_addr += (data->src_stride[1] * ALIGN(data->src_height >> 1, 16));
+	*cmd_buffer = src_addr + src_c_pos;
+	cmd_buffer++;
+	*cmd_buffer = data->src_stride[2];
+	cmd_buffer++;
+	*cmd_buffer = ((cb_src_height - 1) << 16) | (cb_src_width - 1);
+	cmd_buffer++;
+
+	dst_addr += (data->dst_stride[1] * ALIGN(data->dst_height >> 1, 16));
+	*cmd_buffer = dst_addr;
+	cmd_buffer++;
+	*cmd_buffer = data->dst_stride[2];
+	cmd_buffer++;
+	cmd_buffer++;
+	cmd_buffer++;
+	*cmd_buffer = ((cb_dst_height - 1) << 16) | (cb_dst_width - 1);
+	cmd_buffer++;
+	*cmd_buffer = (cb_src_width << 16) / (cb_dst_width - 1);
+	cmd_buffer++;
+	*cmd_buffer = (cb_src_height << 16) / (cb_dst_height - 1);
+	cmd_buffer++;
+	*cmd_buffer = 0x00080010;
+	cmd_buffer++;
+
+	*cmd_buffer = 0;
+	cmd_buffer++;
+	*cmd_buffer = 0x00000001;
+	cmd_buffer++;
+	*cmd_buffer = (1 << 29) | (1 << 27) | (1 << 10);
+	cmd_buffer++;
+	*cmd_buffer = 0x00000003;
+	cmd_buffer++;
+
+	return 0;
+}
+
+
+static int _set_and_run(struct nx_scaler *me,
+	struct nx_scaler_ioctl_data *data)
+{
+	_set_running(me);
+
+	_make_command_buffer(me, data);
+	nx_scaler_set_cmd_buf_addr(0, me->command_buffer_phy);
+	nx_scaler_set_interrupt_enable(0, NX_SCALER_INT_CMD_PROC, true);
+	nx_scaler_set_mode(0, 0);
+	nx_scaler_run_cmd_buf(0);
+
+	if (!wait_event_interruptible_timeout(me->wq_end,
+		      atomic_read(&me->running) == 0, WAIT_TIMEOUT_HZ)) {
+		_clear_running(me);
+
+		nx_scaler_stop(0);
+		nx_scaler_set_interrupt_enable_all(0, false);
+		nx_scaler_clear_interrupt_pending_all(0);
+
+		clk_disable_unprepare(me->clk);
+
+		_hw_init(me);
+
+		_hw_set_filter_table(me, &_default_filter_table);
+		_hw_set_format(me);
+	}
+
+	return 0;
+}
+
+static int nx_scaler_open(struct inode *inode, struct file *filp)
+{
+	int ret;
+	struct nx_scaler *me = container_of(filp->private_data,
+				struct nx_scaler, miscdev);
+
+	if (atomic_read(&me->open_count) > 0) {
+		atomic_inc(&me->open_count);
+
+		return 0;
+	}
+	_hw_init(me);
+	_hw_set_filter_table(me, &_default_filter_table);
+	_hw_set_format(me);
+	ret = request_irq(me->irq, _scaler_irq_handler, IRQF_TRIGGER_NONE,
+			  "nx-scaler", me);
+	if (ret < 0) {
+		pr_err("%s: failed to request_irq()\n", __func__);
+
+		return ret;
+	}
+	atomic_inc(&me->open_count);
+
+	return 0;
+}
+
+static int nx_scaler_release(struct inode *inode,
+				  struct file *file)
+{
+	struct nx_scaler *me = (struct nx_scaler *)file->private_data;
+
+	atomic_dec(&me->open_count);
+
+	if (atomic_read(&me->open_count) == 0)
+		_hw_cleanup(me);
+
+	_clear_running(me);
+
+	return 0;
+}
+
+static long nx_scaler_ioctl(struct file *file, unsigned int cmd,
+				 unsigned long arg)
+{
+	long ret = 0;
+	struct nx_scaler *me = (struct nx_scaler *)file->private_data;
+
+	mutex_lock(&me->mutex);
+
+	switch (cmd) {
+	case IOCTL_SCALER_SET_AND_RUN:
+		{
+			struct nx_scaler_ioctl_data data;
+
+			if (copy_from_user(&data, (void __user *)arg,
+				sizeof(struct nx_scaler_ioctl_data))) {
+				pr_info("%s: failed to copy_from_user()\n",
+					__func__);
+				ret = -EFAULT;
+
+				goto END;
+			}
+
+			ret = _set_and_run(me, &data);
+		}
+		break;
+	default:
+		ret = -EFAULT;
+	}
+
+END:
+	mutex_unlock(&me->mutex);
+
+	return ret;
+}
+
+static const struct file_operations nx_scaler_ops = {
+	.owner          = THIS_MODULE,
+	.open           = nx_scaler_open,
+	.release        = nx_scaler_release,
+	.unlocked_ioctl = nx_scaler_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl	= nx_scaler_ioctl,
+#endif
+};
+
+static struct miscdevice nx_scaler_misc_device = {
+	.minor          = MISC_DYNAMIC_MINOR,
+	.name           = "scaler",
+	.fops           = &nx_scaler_ops,
+};
+
+static int nx_scaler_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct nx_scaler *me = NULL;
+	struct resource *res = NULL;
+
+	me = devm_kzalloc(&pdev->dev, sizeof(struct nx_scaler), GFP_KERNEL);
+	if (!me)
+		return -ENOMEM;
+
+	me->miscdev = nx_scaler_misc_device;
+
+	platform_set_drvdata(pdev, me);
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	me->base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(me->base))
+		return PTR_ERR(me->base);
+
+	pr_debug("%s - base : 0x%p, phy addr : 0x%lX\n", __func__,
+		me->base, (unsigned long)res->start);
+
+	me->command_buffer_vir = NULL;
+	me->command_buffer_phy = 0;
+
+	ret = misc_register(&me->miscdev);
+	if (ret) {
+		pr_err("%s: failed to misc_register()\n",
+		       __func__);
+		kfree(me);
+
+		return -1;
+	}
+
+	dev_set_drvdata(&pdev->dev, me);
+
+	mutex_init(&me->mutex);
+
+	atomic_set(&me->open_count, 0);
+	atomic_set(&me->running, 0);
+
+	init_waitqueue_head(&me->wq_end);
+
+	me->rst = devm_reset_control_get(&pdev->dev, "scaler-reset");
+	if (!me->rst) {
+		dev_err(&me->pdev->dev, "failied to get reset control\n");
+		goto misc_deregister;
+	}
+	me->command_buffer_vir = dma_alloc_coherent(
+				    &pdev->dev,
+				    COMMAND_BUFFER_SIZE,
+				    &me->command_buffer_phy,
+				    GFP_KERNEL);
+	if (!me->command_buffer_vir) {
+		pr_err("%s: failed to alloc", __func__);
+		pr_err("command buffer!!\n");
+
+		goto misc_deregister;
+	}
+	me->pdev = pdev;
+
+	return 0;
+
+misc_deregister:
+	misc_deregister(&me->miscdev);
+	kfree(me);
+
+	return ret;
+}
+
+static int nx_scaler_remove(struct platform_device *pdev)
+{
+	struct nx_scaler *me = platform_get_drvdata(pdev);
+
+	dma_free_coherent(&pdev->dev, COMMAND_BUFFER_SIZE,
+			  me->command_buffer_vir,
+			  me->command_buffer_phy);
+	me->command_buffer_vir = NULL;
+	me->command_buffer_phy = 0;
+
+	misc_deregister(&me->miscdev);
+
+	return 0;
+}
+
+static int nx_scaler_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	struct nx_scaler *me = platform_get_drvdata(pdev);
+
+	if (atomic_read(&me->open_count) > 0) {
+		mutex_lock(&me->mutex);
+
+		nx_scaler_stop(0);
+		nx_scaler_set_interrupt_enable_all(0, false);
+		nx_scaler_clear_interrupt_pending_all(0);
+
+		if (!IS_ERR(me->clk))
+			clk_disable_unprepare(me->clk);
+
+		mutex_unlock(&me->mutex);
+	}
+
+	return 0;
+}
+
+static int nx_scaler_resume(struct platform_device *pdev)
+{
+	struct nx_scaler *me = platform_get_drvdata(pdev);
+
+	if (atomic_read(&me->open_count) > 0) {
+		_hw_init(me);
+		_hw_set_filter_table(me, &_default_filter_table);
+		_hw_set_format(me);
+	}
+
+	return 0;
+}
+
+static const struct of_device_id nx_scaler_match[] = {
+	{ .compatible = "nexell,scaler", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_scaler_match);
+
+static struct platform_driver nx_scaler_driver = {
+	.probe		= nx_scaler_probe,
+	.remove		= nx_scaler_remove,
+	.suspend	= nx_scaler_suspend,
+	.resume		= nx_scaler_resume,
+	.driver		= {
+		.name	= drv_name,
+		.of_match_table	= nx_scaler_match,
+	},
+};
+
+module_platform_driver(nx_scaler_driver);
+
+MODULE_AUTHOR("jkchoi <jkchoi@nexell.co.kr>");
+MODULE_DESCRIPTION("Scaler driver for Nexell");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:nx-scaler");
diff -ENwbur a/drivers/misc/nx-scaler.h b/drivers/misc/nx-scaler.h
--- a/drivers/misc/nx-scaler.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/misc/nx-scaler.h	2018-05-06 08:49:50.210737295 +0200
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongkeun, Choi <jkchoi@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_SCALER_H
+#define _NX_SCALER_H
+
+#include <linux/atomic.h>
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/miscdevice.h>
+#include <linux/mutex.h>
+
+struct list_head;
+struct nx_scaler_ioctl_data;
+
+struct nx_scaler {
+	struct miscdevice		miscdev;
+	struct platform_device		*pdev;
+
+	void __iomem			*base;
+	struct clk			*clk;
+	int				irq;
+
+	unsigned int			*command_buffer_vir;
+	dma_addr_t			command_buffer_phy;
+
+	atomic_t			open_count;
+	wait_queue_head_t		wq_end;
+	struct nx_scaler_ioctl_data	*ioctl_data;
+	atomic_t			running;
+
+	struct reset_control *rst;
+	struct mutex mutex;
+};
+#endif
diff -ENwbur a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
--- a/drivers/mmc/host/dw_mmc.c	2018-05-06 08:47:37.373345913 +0200
+++ b/drivers/mmc/host/dw_mmc.c	2018-05-06 08:49:50.226737943 +0200
@@ -3222,6 +3222,15 @@
 		goto err_clk_ciu;
 	}

+	if (drv_data && drv_data->setup_clock) {
+		ret = drv_data->setup_clock(host);
+		if (ret) {
+			dev_err(host->dev,
+				"implementation specific clock setup failed\n");
+			goto err_clk_ciu;
+		}
+	}
+
 	if (!IS_ERR(host->pdata->rstc)) {
 		reset_control_assert(host->pdata->rstc);
 		usleep_range(10, 50);
diff -ENwbur a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h
--- a/drivers/mmc/host/dw_mmc.h	2018-05-06 08:47:37.373345913 +0200
+++ b/drivers/mmc/host/dw_mmc.h	2018-05-06 08:49:50.226737943 +0200
@@ -544,6 +544,7 @@
  * @caps: mmc subsystem specified capabilities of the controller(s).
  * @num_caps: number of capabilities specified by @caps.
  * @init: early implementation specific initialization.
+ * @setup_clock: implementation specific clock configuration.
  * @set_ios: handle bus specific extensions.
  * @parse_dt: parse implementation specific device tree properties.
  * @execute_tuning: implementation specific tuning procedure.
@@ -556,6 +557,7 @@
 	unsigned long	*caps;
 	u32		num_caps;
 	int		(*init)(struct dw_mci *host);
+	int		(*setup_clock)(struct dw_mci *host);
 	void		(*set_ios)(struct dw_mci *host, struct mmc_ios *ios);
 	int		(*parse_dt)(struct dw_mci *host);
 	int		(*execute_tuning)(struct dw_mci_slot *slot, u32 opcode);
diff -ENwbur a/drivers/mmc/host/dw_mmc-nexell.c b/drivers/mmc/host/dw_mmc-nexell.c
--- a/drivers/mmc/host/dw_mmc-nexell.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/mmc/host/dw_mmc-nexell.c	2018-05-06 08:49:50.222737782 +0200
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/mmc.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/slab.h>
+#include <linux/reset.h>
+
+#include "dw_mmc.h"
+#include "dw_mmc-pltfm.h"
+#include "dw_mmc-nexell.h"
+
+struct dw_mci_nexell_priv_data {
+	struct	reset_control *rst;
+	u32	clkdly;
+};
+
+static int dw_mci_nexell_priv_init(struct dw_mci *host)
+{
+	struct dw_mci_nexell_priv_data *priv = host->priv;
+
+	if (!IS_ERR(priv->rst)) {
+		if (reset_control_status(priv->rst))
+			reset_control_reset(priv->rst);
+	}
+
+	mci_writel(host, CLKCTRL, priv->clkdly);
+
+	return 0;
+}
+
+static int dw_mci_nexell_setup_clock(struct dw_mci *host)
+{
+	host->bus_hz /= NX_SDMMC_CLK_DIV;
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int dw_mci_nexell_suspend(struct device *dev)
+{
+	struct dw_mci *host = dev_get_drvdata(dev);
+
+	clk_disable_unprepare(host->biu_clk);
+	clk_disable_unprepare(host->ciu_clk);
+
+	return dw_mci_runtime_suspend(dev);
+}
+
+static int dw_mci_nexell_resume(struct device *dev)
+{
+	struct dw_mci *host = dev_get_drvdata(dev);
+
+	clk_prepare_enable(host->biu_clk);
+	clk_prepare_enable(host->ciu_clk);
+
+	dw_mci_nexell_priv_init(host);
+	return dw_mci_runtime_resume(dev);
+}
+
+#else
+#define dw_mci_nexell_suspend		NULL
+#define dw_mci_nexell_resume		NULL
+#endif /* CONFIG_PM */
+
+static int dw_mci_nexell_parse_dt(struct dw_mci *host)
+{
+	struct dw_mci_nexell_priv_data *priv;
+	struct device_node *np = host->dev->of_node;
+	int drive_delay, drive_shift, sample_delay, sample_shift;
+
+	priv = devm_kzalloc(host->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	if (of_property_read_u32(np, "nexell,drive_dly", &drive_delay))
+		drive_delay = 0;
+
+	if (of_property_read_u32(np, "nexell,drive_shift", &drive_shift))
+		drive_shift = 2;
+
+	if (of_property_read_u32(np, "nexell,sample_dly", &sample_delay))
+		sample_delay = 0;
+
+	if (of_property_read_u32(np, "nexell,sample_shift", &sample_shift))
+		sample_shift = 1;
+
+	priv->clkdly = NX_MMC_CLK_DELAY(drive_delay, drive_shift,
+					sample_delay, sample_shift);
+
+	priv->rst = devm_reset_control_get(host->dev, "dw_mmc-reset");
+
+	host->priv = priv;
+	return 0;
+}
+
+/* Common capabilities of s5pxx18 SoC */
+static unsigned long nexell_dwmmc_caps[4] = {
+	MMC_CAP_CMD23,
+	MMC_CAP_CMD23,
+	MMC_CAP_CMD23,
+	MMC_CAP_CMD23,
+};
+
+static const struct dw_mci_drv_data nexell_drv_data = {
+	.caps			= nexell_dwmmc_caps,
+	.num_caps		= ARRAY_SIZE(nexell_dwmmc_caps),
+	.init			= dw_mci_nexell_priv_init,
+	.setup_clock		= dw_mci_nexell_setup_clock,
+	.parse_dt		= dw_mci_nexell_parse_dt,
+};
+
+static const struct of_device_id dw_mci_nexell_match[] = {
+	{ .compatible = "nexell,s5p6818-dw-mshc",
+			.data = &nexell_drv_data, },
+	{},
+};
+MODULE_DEVICE_TABLE(of, dw_mci_nexell_match);
+
+static int dw_mci_nexell_probe(struct platform_device *pdev)
+{
+	const struct dw_mci_drv_data *drv_data;
+	const struct of_device_id *match;
+
+	match = of_match_node(dw_mci_nexell_match, pdev->dev.of_node);
+	drv_data = match->data;
+	return dw_mci_pltfm_register(pdev, drv_data);
+}
+
+static const struct dev_pm_ops dw_mci_nexell_pmops = {
+	SET_SYSTEM_SLEEP_PM_OPS(dw_mci_nexell_suspend, dw_mci_nexell_resume)
+};
+
+static struct platform_driver dw_mci_nexell_pltfm_driver = {
+	.probe		= dw_mci_nexell_probe,
+	.remove		= dw_mci_pltfm_remove,
+	.driver		= {
+		.name		= "dwmmc_nexell",
+		.of_match_table	= dw_mci_nexell_match,
+		.pm		= &dw_mci_nexell_pmops,
+	},
+};
+
+module_platform_driver(dw_mci_nexell_pltfm_driver);
+
+MODULE_DESCRIPTION("Nexell Specific DW-MSHC Driver Extension");
+MODULE_AUTHOR("Youngbok Park <ybpart@nexell.co.kr");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:dwmmc-nexell");
diff -ENwbur a/drivers/mmc/host/dw_mmc-nexell.h b/drivers/mmc/host/dw_mmc-nexell.h
--- a/drivers/mmc/host/dw_mmc-nexell.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/mmc/host/dw_mmc-nexell.h	2018-05-06 08:49:50.226737943 +0200
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _DW_MMC_NEXELL_H_
+#define _DW_MMC_NEXELL_H_
+
+#define SDMMC_CLKCTRL			0x114
+
+#define NX_SDMMC_CLK_DIV		2
+
+#define NX_MMC_CLK_DELAY(x, y, a, b)	(((x & 0xFF) << 0) |\
+					((y & 0x03) << 16) |\
+					((a & 0xFF) << 8)  |\
+					((b & 0x03) << 24))
+#endif /* _DW_MMC_NEXELL_H_ */
diff -ENwbur a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
--- a/drivers/mmc/host/Kconfig	2018-05-06 08:47:37.373345913 +0200
+++ b/drivers/mmc/host/Kconfig	2018-05-06 08:49:50.222737782 +0200
@@ -703,6 +703,15 @@
 	  Synopsys DesignWare Memory Card Interface driver. Select this option
 	  for platforms based on Exynos4 and Exynos5 SoC's.

+config MMC_DW_NEXELL
+	tristate "Nexell specific extensions for Synopsys DW Memory Card Interface"
+	depends on MMC_DW
+	select MMC_DW_PLTFM
+	help
+	  This selects support for Nexell s5pxx18 SoC specific extensions to the
+	  Synopsys DesignWare Memory Card Interface driver. Select this option
+	  for platforms based on s5p6818 and s5p6818 SoC's.
+
 config MMC_DW_K3
 	tristate "K3 specific extensions for Synopsys DW Memory Card Interface"
 	depends on MMC_DW
diff -ENwbur a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
--- a/drivers/mmc/host/Makefile	2018-05-06 08:47:37.373345913 +0200
+++ b/drivers/mmc/host/Makefile	2018-05-06 08:49:50.222737782 +0200
@@ -55,6 +55,7 @@
 obj-$(CONFIG_MMC_DW)		+= dw_mmc.o
 obj-$(CONFIG_MMC_DW_PLTFM)	+= dw_mmc-pltfm.o
 obj-$(CONFIG_MMC_DW_EXYNOS)	+= dw_mmc-exynos.o
+obj-$(CONFIG_MMC_DW_NEXELL)	+= dw_mmc-nexell.o
 obj-$(CONFIG_MMC_DW_K3)		+= dw_mmc-k3.o
 obj-$(CONFIG_MMC_DW_PCI)	+= dw_mmc-pci.o
 obj-$(CONFIG_MMC_DW_ROCKCHIP)	+= dw_mmc-rockchip.o
diff -ENwbur a/drivers/net/ethernet/stmicro/stmmac/dwmac-nexell.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-nexell.c
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-nexell.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-nexell.c	2018-05-06 08:49:50.518749793 +0200
@@ -0,0 +1,167 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/ethtool.h>
+#include <linux/stmmac.h>
+#include <linux/clk.h>
+#include <linux/phy.h>
+#include <linux/of_net.h>
+#include <linux/reset.h>
+
+#include "stmmac_platform.h"
+#include "stmmac.h"
+
+struct nexell_priv_data {
+	int clk_enabled;
+	struct clk *tx_clk;
+	int wolopts;
+};
+
+static void nexell_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+{
+	struct stmmac_priv *stpriv = netdev_priv(ndev);
+	wol->supported = WAKE_MAGIC;
+	wol->wolopts = stpriv->wolopts;
+}
+
+static int nexell_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+{
+	struct stmmac_priv *stpriv = netdev_priv(ndev);
+	u32 support = WAKE_MAGIC;
+	int err;
+
+	if (wol->wolopts & ~support)
+		return -EOPNOTSUPP;
+
+	err = phy_ethtool_set_wol(ndev->phydev, wol);
+	if (err < 0) {
+		dev_err(stpriv->device, "The PHY does not support set_wol\n");
+		return -EOPNOTSUPP;
+	}
+
+	spin_lock_irq(&stpriv->lock);
+	stpriv->wolopts |= wol->wolopts;
+	spin_unlock_irq(&stpriv->lock);
+
+	return 0;
+}
+
+static void *nexell_gmac_setup(struct platform_device *pdev)
+{
+	struct nexell_priv_data *gmac;
+	struct device *dev = &pdev->dev;
+
+	gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
+	if (!gmac)
+		return ERR_PTR(-ENOMEM);
+
+	gmac->tx_clk = devm_clk_get(dev, "nexell_gmac_tx");
+	if (IS_ERR(gmac->tx_clk)) {
+		dev_err(dev, "could not get tx clock\n");
+		return gmac->tx_clk;
+	}
+
+	return gmac;
+}
+
+#define GMAC_GMII_RGMII_RATE	125000000
+
+static int nexell_gmac_init(struct platform_device *pdev, void *priv)
+{
+	struct net_device *ndev = platform_get_drvdata(pdev);
+	struct stmmac_priv *stpriv = NULL;
+	struct nexell_priv_data *gmac = priv;
+
+	if (ndev)
+		stpriv = netdev_priv(ndev);
+
+	if (stpriv && stpriv->plat->stmmac_rst)
+		reset_control_deassert(stpriv->plat->stmmac_rst);
+
+	clk_set_rate(gmac->tx_clk, GMAC_GMII_RGMII_RATE);
+	clk_prepare_enable(gmac->tx_clk);
+	gmac->clk_enabled = 1;
+	gmac->wolopts = 0;
+
+	return 0;
+}
+
+static void nexell_gmac_exit(struct platform_device *pdev, void *priv)
+{
+	struct nexell_priv_data *gmac = priv;
+
+	if (gmac->clk_enabled) {
+		clk_disable(gmac->tx_clk);
+		gmac->clk_enabled = 0;
+	}
+	clk_unprepare(gmac->tx_clk);
+}
+
+static int nexell_gmac_probe(struct platform_device *pdev)
+{
+	struct plat_stmmacenet_data *plat_dat;
+	struct stmmac_resources stmmac_res;
+	int ret;
+
+	ret = stmmac_get_platform_resources(pdev, &stmmac_res);
+	if (ret)
+		return ret;
+
+	plat_dat = stmmac_probe_config_dt(pdev, &stmmac_res.mac);
+	if (IS_ERR(plat_dat))
+		return PTR_ERR(plat_dat);
+
+	plat_dat->has_gmac = true;
+	plat_dat->init = nexell_gmac_init;
+	plat_dat->exit = nexell_gmac_exit;
+	plat_dat->set_wol = nexell_set_wol;
+	plat_dat->get_wol = nexell_get_wol;
+
+	plat_dat->bsp_priv = nexell_gmac_setup(pdev);
+
+	if (IS_ERR(plat_dat->bsp_priv))
+		return PTR_ERR(plat_dat->bsp_priv);
+
+	ret = nexell_gmac_init(pdev, plat_dat->bsp_priv);
+	if (ret)
+		return ret;
+
+	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+}
+
+static const struct of_device_id nexell_dwmac_match[] = {
+	{ .compatible = "nexell,s5p6818-gmac", },
+	{ }
+};
+MODULE_DEVICE_TABLE(of, nexell_dwmac_match);
+
+static struct platform_driver nexell_dwmac_driver = {
+	.probe  = nexell_gmac_probe,
+	.remove = stmmac_pltfr_remove,
+	.driver = {
+		.name           = "nexell-dwmac",
+		.pm		= &stmmac_pltfr_pm_ops,
+		.of_match_table = nexell_dwmac_match,
+	},
+};
+module_platform_driver(nexell_dwmac_driver);
+
+MODULE_AUTHOR("Bon-gyu, KOO <freestyle@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell DWMAC specific glue layer");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig	2018-05-06 08:47:37.657357443 +0200
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig	2018-05-06 08:49:50.518749793 +0200
@@ -86,6 +86,16 @@
 	  the stmmac device driver. This driver is used for Meson6,
 	  Meson8, Meson8b and GXBB SoCs.

+config DWMAC_NEXELL
+	tristate "Nexell dwmac support"
+	default ARCH_S5P6818
+	depends on OF
+	help
+	  Support for Ethernet controller on Nexell SoCs.
+
+	  This selects the Nexell SoC glue layer support for
+	  the stmmac device driver.
+
 config DWMAC_OXNAS
 	tristate "Oxford Semiconductor OXNAS dwmac support"
 	default ARCH_OXNAS
diff -ENwbur a/drivers/net/ethernet/stmicro/stmmac/Makefile b/drivers/net/ethernet/stmicro/stmmac/Makefile
--- a/drivers/net/ethernet/stmicro/stmmac/Makefile	2018-05-06 08:47:37.657357443 +0200
+++ b/drivers/net/ethernet/stmicro/stmmac/Makefile	2018-05-06 08:49:50.518749793 +0200
@@ -12,6 +12,7 @@
 obj-$(CONFIG_DWMAC_IPQ806X)	+= dwmac-ipq806x.o
 obj-$(CONFIG_DWMAC_LPC18XX)	+= dwmac-lpc18xx.o
 obj-$(CONFIG_DWMAC_MESON)	+= dwmac-meson.o dwmac-meson8b.o
+obj-$(CONFIG_DWMAC_NEXELL)	+= dwmac-nexell.o
 obj-$(CONFIG_DWMAC_OXNAS)	+= dwmac-oxnas.o
 obj-$(CONFIG_DWMAC_ROCKCHIP)	+= dwmac-rk.o
 obj-$(CONFIG_DWMAC_SOCFPGA)	+= dwmac-altr-socfpga.o
diff -ENwbur a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c	2018-05-06 08:47:37.661357606 +0200
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c	2018-05-06 08:49:50.522749955 +0200
@@ -628,6 +628,39 @@
 	struct stmmac_priv *priv = netdev_priv(dev);
 	u32 support = WAKE_MAGIC | WAKE_UCAST;

+	if (priv->plat->set_wol)
+	{
+		int ret;
+		u32 wolopts = wol->wolopts;
+
+		/* if requested option has already specified */
+		if (wolopts == priv->wolopts)
+			return 0;
+
+		ret = priv->plat->set_wol(dev, wol);
+		if (ret < 0)
+			return ret;
+
+		if (wolopts) {
+			pr_info("stmmac: wakeup enable by plat\n");
+			device_set_wakeup_enable(priv->device, 1);
+			enable_irq_wake(priv->wol_irq);
+
+			priv->wolopts = wol->wolopts;
+		} else {
+			/* 'disable' */
+			if (priv->wolopts) {
+				pr_info("stmmac: wakeup disable by plat\n");
+				device_set_wakeup_enable(priv->device, 0);
+				disable_irq_wake(priv->wol_irq);
+
+				priv->wolopts = 0;
+			}
+		}
+
+		return ret;
+	}
+
 	/* By default almost all GMAC devices support the WoL via
 	 * magic frame but we can disable it if the HW capability
 	 * register shows no support for pmt_magic_frame. */
diff -ENwbur a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c	2018-05-06 08:47:37.661357606 +0200
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c	2018-05-06 08:49:50.522749955 +0200
@@ -459,6 +459,11 @@
 		plat->pmt = 1;
 	}

+	if (of_device_is_compatible(np, "nexell,s5p6818-gmac")) {
+		of_property_read_u32(np, "snps,multicast-filter-bins",
+				     &plat->multicast_filter_bins);
+	}
+
 	if (of_device_is_compatible(np, "snps,dwmac-4.00") ||
 	    of_device_is_compatible(np, "snps,dwmac-4.10a")) {
 		plat->has_gmac4 = 1;
diff -ENwbur a/drivers/net/wireless/bcm4336/aiutils.c b/drivers/net/wireless/bcm4336/aiutils.c
--- a/drivers/net/wireless/bcm4336/aiutils.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/aiutils.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,1097 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: aiutils.c 467150 2014-04-02 17:30:43Z $
+ */
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+
+#include "siutils_priv.h"
+
+#define BCM47162_DMP() (0)
+#define BCM5357_DMP() (0)
+#define BCM4707_DMP() (0)
+#define PMU_DMP() (0)
+#define remap_coreid(sih, coreid)	(coreid)
+#define remap_corerev(sih, corerev)	(corerev)
+
+/* EROM parsing */
+
+static uint32
+get_erom_ent(si_t *sih, uint32 **eromptr, uint32 mask, uint32 match)
+{
+	uint32 ent;
+	uint inv = 0, nom = 0;
+
+	while (TRUE) {
+		ent = R_REG(si_osh(sih), *eromptr);
+		(*eromptr)++;
+
+		if (mask == 0)
+			break;
+
+		if ((ent & ER_VALID) == 0) {
+			inv++;
+			continue;
+		}
+
+		if (ent == (ER_END | ER_VALID))
+			break;
+
+		if ((ent & mask) == match)
+			break;
+
+		nom++;
+	}
+
+	SI_VMSG(("%s: Returning ent 0x%08x\n", __FUNCTION__, ent));
+	if (inv + nom) {
+		SI_VMSG(("  after %d invalid and %d non-matching entries\n", inv, nom));
+	}
+	return ent;
+}
+
+static uint32
+get_asd(si_t *sih, uint32 **eromptr, uint sp, uint ad, uint st, uint32 *addrl, uint32 *addrh,
+        uint32 *sizel, uint32 *sizeh)
+{
+	uint32 asd, sz, szd;
+
+	asd = get_erom_ent(sih, eromptr, ER_VALID, ER_VALID);
+	if (((asd & ER_TAG1) != ER_ADD) ||
+	    (((asd & AD_SP_MASK) >> AD_SP_SHIFT) != sp) ||
+	    ((asd & AD_ST_MASK) != st)) {
+		/* This is not what we want, "push" it back */
+		(*eromptr)--;
+		return 0;
+	}
+	*addrl = asd & AD_ADDR_MASK;
+	if (asd & AD_AG32)
+		*addrh = get_erom_ent(sih, eromptr, 0, 0);
+	else
+		*addrh = 0;
+	*sizeh = 0;
+	sz = asd & AD_SZ_MASK;
+	if (sz == AD_SZ_SZD) {
+		szd = get_erom_ent(sih, eromptr, 0, 0);
+		*sizel = szd & SD_SZ_MASK;
+		if (szd & SD_SG32)
+			*sizeh = get_erom_ent(sih, eromptr, 0, 0);
+	} else
+		*sizel = AD_SZ_BASE << (sz >> AD_SZ_SHIFT);
+
+	SI_VMSG(("  SP %d, ad %d: st = %d, 0x%08x_0x%08x @ 0x%08x_0x%08x\n",
+	        sp, ad, st, *sizeh, *sizel, *addrh, *addrl));
+
+	return asd;
+}
+
+static void
+ai_hwfixup(si_info_t *sii)
+{
+}
+
+
+/* parse the enumeration rom to identify all cores */
+void
+ai_scan(si_t *sih, void *regs, uint devid)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	chipcregs_t *cc = (chipcregs_t *)regs;
+	uint32 erombase, *eromptr, *eromlim;
+
+	erombase = R_REG(sii->osh, &cc->eromptr);
+
+	switch (BUSTYPE(sih->bustype)) {
+	case SI_BUS:
+		eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+		break;
+
+	case PCI_BUS:
+		/* Set wrappers address */
+		sii->curwrap = (void *)((uintptr)regs + SI_CORE_SIZE);
+
+		/* Now point the window at the erom */
+		OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, erombase);
+		eromptr = regs;
+		break;
+
+#ifdef BCMSDIO
+	case SPI_BUS:
+	case SDIO_BUS:
+		eromptr = (uint32 *)(uintptr)erombase;
+		break;
+#endif	/* BCMSDIO */
+
+	case PCMCIA_BUS:
+	default:
+		SI_ERROR(("Don't know how to do AXI enumertion on bus %d\n", sih->bustype));
+		ASSERT(0);
+		return;
+	}
+	eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+
+	SI_VMSG(("ai_scan: regs = 0x%p, erombase = 0x%08x, eromptr = 0x%p, eromlim = 0x%p\n",
+	         regs, erombase, eromptr, eromlim));
+	while (eromptr < eromlim) {
+		uint32 cia, cib, cid, mfg, crev, nmw, nsw, nmp, nsp;
+		uint32 mpd, asd, addrl, addrh, sizel, sizeh;
+		uint i, j, idx;
+		bool br;
+
+		br = FALSE;
+
+		/* Grok a component */
+		cia = get_erom_ent(sih, &eromptr, ER_TAG, ER_CI);
+		if (cia == (ER_END | ER_VALID)) {
+			SI_VMSG(("Found END of erom after %d cores\n", sii->numcores));
+			ai_hwfixup(sii);
+			return;
+		}
+
+		cib = get_erom_ent(sih, &eromptr, 0, 0);
+
+		if ((cib & ER_TAG) != ER_CI) {
+			SI_ERROR(("CIA not followed by CIB\n"));
+			goto error;
+		}
+
+		cid = (cia & CIA_CID_MASK) >> CIA_CID_SHIFT;
+		mfg = (cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT;
+		crev = (cib & CIB_REV_MASK) >> CIB_REV_SHIFT;
+		nmw = (cib & CIB_NMW_MASK) >> CIB_NMW_SHIFT;
+		nsw = (cib & CIB_NSW_MASK) >> CIB_NSW_SHIFT;
+		nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+		nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+#ifdef BCMDBG_SI
+		SI_VMSG(("Found component 0x%04x/0x%04x rev %d at erom addr 0x%p, with nmw = %d, "
+		         "nsw = %d, nmp = %d & nsp = %d\n",
+		         mfg, cid, crev, eromptr - 1, nmw, nsw, nmp, nsp));
+#else
+		BCM_REFERENCE(crev);
+#endif
+
+		if (((mfg == MFGID_ARM) && (cid == DEF_AI_COMP)) || (nsp == 0))
+			continue;
+		if ((nmw + nsw == 0)) {
+			/* A component which is not a core */
+			if (cid == OOB_ROUTER_CORE_ID) {
+				asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE,
+					&addrl, &addrh, &sizel, &sizeh);
+				if (asd != 0) {
+					sii->oob_router = addrl;
+				}
+			}
+			if (cid != GMAC_COMMON_4706_CORE_ID && cid != NS_CCB_CORE_ID &&
+				cid != PMU_CORE_ID && cid != GCI_CORE_ID)
+				continue;
+		}
+
+		idx = sii->numcores;
+
+		cores_info->cia[idx] = cia;
+		cores_info->cib[idx] = cib;
+		cores_info->coreid[idx] = remap_coreid(sih, cid);
+
+		for (i = 0; i < nmp; i++) {
+			mpd = get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+			if ((mpd & ER_TAG) != ER_MP) {
+				SI_ERROR(("Not enough MP entries for component 0x%x\n", cid));
+				goto error;
+			}
+			SI_VMSG(("  Master port %d, mp: %d id: %d\n", i,
+			         (mpd & MPD_MP_MASK) >> MPD_MP_SHIFT,
+			         (mpd & MPD_MUI_MASK) >> MPD_MUI_SHIFT));
+		}
+
+		/* First Slave Address Descriptor should be port 0:
+		 * the main register space for the core
+		 */
+		asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+		if (asd == 0) {
+			do {
+			/* Try again to see if it is a bridge */
+			asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+			              &sizel, &sizeh);
+			if (asd != 0)
+				br = TRUE;
+			else {
+					if (br == TRUE) {
+						break;
+					}
+					else if ((addrh != 0) || (sizeh != 0) ||
+						(sizel != SI_CORE_SIZE)) {
+						SI_ERROR(("addrh = 0x%x\t sizeh = 0x%x\t size1 ="
+							"0x%x\n", addrh, sizeh, sizel));
+						SI_ERROR(("First Slave ASD for"
+							"core 0x%04x malformed "
+							"(0x%08x)\n", cid, asd));
+						goto error;
+					}
+				}
+			} while (1);
+		}
+		cores_info->coresba[idx] = addrl;
+		cores_info->coresba_size[idx] = sizel;
+		/* Get any more ASDs in port 0 */
+		j = 1;
+		do {
+			asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+			              &sizel, &sizeh);
+			if ((asd != 0) && (j == 1) && (sizel == SI_CORE_SIZE)) {
+				cores_info->coresba2[idx] = addrl;
+				cores_info->coresba2_size[idx] = sizel;
+			}
+			j++;
+		} while (asd != 0);
+
+		/* Go through the ASDs for other slave ports */
+		for (i = 1; i < nsp; i++) {
+			j = 0;
+			do {
+				asd = get_asd(sih, &eromptr, i, j, AD_ST_SLAVE, &addrl, &addrh,
+				              &sizel, &sizeh);
+
+				if (asd == 0)
+					break;
+				j++;
+			} while (1);
+			if (j == 0) {
+				SI_ERROR((" SP %d has no address descriptors\n", i));
+				goto error;
+			}
+		}
+
+		/* Now get master wrappers */
+		for (i = 0; i < nmw; i++) {
+			asd = get_asd(sih, &eromptr, i, 0, AD_ST_MWRAP, &addrl, &addrh,
+			              &sizel, &sizeh);
+			if (asd == 0) {
+				SI_ERROR(("Missing descriptor for MW %d\n", i));
+				goto error;
+			}
+			if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+				SI_ERROR(("Master wrapper %d is not 4KB\n", i));
+				goto error;
+			}
+			if (i == 0)
+				cores_info->wrapba[idx] = addrl;
+		}
+
+		/* And finally slave wrappers */
+		for (i = 0; i < nsw; i++) {
+			uint fwp = (nsp == 1) ? 0 : 1;
+			asd = get_asd(sih, &eromptr, fwp + i, 0, AD_ST_SWRAP, &addrl, &addrh,
+			              &sizel, &sizeh);
+			if (asd == 0) {
+				SI_ERROR(("Missing descriptor for SW %d\n", i));
+				goto error;
+			}
+			if ((sizeh != 0) || (sizel != SI_CORE_SIZE)) {
+				SI_ERROR(("Slave wrapper %d is not 4KB\n", i));
+				goto error;
+			}
+			if ((nmw == 0) && (i == 0))
+				cores_info->wrapba[idx] = addrl;
+		}
+
+
+		/* Don't record bridges */
+		if (br)
+			continue;
+
+		/* Done with core */
+		sii->numcores++;
+	}
+
+	SI_ERROR(("Reached end of erom without finding END"));
+
+error:
+	sii->numcores = 0;
+	return;
+}
+
+#define AI_SETCOREIDX_MAPSIZE(coreid) \
+	(((coreid) == NS_CCB_CORE_ID) ? 15 * SI_CORE_SIZE : SI_CORE_SIZE)
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+void *
+ai_setcoreidx(si_t *sih, uint coreidx)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint32 addr, wrap;
+	void *regs;
+
+	if (coreidx >= MIN(sii->numcores, SI_MAXCORES))
+		return (NULL);
+
+	addr = cores_info->coresba[coreidx];
+	wrap = cores_info->wrapba[coreidx];
+
+	/*
+	 * If the user has provided an interrupt mask enabled function,
+	 * then assert interrupts are disabled before switching the core.
+	 */
+	ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+	switch (BUSTYPE(sih->bustype)) {
+	case SI_BUS:
+		/* map new one */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = REG_MAP(addr,
+				AI_SETCOREIDX_MAPSIZE(cores_info->coreid[coreidx]));
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		sii->curmap = regs = cores_info->regs[coreidx];
+		if (!cores_info->wrappers[coreidx] && (wrap != 0)) {
+			cores_info->wrappers[coreidx] = REG_MAP(wrap, SI_CORE_SIZE);
+			ASSERT(GOODREGS(cores_info->wrappers[coreidx]));
+		}
+		sii->curwrap = cores_info->wrappers[coreidx];
+		break;
+
+	case PCI_BUS:
+		/* point bar0 window */
+		OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, addr);
+		regs = sii->curmap;
+		/* point bar0 2nd 4KB window to the primary wrapper */
+		if (PCIE_GEN2(sii))
+			OSL_PCI_WRITE_CONFIG(sii->osh, PCIE2_BAR0_WIN2, 4, wrap);
+		else
+			OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN2, 4, wrap);
+		break;
+
+#ifdef BCMSDIO
+	case SPI_BUS:
+	case SDIO_BUS:
+		sii->curmap = regs = (void *)((uintptr)addr);
+		sii->curwrap = (void *)((uintptr)wrap);
+		break;
+#endif	/* BCMSDIO */
+
+	case PCMCIA_BUS:
+	default:
+		ASSERT(0);
+		regs = NULL;
+		break;
+	}
+
+	sii->curmap = regs;
+	sii->curidx = coreidx;
+
+	return regs;
+}
+
+
+void
+ai_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	chipcregs_t *cc = NULL;
+	uint32 erombase, *eromptr, *eromlim;
+	uint i, j, cidx;
+	uint32 cia, cib, nmp, nsp;
+	uint32 asd, addrl, addrh, sizel, sizeh;
+
+	for (i = 0; i < sii->numcores; i++) {
+		if (cores_info->coreid[i] == CC_CORE_ID) {
+			cc = (chipcregs_t *)cores_info->regs[i];
+			break;
+		}
+	}
+	if (cc == NULL)
+		goto error;
+
+	erombase = R_REG(sii->osh, &cc->eromptr);
+	eromptr = (uint32 *)REG_MAP(erombase, SI_CORE_SIZE);
+	eromlim = eromptr + (ER_REMAPCONTROL / sizeof(uint32));
+
+	cidx = sii->curidx;
+	cia = cores_info->cia[cidx];
+	cib = cores_info->cib[cidx];
+
+	nmp = (cib & CIB_NMP_MASK) >> CIB_NMP_SHIFT;
+	nsp = (cib & CIB_NSP_MASK) >> CIB_NSP_SHIFT;
+
+	/* scan for cores */
+	while (eromptr < eromlim) {
+		if ((get_erom_ent(sih, &eromptr, ER_TAG, ER_CI) == cia) &&
+			(get_erom_ent(sih, &eromptr, 0, 0) == cib)) {
+			break;
+		}
+	}
+
+	/* skip master ports */
+	for (i = 0; i < nmp; i++)
+		get_erom_ent(sih, &eromptr, ER_VALID, ER_VALID);
+
+	/* Skip ASDs in port 0 */
+	asd = get_asd(sih, &eromptr, 0, 0, AD_ST_SLAVE, &addrl, &addrh, &sizel, &sizeh);
+	if (asd == 0) {
+		/* Try again to see if it is a bridge */
+		asd = get_asd(sih, &eromptr, 0, 0, AD_ST_BRIDGE, &addrl, &addrh,
+		              &sizel, &sizeh);
+	}
+
+	j = 1;
+	do {
+		asd = get_asd(sih, &eromptr, 0, j, AD_ST_SLAVE, &addrl, &addrh,
+		              &sizel, &sizeh);
+		j++;
+	} while (asd != 0);
+
+	/* Go through the ASDs for other slave ports */
+	for (i = 1; i < nsp; i++) {
+		j = 0;
+		do {
+			asd = get_asd(sih, &eromptr, i, j, AD_ST_SLAVE, &addrl, &addrh,
+				&sizel, &sizeh);
+			if (asd == 0)
+				break;
+
+			if (!asidx--) {
+				*addr = addrl;
+				*size = sizel;
+				return;
+			}
+			j++;
+		} while (1);
+
+		if (j == 0) {
+			SI_ERROR((" SP %d has no address descriptors\n", i));
+			break;
+		}
+	}
+
+error:
+	*size = 0;
+	return;
+}
+
+/* Return the number of address spaces in current core */
+int
+ai_numaddrspaces(si_t *sih)
+{
+	return 2;
+}
+
+/* Return the address of the nth address space in the current core */
+uint32
+ai_addrspace(si_t *sih, uint asidx)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint cidx;
+
+	cidx = sii->curidx;
+
+	if (asidx == 0)
+		return cores_info->coresba[cidx];
+	else if (asidx == 1)
+		return cores_info->coresba2[cidx];
+	else {
+		SI_ERROR(("%s: Need to parse the erom again to find addr space %d\n",
+		          __FUNCTION__, asidx));
+		return 0;
+	}
+}
+
+/* Return the size of the nth address space in the current core */
+uint32
+ai_addrspacesize(si_t *sih, uint asidx)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint cidx;
+
+	cidx = sii->curidx;
+
+	if (asidx == 0)
+		return cores_info->coresba_size[cidx];
+	else if (asidx == 1)
+		return cores_info->coresba2_size[cidx];
+	else {
+		SI_ERROR(("%s: Need to parse the erom again to find addr space %d\n",
+		          __FUNCTION__, asidx));
+		return 0;
+	}
+}
+
+uint
+ai_flag(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+
+	if (BCM47162_DMP()) {
+		SI_ERROR(("%s: Attempting to read MIPS DMP registers on 47162a0", __FUNCTION__));
+		return sii->curidx;
+	}
+	if (BCM5357_DMP()) {
+		SI_ERROR(("%s: Attempting to read USB20H DMP registers on 5357b0\n", __FUNCTION__));
+		return sii->curidx;
+	}
+	if (BCM4707_DMP()) {
+		SI_ERROR(("%s: Attempting to read CHIPCOMMONB DMP registers on 4707\n",
+			__FUNCTION__));
+		return sii->curidx;
+	}
+
+#ifdef REROUTE_OOBINT
+	if (PMU_DMP()) {
+		SI_ERROR(("%s: Attempting to read PMU DMP registers\n",
+			__FUNCTION__));
+		return PMU_OOB_BIT;
+	}
+#endif /* REROUTE_OOBINT */
+
+	ai = sii->curwrap;
+	ASSERT(ai != NULL);
+
+	return (R_REG(sii->osh, &ai->oobselouta30) & 0x1f);
+}
+
+uint
+ai_flag_alt(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+
+	if (BCM47162_DMP()) {
+		SI_ERROR(("%s: Attempting to read MIPS DMP registers on 47162a0", __FUNCTION__));
+		return sii->curidx;
+	}
+	if (BCM5357_DMP()) {
+		SI_ERROR(("%s: Attempting to read USB20H DMP registers on 5357b0\n", __FUNCTION__));
+		return sii->curidx;
+	}
+	if (BCM4707_DMP()) {
+		SI_ERROR(("%s: Attempting to read CHIPCOMMONB DMP registers on 4707\n",
+			__FUNCTION__));
+		return sii->curidx;
+	}
+#ifdef REROUTE_OOBINT
+	if (PMU_DMP()) {
+		SI_ERROR(("%s: Attempting to read PMU DMP registers\n",
+			__FUNCTION__));
+		return PMU_OOB_BIT;
+	}
+#endif /* REROUTE_OOBINT */
+
+	ai = sii->curwrap;
+
+	return ((R_REG(sii->osh, &ai->oobselouta30) >> AI_OOBSEL_1_SHIFT) & AI_OOBSEL_MASK);
+}
+
+void
+ai_setint(si_t *sih, int siflag)
+{
+}
+
+uint
+ai_wrap_reg(si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+	si_info_t *sii = SI_INFO(sih);
+	uint32 *map = (uint32 *) sii->curwrap;
+
+	if (mask || val) {
+		uint32 w = R_REG(sii->osh, map+(offset/4));
+		w &= ~mask;
+		w |= val;
+		W_REG(sii->osh, map+(offset/4), w);
+	}
+
+	return (R_REG(sii->osh, map+(offset/4)));
+}
+
+uint
+ai_corevendor(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint32 cia;
+
+	cia = cores_info->cia[sii->curidx];
+	return ((cia & CIA_MFG_MASK) >> CIA_MFG_SHIFT);
+}
+
+uint
+ai_corerev(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint32 cib;
+
+
+	cib = cores_info->cib[sii->curidx];
+	return remap_corerev(sih, (cib & CIB_REV_MASK) >> CIB_REV_SHIFT);
+}
+
+bool
+ai_iscoreup(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+
+	ai = sii->curwrap;
+
+	return (((R_REG(sii->osh, &ai->ioctrl) & (SICF_FGC | SICF_CLOCK_EN)) == SICF_CLOCK_EN) &&
+	        ((R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET) == 0));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fiddling with interrupts or core switches is needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+	uint origidx = 0;
+	uint32 *r = NULL;
+	uint w;
+	uint intr_val = 0;
+	bool fast = FALSE;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+
+	ASSERT(GOODIDX(coreidx));
+	ASSERT(regoff < SI_CORE_SIZE);
+	ASSERT((val & ~mask) == 0);
+
+	if (coreidx >= SI_MAXCORES)
+		return 0;
+
+	if (BUSTYPE(sih->bustype) == SI_BUS) {
+		/* If internal bus, we can always get at everything */
+		fast = TRUE;
+		/* map if does not exist */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+			                            SI_CORE_SIZE);
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+	} else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+		/* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+		if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+			/* Chipc registers are mapped at 12KB */
+
+			fast = TRUE;
+			r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+		} else if (sii->pub.buscoreidx == coreidx) {
+			/* pci registers are at either in the last 2KB of an 8KB window
+			 * or, in pcie and pci rev 13 at 8KB
+			 */
+			fast = TRUE;
+			if (SI_FAST(sii))
+				r = (uint32 *)((char *)sii->curmap +
+				               PCI_16KB0_PCIREGS_OFFSET + regoff);
+			else
+				r = (uint32 *)((char *)sii->curmap +
+				               ((regoff >= SBCONFIGOFF) ?
+				                PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+				               regoff);
+		}
+	}
+
+	if (!fast) {
+		INTR_OFF(sii, intr_val);
+
+		/* save current core index */
+		origidx = si_coreidx(&sii->pub);
+
+		/* switch core */
+		r = (uint32*) ((uchar*) ai_setcoreidx(&sii->pub, coreidx) + regoff);
+	}
+	ASSERT(r != NULL);
+
+	/* mask and set */
+	if (mask || val) {
+		w = (R_REG(sii->osh, r) & ~mask) | val;
+		W_REG(sii->osh, r, w);
+	}
+
+	/* readback */
+	w = R_REG(sii->osh, r);
+
+	if (!fast) {
+		/* restore core index */
+		if (origidx != coreidx)
+			ai_setcoreidx(&sii->pub, origidx);
+
+		INTR_RESTORE(sii, intr_val);
+	}
+
+	return (w);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+uint32 *
+ai_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+	uint32 *r = NULL;
+	bool fast = FALSE;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+
+	ASSERT(GOODIDX(coreidx));
+	ASSERT(regoff < SI_CORE_SIZE);
+
+	if (coreidx >= SI_MAXCORES)
+		return 0;
+
+	if (BUSTYPE(sih->bustype) == SI_BUS) {
+		/* If internal bus, we can always get at everything */
+		fast = TRUE;
+		/* map if does not exist */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+			                            SI_CORE_SIZE);
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+	} else if (BUSTYPE(sih->bustype) == PCI_BUS) {
+		/* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+		if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+			/* Chipc registers are mapped at 12KB */
+
+			fast = TRUE;
+			r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+		} else if (sii->pub.buscoreidx == coreidx) {
+			/* pci registers are at either in the last 2KB of an 8KB window
+			 * or, in pcie and pci rev 13 at 8KB
+			 */
+			fast = TRUE;
+			if (SI_FAST(sii))
+				r = (uint32 *)((char *)sii->curmap +
+				               PCI_16KB0_PCIREGS_OFFSET + regoff);
+			else
+				r = (uint32 *)((char *)sii->curmap +
+				               ((regoff >= SBCONFIGOFF) ?
+				                PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+				               regoff);
+		}
+	}
+
+	if (!fast)
+		return 0;
+
+	return (r);
+}
+
+void
+ai_core_disable(si_t *sih, uint32 bits)
+{
+	si_info_t *sii = SI_INFO(sih);
+	volatile uint32 dummy;
+	uint32 status;
+	aidmp_t *ai;
+
+
+	ASSERT(GOODREGS(sii->curwrap));
+	ai = sii->curwrap;
+
+	/* if core is already in reset, just return */
+	if (R_REG(sii->osh, &ai->resetctrl) & AIRC_RESET)
+		return;
+
+	/* ensure there are no pending backplane operations */
+	SPINWAIT(((status = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+	/* if pending backplane ops still, try waiting longer */
+	if (status != 0) {
+		/* 300usecs was sufficient to allow backplane ops to clear for big hammer */
+		/* during driver load we may need more time */
+		SPINWAIT(((status = R_REG(sii->osh, &ai->resetstatus)) != 0), 10000);
+		/* if still pending ops, continue on and try disable anyway */
+		/* this is in big hammer path, so don't call wl_reinit in this case... */
+	}
+
+	W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+	dummy = R_REG(sii->osh, &ai->resetctrl);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(1);
+
+	W_REG(sii->osh, &ai->ioctrl, bits);
+	dummy = R_REG(sii->osh, &ai->ioctrl);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(10);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+void
+ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+	volatile uint32 dummy;
+	uint loop_counter = 10;
+
+	ASSERT(GOODREGS(sii->curwrap));
+	ai = sii->curwrap;
+
+	/* ensure there are no pending backplane operations */
+	SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+
+	/* put core into reset state */
+	W_REG(sii->osh, &ai->resetctrl, AIRC_RESET);
+	OSL_DELAY(10);
+
+	/* ensure there are no pending backplane operations */
+	SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+
+	W_REG(sii->osh, &ai->ioctrl, (bits | resetbits | SICF_FGC | SICF_CLOCK_EN));
+	dummy = R_REG(sii->osh, &ai->ioctrl);
+	BCM_REFERENCE(dummy);
+
+	/* ensure there are no pending backplane operations */
+	SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+
+	while (R_REG(sii->osh, &ai->resetctrl) != 0 && --loop_counter != 0) {
+		/* ensure there are no pending backplane operations */
+		SPINWAIT(((dummy = R_REG(sii->osh, &ai->resetstatus)) != 0), 300);
+
+
+		/* take core out of reset */
+		W_REG(sii->osh, &ai->resetctrl, 0);
+
+		/* ensure there are no pending backplane operations */
+		SPINWAIT((R_REG(sii->osh, &ai->resetstatus) != 0), 300);
+	}
+
+
+	W_REG(sii->osh, &ai->ioctrl, (bits | SICF_CLOCK_EN));
+	dummy = R_REG(sii->osh, &ai->ioctrl);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(1);
+}
+
+void
+ai_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+	uint32 w;
+
+
+	if (BCM47162_DMP()) {
+		SI_ERROR(("%s: Accessing MIPS DMP register (ioctrl) on 47162a0",
+		          __FUNCTION__));
+		return;
+	}
+	if (BCM5357_DMP()) {
+		SI_ERROR(("%s: Accessing USB20H DMP register (ioctrl) on 5357\n",
+		          __FUNCTION__));
+		return;
+	}
+	if (BCM4707_DMP()) {
+		SI_ERROR(("%s: Accessing CHIPCOMMONB DMP register (ioctrl) on 4707\n",
+			__FUNCTION__));
+		return;
+	}
+	if (PMU_DMP()) {
+		SI_ERROR(("%s: Accessing PMU DMP register (ioctrl)\n",
+			__FUNCTION__));
+		return;
+	}
+
+	ASSERT(GOODREGS(sii->curwrap));
+	ai = sii->curwrap;
+
+	ASSERT((val & ~mask) == 0);
+
+	if (mask || val) {
+		w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+		W_REG(sii->osh, &ai->ioctrl, w);
+	}
+}
+
+uint32
+ai_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+	uint32 w;
+
+	if (BCM47162_DMP()) {
+		SI_ERROR(("%s: Accessing MIPS DMP register (ioctrl) on 47162a0",
+		          __FUNCTION__));
+		return 0;
+	}
+	if (BCM5357_DMP()) {
+		SI_ERROR(("%s: Accessing USB20H DMP register (ioctrl) on 5357\n",
+		          __FUNCTION__));
+		return 0;
+	}
+	if (BCM4707_DMP()) {
+		SI_ERROR(("%s: Accessing CHIPCOMMONB DMP register (ioctrl) on 4707\n",
+			__FUNCTION__));
+		return 0;
+	}
+
+	if (PMU_DMP()) {
+		SI_ERROR(("%s: Accessing PMU DMP register (ioctrl)\n",
+			__FUNCTION__));
+		return 0;
+	}
+	ASSERT(GOODREGS(sii->curwrap));
+	ai = sii->curwrap;
+
+	ASSERT((val & ~mask) == 0);
+
+	if (mask || val) {
+		w = ((R_REG(sii->osh, &ai->ioctrl) & ~mask) | val);
+		W_REG(sii->osh, &ai->ioctrl, w);
+	}
+
+	return R_REG(sii->osh, &ai->ioctrl);
+}
+
+uint32
+ai_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii = SI_INFO(sih);
+	aidmp_t *ai;
+	uint32 w;
+
+	if (BCM47162_DMP()) {
+		SI_ERROR(("%s: Accessing MIPS DMP register (iostatus) on 47162a0",
+		          __FUNCTION__));
+		return 0;
+	}
+	if (BCM5357_DMP()) {
+		SI_ERROR(("%s: Accessing USB20H DMP register (iostatus) on 5357\n",
+		          __FUNCTION__));
+		return 0;
+	}
+	if (BCM4707_DMP()) {
+		SI_ERROR(("%s: Accessing CHIPCOMMONB DMP register (ioctrl) on 4707\n",
+			__FUNCTION__));
+		return 0;
+	}
+	if (PMU_DMP()) {
+		SI_ERROR(("%s: Accessing PMU DMP register (ioctrl)\n",
+			__FUNCTION__));
+		return 0;
+	}
+
+	ASSERT(GOODREGS(sii->curwrap));
+	ai = sii->curwrap;
+
+	ASSERT((val & ~mask) == 0);
+	ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+	if (mask || val) {
+		w = ((R_REG(sii->osh, &ai->iostatus) & ~mask) | val);
+		W_REG(sii->osh, &ai->iostatus, w);
+	}
+
+	return R_REG(sii->osh, &ai->iostatus);
+}
+
+#if defined(BCMDBG_PHYDUMP)
+/* print interesting aidmp registers */
+void
+ai_dumpregs(si_t *sih, struct bcmstrbuf *b)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	osl_t *osh;
+	aidmp_t *ai;
+	uint i;
+
+	osh = sii->osh;
+
+	for (i = 0; i < sii->numcores; i++) {
+		si_setcoreidx(&sii->pub, i);
+		ai = sii->curwrap;
+
+		bcm_bprintf(b, "core 0x%x: \n", cores_info->coreid[i]);
+		if (BCM47162_DMP()) {
+			bcm_bprintf(b, "Skipping mips74k in 47162a0\n");
+			continue;
+		}
+		if (BCM5357_DMP()) {
+			bcm_bprintf(b, "Skipping usb20h in 5357\n");
+			continue;
+		}
+		if (BCM4707_DMP()) {
+			bcm_bprintf(b, "Skipping chipcommonb in 4707\n");
+			continue;
+		}
+
+		if (PMU_DMP()) {
+			bcm_bprintf(b, "Skipping pmu core\n");
+			continue;
+		}
+
+		bcm_bprintf(b, "ioctrlset 0x%x ioctrlclear 0x%x ioctrl 0x%x iostatus 0x%x"
+			    "ioctrlwidth 0x%x iostatuswidth 0x%x\n"
+			    "resetctrl 0x%x resetstatus 0x%x resetreadid 0x%x resetwriteid 0x%x\n"
+			    "errlogctrl 0x%x errlogdone 0x%x errlogstatus 0x%x"
+			    "errlogaddrlo 0x%x errlogaddrhi 0x%x\n"
+			    "errlogid 0x%x errloguser 0x%x errlogflags 0x%x\n"
+			    "intstatus 0x%x config 0x%x itcr 0x%x\n",
+			    R_REG(osh, &ai->ioctrlset),
+			    R_REG(osh, &ai->ioctrlclear),
+			    R_REG(osh, &ai->ioctrl),
+			    R_REG(osh, &ai->iostatus),
+			    R_REG(osh, &ai->ioctrlwidth),
+			    R_REG(osh, &ai->iostatuswidth),
+			    R_REG(osh, &ai->resetctrl),
+			    R_REG(osh, &ai->resetstatus),
+			    R_REG(osh, &ai->resetreadid),
+			    R_REG(osh, &ai->resetwriteid),
+			    R_REG(osh, &ai->errlogctrl),
+			    R_REG(osh, &ai->errlogdone),
+			    R_REG(osh, &ai->errlogstatus),
+			    R_REG(osh, &ai->errlogaddrlo),
+			    R_REG(osh, &ai->errlogaddrhi),
+			    R_REG(osh, &ai->errlogid),
+			    R_REG(osh, &ai->errloguser),
+			    R_REG(osh, &ai->errlogflags),
+			    R_REG(osh, &ai->intstatus),
+			    R_REG(osh, &ai->config),
+			    R_REG(osh, &ai->itcr));
+	}
+}
+#endif
diff -ENwbur a/drivers/net/wireless/bcm4336/ap621x.h b/drivers/net/wireless/bcm4336/ap621x.h
--- a/drivers/net/wireless/bcm4336/ap621x.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/ap621x.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (C) 2015 FriendlyARM (www.arm9.net)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifndef __AP621X_H__
+#define __AP621X_H__
+
+#if defined(CONFIG_MACH_MINI2451)
+#include <linux/gpio.h>
+
+#include <plat/gpio-cfg.h>
+#include <plat/sdhci.h>
+#include <plat/devs.h>
+#include <mach/regs-gpio.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+#include <mach/gpio-samsung.h>
+#else
+#include <mach/gpio.h>
+#endif
+
+#include <mach/board-wlan.h>
+
+#define sdmmc_channel	s3c_device_hsmmc0
+extern void mmc_force_presence_change_onoff(struct platform_device *pdev, int val);
+
+static inline void ap621x_wifi_init(void)
+{
+	// wifi power
+#ifdef GPIO_WLAN_EN
+	if (gpio_request(GPIO_WLAN_EN, "GPIO_WLAN_EN")) {
+		printk(KERN_ERR"failed to request GPIO_WLAN_EN\n");
+	}
+	gpio_direction_output(GPIO_WLAN_EN, 1);
+#endif
+
+	// wifi int
+	if (gpio_request(brcm_gpio_host_wake(), "GPIO_WLAN_HOST_WAKE")) {
+		printk(KERN_ERR"failed to request GPIO_WLAN_HOST_WAKE\n");
+	}
+}
+
+#elif defined(CONFIG_ARCH_S5P6818)
+#include <linux/platform_device.h>
+
+#define SRCBASE		"drivers/net/wireless/bcm4336"
+
+extern int force_presence_change(struct platform_device *dev, int state);
+extern int get_host_wake_irq(void);
+extern int wifi_pm_gpio_ctrl(char *name, int level);
+
+static inline void ap621x_wifi_init(void) {
+	// nothing here yet
+}
+
+#else
+
+/* Stubs */
+#define mmc_force_presence_change_onoff(pdev, val)	\
+	do { } while (0)
+
+#endif /* CONFIG_MACH_MINI2451 */
+
+#endif /* __AP621X_H__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmevent.c b/drivers/net/wireless/bcm4336/bcmevent.c
--- a/drivers/net/wireless/bcm4336/bcmevent.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmevent.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,185 @@
+/*
+ * bcmevent read-only data shared by kernel or app layers
+ *
+ * $Copyright Open Broadcom Corporation$
+ * $Id: bcmevent.c 492377 2014-07-21 19:54:06Z $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <proto/ethernet.h>
+#include <proto/bcmeth.h>
+#include <proto/bcmevent.h>
+
+
+/* Table of event name strings for UIs and debugging dumps */
+typedef struct {
+	uint event;
+	const char *name;
+} bcmevent_name_str_t;
+
+/* Use the actual name for event tracing */
+#define BCMEVENT_NAME(_event) {(_event), #_event}
+
+static const bcmevent_name_str_t bcmevent_names[] = {
+	BCMEVENT_NAME(WLC_E_SET_SSID),
+	BCMEVENT_NAME(WLC_E_JOIN),
+	BCMEVENT_NAME(WLC_E_START),
+	BCMEVENT_NAME(WLC_E_AUTH),
+	BCMEVENT_NAME(WLC_E_AUTH_IND),
+	BCMEVENT_NAME(WLC_E_DEAUTH),
+	BCMEVENT_NAME(WLC_E_DEAUTH_IND),
+	BCMEVENT_NAME(WLC_E_ASSOC),
+	BCMEVENT_NAME(WLC_E_ASSOC_IND),
+	BCMEVENT_NAME(WLC_E_REASSOC),
+	BCMEVENT_NAME(WLC_E_REASSOC_IND),
+	BCMEVENT_NAME(WLC_E_DISASSOC),
+	BCMEVENT_NAME(WLC_E_DISASSOC_IND),
+	BCMEVENT_NAME(WLC_E_QUIET_START),
+	BCMEVENT_NAME(WLC_E_QUIET_END),
+	BCMEVENT_NAME(WLC_E_BEACON_RX),
+	BCMEVENT_NAME(WLC_E_LINK),
+	BCMEVENT_NAME(WLC_E_MIC_ERROR),
+	BCMEVENT_NAME(WLC_E_NDIS_LINK),
+	BCMEVENT_NAME(WLC_E_ROAM),
+	BCMEVENT_NAME(WLC_E_TXFAIL),
+	BCMEVENT_NAME(WLC_E_PMKID_CACHE),
+	BCMEVENT_NAME(WLC_E_RETROGRADE_TSF),
+	BCMEVENT_NAME(WLC_E_PRUNE),
+	BCMEVENT_NAME(WLC_E_AUTOAUTH),
+	BCMEVENT_NAME(WLC_E_EAPOL_MSG),
+	BCMEVENT_NAME(WLC_E_SCAN_COMPLETE),
+	BCMEVENT_NAME(WLC_E_ADDTS_IND),
+	BCMEVENT_NAME(WLC_E_DELTS_IND),
+	BCMEVENT_NAME(WLC_E_BCNSENT_IND),
+	BCMEVENT_NAME(WLC_E_BCNRX_MSG),
+	BCMEVENT_NAME(WLC_E_BCNLOST_MSG),
+	BCMEVENT_NAME(WLC_E_ROAM_PREP),
+	BCMEVENT_NAME(WLC_E_PFN_NET_FOUND),
+	BCMEVENT_NAME(WLC_E_PFN_NET_LOST),
+#if defined(IBSS_PEER_DISCOVERY_EVENT)
+	BCMEVENT_NAME(WLC_E_IBSS_ASSOC),
+#endif /* defined(IBSS_PEER_DISCOVERY_EVENT) */
+	BCMEVENT_NAME(WLC_E_RADIO),
+	BCMEVENT_NAME(WLC_E_PSM_WATCHDOG),
+#if defined(BCMCCX) && defined(CCX_SDK)
+	BCMEVENT_NAME(WLC_E_CCX_ASSOC_START),
+	BCMEVENT_NAME(WLC_E_CCX_ASSOC_ABORT),
+#endif /* BCMCCX && CCX_SDK */
+	BCMEVENT_NAME(WLC_E_PROBREQ_MSG),
+	BCMEVENT_NAME(WLC_E_SCAN_CONFIRM_IND),
+	BCMEVENT_NAME(WLC_E_PSK_SUP),
+	BCMEVENT_NAME(WLC_E_COUNTRY_CODE_CHANGED),
+	BCMEVENT_NAME(WLC_E_EXCEEDED_MEDIUM_TIME),
+	BCMEVENT_NAME(WLC_E_ICV_ERROR),
+	BCMEVENT_NAME(WLC_E_UNICAST_DECODE_ERROR),
+	BCMEVENT_NAME(WLC_E_MULTICAST_DECODE_ERROR),
+	BCMEVENT_NAME(WLC_E_TRACE),
+#ifdef WLBTAMP
+	BCMEVENT_NAME(WLC_E_BTA_HCI_EVENT),
+#endif
+	BCMEVENT_NAME(WLC_E_IF),
+#ifdef WLP2P
+	BCMEVENT_NAME(WLC_E_P2P_DISC_LISTEN_COMPLETE),
+#endif
+	BCMEVENT_NAME(WLC_E_RSSI),
+	BCMEVENT_NAME(WLC_E_PFN_SCAN_COMPLETE),
+	BCMEVENT_NAME(WLC_E_EXTLOG_MSG),
+#ifdef WIFI_ACT_FRAME
+	BCMEVENT_NAME(WLC_E_ACTION_FRAME),
+	BCMEVENT_NAME(WLC_E_ACTION_FRAME_RX),
+	BCMEVENT_NAME(WLC_E_ACTION_FRAME_COMPLETE),
+#endif
+#ifdef BCMWAPI_WAI
+	BCMEVENT_NAME(WLC_E_WAI_STA_EVENT),
+	BCMEVENT_NAME(WLC_E_WAI_MSG),
+#endif /* BCMWAPI_WAI */
+	BCMEVENT_NAME(WLC_E_ESCAN_RESULT),
+	BCMEVENT_NAME(WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE),
+#ifdef WLP2P
+	BCMEVENT_NAME(WLC_E_PROBRESP_MSG),
+	BCMEVENT_NAME(WLC_E_P2P_PROBREQ_MSG),
+#endif
+#ifdef PROP_TXSTATUS
+	BCMEVENT_NAME(WLC_E_FIFO_CREDIT_MAP),
+#endif
+	BCMEVENT_NAME(WLC_E_WAKE_EVENT),
+	BCMEVENT_NAME(WLC_E_DCS_REQUEST),
+	BCMEVENT_NAME(WLC_E_RM_COMPLETE),
+#ifdef WLMEDIA_HTSF
+	BCMEVENT_NAME(WLC_E_HTSFSYNC),
+#endif
+	BCMEVENT_NAME(WLC_E_OVERLAY_REQ),
+	BCMEVENT_NAME(WLC_E_CSA_COMPLETE_IND),
+	BCMEVENT_NAME(WLC_E_EXCESS_PM_WAKE_EVENT),
+	BCMEVENT_NAME(WLC_E_PFN_SCAN_NONE),
+	BCMEVENT_NAME(WLC_E_PFN_SCAN_ALLGONE),
+#ifdef SOFTAP
+	BCMEVENT_NAME(WLC_E_GTK_PLUMBED),
+#endif
+	BCMEVENT_NAME(WLC_E_ASSOC_REQ_IE),
+	BCMEVENT_NAME(WLC_E_ASSOC_RESP_IE),
+	BCMEVENT_NAME(WLC_E_BEACON_FRAME_RX),
+#ifdef WLTDLS
+	BCMEVENT_NAME(WLC_E_TDLS_PEER_EVENT),
+#endif /* WLTDLS */
+	BCMEVENT_NAME(WLC_E_NATIVE),
+#ifdef WLPKTDLYSTAT
+	BCMEVENT_NAME(WLC_E_PKTDELAY_IND),
+#endif /* WLPKTDLYSTAT */
+	BCMEVENT_NAME(WLC_E_SERVICE_FOUND),
+	BCMEVENT_NAME(WLC_E_GAS_FRAGMENT_RX),
+	BCMEVENT_NAME(WLC_E_GAS_COMPLETE),
+	BCMEVENT_NAME(WLC_E_P2PO_ADD_DEVICE),
+	BCMEVENT_NAME(WLC_E_P2PO_DEL_DEVICE),
+#ifdef WLWNM
+	BCMEVENT_NAME(WLC_E_WNM_STA_SLEEP),
+#endif /* WLWNM */
+#if defined(WL_PROXDETECT)
+	BCMEVENT_NAME(WLC_E_PROXD),
+#endif
+	BCMEVENT_NAME(WLC_E_CCA_CHAN_QUAL),
+	BCMEVENT_NAME(WLC_E_BSSID),
+#ifdef PROP_TXSTATUS
+	BCMEVENT_NAME(WLC_E_BCMC_CREDIT_SUPPORT),
+#endif
+	BCMEVENT_NAME(WLC_E_TXFAIL_THRESH),
+#ifdef WLAIBSS
+	BCMEVENT_NAME(WLC_E_AIBSS_TXFAIL),
+#endif /* WLAIBSS */
+#ifdef WLBSSLOAD_REPORT
+	BCMEVENT_NAME(WLC_E_BSS_LOAD),
+#endif
+#if defined(BT_WIFI_HANDOVER) || defined(WL_TBOW)
+	BCMEVENT_NAME(WLC_E_BT_WIFI_HANDOVER_REQ),
+#endif
+#ifdef WLFBT
+	BCMEVENT_NAME(WLC_E_FBT_AUTH_REQ_IND),
+#endif /* WLFBT */
+	BCMEVENT_NAME(WLC_E_RMC_EVENT),
+};
+
+
+const char *bcmevent_get_name(uint event_type)
+{
+	/* note:  first coded this as a static const but some
+	 * ROMs already have something called event_name so
+	 * changed it so we don't have a variable for the
+	 * 'unknown string
+	 */
+	const char *event_name = NULL;
+
+	uint idx;
+	for (idx = 0; idx < (uint)ARRAYSIZE(bcmevent_names); idx++) {
+
+		if (bcmevent_names[idx].event == event_type) {
+			event_name = bcmevent_names[idx].name;
+			break;
+		}
+	}
+
+	/* if we find an event name in the array, return it.
+	 * otherwise return unknown string.
+	 */
+	return ((event_name) ? event_name : "Unknown Event");
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmsdh.c b/drivers/net/wireless/bcm4336/bcmsdh.c
--- a/drivers/net/wireless/bcm4336/bcmsdh.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmsdh.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,698 @@
+/*
+ *  BCMSDH interface glue
+ *  implement bcmsdh API for SDIOH driver
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: bcmsdh.c 450676 2014-01-22 22:45:13Z $
+ */
+
+/**
+ * @file bcmsdh.c
+ */
+
+/* ****************** BCMSDH Interface Functions *************************** */
+
+#include <typedefs.h>
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <hndsoc.h>
+#include <siutils.h>
+#include <osl.h>
+
+#include <bcmsdh.h>	/* BRCM API for SDIO clients (such as wl, dhd) */
+#include <bcmsdbus.h>	/* common SDIO/controller interface */
+#include <sbsdio.h>	/* SDIO device core hardware definitions. */
+#include <sdio.h>	/* SDIO Device and Protocol Specs */
+
+#define SDIOH_API_ACCESS_RETRY_LIMIT	2
+const uint bcmsdh_msglevel = BCMSDH_ERROR_VAL;
+
+/* local copy of bcm sd handler */
+bcmsdh_info_t * l_bcmsdh = NULL;
+
+#if 0 && (NDISVER < 0x0630)
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+#endif
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+extern int
+sdioh_enable_hw_oob_intr(void *sdioh, bool enable);
+
+void
+bcmsdh_enable_hw_oob_intr(bcmsdh_info_t *sdh, bool enable)
+{
+	sdioh_enable_hw_oob_intr(sdh->sdioh, enable);
+}
+#endif
+
+/* Attach BCMSDH layer to SDIO Host Controller Driver
+ *
+ * @param osh OSL Handle.
+ * @param cfghdl Configuration Handle.
+ * @param regsva Virtual address of controller registers.
+ * @param irq Interrupt number of SDIO controller.
+ *
+ * @return bcmsdh_info_t Handle to BCMSDH context.
+ */
+bcmsdh_info_t *
+bcmsdh_attach(osl_t *osh, void *sdioh, ulong *regsva)
+{
+	bcmsdh_info_t *bcmsdh;
+
+	if ((bcmsdh = (bcmsdh_info_t *)MALLOC(osh, sizeof(bcmsdh_info_t))) == NULL) {
+		BCMSDH_ERROR(("bcmsdh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+		return NULL;
+	}
+	bzero((char *)bcmsdh, sizeof(bcmsdh_info_t));
+	bcmsdh->sdioh = sdioh;
+	bcmsdh->osh = osh;
+	bcmsdh->init_success = TRUE;
+	*regsva = SI_ENUM_BASE;
+
+	/* Report the BAR, to fix if needed */
+	bcmsdh->sbwad = SI_ENUM_BASE;
+
+	/* save the handler locally */
+	l_bcmsdh = bcmsdh;
+
+	return bcmsdh;
+}
+
+int
+bcmsdh_detach(osl_t *osh, void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	if (bcmsdh != NULL) {
+#if 0 && (NDISVER < 0x0630)
+		if (bcmsdh->sdioh)
+			sdioh_detach(osh, bcmsdh->sdioh);
+#endif
+		MFREE(osh, bcmsdh, sizeof(bcmsdh_info_t));
+	}
+
+	l_bcmsdh = NULL;
+
+	return 0;
+}
+
+int
+bcmsdh_iovar_op(void *sdh, const char *name,
+                void *params, int plen, void *arg, int len, bool set)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	return sdioh_iovar_op(bcmsdh->sdioh, name, params, plen, arg, len, set);
+}
+
+bool
+bcmsdh_intr_query(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	bool on;
+
+	ASSERT(bcmsdh);
+	status = sdioh_interrupt_query(bcmsdh->sdioh, &on);
+	if (SDIOH_API_SUCCESS(status))
+		return FALSE;
+	else
+		return on;
+}
+
+int
+bcmsdh_intr_enable(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	ASSERT(bcmsdh);
+
+	status = sdioh_interrupt_set(bcmsdh->sdioh, TRUE);
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_disable(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	ASSERT(bcmsdh);
+
+	status = sdioh_interrupt_set(bcmsdh->sdioh, FALSE);
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	ASSERT(bcmsdh);
+
+	status = sdioh_interrupt_register(bcmsdh->sdioh, fn, argh);
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_intr_dereg(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	ASSERT(bcmsdh);
+
+	status = sdioh_interrupt_deregister(bcmsdh->sdioh);
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+#if defined(DHD_DEBUG)
+bool
+bcmsdh_intr_pending(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	ASSERT(sdh);
+	return sdioh_interrupt_pending(bcmsdh->sdioh);
+}
+#endif
+
+
+int
+bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh)
+{
+	ASSERT(sdh);
+
+	/* don't support yet */
+	return BCME_UNSUPPORTED;
+}
+
+/**
+ * Read from SDIO Configuration Space
+ * @param sdh SDIO Host context.
+ * @param func_num Function number to read from.
+ * @param addr Address to read from.
+ * @param err Error return.
+ * @return value read from SDIO configuration space.
+ */
+uint8
+bcmsdh_cfg_read(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+	int32 retry = 0;
+#endif
+	uint8 data = 0;
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+	do {
+		if (retry)	/* wait for 1 ms till bus get settled down */
+			OSL_DELAY(1000);
+#endif
+	status = sdioh_cfg_read(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+	} while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+	if (err)
+		*err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+	BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+	            fnc_num, addr, data));
+
+	return data;
+}
+
+void
+bcmsdh_cfg_write(void *sdh, uint fnc_num, uint32 addr, uint8 data, int *err)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+	int32 retry = 0;
+#endif
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+	do {
+		if (retry)	/* wait for 1 ms till bus get settled down */
+			OSL_DELAY(1000);
+#endif
+	status = sdioh_cfg_write(bcmsdh->sdioh, fnc_num, addr, (uint8 *)&data);
+#ifdef SDIOH_API_ACCESS_RETRY_LIMIT
+	} while (!SDIOH_API_SUCCESS(status) && (retry++ < SDIOH_API_ACCESS_RETRY_LIMIT));
+#endif
+	if (err)
+		*err = SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR;
+
+	BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint8data = 0x%x\n", __FUNCTION__,
+	            fnc_num, addr, data));
+}
+
+uint32
+bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	uint32 data = 0;
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+
+	status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_READ, fnc_num,
+	                            addr, &data, 4);
+
+	if (err)
+		*err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+	BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__,
+	            fnc_num, addr, data));
+
+	return data;
+}
+
+void
+bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+
+	status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, fnc_num,
+	                            addr, &data, 4);
+
+	if (err)
+		*err = (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+
+	BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, uint32data = 0x%x\n", __FUNCTION__, fnc_num,
+	             addr, data));
+}
+
+
+int
+bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+
+	uint8 *tmp_buf, *tmp_ptr;
+	uint8 *ptr;
+	bool ascii = func & ~0xf;
+	func &= 0x7;
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+	ASSERT(cis);
+	ASSERT(length <= SBSDIO_CIS_SIZE_LIMIT);
+
+	status = sdioh_cis_read(bcmsdh->sdioh, func, cis, length);
+
+	if (ascii) {
+		/* Move binary bits to tmp and format them into the provided buffer. */
+		if ((tmp_buf = (uint8 *)MALLOC(bcmsdh->osh, length)) == NULL) {
+			BCMSDH_ERROR(("%s: out of memory\n", __FUNCTION__));
+			return BCME_NOMEM;
+		}
+		bcopy(cis, tmp_buf, length);
+		for (tmp_ptr = tmp_buf, ptr = cis; ptr < (cis + length - 4); tmp_ptr++) {
+			ptr += snprintf((char*)ptr, (cis + length - ptr - 4),
+				"%.2x ", *tmp_ptr & 0xff);
+			if ((((tmp_ptr - tmp_buf) + 1) & 0xf) == 0)
+				ptr += snprintf((char *)ptr, (cis + length - ptr -4), "\n");
+		}
+		MFREE(bcmsdh->osh, tmp_buf, length);
+	}
+
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+
+int
+bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set)
+{
+	int err = 0;
+	uint bar0 = address & ~SBSDIO_SB_OFT_ADDR_MASK;
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	if (bar0 != bcmsdh->sbwad || force_set) {
+		bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+			(address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+		if (!err)
+			bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+				(address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+		if (!err)
+			bcmsdh_cfg_write(bcmsdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+				(address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+
+		if (!err)
+			bcmsdh->sbwad = bar0;
+		else
+			/* invalidate cached window var */
+			bcmsdh->sbwad = 0;
+
+	}
+
+	return err;
+}
+
+uint32
+bcmsdh_reg_read(void *sdh, uint32 addr, uint size)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	uint32 word = 0;
+
+	BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, ", __FUNCTION__, addr));
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+
+	if (bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)) {
+		bcmsdh->regfail = TRUE; // terence 20130621: prevent dhd_dpc in dead lock
+		return 0xFFFFFFFF;
+	}
+
+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+	if (size == 4)
+		addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+	status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL,
+		SDIOH_READ, SDIO_FUNC_1, addr, &word, size);
+
+	bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+	BCMSDH_INFO(("uint32data = 0x%x\n", word));
+
+	/* if ok, return appropriately masked word */
+	if (SDIOH_API_SUCCESS(status)) {
+		switch (size) {
+			case sizeof(uint8):
+				return (word & 0xff);
+			case sizeof(uint16):
+				return (word & 0xffff);
+			case sizeof(uint32):
+				return word;
+			default:
+				bcmsdh->regfail = TRUE;
+
+		}
+	}
+
+	/* otherwise, bad sdio access or invalid size */
+	BCMSDH_ERROR(("%s: error reading addr 0x%04x size %d\n", __FUNCTION__, addr, size));
+	return 0xFFFFFFFF;
+}
+
+uint32
+bcmsdh_reg_write(void *sdh, uint32 addr, uint size, uint32 data)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	int err = 0;
+
+	BCMSDH_INFO(("%s:fun = 1, addr = 0x%x, uint%ddata = 0x%x\n",
+	             __FUNCTION__, addr, size*8, data));
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	ASSERT(bcmsdh->init_success);
+
+	if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE))) {
+		bcmsdh->regfail = TRUE; // terence 20130621:
+		return err;
+	}
+
+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+	if (size == 4)
+		addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+	status = sdioh_request_word(bcmsdh->sdioh, SDIOH_CMD_TYPE_NORMAL, SDIOH_WRITE, SDIO_FUNC_1,
+	                            addr, &data, size);
+	bcmsdh->regfail = !(SDIOH_API_SUCCESS(status));
+
+	if (SDIOH_API_SUCCESS(status))
+		return 0;
+
+	BCMSDH_ERROR(("%s: error writing 0x%08x to addr 0x%04x size %d\n",
+	              __FUNCTION__, data, addr, size));
+	return 0xFFFFFFFF;
+}
+
+bool
+bcmsdh_regfail(void *sdh)
+{
+	return ((bcmsdh_info_t *)sdh)->regfail;
+}
+
+int
+bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	uint incr_fix;
+	uint width;
+	int err = 0;
+
+	ASSERT(bcmsdh);
+	ASSERT(bcmsdh->init_success);
+
+	BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+	             __FUNCTION__, fn, addr, nbytes));
+
+	/* Async not implemented yet */
+	ASSERT(!(flags & SDIO_REQ_ASYNC));
+	if (flags & SDIO_REQ_ASYNC)
+		return BCME_UNSUPPORTED;
+
+	if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+		return err;
+
+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+	incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+	width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+	if (width == 4)
+		addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+	status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+	                              SDIOH_READ, fn, addr, width, nbytes, buf, pkt);
+
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_SDIO_ERROR);
+}
+
+int
+bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                uint8 *buf, uint nbytes, void *pkt,
+                bcmsdh_cmplt_fn_t complete_fn, void *handle)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+	uint incr_fix;
+	uint width;
+	int err = 0;
+
+	ASSERT(bcmsdh);
+	ASSERT(bcmsdh->init_success);
+
+	BCMSDH_INFO(("%s:fun = %d, addr = 0x%x, size = %d\n",
+	            __FUNCTION__, fn, addr, nbytes));
+
+	/* Async not implemented yet */
+	ASSERT(!(flags & SDIO_REQ_ASYNC));
+	if (flags & SDIO_REQ_ASYNC)
+		return BCME_UNSUPPORTED;
+
+	if ((err = bcmsdhsdio_set_sbaddr_window(bcmsdh, addr, FALSE)))
+		return err;
+
+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+
+	incr_fix = (flags & SDIO_REQ_FIXED) ? SDIOH_DATA_FIX : SDIOH_DATA_INC;
+	width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
+	if (width == 4)
+		addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+	status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, incr_fix,
+	                              SDIOH_WRITE, fn, addr, width, nbytes, buf, pkt);
+
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	SDIOH_API_RC status;
+
+	ASSERT(bcmsdh);
+	ASSERT(bcmsdh->init_success);
+	ASSERT((addr & SBSDIO_SBWINDOW_MASK) == 0);
+
+	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+
+	status = sdioh_request_buffer(bcmsdh->sdioh, SDIOH_DATA_PIO, SDIOH_DATA_INC,
+	                              (rw ? SDIOH_WRITE : SDIOH_READ), SDIO_FUNC_1,
+	                              addr, 4, nbytes, buf, NULL);
+
+	return (SDIOH_API_SUCCESS(status) ? 0 : BCME_ERROR);
+}
+
+int
+bcmsdh_abort(void *sdh, uint fn)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	return sdioh_abort(bcmsdh->sdioh, fn);
+}
+
+int
+bcmsdh_start(void *sdh, int stage)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	return sdioh_start(bcmsdh->sdioh, stage);
+}
+
+int
+bcmsdh_stop(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	return sdioh_stop(bcmsdh->sdioh);
+}
+
+int
+bcmsdh_waitlockfree(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	return sdioh_waitlockfree(bcmsdh->sdioh);
+}
+
+
+int
+bcmsdh_query_device(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+	bcmsdh->vendevid = (VENDOR_BROADCOM << 16) | 0;
+	return (bcmsdh->vendevid);
+}
+
+uint
+bcmsdh_query_iofnum(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	return (sdioh_query_iofnum(bcmsdh->sdioh));
+}
+
+int
+bcmsdh_reset(bcmsdh_info_t *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	return sdioh_sdio_reset(bcmsdh->sdioh);
+}
+
+void *bcmsdh_get_sdioh(bcmsdh_info_t *sdh)
+{
+	ASSERT(sdh);
+	return sdh->sdioh;
+}
+
+/* Function to pass device-status bits to DHD. */
+uint32
+bcmsdh_get_dstatus(void *sdh)
+{
+	return 0;
+}
+uint32
+bcmsdh_cur_sbwad(void *sdh)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)sdh;
+
+	if (!bcmsdh)
+		bcmsdh = l_bcmsdh;
+
+	return (bcmsdh->sbwad);
+}
+
+void
+bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev)
+{
+	return;
+}
+
+
+int
+bcmsdh_sleep(void *sdh, bool enab)
+{
+#ifdef SDIOH_SLEEP_ENABLED
+	bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+	sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+	return sdioh_sleep(sd, enab);
+#else
+	return BCME_UNSUPPORTED;
+#endif
+}
+
+int
+bcmsdh_gpio_init(void *sdh)
+{
+	bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+	sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+	return sdioh_gpio_init(sd);
+}
+
+bool
+bcmsdh_gpioin(void *sdh, uint32 gpio)
+{
+	bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+	sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+	return sdioh_gpioin(sd, gpio);
+}
+
+int
+bcmsdh_gpioouten(void *sdh, uint32 gpio)
+{
+	bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+	sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+	return sdioh_gpioouten(sd, gpio);
+}
+
+int
+bcmsdh_gpioout(void *sdh, uint32 gpio, bool enab)
+{
+	bcmsdh_info_t *p = (bcmsdh_info_t *)sdh;
+	sdioh_info_t *sd = (sdioh_info_t *)(p->sdioh);
+
+	return sdioh_gpioout(sd, gpio, enab);
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmsdh_linux.c b/drivers/net/wireless/bcm4336/bcmsdh_linux.c
--- a/drivers/net/wireless/bcm4336/bcmsdh_linux.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmsdh_linux.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,463 @@
+/*
+ * SDIO access interface for drivers - linux specific (pci only)
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmsdh_linux.c 461444 2014-03-12 02:55:28Z $
+ */
+
+/**
+ * @file bcmsdh_linux.c
+ */
+
+#define __UNDEF_NO_VERSION__
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <linux/pci.h>
+#include <linux/completion.h>
+
+#include <osl.h>
+#include <pcicfg.h>
+#include <bcmdefs.h>
+#include <bcmdevs.h>
+#include <linux/irq.h>
+extern void dhdsdio_isr(void * args);
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#if defined(CONFIG_ARCH_ODIN)
+#include <linux/platform_data/gpio-odin.h>
+#endif /* defined(CONFIG_ARCH_ODIN) */
+#include <dhd_linux.h>
+
+/* driver info, initialized when bcmsdh_register is called */
+static bcmsdh_driver_t drvinfo = {NULL, NULL, NULL, NULL};
+
+typedef enum {
+	DHD_INTR_INVALID = 0,
+	DHD_INTR_INBAND,
+	DHD_INTR_HWOOB,
+	DHD_INTR_SWOOB
+} DHD_HOST_INTR_TYPE;
+
+/* the BCMSDH module comprises the generic part (bcmsdh.c) and OS specific layer (e.g.
+ * bcmsdh_linux.c). Put all OS specific variables (e.g. irq number and flags) here rather
+ * than in the common structure bcmsdh_info. bcmsdh_info only keeps a handle (os_ctx) to this
+ * structure.
+ */
+typedef struct bcmsdh_os_info {
+	DHD_HOST_INTR_TYPE	intr_type;
+	int			oob_irq_num;	/* valid when hardware or software oob in use */
+	unsigned long		oob_irq_flags;	/* valid when hardware or software oob in use */
+	bool			oob_irq_registered;
+	bool			oob_irq_enabled;
+	bool			oob_irq_wake_enabled;
+	spinlock_t		oob_irq_spinlock;
+	bcmsdh_cb_fn_t		oob_irq_handler;
+	void			*oob_irq_handler_context;
+	void			*context;	/* context returned from upper layer */
+	void			*sdioh;		/* handle to lower layer (sdioh) */
+	void			*dev;		/* handle to the underlying device */
+	bool			dev_wake_enabled;
+} bcmsdh_os_info_t;
+
+/* debugging macros */
+#define SDLX_MSG(x) printf x
+
+/**
+ * Checks to see if vendor and device IDs match a supported SDIO Host Controller.
+ */
+bool
+bcmsdh_chipmatch(uint16 vendor, uint16 device)
+{
+	/* Add other vendors and devices as required */
+
+#ifdef BCMSDIOH_STD
+	/* Check for Arasan host controller */
+	if (vendor == VENDOR_SI_IMAGE) {
+		return (TRUE);
+	}
+	/* Check for BRCM 27XX Standard host controller */
+	if (device == BCM27XX_SDIOH_ID && vendor == VENDOR_BROADCOM) {
+		return (TRUE);
+	}
+	/* Check for BRCM Standard host controller */
+	if (device == SDIOH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+		return (TRUE);
+	}
+	/* Check for TI PCIxx21 Standard host controller */
+	if (device == PCIXX21_SDIOH_ID && vendor == VENDOR_TI) {
+		return (TRUE);
+	}
+	if (device == PCIXX21_SDIOH0_ID && vendor == VENDOR_TI) {
+		return (TRUE);
+	}
+	/* Ricoh R5C822 Standard SDIO Host */
+	if (device == R5C822_SDIOH_ID && vendor == VENDOR_RICOH) {
+		return (TRUE);
+	}
+	/* JMicron Standard SDIO Host */
+	if (device == JMICRON_SDIOH_ID && vendor == VENDOR_JMICRON) {
+		return (TRUE);
+	}
+
+#endif /* BCMSDIOH_STD */
+#ifdef BCMSDIOH_SPI
+	/* This is the PciSpiHost. */
+	if (device == SPIH_FPGA_ID && vendor == VENDOR_BROADCOM) {
+		printf("Found PCI SPI Host Controller\n");
+		return (TRUE);
+	}
+
+#endif /* BCMSDIOH_SPI */
+
+	return (FALSE);
+}
+
+void* bcmsdh_probe(osl_t *osh, void *dev, void *sdioh, void *adapter_info, uint bus_type,
+	uint bus_num, uint slot_num)
+{
+	ulong regs;
+	bcmsdh_info_t *bcmsdh;
+	uint32 vendevid;
+	bcmsdh_os_info_t *bcmsdh_osinfo = NULL;
+
+	bcmsdh = bcmsdh_attach(osh, sdioh, &regs);
+	if (bcmsdh == NULL) {
+		SDLX_MSG(("%s: bcmsdh_attach failed\n", __FUNCTION__));
+		goto err;
+	}
+	bcmsdh_osinfo = MALLOC(osh, sizeof(bcmsdh_os_info_t));
+	if (bcmsdh_osinfo == NULL) {
+		SDLX_MSG(("%s: failed to allocate bcmsdh_os_info_t\n", __FUNCTION__));
+		goto err;
+	}
+	bzero((char *)bcmsdh_osinfo, sizeof(bcmsdh_os_info_t));
+	bcmsdh->os_cxt = bcmsdh_osinfo;
+	bcmsdh_osinfo->sdioh = sdioh;
+	bcmsdh_osinfo->dev = dev;
+	osl_set_bus_handle(osh, bcmsdh);
+
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+	if (dev && device_init_wakeup(dev, true) == 0)
+		bcmsdh_osinfo->dev_wake_enabled = TRUE;
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+
+#if defined(OOB_INTR_ONLY)
+	spin_lock_init(&bcmsdh_osinfo->oob_irq_spinlock);
+	/* Get customer specific OOB IRQ parametres: IRQ number as IRQ type */
+	bcmsdh_osinfo->oob_irq_num = wifi_platform_get_irq_number(adapter_info,
+		&bcmsdh_osinfo->oob_irq_flags);
+	if  (bcmsdh_osinfo->oob_irq_num < 0) {
+		SDLX_MSG(("%s: Host OOB irq is not defined\n", __FUNCTION__));
+		goto err;
+	}
+#endif /* defined(BCMLXSDMMC) */
+
+	/* Read the vendor/device ID from the CIS */
+	vendevid = bcmsdh_query_device(bcmsdh);
+	/* try to attach to the target device */
+	bcmsdh_osinfo->context = drvinfo.probe((vendevid >> 16), (vendevid & 0xFFFF), bus_num,
+		slot_num, 0, bus_type, (void *)regs, osh, bcmsdh);
+	if (bcmsdh_osinfo->context == NULL) {
+		SDLX_MSG(("%s: device attach failed\n", __FUNCTION__));
+		goto err;
+	}
+
+	return bcmsdh;
+
+	/* error handling */
+err:
+	if (bcmsdh != NULL)
+		bcmsdh_detach(osh, bcmsdh);
+	if (bcmsdh_osinfo != NULL)
+		MFREE(osh, bcmsdh_osinfo, sizeof(bcmsdh_os_info_t));
+	return NULL;
+}
+
+int bcmsdh_remove(bcmsdh_info_t *bcmsdh)
+{
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+	if (bcmsdh_osinfo->dev)
+		device_init_wakeup(bcmsdh_osinfo->dev, false);
+	bcmsdh_osinfo->dev_wake_enabled = FALSE;
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+
+	drvinfo.remove(bcmsdh_osinfo->context);
+	MFREE(bcmsdh->osh, bcmsdh->os_cxt, sizeof(bcmsdh_os_info_t));
+	bcmsdh_detach(bcmsdh->osh, bcmsdh);
+
+	return 0;
+}
+
+int bcmsdh_suspend(bcmsdh_info_t *bcmsdh)
+{
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+	if (drvinfo.suspend && drvinfo.suspend(bcmsdh_osinfo->context))
+		return -EBUSY;
+	return 0;
+}
+
+int bcmsdh_resume(bcmsdh_info_t *bcmsdh)
+{
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+	if (drvinfo.resume)
+		return drvinfo.resume(bcmsdh_osinfo->context);
+	return 0;
+}
+
+extern int bcmsdh_register_client_driver(void);
+extern void bcmsdh_unregister_client_driver(void);
+extern int sdio_func_reg_notify(void* semaphore);
+extern void sdio_func_unreg_notify(void);
+
+#if defined(BCMLXSDMMC)
+int bcmsdh_reg_sdio_notify(void* semaphore)
+{
+	return sdio_func_reg_notify(semaphore);
+}
+
+void bcmsdh_unreg_sdio_notify(void)
+{
+	sdio_func_unreg_notify();
+}
+#endif /* defined(BCMLXSDMMC) */
+
+int
+bcmsdh_register(bcmsdh_driver_t *driver)
+{
+	int error = 0;
+
+	drvinfo = *driver;
+	SDLX_MSG(("%s: register client driver\n", __FUNCTION__));
+	error = bcmsdh_register_client_driver();
+	if (error)
+		SDLX_MSG(("%s: failed %d\n", __FUNCTION__, error));
+
+	return error;
+}
+
+void
+bcmsdh_unregister(void)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+		if (bcmsdh_pci_driver.node.next == NULL)
+			return;
+#endif
+
+	bcmsdh_unregister_client_driver();
+}
+
+void bcmsdh_dev_pm_stay_awake(bcmsdh_info_t *bcmsdh)
+{
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+	pm_stay_awake(bcmsdh_osinfo->dev);
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+}
+
+void bcmsdh_dev_relax(bcmsdh_info_t *bcmsdh)
+{
+#if !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+	pm_relax(bcmsdh_osinfo->dev);
+#endif /* !defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36)) */
+}
+
+bool bcmsdh_dev_pm_enabled(bcmsdh_info_t *bcmsdh)
+{
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+	return bcmsdh_osinfo->dev_wake_enabled;
+}
+
+#if defined(OOB_INTR_ONLY)
+void bcmsdh_oob_intr_set(bcmsdh_info_t *bcmsdh, bool enable)
+{
+	unsigned long flags;
+	bcmsdh_os_info_t *bcmsdh_osinfo;
+
+	if (!bcmsdh)
+		return;
+
+	bcmsdh_osinfo = bcmsdh->os_cxt;
+	spin_lock_irqsave(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+	if (bcmsdh_osinfo->oob_irq_enabled != enable) {
+		if (enable)
+			enable_irq(bcmsdh_osinfo->oob_irq_num);
+		else
+			disable_irq_nosync(bcmsdh_osinfo->oob_irq_num);
+		bcmsdh_osinfo->oob_irq_enabled = enable;
+	}
+	spin_unlock_irqrestore(&bcmsdh_osinfo->oob_irq_spinlock, flags);
+}
+
+static irqreturn_t wlan_oob_irq(int irq, void *dev_id)
+{
+	bcmsdh_info_t *bcmsdh = (bcmsdh_info_t *)dev_id;
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+	bcmsdh_oob_intr_set(bcmsdh, FALSE);
+	bcmsdh_osinfo->oob_irq_handler(bcmsdh_osinfo->oob_irq_handler_context);
+
+	return IRQ_HANDLED;
+}
+
+int bcmsdh_oob_intr_register(bcmsdh_info_t *bcmsdh, bcmsdh_cb_fn_t oob_irq_handler,
+	void* oob_irq_handler_context)
+{
+	int err = 0;
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+	SDLX_MSG(("%s: Enter\n", __FUNCTION__));
+	if (bcmsdh_osinfo->oob_irq_registered) {
+		SDLX_MSG(("%s: irq is already registered\n", __FUNCTION__));
+		return -EBUSY;
+	}
+#ifdef HW_OOB
+	printf("%s: HW_OOB enabled\n", __FUNCTION__);
+#else
+	printf("%s: SW_OOB enabled\n", __FUNCTION__);
+#endif
+	SDLX_MSG(("%s OOB irq=%d flags=%X\n", __FUNCTION__,
+		(int)bcmsdh_osinfo->oob_irq_num, (int)bcmsdh_osinfo->oob_irq_flags));
+	bcmsdh_osinfo->oob_irq_handler = oob_irq_handler;
+	bcmsdh_osinfo->oob_irq_handler_context = oob_irq_handler_context;
+	bcmsdh_osinfo->oob_irq_enabled = TRUE;
+	bcmsdh_osinfo->oob_irq_registered = TRUE;
+#if defined(CONFIG_ARCH_ODIN)
+	err = odin_gpio_sms_request_irq(bcmsdh_osinfo->oob_irq_num, wlan_oob_irq,
+		bcmsdh_osinfo->oob_irq_flags, "bcmsdh_sdmmc", bcmsdh);
+#else
+	err = request_irq(bcmsdh_osinfo->oob_irq_num, wlan_oob_irq,
+		bcmsdh_osinfo->oob_irq_flags, "bcmsdh_sdmmc", bcmsdh);
+#endif /* defined(CONFIG_ARCH_ODIN) */
+	if (err) {
+		bcmsdh_osinfo->oob_irq_enabled = FALSE;
+		bcmsdh_osinfo->oob_irq_registered = FALSE;
+		SDLX_MSG(("%s: request_irq failed with %d\n", __FUNCTION__, err));
+		return err;
+	}
+
+#if defined(DISABLE_WOWLAN)
+	SDLX_MSG(("%s: disable_irq_wake\n", __FUNCTION__));
+	bcmsdh_osinfo->oob_irq_wake_enabled = FALSE;
+#else
+	SDLX_MSG(("%s: enable_irq_wake\n", __FUNCTION__));
+	err = enable_irq_wake(bcmsdh_osinfo->oob_irq_num);
+	if (err)
+		SDLX_MSG(("%s: enable_irq_wake failed with %d\n", __FUNCTION__, err));
+	else
+		bcmsdh_osinfo->oob_irq_wake_enabled = TRUE;
+#endif
+
+	return 0;
+}
+
+void bcmsdh_oob_intr_unregister(bcmsdh_info_t *bcmsdh)
+{
+	int err = 0;
+	bcmsdh_os_info_t *bcmsdh_osinfo = bcmsdh->os_cxt;
+
+	SDLX_MSG(("%s: Enter\n", __FUNCTION__));
+	if (!bcmsdh_osinfo->oob_irq_registered) {
+		SDLX_MSG(("%s: irq is not registered\n", __FUNCTION__));
+		return;
+	}
+	if (bcmsdh_osinfo->oob_irq_wake_enabled) {
+		err = disable_irq_wake(bcmsdh_osinfo->oob_irq_num);
+		if (!err)
+			bcmsdh_osinfo->oob_irq_wake_enabled = FALSE;
+	}
+	if (bcmsdh_osinfo->oob_irq_enabled) {
+		disable_irq(bcmsdh_osinfo->oob_irq_num);
+		bcmsdh_osinfo->oob_irq_enabled = FALSE;
+	}
+	free_irq(bcmsdh_osinfo->oob_irq_num, bcmsdh);
+	bcmsdh_osinfo->oob_irq_registered = FALSE;
+}
+#endif
+
+/* Module parameters specific to each host-controller driver */
+
+extern uint sd_msglevel;	/* Debug message level */
+module_param(sd_msglevel, uint, 0);
+
+extern uint sd_power;	/* 0 = SD Power OFF, 1 = SD Power ON. */
+module_param(sd_power, uint, 0);
+
+extern uint sd_clock;	/* SD Clock Control, 0 = SD Clock OFF, 1 = SD Clock ON */
+module_param(sd_clock, uint, 0);
+
+extern uint sd_divisor;	/* Divisor (-1 means external clock) */
+module_param(sd_divisor, uint, 0);
+
+extern uint sd_sdmode;	/* Default is SD4, 0=SPI, 1=SD1, 2=SD4 */
+module_param(sd_sdmode, uint, 0);
+
+extern uint sd_hiok;	/* Ok to use hi-speed mode */
+module_param(sd_hiok, uint, 0);
+
+extern uint sd_f2_blocksize;
+module_param(sd_f2_blocksize, int, 0);
+
+#ifdef BCMSDIOH_STD
+extern int sd_uhsimode;
+module_param(sd_uhsimode, int, 0);
+extern uint sd_tuning_period;
+module_param(sd_tuning_period, uint, 0);
+extern int sd_delay_value;
+module_param(sd_delay_value, uint, 0);
+
+/* SDIO Drive Strength for UHSI mode specific to SDIO3.0 */
+extern char dhd_sdiod_uhsi_ds_override[2];
+module_param_string(dhd_sdiod_uhsi_ds_override, dhd_sdiod_uhsi_ds_override, 2, 0);
+
+#endif
+
+#ifdef BCMSDH_MODULE
+EXPORT_SYMBOL(bcmsdh_attach);
+EXPORT_SYMBOL(bcmsdh_detach);
+EXPORT_SYMBOL(bcmsdh_intr_query);
+EXPORT_SYMBOL(bcmsdh_intr_enable);
+EXPORT_SYMBOL(bcmsdh_intr_disable);
+EXPORT_SYMBOL(bcmsdh_intr_reg);
+EXPORT_SYMBOL(bcmsdh_intr_dereg);
+
+#if defined(DHD_DEBUG)
+EXPORT_SYMBOL(bcmsdh_intr_pending);
+#endif
+
+EXPORT_SYMBOL(bcmsdh_devremove_reg);
+EXPORT_SYMBOL(bcmsdh_cfg_read);
+EXPORT_SYMBOL(bcmsdh_cfg_write);
+EXPORT_SYMBOL(bcmsdh_cis_read);
+EXPORT_SYMBOL(bcmsdh_reg_read);
+EXPORT_SYMBOL(bcmsdh_reg_write);
+EXPORT_SYMBOL(bcmsdh_regfail);
+EXPORT_SYMBOL(bcmsdh_send_buf);
+EXPORT_SYMBOL(bcmsdh_recv_buf);
+
+EXPORT_SYMBOL(bcmsdh_rwdata);
+EXPORT_SYMBOL(bcmsdh_abort);
+EXPORT_SYMBOL(bcmsdh_query_device);
+EXPORT_SYMBOL(bcmsdh_query_iofnum);
+EXPORT_SYMBOL(bcmsdh_iovar_op);
+EXPORT_SYMBOL(bcmsdh_register);
+EXPORT_SYMBOL(bcmsdh_unregister);
+EXPORT_SYMBOL(bcmsdh_chipmatch);
+EXPORT_SYMBOL(bcmsdh_reset);
+EXPORT_SYMBOL(bcmsdh_waitlockfree);
+
+EXPORT_SYMBOL(bcmsdh_get_dstatus);
+EXPORT_SYMBOL(bcmsdh_cfg_read_word);
+EXPORT_SYMBOL(bcmsdh_cfg_write_word);
+EXPORT_SYMBOL(bcmsdh_cur_sbwad);
+EXPORT_SYMBOL(bcmsdh_chipinfo);
+
+#endif /* BCMSDH_MODULE */
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmsdh_sdmmc.c b/drivers/net/wireless/bcm4336/bcmsdh_sdmmc.c
--- a/drivers/net/wireless/bcm4336/bcmsdh_sdmmc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmsdh_sdmmc.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,1476 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2014, Broadcom Corporation
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_sdmmc.c 459285 2014-03-03 02:54:39Z $
+ */
+#include <typedefs.h>
+
+#include <bcmdevs.h>
+#include <bcmendian.h>
+#include <bcmutils.h>
+#include <osl.h>
+#include <sdio.h>	/* SDIO Device and Protocol Specs */
+#include <sdioh.h>	/* Standard SDIO Host Controller Specification */
+#include <bcmsdbus.h>	/* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>	/* ioctl/iovars */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+extern volatile bool dhd_mmc_suspend;
+#endif
+#include "bcmsdh_sdmmc.h"
+
+#ifndef BCMSDH_MODULE
+extern int sdio_function_init(void);
+extern void sdio_function_cleanup(void);
+#endif /* BCMSDH_MODULE */
+
+#if !defined(OOB_INTR_ONLY)
+static void IRQHandler(struct sdio_func *func);
+static void IRQHandlerF2(struct sdio_func *func);
+#endif /* !defined(OOB_INTR_ONLY) */
+static int sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr);
+#if 0 //defined(ENABLE_INSMOD_NO_FW_LOAD)
+extern int sdio_reset_comm(struct mmc_card *card);
+#else
+int sdio_reset_comm(struct mmc_card *card)
+{
+	return 0;
+}
+#endif
+#ifdef GLOBAL_SDMMC_INSTANCE
+extern PBCMSDH_SDMMC_INSTANCE gInstance;
+#endif
+
+#define DEFAULT_SDIO_F2_BLKSIZE		512
+#ifndef CUSTOM_SDIO_F2_BLKSIZE
+#define CUSTOM_SDIO_F2_BLKSIZE		DEFAULT_SDIO_F2_BLKSIZE
+#endif
+
+#define MAX_IO_RW_EXTENDED_BLK		511
+
+uint sd_sdmode = SDIOH_MODE_SD4;	/* Use SD4 mode by default */
+uint sd_f2_blocksize = CUSTOM_SDIO_F2_BLKSIZE;
+uint sd_divisor = 2;			/* Default 48MHz/2 = 24MHz */
+
+uint sd_power = 1;		/* Default to SD Slot powered ON */
+uint sd_clock = 1;		/* Default to SD Clock turned ON */
+uint sd_hiok = FALSE;	/* Don't use hi-speed mode by default */
+uint sd_msglevel = 0x01;
+uint sd_use_dma = TRUE;
+
+#ifndef CUSTOM_RXCHAIN
+#define CUSTOM_RXCHAIN 0
+#endif
+
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_byte_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_word_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_packet_wait);
+DHD_PM_RESUME_WAIT_INIT(sdioh_request_buffer_wait);
+
+#define DMA_ALIGN_MASK	0x03
+#define MMC_SDIO_ABORT_RETRY_LIMIT 5
+
+int sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data);
+
+static int
+sdioh_sdmmc_card_enablefuncs(sdioh_info_t *sd)
+{
+	int err_ret;
+	uint32 fbraddr;
+	uint8 func;
+
+	sd_trace(("%s\n", __FUNCTION__));
+
+	/* Get the Card's common CIS address */
+	sd->com_cis_ptr = sdioh_sdmmc_get_cisaddr(sd, SDIOD_CCCR_CISPTR_0);
+	sd->func_cis_ptr[0] = sd->com_cis_ptr;
+	sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+	/* Get the Card's function CIS (for each function) */
+	for (fbraddr = SDIOD_FBR_STARTADDR, func = 1;
+	     func <= sd->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
+		sd->func_cis_ptr[func] = sdioh_sdmmc_get_cisaddr(sd, SDIOD_FBR_CISPTR_0 + fbraddr);
+		sd_info(("%s: Function %d CIS Ptr = 0x%x\n",
+		         __FUNCTION__, func, sd->func_cis_ptr[func]));
+	}
+
+	sd->func_cis_ptr[0] = sd->com_cis_ptr;
+	sd_info(("%s: Card's Common CIS Ptr = 0x%x\n", __FUNCTION__, sd->com_cis_ptr));
+
+	/* Enable Function 1 */
+	sdio_claim_host(sd->func[1]);
+	err_ret = sdio_enable_func(sd->func[1]);
+	sdio_release_host(sd->func[1]);
+	if (err_ret) {
+		sd_err(("bcmsdh_sdmmc: Failed to enable F1 Err: 0x%08x", err_ret));
+	}
+
+	return FALSE;
+}
+
+/*
+ *	Public entry points & extern's
+ */
+extern sdioh_info_t *
+sdioh_attach(osl_t *osh, struct sdio_func *func)
+{
+	sdioh_info_t *sd = NULL;
+	int err_ret;
+
+	sd_trace(("%s\n", __FUNCTION__));
+
+	if (func == NULL) {
+		sd_err(("%s: sdio function device is NULL\n", __FUNCTION__));
+		return NULL;
+	}
+
+	if ((sd = (sdioh_info_t *)MALLOC(osh, sizeof(sdioh_info_t))) == NULL) {
+		sd_err(("sdioh_attach: out of memory, malloced %d bytes\n", MALLOCED(osh)));
+		return NULL;
+	}
+	bzero((char *)sd, sizeof(sdioh_info_t));
+	sd->osh = osh;
+	sd->fake_func0.num = 0;
+	sd->fake_func0.card = func->card;
+	sd->func[0] = &sd->fake_func0;
+#ifdef GLOBAL_SDMMC_INSTANCE
+	if (func->num == 2)
+		sd->func[1] = gInstance->func[1];
+#else
+	sd->func[1] = func->card->sdio_func[0];
+#endif
+	sd->func[2] = func->card->sdio_func[1];
+#ifdef GLOBAL_SDMMC_INSTANCE
+	sd->func[func->num] = func;
+#endif
+	sd->num_funcs = 2;
+	sd->sd_blockmode = TRUE;
+	sd->use_client_ints = TRUE;
+	sd->client_block_size[0] = 64;
+	sd->use_rxchain = CUSTOM_RXCHAIN;
+	if (sd->func[1] == NULL || sd->func[2] == NULL) {
+		sd_err(("%s: func 1 or 2 is null \n", __FUNCTION__));
+		goto fail;
+	}
+	sdio_set_drvdata(sd->func[1], sd);
+
+	sdio_claim_host(sd->func[1]);
+	sd->client_block_size[1] = 64;
+	err_ret = sdio_set_block_size(sd->func[1], 64);
+	sdio_release_host(sd->func[1]);
+	if (err_ret) {
+		sd_err(("bcmsdh_sdmmc: Failed to set F1 blocksize(%d)\n", err_ret));
+		goto fail;
+	}
+
+	sdio_claim_host(sd->func[2]);
+	sd->client_block_size[2] = sd_f2_blocksize;
+	err_ret = sdio_set_block_size(sd->func[2], sd_f2_blocksize);
+	sdio_release_host(sd->func[2]);
+	if (err_ret) {
+		sd_err(("bcmsdh_sdmmc: Failed to set F2 blocksize to %d(%d)\n",
+			sd_f2_blocksize, err_ret));
+		goto fail;
+	}
+
+	sdioh_sdmmc_card_enablefuncs(sd);
+
+	sd_trace(("%s: Done\n", __FUNCTION__));
+	return sd;
+
+fail:
+	MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+	return NULL;
+}
+
+
+extern SDIOH_API_RC
+sdioh_detach(osl_t *osh, sdioh_info_t *sd)
+{
+	sd_trace(("%s\n", __FUNCTION__));
+
+	if (sd) {
+
+		/* Disable Function 2 */
+		if (sd->func[2]) {
+			sdio_claim_host(sd->func[2]);
+			sdio_disable_func(sd->func[2]);
+			sdio_release_host(sd->func[2]);
+		}
+
+		/* Disable Function 1 */
+		if (sd->func[1]) {
+			sdio_claim_host(sd->func[1]);
+			sdio_disable_func(sd->func[1]);
+			sdio_release_host(sd->func[1]);
+		}
+
+		sd->func[1] = NULL;
+		sd->func[2] = NULL;
+
+		MFREE(sd->osh, sd, sizeof(sdioh_info_t));
+	}
+	return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+extern SDIOH_API_RC
+sdioh_enable_func_intr(sdioh_info_t *sd)
+{
+	uint8 reg;
+	int err;
+
+	if (sd->func[0] == NULL) {
+		sd_err(("%s: function 0 pointer is NULL\n", __FUNCTION__));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	sdio_claim_host(sd->func[0]);
+	reg = sdio_readb(sd->func[0], SDIOD_CCCR_INTEN, &err);
+	if (err) {
+		sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+		sdio_release_host(sd->func[0]);
+		return SDIOH_API_RC_FAIL;
+	}
+	/* Enable F1 and F2 interrupts, clear master enable */
+	reg &= ~INTR_CTL_MASTER_EN;
+	reg |= (INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+	sdio_writeb(sd->func[0], reg, SDIOD_CCCR_INTEN, &err);
+	sdio_release_host(sd->func[0]);
+
+	if (err) {
+		sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_disable_func_intr(sdioh_info_t *sd)
+{
+	uint8 reg;
+	int err;
+
+	if (sd->func[0] == NULL) {
+		sd_err(("%s: function 0 pointer is NULL\n", __FUNCTION__));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	sdio_claim_host(sd->func[0]);
+	reg = sdio_readb(sd->func[0], SDIOD_CCCR_INTEN, &err);
+	if (err) {
+		sd_err(("%s: error for read SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+		sdio_release_host(sd->func[0]);
+		return SDIOH_API_RC_FAIL;
+	}
+	reg &= ~(INTR_CTL_FUNC1_EN | INTR_CTL_FUNC2_EN);
+	/* Disable master interrupt with the last function interrupt */
+	if (!(reg & 0xFE))
+		reg = 0;
+	sdio_writeb(sd->func[0], reg, SDIOD_CCCR_INTEN, &err);
+	sdio_release_host(sd->func[0]);
+
+	if (err) {
+		sd_err(("%s: error for write SDIO_CCCR_IENx : 0x%x\n", __FUNCTION__, err));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	return SDIOH_API_RC_SUCCESS;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+/* Configure callback to client when we recieve client interrupt */
+extern SDIOH_API_RC
+sdioh_interrupt_register(sdioh_info_t *sd, sdioh_cb_fn_t fn, void *argh)
+{
+	sd_trace(("%s: Entering\n", __FUNCTION__));
+	if (fn == NULL) {
+		sd_err(("%s: interrupt handler is NULL, not registering\n", __FUNCTION__));
+		return SDIOH_API_RC_FAIL;
+	}
+#if !defined(OOB_INTR_ONLY)
+	sd->intr_handler = fn;
+	sd->intr_handler_arg = argh;
+	sd->intr_handler_valid = TRUE;
+
+	/* register and unmask irq */
+	if (sd->func[2]) {
+		sdio_claim_host(sd->func[2]);
+		sdio_claim_irq(sd->func[2], IRQHandlerF2);
+		sdio_release_host(sd->func[2]);
+	}
+
+	if (sd->func[1]) {
+		sdio_claim_host(sd->func[1]);
+		sdio_claim_irq(sd->func[1], IRQHandler);
+		sdio_release_host(sd->func[1]);
+	}
+#elif defined(HW_OOB)
+	sdioh_enable_func_intr(sd);
+#endif /* !defined(OOB_INTR_ONLY) */
+
+	return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_deregister(sdioh_info_t *sd)
+{
+	sd_trace(("%s: Entering\n", __FUNCTION__));
+
+#if !defined(OOB_INTR_ONLY)
+	if (sd->func[1]) {
+		/* register and unmask irq */
+		sdio_claim_host(sd->func[1]);
+		sdio_release_irq(sd->func[1]);
+		sdio_release_host(sd->func[1]);
+	}
+
+	if (sd->func[2]) {
+		/* Claim host controller F2 */
+		sdio_claim_host(sd->func[2]);
+		sdio_release_irq(sd->func[2]);
+		/* Release host controller F2 */
+		sdio_release_host(sd->func[2]);
+	}
+
+	sd->intr_handler_valid = FALSE;
+	sd->intr_handler = NULL;
+	sd->intr_handler_arg = NULL;
+#elif defined(HW_OOB)
+	if (dhd_download_fw_on_driverload)
+		sdioh_disable_func_intr(sd);
+#endif /* !defined(OOB_INTR_ONLY) */
+	return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_interrupt_query(sdioh_info_t *sd, bool *onoff)
+{
+	sd_trace(("%s: Entering\n", __FUNCTION__));
+	*onoff = sd->client_intr_enabled;
+	return SDIOH_API_RC_SUCCESS;
+}
+
+#if defined(DHD_DEBUG)
+extern bool
+sdioh_interrupt_pending(sdioh_info_t *sd)
+{
+	return (0);
+}
+#endif
+
+uint
+sdioh_query_iofnum(sdioh_info_t *sd)
+{
+	return sd->num_funcs;
+}
+
+/* IOVar table */
+enum {
+	IOV_MSGLEVEL = 1,
+	IOV_BLOCKMODE,
+	IOV_BLOCKSIZE,
+	IOV_DMA,
+	IOV_USEINTS,
+	IOV_NUMINTS,
+	IOV_NUMLOCALINTS,
+	IOV_HOSTREG,
+	IOV_DEVREG,
+	IOV_DIVISOR,
+	IOV_SDMODE,
+	IOV_HISPEED,
+	IOV_HCIREGS,
+	IOV_POWER,
+	IOV_CLOCK,
+	IOV_RXCHAIN
+};
+
+const bcm_iovar_t sdioh_iovars[] = {
+	{"sd_msglevel", IOV_MSGLEVEL,	0,	IOVT_UINT32,	0 },
+	{"sd_blockmode", IOV_BLOCKMODE, 0,	IOVT_BOOL,	0 },
+	{"sd_blocksize", IOV_BLOCKSIZE, 0,	IOVT_UINT32,	0 }, /* ((fn << 16) | size) */
+	{"sd_dma",	IOV_DMA,	0,	IOVT_BOOL,	0 },
+	{"sd_ints", 	IOV_USEINTS,	0,	IOVT_BOOL,	0 },
+	{"sd_numints",	IOV_NUMINTS,	0,	IOVT_UINT32,	0 },
+	{"sd_numlocalints", IOV_NUMLOCALINTS, 0, IOVT_UINT32,	0 },
+	{"sd_hostreg",	IOV_HOSTREG,	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
+	{"sd_devreg",	IOV_DEVREG, 	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
+	{"sd_divisor",	IOV_DIVISOR,	0,	IOVT_UINT32,	0 },
+	{"sd_power",	IOV_POWER,	0,	IOVT_UINT32,	0 },
+	{"sd_clock",	IOV_CLOCK,	0,	IOVT_UINT32,	0 },
+	{"sd_mode", 	IOV_SDMODE, 	0,	IOVT_UINT32,	100},
+	{"sd_highspeed", IOV_HISPEED,	0,	IOVT_UINT32,	0 },
+	{"sd_rxchain",  IOV_RXCHAIN,    0, 	IOVT_BOOL,	0 },
+	{NULL, 0, 0, 0, 0 }
+};
+
+int
+sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                           void *params, int plen, void *arg, int len, bool set)
+{
+	const bcm_iovar_t *vi = NULL;
+	int bcmerror = 0;
+	int val_size;
+	int32 int_val = 0;
+	bool bool_val;
+	uint32 actionid;
+
+	ASSERT(name);
+	ASSERT(len >= 0);
+
+	/* Get must have return space; Set does not take qualifiers */
+	ASSERT(set || (arg && len));
+	ASSERT(!set || (!params && !plen));
+
+	sd_trace(("%s: Enter (%s %s)\n", __FUNCTION__, (set ? "set" : "get"), name));
+
+	if ((vi = bcm_iovar_lookup(sdioh_iovars, name)) == NULL) {
+		bcmerror = BCME_UNSUPPORTED;
+		goto exit;
+	}
+
+	if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, set)) != 0)
+		goto exit;
+
+	/* Set up params so get and set can share the convenience variables */
+	if (params == NULL) {
+		params = arg;
+		plen = len;
+	}
+
+	if (vi->type == IOVT_VOID)
+		val_size = 0;
+	else if (vi->type == IOVT_BUFFER)
+		val_size = len;
+	else
+		val_size = sizeof(int);
+
+	if (plen >= (int)sizeof(int_val))
+		bcopy(params, &int_val, sizeof(int_val));
+
+	bool_val = (int_val != 0) ? TRUE : FALSE;
+	BCM_REFERENCE(bool_val);
+
+	actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+	switch (actionid) {
+	case IOV_GVAL(IOV_MSGLEVEL):
+		int_val = (int32)sd_msglevel;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_MSGLEVEL):
+		sd_msglevel = int_val;
+		break;
+
+	case IOV_GVAL(IOV_BLOCKMODE):
+		int_val = (int32)si->sd_blockmode;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_BLOCKMODE):
+		si->sd_blockmode = (bool)int_val;
+		/* Haven't figured out how to make non-block mode with DMA */
+		break;
+
+	case IOV_GVAL(IOV_BLOCKSIZE):
+		if ((uint32)int_val > si->num_funcs) {
+			bcmerror = BCME_BADARG;
+			break;
+		}
+		int_val = (int32)si->client_block_size[int_val];
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_BLOCKSIZE):
+	{
+		uint func = ((uint32)int_val >> 16);
+		uint blksize = (uint16)int_val;
+		uint maxsize;
+
+		if (func > si->num_funcs) {
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		switch (func) {
+		case 0: maxsize = 32; break;
+		case 1: maxsize = BLOCK_SIZE_4318; break;
+		case 2: maxsize = BLOCK_SIZE_4328; break;
+		default: maxsize = 0;
+		}
+		if (blksize > maxsize) {
+			bcmerror = BCME_BADARG;
+			break;
+		}
+		if (!blksize) {
+			blksize = maxsize;
+		}
+
+		/* Now set it */
+		si->client_block_size[func] = blksize;
+
+		break;
+	}
+
+	case IOV_GVAL(IOV_RXCHAIN):
+		int_val = (int32)si->use_rxchain;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_DMA):
+		int_val = (int32)si->sd_use_dma;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DMA):
+		si->sd_use_dma = (bool)int_val;
+		break;
+
+	case IOV_GVAL(IOV_USEINTS):
+		int_val = (int32)si->use_client_ints;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_USEINTS):
+		si->use_client_ints = (bool)int_val;
+		if (si->use_client_ints)
+			si->intmask |= CLIENT_INTR;
+		else
+			si->intmask &= ~CLIENT_INTR;
+
+		break;
+
+	case IOV_GVAL(IOV_DIVISOR):
+		int_val = (uint32)sd_divisor;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DIVISOR):
+		sd_divisor = int_val;
+		break;
+
+	case IOV_GVAL(IOV_POWER):
+		int_val = (uint32)sd_power;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_POWER):
+		sd_power = int_val;
+		break;
+
+	case IOV_GVAL(IOV_CLOCK):
+		int_val = (uint32)sd_clock;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_CLOCK):
+		sd_clock = int_val;
+		break;
+
+	case IOV_GVAL(IOV_SDMODE):
+		int_val = (uint32)sd_sdmode;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_SDMODE):
+		sd_sdmode = int_val;
+		break;
+
+	case IOV_GVAL(IOV_HISPEED):
+		int_val = (uint32)sd_hiok;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_HISPEED):
+		sd_hiok = int_val;
+		break;
+
+	case IOV_GVAL(IOV_NUMINTS):
+		int_val = (int32)si->intrcount;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_NUMLOCALINTS):
+		int_val = (int32)0;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_HOSTREG):
+	{
+		sdreg_t *sd_ptr = (sdreg_t *)params;
+
+		if (sd_ptr->offset < SD_SysAddr || sd_ptr->offset > SD_MaxCurCap) {
+			sd_err(("%s: bad offset 0x%x\n", __FUNCTION__, sd_ptr->offset));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		sd_trace(("%s: rreg%d at offset %d\n", __FUNCTION__,
+		                  (sd_ptr->offset & 1) ? 8 : ((sd_ptr->offset & 2) ? 16 : 32),
+		                  sd_ptr->offset));
+		if (sd_ptr->offset & 1)
+			int_val = 8; /* sdioh_sdmmc_rreg8(si, sd_ptr->offset); */
+		else if (sd_ptr->offset & 2)
+			int_val = 16; /* sdioh_sdmmc_rreg16(si, sd_ptr->offset); */
+		else
+			int_val = 32; /* sdioh_sdmmc_rreg(si, sd_ptr->offset); */
+
+		bcopy(&int_val, arg, sizeof(int_val));
+		break;
+	}
+
+	case IOV_SVAL(IOV_HOSTREG):
+	{
+		sdreg_t *sd_ptr = (sdreg_t *)params;
+
+		if (sd_ptr->offset < SD_SysAddr || sd_ptr->offset > SD_MaxCurCap) {
+			sd_err(("%s: bad offset 0x%x\n", __FUNCTION__, sd_ptr->offset));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		sd_trace(("%s: wreg%d value 0x%08x at offset %d\n", __FUNCTION__, sd_ptr->value,
+		                  (sd_ptr->offset & 1) ? 8 : ((sd_ptr->offset & 2) ? 16 : 32),
+		                  sd_ptr->offset));
+		break;
+	}
+
+	case IOV_GVAL(IOV_DEVREG):
+	{
+		sdreg_t *sd_ptr = (sdreg_t *)params;
+		uint8 data = 0;
+
+		if (sdioh_cfg_read(si, sd_ptr->func, sd_ptr->offset, &data)) {
+			bcmerror = BCME_SDIO_ERROR;
+			break;
+		}
+
+		int_val = (int)data;
+		bcopy(&int_val, arg, sizeof(int_val));
+		break;
+	}
+
+	case IOV_SVAL(IOV_DEVREG):
+	{
+		sdreg_t *sd_ptr = (sdreg_t *)params;
+		uint8 data = (uint8)sd_ptr->value;
+
+		if (sdioh_cfg_write(si, sd_ptr->func, sd_ptr->offset, &data)) {
+			bcmerror = BCME_SDIO_ERROR;
+			break;
+		}
+		break;
+	}
+
+	default:
+		bcmerror = BCME_UNSUPPORTED;
+		break;
+	}
+exit:
+
+	return bcmerror;
+}
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+
+SDIOH_API_RC
+sdioh_enable_hw_oob_intr(sdioh_info_t *sd, bool enable)
+{
+	SDIOH_API_RC status;
+	uint8 data;
+
+	if (enable)
+		data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE | SDIO_SEPINT_ACT_HI;
+	else
+		data = SDIO_SEPINT_ACT_HI;	/* disable hw oob interrupt */
+
+	status = sdioh_request_byte(sd, SDIOH_WRITE, 0, SDIOD_CCCR_BRCM_SEPINT, &data);
+	return status;
+}
+#endif /* defined(OOB_INTR_ONLY) && defined(HW_OOB) */
+
+extern SDIOH_API_RC
+sdioh_cfg_read(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+	SDIOH_API_RC status;
+	/* No lock needed since sdioh_request_byte does locking */
+	status = sdioh_request_byte(sd, SDIOH_READ, fnc_num, addr, data);
+	return status;
+}
+
+extern SDIOH_API_RC
+sdioh_cfg_write(sdioh_info_t *sd, uint fnc_num, uint32 addr, uint8 *data)
+{
+	/* No lock needed since sdioh_request_byte does locking */
+	SDIOH_API_RC status;
+	status = sdioh_request_byte(sd, SDIOH_WRITE, fnc_num, addr, data);
+	return status;
+}
+
+static int
+sdioh_sdmmc_get_cisaddr(sdioh_info_t *sd, uint32 regaddr)
+{
+	/* read 24 bits and return valid 17 bit addr */
+	int i;
+	uint32 scratch, regdata;
+	uint8 *ptr = (uint8 *)&scratch;
+	for (i = 0; i < 3; i++) {
+		if ((sdioh_sdmmc_card_regread (sd, 0, regaddr, 1, &regdata)) != SUCCESS)
+			sd_err(("%s: Can't read!\n", __FUNCTION__));
+
+		*ptr++ = (uint8) regdata;
+		regaddr++;
+	}
+
+	/* Only the lower 17-bits are valid */
+	scratch = ltoh32(scratch);
+	scratch &= 0x0001FFFF;
+	return (scratch);
+}
+
+extern SDIOH_API_RC
+sdioh_cis_read(sdioh_info_t *sd, uint func, uint8 *cisd, uint32 length)
+{
+	uint32 count;
+	int offset;
+	uint32 foo;
+	uint8 *cis = cisd;
+
+	sd_trace(("%s: Func = %d\n", __FUNCTION__, func));
+
+	if (!sd->func_cis_ptr[func]) {
+		bzero(cis, length);
+		sd_err(("%s: no func_cis_ptr[%d]\n", __FUNCTION__, func));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	sd_trace(("%s: func_cis_ptr[%d]=0x%04x\n", __FUNCTION__, func, sd->func_cis_ptr[func]));
+
+	for (count = 0; count < length; count++) {
+		offset =  sd->func_cis_ptr[func] + count;
+		if (sdioh_sdmmc_card_regread (sd, 0, offset, 1, &foo) < 0) {
+			sd_err(("%s: regread failed: Can't read CIS\n", __FUNCTION__));
+			return SDIOH_API_RC_FAIL;
+		}
+
+		*cis = (uint8)(foo & 0xff);
+		cis++;
+	}
+
+	return SDIOH_API_RC_SUCCESS;
+}
+
+extern SDIOH_API_RC
+sdioh_request_byte(sdioh_info_t *sd, uint rw, uint func, uint regaddr, uint8 *byte)
+{
+	int err_ret = 0;
+#if defined(MMC_SDIO_ABORT)
+	int sdio_abort_retry = MMC_SDIO_ABORT_RETRY_LIMIT;
+#endif
+
+	sd_info(("%s: rw=%d, func=%d, addr=0x%05x\n", __FUNCTION__, rw, func, regaddr));
+
+	DHD_PM_RESUME_WAIT(sdioh_request_byte_wait);
+	DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+	if(rw) { /* CMD52 Write */
+		if (func == 0) {
+			/* Can only directly write to some F0 registers.  Handle F2 enable
+			 * as a special case.
+			 */
+			if (regaddr == SDIOD_CCCR_IOEN) {
+				if (sd->func[2]) {
+					sdio_claim_host(sd->func[2]);
+					if (*byte & SDIO_FUNC_ENABLE_2) {
+						/* Enable Function 2 */
+						err_ret = sdio_enable_func(sd->func[2]);
+						if (err_ret) {
+							sd_err(("bcmsdh_sdmmc: enable F2 failed:%d\n",
+								err_ret));
+						}
+					} else {
+						/* Disable Function 2 */
+						err_ret = sdio_disable_func(sd->func[2]);
+						if (err_ret) {
+							sd_err(("bcmsdh_sdmmc: Disab F2 failed:%d\n",
+								err_ret));
+						}
+					}
+					sdio_release_host(sd->func[2]);
+				}
+			}
+#if defined(MMC_SDIO_ABORT)
+			/* to allow abort command through F1 */
+			else if (regaddr == SDIOD_CCCR_IOABORT) {
+				while (sdio_abort_retry--) {
+					if (sd->func[func]) {
+						sdio_claim_host(sd->func[func]);
+						/*
+						 * this sdio_f0_writeb() can be replaced with
+						 * another api depending upon MMC driver change.
+						 * As of this time, this is temporaray one
+						 */
+						sdio_writeb(sd->func[func],
+							*byte, regaddr, &err_ret);
+						sdio_release_host(sd->func[func]);
+					}
+					if (!err_ret)
+						break;
+				}
+			}
+#endif /* MMC_SDIO_ABORT */
+			else if (regaddr < 0xF0) {
+				sd_err(("bcmsdh_sdmmc: F0 Wr:0x%02x: write disallowed\n", regaddr));
+			} else {
+				/* Claim host controller, perform F0 write, and release */
+				if (sd->func[func]) {
+					sdio_claim_host(sd->func[func]);
+					sdio_f0_writeb(sd->func[func],
+						*byte, regaddr, &err_ret);
+					sdio_release_host(sd->func[func]);
+				}
+			}
+		} else {
+			/* Claim host controller, perform Fn write, and release */
+			if (sd->func[func]) {
+				sdio_claim_host(sd->func[func]);
+				sdio_writeb(sd->func[func], *byte, regaddr, &err_ret);
+				sdio_release_host(sd->func[func]);
+			}
+		}
+	} else { /* CMD52 Read */
+		/* Claim host controller, perform Fn read, and release */
+		if (sd->func[func]) {
+			sdio_claim_host(sd->func[func]);
+			if (func == 0) {
+				*byte = sdio_f0_readb(sd->func[func], regaddr, &err_ret);
+			} else {
+				*byte = sdio_readb(sd->func[func], regaddr, &err_ret);
+			}
+			sdio_release_host(sd->func[func]);
+		}
+	}
+
+	if (err_ret) {
+		if ((regaddr == 0x1001F) && ((err_ret == -ETIMEDOUT) || (err_ret == -EILSEQ))) {
+		} else {
+			sd_err(("bcmsdh_sdmmc: Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
+				rw ? "Write" : "Read", func, regaddr, *byte, err_ret));
+		}
+	}
+
+	return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+extern SDIOH_API_RC
+sdioh_request_word(sdioh_info_t *sd, uint cmd_type, uint rw, uint func, uint addr,
+                                   uint32 *word, uint nbytes)
+{
+	int err_ret = SDIOH_API_RC_FAIL;
+	int err_ret2 = SDIOH_API_RC_SUCCESS; // terence 20130621: prevent dhd_dpc in dead lock
+#if defined(MMC_SDIO_ABORT)
+	int sdio_abort_retry = MMC_SDIO_ABORT_RETRY_LIMIT;
+#endif
+
+	if (func == 0) {
+		sd_err(("%s: Only CMD52 allowed to F0.\n", __FUNCTION__));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	sd_info(("%s: cmd_type=%d, rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+	         __FUNCTION__, cmd_type, rw, func, addr, nbytes));
+
+	DHD_PM_RESUME_WAIT(sdioh_request_word_wait);
+	DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+	/* Claim host controller */
+	sdio_claim_host(sd->func[func]);
+
+	if(rw) { /* CMD52 Write */
+		if (nbytes == 4) {
+			sdio_writel(sd->func[func], *word, addr, &err_ret);
+		} else if (nbytes == 2) {
+			sdio_writew(sd->func[func], (*word & 0xFFFF), addr, &err_ret);
+		} else {
+			sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+		}
+	} else { /* CMD52 Read */
+		if (nbytes == 4) {
+			*word = sdio_readl(sd->func[func], addr, &err_ret);
+		} else if (nbytes == 2) {
+			*word = sdio_readw(sd->func[func], addr, &err_ret) & 0xFFFF;
+		} else {
+			sd_err(("%s: Invalid nbytes: %d\n", __FUNCTION__, nbytes));
+		}
+	}
+
+	/* Release host controller */
+	sdio_release_host(sd->func[func]);
+
+	if (err_ret) {
+#if defined(MMC_SDIO_ABORT)
+		/* Any error on CMD53 transaction should abort that function using function 0. */
+		while (sdio_abort_retry--) {
+			if (sd->func[0]) {
+				sdio_claim_host(sd->func[0]);
+				/*
+				 * this sdio_f0_writeb() can be replaced with another api
+				 * depending upon MMC driver change.
+				 * As of this time, this is temporaray one
+				 */
+				sdio_writeb(sd->func[0],
+					func, SDIOD_CCCR_IOABORT, &err_ret2);
+				sdio_release_host(sd->func[0]);
+			}
+			if (!err_ret2)
+				break;
+		}
+		if (err_ret)
+#endif /* MMC_SDIO_ABORT */
+		{
+			sd_err(("bcmsdh_sdmmc: Failed to %s word, Err: 0x%08x\n",
+				rw ? "Write" : "Read", err_ret));
+		}
+	}
+
+	return (((err_ret == 0)&&(err_ret2 == 0)) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+static SDIOH_API_RC
+sdioh_request_packet_chain(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, void *pkt)
+{
+	bool fifo = (fix_inc == SDIOH_DATA_FIX);
+	int err_ret = 0;
+	void *pnext;
+	uint ttl_len, pkt_offset;
+	uint blk_num;
+	uint blk_size;
+	uint max_blk_count;
+	uint max_req_size;
+	struct mmc_request mmc_req;
+	struct mmc_command mmc_cmd;
+	struct mmc_data mmc_dat;
+	uint32 sg_count;
+	struct sdio_func *sdio_func = sd->func[func];
+	struct mmc_host *host = sdio_func->card->host;
+
+	sd_trace(("%s: Enter\n", __FUNCTION__));
+	ASSERT(pkt);
+	DHD_PM_RESUME_WAIT(sdioh_request_packet_wait);
+	DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+	blk_size = sd->client_block_size[func];
+	max_blk_count = min(host->max_blk_count, (uint)MAX_IO_RW_EXTENDED_BLK);
+	max_req_size = min(max_blk_count * blk_size, host->max_req_size);
+
+	pkt_offset = 0;
+	pnext = pkt;
+
+	while (pnext != NULL) {
+		ttl_len = 0;
+		sg_count = 0;
+		memset(&mmc_req, 0, sizeof(struct mmc_request));
+		memset(&mmc_cmd, 0, sizeof(struct mmc_command));
+		memset(&mmc_dat, 0, sizeof(struct mmc_data));
+		sg_init_table(sd->sg_list, ARRAYSIZE(sd->sg_list));
+
+		/* Set up scatter-gather DMA descriptors. this loop is to find out the max
+		 * data we can transfer with one command 53. blocks per command is limited by
+		 * host max_req_size and 9-bit max block number. when the total length of this
+		 * packet chain is bigger than max_req_size, use multiple SD_IO_RW_EXTENDED
+		 * commands (each transfer is still block aligned)
+		 */
+		while (pnext != NULL && ttl_len < max_req_size) {
+			int pkt_len;
+			int sg_data_size;
+			uint8 *pdata = (uint8*)PKTDATA(sd->osh, pnext);
+
+			ASSERT(pdata != NULL);
+			pkt_len = PKTLEN(sd->osh, pnext);
+			sd_trace(("%s[%d] data=%p, len=%d\n", __FUNCTION__, write, pdata, pkt_len));
+			/* sg_count is unlikely larger than the array size, and this is
+			 * NOT something we can handle here, but in case it happens, PLEASE put
+			 * a restriction on max tx/glom count (based on host->max_segs).
+			 */
+			if (sg_count >= ARRAYSIZE(sd->sg_list)) {
+				sd_err(("%s: sg list entries exceed limit\n", __FUNCTION__));
+				return (SDIOH_API_RC_FAIL);
+			}
+			pdata += pkt_offset;
+
+			sg_data_size = pkt_len - pkt_offset;
+			if (sg_data_size > max_req_size - ttl_len)
+				sg_data_size = max_req_size - ttl_len;
+			/* some platforms put a restriction on the data size of each scatter-gather
+			 * DMA descriptor, use multiple sg buffers when xfer_size is bigger than
+			 * max_seg_size
+			 */
+			if (sg_data_size > host->max_seg_size)
+				sg_data_size = host->max_seg_size;
+			sg_set_buf(&sd->sg_list[sg_count++], pdata, sg_data_size);
+
+			ttl_len += sg_data_size;
+			pkt_offset += sg_data_size;
+			if (pkt_offset == pkt_len) {
+				pnext = PKTNEXT(sd->osh, pnext);
+				pkt_offset = 0;
+			}
+		}
+
+		if (ttl_len % blk_size != 0) {
+			sd_err(("%s, data length %d not aligned to block size %d\n",
+				__FUNCTION__,  ttl_len, blk_size));
+			return SDIOH_API_RC_FAIL;
+		}
+		blk_num = ttl_len / blk_size;
+		mmc_dat.sg = sd->sg_list;
+		mmc_dat.sg_len = sg_count;
+		mmc_dat.blksz = blk_size;
+		mmc_dat.blocks = blk_num;
+		mmc_dat.flags = write ? MMC_DATA_WRITE : MMC_DATA_READ;
+		mmc_cmd.opcode = 53; /* SD_IO_RW_EXTENDED */
+		mmc_cmd.arg = write ? 1<<31 : 0;
+		mmc_cmd.arg |= (func & 0x7) << 28;
+		mmc_cmd.arg |= 1<<27;
+		mmc_cmd.arg |= fifo ? 0 : 1<<26;
+		mmc_cmd.arg |= (addr & 0x1FFFF) << 9;
+		mmc_cmd.arg |= blk_num & 0x1FF;
+		mmc_cmd.flags = MMC_RSP_SPI_R5 | MMC_RSP_R5 | MMC_CMD_ADTC;
+		mmc_req.cmd = &mmc_cmd;
+		mmc_req.data = &mmc_dat;
+		if (!fifo)
+			addr += ttl_len;
+
+		sdio_claim_host(sdio_func);
+		mmc_set_data_timeout(&mmc_dat, sdio_func->card);
+		mmc_wait_for_req(host, &mmc_req);
+		sdio_release_host(sdio_func);
+
+		err_ret = mmc_cmd.error? mmc_cmd.error : mmc_dat.error;
+		if (0 != err_ret) {
+			sd_err(("%s:CMD53 %s failed with code %d\n",
+				__FUNCTION__, write ? "write" : "read", err_ret));
+			return SDIOH_API_RC_FAIL;
+		}
+	}
+
+	sd_trace(("%s: Exit\n", __FUNCTION__));
+	return SDIOH_API_RC_SUCCESS;
+}
+
+static SDIOH_API_RC
+sdioh_buffer_tofrom_bus(sdioh_info_t *sd, uint fix_inc, uint write, uint func,
+                     uint addr, uint8 *buf, uint len)
+{
+	bool fifo = (fix_inc == SDIOH_DATA_FIX);
+	int err_ret = 0;
+
+	sd_trace(("%s: Enter\n", __FUNCTION__));
+	ASSERT(buf);
+
+	/* NOTE:
+	 * For all writes, each packet length is aligned to 32 (or 4)
+	 * bytes in dhdsdio_txpkt_preprocess, and for glom the last packet length
+	 * is aligned to block boundary. If you want to align each packet to
+	 * a custom size, please do it in dhdsdio_txpkt_preprocess, NOT here
+	 *
+	 * For reads, the alignment is doen in sdioh_request_buffer.
+	 *
+	 */
+	sdio_claim_host(sd->func[func]);
+
+	if ((write) && (!fifo))
+		err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, len);
+	else if (write)
+		err_ret = sdio_memcpy_toio(sd->func[func], addr, buf, len);
+	else if (fifo)
+		err_ret = sdio_readsb(sd->func[func], buf, addr, len);
+	else
+		err_ret = sdio_memcpy_fromio(sd->func[func], buf, addr, len);
+
+	sdio_release_host(sd->func[func]);
+
+	if (err_ret)
+		sd_err(("%s: %s FAILED %p, addr=0x%05x, pkt_len=%d, ERR=%d\n", __FUNCTION__,
+		       (write) ? "TX" : "RX", buf, addr, len, err_ret));
+	else
+		sd_trace(("%s: %s xfr'd %p, addr=0x%05x, len=%d\n", __FUNCTION__,
+			(write) ? "TX" : "RX", buf, addr, len));
+
+	sd_trace(("%s: Exit\n", __FUNCTION__));
+	return ((err_ret == 0) ? SDIOH_API_RC_SUCCESS : SDIOH_API_RC_FAIL);
+}
+
+
+/*
+ * This function takes a buffer or packet, and fixes everything up so that in the
+ * end, a DMA-able packet is created.
+ *
+ * A buffer does not have an associated packet pointer, and may or may not be aligned.
+ * A packet may consist of a single packet, or a packet chain.  If it is a packet chain,
+ * then all the packets in the chain must be properly aligned.  If the packet data is not
+ * aligned, then there may only be one packet, and in this case, it is copied to a new
+ * aligned packet.
+ *
+ */
+extern SDIOH_API_RC
+sdioh_request_buffer(sdioh_info_t *sd, uint pio_dma, uint fix_inc, uint write, uint func,
+	uint addr, uint reg_width, uint buf_len, uint8 *buffer, void *pkt)
+{
+	SDIOH_API_RC status;
+	void *tmppkt;
+
+	sd_trace(("%s: Enter\n", __FUNCTION__));
+	DHD_PM_RESUME_WAIT(sdioh_request_buffer_wait);
+	DHD_PM_RESUME_RETURN_ERROR(SDIOH_API_RC_FAIL);
+
+	if (pkt) {
+		/* packet chain, only used for tx/rx glom, all packets length
+		 * are aligned, total length is a block multiple
+		 */
+		if (PKTNEXT(sd->osh, pkt))
+			return sdioh_request_packet_chain(sd, fix_inc, write, func, addr, pkt);
+
+		/* non-glom mode, ignore the buffer parameter and use the packet pointer
+		 * (this shouldn't happen)
+		 */
+		buffer = PKTDATA(sd->osh, pkt);
+		buf_len = PKTLEN(sd->osh, pkt);
+	}
+
+	ASSERT(buffer);
+
+	/* buffer and length are aligned, use it directly so we can avoid memory copy */
+	if (((ulong)buffer & DMA_ALIGN_MASK) == 0 && (buf_len & DMA_ALIGN_MASK) == 0)
+		return sdioh_buffer_tofrom_bus(sd, fix_inc, write, func, addr, buffer, buf_len);
+
+	sd_trace(("%s: [%d] doing memory copy buf=%p, len=%d\n",
+		__FUNCTION__, write, buffer, buf_len));
+
+	/* otherwise, a memory copy is needed as the input buffer is not aligned */
+	tmppkt = PKTGET_STATIC(sd->osh, buf_len + DEFAULT_SDIO_F2_BLKSIZE, write ? TRUE : FALSE);
+	if (tmppkt == NULL) {
+		sd_err(("%s: PKTGET failed: len %d\n", __FUNCTION__, buf_len));
+		return SDIOH_API_RC_FAIL;
+	}
+
+	if (write)
+		bcopy(buffer, PKTDATA(sd->osh, tmppkt), buf_len);
+
+	status = sdioh_buffer_tofrom_bus(sd, fix_inc, write, func, addr,
+		PKTDATA(sd->osh, tmppkt), ROUNDUP(buf_len, (DMA_ALIGN_MASK+1)));
+
+	if (!write)
+		bcopy(PKTDATA(sd->osh, tmppkt), buffer, buf_len);
+
+	PKTFREE_STATIC(sd->osh, tmppkt, write ? TRUE : FALSE);
+
+	return status;
+}
+
+/* this function performs "abort" for both of host & device */
+extern int
+sdioh_abort(sdioh_info_t *sd, uint func)
+{
+#if defined(MMC_SDIO_ABORT)
+	char t_func = (char) func;
+#endif /* defined(MMC_SDIO_ABORT) */
+	sd_trace(("%s: Enter\n", __FUNCTION__));
+
+#if defined(MMC_SDIO_ABORT)
+	/* issue abort cmd52 command through F1 */
+	sdioh_request_byte(sd, SD_IO_OP_WRITE, SDIO_FUNC_0, SDIOD_CCCR_IOABORT, &t_func);
+#endif /* defined(MMC_SDIO_ABORT) */
+
+	sd_trace(("%s: Exit\n", __FUNCTION__));
+	return SDIOH_API_RC_SUCCESS;
+}
+
+/* Reset and re-initialize the device */
+int sdioh_sdio_reset(sdioh_info_t *si)
+{
+	sd_trace(("%s: Enter\n", __FUNCTION__));
+	sd_trace(("%s: Exit\n", __FUNCTION__));
+	return SDIOH_API_RC_SUCCESS;
+}
+
+/* Disable device interrupt */
+void
+sdioh_sdmmc_devintr_off(sdioh_info_t *sd)
+{
+	sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+	sd->intmask &= ~CLIENT_INTR;
+}
+
+/* Enable device interrupt */
+void
+sdioh_sdmmc_devintr_on(sdioh_info_t *sd)
+{
+	sd_trace(("%s: %d\n", __FUNCTION__, sd->use_client_ints));
+	sd->intmask |= CLIENT_INTR;
+}
+
+/* Read client card reg */
+int
+sdioh_sdmmc_card_regread(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 *data)
+{
+
+	if ((func == 0) || (regsize == 1)) {
+		uint8 temp = 0;
+
+		sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+		*data = temp;
+		*data &= 0xff;
+		sd_data(("%s: byte read data=0x%02x\n",
+		         __FUNCTION__, *data));
+	} else {
+		sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, data, regsize);
+		if (regsize == 2)
+			*data &= 0xffff;
+
+		sd_data(("%s: word read data=0x%08x\n",
+		         __FUNCTION__, *data));
+	}
+
+	return SUCCESS;
+}
+
+#if !defined(OOB_INTR_ONLY)
+/* bcmsdh_sdmmc interrupt handler */
+static void IRQHandler(struct sdio_func *func)
+{
+	sdioh_info_t *sd;
+
+	sd = sdio_get_drvdata(func);
+
+	ASSERT(sd != NULL);
+	sdio_release_host(sd->func[0]);
+
+	if (sd->use_client_ints) {
+		sd->intrcount++;
+		ASSERT(sd->intr_handler);
+		ASSERT(sd->intr_handler_arg);
+		(sd->intr_handler)(sd->intr_handler_arg);
+	} else {
+		sd_err(("bcmsdh_sdmmc: ***IRQHandler\n"));
+
+		sd_err(("%s: Not ready for intr: enabled %d, handler %p\n",
+		        __FUNCTION__, sd->client_intr_enabled, sd->intr_handler));
+	}
+
+	sdio_claim_host(sd->func[0]);
+}
+
+/* bcmsdh_sdmmc interrupt handler for F2 (dummy handler) */
+static void IRQHandlerF2(struct sdio_func *func)
+{
+	sd_trace(("bcmsdh_sdmmc: ***IRQHandlerF2\n"));
+}
+#endif /* !defined(OOB_INTR_ONLY) */
+
+#ifdef NOTUSED
+/* Write client card reg */
+static int
+sdioh_sdmmc_card_regwrite(sdioh_info_t *sd, int func, uint32 regaddr, int regsize, uint32 data)
+{
+
+	if ((func == 0) || (regsize == 1)) {
+		uint8 temp;
+
+		temp = data & 0xff;
+		sdioh_request_byte(sd, SDIOH_READ, func, regaddr, &temp);
+		sd_data(("%s: byte write data=0x%02x\n",
+		         __FUNCTION__, data));
+	} else {
+		if (regsize == 2)
+			data &= 0xffff;
+
+		sdioh_request_word(sd, 0, SDIOH_READ, func, regaddr, &data, regsize);
+
+		sd_data(("%s: word write data=0x%08x\n",
+		         __FUNCTION__, data));
+	}
+
+	return SUCCESS;
+}
+#endif /* NOTUSED */
+
+int
+sdioh_start(sdioh_info_t *sd, int stage)
+{
+	int ret;
+
+	if (!sd) {
+		sd_err(("%s Failed, sd is NULL\n", __FUNCTION__));
+		return (0);
+	}
+
+	/* Need to do this stages as we can't enable the interrupt till
+		downloading of the firmware is complete, other wise polling
+		sdio access will come in way
+	*/
+	if (sd->func[0]) {
+			if (stage == 0) {
+		/* Since the power to the chip is killed, we will have
+			re enumerate the device again. Set the block size
+			and enable the fucntion 1 for in preparation for
+			downloading the code
+		*/
+		/* sdio_reset_comm() - has been fixed in latest kernel/msm.git for Linux
+		   2.6.27. The implementation prior to that is buggy, and needs broadcom's
+		   patch for it
+		*/
+		if ((ret = sdio_reset_comm(sd->func[0]->card))) {
+			sd_err(("%s Failed, error = %d\n", __FUNCTION__, ret));
+			return ret;
+		}
+		else {
+			sd->num_funcs = 2;
+			sd->sd_blockmode = TRUE;
+			sd->use_client_ints = TRUE;
+			sd->client_block_size[0] = 64;
+
+			if (sd->func[1]) {
+				/* Claim host controller */
+				sdio_claim_host(sd->func[1]);
+
+				sd->client_block_size[1] = 64;
+				ret = sdio_set_block_size(sd->func[1], 64);
+				if (ret) {
+					sd_err(("bcmsdh_sdmmc: Failed to set F1 "
+						"blocksize(%d)\n", ret));
+				}
+
+				/* Release host controller F1 */
+				sdio_release_host(sd->func[1]);
+			}
+
+			if (sd->func[2]) {
+				/* Claim host controller F2 */
+				sdio_claim_host(sd->func[2]);
+
+				sd->client_block_size[2] = sd_f2_blocksize;
+				ret = sdio_set_block_size(sd->func[2], sd_f2_blocksize);
+				if (ret) {
+					sd_err(("bcmsdh_sdmmc: Failed to set F2 "
+						"blocksize to %d(%d)\n", sd_f2_blocksize, ret));
+				}
+
+				/* Release host controller F2 */
+				sdio_release_host(sd->func[2]);
+			}
+
+			sdioh_sdmmc_card_enablefuncs(sd);
+			}
+		} else {
+#if !defined(OOB_INTR_ONLY)
+			sdio_claim_host(sd->func[0]);
+			if (sd->func[2])
+				sdio_claim_irq(sd->func[2], IRQHandlerF2);
+			if (sd->func[1])
+				sdio_claim_irq(sd->func[1], IRQHandler);
+			sdio_release_host(sd->func[0]);
+#else /* defined(OOB_INTR_ONLY) */
+#if defined(HW_OOB)
+			sdioh_enable_func_intr(sd);
+#endif
+			bcmsdh_oob_intr_set(sd->bcmsdh, TRUE);
+#endif /* !defined(OOB_INTR_ONLY) */
+		}
+	}
+	else
+		sd_err(("%s Failed\n", __FUNCTION__));
+
+	return (0);
+}
+
+int
+sdioh_stop(sdioh_info_t *sd)
+{
+	/* MSM7201A Android sdio stack has bug with interrupt
+		So internaly within SDIO stack they are polling
+		which cause issue when device is turned off. So
+		unregister interrupt with SDIO stack to stop the
+		polling
+	*/
+	if (sd->func[0]) {
+#if !defined(OOB_INTR_ONLY)
+		sdio_claim_host(sd->func[0]);
+		if (sd->func[1])
+			sdio_release_irq(sd->func[1]);
+		if (sd->func[2])
+			sdio_release_irq(sd->func[2]);
+		sdio_release_host(sd->func[0]);
+#else /* defined(OOB_INTR_ONLY) */
+#if defined(HW_OOB)
+		sdioh_disable_func_intr(sd);
+#endif
+		bcmsdh_oob_intr_set(sd->bcmsdh, FALSE);
+#endif /* !defined(OOB_INTR_ONLY) */
+	}
+	else
+		sd_err(("%s Failed\n", __FUNCTION__));
+	return (0);
+}
+
+int
+sdioh_waitlockfree(sdioh_info_t *sd)
+{
+	return (1);
+}
+
+
+SDIOH_API_RC
+sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio)
+{
+	return SDIOH_API_RC_FAIL;
+}
+
+SDIOH_API_RC
+sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab)
+{
+	return SDIOH_API_RC_FAIL;
+}
+
+bool
+sdioh_gpioin(sdioh_info_t *sd, uint32 gpio)
+{
+	return FALSE;
+}
+
+SDIOH_API_RC
+sdioh_gpio_init(sdioh_info_t *sd)
+{
+	return SDIOH_API_RC_FAIL;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmsdh_sdmmc_linux.c b/drivers/net/wireless/bcm4336/bcmsdh_sdmmc_linux.c
--- a/drivers/net/wireless/bcm4336/bcmsdh_sdmmc_linux.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmsdh_sdmmc_linux.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,412 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2014, Broadcom Corporation
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_sdmmc_linux.c 434777 2013-11-07 09:30:27Z $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <sdio.h>	/* SDIO Device and Protocol Specs */
+#include <bcmsdbus.h>	/* bcmsdh to/from specific controller APIs */
+#include <sdiovar.h>	/* to get msglevel bit values */
+
+#include <linux/sched.h>	/* request_irq() */
+
+#include <linux/mmc/core.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <dhd_linux.h>
+#include <bcmsdh_sdmmc.h>
+#include <dhd_dbg.h>
+
+#if !defined(SDIO_VENDOR_ID_BROADCOM)
+#define SDIO_VENDOR_ID_BROADCOM		0x02d0
+#endif /* !defined(SDIO_VENDOR_ID_BROADCOM) */
+
+#define SDIO_DEVICE_ID_BROADCOM_DEFAULT	0x0000
+
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB)
+#define SDIO_DEVICE_ID_BROADCOM_4325_SDGWB	0x0492	/* BCM94325SDGWB */
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4325)
+#define SDIO_DEVICE_ID_BROADCOM_4325	0x0493
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4325) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4329)
+#define SDIO_DEVICE_ID_BROADCOM_4329	0x4329
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4329) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4319)
+#define SDIO_DEVICE_ID_BROADCOM_4319	0x4319
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4319) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4330)
+#define SDIO_DEVICE_ID_BROADCOM_4330	0x4330
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4330) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4334)
+#define SDIO_DEVICE_ID_BROADCOM_4334    0x4334
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4334) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_4324)
+#define SDIO_DEVICE_ID_BROADCOM_4324    0x4324
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_4324) */
+#if !defined(SDIO_DEVICE_ID_BROADCOM_43239)
+#define SDIO_DEVICE_ID_BROADCOM_43239    43239
+#endif /* !defined(SDIO_DEVICE_ID_BROADCOM_43239) */
+
+extern void wl_cfg80211_set_parent_dev(void *dev);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void* bcmsdh_probe(osl_t *osh, void *dev, void *sdioh, void *adapter_info, uint bus_type,
+	uint bus_num, uint slot_num);
+extern int bcmsdh_remove(bcmsdh_info_t *bcmsdh);
+
+int sdio_function_init(void);
+void sdio_function_cleanup(void);
+
+#define DESCRIPTION "bcmsdh_sdmmc Driver"
+#define AUTHOR "Broadcom Corporation"
+
+/* module param defaults */
+static int clockoverride = 0;
+
+module_param(clockoverride, int, 0644);
+MODULE_PARM_DESC(clockoverride, "SDIO card clock override");
+
+#ifdef GLOBAL_SDMMC_INSTANCE
+PBCMSDH_SDMMC_INSTANCE gInstance;
+#endif
+
+/* Maximum number of bcmsdh_sdmmc devices supported by driver */
+#define BCMSDH_SDMMC_MAX_DEVICES 1
+
+extern volatile bool dhd_mmc_suspend;
+
+static int sdioh_probe(struct sdio_func *func)
+{
+	int host_idx = func->card->host->index;
+	uint32 rca = func->card->rca;
+	wifi_adapter_info_t *adapter;
+	osl_t *osh = NULL;
+	sdioh_info_t *sdioh = NULL;
+
+	sd_err(("bus num (host idx)=%d, slot num (rca)=%d\n", host_idx, rca));
+	adapter = dhd_wifi_platform_get_adapter(SDIO_BUS, host_idx, rca);
+	if (adapter  != NULL)
+		sd_err(("found adapter info '%s'\n", adapter->name));
+	else
+		sd_err(("can't find adapter info for this chip\n"));
+
+#ifdef WL_CFG80211
+	wl_cfg80211_set_parent_dev(&func->dev);
+#endif
+
+	 /* allocate SDIO Host Controller state info */
+	 osh = osl_attach(&func->dev, SDIO_BUS, TRUE);
+	 if (osh == NULL) {
+		 sd_err(("%s: osl_attach failed\n", __FUNCTION__));
+		 goto fail;
+	 }
+	 osl_static_mem_init(osh, adapter);
+	 sdioh = sdioh_attach(osh, func);
+	 if (sdioh == NULL) {
+		 sd_err(("%s: sdioh_attach failed\n", __FUNCTION__));
+		 goto fail;
+	 }
+	 sdioh->bcmsdh = bcmsdh_probe(osh, &func->dev, sdioh, adapter, SDIO_BUS, host_idx, rca);
+	 if (sdioh->bcmsdh == NULL) {
+		 sd_err(("%s: bcmsdh_probe failed\n", __FUNCTION__));
+		 goto fail;
+	 }
+
+	sdio_set_drvdata(func, sdioh);
+	return 0;
+
+fail:
+	if (sdioh != NULL)
+		sdioh_detach(osh, sdioh);
+	if (osh != NULL)
+		osl_detach(osh);
+	return -ENOMEM;
+}
+
+static void sdioh_remove(struct sdio_func *func)
+{
+	sdioh_info_t *sdioh;
+	osl_t *osh;
+
+	sdioh = sdio_get_drvdata(func);
+	if (sdioh == NULL) {
+		sd_err(("%s: error, no sdioh handler found\n", __FUNCTION__));
+		return;
+	}
+	sd_err(("%s: Enter\n", __FUNCTION__));
+
+	osh = sdioh->osh;
+	bcmsdh_remove(sdioh->bcmsdh);
+	sdioh_detach(osh, sdioh);
+	osl_detach(osh);
+}
+
+static int bcmsdh_sdmmc_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+	int ret = 0;
+
+	if (func == NULL)
+		return -EINVAL;
+
+	sd_err(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+	sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+	sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+	sd_info(("sdio_device: 0x%04x\n", func->device));
+	sd_info(("Function#: 0x%04x\n", func->num));
+
+#ifdef GLOBAL_SDMMC_INSTANCE
+	gInstance->func[func->num] = func;
+#endif
+
+	/* 4318 doesn't have function 2 */
+	if ((func->num == 2) || (func->num == 1 && func->device == 0x4))
+		ret = sdioh_probe(func);
+
+	return ret;
+}
+
+static void bcmsdh_sdmmc_remove(struct sdio_func *func)
+{
+	if (func == NULL) {
+		sd_err(("%s is called with NULL SDIO function pointer\n", __FUNCTION__));
+		return;
+	}
+
+	sd_trace(("bcmsdh_sdmmc: %s Enter\n", __FUNCTION__));
+	sd_info(("sdio_bcmsdh: func->class=%x\n", func->class));
+	sd_info(("sdio_vendor: 0x%04x\n", func->vendor));
+	sd_info(("sdio_device: 0x%04x\n", func->device));
+	sd_info(("Function#: 0x%04x\n", func->num));
+
+	if ((func->num == 2) || (func->num == 1 && func->device == 0x4))
+		sdioh_remove(func);
+}
+
+/* devices we support, null terminated */
+static const struct sdio_device_id bcmsdh_sdmmc_ids[] = {
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_DEFAULT) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325_SDGWB) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4325) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4319) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4324) },
+	{ SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43239) },
+	{ SDIO_DEVICE_CLASS(SDIO_CLASS_NONE)		},
+	{ /* end: all zeroes */				},
+};
+
+MODULE_DEVICE_TABLE(sdio, bcmsdh_sdmmc_ids);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+static int bcmsdh_sdmmc_suspend(struct device *pdev)
+{
+	int err;
+	sdioh_info_t *sdioh;
+	struct sdio_func *func = dev_to_sdio_func(pdev);
+	mmc_pm_flag_t sdio_flags;
+
+	printf("%s Enter func->num=%d\n", __FUNCTION__, func->num);
+	if (func->num != 2)
+		return 0;
+
+	sdioh = sdio_get_drvdata(func);
+	err = bcmsdh_suspend(sdioh->bcmsdh);
+	if (err) {
+		printf("%s bcmsdh_suspend err=%d\n", __FUNCTION__, err);
+		return err;
+	}
+
+	sdio_flags = sdio_get_host_pm_caps(func);
+	if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
+		sd_err(("%s: can't keep power while host is suspended\n", __FUNCTION__));
+		return  -EINVAL;
+	}
+
+	/* keep power while host suspended */
+	err = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+	if (err) {
+		sd_err(("%s: error while trying to keep power\n", __FUNCTION__));
+		return err;
+	}
+#if defined(OOB_INTR_ONLY)
+	bcmsdh_oob_intr_set(sdioh->bcmsdh, FALSE);
+#endif
+	dhd_mmc_suspend = TRUE;
+	smp_mb();
+
+	printf("%s Exit\n", __FUNCTION__);
+	return 0;
+}
+
+static int bcmsdh_sdmmc_resume(struct device *pdev)
+{
+#if defined(OOB_INTR_ONLY)
+	sdioh_info_t *sdioh;
+#endif
+	struct sdio_func *func = dev_to_sdio_func(pdev);
+
+	printf("%s Enter func->num=%d\n", __FUNCTION__, func->num);
+	if (func->num != 2)
+		return 0;
+
+	dhd_mmc_suspend = FALSE;
+#if defined(OOB_INTR_ONLY)
+	sdioh = sdio_get_drvdata(func);
+	bcmsdh_resume(sdioh->bcmsdh);
+#endif
+
+	smp_mb();
+	printf("%s Exit\n", __FUNCTION__);
+	return 0;
+}
+
+static const struct dev_pm_ops bcmsdh_sdmmc_pm_ops = {
+	.suspend	= bcmsdh_sdmmc_suspend,
+	.resume		= bcmsdh_sdmmc_resume,
+};
+#endif  /* (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM) */
+
+#if defined(BCMLXSDMMC)
+static struct semaphore *notify_semaphore = NULL;
+
+static int dummy_probe(struct sdio_func *func,
+                              const struct sdio_device_id *id)
+{
+	if (func && (func->num != 2)) {
+		return 0;
+	}
+
+	if (notify_semaphore)
+		up(notify_semaphore);
+	return 0;
+}
+
+static void dummy_remove(struct sdio_func *func)
+{
+}
+
+static struct sdio_driver dummy_sdmmc_driver = {
+	.probe		= dummy_probe,
+	.remove		= dummy_remove,
+	.name		= "dummy_sdmmc",
+	.id_table	= bcmsdh_sdmmc_ids,
+	};
+
+int sdio_func_reg_notify(void* semaphore)
+{
+	notify_semaphore = semaphore;
+	return sdio_register_driver(&dummy_sdmmc_driver);
+}
+
+void sdio_func_unreg_notify(void)
+{
+	OSL_SLEEP(15);
+	sdio_unregister_driver(&dummy_sdmmc_driver);
+}
+
+#endif /* defined(BCMLXSDMMC) */
+
+static struct sdio_driver bcmsdh_sdmmc_driver = {
+	.probe		= bcmsdh_sdmmc_probe,
+	.remove		= bcmsdh_sdmmc_remove,
+	.name		= "bcmsdh_sdmmc",
+	.id_table	= bcmsdh_sdmmc_ids,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM)
+	.drv = {
+	.pm	= &bcmsdh_sdmmc_pm_ops,
+	},
+#endif /* (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) && defined(CONFIG_PM) */
+};
+
+struct sdos_info {
+	sdioh_info_t *sd;
+	spinlock_t lock;
+};
+
+/* Interrupt enable/disable */
+SDIOH_API_RC
+sdioh_interrupt_set(sdioh_info_t *sd, bool enable)
+{
+	if (!sd)
+		return BCME_BADARG;
+
+	sd_trace(("%s: %s\n", __FUNCTION__, enable ? "Enabling" : "Disabling"));
+	return SDIOH_API_RC_SUCCESS;
+}
+
+#ifdef BCMSDH_MODULE
+static int __init
+bcmsdh_module_init(void)
+{
+	int error = 0;
+	error = sdio_function_init();
+	return error;
+}
+
+static void __exit
+bcmsdh_module_cleanup(void)
+{
+	sdio_function_cleanup();
+}
+
+module_init(bcmsdh_module_init);
+module_exit(bcmsdh_module_cleanup);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION(DESCRIPTION);
+MODULE_AUTHOR(AUTHOR);
+
+#endif /* BCMSDH_MODULE */
+/*
+ * module init
+*/
+int bcmsdh_register_client_driver(void)
+{
+#ifdef GLOBAL_SDMMC_INSTANCE
+	gInstance = kzalloc(sizeof(BCMSDH_SDMMC_INSTANCE), GFP_KERNEL);
+	if (!gInstance)
+		return -ENOMEM;
+#endif
+
+	return sdio_register_driver(&bcmsdh_sdmmc_driver);
+}
+
+/*
+ * module cleanup
+*/
+void bcmsdh_unregister_client_driver(void)
+{
+	sdio_unregister_driver(&bcmsdh_sdmmc_driver);
+#ifdef GLOBAL_SDMMC_INSTANCE
+	if (gInstance)
+		kfree(gInstance);
+#endif
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmutils.c b/drivers/net/wireless/bcm4336/bcmutils.c
--- a/drivers/net/wireless/bcm4336/bcmutils.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmutils.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,3067 @@
+/*
+ * Driver O/S-independent utility routines
+ *
+ * $Copyright Open Broadcom Corporation$
+ * $Id: bcmutils.c 496061 2014-08-11 06:14:48Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <stdarg.h>
+#ifdef BCMDRIVER
+
+#include <osl.h>
+#include <bcmutils.h>
+
+#else /* !BCMDRIVER */
+
+#include <stdio.h>
+#include <string.h>
+#include <bcmutils.h>
+
+#if defined(BCMEXTSUP)
+#include <bcm_osl.h>
+#endif
+
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+
+#endif /* !BCMDRIVER */
+
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <proto/ethernet.h>
+#include <proto/vlan.h>
+#include <proto/bcmip.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+
+void *_bcmutils_dummy_fn = NULL;
+
+
+#ifdef CUSTOM_DSCP_TO_PRIO_MAPPING
+#define CUST_IPV4_TOS_PREC_MASK 0x3F
+#define DCSP_MAX_VALUE 64
+/* 0:BE,1:BK,2:RESV(BK):,3:EE,:4:CL,5:VI,6:VO,7:NC */
+int dscp2priomap[DCSP_MAX_VALUE]=
+{
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, /* BK->BE */
+	2, 0, 0, 0, 0, 0, 0, 0,
+	3, 0, 0, 0, 0, 0, 0, 0,
+	4, 0, 0, 0, 0, 0, 0, 0,
+	5, 0, 0, 0, 0, 0, 0, 0,
+	6, 0, 0, 0, 0, 0, 0, 0,
+	7, 0, 0, 0, 0, 0, 0, 0
+};
+#endif /* CUSTOM_DSCP_TO_PRIO_MAPPING */
+
+
+#ifdef BCMDRIVER
+
+
+
+/* copy a pkt buffer chain into a buffer */
+uint
+pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf)
+{
+	uint n, ret = 0;
+
+	if (len < 0)
+		len = 4096;	/* "infinite" */
+
+	/* skip 'offset' bytes */
+	for (; p && offset; p = PKTNEXT(osh, p)) {
+		if (offset < (uint)PKTLEN(osh, p))
+			break;
+		offset -= PKTLEN(osh, p);
+	}
+
+	if (!p)
+		return 0;
+
+	/* copy the data */
+	for (; p && len; p = PKTNEXT(osh, p)) {
+		n = MIN((uint)PKTLEN(osh, p) - offset, (uint)len);
+		bcopy(PKTDATA(osh, p) + offset, buf, n);
+		buf += n;
+		len -= n;
+		ret += n;
+		offset = 0;
+	}
+
+	return ret;
+}
+
+/* copy a buffer into a pkt buffer chain */
+uint
+pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf)
+{
+	uint n, ret = 0;
+
+
+	/* skip 'offset' bytes */
+	for (; p && offset; p = PKTNEXT(osh, p)) {
+		if (offset < (uint)PKTLEN(osh, p))
+			break;
+		offset -= PKTLEN(osh, p);
+	}
+
+	if (!p)
+		return 0;
+
+	/* copy the data */
+	for (; p && len; p = PKTNEXT(osh, p)) {
+		n = MIN((uint)PKTLEN(osh, p) - offset, (uint)len);
+		bcopy(buf, PKTDATA(osh, p) + offset, n);
+		buf += n;
+		len -= n;
+		ret += n;
+		offset = 0;
+	}
+
+	return ret;
+}
+
+
+
+/* return total length of buffer chain */
+uint BCMFASTPATH
+pkttotlen(osl_t *osh, void *p)
+{
+	uint total;
+	int len;
+
+	total = 0;
+	for (; p; p = PKTNEXT(osh, p)) {
+		len = PKTLEN(osh, p);
+		total += len;
+#ifdef BCMLFRAG
+		if (BCMLFRAG_ENAB()) {
+			if (PKTISFRAG(osh, p)) {
+				total += PKTFRAGTOTLEN(osh, p);
+			}
+		}
+#endif
+	}
+
+	return (total);
+}
+
+/* return the last buffer of chained pkt */
+void *
+pktlast(osl_t *osh, void *p)
+{
+	for (; PKTNEXT(osh, p); p = PKTNEXT(osh, p))
+		;
+
+	return (p);
+}
+
+/* count segments of a chained packet */
+uint BCMFASTPATH
+pktsegcnt(osl_t *osh, void *p)
+{
+	uint cnt;
+
+	for (cnt = 0; p; p = PKTNEXT(osh, p)) {
+		cnt++;
+#ifdef BCMLFRAG
+		if (BCMLFRAG_ENAB()) {
+			if (PKTISFRAG(osh, p)) {
+				cnt += PKTFRAGTOTNUM(osh, p);
+			}
+		}
+#endif
+	}
+
+	return cnt;
+}
+
+
+/* count segments of a chained packet */
+uint BCMFASTPATH
+pktsegcnt_war(osl_t *osh, void *p)
+{
+	uint cnt;
+	uint8 *pktdata;
+	uint len, remain, align64;
+
+	for (cnt = 0; p; p = PKTNEXT(osh, p)) {
+		cnt++;
+		len = PKTLEN(osh, p);
+		if (len > 128) {
+			pktdata = (uint8 *)PKTDATA(osh, p);	/* starting address of data */
+			/* Check for page boundary straddle (2048B) */
+			if (((uintptr)pktdata & ~0x7ff) != ((uintptr)(pktdata+len) & ~0x7ff))
+				cnt++;
+
+			align64 = (uint)((uintptr)pktdata & 0x3f);	/* aligned to 64B */
+			align64 = (64 - align64) & 0x3f;
+			len -= align64;		/* bytes from aligned 64B to end */
+			/* if aligned to 128B, check for MOD 128 between 1 to 4B */
+			remain = len % 128;
+			if (remain > 0 && remain <= 4)
+				cnt++;		/* add extra seg */
+		}
+	}
+
+	return cnt;
+}
+
+uint8 * BCMFASTPATH
+pktdataoffset(osl_t *osh, void *p,  uint offset)
+{
+	uint total = pkttotlen(osh, p);
+	uint pkt_off = 0, len = 0;
+	uint8 *pdata = (uint8 *) PKTDATA(osh, p);
+
+	if (offset > total)
+		return NULL;
+
+	for (; p; p = PKTNEXT(osh, p)) {
+		pdata = (uint8 *) PKTDATA(osh, p);
+		pkt_off = offset - len;
+		len += PKTLEN(osh, p);
+		if (len > offset)
+			break;
+	}
+	return (uint8*) (pdata+pkt_off);
+}
+
+
+/* given a offset in pdata, find the pkt seg hdr */
+void *
+pktoffset(osl_t *osh, void *p,  uint offset)
+{
+	uint total = pkttotlen(osh, p);
+	uint len = 0;
+
+	if (offset > total)
+		return NULL;
+
+	for (; p; p = PKTNEXT(osh, p)) {
+		len += PKTLEN(osh, p);
+		if (len > offset)
+			break;
+	}
+	return p;
+}
+
+#endif /* BCMDRIVER */
+
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
+const unsigned char bcm_ctype[] = {
+
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 0-7 */
+	_BCM_C, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C|_BCM_S, _BCM_C,
+	_BCM_C,	/* 8-15 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 16-23 */
+	_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,_BCM_C,			/* 24-31 */
+	_BCM_S|_BCM_SP,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,		/* 32-39 */
+	_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 40-47 */
+	_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,_BCM_D,			/* 48-55 */
+	_BCM_D,_BCM_D,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 56-63 */
+	_BCM_P, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X, _BCM_U|_BCM_X,
+	_BCM_U|_BCM_X, _BCM_U, /* 64-71 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,			/* 72-79 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,_BCM_U,			/* 80-87 */
+	_BCM_U,_BCM_U,_BCM_U,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_P,			/* 88-95 */
+	_BCM_P, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X, _BCM_L|_BCM_X,
+	_BCM_L|_BCM_X, _BCM_L, /* 96-103 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 104-111 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L,_BCM_L, /* 112-119 */
+	_BCM_L,_BCM_L,_BCM_L,_BCM_P,_BCM_P,_BCM_P,_BCM_P,_BCM_C, /* 120-127 */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,		/* 128-143 */
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,		/* 144-159 */
+	_BCM_S|_BCM_SP, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,	/* 160-175 */
+	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,
+	_BCM_P, _BCM_P, _BCM_P, _BCM_P, _BCM_P,	/* 176-191 */
+	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,
+	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U,	/* 192-207 */
+	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_P, _BCM_U, _BCM_U, _BCM_U,
+	_BCM_U, _BCM_U, _BCM_U, _BCM_U, _BCM_L,	/* 208-223 */
+	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,
+	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L,	/* 224-239 */
+	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_P, _BCM_L, _BCM_L, _BCM_L,
+	_BCM_L, _BCM_L, _BCM_L, _BCM_L, _BCM_L /* 240-255 */
+};
+
+ulong
+bcm_strtoul(const char *cp, char **endp, uint base)
+{
+	ulong result, last_result = 0, value;
+	bool minus;
+
+	minus = FALSE;
+
+	while (bcm_isspace(*cp))
+		cp++;
+
+	if (cp[0] == '+')
+		cp++;
+	else if (cp[0] == '-') {
+		minus = TRUE;
+		cp++;
+	}
+
+	if (base == 0) {
+		if (cp[0] == '0') {
+			if ((cp[1] == 'x') || (cp[1] == 'X')) {
+				base = 16;
+				cp = &cp[2];
+			} else {
+				base = 8;
+				cp = &cp[1];
+			}
+		} else
+			base = 10;
+	} else if (base == 16 && (cp[0] == '0') && ((cp[1] == 'x') || (cp[1] == 'X'))) {
+		cp = &cp[2];
+	}
+
+	result = 0;
+
+	while (bcm_isxdigit(*cp) &&
+	       (value = bcm_isdigit(*cp) ? *cp-'0' : bcm_toupper(*cp)-'A'+10) < base) {
+		result = result*base + value;
+		/* Detected overflow */
+		if (result < last_result && !minus)
+			return (ulong)-1;
+		last_result = result;
+		cp++;
+	}
+
+	if (minus)
+		result = (ulong)(-(long)result);
+
+	if (endp)
+		*endp = DISCARD_QUAL(cp, char);
+
+	return (result);
+}
+
+int
+bcm_atoi(const char *s)
+{
+	return (int)bcm_strtoul(s, NULL, 10);
+}
+
+/* return pointer to location of substring 'needle' in 'haystack' */
+char *
+bcmstrstr(const char *haystack, const char *needle)
+{
+	int len, nlen;
+	int i;
+
+	if ((haystack == NULL) || (needle == NULL))
+		return DISCARD_QUAL(haystack, char);
+
+	nlen = (int)strlen(needle);
+	len = (int)strlen(haystack) - nlen + 1;
+
+	for (i = 0; i < len; i++)
+		if (memcmp(needle, &haystack[i], nlen) == 0)
+			return DISCARD_QUAL(&haystack[i], char);
+	return (NULL);
+}
+
+char *
+bcmstrnstr(const char *s, uint s_len, const char *substr, uint substr_len)
+{
+	for (; s_len >= substr_len; s++, s_len--)
+		if (strncmp(s, substr, substr_len) == 0)
+			return DISCARD_QUAL(s, char);
+
+	return NULL;
+}
+
+char *
+bcmstrcat(char *dest, const char *src)
+{
+	char *p;
+
+	p = dest + strlen(dest);
+
+	while ((*p++ = *src++) != '\0')
+		;
+
+	return (dest);
+}
+
+char *
+bcmstrncat(char *dest, const char *src, uint size)
+{
+	char *endp;
+	char *p;
+
+	p = dest + strlen(dest);
+	endp = p + size;
+
+	while (p != endp && (*p++ = *src++) != '\0')
+		;
+
+	return (dest);
+}
+
+
+/****************************************************************************
+* Function:   bcmstrtok
+*
+* Purpose:
+*  Tokenizes a string. This function is conceptually similiar to ANSI C strtok(),
+*  but allows strToken() to be used by different strings or callers at the same
+*  time. Each call modifies '*string' by substituting a NULL character for the
+*  first delimiter that is encountered, and updates 'string' to point to the char
+*  after the delimiter. Leading delimiters are skipped.
+*
+* Parameters:
+*  string      (mod) Ptr to string ptr, updated by token.
+*  delimiters  (in)  Set of delimiter characters.
+*  tokdelim    (out) Character that delimits the returned token. (May
+*                    be set to NULL if token delimiter is not required).
+*
+* Returns:  Pointer to the next token found. NULL when no more tokens are found.
+*****************************************************************************
+*/
+char *
+bcmstrtok(char **string, const char *delimiters, char *tokdelim)
+{
+	unsigned char *str;
+	unsigned long map[8];
+	int count;
+	char *nextoken;
+
+	if (tokdelim != NULL) {
+		/* Prime the token delimiter */
+		*tokdelim = '\0';
+	}
+
+	/* Clear control map */
+	for (count = 0; count < 8; count++) {
+		map[count] = 0;
+	}
+
+	/* Set bits in delimiter table */
+	do {
+		map[*delimiters >> 5] |= (1 << (*delimiters & 31));
+	}
+	while (*delimiters++);
+
+	str = (unsigned char*)*string;
+
+	/* Find beginning of token (skip over leading delimiters). Note that
+	 * there is no token iff this loop sets str to point to the terminal
+	 * null (*str == '\0')
+	 */
+	while (((map[*str >> 5] & (1 << (*str & 31))) && *str) || (*str == ' ')) {
+		str++;
+	}
+
+	nextoken = (char*)str;
+
+	/* Find the end of the token. If it is not the end of the string,
+	 * put a null there.
+	 */
+	for (; *str; str++) {
+		if (map[*str >> 5] & (1 << (*str & 31))) {
+			if (tokdelim != NULL) {
+				*tokdelim = *str;
+			}
+
+			*str++ = '\0';
+			break;
+		}
+	}
+
+	*string = (char*)str;
+
+	/* Determine if a token has been found. */
+	if (nextoken == (char *) str) {
+		return NULL;
+	}
+	else {
+		return nextoken;
+	}
+}
+
+
+#define xToLower(C) \
+	((C >= 'A' && C <= 'Z') ? (char)((int)C - (int)'A' + (int)'a') : C)
+
+
+/****************************************************************************
+* Function:   bcmstricmp
+*
+* Purpose:    Compare to strings case insensitively.
+*
+* Parameters: s1 (in) First string to compare.
+*             s2 (in) Second string to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstricmp(const char *s1, const char *s2)
+{
+	char dc, sc;
+
+	while (*s2 && *s1) {
+		dc = xToLower(*s1);
+		sc = xToLower(*s2);
+		if (dc < sc) return -1;
+		if (dc > sc) return 1;
+		s1++;
+		s2++;
+	}
+
+	if (*s1 && !*s2) return 1;
+	if (!*s1 && *s2) return -1;
+	return 0;
+}
+
+
+/****************************************************************************
+* Function:   bcmstrnicmp
+*
+* Purpose:    Compare to strings case insensitively, upto a max of 'cnt'
+*             characters.
+*
+* Parameters: s1  (in) First string to compare.
+*             s2  (in) Second string to compare.
+*             cnt (in) Max characters to compare.
+*
+* Returns:    Return 0 if the two strings are equal, -1 if t1 < t2 and 1 if
+*             t1 > t2, when ignoring case sensitivity.
+*****************************************************************************
+*/
+int
+bcmstrnicmp(const char* s1, const char* s2, int cnt)
+{
+	char dc, sc;
+
+	while (*s2 && *s1 && cnt) {
+		dc = xToLower(*s1);
+		sc = xToLower(*s2);
+		if (dc < sc) return -1;
+		if (dc > sc) return 1;
+		s1++;
+		s2++;
+		cnt--;
+	}
+
+	if (!cnt) return 0;
+	if (*s1 && !*s2) return 1;
+	if (!*s1 && *s2) return -1;
+	return 0;
+}
+
+/* parse a xx:xx:xx:xx:xx:xx format ethernet address */
+int
+bcm_ether_atoe(const char *p, struct ether_addr *ea)
+{
+	int i = 0;
+	char *ep;
+
+	for (;;) {
+		ea->octet[i++] = (char) bcm_strtoul(p, &ep, 16);
+		p = ep;
+		if (!*p++ || i == 6)
+			break;
+	}
+
+	return (i == 6);
+}
+
+int
+bcm_atoipv4(const char *p, struct ipv4_addr *ip)
+{
+
+	int i = 0;
+	char *c;
+	for (;;) {
+		ip->addr[i++] = (uint8)bcm_strtoul(p, &c, 0);
+		if (*c++ != '.' || i == IPV4_ADDR_LEN)
+			break;
+		p = c;
+	}
+	return (i == IPV4_ADDR_LEN);
+}
+#endif	/* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
+
+
+#if defined(CONFIG_USBRNDIS_RETAIL) || defined(NDIS_MINIPORT_DRIVER)
+/* registry routine buffer preparation utility functions:
+ * parameter order is like strncpy, but returns count
+ * of bytes copied. Minimum bytes copied is null char(1)/wchar(2)
+ */
+ulong
+wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen)
+{
+	ulong copyct = 1;
+	ushort i;
+
+	if (abuflen == 0)
+		return 0;
+
+	/* wbuflen is in bytes */
+	wbuflen /= sizeof(ushort);
+
+	for (i = 0; i < wbuflen; ++i) {
+		if (--abuflen == 0)
+			break;
+		*abuf++ = (char) *wbuf++;
+		++copyct;
+	}
+	*abuf = '\0';
+
+	return copyct;
+}
+#endif /* CONFIG_USBRNDIS_RETAIL || NDIS_MINIPORT_DRIVER */
+
+char *
+bcm_ether_ntoa(const struct ether_addr *ea, char *buf)
+{
+	static const char hex[] =
+	  {
+		  '0', '1', '2', '3', '4', '5', '6', '7',
+		  '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
+	  };
+	const uint8 *octet = ea->octet;
+	char *p = buf;
+	int i;
+
+	for (i = 0; i < 6; i++, octet++) {
+		*p++ = hex[(*octet >> 4) & 0xf];
+		*p++ = hex[*octet & 0xf];
+		*p++ = ':';
+	}
+
+	*(p-1) = '\0';
+
+	return (buf);
+}
+
+char *
+bcm_ip_ntoa(struct ipv4_addr *ia, char *buf)
+{
+	snprintf(buf, 16, "%d.%d.%d.%d",
+	         ia->addr[0], ia->addr[1], ia->addr[2], ia->addr[3]);
+	return (buf);
+}
+
+char *
+bcm_ipv6_ntoa(void *ipv6, char *buf)
+{
+	/* Implementing RFC 5952 Sections 4 + 5 */
+	/* Not thoroughly tested */
+	uint16 tmp[8];
+	uint16 *a = &tmp[0];
+	char *p = buf;
+	int i, i_max = -1, cnt = 0, cnt_max = 1;
+	uint8 *a4 = NULL;
+	memcpy((uint8 *)&tmp[0], (uint8 *)ipv6, IPV6_ADDR_LEN);
+
+	for (i = 0; i < IPV6_ADDR_LEN/2; i++) {
+		if (a[i]) {
+			if (cnt > cnt_max) {
+				cnt_max = cnt;
+				i_max = i - cnt;
+			}
+			cnt = 0;
+		} else
+			cnt++;
+	}
+	if (cnt > cnt_max) {
+		cnt_max = cnt;
+		i_max = i - cnt;
+	}
+	if (i_max == 0 &&
+		/* IPv4-translated: ::ffff:0:a.b.c.d */
+		((cnt_max == 4 && a[4] == 0xffff && a[5] == 0) ||
+		/* IPv4-mapped: ::ffff:a.b.c.d */
+		(cnt_max == 5 && a[5] == 0xffff)))
+		a4 = (uint8*) (a + 6);
+
+	for (i = 0; i < IPV6_ADDR_LEN/2; i++) {
+		if ((uint8*) (a + i) == a4) {
+			snprintf(p, 16, ":%u.%u.%u.%u", a4[0], a4[1], a4[2], a4[3]);
+			break;
+		} else if (i == i_max) {
+			*p++ = ':';
+			i += cnt_max - 1;
+			p[0] = ':';
+			p[1] = '\0';
+		} else {
+			if (i)
+				*p++ = ':';
+			p += snprintf(p, 8, "%x", ntoh16(a[i]));
+		}
+	}
+
+	return buf;
+}
+#ifdef BCMDRIVER
+
+void
+bcm_mdelay(uint ms)
+{
+	uint i;
+
+	for (i = 0; i < ms; i++) {
+		OSL_DELAY(1000);
+	}
+}
+
+
+
+
+
+#if defined(DHD_DEBUG)
+/* pretty hex print a pkt buffer chain */
+void
+prpkt(const char *msg, osl_t *osh, void *p0)
+{
+	void *p;
+
+	if (msg && (msg[0] != '\0'))
+		printf("%s:\n", msg);
+
+	for (p = p0; p; p = PKTNEXT(osh, p))
+		prhex(NULL, PKTDATA(osh, p), PKTLEN(osh, p));
+}
+#endif
+
+/* Takes an Ethernet frame and sets out-of-bound PKTPRIO.
+ * Also updates the inplace vlan tag if requested.
+ * For debugging, it returns an indication of what it did.
+ */
+uint BCMFASTPATH
+pktsetprio(void *pkt, bool update_vtag)
+{
+	struct ether_header *eh;
+	struct ethervlan_header *evh;
+	uint8 *pktdata;
+	int priority = 0;
+	int rc = 0;
+
+	pktdata = (uint8 *)PKTDATA(OSH_NULL, pkt);
+	ASSERT(ISALIGNED((uintptr)pktdata, sizeof(uint16)));
+
+	eh = (struct ether_header *) pktdata;
+
+	if (eh->ether_type == hton16(ETHER_TYPE_8021Q)) {
+		uint16 vlan_tag;
+		int vlan_prio, dscp_prio = 0;
+
+		evh = (struct ethervlan_header *)eh;
+
+		vlan_tag = ntoh16(evh->vlan_tag);
+		vlan_prio = (int) (vlan_tag >> VLAN_PRI_SHIFT) & VLAN_PRI_MASK;
+
+		if ((evh->ether_type == hton16(ETHER_TYPE_IP)) ||
+			(evh->ether_type == hton16(ETHER_TYPE_IPV6))) {
+			uint8 *ip_body = pktdata + sizeof(struct ethervlan_header);
+			uint8 tos_tc = IP_TOS46(ip_body);
+			dscp_prio = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+		}
+
+		/* DSCP priority gets precedence over 802.1P (vlan tag) */
+		if (dscp_prio != 0) {
+			priority = dscp_prio;
+			rc |= PKTPRIO_VDSCP;
+		} else {
+			priority = vlan_prio;
+			rc |= PKTPRIO_VLAN;
+		}
+		/*
+		 * If the DSCP priority is not the same as the VLAN priority,
+		 * then overwrite the priority field in the vlan tag, with the
+		 * DSCP priority value. This is required for Linux APs because
+		 * the VLAN driver on Linux, overwrites the skb->priority field
+		 * with the priority value in the vlan tag
+		 */
+		if (update_vtag && (priority != vlan_prio)) {
+			vlan_tag &= ~(VLAN_PRI_MASK << VLAN_PRI_SHIFT);
+			vlan_tag |= (uint16)priority << VLAN_PRI_SHIFT;
+			evh->vlan_tag = hton16(vlan_tag);
+			rc |= PKTPRIO_UPD;
+		}
+	} else if ((eh->ether_type == hton16(ETHER_TYPE_IP)) ||
+		(eh->ether_type == hton16(ETHER_TYPE_IPV6))) {
+		uint8 *ip_body = pktdata + sizeof(struct ether_header);
+		uint8 tos_tc = IP_TOS46(ip_body);
+		uint8 dscp = tos_tc >> IPV4_TOS_DSCP_SHIFT;
+		switch (dscp) {
+		case DSCP_EF:
+			priority = PRIO_8021D_VO;
+			break;
+		case DSCP_AF31:
+		case DSCP_AF32:
+		case DSCP_AF33:
+			priority = PRIO_8021D_CL;
+			break;
+		case DSCP_AF21:
+		case DSCP_AF22:
+		case DSCP_AF23:
+		case DSCP_AF11:
+		case DSCP_AF12:
+		case DSCP_AF13:
+			priority = PRIO_8021D_EE;
+			break;
+		default:
+#ifndef CUSTOM_DSCP_TO_PRIO_MAPPING
+			priority = (int)(tos_tc >> IPV4_TOS_PREC_SHIFT);
+#else
+			priority = (int)dscp2priomap[((tos_tc >> IPV4_TOS_DSCP_SHIFT)
+				& CUST_IPV4_TOS_PREC_MASK)];
+#endif
+			break;
+		}
+
+		rc |= PKTPRIO_DSCP;
+	}
+
+	ASSERT(priority >= 0 && priority <= MAXPRIO);
+	PKTSETPRIO(pkt, priority);
+	return (rc | priority);
+}
+
+/* Returns TRUE and DSCP if IP header found, FALSE otherwise.
+ */
+bool BCMFASTPATH
+pktgetdscp(uint8 *pktdata, uint pktlen, uint8 *dscp)
+{
+	struct ether_header *eh;
+	struct ethervlan_header *evh;
+	uint8 *ip_body;
+	bool rc = FALSE;
+
+	/* minimum length is ether header and IP header */
+	if (pktlen < sizeof(struct ether_header) + IPV4_MIN_HEADER_LEN)
+		return FALSE;
+
+	eh = (struct ether_header *) pktdata;
+
+	if (eh->ether_type == HTON16(ETHER_TYPE_IP)) {
+		ip_body = pktdata + sizeof(struct ether_header);
+		*dscp = IP_DSCP46(ip_body);
+		rc = TRUE;
+	}
+	else if (eh->ether_type == HTON16(ETHER_TYPE_8021Q)) {
+		evh = (struct ethervlan_header *)eh;
+
+		/* minimum length is ethervlan header and IP header */
+		if (pktlen >= sizeof(struct ethervlan_header) + IPV4_MIN_HEADER_LEN &&
+			evh->ether_type == HTON16(ETHER_TYPE_IP)) {
+			ip_body = pktdata + sizeof(struct ethervlan_header);
+			*dscp = IP_DSCP46(ip_body);
+			rc = TRUE;
+		}
+	}
+
+	return rc;
+}
+
+/* The 0.5KB string table is not removed by compiler even though it's unused */
+
+static char bcm_undeferrstr[32];
+static const char *bcmerrorstrtable[] = BCMERRSTRINGTABLE;
+
+/* Convert the error codes into related error strings  */
+const char *
+bcmerrorstr(int bcmerror)
+{
+	/* check if someone added a bcmerror code but forgot to add errorstring */
+	ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(bcmerrorstrtable) - 1));
+
+	if (bcmerror > 0 || bcmerror < BCME_LAST) {
+		snprintf(bcm_undeferrstr, sizeof(bcm_undeferrstr), "Undefined error %d", bcmerror);
+		return bcm_undeferrstr;
+	}
+
+	ASSERT(strlen(bcmerrorstrtable[-bcmerror]) < BCME_STRLEN);
+
+	return bcmerrorstrtable[-bcmerror];
+}
+
+
+
+/* iovar table lookup */
+/* could mandate sorted tables and do a binary search */
+const bcm_iovar_t*
+bcm_iovar_lookup(const bcm_iovar_t *table, const char *name)
+{
+	const bcm_iovar_t *vi;
+	const char *lookup_name;
+
+	/* skip any ':' delimited option prefixes */
+	lookup_name = strrchr(name, ':');
+	if (lookup_name != NULL)
+		lookup_name++;
+	else
+		lookup_name = name;
+
+	ASSERT(table != NULL);
+
+	for (vi = table; vi->name; vi++) {
+		if (!strcmp(vi->name, lookup_name))
+			return vi;
+	}
+	/* ran to end of table */
+
+	return NULL; /* var name not found */
+}
+
+int
+bcm_iovar_lencheck(const bcm_iovar_t *vi, void *arg, int len, bool set)
+{
+	int bcmerror = 0;
+
+	/* length check on io buf */
+	switch (vi->type) {
+	case IOVT_BOOL:
+	case IOVT_INT8:
+	case IOVT_INT16:
+	case IOVT_INT32:
+	case IOVT_UINT8:
+	case IOVT_UINT16:
+	case IOVT_UINT32:
+		/* all integers are int32 sized args at the ioctl interface */
+		if (len < (int)sizeof(int)) {
+			bcmerror = BCME_BUFTOOSHORT;
+		}
+		break;
+
+	case IOVT_BUFFER:
+		/* buffer must meet minimum length requirement */
+		if (len < vi->minlen) {
+			bcmerror = BCME_BUFTOOSHORT;
+		}
+		break;
+
+	case IOVT_VOID:
+		if (!set) {
+			/* Cannot return nil... */
+			bcmerror = BCME_UNSUPPORTED;
+		} else if (len) {
+			/* Set is an action w/o parameters */
+			bcmerror = BCME_BUFTOOLONG;
+		}
+		break;
+
+	default:
+		/* unknown type for length check in iovar info */
+		ASSERT(0);
+		bcmerror = BCME_UNSUPPORTED;
+	}
+
+	return bcmerror;
+}
+
+#endif	/* BCMDRIVER */
+
+
+uint8 *
+bcm_write_tlv(int type, const void *data, int datalen, uint8 *dst)
+{
+	uint8 *new_dst = dst;
+	bcm_tlv_t *dst_tlv = (bcm_tlv_t *)dst;
+
+	/* dst buffer should always be valid */
+	ASSERT(dst);
+
+	/* data len must be within valid range */
+	ASSERT((datalen >= 0) && (datalen <= BCM_TLV_MAX_DATA_SIZE));
+
+	/* source data buffer pointer should be valid, unless datalen is 0
+	 * meaning no data with this TLV
+	 */
+	ASSERT((data != NULL) || (datalen == 0));
+
+	/* only do work if the inputs are valid
+	 * - must have a dst to write to AND
+	 * - datalen must be within range AND
+	 * - the source data pointer must be non-NULL if datalen is non-zero
+	 * (this last condition detects datalen > 0 with a NULL data pointer)
+	 */
+	if ((dst != NULL) &&
+	    ((datalen >= 0) && (datalen <= BCM_TLV_MAX_DATA_SIZE)) &&
+	    ((data != NULL) || (datalen == 0))) {
+
+	        /* write type, len fields */
+		dst_tlv->id = (uint8)type;
+	        dst_tlv->len = (uint8)datalen;
+
+		/* if data is present, copy to the output buffer and update
+		 * pointer to output buffer
+		 */
+		if (datalen > 0) {
+
+			memcpy(dst_tlv->data, data, datalen);
+		}
+
+		/* update the output destination poitner to point past
+		 * the TLV written
+		 */
+		new_dst = dst + BCM_TLV_HDR_SIZE + datalen;
+	}
+
+	return (new_dst);
+}
+
+uint8 *
+bcm_write_tlv_safe(int type, const void *data, int datalen, uint8 *dst, int dst_maxlen)
+{
+	uint8 *new_dst = dst;
+
+	if ((datalen >= 0) && (datalen <= BCM_TLV_MAX_DATA_SIZE)) {
+
+		/* if len + tlv hdr len is more than destlen, don't do anything
+		 * just return the buffer untouched
+		 */
+		if ((int)(datalen + BCM_TLV_HDR_SIZE) <= dst_maxlen) {
+
+			new_dst = bcm_write_tlv(type, data, datalen, dst);
+		}
+	}
+
+	return (new_dst);
+}
+
+uint8 *
+bcm_copy_tlv(const void *src, uint8 *dst)
+{
+	uint8 *new_dst = dst;
+	const bcm_tlv_t *src_tlv = (const bcm_tlv_t *)src;
+	uint totlen;
+
+	ASSERT(dst && src);
+	if (dst && src) {
+
+		totlen = BCM_TLV_HDR_SIZE + src_tlv->len;
+		memcpy(dst, src_tlv, totlen);
+		new_dst = dst + totlen;
+	}
+
+	return (new_dst);
+}
+
+
+uint8 *bcm_copy_tlv_safe(const void *src, uint8 *dst, int dst_maxlen)
+{
+	uint8 *new_dst = dst;
+	const bcm_tlv_t *src_tlv = (const bcm_tlv_t *)src;
+
+	ASSERT(src);
+	if (src) {
+		if (bcm_valid_tlv(src_tlv, dst_maxlen)) {
+			new_dst = bcm_copy_tlv(src, dst);
+		}
+	}
+
+	return (new_dst);
+}
+
+
+#if !defined(BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS)
+/*******************************************************************************
+ * crc8
+ *
+ * Computes a crc8 over the input data using the polynomial:
+ *
+ *       x^8 + x^7 +x^6 + x^4 + x^2 + 1
+ *
+ * The caller provides the initial value (either CRC8_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC8_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint8 crc8_table[256] = {
+    0x00, 0xF7, 0xB9, 0x4E, 0x25, 0xD2, 0x9C, 0x6B,
+    0x4A, 0xBD, 0xF3, 0x04, 0x6F, 0x98, 0xD6, 0x21,
+    0x94, 0x63, 0x2D, 0xDA, 0xB1, 0x46, 0x08, 0xFF,
+    0xDE, 0x29, 0x67, 0x90, 0xFB, 0x0C, 0x42, 0xB5,
+    0x7F, 0x88, 0xC6, 0x31, 0x5A, 0xAD, 0xE3, 0x14,
+    0x35, 0xC2, 0x8C, 0x7B, 0x10, 0xE7, 0xA9, 0x5E,
+    0xEB, 0x1C, 0x52, 0xA5, 0xCE, 0x39, 0x77, 0x80,
+    0xA1, 0x56, 0x18, 0xEF, 0x84, 0x73, 0x3D, 0xCA,
+    0xFE, 0x09, 0x47, 0xB0, 0xDB, 0x2C, 0x62, 0x95,
+    0xB4, 0x43, 0x0D, 0xFA, 0x91, 0x66, 0x28, 0xDF,
+    0x6A, 0x9D, 0xD3, 0x24, 0x4F, 0xB8, 0xF6, 0x01,
+    0x20, 0xD7, 0x99, 0x6E, 0x05, 0xF2, 0xBC, 0x4B,
+    0x81, 0x76, 0x38, 0xCF, 0xA4, 0x53, 0x1D, 0xEA,
+    0xCB, 0x3C, 0x72, 0x85, 0xEE, 0x19, 0x57, 0xA0,
+    0x15, 0xE2, 0xAC, 0x5B, 0x30, 0xC7, 0x89, 0x7E,
+    0x5F, 0xA8, 0xE6, 0x11, 0x7A, 0x8D, 0xC3, 0x34,
+    0xAB, 0x5C, 0x12, 0xE5, 0x8E, 0x79, 0x37, 0xC0,
+    0xE1, 0x16, 0x58, 0xAF, 0xC4, 0x33, 0x7D, 0x8A,
+    0x3F, 0xC8, 0x86, 0x71, 0x1A, 0xED, 0xA3, 0x54,
+    0x75, 0x82, 0xCC, 0x3B, 0x50, 0xA7, 0xE9, 0x1E,
+    0xD4, 0x23, 0x6D, 0x9A, 0xF1, 0x06, 0x48, 0xBF,
+    0x9E, 0x69, 0x27, 0xD0, 0xBB, 0x4C, 0x02, 0xF5,
+    0x40, 0xB7, 0xF9, 0x0E, 0x65, 0x92, 0xDC, 0x2B,
+    0x0A, 0xFD, 0xB3, 0x44, 0x2F, 0xD8, 0x96, 0x61,
+    0x55, 0xA2, 0xEC, 0x1B, 0x70, 0x87, 0xC9, 0x3E,
+    0x1F, 0xE8, 0xA6, 0x51, 0x3A, 0xCD, 0x83, 0x74,
+    0xC1, 0x36, 0x78, 0x8F, 0xE4, 0x13, 0x5D, 0xAA,
+    0x8B, 0x7C, 0x32, 0xC5, 0xAE, 0x59, 0x17, 0xE0,
+    0x2A, 0xDD, 0x93, 0x64, 0x0F, 0xF8, 0xB6, 0x41,
+    0x60, 0x97, 0xD9, 0x2E, 0x45, 0xB2, 0xFC, 0x0B,
+    0xBE, 0x49, 0x07, 0xF0, 0x9B, 0x6C, 0x22, 0xD5,
+    0xF4, 0x03, 0x4D, 0xBA, 0xD1, 0x26, 0x68, 0x9F
+};
+
+#define CRC_INNER_LOOP(n, c, x) \
+	(c) = ((c) >> 8) ^ crc##n##_table[((c) ^ (x)) & 0xff]
+
+uint8
+hndcrc8(
+	uint8 *pdata,	/* pointer to array of data to process */
+	uint  nbytes,	/* number of input data bytes to process */
+	uint8 crc	/* either CRC8_INIT_VALUE or previous return value */
+)
+{
+	/* hard code the crc loop instead of using CRC_INNER_LOOP macro
+	 * to avoid the undefined and unnecessary (uint8 >> 8) operation.
+	 */
+	while (nbytes-- > 0)
+		crc = crc8_table[(crc ^ *pdata++) & 0xff];
+
+	return crc;
+}
+
+/*******************************************************************************
+ * crc16
+ *
+ * Computes a crc16 over the input data using the polynomial:
+ *
+ *       x^16 + x^12 +x^5 + 1
+ *
+ * The caller provides the initial value (either CRC16_INIT_VALUE
+ * or the previous returned value) to allow for processing of
+ * discontiguous blocks of data.  When generating the CRC the
+ * caller is responsible for complementing the final return value
+ * and inserting it into the byte stream.  When checking, a final
+ * return value of CRC16_GOOD_VALUE indicates a valid CRC.
+ *
+ * Reference: Dallas Semiconductor Application Note 27
+ *   Williams, Ross N., "A Painless Guide to CRC Error Detection Algorithms",
+ *     ver 3, Aug 1993, ross@guest.adelaide.edu.au, Rocksoft Pty Ltd.,
+ *     ftp://ftp.rocksoft.com/clients/rocksoft/papers/crc_v3.txt
+ *
+ * ****************************************************************************
+ */
+
+static const uint16 crc16_table[256] = {
+    0x0000, 0x1189, 0x2312, 0x329B, 0x4624, 0x57AD, 0x6536, 0x74BF,
+    0x8C48, 0x9DC1, 0xAF5A, 0xBED3, 0xCA6C, 0xDBE5, 0xE97E, 0xF8F7,
+    0x1081, 0x0108, 0x3393, 0x221A, 0x56A5, 0x472C, 0x75B7, 0x643E,
+    0x9CC9, 0x8D40, 0xBFDB, 0xAE52, 0xDAED, 0xCB64, 0xF9FF, 0xE876,
+    0x2102, 0x308B, 0x0210, 0x1399, 0x6726, 0x76AF, 0x4434, 0x55BD,
+    0xAD4A, 0xBCC3, 0x8E58, 0x9FD1, 0xEB6E, 0xFAE7, 0xC87C, 0xD9F5,
+    0x3183, 0x200A, 0x1291, 0x0318, 0x77A7, 0x662E, 0x54B5, 0x453C,
+    0xBDCB, 0xAC42, 0x9ED9, 0x8F50, 0xFBEF, 0xEA66, 0xD8FD, 0xC974,
+    0x4204, 0x538D, 0x6116, 0x709F, 0x0420, 0x15A9, 0x2732, 0x36BB,
+    0xCE4C, 0xDFC5, 0xED5E, 0xFCD7, 0x8868, 0x99E1, 0xAB7A, 0xBAF3,
+    0x5285, 0x430C, 0x7197, 0x601E, 0x14A1, 0x0528, 0x37B3, 0x263A,
+    0xDECD, 0xCF44, 0xFDDF, 0xEC56, 0x98E9, 0x8960, 0xBBFB, 0xAA72,
+    0x6306, 0x728F, 0x4014, 0x519D, 0x2522, 0x34AB, 0x0630, 0x17B9,
+    0xEF4E, 0xFEC7, 0xCC5C, 0xDDD5, 0xA96A, 0xB8E3, 0x8A78, 0x9BF1,
+    0x7387, 0x620E, 0x5095, 0x411C, 0x35A3, 0x242A, 0x16B1, 0x0738,
+    0xFFCF, 0xEE46, 0xDCDD, 0xCD54, 0xB9EB, 0xA862, 0x9AF9, 0x8B70,
+    0x8408, 0x9581, 0xA71A, 0xB693, 0xC22C, 0xD3A5, 0xE13E, 0xF0B7,
+    0x0840, 0x19C9, 0x2B52, 0x3ADB, 0x4E64, 0x5FED, 0x6D76, 0x7CFF,
+    0x9489, 0x8500, 0xB79B, 0xA612, 0xD2AD, 0xC324, 0xF1BF, 0xE036,
+    0x18C1, 0x0948, 0x3BD3, 0x2A5A, 0x5EE5, 0x4F6C, 0x7DF7, 0x6C7E,
+    0xA50A, 0xB483, 0x8618, 0x9791, 0xE32E, 0xF2A7, 0xC03C, 0xD1B5,
+    0x2942, 0x38CB, 0x0A50, 0x1BD9, 0x6F66, 0x7EEF, 0x4C74, 0x5DFD,
+    0xB58B, 0xA402, 0x9699, 0x8710, 0xF3AF, 0xE226, 0xD0BD, 0xC134,
+    0x39C3, 0x284A, 0x1AD1, 0x0B58, 0x7FE7, 0x6E6E, 0x5CF5, 0x4D7C,
+    0xC60C, 0xD785, 0xE51E, 0xF497, 0x8028, 0x91A1, 0xA33A, 0xB2B3,
+    0x4A44, 0x5BCD, 0x6956, 0x78DF, 0x0C60, 0x1DE9, 0x2F72, 0x3EFB,
+    0xD68D, 0xC704, 0xF59F, 0xE416, 0x90A9, 0x8120, 0xB3BB, 0xA232,
+    0x5AC5, 0x4B4C, 0x79D7, 0x685E, 0x1CE1, 0x0D68, 0x3FF3, 0x2E7A,
+    0xE70E, 0xF687, 0xC41C, 0xD595, 0xA12A, 0xB0A3, 0x8238, 0x93B1,
+    0x6B46, 0x7ACF, 0x4854, 0x59DD, 0x2D62, 0x3CEB, 0x0E70, 0x1FF9,
+    0xF78F, 0xE606, 0xD49D, 0xC514, 0xB1AB, 0xA022, 0x92B9, 0x8330,
+    0x7BC7, 0x6A4E, 0x58D5, 0x495C, 0x3DE3, 0x2C6A, 0x1EF1, 0x0F78
+};
+
+uint16
+hndcrc16(
+    uint8 *pdata,  /* pointer to array of data to process */
+    uint nbytes, /* number of input data bytes to process */
+    uint16 crc     /* either CRC16_INIT_VALUE or previous return value */
+)
+{
+	while (nbytes-- > 0)
+		CRC_INNER_LOOP(16, crc, *pdata++);
+	return crc;
+}
+
+static const uint32 crc32_table[256] = {
+    0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
+    0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
+    0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
+    0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
+    0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
+    0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
+    0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
+    0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
+    0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
+    0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
+    0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
+    0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
+    0x26D930AC, 0x51DE003A, 0xC8D75180, 0xBFD06116,
+    0x21B4F4B5, 0x56B3C423, 0xCFBA9599, 0xB8BDA50F,
+    0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
+    0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D,
+    0x76DC4190, 0x01DB7106, 0x98D220BC, 0xEFD5102A,
+    0x71B18589, 0x06B6B51F, 0x9FBFE4A5, 0xE8B8D433,
+    0x7807C9A2, 0x0F00F934, 0x9609A88E, 0xE10E9818,
+    0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
+    0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E,
+    0x6C0695ED, 0x1B01A57B, 0x8208F4C1, 0xF50FC457,
+    0x65B0D9C6, 0x12B7E950, 0x8BBEB8EA, 0xFCB9887C,
+    0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3, 0xFBD44C65,
+    0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
+    0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB,
+    0x4369E96A, 0x346ED9FC, 0xAD678846, 0xDA60B8D0,
+    0x44042D73, 0x33031DE5, 0xAA0A4C5F, 0xDD0D7CC9,
+    0x5005713C, 0x270241AA, 0xBE0B1010, 0xC90C2086,
+    0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
+    0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4,
+    0x59B33D17, 0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD,
+    0xEDB88320, 0x9ABFB3B6, 0x03B6E20C, 0x74B1D29A,
+    0xEAD54739, 0x9DD277AF, 0x04DB2615, 0x73DC1683,
+    0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
+    0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1,
+    0xF00F9344, 0x8708A3D2, 0x1E01F268, 0x6906C2FE,
+    0xF762575D, 0x806567CB, 0x196C3671, 0x6E6B06E7,
+    0xFED41B76, 0x89D32BE0, 0x10DA7A5A, 0x67DD4ACC,
+    0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
+    0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252,
+    0xD1BB67F1, 0xA6BC5767, 0x3FB506DD, 0x48B2364B,
+    0xD80D2BDA, 0xAF0A1B4C, 0x36034AF6, 0x41047A60,
+    0xDF60EFC3, 0xA867DF55, 0x316E8EEF, 0x4669BE79,
+    0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
+    0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F,
+    0xC5BA3BBE, 0xB2BD0B28, 0x2BB45A92, 0x5CB36A04,
+    0xC2D7FFA7, 0xB5D0CF31, 0x2CD99E8B, 0x5BDEAE1D,
+    0x9B64C2B0, 0xEC63F226, 0x756AA39C, 0x026D930A,
+    0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
+    0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38,
+    0x92D28E9B, 0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21,
+    0x86D3D2D4, 0xF1D4E242, 0x68DDB3F8, 0x1FDA836E,
+    0x81BE16CD, 0xF6B9265B, 0x6FB077E1, 0x18B74777,
+    0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
+    0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45,
+    0xA00AE278, 0xD70DD2EE, 0x4E048354, 0x3903B3C2,
+    0xA7672661, 0xD06016F7, 0x4969474D, 0x3E6E77DB,
+    0xAED16A4A, 0xD9D65ADC, 0x40DF0B66, 0x37D83BF0,
+    0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
+    0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6,
+    0xBAD03605, 0xCDD70693, 0x54DE5729, 0x23D967BF,
+    0xB3667A2E, 0xC4614AB8, 0x5D681B02, 0x2A6F2B94,
+    0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B, 0x2D02EF8D
+};
+
+/*
+ * crc input is CRC32_INIT_VALUE for a fresh start, or previous return value if
+ * accumulating over multiple pieces.
+ */
+uint32
+hndcrc32(uint8 *pdata, uint nbytes, uint32 crc)
+{
+	uint8 *pend;
+	pend = pdata + nbytes;
+	while (pdata < pend)
+		CRC_INNER_LOOP(32, crc, *pdata++);
+
+	return crc;
+}
+
+#ifdef notdef
+#define CLEN 	1499 	/*  CRC Length */
+#define CBUFSIZ 	(CLEN+4)
+#define CNBUFS		5 /* # of bufs */
+
+void
+testcrc32(void)
+{
+	uint j, k, l;
+	uint8 *buf;
+	uint len[CNBUFS];
+	uint32 crcr;
+	uint32 crc32tv[CNBUFS] =
+		{0xd2cb1faa, 0xd385c8fa, 0xf5b4f3f3, 0x55789e20, 0x00343110};
+
+	ASSERT((buf = MALLOC(CBUFSIZ*CNBUFS)) != NULL);
+
+	/* step through all possible alignments */
+	for (l = 0; l <= 4; l++) {
+		for (j = 0; j < CNBUFS; j++) {
+			len[j] = CLEN;
+			for (k = 0; k < len[j]; k++)
+				*(buf + j*CBUFSIZ + (k+l)) = (j+k) & 0xff;
+		}
+
+		for (j = 0; j < CNBUFS; j++) {
+			crcr = crc32(buf + j*CBUFSIZ + l, len[j], CRC32_INIT_VALUE);
+			ASSERT(crcr == crc32tv[j]);
+		}
+	}
+
+	MFREE(buf, CBUFSIZ*CNBUFS);
+	return;
+}
+#endif /* notdef */
+
+/*
+ * Advance from the current 1-byte tag/1-byte length/variable-length value
+ * triple, to the next, returning a pointer to the next.
+ * If the current or next TLV is invalid (does not fit in given buffer length),
+ * NULL is returned.
+ * *buflen is not modified if the TLV elt parameter is invalid, or is decremented
+ * by the TLV parameter's length if it is valid.
+ */
+bcm_tlv_t *
+bcm_next_tlv(bcm_tlv_t *elt, int *buflen)
+{
+	int len;
+
+	/* validate current elt */
+	if (!bcm_valid_tlv(elt, *buflen)) {
+		return NULL;
+	}
+
+	/* advance to next elt */
+	len = elt->len;
+	elt = (bcm_tlv_t*)(elt->data + len);
+	*buflen -= (TLV_HDR_LEN + len);
+
+	/* validate next elt */
+	if (!bcm_valid_tlv(elt, *buflen)) {
+		return NULL;
+	}
+
+	return elt;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ */
+bcm_tlv_t *
+bcm_parse_tlvs(void *buf, int buflen, uint key)
+{
+	bcm_tlv_t *elt;
+	int totlen;
+
+	elt = (bcm_tlv_t*)buf;
+	totlen = buflen;
+
+	/* find tagged parameter */
+	while (totlen >= TLV_HDR_LEN) {
+		int len = elt->len;
+
+		/* validate remaining totlen */
+		if ((elt->id == key) && (totlen >= (int)(len + TLV_HDR_LEN))) {
+
+			return (elt);
+		}
+
+		elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+		totlen -= (len + TLV_HDR_LEN);
+	}
+
+	return NULL;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ * return NULL if not found or length field < min_varlen
+ */
+bcm_tlv_t *
+bcm_parse_tlvs_min_bodylen(void *buf, int buflen, uint key, int min_bodylen)
+{
+	bcm_tlv_t * ret = bcm_parse_tlvs(buf, buflen, key);
+	if (ret == NULL || ret->len < min_bodylen) {
+		return NULL;
+	}
+	return ret;
+}
+
+/*
+ * Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag.  Stop parsing when we see an element whose ID is greater
+ * than the target key.
+ */
+bcm_tlv_t *
+bcm_parse_ordered_tlvs(void *buf, int buflen, uint key)
+{
+	bcm_tlv_t *elt;
+	int totlen;
+
+	elt = (bcm_tlv_t*)buf;
+	totlen = buflen;
+
+	/* find tagged parameter */
+	while (totlen >= TLV_HDR_LEN) {
+		uint id = elt->id;
+		int len = elt->len;
+
+		/* Punt if we start seeing IDs > than target key */
+		if (id > key) {
+			return (NULL);
+		}
+
+		/* validate remaining totlen */
+		if ((id == key) && (totlen >= (int)(len + TLV_HDR_LEN))) {
+			return (elt);
+		}
+
+		elt = (bcm_tlv_t*)((uint8*)elt + (len + TLV_HDR_LEN));
+		totlen -= (len + TLV_HDR_LEN);
+	}
+	return NULL;
+}
+#endif	/* !BCMROMOFFLOAD_EXCLUDE_BCMUTILS_FUNCS */
+
+#if defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || defined(WLMSG_ASSOC) || \
+	defined(DHD_DEBUG)
+int
+bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 flags, char* buf, int len)
+{
+	int i, slen = 0;
+	uint32 bit, mask;
+	const char *name;
+	mask = bd->mask;
+	if (len < 2 || !buf)
+		return 0;
+
+	buf[0] = '\0';
+
+	for (i = 0;  (name = bd->bitfield[i].name) != NULL; i++) {
+		bit = bd->bitfield[i].bit;
+		if ((flags & mask) == bit) {
+			if (len > (int)strlen(name)) {
+				slen = strlen(name);
+				strncpy(buf, name, slen+1);
+			}
+			break;
+		}
+	}
+	return slen;
+}
+
+int
+bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len)
+{
+	int i;
+	char* p = buf;
+	char hexstr[16];
+	int slen = 0, nlen = 0;
+	uint32 bit;
+	const char* name;
+
+	if (len < 2 || !buf)
+		return 0;
+
+	buf[0] = '\0';
+
+	for (i = 0; flags != 0; i++) {
+		bit = bd[i].bit;
+		name = bd[i].name;
+		if (bit == 0 && flags != 0) {
+			/* print any unnamed bits */
+			snprintf(hexstr, 16, "0x%X", flags);
+			name = hexstr;
+			flags = 0;	/* exit loop */
+		} else if ((flags & bit) == 0)
+			continue;
+		flags &= ~bit;
+		nlen = strlen(name);
+		slen += nlen;
+		/* count btwn flag space */
+		if (flags != 0)
+			slen += 1;
+		/* need NULL char as well */
+		if (len <= slen)
+			break;
+		/* copy NULL char but don't count it */
+		strncpy(p, name, nlen + 1);
+		p += nlen;
+		/* copy btwn flag space and NULL char */
+		if (flags != 0)
+			p += snprintf(p, 2, " ");
+	}
+
+	/* indicate the str was too short */
+	if (flags != 0) {
+		if (len < 2)
+			p -= 2 - len;	/* overwrite last char */
+		p += snprintf(p, 2, ">");
+	}
+
+	return (int)(p - buf);
+}
+#endif
+
+/* print bytes formatted as hex to a string. return the resulting string length */
+int
+bcm_format_hex(char *str, const void *bytes, int len)
+{
+	int i;
+	char *p = str;
+	const uint8 *src = (const uint8*)bytes;
+
+	for (i = 0; i < len; i++) {
+		p += snprintf(p, 3, "%02X", *src);
+		src++;
+	}
+	return (int)(p - str);
+}
+
+/* pretty hex print a contiguous buffer */
+void
+prhex(const char *msg, uchar *buf, uint nbytes)
+{
+	char line[128], *p;
+	int len = sizeof(line);
+	int nchar;
+	uint i;
+
+	if (msg && (msg[0] != '\0'))
+		printf("%s:\n", msg);
+
+	p = line;
+	for (i = 0; i < nbytes; i++) {
+		if (i % 16 == 0) {
+			nchar = snprintf(p, len, "  %04d: ", i);	/* line prefix */
+			p += nchar;
+			len -= nchar;
+		}
+		if (len > 0) {
+			nchar = snprintf(p, len, "%02x ", buf[i]);
+			p += nchar;
+			len -= nchar;
+		}
+
+		if (i % 16 == 15) {
+			printf("%s\n", line);		/* flush line */
+			p = line;
+			len = sizeof(line);
+		}
+	}
+
+	/* flush last partial line */
+	if (p != line)
+		printf("%s\n", line);
+}
+
+static const char *crypto_algo_names[] = {
+	"NONE",
+	"WEP1",
+	"TKIP",
+	"WEP128",
+	"AES_CCM",
+	"AES_OCB_MSDU",
+	"AES_OCB_MPDU",
+#ifdef BCMCCX
+	"CKIP",
+	"CKIP_MMH",
+	"WEP_MMH",
+	"NALG",
+#else
+	"NALG",
+	"UNDEF",
+	"UNDEF",
+	"UNDEF",
+#endif /* BCMCCX */
+	"WAPI",
+	"PMK",
+	"BIP",
+	"AES_GCM",
+	"AES_CCM256",
+	"AES_GCM256",
+	"BIP_CMAC256",
+	"BIP_GMAC",
+	"BIP_GMAC256",
+	"UNDEF"
+};
+
+const char *
+bcm_crypto_algo_name(uint algo)
+{
+	return (algo < ARRAYSIZE(crypto_algo_names)) ? crypto_algo_names[algo] : "ERR";
+}
+
+
+char *
+bcm_chipname(uint chipid, char *buf, uint len)
+{
+	const char *fmt;
+
+	fmt = ((chipid > 0xa000) || (chipid < 0x4000)) ? "%d" : "%x";
+	snprintf(buf, len, fmt, chipid);
+	return buf;
+}
+
+/* Produce a human-readable string for boardrev */
+char *
+bcm_brev_str(uint32 brev, char *buf)
+{
+	if (brev < 0x100)
+		snprintf(buf, 8, "%d.%d", (brev & 0xf0) >> 4, brev & 0xf);
+	else
+		snprintf(buf, 8, "%c%03x", ((brev & 0xf000) == 0x1000) ? 'P' : 'A', brev & 0xfff);
+
+	return (buf);
+}
+
+#define BUFSIZE_TODUMP_ATONCE 512 /* Buffer size */
+
+/* dump large strings to console */
+void
+printbig(char *buf)
+{
+	uint len, max_len;
+	char c;
+
+	len = (uint)strlen(buf);
+
+	max_len = BUFSIZE_TODUMP_ATONCE;
+
+	while (len > max_len) {
+		c = buf[max_len];
+		buf[max_len] = '\0';
+		printf("%s", buf);
+		buf[max_len] = c;
+
+		buf += max_len;
+		len -= max_len;
+	}
+	/* print the remaining string */
+	printf("%s\n", buf);
+	return;
+}
+
+/* routine to dump fields in a fileddesc structure */
+uint
+bcmdumpfields(bcmutl_rdreg_rtn read_rtn, void *arg0, uint arg1, struct fielddesc *fielddesc_array,
+	char *buf, uint32 bufsize)
+{
+	uint  filled_len;
+	int len;
+	struct fielddesc *cur_ptr;
+
+	filled_len = 0;
+	cur_ptr = fielddesc_array;
+
+	while (bufsize > 1) {
+		if (cur_ptr->nameandfmt == NULL)
+			break;
+		len = snprintf(buf, bufsize, cur_ptr->nameandfmt,
+		               read_rtn(arg0, arg1, cur_ptr->offset));
+		/* check for snprintf overflow or error */
+		if (len < 0 || (uint32)len >= bufsize)
+			len = bufsize - 1;
+		buf += len;
+		bufsize -= len;
+		filled_len += len;
+		cur_ptr++;
+	}
+	return filled_len;
+}
+
+uint
+bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint buflen)
+{
+	uint len;
+
+	len = (uint)strlen(name) + 1;
+
+	if ((len + datalen) > buflen)
+		return 0;
+
+	strncpy(buf, name, buflen);
+
+	/* append data onto the end of the name string */
+	memcpy(&buf[len], data, datalen);
+	len += datalen;
+
+	return len;
+}
+
+/* Quarter dBm units to mW
+ * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
+ * Table is offset so the last entry is largest mW value that fits in
+ * a uint16.
+ */
+
+#define QDBM_OFFSET 153		/* Offset for first entry */
+#define QDBM_TABLE_LEN 40	/* Table size */
+
+/* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
+ * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
+ */
+#define QDBM_TABLE_LOW_BOUND 6493 /* Low bound */
+
+/* Largest mW value that will round down to the last table entry,
+ * QDBM_OFFSET + QDBM_TABLE_LEN-1.
+ * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) + mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
+ */
+#define QDBM_TABLE_HIGH_BOUND 64938 /* High bound */
+
+static const uint16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
+/* qdBm: 	+0 	+1 	+2 	+3 	+4 	+5 	+6 	+7 */
+/* 153: */      6683,	7079,	7499,	7943,	8414,	8913,	9441,	10000,
+/* 161: */      10593,	11220,	11885,	12589,	13335,	14125,	14962,	15849,
+/* 169: */      16788,	17783,	18836,	19953,	21135,	22387,	23714,	25119,
+/* 177: */      26607,	28184,	29854,	31623,	33497,	35481,	37584,	39811,
+/* 185: */      42170,	44668,	47315,	50119,	53088,	56234,	59566,	63096
+};
+
+uint16
+bcm_qdbm_to_mw(uint8 qdbm)
+{
+	uint factor = 1;
+	int idx = qdbm - QDBM_OFFSET;
+
+	if (idx >= QDBM_TABLE_LEN) {
+		/* clamp to max uint16 mW value */
+		return 0xFFFF;
+	}
+
+	/* scale the qdBm index up to the range of the table 0-40
+	 * where an offset of 40 qdBm equals a factor of 10 mW.
+	 */
+	while (idx < 0) {
+		idx += 40;
+		factor *= 10;
+	}
+
+	/* return the mW value scaled down to the correct factor of 10,
+	 * adding in factor/2 to get proper rounding.
+	 */
+	return ((nqdBm_to_mW_map[idx] + factor/2) / factor);
+}
+
+uint8
+bcm_mw_to_qdbm(uint16 mw)
+{
+	uint8 qdbm;
+	int offset;
+	uint mw_uint = mw;
+	uint boundary;
+
+	/* handle boundary case */
+	if (mw_uint <= 1)
+		return 0;
+
+	offset = QDBM_OFFSET;
+
+	/* move mw into the range of the table */
+	while (mw_uint < QDBM_TABLE_LOW_BOUND) {
+		mw_uint *= 10;
+		offset -= 40;
+	}
+
+	for (qdbm = 0; qdbm < QDBM_TABLE_LEN-1; qdbm++) {
+		boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm+1] -
+		                                    nqdBm_to_mW_map[qdbm])/2;
+		if (mw_uint < boundary) break;
+	}
+
+	qdbm += (uint8)offset;
+
+	return (qdbm);
+}
+
+
+uint
+bcm_bitcount(uint8 *bitmap, uint length)
+{
+	uint bitcount = 0, i;
+	uint8 tmp;
+	for (i = 0; i < length; i++) {
+		tmp = bitmap[i];
+		while (tmp) {
+			bitcount++;
+			tmp &= (tmp - 1);
+		}
+	}
+	return bitcount;
+}
+
+#ifdef BCMDRIVER
+
+/* Initialization of bcmstrbuf structure */
+void
+bcm_binit(struct bcmstrbuf *b, char *buf, uint size)
+{
+	b->origsize = b->size = size;
+	b->origbuf = b->buf = buf;
+}
+
+/* Buffer sprintf wrapper to guard against buffer overflow */
+int
+bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...)
+{
+	va_list ap;
+	int r;
+
+	va_start(ap, fmt);
+
+	r = vsnprintf(b->buf, b->size, fmt, ap);
+
+	/* Non Ansi C99 compliant returns -1,
+	 * Ansi compliant return r >= b->size,
+	 * bcmstdlib returns 0, handle all
+	 */
+	/* r == 0 is also the case when strlen(fmt) is zero.
+	 * typically the case when "" is passed as argument.
+	 */
+	if ((r == -1) || (r >= (int)b->size)) {
+		b->size = 0;
+	} else {
+		b->size -= r;
+		b->buf += r;
+	}
+
+	va_end(ap);
+
+	return r;
+}
+
+void
+bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline, uint8 *buf, int len)
+{
+	int i;
+
+	if (msg != NULL && msg[0] != '\0')
+		bcm_bprintf(b, "%s", msg);
+	for (i = 0; i < len; i ++)
+		bcm_bprintf(b, "%02X", buf[i]);
+	if (newline)
+		bcm_bprintf(b, "\n");
+}
+
+void
+bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount)
+{
+	int i;
+
+	for (i = 0; i < num_bytes; i++) {
+		num[i] += amount;
+		if (num[i] >= amount)
+			break;
+		amount = 1;
+	}
+}
+
+int
+bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes)
+{
+	int i;
+
+	for (i = nbytes - 1; i >= 0; i--) {
+		if (arg1[i] != arg2[i])
+			return (arg1[i] - arg2[i]);
+	}
+	return 0;
+}
+
+void
+bcm_print_bytes(const char *name, const uchar *data, int len)
+{
+	int i;
+	int per_line = 0;
+
+	printf("%s: %d \n", name ? name : "", len);
+	for (i = 0; i < len; i++) {
+		printf("%02x ", *data++);
+		per_line++;
+		if (per_line == 16) {
+			per_line = 0;
+			printf("\n");
+		}
+	}
+	printf("\n");
+}
+
+/* Look for vendor-specific IE with specified OUI and optional type */
+bcm_tlv_t *
+bcm_find_vendor_ie(void *tlvs, int tlvs_len, const char *voui, uint8 *type, int type_len)
+{
+	bcm_tlv_t *ie;
+	uint8 ie_len;
+
+	ie = (bcm_tlv_t*)tlvs;
+
+	/* make sure we are looking at a valid IE */
+	if (ie == NULL || !bcm_valid_tlv(ie, tlvs_len)) {
+		return NULL;
+	}
+
+	/* Walk through the IEs looking for an OUI match */
+	do {
+		ie_len = ie->len;
+		if ((ie->id == DOT11_MNG_PROPR_ID) &&
+		    (ie_len >= (DOT11_OUI_LEN + type_len)) &&
+		    !bcmp(ie->data, voui, DOT11_OUI_LEN))
+		{
+			/* compare optional type */
+			if (type_len == 0 ||
+			    !bcmp(&ie->data[DOT11_OUI_LEN], type, type_len)) {
+				return (ie);		/* a match */
+			}
+		}
+	} while ((ie = bcm_next_tlv(ie, &tlvs_len)) != NULL);
+
+	return NULL;
+}
+
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+	defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+#define SSID_FMT_BUF_LEN	((4 * DOT11_MAX_SSID_LEN) + 1)
+
+int
+bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len)
+{
+	uint i, c;
+	char *p = buf;
+	char *endp = buf + SSID_FMT_BUF_LEN;
+
+	if (ssid_len > DOT11_MAX_SSID_LEN) ssid_len = DOT11_MAX_SSID_LEN;
+
+	for (i = 0; i < ssid_len; i++) {
+		c = (uint)ssid[i];
+		if (c == '\\') {
+			*p++ = '\\';
+			*p++ = '\\';
+		} else if (bcm_isprint((uchar)c)) {
+			*p++ = (char)c;
+		} else {
+			p += snprintf(p, (endp - p), "\\x%02X", c);
+		}
+	}
+	*p = '\0';
+	ASSERT(p < endp);
+
+	return (int)(p - buf);
+}
+#endif
+
+#endif /* BCMDRIVER */
+
+/*
+ * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file and ending in a NUL.
+ * also accepts nvram files which are already in the format of <var1>=<value>\0\<var2>=<value2>\0
+ * Removes carriage returns, empty lines, comment lines, and converts newlines to NULs.
+ * Shortens buffer as needed and pads with NULs.  End of buffer is marked by two NULs.
+*/
+
+unsigned int
+process_nvram_vars(char *varbuf, unsigned int len)
+{
+	char *dp;
+	bool findNewline;
+	int column;
+	unsigned int buf_len, n;
+	unsigned int pad = 0;
+
+	dp = varbuf;
+
+	findNewline = FALSE;
+	column = 0;
+
+	// terence 20130914: print out NVRAM version
+	if (varbuf[0] == '#') {
+		for (n=1; n<len; n++) {
+			if (varbuf[n] == '\r' || varbuf[n] == '\n')
+				break;
+		}
+		pr_info("NVRAM version: %.*s", n-1, varbuf+1);
+	}
+
+	for (n = 0; n < len; n++) {
+		if (varbuf[n] == '\r')
+			continue;
+		if (findNewline && varbuf[n] != '\n')
+			continue;
+		findNewline = FALSE;
+		if (varbuf[n] == '#') {
+			findNewline = TRUE;
+			continue;
+		}
+		if (varbuf[n] == '\n') {
+			if (column == 0)
+				continue;
+			*dp++ = 0;
+			column = 0;
+			continue;
+		}
+		*dp++ = varbuf[n];
+		column++;
+	}
+	buf_len = (unsigned int)(dp - varbuf);
+	if (buf_len % 4) {
+		pad = 4 - buf_len % 4;
+		if (pad && (buf_len + pad <= len)) {
+			buf_len += pad;
+		}
+	}
+
+	while (dp < varbuf + n)
+		*dp++ = 0;
+
+	return buf_len;
+}
+
+/* calculate a * b + c */
+void
+bcm_uint64_multiple_add(uint32* r_high, uint32* r_low, uint32 a, uint32 b, uint32 c)
+{
+#define FORMALIZE(var) {cc += (var & 0x80000000) ? 1 : 0; var &= 0x7fffffff;}
+	uint32 r1, r0;
+	uint32 a1, a0, b1, b0, t, cc = 0;
+
+	a1 = a >> 16;
+	a0 = a & 0xffff;
+	b1 = b >> 16;
+	b0 = b & 0xffff;
+
+	r0 = a0 * b0;
+	FORMALIZE(r0);
+
+	t = (a1 * b0) << 16;
+	FORMALIZE(t);
+
+	r0 += t;
+	FORMALIZE(r0);
+
+	t = (a0 * b1) << 16;
+	FORMALIZE(t);
+
+	r0 += t;
+	FORMALIZE(r0);
+
+	FORMALIZE(c);
+
+	r0 += c;
+	FORMALIZE(r0);
+
+	r0 |= (cc % 2) ? 0x80000000 : 0;
+	r1 = a1 * b1 + ((a1 * b0) >> 16) + ((b1 * a0) >> 16) + (cc / 2);
+
+	*r_high = r1;
+	*r_low = r0;
+}
+
+/* calculate a / b */
+void
+bcm_uint64_divide(uint32* r, uint32 a_high, uint32 a_low, uint32 b)
+{
+	uint32 a1 = a_high, a0 = a_low, r0 = 0;
+
+	if (b < 2)
+		return;
+
+	while (a1 != 0) {
+		r0 += (0xffffffff / b) * a1;
+		bcm_uint64_multiple_add(&a1, &a0, ((0xffffffff % b) + 1) % b, a1, a0);
+	}
+
+	r0 += a0 / b;
+	*r = r0;
+}
+
+#ifndef setbit /* As in the header file */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+/* Set bit in byte array. */
+void
+setbit(void *array, uint bit)
+{
+	((uint8 *)array)[bit / NBBY] |= 1 << (bit % NBBY);
+}
+
+/* Clear bit in byte array. */
+void
+clrbit(void *array, uint bit)
+{
+	((uint8 *)array)[bit / NBBY] &= ~(1 << (bit % NBBY));
+}
+
+/* Test if bit is set in byte array. */
+bool
+isset(const void *array, uint bit)
+{
+	return (((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY)));
+}
+
+/* Test if bit is clear in byte array. */
+bool
+isclr(const void *array, uint bit)
+{
+	return ((((const uint8 *)array)[bit / NBBY] & (1 << (bit % NBBY))) == 0);
+}
+#endif /* BCMUTILS_BIT_MACROS_USE_FUNCS */
+#endif /* setbit */
+
+void
+set_bitrange(void *array, uint start, uint end, uint maxbit)
+{
+	uint startbyte = start/NBBY;
+	uint endbyte = end/NBBY;
+	uint i, startbytelastbit, endbytestartbit;
+
+	if (end >= start) {
+		if (endbyte - startbyte > 1)
+		{
+			startbytelastbit = (startbyte+1)*NBBY - 1;
+			endbytestartbit = endbyte*NBBY;
+			for (i = startbyte+1; i < endbyte; i++)
+				((uint8 *)array)[i] = 0xFF;
+			for (i = start; i <= startbytelastbit; i++)
+				setbit(array, i);
+			for (i = endbytestartbit; i <= end; i++)
+				setbit(array, i);
+		} else {
+			for (i = start; i <= end; i++)
+				setbit(array, i);
+		}
+	}
+	else {
+		set_bitrange(array, start, maxbit, maxbit);
+		set_bitrange(array, 0, end, maxbit);
+	}
+}
+
+void
+bcm_bitprint32(const uint32 u32)
+{
+	int i;
+	for (i = NBITS(uint32) - 1; i >= 0; i--) {
+		isbitset(u32, i) ? printf("1") : printf("0");
+		if ((i % NBBY) == 0) printf(" ");
+	}
+	printf("\n");
+}
+
+/* calculate checksum for ip header, tcp / udp header / data */
+uint16
+bcm_ip_cksum(uint8 *buf, uint32 len, uint32 sum)
+{
+	while (len > 1) {
+		sum += (buf[0] << 8) | buf[1];
+		buf += 2;
+		len -= 2;
+	}
+
+	if (len > 0) {
+		sum += (*buf) << 8;
+	}
+
+	while (sum >> 16) {
+		sum = (sum & 0xffff) + (sum >> 16);
+	}
+
+	return ((uint16)~sum);
+}
+
+#ifdef BCMDRIVER
+/*
+ * Hierarchical Multiword bitmap based small id allocator.
+ *
+ * Multilevel hierarchy bitmap. (maximum 2 levels)
+ * First hierarchy uses a multiword bitmap to identify 32bit words in the
+ * second hierarchy that have at least a single bit set. Each bit in a word of
+ * the second hierarchy represents a unique ID that may be allocated.
+ *
+ * BCM_MWBMAP_ITEMS_MAX: Maximum number of IDs managed.
+ * BCM_MWBMAP_BITS_WORD: Number of bits in a bitmap word word
+ * BCM_MWBMAP_WORDS_MAX: Maximum number of bitmap words needed for free IDs.
+ * BCM_MWBMAP_WDMAP_MAX: Maximum number of bitmap wordss identifying first non
+ *                       non-zero bitmap word carrying at least one free ID.
+ * BCM_MWBMAP_SHIFT_OP:  Used in MOD, DIV and MUL operations.
+ * BCM_MWBMAP_INVALID_IDX: Value ~0U is treated as an invalid ID
+ *
+ * Design Notes:
+ * BCM_MWBMAP_USE_CNTSETBITS trades CPU for memory. A runtime count of how many
+ * bits are computed each time on allocation and deallocation, requiring 4
+ * array indexed access and 3 arithmetic operations. When not defined, a runtime
+ * count of set bits state is maintained. Upto 32 Bytes per 1024 IDs is needed.
+ * In a 4K max ID allocator, up to 128Bytes are hence used per instantiation.
+ * In a memory limited system e.g. dongle builds, a CPU for memory tradeoff may
+ * be used by defining BCM_MWBMAP_USE_CNTSETBITS.
+ *
+ * Note: wd_bitmap[] is statically declared and is not ROM friendly ... array
+ * size is fixed. No intention to support larger than 4K indice allocation. ID
+ * allocators for ranges smaller than 4K will have a wastage of only 12Bytes
+ * with savings in not having to use an indirect access, had it been dynamically
+ * allocated.
+ */
+#define BCM_MWBMAP_ITEMS_MAX    (4 * 1024)  /* May increase to 16K */
+
+#define BCM_MWBMAP_BITS_WORD    (NBITS(uint32))
+#define BCM_MWBMAP_WORDS_MAX    (BCM_MWBMAP_ITEMS_MAX / BCM_MWBMAP_BITS_WORD)
+#define BCM_MWBMAP_WDMAP_MAX    (BCM_MWBMAP_WORDS_MAX / BCM_MWBMAP_BITS_WORD)
+#define BCM_MWBMAP_SHIFT_OP     (5)
+#define BCM_MWBMAP_MODOP(ix)    ((ix) & (BCM_MWBMAP_BITS_WORD - 1))
+#define BCM_MWBMAP_DIVOP(ix)    ((ix) >> BCM_MWBMAP_SHIFT_OP)
+#define BCM_MWBMAP_MULOP(ix)    ((ix) << BCM_MWBMAP_SHIFT_OP)
+
+/* Redefine PTR() and/or HDL() conversion to invoke audit for debugging */
+#define BCM_MWBMAP_PTR(hdl)		((struct bcm_mwbmap *)(hdl))
+#define BCM_MWBMAP_HDL(ptr)		((void *)(ptr))
+
+#if defined(BCM_MWBMAP_DEBUG)
+#define BCM_MWBMAP_AUDIT(mwb) \
+	do { \
+		ASSERT((mwb != NULL) && \
+		       (((struct bcm_mwbmap *)(mwb))->magic == (void *)(mwb))); \
+		bcm_mwbmap_audit(mwb); \
+	} while (0)
+#define MWBMAP_ASSERT(exp)		ASSERT(exp)
+#define MWBMAP_DBG(x)           printf x
+#else   /* !BCM_MWBMAP_DEBUG */
+#define BCM_MWBMAP_AUDIT(mwb)   do {} while (0)
+#define MWBMAP_ASSERT(exp)		do {} while (0)
+#define MWBMAP_DBG(x)
+#endif  /* !BCM_MWBMAP_DEBUG */
+
+
+typedef struct bcm_mwbmap {     /* Hierarchical multiword bitmap allocator    */
+	uint16 wmaps;               /* Total number of words in free wd bitmap    */
+	uint16 imaps;               /* Total number of words in free id bitmap    */
+	int16  ifree;               /* Count of free indices. Used only in audits */
+	uint16 total;               /* Total indices managed by multiword bitmap  */
+
+	void * magic;               /* Audit handle parameter from user           */
+
+	uint32 wd_bitmap[BCM_MWBMAP_WDMAP_MAX]; /* 1st level bitmap of            */
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+	int8   wd_count[BCM_MWBMAP_WORDS_MAX];  /* free id running count, 1st lvl */
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+
+	uint32 id_bitmap[0];        /* Second level bitmap                        */
+} bcm_mwbmap_t;
+
+/* Incarnate a hierarchical multiword bitmap based small index allocator. */
+struct bcm_mwbmap *
+bcm_mwbmap_init(osl_t *osh, uint32 items_max)
+{
+	struct bcm_mwbmap * mwbmap_p;
+	uint32 wordix, size, words, extra;
+
+	/* Implementation Constraint: Uses 32bit word bitmap */
+	MWBMAP_ASSERT(BCM_MWBMAP_BITS_WORD == 32U);
+	MWBMAP_ASSERT(BCM_MWBMAP_SHIFT_OP == 5U);
+	MWBMAP_ASSERT(ISPOWEROF2(BCM_MWBMAP_ITEMS_MAX));
+	MWBMAP_ASSERT((BCM_MWBMAP_ITEMS_MAX % BCM_MWBMAP_BITS_WORD) == 0U);
+
+	ASSERT(items_max <= BCM_MWBMAP_ITEMS_MAX);
+
+	/* Determine the number of words needed in the multiword bitmap */
+	extra = BCM_MWBMAP_MODOP(items_max);
+	words = BCM_MWBMAP_DIVOP(items_max) + ((extra != 0U) ? 1U : 0U);
+
+	/* Allocate runtime state of multiword bitmap */
+	/* Note: wd_count[] or wd_bitmap[] are not dynamically allocated */
+	size = sizeof(bcm_mwbmap_t) + (sizeof(uint32) * words);
+	mwbmap_p = (bcm_mwbmap_t *)MALLOC(osh, size);
+	if (mwbmap_p == (bcm_mwbmap_t *)NULL) {
+		ASSERT(0);
+		goto error1;
+	}
+	memset(mwbmap_p, 0, size);
+
+	/* Initialize runtime multiword bitmap state */
+	mwbmap_p->imaps = (uint16)words;
+	mwbmap_p->ifree = (int16)items_max;
+	mwbmap_p->total = (uint16)items_max;
+
+	/* Setup magic, for use in audit of handle */
+	mwbmap_p->magic = BCM_MWBMAP_HDL(mwbmap_p);
+
+	/* Setup the second level bitmap of free indices */
+	/* Mark all indices as available */
+	for (wordix = 0U; wordix < mwbmap_p->imaps; wordix++) {
+		mwbmap_p->id_bitmap[wordix] = (uint32)(~0U);
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+		mwbmap_p->wd_count[wordix] = BCM_MWBMAP_BITS_WORD;
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+	}
+
+	/* Ensure that extra indices are tagged as un-available */
+	if (extra) { /* fixup the free ids in last bitmap and wd_count */
+		uint32 * bmap_p = &mwbmap_p->id_bitmap[mwbmap_p->imaps - 1];
+		*bmap_p ^= (uint32)(~0U << extra); /* fixup bitmap */
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+		mwbmap_p->wd_count[mwbmap_p->imaps - 1] = (int8)extra; /* fixup count */
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+	}
+
+	/* Setup the first level bitmap hierarchy */
+	extra = BCM_MWBMAP_MODOP(mwbmap_p->imaps);
+	words = BCM_MWBMAP_DIVOP(mwbmap_p->imaps) + ((extra != 0U) ? 1U : 0U);
+
+	mwbmap_p->wmaps = (uint16)words;
+
+	for (wordix = 0U; wordix < mwbmap_p->wmaps; wordix++)
+		mwbmap_p->wd_bitmap[wordix] = (uint32)(~0U);
+	if (extra) {
+		uint32 * bmap_p = &mwbmap_p->wd_bitmap[mwbmap_p->wmaps - 1];
+		*bmap_p ^= (uint32)(~0U << extra); /* fixup bitmap */
+	}
+
+	return mwbmap_p;
+
+error1:
+	return BCM_MWBMAP_INVALID_HDL;
+}
+
+/* Release resources used by multiword bitmap based small index allocator. */
+void
+bcm_mwbmap_fini(osl_t * osh, struct bcm_mwbmap * mwbmap_hdl)
+{
+	bcm_mwbmap_t * mwbmap_p;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	MFREE(osh, mwbmap_p, sizeof(struct bcm_mwbmap)
+	                     + (sizeof(uint32) * mwbmap_p->imaps));
+	return;
+}
+
+/* Allocate a unique small index using a multiword bitmap index allocator.    */
+uint32 BCMFASTPATH
+bcm_mwbmap_alloc(struct bcm_mwbmap * mwbmap_hdl)
+{
+	bcm_mwbmap_t * mwbmap_p;
+	uint32 wordix, bitmap;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	/* Start with the first hierarchy */
+	for (wordix = 0; wordix < mwbmap_p->wmaps; ++wordix) {
+
+		bitmap = mwbmap_p->wd_bitmap[wordix]; /* get the word bitmap */
+
+		if (bitmap != 0U) {
+
+			uint32 count, bitix, *bitmap_p;
+
+			bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+			/* clear all except trailing 1 */
+			bitmap   = (uint32)(((int)(bitmap)) & (-((int)(bitmap))));
+			MWBMAP_ASSERT(C_bcm_count_leading_zeros(bitmap) ==
+			              bcm_count_leading_zeros(bitmap));
+			bitix    = (BCM_MWBMAP_BITS_WORD - 1)
+			         - bcm_count_leading_zeros(bitmap); /* use asm clz */
+			wordix   = BCM_MWBMAP_MULOP(wordix) + bitix;
+
+			/* Clear bit if wd count is 0, without conditional branch */
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+			count = bcm_cntsetbits(mwbmap_p->id_bitmap[wordix]) - 1;
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+			mwbmap_p->wd_count[wordix]--;
+			count = mwbmap_p->wd_count[wordix];
+			MWBMAP_ASSERT(count ==
+			              (bcm_cntsetbits(mwbmap_p->id_bitmap[wordix]) - 1));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+			MWBMAP_ASSERT(count >= 0);
+
+			/* clear wd_bitmap bit if id_map count is 0 */
+			bitmap = (count == 0) << bitix;
+
+			MWBMAP_DBG((
+			    "Lvl1: bitix<%02u> wordix<%02u>: %08x ^ %08x = %08x wfree %d",
+			    bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap, count));
+
+			*bitmap_p ^= bitmap;
+
+			/* Use bitix in the second hierarchy */
+			bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+			bitmap = mwbmap_p->id_bitmap[wordix]; /* get the id bitmap */
+			MWBMAP_ASSERT(bitmap != 0U);
+
+			/* clear all except trailing 1 */
+			bitmap   = (uint32)(((int)(bitmap)) & (-((int)(bitmap))));
+			MWBMAP_ASSERT(C_bcm_count_leading_zeros(bitmap) ==
+			              bcm_count_leading_zeros(bitmap));
+			bitix    = BCM_MWBMAP_MULOP(wordix)
+			         + (BCM_MWBMAP_BITS_WORD - 1)
+			         - bcm_count_leading_zeros(bitmap); /* use asm clz */
+
+			mwbmap_p->ifree--; /* decrement system wide free count */
+			MWBMAP_ASSERT(mwbmap_p->ifree >= 0);
+
+			MWBMAP_DBG((
+			    "Lvl2: bitix<%02u> wordix<%02u>: %08x ^ %08x = %08x ifree %d",
+			    bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap,
+			    mwbmap_p->ifree));
+
+			*bitmap_p ^= bitmap; /* mark as allocated = 1b0 */
+
+			return bitix;
+		}
+	}
+
+	ASSERT(mwbmap_p->ifree == 0);
+
+	return BCM_MWBMAP_INVALID_IDX;
+}
+
+/* Force an index at a specified position to be in use */
+void
+bcm_mwbmap_force(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+	bcm_mwbmap_t * mwbmap_p;
+	uint32 count, wordix, bitmap, *bitmap_p;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	ASSERT(bitix < mwbmap_p->total);
+
+	/* Start with second hierarchy */
+	wordix   = BCM_MWBMAP_DIVOP(bitix);
+	bitmap   = (uint32)(1U << BCM_MWBMAP_MODOP(bitix));
+	bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+	ASSERT((*bitmap_p & bitmap) == bitmap);
+
+	mwbmap_p->ifree--; /* update free count */
+	ASSERT(mwbmap_p->ifree >= 0);
+
+	MWBMAP_DBG(("Lvl2: bitix<%u> wordix<%u>: %08x ^ %08x = %08x ifree %d",
+	           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) ^ bitmap,
+	           mwbmap_p->ifree));
+
+	*bitmap_p ^= bitmap; /* mark as in use */
+
+	/* Update first hierarchy */
+	bitix    = wordix;
+
+	wordix   = BCM_MWBMAP_DIVOP(bitix);
+	bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+	count = bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+	mwbmap_p->wd_count[bitix]--;
+	count = mwbmap_p->wd_count[bitix];
+	MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+	MWBMAP_ASSERT(count >= 0);
+
+	bitmap   = (count == 0) << BCM_MWBMAP_MODOP(bitix);
+
+	MWBMAP_DBG(("Lvl1: bitix<%02lu> wordix<%02u>: %08x ^ %08x = %08x wfree %d",
+	           BCM_MWBMAP_MODOP(bitix), wordix, *bitmap_p, bitmap,
+	           (*bitmap_p) ^ bitmap, count));
+
+	*bitmap_p ^= bitmap; /* mark as in use */
+
+	return;
+}
+
+/* Free a previously allocated index back into the multiword bitmap allocator */
+void BCMFASTPATH
+bcm_mwbmap_free(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+	bcm_mwbmap_t * mwbmap_p;
+	uint32 wordix, bitmap, *bitmap_p;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	ASSERT(bitix < mwbmap_p->total);
+
+	/* Start with second level hierarchy */
+	wordix   = BCM_MWBMAP_DIVOP(bitix);
+	bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+	bitmap_p = &mwbmap_p->id_bitmap[wordix];
+
+	ASSERT((*bitmap_p & bitmap) == 0U);	/* ASSERT not a double free */
+
+	mwbmap_p->ifree++; /* update free count */
+	ASSERT(mwbmap_p->ifree <= mwbmap_p->total);
+
+	MWBMAP_DBG(("Lvl2: bitix<%02u> wordix<%02u>: %08x | %08x = %08x ifree %d",
+	           bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) | bitmap,
+	           mwbmap_p->ifree));
+
+	*bitmap_p |= bitmap; /* mark as available */
+
+	/* Now update first level hierarchy */
+
+	bitix    = wordix;
+
+	wordix   = BCM_MWBMAP_DIVOP(bitix); /* first level's word index */
+	bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+	bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+#if !defined(BCM_MWBMAP_USE_CNTSETBITS)
+	mwbmap_p->wd_count[bitix]++;
+#endif
+
+#if defined(BCM_MWBMAP_DEBUG)
+	{
+		uint32 count;
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+		count = bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]);
+#else  /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+		count = mwbmap_p->wd_count[bitix];
+		MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[bitix]));
+#endif /*  ! BCM_MWBMAP_USE_CNTSETBITS */
+
+		MWBMAP_ASSERT(count <= BCM_MWBMAP_BITS_WORD);
+
+		MWBMAP_DBG(("Lvl1: bitix<%02u> wordix<%02u>: %08x | %08x = %08x wfree %d",
+		            bitix, wordix, *bitmap_p, bitmap, (*bitmap_p) | bitmap, count));
+	}
+#endif /* BCM_MWBMAP_DEBUG */
+
+	*bitmap_p |= bitmap;
+
+	return;
+}
+
+/* Fetch the toal number of free indices in the multiword bitmap allocator */
+uint32
+bcm_mwbmap_free_cnt(struct bcm_mwbmap * mwbmap_hdl)
+{
+	bcm_mwbmap_t * mwbmap_p;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	ASSERT(mwbmap_p->ifree >= 0);
+
+	return mwbmap_p->ifree;
+}
+
+/* Determine whether an index is inuse or free */
+bool
+bcm_mwbmap_isfree(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix)
+{
+	bcm_mwbmap_t * mwbmap_p;
+	uint32 wordix, bitmap;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	ASSERT(bitix < mwbmap_p->total);
+
+	wordix   = BCM_MWBMAP_DIVOP(bitix);
+	bitmap   = (1U << BCM_MWBMAP_MODOP(bitix));
+
+	return ((mwbmap_p->id_bitmap[wordix] & bitmap) != 0U);
+}
+
+/* Debug dump a multiword bitmap allocator */
+void
+bcm_mwbmap_show(struct bcm_mwbmap * mwbmap_hdl)
+{
+	uint32 ix, count;
+	bcm_mwbmap_t * mwbmap_p;
+
+	BCM_MWBMAP_AUDIT(mwbmap_hdl);
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	printf("mwbmap_p %p wmaps %u imaps %u ifree %d total %u\n", mwbmap_p,
+	       mwbmap_p->wmaps, mwbmap_p->imaps, mwbmap_p->ifree, mwbmap_p->total);
+	for (ix = 0U; ix < mwbmap_p->wmaps; ix++) {
+		printf("\tWDMAP:%2u. 0x%08x\t", ix, mwbmap_p->wd_bitmap[ix]);
+		bcm_bitprint32(mwbmap_p->wd_bitmap[ix]);
+		printf("\n");
+	}
+	for (ix = 0U; ix < mwbmap_p->imaps; ix++) {
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+		count = bcm_cntsetbits(mwbmap_p->id_bitmap[ix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+		count = mwbmap_p->wd_count[ix];
+		MWBMAP_ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[ix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+		printf("\tIDMAP:%2u. 0x%08x %02u\t", ix, mwbmap_p->id_bitmap[ix], count);
+		bcm_bitprint32(mwbmap_p->id_bitmap[ix]);
+		printf("\n");
+	}
+
+	return;
+}
+
+/* Audit a hierarchical multiword bitmap */
+void
+bcm_mwbmap_audit(struct bcm_mwbmap * mwbmap_hdl)
+{
+	bcm_mwbmap_t * mwbmap_p;
+	uint32 count, free_cnt = 0U, wordix, idmap_ix, bitix, *bitmap_p;
+
+	mwbmap_p = BCM_MWBMAP_PTR(mwbmap_hdl);
+
+	for (wordix = 0U; wordix < mwbmap_p->wmaps; ++wordix) {
+
+		bitmap_p = &mwbmap_p->wd_bitmap[wordix];
+
+		for (bitix = 0U; bitix < BCM_MWBMAP_BITS_WORD; bitix++) {
+			if ((*bitmap_p) & (1 << bitix)) {
+				idmap_ix = BCM_MWBMAP_MULOP(wordix) + bitix;
+#if defined(BCM_MWBMAP_USE_CNTSETBITS)
+				count = bcm_cntsetbits(mwbmap_p->id_bitmap[idmap_ix]);
+#else  /* ! BCM_MWBMAP_USE_CNTSETBITS */
+				count = mwbmap_p->wd_count[idmap_ix];
+				ASSERT(count == bcm_cntsetbits(mwbmap_p->id_bitmap[idmap_ix]));
+#endif /* ! BCM_MWBMAP_USE_CNTSETBITS */
+				ASSERT(count != 0U);
+				free_cnt += count;
+			}
+		}
+	}
+
+	ASSERT((int)free_cnt == mwbmap_p->ifree);
+}
+/* END : Multiword bitmap based 64bit to Unique 32bit Id allocator. */
+
+/* Simple 16bit Id allocator using a stack implementation. */
+typedef struct id16_map {
+	uint16  total;     /* total number of ids managed by allocator */
+	uint16  start;     /* start value of 16bit ids to be managed */
+	uint32  failures;  /* count of failures */
+	void    *dbg;      /* debug placeholder */
+	int     stack_idx; /* index into stack of available ids */
+	uint16  stack[0];  /* stack of 16 bit ids */
+} id16_map_t;
+
+#define ID16_MAP_SZ(items)      (sizeof(id16_map_t) + \
+	                             (sizeof(uint16) * (items)))
+
+#if defined(BCM_DBG)
+
+/* Uncomment BCM_DBG_ID16 to debug double free */
+/* #define BCM_DBG_ID16 */
+
+typedef struct id16_map_dbg {
+	uint16  total;
+	bool    avail[0];
+} id16_map_dbg_t;
+#define ID16_MAP_DBG_SZ(items)  (sizeof(id16_map_dbg_t) + \
+	                             (sizeof(bool) * (items)))
+#define ID16_MAP_MSG(x)         print x
+#else
+#define ID16_MAP_MSG(x)
+#endif /* BCM_DBG */
+
+void * /* Construct an id16 allocator: [start_val16 .. start_val16+total_ids) */
+id16_map_init(osl_t *osh, uint16 total_ids, uint16 start_val16)
+{
+	uint16 idx, val16;
+	id16_map_t * id16_map;
+
+	ASSERT(total_ids > 0);
+	ASSERT((start_val16 + total_ids) < ID16_INVALID);
+
+	id16_map = (id16_map_t *) MALLOC(osh, ID16_MAP_SZ(total_ids));
+	if (id16_map == NULL) {
+		return NULL;
+	}
+
+	id16_map->total = total_ids;
+	id16_map->start = start_val16;
+	id16_map->failures = 0;
+	id16_map->dbg = NULL;
+
+	/* Populate stack with 16bit id values, commencing with start_val16 */
+	id16_map->stack_idx = 0;
+	val16 = start_val16;
+
+	for (idx = 0; idx < total_ids; idx++, val16++) {
+		id16_map->stack_idx = idx;
+		id16_map->stack[id16_map->stack_idx] = val16;
+	}
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+	id16_map->dbg = MALLOC(osh, ID16_MAP_DBG_SZ(total_ids));
+
+	if (id16_map->dbg) {
+		id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+		id16_map_dbg->total = total_ids;
+		for (idx = 0; idx < total_ids; idx++) {
+			id16_map_dbg->avail[idx] = TRUE;
+		}
+	}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+	return (void *)id16_map;
+}
+
+void * /* Destruct an id16 allocator instance */
+id16_map_fini(osl_t *osh, void * id16_map_hndl)
+{
+	uint16 total_ids;
+	id16_map_t * id16_map;
+
+	if (id16_map_hndl == NULL)
+		return NULL;
+
+	id16_map = (id16_map_t *)id16_map_hndl;
+
+	total_ids = id16_map->total;
+	ASSERT(total_ids > 0);
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+	if (id16_map->dbg) {
+		MFREE(osh, id16_map->dbg, ID16_MAP_DBG_SZ(total_ids));
+		id16_map->dbg = NULL;
+	}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+	id16_map->total = 0;
+	MFREE(osh, id16_map, ID16_MAP_SZ(total_ids));
+
+	return NULL;
+}
+
+void
+id16_map_clear(void * id16_map_hndl, uint16 total_ids, uint16 start_val16)
+{
+	uint16 idx, val16;
+	id16_map_t * id16_map;
+
+	ASSERT(total_ids > 0);
+	ASSERT((start_val16 + total_ids) < ID16_INVALID);
+
+	id16_map = (id16_map_t *)id16_map_hndl;
+	if (id16_map == NULL) {
+		return;
+	}
+
+	id16_map->total = total_ids;
+	id16_map->start = start_val16;
+	id16_map->failures = 0;
+
+	/* Populate stack with 16bit id values, commencing with start_val16 */
+	id16_map->stack_idx = 0;
+	val16 = start_val16;
+
+	for (idx = 0; idx < total_ids; idx++, val16++) {
+		id16_map->stack_idx = idx;
+		id16_map->stack[id16_map->stack_idx] = val16;
+	}
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+	if (id16_map->dbg) {
+		id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+		id16_map_dbg->total = total_ids;
+		for (idx = 0; idx < total_ids; idx++) {
+			id16_map_dbg->avail[idx] = TRUE;
+		}
+	}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+}
+
+uint16 BCMFASTPATH /* Allocate a unique 16bit id */
+id16_map_alloc(void * id16_map_hndl)
+{
+	uint16 val16;
+	id16_map_t * id16_map;
+
+	ASSERT(id16_map_hndl != NULL);
+
+	id16_map = (id16_map_t *)id16_map_hndl;
+
+	ASSERT(id16_map->total > 0);
+
+	if (id16_map->stack_idx < 0) {
+		id16_map->failures++;
+		return ID16_INVALID;
+	}
+
+	val16 = id16_map->stack[id16_map->stack_idx];
+	id16_map->stack_idx--;
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+
+	ASSERT(val16 < (id16_map->start + id16_map->total));
+
+	if (id16_map->dbg) { /* Validate val16 */
+		id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+		ASSERT(id16_map_dbg->avail[val16 - id16_map->start] == TRUE);
+		id16_map_dbg->avail[val16 - id16_map->start] = FALSE;
+	}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+	return val16;
+}
+
+
+void BCMFASTPATH /* Free a 16bit id value into the id16 allocator */
+id16_map_free(void * id16_map_hndl, uint16 val16)
+{
+	id16_map_t * id16_map;
+
+	ASSERT(id16_map_hndl != NULL);
+
+	id16_map = (id16_map_t *)id16_map_hndl;
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+
+	ASSERT(val16 < (id16_map->start + id16_map->total));
+
+	if (id16_map->dbg) { /* Validate val16 */
+		id16_map_dbg_t *id16_map_dbg = (id16_map_dbg_t *)id16_map->dbg;
+
+		ASSERT(id16_map_dbg->avail[val16 - id16_map->start] == FALSE);
+		id16_map_dbg->avail[val16 - id16_map->start] = TRUE;
+	}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+	id16_map->stack_idx++;
+	id16_map->stack[id16_map->stack_idx] = val16;
+}
+
+uint32 /* Returns number of failures to allocate an unique id16 */
+id16_map_failures(void * id16_map_hndl)
+{
+	ASSERT(id16_map_hndl != NULL);
+	return ((id16_map_t *)id16_map_hndl)->failures;
+}
+
+bool
+id16_map_audit(void * id16_map_hndl)
+{
+	int idx;
+	int insane = 0;
+	id16_map_t * id16_map;
+
+	ASSERT(id16_map_hndl != NULL);
+
+	id16_map = (id16_map_t *)id16_map_hndl;
+
+	ASSERT((id16_map->stack_idx > 0) && (id16_map->stack_idx < id16_map->total));
+	for (idx = 0; idx <= id16_map->stack_idx; idx++) {
+		ASSERT(id16_map->stack[idx] >= id16_map->start);
+		ASSERT(id16_map->stack[idx] < (id16_map->start + id16_map->total));
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+		if (id16_map->dbg) {
+			uint16 val16 = id16_map->stack[idx];
+			if (((id16_map_dbg_t *)(id16_map->dbg))->avail[val16] != TRUE) {
+				insane |= 1;
+				ID16_MAP_MSG(("id16_map<%p>: stack_idx %u invalid val16 %u\n",
+				              id16_map_hndl, idx, val16));
+			}
+		}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+	}
+
+#if defined(BCM_DBG) && defined(BCM_DBG_ID16)
+	if (id16_map->dbg) {
+		uint16 avail = 0; /* Audit available ids counts */
+		for (idx = 0; idx < id16_map_dbg->total; idx++) {
+			if (((id16_map_dbg_t *)(id16_map->dbg))->avail[idx16] == TRUE)
+				avail++;
+		}
+		if (avail && (avail != (id16_map->stack_idx + 1))) {
+			insane |= 1;
+			ID16_MAP_MSG(("id16_map<%p>: avail %u stack_idx %u\n",
+			              id16_map_hndl, avail, id16_map->stack_idx));
+		}
+	}
+#endif /* BCM_DBG && BCM_DBG_ID16 */
+
+	return (!!insane);
+}
+/* END: Simple id16 allocator */
+
+
+#endif /* BCMDRIVER */
+
+/* calculate a >> b; and returns only lower 32 bits */
+void
+bcm_uint64_right_shift(uint32* r, uint32 a_high, uint32 a_low, uint32 b)
+{
+	uint32 a1 = a_high, a0 = a_low, r0 = 0;
+
+	if (b == 0) {
+		r0 = a_low;
+		*r = r0;
+		return;
+	}
+
+	if (b < 32) {
+		a0 = a0 >> b;
+		a1 = a1 & ((1 << b) - 1);
+		a1 = a1 << (32 - b);
+		r0 = a0 | a1;
+		*r = r0;
+		return;
+	} else {
+		r0 = a1 >> (b - 32);
+		*r = r0;
+		return;
+	}
+
+}
+
+/* calculate a + b where a is a 64 bit number and b is a 32 bit number */
+void
+bcm_add_64(uint32* r_hi, uint32* r_lo, uint32 offset)
+{
+	uint32 r1_lo = *r_lo;
+	(*r_lo) += offset;
+	if (*r_lo < r1_lo)
+		(*r_hi) ++;
+}
+
+/* calculate a - b where a is a 64 bit number and b is a 32 bit number */
+void
+bcm_sub_64(uint32* r_hi, uint32* r_lo, uint32 offset)
+{
+	uint32 r1_lo = *r_lo;
+	(*r_lo) -= offset;
+	if (*r_lo > r1_lo)
+		(*r_hi) --;
+}
+
+#ifdef DEBUG_COUNTER
+#if (OSL_SYSUPTIME_SUPPORT == TRUE)
+void counter_printlog(counter_tbl_t *ctr_tbl)
+{
+	uint32 now;
+
+	if (!ctr_tbl->enabled)
+		return;
+
+	now = OSL_SYSUPTIME();
+
+	if (now - ctr_tbl->prev_log_print > ctr_tbl->log_print_interval) {
+		uint8 i = 0;
+		printf("counter_print(%s %d):", ctr_tbl->name, now - ctr_tbl->prev_log_print);
+
+		for (i = 0; i < ctr_tbl->needed_cnt; i++) {
+			printf(" %u", ctr_tbl->cnt[i]);
+		}
+		printf("\n");
+
+		ctr_tbl->prev_log_print = now;
+		bzero(ctr_tbl->cnt, CNTR_TBL_MAX * sizeof(uint));
+	}
+}
+#else
+/* OSL_SYSUPTIME is not supported so no way to get time */
+#define counter_printlog(a) do {} while (0)
+#endif /* OSL_SYSUPTIME_SUPPORT == TRUE */
+#endif /* DEBUG_COUNTER */
+
+#ifdef BCMDRIVER
+void
+dll_pool_detach(void * osh, dll_pool_t * pool, uint16 elems_max, uint16 elem_size)
+{
+	uint32 mem_size;
+	mem_size = sizeof(dll_pool_t) + (elems_max * elem_size);
+	if (pool)
+		MFREE(osh, pool, mem_size);
+}
+dll_pool_t *
+dll_pool_init(void * osh, uint16 elems_max, uint16 elem_size)
+{
+	uint32 mem_size, i;
+	dll_pool_t * dll_pool_p;
+	dll_t * elem_p;
+
+	ASSERT(elem_size > sizeof(dll_t));
+
+	mem_size = sizeof(dll_pool_t) + (elems_max * elem_size);
+
+	if ((dll_pool_p = (dll_pool_t *)MALLOC(osh, mem_size)) == NULL) {
+		printf("dll_pool_init: elems_max<%u> elem_size<%u> malloc failure\n",
+			elems_max, elem_size);
+		ASSERT(0);
+		return dll_pool_p;
+	}
+
+	bzero(dll_pool_p, mem_size);
+
+	dll_init(&dll_pool_p->free_list);
+	dll_pool_p->elems_max = elems_max;
+	dll_pool_p->elem_size = elem_size;
+
+	elem_p = dll_pool_p->elements;
+	for (i = 0; i < elems_max; i++) {
+		dll_append(&dll_pool_p->free_list, elem_p);
+		elem_p = (dll_t *)((uintptr)elem_p + elem_size);
+	}
+
+	dll_pool_p->free_count = elems_max;
+
+	return dll_pool_p;
+}
+
+
+void *
+dll_pool_alloc(dll_pool_t * dll_pool_p)
+{
+	dll_t * elem_p;
+
+	if (dll_pool_p->free_count == 0) {
+		ASSERT(dll_empty(&dll_pool_p->free_list));
+		return NULL;
+	}
+
+	elem_p = dll_head_p(&dll_pool_p->free_list);
+	dll_delete(elem_p);
+	dll_pool_p->free_count -= 1;
+
+	return (void *)elem_p;
+}
+
+void
+dll_pool_free(dll_pool_t * dll_pool_p, void * elem_p)
+{
+	dll_t * node_p = (dll_t *)elem_p;
+	dll_prepend(&dll_pool_p->free_list, node_p);
+	dll_pool_p->free_count += 1;
+}
+
+
+void
+dll_pool_free_tail(dll_pool_t * dll_pool_p, void * elem_p)
+{
+	dll_t * node_p = (dll_t *)elem_p;
+	dll_append(&dll_pool_p->free_list, node_p);
+	dll_pool_p->free_count += 1;
+}
+
+#endif /* BCMDRIVER */
diff -ENwbur a/drivers/net/wireless/bcm4336/bcmwifi_channels.c b/drivers/net/wireless/bcm4336/bcmwifi_channels.c
--- a/drivers/net/wireless/bcm4336/bcmwifi_channels.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/bcmwifi_channels.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,1211 @@
+/*
+ * Misc utility routines used by kernel or app-level.
+ * Contents are wifi-specific, used by any kernel or app-level
+ * software that might want wifi things as it grows.
+ *
+ * $Copyright Open Broadcom Corporation$
+ * $Id: bcmwifi_channels.c 309193 2012-01-19 00:03:57Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmutils.h>
+
+#ifdef BCMDRIVER
+#include <osl.h>
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#define tolower(c) (bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#else
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+#ifndef ASSERT
+#define ASSERT(exp)
+#endif
+#endif /* BCMDRIVER */
+
+#include <bcmwifi_channels.h>
+
+#if defined(WIN32) && (defined(BCMDLL) || defined(WLMDLL))
+#include <bcmstdlib.h> 	/* For wl/exe/GNUmakefile.brcm_wlu and GNUmakefile.wlm_dll */
+#endif
+
+/* Definitions for D11AC capable Chanspec type */
+
+/* Chanspec ASCII representation with 802.11ac capability:
+ * [<band> 'g'] <channel> ['/'<bandwidth> [<ctl-sideband>]['/'<1st80channel>'-'<2nd80channel>]]
+ *
+ * <band>:
+ *      (optional) 2, 3, 4, 5 for 2.4GHz, 3GHz, 4GHz, and 5GHz respectively.
+ *      Default value is 2g if channel <= 14, otherwise 5g.
+ * <channel>:
+ *      channel number of the 5MHz, 10MHz, 20MHz channel,
+ *      or primary channel of 40MHz, 80MHz, 160MHz, or 80+80MHz channel.
+ * <bandwidth>:
+ *      (optional) 5, 10, 20, 40, 80, 160, or 80+80. Default value is 20.
+ * <primary-sideband>:
+ *      (only for 2.4GHz band 40MHz) U for upper sideband primary, L for lower.
+ *
+ *      For 2.4GHz band 40MHz channels, the same primary channel may be the
+ *      upper sideband for one 40MHz channel, and the lower sideband for an
+ *      overlapping 40MHz channel.  The U/L disambiguates which 40MHz channel
+ *      is being specified.
+ *
+ *      For 40MHz in the 5GHz band and all channel bandwidths greater than
+ *      40MHz, the U/L specificaion is not allowed since the channels are
+ *      non-overlapping and the primary sub-band is derived from its
+ *      position in the wide bandwidth channel.
+ *
+ * <1st80Channel>:
+ * <2nd80Channel>:
+ *      Required for 80+80, otherwise not allowed.
+ *      Specifies the center channel of the first and second 80MHz band.
+ *
+ * In its simplest form, it is a 20MHz channel number, with the implied band
+ * of 2.4GHz if channel number <= 14, and 5GHz otherwise.
+ *
+ * To allow for backward compatibility with scripts, the old form for
+ * 40MHz channels is also allowed: <channel><ctl-sideband>
+ *
+ * <channel>:
+ *	primary channel of 40MHz, channel <= 14 is 2GHz, otherwise 5GHz
+ * <ctl-sideband>:
+ * 	"U" for upper, "L" for lower (or lower case "u" "l")
+ *
+ * 5 GHz Examples:
+ *      Chanspec        BW        Center Ch  Channel Range  Primary Ch
+ *      5g8             20MHz     8          -              -
+ *      52              20MHz     52         -              -
+ *      52/40           40MHz     54         52-56          52
+ *      56/40           40MHz     54         52-56          56
+ *      52/80           80MHz     58         52-64          52
+ *      56/80           80MHz     58         52-64          56
+ *      60/80           80MHz     58         52-64          60
+ *      64/80           80MHz     58         52-64          64
+ *      52/160          160MHz    50         36-64          52
+ *      36/160          160MGz    50         36-64          36
+ *      36/80+80/42-106 80+80MHz  42,106     36-48,100-112  36
+ *
+ * 2 GHz Examples:
+ *      Chanspec        BW        Center Ch  Channel Range  Primary Ch
+ *      2g8             20MHz     8          -              -
+ *      8               20MHz     8          -              -
+ *      6               20MHz     6          -              -
+ *      6/40l           40MHz     8          6-10           6
+ *      6l              40MHz     8          6-10           6
+ *      6/40u           40MHz     4          2-6            6
+ *      6u              40MHz     4          2-6            6
+ */
+
+/* bandwidth ASCII string */
+static const char *wf_chspec_bw_str[] =
+{
+	"5",
+	"10",
+	"20",
+	"40",
+	"80",
+	"160",
+	"80+80",
+	"na"
+};
+
+static const uint8 wf_chspec_bw_mhz[] =
+{5, 10, 20, 40, 80, 160, 160};
+
+#define WF_NUM_BW \
+	(sizeof(wf_chspec_bw_mhz)/sizeof(uint8))
+
+/* 40MHz channels in 5GHz band */
+static const uint8 wf_5g_40m_chans[] =
+{38, 46, 54, 62, 102, 110, 118, 126, 134, 142, 151, 159};
+#define WF_NUM_5G_40M_CHANS \
+	(sizeof(wf_5g_40m_chans)/sizeof(uint8))
+
+/* 80MHz channels in 5GHz band */
+static const uint8 wf_5g_80m_chans[] =
+{42, 58, 106, 122, 138, 155};
+#define WF_NUM_5G_80M_CHANS \
+	(sizeof(wf_5g_80m_chans)/sizeof(uint8))
+
+/* 160MHz channels in 5GHz band */
+static const uint8 wf_5g_160m_chans[] =
+{50, 114};
+#define WF_NUM_5G_160M_CHANS \
+	(sizeof(wf_5g_160m_chans)/sizeof(uint8))
+
+
+/* convert bandwidth from chanspec to MHz */
+static uint
+bw_chspec_to_mhz(chanspec_t chspec)
+{
+	uint bw;
+
+	bw = (chspec & WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT;
+	return (bw >= WF_NUM_BW ? 0 : wf_chspec_bw_mhz[bw]);
+}
+
+/* bw in MHz, return the channel count from the center channel to the
+ * the channel at the edge of the band
+ */
+static uint8
+center_chan_to_edge(uint bw)
+{
+	/* edge channels separated by BW - 10MHz on each side
+	 * delta from cf to edge is half of that,
+	 * MHz to channel num conversion is 5MHz/channel
+	 */
+	return (uint8)(((bw - 20) / 2) / 5);
+}
+
+/* return channel number of the low edge of the band
+ * given the center channel and BW
+ */
+static uint8
+channel_low_edge(uint center_ch, uint bw)
+{
+	return (uint8)(center_ch - center_chan_to_edge(bw));
+}
+
+/* return side band number given center channel and control channel
+ * return -1 on error
+ */
+static int
+channel_to_sb(uint center_ch, uint ctl_ch, uint bw)
+{
+	uint lowest = channel_low_edge(center_ch, bw);
+	uint sb;
+
+	if ((ctl_ch - lowest) % 4) {
+		/* bad ctl channel, not mult 4 */
+		return -1;
+	}
+
+	sb = ((ctl_ch - lowest) / 4);
+
+	/* sb must be a index to a 20MHz channel in range */
+	if (sb >= (bw / 20)) {
+		/* ctl_ch must have been too high for the center_ch */
+		return -1;
+	}
+
+	return sb;
+}
+
+/* return control channel given center channel and side band */
+static uint8
+channel_to_ctl_chan(uint center_ch, uint bw, uint sb)
+{
+	return (uint8)(channel_low_edge(center_ch, bw) + sb * 4);
+}
+
+/* return index of 80MHz channel from channel number
+ * return -1 on error
+ */
+static int
+channel_80mhz_to_id(uint ch)
+{
+	uint i;
+	for (i = 0; i < WF_NUM_5G_80M_CHANS; i ++) {
+		if (ch == wf_5g_80m_chans[i])
+			return i;
+	}
+
+	return -1;
+}
+
+/* wrapper function for wf_chspec_ntoa. In case of an error it puts
+ * the original chanspec in the output buffer, prepended with "invalid".
+ * Can be directly used in print routines as it takes care of null
+ */
+char *
+wf_chspec_ntoa_ex(chanspec_t chspec, char *buf)
+{
+	if (wf_chspec_ntoa(chspec, buf) == NULL)
+		snprintf(buf, CHANSPEC_STR_LEN, "invalid 0x%04x", chspec);
+	return buf;
+}
+
+/* given a chanspec and a string buffer, format the chanspec as a
+ * string, and return the original pointer a.
+ * Min buffer length must be CHANSPEC_STR_LEN.
+ * On error return NULL
+ */
+char *
+wf_chspec_ntoa(chanspec_t chspec, char *buf)
+{
+	const char *band;
+	uint ctl_chan;
+
+	if (wf_chspec_malformed(chspec))
+		return NULL;
+
+	band = "";
+
+	/* check for non-default band spec */
+	if ((CHSPEC_IS2G(chspec) && CHSPEC_CHANNEL(chspec) > CH_MAX_2G_CHANNEL) ||
+	    (CHSPEC_IS5G(chspec) && CHSPEC_CHANNEL(chspec) <= CH_MAX_2G_CHANNEL))
+		band = (CHSPEC_IS2G(chspec)) ? "2g" : "5g";
+
+	/* ctl channel */
+	ctl_chan = wf_chspec_ctlchan(chspec);
+
+	/* bandwidth and ctl sideband */
+	if (CHSPEC_IS20(chspec)) {
+		snprintf(buf, CHANSPEC_STR_LEN, "%s%d", band, ctl_chan);
+	} else if (!CHSPEC_IS8080(chspec)) {
+		const char *bw;
+		const char *sb = "";
+
+		bw = wf_chspec_bw_str[(chspec & WL_CHANSPEC_BW_MASK) >> WL_CHANSPEC_BW_SHIFT];
+
+#ifdef CHANSPEC_NEW_40MHZ_FORMAT
+		/* ctl sideband string if needed for 2g 40MHz */
+		if (CHSPEC_IS40(chspec) && CHSPEC_IS2G(chspec)) {
+			sb = CHSPEC_SB_UPPER(chspec) ? "u" : "l";
+		}
+
+		snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s%s", band, ctl_chan, bw, sb);
+#else
+		/* ctl sideband string instead of BW for 40MHz */
+		if (CHSPEC_IS40(chspec)) {
+			sb = CHSPEC_SB_UPPER(chspec) ? "u" : "l";
+			snprintf(buf, CHANSPEC_STR_LEN, "%s%d%s", band, ctl_chan, sb);
+		} else {
+			snprintf(buf, CHANSPEC_STR_LEN, "%s%d/%s", band, ctl_chan, bw);
+		}
+#endif /* CHANSPEC_NEW_40MHZ_FORMAT */
+
+	} else {
+		/* 80+80 */
+		uint chan1 = (chspec & WL_CHANSPEC_CHAN1_MASK) >> WL_CHANSPEC_CHAN1_SHIFT;
+		uint chan2 = (chspec & WL_CHANSPEC_CHAN2_MASK) >> WL_CHANSPEC_CHAN2_SHIFT;
+
+		/* convert to channel number */
+		chan1 = (chan1 < WF_NUM_5G_80M_CHANS) ? wf_5g_80m_chans[chan1] : 0;
+		chan2 = (chan2 < WF_NUM_5G_80M_CHANS) ? wf_5g_80m_chans[chan2] : 0;
+
+		/* Outputs a max of CHANSPEC_STR_LEN chars including '\0'  */
+		snprintf(buf, CHANSPEC_STR_LEN, "%d/80+80/%d-%d", ctl_chan, chan1, chan2);
+	}
+
+	return (buf);
+}
+
+static int
+read_uint(const char **p, unsigned int *num)
+{
+	unsigned long val;
+	char *endp = NULL;
+
+	val = strtoul(*p, &endp, 10);
+	/* if endp is the initial pointer value, then a number was not read */
+	if (endp == *p)
+		return 0;
+
+	/* advance the buffer pointer to the end of the integer string */
+	*p = endp;
+	/* return the parsed integer */
+	*num = (unsigned int)val;
+
+	return 1;
+}
+
+/* given a chanspec string, convert to a chanspec.
+ * On error return 0
+ */
+chanspec_t
+wf_chspec_aton(const char *a)
+{
+	chanspec_t chspec;
+	uint chspec_ch, chspec_band, bw, chspec_bw, chspec_sb;
+	uint num, ctl_ch;
+	uint ch1, ch2;
+	char c, sb_ul = '\0';
+	int i;
+
+	bw = 20;
+	chspec_sb = 0;
+	chspec_ch = ch1 = ch2 = 0;
+
+	/* parse channel num or band */
+	if (!read_uint(&a, &num))
+		return 0;
+
+	/* if we are looking at a 'g', then the first number was a band */
+	c = tolower((int)a[0]);
+	if (c == 'g') {
+		a ++; /* consume the char */
+
+		/* band must be "2" or "5" */
+		if (num == 2)
+			chspec_band = WL_CHANSPEC_BAND_2G;
+		else if (num == 5)
+			chspec_band = WL_CHANSPEC_BAND_5G;
+		else
+			return 0;
+
+		/* read the channel number */
+		if (!read_uint(&a, &ctl_ch))
+			return 0;
+
+		c = tolower((int)a[0]);
+	}
+	else {
+		/* first number is channel, use default for band */
+		ctl_ch = num;
+		chspec_band = ((ctl_ch <= CH_MAX_2G_CHANNEL) ?
+		               WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+	}
+
+	if (c == '\0') {
+		/* default BW of 20MHz */
+		chspec_bw = WL_CHANSPEC_BW_20;
+		goto done_read;
+	}
+
+	a ++; /* consume the 'u','l', or '/' */
+
+	/* check 'u'/'l' */
+	if (c == 'u' || c == 'l') {
+		sb_ul = c;
+		chspec_bw = WL_CHANSPEC_BW_40;
+		goto done_read;
+	}
+
+	/* next letter must be '/' */
+	if (c != '/')
+		return 0;
+
+	/* read bandwidth */
+	if (!read_uint(&a, &bw))
+		return 0;
+
+	/* convert to chspec value */
+	if (bw == 20) {
+		chspec_bw = WL_CHANSPEC_BW_20;
+	} else if (bw == 40) {
+		chspec_bw = WL_CHANSPEC_BW_40;
+	} else if (bw == 80) {
+		chspec_bw = WL_CHANSPEC_BW_80;
+	} else if (bw == 160) {
+		chspec_bw = WL_CHANSPEC_BW_160;
+	} else {
+		return 0;
+	}
+
+	/* So far we have <band>g<chan>/<bw>
+	 * Can now be followed by u/l if bw = 40,
+	 * or '+80' if bw = 80, to make '80+80' bw.
+	 */
+
+	c = tolower((int)a[0]);
+
+	/* if we have a 2g/40 channel, we should have a l/u spec now */
+	if (chspec_band == WL_CHANSPEC_BAND_2G && bw == 40) {
+		if (c == 'u' || c == 'l') {
+			a ++; /* consume the u/l char */
+			sb_ul = c;
+			goto done_read;
+		}
+	}
+
+	/* check for 80+80 */
+	if (c == '+') {
+		/* 80+80 */
+		static const char *plus80 = "80/";
+
+		/* must be looking at '+80/'
+		 * check and consume this string.
+		 */
+		chspec_bw = WL_CHANSPEC_BW_8080;
+
+		a ++; /* consume the char '+' */
+
+		/* consume the '80/' string */
+		for (i = 0; i < 3; i++) {
+			if (*a++ != *plus80++) {
+				return 0;
+			}
+		}
+
+		/* read primary 80MHz channel */
+		if (!read_uint(&a, &ch1))
+			return 0;
+
+		/* must followed by '-' */
+		if (a[0] != '-')
+			return 0;
+		a ++; /* consume the char */
+
+		/* read secondary 80MHz channel */
+		if (!read_uint(&a, &ch2))
+			return 0;
+	}
+
+done_read:
+	/* skip trailing white space */
+	while (a[0] == ' ') {
+		a ++;
+	}
+
+	/* must be end of string */
+	if (a[0] != '\0')
+		return 0;
+
+	/* Now have all the chanspec string parts read;
+	 * chspec_band, ctl_ch, chspec_bw, sb_ul, ch1, ch2.
+	 * chspec_band and chspec_bw are chanspec values.
+	 * Need to convert ctl_ch, sb_ul, and ch1,ch2 into
+	 * a center channel (or two) and sideband.
+	 */
+
+	/* if a sb u/l string was given, just use that,
+	 * guaranteed to be bw = 40 by sting parse.
+	 */
+	if (sb_ul != '\0') {
+		if (sb_ul == 'l') {
+			chspec_ch = UPPER_20_SB(ctl_ch);
+			chspec_sb = WL_CHANSPEC_CTL_SB_LLL;
+		} else if (sb_ul == 'u') {
+			chspec_ch = LOWER_20_SB(ctl_ch);
+			chspec_sb = WL_CHANSPEC_CTL_SB_LLU;
+		}
+	}
+	/* if the bw is 20, center and sideband are trivial */
+	else if (chspec_bw == WL_CHANSPEC_BW_20) {
+		chspec_ch = ctl_ch;
+		chspec_sb = WL_CHANSPEC_CTL_SB_NONE;
+	}
+	/* if the bw is 40/80/160, not 80+80, a single method
+	 * can be used to to find the center and sideband
+	 */
+	else if (chspec_bw != WL_CHANSPEC_BW_8080) {
+		/* figure out ctl sideband based on ctl channel and bandwidth */
+		const uint8 *center_ch = NULL;
+		int num_ch = 0;
+		int sb = -1;
+
+		if (chspec_bw == WL_CHANSPEC_BW_40) {
+			center_ch = wf_5g_40m_chans;
+			num_ch = WF_NUM_5G_40M_CHANS;
+		} else if (chspec_bw == WL_CHANSPEC_BW_80) {
+			center_ch = wf_5g_80m_chans;
+			num_ch = WF_NUM_5G_80M_CHANS;
+		} else if (chspec_bw == WL_CHANSPEC_BW_160) {
+			center_ch = wf_5g_160m_chans;
+			num_ch = WF_NUM_5G_160M_CHANS;
+		} else {
+			return 0;
+		}
+
+		for (i = 0; i < num_ch; i ++) {
+			sb = channel_to_sb(center_ch[i], ctl_ch, bw);
+			if (sb >= 0) {
+				chspec_ch = center_ch[i];
+				chspec_sb = sb << WL_CHANSPEC_CTL_SB_SHIFT;
+				break;
+			}
+		}
+
+		/* check for no matching sb/center */
+		if (sb < 0) {
+			return 0;
+		}
+	}
+	/* Otherwise, bw is 80+80. Figure out channel pair and sb */
+	else {
+		int ch1_id = 0, ch2_id = 0;
+		int sb;
+
+		/* look up the channel ID for the specified channel numbers */
+		ch1_id = channel_80mhz_to_id(ch1);
+		ch2_id = channel_80mhz_to_id(ch2);
+
+		/* validate channels */
+		if (ch1_id < 0 || ch2_id < 0)
+			return 0;
+
+		/* combine 2 channel IDs in channel field of chspec */
+		chspec_ch = (((uint)ch1_id << WL_CHANSPEC_CHAN1_SHIFT) |
+		             ((uint)ch2_id << WL_CHANSPEC_CHAN2_SHIFT));
+
+		/* figure out primary 20 MHz sideband */
+
+		/* is the primary channel contained in the 1st 80MHz channel? */
+		sb = channel_to_sb(ch1, ctl_ch, bw);
+		if (sb < 0) {
+			/* no match for primary channel 'ctl_ch' in segment0 80MHz channel */
+			return 0;
+		}
+
+		chspec_sb = sb << WL_CHANSPEC_CTL_SB_SHIFT;
+	}
+
+	chspec = (chspec_ch | chspec_band | chspec_bw | chspec_sb);
+
+	if (wf_chspec_malformed(chspec))
+		return 0;
+
+	return chspec;
+}
+
+/*
+ * Verify the chanspec is using a legal set of parameters, i.e. that the
+ * chanspec specified a band, bw, ctl_sb and channel and that the
+ * combination could be legal given any set of circumstances.
+ * RETURNS: TRUE is the chanspec is malformed, false if it looks good.
+ */
+bool
+wf_chspec_malformed(chanspec_t chanspec)
+{
+	uint chspec_bw = CHSPEC_BW(chanspec);
+	uint chspec_ch = CHSPEC_CHANNEL(chanspec);
+
+	/* must be 2G or 5G band */
+	if (CHSPEC_IS2G(chanspec)) {
+		/* must be valid bandwidth */
+		if (chspec_bw != WL_CHANSPEC_BW_20 &&
+		    chspec_bw != WL_CHANSPEC_BW_40) {
+			return TRUE;
+		}
+	} else if (CHSPEC_IS5G(chanspec)) {
+		if (chspec_bw == WL_CHANSPEC_BW_8080) {
+			uint ch1_id, ch2_id;
+
+			/* channel IDs in 80+80 must be in range */
+			ch1_id = CHSPEC_CHAN1(chanspec);
+			ch2_id = CHSPEC_CHAN2(chanspec);
+			if (ch1_id >= WF_NUM_5G_80M_CHANS || ch2_id >= WF_NUM_5G_80M_CHANS)
+				return TRUE;
+
+		} else if (chspec_bw == WL_CHANSPEC_BW_20 || chspec_bw == WL_CHANSPEC_BW_40 ||
+		           chspec_bw == WL_CHANSPEC_BW_80 || chspec_bw == WL_CHANSPEC_BW_160) {
+
+			if (chspec_ch > MAXCHANNEL) {
+				return TRUE;
+			}
+		} else {
+			/* invalid bandwidth */
+			return TRUE;
+		}
+	} else {
+		/* must be 2G or 5G band */
+		return TRUE;
+	}
+
+	/* side band needs to be consistent with bandwidth */
+	if (chspec_bw == WL_CHANSPEC_BW_20) {
+		if (CHSPEC_CTL_SB(chanspec) != WL_CHANSPEC_CTL_SB_LLL)
+			return TRUE;
+	} else if (chspec_bw == WL_CHANSPEC_BW_40) {
+		if (CHSPEC_CTL_SB(chanspec) > WL_CHANSPEC_CTL_SB_LLU)
+			return TRUE;
+	} else if (chspec_bw == WL_CHANSPEC_BW_80 ||
+	           chspec_bw == WL_CHANSPEC_BW_8080) {
+		if (CHSPEC_CTL_SB(chanspec) > WL_CHANSPEC_CTL_SB_LUU)
+			return TRUE;
+	}
+	else if (chspec_bw == WL_CHANSPEC_BW_160) {
+		ASSERT(CHSPEC_CTL_SB(chanspec) <= WL_CHANSPEC_CTL_SB_UUU);
+	}
+	return FALSE;
+}
+
+/*
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ * RETURNS: TRUE if the chanspec is a valid 802.11 channel
+ */
+bool
+wf_chspec_valid(chanspec_t chanspec)
+{
+	uint chspec_bw = CHSPEC_BW(chanspec);
+	uint chspec_ch = CHSPEC_CHANNEL(chanspec);
+
+	if (wf_chspec_malformed(chanspec))
+		return FALSE;
+
+	if (CHSPEC_IS2G(chanspec)) {
+		/* must be valid bandwidth and channel range */
+		if (chspec_bw == WL_CHANSPEC_BW_20) {
+			if (chspec_ch >= 1 && chspec_ch <= 14)
+				return TRUE;
+		} else if (chspec_bw == WL_CHANSPEC_BW_40) {
+			if (chspec_ch >= 3 && chspec_ch <= 11)
+				return TRUE;
+		}
+	} else if (CHSPEC_IS5G(chanspec)) {
+		if (chspec_bw == WL_CHANSPEC_BW_8080) {
+			uint16 ch1, ch2;
+
+			ch1 = wf_5g_80m_chans[CHSPEC_CHAN1(chanspec)];
+			ch2 = wf_5g_80m_chans[CHSPEC_CHAN2(chanspec)];
+
+			/* the two channels must be separated by more than 80MHz by VHT req */
+			if ((ch2 > ch1 + CH_80MHZ_APART) ||
+			    (ch1 > ch2 + CH_80MHZ_APART))
+				return TRUE;
+		} else {
+			const uint8 *center_ch;
+			uint num_ch, i;
+
+			if (chspec_bw == WL_CHANSPEC_BW_20 || chspec_bw == WL_CHANSPEC_BW_40) {
+				center_ch = wf_5g_40m_chans;
+				num_ch = WF_NUM_5G_40M_CHANS;
+			} else if (chspec_bw == WL_CHANSPEC_BW_80) {
+				center_ch = wf_5g_80m_chans;
+				num_ch = WF_NUM_5G_80M_CHANS;
+			} else if (chspec_bw == WL_CHANSPEC_BW_160) {
+				center_ch = wf_5g_160m_chans;
+				num_ch = WF_NUM_5G_160M_CHANS;
+			} else {
+				/* invalid bandwidth */
+				return FALSE;
+			}
+
+			/* check for a valid center channel */
+			if (chspec_bw == WL_CHANSPEC_BW_20) {
+				/* We don't have an array of legal 20MHz 5G channels, but they are
+				 * each side of the legal 40MHz channels.  Check the chanspec
+				 * channel against either side of the 40MHz channels.
+				 */
+				for (i = 0; i < num_ch; i ++) {
+					if (chspec_ch == (uint)LOWER_20_SB(center_ch[i]) ||
+					    chspec_ch == (uint)UPPER_20_SB(center_ch[i]))
+						break; /* match found */
+				}
+
+				if (i == num_ch) {
+					/* check for channel 165 which is not the side band
+					 * of 40MHz 5G channel
+					 */
+					if (chspec_ch == 165)
+						i = 0;
+
+					/* check for legacy JP channels on failure */
+					if (chspec_ch == 34 || chspec_ch == 38 ||
+					    chspec_ch == 42 || chspec_ch == 46)
+						i = 0;
+				}
+			} else {
+				/* check the chanspec channel to each legal channel */
+				for (i = 0; i < num_ch; i ++) {
+					if (chspec_ch == center_ch[i])
+						break; /* match found */
+				}
+			}
+
+			if (i < num_ch) {
+				/* match found */
+				return TRUE;
+			}
+		}
+	}
+
+	return FALSE;
+}
+
+/*
+ * This function returns the channel number that control traffic is being sent on, for 20MHz
+ * channels this is just the channel number, for 40MHZ, 80MHz, 160MHz channels it is the 20MHZ
+ * sideband depending on the chanspec selected
+ */
+uint8
+wf_chspec_ctlchan(chanspec_t chspec)
+{
+	uint center_chan;
+	uint bw_mhz;
+	uint sb;
+
+	ASSERT(!wf_chspec_malformed(chspec));
+
+	/* Is there a sideband ? */
+	if (CHSPEC_IS20(chspec)) {
+		return CHSPEC_CHANNEL(chspec);
+	} else {
+		sb = CHSPEC_CTL_SB(chspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+
+		if (CHSPEC_IS8080(chspec)) {
+			/* For an 80+80 MHz channel, the sideband 'sb' field is an 80 MHz sideband
+			 * (LL, LU, UL, LU) for the 80 MHz frequency segment 0.
+			 */
+			uint chan_id = CHSPEC_CHAN1(chspec);
+
+			bw_mhz = 80;
+
+			/* convert from channel index to channel number */
+			center_chan = wf_5g_80m_chans[chan_id];
+		}
+		else {
+			bw_mhz = bw_chspec_to_mhz(chspec);
+			center_chan = CHSPEC_CHANNEL(chspec) >> WL_CHANSPEC_CHAN_SHIFT;
+		}
+
+		return (channel_to_ctl_chan(center_chan, bw_mhz, sb));
+	}
+}
+
+/* given a chanspec, return the bandwidth string */
+char *
+wf_chspec_to_bw_str(chanspec_t chspec)
+{
+	return (char *)wf_chspec_bw_str[(CHSPEC_BW(chspec) >> WL_CHANSPEC_BW_SHIFT)];
+}
+
+/*
+ * This function returns the chanspec of the control channel of a given chanspec
+ */
+chanspec_t
+wf_chspec_ctlchspec(chanspec_t chspec)
+{
+	chanspec_t ctl_chspec = chspec;
+	uint8 ctl_chan;
+
+	ASSERT(!wf_chspec_malformed(chspec));
+
+	/* Is there a sideband ? */
+	if (!CHSPEC_IS20(chspec)) {
+		ctl_chan = wf_chspec_ctlchan(chspec);
+		ctl_chspec = ctl_chan | WL_CHANSPEC_BW_20;
+		ctl_chspec |= CHSPEC_BAND(chspec);
+	}
+	return ctl_chspec;
+}
+
+/* return chanspec given control channel and bandwidth
+ * return 0 on error
+ */
+uint16
+wf_channel2chspec(uint ctl_ch, uint bw)
+{
+	uint16 chspec;
+	const uint8 *center_ch = NULL;
+	int num_ch = 0;
+	int sb = -1;
+	int i = 0;
+
+	chspec = ((ctl_ch <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G);
+
+	chspec |= bw;
+
+	if (bw == WL_CHANSPEC_BW_40) {
+		center_ch = wf_5g_40m_chans;
+		num_ch = WF_NUM_5G_40M_CHANS;
+		bw = 40;
+	} else if (bw == WL_CHANSPEC_BW_80) {
+		center_ch = wf_5g_80m_chans;
+		num_ch = WF_NUM_5G_80M_CHANS;
+		bw = 80;
+	} else if (bw == WL_CHANSPEC_BW_160) {
+		center_ch = wf_5g_160m_chans;
+		num_ch = WF_NUM_5G_160M_CHANS;
+		bw = 160;
+	} else if (bw == WL_CHANSPEC_BW_20) {
+		chspec |= ctl_ch;
+		return chspec;
+	} else {
+		return 0;
+	}
+
+	for (i = 0; i < num_ch; i ++) {
+		sb = channel_to_sb(center_ch[i], ctl_ch, bw);
+		if (sb >= 0) {
+			chspec |= center_ch[i];
+			chspec |= (sb << WL_CHANSPEC_CTL_SB_SHIFT);
+			break;
+		}
+	}
+
+	/* check for no matching sb/center */
+	if (sb < 0) {
+		return 0;
+	}
+
+	return chspec;
+}
+
+/*
+ * This function returns the chanspec for the primary 40MHz of an 80MHz channel.
+ * The control sideband specifies the same 20MHz channel that the 80MHz channel is using
+ * as the primary 20MHz channel.
+ */
+extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec)
+{
+	chanspec_t chspec40 = chspec;
+	uint center_chan;
+	uint sb;
+
+	ASSERT(!wf_chspec_malformed(chspec));
+
+	/* if the chanspec is > 80MHz, use the helper routine to find the primary 80 MHz channel */
+	if (CHSPEC_IS8080(chspec) || CHSPEC_IS160(chspec)) {
+		chspec = wf_chspec_primary80_chspec(chspec);
+	}
+
+	/* determine primary 40 MHz sub-channel of an 80 MHz chanspec */
+	if (CHSPEC_IS80(chspec)) {
+		center_chan = CHSPEC_CHANNEL(chspec);
+		sb = CHSPEC_CTL_SB(chspec);
+
+		if (sb < WL_CHANSPEC_CTL_SB_UL) {
+			/* Primary 40MHz is on lower side */
+			center_chan -= CH_20MHZ_APART;
+			/* sideband bits are the same for LL/LU and L/U */
+		} else {
+			/* Primary 40MHz is on upper side */
+			center_chan += CH_20MHZ_APART;
+			/* sideband bits need to be adjusted by UL offset */
+			sb -= WL_CHANSPEC_CTL_SB_UL;
+		}
+
+		/* Create primary 40MHz chanspec */
+		chspec40 = (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_40 |
+		            sb | center_chan);
+	}
+
+	return chspec40;
+}
+
+/*
+ * Return the channel number for a given frequency and base frequency.
+ * The returned channel number is relative to the given base frequency.
+ * If the given base frequency is zero, a base frequency of 5 GHz is assumed for
+ * frequencies from 5 - 6 GHz, and 2.407 GHz is assumed for 2.4 - 2.5 GHz.
+ *
+ * Frequency is specified in MHz.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ *
+ * The returned channel will be in the range [1, 14] in the 2.4 GHz band
+ * and [0, 200] otherwise.
+ * -1 is returned if the start_factor is WF_CHAN_FACTOR_2_4_G and the
+ * frequency is not a 2.4 GHz channel, or if the frequency is not and even
+ * multiple of 5 MHz from the base frequency to the base plus 1 GHz.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ */
+int
+wf_mhz2channel(uint freq, uint start_factor)
+{
+	int ch = -1;
+	uint base;
+	int offset;
+
+	/* take the default channel start frequency */
+	if (start_factor == 0) {
+		if (freq >= 2400 && freq <= 2500)
+			start_factor = WF_CHAN_FACTOR_2_4_G;
+		else if (freq >= 5000 && freq <= 6000)
+			start_factor = WF_CHAN_FACTOR_5_G;
+	}
+
+	if (freq == 2484 && start_factor == WF_CHAN_FACTOR_2_4_G)
+		return 14;
+
+	base = start_factor / 2;
+
+	/* check that the frequency is in 1GHz range of the base */
+	if ((freq < base) || (freq > base + 1000))
+		return -1;
+
+	offset = freq - base;
+	ch = offset / 5;
+
+	/* check that frequency is a 5MHz multiple from the base */
+	if (offset != (ch * 5))
+		return -1;
+
+	/* restricted channel range check for 2.4G */
+	if (start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 13))
+		return -1;
+
+	return ch;
+}
+
+/*
+ * Return the center frequency in MHz of the given channel and base frequency.
+ * The channel number is interpreted relative to the given base frequency.
+ *
+ * The valid channel range is [1, 14] in the 2.4 GHz band and [0, 200] otherwise.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_4_G, and WF_CHAN_FACTOR_5_G
+ * are defined for 2.4 GHz, 4 GHz, and 5 GHz bands.
+ * The channel range of [1, 14] is only checked for a start_factor of
+ * WF_CHAN_FACTOR_2_4_G (4814 = 2407 * 2).
+ * Odd start_factors produce channels on .5 MHz boundaries, in which case
+ * the answer is rounded down to an integral MHz.
+ * -1 is returned for an out of range channel.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ */
+int
+wf_channel2mhz(uint ch, uint start_factor)
+{
+	int freq;
+
+	if ((start_factor == WF_CHAN_FACTOR_2_4_G && (ch < 1 || ch > 14)) ||
+	    (ch > 200))
+		freq = -1;
+	else if ((start_factor == WF_CHAN_FACTOR_2_4_G) && (ch == 14))
+		freq = 2484;
+	else
+		freq = ch * 5 + start_factor / 2;
+
+	return freq;
+}
+
+static const uint16 sidebands[] = {
+	WL_CHANSPEC_CTL_SB_LLL, WL_CHANSPEC_CTL_SB_LLU,
+	WL_CHANSPEC_CTL_SB_LUL, WL_CHANSPEC_CTL_SB_LUU,
+	WL_CHANSPEC_CTL_SB_ULL, WL_CHANSPEC_CTL_SB_ULU,
+	WL_CHANSPEC_CTL_SB_UUL, WL_CHANSPEC_CTL_SB_UUU
+};
+
+/*
+ * Returns the chanspec 80Mhz channel corresponding to the following input
+ * parameters
+ *
+ *	primary_channel - primary 20Mhz channel
+ *	center_channel   - center frequecny of the 80Mhz channel
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155}
+ *
+ * returns INVCHANSPEC in case of error
+ */
+chanspec_t
+wf_chspec_80(uint8 center_channel, uint8 primary_channel)
+{
+
+	chanspec_t chanspec = INVCHANSPEC;
+	chanspec_t chanspec_cur;
+	uint i;
+
+	for (i = 0; i < WF_NUM_SIDEBANDS_80MHZ; i++) {
+		chanspec_cur = CH80MHZ_CHSPEC(center_channel, sidebands[i]);
+		if (primary_channel == wf_chspec_ctlchan(chanspec_cur)) {
+			chanspec = chanspec_cur;
+			break;
+		}
+	}
+	/* If the loop ended early, we are good, otherwise we did not
+	* find a 80MHz chanspec with the given center_channel that had a primary channel
+	*matching the given primary_channel.
+	*/
+	return chanspec;
+}
+
+/*
+ * Returns the 80+80 chanspec corresponding to the following input parameters
+ *
+ *    primary_20mhz - Primary 20 MHz channel
+ *    chan0 - center channel number of one frequency segment
+ *    chan1 - center channel number of the other frequency segment
+ *
+ * Parameters chan0 and chan1 are channel numbers in {42, 58, 106, 122, 138, 155}.
+ * The primary channel must be contained in one of the 80MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * Returns INVCHANSPEC in case of error.
+ *
+ * Refer to IEEE802.11ac section 22.3.14 "Channelization".
+ */
+chanspec_t
+wf_chspec_get8080_chspec(uint8 primary_20mhz, uint8 chan0, uint8 chan1)
+{
+	int sb = 0;
+	uint16 chanspec = 0;
+	int chan0_id = 0, chan1_id = 0;
+	int seg0, seg1;
+
+	chan0_id = channel_80mhz_to_id(chan0);
+	chan1_id = channel_80mhz_to_id(chan1);
+
+	/* make sure the channel numbers were valid */
+	if (chan0_id == -1 || chan1_id == -1)
+		return INVCHANSPEC;
+
+	/* does the primary channel fit with the 1st 80MHz channel ? */
+	sb = channel_to_sb(chan0, primary_20mhz, 80);
+	if (sb >= 0) {
+		/* yes, so chan0 is frequency segment 0, and chan1 is seg 1 */
+		seg0 = chan0_id;
+		seg1 = chan1_id;
+	} else {
+		/* no, so does the primary channel fit with the 2nd 80MHz channel ? */
+		sb = channel_to_sb(chan1, primary_20mhz, 80);
+		if (sb < 0) {
+			/* no match for ctl_ch to either 80MHz center channel */
+			return INVCHANSPEC;
+		}
+		/* swapped, so chan1 is frequency segment 0, and chan0 is seg 1 */
+		seg0 = chan1_id;
+		seg1 = chan0_id;
+	}
+
+	chanspec = ((seg0 << WL_CHANSPEC_CHAN1_SHIFT) |
+	            (seg1 << WL_CHANSPEC_CHAN2_SHIFT) |
+	            (sb << WL_CHANSPEC_CTL_SB_SHIFT) |
+	            WL_CHANSPEC_BW_8080 |
+	            WL_CHANSPEC_BAND_5G);
+
+	return chanspec;
+}
+
+/*
+ * This function returns the 80Mhz channel for the given id.
+ */
+static uint8
+wf_chspec_get80Mhz_ch(uint8 chan_80Mhz_id)
+{
+	if (chan_80Mhz_id < WF_NUM_5G_80M_CHANS)
+		return wf_5g_80m_chans[chan_80Mhz_id];
+
+	return 0;
+}
+
+/*
+ * Returns the primary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz primary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40 Mhz chanspec
+ */
+
+uint8
+wf_chspec_primary80_channel(chanspec_t chanspec)
+{
+	uint8 primary80_chan;
+
+	if (CHSPEC_IS80(chanspec))	{
+		primary80_chan = CHSPEC_CHANNEL(chanspec);
+	}
+	else if (CHSPEC_IS8080(chanspec)) {
+		/* Channel ID 1 corresponds to frequency segment 0, the primary 80 MHz segment */
+		primary80_chan = wf_chspec_get80Mhz_ch(CHSPEC_CHAN1(chanspec));
+	}
+	else if (CHSPEC_IS160(chanspec)) {
+		uint8 center_chan = CHSPEC_CHANNEL(chanspec);
+		uint sb = CHSPEC_CTL_SB(chanspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+
+		/* based on the sb value primary 80 channel can be retrieved
+		 * if sb is in range 0 to 3 the lower band is the 80Mhz primary band
+		 */
+		if (sb < 4) {
+			primary80_chan = center_chan - CH_40MHZ_APART;
+		}
+		/* if sb is in range 4 to 7 the upper band is the 80Mhz primary band */
+		else
+		{
+			primary80_chan = center_chan + CH_40MHZ_APART;
+		}
+	}
+	else {
+		/* for 20 and 40 Mhz */
+		primary80_chan = -1;
+	}
+	return primary80_chan;
+}
+
+/*
+ * Returns the secondary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz secondary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40/80 Mhz chanspec
+ */
+uint8
+wf_chspec_secondary80_channel(chanspec_t chanspec)
+{
+	uint8 secondary80_chan;
+
+	if (CHSPEC_IS8080(chanspec)) {
+		secondary80_chan = wf_chspec_get80Mhz_ch(CHSPEC_CHAN2(chanspec));
+	}
+	else if (CHSPEC_IS160(chanspec)) {
+		uint8 center_chan = CHSPEC_CHANNEL(chanspec);
+		uint sb = CHSPEC_CTL_SB(chanspec) >> WL_CHANSPEC_CTL_SB_SHIFT;
+
+		/* based on the sb value  secondary 80 channel can be retrieved
+		 * if sb is in range 0 to 3 upper band is the secondary 80Mhz band
+		 */
+		if (sb < 4) {
+			secondary80_chan = center_chan + CH_40MHZ_APART;
+		}
+		/* if sb is in range 4 to 7 the lower band is the secondary 80Mhz band */
+		else
+		{
+			secondary80_chan = center_chan - CH_40MHZ_APART;
+		}
+	}
+	else {
+		/* for 20, 40, and 80 Mhz */
+		secondary80_chan = -1;
+	}
+	return secondary80_chan;
+}
+
+/*
+ * This function returns the chanspec for the primary 80MHz of an 160MHz or 80+80 channel.
+ *
+ *    chanspec - Input chanspec for which the primary 80Mhz chanspec has to be retreived
+ *
+ *  returns the input chanspec in case the provided chanspec is an 80 MHz chanspec
+ *  returns INVCHANSPEC in case the provided channel is 20/40 MHz chanspec
+ */
+chanspec_t
+wf_chspec_primary80_chspec(chanspec_t chspec)
+{
+	chanspec_t chspec80;
+	uint center_chan;
+	uint sb;
+
+	ASSERT(!wf_chspec_malformed(chspec));
+	if (CHSPEC_IS80(chspec)) {
+		chspec80 = chspec;
+	}
+	else if (CHSPEC_IS8080(chspec)) {
+
+		/* Channel ID 1 corresponds to frequency segment 0, the primary 80 MHz segment */
+		center_chan = wf_chspec_get80Mhz_ch(CHSPEC_CHAN1(chspec));
+
+		sb = CHSPEC_CTL_SB(chspec);
+
+		/* Create primary 80MHz chanspec */
+		chspec80 = (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_80 | sb | center_chan);
+	}
+	else if (CHSPEC_IS160(chspec)) {
+		center_chan = CHSPEC_CHANNEL(chspec);
+		sb = CHSPEC_CTL_SB(chspec);
+
+		if (sb < WL_CHANSPEC_CTL_SB_ULL) {
+			/* Primary 80MHz is on lower side */
+			center_chan -= CH_40MHZ_APART;
+		}
+		else {
+			/* Primary 80MHz is on upper side */
+			center_chan += CH_40MHZ_APART;
+			sb -= WL_CHANSPEC_CTL_SB_ULL;
+		}
+		/* Create primary 80MHz chanspec */
+		chspec80 = (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_80 | sb | center_chan);
+	}
+	else {
+		chspec80 = INVCHANSPEC;
+	}
+
+	return chspec80;
+}
+
+#ifdef WL11AC_80P80
+uint8
+wf_chspec_channel(chanspec_t chspec)
+{
+	if (CHSPEC_IS8080(chspec)) {
+		return wf_chspec_primary80_channel(chspec);
+	}
+	else {
+		return ((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK));
+	}
+}
+#endif /* WL11AC_80P80 */
diff -ENwbur a/drivers/net/wireless/bcm4336/circularbuf.c b/drivers/net/wireless/bcm4336/circularbuf.c
--- a/drivers/net/wireless/bcm4336/circularbuf.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/circularbuf.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,324 @@
+/** @file circularbuf.c
+ *
+ * PCIe host driver and dongle firmware need to communicate with each other. The mechanism consists
+ * of multiple circular buffers located in (DMA'able) host memory. A circular buffer is either used
+ * for host -> dongle (h2d) or dongle -> host communication. Both host driver and firmware make use
+ * of this source file. This source file contains functions to manage such a set of circular
+ * buffers, but does not contain the code to read or write the data itself into the buffers. It
+ * leaves that up to the software layer that uses this file, which can be implemented either using
+ * pio or DMA transfers. It also leaves the format of the data that is written and read to a higher
+ * layer. Typically the data is in the form of so-called 'message buffers'.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: circularbuf.c 467150 2014-04-02 17:30:43Z $
+ */
+
+#include <circularbuf.h>
+#include <bcmmsgbuf.h>
+#include <osl.h>
+
+#define CIRCULARBUF_READ_SPACE_AT_END(x)		\
+			((x->w_ptr >= x->rp_ptr) ? (x->w_ptr - x->rp_ptr) : (x->e_ptr - x->rp_ptr))
+
+#define CIRCULARBUF_READ_SPACE_AVAIL(x)		\
+			(((CIRCULARBUF_READ_SPACE_AT_END(x) == 0) && (x->w_ptr < x->rp_ptr)) ? \
+				x->w_ptr : CIRCULARBUF_READ_SPACE_AT_END(x))
+
+int cbuf_msg_level = CBUF_ERROR_VAL | CBUF_TRACE_VAL | CBUF_INFORM_VAL;
+
+/* #define CBUF_DEBUG */
+#ifdef CBUF_DEBUG
+#define CBUF_DEBUG_CHECK(x)	x
+#else
+#define CBUF_DEBUG_CHECK(x)
+#endif	/* CBUF_DEBUG */
+
+/**
+ * -----------------------------------------------------------------------------
+ * Function   : circularbuf_init
+ * Description:
+ *
+ *
+ * Input Args : buf_base_addr: address of DMA'able host memory provided by caller
+ *
+ *
+ * Return Values :
+ *
+ * -----------------------------------------------------------------------------
+ */
+void
+circularbuf_init(circularbuf_t *handle, void *buf_base_addr, uint16 total_buf_len)
+{
+	handle->buf_addr = buf_base_addr;
+
+	handle->depth = handle->e_ptr = HTOL32(total_buf_len);
+
+	/* Initialize Read and Write pointers */
+	handle->w_ptr = handle->r_ptr = handle->wp_ptr = handle->rp_ptr = HTOL32(0);
+	handle->mb_ring_bell = NULL;
+	handle->mb_ctx = NULL;
+
+	return;
+}
+
+/**
+ * When an item is added to the circular buffer by the producing party, the consuming party has to
+ * be notified by means of a 'door bell' or 'ring'. This function allows the caller to register a
+ * 'ring' function that will be called when a 'write complete' occurs.
+ */
+void
+circularbuf_register_cb(circularbuf_t *handle, mb_ring_t mb_ring_func, void *ctx)
+{
+	handle->mb_ring_bell = mb_ring_func;
+	handle->mb_ctx = ctx;
+}
+
+#ifdef CBUF_DEBUG
+static void
+circularbuf_check_sanity(circularbuf_t *handle)
+{
+	if ((handle->e_ptr > handle->depth) ||
+	    (handle->r_ptr > handle->e_ptr) ||
+		(handle->rp_ptr > handle->e_ptr) ||
+		(handle->w_ptr > handle->e_ptr))
+	{
+		printf("%s:%d: Pointers are corrupted.\n", __FUNCTION__, __LINE__);
+		circularbuf_debug_print(handle);
+		ASSERT(0);
+	}
+	return;
+}
+#endif /* CBUF_DEBUG */
+
+/**
+ * -----------------------------------------------------------------------------
+ * Function   : circularbuf_reserve_for_write
+ *
+ * Description:
+ * This function reserves N bytes for write in the circular buffer. The circularbuf
+ * implementation will only reserve space in the circular buffer and return
+ * the pointer to the address where the new data can be written.
+ * The actual write implementation (bcopy/dma) is outside the scope of
+ * circularbuf implementation.
+ *
+ * Input Args :
+ *		size - No. of bytes to reserve for write
+ *
+ * Return Values :
+ *		void * : Pointer to the reserved location. This is the address
+ *		          that will be used for write (dma/bcopy)
+ *
+ * -----------------------------------------------------------------------------
+ */
+void * BCMFASTPATH
+circularbuf_reserve_for_write(circularbuf_t *handle, uint16 size)
+{
+	int16 avail_space;
+	void *ret_ptr = NULL;
+
+	CBUF_DEBUG_CHECK(circularbuf_check_sanity(handle));
+	ASSERT(size < handle->depth);
+
+	if (handle->wp_ptr >= handle->r_ptr)
+		avail_space = handle->depth - handle->wp_ptr;
+	else
+		avail_space = handle->r_ptr - handle->wp_ptr;
+
+	ASSERT(avail_space <= handle->depth);
+	if (avail_space > size)
+	{
+		/* Great. We have enough space. */
+		ret_ptr = CIRCULARBUF_START(handle) + handle->wp_ptr;
+
+		/*
+		 * We need to update the wp_ptr for the next guy to write.
+		 *
+		 * Please Note : We are not updating the write pointer here. This can be
+		 * done only after write is complete (In case of DMA, we can only schedule
+		 * the DMA. Actual completion will be known only on DMA complete interrupt).
+		 */
+		handle->wp_ptr += size;
+		return ret_ptr;
+	}
+
+	/*
+	 * If there is no available space, we should check if there is some space left
+	 * in the beginning of the circular buffer.  Wrap-around case, where there is
+	 * not enough space in the end of the circular buffer. But, there might be
+	 * room in the beginning of the buffer.
+	 */
+	if (handle->wp_ptr >= handle->r_ptr)
+	{
+		avail_space = handle->r_ptr;
+		if (avail_space > size)
+		{
+			/* OK. There is room in the beginning. Let's go ahead and use that.
+			 * But, before that, we have left a hole at the end of the circular
+			 * buffer as that was not sufficient to accomodate the requested
+			 * size. Let's make sure this is updated in the circularbuf structure
+			 * so that consumer does not use the hole.
+			 */
+			handle->e_ptr  = handle->wp_ptr;
+			handle->wp_ptr = size;
+
+			return CIRCULARBUF_START(handle);
+		}
+	}
+
+	/* We have tried enough to accomodate the new packet. There is no room for now. */
+	return NULL;
+}
+
+/**
+ * -----------------------------------------------------------------------------
+ * Function   : circularbuf_write_complete
+ *
+ * Description:
+ * This function has to be called by the producer end of circularbuf to indicate to
+ * the circularbuf layer that data has been written and the write pointer can be
+ * updated. In the process, if there was a doorbell callback registered, that
+ * function would also be invoked as to notify the consuming party.
+ *
+ * Input Args :
+ *		dest_addr	  : Address where the data was written. This would be the
+ *					    same address that was reserved earlier.
+ *		bytes_written : Length of data written
+ *
+ * -----------------------------------------------------------------------------
+ */
+void BCMFASTPATH
+circularbuf_write_complete(circularbuf_t *handle, uint16 bytes_written)
+{
+	CBUF_DEBUG_CHECK(circularbuf_check_sanity(handle));
+
+	/* Update the write pointer */
+	if ((handle->w_ptr + bytes_written) >= handle->depth) {
+		OSL_CACHE_FLUSH((void *) CIRCULARBUF_START(handle), bytes_written);
+		handle->w_ptr = bytes_written;
+	} else {
+		OSL_CACHE_FLUSH((void *) (CIRCULARBUF_START(handle) + handle->w_ptr),
+			bytes_written);
+		handle->w_ptr += bytes_written;
+	}
+
+	/* And ring the door bell (mail box interrupt) to indicate to the peer that
+	 * message is available for consumption.
+	 */
+	if (handle->mb_ring_bell)
+		handle->mb_ring_bell(handle->mb_ctx);
+}
+
+/**
+ * -----------------------------------------------------------------------------
+ * Function   : circularbuf_get_read_ptr
+ *
+ * Description:
+ * This function will be called by the consumer of circularbuf for reading data from
+ * the circular buffer. This will typically be invoked when the consumer gets a
+ * doorbell interrupt.
+ * Please note that the function only returns the pointer (and length) from
+ * where the data can be read. Actual read implementation is up to the
+ * consumer. It could be a bcopy or dma.
+ *
+ * Input Args :
+ *		void *			: Address from where the data can be read.
+ *		available_len	: Length of data available for read.
+ *
+ * -----------------------------------------------------------------------------
+ */
+void * BCMFASTPATH
+circularbuf_get_read_ptr(circularbuf_t *handle, uint16 *available_len)
+{
+	uint8 *ret_addr;
+
+	CBUF_DEBUG_CHECK(circularbuf_check_sanity(handle));
+
+	/* First check if there is any data available in the circular buffer */
+	*available_len = CIRCULARBUF_READ_SPACE_AVAIL(handle);
+	if (*available_len == 0)
+		return NULL;
+
+	/*
+	 * Although there might be data in the circular buffer for read, in
+	 * cases of write wrap-around and read still in the end of the circular
+	 * buffer, we might have to wrap around the read pending pointer also.
+	 */
+	if (CIRCULARBUF_READ_SPACE_AT_END(handle) == 0)
+		handle->rp_ptr = 0;
+
+	ret_addr = CIRCULARBUF_START(handle) + handle->rp_ptr;
+
+	/*
+	 * Please note that we do not update the read pointer here. Only
+	 * read pending pointer is updated, so that next reader knows where
+	 * to read data from.
+	 * read pointer can only be updated when the read is complete.
+	 */
+	handle->rp_ptr = (uint16)(ret_addr - CIRCULARBUF_START(handle) + *available_len);
+
+	ASSERT(*available_len <= handle->depth);
+
+	OSL_CACHE_INV((void *) ret_addr, *available_len);
+
+	return ret_addr;
+}
+
+/**
+ * -----------------------------------------------------------------------------
+ * Function   : circularbuf_read_complete
+ * Description:
+ * This function has to be called by the consumer end of circularbuf to indicate
+ * that data has been consumed and the read pointer can be updated, so the producing side
+ * can can use the freed space for new entries.
+ *
+ *
+ * Input Args :
+ *		bytes_read : No. of bytes consumed by the consumer. This has to match
+ *					 the length returned by circularbuf_get_read_ptr
+ *
+ * Return Values :
+ *		CIRCULARBUF_SUCCESS		: Otherwise
+ *
+ * -----------------------------------------------------------------------------
+ */
+circularbuf_ret_t BCMFASTPATH
+circularbuf_read_complete(circularbuf_t *handle, uint16 bytes_read)
+{
+	CBUF_DEBUG_CHECK(circularbuf_check_sanity(handle));
+	ASSERT(bytes_read < handle->depth);
+
+	/* Update the read pointer */
+	if ((handle->w_ptr < handle->e_ptr) && (handle->r_ptr + bytes_read) > handle->e_ptr)
+		handle->r_ptr = bytes_read;
+	else
+		handle->r_ptr += bytes_read;
+
+	return CIRCULARBUF_SUCCESS;
+}
+
+/**
+ * -----------------------------------------------------------------------------
+ * Function	: circularbuf_revert_rp_ptr
+ *
+ * Description:
+ * The rp_ptr update during circularbuf_get_read_ptr() is done to reflect the amount of data
+ * that is sent out to be read by the consumer. But the consumer may not always read the
+ * entire data. In such a case, the rp_ptr needs to be reverted back by 'left' bytes, where
+ * 'left' is the no. of bytes left unread.
+ *
+ * Input args:
+ * 	bytes : The no. of bytes left unread by the consumer
+ *
+ * -----------------------------------------------------------------------------
+ */
+circularbuf_ret_t
+circularbuf_revert_rp_ptr(circularbuf_t *handle, uint16 bytes)
+{
+	CBUF_DEBUG_CHECK(circularbuf_check_sanity(handle));
+	ASSERT(bytes < handle->depth);
+
+	handle->rp_ptr -= bytes;
+
+	return CIRCULARBUF_SUCCESS;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_bta.c b/drivers/net/wireless/bcm4336/dhd_bta.c
--- a/drivers/net/wireless/bcm4336/dhd_bta.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_bta.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,321 @@
+/*
+ * BT-AMP support routines
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_bta.c 434434 2013-11-06 07:16:02Z $
+ */
+#ifndef WLBTAMP
+#error "WLBTAMP is not defined"
+#endif	/* WLBTAMP */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmcdc.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/802.11.h>
+#include <proto/802.11_bta.h>
+#include <proto/bt_amp_hci.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhdioctl.h>
+#include <dhd_dbg.h>
+
+#include <dhd_bta.h>
+
+
+#ifdef SEND_HCI_CMD_VIA_IOCTL
+#define BTA_HCI_CMD_MAX_LEN HCI_CMD_PREAMBLE_SIZE + HCI_CMD_DATA_SIZE
+
+/* Send HCI cmd via wl iovar HCI_cmd to the dongle. */
+int
+dhd_bta_docmd(dhd_pub_t *pub, void *cmd_buf, uint cmd_len)
+{
+	amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)cmd_buf;
+	uint8 buf[BTA_HCI_CMD_MAX_LEN + 16];
+	uint len = sizeof(buf);
+	wl_ioctl_t ioc;
+
+	if (cmd_len < HCI_CMD_PREAMBLE_SIZE)
+		return BCME_BADLEN;
+
+	if ((uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE > cmd_len)
+		return BCME_BADLEN;
+
+	len = bcm_mkiovar("HCI_cmd",
+		(char *)cmd, (uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE, (char *)buf, len);
+
+
+	memset(&ioc, 0, sizeof(ioc));
+
+	ioc.cmd = WLC_SET_VAR;
+	ioc.buf = buf;
+	ioc.len = len;
+	ioc.set = TRUE;
+
+	return dhd_wl_ioctl(pub, &ioc, ioc.buf, ioc.len);
+}
+#else /* !SEND_HCI_CMD_VIA_IOCTL */
+
+static void
+dhd_bta_flush_hcidata(dhd_pub_t *pub, uint16 llh)
+{
+	int prec;
+	struct pktq *q;
+	uint count = 0;
+
+	q = dhd_bus_txq(pub->bus);
+	if (q == NULL)
+		return;
+
+	DHD_BTA(("dhd: flushing HCI ACL data for logical link %u...\n", llh));
+
+	dhd_os_sdlock_txq(pub);
+
+	/* Walk through the txq and toss all HCI ACL data packets */
+	PKTQ_PREC_ITER(q, prec) {
+		void *head_pkt = NULL;
+
+		while (pktq_ppeek(q, prec) != head_pkt) {
+			void *pkt = pktq_pdeq(q, prec);
+			int ifidx;
+
+			dhd_prot_hdrpull(pub, &ifidx, pkt, NULL, NULL);
+
+			if (PKTLEN(pub->osh, pkt) >= RFC1042_HDR_LEN) {
+				struct ether_header *eh =
+				        (struct ether_header *)PKTDATA(pub->osh, pkt);
+
+				if (ntoh16(eh->ether_type) < ETHER_TYPE_MIN) {
+					struct dot11_llc_snap_header *lsh =
+					        (struct dot11_llc_snap_header *)&eh[1];
+
+					if (bcmp(lsh, BT_SIG_SNAP_MPROT,
+					         DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+					    ntoh16(lsh->type) == BTA_PROT_L2CAP) {
+						amp_hci_ACL_data_t *ACL_data =
+						        (amp_hci_ACL_data_t *)&lsh[1];
+						uint16 handle = ltoh16(ACL_data->handle);
+
+						if (HCI_ACL_DATA_HANDLE(handle) == llh) {
+							PKTFREE(pub->osh, pkt, TRUE);
+							count ++;
+							continue;
+						}
+					}
+				}
+			}
+
+			dhd_prot_hdrpush(pub, ifidx, pkt);
+
+			if (head_pkt == NULL)
+				head_pkt = pkt;
+			pktq_penq(q, prec, pkt);
+		}
+	}
+
+	dhd_os_sdunlock_txq(pub);
+
+	DHD_BTA(("dhd: flushed %u packet(s) for logical link %u...\n", count, llh));
+}
+
+/* Handle HCI cmd locally.
+ * Return 0: continue to send the cmd across SDIO
+ *        < 0: stop, fail
+ *        > 0: stop, succuess
+ */
+static int
+_dhd_bta_docmd(dhd_pub_t *pub, amp_hci_cmd_t *cmd)
+{
+	int status = 0;
+
+	switch (ltoh16_ua((uint8 *)&cmd->opcode)) {
+	case HCI_Enhanced_Flush: {
+		eflush_cmd_parms_t *cmdparms = (eflush_cmd_parms_t *)cmd->parms;
+		dhd_bta_flush_hcidata(pub, ltoh16_ua(cmdparms->llh));
+		break;
+	}
+	default:
+		break;
+	}
+
+	return status;
+}
+
+/* Send HCI cmd encapsulated in BT-SIG frame via data channel to the dongle. */
+int
+dhd_bta_docmd(dhd_pub_t *pub, void *cmd_buf, uint cmd_len)
+{
+	amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)cmd_buf;
+	struct ether_header *eh;
+	struct dot11_llc_snap_header *lsh;
+	osl_t *osh = pub->osh;
+	uint len;
+	void *p;
+	int status;
+
+	if (cmd_len < HCI_CMD_PREAMBLE_SIZE) {
+		DHD_ERROR(("dhd_bta_docmd: short command, cmd_len %u\n", cmd_len));
+		return BCME_BADLEN;
+	}
+
+	if ((len = (uint)cmd->plen + HCI_CMD_PREAMBLE_SIZE) > cmd_len) {
+		DHD_ERROR(("dhd_bta_docmd: malformed command, len %u cmd_len %u\n",
+		           len, cmd_len));
+		/* return BCME_BADLEN; */
+	}
+
+	p = PKTGET(osh, pub->hdrlen + RFC1042_HDR_LEN + len, TRUE);
+	if (p == NULL) {
+		DHD_ERROR(("dhd_bta_docmd: out of memory\n"));
+		return BCME_NOMEM;
+	}
+
+
+	/* intercept and handle the HCI cmd locally */
+	if ((status = _dhd_bta_docmd(pub, cmd)) > 0)
+		return 0;
+	else if (status < 0)
+		return status;
+
+	/* copy in HCI cmd */
+	PKTPULL(osh, p, pub->hdrlen + RFC1042_HDR_LEN);
+	bcopy(cmd, PKTDATA(osh, p), len);
+
+	/* copy in partial Ethernet header with BT-SIG LLC/SNAP header */
+	PKTPUSH(osh, p, RFC1042_HDR_LEN);
+	eh = (struct ether_header *)PKTDATA(osh, p);
+	bzero(eh->ether_dhost, ETHER_ADDR_LEN);
+	ETHER_SET_LOCALADDR(eh->ether_dhost);
+	bcopy(&pub->mac, eh->ether_shost, ETHER_ADDR_LEN);
+	eh->ether_type = hton16(len + DOT11_LLC_SNAP_HDR_LEN);
+	lsh = (struct dot11_llc_snap_header *)&eh[1];
+	bcopy(BT_SIG_SNAP_MPROT, lsh, DOT11_LLC_SNAP_HDR_LEN - 2);
+	lsh->type = 0;
+
+	return dhd_sendpkt(pub, 0, p);
+}
+#endif /* !SEND_HCI_CMD_VIA_IOCTL */
+
+/* Send HCI ACL data to dongle via data channel */
+int
+dhd_bta_tx_hcidata(dhd_pub_t *pub, void *data_buf, uint data_len)
+{
+	amp_hci_ACL_data_t *data = (amp_hci_ACL_data_t *)data_buf;
+	struct ether_header *eh;
+	struct dot11_llc_snap_header *lsh;
+	osl_t *osh = pub->osh;
+	uint len;
+	void *p;
+
+	if (data_len < HCI_ACL_DATA_PREAMBLE_SIZE) {
+		DHD_ERROR(("dhd_bta_tx_hcidata: short data_buf, data_len %u\n", data_len));
+		return BCME_BADLEN;
+	}
+
+	if ((len = (uint)ltoh16(data->dlen) + HCI_ACL_DATA_PREAMBLE_SIZE) > data_len) {
+		DHD_ERROR(("dhd_bta_tx_hcidata: malformed hci data, len %u data_len %u\n",
+		           len, data_len));
+		/* return BCME_BADLEN; */
+	}
+
+	p = PKTGET(osh, pub->hdrlen + RFC1042_HDR_LEN + len, TRUE);
+	if (p == NULL) {
+		DHD_ERROR(("dhd_bta_tx_hcidata: out of memory\n"));
+		return BCME_NOMEM;
+	}
+
+
+	/* copy in HCI ACL data header and HCI ACL data */
+	PKTPULL(osh, p, pub->hdrlen + RFC1042_HDR_LEN);
+	bcopy(data, PKTDATA(osh, p), len);
+
+	/* copy in partial Ethernet header with BT-SIG LLC/SNAP header */
+	PKTPUSH(osh, p, RFC1042_HDR_LEN);
+	eh = (struct ether_header *)PKTDATA(osh, p);
+	bzero(eh->ether_dhost, ETHER_ADDR_LEN);
+	bcopy(&pub->mac, eh->ether_shost, ETHER_ADDR_LEN);
+	eh->ether_type = hton16(len + DOT11_LLC_SNAP_HDR_LEN);
+	lsh = (struct dot11_llc_snap_header *)&eh[1];
+	bcopy(BT_SIG_SNAP_MPROT, lsh, DOT11_LLC_SNAP_HDR_LEN - 2);
+	lsh->type = HTON16(BTA_PROT_L2CAP);
+
+	return dhd_sendpkt(pub, 0, p);
+}
+
+/* txcomplete callback */
+void
+dhd_bta_tx_hcidata_complete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+	uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, txp);
+	amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)(pktdata + RFC1042_HDR_LEN);
+	uint16 handle = ltoh16(ACL_data->handle);
+	uint16 llh = HCI_ACL_DATA_HANDLE(handle);
+
+	wl_event_msg_t event;
+	uint8 data[HCI_EVT_PREAMBLE_SIZE + sizeof(num_completed_data_blocks_evt_parms_t)];
+	amp_hci_event_t *evt;
+	num_completed_data_blocks_evt_parms_t *parms;
+
+	uint16 len = HCI_EVT_PREAMBLE_SIZE + sizeof(num_completed_data_blocks_evt_parms_t);
+
+	/* update the event struct */
+	memset(&event, 0, sizeof(event));
+	event.version = hton16(BCM_EVENT_MSG_VERSION);
+	event.event_type = hton32(WLC_E_BTA_HCI_EVENT);
+	event.status = 0;
+	event.reason = 0;
+	event.auth_type = 0;
+	event.datalen = hton32(len);
+	event.flags = 0;
+
+	/* generate Number of Completed Blocks event */
+	evt = (amp_hci_event_t *)data;
+	evt->ecode = HCI_Number_of_Completed_Data_Blocks;
+	evt->plen = sizeof(num_completed_data_blocks_evt_parms_t);
+
+	parms = (num_completed_data_blocks_evt_parms_t *)evt->parms;
+	htol16_ua_store(dhdp->maxdatablks, (uint8 *)&parms->num_blocks);
+	parms->num_handles = 1;
+	htol16_ua_store(llh, (uint8 *)&parms->completed[0].handle);
+	parms->completed[0].pkts = 1;
+	parms->completed[0].blocks = 1;
+
+	dhd_sendup_event_common(dhdp, &event, data);
+}
+
+/* event callback */
+void
+dhd_bta_doevt(dhd_pub_t *dhdp, void *data_buf, uint data_len)
+{
+	amp_hci_event_t *evt = (amp_hci_event_t *)data_buf;
+
+	ASSERT(dhdp);
+	ASSERT(evt);
+
+	switch (evt->ecode) {
+	case HCI_Command_Complete: {
+		cmd_complete_parms_t *parms = (cmd_complete_parms_t *)evt->parms;
+		switch (ltoh16_ua((uint8 *)&parms->opcode)) {
+		case HCI_Read_Data_Block_Size: {
+			read_data_block_size_evt_parms_t *parms2 =
+			        (read_data_block_size_evt_parms_t *)parms->parms;
+			dhdp->maxdatablks = ltoh16_ua((uint8 *)&parms2->data_block_num);
+			break;
+		}
+		}
+		break;
+	}
+
+	case HCI_Flush_Occurred: {
+		flush_occurred_evt_parms_t *evt_parms = (flush_occurred_evt_parms_t *)evt->parms;
+		dhd_bta_flush_hcidata(dhdp, ltoh16_ua((uint8 *)&evt_parms->handle));
+		break;
+	}
+	default:
+		break;
+	}
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_bta.h b/drivers/net/wireless/bcm4336/dhd_bta.h
--- a/drivers/net/wireless/bcm4336/dhd_bta.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_bta.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,21 @@
+/*
+ * BT-AMP support routines
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_bta.h 291086 2011-10-21 01:17:24Z $
+ */
+#ifndef __dhd_bta_h__
+#define __dhd_bta_h__
+
+struct dhd_pub;
+
+extern int dhd_bta_docmd(struct dhd_pub *pub, void *cmd_buf, uint cmd_len);
+
+extern void dhd_bta_doevt(struct dhd_pub *pub, void *data_buf, uint data_len);
+
+extern int dhd_bta_tx_hcidata(struct dhd_pub *pub, void *data_buf, uint data_len);
+extern void dhd_bta_tx_hcidata_complete(struct dhd_pub *dhdp, void *txp, bool success);
+
+
+#endif /* __dhd_bta_h__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_bus.h b/drivers/net/wireless/bcm4336/dhd_bus.h
--- a/drivers/net/wireless/bcm4336/dhd_bus.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_bus.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,174 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_bus.h 497466 2014-08-19 15:41:01Z $
+ */
+
+#ifndef _dhd_bus_h_
+#define _dhd_bus_h_
+
+/*
+ * Exported from dhd bus module (dhd_usb, dhd_sdio)
+ */
+
+/* Indicate (dis)interest in finding dongles. */
+extern int dhd_bus_register(void);
+extern void dhd_bus_unregister(void);
+
+/* Download firmware image and nvram image */
+extern int dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+	char *fw_path, char *nv_path, char *conf_path);
+
+/* Stop bus module: clear pending frames, disable data flow */
+extern void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex);
+
+/* Initialize bus module: prepare for communication w/dongle */
+extern int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex);
+
+/* Get the Bus Idle Time */
+extern void dhd_bus_getidletime(dhd_pub_t *dhdp, int *idletime);
+
+/* Set the Bus Idle Time */
+extern void dhd_bus_setidletime(dhd_pub_t *dhdp, int idle_time);
+
+/* Send a data frame to the dongle.  Callee disposes of txp. */
+#ifdef BCMPCIE
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp, uint8 ifidx);
+#else
+extern int dhd_bus_txdata(struct dhd_bus *bus, void *txp);
+#endif
+
+
+/* Send/receive a control message to/from the dongle.
+ * Expects caller to enforce a single outstanding transaction.
+ */
+extern int dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+extern int dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen);
+
+/* Watchdog timer function */
+extern bool dhd_bus_watchdog(dhd_pub_t *dhd);
+
+extern int dhd_bus_oob_intr_register(dhd_pub_t *dhdp);
+extern void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp);
+extern void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable);
+extern void dhd_bus_dev_pm_stay_awake(dhd_pub_t *dhdpub);
+extern void dhd_bus_dev_pm_relax(dhd_pub_t *dhdpub);
+extern bool dhd_bus_dev_pm_enabled(dhd_pub_t *dhdpub);
+
+#if defined(DHD_DEBUG)
+/* Device console input function */
+extern int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen);
+#endif /* defined(DHD_DEBUG) */
+
+/* Deferred processing for the bus, return TRUE requests reschedule */
+extern bool dhd_bus_dpc(struct dhd_bus *bus);
+extern void dhd_bus_isr(bool * InterruptRecognized, bool * QueueMiniportHandleInterrupt, void *arg);
+
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                            void *params, int plen, void *arg, int len, bool set);
+
+/* Add bus dump output to a buffer */
+extern void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Clear any bus counters */
+extern void dhd_bus_clearcounts(dhd_pub_t *dhdp);
+
+/* return the dongle chipid */
+extern uint dhd_bus_chip(struct dhd_bus *bus);
+
+/* return the dongle chiprev */
+extern uint dhd_bus_chiprev(struct dhd_bus *bus);
+
+/* Set user-specified nvram parameters. */
+extern void dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params);
+
+extern void *dhd_bus_pub(struct dhd_bus *bus);
+extern void *dhd_bus_txq(struct dhd_bus *bus);
+extern void *dhd_bus_sih(struct dhd_bus *bus);
+extern uint dhd_bus_hdrlen(struct dhd_bus *bus);
+#ifdef BCMSDIO
+extern void dhd_bus_set_dotxinrx(struct dhd_bus *bus, bool val);
+#else
+#define dhd_bus_set_dotxinrx(a, b) do {} while (0)
+#endif
+
+#define DHD_SET_BUS_STATE_DOWN(_bus)  do { \
+	(_bus)->dhd->busstate = DHD_BUS_DOWN; \
+} while (0)
+
+/* Register a dummy SDIO client driver in order to be notified of new SDIO device */
+extern int dhd_bus_reg_sdio_notify(void* semaphore);
+extern void dhd_bus_unreg_sdio_notify(void);
+extern void dhd_txglom_enable(dhd_pub_t *dhdp, bool enable);
+extern int dhd_bus_get_ids(struct dhd_bus *bus, uint32 *bus_type, uint32 *bus_num,
+	uint32 *slot_num);
+
+#ifdef BCMPCIE
+enum {
+	DNGL_TO_HOST_BUF_IOCT,
+	DNGL_TO_HOST_DMA_SCRATCH_BUFFER,
+	DNGL_TO_HOST_DMA_SCRATCH_BUFFER_LEN,
+	HOST_TO_DNGL_DMA_WRITEINDX_BUFFER,
+	HOST_TO_DNGL_DMA_READINDX_BUFFER,
+	DNGL_TO_HOST_DMA_WRITEINDX_BUFFER,
+	DNGL_TO_HOST_DMA_READINDX_BUFFER,
+	TOTAL_LFRAG_PACKET_CNT,
+	HTOD_MB_DATA,
+	DTOH_MB_DATA,
+	RING_BUF_ADDR,
+	H2D_DMA_WRITEINDX,
+	H2D_DMA_READINDX,
+	D2H_DMA_WRITEINDX,
+	D2H_DMA_READINDX,
+	RING_READ_PTR,
+	RING_WRITE_PTR,
+	RING_LEN_ITEMS,
+	RING_MAX_ITEM,
+	MAX_HOST_RXBUFS
+};
+typedef void (*dhd_mb_ring_t) (struct dhd_bus *, uint32);
+extern void dhd_bus_cmn_writeshared(struct dhd_bus *bus, void * data, uint32 len, uint8 type,
+	uint16 ringid);
+extern void dhd_bus_ringbell(struct dhd_bus *bus, uint32 value);
+extern void dhd_bus_cmn_readshared(struct dhd_bus *bus, void* data, uint8 type, uint16 ringid);
+extern uint32 dhd_bus_get_sharedflags(struct dhd_bus *bus);
+extern void dhd_bus_rx_frame(struct dhd_bus *bus, void* pkt, int ifidx, uint pkt_count);
+extern void dhd_bus_start_queue(struct dhd_bus *bus);
+extern void dhd_bus_stop_queue(struct dhd_bus *bus);
+extern void dhd_bus_update_retlen(struct dhd_bus *bus, uint32 retlen, uint32 cmd_id, uint16 status,
+	uint32 resp_len);
+extern dhd_mb_ring_t dhd_bus_get_mbintr_fn(struct dhd_bus *bus);
+extern void dhd_bus_write_flow_ring_states(struct dhd_bus *bus,
+	void * data, uint16 flowid);
+extern void dhd_bus_read_flow_ring_states(struct dhd_bus *bus,
+	void * data, uint8 flowid);
+extern int dhd_bus_flow_ring_create_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_clean_flow_ring(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_create_response(struct dhd_bus *bus, uint16 flow_id, int32 status);
+extern int dhd_bus_flow_ring_delete_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_delete_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern int dhd_bus_flow_ring_flush_request(struct dhd_bus *bus, void *flow_ring_node);
+extern void dhd_bus_flow_ring_flush_response(struct dhd_bus *bus, uint16 flowid, uint32 status);
+extern uint8 dhd_bus_is_txmode_push(struct dhd_bus *bus);
+extern uint32 dhd_bus_max_h2d_queues(struct dhd_bus *bus, uint8 *txpush);
+extern int dhd_bus_schedule_queue(struct dhd_bus *bus, uint16 flow_id, bool txs);
+extern int dhdpcie_bus_clock_start(struct dhd_bus *bus);
+extern int dhdpcie_bus_clock_stop(struct dhd_bus *bus);
+extern int dhdpcie_bus_enable_device(struct dhd_bus *bus);
+extern int dhdpcie_bus_disable_device(struct dhd_bus *bus);
+extern int dhdpcie_bus_alloc_resource(struct dhd_bus *bus);
+extern void dhdpcie_bus_free_resource(struct dhd_bus *bus);
+extern bool dhdpcie_bus_dongle_attach(struct dhd_bus *bus);
+extern int dhd_bus_release_dongle(struct dhd_bus *bus);
+extern int dhd_bus_request_irq(struct dhd_bus *bus);
+
+
+#endif /* BCMPCIE */
+#endif /* _dhd_bus_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_cdc.c b/drivers/net/wireless/bcm4336/dhd_cdc.c
--- a/drivers/net/wireless/bcm4336/dhd_cdc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_cdc.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,810 @@
+/*
+ * DHD Protocol Module for CDC and BDC.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_cdc.c 492377 2014-07-21 19:54:06Z $
+ *
+ * BDC is like CDC, except it includes a header for data packets to convey
+ * packet priority over the bus, and flags (e.g. to indicate checksum status
+ * for dongle offload.)
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmcdc.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+#include <dhd_bus.h>
+#include <dhd_dbg.h>
+
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+
+#define RETRIES 2		/* # of retries to retrieve matching ioctl response */
+#define BUS_HEADER_LEN	(24+DHD_SDALIGN)	/* Must be at least SDPCM_RESERVE
+				 * defined in dhd_sdio.c (amount of header tha might be added)
+				 * plus any space that might be needed for alignment padding.
+				 */
+#define ROUND_UP_MARGIN	2048	/* Biggest SDIO block size possible for
+				 * round off at the end of buffer
+				 */
+
+typedef struct dhd_prot {
+	uint16 reqid;
+	uint8 pending;
+	uint32 lastcmd;
+	uint8 bus_header[BUS_HEADER_LEN];
+	cdc_ioctl_t msg;
+	unsigned char buf[WLC_IOCTL_MAXLEN + ROUND_UP_MARGIN];
+} dhd_prot_t;
+
+
+static int
+dhdcdc_msg(dhd_pub_t *dhd)
+{
+	int err = 0;
+	dhd_prot_t *prot = dhd->prot;
+	int len = ltoh32(prot->msg.len) + sizeof(cdc_ioctl_t);
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	DHD_OS_WAKE_LOCK(dhd);
+
+	/* NOTE : cdc->msg.len holds the desired length of the buffer to be
+	 *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
+	 *	  is actually sent to the dongle
+	 */
+	if (len > CDC_MAX_MSG_SIZE)
+		len = CDC_MAX_MSG_SIZE;
+
+	/* Send request */
+	err = dhd_bus_txctl(dhd->bus, (uchar*)&prot->msg, len);
+
+	DHD_OS_WAKE_UNLOCK(dhd);
+	return err;
+}
+
+static int
+dhdcdc_cmplt(dhd_pub_t *dhd, uint32 id, uint32 len)
+{
+	int ret;
+	int cdc_len = len + sizeof(cdc_ioctl_t);
+	dhd_prot_t *prot = dhd->prot;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+
+	do {
+		ret = dhd_bus_rxctl(dhd->bus, (uchar*)&prot->msg, cdc_len);
+		if (ret < 0)
+			break;
+	} while (CDC_IOC_ID(ltoh32(prot->msg.flags)) != id);
+
+
+	return ret;
+}
+
+static int
+dhdcdc_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+	dhd_prot_t *prot = dhd->prot;
+	cdc_ioctl_t *msg = &prot->msg;
+	int ret = 0, retries = 0;
+	uint32 id, flags = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+
+	/* Respond "bcmerror" and "bcmerrorstr" with local cache */
+	if (cmd == WLC_GET_VAR && buf)
+	{
+		if (!strcmp((char *)buf, "bcmerrorstr"))
+		{
+			strncpy((char *)buf, bcmerrorstr(dhd->dongle_error), BCME_STRLEN);
+			goto done;
+		}
+		else if (!strcmp((char *)buf, "bcmerror"))
+		{
+			*(int *)buf = dhd->dongle_error;
+			goto done;
+		}
+	}
+
+	memset(msg, 0, sizeof(cdc_ioctl_t));
+
+	msg->cmd = htol32(cmd);
+	msg->len = htol32(len);
+	msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+	CDC_SET_IF_IDX(msg, ifidx);
+	/* add additional action bits */
+	action &= WL_IOCTL_ACTION_MASK;
+	msg->flags |= (action << CDCF_IOC_ACTION_SHIFT);
+	msg->flags = htol32(msg->flags);
+
+	if (buf)
+		memcpy(prot->buf, buf, len);
+
+	if ((ret = dhdcdc_msg(dhd)) < 0) {
+		if (!dhd->hang_was_sent)
+		DHD_ERROR(("dhdcdc_query_ioctl: dhdcdc_msg failed w/status %d\n", ret));
+		goto done;
+	}
+
+retry:
+	/* wait for interrupt and get first fragment */
+	if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+		goto done;
+
+	flags = ltoh32(msg->flags);
+	id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+	if ((id < prot->reqid) && (++retries < RETRIES))
+		goto retry;
+	if (id != prot->reqid) {
+		DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+		           dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* Copy info buffer */
+	if (buf)
+	{
+		if (ret < (int)len)
+			len = ret;
+		memcpy(buf, (void*) prot->buf, len);
+	}
+
+	/* Check the ERROR flag */
+	if (flags & CDCF_IOC_ERROR)
+	{
+		ret = ltoh32(msg->status);
+		/* Cache error from dongle */
+		dhd->dongle_error = ret;
+	}
+
+done:
+	return ret;
+}
+
+
+static int
+dhdcdc_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+	dhd_prot_t *prot = dhd->prot;
+	cdc_ioctl_t *msg = &prot->msg;
+	int ret = 0;
+	uint32 flags, id;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	DHD_CTL(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+		return -EIO;
+	}
+
+	/* don't talk to the dongle if fw is about to be reloaded */
+	if (dhd->hang_was_sent) {
+		DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+			__FUNCTION__));
+		return -EIO;
+	}
+
+	memset(msg, 0, sizeof(cdc_ioctl_t));
+
+	msg->cmd = htol32(cmd);
+	msg->len = htol32(len);
+	msg->flags = (++prot->reqid << CDCF_IOC_ID_SHIFT);
+	CDC_SET_IF_IDX(msg, ifidx);
+	/* add additional action bits */
+	action &= WL_IOCTL_ACTION_MASK;
+	msg->flags |= (action << CDCF_IOC_ACTION_SHIFT) | CDCF_IOC_SET;
+	msg->flags = htol32(msg->flags);
+
+	if (buf)
+		memcpy(prot->buf, buf, len);
+
+	if ((ret = dhdcdc_msg(dhd)) < 0) {
+		DHD_ERROR(("%s: dhdcdc_msg failed w/status %d\n", __FUNCTION__, ret));
+		goto done;
+	}
+
+	if ((ret = dhdcdc_cmplt(dhd, prot->reqid, len)) < 0)
+		goto done;
+
+	flags = ltoh32(msg->flags);
+	id = (flags & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT;
+
+	if (id != prot->reqid) {
+		DHD_ERROR(("%s: %s: unexpected request id %d (expected %d)\n",
+		           dhd_ifname(dhd, ifidx), __FUNCTION__, id, prot->reqid));
+		ret = -EINVAL;
+		goto done;
+	}
+
+	/* Check the ERROR flag */
+	if (flags & CDCF_IOC_ERROR)
+	{
+		ret = ltoh32(msg->status);
+		/* Cache error from dongle */
+		dhd->dongle_error = ret;
+	}
+
+done:
+	return ret;
+}
+
+
+int
+dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+	dhd_prot_t *prot = dhd->prot;
+	int ret = -1;
+	uint8 action;
+	static int error_cnt = 0;
+
+	if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+		DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+		goto done;
+	}
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+	if (len > WLC_IOCTL_MAXLEN)
+		goto done;
+
+	if (prot->pending == TRUE) {
+		DHD_ERROR(("CDC packet is pending!!!! cmd=0x%x (%lu) lastcmd=0x%x (%lu)\n",
+			ioc->cmd, (unsigned long)ioc->cmd, prot->lastcmd,
+			(unsigned long)prot->lastcmd));
+		if ((ioc->cmd == WLC_SET_VAR) || (ioc->cmd == WLC_GET_VAR)) {
+			DHD_TRACE(("iovar cmd=%s\n", (char*)buf));
+		}
+		goto done;
+	}
+
+	prot->pending = TRUE;
+	prot->lastcmd = ioc->cmd;
+	action = ioc->set;
+	if (action & WL_IOCTL_ACTION_SET)
+		ret = dhdcdc_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+	else {
+		ret = dhdcdc_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+		if (ret > 0)
+			ioc->used = ret - sizeof(cdc_ioctl_t);
+	}
+	// terence 20130805: send hang event to wpa_supplicant
+	if (ret == -EIO) {
+		error_cnt++;
+		if (error_cnt > 2)
+			ret = -ETIMEDOUT;
+	} else
+		error_cnt = 0;
+
+	/* Too many programs assume ioctl() returns 0 on success */
+	if (ret >= 0)
+		ret = 0;
+	else {
+		cdc_ioctl_t *msg = &prot->msg;
+		ioc->needed = ltoh32(msg->len); /* len == needed when set/query fails from dongle */
+	}
+
+	/* Intercept the wme_dp ioctl here */
+	if ((!ret) && (ioc->cmd == WLC_SET_VAR) && (!strcmp(buf, "wme_dp"))) {
+		int slen, val = 0;
+
+		slen = strlen("wme_dp") + 1;
+		if (len >= (int)(slen + sizeof(int)))
+			bcopy(((char *)buf + slen), &val, sizeof(int));
+		dhd->wme_dp = (uint8) ltoh32(val);
+	}
+
+	prot->pending = FALSE;
+
+done:
+
+	return ret;
+}
+
+int
+dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                  void *params, int plen, void *arg, int len, bool set)
+{
+	return BCME_UNSUPPORTED;
+}
+
+void
+dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+	bcm_bprintf(strbuf, "Protocol CDC: reqid %d\n", dhdp->prot->reqid);
+#ifdef PROP_TXSTATUS
+	dhd_wlfc_dump(dhdp, strbuf);
+#endif
+}
+
+/*	The FreeBSD PKTPUSH could change the packet buf pinter
+	so we need to make it changable
+*/
+#define PKTBUF pktbuf
+void
+dhd_prot_hdrpush(dhd_pub_t *dhd, int ifidx, void *PKTBUF)
+{
+#ifdef BDC
+	struct bdc_header *h;
+#endif /* BDC */
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+	/* Push BDC header used to convey priority for buses that don't */
+
+	PKTPUSH(dhd->osh, PKTBUF, BDC_HEADER_LEN);
+
+	h = (struct bdc_header *)PKTDATA(dhd->osh, PKTBUF);
+
+	h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+	if (PKTSUMNEEDED(PKTBUF))
+		h->flags |= BDC_FLAG_SUM_NEEDED;
+
+
+	h->priority = (PKTPRIO(PKTBUF) & BDC_PRIORITY_MASK);
+	h->flags2 = 0;
+	h->dataOffset = 0;
+#endif /* BDC */
+	BDC_SET_IF_IDX(h, ifidx);
+}
+#undef PKTBUF	/* Only defined in the above routine */
+
+uint
+dhd_prot_hdrlen(dhd_pub_t *dhd, void *PKTBUF)
+{
+	uint hdrlen = 0;
+#ifdef BDC
+	/* Length of BDC(+WLFC) headers pushed */
+	hdrlen = BDC_HEADER_LEN + (((struct bdc_header *)PKTBUF)->dataOffset * 4);
+#endif
+	return hdrlen;
+}
+
+int
+dhd_prot_hdrpull(dhd_pub_t *dhd, int *ifidx, void *pktbuf, uchar *reorder_buf_info,
+	uint *reorder_info_len)
+{
+#ifdef BDC
+	struct bdc_header *h;
+#endif
+	uint8 data_offset = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BDC
+	if (reorder_info_len)
+		*reorder_info_len = 0;
+	/* Pop BDC header used to convey priority for buses that don't */
+
+	if (PKTLEN(dhd->osh, pktbuf) < BDC_HEADER_LEN) {
+		DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+		           PKTLEN(dhd->osh, pktbuf), BDC_HEADER_LEN));
+		return BCME_ERROR;
+	}
+
+	h = (struct bdc_header *)PKTDATA(dhd->osh, pktbuf);
+
+	if (!ifidx) {
+		/* for tx packet, skip the analysis */
+		data_offset = h->dataOffset;
+		PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+		goto exit;
+	}
+
+	if ((*ifidx = BDC_GET_IF_IDX(h)) >= DHD_MAX_IFS) {
+		DHD_ERROR(("%s: rx data ifnum out of range (%d)\n",
+		           __FUNCTION__, *ifidx));
+		return BCME_ERROR;
+	}
+
+	if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) != BDC_PROTO_VER) {
+		DHD_ERROR(("%s: non-BDC packet received, flags = 0x%x\n",
+		           dhd_ifname(dhd, *ifidx), h->flags));
+		if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) == BDC_PROTO_VER_1)
+			h->dataOffset = 0;
+		else
+		return BCME_ERROR;
+	}
+
+	if (h->flags & BDC_FLAG_SUM_GOOD) {
+		DHD_INFO(("%s: BDC packet received with good rx-csum, flags 0x%x\n",
+		          dhd_ifname(dhd, *ifidx), h->flags));
+		PKTSETSUMGOOD(pktbuf, TRUE);
+	}
+
+	PKTSETPRIO(pktbuf, (h->priority & BDC_PRIORITY_MASK));
+	data_offset = h->dataOffset;
+	PKTPULL(dhd->osh, pktbuf, BDC_HEADER_LEN);
+#endif /* BDC */
+
+#if defined(NDISVER)
+#if (NDISVER < 0x0630)
+	if (PKTLEN(dhd->osh, pktbuf) < (uint32) (data_offset << 2)) {
+		DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+		           PKTLEN(dhd->osh, pktbuf), (data_offset * 4)));
+		return BCME_ERROR;
+	}
+#endif /* #if defined(NDISVER) */
+#endif /* (NDISVER < 0x0630) */
+
+#ifdef PROP_TXSTATUS
+	if (!DHD_PKTTAG_PKTDIR(PKTTAG(pktbuf))) {
+		/*
+		- parse txstatus only for packets that came from the firmware
+		*/
+		dhd_wlfc_parse_header_info(dhd, pktbuf, (data_offset << 2),
+			reorder_buf_info, reorder_info_len);
+
+	}
+#endif /* PROP_TXSTATUS */
+
+exit:
+	PKTPULL(dhd->osh, pktbuf, (data_offset << 2));
+	return 0;
+}
+
+
+int
+dhd_prot_attach(dhd_pub_t *dhd)
+{
+	dhd_prot_t *cdc;
+
+	if (!(cdc = (dhd_prot_t *)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_PROT, sizeof(dhd_prot_t)))) {
+		DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+		goto fail;
+	}
+	memset(cdc, 0, sizeof(dhd_prot_t));
+
+	/* ensure that the msg buf directly follows the cdc msg struct */
+	if ((uintptr)(&cdc->msg + 1) != (uintptr)cdc->buf) {
+		DHD_ERROR(("dhd_prot_t is not correctly defined\n"));
+		goto fail;
+	}
+
+	dhd->prot = cdc;
+#ifdef BDC
+	dhd->hdrlen += BDC_HEADER_LEN;
+#endif
+	dhd->maxctl = WLC_IOCTL_MAXLEN + sizeof(cdc_ioctl_t) + ROUND_UP_MARGIN;
+	return 0;
+
+fail:
+	if (cdc != NULL)
+		DHD_OS_PREFREE(dhd, cdc, sizeof(dhd_prot_t));
+	return BCME_NOMEM;
+}
+
+/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
+void
+dhd_prot_detach(dhd_pub_t *dhd)
+{
+#ifdef PROP_TXSTATUS
+	dhd_wlfc_deinit(dhd);
+#endif
+	DHD_OS_PREFREE(dhd, dhd->prot, sizeof(dhd_prot_t));
+	dhd->prot = NULL;
+}
+
+void
+dhd_prot_dstats(dhd_pub_t *dhd)
+{
+	/*  copy bus stats */
+
+	dhd->dstats.tx_packets = dhd->tx_packets;
+	dhd->dstats.tx_errors = dhd->tx_errors;
+	dhd->dstats.rx_packets = dhd->rx_packets;
+	dhd->dstats.rx_errors = dhd->rx_errors;
+	dhd->dstats.rx_dropped = dhd->rx_dropped;
+	dhd->dstats.multicast = dhd->rx_multicast;
+	return;
+}
+
+int
+dhd_sync_with_dongle(dhd_pub_t *dhd)
+{
+	int ret = 0;
+	wlc_rev_info_t revinfo;
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+
+	/* Get the device rev info */
+	memset(&revinfo, 0, sizeof(revinfo));
+	ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+	if (ret < 0)
+		goto done;
+
+
+	dhd_process_cid_mac(dhd, TRUE);
+
+	ret = dhd_preinit_ioctls(dhd);
+
+	if (!ret)
+		dhd_process_cid_mac(dhd, FALSE);
+
+	/* Always assumes wl for now */
+	dhd->iswl = TRUE;
+
+done:
+	return ret;
+}
+
+int dhd_prot_init(dhd_pub_t *dhd)
+{
+	return TRUE;
+}
+
+void
+dhd_prot_stop(dhd_pub_t *dhd)
+{
+/* Nothing to do for CDC */
+}
+
+
+static void
+dhd_get_hostreorder_pkts(void *osh, struct reorder_info *ptr, void **pkt,
+	uint32 *pkt_count, void **pplast, uint8 start, uint8 end)
+{
+	void *plast = NULL, *p;
+	uint32 pkt_cnt = 0;
+
+	if (ptr->pend_pkts == 0) {
+		DHD_REORDER(("%s: no packets in reorder queue \n", __FUNCTION__));
+		*pplast = NULL;
+		*pkt_count = 0;
+		*pkt = NULL;
+		return;
+	}
+	do {
+		p = (void *)(ptr->p[start]);
+		ptr->p[start] = NULL;
+
+		if (p != NULL) {
+			if (plast == NULL)
+				*pkt = p;
+			else
+				PKTSETNEXT(osh, plast, p);
+
+			plast = p;
+			pkt_cnt++;
+		}
+		start++;
+		if (start > ptr->max_idx)
+			start = 0;
+	} while (start != end);
+	*pplast = plast;
+	*pkt_count = pkt_cnt;
+	ptr->pend_pkts -= (uint8)pkt_cnt;
+}
+
+int
+dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf, uint reorder_info_len,
+	void **pkt, uint32 *pkt_count)
+{
+	uint8 flow_id, max_idx, cur_idx, exp_idx;
+	struct reorder_info *ptr;
+	uint8 flags;
+	void *cur_pkt, *plast = NULL;
+	uint32 cnt = 0;
+
+	if (pkt == NULL) {
+		if (pkt_count != NULL)
+			*pkt_count = 0;
+		return 0;
+	}
+
+	flow_id = reorder_info_buf[WLHOST_REORDERDATA_FLOWID_OFFSET];
+	flags = reorder_info_buf[WLHOST_REORDERDATA_FLAGS_OFFSET];
+
+	DHD_REORDER(("flow_id %d, flags 0x%02x, idx(%d, %d, %d)\n", flow_id, flags,
+		reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET],
+		reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET],
+		reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET]));
+
+	/* validate flags and flow id */
+	if (flags == 0xFF) {
+		DHD_ERROR(("%s: invalid flags...so ignore this packet\n", __FUNCTION__));
+		*pkt_count = 1;
+		return 0;
+	}
+
+	cur_pkt = *pkt;
+	*pkt = NULL;
+
+	ptr = dhd->reorder_bufs[flow_id];
+	if (flags & WLHOST_REORDERDATA_DEL_FLOW) {
+		uint32 buf_size = sizeof(struct reorder_info);
+
+		DHD_REORDER(("%s: Flags indicating to delete a flow id %d\n",
+			__FUNCTION__, flow_id));
+
+		if (ptr == NULL) {
+			DHD_REORDER(("%s: received flags to cleanup, but no flow (%d) yet\n",
+				__FUNCTION__, flow_id));
+			*pkt_count = 1;
+			*pkt = cur_pkt;
+			return 0;
+		}
+
+		dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+			ptr->exp_idx, ptr->exp_idx);
+		/* set it to the last packet */
+		if (plast) {
+			PKTSETNEXT(dhd->osh, plast, cur_pkt);
+			cnt++;
+		}
+		else {
+			if (cnt != 0) {
+				DHD_ERROR(("%s: del flow: something fishy, pending packets %d\n",
+					__FUNCTION__, cnt));
+			}
+			*pkt = cur_pkt;
+			cnt = 1;
+		}
+		buf_size += ((ptr->max_idx + 1) * sizeof(void *));
+		MFREE(dhd->osh, ptr, buf_size);
+		dhd->reorder_bufs[flow_id] = NULL;
+		*pkt_count = cnt;
+		return 0;
+	}
+	/* all the other cases depend on the existance of the reorder struct for that flow id */
+	if (ptr == NULL) {
+		uint32 buf_size_alloc = sizeof(reorder_info_t);
+		max_idx = reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET];
+
+		buf_size_alloc += ((max_idx + 1) * sizeof(void*));
+		/* allocate space to hold the buffers, index etc */
+
+		DHD_REORDER(("%s: alloc buffer of size %d size, reorder info id %d, maxidx %d\n",
+			__FUNCTION__, buf_size_alloc, flow_id, max_idx));
+		ptr = (struct reorder_info *)MALLOC(dhd->osh, buf_size_alloc);
+		if (ptr == NULL) {
+			DHD_ERROR(("%s: Malloc failed to alloc buffer\n", __FUNCTION__));
+			*pkt_count = 1;
+			return 0;
+		}
+		bzero(ptr, buf_size_alloc);
+		dhd->reorder_bufs[flow_id] = ptr;
+		ptr->p = (void *)(ptr+1);
+		ptr->max_idx = max_idx;
+	}
+	if (flags & WLHOST_REORDERDATA_NEW_HOLE)  {
+		DHD_REORDER(("%s: new hole, so cleanup pending buffers\n", __FUNCTION__));
+		if (ptr->pend_pkts) {
+			dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+				ptr->exp_idx, ptr->exp_idx);
+			ptr->pend_pkts = 0;
+		}
+		ptr->cur_idx = reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET];
+		ptr->exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+		ptr->max_idx = reorder_info_buf[WLHOST_REORDERDATA_MAXIDX_OFFSET];
+		ptr->p[ptr->cur_idx] = cur_pkt;
+		ptr->pend_pkts++;
+		*pkt_count = cnt;
+	}
+	else if (flags & WLHOST_REORDERDATA_CURIDX_VALID) {
+		cur_idx = reorder_info_buf[WLHOST_REORDERDATA_CURIDX_OFFSET];
+		exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+
+
+		if ((exp_idx == ptr->exp_idx) && (cur_idx != ptr->exp_idx)) {
+			/* still in the current hole */
+			/* enqueue the current on the buffer chain */
+			if (ptr->p[cur_idx] != NULL) {
+				DHD_REORDER(("%s: HOLE: ERROR buffer pending..free it\n",
+					__FUNCTION__));
+				PKTFREE(dhd->osh, ptr->p[cur_idx], TRUE);
+				ptr->p[cur_idx] = NULL;
+			}
+			ptr->p[cur_idx] = cur_pkt;
+			ptr->pend_pkts++;
+			ptr->cur_idx = cur_idx;
+			DHD_REORDER(("%s: fill up a hole..pending packets is %d\n",
+				__FUNCTION__, ptr->pend_pkts));
+			*pkt_count = 0;
+			*pkt = NULL;
+		}
+		else if (ptr->exp_idx == cur_idx) {
+			/* got the right one ..flush from cur to exp and update exp */
+			DHD_REORDER(("%s: got the right one now, cur_idx is %d\n",
+				__FUNCTION__, cur_idx));
+			if (ptr->p[cur_idx] != NULL) {
+				DHD_REORDER(("%s: Error buffer pending..free it\n",
+					__FUNCTION__));
+				PKTFREE(dhd->osh, ptr->p[cur_idx], TRUE);
+				ptr->p[cur_idx] = NULL;
+			}
+			ptr->p[cur_idx] = cur_pkt;
+			ptr->pend_pkts++;
+
+			ptr->cur_idx = cur_idx;
+			ptr->exp_idx = exp_idx;
+
+			dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+				cur_idx, exp_idx);
+			*pkt_count = cnt;
+			DHD_REORDER(("%s: freeing up buffers %d, still pending %d\n",
+				__FUNCTION__, cnt, ptr->pend_pkts));
+		}
+		else {
+			uint8 end_idx;
+			bool flush_current = FALSE;
+			/* both cur and exp are moved now .. */
+			DHD_REORDER(("%s:, flow %d, both moved, cur %d(%d), exp %d(%d)\n",
+				__FUNCTION__, flow_id, ptr->cur_idx, cur_idx,
+				ptr->exp_idx, exp_idx));
+			if (flags & WLHOST_REORDERDATA_FLUSH_ALL)
+				end_idx = ptr->exp_idx;
+			else
+				end_idx = exp_idx;
+
+			/* flush pkts first */
+			dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast,
+				ptr->exp_idx, end_idx);
+
+			if (cur_idx == ptr->max_idx) {
+				if (exp_idx == 0)
+					flush_current = TRUE;
+			} else {
+				if (exp_idx == cur_idx + 1)
+					flush_current = TRUE;
+			}
+			if (flush_current) {
+				if (plast)
+					PKTSETNEXT(dhd->osh, plast, cur_pkt);
+				else
+					*pkt = cur_pkt;
+				cnt++;
+			}
+			else {
+				ptr->p[cur_idx] = cur_pkt;
+				ptr->pend_pkts++;
+			}
+			ptr->exp_idx = exp_idx;
+			ptr->cur_idx = cur_idx;
+			*pkt_count = cnt;
+		}
+	}
+	else {
+		uint8 end_idx;
+		/* no real packet but update to exp_seq...that means explicit window move */
+		exp_idx = reorder_info_buf[WLHOST_REORDERDATA_EXPIDX_OFFSET];
+
+		DHD_REORDER(("%s: move the window, cur_idx is %d, exp is %d, new exp is %d\n",
+			__FUNCTION__, ptr->cur_idx, ptr->exp_idx, exp_idx));
+		if (flags & WLHOST_REORDERDATA_FLUSH_ALL)
+			end_idx =  ptr->exp_idx;
+		else
+			end_idx =  exp_idx;
+
+		dhd_get_hostreorder_pkts(dhd->osh, ptr, pkt, &cnt, &plast, ptr->exp_idx, end_idx);
+		if (plast)
+			PKTSETNEXT(dhd->osh, plast, cur_pkt);
+		else
+			*pkt = cur_pkt;
+		cnt++;
+		*pkt_count = cnt;
+		/* set the new expected idx */
+		ptr->exp_idx = exp_idx;
+	}
+	return 0;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_cfg80211.c b/drivers/net/wireless/bcm4336/dhd_cfg80211.c
--- a/drivers/net/wireless/bcm4336/dhd_cfg80211.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_cfg80211.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,201 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfg80211.c,v 1.1.4.1.2.14 2011/02/09 01:40:07 Exp $
+ */
+
+#include <linux/vmalloc.h>
+#include <net/rtnetlink.h>
+
+#include <bcmutils.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <dhd_cfg80211.h>
+
+#ifdef PKT_FILTER_SUPPORT
+#include <dngl_stats.h>
+#include <dhd.h>
+#endif
+
+extern struct bcm_cfg80211 *g_bcm_cfg;
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+static int dhd_dongle_up = FALSE;
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <brcm_nl80211.h>
+#include <dhd_cfg80211.h>
+
+static s32 wl_dongle_up(struct net_device *ndev);
+static s32 wl_dongle_down(struct net_device *ndev);
+
+/**
+ * Function implementations
+ */
+
+s32 dhd_cfg80211_init(struct bcm_cfg80211 *cfg)
+{
+	dhd_dongle_up = FALSE;
+	return 0;
+}
+
+s32 dhd_cfg80211_deinit(struct bcm_cfg80211 *cfg)
+{
+	dhd_dongle_up = FALSE;
+	return 0;
+}
+
+s32 dhd_cfg80211_down(struct bcm_cfg80211 *cfg)
+{
+	struct net_device *ndev;
+	s32 err = 0;
+
+	WL_TRACE(("In\n"));
+	if (!dhd_dongle_up) {
+		WL_ERR(("Dongle is already down\n"));
+		return err;
+	}
+
+	ndev = bcmcfg_to_prmry_ndev(cfg);
+	wl_dongle_down(ndev);
+	dhd_dongle_up = FALSE;
+	return 0;
+}
+
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val)
+{
+	dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+	dhd->op_mode |= val;
+	WL_ERR(("Set : op_mode=0x%04x\n", dhd->op_mode));
+#ifdef ARP_OFFLOAD_SUPPORT
+	if (dhd->arp_version == 1) {
+		/* IF P2P is enabled, disable arpoe */
+		dhd_arp_offload_set(dhd, 0);
+		dhd_arp_offload_enable(dhd, false);
+	}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+	return 0;
+}
+
+s32 dhd_cfg80211_clean_p2p_info(struct bcm_cfg80211 *cfg)
+{
+	dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+	dhd->op_mode &= ~(DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE);
+	WL_ERR(("Clean : op_mode=0x%04x\n", dhd->op_mode));
+
+#ifdef ARP_OFFLOAD_SUPPORT
+	if (dhd->arp_version == 1) {
+		/* IF P2P is disabled, enable arpoe back for STA mode. */
+		dhd_arp_offload_set(dhd, dhd_arp_mode);
+		dhd_arp_offload_enable(dhd, true);
+	}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+	return 0;
+}
+
+struct net_device* wl_cfg80211_allocate_if(struct bcm_cfg80211 *cfg, int ifidx, char *name,
+	uint8 *mac, uint8 bssidx)
+{
+	return dhd_allocate_if(cfg->pub, ifidx, name, mac, bssidx, FALSE);
+}
+
+int wl_cfg80211_register_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev)
+{
+	return dhd_register_if(cfg->pub, ifidx, FALSE);
+}
+
+int wl_cfg80211_remove_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev)
+{
+	return dhd_remove_if(cfg->pub, ifidx, FALSE);
+}
+
+struct net_device * dhd_cfg80211_netdev_free(struct net_device *ndev)
+{
+	if (ndev) {
+		if (ndev->ieee80211_ptr) {
+			kfree(ndev->ieee80211_ptr);
+			ndev->ieee80211_ptr = NULL;
+		}
+		free_netdev(ndev);
+		return NULL;
+	}
+
+	return ndev;
+}
+
+void dhd_netdev_free(struct net_device *ndev)
+{
+#ifdef WL_CFG80211
+	ndev = dhd_cfg80211_netdev_free(ndev);
+#endif
+	if (ndev)
+		free_netdev(ndev);
+}
+
+static s32
+wl_dongle_up(struct net_device *ndev)
+{
+	s32 err = 0;
+	u32 up = 0;
+
+	err = wldev_ioctl(ndev, WLC_UP, &up, sizeof(up), true);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_UP error (%d)\n", err));
+	}
+	return err;
+}
+
+static s32
+wl_dongle_down(struct net_device *ndev)
+{
+	s32 err = 0;
+	u32 down = 0;
+
+	err = wldev_ioctl(ndev, WLC_DOWN, &down, sizeof(down), true);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_DOWN error (%d)\n", err));
+	}
+	return err;
+}
+
+
+s32 dhd_config_dongle(struct bcm_cfg80211 *cfg)
+{
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN	32
+#endif
+	struct net_device *ndev;
+	s32 err = 0;
+
+	WL_TRACE(("In\n"));
+	if (dhd_dongle_up) {
+		WL_ERR(("Dongle is already up\n"));
+		return err;
+	}
+
+	ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	err = wl_dongle_up(ndev);
+	if (unlikely(err)) {
+		WL_ERR(("wl_dongle_up failed\n"));
+		goto default_conf_out;
+	}
+	dhd_dongle_up = true;
+
+default_conf_out:
+
+	return err;
+
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_cfg80211.h b/drivers/net/wireless/bcm4336/dhd_cfg80211.h
--- a/drivers/net/wireless/bcm4336/dhd_cfg80211.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_cfg80211.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,30 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfg80211.c,v 1.1.4.1.2.14 2011/02/09 01:40:07 Exp $
+ */
+
+
+#ifndef __DHD_CFG80211__
+#define __DHD_CFG80211__
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+
+#ifndef WL_ERR
+#define WL_ERR CFG80211_ERR
+#endif
+#ifndef WL_TRACE
+#define WL_TRACE CFG80211_TRACE
+#endif
+
+s32 dhd_cfg80211_init(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_deinit(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_down(struct bcm_cfg80211 *cfg);
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val);
+s32 dhd_cfg80211_clean_p2p_info(struct bcm_cfg80211 *cfg);
+s32 dhd_config_dongle(struct bcm_cfg80211 *cfg);
+
+#endif /* __DHD_CFG80211__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_cfg_vendor.c b/drivers/net/wireless/bcm4336/dhd_cfg_vendor.c
--- a/drivers/net/wireless/bcm4336/dhd_cfg_vendor.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_cfg_vendor.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,153 @@
+/*
+ * Linux cfg80211 vendor command/event handlers of DHD
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_cfg_vendor.c 495605 2014-08-07 18:41:34Z $
+ */
+
+#include <linux/vmalloc.h>
+#include <linuxver.h>
+#include <net/cfg80211.h>
+#include <net/netlink.h>
+
+#include <bcmutils.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgvendor.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <brcm_nl80211.h>
+
+#ifdef VENDOR_EXT_SUPPORT
+static int dhd_cfgvendor_priv_string_handler(struct wiphy *wiphy,
+	struct wireless_dev *wdev, const void  *data, int len)
+{
+	const struct bcm_nlmsg_hdr *nlioc = data;
+	struct net_device *ndev = NULL;
+	struct bcm_cfg80211 *cfg;
+	struct sk_buff *reply;
+	void *buf = NULL, *cur;
+	dhd_pub_t *dhd;
+	dhd_ioctl_t ioc = { 0 };
+	int ret = 0, ret_len, payload, msglen;
+	int maxmsglen = PAGE_SIZE - 0x100;
+	int8 index;
+
+	WL_TRACE(("entry: cmd = %d\n", nlioc->cmd));
+	DHD_ERROR(("entry: cmd = %d\n", nlioc->cmd));
+
+	cfg = wiphy_priv(wiphy);
+	dhd = cfg->pub;
+
+	DHD_OS_WAKE_LOCK(dhd);
+
+	/* send to dongle only if we are not waiting for reload already */
+	if (dhd->hang_was_sent) {
+		WL_ERR(("HANG was sent up earlier\n"));
+		DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhd, DHD_EVENT_TIMEOUT_MS);
+		DHD_OS_WAKE_UNLOCK(dhd);
+		return OSL_ERROR(BCME_DONGLE_DOWN);
+	}
+
+	len -= sizeof(struct bcm_nlmsg_hdr);
+	ret_len = nlioc->len;
+	if (ret_len > 0 || len > 0) {
+		if (len > DHD_IOCTL_MAXLEN) {
+			WL_ERR(("oversize input buffer %d\n", len));
+			len = DHD_IOCTL_MAXLEN;
+		}
+		if (ret_len > DHD_IOCTL_MAXLEN) {
+			WL_ERR(("oversize return buffer %d\n", ret_len));
+			ret_len = DHD_IOCTL_MAXLEN;
+		}
+		payload = max(ret_len, len) + 1;
+		buf = vzalloc(payload);
+		if (!buf) {
+			DHD_OS_WAKE_UNLOCK(dhd);
+			return -ENOMEM;
+		}
+		memcpy(buf, (void *)nlioc + nlioc->offset, len);
+		*(char *)(buf + len) = '\0';
+	}
+
+	ndev = wdev_to_wlc_ndev(wdev, cfg);
+	index = dhd_net2idx(dhd->info, ndev);
+	if (index == DHD_BAD_IF) {
+		WL_ERR(("Bad ifidx from wdev:%p\n", wdev));
+		ret = BCME_ERROR;
+		goto done;
+	}
+
+	ioc.cmd = nlioc->cmd;
+	ioc.len = nlioc->len;
+	ioc.set = nlioc->set;
+	ioc.driver = nlioc->magic;
+	ret = dhd_ioctl_process(dhd, index, &ioc, buf);
+	if (ret) {
+		WL_TRACE(("dhd_ioctl_process return err %d\n", ret));
+		ret = OSL_ERROR(ret);
+		goto done;
+	}
+
+	cur = buf;
+	while (ret_len > 0) {
+		msglen = nlioc->len > maxmsglen ? maxmsglen : ret_len;
+		ret_len -= msglen;
+		payload = msglen + sizeof(msglen);
+		reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
+		if (!reply) {
+			WL_ERR(("Failed to allocate reply msg\n"));
+			ret = -ENOMEM;
+			break;
+		}
+
+		if (nla_put(reply, BCM_NLATTR_DATA, msglen, cur) ||
+			nla_put_u16(reply, BCM_NLATTR_LEN, msglen)) {
+			kfree_skb(reply);
+			ret = -ENOBUFS;
+			break;
+		}
+
+		ret = cfg80211_vendor_cmd_reply(reply);
+		if (ret) {
+			WL_ERR(("testmode reply failed:%d\n", ret));
+			break;
+		}
+		cur += msglen;
+	}
+
+done:
+	vfree(buf);
+	DHD_OS_WAKE_UNLOCK(dhd);
+	return ret;
+}
+
+const struct wiphy_vendor_command dhd_cfgvendor_cmds [] = {
+	{
+		{
+			.vendor_id = OUI_BRCM,
+			.subcmd = BRCM_VENDOR_SCMD_PRIV_STR
+		},
+		.flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
+		.doit = dhd_cfgvendor_priv_string_handler
+	},
+};
+
+int cfgvendor_attach(struct wiphy *wiphy)
+{
+	wiphy->vendor_commands	= dhd_cfgvendor_cmds;
+	wiphy->n_vendor_commands = ARRAY_SIZE(dhd_cfgvendor_cmds);
+
+	return 0;
+}
+
+int cfgvendor_detach(struct wiphy *wiphy)
+{
+	wiphy->vendor_commands  = NULL;
+	wiphy->n_vendor_commands = 0;
+
+	return 0;
+}
+#endif /* VENDOR_EXT_SUPPORT */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_common.c b/drivers/net/wireless/bcm4336/dhd_common.c
--- a/drivers/net/wireless/bcm4336/dhd_common.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_common.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,2881 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), common DHD core.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_common.c 492215 2014-07-20 16:44:15Z $
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+#include <dhd.h>
+#include <dhd_ip.h>
+#include <proto/bcmevent.h>
+
+#ifdef SHOW_LOGTRACE
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_config.h>
+#include <dhd_dbg.h>
+#include <msgtrace.h>
+
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#ifdef WLBTAMP
+#include <proto/bt_amp_hci.h>
+#include <dhd_bta.h>
+#endif
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef DHD_WMF
+#include <dhd_linux.h>
+#include <dhd_wmf_linux.h>
+#endif /* DHD_WMF */
+
+
+#ifdef WLMEDIA_HTSF
+extern void htsf_update(struct dhd_info *dhd, void *data);
+#endif
+int dhd_msg_level = DHD_ERROR_VAL;
+
+
+#include <wl_iw.h>
+
+#ifdef SOFTAP
+char fw_path2[MOD_PARAM_PATHLEN];
+extern bool softap_enabled;
+#endif
+
+/* Last connection success/failure status */
+uint32 dhd_conn_event;
+uint32 dhd_conn_status;
+uint32 dhd_conn_reason;
+
+#if defined(SHOW_EVENTS) && defined(SHOW_LOGTRACE)
+static int check_event_log_sequence_number(uint32 seq_no);
+#endif /* defined(SHOW_EVENTS) && defined(SHOW_LOGTRACE) */
+extern int dhd_iscan_request(void * dhdp, uint16 action);
+extern void dhd_ind_scan_confirm(void *h, bool status);
+extern int dhd_iscan_in_progress(void *h);
+void dhd_iscan_lock(void);
+void dhd_iscan_unlock(void);
+extern int dhd_change_mtu(dhd_pub_t *dhd, int new_mtu, int ifidx);
+#if !defined(AP) && defined(WLP2P)
+extern int dhd_get_concurrent_capabilites(dhd_pub_t *dhd);
+#endif
+bool ap_cfg_running = FALSE;
+bool ap_fw_loaded = FALSE;
+
+/* Version string to report */
+#ifdef DHD_DEBUG
+#ifndef SRCBASE
+#define SRCBASE        "drivers/net/wireless/bcmdhd"
+#endif
+#define DHD_COMPILED "\nCompiled in " SRCBASE
+#endif /* DHD_DEBUG */
+
+#if defined(DHD_DEBUG)
+const char dhd_version[] = "Dongle Host Driver, version " EPI_VERSION_STR
+	DHD_COMPILED;
+#else
+const char dhd_version[] = "\nDongle Host Driver, version " EPI_VERSION_STR "\nCompiled from ";
+#endif
+
+void dhd_set_timer(void *bus, uint wdtick);
+
+
+
+/* IOVar table */
+enum {
+	IOV_VERSION = 1,
+	IOV_WLMSGLEVEL,
+	IOV_MSGLEVEL,
+	IOV_BCMERRORSTR,
+	IOV_BCMERROR,
+	IOV_WDTICK,
+	IOV_DUMP,
+	IOV_CLEARCOUNTS,
+	IOV_LOGDUMP,
+	IOV_LOGCAL,
+	IOV_LOGSTAMP,
+	IOV_GPIOOB,
+	IOV_IOCTLTIMEOUT,
+#ifdef WLBTAMP
+	IOV_HCI_CMD,		/* HCI command */
+	IOV_HCI_ACL_DATA,	/* HCI data packet */
+#endif
+#if defined(DHD_DEBUG)
+	IOV_CONS,
+	IOV_DCONSOLE_POLL,
+#endif /* defined(DHD_DEBUG) */
+#ifdef PROP_TXSTATUS
+	IOV_PROPTXSTATUS_ENABLE,
+	IOV_PROPTXSTATUS_MODE,
+	IOV_PROPTXSTATUS_OPT,
+#ifdef QMONITOR
+	IOV_QMON_TIME_THRES,
+	IOV_QMON_TIME_PERCENT,
+#endif /* QMONITOR */
+	IOV_PROPTXSTATUS_MODULE_IGNORE,
+	IOV_PROPTXSTATUS_CREDIT_IGNORE,
+	IOV_PROPTXSTATUS_TXSTATUS_IGNORE,
+	IOV_PROPTXSTATUS_RXPKT_CHK,
+#endif /* PROP_TXSTATUS */
+	IOV_BUS_TYPE,
+#ifdef WLMEDIA_HTSF
+	IOV_WLPKTDLYSTAT_SZ,
+#endif
+	IOV_CHANGEMTU,
+	IOV_HOSTREORDER_FLOWS,
+#ifdef DHDTCPACK_SUPPRESS
+	IOV_TCPACK_SUPPRESS,
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_WMF
+	IOV_WMF_BSS_ENAB,
+	IOV_WMF_UCAST_IGMP,
+	IOV_WMF_MCAST_DATA_SENDUP,
+#ifdef WL_IGMP_UCQUERY
+	IOV_WMF_UCAST_IGMP_QUERY,
+#endif /* WL_IGMP_UCQUERY */
+#ifdef DHD_UCAST_UPNP
+	IOV_WMF_UCAST_UPNP,
+#endif /* DHD_UCAST_UPNP */
+#endif /* DHD_WMF */
+	IOV_AP_ISOLATE,
+#ifdef DHD_UNICAST_DHCP
+	IOV_DHCP_UNICAST,
+#endif /* DHD_UNICAST_DHCP */
+#ifdef DHD_L2_FILTER
+	IOV_BLOCK_PING,
+#endif
+	IOV_LAST
+};
+
+const bcm_iovar_t dhd_iovars[] = {
+	{"version",	IOV_VERSION,	0,	IOVT_BUFFER,	sizeof(dhd_version) },
+	{"wlmsglevel",	IOV_WLMSGLEVEL,	0,	IOVT_UINT32,	0 },
+#ifdef DHD_DEBUG
+	{"msglevel",	IOV_MSGLEVEL,	0,	IOVT_UINT32,	0 },
+#endif /* DHD_DEBUG */
+	{"bcmerrorstr", IOV_BCMERRORSTR, 0, IOVT_BUFFER,	BCME_STRLEN },
+	{"bcmerror",	IOV_BCMERROR,	0,	IOVT_INT8,	0 },
+	{"wdtick",	IOV_WDTICK, 0,	IOVT_UINT32,	0 },
+	{"dump",	IOV_DUMP,	0,	IOVT_BUFFER,	DHD_IOCTL_MAXLEN },
+#ifdef DHD_DEBUG
+	{"cons",	IOV_CONS,	0,	IOVT_BUFFER,	0 },
+	{"dconpoll",	IOV_DCONSOLE_POLL, 0,	IOVT_UINT32,	0 },
+#endif
+	{"clearcounts", IOV_CLEARCOUNTS, 0, IOVT_VOID,	0 },
+	{"gpioob",	IOV_GPIOOB,	0,	IOVT_UINT32,	0 },
+	{"ioctl_timeout",	IOV_IOCTLTIMEOUT,	0,	IOVT_UINT32,	0 },
+#ifdef WLBTAMP
+	{"HCI_cmd",	IOV_HCI_CMD,	0,	IOVT_BUFFER,	0},
+	{"HCI_ACL_data", IOV_HCI_ACL_DATA, 0,	IOVT_BUFFER,	0},
+#endif
+#ifdef PROP_TXSTATUS
+	{"proptx",	IOV_PROPTXSTATUS_ENABLE,	0,	IOVT_BOOL,	0 },
+	/*
+	set the proptxtstatus operation mode:
+	0 - Do not do any proptxtstatus flow control
+	1 - Use implied credit from a packet status
+	2 - Use explicit credit
+	*/
+	{"ptxmode",	IOV_PROPTXSTATUS_MODE,	0,	IOVT_UINT32,	0 },
+	{"proptx_opt", IOV_PROPTXSTATUS_OPT,	0,	IOVT_UINT32,	0 },
+#ifdef QMONITOR
+	{"qtime_thres",	IOV_QMON_TIME_THRES,	0,	IOVT_UINT32,	0 },
+	{"qtime_percent", IOV_QMON_TIME_PERCENT, 0,	IOVT_UINT32,	0 },
+#endif /* QMONITOR */
+	{"pmodule_ignore", IOV_PROPTXSTATUS_MODULE_IGNORE, 0, IOVT_BOOL, 0 },
+	{"pcredit_ignore", IOV_PROPTXSTATUS_CREDIT_IGNORE, 0, IOVT_BOOL, 0 },
+	{"ptxstatus_ignore", IOV_PROPTXSTATUS_TXSTATUS_IGNORE, 0, IOVT_BOOL, 0 },
+	{"rxpkt_chk", IOV_PROPTXSTATUS_RXPKT_CHK, 0, IOVT_BOOL, 0 },
+#endif /* PROP_TXSTATUS */
+	{"bustype", IOV_BUS_TYPE, 0, IOVT_UINT32, 0},
+#ifdef WLMEDIA_HTSF
+	{"pktdlystatsz", IOV_WLPKTDLYSTAT_SZ, 0, IOVT_UINT8, 0 },
+#endif
+	{"changemtu", IOV_CHANGEMTU, 0, IOVT_UINT32, 0 },
+	{"host_reorder_flows", IOV_HOSTREORDER_FLOWS, 0, IOVT_BUFFER,
+	(WLHOST_REORDERDATA_MAXFLOWS + 1) },
+#ifdef DHDTCPACK_SUPPRESS
+	{"tcpack_suppress",	IOV_TCPACK_SUPPRESS,	0,	IOVT_UINT8,	0 },
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_WMF
+	{"wmf_bss_enable", IOV_WMF_BSS_ENAB,	0,	IOVT_BOOL,	0 },
+	{"wmf_ucast_igmp", IOV_WMF_UCAST_IGMP,	0,	IOVT_BOOL,	0 },
+	{"wmf_mcast_data_sendup", IOV_WMF_MCAST_DATA_SENDUP,	0,	IOVT_BOOL,	0 },
+#ifdef WL_IGMP_UCQUERY
+	{"wmf_ucast_igmp_query", IOV_WMF_UCAST_IGMP_QUERY, (0), IOVT_BOOL, 0 },
+#endif /* WL_IGMP_UCQUERY */
+#ifdef DHD_UCAST_UPNP
+	{"wmf_ucast_upnp", IOV_WMF_UCAST_UPNP, (0), IOVT_BOOL, 0 },
+#endif /* DHD_UCAST_UPNP */
+#endif /* DHD_WMF */
+#ifdef DHD_UNICAST_DHCP
+	{"dhcp_unicast", IOV_DHCP_UNICAST, (0), IOVT_BOOL, 0 },
+#endif /* DHD_UNICAST_DHCP */
+	{"ap_isolate", IOV_AP_ISOLATE, (0), IOVT_BOOL, 0},
+#ifdef DHD_L2_FILTER
+	{"block_ping", IOV_BLOCK_PING, (0), IOVT_BOOL, 0},
+#endif
+	{NULL, 0, 0, 0, 0 }
+};
+
+#define DHD_IOVAR_BUF_SIZE	128
+
+/* to NDIS developer, the structure dhd_common is redundant,
+ * please do NOT merge it back from other branches !!!
+ */
+
+static int
+dhd_dump(dhd_pub_t *dhdp, char *buf, int buflen)
+{
+	char eabuf[ETHER_ADDR_STR_LEN];
+
+	struct bcmstrbuf b;
+	struct bcmstrbuf *strbuf = &b;
+
+	bcm_binit(strbuf, buf, buflen);
+
+	/* Base DHD info */
+	bcm_bprintf(strbuf, "%s\n", dhd_version);
+	bcm_bprintf(strbuf, "\n");
+	bcm_bprintf(strbuf, "pub.up %d pub.txoff %d pub.busstate %d\n",
+	            dhdp->up, dhdp->txoff, dhdp->busstate);
+	bcm_bprintf(strbuf, "pub.hdrlen %u pub.maxctl %u pub.rxsz %u\n",
+	            dhdp->hdrlen, dhdp->maxctl, dhdp->rxsz);
+	bcm_bprintf(strbuf, "pub.iswl %d pub.drv_version %ld pub.mac %s\n",
+	            dhdp->iswl, dhdp->drv_version, bcm_ether_ntoa(&dhdp->mac, eabuf));
+	bcm_bprintf(strbuf, "pub.bcmerror %d tickcnt %u\n", dhdp->bcmerror, dhdp->tickcnt);
+
+	bcm_bprintf(strbuf, "dongle stats:\n");
+	bcm_bprintf(strbuf, "tx_packets %lu tx_bytes %lu tx_errors %lu tx_dropped %lu\n",
+	            dhdp->dstats.tx_packets, dhdp->dstats.tx_bytes,
+	            dhdp->dstats.tx_errors, dhdp->dstats.tx_dropped);
+	bcm_bprintf(strbuf, "rx_packets %lu rx_bytes %lu rx_errors %lu rx_dropped %lu\n",
+	            dhdp->dstats.rx_packets, dhdp->dstats.rx_bytes,
+	            dhdp->dstats.rx_errors, dhdp->dstats.rx_dropped);
+	bcm_bprintf(strbuf, "multicast %lu\n", dhdp->dstats.multicast);
+
+	bcm_bprintf(strbuf, "bus stats:\n");
+	bcm_bprintf(strbuf, "tx_packets %lu  tx_dropped %lu tx_multicast %lu tx_errors %lu\n",
+	            dhdp->tx_packets, dhdp->tx_dropped, dhdp->tx_multicast, dhdp->tx_errors);
+	bcm_bprintf(strbuf, "tx_ctlpkts %lu tx_ctlerrs %lu\n",
+	            dhdp->tx_ctlpkts, dhdp->tx_ctlerrs);
+	bcm_bprintf(strbuf, "rx_packets %lu rx_multicast %lu rx_errors %lu \n",
+	            dhdp->rx_packets, dhdp->rx_multicast, dhdp->rx_errors);
+	bcm_bprintf(strbuf, "rx_ctlpkts %lu rx_ctlerrs %lu rx_dropped %lu\n",
+	            dhdp->rx_ctlpkts, dhdp->rx_ctlerrs, dhdp->rx_dropped);
+	bcm_bprintf(strbuf, "rx_readahead_cnt %lu tx_realloc %lu\n",
+	            dhdp->rx_readahead_cnt, dhdp->tx_realloc);
+	bcm_bprintf(strbuf, "\n");
+
+	/* Add any prot info */
+	dhd_prot_dump(dhdp, strbuf);
+	bcm_bprintf(strbuf, "\n");
+
+	/* Add any bus info */
+	dhd_bus_dump(dhdp, strbuf);
+
+
+	return (!strbuf->size ? BCME_BUFTOOSHORT : 0);
+}
+
+int
+dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set, int ifidx)
+{
+	wl_ioctl_t ioc;
+
+	ioc.cmd = cmd;
+	ioc.buf = arg;
+	ioc.len = len;
+	ioc.set = set;
+
+	return dhd_wl_ioctl(dhd_pub, ifidx, &ioc, arg, len);
+}
+
+int
+dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifidx, wl_ioctl_t *ioc, void *buf, int len)
+{
+	int ret = BCME_ERROR;
+
+	if (dhd_os_proto_block(dhd_pub))
+	{
+#if defined(WL_WLC_SHIM)
+		wl_info_t *wl = dhd_pub_wlinfo(dhd_pub);
+
+		wl_io_pport_t io_pport;
+		io_pport.dhd_pub = dhd_pub;
+		io_pport.ifidx = ifidx;
+
+		ret = wl_shim_ioctl(wl->shim, ioc, &io_pport);
+		if (ret != BCME_OK) {
+			DHD_ERROR(("%s: wl_shim_ioctl(%d) ERR %d\n", __FUNCTION__, ioc->cmd, ret));
+		}
+#else
+		ret = dhd_prot_ioctl(dhd_pub, ifidx, ioc, buf, len);
+#endif /* defined(WL_WLC_SHIM) */
+
+		if (ret && dhd_pub->up) {
+			/* Send hang event only if dhd_open() was success */
+			dhd_os_check_hang(dhd_pub, ifidx, ret);
+		}
+
+		if (ret == -ETIMEDOUT && !dhd_pub->up) {
+			DHD_ERROR(("%s: 'resumed on timeout' error is "
+				"occurred before the interface does not"
+				" bring up\n", __FUNCTION__));
+			dhd_pub->busstate = DHD_BUS_DOWN;
+		}
+
+		dhd_os_proto_unblock(dhd_pub);
+
+	}
+
+	return ret;
+}
+
+uint wl_get_port_num(wl_io_pport_t *io_pport)
+{
+	return 0;
+}
+
+/* Get bssidx from iovar params
+ * Input:   dhd_pub - pointer to dhd_pub_t
+ *	    params  - IOVAR params
+ * Output:  idx	    - BSS index
+ *	    val	    - ponter to the IOVAR arguments
+ */
+static int
+dhd_iovar_parse_bssidx(dhd_pub_t *dhd_pub, char *params, int *idx, char **val)
+{
+	char *prefix = "bsscfg:";
+	uint32	bssidx;
+
+	if (!(strncmp(params, prefix, strlen(prefix)))) {
+		/* per bss setting should be prefixed with 'bsscfg:' */
+		char *p = (char *)params + strlen(prefix);
+
+		/* Skip Name */
+		while (*p != '\0')
+			p++;
+		/* consider null */
+		p = p + 1;
+		bcopy(p, &bssidx, sizeof(uint32));
+		/* Get corresponding dhd index */
+		bssidx = dhd_bssidx2idx(dhd_pub, bssidx);
+
+		if (bssidx >= DHD_MAX_IFS) {
+			DHD_ERROR(("%s Wrong bssidx provided\n", __FUNCTION__));
+			return BCME_ERROR;
+		}
+
+		/* skip bss idx */
+		p += sizeof(uint32);
+		*val = p;
+		*idx = bssidx;
+	} else {
+		DHD_ERROR(("%s: bad parameter for per bss iovar\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	return BCME_OK;
+}
+
+static int
+dhd_doiovar(dhd_pub_t *dhd_pub, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+            void *params, int plen, void *arg, int len, int val_size)
+{
+	int bcmerror = 0;
+	int32 int_val = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	DHD_TRACE(("%s: actionid = %d; name %s\n", __FUNCTION__, actionid, name));
+
+	if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+		goto exit;
+
+	if (plen >= (int)sizeof(int_val))
+		bcopy(params, &int_val, sizeof(int_val));
+
+	switch (actionid) {
+	case IOV_GVAL(IOV_VERSION):
+		/* Need to have checked buffer length */
+		bcm_strncpy_s((char*)arg, len, dhd_version, len);
+		break;
+
+	case IOV_GVAL(IOV_WLMSGLEVEL):
+		printf("android_msg_level=0x%x\n", android_msg_level);
+		printf("config_msg_level=0x%x\n", config_msg_level);
+#if defined(WL_WIRELESS_EXT)
+		int_val = (int32)iw_msg_level;
+		bcopy(&int_val, arg, val_size);
+		printf("iw_msg_level=0x%x\n", iw_msg_level);
+#endif
+#ifdef WL_CFG80211
+		int_val = (int32)wl_dbg_level;
+		bcopy(&int_val, arg, val_size);
+		printf("cfg_msg_level=0x%x\n", wl_dbg_level);
+#endif
+		break;
+
+	case IOV_SVAL(IOV_WLMSGLEVEL):
+		if (int_val & DHD_ANDROID_VAL) {
+			android_msg_level = (uint)(int_val & 0xFFFF);
+			printf("android_msg_level=0x%x\n", android_msg_level);
+		}
+		if (int_val & DHD_CONFIG_VAL) {
+			config_msg_level = (uint)(int_val & 0xFFFF);
+			printf("config_msg_level=0x%x\n", config_msg_level);
+		}
+#if defined(WL_WIRELESS_EXT)
+		if (int_val & DHD_IW_VAL) {
+			iw_msg_level = (uint)(int_val & 0xFFFF);
+			printf("iw_msg_level=0x%x\n", iw_msg_level);
+		}
+#endif
+#ifdef WL_CFG80211
+		if (int_val & DHD_CFG_VAL) {
+			wl_cfg80211_enable_trace((u32)(int_val & 0xFFFF));
+		}
+#endif
+		break;
+
+	case IOV_GVAL(IOV_MSGLEVEL):
+		int_val = (int32)dhd_msg_level;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_MSGLEVEL):
+		dhd_msg_level = int_val;
+		break;
+
+	case IOV_GVAL(IOV_BCMERRORSTR):
+		bcm_strncpy_s((char *)arg, len, bcmerrorstr(dhd_pub->bcmerror), BCME_STRLEN);
+		((char *)arg)[BCME_STRLEN - 1] = 0x00;
+		break;
+
+	case IOV_GVAL(IOV_BCMERROR):
+		int_val = (int32)dhd_pub->bcmerror;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_WDTICK):
+		int_val = (int32)dhd_watchdog_ms;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_WDTICK):
+		if (!dhd_pub->up) {
+			bcmerror = BCME_NOTUP;
+			break;
+		}
+		dhd_os_wd_timer(dhd_pub, (uint)int_val);
+		break;
+
+	case IOV_GVAL(IOV_DUMP):
+		bcmerror = dhd_dump(dhd_pub, arg, len);
+		break;
+
+#ifdef DHD_DEBUG
+	case IOV_GVAL(IOV_DCONSOLE_POLL):
+		int_val = (int32)dhd_console_ms;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DCONSOLE_POLL):
+		dhd_console_ms = (uint)int_val;
+		break;
+
+	case IOV_SVAL(IOV_CONS):
+		if (len > 0)
+			bcmerror = dhd_bus_console_in(dhd_pub, arg, len - 1);
+		break;
+#endif /* DHD_DEBUG */
+
+	case IOV_SVAL(IOV_CLEARCOUNTS):
+		dhd_pub->tx_packets = dhd_pub->rx_packets = 0;
+		dhd_pub->tx_errors = dhd_pub->rx_errors = 0;
+		dhd_pub->tx_ctlpkts = dhd_pub->rx_ctlpkts = 0;
+		dhd_pub->tx_ctlerrs = dhd_pub->rx_ctlerrs = 0;
+		dhd_pub->tx_dropped = 0;
+		dhd_pub->rx_dropped = 0;
+		dhd_pub->rx_readahead_cnt = 0;
+		dhd_pub->tx_realloc = 0;
+		dhd_pub->wd_dpc_sched = 0;
+		memset(&dhd_pub->dstats, 0, sizeof(dhd_pub->dstats));
+		dhd_bus_clearcounts(dhd_pub);
+#ifdef PROP_TXSTATUS
+		/* clear proptxstatus related counters */
+		dhd_wlfc_clear_counts(dhd_pub);
+#endif /* PROP_TXSTATUS */
+		break;
+
+
+	case IOV_GVAL(IOV_IOCTLTIMEOUT): {
+		int_val = (int32)dhd_os_get_ioctl_resp_timeout();
+		bcopy(&int_val, arg, sizeof(int_val));
+		break;
+	}
+
+	case IOV_SVAL(IOV_IOCTLTIMEOUT): {
+		if (int_val <= 0)
+			bcmerror = BCME_BADARG;
+		else
+			dhd_os_set_ioctl_resp_timeout((unsigned int)int_val);
+		break;
+	}
+
+#ifdef WLBTAMP
+	case IOV_SVAL(IOV_HCI_CMD): {
+		amp_hci_cmd_t *cmd = (amp_hci_cmd_t *)arg;
+
+		/* sanity check: command preamble present */
+		if (len < HCI_CMD_PREAMBLE_SIZE)
+			return BCME_BUFTOOSHORT;
+
+		/* sanity check: command parameters are present */
+		if (len < (int)(HCI_CMD_PREAMBLE_SIZE + cmd->plen))
+			return BCME_BUFTOOSHORT;
+
+		dhd_bta_docmd(dhd_pub, cmd, len);
+		break;
+	}
+
+	case IOV_SVAL(IOV_HCI_ACL_DATA): {
+		amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)arg;
+
+		/* sanity check: HCI header present */
+		if (len < HCI_ACL_DATA_PREAMBLE_SIZE)
+			return BCME_BUFTOOSHORT;
+
+		/* sanity check: ACL data is present */
+		if (len < (int)(HCI_ACL_DATA_PREAMBLE_SIZE + ACL_data->dlen))
+			return BCME_BUFTOOSHORT;
+
+		dhd_bta_tx_hcidata(dhd_pub, ACL_data, len);
+		break;
+	}
+#endif /* WLBTAMP */
+
+#ifdef PROP_TXSTATUS
+	case IOV_GVAL(IOV_PROPTXSTATUS_ENABLE): {
+		bool wlfc_enab = FALSE;
+		bcmerror = dhd_wlfc_get_enable(dhd_pub, &wlfc_enab);
+		if (bcmerror != BCME_OK)
+			goto exit;
+		int_val = wlfc_enab ? 1 : 0;
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+	case IOV_SVAL(IOV_PROPTXSTATUS_ENABLE): {
+		bool wlfc_enab = FALSE;
+		bcmerror = dhd_wlfc_get_enable(dhd_pub, &wlfc_enab);
+		if (bcmerror != BCME_OK)
+			goto exit;
+
+		/* wlfc is already set as desired */
+		if (wlfc_enab == (int_val == 0 ? FALSE : TRUE))
+			goto exit;
+
+		if (int_val == TRUE)
+			bcmerror = dhd_wlfc_init(dhd_pub);
+		else
+			bcmerror = dhd_wlfc_deinit(dhd_pub);
+
+		break;
+	}
+	case IOV_GVAL(IOV_PROPTXSTATUS_MODE):
+		bcmerror = dhd_wlfc_get_mode(dhd_pub, &int_val);
+		if (bcmerror != BCME_OK)
+			goto exit;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PROPTXSTATUS_MODE):
+		dhd_wlfc_set_mode(dhd_pub, int_val);
+		break;
+#ifdef QMONITOR
+	case IOV_GVAL(IOV_QMON_TIME_THRES): {
+		int_val = dhd_qmon_thres(dhd_pub, FALSE, 0);
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+
+	case IOV_SVAL(IOV_QMON_TIME_THRES): {
+		dhd_qmon_thres(dhd_pub, TRUE, int_val);
+		break;
+	}
+
+	case IOV_GVAL(IOV_QMON_TIME_PERCENT): {
+		int_val = dhd_qmon_getpercent(dhd_pub);
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+#endif /* QMONITOR */
+
+	case IOV_GVAL(IOV_PROPTXSTATUS_MODULE_IGNORE):
+		bcmerror = dhd_wlfc_get_module_ignore(dhd_pub, &int_val);
+		if (bcmerror != BCME_OK)
+			goto exit;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PROPTXSTATUS_MODULE_IGNORE):
+		dhd_wlfc_set_module_ignore(dhd_pub, int_val);
+		break;
+
+	case IOV_GVAL(IOV_PROPTXSTATUS_CREDIT_IGNORE):
+		bcmerror = dhd_wlfc_get_credit_ignore(dhd_pub, &int_val);
+		if (bcmerror != BCME_OK)
+			goto exit;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PROPTXSTATUS_CREDIT_IGNORE):
+		dhd_wlfc_set_credit_ignore(dhd_pub, int_val);
+		break;
+
+	case IOV_GVAL(IOV_PROPTXSTATUS_TXSTATUS_IGNORE):
+		bcmerror = dhd_wlfc_get_txstatus_ignore(dhd_pub, &int_val);
+		if (bcmerror != BCME_OK)
+			goto exit;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PROPTXSTATUS_TXSTATUS_IGNORE):
+		dhd_wlfc_set_txstatus_ignore(dhd_pub, int_val);
+		break;
+
+	case IOV_GVAL(IOV_PROPTXSTATUS_RXPKT_CHK):
+		bcmerror = dhd_wlfc_get_rxpkt_chk(dhd_pub, &int_val);
+		if (bcmerror != BCME_OK)
+			goto exit;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PROPTXSTATUS_RXPKT_CHK):
+		dhd_wlfc_set_rxpkt_chk(dhd_pub, int_val);
+		break;
+
+#endif /* PROP_TXSTATUS */
+
+	case IOV_GVAL(IOV_BUS_TYPE):
+		/* The dhd application queries the driver to check if its usb or sdio.  */
+#ifdef BCMDHDUSB
+		int_val = BUS_TYPE_USB;
+#endif
+#ifdef BCMSDIO
+		int_val = BUS_TYPE_SDIO;
+#endif
+#ifdef PCIE_FULL_DONGLE
+		int_val = BUS_TYPE_PCIE;
+#endif
+		bcopy(&int_val, arg, val_size);
+		break;
+
+
+#ifdef WLMEDIA_HTSF
+	case IOV_GVAL(IOV_WLPKTDLYSTAT_SZ):
+		int_val = dhd_pub->htsfdlystat_sz;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_WLPKTDLYSTAT_SZ):
+		dhd_pub->htsfdlystat_sz = int_val & 0xff;
+		printf("Setting tsfdlystat_sz:%d\n", dhd_pub->htsfdlystat_sz);
+		break;
+#endif
+	case IOV_SVAL(IOV_CHANGEMTU):
+		int_val &= 0xffff;
+		bcmerror = dhd_change_mtu(dhd_pub, int_val, 0);
+		break;
+
+	case IOV_GVAL(IOV_HOSTREORDER_FLOWS):
+	{
+		uint i = 0;
+		uint8 *ptr = (uint8 *)arg;
+		uint8 count = 0;
+
+		ptr++;
+		for (i = 0; i < WLHOST_REORDERDATA_MAXFLOWS; i++) {
+			if (dhd_pub->reorder_bufs[i] != NULL) {
+				*ptr = dhd_pub->reorder_bufs[i]->flow_id;
+				ptr++;
+				count++;
+			}
+		}
+		ptr = (uint8 *)arg;
+		*ptr = count;
+		break;
+	}
+#ifdef DHDTCPACK_SUPPRESS
+	case IOV_GVAL(IOV_TCPACK_SUPPRESS): {
+		int_val = (uint32)dhd_pub->tcpack_sup_mode;
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+	case IOV_SVAL(IOV_TCPACK_SUPPRESS): {
+		bcmerror = dhd_tcpack_suppress_set(dhd_pub, (uint8)int_val);
+		break;
+	}
+#endif /* DHDTCPACK_SUPPRESS */
+#ifdef DHD_WMF
+	case IOV_GVAL(IOV_WMF_BSS_ENAB): {
+		uint32	bssidx;
+		dhd_wmf_t *wmf;
+		char *val;
+
+		if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+			DHD_ERROR(("%s: wmf_bss_enable: bad parameter\n", __FUNCTION__));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		wmf = dhd_wmf_conf(dhd_pub, bssidx);
+		int_val = wmf->wmf_enable ? 1 :0;
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+	case IOV_SVAL(IOV_WMF_BSS_ENAB): {
+		/* Enable/Disable WMF */
+		uint32	bssidx;
+		dhd_wmf_t *wmf;
+		char *val;
+
+		if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+			DHD_ERROR(("%s: wmf_bss_enable: bad parameter\n", __FUNCTION__));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		ASSERT(val);
+		bcopy(val, &int_val, sizeof(uint32));
+		wmf = dhd_wmf_conf(dhd_pub, bssidx);
+		if (wmf->wmf_enable == int_val)
+			break;
+		if (int_val) {
+			/* Enable WMF */
+			if (dhd_wmf_instance_add(dhd_pub, bssidx) != BCME_OK) {
+				DHD_ERROR(("%s: Error in creating WMF instance\n",
+				__FUNCTION__));
+				break;
+			}
+			if (dhd_wmf_start(dhd_pub, bssidx) != BCME_OK) {
+				DHD_ERROR(("%s: Failed to start WMF\n", __FUNCTION__));
+				break;
+			}
+			wmf->wmf_enable = TRUE;
+		} else {
+			/* Disable WMF */
+			wmf->wmf_enable = FALSE;
+			dhd_wmf_stop(dhd_pub, bssidx);
+			dhd_wmf_instance_del(dhd_pub, bssidx);
+		}
+		break;
+	}
+	case IOV_GVAL(IOV_WMF_UCAST_IGMP):
+		int_val = dhd_pub->wmf_ucast_igmp ? 1 : 0;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_WMF_UCAST_IGMP):
+		if (dhd_pub->wmf_ucast_igmp == int_val)
+			break;
+
+		if (int_val >= OFF && int_val <= ON)
+			dhd_pub->wmf_ucast_igmp = int_val;
+		else
+			bcmerror = BCME_RANGE;
+		break;
+	case IOV_GVAL(IOV_WMF_MCAST_DATA_SENDUP):
+		int_val = dhd_wmf_mcast_data_sendup(dhd_pub, 0, FALSE, FALSE);
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_WMF_MCAST_DATA_SENDUP):
+		dhd_wmf_mcast_data_sendup(dhd_pub, 0, TRUE, int_val);
+		break;
+
+#ifdef WL_IGMP_UCQUERY
+	case IOV_GVAL(IOV_WMF_UCAST_IGMP_QUERY):
+		int_val = dhd_pub->wmf_ucast_igmp_query ? 1 : 0;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_WMF_UCAST_IGMP_QUERY):
+		if (dhd_pub->wmf_ucast_igmp_query == int_val)
+			break;
+
+		if (int_val >= OFF && int_val <= ON)
+			dhd_pub->wmf_ucast_igmp_query = int_val;
+		else
+			bcmerror = BCME_RANGE;
+		break;
+#endif /* WL_IGMP_UCQUERY */
+#ifdef DHD_UCAST_UPNP
+	case IOV_GVAL(IOV_WMF_UCAST_UPNP):
+		int_val = dhd_pub->wmf_ucast_upnp ? 1 : 0;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_WMF_UCAST_UPNP):
+		if (dhd_pub->wmf_ucast_upnp == int_val)
+			break;
+
+		if (int_val >= OFF && int_val <= ON)
+			dhd_pub->wmf_ucast_upnp = int_val;
+		else
+			bcmerror = BCME_RANGE;
+		break;
+#endif /* DHD_UCAST_UPNP */
+#endif /* DHD_WMF */
+
+
+#ifdef DHD_UNICAST_DHCP
+	case IOV_GVAL(IOV_DHCP_UNICAST):
+		int_val = dhd_pub->dhcp_unicast;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_DHCP_UNICAST):
+		if (dhd_pub->dhcp_unicast == int_val)
+			break;
+
+		if (int_val >= OFF || int_val <= ON) {
+			dhd_pub->dhcp_unicast = int_val;
+		} else {
+			bcmerror = BCME_RANGE;
+		}
+		break;
+#endif /* DHD_UNICAST_DHCP */
+#ifdef DHD_L2_FILTER
+	case IOV_GVAL(IOV_BLOCK_PING):
+		int_val = dhd_pub->block_ping;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_BLOCK_PING):
+		if (dhd_pub->block_ping == int_val)
+			break;
+		if (int_val >= OFF || int_val <= ON) {
+			dhd_pub->block_ping = int_val;
+		} else {
+			bcmerror = BCME_RANGE;
+		}
+		break;
+#endif
+
+	case IOV_GVAL(IOV_AP_ISOLATE): {
+		uint32	bssidx;
+		char *val;
+
+		if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+			DHD_ERROR(("%s: ap isoalate: bad parameter\n", __FUNCTION__));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		int_val = dhd_get_ap_isolate(dhd_pub, bssidx);
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+	case IOV_SVAL(IOV_AP_ISOLATE): {
+		uint32	bssidx;
+		char *val;
+
+		if (dhd_iovar_parse_bssidx(dhd_pub, (char *)name, &bssidx, &val) != BCME_OK) {
+			DHD_ERROR(("%s: ap isolate: bad parameter\n", __FUNCTION__));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		ASSERT(val);
+		bcopy(val, &int_val, sizeof(uint32));
+		dhd_set_ap_isolate(dhd_pub, bssidx, int_val);
+		break;
+	}
+
+	default:
+		bcmerror = BCME_UNSUPPORTED;
+		break;
+	}
+
+exit:
+	DHD_TRACE(("%s: actionid %d, bcmerror %d\n", __FUNCTION__, actionid, bcmerror));
+	return bcmerror;
+}
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+void
+dhd_store_conn_status(uint32 event, uint32 status, uint32 reason)
+{
+	/* Do not overwrite a WLC_E_PRUNE with a WLC_E_SET_SSID
+	 * because an encryption/rsn mismatch results in both events, and
+	 * the important information is in the WLC_E_PRUNE.
+	 */
+	if (!(event == WLC_E_SET_SSID && status == WLC_E_STATUS_FAIL &&
+	      dhd_conn_event == WLC_E_PRUNE)) {
+		dhd_conn_event = event;
+		dhd_conn_status = status;
+		dhd_conn_reason = reason;
+	}
+}
+
+bool
+dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec)
+{
+	void *p;
+	int eprec = -1;		/* precedence to evict from */
+	bool discard_oldest;
+
+	/* Fast case, precedence queue is not full and we are also not
+	 * exceeding total queue length
+	 */
+	if (!pktq_pfull(q, prec) && !pktq_full(q)) {
+		pktq_penq(q, prec, pkt);
+		return TRUE;
+	}
+
+	/* Determine precedence from which to evict packet, if any */
+	if (pktq_pfull(q, prec))
+		eprec = prec;
+	else if (pktq_full(q)) {
+		p = pktq_peek_tail(q, &eprec);
+		ASSERT(p);
+		if (eprec > prec || eprec < 0)
+			return FALSE;
+	}
+
+	/* Evict if needed */
+	if (eprec >= 0) {
+		/* Detect queueing to unconfigured precedence */
+		ASSERT(!pktq_pempty(q, eprec));
+		discard_oldest = AC_BITMAP_TST(dhdp->wme_dp, eprec);
+		if (eprec == prec && !discard_oldest)
+			return FALSE;		/* refuse newer (incoming) packet */
+		/* Evict packet according to discard policy */
+		p = discard_oldest ? pktq_pdeq(q, eprec) : pktq_pdeq_tail(q, eprec);
+		ASSERT(p);
+#ifdef DHDTCPACK_SUPPRESS
+		if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+			DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+				__FUNCTION__, __LINE__));
+			dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+		}
+#endif /* DHDTCPACK_SUPPRESS */
+		PKTFREE(dhdp->osh, p, TRUE);
+	}
+
+	/* Enqueue */
+	p = pktq_penq(q, prec, pkt);
+	ASSERT(p);
+
+	return TRUE;
+}
+
+/*
+ * Functions to drop proper pkts from queue:
+ *	If one pkt in queue is non-fragmented, drop first non-fragmented pkt only
+ *	If all pkts in queue are all fragmented, find and drop one whole set fragmented pkts
+ *	If can't find pkts matching upper 2 cases, drop first pkt anyway
+ */
+bool
+dhd_prec_drop_pkts(dhd_pub_t *dhdp, struct pktq *pq, int prec, f_droppkt_t fn)
+{
+	struct pktq_prec *q = NULL;
+	void *p, *prev = NULL, *next = NULL, *first = NULL, *last = NULL, *prev_first = NULL;
+	pkt_frag_t frag_info;
+
+	ASSERT(dhdp && pq);
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+	p = q->head;
+
+	if (p == NULL)
+		return FALSE;
+
+	while (p) {
+		frag_info = pkt_frag_info(dhdp->osh, p);
+		if (frag_info == DHD_PKT_FRAG_NONE) {
+			break;
+		} else if (frag_info == DHD_PKT_FRAG_FIRST) {
+			if (first) {
+				/* No last frag pkt, use prev as last */
+				last = prev;
+				break;
+			} else {
+				first = p;
+				prev_first = prev;
+			}
+		} else if (frag_info == DHD_PKT_FRAG_LAST) {
+			if (first) {
+				last = p;
+				break;
+			}
+		}
+
+		prev = p;
+		p = PKTLINK(p);
+	}
+
+	if ((p == NULL) || ((frag_info != DHD_PKT_FRAG_NONE) && !(first && last))) {
+		/* Not found matching pkts, use oldest */
+		prev = NULL;
+		p = q->head;
+		frag_info = 0;
+	}
+
+	if (frag_info == DHD_PKT_FRAG_NONE) {
+		first = last = p;
+		prev_first = prev;
+	}
+
+	p = first;
+	while (p) {
+		next = PKTLINK(p);
+		q->len--;
+		pq->len--;
+
+		PKTSETLINK(p, NULL);
+
+		if (fn)
+			fn(dhdp, prec, p, TRUE);
+
+		if (p == last)
+			break;
+
+		p = next;
+	}
+
+	if (prev_first == NULL) {
+		if ((q->head = next) == NULL)
+			q->tail = NULL;
+	} else {
+		PKTSETLINK(prev_first, next);
+		if (!next)
+			q->tail = prev_first;
+	}
+
+	return TRUE;
+}
+
+static int
+dhd_iovar_op(dhd_pub_t *dhd_pub, const char *name,
+	void *params, int plen, void *arg, int len, bool set)
+{
+	int bcmerror = 0;
+	int val_size;
+	const bcm_iovar_t *vi = NULL;
+	uint32 actionid;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(name);
+	ASSERT(len >= 0);
+
+	/* Get MUST have return space */
+	ASSERT(set || (arg && len));
+
+	/* Set does NOT take qualifiers */
+	ASSERT(!set || (!params && !plen));
+
+	if ((vi = bcm_iovar_lookup(dhd_iovars, name)) == NULL) {
+		bcmerror = BCME_UNSUPPORTED;
+		goto exit;
+	}
+
+	DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+		name, (set ? "set" : "get"), len, plen));
+
+	/* set up 'params' pointer in case this is a set command so that
+	 * the convenience int and bool code can be common to set and get
+	 */
+	if (params == NULL) {
+		params = arg;
+		plen = len;
+	}
+
+	if (vi->type == IOVT_VOID)
+		val_size = 0;
+	else if (vi->type == IOVT_BUFFER)
+		val_size = len;
+	else
+		/* all other types are integer sized */
+		val_size = sizeof(int);
+
+	actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+
+	bcmerror = dhd_doiovar(dhd_pub, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+	return bcmerror;
+}
+
+int
+dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen)
+{
+	int bcmerror = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (!buf) {
+		return BCME_BADARG;
+	}
+
+	switch (ioc->cmd) {
+	case DHD_GET_MAGIC:
+		if (buflen < sizeof(int))
+			bcmerror = BCME_BUFTOOSHORT;
+		else
+			*(int*)buf = DHD_IOCTL_MAGIC;
+		break;
+
+	case DHD_GET_VERSION:
+		if (buflen < sizeof(int))
+			bcmerror = BCME_BUFTOOSHORT;
+		else
+			*(int*)buf = DHD_IOCTL_VERSION;
+		break;
+
+	case DHD_GET_VAR:
+	case DHD_SET_VAR: {
+		char *arg;
+		uint arglen;
+
+		/* scan past the name to any arguments */
+		for (arg = buf, arglen = buflen; *arg && arglen; arg++, arglen--)
+			;
+
+		if (*arg) {
+			bcmerror = BCME_BUFTOOSHORT;
+			break;
+		}
+
+		/* account for the NUL terminator */
+		arg++, arglen--;
+
+		/* call with the appropriate arguments */
+		if (ioc->cmd == DHD_GET_VAR)
+			bcmerror = dhd_iovar_op(dhd_pub, buf, arg, arglen,
+			buf, buflen, IOV_GET);
+		else
+			bcmerror = dhd_iovar_op(dhd_pub, buf, NULL, 0, arg, arglen, IOV_SET);
+		if (bcmerror != BCME_UNSUPPORTED)
+			break;
+
+		/* not in generic table, try protocol module */
+		if (ioc->cmd == DHD_GET_VAR)
+			bcmerror = dhd_prot_iovar_op(dhd_pub, buf, arg,
+				arglen, buf, buflen, IOV_GET);
+		else
+			bcmerror = dhd_prot_iovar_op(dhd_pub, buf,
+				NULL, 0, arg, arglen, IOV_SET);
+		if (bcmerror != BCME_UNSUPPORTED)
+			break;
+
+		/* if still not found, try bus module */
+		if (ioc->cmd == DHD_GET_VAR) {
+			bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+				arg, arglen, buf, buflen, IOV_GET);
+		} else {
+			bcmerror = dhd_bus_iovar_op(dhd_pub, buf,
+				NULL, 0, arg, arglen, IOV_SET);
+		}
+
+		break;
+	}
+
+	default:
+		bcmerror = BCME_UNSUPPORTED;
+	}
+
+	return bcmerror;
+}
+
+#ifdef SHOW_EVENTS
+#ifdef SHOW_LOGTRACE
+
+#define AVOID_BYTE 64
+#define MAX_NO_OF_ARG 16
+
+static int
+check_event_log_sequence_number(uint32 seq_no)
+{
+	int32 diff;
+	uint32 ret;
+	static uint32 logtrace_seqnum_prev = 0;
+
+	diff = ntoh32(seq_no)-logtrace_seqnum_prev;
+	switch (diff)
+	{
+		case 0:
+			ret = -1; /* duplicate packet . drop */
+			break;
+
+		case 1:
+			ret =0; /* in order */
+			break;
+
+		default:
+			if ((ntoh32(seq_no) == 0) &&
+				(logtrace_seqnum_prev == 0xFFFFFFFF) ) { /* in-order - Roll over */
+					ret = 0;
+			} else {
+
+				if (diff > 0) {
+					DHD_EVENT(("WLC_E_TRACE:"
+						"Event lost (log) seqnum %d nblost %d\n",
+						ntoh32(seq_no), (diff-1)));
+				} else {
+					DHD_EVENT(("WLC_E_TRACE:"
+						"Event Packets coming out of order!!\n"));
+				}
+				ret = 0;
+			}
+	}
+
+	logtrace_seqnum_prev = ntoh32(seq_no);
+
+	return ret;
+}
+#endif /* SHOW_LOGTRACE */
+
+static void
+wl_show_host_event(dhd_pub_t *dhd_pub, wl_event_msg_t *event, void *event_data,
+	void *raw_event_ptr, char *eventmask)
+{
+	uint i, status, reason;
+	bool group = FALSE, flush_txq = FALSE, link = FALSE;
+	const char *auth_str;
+	const char *event_name;
+	uchar *buf;
+	char err_msg[256], eabuf[ETHER_ADDR_STR_LEN];
+	uint event_type, flags, auth_type, datalen;
+
+	event_type = ntoh32(event->event_type);
+	flags = ntoh16(event->flags);
+	status = ntoh32(event->status);
+	reason = ntoh32(event->reason);
+	BCM_REFERENCE(reason);
+	auth_type = ntoh32(event->auth_type);
+	datalen = ntoh32(event->datalen);
+
+	/* debug dump of event messages */
+	snprintf(eabuf, sizeof(eabuf), "%02x:%02x:%02x:%02x:%02x:%02x",
+	        (uchar)event->addr.octet[0]&0xff,
+	        (uchar)event->addr.octet[1]&0xff,
+	        (uchar)event->addr.octet[2]&0xff,
+	        (uchar)event->addr.octet[3]&0xff,
+	        (uchar)event->addr.octet[4]&0xff,
+	        (uchar)event->addr.octet[5]&0xff);
+
+	event_name = bcmevent_get_name(event_type);
+	BCM_REFERENCE(event_name);
+
+	if (flags & WLC_EVENT_MSG_LINK)
+		link = TRUE;
+	if (flags & WLC_EVENT_MSG_GROUP)
+		group = TRUE;
+	if (flags & WLC_EVENT_MSG_FLUSHTXQ)
+		flush_txq = TRUE;
+
+	switch (event_type) {
+	case WLC_E_START:
+	case WLC_E_DEAUTH:
+	case WLC_E_DISASSOC:
+		DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+		break;
+
+	case WLC_E_ASSOC_IND:
+	case WLC_E_REASSOC_IND:
+
+		DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+		break;
+
+	case WLC_E_ASSOC:
+	case WLC_E_REASSOC:
+		if (status == WLC_E_STATUS_SUCCESS) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, SUCCESS\n", event_name, eabuf));
+		} else if (status == WLC_E_STATUS_TIMEOUT) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, TIMEOUT\n", event_name, eabuf));
+		} else if (status == WLC_E_STATUS_FAIL) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, FAILURE, reason %d\n",
+			       event_name, eabuf, (int)reason));
+		} else {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, unexpected status %d\n",
+			       event_name, eabuf, (int)status));
+		}
+		break;
+
+	case WLC_E_DEAUTH_IND:
+	case WLC_E_DISASSOC_IND:
+		DHD_EVENT(("MACEVENT: %s, MAC %s, reason %d\n", event_name, eabuf, (int)reason));
+		break;
+
+	case WLC_E_AUTH:
+	case WLC_E_AUTH_IND:
+		if (auth_type == DOT11_OPEN_SYSTEM)
+			auth_str = "Open System";
+		else if (auth_type == DOT11_SHARED_KEY)
+			auth_str = "Shared Key";
+		else {
+			snprintf(err_msg, sizeof(err_msg), "AUTH unknown: %d", (int)auth_type);
+			auth_str = err_msg;
+		}
+		if (event_type == WLC_E_AUTH_IND) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, %s\n", event_name, eabuf, auth_str));
+		} else if (status == WLC_E_STATUS_SUCCESS) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, %s, SUCCESS\n",
+				event_name, eabuf, auth_str));
+		} else if (status == WLC_E_STATUS_TIMEOUT) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, %s, TIMEOUT\n",
+				event_name, eabuf, auth_str));
+		} else if (status == WLC_E_STATUS_FAIL) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s, %s, FAILURE, reason %d\n",
+			       event_name, eabuf, auth_str, (int)reason));
+		}
+		BCM_REFERENCE(auth_str);
+
+		break;
+
+	case WLC_E_JOIN:
+	case WLC_E_ROAM:
+	case WLC_E_SET_SSID:
+		if (status == WLC_E_STATUS_SUCCESS) {
+			DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+		} else if (status == WLC_E_STATUS_FAIL) {
+			DHD_EVENT(("MACEVENT: %s, failed\n", event_name));
+		} else if (status == WLC_E_STATUS_NO_NETWORKS) {
+			DHD_EVENT(("MACEVENT: %s, no networks found\n", event_name));
+		} else {
+			DHD_EVENT(("MACEVENT: %s, unexpected status %d\n",
+				event_name, (int)status));
+		}
+		break;
+
+	case WLC_E_BEACON_RX:
+		if (status == WLC_E_STATUS_SUCCESS) {
+			DHD_EVENT(("MACEVENT: %s, SUCCESS\n", event_name));
+		} else if (status == WLC_E_STATUS_FAIL) {
+			DHD_EVENT(("MACEVENT: %s, FAIL\n", event_name));
+		} else {
+			DHD_EVENT(("MACEVENT: %s, status %d\n", event_name, status));
+		}
+		break;
+
+	case WLC_E_LINK:
+		DHD_EVENT(("MACEVENT: %s %s\n", event_name, link?"UP":"DOWN"));
+		BCM_REFERENCE(link);
+		break;
+
+	case WLC_E_MIC_ERROR:
+		DHD_EVENT(("MACEVENT: %s, MAC %s, Group %d, Flush %d\n",
+		       event_name, eabuf, group, flush_txq));
+		BCM_REFERENCE(group);
+		BCM_REFERENCE(flush_txq);
+		break;
+
+	case WLC_E_ICV_ERROR:
+	case WLC_E_UNICAST_DECODE_ERROR:
+	case WLC_E_MULTICAST_DECODE_ERROR:
+		DHD_EVENT(("MACEVENT: %s, MAC %s\n",
+		       event_name, eabuf));
+		break;
+
+	case WLC_E_TXFAIL:
+		DHD_EVENT(("MACEVENT: %s, RA %s\n", event_name, eabuf));
+		break;
+
+	case WLC_E_SCAN_COMPLETE:
+	case WLC_E_ASSOC_REQ_IE:
+	case WLC_E_ASSOC_RESP_IE:
+	case WLC_E_PMKID_CACHE:
+		DHD_EVENT(("MACEVENT: %s\n", event_name));
+		break;
+
+	case WLC_E_PFN_NET_FOUND:
+	case WLC_E_PFN_NET_LOST:
+	case WLC_E_PFN_SCAN_COMPLETE:
+	case WLC_E_PFN_SCAN_NONE:
+	case WLC_E_PFN_SCAN_ALLGONE:
+		DHD_EVENT(("PNOEVENT: %s\n", event_name));
+		break;
+
+	case WLC_E_PSK_SUP:
+	case WLC_E_PRUNE:
+		DHD_EVENT(("MACEVENT: %s, status %d, reason %d\n",
+		           event_name, (int)status, (int)reason));
+		break;
+
+#ifdef WIFI_ACT_FRAME
+	case WLC_E_ACTION_FRAME:
+		DHD_TRACE(("MACEVENT: %s Bssid %s\n", event_name, eabuf));
+		break;
+#endif /* WIFI_ACT_FRAME */
+
+#ifdef SHOW_LOGTRACE
+	case WLC_E_TRACE:
+	{
+		msgtrace_hdr_t hdr;
+		uint32 nblost;
+		uint8 count;
+		char *s, *p;
+		static uint32 seqnum_prev = 0;
+		uint32 *record = NULL;
+		uint32 *log_ptr =  NULL;
+		uint32 writeindex = 0;
+		event_log_hdr_t event_hdr;
+		int no_of_fmts = 0;
+		char *fmt = NULL;
+		dhd_event_log_t *raw_event = (dhd_event_log_t *) raw_event_ptr;
+
+		buf = (uchar *) event_data;
+		memcpy(&hdr, buf, MSGTRACE_HDRLEN);
+
+		if (hdr.version != MSGTRACE_VERSION) {
+			DHD_EVENT(("\nMACEVENT: %s [unsupported version --> "
+				"dhd version:%d dongle version:%d]\n",
+				event_name, MSGTRACE_VERSION, hdr.version));
+			/* Reset datalen to avoid display below */
+			datalen = 0;
+			break;
+		}
+
+		if (hdr.trace_type == MSGTRACE_HDR_TYPE_MSG) {
+			/* There are 2 bytes available at the end of data */
+			buf[MSGTRACE_HDRLEN + ntoh16(hdr.len)] = '\0';
+
+			if (ntoh32(hdr.discarded_bytes) || ntoh32(hdr.discarded_printf)) {
+				DHD_EVENT(("WLC_E_TRACE: [Discarded traces in dongle -->"
+					"discarded_bytes %d discarded_printf %d]\n",
+					ntoh32(hdr.discarded_bytes),
+					ntoh32(hdr.discarded_printf)));
+			}
+
+			nblost = ntoh32(hdr.seqnum) - seqnum_prev - 1;
+			if (nblost > 0) {
+				DHD_EVENT(("WLC_E_TRACE:"
+					"[Event lost (msg) --> seqnum %d nblost %d\n",
+					ntoh32(hdr.seqnum), nblost));
+			}
+			seqnum_prev = ntoh32(hdr.seqnum);
+
+			/* Display the trace buffer. Advance from
+			 * \n to \n to avoid display big
+			 * printf (issue with Linux printk )
+			 */
+			p = (char *)&buf[MSGTRACE_HDRLEN];
+			while (*p != '\0' && (s = strstr(p, "\n")) != NULL) {
+				*s = '\0';
+				DHD_EVENT(("%s\n", p));
+				p = s+1;
+			}
+			if (*p)
+				DHD_EVENT(("%s", p));
+
+			/* Reset datalen to avoid display below */
+			datalen = 0;
+
+		} else if (hdr.trace_type == MSGTRACE_HDR_TYPE_LOG) {
+			/* Let the standard event printing work for now */
+			uint32 timestamp, w, malloc_len;
+
+			if (check_event_log_sequence_number(hdr.seqnum)) {
+
+				DHD_EVENT(("%s: WLC_E_TRACE:"
+					"[Event duplicate (log) %d] dropping!!\n",
+					__FUNCTION__, hdr.seqnum));
+				return; /* drop duplicate events */
+			}
+
+			p = (char *)&buf[MSGTRACE_HDRLEN];
+			datalen -= MSGTRACE_HDRLEN;
+			w = ntoh32((uint32)*p);
+			p += 4;
+			datalen -= 4;
+			timestamp = ntoh32((uint32)*p);
+			BCM_REFERENCE(timestamp);
+			BCM_REFERENCE(w);
+
+			DHD_EVENT(("timestamp %x%x\n", timestamp, w));
+
+			if (raw_event->fmts) {
+				malloc_len = datalen+ AVOID_BYTE;
+				record = (uint32 *)MALLOC(dhd_pub->osh, malloc_len);
+				if (record == NULL) {
+					DHD_EVENT(("MSGTRACE_HDR_TYPE_LOG:"
+						"malloc failed\n"));
+					return;
+				}
+				log_ptr = (uint32 *) (p + datalen);
+				writeindex = datalen/4;
+
+				if (record) {
+					while (datalen > 4) {
+						log_ptr--;
+						datalen -= 4;
+						event_hdr.t = *log_ptr;
+						/*
+						 * Check for partially overriten entries
+						 */
+						if (log_ptr - (uint32 *) p < event_hdr.count) {
+								break;
+						}
+						/*
+						* Check for end of the Frame.
+						*/
+						if (event_hdr.tag ==  EVENT_LOG_TAG_NULL) {
+							continue;
+						}
+						/*
+						* Check For Special Time Stamp Packet
+						*/
+						if (event_hdr.tag == EVENT_LOG_TAG_TS) {
+							datalen -= 12;
+							log_ptr = log_ptr - 3;
+							continue;
+						}
+
+						log_ptr[0] = event_hdr.t;
+						if (event_hdr.count > MAX_NO_OF_ARG) {
+							break;
+						}
+						/* Now place the header at the front
+						* and copy back.
+						*/
+						log_ptr -= event_hdr.count;
+
+						writeindex = writeindex - event_hdr.count;
+						record[writeindex++] = event_hdr.t;
+						for (count = 0; count < (event_hdr.count-1);
+							count++) {
+							record[writeindex++] = log_ptr[count];
+						}
+						writeindex = writeindex - event_hdr.count;
+						datalen = datalen - (event_hdr.count * 4);
+						no_of_fmts++;
+					}
+				}
+
+				while (no_of_fmts--)
+				{
+					event_log_hdr_t event_hdr;
+					event_hdr.t = record[writeindex];
+
+					if ((event_hdr.fmt_num>>2) < raw_event->num_fmts) {
+						fmt = raw_event->fmts[event_hdr.fmt_num>>2];
+						DHD_EVENT((fmt,
+							record[writeindex + 1],
+							record[writeindex + 2],
+							record[writeindex + 3],
+							record[writeindex + 4],
+							record[writeindex + 5],
+							record[writeindex + 6],
+							record[writeindex + 7],
+							record[writeindex + 8],
+							record[writeindex + 9],
+							record[writeindex + 10],
+							record[writeindex + 11],
+							record[writeindex + 12],
+							record[writeindex + 13],
+							record[writeindex + 14],
+							record[writeindex + 15],
+							record[writeindex + 16]));
+
+						if (fmt[strlen(fmt) - 1] != '\n') {
+							/* Add newline if missing */
+							DHD_EVENT(("\n"));
+						}
+					}
+
+					writeindex = writeindex + event_hdr.count;
+				}
+
+				if (record) {
+					MFREE(dhd_pub->osh, record, malloc_len);
+					record = NULL;
+				}
+			} else {
+				while (datalen > 4) {
+					p += 4;
+					datalen -= 4;
+					/* Print each word.  DO NOT ntoh it.  */
+					DHD_EVENT((" %8.8x", *((uint32 *) p)));
+				}
+				DHD_EVENT(("\n"));
+			}
+			datalen = 0;
+		}
+		break;
+	}
+#endif /* SHOW_LOGTRACE */
+
+	case WLC_E_RSSI:
+		DHD_EVENT(("MACEVENT: %s %d\n", event_name, ntoh32(*((int *)event_data))));
+		break;
+
+	case WLC_E_SERVICE_FOUND:
+	case WLC_E_P2PO_ADD_DEVICE:
+	case WLC_E_P2PO_DEL_DEVICE:
+		DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+		break;
+
+#ifdef BT_WIFI_HANDOBER
+	case WLC_E_BT_WIFI_HANDOVER_REQ:
+		DHD_EVENT(("MACEVENT: %s, MAC %s\n", event_name, eabuf));
+		break;
+#endif
+
+	default:
+		DHD_EVENT(("MACEVENT: %s %d, MAC %s, status %d, reason %d, auth %d\n",
+		       event_name, event_type, eabuf, (int)status, (int)reason,
+		       (int)auth_type));
+		break;
+	}
+
+	/* show any appended data */
+	if (DHD_BYTES_ON() && DHD_EVENT_ON() && datalen) {
+		buf = (uchar *) event_data;
+		BCM_REFERENCE(buf);
+		DHD_EVENT((" data (%d) : ", datalen));
+		for (i = 0; i < datalen; i++)
+			DHD_EVENT((" 0x%02x ", *buf++));
+		DHD_EVENT(("\n"));
+	}
+}
+#endif /* SHOW_EVENTS */
+
+int
+wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
+	wl_event_msg_t *event, void **data_ptr, void *raw_event)
+{
+	/* check whether packet is a BRCM event pkt */
+	bcm_event_t *pvt_data = (bcm_event_t *)pktdata;
+	uint8 *event_data;
+	uint32 type, status, datalen;
+	uint16 flags;
+	int evlen;
+	int hostidx;
+
+	if (bcmp(BRCM_OUI, &pvt_data->bcm_hdr.oui[0], DOT11_OUI_LEN)) {
+		DHD_ERROR(("%s: mismatched OUI, bailing\n", __FUNCTION__));
+		return (BCME_ERROR);
+	}
+
+	/* BRCM event pkt may be unaligned - use xxx_ua to load user_subtype. */
+	if (ntoh16_ua((void *)&pvt_data->bcm_hdr.usr_subtype) != BCMILCP_BCM_SUBTYPE_EVENT) {
+		DHD_ERROR(("%s: mismatched subtype, bailing\n", __FUNCTION__));
+		return (BCME_ERROR);
+	}
+
+	*data_ptr = &pvt_data[1];
+	event_data = *data_ptr;
+
+
+	/* memcpy since BRCM event pkt may be unaligned. */
+	memcpy(event, &pvt_data->event, sizeof(wl_event_msg_t));
+
+	type = ntoh32_ua((void *)&event->event_type);
+	flags = ntoh16_ua((void *)&event->flags);
+	status = ntoh32_ua((void *)&event->status);
+	datalen = ntoh32_ua((void *)&event->datalen);
+	evlen = datalen + sizeof(bcm_event_t);
+
+	/* find equivalent host index for event ifidx */
+	hostidx = dhd_ifidx2hostidx(dhd_pub->info, event->ifidx);
+
+	switch (type) {
+#ifdef PROP_TXSTATUS
+	case WLC_E_FIFO_CREDIT_MAP:
+		dhd_wlfc_enable(dhd_pub);
+		dhd_wlfc_FIFOcreditmap_event(dhd_pub, event_data);
+		WLFC_DBGMESG(("WLC_E_FIFO_CREDIT_MAP:(AC0,AC1,AC2,AC3),(BC_MC),(OTHER): "
+			"(%d,%d,%d,%d),(%d),(%d)\n", event_data[0], event_data[1],
+			event_data[2],
+			event_data[3], event_data[4], event_data[5]));
+		break;
+
+	case WLC_E_BCMC_CREDIT_SUPPORT:
+		dhd_wlfc_BCMCCredit_support_event(dhd_pub);
+		break;
+#endif
+
+	case WLC_E_IF:
+		{
+		struct wl_event_data_if *ifevent = (struct wl_event_data_if *)event_data;
+
+		/* Ignore the event if NOIF is set */
+		if (ifevent->reserved & WLC_E_IF_FLAGS_BSSCFG_NOIF) {
+			DHD_ERROR(("WLC_E_IF: NO_IF set, event Ignored\r\n"));
+			return (BCME_UNSUPPORTED);
+		}
+#ifdef PCIE_FULL_DONGLE
+		dhd_update_interface_flow_info(dhd_pub, ifevent->ifidx,
+			ifevent->opcode, ifevent->role);
+#endif
+#ifdef PROP_TXSTATUS
+		{
+			uint8* ea = pvt_data->eth.ether_dhost;
+			WLFC_DBGMESG(("WLC_E_IF: idx:%d, action:%s, iftype:%s, "
+			              "[%02x:%02x:%02x:%02x:%02x:%02x]\n",
+			              ifevent->ifidx,
+			              ((ifevent->opcode == WLC_E_IF_ADD) ? "ADD":"DEL"),
+			              ((ifevent->role == 0) ? "STA":"AP "),
+			              ea[0], ea[1], ea[2], ea[3], ea[4], ea[5]));
+			(void)ea;
+
+			if (ifevent->opcode == WLC_E_IF_CHANGE)
+				dhd_wlfc_interface_event(dhd_pub,
+					eWLFC_MAC_ENTRY_ACTION_UPDATE,
+					ifevent->ifidx, ifevent->role, ea);
+			else
+				dhd_wlfc_interface_event(dhd_pub,
+					((ifevent->opcode == WLC_E_IF_ADD) ?
+					eWLFC_MAC_ENTRY_ACTION_ADD : eWLFC_MAC_ENTRY_ACTION_DEL),
+					ifevent->ifidx, ifevent->role, ea);
+
+			/* dhd already has created an interface by default, for 0 */
+			if (ifevent->ifidx == 0)
+				break;
+		}
+#endif /* PROP_TXSTATUS */
+
+		if (ifevent->ifidx > 0 && ifevent->ifidx < DHD_MAX_IFS) {
+			if (ifevent->opcode == WLC_E_IF_ADD) {
+				if (dhd_event_ifadd(dhd_pub->info, ifevent, event->ifname,
+					event->addr.octet)) {
+
+					DHD_ERROR(("%s: dhd_event_ifadd failed ifidx: %d  %s\n",
+						__FUNCTION__, ifevent->ifidx, event->ifname));
+					return (BCME_ERROR);
+				}
+			} else if (ifevent->opcode == WLC_E_IF_DEL) {
+				dhd_event_ifdel(dhd_pub->info, ifevent, event->ifname,
+					event->addr.octet);
+			} else if (ifevent->opcode == WLC_E_IF_CHANGE) {
+#ifdef WL_CFG80211
+				wl_cfg80211_notify_ifchange(ifevent->ifidx,
+					event->ifname, event->addr.octet, ifevent->bssidx);
+#endif /* WL_CFG80211 */
+			}
+		} else {
+#if !defined(PROP_TXSTATUS) || !defined(PCIE_FULL_DONGLE)
+			DHD_ERROR(("%s: Invalid ifidx %d for %s\n",
+			           __FUNCTION__, ifevent->ifidx, event->ifname));
+#endif /* !PROP_TXSTATUS */
+		}
+			/* send up the if event: btamp user needs it */
+			*ifidx = hostidx;
+			/* push up to external supp/auth */
+			dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+		break;
+	}
+
+#ifdef WLMEDIA_HTSF
+	case WLC_E_HTSFSYNC:
+		htsf_update(dhd_pub->info, event_data);
+		break;
+#endif /* WLMEDIA_HTSF */
+#if defined(NDISVER) && (NDISVER >= 0x0630)
+	case WLC_E_NDIS_LINK:
+		break;
+#else
+	case WLC_E_NDIS_LINK: {
+		uint32 temp = hton32(WLC_E_LINK);
+
+		memcpy((void *)(&pvt_data->event.event_type), &temp,
+		       sizeof(pvt_data->event.event_type));
+		break;
+	}
+#endif /* NDISVER >= 0x0630 */
+	case WLC_E_PFN_NET_FOUND:
+	case WLC_E_PFN_NET_LOST:
+		break;
+#if defined(PNO_SUPPORT)
+	case WLC_E_PFN_BSSID_NET_FOUND:
+	case WLC_E_PFN_BSSID_NET_LOST:
+	case WLC_E_PFN_BEST_BATCHING:
+		dhd_pno_event_handler(dhd_pub, event, (void *)event_data);
+		break;
+#endif
+		/* These are what external supplicant/authenticator wants */
+	case WLC_E_ASSOC_IND:
+	case WLC_E_AUTH_IND:
+	case WLC_E_REASSOC_IND:
+		dhd_findadd_sta(dhd_pub, hostidx, &event->addr.octet);
+		break;
+	case WLC_E_LINK:
+#ifdef PCIE_FULL_DONGLE
+		if (dhd_update_interface_link_status(dhd_pub, (uint8)hostidx,
+			(uint8)flags) != BCME_OK)
+			break;
+		if (!flags) {
+			dhd_flow_rings_delete(dhd_pub, hostidx);
+		}
+		/* fall through */
+#endif
+	case WLC_E_DEAUTH:
+	case WLC_E_DEAUTH_IND:
+	case WLC_E_DISASSOC:
+	case WLC_E_DISASSOC_IND:
+		if (type != WLC_E_LINK) {
+			dhd_del_sta(dhd_pub, hostidx, &event->addr.octet);
+		}
+		DHD_EVENT(("%s: Link event %d, flags %x, status %x\n",
+		           __FUNCTION__, type, flags, status));
+#ifdef PCIE_FULL_DONGLE
+		if (type != WLC_E_LINK) {
+			uint8 ifindex = (uint8)hostidx;
+			uint8 role = dhd_flow_rings_ifindex2role(dhd_pub, ifindex);
+			if (DHD_IF_ROLE_STA(role)) {
+				dhd_flow_rings_delete(dhd_pub, ifindex);
+			} else {
+				dhd_flow_rings_delete_for_peer(dhd_pub, ifindex,
+					&event->addr.octet[0]);
+			}
+		}
+#endif
+		/* fall through */
+	default:
+		*ifidx = hostidx;
+		/* push up to external supp/auth */
+		dhd_event(dhd_pub->info, (char *)pvt_data, evlen, *ifidx);
+		DHD_TRACE(("%s: MAC event %d, flags %x, status %x\n",
+		           __FUNCTION__, type, flags, status));
+		BCM_REFERENCE(flags);
+		BCM_REFERENCE(status);
+
+		break;
+	}
+
+#ifdef SHOW_EVENTS
+	wl_show_host_event(dhd_pub, event,
+		(void *)event_data, raw_event, dhd_pub->enable_log);
+#endif /* SHOW_EVENTS */
+
+	return (BCME_OK);
+}
+
+void
+wl_event_to_host_order(wl_event_msg_t * evt)
+{
+	/* Event struct members passed from dongle to host are stored in network
+	 * byte order. Convert all members to host-order.
+	 */
+	evt->event_type = ntoh32(evt->event_type);
+	evt->flags = ntoh16(evt->flags);
+	evt->status = ntoh32(evt->status);
+	evt->reason = ntoh32(evt->reason);
+	evt->auth_type = ntoh32(evt->auth_type);
+	evt->datalen = ntoh32(evt->datalen);
+	evt->version = ntoh16(evt->version);
+}
+
+void
+dhd_print_buf(void *pbuf, int len, int bytes_per_line)
+{
+#ifdef DHD_DEBUG
+	int i, j = 0;
+	unsigned char *buf = pbuf;
+
+	if (bytes_per_line == 0) {
+		bytes_per_line = len;
+	}
+
+	for (i = 0; i < len; i++) {
+		printf("%2.2x", *buf++);
+		j++;
+		if (j == bytes_per_line) {
+			printf("\n");
+			j = 0;
+		} else {
+			printf(":");
+		}
+	}
+	printf("\n");
+#endif /* DHD_DEBUG */
+}
+#ifndef strtoul
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+#endif
+
+#ifdef PKT_FILTER_SUPPORT
+/* Convert user's input in hex pattern to byte-size mask */
+static int
+wl_pattern_atoh(char *src, char *dst)
+{
+	int i;
+	if (strncmp(src, "0x", 2) != 0 &&
+	    strncmp(src, "0X", 2) != 0) {
+		DHD_ERROR(("Mask invalid format. Needs to start with 0x\n"));
+		return -1;
+	}
+	src = src + 2; /* Skip past 0x */
+	if (strlen(src) % 2 != 0) {
+		DHD_ERROR(("Mask invalid format. Needs to be of even length\n"));
+		return -1;
+	}
+	for (i = 0; *src != '\0'; i++) {
+		char num[3];
+		bcm_strncpy_s(num, sizeof(num), src, 2);
+		num[2] = '\0';
+		dst[i] = (uint8)strtoul(num, NULL, 16);
+		src += 2;
+	}
+	return i;
+}
+
+void
+dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode)
+{
+	char				*argv[8];
+	int					i = 0;
+	const char			*str;
+	int					buf_len;
+	int					str_len;
+	char				*arg_save = 0, *arg_org = 0;
+	int					rc;
+	char				buf[32] = {0};
+	wl_pkt_filter_enable_t	enable_parm;
+	wl_pkt_filter_enable_t	* pkt_filterp;
+
+	if (!arg)
+		return;
+
+	if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+		DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+		goto fail;
+	}
+	arg_org = arg_save;
+	memcpy(arg_save, arg, strlen(arg) + 1);
+
+	argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+	i = 0;
+	if (argv[i] == NULL) {
+		DHD_ERROR(("No args provided\n"));
+		goto fail;
+	}
+
+	str = "pkt_filter_enable";
+	str_len = strlen(str);
+	bcm_strncpy_s(buf, sizeof(buf) - 1, str, sizeof(buf) - 1);
+	buf[ sizeof(buf) - 1 ] = '\0';
+	buf_len = str_len + 1;
+
+	pkt_filterp = (wl_pkt_filter_enable_t *)(buf + str_len + 1);
+
+	/* Parse packet filter id. */
+	enable_parm.id = htod32(strtoul(argv[i], NULL, 0));
+	if (dhd_conf_del_pkt_filter(dhd, enable_parm.id))
+		goto fail;
+
+	/* Parse enable/disable value. */
+	enable_parm.enable = htod32(enable);
+
+	buf_len += sizeof(enable_parm);
+	memcpy((char *)pkt_filterp,
+	       &enable_parm,
+	       sizeof(enable_parm));
+
+	/* Enable/disable the specified filter. */
+	rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+	rc = rc >= 0 ? 0 : rc;
+	if (rc)
+		DHD_ERROR(("%s: failed to %s pktfilter %s, retcode = %d\n",
+		__FUNCTION__, enable?"enable":"disable", arg, rc));
+	else
+		DHD_TRACE(("%s: successfully %s pktfilter %s\n",
+		__FUNCTION__, enable?"enable":"disable", arg));
+
+	/* Contorl the master mode */
+	bcm_mkiovar("pkt_filter_mode", (char *)&master_mode, 4, buf, sizeof(buf));
+	rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+	rc = rc >= 0 ? 0 : rc;
+	if (rc)
+		DHD_TRACE(("%s: failed to set pkt_filter_mode %d, retcode = %d\n",
+		__FUNCTION__, master_mode, rc));
+
+fail:
+	if (arg_org)
+		MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+}
+
+void
+dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg)
+{
+	const char 			*str;
+	wl_pkt_filter_t		pkt_filter;
+	wl_pkt_filter_t		*pkt_filterp;
+	int					buf_len;
+	int					str_len;
+	int 				rc;
+	uint32				mask_size;
+	uint32				pattern_size;
+	char				*argv[8], * buf = 0;
+	int					i = 0;
+	char				*arg_save = 0, *arg_org = 0;
+#define BUF_SIZE		2048
+
+	if (!arg)
+		return;
+
+	if (!(arg_save = MALLOC(dhd->osh, strlen(arg) + 1))) {
+		DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	arg_org = arg_save;
+
+	if (!(buf = MALLOC(dhd->osh, BUF_SIZE))) {
+		DHD_ERROR(("%s: malloc failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	memcpy(arg_save, arg, strlen(arg) + 1);
+
+	if (strlen(arg) > BUF_SIZE) {
+		DHD_ERROR(("Not enough buffer %d < %d\n", (int)strlen(arg), (int)sizeof(buf)));
+		goto fail;
+	}
+
+	argv[i] = bcmstrtok(&arg_save, " ", 0);
+	while (argv[i++])
+		argv[i] = bcmstrtok(&arg_save, " ", 0);
+
+	i = 0;
+	if (argv[i] == NULL) {
+		DHD_ERROR(("No args provided\n"));
+		goto fail;
+	}
+
+	str = "pkt_filter_add";
+	str_len = strlen(str);
+	bcm_strncpy_s(buf, BUF_SIZE, str, str_len);
+	buf[ str_len ] = '\0';
+	buf_len = str_len + 1;
+
+	pkt_filterp = (wl_pkt_filter_t *) (buf + str_len + 1);
+
+	/* Parse packet filter id. */
+	pkt_filter.id = htod32(strtoul(argv[i], NULL, 0));
+	if (dhd_conf_del_pkt_filter(dhd, pkt_filter.id))
+		goto fail;
+
+	if (argv[++i] == NULL) {
+		DHD_ERROR(("Polarity not provided\n"));
+		goto fail;
+	}
+
+	/* Parse filter polarity. */
+	pkt_filter.negate_match = htod32(strtoul(argv[i], NULL, 0));
+
+	if (argv[++i] == NULL) {
+		DHD_ERROR(("Filter type not provided\n"));
+		goto fail;
+	}
+
+	/* Parse filter type. */
+	pkt_filter.type = htod32(strtoul(argv[i], NULL, 0));
+
+	if (argv[++i] == NULL) {
+		DHD_ERROR(("Offset not provided\n"));
+		goto fail;
+	}
+
+	/* Parse pattern filter offset. */
+	pkt_filter.u.pattern.offset = htod32(strtoul(argv[i], NULL, 0));
+
+	if (argv[++i] == NULL) {
+		DHD_ERROR(("Bitmask not provided\n"));
+		goto fail;
+	}
+
+	/* Parse pattern filter mask. */
+	mask_size =
+		htod32(wl_pattern_atoh(argv[i], (char *) pkt_filterp->u.pattern.mask_and_pattern));
+
+	if (argv[++i] == NULL) {
+		DHD_ERROR(("Pattern not provided\n"));
+		goto fail;
+	}
+
+	/* Parse pattern filter pattern. */
+	pattern_size =
+		htod32(wl_pattern_atoh(argv[i],
+	         (char *) &pkt_filterp->u.pattern.mask_and_pattern[mask_size]));
+
+	if (mask_size != pattern_size) {
+		DHD_ERROR(("Mask and pattern not the same size\n"));
+		goto fail;
+	}
+
+	pkt_filter.u.pattern.size_bytes = mask_size;
+	buf_len += WL_PKT_FILTER_FIXED_LEN;
+	buf_len += (WL_PKT_FILTER_PATTERN_FIXED_LEN + 2 * mask_size);
+
+	/* Keep-alive attributes are set in local	variable (keep_alive_pkt), and
+	** then memcpy'ed into buffer (keep_alive_pktp) since there is no
+	** guarantee that the buffer is properly aligned.
+	*/
+	memcpy((char *)pkt_filterp,
+	       &pkt_filter,
+	       WL_PKT_FILTER_FIXED_LEN + WL_PKT_FILTER_PATTERN_FIXED_LEN);
+
+	rc = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+	rc = rc >= 0 ? 0 : rc;
+
+	if (rc)
+		DHD_ERROR(("%s: failed to add pktfilter %s, retcode = %d\n",
+		__FUNCTION__, arg, rc));
+	else
+		DHD_TRACE(("%s: successfully added pktfilter %s\n",
+		__FUNCTION__, arg));
+
+fail:
+	if (arg_org)
+		MFREE(dhd->osh, arg_org, strlen(arg) + 1);
+
+	if (buf)
+		MFREE(dhd->osh, buf, BUF_SIZE);
+}
+
+void dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id)
+{
+	char iovbuf[32];
+	int ret;
+
+	bcm_mkiovar("pkt_filter_delete", (char *)&id, 4, iovbuf, sizeof(iovbuf));
+	ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+	if (ret < 0) {
+		DHD_ERROR(("%s: Failed to delete filter ID:%d, ret=%d\n",
+			__FUNCTION__, id, ret));
+	}
+	else
+		DHD_TRACE(("%s: successfully deleted pktfilter %d\n",
+		__FUNCTION__, id));
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+/* ========================== */
+/* ==== ARP OFFLOAD SUPPORT = */
+/* ========================== */
+#ifdef ARP_OFFLOAD_SUPPORT
+void
+dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode)
+{
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+	int iovar_len;
+	int retcode;
+
+	iovar_len = bcm_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+	if (!iovar_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return;
+	}
+
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iovar_len, TRUE, 0);
+	retcode = retcode >= 0 ? 0 : retcode;
+	if (retcode)
+		DHD_ERROR(("%s: failed to set ARP offload mode to 0x%x, retcode = %d\n",
+			__FUNCTION__, arp_mode, retcode));
+	else
+		DHD_ARPOE(("%s: successfully set ARP offload mode to 0x%x\n",
+			__FUNCTION__, arp_mode));
+}
+
+void
+dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable)
+{
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+	int iovar_len;
+	int retcode;
+
+	iovar_len = bcm_mkiovar("arpoe", (char *)&arp_enable, 4, iovbuf, sizeof(iovbuf));
+	if (!iovar_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return;
+	}
+
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iovar_len, TRUE, 0);
+	retcode = retcode >= 0 ? 0 : retcode;
+	if (retcode)
+		DHD_ERROR(("%s: failed to enabe ARP offload to %d, retcode = %d\n",
+			__FUNCTION__, arp_enable, retcode));
+	else
+		DHD_ARPOE(("%s: successfully enabed ARP offload to %d\n",
+			__FUNCTION__, arp_enable));
+	if (arp_enable) {
+		uint32 version;
+		bcm_mkiovar("arp_version", 0, 0, iovbuf, sizeof(iovbuf));
+		retcode = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+		if (retcode) {
+			DHD_INFO(("%s: fail to get version (maybe version 1:retcode = %d\n",
+				__FUNCTION__, retcode));
+			dhd->arp_version = 1;
+		}
+		else {
+			memcpy(&version, iovbuf, sizeof(version));
+			DHD_INFO(("%s: ARP Version= %x\n", __FUNCTION__, version));
+			dhd->arp_version = version;
+		}
+	}
+}
+
+void
+dhd_aoe_arp_clr(dhd_pub_t *dhd, int idx)
+{
+	int ret = 0;
+	int iov_len = 0;
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+
+	if (dhd == NULL) return;
+	if (dhd->arp_version == 1)
+		idx = 0;
+
+	iov_len = bcm_mkiovar("arp_table_clear", 0, 0, iovbuf, sizeof(iovbuf));
+	if (!iov_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return;
+	}
+	if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx)) < 0)
+		DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+}
+
+void
+dhd_aoe_hostip_clr(dhd_pub_t *dhd, int idx)
+{
+	int ret = 0;
+	int iov_len = 0;
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+
+	if (dhd == NULL) return;
+	if (dhd->arp_version == 1)
+		idx = 0;
+
+	iov_len = bcm_mkiovar("arp_hostip_clear", 0, 0, iovbuf, sizeof(iovbuf));
+	if (!iov_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return;
+	}
+	if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx)) < 0)
+		DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+}
+
+void
+dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr, int idx)
+{
+	int iov_len = 0;
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+	int retcode;
+
+
+	if (dhd == NULL) return;
+	if (dhd->arp_version == 1)
+		idx = 0;
+	iov_len = bcm_mkiovar("arp_hostip", (char *)&ipaddr,
+		sizeof(ipaddr), iovbuf, sizeof(iovbuf));
+	if (!iov_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return;
+	}
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+	if (retcode)
+		DHD_ERROR(("%s: ARP ip addr add failed, retcode = %d\n",
+			__FUNCTION__, retcode));
+	else
+		DHD_ARPOE(("%s: sARP H ipaddr entry added \n",
+			__FUNCTION__));
+}
+
+int
+dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen, int idx)
+{
+	int retcode, i;
+	int iov_len;
+	uint32 *ptr32 = buf;
+	bool clr_bottom = FALSE;
+
+	if (!buf)
+		return -1;
+	if (dhd == NULL) return -1;
+	if (dhd->arp_version == 1)
+		idx = 0;
+
+	iov_len = bcm_mkiovar("arp_hostip", 0, 0, buf, buflen);
+	BCM_REFERENCE(iov_len);
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, buflen, FALSE, idx);
+
+	if (retcode) {
+		DHD_ERROR(("%s: ioctl WLC_GET_VAR error %d\n",
+			__FUNCTION__, retcode));
+
+		return -1;
+	}
+
+	/* clean up the buf, ascii reminder */
+	for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+		if (!clr_bottom) {
+			if (*ptr32 == 0)
+				clr_bottom = TRUE;
+		} else {
+			*ptr32 = 0;
+		}
+		ptr32++;
+	}
+
+	return 0;
+}
+#endif /* ARP_OFFLOAD_SUPPORT  */
+
+/*
+ * Neighbor Discovery Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up/goes down
+ */
+int
+dhd_ndo_enable(dhd_pub_t * dhd, int ndo_enable)
+{
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+	int iov_len;
+	int retcode;
+
+	if (dhd == NULL)
+		return -1;
+
+	iov_len = bcm_mkiovar("ndoe", (char *)&ndo_enable, 4, iovbuf, sizeof(iovbuf));
+	if (!iov_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return -1;
+	}
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, 0);
+	if (retcode)
+		DHD_ERROR(("%s: failed to enabe ndo to %d, retcode = %d\n",
+			__FUNCTION__, ndo_enable, retcode));
+	else
+		DHD_TRACE(("%s: successfully enabed ndo offload to %d\n",
+			__FUNCTION__, ndo_enable));
+
+	return retcode;
+}
+
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface comes up
+ */
+int
+dhd_ndo_add_ip(dhd_pub_t *dhd, char* ipv6addr, int idx)
+{
+	int iov_len = 0;
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+	int retcode;
+
+	if (dhd == NULL)
+		return -1;
+
+	iov_len = bcm_mkiovar("nd_hostip", (char *)ipv6addr,
+		IPV6_ADDR_LEN, iovbuf, sizeof(iovbuf));
+	if (!iov_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return -1;
+	}
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+	if (retcode)
+		DHD_ERROR(("%s: ndo ip addr add failed, retcode = %d\n",
+		__FUNCTION__, retcode));
+	else
+		DHD_TRACE(("%s: ndo ipaddr entry added \n",
+		__FUNCTION__));
+
+	return retcode;
+}
+/*
+ * Neighbor Discover Offload: enable NDO feature
+ * Called  by ipv6 event handler when interface goes down
+ */
+int
+dhd_ndo_remove_ip(dhd_pub_t *dhd, int idx)
+{
+	int iov_len = 0;
+	char iovbuf[DHD_IOVAR_BUF_SIZE];
+	int retcode;
+
+	if (dhd == NULL)
+		return -1;
+
+	iov_len = bcm_mkiovar("nd_hostip_clear", NULL,
+		0, iovbuf, sizeof(iovbuf));
+	if (!iov_len) {
+		DHD_ERROR(("%s: Insufficient iovar buffer size %zu \n",
+			__FUNCTION__, sizeof(iovbuf)));
+		return -1;
+	}
+	retcode = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, idx);
+
+	if (retcode)
+		DHD_ERROR(("%s: ndo ip addr remove failed, retcode = %d\n",
+		__FUNCTION__, retcode));
+	else
+		DHD_TRACE(("%s: ndo ipaddr entry removed \n",
+		__FUNCTION__));
+
+	return retcode;
+}
+
+/* send up locally generated event */
+void
+dhd_sendup_event_common(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data)
+{
+	switch (ntoh32(event->event_type)) {
+#ifdef WLBTAMP
+	case WLC_E_BTA_HCI_EVENT:
+		break;
+#endif /* WLBTAMP */
+	default:
+		break;
+	}
+
+	/* Call per-port handler. */
+	dhd_sendup_event(dhdp, event, data);
+}
+
+
+/*
+ * returns = TRUE if associated, FALSE if not associated
+ */
+bool dhd_is_associated(dhd_pub_t *dhd, void *bss_buf, int *retval)
+{
+	char bssid[6], zbuf[6];
+	int ret = -1;
+
+	bzero(bssid, 6);
+	bzero(zbuf, 6);
+
+	ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_BSSID, (char *)&bssid, ETHER_ADDR_LEN, FALSE, 0);
+	DHD_TRACE((" %s WLC_GET_BSSID ioctl res = %d\n", __FUNCTION__, ret));
+
+	if (ret == BCME_NOTASSOCIATED) {
+		DHD_TRACE(("%s: not associated! res:%d\n", __FUNCTION__, ret));
+	}
+
+	if (retval)
+		*retval = ret;
+
+	if (ret < 0)
+		return FALSE;
+
+	if ((memcmp(bssid, zbuf, ETHER_ADDR_LEN) != 0)) {
+		/*  STA is assocoated BSSID is non zero */
+
+		if (bss_buf) {
+			/* return bss if caller provided buf */
+			memcpy(bss_buf, bssid, ETHER_ADDR_LEN);
+		}
+		return TRUE;
+	} else {
+		DHD_TRACE(("%s: WLC_GET_BSSID ioctl returned zero bssid\n", __FUNCTION__));
+		return FALSE;
+	}
+}
+
+/* Function to estimate possible DTIM_SKIP value */
+int
+dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd)
+{
+	int bcn_li_dtim = 1; /* deafult no dtim skip setting */
+	int ret = -1;
+	int dtim_period = 0;
+	int ap_beacon = 0;
+	int allowed_skip_dtim_cnt = 0;
+	/* Check if associated */
+	if (dhd_is_associated(dhd, NULL, NULL) == FALSE) {
+		DHD_TRACE(("%s NOT assoc ret %d\n", __FUNCTION__, ret));
+		goto exit;
+	}
+
+	/* read associated AP beacon interval */
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_BCNPRD,
+		&ap_beacon, sizeof(ap_beacon), FALSE, 0)) < 0) {
+		DHD_ERROR(("%s get beacon failed code %d\n", __FUNCTION__, ret));
+		goto exit;
+	}
+
+	/* read associated ap's dtim setup */
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_DTIMPRD,
+		&dtim_period, sizeof(dtim_period), FALSE, 0)) < 0) {
+		DHD_ERROR(("%s failed code %d\n", __FUNCTION__, ret));
+		goto exit;
+	}
+
+	/* if not assocated just eixt */
+	if (dtim_period == 0) {
+		goto exit;
+	}
+
+	/* attemp to use platform defined dtim skip interval */
+	bcn_li_dtim = dhd->suspend_bcn_li_dtim;
+
+	/* check if sta listen interval fits into AP dtim */
+	if (dtim_period > CUSTOM_LISTEN_INTERVAL) {
+		/* AP DTIM to big for our Listen Interval : no dtim skiping */
+		bcn_li_dtim = NO_DTIM_SKIP;
+		DHD_ERROR(("%s DTIM=%d > Listen=%d : too big ...\n",
+			__FUNCTION__, dtim_period, CUSTOM_LISTEN_INTERVAL));
+		goto exit;
+	}
+
+	if ((dtim_period * ap_beacon * bcn_li_dtim) > MAX_DTIM_ALLOWED_INTERVAL) {
+		 allowed_skip_dtim_cnt = MAX_DTIM_ALLOWED_INTERVAL / (dtim_period * ap_beacon);
+		 bcn_li_dtim = (allowed_skip_dtim_cnt != 0) ? allowed_skip_dtim_cnt : NO_DTIM_SKIP;
+	}
+
+	if ((bcn_li_dtim * dtim_period) > CUSTOM_LISTEN_INTERVAL) {
+		/* Round up dtim_skip to fit into STAs Listen Interval */
+		bcn_li_dtim = (int)(CUSTOM_LISTEN_INTERVAL / dtim_period);
+		DHD_TRACE(("%s agjust dtim_skip as %d\n", __FUNCTION__, bcn_li_dtim));
+	}
+
+	DHD_ERROR(("%s beacon=%d bcn_li_dtim=%d DTIM=%d Listen=%d\n",
+		__FUNCTION__, ap_beacon, bcn_li_dtim, dtim_period, CUSTOM_LISTEN_INTERVAL));
+
+exit:
+	return bcn_li_dtim;
+}
+
+/* Check if the mode supports STA MODE */
+bool dhd_support_sta_mode(dhd_pub_t *dhd)
+{
+
+#ifdef  WL_CFG80211
+	if (!(dhd->op_mode & DHD_FLAG_STA_MODE))
+		return FALSE;
+	else
+#endif /* WL_CFG80211 */
+		return TRUE;
+}
+
+#if defined(KEEP_ALIVE)
+int dhd_keep_alive_onoff(dhd_pub_t *dhd)
+{
+	char				buf[32] = {0};
+	const char			*str;
+	wl_mkeep_alive_pkt_t	mkeep_alive_pkt = {0};
+	wl_mkeep_alive_pkt_t	*mkeep_alive_pktp;
+	int					buf_len;
+	int					str_len;
+	int res					= -1;
+
+	if (!dhd_support_sta_mode(dhd))
+		return res;
+
+	DHD_TRACE(("%s execution\n", __FUNCTION__));
+
+	str = "mkeep_alive";
+	str_len = strlen(str);
+	strncpy(buf, str, sizeof(buf) - 1);
+	buf[ sizeof(buf) - 1 ] = '\0';
+	mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (buf + str_len + 1);
+	mkeep_alive_pkt.period_msec = dhd->conf->keep_alive_period;
+	buf_len = str_len + 1;
+	mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+	mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+	/* Setup keep alive zero for null packet generation */
+	mkeep_alive_pkt.keep_alive_id = 0;
+	mkeep_alive_pkt.len_bytes = 0;
+	buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+	bzero(mkeep_alive_pkt.data, sizeof(mkeep_alive_pkt.data));
+	/* Keep-alive attributes are set in local	variable (mkeep_alive_pkt), and
+	 * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+	 * guarantee that the buffer is properly aligned.
+	 */
+	memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+	res = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, buf_len, TRUE, 0);
+
+	return res;
+}
+#endif /* defined(KEEP_ALIVE) */
+/* Android ComboSCAN support */
+
+/*
+ *  data parsing from ComboScan tlv list
+*/
+int
+wl_iw_parse_data_tlv(char** list_str, void *dst, int dst_size, const char token,
+                     int input_size, int *bytes_left)
+{
+	char* str;
+	uint16 short_temp;
+	uint32 int_temp;
+
+	if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+		DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+		return -1;
+	}
+	str = *list_str;
+
+	/* Clean all dest bytes */
+	memset(dst, 0, dst_size);
+	while (*bytes_left > 0) {
+
+		if (str[0] != token) {
+			DHD_TRACE(("%s NOT Type=%d get=%d left_parse=%d \n",
+				__FUNCTION__, token, str[0], *bytes_left));
+			return -1;
+		}
+
+		*bytes_left -= 1;
+		str += 1;
+
+		if (input_size == 1) {
+			memcpy(dst, str, input_size);
+		}
+		else if (input_size == 2) {
+			memcpy(dst, (char *)htod16(memcpy(&short_temp, str, input_size)),
+				input_size);
+		}
+		else if (input_size == 4) {
+			memcpy(dst, (char *)htod32(memcpy(&int_temp, str, input_size)),
+				input_size);
+		}
+
+		*bytes_left -= input_size;
+		str += input_size;
+		*list_str = str;
+		return 1;
+	}
+	return 1;
+}
+
+/*
+ *  channel list parsing from cscan tlv list
+*/
+int
+wl_iw_parse_channel_list_tlv(char** list_str, uint16* channel_list,
+                             int channel_num, int *bytes_left)
+{
+	char* str;
+	int idx = 0;
+
+	if ((list_str == NULL) || (*list_str == NULL) ||(bytes_left == NULL) || (*bytes_left < 0)) {
+		DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+		return -1;
+	}
+	str = *list_str;
+
+	while (*bytes_left > 0) {
+
+		if (str[0] != CSCAN_TLV_TYPE_CHANNEL_IE) {
+			*list_str = str;
+			DHD_TRACE(("End channel=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+			return idx;
+		}
+		/* Get proper CSCAN_TLV_TYPE_CHANNEL_IE */
+		*bytes_left -= 1;
+		str += 1;
+
+		if (str[0] == 0) {
+			/* All channels */
+			channel_list[idx] = 0x0;
+		}
+		else {
+			channel_list[idx] = (uint16)str[0];
+			DHD_TRACE(("%s channel=%d \n", __FUNCTION__,  channel_list[idx]));
+		}
+		*bytes_left -= 1;
+		str += 1;
+
+		if (idx++ > 255) {
+			DHD_ERROR(("%s Too many channels \n", __FUNCTION__));
+			return -1;
+		}
+	}
+
+	*list_str = str;
+	return idx;
+}
+
+/*
+ *  SSIDs list parsing from cscan tlv list
+ */
+int
+wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_t* ssid, int max, int *bytes_left)
+{
+	char* str;
+	int idx = 0;
+
+	if ((list_str == NULL) || (*list_str == NULL) || (*bytes_left < 0)) {
+		DHD_ERROR(("%s error paramters\n", __FUNCTION__));
+		return -1;
+	}
+	str = *list_str;
+	while (*bytes_left > 0) {
+
+		if (str[0] != CSCAN_TLV_TYPE_SSID_IE) {
+			*list_str = str;
+			DHD_TRACE(("nssid=%d left_parse=%d %d\n", idx, *bytes_left, str[0]));
+			return idx;
+		}
+
+		/* Get proper CSCAN_TLV_TYPE_SSID_IE */
+		*bytes_left -= 1;
+		str += 1;
+
+		if (str[0] == 0) {
+			/* Broadcast SSID */
+			ssid[idx].SSID_len = 0;
+			memset((char*)ssid[idx].SSID, 0x0, DOT11_MAX_SSID_LEN);
+			*bytes_left -= 1;
+			str += 1;
+
+			DHD_TRACE(("BROADCAST SCAN  left=%d\n", *bytes_left));
+		}
+		else if (str[0] <= DOT11_MAX_SSID_LEN) {
+			/* Get proper SSID size */
+			ssid[idx].SSID_len = str[0];
+			*bytes_left -= 1;
+			str += 1;
+
+			/* Get SSID */
+			if (ssid[idx].SSID_len > *bytes_left) {
+				DHD_ERROR(("%s out of memory range len=%d but left=%d\n",
+				__FUNCTION__, ssid[idx].SSID_len, *bytes_left));
+				return -1;
+			}
+
+			memcpy((char*)ssid[idx].SSID, str, ssid[idx].SSID_len);
+
+			*bytes_left -= ssid[idx].SSID_len;
+			str += ssid[idx].SSID_len;
+
+			DHD_TRACE(("%s :size=%d left=%d\n",
+				(char*)ssid[idx].SSID, ssid[idx].SSID_len, *bytes_left));
+		}
+		else {
+			DHD_ERROR(("### SSID size more that %d\n", str[0]));
+			return -1;
+		}
+
+		if (idx++ >  max) {
+			DHD_ERROR(("%s number of SSIDs more that %d\n", __FUNCTION__, idx));
+			return -1;
+		}
+	}
+
+	*list_str = str;
+	return idx;
+}
+
+/* Parse a comma-separated list from list_str into ssid array, starting
+ * at index idx.  Max specifies size of the ssid array.  Parses ssids
+ * and returns updated idx; if idx >= max not all fit, the excess have
+ * not been copied.  Returns -1 on empty string, or on ssid too long.
+ */
+int
+wl_iw_parse_ssid_list(char** list_str, wlc_ssid_t* ssid, int idx, int max)
+{
+	char* str, *ptr;
+
+	if ((list_str == NULL) || (*list_str == NULL))
+		return -1;
+
+	for (str = *list_str; str != NULL; str = ptr) {
+
+		/* check for next TAG */
+		if (!strncmp(str, GET_CHANNEL, strlen(GET_CHANNEL))) {
+			*list_str	 = str + strlen(GET_CHANNEL);
+			return idx;
+		}
+
+		if ((ptr = strchr(str, ',')) != NULL) {
+			*ptr++ = '\0';
+		}
+
+		if (strlen(str) > DOT11_MAX_SSID_LEN) {
+			DHD_ERROR(("ssid <%s> exceeds %d\n", str, DOT11_MAX_SSID_LEN));
+			return -1;
+		}
+
+		if (strlen(str) == 0)
+			ssid[idx].SSID_len = 0;
+
+		if (idx < max) {
+			bzero(ssid[idx].SSID, sizeof(ssid[idx].SSID));
+			strncpy((char*)ssid[idx].SSID, str, sizeof(ssid[idx].SSID) - 1);
+			ssid[idx].SSID_len = strlen(str);
+		}
+		idx++;
+	}
+	return idx;
+}
+
+/*
+ * Parse channel list from iwpriv CSCAN
+ */
+int
+wl_iw_parse_channel_list(char** list_str, uint16* channel_list, int channel_num)
+{
+	int num;
+	int val;
+	char* str;
+	char* endptr = NULL;
+
+	if ((list_str == NULL)||(*list_str == NULL))
+		return -1;
+
+	str = *list_str;
+	num = 0;
+	while (strncmp(str, GET_NPROBE, strlen(GET_NPROBE))) {
+		val = (int)strtoul(str, &endptr, 0);
+		if (endptr == str) {
+			printf("could not parse channel number starting at"
+				" substring \"%s\" in list:\n%s\n",
+				str, *list_str);
+			return -1;
+		}
+		str = endptr + strspn(endptr, " ,");
+
+		if (num == channel_num) {
+			DHD_ERROR(("too many channels (more than %d) in channel list:\n%s\n",
+				channel_num, *list_str));
+			return -1;
+		}
+
+		channel_list[num++] = (uint16)val;
+	}
+	*list_str = str;
+	return num;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_config.c b/drivers/net/wireless/bcm4336/dhd_config.c
--- a/drivers/net/wireless/bcm4336/dhd_config.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_config.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,2154 @@
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <hndsoc.h>
+#if defined(HW_OOB)
+#include <bcmdefs.h>
+#include <bcmsdh.h>
+#include <sdio.h>
+#include <sbchipc.h>
+#endif
+
+#include <dhd_config.h>
+#include <dhd_dbg.h>
+
+/* message levels */
+#define CONFIG_ERROR_LEVEL	0x0001
+#define CONFIG_TRACE_LEVEL	0x0002
+
+uint config_msg_level = CONFIG_ERROR_LEVEL;
+
+#define CONFIG_ERROR(x) \
+	do { \
+		if (config_msg_level & CONFIG_ERROR_LEVEL) { \
+			printk(KERN_ERR "CONFIG-ERROR) ");	\
+			printk x; \
+		} \
+	} while (0)
+#define CONFIG_TRACE(x) \
+	do { \
+		if (config_msg_level & CONFIG_TRACE_LEVEL) { \
+			printk(KERN_ERR "CONFIG-TRACE) ");	\
+			printk x; \
+		} \
+	} while (0)
+
+#define MAXSZ_BUF		1000
+#define	MAXSZ_CONFIG	4096
+
+#define FW_TYPE_STA     0
+#define FW_TYPE_APSTA   1
+#define FW_TYPE_P2P     2
+#define FW_TYPE_MFG     3
+#define FW_TYPE_G       0
+#define FW_TYPE_AG      1
+
+#ifdef BCMSDIO
+#define SBSDIO_CIS_SIZE_LIMIT		0x200		/* maximum bytes in one CIS */
+
+#define BCM43362A0_CHIP_REV     0
+#define BCM43362A2_CHIP_REV     1
+#define BCM43430A0_CHIP_REV     0
+#define BCM43430A1_CHIP_REV     1
+#define BCM4330B2_CHIP_REV      4
+#define BCM43340B0_CHIP_REV     2
+#define BCM43341B0_CHIP_REV     2
+#define BCM43241B4_CHIP_REV     5
+#define BCM4335A0_CHIP_REV      2
+#define BCM4339A0_CHIP_REV      1
+#define BCM43455C0_CHIP_REV     6
+#define BCM4354A1_CHIP_REV      1
+#define BCM4356A2_CHIP_REV      2
+
+const static char *bcm4330b2_fw_name[] = {
+	"fw_bcm40183b2.bin",
+	"fw_bcm40183b2_apsta.bin",
+	"fw_bcm40183b2_p2p.bin",
+	"fw_bcm40183b2_mfg.bin"
+};
+
+const static char *bcm4330b2_ag_fw_name[] = {
+	"fw_bcm40183b2_ag.bin",
+	"fw_bcm40183b2_ag_apsta.bin",
+	"fw_bcm40183b2_ag_p2p.bin",
+	"fw_bcm40183b2_ag_mfg.bin"
+};
+
+const static char *bcm43362a0_fw_name[] = {
+	"fw_bcm40181a0.bin",
+	"fw_bcm40181a0_apsta.bin",
+	"fw_bcm40181a0_p2p.bin",
+	"fw_bcm40181a0_mfg.bin"
+};
+
+const static char *bcm43362a2_fw_name[] = {
+	"fw_bcm40181a2.bin",
+	"fw_bcm40181a2_apsta.bin",
+	"fw_bcm40181a2_p2p.bin",
+	"fw_bcm40181a2_mfg.bin"
+};
+
+const static char *bcm43438a0_fw_name[] = {
+	"fw_bcm43438a0.bin",
+	"fw_bcm43438a0_apsta.bin",
+	"fw_bcm43438a0_p2p.bin",
+	"fw_bcm43438a0_mfg.bin"
+};
+
+const static char *bcm43438a1_fw_name[] = {
+	"fw_bcm43438a1.bin",
+	"fw_bcm43438a1_apsta.bin",
+	"fw_bcm43438a1_p2p.bin",
+	"fw_bcm43438a1_mfg.bin"
+};
+
+const static char *bcm43341b0_ag_fw_name[] = {
+	"fw_bcm43341b0_ag.bin",
+	"fw_bcm43341b0_ag_apsta.bin",
+	"fw_bcm43341b0_ag_p2p.bin",
+	"fw_bcm43341b0_ag_mfg.bin"
+};
+
+const static char *bcm43241b4_ag_fw_name[] = {
+	"fw_bcm43241b4_ag.bin",
+	"fw_bcm43241b4_ag_apsta.bin",
+	"fw_bcm43241b4_ag_p2p.bin",
+	"fw_bcm43241b4_ag_mfg.bin"
+};
+
+const static char *bcm4339a0_ag_fw_name[] = {
+	"fw_bcm4339a0_ag.bin",
+	"fw_bcm4339a0_ag_apsta.bin",
+	"fw_bcm4339a0_ag_p2p.bin",
+	"fw_bcm4339a0_ag_mfg.bin"
+};
+
+const static char *bcm43455c0_ag_fw_name[] = {
+	"fw_bcm43455c0_ag.bin",
+	"fw_bcm43455c0_ag_apsta.bin",
+	"fw_bcm43455c0_ag_p2p.bin",
+	"fw_bcm43455c0_ag_mfg.bin"
+};
+
+const static char *bcm4354a1_ag_fw_name[] = {
+	"fw_bcm4354a1_ag.bin",
+	"fw_bcm4354a1_ag_apsta.bin",
+	"fw_bcm4354a1_ag_p2p.bin",
+	"fw_bcm4354a1_ag_mfg.bin"
+};
+
+const static char *bcm4356a2_ag_fw_name[] = {
+	"fw_bcm4356a2_ag.bin",
+	"fw_bcm4356a2_ag_apsta.bin",
+	"fw_bcm4356a2_ag_p2p.bin",
+	"fw_bcm4356a2_ag_mfg.bin"
+};
+#endif
+#ifdef BCMPCIE
+#define BCM4356A2_CHIP_REV      2
+
+const static char *bcm4356a2_pcie_ag_fw_name[] = {
+	"fw_bcm4356a2_pcie_ag.bin",
+	"fw_bcm4356a2_pcie_ag_apsta.bin",
+	"fw_bcm4356a2_pcie_ag_p2p.bin",
+	"fw_bcm4356a2_pcie_ag_mfg.bin"
+};
+#endif
+
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+#define htodchanspec(i) i
+#define dtohchanspec(i) i
+
+#ifdef BCMSDIO
+void
+dhd_conf_free_mac_list(wl_mac_list_ctrl_t *mac_list)
+{
+	int i;
+
+	CONFIG_TRACE(("%s called\n", __FUNCTION__));
+	if (mac_list->m_mac_list_head) {
+		for (i=0; i<mac_list->count; i++) {
+			if (mac_list->m_mac_list_head[i].mac) {
+				CONFIG_TRACE(("%s Free mac %p\n", __FUNCTION__, mac_list->m_mac_list_head[i].mac));
+				kfree(mac_list->m_mac_list_head[i].mac);
+			}
+		}
+		CONFIG_TRACE(("%s Free m_mac_list_head %p\n", __FUNCTION__, mac_list->m_mac_list_head));
+		kfree(mac_list->m_mac_list_head);
+	}
+	mac_list->count = 0;
+}
+
+void
+dhd_conf_free_chip_nv_path_list(wl_chip_nv_path_list_ctrl_t *chip_nv_list)
+{
+	CONFIG_TRACE(("%s called\n", __FUNCTION__));
+
+	if (chip_nv_list->m_chip_nv_path_head) {
+		CONFIG_TRACE(("%s Free %p\n", __FUNCTION__, chip_nv_list->m_chip_nv_path_head));
+		kfree(chip_nv_list->m_chip_nv_path_head);
+	}
+	chip_nv_list->count = 0;
+}
+
+#if defined(HW_OOB)
+void
+dhd_conf_set_hw_oob_intr(bcmsdh_info_t *sdh, uint chip)
+{
+	uint32 gpiocontrol, addr;
+
+	if (CHIPID(chip) == BCM43362_CHIP_ID) {
+		printf("%s: Enable HW OOB for 43362\n", __FUNCTION__);
+		addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, gpiocontrol);
+		gpiocontrol = bcmsdh_reg_read(sdh, addr, 4);
+		gpiocontrol |= 0x2;
+		bcmsdh_reg_write(sdh, addr, 4, gpiocontrol);
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, 0x10005, 0xf, NULL);
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, 0x10006, 0x0, NULL);
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, 0x10007, 0x2, NULL);
+	}
+}
+#endif
+
+int
+dhd_conf_get_mac(dhd_pub_t *dhd, bcmsdh_info_t *sdh, uint8 *mac)
+{
+	int i, err = -1;
+	uint8 *ptr = 0;
+	unsigned char tpl_code, tpl_link='\0';
+	uint8 header[3] = {0x80, 0x07, 0x19};
+	uint8 *cis;
+
+	if (!(cis = MALLOC(dhd->osh, SBSDIO_CIS_SIZE_LIMIT))) {
+		CONFIG_ERROR(("%s: cis malloc failed\n", __FUNCTION__));
+		return err;
+	}
+	bzero(cis, SBSDIO_CIS_SIZE_LIMIT);
+
+	if ((err = bcmsdh_cis_read(sdh, 0, cis, SBSDIO_CIS_SIZE_LIMIT))) {
+		CONFIG_ERROR(("%s: cis read err %d\n", __FUNCTION__, err));
+		MFREE(dhd->osh, cis, SBSDIO_CIS_SIZE_LIMIT);
+		return err;
+	}
+	err = -1; // reset err;
+	ptr = cis;
+	do {
+		/* 0xff means we're done */
+		tpl_code = *ptr;
+		ptr++;
+		if (tpl_code == 0xff)
+			break;
+
+		/* null entries have no link field or data */
+		if (tpl_code == 0x00)
+			continue;
+
+		tpl_link = *ptr;
+		ptr++;
+		/* a size of 0xff also means we're done */
+		if (tpl_link == 0xff)
+			break;
+		if (config_msg_level & CONFIG_TRACE_LEVEL) {
+			printf("%s: tpl_code=0x%02x, tpl_link=0x%02x, tag=0x%02x\n",
+				__FUNCTION__, tpl_code, tpl_link, *ptr);
+			printk("%s: value:", __FUNCTION__);
+			for (i=0; i<tpl_link-1; i++) {
+				printk("%02x ", ptr[i+1]);
+				if ((i+1) % 16 == 0)
+					printk("\n");
+			}
+			printk("\n");
+		}
+
+		if (tpl_code == 0x80 && tpl_link == 0x07 && *ptr == 0x19)
+			break;
+
+		ptr += tpl_link;
+	} while (1);
+
+	if (tpl_code == 0x80 && tpl_link == 0x07 && *ptr == 0x19) {
+		/* Normal OTP */
+		memcpy(mac, ptr+1, 6);
+		err = 0;
+	} else {
+		ptr = cis;
+		/* Special OTP */
+		if (bcmsdh_reg_read(sdh, SI_ENUM_BASE, 4) == 0x16044330) {
+			for (i=0; i<SBSDIO_CIS_SIZE_LIMIT; i++) {
+				if (!memcmp(header, ptr, 3)) {
+					memcpy(mac, ptr+1, 6);
+					err = 0;
+					break;
+				}
+				ptr++;
+			}
+		}
+	}
+
+	ASSERT(cis);
+	MFREE(dhd->osh, cis, SBSDIO_CIS_SIZE_LIMIT);
+
+	return err;
+}
+
+void
+dhd_conf_set_fw_name_by_mac(dhd_pub_t *dhd, bcmsdh_info_t *sdh, char *fw_path)
+{
+	int i, j;
+	uint8 mac[6]={0};
+	int fw_num=0, mac_num=0;
+	uint32 oui, nic;
+	wl_mac_list_t *mac_list;
+	wl_mac_range_t *mac_range;
+	char *pfw_name;
+	int fw_type, fw_type_new;
+
+	mac_list = dhd->conf->fw_by_mac.m_mac_list_head;
+	fw_num = dhd->conf->fw_by_mac.count;
+	if (!mac_list || !fw_num)
+		return;
+
+	if (dhd_conf_get_mac(dhd, sdh, mac)) {
+		CONFIG_ERROR(("%s: Can not read MAC address\n", __FUNCTION__));
+		return;
+	}
+	oui = (mac[0] << 16) | (mac[1] << 8) | (mac[2]);
+	nic = (mac[3] << 16) | (mac[4] << 8) | (mac[5]);
+
+	/* find out the last '/' */
+	i = strlen(fw_path);
+	while (i > 0) {
+		if (fw_path[i] == '/') break;
+		i--;
+	}
+	pfw_name = &fw_path[i+1];
+	fw_type = (strstr(pfw_name, "_mfg") ?
+		FW_TYPE_MFG : (strstr(pfw_name, "_apsta") ?
+		FW_TYPE_APSTA : (strstr(pfw_name, "_p2p") ?
+		FW_TYPE_P2P : FW_TYPE_STA)));
+
+	for (i=0; i<fw_num; i++) {
+		mac_num = mac_list[i].count;
+		mac_range = mac_list[i].mac;
+		fw_type_new = (strstr(mac_list[i].name, "_mfg") ?
+			FW_TYPE_MFG : (strstr(mac_list[i].name, "_apsta") ?
+			FW_TYPE_APSTA : (strstr(mac_list[i].name, "_p2p") ?
+			FW_TYPE_P2P : FW_TYPE_STA)));
+		if (fw_type != fw_type_new) {
+			printf("%s: fw_typ=%d != fw_type_new=%d\n", __FUNCTION__, fw_type, fw_type_new);
+			continue;
+		}
+		for (j=0; j<mac_num; j++) {
+			if (oui == mac_range[j].oui) {
+				if (nic >= mac_range[j].nic_start && nic <= mac_range[j].nic_end) {
+					strcpy(pfw_name, mac_list[i].name);
+					printf("%s: matched oui=0x%06X, nic=0x%06X\n",
+						__FUNCTION__, oui, nic);
+					printf("%s: fw_path=%s\n", __FUNCTION__, fw_path);
+					return;
+				}
+			}
+		}
+	}
+}
+
+void
+dhd_conf_set_nv_name_by_mac(dhd_pub_t *dhd, bcmsdh_info_t *sdh, char *nv_path)
+{
+	int i, j;
+	uint8 mac[6]={0};
+	int nv_num=0, mac_num=0;
+	uint32 oui, nic;
+	wl_mac_list_t *mac_list;
+	wl_mac_range_t *mac_range;
+	char *pnv_name;
+
+	mac_list = dhd->conf->nv_by_mac.m_mac_list_head;
+	nv_num = dhd->conf->nv_by_mac.count;
+	if (!mac_list || !nv_num)
+		return;
+
+	if (dhd_conf_get_mac(dhd, sdh, mac)) {
+		CONFIG_ERROR(("%s: Can not read MAC address\n", __FUNCTION__));
+		return;
+	}
+	oui = (mac[0] << 16) | (mac[1] << 8) | (mac[2]);
+	nic = (mac[3] << 16) | (mac[4] << 8) | (mac[5]);
+
+	/* find out the last '/' */
+	i = strlen(nv_path);
+	while (i > 0) {
+		if (nv_path[i] == '/') break;
+		i--;
+	}
+	pnv_name = &nv_path[i+1];
+
+	for (i=0; i<nv_num; i++) {
+		mac_num = mac_list[i].count;
+		mac_range = mac_list[i].mac;
+		for (j=0; j<mac_num; j++) {
+			if (oui == mac_range[j].oui) {
+				if (nic >= mac_range[j].nic_start && nic <= mac_range[j].nic_end) {
+					strcpy(pnv_name, mac_list[i].name);
+					printf("%s: matched oui=0x%06X, nic=0x%06X\n",
+						__FUNCTION__, oui, nic);
+					printf("%s: nv_path=%s\n", __FUNCTION__, nv_path);
+					return;
+				}
+			}
+		}
+	}
+}
+#endif
+
+void
+dhd_conf_set_fw_name_by_chip(dhd_pub_t *dhd, char *fw_path)
+{
+	int fw_type, ag_type;
+	uint chip, chiprev;
+	int i;
+
+	chip = dhd->conf->chip;
+	chiprev = dhd->conf->chiprev;
+
+	if (fw_path[0] == '\0') {
+#ifdef CONFIG_BCMDHD_FW_PATH
+		bcm_strncpy_s(fw_path, MOD_PARAM_PATHLEN-1, CONFIG_BCMDHD_FW_PATH, MOD_PARAM_PATHLEN-1);
+		if (fw_path[0] == '\0')
+#endif
+		{
+			printf("firmware path is null\n");
+			return;
+		}
+	}
+#ifndef FW_PATH_AUTO_SELECT
+	return;
+#endif
+
+	/* find out the last '/' */
+	i = strlen(fw_path);
+	while (i > 0) {
+		if (fw_path[i] == '/') break;
+		i--;
+	}
+#ifdef BAND_AG
+	ag_type = FW_TYPE_AG;
+#else
+	ag_type = strstr(&fw_path[i], "_ag") ? FW_TYPE_AG : FW_TYPE_G;
+#endif
+	fw_type = (strstr(&fw_path[i], "_mfg") ?
+		FW_TYPE_MFG : (strstr(&fw_path[i], "_apsta") ?
+		FW_TYPE_APSTA : (strstr(&fw_path[i], "_p2p") ?
+		FW_TYPE_P2P : FW_TYPE_STA)));
+
+	switch (chip) {
+#ifdef BCMSDIO
+		case BCM4330_CHIP_ID:
+			if (ag_type == FW_TYPE_G) {
+				if (chiprev == BCM4330B2_CHIP_REV)
+					strcpy(&fw_path[i+1], bcm4330b2_fw_name[fw_type]);
+				break;
+			} else {
+				if (chiprev == BCM4330B2_CHIP_REV)
+					strcpy(&fw_path[i+1], bcm4330b2_ag_fw_name[fw_type]);
+				break;
+			}
+		case BCM43362_CHIP_ID:
+			if (chiprev == BCM43362A0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43362a0_fw_name[fw_type]);
+			else
+				strcpy(&fw_path[i+1], bcm43362a2_fw_name[fw_type]);
+			break;
+		case BCM43430_CHIP_ID:
+			if (chiprev == BCM43430A0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43438a0_fw_name[fw_type]);
+			else if (chiprev == BCM43430A1_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43438a1_fw_name[fw_type]);
+			break;
+		case BCM43340_CHIP_ID:
+			if (chiprev == BCM43340B0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43341b0_ag_fw_name[fw_type]);
+			break;
+		case BCM43341_CHIP_ID:
+			if (chiprev == BCM43341B0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43341b0_ag_fw_name[fw_type]);
+			break;
+		case BCM4324_CHIP_ID:
+			if (chiprev == BCM43241B4_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43241b4_ag_fw_name[fw_type]);
+			break;
+		case BCM4335_CHIP_ID:
+			if (chiprev == BCM4335A0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4339a0_ag_fw_name[fw_type]);
+			break;
+		case BCM4345_CHIP_ID:
+			if (chiprev == BCM43455C0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm43455c0_ag_fw_name[fw_type]);
+			break;
+		case BCM4339_CHIP_ID:
+			if (chiprev == BCM4339A0_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4339a0_ag_fw_name[fw_type]);
+			break;
+		case BCM4354_CHIP_ID:
+			if (chiprev == BCM4354A1_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4354a1_ag_fw_name[fw_type]);
+			else if (chiprev == BCM4356A2_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4356a2_ag_fw_name[fw_type]);
+			break;
+		case BCM4356_CHIP_ID:
+			if (chiprev == BCM4356A2_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4356a2_ag_fw_name[fw_type]);
+			break;
+		case BCM4371_CHIP_ID:
+			if (chiprev == BCM4356A2_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4356a2_ag_fw_name[fw_type]);
+			break;
+#endif
+#ifdef BCMPCIE
+		case BCM4356_CHIP_ID:
+			if (chiprev == BCM4356A2_CHIP_REV)
+				strcpy(&fw_path[i+1], bcm4356a2_pcie_ag_fw_name[fw_type]);
+			break;
+#endif
+	}
+
+	printf("%s: firmware_path=%s\n", __FUNCTION__, fw_path);
+}
+
+void
+dhd_conf_set_nv_name_by_chip(dhd_pub_t *dhd, char *nv_path)
+{
+	int matched=-1;
+	uint chip, chiprev;
+	int i;
+
+	chip = dhd->conf->chip;
+	chiprev = dhd->conf->chiprev;
+
+	for (i=0; i<dhd->conf->nv_by_chip.count; i++) {
+		if (chip==dhd->conf->nv_by_chip.m_chip_nv_path_head[i].chip &&
+				chiprev==dhd->conf->nv_by_chip.m_chip_nv_path_head[i].chiprev) {
+			matched = i;
+			break;
+		}
+	}
+	if (matched < 0)
+		return;
+
+	if (nv_path[0] == '\0') {
+#ifdef CONFIG_BCMDHD_NVRAM_PATH
+		bcm_strncpy_s(nv_path, MOD_PARAM_PATHLEN-1, CONFIG_BCMDHD_NVRAM_PATH, MOD_PARAM_PATHLEN-1);
+		if (nv_path[0] == '\0')
+#endif
+		{
+			printf("nvram path is null\n");
+			return;
+		}
+	}
+
+	/* find out the last '/' */
+	i = strlen(nv_path);
+	while (i > 0) {
+		if (nv_path[i] == '/') break;
+		i--;
+	}
+
+	strcpy(&nv_path[i+1], dhd->conf->nv_by_chip.m_chip_nv_path_head[matched].name);
+
+	printf("%s: nvram_path=%s\n", __FUNCTION__, nv_path);
+}
+
+void
+dhd_conf_set_conf_path_by_nv_path(dhd_pub_t *dhd, char *conf_path, char *nv_path)
+{
+	int i;
+
+	if (nv_path[0] == '\0') {
+#ifdef CONFIG_BCMDHD_NVRAM_PATH
+		bcm_strncpy_s(conf_path, MOD_PARAM_PATHLEN-1, CONFIG_BCMDHD_NVRAM_PATH, MOD_PARAM_PATHLEN-1);
+		if (nv_path[0] == '\0')
+#endif
+		{
+			printf("nvram path is null\n");
+			return;
+		}
+	} else
+		strcpy(conf_path, nv_path);
+
+	/* find out the last '/' */
+	i = strlen(conf_path);
+	while (i > 0) {
+		if (conf_path[i] == '/') break;
+		i--;
+	}
+	strcpy(&conf_path[i+1], "config.txt");
+
+	printf("%s: config_path=%s\n", __FUNCTION__, conf_path);
+}
+
+int
+dhd_conf_set_band(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+
+	printf("%s: Set band %d\n", __FUNCTION__, dhd->conf->band);
+	if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_BAND, &dhd->conf->band,
+		sizeof(dhd->conf->band), TRUE, 0)) < 0)
+		CONFIG_ERROR(("%s: WLC_SET_BAND setting failed %d\n", __FUNCTION__, bcmerror));
+
+	return bcmerror;
+}
+
+uint
+dhd_conf_get_band(dhd_pub_t *dhd)
+{
+	uint band = WLC_BAND_AUTO;
+
+	if (dhd && dhd->conf)
+		band = dhd->conf->band;
+	else
+		CONFIG_ERROR(("%s: dhd or conf is NULL\n", __FUNCTION__));
+
+	return band;
+}
+
+int
+dhd_conf_set_country(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+
+	memset(&dhd->dhd_cspec, 0, sizeof(wl_country_t));
+	printf("%s: Set country %s, revision %d\n", __FUNCTION__,
+		dhd->conf->cspec.ccode, dhd->conf->cspec.rev);
+	bcm_mkiovar("country", (char *)&dhd->conf->cspec,
+		sizeof(wl_country_t), iovbuf, sizeof(iovbuf));
+	if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+		printf("%s: country code setting failed %d\n", __FUNCTION__, bcmerror);
+
+	return bcmerror;
+}
+
+int
+dhd_conf_get_country(dhd_pub_t *dhd, wl_country_t *cspec)
+{
+	int bcmerror = -1;
+
+	memset(cspec, 0, sizeof(wl_country_t));
+	bcm_mkiovar("country", NULL, 0, (char*)cspec, sizeof(wl_country_t));
+	if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, cspec, sizeof(wl_country_t), FALSE, 0)) < 0)
+		printf("%s: country code getting failed %d\n", __FUNCTION__, bcmerror);
+	else
+		printf("Country code: %s (%s/%d)\n", cspec->country_abbrev, cspec->ccode, cspec->rev);
+
+	return bcmerror;
+}
+
+int
+dhd_conf_fix_country(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	uint band;
+	wl_uint32_list_t *list;
+	u8 valid_chan_list[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+
+	if (!(dhd && dhd->conf)) {
+		return bcmerror;
+	}
+
+	memset(valid_chan_list, 0, sizeof(valid_chan_list));
+	list = (wl_uint32_list_t *)(void *) valid_chan_list;
+	list->count = htod32(WL_NUMCHANNELS);
+	if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_GET_VALID_CHANNELS, valid_chan_list, sizeof(valid_chan_list), FALSE, 0)) < 0) {
+		CONFIG_ERROR(("%s: get channels failed with %d\n", __FUNCTION__, bcmerror));
+	}
+
+	band = dhd_conf_get_band(dhd);
+
+	if (bcmerror || ((band==WLC_BAND_AUTO || band==WLC_BAND_2G) &&
+			dtoh32(list->count)<11)) {
+		CONFIG_ERROR(("%s: bcmerror=%d, # of channels %d\n",
+			__FUNCTION__, bcmerror, dtoh32(list->count)));
+		if ((bcmerror = dhd_conf_set_country(dhd)) < 0) {
+			strcpy(dhd->conf->cspec.country_abbrev, "US");
+			dhd->conf->cspec.rev = 0;
+			strcpy(dhd->conf->cspec.ccode, "US");
+			dhd_conf_set_country(dhd);
+		}
+	}
+
+	return bcmerror;
+}
+
+bool
+dhd_conf_match_channel(dhd_pub_t *dhd, uint32 channel)
+{
+	int i;
+	bool match = false;
+
+	if (dhd && dhd->conf) {
+		if (dhd->conf->channels.count == 0)
+			return true;
+		for (i=0; i<dhd->conf->channels.count; i++) {
+			if (channel == dhd->conf->channels.channel[i])
+				match = true;
+		}
+	} else {
+		match = true;
+		CONFIG_ERROR(("%s: dhd or conf is NULL\n", __FUNCTION__));
+	}
+
+	return match;
+}
+
+int
+dhd_conf_set_roam(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	struct dhd_conf *conf = dhd->conf;
+
+	printf("%s: Set roam_off %d\n", __FUNCTION__, conf->roam_off);
+	dhd_roam_disable = conf->roam_off;
+	bcm_mkiovar("roam_off", (char *)&conf->roam_off, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+	if (!conf->roam_off || !conf->roam_off_suspend) {
+		printf("%s: Set roam_trigger %d\n", __FUNCTION__, conf->roam_trigger[0]);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_TRIGGER, conf->roam_trigger,
+				sizeof(conf->roam_trigger), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: roam trigger setting failed %d\n", __FUNCTION__, bcmerror));
+
+		printf("%s: Set roam_scan_period %d\n", __FUNCTION__, conf->roam_scan_period[0]);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_SCAN_PERIOD, conf->roam_scan_period,
+				sizeof(conf->roam_scan_period), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: roam scan period setting failed %d\n", __FUNCTION__, bcmerror));
+
+		printf("%s: Set roam_delta %d\n", __FUNCTION__, conf->roam_delta[0]);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_DELTA, conf->roam_delta,
+				sizeof(conf->roam_delta), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: roam delta setting failed %d\n", __FUNCTION__, bcmerror));
+
+		printf("%s: Set fullroamperiod %d\n", __FUNCTION__, conf->fullroamperiod);
+		bcm_mkiovar("fullroamperiod", (char *)&conf->fullroamperiod, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: roam fullscan period setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+
+	return bcmerror;
+}
+
+void
+dhd_conf_set_mimo_bw_cap(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	uint32 mimo_bw_cap;
+
+	if (dhd->conf->mimo_bw_cap >= 0) {
+		mimo_bw_cap = (uint)dhd->conf->mimo_bw_cap;
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, NULL, 0, TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: WLC_DOWN setting failed %d\n", __FUNCTION__, bcmerror));
+		/*  0:HT20 in ALL, 1:HT40 in ALL, 2: HT20 in 2G HT40 in 5G */
+		printf("%s: Set mimo_bw_cap %d\n", __FUNCTION__, mimo_bw_cap);
+		bcm_mkiovar("mimo_bw_cap", (char *)&mimo_bw_cap, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: mimo_bw_cap setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_force_wme(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+
+	if (dhd->conf->force_wme_ac) {
+		bcm_mkiovar("force_wme_ac", (char *)&dhd->conf->force_wme_ac, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: force_wme_ac setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_get_wme(dhd_pub_t *dhd, edcf_acparam_t *acp)
+{
+	int bcmerror = -1;
+	char iovbuf[WLC_IOCTL_SMLEN];
+	edcf_acparam_t *acparam;
+
+	bzero(iovbuf, sizeof(iovbuf));
+
+	/*
+	 * Get current acparams, using buf as an input buffer.
+	 * Return data is array of 4 ACs of wme params.
+	 */
+	bcm_mkiovar("wme_ac_sta", NULL, 0, iovbuf, sizeof(iovbuf));
+	if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+		CONFIG_ERROR(("%s: wme_ac_sta getting failed %d\n", __FUNCTION__, bcmerror));
+		return;
+	}
+	memcpy((char*)acp, iovbuf, sizeof(edcf_acparam_t)*AC_COUNT);
+
+	acparam = &acp[AC_BK];
+	CONFIG_TRACE(("%s: BK: aci %d aifsn %d ecwmin %d ecwmax %d size %ld\n", __FUNCTION__,
+		acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,
+		acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,
+		sizeof(acp)));
+	acparam = &acp[AC_BE];
+	CONFIG_TRACE(("%s: BE: aci %d aifsn %d ecwmin %d ecwmax %d size %ld\n", __FUNCTION__,
+		acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,
+		acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,
+		sizeof(acp)));
+	acparam = &acp[AC_VI];
+	CONFIG_TRACE(("%s: VI: aci %d aifsn %d ecwmin %d ecwmax %d size %ld\n", __FUNCTION__,
+		acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,
+		acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,
+		sizeof(acp)));
+	acparam = &acp[AC_VO];
+	CONFIG_TRACE(("%s: VO: aci %d aifsn %d ecwmin %d ecwmax %d size %ld\n", __FUNCTION__,
+		acparam->ACI, acparam->ACI&EDCF_AIFSN_MASK,
+		acparam->ECW&EDCF_ECWMIN_MASK, (acparam->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,
+		sizeof(acp)));
+
+	return;
+}
+
+void
+dhd_conf_update_wme(dhd_pub_t *dhd, edcf_acparam_t *acparam_cur, int aci)
+{
+	int bcmerror = -1;
+	int aifsn, ecwmin, ecwmax;
+	edcf_acparam_t *acp;
+	char iovbuf[WLC_IOCTL_SMLEN];
+	struct dhd_conf *conf = dhd->conf;
+
+	/* Default value */
+	aifsn = acparam_cur->ACI&EDCF_AIFSN_MASK;
+	ecwmin = acparam_cur->ECW&EDCF_ECWMIN_MASK;
+	ecwmax = (acparam_cur->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT;
+
+	/* Modified value */
+	if (conf->wme.aifsn[aci] > 0)
+		aifsn = conf->wme.aifsn[aci];
+	if (conf->wme.cwmin[aci] > 0)
+		ecwmin = conf->wme.cwmin[aci];
+	if (conf->wme.cwmax[aci] > 0)
+		ecwmax = conf->wme.cwmax[aci];
+
+	/* Update */
+	acp = acparam_cur;
+	acp->ACI = (acp->ACI & ~EDCF_AIFSN_MASK) | (aifsn & EDCF_AIFSN_MASK);
+	acp->ECW = ((ecwmax << EDCF_ECWMAX_SHIFT) & EDCF_ECWMAX_MASK) | (acp->ECW & EDCF_ECWMIN_MASK);
+	acp->ECW = ((acp->ECW & EDCF_ECWMAX_MASK) | (ecwmin & EDCF_ECWMIN_MASK));
+
+	CONFIG_TRACE(("%s: mod aci %d aifsn %d ecwmin %d ecwmax %d size %ld\n", __FUNCTION__,
+		acp->ACI, acp->ACI&EDCF_AIFSN_MASK,
+		acp->ECW&EDCF_ECWMIN_MASK, (acp->ECW&EDCF_ECWMAX_MASK)>>EDCF_ECWMAX_SHIFT,
+		sizeof(edcf_acparam_t)));
+
+	/*
+	* Now use buf as an output buffer.
+	* Put WME acparams after "wme_ac\0" in buf.
+	* NOTE: only one of the four ACs can be set at a time.
+	*/
+	bcm_mkiovar("wme_ac_sta", (char*)acp, sizeof(edcf_acparam_t), iovbuf,
+		sizeof(iovbuf));
+	if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+		CONFIG_ERROR(("%s: wme_ac_sta setting failed %d\n", __FUNCTION__, bcmerror));
+		return;
+	}
+}
+
+void
+dhd_conf_set_wme(dhd_pub_t *dhd)
+{
+	edcf_acparam_t acparam_cur[AC_COUNT];
+
+	if (dhd && dhd->conf) {
+		if (!dhd->conf->force_wme_ac) {
+			CONFIG_TRACE(("%s: force_wme_ac is not enabled %d\n",
+				__FUNCTION__, dhd->conf->force_wme_ac));
+			return;
+		}
+
+		CONFIG_TRACE(("%s: Before change:\n", __FUNCTION__));
+		dhd_conf_get_wme(dhd, acparam_cur);
+
+		dhd_conf_update_wme(dhd, &acparam_cur[AC_BK], AC_BK);
+		dhd_conf_update_wme(dhd, &acparam_cur[AC_BE], AC_BE);
+		dhd_conf_update_wme(dhd, &acparam_cur[AC_VI], AC_VI);
+		dhd_conf_update_wme(dhd, &acparam_cur[AC_VO], AC_VO);
+
+		CONFIG_TRACE(("%s: After change:\n", __FUNCTION__));
+		dhd_conf_get_wme(dhd, acparam_cur);
+	} else {
+		CONFIG_ERROR(("%s: dhd or conf is NULL\n", __FUNCTION__));
+	}
+
+	return;
+}
+
+void
+dhd_conf_set_stbc(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	uint stbc = 0;
+
+	if (dhd->conf->stbc >= 0) {
+		stbc = (uint)dhd->conf->stbc;
+		printf("%s: set stbc_tx %d\n", __FUNCTION__, stbc);
+		bcm_mkiovar("stbc_tx", (char *)&stbc, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: stbc_tx setting failed %d\n", __FUNCTION__, bcmerror));
+
+		printf("%s: set stbc_rx %d\n", __FUNCTION__, stbc);
+		bcm_mkiovar("stbc_rx", (char *)&stbc, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: stbc_rx setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_set_phyoclscdenable(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	uint phy_oclscdenable = 0;
+
+	if (dhd->conf->chip == BCM4324_CHIP_ID && dhd->conf->phy_oclscdenable >= 0) {
+		phy_oclscdenable = (uint)dhd->conf->phy_oclscdenable;
+		printf("%s: set stbc_tx %d\n", __FUNCTION__, phy_oclscdenable);
+		bcm_mkiovar("phy_oclscdenable", (char *)&phy_oclscdenable, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: stbc_tx setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+#ifdef PKT_FILTER_SUPPORT
+void
+dhd_conf_add_pkt_filter(dhd_pub_t *dhd)
+{
+	int i;
+
+	/*
+	 * All pkt: pkt_filter_add=99 0 0 0 0x000000000000 0x000000000000
+	 * Netbios pkt: 120 0 0 12 0xFFFF000000000000000000FF000000000000000000000000FFFF 0x0800000000000000000000110000000000000000000000000089
+	 */
+	for(i=0; i<dhd->conf->pkt_filter_add.count; i++) {
+		dhd->pktfilter[i+dhd->pktfilter_count] = dhd->conf->pkt_filter_add.filter[i];
+		printf("%s: %s\n", __FUNCTION__, dhd->pktfilter[i+dhd->pktfilter_count]);
+	}
+	dhd->pktfilter_count += i;
+}
+
+bool
+dhd_conf_del_pkt_filter(dhd_pub_t *dhd, uint32 id)
+{
+	int i;
+
+	if (dhd && dhd->conf) {
+		for (i=0; i<dhd->conf->pkt_filter_del.count; i++) {
+			if (id == dhd->conf->pkt_filter_del.id[i]) {
+				printf("%s: %d\n", __FUNCTION__, dhd->conf->pkt_filter_del.id[i]);
+				return true;
+			}
+		}
+		return false;
+	}
+	return false;
+}
+
+void
+dhd_conf_discard_pkt_filter(dhd_pub_t *dhd)
+{
+	dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = NULL;
+	dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = "101 0 0 0 0xFFFFFFFFFFFF 0xFFFFFFFFFFFF";
+	dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = "102 0 0 0 0xFFFFFF 0x01005E";
+	dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = "103 0 0 0 0xFFFF 0x3333";
+	dhd->pktfilter[DHD_MDNS_FILTER_NUM] = NULL;
+	/* Do not enable ARP to pkt filter if dhd_master_mode is false.*/
+	dhd->pktfilter[DHD_ARP_FILTER_NUM] = NULL;
+
+	/* IPv4 broadcast address XXX.XXX.XXX.255 */
+	dhd->pktfilter[dhd->pktfilter_count] = "110 0 0 12 0xFFFF00000000000000000000000000000000000000FF 0x080000000000000000000000000000000000000000FF";
+	dhd->pktfilter_count++;
+	/* discard IPv4 multicast address 224.0.0.0/4 */
+	dhd->pktfilter[dhd->pktfilter_count] = "111 0 0 12 0xFFFF00000000000000000000000000000000F0 0x080000000000000000000000000000000000E0";
+	dhd->pktfilter_count++;
+	/* discard IPv6 multicast address FF00::/8 */
+	dhd->pktfilter[dhd->pktfilter_count] = "112 0 0 12 0xFFFF000000000000000000000000000000000000000000000000FF 0x86DD000000000000000000000000000000000000000000000000FF";
+	dhd->pktfilter_count++;
+	/* discard Netbios pkt */
+	dhd->pktfilter[dhd->pktfilter_count] = "120 0 0 12 0xFFFF000000000000000000FF000000000000000000000000FFFF 0x0800000000000000000000110000000000000000000000000089";
+	dhd->pktfilter_count++;
+
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+void
+dhd_conf_set_srl(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	uint srl = 0;
+
+	if (dhd->conf->srl >= 0) {
+		srl = (uint)dhd->conf->srl;
+		printf("%s: set srl %d\n", __FUNCTION__, srl);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_SRL, &srl , sizeof(srl), true, 0)) < 0)
+			CONFIG_ERROR(("%s: WLC_SET_SRL setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_set_lrl(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	uint lrl = 0;
+
+	if (dhd->conf->lrl >= 0) {
+		lrl = (uint)dhd->conf->lrl;
+		printf("%s: set lrl %d\n", __FUNCTION__, lrl);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_LRL, &lrl , sizeof(lrl), true, 0)) < 0)
+			CONFIG_ERROR(("%s: WLC_SET_LRL setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_set_bus_txglom(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	uint32 bus_txglom = 0;
+
+	if (dhd->conf->bus_txglom) {
+		bus_txglom = (uint)dhd->conf->bus_txglom;
+		printf("%s: set bus:txglom %d\n", __FUNCTION__, bus_txglom);
+		bcm_mkiovar("bus:txglom", (char *)&bus_txglom, 4, iovbuf, sizeof(iovbuf));
+		dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: bus:txglom setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_set_ampdu_ba_wsize(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	uint32 ampdu_ba_wsize = dhd->conf->ampdu_ba_wsize;
+
+	/* Set ampdu_ba_wsize */
+	if (ampdu_ba_wsize > 0) {
+		printf("%s: set ampdu_ba_wsize %d\n", __FUNCTION__, ampdu_ba_wsize);
+		bcm_mkiovar("ampdu_ba_wsize", (char *)&ampdu_ba_wsize, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+				sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set ampdu_ba_wsize to %d failed %d\n",
+				__FUNCTION__, ampdu_ba_wsize, bcmerror));
+		}
+	}
+}
+
+void
+dhd_conf_set_spect(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	uint spect = 0;
+
+	if (dhd->conf->spect >= 0) {
+		spect = (uint)dhd->conf->spect;
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, NULL, 0, TRUE, 0)) < 0)
+			CONFIG_ERROR(("%s: WLC_DOWN setting failed %d\n", __FUNCTION__, bcmerror));
+		printf("%s: set spect %d\n", __FUNCTION__, spect);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_SPECT_MANAGMENT, &spect , sizeof(spect), true, 0)) < 0)
+			CONFIG_ERROR(("%s: WLC_SET_SPECT_MANAGMENT setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_set_txbf(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	int txbf = dhd->conf->txbf;
+
+	/* Set txbf */
+	if (txbf >= 0) {
+		printf("%s: set txbf %d\n", __FUNCTION__, txbf);
+		bcm_mkiovar("txbf", (char *)&txbf, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+				sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set txbf to %d failed %d\n",
+				__FUNCTION__, txbf, bcmerror));
+		}
+	}
+}
+
+void
+dhd_conf_set_frameburst(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	int frameburst = dhd->conf->frameburst;
+
+	/* Set txbframeburstf */
+	if (frameburst >= 0) {
+		printf("%s: set frameburst %d\n", __FUNCTION__, frameburst);
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_FAKEFRAG, &frameburst , sizeof(frameburst), true, 0)) < 0)
+			CONFIG_ERROR(("%s: WLC_SET_FAKEFRAG setting failed %d\n", __FUNCTION__, bcmerror));
+	}
+}
+
+void
+dhd_conf_set_lpc(dhd_pub_t *dhd)
+{
+	int bcmerror = -1;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	int lpc = dhd->conf->lpc;
+
+	/* Set lpc */
+	if (lpc >= 0) {
+		printf("%s: set lpc %d\n", __FUNCTION__, lpc);
+		bcm_mkiovar("lpc", (char *)&lpc, 4, iovbuf, sizeof(iovbuf));
+		if ((bcmerror = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+				sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set lpc to %d failed %d\n",
+				__FUNCTION__, lpc, bcmerror));
+		}
+	}
+}
+
+void
+dhd_conf_set_disable_proptx(dhd_pub_t *dhd)
+{
+	printf("%s: set disable_proptx %d\n", __FUNCTION__, dhd->conf->disable_proptx);
+	disable_proptx = dhd->conf->disable_proptx;
+}
+
+int
+dhd_conf_get_pm(dhd_pub_t *dhd)
+{
+	if (dhd && dhd->conf)
+		return dhd->conf->pm;
+	return -1;
+}
+
+int
+dhd_conf_get_tcpack_sup_mode(dhd_pub_t *dhd)
+{
+	if (dhd && dhd->conf)
+		return dhd->conf->tcpack_sup_mode;
+	return -1;
+}
+
+unsigned int
+process_config_vars(char *varbuf, unsigned int len, char *pickbuf, char *param)
+{
+	bool findNewline, changenewline=FALSE, pick=FALSE;
+	int column;
+	unsigned int n, pick_column=0;
+
+	findNewline = FALSE;
+	column = 0;
+
+	for (n = 0; n < len; n++) {
+		if (varbuf[n] == '\r')
+			continue;
+		if ((findNewline || changenewline) && varbuf[n] != '\n')
+			continue;
+		findNewline = FALSE;
+		if (varbuf[n] == '#') {
+			findNewline = TRUE;
+			continue;
+		}
+		if (varbuf[n] == '\\') {
+			changenewline = TRUE;
+			continue;
+		}
+		if (!changenewline && varbuf[n] == '\n') {
+			if (column == 0)
+				continue;
+			column = 0;
+			continue;
+		}
+		if (changenewline && varbuf[n] == '\n') {
+			changenewline = FALSE;
+			continue;
+		}
+		if (!memcmp(&varbuf[n], param, strlen(param)) && column==0) {
+			pick = TRUE;
+			column = strlen(param);
+			n += column;
+			pick_column = 0;
+		} else {
+			if (pick && column==0)
+				pick = FALSE;
+			else
+				column++;
+		}
+		if (pick) {
+			if (varbuf[n] == 0x9)
+				continue;
+			if (pick_column>0 && pickbuf[pick_column-1]==' ' && varbuf[n]==' ')
+				continue;
+			pickbuf[pick_column] = varbuf[n];
+			pick_column++;
+		}
+	}
+
+	return pick_column;
+}
+
+void
+dhd_conf_read_log_level(dhd_pub_t *dhd, char *bufp, uint len)
+{
+	uint len_val;
+	char pick[MAXSZ_BUF];
+
+	/* Process dhd_msglevel */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "msglevel=");
+	if (len_val) {
+		dhd_msg_level = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: dhd_msg_level = 0x%X\n", __FUNCTION__, dhd_msg_level);
+	}
+#ifdef BCMSDIO
+	/* Process sd_msglevel */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "sd_msglevel=");
+	if (len_val) {
+		sd_msglevel = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: sd_msglevel = 0x%X\n", __FUNCTION__, sd_msglevel);
+	}
+#endif
+	/* Process android_msg_level */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "android_msg_level=");
+	if (len_val) {
+		android_msg_level = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: android_msg_level = 0x%X\n", __FUNCTION__, android_msg_level);
+	}
+	/* Process config_msg_level */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "config_msg_level=");
+	if (len_val) {
+		config_msg_level = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: config_msg_level = 0x%X\n", __FUNCTION__, config_msg_level);
+	}
+#ifdef WL_CFG80211
+	/* Process wl_dbg_level */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "wl_dbg_level=");
+	if (len_val) {
+		wl_dbg_level = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: wl_dbg_level = 0x%X\n", __FUNCTION__, wl_dbg_level);
+	}
+#endif
+#if defined(WL_WIRELESS_EXT)
+	/* Process iw_msg_level */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "iw_msg_level=");
+	if (len_val) {
+		iw_msg_level = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: iw_msg_level = 0x%X\n", __FUNCTION__, iw_msg_level);
+	}
+#endif
+
+	/* Process dhd_console_ms */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "dhd_console_ms=");
+	if (len_val) {
+		dhd_console_ms = (int)simple_strtol(pick, NULL, 0);
+		printf("%s: dhd_console_ms = 0x%X\n", __FUNCTION__, dhd_console_ms);
+	}
+}
+
+void
+dhd_conf_read_wme_ac_params(dhd_pub_t *dhd, char *bufp, uint len)
+{
+	uint len_val;
+	char pick[MAXSZ_BUF];
+	struct dhd_conf *conf = dhd->conf;
+
+	/* Process WMM parameters */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "force_wme_ac=");
+	if (len_val) {
+		conf->force_wme_ac = (int)simple_strtol(pick, NULL, 10);
+		printf("%s: force_wme_ac = %d\n", __FUNCTION__, conf->force_wme_ac);
+	}
+
+	if (conf->force_wme_ac) {
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "bk_aifsn=");
+		if (len_val) {
+			conf->wme.aifsn[AC_BK] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_BK aifsn = %d\n", __FUNCTION__, conf->wme.aifsn[AC_BK]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "bk_cwmin=");
+		if (len_val) {
+			conf->wme.cwmin[AC_BK] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_BK cwmin = %d\n", __FUNCTION__, conf->wme.cwmin[AC_BK]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "bk_cwmax=");
+		if (len_val) {
+			conf->wme.cwmax[AC_BK] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_BK cwmax = %d\n", __FUNCTION__, conf->wme.cwmax[AC_BK]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "be_aifsn=");
+		if (len_val) {
+			conf->wme.aifsn[AC_BE] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_BE aifsn = %d\n", __FUNCTION__, conf->wme.aifsn[AC_BE]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "be_cwmin=");
+		if (len_val) {
+			conf->wme.cwmin[AC_BE] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_BE cwmin = %d\n", __FUNCTION__, conf->wme.cwmin[AC_BE]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "be_cwmax=");
+		if (len_val) {
+			conf->wme.cwmax[AC_BE] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_BE cwmax = %d\n", __FUNCTION__, conf->wme.cwmax[AC_BE]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "vi_aifsn=");
+		if (len_val) {
+			conf->wme.aifsn[AC_VI] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_VI aifsn = %d\n", __FUNCTION__, conf->wme.aifsn[AC_VI]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "vi_cwmin=");
+		if (len_val) {
+			conf->wme.cwmin[AC_VI] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_VI cwmin = %d\n", __FUNCTION__, conf->wme.cwmin[AC_VI]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "vi_cwmax=");
+		if (len_val) {
+			conf->wme.cwmax[AC_VI] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_VI cwmax = %d\n", __FUNCTION__, conf->wme.cwmax[AC_VI]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "vo_aifsn=");
+		if (len_val) {
+			conf->wme.aifsn[AC_VO] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_VO aifsn = %d\n", __FUNCTION__, conf->wme.aifsn[AC_VO]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "vo_cwmin=");
+		if (len_val) {
+			conf->wme.cwmin[AC_VO] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_VO cwmin = %d\n", __FUNCTION__, conf->wme.cwmin[AC_VO]);
+		}
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "vo_cwmax=");
+		if (len_val) {
+			conf->wme.cwmax[AC_VO] = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: AC_VO cwmax = %d\n", __FUNCTION__, conf->wme.cwmax[AC_VO]);
+		}
+	}
+
+}
+
+void
+dhd_conf_read_fw_by_mac(dhd_pub_t *dhd, char *bufp, uint len)
+{
+	uint len_val;
+	int i, j;
+	char pick[MAXSZ_BUF];
+	char *pch, *pick_tmp;
+	wl_mac_list_t *mac_list;
+	wl_mac_range_t *mac_range;
+	struct dhd_conf *conf = dhd->conf;
+
+	/* Process fw_by_mac:
+	 * fw_by_mac=[fw_mac_num] \
+	 *  [fw_name1] [mac_num1] [oui1-1] [nic_start1-1] [nic_end1-1] \
+	 *                                    [oui1-1] [nic_start1-1] [nic_end1-1]... \
+	 *                                    [oui1-n] [nic_start1-n] [nic_end1-n] \
+	 *  [fw_name2] [mac_num2] [oui2-1] [nic_start2-1] [nic_end2-1] \
+	 *                                    [oui2-1] [nic_start2-1] [nic_end2-1]... \
+	 *                                    [oui2-n] [nic_start2-n] [nic_end2-n] \
+	 * Ex: fw_by_mac=2 \
+	 *  fw_bcmdhd1.bin 2 0x0022F4 0xE85408 0xE8549D 0x983B16 0x3557A9 0x35582A \
+	 *  fw_bcmdhd2.bin 3 0x0022F4 0xE85408 0xE8549D 0x983B16 0x3557A9 0x35582A \
+	 *                           0x983B16 0x916157 0x916487
+	 */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "fw_by_mac=");
+	if (len_val) {
+		pick_tmp = pick;
+		pch = bcmstrtok(&pick_tmp, " ", 0);
+		conf->fw_by_mac.count = (uint32)simple_strtol(pch, NULL, 0);
+		if (!(mac_list = kmalloc(sizeof(wl_mac_list_t)*conf->fw_by_mac.count, GFP_KERNEL))) {
+			conf->fw_by_mac.count = 0;
+			CONFIG_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+		}
+		printf("%s: fw_count=%d\n", __FUNCTION__, conf->fw_by_mac.count);
+		conf->fw_by_mac.m_mac_list_head = mac_list;
+		for (i=0; i<conf->fw_by_mac.count; i++) {
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			strcpy(mac_list[i].name, pch);
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			mac_list[i].count = (uint32)simple_strtol(pch, NULL, 0);
+			printf("%s: name=%s, mac_count=%d\n", __FUNCTION__,
+				mac_list[i].name, mac_list[i].count);
+			if (!(mac_range = kmalloc(sizeof(wl_mac_range_t)*mac_list[i].count, GFP_KERNEL))) {
+				mac_list[i].count = 0;
+				CONFIG_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+				break;
+			}
+			mac_list[i].mac = mac_range;
+			for (j=0; j<mac_list[i].count; j++) {
+				pch = bcmstrtok(&pick_tmp, " ", 0);
+				mac_range[j].oui = (uint32)simple_strtol(pch, NULL, 0);
+				pch = bcmstrtok(&pick_tmp, " ", 0);
+				mac_range[j].nic_start = (uint32)simple_strtol(pch, NULL, 0);
+				pch = bcmstrtok(&pick_tmp, " ", 0);
+				mac_range[j].nic_end = (uint32)simple_strtol(pch, NULL, 0);
+				printf("%s: oui=0x%06X, nic_start=0x%06X, nic_end=0x%06X\n",
+					__FUNCTION__, mac_range[j].oui,
+					mac_range[j].nic_start, mac_range[j].nic_end);
+			}
+		}
+	}
+}
+
+void
+dhd_conf_read_nv_by_mac(dhd_pub_t *dhd, char *bufp, uint len)
+{
+	uint len_val;
+	int i, j;
+	char pick[MAXSZ_BUF];
+	char *pch, *pick_tmp;
+	wl_mac_list_t *mac_list;
+	wl_mac_range_t *mac_range;
+	struct dhd_conf *conf = dhd->conf;
+
+	/* Process nv_by_mac:
+	 * [nv_by_mac]: The same format as fw_by_mac
+	 */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "nv_by_mac=");
+	if (len_val) {
+		pick_tmp = pick;
+		pch = bcmstrtok(&pick_tmp, " ", 0);
+		conf->nv_by_mac.count = (uint32)simple_strtol(pch, NULL, 0);
+		if (!(mac_list = kmalloc(sizeof(wl_mac_list_t)*conf->nv_by_mac.count, GFP_KERNEL))) {
+			conf->nv_by_mac.count = 0;
+			CONFIG_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+		}
+		printf("%s: nv_count=%d\n", __FUNCTION__, conf->nv_by_mac.count);
+		conf->nv_by_mac.m_mac_list_head = mac_list;
+		for (i=0; i<conf->nv_by_mac.count; i++) {
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			strcpy(mac_list[i].name, pch);
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			mac_list[i].count = (uint32)simple_strtol(pch, NULL, 0);
+			printf("%s: name=%s, mac_count=%d\n", __FUNCTION__,
+				mac_list[i].name, mac_list[i].count);
+			if (!(mac_range = kmalloc(sizeof(wl_mac_range_t)*mac_list[i].count, GFP_KERNEL))) {
+				mac_list[i].count = 0;
+				CONFIG_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+				break;
+			}
+			mac_list[i].mac = mac_range;
+			for (j=0; j<mac_list[i].count; j++) {
+				pch = bcmstrtok(&pick_tmp, " ", 0);
+				mac_range[j].oui = (uint32)simple_strtol(pch, NULL, 0);
+				pch = bcmstrtok(&pick_tmp, " ", 0);
+				mac_range[j].nic_start = (uint32)simple_strtol(pch, NULL, 0);
+				pch = bcmstrtok(&pick_tmp, " ", 0);
+				mac_range[j].nic_end = (uint32)simple_strtol(pch, NULL, 0);
+				printf("%s: oui=0x%06X, nic_start=0x%06X, nic_end=0x%06X\n",
+					__FUNCTION__, mac_range[j].oui,
+					mac_range[j].nic_start, mac_range[j].nic_end);
+			}
+		}
+	}
+}
+
+void
+dhd_conf_read_nv_by_chip(dhd_pub_t *dhd, char *bufp, uint len)
+{
+	uint len_val;
+	int i;
+	char pick[MAXSZ_BUF];
+	char *pch, *pick_tmp;
+	wl_chip_nv_path_t *chip_nv_path;
+	struct dhd_conf *conf = dhd->conf;
+
+	/* Process nv_by_chip:
+	 * nv_by_chip=[nv_chip_num] \
+	 *  [chip1] [chiprev1] [nv_name1] [chip2] [chiprev2] [nv_name2] \
+	 * Ex: nv_by_chip=2 \
+	 *  43430 0 nvram_ap6212.txt 43430 1 nvram_ap6212a.txt \
+	 */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "nv_by_chip=");
+	if (len_val) {
+		pick_tmp = pick;
+		pch = bcmstrtok(&pick_tmp, " ", 0);
+		conf->nv_by_chip.count = (uint32)simple_strtol(pch, NULL, 0);
+		if (!(chip_nv_path = kmalloc(sizeof(wl_mac_list_t)*conf->nv_by_chip.count, GFP_KERNEL))) {
+			conf->nv_by_chip.count = 0;
+			CONFIG_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+		}
+		printf("%s: nv_by_chip_count=%d\n", __FUNCTION__, conf->nv_by_chip.count);
+		conf->nv_by_chip.m_chip_nv_path_head = chip_nv_path;
+		for (i=0; i<conf->nv_by_chip.count; i++) {
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			chip_nv_path[i].chip = (uint32)simple_strtol(pch, NULL, 0);
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			chip_nv_path[i].chiprev = (uint32)simple_strtol(pch, NULL, 0);
+			pch = bcmstrtok(&pick_tmp, " ", 0);
+			strcpy(chip_nv_path[i].name, pch);
+			printf("%s: chip=0x%x, chiprev=%d, name=%s\n", __FUNCTION__,
+				chip_nv_path[i].chip, chip_nv_path[i].chiprev, chip_nv_path[i].name);
+		}
+	}
+}
+
+void
+dhd_conf_read_roam_params(dhd_pub_t *dhd, char *bufp, uint len)
+{
+	uint len_val;
+	char pick[MAXSZ_BUF];
+	struct dhd_conf *conf = dhd->conf;
+
+	/* Process roam */
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "roam_off=");
+	if (len_val) {
+		if (!strncmp(pick, "0", len_val))
+			conf->roam_off = 0;
+		else
+			conf->roam_off = 1;
+		printf("%s: roam_off = %d\n", __FUNCTION__, conf->roam_off);
+	}
+
+	memset(pick, 0, MAXSZ_BUF);
+	len_val = process_config_vars(bufp, len, pick, "roam_off_suspend=");
+	if (len_val) {
+		if (!strncmp(pick, "0", len_val))
+			conf->roam_off_suspend = 0;
+		else
+			conf->roam_off_suspend = 1;
+		printf("%s: roam_off_suspend = %d\n", __FUNCTION__,
+			conf->roam_off_suspend);
+	}
+
+	if (!conf->roam_off || !conf->roam_off_suspend) {
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "roam_trigger=");
+		if (len_val)
+			conf->roam_trigger[0] = (int)simple_strtol(pick, NULL, 10);
+		printf("%s: roam_trigger = %d\n", __FUNCTION__,
+			conf->roam_trigger[0]);
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "roam_scan_period=");
+		if (len_val)
+			conf->roam_scan_period[0] = (int)simple_strtol(pick, NULL, 10);
+		printf("%s: roam_scan_period = %d\n", __FUNCTION__,
+			conf->roam_scan_period[0]);
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "roam_delta=");
+		if (len_val)
+			conf->roam_delta[0] = (int)simple_strtol(pick, NULL, 10);
+		printf("%s: roam_delta = %d\n", __FUNCTION__, conf->roam_delta[0]);
+
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "fullroamperiod=");
+		if (len_val)
+			conf->fullroamperiod = (int)simple_strtol(pick, NULL, 10);
+		printf("%s: fullroamperiod = %d\n", __FUNCTION__,
+			conf->fullroamperiod);
+	}
+
+}
+
+int
+dhd_conf_read_config(dhd_pub_t *dhd, char *conf_path)
+{
+	int bcmerror = -1, i;
+	uint len, len_val;
+	void * image = NULL;
+	char * memblock = NULL;
+	char *bufp, pick[MAXSZ_BUF], *pch, *pick_tmp;
+	bool conf_file_exists;
+	struct dhd_conf *conf = dhd->conf;
+
+	conf_file_exists = ((conf_path != NULL) && (conf_path[0] != '\0'));
+	if (!conf_file_exists) {
+		printk("%s: config path %s\n", __FUNCTION__, conf_path);
+		return (0);
+	}
+
+	if (conf_file_exists) {
+		image = dhd_os_open_image(conf_path);
+		if (image == NULL) {
+			printk("%s: Ignore config file %s\n", __FUNCTION__, conf_path);
+			goto err;
+		}
+	}
+
+	memblock = MALLOC(dhd->osh, MAXSZ_CONFIG);
+	if (memblock == NULL) {
+		CONFIG_ERROR(("%s: Failed to allocate memory %d bytes\n",
+			__FUNCTION__, MAXSZ_CONFIG));
+		goto err;
+	}
+
+	/* Read variables */
+	if (conf_file_exists) {
+		len = dhd_os_get_image_block(memblock, MAXSZ_CONFIG, image);
+	}
+	if (len > 0 && len < MAXSZ_CONFIG) {
+		bufp = (char *)memblock;
+		bufp[len] = 0;
+
+		/* Process log_level */
+		dhd_conf_read_log_level(dhd, bufp, len);
+		dhd_conf_read_roam_params(dhd, bufp, len);
+		dhd_conf_read_wme_ac_params(dhd, bufp, len);
+		dhd_conf_read_fw_by_mac(dhd, bufp, len);
+		dhd_conf_read_nv_by_mac(dhd, bufp, len);
+		dhd_conf_read_nv_by_chip(dhd, bufp, len);
+
+		/* Process band:
+		 * band=a for 5GHz only and band=b for 2.4GHz only
+		 */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "band=");
+		if (len_val) {
+			if (!strncmp(pick, "b", len_val))
+				conf->band = WLC_BAND_2G;
+			else if (!strncmp(pick, "a", len_val))
+				conf->band = WLC_BAND_5G;
+			else
+				conf->band = WLC_BAND_AUTO;
+			printf("%s: band = %d\n", __FUNCTION__, conf->band);
+		}
+
+		/* Process bandwidth */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "mimo_bw_cap=");
+		if (len_val) {
+			conf->mimo_bw_cap = (uint)simple_strtol(pick, NULL, 10);
+			printf("%s: mimo_bw_cap = %d\n", __FUNCTION__, conf->mimo_bw_cap);
+		}
+
+		/* Process country code */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "ccode=");
+		if (len_val) {
+			memset(&conf->cspec, 0, sizeof(wl_country_t));
+			memcpy(conf->cspec.country_abbrev, pick, len_val);
+			memcpy(conf->cspec.ccode, pick, len_val);
+			memset(pick, 0, MAXSZ_BUF);
+			len_val = process_config_vars(bufp, len, pick, "regrev=");
+			if (len_val)
+				conf->cspec.rev = (int32)simple_strtol(pick, NULL, 10);
+		}
+
+		/* Process channels */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "channels=");
+		pick_tmp = pick;
+		if (len_val) {
+			pch = bcmstrtok(&pick_tmp, " ,.-", 0);
+			i=0;
+			while (pch != NULL && i<WL_NUMCHANNELS) {
+				conf->channels.channel[i] = (uint32)simple_strtol(pch, NULL, 10);
+				pch = bcmstrtok(&pick_tmp, " ,.-", 0);
+				i++;
+			}
+			conf->channels.count = i;
+			printf("%s: channels = ", __FUNCTION__);
+			for (i=0; i<conf->channels.count; i++)
+				printf("%d ", conf->channels.channel[i]);
+			printf("\n");
+		}
+
+		/* Process keep alive period */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "keep_alive_period=");
+		if (len_val) {
+			conf->keep_alive_period = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: keep_alive_period = %d\n", __FUNCTION__,
+				conf->keep_alive_period);
+		}
+
+		/* Process STBC parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "stbc=");
+		if (len_val) {
+			conf->stbc = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: stbc = %d\n", __FUNCTION__, conf->stbc);
+		}
+
+		/* Process phy_oclscdenable parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "phy_oclscdenable=");
+		if (len_val) {
+			conf->phy_oclscdenable = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: phy_oclscdenable = %d\n", __FUNCTION__, conf->phy_oclscdenable);
+		}
+
+#ifdef BCMSDIO
+		/* Process dhd_doflow parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "dhd_doflow=");
+		if (len_val) {
+			if (!strncmp(pick, "0", len_val))
+				dhd_doflow = FALSE;
+			else
+				dhd_doflow = TRUE;
+			printf("%s: dhd_doflow = %d\n", __FUNCTION__, dhd_doflow);
+		}
+#endif
+
+		/* Process dhd_master_mode parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "dhd_master_mode=");
+		if (len_val) {
+			if (!strncmp(pick, "0", len_val))
+				dhd_master_mode = FALSE;
+			else
+				dhd_master_mode = TRUE;
+			printf("%s: dhd_master_mode = %d\n", __FUNCTION__, dhd_master_mode);
+		}
+
+#ifdef PKT_FILTER_SUPPORT
+		/* Process pkt_filter_add:
+		 * All pkt: pkt_filter_add=99 0 0 0 0x000000000000 0x000000000000
+		 */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "pkt_filter_add=");
+		pick_tmp = pick;
+		if (len_val) {
+			pch = bcmstrtok(&pick_tmp, ",.-", 0);
+			i=0;
+			while (pch != NULL && i<DHD_CONF_FILTER_MAX) {
+				strcpy(&conf->pkt_filter_add.filter[i][0], pch);
+				printf("%s: pkt_filter_add[%d][] = %s\n", __FUNCTION__, i, &conf->pkt_filter_add.filter[i][0]);
+				pch = bcmstrtok(&pick_tmp, ",.-", 0);
+				i++;
+			}
+			conf->pkt_filter_add.count = i;
+		}
+
+		/* Process pkt_filter_del */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "pkt_filter_del=");
+		pick_tmp = pick;
+		if (len_val) {
+			pch = bcmstrtok(&pick_tmp, " ,.-", 0);
+			i=0;
+			while (pch != NULL && i<DHD_CONF_FILTER_MAX) {
+				conf->pkt_filter_del.id[i] = (uint32)simple_strtol(pch, NULL, 10);
+				pch = bcmstrtok(&pick_tmp, " ,.-", 0);
+				i++;
+			}
+			conf->pkt_filter_del.count = i;
+			printf("%s: pkt_filter_del id = ", __FUNCTION__);
+			for (i=0; i<conf->pkt_filter_del.count; i++)
+				printf("%d ", conf->pkt_filter_del.id[i]);
+			printf("\n");
+		}
+#endif
+
+		/* Process srl parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "srl=");
+		if (len_val) {
+			conf->srl = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: srl = %d\n", __FUNCTION__, conf->srl);
+		}
+
+		/* Process lrl parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "lrl=");
+		if (len_val) {
+			conf->lrl = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: lrl = %d\n", __FUNCTION__, conf->lrl);
+		}
+
+		/* Process beacon timeout parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "bcn_timeout=");
+		if (len_val) {
+			conf->bcn_timeout= (int)simple_strtol(pick, NULL, 10);
+			printf("%s: bcn_timeout = %d\n", __FUNCTION__, conf->bcn_timeout);
+		}
+
+		/* Process bus:txglom */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "bus:txglom=");
+		if (len_val) {
+			conf->bus_txglom = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: bus:txglom = %d\n", __FUNCTION__, conf->bus_txglom);
+		}
+
+		/* Process ampdu_ba_wsize parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "ampdu_ba_wsize=");
+		if (len_val) {
+			conf->ampdu_ba_wsize = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: ampdu_ba_wsize = %d\n", __FUNCTION__, conf->ampdu_ba_wsize);
+		}
+
+		/* Process kso_enable parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "kso_enable=");
+		if (len_val) {
+			if (!strncmp(pick, "0", len_val))
+				conf->kso_enable = FALSE;
+			else
+				conf->kso_enable = TRUE;
+			printf("%s: kso_enable = %d\n", __FUNCTION__, conf->kso_enable);
+		}
+
+		/* Process spect parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "spect=");
+		if (len_val) {
+			conf->spect = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: spect = %d\n", __FUNCTION__, conf->spect);
+		}
+
+		/* Process txbf parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "txbf=");
+		if (len_val) {
+			conf->txbf = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: txbf = %d\n", __FUNCTION__, conf->txbf);
+		}
+
+		/* Process frameburst parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "frameburst=");
+		if (len_val) {
+			conf->frameburst = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: frameburst = %d\n", __FUNCTION__, conf->frameburst);
+		}
+
+		/* Process lpc parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "lpc=");
+		if (len_val) {
+			conf->lpc = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: lpc = %d\n", __FUNCTION__, conf->lpc);
+		}
+
+		/* Process use_rxchain parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "use_rxchain=");
+		if (len_val) {
+			conf->use_rxchain = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: use_rxchain = %d\n", __FUNCTION__, conf->use_rxchain);
+		}
+
+		/* Process txglomsize parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "txglomsize=");
+		if (len_val) {
+			conf->txglomsize = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: txglomsize = %d\n", __FUNCTION__, conf->txglomsize);
+		}
+
+		/* Process disable_proptx parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "disable_proptx=");
+		if (len_val) {
+			dhd->conf->disable_proptx = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: disable_proptx = %d\n", __FUNCTION__, dhd->conf->disable_proptx);
+		}
+
+		/* Process dpc_cpucore parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "dpc_cpucore=");
+		if (len_val) {
+			conf->dpc_cpucore = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: dpc_cpucore = %d\n", __FUNCTION__, conf->dpc_cpucore);
+		}
+
+		/* Process bus:rxglom parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "bus:rxglom=");
+		if (len_val) {
+			if (!strncmp(pick, "0", len_val))
+				conf->bus_rxglom = FALSE;
+			else
+				conf->bus_rxglom = TRUE;
+			printf("%s: bus:rxglom = %d\n", __FUNCTION__, conf->bus_rxglom);
+		}
+
+		/* Process deepsleep parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "deepsleep=");
+		if (len_val) {
+			if (!strncmp(pick, "1", len_val))
+				conf->deepsleep = TRUE;
+			else
+				conf->deepsleep = FALSE;
+			printf("%s: deepsleep = %d\n", __FUNCTION__, conf->deepsleep);
+		}
+
+		/* Process PM parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "PM=");
+		if (len_val) {
+			conf->pm = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: PM = %d\n", __FUNCTION__, conf->pm);
+		}
+
+		/* Process tcpack_sup_mode parameters */
+		memset(pick, 0, MAXSZ_BUF);
+		len_val = process_config_vars(bufp, len, pick, "tcpack_sup_mode=");
+		if (len_val) {
+			conf->tcpack_sup_mode = (int)simple_strtol(pick, NULL, 10);
+			printf("%s: tcpack_sup_mode = %d\n", __FUNCTION__, conf->tcpack_sup_mode);
+		}
+
+		bcmerror = 0;
+	} else {
+		CONFIG_ERROR(("%s: error reading config file: %d\n", __FUNCTION__, len));
+		bcmerror = BCME_SDIO_ERROR;
+	}
+
+err:
+	if (memblock)
+		MFREE(dhd->osh, memblock, MAXSZ_CONFIG);
+
+	if (image)
+		dhd_os_close_image(image);
+
+	return bcmerror;
+}
+
+int
+dhd_conf_set_chiprev(dhd_pub_t *dhd, uint chip, uint chiprev)
+{
+	printf("%s: chip=0x%x, chiprev=%d\n", __FUNCTION__, chip, chiprev);
+	dhd->conf->chip = chip;
+	dhd->conf->chiprev = chiprev;
+	return 0;
+}
+
+uint
+dhd_conf_get_chip(void *context)
+{
+	dhd_pub_t *dhd = context;
+
+	if (dhd && dhd->conf)
+		return dhd->conf->chip;
+	return 0;
+}
+
+uint
+dhd_conf_get_chiprev(void *context)
+{
+	dhd_pub_t *dhd = context;
+
+	if (dhd && dhd->conf)
+		return dhd->conf->chiprev;
+	return 0;
+}
+
+int
+dhd_conf_preinit(dhd_pub_t *dhd)
+{
+	struct dhd_conf *conf = dhd->conf;
+
+	CONFIG_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BCMSDIO
+	dhd_conf_free_mac_list(&conf->fw_by_mac);
+	dhd_conf_free_mac_list(&conf->nv_by_mac);
+	dhd_conf_free_chip_nv_path_list(&conf->nv_by_chip);
+#endif
+	conf->band = WLC_BAND_AUTO;
+	conf->mimo_bw_cap = -1;
+	if (conf->chip == BCM43362_CHIP_ID || conf->chip == BCM4330_CHIP_ID) {
+		strcpy(conf->cspec.country_abbrev, "ALL");
+		strcpy(conf->cspec.ccode, "ALL");
+		conf->cspec.rev = 0;
+	} else if (conf->chip == BCM4335_CHIP_ID || conf->chip == BCM4339_CHIP_ID ||
+			conf->chip == BCM4354_CHIP_ID || conf->chip == BCM4356_CHIP_ID ||
+			conf->chip == BCM4345_CHIP_ID || conf->chip == BCM4371_CHIP_ID) {
+		strcpy(conf->cspec.country_abbrev, "CN");
+		strcpy(conf->cspec.ccode, "CN");
+		conf->cspec.rev = 38;
+	} else {
+		strcpy(conf->cspec.country_abbrev, "CN");
+		strcpy(conf->cspec.ccode, "CN");
+		conf->cspec.rev = 0;
+	}
+	memset(&conf->channels, 0, sizeof(wl_channel_list_t));
+	conf->roam_off = 1;
+	conf->roam_off_suspend = 1;
+#ifdef CUSTOM_ROAM_TRIGGER_SETTING
+	conf->roam_trigger[0] = CUSTOM_ROAM_TRIGGER_SETTING;
+#else
+	conf->roam_trigger[0] = -65;
+#endif
+	conf->roam_trigger[1] = WLC_BAND_ALL;
+	conf->roam_scan_period[0] = 10;
+	conf->roam_scan_period[1] = WLC_BAND_ALL;
+#ifdef CUSTOM_ROAM_DELTA_SETTING
+	conf->roam_delta[0] = CUSTOM_ROAM_DELTA_SETTING;
+#else
+	conf->roam_delta[0] = 15;
+#endif
+	conf->roam_delta[1] = WLC_BAND_ALL;
+#ifdef FULL_ROAMING_SCAN_PERIOD_60_SEC
+	conf->fullroamperiod = 60;
+#else /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+	conf->fullroamperiod = 120;
+#endif /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+#ifdef CUSTOM_KEEP_ALIVE_SETTING
+	conf->keep_alive_period = CUSTOM_KEEP_ALIVE_SETTING;
+#else
+	conf->keep_alive_period = 28000;
+#endif
+	conf->force_wme_ac = 0;
+	conf->stbc = -1;
+	conf->phy_oclscdenable = -1;
+#ifdef PKT_FILTER_SUPPORT
+	memset(&conf->pkt_filter_add, 0, sizeof(conf_pkt_filter_add_t));
+	memset(&conf->pkt_filter_del, 0, sizeof(conf_pkt_filter_del_t));
+#endif
+	conf->srl = -1;
+	conf->lrl = -1;
+	conf->bcn_timeout = 15;
+	conf->kso_enable = TRUE;
+	conf->spect = -1;
+	conf->txbf = -1;
+	conf->lpc = -1;
+	conf->disable_proptx = 0;
+	conf->bus_txglom = 0;
+	conf->use_rxchain = 1;
+	conf->bus_rxglom = TRUE;
+	conf->txglomsize = -1;
+	conf->ampdu_ba_wsize = 0;
+	conf->dpc_cpucore = 0;
+	conf->frameburst = -1;
+	conf->deepsleep = FALSE;
+	conf->pm = -1;
+	conf->tcpack_sup_mode = TCPACK_SUP_OFF;
+	if ((conf->chip == BCM43362_CHIP_ID) || (conf->chip == BCM4330_CHIP_ID)) {
+		conf->disable_proptx = 1;
+		conf->use_rxchain = 0;
+	}
+	if (conf->chip == BCM43430_CHIP_ID) {
+		conf->bus_rxglom = FALSE;
+		conf->use_rxchain = 0;
+	}
+	if (conf->chip == BCM4339_CHIP_ID) {
+		conf->txbf = 1;
+	}
+	if (conf->chip == BCM4345_CHIP_ID) {
+		conf->txbf = 1;
+	}
+	if (conf->chip == BCM4354_CHIP_ID) {
+		conf->txbf = 1;
+	}
+	if (conf->chip == BCM4356_CHIP_ID) {
+		conf->txbf = 1;
+	}
+	if (conf->chip == BCM4371_CHIP_ID) {
+		conf->txbf = 1;
+	}
+#ifdef BCMSDIO
+	if (conf->chip == BCM4356_CHIP_ID) {
+		conf->txbf = 1;
+	}
+#elif defined(BCMPCIE)
+	if (conf->chip == BCM4356_CHIP_ID) {
+		conf->txbf = 1;
+	}
+#endif
+
+	return 0;
+}
+
+int
+dhd_conf_reset(dhd_pub_t *dhd)
+{
+#ifdef BCMSDIO
+	dhd_conf_free_mac_list(&dhd->conf->fw_by_mac);
+	dhd_conf_free_mac_list(&dhd->conf->nv_by_mac);
+	dhd_conf_free_chip_nv_path_list(&dhd->conf->nv_by_chip);
+#endif
+	memset(dhd->conf, 0, sizeof(dhd_conf_t));
+	return 0;
+}
+
+int
+dhd_conf_attach(dhd_pub_t *dhd)
+{
+	dhd_conf_t *conf;
+
+	CONFIG_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (dhd->conf != NULL) {
+		printf("%s: config is attached before!\n", __FUNCTION__);
+		return 0;
+	}
+	/* Allocate private bus interface state */
+	if (!(conf = MALLOC(dhd->osh, sizeof(dhd_conf_t)))) {
+		CONFIG_ERROR(("%s: MALLOC failed\n", __FUNCTION__));
+		goto fail;
+	}
+	memset(conf, 0, sizeof(dhd_conf_t));
+
+	dhd->conf = conf;
+
+	return 0;
+
+fail:
+	if (conf != NULL)
+		MFREE(dhd->osh, conf, sizeof(dhd_conf_t));
+	return BCME_NOMEM;
+}
+
+void
+dhd_conf_detach(dhd_pub_t *dhd)
+{
+	CONFIG_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (dhd->conf) {
+#ifdef BCMSDIO
+		dhd_conf_free_mac_list(&dhd->conf->fw_by_mac);
+		dhd_conf_free_mac_list(&dhd->conf->nv_by_mac);
+		dhd_conf_free_chip_nv_path_list(&dhd->conf->nv_by_chip);
+#endif
+		MFREE(dhd->osh, dhd->conf, sizeof(dhd_conf_t));
+	}
+	dhd->conf = NULL;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_config.h b/drivers/net/wireless/bcm4336/dhd_config.h
--- a/drivers/net/wireless/bcm4336/dhd_config.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_config.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,178 @@
+
+#ifndef _dhd_config_
+#define _dhd_config_
+
+#include <bcmdevs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <wlioctl.h>
+#include <proto/802.11.h>
+
+#define FW_PATH_AUTO_SELECT 1
+extern char firmware_path[MOD_PARAM_PATHLEN];
+extern int disable_proptx;
+#ifdef BCMSDIO
+extern uint dhd_doflow;
+#endif
+
+/* mac range */
+typedef struct wl_mac_range {
+	uint32 oui;
+	uint32 nic_start;
+	uint32 nic_end;
+} wl_mac_range_t;
+
+/* mac list */
+typedef struct wl_mac_list {
+	int count;
+	wl_mac_range_t *mac;
+	char name[MOD_PARAM_PATHLEN];		/* path */
+} wl_mac_list_t;
+
+/* mac list head */
+typedef struct wl_mac_list_ctrl {
+	int count;
+	struct wl_mac_list *m_mac_list_head;
+} wl_mac_list_ctrl_t;
+
+/* chip_nv_path */
+typedef struct wl_chip_nv_path {
+	uint chip;
+	uint chiprev;
+	char name[MOD_PARAM_PATHLEN];		/* path */
+} wl_chip_nv_path_t;
+
+/* chip_nv_path list head */
+typedef struct wl_chip_nv_path_list_ctrl {
+	int count;
+	struct wl_chip_nv_path *m_chip_nv_path_head;
+} wl_chip_nv_path_list_ctrl_t;
+
+/* channel list */
+typedef struct wl_channel_list {
+	/* in - # of channels, out - # of entries */
+	uint32 count;
+	/* variable length channel list */
+	uint32 channel[WL_NUMCHANNELS];
+} wl_channel_list_t;
+
+typedef struct wmes_param {
+	int aifsn[AC_COUNT];
+	int cwmin[AC_COUNT];
+	int cwmax[AC_COUNT];
+} wme_param_t;
+
+#ifdef PKT_FILTER_SUPPORT
+#define DHD_CONF_FILTER_MAX	8
+/* filter list */
+#define PKT_FILTER_LEN 300
+typedef struct conf_pkt_filter_add {
+	/* in - # of channels, out - # of entries */
+	uint32 count;
+	/* variable length filter list */
+	char filter[DHD_CONF_FILTER_MAX][PKT_FILTER_LEN];
+} conf_pkt_filter_add_t;
+
+/* pkt_filter_del list */
+typedef struct conf_pkt_filter_del {
+	/* in - # of channels, out - # of entries */
+	uint32 count;
+	/* variable length filter list */
+	uint32 id[DHD_CONF_FILTER_MAX];
+} conf_pkt_filter_del_t;
+#endif
+
+typedef struct dhd_conf {
+	uint	chip;			/* chip number */
+	uint	chiprev;		/* chip revision */
+	wl_mac_list_ctrl_t fw_by_mac;	/* Firmware auto selection by MAC */
+	wl_mac_list_ctrl_t nv_by_mac;	/* NVRAM auto selection by MAC */
+	wl_chip_nv_path_list_ctrl_t nv_by_chip;	/* NVRAM auto selection by chip */
+	uint band;			/* Band, b:2.4G only, otherwise for auto */
+	int mimo_bw_cap;			/* Bandwidth, 0:HT20ALL, 1: HT40ALL, 2:HT20IN2G_HT40PIN5G */
+	wl_country_t cspec;		/* Country */
+	wl_channel_list_t channels;	/* Support channels */
+	uint roam_off;		/* Roaming, 0:enable, 1:disable */
+	uint roam_off_suspend;		/* Roaming in suspend, 0:enable, 1:disable */
+	int roam_trigger[2];		/* The RSSI threshold to trigger roaming */
+	int roam_scan_period[2];	/* Roaming scan period */
+	int roam_delta[2];			/* Roaming candidate qualification delta */
+	int fullroamperiod;			/* Full Roaming period */
+	uint keep_alive_period;		/* The perioid in ms to send keep alive packet */
+	uint force_wme_ac;
+	wme_param_t wme;	/* WME parameters */
+	int stbc;			/* STBC for Tx/Rx */
+	int phy_oclscdenable;		/* phy_oclscdenable */
+#ifdef PKT_FILTER_SUPPORT
+	conf_pkt_filter_add_t pkt_filter_add;		/* Packet filter add */
+	conf_pkt_filter_del_t pkt_filter_del;		/* Packet filter add */
+#endif
+	int srl;	/* short retry limit */
+	int lrl;	/* long retry limit */
+	uint bcn_timeout;	/* beacon timeout */
+	bool kso_enable;
+	int spect;
+	int txbf;
+	int lpc;
+	int disable_proptx;
+	uint32 bus_txglom;	/* bus:txglom */
+	int use_rxchain;
+	bool bus_rxglom;	/* bus:rxglom */
+	int txglomsize;
+	uint32 ampdu_ba_wsize;
+	int dpc_cpucore;
+	int frameburst;
+	bool deepsleep;
+	int pm;
+	uint8 tcpack_sup_mode;
+} dhd_conf_t;
+
+#ifdef BCMSDIO
+int dhd_conf_get_mac(dhd_pub_t *dhd, bcmsdh_info_t *sdh, uint8 *mac);
+void dhd_conf_set_fw_name_by_mac(dhd_pub_t *dhd, bcmsdh_info_t *sdh, char *fw_path);
+void dhd_conf_set_nv_name_by_mac(dhd_pub_t *dhd, bcmsdh_info_t *sdh, char *nv_path);
+#if defined(HW_OOB)
+void dhd_conf_set_hw_oob_intr(bcmsdh_info_t *sdh, uint chip);
+#endif
+#endif
+void dhd_conf_set_fw_name_by_chip(dhd_pub_t *dhd, char *fw_path);
+void dhd_conf_set_nv_name_by_chip(dhd_pub_t *dhd, char *nv_path);
+void dhd_conf_set_conf_path_by_nv_path(dhd_pub_t *dhd, char *conf_path, char *nv_path);
+int dhd_conf_set_band(dhd_pub_t *dhd);
+uint dhd_conf_get_band(dhd_pub_t *dhd);
+int dhd_conf_set_country(dhd_pub_t *dhd);
+int dhd_conf_get_country(dhd_pub_t *dhd, wl_country_t *cspec);
+int dhd_conf_fix_country(dhd_pub_t *dhd);
+bool dhd_conf_match_channel(dhd_pub_t *dhd, uint32 channel);
+int dhd_conf_set_roam(dhd_pub_t *dhd);
+void dhd_conf_set_mimo_bw_cap(dhd_pub_t *dhd);
+void dhd_conf_force_wme(dhd_pub_t *dhd);
+void dhd_conf_get_wme(dhd_pub_t *dhd, edcf_acparam_t *acp);
+void dhd_conf_set_wme(dhd_pub_t *dhd);
+void dhd_conf_set_stbc(dhd_pub_t *dhd);
+void dhd_conf_set_phyoclscdenable(dhd_pub_t *dhd);
+void dhd_conf_add_pkt_filter(dhd_pub_t *dhd);
+bool dhd_conf_del_pkt_filter(dhd_pub_t *dhd, uint32 id);
+void dhd_conf_discard_pkt_filter(dhd_pub_t *dhd);
+void dhd_conf_set_srl(dhd_pub_t *dhd);
+void dhd_conf_set_lrl(dhd_pub_t *dhd);
+void dhd_conf_set_bus_txglom(dhd_pub_t *dhd);
+void dhd_conf_set_ampdu_ba_wsize(dhd_pub_t *dhd);
+void dhd_conf_set_spect(dhd_pub_t *dhd);
+void dhd_conf_set_txbf(dhd_pub_t *dhd);
+void dhd_conf_set_frameburst(dhd_pub_t *dhd);
+void dhd_conf_set_lpc(dhd_pub_t *dhd);
+void dhd_conf_set_disable_proptx(dhd_pub_t *dhd);
+int dhd_conf_read_config(dhd_pub_t *dhd, char *conf_path);
+int dhd_conf_set_chiprev(dhd_pub_t *dhd, uint chip, uint chiprev);
+uint dhd_conf_get_chip(void *context);
+uint dhd_conf_get_chiprev(void *context);
+int dhd_conf_get_pm(dhd_pub_t *dhd);
+int dhd_conf_get_tcpack_sup_mode(dhd_pub_t *dhd);
+int dhd_conf_preinit(dhd_pub_t *dhd);
+int dhd_conf_reset(dhd_pub_t *dhd);
+int dhd_conf_attach(dhd_pub_t *dhd);
+void dhd_conf_detach(dhd_pub_t *dhd);
+void *dhd_get_pub(struct net_device *dev);
+
+#endif /* _dhd_config_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_custom_gpio.c b/drivers/net/wireless/bcm4336/dhd_custom_gpio.c
--- a/drivers/net/wireless/bcm4336/dhd_custom_gpio.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_custom_gpio.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,422 @@
+/*
+* Customer code to add GPIO control during WLAN start/stop
+* $Copyright Open Broadcom Corporation$
+*
+* $Id: dhd_custom_gpio.c 493822 2014-07-29 13:20:26Z $
+*/
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+
+#include <wlioctl.h>
+#include <wl_iw.h>
+
+#define WL_ERROR(x) printf x
+#define WL_TRACE(x)
+
+#if defined(CUSTOMER_HW2)
+
+#if defined(PLATFORM_MPS)
+int __attribute__ ((weak)) wifi_get_fw_nv_path(char *fw, char *nv) { return 0;};
+#endif
+
+#endif
+
+#if defined(OOB_INTR_ONLY)
+
+#if defined(BCMLXSDMMC)
+extern int sdioh_mmc_irq(int irq);
+#endif /* (BCMLXSDMMC)  */
+
+#if defined(CUSTOMER_HW3) || defined(PLATFORM_MPS)
+#include <mach/gpio.h>
+#endif
+
+/* Customer specific Host GPIO defintion  */
+static int dhd_oob_gpio_num = -1;
+
+module_param(dhd_oob_gpio_num, int, 0644);
+MODULE_PARM_DESC(dhd_oob_gpio_num, "DHD oob gpio number");
+
+/* This function will return:
+ *  1) return :  Host gpio interrupt number per customer platform
+ *  2) irq_flags_ptr : Type of Host interrupt as Level or Edge
+ *
+ *  NOTE :
+ *  Customer should check his platform definitions
+ *  and his Host Interrupt spec
+ *  to figure out the proper setting for his platform.
+ *  Broadcom provides just reference settings as example.
+ *
+ */
+int dhd_customer_oob_irq_map(void *adapter, unsigned long *irq_flags_ptr)
+{
+	int  host_oob_irq = 0;
+
+#if defined(CUSTOMER_HW2) && !defined(PLATFORM_MPS)
+	host_oob_irq = wifi_platform_get_irq_number(adapter, irq_flags_ptr);
+
+#else
+#if defined(CUSTOM_OOB_GPIO_NUM)
+	if (dhd_oob_gpio_num < 0) {
+		dhd_oob_gpio_num = CUSTOM_OOB_GPIO_NUM;
+	}
+#endif /* CUSTOMER_OOB_GPIO_NUM */
+
+	if (dhd_oob_gpio_num < 0) {
+		WL_ERROR(("%s: ERROR customer specific Host GPIO is NOT defined \n",
+		__FUNCTION__));
+		return (dhd_oob_gpio_num);
+	}
+
+	WL_ERROR(("%s: customer specific Host GPIO number is (%d)\n",
+	         __FUNCTION__, dhd_oob_gpio_num));
+
+#if defined CUSTOMER_HW3 || defined(PLATFORM_MPS)
+	gpio_request(dhd_oob_gpio_num, "oob irq");
+	host_oob_irq = gpio_to_irq(dhd_oob_gpio_num);
+	gpio_direction_input(dhd_oob_gpio_num);
+#endif /* defined CUSTOMER_HW3 || defined(PLATFORM_MPS) */
+#endif
+
+	return (host_oob_irq);
+}
+#endif
+
+/* Customer function to control hw specific wlan gpios */
+int
+dhd_customer_gpio_wlan_ctrl(void *adapter, int onoff)
+{
+	int err = 0;
+
+	return err;
+}
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+/* Function to get custom MAC address */
+int
+dhd_custom_get_mac_address(void *adapter, unsigned char *buf)
+{
+	int ret = 0;
+
+	WL_TRACE(("%s Enter\n", __FUNCTION__));
+	if (!buf)
+		return -EINVAL;
+
+	/* Customer access to MAC address stored outside of DHD driver */
+#if (defined(CUSTOMER_HW2) || defined(CUSTOMER_HW10)) && (LINUX_VERSION_CODE >= \
+	KERNEL_VERSION(2, 6, 35))
+	ret = wifi_platform_get_mac_addr(adapter, buf);
+#endif
+
+#ifdef EXAMPLE_GET_MAC
+	/* EXAMPLE code */
+	{
+		struct ether_addr ea_example = {{0x00, 0x11, 0x22, 0x33, 0x44, 0xFF}};
+		bcopy((char *)&ea_example, buf, sizeof(struct ether_addr));
+	}
+#endif /* EXAMPLE_GET_MAC */
+
+	return ret;
+}
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+/* Customized Locale table : OPTIONAL feature */
+const struct cntry_locales_custom translate_custom_table[] = {
+/* Table should be filled out based on custom platform regulatory requirement */
+#ifdef EXAMPLE_TABLE
+	{"",   "XY", 4},  /* Universal if Country code is unknown or empty */
+	{"US", "US", 69}, /* input ISO "US" to : US regrev 69 */
+	{"CA", "US", 69}, /* input ISO "CA" to : US regrev 69 */
+	{"EU", "EU", 5},  /* European union countries to : EU regrev 05 */
+	{"AT", "EU", 5},
+	{"BE", "EU", 5},
+	{"BG", "EU", 5},
+	{"CY", "EU", 5},
+	{"CZ", "EU", 5},
+	{"DK", "EU", 5},
+	{"EE", "EU", 5},
+	{"FI", "EU", 5},
+	{"FR", "EU", 5},
+	{"DE", "EU", 5},
+	{"GR", "EU", 5},
+	{"HU", "EU", 5},
+	{"IE", "EU", 5},
+	{"IT", "EU", 5},
+	{"LV", "EU", 5},
+	{"LI", "EU", 5},
+	{"LT", "EU", 5},
+	{"LU", "EU", 5},
+	{"MT", "EU", 5},
+	{"NL", "EU", 5},
+	{"PL", "EU", 5},
+	{"PT", "EU", 5},
+	{"RO", "EU", 5},
+	{"SK", "EU", 5},
+	{"SI", "EU", 5},
+	{"ES", "EU", 5},
+	{"SE", "EU", 5},
+	{"GB", "EU", 5},
+	{"KR", "XY", 3},
+	{"AU", "XY", 3},
+	{"CN", "XY", 3}, /* input ISO "CN" to : XY regrev 03 */
+	{"TW", "XY", 3},
+	{"AR", "XY", 3},
+	{"MX", "XY", 3},
+	{"IL", "IL", 0},
+	{"CH", "CH", 0},
+	{"TR", "TR", 0},
+	{"NO", "NO", 0},
+#endif /* EXMAPLE_TABLE */
+#if defined(CUSTOMER_HW2) && !defined(CUSTOMER_HW5)
+#if defined(BCM4335_CHIP)
+	{"",   "XZ", 11},  /* Universal if Country code is unknown or empty */
+#endif
+	{"AE", "AE", 1},
+	{"AR", "AR", 1},
+	{"AT", "AT", 1},
+	{"AU", "AU", 2},
+	{"BE", "BE", 1},
+	{"BG", "BG", 1},
+	{"BN", "BN", 1},
+	{"CA", "CA", 2},
+	{"CH", "CH", 1},
+	{"CY", "CY", 1},
+	{"CZ", "CZ", 1},
+	{"DE", "DE", 3},
+	{"DK", "DK", 1},
+	{"EE", "EE", 1},
+	{"ES", "ES", 1},
+	{"FI", "FI", 1},
+	{"FR", "FR", 1},
+	{"GB", "GB", 1},
+	{"GR", "GR", 1},
+	{"HR", "HR", 1},
+	{"HU", "HU", 1},
+	{"IE", "IE", 1},
+	{"IS", "IS", 1},
+	{"IT", "IT", 1},
+	{"ID", "ID", 1},
+	{"JP", "JP", 8},
+	{"KR", "KR", 24},
+	{"KW", "KW", 1},
+	{"LI", "LI", 1},
+	{"LT", "LT", 1},
+	{"LU", "LU", 1},
+	{"LV", "LV", 1},
+	{"MA", "MA", 1},
+	{"MT", "MT", 1},
+	{"MX", "MX", 1},
+	{"NL", "NL", 1},
+	{"NO", "NO", 1},
+	{"PL", "PL", 1},
+	{"PT", "PT", 1},
+	{"PY", "PY", 1},
+	{"RO", "RO", 1},
+	{"SE", "SE", 1},
+	{"SI", "SI", 1},
+	{"SK", "SK", 1},
+	{"TR", "TR", 7},
+	{"TW", "TW", 1},
+	{"IR", "XZ", 11},	/* Universal if Country code is IRAN, (ISLAMIC REPUBLIC OF) */
+	{"SD", "XZ", 11},	/* Universal if Country code is SUDAN */
+	{"SY", "XZ", 11},	/* Universal if Country code is SYRIAN ARAB REPUBLIC */
+	{"GL", "XZ", 11},	/* Universal if Country code is GREENLAND */
+	{"PS", "XZ", 11},	/* Universal if Country code is PALESTINIAN TERRITORY, OCCUPIED */
+	{"TL", "XZ", 11},	/* Universal if Country code is TIMOR-LESTE (EAST TIMOR) */
+	{"MH", "XZ", 11},	/* Universal if Country code is MARSHALL ISLANDS */
+#ifdef BCM4330_CHIP
+	{"RU", "RU", 1},
+	{"US", "US", 5}
+#endif
+
+#elif defined(CUSTOMER_HW5)
+	{"",   "XZ", 11},
+	{"AE", "AE", 212},
+	{"AG", "AG", 2},
+	{"AI", "AI", 2},
+	{"AL", "AL", 2},
+	{"AN", "AN", 3},
+	{"AR", "AR", 212},
+	{"AS", "AS", 15},
+	{"AT", "AT", 4},
+	{"AU", "AU", 212},
+	{"AW", "AW", 2},
+	{"AZ", "AZ", 2},
+	{"BA", "BA", 2},
+	{"BD", "BD", 2},
+	{"BE", "BE", 4},
+	{"BG", "BG", 4},
+	{"BH", "BH", 4},
+	{"BM", "BM", 15},
+	{"BN", "BN", 4},
+	{"BR", "BR", 212},
+	{"BS", "BS", 2},
+	{"BY", "BY", 3},
+	{"BW", "BW", 1},
+	{"CA", "CA", 212},
+	{"CH", "CH", 212},
+	{"CL", "CL", 212},
+	{"CN", "CN", 212},
+	{"CO", "CO", 212},
+	{"CR", "CR", 21},
+	{"CY", "CY", 212},
+	{"CZ", "CZ", 212},
+	{"DE", "DE", 212},
+	{"DK", "DK", 4},
+	{"DZ", "DZ", 1},
+	{"EC", "EC", 23},
+	{"EE", "EE", 4},
+	{"EG", "EG", 212},
+	{"ES", "ES", 212},
+	{"ET", "ET", 2},
+	{"FI", "FI", 4},
+	{"FR", "FR", 212},
+	{"GB", "GB", 212},
+	{"GD", "GD", 2},
+	{"GF", "GF", 2},
+	{"GP", "GP", 2},
+	{"GR", "GR", 212},
+	{"GT", "GT", 0},
+	{"GU", "GU", 17},
+	{"HK", "HK", 212},
+	{"HR", "HR", 4},
+	{"HU", "HU", 4},
+	{"IN", "IN", 212},
+	{"ID", "ID", 212},
+	{"IE", "IE", 5},
+	{"IL", "IL", 7},
+	{"IN", "IN", 212},
+	{"IS", "IS", 4},
+	{"IT", "IT", 212},
+	{"JO", "JO", 3},
+	{"JP", "JP", 212},
+	{"KH", "KH", 4},
+	{"KI", "KI", 1},
+	{"KR", "KR", 212},
+	{"KW", "KW", 5},
+	{"KY", "KY", 4},
+	{"KZ", "KZ", 212},
+	{"LA", "LA", 4},
+	{"LB", "LB", 6},
+	{"LI", "LI", 4},
+	{"LK", "LK", 3},
+	{"LS", "LS", 2},
+	{"LT", "LT", 4},
+	{"LR", "LR", 2},
+	{"LU", "LU", 3},
+	{"LV", "LV", 4},
+	{"MA", "MA", 2},
+	{"MC", "MC", 1},
+	{"MD", "MD", 2},
+	{"ME", "ME", 2},
+	{"MK", "MK", 2},
+	{"MN", "MN", 0},
+	{"MO", "MO", 2},
+	{"MR", "MR", 2},
+	{"MT", "MT", 4},
+	{"MQ", "MQ", 2},
+	{"MU", "MU", 2},
+	{"MV", "MV", 3},
+	{"MX", "MX", 212},
+	{"MY", "MY", 212},
+	{"NI", "NI", 0},
+	{"NL", "NL", 212},
+	{"NO", "NO", 4},
+	{"NP", "NP", 3},
+	{"NZ", "NZ", 9},
+	{"OM", "OM", 4},
+	{"PA", "PA", 17},
+	{"PE", "PE", 212},
+	{"PG", "PG", 2},
+	{"PH", "PH", 212},
+	{"PL", "PL", 212},
+	{"PR", "PR", 25},
+	{"PT", "PT", 212},
+	{"PY", "PY", 4},
+	{"RE", "RE", 2},
+	{"RO", "RO", 212},
+	{"RS", "RS", 2},
+	{"RU", "RU", 212},
+	{"SA", "SA", 212},
+	{"SE", "SE", 212},
+	{"SG", "SG", 212},
+	{"SI", "SI", 4},
+	{"SK", "SK", 212},
+	{"SN", "SN", 2},
+	{"SV", "SV", 25},
+	{"TH", "TH", 212},
+	{"TR", "TR", 212},
+	{"TT", "TT", 5},
+	{"TW", "TW", 212},
+	{"UA", "UA", 212},
+	{"UG", "UG", 2},
+	{"US", "US", 212},
+	{"UY", "UY", 5},
+	{"VA", "VA", 2},
+	{"VE", "VE", 3},
+	{"VG", "VG", 2},
+	{"VI", "VI", 18},
+	{"VN", "VN", 4},
+	{"YT", "YT", 2},
+	{"ZA", "ZA", 212},
+	{"ZM", "ZM", 2},
+	{"XT", "XT", 212},
+	{"XZ", "XZ", 11},
+	{"XV", "XV", 17},
+	{"Q1", "Q1", 77},
+#endif /* CUSTOMER_HW2 and  CUSTOMER_HW5 */
+};
+
+
+/* Customized Locale convertor
+*  input : ISO 3166-1 country abbreviation
+*  output: customized cspec
+*/
+void get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec)
+{
+#if defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+
+	struct cntry_locales_custom *cloc_ptr;
+
+	if (!cspec)
+		return;
+
+	cloc_ptr = wifi_platform_get_country_code(adapter, country_iso_code);
+	if (cloc_ptr) {
+		strlcpy(cspec->ccode, cloc_ptr->custom_locale, WLC_CNTRY_BUF_SZ);
+		cspec->rev = cloc_ptr->custom_locale_rev;
+	}
+	return;
+#else
+	int size, i;
+
+	size = ARRAYSIZE(translate_custom_table);
+
+	if (cspec == 0)
+		 return;
+
+	if (size == 0)
+		 return;
+
+	for (i = 0; i < size; i++) {
+		if (strcmp(country_iso_code, translate_custom_table[i].iso_abbrev) == 0) {
+			memcpy(cspec->ccode,
+				translate_custom_table[i].custom_locale, WLC_CNTRY_BUF_SZ);
+			cspec->rev = translate_custom_table[i].custom_locale_rev;
+			return;
+		}
+	}
+#ifdef EXAMPLE_TABLE
+	/* if no country code matched return first universal code from translate_custom_table */
+	memcpy(cspec->ccode, translate_custom_table[0].custom_locale, WLC_CNTRY_BUF_SZ);
+	cspec->rev = translate_custom_table[0].custom_locale_rev;
+#endif /* EXMAPLE_TABLE */
+	return;
+#endif /* defined(CUSTOMER_HW2) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)) */
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_dbg.h b/drivers/net/wireless/bcm4336/dhd_dbg.h
--- a/drivers/net/wireless/bcm4336/dhd_dbg.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_dbg.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,107 @@
+/*
+ * Debug/trace/assert driver definitions for Dongle Host Driver.
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: dhd_dbg.h 491225 2014-07-15 11:58:29Z $
+ */
+
+#ifndef _dhd_dbg_
+#define _dhd_dbg_
+
+#define USE_NET_RATELIMIT		1
+
+#if defined(DHD_DEBUG)
+
+#define DHD_ERROR(args)		do {if ((dhd_msg_level & DHD_ERROR_VAL) && USE_NET_RATELIMIT) \
+								printf args;} while (0)
+#define DHD_TRACE(args)		do {if (dhd_msg_level & DHD_TRACE_VAL) printf args;} while (0)
+#define DHD_INFO(args)		do {if (dhd_msg_level & DHD_INFO_VAL) printf args;} while (0)
+#define DHD_DATA(args)		do {if (dhd_msg_level & DHD_DATA_VAL) printf args;} while (0)
+#define DHD_CTL(args)		do {if (dhd_msg_level & DHD_CTL_VAL) printf args;} while (0)
+#define DHD_TIMER(args)		do {if (dhd_msg_level & DHD_TIMER_VAL) printf args;} while (0)
+#define DHD_HDRS(args)		do {if (dhd_msg_level & DHD_HDRS_VAL) printf args;} while (0)
+#define DHD_BYTES(args)		do {if (dhd_msg_level & DHD_BYTES_VAL) printf args;} while (0)
+#define DHD_INTR(args)		do {if (dhd_msg_level & DHD_INTR_VAL) printf args;} while (0)
+#define DHD_GLOM(args)		do {if (dhd_msg_level & DHD_GLOM_VAL) printf args;} while (0)
+#define DHD_EVENT(args)		do {if (dhd_msg_level & DHD_EVENT_VAL) printf args;} while (0)
+#define DHD_BTA(args)		do {if (dhd_msg_level & DHD_BTA_VAL) printf args;} while (0)
+#define DHD_ISCAN(args)		do {if (dhd_msg_level & DHD_ISCAN_VAL) printf args;} while (0)
+#define DHD_ARPOE(args)		do {if (dhd_msg_level & DHD_ARPOE_VAL) printf args;} while (0)
+#define DHD_REORDER(args)	do {if (dhd_msg_level & DHD_REORDER_VAL) printf args;} while (0)
+#define DHD_PNO(args)		do {if (dhd_msg_level & DHD_PNO_VAL) printf args;} while (0)
+
+#define DHD_TRACE_HW4	DHD_TRACE
+#define DHD_INFO_HW4	DHD_INFO
+
+#define DHD_ERROR_ON()		(dhd_msg_level & DHD_ERROR_VAL)
+#define DHD_TRACE_ON()		(dhd_msg_level & DHD_TRACE_VAL)
+#define DHD_INFO_ON()		(dhd_msg_level & DHD_INFO_VAL)
+#define DHD_DATA_ON()		(dhd_msg_level & DHD_DATA_VAL)
+#define DHD_CTL_ON()		(dhd_msg_level & DHD_CTL_VAL)
+#define DHD_TIMER_ON()		(dhd_msg_level & DHD_TIMER_VAL)
+#define DHD_HDRS_ON()		(dhd_msg_level & DHD_HDRS_VAL)
+#define DHD_BYTES_ON()		(dhd_msg_level & DHD_BYTES_VAL)
+#define DHD_INTR_ON()		(dhd_msg_level & DHD_INTR_VAL)
+#define DHD_GLOM_ON()		(dhd_msg_level & DHD_GLOM_VAL)
+#define DHD_EVENT_ON()		(dhd_msg_level & DHD_EVENT_VAL)
+#define DHD_BTA_ON()		(dhd_msg_level & DHD_BTA_VAL)
+#define DHD_ISCAN_ON()		(dhd_msg_level & DHD_ISCAN_VAL)
+#define DHD_ARPOE_ON()		(dhd_msg_level & DHD_ARPOE_VAL)
+#define DHD_REORDER_ON()	(dhd_msg_level & DHD_REORDER_VAL)
+#define DHD_NOCHECKDIED_ON()	(dhd_msg_level & DHD_NOCHECKDIED_VAL)
+#define DHD_PNO_ON()		(dhd_msg_level & DHD_PNO_VAL)
+
+#else /* defined(BCMDBG) || defined(DHD_DEBUG) */
+
+#define DHD_ERROR(args)		do {if (USE_NET_RATELIMIT) printf args;} while (0)
+#define DHD_TRACE(args)
+#define DHD_INFO(args)
+#define DHD_DATA(args)
+#define DHD_CTL(args)
+#define DHD_TIMER(args)
+#define DHD_HDRS(args)
+#define DHD_BYTES(args)
+#define DHD_INTR(args)
+#define DHD_GLOM(args)
+#define DHD_EVENT(args)
+#define DHD_BTA(args)
+#define DHD_ISCAN(args)
+#define DHD_ARPOE(args)
+#define DHD_REORDER(args)
+#define DHD_PNO(args)
+
+#define DHD_TRACE_HW4	DHD_TRACE
+#define DHD_INFO_HW4	DHD_INFO
+
+#define DHD_ERROR_ON()		0
+#define DHD_TRACE_ON()		0
+#define DHD_INFO_ON()		0
+#define DHD_DATA_ON()		0
+#define DHD_CTL_ON()		0
+#define DHD_TIMER_ON()		0
+#define DHD_HDRS_ON()		0
+#define DHD_BYTES_ON()		0
+#define DHD_INTR_ON()		0
+#define DHD_GLOM_ON()		0
+#define DHD_EVENT_ON()		0
+#define DHD_BTA_ON()		0
+#define DHD_ISCAN_ON()		0
+#define DHD_ARPOE_ON()		0
+#define DHD_REORDER_ON()	0
+#define DHD_NOCHECKDIED_ON()	0
+#define DHD_PNO_ON()		0
+
+#endif
+
+#define DHD_LOG(args)
+
+#define DHD_BLOG(cp, size)
+
+#define DHD_NONE(args)
+extern int dhd_msg_level;
+
+/* Defines msg bits */
+#include <dhdioctl.h>
+
+#endif /* _dhd_dbg_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_flowring.c b/drivers/net/wireless/bcm4336/dhd_flowring.c
--- a/drivers/net/wireless/bcm4336/dhd_flowring.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_flowring.c	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,810 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Flow ring specific code at top level
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_flowrings.c jaganlv $
+ */
+
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <proto/ethernet.h>
+#include <proto/bcmevent.h>
+#include <dngl_stats.h>
+
+#include <dhd.h>
+
+#include <dhd_flowring.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <proto/802.1d.h>
+#include <pcie_core.h>
+#include <bcmmsgbuf.h>
+#include <dhd_pcie.h>
+
+static INLINE uint16 dhd_flowid_alloc(dhd_pub_t *dhdp, uint8 ifindex,
+                                      uint8 prio, char *sa, char *da);
+
+static INLINE int dhd_flowid_lookup(dhd_pub_t *dhdp, uint8 ifindex,
+                                uint8 prio, char *sa, char *da, uint16 *flowid);
+int BCMFASTPATH dhd_flow_queue_overflow(flow_queue_t *queue, void *pkt);
+
+#define FLOW_QUEUE_PKT_NEXT(p)          PKTLINK(p)
+#define FLOW_QUEUE_PKT_SETNEXT(p, x)    PKTSETLINK((p), (x))
+
+const uint8 prio2ac[8] = { 0, 1, 1, 0, 2, 2, 3, 3 };
+const uint8 prio2tid[8] = { 0, 1, 2, 3, 4, 5, 6, 7 };
+
+int BCMFASTPATH
+dhd_flow_queue_overflow(flow_queue_t *queue, void *pkt)
+{
+	return BCME_NORESOURCE;
+}
+
+/* Flow ring's queue management functions */
+
+void /* Initialize a flow ring's queue */
+dhd_flow_queue_init(dhd_pub_t *dhdp, flow_queue_t *queue, int max)
+{
+	ASSERT((queue != NULL) && (max > 0));
+
+	dll_init(&queue->list);
+	queue->head = queue->tail = NULL;
+	queue->len = 0;
+	queue->max = max - 1;
+	queue->failures = 0U;
+	queue->cb = &dhd_flow_queue_overflow;
+}
+
+void /* Register an enqueue overflow callback handler */
+dhd_flow_queue_register(flow_queue_t *queue, flow_queue_cb_t cb)
+{
+	ASSERT(queue != NULL);
+	queue->cb = cb;
+}
+
+
+int BCMFASTPATH /* Enqueue a packet in a flow ring's queue */
+dhd_flow_queue_enqueue(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt)
+{
+	int ret = BCME_OK;
+
+	ASSERT(queue != NULL);
+
+	if (queue->len >= queue->max) {
+		queue->failures++;
+		ret = (*queue->cb)(queue, pkt);
+		goto done;
+	}
+
+	if (queue->head) {
+		FLOW_QUEUE_PKT_SETNEXT(queue->tail, pkt);
+	} else {
+		queue->head = pkt;
+	}
+
+	FLOW_QUEUE_PKT_SETNEXT(pkt, NULL);
+
+	queue->tail = pkt; /* at tail */
+
+	queue->len++;
+
+done:
+	return ret;
+}
+
+void * BCMFASTPATH /* Dequeue a packet from a flow ring's queue, from head */
+dhd_flow_queue_dequeue(dhd_pub_t *dhdp, flow_queue_t *queue)
+{
+	void * pkt;
+
+	ASSERT(queue != NULL);
+
+	pkt = queue->head; /* from head */
+
+	if (pkt == NULL) {
+		ASSERT((queue->len == 0) && (queue->tail == NULL));
+		goto done;
+	}
+
+	queue->head = FLOW_QUEUE_PKT_NEXT(pkt);
+	if (queue->head == NULL)
+		queue->tail = NULL;
+
+	queue->len--;
+
+	FLOW_QUEUE_PKT_SETNEXT(pkt, NULL); /* dettach packet from queue */
+
+done:
+	return pkt;
+}
+
+void BCMFASTPATH /* Reinsert a dequeued packet back at the head */
+dhd_flow_queue_reinsert(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt)
+{
+	if (queue->head == NULL) {
+		queue->tail = pkt;
+	}
+
+	FLOW_QUEUE_PKT_SETNEXT(pkt, queue->head);
+	queue->head = pkt;
+	queue->len++;
+}
+
+
+/* Init Flow Ring specific data structures */
+int
+dhd_flow_rings_init(dhd_pub_t *dhdp, uint32 num_flow_rings)
+{
+	uint32 idx;
+	uint32 flow_ring_table_sz;
+	uint32 if_flow_lkup_sz;
+	void * flowid_allocator;
+	flow_ring_table_t *flow_ring_table;
+	if_flow_lkup_t *if_flow_lkup = NULL;
+#ifdef PCIE_TX_DEFERRAL
+	uint32 count;
+#endif
+	void *lock = NULL;
+	unsigned long flags;
+
+	DHD_INFO(("%s\n", __FUNCTION__));
+
+	/* Construct a 16bit flow1d allocator */
+	flowid_allocator = id16_map_init(dhdp->osh,
+	                       num_flow_rings - FLOW_RING_COMMON, FLOWID_RESERVED);
+	if (flowid_allocator == NULL) {
+		DHD_ERROR(("%s: flowid allocator init failure\n", __FUNCTION__));
+		return BCME_NOMEM;
+	}
+
+	/* Allocate a flow ring table, comprising of requested number of rings */
+	flow_ring_table_sz = (num_flow_rings * sizeof(flow_ring_node_t));
+	flow_ring_table = (flow_ring_table_t *)MALLOC(dhdp->osh, flow_ring_table_sz);
+	if (flow_ring_table == NULL) {
+		DHD_ERROR(("%s: flow ring table alloc failure\n", __FUNCTION__));
+		goto fail;
+	}
+
+	/* Initialize flow ring table state */
+	bzero((uchar *)flow_ring_table, flow_ring_table_sz);
+	for (idx = 0; idx < num_flow_rings; idx++) {
+		flow_ring_table[idx].status = FLOW_RING_STATUS_CLOSED;
+		flow_ring_table[idx].flowid = (uint16)idx;
+		flow_ring_table[idx].lock = dhd_os_spin_lock_init(dhdp->osh);
+		if (flow_ring_table[idx].lock == NULL) {
+			DHD_ERROR(("%s: Failed to init spinlock for queue!\n", __FUNCTION__));
+			goto fail;
+		}
+
+		dll_init(&flow_ring_table[idx].list);
+
+		/* Initialize the per flow ring backup queue */
+		dhd_flow_queue_init(dhdp, &flow_ring_table[idx].queue,
+		                    FLOW_RING_QUEUE_THRESHOLD);
+	}
+
+	/* Allocate per interface hash table */
+	if_flow_lkup_sz = sizeof(if_flow_lkup_t) * DHD_MAX_IFS;
+	if_flow_lkup = (if_flow_lkup_t *)DHD_OS_PREALLOC(dhdp,
+		DHD_PREALLOC_IF_FLOW_LKUP, if_flow_lkup_sz);
+	if (if_flow_lkup == NULL) {
+		DHD_ERROR(("%s: if flow lkup alloc failure\n", __FUNCTION__));
+		goto fail;
+	}
+
+	/* Initialize per interface hash table */
+	bzero((uchar *)if_flow_lkup, if_flow_lkup_sz);
+	for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+		int hash_ix;
+		if_flow_lkup[idx].status = 0;
+		if_flow_lkup[idx].role = 0;
+		for (hash_ix = 0; hash_ix < DHD_FLOWRING_HASH_SIZE; hash_ix++)
+			if_flow_lkup[idx].fl_hash[hash_ix] = NULL;
+	}
+
+#ifdef PCIE_TX_DEFERRAL
+	count = BITS_TO_LONGS(num_flow_rings);
+	dhdp->bus->delete_flow_map = kzalloc(count, GFP_ATOMIC);
+	if  (!dhdp->bus->delete_flow_map) {
+		DHD_ERROR(("%s: delete_flow_map alloc failure\n", __FUNCTION__));
+		goto fail;
+	}
+#endif
+
+	lock = dhd_os_spin_lock_init(dhdp->osh);
+	if (lock == NULL)
+		goto fail;
+
+	dhdp->flow_prio_map_type = DHD_FLOW_PRIO_AC_MAP;
+	bcopy(prio2ac, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+	/* Now populate into dhd pub */
+	DHD_FLOWID_LOCK(lock, flags);
+	dhdp->num_flow_rings = num_flow_rings;
+	dhdp->flowid_allocator = (void *)flowid_allocator;
+	dhdp->flow_ring_table = (void *)flow_ring_table;
+	dhdp->if_flow_lkup = (void *)if_flow_lkup;
+	dhdp->flowid_lock = lock;
+	DHD_FLOWID_UNLOCK(lock, flags);
+
+	DHD_INFO(("%s done\n", __FUNCTION__));
+	return BCME_OK;
+
+fail:
+
+#ifdef PCIE_TX_DEFERRAL
+	if (dhdp->bus->delete_flow_map)
+		kfree(dhdp->bus->delete_flow_map);
+#endif
+	/* Destruct the per interface flow lkup table */
+	if (dhdp->if_flow_lkup != NULL) {
+		DHD_OS_PREFREE(dhdp, if_flow_lkup, if_flow_lkup_sz);
+	}
+	if (flow_ring_table != NULL) {
+		for (idx = 0; idx < num_flow_rings; idx++) {
+			if (flow_ring_table[idx].lock != NULL)
+				dhd_os_spin_lock_deinit(dhdp->osh, flow_ring_table[idx].lock);
+		}
+		MFREE(dhdp->osh, flow_ring_table, flow_ring_table_sz);
+	}
+	id16_map_fini(dhdp->osh, flowid_allocator);
+
+	return BCME_NOMEM;
+}
+
+/* Deinit Flow Ring specific data structures */
+void dhd_flow_rings_deinit(dhd_pub_t *dhdp)
+{
+	uint16 idx;
+	uint32 flow_ring_table_sz;
+	uint32 if_flow_lkup_sz;
+	flow_ring_table_t *flow_ring_table;
+	unsigned long flags;
+	void *lock;
+
+	DHD_INFO(("dhd_flow_rings_deinit\n"));
+
+	if (dhdp->flow_ring_table != NULL) {
+
+		ASSERT(dhdp->num_flow_rings > 0);
+
+		DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+		flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+		dhdp->flow_ring_table = NULL;
+		DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+		for (idx = 0; idx < dhdp->num_flow_rings; idx++) {
+			if (flow_ring_table[idx].active) {
+				dhd_bus_clean_flow_ring(dhdp->bus, &flow_ring_table[idx]);
+			}
+			ASSERT(flow_queue_empty(&flow_ring_table[idx].queue));
+
+			/* Deinit flow ring queue locks before destroying flow ring table */
+			dhd_os_spin_lock_deinit(dhdp->osh, flow_ring_table[idx].lock);
+			flow_ring_table[idx].lock = NULL;
+		}
+
+		/* Destruct the flow ring table */
+		flow_ring_table_sz = dhdp->num_flow_rings * sizeof(flow_ring_table_t);
+		MFREE(dhdp->osh, flow_ring_table, flow_ring_table_sz);
+	}
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+
+	/* Destruct the per interface flow lkup table */
+	if (dhdp->if_flow_lkup != NULL) {
+		if_flow_lkup_sz = sizeof(if_flow_lkup_t) * DHD_MAX_IFS;
+		bzero(dhdp->if_flow_lkup, sizeof(if_flow_lkup_sz));
+		DHD_OS_PREFREE(dhdp, dhdp->if_flow_lkup, if_flow_lkup_sz);
+		dhdp->if_flow_lkup = NULL;
+	}
+
+#ifdef PCIE_TX_DEFERRAL
+	if (dhdp->bus->delete_flow_map)
+		kfree(dhdp->bus->delete_flow_map);
+#endif
+
+	/* Destruct the flowid allocator */
+	if (dhdp->flowid_allocator != NULL)
+		dhdp->flowid_allocator = id16_map_fini(dhdp->osh, dhdp->flowid_allocator);
+
+	dhdp->num_flow_rings = 0U;
+	lock = dhdp->flowid_lock;
+	dhdp->flowid_lock = NULL;
+
+	DHD_FLOWID_UNLOCK(lock, flags);
+	dhd_os_spin_lock_deinit(dhdp->osh, lock);
+}
+
+uint8
+dhd_flow_rings_ifindex2role(dhd_pub_t *dhdp, uint8 ifindex)
+{
+	if_flow_lkup_t *if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+	ASSERT(if_flow_lkup);
+	return if_flow_lkup[ifindex].role;
+}
+
+#ifdef WLTDLS
+bool is_tdls_destination(dhd_pub_t *dhdp, uint8 *da)
+{
+	tdls_peer_node_t *cur = dhdp->peer_tbl.node;
+	while (cur != NULL) {
+		if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+			return TRUE;
+		}
+		cur = cur->next;
+	}
+	return FALSE;
+}
+#endif /* WLTDLS */
+
+/* For a given interface, search the hash table for a matching flow */
+uint16
+dhd_flowid_find(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da)
+{
+	int hash;
+	bool ismcast = FALSE;
+	flow_hash_info_t *cur;
+	if_flow_lkup_t *if_flow_lkup;
+	unsigned long flags;
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+	if (DHD_IF_ROLE_STA(if_flow_lkup[ifindex].role)) {
+#ifdef WLTDLS
+		if (dhdp->peer_tbl.tdls_peer_count && !(ETHER_ISMULTI(da)) &&
+			is_tdls_destination(dhdp, da)) {
+			hash = DHD_FLOWRING_HASHINDEX(da, prio);
+			cur = if_flow_lkup[ifindex].fl_hash[hash];
+			while (cur != NULL) {
+				if (!memcmp(cur->flow_info.da, da, ETHER_ADDR_LEN)) {
+					DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+					return cur->flowid;
+				}
+				cur = cur->next;
+			}
+			DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+			return FLOWID_INVALID;
+		}
+#endif /* WLTDLS */
+		cur = if_flow_lkup[ifindex].fl_hash[prio];
+		if (cur) {
+			DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+			return cur->flowid;
+		}
+
+	} else {
+
+		if (ETHER_ISMULTI(da)) {
+			ismcast = TRUE;
+			hash = 0;
+		} else {
+			hash = DHD_FLOWRING_HASHINDEX(da, prio);
+		}
+
+		cur = if_flow_lkup[ifindex].fl_hash[hash];
+
+		while (cur) {
+			if ((ismcast && ETHER_ISMULTI(cur->flow_info.da)) ||
+				(!memcmp(cur->flow_info.da, da, ETHER_ADDR_LEN) &&
+				(cur->flow_info.tid == prio))) {
+				DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+				return cur->flowid;
+			}
+			cur = cur->next;
+		}
+	}
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+	return FLOWID_INVALID;
+}
+
+/* Allocate Flow ID */
+static INLINE uint16
+dhd_flowid_alloc(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da)
+{
+	flow_hash_info_t *fl_hash_node, *cur;
+	if_flow_lkup_t *if_flow_lkup;
+	int hash;
+	uint16 flowid;
+	unsigned long flags;
+
+	fl_hash_node = (flow_hash_info_t *) MALLOC(dhdp->osh, sizeof(flow_hash_info_t));
+	memcpy(fl_hash_node->flow_info.da, da, sizeof(fl_hash_node->flow_info.da));
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	ASSERT(dhdp->flowid_allocator != NULL);
+	flowid = id16_map_alloc(dhdp->flowid_allocator);
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+	if (flowid == FLOWID_INVALID) {
+		MFREE(dhdp->osh, fl_hash_node,  sizeof(flow_hash_info_t));
+		DHD_ERROR(("%s: cannot get free flowid \n", __FUNCTION__));
+		return FLOWID_INVALID;
+	}
+
+	fl_hash_node->flowid = flowid;
+	fl_hash_node->flow_info.tid = prio;
+	fl_hash_node->flow_info.ifindex = ifindex;
+	fl_hash_node->next = NULL;
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+	if (DHD_IF_ROLE_STA(if_flow_lkup[ifindex].role)) {
+		/* For STA non TDLS dest we allocate entry based on prio only */
+#ifdef WLTDLS
+		if (dhdp->peer_tbl.tdls_peer_count &&
+			(is_tdls_destination(dhdp, da))) {
+			hash = DHD_FLOWRING_HASHINDEX(da, prio);
+			cur = if_flow_lkup[ifindex].fl_hash[hash];
+			if (cur) {
+				while (cur->next) {
+					cur = cur->next;
+				}
+				cur->next = fl_hash_node;
+			} else {
+				if_flow_lkup[ifindex].fl_hash[hash] = fl_hash_node;
+			}
+		} else
+#endif /* WLTDLS */
+			if_flow_lkup[ifindex].fl_hash[prio] = fl_hash_node;
+	} else {
+
+		/* For bcast/mcast assign first slot in in interface */
+		hash = ETHER_ISMULTI(da) ? 0 : DHD_FLOWRING_HASHINDEX(da, prio);
+		cur = if_flow_lkup[ifindex].fl_hash[hash];
+		if (cur) {
+			while (cur->next) {
+				cur = cur->next;
+			}
+			cur->next = fl_hash_node;
+		} else
+			if_flow_lkup[ifindex].fl_hash[hash] = fl_hash_node;
+	}
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+	DHD_INFO(("%s: allocated flowid %d\n", __FUNCTION__, fl_hash_node->flowid));
+
+	return fl_hash_node->flowid;
+}
+
+/* Get flow ring ID, if not present try to create one */
+static INLINE int
+dhd_flowid_lookup(dhd_pub_t *dhdp, uint8 ifindex,
+                  uint8 prio, char *sa, char *da, uint16 *flowid)
+{
+	uint16 id;
+	flow_ring_node_t *flow_ring_node;
+	flow_ring_table_t *flow_ring_table;
+	unsigned long flags;
+
+	DHD_INFO(("%s\n", __FUNCTION__));
+
+	if (!dhdp->flow_ring_table)
+		return BCME_ERROR;
+
+	flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+
+	id = dhd_flowid_find(dhdp, ifindex, prio, sa, da);
+
+	if (id == FLOWID_INVALID) {
+
+		if_flow_lkup_t *if_flow_lkup;
+		if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+		if (!if_flow_lkup[ifindex].status)
+			return BCME_ERROR;
+
+		id = dhd_flowid_alloc(dhdp, ifindex, prio, sa, da);
+		if (id == FLOWID_INVALID) {
+			DHD_ERROR(("%s: alloc flowid ifindex %u status %u\n",
+			           __FUNCTION__, ifindex, if_flow_lkup[ifindex].status));
+			return BCME_ERROR;
+		}
+
+		/* register this flowid in dhd_pub */
+		dhd_add_flowid(dhdp, ifindex, prio, da, id);
+	}
+
+	ASSERT(id < dhdp->num_flow_rings);
+
+	flow_ring_node = (flow_ring_node_t *) &flow_ring_table[id];
+	DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+	if (flow_ring_node->active) {
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+		*flowid = id;
+		return BCME_OK;
+	}
+	/* Init Flow info */
+	memcpy(flow_ring_node->flow_info.sa, sa, sizeof(flow_ring_node->flow_info.sa));
+	memcpy(flow_ring_node->flow_info.da, da, sizeof(flow_ring_node->flow_info.da));
+	flow_ring_node->flow_info.tid = prio;
+	flow_ring_node->flow_info.ifindex = ifindex;
+	flow_ring_node->active = TRUE;
+	flow_ring_node->status = FLOW_RING_STATUS_PENDING;
+	DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	dll_prepend(&dhdp->bus->const_flowring, &flow_ring_node->list);
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+	/* Create and inform device about the new flow */
+	if (dhd_bus_flow_ring_create_request(dhdp->bus, (void *)flow_ring_node)
+	        != BCME_OK) {
+		DHD_ERROR(("%s: create error %d\n", __FUNCTION__, id));
+		return BCME_ERROR;
+	}
+
+	*flowid = id;
+	return BCME_OK;
+}
+
+/* Update flowid information on the packet */
+int BCMFASTPATH
+dhd_flowid_update(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, void *pktbuf)
+{
+	uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+	struct ether_header *eh = (struct ether_header *)pktdata;
+	uint16 flowid;
+
+	if (dhd_bus_is_txmode_push(dhdp->bus))
+		return BCME_OK;
+
+	ASSERT(ifindex < DHD_MAX_IFS);
+	if (ifindex >= DHD_MAX_IFS) {
+		return BCME_BADARG;
+	}
+
+	if (!dhdp->flowid_allocator) {
+		DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	if (dhd_flowid_lookup(dhdp, ifindex, prio, eh->ether_shost, eh->ether_dhost,
+		&flowid) != BCME_OK) {
+		return BCME_ERROR;
+	}
+
+	DHD_INFO(("%s: prio %d flowid %d\n", __FUNCTION__, prio, flowid));
+
+	/* Tag the packet with flowid */
+	DHD_PKTTAG_SET_FLOWID((dhd_pkttag_fr_t *)PKTTAG(pktbuf), flowid);
+	return BCME_OK;
+}
+
+void
+dhd_flowid_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid)
+{
+	int hashix;
+	bool found = FALSE;
+	flow_hash_info_t *cur, *prev;
+	if_flow_lkup_t *if_flow_lkup;
+	unsigned long flags;
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+	for (hashix = 0; hashix < DHD_FLOWRING_HASH_SIZE; hashix++) {
+
+		cur = if_flow_lkup[ifindex].fl_hash[hashix];
+
+		if (cur) {
+			if (cur->flowid == flowid) {
+				found = TRUE;
+			}
+
+			prev = NULL;
+			while (!found && cur) {
+				if (cur->flowid == flowid) {
+					found = TRUE;
+					break;
+				}
+				prev = cur;
+				cur = cur->next;
+			}
+			if (found) {
+				if (!prev) {
+					if_flow_lkup[ifindex].fl_hash[hashix] = cur->next;
+				} else {
+					prev->next = cur->next;
+				}
+
+				/* deregister flowid from dhd_pub. */
+				dhd_del_flowid(dhdp, ifindex, flowid);
+
+				id16_map_free(dhdp->flowid_allocator, flowid);
+				DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+				MFREE(dhdp->osh, cur, sizeof(flow_hash_info_t));
+
+				return;
+			}
+		}
+	}
+
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+	DHD_ERROR(("%s: could not free flow ring hash entry flowid %d\n",
+	           __FUNCTION__, flowid));
+}
+
+
+/* Delete all Flow rings assocaited with the given Interface */
+void
+dhd_flow_rings_delete(dhd_pub_t *dhdp, uint8 ifindex)
+{
+	uint32 id;
+	flow_ring_table_t *flow_ring_table;
+
+	DHD_INFO(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+	ASSERT(ifindex < DHD_MAX_IFS);
+	if (ifindex >= DHD_MAX_IFS)
+		return;
+
+	if (!dhdp->flow_ring_table)
+		return;
+
+	flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+	for (id = 0; id < dhdp->num_flow_rings; id++) {
+		if (flow_ring_table[id].active &&
+		    (flow_ring_table[id].flow_info.ifindex == ifindex) &&
+		    (flow_ring_table[id].status != FLOW_RING_STATUS_DELETE_PENDING)) {
+			DHD_INFO(("%s: deleting flowid %d\n",
+			          __FUNCTION__, flow_ring_table[id].flowid));
+			dhd_bus_flow_ring_delete_request(dhdp->bus,
+			                                 (void *) &flow_ring_table[id]);
+		}
+	}
+}
+
+/* Delete flow/s for given peer address */
+void
+dhd_flow_rings_delete_for_peer(dhd_pub_t *dhdp, uint8 ifindex, char *addr)
+{
+	uint32 id;
+	flow_ring_table_t *flow_ring_table;
+
+	DHD_ERROR(("%s: ifindex %u\n", __FUNCTION__, ifindex));
+
+	ASSERT(ifindex < DHD_MAX_IFS);
+	if (ifindex >= DHD_MAX_IFS)
+		return;
+
+	if (!dhdp->flow_ring_table)
+		return;
+
+	flow_ring_table = (flow_ring_table_t *)dhdp->flow_ring_table;
+	for (id = 0; id < dhdp->num_flow_rings; id++) {
+		if (flow_ring_table[id].active &&
+		    (flow_ring_table[id].flow_info.ifindex == ifindex) &&
+		    (!memcmp(flow_ring_table[id].flow_info.da, addr, ETHER_ADDR_LEN)) &&
+		    (flow_ring_table[id].status != FLOW_RING_STATUS_DELETE_PENDING)) {
+			DHD_INFO(("%s: deleting flowid %d\n",
+			          __FUNCTION__, flow_ring_table[id].flowid));
+			dhd_bus_flow_ring_delete_request(dhdp->bus,
+			                                 (void *) &flow_ring_table[id]);
+		}
+	}
+}
+
+/* Handle Interface ADD, DEL operations */
+void
+dhd_update_interface_flow_info(dhd_pub_t *dhdp, uint8 ifindex,
+                               uint8 op, uint8 role)
+{
+	if_flow_lkup_t *if_flow_lkup;
+	unsigned long flags;
+
+	ASSERT(ifindex < DHD_MAX_IFS);
+	if (ifindex >= DHD_MAX_IFS)
+		return;
+
+	DHD_INFO(("%s: ifindex %u op %u role is %u \n",
+	          __FUNCTION__, ifindex, op, role));
+	if (!dhdp->flowid_allocator) {
+		DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+		return;
+	}
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+	if (op == WLC_E_IF_ADD || op == WLC_E_IF_CHANGE) {
+
+		if_flow_lkup[ifindex].role = role;
+
+		if (!(DHD_IF_ROLE_STA(role))) {
+			if_flow_lkup[ifindex].status = TRUE;
+			DHD_INFO(("%s: Mcast Flow ring for ifindex %d role is %d \n",
+			          __FUNCTION__, ifindex, role));
+			/* Create Mcast Flow */
+		}
+	} else	if (op == WLC_E_IF_DEL) {
+		if_flow_lkup[ifindex].status = FALSE;
+		DHD_INFO(("%s: cleanup all Flow rings for ifindex %d role is %d \n",
+		          __FUNCTION__, ifindex, role));
+	}
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+}
+
+/* Handle a STA interface link status update */
+int
+dhd_update_interface_link_status(dhd_pub_t *dhdp, uint8 ifindex, uint8 status)
+{
+	if_flow_lkup_t *if_flow_lkup;
+	unsigned long flags;
+
+	ASSERT(ifindex < DHD_MAX_IFS);
+	if (ifindex >= DHD_MAX_IFS)
+		return BCME_BADARG;
+
+	DHD_INFO(("%s: ifindex %d status %d\n", __FUNCTION__, ifindex, status));
+
+	DHD_FLOWID_LOCK(dhdp->flowid_lock, flags);
+	if_flow_lkup = (if_flow_lkup_t *)dhdp->if_flow_lkup;
+
+	if (DHD_IF_ROLE_STA(if_flow_lkup[ifindex].role)) {
+		if (status)
+			if_flow_lkup[ifindex].status = TRUE;
+		else
+			if_flow_lkup[ifindex].status = FALSE;
+	}
+	DHD_FLOWID_UNLOCK(dhdp->flowid_lock, flags);
+
+	return BCME_OK;
+}
+/* Update flow priority mapping */
+int dhd_update_flow_prio_map(dhd_pub_t *dhdp, uint8 map)
+{
+	uint16 flowid;
+	flow_ring_node_t *flow_ring_node;
+
+	if (map > DHD_FLOW_PRIO_TID_MAP)
+		return BCME_BADOPTION;
+
+	/* Check if we need to change prio map */
+	if (map == dhdp->flow_prio_map_type)
+		return BCME_OK;
+
+	/* If any ring is active we cannot change priority mapping for flow rings */
+	for (flowid = 0; flowid < dhdp->num_flow_rings; flowid++) {
+		flow_ring_node = DHD_FLOW_RING(dhdp, flowid);
+		if (flow_ring_node->active)
+			return BCME_EPERM;
+	}
+	/* Infor firmware about new mapping type */
+	if (BCME_OK != dhd_flow_prio_map(dhdp, &map, TRUE))
+		return BCME_ERROR;
+
+	/* update internal structures */
+	dhdp->flow_prio_map_type = map;
+	if (dhdp->flow_prio_map_type == DHD_FLOW_PRIO_TID_MAP)
+		bcopy(prio2tid, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+	else
+		bcopy(prio2ac, dhdp->flow_prio_map, sizeof(uint8) * NUMPRIO);
+
+	return BCME_OK;
+}
+
+/* Set/Get flwo ring priority map */
+int dhd_flow_prio_map(dhd_pub_t *dhd, uint8 *map, bool set)
+{
+	uint8 iovbuf[24];
+	if (!set) {
+		bcm_mkiovar("bus:fl_prio_map", NULL, 0, (char*)iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0) < 0) {
+			DHD_ERROR(("%s: failed to get fl_prio_map\n", __FUNCTION__));
+			return BCME_ERROR;
+		}
+		*map = iovbuf[0];
+		return BCME_OK;
+	}
+	bcm_mkiovar("bus:fl_prio_map", (char *)map, 4, (char*)iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+		DHD_ERROR(("%s: failed to set fl_prio_map \n",
+			__FUNCTION__));
+		return BCME_ERROR;
+	}
+	return BCME_OK;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_flowring.h b/drivers/net/wireless/bcm4336/dhd_flowring.h
--- a/drivers/net/wireless/bcm4336/dhd_flowring.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_flowring.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,159 @@
+/*
+ * Header file describing the flow rings DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to create, delete and manage
+ *
+ * flow rings at high level
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_flowrings.h  jaganlv $
+ */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_flowrings_h_
+#define _dhd_flowrings_h_
+
+/* Max pkts held in a flow ring's backup queue */
+#define FLOW_RING_QUEUE_THRESHOLD       (2048)
+
+/* Number of H2D common rings : PCIE Spec Rev? */
+#define FLOW_RING_COMMON                2
+
+#define FLOWID_INVALID                  (ID16_INVALID)
+#define FLOWID_RESERVED                 (FLOW_RING_COMMON)
+
+#define FLOW_RING_STATUS_OPEN           0
+#define FLOW_RING_STATUS_PENDING        1
+#define FLOW_RING_STATUS_CLOSED         2
+#define FLOW_RING_STATUS_DELETE_PENDING 3
+#define FLOW_RING_STATUS_FLUSH_PENDING  4
+
+#define DHD_FLOWRING_RX_BUFPOST_PKTSZ	2048
+
+#define DHD_FLOW_PRIO_AC_MAP		0
+#define DHD_FLOW_PRIO_TID_MAP		1
+
+
+/* Pkttag not compatible with PROP_TXSTATUS or WLFC */
+typedef struct dhd_pkttag_fr {
+	uint16  flowid;
+	int     dataoff;
+} dhd_pkttag_fr_t;
+
+#define DHD_PKTTAG_SET_FLOWID(tag, flow)    ((tag)->flowid = (uint16)(flow))
+#define DHD_PKTTAG_SET_DATAOFF(tag, offset) ((tag)->dataoff = (int)(offset))
+
+#define DHD_PKTTAG_FLOWID(tag)              ((tag)->flowid)
+#define DHD_PKTTAG_DATAOFF(tag)             ((tag)->dataoff)
+
+/* Hashing a MacAddress for lkup into a per interface flow hash table */
+#define DHD_FLOWRING_HASH_SIZE    256
+#define	DHD_FLOWRING_HASHINDEX(ea, prio) \
+	       ((((uint8 *)(ea))[3] ^ ((uint8 *)(ea))[4] ^ ((uint8 *)(ea))[5] ^ ((uint8)(prio))) \
+		% DHD_FLOWRING_HASH_SIZE)
+
+#define DHD_IF_ROLE(pub, idx)		(((if_flow_lkup_t *)(pub)->if_flow_lkup)[idx].role)
+#define DHD_IF_ROLE_AP(pub, idx)	(DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_AP)
+#define DHD_IF_ROLE_P2PGO(pub, idx)	(DHD_IF_ROLE(pub, idx) == WLC_E_IF_ROLE_P2P_GO)
+#define DHD_FLOW_RING(dhdp, flowid) \
+	(flow_ring_node_t *)&(((flow_ring_node_t *)((dhdp)->flow_ring_table))[flowid])
+
+struct flow_queue;
+
+/* Flow Ring Queue Enqueue overflow callback */
+typedef int (*flow_queue_cb_t)(struct flow_queue * queue, void * pkt);
+
+typedef struct flow_queue {
+	dll_t  list;                /* manage a flowring queue in a dll */
+	void * head;                /* first packet in the queue */
+	void * tail;                /* last packet in the queue */
+	uint16 len;                 /* number of packets in the queue */
+	uint16 max;                 /* maximum number of packets, queue may hold */
+	uint32 failures;            /* enqueue failures due to queue overflow */
+	flow_queue_cb_t cb;         /* callback invoked on threshold crossing */
+} flow_queue_t;
+
+#define flow_queue_len(queue)   ((int)(queue)->len)
+#define flow_queue_max(queue)   ((int)(queue)->max)
+#define flow_queue_avail(queue) ((int)((queue)->max - (queue)->len))
+#define flow_queue_full(queue)  ((queue)->len >= (queue)->max)
+#define flow_queue_empty(queue) ((queue)->len == 0)
+
+typedef struct flow_info {
+	uint8		tid;
+	uint8		ifindex;
+	char		sa[ETHER_ADDR_LEN];
+	char		da[ETHER_ADDR_LEN];
+} flow_info_t;
+
+typedef struct flow_ring_node {
+	dll_t		list; /* manage a constructed flowring in a dll, must be at first place */
+	flow_queue_t	queue;
+	bool		active;
+	uint8		status;
+	uint16		flowid;
+	flow_info_t	flow_info;
+	void		*prot_info;
+	void		*lock; /* lock for flowring access protection */
+} flow_ring_node_t;
+typedef flow_ring_node_t flow_ring_table_t;
+
+typedef struct flow_hash_info {
+	uint16			flowid;
+	flow_info_t		flow_info;
+	struct flow_hash_info	*next;
+} flow_hash_info_t;
+
+typedef struct if_flow_lkup {
+	bool		status;
+	uint8		role; /* Interface role: STA/AP */
+	flow_hash_info_t *fl_hash[DHD_FLOWRING_HASH_SIZE]; /* Lkup Hash table */
+} if_flow_lkup_t;
+
+static INLINE flow_ring_node_t *
+dhd_constlist_to_flowring(dll_t *item)
+{
+	return ((flow_ring_node_t *)item);
+}
+
+/* Exported API */
+
+/* Flow ring's queue management functions */
+extern void dhd_flow_queue_init(dhd_pub_t *dhdp, flow_queue_t *queue, int max);
+extern void dhd_flow_queue_register(flow_queue_t *queue, flow_queue_cb_t cb);
+extern int  dhd_flow_queue_enqueue(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt);
+extern void * dhd_flow_queue_dequeue(dhd_pub_t *dhdp, flow_queue_t *queue);
+extern void dhd_flow_queue_reinsert(dhd_pub_t *dhdp, flow_queue_t *queue, void *pkt);
+
+extern int  dhd_flow_rings_init(dhd_pub_t *dhdp, uint32 num_flow_rings);
+
+extern void dhd_flow_rings_deinit(dhd_pub_t *dhdp);
+
+extern uint16 dhd_flowid_find(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio, char *sa, char *da);
+
+extern int dhd_flowid_update(dhd_pub_t *dhdp, uint8 ifindex, uint8 prio,
+                void *pktbuf);
+
+extern void dhd_flowid_free(dhd_pub_t *dhdp, uint8 ifindex, uint16 flowid);
+
+extern void dhd_flow_rings_delete(dhd_pub_t *dhdp, uint8 ifindex);
+
+extern void dhd_flow_rings_delete_for_peer(dhd_pub_t *dhdp, uint8 ifindex,
+                char *addr);
+
+/* Handle Interface ADD, DEL operations */
+extern void dhd_update_interface_flow_info(dhd_pub_t *dhdp, uint8 ifindex,
+                uint8 op, uint8 role);
+
+/* Handle a STA interface link status update */
+extern int dhd_update_interface_link_status(dhd_pub_t *dhdp, uint8 ifindex,
+                uint8 status);
+extern int dhd_flow_prio_map(dhd_pub_t *dhd, uint8 *map, bool set);
+extern int dhd_update_flow_prio_map(dhd_pub_t *dhdp, uint8 map);
+
+extern uint8 dhd_flow_rings_ifindex2role(dhd_pub_t *dhdp, uint8 ifindex);
+#endif /* _dhd_flowrings_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_gpio.c b/drivers/net/wireless/bcm4336/dhd_gpio.c
--- a/drivers/net/wireless/bcm4336/dhd_gpio.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_gpio.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,148 @@
+#ifdef CUSTOMER_HW
+#include <osl.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#include "ap621x.h"
+
+struct wifi_platform_data dhd_wlan_control = {0};
+
+/* nanopi: irq and flags are read from OF dtb, see read_brcm_nanopi_irq() */
+#if defined(CUSTOMER_OOB) && !defined(CONFIG_ARCH_S5P6818)
+uint bcm_wlan_get_oob_irq(void)
+{
+	uint host_oob_irq = 0;
+
+#ifdef GPIO_WLAN_HOST_WAKE
+	printf("GPIO(GPIO_WLAN_HOST_WAKE) = %d\n", brcm_gpio_host_wake());
+	host_oob_irq = gpio_to_irq(brcm_gpio_host_wake());
+	gpio_direction_input(brcm_gpio_host_wake());
+#elif defined(CONFIG_ARCH_CPU_SLSI)
+	host_oob_irq = get_host_wake_irq();
+#endif
+
+	printf("host_oob_irq: %d\n", host_oob_irq);
+	return host_oob_irq;
+}
+
+uint bcm_wlan_get_oob_irq_flags(void)
+{
+	uint host_oob_irq_flags = 0;
+
+#if defined(GPIO_WLAN_HOST_WAKE) || defined(CONFIG_ARCH_S5P6818)
+#ifdef HW_OOB
+	host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL | IORESOURCE_IRQ_SHAREABLE;
+#else
+	host_oob_irq_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE  | IORESOURCE_IRQ_SHAREABLE;
+#endif
+#endif
+	printf("host_oob_irq_flags = %x\n", host_oob_irq_flags);
+
+	return host_oob_irq_flags;
+}
+#endif
+
+int bcm_wlan_set_power(bool on)
+{
+	int err = 0;
+
+	if (on) {
+		printf("======== PULL WL_REG_ON HIGH! ========\n");
+#ifdef GPIO_WLAN_EN
+		gpio_set_value(GPIO_WLAN_EN, 1);
+#elif defined(CONFIG_ARCH_S5P6818)
+		/* nanopi: the function sets high/low value on gpiob-24 pin, which is
+		 * connected with WL_REG_ON pin on ap6212.
+		 * When set to low, WLAN section of the chip is powered off and
+		 * set in reset state. In this case the chip becomes also unresponsive
+		 * on SDIO interface. But we don't want to interfere with mmc driver...
+		 */
+		//wifi_pm_gpio_ctrl("bcmdhd", 1);
+#endif
+		/* Lets customer power to get stable */
+		msleep(50);
+	} else {
+		printf("======== PULL WL_REG_ON LOW! ========\n");
+#ifdef GPIO_WLAN_EN
+		gpio_set_value(GPIO_WLAN_EN, 0);
+#elif defined(CONFIG_ARCH_S5P6818)
+		 // wifi_pm_gpio_ctrl("bcmdhd", 0);
+#endif
+		msleep(50);
+	}
+
+	return err;
+}
+
+int bcm_wlan_set_carddetect(bool present)
+{
+	int err = 0;
+
+#if 0
+	if (present) {
+		printf("======== Card detection to detect SDIO card! ========\n");
+		err = sdhci_s3c_force_presence_change(&sdmmc_channel, 1);
+	} else {
+		printf("======== Card detection to remove SDIO card! ========\n");
+		err = sdhci_s3c_force_presence_change(&sdmmc_channel, 0);
+	}
+#endif
+
+#if defined(CONFIG_ARCH_S5P6818)
+	/* nanopi: kernel 3.x has added method in MMC driver
+	 * which mimics insertion/removal of SD card.
+	 * The function is used after pull WL_REG_ON pin low/high.
+	 */
+	//force_presence_change(NULL, present);
+#else
+	mmc_force_presence_change_onoff(&sdmmc_channel, present);
+#endif
+
+	return err;
+}
+
+int bcm_wlan_get_mac_address(unsigned char *buf)
+{
+	int err = 0;
+
+	printf("======== %s ========\n", __FUNCTION__);
+#ifdef EXAMPLE_GET_MAC
+	/* EXAMPLE code */
+	{
+		struct ether_addr ea_example = {{0x00, 0x11, 0x22, 0x33, 0x44, 0xFF}};
+		bcopy((char *)&ea_example, buf, sizeof(struct ether_addr));
+	}
+#endif /* EXAMPLE_GET_MAC */
+
+	return err;
+}
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+extern void *bcmdhd_mem_prealloc(int section, unsigned long size);
+void* bcm_wlan_prealloc(int section, unsigned long size)
+{
+	void *alloc_ptr = NULL;
+	alloc_ptr = bcmdhd_mem_prealloc(section, size);
+	if (alloc_ptr) {
+		printf("success alloc section %d, size %ld\n", section, size);
+		if (size != 0L)
+			bzero(alloc_ptr, size);
+		return alloc_ptr;
+	}
+	printf("can't alloc section %d\n", section);
+	return NULL;
+}
+#endif
+
+int bcm_wlan_set_plat_data(void) {
+	printf("======== %s ========\n", __FUNCTION__);
+	dhd_wlan_control.set_power = bcm_wlan_set_power;
+	dhd_wlan_control.set_carddetect = bcm_wlan_set_carddetect;
+	dhd_wlan_control.get_mac_addr = bcm_wlan_get_mac_address;
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+	dhd_wlan_control.mem_prealloc = bcm_wlan_prealloc;
+#endif
+	return 0;
+}
+
+#endif /* CUSTOMER_HW */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd.h b/drivers/net/wireless/bcm4336/dhd.h
--- a/drivers/net/wireless/bcm4336/dhd.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd.h	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,1106 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd.h 504503 2014-09-24 11:28:56Z $
+ */
+
+/****************
+ * Common types *
+ */
+
+#ifndef _dhd_h_
+#define _dhd_h_
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_HAS_WAKELOCK)
+#include <linux/wakelock.h>
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined (CONFIG_HAS_WAKELOCK) */
+/* The kernel threading is sdio-specific */
+struct task_struct;
+struct sched_param;
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param);
+int get_scheduler_policy(struct task_struct *p);
+#define MAX_EVENT	16
+
+#define ALL_INTERFACES	0xff
+
+#include <wlioctl.h>
+#include <wlfc_proto.h>
+#include <hnd_pktq.h>
+
+#if defined(BCMWDF)
+#include <wdf.h>
+#include <WdfMiniport.h>
+#endif /* (BCMWDF)  */
+
+#if defined(WL11U) && !defined(MFP)
+#define MFP /* Applying interaction with MFP by spec HS2.0 REL2 */
+#endif /* WL11U */
+
+#if defined(KEEP_ALIVE)
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define KEEP_ALIVE_PERIOD 55000
+#define NULL_PKT_STR	"null_pkt"
+#endif /* KEEP_ALIVE */
+/* Forward decls */
+struct dhd_bus;
+struct dhd_prot;
+struct dhd_info;
+struct dhd_ioctl;
+
+/* The level of bus communication with the dongle */
+enum dhd_bus_state {
+	DHD_BUS_DOWN,		/* Not ready for frame transfers */
+	DHD_BUS_LOAD,		/* Download access only (CPU reset) */
+	DHD_BUS_DATA,		/* Ready for frame transfers */
+	DHD_BUS_SUSPEND,	/* Bus has been suspended */
+};
+
+#if defined(NDISVER)
+#if (NDISVER >= 0x0600)
+/* Firmware requested operation mode */
+#define STA_MASK			0x0001
+#define HOSTAPD_MASK		0x0002
+#define WFD_MASK			0x0004
+#define SOFTAP_FW_MASK	0x0008
+#define P2P_GO_ENABLED		0x0010
+#define P2P_GC_ENABLED		0x0020
+#define CONCURENT_MASK		0x00F0
+#endif /* (NDISVER >= 0x0600)  */
+#endif /* #if defined(NDISVER) */
+
+#define DHD_IF_ROLE_STA(role)	(role == WLC_E_IF_ROLE_STA ||\
+				role == WLC_E_IF_ROLE_P2P_CLIENT)
+
+/* For supporting multiple interfaces */
+#define DHD_MAX_IFS	16
+#define DHD_DEL_IF	-0xE
+#define DHD_BAD_IF	-0xF
+
+enum dhd_op_flags {
+/* Firmware requested operation mode */
+	DHD_FLAG_STA_MODE				= (1 << (0)), /* STA only */
+	DHD_FLAG_HOSTAP_MODE				= (1 << (1)), /* SOFTAP only */
+	DHD_FLAG_P2P_MODE				= (1 << (2)), /* P2P Only */
+	/* STA + P2P */
+	DHD_FLAG_CONCURR_SINGLE_CHAN_MODE = (DHD_FLAG_STA_MODE | DHD_FLAG_P2P_MODE),
+	DHD_FLAG_CONCURR_MULTI_CHAN_MODE		= (1 << (4)), /* STA + P2P */
+	/* Current P2P mode for P2P connection */
+	DHD_FLAG_P2P_GC_MODE				= (1 << (5)),
+	DHD_FLAG_P2P_GO_MODE				= (1 << (6)),
+	DHD_FLAG_MBSS_MODE				= (1 << (7)), /* MBSS in future */
+	DHD_FLAG_IBSS_MODE				= (1 << (8)),
+	DHD_FLAG_MFG_MODE				= (1 << (9))
+};
+
+/* Max sequential TX/RX Control timeouts to set HANG event */
+#ifndef MAX_CNTL_TX_TIMEOUT
+#define MAX_CNTL_TX_TIMEOUT 2
+#endif /* MAX_CNTL_TX_TIMEOUT */
+#ifndef MAX_CNTL_RX_TIMEOUT
+#define MAX_CNTL_RX_TIMEOUT 1
+#endif /* MAX_CNTL_RX_TIMEOUT */
+
+#define DHD_SCAN_ASSOC_ACTIVE_TIME	40 /* ms: Embedded default Active setting from DHD */
+#define DHD_SCAN_UNASSOC_ACTIVE_TIME 80 /* ms: Embedded def. Unassoc Active setting from DHD */
+#define DHD_SCAN_PASSIVE_TIME		130 /* ms: Embedded default Passive setting from DHD */
+
+#ifndef POWERUP_MAX_RETRY
+#define POWERUP_MAX_RETRY	3 /* how many times we retry to power up the chip */
+#endif
+#ifndef POWERUP_WAIT_MS
+#define POWERUP_WAIT_MS		2000 /* ms: time out in waiting wifi to come up */
+#endif
+
+enum dhd_bus_wake_state {
+	WAKE_LOCK_OFF,
+	WAKE_LOCK_PRIV,
+	WAKE_LOCK_DPC,
+	WAKE_LOCK_IOCTL,
+	WAKE_LOCK_DOWNLOAD,
+	WAKE_LOCK_TMOUT,
+	WAKE_LOCK_WATCHDOG,
+	WAKE_LOCK_LINK_DOWN_TMOUT,
+	WAKE_LOCK_PNO_FIND_TMOUT,
+	WAKE_LOCK_SOFTAP_SET,
+	WAKE_LOCK_SOFTAP_STOP,
+	WAKE_LOCK_SOFTAP_START,
+	WAKE_LOCK_SOFTAP_THREAD
+};
+
+enum dhd_prealloc_index {
+	DHD_PREALLOC_PROT = 0,
+	DHD_PREALLOC_RXBUF,
+	DHD_PREALLOC_DATABUF,
+	DHD_PREALLOC_OSL_BUF,
+#if defined(STATIC_WL_PRIV_STRUCT)
+	DHD_PREALLOC_WIPHY_ESCAN0 = 5,
+#endif /* STATIC_WL_PRIV_STRUCT */
+	DHD_PREALLOC_DHD_INFO = 7,
+	DHD_PREALLOC_DHD_WLFC_INFO = 8,
+	DHD_PREALLOC_IF_FLOW_LKUP = 9,
+	DHD_PREALLOC_FLOWRING = 10
+};
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef DHD_SDALIGN
+#define DHD_SDALIGN	32
+#endif
+
+/* host reordering packts logic */
+/* followed the structure to hold the reorder buffers (void **p) */
+typedef struct reorder_info {
+	void **p;
+	uint8 flow_id;
+	uint8 cur_idx;
+	uint8 exp_idx;
+	uint8 max_idx;
+	uint8 pend_pkts;
+} reorder_info_t;
+
+#ifdef DHDTCPACK_SUPPRESS
+
+enum {
+	/* TCPACK suppress off */
+	TCPACK_SUP_OFF,
+	/* Replace TCPACK in txq when new coming one has higher ACK number. */
+	TCPACK_SUP_REPLACE,
+	/* TCPACK_SUP_REPLACE + delayed TCPACK TX unless ACK to PSH DATA.
+	 * This will give benefits to Half-Duplex bus interface(e.g. SDIO) that
+	 * 1. we are able to read TCP DATA packets first from the bus
+	 * 2. TCPACKs that don't need to hurry delivered remains longer in TXQ so can be suppressed.
+	 */
+	TCPACK_SUP_DELAYTX,
+	TCPACK_SUP_HOLD,
+	TCPACK_SUP_LAST_MODE
+};
+#endif /* DHDTCPACK_SUPPRESS */
+
+
+/* DMA'ing r/w indices for rings supported */
+#ifdef BCM_INDX_TCM /* FW gets r/w indices in TCM */
+#define DMA_INDX_ENAB(dma_indxsup)	0
+#elif defined BCM_INDX_DMA  /* FW gets r/w indices from Host memory */
+#define DMA_INDX_ENAB(dma_indxsup)	1
+#else	/* r/w indices in TCM or host memory based on FW/Host agreement */
+#define DMA_INDX_ENAB(dma_indxsup)	dma_indxsup
+#endif	/* BCM_INDX_TCM */
+
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+struct tdls_peer_node {
+	uint8 addr[ETHER_ADDR_LEN];
+	struct tdls_peer_node *next;
+};
+typedef struct tdls_peer_node tdls_peer_node_t;
+typedef struct {
+	tdls_peer_node_t *node;
+	uint8 tdls_peer_count;
+} tdls_peer_tbl_t;
+#endif /* defined(WLTDLS) && defined(PCIE_FULL_DONGLE) */
+
+/* Common structure for module and instance linkage */
+typedef struct dhd_pub {
+	/* Linkage ponters */
+	osl_t *osh;		/* OSL handle */
+	struct dhd_bus *bus;	/* Bus module handle */
+	struct dhd_prot *prot;	/* Protocol module handle */
+	struct dhd_info  *info; /* Info module handle */
+
+	/* to NDIS developer, the structure dhd_common is redundant,
+	 * please do NOT merge it back from other branches !!!
+	 */
+
+
+	/* Internal dhd items */
+	bool up;		/* Driver up/down (to OS) */
+	bool txoff;		/* Transmit flow-controlled */
+	bool dongle_reset;  /* TRUE = DEVRESET put dongle into reset */
+	enum dhd_bus_state busstate;
+	uint hdrlen;		/* Total DHD header length (proto + bus) */
+	uint maxctl;		/* Max size rxctl request from proto to bus */
+	uint rxsz;		/* Rx buffer size bus module should use */
+	uint8 wme_dp;	/* wme discard priority */
+
+	/* Dongle media info */
+	bool iswl;		/* Dongle-resident driver is wl */
+	ulong drv_version;	/* Version of dongle-resident driver */
+	struct ether_addr mac;	/* MAC address obtained from dongle */
+	dngl_stats_t dstats;	/* Stats for dongle-based data */
+
+	/* Additional stats for the bus level */
+	ulong tx_packets;	/* Data packets sent to dongle */
+	ulong tx_dropped;	/* Data packets dropped in dhd */
+	ulong tx_multicast;	/* Multicast data packets sent to dongle */
+	ulong tx_errors;	/* Errors in sending data to dongle */
+	ulong tx_ctlpkts;	/* Control packets sent to dongle */
+	ulong tx_ctlerrs;	/* Errors sending control frames to dongle */
+	ulong rx_packets;	/* Packets sent up the network interface */
+	ulong rx_multicast;	/* Multicast packets sent up the network interface */
+	ulong rx_errors;	/* Errors processing rx data packets */
+	ulong rx_ctlpkts;	/* Control frames processed from dongle */
+	ulong rx_ctlerrs;	/* Errors in processing rx control frames */
+	ulong rx_dropped;	/* Packets dropped locally (no memory) */
+	ulong rx_flushed;  /* Packets flushed due to unscheduled sendup thread */
+	ulong wd_dpc_sched;   /* Number of times dhd dpc scheduled by watchdog timer */
+
+	ulong rx_readahead_cnt;	/* Number of packets where header read-ahead was used. */
+	ulong tx_realloc;	/* Number of tx packets we had to realloc for headroom */
+	ulong fc_packets;       /* Number of flow control pkts recvd */
+
+	/* Last error return */
+	int bcmerror;
+	uint tickcnt;
+
+	/* Last error from dongle */
+	int dongle_error;
+
+	uint8 country_code[WLC_CNTRY_BUF_SZ];
+
+	/* Suspend disable flag and "in suspend" flag */
+	int suspend_disable_flag; /* "1" to disable all extra powersaving during suspend */
+	int in_suspend;			/* flag set to 1 when early suspend called */
+#ifdef PNO_SUPPORT
+	int pno_enable;			/* pno status : "1" is pno enable */
+	int pno_suspend;		/* pno suspend status : "1" is pno suspended */
+#endif /* PNO_SUPPORT */
+	/* DTIM skip value, default 0(or 1) means wake each DTIM
+	 * 3 means skip 2 DTIMs and wake up 3rd DTIM(9th beacon when AP DTIM is 3)
+	 */
+	int suspend_bcn_li_dtim;         /* bcn_li_dtim value in suspend mode */
+#ifdef PKT_FILTER_SUPPORT
+	int early_suspended;	/* Early suspend status */
+	int dhcp_in_progress;	/* DHCP period */
+#endif
+
+	/* Pkt filter defination */
+	char * pktfilter[100];
+	int pktfilter_count;
+
+	wl_country_t dhd_cspec;		/* Current Locale info */
+	char eventmask[WL_EVENTING_MASK_LEN];
+	int	op_mode;				/* STA, HostAPD, WFD, SoftAP */
+
+/* Set this to 1 to use a seperate interface (p2p0) for p2p operations.
+ *  For ICS MR1 releases it should be disable to be compatable with ICS MR1 Framework
+ *  see target dhd-cdc-sdmmc-panda-cfg80211-icsmr1-gpl-debug in Makefile
+ */
+/* #define WL_ENABLE_P2P_IF		1 */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	struct mutex 	wl_start_stop_lock; /* lock/unlock for Android start/stop */
+	struct mutex 	wl_softap_lock;		 /* lock/unlock for any SoftAP/STA settings */
+#endif
+
+#ifdef WLBTAMP
+	uint16	maxdatablks;
+#endif /* WLBTAMP */
+#ifdef PROP_TXSTATUS
+	bool	wlfc_enabled;
+	int	wlfc_mode;
+	void*	wlfc_state;
+	/*
+	Mode in which the dhd flow control shall operate. Must be set before
+	traffic starts to the device.
+	0 - Do not do any proptxtstatus flow control
+	1 - Use implied credit from a packet status
+	2 - Use explicit credit
+	3 - Only AMPDU hostreorder used. no wlfc.
+	*/
+	uint8	proptxstatus_mode;
+	bool	proptxstatus_txoff;
+	bool	proptxstatus_module_ignore;
+	bool	proptxstatus_credit_ignore;
+	bool	proptxstatus_txstatus_ignore;
+
+	bool	wlfc_rxpkt_chk;
+	/*
+	 * implement below functions in each platform if needed.
+	 */
+	/* platform specific function whether to skip flow control */
+	bool (*skip_fc)(void);
+	/* platform specific function for wlfc_enable and wlfc_deinit */
+	void (*plat_init)(void *dhd);
+	void (*plat_deinit)(void *dhd);
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+	void *pno_state;
+#endif
+	bool	dongle_isolation;
+	bool	dongle_trap_occured;	/* flag for sending HANG event to upper layer */
+	int   hang_was_sent;
+	int   rxcnt_timeout;		/* counter rxcnt timeout to send HANG */
+	int   txcnt_timeout;		/* counter txcnt timeout to send HANG */
+	bool hang_report;		/* enable hang report by default */
+#ifdef WLMEDIA_HTSF
+	uint8 htsfdlystat_sz; /* Size of delay stats, max 255B */
+#endif
+#ifdef WLTDLS
+	bool tdls_enable;
+#endif
+	struct reorder_info *reorder_bufs[WLHOST_REORDERDATA_MAXFLOWS];
+	char  fw_capabilities[WLC_IOCTL_SMLEN];
+	#define MAXSKBPEND 1024
+	void *skbbuf[MAXSKBPEND];
+	uint32 store_idx;
+	uint32 sent_idx;
+#ifdef DHDTCPACK_SUPPRESS
+	uint8 tcpack_sup_mode;		/* TCPACK suppress mode */
+	void *tcpack_sup_module;	/* TCPACK suppress module */
+	uint32 tcpack_sup_ratio;
+	uint32 tcpack_sup_delay;
+#endif /* DHDTCPACK_SUPPRESS */
+#if defined(ARP_OFFLOAD_SUPPORT)
+	uint32 arp_version;
+#endif
+#if defined(BCMSUP_4WAY_HANDSHAKE) && defined(WLAN_AKM_SUITE_FT_8021X)
+	bool fw_4way_handshake;		/* Whether firmware will to do the 4way handshake. */
+#endif
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#ifdef PKT_FILTER_SUPPORT
+	uint pkt_filter_mode;
+	uint pkt_filter_ports_count;
+	uint16 pkt_filter_ports[WL_PKT_FILTER_PORTS_MAX];
+#endif /* PKT_FILTER_SUPPORT */
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+#ifdef CUSTOM_SET_CPUCORE
+	struct task_struct * current_dpc;
+	struct task_struct * current_rxf;
+	int chan_isvht80;
+#endif /* CUSTOM_SET_CPUCORE */
+
+	void    *sta_pool;          /* pre-allocated pool of sta objects */
+	void    *staid_allocator;   /* allocator of sta indexes */
+
+	void    *flowid_allocator;  /* unique flowid allocator */
+	void	*flow_ring_table;   /* flow ring table, include prot and bus info */
+	void	*if_flow_lkup;      /* per interface flowid lkup hash table */
+	void    *flowid_lock;       /* per os lock for flowid info protection */
+	uint32  num_flow_rings;
+
+	uint32 d2h_sync_mode;		/* D2H DMA completion sync mode */
+
+	uint8  flow_prio_map[NUMPRIO];
+	uint8	flow_prio_map_type;
+	char enable_log[MAX_EVENT];
+	bool dma_d2h_ring_upd_support;
+	bool dma_h2d_ring_upd_support;
+#ifdef DHD_WMF
+	bool wmf_ucast_igmp;
+#ifdef DHD_IGMP_UCQUERY
+	bool wmf_ucast_igmp_query;
+#endif
+#ifdef DHD_UCAST_UPNP
+	bool wmf_ucast_upnp;
+#endif
+#endif /* DHD_WMF */
+#ifdef DHD_UNICAST_DHCP
+	bool dhcp_unicast;
+#endif /* DHD_UNICAST_DHCP */
+#ifdef DHD_L2_FILTER
+	bool block_ping;
+#endif
+#if defined(WLTDLS) && defined(PCIE_FULL_DONGLE)
+	tdls_peer_tbl_t peer_tbl;
+#endif /* defined(WLTDLS) && defined(PCIE_FULL_DONGLE) */
+	char		*conf_path;		/* module_param: path to config vars file */
+	struct dhd_conf *conf;	/* Bus module handle */
+} dhd_pub_t;
+
+#if defined(BCMWDF)
+typedef struct {
+	dhd_pub_t *dhd_pub;
+} dhd_workitem_context_t;
+
+WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(dhd_workitem_context_t, dhd_get_dhd_workitem_context)
+#endif /* (BCMWDF)  */
+
+	#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+
+	#define DHD_PM_RESUME_WAIT_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+	#define _DHD_PM_RESUME_WAIT(a, b) do {\
+			int retry = 0; \
+			SMP_RD_BARRIER_DEPENDS(); \
+			while (dhd_mmc_suspend && retry++ != b) { \
+				SMP_RD_BARRIER_DEPENDS(); \
+				wait_event_interruptible_timeout(a, !dhd_mmc_suspend, 1); \
+			} \
+		} 	while (0)
+	#define DHD_PM_RESUME_WAIT(a) 		_DHD_PM_RESUME_WAIT(a, 200)
+	#define DHD_PM_RESUME_WAIT_FOREVER(a) 	_DHD_PM_RESUME_WAIT(a, ~0)
+	#ifdef CUSTOMER_HW4
+		#define DHD_PM_RESUME_RETURN_ERROR(a)   do { \
+				if (dhd_mmc_suspend) { \
+					printf("%s[%d]: mmc is still in suspend state!!!\n", \
+							__FUNCTION__, __LINE__); \
+					return a; \
+				} \
+			} while (0)
+	#else
+		#define DHD_PM_RESUME_RETURN_ERROR(a)	do { \
+			if (dhd_mmc_suspend) return a; } while (0)
+	#endif
+	#define DHD_PM_RESUME_RETURN		do { if (dhd_mmc_suspend) return; } while (0)
+
+	#define DHD_SPINWAIT_SLEEP_INIT(a) DECLARE_WAIT_QUEUE_HEAD(a);
+	#define SPINWAIT_SLEEP(a, exp, us) do { \
+		uint countdown = (us) + 9999; \
+		while ((exp) && (countdown >= 10000)) { \
+			wait_event_interruptible_timeout(a, FALSE, 1); \
+			countdown -= 10000; \
+		} \
+	} while (0)
+
+	#else
+
+	#define DHD_PM_RESUME_WAIT_INIT(a)
+	#define DHD_PM_RESUME_WAIT(a)
+	#define DHD_PM_RESUME_WAIT_FOREVER(a)
+	#define DHD_PM_RESUME_RETURN_ERROR(a)
+	#define DHD_PM_RESUME_RETURN
+
+	#define DHD_SPINWAIT_SLEEP_INIT(a)
+	#define SPINWAIT_SLEEP(a, exp, us)  do { \
+		uint countdown = (us) + 9; \
+		while ((exp) && (countdown >= 10)) { \
+			OSL_DELAY(10);  \
+			countdown -= 10;  \
+		} \
+	} while (0)
+
+	#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+#ifndef OSL_SLEEP
+#define OSL_SLEEP(ms)		OSL_DELAY(ms*1000)
+#endif /* OSL_SLEEP */
+
+#define DHD_IF_VIF	0x01	/* Virtual IF (Hidden from user) */
+
+#ifdef PNO_SUPPORT
+int dhd_pno_clean(dhd_pub_t *dhd);
+#endif /* PNO_SUPPORT */
+/*
+ *  Wake locks are an Android power management concept. They are used by applications and services
+ *  to request CPU resources.
+ */
+extern int dhd_os_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wake_unlock(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_timeout(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_rx_timeout_enable(dhd_pub_t *pub, int val);
+extern int dhd_os_wake_lock_ctrl_timeout_enable(dhd_pub_t *pub, int val);
+extern int dhd_os_wake_lock_ctrl_timeout_cancel(dhd_pub_t *pub);
+extern int dhd_os_wd_wake_lock(dhd_pub_t *pub);
+extern int dhd_os_wd_wake_unlock(dhd_pub_t *pub);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+extern int dhd_os_oob_irq_wake_lock_timeout(dhd_pub_t *pub, int val);
+extern int dhd_os_oob_irq_wake_unlock(dhd_pub_t *pub);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+extern int dhd_os_wake_lock_waive(dhd_pub_t *pub);
+extern int dhd_os_wake_lock_restore(dhd_pub_t *pub);
+
+inline static void MUTEX_LOCK_SOFTAP_SET_INIT(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	mutex_init(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+inline static void MUTEX_LOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	mutex_lock(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+inline static void MUTEX_UNLOCK_SOFTAP_SET(dhd_pub_t * dhdp)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	mutex_unlock(&dhdp->wl_softap_lock);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+}
+
+#define DHD_OS_WAKE_LOCK(pub)			dhd_os_wake_lock(pub)
+#define DHD_OS_WAKE_UNLOCK(pub)		dhd_os_wake_unlock(pub)
+#define DHD_OS_WAKE_LOCK_TIMEOUT(pub)		dhd_os_wake_lock_timeout(pub)
+#define DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(pub, val) \
+	dhd_os_wake_lock_rx_timeout_enable(pub, val)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(pub, val) \
+	dhd_os_wake_lock_ctrl_timeout_enable(pub, val)
+#define DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_CANCEL(pub) \
+	dhd_os_wake_lock_ctrl_timeout_cancel(pub)
+#define DHD_OS_WAKE_LOCK_WAIVE(pub)             dhd_os_wake_lock_waive(pub)
+#define DHD_OS_WAKE_LOCK_RESTORE(pub)           dhd_os_wake_lock_restore(pub)
+
+#define DHD_OS_WD_WAKE_LOCK(pub)		dhd_os_wd_wake_lock(pub)
+#define DHD_OS_WD_WAKE_UNLOCK(pub)		dhd_os_wd_wake_unlock(pub)
+#ifdef BCMPCIE_OOB_HOST_WAKE
+#define OOB_WAKE_LOCK_TIMEOUT 500
+#define DHD_OS_OOB_IRQ_WAKE_LOCK_TIMEOUT(pub, val) dhd_os_oob_irq_wake_lock_timeout(pub, val)
+#define DHD_OS_OOB_IRQ_WAKE_UNLOCK(pub)		dhd_os_oob_irq_wake_unlock(pub)
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#define DHD_PACKET_TIMEOUT_MS	500
+#define DHD_EVENT_TIMEOUT_MS	1500
+
+
+/* interface operations (register, remove) should be atomic, use this lock to prevent race
+ * condition among wifi on/off and interface operation functions
+ */
+void dhd_net_if_lock(struct net_device *dev);
+void dhd_net_if_unlock(struct net_device *dev);
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+extern struct mutex _dhd_sdio_mutex_lock_;
+#endif
+#endif /* MULTIPLE_SUPPLICANT */
+
+typedef enum dhd_attach_states
+{
+	DHD_ATTACH_STATE_INIT = 0x0,
+	DHD_ATTACH_STATE_NET_ALLOC = 0x1,
+	DHD_ATTACH_STATE_DHD_ALLOC = 0x2,
+	DHD_ATTACH_STATE_ADD_IF = 0x4,
+	DHD_ATTACH_STATE_PROT_ATTACH = 0x8,
+	DHD_ATTACH_STATE_WL_ATTACH = 0x10,
+	DHD_ATTACH_STATE_THREADS_CREATED = 0x20,
+	DHD_ATTACH_STATE_WAKELOCKS_INIT = 0x40,
+	DHD_ATTACH_STATE_CFG80211 = 0x80,
+	DHD_ATTACH_STATE_EARLYSUSPEND_DONE = 0x100,
+	DHD_ATTACH_STATE_DONE = 0x200
+} dhd_attach_states_t;
+
+/* Value -1 means we are unsuccessful in creating the kthread. */
+#define DHD_PID_KT_INVALID 	-1
+/* Value -2 means we are unsuccessful in both creating the kthread and tasklet */
+#define DHD_PID_KT_TL_INVALID	-2
+
+/*
+ * Exported from dhd OS modules (dhd_linux/dhd_ndis)
+ */
+
+/* Indication from bus module regarding presence/insertion of dongle.
+ * Return dhd_pub_t pointer, used as handle to OS module in later calls.
+ * Returned structure should have bus and prot pointers filled in.
+ * bus_hdrlen specifies required headroom for bus module header.
+ */
+extern dhd_pub_t *dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen);
+#if defined(WLP2P) && defined(WL_CFG80211)
+/* To allow attach/detach calls corresponding to p2p0 interface  */
+extern int dhd_attach_p2p(dhd_pub_t *);
+extern int dhd_detach_p2p(dhd_pub_t *);
+#endif /* WLP2P && WL_CFG80211 */
+extern int dhd_register_if(dhd_pub_t *dhdp, int idx, bool need_rtnl_lock);
+
+/* Indication from bus module regarding removal/absence of dongle */
+extern void dhd_detach(dhd_pub_t *dhdp);
+extern void dhd_free(dhd_pub_t *dhdp);
+extern void dhd_clear(dhd_pub_t *dhdp);
+
+/* Indication from bus module to change flow-control state */
+extern void dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool on);
+
+/* Store the status of a connection attempt for later retrieval by an iovar */
+extern void dhd_store_conn_status(uint32 event, uint32 status, uint32 reason);
+
+extern bool dhd_prec_enq(dhd_pub_t *dhdp, struct pktq *q, void *pkt, int prec);
+
+/* Receive frame for delivery to OS.  Callee disposes of rxp. */
+extern void dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *rxp, int numpkt, uint8 chan);
+
+/* Return pointer to interface name */
+extern char *dhd_ifname(dhd_pub_t *dhdp, int idx);
+
+/* Request scheduling of the bus dpc */
+extern void dhd_sched_dpc(dhd_pub_t *dhdp);
+
+/* Notify tx completion */
+extern void dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success);
+
+/* OS independent layer functions */
+extern int dhd_os_proto_block(dhd_pub_t * pub);
+extern int dhd_os_proto_unblock(dhd_pub_t * pub);
+extern int dhd_os_ioctl_resp_wait(dhd_pub_t * pub, uint * condition, bool * pending);
+extern int dhd_os_ioctl_resp_wake(dhd_pub_t * pub);
+extern unsigned int dhd_os_get_ioctl_resp_timeout(void);
+extern void dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec);
+
+extern int dhd_os_get_image_block(char * buf, int len, void * image);
+extern void * dhd_os_open_image(char * filename);
+extern void dhd_os_close_image(void * image);
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+extern void dhd_os_sdlock(dhd_pub_t * pub);
+extern void dhd_os_sdunlock(dhd_pub_t * pub);
+extern void dhd_os_sdlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_txq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_sndup_rxq(dhd_pub_t * pub);
+#ifdef DHDTCPACK_SUPPRESS
+extern void dhd_os_tcpacklock(dhd_pub_t *pub);
+extern void dhd_os_tcpackunlock(dhd_pub_t *pub);
+#endif /* DHDTCPACK_SUPPRESS */
+
+extern int dhd_customer_oob_irq_map(void *adapter, unsigned long *irq_flags_ptr);
+extern int dhd_customer_gpio_wlan_ctrl(void *adapter, int onoff);
+extern int dhd_custom_get_mac_address(void *adapter, unsigned char *buf);
+extern void get_customized_country_code(void *adapter, char *country_iso_code, wl_country_t *cspec);
+extern void dhd_os_sdunlock_sndup_rxq(dhd_pub_t * pub);
+extern void dhd_os_sdlock_eventq(dhd_pub_t * pub);
+extern void dhd_os_sdunlock_eventq(dhd_pub_t * pub);
+extern bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret);
+extern int dhd_os_send_hang_message(dhd_pub_t *dhdp);
+extern void dhd_set_version_info(dhd_pub_t *pub, char *fw);
+extern bool dhd_os_check_if_up(dhd_pub_t *pub);
+extern int dhd_os_check_wakelock(dhd_pub_t *pub);
+extern int dhd_os_check_wakelock_all(dhd_pub_t *pub);
+extern int dhd_get_instance(dhd_pub_t *pub);
+#ifdef CUSTOM_SET_CPUCORE
+extern void dhd_set_cpucore(dhd_pub_t *dhd, int set);
+#endif /* CUSTOM_SET_CPUCORE */
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+#ifdef SUPPORT_AP_POWERSAVE
+extern int dhd_set_ap_powersave(dhd_pub_t *dhdp, int ifidx, int enable);
+#endif
+
+
+#ifdef PKT_FILTER_SUPPORT
+#define DHD_UNICAST_FILTER_NUM		0
+#define DHD_BROADCAST_FILTER_NUM	1
+#define DHD_MULTICAST4_FILTER_NUM	2
+#define DHD_MULTICAST6_FILTER_NUM	3
+#define DHD_MDNS_FILTER_NUM		4
+#define DHD_ARP_FILTER_NUM		5
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+/* Port based packet filtering command actions */
+#define PKT_FILTER_PORTS_CLEAR		0
+#define PKT_FILTER_PORTS_ADD		1
+#define PKT_FILTER_PORTS_DEL		2
+#define PKT_FILTER_PORTS_LOOPBACK	3
+#define PKT_FILTER_PORTS_MAX		PKT_FILTER_PORTS_LOOPBACK
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+extern int dhd_os_enable_packet_filter(dhd_pub_t *dhdp, int val);
+extern void dhd_enable_packet_filter(int value, dhd_pub_t *dhd);
+extern int net_os_enable_packet_filter(struct net_device *dev, int val);
+extern int net_os_rxfilter_add_remove(struct net_device *dev, int val, int num);
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+extern void dhd_set_packet_filter_mode(struct net_device *dev, char *command);
+extern int dhd_set_packet_filter_ports(struct net_device *dev, char *command);
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+#endif /* PKT_FILTER_SUPPORT */
+
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd);
+extern bool dhd_support_sta_mode(dhd_pub_t *dhd);
+
+#ifdef DHD_DEBUG
+extern int write_to_file(dhd_pub_t *dhd, uint8 *buf, int size);
+#endif /* DHD_DEBUG */
+
+typedef struct {
+	uint32 limit;		/* Expiration time (usec) */
+	uint32 increment;	/* Current expiration increment (usec) */
+	uint32 elapsed;		/* Current elapsed time (usec) */
+	uint32 tick;		/* O/S tick time (usec) */
+} dhd_timeout_t;
+
+#ifdef SHOW_LOGTRACE
+typedef struct {
+	int  num_fmts;
+	char **fmts;
+	char *raw_fmts;
+} dhd_event_log_t;
+#endif /* SHOW_LOGTRACE */
+
+extern void dhd_timeout_start(dhd_timeout_t *tmo, uint usec);
+extern int dhd_timeout_expired(dhd_timeout_t *tmo);
+
+extern int dhd_ifname2idx(struct dhd_info *dhd, char *name);
+extern int dhd_ifidx2hostidx(struct dhd_info *dhd, int ifidx);
+extern int dhd_net2idx(struct dhd_info *dhd, struct net_device *net);
+extern struct net_device * dhd_idx2net(void *pub, int ifidx);
+extern int net_os_send_hang_message(struct net_device *dev);
+extern int wl_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata,
+                         wl_event_msg_t *, void **data_ptr,  void *);
+extern void wl_event_to_host_order(wl_event_msg_t * evt);
+
+extern int dhd_wl_ioctl(dhd_pub_t *dhd_pub, int ifindex, wl_ioctl_t *ioc, void *buf, int len);
+extern int dhd_wl_ioctl_cmd(dhd_pub_t *dhd_pub, int cmd, void *arg, int len, uint8 set,
+                            int ifindex);
+extern void dhd_common_init(osl_t *osh);
+
+extern int dhd_do_driver_init(struct net_device *net);
+extern int dhd_event_ifadd(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+	char *name, uint8 *mac);
+extern int dhd_event_ifdel(struct dhd_info *dhd, struct wl_event_data_if *ifevent,
+	char *name, uint8 *mac);
+extern struct net_device* dhd_allocate_if(dhd_pub_t *dhdpub, int ifidx, char *name,
+	uint8 *mac, uint8 bssidx, bool need_rtnl_lock);
+extern int dhd_remove_if(dhd_pub_t *dhdpub, int ifidx, bool need_rtnl_lock);
+extern void dhd_vif_add(struct dhd_info *dhd, int ifidx, char * name);
+extern void dhd_vif_del(struct dhd_info *dhd, int ifidx);
+extern void dhd_event(struct dhd_info *dhd, char *evpkt, int evlen, int ifidx);
+extern void dhd_vif_sendup(struct dhd_info *dhd, int ifidx, uchar *cp, int len);
+
+/* Send packet to dongle via data channel */
+extern int dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pkt);
+
+/* send up locally generated event */
+extern void dhd_sendup_event_common(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+/* Send event to host */
+extern void dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data);
+#ifdef LOG_INTO_TCPDUMP
+extern void dhd_sendup_log(dhd_pub_t *dhdp, void *data, int len);
+#endif /* LOG_INTO_TCPDUMP */
+extern int dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag);
+extern uint dhd_bus_status(dhd_pub_t *dhdp);
+extern int  dhd_bus_start(dhd_pub_t *dhdp);
+extern int dhd_bus_suspend(dhd_pub_t *dhdpub);
+extern int dhd_bus_resume(dhd_pub_t *dhdpub, int stage);
+extern int dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size);
+extern void dhd_print_buf(void *pbuf, int len, int bytes_per_line);
+extern bool dhd_is_associated(dhd_pub_t *dhd, void *bss_buf, int *retval);
+#if defined(BCMSDIO) || defined(BCMPCIE)
+extern uint dhd_bus_chip_id(dhd_pub_t *dhdp);
+extern uint dhd_bus_chiprev_id(dhd_pub_t *dhdp);
+extern uint dhd_bus_chippkg_id(dhd_pub_t *dhdp);
+#endif /* defined(BCMSDIO) || defined(BCMPCIE) */
+
+#if defined(KEEP_ALIVE)
+extern int dhd_keep_alive_onoff(dhd_pub_t *dhd);
+#endif /* KEEP_ALIVE */
+
+/* OS spin lock API */
+extern void *dhd_os_spin_lock_init(osl_t *osh);
+extern void dhd_os_spin_lock_deinit(osl_t *osh, void *lock);
+extern unsigned long dhd_os_spin_lock(void *lock);
+void dhd_os_spin_unlock(void *lock, unsigned long flags);
+
+/*
+ * Manage sta objects in an interface. Interface is identified by an ifindex and
+ * sta(s) within an interfaces are managed using a MacAddress of the sta.
+ */
+struct dhd_sta;
+extern struct dhd_sta *dhd_findadd_sta(void *pub, int ifidx, void *ea);
+extern void dhd_del_sta(void *pub, int ifidx, void *ea);
+extern int dhd_get_ap_isolate(dhd_pub_t *dhdp, uint32 idx);
+extern int dhd_set_ap_isolate(dhd_pub_t *dhdp, uint32 idx, int val);
+extern int dhd_bssidx2idx(dhd_pub_t *dhdp, uint32 bssidx);
+
+extern bool dhd_is_concurrent_mode(dhd_pub_t *dhd);
+extern int dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf, uint cmd_len, int set);
+typedef enum cust_gpio_modes {
+	WLAN_RESET_ON,
+	WLAN_RESET_OFF,
+	WLAN_POWER_ON,
+	WLAN_POWER_OFF
+} cust_gpio_modes_t;
+
+extern int wl_iw_iscan_set_scan_broadcast_prep(struct net_device *dev, uint flag);
+extern int wl_iw_send_priv_event(struct net_device *dev, char *flag);
+/*
+ * Insmod parameters for debug/test
+ */
+
+/* Watchdog timer interval */
+extern uint dhd_watchdog_ms;
+
+#if defined(DHD_DEBUG)
+/* Console output poll interval */
+extern uint dhd_console_ms;
+#endif /* defined(DHD_DEBUG) */
+extern uint android_msg_level;
+extern uint config_msg_level;
+extern uint sd_msglevel;
+#ifdef WL_WIRELESS_EXT
+extern uint iw_msg_level;
+#endif
+#ifdef WL_CFG80211
+extern uint wl_dbg_level;
+#endif
+
+#ifdef CUSTOMER_HW
+struct wifi_platform_data {
+	int (*set_power)(bool val);
+	int (*set_carddetect)(bool val);
+	void *(*mem_prealloc)(int section, unsigned long size);
+	int (*get_mac_addr)(unsigned char *buf);
+	void *(*get_country_code)(char *ccode);
+};
+#endif
+
+extern uint dhd_slpauto;
+
+/* Use interrupts */
+extern uint dhd_intr;
+
+/* Use polling */
+extern uint dhd_poll;
+
+/* ARP offload agent mode */
+extern uint dhd_arp_mode;
+
+/* ARP offload enable */
+extern uint dhd_arp_enable;
+
+/* Pkt filte enable control */
+extern uint dhd_pkt_filter_enable;
+
+/*  Pkt filter init setup */
+extern uint dhd_pkt_filter_init;
+
+/* Pkt filter mode control */
+extern uint dhd_master_mode;
+
+/* Roaming mode control */
+extern uint dhd_roam_disable;
+
+/* Roaming mode control */
+extern uint dhd_radio_up;
+
+/* Initial idletime ticks (may be -1 for immediate idle, 0 for no idle) */
+extern int dhd_idletime;
+#ifdef DHD_USE_IDLECOUNT
+#define DHD_IDLETIME_TICKS 5
+#else
+#define DHD_IDLETIME_TICKS 1
+#endif /* DHD_USE_IDLECOUNT */
+
+/* SDIO Drive Strength */
+extern uint dhd_sdiod_drive_strength;
+
+/* Override to force tx queueing all the time */
+extern uint dhd_force_tx_queueing;
+/* Default KEEP_ALIVE Period is 55 sec to prevent AP from sending Keep Alive probe frame */
+#define DEFAULT_KEEP_ALIVE_VALUE 	55000 /* msec */
+#ifndef CUSTOM_KEEP_ALIVE_SETTING
+#define CUSTOM_KEEP_ALIVE_SETTING 	DEFAULT_KEEP_ALIVE_VALUE
+#endif /* DEFAULT_KEEP_ALIVE_VALUE */
+
+#define NULL_PKT_STR	"null_pkt"
+
+/* hooks for custom glom setting option via Makefile */
+#define DEFAULT_GLOM_VALUE 	-1
+#ifndef CUSTOM_GLOM_SETTING
+#define CUSTOM_GLOM_SETTING 	DEFAULT_GLOM_VALUE
+#endif
+#define WL_AUTO_ROAM_TRIGGER -75
+/* hooks for custom Roaming Trigger  setting via Makefile */
+#define DEFAULT_ROAM_TRIGGER_VALUE -75 /* dBm default roam trigger all band */
+#define DEFAULT_ROAM_TRIGGER_SETTING 	-1
+#ifndef CUSTOM_ROAM_TRIGGER_SETTING
+#define CUSTOM_ROAM_TRIGGER_SETTING 	DEFAULT_ROAM_TRIGGER_VALUE
+#endif
+
+/* hooks for custom Roaming Romaing  setting via Makefile */
+#define DEFAULT_ROAM_DELTA_VALUE  10 /* dBm default roam delta all band */
+#define DEFAULT_ROAM_DELTA_SETTING 	-1
+#ifndef CUSTOM_ROAM_DELTA_SETTING
+#define CUSTOM_ROAM_DELTA_SETTING 	DEFAULT_ROAM_DELTA_VALUE
+#endif
+
+/* hooks for custom PNO Event wake lock to guarantee enough time
+	for the Platform to detect Event before system suspended
+*/
+#define DEFAULT_PNO_EVENT_LOCK_xTIME 	2 	/* multiplay of DHD_PACKET_TIMEOUT_MS */
+#ifndef CUSTOM_PNO_EVENT_LOCK_xTIME
+#define CUSTOM_PNO_EVENT_LOCK_xTIME	 DEFAULT_PNO_EVENT_LOCK_xTIME
+#endif
+/* hooks for custom dhd_dpc_prio setting option via Makefile */
+#define DEFAULT_DHP_DPC_PRIO  1
+#ifndef CUSTOM_DPC_PRIO_SETTING
+#define CUSTOM_DPC_PRIO_SETTING 	DEFAULT_DHP_DPC_PRIO
+#endif
+
+#ifndef CUSTOM_LISTEN_INTERVAL
+#define CUSTOM_LISTEN_INTERVAL 		LISTEN_INTERVAL
+#endif /* CUSTOM_LISTEN_INTERVAL */
+
+#define DEFAULT_SUSPEND_BCN_LI_DTIM		3
+#ifndef CUSTOM_SUSPEND_BCN_LI_DTIM
+#define CUSTOM_SUSPEND_BCN_LI_DTIM		DEFAULT_SUSPEND_BCN_LI_DTIM
+#endif
+
+#ifndef CUSTOM_RXF_PRIO_SETTING
+#define CUSTOM_RXF_PRIO_SETTING		MAX((CUSTOM_DPC_PRIO_SETTING - 1), 1)
+#endif
+
+#define DEFAULT_WIFI_TURNOFF_DELAY		0
+#ifndef WIFI_TURNOFF_DELAY
+#define WIFI_TURNOFF_DELAY		DEFAULT_WIFI_TURNOFF_DELAY
+#endif /* WIFI_TURNOFF_DELAY */
+
+#define DEFAULT_WIFI_TURNON_DELAY		200
+#ifndef WIFI_TURNON_DELAY
+#define WIFI_TURNON_DELAY		DEFAULT_WIFI_TURNON_DELAY
+#endif /* WIFI_TURNON_DELAY */
+
+#ifdef BCMSDIO
+#define DEFAULT_DHD_WATCHDOG_INTERVAL_MS	10 /* msec */
+#else
+#define DEFAULT_DHD_WATCHDOG_INTERVAL_MS	0 /* msec */
+#endif
+#ifndef CUSTOM_DHD_WATCHDOG_MS
+#define CUSTOM_DHD_WATCHDOG_MS			DEFAULT_DHD_WATCHDOG_INTERVAL_MS
+#endif /* DEFAULT_DHD_WATCHDOG_INTERVAL_MS */
+
+#ifdef WLTDLS
+#ifndef CUSTOM_TDLS_IDLE_MODE_SETTING
+#define CUSTOM_TDLS_IDLE_MODE_SETTING  60000 /* 60sec to tear down TDLS of not active */
+#endif
+#ifndef CUSTOM_TDLS_RSSI_THRESHOLD_HIGH
+#define CUSTOM_TDLS_RSSI_THRESHOLD_HIGH -70 /* rssi threshold for establishing TDLS link */
+#endif
+#ifndef CUSTOM_TDLS_RSSI_THRESHOLD_LOW
+#define CUSTOM_TDLS_RSSI_THRESHOLD_LOW -80 /* rssi threshold for tearing down TDLS link */
+#endif
+#endif /* WLTDLS */
+
+#define DEFAULT_BCN_TIMEOUT		8
+#ifndef CUSTOM_BCN_TIMEOUT
+#define CUSTOM_BCN_TIMEOUT		DEFAULT_BCN_TIMEOUT
+#endif
+
+#define MAX_DTIM_SKIP_BEACON_INTERVAL	100 /* max allowed associated AP beacon for DTIM skip */
+#ifndef MAX_DTIM_ALLOWED_INTERVAL
+#define MAX_DTIM_ALLOWED_INTERVAL 600 /* max allowed total beacon interval for DTIM skip */
+#endif
+#define NO_DTIM_SKIP 1
+#ifdef SDTEST
+/* Echo packet generator (SDIO), pkts/s */
+extern uint dhd_pktgen;
+
+/* Echo packet len (0 => sawtooth, max 1800) */
+extern uint dhd_pktgen_len;
+#define MAX_PKTGEN_LEN 1800
+#endif
+
+
+/* optionally set by a module_param_string() */
+#define MOD_PARAM_PATHLEN	2048
+#define MOD_PARAM_INFOLEN	512
+
+#ifdef SOFTAP
+extern char fw_path2[MOD_PARAM_PATHLEN];
+#endif
+
+/* Flag to indicate if we should download firmware on driver load */
+extern uint dhd_download_fw_on_driverload;
+
+
+extern void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar);
+extern void dhd_wait_event_wakeup(dhd_pub_t*dhd);
+
+#define IFLOCK_INIT(lock)       *lock = 0
+#define IFLOCK(lock)    while (InterlockedCompareExchange((lock), 1, 0))	\
+	NdisStallExecution(1);
+#define IFUNLOCK(lock)  InterlockedExchange((lock), 0)
+#define IFLOCK_FREE(lock)
+#define FW_SUPPORTED(dhd, capa) ((strstr(dhd->fw_capabilities, #capa) != NULL))
+#ifdef ARP_OFFLOAD_SUPPORT
+#define MAX_IPV4_ENTRIES	8
+void dhd_arp_offload_set(dhd_pub_t * dhd, int arp_mode);
+void dhd_arp_offload_enable(dhd_pub_t * dhd, int arp_enable);
+
+/* dhd_commn arp offload wrapers */
+void dhd_aoe_hostip_clr(dhd_pub_t *dhd, int idx);
+void dhd_aoe_arp_clr(dhd_pub_t *dhd, int idx);
+int dhd_arp_get_arp_hostip_table(dhd_pub_t *dhd, void *buf, int buflen, int idx);
+void dhd_arp_offload_add_ip(dhd_pub_t *dhd, uint32 ipaddr, int idx);
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef WLTDLS
+int dhd_tdls_enable(struct net_device *dev, bool tdls_on, bool auto_on, struct ether_addr *mac);
+#ifdef PCIE_FULL_DONGLE
+void dhd_tdls_update_peer_info(struct net_device *dev, bool connect_disconnect, uint8 *addr);
+#endif /* PCIE_FULL_DONGLE */
+#endif /* WLTDLS */
+/* Neighbor Discovery Offload Support */
+int dhd_ndo_enable(dhd_pub_t * dhd, int ndo_enable);
+int dhd_ndo_add_ip(dhd_pub_t *dhd, char* ipaddr, int idx);
+int dhd_ndo_remove_ip(dhd_pub_t *dhd, int idx);
+/* ioctl processing for nl80211 */
+int dhd_ioctl_process(dhd_pub_t *pub, int ifidx, struct dhd_ioctl *ioc, void *data_buf);
+
+void dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path, char *pnv_path, char *pconf_path);
+void dhd_set_bus_state(void *bus, uint32 state);
+
+/* Remove proper pkts(either one no-frag pkt or whole fragmented pkts) */
+typedef int (*f_droppkt_t)(dhd_pub_t *dhdp, int prec, void* p, bool bPktInQ);
+extern bool dhd_prec_drop_pkts(dhd_pub_t *dhdp, struct pktq *pq, int prec, f_droppkt_t fn);
+
+#ifdef PROP_TXSTATUS
+int dhd_os_wlfc_block(dhd_pub_t *pub);
+int dhd_os_wlfc_unblock(dhd_pub_t *pub);
+extern const uint8 prio2fifo[];
+#endif /* PROP_TXSTATUS */
+
+uint8* dhd_os_prealloc(dhd_pub_t *dhdpub, int section, uint size, bool kmalloc_if_fail);
+void dhd_os_prefree(dhd_pub_t *dhdpub, void *addr, uint size);
+
+int dhd_process_cid_mac(dhd_pub_t *dhdp, bool prepost);
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF)
+#define DHD_OS_PREALLOC(dhdpub, section, size) dhd_os_prealloc(dhdpub, section, size, FALSE)
+#define DHD_OS_PREFREE(dhdpub, addr, size) dhd_os_prefree(dhdpub, addr, size)
+#else
+#define DHD_OS_PREALLOC(dhdpub, section, size) MALLOC(dhdpub->osh, size)
+#define DHD_OS_PREFREE(dhdpub, addr, size) MFREE(dhdpub->osh, addr, size)
+#endif /* defined(CONFIG_DHD_USE_STATIC_BUF) */
+
+
+#define dhd_add_flowid(pub, ifidx, ac_prio, ea, flowid)  do {} while (0)
+#define dhd_del_flowid(pub, ifidx, flowid)               do {} while (0)
+
+extern unsigned long dhd_os_general_spin_lock(dhd_pub_t *pub);
+extern void dhd_os_general_spin_unlock(dhd_pub_t *pub, unsigned long flags);
+
+/** Miscellaenous DHD Spin Locks */
+
+/* Disable router 3GMAC bypass path perimeter lock */
+#define DHD_PERIM_LOCK(dhdp)              do {} while (0)
+#define DHD_PERIM_UNLOCK(dhdp)            do {} while (0)
+
+/* Enable DHD general spin lock/unlock */
+#define DHD_GENERAL_LOCK(dhdp, flags) \
+	(flags) = dhd_os_general_spin_lock(dhdp)
+#define DHD_GENERAL_UNLOCK(dhdp, flags) \
+	dhd_os_general_spin_unlock((dhdp), (flags))
+
+/* Enable DHD flowring spin lock/unlock */
+#define DHD_FLOWRING_LOCK(lock, flags)     (flags) = dhd_os_spin_lock(lock)
+#define DHD_FLOWRING_UNLOCK(lock, flags)   dhd_os_spin_unlock((lock), (flags))
+
+/* Enable DHD common flowring info spin lock/unlock */
+#define DHD_FLOWID_LOCK(lock, flags)       (flags) = dhd_os_spin_lock(lock)
+#define DHD_FLOWID_UNLOCK(lock, flags)     dhd_os_spin_unlock((lock), (flags))
+
+
+
+typedef struct wl_io_pport {
+	dhd_pub_t *dhd_pub;
+	uint ifidx;
+} wl_io_pport_t;
+
+extern void *dhd_pub_wlinfo(dhd_pub_t *dhd_pub);
+#ifdef CONFIG_MACH_UNIVERSAL5433
+extern int check_rev(void);
+#endif
+#endif /* _dhd_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_ip.c b/drivers/net/wireless/bcm4336/dhd_ip.c
--- a/drivers/net/wireless/bcm4336/dhd_ip.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_ip.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,1285 @@
+/*
+ * IP Packet Parser Module.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_ip.c 502735 2014-09-16 00:53:02Z $
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <proto/ethernet.h>
+#include <proto/vlan.h>
+#include <proto/802.3.h>
+#include <proto/bcmip.h>
+#include <bcmendian.h>
+
+#include <dhd_dbg.h>
+
+#include <dhd_ip.h>
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <proto/bcmtcp.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+/* special values */
+/* 802.3 llc/snap header */
+static const uint8 llc_snap_hdr[SNAP_HDR_LEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+
+pkt_frag_t pkt_frag_info(osl_t *osh, void *p)
+{
+	uint8 *frame;
+	int length;
+	uint8 *pt;			/* Pointer to type field */
+	uint16 ethertype;
+	struct ipv4_hdr *iph;		/* IP frame pointer */
+	int ipl;			/* IP frame length */
+	uint16 iph_frag;
+
+	ASSERT(osh && p);
+
+	frame = PKTDATA(osh, p);
+	length = PKTLEN(osh, p);
+
+	/* Process Ethernet II or SNAP-encapsulated 802.3 frames */
+	if (length < ETHER_HDR_LEN) {
+		DHD_INFO(("%s: short eth frame (%d)\n", __FUNCTION__, length));
+		return DHD_PKT_FRAG_NONE;
+	} else if (ntoh16(*(uint16 *)(frame + ETHER_TYPE_OFFSET)) >= ETHER_TYPE_MIN) {
+		/* Frame is Ethernet II */
+		pt = frame + ETHER_TYPE_OFFSET;
+	} else if (length >= ETHER_HDR_LEN + SNAP_HDR_LEN + ETHER_TYPE_LEN &&
+	           !bcmp(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN)) {
+		pt = frame + ETHER_HDR_LEN + SNAP_HDR_LEN;
+	} else {
+		DHD_INFO(("%s: non-SNAP 802.3 frame\n", __FUNCTION__));
+		return DHD_PKT_FRAG_NONE;
+	}
+
+	ethertype = ntoh16(*(uint16 *)pt);
+
+	/* Skip VLAN tag, if any */
+	if (ethertype == ETHER_TYPE_8021Q) {
+		pt += VLAN_TAG_LEN;
+
+		if (pt + ETHER_TYPE_LEN > frame + length) {
+			DHD_INFO(("%s: short VLAN frame (%d)\n", __FUNCTION__, length));
+			return DHD_PKT_FRAG_NONE;
+		}
+
+		ethertype = ntoh16(*(uint16 *)pt);
+	}
+
+	if (ethertype != ETHER_TYPE_IP) {
+		DHD_INFO(("%s: non-IP frame (ethertype 0x%x, length %d)\n",
+			__FUNCTION__, ethertype, length));
+		return DHD_PKT_FRAG_NONE;
+	}
+
+	iph = (struct ipv4_hdr *)(pt + ETHER_TYPE_LEN);
+	ipl = (uint)(length - (pt + ETHER_TYPE_LEN - frame));
+
+	/* We support IPv4 only */
+	if ((ipl < IPV4_OPTIONS_OFFSET) || (IP_VER(iph) != IP_VER_4)) {
+		DHD_INFO(("%s: short frame (%d) or non-IPv4\n", __FUNCTION__, ipl));
+		return DHD_PKT_FRAG_NONE;
+	}
+
+	iph_frag = ntoh16(iph->frag);
+
+	if (iph_frag & IPV4_FRAG_DONT) {
+		return DHD_PKT_FRAG_NONE;
+	} else if ((iph_frag & IPV4_FRAG_MORE) == 0) {
+		return DHD_PKT_FRAG_LAST;
+	} else {
+		return (iph_frag & IPV4_FRAG_OFFSET_MASK)? DHD_PKT_FRAG_CONT : DHD_PKT_FRAG_FIRST;
+	}
+}
+
+bool pkt_is_dhcp(osl_t *osh, void *p)
+{
+	uint8 *frame;
+	int length;
+	uint8 *pt;			/* Pointer to type field */
+	uint16 ethertype;
+	struct ipv4_hdr *iph;		/* IP frame pointer */
+	int ipl;			/* IP frame length */
+	uint16 src_port;
+
+	ASSERT(osh && p);
+
+	frame = PKTDATA(osh, p);
+	length = PKTLEN(osh, p);
+
+	/* Process Ethernet II or SNAP-encapsulated 802.3 frames */
+	if (length < ETHER_HDR_LEN) {
+		DHD_INFO(("%s: short eth frame (%d)\n", __FUNCTION__, length));
+		return FALSE;
+	} else if (ntoh16(*(uint16 *)(frame + ETHER_TYPE_OFFSET)) >= ETHER_TYPE_MIN) {
+		/* Frame is Ethernet II */
+		pt = frame + ETHER_TYPE_OFFSET;
+	} else if (length >= ETHER_HDR_LEN + SNAP_HDR_LEN + ETHER_TYPE_LEN &&
+	           !bcmp(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN)) {
+		pt = frame + ETHER_HDR_LEN + SNAP_HDR_LEN;
+	} else {
+		DHD_INFO(("%s: non-SNAP 802.3 frame\n", __FUNCTION__));
+		return FALSE;
+	}
+
+	ethertype = ntoh16(*(uint16 *)pt);
+
+	/* Skip VLAN tag, if any */
+	if (ethertype == ETHER_TYPE_8021Q) {
+		pt += VLAN_TAG_LEN;
+
+		if (pt + ETHER_TYPE_LEN > frame + length) {
+			DHD_INFO(("%s: short VLAN frame (%d)\n", __FUNCTION__, length));
+			return FALSE;
+		}
+
+		ethertype = ntoh16(*(uint16 *)pt);
+	}
+
+	if (ethertype != ETHER_TYPE_IP) {
+		DHD_INFO(("%s: non-IP frame (ethertype 0x%x, length %d)\n",
+			__FUNCTION__, ethertype, length));
+		return FALSE;
+	}
+
+	iph = (struct ipv4_hdr *)(pt + ETHER_TYPE_LEN);
+	ipl = (uint)(length - (pt + ETHER_TYPE_LEN - frame));
+
+	/* We support IPv4 only */
+	if ((ipl < (IPV4_OPTIONS_OFFSET + 2)) || (IP_VER(iph) != IP_VER_4)) {
+		DHD_INFO(("%s: short frame (%d) or non-IPv4\n", __FUNCTION__, ipl));
+		return FALSE;
+	}
+
+	src_port = ntoh16(*(uint16 *)(pt + ETHER_TYPE_LEN + IPV4_OPTIONS_OFFSET));
+
+	return (src_port == 0x43 || src_port == 0x44);
+}
+
+#ifdef DHDTCPACK_SUPPRESS
+
+typedef struct {
+	void *pkt_in_q;		/* TCP ACK packet that is already in txq or DelayQ */
+	void *pkt_ether_hdr;	/* Ethernet header pointer of pkt_in_q */
+	int ifidx;
+	uint8 supp_cnt;
+	dhd_pub_t *dhdp;
+	struct timer_list timer;
+} tcpack_info_t;
+
+typedef struct _tdata_psh_info_t {
+	uint32 end_seq;			/* end seq# of a received TCP PSH DATA pkt */
+	struct _tdata_psh_info_t *next;	/* next pointer of the link chain */
+} tdata_psh_info_t;
+
+typedef struct {
+	uint8 src_ip_addr[IPV4_ADDR_LEN];	/* SRC ip addrs of this TCP stream */
+	uint8 dst_ip_addr[IPV4_ADDR_LEN];	/* DST ip addrs of this TCP stream */
+	uint8 src_tcp_port[TCP_PORT_LEN];	/* SRC tcp ports of this TCP stream */
+	uint8 dst_tcp_port[TCP_PORT_LEN];	/* DST tcp ports of this TCP stream */
+	tdata_psh_info_t *tdata_psh_info_head;	/* Head of received TCP PSH DATA chain */
+	tdata_psh_info_t *tdata_psh_info_tail;	/* Tail of received TCP PSH DATA chain */
+	uint32 last_used_time;	/* The last time this tcpdata_info was used(in ms) */
+} tcpdata_info_t;
+
+/* TCPACK SUPPRESS module */
+typedef struct {
+	int tcpack_info_cnt;
+	tcpack_info_t tcpack_info_tbl[TCPACK_INFO_MAXNUM];	/* Info of TCP ACK to send */
+	int tcpdata_info_cnt;
+	tcpdata_info_t tcpdata_info_tbl[TCPDATA_INFO_MAXNUM];	/* Info of received TCP DATA */
+	tdata_psh_info_t *tdata_psh_info_pool;	/* Pointer to tdata_psh_info elements pool */
+	tdata_psh_info_t *tdata_psh_info_free;	/* free tdata_psh_info elements chain in pool */
+#ifdef DHDTCPACK_SUP_DBG
+	int psh_info_enq_num;	/* Number of free TCP PSH DATA info elements in pool */
+#endif /* DHDTCPACK_SUP_DBG */
+} tcpack_sup_module_t;
+
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+counter_tbl_t tack_tbl = {"tcpACK", 0, 1000, 10, {0, }, 1};
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+static void
+_tdata_psh_info_pool_enq(tcpack_sup_module_t *tcpack_sup_mod,
+	tdata_psh_info_t *tdata_psh_info)
+{
+	if ((tcpack_sup_mod == NULL) || (tdata_psh_info == NULL)) {
+		DHD_ERROR(("%s %d: ERROR %p %p\n", __FUNCTION__, __LINE__,
+			tcpack_sup_mod, tdata_psh_info));
+		return;
+	}
+
+	ASSERT(tdata_psh_info->next == NULL);
+	tdata_psh_info->next = tcpack_sup_mod->tdata_psh_info_free;
+	tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info;
+#ifdef DHDTCPACK_SUP_DBG
+	tcpack_sup_mod->psh_info_enq_num++;
+#endif
+}
+
+static tdata_psh_info_t*
+_tdata_psh_info_pool_deq(tcpack_sup_module_t *tcpack_sup_mod)
+{
+	tdata_psh_info_t *tdata_psh_info = NULL;
+
+	if (tcpack_sup_mod == NULL) {
+		DHD_ERROR(("%s %d: ERROR %p\n", __FUNCTION__, __LINE__,
+			tcpack_sup_mod));
+		return NULL;
+	}
+
+	tdata_psh_info = tcpack_sup_mod->tdata_psh_info_free;
+	if (tdata_psh_info == NULL)
+		DHD_ERROR(("%s %d: Out of tdata_disc_grp\n", __FUNCTION__, __LINE__));
+	else {
+		tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info->next;
+		tdata_psh_info->next = NULL;
+#ifdef DHDTCPACK_SUP_DBG
+		tcpack_sup_mod->psh_info_enq_num--;
+#endif /* DHDTCPACK_SUP_DBG */
+	}
+
+	return tdata_psh_info;
+}
+
+static int _tdata_psh_info_pool_init(dhd_pub_t *dhdp,
+	tcpack_sup_module_t *tcpack_sup_mod)
+{
+	tdata_psh_info_t *tdata_psh_info_pool = NULL;
+	uint i;
+
+	DHD_TRACE(("%s %d: Enter\n", __FUNCTION__, __LINE__));
+
+	if (tcpack_sup_mod == NULL)
+		return BCME_ERROR;
+
+	ASSERT(tcpack_sup_mod->tdata_psh_info_pool == NULL);
+	ASSERT(tcpack_sup_mod->tdata_psh_info_free == NULL);
+
+	tdata_psh_info_pool =
+		MALLOC(dhdp->osh, sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+
+	if (tdata_psh_info_pool == NULL)
+		return BCME_NOMEM;
+	bzero(tdata_psh_info_pool, sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+#ifdef DHDTCPACK_SUP_DBG
+	tcpack_sup_mod->psh_info_enq_num = 0;
+#endif /* DHDTCPACK_SUP_DBG */
+
+	/* Enqueue newly allocated tcpdata psh info elements to the pool */
+	for (i = 0; i < TCPDATA_PSH_INFO_MAXNUM; i++)
+		_tdata_psh_info_pool_enq(tcpack_sup_mod, &tdata_psh_info_pool[i]);
+
+	ASSERT(tcpack_sup_mod->tdata_psh_info_free != NULL);
+	tcpack_sup_mod->tdata_psh_info_pool = tdata_psh_info_pool;
+
+	return BCME_OK;
+}
+
+static void _tdata_psh_info_pool_deinit(dhd_pub_t *dhdp,
+	tcpack_sup_module_t *tcpack_sup_mod)
+{
+	uint i;
+	tdata_psh_info_t *tdata_psh_info;
+
+	DHD_TRACE(("%s %d: Enter\n", __FUNCTION__, __LINE__));
+
+	if (tcpack_sup_mod == NULL) {
+		DHD_ERROR(("%s %d: ERROR tcpack_sup_mod NULL!\n",
+			__FUNCTION__, __LINE__));
+		return;
+	}
+
+	for (i = 0; i < tcpack_sup_mod->tcpdata_info_cnt; i++) {
+		tcpdata_info_t *tcpdata_info = &tcpack_sup_mod->tcpdata_info_tbl[i];
+		/* Return tdata_psh_info elements allocated to each tcpdata_info to the pool */
+		while ((tdata_psh_info = tcpdata_info->tdata_psh_info_head)) {
+			tcpdata_info->tdata_psh_info_head = tdata_psh_info->next;
+			tdata_psh_info->next = NULL;
+			_tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info);
+		}
+		tcpdata_info->tdata_psh_info_tail = NULL;
+	}
+#ifdef DHDTCPACK_SUP_DBG
+	DHD_ERROR(("%s %d: PSH INFO ENQ %d\n",
+		__FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+	i = 0;
+	/* Be sure we recollected all tdata_psh_info elements */
+	while ((tdata_psh_info = tcpack_sup_mod->tdata_psh_info_free)) {
+		tcpack_sup_mod->tdata_psh_info_free = tdata_psh_info->next;
+		tdata_psh_info->next = NULL;
+		i++;
+	}
+	ASSERT(i == TCPDATA_PSH_INFO_MAXNUM);
+	MFREE(dhdp->osh, tcpack_sup_mod->tdata_psh_info_pool,
+		sizeof(tdata_psh_info_t) * TCPDATA_PSH_INFO_MAXNUM);
+	tcpack_sup_mod->tdata_psh_info_pool = NULL;
+
+	return;
+}
+
+static void dhd_tcpack_send(ulong data)
+{
+	tcpack_sup_module_t *tcpack_sup_mod;
+	tcpack_info_t *cur_tbl = (tcpack_info_t *)data;
+	dhd_pub_t *dhdp;
+	int ifidx;
+	void* pkt;
+
+	if (!cur_tbl) {
+		return;
+	}
+
+	dhdp = cur_tbl->dhdp;
+	if (!dhdp) {
+		return;
+	}
+
+	dhd_os_tcpacklock(dhdp);
+
+	tcpack_sup_mod = dhdp->tcpack_sup_module;
+	pkt = cur_tbl->pkt_in_q;
+	ifidx = cur_tbl->ifidx;
+	if (!pkt) {
+		dhd_os_tcpackunlock(dhdp);
+		return;
+	}
+	cur_tbl->pkt_in_q = NULL;
+	cur_tbl->pkt_ether_hdr = NULL;
+	cur_tbl->ifidx = 0;
+	cur_tbl->supp_cnt = 0;
+	if (--tcpack_sup_mod->tcpack_info_cnt < 0) {
+		DHD_ERROR(("%s %d: ERROR!!! tcp_ack_info_cnt %d\n",
+			__FUNCTION__, __LINE__, tcpack_sup_mod->tcpack_info_cnt));
+	}
+
+	dhd_os_tcpackunlock(dhdp);
+
+	dhd_sendpkt(dhdp, ifidx, pkt);
+}
+
+int dhd_tcpack_suppress_set(dhd_pub_t *dhdp, uint8 mode)
+{
+	int ret = BCME_OK;
+
+	dhd_os_tcpacklock(dhdp);
+
+	if (dhdp->tcpack_sup_mode == mode) {
+		DHD_ERROR(("%s %d: already set to %d\n", __FUNCTION__, __LINE__, mode));
+		goto exit;
+	}
+
+	if (mode >= TCPACK_SUP_LAST_MODE ||
+#ifndef BCMSDIO
+		mode == TCPACK_SUP_DELAYTX ||
+#endif
+		FALSE) {
+		DHD_ERROR(("%s %d: Invalid mode %d\n", __FUNCTION__, __LINE__, mode));
+		ret = BCME_BADARG;
+		goto exit;
+	}
+
+	DHD_TRACE(("%s: %d -> %d\n",
+		__FUNCTION__, dhdp->tcpack_sup_mode, mode));
+
+	/* Old tcpack_sup_mode is TCPACK_SUP_DELAYTX */
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_DELAYTX) {
+		tcpack_sup_module_t *tcpack_sup_mod = dhdp->tcpack_sup_module;
+		/* We won't need tdata_psh_info pool and tcpddata_info_tbl anymore */
+		_tdata_psh_info_pool_deinit(dhdp, tcpack_sup_mod);
+		tcpack_sup_mod->tcpdata_info_cnt = 0;
+		bzero(tcpack_sup_mod->tcpdata_info_tbl,
+			sizeof(tcpdata_info_t) * TCPDATA_INFO_MAXNUM);
+		/* For half duplex bus interface, tx precedes rx by default */
+		if (dhdp->bus)
+			dhd_bus_set_dotxinrx(dhdp->bus, TRUE);
+	}
+
+	dhdp->tcpack_sup_mode = mode;
+
+	if (mode == TCPACK_SUP_OFF) {
+		ASSERT(dhdp->tcpack_sup_module != NULL);
+		MFREE(dhdp->osh, dhdp->tcpack_sup_module, sizeof(tcpack_sup_module_t));
+		dhdp->tcpack_sup_module = NULL;
+		goto exit;
+	}
+
+	if (dhdp->tcpack_sup_module == NULL) {
+		tcpack_sup_module_t *tcpack_sup_mod =
+			MALLOC(dhdp->osh, sizeof(tcpack_sup_module_t));
+		if (tcpack_sup_mod == NULL) {
+			DHD_ERROR(("%s %d: No MEM\n", __FUNCTION__, __LINE__));
+			dhdp->tcpack_sup_mode = TCPACK_SUP_OFF;
+			ret = BCME_NOMEM;
+			goto exit;
+		}
+		bzero(tcpack_sup_mod, sizeof(tcpack_sup_module_t));
+		dhdp->tcpack_sup_module = tcpack_sup_mod;
+	}
+
+	if (mode == TCPACK_SUP_DELAYTX) {
+		ret = _tdata_psh_info_pool_init(dhdp, dhdp->tcpack_sup_module);
+		if (ret != BCME_OK)
+			DHD_ERROR(("%s %d: pool init fail with %d\n", __FUNCTION__, __LINE__, ret));
+		else if (dhdp->bus)
+			dhd_bus_set_dotxinrx(dhdp->bus, FALSE);
+	}
+
+	if (mode == TCPACK_SUP_HOLD) {
+		int i;
+		tcpack_sup_module_t *tcpack_sup_mod =
+			(tcpack_sup_module_t *)dhdp->tcpack_sup_module;
+		dhdp->tcpack_sup_ratio = TCPACK_SUPP_RATIO;
+		dhdp->tcpack_sup_delay = TCPACK_DELAY_TIME;
+		for (i = 0; i < TCPACK_INFO_MAXNUM; i++)
+		{
+			tcpack_sup_mod->tcpack_info_tbl[i].dhdp = dhdp;
+			init_timer(&tcpack_sup_mod->tcpack_info_tbl[i].timer);
+			tcpack_sup_mod->tcpack_info_tbl[i].timer.data =
+				(ulong)&tcpack_sup_mod->tcpack_info_tbl[i];
+			tcpack_sup_mod->tcpack_info_tbl[i].timer.function = dhd_tcpack_send;
+		}
+	}
+
+exit:
+	dhd_os_tcpackunlock(dhdp);
+	return ret;
+}
+
+void
+dhd_tcpack_info_tbl_clean(dhd_pub_t *dhdp)
+{
+	tcpack_sup_module_t *tcpack_sup_mod = dhdp->tcpack_sup_module;
+	int i;
+
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+		goto exit;
+
+	dhd_os_tcpacklock(dhdp);
+
+	if (!tcpack_sup_mod) {
+		DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n",
+			__FUNCTION__, __LINE__));
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_HOLD) {
+		for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+			if (tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q) {
+				PKTFREE(dhdp->osh, tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q,
+					TRUE);
+				tcpack_sup_mod->tcpack_info_tbl[i].pkt_in_q = NULL;
+				tcpack_sup_mod->tcpack_info_tbl[i].pkt_ether_hdr = NULL;
+				tcpack_sup_mod->tcpack_info_tbl[i].ifidx = 0;
+				tcpack_sup_mod->tcpack_info_tbl[i].supp_cnt = 0;
+			}
+		}
+	} else {
+		tcpack_sup_mod->tcpack_info_cnt = 0;
+		bzero(tcpack_sup_mod->tcpack_info_tbl, sizeof(tcpack_info_t) * TCPACK_INFO_MAXNUM);
+	}
+
+	dhd_os_tcpackunlock(dhdp);
+
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_HOLD) {
+		for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+			del_timer_sync(&tcpack_sup_mod->tcpack_info_tbl[i].timer);
+		}
+	}
+
+exit:
+	return;
+}
+
+inline int dhd_tcpack_check_xmit(dhd_pub_t *dhdp, void *pkt)
+{
+	uint8 i;
+	tcpack_sup_module_t *tcpack_sup_mod;
+	tcpack_info_t *tcpack_info_tbl;
+	int tbl_cnt;
+	int ret = BCME_OK;
+	void *pdata;
+	uint32 pktlen;
+
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+		goto exit;
+
+	pdata = PKTDATA(dhdp->osh, pkt);
+	pktlen = PKTLEN(dhdp->osh, pkt) - dhd_prot_hdrlen(dhdp, pdata);
+
+	if (pktlen < TCPACKSZMIN || pktlen > TCPACKSZMAX) {
+		DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+			__FUNCTION__, __LINE__, pktlen));
+		goto exit;
+	}
+
+	dhd_os_tcpacklock(dhdp);
+	tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+	if (!tcpack_sup_mod) {
+		DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+		ret = BCME_ERROR;
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+	tbl_cnt = tcpack_sup_mod->tcpack_info_cnt;
+	tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+	ASSERT(tbl_cnt <= TCPACK_INFO_MAXNUM);
+
+	for (i = 0; i < tbl_cnt; i++) {
+		if (tcpack_info_tbl[i].pkt_in_q == pkt) {
+			DHD_TRACE(("%s %d: pkt %p sent out. idx %d, tbl_cnt %d\n",
+				__FUNCTION__, __LINE__, pkt, i, tbl_cnt));
+			/* This pkt is being transmitted so remove the tcp_ack_info of it. */
+			if (i < tbl_cnt - 1) {
+				bcopy(&tcpack_info_tbl[tbl_cnt - 1],
+					&tcpack_info_tbl[i], sizeof(tcpack_info_t));
+			}
+			bzero(&tcpack_info_tbl[tbl_cnt - 1], sizeof(tcpack_info_t));
+			if (--tcpack_sup_mod->tcpack_info_cnt < 0) {
+				DHD_ERROR(("%s %d: ERROR!!! tcp_ack_info_cnt %d\n",
+					__FUNCTION__, __LINE__, tcpack_sup_mod->tcpack_info_cnt));
+				ret = BCME_ERROR;
+			}
+			break;
+		}
+	}
+	dhd_os_tcpackunlock(dhdp);
+
+exit:
+	return ret;
+}
+
+static INLINE bool dhd_tcpdata_psh_acked(dhd_pub_t *dhdp, uint8 *ip_hdr,
+	uint8 *tcp_hdr, uint32 tcp_ack_num)
+{
+	tcpack_sup_module_t *tcpack_sup_mod;
+	int i;
+	tcpdata_info_t *tcpdata_info = NULL;
+	tdata_psh_info_t *tdata_psh_info = NULL;
+	bool ret = FALSE;
+
+	if (dhdp->tcpack_sup_mode != TCPACK_SUP_DELAYTX)
+		goto exit;
+
+	tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+	if (!tcpack_sup_mod) {
+		DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+		goto exit;
+	}
+
+	DHD_TRACE(("%s %d: IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+		" TCP port %d %d, ack %u\n", __FUNCTION__, __LINE__,
+		IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+		IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+		ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+		ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET]),
+		tcp_ack_num));
+
+	for (i = 0; i < tcpack_sup_mod->tcpdata_info_cnt; i++) {
+		tcpdata_info_t *tcpdata_info_tmp = &tcpack_sup_mod->tcpdata_info_tbl[i];
+		DHD_TRACE(("%s %d: data info[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+			" TCP port %d %d\n", __FUNCTION__, __LINE__, i,
+			IPV4_ADDR_TO_STR(ntoh32_ua(tcpdata_info_tmp->src_ip_addr)),
+			IPV4_ADDR_TO_STR(ntoh32_ua(tcpdata_info_tmp->dst_ip_addr)),
+			ntoh16_ua(tcpdata_info_tmp->src_tcp_port),
+			ntoh16_ua(tcpdata_info_tmp->dst_tcp_port)));
+
+		/* If either IP address or TCP port number does not match, skip. */
+		if (memcmp(&ip_hdr[IPV4_SRC_IP_OFFSET],
+			tcpdata_info_tmp->dst_ip_addr, IPV4_ADDR_LEN) == 0 &&
+			memcmp(&ip_hdr[IPV4_DEST_IP_OFFSET],
+			tcpdata_info_tmp->src_ip_addr, IPV4_ADDR_LEN) == 0 &&
+			memcmp(&tcp_hdr[TCP_SRC_PORT_OFFSET],
+			tcpdata_info_tmp->dst_tcp_port, TCP_PORT_LEN) == 0 &&
+			memcmp(&tcp_hdr[TCP_DEST_PORT_OFFSET],
+			tcpdata_info_tmp->src_tcp_port, TCP_PORT_LEN) == 0) {
+			tcpdata_info = tcpdata_info_tmp;
+			break;
+		}
+	}
+
+	if (tcpdata_info == NULL) {
+		DHD_TRACE(("%s %d: no tcpdata_info!\n", __FUNCTION__, __LINE__));
+		goto exit;
+	}
+
+	if (tcpdata_info->tdata_psh_info_head == NULL) {
+		DHD_TRACE(("%s %d: No PSH DATA to be acked!\n", __FUNCTION__, __LINE__));
+	}
+
+	while ((tdata_psh_info = tcpdata_info->tdata_psh_info_head)) {
+		if (IS_TCPSEQ_GE(tcp_ack_num, tdata_psh_info->end_seq)) {
+			DHD_TRACE(("%s %d: PSH ACKED! %u >= %u\n",
+				__FUNCTION__, __LINE__, tcp_ack_num, tdata_psh_info->end_seq));
+			tcpdata_info->tdata_psh_info_head = tdata_psh_info->next;
+			tdata_psh_info->next = NULL;
+			_tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info);
+			ret = TRUE;
+		} else
+			break;
+	}
+	if (tdata_psh_info == NULL)
+		tcpdata_info->tdata_psh_info_tail = NULL;
+
+#ifdef DHDTCPACK_SUP_DBG
+	DHD_TRACE(("%s %d: PSH INFO ENQ %d\n",
+		__FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+exit:
+	return ret;
+}
+
+bool
+dhd_tcpack_suppress(dhd_pub_t *dhdp, void *pkt)
+{
+	uint8 *new_ether_hdr;	/* Ethernet header of the new packet */
+	uint16 new_ether_type;	/* Ethernet type of the new packet */
+	uint8 *new_ip_hdr;		/* IP header of the new packet */
+	uint8 *new_tcp_hdr;		/* TCP header of the new packet */
+	uint32 new_ip_hdr_len;	/* IP header length of the new packet */
+	uint32 cur_framelen;
+	uint32 new_tcp_ack_num;		/* TCP acknowledge number of the new packet */
+	uint16 new_ip_total_len;	/* Total length of IP packet for the new packet */
+	uint32 new_tcp_hdr_len;		/* TCP header length of the new packet */
+	tcpack_sup_module_t *tcpack_sup_mod;
+	tcpack_info_t *tcpack_info_tbl;
+	int i;
+	bool ret = FALSE;
+	bool set_dotxinrx = TRUE;
+
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_OFF)
+		goto exit;
+
+	new_ether_hdr = PKTDATA(dhdp->osh, pkt);
+	cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+	if (cur_framelen < TCPACKSZMIN || cur_framelen > TCPACKSZMAX) {
+		DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+			__FUNCTION__, __LINE__, cur_framelen));
+		goto exit;
+	}
+
+	new_ether_type = new_ether_hdr[12] << 8 | new_ether_hdr[13];
+
+	if (new_ether_type != ETHER_TYPE_IP) {
+		DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+			__FUNCTION__, __LINE__, new_ether_type));
+		goto exit;
+	}
+
+	DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, new_ether_type));
+
+	new_ip_hdr = new_ether_hdr + ETHER_HDR_LEN;
+	cur_framelen -= ETHER_HDR_LEN;
+
+	ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+	new_ip_hdr_len = IPV4_HLEN(new_ip_hdr);
+	if (IP_VER(new_ip_hdr) != IP_VER_4 || IPV4_PROT(new_ip_hdr) != IP_PROT_TCP) {
+		DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+			__FUNCTION__, __LINE__, IP_VER(new_ip_hdr), IPV4_PROT(new_ip_hdr)));
+		goto exit;
+	}
+
+	new_tcp_hdr = new_ip_hdr + new_ip_hdr_len;
+	cur_framelen -= new_ip_hdr_len;
+
+	ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+	DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+	/* is it an ack ? Allow only ACK flag, not to suppress others. */
+	if (new_tcp_hdr[TCP_FLAGS_OFFSET] != TCP_FLAG_ACK) {
+		DHD_TRACE(("%s %d: Do not touch TCP flag 0x%x\n",
+			__FUNCTION__, __LINE__, new_tcp_hdr[TCP_FLAGS_OFFSET]));
+		goto exit;
+	}
+
+	new_ip_total_len = ntoh16_ua(&new_ip_hdr[IPV4_PKTLEN_OFFSET]);
+	new_tcp_hdr_len = 4 * TCP_HDRLEN(new_tcp_hdr[TCP_HLEN_OFFSET]);
+
+	/* This packet has TCP data, so just send */
+	if (new_ip_total_len > new_ip_hdr_len + new_tcp_hdr_len) {
+		DHD_TRACE(("%s %d: Do nothing for TCP DATA\n", __FUNCTION__, __LINE__));
+		goto exit;
+	}
+
+	ASSERT(new_ip_total_len == new_ip_hdr_len + new_tcp_hdr_len);
+
+	new_tcp_ack_num = ntoh32_ua(&new_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+	DHD_TRACE(("%s %d: TCP ACK with zero DATA length"
+		" IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+		__FUNCTION__, __LINE__,
+		IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_SRC_IP_OFFSET])),
+		IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_DEST_IP_OFFSET])),
+		ntoh16_ua(&new_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+		ntoh16_ua(&new_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+	/* Look for tcp_ack_info that has the same ip src/dst addrs and tcp src/dst ports */
+	dhd_os_tcpacklock(dhdp);
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+	counter_printlog(&tack_tbl);
+	tack_tbl.cnt[0]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+	tcpack_sup_mod = dhdp->tcpack_sup_module;
+	tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+	if (!tcpack_sup_mod) {
+		DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+		ret = BCME_ERROR;
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+
+	if (dhd_tcpdata_psh_acked(dhdp, new_ip_hdr, new_tcp_hdr, new_tcp_ack_num)) {
+		/* This TCPACK is ACK to TCPDATA PSH pkt, so keep set_dotxinrx TRUE */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+		tack_tbl.cnt[5]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+	} else
+		set_dotxinrx = FALSE;
+
+	for (i = 0; i < tcpack_sup_mod->tcpack_info_cnt; i++) {
+		void *oldpkt;	/* TCPACK packet that is already in txq or DelayQ */
+		uint8 *old_ether_hdr, *old_ip_hdr, *old_tcp_hdr;
+		uint32 old_ip_hdr_len, old_tcp_hdr_len;
+		uint32 old_tcpack_num;	/* TCP ACK number of old TCPACK packet in Q */
+
+		if ((oldpkt = tcpack_info_tbl[i].pkt_in_q) == NULL) {
+			DHD_ERROR(("%s %d: Unexpected error!! cur idx %d, ttl cnt %d\n",
+				__FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpack_info_cnt));
+			break;
+		}
+
+		if (PKTDATA(dhdp->osh, oldpkt) == NULL) {
+			DHD_ERROR(("%s %d: oldpkt data NULL!! cur idx %d, ttl cnt %d\n",
+				__FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpack_info_cnt));
+			break;
+		}
+
+		old_ether_hdr = tcpack_info_tbl[i].pkt_ether_hdr;
+		old_ip_hdr = old_ether_hdr + ETHER_HDR_LEN;
+		old_ip_hdr_len = IPV4_HLEN(old_ip_hdr);
+		old_tcp_hdr = old_ip_hdr + old_ip_hdr_len;
+		old_tcp_hdr_len = 4 * TCP_HDRLEN(old_tcp_hdr[TCP_HLEN_OFFSET]);
+
+		DHD_TRACE(("%s %d: oldpkt %p[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+			" TCP port %d %d\n", __FUNCTION__, __LINE__, oldpkt, i,
+			IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_SRC_IP_OFFSET])),
+			IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_DEST_IP_OFFSET])),
+			ntoh16_ua(&old_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+			ntoh16_ua(&old_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+		/* If either of IP address or TCP port number does not match, skip. */
+		if (memcmp(&new_ip_hdr[IPV4_SRC_IP_OFFSET],
+			&old_ip_hdr[IPV4_SRC_IP_OFFSET], IPV4_ADDR_LEN * 2) ||
+			memcmp(&new_tcp_hdr[TCP_SRC_PORT_OFFSET],
+			&old_tcp_hdr[TCP_SRC_PORT_OFFSET], TCP_PORT_LEN * 2))
+			continue;
+
+		old_tcpack_num = ntoh32_ua(&old_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+		if (IS_TCPSEQ_GT(new_tcp_ack_num, old_tcpack_num)) {
+			/* New packet has higher TCP ACK number, so it replaces the old packet */
+			if (new_ip_hdr_len == old_ip_hdr_len &&
+				new_tcp_hdr_len == old_tcp_hdr_len) {
+				ASSERT(memcmp(new_ether_hdr, old_ether_hdr, ETHER_HDR_LEN) == 0);
+				bcopy(new_ip_hdr, old_ip_hdr, new_ip_total_len);
+				PKTFREE(dhdp->osh, pkt, FALSE);
+				DHD_TRACE(("%s %d: TCP ACK replace %u -> %u\n",
+					__FUNCTION__, __LINE__, old_tcpack_num, new_tcp_ack_num));
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+				tack_tbl.cnt[2]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+				ret = TRUE;
+			} else {
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+				tack_tbl.cnt[6]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+				DHD_TRACE(("%s %d: lenth mismatch %d != %d || %d != %d"
+					" ACK %u -> %u\n", __FUNCTION__, __LINE__,
+					new_ip_hdr_len, old_ip_hdr_len,
+					new_tcp_hdr_len, old_tcp_hdr_len,
+					old_tcpack_num, new_tcp_ack_num));
+			}
+		} else if (new_tcp_ack_num == old_tcpack_num) {
+			set_dotxinrx = TRUE;
+			/* TCPACK retransmission */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+			tack_tbl.cnt[3]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+		} else {
+			DHD_TRACE(("%s %d: ACK number reverse old %u(0x%p) new %u(0x%p)\n",
+				__FUNCTION__, __LINE__, old_tcpack_num, oldpkt,
+				new_tcp_ack_num, pkt));
+		}
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+
+	if (i == tcpack_sup_mod->tcpack_info_cnt && i < TCPACK_INFO_MAXNUM) {
+		/* No TCPACK packet with the same IP addr and TCP port is found
+		 * in tcp_ack_info_tbl. So add this packet to the table.
+		 */
+		DHD_TRACE(("%s %d: Add pkt 0x%p(ether_hdr 0x%p) to tbl[%d]\n",
+			__FUNCTION__, __LINE__, pkt, new_ether_hdr,
+			tcpack_sup_mod->tcpack_info_cnt));
+
+		tcpack_info_tbl[tcpack_sup_mod->tcpack_info_cnt].pkt_in_q = pkt;
+		tcpack_info_tbl[tcpack_sup_mod->tcpack_info_cnt].pkt_ether_hdr = new_ether_hdr;
+		tcpack_sup_mod->tcpack_info_cnt++;
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+		tack_tbl.cnt[1]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+	} else {
+		ASSERT(i == tcpack_sup_mod->tcpack_info_cnt);
+		DHD_TRACE(("%s %d: No empty tcp ack info tbl\n",
+			__FUNCTION__, __LINE__));
+	}
+	dhd_os_tcpackunlock(dhdp);
+
+exit:
+	/* Unless TCPACK_SUP_DELAYTX, dotxinrx is alwasy TRUE, so no need to set here */
+	if (dhdp->tcpack_sup_mode == TCPACK_SUP_DELAYTX && set_dotxinrx)
+		dhd_bus_set_dotxinrx(dhdp->bus, TRUE);
+
+	return ret;
+}
+
+bool
+dhd_tcpdata_info_get(dhd_pub_t *dhdp, void *pkt)
+{
+	uint8 *ether_hdr;	/* Ethernet header of the new packet */
+	uint16 ether_type;	/* Ethernet type of the new packet */
+	uint8 *ip_hdr;		/* IP header of the new packet */
+	uint8 *tcp_hdr;		/* TCP header of the new packet */
+	uint32 ip_hdr_len;	/* IP header length of the new packet */
+	uint32 cur_framelen;
+	uint16 ip_total_len;	/* Total length of IP packet for the new packet */
+	uint32 tcp_hdr_len;		/* TCP header length of the new packet */
+	uint32 tcp_seq_num;		/* TCP sequence number of the new packet */
+	uint16 tcp_data_len;	/* TCP DATA length that excludes IP and TCP headers */
+	uint32 end_tcp_seq_num;	/* TCP seq number of the last byte in the new packet */
+	tcpack_sup_module_t *tcpack_sup_mod;
+	tcpdata_info_t *tcpdata_info = NULL;
+	tdata_psh_info_t *tdata_psh_info;
+
+	int i;
+	bool ret = FALSE;
+
+	if (dhdp->tcpack_sup_mode != TCPACK_SUP_DELAYTX)
+		goto exit;
+
+	ether_hdr = PKTDATA(dhdp->osh, pkt);
+	cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+	ether_type = ether_hdr[12] << 8 | ether_hdr[13];
+
+	if (ether_type != ETHER_TYPE_IP) {
+		DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+			__FUNCTION__, __LINE__, ether_type));
+		goto exit;
+	}
+
+	DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, ether_type));
+
+	ip_hdr = ether_hdr + ETHER_HDR_LEN;
+	cur_framelen -= ETHER_HDR_LEN;
+
+	ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+	ip_hdr_len = IPV4_HLEN(ip_hdr);
+	if (IP_VER(ip_hdr) != IP_VER_4 || IPV4_PROT(ip_hdr) != IP_PROT_TCP) {
+		DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+			__FUNCTION__, __LINE__, IP_VER(ip_hdr), IPV4_PROT(ip_hdr)));
+		goto exit;
+	}
+
+	tcp_hdr = ip_hdr + ip_hdr_len;
+	cur_framelen -= ip_hdr_len;
+
+	ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+	DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+	ip_total_len = ntoh16_ua(&ip_hdr[IPV4_PKTLEN_OFFSET]);
+	tcp_hdr_len = 4 * TCP_HDRLEN(tcp_hdr[TCP_HLEN_OFFSET]);
+
+	/* This packet is mere TCP ACK, so do nothing */
+	if (ip_total_len == ip_hdr_len + tcp_hdr_len) {
+		DHD_TRACE(("%s %d: Do nothing for no data TCP ACK\n", __FUNCTION__, __LINE__));
+		goto exit;
+	}
+
+	ASSERT(ip_total_len > ip_hdr_len + tcp_hdr_len);
+
+	if ((tcp_hdr[TCP_FLAGS_OFFSET] & TCP_FLAG_PSH) == 0) {
+		DHD_TRACE(("%s %d: Not interested TCP DATA packet\n", __FUNCTION__, __LINE__));
+		goto exit;
+	}
+
+	DHD_TRACE(("%s %d: TCP DATA with nonzero DATA length"
+		" IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d, flag 0x%x\n",
+		__FUNCTION__, __LINE__,
+		IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+		IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+		ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+		ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET]),
+		tcp_hdr[TCP_FLAGS_OFFSET]));
+
+	dhd_os_tcpacklock(dhdp);
+	tcpack_sup_mod = dhdp->tcpack_sup_module;
+
+	if (!tcpack_sup_mod) {
+		DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+		ret = BCME_ERROR;
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+
+	/* Look for tcpdata_info that has the same ip src/dst addrs and tcp src/dst ports */
+	i = 0;
+	while (i < tcpack_sup_mod->tcpdata_info_cnt) {
+		tcpdata_info_t *tdata_info_tmp = &tcpack_sup_mod->tcpdata_info_tbl[i];
+		uint32 now_in_ms = OSL_SYSUPTIME();
+		DHD_TRACE(("%s %d: data info[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+			" TCP port %d %d\n", __FUNCTION__, __LINE__, i,
+			IPV4_ADDR_TO_STR(ntoh32_ua(tdata_info_tmp->src_ip_addr)),
+			IPV4_ADDR_TO_STR(ntoh32_ua(tdata_info_tmp->dst_ip_addr)),
+			ntoh16_ua(tdata_info_tmp->src_tcp_port),
+			ntoh16_ua(tdata_info_tmp->dst_tcp_port)));
+
+		/* If both IP address and TCP port number match, we found it so break. */
+		if (memcmp(&ip_hdr[IPV4_SRC_IP_OFFSET],
+			tdata_info_tmp->src_ip_addr, IPV4_ADDR_LEN * 2) == 0 &&
+			memcmp(&tcp_hdr[TCP_SRC_PORT_OFFSET],
+			tdata_info_tmp->src_tcp_port, TCP_PORT_LEN * 2) == 0) {
+			tcpdata_info = tdata_info_tmp;
+			tcpdata_info->last_used_time = now_in_ms;
+			break;
+		}
+
+		if (now_in_ms - tdata_info_tmp->last_used_time > TCPDATA_INFO_TIMEOUT) {
+			tdata_psh_info_t *tdata_psh_info_tmp;
+			tcpdata_info_t *last_tdata_info;
+
+			while ((tdata_psh_info_tmp = tdata_info_tmp->tdata_psh_info_head)) {
+				tdata_info_tmp->tdata_psh_info_head = tdata_psh_info_tmp->next;
+				tdata_psh_info_tmp->next = NULL;
+				DHD_TRACE(("%s %d: Clean tdata_psh_info(end_seq %u)!\n",
+					__FUNCTION__, __LINE__, tdata_psh_info_tmp->end_seq));
+				_tdata_psh_info_pool_enq(tcpack_sup_mod, tdata_psh_info_tmp);
+			}
+#ifdef DHDTCPACK_SUP_DBG
+			DHD_ERROR(("%s %d: PSH INFO ENQ %d\n",
+				__FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+			tcpack_sup_mod->tcpdata_info_cnt--;
+			ASSERT(tcpack_sup_mod->tcpdata_info_cnt >= 0);
+
+			last_tdata_info =
+				&tcpack_sup_mod->tcpdata_info_tbl[tcpack_sup_mod->tcpdata_info_cnt];
+			if (i < tcpack_sup_mod->tcpdata_info_cnt) {
+				ASSERT(last_tdata_info != tdata_info_tmp);
+				bcopy(last_tdata_info, tdata_info_tmp, sizeof(tcpdata_info_t));
+			}
+			bzero(last_tdata_info, sizeof(tcpdata_info_t));
+			DHD_ERROR(("%s %d: tcpdata_info(idx %d) is aged out. ttl cnt is now %d\n",
+				__FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpdata_info_cnt));
+			/* Don't increase "i" here, so that the prev last tcpdata_info is checked */
+		} else
+			 i++;
+	}
+
+	tcp_seq_num = ntoh32_ua(&tcp_hdr[TCP_SEQ_NUM_OFFSET]);
+	tcp_data_len = ip_total_len - ip_hdr_len - tcp_hdr_len;
+	end_tcp_seq_num = tcp_seq_num + tcp_data_len;
+
+	if (tcpdata_info == NULL) {
+		ASSERT(i == tcpack_sup_mod->tcpdata_info_cnt);
+		if (i >= TCPDATA_INFO_MAXNUM) {
+			DHD_TRACE(("%s %d: tcp_data_info_tbl FULL! %d %d"
+				" IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+				__FUNCTION__, __LINE__, i, tcpack_sup_mod->tcpdata_info_cnt,
+				IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+				IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+				ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+				ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET])));
+			dhd_os_tcpackunlock(dhdp);
+			goto exit;
+		}
+		tcpdata_info = &tcpack_sup_mod->tcpdata_info_tbl[i];
+
+		/* No TCP flow with the same IP addr and TCP port is found
+		 * in tcp_data_info_tbl. So add this flow to the table.
+		 */
+		DHD_ERROR(("%s %d: Add data info to tbl[%d]: IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+			" TCP port %d %d\n",
+			__FUNCTION__, __LINE__, tcpack_sup_mod->tcpdata_info_cnt,
+			IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_SRC_IP_OFFSET])),
+			IPV4_ADDR_TO_STR(ntoh32_ua(&ip_hdr[IPV4_DEST_IP_OFFSET])),
+			ntoh16_ua(&tcp_hdr[TCP_SRC_PORT_OFFSET]),
+			ntoh16_ua(&tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+		bcopy(&ip_hdr[IPV4_SRC_IP_OFFSET], tcpdata_info->src_ip_addr,
+			IPV4_ADDR_LEN * 2);
+		bcopy(&tcp_hdr[TCP_SRC_PORT_OFFSET], tcpdata_info->src_tcp_port,
+			TCP_PORT_LEN * 2);
+
+		tcpdata_info->last_used_time = OSL_SYSUPTIME();
+		tcpack_sup_mod->tcpdata_info_cnt++;
+	}
+
+	ASSERT(tcpdata_info != NULL);
+
+	tdata_psh_info = _tdata_psh_info_pool_deq(tcpack_sup_mod);
+#ifdef DHDTCPACK_SUP_DBG
+	DHD_TRACE(("%s %d: PSH INFO ENQ %d\n",
+		__FUNCTION__, __LINE__, tcpack_sup_mod->psh_info_enq_num));
+#endif /* DHDTCPACK_SUP_DBG */
+
+	if (tdata_psh_info == NULL) {
+		DHD_ERROR(("%s %d: No more free tdata_psh_info!!\n", __FUNCTION__, __LINE__));
+		ret = BCME_ERROR;
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+	tdata_psh_info->end_seq = end_tcp_seq_num;
+
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+	tack_tbl.cnt[4]++;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+
+	DHD_TRACE(("%s %d: TCP PSH DATA recvd! end seq %u\n",
+		__FUNCTION__, __LINE__, tdata_psh_info->end_seq));
+
+	ASSERT(tdata_psh_info->next == NULL);
+
+	if (tcpdata_info->tdata_psh_info_head == NULL)
+		tcpdata_info->tdata_psh_info_head = tdata_psh_info;
+	else {
+		ASSERT(tcpdata_info->tdata_psh_info_tail);
+		tcpdata_info->tdata_psh_info_tail->next = tdata_psh_info;
+	}
+	tcpdata_info->tdata_psh_info_tail = tdata_psh_info;
+
+	dhd_os_tcpackunlock(dhdp);
+
+exit:
+	return ret;
+}
+
+bool
+dhd_tcpack_hold(dhd_pub_t *dhdp, void *pkt, int ifidx)
+{
+	uint8 *new_ether_hdr;	/* Ethernet header of the new packet */
+	uint16 new_ether_type;	/* Ethernet type of the new packet */
+	uint8 *new_ip_hdr;		/* IP header of the new packet */
+	uint8 *new_tcp_hdr;		/* TCP header of the new packet */
+	uint32 new_ip_hdr_len;	/* IP header length of the new packet */
+	uint32 cur_framelen;
+	uint32 new_tcp_ack_num;		/* TCP acknowledge number of the new packet */
+	uint16 new_ip_total_len;	/* Total length of IP packet for the new packet */
+	uint32 new_tcp_hdr_len;		/* TCP header length of the new packet */
+	tcpack_sup_module_t *tcpack_sup_mod;
+	tcpack_info_t *tcpack_info_tbl;
+	int i, free_slot = TCPACK_INFO_MAXNUM;
+	bool hold = FALSE;
+
+	if (dhdp->tcpack_sup_mode != TCPACK_SUP_HOLD) {
+		goto exit;
+	}
+
+	if (dhdp->tcpack_sup_ratio == 1) {
+		goto exit;
+	}
+
+	new_ether_hdr = PKTDATA(dhdp->osh, pkt);
+	cur_framelen = PKTLEN(dhdp->osh, pkt);
+
+	if (cur_framelen < TCPACKSZMIN || cur_framelen > TCPACKSZMAX) {
+		DHD_TRACE(("%s %d: Too short or long length %d to be TCP ACK\n",
+			__FUNCTION__, __LINE__, cur_framelen));
+		goto exit;
+	}
+
+	new_ether_type = new_ether_hdr[12] << 8 | new_ether_hdr[13];
+
+	if (new_ether_type != ETHER_TYPE_IP) {
+		DHD_TRACE(("%s %d: Not a IP packet 0x%x\n",
+			__FUNCTION__, __LINE__, new_ether_type));
+		goto exit;
+	}
+
+	DHD_TRACE(("%s %d: IP pkt! 0x%x\n", __FUNCTION__, __LINE__, new_ether_type));
+
+	new_ip_hdr = new_ether_hdr + ETHER_HDR_LEN;
+	cur_framelen -= ETHER_HDR_LEN;
+
+	ASSERT(cur_framelen >= IPV4_MIN_HEADER_LEN);
+
+	new_ip_hdr_len = IPV4_HLEN(new_ip_hdr);
+	if (IP_VER(new_ip_hdr) != IP_VER_4 || IPV4_PROT(new_ip_hdr) != IP_PROT_TCP) {
+		DHD_TRACE(("%s %d: Not IPv4 nor TCP! ip ver %d, prot %d\n",
+			__FUNCTION__, __LINE__, IP_VER(new_ip_hdr), IPV4_PROT(new_ip_hdr)));
+		goto exit;
+	}
+
+	new_tcp_hdr = new_ip_hdr + new_ip_hdr_len;
+	cur_framelen -= new_ip_hdr_len;
+
+	ASSERT(cur_framelen >= TCP_MIN_HEADER_LEN);
+
+	DHD_TRACE(("%s %d: TCP pkt!\n", __FUNCTION__, __LINE__));
+
+	/* is it an ack ? Allow only ACK flag, not to suppress others. */
+	if (new_tcp_hdr[TCP_FLAGS_OFFSET] != TCP_FLAG_ACK) {
+		DHD_TRACE(("%s %d: Do not touch TCP flag 0x%x\n",
+			__FUNCTION__, __LINE__, new_tcp_hdr[TCP_FLAGS_OFFSET]));
+		goto exit;
+	}
+
+	new_ip_total_len = ntoh16_ua(&new_ip_hdr[IPV4_PKTLEN_OFFSET]);
+	new_tcp_hdr_len = 4 * TCP_HDRLEN(new_tcp_hdr[TCP_HLEN_OFFSET]);
+
+	/* This packet has TCP data, so just send */
+	if (new_ip_total_len > new_ip_hdr_len + new_tcp_hdr_len) {
+		DHD_TRACE(("%s %d: Do nothing for TCP DATA\n", __FUNCTION__, __LINE__));
+		goto exit;
+	}
+
+	ASSERT(new_ip_total_len == new_ip_hdr_len + new_tcp_hdr_len);
+
+	new_tcp_ack_num = ntoh32_ua(&new_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+	DHD_TRACE(("%s %d: TCP ACK with zero DATA length"
+		" IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR" TCP port %d %d\n",
+		__FUNCTION__, __LINE__,
+		IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_SRC_IP_OFFSET])),
+		IPV4_ADDR_TO_STR(ntoh32_ua(&new_ip_hdr[IPV4_DEST_IP_OFFSET])),
+		ntoh16_ua(&new_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+		ntoh16_ua(&new_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+	/* Look for tcp_ack_info that has the same ip src/dst addrs and tcp src/dst ports */
+	dhd_os_tcpacklock(dhdp);
+
+	tcpack_sup_mod = dhdp->tcpack_sup_module;
+	tcpack_info_tbl = tcpack_sup_mod->tcpack_info_tbl;
+
+	if (!tcpack_sup_mod) {
+		DHD_ERROR(("%s %d: tcpack suppress module NULL!!\n", __FUNCTION__, __LINE__));
+		dhd_os_tcpackunlock(dhdp);
+		goto exit;
+	}
+
+	hold = TRUE;
+
+	for (i = 0; i < TCPACK_INFO_MAXNUM; i++) {
+		void *oldpkt;	/* TCPACK packet that is already in txq or DelayQ */
+		uint8 *old_ether_hdr, *old_ip_hdr, *old_tcp_hdr;
+		uint32 old_ip_hdr_len, old_tcp_hdr_len;
+		uint32 old_tcpack_num;	/* TCP ACK number of old TCPACK packet in Q */
+
+		if ((oldpkt = tcpack_info_tbl[i].pkt_in_q) == NULL) {
+			if (free_slot == TCPACK_INFO_MAXNUM) {
+				free_slot = i;
+			}
+			continue;
+		}
+
+		if (PKTDATA(dhdp->osh, oldpkt) == NULL) {
+			DHD_ERROR(("%s %d: oldpkt data NULL!! cur idx %d\n",
+				__FUNCTION__, __LINE__, i));
+			hold = FALSE;
+			dhd_os_tcpackunlock(dhdp);
+			goto exit;
+		}
+
+		old_ether_hdr = tcpack_info_tbl[i].pkt_ether_hdr;
+		old_ip_hdr = old_ether_hdr + ETHER_HDR_LEN;
+		old_ip_hdr_len = IPV4_HLEN(old_ip_hdr);
+		old_tcp_hdr = old_ip_hdr + old_ip_hdr_len;
+		old_tcp_hdr_len = 4 * TCP_HDRLEN(old_tcp_hdr[TCP_HLEN_OFFSET]);
+
+		DHD_TRACE(("%s %d: oldpkt %p[%d], IP addr "IPV4_ADDR_STR" "IPV4_ADDR_STR
+			" TCP port %d %d\n", __FUNCTION__, __LINE__, oldpkt, i,
+			IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_SRC_IP_OFFSET])),
+			IPV4_ADDR_TO_STR(ntoh32_ua(&old_ip_hdr[IPV4_DEST_IP_OFFSET])),
+			ntoh16_ua(&old_tcp_hdr[TCP_SRC_PORT_OFFSET]),
+			ntoh16_ua(&old_tcp_hdr[TCP_DEST_PORT_OFFSET])));
+
+		/* If either of IP address or TCP port number does not match, skip. */
+		if (memcmp(&new_ip_hdr[IPV4_SRC_IP_OFFSET],
+			&old_ip_hdr[IPV4_SRC_IP_OFFSET], IPV4_ADDR_LEN * 2) ||
+			memcmp(&new_tcp_hdr[TCP_SRC_PORT_OFFSET],
+			&old_tcp_hdr[TCP_SRC_PORT_OFFSET], TCP_PORT_LEN * 2)) {
+			continue;
+		}
+
+		old_tcpack_num = ntoh32_ua(&old_tcp_hdr[TCP_ACK_NUM_OFFSET]);
+
+		if (IS_TCPSEQ_GE(new_tcp_ack_num, old_tcpack_num)) {
+			tcpack_info_tbl[i].supp_cnt++;
+			if (tcpack_info_tbl[i].supp_cnt >= dhdp->tcpack_sup_ratio) {
+				tcpack_info_tbl[i].pkt_in_q = NULL;
+				tcpack_info_tbl[i].pkt_ether_hdr = NULL;
+				tcpack_info_tbl[i].ifidx = 0;
+				tcpack_info_tbl[i].supp_cnt = 0;
+				hold = FALSE;
+			} else {
+				tcpack_info_tbl[i].pkt_in_q = pkt;
+				tcpack_info_tbl[i].pkt_ether_hdr = new_ether_hdr;
+				tcpack_info_tbl[i].ifidx = ifidx;
+			}
+			PKTFREE(dhdp->osh, oldpkt, TRUE);
+		} else {
+			PKTFREE(dhdp->osh, pkt, TRUE);
+		}
+		dhd_os_tcpackunlock(dhdp);
+
+		if (!hold) {
+			del_timer_sync(&tcpack_info_tbl[i].timer);
+		}
+		goto exit;
+	}
+
+	if (free_slot < TCPACK_INFO_MAXNUM) {
+		/* No TCPACK packet with the same IP addr and TCP port is found
+		 * in tcp_ack_info_tbl. So add this packet to the table.
+		 */
+		DHD_TRACE(("%s %d: Add pkt 0x%p(ether_hdr 0x%p) to tbl[%d]\n",
+			__FUNCTION__, __LINE__, pkt, new_ether_hdr,
+			free_slot));
+
+		tcpack_info_tbl[free_slot].pkt_in_q = pkt;
+		tcpack_info_tbl[free_slot].pkt_ether_hdr = new_ether_hdr;
+		tcpack_info_tbl[free_slot].ifidx = ifidx;
+		tcpack_info_tbl[free_slot].supp_cnt = 1;
+		mod_timer(&tcpack_sup_mod->tcpack_info_tbl[free_slot].timer,
+			jiffies + msecs_to_jiffies(dhdp->tcpack_sup_delay));
+		tcpack_sup_mod->tcpack_info_cnt++;
+	} else {
+		DHD_TRACE(("%s %d: No empty tcp ack info tbl\n",
+			__FUNCTION__, __LINE__));
+	}
+	dhd_os_tcpackunlock(dhdp);
+
+exit:
+	return hold;
+}
+#endif /* DHDTCPACK_SUPPRESS */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_ip.h b/drivers/net/wireless/bcm4336/dhd_ip.h
--- a/drivers/net/wireless/bcm4336/dhd_ip.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_ip.h	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,58 @@
+/*
+ * Header file describing the common ip parser function.
+ *
+ * Provides type definitions and function prototypes used to parse ip packet.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_ip.h 502735 2014-09-16 00:53:02Z $
+ */
+
+#ifndef _dhd_ip_h_
+#define _dhd_ip_h_
+
+#ifdef DHDTCPACK_SUPPRESS
+#include <dngl_stats.h>
+#include <bcmutils.h>
+#include <dhd.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+typedef enum pkt_frag
+{
+	DHD_PKT_FRAG_NONE = 0,
+	DHD_PKT_FRAG_FIRST,
+	DHD_PKT_FRAG_CONT,
+	DHD_PKT_FRAG_LAST
+} pkt_frag_t;
+
+extern pkt_frag_t pkt_frag_info(osl_t *osh, void *p);
+extern bool pkt_is_dhcp(osl_t *osh, void *p);
+
+#ifdef DHDTCPACK_SUPPRESS
+#define	TCPACKSZMIN	(ETHER_HDR_LEN + IPV4_MIN_HEADER_LEN + TCP_MIN_HEADER_LEN)
+/* Size of MAX possible TCP ACK packet. Extra bytes for IP/TCP option fields */
+#define	TCPACKSZMAX	(TCPACKSZMIN + 100)
+
+/* Max number of TCP streams that have own src/dst IP addrs and TCP ports */
+#define TCPACK_INFO_MAXNUM 4
+#define TCPDATA_INFO_MAXNUM 4
+#define TCPDATA_PSH_INFO_MAXNUM (8 * TCPDATA_INFO_MAXNUM)
+
+#define TCPDATA_INFO_TIMEOUT 5000	/* Remove tcpdata_info if inactive for this time (in ms) */
+
+#define TCPACK_SUPP_RATIO 3
+#define TCPACK_DELAY_TIME 10 /* ms */
+
+extern int dhd_tcpack_suppress_set(dhd_pub_t *dhdp, uint8 on);
+extern void dhd_tcpack_info_tbl_clean(dhd_pub_t *dhdp);
+extern int dhd_tcpack_check_xmit(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpack_suppress(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpdata_info_get(dhd_pub_t *dhdp, void *pkt);
+extern bool dhd_tcpack_hold(dhd_pub_t *dhdp, void *pkt, int ifidx);
+/* #define DHDTCPACK_SUP_DBG */
+#if defined(DEBUG_COUNTER) && defined(DHDTCPACK_SUP_DBG)
+extern counter_tbl_t tack_tbl;
+#endif /* DEBUG_COUNTER && DHDTCPACK_SUP_DBG */
+#endif /* DHDTCPACK_SUPPRESS */
+
+#endif /* _dhd_ip_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_linux.c b/drivers/net/wireless/bcm4336/dhd_linux.c
--- a/drivers/net/wireless/bcm4336/dhd_linux.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_linux.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,10363 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux-specific network interface
+ * Basically selected code segments from usb-cdc.c and usb-rndis.c
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_linux.c 505753 2014-10-01 01:40:15Z $
+ */
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#ifdef SHOW_LOGTRACE
+#include <linux/syscalls.h>
+#include <event_log.h>
+#endif /* SHOW_LOGTRACE */
+
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/etherdevice.h>
+#include <linux/random.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/ip.h>
+#include <linux/reboot.h>
+#include <linux/notifier.h>
+#include <net/addrconf.h>
+#ifdef ENABLE_ADAPTIVE_SCHED
+#include <linux/cpufreq.h>
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include "ap621x.h"
+
+#include <epivers.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <proto/ethernet.h>
+#include <proto/bcmevent.h>
+#include <proto/vlan.h>
+#ifdef DHD_L2_FILTER
+#include <proto/bcmicmp.h>
+#endif
+#include <proto/802.3.h>
+
+#include <dngl_stats.h>
+#include <dhd_linux_wq.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#ifdef PCIE_FULL_DONGLE
+#include <dhd_flowring.h>
+#endif
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_config.h>
+#include <dhd_dbg.h>
+#ifdef CONFIG_HAS_WAKELOCK
+#include <linux/wakelock.h>
+#endif
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#ifdef P2PONEINT
+#include <wl_cfgp2p.h>
+#endif
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+#ifdef WLBTAMP
+#include <proto/802.11_bta.h>
+#include <proto/bt_amp_hci.h>
+#include <dhd_bta.h>
+#endif
+
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#ifdef DHD_WMF
+#include <dhd_wmf_linux.h>
+#endif /* DHD_WMF */
+
+#ifdef AMPDU_VO_ENABLE
+#include <proto/802.1d.h>
+#endif /* AMPDU_VO_ENABLE */
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+#if defined(DHD_TCP_WINSIZE_ADJUST)
+#include <linux/tcp.h>
+#include <net/tcp.h>
+#endif /* DHD_TCP_WINSIZE_ADJUST */
+
+#include <linux/sched/types.h>
+#include <linux/signal.h>
+
+#ifdef WLMEDIA_HTSF
+#include <linux/time.h>
+#include <htsf.h>
+
+#define HTSF_MINLEN 200    /* min. packet length to timestamp */
+#define HTSF_BUS_DELAY 150 /* assume a fix propagation in us  */
+#define TSMAX  1000        /* max no. of timing record kept   */
+#define NUMBIN 34
+
+static uint32 tsidx = 0;
+static uint32 htsf_seqnum = 0;
+uint32 tsfsync;
+struct timeval tsync;
+static uint32 tsport = 5010;
+
+typedef struct histo_ {
+	uint32 bin[NUMBIN];
+} histo_t;
+
+#if !ISPOWEROF2(DHD_SDALIGN)
+#error DHD_SDALIGN is not a power of 2!
+#endif
+
+static histo_t vi_d1, vi_d2, vi_d3, vi_d4;
+#endif /* WLMEDIA_HTSF */
+
+#if defined(DHD_TCP_WINSIZE_ADJUST)
+#define MIN_TCP_WIN_SIZE 18000
+#define WIN_SIZE_SCALE_FACTOR 2
+#define MAX_TARGET_PORTS 5
+
+static uint target_ports[MAX_TARGET_PORTS] = {20, 0, 0, 0, 0};
+static uint dhd_use_tcp_window_size_adjust = FALSE;
+static void dhd_adjust_tcp_winsize(int op_mode, struct sk_buff *skb);
+#endif /* DHD_TCP_WINSIZE_ADJUST */
+
+
+#if defined(SOFTAP)
+extern bool ap_cfg_running;
+extern bool ap_fw_loaded;
+#endif
+
+
+#ifdef ENABLE_ADAPTIVE_SCHED
+#define DEFAULT_CPUFREQ_THRESH		1000000	/* threshold frequency : 1000000 = 1GHz */
+#ifndef CUSTOM_CPUFREQ_THRESH
+#define CUSTOM_CPUFREQ_THRESH	DEFAULT_CPUFREQ_THRESH
+#endif /* CUSTOM_CPUFREQ_THRESH */
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+/* enable HOSTIP cache update from the host side when an eth0:N is up */
+#define AOE_IP_ALIAS_SUPPORT 1
+
+#ifdef BCM_FD_AGGR
+#include <bcm_rpc.h>
+#include <bcm_rpc_tp.h>
+#endif
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#include <wl_android.h>
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+#include <sdaudio.h>
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+/* Maximum STA per radio */
+#define DHD_MAX_STA     32
+
+
+const uint8 wme_fifo2ac[] = { 0, 1, 2, 3, 1, 1 };
+const uint8 prio2fifo[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
+#define WME_PRIO2AC(prio)  wme_fifo2ac[prio2fifo[(prio)]]
+
+#ifdef ARP_OFFLOAD_SUPPORT
+void aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add, int idx);
+static int dhd_inetaddr_notifier_call(struct notifier_block *this,
+	unsigned long event, void *ptr);
+static struct notifier_block dhd_inetaddr_notifier = {
+	.notifier_call = dhd_inetaddr_notifier_call
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_inetaddr_notifier_registered = FALSE;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef CONFIG_IPV6
+static int dhd_inet6addr_notifier_call(struct notifier_block *this,
+	unsigned long event, void *ptr);
+static struct notifier_block dhd_inet6addr_notifier = {
+	.notifier_call = dhd_inet6addr_notifier_call
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_inet6addr_notifier_registered = FALSE;
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP)
+#include <linux/suspend.h>
+volatile bool dhd_mmc_suspend = FALSE;
+DECLARE_WAIT_QUEUE_HEAD(dhd_dpc_wait);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(CONFIG_PM_SLEEP) */
+
+#if defined(OOB_INTR_ONLY)
+extern void dhd_enable_oob_intr(struct dhd_bus *bus, bool enable);
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (1)
+static void dhd_hang_process(void *dhd_info, void *event_data, u8 event);
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+MODULE_LICENSE("GPL v2");
+#endif /* LinuxVer */
+
+#include <dhd_bus.h>
+
+#ifdef BCM_FD_AGGR
+#define DBUS_RX_BUFFER_SIZE_DHD(net)	(BCM_RPC_TP_DNGL_AGG_MAX_BYTE)
+#else
+#ifndef PROP_TXSTATUS
+#define DBUS_RX_BUFFER_SIZE_DHD(net)	(net->mtu + net->hard_header_len + dhd->pub.hdrlen)
+#else
+#define DBUS_RX_BUFFER_SIZE_DHD(net)	(net->mtu + net->hard_header_len + dhd->pub.hdrlen + 128)
+#endif
+#endif /* BCM_FD_AGGR */
+
+#ifdef PROP_TXSTATUS
+extern bool dhd_wlfc_skip_fc(void);
+extern void dhd_wlfc_plat_init(void *dhd);
+extern void dhd_wlfc_plat_deinit(void *dhd);
+#endif /* PROP_TXSTATUS */
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 15)
+const char *
+print_tainted()
+{
+	return "";
+}
+#endif	/* LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 15) */
+
+/* Linux wireless extension support */
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+extern wl_iw_extra_params_t  g_wl_iw_params;
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND) */
+
+extern int dhd_get_suspend_bcn_li_dtim(dhd_pub_t *dhd);
+
+#ifdef PKT_FILTER_SUPPORT
+extern void dhd_pktfilter_offload_set(dhd_pub_t * dhd, char *arg);
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+extern void dhd_pktfilter_offload_delete(dhd_pub_t *dhd, int id);
+#endif
+
+
+#ifdef READ_MACADDR
+extern int dhd_read_macaddr(struct dhd_info *dhd);
+#else
+static inline int dhd_read_macaddr(struct dhd_info *dhd) { return 0; }
+#endif
+#ifdef WRITE_MACADDR
+extern int dhd_write_macaddr(struct ether_addr *mac);
+#else
+static inline int dhd_write_macaddr(struct ether_addr *mac) { return 0; }
+#endif
+
+
+#if defined(SOFTAP_TPUT_ENHANCE)
+extern void dhd_bus_setidletime(dhd_pub_t *dhdp, int idle_time);
+extern void dhd_bus_getidletime(dhd_pub_t *dhdp, int* idle_time);
+#endif /* SOFTAP_TPUT_ENHANCE */
+
+
+#ifdef SET_RPS_CPUS
+int custom_rps_map_set(struct netdev_rx_queue *queue, char *buf, size_t len);
+void custom_rps_map_clear(struct netdev_rx_queue *queue);
+#ifdef CONFIG_MACH_UNIVERSAL5433
+#define RPS_CPUS_MASK "10"
+#else
+#define RPS_CPUS_MASK "6"
+#endif /* CONFIG_MACH_UNIVERSAL5433 */
+#endif /* SET_RPS_CPUS */
+
+static int dhd_reboot_callback(struct notifier_block *this, unsigned long code, void *unused);
+static struct notifier_block dhd_reboot_notifier = {
+		.notifier_call = dhd_reboot_callback,
+		.priority = 1,
+};
+
+
+typedef struct dhd_if_event {
+	struct list_head	list;
+	wl_event_data_if_t	event;
+	char			name[IFNAMSIZ+1];
+	uint8			mac[ETHER_ADDR_LEN];
+} dhd_if_event_t;
+
+/* Interface control information */
+typedef struct dhd_if {
+	struct dhd_info *info;			/* back pointer to dhd_info */
+	/* OS/stack specifics */
+	struct net_device *net;
+	int				idx;			/* iface idx in dongle */
+	uint			subunit;		/* subunit */
+	uint8			mac_addr[ETHER_ADDR_LEN];	/* assigned MAC address */
+	bool			set_macaddress;
+	bool			set_multicast;
+	uint8			bssidx;			/* bsscfg index for the interface */
+	bool			attached;		/* Delayed attachment when unset */
+	bool			txflowcontrol;	/* Per interface flow control indicator */
+	char			name[IFNAMSIZ+1]; /* linux interface name */
+	struct net_device_stats stats;
+#ifdef DHD_WMF
+	dhd_wmf_t		wmf;		/* per bsscfg wmf setting */
+#endif /* DHD_WMF */
+#ifdef PCIE_FULL_DONGLE
+	struct list_head sta_list;		/* sll of associated stations */
+#if !defined(BCM_GMAC3)
+	spinlock_t	sta_list_lock;		/* lock for manipulating sll */
+#endif /* ! BCM_GMAC3 */
+#endif /* PCIE_FULL_DONGLE */
+	uint32  ap_isolate;			/* ap-isolation settings */
+} dhd_if_t;
+
+#ifdef WLMEDIA_HTSF
+typedef struct {
+	uint32 low;
+	uint32 high;
+} tsf_t;
+
+typedef struct {
+	uint32 last_cycle;
+	uint32 last_sec;
+	uint32 last_tsf;
+	uint32 coef;     /* scaling factor */
+	uint32 coefdec1; /* first decimal  */
+	uint32 coefdec2; /* second decimal */
+} htsf_t;
+
+typedef struct {
+	uint32 t1;
+	uint32 t2;
+	uint32 t3;
+	uint32 t4;
+} tstamp_t;
+
+static tstamp_t ts[TSMAX];
+static tstamp_t maxdelayts;
+static uint32 maxdelay = 0, tspktcnt = 0, maxdelaypktno = 0;
+
+#endif  /* WLMEDIA_HTSF */
+
+struct ipv6_work_info_t {
+	uint8			if_idx;
+	char			ipv6_addr[16];
+	unsigned long		event;
+};
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+#define MAX_WLANAUDIO_BLACKLIST 4
+
+struct wlanaudio_blacklist {
+	bool is_blacklist;
+	uint32 cnt;
+	ulong txfail_jiffies;
+	struct ether_addr blacklist_addr;
+};
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+/* When Perimeter locks are deployed, any blocking calls must be preceeded
+ * with a PERIM UNLOCK and followed by a PERIM LOCK.
+ * Examples of blocking calls are: schedule_timeout(), down_interruptible(),
+ * wait_event_timeout().
+ */
+
+/* Local private structure (extension of pub) */
+typedef struct dhd_info {
+#if defined(WL_WIRELESS_EXT)
+	wl_iw_t		iw;		/* wireless extensions state (must be first) */
+#endif /* defined(WL_WIRELESS_EXT) */
+	dhd_pub_t pub;
+	dhd_if_t *iflist[DHD_MAX_IFS]; /* for supporting multiple interfaces */
+
+	void *adapter;			/* adapter information, interrupt, fw path etc. */
+	char fw_path[PATH_MAX];		/* path to firmware image */
+	char nv_path[PATH_MAX];		/* path to nvram vars file */
+	char conf_path[PATH_MAX];	/* path to config vars file */
+
+	struct semaphore proto_sem;
+#ifdef PROP_TXSTATUS
+	spinlock_t	wlfc_spinlock;
+
+#endif /* PROP_TXSTATUS */
+#ifdef WLMEDIA_HTSF
+	htsf_t  htsf;
+#endif
+	wait_queue_head_t ioctl_resp_wait;
+	uint32	default_wd_interval;
+
+	struct timer_list timer;
+	bool wd_timer_valid;
+	struct tasklet_struct tasklet;
+	spinlock_t	sdlock;
+	spinlock_t	txqlock;
+	spinlock_t	dhd_lock;
+
+	struct semaphore sdsem;
+	tsk_ctl_t	thr_dpc_ctl;
+	tsk_ctl_t	thr_wdt_ctl;
+
+	tsk_ctl_t	thr_rxf_ctl;
+	spinlock_t	rxf_lock;
+	bool		rxthread_enabled;
+
+	/* Wakelocks */
+#if defined(CONFIG_HAS_WAKELOCK) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+	struct wake_lock wl_wifi;   /* Wifi wakelock */
+	struct wake_lock wl_rxwake; /* Wifi rx wakelock */
+	struct wake_lock wl_ctrlwake; /* Wifi ctrl wakelock */
+	struct wake_lock wl_wdwake; /* Wifi wd wakelock */
+#ifdef BCMPCIE_OOB_HOST_WAKE
+	struct wake_lock wl_intrwake; /* Host wakeup wakelock */
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#endif /* CONFIG_HAS_WAKELOCK && LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	/* net_device interface lock, prevent race conditions among net_dev interface
+	 * calls and wifi_on or wifi_off
+	 */
+	struct mutex dhd_net_if_mutex;
+	struct mutex dhd_suspend_mutex;
+#endif
+	spinlock_t wakelock_spinlock;
+	uint32 wakelock_counter;
+	int wakelock_wd_counter;
+	int wakelock_rx_timeout_enable;
+	int wakelock_ctrl_timeout_enable;
+	bool waive_wakelock;
+	uint32 wakelock_before_waive;
+
+	/* Thread to issue ioctl for multicast */
+	wait_queue_head_t ctrl_wait;
+	atomic_t pend_8021x_cnt;
+	dhd_attach_states_t dhd_state;
+#ifdef SHOW_LOGTRACE
+	dhd_event_log_t event_data;
+#endif /* SHOW_LOGTRACE */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+	struct early_suspend early_suspend;
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+	u32 pend_ipaddr;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef BCM_FD_AGGR
+	void *rpc_th;
+	void *rpc_osh;
+	struct timer_list rpcth_timer;
+	bool rpcth_timer_active;
+	bool fdaggr;
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+	spinlock_t	tcpack_lock;
+#endif /* DHDTCPACK_SUPPRESS */
+	void			*dhd_deferred_wq;
+#ifdef DEBUG_CPU_FREQ
+	struct notifier_block freq_trans;
+	int __percpu *new_freq;
+#endif
+	unsigned int unit;
+	struct notifier_block pm_notifier;
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+	struct wlanaudio_blacklist wlanaudio_blist[MAX_WLANAUDIO_BLACKLIST];
+	bool is_wlanaudio_blist;
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+} dhd_info_t;
+
+#define DHDIF_FWDER(dhdif)      FALSE
+
+/* Flag to indicate if we should download firmware on driver load */
+uint dhd_download_fw_on_driverload = TRUE;
+
+/* Definitions to provide path to the firmware and nvram
+ * example nvram_path[MOD_PARAM_PATHLEN]="/projects/wlan/nvram.txt"
+ */
+char firmware_path[MOD_PARAM_PATHLEN];
+char nvram_path[MOD_PARAM_PATHLEN];
+char config_path[MOD_PARAM_PATHLEN];
+
+/* backup buffer for firmware and nvram path */
+char fw_bak_path[MOD_PARAM_PATHLEN];
+char nv_bak_path[MOD_PARAM_PATHLEN];
+
+/* information string to keep firmware, chio, cheip version info visiable from log */
+char info_string[MOD_PARAM_INFOLEN];
+module_param_string(info_string, info_string, MOD_PARAM_INFOLEN, 0444);
+int op_mode = 0;
+int disable_proptx = 0;
+module_param(op_mode, int, 0644);
+extern int wl_control_wl_start(struct net_device *dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && defined(BCMLXSDMMC)
+struct semaphore dhd_registration_sem;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+
+/* deferred handlers */
+static void dhd_ifadd_event_handler(void *handle, void *event_info, u8 event);
+static void dhd_ifdel_event_handler(void *handle, void *event_info, u8 event);
+static void dhd_set_mac_addr_handler(void *handle, void *event_info, u8 event);
+static void dhd_set_mcast_list_handler(void *handle, void *event_info, u8 event);
+#ifdef CONFIG_IPV6
+static void dhd_inet6_work_handler(void *dhd_info, void *event_data, u8 event);
+#endif
+
+#ifdef WL_CFG80211
+extern void dhd_netdev_free(struct net_device *ndev);
+#endif /* WL_CFG80211 */
+
+/* Error bits */
+module_param(dhd_msg_level, int, 0);
+#if defined(WL_WIRELESS_EXT)
+module_param(iw_msg_level, int, 0);
+#endif
+#ifdef WL_CFG80211
+module_param(wl_dbg_level, int, 0);
+#endif
+module_param(android_msg_level, int, 0);
+module_param(config_msg_level, int, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* ARP offload enable */
+uint dhd_arp_enable = TRUE;
+module_param(dhd_arp_enable, uint, 0);
+
+/* ARP offload agent mode : Enable ARP Host Auto-Reply and ARP Peer Auto-Reply */
+
+uint dhd_arp_mode = ARP_OL_AGENT | ARP_OL_PEER_AUTO_REPLY;
+
+module_param(dhd_arp_mode, uint, 0);
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+/* Disable Prop tx */
+module_param(disable_proptx, int, 0644);
+/* load firmware and/or nvram values from the filesystem */
+module_param_string(firmware_path, firmware_path, MOD_PARAM_PATHLEN, 0660);
+module_param_string(nvram_path, nvram_path, MOD_PARAM_PATHLEN, 0660);
+module_param_string(config_path, config_path, MOD_PARAM_PATHLEN, 0);
+
+/* Watchdog interval */
+
+/* extend watchdog expiration to 2 seconds when DPC is running */
+#define WATCHDOG_EXTEND_INTERVAL (2000)
+
+uint dhd_watchdog_ms = CUSTOM_DHD_WATCHDOG_MS;
+module_param(dhd_watchdog_ms, uint, 0);
+
+#if defined(DHD_DEBUG)
+/* Console poll interval */
+uint dhd_console_ms = 0;
+module_param(dhd_console_ms, uint, 0644);
+#endif /* defined(DHD_DEBUG) */
+
+
+uint dhd_slpauto = TRUE;
+module_param(dhd_slpauto, uint, 0);
+
+#ifdef PKT_FILTER_SUPPORT
+/* Global Pkt filter enable control */
+uint dhd_pkt_filter_enable = TRUE;
+module_param(dhd_pkt_filter_enable, uint, 0);
+#endif
+
+/* Pkt filter init setup */
+uint dhd_pkt_filter_init = 0;
+module_param(dhd_pkt_filter_init, uint, 0);
+
+/* Pkt filter mode control */
+uint dhd_master_mode = FALSE;
+module_param(dhd_master_mode, uint, 0);
+
+int dhd_watchdog_prio = 0;
+module_param(dhd_watchdog_prio, int, 0);
+
+/* DPC thread priority */
+int dhd_dpc_prio = CUSTOM_DPC_PRIO_SETTING;
+module_param(dhd_dpc_prio, int, 0);
+
+/* RX frame thread priority */
+int dhd_rxf_prio = CUSTOM_RXF_PRIO_SETTING;
+module_param(dhd_rxf_prio, int, 0);
+
+int passive_channel_skip = 0;
+module_param(passive_channel_skip, int, (S_IRUSR|S_IWUSR));
+
+#if !defined(BCMDHDUSB)
+extern int dhd_dongle_ramsize;
+module_param(dhd_dongle_ramsize, int, 0);
+#endif /* BCMDHDUSB */
+
+/* Keep track of number of instances */
+static int dhd_found = 0;
+static int instance_base = 0; /* Starting instance number */
+module_param(instance_base, int, 0644);
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+dhd_info_t *dhd_global = NULL;
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+
+
+/* DHD Perimiter lock only used in router with bypass forwarding. */
+#define DHD_PERIM_RADIO_INIT()              do { /* noop */ } while (0)
+#define DHD_PERIM_LOCK_TRY(unit, flag)      do { /* noop */ } while (0)
+#define DHD_PERIM_UNLOCK_TRY(unit, flag)    do { /* noop */ } while (0)
+#define DHD_PERIM_LOCK_ALL()                do { /* noop */ } while (0)
+#define DHD_PERIM_UNLOCK_ALL()              do { /* noop */ } while (0)
+
+#ifdef PCIE_FULL_DONGLE
+#if defined(BCM_GMAC3)
+#define DHD_IF_STA_LIST_LOCK_INIT(ifp)      do { /* noop */ } while (0)
+#define DHD_IF_STA_LIST_LOCK(ifp, flags)    ({ BCM_REFERENCE(flags); })
+#define DHD_IF_STA_LIST_UNLOCK(ifp, flags)  ({ BCM_REFERENCE(flags); })
+#else /* ! BCM_GMAC3 */
+#define DHD_IF_STA_LIST_LOCK_INIT(ifp) spin_lock_init(&(ifp)->sta_list_lock)
+#define DHD_IF_STA_LIST_LOCK(ifp, flags) \
+	spin_lock_irqsave(&(ifp)->sta_list_lock, (flags))
+#define DHD_IF_STA_LIST_UNLOCK(ifp, flags) \
+	spin_unlock_irqrestore(&(ifp)->sta_list_lock, (flags))
+#endif /* ! BCM_GMAC3 */
+#endif /* PCIE_FULL_DONGLE */
+
+/* Control fw roaming */
+#ifdef BCMCCX
+uint dhd_roam_disable = 0;
+#else
+uint dhd_roam_disable = 0;
+#endif /* BCMCCX */
+
+/* Control radio state */
+uint dhd_radio_up = 1;
+
+/* Network inteface name */
+char iface_name[IFNAMSIZ] = {'\0'};
+module_param_string(iface_name, iface_name, IFNAMSIZ, 0);
+
+/* The following are specific to the SDIO dongle */
+
+/* IOCTL response timeout */
+int dhd_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
+
+/* Idle timeout for backplane clock */
+int dhd_idletime = DHD_IDLETIME_TICKS;
+module_param(dhd_idletime, int, 0);
+
+/* Use polling */
+uint dhd_poll = FALSE;
+module_param(dhd_poll, uint, 0);
+
+/* Use interrupts */
+uint dhd_intr = TRUE;
+module_param(dhd_intr, uint, 0);
+
+/* SDIO Drive Strength (in milliamps) */
+uint dhd_sdiod_drive_strength = 6;
+module_param(dhd_sdiod_drive_strength, uint, 0);
+
+#ifdef BCMSDIO
+/* Tx/Rx bounds */
+extern uint dhd_txbound;
+extern uint dhd_rxbound;
+module_param(dhd_txbound, uint, 0);
+module_param(dhd_rxbound, uint, 0);
+
+/* Deferred transmits */
+extern uint dhd_deferred_tx;
+module_param(dhd_deferred_tx, uint, 0);
+
+#ifdef BCMDBGFS
+extern void dhd_dbg_init(dhd_pub_t *dhdp);
+extern void dhd_dbg_remove(void);
+#endif /* BCMDBGFS */
+
+#endif /* BCMSDIO */
+
+
+#ifdef SDTEST
+/* Echo packet generator (pkts/s) */
+uint dhd_pktgen = 0;
+module_param(dhd_pktgen, uint, 0);
+
+/* Echo packet len (0 => sawtooth, max 2040) */
+uint dhd_pktgen_len = 0;
+module_param(dhd_pktgen_len, uint, 0);
+#endif /* SDTEST */
+
+#if defined(BCMSUP_4WAY_HANDSHAKE)
+/* Use in dongle supplicant for 4-way handshake */
+uint dhd_use_idsup = 0;
+module_param(dhd_use_idsup, uint, 0);
+#endif /* BCMSUP_4WAY_HANDSHAKE */
+
+extern char dhd_version[];
+
+int dhd_net_bus_devreset(struct net_device *dev, uint8 flag);
+static void dhd_net_if_lock_local(dhd_info_t *dhd);
+static void dhd_net_if_unlock_local(dhd_info_t *dhd);
+static void dhd_suspend_lock(dhd_pub_t *dhdp);
+static void dhd_suspend_unlock(dhd_pub_t *dhdp);
+
+#ifdef WLMEDIA_HTSF
+void htsf_update(dhd_info_t *dhd, void *data);
+tsf_t prev_tsf, cur_tsf;
+
+uint32 dhd_get_htsf(dhd_info_t *dhd, int ifidx);
+static int dhd_ioctl_htsf_get(dhd_info_t *dhd, int ifidx);
+static void dhd_dump_latency(void);
+static void dhd_htsf_addtxts(dhd_pub_t *dhdp, void *pktbuf);
+static void dhd_htsf_addrxts(dhd_pub_t *dhdp, void *pktbuf);
+static void dhd_dump_htsfhisto(histo_t *his, char *s);
+#endif /* WLMEDIA_HTSF */
+
+/* Monitor interface */
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+
+#if defined(WL_WIRELESS_EXT)
+struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+#endif /* defined(WL_WIRELESS_EXT) */
+
+static void dhd_dpc(ulong data);
+/* forward decl */
+extern int dhd_wait_pend8021x(struct net_device *dev);
+void dhd_os_wd_timer_extend(void *bus, bool extend);
+
+#ifdef TOE
+#ifndef BDC
+#error TOE requires BDC
+#endif /* !BDC */
+static int dhd_toe_get(dhd_info_t *dhd, int idx, uint32 *toe_ol);
+static int dhd_toe_set(dhd_info_t *dhd, int idx, uint32 toe_ol);
+#endif /* TOE */
+
+static int dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+                             wl_event_msg_t *event_ptr, void **data_ptr);
+#ifdef DHD_UNICAST_DHCP
+static const uint8 llc_snap_hdr[SNAP_HDR_LEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+static int dhd_get_pkt_ip_type(dhd_pub_t *dhd, void *skb, uint8 **data_ptr,
+	int *len_ptr, uint8 *prot_ptr);
+static int dhd_get_pkt_ether_type(dhd_pub_t *dhd, void *skb, uint8 **data_ptr,
+	int *len_ptr, uint16 *et_ptr, bool *snap_ptr);
+
+static int dhd_convert_dhcp_broadcast_ack_to_unicast(dhd_pub_t *pub, void *pktbuf, int ifidx);
+#endif /* DHD_UNICAST_DHCP */
+#ifdef DHD_L2_FILTER
+static int dhd_l2_filter_block_ping(dhd_pub_t *pub, void *pktbuf, int ifidx);
+#endif
+#if defined(CONFIG_PM_SLEEP)
+static int dhd_pm_callback(struct notifier_block *nfb, unsigned long action, void *ignored)
+{
+	int ret = NOTIFY_DONE;
+	bool suspend = FALSE;
+	dhd_info_t *dhdinfo = (dhd_info_t*)container_of(nfb, struct dhd_info, pm_notifier);
+
+	BCM_REFERENCE(dhdinfo);
+	switch (action) {
+	case PM_HIBERNATION_PREPARE:
+	case PM_SUSPEND_PREPARE:
+		suspend = TRUE;
+		break;
+	case PM_POST_HIBERNATION:
+	case PM_POST_SUSPEND:
+		suspend = FALSE;
+		break;
+	}
+
+#if defined(SUPPORT_P2P_GO_PS)
+#ifdef PROP_TXSTATUS
+	if (suspend) {
+		DHD_OS_WAKE_LOCK_WAIVE(&dhdinfo->pub);
+		dhd_wlfc_suspend(&dhdinfo->pub);
+		DHD_OS_WAKE_LOCK_RESTORE(&dhdinfo->pub);
+	} else
+		dhd_wlfc_resume(&dhdinfo->pub);
+#endif
+#endif /* defined(SUPPORT_P2P_GO_PS) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+	KERNEL_VERSION(2, 6, 39))
+	dhd_mmc_suspend = suspend;
+	smp_mb();
+#endif
+
+	return ret;
+}
+
+static struct notifier_block dhd_pm_notifier = {
+	.notifier_call = dhd_pm_callback,
+	.priority = 10
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool dhd_pm_notifier_registered = FALSE;
+
+extern int register_pm_notifier(struct notifier_block *nb);
+extern int unregister_pm_notifier(struct notifier_block *nb);
+#endif /* CONFIG_PM_SLEEP */
+
+/* Request scheduling of the bus rx frame */
+static void dhd_sched_rxf(dhd_pub_t *dhdp, void *skb);
+static void dhd_os_rxflock(dhd_pub_t *pub);
+static void dhd_os_rxfunlock(dhd_pub_t *pub);
+
+/** priv_link is the link between netdev and the dhdif and dhd_info structs. */
+typedef struct dhd_dev_priv {
+	dhd_info_t * dhd; /* cached pointer to dhd_info in netdevice priv */
+	dhd_if_t   * ifp; /* cached pointer to dhd_if in netdevice priv */
+	int          ifidx; /* interface index */
+} dhd_dev_priv_t;
+
+#define DHD_DEV_PRIV_SIZE       (sizeof(dhd_dev_priv_t))
+#define DHD_DEV_PRIV(dev)       ((dhd_dev_priv_t *)DEV_PRIV(dev))
+#define DHD_DEV_INFO(dev)       (((dhd_dev_priv_t *)DEV_PRIV(dev))->dhd)
+#define DHD_DEV_IFP(dev)        (((dhd_dev_priv_t *)DEV_PRIV(dev))->ifp)
+#define DHD_DEV_IFIDX(dev)      (((dhd_dev_priv_t *)DEV_PRIV(dev))->ifidx)
+
+/** Clear the dhd net_device's private structure. */
+static inline void
+dhd_dev_priv_clear(struct net_device * dev)
+{
+	dhd_dev_priv_t * dev_priv;
+	ASSERT(dev != (struct net_device *)NULL);
+	dev_priv = DHD_DEV_PRIV(dev);
+	dev_priv->dhd = (dhd_info_t *)NULL;
+	dev_priv->ifp = (dhd_if_t *)NULL;
+	dev_priv->ifidx = DHD_BAD_IF;
+}
+
+/** Setup the dhd net_device's private structure. */
+static inline void
+dhd_dev_priv_save(struct net_device * dev, dhd_info_t * dhd, dhd_if_t * ifp,
+                  int ifidx)
+{
+	dhd_dev_priv_t * dev_priv;
+	ASSERT(dev != (struct net_device *)NULL);
+	dev_priv = DHD_DEV_PRIV(dev);
+	dev_priv->dhd = dhd;
+	dev_priv->ifp = ifp;
+	dev_priv->ifidx = ifidx;
+}
+
+#ifdef PCIE_FULL_DONGLE
+
+/** Dummy objects are defined with state representing bad|down.
+ * Performance gains from reducing branch conditionals, instruction parallelism,
+ * dual issue, reducing load shadows, avail of larger pipelines.
+ * Use DHD_XXX_NULL instead of (dhd_xxx_t *)NULL, whenever an object pointer
+ * is accessed via the dhd_sta_t.
+ */
+
+/* Dummy dhd_info object */
+dhd_info_t dhd_info_null = {
+#if defined(BCM_GMAC3)
+	.fwdh = FWDER_NULL,
+#endif
+	.pub = {
+	         .info = &dhd_info_null,
+#ifdef DHDTCPACK_SUPPRESS
+	         .tcpack_sup_mode = TCPACK_SUP_REPLACE,
+#endif /* DHDTCPACK_SUPPRESS */
+	         .up = FALSE, .busstate = DHD_BUS_DOWN
+	}
+};
+#define DHD_INFO_NULL (&dhd_info_null)
+#define DHD_PUB_NULL  (&dhd_info_null.pub)
+
+/* Dummy netdevice object */
+struct net_device dhd_net_dev_null = {
+	.reg_state = NETREG_UNREGISTERED
+};
+#define DHD_NET_DEV_NULL (&dhd_net_dev_null)
+
+/* Dummy dhd_if object */
+dhd_if_t dhd_if_null = {
+#if defined(BCM_GMAC3)
+	.fwdh = FWDER_NULL,
+#endif
+#ifdef WMF
+	.wmf = { .wmf_enable = TRUE },
+#endif
+	.info = DHD_INFO_NULL,
+	.net = DHD_NET_DEV_NULL,
+	.idx = DHD_BAD_IF
+};
+#define DHD_IF_NULL  (&dhd_if_null)
+
+#define DHD_STA_NULL ((dhd_sta_t *)NULL)
+
+/** Interface STA list management. */
+
+/** Fetch the dhd_if object, given the interface index in the dhd. */
+static inline dhd_if_t *dhd_get_ifp(dhd_pub_t *dhdp, uint32 ifidx);
+
+/** Alloc/Free a dhd_sta object from the dhd instances' sta_pool. */
+static void dhd_sta_free(dhd_pub_t *pub, dhd_sta_t *sta);
+static dhd_sta_t * dhd_sta_alloc(dhd_pub_t * dhdp);
+
+/* Delete a dhd_sta or flush all dhd_sta in an interface's sta_list. */
+static void dhd_if_del_sta_list(dhd_if_t * ifp);
+static void	dhd_if_flush_sta(dhd_if_t * ifp);
+
+/* Construct/Destruct a sta pool. */
+static int dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta);
+static void dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta);
+static void dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta);
+
+
+/* Return interface pointer */
+static inline dhd_if_t *dhd_get_ifp(dhd_pub_t *dhdp, uint32 ifidx)
+{
+	ASSERT(ifidx < DHD_MAX_IFS);
+
+	if (ifidx >= DHD_MAX_IFS)
+		return NULL;
+
+	return dhdp->info->iflist[ifidx];
+}
+
+/** Reset a dhd_sta object and free into the dhd pool. */
+static void
+dhd_sta_free(dhd_pub_t * dhdp, dhd_sta_t * sta)
+{
+	int prio;
+
+	ASSERT((sta != DHD_STA_NULL) && (sta->idx != ID16_INVALID));
+
+	ASSERT((dhdp->staid_allocator != NULL) && (dhdp->sta_pool != NULL));
+	id16_map_free(dhdp->staid_allocator, sta->idx);
+	for (prio = 0; prio < (int)NUMPRIO; prio++)
+		sta->flowid[prio] = FLOWID_INVALID;
+	sta->ifp = DHD_IF_NULL; /* dummy dhd_if object */
+	sta->ifidx = DHD_BAD_IF;
+	bzero(sta->ea.octet, ETHER_ADDR_LEN);
+	INIT_LIST_HEAD(&sta->list);
+	sta->idx = ID16_INVALID; /* implying free */
+}
+
+/** Allocate a dhd_sta object from the dhd pool. */
+static dhd_sta_t *
+dhd_sta_alloc(dhd_pub_t * dhdp)
+{
+	uint16 idx;
+	dhd_sta_t * sta;
+	dhd_sta_pool_t * sta_pool;
+
+	ASSERT((dhdp->staid_allocator != NULL) && (dhdp->sta_pool != NULL));
+
+	idx = id16_map_alloc(dhdp->staid_allocator);
+	if (idx == ID16_INVALID) {
+		DHD_ERROR(("%s: cannot get free staid\n", __FUNCTION__));
+		return DHD_STA_NULL;
+	}
+
+	sta_pool = (dhd_sta_pool_t *)(dhdp->sta_pool);
+	sta = &sta_pool[idx];
+
+	ASSERT((sta->idx == ID16_INVALID) &&
+	       (sta->ifp == DHD_IF_NULL) && (sta->ifidx == DHD_BAD_IF));
+	sta->idx = idx; /* implying allocated */
+
+	return sta;
+}
+
+/** Delete all STAs in an interface's STA list. */
+static void
+dhd_if_del_sta_list(dhd_if_t *ifp)
+{
+	dhd_sta_t *sta, *next;
+	unsigned long flags;
+
+	DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+	list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+#if defined(BCM_GMAC3)
+		if (ifp->fwdh) {
+			/* Remove sta from WOFA forwarder. */
+			fwder_deassoc(ifp->fwdh, (uint16 *)(sta->ea.octet), (wofa_t)sta);
+		}
+#endif /* BCM_GMAC3 */
+		list_del(&sta->list);
+		dhd_sta_free(&ifp->info->pub, sta);
+	}
+
+	DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+	return;
+}
+
+/** Router/GMAC3: Flush all station entries in the forwarder's WOFA database. */
+static void
+dhd_if_flush_sta(dhd_if_t * ifp)
+{
+#if defined(BCM_GMAC3)
+
+	if (ifp && (ifp->fwdh != FWDER_NULL)) {
+		dhd_sta_t *sta, *next;
+		unsigned long flags;
+
+		DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+		list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+			/* Remove any sta entry from WOFA forwarder. */
+			fwder_flush(ifp->fwdh, (wofa_t)sta);
+		}
+
+		DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+	}
+#endif /* BCM_GMAC3 */
+}
+
+/** Construct a pool of dhd_sta_t objects to be used by interfaces. */
+static int
+dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta)
+{
+	int idx, sta_pool_memsz;
+	dhd_sta_t * sta;
+	dhd_sta_pool_t * sta_pool;
+	void * staid_allocator;
+
+	ASSERT(dhdp != (dhd_pub_t *)NULL);
+	ASSERT((dhdp->staid_allocator == NULL) && (dhdp->sta_pool == NULL));
+
+	/* dhd_sta objects per radio are managed in a table. id#0 reserved. */
+	staid_allocator = id16_map_init(dhdp->osh, max_sta, 1);
+	if (staid_allocator == NULL) {
+		DHD_ERROR(("%s: sta id allocator init failure\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	/* Pre allocate a pool of dhd_sta objects (one extra). */
+	sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t)); /* skip idx 0 */
+	sta_pool = (dhd_sta_pool_t *)MALLOC(dhdp->osh, sta_pool_memsz);
+	if (sta_pool == NULL) {
+		DHD_ERROR(("%s: sta table alloc failure\n", __FUNCTION__));
+		id16_map_fini(dhdp->osh, staid_allocator);
+		return BCME_ERROR;
+	}
+
+	dhdp->sta_pool = sta_pool;
+	dhdp->staid_allocator = staid_allocator;
+
+	/* Initialize all sta(s) for the pre-allocated free pool. */
+	bzero((uchar *)sta_pool, sta_pool_memsz);
+	for (idx = max_sta; idx >= 1; idx--) { /* skip sta_pool[0] */
+		sta = &sta_pool[idx];
+		sta->idx = id16_map_alloc(staid_allocator);
+		ASSERT(sta->idx <= max_sta);
+	}
+	/* Now place them into the pre-allocated free pool. */
+	for (idx = 1; idx <= max_sta; idx++) {
+		sta = &sta_pool[idx];
+		dhd_sta_free(dhdp, sta);
+	}
+
+	return BCME_OK;
+}
+
+/** Destruct the pool of dhd_sta_t objects.
+ * Caller must ensure that no STA objects are currently associated with an if.
+ */
+static void
+dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta)
+{
+	dhd_sta_pool_t * sta_pool = (dhd_sta_pool_t *)dhdp->sta_pool;
+
+	if (sta_pool) {
+		int idx;
+		int sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t));
+		for (idx = 1; idx <= max_sta; idx++) {
+			ASSERT(sta_pool[idx].ifp == DHD_IF_NULL);
+			ASSERT(sta_pool[idx].idx == ID16_INVALID);
+		}
+		MFREE(dhdp->osh, dhdp->sta_pool, sta_pool_memsz);
+		dhdp->sta_pool = NULL;
+	}
+
+	id16_map_fini(dhdp->osh, dhdp->staid_allocator);
+	dhdp->staid_allocator = NULL;
+}
+
+/* Clear the pool of dhd_sta_t objects for built-in type driver */
+static void
+dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta)
+{
+	int idx, sta_pool_memsz;
+	dhd_sta_t * sta;
+	dhd_sta_pool_t * sta_pool;
+	void *staid_allocator;
+
+	if (!dhdp) {
+		DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	sta_pool = (dhd_sta_pool_t *)dhdp->sta_pool;
+	staid_allocator = dhdp->staid_allocator;
+
+	if (!sta_pool) {
+		DHD_ERROR(("%s: sta_pool is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	if (!staid_allocator) {
+		DHD_ERROR(("%s: staid_allocator is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	/* clear free pool */
+	sta_pool_memsz = ((max_sta + 1) * sizeof(dhd_sta_t));
+	bzero((uchar *)sta_pool, sta_pool_memsz);
+
+	/* dhd_sta objects per radio are managed in a table. id#0 reserved. */
+	id16_map_clear(staid_allocator, max_sta, 1);
+
+	/* Initialize all sta(s) for the pre-allocated free pool. */
+	for (idx = max_sta; idx >= 1; idx--) { /* skip sta_pool[0] */
+		sta = &sta_pool[idx];
+		sta->idx = id16_map_alloc(staid_allocator);
+		ASSERT(sta->idx <= max_sta);
+	}
+	/* Now place them into the pre-allocated free pool. */
+	for (idx = 1; idx <= max_sta; idx++) {
+		sta = &sta_pool[idx];
+		dhd_sta_free(dhdp, sta);
+	}
+}
+
+/** Find STA with MAC address ea in an interface's STA list. */
+dhd_sta_t *
+dhd_find_sta(void *pub, int ifidx, void *ea)
+{
+	dhd_sta_t *sta;
+	dhd_if_t *ifp;
+	unsigned long flags;
+
+	ASSERT(ea != NULL);
+	ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+	if (ifp == NULL)
+		return DHD_STA_NULL;
+
+	DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+	list_for_each_entry(sta, &ifp->sta_list, list) {
+		if (!memcmp(sta->ea.octet, ea, ETHER_ADDR_LEN)) {
+			DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+			return sta;
+		}
+	}
+
+	DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+	return DHD_STA_NULL;
+}
+
+/** Add STA into the interface's STA list. */
+dhd_sta_t *
+dhd_add_sta(void *pub, int ifidx, void *ea)
+{
+	dhd_sta_t *sta;
+	dhd_if_t *ifp;
+	unsigned long flags;
+
+	ASSERT(ea != NULL);
+	ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+	if (ifp == NULL)
+		return DHD_STA_NULL;
+
+	sta = dhd_sta_alloc((dhd_pub_t *)pub);
+	if (sta == DHD_STA_NULL) {
+		DHD_ERROR(("%s: Alloc failed\n", __FUNCTION__));
+		return DHD_STA_NULL;
+	}
+
+	memcpy(sta->ea.octet, ea, ETHER_ADDR_LEN);
+
+	/* link the sta and the dhd interface */
+	sta->ifp = ifp;
+	sta->ifidx = ifidx;
+	INIT_LIST_HEAD(&sta->list);
+
+	DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+	list_add_tail(&sta->list, &ifp->sta_list);
+
+#if defined(BCM_GMAC3)
+	if (ifp->fwdh) {
+		ASSERT(ISALIGNED(ea, 2));
+		/* Add sta to WOFA forwarder. */
+		fwder_reassoc(ifp->fwdh, (uint16 *)ea, (wofa_t)sta);
+	}
+#endif /* BCM_GMAC3 */
+
+	DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+	return sta;
+}
+
+/** Delete STA from the interface's STA list. */
+void
+dhd_del_sta(void *pub, int ifidx, void *ea)
+{
+	dhd_sta_t *sta, *next;
+	dhd_if_t *ifp;
+	unsigned long flags;
+
+	ASSERT(ea != NULL);
+	ifp = dhd_get_ifp((dhd_pub_t *)pub, ifidx);
+	if (ifp == NULL)
+		return;
+
+	DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+	list_for_each_entry_safe(sta, next, &ifp->sta_list, list) {
+		if (!memcmp(sta->ea.octet, ea, ETHER_ADDR_LEN)) {
+#if defined(BCM_GMAC3)
+			if (ifp->fwdh) { /* Found a sta, remove from WOFA forwarder. */
+				ASSERT(ISALIGNED(ea, 2));
+				fwder_deassoc(ifp->fwdh, (uint16 *)ea, (wofa_t)sta);
+			}
+#endif /* BCM_GMAC3 */
+			list_del(&sta->list);
+			dhd_sta_free(&ifp->info->pub, sta);
+		}
+	}
+
+	DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+
+	return;
+}
+
+/** Add STA if it doesn't exist. Not reentrant. */
+dhd_sta_t*
+dhd_findadd_sta(void *pub, int ifidx, void *ea)
+{
+	dhd_sta_t *sta;
+
+	sta = dhd_find_sta(pub, ifidx, ea);
+
+	if (!sta) {
+		/* Add entry */
+		sta = dhd_add_sta(pub, ifidx, ea);
+	}
+
+	return sta;
+}
+#else
+static inline void dhd_if_flush_sta(dhd_if_t * ifp) { }
+static inline void dhd_if_del_sta_list(dhd_if_t *ifp) {}
+static inline int dhd_sta_pool_init(dhd_pub_t *dhdp, int max_sta) { return BCME_OK; }
+static inline void dhd_sta_pool_fini(dhd_pub_t *dhdp, int max_sta) {}
+static inline void dhd_sta_pool_clear(dhd_pub_t *dhdp, int max_sta) {}
+dhd_sta_t *dhd_findadd_sta(void *pub, int ifidx, void *ea) { return NULL; }
+void dhd_del_sta(void *pub, int ifidx, void *ea) {}
+#endif /* PCIE_FULL_DONGLE */
+
+
+/* Returns dhd iflist index correspondig the the bssidx provided by apps */
+int dhd_bssidx2idx(dhd_pub_t *dhdp, uint32 bssidx)
+{
+	dhd_if_t *ifp;
+	dhd_info_t *dhd = dhdp->info;
+	int i;
+
+	ASSERT(bssidx < DHD_MAX_IFS);
+	ASSERT(dhdp);
+
+	for (i = 0; i < DHD_MAX_IFS; i++) {
+		ifp = dhd->iflist[i];
+		if (ifp && (ifp->bssidx == bssidx)) {
+			DHD_TRACE(("Index manipulated for %s from %d to %d\n",
+				ifp->name, bssidx, i));
+			break;
+		}
+	}
+	return i;
+}
+
+static inline int dhd_rxf_enqueue(dhd_pub_t *dhdp, void* skb)
+{
+	uint32 store_idx;
+	uint32 sent_idx;
+
+	if (!skb) {
+		DHD_ERROR(("dhd_rxf_enqueue: NULL skb!!!\n"));
+		return BCME_ERROR;
+	}
+
+	dhd_os_rxflock(dhdp);
+	store_idx = dhdp->store_idx;
+	sent_idx = dhdp->sent_idx;
+	if (dhdp->skbbuf[store_idx] != NULL) {
+		/* Make sure the previous packets are processed */
+		dhd_os_rxfunlock(dhdp);
+#ifdef RXF_DEQUEUE_ON_BUSY
+		DHD_TRACE(("dhd_rxf_enqueue: pktbuf not consumed %p, store idx %d sent idx %d\n",
+			skb, store_idx, sent_idx));
+		return BCME_BUSY;
+#else /* RXF_DEQUEUE_ON_BUSY */
+		DHD_ERROR(("dhd_rxf_enqueue: pktbuf not consumed %p, store idx %d sent idx %d\n",
+			skb, store_idx, sent_idx));
+		/* removed msleep here, should use wait_event_timeout if we
+		 * want to give rx frame thread a chance to run
+		 */
+#if defined(WAIT_DEQUEUE)
+		OSL_SLEEP(1);
+#endif
+		return BCME_ERROR;
+#endif /* RXF_DEQUEUE_ON_BUSY */
+	}
+	DHD_TRACE(("dhd_rxf_enqueue: Store SKB %p. idx %d -> %d\n",
+		skb, store_idx, (store_idx + 1) & (MAXSKBPEND - 1)));
+	dhdp->skbbuf[store_idx] = skb;
+	dhdp->store_idx = (store_idx + 1) & (MAXSKBPEND - 1);
+	dhd_os_rxfunlock(dhdp);
+
+	return BCME_OK;
+}
+
+static inline void* dhd_rxf_dequeue(dhd_pub_t *dhdp)
+{
+	uint32 store_idx;
+	uint32 sent_idx;
+	void *skb;
+
+	dhd_os_rxflock(dhdp);
+
+	store_idx = dhdp->store_idx;
+	sent_idx = dhdp->sent_idx;
+	skb = dhdp->skbbuf[sent_idx];
+
+	if (skb == NULL) {
+		dhd_os_rxfunlock(dhdp);
+		DHD_ERROR(("dhd_rxf_dequeue: Dequeued packet is NULL, store idx %d sent idx %d\n",
+			store_idx, sent_idx));
+		return NULL;
+	}
+
+	dhdp->skbbuf[sent_idx] = NULL;
+	dhdp->sent_idx = (sent_idx + 1) & (MAXSKBPEND - 1);
+
+	DHD_TRACE(("dhd_rxf_dequeue: netif_rx_ni(%p), sent idx %d\n",
+		skb, sent_idx));
+
+	dhd_os_rxfunlock(dhdp);
+
+	return skb;
+}
+
+int dhd_process_cid_mac(dhd_pub_t *dhdp, bool prepost)
+{
+#ifndef CUSTOMER_HW10
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+#endif /* !CUSTOMER_HW10 */
+
+	if (prepost) { /* pre process */
+		dhd_read_macaddr(dhd);
+	} else { /* post process */
+		dhd_write_macaddr(&dhd->pub.mac);
+	}
+
+	return 0;
+}
+
+#if defined(PKT_FILTER_SUPPORT) && !defined(GAN_LITE_NAT_KEEPALIVE_FILTER)
+static bool
+_turn_on_arp_filter(dhd_pub_t *dhd, int op_mode)
+{
+	bool _apply = FALSE;
+	/* In case of IBSS mode, apply arp pkt filter */
+	if (op_mode & DHD_FLAG_IBSS_MODE) {
+		_apply = TRUE;
+		goto exit;
+	}
+	/* In case of P2P GO or GC, apply pkt filter to pass arp pkt to host */
+	if ((dhd->arp_version == 1) &&
+		(op_mode & (DHD_FLAG_P2P_GC_MODE | DHD_FLAG_P2P_GO_MODE))) {
+		_apply = TRUE;
+		goto exit;
+	}
+
+exit:
+	return _apply;
+}
+#endif /* PKT_FILTER_SUPPORT && !GAN_LITE_NAT_KEEPALIVE_FILTER */
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#ifdef PKT_FILTER_SUPPORT
+void
+dhd_set_packet_filter_mode(struct net_device *dev, char *command)
+{
+	dhd_info_t *dhdi = *(dhd_info_t **)netdev_priv(dev);
+
+	dhdi->pub.pkt_filter_mode = bcm_strtoul(command, &command, 0);
+}
+
+int
+dhd_set_packet_filter_ports(struct net_device *dev, char *command)
+{
+	int i = 0, error = BCME_OK, count = 0, get_count = 0, action = 0;
+	uint16 portnum = 0, *ports = NULL, get_ports[WL_PKT_FILTER_PORTS_MAX];
+	dhd_info_t *dhdi = *(dhd_info_t **)netdev_priv(dev);
+	dhd_pub_t *dhdp = &dhdi->pub;
+	char iovbuf[WLC_IOCTL_SMLEN];
+
+	/* get action */
+	action = bcm_strtoul(command, &command, 0);
+	if (action > PKT_FILTER_PORTS_MAX)
+		return BCME_BADARG;
+
+	if (action == PKT_FILTER_PORTS_LOOPBACK) {
+		/* echo the loopback value if port filter is supported else error */
+		bcm_mkiovar("cap", NULL, 0, iovbuf, sizeof(iovbuf));
+		error = dhd_wl_ioctl_cmd(dhdp, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+		if (error < 0) {
+			DHD_ERROR(("%s: Get Capability failed (error=%d)\n", __FUNCTION__, error));
+			return error;
+		}
+
+		if (strstr(iovbuf, "pktfltr2"))
+			return bcm_strtoul(command, &command, 0);
+		else {
+			DHD_ERROR(("%s: pktfltr2 is not supported\n", __FUNCTION__));
+			return BCME_UNSUPPORTED;
+		}
+	}
+
+	if (action == PKT_FILTER_PORTS_CLEAR) {
+		/* action 0 is clear all ports */
+		dhdp->pkt_filter_ports_count = 0;
+		bzero(dhdp->pkt_filter_ports, sizeof(dhdp->pkt_filter_ports));
+	}
+	else {
+		portnum = bcm_strtoul(command, &command, 0);
+		if (portnum == 0) {
+			/* no ports to add or remove */
+			return BCME_BADARG;
+		}
+
+		/* get configured ports */
+		count = dhdp->pkt_filter_ports_count;
+		ports = dhdp->pkt_filter_ports;
+
+		if (action == PKT_FILTER_PORTS_ADD) {
+			/* action 1 is add ports */
+
+			/* copy new ports */
+			while ((portnum != 0) && (count < WL_PKT_FILTER_PORTS_MAX)) {
+				for (i = 0; i < count; i++) {
+					/* duplicate port */
+					if (portnum == ports[i])
+						break;
+				}
+				if (portnum != ports[i])
+					ports[count++] = portnum;
+				portnum = bcm_strtoul(command, &command, 0);
+			}
+		} else if ((action == PKT_FILTER_PORTS_DEL) && (count > 0)) {
+			/* action 2 is remove ports */
+			bcopy(dhdp->pkt_filter_ports, get_ports, count * sizeof(uint16));
+			get_count = count;
+
+			while (portnum != 0) {
+				count = 0;
+				for (i = 0; i < get_count; i++) {
+					if (portnum != get_ports[i])
+						ports[count++] = get_ports[i];
+				}
+				get_count = count;
+				bcopy(ports, get_ports, count * sizeof(uint16));
+				portnum = bcm_strtoul(command, &command, 0);
+			}
+		}
+		dhdp->pkt_filter_ports_count = count;
+	}
+	return error;
+}
+
+static void
+dhd_enable_packet_filter_ports(dhd_pub_t *dhd, bool enable)
+{
+	int error = 0;
+	wl_pkt_filter_ports_t *portlist = NULL;
+	const uint pkt_filter_ports_buf_len = sizeof("pkt_filter_ports")
+		+ WL_PKT_FILTER_PORTS_FIXED_LEN	+ (WL_PKT_FILTER_PORTS_MAX * sizeof(uint16));
+	char pkt_filter_ports_buf[pkt_filter_ports_buf_len];
+	char iovbuf[pkt_filter_ports_buf_len];
+
+	DHD_TRACE(("%s: enable %d, in_suspend %d, mode %d, port count %d\n", __FUNCTION__,
+		enable, dhd->in_suspend, dhd->pkt_filter_mode,
+		dhd->pkt_filter_ports_count));
+
+	bzero(pkt_filter_ports_buf, sizeof(pkt_filter_ports_buf));
+	portlist = (wl_pkt_filter_ports_t*)pkt_filter_ports_buf;
+	portlist->version = WL_PKT_FILTER_PORTS_VERSION;
+	portlist->reserved = 0;
+
+	if (enable) {
+		if (!(dhd->pkt_filter_mode & PKT_FILTER_MODE_PORTS_ONLY))
+			return;
+
+		/* enable port filter */
+		dhd_master_mode |= PKT_FILTER_MODE_PORTS_ONLY;
+		if (dhd->pkt_filter_mode & PKT_FILTER_MODE_FORWARD_ON_MATCH)
+			/* whitelist mode: FORWARD_ON_MATCH */
+			dhd_master_mode |= PKT_FILTER_MODE_FORWARD_ON_MATCH;
+		else
+			/* blacklist mode: DISCARD_ON_MATCH */
+			dhd_master_mode &= ~PKT_FILTER_MODE_FORWARD_ON_MATCH;
+
+		portlist->count = dhd->pkt_filter_ports_count;
+		bcopy(dhd->pkt_filter_ports, portlist->ports,
+			dhd->pkt_filter_ports_count * sizeof(uint16));
+	} else {
+		/* disable port filter */
+		portlist->count = 0;
+		dhd_master_mode &= ~PKT_FILTER_MODE_PORTS_ONLY;
+		dhd_master_mode |= PKT_FILTER_MODE_FORWARD_ON_MATCH;
+	}
+
+	DHD_INFO(("%s: update: mode %d, port count %d\n", __FUNCTION__, dhd_master_mode,
+		portlist->count));
+
+	/* update ports */
+	bcm_mkiovar("pkt_filter_ports",
+		(char*)portlist,
+		(WL_PKT_FILTER_PORTS_FIXED_LEN + (portlist->count * sizeof(uint16))),
+		iovbuf, sizeof(iovbuf));
+	error = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+	if (error < 0)
+		DHD_ERROR(("%s: set pkt_filter_ports failed %d\n", __FUNCTION__, error));
+
+	/* update mode */
+	bcm_mkiovar("pkt_filter_mode", (char*)&dhd_master_mode,
+		sizeof(dhd_master_mode), iovbuf, sizeof(iovbuf));
+	error = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+	if (error < 0)
+		DHD_ERROR(("%s: set pkt_filter_mode failed %d\n", __FUNCTION__, error));
+
+	return;
+}
+#endif /* PKT_FILTER_SUPPORT */
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+void dhd_set_packet_filter(dhd_pub_t *dhd)
+{
+#ifdef PKT_FILTER_SUPPORT
+	int i;
+
+	DHD_TRACE(("%s: enter\n", __FUNCTION__));
+	if (dhd_pkt_filter_enable) {
+		for (i = 0; i < dhd->pktfilter_count; i++) {
+			dhd_pktfilter_offload_set(dhd, dhd->pktfilter[i]);
+		}
+	}
+#endif /* PKT_FILTER_SUPPORT */
+}
+
+void dhd_enable_packet_filter(int value, dhd_pub_t *dhd)
+{
+#ifdef PKT_FILTER_SUPPORT
+	int i;
+
+	DHD_TRACE(("%s: enter, value = %d\n", __FUNCTION__, value));
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+	dhd_enable_packet_filter_ports(dhd, value);
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+	/* 1 - Enable packet filter, only allow unicast packet to send up */
+	/* 0 - Disable packet filter */
+	if (dhd_pkt_filter_enable && (!value ||
+	    (dhd_support_sta_mode(dhd) && !dhd->dhcp_in_progress)))
+	{
+		for (i = 0; i < dhd->pktfilter_count; i++) {
+#ifndef GAN_LITE_NAT_KEEPALIVE_FILTER
+			if (value && (i == DHD_ARP_FILTER_NUM) &&
+				!_turn_on_arp_filter(dhd, dhd->op_mode)) {
+				DHD_TRACE(("Do not turn on ARP white list pkt filter:"
+					"val %d, cnt %d, op_mode 0x%x\n",
+					value, i, dhd->op_mode));
+				continue;
+			}
+#endif /* !GAN_LITE_NAT_KEEPALIVE_FILTER */
+			dhd_pktfilter_offload_enable(dhd, dhd->pktfilter[i],
+				value, dhd_master_mode);
+		}
+	}
+#endif /* PKT_FILTER_SUPPORT */
+}
+
+static int dhd_set_suspend(int value, dhd_pub_t *dhd)
+{
+#ifndef SUPPORT_PM2_ONLY
+	int power_mode = PM_MAX;
+#endif /* SUPPORT_PM2_ONLY */
+	/* wl_pkt_filter_enable_t	enable_parm; */
+	char iovbuf[32];
+	int bcn_li_dtim = 0; /* Default bcn_li_dtim in resume mode is 0 */
+	uint roamvar = dhd->conf->roam_off_suspend;
+	uint nd_ra_filter = 0;
+	int ret = 0;
+
+	if (!dhd)
+		return -ENODEV;
+
+	DHD_TRACE(("%s: enter, value = %d in_suspend=%d\n",
+		__FUNCTION__, value, dhd->in_suspend));
+
+	dhd_suspend_lock(dhd);
+
+#ifdef CUSTOM_SET_CPUCORE
+	DHD_TRACE(("%s set cpucore(suspend%d)\n", __FUNCTION__, value));
+	/* set specific cpucore */
+	dhd_set_cpucore(dhd, TRUE);
+#endif /* CUSTOM_SET_CPUCORE */
+#ifndef SUPPORT_PM2_ONLY
+	if (dhd->conf->pm >= 0)
+		power_mode = dhd->conf->pm;
+#endif /* SUPPORT_PM2_ONLY */
+	if (dhd->up) {
+		if (value && dhd->in_suspend) {
+#ifdef PKT_FILTER_SUPPORT
+			dhd->early_suspended = 1;
+#endif
+			/* Kernel suspended */
+			DHD_ERROR(("%s: force extra Suspend setting\n", __FUNCTION__));
+
+#ifndef SUPPORT_PM2_ONLY
+			dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+				sizeof(power_mode), TRUE, 0);
+#endif /* SUPPORT_PM2_ONLY */
+
+			/* Enable packet filter, only allow unicast packet to send up */
+			dhd_enable_packet_filter(1, dhd);
+
+			/* If DTIM skip is set up as default, force it to wake
+			 * each third DTIM for better power savings.  Note that
+			 * one side effect is a chance to miss BC/MC packet.
+			 */
+			bcn_li_dtim = dhd_get_suspend_bcn_li_dtim(dhd);
+			bcm_mkiovar("bcn_li_dtim", (char *)&bcn_li_dtim,
+				4, iovbuf, sizeof(iovbuf));
+			if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf),
+				TRUE, 0) < 0)
+					DHD_ERROR(("%s: set dtim failed\n", __FUNCTION__));
+
+			/* Disable firmware roaming during suspend */
+			bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf, sizeof(iovbuf));
+			dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			if (FW_SUPPORTED(dhd, ndoe)) {
+				/* enable IPv6 RA filter in  firmware during suspend */
+				nd_ra_filter = 1;
+				bcm_mkiovar("nd_ra_filter_enable", (char *)&nd_ra_filter, 4,
+					iovbuf, sizeof(iovbuf));
+				if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+					sizeof(iovbuf), TRUE, 0)) < 0)
+					DHD_ERROR(("failed to set nd_ra_filter (%d)\n",
+						ret));
+			}
+		} else {
+#ifdef PKT_FILTER_SUPPORT
+			dhd->early_suspended = 0;
+#endif
+			/* Kernel resumed  */
+			DHD_ERROR(("%s: Remove extra suspend setting\n", __FUNCTION__));
+
+#ifndef SUPPORT_PM2_ONLY
+			power_mode = PM_FAST;
+			dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode,
+				sizeof(power_mode), TRUE, 0);
+#endif /* SUPPORT_PM2_ONLY */
+#ifdef PKT_FILTER_SUPPORT
+			/* disable pkt filter */
+			dhd_enable_packet_filter(0, dhd);
+#endif /* PKT_FILTER_SUPPORT */
+
+			/* restore pre-suspend setting for dtim_skip */
+			bcm_mkiovar("bcn_li_dtim", (char *)&bcn_li_dtim,
+				4, iovbuf, sizeof(iovbuf));
+
+			dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			roamvar = dhd_roam_disable;
+			bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf, sizeof(iovbuf));
+			dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			if (FW_SUPPORTED(dhd, ndoe)) {
+				/* disable IPv6 RA filter in  firmware during suspend */
+				nd_ra_filter = 0;
+				bcm_mkiovar("nd_ra_filter_enable", (char *)&nd_ra_filter, 4,
+					iovbuf, sizeof(iovbuf));
+				if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+					sizeof(iovbuf), TRUE, 0)) < 0)
+					DHD_ERROR(("failed to set nd_ra_filter (%d)\n",
+						ret));
+			}
+		}
+	}
+	dhd_suspend_unlock(dhd);
+
+	return 0;
+}
+
+static int dhd_suspend_resume_helper(struct dhd_info *dhd, int val, int force)
+{
+	dhd_pub_t *dhdp = &dhd->pub;
+	int ret = 0;
+
+	DHD_OS_WAKE_LOCK(dhdp);
+	DHD_PERIM_LOCK(dhdp);
+
+	/* Set flag when early suspend was called */
+	dhdp->in_suspend = val;
+	if ((force || !dhdp->suspend_disable_flag) &&
+		dhd_support_sta_mode(dhdp))
+	{
+		ret = dhd_set_suspend(val, dhdp);
+	}
+
+	DHD_PERIM_UNLOCK(dhdp);
+	DHD_OS_WAKE_UNLOCK(dhdp);
+	return ret;
+}
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+static void dhd_early_suspend(struct early_suspend *h)
+{
+	struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+	DHD_TRACE_HW4(("%s: enter\n", __FUNCTION__));
+
+	if (dhd)
+		dhd_suspend_resume_helper(dhd, 1, 0);
+}
+
+static void dhd_late_resume(struct early_suspend *h)
+{
+	struct dhd_info *dhd = container_of(h, struct dhd_info, early_suspend);
+	DHD_TRACE_HW4(("%s: enter\n", __FUNCTION__));
+
+	if (dhd)
+		dhd_suspend_resume_helper(dhd, 0, 0);
+}
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+/*
+ * Generalized timeout mechanism.  Uses spin sleep with exponential back-off until
+ * the sleep time reaches one jiffy, then switches over to task delay.  Usage:
+ *
+ *      dhd_timeout_start(&tmo, usec);
+ *      while (!dhd_timeout_expired(&tmo))
+ *              if (poll_something())
+ *                      break;
+ *      if (dhd_timeout_expired(&tmo))
+ *              fatal();
+ */
+
+void
+dhd_timeout_start(dhd_timeout_t *tmo, uint usec)
+{
+	tmo->limit = usec;
+	tmo->increment = 0;
+	tmo->elapsed = 0;
+	tmo->tick = jiffies_to_usecs(1);
+}
+
+int
+dhd_timeout_expired(dhd_timeout_t *tmo)
+{
+	/* Does nothing the first call */
+	if (tmo->increment == 0) {
+		tmo->increment = 1;
+		return 0;
+	}
+
+	if (tmo->elapsed >= tmo->limit)
+		return 1;
+
+	/* Add the delay that's about to take place */
+	tmo->elapsed += tmo->increment;
+
+	if ((!CAN_SLEEP()) || tmo->increment < tmo->tick) {
+		OSL_DELAY(tmo->increment);
+		tmo->increment *= 2;
+		if (tmo->increment > tmo->tick)
+			tmo->increment = tmo->tick;
+	} else {
+		wait_queue_head_t delay_wait;
+		DECLARE_WAITQUEUE(wait, current);
+		init_waitqueue_head(&delay_wait);
+		add_wait_queue(&delay_wait, &wait);
+		set_current_state(TASK_INTERRUPTIBLE);
+		(void)schedule_timeout(1);
+		remove_wait_queue(&delay_wait, &wait);
+		set_current_state(TASK_RUNNING);
+	}
+
+	return 0;
+}
+
+int
+dhd_net2idx(dhd_info_t *dhd, struct net_device *net)
+{
+	int i = 0;
+
+	if (!dhd) {
+		DHD_ERROR(("%s : DHD_BAD_IF return\n", __FUNCTION__));
+		return DHD_BAD_IF;
+	}
+	while (i < DHD_MAX_IFS) {
+		if (dhd->iflist[i] && dhd->iflist[i]->net && (dhd->iflist[i]->net == net))
+			return i;
+		i++;
+	}
+
+	return DHD_BAD_IF;
+}
+
+struct net_device * dhd_idx2net(void *pub, int ifidx)
+{
+	struct dhd_pub *dhd_pub = (struct dhd_pub *)pub;
+	struct dhd_info *dhd_info;
+
+	if (!dhd_pub || ifidx < 0 || ifidx >= DHD_MAX_IFS)
+		return NULL;
+	dhd_info = dhd_pub->info;
+	if (dhd_info && dhd_info->iflist[ifidx])
+		return dhd_info->iflist[ifidx]->net;
+	return NULL;
+}
+
+int
+dhd_ifname2idx(dhd_info_t *dhd, char *name)
+{
+	int i = DHD_MAX_IFS;
+
+	ASSERT(dhd);
+
+	if (name == NULL || *name == '\0')
+		return 0;
+
+	while (--i > 0)
+		if (dhd->iflist[i] && !strncmp(dhd->iflist[i]->name, name, IFNAMSIZ))
+				break;
+
+	DHD_TRACE(("%s: return idx %d for \"%s\"\n", __FUNCTION__, i, name));
+
+	return i;	/* default - the primary interface */
+}
+
+int
+dhd_ifidx2hostidx(dhd_info_t *dhd, int ifidx)
+{
+	int i = DHD_MAX_IFS;
+
+	ASSERT(dhd);
+
+	while (--i > 0)
+		if (dhd->iflist[i] && (dhd->iflist[i]->idx == ifidx))
+				break;
+
+	DHD_TRACE(("%s: return hostidx %d for ifidx %d\n", __FUNCTION__, i, ifidx));
+
+	return i;	/* default - the primary interface */
+}
+
+char *
+dhd_ifname(dhd_pub_t *dhdp, int ifidx)
+{
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+	ASSERT(dhd);
+
+	if (ifidx < 0 || ifidx >= DHD_MAX_IFS) {
+		DHD_ERROR(("%s: ifidx %d out of range\n", __FUNCTION__, ifidx));
+		return "<if_bad>";
+	}
+
+	if (dhd->iflist[ifidx] == NULL) {
+		DHD_ERROR(("%s: null i/f %d\n", __FUNCTION__, ifidx));
+		return "<if_null>";
+	}
+
+	if (dhd->iflist[ifidx]->net)
+		return dhd->iflist[ifidx]->net->name;
+
+	return "<if_none>";
+}
+
+uint8 *
+dhd_bssidx2bssid(dhd_pub_t *dhdp, int idx)
+{
+	int i;
+	dhd_info_t *dhd = (dhd_info_t *)dhdp;
+
+	ASSERT(dhd);
+	for (i = 0; i < DHD_MAX_IFS; i++)
+	if (dhd->iflist[i] && dhd->iflist[i]->bssidx == idx)
+		return dhd->iflist[i]->mac_addr;
+
+	return NULL;
+}
+
+
+static void
+_dhd_set_multicast_list(dhd_info_t *dhd, int ifidx)
+{
+	struct net_device *dev;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+	struct netdev_hw_addr *ha;
+#else
+	struct dev_mc_list *mclist;
+#endif
+	uint32 allmulti, cnt;
+
+	wl_ioctl_t ioc;
+	char *buf, *bufp;
+	uint buflen;
+	int ret;
+
+	ASSERT(dhd && dhd->iflist[ifidx]);
+	dev = dhd->iflist[ifidx]->net;
+	if (!dev)
+		return;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	netif_addr_lock_bh(dev);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+	cnt = netdev_mc_count(dev);
+#else
+	cnt = dev->mc_count;
+#endif /* LINUX_VERSION_CODE */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	netif_addr_unlock_bh(dev);
+#endif
+
+	/* Determine initial value of allmulti flag */
+	allmulti = (dev->flags & IFF_ALLMULTI) ? TRUE : FALSE;
+
+	/* Send down the multicast list first. */
+
+
+	buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETHER_ADDR_LEN);
+	if (!(bufp = buf = MALLOC(dhd->pub.osh, buflen))) {
+		DHD_ERROR(("%s: out of memory for mcast_list, cnt %d\n",
+			dhd_ifname(&dhd->pub, ifidx), cnt));
+		return;
+	}
+
+	strncpy(bufp, "mcast_list", buflen - 1);
+	bufp[buflen - 1] = '\0';
+	bufp += strlen("mcast_list") + 1;
+
+	cnt = htol32(cnt);
+	memcpy(bufp, &cnt, sizeof(cnt));
+	bufp += sizeof(cnt);
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	netif_addr_lock_bh(dev);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+	netdev_for_each_mc_addr(ha, dev) {
+		if (!cnt)
+			break;
+		memcpy(bufp, ha->addr, ETHER_ADDR_LEN);
+		bufp += ETHER_ADDR_LEN;
+		cnt--;
+	}
+#else
+	for (mclist = dev->mc_list; (mclist && (cnt > 0));
+			cnt--, mclist = mclist->next) {
+		memcpy(bufp, (void *)mclist->dmi_addr, ETHER_ADDR_LEN);
+		bufp += ETHER_ADDR_LEN;
+	}
+#endif /* LINUX_VERSION_CODE */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+	netif_addr_unlock_bh(dev);
+#endif
+
+	memset(&ioc, 0, sizeof(ioc));
+	ioc.cmd = WLC_SET_VAR;
+	ioc.buf = buf;
+	ioc.len = buflen;
+	ioc.set = TRUE;
+
+	ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+	if (ret < 0) {
+		DHD_ERROR(("%s: set mcast_list failed, cnt %d\n",
+			dhd_ifname(&dhd->pub, ifidx), cnt));
+		allmulti = cnt ? TRUE : allmulti;
+	}
+
+	MFREE(dhd->pub.osh, buf, buflen);
+
+	/* Now send the allmulti setting.  This is based on the setting in the
+	 * net_device flags, but might be modified above to be turned on if we
+	 * were trying to set some addresses and dongle rejected it...
+	 */
+
+	buflen = sizeof("allmulti") + sizeof(allmulti);
+	if (!(buf = MALLOC(dhd->pub.osh, buflen))) {
+		DHD_ERROR(("%s: out of memory for allmulti\n", dhd_ifname(&dhd->pub, ifidx)));
+		return;
+	}
+	allmulti = htol32(allmulti);
+
+	if (!bcm_mkiovar("allmulti", (void*)&allmulti, sizeof(allmulti), buf, buflen)) {
+		DHD_ERROR(("%s: mkiovar failed for allmulti, datalen %d buflen %u\n",
+		           dhd_ifname(&dhd->pub, ifidx), (int)sizeof(allmulti), buflen));
+		MFREE(dhd->pub.osh, buf, buflen);
+		return;
+	}
+
+
+	memset(&ioc, 0, sizeof(ioc));
+	ioc.cmd = WLC_SET_VAR;
+	ioc.buf = buf;
+	ioc.len = buflen;
+	ioc.set = TRUE;
+
+	ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+	if (ret < 0) {
+		DHD_ERROR(("%s: set allmulti %d failed\n",
+		           dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+	}
+
+	MFREE(dhd->pub.osh, buf, buflen);
+
+	/* Finally, pick up the PROMISC flag as well, like the NIC driver does */
+
+	allmulti = (dev->flags & IFF_PROMISC) ? TRUE : FALSE;
+
+	allmulti = htol32(allmulti);
+
+	memset(&ioc, 0, sizeof(ioc));
+	ioc.cmd = WLC_SET_PROMISC;
+	ioc.buf = &allmulti;
+	ioc.len = sizeof(allmulti);
+	ioc.set = TRUE;
+
+	ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+	if (ret < 0) {
+		DHD_ERROR(("%s: set promisc %d failed\n",
+		           dhd_ifname(&dhd->pub, ifidx), ltoh32(allmulti)));
+	}
+}
+
+int
+_dhd_set_mac_address(dhd_info_t *dhd, int ifidx, uint8 *addr)
+{
+	char buf[32];
+	wl_ioctl_t ioc;
+	int ret;
+
+	if (!bcm_mkiovar("cur_etheraddr", (char*)addr, ETHER_ADDR_LEN, buf, 32)) {
+		DHD_ERROR(("%s: mkiovar failed for cur_etheraddr\n", dhd_ifname(&dhd->pub, ifidx)));
+		return -1;
+	}
+	memset(&ioc, 0, sizeof(ioc));
+	ioc.cmd = WLC_SET_VAR;
+	ioc.buf = buf;
+	ioc.len = 32;
+	ioc.set = TRUE;
+
+	ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len);
+	if (ret < 0) {
+		DHD_ERROR(("%s: set cur_etheraddr failed\n", dhd_ifname(&dhd->pub, ifidx)));
+	} else {
+		memcpy(dhd->iflist[ifidx]->net->dev_addr, addr, ETHER_ADDR_LEN);
+		if (ifidx == 0)
+			memcpy(dhd->pub.mac.octet, addr, ETHER_ADDR_LEN);
+	}
+
+	return ret;
+}
+
+#ifdef SOFTAP
+extern struct net_device *ap_net_dev;
+extern tsk_ctl_t ap_eth_ctl; /* ap netdev heper thread ctl */
+#endif
+
+static void
+dhd_ifadd_event_handler(void *handle, void *event_info, u8 event)
+{
+	dhd_info_t *dhd = handle;
+	dhd_if_event_t *if_event = event_info;
+	struct net_device *ndev;
+	int ifidx, bssidx;
+	int ret;
+#if 1 && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+	struct wireless_dev *vwdev, *primary_wdev;
+	struct net_device *primary_ndev;
+#endif /* OEM_ANDROID && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)) */
+
+	if (event != DHD_WQ_WORK_IF_ADD) {
+		DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+		return;
+	}
+
+	if (!dhd) {
+		DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+		return;
+	}
+
+	if (!if_event) {
+		DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+		return;
+	}
+
+	dhd_net_if_lock_local(dhd);
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+
+	ifidx = if_event->event.ifidx;
+	bssidx = if_event->event.bssidx;
+	DHD_TRACE(("%s: registering if with ifidx %d\n", __FUNCTION__, ifidx));
+
+	ndev = dhd_allocate_if(&dhd->pub, ifidx, if_event->name,
+		if_event->mac, bssidx, TRUE);
+	if (!ndev) {
+		DHD_ERROR(("%s: net device alloc failed  \n", __FUNCTION__));
+		goto done;
+	}
+
+#if 1 && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+	vwdev = kzalloc(sizeof(*vwdev), GFP_KERNEL);
+	if (unlikely(!vwdev)) {
+		WL_ERR(("Could not allocate wireless device\n"));
+		goto done;
+	}
+	primary_ndev = dhd->pub.info->iflist[0]->net;
+	primary_wdev = ndev_to_wdev(primary_ndev);
+	vwdev->wiphy = primary_wdev->wiphy;
+	vwdev->iftype = if_event->event.role;
+	vwdev->netdev = ndev;
+	ndev->ieee80211_ptr = vwdev;
+	SET_NETDEV_DEV(ndev, wiphy_dev(vwdev->wiphy));
+	DHD_ERROR(("virtual interface(%s) is created\n", if_event->name));
+#endif /* OEM_ANDROID && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0)) */
+
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	ret = dhd_register_if(&dhd->pub, ifidx, TRUE);
+	DHD_PERIM_LOCK(&dhd->pub);
+	if (ret != BCME_OK) {
+		DHD_ERROR(("%s: dhd_register_if failed\n", __FUNCTION__));
+		dhd_remove_if(&dhd->pub, ifidx, TRUE);
+		goto done;
+	}
+#ifdef PCIE_FULL_DONGLE
+	/* Turn on AP isolation in the firmware for interfaces operating in AP mode */
+	if (FW_SUPPORTED((&dhd->pub), ap) && !(DHD_IF_ROLE_STA(if_event->event.role))) {
+		char iovbuf[WLC_IOCTL_SMLEN];
+		uint32 var_int =  1;
+
+		memset(iovbuf, 0, sizeof(iovbuf));
+		bcm_mkiovar("ap_isolate", (char *)&var_int, 4, iovbuf, sizeof(iovbuf));
+		ret = dhd_wl_ioctl_cmd(&dhd->pub, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, ifidx);
+
+		if (ret != BCME_OK) {
+			DHD_ERROR(("%s: Failed to set ap_isolate to dongle\n", __FUNCTION__));
+			dhd_remove_if(&dhd->pub, ifidx, TRUE);
+		}
+	}
+#endif /* PCIE_FULL_DONGLE */
+done:
+	MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_ifdel_event_handler(void *handle, void *event_info, u8 event)
+{
+	dhd_info_t *dhd = handle;
+	int ifidx;
+	dhd_if_event_t *if_event = event_info;
+
+
+	if (event != DHD_WQ_WORK_IF_DEL) {
+		DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+		return;
+	}
+
+	if (!dhd) {
+		DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+		return;
+	}
+
+	if (!if_event) {
+		DHD_ERROR(("%s: event data is null \n", __FUNCTION__));
+		return;
+	}
+
+	dhd_net_if_lock_local(dhd);
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+
+	ifidx = if_event->event.ifidx;
+	DHD_TRACE(("Removing interface with idx %d\n", ifidx));
+
+	dhd_remove_if(&dhd->pub, ifidx, TRUE);
+
+	MFREE(dhd->pub.osh, if_event, sizeof(dhd_if_event_t));
+
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_set_mac_addr_handler(void *handle, void *event_info, u8 event)
+{
+	dhd_info_t *dhd = handle;
+	dhd_if_t *ifp = event_info;
+
+	if (event != DHD_WQ_WORK_SET_MAC) {
+		DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+	}
+
+	if (!dhd) {
+		DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+		return;
+	}
+
+	dhd_net_if_lock_local(dhd);
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+
+#ifdef SOFTAP
+	{
+		unsigned long flags;
+		bool in_ap = FALSE;
+		DHD_GENERAL_LOCK(&dhd->pub, flags);
+		in_ap = (ap_net_dev != NULL);
+		DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+		if (in_ap)  {
+			DHD_ERROR(("attempt to set MAC for %s in AP Mode, blocked. \n",
+			           ifp->net->name));
+			goto done;
+		}
+	}
+#endif /* SOFTAP */
+
+	if (ifp == NULL || !dhd->pub.up) {
+		DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+		goto done;
+	}
+
+	DHD_ERROR(("%s: MACID is overwritten\n", __FUNCTION__));
+	ifp->set_macaddress = FALSE;
+	if (_dhd_set_mac_address(dhd, ifp->idx, ifp->mac_addr) == 0)
+		DHD_INFO(("%s: MACID is overwritten\n",	__FUNCTION__));
+	else
+		DHD_ERROR(("%s: _dhd_set_mac_address() failed\n", __FUNCTION__));
+
+done:
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	dhd_net_if_unlock_local(dhd);
+}
+
+static void
+dhd_set_mcast_list_handler(void *handle, void *event_info, u8 event)
+{
+	dhd_info_t *dhd = handle;
+	dhd_if_t *ifp = event_info;
+	int ifidx;
+
+	if (event != DHD_WQ_WORK_SET_MCAST_LIST) {
+		DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+		return;
+	}
+
+	if (!dhd) {
+		DHD_ERROR(("%s: dhd info not available \n", __FUNCTION__));
+		return;
+	}
+
+	dhd_net_if_lock_local(dhd);
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+
+#ifdef SOFTAP
+	{
+		bool in_ap = FALSE;
+		unsigned long flags;
+		DHD_GENERAL_LOCK(&dhd->pub, flags);
+		in_ap = (ap_net_dev != NULL);
+		DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+		if (in_ap)  {
+			DHD_ERROR(("set MULTICAST list for %s in AP Mode, blocked. \n",
+			           ifp->net->name));
+			ifp->set_multicast = FALSE;
+			goto done;
+		}
+	}
+#endif /* SOFTAP */
+
+	if (ifp == NULL || !dhd->pub.up) {
+		DHD_ERROR(("%s: interface info not available/down \n", __FUNCTION__));
+		goto done;
+	}
+
+	ifidx = ifp->idx;
+
+
+	_dhd_set_multicast_list(dhd, ifidx);
+	DHD_INFO(("%s: set multicast list for if %d\n", __FUNCTION__, ifidx));
+
+done:
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	dhd_net_if_unlock_local(dhd);
+}
+
+static int
+dhd_set_mac_address(struct net_device *dev, void *addr)
+{
+	int ret = 0;
+
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	struct sockaddr *sa = (struct sockaddr *)addr;
+	int ifidx;
+	dhd_if_t *dhdif;
+
+	ifidx = dhd_net2idx(dhd, dev);
+	if (ifidx == DHD_BAD_IF)
+		return -1;
+
+	dhdif = dhd->iflist[ifidx];
+
+	dhd_net_if_lock_local(dhd);
+	memcpy(dhdif->mac_addr, sa->sa_data, ETHER_ADDR_LEN);
+	dhdif->set_macaddress = TRUE;
+	dhd_net_if_unlock_local(dhd);
+	dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)dhdif, DHD_WQ_WORK_SET_MAC,
+		dhd_set_mac_addr_handler, DHD_WORK_PRIORITY_LOW);
+	return ret;
+}
+
+static void
+dhd_set_multicast_list(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ifidx;
+
+	ifidx = dhd_net2idx(dhd, dev);
+	if (ifidx == DHD_BAD_IF)
+		return;
+
+	dhd->iflist[ifidx]->set_multicast = TRUE;
+	dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)dhd->iflist[ifidx],
+		DHD_WQ_WORK_SET_MCAST_LIST, dhd_set_mcast_list_handler, DHD_WORK_PRIORITY_LOW);
+}
+
+#ifdef PROP_TXSTATUS
+int
+dhd_os_wlfc_block(dhd_pub_t *pub)
+{
+	dhd_info_t *di = (dhd_info_t *)(pub->info);
+	ASSERT(di != NULL);
+	spin_lock_bh(&di->wlfc_spinlock);
+	return 1;
+}
+
+int
+dhd_os_wlfc_unblock(dhd_pub_t *pub)
+{
+	dhd_info_t *di = (dhd_info_t *)(pub->info);
+
+	ASSERT(di != NULL);
+	spin_unlock_bh(&di->wlfc_spinlock);
+	return 1;
+}
+
+#endif /* PROP_TXSTATUS */
+
+#if defined(DHD_RX_DUMP) || defined(DHD_TX_DUMP)
+typedef struct {
+	uint16 type;
+	const char *str;
+} PKTTYPE_INFO;
+
+static const PKTTYPE_INFO packet_type_info[] =
+{
+	{ ETHER_TYPE_IP, "IP" },
+	{ ETHER_TYPE_ARP, "ARP" },
+	{ ETHER_TYPE_BRCM, "BRCM" },
+	{ ETHER_TYPE_802_1X, "802.1X" },
+	{ ETHER_TYPE_WAI, "WAPI" },
+	{ 0, ""}
+};
+
+static const char *_get_packet_type_str(uint16 type)
+{
+	int i;
+	int n = sizeof(packet_type_info)/sizeof(packet_type_info[1]) - 1;
+
+	for (i = 0; i < n; i++) {
+		if (packet_type_info[i].type == type)
+			return packet_type_info[i].str;
+	}
+
+	return packet_type_info[n].str;
+}
+#endif /* DHD_RX_DUMP || DHD_TX_DUMP */
+
+#if defined(DHD_TX_DUMP)
+void
+dhd_tx_dump(osl_t *osh, void *pkt)
+{
+	uint8 *dump_data;
+	uint16 protocol;
+	struct ether_header *eh;
+
+	dump_data = PKTDATA(osh, pkt);
+	eh = (struct ether_header *) dump_data;
+	protocol = ntoh16(eh->ether_type);
+
+	DHD_ERROR(("TX DUMP - %s\n", _get_packet_type_str(protocol)));
+
+	if (protocol == ETHER_TYPE_802_1X) {
+		DHD_ERROR(("ETHER_TYPE_802_1X [TX]: ver %d, type %d, replay %d\n",
+			dump_data[14], dump_data[15], dump_data[30]));
+	}
+
+#if defined(DHD_TX_FULL_DUMP)
+	{
+		int i;
+		uint datalen;
+		datalen = PKTLEN(osh, pkt);
+
+		for (i = 0; i < datalen; i++) {
+			DHD_ERROR(("%02X ", dump_data[i]));
+			if ((i & 15) == 15)
+				printk("\n");
+		}
+		DHD_ERROR(("\n"));
+	}
+#endif /* DHD_TX_FULL_DUMP */
+}
+#endif /* DHD_TX_DUMP */
+
+int BCMFASTPATH
+dhd_sendpkt(dhd_pub_t *dhdp, int ifidx, void *pktbuf)
+{
+	int ret = BCME_OK;
+	dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+	struct ether_header *eh = NULL;
+
+	/* Reject if down */
+	if (!dhdp->up || (dhdp->busstate == DHD_BUS_DOWN)) {
+		/* free the packet here since the caller won't */
+		PKTFREE(dhdp->osh, pktbuf, TRUE);
+		return -ENODEV;
+	}
+
+#ifdef PCIE_FULL_DONGLE
+	if (dhdp->busstate == DHD_BUS_SUSPEND) {
+		DHD_ERROR(("%s : pcie is still in suspend state!!\n", __FUNCTION__));
+		PKTFREE(dhdp->osh, pktbuf, TRUE);
+		return -EBUSY;
+	}
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_UNICAST_DHCP
+	/* if dhcp_unicast is enabled, we need to convert the */
+	/* broadcast DHCP ACK/REPLY packets to Unicast. */
+	if (dhdp->dhcp_unicast) {
+	    dhd_convert_dhcp_broadcast_ack_to_unicast(dhdp, pktbuf, ifidx);
+	}
+#endif /* DHD_UNICAST_DHCP */
+	/* Update multicast statistic */
+	if (PKTLEN(dhdp->osh, pktbuf) >= ETHER_HDR_LEN) {
+		uint8 *pktdata = (uint8 *)PKTDATA(dhdp->osh, pktbuf);
+		eh = (struct ether_header *)pktdata;
+
+		if (ETHER_ISMULTI(eh->ether_dhost))
+			dhdp->tx_multicast++;
+		if (ntoh16(eh->ether_type) == ETHER_TYPE_802_1X)
+			atomic_inc(&dhd->pend_8021x_cnt);
+	} else {
+			PKTFREE(dhd->pub.osh, pktbuf, TRUE);
+			return BCME_ERROR;
+	}
+
+	/* Look into the packet and update the packet priority */
+#ifndef PKTPRIO_OVERRIDE
+	if (PKTPRIO(pktbuf) == 0)
+#endif
+		pktsetprio(pktbuf, FALSE);
+
+
+#if defined(PCIE_FULL_DONGLE) && !defined(PCIE_TX_DEFERRAL)
+	/*
+	 * Lkup the per interface hash table, for a matching flowring. If one is not
+	 * available, allocate a unique flowid and add a flowring entry.
+	 * The found or newly created flowid is placed into the pktbuf's tag.
+	 */
+	ret = dhd_flowid_update(dhdp, ifidx, dhdp->flow_prio_map[(PKTPRIO(pktbuf))], pktbuf);
+	if (ret != BCME_OK) {
+		PKTCFREE(dhd->pub.osh, pktbuf, TRUE);
+		return ret;
+	}
+#endif
+#if defined(DHD_TX_DUMP)
+	dhd_tx_dump(dhdp->osh, pktbuf);
+#endif
+
+#ifdef PROP_TXSTATUS
+	if (dhd_wlfc_is_supported(dhdp)) {
+		/* store the interface ID */
+		DHD_PKTTAG_SETIF(PKTTAG(pktbuf), ifidx);
+
+		/* store destination MAC in the tag as well */
+		DHD_PKTTAG_SETDSTN(PKTTAG(pktbuf), eh->ether_dhost);
+
+		/* decide which FIFO this packet belongs to */
+		if (ETHER_ISMULTI(eh->ether_dhost))
+			/* one additional queue index (highest AC + 1) is used for bc/mc queue */
+			DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), AC_COUNT);
+		else
+			DHD_PKTTAG_SETFIFO(PKTTAG(pktbuf), WME_PRIO2AC(PKTPRIO(pktbuf)));
+	} else
+#endif /* PROP_TXSTATUS */
+	/* If the protocol uses a data header, apply it */
+	dhd_prot_hdrpush(dhdp, ifidx, pktbuf);
+
+	/* Use bus module to send data frame */
+#ifdef WLMEDIA_HTSF
+	dhd_htsf_addtxts(dhdp, pktbuf);
+#endif
+
+#ifdef PROP_TXSTATUS
+	{
+		if (dhd_wlfc_commit_packets(dhdp, (f_commitpkt_t)dhd_bus_txdata,
+			dhdp->bus, pktbuf, TRUE) == WLFC_UNSUPPORTED) {
+			/* non-proptxstatus way */
+#ifdef BCMPCIE
+			ret = dhd_bus_txdata(dhdp->bus, pktbuf, (uint8)ifidx);
+#else
+			ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* BCMPCIE */
+		}
+	}
+#else
+#ifdef BCMPCIE
+	ret = dhd_bus_txdata(dhdp->bus, pktbuf, (uint8)ifidx);
+#else
+	ret = dhd_bus_txdata(dhdp->bus, pktbuf);
+#endif /* BCMPCIE */
+#endif /* PROP_TXSTATUS */
+
+	return ret;
+}
+
+int BCMFASTPATH
+dhd_start_xmit(struct sk_buff *skb, struct net_device *net)
+{
+	int ret;
+	uint datalen;
+	void *pktbuf;
+	dhd_info_t *dhd = DHD_DEV_INFO(net);
+	dhd_if_t *ifp = NULL;
+	int ifidx;
+#ifdef WLMEDIA_HTSF
+	uint8 htsfdlystat_sz = dhd->pub.htsfdlystat_sz;
+#else
+	uint8 htsfdlystat_sz = 0;
+#endif
+#ifdef DHD_WMF
+	struct ether_header *eh;
+	uint8 *iph;
+#endif /* DHD_WMF */
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+
+	/* Reject if down */
+	if (dhd->pub.busstate == DHD_BUS_DOWN || dhd->pub.hang_was_sent) {
+		DHD_ERROR(("%s: xmit rejected pub.up=%d busstate=%d \n",
+			__FUNCTION__, dhd->pub.up, dhd->pub.busstate));
+		netif_stop_queue(net);
+		/* Send Event when bus down detected during data session */
+		if (dhd->pub.up) {
+			DHD_ERROR(("%s: Event HANG sent up\n", __FUNCTION__));
+			net_os_send_hang_message(net);
+		}
+		DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+		return -ENODEV;
+#else
+		return NETDEV_TX_BUSY;
+#endif
+	}
+
+	ifp = DHD_DEV_IFP(net);
+	ifidx = DHD_DEV_IFIDX(net);
+
+	ASSERT(ifidx == dhd_net2idx(dhd, net));
+	ASSERT((ifp != NULL) && (ifp == dhd->iflist[ifidx]));
+
+	if (ifidx == DHD_BAD_IF) {
+		DHD_ERROR(("%s: bad ifidx %d\n", __FUNCTION__, ifidx));
+		netif_stop_queue(net);
+		DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+		return -ENODEV;
+#else
+		return NETDEV_TX_BUSY;
+#endif
+	}
+
+	/* re-align socket buffer if "skb->data" is odd address */
+	if (((unsigned long)(skb->data)) & 0x1) {
+		unsigned char *data = skb->data;
+		uint32 length = skb->len;
+		PKTPUSH(dhd->pub.osh, skb, 1);
+		memmove(skb->data, data, length);
+		PKTSETLEN(dhd->pub.osh, skb, length);
+	}
+
+	datalen  = PKTLEN(dhd->pub.osh, skb);
+
+	/* Make sure there's enough room for any header */
+
+	if (skb_headroom(skb) < dhd->pub.hdrlen + htsfdlystat_sz) {
+		struct sk_buff *skb2;
+
+		DHD_INFO(("%s: insufficient headroom\n",
+		          dhd_ifname(&dhd->pub, ifidx)));
+		dhd->pub.tx_realloc++;
+
+		skb2 = skb_realloc_headroom(skb, dhd->pub.hdrlen + htsfdlystat_sz);
+
+		dev_kfree_skb(skb);
+		if ((skb = skb2) == NULL) {
+			DHD_ERROR(("%s: skb_realloc_headroom failed\n",
+			           dhd_ifname(&dhd->pub, ifidx)));
+			ret = -ENOMEM;
+			goto done;
+		}
+	}
+
+	/* Convert to packet */
+	if (!(pktbuf = PKTFRMNATIVE(dhd->pub.osh, skb))) {
+		DHD_ERROR(("%s: PKTFRMNATIVE failed\n",
+		           dhd_ifname(&dhd->pub, ifidx)));
+		dev_kfree_skb_any(skb);
+		ret = -ENOMEM;
+		goto done;
+	}
+#ifdef WLMEDIA_HTSF
+	if (htsfdlystat_sz && PKTLEN(dhd->pub.osh, pktbuf) >= ETHER_ADDR_LEN) {
+		uint8 *pktdata = (uint8 *)PKTDATA(dhd->pub.osh, pktbuf);
+		struct ether_header *eh = (struct ether_header *)pktdata;
+
+		if (!ETHER_ISMULTI(eh->ether_dhost) &&
+			(ntoh16(eh->ether_type) == ETHER_TYPE_IP)) {
+			eh->ether_type = hton16(ETHER_TYPE_BRCM_PKTDLYSTATS);
+		}
+	}
+#endif
+#ifdef DHD_WMF
+	eh = (struct ether_header *)PKTDATA(dhd->pub.osh, pktbuf);
+	iph = (uint8 *)eh + ETHER_HDR_LEN;
+
+	/* WMF processing for multicast packets
+	 * Only IPv4 packets are handled
+	 */
+	if (ifp->wmf.wmf_enable && (ntoh16(eh->ether_type) == ETHER_TYPE_IP) &&
+		(IP_VER(iph) == IP_VER_4) && (ETHER_ISMULTI(eh->ether_dhost) ||
+		((IPV4_PROT(iph) == IP_PROT_IGMP) && dhd->pub.wmf_ucast_igmp))) {
+#if defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP)
+		void *sdu_clone;
+		bool ucast_convert = FALSE;
+#ifdef DHD_UCAST_UPNP
+		uint32 dest_ip;
+
+		dest_ip = ntoh32(*((uint32 *)(iph + IPV4_DEST_IP_OFFSET)));
+		ucast_convert = dhd->pub.wmf_ucast_upnp && MCAST_ADDR_UPNP_SSDP(dest_ip);
+#endif /* DHD_UCAST_UPNP */
+#ifdef DHD_IGMP_UCQUERY
+		ucast_convert |= dhd->pub.wmf_ucast_igmp_query &&
+			(IPV4_PROT(iph) == IP_PROT_IGMP) &&
+			(*(iph + IPV4_HLEN(iph)) == IGMPV2_HOST_MEMBERSHIP_QUERY);
+#endif /* DHD_IGMP_UCQUERY */
+		if (ucast_convert) {
+			dhd_sta_t *sta;
+			unsigned long flags;
+
+			DHD_IF_STA_LIST_LOCK(ifp, flags);
+
+			/* Convert upnp/igmp query to unicast for each assoc STA */
+			list_for_each_entry(sta, &ifp->sta_list, list) {
+				if ((sdu_clone = PKTDUP(dhd->pub.osh, pktbuf)) == NULL) {
+					DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+					DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+					DHD_OS_WAKE_UNLOCK(&dhd->pub);
+					return (WMF_NOP);
+				}
+				dhd_wmf_forward(ifp->wmf.wmfh, sdu_clone, 0, sta, 1);
+			}
+
+			DHD_IF_STA_LIST_UNLOCK(ifp, flags);
+			DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+			DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+			PKTFREE(dhd->pub.osh, pktbuf, TRUE);
+			return NETDEV_TX_OK;
+		} else
+#endif /* defined(DHD_IGMP_UCQUERY) || defined(DHD_UCAST_UPNP) */
+		{
+			/* There will be no STA info if the packet is coming from LAN host
+			 * Pass as NULL
+			 */
+			ret = dhd_wmf_packets_handle(&dhd->pub, pktbuf, NULL, ifidx, 0);
+			switch (ret) {
+			case WMF_TAKEN:
+			case WMF_DROP:
+				/* Either taken by WMF or we should drop it.
+				 * Exiting send path
+				 */
+				DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+				DHD_OS_WAKE_UNLOCK(&dhd->pub);
+				return NETDEV_TX_OK;
+			default:
+				/* Continue the transmit path */
+				break;
+			}
+		}
+	}
+#endif /* DHD_WMF */
+
+#ifdef DHDTCPACK_SUPPRESS
+	if (dhd->pub.tcpack_sup_mode == TCPACK_SUP_HOLD) {
+		/* If this packet has been hold or got freed, just return */
+		if (dhd_tcpack_hold(&dhd->pub, pktbuf, ifidx))
+			return 0;
+	} else {
+		/* If this packet has replaced another packet and got freed, just return */
+		if (dhd_tcpack_suppress(&dhd->pub, pktbuf))
+			return 0;
+	}
+#endif /* DHDTCPACK_SUPPRESS */
+
+	ret = dhd_sendpkt(&dhd->pub, ifidx, pktbuf);
+
+done:
+	if (ret) {
+		ifp->stats.tx_dropped++;
+		dhd->pub.tx_dropped++;
+	}
+	else {
+
+#ifdef PROP_TXSTATUS
+		/* tx_packets counter can counted only when wlfc is disabled */
+		if (!dhd_wlfc_is_supported(&dhd->pub))
+#endif
+		{
+			dhd->pub.tx_packets++;
+			ifp->stats.tx_packets++;
+			ifp->stats.tx_bytes += datalen;
+		}
+	}
+
+	DHD_PERIM_UNLOCK_TRY(DHD_FWDER_UNIT(dhd), TRUE);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+	/* Return ok: we always eat the packet */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 20))
+	return 0;
+#else
+	return NETDEV_TX_OK;
+#endif
+}
+
+
+void
+dhd_txflowcontrol(dhd_pub_t *dhdp, int ifidx, bool state)
+{
+	struct net_device *net;
+	dhd_info_t *dhd = dhdp->info;
+	int i;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(dhd);
+
+	if (ifidx == ALL_INTERFACES) {
+		/* Flow control on all active interfaces */
+		dhdp->txoff = state;
+		for (i = 0; i < DHD_MAX_IFS; i++) {
+			if (dhd->iflist[i]) {
+				net = dhd->iflist[i]->net;
+				if (state == ON)
+					netif_stop_queue(net);
+				else
+					netif_wake_queue(net);
+			}
+		}
+	}
+	else {
+		if (dhd->iflist[ifidx]) {
+			net = dhd->iflist[ifidx]->net;
+			if (state == ON)
+				netif_stop_queue(net);
+			else
+				netif_wake_queue(net);
+		}
+	}
+}
+
+
+#ifdef DHD_WMF
+bool
+dhd_is_rxthread_enabled(dhd_pub_t *dhdp)
+{
+	dhd_info_t *dhd = dhdp->info;
+
+	return dhd->rxthread_enabled;
+}
+#endif /* DHD_WMF */
+
+void
+dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *pktbuf, int numpkt, uint8 chan)
+{
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+	struct sk_buff *skb;
+	uchar *eth;
+	uint len;
+	void *data, *pnext = NULL;
+	int i;
+	dhd_if_t *ifp;
+	wl_event_msg_t event;
+	int tout_rx = 0;
+	int tout_ctrl = 0;
+	void *skbhead = NULL;
+	void *skbprev = NULL;
+#if defined(DHD_RX_DUMP) || defined(DHD_8021X_DUMP)
+	char *dump_data;
+	uint16 protocol;
+#endif /* DHD_RX_DUMP || DHD_8021X_DUMP */
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	for (i = 0; pktbuf && i < numpkt; i++, pktbuf = pnext) {
+		struct ether_header *eh;
+#ifdef WLBTAMP
+		struct dot11_llc_snap_header *lsh;
+#endif
+
+		pnext = PKTNEXT(dhdp->osh, pktbuf);
+		PKTSETNEXT(dhdp->osh, pktbuf, NULL);
+
+		ifp = dhd->iflist[ifidx];
+		if (ifp == NULL) {
+			DHD_ERROR(("%s: ifp is NULL. drop packet\n",
+				__FUNCTION__));
+			PKTCFREE(dhdp->osh, pktbuf, FALSE);
+			continue;
+		}
+
+		eh = (struct ether_header *)PKTDATA(dhdp->osh, pktbuf);
+
+		/* Dropping only data packets before registering net device to avoid kernel panic */
+#ifndef PROP_TXSTATUS_VSDB
+		if ((!ifp->net || ifp->net->reg_state != NETREG_REGISTERED) &&
+			(ntoh16(eh->ether_type) != ETHER_TYPE_BRCM))
+#else
+		if ((!ifp->net || ifp->net->reg_state != NETREG_REGISTERED || !dhd->pub.up) &&
+			(ntoh16(eh->ether_type) != ETHER_TYPE_BRCM))
+#endif /* PROP_TXSTATUS_VSDB */
+		{
+			DHD_ERROR(("%s: net device is NOT registered yet. drop packet\n",
+			__FUNCTION__));
+			PKTCFREE(dhdp->osh, pktbuf, FALSE);
+			continue;
+		}
+
+#ifdef WLBTAMP
+		lsh = (struct dot11_llc_snap_header *)&eh[1];
+
+		if ((ntoh16(eh->ether_type) < ETHER_TYPE_MIN) &&
+		    (PKTLEN(dhdp->osh, pktbuf) >= RFC1042_HDR_LEN) &&
+		    bcmp(lsh, BT_SIG_SNAP_MPROT, DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+		    lsh->type == HTON16(BTA_PROT_L2CAP)) {
+			amp_hci_ACL_data_t *ACL_data = (amp_hci_ACL_data_t *)
+			        ((uint8 *)eh + RFC1042_HDR_LEN);
+			ACL_data = NULL;
+		}
+#endif /* WLBTAMP */
+
+#ifdef PROP_TXSTATUS
+		if (dhd_wlfc_is_header_only_pkt(dhdp, pktbuf)) {
+			/* WLFC may send header only packet when
+			there is an urgent message but no packet to
+			piggy-back on
+			*/
+			PKTCFREE(dhdp->osh, pktbuf, FALSE);
+			continue;
+		}
+#endif
+#ifdef DHD_L2_FILTER
+		/* If block_ping is enabled drop the ping packet */
+		if (dhdp->block_ping) {
+			if (dhd_l2_filter_block_ping(dhdp, pktbuf, ifidx) == BCME_OK) {
+				PKTFREE(dhdp->osh, pktbuf, FALSE);
+				continue;
+			}
+		}
+#endif
+#ifdef DHD_WMF
+		/* WMF processing for multicast packets */
+		if (ifp->wmf.wmf_enable && (ETHER_ISMULTI(eh->ether_dhost))) {
+			dhd_sta_t *sta;
+			int ret;
+
+			sta = dhd_find_sta(dhdp, ifidx, (void *)eh->ether_shost);
+			ret = dhd_wmf_packets_handle(dhdp, pktbuf, sta, ifidx, 1);
+			switch (ret) {
+				case WMF_TAKEN:
+					/* The packet is taken by WMF. Continue to next iteration */
+					continue;
+				case WMF_DROP:
+					/* Packet DROP decision by WMF. Toss it */
+					DHD_ERROR(("%s: WMF decides to drop packet\n",
+						__FUNCTION__));
+					PKTCFREE(dhdp->osh, pktbuf, FALSE);
+					continue;
+				default:
+					/* Continue the transmit path */
+					break;
+			}
+		}
+#endif /* DHD_WMF */
+#ifdef DHDTCPACK_SUPPRESS
+		dhd_tcpdata_info_get(dhdp, pktbuf);
+#endif
+		skb = PKTTONATIVE(dhdp->osh, pktbuf);
+
+		ifp = dhd->iflist[ifidx];
+		if (ifp == NULL)
+			ifp = dhd->iflist[0];
+
+		ASSERT(ifp);
+		skb->dev = ifp->net;
+
+#ifdef PCIE_FULL_DONGLE
+		if ((DHD_IF_ROLE_AP(dhdp, ifidx) || DHD_IF_ROLE_P2PGO(dhdp, ifidx)) &&
+			(!ifp->ap_isolate)) {
+			eh = (struct ether_header *)PKTDATA(dhdp->osh, pktbuf);
+			if (ETHER_ISUCAST(eh->ether_dhost)) {
+				if (dhd_find_sta(dhdp, ifidx, (void *)eh->ether_dhost)) {
+					dhd_sendpkt(dhdp, ifidx, pktbuf);
+					continue;
+				}
+			} else {
+				void *npktbuf = PKTDUP(dhdp->osh, pktbuf);
+				dhd_sendpkt(dhdp, ifidx, npktbuf);
+			}
+		}
+#endif /* PCIE_FULL_DONGLE */
+
+		/* Get the protocol, maintain skb around eth_type_trans()
+		 * The main reason for this hack is for the limitation of
+		 * Linux 2.4 where 'eth_type_trans' uses the 'net->hard_header_len'
+		 * to perform skb_pull inside vs ETH_HLEN. Since to avoid
+		 * coping of the packet coming from the network stack to add
+		 * BDC, Hardware header etc, during network interface registration
+		 * we set the 'net->hard_header_len' to ETH_HLEN + extra space required
+		 * for BDC, Hardware header etc. and not just the ETH_HLEN
+		 */
+		eth = skb->data;
+		len = skb->len;
+
+#if defined(DHD_RX_DUMP) || defined(DHD_8021X_DUMP)
+		dump_data = skb->data;
+		protocol = (dump_data[12] << 8) | dump_data[13];
+
+		if (protocol == ETHER_TYPE_802_1X) {
+			DHD_ERROR(("ETHER_TYPE_802_1X [RX]: "
+				"ver %d, type %d, replay %d\n",
+				dump_data[14], dump_data[15],
+				dump_data[30]));
+		}
+#endif /* DHD_RX_DUMP || DHD_8021X_DUMP */
+#if defined(DHD_RX_DUMP)
+		DHD_ERROR(("RX DUMP - %s\n", _get_packet_type_str(protocol)));
+		if (protocol != ETHER_TYPE_BRCM) {
+			if (dump_data[0] == 0xFF) {
+				DHD_ERROR(("%s: BROADCAST\n", __FUNCTION__));
+
+				if ((dump_data[12] == 8) &&
+					(dump_data[13] == 6)) {
+					DHD_ERROR(("%s: ARP %d\n",
+						__FUNCTION__, dump_data[0x15]));
+				}
+			} else if (dump_data[0] & 1) {
+				DHD_ERROR(("%s: MULTICAST: " MACDBG "\n",
+					__FUNCTION__, MAC2STRDBG(dump_data)));
+			}
+#ifdef DHD_RX_FULL_DUMP
+			{
+				int k;
+				for (k = 0; k < skb->len; k++) {
+					DHD_ERROR(("%02X ", dump_data[k]));
+					if ((k & 15) == 15)
+						DHD_ERROR(("\n"));
+				}
+				DHD_ERROR(("\n"));
+			}
+#endif /* DHD_RX_FULL_DUMP */
+		}
+#endif /* DHD_RX_DUMP */
+
+		skb->protocol = eth_type_trans(skb, skb->dev);
+
+		if (skb->pkt_type == PACKET_MULTICAST) {
+			dhd->pub.rx_multicast++;
+			ifp->stats.multicast++;
+		}
+
+		skb->data = eth;
+		skb->len = len;
+
+#ifdef WLMEDIA_HTSF
+		dhd_htsf_addrxts(dhdp, pktbuf);
+#endif
+		/* Strip header, count, deliver upward */
+		skb_pull(skb, ETH_HLEN);
+
+		/* Process special event packets and then discard them */
+		memset(&event, 0, sizeof(event));
+		if (ntoh16(skb->protocol) == ETHER_TYPE_BRCM) {
+			dhd_wl_host_event(dhd, &ifidx,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+			skb_mac_header(skb),
+#else
+			skb->mac.raw,
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22) */
+			&event,
+			&data);
+
+			wl_event_to_host_order(&event);
+			if (!tout_ctrl)
+				tout_ctrl = DHD_PACKET_TIMEOUT_MS;
+#ifdef WLBTAMP
+			if (event.event_type == WLC_E_BTA_HCI_EVENT) {
+				dhd_bta_doevt(dhdp, data, event.datalen);
+			}
+#endif /* WLBTAMP */
+
+#if defined(PNO_SUPPORT)
+			if (event.event_type == WLC_E_PFN_NET_FOUND) {
+				/* enforce custom wake lock to garantee that Kernel not suspended */
+				tout_ctrl = CUSTOM_PNO_EVENT_LOCK_xTIME * DHD_PACKET_TIMEOUT_MS;
+			}
+#endif /* PNO_SUPPORT */
+
+#ifdef DHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT
+			PKTFREE(dhdp->osh, pktbuf, FALSE);
+			continue;
+#endif /* DHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT */
+		} else {
+			tout_rx = DHD_PACKET_TIMEOUT_MS;
+
+#ifdef PROP_TXSTATUS
+			dhd_wlfc_save_rxpath_ac_time(dhdp, (uint8)PKTPRIO(skb));
+#endif /* PROP_TXSTATUS */
+		}
+
+		ASSERT(ifidx < DHD_MAX_IFS && dhd->iflist[ifidx]);
+		ifp = dhd->iflist[ifidx];
+
+		if (ntoh16(skb->protocol) != ETHER_TYPE_BRCM) {
+			dhdp->dstats.rx_bytes += skb->len;
+			dhdp->rx_packets++; /* Local count */
+			ifp->stats.rx_bytes += skb->len;
+			ifp->stats.rx_packets++;
+		}
+#if defined(DHD_TCP_WINSIZE_ADJUST)
+		if (dhd_use_tcp_window_size_adjust) {
+			if (ifidx == 0 && ntoh16(skb->protocol) == ETHER_TYPE_IP) {
+				dhd_adjust_tcp_winsize(dhdp->op_mode, skb);
+			}
+		}
+#endif /* DHD_TCP_WINSIZE_ADJUST */
+
+		if (in_interrupt()) {
+			netif_rx(skb);
+		} else {
+			if (dhd->rxthread_enabled) {
+				if (!skbhead)
+					skbhead = skb;
+				else
+					PKTSETNEXT(dhdp->osh, skbprev, skb);
+				skbprev = skb;
+			} else {
+
+				/* If the receive is not processed inside an ISR,
+				 * the softirqd must be woken explicitly to service
+				 * the NET_RX_SOFTIRQ.	In 2.6 kernels, this is handled
+				 * by netif_rx_ni(), but in earlier kernels, we need
+				 * to do it manually.
+				 */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+				netif_rx_ni(skb);
+#else
+				ulong flags;
+				netif_rx(skb);
+				local_irq_save(flags);
+				RAISE_RX_SOFTIRQ();
+				local_irq_restore(flags);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) */
+			}
+		}
+	}
+
+	if (dhd->rxthread_enabled && skbhead)
+		dhd_sched_rxf(dhdp, skbhead);
+
+	DHD_OS_WAKE_LOCK_RX_TIMEOUT_ENABLE(dhdp, tout_rx);
+	DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(dhdp, tout_ctrl);
+}
+
+void
+dhd_event(struct dhd_info *dhd, char *evpkt, int evlen, int ifidx)
+{
+	/* Linux version has nothing to do */
+	return;
+}
+
+void
+dhd_txcomplete(dhd_pub_t *dhdp, void *txp, bool success)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+	struct ether_header *eh;
+	uint16 type;
+#ifdef WLBTAMP
+	uint len;
+#endif
+
+	dhd_prot_hdrpull(dhdp, NULL, txp, NULL, NULL);
+
+	eh = (struct ether_header *)PKTDATA(dhdp->osh, txp);
+	type  = ntoh16(eh->ether_type);
+
+	if (type == ETHER_TYPE_802_1X)
+		atomic_dec(&dhd->pend_8021x_cnt);
+
+#ifdef WLBTAMP
+	/* Crack open the packet and check to see if it is BT HCI ACL data packet.
+	 * If yes generate packet completion event.
+	 */
+	len = PKTLEN(dhdp->osh, txp);
+
+	/* Generate ACL data tx completion event locally to avoid SDIO bus transaction */
+	if ((type < ETHER_TYPE_MIN) && (len >= RFC1042_HDR_LEN)) {
+		struct dot11_llc_snap_header *lsh = (struct dot11_llc_snap_header *)&eh[1];
+
+		if (bcmp(lsh, BT_SIG_SNAP_MPROT, DOT11_LLC_SNAP_HDR_LEN - 2) == 0 &&
+		    ntoh16(lsh->type) == BTA_PROT_L2CAP) {
+
+			dhd_bta_tx_hcidata_complete(dhdp, txp, success);
+		}
+	}
+#endif /* WLBTAMP */
+#ifdef PROP_TXSTATUS
+	if (dhdp->wlfc_state && (dhdp->proptxstatus_mode != WLFC_FCMODE_NONE)) {
+		dhd_if_t *ifp = dhd->iflist[DHD_PKTTAG_IF(PKTTAG(txp))];
+		uint datalen  = PKTLEN(dhd->pub.osh, txp);
+
+		if (success) {
+			dhd->pub.tx_packets++;
+			ifp->stats.tx_packets++;
+			ifp->stats.tx_bytes += datalen;
+		} else {
+			ifp->stats.tx_dropped++;
+		}
+	}
+#endif
+}
+
+static struct net_device_stats *
+dhd_get_stats(struct net_device *net)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(net);
+	dhd_if_t *ifp;
+	int ifidx;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ifidx = dhd_net2idx(dhd, net);
+	if (ifidx == DHD_BAD_IF) {
+		DHD_ERROR(("%s: BAD_IF\n", __FUNCTION__));
+
+		memset(&net->stats, 0, sizeof(net->stats));
+		return &net->stats;
+	}
+
+	ifp = dhd->iflist[ifidx];
+	ASSERT(dhd && ifp);
+
+	if (dhd->pub.up) {
+		/* Use the protocol to get dongle stats */
+		dhd_prot_dstats(&dhd->pub);
+	}
+	return &ifp->stats;
+}
+
+static int
+dhd_watchdog_thread(void *data)
+{
+	tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+	dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+	/* This thread doesn't need any user-level access,
+	 * so get rid of all our resources
+	 */
+	if (dhd_watchdog_prio > 0) {
+		struct sched_param param;
+		param.sched_priority = (dhd_watchdog_prio < MAX_RT_PRIO)?
+			dhd_watchdog_prio:(MAX_RT_PRIO-1);
+		setScheduler(current, SCHED_FIFO, &param);
+	}
+
+	while (1)
+		if (down_interruptible (&tsk->sema) == 0) {
+			unsigned long flags;
+			unsigned long jiffies_at_start = jiffies;
+			unsigned long time_lapse;
+
+			SMP_RD_BARRIER_DEPENDS();
+			if (tsk->terminated) {
+				break;
+			}
+
+			if (dhd->pub.dongle_reset == FALSE) {
+				DHD_TIMER(("%s:\n", __FUNCTION__));
+
+				/* Call the bus module watchdog */
+				dhd_bus_watchdog(&dhd->pub);
+
+
+				DHD_GENERAL_LOCK(&dhd->pub, flags);
+				/* Count the tick for reference */
+				dhd->pub.tickcnt++;
+				time_lapse = jiffies - jiffies_at_start;
+
+				/* Reschedule the watchdog */
+				if (dhd->wd_timer_valid)
+					mod_timer(&dhd->timer,
+					    jiffies +
+					    msecs_to_jiffies(dhd_watchdog_ms) -
+					    min(msecs_to_jiffies(dhd_watchdog_ms), time_lapse));
+					DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+				}
+		} else {
+			break;
+	}
+
+	complete_and_exit(&tsk->completed, 0);
+}
+
+static void dhd_watchdog(ulong data)
+{
+	dhd_info_t *dhd = (dhd_info_t *)data;
+	unsigned long flags;
+
+	if (dhd->pub.dongle_reset) {
+		return;
+	}
+
+	if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+		up(&dhd->thr_wdt_ctl.sema);
+		return;
+	}
+
+	/* Call the bus module watchdog */
+	dhd_bus_watchdog(&dhd->pub);
+
+	DHD_GENERAL_LOCK(&dhd->pub, flags);
+	/* Count the tick for reference */
+	dhd->pub.tickcnt++;
+
+	/* Reschedule the watchdog */
+	if (dhd->wd_timer_valid)
+		mod_timer(&dhd->timer, jiffies + msecs_to_jiffies(dhd_watchdog_ms));
+	DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+
+}
+
+#ifdef ENABLE_ADAPTIVE_SCHED
+static void
+dhd_sched_policy(int prio)
+{
+	struct sched_param param;
+	if (cpufreq_quick_get(0) <= CUSTOM_CPUFREQ_THRESH) {
+		param.sched_priority = 0;
+		setScheduler(current, SCHED_NORMAL, &param);
+	} else {
+		if (get_scheduler_policy(current) != SCHED_FIFO) {
+			param.sched_priority = (prio < MAX_RT_PRIO)? prio : (MAX_RT_PRIO-1);
+			setScheduler(current, SCHED_FIFO, &param);
+		}
+	}
+}
+#endif /* ENABLE_ADAPTIVE_SCHED */
+#ifdef DEBUG_CPU_FREQ
+static int dhd_cpufreq_notifier(struct notifier_block *nb, unsigned long val, void *data)
+{
+	dhd_info_t *dhd = container_of(nb, struct dhd_info, freq_trans);
+	struct cpufreq_freqs *freq = data;
+	if (dhd) {
+		if (!dhd->new_freq)
+			goto exit;
+		if (val == CPUFREQ_POSTCHANGE) {
+			DHD_ERROR(("cpu freq is changed to %u kHZ on CPU %d\n",
+				freq->new, freq->cpu));
+			*per_cpu_ptr(dhd->new_freq, freq->cpu) = freq->new;
+		}
+	}
+exit:
+	return 0;
+}
+#endif /* DEBUG_CPU_FREQ */
+static int
+dhd_dpc_thread(void *data)
+{
+	tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+	dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+
+	/* This thread doesn't need any user-level access,
+	 * so get rid of all our resources
+	 */
+	if (dhd_dpc_prio > 0)
+	{
+		struct sched_param param;
+		param.sched_priority = (dhd_dpc_prio < MAX_RT_PRIO)?dhd_dpc_prio:(MAX_RT_PRIO-1);
+		setScheduler(current, SCHED_FIFO, &param);
+	}
+
+#ifdef CUSTOM_DPC_CPUCORE
+	set_cpus_allowed_ptr(current, cpumask_of(CUSTOM_DPC_CPUCORE));
+#else
+	if (dhd->pub.conf->dpc_cpucore >= 0) {
+		printf("%s: set dpc_cpucore %d from config.txt\n", __FUNCTION__, dhd->pub.conf->dpc_cpucore);
+		set_cpus_allowed_ptr(current, cpumask_of(dhd->pub.conf->dpc_cpucore));
+	}
+#endif
+#ifdef CUSTOM_SET_CPUCORE
+	dhd->pub.current_dpc = current;
+#endif /* CUSTOM_SET_CPUCORE */
+	/* Run until signal received */
+	while (1) {
+		if (!binary_sema_down(tsk)) {
+#ifdef ENABLE_ADAPTIVE_SCHED
+			dhd_sched_policy(dhd_dpc_prio);
+#endif /* ENABLE_ADAPTIVE_SCHED */
+			SMP_RD_BARRIER_DEPENDS();
+			if (tsk->terminated) {
+				break;
+			}
+
+			/* Call bus dpc unless it indicated down (then clean stop) */
+			if (dhd->pub.busstate != DHD_BUS_DOWN) {
+				dhd_os_wd_timer_extend(&dhd->pub, TRUE);
+				while (dhd_bus_dpc(dhd->pub.bus)) {
+					/* process all data */
+				}
+				dhd_os_wd_timer_extend(&dhd->pub, FALSE);
+				DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+			} else {
+				if (dhd->pub.up)
+					dhd_bus_stop(dhd->pub.bus, TRUE);
+				DHD_OS_WAKE_UNLOCK(&dhd->pub);
+			}
+		}
+		else
+			break;
+	}
+	complete_and_exit(&tsk->completed, 0);
+}
+
+static int
+dhd_rxf_thread(void *data)
+{
+	tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+	dhd_info_t *dhd = (dhd_info_t *)tsk->parent;
+#if defined(WAIT_DEQUEUE)
+#define RXF_WATCHDOG_TIME 250 /* BARK_TIME(1000) /  */
+	ulong watchdogTime = OSL_SYSUPTIME(); /* msec */
+#endif
+	dhd_pub_t *pub = &dhd->pub;
+
+	/* This thread doesn't need any user-level access,
+	 * so get rid of all our resources
+	 */
+	if (dhd_rxf_prio > 0)
+	{
+		struct sched_param param;
+		param.sched_priority = (dhd_rxf_prio < MAX_RT_PRIO)?dhd_rxf_prio:(MAX_RT_PRIO-1);
+		setScheduler(current, SCHED_FIFO, &param);
+	}
+
+	DAEMONIZE("dhd_rxf");
+	/* DHD_OS_WAKE_LOCK is called in dhd_sched_dpc[dhd_linux.c] down below  */
+
+	/*  signal: thread has started */
+	complete(&tsk->completed);
+#ifdef CUSTOM_SET_CPUCORE
+	dhd->pub.current_rxf = current;
+#endif /* CUSTOM_SET_CPUCORE */
+	/* Run until signal received */
+	while (1) {
+		if (down_interruptible(&tsk->sema) == 0) {
+			void *skb;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+			ulong flags;
+#endif
+#ifdef ENABLE_ADAPTIVE_SCHED
+			dhd_sched_policy(dhd_rxf_prio);
+#endif /* ENABLE_ADAPTIVE_SCHED */
+
+			SMP_RD_BARRIER_DEPENDS();
+
+			if (tsk->terminated) {
+				break;
+			}
+			skb = dhd_rxf_dequeue(pub);
+
+			if (skb == NULL) {
+				continue;
+			}
+			while (skb) {
+				void *skbnext = PKTNEXT(pub->osh, skb);
+				PKTSETNEXT(pub->osh, skb, NULL);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+				netif_rx_ni(skb);
+#else
+				netif_rx(skb);
+				local_irq_save(flags);
+				RAISE_RX_SOFTIRQ();
+				local_irq_restore(flags);
+
+#endif
+				skb = skbnext;
+			}
+#if defined(WAIT_DEQUEUE)
+			if (OSL_SYSUPTIME() - watchdogTime > RXF_WATCHDOG_TIME) {
+				OSL_SLEEP(1);
+				watchdogTime = OSL_SYSUPTIME();
+			}
+#endif
+
+			DHD_OS_WAKE_UNLOCK(pub);
+		}
+		else
+			break;
+	}
+	complete_and_exit(&tsk->completed, 0);
+}
+
+#ifdef BCMPCIE
+void dhd_dpc_kill(dhd_pub_t *dhdp)
+{
+	dhd_info_t *dhd;
+
+	if (!dhdp)
+		return;
+
+	dhd = dhdp->info;
+
+	if (!dhd)
+		return;
+
+	tasklet_kill(&dhd->tasklet);
+	DHD_ERROR(("%s: tasklet disabled\n", __FUNCTION__));
+}
+#endif /* BCMPCIE */
+
+static void
+dhd_dpc(ulong data)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)data;
+
+	/* this (tasklet) can be scheduled in dhd_sched_dpc[dhd_linux.c]
+	 * down below , wake lock is set,
+	 * the tasklet is initialized in dhd_attach()
+	 */
+	/* Call bus dpc unless it indicated down (then clean stop) */
+	if (dhd->pub.busstate != DHD_BUS_DOWN) {
+		if (dhd_bus_dpc(dhd->pub.bus))
+			tasklet_schedule(&dhd->tasklet);
+		else
+			DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	} else {
+		dhd_bus_stop(dhd->pub.bus, TRUE);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	}
+}
+
+void
+dhd_sched_dpc(dhd_pub_t *dhdp)
+{
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+
+	DHD_OS_WAKE_LOCK(dhdp);
+	if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+		/* If the semaphore does not get up,
+		* wake unlock should be done here
+		*/
+		if (!binary_sema_up(&dhd->thr_dpc_ctl))
+			DHD_OS_WAKE_UNLOCK(dhdp);
+		return;
+	} else {
+		tasklet_schedule(&dhd->tasklet);
+	}
+}
+
+static void
+dhd_sched_rxf(dhd_pub_t *dhdp, void *skb)
+{
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+#ifdef RXF_DEQUEUE_ON_BUSY
+	int ret = BCME_OK;
+	int retry = 2;
+#endif /* RXF_DEQUEUE_ON_BUSY */
+
+	DHD_OS_WAKE_LOCK(dhdp);
+
+	DHD_TRACE(("dhd_sched_rxf: Enter\n"));
+#ifdef RXF_DEQUEUE_ON_BUSY
+	do {
+		ret = dhd_rxf_enqueue(dhdp, skb);
+		if (ret == BCME_OK || ret == BCME_ERROR)
+			break;
+		else
+			OSL_SLEEP(50); /* waiting for dequeueing */
+	} while (retry-- > 0);
+
+	if (retry <= 0 && ret == BCME_BUSY) {
+		void *skbp = skb;
+
+		while (skbp) {
+			void *skbnext = PKTNEXT(dhdp->osh, skbp);
+			PKTSETNEXT(dhdp->osh, skbp, NULL);
+			netif_rx_ni(skbp);
+			skbp = skbnext;
+		}
+		DHD_ERROR(("send skb to kernel backlog without rxf_thread\n"));
+	}
+	else {
+		if (dhd->thr_rxf_ctl.thr_pid >= 0) {
+			up(&dhd->thr_rxf_ctl.sema);
+		}
+	}
+#else /* RXF_DEQUEUE_ON_BUSY */
+	do {
+		if (dhd_rxf_enqueue(dhdp, skb) == BCME_OK)
+			break;
+	} while (1);
+	if (dhd->thr_rxf_ctl.thr_pid >= 0) {
+		up(&dhd->thr_rxf_ctl.sema);
+	}
+	return;
+#endif /* RXF_DEQUEUE_ON_BUSY */
+}
+
+#ifdef TOE
+/* Retrieve current toe component enables, which are kept as a bitmap in toe_ol iovar */
+static int
+dhd_toe_get(dhd_info_t *dhd, int ifidx, uint32 *toe_ol)
+{
+	wl_ioctl_t ioc;
+	char buf[32];
+	int ret;
+
+	memset(&ioc, 0, sizeof(ioc));
+
+	ioc.cmd = WLC_GET_VAR;
+	ioc.buf = buf;
+	ioc.len = (uint)sizeof(buf);
+	ioc.set = FALSE;
+
+	strncpy(buf, "toe_ol", sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
+	if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+		/* Check for older dongle image that doesn't support toe_ol */
+		if (ret == -EIO) {
+			DHD_ERROR(("%s: toe not supported by device\n",
+				dhd_ifname(&dhd->pub, ifidx)));
+			return -EOPNOTSUPP;
+		}
+
+		DHD_INFO(("%s: could not get toe_ol: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+		return ret;
+	}
+
+	memcpy(toe_ol, buf, sizeof(uint32));
+	return 0;
+}
+
+/* Set current toe component enables in toe_ol iovar, and set toe global enable iovar */
+static int
+dhd_toe_set(dhd_info_t *dhd, int ifidx, uint32 toe_ol)
+{
+	wl_ioctl_t ioc;
+	char buf[32];
+	int toe, ret;
+
+	memset(&ioc, 0, sizeof(ioc));
+
+	ioc.cmd = WLC_SET_VAR;
+	ioc.buf = buf;
+	ioc.len = (uint)sizeof(buf);
+	ioc.set = TRUE;
+
+	/* Set toe_ol as requested */
+
+	strncpy(buf, "toe_ol", sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
+	memcpy(&buf[sizeof("toe_ol")], &toe_ol, sizeof(uint32));
+
+	if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+		DHD_ERROR(("%s: could not set toe_ol: ret=%d\n",
+			dhd_ifname(&dhd->pub, ifidx), ret));
+		return ret;
+	}
+
+	/* Enable toe globally only if any components are enabled. */
+
+	toe = (toe_ol != 0);
+
+	strcpy(buf, "toe");
+	memcpy(&buf[sizeof("toe")], &toe, sizeof(uint32));
+
+	if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+		DHD_ERROR(("%s: could not set toe: ret=%d\n", dhd_ifname(&dhd->pub, ifidx), ret));
+		return ret;
+	}
+
+	return 0;
+}
+#endif /* TOE */
+
+#if defined(WL_CFG80211)
+void dhd_set_scb_probe(dhd_pub_t *dhd)
+{
+#define NUM_SCB_MAX_PROBE 3
+	int ret = 0;
+	wl_scb_probe_t scb_probe;
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+	memset(&scb_probe, 0, sizeof(wl_scb_probe_t));
+
+	if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE)
+		return;
+
+	bcm_mkiovar("scb_probe", NULL, 0, iovbuf, sizeof(iovbuf));
+
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0)
+		DHD_ERROR(("%s: GET max_scb_probe failed\n", __FUNCTION__));
+
+	memcpy(&scb_probe, iovbuf, sizeof(wl_scb_probe_t));
+
+	scb_probe.scb_max_probe = NUM_SCB_MAX_PROBE;
+
+	bcm_mkiovar("scb_probe", (char *)&scb_probe,
+		sizeof(wl_scb_probe_t), iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+		DHD_ERROR(("%s: max_scb_probe setting failed\n", __FUNCTION__));
+#undef NUM_SCB_MAX_PROBE
+	return;
+}
+#endif /* WL_CFG80211 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void
+dhd_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(net);
+
+	snprintf(info->driver, sizeof(info->driver), "wl");
+	snprintf(info->version, sizeof(info->version), "%lu", dhd->pub.drv_version);
+}
+
+struct ethtool_ops dhd_ethtool_ops = {
+	.get_drvinfo = dhd_ethtool_get_drvinfo
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2)
+static int
+dhd_ethtool(dhd_info_t *dhd, void *uaddr)
+{
+	struct ethtool_drvinfo info;
+	char drvname[sizeof(info.driver)];
+	uint32 cmd;
+#ifdef TOE
+	struct ethtool_value edata;
+	uint32 toe_cmpnt, csum_dir;
+	int ret;
+#endif
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* all ethtool calls start with a cmd word */
+	if (copy_from_user(&cmd, uaddr, sizeof (uint32)))
+		return -EFAULT;
+
+	switch (cmd) {
+	case ETHTOOL_GDRVINFO:
+		/* Copy out any request driver name */
+		if (copy_from_user(&info, uaddr, sizeof(info)))
+			return -EFAULT;
+		strncpy(drvname, info.driver, sizeof(info.driver));
+		drvname[sizeof(info.driver)-1] = '\0';
+
+		/* clear struct for return */
+		memset(&info, 0, sizeof(info));
+		info.cmd = cmd;
+
+		/* if dhd requested, identify ourselves */
+		if (strcmp(drvname, "?dhd") == 0) {
+			snprintf(info.driver, sizeof(info.driver), "dhd");
+			strncpy(info.version, EPI_VERSION_STR, sizeof(info.version) - 1);
+			info.version[sizeof(info.version) - 1] = '\0';
+		}
+
+		/* otherwise, require dongle to be up */
+		else if (!dhd->pub.up) {
+			DHD_ERROR(("%s: dongle is not up\n", __FUNCTION__));
+			return -ENODEV;
+		}
+
+		/* finally, report dongle driver type */
+		else if (dhd->pub.iswl)
+			snprintf(info.driver, sizeof(info.driver), "wl");
+		else
+			snprintf(info.driver, sizeof(info.driver), "xx");
+
+		snprintf(info.version, sizeof(info.version), "%lu", dhd->pub.drv_version);
+		if (copy_to_user(uaddr, &info, sizeof(info)))
+			return -EFAULT;
+		DHD_CTL(("%s: given %*s, returning %s\n", __FUNCTION__,
+		         (int)sizeof(drvname), drvname, info.driver));
+		break;
+
+#ifdef TOE
+	/* Get toe offload components from dongle */
+	case ETHTOOL_GRXCSUM:
+	case ETHTOOL_GTXCSUM:
+		if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+			return ret;
+
+		csum_dir = (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+		edata.cmd = cmd;
+		edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
+
+		if (copy_to_user(uaddr, &edata, sizeof(edata)))
+			return -EFAULT;
+		break;
+
+	/* Set toe offload components in dongle */
+	case ETHTOOL_SRXCSUM:
+	case ETHTOOL_STXCSUM:
+		if (copy_from_user(&edata, uaddr, sizeof(edata)))
+			return -EFAULT;
+
+		/* Read the current settings, update and write back */
+		if ((ret = dhd_toe_get(dhd, 0, &toe_cmpnt)) < 0)
+			return ret;
+
+		csum_dir = (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
+
+		if (edata.data != 0)
+			toe_cmpnt |= csum_dir;
+		else
+			toe_cmpnt &= ~csum_dir;
+
+		if ((ret = dhd_toe_set(dhd, 0, toe_cmpnt)) < 0)
+			return ret;
+
+		/* If setting TX checksum mode, tell Linux the new mode */
+		if (cmd == ETHTOOL_STXCSUM) {
+			if (edata.data)
+				dhd->iflist[0]->net->features |= NETIF_F_IP_CSUM;
+			else
+				dhd->iflist[0]->net->features &= ~NETIF_F_IP_CSUM;
+		}
+
+		break;
+#endif /* TOE */
+
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2) */
+
+static bool dhd_check_hang(struct net_device *net, dhd_pub_t *dhdp, int error)
+{
+	dhd_info_t *dhd;
+
+	if (!dhdp) {
+		DHD_ERROR(("%s: dhdp is NULL\n", __FUNCTION__));
+		return FALSE;
+	}
+
+	if (!dhdp->up)
+		return FALSE;
+
+	dhd = (dhd_info_t *)dhdp->info;
+#if !defined(BCMPCIE)
+	if (dhd->thr_dpc_ctl.thr_pid < 0) {
+		DHD_ERROR(("%s : skipped due to negative pid - unloading?\n", __FUNCTION__));
+		return FALSE;
+	}
+#endif
+
+#ifdef CONFIG_MACH_UNIVERSAL5433
+	/* old revision does not send hang message */
+	if ((check_rev() && (error == -ETIMEDOUT)) || (error == -EREMOTEIO) ||
+#else
+	if ((error == -ETIMEDOUT) || (error == -EREMOTEIO) ||
+#endif /* CONFIG_MACH_UNIVERSAL5433 */
+		((dhdp->busstate == DHD_BUS_DOWN) && (!dhdp->dongle_reset))) {
+		DHD_ERROR(("%s: Event HANG send up due to  re=%d te=%d e=%d s=%d\n", __FUNCTION__,
+			dhdp->rxcnt_timeout, dhdp->txcnt_timeout, error, dhdp->busstate));
+		net_os_send_hang_message(net);
+		return TRUE;
+	}
+	return FALSE;
+}
+
+int dhd_ioctl_process(dhd_pub_t *pub, int ifidx, dhd_ioctl_t *ioc, void *data_buf)
+{
+	int bcmerror = BCME_OK;
+	int buflen = 0;
+	struct net_device *net;
+
+	net = dhd_idx2net(pub, ifidx);
+	if (!net) {
+		bcmerror = BCME_BADARG;
+		goto done;
+	}
+
+	if (data_buf)
+		buflen = MIN(ioc->len, DHD_IOCTL_MAXLEN);
+
+	/* check for local dhd ioctl and handle it */
+	if (ioc->driver == DHD_IOCTL_MAGIC) {
+		bcmerror = dhd_ioctl((void *)pub, ioc, data_buf, buflen);
+		if (bcmerror)
+			pub->bcmerror = bcmerror;
+		goto done;
+	}
+
+	/* send to dongle (must be up, and wl). */
+	if (pub->busstate != DHD_BUS_DATA) {
+		bcmerror = BCME_DONGLE_DOWN;
+		goto done;
+	}
+
+	if (!pub->iswl) {
+		bcmerror = BCME_DONGLE_DOWN;
+		goto done;
+	}
+
+	/*
+	 * Flush the TX queue if required for proper message serialization:
+	 * Intercept WLC_SET_KEY IOCTL - serialize M4 send and set key IOCTL to
+	 * prevent M4 encryption and
+	 * intercept WLC_DISASSOC IOCTL - serialize WPS-DONE and WLC_DISASSOC IOCTL to
+	 * prevent disassoc frame being sent before WPS-DONE frame.
+	 */
+	if (ioc->cmd == WLC_SET_KEY ||
+	    (ioc->cmd == WLC_SET_VAR && data_buf != NULL &&
+	     strncmp("wsec_key", data_buf, 9) == 0) ||
+	    (ioc->cmd == WLC_SET_VAR && data_buf != NULL &&
+	     strncmp("bsscfg:wsec_key", data_buf, 15) == 0) ||
+	    ioc->cmd == WLC_DISASSOC)
+		dhd_wait_pend8021x(net);
+
+#ifdef WLMEDIA_HTSF
+	if (data_buf) {
+		/*  short cut wl ioctl calls here  */
+		if (strcmp("htsf", data_buf) == 0) {
+			dhd_ioctl_htsf_get(dhd, 0);
+			return BCME_OK;
+		}
+
+		if (strcmp("htsflate", data_buf) == 0) {
+			if (ioc->set) {
+				memset(ts, 0, sizeof(tstamp_t)*TSMAX);
+				memset(&maxdelayts, 0, sizeof(tstamp_t));
+				maxdelay = 0;
+				tspktcnt = 0;
+				maxdelaypktno = 0;
+				memset(&vi_d1.bin, 0, sizeof(uint32)*NUMBIN);
+				memset(&vi_d2.bin, 0, sizeof(uint32)*NUMBIN);
+				memset(&vi_d3.bin, 0, sizeof(uint32)*NUMBIN);
+				memset(&vi_d4.bin, 0, sizeof(uint32)*NUMBIN);
+			} else {
+				dhd_dump_latency();
+			}
+			return BCME_OK;
+		}
+		if (strcmp("htsfclear", data_buf) == 0) {
+			memset(&vi_d1.bin, 0, sizeof(uint32)*NUMBIN);
+			memset(&vi_d2.bin, 0, sizeof(uint32)*NUMBIN);
+			memset(&vi_d3.bin, 0, sizeof(uint32)*NUMBIN);
+			memset(&vi_d4.bin, 0, sizeof(uint32)*NUMBIN);
+			htsf_seqnum = 0;
+			return BCME_OK;
+		}
+		if (strcmp("htsfhis", data_buf) == 0) {
+			dhd_dump_htsfhisto(&vi_d1, "H to D");
+			dhd_dump_htsfhisto(&vi_d2, "D to D");
+			dhd_dump_htsfhisto(&vi_d3, "D to H");
+			dhd_dump_htsfhisto(&vi_d4, "H to H");
+			return BCME_OK;
+		}
+		if (strcmp("tsport", data_buf) == 0) {
+			if (ioc->set) {
+				memcpy(&tsport, data_buf + 7, 4);
+			} else {
+				DHD_ERROR(("current timestamp port: %d \n", tsport));
+			}
+			return BCME_OK;
+		}
+	}
+#endif /* WLMEDIA_HTSF */
+
+	if ((ioc->cmd == WLC_SET_VAR || ioc->cmd == WLC_GET_VAR) &&
+		data_buf != NULL && strncmp("rpc_", data_buf, 4) == 0) {
+#ifdef BCM_FD_AGGR
+		bcmerror = dhd_fdaggr_ioctl(pub, ifidx, (wl_ioctl_t *)ioc, data_buf, buflen);
+#else
+		bcmerror = BCME_UNSUPPORTED;
+#endif
+		goto done;
+	}
+	bcmerror = dhd_wl_ioctl(pub, ifidx, (wl_ioctl_t *)ioc, data_buf, buflen);
+
+done:
+	dhd_check_hang(net, pub, bcmerror);
+
+	return bcmerror;
+}
+
+static int
+dhd_ioctl_entry(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(net);
+	dhd_ioctl_t ioc;
+	int bcmerror = 0;
+	int ifidx;
+	int ret;
+	void *local_buf = NULL;
+	u16 buflen = 0;
+
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+
+	/* Interface up check for built-in type */
+	if (!dhd_download_fw_on_driverload && dhd->pub.up == 0) {
+		DHD_ERROR(("%s: Interface is down \n", __FUNCTION__));
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return BCME_NOTUP;
+	}
+
+	/* send to dongle only if we are not waiting for reload already */
+	if (dhd->pub.hang_was_sent) {
+		DHD_ERROR(("%s: HANG was sent up earlier\n", __FUNCTION__));
+		DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE(&dhd->pub, DHD_EVENT_TIMEOUT_MS);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return OSL_ERROR(BCME_DONGLE_DOWN);
+	}
+
+	ifidx = dhd_net2idx(dhd, net);
+	DHD_TRACE(("%s: ifidx %d, cmd 0x%04x\n", __FUNCTION__, ifidx, cmd));
+
+	if (ifidx == DHD_BAD_IF) {
+		DHD_ERROR(("%s: BAD IF\n", __FUNCTION__));
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return -1;
+	}
+
+#if defined(WL_WIRELESS_EXT)
+	/* linux wireless extensions */
+	if ((cmd >= SIOCIWFIRST) && (cmd <= SIOCIWLAST)) {
+		/* may recurse, do NOT lock */
+		ret = wl_iw_ioctl(net, ifr, cmd);
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return ret;
+	}
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2)
+	if (cmd == SIOCETHTOOL) {
+		ret = dhd_ethtool(dhd, (void*)ifr->ifr_data);
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return ret;
+	}
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(2, 4, 2) */
+
+	if (cmd == SIOCDEVPRIVATE+1) {
+		ret = wl_android_priv_cmd(net, ifr, cmd);
+		dhd_check_hang(net, &dhd->pub, ret);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return ret;
+	}
+
+	if (cmd != SIOCDEVPRIVATE) {
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		DHD_OS_WAKE_UNLOCK(&dhd->pub);
+		return -EOPNOTSUPP;
+	}
+
+	memset(&ioc, 0, sizeof(ioc));
+
+#ifdef CONFIG_COMPAT
+	if (is_compat_task()) {
+		compat_wl_ioctl_t compat_ioc;
+		if (copy_from_user(&compat_ioc, ifr->ifr_data, sizeof(compat_wl_ioctl_t))) {
+			bcmerror = BCME_BADADDR;
+			goto done;
+		}
+		ioc.cmd = compat_ioc.cmd;
+		ioc.buf = compat_ptr(compat_ioc.buf);
+		ioc.len = compat_ioc.len;
+		ioc.set = compat_ioc.set;
+		ioc.used = compat_ioc.used;
+		ioc.needed = compat_ioc.needed;
+		/* To differentiate between wl and dhd read 4 more byes */
+		if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(compat_wl_ioctl_t),
+			sizeof(uint)) != 0)) {
+			bcmerror = BCME_BADADDR;
+			goto done;
+		}
+	} else
+#endif /* CONFIG_COMPAT */
+	{
+		/* Copy the ioc control structure part of ioctl request */
+		if (copy_from_user(&ioc, ifr->ifr_data, sizeof(wl_ioctl_t))) {
+			bcmerror = BCME_BADADDR;
+			goto done;
+		}
+
+		/* To differentiate between wl and dhd read 4 more byes */
+		if ((copy_from_user(&ioc.driver, (char *)ifr->ifr_data + sizeof(wl_ioctl_t),
+			sizeof(uint)) != 0)) {
+			bcmerror = BCME_BADADDR;
+			goto done;
+		}
+	}
+
+	if (!capable(CAP_NET_ADMIN)) {
+		bcmerror = BCME_EPERM;
+		goto done;
+	}
+
+	if (ioc.len > 0) {
+		buflen = MIN(ioc.len, DHD_IOCTL_MAXLEN);
+		if (!(local_buf = MALLOC(dhd->pub.osh, buflen+1))) {
+			bcmerror = BCME_NOMEM;
+			goto done;
+		}
+
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		if (copy_from_user(local_buf, ioc.buf, buflen)) {
+			DHD_PERIM_LOCK(&dhd->pub);
+			bcmerror = BCME_BADADDR;
+			goto done;
+		}
+		DHD_PERIM_LOCK(&dhd->pub);
+
+		*(char *)(local_buf + buflen) = '\0';
+	}
+
+	bcmerror = dhd_ioctl_process(&dhd->pub, ifidx, &ioc, local_buf);
+
+	if (!bcmerror && buflen && local_buf && ioc.buf) {
+		DHD_PERIM_UNLOCK(&dhd->pub);
+		if (copy_to_user(ioc.buf, local_buf, buflen))
+			bcmerror = -EFAULT;
+		DHD_PERIM_LOCK(&dhd->pub);
+	}
+
+done:
+	if (local_buf)
+		MFREE(dhd->pub.osh, local_buf, buflen+1);
+
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+	return OSL_ERROR(bcmerror);
+}
+
+#define MAX_TRY_CNT             5 /* Number of tries to disable deepsleep */
+int dhd_deepsleep(dhd_info_t *dhd, int flag)
+{
+	char iovbuf[20];
+	uint powervar = 0;
+	dhd_pub_t *dhdp;
+	int cnt = 0;
+	int ret = 0;
+
+	dhdp = &dhd->pub;
+
+	switch (flag) {
+		case 1 :  /* Deepsleep on */
+			DHD_ERROR(("dhd_deepsleep: ON\n"));
+			/* give some time to sysioc_work before deepsleep */
+			OSL_SLEEP(200);
+#ifdef PKT_FILTER_SUPPORT
+			/* disable pkt filter */
+			dhd_enable_packet_filter(0, dhdp);
+#endif /* PKT_FILTER_SUPPORT */
+			/* Disable MPC */
+			powervar = 0;
+			memset(iovbuf, 0, sizeof(iovbuf));
+			bcm_mkiovar("mpc", (char *)&powervar, 4, iovbuf, sizeof(iovbuf));
+			dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+			/* Enable Deepsleep */
+			powervar = 1;
+			memset(iovbuf, 0, sizeof(iovbuf));
+			bcm_mkiovar("deepsleep", (char *)&powervar, 4, iovbuf, sizeof(iovbuf));
+			dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			break;
+
+		case 0: /* Deepsleep Off */
+			DHD_ERROR(("dhd_deepsleep: OFF\n"));
+
+			/* Disable Deepsleep */
+			for (cnt = 0; cnt < MAX_TRY_CNT; cnt++) {
+				powervar = 0;
+				memset(iovbuf, 0, sizeof(iovbuf));
+				bcm_mkiovar("deepsleep", (char *)&powervar, 4,
+					iovbuf, sizeof(iovbuf));
+				dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf,
+					sizeof(iovbuf), TRUE, 0);
+
+				memset(iovbuf, 0, sizeof(iovbuf));
+				bcm_mkiovar("deepsleep", (char *)&powervar, 4,
+					iovbuf, sizeof(iovbuf));
+				if ((ret = dhd_wl_ioctl_cmd(dhdp, WLC_GET_VAR, iovbuf,
+					sizeof(iovbuf),	FALSE, 0)) < 0) {
+					DHD_ERROR(("the error of dhd deepsleep status"
+						" ret value :%d\n", ret));
+				} else {
+					if (!(*(int *)iovbuf)) {
+						DHD_ERROR(("deepsleep mode is 0,"
+							" count: %d\n", cnt));
+						break;
+					}
+				}
+			}
+
+			/* Enable MPC */
+			powervar = 1;
+			memset(iovbuf, 0, sizeof(iovbuf));
+			bcm_mkiovar("mpc", (char *)&powervar, 4, iovbuf, sizeof(iovbuf));
+			dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			break;
+	}
+
+	return 0;
+}
+
+static int
+dhd_stop(struct net_device *net)
+{
+	int ifidx = 0;
+	dhd_info_t *dhd = DHD_DEV_INFO(net);
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+	printf("%s: Enter %p\n", __FUNCTION__, net);
+	if (dhd->pub.up == 0) {
+		goto exit;
+	}
+
+	dhd_if_flush_sta(DHD_DEV_IFP(net));
+
+
+	ifidx = dhd_net2idx(dhd, net);
+	BCM_REFERENCE(ifidx);
+
+	/* Set state and stop OS transmissions */
+	netif_stop_queue(net);
+	dhd->pub.up = 0;
+
+#ifdef WL_CFG80211
+	if (ifidx == 0) {
+		wl_cfg80211_down(NULL);
+
+		/*
+		 * For CFG80211: Clean up all the left over virtual interfaces
+		 * when the primary Interface is brought down. [ifconfig wlan0 down]
+		 */
+		if (!dhd_download_fw_on_driverload) {
+			if ((dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) &&
+				(dhd->dhd_state & DHD_ATTACH_STATE_CFG80211)) {
+				int i;
+
+				dhd_net_if_lock_local(dhd);
+				for (i = 1; i < DHD_MAX_IFS; i++)
+					dhd_remove_if(&dhd->pub, i, FALSE);
+				dhd_net_if_unlock_local(dhd);
+			}
+		}
+	}
+#endif /* WL_CFG80211 */
+
+#ifdef PROP_TXSTATUS
+	dhd_wlfc_cleanup(&dhd->pub, NULL, 0);
+#endif
+	/* Stop the protocol module */
+	dhd_prot_stop(&dhd->pub);
+
+	OLD_MOD_DEC_USE_COUNT;
+exit:
+	if (ifidx == 0 && !dhd_download_fw_on_driverload)
+		wl_android_wifi_off(net);
+	else {
+		if (dhd->pub.conf->deepsleep)
+			dhd_deepsleep(dhd, 1);
+	}
+	dhd->pub.rxcnt_timeout = 0;
+	dhd->pub.txcnt_timeout = 0;
+
+	dhd->pub.hang_was_sent = 0;
+
+	/* Clear country spec for for built-in type driver */
+	if (!dhd_download_fw_on_driverload) {
+		dhd->pub.dhd_cspec.country_abbrev[0] = 0x00;
+		dhd->pub.dhd_cspec.rev = 0;
+		dhd->pub.dhd_cspec.ccode[0] = 0x00;
+	}
+
+	printf("%s: Exit\n", __FUNCTION__);
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+	return 0;
+}
+
+#if defined(WL_CFG80211) && defined(USE_INITIAL_SHORT_DWELL_TIME)
+extern bool g_first_broadcast_scan;
+#endif
+
+#ifdef WL11U
+static int dhd_interworking_enable(dhd_pub_t *dhd)
+{
+	char iovbuf[WLC_IOCTL_SMLEN];
+	uint32 enable = true;
+	int ret = BCME_OK;
+
+	bcm_mkiovar("interworking", (char *)&enable, sizeof(enable), iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s: enableing interworking failed, ret=%d\n", __FUNCTION__, ret));
+	}
+
+	if (ret == BCME_OK) {
+		/* basic capabilities for HS20 REL2 */
+		uint32 cap = WL_WNM_BSSTRANS | WL_WNM_NOTIF;
+		bcm_mkiovar("wnm", (char *)&cap, sizeof(cap), iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+			iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s: failed to set WNM info, ret=%d\n", __FUNCTION__, ret));
+		}
+	}
+
+	return ret;
+}
+#endif /* WL11u */
+
+static int
+dhd_open(struct net_device *net)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(net);
+#ifdef TOE
+	uint32 toe_ol;
+#endif
+	int ifidx;
+	int32 ret = 0;
+
+	printf("%s: Enter %p\n", __FUNCTION__, net);
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	if (mutex_is_locked(&_dhd_sdio_mutex_lock_) != 0) {
+		DHD_ERROR(("%s : dhd_open: call dev open before insmod complete!\n", __FUNCTION__));
+	}
+	mutex_lock(&_dhd_sdio_mutex_lock_);
+#endif
+#endif /* MULTIPLE_SUPPLICANT */
+
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+	dhd->pub.dongle_trap_occured = 0;
+	dhd->pub.hang_was_sent = 0;
+
+#if 0
+	/*
+	 * Force start if ifconfig_up gets called before START command
+	 *  We keep WEXT's wl_control_wl_start to provide backward compatibility
+	 *  This should be removed in the future
+	 */
+	ret = wl_control_wl_start(net);
+	if (ret != 0) {
+		DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+		ret = -1;
+		goto exit;
+	}
+#endif
+
+	ifidx = dhd_net2idx(dhd, net);
+	DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+	if (ifidx < 0) {
+		DHD_ERROR(("%s: Error: called with invalid IF\n", __FUNCTION__));
+		ret = -1;
+		goto exit;
+	}
+
+	if (!dhd->iflist[ifidx]) {
+		DHD_ERROR(("%s: Error: called when IF already deleted\n", __FUNCTION__));
+		ret = -1;
+		goto exit;
+	}
+
+	if (ifidx == 0) {
+		atomic_set(&dhd->pend_8021x_cnt, 0);
+		if (!dhd_download_fw_on_driverload) {
+			DHD_ERROR(("\n%s\n", dhd_version));
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+			g_first_broadcast_scan = TRUE;
+#endif
+			ret = wl_android_wifi_on(net);
+			if (ret != 0) {
+				DHD_ERROR(("%s : wl_android_wifi_on failed (%d)\n",
+					__FUNCTION__, ret));
+				ret = -1;
+				goto exit;
+			}
+		}
+
+		if (dhd->pub.busstate != DHD_BUS_DATA) {
+
+			/* try to bring up bus */
+			DHD_PERIM_UNLOCK(&dhd->pub);
+			ret = dhd_bus_start(&dhd->pub);
+			DHD_PERIM_LOCK(&dhd->pub);
+			if (ret) {
+				DHD_ERROR(("%s: failed with code %d\n", __FUNCTION__, ret));
+				ret = -1;
+				goto exit;
+			}
+
+		}
+		if (dhd_download_fw_on_driverload) {
+			if (dhd->pub.conf->deepsleep)
+				dhd_deepsleep(dhd, 0);
+		}
+
+		/* dhd_sync_with_dongle has been called in dhd_bus_start or wl_android_wifi_on */
+		memcpy(net->dev_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+
+#ifdef TOE
+		/* Get current TOE mode from dongle */
+		if (dhd_toe_get(dhd, ifidx, &toe_ol) >= 0 && (toe_ol & TOE_TX_CSUM_OL) != 0)
+			dhd->iflist[ifidx]->net->features |= NETIF_F_IP_CSUM;
+		else
+			dhd->iflist[ifidx]->net->features &= ~NETIF_F_IP_CSUM;
+#endif /* TOE */
+
+#if defined(WL_CFG80211)
+		if (unlikely(wl_cfg80211_up(NULL))) {
+			DHD_ERROR(("%s: failed to bring up cfg80211\n", __FUNCTION__));
+			ret = -1;
+			goto exit;
+		}
+		dhd_set_scb_probe(&dhd->pub);
+#endif /* WL_CFG80211 */
+	}
+
+	/* Allow transmit calls */
+	netif_start_queue(net);
+	dhd->pub.up = 1;
+
+#ifdef BCMDBGFS
+	dhd_dbg_init(&dhd->pub);
+#endif
+
+	OLD_MOD_INC_USE_COUNT;
+exit:
+	if (ret)
+		dhd_stop(net);
+
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	mutex_unlock(&_dhd_sdio_mutex_lock_);
+#endif
+#endif /* MULTIPLE_SUPPLICANT */
+
+	printf("%s: Exit ret=%d\n", __FUNCTION__, ret);
+	return ret;
+}
+
+int dhd_do_driver_init(struct net_device *net)
+{
+	dhd_info_t *dhd = NULL;
+
+	if (!net) {
+		DHD_ERROR(("Primary Interface not initialized \n"));
+		return -EINVAL;
+	}
+
+#ifdef MULTIPLE_SUPPLICANT
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1 && defined(BCMSDIO)
+	if (mutex_is_locked(&_dhd_sdio_mutex_lock_) != 0) {
+		DHD_ERROR(("%s : dhdsdio_probe is already running!\n", __FUNCTION__));
+		return 0;
+	}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif /* MULTIPLE_SUPPLICANT */
+
+	/*  && defined(OEM_ANDROID) && defined(BCMSDIO) */
+	dhd = DHD_DEV_INFO(net);
+
+	/* If driver is already initialized, do nothing
+	 */
+	if (dhd->pub.busstate == DHD_BUS_DATA) {
+		DHD_TRACE(("Driver already Inititalized. Nothing to do"));
+		return 0;
+	}
+
+	if (dhd_open(net) < 0) {
+		DHD_ERROR(("Driver Init Failed \n"));
+		return -1;
+	}
+
+	return 0;
+}
+
+int
+dhd_event_ifadd(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+
+#ifdef WL_CFG80211
+	if (wl_cfg80211_notify_ifadd(ifevent->ifidx, name, mac, ifevent->bssidx) == BCME_OK)
+		return BCME_OK;
+#endif
+
+	/* handle IF event caused by wl commands, SoftAP, WEXT and
+	 * anything else. This has to be done asynchronously otherwise
+	 * DPC will be blocked (and iovars will timeout as DPC has no chance
+	 * to read the response back)
+	 */
+	if (ifevent->ifidx > 0) {
+		dhd_if_event_t *if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+
+		memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+		memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+		strncpy(if_event->name, name, IFNAMSIZ);
+		if_event->name[IFNAMSIZ - 1] = '\0';
+		dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event,
+			DHD_WQ_WORK_IF_ADD, dhd_ifadd_event_handler, DHD_WORK_PRIORITY_LOW);
+	}
+
+	return BCME_OK;
+}
+
+int
+dhd_event_ifdel(dhd_info_t *dhdinfo, wl_event_data_if_t *ifevent, char *name, uint8 *mac)
+{
+	dhd_if_event_t *if_event;
+
+#if defined(WL_CFG80211) && !defined(P2PONEINT)
+	if (wl_cfg80211_notify_ifdel(ifevent->ifidx, name, mac, ifevent->bssidx) == BCME_OK)
+		return BCME_OK;
+#endif /* WL_CFG80211 */
+
+	/* handle IF event caused by wl commands, SoftAP, WEXT and
+	 * anything else
+	 */
+	if_event = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_event_t));
+	memcpy(&if_event->event, ifevent, sizeof(if_event->event));
+	memcpy(if_event->mac, mac, ETHER_ADDR_LEN);
+	strncpy(if_event->name, name, IFNAMSIZ);
+	if_event->name[IFNAMSIZ - 1] = '\0';
+	dhd_deferred_schedule_work(dhdinfo->dhd_deferred_wq, (void *)if_event, DHD_WQ_WORK_IF_DEL,
+		dhd_ifdel_event_handler, DHD_WORK_PRIORITY_LOW);
+
+	return BCME_OK;
+}
+
+/* unregister and free the existing net_device interface (if any) in iflist and
+ * allocate a new one. the slot is reused. this function does NOT register the
+ * new interface to linux kernel. dhd_register_if does the job
+ */
+struct net_device*
+dhd_allocate_if(dhd_pub_t *dhdpub, int ifidx, char *name,
+	uint8 *mac, uint8 bssidx, bool need_rtnl_lock)
+{
+	dhd_info_t *dhdinfo = (dhd_info_t *)dhdpub->info;
+	dhd_if_t *ifp;
+
+	ASSERT(dhdinfo && (ifidx < DHD_MAX_IFS));
+	ifp = dhdinfo->iflist[ifidx];
+
+	if (ifp != NULL) {
+		if (ifp->net != NULL) {
+			DHD_ERROR(("%s: free existing IF %s\n", __FUNCTION__, ifp->net->name));
+
+			dhd_dev_priv_clear(ifp->net); /* clear net_device private */
+
+			/* in unregister_netdev case, the interface gets freed by net->destructor
+			 * (which is set to free_netdev)
+			 */
+			if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+				free_netdev(ifp->net);
+			} else {
+				netif_stop_queue(ifp->net);
+				if (need_rtnl_lock)
+					unregister_netdev(ifp->net);
+				else
+					unregister_netdevice(ifp->net);
+			}
+			ifp->net = NULL;
+		}
+	} else {
+		ifp = MALLOC(dhdinfo->pub.osh, sizeof(dhd_if_t));
+		if (ifp == NULL) {
+			DHD_ERROR(("%s: OOM - dhd_if_t(%zu)\n", __FUNCTION__, sizeof(dhd_if_t)));
+			return NULL;
+		}
+	}
+
+	memset(ifp, 0, sizeof(dhd_if_t));
+	ifp->info = dhdinfo;
+	ifp->idx = ifidx;
+	ifp->bssidx = bssidx;
+	if (mac != NULL)
+		memcpy(&ifp->mac_addr, mac, ETHER_ADDR_LEN);
+
+	/* Allocate etherdev, including space for private structure */
+	ifp->net = alloc_etherdev(DHD_DEV_PRIV_SIZE);
+	if (ifp->net == NULL) {
+		DHD_ERROR(("%s: OOM - alloc_etherdev(%zu)\n", __FUNCTION__, sizeof(dhdinfo)));
+		goto fail;
+	}
+
+	/* Setup the dhd interface's netdevice private structure. */
+	dhd_dev_priv_save(ifp->net, dhdinfo, ifp, ifidx);
+
+	if (name && name[0]) {
+		strncpy(ifp->net->name, name, IFNAMSIZ);
+		ifp->net->name[IFNAMSIZ - 1] = '\0';
+	}
+#ifdef WL_CFG80211
+	if (ifidx == 0)
+		ifp->net->destructor = free_netdev;
+	else
+		ifp->net->destructor = dhd_netdev_free;
+#else
+	ifp->net->destructor = free_netdev;
+#endif /* WL_CFG80211 */
+	strncpy(ifp->name, ifp->net->name, IFNAMSIZ);
+	ifp->name[IFNAMSIZ - 1] = '\0';
+	dhdinfo->iflist[ifidx] = ifp;
+
+#ifdef PCIE_FULL_DONGLE
+	/* Initialize STA info list */
+	INIT_LIST_HEAD(&ifp->sta_list);
+	DHD_IF_STA_LIST_LOCK_INIT(ifp);
+#endif /* PCIE_FULL_DONGLE */
+
+	return ifp->net;
+
+fail:
+	if (ifp != NULL) {
+		if (ifp->net != NULL) {
+			dhd_dev_priv_clear(ifp->net);
+			free_netdev(ifp->net);
+			ifp->net = NULL;
+		}
+		MFREE(dhdinfo->pub.osh, ifp, sizeof(*ifp));
+		ifp = NULL;
+	}
+	dhdinfo->iflist[ifidx] = NULL;
+	return NULL;
+}
+
+/* unregister and free the the net_device interface associated with the indexed
+ * slot, also free the slot memory and set the slot pointer to NULL
+ */
+int
+dhd_remove_if(dhd_pub_t *dhdpub, int ifidx, bool need_rtnl_lock)
+{
+	dhd_info_t *dhdinfo = (dhd_info_t *)dhdpub->info;
+	dhd_if_t *ifp;
+
+	ifp = dhdinfo->iflist[ifidx];
+	if (ifp != NULL) {
+		if (ifp->net != NULL) {
+			DHD_ERROR(("deleting interface '%s' idx %d\n", ifp->net->name, ifp->idx));
+
+			/* in unregister_netdev case, the interface gets freed by net->destructor
+			 * (which is set to free_netdev)
+			 */
+			if (ifp->net->reg_state == NETREG_UNINITIALIZED) {
+				free_netdev(ifp->net);
+			} else {
+				netif_stop_queue(ifp->net);
+
+
+
+#ifdef SET_RPS_CPUS
+				custom_rps_map_clear(ifp->net->_rx);
+#endif /* SET_RPS_CPUS */
+				if (need_rtnl_lock)
+					unregister_netdev(ifp->net);
+				else
+					unregister_netdevice(ifp->net);
+			}
+			ifp->net = NULL;
+		}
+#ifdef DHD_WMF
+		dhd_wmf_cleanup(dhdpub, ifidx);
+#endif /* DHD_WMF */
+
+		dhd_if_del_sta_list(ifp);
+
+		dhdinfo->iflist[ifidx] = NULL;
+		MFREE(dhdinfo->pub.osh, ifp, sizeof(*ifp));
+
+	}
+
+	return BCME_OK;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+static struct net_device_ops dhd_ops_pri = {
+	.ndo_open = dhd_open,
+	.ndo_stop = dhd_stop,
+	.ndo_get_stats = dhd_get_stats,
+	.ndo_do_ioctl = dhd_ioctl_entry,
+	.ndo_start_xmit = dhd_start_xmit,
+	.ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+	.ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+	.ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+};
+
+static struct net_device_ops dhd_ops_virt = {
+	.ndo_get_stats = dhd_get_stats,
+	.ndo_do_ioctl = dhd_ioctl_entry,
+	.ndo_start_xmit = dhd_start_xmit,
+	.ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+	.ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+	.ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+};
+
+#ifdef P2PONEINT
+extern int wl_cfgp2p_if_open(struct net_device *net);
+extern int wl_cfgp2p_if_stop(struct net_device *net);
+
+static struct net_device_ops dhd_cfgp2p_ops_virt = {
+	.ndo_open = wl_cfgp2p_if_open,
+	.ndo_stop = wl_cfgp2p_if_stop,
+	.ndo_get_stats = dhd_get_stats,
+	.ndo_do_ioctl = dhd_ioctl_entry,
+	.ndo_start_xmit = dhd_start_xmit,
+	.ndo_set_mac_address = dhd_set_mac_address,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+	.ndo_set_rx_mode = dhd_set_multicast_list,
+#else
+	.ndo_set_multicast_list = dhd_set_multicast_list,
+#endif
+};
+#endif /* P2PONEINT */
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)) */
+
+#ifdef DEBUGGER
+extern void debugger_init(void *bus_handle);
+#endif
+
+
+#ifdef SHOW_LOGTRACE
+static char *logstrs_path = "/root/logstrs.bin";
+module_param(logstrs_path, charp, S_IRUGO);
+
+int
+dhd_init_logstrs_array(dhd_event_log_t *temp)
+{
+	struct file *filep = NULL;
+	struct kstat stat;
+	mm_segment_t fs;
+	char *raw_fmts =  NULL;
+	int logstrs_size = 0;
+
+	logstr_header_t *hdr = NULL;
+	uint32 *lognums = NULL;
+	char *logstrs = NULL;
+	int ram_index = 0;
+	char **fmts;
+	int num_fmts = 0;
+	uint32 i = 0;
+	int error = 0;
+	set_fs(KERNEL_DS);
+	fs = get_fs();
+	filep = filp_open(logstrs_path, O_RDONLY, 0);
+	if (IS_ERR(filep)) {
+		DHD_ERROR(("Failed to open the file logstrs.bin in %s\n",  __FUNCTION__));
+		goto fail;
+	}
+	error = vfs_stat(logstrs_path, &stat);
+	if (error) {
+		DHD_ERROR(("Failed in %s to find file stat\n", __FUNCTION__));
+		goto fail;
+	}
+	logstrs_size = (int) stat.size;
+
+	raw_fmts = kmalloc(logstrs_size, GFP_KERNEL);
+	if (raw_fmts == NULL) {
+		DHD_ERROR(("Failed to allocate raw_fmts memory\n"));
+		goto fail;
+	}
+	if (vfs_read(filep, raw_fmts, logstrs_size, &filep->f_pos) !=	logstrs_size) {
+		DHD_ERROR(("Error: Log strings file read failed\n"));
+		goto fail;
+	}
+
+	/* Remember header from the logstrs.bin file */
+	hdr = (logstr_header_t *) (raw_fmts + logstrs_size -
+		sizeof(logstr_header_t));
+
+	if (hdr->log_magic == LOGSTRS_MAGIC) {
+		/*
+		* logstrs.bin start with header.
+		*/
+		num_fmts =	hdr->rom_logstrs_offset / sizeof(uint32);
+		ram_index = (hdr->ram_lognums_offset -
+			hdr->rom_lognums_offset) / sizeof(uint32);
+		lognums = (uint32 *) &raw_fmts[hdr->rom_lognums_offset];
+		logstrs = (char *)	 &raw_fmts[hdr->rom_logstrs_offset];
+	} else {
+		/*
+		 * Legacy logstrs.bin format without header.
+		 */
+		num_fmts = *((uint32 *) (raw_fmts)) / sizeof(uint32);
+		if (num_fmts == 0) {
+			/* Legacy ROM/RAM logstrs.bin format:
+			  *  - ROM 'lognums' section
+			  *   - RAM 'lognums' section
+			  *   - ROM 'logstrs' section.
+			  *   - RAM 'logstrs' section.
+			  *
+			  * 'lognums' is an array of indexes for the strings in the
+			  * 'logstrs' section. The first uint32 is 0 (index of first
+			  * string in ROM 'logstrs' section).
+			  *
+			  * The 4324b5 is the only ROM that uses this legacy format. Use the
+			  * fixed number of ROM fmtnums to find the start of the RAM
+			  * 'lognums' section. Use the fixed first ROM string ("Con\n") to
+			  * find the ROM 'logstrs' section.
+			  */
+			#define NUM_4324B5_ROM_FMTS	186
+			#define FIRST_4324B5_ROM_LOGSTR "Con\n"
+			ram_index = NUM_4324B5_ROM_FMTS;
+			lognums = (uint32 *) raw_fmts;
+			num_fmts =	ram_index;
+			logstrs = (char *) &raw_fmts[num_fmts << 2];
+			while (strncmp(FIRST_4324B5_ROM_LOGSTR, logstrs, 4)) {
+				num_fmts++;
+				logstrs = (char *) &raw_fmts[num_fmts << 2];
+			}
+		} else {
+				/* Legacy RAM-only logstrs.bin format:
+				 *	  - RAM 'lognums' section
+				 *	  - RAM 'logstrs' section.
+				 *
+				 * 'lognums' is an array of indexes for the strings in the
+				 * 'logstrs' section. The first uint32 is an index to the
+				 * start of 'logstrs'. Therefore, if this index is divided
+				 * by 'sizeof(uint32)' it provides the number of logstr
+				 *	entries.
+				 */
+				ram_index = 0;
+				lognums = (uint32 *) raw_fmts;
+				logstrs = (char *)	&raw_fmts[num_fmts << 2];
+			}
+	}
+	fmts = kmalloc(num_fmts  * sizeof(char *), GFP_KERNEL);
+	if (fmts == NULL) {
+		DHD_ERROR(("Failed to allocate fmts memory\n"));
+		goto fail;
+	}
+
+	for (i = 0; i < num_fmts; i++) {
+		/* ROM lognums index into logstrs using 'rom_logstrs_offset' as a base
+		* (they are 0-indexed relative to 'rom_logstrs_offset').
+		*
+		* RAM lognums are already indexed to point to the correct RAM logstrs (they
+		* are 0-indexed relative to the start of the logstrs.bin file).
+		*/
+		if (i == ram_index) {
+			logstrs = raw_fmts;
+		}
+		fmts[i] = &logstrs[lognums[i]];
+	}
+	temp->fmts = fmts;
+	temp->raw_fmts = raw_fmts;
+	temp->num_fmts = num_fmts;
+	filp_close(filep, NULL);
+	set_fs(fs);
+	return 0;
+fail:
+	if (raw_fmts) {
+		kfree(raw_fmts);
+		raw_fmts = NULL;
+	}
+	if (!IS_ERR(filep))
+		filp_close(filep, NULL);
+	set_fs(fs);
+	temp->fmts = NULL;
+	return -1;
+}
+#endif /* SHOW_LOGTRACE */
+
+
+dhd_pub_t *
+dhd_attach(osl_t *osh, struct dhd_bus *bus, uint bus_hdrlen)
+{
+	dhd_info_t *dhd = NULL;
+	struct net_device *net = NULL;
+	char if_name[IFNAMSIZ] = {'\0'};
+	uint32 bus_type = -1;
+	uint32 bus_num = -1;
+	uint32 slot_num = -1;
+	wifi_adapter_info_t *adapter = NULL;
+
+	dhd_attach_states_t dhd_state = DHD_ATTACH_STATE_INIT;
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* will implement get_ids for DBUS later */
+#if defined(BCMSDIO)
+	dhd_bus_get_ids(bus, &bus_type, &bus_num, &slot_num);
+#endif
+	adapter = dhd_wifi_platform_get_adapter(bus_type, bus_num, slot_num);
+
+	/* Allocate primary dhd_info */
+	dhd = wifi_platform_prealloc(adapter, DHD_PREALLOC_DHD_INFO, sizeof(dhd_info_t));
+	if (dhd == NULL) {
+		dhd = MALLOC(osh, sizeof(dhd_info_t));
+		if (dhd == NULL) {
+			DHD_ERROR(("%s: OOM - alloc dhd_info\n", __FUNCTION__));
+			goto fail;
+		}
+	}
+	memset(dhd, 0, sizeof(dhd_info_t));
+	dhd_state |= DHD_ATTACH_STATE_DHD_ALLOC;
+
+	dhd->unit = dhd_found + instance_base; /* do not increment dhd_found, yet */
+
+	dhd->pub.osh = osh;
+	dhd->adapter = adapter;
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+	wifi_platform_get_mac_addr(dhd->adapter, dhd->pub.mac.octet);
+#endif /* GET_CUSTOM_MAC_ENABLE */
+	dhd->thr_dpc_ctl.thr_pid = DHD_PID_KT_TL_INVALID;
+	dhd->thr_wdt_ctl.thr_pid = DHD_PID_KT_INVALID;
+
+	/* Initialize thread based operation and lock */
+	sema_init(&dhd->sdsem, 1);
+
+	/* Link to info module */
+	dhd->pub.info = dhd;
+
+
+	/* Link to bus module */
+	dhd->pub.bus = bus;
+	dhd->pub.hdrlen = bus_hdrlen;
+
+	/* dhd_conf must be attached after linking dhd to dhd->pub.info,
+	 * because dhd_detech will check .info is NULL or not.
+	*/
+	if (dhd_conf_attach(&dhd->pub) != 0) {
+		DHD_ERROR(("dhd_conf_attach failed\n"));
+		goto fail;
+	}
+	dhd_conf_reset(&dhd->pub);
+	dhd_conf_set_chiprev(&dhd->pub, dhd_bus_chip(bus), dhd_bus_chiprev(bus));
+	dhd_conf_preinit(&dhd->pub);
+
+	/* Some DHD modules (e.g. cfg80211) configures operation mode based on firmware name.
+	 * This is indeed a hack but we have to make it work properly before we have a better
+	 * solution
+	 */
+	dhd_update_fw_nv_path(dhd);
+#ifndef BUILD_IN_KERNEL
+	dhd_conf_read_config(&dhd->pub, dhd->conf_path);
+#endif
+
+	/* Set network interface name if it was provided as module parameter */
+	if (iface_name[0]) {
+		int len;
+		char ch;
+		strncpy(if_name, iface_name, IFNAMSIZ);
+		if_name[IFNAMSIZ - 1] = 0;
+		len = strlen(if_name);
+		ch = if_name[len - 1];
+		if ((ch > '9' || ch < '0') && (len < IFNAMSIZ - 2))
+			strcat(if_name, "%d");
+	}
+	net = dhd_allocate_if(&dhd->pub, 0, if_name, NULL, 0, TRUE);
+	if (net == NULL)
+		goto fail;
+	dhd_state |= DHD_ATTACH_STATE_ADD_IF;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+	net->open = NULL;
+#else
+	net->netdev_ops = NULL;
+#endif
+
+	sema_init(&dhd->proto_sem, 1);
+
+#ifdef PROP_TXSTATUS
+	spin_lock_init(&dhd->wlfc_spinlock);
+
+	dhd->pub.skip_fc = dhd_wlfc_skip_fc;
+	dhd->pub.plat_init = dhd_wlfc_plat_init;
+	dhd->pub.plat_deinit = dhd_wlfc_plat_deinit;
+#endif /* PROP_TXSTATUS */
+
+	/* Initialize other structure content */
+	init_waitqueue_head(&dhd->ioctl_resp_wait);
+	init_waitqueue_head(&dhd->ctrl_wait);
+
+	/* Initialize the spinlocks */
+	spin_lock_init(&dhd->sdlock);
+	spin_lock_init(&dhd->txqlock);
+	spin_lock_init(&dhd->dhd_lock);
+	spin_lock_init(&dhd->rxf_lock);
+#if defined(RXFRAME_THREAD)
+	dhd->rxthread_enabled = TRUE;
+#endif /* defined(RXFRAME_THREAD) */
+
+#ifdef DHDTCPACK_SUPPRESS
+	spin_lock_init(&dhd->tcpack_lock);
+#endif /* DHDTCPACK_SUPPRESS */
+
+	/* Initialize Wakelock stuff */
+	spin_lock_init(&dhd->wakelock_spinlock);
+	dhd->wakelock_counter = 0;
+	dhd->wakelock_wd_counter = 0;
+	dhd->wakelock_rx_timeout_enable = 0;
+	dhd->wakelock_ctrl_timeout_enable = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+	wake_lock_init(&dhd->wl_wifi, WAKE_LOCK_SUSPEND, "wlan_wake");
+	wake_lock_init(&dhd->wl_rxwake, WAKE_LOCK_SUSPEND, "wlan_rx_wake");
+	wake_lock_init(&dhd->wl_ctrlwake, WAKE_LOCK_SUSPEND, "wlan_ctrl_wake");
+	wake_lock_init(&dhd->wl_wdwake, WAKE_LOCK_SUSPEND, "wlan_wd_wake");
+#ifdef BCMPCIE_OOB_HOST_WAKE
+	wake_lock_init(&dhd->wl_intrwake, WAKE_LOCK_SUSPEND, "wlan_oob_irq_wake");
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#endif /* CONFIG_HAS_WAKELOCK */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	mutex_init(&dhd->dhd_net_if_mutex);
+	mutex_init(&dhd->dhd_suspend_mutex);
+#endif
+	dhd_state |= DHD_ATTACH_STATE_WAKELOCKS_INIT;
+
+	/* Attach and link in the protocol */
+	if (dhd_prot_attach(&dhd->pub) != 0) {
+		DHD_ERROR(("dhd_prot_attach failed\n"));
+		goto fail;
+	}
+	dhd_state |= DHD_ATTACH_STATE_PROT_ATTACH;
+
+#ifdef WL_CFG80211
+	/* Attach and link in the cfg80211 */
+	if (unlikely(wl_cfg80211_attach(net, &dhd->pub))) {
+		DHD_ERROR(("wl_cfg80211_attach failed\n"));
+		goto fail;
+	}
+
+	dhd_monitor_init(&dhd->pub);
+	dhd_state |= DHD_ATTACH_STATE_CFG80211;
+#endif
+#if defined(WL_WIRELESS_EXT)
+	/* Attach and link in the iw */
+	if (!(dhd_state &  DHD_ATTACH_STATE_CFG80211)) {
+		if (wl_iw_attach(net, (void *)&dhd->pub) != 0) {
+			DHD_ERROR(("wl_iw_attach failed\n"));
+			goto fail;
+		}
+		dhd_state |= DHD_ATTACH_STATE_WL_ATTACH;
+	}
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#ifdef SHOW_LOGTRACE
+	dhd_init_logstrs_array(&dhd->event_data);
+#endif /* SHOW_LOGTRACE */
+
+	if (dhd_sta_pool_init(&dhd->pub, DHD_MAX_STA) != BCME_OK) {
+		DHD_ERROR(("%s: Initializing %u sta\n", __FUNCTION__, DHD_MAX_STA));
+		goto fail;
+	}
+
+
+	/* Set up the watchdog timer */
+	init_timer(&dhd->timer);
+	dhd->timer.data = (ulong)dhd;
+	dhd->timer.function = dhd_watchdog;
+	dhd->default_wd_interval = dhd_watchdog_ms;
+
+	if (dhd_watchdog_prio >= 0) {
+		/* Initialize watchdog thread */
+		PROC_START(dhd_watchdog_thread, dhd, &dhd->thr_wdt_ctl, 0, "dhd_watchdog_thread");
+
+	} else {
+		dhd->thr_wdt_ctl.thr_pid = -1;
+	}
+
+#ifdef DEBUGGER
+	debugger_init((void *) bus);
+#endif
+
+	/* Set up the bottom half handler */
+	if (dhd_dpc_prio >= 0) {
+		/* Initialize DPC thread */
+		PROC_START(dhd_dpc_thread, dhd, &dhd->thr_dpc_ctl, 0, "dhd_dpc");
+	} else {
+		/*  use tasklet for dpc */
+		tasklet_init(&dhd->tasklet, dhd_dpc, (ulong)dhd);
+		dhd->thr_dpc_ctl.thr_pid = -1;
+	}
+
+	if (dhd->rxthread_enabled) {
+		bzero(&dhd->pub.skbbuf[0], sizeof(void *) * MAXSKBPEND);
+		/* Initialize RXF thread */
+		PROC_START(dhd_rxf_thread, dhd, &dhd->thr_rxf_ctl, 0, "dhd_rxf");
+	}
+
+	dhd_state |= DHD_ATTACH_STATE_THREADS_CREATED;
+
+#if defined(CONFIG_PM_SLEEP)
+	if (!dhd_pm_notifier_registered) {
+		dhd_pm_notifier_registered = TRUE;
+		register_pm_notifier(&dhd_pm_notifier);
+	}
+#endif /* CONFIG_PM_SLEEP */
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+	dhd->early_suspend.level = EARLY_SUSPEND_LEVEL_BLANK_SCREEN + 20;
+	dhd->early_suspend.suspend = dhd_early_suspend;
+	dhd->early_suspend.resume = dhd_late_resume;
+	register_early_suspend(&dhd->early_suspend);
+	dhd_state |= DHD_ATTACH_STATE_EARLYSUSPEND_DONE;
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#ifdef ARP_OFFLOAD_SUPPORT
+	dhd->pend_ipaddr = 0;
+	if (!dhd_inetaddr_notifier_registered) {
+		dhd_inetaddr_notifier_registered = TRUE;
+		register_inetaddr_notifier(&dhd_inetaddr_notifier);
+	}
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef CONFIG_IPV6
+	if (!dhd_inet6addr_notifier_registered) {
+		dhd_inet6addr_notifier_registered = TRUE;
+		register_inet6addr_notifier(&dhd_inet6addr_notifier);
+	}
+#endif
+	dhd->dhd_deferred_wq = dhd_deferred_work_init((void *)dhd);
+#ifdef DEBUG_CPU_FREQ
+	dhd->new_freq = alloc_percpu(int);
+	dhd->freq_trans.notifier_call = dhd_cpufreq_notifier;
+	cpufreq_register_notifier(&dhd->freq_trans, CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+#ifdef BCMSDIO
+	dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_DELAYTX);
+#elif defined(BCMPCIE)
+	dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_HOLD);
+#else
+	dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* BCMSDIO */
+#endif /* DHDTCPACK_SUPPRESS */
+
+	dhd_state |= DHD_ATTACH_STATE_DONE;
+	dhd->dhd_state = dhd_state;
+
+	dhd_found++;
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+	dhd_global = dhd;
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+	return &dhd->pub;
+
+fail:
+	if (dhd_state >= DHD_ATTACH_STATE_DHD_ALLOC) {
+		DHD_TRACE(("%s: Calling dhd_detach dhd_state 0x%x &dhd->pub %p\n",
+			__FUNCTION__, dhd_state, &dhd->pub));
+		dhd->dhd_state = dhd_state;
+		dhd_detach(&dhd->pub);
+		dhd_free(&dhd->pub);
+	}
+
+	return NULL;
+}
+
+int dhd_get_fw_mode(dhd_info_t *dhdinfo)
+{
+	if (strstr(dhdinfo->fw_path, "_apsta") != NULL)
+		return DHD_FLAG_HOSTAP_MODE;
+	if (strstr(dhdinfo->fw_path, "_p2p") != NULL)
+		return DHD_FLAG_P2P_MODE;
+	if (strstr(dhdinfo->fw_path, "_ibss") != NULL)
+		return DHD_FLAG_IBSS_MODE;
+	if (strstr(dhdinfo->fw_path, "_mfg") != NULL)
+		return DHD_FLAG_MFG_MODE;
+
+	return DHD_FLAG_STA_MODE;
+}
+
+bool dhd_update_fw_nv_path(dhd_info_t *dhdinfo)
+{
+	int fw_len;
+	int nv_len;
+	int conf_len;
+	const char *fw = NULL;
+	const char *nv = NULL;
+	const char *conf = NULL;
+	wifi_adapter_info_t *adapter = dhdinfo->adapter;
+
+
+	/* Update firmware and nvram path. The path may be from adapter info or module parameter
+	 * The path from adapter info is used for initialization only (as it won't change).
+	 *
+	 * The firmware_path/nvram_path module parameter may be changed by the system at run
+	 * time. When it changes we need to copy it to dhdinfo->fw_path. Also Android private
+	 * command may change dhdinfo->fw_path. As such we need to clear the path info in
+	 * module parameter after it is copied. We won't update the path until the module parameter
+	 * is changed again (first character is not '\0')
+	 */
+
+	/* set default firmware and nvram path for built-in type driver */
+//	if (!dhd_download_fw_on_driverload) {
+#ifdef CONFIG_BCMDHD_FW_PATH
+		fw = CONFIG_BCMDHD_FW_PATH;
+#endif /* CONFIG_BCMDHD_FW_PATH */
+#ifdef CONFIG_BCMDHD_NVRAM_PATH
+		nv = CONFIG_BCMDHD_NVRAM_PATH;
+#endif /* CONFIG_BCMDHD_NVRAM_PATH */
+//	}
+
+	/* check if we need to initialize the path */
+	if (dhdinfo->fw_path[0] == '\0') {
+		if (adapter && adapter->fw_path && adapter->fw_path[0] != '\0')
+			fw = adapter->fw_path;
+
+	}
+	if (dhdinfo->nv_path[0] == '\0') {
+		if (adapter && adapter->nv_path && adapter->nv_path[0] != '\0')
+			nv = adapter->nv_path;
+	}
+	if (dhdinfo->conf_path[0] == '\0') {
+		if (adapter && adapter->conf_path && adapter->conf_path[0] != '\0')
+			conf = adapter->conf_path;
+	}
+
+	/* Use module parameter if it is valid, EVEN IF the path has not been initialized
+	 *
+	 * TODO: need a solution for multi-chip, can't use the same firmware for all chips
+	 */
+	if (firmware_path[0] != '\0')
+		fw = firmware_path;
+	if (nvram_path[0] != '\0')
+		nv = nvram_path;
+	if (config_path[0] != '\0')
+		conf = config_path;
+
+	if (fw && fw[0] != '\0') {
+		fw_len = strlen(fw);
+		if (fw_len >= sizeof(dhdinfo->fw_path)) {
+			DHD_ERROR(("fw path len exceeds max len of dhdinfo->fw_path\n"));
+			return FALSE;
+		}
+		strncpy(dhdinfo->fw_path, fw, sizeof(dhdinfo->fw_path));
+		if (dhdinfo->fw_path[fw_len-1] == '\n')
+		       dhdinfo->fw_path[fw_len-1] = '\0';
+	}
+	if (nv && nv[0] != '\0') {
+		nv_len = strlen(nv);
+		if (nv_len >= sizeof(dhdinfo->nv_path)) {
+			DHD_ERROR(("nvram path len exceeds max len of dhdinfo->nv_path\n"));
+			return FALSE;
+		}
+		strncpy(dhdinfo->nv_path, nv, sizeof(dhdinfo->nv_path));
+		if (dhdinfo->nv_path[nv_len-1] == '\n')
+		       dhdinfo->nv_path[nv_len-1] = '\0';
+	}
+	if (conf && conf[0] != '\0') {
+		conf_len = strlen(conf);
+		if (conf_len >= sizeof(dhdinfo->conf_path)) {
+			DHD_ERROR(("config path len exceeds max len of dhdinfo->conf_path\n"));
+			return FALSE;
+		}
+		strncpy(dhdinfo->conf_path, conf, sizeof(dhdinfo->conf_path));
+		if (dhdinfo->conf_path[conf_len-1] == '\n')
+		       dhdinfo->conf_path[conf_len-1] = '\0';
+	}
+
+#if 0
+	/* clear the path in module parameter */
+	firmware_path[0] = '\0';
+	nvram_path[0] = '\0';
+	config_path[0] = '\0';
+#endif
+
+#ifndef BCMEMBEDIMAGE
+	/* fw_path and nv_path are not mandatory for BCMEMBEDIMAGE */
+	if (dhdinfo->fw_path[0] == '\0') {
+		DHD_ERROR(("firmware path not found\n"));
+		return FALSE;
+	}
+	if (dhdinfo->nv_path[0] == '\0') {
+		DHD_ERROR(("nvram path not found\n"));
+		return FALSE;
+	}
+	if (dhdinfo->conf_path[0] == '\0') {
+		dhd_conf_set_conf_path_by_nv_path(&dhdinfo->pub, dhdinfo->conf_path, dhdinfo->nv_path);
+	}
+#endif /* BCMEMBEDIMAGE */
+
+	return TRUE;
+}
+
+
+int
+dhd_bus_start(dhd_pub_t *dhdp)
+{
+	int ret = -1;
+	dhd_info_t *dhd = (dhd_info_t*)dhdp->info;
+	unsigned long flags;
+
+	ASSERT(dhd);
+
+	DHD_TRACE(("Enter %s:\n", __FUNCTION__));
+
+	DHD_PERIM_LOCK(dhdp);
+
+	/* try to download image and nvram to the dongle */
+	if  (dhd->pub.busstate == DHD_BUS_DOWN && dhd_update_fw_nv_path(dhd)) {
+		DHD_INFO(("%s download fw %s, nv %s, conf %s\n",
+			__FUNCTION__, dhd->fw_path, dhd->nv_path, dhd->conf_path));
+		ret = dhd_bus_download_firmware(dhd->pub.bus, dhd->pub.osh,
+			dhd->fw_path, dhd->nv_path, dhd->conf_path);
+		if (ret < 0) {
+			DHD_ERROR(("%s: failed to download firmware %s\n",
+				__FUNCTION__, dhd->fw_path));
+			DHD_PERIM_UNLOCK(dhdp);
+			return ret;
+		}
+	}
+	if (dhd->pub.busstate != DHD_BUS_LOAD) {
+		DHD_PERIM_UNLOCK(dhdp);
+		return -ENETDOWN;
+	}
+
+	dhd_os_sdlock(dhdp);
+
+	/* Start the watchdog timer */
+	dhd->pub.tickcnt = 0;
+	dhd_os_wd_timer(&dhd->pub, dhd_watchdog_ms);
+
+	/* Bring up the bus */
+	if ((ret = dhd_bus_init(&dhd->pub, FALSE)) != 0) {
+
+		DHD_ERROR(("%s, dhd_bus_init failed %d\n", __FUNCTION__, ret));
+		dhd_os_sdunlock(dhdp);
+		DHD_PERIM_UNLOCK(dhdp);
+		return ret;
+	}
+#if defined(OOB_INTR_ONLY) || defined(BCMPCIE_OOB_HOST_WAKE)
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+	dhd_os_sdunlock(dhdp);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+	/* Host registration for OOB interrupt */
+	if (dhd_bus_oob_intr_register(dhdp)) {
+		/* deactivate timer and wait for the handler to finish */
+#if !defined(BCMPCIE_OOB_HOST_WAKE)
+		DHD_GENERAL_LOCK(&dhd->pub, flags);
+		dhd->wd_timer_valid = FALSE;
+		DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+		del_timer_sync(&dhd->timer);
+
+		dhd_os_sdunlock(dhdp);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+		DHD_PERIM_UNLOCK(dhdp);
+		DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+		DHD_ERROR(("%s Host failed to register for OOB\n", __FUNCTION__));
+		return -ENODEV;
+	}
+
+#if defined(BCMPCIE_OOB_HOST_WAKE)
+	dhd_os_sdlock(dhdp);
+	dhd_bus_oob_intr_set(dhdp, TRUE);
+#else
+	/* Enable oob at firmware */
+	dhd_enable_oob_intr(dhd->pub.bus, TRUE);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#endif
+#ifdef PCIE_FULL_DONGLE
+	{
+		uint8 txpush = 0;
+		uint32 num_flowrings; /* includes H2D common rings */
+		num_flowrings = dhd_bus_max_h2d_queues(dhd->pub.bus, &txpush);
+		DHD_ERROR(("%s: Initializing %u flowrings\n", __FUNCTION__,
+			num_flowrings));
+		if ((ret = dhd_flow_rings_init(&dhd->pub, num_flowrings)) != BCME_OK) {
+			dhd_os_sdunlock(dhdp);
+			DHD_PERIM_UNLOCK(dhdp);
+			return ret;
+		}
+	}
+#endif /* PCIE_FULL_DONGLE */
+
+	/* Do protocol initialization necessary for IOCTL/IOVAR */
+	dhd_prot_init(&dhd->pub);
+
+	/* If bus is not ready, can't come up */
+	if (dhd->pub.busstate != DHD_BUS_DATA) {
+		DHD_GENERAL_LOCK(&dhd->pub, flags);
+		dhd->wd_timer_valid = FALSE;
+		DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+		del_timer_sync(&dhd->timer);
+		DHD_ERROR(("%s failed bus is not ready\n", __FUNCTION__));
+		dhd_os_sdunlock(dhdp);
+		DHD_PERIM_UNLOCK(dhdp);
+		DHD_OS_WD_WAKE_UNLOCK(&dhd->pub);
+		return -ENODEV;
+	}
+
+	dhd_os_sdunlock(dhdp);
+
+	/* Bus is ready, query any dongle information */
+	if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0) {
+		DHD_PERIM_UNLOCK(dhdp);
+		return ret;
+	}
+
+#ifdef ARP_OFFLOAD_SUPPORT
+	if (dhd->pend_ipaddr) {
+#ifdef AOE_IP_ALIAS_SUPPORT
+		aoe_update_host_ipv4_table(&dhd->pub, dhd->pend_ipaddr, TRUE, 0);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+		dhd->pend_ipaddr = 0;
+	}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+	DHD_PERIM_UNLOCK(dhdp);
+	return 0;
+}
+
+#ifdef WLTDLS
+int _dhd_tdls_enable(dhd_pub_t *dhd, bool tdls_on, bool auto_on, struct ether_addr *mac)
+{
+	char iovbuf[WLC_IOCTL_SMLEN];
+	uint32 tdls = tdls_on;
+	int ret = 0;
+	uint32 tdls_auto_op = 0;
+	uint32 tdls_idle_time = CUSTOM_TDLS_IDLE_MODE_SETTING;
+	int32 tdls_rssi_high = CUSTOM_TDLS_RSSI_THRESHOLD_HIGH;
+	int32 tdls_rssi_low = CUSTOM_TDLS_RSSI_THRESHOLD_LOW;
+	BCM_REFERENCE(mac);
+	if (!FW_SUPPORTED(dhd, tdls))
+		return BCME_ERROR;
+
+	if (dhd->tdls_enable == tdls_on)
+		goto auto_mode;
+	bcm_mkiovar("tdls_enable", (char *)&tdls, sizeof(tdls), iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s: tdls %d failed %d\n", __FUNCTION__, tdls, ret));
+		goto exit;
+	}
+	dhd->tdls_enable = tdls_on;
+auto_mode:
+
+	tdls_auto_op = auto_on;
+	bcm_mkiovar("tdls_auto_op", (char *)&tdls_auto_op, sizeof(tdls_auto_op),
+		iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s: tdls_auto_op failed %d\n", __FUNCTION__, ret));
+		goto exit;
+	}
+
+	if (tdls_auto_op) {
+		bcm_mkiovar("tdls_idle_time", (char *)&tdls_idle_time,
+			sizeof(tdls_idle_time),	iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s: tdls_idle_time failed %d\n", __FUNCTION__, ret));
+			goto exit;
+		}
+		bcm_mkiovar("tdls_rssi_high", (char *)&tdls_rssi_high, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s: tdls_rssi_high failed %d\n", __FUNCTION__, ret));
+			goto exit;
+		}
+		bcm_mkiovar("tdls_rssi_low", (char *)&tdls_rssi_low, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s: tdls_rssi_low failed %d\n", __FUNCTION__, ret));
+			goto exit;
+		}
+	}
+
+exit:
+	return ret;
+}
+
+int dhd_tdls_enable(struct net_device *dev, bool tdls_on, bool auto_on, struct ether_addr *mac)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+	if (dhd)
+		ret = _dhd_tdls_enable(&dhd->pub, tdls_on, auto_on, mac);
+	else
+		ret = BCME_ERROR;
+	return ret;
+}
+#ifdef PCIE_FULL_DONGLE
+void dhd_tdls_update_peer_info(struct net_device *dev, bool connect, uint8 *da)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	dhd_pub_t *dhdp =  (dhd_pub_t *)&dhd->pub;
+	tdls_peer_node_t *cur = dhdp->peer_tbl.node;
+	tdls_peer_node_t *new = NULL, *prev = NULL;
+	dhd_if_t *dhdif;
+	uint8 sa[ETHER_ADDR_LEN];
+	int ifidx = dhd_net2idx(dhd, dev);
+
+	if (ifidx == DHD_BAD_IF)
+		return;
+
+	dhdif = dhd->iflist[ifidx];
+	memcpy(sa, dhdif->mac_addr, ETHER_ADDR_LEN);
+
+	if (connect) {
+		while (cur != NULL) {
+			if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+				DHD_ERROR(("%s: TDLS Peer exist already %d\n",
+					__FUNCTION__, __LINE__));
+				return;
+			}
+			cur = cur->next;
+		}
+
+		new = MALLOC(dhdp->osh, sizeof(tdls_peer_node_t));
+		if (new == NULL) {
+			DHD_ERROR(("%s: Failed to allocate memory\n", __FUNCTION__));
+			return;
+		}
+		memcpy(new->addr, da, ETHER_ADDR_LEN);
+		new->next = dhdp->peer_tbl.node;
+		dhdp->peer_tbl.node = new;
+		dhdp->peer_tbl.tdls_peer_count++;
+
+	} else {
+		while (cur != NULL) {
+			if (!memcmp(da, cur->addr, ETHER_ADDR_LEN)) {
+				dhd_flow_rings_delete_for_peer(dhdp, ifidx, da);
+				if (prev)
+					prev->next = cur->next;
+				else
+					dhdp->peer_tbl.node = cur->next;
+				MFREE(dhdp->osh, cur, sizeof(tdls_peer_node_t));
+				dhdp->peer_tbl.tdls_peer_count--;
+				return;
+			}
+			prev = cur;
+			cur = cur->next;
+		}
+		DHD_ERROR(("%s: TDLS Peer Entry Not found\n", __FUNCTION__));
+	}
+}
+#endif /* PCIE_FULL_DONGLE */
+#endif
+
+bool dhd_is_concurrent_mode(dhd_pub_t *dhd)
+{
+	if (!dhd)
+		return FALSE;
+
+	if (dhd->op_mode & DHD_FLAG_CONCURR_MULTI_CHAN_MODE)
+		return TRUE;
+	else if ((dhd->op_mode & DHD_FLAG_CONCURR_SINGLE_CHAN_MODE) ==
+		DHD_FLAG_CONCURR_SINGLE_CHAN_MODE)
+		return TRUE;
+	else
+		return FALSE;
+}
+#if !defined(AP) && defined(WLP2P)
+/* From Android JerryBean release, the concurrent mode is enabled by default and the firmware
+ * name would be fw_bcmdhd.bin. So we need to determine whether P2P is enabled in the STA
+ * firmware and accordingly enable concurrent mode (Apply P2P settings). SoftAP firmware
+ * would still be named as fw_bcmdhd_apsta.
+ */
+uint32
+dhd_get_concurrent_capabilites(dhd_pub_t *dhd)
+{
+	int32 ret = 0;
+	char buf[WLC_IOCTL_SMLEN];
+	bool mchan_supported = FALSE;
+	/* if dhd->op_mode is already set for HOSTAP and Manufacturing
+	 * test mode, that means we only will use the mode as it is
+	 */
+	if (dhd->op_mode & (DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))
+		return 0;
+	if (FW_SUPPORTED(dhd, vsdb)) {
+		mchan_supported = TRUE;
+	}
+	if (!FW_SUPPORTED(dhd, p2p)) {
+		DHD_TRACE(("Chip does not support p2p\n"));
+		return 0;
+	}
+	else {
+		/* Chip supports p2p but ensure that p2p is really implemented in firmware or not */
+		memset(buf, 0, sizeof(buf));
+		bcm_mkiovar("p2p", 0, 0, buf, sizeof(buf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf),
+			FALSE, 0)) < 0) {
+			DHD_ERROR(("%s: Get P2P failed (error=%d)\n", __FUNCTION__, ret));
+			return 0;
+		}
+		else {
+			if (buf[0] == 1) {
+				/* By default, chip supports single chan concurrency,
+				* now lets check for mchan
+				*/
+				ret = DHD_FLAG_CONCURR_SINGLE_CHAN_MODE;
+				if (mchan_supported)
+					ret |= DHD_FLAG_CONCURR_MULTI_CHAN_MODE;
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF)
+				/* For customer_hw4, although ICS,
+				* we still support concurrent mode
+				*/
+				return ret;
+#else
+				return 0;
+#endif
+			}
+		}
+	}
+	return 0;
+}
+#endif
+
+#ifdef SUPPORT_AP_POWERSAVE
+#define RXCHAIN_PWRSAVE_PPS			10
+#define RXCHAIN_PWRSAVE_QUIET_TIME		10
+#define RXCHAIN_PWRSAVE_STAS_ASSOC_CHECK	0
+int dhd_set_ap_powersave(dhd_pub_t *dhdp, int ifidx, int enable)
+{
+	char iovbuf[128];
+	int32 pps = RXCHAIN_PWRSAVE_PPS;
+	int32 quiet_time = RXCHAIN_PWRSAVE_QUIET_TIME;
+	int32 stas_assoc_check = RXCHAIN_PWRSAVE_STAS_ASSOC_CHECK;
+
+	if (enable) {
+		bcm_mkiovar("rxchain_pwrsave_enable", (char *)&enable, 4, iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+		    iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+			DHD_ERROR(("Failed to enable AP power save\n"));
+		}
+		bcm_mkiovar("rxchain_pwrsave_pps", (char *)&pps, 4, iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+		    iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+			DHD_ERROR(("Failed to set pps\n"));
+		}
+		bcm_mkiovar("rxchain_pwrsave_quiet_time", (char *)&quiet_time,
+		4, iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+		    iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+			DHD_ERROR(("Failed to set quiet time\n"));
+		}
+		bcm_mkiovar("rxchain_pwrsave_stas_assoc_check", (char *)&stas_assoc_check,
+		4, iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+		    iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+			DHD_ERROR(("Failed to set stas assoc check\n"));
+		}
+	} else {
+		bcm_mkiovar("rxchain_pwrsave_enable", (char *)&enable, 4, iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR,
+		    iovbuf, sizeof(iovbuf), TRUE, 0) != BCME_OK) {
+			DHD_ERROR(("Failed to disable AP power save\n"));
+		}
+	}
+
+	return 0;
+}
+#endif /* SUPPORT_AP_POWERSAVE */
+
+
+#if defined(READ_CONFIG_FROM_FILE)
+#include <linux/fs.h>
+#include <linux/ctype.h>
+
+#define strtoul(nptr, endptr, base) bcm_strtoul((nptr), (endptr), (base))
+bool PM_control = TRUE;
+
+static int dhd_preinit_proc(dhd_pub_t *dhd, int ifidx, char *name, char *value)
+{
+	int var_int;
+	wl_country_t cspec = {{0}, -1, {0}};
+	char *revstr;
+	char *endptr = NULL;
+	int iolen;
+	char smbuf[WLC_IOCTL_SMLEN*2];
+
+	if (!strcmp(name, "country")) {
+		revstr = strchr(value, '/');
+		if (revstr) {
+			cspec.rev = strtoul(revstr + 1, &endptr, 10);
+			memcpy(cspec.country_abbrev, value, WLC_CNTRY_BUF_SZ);
+			cspec.country_abbrev[2] = '\0';
+			memcpy(cspec.ccode, cspec.country_abbrev, WLC_CNTRY_BUF_SZ);
+		} else {
+			cspec.rev = -1;
+			memcpy(cspec.country_abbrev, value, WLC_CNTRY_BUF_SZ);
+			memcpy(cspec.ccode, value, WLC_CNTRY_BUF_SZ);
+			get_customized_country_code(dhd->info->adapter,
+				(char *)&cspec.country_abbrev, &cspec);
+		}
+		memset(smbuf, 0, sizeof(smbuf));
+		DHD_ERROR(("config country code is country : %s, rev : %d !!\n",
+			cspec.country_abbrev, cspec.rev));
+		iolen = bcm_mkiovar("country", (char*)&cspec, sizeof(cspec),
+			smbuf, sizeof(smbuf));
+		return dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+			smbuf, iolen, TRUE, 0);
+	} else if (!strcmp(name, "roam_scan_period")) {
+		var_int = (int)simple_strtol(value, NULL, 0);
+		return dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_SCAN_PERIOD,
+			&var_int, sizeof(var_int), TRUE, 0);
+	} else if (!strcmp(name, "roam_delta")) {
+		struct {
+			int val;
+			int band;
+		} x;
+		x.val = (int)simple_strtol(value, NULL, 0);
+		/* x.band = WLC_BAND_AUTO; */
+		x.band = WLC_BAND_ALL;
+		return dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_DELTA, &x, sizeof(x), TRUE, 0);
+	} else if (!strcmp(name, "roam_trigger")) {
+		int ret = 0;
+
+		roam_trigger[0] = (int)simple_strtol(value, NULL, 0);
+		roam_trigger[1] = WLC_BAND_ALL;
+		ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_TRIGGER, &roam_trigger,
+			sizeof(roam_trigger), TRUE, 0);
+
+		return ret;
+	} else if (!strcmp(name, "PM")) {
+		int ret = 0;
+		var_int = (int)simple_strtol(value, NULL, 0);
+
+		ret =  dhd_wl_ioctl_cmd(dhd, WLC_SET_PM,
+			&var_int, sizeof(var_int), TRUE, 0);
+
+#if defined(CONFIG_PM_LOCK)
+		if (var_int == 0) {
+			g_pm_control = TRUE;
+			printk("%s var_int=%d don't control PM\n", __func__, var_int);
+		} else {
+			g_pm_control = FALSE;
+			printk("%s var_int=%d do control PM\n", __func__, var_int);
+		}
+#endif
+
+		return ret;
+	}
+#ifdef WLBTAMP
+	else if (!strcmp(name, "btamp_chan")) {
+		int btamp_chan;
+		int iov_len = 0;
+		char iovbuf[128];
+		int ret;
+
+		btamp_chan = (int)simple_strtol(value, NULL, 0);
+		iov_len = bcm_mkiovar("btamp_chan", (char *)&btamp_chan, 4, iovbuf, sizeof(iovbuf));
+		if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, iov_len, TRUE, 0) < 0))
+			DHD_ERROR(("%s btamp_chan=%d set failed code %d\n",
+				__FUNCTION__, btamp_chan, ret));
+		else
+			DHD_ERROR(("%s btamp_chan %d set success\n",
+				__FUNCTION__, btamp_chan));
+	}
+#endif /* WLBTAMP */
+	else if (!strcmp(name, "band")) {
+		int ret;
+		if (!strcmp(value, "auto"))
+			var_int = WLC_BAND_AUTO;
+		else if (!strcmp(value, "a"))
+			var_int = WLC_BAND_5G;
+		else if (!strcmp(value, "b"))
+			var_int = WLC_BAND_2G;
+		else if (!strcmp(value, "all"))
+			var_int = WLC_BAND_ALL;
+		else {
+			printk(" set band value should be one of the a or b or all\n");
+			var_int = WLC_BAND_AUTO;
+		}
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_BAND, &var_int,
+			sizeof(var_int), TRUE, 0)) < 0)
+			printk(" set band err=%d\n", ret);
+		return ret;
+	} else if (!strcmp(name, "cur_etheraddr")) {
+		struct ether_addr ea;
+		char buf[32];
+		uint iovlen;
+		int ret;
+
+		bcm_ether_atoe(value, &ea);
+
+		ret = memcmp(&ea.octet, dhd->mac.octet, ETHER_ADDR_LEN);
+		if (ret == 0) {
+			DHD_ERROR(("%s: Same Macaddr\n", __FUNCTION__));
+			return 0;
+		}
+
+		DHD_ERROR(("%s: Change Macaddr = %02X:%02X:%02X:%02X:%02X:%02X\n", __FUNCTION__,
+			ea.octet[0], ea.octet[1], ea.octet[2],
+			ea.octet[3], ea.octet[4], ea.octet[5]));
+
+		iovlen = bcm_mkiovar("cur_etheraddr", (char*)&ea, ETHER_ADDR_LEN, buf, 32);
+
+		ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, iovlen, TRUE, 0);
+		if (ret < 0) {
+			DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+			return ret;
+		}
+		else {
+			memcpy(dhd->mac.octet, (void *)&ea, ETHER_ADDR_LEN);
+			return ret;
+		}
+	} else if (!strcmp(name, "lpc")) {
+		int ret = 0;
+		char buf[32];
+		uint iovlen;
+		var_int = (int)simple_strtol(value, NULL, 0);
+		if (dhd_wl_ioctl_cmd(dhd, WLC_DOWN, NULL, 0, TRUE, 0) < 0) {
+			DHD_ERROR(("%s: wl down failed\n", __FUNCTION__));
+		}
+		iovlen = bcm_mkiovar("lpc", (char *)&var_int, 4, buf, sizeof(buf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, iovlen, TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set lpc failed  %d\n", __FUNCTION__, ret));
+		}
+		if (dhd_wl_ioctl_cmd(dhd, WLC_UP, NULL, 0, TRUE, 0) < 0) {
+			DHD_ERROR(("%s: wl up failed\n", __FUNCTION__));
+		}
+		return ret;
+	} else if (!strcmp(name, "vht_features")) {
+		int ret = 0;
+		char buf[32];
+		uint iovlen;
+		var_int = (int)simple_strtol(value, NULL, 0);
+
+		if (dhd_wl_ioctl_cmd(dhd, WLC_DOWN, NULL, 0, TRUE, 0) < 0) {
+			DHD_ERROR(("%s: wl down failed\n", __FUNCTION__));
+		}
+		iovlen = bcm_mkiovar("vht_features", (char *)&var_int, 4, buf, sizeof(buf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, iovlen, TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set vht_features failed  %d\n", __FUNCTION__, ret));
+		}
+		if (dhd_wl_ioctl_cmd(dhd, WLC_UP, NULL, 0, TRUE, 0) < 0) {
+			DHD_ERROR(("%s: wl up failed\n", __FUNCTION__));
+		}
+		return ret;
+	} else {
+		uint iovlen;
+		char iovbuf[WLC_IOCTL_SMLEN];
+
+		/* wlu_iovar_setint */
+		var_int = (int)simple_strtol(value, NULL, 0);
+
+		/* Setup timeout bcn_timeout from dhd driver 4.217.48 */
+		if (!strcmp(name, "roam_off")) {
+			/* Setup timeout if Beacons are lost to report link down */
+			if (var_int) {
+				uint bcn_timeout = 2;
+				bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4,
+					iovbuf, sizeof(iovbuf));
+				dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			}
+		}
+		/* Setup timeout bcm_timeout from dhd driver 4.217.48 */
+
+		DHD_INFO(("%s:[%s]=[%d]\n", __FUNCTION__, name, var_int));
+
+		iovlen = bcm_mkiovar(name, (char *)&var_int, sizeof(var_int),
+			iovbuf, sizeof(iovbuf));
+		return dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+			iovbuf, iovlen, TRUE, 0);
+	}
+
+	return 0;
+}
+
+static int dhd_preinit_config(dhd_pub_t *dhd, int ifidx)
+{
+	mm_segment_t old_fs;
+	struct kstat stat;
+	struct file *fp = NULL;
+	unsigned int len;
+	char *buf = NULL, *p, *name, *value;
+	int ret = 0;
+	char *config_path;
+
+	config_path = CONFIG_BCMDHD_CONFIG_PATH;
+
+	if (!config_path)
+	{
+		printk(KERN_ERR "config_path can't read. \n");
+		return 0;
+	}
+
+	old_fs = get_fs();
+	set_fs(get_ds());
+	if ((ret = vfs_stat(config_path, &stat))) {
+		set_fs(old_fs);
+		printk(KERN_ERR "%s: Failed to get information (%d)\n",
+			config_path, ret);
+		return ret;
+	}
+	set_fs(old_fs);
+
+	if (!(buf = MALLOC(dhd->osh, stat.size + 1))) {
+		printk(KERN_ERR "Failed to allocate memory %llu bytes\n", stat.size);
+		return -ENOMEM;
+	}
+
+	printk("dhd_preinit_config : config path : %s \n", config_path);
+
+	if (!(fp = dhd_os_open_image(config_path)) ||
+		(len = dhd_os_get_image_block(buf, stat.size, fp)) < 0)
+		goto err;
+
+	buf[stat.size] = '\0';
+	for (p = buf; *p; p++) {
+		if (isspace(*p))
+			continue;
+		for (name = p++; *p && !isspace(*p); p++) {
+			if (*p == '=') {
+				*p = '\0';
+				p++;
+				for (value = p; *p && !isspace(*p); p++);
+				*p = '\0';
+				if ((ret = dhd_preinit_proc(dhd, ifidx, name, value)) < 0) {
+					printk(KERN_ERR "%s: %s=%s\n",
+						bcmerrorstr(ret), name, value);
+				}
+				break;
+			}
+		}
+	}
+	ret = 0;
+
+out:
+	if (fp)
+		dhd_os_close_image(fp);
+	if (buf)
+		MFREE(dhd->osh, buf, stat.size+1);
+	return ret;
+
+err:
+	ret = -1;
+	goto out;
+}
+#endif /* READ_CONFIG_FROM_FILE */
+
+int
+dhd_preinit_ioctls(dhd_pub_t *dhd)
+{
+	int ret = 0;
+	char eventmask[WL_EVENTING_MASK_LEN];
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/*  Room for "event_msgs" + '\0' + bitvec  */
+	uint32 buf_key_b4_m4 = 1;
+#ifndef WL_CFG80211
+	u32 up = 0;
+#endif
+	uint8 msglen;
+	eventmsgs_ext_t *eventmask_msg = NULL;
+	char* iov_buf = NULL;
+	int ret2 = 0;
+#ifdef WLAIBSS
+	aibss_bcn_force_config_t bcn_config;
+	uint32 aibss;
+#ifdef WLAIBSS_PS
+	uint32 aibss_ps;
+#endif /* WLAIBSS_PS */
+#endif /* WLAIBSS */
+#if defined(BCMSUP_4WAY_HANDSHAKE) && defined(WLAN_AKM_SUITE_FT_8021X)
+	uint32 sup_wpa = 0;
+#endif
+#if defined(CUSTOM_AMPDU_BA_WSIZE) || (defined(WLAIBSS) && \
+	defined(CUSTOM_IBSS_AMPDU_BA_WSIZE))
+	uint32 ampdu_ba_wsize = 0;
+#endif /* CUSTOM_AMPDU_BA_WSIZE ||(WLAIBSS && CUSTOM_IBSS_AMPDU_BA_WSIZE) */
+#if defined(CUSTOM_AMPDU_MPDU)
+	int32 ampdu_mpdu = 0;
+#endif
+#if defined(CUSTOM_AMPDU_RELEASE)
+	int32 ampdu_release = 0;
+#endif
+#if defined(CUSTOM_AMSDU_AGGSF)
+	int32 amsdu_aggsf = 0;
+#endif
+
+#if defined(BCMSDIO)
+#ifdef PROP_TXSTATUS
+	int wlfc_enable = TRUE;
+#ifndef DISABLE_11N
+	uint32 hostreorder = 1;
+	uint wl_down = 1;
+#endif /* DISABLE_11N */
+#endif /* PROP_TXSTATUS */
+#endif
+#ifdef PCIE_FULL_DONGLE
+	uint32 wl_ap_isolate;
+#endif /* PCIE_FULL_DONGLE */
+
+#ifdef DHD_ENABLE_LPC
+	uint32 lpc = 1;
+#endif /* DHD_ENABLE_LPC */
+	uint power_mode = PM_FAST;
+	uint32 dongle_align = DHD_SDALIGN;
+#if defined(BCMSDIO)
+	uint32 glom = CUSTOM_GLOM_SETTING;
+#endif /* defined(BCMSDIO) */
+#if defined(CUSTOMER_HW2) && defined(USE_WL_CREDALL)
+	uint32 credall = 1;
+#endif
+	uint bcn_timeout = dhd->conf->bcn_timeout;
+	uint retry_max = 3;
+#if defined(ARP_OFFLOAD_SUPPORT)
+	int arpoe = 1;
+#endif
+	int scan_assoc_time = DHD_SCAN_ASSOC_ACTIVE_TIME;
+	int scan_unassoc_time = DHD_SCAN_UNASSOC_ACTIVE_TIME;
+	int scan_passive_time = DHD_SCAN_PASSIVE_TIME;
+	char buf[WLC_IOCTL_SMLEN];
+	char *ptr;
+	uint32 listen_interval = CUSTOM_LISTEN_INTERVAL; /* Default Listen Interval in Beacons */
+#ifdef ROAM_ENABLE
+	uint roamvar = 0;
+	int roam_trigger[2] = {CUSTOM_ROAM_TRIGGER_SETTING, WLC_BAND_ALL};
+	int roam_scan_period[2] = {10, WLC_BAND_ALL};
+	int roam_delta[2] = {CUSTOM_ROAM_DELTA_SETTING, WLC_BAND_ALL};
+#ifdef FULL_ROAMING_SCAN_PERIOD_60_SEC
+	int roam_fullscan_period = 60;
+#else /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+	int roam_fullscan_period = 120;
+#endif /* FULL_ROAMING_SCAN_PERIOD_60_SEC */
+#else
+#ifdef DISABLE_BUILTIN_ROAM
+	uint roamvar = 1;
+#endif /* DISABLE_BUILTIN_ROAM */
+#endif /* ROAM_ENABLE */
+
+#if defined(SOFTAP)
+	uint dtim = 1;
+#endif
+#if (defined(AP) && !defined(WLP2P)) || (!defined(AP) && defined(WL_CFG80211))
+	uint32 mpc = 0; /* Turn MPC off for AP/APSTA mode */
+	struct ether_addr p2p_ea;
+#endif
+#ifdef BCMCCX
+	uint32 ccx = 1;
+#endif
+#ifdef SOFTAP_UAPSD_OFF
+	uint32 wme_apsd = 0;
+#endif /* SOFTAP_UAPSD_OFF */
+#if (defined(AP) || defined(WLP2P)) && !defined(SOFTAP_AND_GC)
+	uint32 apsta = 1; /* Enable APSTA mode */
+#elif defined(SOFTAP_AND_GC)
+	uint32 apsta = 0;
+	int ap_mode = 1;
+#endif /* (defined(AP) || defined(WLP2P)) && !defined(SOFTAP_AND_GC) */
+#ifdef GET_CUSTOM_MAC_ENABLE
+	struct ether_addr ea_addr;
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+#ifdef DISABLE_11N
+	uint32 nmode = 0;
+#endif /* DISABLE_11N */
+
+#if defined(DISABLE_11AC)
+	uint32 vhtmode = 0;
+#endif /* DISABLE_11AC */
+#ifdef USE_WL_TXBF
+	uint32 txbf = 1;
+#endif /* USE_WL_TXBF */
+#ifdef AMPDU_VO_ENABLE
+	struct ampdu_tid_control tid;
+#endif
+#ifdef USE_WL_FRAMEBURST
+	uint32 frameburst = 1;
+#endif /* USE_WL_FRAMEBURST */
+#ifdef DHD_SET_FW_HIGHSPEED
+	uint32 ack_ratio = 250;
+	uint32 ack_ratio_depth = 64;
+#endif /* DHD_SET_FW_HIGHSPEED */
+#ifdef SUPPORT_2G_VHT
+	uint32 vht_features = 0x3; /* 2G enable | rates all */
+#endif /* SUPPORT_2G_VHT */
+#ifdef CUSTOM_PSPRETEND_THR
+	uint32 pspretend_thr = CUSTOM_PSPRETEND_THR;
+#endif
+#ifdef PKT_FILTER_SUPPORT
+	dhd_pkt_filter_enable = TRUE;
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef WLTDLS
+	dhd->tdls_enable = FALSE;
+#endif /* WLTDLS */
+	dhd->suspend_bcn_li_dtim = CUSTOM_SUSPEND_BCN_LI_DTIM;
+	DHD_TRACE(("Enter %s\n", __FUNCTION__));
+
+	dhd_conf_set_band(dhd);
+	printf("%s: Set tcpack_sup_mode %d\n", __FUNCTION__, dhd->conf->tcpack_sup_mode);
+	dhd_tcpack_suppress_set(dhd, dhd->conf->tcpack_sup_mode);
+
+	dhd->op_mode = 0;
+	if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+		(op_mode == DHD_FLAG_MFG_MODE)) {
+		/* Check and adjust IOCTL response timeout for Manufactring firmware */
+		dhd_os_set_ioctl_resp_timeout(MFG_IOCTL_RESP_TIMEOUT);
+		DHD_ERROR(("%s : Set IOCTL response time for Manufactring Firmware\n",
+			__FUNCTION__));
+	}
+	else {
+		dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+		DHD_INFO(("%s : Set IOCTL response time.\n", __FUNCTION__));
+	}
+#ifdef GET_CUSTOM_MAC_ENABLE
+	ret = wifi_platform_get_mac_addr(dhd->info->adapter, ea_addr.octet);
+	if (!ret) {
+		memset(buf, 0, sizeof(buf));
+		bcm_mkiovar("cur_etheraddr", (void *)&ea_addr, ETHER_ADDR_LEN, buf, sizeof(buf));
+		ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+		if (ret < 0) {
+			DHD_ERROR(("%s: can't set MAC address MAC="MACDBG", error=%d\n",
+				__FUNCTION__, MAC2STRDBG(ea_addr.octet), ret));
+			ret = BCME_NOTUP;
+			goto done;
+		}
+		memcpy(dhd->mac.octet, ea_addr.octet, ETHER_ADDR_LEN);
+	} else {
+#endif /* GET_CUSTOM_MAC_ENABLE */
+		/* Get the default device MAC address directly from firmware */
+		memset(buf, 0, sizeof(buf));
+		bcm_mkiovar("cur_etheraddr", 0, 0, buf, sizeof(buf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf),
+			FALSE, 0)) < 0) {
+			DHD_ERROR(("%s: can't get MAC address , error=%d\n", __FUNCTION__, ret));
+			ret = BCME_NOTUP;
+			goto done;
+		}
+		/* Update public MAC address after reading from Firmware */
+		memcpy(dhd->mac.octet, buf, ETHER_ADDR_LEN);
+
+#ifdef GET_CUSTOM_MAC_ENABLE
+	}
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+	/* get a capabilities from firmware */
+	memset(dhd->fw_capabilities, 0, sizeof(dhd->fw_capabilities));
+	bcm_mkiovar("cap", 0, 0, dhd->fw_capabilities, sizeof(dhd->fw_capabilities));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, dhd->fw_capabilities,
+		sizeof(dhd->fw_capabilities), FALSE, 0)) < 0) {
+		DHD_ERROR(("%s: Get Capability failed (error=%d)\n",
+			__FUNCTION__, ret));
+		goto done;
+	}
+	if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_HOSTAP_MODE) ||
+		(op_mode == DHD_FLAG_HOSTAP_MODE)) {
+#ifdef SET_RANDOM_MAC_SOFTAP
+		uint rand_mac;
+#endif
+		dhd->op_mode = DHD_FLAG_HOSTAP_MODE;
+#if defined(ARP_OFFLOAD_SUPPORT)
+			arpoe = 0;
+#endif
+#ifdef PKT_FILTER_SUPPORT
+			dhd_pkt_filter_enable = FALSE;
+#endif
+#ifdef SET_RANDOM_MAC_SOFTAP
+		SRANDOM32((uint)jiffies);
+		rand_mac = RANDOM32();
+		iovbuf[0] = 0x02;			   /* locally administered bit */
+		iovbuf[1] = 0x1A;
+		iovbuf[2] = 0x11;
+		iovbuf[3] = (unsigned char)(rand_mac & 0x0F) | 0xF0;
+		iovbuf[4] = (unsigned char)(rand_mac >> 8);
+		iovbuf[5] = (unsigned char)(rand_mac >> 16);
+
+		bcm_mkiovar("cur_etheraddr", (void *)iovbuf, ETHER_ADDR_LEN, buf, sizeof(buf));
+		ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+		if (ret < 0) {
+			DHD_ERROR(("%s: can't set MAC address , error=%d\n", __FUNCTION__, ret));
+		} else
+			memcpy(dhd->mac.octet, iovbuf, ETHER_ADDR_LEN);
+#endif /* SET_RANDOM_MAC_SOFTAP */
+#if !defined(AP) && defined(WL_CFG80211)
+		/* Turn off MPC in AP mode */
+		bcm_mkiovar("mpc", (char *)&mpc, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s mpc for HostAPD failed  %d\n", __FUNCTION__, ret));
+		}
+#endif
+#ifdef SUPPORT_AP_POWERSAVE
+		dhd_set_ap_powersave(dhd, 0, TRUE);
+#endif
+#ifdef SOFTAP_UAPSD_OFF
+		bcm_mkiovar("wme_apsd", (char *)&wme_apsd, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			DHD_ERROR(("%s: set wme_apsd 0 fail (error=%d)\n", __FUNCTION__, ret));
+#endif /* SOFTAP_UAPSD_OFF */
+	} else if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_MFG_MODE) ||
+		(op_mode == DHD_FLAG_MFG_MODE)) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+		arpoe = 0;
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef PKT_FILTER_SUPPORT
+		dhd_pkt_filter_enable = FALSE;
+#endif /* PKT_FILTER_SUPPORT */
+		dhd->op_mode = DHD_FLAG_MFG_MODE;
+	} else {
+		uint32 concurrent_mode = 0;
+		if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_P2P_MODE) ||
+			(op_mode == DHD_FLAG_P2P_MODE)) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+			arpoe = 0;
+#endif
+#ifdef PKT_FILTER_SUPPORT
+			dhd_pkt_filter_enable = FALSE;
+#endif
+			dhd->op_mode = DHD_FLAG_P2P_MODE;
+		} else if ((!op_mode && dhd_get_fw_mode(dhd->info) == DHD_FLAG_IBSS_MODE) ||
+			(op_mode == DHD_FLAG_IBSS_MODE)) {
+			dhd->op_mode = DHD_FLAG_IBSS_MODE;
+		} else
+			dhd->op_mode = DHD_FLAG_STA_MODE;
+#if !defined(AP) && defined(WLP2P)
+		if (dhd->op_mode != DHD_FLAG_IBSS_MODE &&
+			(concurrent_mode = dhd_get_concurrent_capabilites(dhd))) {
+#if defined(ARP_OFFLOAD_SUPPORT)
+			arpoe = 1;
+#endif
+			dhd->op_mode |= concurrent_mode;
+		}
+
+		/* Check if we are enabling p2p */
+		if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+			bcm_mkiovar("apsta", (char *)&apsta, 4, iovbuf, sizeof(iovbuf));
+			if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+				iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+				DHD_ERROR(("%s APSTA for P2P failed ret= %d\n", __FUNCTION__, ret));
+			}
+
+#if defined(SOFTAP_AND_GC)
+			if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_AP,
+				(char *)&ap_mode, sizeof(ap_mode), TRUE, 0)) < 0) {
+					DHD_ERROR(("%s WLC_SET_AP failed %d\n", __FUNCTION__, ret));
+			}
+#endif
+			memcpy(&p2p_ea, &dhd->mac, ETHER_ADDR_LEN);
+			ETHER_SET_LOCALADDR(&p2p_ea);
+			bcm_mkiovar("p2p_da_override", (char *)&p2p_ea,
+				ETHER_ADDR_LEN, iovbuf, sizeof(iovbuf));
+			if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+				iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+				DHD_ERROR(("%s p2p_da_override ret= %d\n", __FUNCTION__, ret));
+			} else {
+				DHD_INFO(("dhd_preinit_ioctls: p2p_da_override succeeded\n"));
+			}
+		}
+#else
+		(void)concurrent_mode;
+#endif
+	}
+
+	DHD_ERROR(("Firmware up: op_mode=0x%04x, MAC="MACDBG"\n",
+		dhd->op_mode, MAC2STRDBG(dhd->mac.octet)));
+	/* Set Country code  */
+	if (dhd->dhd_cspec.ccode[0] != 0) {
+		printf("Set country %s, revision %d\n", dhd->dhd_cspec.ccode, dhd->dhd_cspec.rev);
+		bcm_mkiovar("country", (char *)&dhd->dhd_cspec,
+			sizeof(wl_country_t), iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			printf("%s: country code setting failed %d\n", __FUNCTION__, ret);
+	} else {
+		dhd_conf_set_country(dhd);
+		dhd_conf_fix_country(dhd);
+	}
+	dhd_conf_get_country(dhd, &dhd->dhd_cspec);
+
+#if defined(DISABLE_11AC)
+	bcm_mkiovar("vhtmode", (char *)&vhtmode, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+		DHD_ERROR(("%s wl vhtmode 0 failed %d\n", __FUNCTION__, ret));
+#endif /* DISABLE_11AC */
+
+	/* Set Listen Interval */
+	bcm_mkiovar("assoc_listen", (char *)&listen_interval, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+		DHD_ERROR(("%s assoc_listen failed %d\n", __FUNCTION__, ret));
+
+#if defined(ROAM_ENABLE) || defined(DISABLE_BUILTIN_ROAM)
+	/* Disable built-in roaming to allowed ext supplicant to take care of roaming */
+	bcm_mkiovar("roam_off", (char *)&roamvar, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* ROAM_ENABLE || DISABLE_BUILTIN_ROAM */
+#if defined(ROAM_ENABLE)
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_TRIGGER, roam_trigger,
+		sizeof(roam_trigger), TRUE, 0)) < 0)
+		DHD_ERROR(("%s: roam trigger set failed %d\n", __FUNCTION__, ret));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_SCAN_PERIOD, roam_scan_period,
+		sizeof(roam_scan_period), TRUE, 0)) < 0)
+		DHD_ERROR(("%s: roam scan period set failed %d\n", __FUNCTION__, ret));
+	if ((dhd_wl_ioctl_cmd(dhd, WLC_SET_ROAM_DELTA, roam_delta,
+		sizeof(roam_delta), TRUE, 0)) < 0)
+		DHD_ERROR(("%s: roam delta set failed %d\n", __FUNCTION__, ret));
+	bcm_mkiovar("fullroamperiod", (char *)&roam_fullscan_period, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+		DHD_ERROR(("%s: roam fullscan period set failed %d\n", __FUNCTION__, ret));
+#endif /* ROAM_ENABLE */
+	dhd_conf_set_roam(dhd);
+
+#ifdef BCMCCX
+	bcm_mkiovar("ccx_enable", (char *)&ccx, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* BCMCCX */
+#ifdef WLTDLS
+	/* by default TDLS on and auto mode off */
+	_dhd_tdls_enable(dhd, true, false, NULL);
+#endif /* WLTDLS */
+
+#ifdef DHD_ENABLE_LPC
+	/* Set lpc 1 */
+	bcm_mkiovar("lpc", (char *)&lpc, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set lpc failed  %d\n", __FUNCTION__, ret));
+	}
+#endif /* DHD_ENABLE_LPC */
+	dhd_conf_set_lpc(dhd);
+
+	/* Set PowerSave mode */
+	if (dhd->conf->pm >= 0)
+		power_mode = dhd->conf->pm;
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_PM, (char *)&power_mode, sizeof(power_mode), TRUE, 0);
+
+	/* Match Host and Dongle rx alignment */
+	bcm_mkiovar("bus:txglomalign", (char *)&dongle_align, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+#if defined(CUSTOMER_HW2) && defined(USE_WL_CREDALL)
+	/* enable credall to reduce the chance of no bus credit happened. */
+	bcm_mkiovar("bus:credall", (char *)&credall, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif
+
+#if defined(BCMSDIO)
+	if (glom != DEFAULT_GLOM_VALUE) {
+		DHD_INFO(("%s set glom=0x%X\n", __FUNCTION__, glom));
+		bcm_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
+		dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+	}
+#endif /* defined(BCMSDIO) */
+	dhd_conf_set_bus_txglom(dhd);
+
+	/* Setup timeout if Beacons are lost and roam is off to report link down */
+	bcm_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+	/* Setup assoc_retry_max count to reconnect target AP in dongle */
+	bcm_mkiovar("assoc_retry_max", (char *)&retry_max, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#if defined(AP) && !defined(WLP2P)
+	/* Turn off MPC in AP mode */
+	bcm_mkiovar("mpc", (char *)&mpc, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+	bcm_mkiovar("apsta", (char *)&apsta, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif /* defined(AP) && !defined(WLP2P) */
+	dhd_conf_set_mimo_bw_cap(dhd);
+	dhd_conf_force_wme(dhd);
+	dhd_conf_set_stbc(dhd);
+	dhd_conf_set_srl(dhd);
+	dhd_conf_set_lrl(dhd);
+	dhd_conf_set_spect(dhd);
+
+#if defined(SOFTAP)
+	if (ap_fw_loaded == TRUE) {
+		dhd_wl_ioctl_cmd(dhd, WLC_SET_DTIMPRD, (char *)&dtim, sizeof(dtim), TRUE, 0);
+	}
+#endif
+
+#if defined(KEEP_ALIVE)
+	{
+	/* Set Keep Alive : be sure to use FW with -keepalive */
+	int res;
+
+#if defined(SOFTAP)
+	if (ap_fw_loaded == FALSE)
+#endif
+		if (!(dhd->op_mode &
+			(DHD_FLAG_HOSTAP_MODE | DHD_FLAG_MFG_MODE))) {
+			if ((res = dhd_keep_alive_onoff(dhd)) < 0)
+				DHD_ERROR(("%s set keeplive failed %d\n",
+				__FUNCTION__, res));
+		}
+	}
+#endif /* defined(KEEP_ALIVE) */
+
+#ifdef USE_WL_TXBF
+	bcm_mkiovar("txbf", (char *)&txbf, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set txbf failed  %d\n", __FUNCTION__, ret));
+	}
+#endif /* USE_WL_TXBF */
+	dhd_conf_set_txbf(dhd);
+#ifdef USE_WL_FRAMEBURST
+	/* Set frameburst to value */
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_FAKEFRAG, (char *)&frameburst,
+		sizeof(frameburst), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set frameburst failed  %d\n", __FUNCTION__, ret));
+	}
+#endif /* USE_WL_FRAMEBURST */
+	dhd_conf_set_frameburst(dhd);
+#ifdef DHD_SET_FW_HIGHSPEED
+	/* Set ack_ratio */
+	bcm_mkiovar("ack_ratio", (char *)&ack_ratio, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set ack_ratio failed  %d\n", __FUNCTION__, ret));
+	}
+
+	/* Set ack_ratio_depth */
+	bcm_mkiovar("ack_ratio_depth", (char *)&ack_ratio_depth, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set ack_ratio_depth failed  %d\n", __FUNCTION__, ret));
+	}
+#endif /* DHD_SET_FW_HIGHSPEED */
+#if defined(CUSTOM_AMPDU_BA_WSIZE) || (defined(WLAIBSS) && \
+	defined(CUSTOM_IBSS_AMPDU_BA_WSIZE))
+	/* Set ampdu ba wsize to 64 or 16 */
+#ifdef CUSTOM_AMPDU_BA_WSIZE
+	ampdu_ba_wsize = CUSTOM_AMPDU_BA_WSIZE;
+#endif
+#if defined(WLAIBSS) && defined(CUSTOM_IBSS_AMPDU_BA_WSIZE)
+	if (dhd->op_mode == DHD_FLAG_IBSS_MODE)
+		ampdu_ba_wsize = CUSTOM_IBSS_AMPDU_BA_WSIZE;
+#endif /* WLAIBSS && CUSTOM_IBSS_AMPDU_BA_WSIZE */
+	if (ampdu_ba_wsize != 0) {
+		bcm_mkiovar("ampdu_ba_wsize", (char *)&ampdu_ba_wsize, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set ampdu_ba_wsize to %d failed  %d\n",
+				__FUNCTION__, ampdu_ba_wsize, ret));
+		}
+	}
+#endif /* CUSTOM_AMPDU_BA_WSIZE || (WLAIBSS && CUSTOM_IBSS_AMPDU_BA_WSIZE) */
+	dhd_conf_set_ampdu_ba_wsize(dhd);
+
+	iov_buf = (char*)kmalloc(WLC_IOCTL_SMLEN, GFP_KERNEL);
+	if (iov_buf == NULL) {
+		DHD_ERROR(("failed to allocate %d bytes for iov_buf\n", WLC_IOCTL_SMLEN));
+		ret = BCME_NOMEM;
+		goto done;
+	}
+#ifdef WLAIBSS
+	/* Configure custom IBSS beacon transmission */
+	if (dhd->op_mode & DHD_FLAG_IBSS_MODE)
+	{
+		aibss = 1;
+		bcm_mkiovar("aibss", (char *)&aibss, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set aibss to %d failed  %d\n",
+				__FUNCTION__, aibss, ret));
+		}
+#ifdef WLAIBSS_PS
+		aibss_ps = 1;
+		bcm_mkiovar("aibss_ps", (char *)&aibss_ps, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set aibss PS to %d failed  %d\n",
+				__FUNCTION__, aibss, ret));
+		}
+#endif /* WLAIBSS_PS */
+	}
+	memset(&bcn_config, 0, sizeof(bcn_config));
+	bcn_config.initial_min_bcn_dur = AIBSS_INITIAL_MIN_BCN_DUR;
+	bcn_config.min_bcn_dur = AIBSS_MIN_BCN_DUR;
+	bcn_config.bcn_flood_dur = AIBSS_BCN_FLOOD_DUR;
+	bcn_config.version = AIBSS_BCN_FORCE_CONFIG_VER_0;
+	bcn_config.len = sizeof(bcn_config);
+
+	bcm_mkiovar("aibss_bcn_force_config", (char *)&bcn_config,
+		sizeof(aibss_bcn_force_config_t), iov_buf, WLC_IOCTL_SMLEN);
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iov_buf,
+		WLC_IOCTL_SMLEN, TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set aibss_bcn_force_config to %d, %d, %d failed %d\n",
+			__FUNCTION__, AIBSS_INITIAL_MIN_BCN_DUR, AIBSS_MIN_BCN_DUR,
+			AIBSS_BCN_FLOOD_DUR, ret));
+	}
+#endif /* WLAIBSS */
+
+#if defined(CUSTOM_AMPDU_MPDU)
+	ampdu_mpdu = CUSTOM_AMPDU_MPDU;
+	if (ampdu_mpdu != 0 && (ampdu_mpdu <= ampdu_ba_wsize)) {
+		bcm_mkiovar("ampdu_mpdu", (char *)&ampdu_mpdu, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set ampdu_mpdu to %d failed  %d\n",
+				__FUNCTION__, CUSTOM_AMPDU_MPDU, ret));
+		}
+	}
+#endif /* CUSTOM_AMPDU_MPDU */
+
+#if defined(CUSTOM_AMPDU_RELEASE)
+	ampdu_release = CUSTOM_AMPDU_RELEASE;
+	if (ampdu_release != 0 && (ampdu_release <= ampdu_ba_wsize)) {
+		bcm_mkiovar("ampdu_release", (char *)&ampdu_release, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set ampdu_release to %d failed  %d\n",
+				__FUNCTION__, CUSTOM_AMPDU_RELEASE, ret));
+		}
+	}
+#endif /* CUSTOM_AMPDU_RELEASE */
+
+#if defined(CUSTOM_AMSDU_AGGSF)
+	amsdu_aggsf = CUSTOM_AMSDU_AGGSF;
+	if (amsdu_aggsf != 0) {
+		bcm_mkiovar("amsdu_aggsf", (char *)&amsdu_aggsf, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+			sizeof(iovbuf), TRUE, 0)) < 0) {
+			DHD_ERROR(("%s Set amsdu_aggsf to %d failed  %d\n",
+				__FUNCTION__, CUSTOM_AMSDU_AGGSF, ret));
+		}
+	}
+#endif /* CUSTOM_AMSDU_AGGSF */
+
+#if defined(BCMSUP_4WAY_HANDSHAKE) && defined(WLAN_AKM_SUITE_FT_8021X)
+	/* Read 4-way handshake requirements */
+	if (dhd_use_idsup == 1) {
+		bcm_mkiovar("sup_wpa", (char *)&sup_wpa, 4, iovbuf, sizeof(iovbuf));
+		ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+		/* sup_wpa iovar returns NOTREADY status on some platforms using modularized
+		 * in-dongle supplicant.
+		 */
+		if (ret >= 0 || ret == BCME_NOTREADY)
+			dhd->fw_4way_handshake = TRUE;
+		DHD_TRACE(("4-way handshake mode is: %d\n", dhd->fw_4way_handshake));
+	}
+#endif /* BCMSUP_4WAY_HANDSHAKE && WLAN_AKM_SUITE_FT_8021X */
+#ifdef SUPPORT_2G_VHT
+	bcm_mkiovar("vht_features", (char *)&vht_features, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s vht_features set failed %d\n", __FUNCTION__, ret));
+	}
+#endif /* SUPPORT_2G_VHT */
+#ifdef CUSTOM_PSPRETEND_THR
+	/* Turn off MPC in AP mode */
+	bcm_mkiovar("pspretend_threshold", (char *)&pspretend_thr, 4,
+		iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s pspretend_threshold for HostAPD failed  %d\n",
+			__FUNCTION__, ret));
+	}
+#endif
+
+	bcm_mkiovar("buf_key_b4_m4", (char *)&buf_key_b4_m4, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf,
+		sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s buf_key_b4_m4 set failed %d\n", __FUNCTION__, ret));
+	}
+
+	/* Read event_msgs mask */
+	bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf, sizeof(iovbuf));
+	if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0)) < 0) {
+		DHD_ERROR(("%s read Event mask failed %d\n", __FUNCTION__, ret));
+		goto done;
+	}
+	bcopy(iovbuf, eventmask, WL_EVENTING_MASK_LEN);
+
+	/* Setup event_msgs */
+	setbit(eventmask, WLC_E_SET_SSID);
+	setbit(eventmask, WLC_E_PRUNE);
+	setbit(eventmask, WLC_E_AUTH);
+	setbit(eventmask, WLC_E_AUTH_IND);
+	setbit(eventmask, WLC_E_ASSOC);
+	setbit(eventmask, WLC_E_REASSOC);
+	setbit(eventmask, WLC_E_REASSOC_IND);
+	setbit(eventmask, WLC_E_DEAUTH);
+	setbit(eventmask, WLC_E_DEAUTH_IND);
+	setbit(eventmask, WLC_E_DISASSOC_IND);
+	setbit(eventmask, WLC_E_DISASSOC);
+	setbit(eventmask, WLC_E_JOIN);
+	setbit(eventmask, WLC_E_START);
+	setbit(eventmask, WLC_E_ASSOC_IND);
+	setbit(eventmask, WLC_E_PSK_SUP);
+	setbit(eventmask, WLC_E_LINK);
+	setbit(eventmask, WLC_E_NDIS_LINK);
+	setbit(eventmask, WLC_E_MIC_ERROR);
+	setbit(eventmask, WLC_E_ASSOC_REQ_IE);
+	setbit(eventmask, WLC_E_ASSOC_RESP_IE);
+#ifndef WL_CFG80211
+	setbit(eventmask, WLC_E_PMKID_CACHE);
+	setbit(eventmask, WLC_E_TXFAIL);
+#endif
+	setbit(eventmask, WLC_E_JOIN_START);
+	setbit(eventmask, WLC_E_SCAN_COMPLETE);
+#ifdef WLMEDIA_HTSF
+	setbit(eventmask, WLC_E_HTSFSYNC);
+#endif /* WLMEDIA_HTSF */
+#ifdef PNO_SUPPORT
+	setbit(eventmask, WLC_E_PFN_NET_FOUND);
+	setbit(eventmask, WLC_E_PFN_BEST_BATCHING);
+	setbit(eventmask, WLC_E_PFN_BSSID_NET_FOUND);
+	setbit(eventmask, WLC_E_PFN_BSSID_NET_LOST);
+#endif /* PNO_SUPPORT */
+	/* enable dongle roaming event */
+	setbit(eventmask, WLC_E_ROAM);
+	setbit(eventmask, WLC_E_BSSID);
+#ifdef BCMCCX
+	setbit(eventmask, WLC_E_ADDTS_IND);
+	setbit(eventmask, WLC_E_DELTS_IND);
+#endif /* BCMCCX */
+#ifdef WLTDLS
+	setbit(eventmask, WLC_E_TDLS_PEER_EVENT);
+#endif /* WLTDLS */
+#ifdef WL_CFG80211
+	setbit(eventmask, WLC_E_ESCAN_RESULT);
+	if (dhd->op_mode & DHD_FLAG_P2P_MODE) {
+		setbit(eventmask, WLC_E_ACTION_FRAME_RX);
+		setbit(eventmask, WLC_E_P2P_DISC_LISTEN_COMPLETE);
+	}
+#endif /* WL_CFG80211 */
+#ifdef WLAIBSS
+	setbit(eventmask, WLC_E_AIBSS_TXFAIL);
+#endif /* WLAIBSS */
+#ifdef CUSTOMER_HW10
+	clrbit(eventmask, WLC_E_TRACE);
+#else
+	setbit(eventmask, WLC_E_TRACE);
+#endif
+	/* Write updated Event mask */
+	bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s Set Event mask failed %d\n", __FUNCTION__, ret));
+		goto done;
+	}
+
+	/* make up event mask ext message iovar for event larger than 128 */
+	msglen = ROUNDUP(WLC_E_LAST, NBBY)/NBBY + EVENTMSGS_EXT_STRUCT_SIZE;
+	eventmask_msg = (eventmsgs_ext_t*)kmalloc(msglen, GFP_KERNEL);
+	if (eventmask_msg == NULL) {
+		DHD_ERROR(("failed to allocate %d bytes for event_msg_ext\n", msglen));
+		ret = BCME_NOMEM;
+		goto done;
+	}
+	bzero(eventmask_msg, msglen);
+	eventmask_msg->ver = EVENTMSGS_VER;
+	eventmask_msg->len = ROUNDUP(WLC_E_LAST, NBBY)/NBBY;
+
+	/* Read event_msgs_ext mask */
+	bcm_mkiovar("event_msgs_ext", (char *)eventmask_msg, msglen, iov_buf, WLC_IOCTL_SMLEN);
+	ret2  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iov_buf, WLC_IOCTL_SMLEN, FALSE, 0);
+	if (ret2 != BCME_UNSUPPORTED)
+		ret = ret2;
+	if (ret2 == 0) { /* event_msgs_ext must be supported */
+		bcopy(iov_buf, eventmask_msg, msglen);
+
+#ifdef BT_WIFI_HANDOVER
+		setbit(eventmask_msg->mask, WLC_E_BT_WIFI_HANDOVER_REQ);
+#endif /* BT_WIFI_HANDOVER */
+
+		/* Write updated Event mask */
+		eventmask_msg->ver = EVENTMSGS_VER;
+		eventmask_msg->command = EVENTMSGS_SET_MASK;
+		eventmask_msg->len = ROUNDUP(WLC_E_LAST, NBBY)/NBBY;
+		bcm_mkiovar("event_msgs_ext", (char *)eventmask_msg,
+			msglen, iov_buf, WLC_IOCTL_SMLEN);
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR,
+			iov_buf, WLC_IOCTL_SMLEN, TRUE, 0)) < 0) {
+			DHD_ERROR(("%s write event mask ext failed %d\n", __FUNCTION__, ret));
+			goto done;
+		}
+	} else if (ret2 < 0 && ret2 != BCME_UNSUPPORTED) {
+		DHD_ERROR(("%s read event mask ext failed %d\n", __FUNCTION__, ret2));
+		goto done;
+	} /* unsupported is ok */
+
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_CHANNEL_TIME, (char *)&scan_assoc_time,
+		sizeof(scan_assoc_time), TRUE, 0);
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_UNASSOC_TIME, (char *)&scan_unassoc_time,
+		sizeof(scan_unassoc_time), TRUE, 0);
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_SCAN_PASSIVE_TIME, (char *)&scan_passive_time,
+		sizeof(scan_passive_time), TRUE, 0);
+
+#ifdef ARP_OFFLOAD_SUPPORT
+	/* Set and enable ARP offload feature for STA only  */
+#if defined(SOFTAP)
+	if (arpoe && !ap_fw_loaded)
+#else
+	if (arpoe)
+#endif
+	{
+		dhd_arp_offload_enable(dhd, TRUE);
+		dhd_arp_offload_set(dhd, dhd_arp_mode);
+	} else {
+		dhd_arp_offload_enable(dhd, FALSE);
+		dhd_arp_offload_set(dhd, 0);
+	}
+	dhd_arp_enable = arpoe;
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef PKT_FILTER_SUPPORT
+	/* Setup default defintions for pktfilter , enable in suspend */
+	dhd->pktfilter_count = 6;
+	/* Setup filter to allow only unicast */
+	if (dhd_master_mode) {
+		dhd->pktfilter[DHD_UNICAST_FILTER_NUM] = "100 0 0 0 0x01 0x00";
+		dhd->pktfilter[DHD_BROADCAST_FILTER_NUM] = NULL;
+		dhd->pktfilter[DHD_MULTICAST4_FILTER_NUM] = NULL;
+		dhd->pktfilter[DHD_MULTICAST6_FILTER_NUM] = NULL;
+		/* Add filter to pass multicastDNS packet and NOT filter out as Broadcast */
+		dhd->pktfilter[DHD_MDNS_FILTER_NUM] = "104 0 0 0 0xFFFFFFFFFFFF 0x01005E0000FB";
+		/* apply APP pktfilter */
+		dhd->pktfilter[DHD_ARP_FILTER_NUM] = "105 0 0 12 0xFFFF 0x0806";
+	} else
+		dhd_conf_discard_pkt_filter(dhd);
+	dhd_conf_add_pkt_filter(dhd);
+
+#if defined(SOFTAP)
+	if (ap_fw_loaded) {
+		dhd_enable_packet_filter(0, dhd);
+	}
+#endif /* defined(SOFTAP) */
+	dhd_set_packet_filter(dhd);
+#endif /* PKT_FILTER_SUPPORT */
+#ifdef DISABLE_11N
+	bcm_mkiovar("nmode", (char *)&nmode, 4, iovbuf, sizeof(iovbuf));
+	if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+		DHD_ERROR(("%s wl nmode 0 failed %d\n", __FUNCTION__, ret));
+#endif /* DISABLE_11N */
+
+#ifdef AMPDU_VO_ENABLE
+	tid.tid = PRIO_8021D_VO; /* Enable TID(6) for voice */
+	tid.enable = TRUE;
+	bcm_mkiovar("ampdu_tid", (char *)&tid, sizeof(tid), iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+	tid.tid = PRIO_8021D_NC; /* Enable TID(7) for voice */
+	tid.enable = TRUE;
+	bcm_mkiovar("ampdu_tid", (char *)&tid, sizeof(tid), iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+#endif
+#if defined(SOFTAP_TPUT_ENHANCE)
+	if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+		dhd_bus_setidletime(dhd, (int)100);
+#ifdef DHDTCPACK_SUPPRESS
+		dhd->tcpack_sup_enabled = FALSE;
+#endif
+#if defined(DHD_TCP_WINSIZE_ADJUST)
+		dhd_use_tcp_window_size_adjust = TRUE;
+#endif
+
+		memset(buf, 0, sizeof(buf));
+		bcm_mkiovar("bus:txglom_auto_control", 0, 0, buf, sizeof(buf));
+		if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0)) < 0) {
+			glom = 0;
+			bcm_mkiovar("bus:txglom", (char *)&glom, 4, iovbuf, sizeof(iovbuf));
+			dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+		}
+		else {
+			if (buf[0] == 0) {
+				glom = 1;
+				bcm_mkiovar("bus:txglom_auto_control", (char *)&glom, 4, iovbuf,
+				sizeof(iovbuf));
+				dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+			}
+		}
+	}
+#endif /* SOFTAP_TPUT_ENHANCE */
+
+	/* query for 'ver' to get version info from firmware */
+	memset(buf, 0, sizeof(buf));
+	ptr = buf;
+	bcm_mkiovar("ver", (char *)&buf, 4, buf, sizeof(buf));
+	if ((ret  = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, buf, sizeof(buf), FALSE, 0)) < 0)
+		DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+	else {
+		bcmstrtok(&ptr, "\n", 0);
+		/* Print fw version info */
+		DHD_ERROR(("Firmware version = %s\n", buf));
+		dhd_set_version_info(dhd, buf);
+	}
+
+#if defined(BCMSDIO)
+	dhd_txglom_enable(dhd, dhd->conf->bus_rxglom);
+#endif /* defined(BCMSDIO) */
+
+	dhd_conf_set_disable_proptx(dhd);
+#if defined(BCMSDIO)
+#ifdef PROP_TXSTATUS
+	if (disable_proptx ||
+#ifdef PROP_TXSTATUS_VSDB
+		/* enable WLFC only if the firmware is VSDB when it is in STA mode */
+		(dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+		 dhd->op_mode != DHD_FLAG_IBSS_MODE) ||
+#endif /* PROP_TXSTATUS_VSDB */
+		FALSE) {
+		wlfc_enable = FALSE;
+	}
+
+#ifndef DISABLE_11N
+	ret = dhd_wl_ioctl_cmd(dhd, WLC_DOWN, (char *)&wl_down, sizeof(wl_down), TRUE, 0);
+	bcm_mkiovar("ampdu_hostreorder", (char *)&hostreorder, 4, iovbuf, sizeof(iovbuf));
+	if ((ret2 = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0) {
+		DHD_ERROR(("%s wl ampdu_hostreorder failed %d\n", __FUNCTION__, ret2));
+		if (ret2 != BCME_UNSUPPORTED)
+			ret = ret2;
+		if (ret2 != BCME_OK)
+			hostreorder = 0;
+	}
+#endif /* DISABLE_11N */
+
+#ifdef READ_CONFIG_FROM_FILE
+	dhd_preinit_config(dhd, 0);
+#endif /* READ_CONFIG_FROM_FILE */
+
+	if (wlfc_enable)
+		dhd_wlfc_init(dhd);
+#ifndef DISABLE_11N
+	else if (hostreorder)
+		dhd_wlfc_hostreorder_init(dhd);
+#endif /* DISABLE_11N */
+
+#endif /* PROP_TXSTATUS */
+#endif /* BCMSDIO || BCMBUS */
+#ifdef PCIE_FULL_DONGLE
+	/* For FD we need all the packets at DHD to handle intra-BSS forwarding */
+	if (FW_SUPPORTED(dhd, ap)) {
+		wl_ap_isolate = AP_ISOLATE_SENDUP_ALL;
+		bcm_mkiovar("ap_isolate", (char *)&wl_ap_isolate, 4, iovbuf, sizeof(iovbuf));
+		if ((ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0)) < 0)
+			DHD_ERROR(("%s failed %d\n", __FUNCTION__, ret));
+	}
+#endif /* PCIE_FULL_DONGLE */
+#ifdef PNO_SUPPORT
+	if (!dhd->pno_state) {
+		dhd_pno_init(dhd);
+	}
+#endif
+#ifdef WL11U
+	dhd_interworking_enable(dhd);
+#endif /* WL11U */
+#ifndef WL_CFG80211
+	dhd_wl_ioctl_cmd(dhd, WLC_UP, (char *)&up, sizeof(up), TRUE, 0);
+#endif
+
+done:
+
+	if (eventmask_msg)
+		kfree(eventmask_msg);
+	if (iov_buf)
+		kfree(iov_buf);
+
+	return ret;
+}
+
+
+int
+dhd_iovar(dhd_pub_t *pub, int ifidx, char *name, char *cmd_buf, uint cmd_len, int set)
+{
+	char buf[strlen(name) + 1 + cmd_len];
+	int len = sizeof(buf);
+	wl_ioctl_t ioc;
+	int ret;
+
+	len = bcm_mkiovar(name, cmd_buf, cmd_len, buf, len);
+
+	memset(&ioc, 0, sizeof(ioc));
+
+	ioc.cmd = set? WLC_SET_VAR : WLC_GET_VAR;
+	ioc.buf = buf;
+	ioc.len = len;
+	ioc.set = set;
+
+	ret = dhd_wl_ioctl(pub, ifidx, &ioc, ioc.buf, ioc.len);
+	if (!set && ret >= 0)
+		memcpy(cmd_buf, buf, cmd_len);
+
+	return ret;
+}
+
+int dhd_change_mtu(dhd_pub_t *dhdp, int new_mtu, int ifidx)
+{
+	struct dhd_info *dhd = dhdp->info;
+	struct net_device *dev = NULL;
+
+	ASSERT(dhd && dhd->iflist[ifidx]);
+	dev = dhd->iflist[ifidx]->net;
+	ASSERT(dev);
+
+	if (netif_running(dev)) {
+		DHD_ERROR(("%s: Must be down to change its MTU\n", dev->name));
+		return BCME_NOTDOWN;
+	}
+
+#define DHD_MIN_MTU 1500
+#define DHD_MAX_MTU 1752
+
+	if ((new_mtu < DHD_MIN_MTU) || (new_mtu > DHD_MAX_MTU)) {
+		DHD_ERROR(("%s: MTU size %d is invalid.\n", __FUNCTION__, new_mtu));
+		return BCME_BADARG;
+	}
+
+	dev->mtu = new_mtu;
+	return 0;
+}
+
+#ifdef ARP_OFFLOAD_SUPPORT
+/* add or remove AOE host ip(s) (up to 8 IPs on the interface)  */
+void
+aoe_update_host_ipv4_table(dhd_pub_t *dhd_pub, u32 ipa, bool add, int idx)
+{
+	u32 ipv4_buf[MAX_IPV4_ENTRIES]; /* temp save for AOE host_ip table */
+	int i;
+	int ret;
+
+	bzero(ipv4_buf, sizeof(ipv4_buf));
+
+	/* display what we've got */
+	ret = dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf), idx);
+	DHD_ARPOE(("%s: hostip table read from Dongle:\n", __FUNCTION__));
+#ifdef AOE_DBG
+	dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+	/* now we saved hoste_ip table, clr it in the dongle AOE */
+	dhd_aoe_hostip_clr(dhd_pub, idx);
+
+	if (ret) {
+		DHD_ERROR(("%s failed\n", __FUNCTION__));
+		return;
+	}
+
+	for (i = 0; i < MAX_IPV4_ENTRIES; i++) {
+		if (add && (ipv4_buf[i] == 0)) {
+				ipv4_buf[i] = ipa;
+				add = FALSE; /* added ipa to local table  */
+				DHD_ARPOE(("%s: Saved new IP in temp arp_hostip[%d]\n",
+				__FUNCTION__, i));
+		} else if (ipv4_buf[i] == ipa) {
+			ipv4_buf[i]	= 0;
+			DHD_ARPOE(("%s: removed IP:%x from temp table %d\n",
+				__FUNCTION__, ipa, i));
+		}
+
+		if (ipv4_buf[i] != 0) {
+			/* add back host_ip entries from our local cache */
+			dhd_arp_offload_add_ip(dhd_pub, ipv4_buf[i], idx);
+			DHD_ARPOE(("%s: added IP:%x to dongle arp_hostip[%d]\n\n",
+				__FUNCTION__, ipv4_buf[i], i));
+		}
+	}
+#ifdef AOE_DBG
+	/* see the resulting hostip table */
+	dhd_arp_get_arp_hostip_table(dhd_pub, ipv4_buf, sizeof(ipv4_buf), idx);
+	DHD_ARPOE(("%s: read back arp_hostip table:\n", __FUNCTION__));
+	dhd_print_buf(ipv4_buf, 32, 4); /* max 8 IPs 4b each */
+#endif
+}
+
+/*
+ * Notification mechanism from kernel to our driver. This function is called by the Linux kernel
+ * whenever there is an event related to an IP address.
+ * ptr : kernel provided pointer to IP address that has changed
+ */
+static int dhd_inetaddr_notifier_call(struct notifier_block *this,
+	unsigned long event,
+	void *ptr)
+{
+	struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+
+	dhd_info_t *dhd;
+	dhd_pub_t *dhd_pub;
+	int idx;
+
+	if (!dhd_arp_enable)
+		return NOTIFY_DONE;
+	if (!ifa || !(ifa->ifa_dev->dev))
+		return NOTIFY_DONE;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+	/* Filter notifications meant for non Broadcom devices */
+	if ((ifa->ifa_dev->dev->netdev_ops != &dhd_ops_pri) &&
+	    (ifa->ifa_dev->dev->netdev_ops != &dhd_ops_virt)) {
+#if defined(WL_ENABLE_P2P_IF)
+		if (!wl_cfgp2p_is_ifops(ifa->ifa_dev->dev->netdev_ops))
+#endif /* WL_ENABLE_P2P_IF */
+			return NOTIFY_DONE;
+	}
+#endif /* LINUX_VERSION_CODE */
+
+	dhd = DHD_DEV_INFO(ifa->ifa_dev->dev);
+	if (!dhd)
+		return NOTIFY_DONE;
+
+	dhd_pub = &dhd->pub;
+
+	if (dhd_pub->arp_version == 1) {
+		idx = 0;
+	}
+	else {
+		for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+			if (dhd->iflist[idx] && dhd->iflist[idx]->net == ifa->ifa_dev->dev)
+			break;
+		}
+		if (idx < DHD_MAX_IFS)
+			DHD_TRACE(("ifidx : %p %s %d\n", dhd->iflist[idx]->net,
+				dhd->iflist[idx]->name, dhd->iflist[idx]->idx));
+		else {
+			DHD_ERROR(("Cannot find ifidx for(%s) set to 0\n", ifa->ifa_label));
+			idx = 0;
+		}
+	}
+
+	switch (event) {
+		case NETDEV_UP:
+			DHD_ARPOE(("%s: [%s] Up IP: 0x%x\n",
+				__FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+
+			if (dhd->pub.busstate != DHD_BUS_DATA) {
+				DHD_ERROR(("%s: bus not ready, exit\n", __FUNCTION__));
+				if (dhd->pend_ipaddr) {
+					DHD_ERROR(("%s: overwrite pending ipaddr: 0x%x\n",
+						__FUNCTION__, dhd->pend_ipaddr));
+				}
+				dhd->pend_ipaddr = ifa->ifa_address;
+				break;
+			}
+
+#ifdef AOE_IP_ALIAS_SUPPORT
+			DHD_ARPOE(("%s:add aliased IP to AOE hostip cache\n",
+				__FUNCTION__));
+			aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, TRUE, idx);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+			break;
+
+		case NETDEV_DOWN:
+			DHD_ARPOE(("%s: [%s] Down IP: 0x%x\n",
+				__FUNCTION__, ifa->ifa_label, ifa->ifa_address));
+			dhd->pend_ipaddr = 0;
+#ifdef AOE_IP_ALIAS_SUPPORT
+			DHD_ARPOE(("%s:interface is down, AOE clr all for this if\n",
+				__FUNCTION__));
+			aoe_update_host_ipv4_table(dhd_pub, ifa->ifa_address, FALSE, idx);
+#else
+			dhd_aoe_hostip_clr(&dhd->pub, idx);
+			dhd_aoe_arp_clr(&dhd->pub, idx);
+#endif /* AOE_IP_ALIAS_SUPPORT */
+			break;
+
+		default:
+			DHD_ARPOE(("%s: do noting for [%s] Event: %lu\n",
+				__func__, ifa->ifa_label, event));
+			break;
+	}
+	return NOTIFY_DONE;
+}
+#endif /* ARP_OFFLOAD_SUPPORT */
+
+#ifdef CONFIG_IPV6
+/* Neighbor Discovery Offload: defered handler */
+static void
+dhd_inet6_work_handler(void *dhd_info, void *event_data, u8 event)
+{
+	struct ipv6_work_info_t *ndo_work = (struct ipv6_work_info_t *)event_data;
+	dhd_pub_t	*pub = &((dhd_info_t *)dhd_info)->pub;
+	int		ret;
+
+	if (event != DHD_WQ_WORK_IPV6_NDO) {
+		DHD_ERROR(("%s: unexpected event \n", __FUNCTION__));
+		return;
+	}
+
+	if (!ndo_work) {
+		DHD_ERROR(("%s: ipv6 work info is not initialized \n", __FUNCTION__));
+		return;
+	}
+
+	if (!pub) {
+		DHD_ERROR(("%s: dhd pub is not initialized \n", __FUNCTION__));
+		return;
+	}
+
+	if (ndo_work->if_idx) {
+		DHD_ERROR(("%s: idx %d \n", __FUNCTION__, ndo_work->if_idx));
+		return;
+	}
+
+	switch (ndo_work->event) {
+		case NETDEV_UP:
+			DHD_TRACE(("%s: Enable NDO and add ipv6 into table \n", __FUNCTION__));
+			ret = dhd_ndo_enable(pub, TRUE);
+			if (ret < 0) {
+				DHD_ERROR(("%s: Enabling NDO Failed %d\n", __FUNCTION__, ret));
+			}
+
+			ret = dhd_ndo_add_ip(pub, &ndo_work->ipv6_addr[0], ndo_work->if_idx);
+			if (ret < 0) {
+				DHD_ERROR(("%s: Adding host ip for NDO failed %d\n",
+					__FUNCTION__, ret));
+			}
+			break;
+		case NETDEV_DOWN:
+			DHD_TRACE(("%s: clear ipv6 table \n", __FUNCTION__));
+			ret = dhd_ndo_remove_ip(pub, ndo_work->if_idx);
+			if (ret < 0) {
+				DHD_ERROR(("%s: Removing host ip for NDO failed %d\n",
+					__FUNCTION__, ret));
+				goto done;
+			}
+
+			ret = dhd_ndo_enable(pub, FALSE);
+			if (ret < 0) {
+				DHD_ERROR(("%s: disabling NDO Failed %d\n", __FUNCTION__, ret));
+				goto done;
+			}
+			break;
+		default:
+			DHD_ERROR(("%s: unknown notifier event \n", __FUNCTION__));
+			break;
+	}
+done:
+	/* free ndo_work. alloced while scheduling the work */
+	kfree(ndo_work);
+
+	return;
+}
+
+/*
+ * Neighbor Discovery Offload: Called when an interface
+ * is assigned with ipv6 address.
+ * Handles only primary interface
+ */
+static int dhd_inet6addr_notifier_call(struct notifier_block *this,
+	unsigned long event,
+	void *ptr)
+{
+	dhd_info_t *dhd;
+	dhd_pub_t *dhd_pub;
+	struct inet6_ifaddr *inet6_ifa = ptr;
+	struct in6_addr *ipv6_addr = &inet6_ifa->addr;
+	struct ipv6_work_info_t *ndo_info;
+	int idx = 0; /* REVISIT */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+	/* Filter notifications meant for non Broadcom devices */
+	if (inet6_ifa->idev->dev->netdev_ops != &dhd_ops_pri) {
+			return NOTIFY_DONE;
+	}
+#endif /* LINUX_VERSION_CODE */
+
+	dhd = DHD_DEV_INFO(inet6_ifa->idev->dev);
+	if (!dhd)
+		return NOTIFY_DONE;
+
+	if (dhd->iflist[idx] && dhd->iflist[idx]->net != inet6_ifa->idev->dev)
+		return NOTIFY_DONE;
+	dhd_pub = &dhd->pub;
+	if (!FW_SUPPORTED(dhd_pub, ndoe))
+		return NOTIFY_DONE;
+
+	ndo_info = (struct ipv6_work_info_t *)kzalloc(sizeof(struct ipv6_work_info_t), GFP_ATOMIC);
+	if (!ndo_info) {
+		DHD_ERROR(("%s: ipv6 work alloc failed\n", __FUNCTION__));
+		return NOTIFY_DONE;
+	}
+
+	ndo_info->event = event;
+	ndo_info->if_idx = idx;
+	memcpy(&ndo_info->ipv6_addr[0], ipv6_addr, IPV6_ADDR_LEN);
+
+	/* defer the work to thread as it may block kernel */
+	dhd_deferred_schedule_work(dhd->dhd_deferred_wq, (void *)ndo_info, DHD_WQ_WORK_IPV6_NDO,
+		dhd_inet6_work_handler, DHD_WORK_PRIORITY_LOW);
+	return NOTIFY_DONE;
+}
+#endif /* #ifdef CONFIG_IPV6 */
+
+int
+dhd_register_if(dhd_pub_t *dhdp, int ifidx, bool need_rtnl_lock)
+{
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+	dhd_if_t *ifp;
+	struct net_device *net = NULL;
+	int err = 0;
+	uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x11, 0x22, 0x33 };
+
+	DHD_TRACE(("%s: ifidx %d\n", __FUNCTION__, ifidx));
+
+	ASSERT(dhd && dhd->iflist[ifidx]);
+	ifp = dhd->iflist[ifidx];
+	net = ifp->net;
+	ASSERT(net && (ifp->idx == ifidx));
+
+#ifndef  P2PONEINT
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+	ASSERT(!net->open);
+	net->get_stats = dhd_get_stats;
+	net->do_ioctl = dhd_ioctl_entry;
+	net->hard_start_xmit = dhd_start_xmit;
+	net->set_mac_address = dhd_set_mac_address;
+	net->set_multicast_list = dhd_set_multicast_list;
+	net->open = net->stop = NULL;
+#else
+	ASSERT(!net->netdev_ops);
+	net->netdev_ops = &dhd_ops_virt;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31) */
+#else
+	net->netdev_ops = &dhd_cfgp2p_ops_virt;
+#endif /* P2PONEINT */
+
+	/* Ok, link into the network layer... */
+	if (ifidx == 0) {
+		/*
+		 * device functions for the primary interface only
+		 */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+		net->open = dhd_open;
+		net->stop = dhd_stop;
+#else
+		net->netdev_ops = &dhd_ops_pri;
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31) */
+		if (!ETHER_ISNULLADDR(dhd->pub.mac.octet))
+			memcpy(temp_addr, dhd->pub.mac.octet, ETHER_ADDR_LEN);
+	} else {
+		/*
+		 * We have to use the primary MAC for virtual interfaces
+		 */
+		memcpy(temp_addr, ifp->mac_addr, ETHER_ADDR_LEN);
+		/*
+		 * Android sets the locally administered bit to indicate that this is a
+		 * portable hotspot.  This will not work in simultaneous AP/STA mode,
+		 * nor with P2P.  Need to set the Donlge's MAC address, and then use that.
+		 */
+		if (!memcmp(temp_addr, dhd->iflist[0]->mac_addr,
+			ETHER_ADDR_LEN)) {
+			DHD_ERROR(("%s interface [%s]: set locally administered bit in MAC\n",
+			__func__, net->name));
+			temp_addr[0] |= 0x02;
+		}
+	}
+
+	net->hard_header_len = ETH_HLEN + dhd->pub.hdrlen;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+	net->ethtool_ops = &dhd_ethtool_ops;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#if defined(WL_WIRELESS_EXT)
+#if WIRELESS_EXT < 19
+	net->get_wireless_stats = dhd_get_wireless_stats;
+#endif /* WIRELESS_EXT < 19 */
+#if WIRELESS_EXT > 12
+	net->wireless_handlers = (struct iw_handler_def *)&wl_iw_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+#endif /* defined(WL_WIRELESS_EXT) */
+
+	dhd->pub.rxsz = DBUS_RX_BUFFER_SIZE_DHD(net);
+
+	memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+	if (ifidx == 0)
+		printf("%s\n", dhd_version);
+
+	if (need_rtnl_lock)
+		err = register_netdev(net);
+	else
+		err = register_netdevice(net);
+
+	if (err != 0) {
+		DHD_ERROR(("couldn't register the net device [%s], err %d\n", net->name, err));
+		goto fail;
+	}
+
+#ifdef SET_RPS_CPUS
+	err = custom_rps_map_set(net->_rx, RPS_CPUS_MASK, strlen(RPS_CPUS_MASK));
+	if (err < 0)
+		DHD_ERROR(("%s : custom_rps_map_set done. error : %d\n", __FUNCTION__, err));
+#endif /* SET_RPS_CPUS */
+
+
+
+	printf("Register interface [%s]  MAC: "MACDBG"\n\n", net->name,
+		MAC2STRDBG(net->dev_addr));
+
+#if defined(SOFTAP) && defined(WL_WIRELESS_EXT) && !defined(WL_CFG80211)
+//		wl_iw_iscan_set_scan_broadcast_prep(net, 1);
+#endif
+
+#if 1 && (defined(BCMPCIE) || (defined(BCMLXSDMMC) && (LINUX_VERSION_CODE >= \
+	KERNEL_VERSION(2, 6, 27))))
+	if (ifidx == 0) {
+#ifdef BCMLXSDMMC
+		up(&dhd_registration_sem);
+#endif
+		if (!dhd_download_fw_on_driverload) {
+			dhd_net_bus_devreset(net, TRUE);
+#ifdef BCMLXSDMMC
+			dhd_net_bus_suspend(net);
+#endif /* BCMLXSDMMC */
+			wifi_platform_set_power(dhdp->info->adapter, FALSE, WIFI_TURNOFF_DELAY);
+		}
+	}
+#endif /* OEM_ANDROID && (BCMPCIE || (BCMLXSDMMC && KERNEL_VERSION >= 2.6.27)) */
+	return 0;
+
+fail:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	net->open = NULL;
+#else
+	net->netdev_ops = NULL;
+#endif
+	return err;
+}
+
+void
+dhd_bus_detach(dhd_pub_t *dhdp)
+{
+	dhd_info_t *dhd;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (dhdp) {
+		dhd = (dhd_info_t *)dhdp->info;
+		if (dhd) {
+
+			/*
+			 * In case of Android cfg80211 driver, the bus is down in dhd_stop,
+			 *  calling stop again will cuase SD read/write errors.
+			 */
+			if (dhd->pub.busstate != DHD_BUS_DOWN) {
+				/* Stop the protocol module */
+				dhd_prot_stop(&dhd->pub);
+
+				/* Stop the bus module */
+				dhd_bus_stop(dhd->pub.bus, TRUE);
+			}
+
+#if defined(OOB_INTR_ONLY) || defined(BCMPCIE_OOB_HOST_WAKE)
+			dhd_bus_oob_intr_unregister(dhdp);
+#endif
+		}
+	}
+}
+
+
+void dhd_detach(dhd_pub_t *dhdp)
+{
+	dhd_info_t *dhd;
+	unsigned long flags;
+	int timer_valid = FALSE;
+
+	if (!dhdp)
+		return;
+
+	dhd = (dhd_info_t *)dhdp->info;
+	if (!dhd)
+		return;
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+	dhd_global = NULL;
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+	DHD_TRACE(("%s: Enter state 0x%x\n", __FUNCTION__, dhd->dhd_state));
+
+	dhd->pub.up = 0;
+	if (!(dhd->dhd_state & DHD_ATTACH_STATE_DONE)) {
+		/* Give sufficient time for threads to start running in case
+		 * dhd_attach() has failed
+		 */
+		OSL_SLEEP(100);
+	}
+
+	if (dhd->dhd_state & DHD_ATTACH_STATE_PROT_ATTACH) {
+		dhd_bus_detach(dhdp);
+#ifdef PCIE_FULL_DONGLE
+		dhd_flow_rings_deinit(dhdp);
+#endif
+
+		if (dhdp->prot)
+			dhd_prot_detach(dhdp);
+	}
+
+#ifdef ARP_OFFLOAD_SUPPORT
+	if (dhd_inetaddr_notifier_registered) {
+		dhd_inetaddr_notifier_registered = FALSE;
+		unregister_inetaddr_notifier(&dhd_inetaddr_notifier);
+	}
+#endif /* ARP_OFFLOAD_SUPPORT */
+#ifdef CONFIG_IPV6
+	if (dhd_inet6addr_notifier_registered) {
+		dhd_inet6addr_notifier_registered = FALSE;
+		unregister_inet6addr_notifier(&dhd_inet6addr_notifier);
+	}
+#endif
+
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+	if (dhd->dhd_state & DHD_ATTACH_STATE_EARLYSUSPEND_DONE) {
+		if (dhd->early_suspend.suspend)
+			unregister_early_suspend(&dhd->early_suspend);
+	}
+#endif /* CONFIG_HAS_EARLYSUSPEND && DHD_USE_EARLYSUSPEND */
+
+#if defined(WL_WIRELESS_EXT)
+	if (dhd->dhd_state & DHD_ATTACH_STATE_WL_ATTACH) {
+		/* Detatch and unlink in the iw */
+		wl_iw_detach();
+	}
+#endif /* defined(WL_WIRELESS_EXT) */
+
+	/* delete all interfaces, start with virtual  */
+	if (dhd->dhd_state & DHD_ATTACH_STATE_ADD_IF) {
+		int i = 1;
+		dhd_if_t *ifp;
+
+		/* Cleanup virtual interfaces */
+		dhd_net_if_lock_local(dhd);
+		for (i = 1; i < DHD_MAX_IFS; i++) {
+			if (dhd->iflist[i])
+				dhd_remove_if(&dhd->pub, i, TRUE);
+		}
+		dhd_net_if_unlock_local(dhd);
+
+		/*  delete primary interface 0 */
+		ifp = dhd->iflist[0];
+		ASSERT(ifp);
+		ASSERT(ifp->net);
+		if (ifp && ifp->net) {
+
+
+
+			/* in unregister_netdev case, the interface gets freed by net->destructor
+			 * (which is set to free_netdev)
+			 */
+			if (ifp->net->reg_state == NETREG_UNINITIALIZED)
+				free_netdev(ifp->net);
+			else {
+#ifdef SET_RPS_CPUS
+				custom_rps_map_clear(ifp->net->_rx);
+#endif /* SET_RPS_CPUS */
+				unregister_netdev(ifp->net);
+			}
+			ifp->net = NULL;
+#ifdef DHD_WMF
+			dhd_wmf_cleanup(dhdp, 0);
+#endif /* DHD_WMF */
+
+			dhd_if_del_sta_list(ifp);
+
+			MFREE(dhd->pub.osh, ifp, sizeof(*ifp));
+			dhd->iflist[0] = NULL;
+		}
+	}
+
+	/* Clear the watchdog timer */
+	DHD_GENERAL_LOCK(&dhd->pub, flags);
+	timer_valid = dhd->wd_timer_valid;
+	dhd->wd_timer_valid = FALSE;
+	DHD_GENERAL_UNLOCK(&dhd->pub, flags);
+	if (timer_valid)
+		del_timer_sync(&dhd->timer);
+
+	if (dhd->dhd_state & DHD_ATTACH_STATE_THREADS_CREATED) {
+		if (dhd->thr_wdt_ctl.thr_pid >= 0) {
+			PROC_STOP(&dhd->thr_wdt_ctl);
+		}
+
+		if (dhd->rxthread_enabled && dhd->thr_rxf_ctl.thr_pid >= 0) {
+			PROC_STOP(&dhd->thr_rxf_ctl);
+		}
+
+		if (dhd->thr_dpc_ctl.thr_pid >= 0) {
+			PROC_STOP(&dhd->thr_dpc_ctl);
+		} else
+			tasklet_kill(&dhd->tasklet);
+	}
+#ifdef WL_CFG80211
+	if (dhd->dhd_state & DHD_ATTACH_STATE_CFG80211) {
+		wl_cfg80211_detach(NULL);
+		dhd_monitor_uninit();
+	}
+#endif
+	/* free deferred work queue */
+	dhd_deferred_work_deinit(dhd->dhd_deferred_wq);
+	dhd->dhd_deferred_wq = NULL;
+
+#ifdef SHOW_LOGTRACE
+	if (dhd->event_data.fmts)
+		kfree(dhd->event_data.fmts);
+	if (dhd->event_data.raw_fmts)
+		kfree(dhd->event_data.raw_fmts);
+#endif /* SHOW_LOGTRACE */
+
+#ifdef PNO_SUPPORT
+	if (dhdp->pno_state)
+		dhd_pno_deinit(dhdp);
+#endif
+#if defined(CONFIG_PM_SLEEP)
+	if (dhd_pm_notifier_registered) {
+		unregister_pm_notifier(&dhd_pm_notifier);
+		dhd_pm_notifier_registered = FALSE;
+	}
+#endif /* CONFIG_PM_SLEEP */
+#ifdef DEBUG_CPU_FREQ
+		if (dhd->new_freq)
+			free_percpu(dhd->new_freq);
+		dhd->new_freq = NULL;
+		cpufreq_unregister_notifier(&dhd->freq_trans, CPUFREQ_TRANSITION_NOTIFIER);
+#endif
+	if (dhd->dhd_state & DHD_ATTACH_STATE_WAKELOCKS_INIT) {
+		DHD_TRACE(("wd wakelock count:%d\n", dhd->wakelock_wd_counter));
+#ifdef CONFIG_HAS_WAKELOCK
+		dhd->wakelock_counter = 0;
+		dhd->wakelock_wd_counter = 0;
+		dhd->wakelock_rx_timeout_enable = 0;
+		dhd->wakelock_ctrl_timeout_enable = 0;
+		wake_lock_destroy(&dhd->wl_wifi);
+		wake_lock_destroy(&dhd->wl_rxwake);
+		wake_lock_destroy(&dhd->wl_ctrlwake);
+		wake_lock_destroy(&dhd->wl_wdwake);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+		wake_lock_destroy(&dhd->wl_intrwake);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+#endif /* CONFIG_HAS_WAKELOCK */
+	}
+
+
+
+
+#ifdef DHDTCPACK_SUPPRESS
+	/* This will free all MEM allocated for TCPACK SUPPRESS */
+	dhd_tcpack_suppress_set(&dhd->pub, TCPACK_SUP_OFF);
+#endif /* DHDTCPACK_SUPPRESS */
+	dhd_conf_detach(dhdp);
+}
+
+
+void
+dhd_free(dhd_pub_t *dhdp)
+{
+	dhd_info_t *dhd;
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (dhdp) {
+		int i;
+		for (i = 0; i < ARRAYSIZE(dhdp->reorder_bufs); i++) {
+			if (dhdp->reorder_bufs[i]) {
+				reorder_info_t *ptr;
+				uint32 buf_size = sizeof(struct reorder_info);
+
+				ptr = dhdp->reorder_bufs[i];
+
+				buf_size += ((ptr->max_idx + 1) * sizeof(void*));
+				DHD_REORDER(("free flow id buf %d, maxidx is %d, buf_size %d\n",
+					i, ptr->max_idx, buf_size));
+
+				MFREE(dhdp->osh, dhdp->reorder_bufs[i], buf_size);
+				dhdp->reorder_bufs[i] = NULL;
+			}
+		}
+
+		dhd_sta_pool_fini(dhdp, DHD_MAX_STA);
+
+		dhd = (dhd_info_t *)dhdp->info;
+		/* If pointer is allocated by dhd_os_prealloc then avoid MFREE */
+		if (dhd &&
+			dhd != (dhd_info_t *)dhd_os_prealloc(dhdp, DHD_PREALLOC_DHD_INFO, 0, FALSE))
+			MFREE(dhd->pub.osh, dhd, sizeof(*dhd));
+		dhd = NULL;
+	}
+}
+
+void
+dhd_clear(dhd_pub_t *dhdp)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (dhdp) {
+		int i;
+		for (i = 0; i < ARRAYSIZE(dhdp->reorder_bufs); i++) {
+			if (dhdp->reorder_bufs[i]) {
+				reorder_info_t *ptr;
+				uint32 buf_size = sizeof(struct reorder_info);
+
+				ptr = dhdp->reorder_bufs[i];
+
+				buf_size += ((ptr->max_idx + 1) * sizeof(void*));
+				DHD_REORDER(("free flow id buf %d, maxidx is %d, buf_size %d\n",
+					i, ptr->max_idx, buf_size));
+
+				MFREE(dhdp->osh, dhdp->reorder_bufs[i], buf_size);
+				dhdp->reorder_bufs[i] = NULL;
+			}
+		}
+
+		dhd_sta_pool_clear(dhdp, DHD_MAX_STA);
+	}
+}
+
+static void
+dhd_module_cleanup(void)
+{
+	printf("%s: Enter\n", __FUNCTION__);
+
+	dhd_bus_unregister();
+
+	wl_android_exit();
+
+	dhd_wifi_platform_unregister_drv();
+	printf("%s: Exit\n", __FUNCTION__);
+}
+
+static void __exit
+dhd_module_exit(void)
+{
+	dhd_module_cleanup();
+	unregister_reboot_notifier(&dhd_reboot_notifier);
+}
+
+static int __init
+dhd_module_init(void)
+{
+	int err;
+	int retry = POWERUP_MAX_RETRY;
+
+	printf("%s: in\n", __FUNCTION__);
+
+	ap621x_wifi_init();
+
+	DHD_PERIM_RADIO_INIT();
+
+	if (firmware_path[0] != '\0') {
+		strncpy(fw_bak_path, firmware_path, MOD_PARAM_PATHLEN);
+		fw_bak_path[MOD_PARAM_PATHLEN-1] = '\0';
+	}
+
+	if (nvram_path[0] != '\0') {
+		strncpy(nv_bak_path, nvram_path, MOD_PARAM_PATHLEN);
+		nv_bak_path[MOD_PARAM_PATHLEN-1] = '\0';
+	}
+
+	do {
+		err = dhd_wifi_platform_register_drv();
+		if (!err) {
+			register_reboot_notifier(&dhd_reboot_notifier);
+			break;
+		}
+		else {
+			DHD_ERROR(("%s: Failed to load the driver, try cnt %d\n",
+				__FUNCTION__, retry));
+			strncpy(firmware_path, fw_bak_path, MOD_PARAM_PATHLEN);
+			firmware_path[MOD_PARAM_PATHLEN-1] = '\0';
+			strncpy(nvram_path, nv_bak_path, MOD_PARAM_PATHLEN);
+			nvram_path[MOD_PARAM_PATHLEN-1] = '\0';
+		}
+	} while (retry--);
+
+	if (err)
+		DHD_ERROR(("%s: Failed to load driver max retry reached**\n", __FUNCTION__));
+
+	printf("%s: Exit err=%d\n", __FUNCTION__, err);
+	return err;
+}
+
+static int
+dhd_reboot_callback(struct notifier_block *this, unsigned long code, void *unused)
+{
+	DHD_TRACE(("%s: code = %ld\n", __FUNCTION__, code));
+	if (code == SYS_RESTART) {
+	}
+
+	return NOTIFY_DONE;
+}
+
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+#if defined(CONFIG_DEFERRED_INITCALLS)
+deferred_module_init(dhd_module_init);
+#elif defined(USE_LATE_INITCALL_SYNC)
+late_initcall_sync(dhd_module_init);
+#else
+late_initcall(dhd_module_init);
+#endif /* USE_LATE_INITCALL_SYNC */
+#else
+module_init(dhd_module_init);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) */
+
+module_exit(dhd_module_exit);
+
+/*
+ * OS specific functions required to implement DHD driver in OS independent way
+ */
+int
+dhd_os_proto_block(dhd_pub_t *pub)
+{
+	dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+	if (dhd) {
+		DHD_PERIM_UNLOCK(pub);
+
+		down(&dhd->proto_sem);
+
+		DHD_PERIM_LOCK(pub);
+		return 1;
+	}
+
+	return 0;
+}
+
+int
+dhd_os_proto_unblock(dhd_pub_t *pub)
+{
+	dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+
+	if (dhd) {
+		up(&dhd->proto_sem);
+		return 1;
+	}
+
+	return 0;
+}
+
+unsigned int
+dhd_os_get_ioctl_resp_timeout(void)
+{
+	return ((unsigned int)dhd_ioctl_timeout_msec);
+}
+
+void
+dhd_os_set_ioctl_resp_timeout(unsigned int timeout_msec)
+{
+	dhd_ioctl_timeout_msec = (int)timeout_msec;
+}
+
+int
+dhd_os_ioctl_resp_wait(dhd_pub_t *pub, uint *condition, bool *pending)
+{
+	dhd_info_t * dhd = (dhd_info_t *)(pub->info);
+	int timeout;
+
+	/* Convert timeout in millsecond to jiffies */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+	timeout = msecs_to_jiffies(dhd_ioctl_timeout_msec);
+#else
+	timeout = dhd_ioctl_timeout_msec * HZ / 1000;
+#endif
+
+	DHD_PERIM_UNLOCK(pub);
+
+	timeout = wait_event_timeout(dhd->ioctl_resp_wait, (*condition), timeout);
+
+	DHD_PERIM_LOCK(pub);
+
+	return timeout;
+}
+
+int
+dhd_os_ioctl_resp_wake(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+	wake_up(&dhd->ioctl_resp_wait);
+	return 0;
+}
+
+void
+dhd_os_wd_timer_extend(void *bus, bool extend)
+{
+	dhd_pub_t *pub = bus;
+	dhd_info_t *dhd = (dhd_info_t *)pub->info;
+
+	if (extend)
+		dhd_os_wd_timer(bus, WATCHDOG_EXTEND_INTERVAL);
+	else
+		dhd_os_wd_timer(bus, dhd->default_wd_interval);
+}
+
+
+void
+dhd_os_wd_timer(void *bus, uint wdtick)
+{
+	dhd_pub_t *pub = bus;
+	dhd_info_t *dhd = (dhd_info_t *)pub->info;
+	unsigned long flags;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (!dhd) {
+		DHD_ERROR(("%s: dhd NULL\n", __FUNCTION__));
+		return;
+	}
+
+	DHD_GENERAL_LOCK(pub, flags);
+
+	/* don't start the wd until fw is loaded */
+	if (pub->busstate == DHD_BUS_DOWN) {
+		DHD_GENERAL_UNLOCK(pub, flags);
+		if (!wdtick)
+			DHD_OS_WD_WAKE_UNLOCK(pub);
+		return;
+	}
+
+	/* Totally stop the timer */
+	if (!wdtick && dhd->wd_timer_valid == TRUE) {
+		dhd->wd_timer_valid = FALSE;
+		DHD_GENERAL_UNLOCK(pub, flags);
+		del_timer_sync(&dhd->timer);
+		DHD_OS_WD_WAKE_UNLOCK(pub);
+		return;
+	}
+
+	if (wdtick) {
+		DHD_OS_WD_WAKE_LOCK(pub);
+		dhd_watchdog_ms = (uint)wdtick;
+		/* Re arm the timer, at last watchdog period */
+		mod_timer(&dhd->timer, jiffies + msecs_to_jiffies(dhd_watchdog_ms));
+		dhd->wd_timer_valid = TRUE;
+	}
+	DHD_GENERAL_UNLOCK(pub, flags);
+}
+
+void *
+dhd_os_open_image(char *filename)
+{
+	struct file *fp;
+
+	fp = filp_open(filename, O_RDONLY, 0);
+	/*
+	 * 2.6.11 (FC4) supports filp_open() but later revs don't?
+	 * Alternative:
+	 * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+	 * ???
+	 */
+	 if (IS_ERR(fp))
+		 fp = NULL;
+
+	 return fp;
+}
+
+int
+dhd_os_get_image_block(char *buf, int len, void *image)
+{
+	struct file *fp = (struct file *)image;
+	int rdlen;
+
+	if (!image)
+		return 0;
+
+	rdlen = kernel_read(fp, fp->f_pos, buf, len);
+	if (rdlen > 0)
+		fp->f_pos += rdlen;
+
+	return rdlen;
+}
+
+void
+dhd_os_close_image(void *image)
+{
+	if (image)
+		filp_close((struct file *)image, NULL);
+}
+
+void
+dhd_os_sdlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+
+	if (dhd_dpc_prio >= 0)
+		down(&dhd->sdsem);
+	else
+		spin_lock_bh(&dhd->sdlock);
+}
+
+void
+dhd_os_sdunlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+
+	if (dhd_dpc_prio >= 0)
+		up(&dhd->sdsem);
+	else
+		spin_unlock_bh(&dhd->sdlock);
+}
+
+void
+dhd_os_sdlock_txq(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+	spin_lock_bh(&dhd->txqlock);
+}
+
+void
+dhd_os_sdunlock_txq(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+	spin_unlock_bh(&dhd->txqlock);
+}
+
+void
+dhd_os_sdlock_rxq(dhd_pub_t *pub)
+{
+}
+
+void
+dhd_os_sdunlock_rxq(dhd_pub_t *pub)
+{
+}
+
+static void
+dhd_os_rxflock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+	spin_lock_bh(&dhd->rxf_lock);
+
+}
+
+static void
+dhd_os_rxfunlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+	spin_unlock_bh(&dhd->rxf_lock);
+}
+
+#ifdef DHDTCPACK_SUPPRESS
+void
+dhd_os_tcpacklock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+	spin_lock_bh(&dhd->tcpack_lock);
+
+}
+
+void
+dhd_os_tcpackunlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd;
+
+	dhd = (dhd_info_t *)(pub->info);
+	spin_unlock_bh(&dhd->tcpack_lock);
+}
+#endif /* DHDTCPACK_SUPPRESS */
+
+uint8* dhd_os_prealloc(dhd_pub_t *dhdpub, int section, uint size, bool kmalloc_if_fail)
+{
+	uint8* buf;
+	gfp_t flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+
+	buf = (uint8*)wifi_platform_prealloc(dhdpub->info->adapter, section, size);
+	if (buf == NULL) {
+		DHD_ERROR(("%s: failed to alloc memory, section: %d,"
+			" size: %dbytes\n", __FUNCTION__, section, size));
+		if (kmalloc_if_fail)
+			buf = kmalloc(size, flags);
+	}
+
+	return buf;
+}
+
+void dhd_os_prefree(dhd_pub_t *dhdpub, void *addr, uint size)
+{
+}
+
+#if defined(WL_WIRELESS_EXT)
+struct iw_statistics *
+dhd_get_wireless_stats(struct net_device *dev)
+{
+	int res = 0;
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	if (!dhd->pub.up) {
+		return NULL;
+	}
+
+	res = wl_iw_get_wireless_stats(dev, &dhd->iw.wstats);
+
+	if (res == 0)
+		return &dhd->iw.wstats;
+	else
+		return NULL;
+}
+#endif /* defined(WL_WIRELESS_EXT) */
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+static int
+dhd_wlanaudio_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+                    wl_event_msg_t *event, void **data)
+{
+	int cnt;
+	char eabuf[ETHER_ADDR_STR_LEN];
+	struct ether_addr *addr = &event->addr;
+	uint32 type = ntoh32_ua((void *)&event->event_type);
+
+	switch (type) {
+	case WLC_E_TXFAIL:
+		if (addr != NULL)
+			bcm_ether_ntoa(addr, eabuf);
+		else
+			return (BCME_ERROR);
+
+		for (cnt = 0; cnt < MAX_WLANAUDIO_BLACKLIST; cnt++) {
+			if (dhd->wlanaudio_blist[cnt].is_blacklist)
+				break;
+
+			if (!bcmp(&dhd->wlanaudio_blist[cnt].blacklist_addr,
+			          addr, ETHER_ADDR_LEN)) {
+				/* Mac address is Same */
+				dhd->wlanaudio_blist[cnt].cnt++;
+
+				if (dhd->wlanaudio_blist[cnt].cnt < 15) {
+					/* black list is false */
+					if ((dhd->wlanaudio_blist[cnt].cnt > 10) &&
+					    (jiffies - dhd->wlanaudio_blist[cnt].txfail_jiffies
+					     < 100)) {
+						dhd->wlanaudio_blist[cnt].is_blacklist = true;
+						dhd->is_wlanaudio_blist = true;
+					}
+				} else {
+					if ((!dhd->wlanaudio_blist[cnt].is_blacklist) &&
+					   (jiffies - dhd->wlanaudio_blist[cnt].txfail_jiffies
+					    > 100)) {
+
+						bzero(&dhd->wlanaudio_blist[cnt],
+						      sizeof(struct wlanaudio_blacklist));
+					}
+				}
+				break;
+			} else if ((!dhd->wlanaudio_blist[cnt].is_blacklist) &&
+			           (!dhd->wlanaudio_blist[cnt].cnt)) {
+				bcopy(addr,
+				      (char*)&dhd->wlanaudio_blist[cnt].blacklist_addr,
+				      ETHER_ADDR_LEN);
+				dhd->wlanaudio_blist[cnt].cnt++;
+				dhd->wlanaudio_blist[cnt].txfail_jiffies = jiffies;
+
+				bcm_ether_ntoa(&dhd->wlanaudio_blist[cnt].blacklist_addr, eabuf);
+				break;
+			}
+		}
+		break;
+	case WLC_E_AUTH	 :
+	case WLC_E_AUTH_IND :
+	case WLC_E_DEAUTH :
+	case WLC_E_DEAUTH_IND :
+	case WLC_E_ASSOC:
+	case WLC_E_ASSOC_IND:
+	case WLC_E_REASSOC:
+	case WLC_E_REASSOC_IND:
+	case WLC_E_DISASSOC:
+	case WLC_E_DISASSOC_IND:
+		{
+			int bl_cnt = 0;
+
+			if (addr != NULL)
+				bcm_ether_ntoa(addr, eabuf);
+			else
+				return (BCME_ERROR);
+
+			for (cnt = 0; cnt < MAX_WLANAUDIO_BLACKLIST; cnt++) {
+				if (!bcmp(&dhd->wlanaudio_blist[cnt].blacklist_addr,
+				          addr, ETHER_ADDR_LEN)) {
+					/* Mac address is Same */
+					if (dhd->wlanaudio_blist[cnt].is_blacklist) {
+						/* black list is true */
+						bzero(&dhd->wlanaudio_blist[cnt],
+						      sizeof(struct wlanaudio_blacklist));
+					}
+				}
+			}
+
+			for (cnt = 0; cnt < MAX_WLANAUDIO_BLACKLIST; cnt++) {
+				if (dhd->wlanaudio_blist[cnt].is_blacklist)
+					bl_cnt++;
+			}
+
+			if (!bl_cnt)
+			{
+				dhd->is_wlanaudio_blist = false;
+			}
+
+			break;
+		}
+	}
+	return BCME_OK;
+}
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+static int
+dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+	wl_event_msg_t *event, void **data)
+{
+	int bcmerror = 0;
+
+	ASSERT(dhd != NULL);
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+	bcmerror = dhd_wlanaudio_event(dhd, ifidx, pktdata, event, data);
+
+	if (bcmerror != BCME_OK)
+		return (bcmerror);
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+#ifdef SHOW_LOGTRACE
+	bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, event, data, &dhd->event_data);
+#else
+	bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, event, data, NULL);
+#endif /* SHOW_LOGTRACE */
+
+	if (bcmerror != BCME_OK)
+		return (bcmerror);
+
+#if defined(WL_WIRELESS_EXT)
+	if (event->bsscfgidx == 0) {
+		/*
+		 * Wireless ext is on primary interface only
+		 */
+
+	ASSERT(dhd->iflist[*ifidx] != NULL);
+	ASSERT(dhd->iflist[*ifidx]->net != NULL);
+
+		if (dhd->iflist[*ifidx]->net) {
+		wl_iw_event(dhd->iflist[*ifidx]->net, event, *data);
+		}
+	}
+#endif /* defined(WL_WIRELESS_EXT)  */
+
+#ifdef WL_CFG80211
+	ASSERT(dhd->iflist[*ifidx] != NULL);
+	ASSERT(dhd->iflist[*ifidx]->net != NULL);
+	if (dhd->iflist[*ifidx]->net)
+		wl_cfg80211_event(dhd->iflist[*ifidx]->net, event, *data);
+#endif /* defined(WL_CFG80211) */
+
+	return (bcmerror);
+}
+
+/* send up locally generated event */
+void
+dhd_sendup_event(dhd_pub_t *dhdp, wl_event_msg_t *event, void *data)
+{
+	switch (ntoh32(event->event_type)) {
+#ifdef WLBTAMP
+	/* Send up locally generated AMP HCI Events */
+	case WLC_E_BTA_HCI_EVENT: {
+		struct sk_buff *p, *skb;
+		bcm_event_t *msg;
+		wl_event_msg_t *p_bcm_event;
+		char *ptr;
+		uint32 len;
+		uint32 pktlen;
+		dhd_if_t *ifp;
+		dhd_info_t *dhd;
+		uchar *eth;
+		int ifidx;
+
+		len = ntoh32(event->datalen);
+		pktlen = sizeof(bcm_event_t) + len + 2;
+		dhd = dhdp->info;
+		ifidx = dhd_ifname2idx(dhd, event->ifname);
+
+		if ((p = PKTGET(dhdp->osh, pktlen, FALSE))) {
+			ASSERT(ISALIGNED((uintptr)PKTDATA(dhdp->osh, p), sizeof(uint32)));
+
+			msg = (bcm_event_t *) PKTDATA(dhdp->osh, p);
+
+			bcopy(&dhdp->mac, &msg->eth.ether_dhost, ETHER_ADDR_LEN);
+			bcopy(&dhdp->mac, &msg->eth.ether_shost, ETHER_ADDR_LEN);
+			ETHER_TOGGLE_LOCALADDR(&msg->eth.ether_shost);
+
+			msg->eth.ether_type = hton16(ETHER_TYPE_BRCM);
+
+			/* BCM Vendor specific header... */
+			msg->bcm_hdr.subtype = hton16(BCMILCP_SUBTYPE_VENDOR_LONG);
+			msg->bcm_hdr.version = BCMILCP_BCM_SUBTYPEHDR_VERSION;
+			bcopy(BRCM_OUI, &msg->bcm_hdr.oui[0], DOT11_OUI_LEN);
+
+			/* vendor spec header length + pvt data length (private indication
+			 *  hdr + actual message itself)
+			 */
+			msg->bcm_hdr.length = hton16(BCMILCP_BCM_SUBTYPEHDR_MINLENGTH +
+				BCM_MSG_LEN + sizeof(wl_event_msg_t) + (uint16)len);
+			msg->bcm_hdr.usr_subtype = hton16(BCMILCP_BCM_SUBTYPE_EVENT);
+
+			PKTSETLEN(dhdp->osh, p, (sizeof(bcm_event_t) + len + 2));
+
+			/* copy  wl_event_msg_t into sk_buf */
+
+			/* pointer to wl_event_msg_t in sk_buf */
+			p_bcm_event = &msg->event;
+			bcopy(event, p_bcm_event, sizeof(wl_event_msg_t));
+
+			/* copy hci event into sk_buf */
+			bcopy(data, (p_bcm_event + 1), len);
+
+			msg->bcm_hdr.length  = hton16(sizeof(wl_event_msg_t) +
+				ntoh16(msg->bcm_hdr.length));
+			PKTSETLEN(dhdp->osh, p, (sizeof(bcm_event_t) + len + 2));
+
+			ptr = (char *)(msg + 1);
+			/* Last 2 bytes of the message are 0x00 0x00 to signal that there
+			 * are no ethertypes which are following this
+			 */
+			ptr[len+0] = 0x00;
+			ptr[len+1] = 0x00;
+
+			skb = PKTTONATIVE(dhdp->osh, p);
+			eth = skb->data;
+			len = skb->len;
+
+			ifp = dhd->iflist[ifidx];
+			if (ifp == NULL)
+			     ifp = dhd->iflist[0];
+
+			ASSERT(ifp);
+			skb->dev = ifp->net;
+			skb->protocol = eth_type_trans(skb, skb->dev);
+
+			skb->data = eth;
+			skb->len = len;
+
+			/* Strip header, count, deliver upward */
+			skb_pull(skb, ETH_HLEN);
+
+			/* Send the packet */
+			if (in_interrupt()) {
+				netif_rx(skb);
+			} else {
+				netif_rx_ni(skb);
+			}
+		}
+		else {
+			/* Could not allocate a sk_buf */
+			DHD_ERROR(("%s: unable to alloc sk_buf\n", __FUNCTION__));
+		}
+		break;
+	} /* case WLC_E_BTA_HCI_EVENT */
+#endif /* WLBTAMP */
+
+	default:
+		break;
+	}
+}
+
+#ifdef LOG_INTO_TCPDUMP
+void
+dhd_sendup_log(dhd_pub_t *dhdp, void *data, int data_len)
+{
+	struct sk_buff *p, *skb;
+	uint32 pktlen;
+	int len;
+	dhd_if_t *ifp;
+	dhd_info_t *dhd;
+	uchar *skb_data;
+	int ifidx = 0;
+	struct ether_header eth;
+
+	pktlen = sizeof(eth) + data_len;
+	dhd = dhdp->info;
+
+	if ((p = PKTGET(dhdp->osh, pktlen, FALSE))) {
+		ASSERT(ISALIGNED((uintptr)PKTDATA(dhdp->osh, p), sizeof(uint32)));
+
+		bcopy(&dhdp->mac, &eth.ether_dhost, ETHER_ADDR_LEN);
+		bcopy(&dhdp->mac, &eth.ether_shost, ETHER_ADDR_LEN);
+		ETHER_TOGGLE_LOCALADDR(&eth.ether_shost);
+		eth.ether_type = hton16(ETHER_TYPE_BRCM);
+
+		bcopy((void *)&eth, PKTDATA(dhdp->osh, p), sizeof(eth));
+		bcopy(data, PKTDATA(dhdp->osh, p) + sizeof(eth), data_len);
+		skb = PKTTONATIVE(dhdp->osh, p);
+		skb_data = skb->data;
+		len = skb->len;
+
+		ifidx = dhd_ifname2idx(dhd, "wlan0");
+		ifp = dhd->iflist[ifidx];
+		if (ifp == NULL)
+			 ifp = dhd->iflist[0];
+
+		ASSERT(ifp);
+		skb->dev = ifp->net;
+		skb->protocol = eth_type_trans(skb, skb->dev);
+		skb->data = skb_data;
+		skb->len = len;
+
+		/* Strip header, count, deliver upward */
+		skb_pull(skb, ETH_HLEN);
+
+		/* Send the packet */
+		if (in_interrupt()) {
+			netif_rx(skb);
+		} else {
+			netif_rx_ni(skb);
+		}
+	}
+	else {
+		/* Could not allocate a sk_buf */
+		DHD_ERROR(("%s: unable to alloc sk_buf\n", __FUNCTION__));
+	}
+}
+#endif /* LOG_INTO_TCPDUMP */
+
+void dhd_wait_for_event(dhd_pub_t *dhd, bool *lockvar)
+{
+#if defined(BCMSDIO) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+	struct dhd_info *dhdinfo =  dhd->info;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+	int timeout = msecs_to_jiffies(IOCTL_RESP_TIMEOUT);
+#else
+	int timeout = (IOCTL_RESP_TIMEOUT / 1000) * HZ;
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+
+	dhd_os_sdunlock(dhd);
+	wait_event_timeout(dhdinfo->ctrl_wait, (*lockvar == FALSE), timeout);
+	dhd_os_sdlock(dhd);
+#endif /* defined(BCMSDIO) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+	return;
+}
+
+void dhd_wait_event_wakeup(dhd_pub_t *dhd)
+{
+#if defined(BCMSDIO) && (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+	struct dhd_info *dhdinfo =  dhd->info;
+	if (waitqueue_active(&dhdinfo->ctrl_wait))
+		wake_up(&dhdinfo->ctrl_wait);
+#endif
+	return;
+}
+
+#if defined(BCMSDIO) || defined(BCMPCIE)
+int
+dhd_net_bus_devreset(struct net_device *dev, uint8 flag)
+{
+	int ret = 0;
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	if (flag == TRUE) {
+		/* Issue wl down command before resetting the chip */
+		if (dhd_wl_ioctl_cmd(&dhd->pub, WLC_DOWN, NULL, 0, TRUE, 0) < 0) {
+			DHD_TRACE(("%s: wl down failed\n", __FUNCTION__));
+		}
+#ifdef PROP_TXSTATUS
+		if (dhd->pub.wlfc_enabled)
+			dhd_wlfc_deinit(&dhd->pub);
+#endif /* PROP_TXSTATUS */
+#ifdef PNO_SUPPORT
+	if (dhd->pub.pno_state)
+		dhd_pno_deinit(&dhd->pub);
+#endif
+	}
+
+#ifdef BCMSDIO
+	if (!flag) {
+		dhd_update_fw_nv_path(dhd);
+		/* update firmware and nvram path to sdio bus */
+		dhd_bus_update_fw_nv_path(dhd->pub.bus,
+			dhd->fw_path, dhd->nv_path, dhd->conf_path);
+	}
+#endif /* BCMSDIO */
+
+	ret = dhd_bus_devreset(&dhd->pub, flag);
+	if (ret) {
+		DHD_ERROR(("%s: dhd_bus_devreset: %d\n", __FUNCTION__, ret));
+		return ret;
+	}
+
+	return ret;
+}
+
+#ifdef BCMSDIO
+int
+dhd_net_bus_suspend(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return dhd_bus_suspend(&dhd->pub);
+}
+
+int
+dhd_net_bus_resume(struct net_device *dev, uint8 stage)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return dhd_bus_resume(&dhd->pub, stage);
+}
+
+#endif /* BCMSDIO */
+#endif /* BCMSDIO || BCMPCIE */
+
+int net_os_set_suspend_disable(struct net_device *dev, int val)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd) {
+		ret = dhd->pub.suspend_disable_flag;
+		dhd->pub.suspend_disable_flag = val;
+	}
+	return ret;
+}
+
+int net_os_set_suspend(struct net_device *dev, int val, int force)
+{
+	int ret = 0;
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	if (dhd) {
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+		ret = dhd_set_suspend(val, &dhd->pub);
+#else
+		ret = dhd_suspend_resume_helper(dhd, val, force);
+#endif
+#ifdef WL_CFG80211
+		wl_cfg80211_update_power_mode(dev);
+#endif
+	}
+	return ret;
+}
+
+int net_os_set_suspend_bcn_li_dtim(struct net_device *dev, int val)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	if (dhd)
+		dhd->pub.suspend_bcn_li_dtim = val;
+
+	return 0;
+}
+
+#ifdef PKT_FILTER_SUPPORT
+int net_os_rxfilter_add_remove(struct net_device *dev, int add_remove, int num)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	char *filterp = NULL;
+	int filter_id = 0;
+	int ret = 0;
+
+	if (!dhd_master_mode)
+		add_remove = !add_remove;
+
+	if (!dhd || (num == DHD_UNICAST_FILTER_NUM) ||
+		(num == DHD_MDNS_FILTER_NUM))
+		return ret;
+	if (num >= dhd->pub.pktfilter_count)
+		return -EINVAL;
+	switch (num) {
+		case DHD_BROADCAST_FILTER_NUM:
+			filterp = "101 0 0 0 0xFFFFFFFFFFFF 0xFFFFFFFFFFFF";
+			filter_id = 101;
+			break;
+		case DHD_MULTICAST4_FILTER_NUM:
+			filterp = "102 0 0 0 0xFFFFFF 0x01005E";
+			filter_id = 102;
+			break;
+		case DHD_MULTICAST6_FILTER_NUM:
+			filterp = "103 0 0 0 0xFFFF 0x3333";
+			filter_id = 103;
+			break;
+		default:
+			return -EINVAL;
+	}
+
+	/* Add filter */
+	if (add_remove) {
+		dhd->pub.pktfilter[num] = filterp;
+		dhd_pktfilter_offload_set(&dhd->pub, dhd->pub.pktfilter[num]);
+	} else { /* Delete filter */
+		if (dhd->pub.pktfilter[num] != NULL) {
+			dhd_pktfilter_offload_delete(&dhd->pub, filter_id);
+			dhd->pub.pktfilter[num] = NULL;
+		}
+	}
+	return ret;
+}
+
+int dhd_os_enable_packet_filter(dhd_pub_t *dhdp, int val)
+
+{
+	int ret = 0;
+
+	/* Packet filtering is set only if we still in early-suspend and
+	 * we need either to turn it ON or turn it OFF
+	 * We can always turn it OFF in case of early-suspend, but we turn it
+	 * back ON only if suspend_disable_flag was not set
+	*/
+	if (dhdp && dhdp->up) {
+		if (dhdp->in_suspend) {
+			if (!val || (val && !dhdp->suspend_disable_flag))
+				dhd_enable_packet_filter(val, dhdp);
+		}
+	}
+	return ret;
+}
+
+/* function to enable/disable packet for Network device */
+int net_os_enable_packet_filter(struct net_device *dev, int val)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	return dhd_os_enable_packet_filter(&dhd->pub, val);
+}
+#endif /* PKT_FILTER_SUPPORT */
+
+int
+dhd_dev_init_ioctl(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret;
+
+	if ((ret = dhd_sync_with_dongle(&dhd->pub)) < 0)
+		goto done;
+
+done:
+	return ret;
+}
+
+#ifdef PNO_SUPPORT
+/* Linux wrapper to call common dhd_pno_stop_for_ssid */
+int
+dhd_dev_pno_stop_for_ssid(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	return (dhd_pno_stop_for_ssid(&dhd->pub));
+}
+/* Linux wrapper to call common dhd_pno_set_for_ssid */
+int
+dhd_dev_pno_set_for_ssid(struct net_device *dev, wlc_ssid_t* ssids_local, int nssid,
+	uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	return (dhd_pno_set_for_ssid(&dhd->pub, ssids_local, nssid, scan_fr,
+		pno_repeat, pno_freq_expo_max, channel_list, nchan));
+}
+
+/* Linux wrapper to call common dhd_pno_enable */
+int
+dhd_dev_pno_enable(struct net_device *dev, int enable)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	return (dhd_pno_enable(&dhd->pub, enable));
+}
+
+/* Linux wrapper to call common dhd_pno_set_for_hotlist */
+int
+dhd_dev_pno_set_for_hotlist(struct net_device *dev, wl_pfn_bssid_t *p_pfn_bssid,
+	struct dhd_pno_hotlist_params *hotlist_params)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return (dhd_pno_set_for_hotlist(&dhd->pub, p_pfn_bssid, hotlist_params));
+}
+/* Linux wrapper to call common dhd_dev_pno_stop_for_batch */
+int
+dhd_dev_pno_stop_for_batch(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return (dhd_pno_stop_for_batch(&dhd->pub));
+}
+/* Linux wrapper to call common dhd_dev_pno_set_for_batch */
+int
+dhd_dev_pno_set_for_batch(struct net_device *dev, struct dhd_pno_batch_params *batch_params)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return (dhd_pno_set_for_batch(&dhd->pub, batch_params));
+}
+/* Linux wrapper to call common dhd_dev_pno_get_for_batch */
+int
+dhd_dev_pno_get_for_batch(struct net_device *dev, char *buf, int bufsize)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return (dhd_pno_get_for_batch(&dhd->pub, buf, bufsize, PNO_STATUS_NORMAL));
+}
+#endif /* PNO_SUPPORT */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (1)
+static void dhd_hang_process(void *dhd_info, void *event_info, u8 event)
+{
+	dhd_info_t *dhd;
+	struct net_device *dev;
+
+	dhd = (dhd_info_t *)dhd_info;
+	dev = dhd->iflist[0]->net;
+
+	if (dev) {
+		rtnl_lock();
+		dev_close(dev);
+		rtnl_unlock();
+#if defined(WL_WIRELESS_EXT)
+		wl_iw_send_priv_event(dev, "HANG");
+#endif
+#if defined(WL_CFG80211)
+		wl_cfg80211_hang(dev, WLAN_REASON_UNSPECIFIED);
+#endif
+	}
+}
+
+
+int dhd_os_send_hang_message(dhd_pub_t *dhdp)
+{
+	int ret = 0;
+	if (dhdp) {
+		if (!dhdp->hang_was_sent) {
+			dhdp->hang_was_sent = 1;
+			dhd_deferred_schedule_work(dhdp->info->dhd_deferred_wq, (void *)dhdp,
+				DHD_WQ_WORK_HANG_MSG, dhd_hang_process, DHD_WORK_PRIORITY_HIGH);
+		}
+	}
+	return ret;
+}
+
+int net_os_send_hang_message(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd) {
+		/* Report FW problem when enabled */
+		if (dhd->pub.hang_report) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+			ret = dhd_os_send_hang_message(&dhd->pub);
+#else
+			ret = wl_cfg80211_hang(dev, WLAN_REASON_UNSPECIFIED);
+#endif
+		} else {
+			DHD_ERROR(("%s: FW HANG ignored (for testing purpose) and not sent up\n",
+				__FUNCTION__));
+			/* Enforce bus down to stop any future traffic */
+			dhd->pub.busstate = DHD_BUS_DOWN;
+		}
+	}
+	return ret;
+}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) && OEM_ANDROID */
+
+
+int dhd_net_wifi_platform_set_power(struct net_device *dev, bool on, unsigned long delay_msec)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	return wifi_platform_set_power(dhd->adapter, on, delay_msec);
+}
+
+void dhd_get_customized_country_code(struct net_device *dev, char *country_iso_code,
+	wl_country_t *cspec)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	get_customized_country_code(dhd->adapter, country_iso_code, cspec);
+}
+void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec, bool notify)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	if (dhd && dhd->pub.up) {
+		memcpy(&dhd->pub.dhd_cspec, cspec, sizeof(wl_country_t));
+#ifdef WL_CFG80211
+		wl_update_wiphybands(NULL, notify);
+#endif
+	}
+}
+
+void dhd_bus_band_set(struct net_device *dev, uint band)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	if (dhd && dhd->pub.up) {
+#ifdef WL_CFG80211
+		wl_update_wiphybands(NULL, true);
+#endif
+	}
+}
+
+int dhd_net_set_fw_path(struct net_device *dev, char *fw)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+
+	if (!fw || fw[0] == '\0')
+		return -EINVAL;
+
+	strncpy(dhd->fw_path, fw, sizeof(dhd->fw_path) - 1);
+	dhd->fw_path[sizeof(dhd->fw_path)-1] = '\0';
+
+#if defined(SOFTAP)
+	if (strstr(fw, "apsta") != NULL) {
+		DHD_INFO(("GOT APSTA FIRMWARE\n"));
+		ap_fw_loaded = TRUE;
+	} else {
+		DHD_INFO(("GOT STA FIRMWARE\n"));
+		ap_fw_loaded = FALSE;
+	}
+#endif
+	return 0;
+}
+
+void dhd_net_if_lock(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	dhd_net_if_lock_local(dhd);
+}
+
+void dhd_net_if_unlock(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	dhd_net_if_unlock_local(dhd);
+}
+
+static void dhd_net_if_lock_local(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	if (dhd)
+		mutex_lock(&dhd->dhd_net_if_mutex);
+#endif
+}
+
+static void dhd_net_if_unlock_local(dhd_info_t *dhd)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	if (dhd)
+		mutex_unlock(&dhd->dhd_net_if_mutex);
+#endif
+}
+
+static void dhd_suspend_lock(dhd_pub_t *pub)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	if (dhd)
+		mutex_lock(&dhd->dhd_suspend_mutex);
+#endif
+}
+
+static void dhd_suspend_unlock(dhd_pub_t *pub)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) && 1
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	if (dhd)
+		mutex_unlock(&dhd->dhd_suspend_mutex);
+#endif
+}
+
+unsigned long dhd_os_general_spin_lock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags = 0;
+
+	if (dhd)
+		spin_lock_irqsave(&dhd->dhd_lock, flags);
+
+	return flags;
+}
+
+void dhd_os_general_spin_unlock(dhd_pub_t *pub, unsigned long flags)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+
+	if (dhd)
+		spin_unlock_irqrestore(&dhd->dhd_lock, flags);
+}
+
+/* Linux specific multipurpose spinlock API */
+void *
+dhd_os_spin_lock_init(osl_t *osh)
+{
+	/* Adding 4 bytes since the sizeof(spinlock_t) could be 0 */
+	/* if CONFIG_SMP and CONFIG_DEBUG_SPINLOCK are not defined */
+	/* and this results in kernel asserts in internal builds */
+	spinlock_t * lock = MALLOC(osh, sizeof(spinlock_t) + 4);
+	if (lock)
+		spin_lock_init(lock);
+	return ((void *)lock);
+}
+void
+dhd_os_spin_lock_deinit(osl_t *osh, void *lock)
+{
+	MFREE(osh, lock, sizeof(spinlock_t) + 4);
+}
+unsigned long
+dhd_os_spin_lock(void *lock)
+{
+	unsigned long flags = 0;
+
+	if (lock)
+		spin_lock_irqsave((spinlock_t *)lock, flags);
+
+	return flags;
+}
+void
+dhd_os_spin_unlock(void *lock, unsigned long flags)
+{
+	if (lock)
+		spin_unlock_irqrestore((spinlock_t *)lock, flags);
+}
+
+static int
+dhd_get_pend_8021x_cnt(dhd_info_t *dhd)
+{
+	return (atomic_read(&dhd->pend_8021x_cnt));
+}
+
+#define MAX_WAIT_FOR_8021X_TX	100
+
+int
+dhd_wait_pend8021x(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int timeout = msecs_to_jiffies(10);
+	int ntimes = MAX_WAIT_FOR_8021X_TX;
+	int pend = dhd_get_pend_8021x_cnt(dhd);
+
+	while (ntimes && pend) {
+		if (pend) {
+			set_current_state(TASK_INTERRUPTIBLE);
+			DHD_PERIM_UNLOCK(&dhd->pub);
+			schedule_timeout(timeout);
+			DHD_PERIM_LOCK(&dhd->pub);
+			set_current_state(TASK_RUNNING);
+			ntimes--;
+		}
+		pend = dhd_get_pend_8021x_cnt(dhd);
+	}
+	if (ntimes == 0)
+	{
+		atomic_set(&dhd->pend_8021x_cnt, 0);
+		DHD_ERROR(("%s: TIMEOUT\n", __FUNCTION__));
+	}
+	return pend;
+}
+
+#ifdef DHD_DEBUG
+int
+write_to_file(dhd_pub_t *dhd, uint8 *buf, int size)
+{
+	int ret = 0;
+	struct file *fp;
+	mm_segment_t old_fs;
+	loff_t pos = 0;
+
+	/* change to KERNEL_DS address limit */
+	old_fs = get_fs();
+	set_fs(KERNEL_DS);
+
+	/* open file to write */
+	fp = filp_open("/tmp/mem_dump", O_WRONLY|O_CREAT, 0640);
+	if (!fp) {
+		printf("%s: open file error\n", __FUNCTION__);
+		ret = -1;
+		goto exit;
+	}
+
+	/* Write buf to file */
+	fp->f_op->write(fp, buf, size, &pos);
+
+exit:
+	/* free buf before return */
+	MFREE(dhd->osh, buf, size);
+	/* close file before return */
+	if (fp)
+		filp_close(fp, current->files);
+	/* restore previous address limit */
+	set_fs(old_fs);
+
+	return ret;
+}
+#endif /* DHD_DEBUG */
+
+int dhd_os_wake_lock_timeout(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		ret = dhd->wakelock_rx_timeout_enable > dhd->wakelock_ctrl_timeout_enable ?
+			dhd->wakelock_rx_timeout_enable : dhd->wakelock_ctrl_timeout_enable;
+#ifdef CONFIG_HAS_WAKELOCK
+		if (dhd->wakelock_rx_timeout_enable)
+			wake_lock_timeout(&dhd->wl_rxwake,
+				msecs_to_jiffies(dhd->wakelock_rx_timeout_enable));
+		if (dhd->wakelock_ctrl_timeout_enable)
+			wake_lock_timeout(&dhd->wl_ctrlwake,
+				msecs_to_jiffies(dhd->wakelock_ctrl_timeout_enable));
+#endif
+		dhd->wakelock_rx_timeout_enable = 0;
+		dhd->wakelock_ctrl_timeout_enable = 0;
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return ret;
+}
+
+int net_os_wake_lock_timeout(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd)
+		ret = dhd_os_wake_lock_timeout(&dhd->pub);
+	return ret;
+}
+
+int dhd_os_wake_lock_rx_timeout_enable(dhd_pub_t *pub, int val)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		if (val > dhd->wakelock_rx_timeout_enable)
+			dhd->wakelock_rx_timeout_enable = val;
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return 0;
+}
+
+int dhd_os_wake_lock_ctrl_timeout_enable(dhd_pub_t *pub, int val)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		if (val > dhd->wakelock_ctrl_timeout_enable)
+			dhd->wakelock_ctrl_timeout_enable = val;
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return 0;
+}
+
+int dhd_os_wake_lock_ctrl_timeout_cancel(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		dhd->wakelock_ctrl_timeout_enable = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+		if (wake_lock_active(&dhd->wl_ctrlwake))
+			wake_unlock(&dhd->wl_ctrlwake);
+#endif
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return 0;
+}
+
+int net_os_wake_lock_rx_timeout_enable(struct net_device *dev, int val)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd)
+		ret = dhd_os_wake_lock_rx_timeout_enable(&dhd->pub, val);
+	return ret;
+}
+
+int net_os_wake_lock_ctrl_timeout_enable(struct net_device *dev, int val)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd)
+		ret = dhd_os_wake_lock_ctrl_timeout_enable(&dhd->pub, val);
+	return ret;
+}
+
+int dhd_os_wake_lock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+
+		if (dhd->wakelock_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+			wake_lock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+			dhd_bus_dev_pm_stay_awake(pub);
+#endif
+		}
+		dhd->wakelock_counter++;
+		ret = dhd->wakelock_counter;
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return ret;
+}
+
+int net_os_wake_lock(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd)
+		ret = dhd_os_wake_lock(&dhd->pub);
+	return ret;
+}
+
+int dhd_os_wake_unlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	dhd_os_wake_lock_timeout(pub);
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		if (dhd->wakelock_counter > 0) {
+			dhd->wakelock_counter--;
+			if (dhd->wakelock_counter == 0 && !dhd->waive_wakelock) {
+#ifdef CONFIG_HAS_WAKELOCK
+				wake_unlock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+				dhd_bus_dev_pm_relax(pub);
+#endif
+			}
+			ret = dhd->wakelock_counter;
+		}
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return ret;
+}
+
+int dhd_os_check_wakelock(dhd_pub_t *pub)
+{
+#if defined(CONFIG_HAS_WAKELOCK) || (defined(BCMSDIO) && (LINUX_VERSION_CODE > \
+	KERNEL_VERSION(2, 6, 36)))
+	dhd_info_t *dhd;
+
+	if (!pub)
+		return 0;
+	dhd = (dhd_info_t *)(pub->info);
+#endif /* CONFIG_HAS_WAKELOCK || BCMSDIO */
+
+#ifdef CONFIG_HAS_WAKELOCK
+	/* Indicate to the SD Host to avoid going to suspend if internal locks are up */
+	if (dhd && (wake_lock_active(&dhd->wl_wifi) ||
+		(wake_lock_active(&dhd->wl_wdwake))))
+		return 1;
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+	if (dhd && (dhd->wakelock_counter > 0) && dhd_bus_dev_pm_enabled(pub))
+		return 1;
+#endif
+	return 0;
+}
+
+int dhd_os_check_wakelock_all(dhd_pub_t *pub)
+{
+#if defined(CONFIG_HAS_WAKELOCK) || (defined(BCMSDIO) && (LINUX_VERSION_CODE > \
+	KERNEL_VERSION(2, 6, 36)))
+	dhd_info_t *dhd;
+
+	if (!pub)
+		return 0;
+	dhd = (dhd_info_t *)(pub->info);
+#endif /* CONFIG_HAS_WAKELOCK || BCMSDIO */
+
+#ifdef CONFIG_HAS_WAKELOCK
+	/* Indicate to the SD Host to avoid going to suspend if internal locks are up */
+	if (dhd && (wake_lock_active(&dhd->wl_wifi) ||
+		wake_lock_active(&dhd->wl_wdwake) ||
+		wake_lock_active(&dhd->wl_rxwake) ||
+		wake_lock_active(&dhd->wl_ctrlwake))) {
+		return 1;
+	}
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+	if (dhd && (dhd->wakelock_counter > 0) && dhd_bus_dev_pm_enabled(pub))
+		return 1;
+#endif
+	return 0;
+}
+
+int net_os_wake_unlock(struct net_device *dev)
+{
+	dhd_info_t *dhd = DHD_DEV_INFO(dev);
+	int ret = 0;
+
+	if (dhd)
+		ret = dhd_os_wake_unlock(&dhd->pub);
+	return ret;
+}
+
+int dhd_os_wd_wake_lock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+#ifdef CONFIG_HAS_WAKELOCK
+		/* if wakelock_wd_counter was never used : lock it at once */
+		if (!dhd->wakelock_wd_counter)
+			wake_lock(&dhd->wl_wdwake);
+#endif
+		dhd->wakelock_wd_counter++;
+		ret = dhd->wakelock_wd_counter;
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return ret;
+}
+
+int dhd_os_wd_wake_unlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		if (dhd->wakelock_wd_counter) {
+			dhd->wakelock_wd_counter = 0;
+#ifdef CONFIG_HAS_WAKELOCK
+			wake_unlock(&dhd->wl_wdwake);
+#endif
+		}
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return ret;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+int dhd_os_oob_irq_wake_lock_timeout(dhd_pub_t *pub, int val)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	int ret = 0;
+
+	if (dhd) {
+#ifdef CONFIG_HAS_WAKELOCK
+		wake_lock_timeout(&dhd->wl_intrwake, msecs_to_jiffies(val));
+#endif
+	}
+	return ret;
+}
+
+int dhd_os_oob_irq_wake_unlock(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	int ret = 0;
+
+	if (dhd) {
+#ifdef CONFIG_HAS_WAKELOCK
+		/* if wl_intrwake is active, unlock it */
+		if (wake_lock_active(&dhd->wl_intrwake)) {
+			wake_unlock(&dhd->wl_intrwake);
+		}
+#endif
+	}
+	return ret;
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+/* waive wakelocks for operations such as IOVARs in suspend function, must be closed
+ * by a paired function call to dhd_wakelock_restore. returns current wakelock counter
+ */
+int dhd_os_wake_lock_waive(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	if (dhd) {
+		spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+		/* dhd_wakelock_waive/dhd_wakelock_restore must be paired */
+		if (dhd->waive_wakelock == FALSE) {
+			/* record current lock status */
+			dhd->wakelock_before_waive = dhd->wakelock_counter;
+			dhd->waive_wakelock = TRUE;
+		}
+		ret = dhd->wakelock_wd_counter;
+		spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	}
+	return ret;
+}
+
+int dhd_os_wake_lock_restore(dhd_pub_t *pub)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(pub->info);
+	unsigned long flags;
+	int ret = 0;
+
+	if (!dhd)
+		return 0;
+
+	spin_lock_irqsave(&dhd->wakelock_spinlock, flags);
+	/* dhd_wakelock_waive/dhd_wakelock_restore must be paired */
+	if (!dhd->waive_wakelock)
+		goto exit;
+
+	dhd->waive_wakelock = FALSE;
+	/* if somebody else acquires wakelock between dhd_wakelock_waive/dhd_wakelock_restore,
+	 * we need to make it up by calling wake_lock or pm_stay_awake. or if somebody releases
+	 * the lock in between, do the same by calling wake_unlock or pm_relax
+	 */
+	if (dhd->wakelock_before_waive == 0 && dhd->wakelock_counter > 0) {
+#ifdef CONFIG_HAS_WAKELOCK
+		wake_lock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+		dhd_bus_dev_pm_stay_awake(&dhd->pub);
+#endif
+	} else if (dhd->wakelock_before_waive > 0 && dhd->wakelock_counter == 0) {
+#ifdef CONFIG_HAS_WAKELOCK
+		wake_unlock(&dhd->wl_wifi);
+#elif defined(BCMSDIO) && (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 36))
+		dhd_bus_dev_pm_relax(&dhd->pub);
+#endif
+	}
+	dhd->wakelock_before_waive = 0;
+exit:
+	ret = dhd->wakelock_wd_counter;
+	spin_unlock_irqrestore(&dhd->wakelock_spinlock, flags);
+	return ret;
+}
+
+bool dhd_os_check_if_up(dhd_pub_t *pub)
+{
+	if (!pub)
+		return FALSE;
+	return pub->up;
+}
+
+/* function to collect firmware, chip id and chip version info */
+void dhd_set_version_info(dhd_pub_t *dhdp, char *fw)
+{
+	int i;
+
+	i = snprintf(info_string, sizeof(info_string),
+		"  Driver: %s\n  Firmware: %s ", EPI_VERSION_STR, fw);
+	printf("%s\n", info_string);
+
+	if (!dhdp)
+		return;
+
+	i = snprintf(&info_string[i], sizeof(info_string) - i,
+		"\n  Chip: %x Rev %x Pkg %x", dhd_bus_chip_id(dhdp),
+		dhd_bus_chiprev_id(dhdp), dhd_bus_chippkg_id(dhdp));
+}
+
+int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd)
+{
+	int ifidx;
+	int ret = 0;
+	dhd_info_t *dhd = NULL;
+
+	if (!net || !DEV_PRIV(net)) {
+		DHD_ERROR(("%s invalid parameter\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	dhd = DHD_DEV_INFO(net);
+	if (!dhd)
+		return -EINVAL;
+
+	ifidx = dhd_net2idx(dhd, net);
+	if (ifidx == DHD_BAD_IF) {
+		DHD_ERROR(("%s bad ifidx\n", __FUNCTION__));
+		return -ENODEV;
+	}
+
+	DHD_OS_WAKE_LOCK(&dhd->pub);
+	DHD_PERIM_LOCK(&dhd->pub);
+
+	ret = dhd_wl_ioctl(&dhd->pub, ifidx, ioc, ioc->buf, ioc->len);
+	dhd_check_hang(net, &dhd->pub, ret);
+
+	DHD_PERIM_UNLOCK(&dhd->pub);
+	DHD_OS_WAKE_UNLOCK(&dhd->pub);
+
+	return ret;
+}
+
+bool dhd_os_check_hang(dhd_pub_t *dhdp, int ifidx, int ret)
+{
+	struct net_device *net;
+
+	net = dhd_idx2net(dhdp, ifidx);
+	if (!net) {
+		DHD_ERROR(("%s : Invalid index : %d\n", __FUNCTION__, ifidx));
+		return -EINVAL;
+	}
+
+	return dhd_check_hang(net, dhdp, ret);
+}
+
+/* Return instance */
+int dhd_get_instance(dhd_pub_t *dhdp)
+{
+	return dhdp->info->unit;
+}
+
+
+#ifdef PROP_TXSTATUS
+
+void dhd_wlfc_plat_init(void *dhd)
+{
+	return;
+}
+
+void dhd_wlfc_plat_deinit(void *dhd)
+{
+	return;
+}
+
+bool dhd_wlfc_skip_fc(void)
+{
+	return FALSE;
+}
+#endif /* PROP_TXSTATUS */
+
+#ifdef BCMDBGFS
+
+#include <linux/debugfs.h>
+
+extern uint32 dhd_readregl(void *bp, uint32 addr);
+extern uint32 dhd_writeregl(void *bp, uint32 addr, uint32 data);
+
+typedef struct dhd_dbgfs {
+	struct dentry	*debugfs_dir;
+	struct dentry	*debugfs_mem;
+	dhd_pub_t 	*dhdp;
+	uint32 		size;
+} dhd_dbgfs_t;
+
+dhd_dbgfs_t g_dbgfs;
+
+static int
+dhd_dbg_state_open(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t
+dhd_dbg_state_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+	ssize_t rval;
+	uint32 tmp;
+	loff_t pos = *ppos;
+	size_t ret;
+
+	if (pos < 0)
+		return -EINVAL;
+	if (pos >= g_dbgfs.size || !count)
+		return 0;
+	if (count > g_dbgfs.size - pos)
+		count = g_dbgfs.size - pos;
+
+	/* Basically enforce aligned 4 byte reads. It's up to the user to work out the details */
+	tmp = dhd_readregl(g_dbgfs.dhdp->bus, file->f_pos & (~3));
+
+	ret = copy_to_user(ubuf, &tmp, 4);
+	if (ret == count)
+		return -EFAULT;
+
+	count -= ret;
+	*ppos = pos + count;
+	rval = count;
+
+	return rval;
+}
+
+
+static ssize_t
+dhd_debugfs_write(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos)
+{
+	loff_t pos = *ppos;
+	size_t ret;
+	uint32 buf;
+
+	if (pos < 0)
+		return -EINVAL;
+	if (pos >= g_dbgfs.size || !count)
+		return 0;
+	if (count > g_dbgfs.size - pos)
+		count = g_dbgfs.size - pos;
+
+	ret = copy_from_user(&buf, ubuf, sizeof(uint32));
+	if (ret == count)
+		return -EFAULT;
+
+	/* Basically enforce aligned 4 byte writes. It's up to the user to work out the details */
+	dhd_writeregl(g_dbgfs.dhdp->bus, file->f_pos & (~3), buf);
+
+	return count;
+}
+
+
+loff_t
+dhd_debugfs_lseek(struct file *file, loff_t off, int whence)
+{
+	loff_t pos = -1;
+
+	switch (whence) {
+		case 0:
+			pos = off;
+			break;
+		case 1:
+			pos = file->f_pos + off;
+			break;
+		case 2:
+			pos = g_dbgfs.size - off;
+	}
+	return (pos < 0 || pos > g_dbgfs.size) ? -EINVAL : (file->f_pos = pos);
+}
+
+static const struct file_operations dhd_dbg_state_ops = {
+	.read   = dhd_dbg_state_read,
+	.write	= dhd_debugfs_write,
+	.open   = dhd_dbg_state_open,
+	.llseek	= dhd_debugfs_lseek
+};
+
+static void dhd_dbg_create(void)
+{
+	if (g_dbgfs.debugfs_dir) {
+		g_dbgfs.debugfs_mem = debugfs_create_file("mem", 0644, g_dbgfs.debugfs_dir,
+			NULL, &dhd_dbg_state_ops);
+	}
+}
+
+void dhd_dbg_init(dhd_pub_t *dhdp)
+{
+	int err;
+
+	g_dbgfs.dhdp = dhdp;
+	g_dbgfs.size = 0x20000000; /* Allow access to various cores regs */
+
+	g_dbgfs.debugfs_dir = debugfs_create_dir("dhd", 0);
+	if (IS_ERR(g_dbgfs.debugfs_dir)) {
+		err = PTR_ERR(g_dbgfs.debugfs_dir);
+		g_dbgfs.debugfs_dir = NULL;
+		return;
+	}
+
+	dhd_dbg_create();
+
+	return;
+}
+
+void dhd_dbg_remove(void)
+{
+	debugfs_remove(g_dbgfs.debugfs_mem);
+	debugfs_remove(g_dbgfs.debugfs_dir);
+
+	bzero((unsigned char *) &g_dbgfs, sizeof(g_dbgfs));
+
+}
+#endif /* ifdef BCMDBGFS */
+
+#ifdef WLMEDIA_HTSF
+
+static
+void dhd_htsf_addtxts(dhd_pub_t *dhdp, void *pktbuf)
+{
+	dhd_info_t *dhd = (dhd_info_t *)(dhdp->info);
+	struct sk_buff *skb;
+	uint32 htsf = 0;
+	uint16 dport = 0, oldmagic = 0xACAC;
+	char *p1;
+	htsfts_t ts;
+
+	/*  timestamp packet  */
+
+	p1 = (char*) PKTDATA(dhdp->osh, pktbuf);
+
+	if (PKTLEN(dhdp->osh, pktbuf) > HTSF_MINLEN) {
+/*		memcpy(&proto, p1+26, 4);  	*/
+		memcpy(&dport, p1+40, 2);
+/* 	proto = ((ntoh32(proto))>> 16) & 0xFF;  */
+		dport = ntoh16(dport);
+	}
+
+	/* timestamp only if  icmp or udb iperf with port 5555 */
+/*	if (proto == 17 && dport == tsport) { */
+	if (dport >= tsport && dport <= tsport + 20) {
+
+		skb = (struct sk_buff *) pktbuf;
+
+		htsf = dhd_get_htsf(dhd, 0);
+		memset(skb->data + 44, 0, 2); /* clear checksum */
+		memcpy(skb->data+82, &oldmagic, 2);
+		memcpy(skb->data+84, &htsf, 4);
+
+		memset(&ts, 0, sizeof(htsfts_t));
+		ts.magic  = HTSFMAGIC;
+		ts.prio   = PKTPRIO(pktbuf);
+		ts.seqnum = htsf_seqnum++;
+		ts.c10    = get_cycles();
+		ts.t10    = htsf;
+		ts.endmagic = HTSFENDMAGIC;
+
+		memcpy(skb->data + HTSF_HOSTOFFSET, &ts, sizeof(ts));
+	}
+}
+
+static void dhd_dump_htsfhisto(histo_t *his, char *s)
+{
+	int pktcnt = 0, curval = 0, i;
+	for (i = 0; i < (NUMBIN-2); i++) {
+		curval += 500;
+		printf("%d ",  his->bin[i]);
+		pktcnt += his->bin[i];
+	}
+	printf(" max: %d TotPkt: %d neg: %d [%s]\n", his->bin[NUMBIN-2], pktcnt,
+		his->bin[NUMBIN-1], s);
+}
+
+static
+void sorttobin(int value, histo_t *histo)
+{
+	int i, binval = 0;
+
+	if (value < 0) {
+		histo->bin[NUMBIN-1]++;
+		return;
+	}
+	if (value > histo->bin[NUMBIN-2])  /* store the max value  */
+		histo->bin[NUMBIN-2] = value;
+
+	for (i = 0; i < (NUMBIN-2); i++) {
+		binval += 500; /* 500m s bins */
+		if (value <= binval) {
+			histo->bin[i]++;
+			return;
+		}
+	}
+	histo->bin[NUMBIN-3]++;
+}
+
+static
+void dhd_htsf_addrxts(dhd_pub_t *dhdp, void *pktbuf)
+{
+	dhd_info_t *dhd = (dhd_info_t *)dhdp->info;
+	struct sk_buff *skb;
+	char *p1;
+	uint16 old_magic;
+	int d1, d2, d3, end2end;
+	htsfts_t *htsf_ts;
+	uint32 htsf;
+
+	skb = PKTTONATIVE(dhdp->osh, pktbuf);
+	p1 = (char*)PKTDATA(dhdp->osh, pktbuf);
+
+	if (PKTLEN(osh, pktbuf) > HTSF_MINLEN) {
+		memcpy(&old_magic, p1+78, 2);
+		htsf_ts = (htsfts_t*) (p1 + HTSF_HOSTOFFSET - 4);
+	}
+	else
+		return;
+
+	if (htsf_ts->magic == HTSFMAGIC) {
+		htsf_ts->tE0 = dhd_get_htsf(dhd, 0);
+		htsf_ts->cE0 = get_cycles();
+	}
+
+	if (old_magic == 0xACAC) {
+
+		tspktcnt++;
+		htsf = dhd_get_htsf(dhd, 0);
+		memcpy(skb->data+92, &htsf, sizeof(uint32));
+
+		memcpy(&ts[tsidx].t1, skb->data+80, 16);
+
+		d1 = ts[tsidx].t2 - ts[tsidx].t1;
+		d2 = ts[tsidx].t3 - ts[tsidx].t2;
+		d3 = ts[tsidx].t4 - ts[tsidx].t3;
+		end2end = ts[tsidx].t4 - ts[tsidx].t1;
+
+		sorttobin(d1, &vi_d1);
+		sorttobin(d2, &vi_d2);
+		sorttobin(d3, &vi_d3);
+		sorttobin(end2end, &vi_d4);
+
+		if (end2end > 0 && end2end >  maxdelay) {
+			maxdelay = end2end;
+			maxdelaypktno = tspktcnt;
+			memcpy(&maxdelayts, &ts[tsidx], 16);
+		}
+		if (++tsidx >= TSMAX)
+			tsidx = 0;
+	}
+}
+
+uint32 dhd_get_htsf(dhd_info_t *dhd, int ifidx)
+{
+	uint32 htsf = 0, cur_cycle, delta, delta_us;
+	uint32    factor, baseval, baseval2;
+	cycles_t t;
+
+	t = get_cycles();
+	cur_cycle = t;
+
+	if (cur_cycle >  dhd->htsf.last_cycle)
+		delta = cur_cycle -  dhd->htsf.last_cycle;
+	else {
+		delta = cur_cycle + (0xFFFFFFFF -  dhd->htsf.last_cycle);
+	}
+
+	delta = delta >> 4;
+
+	if (dhd->htsf.coef) {
+		/* times ten to get the first digit */
+	        factor = (dhd->htsf.coef*10 + dhd->htsf.coefdec1);
+		baseval  = (delta*10)/factor;
+		baseval2 = (delta*10)/(factor+1);
+		delta_us  = (baseval -  (((baseval - baseval2) * dhd->htsf.coefdec2)) / 10);
+		htsf = (delta_us << 4) +  dhd->htsf.last_tsf + HTSF_BUS_DELAY;
+	}
+	else {
+		DHD_ERROR(("-------dhd->htsf.coef = 0 -------\n"));
+	}
+
+	return htsf;
+}
+
+static void dhd_dump_latency(void)
+{
+	int i, max = 0;
+	int d1, d2, d3, d4, d5;
+
+	printf("T1       T2       T3       T4           d1  d2   t4-t1     i    \n");
+	for (i = 0; i < TSMAX; i++) {
+		d1 = ts[i].t2 - ts[i].t1;
+		d2 = ts[i].t3 - ts[i].t2;
+		d3 = ts[i].t4 - ts[i].t3;
+		d4 = ts[i].t4 - ts[i].t1;
+		d5 = ts[max].t4-ts[max].t1;
+		if (d4 > d5 && d4 > 0)  {
+			max = i;
+		}
+		printf("%08X %08X %08X %08X \t%d %d %d   %d i=%d\n",
+			ts[i].t1, ts[i].t2, ts[i].t3, ts[i].t4,
+			d1, d2, d3, d4, i);
+	}
+
+	printf("current idx = %d \n", tsidx);
+
+	printf("Highest latency %d pkt no.%d total=%d\n", maxdelay, maxdelaypktno, tspktcnt);
+	printf("%08X %08X %08X %08X \t%d %d %d   %d\n",
+	maxdelayts.t1, maxdelayts.t2, maxdelayts.t3, maxdelayts.t4,
+	maxdelayts.t2 - maxdelayts.t1,
+	maxdelayts.t3 - maxdelayts.t2,
+	maxdelayts.t4 - maxdelayts.t3,
+	maxdelayts.t4 - maxdelayts.t1);
+}
+
+
+static int
+dhd_ioctl_htsf_get(dhd_info_t *dhd, int ifidx)
+{
+	wl_ioctl_t ioc;
+	char buf[32];
+	int ret;
+	uint32 s1, s2;
+
+	struct tsf {
+		uint32 low;
+		uint32 high;
+	} tsf_buf;
+
+	memset(&ioc, 0, sizeof(ioc));
+	memset(&tsf_buf, 0, sizeof(tsf_buf));
+
+	ioc.cmd = WLC_GET_VAR;
+	ioc.buf = buf;
+	ioc.len = (uint)sizeof(buf);
+	ioc.set = FALSE;
+
+	strncpy(buf, "tsf", sizeof(buf) - 1);
+	buf[sizeof(buf) - 1] = '\0';
+	s1 = dhd_get_htsf(dhd, 0);
+	if ((ret = dhd_wl_ioctl(&dhd->pub, ifidx, &ioc, ioc.buf, ioc.len)) < 0) {
+		if (ret == -EIO) {
+			DHD_ERROR(("%s: tsf is not supported by device\n",
+				dhd_ifname(&dhd->pub, ifidx)));
+			return -EOPNOTSUPP;
+		}
+		return ret;
+	}
+	s2 = dhd_get_htsf(dhd, 0);
+
+	memcpy(&tsf_buf, buf, sizeof(tsf_buf));
+	printf(" TSF_h=%04X lo=%08X Calc:htsf=%08X, coef=%d.%d%d delta=%d ",
+		tsf_buf.high, tsf_buf.low, s2, dhd->htsf.coef, dhd->htsf.coefdec1,
+		dhd->htsf.coefdec2, s2-tsf_buf.low);
+	printf("lasttsf=%08X lastcycle=%08X\n", dhd->htsf.last_tsf, dhd->htsf.last_cycle);
+	return 0;
+}
+
+void htsf_update(dhd_info_t *dhd, void *data)
+{
+	static ulong  cur_cycle = 0, prev_cycle = 0;
+	uint32 htsf, tsf_delta = 0;
+	uint32 hfactor = 0, cyc_delta, dec1 = 0, dec2, dec3, tmp;
+	ulong b, a;
+	cycles_t t;
+
+	/* cycles_t in inlcude/mips/timex.h */
+
+	t = get_cycles();
+
+	prev_cycle = cur_cycle;
+	cur_cycle = t;
+
+	if (cur_cycle > prev_cycle)
+		cyc_delta = cur_cycle - prev_cycle;
+	else {
+		b = cur_cycle;
+		a = prev_cycle;
+		cyc_delta = cur_cycle + (0xFFFFFFFF - prev_cycle);
+	}
+
+	if (data == NULL)
+		printf(" tsf update ata point er is null \n");
+
+	memcpy(&prev_tsf, &cur_tsf, sizeof(tsf_t));
+	memcpy(&cur_tsf, data, sizeof(tsf_t));
+
+	if (cur_tsf.low == 0) {
+		DHD_INFO((" ---- 0 TSF, do not update, return\n"));
+		return;
+	}
+
+	if (cur_tsf.low > prev_tsf.low)
+		tsf_delta = (cur_tsf.low - prev_tsf.low);
+	else {
+		DHD_INFO((" ---- tsf low is smaller cur_tsf= %08X, prev_tsf=%08X, \n",
+		 cur_tsf.low, prev_tsf.low));
+		if (cur_tsf.high > prev_tsf.high) {
+			tsf_delta = cur_tsf.low + (0xFFFFFFFF - prev_tsf.low);
+			DHD_INFO((" ---- Wrap around tsf coutner  adjusted TSF=%08X\n", tsf_delta));
+		}
+		else
+			return; /* do not update */
+	}
+
+	if (tsf_delta)  {
+		hfactor = cyc_delta / tsf_delta;
+		tmp  = 	(cyc_delta - (hfactor * tsf_delta))*10;
+		dec1 =  tmp/tsf_delta;
+		dec2 =  ((tmp - dec1*tsf_delta)*10) / tsf_delta;
+		tmp  = 	(tmp   - (dec1*tsf_delta))*10;
+		dec3 =  ((tmp - dec2*tsf_delta)*10) / tsf_delta;
+
+		if (dec3 > 4) {
+			if (dec2 == 9) {
+				dec2 = 0;
+				if (dec1 == 9) {
+					dec1 = 0;
+					hfactor++;
+				}
+				else {
+					dec1++;
+				}
+			}
+			else
+				dec2++;
+		}
+	}
+
+	if (hfactor) {
+		htsf = ((cyc_delta * 10)  / (hfactor*10+dec1)) + prev_tsf.low;
+		dhd->htsf.coef = hfactor;
+		dhd->htsf.last_cycle = cur_cycle;
+		dhd->htsf.last_tsf = cur_tsf.low;
+		dhd->htsf.coefdec1 = dec1;
+		dhd->htsf.coefdec2 = dec2;
+	}
+	else {
+		htsf = prev_tsf.low;
+	}
+}
+
+#endif /* WLMEDIA_HTSF */
+
+#ifdef CUSTOM_SET_CPUCORE
+void dhd_set_cpucore(dhd_pub_t *dhd, int set)
+{
+	int e_dpc = 0, e_rxf = 0, retry_set = 0;
+
+	if (!(dhd->chan_isvht80)) {
+		DHD_ERROR(("%s: chan_status(%d) cpucore!!!\n", __FUNCTION__, dhd->chan_isvht80));
+		return;
+	}
+
+	if (DPC_CPUCORE) {
+		do {
+			if (set == TRUE) {
+				e_dpc = set_cpus_allowed_ptr(dhd->current_dpc,
+					cpumask_of(DPC_CPUCORE));
+			} else {
+				e_dpc = set_cpus_allowed_ptr(dhd->current_dpc,
+					cpumask_of(PRIMARY_CPUCORE));
+			}
+			if (retry_set++ > MAX_RETRY_SET_CPUCORE) {
+				DHD_ERROR(("%s: dpc(%d) invalid cpu!\n", __FUNCTION__, e_dpc));
+				return;
+			}
+			if (e_dpc < 0)
+				OSL_SLEEP(1);
+		} while (e_dpc < 0);
+	}
+	if (RXF_CPUCORE) {
+		do {
+			if (set == TRUE) {
+				e_rxf = set_cpus_allowed_ptr(dhd->current_rxf,
+					cpumask_of(RXF_CPUCORE));
+			} else {
+				e_rxf = set_cpus_allowed_ptr(dhd->current_rxf,
+					cpumask_of(PRIMARY_CPUCORE));
+			}
+			if (retry_set++ > MAX_RETRY_SET_CPUCORE) {
+				DHD_ERROR(("%s: rxf(%d) invalid cpu!\n", __FUNCTION__, e_rxf));
+				return;
+			}
+			if (e_rxf < 0)
+				OSL_SLEEP(1);
+		} while (e_rxf < 0);
+	}
+#ifdef DHD_OF_SUPPORT
+	interrupt_set_cpucore(set);
+#endif /* DHD_OF_SUPPORT */
+	DHD_TRACE(("%s: set(%d) cpucore success!\n", __FUNCTION__, set));
+
+	return;
+}
+#endif /* CUSTOM_SET_CPUCORE */
+#if defined(DHD_TCP_WINSIZE_ADJUST)
+static int dhd_port_list_match(int port)
+{
+	int i;
+	for (i = 0; i < MAX_TARGET_PORTS; i++) {
+		if (target_ports[i] == port)
+			return 1;
+	}
+	return 0;
+}
+static void dhd_adjust_tcp_winsize(int op_mode, struct sk_buff *skb)
+{
+	struct iphdr *ipheader;
+	struct tcphdr *tcpheader;
+	uint16 win_size;
+	int32 incremental_checksum;
+
+	if (!(op_mode & DHD_FLAG_HOSTAP_MODE))
+		return;
+	if (skb == NULL || skb->data == NULL)
+		return;
+
+	ipheader = (struct iphdr*)(skb->data);
+
+	if (ipheader->protocol == IPPROTO_TCP) {
+		tcpheader = (struct tcphdr*) skb_pull(skb, (ipheader->ihl)<<2);
+		if (tcpheader) {
+			win_size = ntoh16(tcpheader->window);
+			if (win_size < MIN_TCP_WIN_SIZE &&
+				dhd_port_list_match(ntoh16(tcpheader->dest))) {
+				incremental_checksum = ntoh16(tcpheader->check);
+				incremental_checksum += win_size - win_size*WIN_SIZE_SCALE_FACTOR;
+				if (incremental_checksum < 0)
+					--incremental_checksum;
+				tcpheader->window = hton16(win_size*WIN_SIZE_SCALE_FACTOR);
+				tcpheader->check = hton16((unsigned short)incremental_checksum);
+			}
+		}
+		skb_push(skb, (ipheader->ihl)<<2);
+	}
+}
+#endif /* DHD_TCP_WINSIZE_ADJUST */
+
+/* Get interface specific ap_isolate configuration */
+int dhd_get_ap_isolate(dhd_pub_t *dhdp, uint32 idx)
+{
+	dhd_info_t *dhd = dhdp->info;
+	dhd_if_t *ifp;
+
+	ASSERT(idx < DHD_MAX_IFS);
+
+	ifp = dhd->iflist[idx];
+
+	return ifp->ap_isolate;
+}
+
+/* Set interface specific ap_isolate configuration */
+int dhd_set_ap_isolate(dhd_pub_t *dhdp, uint32 idx, int val)
+{
+	dhd_info_t *dhd = dhdp->info;
+	dhd_if_t *ifp;
+
+	ASSERT(idx < DHD_MAX_IFS);
+
+	ifp = dhd->iflist[idx];
+
+	ifp->ap_isolate = val;
+
+	return 0;
+}
+
+#ifdef DHD_WMF
+/* Returns interface specific WMF configuration */
+dhd_wmf_t* dhd_wmf_conf(dhd_pub_t *dhdp, uint32 idx)
+{
+	dhd_info_t *dhd = dhdp->info;
+	dhd_if_t *ifp;
+
+	ASSERT(idx < DHD_MAX_IFS);
+
+	ifp = dhd->iflist[idx];
+	return &ifp->wmf;
+}
+#endif /* DHD_WMF */
+
+
+#ifdef DHD_UNICAST_DHCP
+static int
+dhd_get_pkt_ether_type(dhd_pub_t *pub, void *pktbuf,
+	uint8 **data_ptr, int *len_ptr, uint16 *et_ptr, bool *snap_ptr)
+{
+	uint8 *frame = PKTDATA(pub->osh, pktbuf);
+	int length = PKTLEN(pub->osh, pktbuf);
+	uint8 *pt;			/* Pointer to type field */
+	uint16 ethertype;
+	bool snap = FALSE;
+	/* Process Ethernet II or SNAP-encapsulated 802.3 frames */
+	if (length < ETHER_HDR_LEN) {
+		DHD_ERROR(("dhd: %s: short eth frame (%d)\n",
+		           __FUNCTION__, length));
+		return BCME_ERROR;
+	} else if (ntoh16_ua(frame + ETHER_TYPE_OFFSET) >= ETHER_TYPE_MIN) {
+		/* Frame is Ethernet II */
+		pt = frame + ETHER_TYPE_OFFSET;
+	} else if (length >= ETHER_HDR_LEN + SNAP_HDR_LEN + ETHER_TYPE_LEN &&
+	           !bcmp(llc_snap_hdr, frame + ETHER_HDR_LEN, SNAP_HDR_LEN)) {
+		pt = frame + ETHER_HDR_LEN + SNAP_HDR_LEN;
+		snap = TRUE;
+	} else {
+		DHD_INFO(("DHD: %s: non-SNAP 802.3 frame\n",
+		           __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	ethertype = ntoh16_ua(pt);
+
+	/* Skip VLAN tag, if any */
+	if (ethertype == ETHER_TYPE_8021Q) {
+		pt += VLAN_TAG_LEN;
+
+		if ((pt + ETHER_TYPE_LEN) > (frame + length)) {
+			DHD_ERROR(("dhd: %s: short VLAN frame (%d)\n",
+			          __FUNCTION__, length));
+			return BCME_ERROR;
+		}
+
+		ethertype = ntoh16_ua(pt);
+	}
+
+	*data_ptr = pt + ETHER_TYPE_LEN;
+	*len_ptr = length - (pt + ETHER_TYPE_LEN - frame);
+	*et_ptr = ethertype;
+	*snap_ptr = snap;
+	return BCME_OK;
+}
+
+static int
+dhd_get_pkt_ip_type(dhd_pub_t *pub, void *pktbuf,
+	uint8 **data_ptr, int *len_ptr, uint8 *prot_ptr)
+{
+	struct ipv4_hdr *iph;		/* IP frame pointer */
+	int iplen;			/* IP frame length */
+	uint16 ethertype, iphdrlen, ippktlen;
+	uint16 iph_frag;
+	uint8 prot;
+	bool snap;
+
+	if (dhd_get_pkt_ether_type(pub, pktbuf, (uint8 **)&iph,
+	    &iplen, &ethertype, &snap) != 0)
+		return BCME_ERROR;
+
+	if (ethertype != ETHER_TYPE_IP) {
+		return BCME_ERROR;
+	}
+
+	/* We support IPv4 only */
+	if (iplen < IPV4_OPTIONS_OFFSET || (IP_VER(iph) != IP_VER_4)) {
+		return BCME_ERROR;
+	}
+
+	/* Header length sanity */
+	iphdrlen = IPV4_HLEN(iph);
+
+	/*
+	 * Packet length sanity; sometimes we receive eth-frame size bigger
+	 * than the IP content, which results in a bad tcp chksum
+	 */
+	ippktlen = ntoh16(iph->tot_len);
+	if (ippktlen < iplen) {
+
+		DHD_INFO(("%s: extra frame length ignored\n",
+		          __FUNCTION__));
+		iplen = ippktlen;
+	} else if (ippktlen > iplen) {
+		DHD_ERROR(("dhd: %s: truncated IP packet (%d)\n",
+		           __FUNCTION__, ippktlen - iplen));
+		return BCME_ERROR;
+	}
+
+	if (iphdrlen < IPV4_OPTIONS_OFFSET || iphdrlen > iplen) {
+		DHD_ERROR(("DHD: %s: IP-header-len (%d) out of range (%d-%d)\n",
+		           __FUNCTION__, iphdrlen, IPV4_OPTIONS_OFFSET, iplen));
+		return BCME_ERROR;
+	}
+
+	/*
+	 * We don't handle fragmented IP packets.  A first frag is indicated by the MF
+	 * (more frag) bit and a subsequent frag is indicated by a non-zero frag offset.
+	 */
+	iph_frag = ntoh16(iph->frag);
+
+	if ((iph_frag & IPV4_FRAG_MORE) || (iph_frag & IPV4_FRAG_OFFSET_MASK) != 0) {
+		DHD_INFO(("DHD:%s: IP fragment not handled\n",
+		           __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	prot = IPV4_PROT(iph);
+
+	*data_ptr = (((uint8 *)iph) + iphdrlen);
+	*len_ptr = iplen - iphdrlen;
+	*prot_ptr = prot;
+	return BCME_OK;
+}
+
+/** check the packet type, if it is DHCP ACK/REPLY, convert into unicast packet	*/
+static
+int dhd_convert_dhcp_broadcast_ack_to_unicast(dhd_pub_t *pub, void *pktbuf, int ifidx)
+{
+	dhd_sta_t* stainfo;
+	uint8 *eh = PKTDATA(pub->osh, pktbuf);
+	uint8 *udph;
+	uint8 *dhcp;
+	uint8 *chaddr;
+	int udpl;
+	int dhcpl;
+	uint16 port;
+	uint8 prot;
+
+	if (!ETHER_ISMULTI(eh + ETHER_DEST_OFFSET))
+	    return BCME_ERROR;
+	if (dhd_get_pkt_ip_type(pub, pktbuf, &udph, &udpl, &prot) != 0)
+		return BCME_ERROR;
+	if (prot != IP_PROT_UDP)
+		return BCME_ERROR;
+	/* check frame length, at least UDP_HDR_LEN */
+	if (udpl < UDP_HDR_LEN) {
+		DHD_ERROR(("DHD: %s: short UDP frame, ignored\n",
+		    __FUNCTION__));
+		return BCME_ERROR;
+	}
+	port = ntoh16_ua(udph + UDP_DEST_PORT_OFFSET);
+	/* only process DHCP packets from server to client */
+	if (port != DHCP_PORT_CLIENT)
+		return BCME_ERROR;
+
+	dhcp = udph + UDP_HDR_LEN;
+	dhcpl = udpl - UDP_HDR_LEN;
+
+	if (dhcpl < DHCP_CHADDR_OFFSET + ETHER_ADDR_LEN) {
+		DHD_ERROR(("DHD: %s: short DHCP frame, ignored\n",
+		    __FUNCTION__));
+		return BCME_ERROR;
+	}
+	/* only process DHCP reply(offer/ack) packets */
+	if (*(dhcp + DHCP_TYPE_OFFSET) != DHCP_TYPE_REPLY)
+		return BCME_ERROR;
+	chaddr = dhcp + DHCP_CHADDR_OFFSET;
+	stainfo = dhd_find_sta(pub, ifidx, chaddr);
+	if (stainfo) {
+		bcopy(chaddr, eh + ETHER_DEST_OFFSET, ETHER_ADDR_LEN);
+		return BCME_OK;
+	}
+	return BCME_ERROR;
+}
+#endif /* DHD_UNICAST_DHD */
+#ifdef DHD_L2_FILTER
+/* Check if packet type is ICMP ECHO */
+static
+int dhd_l2_filter_block_ping(dhd_pub_t *pub, void *pktbuf, int ifidx)
+{
+	struct bcmicmp_hdr *icmph;
+	int udpl;
+	uint8 prot;
+
+	if (dhd_get_pkt_ip_type(pub, pktbuf, (uint8 **)&icmph, &udpl, &prot) != 0)
+		return BCME_ERROR;
+	if (prot == IP_PROT_ICMP) {
+		if (icmph->type == ICMP_TYPE_ECHO_REQUEST)
+			return BCME_OK;
+	}
+	return BCME_ERROR;
+}
+#endif /* DHD_L2_FILTER */
+
+#ifdef SET_RPS_CPUS
+int custom_rps_map_set(struct netdev_rx_queue *queue, char *buf, size_t len)
+{
+	struct rps_map *old_map, *map;
+	cpumask_var_t mask;
+	int err, cpu, i;
+	static DEFINE_SPINLOCK(rps_map_lock);
+
+	DHD_INFO(("%s : Entered.\n", __FUNCTION__));
+
+	if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
+		DHD_ERROR(("%s : alloc_cpumask_var fail.\n", __FUNCTION__));
+		return -ENOMEM;
+	}
+
+	err = bitmap_parse(buf, len, cpumask_bits(mask), nr_cpumask_bits);
+	if (err) {
+		free_cpumask_var(mask);
+		DHD_ERROR(("%s : bitmap_parse fail.\n", __FUNCTION__));
+		return err;
+	}
+
+	map = kzalloc(max_t(unsigned int,
+		RPS_MAP_SIZE(cpumask_weight(mask)), L1_CACHE_BYTES),
+		GFP_KERNEL);
+	if (!map) {
+		free_cpumask_var(mask);
+		DHD_ERROR(("%s : map malloc fail.\n", __FUNCTION__));
+		return -ENOMEM;
+	}
+
+	i = 0;
+	for_each_cpu(cpu, mask)
+		map->cpus[i++] = cpu;
+
+	if (i)
+		map->len = i;
+	else {
+		kfree(map);
+		DHD_ERROR(("%s : mapping cpu fail.\n", __FUNCTION__));
+		map = NULL;
+	}
+
+	spin_lock(&rps_map_lock);
+	old_map = rcu_dereference_protected(queue->rps_map,
+		lockdep_is_held(&rps_map_lock));
+	rcu_assign_pointer(queue->rps_map, map);
+	spin_unlock(&rps_map_lock);
+
+	if (map)
+		static_key_slow_inc(&rps_needed);
+	if (old_map) {
+		kfree_rcu(old_map, rcu);
+		static_key_slow_dec(&rps_needed);
+	}
+	free_cpumask_var(mask);
+
+	DHD_INFO(("%s : Done. mapping cpu nummber : %d\n", __FUNCTION__, map->len));
+	return map->len;
+}
+
+void custom_rps_map_clear(struct netdev_rx_queue *queue)
+{
+	struct rps_map *map;
+
+	DHD_INFO(("%s : Entered.\n", __FUNCTION__));
+
+	map = rcu_dereference_protected(queue->rps_map, 1);
+	if (map) {
+		RCU_INIT_POINTER(queue->rps_map, NULL);
+		kfree_rcu(map, rcu);
+		DHD_INFO(("%s : rps_cpus map clear.\n", __FUNCTION__));
+	}
+}
+#endif /* SET_RPS_CPUS */
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+void
+SDA_setSharedMemory4Send(unsigned int buffer_id,
+                         unsigned char *buffer, unsigned int buffer_size,
+                         unsigned int packet_size, unsigned int headroom_size)
+{
+	dhd_info_t *dhd = dhd_global;
+
+	sda_packet_length = packet_size;
+
+	ASSERT(dhd);
+	if (dhd == NULL)
+		return;
+}
+
+void
+SDA_registerCallback4SendDone(SDA_SendDoneCallBack packet_cb)
+{
+	dhd_info_t *dhd = dhd_global;
+
+	ASSERT(dhd);
+	if (dhd == NULL)
+		return;
+}
+
+
+unsigned long long
+SDA_getTsf(unsigned char vif_id)
+{
+	dhd_info_t *dhd = dhd_global;
+	uint64 tsf_val;
+	char buf[WLC_IOCTL_SMLEN];
+	int ifidx = 0;
+
+	struct tsf {
+		uint32 low;
+		uint32 high;
+	} tsf_buf;
+
+	memset(buf, 0, sizeof(buf));
+
+	if (vif_id == 0) /* wlan0 tsf */
+		ifidx = dhd_ifname2idx(dhd, "wlan0");
+	else if (vif_id == 1) /* p2p0 tsf */
+		ifidx = dhd_ifname2idx(dhd, "p2p0");
+
+	bcm_mkiovar("tsf_bss", 0, 0, buf, sizeof(buf));
+
+	if (dhd_wl_ioctl_cmd(&dhd->pub, WLC_GET_VAR, buf, sizeof(buf), FALSE, ifidx) < 0) {
+		DHD_ERROR(("%s wl ioctl error\n", __FUNCTION__));
+		return 0;
+	}
+
+	memcpy(&tsf_buf, buf, sizeof(tsf_buf));
+	tsf_val = (uint64)tsf_buf.high;
+	DHD_TRACE(("%s tsf high 0x%08x, low 0x%08x\n",
+	           __FUNCTION__, tsf_buf.high, tsf_buf.low));
+
+	return ((tsf_val << 32) | tsf_buf.low);
+}
+EXPORT_SYMBOL(SDA_getTsf);
+
+unsigned int
+SDA_syncTsf(void)
+{
+	dhd_info_t *dhd = dhd_global;
+	int tsf_sync = 1;
+	char iovbuf[WLC_IOCTL_SMLEN];
+
+	bcm_mkiovar("wa_tsf_sync", (char *)&tsf_sync, 4, iovbuf, sizeof(iovbuf));
+	dhd_wl_ioctl_cmd(&dhd->pub, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+	DHD_TRACE(("%s\n", __FUNCTION__));
+	return 0;
+}
+
+extern struct net_device *wl0dot1_dev;
+
+void
+BCMFASTPATH SDA_function4Send(uint buffer_id, void *packet, uint packet_size)
+{
+	struct sk_buff *skb;
+	sda_packet_t *shm_packet = packet;
+	dhd_info_t *dhd = dhd_global;
+	int cnt;
+
+	static unsigned int cnt_t = 1;
+
+	ASSERT(dhd);
+	if (dhd == NULL)
+		return;
+
+	if (dhd->is_wlanaudio_blist) {
+		for (cnt = 0; cnt < MAX_WLANAUDIO_BLACKLIST; cnt++) {
+			if (dhd->wlanaudio_blist[cnt].is_blacklist == true) {
+				if (!bcmp(dhd->wlanaudio_blist[cnt].blacklist_addr.octet,
+				          shm_packet->headroom.ether_dhost, ETHER_ADDR_LEN))
+					return;
+			}
+		}
+	}
+
+	if ((cnt_t % 10000) == 0)
+		cnt_t = 0;
+
+	cnt_t++;
+
+	/* packet_size may be smaller than SDA_SHM_PKT_SIZE, remaining will be garbage */
+#define TXOFF 26
+	skb = __dev_alloc_skb(TXOFF + sda_packet_length - SDA_PKT_HEADER_SIZE, GFP_ATOMIC);
+
+	skb_reserve(skb, TXOFF - SDA_HEADROOM_SIZE);
+	skb_put(skb, sda_packet_length - SDA_PKT_HEADER_SIZE + SDA_HEADROOM_SIZE);
+	skb->priority = PRIO_8021D_VO; /* PRIO_8021D_VO or PRIO_8021D_VI */
+
+	/* p2p_net  */
+	skb->dev = wl0dot1_dev;
+	shm_packet->txTsf = 0x0;
+	shm_packet->rxTsf = 0x0;
+	memcpy(skb->data, &shm_packet->headroom,
+	       sda_packet_length - OFFSETOF(sda_packet_t, headroom));
+	shm_packet->desc.ready_to_copy = 0;
+
+	dhd_start_xmit(skb, skb->dev);
+}
+
+void
+SDA_registerCallback4Recv(unsigned char *pBufferTotal,
+                          unsigned int BufferTotalSize)
+{
+	dhd_info_t *dhd = dhd_global;
+
+	ASSERT(dhd);
+	if (dhd == NULL)
+		return;
+}
+
+
+void
+SDA_setSharedMemory4Recv(unsigned char *pBufferTotal,
+                         unsigned int BufferTotalSize,
+                         unsigned int BufferUnitSize,
+                         unsigned int Headroomsize)
+{
+	dhd_info_t *dhd = dhd_global;
+
+	ASSERT(dhd);
+	if (dhd == NULL)
+		return;
+}
+
+
+void
+SDA_function4RecvDone(unsigned char * pBuffer, unsigned int BufferSize)
+{
+	dhd_info_t *dhd = dhd_global;
+
+	ASSERT(dhd);
+	if (dhd == NULL)
+		return;
+}
+
+EXPORT_SYMBOL(SDA_setSharedMemory4Send);
+EXPORT_SYMBOL(SDA_registerCallback4SendDone);
+EXPORT_SYMBOL(SDA_syncTsf);
+EXPORT_SYMBOL(SDA_function4Send);
+EXPORT_SYMBOL(SDA_registerCallback4Recv);
+EXPORT_SYMBOL(SDA_setSharedMemory4Recv);
+EXPORT_SYMBOL(SDA_function4RecvDone);
+
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+void *dhd_get_pub(struct net_device *dev)
+{
+	dhd_info_t *dhdinfo = *(dhd_info_t **)netdev_priv(dev);
+	if (dhdinfo)
+		return (void *)&dhdinfo->pub;
+	else
+		return NULL;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_linux.h b/drivers/net/wireless/bcm4336/dhd_linux.h
--- a/drivers/net/wireless/bcm4336/dhd_linux.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_linux.h	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,82 @@
+/*
+ * DHD Linux header file (dhd_linux exports for cfg80211 and other components)
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_linux.h 399301 2013-04-29 21:41:52Z $
+ */
+
+/* wifi platform functions for power, interrupt and pre-alloc, either
+ * from Android-like platform device data, or Broadcom wifi platform
+ * device data.
+ *
+ */
+#ifndef __DHD_LINUX_H__
+#define __DHD_LINUX_H__
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/fs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#ifdef DHD_WMF
+#include <dhd_wmf_linux.h>
+#endif
+/* Linux wireless extension support */
+#if defined(WL_WIRELESS_EXT)
+#include <wl_iw.h>
+#endif /* defined(WL_WIRELESS_EXT) */
+#if defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND)
+#include <linux/earlysuspend.h>
+#endif /* defined(CONFIG_HAS_EARLYSUSPEND) && defined(DHD_USE_EARLYSUSPEND) */
+
+#define DHD_REGISTRATION_TIMEOUT  12000  /* msec : allowed time to finished dhd registration */
+
+typedef struct wifi_adapter_info {
+	const char	*name;
+	uint		irq_num;
+	uint		intr_flags;
+	const char	*fw_path;
+	const char	*nv_path;
+	const char	*conf_path;
+	void		*wifi_plat_data;	/* wifi ctrl func, for backward compatibility */
+	uint		bus_type;
+	uint		bus_num;
+	uint		slot_num;
+} wifi_adapter_info_t;
+
+typedef struct bcmdhd_wifi_platdata {
+	uint				num_adapters;
+	wifi_adapter_info_t	*adapters;
+} bcmdhd_wifi_platdata_t;
+
+/** Per STA params. A list of dhd_sta objects are managed in dhd_if */
+typedef struct dhd_sta {
+	uint16 flowid[NUMPRIO]; /* allocated flow ring ids (by priority) */
+	void * ifp;             /* associated dhd_if */
+	struct ether_addr ea;   /* stations ethernet mac address */
+	struct list_head list;  /* link into dhd_if::sta_list */
+	int idx;                /* index of self in dhd_pub::sta_pool[] */
+	int ifidx;              /* index of interface in dhd */
+} dhd_sta_t;
+typedef dhd_sta_t dhd_sta_pool_t;
+
+int dhd_wifi_platform_register_drv(void);
+void dhd_wifi_platform_unregister_drv(void);
+wifi_adapter_info_t* dhd_wifi_platform_get_adapter(uint32 bus_type, uint32 bus_num,
+	uint32 slot_num);
+int wifi_platform_set_power(wifi_adapter_info_t *adapter, bool on, unsigned long msec);
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present);
+int wifi_platform_get_irq_number(wifi_adapter_info_t *adapter, unsigned long *irq_flags_ptr);
+int wifi_platform_get_mac_addr(wifi_adapter_info_t *adapter, unsigned char *buf);
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode);
+void* wifi_platform_prealloc(wifi_adapter_info_t *adapter, int section, unsigned long size);
+void* wifi_platform_get_prealloc_func_ptr(wifi_adapter_info_t *adapter);
+
+int dhd_get_fw_mode(struct dhd_info *dhdinfo);
+bool dhd_update_fw_nv_path(struct dhd_info *dhdinfo);
+
+#ifdef DHD_WMF
+dhd_wmf_t* dhd_wmf_conf(dhd_pub_t *dhdp, uint32 idx);
+#endif /* DHD_WMF */
+#endif /* __DHD_LINUX_H__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_linux_platdev.c b/drivers/net/wireless/bcm4336/dhd_linux_platdev.c
--- a/drivers/net/wireless/bcm4336/dhd_linux_platdev.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_linux_platdev.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,864 @@
+/*
+ * Linux platform device for DHD WLAN adapter
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_linux_platdev.c 401742 2013-05-13 15:03:21Z $
+ */
+#include <typedefs.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_linux.h>
+#include <wl_android.h>
+#if defined(CONFIG_WIFI_CONTROL_FUNC)
+#include <linux/wlan_plat.h>
+#endif
+#ifdef CONFIG_DTS
+#include<linux/regulator/consumer.h>
+#include<linux/of_gpio.h>
+#endif /* CONFIG_DTS */
+#include <linux/of_irq.h>
+
+#ifdef CUSTOMER_HW
+#if defined(CUSTOMER_OOB) && !defined(CONFIG_ARCH_S5P6818)
+extern uint bcm_wlan_get_oob_irq(void);
+extern uint bcm_wlan_get_oob_irq_flags(void);
+#endif
+extern int bcm_wlan_set_plat_data(void);
+#endif /* CUSTOMER_HW */
+
+#define WIFI_PLAT_NAME		"bcmdhd_wlan"
+#define WIFI_PLAT_NAME2		"bcm4329_wlan"
+#define WIFI_PLAT_EXT		"bcmdhd_wifi_platform"
+
+#ifdef CONFIG_DTS
+struct regulator *wifi_regulator = NULL;
+#endif /* CONFIG_DTS */
+
+bool cfg_multichip = FALSE;
+bcmdhd_wifi_platdata_t *dhd_wifi_platdata = NULL;
+static int wifi_plat_dev_probe_ret = 0;
+static bool is_power_on = FALSE;
+#if !defined(CONFIG_DTS)
+#if defined(DHD_OF_SUPPORT)
+static bool dts_enabled = TRUE;
+extern struct wifi_platform_data dhd_wlan_control;
+#else
+static bool dts_enabled = FALSE;
+struct resource dhd_wlan_resources = {0};
+#ifdef CUSTOMER_HW
+struct wifi_platform_data dhd_wlan_control = {0};
+#endif
+#endif /* !defind(DHD_OF_SUPPORT) */
+#endif /* !defind(CONFIG_DTS) */
+
+static int dhd_wifi_platform_load(void);
+
+extern void* wl_cfg80211_get_dhdp(void);
+
+#ifdef ENABLE_4335BT_WAR
+extern int bcm_bt_lock(int cookie);
+extern void bcm_bt_unlock(int cookie);
+static int lock_cookie_wifi = 'W' | 'i'<<8 | 'F'<<16 | 'i'<<24;	/* cookie is "WiFi" */
+#endif /* ENABLE_4335BT_WAR */
+
+wifi_adapter_info_t* dhd_wifi_platform_get_adapter(uint32 bus_type, uint32 bus_num, uint32 slot_num)
+{
+	int i;
+
+	if (dhd_wifi_platdata == NULL)
+		return NULL;
+
+	for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+		wifi_adapter_info_t *adapter = &dhd_wifi_platdata->adapters[i];
+		if ((adapter->bus_type == -1 || adapter->bus_type == bus_type) &&
+			(adapter->bus_num == -1 || adapter->bus_num == bus_num) &&
+			(adapter->slot_num == -1 || adapter->slot_num == slot_num)) {
+			DHD_TRACE(("found adapter info '%s'\n", adapter->name));
+			return adapter;
+		}
+	}
+	return NULL;
+}
+
+void* wifi_platform_prealloc(wifi_adapter_info_t *adapter, int section, unsigned long size)
+{
+	void *alloc_ptr = NULL;
+	struct wifi_platform_data *plat_data;
+
+	if (!adapter || !adapter->wifi_plat_data)
+		return NULL;
+	plat_data = adapter->wifi_plat_data;
+	if (plat_data->mem_prealloc) {
+		alloc_ptr = plat_data->mem_prealloc(section, size);
+		if (alloc_ptr) {
+			DHD_INFO(("success alloc section %d\n", section));
+			if (size != 0L)
+				bzero(alloc_ptr, size);
+			return alloc_ptr;
+		}
+	} else
+		return NULL;
+
+	DHD_ERROR(("%s: failed to alloc static mem section %d\n", __FUNCTION__, section));
+	return NULL;
+}
+
+void* wifi_platform_get_prealloc_func_ptr(wifi_adapter_info_t *adapter)
+{
+	struct wifi_platform_data *plat_data;
+
+	if (!adapter || !adapter->wifi_plat_data)
+		return NULL;
+	plat_data = adapter->wifi_plat_data;
+	return plat_data->mem_prealloc;
+}
+
+int wifi_platform_get_irq_number(wifi_adapter_info_t *adapter, unsigned long *irq_flags_ptr)
+{
+	if (adapter == NULL)
+		return -1;
+	if (irq_flags_ptr)
+		*irq_flags_ptr = adapter->intr_flags;
+	return adapter->irq_num;
+}
+
+int wifi_platform_set_power(wifi_adapter_info_t *adapter, bool on, unsigned long msec)
+{
+	int err = 0;
+#ifdef CONFIG_DTS
+	if (on) {
+		err = regulator_enable(wifi_regulator);
+		is_power_on = TRUE;
+	}
+	else {
+		err = regulator_disable(wifi_regulator);
+		is_power_on = FALSE;
+	}
+	if (err < 0)
+		DHD_ERROR(("%s: regulator enable/disable failed", __FUNCTION__));
+#else
+	struct wifi_platform_data *plat_data;
+
+	if (!adapter || !adapter->wifi_plat_data)
+		return -EINVAL;
+	plat_data = adapter->wifi_plat_data;
+
+	DHD_ERROR(("%s = %d\n", __FUNCTION__, on));
+	if (plat_data->set_power) {
+#ifdef ENABLE_4335BT_WAR
+		if (on) {
+			printk("WiFi: trying to acquire BT lock\n");
+			if (bcm_bt_lock(lock_cookie_wifi) != 0)
+				printk("** WiFi: timeout in acquiring bt lock**\n");
+			printk("%s: btlock acquired\n", __FUNCTION__);
+		}
+		else {
+			/* For a exceptional case, release btlock */
+			bcm_bt_unlock(lock_cookie_wifi);
+		}
+#endif /* ENABLE_4335BT_WAR */
+
+		err = plat_data->set_power(on);
+	}
+
+	if (msec && !err)
+		OSL_SLEEP(msec);
+
+	if (on && !err)
+		is_power_on = TRUE;
+	else
+		is_power_on = FALSE;
+
+#endif /* CONFIG_DTS */
+
+	return err;
+}
+
+int wifi_platform_bus_enumerate(wifi_adapter_info_t *adapter, bool device_present)
+{
+	int err = 0;
+	struct wifi_platform_data *plat_data;
+
+	if (!adapter || !adapter->wifi_plat_data)
+		return -EINVAL;
+	plat_data = adapter->wifi_plat_data;
+
+	DHD_ERROR(("%s device present %d\n", __FUNCTION__, device_present));
+	if (plat_data->set_carddetect) {
+		err = plat_data->set_carddetect(device_present);
+	}
+	return err;
+
+}
+
+int wifi_platform_get_mac_addr(wifi_adapter_info_t *adapter, unsigned char *buf)
+{
+	struct wifi_platform_data *plat_data;
+
+	DHD_ERROR(("%s\n", __FUNCTION__));
+	if (!buf || !adapter || !adapter->wifi_plat_data)
+		return -EINVAL;
+	plat_data = adapter->wifi_plat_data;
+	if (plat_data->get_mac_addr) {
+		return plat_data->get_mac_addr(buf);
+	}
+	return -EOPNOTSUPP;
+}
+
+void *wifi_platform_get_country_code(wifi_adapter_info_t *adapter, char *ccode)
+{
+	/* get_country_code was added after 2.6.39 */
+#if	(LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+	struct wifi_platform_data *plat_data;
+
+	if (!ccode || !adapter || !adapter->wifi_plat_data)
+		return NULL;
+	plat_data = adapter->wifi_plat_data;
+
+	DHD_TRACE(("%s\n", __FUNCTION__));
+	if (plat_data->get_country_code) {
+		return plat_data->get_country_code(ccode);
+	}
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)) */
+
+	return NULL;
+}
+
+#ifndef CUSTOMER_HW
+static int wifi_plat_dev_drv_probe(struct platform_device *pdev)
+{
+	struct resource *resource;
+	wifi_adapter_info_t *adapter;
+#ifdef CONFIG_DTS
+	int irq, gpio;
+#endif /* CONFIG_DTS */
+
+	/* Android style wifi platform data device ("bcmdhd_wlan" or "bcm4329_wlan")
+	 * is kept for backward compatibility and supports only 1 adapter
+	 */
+	ASSERT(dhd_wifi_platdata != NULL);
+	ASSERT(dhd_wifi_platdata->num_adapters == 1);
+	adapter = &dhd_wifi_platdata->adapters[0];
+	adapter->wifi_plat_data = (struct wifi_platform_data *)(pdev->dev.platform_data);
+
+	resource = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcmdhd_wlan_irq");
+	if (resource == NULL)
+		resource = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "bcm4329_wlan_irq");
+	if (resource) {
+		adapter->irq_num = resource->start;
+		adapter->intr_flags = resource->flags & IRQF_TRIGGER_MASK;
+	}
+
+#ifdef CONFIG_DTS
+	wifi_regulator = regulator_get(&pdev->dev, "wlreg_on");
+	if (wifi_regulator == NULL) {
+		DHD_ERROR(("%s regulator is null\n", __FUNCTION__));
+		return -1;
+	}
+
+	/* This is to get the irq for the OOB */
+	gpio = of_get_gpio(pdev->dev.of_node, 0);
+
+	if (gpio < 0) {
+		DHD_ERROR(("%s gpio information is incorrect\n", __FUNCTION__));
+		return -1;
+	}
+	irq = gpio_to_irq(gpio);
+	if (irq < 0) {
+		DHD_ERROR(("%s irq information is incorrect\n", __FUNCTION__));
+		return -1;
+	}
+	adapter->irq_num = irq;
+
+	/* need to change the flags according to our requirement */
+	adapter->intr_flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL |
+		IORESOURCE_IRQ_SHAREABLE;
+#endif /* CONFIG_DTS */
+
+	wifi_plat_dev_probe_ret = dhd_wifi_platform_load();
+	return wifi_plat_dev_probe_ret;
+}
+
+static int wifi_plat_dev_drv_remove(struct platform_device *pdev)
+{
+	wifi_adapter_info_t *adapter;
+
+	/* Android style wifi platform data device ("bcmdhd_wlan" or "bcm4329_wlan")
+	 * is kept for backward compatibility and supports only 1 adapter
+	 */
+	ASSERT(dhd_wifi_platdata != NULL);
+	ASSERT(dhd_wifi_platdata->num_adapters == 1);
+	adapter = &dhd_wifi_platdata->adapters[0];
+	if (is_power_on) {
+#ifdef BCMPCIE
+		wifi_platform_bus_enumerate(adapter, FALSE);
+		wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+#else
+		wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+		wifi_platform_bus_enumerate(adapter, FALSE);
+#endif /* BCMPCIE */
+	}
+
+#ifdef CONFIG_DTS
+	regulator_put(wifi_regulator);
+#endif /* CONFIG_DTS */
+	return 0;
+}
+
+static int wifi_plat_dev_drv_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY) && \
+	defined(BCMSDIO)
+	bcmsdh_oob_intr_set(0);
+#endif /* (OOB_INTR_ONLY) */
+	return 0;
+}
+
+static int wifi_plat_dev_drv_resume(struct platform_device *pdev)
+{
+	DHD_TRACE(("##> %s\n", __FUNCTION__));
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && defined(OOB_INTR_ONLY) && \
+	defined(BCMSDIO)
+	if (dhd_os_check_if_up(wl_cfg80211_get_dhdp()))
+		bcmsdh_oob_intr_set(1);
+#endif /* (OOB_INTR_ONLY) */
+	return 0;
+}
+
+#ifdef CONFIG_DTS
+static const struct of_device_id wifi_device_dt_match[] = {
+	{ .compatible = "android,bcmdhd_wlan", },
+	{},
+};
+#endif /* CONFIG_DTS */
+
+static struct platform_driver wifi_platform_dev_driver = {
+	.probe          = wifi_plat_dev_drv_probe,
+	.remove         = wifi_plat_dev_drv_remove,
+	.suspend        = wifi_plat_dev_drv_suspend,
+	.resume         = wifi_plat_dev_drv_resume,
+	.driver         = {
+	.name   = WIFI_PLAT_NAME,
+#ifdef CONFIG_DTS
+	.of_match_table = wifi_device_dt_match,
+#endif /* CONFIG_DTS */
+	}
+};
+
+static struct platform_driver wifi_platform_dev_driver_legacy = {
+	.probe          = wifi_plat_dev_drv_probe,
+	.remove         = wifi_plat_dev_drv_remove,
+	.suspend        = wifi_plat_dev_drv_suspend,
+	.resume         = wifi_plat_dev_drv_resume,
+	.driver         = {
+	.name	= WIFI_PLAT_NAME2,
+	}
+};
+
+static int wifi_platdev_match(struct device *dev, void *data)
+{
+	char *name = (char*)data;
+	struct platform_device *pdev = to_platform_device(dev);
+
+	if (strcmp(pdev->name, name) == 0) {
+		DHD_ERROR(("found wifi platform device %s\n", name));
+		return TRUE;
+	}
+
+	return FALSE;
+}
+#endif
+
+#ifdef CONFIG_ARCH_S5P6818
+static int read_brcm_nanopi_irq(uint *irqnum, uint *irqflags)
+{
+	static struct of_device_id wifi_device_match[] = {
+		{ .compatible = "nanopi,bcm4329" },
+		{}
+	};
+	struct device_node *np;
+	int irq;
+
+	*irqnum = -1;
+	*irqflags = -1;
+	np = of_find_matching_node(NULL, wifi_device_match);
+	if( np == NULL ) {
+		DHD_ERROR(("node for nanopi,bcm4329 not defined in devicetree!\n"));
+		return -ENODEV;
+	}
+	if (!of_find_property(np, "interrupts", NULL)) {
+		DHD_ERROR(("'interrupts' property is not defined in devicetree node!\n"));
+		return -ENODEV;
+	}
+
+	irq = irq_of_parse_and_map(np, 0);
+	if (!irq) {
+		DHD_ERROR(("interrupt could not be mapped\n"));
+		return -ENODEV;
+	}
+	*irqnum = irq;
+	*irqflags = irqd_get_trigger_type(irq_get_irq_data(irq));
+	return 0;
+}
+#endif
+
+static int wifi_ctrlfunc_register_drv(void)
+{
+	wifi_adapter_info_t *adapter;
+
+#ifndef CUSTOMER_HW
+	int err = 0;
+	struct device *dev1, *dev2;
+	dev1 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME, wifi_platdev_match);
+	dev2 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME2, wifi_platdev_match);
+#endif
+
+#if !defined(CONFIG_DTS) && !defined(CUSTOMER_HW)
+	if (!dts_enabled) {
+		if (dev1 == NULL && dev2 == NULL) {
+			DHD_ERROR(("no wifi platform data, skip\n"));
+			return -ENXIO;
+		}
+	}
+#endif /* !defined(CONFIG_DTS) */
+
+	/* multi-chip support not enabled, build one adapter information for
+	 * DHD (either SDIO, USB or PCIe)
+	 */
+	adapter = kzalloc(sizeof(wifi_adapter_info_t), GFP_KERNEL);
+	adapter->name = "DHD generic adapter";
+	adapter->bus_type = -1;
+	adapter->bus_num = -1;
+	adapter->slot_num = -1;
+	adapter->irq_num = -1;
+	is_power_on = FALSE;
+	wifi_plat_dev_probe_ret = 0;
+	dhd_wifi_platdata = kzalloc(sizeof(bcmdhd_wifi_platdata_t), GFP_KERNEL);
+	dhd_wifi_platdata->num_adapters = 1;
+	dhd_wifi_platdata->adapters = adapter;
+
+#ifndef CUSTOMER_HW
+	if (dev1) {
+		err = platform_driver_register(&wifi_platform_dev_driver);
+		if (err) {
+			DHD_ERROR(("%s: failed to register wifi ctrl func driver\n",
+				__FUNCTION__));
+			return err;
+		}
+	}
+	if (dev2) {
+		err = platform_driver_register(&wifi_platform_dev_driver_legacy);
+		if (err) {
+			DHD_ERROR(("%s: failed to register wifi ctrl func legacy driver\n",
+				__FUNCTION__));
+			return err;
+		}
+	}
+#endif
+
+#if !defined(CONFIG_DTS)
+	if (dts_enabled) {
+#ifdef CUSTOMER_HW
+		adapter->wifi_plat_data = (void *)&dhd_wlan_control;
+		bcm_wlan_set_plat_data();
+#ifdef CUSTOMER_OOB
+#ifdef CONFIG_ARCH_S5P6818
+		{
+			int err = read_brcm_nanopi_irq(&adapter->irq_num, &adapter->intr_flags);
+			if( err )
+				return err;
+		}
+#else
+		adapter->irq_num = bcm_wlan_get_oob_irq();
+		adapter->intr_flags = bcm_wlan_get_oob_irq_flags();
+#endif
+#endif
+#else
+		struct resource *resource;
+		resource = &dhd_wlan_resources;
+		adapter->irq_num = resource->start;
+		adapter->intr_flags = resource->flags & IRQF_TRIGGER_MASK;
+#endif
+		wifi_plat_dev_probe_ret = dhd_wifi_platform_load();
+	}
+#endif /* !defined(CONFIG_DTS) */
+
+
+#if defined(CONFIG_DTS) && !defined(CUSTOMER_HW)
+	wifi_plat_dev_probe_ret = platform_driver_register(&wifi_platform_dev_driver);
+#endif /* CONFIG_DTS */
+
+	/* return probe function's return value if registeration succeeded */
+	return wifi_plat_dev_probe_ret;
+}
+
+void wifi_ctrlfunc_unregister_drv(void)
+{
+#if defined(CONFIG_DTS) && !defined(CUSTOMER_HW)
+	DHD_ERROR(("unregister wifi platform drivers\n"));
+	platform_driver_unregister(&wifi_platform_dev_driver);
+#else
+#ifndef CUSTOMER_HW
+	struct device *dev1, *dev2;
+	dev1 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME, wifi_platdev_match);
+	dev2 = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_NAME2, wifi_platdev_match);
+	if (!dts_enabled)
+		if (dev1 == NULL && dev2 == NULL)
+			return;
+#endif
+	DHD_ERROR(("unregister wifi platform drivers\n"));
+#ifndef CUSTOMER_HW
+	if (dev1)
+		platform_driver_unregister(&wifi_platform_dev_driver);
+	if (dev2)
+		platform_driver_unregister(&wifi_platform_dev_driver_legacy);
+#endif
+	if (dts_enabled) {
+		wifi_adapter_info_t *adapter;
+		adapter = &dhd_wifi_platdata->adapters[0];
+		if (is_power_on) {
+			wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+		}
+		/* Maybe powered off by wl_android_wifi_off() */
+		wifi_platform_bus_enumerate(adapter, FALSE);
+	}
+#endif /* !defined(CONFIG_DTS) */
+
+	kfree(dhd_wifi_platdata->adapters);
+	dhd_wifi_platdata->adapters = NULL;
+	dhd_wifi_platdata->num_adapters = 0;
+	kfree(dhd_wifi_platdata);
+	dhd_wifi_platdata = NULL;
+}
+
+#ifndef CUSTOMER_HW
+static int bcmdhd_wifi_plat_dev_drv_probe(struct platform_device *pdev)
+{
+	dhd_wifi_platdata = (bcmdhd_wifi_platdata_t *)(pdev->dev.platform_data);
+
+	return dhd_wifi_platform_load();
+}
+
+static int bcmdhd_wifi_plat_dev_drv_remove(struct platform_device *pdev)
+{
+	int i;
+	wifi_adapter_info_t *adapter;
+	ASSERT(dhd_wifi_platdata != NULL);
+
+	/* power down all adapters */
+	for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+		adapter = &dhd_wifi_platdata->adapters[i];
+		wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+		wifi_platform_bus_enumerate(adapter, FALSE);
+	}
+	return 0;
+}
+
+static struct platform_driver dhd_wifi_platform_dev_driver = {
+	.probe          = bcmdhd_wifi_plat_dev_drv_probe,
+	.remove         = bcmdhd_wifi_plat_dev_drv_remove,
+	.driver         = {
+	.name   = WIFI_PLAT_EXT,
+	}
+};
+#endif
+
+int dhd_wifi_platform_register_drv(void)
+{
+	int err = 0;
+#ifndef CUSTOMER_HW
+	struct device *dev;
+
+	/* register Broadcom wifi platform data driver if multi-chip is enabled,
+	 * otherwise use Android style wifi platform data (aka wifi control function)
+	 * if it exists
+	 *
+	 * to support multi-chip DHD, Broadcom wifi platform data device must
+	 * be added in kernel early boot (e.g. board config file).
+	 */
+	if (cfg_multichip) {
+		dev = bus_find_device(&platform_bus_type, NULL, WIFI_PLAT_EXT, wifi_platdev_match);
+		if (dev == NULL) {
+			DHD_ERROR(("bcmdhd wifi platform data device not found!!\n"));
+			return -ENXIO;
+		}
+		err = platform_driver_register(&dhd_wifi_platform_dev_driver);
+	} else
+#endif
+	{
+		err = wifi_ctrlfunc_register_drv();
+
+		/* no wifi ctrl func either, load bus directly and ignore this error */
+		if (err) {
+			if (err == -ENXIO) {
+				/* wifi ctrl function does not exist */
+				err = dhd_wifi_platform_load();
+			} else {
+				/* unregister driver due to initialization failure */
+				wifi_ctrlfunc_unregister_drv();
+			}
+		}
+	}
+
+	return err;
+}
+
+#ifdef BCMPCIE
+static int dhd_wifi_platform_load_pcie(void)
+{
+	int err = 0;
+	int i;
+	wifi_adapter_info_t *adapter;
+
+	BCM_REFERENCE(i);
+	BCM_REFERENCE(adapter);
+
+	if (dhd_wifi_platdata == NULL) {
+		err = dhd_bus_register();
+	} else {
+		if (dhd_download_fw_on_driverload) {
+			/* power up all adapters */
+			for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+				int retry = POWERUP_MAX_RETRY;
+				adapter = &dhd_wifi_platdata->adapters[i];
+
+				DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+				DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+					adapter->irq_num, adapter->intr_flags, adapter->fw_path,
+					adapter->nv_path));
+				DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+					adapter->bus_type, adapter->bus_num, adapter->slot_num));
+
+				do {
+					err = wifi_platform_set_power(adapter,
+						TRUE, WIFI_TURNON_DELAY);
+					if (err) {
+						DHD_ERROR(("failed to power up %s,"
+							" %d retry left\n",
+							adapter->name, retry));
+						/* WL_REG_ON state unknown, Power off forcely */
+						wifi_platform_set_power(adapter,
+							FALSE, WIFI_TURNOFF_DELAY);
+						continue;
+					} else {
+						err = wifi_platform_bus_enumerate(adapter, TRUE);
+						if (err) {
+							DHD_ERROR(("failed to enumerate bus %s, "
+								"%d retry left\n",
+								adapter->name, retry));
+							wifi_platform_set_power(adapter, FALSE,
+								WIFI_TURNOFF_DELAY);
+						} else {
+							break;
+						}
+					}
+				} while (retry--);
+
+				if (!retry) {
+					DHD_ERROR(("failed to power up %s, max retry reached**\n",
+						adapter->name));
+					return -ENODEV;
+				}
+			}
+		}
+
+		err = dhd_bus_register();
+
+		if (err) {
+			DHD_ERROR(("%s: pcie_register_driver failed\n", __FUNCTION__));
+			if (dhd_download_fw_on_driverload) {
+				/* power down all adapters */
+				for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+					adapter = &dhd_wifi_platdata->adapters[i];
+					wifi_platform_bus_enumerate(adapter, FALSE);
+					wifi_platform_set_power(adapter,
+						FALSE, WIFI_TURNOFF_DELAY);
+				}
+			}
+		}
+	}
+
+	return err;
+}
+#else
+static int dhd_wifi_platform_load_pcie(void)
+{
+	return 0;
+}
+#endif /* BCMPCIE  */
+
+
+void dhd_wifi_platform_unregister_drv(void)
+{
+#ifndef CUSTOMER_HW
+	if (cfg_multichip)
+		platform_driver_unregister(&dhd_wifi_platform_dev_driver);
+	else
+#endif
+		wifi_ctrlfunc_unregister_drv();
+}
+
+extern int dhd_watchdog_prio;
+extern int dhd_dpc_prio;
+extern uint dhd_deferred_tx;
+#if defined(BCMLXSDMMC)
+extern struct semaphore dhd_registration_sem;
+#endif
+
+#ifdef BCMSDIO
+static int dhd_wifi_platform_load_sdio(void)
+{
+	int i;
+	int err = 0;
+	wifi_adapter_info_t *adapter;
+
+	BCM_REFERENCE(i);
+	BCM_REFERENCE(adapter);
+	/* Sanity check on the module parameters
+	 * - Both watchdog and DPC as tasklets are ok
+	 * - If both watchdog and DPC are threads, TX must be deferred
+	 */
+	if (!(dhd_watchdog_prio < 0 && dhd_dpc_prio < 0) &&
+		!(dhd_watchdog_prio >= 0 && dhd_dpc_prio >= 0 && dhd_deferred_tx))
+		return -EINVAL;
+
+#if defined(BCMLXSDMMC)
+	if (dhd_wifi_platdata == NULL) {
+		DHD_ERROR(("DHD wifi platform data is required for Android build\n"));
+		return -EINVAL;
+	}
+
+	sema_init(&dhd_registration_sem, 0);
+	/* power up all adapters */
+	for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+		bool chip_up = FALSE;
+		int retry = POWERUP_MAX_RETRY;
+		struct semaphore dhd_chipup_sem;
+
+		adapter = &dhd_wifi_platdata->adapters[i];
+
+		DHD_ERROR(("Power-up adapter '%s'\n", adapter->name));
+		DHD_INFO((" - irq %d [flags %d], firmware: %s, nvram: %s\n",
+			adapter->irq_num, adapter->intr_flags, adapter->fw_path, adapter->nv_path));
+		DHD_INFO((" - bus type %d, bus num %d, slot num %d\n\n",
+			adapter->bus_type, adapter->bus_num, adapter->slot_num));
+
+		do {
+			sema_init(&dhd_chipup_sem, 0);
+			err = dhd_bus_reg_sdio_notify(&dhd_chipup_sem);
+			if (err) {
+				DHD_ERROR(("%s dhd_bus_reg_sdio_notify fail(%d)\n\n",
+					__FUNCTION__, err));
+				return err;
+			}
+			err = wifi_platform_set_power(adapter, TRUE, WIFI_TURNON_DELAY);
+			if (err) {
+				/* WL_REG_ON state unknown, Power off forcely */
+				wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+				continue;
+			} else {
+				wifi_platform_bus_enumerate(adapter, TRUE);
+				err = 0;
+			}
+
+			if (down_timeout(&dhd_chipup_sem, msecs_to_jiffies(POWERUP_WAIT_MS)) == 0) {
+				dhd_bus_unreg_sdio_notify();
+				chip_up = TRUE;
+				break;
+			}
+
+			DHD_ERROR(("failed to power up %s, %d retry left\n", adapter->name, retry));
+			dhd_bus_unreg_sdio_notify();
+			wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+			wifi_platform_bus_enumerate(adapter, FALSE);
+		} while (--retry);
+
+		if (!chip_up) {
+			DHD_ERROR(("failed to power up %s, max retry reached**\n", adapter->name));
+			return -ENODEV;
+		}
+	}
+
+	err = dhd_bus_register();
+
+	if (err) {
+		DHD_ERROR(("%s: sdio_register_driver failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	/*
+	 * Wait till MMC sdio_register_driver callback called and made driver attach.
+	 * It's needed to make sync up exit from dhd insmod  and
+	 * Kernel MMC sdio device callback registration
+	 */
+	err = down_timeout(&dhd_registration_sem, msecs_to_jiffies(DHD_REGISTRATION_TIMEOUT));
+	if (err) {
+		DHD_ERROR(("%s: sdio_register_driver timeout or error \n", __FUNCTION__));
+		dhd_bus_unregister();
+		goto fail;
+	}
+
+	return err;
+
+fail:
+	/* power down all adapters */
+	for (i = 0; i < dhd_wifi_platdata->num_adapters; i++) {
+		adapter = &dhd_wifi_platdata->adapters[i];
+		wifi_platform_set_power(adapter, FALSE, WIFI_TURNOFF_DELAY);
+		wifi_platform_bus_enumerate(adapter, FALSE);
+	}
+#else
+
+	/* x86 bring-up PC needs no power-up operations */
+	err = dhd_bus_register();
+
+#endif
+
+	return err;
+}
+#else /* BCMSDIO */
+static int dhd_wifi_platform_load_sdio(void)
+{
+	return 0;
+}
+#endif /* BCMSDIO */
+
+static int dhd_wifi_platform_load_usb(void)
+{
+	return 0;
+}
+
+static int dhd_wifi_platform_load()
+{
+	int err = 0;
+	printf("%s: Enter\n", __FUNCTION__);
+
+	wl_android_init();
+
+	if ((err = dhd_wifi_platform_load_usb()))
+		goto end;
+	else if ((err = dhd_wifi_platform_load_sdio()))
+		goto end;
+	else
+		err = dhd_wifi_platform_load_pcie();
+
+end:
+	if (err)
+		wl_android_exit();
+#if !defined(MULTIPLE_SUPPLICANT)
+	else
+		wl_android_post_init();
+#endif
+
+	return err;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_linux_sched.c b/drivers/net/wireless/bcm4336/dhd_linux_sched.c
--- a/drivers/net/wireless/bcm4336/dhd_linux_sched.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_linux_sched.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,30 @@
+/*
+ * Expose some of the kernel scheduler routines
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_linux_sched.c 457570 2014-02-23 13:54:46Z $
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <typedefs.h>
+#include <linuxver.h>
+
+int setScheduler(struct task_struct *p, int policy, struct sched_param *param)
+{
+	int rc = 0;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+	rc = sched_setscheduler(p, policy, param);
+#endif /* LinuxVer */
+	return rc;
+}
+
+int get_scheduler_policy(struct task_struct *p)
+{
+	int rc = SCHED_NORMAL;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+	rc = p->policy;
+#endif /* LinuxVer */
+	return rc;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_linux_wq.c b/drivers/net/wireless/bcm4336/dhd_linux_wq.c
--- a/drivers/net/wireless/bcm4336/dhd_linux_wq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_linux_wq.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,299 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Generic work queue framework
+ * Generic interface to handle dhd deferred work events
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_linux_wq.c 449578 2014-01-17 13:53:20Z $
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/fcntl.h>
+#include <linux/fs.h>
+#include <linux/ip.h>
+#include <linux/kfifo.h>
+
+#include <linuxver.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include <dhd_linux_wq.h>
+
+struct dhd_deferred_event_t {
+	u8	event; /* holds the event */
+	void	*event_data; /* Holds event specific data */
+	event_handler_t event_handler;
+};
+#define DEFRD_EVT_SIZE	sizeof(struct dhd_deferred_event_t)
+
+struct dhd_deferred_wq {
+	struct work_struct	deferred_work; /* should be the first member */
+
+	/*
+	 * work events may occur simultaneously.
+	 * Can hold upto 64 low priority events and 4 high priority events
+	 */
+#define DHD_PRIO_WORK_FIFO_SIZE	(4 * sizeof(struct dhd_deferred_event_t))
+#define DHD_WORK_FIFO_SIZE	(64 * sizeof(struct dhd_deferred_event_t))
+	struct kfifo			*prio_fifo;
+	struct kfifo			*work_fifo;
+	u8				*prio_fifo_buf;
+	u8				*work_fifo_buf;
+	spinlock_t			work_lock;
+	void				*dhd_info; /* review: does it require */
+};
+
+static inline struct kfifo*
+dhd_kfifo_init(u8 *buf, int size, spinlock_t *lock)
+{
+	struct kfifo *fifo;
+	gfp_t flags = CAN_SLEEP()? GFP_KERNEL : GFP_ATOMIC;
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33))
+	fifo = kfifo_init(buf, size, flags, lock);
+#else
+	fifo = (struct kfifo *)kzalloc(sizeof(struct kfifo), flags);
+	if (!fifo) {
+		return NULL;
+	}
+	kfifo_init(fifo, buf, size);
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) */
+	return fifo;
+}
+
+static inline void
+dhd_kfifo_free(struct kfifo *fifo)
+{
+	kfifo_free(fifo);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 31))
+	/* FC11 releases the fifo memory */
+	kfree(fifo);
+#endif
+}
+
+/* deferred work functions */
+static void dhd_deferred_work_handler(struct work_struct *data);
+
+void*
+dhd_deferred_work_init(void *dhd_info)
+{
+	struct dhd_deferred_wq	*work = NULL;
+	u8*	buf;
+	unsigned long	fifo_size = 0;
+	gfp_t	flags = CAN_SLEEP()? GFP_KERNEL : GFP_ATOMIC;
+
+	if (!dhd_info) {
+		DHD_ERROR(("%s: dhd info not initialized\n", __FUNCTION__));
+		goto return_null;
+	}
+
+	work = (struct dhd_deferred_wq *)kzalloc(sizeof(struct dhd_deferred_wq),
+		flags);
+
+	if (!work) {
+		DHD_ERROR(("%s: work queue creation failed \n", __FUNCTION__));
+		goto return_null;
+	}
+
+	INIT_WORK((struct work_struct *)work, dhd_deferred_work_handler);
+
+	/* initialize event fifo */
+	spin_lock_init(&work->work_lock);
+
+	/* allocate buffer to hold prio events */
+	fifo_size = DHD_PRIO_WORK_FIFO_SIZE;
+	fifo_size = is_power_of_2(fifo_size)? fifo_size : roundup_pow_of_two(fifo_size);
+	buf = (u8*)kzalloc(fifo_size, flags);
+	if (!buf) {
+		DHD_ERROR(("%s: prio work fifo allocation failed \n", __FUNCTION__));
+		goto return_null;
+	}
+
+	/* Initialize prio event fifo */
+	work->prio_fifo = dhd_kfifo_init(buf, fifo_size, &work->work_lock);
+	if (!work->prio_fifo) {
+		kfree(buf);
+		goto return_null;
+	}
+
+	/* allocate buffer to hold work events */
+	fifo_size = DHD_WORK_FIFO_SIZE;
+	fifo_size = is_power_of_2(fifo_size)? fifo_size : roundup_pow_of_two(fifo_size);
+	buf = (u8*)kzalloc(fifo_size, flags);
+	if (!buf) {
+		DHD_ERROR(("%s: work fifo allocation failed \n", __FUNCTION__));
+		goto return_null;
+	}
+
+	/* Initialize event fifo */
+	work->work_fifo = dhd_kfifo_init(buf, fifo_size, &work->work_lock);
+	if (!work->work_fifo) {
+		kfree(buf);
+		goto return_null;
+	}
+
+	work->dhd_info = dhd_info;
+	DHD_ERROR(("%s: work queue initialized \n", __FUNCTION__));
+	return work;
+
+return_null:
+
+	if (work)
+		dhd_deferred_work_deinit(work);
+
+	return NULL;
+}
+
+void
+dhd_deferred_work_deinit(void *work)
+{
+	struct dhd_deferred_wq *deferred_work = work;
+
+
+	if (!deferred_work) {
+		DHD_ERROR(("%s: deferred work has been freed alread \n", __FUNCTION__));
+		return;
+	}
+
+	/* cancel the deferred work handling */
+	cancel_work_sync((struct work_struct *)deferred_work);
+
+	/*
+	 * free work event fifo.
+	 * kfifo_free frees locally allocated fifo buffer
+	 */
+	if (deferred_work->prio_fifo)
+		dhd_kfifo_free(deferred_work->prio_fifo);
+
+	if (deferred_work->work_fifo)
+		dhd_kfifo_free(deferred_work->work_fifo);
+
+	kfree(deferred_work);
+}
+
+/*
+ *	Prepares event to be queued
+ *	Schedules the event
+ */
+int
+dhd_deferred_schedule_work(void *workq, void *event_data, u8 event,
+	event_handler_t event_handler, u8 priority)
+{
+	struct dhd_deferred_wq *deferred_wq = (struct dhd_deferred_wq *) workq;
+	struct	dhd_deferred_event_t	deferred_event;
+	int	status;
+
+	if (!deferred_wq) {
+		DHD_ERROR(("%s: work queue not initialized \n", __FUNCTION__));
+		ASSERT(0);
+		return DHD_WQ_STS_UNINITIALIZED;
+	}
+
+	if (!event || (event >= DHD_MAX_WQ_EVENTS)) {
+		DHD_ERROR(("%s: Unknown event \n", __FUNCTION__));
+		return DHD_WQ_STS_UNKNOWN_EVENT;
+	}
+
+	/*
+	 * default element size is 1, which can be changed
+	 * using kfifo_esize(). Older kernel(FC11) doesn't support
+	 * changing element size. For compatibility changing
+	 * element size is not prefered
+	 */
+	ASSERT(kfifo_esize(deferred_wq->prio_fifo) == 1);
+	ASSERT(kfifo_esize(deferred_wq->work_fifo) == 1);
+
+	deferred_event.event = event;
+	deferred_event.event_data = event_data;
+	deferred_event.event_handler = event_handler;
+
+	if (priority == DHD_WORK_PRIORITY_HIGH) {
+		status = kfifo_in_spinlocked(deferred_wq->prio_fifo, &deferred_event,
+			DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+	} else {
+		status = kfifo_in_spinlocked(deferred_wq->work_fifo, &deferred_event,
+			DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+	}
+
+	if (!status) {
+		return DHD_WQ_STS_SCHED_FAILED;
+	}
+	schedule_work((struct work_struct *)deferred_wq);
+	return DHD_WQ_STS_OK;
+}
+
+static int
+dhd_get_scheduled_work(struct dhd_deferred_wq *deferred_wq, struct dhd_deferred_event_t *event)
+{
+	int	status = 0;
+
+	if (!deferred_wq) {
+		DHD_ERROR(("%s: work queue not initialized \n", __FUNCTION__));
+		return DHD_WQ_STS_UNINITIALIZED;
+	}
+
+	/*
+	 * default element size is 1 byte, which can be changed
+	 * using kfifo_esize(). Older kernel(FC11) doesn't support
+	 * changing element size. For compatibility changing
+	 * element size is not prefered
+	 */
+	ASSERT(kfifo_esize(deferred_wq->prio_fifo) == 1);
+	ASSERT(kfifo_esize(deferred_wq->work_fifo) == 1);
+
+	/* first read  priorit event fifo */
+	status = kfifo_out_spinlocked(deferred_wq->prio_fifo, event,
+		DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+
+	if (!status) {
+		/* priority fifo is empty. Now read low prio work fifo */
+		status = kfifo_out_spinlocked(deferred_wq->work_fifo, event,
+			DEFRD_EVT_SIZE, &deferred_wq->work_lock);
+	}
+
+	return status;
+}
+
+/*
+ *	Called when work is scheduled
+ */
+static void
+dhd_deferred_work_handler(struct work_struct *work)
+{
+	struct dhd_deferred_wq		*deferred_work = (struct dhd_deferred_wq *)work;
+	struct dhd_deferred_event_t	work_event;
+	int				status;
+
+	if (!deferred_work) {
+		DHD_ERROR(("%s: work queue not initialized\n", __FUNCTION__));
+		return;
+	}
+
+	do {
+		status = dhd_get_scheduled_work(deferred_work, &work_event);
+		DHD_TRACE(("%s: event to handle %d \n", __FUNCTION__, status));
+		if (!status) {
+			DHD_TRACE(("%s: No event to handle %d \n", __FUNCTION__, status));
+			break;
+		}
+
+		if (work_event.event > DHD_MAX_WQ_EVENTS) {
+			DHD_TRACE(("%s: Unknown event %d \n", __FUNCTION__, work_event.event));
+			break;
+		}
+
+		if (work_event.event_handler) {
+			work_event.event_handler(deferred_work->dhd_info,
+				work_event.event_data, work_event.event);
+		} else {
+			DHD_ERROR(("%s: event not defined %d\n", __FUNCTION__, work_event.event));
+		}
+	} while (1);
+	return;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_linux_wq.h b/drivers/net/wireless/bcm4336/dhd_linux_wq.h
--- a/drivers/net/wireless/bcm4336/dhd_linux_wq.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_linux_wq.h	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,46 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Generic work queue framework
+ * Generic interface to handle dhd deferred work events
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_linux_wq.h 449578 2014-01-17 13:53:20Z $
+ */
+#ifndef _dhd_linux_wq_h_
+#define _dhd_linux_wq_h_
+/*
+ *	Work event definitions
+ */
+enum _wq_event {
+	DHD_WQ_WORK_IF_ADD = 1,
+	DHD_WQ_WORK_IF_DEL,
+	DHD_WQ_WORK_SET_MAC,
+	DHD_WQ_WORK_SET_MCAST_LIST,
+	DHD_WQ_WORK_IPV6_NDO,
+	DHD_WQ_WORK_HANG_MSG,
+
+	DHD_MAX_WQ_EVENTS
+};
+
+/*
+ *	Work event priority
+ */
+#define DHD_WORK_PRIORITY_LOW	0
+#define DHD_WORK_PRIORITY_HIGH	1
+
+/*
+ *	Error definitions
+ */
+#define DHD_WQ_STS_OK			 0
+#define DHD_WQ_STS_FAILED		-1	/* General failure */
+#define DHD_WQ_STS_UNINITIALIZED	-2
+#define DHD_WQ_STS_SCHED_FAILED		-3
+#define DHD_WQ_STS_UNKNOWN_EVENT	-4
+
+typedef void (*event_handler_t)(void *handle, void *event_data, u8 event);
+
+void *dhd_deferred_work_init(void *dhd);
+void dhd_deferred_work_deinit(void *workq);
+int dhd_deferred_schedule_work(void *workq, void *event_data, u8 event,
+	event_handler_t evt_handler, u8 priority);
+#endif /* _dhd_linux_wq_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_log.c b/drivers/net/wireless/bcm4336/dhd_log.c
--- a/drivers/net/wireless/bcm4336/dhd_log.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_log.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,58 @@
+/*
+ * DHD logging module for internal debug
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_sdio.c 281456 2011-09-02 01:49:45Z $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <proto/ethernet.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+#include <linux/inet.h>
+
+void dhd_blog(char *cp, int size)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29))
+	static struct socket * _udpSocket = NULL;
+	struct sockaddr_in _saAddr;
+	struct iovec iov;
+	struct msghdr msg;
+	if (sock_create(PF_INET, SOCK_DGRAM, IPPROTO_UDP, &_udpSocket) >= 0)
+	{
+
+		{
+			memset(&_saAddr, 0, sizeof(_saAddr));
+			_saAddr.sin_family      = AF_INET;
+			_saAddr.sin_port        = htons(7651);
+			_saAddr.sin_addr.s_addr = in_aton("10.19.74.43");
+
+			iov.iov_base = cp;
+			iov.iov_len = size;
+
+			msg.msg_name = &_saAddr;
+			msg.msg_namelen = sizeof(struct sockaddr_in);
+			msg.msg_iov = &iov;
+			msg.msg_iovlen = 1;
+			msg.msg_control = NULL;
+			msg.msg_controllen = 0;
+			msg.msg_flags = 0;
+
+			{
+				mm_segment_t fs = get_fs();
+				set_fs(get_ds());
+
+				sock_sendmsg(_udpSocket, &msg, size);
+
+				set_fs(fs);
+			}
+		}
+
+		sock_release(_udpSocket);
+	}
+#endif /* #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_msgbuf.c b/drivers/net/wireless/bcm4336/dhd_msgbuf.c
--- a/drivers/net/wireless/bcm4336/dhd_msgbuf.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_msgbuf.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,4189 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_msgbuf.c 504484 2014-09-24 10:11:20Z $
+ */
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmmsgbuf.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_proto.h>
+#include <dhd_bus.h>
+#include <dhd_dbg.h>
+
+#include <siutils.h>
+
+
+#include <dhd_flowring.h>
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+
+#include <pcie_core.h>
+#include <bcmpcie.h>
+#include <dhd_pcie.h>
+#include <dhd_ip.h>
+
+/*
+ * PCIE D2H DMA Complete Sync Modes
+ *
+ * Firmware may interrupt the host, prior to the D2H Mem2Mem DMA completes into
+ * Host system memory. A WAR using one of 3 approaches is needed:
+ * 1. Dongle places ia modulo-253 seqnum in last word of each D2H message
+ * 2. XOR Checksum, with epoch# in each work item. Dongle builds an XOR checksum
+ *    writes in the last word of each work item. Each work item has a seqnum
+ *    number = sequence num % 253.
+ * 3. Read Barrier: Dongle does a host memory read access prior to posting an
+ *    interrupt.
+ * Host does not participate with option #3, other than reserving a host system
+ * memory location for the dongle to read.
+ */
+#define PCIE_D2H_SYNC
+#define PCIE_D2H_SYNC_WAIT_TRIES    1024
+#define PCIE_D2H_SYNC_BZERO /* bzero a message before updating the RD offset */
+
+#define RETRIES 2		/* # of retries to retrieve matching ioctl response */
+#define IOCTL_HDR_LEN	12
+
+#define DEFAULT_RX_BUFFERS_TO_POST	256
+#define RXBUFPOST_THRESHOLD			32
+#define RX_BUF_BURST				16
+
+#define DHD_STOP_QUEUE_THRESHOLD	200
+#define DHD_START_QUEUE_THRESHOLD	100
+
+#define MODX(x, n)	((x) & ((n) -1))
+#define align(x, n)	(MODX(x, n) ? ((x) - MODX(x, n) + (n)) : ((x) - MODX(x, n)))
+#define RX_DMA_OFFSET		8
+#define IOCT_RETBUF_SIZE	(RX_DMA_OFFSET + WLC_IOCTL_MAXLEN)
+
+#define DMA_D2H_SCRATCH_BUF_LEN	8
+#define DMA_ALIGN_LEN		4
+#define DMA_XFER_LEN_LIMIT	0x400000
+
+#define DHD_FLOWRING_IOCTL_BUFPOST_PKTSZ		8192
+
+#define DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D		1
+#define DHD_FLOWRING_MAX_EVENTBUF_POST			8
+#define DHD_FLOWRING_MAX_IOCTLRESPBUF_POST		8
+
+#define DHD_PROT_FUNCS	22
+
+typedef struct dhd_mem_map {
+	void *va;
+	dmaaddr_t pa;
+	void *dmah;
+} dhd_mem_map_t;
+
+typedef struct dhd_dmaxfer {
+	dhd_mem_map_t	srcmem;
+	dhd_mem_map_t	destmem;
+	uint32		len;
+	uint32		srcdelay;
+	uint32		destdelay;
+} dhd_dmaxfer_t;
+
+#define TXP_FLUSH_NITEMS
+#define TXP_FLUSH_MAX_ITEMS_FLUSH_CNT	48
+
+typedef struct msgbuf_ring {
+	bool		inited;
+	uint16		idx;
+	uchar		name[24];
+	dhd_mem_map_t	ring_base;
+#ifdef TXP_FLUSH_NITEMS
+	void*		start_addr;
+	uint16		pend_items_count;
+#endif /* TXP_FLUSH_NITEMS */
+	ring_mem_t	*ringmem;
+	ring_state_t	*ringstate;
+#if defined(PCIE_D2H_SYNC)
+	uint32      seqnum;
+#endif  /* PCIE_D2H_SYNC */
+	void *secdma;
+} msgbuf_ring_t;
+
+#if defined(PCIE_D2H_SYNC)
+/* Custom callback attached based upon D2H DMA Sync mode used in dongle. */
+typedef uint8 (* d2h_sync_cb_t)(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                volatile cmn_msg_hdr_t *msg, int msglen);
+#endif /* PCIE_D2H_SYNC */
+
+typedef struct dhd_prot {
+	osl_t *osh;		/* OSL handle */
+	uint32 reqid;
+	uint32 lastcmd;
+	uint32 pending;
+	uint16 rxbufpost;
+	uint16 max_rxbufpost;
+	uint16 max_eventbufpost;
+	uint16 max_ioctlrespbufpost;
+	uint16 cur_event_bufs_posted;
+	uint16 cur_ioctlresp_bufs_posted;
+	uint16 active_tx_count;
+	uint16 max_tx_count;
+	uint16 txp_threshold;
+	/* Ring info */
+	msgbuf_ring_t	*h2dring_txp_subn;
+	msgbuf_ring_t	*h2dring_rxp_subn;
+	msgbuf_ring_t	*h2dring_ctrl_subn;	/* Cbuf handle for H2D ctrl ring */
+	msgbuf_ring_t	*d2hring_tx_cpln;
+	msgbuf_ring_t	*d2hring_rx_cpln;
+	msgbuf_ring_t	*d2hring_ctrl_cpln;	/* Cbuf handle for D2H ctrl ring */
+	uint32		rx_dataoffset;
+	dhd_mem_map_t	retbuf;
+	dhd_mem_map_t	ioctbuf;	/* For holding ioct request buf */
+	dhd_mb_ring_t	mb_ring_fn;
+
+	uint32		d2h_dma_scratch_buf_len; /* For holding ioct request buf */
+	dhd_mem_map_t	d2h_dma_scratch_buf;	/* For holding ioct request buf */
+
+	uint32	h2d_dma_writeindx_buf_len; /* For holding dma ringupd buf - submission write */
+	dhd_mem_map_t 	h2d_dma_writeindx_buf;	/* For holding dma ringupd buf - submission write */
+
+	uint32	h2d_dma_readindx_buf_len; /* For holding dma ringupd buf - submission read */
+	dhd_mem_map_t	h2d_dma_readindx_buf;	/* For holding dma ringupd buf - submission read */
+
+	uint32	d2h_dma_writeindx_buf_len; /* For holding dma ringupd buf - completion write */
+	dhd_mem_map_t	d2h_dma_writeindx_buf;	/* For holding dma ringupd buf - completion write */
+
+	uint32	d2h_dma_readindx_buf_len; /* For holding dma ringupd buf - completion read */
+	dhd_mem_map_t	d2h_dma_readindx_buf;	/* For holding dma ringupd buf - completion read */
+
+#if defined(PCIE_D2H_SYNC)
+	d2h_sync_cb_t d2h_sync_cb; /* Sync on D2H DMA done: SEQNUM or XORCSUM */
+	ulong d2h_sync_wait_max; /* max number of wait loops to receive one msg */
+	ulong d2h_sync_wait_tot; /* total wait loops */
+#endif  /* PCIE_D2H_SYNC */
+	dhd_dmaxfer_t	dmaxfer;
+	bool		dmaxfer_in_progress;
+
+	uint16		ioctl_seq_no;
+	uint16		data_seq_no;
+	uint16		ioctl_trans_id;
+	void		*pktid_map_handle;
+	uint16		rx_metadata_offset;
+	uint16		tx_metadata_offset;
+	uint16          rx_cpln_early_upd_idx;
+} dhd_prot_t;
+
+static int dhdmsgbuf_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd,
+	void *buf, uint len, uint8 action);
+static int dhd_msgbuf_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd,
+	void *buf, uint len, uint8 action);
+static int dhdmsgbuf_cmplt(dhd_pub_t *dhd, uint32 id, uint32 len, void* buf, void* retbuf);
+
+static int dhd_msgbuf_rxbuf_post(dhd_pub_t *dhd);
+static int dhd_prot_rxbufpost(dhd_pub_t *dhd, uint16 count);
+static void dhd_prot_return_rxbuf(dhd_pub_t *dhd, uint16 rxcnt);
+static void dhd_prot_rxcmplt_process(dhd_pub_t *dhd, void* buf, uint16 msglen);
+static void dhd_prot_event_process(dhd_pub_t *dhd, void* buf, uint16 len);
+static int dhd_prot_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8* buf, uint16 len);
+static int dhd_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8* buf, uint16 len);
+
+static void dhd_prot_noop(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static void dhd_prot_txstatus_process(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static void dhd_prot_ioctcmplt_process(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static void dhd_prot_ioctack_process(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static void dhd_prot_ringstatus_process(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static void dhd_prot_genstatus_process(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static void* dhd_alloc_ring_space(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+	uint16 msglen, uint16 *alloced);
+static int dhd_fillup_ioct_reqst_ptrbased(dhd_pub_t *dhd, uint16 len, uint cmd, void* buf,
+	int ifidx);
+static INLINE void dhd_prot_packet_free(dhd_pub_t *dhd, uint32 pktid);
+static INLINE void *dhd_prot_packet_get(dhd_pub_t *dhd, uint32 pktid);
+static void dmaxfer_free_dmaaddr(dhd_pub_t *dhd, dhd_dmaxfer_t *dma);
+static int dmaxfer_prepare_dmaaddr(dhd_pub_t *dhd, uint len, uint srcdelay,
+	uint destdelay, dhd_dmaxfer_t *dma);
+static void dhdmsgbuf_dmaxfer_compare(dhd_pub_t *dhd, void *buf, uint16 msglen);
+static void dhd_prot_process_flow_ring_create_response(dhd_pub_t *dhd, void* buf, uint16 msglen);
+static void dhd_prot_process_flow_ring_delete_response(dhd_pub_t *dhd, void* buf, uint16 msglen);
+static void dhd_prot_process_flow_ring_flush_response(dhd_pub_t *dhd, void* buf, uint16 msglen);
+
+
+
+
+#ifdef DHD_RX_CHAINING
+#define PKT_CTF_CHAINABLE(dhd, ifidx, evh, prio, h_sa, h_da, h_prio) \
+	(!ETHER_ISNULLDEST(((struct ether_header *)(evh))->ether_dhost) && \
+	 !ETHER_ISMULTI(((struct ether_header *)(evh))->ether_dhost) && \
+	 !eacmp((h_da), ((struct ether_header *)(evh))->ether_dhost) && \
+	 !eacmp((h_sa), ((struct ether_header *)(evh))->ether_shost) && \
+	 ((h_prio) == (prio)) && (dhd_ctf_hotbrc_check((dhd), (evh), (ifidx))) && \
+	 ((((struct ether_header *)(evh))->ether_type == HTON16(ETHER_TYPE_IP)) || \
+	 (((struct ether_header *)(evh))->ether_type == HTON16(ETHER_TYPE_IPV6))))
+
+static INLINE void BCMFASTPATH dhd_rxchain_reset(rxchain_info_t *rxchain);
+static void BCMFASTPATH dhd_rxchain_frame(dhd_pub_t *dhd, void *pkt, uint ifidx);
+static void BCMFASTPATH dhd_rxchain_commit(dhd_pub_t *dhd);
+
+#define DHD_PKT_CTF_MAX_CHAIN_LEN	64
+#endif /* DHD_RX_CHAINING */
+
+static uint16 dhd_msgbuf_rxbuf_post_ctrlpath(dhd_pub_t *dhd, bool event_buf, uint32 max_to_post);
+static int dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd_pub_t *pub);
+static int dhd_msgbuf_rxbuf_post_event_bufs(dhd_pub_t *pub);
+
+static void dhd_prot_ring_detach(dhd_pub_t *dhd, msgbuf_ring_t * ring);
+static void dhd_ring_init(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static msgbuf_ring_t* prot_ring_attach(dhd_prot_t * prot, char* name, uint16 max_item,
+	uint16 len_item, uint16 ringid);
+static void* prot_get_ring_space(msgbuf_ring_t *ring, uint16 nitems, uint16 * alloced);
+static void dhd_set_dmaed_index(dhd_pub_t *dhd, uint8 type, uint16 ringid, uint16 new_index);
+static uint16 dhd_get_dmaed_index(dhd_pub_t *dhd, uint8 type, uint16 ringid);
+static void prot_ring_write_complete(dhd_pub_t *dhd, msgbuf_ring_t * ring, void* p, uint16 len);
+static void prot_upd_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring);
+static uint8* prot_get_src_addr(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint16 *available_len);
+static void prot_store_rxcpln_read_idx(dhd_pub_t *dhd, msgbuf_ring_t *ring);
+static void prot_early_upd_rxcpln_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring);
+
+typedef void (*dhd_msgbuf_func_t)(dhd_pub_t *dhd, void * buf, uint16 msglen);
+static dhd_msgbuf_func_t table_lookup[DHD_PROT_FUNCS] = {
+	dhd_prot_noop,              /* 0 is invalid message type */
+	dhd_prot_genstatus_process, /* MSG_TYPE_GEN_STATUS */
+	dhd_prot_ringstatus_process, /* MSG_TYPE_RING_STATUS */
+	NULL,
+	dhd_prot_process_flow_ring_create_response, /* MSG_TYPE_FLOW_RING_CREATE_CMPLT */
+	NULL,
+	dhd_prot_process_flow_ring_delete_response, /* MSG_TYPE_FLOW_RING_DELETE_CMPLT */
+	NULL,
+	dhd_prot_process_flow_ring_flush_response, /* MSG_TYPE_FLOW_RING_FLUSH_CMPLT */
+	NULL,
+	dhd_prot_ioctack_process, /* MSG_TYPE_IOCTLPTR_REQ_ACK */
+	NULL,
+	dhd_prot_ioctcmplt_process, /* MSG_TYPE_IOCTL_CMPLT */
+	NULL,
+	dhd_prot_event_process, /* MSG_TYPE_WL_EVENT */
+	NULL,
+	dhd_prot_txstatus_process, /* MSG_TYPE_TX_STATUS */
+	NULL,
+	dhd_prot_rxcmplt_process, /* MSG_TYPE_RX_CMPLT */
+	NULL,
+	dhdmsgbuf_dmaxfer_compare, /* MSG_TYPE_LPBK_DMAXFER_CMPLT */
+	NULL,
+};
+
+
+#if defined(PCIE_D2H_SYNC)
+
+/*
+ * D2H DMA to completion callback handlers. Based on the mode advertised by the
+ * dongle through the PCIE shared region, the appropriate callback will be
+ * registered in the proto layer to be invoked prior to precessing any message
+ * from a D2H DMA ring. If the dongle uses a read barrier or another mode that
+ * does not require host participation, then a noop callback handler will be
+ * bound that simply returns the msgtype.
+ */
+static void dhd_prot_d2h_sync_livelock(dhd_pub_t *dhd, uint32 seqnum,
+                                       uint32 tries, uchar *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_seqnum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                      volatile cmn_msg_hdr_t *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_xorcsum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                       volatile cmn_msg_hdr_t *msg, int msglen);
+static uint8 dhd_prot_d2h_sync_none(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                                    volatile cmn_msg_hdr_t *msg, int msglen);
+static void dhd_prot_d2h_sync_init(dhd_pub_t *dhd, dhd_prot_t * prot);
+
+/* Debug print a livelock avert by dropping a D2H message */
+static void
+dhd_prot_d2h_sync_livelock(dhd_pub_t *dhd, uint32 seqnum, uint32 tries,
+                           uchar *msg, int msglen)
+{
+	DHD_ERROR(("LIVELOCK DHD<%p> seqnum<%u:%u> tries<%u> max<%lu> tot<%lu>\n",
+		dhd, seqnum, seqnum% D2H_EPOCH_MODULO, tries,
+		dhd->prot->d2h_sync_wait_max, dhd->prot->d2h_sync_wait_tot));
+	prhex("D2H MsgBuf Failure", (uchar *)msg, msglen);
+}
+
+/* Sync on a D2H DMA to complete using SEQNUM mode */
+static uint8 BCMFASTPATH
+dhd_prot_d2h_sync_seqnum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                         volatile cmn_msg_hdr_t *msg, int msglen)
+{
+	uint32 tries;
+	uint32 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+	int num_words = msglen / sizeof(uint32); /* num of 32bit words */
+	volatile uint32 *marker = (uint32 *)msg + (num_words - 1); /* last word */
+	dhd_prot_t *prot = dhd->prot;
+
+	ASSERT(msglen == RING_LEN_ITEMS(ring));
+
+	for (tries = 0; tries < PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+		uint32 msg_seqnum = *marker;
+		if (ltoh32(msg_seqnum) == ring_seqnum) { /* dma upto last word done */
+			ring->seqnum++; /* next expected sequence number */
+			goto dma_completed;
+		}
+
+		if (tries > prot->d2h_sync_wait_max)
+			prot->d2h_sync_wait_max = tries;
+
+		OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+
+	} /* for PCIE_D2H_SYNC_WAIT_TRIES */
+
+	dhd_prot_d2h_sync_livelock(dhd, ring->seqnum, tries, (uchar *)msg, msglen);
+
+	ring->seqnum++; /* skip this message ... leak of a pktid */
+	return 0; /* invalid msgtype 0 -> noop callback */
+
+dma_completed:
+
+	prot->d2h_sync_wait_tot += tries;
+	return msg->msg_type;
+}
+
+/* Sync on a D2H DMA to complete using XORCSUM mode */
+static uint8 BCMFASTPATH
+dhd_prot_d2h_sync_xorcsum(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                          volatile cmn_msg_hdr_t *msg, int msglen)
+{
+	uint32 tries;
+	uint32 prot_checksum = 0; /* computed checksum */
+	int num_words = msglen / sizeof(uint32); /* num of 32bit words */
+	uint8 ring_seqnum = ring->seqnum % D2H_EPOCH_MODULO;
+	dhd_prot_t *prot = dhd->prot;
+
+	ASSERT(msglen == RING_LEN_ITEMS(ring));
+
+	for (tries = 0; tries < PCIE_D2H_SYNC_WAIT_TRIES; tries++) {
+		prot_checksum = bcm_compute_xor32((volatile uint32 *)msg, num_words);
+		if (prot_checksum == 0U) { /* checksum is OK */
+			if (msg->epoch == ring_seqnum) {
+				ring->seqnum++; /* next expected sequence number */
+				goto dma_completed;
+			}
+		}
+
+		if (tries > prot->d2h_sync_wait_max)
+			prot->d2h_sync_wait_max = tries;
+
+		OSL_CACHE_INV(msg, msglen); /* invalidate and try again */
+
+	} /* for PCIE_D2H_SYNC_WAIT_TRIES */
+
+	dhd_prot_d2h_sync_livelock(dhd, ring->seqnum, tries, (uchar *)msg, msglen);
+
+	ring->seqnum++; /* skip this message ... leak of a pktid */
+	return 0; /* invalid msgtype 0 -> noop callback */
+
+dma_completed:
+
+	prot->d2h_sync_wait_tot += tries;
+	return msg->msg_type;
+}
+
+/* Do not sync on a D2H DMA */
+static uint8 BCMFASTPATH
+dhd_prot_d2h_sync_none(dhd_pub_t *dhd, msgbuf_ring_t *ring,
+                       volatile cmn_msg_hdr_t *msg, int msglen)
+{
+	return msg->msg_type;
+}
+
+/* Initialize the D2H DMA Sync mode, per D2H ring seqnum and dhd stats */
+static void
+dhd_prot_d2h_sync_init(dhd_pub_t *dhd, dhd_prot_t * prot)
+{
+	prot->d2h_sync_wait_max = 0UL;
+	prot->d2h_sync_wait_tot = 0UL;
+
+	prot->d2hring_tx_cpln->seqnum = D2H_EPOCH_INIT_VAL;
+	prot->d2hring_rx_cpln->seqnum = D2H_EPOCH_INIT_VAL;
+	prot->d2hring_ctrl_cpln->seqnum = D2H_EPOCH_INIT_VAL;
+
+	if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_SEQNUM)
+		prot->d2h_sync_cb = dhd_prot_d2h_sync_seqnum;
+	else if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_XORCSUM)
+		prot->d2h_sync_cb = dhd_prot_d2h_sync_xorcsum;
+	else
+		prot->d2h_sync_cb = dhd_prot_d2h_sync_none;
+}
+
+#endif /* PCIE_D2H_SYNC */
+
+/*
+ * +---------------------------------------------------------------------------+
+ * PktId Map: Provides a native packet pointer to unique 32bit PktId mapping.
+ * The packet id map, also includes storage for some packet parameters that
+ * may be saved. A native packet pointer along with the parameters may be saved
+ * and a unique 32bit pkt id will be returned. Later, the saved packet pointer
+ * and the metadata may be retrieved using the previously allocated packet id.
+ * +---------------------------------------------------------------------------+
+ */
+#define MAX_PKTID_ITEMS     (8192) /* Maximum number of pktids supported */
+
+typedef void * dhd_pktid_map_handle_t; /* opaque handle to a pktid map */
+
+/* Construct a packet id mapping table, returing an opaque map handle */
+static dhd_pktid_map_handle_t *dhd_pktid_map_init(void *osh, uint32 num_items);
+
+/* Destroy a packet id mapping table, freeing all packets active in the table */
+static void dhd_pktid_map_fini(dhd_pktid_map_handle_t *map);
+
+/* Determine number of pktids that are available */
+static INLINE uint32 dhd_pktid_map_avail_cnt(dhd_pktid_map_handle_t *map);
+
+/* Allocate a unique pktid against which a pkt and some metadata is saved */
+static INLINE uint32 dhd_pktid_map_reserve(dhd_pktid_map_handle_t *handle,
+                                           void *pkt);
+static INLINE void dhd_pktid_map_save(dhd_pktid_map_handle_t *handle, void *pkt,
+                       uint32 nkey, dmaaddr_t physaddr, uint32 len, uint8 dma, void *secdma);
+static uint32 dhd_pktid_map_alloc(dhd_pktid_map_handle_t *map, void *pkt,
+                                  dmaaddr_t physaddr, uint32 len, uint8 dma, void *secdma);
+
+/* Return an allocated pktid, retrieving previously saved pkt and metadata */
+static void *dhd_pktid_map_free(dhd_pktid_map_handle_t *map, uint32 id,
+                                dmaaddr_t *physaddr, uint32 *len, void **secdma);
+
+/* Packet metadata saved in packet id mapper */
+typedef struct dhd_pktid_item {
+	bool        inuse;    /* tag an item to be in use */
+	uint8       dma;      /* map direction: flush or invalidate */
+	uint16      len;      /* length of mapped packet's buffer */
+	void        *pkt;     /* opaque native pointer to a packet */
+	dmaaddr_t   physaddr; /* physical address of mapped packet's buffer */
+	void		*secdma;
+} dhd_pktid_item_t;
+
+typedef struct dhd_pktid_map {
+    void        *osh;
+    int         items;    /* total items in map */
+    int         avail;    /* total available items */
+    int         failures; /* lockers unavailable count */
+    uint32      keys[MAX_PKTID_ITEMS + 1]; /* stack of unique pkt ids */
+    dhd_pktid_item_t lockers[0];           /* metadata storage */
+} dhd_pktid_map_t;
+
+/*
+ * PktId (Locker) #0 is never allocated and is considered invalid.
+ *
+ * On request for a pktid, a value DHD_PKTID_INVALID must be treated as a
+ * depleted pktid pool and must not be used by the caller.
+ *
+ * Likewise, a caller must never free a pktid of value DHD_PKTID_INVALID.
+ */
+#define DHD_PKTID_INVALID               (0U)
+
+#define DHD_PKTID_ITEM_SZ               (sizeof(dhd_pktid_item_t))
+#define DHD_PKTID_MAP_SZ(items)         (sizeof(dhd_pktid_map_t) + \
+	                                     (DHD_PKTID_ITEM_SZ * ((items) + 1)))
+
+#define NATIVE_TO_PKTID_INIT(osh, items) dhd_pktid_map_init((osh), (items))
+#define NATIVE_TO_PKTID_FINI(map)        dhd_pktid_map_fini(map)
+#define NATIVE_TO_PKTID_CLEAR(map)       dhd_pktid_map_clear(map)
+
+#define NATIVE_TO_PKTID_RSV(map, pkt)    dhd_pktid_map_reserve((map), (pkt))
+#define NATIVE_TO_PKTID_SAVE(map, pkt, nkey, pa, len, dma, secdma) \
+	dhd_pktid_map_save((map), (void *)(pkt), (nkey), (pa), (uint32)(len), (uint8)dma, \
+	(void *)(secdma))
+#define NATIVE_TO_PKTID(map, pkt, pa, len, dma, secdma) \
+	dhd_pktid_map_alloc((map), (void *)(pkt), (pa), (uint32)(len), (uint8)dma, (void *)(secdma))
+
+#define PKTID_TO_NATIVE(map, pktid, pa, len, secdma) \
+	dhd_pktid_map_free((map), (uint32)(pktid), \
+	                   (dmaaddr_t *)&(pa), (uint32 *)&(len), (void **) &secdma)
+
+#define PKTID_AVAIL(map)                 dhd_pktid_map_avail_cnt(map)
+
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_FLOWRING)
+#define FLOWRING_NAME	"h2dflr"
+#define RING_IS_FLOWRING(ring) \
+	((strncmp(ring->name, FLOWRING_NAME, sizeof(FLOWRING_NAME))) == (0))
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_FLOWRING */
+
+/*
+ * +---------------------------------------------------------------------------+
+ * Packet to Packet Id mapper using a <numbered_key, locker> paradigm.
+ *
+ * dhd_pktid_map manages a set of unique Packet Ids range[1..MAX_PKTID_ITEMS].
+ *
+ * dhd_pktid_map_alloc() may be used to save some packet metadata, and a unique
+ * packet id is returned. This unique packet id may be used to retrieve the
+ * previously saved packet metadata, using dhd_pktid_map_free(). On invocation
+ * of dhd_pktid_map_free(), the unique packet id is essentially freed. A
+ * subsequent call to dhd_pktid_map_alloc() may reuse this packet id.
+ *
+ * Implementation Note:
+ * Convert this into a <key,locker> abstraction and place into bcmutils !
+ * Locker abstraction should treat contents as opaque storage, and a
+ * callback should be registered to handle inuse lockers on destructor.
+ *
+ * +---------------------------------------------------------------------------+
+ */
+
+/* Allocate and initialize a mapper of num_items <numbered_key, locker> */
+static dhd_pktid_map_handle_t *
+dhd_pktid_map_init(void *osh, uint32 num_items)
+{
+	uint32 nkey;
+	dhd_pktid_map_t *map;
+	uint32 dhd_pktid_map_sz;
+
+	ASSERT((num_items >= 1) && num_items <= MAX_PKTID_ITEMS);
+	dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(num_items);
+
+	if ((map = (dhd_pktid_map_t *)MALLOC(osh, dhd_pktid_map_sz)) == NULL) {
+		DHD_ERROR(("%s:%d: MALLOC failed for size %d\n",
+		           __FUNCTION__, __LINE__, dhd_pktid_map_sz));
+		return NULL;
+	}
+	bzero(map, dhd_pktid_map_sz);
+
+	map->osh = osh;
+	map->items = num_items;
+	map->avail = num_items;
+
+	map->lockers[DHD_PKTID_INVALID].inuse = TRUE; /* tag locker #0 as inuse */
+
+	for (nkey = 1; nkey <= num_items; nkey++) { /* locker #0 is reserved */
+		map->keys[nkey] = nkey; /* populate with unique keys */
+		map->lockers[nkey].inuse = FALSE;
+	}
+
+	return (dhd_pktid_map_handle_t *)map; /* opaque handle */
+}
+
+/*
+ * Retrieve all allocated keys and free all <numbered_key, locker>.
+ * Freeing implies: unmapping the buffers and freeing the native packet
+ * This could have been a callback registered with the pktid mapper.
+ */
+static void
+dhd_pktid_map_fini(dhd_pktid_map_handle_t *handle)
+{
+	void *osh;
+	int nkey;
+	dhd_pktid_map_t *map;
+	uint32 dhd_pktid_map_sz;
+	dhd_pktid_item_t *locker;
+
+	if (handle == NULL)
+		return;
+
+	map = (dhd_pktid_map_t *)handle;
+	osh = map->osh;
+	dhd_pktid_map_sz = DHD_PKTID_MAP_SZ(map->items);
+
+	nkey = 1; /* skip reserved KEY #0, and start from 1 */
+	locker = &map->lockers[nkey];
+
+	for (; nkey <= map->items; nkey++, locker++) {
+		if (locker->inuse == TRUE) { /* numbered key still in use */
+			locker->inuse = FALSE; /* force open the locker */
+
+			{   /* This could be a callback registered with dhd_pktid_map */
+				DMA_UNMAP(osh, locker->physaddr, locker->len,
+				          locker->dma, 0, 0);
+				PKTFREE(osh, (ulong*)locker->pkt, FALSE);
+			}
+		}
+	}
+
+	MFREE(osh, handle, dhd_pktid_map_sz);
+}
+
+static void
+dhd_pktid_map_clear(dhd_pktid_map_handle_t *handle)
+{
+	void *osh;
+	int nkey;
+	dhd_pktid_map_t *map;
+	dhd_pktid_item_t *locker;
+
+	DHD_TRACE(("%s\n", __FUNCTION__));
+
+	if (handle == NULL)
+		return;
+
+	map = (dhd_pktid_map_t *)handle;
+	osh = map->osh;
+	map->failures = 0;
+
+	nkey = 1; /* skip reserved KEY #0, and start from 1 */
+	locker = &map->lockers[nkey];
+
+	for (; nkey <= map->items; nkey++, locker++) {
+		map->keys[nkey] = nkey; /* populate with unique keys */
+		if (locker->inuse == TRUE) { /* numbered key still in use */
+			locker->inuse = FALSE; /* force open the locker */
+			DHD_TRACE(("%s free id%d\n", __FUNCTION__, nkey));
+			DMA_UNMAP(osh, (uint32)locker->physaddr, locker->len,
+				locker->dma, 0, 0);
+			PKTFREE(osh, (ulong*)locker->pkt, FALSE);
+		}
+	}
+	map->avail = map->items;
+}
+
+/* Get the pktid free count */
+static INLINE uint32 BCMFASTPATH
+dhd_pktid_map_avail_cnt(dhd_pktid_map_handle_t *handle)
+{
+	dhd_pktid_map_t *map;
+
+	ASSERT(handle != NULL);
+	map = (dhd_pktid_map_t *)handle;
+
+	return map->avail;
+}
+
+/*
+ * Allocate locker, save pkt contents, and return the locker's numbered key.
+ * dhd_pktid_map_alloc() is not reentrant, and is the caller's responsibility.
+ * Caller must treat a returned value DHD_PKTID_INVALID as a failure case,
+ * implying a depleted pool of pktids.
+ */
+static INLINE uint32
+dhd_pktid_map_reserve(dhd_pktid_map_handle_t *handle, void *pkt)
+{
+	uint32 nkey;
+	dhd_pktid_map_t *map;
+	dhd_pktid_item_t *locker;
+
+	ASSERT(handle != NULL);
+	map = (dhd_pktid_map_t *)handle;
+
+	if (map->avail <= 0) { /* no more pktids to allocate */
+		map->failures++;
+		DHD_INFO(("%s:%d: failed, no free keys\n", __FUNCTION__, __LINE__));
+		return DHD_PKTID_INVALID; /* failed alloc request */
+	}
+	ASSERT(map->avail <= map->items);
+
+	nkey = map->keys[map->avail]; /* fetch a free locker, pop stack */
+	map->avail--;
+
+	locker = &map->lockers[nkey]; /* save packet metadata in locker */
+	locker->inuse = TRUE; /* reserve this locker */
+	locker->pkt = pkt;
+
+	ASSERT(nkey != DHD_PKTID_INVALID);
+	return nkey; /* return locker's numbered key */
+}
+
+static INLINE void
+dhd_pktid_map_save(dhd_pktid_map_handle_t *handle, void *pkt, uint32 nkey,
+                   dmaaddr_t physaddr, uint32 len, uint8 dma, void *secdma)
+{
+	dhd_pktid_map_t *map;
+	dhd_pktid_item_t *locker;
+
+	ASSERT(handle != NULL);
+	map = (dhd_pktid_map_t *)handle;
+
+	ASSERT((nkey != DHD_PKTID_INVALID) && (nkey <= (uint32)map->items));
+
+	locker = &map->lockers[nkey];
+	ASSERT(locker->pkt == pkt);
+
+	locker->dma = dma; /* store contents in locker */
+	locker->physaddr = physaddr;
+	locker->len = (uint16)len; /* 16bit len */
+	locker->secdma = secdma;
+}
+
+static uint32 BCMFASTPATH
+dhd_pktid_map_alloc(dhd_pktid_map_handle_t *handle, void *pkt,
+                    dmaaddr_t physaddr, uint32 len, uint8 dma, void *secdma)
+{
+	uint32 nkey = dhd_pktid_map_reserve(handle, pkt);
+	if (nkey != DHD_PKTID_INVALID) {
+		dhd_pktid_map_save(handle, pkt, nkey, physaddr, len, dma, secdma);
+	}
+	return nkey;
+}
+
+/*
+ * Given a numbered key, return the locker contents.
+ * dhd_pktid_map_free() is not reentrant, and is the caller's responsibility.
+ * Caller may not free a pktid value DHD_PKTID_INVALID or an arbitrary pktid
+ * value. Only a previously allocated pktid may be freed.
+ */
+static void * BCMFASTPATH
+dhd_pktid_map_free(dhd_pktid_map_handle_t *handle, uint32 nkey,
+                   dmaaddr_t *physaddr, uint32 *len, void **secdma)
+{
+	dhd_pktid_map_t *map;
+	dhd_pktid_item_t *locker;
+
+	ASSERT(handle != NULL);
+
+	map = (dhd_pktid_map_t *)handle;
+	ASSERT((nkey != DHD_PKTID_INVALID) && (nkey <= (uint32)map->items));
+
+	locker = &map->lockers[nkey];
+
+	if (locker->inuse == FALSE) { /* Debug check for cloned numbered key */
+		DHD_ERROR(("%s:%d: Error! freeing invalid pktid<%u>\n",
+		           __FUNCTION__, __LINE__, nkey));
+		ASSERT(locker->inuse != FALSE);
+		return NULL;
+	}
+
+	map->avail++;
+	map->keys[map->avail] = nkey; /* make this numbered key available */
+	locker->inuse = FALSE; /* open and free Locker */
+
+	*physaddr = locker->physaddr; /* return contents of locker */
+	*len = (uint32)locker->len;
+	*secdma = locker->secdma;
+
+	return locker->pkt;
+}
+
+/* Linkage, sets prot link and updates hdrlen in pub */
+int dhd_prot_attach(dhd_pub_t *dhd)
+{
+	uint alloced = 0;
+
+	dhd_prot_t *prot;
+
+	/* Allocate prot structure */
+	if (!(prot = (dhd_prot_t *)DHD_OS_PREALLOC(dhd, DHD_PREALLOC_PROT,
+		sizeof(dhd_prot_t)))) {
+		DHD_ERROR(("%s: kmalloc failed\n", __FUNCTION__));
+		goto fail;
+	}
+	memset(prot, 0, sizeof(*prot));
+
+	prot->osh = dhd->osh;
+	dhd->prot = prot;
+
+	/* DMAing ring completes supported? FALSE by default  */
+	dhd->dma_d2h_ring_upd_support = FALSE;
+	dhd->dma_h2d_ring_upd_support = FALSE;
+
+	/* Ring Allocations */
+	/* 1.0	 H2D	TXPOST ring */
+	if (!(prot->h2dring_txp_subn = prot_ring_attach(prot, "h2dtxp",
+		H2DRING_TXPOST_MAX_ITEM, H2DRING_TXPOST_ITEMSIZE,
+		BCMPCIE_H2D_TXFLOWRINGID))) {
+		DHD_ERROR(("%s: kmalloc for H2D    TXPOST ring  failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	/* 2.0	 H2D	RXPOST ring */
+	if (!(prot->h2dring_rxp_subn = prot_ring_attach(prot, "h2drxp",
+		H2DRING_RXPOST_MAX_ITEM, H2DRING_RXPOST_ITEMSIZE,
+		BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT))) {
+		DHD_ERROR(("%s: kmalloc for H2D    RXPOST ring  failed\n", __FUNCTION__));
+		goto fail;
+
+	}
+
+	/* 3.0	 H2D	CTRL_SUBMISSION ring */
+	if (!(prot->h2dring_ctrl_subn = prot_ring_attach(prot, "h2dctrl",
+		H2DRING_CTRL_SUB_MAX_ITEM, H2DRING_CTRL_SUB_ITEMSIZE,
+		BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT))) {
+		DHD_ERROR(("%s: kmalloc for H2D    CTRL_SUBMISSION ring failed\n",
+			__FUNCTION__));
+		goto fail;
+
+	}
+
+	/* 4.0	 D2H	TX_COMPLETION ring */
+	if (!(prot->d2hring_tx_cpln = prot_ring_attach(prot, "d2htxcpl",
+		D2HRING_TXCMPLT_MAX_ITEM, D2HRING_TXCMPLT_ITEMSIZE,
+		BCMPCIE_D2H_MSGRING_TX_COMPLETE))) {
+		DHD_ERROR(("%s: kmalloc for D2H    TX_COMPLETION ring failed\n",
+			__FUNCTION__));
+		goto fail;
+
+	}
+
+	/* 5.0	 D2H	RX_COMPLETION ring */
+	if (!(prot->d2hring_rx_cpln = prot_ring_attach(prot, "d2hrxcpl",
+		D2HRING_RXCMPLT_MAX_ITEM, D2HRING_RXCMPLT_ITEMSIZE,
+		BCMPCIE_D2H_MSGRING_RX_COMPLETE))) {
+		DHD_ERROR(("%s: kmalloc for D2H    RX_COMPLETION ring failed\n",
+			__FUNCTION__));
+		goto fail;
+
+	}
+
+	/* 6.0	 D2H	CTRL_COMPLETION ring */
+	if (!(prot->d2hring_ctrl_cpln = prot_ring_attach(prot, "d2hctrl",
+		D2HRING_CTRL_CMPLT_MAX_ITEM, D2HRING_CTRL_CMPLT_ITEMSIZE,
+		BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE))) {
+		DHD_ERROR(("%s: kmalloc for D2H    CTRL_COMPLETION ring failed\n",
+			__FUNCTION__));
+		goto fail;
+	}
+
+	/* Return buffer for ioctl */
+	prot->retbuf.va = DMA_ALLOC_CONSISTENT(dhd->osh, IOCT_RETBUF_SIZE, DMA_ALIGN_LEN,
+		&alloced, &prot->retbuf.pa, &prot->retbuf.dmah);
+	if (prot->retbuf.va ==  NULL) {
+		ASSERT(0);
+		return BCME_NOMEM;
+	}
+
+	ASSERT(MODX((unsigned long)prot->retbuf.va, DMA_ALIGN_LEN) == 0);
+	bzero(prot->retbuf.va, IOCT_RETBUF_SIZE);
+	OSL_CACHE_FLUSH((void *) prot->retbuf.va, IOCT_RETBUF_SIZE);
+
+	/* IOCTL request buffer */
+	prot->ioctbuf.va = DMA_ALLOC_CONSISTENT(dhd->osh, IOCT_RETBUF_SIZE, DMA_ALIGN_LEN,
+		&alloced, &prot->ioctbuf.pa, &prot->ioctbuf.dmah);
+
+	if (prot->ioctbuf.va ==  NULL) {
+		ASSERT(0);
+		return BCME_NOMEM;
+	}
+
+	ASSERT(MODX((unsigned long)prot->ioctbuf.va, DMA_ALIGN_LEN) == 0);
+	bzero(prot->ioctbuf.va, IOCT_RETBUF_SIZE);
+	OSL_CACHE_FLUSH((void *) prot->ioctbuf.va, IOCT_RETBUF_SIZE);
+
+	/* Scratch buffer for dma rx offset */
+	prot->d2h_dma_scratch_buf_len = DMA_D2H_SCRATCH_BUF_LEN;
+	prot->d2h_dma_scratch_buf.va = DMA_ALLOC_CONSISTENT(dhd->osh, DMA_D2H_SCRATCH_BUF_LEN,
+		DMA_ALIGN_LEN, &alloced, &prot->d2h_dma_scratch_buf.pa,
+		&prot->d2h_dma_scratch_buf.dmah);
+
+	if (prot->d2h_dma_scratch_buf.va == NULL) {
+		ASSERT(0);
+		return BCME_NOMEM;
+	}
+	ASSERT(MODX((unsigned long)prot->d2h_dma_scratch_buf.va, DMA_ALIGN_LEN) == 0);
+	bzero(prot->d2h_dma_scratch_buf.va, DMA_D2H_SCRATCH_BUF_LEN);
+	OSL_CACHE_FLUSH((void *)prot->d2h_dma_scratch_buf.va, DMA_D2H_SCRATCH_BUF_LEN);
+
+
+	/* PKTID handle INIT */
+	prot->pktid_map_handle = NATIVE_TO_PKTID_INIT(dhd->osh, MAX_PKTID_ITEMS);
+	if (prot->pktid_map_handle == NULL) {
+		ASSERT(0);
+		return BCME_NOMEM;
+	}
+
+#if defined(PCIE_D2H_SYNC)
+	dhd_prot_d2h_sync_init(dhd, prot);
+#endif /* PCIE_D2H_SYNC */
+
+	prot->dmaxfer.srcmem.va = NULL;
+	prot->dmaxfer.destmem.va = NULL;
+	prot->dmaxfer_in_progress = FALSE;
+
+	prot->rx_metadata_offset = 0;
+	prot->tx_metadata_offset = 0;
+
+#ifdef DHD_RX_CHAINING
+	dhd_rxchain_reset(&prot->rxchain);
+#endif
+
+	return 0;
+
+fail:
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+	if (prot != NULL)
+		dhd_prot_detach(dhd);
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+	return BCME_NOMEM;
+}
+
+/* Init memory block on host DMA'ing indices */
+int
+dhd_prot_init_index_dma_block(dhd_pub_t *dhd, uint8 type, uint32 length)
+{
+	uint alloced = 0;
+
+	dhd_prot_t *prot = dhd->prot;
+	uint32 dma_block_size = 4 * length;
+
+	if (prot == NULL) {
+		DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	switch (type) {
+		case HOST_TO_DNGL_DMA_WRITEINDX_BUFFER:
+			/* ring update dma buffer for submission write */
+			prot->h2d_dma_writeindx_buf_len = dma_block_size;
+			prot->h2d_dma_writeindx_buf.va = DMA_ALLOC_CONSISTENT(dhd->osh,
+				dma_block_size, DMA_ALIGN_LEN, &alloced,
+				&prot->h2d_dma_writeindx_buf.pa,
+				&prot->h2d_dma_writeindx_buf.dmah);
+
+			if (prot->h2d_dma_writeindx_buf.va == NULL) {
+				return BCME_NOMEM;
+			}
+
+			ASSERT(ISALIGNED(prot->h2d_dma_writeindx_buf.va, 4));
+			bzero(prot->h2d_dma_writeindx_buf.va, dma_block_size);
+			OSL_CACHE_FLUSH((void *)prot->h2d_dma_writeindx_buf.va, dma_block_size);
+			DHD_ERROR(("%s: H2D_WRITEINDX_ARRAY_HOST: %d-bytes "
+				"inited for dma'ing h2d-w indices\n", __FUNCTION__,
+				prot->h2d_dma_writeindx_buf_len));
+			break;
+
+		case HOST_TO_DNGL_DMA_READINDX_BUFFER:
+			/* ring update dma buffer for submission read */
+			prot->h2d_dma_readindx_buf_len = dma_block_size;
+			prot->h2d_dma_readindx_buf.va = DMA_ALLOC_CONSISTENT(dhd->osh,
+				dma_block_size, DMA_ALIGN_LEN, &alloced,
+				&prot->h2d_dma_readindx_buf.pa,
+				&prot->h2d_dma_readindx_buf.dmah);
+			if (prot->h2d_dma_readindx_buf.va == NULL) {
+				return BCME_NOMEM;
+			}
+
+			ASSERT(ISALIGNED(prot->h2d_dma_readindx_buf.va, 4));
+			bzero(prot->h2d_dma_readindx_buf.va, dma_block_size);
+			OSL_CACHE_FLUSH((void *)prot->h2d_dma_readindx_buf.va, dma_block_size);
+			DHD_ERROR(("%s: H2D_READINDX_ARRAY_HOST %d-bytes "
+				"inited for dma'ing h2d-r indices\n", __FUNCTION__,
+				prot->h2d_dma_readindx_buf_len));
+			break;
+
+		case DNGL_TO_HOST_DMA_WRITEINDX_BUFFER:
+			/* ring update dma buffer for completion write */
+			prot->d2h_dma_writeindx_buf_len = dma_block_size;
+			prot->d2h_dma_writeindx_buf.va = DMA_ALLOC_CONSISTENT(dhd->osh,
+				dma_block_size, DMA_ALIGN_LEN, &alloced,
+				&prot->d2h_dma_writeindx_buf.pa,
+				&prot->d2h_dma_writeindx_buf.dmah);
+
+			if (prot->d2h_dma_writeindx_buf.va == NULL) {
+				return BCME_NOMEM;
+			}
+
+			ASSERT(ISALIGNED(prot->d2h_dma_writeindx_buf.va, 4));
+			bzero(prot->d2h_dma_writeindx_buf.va, dma_block_size);
+			OSL_CACHE_FLUSH((void *)prot->d2h_dma_writeindx_buf.va, dma_block_size);
+			DHD_ERROR(("%s: D2H_WRITEINDX_ARRAY_HOST %d-bytes "
+				"inited for dma'ing d2h-w indices\n", __FUNCTION__,
+				prot->d2h_dma_writeindx_buf_len));
+			break;
+
+		case DNGL_TO_HOST_DMA_READINDX_BUFFER:
+			/* ring update dma buffer for completion read */
+			prot->d2h_dma_readindx_buf_len = dma_block_size;
+			prot->d2h_dma_readindx_buf.va = DMA_ALLOC_CONSISTENT(dhd->osh,
+				dma_block_size, DMA_ALIGN_LEN, &alloced,
+				&prot->d2h_dma_readindx_buf.pa,
+				&prot->d2h_dma_readindx_buf.dmah);
+
+			if (prot->d2h_dma_readindx_buf.va == NULL) {
+				return BCME_NOMEM;
+			}
+
+			ASSERT(ISALIGNED(prot->d2h_dma_readindx_buf.va, 4));
+			bzero(prot->d2h_dma_readindx_buf.va, dma_block_size);
+			OSL_CACHE_FLUSH((void *)prot->d2h_dma_readindx_buf.va, dma_block_size);
+			DHD_ERROR(("%s: D2H_READINDX_ARRAY_HOST %d-bytes "
+				"inited for dma'ing d2h-r indices\n", __FUNCTION__,
+				prot->d2h_dma_readindx_buf_len));
+			break;
+
+		default:
+			DHD_ERROR(("%s: Unexpected option\n", __FUNCTION__));
+			return BCME_BADOPTION;
+	}
+
+	return BCME_OK;
+
+}
+
+/* Unlink, frees allocated protocol memory (including dhd_prot) */
+void dhd_prot_detach(dhd_pub_t *dhd)
+{
+	dhd_prot_t *prot = dhd->prot;
+	/* Stop the protocol module */
+	if (dhd->prot) {
+
+		/* free up scratch buffer */
+		if (prot->d2h_dma_scratch_buf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, prot->d2h_dma_scratch_buf.va,
+			DMA_D2H_SCRATCH_BUF_LEN, prot->d2h_dma_scratch_buf.pa,
+			prot->d2h_dma_scratch_buf.dmah);
+			prot->d2h_dma_scratch_buf.va = NULL;
+		}
+		/* free up ring upd buffer for submission writes */
+		if (prot->h2d_dma_writeindx_buf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, prot->h2d_dma_writeindx_buf.va,
+			  prot->h2d_dma_writeindx_buf_len, prot->h2d_dma_writeindx_buf.pa,
+			  prot->h2d_dma_writeindx_buf.dmah);
+			prot->h2d_dma_writeindx_buf.va = NULL;
+		}
+
+		/* free up ring upd buffer for submission reads */
+		if (prot->h2d_dma_readindx_buf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, prot->h2d_dma_readindx_buf.va,
+			  prot->h2d_dma_readindx_buf_len, prot->h2d_dma_readindx_buf.pa,
+			  prot->h2d_dma_readindx_buf.dmah);
+			prot->h2d_dma_readindx_buf.va = NULL;
+		}
+
+		/* free up ring upd buffer for completion writes */
+		if (prot->d2h_dma_writeindx_buf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, prot->d2h_dma_writeindx_buf.va,
+			  prot->d2h_dma_writeindx_buf_len, prot->d2h_dma_writeindx_buf.pa,
+			  prot->d2h_dma_writeindx_buf.dmah);
+			prot->d2h_dma_writeindx_buf.va = NULL;
+		}
+
+		/* free up ring upd buffer for completion writes */
+		if (prot->d2h_dma_readindx_buf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, prot->d2h_dma_readindx_buf.va,
+			  prot->d2h_dma_readindx_buf_len, prot->d2h_dma_readindx_buf.pa,
+			  prot->d2h_dma_readindx_buf.dmah);
+			prot->d2h_dma_readindx_buf.va = NULL;
+		}
+
+		/* ioctl return buffer */
+		if (prot->retbuf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, dhd->prot->retbuf.va,
+			IOCT_RETBUF_SIZE, dhd->prot->retbuf.pa, dhd->prot->retbuf.dmah);
+			dhd->prot->retbuf.va = NULL;
+		}
+
+		/* ioctl request buffer */
+		if (prot->ioctbuf.va) {
+			DMA_FREE_CONSISTENT(dhd->osh, dhd->prot->ioctbuf.va,
+			IOCT_RETBUF_SIZE, dhd->prot->ioctbuf.pa, dhd->prot->ioctbuf.dmah);
+
+			dhd->prot->ioctbuf.va = NULL;
+		}
+
+
+		/* 1.0	 H2D	TXPOST ring */
+		dhd_prot_ring_detach(dhd, prot->h2dring_txp_subn);
+		/* 2.0	 H2D	RXPOST ring */
+		dhd_prot_ring_detach(dhd, prot->h2dring_rxp_subn);
+		/* 3.0	 H2D	CTRL_SUBMISSION ring */
+		dhd_prot_ring_detach(dhd, prot->h2dring_ctrl_subn);
+		/* 4.0	 D2H	TX_COMPLETION ring */
+		dhd_prot_ring_detach(dhd, prot->d2hring_tx_cpln);
+		/* 5.0	 D2H	RX_COMPLETION ring */
+		dhd_prot_ring_detach(dhd, prot->d2hring_rx_cpln);
+		/* 6.0	 D2H	CTRL_COMPLETION ring */
+		dhd_prot_ring_detach(dhd, prot->d2hring_ctrl_cpln);
+
+		NATIVE_TO_PKTID_FINI(dhd->prot->pktid_map_handle);
+
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+		MFREE(dhd->osh, dhd->prot, sizeof(dhd_prot_t));
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+		dhd->prot = NULL;
+	}
+}
+
+void
+dhd_prot_rx_dataoffset(dhd_pub_t *dhd, uint32 rx_offset)
+{
+	dhd_prot_t *prot = dhd->prot;
+	prot->rx_dataoffset = rx_offset;
+}
+
+
+/* Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+int dhd_sync_with_dongle(dhd_pub_t *dhd)
+{
+	int ret = 0;
+	wlc_rev_info_t revinfo;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Post event buffer after shim layer is attached */
+	ret = dhd_msgbuf_rxbuf_post_event_bufs(dhd);
+	if (ret <= 0) {
+		DHD_ERROR(("%s : Post event buffer fail. ret = %d\n", __FUNCTION__, ret));
+		return ret;
+	}
+
+
+	/* Get the device rev info */
+	memset(&revinfo, 0, sizeof(revinfo));
+	ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_REVINFO, &revinfo, sizeof(revinfo), FALSE, 0);
+	if (ret < 0)
+		goto done;
+
+	dhd_process_cid_mac(dhd, TRUE);
+
+	ret = dhd_preinit_ioctls(dhd);
+
+	if (!ret)
+		dhd_process_cid_mac(dhd, FALSE);
+
+	/* Always assumes wl for now */
+	dhd->iswl = TRUE;
+done:
+	return ret;
+}
+
+/* This function does all necessary initialization needed
+* for IOCTL/IOVAR path
+*/
+int dhd_prot_init(dhd_pub_t *dhd)
+{
+	int ret = 0;
+	dhd_prot_t *prot = dhd->prot;
+
+	/* Max pkts in ring */
+	prot->max_tx_count = H2DRING_TXPOST_MAX_ITEM;
+
+	DHD_INFO(("%s:%d: MAX_TX_COUNT = %d\n", __FUNCTION__, __LINE__, prot->max_tx_count));
+
+	/* Read max rx packets supported by dongle */
+	dhd_bus_cmn_readshared(dhd->bus, &prot->max_rxbufpost, MAX_HOST_RXBUFS, 0);
+	if (prot->max_rxbufpost == 0) {
+		/* This would happen if the dongle firmware is not */
+		/* using the latest shared structure template */
+		prot->max_rxbufpost = DEFAULT_RX_BUFFERS_TO_POST;
+	}
+	DHD_INFO(("%s:%d: MAX_RXBUFPOST = %d\n", __FUNCTION__, __LINE__, prot->max_rxbufpost));
+
+	prot->max_eventbufpost = DHD_FLOWRING_MAX_EVENTBUF_POST;
+	prot->max_ioctlrespbufpost = DHD_FLOWRING_MAX_IOCTLRESPBUF_POST;
+
+	prot->active_tx_count = 0;
+	prot->data_seq_no = 0;
+	prot->ioctl_seq_no = 0;
+	prot->txp_threshold = TXP_FLUSH_MAX_ITEMS_FLUSH_CNT;
+
+	prot->ioctl_trans_id = 1;
+
+	/* Register the interrupt function upfront */
+	/* remove corerev checks in data path */
+	prot->mb_ring_fn = dhd_bus_get_mbintr_fn(dhd->bus);
+
+	/* Initialise rings */
+	/* 1.0	 H2D	TXPOST ring */
+	if (dhd_bus_is_txmode_push(dhd->bus)) {
+		dhd_ring_init(dhd, prot->h2dring_txp_subn);
+	}
+
+	/* 2.0	 H2D	RXPOST ring */
+	dhd_ring_init(dhd, prot->h2dring_rxp_subn);
+	/* 3.0	 H2D	CTRL_SUBMISSION ring */
+	dhd_ring_init(dhd, prot->h2dring_ctrl_subn);
+	/* 4.0	 D2H	TX_COMPLETION ring */
+	dhd_ring_init(dhd, prot->d2hring_tx_cpln);
+	/* 5.0	 D2H	RX_COMPLETION ring */
+	dhd_ring_init(dhd, prot->d2hring_rx_cpln);
+	/* 6.0	 D2H	CTRL_COMPLETION ring */
+	dhd_ring_init(dhd, prot->d2hring_ctrl_cpln);
+
+	/* init the scratch buffer */
+	dhd_bus_cmn_writeshared(dhd->bus, &prot->d2h_dma_scratch_buf.pa,
+		sizeof(prot->d2h_dma_scratch_buf.pa), DNGL_TO_HOST_DMA_SCRATCH_BUFFER, 0);
+	dhd_bus_cmn_writeshared(dhd->bus, &prot->d2h_dma_scratch_buf_len,
+		sizeof(prot->d2h_dma_scratch_buf_len), DNGL_TO_HOST_DMA_SCRATCH_BUFFER_LEN, 0);
+
+	/* If supported by the host, indicate the memory block
+	 * for comletion writes / submission reads to shared space
+	 */
+	if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+		dhd_bus_cmn_writeshared(dhd->bus, &prot->d2h_dma_writeindx_buf.pa,
+			sizeof(prot->d2h_dma_writeindx_buf.pa),
+			DNGL_TO_HOST_DMA_WRITEINDX_BUFFER, 0);
+		dhd_bus_cmn_writeshared(dhd->bus, &prot->h2d_dma_readindx_buf.pa,
+			sizeof(prot->h2d_dma_readindx_buf.pa),
+			HOST_TO_DNGL_DMA_READINDX_BUFFER, 0);
+	}
+
+	if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support)) {
+		dhd_bus_cmn_writeshared(dhd->bus, &prot->h2d_dma_writeindx_buf.pa,
+			sizeof(prot->h2d_dma_writeindx_buf.pa),
+			HOST_TO_DNGL_DMA_WRITEINDX_BUFFER, 0);
+		dhd_bus_cmn_writeshared(dhd->bus, &prot->d2h_dma_readindx_buf.pa,
+			sizeof(prot->d2h_dma_readindx_buf.pa),
+			DNGL_TO_HOST_DMA_READINDX_BUFFER, 0);
+
+	}
+
+	ret = dhd_msgbuf_rxbuf_post(dhd);
+	ret = dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd);
+
+	return ret;
+}
+
+#define DHD_DBG_SHOW_METADATA	0
+#if DHD_DBG_SHOW_METADATA
+static void BCMFASTPATH
+dhd_prot_print_metadata(dhd_pub_t *dhd, void *ptr, int len)
+{
+	uint8 tlv_t;
+	uint8 tlv_l;
+	uint8 *tlv_v = (uint8 *)ptr;
+
+	if (len <= BCMPCIE_D2H_METADATA_HDRLEN)
+		return;
+
+	len -= BCMPCIE_D2H_METADATA_HDRLEN;
+	tlv_v += BCMPCIE_D2H_METADATA_HDRLEN;
+
+	while (len > TLV_HDR_LEN) {
+		tlv_t = tlv_v[TLV_TAG_OFF];
+		tlv_l = tlv_v[TLV_LEN_OFF];
+
+		len -= TLV_HDR_LEN;
+		tlv_v += TLV_HDR_LEN;
+		if (len < tlv_l)
+			break;
+		if ((tlv_t == 0) || (tlv_t == WLFC_CTL_TYPE_FILLER))
+			break;
+
+		switch (tlv_t) {
+		case WLFC_CTL_TYPE_TXSTATUS:
+			bcm_print_bytes("METADATA TX_STATUS", tlv_v, tlv_l);
+			break;
+
+		case WLFC_CTL_TYPE_RSSI:
+			bcm_print_bytes("METADATA RX_RSSI", tlv_v, tlv_l);
+			break;
+
+		case WLFC_CTL_TYPE_FIFO_CREDITBACK:
+			bcm_print_bytes("METADATA FIFO_CREDITBACK", tlv_v, tlv_l);
+			break;
+
+		case WLFC_CTL_TYPE_TX_ENTRY_STAMP:
+			bcm_print_bytes("METADATA TX_ENTRY", tlv_v, tlv_l);
+			break;
+
+		case WLFC_CTL_TYPE_RX_STAMP:
+			bcm_print_bytes("METADATA RX_TIMESTAMP", tlv_v, tlv_l);
+			break;
+
+		case WLFC_CTL_TYPE_TRANS_ID:
+			bcm_print_bytes("METADATA TRANS_ID", tlv_v, tlv_l);
+			break;
+
+		case WLFC_CTL_TYPE_COMP_TXSTATUS:
+			bcm_print_bytes("METADATA COMP_TXSTATUS", tlv_v, tlv_l);
+			break;
+
+		default:
+			bcm_print_bytes("METADATA UNKNOWN", tlv_v, tlv_l);
+			break;
+		}
+
+		len -= tlv_l;
+		tlv_v += tlv_l;
+	}
+}
+#endif /* DHD_DBG_SHOW_METADATA */
+
+static INLINE void BCMFASTPATH
+dhd_prot_packet_free(dhd_pub_t *dhd, uint32 pktid)
+{
+	void *PKTBUF;
+	dmaaddr_t pa;
+	uint32 pa_len;
+	void *secdma;
+	PKTBUF = PKTID_TO_NATIVE(dhd->prot->pktid_map_handle, pktid, pa, pa_len, secdma);
+
+	if (PKTBUF) {
+	{
+		if (SECURE_DMA_ENAB(dhd->osh))  {
+			SECURE_DMA_UNMAP(dhd->osh, pa, (uint) pa_len, DMA_TX, 0, 0, secdma, 0);
+		} else
+			DMA_UNMAP(dhd->osh, pa, (uint) pa_len, DMA_TX, 0, 0);
+		}
+		PKTFREE(dhd->osh, PKTBUF, FALSE);
+	}
+	return;
+}
+
+static INLINE void * BCMFASTPATH
+dhd_prot_packet_get(dhd_pub_t *dhd, uint32 pktid)
+{
+	void *PKTBUF;
+	dmaaddr_t pa;
+	uint32 pa_len;
+	void *secdma;
+	PKTBUF = PKTID_TO_NATIVE(dhd->prot->pktid_map_handle, pktid, pa, pa_len, secdma);
+	if (PKTBUF) {
+	if (SECURE_DMA_ENAB(dhd->osh))
+		SECURE_DMA_UNMAP(dhd->osh, pa, (uint) pa_len, DMA_RX, 0, 0, secdma, 0);
+	else
+		DMA_UNMAP(dhd->osh, pa, (uint) pa_len, DMA_RX, 0, 0);
+	}
+
+	return PKTBUF;
+}
+
+static int BCMFASTPATH
+dhd_msgbuf_rxbuf_post(dhd_pub_t *dhd)
+{
+	dhd_prot_t *prot = dhd->prot;
+	int16 fillbufs;
+	uint16 cnt = 64;
+	int retcount = 0;
+
+	fillbufs = prot->max_rxbufpost - prot->rxbufpost;
+	while (fillbufs > 0) {
+		cnt--;
+		if (cnt == 0) {
+			/* find a better way to reschedule rx buf post if space not available */
+			DHD_ERROR(("%s: h2d rx post ring not available to post host buffers\n", __FUNCTION__));
+			DHD_ERROR(("%s: Current posted host buf count %d \n", __FUNCTION__, prot->rxbufpost));
+			break;
+		}
+
+		/* Post in a burst of 8 buffers ata time */
+		fillbufs = MIN(fillbufs, RX_BUF_BURST);
+
+		/* Post buffers */
+		retcount = dhd_prot_rxbufpost(dhd, fillbufs);
+
+		if (retcount > 0) {
+			prot->rxbufpost += (uint16)retcount;
+
+			/* how many more to post */
+			fillbufs = prot->max_rxbufpost - prot->rxbufpost;
+		} else {
+			/* Make sure we don't run loop any further */
+			fillbufs = 0;
+		}
+	}
+
+	return 0;
+}
+
+/* Post count no of rx buffers down to dongle */
+static int BCMFASTPATH
+dhd_prot_rxbufpost(dhd_pub_t *dhd, uint16 count)
+{
+	void *p;
+	uint16 pktsz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+	uint8 *rxbuf_post_tmp;
+	host_rxbuf_post_t *rxbuf_post;
+	void* msg_start;
+	dmaaddr_t physaddr;
+	uint32 pktlen;
+	dhd_prot_t *prot = dhd->prot;
+	msgbuf_ring_t * ring = prot->h2dring_rxp_subn;
+	uint8 i = 0;
+	uint16 alloced = 0;
+	unsigned long flags;
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	/* Claim space for 'count' no of messages */
+	msg_start = (void *)dhd_alloc_ring_space(dhd, ring, count, &alloced);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	if (msg_start == NULL) {
+		DHD_INFO(("%s:%d: Rxbufpost Msgbuf Not available\n", __FUNCTION__, __LINE__));
+		return -1;
+	}
+	/* if msg_start !=  NULL, we should have alloced space for atleast 1 item */
+	ASSERT(alloced > 0);
+
+	rxbuf_post_tmp = (uint8*)msg_start;
+
+	/* loop through each message */
+	for (i = 0; i < alloced; i++) {
+		rxbuf_post = (host_rxbuf_post_t *)rxbuf_post_tmp;
+		/* Create a rx buffer */
+		if ((p = PKTGET(dhd->osh, pktsz, FALSE)) == NULL) {
+			DHD_ERROR(("%s:%d: PKTGET for rxbuf failed\n", __FUNCTION__, __LINE__));
+			break;
+		}
+
+		pktlen = PKTLEN(dhd->osh, p);
+	if (SECURE_DMA_ENAB(dhd->osh)) {
+		DHD_GENERAL_LOCK(dhd, flags);
+		physaddr = SECURE_DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0,
+			ring->secdma, 0);
+		DHD_GENERAL_UNLOCK(dhd, flags);
+	} else
+		physaddr = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0);
+
+		if (PHYSADDRISZERO(physaddr)) {
+	if (SECURE_DMA_ENAB(dhd->osh)) {
+			DHD_GENERAL_LOCK(dhd, flags);
+			SECURE_DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0,
+				ring->secdma, 0);
+			DHD_GENERAL_UNLOCK(dhd, flags);
+	} else
+			DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0);
+
+			PKTFREE(dhd->osh, p, FALSE);
+			DHD_ERROR(("%s: Invalid phyaddr 0\n", __FUNCTION__));
+			ASSERT(0);
+			break;
+		}
+
+		PKTPULL(dhd->osh, p, prot->rx_metadata_offset);
+		pktlen = PKTLEN(dhd->osh, p);
+
+		/* CMN msg header */
+		rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_RXBUF_POST;
+		rxbuf_post->cmn_hdr.if_id = 0;
+
+		/* get the lock before calling NATIVE_TO_PKTID */
+		DHD_GENERAL_LOCK(dhd, flags);
+
+		rxbuf_post->cmn_hdr.request_id =
+			htol32(NATIVE_TO_PKTID(dhd->prot->pktid_map_handle, p, physaddr,
+			pktlen, DMA_RX, ring->secdma));
+
+		/* free lock */
+		DHD_GENERAL_UNLOCK(dhd, flags);
+
+		if (rxbuf_post->cmn_hdr.request_id == DHD_PKTID_INVALID) {
+			if (SECURE_DMA_ENAB(dhd->osh)) {
+				DHD_GENERAL_LOCK(dhd, flags);
+				SECURE_DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0,
+					ring->secdma, 0);
+				DHD_GENERAL_UNLOCK(dhd, flags);
+		} else
+			DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0);
+
+			PKTFREE(dhd->osh, p, FALSE);
+			DHD_ERROR(("%s: Pktid pool depleted.\n", __FUNCTION__));
+			break;
+		}
+
+		rxbuf_post->data_buf_len = htol16((uint16)pktlen);
+		rxbuf_post->data_buf_addr.high_addr = htol32(PHYSADDRHI(physaddr));
+		rxbuf_post->data_buf_addr.low_addr =
+			htol32(PHYSADDRLO(physaddr) + prot->rx_metadata_offset);
+
+		if (prot->rx_metadata_offset) {
+			rxbuf_post->metadata_buf_len = prot->rx_metadata_offset;
+			rxbuf_post->metadata_buf_addr.high_addr = htol32(PHYSADDRHI(physaddr));
+			rxbuf_post->metadata_buf_addr.low_addr  = htol32(PHYSADDRLO(physaddr));
+		} else {
+			rxbuf_post->metadata_buf_len = 0;
+			rxbuf_post->metadata_buf_addr.high_addr = 0;
+			rxbuf_post->metadata_buf_addr.low_addr  = 0;
+		}
+
+		/* Move rxbuf_post_tmp to next item */
+		rxbuf_post_tmp = rxbuf_post_tmp + RING_LEN_ITEMS(ring);
+	}
+
+	if (i < alloced) {
+		if (RING_WRITE_PTR(ring) < (alloced - i))
+			RING_WRITE_PTR(ring) = RING_MAX_ITEM(ring) - (alloced - i);
+		else
+			RING_WRITE_PTR(ring) -= (alloced - i);
+
+		alloced = i;
+	}
+
+	/* Update the write pointer in TCM & ring bell */
+	if (alloced > 0)
+		prot_ring_write_complete(dhd, prot->h2dring_rxp_subn, msg_start, alloced);
+
+	return alloced;
+}
+
+static int
+dhd_prot_rxbufpost_ctrl(dhd_pub_t *dhd, bool event_buf)
+{
+	void *p;
+	uint16 pktsz;
+	ioctl_resp_evt_buf_post_msg_t *rxbuf_post;
+	dmaaddr_t physaddr;
+	uint32 pktlen;
+	dhd_prot_t *prot = dhd->prot;
+	uint16 alloced = 0;
+	unsigned long flags;
+
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+		return -1;
+	}
+
+	if (event_buf) {
+		/* Allocate packet for event buffer post */
+		pktsz = DHD_FLOWRING_RX_BUFPOST_PKTSZ;
+	} else {
+		/* Allocate packet for ctrl/ioctl buffer post */
+		pktsz = DHD_FLOWRING_IOCTL_BUFPOST_PKTSZ;
+	}
+
+	if ((p = PKTGET(dhd->osh, pktsz, FALSE)) == NULL) {
+		DHD_ERROR(("%s:%d: PKTGET for %s rxbuf failed\n",
+			__FUNCTION__, __LINE__, event_buf ?
+			"event" : "ioctl"));
+		return -1;
+	}
+
+	pktlen = PKTLEN(dhd->osh, p);
+	if (SECURE_DMA_ENAB(dhd->osh)) {
+		DHD_GENERAL_LOCK(dhd, flags);
+		physaddr = SECURE_DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen,
+			DMA_RX, p, 0, prot->h2dring_ctrl_subn->secdma, 0);
+		DHD_GENERAL_UNLOCK(dhd, flags);
+	} else
+	physaddr = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, p), pktlen, DMA_RX, p, 0);
+
+	if (PHYSADDRISZERO(physaddr)) {
+
+		DHD_ERROR(("%s: Invalid phyaddr 0\n", __FUNCTION__));
+		ASSERT(0);
+		goto free_pkt_return;
+	}
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	rxbuf_post = (ioctl_resp_evt_buf_post_msg_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+	if (rxbuf_post == NULL) {
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		DHD_ERROR(("%s:%d: Ctrl submit Msgbuf Not available to post buffer"
+			" for %s\n", __FUNCTION__, __LINE__, event_buf ? "event" :
+			"ioctl"));
+		if (SECURE_DMA_ENAB(dhd->osh)) {
+			DHD_GENERAL_LOCK(dhd, flags);
+			SECURE_DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0,
+				prot->h2dring_ctrl_subn->secdma, 0);
+			DHD_GENERAL_UNLOCK(dhd, flags);
+		} else
+		DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0);
+
+		goto free_pkt_return;
+	}
+
+	/* CMN msg header */
+	if (event_buf)
+		rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_EVENT_BUF_POST;
+	else
+		rxbuf_post->cmn_hdr.msg_type = MSG_TYPE_IOCTLRESP_BUF_POST;
+	rxbuf_post->cmn_hdr.if_id = 0;
+
+	rxbuf_post->cmn_hdr.request_id =
+		htol32(NATIVE_TO_PKTID(dhd->prot->pktid_map_handle, p, physaddr, pktlen, DMA_RX,
+		prot->h2dring_ctrl_subn->secdma));
+
+	if (rxbuf_post->cmn_hdr.request_id == DHD_PKTID_INVALID) {
+		if (RING_WRITE_PTR(prot->h2dring_ctrl_subn) == 0)
+			RING_WRITE_PTR(prot->h2dring_ctrl_subn) =
+				RING_MAX_ITEM(prot->h2dring_ctrl_subn) - 1;
+		else
+			RING_WRITE_PTR(prot->h2dring_ctrl_subn)--;
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		if (SECURE_DMA_ENAB(dhd->osh)) {
+			DHD_GENERAL_LOCK(dhd, flags);
+			SECURE_DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0,
+				prot->h2dring_ctrl_subn->secdma, 0);
+			DHD_GENERAL_UNLOCK(dhd, flags);
+		} else
+		DMA_UNMAP(dhd->osh, physaddr, pktlen, DMA_RX, 0, 0);
+
+		goto free_pkt_return;
+	}
+
+	rxbuf_post->cmn_hdr.flags = 0;
+	rxbuf_post->host_buf_len = htol16((uint16)PKTLEN(dhd->osh, p));
+	rxbuf_post->host_buf_addr.high_addr = htol32(PHYSADDRHI(physaddr));
+	rxbuf_post->host_buf_addr.low_addr  = htol32(PHYSADDRLO(physaddr));
+
+	/* Update the write pointer in TCM & ring bell */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, rxbuf_post,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return 1;
+
+free_pkt_return:
+	PKTFREE(dhd->osh, p, FALSE);
+
+	return -1;
+}
+
+static uint16
+dhd_msgbuf_rxbuf_post_ctrlpath(dhd_pub_t *dhd, bool event_buf, uint32 max_to_post)
+{
+	uint32 i = 0;
+	int32 ret_val;
+
+	DHD_INFO(("%s: max to post %d, event %d\n", __FUNCTION__, max_to_post, event_buf));
+
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+		return 0;
+	}
+
+	while (i < max_to_post) {
+		ret_val  = dhd_prot_rxbufpost_ctrl(dhd, event_buf);
+		if (ret_val < 0)
+			break;
+		i++;
+	}
+	DHD_INFO(("%s: posted %d buffers to event_pool/ioctl_resp_pool %d\n", __FUNCTION__, i, event_buf));
+	return (uint16)i;
+}
+
+static int
+dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd_pub_t *dhd)
+{
+	dhd_prot_t *prot = dhd->prot;
+	uint16 retcnt = 0;
+
+	DHD_INFO(("%s: ioctl resp buf post\n", __FUNCTION__));
+
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+		return 0;
+	}
+
+	retcnt = dhd_msgbuf_rxbuf_post_ctrlpath(dhd, FALSE,
+		prot->max_ioctlrespbufpost - prot->cur_ioctlresp_bufs_posted);
+	prot->cur_ioctlresp_bufs_posted += retcnt;
+	return retcnt;
+}
+
+static int
+dhd_msgbuf_rxbuf_post_event_bufs(dhd_pub_t *dhd)
+{
+	dhd_prot_t *prot = dhd->prot;
+	uint16 retcnt = 0;
+
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+		return 0;
+	}
+
+	retcnt = dhd_msgbuf_rxbuf_post_ctrlpath(dhd, TRUE,
+		prot->max_eventbufpost - prot->cur_event_bufs_posted);
+
+	prot->cur_event_bufs_posted += retcnt;
+	return retcnt;
+}
+
+bool BCMFASTPATH
+dhd_prot_process_msgbuf_rxcpl(dhd_pub_t *dhd, uint bound)
+{
+	dhd_prot_t *prot = dhd->prot;
+	bool more = TRUE;
+	uint n = 0;
+
+	/* Process all the messages - DTOH direction */
+	while (TRUE) {
+		uint8 *src_addr;
+		uint16 src_len;
+
+		/* Store current read pointer */
+		/* Read pointer will be updated in prot_early_upd_rxcpln_read_idx */
+		prot_store_rxcpln_read_idx(dhd, prot->d2hring_rx_cpln);
+
+		/* Get the message from ring */
+		src_addr = prot_get_src_addr(dhd, prot->d2hring_rx_cpln, &src_len);
+		if (src_addr == NULL) {
+			more = FALSE;
+			break;
+		}
+
+		/* Prefetch data to populate the cache */
+		OSL_PREFETCH(src_addr);
+
+		if (dhd_prot_process_msgtype(dhd, prot->d2hring_rx_cpln, src_addr,
+			src_len) != BCME_OK) {
+			prot_upd_read_idx(dhd, prot->d2hring_rx_cpln);
+			DHD_ERROR(("%s: Error at  process rxpl msgbuf of len %d\n",
+				__FUNCTION__, src_len));
+		}
+
+		/* After batch processing, check RX bound */
+		n += src_len/RING_LEN_ITEMS(prot->d2hring_rx_cpln);
+		if (n >= bound) {
+			break;
+		}
+	}
+
+	return more;
+}
+
+void
+dhd_prot_update_txflowring(dhd_pub_t *dhd, uint16 flow_id, void *msgring_info)
+{
+	uint16 r_index = 0;
+	msgbuf_ring_t *ring = (msgbuf_ring_t *)msgring_info;
+
+	/* Update read pointer */
+	if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+		r_index = dhd_get_dmaed_index(dhd, H2D_DMA_READINDX, ring->idx);
+		ring->ringstate->r_offset = r_index;
+	}
+
+	DHD_TRACE(("%s: flow %d, write %d read %d \n\n", __FUNCTION__, flow_id, RING_WRITE_PTR(ring),
+		RING_READ_PTR(ring)));
+
+	/* Need more logic here, but for now use it directly */
+	dhd_bus_schedule_queue(dhd->bus, flow_id, TRUE);
+}
+
+
+bool BCMFASTPATH
+dhd_prot_process_msgbuf_txcpl(dhd_pub_t *dhd, uint bound)
+{
+	dhd_prot_t *prot = dhd->prot;
+	bool more = TRUE;
+	uint n = 0;
+
+	/* Process all the messages - DTOH direction */
+	while (TRUE) {
+		uint8 *src_addr;
+		uint16 src_len;
+
+		src_addr = prot_get_src_addr(dhd, prot->d2hring_tx_cpln, &src_len);
+		if (src_addr == NULL) {
+			more = FALSE;
+			break;
+		}
+
+		/* Prefetch data to populate the cache */
+		OSL_PREFETCH(src_addr);
+
+		if (dhd_prot_process_msgtype(dhd, prot->d2hring_tx_cpln, src_addr,
+			src_len) != BCME_OK) {
+			DHD_ERROR(("%s: Error at  process txcmpl msgbuf of len %d\n",
+				__FUNCTION__, src_len));
+		}
+
+		/* Write to dngl rd ptr */
+		prot_upd_read_idx(dhd, prot->d2hring_tx_cpln);
+
+		/* After batch processing, check bound */
+		n += src_len/RING_LEN_ITEMS(prot->d2hring_tx_cpln);
+		if (n >= bound) {
+			break;
+		}
+	}
+
+	return more;
+}
+
+int BCMFASTPATH
+dhd_prot_process_ctrlbuf(dhd_pub_t * dhd)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	/* Process all the messages - DTOH direction */
+	while (TRUE) {
+		uint8 *src_addr;
+		uint16 src_len;
+		src_addr = prot_get_src_addr(dhd, prot->d2hring_ctrl_cpln, &src_len);
+
+		if (src_addr == NULL) {
+			break;
+		}
+
+		/* Prefetch data to populate the cache */
+		OSL_PREFETCH(src_addr);
+		if (dhd_prot_process_msgtype(dhd, prot->d2hring_ctrl_cpln, src_addr,
+			src_len) != BCME_OK) {
+			DHD_ERROR(("%s: Error at  process ctrlmsgbuf of len %d\n",
+				__FUNCTION__, src_len));
+		}
+
+		/* Write to dngl rd ptr */
+		prot_upd_read_idx(dhd, prot->d2hring_ctrl_cpln);
+	}
+
+	return 0;
+}
+
+static int BCMFASTPATH
+dhd_prot_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8* buf, uint16 len)
+{
+	dhd_prot_t *prot = dhd->prot;
+	uint32 cur_dma_len = 0;
+	int ret = BCME_OK;
+
+	DHD_INFO(("%s: process msgbuf of len %d\n", __FUNCTION__, len));
+
+	while (len > 0) {
+		ASSERT(len > (sizeof(cmn_msg_hdr_t) + prot->rx_dataoffset));
+		if (prot->rx_dataoffset) {
+			cur_dma_len = *(uint32 *) buf;
+			ASSERT(cur_dma_len <= len);
+			buf += prot->rx_dataoffset;
+			len -= (uint16)prot->rx_dataoffset;
+		}
+		else {
+			cur_dma_len = len;
+		}
+		if (dhd_process_msgtype(dhd, ring, buf, (uint16)cur_dma_len) != BCME_OK) {
+			DHD_ERROR(("%s: Error at  process msg of dmalen %d\n",
+				__FUNCTION__, cur_dma_len));
+			ret = BCME_ERROR;
+		}
+
+		len -= (uint16)cur_dma_len;
+		buf += cur_dma_len;
+	}
+	return ret;
+}
+
+static int BCMFASTPATH
+dhd_process_msgtype(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint8* buf, uint16 len)
+{
+	uint16 pktlen = len;
+	uint16 msglen;
+	uint8 msgtype;
+	cmn_msg_hdr_t *msg = NULL;
+	int ret = BCME_OK;
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	uint8 *buf_head = buf;
+#endif /* PCIE_D2H_SYNC_BZERO */
+
+	ASSERT(ring && ring->ringmem);
+	msglen = RING_LEN_ITEMS(ring);
+	if (msglen == 0) {
+		DHD_ERROR(("%s: ringidx %d, msglen is %d, pktlen is %d \n",
+			__FUNCTION__, ring->idx, msglen, pktlen));
+		return BCME_ERROR;
+	}
+
+	while (pktlen > 0) {
+		msg = (cmn_msg_hdr_t *)buf;
+
+#if defined(PCIE_D2H_SYNC)
+		/* Wait until DMA completes, then fetch msgtype */
+		msgtype = dhd->prot->d2h_sync_cb(dhd, ring, msg, msglen);
+#else
+		msgtype = msg->msg_type;
+#endif /* !PCIE_D2H_SYNC */
+
+		DHD_INFO(("%s: msgtype %d, msglen is %d, pktlen is %d\n", __FUNCTION__,
+			msgtype, msglen, pktlen));
+		if (msgtype == MSG_TYPE_LOOPBACK) {
+			bcm_print_bytes("LPBK RESP: ", (uint8 *)msg, msglen);
+			DHD_ERROR(("%s: MSG_TYPE_LOOPBACK, len %d\n", __FUNCTION__, msglen));
+		}
+
+
+		if (msgtype >= DHD_PROT_FUNCS) {
+			DHD_ERROR(("%s: msgtype %d, msglen is %d, pktlen is %d \n",
+				__FUNCTION__, msgtype, msglen, pktlen));
+			ret = BCME_ERROR;
+			goto done;
+		}
+
+		if (table_lookup[msgtype]) {
+			table_lookup[msgtype](dhd, buf, msglen);
+		}
+
+		if (pktlen < msglen) {
+			ret = BCME_ERROR;
+			goto done;
+		}
+		pktlen = pktlen - msglen;
+		buf = buf + msglen;
+
+		if (ring->idx == BCMPCIE_D2H_MSGRING_RX_COMPLETE)
+			prot_early_upd_rxcpln_read_idx(dhd, ring);
+	}
+done:
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	OSL_CACHE_FLUSH(buf_head, len - pktlen); /* Flush the bzeroed msg */
+#endif /* PCIE_D2H_SYNC_BZERO */
+
+#ifdef DHD_RX_CHAINING
+	dhd_rxchain_commit(dhd);
+#endif
+
+	return ret;
+}
+
+static void
+dhd_prot_noop(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	return;
+}
+
+static void
+dhd_prot_ringstatus_process(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	pcie_ring_status_t * ring_status = (pcie_ring_status_t *)buf;
+	DHD_ERROR(("%s: ring status: request_id %d, status 0x%04x, flow ring %d, w_offset %d \n",
+		__FUNCTION__,
+		ring_status->cmn_hdr.request_id, ring_status->compl_hdr.status,
+		ring_status->compl_hdr.flow_ring_id, ring_status->write_idx));
+	/* How do we track this to pair it with ??? */
+	return;
+}
+
+static void
+dhd_prot_genstatus_process(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	pcie_gen_status_t * gen_status = (pcie_gen_status_t *)buf;
+	DHD_ERROR(("%s: gen status: request_id %d, status 0x%04x, flow ring %d \n",
+		__FUNCTION__,
+		gen_status->cmn_hdr.request_id, gen_status->compl_hdr.status,
+		gen_status->compl_hdr.flow_ring_id));
+
+	/* How do we track this to pair it with ??? */
+	return;
+}
+
+static void
+dhd_prot_ioctack_process(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	ioctl_req_ack_msg_t * ioct_ack = (ioctl_req_ack_msg_t *)buf;
+
+	DHD_CTL(("%s: ioctl req ack: request_id %d, status 0x%04x, flow ring %d \n",
+		__FUNCTION__,
+		ioct_ack->cmn_hdr.request_id, ioct_ack->compl_hdr.status,
+		ioct_ack->compl_hdr.flow_ring_id));
+	if (ioct_ack->compl_hdr.status != 0)  {
+		DHD_ERROR(("%s: got an error status for the ioctl request...need to handle that\n",
+			__FUNCTION__));
+	}
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	memset(buf, 0, msglen);
+#endif /* PCIE_D2H_SYNC_BZERO */
+}
+
+static void
+dhd_prot_ioctcmplt_process(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	uint16 status;
+	uint32 resp_len = 0;
+	uint32 pkt_id, xt_id;
+	ioctl_comp_resp_msg_t * ioct_resp = (ioctl_comp_resp_msg_t *)buf;
+
+	resp_len = ltoh16(ioct_resp->resp_len);
+	xt_id = ltoh16(ioct_resp->trans_id);
+	pkt_id = ltoh32(ioct_resp->cmn_hdr.request_id);
+	status = ioct_resp->compl_hdr.status;
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	memset(buf, 0, msglen);
+#endif /* PCIE_D2H_SYNC_BZERO */
+
+	DHD_CTL(("%s: IOCTL_COMPLETE: pktid %x xtid %d status %x resplen %d\n", __FUNCTION__,
+		pkt_id, xt_id, status, resp_len));
+
+	dhd_bus_update_retlen(dhd->bus, sizeof(ioctl_comp_resp_msg_t), pkt_id, status, resp_len);
+	dhd_os_ioctl_resp_wake(dhd);
+}
+
+static void BCMFASTPATH
+dhd_prot_txstatus_process(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	dhd_prot_t *prot = dhd->prot;
+	host_txbuf_cmpl_t * txstatus;
+	unsigned long flags;
+	uint32 pktid;
+	void *pkt;
+	ulong pa;
+	uint32 pa_len;
+	void *secdma;
+	/* locks required to protect circular buffer accesses */
+	DHD_GENERAL_LOCK(dhd, flags);
+
+	txstatus = (host_txbuf_cmpl_t *)buf;
+	pktid = ltoh32(txstatus->cmn_hdr.request_id);
+
+	DHD_INFO(("%s: txstatus for pktid 0x%04x\n", __FUNCTION__, pktid));
+	if (prot->active_tx_count)
+		prot->active_tx_count--;
+	else
+		DHD_ERROR(("%s: Extra packets are freed\n", __FUNCTION__));
+
+	ASSERT(pktid != 0);
+	pkt = PKTID_TO_NATIVE(dhd->prot->pktid_map_handle, pktid, pa, pa_len, secdma);
+	if (pkt) {
+		if (SECURE_DMA_ENAB(dhd->osh)) {
+			int offset = 0;
+			BCM_REFERENCE(offset);
+
+			if (dhd->prot->tx_metadata_offset)
+				offset = dhd->prot->tx_metadata_offset + ETHER_HDR_LEN;
+				SECURE_DMA_UNMAP(dhd->osh, (uint) pa,
+				(uint) dhd->prot->tx_metadata_offset, DMA_RX, 0, 0,
+				secdma, offset);
+		} else
+			DMA_UNMAP(dhd->osh, pa, (uint) pa_len, DMA_RX, 0, dmah);
+
+#if defined(BCMPCIE)
+		dhd_txcomplete(dhd, pkt, true);
+#endif
+
+#if DHD_DBG_SHOW_METADATA
+		if (dhd->prot->tx_metadata_offset && txstatus->metadata_len) {
+			uchar *ptr;
+			/* The Ethernet header of TX frame was copied and removed.
+			 * Here, move the data pointer forward by Ethernet header size.
+			 */
+			PKTPULL(dhd->osh, pkt, ETHER_HDR_LEN);
+			ptr = PKTDATA(dhd->osh, pkt)  - (dhd->prot->tx_metadata_offset);
+			bcm_print_bytes("txmetadata", ptr, txstatus->metadata_len);
+			dhd_prot_print_metadata(dhd, ptr, txstatus->metadata_len);
+		}
+#endif /* DHD_DBG_SHOW_METADATA */
+		PKTFREE(dhd->osh, pkt, TRUE);
+	}
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	memset(buf, 0, msglen);
+#endif /* PCIE_D2H_SYNC_BZERO */
+
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return;
+}
+
+static void
+dhd_prot_event_process(dhd_pub_t *dhd, void* buf, uint16 len)
+{
+	wlevent_req_msg_t *evnt;
+	uint32 bufid;
+	uint16 buflen;
+	int ifidx = 0;
+	void* pkt;
+	unsigned long flags;
+	dhd_prot_t *prot = dhd->prot;
+	int post_cnt = 0;
+	bool zero_posted = FALSE;
+
+	/* Event complete header */
+	evnt = (wlevent_req_msg_t *)buf;
+	bufid = ltoh32(evnt->cmn_hdr.request_id);
+	buflen = ltoh16(evnt->event_data_len);
+
+	ifidx = BCMMSGBUF_API_IFIDX(&evnt->cmn_hdr);
+
+	/* Post another rxbuf to the device */
+	if (prot->cur_event_bufs_posted)
+		prot->cur_event_bufs_posted--;
+	else
+		zero_posted = TRUE;
+
+
+	post_cnt = dhd_msgbuf_rxbuf_post_event_bufs(dhd);
+	if (zero_posted && (post_cnt <= 0)) {
+		return;
+	}
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	memset(buf, 0, len);
+#endif /* PCIE_D2H_SYNC_BZERO */
+
+	/* locks required to protect pktid_map */
+	DHD_GENERAL_LOCK(dhd, flags);
+	pkt = dhd_prot_packet_get(dhd, ltoh32(bufid));
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	if (!pkt)
+		return;
+
+	/* DMA RX offset updated through shared area */
+	if (dhd->prot->rx_dataoffset)
+		PKTPULL(dhd->osh, pkt, dhd->prot->rx_dataoffset);
+
+	PKTSETLEN(dhd->osh, pkt, buflen);
+
+	dhd_bus_rx_frame(dhd->bus, pkt, ifidx, 1);
+}
+
+static void BCMFASTPATH
+dhd_prot_rxcmplt_process(dhd_pub_t *dhd, void* buf, uint16 msglen)
+{
+	host_rxbuf_cmpl_t *rxcmplt_h;
+	uint16 data_offset;             /* offset at which data starts */
+	void * pkt;
+	unsigned long flags;
+	static uint8 current_phase = 0;
+	uint ifidx;
+
+	/* RXCMPLT HDR */
+	rxcmplt_h = (host_rxbuf_cmpl_t *)buf;
+
+	/* Post another set of rxbufs to the device */
+	dhd_prot_return_rxbuf(dhd, 1);
+
+	/* offset from which data starts is populated in rxstatus0 */
+	data_offset = ltoh16(rxcmplt_h->data_offset);
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	pkt = dhd_prot_packet_get(dhd, ltoh32(rxcmplt_h->cmn_hdr.request_id));
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	if (!pkt) {
+		return;
+	}
+
+	DHD_INFO(("%s: id 0x%04x, offset %d, len %d, idx %d, phase 0x%02x, pktdata %p, metalen %d\n",
+		__FUNCTION__,
+		ltoh32(rxcmplt_h->cmn_hdr.request_id), data_offset, ltoh16(rxcmplt_h->data_len),
+		rxcmplt_h->cmn_hdr.if_id, rxcmplt_h->cmn_hdr.flags, PKTDATA(dhd->osh, pkt),
+		ltoh16(rxcmplt_h->metadata_len)));
+
+#if DHD_DBG_SHOW_METADATA
+	if (dhd->prot->rx_metadata_offset && rxcmplt_h->metadata_len) {
+		uchar *ptr;
+		ptr = PKTDATA(dhd->osh, pkt) - (dhd->prot->rx_metadata_offset);
+		/* header followed by data */
+		bcm_print_bytes("rxmetadata", ptr, rxcmplt_h->metadata_len);
+		dhd_prot_print_metadata(dhd, ptr, rxcmplt_h->metadata_len);
+	}
+#endif /* DHD_DBG_SHOW_METADATA */
+
+	if (current_phase !=  rxcmplt_h->cmn_hdr.flags) {
+		current_phase = rxcmplt_h->cmn_hdr.flags;
+	}
+	if (rxcmplt_h->flags & BCMPCIE_PKT_FLAGS_FRAME_802_11)
+		DHD_INFO(("%s: D11 frame rxed\n", __FUNCTION__));
+	/* data_offset from buf start */
+	if (data_offset) {
+		/* data offset given from dongle after split rx */
+		PKTPULL(dhd->osh, pkt, data_offset); /* data offset */
+	} else {
+		/* DMA RX offset updated through shared area */
+		if (dhd->prot->rx_dataoffset)
+			PKTPULL(dhd->osh, pkt, dhd->prot->rx_dataoffset);
+	}
+	/* Actual length of the packet */
+	PKTSETLEN(dhd->osh, pkt, ltoh16(rxcmplt_h->data_len));
+
+	ifidx = rxcmplt_h->cmn_hdr.if_id;
+
+#if defined(PCIE_D2H_SYNC_BZERO)
+	memset(buf, 0, msglen);
+#endif /* PCIE_D2H_SYNC_BZERO */
+
+#ifdef DHD_RX_CHAINING
+	/* Chain the packets */
+	dhd_rxchain_frame(dhd, pkt, ifidx);
+#else /* ! DHD_RX_CHAINING */
+	/* offset from which data starts is populated in rxstatus0 */
+	dhd_bus_rx_frame(dhd->bus, pkt, ifidx, 1);
+#endif /* ! DHD_RX_CHAINING */
+
+}
+
+/* Stop protocol: sync w/dongle state. */
+void dhd_prot_stop(dhd_pub_t *dhd)
+{
+	/* nothing to do for pcie */
+}
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+void BCMFASTPATH
+dhd_prot_hdrpush(dhd_pub_t *dhd, int ifidx, void *PKTBUF)
+{
+	return;
+}
+
+uint
+dhd_prot_hdrlen(dhd_pub_t *dhd, void *PKTBUF)
+{
+	return 0;
+}
+
+
+#define PKTBUF pktbuf
+
+int BCMFASTPATH
+dhd_prot_txdata(dhd_pub_t *dhd, void *PKTBUF, uint8 ifidx)
+{
+	unsigned long flags;
+	dhd_prot_t *prot = dhd->prot;
+	host_txbuf_post_t *txdesc = NULL;
+	dmaaddr_t physaddr, meta_physaddr;
+	uint8 *pktdata;
+	uint32 pktlen;
+	uint32 pktid;
+	uint8	prio;
+	uint16 flowid = 0;
+	uint16 alloced = 0;
+	uint16	headroom;
+
+	msgbuf_ring_t *msg_ring;
+	uint8 dhcp_pkt;
+
+	if (!dhd->flow_ring_table)
+		return BCME_NORESOURCE;
+
+	if (!dhd_bus_is_txmode_push(dhd->bus)) {
+		flow_ring_table_t *flow_ring_table;
+		flow_ring_node_t *flow_ring_node;
+
+		flowid = (uint16)DHD_PKTTAG_FLOWID((dhd_pkttag_fr_t*)PKTTAG(PKTBUF));
+
+		flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+		flow_ring_node = (flow_ring_node_t *)&flow_ring_table[flowid];
+
+		msg_ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+	} else {
+		msg_ring = prot->h2dring_txp_subn;
+	}
+
+
+
+	DHD_GENERAL_LOCK(dhd, flags);
+
+	/* Create a unique 32-bit packet id */
+	pktid = NATIVE_TO_PKTID_RSV(dhd->prot->pktid_map_handle, PKTBUF);
+	if (pktid == DHD_PKTID_INVALID) {
+		DHD_ERROR(("%s: Pktid pool depleted.\n", __FUNCTION__));
+		/*
+		 * If we return error here, the caller would queue the packet
+		 * again. So we'll just free the skb allocated in DMA Zone.
+		 * Since we have not freed the original SKB yet the caller would
+		 * requeue the same.
+		 */
+		goto err_no_res_pktfree;
+	}
+
+	/* Reserve space in the circular buffer */
+	txdesc = (host_txbuf_post_t *)dhd_alloc_ring_space(dhd,
+		msg_ring, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+	if (txdesc == NULL) {
+		void *secdma;
+		DHD_INFO(("%s:%d: HTOD Msgbuf Not available TxCount = %d\n",
+			__FUNCTION__, __LINE__, prot->active_tx_count));
+		/* Free up the PKTID */
+		PKTID_TO_NATIVE(dhd->prot->pktid_map_handle, pktid, physaddr,
+			pktlen, secdma);
+		goto err_no_res_pktfree;
+	}
+
+	/* test if dhcp pkt */
+	dhcp_pkt = pkt_is_dhcp(dhd->osh, PKTBUF);
+	txdesc->flag2 = (txdesc->flag2 & ~(BCMPCIE_PKT_FLAGS2_FORCELOWRATE_MASK <<
+		BCMPCIE_PKT_FLAGS2_FORCELOWRATE_SHIFT)) | ((dhcp_pkt &
+		BCMPCIE_PKT_FLAGS2_FORCELOWRATE_MASK) << BCMPCIE_PKT_FLAGS2_FORCELOWRATE_SHIFT);
+
+	/* Extract the data pointer and length information */
+	pktdata = PKTDATA(dhd->osh, PKTBUF);
+	pktlen  = PKTLEN(dhd->osh, PKTBUF);
+
+	/* Ethernet header: Copy before we cache flush packet using DMA_MAP */
+	bcopy(pktdata, txdesc->txhdr, ETHER_HDR_LEN);
+
+	/* Extract the ethernet header and adjust the data pointer and length */
+	pktdata = PKTPULL(dhd->osh, PKTBUF, ETHER_HDR_LEN);
+	pktlen -= ETHER_HDR_LEN;
+
+	/* Map the data pointer to a DMA-able address */
+	if (SECURE_DMA_ENAB(dhd->osh)) {
+
+		int offset = 0;
+		BCM_REFERENCE(offset);
+
+		if (prot->tx_metadata_offset)
+			offset = prot->tx_metadata_offset + ETHER_HDR_LEN;
+
+		physaddr = SECURE_DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF), pktlen,
+			DMA_TX, PKTBUF, 0, msg_ring->secdma, offset);
+	} else
+	physaddr = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF), pktlen, DMA_TX, PKTBUF, 0);
+
+	if ((PHYSADDRHI(physaddr) == 0) && (PHYSADDRLO(physaddr) == 0)) {
+		DHD_ERROR(("%s: Something really bad, unless 0 is a valid phyaddr\n", __FUNCTION__));
+		ASSERT(0);
+	}
+
+	/* No need to lock. Save the rest of the packet's metadata */
+	NATIVE_TO_PKTID_SAVE(dhd->prot->pktid_map_handle, PKTBUF, pktid,
+	                     physaddr, pktlen, DMA_TX, msg_ring->secdma);
+
+#ifdef TXP_FLUSH_NITEMS
+	if (msg_ring->pend_items_count == 0)
+		msg_ring->start_addr = (void *)txdesc;
+	msg_ring->pend_items_count++;
+#endif
+
+	/* Form the Tx descriptor message buffer */
+
+	/* Common message hdr */
+	txdesc->cmn_hdr.msg_type = MSG_TYPE_TX_POST;
+	txdesc->cmn_hdr.request_id = htol32(pktid);
+	txdesc->cmn_hdr.if_id = ifidx;
+	txdesc->flags = BCMPCIE_PKT_FLAGS_FRAME_802_3;
+	prio = (uint8)PKTPRIO(PKTBUF);
+
+
+	txdesc->flags |= (prio & 0x7) << BCMPCIE_PKT_FLAGS_PRIO_SHIFT;
+	txdesc->seg_cnt = 1;
+
+	txdesc->data_len = htol16((uint16)pktlen);
+	txdesc->data_buf_addr.high_addr = htol32(PHYSADDRHI(physaddr));
+	txdesc->data_buf_addr.low_addr  = htol32(PHYSADDRLO(physaddr));
+
+	/* Move data pointer to keep ether header in local PKTBUF for later reference */
+	PKTPUSH(dhd->osh, PKTBUF, ETHER_HDR_LEN);
+
+	/* Handle Tx metadata */
+	headroom = (uint16)PKTHEADROOM(dhd->osh, PKTBUF);
+	if (prot->tx_metadata_offset && (headroom < prot->tx_metadata_offset))
+		DHD_ERROR(("%s: No headroom for Metadata tx %d %d\n", __FUNCTION__,
+		prot->tx_metadata_offset, headroom));
+
+	if (prot->tx_metadata_offset && (headroom >= prot->tx_metadata_offset)) {
+		DHD_TRACE(("%s: Metadata in tx %d\n", __FUNCTION__, prot->tx_metadata_offset));
+
+		/* Adjust the data pointer to account for meta data in DMA_MAP */
+		PKTPUSH(dhd->osh, PKTBUF, prot->tx_metadata_offset);
+	if (SECURE_DMA_ENAB(dhd->osh)) {
+		meta_physaddr = SECURE_DMA_MAP_TXMETA(dhd->osh, PKTDATA(dhd->osh, PKTBUF),
+			prot->tx_metadata_offset + ETHER_HDR_LEN, DMA_RX, PKTBUF,
+			0, msg_ring->secdma);
+	} else
+		meta_physaddr = DMA_MAP(dhd->osh, PKTDATA(dhd->osh, PKTBUF),
+			prot->tx_metadata_offset, DMA_RX, PKTBUF, 0);
+
+		if (PHYSADDRISZERO(meta_physaddr)) {
+			DHD_ERROR(("%s: Something really bad, unless 0 is a valid phyaddr\n", __FUNCTION__));
+			ASSERT(0);
+		}
+
+		/* Adjust the data pointer back to original value */
+		PKTPULL(dhd->osh, PKTBUF, prot->tx_metadata_offset);
+
+		txdesc->metadata_buf_len = prot->tx_metadata_offset;
+		txdesc->metadata_buf_addr.high_addr = htol32(PHYSADDRHI(meta_physaddr));
+		txdesc->metadata_buf_addr.low_addr = htol32(PHYSADDRLO(meta_physaddr));
+	}
+	else {
+		txdesc->metadata_buf_len = htol16(0);
+		txdesc->metadata_buf_addr.high_addr = 0;
+		txdesc->metadata_buf_addr.low_addr = 0;
+	}
+
+
+	DHD_TRACE(("%s: txpost: data_len %d, pktid 0x%04x\n", __FUNCTION__, txdesc->data_len,
+		txdesc->cmn_hdr.request_id));
+
+	/* Update the write pointer in TCM & ring bell */
+#ifdef TXP_FLUSH_NITEMS
+	/* Flush if we have either hit the txp_threshold or if this msg is */
+	/* occupying the last slot in the flow_ring - before wrap around.  */
+	if ((msg_ring->pend_items_count == prot->txp_threshold) ||
+		((uint8 *) txdesc == (uint8 *) HOST_RING_END(msg_ring))) {
+		dhd_prot_txdata_write_flush(dhd, flowid, TRUE);
+	}
+#else
+	prot_ring_write_complete(dhd, msg_ring, txdesc, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+#endif
+
+	prot->active_tx_count++;
+
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return BCME_OK;
+
+err_no_res_pktfree:
+
+
+
+	DHD_GENERAL_UNLOCK(dhd, flags);
+	return BCME_NORESOURCE;
+
+}
+
+/* called with a lock */
+void BCMFASTPATH
+dhd_prot_txdata_write_flush(dhd_pub_t *dhd, uint16 flowid, bool in_lock)
+{
+#ifdef TXP_FLUSH_NITEMS
+	unsigned long flags = 0;
+	flow_ring_table_t *flow_ring_table;
+	flow_ring_node_t *flow_ring_node;
+	msgbuf_ring_t *msg_ring;
+
+	if (!dhd->flow_ring_table)
+		return;
+
+	if (!in_lock) {
+		DHD_GENERAL_LOCK(dhd, flags);
+	}
+
+	flow_ring_table = (flow_ring_table_t *)dhd->flow_ring_table;
+	flow_ring_node = (flow_ring_node_t *)&flow_ring_table[flowid];
+	msg_ring = (msgbuf_ring_t *)flow_ring_node->prot_info;
+
+	/* Update the write pointer in TCM & ring bell */
+	if (msg_ring->pend_items_count) {
+		prot_ring_write_complete(dhd, msg_ring, msg_ring->start_addr,
+			msg_ring->pend_items_count);
+		msg_ring->pend_items_count = 0;
+		msg_ring->start_addr = NULL;
+	}
+
+	if (!in_lock) {
+		DHD_GENERAL_UNLOCK(dhd, flags);
+	}
+#endif /* TXP_FLUSH_NITEMS */
+}
+
+#undef PKTBUF	/* Only defined in the above routine */
+int BCMFASTPATH
+dhd_prot_hdrpull(dhd_pub_t *dhd, int *ifidx, void *pkt, uchar *buf, uint *len)
+{
+	return 0;
+}
+
+static void BCMFASTPATH
+dhd_prot_return_rxbuf(dhd_pub_t *dhd, uint16 rxcnt)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	if (prot->rxbufpost >= rxcnt) {
+		prot->rxbufpost -= rxcnt;
+	} else {
+		/* ASSERT(0); */
+		prot->rxbufpost = 0;
+	}
+
+	if (prot->rxbufpost <= (prot->max_rxbufpost - RXBUFPOST_THRESHOLD))
+		dhd_msgbuf_rxbuf_post(dhd);
+
+	return;
+}
+
+
+
+/* Use protocol to issue ioctl to dongle */
+int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len)
+{
+	dhd_prot_t *prot = dhd->prot;
+	int ret = -1;
+	uint8 action;
+
+	if ((dhd->busstate == DHD_BUS_DOWN) || dhd->hang_was_sent) {
+		DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+		goto done;
+	}
+
+	if (dhd->busstate == DHD_BUS_SUSPEND) {
+		DHD_ERROR(("%s : bus is suspended\n", __FUNCTION__));
+		goto done;
+	}
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(len <= WLC_IOCTL_MAXLEN);
+
+	if (len > WLC_IOCTL_MAXLEN)
+		goto done;
+
+	if (prot->pending == TRUE) {
+		DHD_ERROR(("%s: packet is pending!!!! cmd=0x%x (%lu) lastcmd=0x%x (%lu)\n",
+			__FUNCTION__,
+			ioc->cmd, (unsigned long)ioc->cmd, prot->lastcmd,
+			(unsigned long)prot->lastcmd));
+		if ((ioc->cmd == WLC_SET_VAR) || (ioc->cmd == WLC_GET_VAR)) {
+			DHD_TRACE(("iovar cmd=%s\n", (char*)buf));
+		}
+		goto done;
+	}
+
+	prot->pending = TRUE;
+	prot->lastcmd = ioc->cmd;
+	action = ioc->set;
+
+
+	if (action & WL_IOCTL_ACTION_SET) {
+		ret = dhd_msgbuf_set_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+	} else {
+		ret = dhdmsgbuf_query_ioctl(dhd, ifidx, ioc->cmd, buf, len, action);
+		if (ret > 0)
+			ioc->used = ret;
+	}
+	/* Too many programs assume ioctl() returns 0 on success */
+	if (ret >= 0)
+		ret = 0;
+	else {
+		DHD_ERROR(("%s: status ret value is %d \n", __FUNCTION__, ret));
+		dhd->dongle_error = ret;
+	}
+
+	/* Intercept the wme_dp ioctl here */
+	if ((!ret) && (ioc->cmd == WLC_SET_VAR) && (!strcmp(buf, "wme_dp"))) {
+		int slen, val = 0;
+
+		slen = strlen("wme_dp") + 1;
+		if (len >= (int)(slen + sizeof(int)))
+			bcopy(((char *)buf + slen), &val, sizeof(int));
+		dhd->wme_dp = (uint8) ltoh32(val);
+	}
+
+
+	prot->pending = FALSE;
+
+done:
+	return ret;
+
+}
+
+int
+dhdmsgbuf_lpbk_req(dhd_pub_t *dhd, uint len)
+{
+	unsigned long flags;
+	dhd_prot_t *prot = dhd->prot;
+	uint16 alloced = 0;
+
+	ioct_reqst_hdr_t *ioct_rqst;
+
+	uint16 hdrlen = sizeof(ioct_reqst_hdr_t);
+	uint16 msglen = len + hdrlen;
+
+
+	if (msglen  > MSGBUF_MAX_MSG_SIZE)
+		msglen = MSGBUF_MAX_MSG_SIZE;
+
+	msglen = align(msglen, DMA_ALIGN_LEN);
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	ioct_rqst = (ioct_reqst_hdr_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+
+	if (ioct_rqst == NULL) {
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		return 0;
+	}
+
+	{
+		uint8 *ptr;
+		uint16 i;
+
+		ptr = (uint8 *)ioct_rqst;
+		for (i = 0; i < msglen; i++) {
+			ptr[i] = i % 256;
+		}
+	}
+
+
+	/* Common msg buf hdr */
+	ioct_rqst->msg.msg_type = MSG_TYPE_LOOPBACK;
+	ioct_rqst->msg.if_id = 0;
+
+	bcm_print_bytes("LPBK REQ: ", (uint8 *)ioct_rqst, msglen);
+
+	/* Update the write pointer in TCM & ring bell */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, ioct_rqst,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return 0;
+}
+
+void dmaxfer_free_dmaaddr(dhd_pub_t *dhd, dhd_dmaxfer_t *dma)
+{
+	if (dma == NULL)
+		return;
+
+	if (dma->srcmem.va) {
+		DMA_FREE_CONSISTENT(dhd->osh, dma->srcmem.va,
+			dma->len, dma->srcmem.pa, dma->srcmem.dmah);
+		dma->srcmem.va = NULL;
+	}
+	if (dma->destmem.va) {
+		DMA_FREE_CONSISTENT(dhd->osh, dma->destmem.va,
+			dma->len + 8, dma->destmem.pa, dma->destmem.dmah);
+		dma->destmem.va = NULL;
+	}
+}
+
+int dmaxfer_prepare_dmaaddr(dhd_pub_t *dhd, uint len,
+	uint srcdelay, uint destdelay, dhd_dmaxfer_t *dma)
+{
+	uint i;
+
+	if (!dma)
+		return BCME_ERROR;
+
+	/* First free up exisiting buffers */
+	dmaxfer_free_dmaaddr(dhd, dma);
+
+	dma->srcmem.va = DMA_ALLOC_CONSISTENT(dhd->osh, len, DMA_ALIGN_LEN,
+	&i, &dma->srcmem.pa, &dma->srcmem.dmah);
+	if (dma->srcmem.va ==  NULL) {
+		return BCME_NOMEM;
+	}
+
+	/* Populate source with a pattern */
+	for (i = 0; i < len; i++) {
+		((uint8*)dma->srcmem.va)[i] = i % 256;
+	}
+	OSL_CACHE_FLUSH(dma->srcmem.va, len);
+
+	dma->destmem.va = DMA_ALLOC_CONSISTENT(dhd->osh, len + 8, DMA_ALIGN_LEN,
+	&i, &dma->destmem.pa, &dma->destmem.dmah);
+	if (dma->destmem.va ==  NULL) {
+		DMA_FREE_CONSISTENT(dhd->osh, dma->srcmem.va,
+			dma->len, dma->srcmem.pa, dma->srcmem.dmah);
+		dma->srcmem.va = NULL;
+		return BCME_NOMEM;
+	}
+
+
+	/* Clear the destination buffer */
+	bzero(dma->destmem.va, len +8);
+	OSL_CACHE_FLUSH(dma->destmem.va, len+8);
+
+	dma->len = len;
+	dma->srcdelay = srcdelay;
+	dma->destdelay = destdelay;
+
+	return BCME_OK;
+}
+
+static void
+dhdmsgbuf_dmaxfer_compare(dhd_pub_t *dhd, void * buf, uint16 msglen)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	OSL_CACHE_INV(prot->dmaxfer.destmem.va, prot->dmaxfer.len);
+	if (prot->dmaxfer.srcmem.va && prot->dmaxfer.destmem.va) {
+		if (memcmp(prot->dmaxfer.srcmem.va,
+			prot->dmaxfer.destmem.va,
+			prot->dmaxfer.len)) {
+			bcm_print_bytes("XFER SRC: ",
+				prot->dmaxfer.srcmem.va, prot->dmaxfer.len);
+			bcm_print_bytes("XFER DEST: ",
+				prot->dmaxfer.destmem.va, prot->dmaxfer.len);
+		}
+		else {
+			DHD_INFO(("%s: DMA successful\n", __FUNCTION__));
+		}
+	}
+	dmaxfer_free_dmaaddr(dhd, &prot->dmaxfer);
+	dhd->prot->dmaxfer_in_progress = FALSE;
+}
+
+int
+dhdmsgbuf_dmaxfer_req(dhd_pub_t *dhd, uint len, uint srcdelay, uint destdelay)
+{
+	unsigned long flags;
+	int ret = BCME_OK;
+	dhd_prot_t *prot = dhd->prot;
+	pcie_dma_xfer_params_t *dmap;
+	uint32 xferlen = len > DMA_XFER_LEN_LIMIT ? DMA_XFER_LEN_LIMIT : len;
+	uint16 msglen = sizeof(pcie_dma_xfer_params_t);
+	uint16 alloced = 0;
+
+	if (prot->dmaxfer_in_progress) {
+		DHD_ERROR(("%s: DMA is in progress...\n", __FUNCTION__));
+		return ret;
+	}
+	prot->dmaxfer_in_progress = TRUE;
+	if ((ret = dmaxfer_prepare_dmaaddr(dhd, xferlen, srcdelay, destdelay,
+		&prot->dmaxfer)) != BCME_OK) {
+		prot->dmaxfer_in_progress = FALSE;
+		return ret;
+	}
+
+
+	if (msglen  > MSGBUF_MAX_MSG_SIZE)
+		msglen = MSGBUF_MAX_MSG_SIZE;
+
+	msglen = align(msglen, DMA_ALIGN_LEN);
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	dmap = (pcie_dma_xfer_params_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+
+	if (dmap == NULL) {
+		dmaxfer_free_dmaaddr(dhd, &prot->dmaxfer);
+		prot->dmaxfer_in_progress = FALSE;
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		return BCME_NOMEM;
+	}
+
+	/* Common msg buf hdr */
+	dmap->cmn_hdr.msg_type = MSG_TYPE_LPBK_DMAXFER;
+	dmap->cmn_hdr.request_id = 0x1234;
+
+	dmap->host_input_buf_addr.high = htol32(PHYSADDRHI(prot->dmaxfer.srcmem.pa));
+	dmap->host_input_buf_addr.low = htol32(PHYSADDRLO(prot->dmaxfer.srcmem.pa));
+	dmap->host_ouput_buf_addr.high = htol32(PHYSADDRHI(prot->dmaxfer.destmem.pa));
+	dmap->host_ouput_buf_addr.low = htol32(PHYSADDRLO(prot->dmaxfer.destmem.pa));
+	dmap->xfer_len = htol32(prot->dmaxfer.len);
+	dmap->srcdelay = htol32(prot->dmaxfer.srcdelay);
+	dmap->destdelay = htol32(prot->dmaxfer.destdelay);
+
+	/* Update the write pointer in TCM & ring bell */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, dmap,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	DHD_ERROR(("%s: DMA Started...\n", __FUNCTION__));
+
+	return BCME_OK;
+}
+
+static int
+dhdmsgbuf_query_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	int ret = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Respond "bcmerror" and "bcmerrorstr" with local cache */
+	if (cmd == WLC_GET_VAR && buf)
+	{
+		if (!strcmp((char *)buf, "bcmerrorstr"))
+		{
+			strncpy((char *)buf, bcmerrorstr(dhd->dongle_error), BCME_STRLEN);
+			goto done;
+		}
+		else if (!strcmp((char *)buf, "bcmerror"))
+		{
+			*(int *)buf = dhd->dongle_error;
+			goto done;
+		}
+	}
+
+	ret = dhd_fillup_ioct_reqst_ptrbased(dhd, (uint16)len, cmd, buf, ifidx);
+	if (ret < 0) {
+		DHD_ERROR(("%s : dhd_fillup_ioct_reqst_ptrbased error : %d\n", __FUNCTION__, ret));
+		return ret;
+	}
+
+	DHD_INFO(("%s: ACTION %d ifdix %d cmd %d len %d \n", __FUNCTION__,
+		action, ifidx, cmd, len));
+
+	/* wait for interrupt and get first fragment */
+	ret = dhdmsgbuf_cmplt(dhd, prot->reqid, len, buf, prot->retbuf.va);
+
+done:
+	return ret;
+}
+static int
+dhdmsgbuf_cmplt(dhd_pub_t *dhd, uint32 id, uint32 len, void* buf, void* retbuf)
+{
+	dhd_prot_t *prot = dhd->prot;
+	ioctl_comp_resp_msg_t  ioct_resp;
+	void* pkt;
+	int retlen;
+	int msgbuf_len = 0;
+	int post_cnt = 0;
+	unsigned long flags;
+	bool zero_posted = FALSE;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: bus is already down.\n", __FUNCTION__));
+		return -1;
+	}
+
+	if (prot->cur_ioctlresp_bufs_posted)
+		prot->cur_ioctlresp_bufs_posted--;
+	else
+		zero_posted = TRUE;
+
+	post_cnt = dhd_msgbuf_rxbuf_post_ioctlresp_bufs(dhd);
+	if (zero_posted && (post_cnt <= 0)) {
+		return -1;
+	}
+
+	memset(&ioct_resp, 0, sizeof(ioctl_comp_resp_msg_t));
+
+	retlen = dhd_bus_rxctl(dhd->bus, (uchar*)&ioct_resp, msgbuf_len);
+	if (retlen <= 0) {
+		DHD_ERROR(("%s: IOCTL request failed with error code %d\n", __FUNCTION__, retlen));
+		return retlen;
+	}
+	DHD_INFO(("%s: ioctl resp retlen %d status %d, resp_len %d, pktid %d\n", __FUNCTION__,
+		retlen, ioct_resp.compl_hdr.status, ioct_resp.resp_len,
+		ioct_resp.cmn_hdr.request_id));
+	if (ioct_resp.resp_len != 0) {
+		DHD_GENERAL_LOCK(dhd, flags);
+		pkt = dhd_prot_packet_get(dhd, ioct_resp.cmn_hdr.request_id);
+		DHD_GENERAL_UNLOCK(dhd, flags);
+
+		DHD_INFO(("%s: ioctl ret buf %p retlen %d status %x\n", __FUNCTION__, pkt, retlen,
+			ioct_resp.compl_hdr.status));
+		/* get ret buf */
+		if ((buf) && (pkt)) {
+			/* bcopy(PKTDATA(dhd->osh, pkt), buf, ioct_resp.resp_len); */
+			/* ioct_resp.resp_len could have been changed to make it > 8 bytes */
+			bcopy(PKTDATA(dhd->osh, pkt), buf, len);
+		}
+		if (pkt) {
+			PKTFREE(dhd->osh, pkt, FALSE);
+		}
+	} else {
+		DHD_GENERAL_LOCK(dhd, flags);
+		dhd_prot_packet_free(dhd, ioct_resp.cmn_hdr.request_id);
+		DHD_GENERAL_UNLOCK(dhd, flags);
+	}
+
+	return (int)(ioct_resp.compl_hdr.status);
+}
+static int
+dhd_msgbuf_set_ioctl(dhd_pub_t *dhd, int ifidx, uint cmd, void *buf, uint len, uint8 action)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	int ret = 0;
+
+	DHD_TRACE(("%s: Enter \n", __FUNCTION__));
+	DHD_TRACE(("%s: cmd %d len %d\n", __FUNCTION__, cmd, len));
+
+	if (dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+		return -EIO;
+	}
+
+	/* don't talk to the dongle if fw is about to be reloaded */
+	if (dhd->hang_was_sent) {
+		DHD_ERROR(("%s: HANG was sent up earlier. Not talking to the chip\n",
+			__FUNCTION__));
+		return -EIO;
+	}
+
+	/* Fill up msgbuf for ioctl req */
+	ret = dhd_fillup_ioct_reqst_ptrbased(dhd, (uint16)len, cmd, buf, ifidx);
+	if (ret < 0) {
+		DHD_ERROR(("%s : dhd_fillup_ioct_reqst_ptrbased error : %d\n", __FUNCTION__, ret));
+		return ret;
+	}
+
+	DHD_INFO(("%s: ACTIOn %d ifdix %d cmd %d len %d \n", __FUNCTION__,
+		action, ifidx, cmd, len));
+
+	ret = dhdmsgbuf_cmplt(dhd, prot->reqid, len, buf, prot->retbuf.va);
+
+	return ret;
+}
+/* Handles a protocol control response asynchronously */
+int dhd_prot_ctl_complete(dhd_pub_t *dhd)
+{
+	return 0;
+}
+
+/* Check for and handle local prot-specific iovar commands */
+int dhd_prot_iovar_op(dhd_pub_t *dhd, const char *name,
+                             void *params, int plen, void *arg, int len, bool set)
+{
+	return BCME_UNSUPPORTED;
+}
+
+/* Add prot dump output to a buffer */
+void dhd_prot_dump(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+#if defined(PCIE_D2H_SYNC)
+	if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_SEQNUM)
+		bcm_bprintf(strbuf, "\nd2h_sync: SEQNUM:");
+	else if (dhd->d2h_sync_mode & PCIE_SHARED_D2H_SYNC_XORCSUM)
+		bcm_bprintf(strbuf, "\nd2h_sync: XORCSUM:");
+	else
+		bcm_bprintf(strbuf, "\nd2h_sync: NONE:");
+	bcm_bprintf(strbuf, " d2h_sync_wait max<%lu> tot<%lu>\n",
+	            dhd->prot->d2h_sync_wait_max, dhd->prot->d2h_sync_wait_tot);
+#endif  /* PCIE_D2H_SYNC */
+}
+
+/* Update local copy of dongle statistics */
+void dhd_prot_dstats(dhd_pub_t *dhd)
+{
+		return;
+}
+
+int dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf,
+	uint reorder_info_len, void **pkt, uint32 *free_buf_count)
+{
+	return 0;
+}
+/* post a dummy message to interrupt dongle */
+/* used to process cons commands */
+int
+dhd_post_dummy_msg(dhd_pub_t *dhd)
+{
+	unsigned long flags;
+	hostevent_hdr_t *hevent = NULL;
+	uint16 alloced = 0;
+
+	dhd_prot_t *prot = dhd->prot;
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	hevent = (hostevent_hdr_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+
+	if (hevent == NULL) {
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		return -1;
+	}
+
+	/* CMN msg header */
+	hevent->msg.msg_type = MSG_TYPE_HOST_EVNT;
+	hevent->msg.if_id = 0;
+
+	/* Event payload */
+	hevent->evnt_pyld = htol32(HOST_EVENT_CONS_CMD);
+
+	/* Since, we are filling the data directly into the bufptr obtained
+	 * from the msgbuf, we can directly call the write_complete
+	 */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, hevent,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return 0;
+}
+
+static void * BCMFASTPATH
+dhd_alloc_ring_space(dhd_pub_t *dhd, msgbuf_ring_t *ring, uint16 nitems, uint16 * alloced)
+{
+	void * ret_buf;
+	uint16 r_index = 0;
+
+	/* Alloc space for nitems in the ring */
+	ret_buf = prot_get_ring_space(ring, nitems, alloced);
+
+	if (ret_buf == NULL) {
+		/* if alloc failed , invalidate cached read ptr */
+		if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+			r_index = dhd_get_dmaed_index(dhd, H2D_DMA_READINDX, ring->idx);
+			ring->ringstate->r_offset = r_index;
+		} else
+			dhd_bus_cmn_readshared(dhd->bus, &(RING_READ_PTR(ring)),
+				RING_READ_PTR, ring->idx);
+
+		/* Try allocating once more */
+		ret_buf = prot_get_ring_space(ring, nitems, alloced);
+
+		if (ret_buf == NULL) {
+			DHD_INFO(("%s: RING space not available on ring %s for %d items \n", __FUNCTION__,
+				ring->name, nitems));
+			DHD_INFO(("%s: write %d read %d \n\n", __FUNCTION__, RING_WRITE_PTR(ring),
+				RING_READ_PTR(ring)));
+			return NULL;
+		}
+	}
+
+	/* Return alloced space */
+	return ret_buf;
+}
+
+#define DHD_IOCTL_REQ_PKTID	0xFFFE
+
+/* Non inline ioct request */
+/* Form a ioctl request first as per ioctptr_reqst_hdr_t header in the circular buffer */
+/* Form a separate request buffer where a 4 byte cmn header is added in the front */
+/* buf contents from parent function is copied to remaining section of this buffer */
+static int
+dhd_fillup_ioct_reqst_ptrbased(dhd_pub_t *dhd, uint16 len, uint cmd, void* buf, int ifidx)
+{
+	dhd_prot_t *prot = dhd->prot;
+	ioctl_req_msg_t *ioct_rqst;
+	void * ioct_buf;	/* For ioctl payload */
+	uint16  rqstlen, resplen;
+	unsigned long flags;
+	uint16 alloced = 0;
+
+	rqstlen = len;
+	resplen = len;
+
+	/* Limit ioct request to MSGBUF_MAX_MSG_SIZE bytes including hdrs */
+	/* 8K allocation of dongle buffer fails */
+	/* dhd doesnt give separate input & output buf lens */
+	/* so making the assumption that input length can never be more than 1.5k */
+	rqstlen = MIN(rqstlen, MSGBUF_MAX_MSG_SIZE);
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	/* Request for cbuf space */
+	ioct_rqst = (ioctl_req_msg_t*)dhd_alloc_ring_space(dhd, prot->h2dring_ctrl_subn,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D,	&alloced);
+	if (ioct_rqst == NULL) {
+		DHD_ERROR(("%s: couldn't allocate space on msgring to send ioctl request\n", __FUNCTION__));
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		return -1;
+	}
+
+	/* Common msg buf hdr */
+	ioct_rqst->cmn_hdr.msg_type = MSG_TYPE_IOCTLPTR_REQ;
+	ioct_rqst->cmn_hdr.if_id = (uint8)ifidx;
+	ioct_rqst->cmn_hdr.flags = 0;
+	ioct_rqst->cmn_hdr.request_id = DHD_IOCTL_REQ_PKTID;
+
+	ioct_rqst->cmd = htol32(cmd);
+	ioct_rqst->output_buf_len = htol16(resplen);
+	ioct_rqst->trans_id = prot->ioctl_trans_id ++;
+
+	/* populate ioctl buffer info */
+	ioct_rqst->input_buf_len = htol16(rqstlen);
+	ioct_rqst->host_input_buf_addr.high = htol32(PHYSADDRHI(prot->ioctbuf.pa));
+	ioct_rqst->host_input_buf_addr.low = htol32(PHYSADDRLO(prot->ioctbuf.pa));
+	/* copy ioct payload */
+	ioct_buf = (void *) prot->ioctbuf.va;
+
+	if (buf)
+		memcpy(ioct_buf, buf, len);
+
+	OSL_CACHE_FLUSH((void *) prot->ioctbuf.va, len);
+
+	if ((ulong)ioct_buf % DMA_ALIGN_LEN)
+		DHD_ERROR(("%s: host ioct address unaligned !!!!! \n", __FUNCTION__));
+
+	DHD_CTL(("%s: submitted IOCTL request request_id %d, cmd %d, output_buf_len %d, tx_id %d\n",
+		__FUNCTION__,
+		ioct_rqst->cmn_hdr.request_id, cmd, ioct_rqst->output_buf_len,
+		ioct_rqst->trans_id));
+
+	/* upd wrt ptr and raise interrupt */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, ioct_rqst,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return 0;
+}
+
+/* Packet to PacketID mapper */
+typedef struct {
+	ulong native;
+	dmaaddr_t pa;
+	uint32 pa_len;
+	uchar dma;
+} pktid_t;
+
+typedef struct {
+	void	*osh;
+	void	*mwbmap_hdl;
+	pktid_t *pktid_list;
+	uint32	count;
+} pktid_map_t;
+
+
+void *pktid_map_init(void *osh, uint32 count)
+{
+	pktid_map_t *handle;
+
+	handle = (pktid_map_t *) MALLOC(osh, sizeof(pktid_map_t));
+	if (handle == NULL) {
+		printf("%s:%d: MALLOC failed for size %d\n",
+			__FUNCTION__, __LINE__, (uint32) sizeof(pktid_map_t));
+		return NULL;
+	}
+	handle->osh = osh;
+	handle->count = count;
+	handle->mwbmap_hdl = bcm_mwbmap_init(osh, count);
+	if (handle->mwbmap_hdl == NULL) {
+		printf("%s:%d: bcm_mwbmap_init failed for count %d\n",
+			__FUNCTION__, __LINE__, count);
+		MFREE(osh, handle, sizeof(pktid_map_t));
+		return NULL;
+	}
+
+	handle->pktid_list = (pktid_t *) MALLOC(osh, sizeof(pktid_t) * (count+1));
+	if (handle->pktid_list == NULL) {
+		printf("%s:%d: MALLOC failed for count %d / total = %d\n",
+			__FUNCTION__, __LINE__, count, (uint32) sizeof(pktid_t) * count);
+		bcm_mwbmap_fini(osh, handle->mwbmap_hdl);
+		MFREE(osh, handle, sizeof(pktid_map_t));
+		return NULL;
+	}
+
+	return handle;
+}
+
+void
+pktid_map_uninit(void *pktid_map_handle)
+{
+	pktid_map_t *handle = (pktid_map_t *) pktid_map_handle;
+	uint32 ix;
+
+	if (handle != NULL) {
+		void *osh = handle->osh;
+		for (ix = 0; ix < MAX_PKTID_ITEMS; ix++)
+		{
+			if (!bcm_mwbmap_isfree(handle->mwbmap_hdl, ix)) {
+				/* Mark the slot as free */
+				bcm_mwbmap_free(handle->mwbmap_hdl, ix);
+				/*
+				Here we can do dma unmapping for 32 bit also.
+				Since this in removal path, it will not affect performance
+				*/
+				DMA_UNMAP(osh, handle->pktid_list[ix+1].pa,
+					(uint) handle->pktid_list[ix+1].pa_len,
+					handle->pktid_list[ix+1].dma, 0, 0);
+				PKTFREE(osh, (unsigned long*)handle->pktid_list[ix+1].native, TRUE);
+			}
+		}
+		bcm_mwbmap_fini(osh, handle->mwbmap_hdl);
+		MFREE(osh, handle->pktid_list, sizeof(pktid_t) * (handle->count+1));
+		MFREE(osh, handle, sizeof(pktid_map_t));
+	}
+	return;
+}
+
+uint32 BCMFASTPATH
+pktid_map_unique(void *pktid_map_handle, void *pkt, dmaaddr_t physaddr, uint32 physlen, uint32 dma)
+{
+	uint32 id;
+	pktid_map_t *handle = (pktid_map_t *) pktid_map_handle;
+
+	if (handle == NULL) {
+		printf("%s:%d: Error !!! pktid_map_unique called without initing pktid_map\n",
+			__FUNCTION__, __LINE__);
+		return 0;
+	}
+	id = bcm_mwbmap_alloc(handle->mwbmap_hdl);
+	if (id == BCM_MWBMAP_INVALID_IDX) {
+		printf("%s:%d: bcm_mwbmap_alloc failed. Free Count = %d\n",
+			__FUNCTION__, __LINE__, bcm_mwbmap_free_cnt(handle->mwbmap_hdl));
+		return 0;
+	}
+
+	/* id=0 is invalid as we use this for error checking in the dongle */
+	id += 1;
+	handle->pktid_list[id].native = (ulong) pkt;
+	handle->pktid_list[id].pa     = physaddr;
+	handle->pktid_list[id].pa_len = (uint32) physlen;
+	handle->pktid_list[id].dma = (uchar)dma;
+
+	return id;
+}
+
+void * BCMFASTPATH
+pktid_get_packet(void *pktid_map_handle, uint32 id, dmaaddr_t *physaddr, uint32 *physlen)
+{
+	void *native = NULL;
+	pktid_map_t *handle = (pktid_map_t *) pktid_map_handle;
+	if (handle == NULL) {
+		printf("%s:%d: Error !!! pktid_get_packet called without initing pktid_map\n",
+			__FUNCTION__, __LINE__);
+		return NULL;
+	}
+
+	/* Debug check */
+	if (bcm_mwbmap_isfree(handle->mwbmap_hdl, (id-1))) {
+		printf("%s:%d: Error !!!. slot (%d/0x%04x) free but the app is using it.\n",
+			__FUNCTION__, __LINE__, (id-1), (id-1));
+		return NULL;
+	}
+
+	native = (void *) handle->pktid_list[id].native;
+	*physaddr = handle->pktid_list[id].pa;
+	*physlen  = (uint32) handle->pktid_list[id].pa_len;
+
+	/* Mark the slot as free */
+	bcm_mwbmap_free(handle->mwbmap_hdl, (id-1));
+
+	return native;
+}
+static msgbuf_ring_t*
+prot_ring_attach(dhd_prot_t * prot, char* name, uint16 max_item, uint16 len_item, uint16 ringid)
+{
+	uint alloced = 0;
+	msgbuf_ring_t *ring;
+	dmaaddr_t physaddr;
+	uint16 size;
+
+	ASSERT(name);
+	BCM_REFERENCE(physaddr);
+
+	/* allocate ring info */
+	ring = MALLOC(prot->osh, sizeof(msgbuf_ring_t));
+	if (ring == NULL) {
+		ASSERT(0);
+		return NULL;
+	}
+	bzero(ring, sizeof(*ring));
+
+	/* Init name */
+	strncpy(ring->name, name, sizeof(ring->name) - 1);
+
+	/* Ringid in the order given in bcmpcie.h */
+	ring->idx = ringid;
+
+	/* init ringmem */
+	ring->ringmem = MALLOC(prot->osh, sizeof(ring_mem_t));
+	if (ring->ringmem == NULL)
+		goto fail;
+	bzero(ring->ringmem, sizeof(*ring->ringmem));
+
+	ring->ringmem->max_item = max_item;
+	ring->ringmem->len_items = len_item;
+	size = max_item * len_item;
+
+	/* Ring Memmory allocation */
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_FLOWRING)
+	if (RING_IS_FLOWRING(ring)) {
+		ring->ring_base.va = DMA_ALLOC_CONSISTENT_STATIC(prot->osh,
+			size, DMA_ALIGN_LEN, &alloced, &ring->ring_base.pa,
+			&ring->ring_base.dmah, ringid);
+	} else
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_FLOWRING */
+	ring->ring_base.va = DMA_ALLOC_CONSISTENT(prot->osh, size, DMA_ALIGN_LEN,
+		&alloced, &ring->ring_base.pa, &ring->ring_base.dmah);
+
+	if (ring->ring_base.va == NULL)
+		goto fail;
+	ring->ringmem->base_addr.high_addr = htol32(PHYSADDRHI(ring->ring_base.pa));
+	ring->ringmem->base_addr.low_addr = htol32(PHYSADDRLO(ring->ring_base.pa));
+
+	ASSERT(MODX((unsigned long)ring->ring_base.va, DMA_ALIGN_LEN) == 0);
+	bzero(ring->ring_base.va, size);
+
+	OSL_CACHE_FLUSH((void *) ring->ring_base.va, size);
+
+	/* Ring state init */
+	ring->ringstate	= MALLOC(prot->osh, sizeof(ring_state_t));
+	if (ring->ringstate == NULL)
+		goto fail;
+	bzero(ring->ringstate, sizeof(*ring->ringstate));
+
+#ifdef BCM_SECURE_DMA
+	if (SECURE_DMA_ENAB(prot->osh)) {
+		ring->secdma = MALLOC(prot->osh, sizeof(sec_cma_info_t));
+		bzero(ring->secdma, sizeof(sec_cma_info_t));
+		if (ring->secdma == NULL) {
+			DHD_ERROR(("%s: MALLOC failure for secdma\n", __FUNCTION__));
+			goto fail;
+		}
+	}
+#endif
+	DHD_INFO(("%s: RING_ATTACH : %s Max item %d len item %d total size %d "
+		"ring start %p buf phys addr  %x:%x \n", __FUNCTION__,
+		ring->name, ring->ringmem->max_item, ring->ringmem->len_items,
+		size, ring->ring_base.va, ring->ringmem->base_addr.high_addr,
+		ring->ringmem->base_addr.low_addr));
+	return ring;
+fail:
+	if (ring->ring_base.va && ring->ringmem) {
+		PHYSADDRHISET(physaddr, ring->ringmem->base_addr.high_addr);
+		PHYSADDRLOSET(physaddr, ring->ringmem->base_addr.low_addr);
+		size = ring->ringmem->max_item * ring->ringmem->len_items;
+		DMA_FREE_CONSISTENT(prot->osh, ring->ring_base.va, size, ring->ring_base.pa, NULL);
+		ring->ring_base.va = NULL;
+	}
+	if (ring->ringmem)
+		MFREE(prot->osh, ring->ringmem, sizeof(ring_mem_t));
+	MFREE(prot->osh, ring, sizeof(msgbuf_ring_t));
+	ASSERT(0);
+	return NULL;
+}
+static void
+dhd_ring_init(dhd_pub_t *dhd, msgbuf_ring_t *ring)
+{
+	/* update buffer address of ring */
+	dhd_bus_cmn_writeshared(dhd->bus, &ring->ringmem->base_addr,
+		sizeof(ring->ringmem->base_addr), RING_BUF_ADDR, ring->idx);
+
+	/* Update max items possible in ring */
+	dhd_bus_cmn_writeshared(dhd->bus, &ring->ringmem->max_item,
+		sizeof(ring->ringmem->max_item), RING_MAX_ITEM, ring->idx);
+
+	/* Update length of each item in the ring */
+	dhd_bus_cmn_writeshared(dhd->bus, &ring->ringmem->len_items,
+		sizeof(ring->ringmem->len_items), RING_LEN_ITEMS, ring->idx);
+
+	/* ring inited */
+	ring->inited = TRUE;
+}
+static void
+dhd_prot_ring_detach(dhd_pub_t *dhd, msgbuf_ring_t * ring)
+{
+	dmaaddr_t phyaddr;
+	uint16 size;
+	dhd_prot_t *prot = dhd->prot;
+
+	BCM_REFERENCE(phyaddr);
+
+	if (ring == NULL)
+		return;
+
+
+	if (ring->ringmem == NULL) {
+		DHD_ERROR(("%s: ring->ringmem is NULL\n", __FUNCTION__));
+			return;
+	}
+
+	ring->inited = FALSE;
+
+	PHYSADDRHISET(phyaddr, ring->ringmem->base_addr.high_addr);
+	PHYSADDRLOSET(phyaddr, ring->ringmem->base_addr.low_addr);
+	size = ring->ringmem->max_item * ring->ringmem->len_items;
+	/* Free up ring */
+	if (ring->ring_base.va) {
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_FLOWRING)
+		if (RING_IS_FLOWRING(ring)) {
+			DMA_FREE_CONSISTENT_STATIC(prot->osh, ring->ring_base.va, size,
+				ring->ring_base.pa, ring->ring_base.dmah, ring->idx);
+		} else
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_FLOWRING */
+		DMA_FREE_CONSISTENT(prot->osh, ring->ring_base.va, size, ring->ring_base.pa,
+			ring->ring_base.dmah);
+		ring->ring_base.va = NULL;
+	}
+
+	/* Free up ring mem space */
+	if (ring->ringmem) {
+		MFREE(prot->osh, ring->ringmem, sizeof(ring_mem_t));
+		ring->ringmem = NULL;
+	}
+
+	/* Free up ring state info */
+	if (ring->ringstate) {
+		MFREE(prot->osh, ring->ringstate, sizeof(ring_state_t));
+		ring->ringstate = NULL;
+	}
+#ifdef BCM_SECURE_DMA
+	if (SECURE_DMA_ENAB(prot->osh)) {
+		DHD_ERROR(("%s:free secdma\n", __FUNCTION__));
+		SECURE_DMA_UNMAP_ALL(prot->osh, ring->secdma);
+		MFREE(prot->osh, ring->secdma, sizeof(sec_cma_info_t));
+	}
+#endif
+
+	/* free up ring info */
+	MFREE(prot->osh, ring, sizeof(msgbuf_ring_t));
+}
+/* Assumes only one index is updated ata time */
+static void *BCMFASTPATH
+prot_get_ring_space(msgbuf_ring_t *ring, uint16 nitems, uint16 * alloced)
+{
+	void *ret_ptr = NULL;
+	uint16 ring_avail_cnt;
+
+	ASSERT(nitems <= RING_MAX_ITEM(ring));
+
+	ring_avail_cnt = CHECK_WRITE_SPACE(RING_READ_PTR(ring), RING_WRITE_PTR(ring),
+		RING_MAX_ITEM(ring));
+
+	if (ring_avail_cnt == 0) {
+		return NULL;
+	}
+	*alloced = MIN(nitems, ring_avail_cnt);
+
+	/* Return next available space */
+	ret_ptr = (char*)HOST_RING_BASE(ring) + (RING_WRITE_PTR(ring) * RING_LEN_ITEMS(ring));
+
+	/* Update write pointer */
+	if ((RING_WRITE_PTR(ring) + *alloced) == RING_MAX_ITEM(ring))
+		RING_WRITE_PTR(ring) = 0;
+	else if ((RING_WRITE_PTR(ring) + *alloced) < RING_MAX_ITEM(ring))
+		RING_WRITE_PTR(ring) += *alloced;
+	else {
+		/* Should never hit this */
+		ASSERT(0);
+		return NULL;
+	}
+
+	return ret_ptr;
+}
+
+static void BCMFASTPATH
+prot_ring_write_complete(dhd_pub_t *dhd, msgbuf_ring_t * ring, void* p, uint16 nitems)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	/* cache flush */
+	OSL_CACHE_FLUSH(p, RING_LEN_ITEMS(ring) * nitems);
+
+	/* update write pointer */
+	/* If dma'ing h2d indices are supported
+	 * update the values in the host memory
+	 * o/w update the values in TCM
+	 */
+	if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support))
+		dhd_set_dmaed_index(dhd, H2D_DMA_WRITEINDX,
+			ring->idx, (uint16)RING_WRITE_PTR(ring));
+	else
+		dhd_bus_cmn_writeshared(dhd->bus, &(RING_WRITE_PTR(ring)),
+			sizeof(uint16), RING_WRITE_PTR, ring->idx);
+
+	/* raise h2d interrupt */
+	prot->mb_ring_fn(dhd->bus, RING_WRITE_PTR(ring));
+}
+
+/* If dma'ing h2d indices are supported
+ * this function updates the indices in
+ * the host memory
+ */
+static void
+dhd_set_dmaed_index(dhd_pub_t *dhd, uint8 type, uint16 ringid, uint16 new_index)
+{
+	dhd_prot_t *prot = dhd->prot;
+
+	uint32 *ptr = NULL;
+	uint16 offset = 0;
+
+	switch (type) {
+		case H2D_DMA_WRITEINDX:
+			ptr = (uint32 *)(prot->h2d_dma_writeindx_buf.va);
+
+			/* Flow-Rings start at Id BCMPCIE_COMMON_MSGRINGS
+			 * but in host memory their indices start
+			 * after H2D Common Rings
+			 */
+			if (ringid >= BCMPCIE_COMMON_MSGRINGS)
+				offset = ringid - BCMPCIE_COMMON_MSGRINGS +
+					BCMPCIE_H2D_COMMON_MSGRINGS;
+			else
+				offset = ringid;
+			ptr += offset;
+
+			*ptr = htol16(new_index);
+
+			/* cache flush */
+			OSL_CACHE_FLUSH((void *)prot->h2d_dma_writeindx_buf.va,
+				prot->h2d_dma_writeindx_buf_len);
+
+			break;
+
+		case D2H_DMA_READINDX:
+			ptr = (uint32 *)(prot->d2h_dma_readindx_buf.va);
+
+			/* H2D Common Righs start at Id BCMPCIE_H2D_COMMON_MSGRINGS */
+			offset = ringid - BCMPCIE_H2D_COMMON_MSGRINGS;
+			ptr += offset;
+
+			*ptr = htol16(new_index);
+			/* cache flush */
+			OSL_CACHE_FLUSH((void *)prot->d2h_dma_readindx_buf.va,
+				prot->d2h_dma_readindx_buf_len);
+
+			break;
+
+		default:
+			DHD_ERROR(("%s: Invalid option for DMAing read/write index\n",
+				__FUNCTION__));
+
+			break;
+	}
+	DHD_TRACE(("%s: Data 0x%p, ringId %d, new_index %d\n",
+		__FUNCTION__, ptr, ringid, new_index));
+}
+
+
+static uint16
+dhd_get_dmaed_index(dhd_pub_t *dhd, uint8 type, uint16 ringid)
+{
+	uint32 *ptr = NULL;
+	uint16 data = 0;
+	uint16 offset = 0;
+
+	switch (type) {
+		case H2D_DMA_WRITEINDX:
+			OSL_CACHE_INV((void *)dhd->prot->h2d_dma_writeindx_buf.va,
+				dhd->prot->h2d_dma_writeindx_buf_len);
+			ptr = (uint32 *)(dhd->prot->h2d_dma_writeindx_buf.va);
+
+			/* Flow-Rings start at Id BCMPCIE_COMMON_MSGRINGS
+			 * but in host memory their indices start
+			 * after H2D Common Rings
+			 */
+			if (ringid >= BCMPCIE_COMMON_MSGRINGS)
+				offset = ringid - BCMPCIE_COMMON_MSGRINGS +
+					BCMPCIE_H2D_COMMON_MSGRINGS;
+			else
+				offset = ringid;
+			ptr += offset;
+
+			data = LTOH16((uint16)*ptr);
+			break;
+
+		case H2D_DMA_READINDX:
+			OSL_CACHE_INV((void *)dhd->prot->h2d_dma_readindx_buf.va,
+				dhd->prot->h2d_dma_readindx_buf_len);
+			ptr = (uint32 *)(dhd->prot->h2d_dma_readindx_buf.va);
+
+			/* Flow-Rings start at Id BCMPCIE_COMMON_MSGRINGS
+			 * but in host memory their indices start
+			 * after H2D Common Rings
+			 */
+			if (ringid >= BCMPCIE_COMMON_MSGRINGS)
+				offset = ringid - BCMPCIE_COMMON_MSGRINGS +
+					BCMPCIE_H2D_COMMON_MSGRINGS;
+			else
+				offset = ringid;
+			ptr += offset;
+
+			data = LTOH16((uint16)*ptr);
+			break;
+
+		case D2H_DMA_WRITEINDX:
+			OSL_CACHE_INV((void *)dhd->prot->d2h_dma_writeindx_buf.va,
+				dhd->prot->d2h_dma_writeindx_buf_len);
+			ptr = (uint32 *)(dhd->prot->d2h_dma_writeindx_buf.va);
+
+			/* H2D Common Righs start at Id BCMPCIE_H2D_COMMON_MSGRINGS */
+			offset = ringid - BCMPCIE_H2D_COMMON_MSGRINGS;
+			ptr += offset;
+
+			data = LTOH16((uint16)*ptr);
+			break;
+
+		case D2H_DMA_READINDX:
+			OSL_CACHE_INV((void *)dhd->prot->d2h_dma_readindx_buf.va,
+				dhd->prot->d2h_dma_readindx_buf_len);
+			ptr = (uint32 *)(dhd->prot->d2h_dma_readindx_buf.va);
+
+			/* H2D Common Righs start at Id BCMPCIE_H2D_COMMON_MSGRINGS */
+			offset = ringid - BCMPCIE_H2D_COMMON_MSGRINGS;
+			ptr += offset;
+
+			data = LTOH16((uint16)*ptr);
+			break;
+
+		default:
+			DHD_ERROR(("%s: Invalid option for DMAing read/write index\n",
+				__FUNCTION__));
+
+			break;
+	}
+	DHD_TRACE(("%s: Data 0x%p, data %d\n", __FUNCTION__, ptr, data));
+	return (data);
+}
+
+/* D2H dircetion: get next space to read from */
+static uint8*
+prot_get_src_addr(dhd_pub_t *dhd, msgbuf_ring_t * ring, uint16* available_len)
+{
+	uint16 w_ptr;
+	uint16 r_ptr;
+	uint16 depth;
+	void* ret_addr = NULL;
+	uint16 d2h_w_index = 0;
+
+	DHD_TRACE(("%s: h2d_dma_readindx_buf %p, d2h_dma_writeindx_buf %p\n",
+		__FUNCTION__, (uint32 *)(dhd->prot->h2d_dma_readindx_buf.va),
+		(uint32 *)(dhd->prot->d2h_dma_writeindx_buf.va)));
+
+	/* update write pointer */
+	if (DMA_INDX_ENAB(dhd->dma_d2h_ring_upd_support)) {
+		/* DMAing write/read indices supported */
+		d2h_w_index = dhd_get_dmaed_index(dhd, D2H_DMA_WRITEINDX, ring->idx);
+		ring->ringstate->w_offset = d2h_w_index;
+	} else
+		dhd_bus_cmn_readshared(dhd->bus,
+			&(RING_WRITE_PTR(ring)), RING_WRITE_PTR, ring->idx);
+
+	w_ptr = ring->ringstate->w_offset;
+	r_ptr = ring->ringstate->r_offset;
+	depth = ring->ringmem->max_item;
+
+	/* check for avail space */
+	*available_len = READ_AVAIL_SPACE(w_ptr, r_ptr, depth);
+	if (*available_len == 0)
+		return NULL;
+
+	if (*available_len > ring->ringmem->max_item) {
+		DHD_ERROR(("%s: *available_len %d, ring->ringmem->max_item %d\n",
+			__FUNCTION__, *available_len, ring->ringmem->max_item));
+		return NULL;
+	}
+
+	/* if space available, calculate address to be read */
+	ret_addr = (char*)ring->ring_base.va + (r_ptr * ring->ringmem->len_items);
+
+	/* update read pointer */
+	if ((ring->ringstate->r_offset + *available_len) >= ring->ringmem->max_item)
+		ring->ringstate->r_offset = 0;
+	else
+		ring->ringstate->r_offset += *available_len;
+
+	ASSERT(ring->ringstate->r_offset < ring->ringmem->max_item);
+
+	/* convert index to bytes */
+	*available_len = *available_len * ring->ringmem->len_items;
+
+	/* Cache invalidate */
+	OSL_CACHE_INV((void *) ret_addr, *available_len);
+
+	/* return read address */
+	return ret_addr;
+}
+static void
+prot_upd_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring)
+{
+	/* update read index */
+	/* If dma'ing h2d indices supported
+	 * update the r -indices in the
+	 * host memory o/w in TCM
+	 */
+	if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support))
+		dhd_set_dmaed_index(dhd, D2H_DMA_READINDX,
+			ring->idx, (uint16)RING_READ_PTR(ring));
+	else
+		dhd_bus_cmn_writeshared(dhd->bus, &(RING_READ_PTR(ring)),
+			sizeof(uint16), RING_READ_PTR, ring->idx);
+}
+
+static void
+prot_store_rxcpln_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring)
+{
+	dhd_prot_t *prot;
+
+	if (!dhd || !dhd->prot)
+		return;
+
+	prot = dhd->prot;
+	prot->rx_cpln_early_upd_idx = RING_READ_PTR(ring);
+}
+
+static void
+prot_early_upd_rxcpln_read_idx(dhd_pub_t *dhd, msgbuf_ring_t * ring)
+{
+	dhd_prot_t *prot;
+
+	if (!dhd || !dhd->prot)
+		return;
+
+	prot = dhd->prot;
+
+	if (prot->rx_cpln_early_upd_idx == RING_READ_PTR(ring))
+		return;
+
+	if (++prot->rx_cpln_early_upd_idx >= RING_MAX_ITEM(ring))
+		prot->rx_cpln_early_upd_idx = 0;
+
+	if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support))
+		dhd_set_dmaed_index(dhd, D2H_DMA_READINDX,
+			ring->idx, (uint16)prot->rx_cpln_early_upd_idx);
+	else
+		dhd_bus_cmn_writeshared(dhd->bus, &(prot->rx_cpln_early_upd_idx),
+			sizeof(uint16), RING_READ_PTR, ring->idx);
+}
+
+int
+dhd_prot_flow_ring_create(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+	tx_flowring_create_request_t *flow_create_rqst;
+	msgbuf_ring_t *msgbuf_flow_info;
+	dhd_prot_t *prot = dhd->prot;
+	uint16 hdrlen = sizeof(tx_flowring_create_request_t);
+	uint16 msglen = hdrlen;
+	unsigned long flags;
+	char eabuf[ETHER_ADDR_STR_LEN];
+	uint16 alloced = 0;
+
+	if (!(msgbuf_flow_info = prot_ring_attach(prot, "h2dflr",
+		H2DRING_TXPOST_MAX_ITEM, H2DRING_TXPOST_ITEMSIZE,
+		BCMPCIE_H2D_TXFLOWRINGID +
+		(flow_ring_node->flowid - BCMPCIE_H2D_COMMON_MSGRINGS)))) {
+		DHD_ERROR(("%s: kmalloc for H2D TX Flow ring failed\n", __FUNCTION__));
+		return BCME_NOMEM;
+	}
+	/* Clear write pointer of the ring */
+	flow_ring_node->prot_info = (void *)msgbuf_flow_info;
+
+	/* align it to 4 bytes, so that all start addr form cbuf is 4 byte aligned */
+	msglen = align(msglen, DMA_ALIGN_LEN);
+
+
+	DHD_GENERAL_LOCK(dhd, flags);
+	/* Request for ring buffer space */
+	flow_create_rqst = (tx_flowring_create_request_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+
+	if (flow_create_rqst == NULL) {
+		DHD_ERROR(("%s: No space in control ring for Flow create req\n", __FUNCTION__));
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		return BCME_NOMEM;
+	}
+	msgbuf_flow_info->inited = TRUE;
+
+	/* Common msg buf hdr */
+	flow_create_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_CREATE;
+	flow_create_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+	flow_create_rqst->msg.request_id = htol16(0); /* TBD */
+
+	/* Update flow create message */
+	flow_create_rqst->tid = flow_ring_node->flow_info.tid;
+	flow_create_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+	memcpy(flow_create_rqst->sa, flow_ring_node->flow_info.sa, sizeof(flow_create_rqst->sa));
+	memcpy(flow_create_rqst->da, flow_ring_node->flow_info.da, sizeof(flow_create_rqst->da));
+	flow_create_rqst->flow_ring_ptr.low_addr = msgbuf_flow_info->ringmem->base_addr.low_addr;
+	flow_create_rqst->flow_ring_ptr.high_addr = msgbuf_flow_info->ringmem->base_addr.high_addr;
+	flow_create_rqst->max_items = htol16(H2DRING_TXPOST_MAX_ITEM);
+	flow_create_rqst->len_item = htol16(H2DRING_TXPOST_ITEMSIZE);
+	bcm_ether_ntoa((struct ether_addr *)flow_ring_node->flow_info.da, eabuf);
+	DHD_ERROR(("%s Send Flow create Req msglen flow ID %d for peer %s prio %d ifindex %d\n",
+		__FUNCTION__, flow_ring_node->flowid, eabuf, flow_ring_node->flow_info.tid,
+		flow_ring_node->flow_info.ifindex));
+
+	/* upd wrt ptr and raise interrupt */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, flow_create_rqst,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+
+	/* If dma'ing indices supported
+	 * update the w-index in host memory o/w in TCM
+	 */
+	if (DMA_INDX_ENAB(dhd->dma_h2d_ring_upd_support))
+		dhd_set_dmaed_index(dhd, H2D_DMA_WRITEINDX,
+			msgbuf_flow_info->idx, (uint16)RING_WRITE_PTR(msgbuf_flow_info));
+	else
+		dhd_bus_cmn_writeshared(dhd->bus, &(RING_WRITE_PTR(msgbuf_flow_info)),
+			sizeof(uint16), RING_WRITE_PTR, msgbuf_flow_info->idx);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return BCME_OK;
+}
+
+static void
+dhd_prot_process_flow_ring_create_response(dhd_pub_t *dhd, void* buf, uint16 msglen)
+{
+	tx_flowring_create_response_t *flow_create_resp = (tx_flowring_create_response_t *)buf;
+
+	DHD_ERROR(("%s Flow create Response status = %d Flow %d\n", __FUNCTION__,
+		flow_create_resp->cmplt.status, flow_create_resp->cmplt.flow_ring_id));
+
+	dhd_bus_flow_ring_create_response(dhd->bus, flow_create_resp->cmplt.flow_ring_id,
+		flow_create_resp->cmplt.status);
+}
+
+void dhd_prot_clean_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info)
+{
+	msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)msgbuf_flow_info;
+	dhd_prot_ring_detach(dhd, flow_ring);
+	DHD_INFO(("%s Cleaning up Flow \n", __FUNCTION__));
+}
+
+void dhd_prot_print_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info,
+	struct bcmstrbuf *strbuf)
+{
+	msgbuf_ring_t *flow_ring = (msgbuf_ring_t *)msgbuf_flow_info;
+	uint16 rd, wrt;
+	dhd_bus_cmn_readshared(dhd->bus, &rd, RING_READ_PTR, flow_ring->idx);
+	dhd_bus_cmn_readshared(dhd->bus, &wrt, RING_WRITE_PTR, flow_ring->idx);
+	bcm_bprintf(strbuf, "RD %d WR %d\n", rd, wrt);
+}
+
+void dhd_prot_print_info(dhd_pub_t *dhd, struct bcmstrbuf *strbuf)
+{
+	bcm_bprintf(strbuf, "CtrlPost: ");
+	dhd_prot_print_flow_ring(dhd, dhd->prot->h2dring_ctrl_subn, strbuf);
+	bcm_bprintf(strbuf, "CtrlCpl: ");
+	dhd_prot_print_flow_ring(dhd, dhd->prot->d2hring_ctrl_cpln, strbuf);
+	bcm_bprintf(strbuf, "RxPost: ");
+	bcm_bprintf(strbuf, "RBP %d ", dhd->prot->rxbufpost);
+	dhd_prot_print_flow_ring(dhd, dhd->prot->h2dring_rxp_subn, strbuf);
+	bcm_bprintf(strbuf, "RxCpl: ");
+	dhd_prot_print_flow_ring(dhd, dhd->prot->d2hring_rx_cpln, strbuf);
+	if (dhd_bus_is_txmode_push(dhd->bus)) {
+		bcm_bprintf(strbuf, "TxPost: ");
+		dhd_prot_print_flow_ring(dhd, dhd->prot->h2dring_txp_subn, strbuf);
+	}
+	bcm_bprintf(strbuf, "TxCpl: ");
+	dhd_prot_print_flow_ring(dhd, dhd->prot->d2hring_tx_cpln, strbuf);
+	bcm_bprintf(strbuf, "active_tx_count %d	 pktidmap_avail %d\n",
+		dhd->prot->active_tx_count,
+		dhd_pktid_map_avail_cnt(dhd->prot->pktid_map_handle));
+}
+
+int
+dhd_prot_flow_ring_delete(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+	tx_flowring_delete_request_t *flow_delete_rqst;
+	dhd_prot_t *prot = dhd->prot;
+	uint16 msglen = sizeof(tx_flowring_delete_request_t);
+	unsigned long flags;
+	char eabuf[ETHER_ADDR_STR_LEN];
+	uint16 alloced = 0;
+
+	/* align it to 4 bytes, so that all start addr form cbuf is 4 byte aligned */
+	msglen = align(msglen, DMA_ALIGN_LEN);
+
+	/* Request for ring buffer space */
+	DHD_GENERAL_LOCK(dhd, flags);
+	flow_delete_rqst = (tx_flowring_delete_request_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+
+	if (flow_delete_rqst == NULL) {
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		DHD_ERROR(("%s Flow Delete req failure no ring mem %d \n", __FUNCTION__, msglen));
+		return BCME_NOMEM;
+	}
+
+	/* Common msg buf hdr */
+	flow_delete_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_DELETE;
+	flow_delete_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+	flow_delete_rqst->msg.request_id = htol16(0); /* TBD */
+
+	/* Update Delete info */
+	flow_delete_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+	flow_delete_rqst->reason = htol16(BCME_OK);
+
+	bcm_ether_ntoa((struct ether_addr *)flow_ring_node->flow_info.da, eabuf);
+	DHD_ERROR(("%s sending FLOW RING ID %d for peer %s prio %d ifindex %d"
+		" Delete req msglen %d\n", __FUNCTION__,
+		flow_ring_node->flowid, eabuf, flow_ring_node->flow_info.tid,
+		flow_ring_node->flow_info.ifindex, msglen));
+
+	/* upd wrt ptr and raise interrupt */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, flow_delete_rqst,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return BCME_OK;
+}
+
+static void
+dhd_prot_process_flow_ring_delete_response(dhd_pub_t *dhd, void* buf, uint16 msglen)
+{
+	tx_flowring_delete_response_t *flow_delete_resp = (tx_flowring_delete_response_t *)buf;
+
+	DHD_INFO(("%s Flow Delete Response status = %d \n", __FUNCTION__,
+		flow_delete_resp->cmplt.status));
+
+#ifdef PCIE_TX_DEFERRAL
+	if (flow_delete_resp->cmplt.status != BCME_OK) {
+		DHD_ERROR(("%s Flow Delete Response failure error status = %d \n",
+		    __FUNCTION__, flow_delete_resp->cmplt.status));
+		return;
+	}
+	set_bit(flow_delete_resp->cmplt.flow_ring_id, dhd->bus->delete_flow_map);
+	queue_work(dhd->bus->tx_wq, &dhd->bus->delete_flow_work);
+#else
+	dhd_bus_flow_ring_delete_response(dhd->bus, flow_delete_resp->cmplt.flow_ring_id,
+		flow_delete_resp->cmplt.status);
+#endif /* PCIE_TX_DEFERRAL */
+}
+
+int
+dhd_prot_flow_ring_flush(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node)
+{
+	tx_flowring_flush_request_t *flow_flush_rqst;
+	dhd_prot_t *prot = dhd->prot;
+	uint16 msglen = sizeof(tx_flowring_flush_request_t);
+	unsigned long flags;
+	uint16 alloced = 0;
+
+	/* align it to 4 bytes, so that all start addr form cbuf is 4 byte aligned */
+	msglen = align(msglen, DMA_ALIGN_LEN);
+
+	/* Request for ring buffer space */
+	DHD_GENERAL_LOCK(dhd, flags);
+	flow_flush_rqst = (tx_flowring_flush_request_t *)dhd_alloc_ring_space(dhd,
+		prot->h2dring_ctrl_subn, DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D, &alloced);
+	if (flow_flush_rqst == NULL) {
+		DHD_GENERAL_UNLOCK(dhd, flags);
+		DHD_ERROR(("%s Flow Flush req failure no ring mem %d \n", __FUNCTION__, msglen));
+		return BCME_NOMEM;
+	}
+
+	/* Common msg buf hdr */
+	flow_flush_rqst->msg.msg_type = MSG_TYPE_FLOW_RING_FLUSH;
+	flow_flush_rqst->msg.if_id = (uint8)flow_ring_node->flow_info.ifindex;
+	flow_flush_rqst->msg.request_id = htol16(0); /* TBD */
+
+	flow_flush_rqst->flow_ring_id = htol16((uint16)flow_ring_node->flowid);
+	flow_flush_rqst->reason = htol16(BCME_OK);
+
+	DHD_INFO(("%s sending FLOW RING Flush req msglen %d \n", __FUNCTION__, msglen));
+
+	/* upd wrt ptr and raise interrupt */
+	prot_ring_write_complete(dhd, prot->h2dring_ctrl_subn, flow_flush_rqst,
+		DHD_FLOWRING_DEFAULT_NITEMS_POSTED_H2D);
+	DHD_GENERAL_UNLOCK(dhd, flags);
+
+	return BCME_OK;
+}
+
+static void
+dhd_prot_process_flow_ring_flush_response(dhd_pub_t *dhd, void* buf, uint16 msglen)
+{
+	tx_flowring_flush_response_t *flow_flush_resp = (tx_flowring_flush_response_t *)buf;
+
+	DHD_INFO(("%s Flow Flush Response status = %d \n", __FUNCTION__,
+		flow_flush_resp->cmplt.status));
+
+	dhd_bus_flow_ring_flush_response(dhd->bus, flow_flush_resp->cmplt.flow_ring_id,
+		flow_flush_resp->cmplt.status);
+}
+
+int
+dhd_prot_ringupd_dump(dhd_pub_t *dhd, struct bcmstrbuf *b)
+{
+	uint32 *ptr;
+	uint32 value;
+	uint32 i;
+	uint8 txpush = 0;
+	uint32 max_h2d_queues = dhd_bus_max_h2d_queues(dhd->bus, &txpush);
+
+	OSL_CACHE_INV((void *)dhd->prot->d2h_dma_writeindx_buf.va,
+		dhd->prot->d2h_dma_writeindx_buf_len);
+
+	ptr = (uint32 *)(dhd->prot->d2h_dma_writeindx_buf.va);
+
+	bcm_bprintf(b, "\n max_tx_queues %d, txpush mode %d\n", max_h2d_queues, txpush);
+
+	bcm_bprintf(b, "\nRPTR block H2D common rings, 0x%04x\n", ptr);
+	value = ltoh32(*ptr);
+	bcm_bprintf(b, "\tH2D CTRL: value 0x%04x\n", value);
+	ptr++;
+	value = ltoh32(*ptr);
+	bcm_bprintf(b, "\tH2D RXPOST: value 0x%04x\n", value);
+
+	if (txpush) {
+		ptr++;
+		value = ltoh32(*ptr);
+		bcm_bprintf(b, "\tH2D TXPOST value 0x%04x\n", value);
+	}
+	else {
+		ptr++;
+		bcm_bprintf(b, "RPTR block Flow rings , 0x%04x\n", ptr);
+		for (i = BCMPCIE_H2D_COMMON_MSGRINGS; i < max_h2d_queues; i++) {
+			value = ltoh32(*ptr);
+			bcm_bprintf(b, "\tflowring ID %d: value 0x%04x\n", i, value);
+			ptr++;
+		}
+	}
+
+	OSL_CACHE_INV((void *)dhd->prot->h2d_dma_readindx_buf.va,
+		dhd->prot->h2d_dma_readindx_buf_len);
+
+	ptr = (uint32 *)(dhd->prot->h2d_dma_readindx_buf.va);
+
+	bcm_bprintf(b, "\nWPTR block D2H common rings, 0x%04x\n", ptr);
+	value = ltoh32(*ptr);
+	bcm_bprintf(b, "\tD2H CTRLCPLT: value 0x%04x\n", value);
+	ptr++;
+	value = ltoh32(*ptr);
+	bcm_bprintf(b, "\tD2H TXCPLT: value 0x%04x\n", value);
+	ptr++;
+	value = ltoh32(*ptr);
+	bcm_bprintf(b, "\tD2H RXCPLT: value 0x%04x\n", value);
+
+	return 0;
+}
+
+uint32
+dhd_prot_metadatalen_set(dhd_pub_t *dhd, uint32 val, bool rx)
+{
+	dhd_prot_t *prot = dhd->prot;
+	if (rx)
+		prot->rx_metadata_offset = (uint16)val;
+	else
+		prot->tx_metadata_offset = (uint16)val;
+	return dhd_prot_metadatalen_get(dhd, rx);
+}
+
+uint32
+dhd_prot_metadatalen_get(dhd_pub_t *dhd, bool rx)
+{
+	dhd_prot_t *prot = dhd->prot;
+	if (rx)
+		return prot->rx_metadata_offset;
+	else
+		return prot->tx_metadata_offset;
+}
+
+uint32
+dhd_prot_txp_threshold(dhd_pub_t *dhd, bool set, uint32 val)
+{
+	dhd_prot_t *prot = dhd->prot;
+	if (set)
+		prot->txp_threshold = (uint16)val;
+	val = prot->txp_threshold;
+	return val;
+}
+
+#ifdef DHD_RX_CHAINING
+static INLINE void BCMFASTPATH
+dhd_rxchain_reset(rxchain_info_t *rxchain)
+{
+	rxchain->pkt_count = 0;
+}
+
+static void BCMFASTPATH
+dhd_rxchain_frame(dhd_pub_t *dhd, void *pkt, uint ifidx)
+{
+	uint8 *eh;
+	uint8 prio;
+	dhd_prot_t *prot = dhd->prot;
+	rxchain_info_t *rxchain = &prot->rxchain;
+
+	eh = PKTDATA(dhd->osh, pkt);
+	prio = IP_TOS46(eh + ETHER_HDR_LEN) >> IPV4_TOS_PREC_SHIFT;
+
+	/* For routers, with HNDCTF, link the packets using PKTSETCLINK, */
+	/* so that the chain can be handed off to CTF bridge as is. */
+	if (rxchain->pkt_count == 0) {
+		/* First packet in chain */
+		rxchain->pkthead = rxchain->pkttail = pkt;
+
+		/* Keep a copy of ptr to ether_da, ether_sa and prio */
+		rxchain->h_da = ((struct ether_header *)eh)->ether_dhost;
+		rxchain->h_sa = ((struct ether_header *)eh)->ether_shost;
+		rxchain->h_prio = prio;
+		rxchain->ifidx = ifidx;
+		rxchain->pkt_count++;
+	} else {
+		if (PKT_CTF_CHAINABLE(dhd, ifidx, eh, prio, rxchain->h_sa,
+			rxchain->h_da, rxchain->h_prio)) {
+			/* Same flow - keep chaining */
+			PKTSETCLINK(rxchain->pkttail, pkt);
+			rxchain->pkttail = pkt;
+			rxchain->pkt_count++;
+		} else {
+			/* Different flow - First release the existing chain */
+			dhd_rxchain_commit(dhd);
+
+			/* Create a new chain */
+			rxchain->pkthead = rxchain->pkttail = pkt;
+
+			/* Keep a copy of ptr to ether_da, ether_sa and prio */
+			rxchain->h_da = ((struct ether_header *)eh)->ether_dhost;
+			rxchain->h_sa = ((struct ether_header *)eh)->ether_shost;
+			rxchain->h_prio = prio;
+			rxchain->ifidx = ifidx;
+			rxchain->pkt_count++;
+		}
+	}
+
+	if ((!ETHER_ISMULTI(rxchain->h_da)) &&
+		((((struct ether_header *)eh)->ether_type == HTON16(ETHER_TYPE_IP)) ||
+		(((struct ether_header *)eh)->ether_type == HTON16(ETHER_TYPE_IPV6)))) {
+		PKTSETCHAINED(dhd->osh, pkt);
+		PKTCINCRCNT(rxchain->pkthead);
+		PKTCADDLEN(rxchain->pkthead, PKTLEN(dhd->osh, pkt));
+	} else {
+		dhd_rxchain_commit(dhd);
+		return;
+	}
+
+	/* If we have hit the max chain length, dispatch the chain and reset */
+	if (rxchain->pkt_count >= DHD_PKT_CTF_MAX_CHAIN_LEN) {
+		dhd_rxchain_commit(dhd);
+	}
+}
+
+static void BCMFASTPATH
+dhd_rxchain_commit(dhd_pub_t *dhd)
+{
+	dhd_prot_t *prot = dhd->prot;
+	rxchain_info_t *rxchain = &prot->rxchain;
+
+	if (rxchain->pkt_count == 0)
+		return;
+
+	/* Release the packets to dhd_linux */
+	dhd_bus_rx_frame(dhd->bus, rxchain->pkthead, rxchain->ifidx, rxchain->pkt_count);
+
+	/* Reset the chain */
+	dhd_rxchain_reset(rxchain);
+}
+#endif /* DHD_RX_CHAINING */
+
+static void
+dhd_prot_ring_clear(msgbuf_ring_t* ring)
+{
+	uint16 size;
+
+	DHD_TRACE(("%s\n", __FUNCTION__));
+
+	size = ring->ringmem->max_item * ring->ringmem->len_items;
+	ASSERT(MODX((unsigned long)ring->ring_base.va, DMA_ALIGN_LEN) == 0);
+	OSL_CACHE_INV((void *) ring->ring_base.va, size);
+	bzero(ring->ring_base.va, size);
+
+	OSL_CACHE_FLUSH((void *) ring->ring_base.va, size);
+
+	bzero(ring->ringstate, sizeof(*ring->ringstate));
+}
+
+void
+dhd_prot_clear(dhd_pub_t *dhd)
+{
+	struct dhd_prot *prot = dhd->prot;
+
+	DHD_TRACE(("%s\n", __FUNCTION__));
+
+	if (prot == NULL)
+		return;
+
+	if (prot->h2dring_txp_subn)
+		dhd_prot_ring_clear(prot->h2dring_txp_subn);
+	if (prot->h2dring_rxp_subn)
+		dhd_prot_ring_clear(prot->h2dring_rxp_subn);
+	if (prot->h2dring_ctrl_subn)
+		dhd_prot_ring_clear(prot->h2dring_ctrl_subn);
+	if (prot->d2hring_tx_cpln)
+		dhd_prot_ring_clear(prot->d2hring_tx_cpln);
+	if (prot->d2hring_rx_cpln)
+		dhd_prot_ring_clear(prot->d2hring_rx_cpln);
+	if (prot->d2hring_ctrl_cpln)
+		dhd_prot_ring_clear(prot->d2hring_ctrl_cpln);
+
+	if (prot->retbuf.va) {
+		OSL_CACHE_INV((void *) prot->retbuf.va, IOCT_RETBUF_SIZE);
+		bzero(prot->retbuf.va, IOCT_RETBUF_SIZE);
+		OSL_CACHE_FLUSH((void *) prot->retbuf.va, IOCT_RETBUF_SIZE);
+	}
+
+	if (prot->ioctbuf.va) {
+		OSL_CACHE_INV((void *) prot->ioctbuf.va, IOCT_RETBUF_SIZE);
+		bzero(prot->ioctbuf.va, IOCT_RETBUF_SIZE);
+		OSL_CACHE_FLUSH((void *) prot->ioctbuf.va, IOCT_RETBUF_SIZE);
+	}
+
+	if (prot->d2h_dma_scratch_buf.va) {
+		OSL_CACHE_INV((void *)prot->d2h_dma_scratch_buf.va, DMA_D2H_SCRATCH_BUF_LEN);
+		bzero(prot->d2h_dma_scratch_buf.va, DMA_D2H_SCRATCH_BUF_LEN);
+		OSL_CACHE_FLUSH((void *)prot->d2h_dma_scratch_buf.va, DMA_D2H_SCRATCH_BUF_LEN);
+	}
+
+	if (prot->h2d_dma_readindx_buf.va) {
+		OSL_CACHE_INV((void *)prot->h2d_dma_readindx_buf.va,
+			prot->h2d_dma_readindx_buf_len);
+		bzero(prot->h2d_dma_readindx_buf.va,
+			prot->h2d_dma_readindx_buf_len);
+		OSL_CACHE_FLUSH((void *)prot->h2d_dma_readindx_buf.va,
+			prot->h2d_dma_readindx_buf_len);
+	}
+
+	if (prot->h2d_dma_writeindx_buf.va) {
+		OSL_CACHE_INV((void *)prot->h2d_dma_writeindx_buf.va,
+			prot->h2d_dma_writeindx_buf_len);
+		bzero(prot->h2d_dma_writeindx_buf.va, prot->h2d_dma_writeindx_buf_len);
+		OSL_CACHE_FLUSH((void *)prot->h2d_dma_writeindx_buf.va,
+			prot->h2d_dma_writeindx_buf_len);
+	}
+
+	if (prot->d2h_dma_readindx_buf.va) {
+		OSL_CACHE_INV((void *)prot->d2h_dma_readindx_buf.va,
+			prot->d2h_dma_readindx_buf_len);
+		bzero(prot->d2h_dma_readindx_buf.va, prot->d2h_dma_readindx_buf_len);
+		OSL_CACHE_FLUSH((void *)prot->d2h_dma_readindx_buf.va,
+			prot->d2h_dma_readindx_buf_len);
+	}
+
+	if (prot->d2h_dma_writeindx_buf.va) {
+		OSL_CACHE_INV((void *)prot->d2h_dma_writeindx_buf.va,
+			prot->d2h_dma_writeindx_buf_len);
+		bzero(prot->d2h_dma_writeindx_buf.va, prot->d2h_dma_writeindx_buf_len);
+		OSL_CACHE_FLUSH((void *)prot->d2h_dma_writeindx_buf.va,
+			prot->d2h_dma_writeindx_buf_len);
+	}
+
+	prot->rx_metadata_offset = 0;
+	prot->tx_metadata_offset = 0;
+
+	prot->rxbufpost = 0;
+	prot->cur_event_bufs_posted = 0;
+	prot->cur_ioctlresp_bufs_posted = 0;
+
+	prot->active_tx_count = 0;
+	prot->data_seq_no = 0;
+	prot->ioctl_seq_no = 0;
+	prot->pending = 0;
+	prot->lastcmd = 0;
+
+	prot->ioctl_trans_id = 1;
+
+	/* dhd_flow_rings_init is located at dhd_bus_start,
+	 *  so when stopping bus, flowrings shall be deleted
+	 */
+	dhd_flow_rings_deinit(dhd);
+	NATIVE_TO_PKTID_CLEAR(prot->pktid_map_handle);
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_pcie.c b/drivers/net/wireless/bcm4336/dhd_pcie.c
--- a/drivers/net/wireless/bcm4336/dhd_pcie.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_pcie.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,4733 @@
+/*
+ * DHD Bus Module for PCIE
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_pcie.c 506043 2014-10-02 12:29:45Z $
+ */
+
+
+/* include files */
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <hndpmu.h>
+#include <sbchipc.h>
+#if defined(DHD_DEBUG)
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <dngl_stats.h>
+#include <pcie_core.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_flowring.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+#include <bcmmsgbuf.h>
+#include <pcicfg.h>
+#include <dhd_pcie.h>
+#include <bcmpcie.h>
+#include <bcmendian.h>
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+#include <dhd_config.h>
+
+#ifdef BCMEMBEDIMAGE
+#include BCMEMBEDIMAGE
+#endif /* BCMEMBEDIMAGE */
+
+#define MEMBLOCK	2048		/* Block size used for downloading of dongle image */
+#define MAX_NVRAMBUF_SIZE	6144	/* max nvram buf size */
+
+#define ARMCR4REG_BANKIDX	(0x40/sizeof(uint32))
+#define ARMCR4REG_BANKPDA	(0x4C/sizeof(uint32))
+/* Temporary war to fix precommit till sync issue between trunk & precommit branch is resolved */
+
+#if defined(SUPPORT_MULTIPLE_BOARD_REV)
+	extern unsigned int system_rev;
+#endif /* SUPPORT_MULTIPLE_BOARD_REV */
+
+int dhd_dongle_memsize;
+int dhd_dongle_ramsize;
+#ifdef DHD_DEBUG
+static int dhdpcie_checkdied(dhd_bus_t *bus, char *data, uint size);
+static int dhdpcie_bus_readconsole(dhd_bus_t *bus);
+#endif
+static int dhdpcie_bus_membytes(dhd_bus_t *bus, bool write, ulong address, uint8 *data, uint size);
+static int dhdpcie_bus_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid,
+	const char *name, void *params,
+	int plen, void *arg, int len, int val_size);
+static int dhdpcie_bus_lpback_req(struct  dhd_bus *bus, uint32 intval);
+static int dhdpcie_bus_dmaxfer_req(struct  dhd_bus *bus,
+	uint32 len, uint32 srcdelay, uint32 destdelay);
+static int dhdpcie_bus_download_state(dhd_bus_t *bus, bool enter);
+static int _dhdpcie_download_firmware(struct dhd_bus *bus);
+static int dhdpcie_download_firmware(dhd_bus_t *bus, osl_t *osh);
+static int dhdpcie_bus_write_vars(dhd_bus_t *bus);
+static bool dhdpcie_bus_process_mailbox_intr(dhd_bus_t *bus, uint32 intstatus);
+static bool dhdpci_bus_read_frames(dhd_bus_t *bus);
+static int dhdpcie_readshared(dhd_bus_t *bus);
+static void dhdpcie_init_shared_addr(dhd_bus_t *bus);
+static bool dhdpcie_dongle_attach(dhd_bus_t *bus);
+static void dhdpcie_bus_intr_enable(dhd_bus_t *bus);
+static void dhdpcie_bus_dongle_setmemsize(dhd_bus_t *bus, int mem_size);
+static void dhdpcie_bus_release_dongle(dhd_bus_t *bus, osl_t *osh,
+	bool dongle_isolation, bool reset_flag);
+static void dhdpcie_bus_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static int dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len);
+static uint8 dhdpcie_bus_rtcm8(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data);
+static void dhdpcie_bus_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data);
+static uint16 dhdpcie_bus_rtcm16(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data);
+static uint32 dhdpcie_bus_rtcm32(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data);
+static uint64 dhdpcie_bus_rtcm64(dhd_bus_t *bus, ulong offset);
+static void dhdpcie_bus_cfg_set_bar0_win(dhd_bus_t *bus, uint32 data);
+#ifdef CONFIG_ARCH_MSM8994
+static void dhdpcie_bus_cfg_set_bar1_win(dhd_bus_t *bus, uint32 data);
+static ulong dhd_bus_cmn_check_offset(dhd_bus_t *bus, ulong offset);
+#endif
+static void dhdpcie_bus_reg_unmap(osl_t *osh, ulong addr, int size);
+static int dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b);
+static void dhdpcie_send_mb_data(dhd_bus_t *bus, uint32 h2d_mb_data);
+static void dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info);
+extern void dhd_dpc_kill(dhd_pub_t *dhdp);
+
+#ifdef BCMEMBEDIMAGE
+static int dhdpcie_download_code_array(dhd_bus_t *bus);
+#endif /* BCMEMBEDIMAGE */
+
+
+
+#define     PCI_VENDOR_ID_BROADCOM          0x14e4
+
+/* IOVar table */
+enum {
+	IOV_INTR = 1,
+	IOV_MEMBYTES,
+	IOV_MEMSIZE,
+	IOV_SET_DOWNLOAD_STATE,
+	IOV_DEVRESET,
+	IOV_VARS,
+	IOV_MSI_SIM,
+	IOV_PCIE_LPBK,
+	IOV_CC_NVMSHADOW,
+	IOV_RAMSIZE,
+	IOV_RAMSTART,
+	IOV_SLEEP_ALLOWED,
+	IOV_PCIE_DMAXFER,
+	IOV_PCIE_SUSPEND,
+	IOV_PCIEREG,
+	IOV_PCIECFGREG,
+	IOV_PCIECOREREG,
+	IOV_PCIESERDESREG,
+	IOV_BAR0_SECWIN_REG,
+	IOV_SBREG,
+	IOV_DONGLEISOLATION,
+	IOV_LTRSLEEPON_UNLOOAD,
+	IOV_RX_METADATALEN,
+	IOV_TX_METADATALEN,
+	IOV_TXP_THRESHOLD,
+	IOV_BUZZZ_DUMP,
+	IOV_DUMP_RINGUPD_BLOCK,
+	IOV_DMA_RINGINDICES,
+	IOV_DB1_FOR_MB,
+	IOV_FLOW_PRIO_MAP,
+	IOV_RXBOUND,
+	IOV_TXBOUND
+};
+
+
+const bcm_iovar_t dhdpcie_iovars[] = {
+	{"intr",	IOV_INTR,	0,	IOVT_BOOL,	0 },
+	{"membytes",	IOV_MEMBYTES,	0,	IOVT_BUFFER,	2 * sizeof(int) },
+	{"memsize",	IOV_MEMSIZE,	0,	IOVT_UINT32,	0 },
+	{"dwnldstate",	IOV_SET_DOWNLOAD_STATE,	0,	IOVT_BOOL,	0 },
+	{"vars",	IOV_VARS,	0,	IOVT_BUFFER,	0 },
+	{"devreset",	IOV_DEVRESET,	0,	IOVT_BOOL,	0 },
+	{"pcie_lpbk",	IOV_PCIE_LPBK,	0,	IOVT_UINT32,	0 },
+	{"cc_nvmshadow", IOV_CC_NVMSHADOW, 0, IOVT_BUFFER, 0 },
+	{"ramsize",	IOV_RAMSIZE,	0,	IOVT_UINT32,	0 },
+	{"ramstart",	IOV_RAMSTART,	0,	IOVT_UINT32,	0 },
+	{"pciereg",	IOV_PCIEREG,	0,	IOVT_BUFFER,	2 * sizeof(int32) },
+	{"pciecfgreg",	IOV_PCIECFGREG,	0,	IOVT_BUFFER,	2 * sizeof(int32) },
+	{"pciecorereg",	IOV_PCIECOREREG,	0,	IOVT_BUFFER,	2 * sizeof(int32) },
+	{"pcieserdesreg",	IOV_PCIESERDESREG,	0,	IOVT_BUFFER,	3 * sizeof(int32) },
+	{"bar0secwinreg",	IOV_BAR0_SECWIN_REG,	0,	IOVT_BUFFER,	2 * sizeof(int32) },
+	{"sbreg",	IOV_SBREG,	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
+	{"pcie_dmaxfer",	IOV_PCIE_DMAXFER,	0,	IOVT_BUFFER,	3 * sizeof(int32) },
+	{"pcie_suspend", IOV_PCIE_SUSPEND,	0,	IOVT_UINT32,	0 },
+	{"sleep_allowed",	IOV_SLEEP_ALLOWED,	0,	IOVT_BOOL,	0 },
+	{"dngl_isolation", IOV_DONGLEISOLATION,	0,	IOVT_UINT32,	0 },
+	{"ltrsleep_on_unload", IOV_LTRSLEEPON_UNLOOAD,	0,	IOVT_UINT32,	0 },
+	{"dump_ringupdblk", IOV_DUMP_RINGUPD_BLOCK,	0,	IOVT_BUFFER,	0 },
+	{"dma_ring_indices", IOV_DMA_RINGINDICES,	0,	IOVT_UINT32,	0},
+	{"rx_metadata_len", IOV_RX_METADATALEN,	0,	IOVT_UINT32,	0 },
+	{"tx_metadata_len", IOV_TX_METADATALEN,	0,	IOVT_UINT32,	0 },
+	{"db1_for_mb", IOV_DB1_FOR_MB,	0,	IOVT_UINT32,	0 },
+	{"txp_thresh", IOV_TXP_THRESHOLD,	0,	IOVT_UINT32,	0 },
+	{"buzzz_dump", IOV_BUZZZ_DUMP,		0,	IOVT_UINT32,	0 },
+	{"flow_prio_map", IOV_FLOW_PRIO_MAP,	0,	IOVT_UINT32,	0 },
+	{"rxbound",     IOV_RXBOUND,    0,      IOVT_UINT32,    0 },
+	{"txbound",     IOV_TXBOUND,    0,      IOVT_UINT32,    0 },
+	{NULL, 0, 0, 0, 0 }
+};
+
+#define MAX_READ_TIMEOUT	5 * 1000 * 1000
+
+#ifndef DHD_RXBOUND
+#define DHD_RXBOUND		64
+#endif
+#ifndef DHD_TXBOUND
+#define DHD_TXBOUND		64
+#endif
+uint dhd_rxbound = DHD_RXBOUND;
+uint dhd_txbound = DHD_TXBOUND;
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+int
+dhd_bus_register(void)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	return dhdpcie_bus_register();
+}
+
+void
+dhd_bus_unregister(void)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	dhdpcie_bus_unregister();
+	return;
+}
+
+
+/** returns a host virtual address */
+uint32 *
+dhdpcie_bus_reg_map(osl_t *osh, ulong addr, int size)
+{
+	return (uint32 *)REG_MAP(addr, size);
+}
+
+void
+dhdpcie_bus_reg_unmap(osl_t *osh, ulong addr, int size)
+{
+	REG_UNMAP((void*)(uintptr)addr);
+	return;
+}
+
+/**
+ * 'regs' is the host virtual address that maps to the start of the PCIe BAR0 window. The first 4096
+ * bytes in this window are mapped to the backplane address in the PCIEBAR0Window register. The
+ * precondition is that the PCIEBAR0Window register 'points' at the PCIe core.
+ *
+ * 'tcm' is the *host* virtual address at which tcm is mapped.
+ */
+dhd_bus_t* dhdpcie_bus_attach(osl_t *osh, volatile char* regs, volatile char* tcm, uint32 tcm_size)
+{
+	dhd_bus_t *bus;
+
+	DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+	do {
+		if (!(bus = MALLOC(osh, sizeof(dhd_bus_t)))) {
+			DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+			break;
+		}
+		bzero(bus, sizeof(dhd_bus_t));
+		bus->regs = regs;
+		bus->tcm = tcm;
+		bus->tcm_size = tcm_size;
+		bus->osh = osh;
+
+		dll_init(&bus->const_flowring);
+
+		/* Attach pcie shared structure */
+		bus->pcie_sh = MALLOC(osh, sizeof(pciedev_shared_t));
+		if (!bus->pcie_sh) {
+			DHD_ERROR(("%s: MALLOC of bus->pcie_sh failed\n", __FUNCTION__));
+			break;
+		}
+
+		/* dhd_common_init(osh); */
+		if (dhdpcie_dongle_attach(bus)) {
+			DHD_ERROR(("%s: dhdpcie_probe_attach failed\n", __FUNCTION__));
+			break;
+		}
+
+		/* software resources */
+		if (!(bus->dhd = dhd_attach(osh, bus, PCMSGBUF_HDRLEN))) {
+			DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+
+			break;
+		}
+		bus->dhd->busstate = DHD_BUS_DOWN;
+		bus->db1_for_mb = TRUE;
+		bus->dhd->hang_report  = TRUE;
+
+		DHD_TRACE(("%s: EXIT SUCCESS\n",
+			__FUNCTION__));
+
+		return bus;
+	} while (0);
+
+	DHD_TRACE(("%s: EXIT FAILURE\n", __FUNCTION__));
+
+	if (bus && bus->pcie_sh)
+		MFREE(osh, bus->pcie_sh, sizeof(pciedev_shared_t));
+
+	if (bus)
+		MFREE(osh, bus, sizeof(dhd_bus_t));
+
+	return NULL;
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+	ASSERT(bus->sih != NULL);
+	return bus->sih->chip;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+	ASSERT(bus);
+	ASSERT(bus->sih != NULL);
+	return bus->sih->chiprev;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+	return bus->dhd;
+}
+
+void *
+dhd_bus_sih(struct dhd_bus *bus)
+{
+	return (void *)bus->sih;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+	return &bus->txq;
+}
+
+/* Get Chip ID version */
+uint dhd_bus_chip_id(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	return  bus->sih->chip;
+}
+
+/* Get Chip Rev ID version */
+uint dhd_bus_chiprev_id(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	return bus->sih->chiprev;
+}
+
+/* Get Chip Pkg ID version */
+uint dhd_bus_chippkg_id(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	return bus->sih->chippkg;
+}
+
+
+/*
+
+Name:  dhdpcie_bus_isr
+
+Parametrs:
+
+1: IN int irq   -- interrupt vector
+2: IN void *arg      -- handle to private data structure
+
+Return value:
+
+Status (TRUE or FALSE)
+
+Description:
+Interrupt Service routine checks for the status register,
+disable interrupt and queue DPC if mail box interrupts are raised.
+*/
+
+
+int32
+dhdpcie_bus_isr(dhd_bus_t *bus)
+{
+
+	do {
+			DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+			/* verify argument */
+			if (!bus) {
+				DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
+				break;
+			}
+
+			if (bus->dhd->busstate == DHD_BUS_DOWN) {
+				DHD_TRACE(("%s : bus is down. we have nothing to do\n",
+					__FUNCTION__));
+				break;
+			}
+
+			/*  Overall operation:
+			 *    - Mask further interrupts
+			 *    - Read/ack intstatus
+			 *    - Take action based on bits and state
+			 *    - Reenable interrupts (as per state)
+			 */
+
+			/* Count the interrupt call */
+			bus->intrcount++;
+
+			/* read interrupt status register!! Status bits will be cleared in DPC !! */
+			bus->ipend = TRUE;
+			dhdpcie_bus_intr_disable(bus); /* Disable interrupt!! */
+			bus->intdis = TRUE;
+
+#if defined(PCIE_ISR_THREAD)
+
+			DHD_TRACE(("Calling dhd_bus_dpc() from %s\n", __FUNCTION__));
+			DHD_OS_WAKE_LOCK(bus->dhd);
+			while (dhd_bus_dpc(bus));
+			DHD_OS_WAKE_UNLOCK(bus->dhd);
+#else
+			bus->dpc_sched = TRUE;
+			dhd_sched_dpc(bus->dhd);     /* queue DPC now!! */
+#endif /* defined(SDIO_ISR_THREAD) */
+
+			DHD_TRACE(("%s: Exit Success DPC Queued\n", __FUNCTION__));
+			return TRUE;
+
+	} while (0);
+
+	DHD_TRACE(("%s: Exit Failure\n", __FUNCTION__));
+	return FALSE;
+}
+
+static bool
+dhdpcie_dongle_attach(dhd_bus_t *bus)
+{
+
+	osl_t *osh = bus->osh;
+	void *regsva = (void*)bus->regs;
+	uint16 devid = bus->cl_devid;
+	uint32 val;
+	sbpcieregs_t *sbpcieregs;
+
+	DHD_TRACE(("%s: ENTER\n",
+		__FUNCTION__));
+
+
+	bus->alp_only = TRUE;
+	bus->sih = NULL;
+
+	/* Set bar0 window to si_enum_base */
+	dhdpcie_bus_cfg_set_bar0_win(bus, SI_ENUM_BASE);
+
+#ifdef CONFIG_ARCH_MSM8994
+	/* Read bar1 window */
+	bus->bar1_win_base = OSL_PCI_READ_CONFIG(bus->osh, PCI_BAR1_WIN, 4);
+	DHD_ERROR(("%s: PCI_BAR1_WIN = %x\n", __FUNCTION__, bus->bar1_win_base));
+#endif
+
+	/* si_attach() will provide an SI handle and scan the backplane */
+	if (!(bus->sih = si_attach((uint)devid, osh, regsva, PCI_BUS, bus,
+	                           &bus->vars, &bus->varsz))) {
+		DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+		goto fail;
+	}
+
+
+	si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+	sbpcieregs = (sbpcieregs_t*)(bus->regs);
+
+	/* WAR where the BAR1 window may not be sized properly */
+	W_REG(osh, &sbpcieregs->configaddr, 0x4e0);
+	val = R_REG(osh, &sbpcieregs->configdata);
+#ifdef CONFIG_ARCH_MSM8994
+	bus->bar1_win_mask = 0xffffffff - (bus->tcm_size - 1);
+	DHD_ERROR(("%s: BAR1 window val=%d mask=%x\n", __FUNCTION__, val, bus->bar1_win_mask));
+#endif
+	W_REG(osh, &sbpcieregs->configdata, val);
+
+	/* Get info on the ARM and SOCRAM cores... */
+	/* Should really be qualified by device id */
+	if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+	    (si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) ||
+	    (si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+		bus->armrev = si_corerev(bus->sih);
+	} else {
+		DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+		goto fail;
+	}
+
+	if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+		if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+			DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+			goto fail;
+		}
+	} else {
+		/* cr4 has a different way to find the RAM size from TCM's */
+		if (!(bus->orig_ramsize = si_tcm_size(bus->sih))) {
+			DHD_ERROR(("%s: failed to find CR4-TCM memory!\n", __FUNCTION__));
+			goto fail;
+		}
+		/* also populate base address */
+		switch ((uint16)bus->sih->chip) {
+		case BCM4339_CHIP_ID:
+		case BCM4335_CHIP_ID:
+			bus->dongle_ram_base = CR4_4335_RAM_BASE;
+			break;
+		case BCM4358_CHIP_ID:
+		case BCM4356_CHIP_ID:
+		case BCM4354_CHIP_ID:
+		case BCM43567_CHIP_ID:
+		case BCM43569_CHIP_ID:
+		case BCM4350_CHIP_ID:
+		case BCM43570_CHIP_ID:
+			bus->dongle_ram_base = CR4_4350_RAM_BASE;
+			break;
+		case BCM4360_CHIP_ID:
+			bus->dongle_ram_base = CR4_4360_RAM_BASE;
+			break;
+		case BCM4345_CHIP_ID:
+			bus->dongle_ram_base = (bus->sih->chiprev < 6)  /* changed at 4345C0 */
+				? CR4_4345_LT_C0_RAM_BASE : CR4_4345_GE_C0_RAM_BASE;
+			break;
+		case BCM43602_CHIP_ID:
+			bus->dongle_ram_base = CR4_43602_RAM_BASE;
+			break;
+		case BCM4349_CHIP_GRPID:
+			bus->dongle_ram_base = CR4_4349_RAM_BASE;
+			break;
+		default:
+			bus->dongle_ram_base = 0;
+			DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+			           __FUNCTION__, bus->dongle_ram_base));
+		}
+	}
+	bus->ramsize = bus->orig_ramsize;
+	if (dhd_dongle_memsize)
+		dhdpcie_bus_dongle_setmemsize(bus, dhd_dongle_memsize);
+
+	DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d) at 0x%x\n",
+	           bus->ramsize, bus->orig_ramsize, bus->dongle_ram_base));
+
+	bus->srmemsize = si_socram_srmem_size(bus->sih);
+
+
+	bus->def_intmask = PCIE_MB_D2H_MB_MASK | PCIE_MB_TOPCIE_FN0_0 | PCIE_MB_TOPCIE_FN0_1;
+
+	/* Set the poll and/or interrupt flags */
+	bus->intr = (bool)dhd_intr;
+
+	bus->wait_for_d3_ack = 1;
+	bus->suspended = FALSE;
+	DHD_TRACE(("%s: EXIT: SUCCESS\n",
+		__FUNCTION__));
+	return 0;
+
+fail:
+	if (bus->sih != NULL)
+		si_detach(bus->sih);
+	DHD_TRACE(("%s: EXIT: FAILURE\n",
+		__FUNCTION__));
+	return -1;
+}
+
+int
+dhpcie_bus_unmask_interrupt(dhd_bus_t *bus)
+{
+	dhdpcie_bus_cfg_write_dword(bus, PCIIntmask, 4, I_MB);
+	return 0;
+}
+int
+dhpcie_bus_mask_interrupt(dhd_bus_t *bus)
+{
+	dhdpcie_bus_cfg_write_dword(bus, PCIIntmask, 4, 0x0);
+	return 0;
+}
+
+void
+dhdpcie_bus_intr_enable(dhd_bus_t *bus)
+{
+	DHD_TRACE(("%s: enable interrupts\n", __FUNCTION__));
+
+	if (!bus || !bus->sih)
+		return;
+
+	if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+		(bus->sih->buscorerev == 4)) {
+		dhpcie_bus_unmask_interrupt(bus);
+	}
+	else if (bus->sih) {
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxMask,
+			bus->def_intmask, bus->def_intmask);
+	}
+}
+
+void
+dhdpcie_bus_intr_disable(dhd_bus_t *bus)
+{
+
+	DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+	if (!bus || !bus->sih)
+		return;
+
+	if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+		(bus->sih->buscorerev == 4)) {
+		dhpcie_bus_mask_interrupt(bus);
+	}
+	else if (bus->sih) {
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxMask,
+			bus->def_intmask, 0);
+	}
+
+	DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+void
+dhdpcie_bus_remove_prep(dhd_bus_t *bus)
+{
+	DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+	dhd_os_sdlock(bus->dhd);
+
+	bus->dhd->busstate = DHD_BUS_DOWN;
+	dhdpcie_bus_intr_disable(bus);
+	// terence 20150406: fix for null pointer handle
+	if (bus->sih)
+		pcie_watchdog_reset(bus->osh, bus->sih, (sbpcieregs_t *)(bus->regs));
+
+	dhd_os_sdunlock(bus->dhd);
+
+	DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+
+/* Detach and free everything */
+void
+dhdpcie_bus_release(dhd_bus_t *bus)
+{
+	bool dongle_isolation = FALSE;
+	osl_t *osh = NULL;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus) {
+
+		osh = bus->osh;
+		ASSERT(osh);
+
+		if (bus->dhd) {
+			dongle_isolation = bus->dhd->dongle_isolation;
+			if (bus->intr) {
+				dhdpcie_bus_intr_disable(bus);
+				dhdpcie_free_irq(bus);
+			}
+			dhd_detach(bus->dhd);
+			dhdpcie_bus_release_dongle(bus, osh, dongle_isolation, TRUE);
+			dhd_free(bus->dhd);
+			bus->dhd = NULL;
+		}
+
+		/* unmap the regs and tcm here!! */
+		if (bus->regs) {
+			dhdpcie_bus_reg_unmap(osh, (ulong)bus->regs, DONGLE_REG_MAP_SIZE);
+			bus->regs = NULL;
+		}
+		if (bus->tcm) {
+			dhdpcie_bus_reg_unmap(osh, (ulong)bus->tcm, bus->tcm_size);
+			bus->tcm = NULL;
+		}
+
+		dhdpcie_bus_release_malloc(bus, osh);
+		/* Detach pcie shared structure */
+		if (bus->pcie_sh)
+			MFREE(osh, bus->pcie_sh, sizeof(pciedev_shared_t));
+
+#ifdef DHD_DEBUG
+
+		if (bus->console.buf != NULL)
+			MFREE(osh, bus->console.buf, bus->console.bufsize);
+#endif
+
+
+		/* Finally free bus info */
+		MFREE(osh, bus, sizeof(dhd_bus_t));
+
+	}
+
+	DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+
+}
+
+
+void
+dhdpcie_bus_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+
+	DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+		bus->dhd, bus->dhd->dongle_reset));
+
+	if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag) {
+		DHD_TRACE(("%s Exit\n", __FUNCTION__));
+		return;
+	}
+
+	if (bus->sih) {
+
+		if (!dongle_isolation)
+			pcie_watchdog_reset(bus->osh, bus->sih, (sbpcieregs_t *)(bus->regs));
+
+		if (bus->ltrsleep_on_unload) {
+			si_corereg(bus->sih, bus->sih->buscoreidx,
+				OFFSETOF(sbpcieregs_t, u.pcie2.ltr_state), ~0, 0);
+		}
+		si_detach(bus->sih);
+		// terence 20150420: fix for sih incorrectly handled in other function
+		bus->sih = NULL;
+		if (bus->vars && bus->varsz)
+			MFREE(osh, bus->vars, bus->varsz);
+		bus->vars = NULL;
+	}
+
+	DHD_TRACE(("%s Exit\n", __FUNCTION__));
+}
+
+uint32
+dhdpcie_bus_cfg_read_dword(dhd_bus_t *bus, uint32 addr, uint32 size)
+{
+	uint32 data = OSL_PCI_READ_CONFIG(bus->osh, addr, size);
+	return data;
+}
+
+/* 32 bit config write */
+void
+dhdpcie_bus_cfg_write_dword(dhd_bus_t *bus, uint32 addr, uint32 size, uint32 data)
+{
+	OSL_PCI_WRITE_CONFIG(bus->osh, addr, size, data);
+}
+
+void
+dhdpcie_bus_cfg_set_bar0_win(dhd_bus_t *bus, uint32 data)
+{
+	OSL_PCI_WRITE_CONFIG(bus->osh, PCI_BAR0_WIN, 4, data);
+}
+
+#ifdef CONFIG_ARCH_MSM8994
+void
+dhdpcie_bus_cfg_set_bar1_win(dhd_bus_t *bus, uint32 data)
+{
+	OSL_PCI_WRITE_CONFIG(bus->osh, PCI_BAR1_WIN, 4, data);
+}
+#endif
+
+void
+dhdpcie_bus_dongle_setmemsize(struct dhd_bus *bus, int mem_size)
+{
+	int32 min_size =  DONGLE_MIN_MEMSIZE;
+	/* Restrict the memsize to user specified limit */
+	DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
+		dhd_dongle_memsize, min_size));
+	if ((dhd_dongle_memsize > min_size) &&
+		(dhd_dongle_memsize < (int32)bus->orig_ramsize))
+		bus->ramsize = dhd_dongle_memsize;
+}
+
+void
+dhdpcie_bus_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd && bus->dhd->dongle_reset)
+		return;
+
+	if (bus->vars && bus->varsz) {
+		MFREE(osh, bus->vars, bus->varsz);
+		bus->vars = NULL;
+	}
+
+	DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+	return;
+
+}
+
+/* Stop bus module: clear pending frames, disable data flow */
+void dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+	uint32 status;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (!bus->dhd)
+		return;
+
+	if (bus->dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: already down by net_dev_reset\n", __FUNCTION__));
+		goto done;
+	}
+
+	bus->dhd->busstate = DHD_BUS_DOWN;
+	dhdpcie_bus_intr_disable(bus);
+	status =  dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+	dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, status);
+	if (!dhd_download_fw_on_driverload)
+		dhd_dpc_kill(bus->dhd);
+
+	/* Clear rx control and wake any waiters */
+	bus->rxlen = 0;
+	dhd_os_ioctl_resp_wake(bus->dhd);
+
+done:
+	return;
+}
+
+/* Watchdog timer function */
+bool dhd_bus_watchdog(dhd_pub_t *dhd)
+{
+#ifdef DHD_DEBUG
+	dhd_bus_t *bus;
+	bus = dhd->bus;
+
+
+
+	/* Poll for console output periodically */
+	if (dhd->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
+		bus->console.count += dhd_watchdog_ms;
+		if (bus->console.count >= dhd_console_ms) {
+			bus->console.count -= dhd_console_ms;
+			/* Make sure backplane clock is on */
+			if (dhdpcie_bus_readconsole(bus) < 0)
+				dhd_console_ms = 0;	/* On error, stop trying */
+		}
+	}
+#endif /* DHD_DEBUG */
+
+	return FALSE;
+}
+
+
+
+/* Download firmware image and nvram image */
+int
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path, char *pconf_path)
+{
+	int ret;
+
+	bus->fw_path = pfw_path;
+	bus->nv_path = pnv_path;
+	bus->dhd->conf_path = pconf_path;
+
+	ret = dhdpcie_download_firmware(bus, osh);
+
+	return ret;
+}
+
+static int
+dhdpcie_download_firmware(struct dhd_bus *bus, osl_t *osh)
+{
+	int ret = 0;
+
+	DHD_TRACE_HW4(("%s: firmware path=%s, nvram path=%s\n",
+		__FUNCTION__, bus->fw_path, bus->nv_path));
+
+	DHD_OS_WAKE_LOCK(bus->dhd);
+
+	/* External conf takes precedence if specified */
+	dhd_conf_preinit(bus->dhd);
+	dhd_conf_read_config(bus->dhd, bus->dhd->conf_path);
+	dhd_conf_set_fw_name_by_chip(bus->dhd, bus->fw_path);
+	dhd_conf_set_nv_name_by_chip(bus->dhd, bus->nv_path);
+
+	printf("Final fw_path=%s\n", bus->fw_path);
+	printf("Final nv_path=%s\n", bus->nv_path);
+	printf("Final conf_path=%s\n", bus->dhd->conf_path);
+
+	ret = _dhdpcie_download_firmware(bus);
+
+	DHD_OS_WAKE_UNLOCK(bus->dhd);
+	return ret;
+}
+
+static int
+dhdpcie_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+	int bcmerror = -1;
+	int offset = 0;
+	int len;
+	void *image = NULL;
+	uint8 *memblock = NULL, *memptr;
+
+	DHD_ERROR(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+
+	/* Should succeed in opening image if it is actually given through registry
+	 * entry or in module param.
+	 */
+	image = dhd_os_open_image(pfw_path);
+	if (image == NULL) {
+		printf("%s: Open firmware file failed %s\n", __FUNCTION__, pfw_path);
+		goto err;
+	}
+
+	memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+	if (memblock == NULL) {
+		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+		goto err;
+	}
+	if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+		memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+	/* Download image */
+	while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, image))) {
+		if (len < 0) {
+			DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+			bcmerror = BCME_ERROR;
+			goto err;
+		}
+		/* check if CR4 */
+		if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			/* if address is 0, store the reset instruction to be written in 0 */
+
+			if (offset == 0) {
+				bus->resetinstr = *(((uint32*)memptr));
+				/* Add start of RAM address to the address given by user */
+				offset += bus->dongle_ram_base;
+			}
+		}
+
+		bcmerror = dhdpcie_bus_membytes(bus, TRUE, offset, memptr, len);
+		if (bcmerror) {
+			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+			        __FUNCTION__, bcmerror, MEMBLOCK, offset));
+			goto err;
+		}
+
+		offset += MEMBLOCK;
+	}
+
+err:
+	if (memblock)
+		MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+
+	if (image)
+		dhd_os_close_image(image);
+
+	return bcmerror;
+}
+
+
+static int
+dhdpcie_download_nvram(struct dhd_bus *bus)
+{
+	int bcmerror = -1;
+	uint len;
+	void * image = NULL;
+	char * memblock = NULL;
+	char *bufp;
+	char *pnv_path;
+	bool nvram_file_exists;
+
+	pnv_path = bus->nv_path;
+
+	nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+	if (!nvram_file_exists && (bus->nvram_params == NULL))
+		return (0);
+
+	if (nvram_file_exists) {
+		image = dhd_os_open_image(pnv_path);
+		if (image == NULL) {
+			printf("%s: Open nvram file failed %s\n", __FUNCTION__, pnv_path);
+			goto err;
+		}
+	}
+
+	memblock = MALLOC(bus->dhd->osh, MAX_NVRAMBUF_SIZE);
+	if (memblock == NULL) {
+		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+		           __FUNCTION__, MAX_NVRAMBUF_SIZE));
+		goto err;
+	}
+
+	/* Download variables */
+	if (nvram_file_exists) {
+		len = dhd_os_get_image_block(memblock, MAX_NVRAMBUF_SIZE, image);
+	}
+	else {
+
+		/* nvram is string with null terminated. cannot use strlen */
+		len = bus->nvram_params_len;
+		ASSERT(len <= MAX_NVRAMBUF_SIZE);
+		memcpy(memblock, bus->nvram_params, len);
+	}
+	if (len > 0 && len < MAX_NVRAMBUF_SIZE) {
+		bufp = (char *)memblock;
+		bufp[len] = 0;
+
+		if (nvram_file_exists)
+			len = process_nvram_vars(bufp, len);
+
+		if (len % 4) {
+			len += 4 - (len % 4);
+		}
+		bufp += len;
+		*bufp++ = 0;
+		if (len)
+			bcmerror = dhdpcie_downloadvars(bus, memblock, len + 1);
+		if (bcmerror) {
+			DHD_ERROR(("%s: error downloading vars: %d\n",
+			           __FUNCTION__, bcmerror));
+		}
+	}
+	else {
+		DHD_ERROR(("%s: error reading nvram file: %d\n",
+		           __FUNCTION__, len));
+		bcmerror = BCME_ERROR;
+	}
+
+err:
+	if (memblock)
+		MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+
+	if (image)
+		dhd_os_close_image(image);
+
+	return bcmerror;
+}
+
+
+#ifdef BCMEMBEDIMAGE
+int
+dhdpcie_download_code_array(struct dhd_bus *bus)
+{
+	int bcmerror = -1;
+	int offset = 0;
+	unsigned char *p_dlarray  = NULL;
+	unsigned int dlarray_size = 0;
+	unsigned int downloded_len, remaining_len, len;
+	char *p_dlimagename, *p_dlimagever, *p_dlimagedate;
+	uint8 *memblock = NULL, *memptr;
+
+	downloded_len = 0;
+	remaining_len = 0;
+	len = 0;
+
+	p_dlarray = dlarray;
+	dlarray_size = sizeof(dlarray);
+	p_dlimagename = dlimagename;
+	p_dlimagever  = dlimagever;
+	p_dlimagedate = dlimagedate;
+
+	if ((p_dlarray == 0) ||	(dlarray_size == 0) ||(dlarray_size > bus->ramsize) ||
+		(p_dlimagename == 0) ||	(p_dlimagever  == 0) ||	(p_dlimagedate == 0))
+		goto err;
+
+	memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+	if (memblock == NULL) {
+		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+		goto err;
+	}
+	if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+		memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+	while (downloded_len  < dlarray_size) {
+		remaining_len = dlarray_size - downloded_len;
+		if (remaining_len >= MEMBLOCK)
+			len = MEMBLOCK;
+		else
+			len = remaining_len;
+
+		memcpy(memptr, (p_dlarray + downloded_len), len);
+		/* check if CR4 */
+		if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			/* if address is 0, store the reset instruction to be written in 0 */
+			if (offset == 0) {
+				bus->resetinstr = *(((uint32*)memptr));
+				/* Add start of RAM address to the address given by user */
+				offset += bus->dongle_ram_base;
+			}
+		}
+		bcmerror = dhdpcie_bus_membytes(bus, TRUE, offset, (uint8 *)memptr, len);
+		downloded_len += len;
+		if (bcmerror) {
+			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+				__FUNCTION__, bcmerror, MEMBLOCK, offset));
+			goto err;
+		}
+		offset += MEMBLOCK;
+	}
+
+#ifdef DHD_DEBUG
+	/* Upload and compare the downloaded code */
+	{
+		unsigned char *ularray = NULL;
+		unsigned int uploded_len;
+		uploded_len = 0;
+		bcmerror = -1;
+		ularray = MALLOC(bus->dhd->osh, dlarray_size);
+		if (ularray == NULL)
+			goto upload_err;
+		/* Upload image to verify downloaded contents. */
+		offset = bus->dongle_ram_base;
+		memset(ularray, 0xaa, dlarray_size);
+		while (uploded_len  < dlarray_size) {
+			remaining_len = dlarray_size - uploded_len;
+			if (remaining_len >= MEMBLOCK)
+				len = MEMBLOCK;
+			else
+				len = remaining_len;
+			bcmerror = dhdpcie_bus_membytes(bus, FALSE, offset,
+				(uint8 *)(ularray + uploded_len), len);
+			if (bcmerror) {
+				DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+					__FUNCTION__, bcmerror, MEMBLOCK, offset));
+				goto upload_err;
+			}
+
+			uploded_len += len;
+			offset += MEMBLOCK;
+		}
+
+		if (memcmp(p_dlarray, ularray, dlarray_size)) {
+			DHD_ERROR(("%s: Downloaded image is corrupted (%s, %s, %s).\n",
+				__FUNCTION__, p_dlimagename, p_dlimagever, p_dlimagedate));
+			goto upload_err;
+
+		} else
+			DHD_ERROR(("%s: Download, Upload and compare succeeded (%s, %s, %s).\n",
+				__FUNCTION__, p_dlimagename, p_dlimagever, p_dlimagedate));
+upload_err:
+		if (ularray)
+			MFREE(bus->dhd->osh, ularray, dlarray_size);
+	}
+#endif /* DHD_DEBUG */
+err:
+
+	if (memblock)
+		MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+
+	return bcmerror;
+}
+#endif /* BCMEMBEDIMAGE */
+
+
+static int
+_dhdpcie_download_firmware(struct dhd_bus *bus)
+{
+	int bcmerror = -1;
+
+	bool embed = FALSE;	/* download embedded firmware */
+	bool dlok = FALSE;	/* download firmware succeeded */
+
+	/* Out immediately if no image to download */
+	if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+#ifdef BCMEMBEDIMAGE
+		embed = TRUE;
+#else
+		DHD_ERROR(("%s: no fimrware file\n", __FUNCTION__));
+		return 0;
+#endif
+	}
+
+	/* Keep arm in reset */
+	if (dhdpcie_bus_download_state(bus, TRUE)) {
+		DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+		goto err;
+	}
+
+	/* External image takes precedence if specified */
+	if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+		if (dhdpcie_download_code_file(bus, bus->fw_path)) {
+			DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
+#ifdef BCMEMBEDIMAGE
+			embed = TRUE;
+#else
+			goto err;
+#endif
+		}
+		else {
+			embed = FALSE;
+			dlok = TRUE;
+		}
+	}
+
+#ifdef BCMEMBEDIMAGE
+	if (embed) {
+		if (dhdpcie_download_code_array(bus)) {
+			DHD_ERROR(("%s: dongle image array download failed\n", __FUNCTION__));
+			goto err;
+		}
+		else {
+			dlok = TRUE;
+		}
+	}
+#else
+	BCM_REFERENCE(embed);
+#endif
+	if (!dlok) {
+		DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
+		goto err;
+	}
+
+	/* EXAMPLE: nvram_array */
+	/* If a valid nvram_arry is specified as above, it can be passed down to dongle */
+	/* dhd_bus_set_nvram_params(bus, (char *)&nvram_array); */
+
+
+	/* External nvram takes precedence if specified */
+	if (dhdpcie_download_nvram(bus)) {
+		DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
+		goto err;
+	}
+
+	/* Take arm out of reset */
+	if (dhdpcie_bus_download_state(bus, FALSE)) {
+		DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+		goto err;
+	}
+
+	bcmerror = 0;
+
+err:
+	return bcmerror;
+}
+
+int dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+	int timeleft;
+	uint rxlen = 0;
+	bool pending;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd->dongle_reset)
+		return -EIO;
+
+	/* Wait until control frame is available */
+	timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen, &pending);
+	rxlen = bus->rxlen;
+	bcopy(&bus->ioct_resp, msg, MIN(rxlen, sizeof(ioctl_comp_resp_msg_t)));
+	bus->rxlen = 0;
+
+	if (rxlen) {
+		DHD_CTL(("%s: resumed on rxctl frame, got %d\n", __FUNCTION__, rxlen));
+	} else if (timeleft == 0) {
+		DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
+		bus->ioct_resp.cmn_hdr.request_id = 0;
+		bus->ioct_resp.compl_hdr.status = 0xffff;
+		bus->dhd->rxcnt_timeout++;
+		DHD_ERROR(("%s: rxcnt_timeout=%d\n", __FUNCTION__, bus->dhd->rxcnt_timeout));
+	} else if (pending == TRUE) {
+		DHD_CTL(("%s: canceled\n", __FUNCTION__));
+		return -ERESTARTSYS;
+	} else {
+		DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
+	}
+
+	if (timeleft != 0)
+		bus->dhd->rxcnt_timeout = 0;
+
+	if (rxlen)
+		bus->dhd->rx_ctlpkts++;
+	else
+		bus->dhd->rx_ctlerrs++;
+
+	if (bus->dhd->rxcnt_timeout >= MAX_CNTL_TX_TIMEOUT)
+		return -ETIMEDOUT;
+
+	if (bus->dhd->dongle_trap_occured)
+		return -EREMOTEIO;
+
+	return rxlen ? (int)rxlen : -EIO;
+
+}
+
+#define CONSOLE_LINE_MAX	192
+
+#ifdef DHD_DEBUG
+static int
+dhdpcie_bus_readconsole(dhd_bus_t *bus)
+{
+	dhd_console_t *c = &bus->console;
+	uint8 line[CONSOLE_LINE_MAX], ch;
+	uint32 n, idx, addr;
+	int rv;
+
+	/* Don't do anything until FWREADY updates console address */
+	if (bus->console_addr == 0)
+		return -1;
+
+	/* Read console log struct */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, log);
+
+	if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+		return rv;
+
+	/* Allocate console buffer (one time only) */
+	if (c->buf == NULL) {
+		c->bufsize = ltoh32(c->log.buf_size);
+		if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+			return BCME_NOMEM;
+	}
+	idx = ltoh32(c->log.idx);
+
+	/* Protect against corrupt value */
+	if (idx > c->bufsize)
+		return BCME_ERROR;
+
+	/* Skip reading the console buffer if the index pointer has not moved */
+	if (idx == c->last)
+		return BCME_OK;
+
+	/* Read the console buffer */
+	addr = ltoh32(c->log.buf);
+	if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
+		return rv;
+
+	while (c->last != idx) {
+		for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+			if (c->last == idx) {
+				/* This would output a partial line.  Instead, back up
+				 * the buffer pointer and output this line next time around.
+				 */
+				if (c->last >= n)
+					c->last -= n;
+				else
+					c->last = c->bufsize - n;
+				goto break2;
+			}
+			ch = c->buf[c->last];
+			c->last = (c->last + 1) % c->bufsize;
+			if (ch == '\n')
+				break;
+			line[n] = ch;
+		}
+
+		if (n > 0) {
+			if (line[n - 1] == '\r')
+				n--;
+			line[n] = 0;
+			printf("CONSOLE: %s\n", line);
+		}
+	}
+break2:
+
+	return BCME_OK;
+}
+
+static int
+dhdpcie_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+	int bcmerror = 0;
+	uint msize = 512;
+	char *mbuffer = NULL;
+	char *console_buffer = NULL;
+	uint maxstrlen = 256;
+	char *str = NULL;
+	trap_t tr;
+	pciedev_shared_t *pciedev_shared = bus->pcie_sh;
+	struct bcmstrbuf strbuf;
+	uint32 console_ptr, console_size, console_index;
+	uint8 line[CONSOLE_LINE_MAX], ch;
+	uint32 n, i, addr;
+	int rv;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (DHD_NOCHECKDIED_ON())
+		return 0;
+
+	if (data == NULL) {
+		/*
+		 * Called after a rx ctrl timeout. "data" is NULL.
+		 * allocate memory to trace the trap or assert.
+		 */
+		size = msize;
+		mbuffer = data = MALLOC(bus->dhd->osh, msize);
+
+		if (mbuffer == NULL) {
+			DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+			bcmerror = BCME_NOMEM;
+			goto done;
+		}
+	}
+
+	if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+		DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+		bcmerror = BCME_NOMEM;
+		goto done;
+	}
+
+	if ((bcmerror = dhdpcie_readshared(bus)) < 0)
+		goto done;
+
+	bcm_binit(&strbuf, data, size);
+
+	bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+	            pciedev_shared->msgtrace_addr, pciedev_shared->console_addr);
+
+	if ((pciedev_shared->flags & PCIE_SHARED_ASSERT_BUILT) == 0) {
+		/* NOTE: Misspelled assert is intentional - DO NOT FIX.
+		 * (Avoids conflict with real asserts for programmatic parsing of output.)
+		 */
+		bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+	}
+
+	if ((bus->pcie_sh->flags & (PCIE_SHARED_ASSERT|PCIE_SHARED_TRAP)) == 0) {
+		/* NOTE: Misspelled assert is intentional - DO NOT FIX.
+		 * (Avoids conflict with real asserts for programmatic parsing of output.)
+		 */
+		bcm_bprintf(&strbuf, "No trap%s in dongle",
+		          (bus->pcie_sh->flags & PCIE_SHARED_ASSERT_BUILT)
+		          ?"/assrt" :"");
+	} else {
+		if (bus->pcie_sh->flags & PCIE_SHARED_ASSERT) {
+			/* Download assert */
+			bcm_bprintf(&strbuf, "Dongle assert");
+			if (bus->pcie_sh->assert_exp_addr != 0) {
+				str[0] = '\0';
+				if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+				                                  bus->pcie_sh->assert_exp_addr,
+				                                 (uint8 *)str, maxstrlen)) < 0)
+					goto done;
+
+				str[maxstrlen - 1] = '\0';
+				bcm_bprintf(&strbuf, " expr \"%s\"", str);
+			}
+
+			if (bus->pcie_sh->assert_file_addr != 0) {
+				str[0] = '\0';
+				if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+				                                  bus->pcie_sh->assert_file_addr,
+				                                 (uint8 *)str, maxstrlen)) < 0)
+					goto done;
+
+				str[maxstrlen - 1] = '\0';
+				bcm_bprintf(&strbuf, " file \"%s\"", str);
+			}
+
+			bcm_bprintf(&strbuf, " line %d ",  bus->pcie_sh->assert_line);
+		}
+
+		if (bus->pcie_sh->flags & PCIE_SHARED_TRAP) {
+			bus->dhd->dongle_trap_occured = TRUE;
+			if ((bcmerror = dhdpcie_bus_membytes(bus, FALSE,
+			                                  bus->pcie_sh->trap_addr,
+			                                 (uint8*)&tr, sizeof(trap_t))) < 0)
+				goto done;
+
+			bcm_bprintf(&strbuf,
+			"Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+			            "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
+			"r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+			"r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
+			ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
+			ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
+			ltoh32(bus->pcie_sh->trap_addr),
+			ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
+			ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
+
+			addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log);
+			if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+				(uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
+				goto printbuf;
+
+			addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log.buf_size);
+			if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+				(uint8 *)&console_size, sizeof(console_size))) < 0)
+				goto printbuf;
+
+			addr =  bus->pcie_sh->console_addr + OFFSETOF(hnd_cons_t, log.idx);
+			if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr,
+				(uint8 *)&console_index, sizeof(console_index))) < 0)
+				goto printbuf;
+
+			console_ptr = ltoh32(console_ptr);
+			console_size = ltoh32(console_size);
+			console_index = ltoh32(console_index);
+
+			if (console_size > CONSOLE_BUFFER_MAX ||
+				!(console_buffer = MALLOC(bus->dhd->osh, console_size)))
+				goto printbuf;
+
+			if ((rv = dhdpcie_bus_membytes(bus, FALSE, console_ptr,
+				(uint8 *)console_buffer, console_size)) < 0)
+				goto printbuf;
+
+			for (i = 0, n = 0; i < console_size; i += n + 1) {
+				for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+					ch = console_buffer[(console_index + i + n) % console_size];
+					if (ch == '\n')
+						break;
+					line[n] = ch;
+				}
+
+
+				if (n > 0) {
+					if (line[n - 1] == '\r')
+						n--;
+					line[n] = 0;
+					/* Don't use DHD_ERROR macro since we print
+					 * a lot of information quickly. The macro
+					 * will truncate a lot of the printfs
+					 */
+
+					if (dhd_msg_level & DHD_ERROR_VAL)
+						printf("CONSOLE: %s\n", line);
+				}
+			}
+		}
+	}
+
+printbuf:
+	if (bus->pcie_sh->flags & (PCIE_SHARED_ASSERT | PCIE_SHARED_TRAP)) {
+		DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
+	}
+
+done:
+	if (mbuffer)
+		MFREE(bus->dhd->osh, mbuffer, msize);
+	if (str)
+		MFREE(bus->dhd->osh, str, maxstrlen);
+
+	if (console_buffer)
+		MFREE(bus->dhd->osh, console_buffer, console_size);
+
+	return bcmerror;
+}
+#endif /* DHD_DEBUG */
+
+
+/**
+ * Transfers bytes from host to dongle using pio mode.
+ * Parameter 'address' is a backplane address.
+ */
+static int
+dhdpcie_bus_membytes(dhd_bus_t *bus, bool write, ulong address, uint8 *data, uint size)
+{
+	int bcmerror = 0;
+	uint dsize;
+	int detect_endian_flag = 0x01;
+	bool little_endian;
+#ifdef CONFIG_ARCH_MSM8994
+	bool is_64bit_unaligned;
+#endif
+
+	/* Detect endianness. */
+	little_endian = *(char *)&detect_endian_flag;
+
+#ifdef CONFIG_ARCH_MSM8994
+	/* Check 64bit aligned or not. */
+	is_64bit_unaligned = (address & 0x7);
+#endif
+	/* In remap mode, adjust address beyond socram and redirect
+	 * to devram at SOCDEVRAM_BP_ADDR since remap address > orig_ramsize
+	 * is not backplane accessible
+	 */
+
+	/* Determine initial transfer parameters */
+	dsize = sizeof(uint64);
+
+	/* Do the transfer(s) */
+	if (write) {
+		while (size) {
+			if (size >= sizeof(uint64) && little_endian) {
+#ifdef CONFIG_ARCH_MSM8994
+				if (is_64bit_unaligned) {
+					DHD_INFO(("%s: write unaligned %lx\n",
+					    __FUNCTION__, address));
+					dhdpcie_bus_wtcm32(bus, address, *((uint32 *)data));
+					data += 4;
+					size -= 4;
+					address += 4;
+					is_64bit_unaligned = (address & 0x7);
+					continue;
+				}
+				else
+#endif
+				dhdpcie_bus_wtcm64(bus, address, *((uint64 *)data));
+			} else {
+				dsize = sizeof(uint8);
+				dhdpcie_bus_wtcm8(bus, address, *data);
+			}
+
+			/* Adjust for next transfer (if any) */
+			if ((size -= dsize)) {
+				data += dsize;
+				address += dsize;
+			}
+		}
+	} else {
+		while (size) {
+			if (size >= sizeof(uint64) && little_endian) {
+#ifdef CONFIG_ARCH_MSM8994
+				if (is_64bit_unaligned) {
+					DHD_INFO(("%s: read unaligned %lx\n",
+					    __FUNCTION__, address));
+					*(uint32 *)data = dhdpcie_bus_rtcm32(bus, address);
+					data += 4;
+					size -= 4;
+					address += 4;
+					is_64bit_unaligned = (address & 0x7);
+					continue;
+				}
+				else
+#endif
+				*(uint64 *)data = dhdpcie_bus_rtcm64(bus, address);
+			} else {
+				dsize = sizeof(uint8);
+				*data = dhdpcie_bus_rtcm8(bus, address);
+			}
+
+			/* Adjust for next transfer (if any) */
+			if ((size -= dsize) > 0) {
+				data += dsize;
+				address += dsize;
+			}
+		}
+	}
+	return bcmerror;
+}
+
+int BCMFASTPATH
+dhd_bus_schedule_queue(struct dhd_bus  *bus, uint16 flow_id, bool txs)
+{
+	flow_ring_node_t *flow_ring_node;
+	int ret = BCME_OK;
+
+	DHD_INFO(("%s: flow_id is %d\n", __FUNCTION__, flow_id));
+	/* ASSERT on flow_id */
+	if (flow_id >= bus->max_sub_queues) {
+		DHD_ERROR(("%s: flow_id is invalid %d, max %d\n", __FUNCTION__,
+			flow_id, bus->max_sub_queues));
+		return 0;
+	}
+
+	flow_ring_node = DHD_FLOW_RING(bus->dhd, flow_id);
+
+	{
+		unsigned long flags;
+		void *txp = NULL;
+		flow_queue_t *queue;
+
+		queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+		DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+		if (flow_ring_node->status != FLOW_RING_STATUS_OPEN) {
+			DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+			return BCME_NOTREADY;
+		}
+
+		while ((txp = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+			PKTORPHAN(txp);
+
+#ifdef DHDTCPACK_SUPPRESS
+		if (bus->dhd->tcpack_sup_mode != TCPACK_SUP_HOLD) {
+			dhd_tcpack_check_xmit(bus->dhd, txp);
+		}
+#endif /* DHDTCPACK_SUPPRESS */
+			/* Attempt to transfer packet over flow ring */
+
+			ret = dhd_prot_txdata(bus->dhd, txp, flow_ring_node->flow_info.ifindex);
+			if (ret != BCME_OK) { /* may not have resources in flow ring */
+				DHD_INFO(("%s: Reinserrt %d\n", __FUNCTION__, ret));
+				dhd_prot_txdata_write_flush(bus->dhd, flow_id, FALSE);
+				/* reinsert at head */
+				dhd_flow_queue_reinsert(bus->dhd, queue, txp);
+				DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+				/* If we are able to requeue back, return success */
+				return BCME_OK;
+			}
+		}
+
+		dhd_prot_txdata_write_flush(bus->dhd, flow_id, FALSE);
+
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+	}
+
+	return ret;
+}
+
+#ifndef PCIE_TX_DEFERRAL
+/* Send a data frame to the dongle.  Callee disposes of txp. */
+int BCMFASTPATH
+dhd_bus_txdata(struct dhd_bus *bus, void *txp, uint8 ifidx)
+{
+	unsigned long flags;
+	int ret = BCME_OK;
+	void *txp_pend = NULL;
+	if (!bus->txmode_push) {
+		uint16 flowid;
+		flow_queue_t *queue;
+		flow_ring_node_t *flow_ring_node;
+		if (!bus->dhd->flowid_allocator) {
+			DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+			goto toss;
+		}
+
+		flowid = DHD_PKTTAG_FLOWID((dhd_pkttag_fr_t*)PKTTAG(txp));
+
+		flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+
+		DHD_TRACE(("%s: pkt flowid %d, status %d active %d\n",
+			__FUNCTION__, flowid, flow_ring_node->status,
+			flow_ring_node->active));
+
+		if ((flowid >= bus->dhd->num_flow_rings) ||
+			(!flow_ring_node->active) ||
+			(flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING)) {
+			DHD_INFO(("%s: Dropping pkt flowid %d, status %d active %d\n",
+				__FUNCTION__, flowid, flow_ring_node->status,
+				flow_ring_node->active));
+			ret = BCME_ERROR;
+			goto toss;
+		}
+
+		queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+		DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+		if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp)) != BCME_OK)
+			txp_pend = txp;
+
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+		if (flow_ring_node->status) {
+			DHD_INFO(("%s: Enq pkt flowid %d, status %d active %d\n",
+			    __FUNCTION__, flowid, flow_ring_node->status,
+			    flow_ring_node->active));
+			if (txp_pend) {
+				txp = txp_pend;
+				goto toss;
+			}
+			return BCME_OK;
+		}
+		ret = dhd_bus_schedule_queue(bus, flowid, FALSE);
+
+		/* If we have anything pending, try to push into q */
+		if (txp_pend) {
+			DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+			if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp_pend)) != BCME_OK) {
+				DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+				txp = txp_pend;
+				goto toss;
+			}
+
+			DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+		}
+
+		return ret;
+
+	} else { /* bus->txmode_push */
+		return dhd_prot_txdata(bus->dhd, txp, ifidx);
+	}
+
+toss:
+	DHD_INFO(("%s: Toss %d\n", __FUNCTION__, ret));
+	PKTCFREE(bus->dhd->osh, txp, TRUE);
+	return ret;
+}
+#else /* PCIE_TX_DEFERRAL */
+int BCMFASTPATH
+dhd_bus_txdata(struct dhd_bus *bus, void *txp, uint8 ifidx)
+{
+	unsigned long flags;
+	int ret = BCME_OK;
+	uint16 flowid;
+	flow_queue_t *queue;
+	flow_ring_node_t *flow_ring_node;
+	uint8 *pktdata = (uint8 *)PKTDATA(bus->dhd->osh, txp);
+	struct ether_header *eh = (struct ether_header *)pktdata;
+
+	if (!bus->dhd->flowid_allocator) {
+		DHD_ERROR(("%s: Flow ring not intited yet  \n", __FUNCTION__));
+		goto toss;
+	}
+
+	flowid = dhd_flowid_find(bus->dhd, ifidx,
+		bus->dhd->flow_prio_map[(PKTPRIO(txp))],
+		eh->ether_shost, eh->ether_dhost);
+	if (flowid == FLOWID_INVALID) {
+		DHD_PKTTAG_SET_FLOWID((dhd_pkttag_fr_t *)PKTTAG(txp), ifidx);
+		skb_queue_tail(&bus->orphan_list, txp);
+		queue_work(bus->tx_wq, &bus->create_flow_work);
+		return BCME_OK;
+	}
+
+	DHD_PKTTAG_SET_FLOWID((dhd_pkttag_fr_t *)PKTTAG(txp), flowid);
+	flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+	queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+	DHD_DATA(("%s: pkt flowid %d, status %d active %d\n",
+		__FUNCTION__, flowid, flow_ring_node->status,
+		flow_ring_node->active));
+
+	DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+	if ((flowid >= bus->dhd->num_flow_rings) ||
+		(!flow_ring_node->active) ||
+		(flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING)) {
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+		DHD_DATA(("%s: Dropping pkt flowid %d, status %d active %d\n",
+			__FUNCTION__, flowid, flow_ring_node->status,
+			flow_ring_node->active));
+		ret = BCME_ERROR;
+		goto toss;
+	}
+
+	if (flow_ring_node->status == FLOW_RING_STATUS_PENDING) {
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+		DHD_PKTTAG_SET_FLOWID((dhd_pkttag_fr_t *)PKTTAG(txp), ifidx);
+		skb_queue_tail(&bus->orphan_list, txp);
+		queue_work(bus->tx_wq, &bus->create_flow_work);
+		return BCME_OK;
+	}
+
+	if ((ret = dhd_flow_queue_enqueue(bus->dhd, queue, txp)) != BCME_OK) {
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+		goto toss;
+	}
+
+	DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+	ret = dhd_bus_schedule_queue(bus, flowid, FALSE);
+
+	return ret;
+
+toss:
+	DHD_DATA(("%s: Toss %d\n", __FUNCTION__, ret));
+	PKTCFREE(bus->dhd->osh, txp, TRUE);
+	return ret;
+}
+#endif /* !PCIE_TX_DEFERRAL */
+
+
+void
+dhd_bus_stop_queue(struct dhd_bus *bus)
+{
+	dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+	bus->bus_flowctrl = TRUE;
+}
+
+void
+dhd_bus_start_queue(struct dhd_bus *bus)
+{
+	dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+	bus->bus_flowctrl = TRUE;
+}
+
+void
+dhd_bus_update_retlen(dhd_bus_t *bus, uint32 retlen, uint32 pkt_id, uint16 status,
+	uint32 resp_len)
+{
+	bus->rxlen = retlen;
+	bus->ioct_resp.cmn_hdr.request_id = pkt_id;
+	bus->ioct_resp.compl_hdr.status = status;
+	bus->ioct_resp.resp_len = (uint16)resp_len;
+}
+
+#if defined(DHD_DEBUG)
+/* Device console input function */
+int dhd_bus_console_in(dhd_pub_t *dhd, uchar *msg, uint msglen)
+{
+	dhd_bus_t *bus = dhd->bus;
+	uint32 addr, val;
+	int rv;
+	/* Address could be zero if CONSOLE := 0 in dongle Makefile */
+	if (bus->console_addr == 0)
+		return BCME_UNSUPPORTED;
+
+	/* Don't allow input if dongle is in reset */
+	if (bus->dhd->dongle_reset) {
+		dhd_os_sdunlock(bus->dhd);
+		return BCME_NOTREADY;
+	}
+
+	/* Zero cbuf_index */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf_idx);
+	val = htol32(0);
+	if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+		goto done;
+
+	/* Write message into cbuf */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf);
+	if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+		goto done;
+
+	/* Write length into vcons_in */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, vcons_in);
+	val = htol32(msglen);
+	if ((rv = dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+		goto done;
+
+	/* generate an interurpt to dongle to indicate that it needs to process cons command */
+	dhdpcie_send_mb_data(bus, H2D_HOST_CONS_INT);
+done:
+	return rv;
+}
+#endif /* defined(DHD_DEBUG) */
+
+/* Process rx frame , Send up the layer to netif */
+void BCMFASTPATH
+dhd_bus_rx_frame(struct dhd_bus *bus, void* pkt, int ifidx, uint pkt_count)
+{
+	dhd_rx_frame(bus->dhd, ifidx, pkt, pkt_count, 0);
+}
+
+#ifdef CONFIG_ARCH_MSM8994
+static ulong dhd_bus_cmn_check_offset(dhd_bus_t *bus, ulong offset)
+{
+	uint new_bar1_wbase = 0;
+	ulong address = 0;
+
+	new_bar1_wbase = (uint)offset & bus->bar1_win_mask;
+	if (bus->bar1_win_base != new_bar1_wbase) {
+		bus->bar1_win_base = new_bar1_wbase;
+		dhdpcie_bus_cfg_set_bar1_win(bus, bus->bar1_win_base);
+		DHD_ERROR(("%s: offset=%lx, switch bar1_win_base to %x\n",
+		    __FUNCTION__, offset, bus->bar1_win_base));
+	}
+
+	address = offset - bus->bar1_win_base;
+
+	return address;
+}
+#else
+#define dhd_bus_cmn_check_offset(x, y) y
+#endif /* CONFIG_ARCH_MSM8994 */
+
+/** 'offset' is a backplane address */
+void
+dhdpcie_bus_wtcm8(dhd_bus_t *bus, ulong offset, uint8 data)
+{
+	*(volatile uint8 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)) = (uint8)data;
+}
+
+uint8
+dhdpcie_bus_rtcm8(dhd_bus_t *bus, ulong offset)
+{
+	volatile uint8 data;
+#ifdef BCM47XX_ACP_WAR
+	data = R_REG(bus->dhd->osh,
+	    (volatile uint8 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)));
+#else
+	data = *(volatile uint8 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset));
+#endif
+	return data;
+}
+
+void
+dhdpcie_bus_wtcm32(dhd_bus_t *bus, ulong offset, uint32 data)
+{
+	*(volatile uint32 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)) = (uint32)data;
+}
+void
+dhdpcie_bus_wtcm16(dhd_bus_t *bus, ulong offset, uint16 data)
+{
+	*(volatile uint16 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)) = (uint16)data;
+}
+void
+dhdpcie_bus_wtcm64(dhd_bus_t *bus, ulong offset, uint64 data)
+{
+	*(volatile uint64 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)) = (uint64)data;
+}
+
+uint16
+dhdpcie_bus_rtcm16(dhd_bus_t *bus, ulong offset)
+{
+	volatile uint16 data;
+#ifdef BCM47XX_ACP_WAR
+	data = R_REG(bus->dhd->osh,
+	    (volatile uint16 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)));
+#else
+	data = *(volatile uint16 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset));
+#endif
+	return data;
+}
+
+uint32
+dhdpcie_bus_rtcm32(dhd_bus_t *bus, ulong offset)
+{
+	volatile uint32 data;
+#ifdef BCM47XX_ACP_WAR
+	data = R_REG(bus->dhd->osh,
+	    (volatile uint32 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)));
+#else
+	data = *(volatile uint32 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset));
+#endif
+	return data;
+}
+
+uint64
+dhdpcie_bus_rtcm64(dhd_bus_t *bus, ulong offset)
+{
+	volatile uint64 data;
+#ifdef BCM47XX_ACP_WAR
+	data = R_REG(bus->dhd->osh,
+	    (volatile uint64 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset)));
+#else
+	data = *(volatile uint64 *)(bus->tcm + dhd_bus_cmn_check_offset(bus, offset));
+#endif
+	return data;
+}
+
+void
+dhd_bus_cmn_writeshared(dhd_bus_t *bus, void * data, uint32 len, uint8 type, uint16 ringid)
+{
+	uint64 long_data;
+	ulong tcm_offset;
+	pciedev_shared_t *sh;
+	pciedev_shared_t *shmem = NULL;
+
+	sh = (pciedev_shared_t*)bus->shared_addr;
+
+	DHD_INFO(("%s: writing to msgbuf type %d, len %d\n", __FUNCTION__, type, len));
+
+	switch (type) {
+		case DNGL_TO_HOST_DMA_SCRATCH_BUFFER:
+			long_data = HTOL64(*(uint64 *)data);
+			tcm_offset = (ulong)&(sh->host_dma_scratch_buffer);
+			dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case DNGL_TO_HOST_DMA_SCRATCH_BUFFER_LEN :
+			tcm_offset = (ulong)&(sh->host_dma_scratch_buffer_len);
+			dhdpcie_bus_wtcm32(bus, tcm_offset, (uint32) HTOL32(*(uint32 *)data));
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case HOST_TO_DNGL_DMA_WRITEINDX_BUFFER:
+			/* ring_info_ptr stored in pcie_sh */
+			shmem = (pciedev_shared_t *)bus->pcie_sh;
+
+			long_data = HTOL64(*(uint64 *)data);
+			tcm_offset = (ulong)shmem->rings_info_ptr;
+			tcm_offset += OFFSETOF(ring_info_t, h2d_w_idx_hostaddr);
+			dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case HOST_TO_DNGL_DMA_READINDX_BUFFER:
+			/* ring_info_ptr stored in pcie_sh */
+			shmem = (pciedev_shared_t *)bus->pcie_sh;
+
+			long_data = HTOL64(*(uint64 *)data);
+			tcm_offset = (ulong)shmem->rings_info_ptr;
+			tcm_offset += OFFSETOF(ring_info_t, h2d_r_idx_hostaddr);
+			dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case DNGL_TO_HOST_DMA_WRITEINDX_BUFFER:
+			/* ring_info_ptr stored in pcie_sh */
+			shmem = (pciedev_shared_t *)bus->pcie_sh;
+
+			long_data = HTOL64(*(uint64 *)data);
+			tcm_offset = (ulong)shmem->rings_info_ptr;
+			tcm_offset += OFFSETOF(ring_info_t, d2h_w_idx_hostaddr);
+			dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case DNGL_TO_HOST_DMA_READINDX_BUFFER:
+			/* ring_info_ptr stored in pcie_sh */
+			shmem = (pciedev_shared_t *)bus->pcie_sh;
+
+			long_data = HTOL64(*(uint64 *)data);
+			tcm_offset = (ulong)shmem->rings_info_ptr;
+			tcm_offset += OFFSETOF(ring_info_t, d2h_r_idx_hostaddr);
+			dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8*) &long_data, len);
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case RING_LEN_ITEMS :
+			tcm_offset = bus->ring_sh[ringid].ring_mem_addr;
+			tcm_offset += OFFSETOF(ring_mem_t, len_items);
+			dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+			break;
+
+		case RING_MAX_ITEM :
+			tcm_offset = bus->ring_sh[ringid].ring_mem_addr;
+			tcm_offset += OFFSETOF(ring_mem_t, max_item);
+			dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+			break;
+
+		case RING_BUF_ADDR :
+			long_data = HTOL64(*(uint64 *)data);
+			tcm_offset = bus->ring_sh[ringid].ring_mem_addr;
+			tcm_offset += OFFSETOF(ring_mem_t, base_addr);
+			dhdpcie_bus_membytes(bus, TRUE, tcm_offset, (uint8 *) &long_data, len);
+			prhex(__FUNCTION__, data, len);
+			break;
+
+		case RING_WRITE_PTR :
+			tcm_offset = bus->ring_sh[ringid].ring_state_w;
+			dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+			break;
+		case RING_READ_PTR :
+			tcm_offset = bus->ring_sh[ringid].ring_state_r;
+			dhdpcie_bus_wtcm16(bus, tcm_offset, (uint16) HTOL16(*(uint16 *)data));
+			break;
+
+		case DTOH_MB_DATA:
+			dhdpcie_bus_wtcm32(bus, bus->d2h_mb_data_ptr_addr,
+				(uint32) HTOL32(*(uint32 *)data));
+			break;
+
+		case HTOD_MB_DATA:
+			dhdpcie_bus_wtcm32(bus, bus->h2d_mb_data_ptr_addr,
+				(uint32) HTOL32(*(uint32 *)data));
+			break;
+		default:
+			break;
+	}
+}
+
+
+void
+dhd_bus_cmn_readshared(dhd_bus_t *bus, void* data, uint8 type, uint16 ringid)
+{
+	pciedev_shared_t *sh;
+	ulong tcm_offset;
+
+	sh = (pciedev_shared_t*)bus->shared_addr;
+
+	switch (type) {
+		case RING_WRITE_PTR :
+			tcm_offset = bus->ring_sh[ringid].ring_state_w;
+			*(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, tcm_offset));
+			break;
+		case RING_READ_PTR :
+			tcm_offset = bus->ring_sh[ringid].ring_state_r;
+			*(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus, tcm_offset));
+			break;
+		case TOTAL_LFRAG_PACKET_CNT :
+			*(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus,
+				(ulong) &sh->total_lfrag_pkt_cnt));
+			break;
+		case HTOD_MB_DATA:
+			*(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, bus->h2d_mb_data_ptr_addr));
+			break;
+		case DTOH_MB_DATA:
+			*(uint32*)data = LTOH32(dhdpcie_bus_rtcm32(bus, bus->d2h_mb_data_ptr_addr));
+			break;
+		case MAX_HOST_RXBUFS :
+			*(uint16*)data = LTOH16(dhdpcie_bus_rtcm16(bus,
+				(ulong) &sh->max_host_rxbufs));
+			break;
+		default :
+			break;
+	}
+}
+
+uint32 dhd_bus_get_sharedflags(dhd_bus_t *bus)
+{
+	return ((pciedev_shared_t*)bus->pcie_sh)->flags;
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, int plen, void *arg, int len, bool set)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	const bcm_iovar_t *vi = NULL;
+	int bcmerror = 0;
+	int val_size;
+	uint32 actionid;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(name);
+	ASSERT(len >= 0);
+
+	/* Get MUST have return space */
+	ASSERT(set || (arg && len));
+
+	/* Set does NOT take qualifiers */
+	ASSERT(!set || (!params && !plen));
+
+	DHD_INFO(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+	         name, (set ? "set" : "get"), len, plen));
+
+	/* Look up var locally; if not found pass to host driver */
+	if ((vi = bcm_iovar_lookup(dhdpcie_iovars, name)) == NULL) {
+		goto exit;
+	}
+
+
+	/* set up 'params' pointer in case this is a set command so that
+	 * the convenience int and bool code can be common to set and get
+	 */
+	if (params == NULL) {
+		params = arg;
+		plen = len;
+	}
+
+	if (vi->type == IOVT_VOID)
+		val_size = 0;
+	else if (vi->type == IOVT_BUFFER)
+		val_size = len;
+	else
+		/* all other types are integer sized */
+		val_size = sizeof(int);
+
+	actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+	bcmerror = dhdpcie_bus_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+	return bcmerror;
+}
+
+#ifdef BCM_BUZZZ
+#include <bcm_buzzz.h>
+
+int dhd_buzzz_dump_cntrs3(char *p, uint32 *core, uint32 * ovhd, uint32 *log)
+{
+	int bytes = 0;
+	uint32 ctr, curr[3], prev[3], delta[3];
+
+	/* Compute elapsed counter values per counter event type */
+	for (ctr = 0U; ctr < 3; ctr++) {
+		prev[ctr] = core[ctr];
+		curr[ctr] = *log++;
+		core[ctr] = curr[ctr];  /* saved for next log */
+
+		if (curr[ctr] < prev[ctr])
+			delta[ctr] = curr[ctr] + (~0U - prev[ctr]);
+		else
+			delta[ctr] = (curr[ctr] - prev[ctr]);
+
+		/* Adjust for instrumentation overhead */
+		if (delta[ctr] >= ovhd[ctr])
+			delta[ctr] -= ovhd[ctr];
+		else
+			delta[ctr] = 0;
+
+		bytes += sprintf(p + bytes, "%12u ", delta[ctr]);
+	}
+
+	return bytes;
+}
+
+typedef union cm3_cnts { /* export this in bcm_buzzz.h */
+	uint32 u32;
+	uint8  u8[4];
+	struct {
+		uint8 cpicnt;
+		uint8 exccnt;
+		uint8 sleepcnt;
+		uint8 lsucnt;
+	};
+} cm3_cnts_t;
+
+int dhd_buzzz_dump_cntrs6(char *p, uint32 *core, uint32 * ovhd, uint32 *log)
+{
+	int bytes = 0;
+
+	uint32 cyccnt, instrcnt;
+	cm3_cnts_t cm3_cnts;
+	uint8 foldcnt;
+
+	{   /* 32bit cyccnt */
+		uint32 curr, prev, delta;
+		prev = core[0]; curr = *log++; core[0] = curr;
+		if (curr < prev)
+			delta = curr + (~0U - prev);
+		else
+			delta = (curr - prev);
+		if (delta >= ovhd[0])
+			delta -= ovhd[0];
+		else
+			delta = 0;
+
+		bytes += sprintf(p + bytes, "%12u ", delta);
+		cyccnt = delta;
+	}
+
+	{	/* Extract the 4 cnts: cpi, exc, sleep and lsu */
+		int i;
+		uint8 max8 = ~0;
+		cm3_cnts_t curr, prev, delta;
+		prev.u32 = core[1]; curr.u32 = * log++; core[1] = curr.u32;
+		for (i = 0; i < 4; i++) {
+			if (curr.u8[i] < prev.u8[i])
+				delta.u8[i] = curr.u8[i] + (max8 - prev.u8[i]);
+			else
+				delta.u8[i] = (curr.u8[i] - prev.u8[i]);
+			if (delta.u8[i] >= ovhd[i + 1])
+				delta.u8[i] -= ovhd[i + 1];
+			else
+				delta.u8[i] = 0;
+			bytes += sprintf(p + bytes, "%4u ", delta.u8[i]);
+		}
+		cm3_cnts.u32 = delta.u32;
+	}
+
+	{   /* Extract the foldcnt from arg0 */
+		uint8 curr, prev, delta, max8 = ~0;
+		buzzz_arg0_t arg0; arg0.u32 = *log;
+		prev = core[2]; curr = arg0.klog.cnt; core[2] = curr;
+		if (curr < prev)
+			delta = curr + (max8 - prev);
+		else
+			delta = (curr - prev);
+		if (delta >= ovhd[5])
+			delta -= ovhd[5];
+		else
+			delta = 0;
+		bytes += sprintf(p + bytes, "%4u ", delta);
+		foldcnt = delta;
+	}
+
+	instrcnt = cyccnt - (cm3_cnts.u8[0] + cm3_cnts.u8[1] + cm3_cnts.u8[2]
+		                 + cm3_cnts.u8[3]) + foldcnt;
+	if (instrcnt > 0xFFFFFF00)
+		bytes += sprintf(p + bytes, "[%10s] ", "~");
+	else
+		bytes += sprintf(p + bytes, "[%10u] ", instrcnt);
+	return bytes;
+}
+
+int dhd_buzzz_dump_log(char * p, uint32 * core, uint32 * log, buzzz_t * buzzz)
+{
+	int bytes = 0;
+	buzzz_arg0_t arg0;
+	static uint8 * fmt[] = BUZZZ_FMT_STRINGS;
+
+	if (buzzz->counters == 6) {
+		bytes += dhd_buzzz_dump_cntrs6(p, core, buzzz->ovhd, log);
+		log += 2; /* 32bit cyccnt + (4 x 8bit) CM3 */
+	} else {
+		bytes += dhd_buzzz_dump_cntrs3(p, core, buzzz->ovhd, log);
+		log += 3; /* (3 x 32bit) CR4 */
+	}
+
+	/* Dump the logged arguments using the registered formats */
+	arg0.u32 = *log++;
+
+	switch (arg0.klog.args) {
+		case 0:
+			bytes += sprintf(p + bytes, fmt[arg0.klog.id]);
+			break;
+		case 1:
+		{
+			uint32 arg1 = *log++;
+			bytes += sprintf(p + bytes, fmt[arg0.klog.id], arg1);
+			break;
+		}
+		default:
+			printf("%s: Maximum one argument supported\n", __FUNCTION__);
+			break;
+	}
+	bytes += sprintf(p + bytes, "\n");
+
+	return bytes;
+}
+
+void dhd_buzzz_dump(buzzz_t * buzzz_p, void * buffer_p, char * p)
+{
+	int i;
+	uint32 total, part1, part2, log_sz, core[BUZZZ_COUNTERS_MAX];
+	void * log;
+
+	for (i = 0; i < BUZZZ_COUNTERS_MAX; i++)
+		core[i] = 0;
+
+	log_sz = buzzz_p->log_sz;
+
+	part1 = ((uint32)buzzz_p->cur - (uint32)buzzz_p->log) / log_sz;
+
+	if (buzzz_p->wrap == TRUE) {
+		part2 = ((uint32)buzzz_p->end - (uint32)buzzz_p->cur) / log_sz;
+		total = (buzzz_p->buffer_sz - BUZZZ_LOGENTRY_MAXSZ) / log_sz;
+	} else {
+		part2 = 0U;
+		total = buzzz_p->count;
+	}
+
+	if (total == 0U) {
+		printf("%s: buzzz_dump total<%u> done\n", __FUNCTION__, total);
+		return;
+	} else {
+		printf("%s: buzzz_dump total<%u> : part2<%u> + part1<%u>\n", __FUNCTION__,
+		       total, part2, part1);
+	}
+
+	if (part2) {   /* with wrap */
+		log = (void*)((size_t)buffer_p + (buzzz_p->cur - buzzz_p->log));
+		while (part2--) {   /* from cur to end : part2 */
+			p[0] = '\0';
+			dhd_buzzz_dump_log(p, core, (uint32 *)log, buzzz_p);
+			printf("%s", p);
+			log = (void*)((size_t)log + buzzz_p->log_sz);
+		}
+	}
+
+	log = (void*)buffer_p;
+	while (part1--) {
+		p[0] = '\0';
+		dhd_buzzz_dump_log(p, core, (uint32 *)log, buzzz_p);
+		printf("%s", p);
+		log = (void*)((size_t)log + buzzz_p->log_sz);
+	}
+
+	printf("%s: buzzz_dump done.\n", __FUNCTION__);
+}
+
+int dhd_buzzz_dump_dngl(dhd_bus_t *bus)
+{
+	buzzz_t * buzzz_p = NULL;
+	void * buffer_p = NULL;
+	char * page_p = NULL;
+	pciedev_shared_t *sh;
+	int ret = 0;
+
+	if (bus->dhd->busstate != DHD_BUS_DATA) {
+		return BCME_UNSUPPORTED;
+	}
+	if ((page_p = (char *)MALLOC(bus->dhd->osh, 4096)) == NULL) {
+		printf("%s: Page memory allocation failure\n", __FUNCTION__);
+		goto done;
+	}
+	if ((buzzz_p = MALLOC(bus->dhd->osh, sizeof(buzzz_t))) == NULL) {
+		printf("%s: Buzzz memory allocation failure\n", __FUNCTION__);
+		goto done;
+	}
+
+	ret = dhdpcie_readshared(bus);
+	if (ret < 0) {
+		DHD_ERROR(("%s :Shared area read failed \n", __FUNCTION__));
+		goto done;
+	}
+
+	sh = bus->pcie_sh;
+
+	DHD_INFO(("%s buzzz:%08x\n", __FUNCTION__, sh->buzzz));
+
+	if (sh->buzzz != 0U) {	/* Fetch and display dongle BUZZZ Trace */
+		dhdpcie_bus_membytes(bus, FALSE, (ulong)sh->buzzz,
+		                     (uint8 *)buzzz_p, sizeof(buzzz_t));
+		if (buzzz_p->count == 0) {
+			printf("%s: Empty dongle BUZZZ trace\n\n", __FUNCTION__);
+			goto done;
+		}
+		if (buzzz_p->counters != 3) { /* 3 counters for CR4 */
+			printf("%s: Counters<%u> mismatch\n", __FUNCTION__, buzzz_p->counters);
+			goto done;
+		}
+		/* Allocate memory for trace buffer and format strings */
+		buffer_p = MALLOC(bus->dhd->osh, buzzz_p->buffer_sz);
+		if (buffer_p == NULL) {
+			printf("%s: Buffer memory allocation failure\n", __FUNCTION__);
+			goto done;
+		}
+		/* Fetch the trace and format strings */
+		dhdpcie_bus_membytes(bus, FALSE, (uint32)buzzz_p->log,   /* Trace */
+		                     (uint8 *)buffer_p, buzzz_p->buffer_sz);
+		/* Process and display the trace using formatted output */
+		printf("%s: <#cycle> <#instruction> <#ctr3> <event information>\n", __FUNCTION__);
+		dhd_buzzz_dump(buzzz_p, buffer_p, page_p);
+		printf("%s: ----- End of dongle BUZZZ Trace -----\n\n", __FUNCTION__);
+		MFREE(bus->dhd->osh, buffer_p, buzzz_p->buffer_sz); buffer_p = NULL;
+	}
+
+done:
+
+	if (page_p)   MFREE(bus->dhd->osh, page_p, 4096);
+	if (buzzz_p)  MFREE(bus->dhd->osh, buzzz_p, sizeof(buzzz_t));
+	if (buffer_p) MFREE(bus->dhd->osh, buffer_p, buzzz_p->buffer_sz);
+
+	return BCME_OK;
+}
+#endif /* BCM_BUZZZ */
+
+#define PCIE_GEN2(sih) ((BUSTYPE((sih)->bustype) == PCI_BUS) &&	\
+	((sih)->buscoretype == PCIE2_CORE_ID))
+
+static bool
+pcie2_mdiosetblock(dhd_bus_t *bus, uint blk)
+{
+	uint mdiodata, mdioctrl, i = 0;
+	uint pcie_serdes_spinwait = 200;
+
+	mdioctrl = MDIOCTL2_DIVISOR_VAL | (0x1F << MDIOCTL2_REGADDR_SHF);
+	mdiodata = (blk << MDIODATA2_DEVADDR_SHF) | MDIODATA2_DONE;
+
+	si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_CONTROL, ~0, mdioctrl);
+	si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_WR_DATA, ~0, mdiodata);
+
+	OSL_DELAY(10);
+	/* retry till the transaction is complete */
+	while (i < pcie_serdes_spinwait) {
+		uint mdioctrl_read = si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_WR_DATA,
+			0, 0);
+		if (!(mdioctrl_read & MDIODATA2_DONE)) {
+			break;
+		}
+		OSL_DELAY(1000);
+		i++;
+	}
+
+	if (i >= pcie_serdes_spinwait) {
+		DHD_ERROR(("%s: pcie_mdiosetblock: timed out\n", __FUNCTION__));
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+
+static int
+pcie2_mdioop(dhd_bus_t *bus, uint physmedia, uint regaddr, bool write, uint *val,
+	bool slave_bypass)
+{
+	uint pcie_serdes_spinwait = 200, i = 0, mdio_ctrl;
+	uint32 reg32;
+
+	pcie2_mdiosetblock(bus, physmedia);
+
+	/* enable mdio access to SERDES */
+	mdio_ctrl = MDIOCTL2_DIVISOR_VAL;
+	mdio_ctrl |= (regaddr << MDIOCTL2_REGADDR_SHF);
+
+	if (slave_bypass)
+		mdio_ctrl |= MDIOCTL2_SLAVE_BYPASS;
+
+	if (!write)
+		mdio_ctrl |= MDIOCTL2_READ;
+
+	si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_CONTROL, ~0, mdio_ctrl);
+
+	if (write) {
+		reg32 =  PCIE2_MDIO_WR_DATA;
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIE2_MDIO_WR_DATA, ~0,
+			*val | MDIODATA2_DONE);
+	}
+	else
+		reg32 =  PCIE2_MDIO_RD_DATA;
+
+	/* retry till the transaction is complete */
+	while (i < pcie_serdes_spinwait) {
+		uint done_val =  si_corereg(bus->sih, bus->sih->buscoreidx, reg32, 0, 0);
+		if (!(done_val & MDIODATA2_DONE)) {
+			if (!write) {
+				*val = si_corereg(bus->sih, bus->sih->buscoreidx,
+					PCIE2_MDIO_RD_DATA, 0, 0);
+				*val = *val & MDIODATA2_MASK;
+			}
+			return 0;
+		}
+		OSL_DELAY(1000);
+		i++;
+	}
+	return -1;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	int bcmerror = 0;
+#ifdef CONFIG_ARCH_MSM
+	int retry = POWERUP_MAX_RETRY;
+#endif /* CONFIG_ARCH_MSM */
+
+	if (dhd_download_fw_on_driverload) {
+		bcmerror = dhd_bus_start(dhdp);
+	} else {
+		if (flag == TRUE) { /* Turn off WLAN */
+			/* Removing Power */
+			DHD_ERROR(("%s: == Power OFF ==\n", __FUNCTION__));
+			bus->dhd->up = FALSE;
+			if (bus->dhd->busstate != DHD_BUS_DOWN) {
+				if (bus->intr) {
+					dhdpcie_bus_intr_disable(bus);
+					dhdpcie_free_irq(bus);
+				}
+#ifdef BCMPCIE_OOB_HOST_WAKE
+				/* Clean up any pending host wake IRQ */
+				dhd_bus_oob_intr_set(bus->dhd, FALSE);
+				dhd_bus_oob_intr_unregister(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+				dhd_os_wd_timer(dhdp, 0);
+				dhd_bus_stop(bus, TRUE);
+				dhd_prot_clear(dhdp);
+				dhd_clear(dhdp);
+				dhd_bus_release_dongle(bus);
+				dhdpcie_bus_free_resource(bus);
+				bcmerror = dhdpcie_bus_disable_device(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: dhdpcie_bus_disable_device: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+#ifdef CONFIG_ARCH_MSM
+				bcmerror = dhdpcie_bus_clock_stop(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: host clock stop failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+#endif /* CONFIG_ARCH_MSM */
+				bus->dhd->busstate = DHD_BUS_DOWN;
+			} else {
+				if (bus->intr) {
+					dhdpcie_bus_intr_disable(bus);
+					dhdpcie_free_irq(bus);
+				}
+#ifdef BCMPCIE_OOB_HOST_WAKE
+				/* Clean up any pending host wake IRQ */
+				dhd_bus_oob_intr_set(bus->dhd, FALSE);
+				dhd_bus_oob_intr_unregister(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+				dhd_prot_clear(dhdp);
+				dhd_clear(dhdp);
+				dhd_bus_release_dongle(bus);
+				dhdpcie_bus_free_resource(bus);
+				bcmerror = dhdpcie_bus_disable_device(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: dhdpcie_bus_disable_device: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+
+#ifdef CONFIG_ARCH_MSM
+				bcmerror = dhdpcie_bus_clock_stop(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: host clock stop failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+#endif  /* CONFIG_ARCH_MSM */
+			}
+
+			bus->dhd->dongle_reset = TRUE;
+			DHD_ERROR(("%s:  WLAN OFF Done\n", __FUNCTION__));
+
+		} else { /* Turn on WLAN */
+			if (bus->dhd->busstate == DHD_BUS_DOWN) {
+				/* Powering On */
+				DHD_ERROR(("%s: == Power ON ==\n", __FUNCTION__));
+#ifdef CONFIG_ARCH_MSM
+				while (--retry) {
+					bcmerror = dhdpcie_bus_clock_start(bus);
+					if (!bcmerror) {
+						DHD_ERROR(("%s: dhdpcie_bus_clock_start OK\n",
+							__FUNCTION__));
+						break;
+					}
+					else
+						OSL_SLEEP(10);
+				}
+
+				if (bcmerror && !retry) {
+					DHD_ERROR(("%s: host pcie clock enable failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+#endif /* CONFIG_ARCH_MSM */
+				bcmerror = dhdpcie_bus_enable_device(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: host configuration restore failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+
+				bcmerror = dhdpcie_bus_alloc_resource(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: dhdpcie_bus_resource_alloc failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+
+				bcmerror = dhdpcie_bus_dongle_attach(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: dhdpcie_bus_dongle_attach failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+
+				bcmerror = dhd_bus_request_irq(bus);
+				if (bcmerror) {
+					DHD_ERROR(("%s: dhd_bus_request_irq failed: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+
+				bus->dhd->dongle_reset = FALSE;
+
+				bcmerror = dhd_bus_start(dhdp);
+				if (bcmerror) {
+					DHD_ERROR(("%s: dhd_bus_start: %d\n",
+						__FUNCTION__, bcmerror));
+					goto done;
+				}
+
+				bus->dhd->up = TRUE;
+				DHD_ERROR(("%s: WLAN Power On Done\n", __FUNCTION__));
+			} else {
+				DHD_ERROR(("%s: what should we do here\n", __FUNCTION__));
+				goto done;
+			}
+		}
+	}
+done:
+	if (bcmerror)
+		bus->dhd->busstate = DHD_BUS_DOWN;
+
+	return bcmerror;
+}
+
+static int
+dhdpcie_bus_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, int plen, void *arg, int len, int val_size)
+{
+	int bcmerror = 0;
+	int32 int_val = 0;
+	int32 int_val2 = 0;
+	int32 int_val3 = 0;
+	bool bool_val = 0;
+
+	DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+	           __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+	if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+		goto exit;
+
+	if (plen >= (int)sizeof(int_val))
+		bcopy(params, &int_val, sizeof(int_val));
+
+	if (plen >= (int)sizeof(int_val) * 2)
+		bcopy((void*)((uintptr)params + sizeof(int_val)), &int_val2, sizeof(int_val2));
+
+	if (plen >= (int)sizeof(int_val) * 3)
+		bcopy((void*)((uintptr)params + 2 * sizeof(int_val)), &int_val3, sizeof(int_val3));
+
+	bool_val = (int_val != 0) ? TRUE : FALSE;
+
+	/* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+	if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+	                                actionid == IOV_GVAL(IOV_DEVRESET))) {
+		bcmerror = BCME_NOTREADY;
+		goto exit;
+	}
+
+	switch (actionid) {
+
+
+	case IOV_SVAL(IOV_VARS):
+		bcmerror = dhdpcie_downloadvars(bus, arg, len);
+		break;
+
+	case IOV_SVAL(IOV_PCIEREG):
+		si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configaddr), ~0,
+			int_val);
+		si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configdata), ~0,
+			int_val2);
+		break;
+
+	case IOV_GVAL(IOV_PCIEREG):
+		si_corereg(bus->sih, bus->sih->buscoreidx, OFFSETOF(sbpcieregs_t, configaddr), ~0,
+			int_val);
+		int_val = si_corereg(bus->sih, bus->sih->buscoreidx,
+			OFFSETOF(sbpcieregs_t, configdata), 0, 0);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_BAR0_SECWIN_REG):
+	{
+		uint32 cur_base, base;
+		uchar *bar0;
+		volatile uint32 *offset;
+		/* set the bar0 secondary window to this */
+		/* write the register value */
+		cur_base = dhdpcie_bus_cfg_read_dword(bus, PCIE2_BAR0_CORE2_WIN, sizeof(uint));
+		base = int_val & 0xFFFFF000;
+		dhdpcie_bus_cfg_write_dword(bus, PCIE2_BAR0_CORE2_WIN,  sizeof(uint32), base);
+		bar0 = (uchar *)bus->regs;
+		offset = (uint32 *)(bar0 + 0x4000 + (int_val & 0xFFF));
+		int_val = *offset;
+		bcopy(&int_val, arg, val_size);
+		dhdpcie_bus_cfg_write_dword(bus, PCIE2_BAR0_CORE2_WIN, sizeof(uint32), cur_base);
+	}
+		break;
+	case IOV_SVAL(IOV_BAR0_SECWIN_REG):
+	{
+		uint32 cur_base, base;
+		uchar *bar0;
+		volatile uint32 *offset;
+		/* set the bar0 secondary window to this */
+		/* write the register value */
+		cur_base = dhdpcie_bus_cfg_read_dword(bus, PCIE2_BAR0_CORE2_WIN, sizeof(uint));
+		base = int_val & 0xFFFFF000;
+		dhdpcie_bus_cfg_write_dword(bus, PCIE2_BAR0_CORE2_WIN,  sizeof(uint32), base);
+		bar0 = (uchar *)bus->regs;
+		offset = (uint32 *)(bar0 + 0x4000 + (int_val & 0xFFF));
+		*offset = int_val2;
+		bcopy(&int_val2, arg, val_size);
+		dhdpcie_bus_cfg_write_dword(bus, PCIE2_BAR0_CORE2_WIN, sizeof(uint32), cur_base);
+	}
+		break;
+
+	case IOV_SVAL(IOV_PCIECOREREG):
+		si_corereg(bus->sih, bus->sih->buscoreidx, int_val, ~0, int_val2);
+		break;
+	case IOV_GVAL(IOV_SBREG):
+	{
+		sdreg_t sdreg;
+		uint32 addr, coreidx;
+
+		bcopy(params, &sdreg, sizeof(sdreg));
+
+		addr = sdreg.offset;
+		coreidx =  (addr & 0xF000) >> 12;
+
+		int_val = si_corereg(bus->sih, coreidx, (addr & 0xFFF), 0, 0);
+		bcopy(&int_val, arg, sizeof(int32));
+		break;
+	}
+
+	case IOV_SVAL(IOV_SBREG):
+	{
+		sdreg_t sdreg;
+		uint32 addr, coreidx;
+
+		bcopy(params, &sdreg, sizeof(sdreg));
+
+		addr = sdreg.offset;
+		coreidx =  (addr & 0xF000) >> 12;
+
+		si_corereg(bus->sih, coreidx, (addr & 0xFFF), ~0, sdreg.value);
+
+		break;
+	}
+
+	case IOV_GVAL(IOV_PCIESERDESREG):
+	{
+		uint val;
+		if (!PCIE_GEN2(bus->sih)) {
+			DHD_ERROR(("%s: supported only in pcie gen2\n", __FUNCTION__));
+			bcmerror = BCME_ERROR;
+			break;
+		}
+		if (!pcie2_mdioop(bus, int_val, int_val2, FALSE, &val, FALSE)) {
+			bcopy(&val, arg, sizeof(int32));
+		}
+		else {
+			DHD_ERROR(("%s: pcie2_mdioop failed.\n", __FUNCTION__));
+			bcmerror = BCME_ERROR;
+		}
+		break;
+	}
+	case IOV_SVAL(IOV_PCIESERDESREG):
+		if (!PCIE_GEN2(bus->sih)) {
+			DHD_ERROR(("%s: supported only in pcie gen2\n", __FUNCTION__));
+			bcmerror = BCME_ERROR;
+			break;
+		}
+		if (pcie2_mdioop(bus, int_val, int_val2, TRUE, &int_val3, FALSE)) {
+			DHD_ERROR(("%s: pcie2_mdioop failed.\n", __FUNCTION__));
+			bcmerror = BCME_ERROR;
+		}
+		break;
+	case IOV_GVAL(IOV_PCIECOREREG):
+		int_val = si_corereg(bus->sih, bus->sih->buscoreidx, int_val, 0, 0);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PCIECFGREG):
+		OSL_PCI_WRITE_CONFIG(bus->osh, int_val, 4, int_val2);
+		break;
+
+	case IOV_GVAL(IOV_PCIECFGREG):
+		int_val = OSL_PCI_READ_CONFIG(bus->osh, int_val, 4);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PCIE_LPBK):
+		bcmerror = dhdpcie_bus_lpback_req(bus, int_val);
+		break;
+
+	case IOV_SVAL(IOV_PCIE_DMAXFER):
+		bcmerror = dhdpcie_bus_dmaxfer_req(bus, int_val, int_val2, int_val3);
+		break;
+
+	case IOV_GVAL(IOV_PCIE_SUSPEND):
+		int_val = (bus->dhd->busstate == DHD_BUS_SUSPEND) ? 1 : 0;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_PCIE_SUSPEND):
+		dhdpcie_bus_suspend(bus, bool_val);
+		break;
+
+	case IOV_GVAL(IOV_MEMSIZE):
+		int_val = (int32)bus->ramsize;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_MEMBYTES):
+	case IOV_GVAL(IOV_MEMBYTES):
+	{
+		uint32 address;		/* absolute backplane address */
+		uint size, dsize;
+		uint8 *data;
+
+		bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+		ASSERT(plen >= 2*sizeof(int));
+
+		address = (uint32)int_val;
+		bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
+		size = (uint)int_val;
+
+		/* Do some validation */
+		dsize = set ? plen - (2 * sizeof(int)) : len;
+		if (dsize < size) {
+			DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
+			           __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n dsize %d ", __FUNCTION__,
+		          (set ? "write" : "read"), size, address, dsize));
+
+		/* check if CR4 */
+		if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			/* if address is 0, store the reset instruction to be written in 0 */
+			if (set && address == bus->dongle_ram_base) {
+				bus->resetinstr = *(((uint32*)params) + 2);
+			}
+		} else {
+		/* If we know about SOCRAM, check for a fit */
+		if ((bus->orig_ramsize) &&
+		    ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
+		{
+			uint8 enable, protect, remap;
+			si_socdevram(bus->sih, FALSE, &enable, &protect, &remap);
+			if (!enable || protect) {
+				DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
+					__FUNCTION__, bus->orig_ramsize, size, address));
+				DHD_ERROR(("%s: socram enable %d, protect %d\n",
+					__FUNCTION__, enable, protect));
+				bcmerror = BCME_BADARG;
+				break;
+			}
+
+			if (!REMAP_ENAB(bus) && (address >= SOCDEVRAM_ARM_ADDR)) {
+				uint32 devramsize = si_socdevram_size(bus->sih);
+				if ((address < SOCDEVRAM_ARM_ADDR) ||
+					(address + size > (SOCDEVRAM_ARM_ADDR + devramsize))) {
+					DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
+						__FUNCTION__, address, size));
+					DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
+						__FUNCTION__, SOCDEVRAM_ARM_ADDR, devramsize));
+					bcmerror = BCME_BADARG;
+					break;
+				}
+				/* move it such that address is real now */
+				address -= SOCDEVRAM_ARM_ADDR;
+				address += SOCDEVRAM_BP_ADDR;
+				DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
+					__FUNCTION__, (set ? "write" : "read"), size, address));
+			} else if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address) && remap) {
+				/* Can not access remap region while devram remap bit is set
+				 * ROM content would be returned in this case
+				 */
+				DHD_ERROR(("%s: Need to disable remap for address 0x%08x\n",
+					__FUNCTION__, address));
+				bcmerror = BCME_ERROR;
+				break;
+			}
+		}
+		}
+
+		/* Generate the actual data pointer */
+		data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
+
+		/* Call to do the transfer */
+		bcmerror = dhdpcie_bus_membytes(bus, set, address, data, size);
+
+		break;
+	}
+
+#ifdef BCM_BUZZZ
+	case IOV_GVAL(IOV_BUZZZ_DUMP):
+		bcmerror = dhd_buzzz_dump_dngl(bus);
+		break;
+#endif /* BCM_BUZZZ */
+
+	case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+		bcmerror = dhdpcie_bus_download_state(bus, bool_val);
+		break;
+
+	case IOV_GVAL(IOV_RAMSIZE):
+		int_val = (int32)bus->ramsize;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_RAMSTART):
+		int_val = (int32)bus->dongle_ram_base;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_CC_NVMSHADOW):
+	{
+		struct bcmstrbuf dump_b;
+
+		bcm_binit(&dump_b, arg, len);
+		bcmerror = dhdpcie_cc_nvmshadow(bus, &dump_b);
+		break;
+	}
+
+	case IOV_GVAL(IOV_SLEEP_ALLOWED):
+		bool_val = bus->sleep_allowed;
+		bcopy(&bool_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_SLEEP_ALLOWED):
+		bus->sleep_allowed = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_DONGLEISOLATION):
+		int_val = bus->dhd->dongle_isolation;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DONGLEISOLATION):
+		bus->dhd->dongle_isolation = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_LTRSLEEPON_UNLOOAD):
+		int_val = bus->ltrsleep_on_unload;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_LTRSLEEPON_UNLOOAD):
+		bus->ltrsleep_on_unload = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_DUMP_RINGUPD_BLOCK):
+	{
+		struct bcmstrbuf dump_b;
+		bcm_binit(&dump_b, arg, len);
+		bcmerror = dhd_prot_ringupd_dump(bus->dhd, &dump_b);
+		break;
+	}
+	case IOV_GVAL(IOV_DMA_RINGINDICES):
+	{	int h2d_support, d2h_support;
+
+		d2h_support = DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support) ? 1 : 0;
+		h2d_support = DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support) ? 1 : 0;
+		int_val = d2h_support | (h2d_support << 1);
+		bcopy(&int_val, arg, val_size);
+		break;
+	}
+	case IOV_SVAL(IOV_DMA_RINGINDICES):
+		/* Can change it only during initialization/FW download */
+		if (bus->dhd->busstate == DHD_BUS_DOWN) {
+			if ((int_val > 3) || (int_val < 0)) {
+				DHD_ERROR(("%s: Bad argument. Possible values: 0, 1, 2 & 3\n", __FUNCTION__));
+				bcmerror = BCME_BADARG;
+			} else {
+				bus->dhd->dma_d2h_ring_upd_support = (int_val & 1) ? TRUE : FALSE;
+				bus->dhd->dma_h2d_ring_upd_support = (int_val & 2) ? TRUE : FALSE;
+			}
+		} else {
+			DHD_ERROR(("%s: Can change only when bus down (before FW download)\n",
+				__FUNCTION__));
+			bcmerror = BCME_NOTDOWN;
+		}
+		break;
+
+	case IOV_GVAL(IOV_RX_METADATALEN):
+		int_val = dhd_prot_metadatalen_get(bus->dhd, TRUE);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+		case IOV_SVAL(IOV_RX_METADATALEN):
+		if (int_val > 64) {
+			bcmerror = BCME_BUFTOOLONG;
+			break;
+		}
+		dhd_prot_metadatalen_set(bus->dhd, int_val, TRUE);
+		break;
+
+	case IOV_SVAL(IOV_TXP_THRESHOLD):
+		dhd_prot_txp_threshold(bus->dhd, TRUE, int_val);
+		break;
+
+	case IOV_GVAL(IOV_TXP_THRESHOLD):
+		int_val = dhd_prot_txp_threshold(bus->dhd, FALSE, int_val);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DB1_FOR_MB):
+		if (int_val)
+			bus->db1_for_mb = TRUE;
+		else
+			bus->db1_for_mb = FALSE;
+		break;
+
+	case IOV_GVAL(IOV_DB1_FOR_MB):
+		if (bus->db1_for_mb)
+			int_val = 1;
+		else
+			int_val = 0;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_TX_METADATALEN):
+		int_val = dhd_prot_metadatalen_get(bus->dhd, FALSE);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_TX_METADATALEN):
+		if (int_val > 64) {
+			bcmerror = BCME_BUFTOOLONG;
+			break;
+		}
+		dhd_prot_metadatalen_set(bus->dhd, int_val, FALSE);
+		break;
+
+	case IOV_GVAL(IOV_FLOW_PRIO_MAP):
+		int_val = bus->dhd->flow_prio_map_type;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_FLOW_PRIO_MAP):
+		int_val = (int32)dhd_update_flow_prio_map(bus->dhd, (uint8)int_val);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_TXBOUND):
+		int_val = (int32)dhd_txbound;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_TXBOUND):
+		dhd_txbound = (uint)int_val;
+		break;
+
+	case IOV_GVAL(IOV_RXBOUND):
+		int_val = (int32)dhd_rxbound;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_RXBOUND):
+		dhd_rxbound = (uint)int_val;
+		break;
+
+	default:
+		bcmerror = BCME_UNSUPPORTED;
+		break;
+	}
+
+exit:
+	return bcmerror;
+}
+
+/* Transfers bytes from host to dongle using pio mode */
+static int
+dhdpcie_bus_lpback_req(struct  dhd_bus *bus, uint32 len)
+{
+	if (bus->dhd == NULL) {
+		DHD_ERROR(("%s: bus not inited\n", __FUNCTION__));
+		return 0;
+	}
+	if (bus->dhd->prot == NULL) {
+		DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+		return 0;
+	}
+	if (bus->dhd->busstate != DHD_BUS_DATA) {
+		DHD_ERROR(("%s: not in a readystate to LPBK  is not inited\n", __FUNCTION__));
+		return 0;
+	}
+	dhdmsgbuf_lpbk_req(bus->dhd, len);
+	return 0;
+}
+
+void
+dhd_bus_set_suspend_resume(dhd_pub_t *dhdp, bool state)
+{
+	struct  dhd_bus *bus = dhdp->bus;
+	if (bus) {
+		dhdpcie_bus_suspend(bus, state);
+	}
+}
+
+int
+dhdpcie_bus_suspend(struct dhd_bus *bus, bool state)
+{
+
+	int timeleft;
+	bool pending;
+	int rc = 0;
+
+	if (bus->dhd == NULL) {
+		DHD_ERROR(("%s: bus not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	if (bus->dhd->prot == NULL) {
+		DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	if (bus->dhd->busstate != DHD_BUS_DATA && bus->dhd->busstate != DHD_BUS_SUSPEND) {
+		DHD_ERROR(("%s: not in a readystate to LPBK  is not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	if (bus->dhd->dongle_reset)
+		return -EIO;
+
+	if (bus->suspended == state) /* Set to same state */
+		return BCME_OK;
+
+	if (state) {
+		bus->wait_for_d3_ack = 0;
+		bus->suspended = TRUE;
+		bus->dhd->busstate = DHD_BUS_SUSPEND;
+		DHD_OS_WAKE_LOCK_WAIVE(bus->dhd);
+		dhd_os_set_ioctl_resp_timeout(DEFAULT_IOCTL_RESP_TIMEOUT);
+		dhdpcie_send_mb_data(bus, H2D_HOST_D3_INFORM);
+		timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->wait_for_d3_ack, &pending);
+		dhd_os_set_ioctl_resp_timeout(IOCTL_RESP_TIMEOUT);
+		DHD_OS_WAKE_LOCK_RESTORE(bus->dhd);
+		if (bus->wait_for_d3_ack) {
+			/* Got D3 Ack. Suspend the bus */
+			if (dhd_os_check_wakelock_all(bus->dhd)) {
+				DHD_ERROR(("%s: Suspend failed because of wakelock\n", __FUNCTION__));
+				bus->dev->current_state = PCI_D3hot;
+				pci_set_master(bus->dev);
+				rc = pci_set_power_state(bus->dev, PCI_D0);
+				if (rc) {
+					DHD_ERROR(("%s: pci_set_power_state failed:"
+						" current_state[%d], ret[%d]\n",
+						__FUNCTION__, bus->dev->current_state, rc));
+				}
+				bus->suspended = FALSE;
+				bus->dhd->busstate = DHD_BUS_DATA;
+				rc = BCME_ERROR;
+			} else {
+				dhdpcie_bus_intr_disable(bus);
+				rc = dhdpcie_pci_suspend_resume(bus, state);
+			}
+		} else if (timeleft == 0) {
+			DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
+			bus->dev->current_state = PCI_D3hot;
+			pci_set_master(bus->dev);
+			rc = pci_set_power_state(bus->dev, PCI_D0);
+			if (rc) {
+				DHD_ERROR(("%s: pci_set_power_state failed:"
+					" current_state[%d], ret[%d]\n",
+					__FUNCTION__, bus->dev->current_state, rc));
+			}
+			bus->suspended = FALSE;
+			bus->dhd->busstate = DHD_BUS_DATA;
+			rc = -ETIMEDOUT;
+		}
+		bus->wait_for_d3_ack = 1;
+	} else {
+		/* Resume */
+#ifdef BCMPCIE_OOB_HOST_WAKE
+		DHD_OS_OOB_IRQ_WAKE_UNLOCK(bus->dhd);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+		rc = dhdpcie_pci_suspend_resume(bus, state);
+		bus->suspended = FALSE;
+		bus->dhd->busstate = DHD_BUS_DATA;
+		dhdpcie_bus_intr_enable(bus);
+	}
+	return rc;
+}
+
+/* Transfers bytes from host to dongle and to host again using DMA */
+static int
+dhdpcie_bus_dmaxfer_req(struct  dhd_bus *bus, uint32 len, uint32 srcdelay, uint32 destdelay)
+{
+	if (bus->dhd == NULL) {
+		DHD_ERROR(("%s: bus not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	if (bus->dhd->prot == NULL) {
+		DHD_ERROR(("%s: prot is not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	if (bus->dhd->busstate != DHD_BUS_DATA) {
+		DHD_ERROR(("%s: not in a readystate to LPBK  is not inited\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	if (len < 5 || len > 4194296) {
+		DHD_ERROR(("%s: len is too small or too large\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	return dhdmsgbuf_dmaxfer_req(bus->dhd, len, srcdelay, destdelay);
+}
+
+
+
+static int
+dhdpcie_bus_download_state(dhd_bus_t *bus, bool enter)
+{
+	int bcmerror = 0;
+	uint32 *cr4_regs;
+
+	if (!bus->sih)
+		return BCME_ERROR;
+	/* To enter download state, disable ARM and reset SOCRAM.
+	 * To exit download state, simply reset ARM (default is RAM boot).
+	 */
+	if (enter) {
+		bus->alp_only = TRUE;
+
+		/* some chips (e.g. 43602) have two ARM cores, the CR4 is receives the firmware. */
+		cr4_regs = si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+
+		if (cr4_regs == NULL && !(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+		    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+			DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+			bcmerror = BCME_ERROR;
+			goto fail;
+		}
+
+		if (cr4_regs == NULL) { /* no CR4 present on chip */
+			si_core_disable(bus->sih, 0);
+
+			if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+			si_core_reset(bus->sih, 0, 0);
+
+
+			/* Clear the top bit of memory */
+			if (bus->ramsize) {
+				uint32 zeros = 0;
+				if (dhdpcie_bus_membytes(bus, TRUE, bus->ramsize - 4,
+				                     (uint8*)&zeros, 4) < 0) {
+					bcmerror = BCME_ERROR;
+					goto fail;
+				}
+			}
+		} else {
+			/* For CR4,
+			 * Halt ARM
+			 * Remove ARM reset
+			 * Read RAM base address [0x18_0000]
+			 * [next] Download firmware
+			 * [done at else] Populate the reset vector
+			 * [done at else] Remove ARM halt
+			*/
+			/* Halt ARM & remove reset */
+			si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+			if (bus->sih->chip == BCM43602_CHIP_ID) {
+				W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKIDX, 5);
+				W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKPDA, 0);
+				W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKIDX, 7);
+				W_REG(bus->pcie_mb_intr_osh, cr4_regs + ARMCR4REG_BANKPDA, 0);
+			}
+			/* reset last 4 bytes of RAM address. to be used for shared area */
+			dhdpcie_init_shared_addr(bus);
+		}
+	} else {
+		if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+			if (!si_iscoreup(bus->sih)) {
+				DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+
+			/* Enable remap before ARM reset but after vars.
+			 * No backplane access in remap mode
+			 */
+
+			if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+			    !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+				DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+
+			if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+			    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+		} else {
+			if (bus->sih->chip == BCM43602_CHIP_ID) {
+				/* Firmware crashes on SOCSRAM access when core is in reset */
+				if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+					DHD_ERROR(("%s: Failed to find SOCRAM core!\n",
+						__FUNCTION__));
+					bcmerror = BCME_ERROR;
+					goto fail;
+				}
+				si_core_reset(bus->sih, 0, 0);
+				si_setcore(bus->sih, ARMCR4_CORE_ID, 0);
+			}
+
+			/* write vars */
+			if ((bcmerror = dhdpcie_bus_write_vars(bus))) {
+				DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+				goto fail;
+			}
+
+
+			/* switch back to arm core again */
+			if (!(si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find ARM CR4 core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+			/* write address 0 with reset instruction */
+			bcmerror = dhdpcie_bus_membytes(bus, TRUE, 0,
+				(uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+
+			/* now remove reset and halt and continue to run CR4 */
+		}
+
+		si_core_reset(bus->sih, 0, 0);
+
+		/* Allow HT Clock now that the ARM is running. */
+		bus->alp_only = FALSE;
+
+		bus->dhd->busstate = DHD_BUS_LOAD;
+	}
+
+fail:
+	/* Always return to PCIE core */
+	si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+
+	return bcmerror;
+}
+
+static int
+dhdpcie_bus_write_vars(dhd_bus_t *bus)
+{
+	int bcmerror = 0;
+	uint32 varsize, phys_size;
+	uint32 varaddr;
+	uint8 *vbuffer;
+	uint32 varsizew;
+#ifdef DHD_DEBUG
+	uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+	/* Even if there are no vars are to be written, we still need to set the ramsize. */
+	varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+	varaddr = (bus->ramsize - 4) - varsize;
+
+	varaddr += bus->dongle_ram_base;
+
+	if (bus->vars) {
+
+		vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+		if (!vbuffer)
+			return BCME_NOMEM;
+
+		bzero(vbuffer, varsize);
+		bcopy(bus->vars, vbuffer, bus->varsz);
+		/* Write the vars list */
+		bcmerror = dhdpcie_bus_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+
+		/* Implement read back and verify later */
+#ifdef DHD_DEBUG
+		/* Verify NVRAM bytes */
+		DHD_INFO(("%s: Compare NVRAM dl & ul; varsize=%d\n", __FUNCTION__, varsize));
+		nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+		if (!nvram_ularray)
+			return BCME_NOMEM;
+
+		/* Upload image to verify downloaded contents. */
+		memset(nvram_ularray, 0xaa, varsize);
+
+		/* Read the vars list to temp buffer for comparison */
+		bcmerror = dhdpcie_bus_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+		if (bcmerror) {
+				DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+					__FUNCTION__, bcmerror, varsize, varaddr));
+		}
+
+		/* Compare the org NVRAM with the one read from RAM */
+		if (memcmp(vbuffer, nvram_ularray, varsize)) {
+			DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+		} else
+			DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+			__FUNCTION__));
+
+		MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+		MFREE(bus->dhd->osh, vbuffer, varsize);
+	}
+
+	phys_size = REMAP_ENAB(bus) ? bus->ramsize : bus->orig_ramsize;
+
+	phys_size += bus->dongle_ram_base;
+
+	/* adjust to the user specified RAM */
+	DHD_INFO(("%s: Physical memory size: %d, usable memory size: %d\n", __FUNCTION__,
+		phys_size, bus->ramsize));
+	DHD_INFO(("%s: Vars are at %d, orig varsize is %d\n", __FUNCTION__,
+		varaddr, varsize));
+	varsize = ((phys_size - 4) - varaddr);
+
+	/*
+	 * Determine the length token:
+	 * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+	 */
+	if (bcmerror) {
+		varsizew = 0;
+		bus->nvram_csm = varsizew;
+	} else {
+		varsizew = varsize / 4;
+		varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+		bus->nvram_csm = varsizew;
+		varsizew = htol32(varsizew);
+	}
+
+	DHD_INFO(("%s: New varsize is %d, length token=0x%08x\n", __FUNCTION__, varsize, varsizew));
+
+	/* Write the length token to the last word */
+	bcmerror = dhdpcie_bus_membytes(bus, TRUE, (phys_size - 4),
+		(uint8*)&varsizew, 4);
+
+	return bcmerror;
+}
+
+int
+dhdpcie_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+	int bcmerror = BCME_OK;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Basic sanity checks */
+	if (bus->dhd->up) {
+		bcmerror = BCME_NOTDOWN;
+		goto err;
+	}
+	if (!len) {
+		bcmerror = BCME_BUFTOOSHORT;
+		goto err;
+	}
+
+	/* Free the old ones and replace with passed variables */
+	if (bus->vars)
+		MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+
+	bus->vars = MALLOC(bus->dhd->osh, len);
+	bus->varsz = bus->vars ? len : 0;
+	if (bus->vars == NULL) {
+		bcmerror = BCME_NOMEM;
+		goto err;
+	}
+
+	/* Copy the passed variables, which should include the terminating double-null */
+	bcopy(arg, bus->vars, bus->varsz);
+err:
+	return bcmerror;
+}
+
+#ifndef BCMPCIE_OOB_HOST_WAKE
+/* loop through the capability list and see if the pcie capabilty exists */
+uint8
+dhdpcie_find_pci_capability(osl_t *osh, uint8 req_cap_id)
+{
+	uint8 cap_id;
+	uint8 cap_ptr = 0;
+	uint8 byte_val;
+
+	/* check for Header type 0 */
+	byte_val = read_pci_cfg_byte(PCI_CFG_HDR);
+	if ((byte_val & 0x7f) != PCI_HEADER_NORMAL) {
+		DHD_ERROR(("%s : PCI config header not normal.\n", __FUNCTION__));
+		goto end;
+	}
+
+	/* check if the capability pointer field exists */
+	byte_val = read_pci_cfg_byte(PCI_CFG_STAT);
+	if (!(byte_val & PCI_CAPPTR_PRESENT)) {
+		DHD_ERROR(("%s : PCI CAP pointer not present.\n", __FUNCTION__));
+		goto end;
+	}
+
+	cap_ptr = read_pci_cfg_byte(PCI_CFG_CAPPTR);
+	/* check if the capability pointer is 0x00 */
+	if (cap_ptr == 0x00) {
+		DHD_ERROR(("%s : PCI CAP pointer is 0x00.\n", __FUNCTION__));
+		goto end;
+	}
+
+	/* loop thr'u the capability list and see if the pcie capabilty exists */
+
+	cap_id = read_pci_cfg_byte(cap_ptr);
+
+	while (cap_id != req_cap_id) {
+		cap_ptr = read_pci_cfg_byte((cap_ptr + 1));
+		if (cap_ptr == 0x00) break;
+		cap_id = read_pci_cfg_byte(cap_ptr);
+	}
+
+end:
+	return cap_ptr;
+}
+
+void
+dhdpcie_pme_active(osl_t *osh, bool enable)
+{
+	uint8 cap_ptr;
+	uint32 pme_csr;
+
+	cap_ptr = dhdpcie_find_pci_capability(osh, PCI_CAP_POWERMGMTCAP_ID);
+
+	if (!cap_ptr) {
+		DHD_ERROR(("%s : Power Management Capability not present\n", __FUNCTION__));
+		return;
+	}
+
+	pme_csr = OSL_PCI_READ_CONFIG(osh, cap_ptr + PME_CSR_OFFSET, sizeof(uint32));
+	DHD_ERROR(("%s : pme_sts_ctrl 0x%x\n", __FUNCTION__, pme_csr));
+
+	pme_csr |= PME_CSR_PME_STAT;
+	if (enable) {
+		pme_csr |= PME_CSR_PME_EN;
+	} else {
+		pme_csr &= ~PME_CSR_PME_EN;
+	}
+
+	OSL_PCI_WRITE_CONFIG(osh, cap_ptr + PME_CSR_OFFSET, sizeof(uint32), pme_csr);
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+/* Add bus dump output to a buffer */
+void dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+	uint16 flowid;
+	flow_ring_node_t *flow_ring_node;
+
+	dhd_prot_print_info(dhdp, strbuf);
+	for (flowid = 0; flowid < dhdp->num_flow_rings; flowid++) {
+		flow_ring_node = DHD_FLOW_RING(dhdp, flowid);
+		if (flow_ring_node->active) {
+			bcm_bprintf(strbuf, "Flow:%d IF %d Prio %d  Qlen %d ",
+				flow_ring_node->flowid, flow_ring_node->flow_info.ifindex,
+				flow_ring_node->flow_info.tid, flow_ring_node->queue.len);
+			dhd_prot_print_flow_ring(dhdp, flow_ring_node->prot_info, strbuf);
+		}
+	}
+}
+
+static void
+dhd_update_txflowrings(dhd_pub_t *dhd)
+{
+	dll_t *item, *next;
+	flow_ring_node_t *flow_ring_node;
+	struct dhd_bus *bus = dhd->bus;
+
+	for (item = dll_head_p(&bus->const_flowring);
+	         !dll_end(&bus->const_flowring, item); item = next) {
+		next = dll_next_p(item);
+
+		flow_ring_node = dhd_constlist_to_flowring(item);
+		dhd_prot_update_txflowring(dhd, flow_ring_node->flowid, flow_ring_node->prot_info);
+	}
+}
+
+
+/* Mailbox ringbell Function */
+static void
+dhd_bus_gen_devmb_intr(struct dhd_bus *bus)
+{
+	if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+		(bus->sih->buscorerev == 4)) {
+		DHD_ERROR(("%s: mailbox communication not supported\n", __FUNCTION__));
+		return;
+	}
+	if (bus->db1_for_mb)  {
+		/* this is a pcie core register, not the config regsiter */
+		DHD_INFO(("%s: writing a mail box interrupt to the device, through doorbell 1\n", __FUNCTION__));
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIH2D_DB1, ~0, 0x12345678);
+	}
+	else {
+		DHD_INFO(("%s: writing a mail box interrupt to the device, through config space\n", __FUNCTION__));
+		dhdpcie_bus_cfg_write_dword(bus, PCISBMbx, 4, (1 << 0));
+		dhdpcie_bus_cfg_write_dword(bus, PCISBMbx, 4, (1 << 0));
+	}
+}
+
+/* doorbell ring Function */
+void
+dhd_bus_ringbell(struct dhd_bus *bus, uint32 value)
+{
+	if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+		(bus->sih->buscorerev == 4)) {
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxInt, PCIE_INTB, PCIE_INTB);
+	} else {
+		/* this is a pcie core register, not the config regsiter */
+		DHD_INFO(("%s: writing a door bell to the device\n", __FUNCTION__));
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIH2D_MailBox, ~0, 0x12345678);
+	}
+}
+
+static void
+dhd_bus_ringbell_fast(struct dhd_bus *bus, uint32 value)
+{
+	W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr, value);
+}
+
+static void
+dhd_bus_ringbell_oldpcie(struct dhd_bus *bus, uint32 value)
+{
+	uint32 w;
+	w = (R_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr) & ~PCIE_INTB) | PCIE_INTB;
+	W_REG(bus->pcie_mb_intr_osh, bus->pcie_mb_intr_addr, w);
+}
+
+dhd_mb_ring_t
+dhd_bus_get_mbintr_fn(struct dhd_bus *bus)
+{
+	if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+		(bus->sih->buscorerev == 4)) {
+		bus->pcie_mb_intr_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+			PCIMailBoxInt);
+		if (bus->pcie_mb_intr_addr) {
+			bus->pcie_mb_intr_osh = si_osh(bus->sih);
+			return dhd_bus_ringbell_oldpcie;
+		}
+	} else {
+		bus->pcie_mb_intr_addr = si_corereg_addr(bus->sih, bus->sih->buscoreidx,
+			PCIH2D_MailBox);
+		if (bus->pcie_mb_intr_addr) {
+			bus->pcie_mb_intr_osh = si_osh(bus->sih);
+			return dhd_bus_ringbell_fast;
+		}
+	}
+	return dhd_bus_ringbell;
+}
+
+bool BCMFASTPATH
+dhd_bus_dpc(struct dhd_bus *bus)
+{
+	uint32 intstatus = 0;
+	uint32 newstatus = 0;
+	bool resched = FALSE;	  /* Flag indicating resched wanted */
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+		bus->intstatus = 0;
+		return 0;
+	}
+
+	intstatus = bus->intstatus;
+
+	if ((bus->sih->buscorerev == 6) || (bus->sih->buscorerev == 4) ||
+		(bus->sih->buscorerev == 2)) {
+		newstatus =  dhdpcie_bus_cfg_read_dword(bus, PCIIntstatus, 4);
+		dhdpcie_bus_cfg_write_dword(bus, PCIIntstatus, 4, newstatus);
+		/* Merge new bits with previous */
+		intstatus |= newstatus;
+		bus->intstatus = 0;
+		if (intstatus & I_MB) {
+			resched = dhdpcie_bus_process_mailbox_intr(bus, intstatus);
+		}
+	} else {
+		/* this is a PCIE core register..not a config register... */
+		newstatus = si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxInt, 0, 0);
+		intstatus |= (newstatus & bus->def_intmask);
+		si_corereg(bus->sih, bus->sih->buscoreidx, PCIMailBoxInt, newstatus, newstatus);
+		if (intstatus & bus->def_intmask) {
+			resched = dhdpcie_bus_process_mailbox_intr(bus, intstatus);
+			intstatus &= ~bus->def_intmask;
+		}
+	}
+
+	if (!resched) {
+		// terence 20150420: no need to enable interrupt if busstate is down
+		if (bus->dhd->busstate) {
+			dhdpcie_bus_intr_enable(bus);
+		}
+	}
+	return resched;
+
+}
+
+
+static void
+dhdpcie_send_mb_data(dhd_bus_t *bus, uint32 h2d_mb_data)
+{
+	uint32 cur_h2d_mb_data = 0;
+
+	dhd_bus_cmn_readshared(bus, &cur_h2d_mb_data, HTOD_MB_DATA, 0);
+
+	if (cur_h2d_mb_data != 0) {
+		uint32 i = 0;
+		DHD_INFO(("%s: GRRRRRRR: MB transaction is already pending 0x%04x\n", __FUNCTION__, cur_h2d_mb_data));
+		while ((i++ < 100) && cur_h2d_mb_data) {
+			OSL_DELAY(10);
+			dhd_bus_cmn_readshared(bus, &cur_h2d_mb_data, HTOD_MB_DATA, 0);
+		}
+		if (i >= 100)
+			DHD_ERROR(("%s: waited 1ms for the dngl to ack the previous mb transaction\n", __FUNCTION__));
+	}
+
+	dhd_bus_cmn_writeshared(bus, &h2d_mb_data, sizeof(uint32), HTOD_MB_DATA, 0);
+	dhd_bus_gen_devmb_intr(bus);
+
+	if (h2d_mb_data == H2D_HOST_D3_INFORM)
+		DHD_INFO_HW4(("%s: send H2D_HOST_D3_INFORM to dongle\n", __FUNCTION__));
+}
+
+static void
+dhdpcie_handle_mb_data(dhd_bus_t *bus)
+{
+	uint32 d2h_mb_data = 0;
+	uint32 zero = 0;
+	dhd_bus_cmn_readshared(bus, &d2h_mb_data, DTOH_MB_DATA, 0);
+	if (!d2h_mb_data)
+		return;
+
+	dhd_bus_cmn_writeshared(bus, &zero, sizeof(uint32), DTOH_MB_DATA, 0);
+
+	DHD_INFO(("%s: D2H_MB_DATA: 0x%04x\n", __FUNCTION__, d2h_mb_data));
+	if (d2h_mb_data & D2H_DEV_DS_ENTER_REQ)  {
+		/* what should we do */
+		DHD_INFO(("%s: D2H_MB_DATA: DEEP SLEEP REQ\n", __FUNCTION__));
+		dhdpcie_send_mb_data(bus, H2D_HOST_DS_ACK);
+		DHD_INFO(("%s: D2H_MB_DATA: sent DEEP SLEEP ACK\n", __FUNCTION__));
+	}
+	if (d2h_mb_data & D2H_DEV_DS_EXIT_NOTE)  {
+		/* what should we do */
+		DHD_INFO(("%s: D2H_MB_DATA: DEEP SLEEP EXIT\n", __FUNCTION__));
+	}
+	if (d2h_mb_data & D2H_DEV_D3_ACK)  {
+		/* what should we do */
+		DHD_INFO_HW4(("%s D2H_MB_DATA: Received D3 ACK\n", __FUNCTION__));
+		if (!bus->wait_for_d3_ack) {
+			bus->wait_for_d3_ack = 1;
+			dhd_os_ioctl_resp_wake(bus->dhd);
+		}
+	}
+	if (d2h_mb_data & D2H_DEV_FWHALT)  {
+		DHD_INFO(("%s: FW trap has happened\n", __FUNCTION__));
+#ifdef DHD_DEBUG
+		dhdpcie_checkdied(bus, NULL, 0);
+#endif
+		bus->dhd->busstate = DHD_BUS_DOWN;
+	}
+}
+
+static bool
+dhdpcie_bus_process_mailbox_intr(dhd_bus_t *bus, uint32 intstatus)
+{
+	bool resched = FALSE;
+
+	if ((bus->sih->buscorerev == 2) || (bus->sih->buscorerev == 6) ||
+		(bus->sih->buscorerev == 4)) {
+		/* Msg stream interrupt */
+		if (intstatus & I_BIT1) {
+			resched = dhdpci_bus_read_frames(bus);
+		} else if (intstatus & I_BIT0) {
+			/* do nothing for Now */
+		}
+	}
+	else {
+		if (intstatus & (PCIE_MB_TOPCIE_FN0_0 | PCIE_MB_TOPCIE_FN0_1))
+			dhdpcie_handle_mb_data(bus);
+
+		if (bus->dhd->busstate == DHD_BUS_SUSPEND) {
+			goto exit;
+		}
+
+		if (intstatus & PCIE_MB_D2H_MB_MASK) {
+			resched = dhdpci_bus_read_frames(bus);
+		}
+	}
+exit:
+	return resched;
+}
+
+/* Decode dongle to host message stream */
+static bool
+dhdpci_bus_read_frames(dhd_bus_t *bus)
+{
+	bool more = FALSE;
+
+	/* There may be frames in both ctrl buf and data buf; check ctrl buf first */
+	DHD_PERIM_LOCK(bus->dhd); /* Take the perimeter lock */
+	dhd_prot_process_ctrlbuf(bus->dhd);
+	/* Unlock to give chance for resp to be handled */
+	DHD_PERIM_UNLOCK(bus->dhd); /* Release the perimeter lock */
+
+	DHD_PERIM_LOCK(bus->dhd); /* Take the perimeter lock */
+	/* update the flow ring cpls */
+	dhd_update_txflowrings(bus->dhd);
+
+	/* With heavy TX traffic, we could get a lot of TxStatus
+	 * so add bound
+	 */
+	more |= dhd_prot_process_msgbuf_txcpl(bus->dhd, dhd_txbound);
+
+	/* With heavy RX traffic, this routine potentially could spend some time
+	 * processing RX frames without RX bound
+	 */
+	more |= dhd_prot_process_msgbuf_rxcpl(bus->dhd, dhd_rxbound);
+	DHD_PERIM_UNLOCK(bus->dhd); /* Release the perimeter lock */
+
+	return more;
+}
+
+static int
+dhdpcie_readshared(dhd_bus_t *bus)
+{
+	uint32 addr = 0;
+	int rv, w_init, r_init;
+	uint32 shaddr = 0;
+	pciedev_shared_t *sh = bus->pcie_sh;
+	dhd_timeout_t tmo;
+
+	shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+	/* start a timer for 5 seconds */
+	dhd_timeout_start(&tmo, MAX_READ_TIMEOUT);
+
+	while (((addr == 0) || (addr == bus->nvram_csm)) && !dhd_timeout_expired(&tmo)) {
+		/* Read last word in memory to determine address of sdpcm_shared structure */
+		addr = LTOH32(dhdpcie_bus_rtcm32(bus, shaddr));
+	}
+
+	if ((addr == 0) || (addr == bus->nvram_csm) || (addr < bus->dongle_ram_base) ||
+		(addr > shaddr)) {
+		DHD_ERROR(("%s: address (0x%08x) of pciedev_shared invalid\n",
+			__FUNCTION__, addr));
+		DHD_ERROR(("%s: Waited %u usec, dongle is not ready\n", __FUNCTION__, tmo.elapsed));
+		return BCME_ERROR;
+	} else {
+		bus->shared_addr = (ulong)addr;
+		DHD_ERROR(("%s: PCIe shared addr read took %u usec "
+			"before dongle is ready\n", __FUNCTION__, tmo.elapsed));
+	}
+
+	/* Read hndrte_shared structure */
+	if ((rv = dhdpcie_bus_membytes(bus, FALSE, addr, (uint8 *)sh,
+		sizeof(pciedev_shared_t))) < 0) {
+		DHD_ERROR(("%s: Failed to read PCIe shared struct,"
+			"size read %d < %d\n", __FUNCTION__, rv, (int)sizeof(pciedev_shared_t)));
+		return rv;
+	}
+
+	/* Endianness */
+	sh->flags = ltoh32(sh->flags);
+	sh->trap_addr = ltoh32(sh->trap_addr);
+	sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+	sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+	sh->assert_line = ltoh32(sh->assert_line);
+	sh->console_addr = ltoh32(sh->console_addr);
+	sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+	sh->dma_rxoffset = ltoh32(sh->dma_rxoffset);
+	sh->rings_info_ptr = ltoh32(sh->rings_info_ptr);
+	/* load bus console address */
+
+#ifdef DHD_DEBUG
+	bus->console_addr = sh->console_addr;
+#endif
+
+	/* Read the dma rx offset */
+	bus->dma_rxoffset = bus->pcie_sh->dma_rxoffset;
+	dhd_prot_rx_dataoffset(bus->dhd, bus->dma_rxoffset);
+
+	DHD_ERROR(("%s: DMA RX offset from shared Area %d\n", __FUNCTION__, bus->dma_rxoffset));
+
+	if ((sh->flags & PCIE_SHARED_VERSION_MASK) > PCIE_SHARED_VERSION) {
+		DHD_ERROR(("%s: pcie_shared version %d in dhd "
+		           "is older than pciedev_shared version %d in dongle\n",
+		           __FUNCTION__, PCIE_SHARED_VERSION,
+		           sh->flags & PCIE_SHARED_VERSION_MASK));
+		return BCME_ERROR;
+	}
+	if ((sh->flags & PCIE_SHARED_VERSION_MASK) >= 4) {
+		if (sh->flags & PCIE_SHARED_TXPUSH_SPRT) {
+#ifdef DHDTCPACK_SUPPRESS
+			/* Do not use tcpack suppress as packets don't stay in queue */
+			dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+#endif
+			bus->txmode_push = TRUE;
+		} else
+			bus->txmode_push = FALSE;
+	}
+	DHD_ERROR(("%s: bus->txmode_push is set to %d\n", __FUNCTION__, bus->txmode_push));
+
+	/* Does the FW support DMA'ing r/w indices */
+	if (sh->flags & PCIE_SHARED_DMA_INDEX) {
+
+		DHD_ERROR(("%s: Host support DMAing indices: H2D:%d - D2H:%d. FW supports it\n",
+			__FUNCTION__,
+			(DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support) ? 1 : 0),
+			(DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support) ? 1 : 0)));
+
+	} else if (DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support) ||
+	           DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support)) {
+
+#ifdef BCM_INDX_DMA
+		DHD_ERROR(("%s: Incompatible FW. FW does not support DMAing indices\n",
+			__FUNCTION__));
+		return BCME_ERROR;
+#endif
+		DHD_ERROR(("%s: Host supports DMAing indices but FW does not\n",
+			__FUNCTION__));
+		bus->dhd->dma_d2h_ring_upd_support = FALSE;
+		bus->dhd->dma_h2d_ring_upd_support = FALSE;
+	}
+
+
+	/* get ring_info, ring_state and mb data ptrs and store the addresses in bus structure */
+	{
+		ring_info_t  ring_info;
+
+		if ((rv = dhdpcie_bus_membytes(bus, FALSE, sh->rings_info_ptr,
+			(uint8 *)&ring_info, sizeof(ring_info_t))) < 0)
+			return rv;
+
+		bus->h2d_mb_data_ptr_addr = ltoh32(sh->h2d_mb_data_ptr);
+		bus->d2h_mb_data_ptr_addr = ltoh32(sh->d2h_mb_data_ptr);
+
+
+		bus->max_sub_queues = ltoh16(ring_info.max_sub_queues);
+
+		/* If both FW and Host support DMA'ing indices, allocate memory and notify FW
+		 * The max_sub_queues is read from FW initialized ring_info
+		 */
+		if (DMA_INDX_ENAB(bus->dhd->dma_h2d_ring_upd_support)) {
+			w_init = dhd_prot_init_index_dma_block(bus->dhd,
+				HOST_TO_DNGL_DMA_WRITEINDX_BUFFER,
+				bus->max_sub_queues);
+			r_init = dhd_prot_init_index_dma_block(bus->dhd,
+				DNGL_TO_HOST_DMA_READINDX_BUFFER,
+				BCMPCIE_D2H_COMMON_MSGRINGS);
+
+			if ((w_init != BCME_OK) || (r_init != BCME_OK)) {
+				DHD_ERROR(("%s: Failed to allocate memory for dma'ing h2d indices"
+						"Host will use w/r indices in TCM\n",
+						__FUNCTION__));
+				bus->dhd->dma_h2d_ring_upd_support = FALSE;
+			}
+		}
+
+		if (DMA_INDX_ENAB(bus->dhd->dma_d2h_ring_upd_support)) {
+			w_init = dhd_prot_init_index_dma_block(bus->dhd,
+				DNGL_TO_HOST_DMA_WRITEINDX_BUFFER,
+				BCMPCIE_D2H_COMMON_MSGRINGS);
+			r_init = dhd_prot_init_index_dma_block(bus->dhd,
+				HOST_TO_DNGL_DMA_READINDX_BUFFER,
+				bus->max_sub_queues);
+
+			if ((w_init != BCME_OK) || (r_init != BCME_OK)) {
+				DHD_ERROR(("%s: Failed to allocate memory for dma'ing d2h indices"
+						"Host will use w/r indices in TCM\n",
+						__FUNCTION__));
+				bus->dhd->dma_d2h_ring_upd_support = FALSE;
+			}
+		}
+
+		/* read ringmem and ringstate ptrs from shared area and store in host variables */
+		dhd_fillup_ring_sharedptr_info(bus, &ring_info);
+
+		bcm_print_bytes("ring_info_raw", (uchar *)&ring_info, sizeof(ring_info_t));
+		DHD_INFO(("%s: ring_info\n", __FUNCTION__));
+
+		DHD_ERROR(("%s: max H2D queues %d\n", __FUNCTION__, ltoh16(ring_info.max_sub_queues)));
+
+		DHD_INFO(("%s: mail box address\n", __FUNCTION__));
+		DHD_INFO(("%s: h2d_mb_data_ptr_addr 0x%04x\n", __FUNCTION__, bus->h2d_mb_data_ptr_addr));
+		DHD_INFO(("%s: d2h_mb_data_ptr_addr 0x%04x\n", __FUNCTION__, bus->d2h_mb_data_ptr_addr));
+	}
+
+	bus->dhd->d2h_sync_mode = sh->flags & PCIE_SHARED_D2H_SYNC_MODE_MASK;
+	DHD_INFO(("%s: d2h_sync_mode 0x%08x\n", __FUNCTION__, bus->dhd->d2h_sync_mode));
+
+	return BCME_OK;
+}
+/* Read ring mem and ring state ptr info from shared are in TCM */
+static void
+dhd_fillup_ring_sharedptr_info(dhd_bus_t *bus, ring_info_t *ring_info)
+{
+	uint16 i = 0;
+	uint16 j = 0;
+	uint32 tcm_memloc;
+	uint32	d2h_w_idx_ptr, d2h_r_idx_ptr, h2d_w_idx_ptr, h2d_r_idx_ptr;
+
+	/* Ring mem ptr info */
+	/* Alloated in the order
+		H2D_MSGRING_CONTROL_SUBMIT              0
+		H2D_MSGRING_RXPOST_SUBMIT               1
+		D2H_MSGRING_CONTROL_COMPLETE            2
+		D2H_MSGRING_TX_COMPLETE                 3
+		D2H_MSGRING_RX_COMPLETE                 4
+		TX_FLOW_RING				5
+	*/
+
+	{
+		/* ringmemptr holds start of the mem block address space */
+		tcm_memloc = ltoh32(ring_info->ringmem_ptr);
+
+		/* Find out ringmem ptr for each ring common  ring */
+		for (i = 0; i <= BCMPCIE_COMMON_MSGRING_MAX_ID; i++) {
+			bus->ring_sh[i].ring_mem_addr = tcm_memloc;
+			/* Update mem block */
+			tcm_memloc = tcm_memloc + sizeof(ring_mem_t);
+			DHD_INFO(("%s: ring id %d ring mem addr 0x%04x \n", __FUNCTION__,
+				i, bus->ring_sh[i].ring_mem_addr));
+		}
+
+		/* Tx flow Ring */
+		if (bus->txmode_push) {
+			bus->ring_sh[i].ring_mem_addr = tcm_memloc;
+			DHD_INFO(("%s: TX ring ring id %d ring mem addr 0x%04x \n", __FUNCTION__,
+				i, bus->ring_sh[i].ring_mem_addr));
+		}
+	}
+
+	/* Ring state mem ptr info */
+	{
+		d2h_w_idx_ptr = ltoh32(ring_info->d2h_w_idx_ptr);
+		d2h_r_idx_ptr = ltoh32(ring_info->d2h_r_idx_ptr);
+		h2d_w_idx_ptr = ltoh32(ring_info->h2d_w_idx_ptr);
+		h2d_r_idx_ptr = ltoh32(ring_info->h2d_r_idx_ptr);
+		/* Store h2d common ring write/read pointers */
+		for (i = 0; i < BCMPCIE_H2D_COMMON_MSGRINGS; i++) {
+			bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+			bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+			/* update mem block */
+			h2d_w_idx_ptr = h2d_w_idx_ptr + sizeof(uint32);
+			h2d_r_idx_ptr = h2d_r_idx_ptr + sizeof(uint32);
+
+			DHD_INFO(("%s: h2d w/r : idx %d write %x read %x \n", __FUNCTION__, i,
+				bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+		}
+		/* Store d2h common ring write/read pointers */
+		for (j = 0; j < BCMPCIE_D2H_COMMON_MSGRINGS; j++, i++) {
+			bus->ring_sh[i].ring_state_w = d2h_w_idx_ptr;
+			bus->ring_sh[i].ring_state_r = d2h_r_idx_ptr;
+
+			/* update mem block */
+			d2h_w_idx_ptr = d2h_w_idx_ptr + sizeof(uint32);
+			d2h_r_idx_ptr = d2h_r_idx_ptr + sizeof(uint32);
+
+			DHD_INFO(("%s: d2h w/r : idx %d write %x read %x \n", __FUNCTION__, i,
+				bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+		}
+
+		/* Store txflow ring write/read pointers */
+		if (bus->txmode_push) {
+			bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+			bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+			DHD_INFO(("%s: txflow : idx %d write %x read %x \n", __FUNCTION__, i,
+				bus->ring_sh[i].ring_state_w, bus->ring_sh[i].ring_state_r));
+		} else {
+			for (j = 0; j < (bus->max_sub_queues - BCMPCIE_H2D_COMMON_MSGRINGS);
+				i++, j++)
+			{
+				bus->ring_sh[i].ring_state_w = h2d_w_idx_ptr;
+				bus->ring_sh[i].ring_state_r = h2d_r_idx_ptr;
+
+				/* update mem block */
+				h2d_w_idx_ptr = h2d_w_idx_ptr + sizeof(uint32);
+				h2d_r_idx_ptr = h2d_r_idx_ptr + sizeof(uint32);
+
+				DHD_INFO(("%s: FLOW Rings h2d w/r : idx %d write %x read %x \n",
+					__FUNCTION__, i,
+					bus->ring_sh[i].ring_state_w,
+					bus->ring_sh[i].ring_state_r));
+			}
+		}
+	}
+}
+
+/* Initialize bus module: prepare for communication w/dongle */
+int dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	int  ret = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(bus->dhd);
+	if (!bus->dhd)
+		return 0;
+
+	/* Make sure we're talking to the core. */
+	bus->reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+	ASSERT(bus->reg != NULL);
+
+	/* before opening up bus for data transfer, check if shared are is intact */
+	ret = dhdpcie_readshared(bus);
+	if (ret < 0) {
+		DHD_ERROR(("%s :Shared area read failed \n", __FUNCTION__));
+		return ret;
+	}
+
+
+	/* Make sure we're talking to the core. */
+	bus->reg = si_setcore(bus->sih, PCIE2_CORE_ID, 0);
+	ASSERT(bus->reg != NULL);
+
+	/* Set bus state according to enable result */
+	dhdp->busstate = DHD_BUS_DATA;
+
+	/* Enable the interrupt after device is up */
+	dhdpcie_bus_intr_enable(bus);
+
+	/* bcmsdh_intr_unmask(bus->sdh); */
+
+	return ret;
+
+}
+
+
+static void
+dhdpcie_init_shared_addr(dhd_bus_t *bus)
+{
+	uint32 addr = 0;
+	uint32 val = 0;
+	addr = bus->dongle_ram_base + bus->ramsize - 4;
+	dhdpcie_bus_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val));
+}
+
+
+bool
+dhdpcie_chipmatch(uint16 vendor, uint16 device)
+{
+	if (vendor != PCI_VENDOR_ID_BROADCOM) {
+		DHD_ERROR(("%s: Unsupported vendor %x device %x\n", __FUNCTION__,
+			vendor, device));
+		return (-ENODEV);
+	}
+
+	if ((device == BCM4350_D11AC_ID) || (device == BCM4350_D11AC2G_ID) ||
+		(device == BCM4350_D11AC5G_ID) || BCM4350_CHIP(device))
+		return 0;
+
+	if ((device == BCM4354_D11AC_ID) || (device == BCM4354_D11AC2G_ID) ||
+		(device == BCM4354_D11AC5G_ID) || (device == BCM4354_CHIP_ID))
+		return 0;
+
+	if ((device == BCM4356_D11AC_ID) || (device == BCM4356_D11AC2G_ID) ||
+		(device == BCM4356_D11AC5G_ID) || (device == BCM4356_CHIP_ID))
+		return 0;
+
+	if ((device == BCM4345_D11AC_ID) || (device == BCM4345_D11AC2G_ID) ||
+		(device == BCM4345_D11AC5G_ID) || (device == BCM4345_CHIP_ID))
+		return 0;
+
+	if ((device == BCM4335_D11AC_ID) || (device == BCM4335_D11AC2G_ID) ||
+		(device == BCM4335_D11AC5G_ID) || (device == BCM4335_CHIP_ID))
+		return 0;
+
+	if ((device == BCM43602_D11AC_ID) || (device == BCM43602_D11AC2G_ID) ||
+		(device == BCM43602_D11AC5G_ID) || (device == BCM43602_CHIP_ID))
+		return 0;
+
+	if ((device == BCM43569_D11AC_ID) || (device == BCM43569_D11AC2G_ID) ||
+		(device == BCM43569_D11AC5G_ID) || (device == BCM43569_CHIP_ID))
+		return 0;
+
+	if ((device == BCM4358_D11AC_ID) || (device == BCM4358_D11AC2G_ID) ||
+		(device == BCM4358_D11AC5G_ID) || (device == BCM4358_CHIP_ID))
+		return 0;
+
+	if ((device == BCM4349_D11AC_ID) || (device == BCM4349_D11AC2G_ID) ||
+		(device == BCM4349_D11AC5G_ID) || (device == BCM4349_CHIP_ID))
+		return 0;
+	if ((device == BCM4355_D11AC_ID) || (device == BCM4355_D11AC2G_ID) ||
+		(device == BCM4355_D11AC5G_ID) || (device == BCM4355_CHIP_ID))
+		return 0;
+	if ((device == BCM4359_D11AC_ID) || (device == BCM4359_D11AC2G_ID) ||
+		(device == BCM4359_D11AC5G_ID) || (device == BCM4359_CHIP_ID))
+		return 0;
+
+
+	DHD_ERROR(("%s: Unsupported vendor %x device %x\n", __FUNCTION__, vendor, device));
+	return (-ENODEV);
+}
+
+
+/*
+
+Name:  dhdpcie_cc_nvmshadow
+
+Description:
+A shadow of OTP/SPROM exists in ChipCommon Region
+betw. 0x800 and 0xBFF (Backplane Addr. 0x1800_0800 and 0x1800_0BFF).
+Strapping option (SPROM vs. OTP), presence of OTP/SPROM and its size
+can also be read from ChipCommon Registers.
+*/
+
+static int
+dhdpcie_cc_nvmshadow(dhd_bus_t *bus, struct bcmstrbuf *b)
+{
+	uint16 dump_offset = 0;
+	uint32 dump_size = 0, otp_size = 0, sprom_size = 0;
+
+	/* Table for 65nm OTP Size (in bits) */
+	int  otp_size_65nm[8] = {0, 2048, 4096, 8192, 4096, 6144, 512, 1024};
+
+	volatile uint16 *nvm_shadow;
+
+	uint cur_coreid;
+	uint chipc_corerev;
+	chipcregs_t *chipcregs;
+
+
+	/* Save the current core */
+	cur_coreid = si_coreid(bus->sih);
+	/* Switch to ChipC */
+	chipcregs = (chipcregs_t *)si_setcore(bus->sih, CC_CORE_ID, 0);
+	chipc_corerev = si_corerev(bus->sih);
+
+	/* Check ChipcommonCore Rev */
+	if (chipc_corerev < 44) {
+		DHD_ERROR(("%s: ChipcommonCore Rev %d < 44\n", __FUNCTION__, chipc_corerev));
+		return BCME_UNSUPPORTED;
+	}
+
+	/* Check ChipID */
+	if (((uint16)bus->sih->chip != BCM4350_CHIP_ID) &&
+		((uint16)bus->sih->chip != BCM4345_CHIP_ID)) {
+		DHD_ERROR(("%s: cc_nvmdump cmd. supported for 4350/4345 only\n",
+			__FUNCTION__));
+		return BCME_UNSUPPORTED;
+	}
+
+	/* Check if SRC_PRESENT in SpromCtrl(0x190 in ChipCommon Regs) is set */
+	if (chipcregs->sromcontrol & SRC_PRESENT) {
+		/* SPROM Size: 1Kbits (0x0), 4Kbits (0x1), 16Kbits(0x2) */
+		sprom_size = (1 << (2 * ((chipcregs->sromcontrol & SRC_SIZE_MASK)
+					>> SRC_SIZE_SHIFT))) * 1024;
+		bcm_bprintf(b, "\nSPROM Present (Size %d bits)\n", sprom_size);
+	}
+
+	if (chipcregs->sromcontrol & SRC_OTPPRESENT) {
+		bcm_bprintf(b, "\nOTP Present");
+
+		if (((chipcregs->otplayout & OTPL_WRAP_TYPE_MASK) >> OTPL_WRAP_TYPE_SHIFT)
+			== OTPL_WRAP_TYPE_40NM) {
+			/* 40nm OTP: Size = (OtpSize + 1) * 1024 bits */
+			otp_size =  (((chipcregs->capabilities & CC_CAP_OTPSIZE)
+				        >> CC_CAP_OTPSIZE_SHIFT) + 1) * 1024;
+			bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+		} else {
+			/* This part is untested since newer chips have 40nm OTP */
+			otp_size = otp_size_65nm[(chipcregs->capabilities & CC_CAP_OTPSIZE)
+				        >> CC_CAP_OTPSIZE_SHIFT];
+			bcm_bprintf(b, "(Size %d bits)\n", otp_size);
+			DHD_INFO(("%s: 65nm/130nm OTP Size not tested. \n",
+				__FUNCTION__));
+		}
+	}
+
+	if (((chipcregs->sromcontrol & SRC_PRESENT) == 0) &&
+		((chipcregs->capabilities & CC_CAP_OTPSIZE) == 0)) {
+		DHD_ERROR(("%s: SPROM and OTP could not be found \n",
+			__FUNCTION__));
+		return BCME_NOTFOUND;
+	}
+
+	/* Check the strapping option in SpromCtrl: Set = OTP otherwise SPROM */
+	if ((chipcregs->sromcontrol & SRC_OTPSEL) &&
+		(chipcregs->sromcontrol & SRC_OTPPRESENT)) {
+
+		bcm_bprintf(b, "OTP Strap selected.\n"
+		               "\nOTP Shadow in ChipCommon:\n");
+
+		dump_size = otp_size / 16 ; /* 16bit words */
+
+	} else if (((chipcregs->sromcontrol & SRC_OTPSEL) == 0) &&
+		(chipcregs->sromcontrol & SRC_PRESENT)) {
+
+		bcm_bprintf(b, "SPROM Strap selected\n"
+				"\nSPROM Shadow in ChipCommon:\n");
+
+		/* If SPROM > 8K only 8Kbits is mapped to ChipCommon (0x800 - 0xBFF) */
+		/* dump_size in 16bit words */
+		dump_size = sprom_size > 8 ? (8 * 1024) / 16 : sprom_size / 16;
+	}
+	else {
+		DHD_ERROR(("%s: NVM Shadow does not exist in ChipCommon\n",
+			__FUNCTION__));
+		return BCME_NOTFOUND;
+	}
+
+	if (bus->regs == NULL) {
+		DHD_ERROR(("ChipCommon Regs. not initialized\n"));
+		return BCME_NOTREADY;
+	} else {
+	    bcm_bprintf(b, "\n OffSet:");
+
+	    /* Point to the SPROM/OTP shadow in ChipCommon */
+	    nvm_shadow = chipcregs->sromotp;
+
+	   /*
+	    * Read 16 bits / iteration.
+	    * dump_size & dump_offset in 16-bit words
+	    */
+	    while (dump_offset < dump_size) {
+		if (dump_offset % 2 == 0)
+			/* Print the offset in the shadow space in Bytes */
+			bcm_bprintf(b, "\n 0x%04x", dump_offset * 2);
+
+		bcm_bprintf(b, "\t0x%04x", *(nvm_shadow + dump_offset));
+		dump_offset += 0x1;
+	    }
+	}
+
+	/* Switch back to the original core */
+	si_setcore(bus->sih, cur_coreid, 0);
+
+	return BCME_OK;
+}
+
+
+uint8 BCMFASTPATH
+dhd_bus_is_txmode_push(dhd_bus_t *bus)
+{
+	return bus->txmode_push;
+}
+
+void dhd_bus_clean_flow_ring(dhd_bus_t *bus, void *node)
+{
+	void *pkt;
+	flow_queue_t *queue;
+	flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)node;
+	unsigned long flags;
+
+	queue = &flow_ring_node->queue;
+
+#ifdef DHDTCPACK_SUPPRESS
+	/* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+	 * when there is a newly coming packet from network stack.
+	 */
+	dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+
+	/* clean up BUS level info */
+	DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+	/* Flush all pending packets in the queue, if any */
+	while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+		PKTFREE(bus->dhd->osh, pkt, TRUE);
+	}
+	ASSERT(flow_queue_empty(queue));
+
+	flow_ring_node->status = FLOW_RING_STATUS_CLOSED;
+	flow_ring_node->active = FALSE;
+	dll_delete(&flow_ring_node->list);
+
+	DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+	/* Call Flow ring clean up */
+	dhd_prot_clean_flow_ring(bus->dhd, flow_ring_node->prot_info);
+	dhd_flowid_free(bus->dhd, flow_ring_node->flow_info.ifindex,
+	                flow_ring_node->flowid);
+
+}
+
+/*
+ * Allocate a Flow ring buffer,
+ * Init Ring buffer,
+ * Send Msg to device about flow ring creation
+*/
+int
+dhd_bus_flow_ring_create_request(dhd_bus_t *bus, void *arg)
+{
+	flow_ring_node_t *flow_ring_node = (flow_ring_node_t *)arg;
+
+	DHD_INFO(("%s :Flow create\n", __FUNCTION__));
+
+	/* Send Msg to device about flow ring creation */
+	if (dhd_prot_flow_ring_create(bus->dhd, flow_ring_node) != BCME_OK)
+		return BCME_NOMEM;
+
+	return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_create_response(dhd_bus_t *bus, uint16 flowid, int32 status)
+{
+	flow_ring_node_t *flow_ring_node;
+	unsigned long flags;
+
+	DHD_INFO(("%s :Flow Response %d \n", __FUNCTION__, flowid));
+
+	flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+	ASSERT(flow_ring_node->flowid == flowid);
+
+	if (status != BCME_OK) {
+		DHD_ERROR(("%s Flow create Response failure error status = %d \n",
+		     __FUNCTION__, status));
+		/* Call Flow clean up */
+		dhd_bus_clean_flow_ring(bus, flow_ring_node);
+		return;
+	}
+
+	DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+	flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+	DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+	dhd_bus_schedule_queue(bus, flowid, FALSE);
+
+	return;
+}
+
+int
+dhd_bus_flow_ring_delete_request(dhd_bus_t *bus, void *arg)
+{
+	void * pkt;
+	flow_queue_t *queue;
+	flow_ring_node_t *flow_ring_node;
+	unsigned long flags;
+
+	DHD_INFO(("%s :Flow Delete\n", __FUNCTION__));
+
+	flow_ring_node = (flow_ring_node_t *)arg;
+
+	DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+	if (flow_ring_node->status & FLOW_RING_STATUS_DELETE_PENDING) {
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+		DHD_ERROR(("%s :Delete Pending\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+	flow_ring_node->status = FLOW_RING_STATUS_DELETE_PENDING;
+
+	queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+#ifdef DHDTCPACK_SUPPRESS
+	/* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+	 * when there is a newly coming packet from network stack.
+	 */
+	dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+	/* Flush all pending packets in the queue, if any */
+	while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+		PKTFREE(bus->dhd->osh, pkt, TRUE);
+	}
+	ASSERT(flow_queue_empty(queue));
+
+	DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+	/* Send Msg to device about flow ring deletion */
+	dhd_prot_flow_ring_delete(bus->dhd, flow_ring_node);
+
+	return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_delete_response(dhd_bus_t *bus, uint16 flowid, uint32 status)
+{
+	flow_ring_node_t *flow_ring_node;
+
+	DHD_INFO(("%s :Flow Delete Response %d \n", __FUNCTION__, flowid));
+
+	flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+	ASSERT(flow_ring_node->flowid == flowid);
+
+	if (status != BCME_OK) {
+		DHD_ERROR(("%s Flow Delete Response failure error status = %d \n",
+		    __FUNCTION__, status));
+		return;
+	}
+	/* Call Flow clean up */
+	dhd_bus_clean_flow_ring(bus, flow_ring_node);
+
+	return;
+
+}
+
+int dhd_bus_flow_ring_flush_request(dhd_bus_t *bus, void *arg)
+{
+	void *pkt;
+	flow_queue_t *queue;
+	flow_ring_node_t *flow_ring_node;
+	unsigned long flags;
+
+	DHD_INFO(("%s :Flow Delete\n", __FUNCTION__));
+
+	flow_ring_node = (flow_ring_node_t *)arg;
+	queue = &flow_ring_node->queue; /* queue associated with flow ring */
+
+	DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+
+#ifdef DHDTCPACK_SUPPRESS
+	/* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+	 * when there is a newly coming packet from network stack.
+	 */
+	dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+	/* Flush all pending packets in the queue, if any */
+	while ((pkt = dhd_flow_queue_dequeue(bus->dhd, queue)) != NULL) {
+		PKTFREE(bus->dhd->osh, pkt, TRUE);
+	}
+	ASSERT(flow_queue_empty(queue));
+
+	DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+	/* Send Msg to device about flow ring flush */
+	dhd_prot_flow_ring_flush(bus->dhd, flow_ring_node);
+
+	flow_ring_node->status = FLOW_RING_STATUS_FLUSH_PENDING;
+	return BCME_OK;
+}
+
+void
+dhd_bus_flow_ring_flush_response(dhd_bus_t *bus, uint16 flowid, uint32 status)
+{
+	flow_ring_node_t *flow_ring_node;
+
+	if (status != BCME_OK) {
+		DHD_ERROR(("%s Flow flush Response failure error status = %d \n",
+		    __FUNCTION__, status));
+		return;
+	}
+
+	flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+	ASSERT(flow_ring_node->flowid == flowid);
+
+	flow_ring_node->status = FLOW_RING_STATUS_OPEN;
+	return;
+}
+
+uint32
+dhd_bus_max_h2d_queues(struct dhd_bus *bus, uint8 *txpush)
+{
+	if (bus->txmode_push)
+		*txpush = 1;
+	else
+		*txpush = 0;
+	return bus->max_sub_queues;
+}
+
+int
+dhdpcie_bus_clock_start(struct dhd_bus *bus)
+{
+	return dhdpcie_start_host_pcieclock(bus);
+}
+
+int
+dhdpcie_bus_clock_stop(struct dhd_bus *bus)
+{
+	return dhdpcie_stop_host_pcieclock(bus);
+}
+
+int
+dhdpcie_bus_disable_device(struct dhd_bus *bus)
+{
+	return dhdpcie_disable_device(bus);
+}
+
+int
+dhdpcie_bus_enable_device(struct dhd_bus *bus)
+{
+	return dhdpcie_enable_device(bus);
+}
+
+int
+dhdpcie_bus_alloc_resource(struct dhd_bus *bus)
+{
+	return dhdpcie_alloc_resource(bus);
+}
+
+void
+dhdpcie_bus_free_resource(struct dhd_bus *bus)
+{
+	dhdpcie_free_resource(bus);
+}
+
+int
+dhd_bus_request_irq(struct dhd_bus *bus)
+{
+	return dhdpcie_bus_request_irq(bus);
+}
+
+bool
+dhdpcie_bus_dongle_attach(struct dhd_bus *bus)
+{
+	return dhdpcie_dongle_attach(bus);
+}
+
+int
+dhd_bus_release_dongle(struct dhd_bus *bus)
+{
+	bool dongle_isolation;
+	osl_t		*osh;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus) {
+		osh = bus->osh;
+		ASSERT(osh);
+
+		if (bus->dhd) {
+			dongle_isolation = bus->dhd->dongle_isolation;
+			dhdpcie_bus_release_dongle(bus, osh, dongle_isolation, TRUE);
+		}
+	}
+
+	return 0;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+int dhd_bus_oob_intr_register(dhd_pub_t *dhdp)
+{
+	return dhdpcie_oob_intr_register(dhdp->bus);
+}
+
+void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp)
+{
+	dhdpcie_oob_intr_unregister(dhdp->bus);
+}
+
+void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable)
+{
+	dhdpcie_oob_intr_set(dhdp->bus, enable);
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_pcie.h b/drivers/net/wireless/bcm4336/dhd_pcie.h
--- a/drivers/net/wireless/bcm4336/dhd_pcie.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_pcie.h	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,207 @@
+/*
+ * Linux DHD Bus Module for PCIE
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_pcie.h 506084 2014-10-02 15:34:59Z $
+ */
+
+
+#ifndef dhd_pcie_h
+#define dhd_pcie_h
+
+#include <bcmpcie.h>
+#include <hnd_cons.h>
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+#ifdef CONFIG_ARCH_MSM8994
+#include <linux/msm_pcie.h>
+#else
+#include <mach/msm_pcie.h>
+#endif
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+/* defines */
+
+#define PCMSGBUF_HDRLEN 0
+#define DONGLE_REG_MAP_SIZE (32 * 1024)
+#define DONGLE_TCM_MAP_SIZE (4096 * 1024)
+#define DONGLE_MIN_MEMSIZE (128 *1024)
+#ifdef DHD_DEBUG
+#define DHD_PCIE_SUCCESS 0
+#define DHD_PCIE_FAILURE 1
+#endif /* DHD_DEBUG */
+#define	REMAP_ENAB(bus)			((bus)->remap)
+#define	REMAP_ISADDR(bus, a)		(((a) >= ((bus)->orig_ramsize)) && ((a) < ((bus)->ramsize)))
+
+#define MAX_DHD_TX_FLOWS	256
+
+/* user defined data structures */
+#ifdef DHD_DEBUG
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX	192
+#define CONSOLE_BUFFER_MAX	2024
+
+
+typedef struct dhd_console {
+	 uint		count;	/* Poll interval msec counter */
+	 uint		log_addr;		 /* Log struct address (fixed) */
+	 hnd_log_t	 log;			 /* Log struct (host copy) */
+	 uint		 bufsize;		 /* Size of log buffer */
+	 uint8		 *buf;			 /* Log buffer (host copy) */
+	 uint		 last;			 /* Last buffer read index */
+} dhd_console_t;
+#endif /* DHD_DEBUG */
+typedef struct ring_sh_info {
+	uint32 ring_mem_addr;
+	uint32 ring_state_w;
+	uint32 ring_state_r;
+} ring_sh_info_t;
+
+typedef struct dhd_bus {
+	dhd_pub_t	*dhd;
+	struct pci_dev  *dev;		/* pci device handle */
+	dll_t       const_flowring; /* constructed list of tx flowring queues */
+
+	si_t		*sih;			/* Handle for SI calls */
+	char		*vars;			/* Variables (from CIS and/or other) */
+	uint		varsz;			/* Size of variables buffer */
+	uint32		sbaddr;			/* Current SB window pointer (-1, invalid) */
+	sbpcieregs_t	*reg;			/* Registers for PCIE core */
+
+	uint		armrev;			/* CPU core revision */
+	uint		ramrev;			/* SOCRAM core revision */
+	uint32		ramsize;		/* Size of RAM in SOCRAM (bytes) */
+	uint32		orig_ramsize;		/* Size of RAM in SOCRAM (bytes) */
+	uint32		srmemsize;		/* Size of SRMEM */
+
+	uint32		bus;			/* gSPI or SDIO bus */
+	uint32		intstatus;		/* Intstatus bits (events) pending */
+	bool		dpc_sched;		/* Indicates DPC schedule (intrpt rcvd) */
+	bool		fcstate;		/* State of dongle flow-control */
+
+	uint16		cl_devid;		/* cached devid for dhdsdio_probe_attach() */
+	char		*fw_path;		/* module_param: path to firmware image */
+	char		*nv_path;		/* module_param: path to nvram vars file */
+	char		*nvram_params;		/* user specified nvram params. */
+	int		nvram_params_len;
+
+	struct pktq	txq;			/* Queue length used for flow-control */
+
+	uint		rxlen;			/* Length of valid data in buffer */
+
+
+	bool		intr;			/* Use interrupts */
+	bool		ipend;			/* Device interrupt is pending */
+	bool		intdis;			/* Interrupts disabled by isr */
+	uint		intrcount;		/* Count of device interrupt callbacks */
+	uint		lastintrs;		/* Count as of last watchdog timer */
+
+#ifdef DHD_DEBUG
+	dhd_console_t	console;		/* Console output polling support */
+	uint		console_addr;		/* Console address from shared struct */
+#endif /* DHD_DEBUG */
+
+	bool		alp_only;		/* Don't use HT clock (ALP only) */
+
+	bool		remap;		/* Contiguous 1MB RAM: 512K socram + 512K devram
+					 * Available with socram rev 16
+					 * Remap region not DMA-able
+					 */
+	uint32		resetinstr;
+	uint32		dongle_ram_base;
+
+	ulong		shared_addr;
+	pciedev_shared_t	*pcie_sh;
+	bool bus_flowctrl;
+	ioctl_comp_resp_msg_t	ioct_resp;
+	uint32		dma_rxoffset;
+	volatile char	*regs;		/* pci device memory va */
+	volatile char	*tcm;		/* pci device memory va */
+	uint32		tcm_size;
+#ifdef CONFIG_ARCH_MSM8994
+	uint32		bar1_win_base;
+	uint32		bar1_win_mask;
+#endif
+	osl_t		*osh;
+	uint32		nvram_csm;	/* Nvram checksum */
+	uint16		pollrate;
+	uint16  polltick;
+
+	uint32  *pcie_mb_intr_addr;
+	void    *pcie_mb_intr_osh;
+	bool	sleep_allowed;
+
+	/* version 3 shared struct related info start */
+	ring_sh_info_t	ring_sh[BCMPCIE_COMMON_MSGRINGS + MAX_DHD_TX_FLOWS];
+	uint8	h2d_ring_count;
+	uint8	d2h_ring_count;
+	uint32  ringmem_ptr;
+	uint32  ring_state_ptr;
+
+	uint32 d2h_dma_scratch_buffer_mem_addr;
+
+	uint32 h2d_mb_data_ptr_addr;
+	uint32 d2h_mb_data_ptr_addr;
+	/* version 3 shared struct related info end */
+
+	uint32 def_intmask;
+	bool	ltrsleep_on_unload;
+	uint	wait_for_d3_ack;
+	uint8	txmode_push;
+	uint32 max_sub_queues;
+	bool	db1_for_mb;
+	bool	suspended;
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+	struct msm_pcie_register_event pcie_event;
+	bool islinkdown;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#ifdef PCIE_TX_DEFERRAL
+	struct workqueue_struct *tx_wq;
+	struct work_struct create_flow_work;
+	struct work_struct delete_flow_work;
+	unsigned long *delete_flow_map;
+	struct sk_buff_head orphan_list;
+#endif /* PCIE_TX_DEFERRAL */
+	bool irq_registered;
+} dhd_bus_t;
+
+/* function declarations */
+
+extern uint32* dhdpcie_bus_reg_map(osl_t *osh, ulong addr, int size);
+extern int dhdpcie_bus_register(void);
+extern void dhdpcie_bus_unregister(void);
+extern bool dhdpcie_chipmatch(uint16 vendor, uint16 device);
+
+extern struct dhd_bus* dhdpcie_bus_attach(osl_t *osh, volatile char* regs,
+	volatile char* tcm, uint32 tcm_size);
+extern uint32 dhdpcie_bus_cfg_read_dword(struct dhd_bus *bus, uint32 addr, uint32 size);
+extern void dhdpcie_bus_cfg_write_dword(struct dhd_bus *bus, uint32 addr, uint32 size, uint32 data);
+extern void dhdpcie_bus_intr_disable(struct dhd_bus *bus);
+extern void dhdpcie_bus_remove_prep(struct dhd_bus *bus);
+extern void dhdpcie_bus_release(struct dhd_bus *bus);
+extern int32 dhdpcie_bus_isr(struct dhd_bus *bus);
+extern void dhdpcie_free_irq(dhd_bus_t *bus);
+extern int dhdpcie_bus_suspend(struct  dhd_bus *bus, bool state);
+extern int dhdpcie_pci_suspend_resume(struct dhd_bus *bus, bool state);
+#ifndef BCMPCIE_OOB_HOST_WAKE
+extern void dhdpcie_pme_active(osl_t *osh, bool enable);
+#endif /* !BCMPCIE_OOB_HOST_WAKE */
+extern int dhdpcie_start_host_pcieclock(dhd_bus_t *bus);
+extern int dhdpcie_stop_host_pcieclock(dhd_bus_t *bus);
+extern int dhdpcie_disable_device(dhd_bus_t *bus);
+extern int dhdpcie_enable_device(dhd_bus_t *bus);
+extern int dhdpcie_alloc_resource(dhd_bus_t *bus);
+extern void dhdpcie_free_resource(dhd_bus_t *bus);
+extern int dhdpcie_bus_request_irq(struct dhd_bus *bus);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+extern int dhdpcie_oob_intr_register(dhd_bus_t *bus);
+extern void dhdpcie_oob_intr_unregister(dhd_bus_t *bus);
+extern void dhdpcie_oob_intr_set(dhd_bus_t *bus, bool enable);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+extern int dhd_buzzz_dump_dngl(dhd_bus_t *bus);
+#endif /* dhd_pcie_h */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_pcie_linux.c b/drivers/net/wireless/bcm4336/dhd_pcie_linux.c
--- a/drivers/net/wireless/bcm4336/dhd_pcie_linux.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_pcie_linux.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,1315 @@
+/*
+ * Linux DHD Bus Module for PCIE
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_pcie_linux.c 506043 2014-10-02 12:29:45Z $
+ */
+
+
+/* include files */
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdevs.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <hndpmu.h>
+#include <sbchipc.h>
+#if defined(DHD_DEBUG)
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <dngl_stats.h>
+#include <pcie_core.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <bcmmsgbuf.h>
+#include <pcicfg.h>
+#include <dhd_pcie.h>
+#include <dhd_linux.h>
+#ifdef CONFIG_ARCH_MSM
+#ifdef CONFIG_ARCH_MSM8994
+#include <linux/msm_pcie.h>
+#else
+#include <mach/msm_pcie.h>
+#endif
+#endif /* CONFIG_ARCH_MSM */
+
+#define PCI_CFG_RETRY 		10
+#define OS_HANDLE_MAGIC		0x1234abcd	/* Magic # to recognize osh */
+#define BCM_MEM_FILENAME_LEN 	24		/* Mem. filename length */
+
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+	struct sk_buff *s = (struct sk_buff *)(p); \
+	ASSERT(OSL_PKTTAG_SZ == 32); \
+	*(uint32 *)(&s->cb[0]) = 0; *(uint32 *)(&s->cb[4]) = 0; \
+	*(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
+	*(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
+	*(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+} while (0)
+
+
+/* user defined data structures  */
+
+typedef struct dhd_pc_res {
+	uint32 bar0_size;
+	void* bar0_addr;
+	uint32 bar1_size;
+	void* bar1_addr;
+} pci_config_res, *pPci_config_res;
+
+typedef bool (*dhdpcie_cb_fn_t)(void *);
+
+typedef struct dhdpcie_info
+{
+	dhd_bus_t	*bus;
+	osl_t 			*osh;
+	struct pci_dev  *dev;		/* pci device handle */
+	volatile char 	*regs;		/* pci device memory va */
+	volatile char 	*tcm;		/* pci device memory va */
+	uint32			tcm_size;	/* pci device memory size */
+	struct pcos_info *pcos_info;
+	uint16		last_intrstatus;	/* to cache intrstatus */
+	int	irq;
+	char pciname[32];
+	struct pci_saved_state* state;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+	void *os_cxt;			/* Pointer to per-OS private data */
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+} dhdpcie_info_t;
+
+
+struct pcos_info {
+	dhdpcie_info_t *pc;
+	spinlock_t lock;
+	wait_queue_head_t intr_wait_queue;
+	struct timer_list tuning_timer;
+	int tuning_timer_exp;
+	atomic_t timer_enab;
+	struct tasklet_struct tuning_tasklet;
+};
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+typedef struct dhdpcie_os_info {
+	int			oob_irq_num;	/* valid when hardware or software oob in use */
+	unsigned long		oob_irq_flags;	/* valid when hardware or software oob in use */
+	bool			oob_irq_registered;
+	bool			oob_irq_enabled;
+	bool			oob_irq_wake_enabled;
+	spinlock_t		oob_irq_spinlock;
+	void			*dev;		/* handle to the underlying device */
+} dhdpcie_os_info_t;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+/* function declarations */
+static int __devinit
+dhdpcie_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
+static void __devexit
+dhdpcie_pci_remove(struct pci_dev *pdev);
+static int dhdpcie_init(struct pci_dev *pdev);
+static irqreturn_t dhdpcie_isr(int irq, void *arg);
+/* OS Routine functions for PCI suspend/resume */
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+DEFINE_MUTEX(_dhd_sdio_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+
+static int dhdpcie_pci_suspend(struct pci_dev *dev, pm_message_t state);
+static int dhdpcie_set_suspend_resume(struct pci_dev *dev, bool state);
+static int dhdpcie_pci_resume(struct pci_dev *dev);
+static int dhdpcie_resume_dev(struct pci_dev *dev);
+static int dhdpcie_suspend_dev(struct pci_dev *dev);
+static struct pci_device_id dhdpcie_pci_devid[] __devinitdata = {
+	{ vendor: 0x14e4,
+	device: PCI_ANY_ID,
+	subvendor: PCI_ANY_ID,
+	subdevice: PCI_ANY_ID,
+	class: PCI_CLASS_NETWORK_OTHER << 8,
+	class_mask: 0xffff00,
+	driver_data: 0,
+	},
+	{ 0, }
+};
+MODULE_DEVICE_TABLE(pci, dhdpcie_pci_devid);
+
+static struct pci_driver dhdpcie_driver = {
+	node:		{},
+	name:		"pcieh",
+	id_table:	dhdpcie_pci_devid,
+	probe:		dhdpcie_pci_probe,
+	remove:		dhdpcie_pci_remove,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+	save_state:	NULL,
+#endif
+	suspend:	dhdpcie_pci_suspend,
+	resume:		dhdpcie_pci_resume,
+};
+
+int dhdpcie_init_succeeded = FALSE;
+
+static int dhdpcie_set_suspend_resume(struct pci_dev *pdev, bool state)
+{
+	int ret = 0;
+	dhdpcie_info_t *pch = pci_get_drvdata(pdev);
+	dhd_bus_t *bus = NULL;
+
+	if (pch) {
+		bus = pch->bus;
+	}
+
+	/* When firmware is not loaded do the PCI bus */
+	/* suspend/resume only */
+	if (bus && (bus->dhd->busstate == DHD_BUS_DOWN) &&
+#ifdef CONFIG_MACH_UNIVERSAL5433
+		/* RB:34285 check_rev() : return 1 - new rev., 0 - old rev. */
+		(!check_rev() || (check_rev() && !bus->dhd->dongle_reset)))
+#else
+		!bus->dhd->dongle_reset)
+#endif /* CONFIG_MACH_UNIVERSAL5433 */
+		{
+			ret = dhdpcie_pci_suspend_resume(bus, state);
+			return ret;
+		}
+
+	if (bus && ((bus->dhd->busstate == DHD_BUS_SUSPEND)||
+		(bus->dhd->busstate == DHD_BUS_DATA)) &&
+		(bus->suspended != state)) {
+
+		ret = dhdpcie_bus_suspend(bus, state);
+	}
+	return ret;
+}
+
+static int dhdpcie_pci_suspend(struct pci_dev * pdev, pm_message_t state)
+{
+	BCM_REFERENCE(state);
+	return dhdpcie_set_suspend_resume(pdev, TRUE);
+}
+
+static int dhdpcie_pci_resume(struct pci_dev *pdev)
+{
+	return dhdpcie_set_suspend_resume(pdev, FALSE);
+}
+
+static int dhdpcie_suspend_dev(struct pci_dev *dev)
+{
+	int ret;
+	DHD_TRACE_HW4(("%s: Enter\n", __FUNCTION__));
+	pci_save_state(dev);
+	pci_enable_wake(dev, PCI_D0, TRUE);
+	pci_disable_device(dev);
+	ret = pci_set_power_state(dev, PCI_D3hot);
+	if (ret) {
+		DHD_ERROR(("%s: pci_set_power_state error %d\n",
+			__FUNCTION__, ret));
+	}
+	return ret;
+}
+
+static int dhdpcie_resume_dev(struct pci_dev *dev)
+{
+	int err = 0;
+	DHD_TRACE_HW4(("%s: Enter\n", __FUNCTION__));
+	pci_restore_state(dev);
+	err = pci_enable_device(dev);
+	if (err) {
+		printf("%s:pci_enable_device error %d \n", __FUNCTION__, err);
+		return err;
+	}
+	pci_set_master(dev);
+	err = pci_set_power_state(dev, PCI_D0);
+	if (err) {
+		printf("%s:pci_set_power_state error %d \n", __FUNCTION__, err);
+		return err;
+	}
+	return err;
+}
+
+int dhdpcie_pci_suspend_resume(struct dhd_bus *bus, bool state)
+{
+	int rc;
+	struct pci_dev *dev = bus->dev;
+
+	if (state) {
+#ifndef BCMPCIE_OOB_HOST_WAKE
+		dhdpcie_pme_active(bus->osh, state);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+		rc = dhdpcie_suspend_dev(dev);
+	} else {
+		rc = dhdpcie_resume_dev(dev);
+#ifndef BCMPCIE_OOB_HOST_WAKE
+		dhdpcie_pme_active(bus->osh, state);
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+	}
+	return rc;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+static int dhdpcie_device_scan(struct device *dev, void *data)
+{
+	struct pci_dev *pcidev;
+	int *cnt = data;
+
+	pcidev = container_of(dev, struct pci_dev, dev);
+	if (pcidev->vendor != 0x14e4)
+		return 0;
+
+	DHD_INFO(("Found Broadcom PCI device 0x%04x\n", pcidev->device));
+	*cnt += 1;
+	if (pcidev->driver && strcmp(pcidev->driver->name, dhdpcie_driver.name))
+		DHD_ERROR(("Broadcom PCI Device 0x%04x has allocated with driver %s\n",
+			pcidev->device, pcidev->driver->name));
+
+	return 0;
+}
+#endif /* LINUX_VERSION >= 2.6.0 */
+
+int
+dhdpcie_bus_register(void)
+{
+	int error = 0;
+
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+	if (!(error = pci_module_init(&dhdpcie_driver)))
+		return 0;
+
+	DHD_ERROR(("%s: pci_module_init failed 0x%x\n", __FUNCTION__, error));
+#else
+	if (!(error = pci_register_driver(&dhdpcie_driver))) {
+		bus_for_each_dev(dhdpcie_driver.driver.bus, NULL, &error, dhdpcie_device_scan);
+		if (!error) {
+			DHD_ERROR(("No Broadcom PCI device enumerated!\n"));
+		} else if (!dhdpcie_init_succeeded) {
+			DHD_ERROR(("%s: dhdpcie initialize failed.\n", __FUNCTION__));
+		} else {
+			return 0;
+		}
+
+		pci_unregister_driver(&dhdpcie_driver);
+		error = BCME_ERROR;
+	}
+#endif /* LINUX_VERSION < 2.6.0 */
+
+	return error;
+}
+
+
+void
+dhdpcie_bus_unregister(void)
+{
+	pci_unregister_driver(&dhdpcie_driver);
+}
+
+int __devinit
+dhdpcie_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+
+	if (dhdpcie_chipmatch (pdev->vendor, pdev->device)) {
+		DHD_ERROR(("%s: chipmatch failed!!\n", __FUNCTION__));
+			return -ENODEV;
+	}
+	printf("PCI_PROBE:  bus %X, slot %X,vendor %X, device %X"
+		"(good PCI location)\n", pdev->bus->number,
+		PCI_SLOT(pdev->devfn), pdev->vendor, pdev->device);
+
+	if (dhdpcie_init (pdev)) {
+		DHD_ERROR(("%s: PCIe Enumeration failed\n", __FUNCTION__));
+		return -ENODEV;
+	}
+
+#ifdef BCMPCIE_DISABLE_ASYNC_SUSPEND
+	/* disable async suspend */
+	device_disable_async_suspend(&pdev->dev);
+#endif /* BCMPCIE_DISABLE_ASYNC_SUSPEND */
+
+	DHD_TRACE(("%s: PCIe Enumeration done!!\n", __FUNCTION__));
+	return 0;
+}
+
+int
+dhdpcie_detach(dhdpcie_info_t *pch)
+{
+	if (pch) {
+		osl_t *osh = pch->osh;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+		if (!dhd_download_fw_on_driverload)
+			pci_load_and_free_saved_state(pch->dev, &pch->state);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+		MFREE(osh, pch, sizeof(dhdpcie_info_t));
+	}
+	return 0;
+}
+
+
+void __devexit
+dhdpcie_pci_remove(struct pci_dev *pdev)
+{
+	osl_t *osh = NULL;
+	dhdpcie_info_t *pch = NULL;
+	dhd_bus_t *bus = NULL;
+#ifdef PCIE_TX_DEFERRAL
+	struct sk_buff *skb;
+#endif
+
+	DHD_TRACE(("%s Enter\n", __FUNCTION__));
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	if (mutex_is_locked(&_dhd_sdio_mutex_lock_) == 0) {
+		DHD_ERROR(("%s : no mutex held. set lock\n", __FUNCTION__));
+	}
+	else {
+		DHD_ERROR(("%s : mutex is locked!. wait for unlocking\n", __FUNCTION__));
+	}
+	mutex_lock(&_dhd_sdio_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+
+	pch = pci_get_drvdata(pdev);
+	bus = pch->bus;
+	osh = pch->osh;
+
+#ifdef PCIE_TX_DEFERRAL
+	if (bus->tx_wq)
+		destroy_workqueue(bus->tx_wq);
+	skb = skb_dequeue(&bus->orphan_list);
+	while (skb) {
+		PKTCFREE(osh, skb, TRUE);
+		skb = skb_dequeue(&bus->orphan_list);
+	}
+#endif
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+	if (bus)
+		msm_pcie_deregister_event(&bus->pcie_event);
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+	dhdpcie_bus_remove_prep(bus);
+	dhdpcie_bus_release(bus);
+	pci_disable_device(pdev);
+#ifdef BCMPCIE_OOB_HOST_WAKE
+	/* pcie os info detach */
+	MFREE(osh, pch->os_cxt, sizeof(dhdpcie_os_info_t));
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+	/* pcie info detach */
+	dhdpcie_detach(pch);
+	/* osl detach */
+	osl_detach(osh);
+
+	dhdpcie_init_succeeded = FALSE;
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	mutex_unlock(&_dhd_sdio_mutex_lock_);
+	DHD_ERROR(("%s : the lock is released.\n", __FUNCTION__));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif /* LINUX */
+
+	DHD_TRACE(("%s Exit\n", __FUNCTION__));
+
+	return;
+}
+
+/* Free Linux irq */
+int
+dhdpcie_request_irq(dhdpcie_info_t *dhdpcie_info)
+{
+	dhd_bus_t *bus = dhdpcie_info->bus;
+	struct pci_dev *pdev = dhdpcie_info->bus->dev;
+
+	snprintf(dhdpcie_info->pciname, sizeof(dhdpcie_info->pciname),
+	    "dhdpcie:%s", pci_name(pdev));
+	if (request_irq(pdev->irq, dhdpcie_isr, IRQF_SHARED,
+	                dhdpcie_info->pciname, bus) < 0) {
+			DHD_ERROR(("%s: request_irq() failed\n", __FUNCTION__));
+			return -1;
+	}
+	bus->irq_registered = TRUE;
+
+	DHD_TRACE(("%s %s\n", __FUNCTION__, dhdpcie_info->pciname));
+
+
+	return 0; /* SUCCESS */
+}
+
+#ifdef CONFIG_PHYS_ADDR_T_64BIT
+#define PRINTF_RESOURCE	"0x%016llx"
+#else
+#define PRINTF_RESOURCE	"0x%08x"
+#endif
+
+/*
+
+Name:  osl_pci_get_resource
+
+Parametrs:
+
+1: struct pci_dev *pdev   -- pci device structure
+2: pci_res                       -- structure containing pci configuration space values
+
+
+Return value:
+
+int   - Status (TRUE or FALSE)
+
+Description:
+Access PCI configuration space, retrieve  PCI allocated resources , updates in resource structure.
+
+ */
+int dhdpcie_get_resource(dhdpcie_info_t *dhdpcie_info)
+{
+	phys_addr_t  bar0_addr, bar1_addr;
+	ulong bar1_size;
+	struct pci_dev *pdev = NULL;
+	pdev = dhdpcie_info->dev;
+	do {
+		if (pci_enable_device(pdev)) {
+			printf("%s: Cannot enable PCI device\n", __FUNCTION__);
+			break;
+		}
+		pci_set_master(pdev);
+		bar0_addr = pci_resource_start(pdev, 0);	/* Bar-0 mapped address */
+		bar1_addr = pci_resource_start(pdev, 2);	/* Bar-1 mapped address */
+
+		/* read Bar-1 mapped memory range */
+		bar1_size = pci_resource_len(pdev, 2);
+
+		if ((bar1_size == 0) || (bar1_addr == 0)) {
+			printf("%s: BAR1 Not enabled for this device  size(%ld),"
+				" addr(0x"PRINTF_RESOURCE")\n",
+				__FUNCTION__, bar1_size, bar1_addr);
+			goto err;
+		}
+
+		dhdpcie_info->regs = (volatile char *) REG_MAP(bar0_addr, DONGLE_REG_MAP_SIZE);
+		dhdpcie_info->tcm_size =
+		    (bar1_size < DONGLE_TCM_MAP_SIZE) ? bar1_size : DONGLE_TCM_MAP_SIZE;
+		dhdpcie_info->tcm = (volatile char *) REG_MAP(bar1_addr, dhdpcie_info->tcm_size);
+
+		if (!dhdpcie_info->regs || !dhdpcie_info->tcm) {
+			DHD_ERROR(("%s:ioremap() failed\n", __FUNCTION__));
+			break;
+		}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+		if (!dhd_download_fw_on_driverload) {
+			/* Backup PCIe configuration so as to use Wi-Fi on/off process
+			 * in case of built in driver
+			 */
+			pci_save_state(pdev);
+			dhdpcie_info->state = pci_store_saved_state(pdev);
+
+			if (dhdpcie_info->state == NULL) {
+				DHD_ERROR(("%s pci_store_saved_state returns NULL\n",
+					__FUNCTION__));
+				REG_UNMAP(dhdpcie_info->regs);
+				REG_UNMAP(dhdpcie_info->tcm);
+				pci_disable_device(pdev);
+				break;
+			}
+		}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0) */
+
+		DHD_TRACE(("%s:Phys addr : reg space = %p base addr 0x"PRINTF_RESOURCE" \n",
+			__FUNCTION__, dhdpcie_info->regs, bar0_addr));
+		DHD_TRACE(("%s:Phys addr : tcm_space = %p base addr 0x"PRINTF_RESOURCE" \n",
+			__FUNCTION__, dhdpcie_info->tcm, bar1_addr));
+
+		return 0; /* SUCCESS  */
+	} while (0);
+err:
+	return -1;  /* FAILURE */
+}
+
+int dhdpcie_scan_resource(dhdpcie_info_t *dhdpcie_info)
+{
+
+	DHD_TRACE(("%s: ENTER\n", __FUNCTION__));
+
+	do {
+		/* define it here only!! */
+		if (dhdpcie_get_resource (dhdpcie_info)) {
+			DHD_ERROR(("%s: Failed to get PCI resources\n", __FUNCTION__));
+			break;
+		}
+		DHD_TRACE(("%s:Exit - SUCCESS \n",
+			__FUNCTION__));
+
+		return 0; /* SUCCESS */
+
+	} while (0);
+
+	DHD_TRACE(("%s:Exit - FAILURE \n", __FUNCTION__));
+
+	return -1; /* FAILURE */
+
+}
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+void dhdpcie_linkdown_cb(struct msm_pcie_notify *noti)
+{
+	struct pci_dev *pdev = (struct pci_dev *)noti->user;
+	dhdpcie_info_t *pch = NULL;
+
+	if (pdev) {
+		pch = pci_get_drvdata(pdev);
+		if (pch) {
+			dhd_bus_t *bus = pch->bus;
+			if (bus) {
+				dhd_pub_t *dhd = bus->dhd;
+				if (dhd) {
+					DHD_ERROR(("%s: Event HANG send up "
+						"due to PCIe linkdown\n",
+						__FUNCTION__));
+					bus->islinkdown = TRUE;
+					DHD_OS_WAKE_LOCK(dhd);
+					dhd_os_check_hang(dhd, 0, -ETIMEDOUT);
+				}
+			}
+		}
+	}
+
+}
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+#ifdef PCIE_TX_DEFERRAL
+static void dhd_pcie_create_flow_worker(struct work_struct *worker)
+{
+	dhd_bus_t *bus;
+	struct sk_buff *skb;
+	uint16 ifidx, flowid;
+	flow_queue_t *queue;
+	flow_ring_node_t *flow_ring_node;
+	unsigned long flags;
+
+	bus = container_of(worker, dhd_bus_t, create_flow_work);
+	skb = skb_dequeue(&bus->orphan_list);
+	while (skb) {
+		ifidx = DHD_PKTTAG_FLOWID((dhd_pkttag_fr_t*)PKTTAG(skb));
+		if (BCME_OK != dhd_flowid_update(bus->dhd, ifidx,
+			bus->dhd->flow_prio_map[(PKTPRIO(skb))], skb)) {
+			PKTCFREE(bus->dhd->osh, skb, TRUE);
+			skb = skb_dequeue(&bus->orphan_list);
+			continue;
+		}
+		flowid = DHD_PKTTAG_FLOWID((dhd_pkttag_fr_t*)PKTTAG(skb));
+		flow_ring_node = DHD_FLOW_RING(bus->dhd, flowid);
+		queue = &flow_ring_node->queue;
+		DHD_FLOWRING_LOCK(flow_ring_node->lock, flags);
+		if ((flowid >= bus->dhd->num_flow_rings) ||
+			(!flow_ring_node->active) ||
+			(flow_ring_node->status == FLOW_RING_STATUS_DELETE_PENDING)) {
+			DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+			DHD_ERROR(("%s: Dropping pkt flowid %d, status %d active %d\n",
+				__FUNCTION__, flowid, flow_ring_node->status,
+				flow_ring_node->active));
+			PKTCFREE(bus->dhd->osh, skb, TRUE);
+			skb = skb_dequeue(&bus->orphan_list);
+			continue;
+		}
+		if (BCME_OK != dhd_flow_queue_enqueue(bus->dhd, queue, skb)) {
+			DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+			PKTCFREE(bus->dhd->osh, skb, TRUE);
+			skb = skb_dequeue(&bus->orphan_list);
+			continue;
+		}
+		DHD_FLOWRING_UNLOCK(flow_ring_node->lock, flags);
+
+		if (flow_ring_node->status == FLOW_RING_STATUS_OPEN)
+			dhd_bus_schedule_queue(bus, flowid, FALSE);
+
+		skb = skb_dequeue(&bus->orphan_list);
+	}
+}
+
+static void dhd_pcie_delete_flow_worker(struct work_struct *worker)
+{
+	dhd_bus_t *bus;
+	uint16 flowid;
+
+	bus = container_of(worker, dhd_bus_t, delete_flow_work);
+	for_each_set_bit(flowid, bus->delete_flow_map, bus->dhd->num_flow_rings) {
+		clear_bit(flowid, bus->delete_flow_map);
+		dhd_bus_flow_ring_delete_response(bus, flowid, BCME_OK);
+	}
+}
+
+#endif /* PCIE_TX_DEFERRAL */
+
+#if defined(MULTIPLE_SUPPLICANT)
+extern void wl_android_post_init(void); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#endif
+
+int dhdpcie_init(struct pci_dev *pdev)
+{
+
+	osl_t 				*osh = NULL;
+	dhd_bus_t 			*bus = NULL;
+	dhdpcie_info_t		*dhdpcie_info =  NULL;
+	wifi_adapter_info_t	*adapter = NULL;
+#ifdef BCMPCIE_OOB_HOST_WAKE
+	dhdpcie_os_info_t	*dhdpcie_osinfo = NULL;
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	if (mutex_is_locked(&_dhd_sdio_mutex_lock_) == 0) {
+		DHD_ERROR(("%s : no mutex held. set lock\n", __FUNCTION__));
+	}
+	else {
+		DHD_ERROR(("%s : mutex is locked!. wait for unlocking\n", __FUNCTION__));
+	}
+	mutex_lock(&_dhd_sdio_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+
+	do {
+		/* osl attach */
+		if (!(osh = osl_attach(pdev, PCI_BUS, FALSE))) {
+			DHD_ERROR(("%s: osl_attach failed\n", __FUNCTION__));
+			break;
+		}
+
+		/* initialize static buffer */
+		adapter = dhd_wifi_platform_get_adapter(PCI_BUS, pdev->bus->number,
+			PCI_SLOT(pdev->devfn));
+		if (adapter != NULL)
+			DHD_ERROR(("%s: found adapter info '%s'\n", __FUNCTION__, adapter->name));
+		else
+			DHD_ERROR(("%s: can't find adapter info for this chip\n", __FUNCTION__));
+		osl_static_mem_init(osh, adapter);
+
+		/*  allocate linux spcific pcie structure here */
+		if (!(dhdpcie_info = MALLOC(osh, sizeof(dhdpcie_info_t)))) {
+			DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+			break;
+		}
+		bzero(dhdpcie_info, sizeof(dhdpcie_info_t));
+		dhdpcie_info->osh = osh;
+		dhdpcie_info->dev = pdev;
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+		/* allocate OS speicific structure */
+		dhdpcie_osinfo = MALLOC(osh, sizeof(dhdpcie_os_info_t));
+		if (dhdpcie_osinfo == NULL) {
+			DHD_ERROR(("%s: MALLOC of dhdpcie_os_info_t failed\n",
+				__FUNCTION__));
+			break;
+		}
+		bzero(dhdpcie_osinfo, sizeof(dhdpcie_os_info_t));
+		dhdpcie_info->os_cxt = (void *)dhdpcie_osinfo;
+
+		/* Initialize host wake IRQ */
+		spin_lock_init(&dhdpcie_osinfo->oob_irq_spinlock);
+		/* Get customer specific host wake IRQ parametres: IRQ number as IRQ type */
+		dhdpcie_osinfo->oob_irq_num = wifi_platform_get_irq_number(adapter,
+			&dhdpcie_osinfo->oob_irq_flags);
+		if (dhdpcie_osinfo->oob_irq_num < 0) {
+			DHD_ERROR(("%s: Host OOB irq is not defined\n", __FUNCTION__));
+		}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+		/* Find the PCI resources, verify the  */
+		/* vendor and device ID, map BAR regions and irq,  update in structures */
+		if (dhdpcie_scan_resource(dhdpcie_info)) {
+			DHD_ERROR(("%s: dhd_Scan_PCI_Res failed\n", __FUNCTION__));
+
+			break;
+		}
+
+		/* Bus initialization */
+		bus = dhdpcie_bus_attach(osh, dhdpcie_info->regs,
+		    dhdpcie_info->tcm, dhdpcie_info->tcm_size);
+		if (!bus) {
+			DHD_ERROR(("%s:dhdpcie_bus_attach() failed\n", __FUNCTION__));
+			break;
+		}
+
+		dhdpcie_info->bus = bus;
+		dhdpcie_info->bus->dev = pdev;
+
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+#ifdef CONFIG_ARCH_MSM
+		bus->pcie_event.events = MSM_PCIE_EVENT_LINKDOWN;
+		bus->pcie_event.user = pdev;
+		bus->pcie_event.mode = MSM_PCIE_TRIGGER_CALLBACK;
+		bus->pcie_event.callback = dhdpcie_linkdown_cb;
+		bus->pcie_event.options = MSM_PCIE_CONFIG_NO_RECOVERY;
+		msm_pcie_register_event(&bus->pcie_event);
+		bus->islinkdown = FALSE;
+#endif /* CONFIG_ARCH_MSM */
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+
+		if (bus->intr) {
+			/* Register interrupt callback, but mask it (not operational yet). */
+			DHD_INTR(("%s: Registering and masking interrupts\n", __FUNCTION__));
+			dhdpcie_bus_intr_disable(bus);
+
+			if (dhdpcie_request_irq(dhdpcie_info)) {
+				DHD_ERROR(("%s: request_irq() failed\n", __FUNCTION__));
+				break;
+			}
+		} else {
+			bus->pollrate = 1;
+			DHD_INFO(("%s: PCIe interrupt function is NOT registered "
+				"due to polling mode\n", __FUNCTION__));
+		}
+
+#if 0 // terence 20150325: fix for WPA/WPA2 4-way handshake fail in hostapd
+		if (dhd_download_fw_on_driverload) {
+			if (dhd_bus_start(bus->dhd)) {
+				DHD_ERROR(("%s: dhd_bud_start() failed\n", __FUNCTION__));
+				break;
+			}
+		}
+#endif
+
+		/* set private data for pci_dev */
+		pci_set_drvdata(pdev, dhdpcie_info);
+
+#ifdef PCIE_TX_DEFERRAL
+		bus->tx_wq = create_singlethread_workqueue("bcmdhd_tx");
+		if (bus->tx_wq == NULL) {
+			DHD_ERROR(("%s workqueue creation failed\n", __FUNCTION__));
+			break;
+		}
+		INIT_WORK(&bus->create_flow_work, dhd_pcie_create_flow_worker);
+		INIT_WORK(&bus->delete_flow_work, dhd_pcie_delete_flow_worker);
+		skb_queue_head_init(&bus->orphan_list);
+#endif /* PCIE_TX_DEFERRAL */
+
+		/* Attach to the OS network interface */
+		DHD_TRACE(("%s(): Calling dhd_register_if() \n", __FUNCTION__));
+		if (dhd_register_if(bus->dhd, 0, TRUE)) {
+			DHD_ERROR(("%s(): ERROR.. dhd_register_if() failed\n", __FUNCTION__));
+			break;
+		}
+
+		dhdpcie_init_succeeded = TRUE;
+
+#if defined(MULTIPLE_SUPPLICANT)
+		wl_android_post_init(); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+		mutex_unlock(&_dhd_sdio_mutex_lock_);
+		DHD_ERROR(("%s : the lock is released.\n", __FUNCTION__));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#endif
+
+		DHD_TRACE(("%s:Exit - SUCCESS \n", __FUNCTION__));
+		return 0;  /* return  SUCCESS  */
+
+	} while (0);
+	/* reverse the initialization in order in case of error */
+
+	if (bus)
+		dhdpcie_bus_release(bus);
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+	if (dhdpcie_osinfo)
+		MFREE(osh, dhdpcie_osinfo, sizeof(dhdpcie_os_info_t));
+#endif /* BCMPCIE_OOB_HOST_WAKE */
+
+	if (dhdpcie_info)
+		dhdpcie_detach(dhdpcie_info);
+	pci_disable_device(pdev);
+	if (osh)
+		osl_detach(osh);
+
+	dhdpcie_init_succeeded = FALSE;
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	mutex_unlock(&_dhd_sdio_mutex_lock_);
+	DHD_ERROR(("%s : the lock is released.\n", __FUNCTION__));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#endif
+
+	DHD_TRACE(("%s:Exit - FAILURE \n", __FUNCTION__));
+
+	return -1; /* return FAILURE  */
+}
+
+/* Free Linux irq */
+void
+dhdpcie_free_irq(dhd_bus_t *bus)
+{
+	struct pci_dev *pdev = NULL;
+
+	DHD_TRACE(("%s: freeing up the IRQ\n", __FUNCTION__));
+	if (bus && bus->irq_registered) {
+		pdev = bus->dev;
+		free_irq(pdev->irq, bus);
+		bus->irq_registered = FALSE;
+	}
+	DHD_TRACE(("%s: Exit\n", __FUNCTION__));
+	return;
+}
+
+/*
+
+Name:  dhdpcie_isr
+
+Parametrs:
+
+1: IN int irq   -- interrupt vector
+2: IN void *arg      -- handle to private data structure
+
+Return value:
+
+Status (TRUE or FALSE)
+
+Description:
+Interrupt Service routine checks for the status register,
+disable interrupt and queue DPC if mail box interrupts are raised.
+*/
+
+
+irqreturn_t
+dhdpcie_isr(int irq, void *arg)
+{
+	dhd_bus_t *bus = (dhd_bus_t*)arg;
+	if (dhdpcie_bus_isr(bus))
+		return TRUE;
+	else
+		return FALSE;
+}
+
+int
+dhdpcie_start_host_pcieclock(dhd_bus_t *bus)
+{
+	int ret = 0;
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+	int options = 0;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+	DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+	if (bus == NULL)
+		return BCME_ERROR;
+
+	if (bus->dev == NULL)
+		return BCME_ERROR;
+
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+	if (bus->islinkdown) {
+		options = MSM_PCIE_CONFIG_NO_CFG_RESTORE;
+	}
+	ret = msm_pcie_pm_control(MSM_PCIE_RESUME, bus->dev->bus->number,
+		bus->dev, NULL, options);
+	if (bus->islinkdown && !ret) {
+		msm_pcie_recover_config(bus->dev);
+		if (bus->dhd)
+			DHD_OS_WAKE_UNLOCK(bus->dhd);
+		bus->islinkdown = FALSE;
+	}
+#else
+	ret = msm_pcie_pm_control(MSM_PCIE_RESUME, bus->dev->bus->number,
+		bus->dev, NULL, 0);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+	if (ret) {
+		DHD_ERROR(("%s Failed to bring up PCIe link\n", __FUNCTION__));
+		goto done;
+	}
+
+done:
+#endif /* CONFIG_ARCH_MSM */
+	DHD_TRACE(("%s Exit:\n", __FUNCTION__));
+	return ret;
+}
+
+int
+dhdpcie_stop_host_pcieclock(dhd_bus_t *bus)
+{
+	int ret = 0;
+
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+	int options = 0;
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+#endif /* CONFIG_ARCH_MSM */
+	DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+	if (bus == NULL)
+		return BCME_ERROR;
+
+	if (bus->dev == NULL)
+		return BCME_ERROR;
+
+#ifdef CONFIG_ARCH_MSM
+#ifdef SUPPORT_LINKDOWN_RECOVERY
+	if (bus->islinkdown)
+		options = MSM_PCIE_CONFIG_NO_CFG_RESTORE | MSM_PCIE_CONFIG_LINKDOWN;
+
+	ret = msm_pcie_pm_control(MSM_PCIE_SUSPEND,	bus->dev->bus->number,
+		bus->dev, NULL, options);
+#else
+	ret = msm_pcie_pm_control(MSM_PCIE_SUSPEND,	bus->dev->bus->number,
+		bus->dev, NULL, 0);
+#endif /* SUPPORT_LINKDOWN_RECOVERY */
+	if (ret) {
+		DHD_ERROR(("Failed to stop PCIe link\n"));
+		goto done;
+	}
+done:
+#endif /* CONFIG_ARCH_MSM */
+	DHD_TRACE(("%s Exit:\n", __FUNCTION__));
+	return ret;
+}
+
+int
+dhdpcie_disable_device(dhd_bus_t *bus)
+{
+	if (bus == NULL)
+		return BCME_ERROR;
+
+	if (bus->dev == NULL)
+		return BCME_ERROR;
+
+	pci_disable_device(bus->dev);
+
+	return 0;
+}
+
+int
+dhdpcie_enable_device(dhd_bus_t *bus)
+{
+	int ret = BCME_ERROR;
+	dhdpcie_info_t *pch;
+
+	DHD_TRACE(("%s Enter:\n", __FUNCTION__));
+
+	if (bus == NULL)
+		return BCME_ERROR;
+
+	if (bus->dev == NULL)
+		return BCME_ERROR;
+
+	pch = pci_get_drvdata(bus->dev);
+	if (pch == NULL)
+		return BCME_ERROR;
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+	/* Updated with pci_load_and_free_saved_state to compatible
+	 * with kernel 3.14 or higher
+	 */
+	if (pci_load_and_free_saved_state(bus->dev, &pch->state))
+		pci_disable_device(bus->dev);
+	else
+#elif ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+	(LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)))
+	if (pci_load_saved_state(bus->dev, pch->state))
+		pci_disable_device(bus->dev);
+	else
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) and
+		* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+		* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)
+		*/
+	{
+		pci_restore_state(bus->dev);
+		ret = pci_enable_device(bus->dev);
+		if (!ret)
+			pci_set_master(bus->dev);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0))
+	}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) and
+		* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+		* (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0)
+		*/
+
+	if (ret)
+		pci_disable_device(bus->dev);
+
+	return ret;
+}
+
+int
+dhdpcie_alloc_resource(dhd_bus_t *bus)
+{
+	dhdpcie_info_t *dhdpcie_info;
+	phys_addr_t bar0_addr, bar1_addr;
+	ulong bar1_size;
+
+	do {
+		if (bus == NULL) {
+			DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+			break;
+		}
+
+		if (bus->dev == NULL) {
+			DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+			break;
+		}
+
+		dhdpcie_info = pci_get_drvdata(bus->dev);
+		if (dhdpcie_info == NULL) {
+			DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+			break;
+		}
+
+		bar0_addr = pci_resource_start(bus->dev, 0);	/* Bar-0 mapped address */
+		bar1_addr = pci_resource_start(bus->dev, 2);	/* Bar-1 mapped address */
+
+		/* read Bar-1 mapped memory range */
+		bar1_size = pci_resource_len(bus->dev, 2);
+
+		if ((bar1_size == 0) || (bar1_addr == 0)) {
+			printf("%s: BAR1 Not enabled for this device size(%ld),"
+				" addr(0x"PRINTF_RESOURCE")\n",
+				__FUNCTION__, bar1_size, bar1_addr);
+			break;
+		}
+
+		dhdpcie_info->regs = (volatile char *) REG_MAP(bar0_addr, DONGLE_REG_MAP_SIZE);
+		if (!dhdpcie_info->regs) {
+			DHD_ERROR(("%s: ioremap() for regs is failed\n", __FUNCTION__));
+			break;
+		}
+
+		bus->regs = dhdpcie_info->regs;
+		dhdpcie_info->tcm_size =
+		    (bar1_size < DONGLE_TCM_MAP_SIZE) ? bar1_size : DONGLE_TCM_MAP_SIZE;
+		dhdpcie_info->tcm = (volatile char *) REG_MAP(bar1_addr, dhdpcie_info->tcm_size);
+		if (!dhdpcie_info->tcm) {
+			DHD_ERROR(("%s: ioremap() for regs is failed\n", __FUNCTION__));
+			REG_UNMAP(dhdpcie_info->regs);
+			bus->regs = NULL;
+			break;
+		}
+
+		bus->tcm = dhdpcie_info->tcm;
+		bus->tcm_size = dhdpcie_info->tcm_size;
+
+		DHD_TRACE(("%s:Phys addr : reg space = %p base addr 0x"PRINTF_RESOURCE" \n",
+			__FUNCTION__, dhdpcie_info->regs, bar0_addr));
+		DHD_TRACE(("%s:Phys addr : tcm_space = %p base addr 0x"PRINTF_RESOURCE" \n",
+			__FUNCTION__, dhdpcie_info->tcm, bar1_addr));
+
+		return 0;
+	} while (0);
+
+	return BCME_ERROR;
+}
+
+void
+dhdpcie_free_resource(dhd_bus_t *bus)
+{
+	dhdpcie_info_t *dhdpcie_info;
+
+	if (bus == NULL) {
+		DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	if (bus->dev == NULL) {
+		DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	dhdpcie_info = pci_get_drvdata(bus->dev);
+	if (dhdpcie_info == NULL) {
+		DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	if (bus->regs) {
+		REG_UNMAP(dhdpcie_info->regs);
+		bus->regs = NULL;
+	}
+
+	if (bus->tcm) {
+		REG_UNMAP(dhdpcie_info->tcm);
+		bus->tcm = NULL;
+	}
+}
+
+int
+dhdpcie_bus_request_irq(struct dhd_bus *bus)
+{
+	dhdpcie_info_t *dhdpcie_info;
+	int ret = 0;
+
+	if (bus == NULL) {
+		DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	if (bus->dev == NULL) {
+		DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	dhdpcie_info = pci_get_drvdata(bus->dev);
+	if (dhdpcie_info == NULL) {
+		DHD_ERROR(("%s: dhdpcie_info is NULL\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	if (bus->intr) {
+		/* Register interrupt callback, but mask it (not operational yet). */
+		DHD_INTR(("%s: Registering and masking interrupts\n", __FUNCTION__));
+		dhdpcie_bus_intr_disable(bus);
+		ret = dhdpcie_request_irq(dhdpcie_info);
+		if (ret) {
+			DHD_ERROR(("%s: request_irq() failed, ret=%d\n",
+				__FUNCTION__, ret));
+			return ret;
+		}
+	}
+
+	return ret;
+}
+
+#ifdef BCMPCIE_OOB_HOST_WAKE
+void dhdpcie_oob_intr_set(dhd_bus_t *bus, bool enable)
+{
+	unsigned long flags;
+	dhdpcie_info_t *pch;
+	dhdpcie_os_info_t *dhdpcie_osinfo;
+
+	if (bus == NULL) {
+		DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	if (bus->dev == NULL) {
+		DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	pch = pci_get_drvdata(bus->dev);
+	if (pch == NULL) {
+		DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+	spin_lock_irqsave(&dhdpcie_osinfo->oob_irq_spinlock, flags);
+	if ((dhdpcie_osinfo->oob_irq_enabled != enable) &&
+		(dhdpcie_osinfo->oob_irq_num > 0)) {
+		if (enable)
+			enable_irq(dhdpcie_osinfo->oob_irq_num);
+		else
+			disable_irq_nosync(dhdpcie_osinfo->oob_irq_num);
+		dhdpcie_osinfo->oob_irq_enabled = enable;
+	}
+	spin_unlock_irqrestore(&dhdpcie_osinfo->oob_irq_spinlock, flags);
+}
+
+static irqreturn_t wlan_oob_irq(int irq, void *data)
+{
+	dhd_bus_t *bus;
+	DHD_TRACE(("%s: IRQ Triggered\n", __FUNCTION__));
+	bus = (dhd_bus_t *)data;
+	if (bus->dhd->up && bus->suspended) {
+		DHD_OS_OOB_IRQ_WAKE_LOCK_TIMEOUT(bus->dhd, OOB_WAKE_LOCK_TIMEOUT);
+	}
+	return IRQ_HANDLED;
+}
+
+int dhdpcie_oob_intr_register(dhd_bus_t *bus)
+{
+	int err = 0;
+	dhdpcie_info_t *pch;
+	dhdpcie_os_info_t *dhdpcie_osinfo;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	if (bus == NULL) {
+		DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	if (bus->dev == NULL) {
+		DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	pch = pci_get_drvdata(bus->dev);
+	if (pch == NULL) {
+		DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+	if (dhdpcie_osinfo->oob_irq_registered) {
+		DHD_ERROR(("%s: irq is already registered\n", __FUNCTION__));
+		return -EBUSY;
+	}
+
+	if (dhdpcie_osinfo->oob_irq_num > 0) {
+		DHD_INFO_HW4(("%s OOB irq=%d flags=%X \n", __FUNCTION__,
+			(int)dhdpcie_osinfo->oob_irq_num,
+			(int)dhdpcie_osinfo->oob_irq_flags));
+		err = request_irq(dhdpcie_osinfo->oob_irq_num, wlan_oob_irq,
+			dhdpcie_osinfo->oob_irq_flags, "dhdpcie_host_wake",
+			bus);
+		if (err) {
+			DHD_ERROR(("%s: request_irq failed with %d\n",
+				__FUNCTION__, err));
+			return err;
+		}
+		err = enable_irq_wake(dhdpcie_osinfo->oob_irq_num);
+		if (!err)
+			dhdpcie_osinfo->oob_irq_wake_enabled = TRUE;
+		dhdpcie_osinfo->oob_irq_enabled = TRUE;
+	}
+
+	dhdpcie_osinfo->oob_irq_registered = TRUE;
+
+	return err;
+}
+
+void dhdpcie_oob_intr_unregister(dhd_bus_t *bus)
+{
+	int err = 0;
+	dhdpcie_info_t *pch;
+	dhdpcie_os_info_t *dhdpcie_osinfo;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	if (bus == NULL) {
+		DHD_ERROR(("%s: bus is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	if (bus->dev == NULL) {
+		DHD_ERROR(("%s: bus->dev is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	pch = pci_get_drvdata(bus->dev);
+	if (pch == NULL) {
+		DHD_ERROR(("%s: pch is NULL\n", __FUNCTION__));
+		return;
+	}
+
+	dhdpcie_osinfo = (dhdpcie_os_info_t *)pch->os_cxt;
+	if (!dhdpcie_osinfo->oob_irq_registered) {
+		DHD_ERROR(("%s: irq is not registered\n", __FUNCTION__));
+		return;
+	}
+	if (dhdpcie_osinfo->oob_irq_num > 0) {
+		if (dhdpcie_osinfo->oob_irq_wake_enabled) {
+			err = disable_irq_wake(dhdpcie_osinfo->oob_irq_num);
+			if (!err)
+				dhdpcie_osinfo->oob_irq_wake_enabled = FALSE;
+		}
+		if (dhdpcie_osinfo->oob_irq_enabled) {
+			disable_irq(dhdpcie_osinfo->oob_irq_num);
+			dhdpcie_osinfo->oob_irq_enabled = FALSE;
+		}
+		free_irq(dhdpcie_osinfo->oob_irq_num, bus);
+	}
+	dhdpcie_osinfo->oob_irq_registered = FALSE;
+}
+#endif /* BCMPCIE_OOB_HOST_WAKE */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_pno.c b/drivers/net/wireless/bcm4336/dhd_pno.c
--- a/drivers/net/wireless/bcm4336/dhd_pno.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_pno.c	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,1874 @@
+/*
+ * Broadcom Dongle Host Driver (DHD)
+ * Prefered Network Offload and Wi-Fi Location Service(WLS) code.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_pno.c 423669 2013-09-18 13:01:55Z yangj$
+ */
+#ifdef PNO_SUPPORT
+#include <typedefs.h>
+#include <osl.h>
+
+#include <epivers.h>
+#include <bcmutils.h>
+
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/sort.h>
+#include <dngl_stats.h>
+#include <wlioctl.h>
+
+#include <proto/bcmevent.h>
+#include <dhd.h>
+#include <dhd_pno.h>
+#include <dhd_dbg.h>
+
+#ifdef __BIG_ENDIAN
+#include <bcmendian.h>
+#define htod32(i) (bcmswap32(i))
+#define htod16(i) (bcmswap16(i))
+#define dtoh32(i) (bcmswap32(i))
+#define dtoh16(i) (bcmswap16(i))
+#define htodchanspec(i) htod16(i)
+#define dtohchanspec(i) dtoh16(i)
+#else
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+#endif /* IL_BIGENDINA */
+
+#define NULL_CHECK(p, s, err)  \
+			do { \
+				if (!(p)) { \
+					printf("NULL POINTER (%s) : %s\n", __FUNCTION__, (s)); \
+					err = BCME_ERROR; \
+					return err; \
+				} \
+			} while (0)
+#define PNO_GET_PNOSTATE(dhd) ((dhd_pno_status_info_t *)dhd->pno_state)
+#define PNO_BESTNET_LEN 1024
+#define PNO_ON 1
+#define PNO_OFF 0
+#define CHANNEL_2G_MAX 14
+#define MAX_NODE_CNT 5
+#define WLS_SUPPORTED(pno_state) (pno_state->wls_supported == TRUE)
+#define TIME_DIFF(timestamp1, timestamp2) (abs((uint32)(timestamp1/1000)  \
+						- (uint32)(timestamp2/1000)))
+
+#define ENTRY_OVERHEAD strlen("bssid=\nssid=\nfreq=\nlevel=\nage=\ndist=\ndistSd=\n====")
+#define TIME_MIN_DIFF 5
+static inline bool
+is_dfs(uint16 channel)
+{
+	if (channel >= 52 && channel <= 64)			/* class 2 */
+		return TRUE;
+	else if (channel >= 100 && channel <= 140)	/* class 4 */
+		return TRUE;
+	else
+		return FALSE;
+}
+int
+dhd_pno_clean(dhd_pub_t *dhd)
+{
+	int pfn = 0;
+	int err;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	/* Disable PNO */
+	err = dhd_iovar(dhd, 0, "pfn", (char *)&pfn, sizeof(pfn), 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to execute pfn(error : %d)\n",
+			__FUNCTION__, err));
+		goto exit;
+	}
+	_pno_state->pno_status = DHD_PNO_DISABLED;
+	err = dhd_iovar(dhd, 0, "pfnclear", NULL, 0, 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to execute pfnclear(error : %d)\n",
+			__FUNCTION__, err));
+	}
+exit:
+	return err;
+}
+
+static int
+_dhd_pno_suspend(dhd_pub_t *dhd)
+{
+	int err;
+	int suspend = 1;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	err = dhd_iovar(dhd, 0, "pfn_suspend", (char *)&suspend, sizeof(suspend), 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to suspend pfn(error :%d)\n", __FUNCTION__, err));
+		goto exit;
+
+	}
+	_pno_state->pno_status = DHD_PNO_SUSPEND;
+exit:
+	return err;
+}
+static int
+_dhd_pno_enable(dhd_pub_t *dhd, int enable)
+{
+	int err = BCME_OK;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+
+	if (enable & 0xfffe) {
+		DHD_ERROR(("%s invalid value\n", __FUNCTION__));
+		err = BCME_BADARG;
+		goto exit;
+	}
+	if (!dhd_support_sta_mode(dhd)) {
+		DHD_ERROR(("PNO is not allowed for non-STA mode"));
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	if (enable) {
+		if ((_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) &&
+			dhd_is_associated(dhd, NULL, NULL)) {
+			DHD_ERROR(("%s Legacy PNO mode cannot be enabled "
+				"in assoc mode , ignore it\n", __FUNCTION__));
+			err = BCME_BADOPTION;
+			goto exit;
+		}
+	}
+	/* Enable/Disable PNO */
+	err = dhd_iovar(dhd, 0, "pfn", (char *)&enable, sizeof(enable), 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to execute pfn_set\n", __FUNCTION__));
+		goto exit;
+	}
+	_pno_state->pno_status = (enable)?
+		DHD_PNO_ENABLED : DHD_PNO_DISABLED;
+	if (!enable)
+		_pno_state->pno_mode = DHD_PNO_NONE_MODE;
+
+	DHD_PNO(("%s set pno as %s\n",
+		__FUNCTION__, enable ? "Enable" : "Disable"));
+exit:
+	return err;
+}
+
+static int
+_dhd_pno_set(dhd_pub_t *dhd, const dhd_pno_params_t *pno_params, dhd_pno_mode_t mode)
+{
+	int err = BCME_OK;
+	wl_pfn_param_t pfn_param;
+	dhd_pno_params_t *_params;
+	dhd_pno_status_info_t *_pno_state;
+	bool combined_scan = FALSE;
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+
+	memset(&pfn_param, 0, sizeof(pfn_param));
+
+	/* set pfn parameters */
+	pfn_param.version = htod32(PFN_VERSION);
+	pfn_param.flags = ((PFN_LIST_ORDER << SORT_CRITERIA_BIT) |
+		(ENABLE << IMMEDIATE_SCAN_BIT) | (ENABLE << REPORT_SEPERATELY_BIT));
+	if (mode == DHD_PNO_LEGACY_MODE) {
+		/* check and set extra pno params */
+		if ((pno_params->params_legacy.pno_repeat != 0) ||
+			(pno_params->params_legacy.pno_freq_expo_max != 0)) {
+			pfn_param.flags |= htod16(ENABLE << ENABLE_ADAPTSCAN_BIT);
+			pfn_param.repeat = (uchar) (pno_params->params_legacy.pno_repeat);
+			pfn_param.exp = (uchar) (pno_params->params_legacy.pno_freq_expo_max);
+		}
+		/* set up pno scan fr */
+		if (pno_params->params_legacy.scan_fr != 0)
+			pfn_param.scan_freq = htod32(pno_params->params_legacy.scan_fr);
+		if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+			DHD_PNO(("will enable combined scan with BATCHIG SCAN MODE\n"));
+			mode |= DHD_PNO_BATCH_MODE;
+			combined_scan = TRUE;
+		} else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+			DHD_PNO(("will enable combined scan with HOTLIST SCAN MODE\n"));
+			mode |= DHD_PNO_HOTLIST_MODE;
+			combined_scan = TRUE;
+		}
+	}
+	if (mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+		/* Scan frequency of 30 sec */
+		pfn_param.scan_freq = htod32(30);
+		/* slow adapt scan is off by default */
+		pfn_param.slow_freq = htod32(0);
+		/* RSSI margin of 30 dBm */
+		pfn_param.rssi_margin = htod16(30);
+		/* Network timeout 60 sec */
+		pfn_param.lost_network_timeout = htod32(60);
+		/* best n = 2 by default */
+		pfn_param.bestn = DEFAULT_BESTN;
+		/* mscan m=0 by default, so not record best networks by default */
+		pfn_param.mscan = DEFAULT_MSCAN;
+		/*  default repeat = 10 */
+		pfn_param.repeat = DEFAULT_REPEAT;
+		/* by default, maximum scan interval = 2^2
+		 * scan_freq when adaptive scan is turned on
+		 */
+		pfn_param.exp = DEFAULT_EXP;
+		if (mode == DHD_PNO_BATCH_MODE) {
+			/* In case of BATCH SCAN */
+			if (pno_params->params_batch.bestn)
+				pfn_param.bestn = pno_params->params_batch.bestn;
+			if (pno_params->params_batch.scan_fr)
+				pfn_param.scan_freq = htod32(pno_params->params_batch.scan_fr);
+			if (pno_params->params_batch.mscan)
+				pfn_param.mscan = pno_params->params_batch.mscan;
+			/* enable broadcast scan */
+			pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+		} else if (mode == DHD_PNO_HOTLIST_MODE) {
+			/* In case of HOTLIST SCAN */
+			if (pno_params->params_hotlist.scan_fr)
+				pfn_param.scan_freq = htod32(pno_params->params_hotlist.scan_fr);
+			pfn_param.bestn = 0;
+			pfn_param.repeat = 0;
+			/* enable broadcast scan */
+			pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+		}
+		if (combined_scan) {
+			/* Disable Adaptive Scan */
+			pfn_param.flags &= ~(htod16(ENABLE << ENABLE_ADAPTSCAN_BIT));
+			pfn_param.flags |= (ENABLE << ENABLE_BD_SCAN_BIT);
+			pfn_param.repeat = 0;
+			pfn_param.exp = 0;
+			if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+				/* In case of Legacy PNO + BATCH SCAN */
+				_params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+				if (_params->params_batch.bestn)
+					pfn_param.bestn = _params->params_batch.bestn;
+				if (_params->params_batch.scan_fr)
+					pfn_param.scan_freq = htod32(_params->params_batch.scan_fr);
+				if (_params->params_batch.mscan)
+					pfn_param.mscan = _params->params_batch.mscan;
+			} else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+				/* In case of Legacy PNO + HOTLIST SCAN */
+				_params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+				if (_params->params_hotlist.scan_fr)
+				pfn_param.scan_freq = htod32(_params->params_hotlist.scan_fr);
+				pfn_param.bestn = 0;
+				pfn_param.repeat = 0;
+			}
+		}
+	}
+	if (pfn_param.scan_freq < htod32(PNO_SCAN_MIN_FW_SEC) ||
+		pfn_param.scan_freq > htod32(PNO_SCAN_MAX_FW_SEC)) {
+		DHD_ERROR(("%s pno freq(%d sec) is not valid \n",
+			__FUNCTION__, PNO_SCAN_MIN_FW_SEC));
+		err = BCME_BADARG;
+		goto exit;
+	}
+	if (mode == DHD_PNO_BATCH_MODE) {
+		int _tmp = pfn_param.bestn;
+		/* set bestn to calculate the max mscan which firmware supports */
+		err = dhd_iovar(dhd, 0, "pfnmem", (char *)&_tmp, sizeof(_tmp), 1);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to set pfnmem\n", __FUNCTION__));
+			goto exit;
+		}
+		/* get max mscan which the firmware supports */
+		err = dhd_iovar(dhd, 0, "pfnmem", (char *)&_tmp, sizeof(_tmp), 0);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to get pfnmem\n", __FUNCTION__));
+			goto exit;
+		}
+		DHD_PNO((" returned mscan : %d, set bestn : %d\n", _tmp, pfn_param.bestn));
+		pfn_param.mscan = MIN(pfn_param.mscan, _tmp);
+	}
+	err = dhd_iovar(dhd, 0, "pfn_set", (char *)&pfn_param, sizeof(pfn_param), 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to execute pfn_set\n", __FUNCTION__));
+		goto exit;
+	}
+	/* need to return mscan if this is for batch scan instead of err */
+	err = (mode == DHD_PNO_BATCH_MODE)? pfn_param.mscan : err;
+exit:
+	return err;
+}
+static int
+_dhd_pno_add_ssid(dhd_pub_t *dhd, wlc_ssid_t* ssids_list, int nssid)
+{
+	int err = BCME_OK;
+	int i = 0;
+	wl_pfn_t pfn_element;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	if (nssid) {
+		NULL_CHECK(ssids_list, "ssid list is NULL", err);
+	}
+	memset(&pfn_element, 0, sizeof(pfn_element));
+	{
+		int j;
+		for (j = 0; j < nssid; j++) {
+			DHD_PNO(("%d: scan  for  %s size = %d\n", j,
+				ssids_list[j].SSID, ssids_list[j].SSID_len));
+		}
+	}
+	/* Check for broadcast ssid */
+	for (i = 0; i < nssid; i++) {
+		if (!ssids_list[i].SSID_len) {
+			DHD_ERROR(("%d: Broadcast SSID is ilegal for PNO setting\n", i));
+			err = BCME_ERROR;
+			goto exit;
+		}
+	}
+	/* set all pfn ssid */
+	for (i = 0; i < nssid; i++) {
+		pfn_element.infra = htod32(DOT11_BSSTYPE_INFRASTRUCTURE);
+		pfn_element.auth = (DOT11_OPEN_SYSTEM);
+		pfn_element.wpa_auth = htod32(WPA_AUTH_PFN_ANY);
+		pfn_element.wsec = htod32(0);
+		pfn_element.infra = htod32(1);
+		pfn_element.flags = htod32(ENABLE << WL_PFN_HIDDEN_BIT);
+		memcpy((char *)pfn_element.ssid.SSID, ssids_list[i].SSID,
+			ssids_list[i].SSID_len);
+		pfn_element.ssid.SSID_len = ssids_list[i].SSID_len;
+		err = dhd_iovar(dhd, 0, "pfn_add", (char *)&pfn_element,
+			sizeof(pfn_element), 1);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to execute pfn_add\n", __FUNCTION__));
+			goto exit;
+		}
+	}
+exit:
+	return err;
+}
+/* qsort compare function */
+static int
+_dhd_pno_cmpfunc(const void *a, const void *b)
+{
+	return (*(uint16*)a - *(uint16*)b);
+}
+static int
+_dhd_pno_chan_merge(uint16 *d_chan_list, int *nchan,
+	uint16 *chan_list1, int nchan1, uint16 *chan_list2, int nchan2)
+{
+	int err = BCME_OK;
+	int i = 0, j = 0, k = 0;
+	uint16 tmp;
+	NULL_CHECK(d_chan_list, "d_chan_list is NULL", err);
+	NULL_CHECK(nchan, "nchan is NULL", err);
+	NULL_CHECK(chan_list1, "chan_list1 is NULL", err);
+	NULL_CHECK(chan_list2, "chan_list2 is NULL", err);
+	/* chan_list1 and chan_list2 should be sorted at first */
+	while (i < nchan1 && j < nchan2) {
+		tmp = chan_list1[i] < chan_list2[j]?
+			chan_list1[i++] : chan_list2[j++];
+		for (; i < nchan1 && chan_list1[i] == tmp; i++);
+		for (; j < nchan2 && chan_list2[j] == tmp; j++);
+		d_chan_list[k++] = tmp;
+	}
+
+	while (i < nchan1) {
+		tmp = chan_list1[i++];
+		for (; i < nchan1 && chan_list1[i] == tmp; i++);
+		d_chan_list[k++] = tmp;
+	}
+
+	while (j < nchan2) {
+		tmp = chan_list2[j++];
+		for (; j < nchan2 && chan_list2[j] == tmp; j++);
+		d_chan_list[k++] = tmp;
+
+	}
+	*nchan = k;
+	return err;
+}
+static int
+_dhd_pno_get_channels(dhd_pub_t *dhd, uint16 *d_chan_list,
+	int *nchan, uint8 band, bool skip_dfs)
+{
+	int err = BCME_OK;
+	int i, j;
+	uint32 chan_buf[WL_NUMCHANNELS + 1];
+	wl_uint32_list_t *list;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	if (*nchan) {
+		NULL_CHECK(d_chan_list, "d_chan_list is NULL", err);
+	}
+	list = (wl_uint32_list_t *) (void *)chan_buf;
+	list->count = htod32(WL_NUMCHANNELS);
+	err = dhd_wl_ioctl_cmd(dhd, WLC_GET_VALID_CHANNELS, chan_buf, sizeof(chan_buf), FALSE, 0);
+	if (err < 0) {
+		DHD_ERROR(("failed to get channel list (err: %d)\n", err));
+		goto exit;
+	}
+	for (i = 0, j = 0; i < dtoh32(list->count) && i < *nchan; i++) {
+		if (band == WLC_BAND_2G) {
+			if (dtoh32(list->element[i]) > CHANNEL_2G_MAX)
+				continue;
+		} else if (band == WLC_BAND_5G) {
+			if (dtoh32(list->element[i]) <= CHANNEL_2G_MAX)
+				continue;
+			if (skip_dfs && is_dfs(dtoh32(list->element[i])))
+				continue;
+
+		} else { /* All channels */
+			if (skip_dfs && is_dfs(dtoh32(list->element[i])))
+				continue;
+		}
+		d_chan_list[j++] = dtoh32(list->element[i]);
+	}
+	*nchan = j;
+exit:
+	return err;
+}
+static int
+_dhd_pno_convert_format(dhd_pub_t *dhd, struct dhd_pno_batch_params *params_batch,
+	char *buf, int nbufsize)
+{
+	int err = BCME_OK;
+	int bytes_written = 0, nreadsize = 0;
+	int t_delta = 0;
+	int nleftsize = nbufsize;
+	uint8 cnt = 0;
+	char *bp = buf;
+	char eabuf[ETHER_ADDR_STR_LEN];
+#ifdef PNO_DEBUG
+	char *_base_bp;
+	char msg[150];
+#endif
+	dhd_pno_bestnet_entry_t *iter, *next;
+	dhd_pno_scan_results_t *siter, *snext;
+	dhd_pno_best_header_t *phead, *pprev;
+	NULL_CHECK(params_batch, "params_batch is NULL", err);
+	if (nbufsize > 0)
+		NULL_CHECK(buf, "buf is NULL", err);
+	/* initialize the buffer */
+	memset(buf, 0, nbufsize);
+	DHD_PNO(("%s enter \n", __FUNCTION__));
+	/* # of scans */
+	if (!params_batch->get_batch.batch_started) {
+		bp += nreadsize = sprintf(bp, "scancount=%d\n",
+			params_batch->get_batch.expired_tot_scan_cnt);
+		nleftsize -= nreadsize;
+		params_batch->get_batch.batch_started = TRUE;
+	}
+	DHD_PNO(("%s scancount %d\n", __FUNCTION__, params_batch->get_batch.expired_tot_scan_cnt));
+	/* preestimate scan count until which scan result this report is going to end */
+	list_for_each_entry_safe(siter, snext,
+		&params_batch->get_batch.expired_scan_results_list, list) {
+		phead = siter->bestnetheader;
+		while (phead != NULL) {
+			/* if left_size is less than bestheader total size , stop this */
+			if (nleftsize <=
+				(phead->tot_size + phead->tot_cnt * ENTRY_OVERHEAD))
+				goto exit;
+			/* increase scan count */
+			cnt++;
+			/* # best of each scan */
+			DHD_PNO(("\n<loop : %d, apcount %d>\n", cnt - 1, phead->tot_cnt));
+			/* attribute of the scan */
+			if (phead->reason & PNO_STATUS_ABORT_MASK) {
+				bp += nreadsize = sprintf(bp, "trunc\n");
+				nleftsize -= nreadsize;
+			}
+			list_for_each_entry_safe(iter, next,
+				&phead->entry_list, list) {
+				t_delta = jiffies_to_msecs(jiffies - iter->recorded_time);
+#ifdef PNO_DEBUG
+				_base_bp = bp;
+				memset(msg, 0, sizeof(msg));
+#endif
+				/* BSSID info */
+				bp += nreadsize = sprintf(bp, "bssid=%s\n",
+				bcm_ether_ntoa((const struct ether_addr *)&iter->BSSID, eabuf));
+				nleftsize -= nreadsize;
+				/* SSID */
+				bp += nreadsize = sprintf(bp, "ssid=%s\n", iter->SSID);
+				nleftsize -= nreadsize;
+				/* channel */
+				bp += nreadsize = sprintf(bp, "freq=%d\n",
+				wf_channel2mhz(iter->channel,
+				iter->channel <= CH_MAX_2G_CHANNEL?
+				WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G));
+				nleftsize -= nreadsize;
+				/* RSSI */
+				bp += nreadsize = sprintf(bp, "level=%d\n", iter->RSSI);
+				nleftsize -= nreadsize;
+				/* add the time consumed in Driver to the timestamp of firmware */
+				iter->timestamp += t_delta;
+				bp += nreadsize = sprintf(bp, "age=%d\n", iter->timestamp);
+				nleftsize -= nreadsize;
+				/* RTT0 */
+				bp += nreadsize = sprintf(bp, "dist=%d\n",
+				(iter->rtt0 == 0)? -1 : iter->rtt0);
+				nleftsize -= nreadsize;
+				/* RTT1 */
+				bp += nreadsize = sprintf(bp, "distSd=%d\n",
+				(iter->rtt0 == 0)? -1 : iter->rtt1);
+				nleftsize -= nreadsize;
+				bp += nreadsize = sprintf(bp, "%s", AP_END_MARKER);
+				nleftsize -= nreadsize;
+				list_del(&iter->list);
+				MFREE(dhd->osh, iter, BESTNET_ENTRY_SIZE);
+#ifdef PNO_DEBUG
+				memcpy(msg, _base_bp, bp - _base_bp);
+				DHD_PNO(("Entry : \n%s", msg));
+#endif
+			}
+			bp += nreadsize = sprintf(bp, "%s", SCAN_END_MARKER);
+			DHD_PNO(("%s", SCAN_END_MARKER));
+			nleftsize -= nreadsize;
+			pprev = phead;
+			/* reset the header */
+			siter->bestnetheader = phead = phead->next;
+			MFREE(dhd->osh, pprev, BEST_HEADER_SIZE);
+
+			siter->cnt_header--;
+		}
+		if (phead == NULL) {
+			/* we store all entry in this scan , so it is ok to delete */
+			list_del(&siter->list);
+			MFREE(dhd->osh, siter, SCAN_RESULTS_SIZE);
+		}
+	}
+exit:
+	if (cnt < params_batch->get_batch.expired_tot_scan_cnt) {
+		DHD_ERROR(("Buffer size is small to save all batch entry,"
+			" cnt : %d (remained_scan_cnt): %d\n",
+			cnt, params_batch->get_batch.expired_tot_scan_cnt - cnt));
+	}
+	params_batch->get_batch.expired_tot_scan_cnt -= cnt;
+	/* set FALSE only if the link list  is empty after returning the data */
+	if (list_empty(&params_batch->get_batch.expired_scan_results_list)) {
+		params_batch->get_batch.batch_started = FALSE;
+		bp += sprintf(bp, "%s", RESULTS_END_MARKER);
+		DHD_PNO(("%s", RESULTS_END_MARKER));
+		DHD_PNO(("%s : Getting the batching data is complete\n", __FUNCTION__));
+	}
+	/* return used memory in buffer */
+	bytes_written = (int32)(bp - buf);
+	return bytes_written;
+}
+static int
+_dhd_pno_clear_all_batch_results(dhd_pub_t *dhd, struct list_head *head, bool only_last)
+{
+	int err = BCME_OK;
+	int removed_scan_cnt = 0;
+	dhd_pno_scan_results_t *siter, *snext;
+	dhd_pno_best_header_t *phead, *pprev;
+	dhd_pno_bestnet_entry_t *iter, *next;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(head, "head is NULL", err);
+	NULL_CHECK(head->next, "head->next is NULL", err);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	list_for_each_entry_safe(siter, snext,
+		head, list) {
+		if (only_last) {
+			/* in case that we need to delete only last one */
+			if (!list_is_last(&siter->list, head)) {
+				/* skip if the one is not last */
+				continue;
+			}
+		}
+		/* delete all data belong if the one is last */
+		phead = siter->bestnetheader;
+		while (phead != NULL) {
+			removed_scan_cnt++;
+			list_for_each_entry_safe(iter, next,
+			&phead->entry_list, list) {
+				list_del(&iter->list);
+				MFREE(dhd->osh, iter, BESTNET_ENTRY_SIZE);
+			}
+			pprev = phead;
+			phead = phead->next;
+			MFREE(dhd->osh, pprev, BEST_HEADER_SIZE);
+		}
+		if (phead == NULL) {
+			/* it is ok to delete top node */
+			list_del(&siter->list);
+			MFREE(dhd->osh, siter, SCAN_RESULTS_SIZE);
+		}
+	}
+	return removed_scan_cnt;
+}
+
+static int
+_dhd_pno_cfg(dhd_pub_t *dhd, uint16 *channel_list, int nchan)
+{
+	int err = BCME_OK;
+	int i = 0;
+	wl_pfn_cfg_t pfncfg_param;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	if (nchan) {
+		NULL_CHECK(channel_list, "nchan is NULL", err);
+	}
+	DHD_PNO(("%s enter :  nchan : %d\n", __FUNCTION__, nchan));
+	memset(&pfncfg_param, 0, sizeof(wl_pfn_cfg_t));
+	/* Setup default values */
+	pfncfg_param.reporttype = htod32(WL_PFN_REPORT_ALLNET);
+	pfncfg_param.channel_num = htod32(0);
+
+	for (i = 0; i < nchan && nchan < WL_NUMCHANNELS; i++)
+		pfncfg_param.channel_list[i] = channel_list[i];
+
+	pfncfg_param.channel_num = htod32(nchan);
+	err = dhd_iovar(dhd, 0, "pfn_cfg", (char *)&pfncfg_param, sizeof(pfncfg_param), 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to execute pfn_cfg\n", __FUNCTION__));
+		goto exit;
+	}
+exit:
+	return err;
+}
+static int
+_dhd_pno_reinitialize_prof(dhd_pub_t *dhd, dhd_pno_params_t *params, dhd_pno_mode_t mode)
+{
+	int err = BCME_OK;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL\n", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL\n", err);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	mutex_lock(&_pno_state->pno_mutex);
+	switch (mode) {
+	case DHD_PNO_LEGACY_MODE: {
+		struct dhd_pno_ssid *iter, *next;
+		if (params->params_legacy.nssid > 0) {
+			list_for_each_entry_safe(iter, next,
+				&params->params_legacy.ssid_list, list) {
+				list_del(&iter->list);
+				kfree(iter);
+			}
+		}
+		params->params_legacy.nssid = 0;
+		params->params_legacy.scan_fr = 0;
+		params->params_legacy.pno_freq_expo_max = 0;
+		params->params_legacy.pno_repeat = 0;
+		params->params_legacy.nchan = 0;
+		memset(params->params_legacy.chan_list, 0,
+			sizeof(params->params_legacy.chan_list));
+		break;
+	}
+	case DHD_PNO_BATCH_MODE: {
+		params->params_batch.scan_fr = 0;
+		params->params_batch.mscan = 0;
+		params->params_batch.nchan = 0;
+		params->params_batch.rtt = 0;
+		params->params_batch.bestn = 0;
+		params->params_batch.nchan = 0;
+		params->params_batch.band = WLC_BAND_AUTO;
+		memset(params->params_batch.chan_list, 0,
+			sizeof(params->params_batch.chan_list));
+		params->params_batch.get_batch.batch_started = FALSE;
+		params->params_batch.get_batch.buf = NULL;
+		params->params_batch.get_batch.bufsize = 0;
+		params->params_batch.get_batch.reason = 0;
+		_dhd_pno_clear_all_batch_results(dhd,
+			&params->params_batch.get_batch.scan_results_list, FALSE);
+		_dhd_pno_clear_all_batch_results(dhd,
+			&params->params_batch.get_batch.expired_scan_results_list, FALSE);
+		params->params_batch.get_batch.tot_scan_cnt = 0;
+		params->params_batch.get_batch.expired_tot_scan_cnt = 0;
+		params->params_batch.get_batch.top_node_cnt = 0;
+		INIT_LIST_HEAD(&params->params_batch.get_batch.scan_results_list);
+		INIT_LIST_HEAD(&params->params_batch.get_batch.expired_scan_results_list);
+		break;
+	}
+	case DHD_PNO_HOTLIST_MODE: {
+		struct dhd_pno_bssid *iter, *next;
+		if (params->params_hotlist.nbssid > 0) {
+			list_for_each_entry_safe(iter, next,
+				&params->params_hotlist.bssid_list, list) {
+				list_del(&iter->list);
+				kfree(iter);
+			}
+		}
+		params->params_hotlist.scan_fr = 0;
+		params->params_hotlist.nbssid = 0;
+		params->params_hotlist.nchan = 0;
+		params->params_batch.band = WLC_BAND_AUTO;
+		memset(params->params_hotlist.chan_list, 0,
+			sizeof(params->params_hotlist.chan_list));
+		break;
+	}
+	default:
+		DHD_ERROR(("%s : unknown mode : %d\n", __FUNCTION__, mode));
+		break;
+	}
+	mutex_unlock(&_pno_state->pno_mutex);
+	return err;
+}
+static int
+_dhd_pno_add_bssid(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid, int nbssid)
+{
+	int err = BCME_OK;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	if (nbssid) {
+		NULL_CHECK(p_pfn_bssid, "bssid list is NULL", err);
+	}
+	err = dhd_iovar(dhd, 0, "pfn_add_bssid", (char *)&p_pfn_bssid,
+		sizeof(wl_pfn_bssid_t) * nbssid, 1);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to execute pfn_cfg\n", __FUNCTION__));
+		goto exit;
+	}
+exit:
+	return err;
+}
+int
+dhd_pno_stop_for_ssid(dhd_pub_t *dhd)
+{
+	int err = BCME_OK;
+	uint32 mode = 0;
+	dhd_pno_status_info_t *_pno_state;
+	dhd_pno_params_t *_params;
+	wl_pfn_bssid_t *p_pfn_bssid;
+	NULL_CHECK(dhd, "dev is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	if (!(_pno_state->pno_mode & DHD_PNO_LEGACY_MODE)) {
+		DHD_ERROR(("%s : LEGACY PNO MODE is not enabled\n", __FUNCTION__));
+		goto exit;
+	}
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+	/* restart Batch mode  if the batch mode is on */
+	if (_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+		/* retrieve the batching data from firmware into host */
+		dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+		/* save current pno_mode before calling dhd_pno_clean */
+		mode = _pno_state->pno_mode;
+		dhd_pno_clean(dhd);
+		/* restore previous pno_mode */
+		_pno_state->pno_mode = mode;
+		if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+			_params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+			/* restart BATCH SCAN */
+			err = dhd_pno_set_for_batch(dhd, &_params->params_batch);
+			if (err < 0) {
+				_pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+				DHD_ERROR(("%s : failed to restart batch scan(err: %d)\n",
+					__FUNCTION__, err));
+				goto exit;
+			}
+		} else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+			/* restart HOTLIST SCAN */
+			struct dhd_pno_bssid *iter, *next;
+			_params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+			p_pfn_bssid = kzalloc(sizeof(wl_pfn_bssid_t) *
+			_params->params_hotlist.nbssid, GFP_KERNEL);
+			if (p_pfn_bssid == NULL) {
+				DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+				" (count: %d)",
+					__FUNCTION__, _params->params_hotlist.nbssid));
+				err = BCME_ERROR;
+				_pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+				goto exit;
+			}
+			/* convert dhd_pno_bssid to wl_pfn_bssid */
+			list_for_each_entry_safe(iter, next,
+			&_params->params_hotlist.bssid_list, list) {
+				memcpy(&p_pfn_bssid->macaddr,
+				&iter->macaddr, ETHER_ADDR_LEN);
+				p_pfn_bssid->flags = iter->flags;
+				p_pfn_bssid++;
+			}
+			err = dhd_pno_set_for_hotlist(dhd, p_pfn_bssid, &_params->params_hotlist);
+			if (err < 0) {
+				_pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+				DHD_ERROR(("%s : failed to restart hotlist scan(err: %d)\n",
+					__FUNCTION__, err));
+				goto exit;
+			}
+		}
+	} else {
+		err = dhd_pno_clean(dhd);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+exit:
+	return err;
+}
+
+int
+dhd_pno_enable(dhd_pub_t *dhd, int enable)
+{
+	int err = BCME_OK;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	return (_dhd_pno_enable(dhd, enable));
+}
+
+int
+dhd_pno_set_for_ssid(dhd_pub_t *dhd, wlc_ssid_t* ssid_list, int nssid,
+	uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan)
+{
+	struct dhd_pno_ssid *_pno_ssid;
+	dhd_pno_params_t *_params;
+	dhd_pno_params_t *_params2;
+	dhd_pno_status_info_t *_pno_state;
+	uint16 _chan_list[WL_NUMCHANNELS];
+	int32 tot_nchan = 0;
+	int err = BCME_OK;
+	int i;
+	int mode = 0;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+
+	if (!dhd_support_sta_mode(dhd)) {
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	DHD_PNO(("%s enter : scan_fr :%d, pno_repeat :%d,"
+			"pno_freq_expo_max: %d, nchan :%d\n", __FUNCTION__,
+			scan_fr, pno_repeat, pno_freq_expo_max, nchan));
+
+	_params = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+	if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+		DHD_ERROR(("%s : Legacy PNO mode was already started, "
+			"will disable previous one to start new one\n", __FUNCTION__));
+		err = dhd_pno_stop_for_ssid(dhd);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to stop legacy PNO (err %d)\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+	_pno_state->pno_mode |= DHD_PNO_LEGACY_MODE;
+	err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to reinitialize profile (err %d)\n",
+			__FUNCTION__, err));
+		goto exit;
+	}
+	memset(_chan_list, 0, sizeof(_chan_list));
+	tot_nchan = nchan;
+	if (tot_nchan > 0 && channel_list) {
+		for (i = 0; i < nchan; i++)
+		_params->params_legacy.chan_list[i] = _chan_list[i] = channel_list[i];
+	}
+	if (_pno_state->pno_mode & (DHD_PNO_BATCH_MODE | DHD_PNO_HOTLIST_MODE)) {
+		DHD_PNO(("BATCH SCAN is on progress in firmware\n"));
+		/* retrieve the batching data from firmware into host */
+		dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+		/* store current pno_mode before disabling pno */
+		mode = _pno_state->pno_mode;
+		err = _dhd_pno_enable(dhd, PNO_OFF);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+			goto exit;
+		}
+		/* restore the previous mode */
+		_pno_state->pno_mode = mode;
+		/* use superset of channel list between two mode */
+		if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+			_params2 = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+			if (_params2->params_batch.nchan > 0 && nchan > 0) {
+				err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+					&_params2->params_batch.chan_list[0],
+					_params2->params_batch.nchan,
+					&channel_list[0], nchan);
+				if (err < 0) {
+					DHD_ERROR(("%s : failed to merge channel list"
+					" between legacy and batch\n",
+						__FUNCTION__));
+					goto exit;
+				}
+			}  else {
+				DHD_PNO(("superset channel will use"
+				" all channels in firmware\n"));
+			}
+		} else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+			_params2 = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+			if (_params2->params_hotlist.nchan > 0 && nchan > 0) {
+				err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+					&_params2->params_hotlist.chan_list[0],
+					_params2->params_hotlist.nchan,
+					&channel_list[0], nchan);
+				if (err < 0) {
+					DHD_ERROR(("%s : failed to merge channel list"
+					" between legacy and hotlist\n",
+						__FUNCTION__));
+					goto exit;
+				}
+			}
+		}
+	}
+	_params->params_legacy.scan_fr = scan_fr;
+	_params->params_legacy.pno_repeat = pno_repeat;
+	_params->params_legacy.pno_freq_expo_max = pno_freq_expo_max;
+	_params->params_legacy.nchan = nchan;
+	_params->params_legacy.nssid = nssid;
+	INIT_LIST_HEAD(&_params->params_legacy.ssid_list);
+	if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_LEGACY_MODE)) < 0) {
+		DHD_ERROR(("failed to set call pno_set (err %d) in firmware\n", err));
+		goto exit;
+	}
+	if ((err = _dhd_pno_add_ssid(dhd, ssid_list, nssid)) < 0) {
+		DHD_ERROR(("failed to add ssid list(err %d), %d in firmware\n", err, nssid));
+		goto exit;
+	}
+	for (i = 0; i < nssid; i++) {
+		_pno_ssid = kzalloc(sizeof(struct dhd_pno_ssid), GFP_KERNEL);
+		if (_pno_ssid == NULL) {
+			DHD_ERROR(("%s : failed to allocate struct dhd_pno_ssid\n",
+				__FUNCTION__));
+			goto exit;
+		}
+		_pno_ssid->SSID_len = ssid_list[i].SSID_len;
+		memcpy(_pno_ssid->SSID, ssid_list[i].SSID, _pno_ssid->SSID_len);
+		list_add_tail(&_pno_ssid->list, &_params->params_legacy.ssid_list);
+
+	}
+	if (tot_nchan > 0) {
+		if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+			DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+	if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+		if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+			DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+	}
+exit:
+	/* clear mode in case of error */
+	if (err < 0)
+		_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+	return err;
+}
+int
+dhd_pno_set_for_batch(dhd_pub_t *dhd, struct dhd_pno_batch_params *batch_params)
+{
+	int err = BCME_OK;
+	uint16 _chan_list[WL_NUMCHANNELS];
+	int rem_nchan = 0, tot_nchan = 0;
+	int mode = 0, mscan = 0;
+	int i = 0;
+	dhd_pno_params_t *_params;
+	dhd_pno_params_t *_params2;
+	dhd_pno_status_info_t *_pno_state;
+	wlc_ssid_t *p_ssid_list = NULL;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	NULL_CHECK(batch_params, "batch_params is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	if (!dhd_support_sta_mode(dhd)) {
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+	_params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+	if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+		_pno_state->pno_mode |= DHD_PNO_BATCH_MODE;
+		err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to call _dhd_pno_reinitialize_prof\n",
+				__FUNCTION__));
+			goto exit;
+		}
+	} else {
+		/* batch mode is already started */
+		return -EBUSY;
+	}
+	_params->params_batch.scan_fr = batch_params->scan_fr;
+	_params->params_batch.bestn = batch_params->bestn;
+	_params->params_batch.mscan = (batch_params->mscan)?
+		batch_params->mscan : DEFAULT_BATCH_MSCAN;
+	_params->params_batch.nchan = batch_params->nchan;
+	memcpy(_params->params_batch.chan_list, batch_params->chan_list,
+		sizeof(_params->params_batch.chan_list));
+
+	memset(_chan_list, 0, sizeof(_chan_list));
+
+	rem_nchan = ARRAYSIZE(batch_params->chan_list) - batch_params->nchan;
+	if (batch_params->band == WLC_BAND_2G || batch_params->band == WLC_BAND_5G) {
+		/* get a valid channel list based on band B or A */
+		err = _dhd_pno_get_channels(dhd,
+		&_params->params_batch.chan_list[batch_params->nchan],
+		&rem_nchan, batch_params->band, FALSE);
+		if (err < 0) {
+			DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+				__FUNCTION__, batch_params->band));
+			goto exit;
+		}
+		/* now we need to update nchan because rem_chan has valid channel count */
+		_params->params_batch.nchan += rem_nchan;
+		/* need to sort channel list */
+		sort(_params->params_batch.chan_list, _params->params_batch.nchan,
+			sizeof(_params->params_batch.chan_list[0]), _dhd_pno_cmpfunc, NULL);
+	}
+#ifdef PNO_DEBUG
+{
+		DHD_PNO(("Channel list : "));
+		for (i = 0; i < _params->params_batch.nchan; i++) {
+			DHD_PNO(("%d ", _params->params_batch.chan_list[i]));
+		}
+		DHD_PNO(("\n"));
+}
+#endif
+	if (_params->params_batch.nchan) {
+		/* copy the channel list into local array */
+		memcpy(_chan_list, _params->params_batch.chan_list, sizeof(_chan_list));
+		tot_nchan = _params->params_batch.nchan;
+	}
+	if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+		struct dhd_pno_ssid *iter, *next;
+		DHD_PNO(("PNO SSID is on progress in firmware\n"));
+		/* store current pno_mode before disabling pno */
+		mode = _pno_state->pno_mode;
+		err = _dhd_pno_enable(dhd, PNO_OFF);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+			goto exit;
+		}
+		/* restore the previous mode */
+		_pno_state->pno_mode = mode;
+		/* Use the superset for channelist between two mode */
+		_params2 = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+		if (_params2->params_legacy.nchan > 0 && _params->params_batch.nchan > 0) {
+			err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+				&_params2->params_legacy.chan_list[0],
+				_params2->params_legacy.nchan,
+				&_params->params_batch.chan_list[0], _params->params_batch.nchan);
+			if (err < 0) {
+				DHD_ERROR(("%s : failed to merge channel list"
+				" between legacy and batch\n",
+					__FUNCTION__));
+				goto exit;
+			}
+		} else {
+			DHD_PNO(("superset channel will use all channels in firmware\n"));
+		}
+		p_ssid_list = kzalloc(sizeof(wlc_ssid_t) *
+							_params2->params_legacy.nssid, GFP_KERNEL);
+		if (p_ssid_list == NULL) {
+			DHD_ERROR(("%s : failed to allocate wlc_ssid_t array (count: %d)",
+				__FUNCTION__, _params2->params_legacy.nssid));
+			err = BCME_ERROR;
+			_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+			goto exit;
+		}
+		i = 0;
+		/* convert dhd_pno_ssid to dhd_pno_ssid */
+		list_for_each_entry_safe(iter, next, &_params2->params_legacy.ssid_list, list) {
+			p_ssid_list[i].SSID_len = iter->SSID_len;
+			memcpy(p_ssid_list->SSID, iter->SSID, p_ssid_list[i].SSID_len);
+			i++;
+		}
+		if ((err = _dhd_pno_add_ssid(dhd, p_ssid_list,
+			_params2->params_legacy.nssid)) < 0) {
+			DHD_ERROR(("failed to add ssid list (err %d) in firmware\n", err));
+			goto exit;
+		}
+	}
+	if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_BATCH_MODE)) < 0) {
+		DHD_ERROR(("%s : failed to set call pno_set (err %d) in firmware\n",
+			__FUNCTION__, err));
+		goto exit;
+	} else {
+		/* we need to return mscan */
+		mscan = err;
+	}
+	if (tot_nchan > 0) {
+		if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+			DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+	if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+		if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+			DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+	}
+exit:
+	/* clear mode in case of error */
+	if (err < 0)
+		_pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+	else {
+		/* return #max scan firmware can do */
+		err = mscan;
+	}
+	if (p_ssid_list)
+		kfree(p_ssid_list);
+	return err;
+}
+
+static int
+_dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason)
+{
+	int err = BCME_OK;
+	int i, j;
+	uint32 timestamp = 0;
+	dhd_pno_params_t *_params = NULL;
+	dhd_pno_status_info_t *_pno_state = NULL;
+	wl_pfn_lscanresults_t *plbestnet = NULL;
+	wl_pfn_lnet_info_t *plnetinfo;
+	dhd_pno_bestnet_entry_t *pbestnet_entry;
+	dhd_pno_best_header_t *pbestnetheader = NULL;
+	dhd_pno_scan_results_t *pscan_results = NULL, *siter, *snext;
+	bool allocate_header = FALSE;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	if (!dhd_support_sta_mode(dhd)) {
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+	if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+		DHD_ERROR(("%s: Batching SCAN mode is not enabled\n", __FUNCTION__));
+		goto exit;
+	}
+	mutex_lock(&_pno_state->pno_mutex);
+	_params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+	if (buf && bufsize) {
+		if (!list_empty(&_params->params_batch.get_batch.expired_scan_results_list)) {
+			/* need to check whether we have cashed data or not */
+			DHD_PNO(("%s: have cashed batching data in Driver\n",
+				__FUNCTION__));
+			/* convert to results format */
+			goto convert_format;
+		} else {
+			/* this is a first try to get batching results */
+			if (!list_empty(&_params->params_batch.get_batch.scan_results_list)) {
+				/* move the scan_results_list to expired_scan_results_lists */
+				list_for_each_entry_safe(siter, snext,
+					&_params->params_batch.get_batch.scan_results_list, list) {
+					list_move_tail(&siter->list,
+					&_params->params_batch.get_batch.expired_scan_results_list);
+				}
+				_params->params_batch.get_batch.top_node_cnt = 0;
+				_params->params_batch.get_batch.expired_tot_scan_cnt =
+					_params->params_batch.get_batch.tot_scan_cnt;
+				_params->params_batch.get_batch.tot_scan_cnt = 0;
+				goto convert_format;
+			}
+		}
+	}
+	/* create dhd_pno_scan_results_t whenever we got event WLC_E_PFN_BEST_BATCHING */
+	pscan_results = (dhd_pno_scan_results_t *)MALLOC(dhd->osh, SCAN_RESULTS_SIZE);
+	if (pscan_results == NULL) {
+		err = BCME_NOMEM;
+		DHD_ERROR(("failed to allocate dhd_pno_scan_results_t\n"));
+		goto exit;
+	}
+	pscan_results->bestnetheader = NULL;
+	pscan_results->cnt_header = 0;
+	/* add the element into list unless total node cnt is less than MAX_NODE_ CNT */
+	if (_params->params_batch.get_batch.top_node_cnt < MAX_NODE_CNT) {
+		list_add(&pscan_results->list, &_params->params_batch.get_batch.scan_results_list);
+		_params->params_batch.get_batch.top_node_cnt++;
+	} else {
+		int _removed_scan_cnt;
+		/* remove oldest one and add new one */
+		DHD_PNO(("%s : Remove oldest node and add new one\n", __FUNCTION__));
+		_removed_scan_cnt = _dhd_pno_clear_all_batch_results(dhd,
+			&_params->params_batch.get_batch.scan_results_list, TRUE);
+		_params->params_batch.get_batch.tot_scan_cnt -= _removed_scan_cnt;
+		list_add(&pscan_results->list, &_params->params_batch.get_batch.scan_results_list);
+
+	}
+	plbestnet = (wl_pfn_lscanresults_t *)MALLOC(dhd->osh, PNO_BESTNET_LEN);
+	NULL_CHECK(plbestnet, "failed to allocate buffer for bestnet", err);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	memset(plbestnet, 0, PNO_BESTNET_LEN);
+	while (plbestnet->status != PFN_COMPLETE) {
+		memset(plbestnet, 0, PNO_BESTNET_LEN);
+		err = dhd_iovar(dhd, 0, "pfnlbest", (char *)plbestnet, PNO_BESTNET_LEN, 0);
+		if (err < 0) {
+			if (err == BCME_EPERM) {
+				DHD_ERROR(("we cannot get the batching data "
+					"during scanning in firmware, try again\n,"));
+				msleep(500);
+				continue;
+			} else {
+				DHD_ERROR(("%s : failed to execute pfnlbest (err :%d)\n",
+					__FUNCTION__, err));
+				goto exit;
+			}
+		}
+		DHD_PNO(("ver %d, status : %d, count %d\n", plbestnet->version,
+			plbestnet->status, plbestnet->count));
+		if (plbestnet->version != PFN_SCANRESULT_VERSION) {
+			err = BCME_VERSION;
+			DHD_ERROR(("bestnet version(%d) is mismatch with Driver version(%d)\n",
+				plbestnet->version, PFN_SCANRESULT_VERSION));
+			goto exit;
+		}
+		plnetinfo = plbestnet->netinfo;
+		for (i = 0; i < plbestnet->count; i++) {
+			pbestnet_entry = (dhd_pno_bestnet_entry_t *)
+			MALLOC(dhd->osh, BESTNET_ENTRY_SIZE);
+			if (pbestnet_entry == NULL) {
+				err = BCME_NOMEM;
+				DHD_ERROR(("failed to allocate dhd_pno_bestnet_entry\n"));
+				goto exit;
+			}
+			memset(pbestnet_entry, 0, BESTNET_ENTRY_SIZE);
+			pbestnet_entry->recorded_time = jiffies; /* record the current time */
+			/* create header for the first entry */
+			allocate_header = (i == 0)? TRUE : FALSE;
+			/* check whether the new generation is started or not */
+			if (timestamp && (TIME_DIFF(timestamp, plnetinfo->timestamp)
+				> TIME_MIN_DIFF))
+				allocate_header = TRUE;
+			timestamp = plnetinfo->timestamp;
+			if (allocate_header) {
+				pbestnetheader = (dhd_pno_best_header_t *)
+				MALLOC(dhd->osh, BEST_HEADER_SIZE);
+				if (pbestnetheader == NULL) {
+					err = BCME_NOMEM;
+					if (pbestnet_entry)
+						MFREE(dhd->osh, pbestnet_entry,
+						BESTNET_ENTRY_SIZE);
+					DHD_ERROR(("failed to allocate dhd_pno_bestnet_entry\n"));
+					goto exit;
+				}
+				/* increase total cnt of bestnet header */
+				pscan_results->cnt_header++;
+				/* need to record the reason to call dhd_pno_get_for_bach */
+				if (reason)
+					pbestnetheader->reason = (ENABLE << reason);
+				memset(pbestnetheader, 0, BEST_HEADER_SIZE);
+				/* initialize the head of linked list */
+				INIT_LIST_HEAD(&(pbestnetheader->entry_list));
+				/* link the pbestnet heaer into existed list */
+				if (pscan_results->bestnetheader == NULL)
+					/* In case of header */
+					pscan_results->bestnetheader = pbestnetheader;
+				else {
+					dhd_pno_best_header_t *head = pscan_results->bestnetheader;
+					pscan_results->bestnetheader = pbestnetheader;
+					pbestnetheader->next = head;
+				}
+			}
+			/* fills the best network info */
+			pbestnet_entry->channel = plnetinfo->pfnsubnet.channel;
+			pbestnet_entry->RSSI = plnetinfo->RSSI;
+			if (plnetinfo->flags & PFN_PARTIAL_SCAN_MASK) {
+				/* if RSSI is positive value, we assume that
+				 * this scan is aborted by other scan
+				 */
+				DHD_PNO(("This scan is aborted\n"));
+				pbestnetheader->reason = (ENABLE << PNO_STATUS_ABORT);
+			}
+			pbestnet_entry->rtt0 = plnetinfo->rtt0;
+			pbestnet_entry->rtt1 = plnetinfo->rtt1;
+			pbestnet_entry->timestamp = plnetinfo->timestamp;
+			pbestnet_entry->SSID_len = plnetinfo->pfnsubnet.SSID_len;
+			memcpy(pbestnet_entry->SSID, plnetinfo->pfnsubnet.SSID,
+				pbestnet_entry->SSID_len);
+			memcpy(&pbestnet_entry->BSSID, &plnetinfo->pfnsubnet.BSSID, ETHER_ADDR_LEN);
+			/* add the element into list */
+			list_add_tail(&pbestnet_entry->list, &pbestnetheader->entry_list);
+			/* increase best entry count */
+			pbestnetheader->tot_cnt++;
+			pbestnetheader->tot_size += BESTNET_ENTRY_SIZE;
+			DHD_PNO(("Header %d\n", pscan_results->cnt_header - 1));
+			DHD_PNO(("\tSSID : "));
+			for (j = 0; j < plnetinfo->pfnsubnet.SSID_len; j++)
+				DHD_PNO(("%c", plnetinfo->pfnsubnet.SSID[j]));
+			DHD_PNO(("\n"));
+			DHD_PNO(("\tBSSID: %02x:%02x:%02x:%02x:%02x:%02x\n",
+				plnetinfo->pfnsubnet.BSSID.octet[0],
+				plnetinfo->pfnsubnet.BSSID.octet[1],
+				plnetinfo->pfnsubnet.BSSID.octet[2],
+				plnetinfo->pfnsubnet.BSSID.octet[3],
+				plnetinfo->pfnsubnet.BSSID.octet[4],
+				plnetinfo->pfnsubnet.BSSID.octet[5]));
+			DHD_PNO(("\tchannel: %d, RSSI: %d, timestamp: %d ms\n",
+				plnetinfo->pfnsubnet.channel,
+				plnetinfo->RSSI, plnetinfo->timestamp));
+			DHD_PNO(("\tRTT0 : %d, RTT1: %d\n", plnetinfo->rtt0, plnetinfo->rtt1));
+			plnetinfo++;
+		}
+	}
+	if (pscan_results->cnt_header == 0) {
+		/* In case that we didn't get any data from the firmware
+		 * Remove the current scan_result list from get_bach.scan_results_list.
+		 */
+		DHD_PNO(("NO BATCH DATA from Firmware, Delete current SCAN RESULT LIST\n"));
+		list_del(&pscan_results->list);
+		MFREE(dhd->osh, pscan_results, SCAN_RESULTS_SIZE);
+		_params->params_batch.get_batch.top_node_cnt--;
+	}
+	/* increase total scan count using current scan count */
+	_params->params_batch.get_batch.tot_scan_cnt += pscan_results->cnt_header;
+
+	if (buf && bufsize) {
+		/* This is a first try to get batching results */
+		if (!list_empty(&_params->params_batch.get_batch.scan_results_list)) {
+			/* move the scan_results_list to expired_scan_results_lists */
+			list_for_each_entry_safe(siter, snext,
+				&_params->params_batch.get_batch.scan_results_list, list) {
+				list_move_tail(&siter->list,
+					&_params->params_batch.get_batch.expired_scan_results_list);
+			}
+			/* reset gloval values after  moving to expired list */
+			_params->params_batch.get_batch.top_node_cnt = 0;
+			_params->params_batch.get_batch.expired_tot_scan_cnt =
+				_params->params_batch.get_batch.tot_scan_cnt;
+			_params->params_batch.get_batch.tot_scan_cnt = 0;
+		}
+convert_format:
+		err = _dhd_pno_convert_format(dhd, &_params->params_batch, buf, bufsize);
+		if (err < 0) {
+			DHD_ERROR(("failed to convert the data into upper layer format\n"));
+			goto exit;
+		}
+	}
+exit:
+	if (plbestnet)
+		MFREE(dhd->osh, plbestnet, PNO_BESTNET_LEN);
+	if (_params) {
+		_params->params_batch.get_batch.buf = NULL;
+		_params->params_batch.get_batch.bufsize = 0;
+		_params->params_batch.get_batch.bytes_written = err;
+	}
+	mutex_unlock(&_pno_state->pno_mutex);
+	if (waitqueue_active(&_pno_state->get_batch_done.wait))
+		complete(&_pno_state->get_batch_done);
+	return err;
+}
+static void
+_dhd_pno_get_batch_handler(struct work_struct *work)
+{
+	dhd_pno_status_info_t *_pno_state;
+	dhd_pub_t *dhd;
+	struct dhd_pno_batch_params *params_batch;
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state = container_of(work, struct dhd_pno_status_info, work);
+	dhd = _pno_state->dhd;
+	if (dhd == NULL) {
+		DHD_ERROR(("%s : dhd is NULL\n", __FUNCTION__));
+		return;
+	}
+	params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+	_dhd_pno_get_for_batch(dhd, params_batch->get_batch.buf,
+		params_batch->get_batch.bufsize, params_batch->get_batch.reason);
+
+}
+
+int
+dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason)
+{
+	int err = BCME_OK;
+	char *pbuf = buf;
+	dhd_pno_status_info_t *_pno_state;
+	struct dhd_pno_batch_params *params_batch;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	if (!dhd_support_sta_mode(dhd)) {
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+	params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+	if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+		DHD_ERROR(("%s: Batching SCAN mode is not enabled\n", __FUNCTION__));
+		memset(pbuf, 0, bufsize);
+		pbuf += sprintf(pbuf, "scancount=%d\n", 0);
+		sprintf(pbuf, "%s", RESULTS_END_MARKER);
+		err = strlen(buf);
+		goto exit;
+	}
+	params_batch->get_batch.buf = buf;
+	params_batch->get_batch.bufsize = bufsize;
+	params_batch->get_batch.reason = reason;
+	params_batch->get_batch.bytes_written = 0;
+	schedule_work(&_pno_state->work);
+	wait_for_completion(&_pno_state->get_batch_done);
+	err = params_batch->get_batch.bytes_written;
+exit:
+	return err;
+}
+
+int
+dhd_pno_stop_for_batch(dhd_pub_t *dhd)
+{
+	int err = BCME_OK;
+	int mode = 0;
+	int i = 0;
+	dhd_pno_status_info_t *_pno_state;
+	dhd_pno_params_t *_params;
+	wl_pfn_bssid_t *p_pfn_bssid;
+	wlc_ssid_t *p_ssid_list = NULL;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	if (!dhd_support_sta_mode(dhd)) {
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n",
+			__FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+	if (!(_pno_state->pno_mode & DHD_PNO_BATCH_MODE)) {
+		DHD_ERROR(("%s : PNO BATCH MODE is not enabled\n", __FUNCTION__));
+		goto exit;
+	}
+	_pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+	if (_pno_state->pno_mode & (DHD_PNO_LEGACY_MODE | DHD_PNO_HOTLIST_MODE)) {
+		mode = _pno_state->pno_mode;
+		dhd_pno_clean(dhd);
+		_pno_state->pno_mode = mode;
+		/* restart Legacy PNO if the Legacy PNO is on */
+		if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+			struct dhd_pno_legacy_params *_params_legacy;
+			struct dhd_pno_ssid *iter, *next;
+			_params_legacy =
+				&(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+			p_ssid_list = kzalloc(sizeof(wlc_ssid_t) *
+				_params_legacy->nssid, GFP_KERNEL);
+			if (p_ssid_list == NULL) {
+				DHD_ERROR(("%s : failed to allocate wlc_ssid_t array (count: %d)",
+					__FUNCTION__, _params_legacy->nssid));
+				err = BCME_ERROR;
+				_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+				goto exit;
+			}
+			i = 0;
+			/* convert dhd_pno_ssid to dhd_pno_ssid */
+			list_for_each_entry_safe(iter, next, &_params_legacy->ssid_list, list) {
+				p_ssid_list[i].SSID_len = iter->SSID_len;
+				memcpy(p_ssid_list[i].SSID, iter->SSID, p_ssid_list[i].SSID_len);
+				i++;
+			}
+			err = dhd_pno_set_for_ssid(dhd, p_ssid_list, _params_legacy->nssid,
+				_params_legacy->scan_fr, _params_legacy->pno_repeat,
+				_params_legacy->pno_freq_expo_max, _params_legacy->chan_list,
+				_params_legacy->nchan);
+			if (err < 0) {
+				_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+				DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+					__FUNCTION__, err));
+				goto exit;
+			}
+		} else if (_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE) {
+			struct dhd_pno_bssid *iter, *next;
+			_params = &(_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS]);
+			p_pfn_bssid = kzalloc(sizeof(wl_pfn_bssid_t) *
+				_params->params_hotlist.nbssid, GFP_KERNEL);
+			if (p_pfn_bssid == NULL) {
+				DHD_ERROR(("%s : failed to allocate wl_pfn_bssid_t array"
+					" (count: %d)",
+					__FUNCTION__, _params->params_hotlist.nbssid));
+				err = BCME_ERROR;
+				_pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+				goto exit;
+			}
+			i = 0;
+			/* convert dhd_pno_bssid to wl_pfn_bssid */
+			list_for_each_entry_safe(iter, next,
+				&_params->params_hotlist.bssid_list, list) {
+				memcpy(&p_pfn_bssid[i].macaddr, &iter->macaddr, ETHER_ADDR_LEN);
+				p_pfn_bssid[i].flags = iter->flags;
+				i++;
+			}
+			err = dhd_pno_set_for_hotlist(dhd, p_pfn_bssid, &_params->params_hotlist);
+			if (err < 0) {
+				_pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+				DHD_ERROR(("%s : failed to restart hotlist scan(err: %d)\n",
+					__FUNCTION__, err));
+				goto exit;
+			}
+		}
+	} else {
+		err = dhd_pno_clean(dhd);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+exit:
+	_params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+	_dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+	if (p_ssid_list)
+		kfree(p_ssid_list);
+	return err;
+}
+
+int
+dhd_pno_set_for_hotlist(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid,
+	struct dhd_pno_hotlist_params *hotlist_params)
+{
+	int err = BCME_OK;
+	int i;
+	uint16 _chan_list[WL_NUMCHANNELS];
+	int rem_nchan = 0;
+	int tot_nchan = 0;
+	int mode = 0;
+	dhd_pno_params_t *_params;
+	dhd_pno_params_t *_params2;
+	struct dhd_pno_bssid *_pno_bssid;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	NULL_CHECK(hotlist_params, "hotlist_params is NULL", err);
+	NULL_CHECK(p_pfn_bssid, "p_pfn_bssid is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+
+	if (!dhd_support_sta_mode(dhd)) {
+		err = BCME_BADOPTION;
+		goto exit;
+	}
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+	_params = &_pno_state->pno_params_arr[INDEX_OF_HOTLIST_PARAMS];
+	if (!(_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE)) {
+		_pno_state->pno_mode |= DHD_PNO_HOTLIST_MODE;
+		err = _dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_HOTLIST_MODE);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to call _dhd_pno_reinitialize_prof\n",
+				__FUNCTION__));
+			goto exit;
+		}
+	}
+	_params->params_batch.nchan = hotlist_params->nchan;
+	_params->params_batch.scan_fr = hotlist_params->scan_fr;
+	if (hotlist_params->nchan)
+		memcpy(_params->params_hotlist.chan_list, hotlist_params->chan_list,
+			sizeof(_params->params_hotlist.chan_list));
+	memset(_chan_list, 0, sizeof(_chan_list));
+
+	rem_nchan = ARRAYSIZE(hotlist_params->chan_list) - hotlist_params->nchan;
+	if (hotlist_params->band == WLC_BAND_2G || hotlist_params->band == WLC_BAND_5G) {
+		/* get a valid channel list based on band B or A */
+		err = _dhd_pno_get_channels(dhd,
+		&_params->params_hotlist.chan_list[hotlist_params->nchan],
+		&rem_nchan, hotlist_params->band, FALSE);
+		if (err < 0) {
+			DHD_ERROR(("%s: failed to get valid channel list(band : %d)\n",
+				__FUNCTION__, hotlist_params->band));
+			goto exit;
+		}
+		/* now we need to update nchan because rem_chan has valid channel count */
+		_params->params_hotlist.nchan += rem_nchan;
+		/* need to sort channel list */
+		sort(_params->params_hotlist.chan_list, _params->params_hotlist.nchan,
+			sizeof(_params->params_hotlist.chan_list[0]), _dhd_pno_cmpfunc, NULL);
+	}
+#ifdef PNO_DEBUG
+{
+		int i;
+		DHD_PNO(("Channel list : "));
+		for (i = 0; i < _params->params_batch.nchan; i++) {
+			DHD_PNO(("%d ", _params->params_batch.chan_list[i]));
+		}
+		DHD_PNO(("\n"));
+}
+#endif
+	if (_params->params_hotlist.nchan) {
+		/* copy the channel list into local array */
+		memcpy(_chan_list, _params->params_hotlist.chan_list,
+			sizeof(_chan_list));
+		tot_nchan = _params->params_hotlist.nchan;
+	}
+	if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+			DHD_PNO(("PNO SSID is on progress in firmware\n"));
+			/* store current pno_mode before disabling pno */
+			mode = _pno_state->pno_mode;
+			err = _dhd_pno_enable(dhd, PNO_OFF);
+			if (err < 0) {
+				DHD_ERROR(("%s : failed to disable PNO\n", __FUNCTION__));
+				goto exit;
+			}
+			/* restore the previous mode */
+			_pno_state->pno_mode = mode;
+			/* Use the superset for channelist between two mode */
+			_params2 = &(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS]);
+			if (_params2->params_legacy.nchan > 0 &&
+				_params->params_hotlist.nchan > 0) {
+				err = _dhd_pno_chan_merge(_chan_list, &tot_nchan,
+					&_params2->params_legacy.chan_list[0],
+					_params2->params_legacy.nchan,
+					&_params->params_hotlist.chan_list[0],
+					_params->params_hotlist.nchan);
+				if (err < 0) {
+					DHD_ERROR(("%s : failed to merge channel list"
+						"between legacy and hotlist\n",
+						__FUNCTION__));
+					goto exit;
+				}
+			}
+
+	}
+
+	INIT_LIST_HEAD(&(_params->params_hotlist.bssid_list));
+
+	err = _dhd_pno_add_bssid(dhd, p_pfn_bssid, hotlist_params->nbssid);
+	if (err < 0) {
+		DHD_ERROR(("%s : failed to call _dhd_pno_add_bssid(err :%d)\n",
+			__FUNCTION__, err));
+		goto exit;
+	}
+	if ((err = _dhd_pno_set(dhd, _params, DHD_PNO_HOTLIST_MODE)) < 0) {
+		DHD_ERROR(("%s : failed to set call pno_set (err %d) in firmware\n",
+			__FUNCTION__, err));
+		goto exit;
+	}
+	if (tot_nchan > 0) {
+		if ((err = _dhd_pno_cfg(dhd, _chan_list, tot_nchan)) < 0) {
+			DHD_ERROR(("%s : failed to set call pno_cfg (err %d) in firmware\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+	for (i = 0; i < hotlist_params->nbssid; i++) {
+		_pno_bssid = kzalloc(sizeof(struct dhd_pno_bssid), GFP_KERNEL);
+		NULL_CHECK(_pno_bssid, "_pfn_bssid is NULL", err);
+		memcpy(&_pno_bssid->macaddr, &p_pfn_bssid[i].macaddr, ETHER_ADDR_LEN);
+		_pno_bssid->flags = p_pfn_bssid[i].flags;
+		list_add_tail(&_pno_bssid->list, &_params->params_hotlist.bssid_list);
+	}
+	_params->params_hotlist.nbssid = hotlist_params->nbssid;
+	if (_pno_state->pno_status == DHD_PNO_DISABLED) {
+		if ((err = _dhd_pno_enable(dhd, PNO_ON)) < 0)
+			DHD_ERROR(("%s : failed to enable PNO\n", __FUNCTION__));
+	}
+exit:
+	/* clear mode in case of error */
+	if (err < 0)
+		_pno_state->pno_mode &= ~DHD_PNO_HOTLIST_MODE;
+	return err;
+}
+
+int
+dhd_pno_stop_for_hotlist(dhd_pub_t *dhd)
+{
+	int err = BCME_OK;
+	uint32 mode = 0;
+	dhd_pno_status_info_t *_pno_state;
+	dhd_pno_params_t *_params;
+	wlc_ssid_t *p_ssid_list;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n",
+			__FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+
+	if (!(_pno_state->pno_mode & DHD_PNO_HOTLIST_MODE)) {
+		DHD_ERROR(("%s : Hotlist MODE is not enabled\n",
+			__FUNCTION__));
+		goto exit;
+	}
+	_pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+
+	if (_pno_state->pno_mode & (DHD_PNO_LEGACY_MODE | DHD_PNO_BATCH_MODE)) {
+		/* retrieve the batching data from firmware into host */
+		dhd_pno_get_for_batch(dhd, NULL, 0, PNO_STATUS_DISABLE);
+		/* save current pno_mode before calling dhd_pno_clean */
+		mode = _pno_state->pno_mode;
+		err = dhd_pno_clean(dhd);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+		/* restore previos pno mode */
+		_pno_state->pno_mode = mode;
+		if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+			/* restart Legacy PNO Scan */
+			struct dhd_pno_legacy_params *_params_legacy;
+			struct dhd_pno_ssid *iter, *next;
+			_params_legacy =
+			&(_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS].params_legacy);
+			p_ssid_list =
+			kzalloc(sizeof(wlc_ssid_t) * _params_legacy->nssid, GFP_KERNEL);
+			if (p_ssid_list == NULL) {
+				DHD_ERROR(("%s : failed to allocate wlc_ssid_t array (count: %d)",
+					__FUNCTION__, _params_legacy->nssid));
+				err = BCME_ERROR;
+				_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+				goto exit;
+			}
+			/* convert dhd_pno_ssid to dhd_pno_ssid */
+			list_for_each_entry_safe(iter, next, &_params_legacy->ssid_list, list) {
+				p_ssid_list->SSID_len = iter->SSID_len;
+				memcpy(p_ssid_list->SSID, iter->SSID, p_ssid_list->SSID_len);
+				p_ssid_list++;
+			}
+			err = dhd_pno_set_for_ssid(dhd, p_ssid_list, _params_legacy->nssid,
+				_params_legacy->scan_fr, _params_legacy->pno_repeat,
+				_params_legacy->pno_freq_expo_max, _params_legacy->chan_list,
+				_params_legacy->nchan);
+			if (err < 0) {
+				_pno_state->pno_mode &= ~DHD_PNO_LEGACY_MODE;
+				DHD_ERROR(("%s : failed to restart legacy PNO scan(err: %d)\n",
+					__FUNCTION__, err));
+				goto exit;
+			}
+		} else if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+			/* restart Batching Scan */
+			_params = &(_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS]);
+			/* restart BATCH SCAN */
+			err = dhd_pno_set_for_batch(dhd, &_params->params_batch);
+			if (err < 0) {
+				_pno_state->pno_mode &= ~DHD_PNO_BATCH_MODE;
+				DHD_ERROR(("%s : failed to restart batch scan(err: %d)\n",
+					__FUNCTION__,  err));
+				goto exit;
+			}
+		}
+	} else {
+		err = dhd_pno_clean(dhd);
+		if (err < 0) {
+			DHD_ERROR(("%s : failed to call dhd_pno_clean (err: %d)\n",
+				__FUNCTION__, err));
+			goto exit;
+		}
+	}
+exit:
+	return err;
+}
+
+int
+dhd_pno_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data)
+{
+	int err = BCME_OK;
+	uint status, event_type, flags, datalen;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	NULL_CHECK(dhd->pno_state, "pno_state is NULL", err);
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	if (!WLS_SUPPORTED(_pno_state)) {
+		DHD_ERROR(("%s : wifi location service is not supported\n", __FUNCTION__));
+		err = BCME_UNSUPPORTED;
+		goto exit;
+	}
+	event_type = ntoh32(event->event_type);
+	flags = ntoh16(event->flags);
+	status = ntoh32(event->status);
+	datalen = ntoh32(event->datalen);
+	DHD_PNO(("%s enter : event_type :%d\n", __FUNCTION__, event_type));
+	switch (event_type) {
+	case WLC_E_PFN_BSSID_NET_FOUND:
+	case WLC_E_PFN_BSSID_NET_LOST:
+		/* TODO : need to implement event logic using generic netlink */
+		break;
+	case WLC_E_PFN_BEST_BATCHING:
+	{
+		struct dhd_pno_batch_params *params_batch;
+		params_batch = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS].params_batch;
+		if (!waitqueue_active(&_pno_state->get_batch_done.wait)) {
+			DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING\n", __FUNCTION__));
+			params_batch->get_batch.buf = NULL;
+			params_batch->get_batch.bufsize = 0;
+			params_batch->get_batch.reason = PNO_STATUS_EVENT;
+			schedule_work(&_pno_state->work);
+		} else
+			DHD_PNO(("%s : WLC_E_PFN_BEST_BATCHING"
+				"will skip this event\n", __FUNCTION__));
+		break;
+	}
+	default:
+		DHD_ERROR(("unknown event : %d\n", event_type));
+	}
+exit:
+	return err;
+}
+
+int dhd_pno_init(dhd_pub_t *dhd)
+{
+	int err = BCME_OK;
+	dhd_pno_status_info_t *_pno_state;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	UNUSED_PARAMETER(_dhd_pno_suspend);
+	if (dhd->pno_state)
+		goto exit;
+	dhd->pno_state = MALLOC(dhd->osh, sizeof(dhd_pno_status_info_t));
+	NULL_CHECK(dhd->pno_state, "failed to create dhd_pno_state", err);
+	memset(dhd->pno_state, 0, sizeof(dhd_pno_status_info_t));
+	/* need to check whether current firmware support batching and hotlist scan */
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	_pno_state->wls_supported = TRUE;
+	_pno_state->dhd = dhd;
+	mutex_init(&_pno_state->pno_mutex);
+	INIT_WORK(&_pno_state->work, _dhd_pno_get_batch_handler);
+	init_completion(&_pno_state->get_batch_done);
+	err = dhd_iovar(dhd, 0, "pfnlbest", NULL, 0, 0);
+	if (err == BCME_UNSUPPORTED) {
+		_pno_state->wls_supported = FALSE;
+		DHD_INFO(("Current firmware doesn't support"
+			" Android Location Service\n"));
+	}
+exit:
+	return err;
+}
+int dhd_pno_deinit(dhd_pub_t *dhd)
+{
+	int err = BCME_OK;
+	dhd_pno_status_info_t *_pno_state;
+	dhd_pno_params_t *_params;
+	NULL_CHECK(dhd, "dhd is NULL", err);
+
+	DHD_PNO(("%s enter\n", __FUNCTION__));
+	_pno_state = PNO_GET_PNOSTATE(dhd);
+	NULL_CHECK(_pno_state, "pno_state is NULL", err);
+	/* may need to free legacy ssid_list */
+	if (_pno_state->pno_mode & DHD_PNO_LEGACY_MODE) {
+		_params = &_pno_state->pno_params_arr[INDEX_OF_LEGACY_PARAMS];
+		_dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_LEGACY_MODE);
+	}
+
+	if (_pno_state->pno_mode & DHD_PNO_BATCH_MODE) {
+		_params = &_pno_state->pno_params_arr[INDEX_OF_BATCH_PARAMS];
+		/* clear resource if the BATCH MODE is on */
+		_dhd_pno_reinitialize_prof(dhd, _params, DHD_PNO_BATCH_MODE);
+	}
+	cancel_work_sync(&_pno_state->work);
+	MFREE(dhd->osh, _pno_state, sizeof(dhd_pno_status_info_t));
+	dhd->pno_state = NULL;
+	return err;
+}
+#endif /* PNO_SUPPORT */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_pno.h b/drivers/net/wireless/bcm4336/dhd_pno.h
--- a/drivers/net/wireless/bcm4336/dhd_pno.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_pno.h	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,247 @@
+/*
+ * Header file of Broadcom Dongle Host Driver (DHD)
+ * Prefered Network Offload code and Wi-Fi Location Service(WLS) code.
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_pno.h 423669 2013-09-18 13:01:55Z $
+ */
+
+#ifndef __DHD_PNO_H__
+#define __DHD_PNO_H__
+
+#if defined(PNO_SUPPORT)
+#define PNO_TLV_PREFIX			'S'
+#define PNO_TLV_VERSION			'1'
+#define PNO_TLV_SUBTYPE_LEGACY_PNO '2'
+#define PNO_TLV_RESERVED		'0'
+
+#define PNO_BATCHING_SET "SET"
+#define PNO_BATCHING_GET "GET"
+#define PNO_BATCHING_STOP "STOP"
+
+#define PNO_PARAMS_DELIMETER " "
+#define PNO_PARAM_CHANNEL_DELIMETER ","
+#define PNO_PARAM_VALUE_DELLIMETER '='
+#define PNO_PARAM_SCANFREQ "SCANFREQ"
+#define PNO_PARAM_BESTN	"BESTN"
+#define PNO_PARAM_MSCAN "MSCAN"
+#define PNO_PARAM_CHANNEL "CHANNEL"
+#define PNO_PARAM_RTT "RTT"
+
+#define PNO_TLV_TYPE_SSID_IE		'S'
+#define PNO_TLV_TYPE_TIME		'T'
+#define PNO_TLV_FREQ_REPEAT		'R'
+#define PNO_TLV_FREQ_EXPO_MAX		'M'
+
+#define MAXNUM_SSID_PER_ADD	16
+#define MAXNUM_PNO_PARAMS 2
+#define PNO_TLV_COMMON_LENGTH	1
+#define DEFAULT_BATCH_MSCAN 16
+
+#define RESULTS_END_MARKER "----\n"
+#define SCAN_END_MARKER "####\n"
+#define AP_END_MARKER "====\n"
+
+enum scan_status {
+	/* SCAN ABORT by other scan */
+	PNO_STATUS_ABORT,
+	/* RTT is presence or not */
+	PNO_STATUS_RTT_PRESENCE,
+	/* Disable PNO by Driver */
+	PNO_STATUS_DISABLE,
+	/* NORMAL BATCHING GET */
+	PNO_STATUS_NORMAL,
+	/* WLC_E_PFN_BEST_BATCHING */
+	PNO_STATUS_EVENT,
+	PNO_STATUS_MAX
+};
+#define PNO_STATUS_ABORT_MASK 0x0001
+#define PNO_STATUS_RTT_MASK 0x0002
+#define PNO_STATUS_DISABLE_MASK 0x0004
+#define PNO_STATUS_OOM_MASK 0x0010
+
+enum index_mode {
+	INDEX_OF_LEGACY_PARAMS,
+	INDEX_OF_BATCH_PARAMS,
+	INDEX_OF_HOTLIST_PARAMS,
+	INDEX_MODE_MAX
+};
+enum dhd_pno_status {
+	DHD_PNO_DISABLED,
+	DHD_PNO_ENABLED,
+	DHD_PNO_SUSPEND
+};
+typedef struct cmd_tlv {
+	char prefix;
+	char version;
+	char subtype;
+	char reserved;
+} cmd_tlv_t;
+typedef enum dhd_pno_mode {
+	/* Wi-Fi Legacy PNO Mode */
+	DHD_PNO_NONE_MODE = 0,
+	DHD_PNO_LEGACY_MODE = (1 << (0)),
+	/* Wi-Fi Android BATCH SCAN Mode */
+	DHD_PNO_BATCH_MODE = (1 << (1)),
+	/* Wi-Fi Android Hotlist SCAN Mode */
+	DHD_PNO_HOTLIST_MODE = (1 << (2))
+} dhd_pno_mode_t;
+struct dhd_pno_ssid {
+	uint32		SSID_len;
+	uchar		SSID[DOT11_MAX_SSID_LEN];
+	struct list_head list;
+};
+struct dhd_pno_bssid {
+	struct ether_addr	macaddr;
+	/* Bit4: suppress_lost, Bit3: suppress_found */
+	uint16			flags;
+	struct list_head list;
+};
+typedef struct dhd_pno_bestnet_entry {
+	struct ether_addr BSSID;
+	uint8	SSID_len;
+	uint8	SSID[DOT11_MAX_SSID_LEN];
+	int8	RSSI;
+	uint8	channel;
+	uint32	timestamp;
+	uint16	rtt0; /* distance_cm based on RTT */
+	uint16	rtt1; /* distance_cm based on sample standard deviation */
+	unsigned long recorded_time;
+	struct list_head list;
+} dhd_pno_bestnet_entry_t;
+#define BESTNET_ENTRY_SIZE (sizeof(dhd_pno_bestnet_entry_t))
+
+typedef struct dhd_pno_bestnet_header {
+	struct dhd_pno_bestnet_header *next;
+	uint8 reason;
+	uint32 tot_cnt;
+	uint32 tot_size;
+	struct list_head entry_list;
+} dhd_pno_best_header_t;
+#define BEST_HEADER_SIZE (sizeof(dhd_pno_best_header_t))
+
+typedef struct dhd_pno_scan_results {
+	dhd_pno_best_header_t *bestnetheader;
+	uint8 cnt_header;
+	struct list_head list;
+} dhd_pno_scan_results_t;
+#define SCAN_RESULTS_SIZE (sizeof(dhd_pno_scan_results_t))
+
+struct dhd_pno_get_batch_info {
+	/* info related to get batch */
+	char *buf;
+	bool batch_started;
+	uint32 tot_scan_cnt;
+	uint32 expired_tot_scan_cnt;
+	uint32 top_node_cnt;
+	uint32 bufsize;
+	uint32 bytes_written;
+	int reason;
+	struct list_head scan_results_list;
+	struct list_head expired_scan_results_list;
+};
+struct dhd_pno_legacy_params {
+	uint16 scan_fr;
+	uint16 chan_list[WL_NUMCHANNELS];
+	uint16 nchan;
+	int pno_repeat;
+	int pno_freq_expo_max;
+	int nssid;
+	struct list_head ssid_list;
+};
+struct dhd_pno_batch_params {
+	int32 scan_fr;
+	uint8 bestn;
+	uint8 mscan;
+	uint8 band;
+	uint16 chan_list[WL_NUMCHANNELS];
+	uint16 nchan;
+	uint16 rtt;
+	struct dhd_pno_get_batch_info get_batch;
+};
+struct dhd_pno_hotlist_params {
+	uint8 band;
+	int32 scan_fr;
+	uint16 chan_list[WL_NUMCHANNELS];
+	uint16 nchan;
+	uint16 nbssid;
+	struct list_head bssid_list;
+};
+typedef union dhd_pno_params {
+	struct dhd_pno_legacy_params params_legacy;
+	struct dhd_pno_batch_params params_batch;
+	struct dhd_pno_hotlist_params params_hotlist;
+} dhd_pno_params_t;
+typedef struct dhd_pno_status_info {
+	dhd_pub_t *dhd;
+	struct work_struct work;
+	struct mutex pno_mutex;
+	struct completion get_batch_done;
+	bool wls_supported; /* wifi location service supported or not */
+	enum dhd_pno_status pno_status;
+	enum dhd_pno_mode pno_mode;
+	dhd_pno_params_t pno_params_arr[INDEX_MODE_MAX];
+	struct list_head head_list;
+} dhd_pno_status_info_t;
+
+/* wrapper functions */
+extern int
+dhd_dev_pno_enable(struct net_device *dev, int enable);
+
+extern int
+dhd_dev_pno_stop_for_ssid(struct net_device *dev);
+
+extern int
+dhd_dev_pno_set_for_ssid(struct net_device *dev, wlc_ssid_t* ssids_local, int nssid,
+	uint16 scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+extern int
+dhd_dev_pno_set_for_batch(struct net_device *dev,
+	struct dhd_pno_batch_params *batch_params);
+
+extern int
+dhd_dev_pno_get_for_batch(struct net_device *dev, char *buf, int bufsize);
+
+extern int
+dhd_dev_pno_stop_for_batch(struct net_device *dev);
+
+extern int
+dhd_dev_pno_set_for_hotlist(struct net_device *dev, wl_pfn_bssid_t *p_pfn_bssid,
+	struct dhd_pno_hotlist_params *hotlist_params);
+
+/* dhd pno fuctions */
+extern int dhd_pno_stop_for_ssid(dhd_pub_t *dhd);
+extern int dhd_pno_enable(dhd_pub_t *dhd, int enable);
+extern int dhd_pno_set_for_ssid(dhd_pub_t *dhd, wlc_ssid_t* ssid_list, int nssid,
+	uint16  scan_fr, int pno_repeat, int pno_freq_expo_max, uint16 *channel_list, int nchan);
+
+extern int dhd_pno_set_for_batch(dhd_pub_t *dhd, struct dhd_pno_batch_params *batch_params);
+
+extern int dhd_pno_get_for_batch(dhd_pub_t *dhd, char *buf, int bufsize, int reason);
+
+
+extern int dhd_pno_stop_for_batch(dhd_pub_t *dhd);
+
+extern int dhd_pno_set_for_hotlist(dhd_pub_t *dhd, wl_pfn_bssid_t *p_pfn_bssid,
+	struct dhd_pno_hotlist_params *hotlist_params);
+
+extern int dhd_pno_stop_for_hotlist(dhd_pub_t *dhd);
+
+extern int dhd_pno_event_handler(dhd_pub_t *dhd, wl_event_msg_t *event, void *event_data);
+extern int dhd_pno_init(dhd_pub_t *dhd);
+extern int dhd_pno_deinit(dhd_pub_t *dhd);
+#endif
+
+#if defined(NDISVER)
+#if defined(PNO_SUPPORT)
+#if (NDISVER >= 0x0630)
+extern int dhd_pno_cfg(dhd_pub_t *dhd, wl_pfn_cfg_t *pcfg);
+extern int dhd_pno_suspend(dhd_pub_t *dhd, int pfn_suspend);
+extern int dhd_pno_set_add(dhd_pub_t *dhd, wl_pfn_t *netinfo, int nssid, ushort scan_fr,
+	ushort slowscan_fr, uint8 pno_repeat, uint8 pno_freq_expo_max, int16 flags);
+extern int dhd_pno_enable(dhd_pub_t *dhd, int pfn_enabled);
+extern int dhd_pno_clean(dhd_pub_t *dhd);
+#endif /* #if (NDISVER >= 0x0630) */
+#endif /* #if defined(PNO_SUPPORT) */
+#endif /* #if defined(NDISVER) */
+#endif /* __DHD_PNO_H__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_proto.h b/drivers/net/wireless/bcm4336/dhd_proto.h
--- a/drivers/net/wireless/bcm4336/dhd_proto.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_proto.h	2018-05-06 08:49:50.622754012 +0200
@@ -0,0 +1,127 @@
+/*
+ * Header file describing the internal (inter-module) DHD interfaces.
+ *
+ * Provides type definitions and function prototypes used to link the
+ * DHD OS, bus, and protocol modules.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_proto.h 499674 2014-08-29 21:56:23Z $
+ */
+
+#ifndef _dhd_proto_h_
+#define _dhd_proto_h_
+
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#ifdef BCMPCIE
+#include <dhd_flowring.h>
+#endif
+
+#define DEFAULT_IOCTL_RESP_TIMEOUT	2000
+#ifndef IOCTL_RESP_TIMEOUT
+/* In milli second default value for Production FW */
+#define IOCTL_RESP_TIMEOUT  DEFAULT_IOCTL_RESP_TIMEOUT
+#endif /* IOCTL_RESP_TIMEOUT */
+
+#ifndef MFG_IOCTL_RESP_TIMEOUT
+#define MFG_IOCTL_RESP_TIMEOUT  20000  /* In milli second default value for MFG FW */
+#endif /* MFG_IOCTL_RESP_TIMEOUT */
+
+/*
+ * Exported from the dhd protocol module (dhd_cdc, dhd_rndis)
+ */
+
+/* Linkage, sets prot link and updates hdrlen in pub */
+extern int dhd_prot_attach(dhd_pub_t *dhdp);
+
+/* Initilizes the index block for dma'ing indices */
+extern int dhd_prot_init_index_dma_block(dhd_pub_t *dhdp, uint8 type, uint32 length);
+
+/* Unlink, frees allocated protocol memory (including dhd_prot) */
+extern void dhd_prot_detach(dhd_pub_t *dhdp);
+
+/* Initialize protocol: sync w/dongle state.
+ * Sets dongle media info (iswl, drv_version, mac address).
+ */
+extern int dhd_sync_with_dongle(dhd_pub_t *dhdp);
+
+/* Protocol initialization needed for IOCTL/IOVAR path */
+extern int dhd_prot_init(dhd_pub_t *dhd);
+
+/* Stop protocol: sync w/dongle state. */
+extern void dhd_prot_stop(dhd_pub_t *dhdp);
+
+/* Add any protocol-specific data header.
+ * Caller must reserve prot_hdrlen prepend space.
+ */
+extern void dhd_prot_hdrpush(dhd_pub_t *, int ifidx, void *txp);
+extern uint dhd_prot_hdrlen(dhd_pub_t *, void *txp);
+
+/* Remove any protocol-specific data header. */
+extern int dhd_prot_hdrpull(dhd_pub_t *, int *ifidx, void *rxp, uchar *buf, uint *len);
+
+/* Use protocol to issue ioctl to dongle */
+extern int dhd_prot_ioctl(dhd_pub_t *dhd, int ifidx, wl_ioctl_t * ioc, void * buf, int len);
+
+/* Handles a protocol control response asynchronously */
+extern int dhd_prot_ctl_complete(dhd_pub_t *dhd);
+
+/* Check for and handle local prot-specific iovar commands */
+extern int dhd_prot_iovar_op(dhd_pub_t *dhdp, const char *name,
+                             void *params, int plen, void *arg, int len, bool set);
+
+/* Add prot dump output to a buffer */
+extern void dhd_prot_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+
+/* Update local copy of dongle statistics */
+extern void dhd_prot_dstats(dhd_pub_t *dhdp);
+
+extern int dhd_ioctl(dhd_pub_t * dhd_pub, dhd_ioctl_t *ioc, void * buf, uint buflen);
+
+extern int dhd_preinit_ioctls(dhd_pub_t *dhd);
+
+extern int dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf,
+	uint reorder_info_len, void **pkt, uint32 *free_buf_count);
+
+#ifdef BCMPCIE
+extern bool dhd_prot_process_msgbuf_txcpl(dhd_pub_t *dhd, uint bound);
+extern bool dhd_prot_process_msgbuf_rxcpl(dhd_pub_t *dhd, uint bound);
+extern int dhd_prot_process_ctrlbuf(dhd_pub_t * dhd);
+extern bool dhd_prot_dtohsplit(dhd_pub_t * dhd);
+extern int dhd_post_dummy_msg(dhd_pub_t *dhd);
+extern int dhdmsgbuf_lpbk_req(dhd_pub_t *dhd, uint len);
+extern void dhd_prot_rx_dataoffset(dhd_pub_t *dhd, uint32 offset);
+extern int dhd_prot_txdata(dhd_pub_t *dhd, void *p, uint8 ifidx);
+extern int dhdmsgbuf_dmaxfer_req(dhd_pub_t *dhd, uint len, uint srcdelay, uint destdelay);
+
+extern int dhd_prot_flow_ring_create(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern void dhd_prot_clean_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info);
+extern int dhd_post_tx_ring_item(dhd_pub_t *dhd, void *PKTBUF, uint8 ifindex);
+extern int dhd_prot_flow_ring_delete(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_prot_flow_ring_flush(dhd_pub_t *dhd, flow_ring_node_t *flow_ring_node);
+extern int dhd_prot_ringupd_dump(dhd_pub_t *dhd, struct bcmstrbuf *b);
+extern uint32 dhd_prot_metadatalen_set(dhd_pub_t *dhd, uint32 val, bool rx);
+extern uint32 dhd_prot_metadatalen_get(dhd_pub_t *dhd, bool rx);
+extern void dhd_prot_print_flow_ring(dhd_pub_t *dhd, void *msgbuf_flow_info,
+	struct bcmstrbuf *strbuf);
+extern void dhd_prot_print_info(dhd_pub_t *dhd, struct bcmstrbuf *strbuf);
+extern void dhd_prot_update_txflowring(dhd_pub_t *dhdp, uint16 flow_id, void *msgring_info);
+extern void dhd_prot_txdata_write_flush(dhd_pub_t *dhd, uint16 flow_id, bool in_lock);
+extern uint32 dhd_prot_txp_threshold(dhd_pub_t *dhd, bool set, uint32 val);
+extern void dhd_prot_clear(dhd_pub_t *dhd);
+
+#endif /* BCMPCIE */
+
+/********************************
+ * For version-string expansion *
+ */
+#if defined(BDC)
+#define DHD_PROTOCOL "bdc"
+#elif defined(CDC)
+#define DHD_PROTOCOL "cdc"
+#else
+#define DHD_PROTOCOL "unknown"
+#endif /* proto */
+
+#endif /* _dhd_proto_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_sdio.c b/drivers/net/wireless/bcm4336/dhd_sdio.c
--- a/drivers/net/wireless/bcm4336/dhd_sdio.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_sdio.c	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,8693 @@
+/*
+ * DHD Bus Module for SDIO
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_sdio.c 506046 2014-10-02 12:40:12Z $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmsdh.h>
+
+#ifdef BCMEMBEDIMAGE
+#include BCMEMBEDIMAGE
+#endif /* BCMEMBEDIMAGE */
+
+#include <bcmdefs.h>
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <bcmdevs.h>
+
+#include <siutils.h>
+#include <hndpmu.h>
+#include <hndsoc.h>
+#include <bcmsdpcm.h>
+#if defined(DHD_DEBUG)
+#include <hnd_armtrap.h>
+#include <hnd_cons.h>
+#endif /* defined(DHD_DEBUG) */
+#include <sbchipc.h>
+#include <sbhnddma.h>
+
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#include <bcmsdbus.h>
+
+#include <proto/ethernet.h>
+#include <proto/802.1d.h>
+#include <proto/802.11.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_bus.h>
+#include <dhd_proto.h>
+#include <dhd_dbg.h>
+#include <dhdioctl.h>
+#include <sdiovar.h>
+#include <dhd_config.h>
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+#ifdef DHDTCPACK_SUPPRESS
+#include <dhd_ip.h>
+#endif /* DHDTCPACK_SUPPRESS */
+
+bool dhd_mp_halting(dhd_pub_t *dhdp);
+extern void bcmsdh_waitfor_iodrain(void *sdh);
+extern void bcmsdh_reject_ioreqs(void *sdh, bool reject);
+extern bool  bcmsdh_fatal_error(void *sdh);
+
+#ifndef DHDSDIO_MEM_DUMP_FNAME
+#define DHDSDIO_MEM_DUMP_FNAME         "mem_dump"
+#endif
+
+#define QLEN		(1024) /* bulk rx and tx queue lengths */
+#define FCHI		(QLEN - 10)
+#define FCLOW		(FCHI / 2)
+#define PRIOMASK	7
+
+#define TXRETRIES	2	/* # of retries for tx frames */
+#define READ_FRM_CNT_RETRIES	3
+#ifndef DHD_RXBOUND
+#define DHD_RXBOUND	50	/* Default for max rx frames in one scheduling */
+#endif
+
+#ifndef DHD_TXBOUND
+#define DHD_TXBOUND	20	/* Default for max tx frames in one scheduling */
+#endif
+
+#define DHD_TXMINMAX	1	/* Max tx frames if rx still pending */
+
+#define MEMBLOCK	2048		/* Block size used for downloading of dongle image */
+#define MAX_NVRAMBUF_SIZE	4096	/* max nvram buf size */
+#define MAX_DATA_BUF	(64 * 1024)	/* Must be large enough to hold biggest possible glom */
+
+#ifndef DHD_FIRSTREAD
+#define DHD_FIRSTREAD   32
+#endif
+#if !ISPOWEROF2(DHD_FIRSTREAD)
+#error DHD_FIRSTREAD is not a power of 2!
+#endif
+
+/* Total length of frame header for dongle protocol */
+#define SDPCM_HDRLEN	(SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
+#define SDPCM_HDRLEN_TXGLOM	(SDPCM_HDRLEN + SDPCM_HWEXT_LEN)
+#define MAX_TX_PKTCHAIN_CNT	SDPCM_MAXGLOM_SIZE
+
+#ifdef SDTEST
+#define SDPCM_RESERVE	(SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN)
+#else
+#define SDPCM_RESERVE	(SDPCM_HDRLEN + DHD_SDALIGN)
+#endif
+
+/* Space for header read, limit for data packets */
+#ifndef MAX_HDR_READ
+#define MAX_HDR_READ	32
+#endif
+#if !ISPOWEROF2(MAX_HDR_READ)
+#error MAX_HDR_READ is not a power of 2!
+#endif
+
+#define MAX_RX_DATASZ	2048
+
+/* Maximum milliseconds to wait for F2 to come up */
+#define DHD_WAIT_F2RDY	3000
+
+/* Bump up limit on waiting for HT to account for first startup;
+ * if the image is doing a CRC calculation before programming the PMU
+ * for HT availability, it could take a couple hundred ms more, so
+ * max out at a 1 second (1000000us).
+ */
+#if (PMU_MAX_TRANSITION_DLY <= 1000000)
+#undef PMU_MAX_TRANSITION_DLY
+#define PMU_MAX_TRANSITION_DLY 1000000
+#endif
+
+/* hooks for limiting threshold custom tx num in rx processing */
+#define DEFAULT_TXINRX_THRES    0
+#ifndef CUSTOM_TXINRX_THRES
+#define CUSTOM_TXINRX_THRES     DEFAULT_TXINRX_THRES
+#endif
+
+/* Value for ChipClockCSR during initial setup */
+#define DHD_INIT_CLKCTL1	(SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ)
+#define DHD_INIT_CLKCTL2	(SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP)
+
+/* Flags for SDH calls */
+#define F2SYNC	(SDIO_REQ_4BYTE | SDIO_REQ_FIXED)
+
+/* Packet free applicable unconditionally for sdio and sdspi.  Conditional if
+ * bufpool was present for gspi bus.
+ */
+#define PKTFREE2()		if ((bus->bus != SPI_BUS) || bus->usebufpool) \
+					PKTFREE(bus->dhd->osh, pkt, FALSE);
+DHD_SPINWAIT_SLEEP_INIT(sdioh_spinwait_sleep);
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+DEFINE_MUTEX(_dhd_sdio_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+
+#ifdef DHD_DEBUG
+/* Device console log buffer state */
+#define CONSOLE_LINE_MAX	192
+#define CONSOLE_BUFFER_MAX	2024
+typedef struct dhd_console {
+	uint		count;			/* Poll interval msec counter */
+	uint		log_addr;		/* Log struct address (fixed) */
+	hnd_log_t	log;			/* Log struct (host copy) */
+	uint		bufsize;		/* Size of log buffer */
+	uint8		*buf;			/* Log buffer (host copy) */
+	uint		last;			/* Last buffer read index */
+} dhd_console_t;
+#endif /* DHD_DEBUG */
+
+#define	REMAP_ENAB(bus)			((bus)->remap)
+#define	REMAP_ISADDR(bus, a)		(((a) >= ((bus)->orig_ramsize)) && ((a) < ((bus)->ramsize)))
+#define	KSO_ENAB(bus)			((bus)->kso)
+#define	SR_ENAB(bus)			((bus)->_srenab)
+#define	SLPAUTO_ENAB(bus)		((SR_ENAB(bus)) && ((bus)->_slpauto))
+#define	MIN_RSRC_ADDR			(SI_ENUM_BASE + 0x618)
+#define	MIN_RSRC_SR			0x3
+#define	CORE_CAPEXT_ADDR		(SI_ENUM_BASE + 0x64c)
+#define	CORE_CAPEXT_SR_SUPPORTED_MASK	(1 << 1)
+#define RCTL_MACPHY_DISABLE_MASK	(1 << 26)
+#define RCTL_LOGIC_DISABLE_MASK		(1 << 27)
+
+#define	OOB_WAKEUP_ENAB(bus)		((bus)->_oobwakeup)
+#define	GPIO_DEV_SRSTATE		16	/* Host gpio17 mapped to device gpio0 SR state */
+#define	GPIO_DEV_SRSTATE_TIMEOUT	320000	/* 320ms */
+#define	GPIO_DEV_WAKEUP			17	/* Host gpio17 mapped to device gpio1 wakeup */
+#define	CC_CHIPCTRL2_GPIO1_WAKEUP	(1  << 0)
+#define	CC_CHIPCTRL3_SR_ENG_ENABLE	(1  << 2)
+#define OVERFLOW_BLKSZ512_WM		96
+#define OVERFLOW_BLKSZ512_MES		80
+
+#define CC_PMUCC3	(0x3)
+/* Private data for SDIO bus interaction */
+typedef struct dhd_bus {
+	dhd_pub_t	*dhd;
+
+	bcmsdh_info_t	*sdh;			/* Handle for BCMSDH calls */
+	si_t		*sih;			/* Handle for SI calls */
+	char		*vars;			/* Variables (from CIS and/or other) */
+	uint		varsz;			/* Size of variables buffer */
+	uint32		sbaddr;			/* Current SB window pointer (-1, invalid) */
+
+	sdpcmd_regs_t	*regs;			/* Registers for SDIO core */
+	uint		sdpcmrev;		/* SDIO core revision */
+	uint		armrev;			/* CPU core revision */
+	uint		ramrev;			/* SOCRAM core revision */
+	uint32		ramsize;		/* Size of RAM in SOCRAM (bytes) */
+	uint32		orig_ramsize;		/* Size of RAM in SOCRAM (bytes) */
+	uint32		srmemsize;		/* Size of SRMEM */
+
+	uint32		bus;			/* gSPI or SDIO bus */
+	uint32		bus_num;		/* bus number */
+	uint32		slot_num;		/* slot ID */
+	uint32		hostintmask;	/* Copy of Host Interrupt Mask */
+	uint32		intstatus;		/* Intstatus bits (events) pending */
+	bool		dpc_sched;		/* Indicates DPC schedule (intrpt rcvd) */
+	bool		fcstate;		/* State of dongle flow-control */
+
+	uint16		cl_devid;		/* cached devid for dhdsdio_probe_attach() */
+	char		*fw_path;		/* module_param: path to firmware image */
+	char		*nv_path;		/* module_param: path to nvram vars file */
+	const char      *nvram_params;		/* user specified nvram params. */
+
+	uint		blocksize;		/* Block size of SDIO transfers */
+	uint		roundup;		/* Max roundup limit */
+
+	struct pktq	txq;			/* Queue length used for flow-control */
+	uint8		flowcontrol;		/* per prio flow control bitmask */
+	uint8		tx_seq;			/* Transmit sequence number (next) */
+	uint8		tx_max;			/* Maximum transmit sequence allowed */
+
+	uint8		hdrbuf[MAX_HDR_READ + DHD_SDALIGN];
+	uint8		*rxhdr;			/* Header of current rx frame (in hdrbuf) */
+	uint16		nextlen;		/* Next Read Len from last header */
+	uint8		rx_seq;			/* Receive sequence number (expected) */
+	bool		rxskip;			/* Skip receive (awaiting NAK ACK) */
+
+	void		*glomd;			/* Packet containing glomming descriptor */
+	void		*glom;			/* Packet chain for glommed superframe */
+	uint		glomerr;		/* Glom packet read errors */
+
+	uint8		*rxbuf;			/* Buffer for receiving control packets */
+	uint		rxblen;			/* Allocated length of rxbuf */
+	uint8		*rxctl;			/* Aligned pointer into rxbuf */
+	uint8		*databuf;		/* Buffer for receiving big glom packet */
+	uint8		*dataptr;		/* Aligned pointer into databuf */
+	uint		rxlen;			/* Length of valid data in buffer */
+
+	uint8		sdpcm_ver;		/* Bus protocol reported by dongle */
+
+	bool		intr;			/* Use interrupts */
+	bool		poll;			/* Use polling */
+	bool		ipend;			/* Device interrupt is pending */
+	bool		intdis;			/* Interrupts disabled by isr */
+	uint 		intrcount;		/* Count of device interrupt callbacks */
+	uint		lastintrs;		/* Count as of last watchdog timer */
+	uint		spurious;		/* Count of spurious interrupts */
+	uint		pollrate;		/* Ticks between device polls */
+	uint		polltick;		/* Tick counter */
+	uint		pollcnt;		/* Count of active polls */
+
+#ifdef DHD_DEBUG
+	dhd_console_t	console;		/* Console output polling support */
+	uint		console_addr;		/* Console address from shared struct */
+#endif /* DHD_DEBUG */
+
+	uint		regfails;		/* Count of R_REG/W_REG failures */
+
+	uint		clkstate;		/* State of sd and backplane clock(s) */
+	bool		activity;		/* Activity flag for clock down */
+	int32		idletime;		/* Control for activity timeout */
+	int32		idlecount;		/* Activity timeout counter */
+	int32		idleclock;		/* How to set bus driver when idle */
+	int32		sd_divisor;		/* Speed control to bus driver */
+	int32		sd_mode;		/* Mode control to bus driver */
+	int32		sd_rxchain;		/* If bcmsdh api accepts PKT chains */
+	bool		use_rxchain;		/* If dhd should use PKT chains */
+	bool		sleeping;		/* Is SDIO bus sleeping? */
+	wait_queue_head_t bus_sleep;
+	uint		rxflow_mode;		/* Rx flow control mode */
+	bool		rxflow;			/* Is rx flow control on */
+	uint		prev_rxlim_hit;		/* Is prev rx limit exceeded (per dpc schedule) */
+	bool		alp_only;		/* Don't use HT clock (ALP only) */
+	/* Field to decide if rx of control frames happen in rxbuf or lb-pool */
+	bool		usebufpool;
+	int32		txinrx_thres;	/* num of in-queued pkts */
+	int32		dotxinrx;	/* tx first in dhdsdio_readframes */
+#ifdef SDTEST
+	/* external loopback */
+	bool		ext_loop;
+	uint8		loopid;
+
+	/* pktgen configuration */
+	uint		pktgen_freq;		/* Ticks between bursts */
+	uint		pktgen_count;		/* Packets to send each burst */
+	uint		pktgen_print;		/* Bursts between count displays */
+	uint		pktgen_total;		/* Stop after this many */
+	uint		pktgen_minlen;		/* Minimum packet data len */
+	uint		pktgen_maxlen;		/* Maximum packet data len */
+	uint		pktgen_mode;		/* Configured mode: tx, rx, or echo */
+	uint		pktgen_stop;		/* Number of tx failures causing stop */
+
+	/* active pktgen fields */
+	uint		pktgen_tick;		/* Tick counter for bursts */
+	uint		pktgen_ptick;		/* Burst counter for printing */
+	uint		pktgen_sent;		/* Number of test packets generated */
+	uint		pktgen_rcvd;		/* Number of test packets received */
+	uint		pktgen_prev_time;	/* Time at which previous stats where printed */
+	uint		pktgen_prev_sent;	/* Number of test packets generated when
+						 * previous stats were printed
+						 */
+	uint		pktgen_prev_rcvd;	/* Number of test packets received when
+						 * previous stats were printed
+						 */
+	uint		pktgen_fail;		/* Number of failed send attempts */
+	uint16		pktgen_len;		/* Length of next packet to send */
+#define PKTGEN_RCV_IDLE     (0)
+#define PKTGEN_RCV_ONGOING  (1)
+	uint16		pktgen_rcv_state;		/* receive state */
+	uint		pktgen_rcvd_rcvsession;	/* test pkts rcvd per rcv session. */
+#endif /* SDTEST */
+
+	/* Some additional counters */
+	uint		tx_sderrs;		/* Count of tx attempts with sd errors */
+	uint		fcqueued;		/* Tx packets that got queued */
+	uint		rxrtx;			/* Count of rtx requests (NAK to dongle) */
+	uint		rx_toolong;		/* Receive frames too long to receive */
+	uint		rxc_errors;		/* SDIO errors when reading control frames */
+	uint		rx_hdrfail;		/* SDIO errors on header reads */
+	uint		rx_badhdr;		/* Bad received headers (roosync?) */
+	uint		rx_badseq;		/* Mismatched rx sequence number */
+	uint		fc_rcvd;		/* Number of flow-control events received */
+	uint		fc_xoff;		/* Number which turned on flow-control */
+	uint		fc_xon;			/* Number which turned off flow-control */
+	uint		rxglomfail;		/* Failed deglom attempts */
+	uint		rxglomframes;		/* Number of glom frames (superframes) */
+	uint		rxglompkts;		/* Number of packets from glom frames */
+	uint		f2rxhdrs;		/* Number of header reads */
+	uint		f2rxdata;		/* Number of frame data reads */
+	uint		f2txdata;		/* Number of f2 frame writes */
+	uint		f1regdata;		/* Number of f1 register accesses */
+#ifdef DHDENABLE_TAILPAD
+	uint		tx_tailpad_chain;	/* Number of tail padding by chaining pad_pkt */
+	uint		tx_tailpad_pktget;	/* Number of tail padding by new PKTGET */
+#endif /* DHDENABLE_TAILPAD */
+	uint8		*ctrl_frame_buf;
+	uint32		ctrl_frame_len;
+	bool		ctrl_frame_stat;
+	uint32		rxint_mode;	/* rx interrupt mode */
+	bool		remap;		/* Contiguous 1MB RAM: 512K socram + 512K devram
+					 * Available with socram rev 16
+					 * Remap region not DMA-able
+					 */
+	bool		kso;
+	bool		_slpauto;
+	bool		_oobwakeup;
+	bool		_srenab;
+	bool        readframes;
+	bool        reqbussleep;
+	uint32		resetinstr;
+	uint32		dongle_ram_base;
+
+	void		*glom_pkt_arr[SDPCM_MAXGLOM_SIZE];	/* Array of pkts for glomming */
+	uint32		txglom_cnt;	/* Number of pkts in the glom array */
+	uint32		txglom_total_len;	/* Total length of pkts in glom array */
+	bool		txglom_enable;	/* Flag to indicate whether tx glom is enabled/disabled */
+	uint32		txglomsize;	/* Glom size limitation */
+#ifdef DHDENABLE_TAILPAD
+	void		*pad_pkt;
+#endif /* DHDENABLE_TAILPAD */
+	uint        txglomframes;	/* Number of tx glom frames (superframes) */
+	uint        txglompkts;		/* Number of packets from tx glom frames */
+} dhd_bus_t;
+
+/* clkstate */
+#define CLK_NONE	0
+#define CLK_SDONLY	1
+#define CLK_PENDING	2	/* Not used yet */
+#define CLK_AVAIL	3
+
+#define DHD_NOPMU(dhd)	(FALSE)
+
+#ifdef DHD_DEBUG
+static int qcount[NUMPRIO];
+static int tx_packets[NUMPRIO];
+#endif /* DHD_DEBUG */
+
+/* Deferred transmit */
+const uint dhd_deferred_tx = 1;
+
+extern uint dhd_watchdog_ms;
+
+extern void dhd_os_wd_timer(void *bus, uint wdtick);
+
+/* Tx/Rx bounds */
+uint dhd_txbound;
+uint dhd_rxbound;
+uint dhd_txminmax = DHD_TXMINMAX;
+
+/* override the RAM size if possible */
+#define DONGLE_MIN_RAMSIZE (128 *1024)
+int dhd_dongle_ramsize;
+
+uint dhd_doflow = TRUE;
+uint dhd_dpcpoll = FALSE;
+
+module_param(dhd_doflow, uint, 0644);
+module_param(dhd_dpcpoll, uint, 0644);
+
+static bool dhd_alignctl;
+
+static bool sd1idle;
+
+static bool retrydata;
+#define RETRYCHAN(chan) (((chan) == SDPCM_EVENT_CHANNEL) || retrydata)
+
+static uint watermark = 8;
+static uint mesbusyctrl = 0;
+static const uint firstread = DHD_FIRSTREAD;
+
+/* Retry count for register access failures */
+static const uint retry_limit = 2;
+
+/* Force even SD lengths (some host controllers mess up on odd bytes) */
+static bool forcealign;
+
+#define ALIGNMENT  4
+
+#if defined(OOB_INTR_ONLY) && defined(HW_OOB)
+extern void bcmsdh_enable_hw_oob_intr(void *sdh, bool enable);
+#endif
+
+#if defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD)
+#error OOB_INTR_ONLY is NOT working with SDIO_ISR_THREAD
+#endif /* defined(OOB_INTR_ONLY) && defined(SDIO_ISR_THREAD) */
+#define PKTALIGN(osh, p, len, align)					\
+	do {								\
+		uintptr datalign;						\
+		datalign = (uintptr)PKTDATA((osh), (p));		\
+		datalign = ROUNDUP(datalign, (align)) - datalign;	\
+		ASSERT(datalign < (align));				\
+		ASSERT(PKTLEN((osh), (p)) >= ((len) + datalign));	\
+		if (datalign)						\
+			PKTPULL((osh), (p), (uint)datalign);			\
+		PKTSETLEN((osh), (p), (len));				\
+	} while (0)
+
+/* Limit on rounding up frames */
+static const uint max_roundup = 512;
+
+/* Try doing readahead */
+static bool dhd_readahead;
+
+/* To check if there's window offered */
+#define DATAOK(bus) \
+	(((uint8)(bus->tx_max - bus->tx_seq) > 1) && \
+	(((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* To check if there's window offered for ctrl frame */
+#define TXCTLOK(bus) \
+	(((uint8)(bus->tx_max - bus->tx_seq) != 0) && \
+	(((uint8)(bus->tx_max - bus->tx_seq) & 0x80) == 0))
+
+/* Number of pkts available in dongle for data RX */
+#define DATABUFCNT(bus) \
+	((uint8)(bus->tx_max - bus->tx_seq) - 1)
+
+/* Macros to get register read/write status */
+/* NOTE: these assume a local dhdsdio_bus_t *bus! */
+#define R_SDREG(regvar, regaddr, retryvar) \
+do { \
+	retryvar = 0; \
+	do { \
+		regvar = R_REG(bus->dhd->osh, regaddr); \
+	} while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+	if (retryvar) { \
+		bus->regfails += (retryvar-1); \
+		if (retryvar > retry_limit) { \
+			DHD_ERROR(("%s: FAILED" #regvar "READ, LINE %d\n", \
+			           __FUNCTION__, __LINE__)); \
+			regvar = 0; \
+		} \
+	} \
+} while (0)
+
+#define W_SDREG(regval, regaddr, retryvar) \
+do { \
+	retryvar = 0; \
+	do { \
+		W_REG(bus->dhd->osh, regaddr, regval); \
+	} while (bcmsdh_regfail(bus->sdh) && (++retryvar <= retry_limit)); \
+	if (retryvar) { \
+		bus->regfails += (retryvar-1); \
+		if (retryvar > retry_limit) \
+			DHD_ERROR(("%s: FAILED REGISTER WRITE, LINE %d\n", \
+			           __FUNCTION__, __LINE__)); \
+	} \
+} while (0)
+
+#define BUS_WAKE(bus) \
+	do { \
+		bus->idlecount = 0; \
+		if ((bus)->sleeping) \
+			dhdsdio_bussleep((bus), FALSE); \
+	} while (0);
+
+/*
+ * pktavail interrupts from dongle to host can be managed in 3 different ways
+ * whenever there is a packet available in dongle to transmit to host.
+ *
+ * Mode 0:	Dongle writes the software host mailbox and host is interrupted.
+ * Mode 1:	(sdiod core rev >= 4)
+ *		Device sets a new bit in the intstatus whenever there is a packet
+ *		available in fifo.  Host can't clear this specific status bit until all the
+ *		packets are read from the FIFO.  No need to ack dongle intstatus.
+ * Mode 2:	(sdiod core rev >= 4)
+ *		Device sets a bit in the intstatus, and host acks this by writing
+ *		one to this bit.  Dongle won't generate anymore packet interrupts
+ *		until host reads all the packets from the dongle and reads a zero to
+ *		figure that there are no more packets.  No need to disable host ints.
+ *		Need to ack the intstatus.
+ */
+
+#define SDIO_DEVICE_HMB_RXINT		0	/* default old way */
+#define SDIO_DEVICE_RXDATAINT_MODE_0	1	/* from sdiod rev 4 */
+#define SDIO_DEVICE_RXDATAINT_MODE_1	2	/* from sdiod rev 4 */
+
+
+#define FRAME_AVAIL_MASK(bus) 	\
+	((bus->rxint_mode == SDIO_DEVICE_HMB_RXINT) ? I_HMB_FRAME_IND : I_XMTDATA_AVAIL)
+
+#define DHD_BUS			SDIO_BUS
+
+#define PKT_AVAILABLE(bus, intstatus)	((intstatus) & (FRAME_AVAIL_MASK(bus)))
+
+#define HOSTINTMASK		(I_HMB_SW_MASK | I_CHIPACTIVE)
+
+#define GSPI_PR55150_BAILOUT
+
+#ifdef SDTEST
+static void dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq);
+static void dhdsdio_sdtest_set(dhd_bus_t *bus, uint count);
+#endif
+
+#ifdef DHD_DEBUG
+static int dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size);
+static int dhd_serialconsole(dhd_bus_t *bus, bool get, bool enable, int *bcmerror);
+#endif /* DHD_DEBUG */
+
+static int dhdsdio_devcap_set(dhd_bus_t *bus, uint8 cap);
+static int dhdsdio_download_state(dhd_bus_t *bus, bool enter);
+
+static void dhdsdio_release(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh);
+static void dhdsdio_disconnect(void *ptr);
+static bool dhdsdio_chipmatch(uint16 chipid);
+static bool dhdsdio_probe_attach(dhd_bus_t *bus, osl_t *osh, void *sdh,
+                                 void * regsva, uint16  devid);
+static bool dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static bool dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static void dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation,
+	bool reset_flag);
+
+static void dhd_dongle_setramsize(struct dhd_bus *bus, int mem_size);
+static int dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+	uint8 *buf, uint nbytes,
+	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle);
+static int dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags,
+	uint8 *buf, uint nbytes,
+	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle, int max_retry);
+static int dhdsdio_txpkt(dhd_bus_t *bus, uint chan, void** pkts, int num_pkt, bool free_pkt);
+static int dhdsdio_txpkt_preprocess(dhd_bus_t *bus, void *pkt, int chan, int txseq,
+	int prev_chain_total_len, bool last_chained_pkt,
+	int *pad_pkt_len, void **new_pkt);
+static int dhdsdio_txpkt_postprocess(dhd_bus_t *bus, void *pkt);
+
+static int dhdsdio_download_firmware(dhd_bus_t *bus, osl_t *osh, void *sdh);
+static int _dhdsdio_download_firmware(dhd_bus_t *bus);
+
+static int dhdsdio_download_code_file(dhd_bus_t *bus, char *image_path);
+static int dhdsdio_download_nvram(dhd_bus_t *bus);
+#ifdef BCMEMBEDIMAGE
+static int dhdsdio_download_code_array(dhd_bus_t *bus);
+#endif
+static int dhdsdio_bussleep(dhd_bus_t *bus, bool sleep);
+static int dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok);
+static uint8 dhdsdio_sleepcsr_get(dhd_bus_t *bus);
+
+#ifdef WLMEDIA_HTSF
+#include <htsf.h>
+extern uint32 dhd_get_htsf(void *dhd, int ifidx);
+#endif /* WLMEDIA_HTSF */
+
+static void
+dhdsdio_tune_fifoparam(struct dhd_bus *bus)
+{
+	int err;
+	uint8 devctl, wm, mes;
+
+	if (bus->sih->buscorerev >= 15) {
+		/* See .ppt in PR for these recommended values */
+		if (bus->blocksize == 512) {
+			wm = OVERFLOW_BLKSZ512_WM;
+			mes = OVERFLOW_BLKSZ512_MES;
+		} else {
+			mes = bus->blocksize/4;
+			wm = bus->blocksize/4;
+		}
+
+		watermark = wm;
+		mesbusyctrl = mes;
+	} else {
+		DHD_INFO(("skip fifotune: SdioRev(%d) is lower than minimal requested ver\n",
+			bus->sih->buscorerev));
+		return;
+	}
+
+	/* Update watermark */
+	if (wm > 0) {
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, wm, &err);
+
+		devctl = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+		devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+	}
+
+	/* Update MES */
+	if (mes > 0) {
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL,
+			(mes | SBSDIO_MESBUSYCTRL_ENAB), &err);
+	}
+
+	DHD_INFO(("Apply overflow WAR: 0x%02x 0x%02x 0x%02x\n",
+		bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err),
+		bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, &err),
+		bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL, &err)));
+}
+
+static void
+dhd_dongle_setramsize(struct dhd_bus *bus, int mem_size)
+{
+	int32 min_size =  DONGLE_MIN_RAMSIZE;
+	/* Restrict the ramsize to user specified limit */
+	DHD_ERROR(("user: Restrict the dongle ram size to %d, min accepted %d\n",
+		dhd_dongle_ramsize, min_size));
+	if ((dhd_dongle_ramsize > min_size) &&
+		(dhd_dongle_ramsize < (int32)bus->orig_ramsize))
+		bus->ramsize = dhd_dongle_ramsize;
+}
+
+static int
+dhdsdio_set_siaddr_window(dhd_bus_t *bus, uint32 address)
+{
+	int err = 0;
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW,
+	                 (address >> 8) & SBSDIO_SBADDRLOW_MASK, &err);
+	if (!err)
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRMID,
+		                 (address >> 16) & SBSDIO_SBADDRMID_MASK, &err);
+	if (!err)
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRHIGH,
+		                 (address >> 24) & SBSDIO_SBADDRHIGH_MASK, &err);
+	return err;
+}
+
+
+#ifdef USE_OOB_GPIO1
+static int
+dhdsdio_oobwakeup_init(dhd_bus_t *bus)
+{
+	uint32 val, addr, data;
+
+	bcmsdh_gpioouten(bus->sdh, GPIO_DEV_WAKEUP);
+
+	addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+	data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+
+	/* Set device for gpio1 wakeup */
+	bcmsdh_reg_write(bus->sdh, addr, 4, 2);
+	val = bcmsdh_reg_read(bus->sdh, data, 4);
+	val |= CC_CHIPCTRL2_GPIO1_WAKEUP;
+	bcmsdh_reg_write(bus->sdh, data, 4, val);
+
+	bus->_oobwakeup = TRUE;
+
+	return 0;
+}
+#endif /* USE_OOB_GPIO1 */
+
+/*
+ * Query if FW is in SR mode
+ */
+static bool
+dhdsdio_sr_cap(dhd_bus_t *bus)
+{
+	bool cap = FALSE;
+	uint32  core_capext, addr, data;
+
+	if (bus->sih->chip == BCM43430_CHIP_ID) {
+		/* check if fw initialized sr engine */
+		addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, sr_control1);
+		if (bcmsdh_reg_read(bus->sdh, addr, 4) != 0)
+			cap = TRUE;
+
+		return cap;
+	}
+	if (bus->sih->chip == BCM4324_CHIP_ID) {
+			addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+			data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+			bcmsdh_reg_write(bus->sdh, addr, 4, 3);
+			core_capext = bcmsdh_reg_read(bus->sdh, data, 4);
+	} else if ((bus->sih->chip == BCM4330_CHIP_ID) ||
+		(bus->sih->chip == BCM43362_CHIP_ID)) {
+			core_capext = FALSE;
+	} else if ((bus->sih->chip == BCM4335_CHIP_ID) ||
+		(bus->sih->chip == BCM4339_CHIP_ID) ||
+		(bus->sih->chip == BCM43349_CHIP_ID) ||
+		(bus->sih->chip == BCM4345_CHIP_ID) ||
+		(bus->sih->chip == BCM4354_CHIP_ID) ||
+		(bus->sih->chip == BCM4356_CHIP_ID) ||
+		(bus->sih->chip == BCM4358_CHIP_ID) ||
+		(bus->sih->chip == BCM4371_CHIP_ID) ||
+		(BCM4349_CHIP(bus->sih->chip))		||
+		(bus->sih->chip == BCM4350_CHIP_ID)) {
+		core_capext = TRUE;
+	} else {
+			core_capext = bcmsdh_reg_read(bus->sdh, CORE_CAPEXT_ADDR, 4);
+			core_capext = (core_capext & CORE_CAPEXT_SR_SUPPORTED_MASK);
+	}
+	if (!(core_capext))
+		return FALSE;
+
+	if (bus->sih->chip == BCM4324_CHIP_ID) {
+		/* FIX: Should change to query SR control register instead */
+		cap = TRUE;
+	} else if ((bus->sih->chip == BCM4335_CHIP_ID) ||
+		(bus->sih->chip == BCM4339_CHIP_ID) ||
+		(bus->sih->chip == BCM43349_CHIP_ID) ||
+		(bus->sih->chip == BCM4345_CHIP_ID) ||
+		(bus->sih->chip == BCM4354_CHIP_ID) ||
+		(bus->sih->chip == BCM4356_CHIP_ID) ||
+		(bus->sih->chip == BCM4358_CHIP_ID) ||
+		(bus->sih->chip == BCM4371_CHIP_ID) ||
+		(bus->sih->chip == BCM4350_CHIP_ID)) {
+		uint32 enabval = 0;
+		addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+		data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+		bcmsdh_reg_write(bus->sdh, addr, 4, CC_PMUCC3);
+		enabval = bcmsdh_reg_read(bus->sdh, data, 4);
+
+		if ((bus->sih->chip == BCM4350_CHIP_ID) ||
+			(bus->sih->chip == BCM4345_CHIP_ID) ||
+			(bus->sih->chip == BCM4354_CHIP_ID) ||
+			(bus->sih->chip == BCM4356_CHIP_ID) ||
+			(bus->sih->chip == BCM4358_CHIP_ID) ||
+			(bus->sih->chip == BCM4371_CHIP_ID))
+			enabval &= CC_CHIPCTRL3_SR_ENG_ENABLE;
+
+		if (enabval)
+			cap = TRUE;
+	} else {
+		data = bcmsdh_reg_read(bus->sdh,
+			SI_ENUM_BASE + OFFSETOF(chipcregs_t, retention_ctl), 4);
+		if ((data & (RCTL_MACPHY_DISABLE_MASK | RCTL_LOGIC_DISABLE_MASK)) == 0)
+			cap = TRUE;
+	}
+
+	return cap;
+}
+
+static int
+dhdsdio_srwar_init(dhd_bus_t *bus)
+{
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+	bcmsdh_gpio_init(bus->sdh);
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+
+#ifdef USE_OOB_GPIO1
+	dhdsdio_oobwakeup_init(bus);
+#endif
+
+
+	return 0;
+}
+
+static int
+dhdsdio_sr_init(dhd_bus_t *bus)
+{
+	uint8 val;
+	int err = 0;
+
+	if ((bus->sih->chip == BCM4334_CHIP_ID) && (bus->sih->chiprev == 2))
+		dhdsdio_srwar_init(bus);
+
+	val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL,
+		1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT, &err);
+	val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WAKEUPCTRL, NULL);
+
+#ifdef USE_CMD14
+	/* Add CMD14 Support */
+	dhdsdio_devcap_set(bus,
+		(SDIOD_CCCR_BRCM_CARDCAP_CMD14_SUPPORT | SDIOD_CCCR_BRCM_CARDCAP_CMD14_EXT));
+#endif /* USE_CMD14 */
+
+	dhdsdio_devcap_set(bus, SDIOD_CCCR_BRCM_CARDCAP_CMD_NODEC);
+
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+		SBSDIO_FUNC1_CHIPCLKCSR, SBSDIO_FORCE_HT, &err);
+
+	bus->_slpauto = dhd_slpauto ? TRUE : FALSE;
+
+	bus->_srenab = TRUE;
+
+	return 0;
+}
+
+/*
+ * FIX: Be sure KSO bit is enabled
+ * Currently, it's defaulting to 0 which should be 1.
+ */
+static int
+dhdsdio_clk_kso_init(dhd_bus_t *bus)
+{
+	uint8 val;
+	int err = 0;
+
+	/* set flag */
+	bus->kso = TRUE;
+
+	/*
+	 * Enable KeepSdioOn (KSO) bit for normal operation
+	 * Default is 0 (4334A0) so set it. Fixed in B0.
+	 */
+	val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, NULL);
+	if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+		val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, val, &err);
+		if (err)
+			DHD_ERROR(("%s: SBSDIO_FUNC1_SLEEPCSR err: 0x%x\n", __FUNCTION__, err));
+	}
+
+	return 0;
+}
+
+#define KSO_DBG(x)
+#define KSO_WAIT_US 50
+#define KSO_WAIT_MS 1
+#define KSO_SLEEP_RETRY_COUNT 20
+#define ERROR_BCME_NODEVICE_MAX 1
+
+#define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
+static int
+dhdsdio_clk_kso_enab(dhd_bus_t *bus, bool on)
+{
+	uint8 wr_val = 0, rd_val, cmp_val, bmask;
+	int err = 0;
+	int try_cnt = 0;
+
+	if (!bus->dhd->conf->kso_enable)
+		return 0;
+
+	KSO_DBG(("%s> op:%s\n", __FUNCTION__, (on ? "KSO_SET" : "KSO_CLR")));
+
+	wr_val |= (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
+
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+
+	if (on) {
+		cmp_val = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK |  SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK;
+		bmask = cmp_val;
+
+		OSL_SLEEP(3);
+	} else {
+		/* Put device to sleep, turn off  KSO  */
+		cmp_val = 0;
+		bmask = SBSDIO_FUNC1_SLEEPCSR_KSO_MASK;
+	}
+
+	do {
+		rd_val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, &err);
+		if (((rd_val & bmask) == cmp_val) && !err)
+			break;
+
+		KSO_DBG(("%s> KSO wr/rd retry:%d, ERR:%x \n", __FUNCTION__, try_cnt, err));
+
+		if (((try_cnt + 1) % KSO_SLEEP_RETRY_COUNT) == 0) {
+			OSL_SLEEP(KSO_WAIT_MS);
+		} else
+			OSL_DELAY(KSO_WAIT_US);
+
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+	} while (try_cnt++ < MAX_KSO_ATTEMPTS);
+
+
+	if (try_cnt > 2)
+		KSO_DBG(("%s> op:%s, try_cnt:%d, rd_val:%x, ERR:%x \n",
+			__FUNCTION__, (on ? "KSO_SET" : "KSO_CLR"), try_cnt, rd_val, err));
+
+	if (try_cnt > MAX_KSO_ATTEMPTS)  {
+		DHD_ERROR(("%s> op:%s, ERROR: try_cnt:%d, rd_val:%x, ERR:%x \n",
+			__FUNCTION__, (on ? "KSO_SET" : "KSO_CLR"), try_cnt, rd_val, err));
+	}
+	return err;
+}
+
+static int
+dhdsdio_clk_kso_iovar(dhd_bus_t *bus, bool on)
+{
+	int err = 0;
+
+	if (on == FALSE) {
+
+		BUS_WAKE(bus);
+		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+		DHD_ERROR(("%s: KSO disable clk: 0x%x\n", __FUNCTION__,
+			bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+			SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+		dhdsdio_clk_kso_enab(bus, FALSE);
+	} else {
+		DHD_ERROR(("%s: KSO enable\n", __FUNCTION__));
+
+		/* Make sure we have SD bus access */
+		if (bus->clkstate == CLK_NONE) {
+			DHD_ERROR(("%s: Request SD clk\n", __FUNCTION__));
+			dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+		}
+
+		dhdsdio_clk_kso_enab(bus, TRUE);
+
+		DHD_ERROR(("%s: sleepcsr: 0x%x\n", __FUNCTION__,
+			dhdsdio_sleepcsr_get(bus)));
+	}
+
+	bus->kso = on;
+	BCM_REFERENCE(err);
+
+	return 0;
+}
+
+static uint8
+dhdsdio_sleepcsr_get(dhd_bus_t *bus)
+{
+	int err = 0;
+	uint8 val = 0;
+
+	val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SLEEPCSR, &err);
+	if (err)
+		DHD_TRACE(("Failed to read SLEEPCSR: %d\n", err));
+
+	return val;
+}
+
+uint8
+dhdsdio_devcap_get(dhd_bus_t *bus)
+{
+	return bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_BRCM_CARDCAP, NULL);
+}
+
+static int
+dhdsdio_devcap_set(dhd_bus_t *bus, uint8 cap)
+{
+	int err = 0;
+
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_BRCM_CARDCAP, cap, &err);
+	if (err)
+		DHD_ERROR(("%s: devcap set err: 0x%x\n", __FUNCTION__, err));
+
+	return 0;
+}
+
+static int
+dhdsdio_clk_devsleep_iovar(dhd_bus_t *bus, bool on)
+{
+	int err = 0, retry;
+	uint8 val;
+
+	retry = 0;
+	if (on == TRUE) {
+		/* Enter Sleep */
+
+		/* Be sure we request clk before going to sleep
+		 * so we can wake-up with clk request already set
+		 * else device can go back to sleep immediately
+		 */
+		if (!SLPAUTO_ENAB(bus))
+			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+		else {
+			val = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+			if ((val & SBSDIO_CSR_MASK) == 0) {
+				DHD_ERROR(("%s: No clock before enter sleep:0x%x\n",
+					__FUNCTION__, val));
+
+				/* Reset clock request */
+				bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+					SBSDIO_ALP_AVAIL_REQ, &err);
+				DHD_ERROR(("%s: clock before sleep:0x%x\n", __FUNCTION__,
+					bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+					SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+			}
+		}
+
+		DHD_TRACE(("%s: clk before sleep: 0x%x\n", __FUNCTION__,
+			bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+			SBSDIO_FUNC1_CHIPCLKCSR, &err)));
+#ifdef USE_CMD14
+		err = bcmsdh_sleep(bus->sdh, TRUE);
+#else
+		err = dhdsdio_clk_kso_enab(bus, FALSE);
+		if (OOB_WAKEUP_ENAB(bus))
+		{
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+			err = bcmsdh_gpioout(bus->sdh, GPIO_DEV_WAKEUP, FALSE);  /* GPIO_1 is off */
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+		}
+#endif /* USE_CMD14 */
+	} else {
+		/* Exit Sleep */
+		/* Make sure we have SD bus access */
+		if (bus->clkstate == CLK_NONE) {
+			DHD_TRACE(("%s: Request SD clk\n", __FUNCTION__));
+			dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+		}
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+
+		if ((bus->sih->chip == BCM4334_CHIP_ID) && (bus->sih->chiprev == 2)) {
+			SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+				(bcmsdh_gpioin(bus->sdh, GPIO_DEV_SRSTATE) != TRUE),
+				GPIO_DEV_SRSTATE_TIMEOUT);
+
+			if (bcmsdh_gpioin(bus->sdh, GPIO_DEV_SRSTATE) == FALSE) {
+				DHD_ERROR(("ERROR: GPIO_DEV_SRSTATE still low!\n"));
+			}
+		}
+#endif
+#ifdef USE_CMD14
+		err = bcmsdh_sleep(bus->sdh, FALSE);
+		if (SLPAUTO_ENAB(bus) && (err != 0)) {
+			OSL_DELAY(10000);
+			DHD_TRACE(("%s: Resync device sleep\n", __FUNCTION__));
+
+			/* Toggle sleep to resync with host and device */
+			err = bcmsdh_sleep(bus->sdh, TRUE);
+			OSL_DELAY(10000);
+			err = bcmsdh_sleep(bus->sdh, FALSE);
+
+			if (err) {
+				OSL_DELAY(10000);
+				DHD_ERROR(("%s: CMD14 exit failed again!\n", __FUNCTION__));
+
+				/* Toggle sleep to resync with host and device */
+				err = bcmsdh_sleep(bus->sdh, TRUE);
+				OSL_DELAY(10000);
+				err = bcmsdh_sleep(bus->sdh, FALSE);
+				if (err) {
+					DHD_ERROR(("%s: CMD14 exit failed twice!\n", __FUNCTION__));
+					DHD_ERROR(("%s: FATAL: Device non-response!\n",
+						__FUNCTION__));
+					err = 0;
+				}
+			}
+		}
+#else
+		if (OOB_WAKEUP_ENAB(bus))
+		{
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+			err = bcmsdh_gpioout(bus->sdh, GPIO_DEV_WAKEUP, TRUE);  /* GPIO_1 is on */
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+		}
+		do {
+			err = dhdsdio_clk_kso_enab(bus, TRUE);
+			if (err)
+				OSL_SLEEP(10);
+		} while ((err != 0) && (++retry < 3));
+
+		if (err != 0) {
+			DHD_ERROR(("ERROR: kso set failed retry: %d\n", retry));
+			err = 0; /* continue anyway */
+		}
+#endif /* !USE_CMD14 */
+
+		if (err == 0) {
+			uint8 csr;
+
+			/* Wait for device ready during transition to wake-up */
+			SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+				(((csr = dhdsdio_sleepcsr_get(bus)) &
+				SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK) !=
+				(SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK)), (20000));
+
+			DHD_TRACE(("%s: ExitSleep sleepcsr: 0x%x\n", __FUNCTION__, csr));
+
+			if (!(csr & SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK)) {
+				DHD_ERROR(("%s:ERROR: ExitSleep device NOT Ready! 0x%x\n",
+					__FUNCTION__, csr));
+				err = BCME_NODEVICE;
+			}
+
+			SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+				(((csr = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1,
+				SBSDIO_FUNC1_CHIPCLKCSR, &err)) & SBSDIO_HT_AVAIL) !=
+				(SBSDIO_HT_AVAIL)), (10000));
+
+			DHD_TRACE(("%s: SBSDIO_FUNC1_CHIPCLKCSR : 0x%x\n", __FUNCTION__, csr));
+			if (!err && ((csr & SBSDIO_HT_AVAIL) != SBSDIO_HT_AVAIL)) {
+				DHD_ERROR(("%s:ERROR: device NOT Ready! 0x%x\n",
+					__FUNCTION__, csr));
+				err = BCME_NODEVICE;
+			}
+		}
+	}
+
+	/* Update if successful */
+	if (err == 0)
+		bus->kso = on ? FALSE : TRUE;
+	else {
+		DHD_ERROR(("%s: Sleep request failed: kso:%d on:%d err:%d\n",
+			__FUNCTION__, bus->kso, on, err));
+		if (!on && retry > 2)
+			bus->kso = FALSE;
+	}
+
+	return err;
+}
+
+/* Turn backplane clock on or off */
+static int
+dhdsdio_htclk(dhd_bus_t *bus, bool on, bool pendok)
+{
+#define HT_AVAIL_ERROR_MAX 10
+	static int ht_avail_error = 0;
+	int err;
+	uint8 clkctl, clkreq, devctl;
+	bcmsdh_info_t *sdh;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	clkctl = 0;
+	sdh = bus->sdh;
+
+
+	if (!KSO_ENAB(bus))
+		return BCME_OK;
+
+	if (SLPAUTO_ENAB(bus)) {
+		bus->clkstate = (on ? CLK_AVAIL : CLK_SDONLY);
+		return BCME_OK;
+	}
+
+	if (on) {
+		/* Request HT Avail */
+		clkreq = bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
+
+
+
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+		if (err) {
+			ht_avail_error++;
+			if (ht_avail_error < HT_AVAIL_ERROR_MAX) {
+				DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+			}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+			else if (ht_avail_error == HT_AVAIL_ERROR_MAX) {
+				dhd_os_send_hang_message(bus->dhd);
+			}
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27) */
+			return BCME_ERROR;
+		} else {
+			ht_avail_error = 0;
+		}
+
+
+		/* Check current status */
+		clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+		if (err) {
+			DHD_ERROR(("%s: HT Avail read error: %d\n", __FUNCTION__, err));
+			return BCME_ERROR;
+		}
+
+#if !defined(OOB_INTR_ONLY)
+		/* Go to pending and await interrupt if appropriate */
+		if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
+			/* Allow only clock-available interrupt */
+			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+			if (err) {
+				DHD_ERROR(("%s: Devctl access error setting CA: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+
+			devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+			DHD_INFO(("CLKCTL: set PENDING\n"));
+			bus->clkstate = CLK_PENDING;
+			return BCME_OK;
+		} else
+#endif /* !defined (OOB_INTR_ONLY) */
+		{
+			if (bus->clkstate == CLK_PENDING) {
+				/* Cancel CA-only interrupt filter */
+				devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+				devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+				bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+			}
+		}
+
+		/* Otherwise, wait here (polling) for HT Avail */
+		if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+			SPINWAIT_SLEEP(sdioh_spinwait_sleep,
+				((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+			                                    SBSDIO_FUNC1_CHIPCLKCSR, &err)),
+			          !SBSDIO_CLKAV(clkctl, bus->alp_only)), PMU_MAX_TRANSITION_DLY);
+		}
+		if (err) {
+			DHD_ERROR(("%s: HT Avail request error: %d\n", __FUNCTION__, err));
+			return BCME_ERROR;
+		}
+		if (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
+			DHD_ERROR(("%s: HT Avail timeout (%d): clkctl 0x%02x\n",
+			           __FUNCTION__, PMU_MAX_TRANSITION_DLY, clkctl));
+			return BCME_ERROR;
+		}
+
+		/* Mark clock available */
+		bus->clkstate = CLK_AVAIL;
+		DHD_INFO(("CLKCTL: turned ON\n"));
+
+#if defined(DHD_DEBUG)
+		if (bus->alp_only == TRUE) {
+#if !defined(BCMLXSDMMC)
+			if (!SBSDIO_ALPONLY(clkctl)) {
+				DHD_ERROR(("%s: HT Clock, when ALP Only\n", __FUNCTION__));
+			}
+#endif /* !defined(BCMLXSDMMC) */
+		} else {
+			if (SBSDIO_ALPONLY(clkctl)) {
+				DHD_ERROR(("%s: HT Clock should be on.\n", __FUNCTION__));
+			}
+		}
+#endif /* defined (DHD_DEBUG) */
+
+		bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+		bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+	} else {
+		clkreq = 0;
+
+		if (bus->clkstate == CLK_PENDING) {
+			/* Cancel CA-only interrupt filter */
+			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+		}
+
+		bus->clkstate = CLK_SDONLY;
+		if (!SR_ENAB(bus)) {
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkreq, &err);
+			DHD_INFO(("CLKCTL: turned OFF\n"));
+			if (err) {
+				DHD_ERROR(("%s: Failed access turning clock off: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+		}
+	}
+	return BCME_OK;
+}
+
+/* Change idle/active SD state */
+static int
+dhdsdio_sdclk(dhd_bus_t *bus, bool on)
+{
+	int err;
+	int32 iovalue;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (on) {
+		if (bus->idleclock == DHD_IDLE_STOP) {
+			/* Turn on clock and restore mode */
+			iovalue = 1;
+			err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+			                      &iovalue, sizeof(iovalue), TRUE);
+			if (err) {
+				DHD_ERROR(("%s: error enabling sd_clock: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+
+			iovalue = bus->sd_mode;
+			err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+			                      &iovalue, sizeof(iovalue), TRUE);
+			if (err) {
+				DHD_ERROR(("%s: error changing sd_mode: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+		} else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+			/* Restore clock speed */
+			iovalue = bus->sd_divisor;
+			err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+			                      &iovalue, sizeof(iovalue), TRUE);
+			if (err) {
+				DHD_ERROR(("%s: error restoring sd_divisor: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+		}
+		bus->clkstate = CLK_SDONLY;
+	} else {
+		/* Stop or slow the SD clock itself */
+		if ((bus->sd_divisor == -1) || (bus->sd_mode == -1)) {
+			DHD_TRACE(("%s: can't idle clock, divisor %d mode %d\n",
+			           __FUNCTION__, bus->sd_divisor, bus->sd_mode));
+			return BCME_ERROR;
+		}
+		if (bus->idleclock == DHD_IDLE_STOP) {
+			if (sd1idle) {
+				/* Change to SD1 mode and turn off clock */
+				iovalue = 1;
+				err = bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+				                      &iovalue, sizeof(iovalue), TRUE);
+				if (err) {
+					DHD_ERROR(("%s: error changing sd_clock: %d\n",
+					           __FUNCTION__, err));
+					return BCME_ERROR;
+				}
+			}
+
+			iovalue = 0;
+			err = bcmsdh_iovar_op(bus->sdh, "sd_clock", NULL, 0,
+			                      &iovalue, sizeof(iovalue), TRUE);
+			if (err) {
+				DHD_ERROR(("%s: error disabling sd_clock: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+		} else if (bus->idleclock != DHD_IDLE_ACTIVE) {
+			/* Set divisor to idle value */
+			iovalue = bus->idleclock;
+			err = bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+			                      &iovalue, sizeof(iovalue), TRUE);
+			if (err) {
+				DHD_ERROR(("%s: error changing sd_divisor: %d\n",
+				           __FUNCTION__, err));
+				return BCME_ERROR;
+			}
+		}
+		bus->clkstate = CLK_NONE;
+	}
+
+	return BCME_OK;
+}
+
+/* Transition SD and backplane clock readiness */
+static int
+dhdsdio_clkctl(dhd_bus_t *bus, uint target, bool pendok)
+{
+	int ret = BCME_OK;
+#ifdef DHD_DEBUG
+	uint oldstate = bus->clkstate;
+#endif /* DHD_DEBUG */
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Early exit if we're already there */
+	if (bus->clkstate == target) {
+		if (target == CLK_AVAIL) {
+			dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+			bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+			bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+		}
+		return ret;
+	}
+
+	switch (target) {
+	case CLK_AVAIL:
+		/* Make sure SD clock is available */
+		if (bus->clkstate == CLK_NONE)
+			dhdsdio_sdclk(bus, TRUE);
+		/* Now request HT Avail on the backplane */
+		ret = dhdsdio_htclk(bus, TRUE, pendok);
+		if (ret == BCME_OK) {
+			dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+		bus->activity = TRUE;
+#ifdef DHD_USE_IDLECOUNT
+			bus->idlecount = 0;
+#endif /* DHD_USE_IDLECOUNT */
+		}
+		break;
+
+	case CLK_SDONLY:
+		/* Remove HT request, or bring up SD clock */
+		if (bus->clkstate == CLK_NONE)
+			ret = dhdsdio_sdclk(bus, TRUE);
+		else if (bus->clkstate == CLK_AVAIL)
+			ret = dhdsdio_htclk(bus, FALSE, FALSE);
+		else
+			DHD_ERROR(("dhdsdio_clkctl: request for %d -> %d\n",
+			           bus->clkstate, target));
+		if (ret == BCME_OK) {
+			dhd_os_wd_timer(bus->dhd, dhd_watchdog_ms);
+		}
+		break;
+
+	case CLK_NONE:
+		/* Make sure to remove HT request */
+		if (bus->clkstate == CLK_AVAIL)
+			ret = dhdsdio_htclk(bus, FALSE, FALSE);
+		/* Now remove the SD clock */
+		ret = dhdsdio_sdclk(bus, FALSE);
+#ifdef DHD_DEBUG
+		if (dhd_console_ms == 0)
+#endif /* DHD_DEBUG */
+		if (bus->poll == 0)
+			dhd_os_wd_timer(bus->dhd, 0);
+		break;
+	}
+#ifdef DHD_DEBUG
+	DHD_INFO(("dhdsdio_clkctl: %d -> %d\n", oldstate, bus->clkstate));
+#endif /* DHD_DEBUG */
+
+	return ret;
+}
+
+static int
+dhdsdio_bussleep(dhd_bus_t *bus, bool sleep)
+{
+	int err = 0;
+	bcmsdh_info_t *sdh = bus->sdh;
+	sdpcmd_regs_t *regs = bus->regs;
+	uint retries = 0;
+
+	DHD_INFO(("dhdsdio_bussleep: request %s (currently %s)\n",
+	          (sleep ? "SLEEP" : "WAKE"),
+	          (bus->sleeping ? "SLEEP" : "WAKE")));
+
+	if (bus->dhd->hang_was_sent)
+		return BCME_ERROR;
+
+	/* Done if we're already in the requested state */
+	if (sleep == bus->sleeping)
+		return BCME_OK;
+
+	/* Going to sleep: set the alarm and turn off the lights... */
+	if (sleep) {
+		/* Don't sleep if something is pending */
+		if (bus->dpc_sched || bus->rxskip || pktq_len(&bus->txq))
+			return BCME_BUSY;
+
+
+		if (!SLPAUTO_ENAB(bus)) {
+			/* Disable SDIO interrupts (no longer interested) */
+			bcmsdh_intr_disable(bus->sdh);
+
+			/* Make sure the controller has the bus up */
+			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+			/* Tell device to start using OOB wakeup */
+			W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+			if (retries > retry_limit)
+				DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+			/* Turn off our contribution to the HT clock request */
+			dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+				SBSDIO_FORCE_HW_CLKREQ_OFF, NULL);
+
+			/* Isolate the bus */
+			if (bus->sih->chip != BCM4329_CHIP_ID &&
+				bus->sih->chip != BCM4319_CHIP_ID) {
+				bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL,
+					SBSDIO_DEVCTL_PADS_ISO, NULL);
+			}
+		} else {
+			/* Leave interrupts enabled since device can exit sleep and
+			 * interrupt host
+			 */
+			err = dhdsdio_clk_devsleep_iovar(bus, TRUE /* sleep */);
+		}
+
+		/* Change state */
+		bus->sleeping = TRUE;
+		wake_up(&bus->bus_sleep);
+	} else {
+		/* Waking up: bus power up is ok, set local state */
+
+		if (!SLPAUTO_ENAB(bus)) {
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, &err);
+
+			/* Force pad isolation off if possible (in case power never toggled) */
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, 0, NULL);
+
+
+			/* Make sure the controller has the bus up */
+			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+			/* Send misc interrupt to indicate OOB not needed */
+			W_SDREG(0, &regs->tosbmailboxdata, retries);
+			if (retries <= retry_limit)
+				W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+			if (retries > retry_limit)
+				DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+			/* Make sure we have SD bus access */
+			dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+			/* Enable interrupts again */
+			if (bus->intr && (bus->dhd->busstate == DHD_BUS_DATA)) {
+				bus->intdis = FALSE;
+				bcmsdh_intr_enable(bus->sdh);
+			}
+		} else {
+			err = dhdsdio_clk_devsleep_iovar(bus, FALSE /* wake */);
+		}
+
+		if (err == 0) {
+			/* Change state */
+			bus->sleeping = FALSE;
+		}
+	}
+
+	return err;
+}
+
+
+#if defined(OOB_INTR_ONLY)
+void
+dhd_enable_oob_intr(struct dhd_bus *bus, bool enable)
+{
+#if defined(HW_OOB)
+	bcmsdh_enable_hw_oob_intr(bus->sdh, enable);
+#else
+	sdpcmd_regs_t *regs = bus->regs;
+	uint retries = 0;
+
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+	if (enable == TRUE) {
+
+		/* Tell device to start using OOB wakeup */
+		W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+		if (retries > retry_limit)
+			DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+
+	} else {
+		/* Send misc interrupt to indicate OOB not needed */
+		W_SDREG(0, &regs->tosbmailboxdata, retries);
+		if (retries <= retry_limit)
+			W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+	}
+
+	/* Turn off our contribution to the HT clock request */
+	dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+#endif /* !defined(HW_OOB) */
+}
+#endif
+
+int
+dhd_bus_txdata(struct dhd_bus *bus, void *pkt)
+{
+	int ret = BCME_ERROR;
+	osl_t *osh;
+	uint datalen, prec;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	osh = bus->dhd->osh;
+	datalen = PKTLEN(osh, pkt);
+
+#ifdef SDTEST
+	/* Push the test header if doing loopback */
+	if (bus->ext_loop) {
+		uint8* data;
+		PKTPUSH(osh, pkt, SDPCM_TEST_HDRLEN);
+		data = PKTDATA(osh, pkt);
+		*data++ = SDPCM_TEST_ECHOREQ;
+		*data++ = (uint8)bus->loopid++;
+		*data++ = (datalen >> 0);
+		*data++ = (datalen >> 8);
+		datalen += SDPCM_TEST_HDRLEN;
+	}
+#else /* SDTEST */
+	BCM_REFERENCE(datalen);
+#endif /* SDTEST */
+
+	prec = PRIO2PREC((PKTPRIO(pkt) & PRIOMASK));
+
+	/* Check for existing queue, current flow-control, pending event, or pending clock */
+	if (dhd_deferred_tx || bus->fcstate || pktq_len(&bus->txq) || bus->dpc_sched ||
+	    (!DATAOK(bus)) || (bus->flowcontrol & NBITVAL(prec)) ||
+	    (bus->clkstate != CLK_AVAIL)) {
+		bool deq_ret;
+		int pkq_len;
+
+		DHD_TRACE(("%s: deferring pktq len %d\n", __FUNCTION__, pktq_len(&bus->txq)));
+		bus->fcqueued++;
+
+		/* Priority based enq */
+		dhd_os_sdlock_txq(bus->dhd);
+		deq_ret = dhd_prec_enq(bus->dhd, &bus->txq, pkt, prec);
+		dhd_os_sdunlock_txq(bus->dhd);
+
+		if (!deq_ret) {
+#ifdef PROP_TXSTATUS
+			if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt)) == 0)
+#endif /* PROP_TXSTATUS */
+			{
+#ifdef DHDTCPACK_SUPPRESS
+				if (dhd_tcpack_check_xmit(bus->dhd, pkt) == BCME_ERROR) {
+					DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using\n",
+						__FUNCTION__, __LINE__));
+					dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+				}
+#endif /* DHDTCPACK_SUPPRESS */
+				dhd_txcomplete(bus->dhd, pkt, FALSE);
+				PKTFREE(osh, pkt, TRUE);
+			}
+			ret = BCME_NORESOURCE;
+		} else
+			ret = BCME_OK;
+
+		dhd_os_sdlock_txq(bus->dhd);
+		pkq_len = pktq_len(&bus->txq);
+		dhd_os_sdunlock_txq(bus->dhd);
+		if (pkq_len >= FCHI) {
+			bool wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+			wlfc_enabled = (dhd_wlfc_flowcontrol(bus->dhd, ON, FALSE) !=
+				WLFC_UNSUPPORTED);
+#endif
+			if (!wlfc_enabled && dhd_doflow) {
+				dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+			}
+		}
+
+#ifdef DHD_DEBUG
+		dhd_os_sdlock_txq(bus->dhd);
+		if (pktq_plen(&bus->txq, prec) > qcount[prec])
+			qcount[prec] = pktq_plen(&bus->txq, prec);
+		dhd_os_sdunlock_txq(bus->dhd);
+#endif
+
+		/* Schedule DPC if needed to send queued packet(s) */
+		if (dhd_deferred_tx && !bus->dpc_sched) {
+			bus->dpc_sched = TRUE;
+			dhd_sched_dpc(bus->dhd);
+		}
+	} else {
+		int chan = SDPCM_DATA_CHANNEL;
+
+#ifdef SDTEST
+		chan = (bus->ext_loop ? SDPCM_TEST_CHANNEL : SDPCM_DATA_CHANNEL);
+#endif
+		/* Lock: we're about to use shared data/code (and SDIO) */
+		dhd_os_sdlock(bus->dhd);
+
+		/* Otherwise, send it now */
+		BUS_WAKE(bus);
+		/* Make sure back plane ht clk is on, no pending allowed */
+		dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+
+		ret = dhdsdio_txpkt(bus, chan, &pkt, 1, TRUE);
+
+		if (ret != BCME_OK)
+			bus->dhd->tx_errors++;
+		else
+			bus->dhd->dstats.tx_bytes += datalen;
+
+		if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+			bus->activity = FALSE;
+			dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+		}
+
+		dhd_os_sdunlock(bus->dhd);
+	}
+
+	return ret;
+}
+
+/* align packet data pointer and packet length to n-byte boundary, process packet headers,
+ * a new packet may be allocated if there is not enough head and/or tail from for padding.
+ * the caller is responsible for updating the glom size in the head packet (when glom is
+ * used)
+ *
+ * pad_pkt_len: returns the length of extra padding needed from the padding packet, this parameter
+ * is taken in tx glom mode only
+ *
+ * new_pkt: out, pointer of the new packet allocated due to insufficient head room for alignment
+ * padding, NULL if not needed, the caller is responsible for freeing the new packet
+ *
+ * return: positive value - length of the packet, including head and tail padding
+ *		   negative value - errors
+ */
+static int dhdsdio_txpkt_preprocess(dhd_bus_t *bus, void *pkt, int chan, int txseq,
+	int prev_chain_total_len, bool last_chained_pkt,
+	int *pad_pkt_len, void **new_pkt)
+{
+	osl_t *osh;
+	uint8 *frame;
+	int pkt_len;
+	int modulo;
+	int head_padding;
+	int tail_padding = 0;
+	uint32 swheader;
+	uint32 swhdr_offset;
+	bool alloc_new_pkt = FALSE;
+	uint8 sdpcm_hdrlen = bus->txglom_enable ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+
+	*new_pkt = NULL;
+	osh = bus->dhd->osh;
+
+#ifdef DHDTCPACK_SUPPRESS
+	if (dhd_tcpack_check_xmit(bus->dhd, pkt) == BCME_ERROR) {
+		DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+			__FUNCTION__, __LINE__));
+		dhd_tcpack_suppress_set(bus->dhd, TCPACK_SUP_OFF);
+	}
+#endif /* DHDTCPACK_SUPPRESS */
+
+	/* Add space for the SDPCM hardware/software headers */
+	PKTPUSH(osh, pkt, sdpcm_hdrlen);
+	ASSERT(ISALIGNED((uintptr)PKTDATA(osh, pkt), 2));
+
+	frame = (uint8*)PKTDATA(osh, pkt);
+	pkt_len = (uint16)PKTLEN(osh, pkt);
+
+#ifdef WLMEDIA_HTSF
+	frame = (uint8*)PKTDATA(osh, pkt);
+	if (PKTLEN(osh, pkt) >= 100) {
+		htsf_ts = (htsfts_t*) (frame + HTSF_HOSTOFFSET + 12);
+		if (htsf_ts->magic == HTSFMAGIC) {
+			htsf_ts->c20 = get_cycles();
+			htsf_ts->t20 = dhd_get_htsf(bus->dhd->info, 0);
+		}
+	}
+#endif /* WLMEDIA_HTSF */
+#ifdef DHD_DEBUG
+	if (PKTPRIO(pkt) < ARRAYSIZE(tx_packets))
+		tx_packets[PKTPRIO(pkt)]++;
+#endif /* DHD_DEBUG */
+
+	/* align the data pointer, allocate a new packet if there is not enough space (new
+	 * packet data pointer will be aligned thus no padding will be needed)
+	 */
+	head_padding = (ulong)frame % DHD_SDALIGN;
+	if (PKTHEADROOM(osh, pkt) < head_padding) {
+		head_padding = 0;
+		alloc_new_pkt = TRUE;
+	} else {
+		uint cur_chain_total_len;
+		int chain_tail_padding = 0;
+
+		/* All packets need to be aligned by DHD_SDALIGN */
+		modulo = (pkt_len + head_padding) % DHD_SDALIGN;
+		tail_padding = modulo > 0 ? (DHD_SDALIGN - modulo) : 0;
+
+		/* Total pkt chain length needs to be aligned by block size,
+		 * unless it is a single pkt chain with total length less than one block size,
+		 * which we prefer sending by byte mode.
+		 *
+		 * Do the chain alignment here if
+		 * 1. This is the last pkt of the chain of multiple pkts or a single pkt.
+		 * 2-1. This chain is of multiple pkts, or
+		 * 2-2. This is a single pkt whose size is longer than one block size.
+		 */
+		cur_chain_total_len = prev_chain_total_len +
+			(head_padding + pkt_len + tail_padding);
+		if (last_chained_pkt && bus->blocksize != 0 &&
+			(cur_chain_total_len > (int)bus->blocksize || prev_chain_total_len > 0)) {
+			modulo = cur_chain_total_len % bus->blocksize;
+			chain_tail_padding = modulo > 0 ? (bus->blocksize - modulo) : 0;
+		}
+
+#ifdef DHDENABLE_TAILPAD
+		if (PKTTAILROOM(osh, pkt) < tail_padding) {
+			/* We don't have tail room to align by DHD_SDALIGN */
+			alloc_new_pkt = TRUE;
+			bus->tx_tailpad_pktget++;
+		} else if (PKTTAILROOM(osh, pkt) < tail_padding + chain_tail_padding) {
+			/* We have tail room for tail_padding of this pkt itself, but not for
+			 * total pkt chain alignment by block size.
+			 * Use the padding packet to avoid memory copy if applicable,
+			 * otherwise, just allocate a new pkt.
+			 */
+			if (bus->pad_pkt) {
+				*pad_pkt_len = chain_tail_padding;
+				bus->tx_tailpad_chain++;
+			} else {
+				alloc_new_pkt = TRUE;
+				bus->tx_tailpad_pktget++;
+			}
+		} else
+		/* This last pkt's tailroom is sufficient to hold both tail_padding
+		 * of the pkt itself and chain_tail_padding of total pkt chain
+		 */
+#endif /* DHDENABLE_TAILPAD */
+		tail_padding += chain_tail_padding;
+	}
+
+	DHD_INFO(("%s sdhdr len + orig_pkt_len %d h_pad %d t_pad %d pad_pkt_len %d\n",
+		__FUNCTION__, pkt_len, head_padding, tail_padding, *pad_pkt_len));
+
+	if (alloc_new_pkt) {
+		void *tmp_pkt;
+		int newpkt_size;
+		int cur_total_len;
+
+		ASSERT(*pad_pkt_len == 0);
+
+		DHD_INFO(("%s allocating new packet for padding\n", __FUNCTION__));
+
+		/* head pointer is aligned now, no padding needed */
+		head_padding = 0;
+
+		/* update the tail padding as it depends on the head padding, since a new packet is
+		 * allocated, the head padding is non longer needed and packet length is chagned
+		 */
+
+		cur_total_len = prev_chain_total_len + pkt_len;
+		if (last_chained_pkt && bus->blocksize != 0 &&
+			(cur_total_len > (int)bus->blocksize || prev_chain_total_len > 0)) {
+			modulo = cur_total_len % bus->blocksize;
+			tail_padding = modulo > 0 ? (bus->blocksize - modulo) : 0;
+		}
+		else {
+			modulo = pkt_len % DHD_SDALIGN;
+			tail_padding = modulo > 0 ? (DHD_SDALIGN - modulo) : 0;
+		}
+
+		newpkt_size = PKTLEN(osh, pkt) + bus->blocksize + DHD_SDALIGN;
+		bus->dhd->tx_realloc++;
+		tmp_pkt = PKTGET(osh, newpkt_size, TRUE);
+		if (tmp_pkt == NULL) {
+			DHD_ERROR(("failed to alloc new %d byte packet\n", newpkt_size));
+			return BCME_NOMEM;
+		}
+		PKTALIGN(osh, tmp_pkt, PKTLEN(osh, pkt), DHD_SDALIGN);
+		bcopy(PKTDATA(osh, pkt), PKTDATA(osh, tmp_pkt), PKTLEN(osh, pkt));
+		*new_pkt = tmp_pkt;
+		pkt = tmp_pkt;
+	}
+
+	if (head_padding)
+		PKTPUSH(osh, pkt, head_padding);
+
+	frame = (uint8*)PKTDATA(osh, pkt);
+	bzero(frame, head_padding + sdpcm_hdrlen);
+	pkt_len = (uint16)PKTLEN(osh, pkt);
+
+	/* the header has the followming format
+	 * 4-byte HW frame tag: length, ~length (for glom this is the total length)
+	 *
+	 * 8-byte HW extesion flags (glom mode only) as the following:
+	 *			2-byte packet length, excluding HW tag and padding
+	 *			2-byte frame channel and frame flags (e.g. next frame following)
+	 *			2-byte header length
+	 *			2-byte tail padding size
+	 *
+	 * 8-byte SW frame tags as the following
+	 *			4-byte flags: host tx seq, channel, data offset
+	 *			4-byte flags: TBD
+	 */
+
+	swhdr_offset = SDPCM_FRAMETAG_LEN;
+
+	/* hardware frame tag:
+	 *
+	 * in tx-glom mode, dongle only checks the hardware frame tag in the first
+	 * packet and sees it as the total lenght of the glom (including tail padding),
+	 * for each packet in the glom, the packet length needs to be updated, (see
+	 * below PKTSETLEN)
+	 *
+	 * in non tx-glom mode, PKTLEN still need to include tail padding as to be
+	 * referred to in sdioh_request_buffer(). The tail length will be excluded in
+	 * dhdsdio_txpkt_postprocess().
+	 */
+	*(uint16*)frame = (uint16)htol16(pkt_len);
+	*(((uint16*)frame) + 1) = (uint16)htol16(~pkt_len);
+	pkt_len += tail_padding;
+
+	/* hardware extesion flags */
+	if (bus->txglom_enable) {
+		uint32 hwheader1;
+		uint32 hwheader2;
+
+		swhdr_offset += SDPCM_HWEXT_LEN;
+		hwheader1 = (pkt_len - SDPCM_FRAMETAG_LEN - tail_padding) |
+			(last_chained_pkt << 24);
+		hwheader2 = (tail_padding) << 16;
+		htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+		htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+	}
+	PKTSETLEN((osh), (pkt), (pkt_len));
+
+	/* software frame tags */
+	swheader = ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+		| (txseq % SDPCM_SEQUENCE_WRAP) |
+		(((head_padding + sdpcm_hdrlen) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+	htol32_ua_store(swheader, frame + swhdr_offset);
+	htol32_ua_store(0, frame + swhdr_offset + sizeof(swheader));
+
+	return pkt_len;
+}
+
+static int dhdsdio_txpkt_postprocess(dhd_bus_t *bus, void *pkt)
+{
+	osl_t *osh;
+	uint8 *frame;
+	int data_offset;
+	int tail_padding;
+	int swhdr_offset = SDPCM_FRAMETAG_LEN + (bus->txglom_enable ? SDPCM_HWEXT_LEN : 0);
+
+	(void)osh;
+	osh = bus->dhd->osh;
+
+	/* restore pkt buffer pointer, but keeps the header pushed by dhd_prot_hdrpush */
+	frame = (uint8*)PKTDATA(osh, pkt);
+
+	DHD_INFO(("%s PKTLEN before postprocess %d",
+		__FUNCTION__, PKTLEN(osh, pkt)));
+
+	/* PKTLEN still includes tail_padding, so exclude it.
+	 * We shall have head_padding + original pkt_len for PKTLEN afterwards.
+	 */
+	if (bus->txglom_enable) {
+		/* txglom pkts have tail_padding length in HW ext header */
+		tail_padding = ltoh32_ua(frame + SDPCM_FRAMETAG_LEN + 4) >> 16;
+		PKTSETLEN(osh, pkt, PKTLEN(osh, pkt) - tail_padding);
+		DHD_INFO((" txglom pkt: tail_padding %d PKTLEN %d\n",
+			tail_padding, PKTLEN(osh, pkt)));
+	} else {
+		/* non-txglom pkts have head_padding + original pkt length in HW frame tag.
+		 * We cannot refer to this field for txglom pkts as the first pkt of the chain will
+		 * have the field for the total length of the chain.
+		 */
+		PKTSETLEN(osh, pkt, *(uint16*)frame);
+		DHD_INFO((" non-txglom pkt: HW frame tag len %d after PKTLEN %d\n",
+			*(uint16*)frame, PKTLEN(osh, pkt)));
+	}
+
+	data_offset = ltoh32_ua(frame + swhdr_offset);
+	data_offset = (data_offset & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT;
+	/* Get rid of sdpcm header + head_padding */
+	PKTPULL(osh, pkt, data_offset);
+
+	DHD_INFO(("%s data_offset %d, PKTLEN %d\n",
+		__FUNCTION__, data_offset, PKTLEN(osh, pkt)));
+
+	return BCME_OK;
+}
+
+static int dhdsdio_txpkt(dhd_bus_t *bus, uint chan, void** pkts, int num_pkt, bool free_pkt)
+{
+	int i;
+	int ret = 0;
+	osl_t *osh;
+	bcmsdh_info_t *sdh;
+	void *pkt = NULL;
+	void *pkt_chain;
+	int total_len = 0;
+	void *head_pkt = NULL;
+	void *prev_pkt = NULL;
+	int pad_pkt_len = 0;
+	int new_pkt_num = 0;
+	void *new_pkts[MAX_TX_PKTCHAIN_CNT];
+	bool wlfc_enabled = FALSE;
+
+	if (bus->dhd->dongle_reset)
+		return BCME_NOTREADY;
+
+	sdh = bus->sdh;
+	osh = bus->dhd->osh;
+	/* init new_pkts[0] to make some compiler happy, not necessary as we check new_pkt_num */
+	new_pkts[0] = NULL;
+
+	for (i = 0; i < num_pkt; i++) {
+		int pkt_len;
+		bool last_pkt;
+		void *new_pkt = NULL;
+
+		pkt = pkts[i];
+		ASSERT(pkt);
+		last_pkt = (i == num_pkt - 1);
+		pkt_len = dhdsdio_txpkt_preprocess(bus, pkt, chan, bus->tx_seq + i,
+			total_len, last_pkt, &pad_pkt_len, &new_pkt);
+		if (pkt_len <= 0)
+			goto done;
+		if (new_pkt) {
+			pkt = new_pkt;
+			new_pkts[new_pkt_num++] = new_pkt;
+		}
+		total_len += pkt_len;
+
+		PKTSETNEXT(osh, pkt, NULL);
+		/* insert the packet into the list */
+		head_pkt ? PKTSETNEXT(osh, prev_pkt, pkt) : (head_pkt = pkt);
+		prev_pkt = pkt;
+
+	}
+
+	/* Update the HW frame tag (total length) in the first pkt of the glom */
+	if (bus->txglom_enable) {
+		uint8 *frame;
+
+		total_len += pad_pkt_len;
+		frame = (uint8*)PKTDATA(osh, head_pkt);
+		*(uint16*)frame = (uint16)htol16(total_len);
+		*(((uint16*)frame) + 1) = (uint16)htol16(~total_len);
+
+	}
+
+#ifdef DHDENABLE_TAILPAD
+	/* if a padding packet if needed, insert it to the end of the link list */
+	if (pad_pkt_len) {
+		PKTSETLEN(osh, bus->pad_pkt, pad_pkt_len);
+		PKTSETNEXT(osh, pkt, bus->pad_pkt);
+	}
+#endif /* DHDENABLE_TAILPAD */
+
+	/* dhd_bcmsdh_send_buf ignores the buffer pointer if he packet
+	 * parameter is not NULL, for non packet chian we pass NULL pkt pointer
+	 * so it will take the aligned length and buffer pointer.
+	 */
+	pkt_chain = PKTNEXT(osh, head_pkt) ? head_pkt : NULL;
+	ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+		PKTDATA(osh, head_pkt), total_len, pkt_chain, NULL, NULL, TXRETRIES);
+	if (ret == BCME_OK)
+		bus->tx_seq = (bus->tx_seq + num_pkt) % SDPCM_SEQUENCE_WRAP;
+
+	/* if a padding packet was needed, remove it from the link list as it not a data pkt */
+	if (pad_pkt_len && pkt)
+		PKTSETNEXT(osh, pkt, NULL);
+
+done:
+	pkt = head_pkt;
+	while (pkt) {
+		void *pkt_next = PKTNEXT(osh, pkt);
+		PKTSETNEXT(osh, pkt, NULL);
+		dhdsdio_txpkt_postprocess(bus, pkt);
+		pkt = pkt_next;
+	}
+
+	/* new packets might be allocated due to insufficient room for padding, but we
+	 * still have to indicate the original packets to upper layer
+	 */
+	for (i = 0; i < num_pkt; i++) {
+		pkt = pkts[i];
+		wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+		if (DHD_PKTTAG_WLFCPKT(PKTTAG(pkt))) {
+			wlfc_enabled = (dhd_wlfc_txcomplete(bus->dhd, pkt, ret == 0) !=
+				WLFC_UNSUPPORTED);
+		}
+#endif /* PROP_TXSTATUS */
+		if (!wlfc_enabled) {
+			PKTSETNEXT(osh, pkt, NULL);
+			dhd_txcomplete(bus->dhd, pkt, ret != 0);
+			if (free_pkt)
+				PKTFREE(osh, pkt, TRUE);
+		}
+	}
+
+	for (i = 0; i < new_pkt_num; i++)
+		PKTFREE(osh, new_pkts[i], TRUE);
+
+	return ret;
+}
+
+static uint
+dhdsdio_sendfromq(dhd_bus_t *bus, uint maxframes)
+{
+	uint cnt = 0;
+	uint8 tx_prec_map;
+	uint16 txpktqlen = 0;
+	uint32 intstatus = 0;
+	uint retries = 0;
+	osl_t *osh;
+	uint datalen = 0;
+	dhd_pub_t *dhd = bus->dhd;
+	sdpcmd_regs_t *regs = bus->regs;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (!KSO_ENAB(bus)) {
+		DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+		return BCME_NODEVICE;
+	}
+
+	osh = dhd->osh;
+	tx_prec_map = ~bus->flowcontrol;
+	for (cnt = 0; (cnt < maxframes) && DATAOK(bus);) {
+		int i;
+		int num_pkt = 1;
+		void *pkts[MAX_TX_PKTCHAIN_CNT];
+		int prec_out;
+
+		dhd_os_sdlock_txq(bus->dhd);
+		if (bus->txglom_enable) {
+			num_pkt = MIN((uint32)DATABUFCNT(bus), (uint32)bus->txglomsize);
+			num_pkt = MIN(num_pkt, ARRAYSIZE(pkts));
+		}
+		num_pkt = MIN(num_pkt, pktq_mlen(&bus->txq, tx_prec_map));
+		for (i = 0; i < num_pkt; i++) {
+			pkts[i] = pktq_mdeq(&bus->txq, ~bus->flowcontrol, &prec_out);
+			if (!pkts[i]) {
+				DHD_ERROR(("%s: pktq_mlen non-zero when no pkt\n",
+					__FUNCTION__));
+				ASSERT(0);
+				break;
+			}
+			PKTORPHAN(pkts[i]);
+			datalen += PKTLEN(osh, pkts[i]);
+		}
+		dhd_os_sdunlock_txq(bus->dhd);
+
+		if (i == 0)
+			break;
+		if (dhdsdio_txpkt(bus, SDPCM_DATA_CHANNEL, pkts, i, TRUE) != BCME_OK)
+			dhd->tx_errors++;
+		else {
+			dhd->dstats.tx_bytes += datalen;
+			bus->txglomframes++;
+			bus->txglompkts += num_pkt;
+		}
+		cnt += i;
+
+		/* In poll mode, need to check for other events */
+		if (!bus->intr && cnt)
+		{
+			/* Check device status, signal pending interrupt */
+			R_SDREG(intstatus, &regs->intstatus, retries);
+			bus->f2txdata++;
+			if (bcmsdh_regfail(bus->sdh))
+				break;
+			if (intstatus & bus->hostintmask)
+				bus->ipend = TRUE;
+		}
+
+	}
+
+	dhd_os_sdlock_txq(bus->dhd);
+	txpktqlen = pktq_len(&bus->txq);
+	dhd_os_sdunlock_txq(bus->dhd);
+
+	/* Do flow-control if needed */
+	if (dhd->up && (dhd->busstate == DHD_BUS_DATA) && (txpktqlen < FCLOW)) {
+		bool wlfc_enabled = FALSE;
+#ifdef PROP_TXSTATUS
+		wlfc_enabled = (dhd_wlfc_flowcontrol(dhd, OFF, TRUE) != WLFC_UNSUPPORTED);
+#endif
+		if (!wlfc_enabled && dhd_doflow && dhd->txoff) {
+			dhd_txflowcontrol(dhd, ALL_INTERFACES, OFF);
+		}
+	}
+
+	return cnt;
+}
+
+static void
+dhdsdio_sendpendctl(dhd_bus_t *bus)
+{
+	bcmsdh_info_t *sdh = bus->sdh;
+	int ret;
+	uint8* frame_seq = bus->ctrl_frame_buf + SDPCM_FRAMETAG_LEN;
+
+	if (bus->txglom_enable)
+		frame_seq += SDPCM_HWEXT_LEN;
+
+	if (*frame_seq != bus->tx_seq) {
+		DHD_INFO(("%s IOCTL frame seq lag detected!"
+			" frm_seq:%d != bus->tx_seq:%d, corrected\n",
+			__FUNCTION__, *frame_seq, bus->tx_seq));
+		*frame_seq = bus->tx_seq;
+	}
+
+	ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+		(uint8 *)bus->ctrl_frame_buf, (uint32)bus->ctrl_frame_len,
+		NULL, NULL, NULL, 1);
+	if (ret == BCME_OK)
+		bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+
+	bus->ctrl_frame_stat = FALSE;
+	dhd_wait_event_wakeup(bus->dhd);
+}
+
+int
+dhd_bus_txctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+	static int err_nodevice = 0;
+	uint8 *frame;
+	uint16 len;
+	uint32 swheader;
+	bcmsdh_info_t *sdh = bus->sdh;
+	uint8 doff = 0;
+	int ret = -1;
+	uint8 sdpcm_hdrlen = bus->txglom_enable ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd->dongle_reset)
+		return -EIO;
+
+	/* Back the pointer to make a room for bus header */
+	frame = msg - sdpcm_hdrlen;
+	len = (msglen += sdpcm_hdrlen);
+
+	/* Add alignment padding (optional for ctl frames) */
+	if (dhd_alignctl) {
+		if ((doff = ((uintptr)frame % DHD_SDALIGN))) {
+			frame -= doff;
+			len += doff;
+			msglen += doff;
+			bzero(frame, doff + sdpcm_hdrlen);
+		}
+		ASSERT(doff < DHD_SDALIGN);
+	}
+	doff += sdpcm_hdrlen;
+
+	/* Round send length to next SDIO block */
+	if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
+		uint16 pad = bus->blocksize - (len % bus->blocksize);
+		if ((pad <= bus->roundup) && (pad < bus->blocksize))
+			len += pad;
+	} else if (len % DHD_SDALIGN) {
+		len += DHD_SDALIGN - (len % DHD_SDALIGN);
+	}
+
+	/* Satisfy length-alignment requirements */
+	if (forcealign && (len & (ALIGNMENT - 1)))
+		len = ROUNDUP(len, ALIGNMENT);
+
+	ASSERT(ISALIGNED((uintptr)frame, 2));
+
+
+	/* Need to lock here to protect txseq and SDIO tx calls */
+	dhd_os_sdlock(bus->dhd);
+
+	BUS_WAKE(bus);
+
+	/* Make sure backplane clock is on */
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+	/* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
+	*(uint16*)frame = htol16((uint16)msglen);
+	*(((uint16*)frame) + 1) = htol16(~msglen);
+
+	if (bus->txglom_enable) {
+		uint32 hwheader1, hwheader2;
+		/* Software tag: channel, sequence number, data offset */
+		swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+				| bus->tx_seq
+				| ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+		htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN + SDPCM_HWEXT_LEN);
+		htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN
+			+ SDPCM_HWEXT_LEN + sizeof(swheader));
+
+		hwheader1 = (msglen - SDPCM_FRAMETAG_LEN) | (1 << 24);
+		hwheader2 = (len - (msglen)) << 16;
+		htol32_ua_store(hwheader1, frame + SDPCM_FRAMETAG_LEN);
+		htol32_ua_store(hwheader2, frame + SDPCM_FRAMETAG_LEN + 4);
+
+		*(uint16*)frame = htol16(len);
+		*(((uint16*)frame) + 1) = htol16(~(len));
+	} else {
+		/* Software tag: channel, sequence number, data offset */
+		swheader = ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK)
+		        | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
+		htol32_ua_store(swheader, frame + SDPCM_FRAMETAG_LEN);
+		htol32_ua_store(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+	}
+	if (!TXCTLOK(bus)) {
+		DHD_INFO(("%s: No bus credit bus->tx_max %d, bus->tx_seq %d\n",
+			__FUNCTION__, bus->tx_max, bus->tx_seq));
+		bus->ctrl_frame_stat = TRUE;
+		/* Send from dpc */
+		bus->ctrl_frame_buf = frame;
+		bus->ctrl_frame_len = len;
+
+		if (!bus->dpc_sched) {
+			bus->dpc_sched = TRUE;
+			dhd_sched_dpc(bus->dhd);
+		}
+		if (bus->ctrl_frame_stat) {
+			dhd_wait_for_event(bus->dhd, &bus->ctrl_frame_stat);
+		}
+
+		if (bus->ctrl_frame_stat == FALSE) {
+			DHD_INFO(("%s: ctrl_frame_stat == FALSE\n", __FUNCTION__));
+			ret = 0;
+		} else {
+			bus->dhd->txcnt_timeout++;
+			if (!bus->dhd->hang_was_sent) {
+				DHD_ERROR(("%s: ctrl_frame_stat == TRUE txcnt_timeout=%d\n",
+					__FUNCTION__, bus->dhd->txcnt_timeout));
+			}
+			ret = -1;
+			bus->ctrl_frame_stat = FALSE;
+			goto done;
+		}
+	}
+
+	bus->dhd->txcnt_timeout = 0;
+	bus->ctrl_frame_stat = TRUE;
+
+	if (ret == -1) {
+#ifdef DHD_DEBUG
+		if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+			prhex("Tx Frame", frame, len);
+		} else if (DHD_HDRS_ON()) {
+			prhex("TxHdr", frame, MIN(len, 16));
+		}
+#endif
+		ret = dhd_bcmsdh_send_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+		                          frame, len, NULL, NULL, NULL, TXRETRIES);
+		if (ret == BCME_OK)
+			bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+	}
+	bus->ctrl_frame_stat = FALSE;
+
+done:
+	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+		bus->activity = FALSE;
+		dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+	}
+
+	dhd_os_sdunlock(bus->dhd);
+
+	if (ret)
+		bus->dhd->tx_ctlerrs++;
+	else
+		bus->dhd->tx_ctlpkts++;
+
+	if (bus->dhd->txcnt_timeout >= MAX_CNTL_TX_TIMEOUT)
+		return -ETIMEDOUT;
+
+	if (ret == BCME_NODEVICE)
+		err_nodevice++;
+	else
+		err_nodevice = 0;
+
+	return ret ? err_nodevice >= ERROR_BCME_NODEVICE_MAX ? -ETIMEDOUT : -EIO : 0;
+}
+
+int
+dhd_bus_rxctl(struct dhd_bus *bus, uchar *msg, uint msglen)
+{
+	int timeleft;
+	uint rxlen = 0;
+	bool pending;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd->dongle_reset)
+		return -EIO;
+
+	/* Wait until control frame is available */
+	timeleft = dhd_os_ioctl_resp_wait(bus->dhd, &bus->rxlen, &pending);
+
+	dhd_os_sdlock(bus->dhd);
+	rxlen = bus->rxlen;
+	bcopy(bus->rxctl, msg, MIN(msglen, rxlen));
+	bus->rxlen = 0;
+	dhd_os_sdunlock(bus->dhd);
+
+	if (rxlen) {
+		DHD_CTL(("%s: resumed on rxctl frame, got %d expected %d\n",
+			__FUNCTION__, rxlen, msglen));
+	} else if (timeleft == 0) {
+#ifdef DHD_DEBUG
+		uint32 status, retry = 0;
+		R_SDREG(status, &bus->regs->intstatus, retry);
+		DHD_ERROR(("%s: resumed on timeout, INT status=0x%08X\n",
+			__FUNCTION__, status));
+#else
+		DHD_ERROR(("%s: resumed on timeout\n", __FUNCTION__));
+#endif /* DHD_DEBUG */
+#ifdef DHD_DEBUG
+			dhd_os_sdlock(bus->dhd);
+			dhdsdio_checkdied(bus, NULL, 0);
+			dhd_os_sdunlock(bus->dhd);
+#endif /* DHD_DEBUG */
+	} else if (pending == TRUE) {
+		/* signal pending */
+		DHD_ERROR(("%s: signal pending\n", __FUNCTION__));
+		return -EINTR;
+
+	} else {
+		DHD_CTL(("%s: resumed for unknown reason?\n", __FUNCTION__));
+#ifdef DHD_DEBUG
+		dhd_os_sdlock(bus->dhd);
+		dhdsdio_checkdied(bus, NULL, 0);
+		dhd_os_sdunlock(bus->dhd);
+#endif /* DHD_DEBUG */
+	}
+	if (timeleft == 0) {
+		if (rxlen == 0)
+			bus->dhd->rxcnt_timeout++;
+		DHD_ERROR(("%s: rxcnt_timeout=%d, rxlen=%d\n", __FUNCTION__,
+			bus->dhd->rxcnt_timeout, rxlen));
+	}
+	else
+		bus->dhd->rxcnt_timeout = 0;
+
+	if (rxlen)
+		bus->dhd->rx_ctlpkts++;
+	else
+		bus->dhd->rx_ctlerrs++;
+
+	if (bus->dhd->rxcnt_timeout >= MAX_CNTL_RX_TIMEOUT)
+		return -ETIMEDOUT;
+
+	if (bus->dhd->dongle_trap_occured)
+		return -EREMOTEIO;
+
+	return rxlen ? (int)rxlen : -EIO;
+}
+
+/* IOVar table */
+enum {
+	IOV_INTR = 1,
+	IOV_POLLRATE,
+	IOV_SDREG,
+	IOV_SBREG,
+	IOV_SDCIS,
+	IOV_MEMBYTES,
+	IOV_RAMSIZE,
+	IOV_RAMSTART,
+#ifdef DHD_DEBUG
+	IOV_CHECKDIED,
+	IOV_SERIALCONS,
+#endif /* DHD_DEBUG */
+	IOV_SET_DOWNLOAD_STATE,
+	IOV_SOCRAM_STATE,
+	IOV_FORCEEVEN,
+	IOV_SDIOD_DRIVE,
+	IOV_READAHEAD,
+	IOV_SDRXCHAIN,
+	IOV_ALIGNCTL,
+	IOV_SDALIGN,
+	IOV_DEVRESET,
+	IOV_CPU,
+#if defined(USE_SDIOFIFO_IOVAR)
+	IOV_WATERMARK,
+	IOV_MESBUSYCTRL,
+#endif /* USE_SDIOFIFO_IOVAR */
+#ifdef SDTEST
+	IOV_PKTGEN,
+	IOV_EXTLOOP,
+#endif /* SDTEST */
+	IOV_SPROM,
+	IOV_TXBOUND,
+	IOV_RXBOUND,
+	IOV_TXMINMAX,
+	IOV_IDLETIME,
+	IOV_IDLECLOCK,
+	IOV_SD1IDLE,
+	IOV_SLEEP,
+	IOV_DONGLEISOLATION,
+	IOV_KSO,
+	IOV_DEVSLEEP,
+	IOV_DEVCAP,
+	IOV_VARS,
+#ifdef SOFTAP
+	IOV_FWPATH,
+#endif
+	IOV_TXGLOMSIZE,
+	IOV_TXGLOMMODE,
+	IOV_HANGREPORT,
+	IOV_TXINRX_THRES
+};
+
+const bcm_iovar_t dhdsdio_iovars[] = {
+	{"intr",	IOV_INTR,	0,	IOVT_BOOL,	0 },
+	{"sleep",	IOV_SLEEP,	0,	IOVT_BOOL,	0 },
+	{"pollrate",	IOV_POLLRATE,	0,	IOVT_UINT32,	0 },
+	{"idletime",	IOV_IDLETIME,	0,	IOVT_INT32,	0 },
+	{"idleclock",	IOV_IDLECLOCK,	0,	IOVT_INT32,	0 },
+	{"sd1idle",	IOV_SD1IDLE,	0,	IOVT_BOOL,	0 },
+	{"membytes",	IOV_MEMBYTES,	0,	IOVT_BUFFER,	2 * sizeof(int) },
+	{"ramsize",	IOV_RAMSIZE,	0,	IOVT_UINT32,	0 },
+	{"ramstart",	IOV_RAMSTART,	0,	IOVT_UINT32,	0 },
+	{"dwnldstate",	IOV_SET_DOWNLOAD_STATE,	0,	IOVT_BOOL,	0 },
+	{"socram_state",	IOV_SOCRAM_STATE,	0,	IOVT_BOOL,	0 },
+	{"vars",	IOV_VARS,	0,	IOVT_BUFFER,	0 },
+	{"sdiod_drive",	IOV_SDIOD_DRIVE, 0,	IOVT_UINT32,	0 },
+	{"readahead",	IOV_READAHEAD,	0,	IOVT_BOOL,	0 },
+	{"sdrxchain",	IOV_SDRXCHAIN,	0,	IOVT_BOOL,	0 },
+	{"alignctl",	IOV_ALIGNCTL,	0,	IOVT_BOOL,	0 },
+	{"sdalign",	IOV_SDALIGN,	0,	IOVT_BOOL,	0 },
+	{"devreset",	IOV_DEVRESET,	0,	IOVT_BOOL,	0 },
+#ifdef DHD_DEBUG
+	{"sdreg",	IOV_SDREG,	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
+	{"sbreg",	IOV_SBREG,	0,	IOVT_BUFFER,	sizeof(sdreg_t) },
+	{"sd_cis",	IOV_SDCIS,	0,	IOVT_BUFFER,	DHD_IOCTL_MAXLEN },
+	{"forcealign",	IOV_FORCEEVEN,	0,	IOVT_BOOL,	0 },
+	{"txbound",	IOV_TXBOUND,	0,	IOVT_UINT32,	0 },
+	{"rxbound",	IOV_RXBOUND,	0,	IOVT_UINT32,	0 },
+	{"txminmax",	IOV_TXMINMAX,	0,	IOVT_UINT32,	0 },
+	{"cpu",		IOV_CPU,	0,	IOVT_BOOL,	0 },
+#ifdef DHD_DEBUG
+	{"checkdied",	IOV_CHECKDIED,	0,	IOVT_BUFFER,	0 },
+	{"serial",	IOV_SERIALCONS,	0,	IOVT_UINT32,	0 },
+#endif /* DHD_DEBUG  */
+#endif /* DHD_DEBUG */
+#ifdef SDTEST
+	{"extloop",	IOV_EXTLOOP,	0,	IOVT_BOOL,	0 },
+	{"pktgen",	IOV_PKTGEN,	0,	IOVT_BUFFER,	sizeof(dhd_pktgen_t) },
+#endif /* SDTEST */
+#if defined(USE_SDIOFIFO_IOVAR)
+	{"watermark",	IOV_WATERMARK,	0,	IOVT_UINT32,	0 },
+	{"mesbusyctrl",	IOV_MESBUSYCTRL,	0,	IOVT_UINT32,	0 },
+#endif /* USE_SDIOFIFO_IOVAR */
+	{"devcap", IOV_DEVCAP,	0,	IOVT_UINT32,	0 },
+	{"dngl_isolation", IOV_DONGLEISOLATION,	0,	IOVT_UINT32,	0 },
+	{"kso",	IOV_KSO,	0,	IOVT_UINT32,	0 },
+	{"devsleep", IOV_DEVSLEEP,	0,	IOVT_UINT32,	0 },
+#ifdef SOFTAP
+	{"fwpath", IOV_FWPATH, 0, IOVT_BUFFER, 0 },
+#endif
+	{"txglomsize", IOV_TXGLOMSIZE, 0, IOVT_UINT32, 0 },
+	{"fw_hang_report", IOV_HANGREPORT, 0, IOVT_BOOL, 0 },
+	{"txinrx_thres", IOV_TXINRX_THRES, 0, IOVT_INT32, 0 },
+	{NULL, 0, 0, 0, 0 }
+};
+
+static void
+dhd_dump_pct(struct bcmstrbuf *strbuf, char *desc, uint num, uint div)
+{
+	uint q1, q2;
+
+	if (!div) {
+		bcm_bprintf(strbuf, "%s N/A", desc);
+	} else {
+		q1 = num / div;
+		q2 = (100 * (num - (q1 * div))) / div;
+		bcm_bprintf(strbuf, "%s %d.%02d", desc, q1, q2);
+	}
+}
+
+void
+dhd_bus_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+	dhd_bus_t *bus = dhdp->bus;
+
+	bcm_bprintf(strbuf, "Bus SDIO structure:\n");
+	bcm_bprintf(strbuf, "hostintmask 0x%08x intstatus 0x%08x sdpcm_ver %d\n",
+	            bus->hostintmask, bus->intstatus, bus->sdpcm_ver);
+	bcm_bprintf(strbuf, "fcstate %d qlen %u tx_seq %d, max %d, rxskip %d rxlen %u rx_seq %d\n",
+	            bus->fcstate, pktq_len(&bus->txq), bus->tx_seq, bus->tx_max, bus->rxskip,
+	            bus->rxlen, bus->rx_seq);
+	bcm_bprintf(strbuf, "intr %d intrcount %u lastintrs %u spurious %u\n",
+	            bus->intr, bus->intrcount, bus->lastintrs, bus->spurious);
+	bcm_bprintf(strbuf, "pollrate %u pollcnt %u regfails %u\n",
+	            bus->pollrate, bus->pollcnt, bus->regfails);
+
+	bcm_bprintf(strbuf, "\nAdditional counters:\n");
+#ifdef DHDENABLE_TAILPAD
+	bcm_bprintf(strbuf, "tx_tailpad_chain %u tx_tailpad_pktget %u\n",
+	            bus->tx_tailpad_chain, bus->tx_tailpad_pktget);
+#endif /* DHDENABLE_TAILPAD */
+	bcm_bprintf(strbuf, "tx_sderrs %u fcqueued %u rxrtx %u rx_toolong %u rxc_errors %u\n",
+	            bus->tx_sderrs, bus->fcqueued, bus->rxrtx, bus->rx_toolong,
+	            bus->rxc_errors);
+	bcm_bprintf(strbuf, "rx_hdrfail %u badhdr %u badseq %u\n",
+	            bus->rx_hdrfail, bus->rx_badhdr, bus->rx_badseq);
+	bcm_bprintf(strbuf, "fc_rcvd %u, fc_xoff %u, fc_xon %u\n",
+	            bus->fc_rcvd, bus->fc_xoff, bus->fc_xon);
+	bcm_bprintf(strbuf, "rxglomfail %u, rxglomframes %u, rxglompkts %u\n",
+	            bus->rxglomfail, bus->rxglomframes, bus->rxglompkts);
+	bcm_bprintf(strbuf, "f2rx (hdrs/data) %u (%u/%u), f2tx %u f1regs %u\n",
+	            (bus->f2rxhdrs + bus->f2rxdata), bus->f2rxhdrs, bus->f2rxdata,
+	            bus->f2txdata, bus->f1regdata);
+	{
+		dhd_dump_pct(strbuf, "\nRx: pkts/f2rd", bus->dhd->rx_packets,
+		             (bus->f2rxhdrs + bus->f2rxdata));
+		dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->rx_packets, bus->f1regdata);
+		dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->rx_packets,
+		             (bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+		dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->rx_packets, bus->intrcount);
+		bcm_bprintf(strbuf, "\n");
+
+		dhd_dump_pct(strbuf, "Rx: glom pct", (100 * bus->rxglompkts),
+		             bus->dhd->rx_packets);
+		dhd_dump_pct(strbuf, ", pkts/glom", bus->rxglompkts, bus->rxglomframes);
+		bcm_bprintf(strbuf, "\n");
+
+		dhd_dump_pct(strbuf, "Tx: pkts/f2wr", bus->dhd->tx_packets, bus->f2txdata);
+		dhd_dump_pct(strbuf, ", pkts/f1sd", bus->dhd->tx_packets, bus->f1regdata);
+		dhd_dump_pct(strbuf, ", pkts/sd", bus->dhd->tx_packets,
+		             (bus->f2txdata + bus->f1regdata));
+		dhd_dump_pct(strbuf, ", pkts/int", bus->dhd->tx_packets, bus->intrcount);
+		bcm_bprintf(strbuf, "\n");
+
+		dhd_dump_pct(strbuf, "Total: pkts/f2rw",
+		             (bus->dhd->tx_packets + bus->dhd->rx_packets),
+		             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata));
+		dhd_dump_pct(strbuf, ", pkts/f1sd",
+		             (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->f1regdata);
+		dhd_dump_pct(strbuf, ", pkts/sd",
+		             (bus->dhd->tx_packets + bus->dhd->rx_packets),
+		             (bus->f2txdata + bus->f2rxhdrs + bus->f2rxdata + bus->f1regdata));
+		dhd_dump_pct(strbuf, ", pkts/int",
+		             (bus->dhd->tx_packets + bus->dhd->rx_packets), bus->intrcount);
+		bcm_bprintf(strbuf, "\n\n");
+	}
+
+#ifdef SDTEST
+	if (bus->pktgen_count) {
+		bcm_bprintf(strbuf, "pktgen config and count:\n");
+		bcm_bprintf(strbuf, "freq %u count %u print %u total %u min %u len %u\n",
+		            bus->pktgen_freq, bus->pktgen_count, bus->pktgen_print,
+		            bus->pktgen_total, bus->pktgen_minlen, bus->pktgen_maxlen);
+		bcm_bprintf(strbuf, "send attempts %u rcvd %u fail %u\n",
+		            bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+	}
+#endif /* SDTEST */
+#ifdef DHD_DEBUG
+	bcm_bprintf(strbuf, "dpc_sched %d host interrupt%spending\n",
+	            bus->dpc_sched, (bcmsdh_intr_pending(bus->sdh) ? " " : " not "));
+	bcm_bprintf(strbuf, "blocksize %u roundup %u\n", bus->blocksize, bus->roundup);
+#endif /* DHD_DEBUG */
+	bcm_bprintf(strbuf, "clkstate %d activity %d idletime %d idlecount %d sleeping %d\n",
+	            bus->clkstate, bus->activity, bus->idletime, bus->idlecount, bus->sleeping);
+	dhd_dump_pct(strbuf, "Tx: glom pct", (100 * bus->txglompkts), bus->dhd->tx_packets);
+	dhd_dump_pct(strbuf, ", pkts/glom", bus->txglompkts, bus->txglomframes);
+	bcm_bprintf(strbuf, "\n");
+	bcm_bprintf(strbuf, "txglomframes %u, txglompkts %u\n", bus->txglomframes, bus->txglompkts);
+	bcm_bprintf(strbuf, "\n");
+}
+
+void
+dhd_bus_clearcounts(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = (dhd_bus_t *)dhdp->bus;
+
+	bus->intrcount = bus->lastintrs = bus->spurious = bus->regfails = 0;
+	bus->rxrtx = bus->rx_toolong = bus->rxc_errors = 0;
+	bus->rx_hdrfail = bus->rx_badhdr = bus->rx_badseq = 0;
+#ifdef DHDENABLE_TAILPAD
+	bus->tx_tailpad_chain = bus->tx_tailpad_pktget = 0;
+#endif /* DHDENABLE_TAILPAD */
+	bus->tx_sderrs = bus->fc_rcvd = bus->fc_xoff = bus->fc_xon = 0;
+	bus->rxglomfail = bus->rxglomframes = bus->rxglompkts = 0;
+	bus->f2rxhdrs = bus->f2rxdata = bus->f2txdata = bus->f1regdata = 0;
+	bus->txglomframes = bus->txglompkts = 0;
+}
+
+#ifdef SDTEST
+static int
+dhdsdio_pktgen_get(dhd_bus_t *bus, uint8 *arg)
+{
+	dhd_pktgen_t pktgen;
+
+	pktgen.version = DHD_PKTGEN_VERSION;
+	pktgen.freq = bus->pktgen_freq;
+	pktgen.count = bus->pktgen_count;
+	pktgen.print = bus->pktgen_print;
+	pktgen.total = bus->pktgen_total;
+	pktgen.minlen = bus->pktgen_minlen;
+	pktgen.maxlen = bus->pktgen_maxlen;
+	pktgen.numsent = bus->pktgen_sent;
+	pktgen.numrcvd = bus->pktgen_rcvd;
+	pktgen.numfail = bus->pktgen_fail;
+	pktgen.mode = bus->pktgen_mode;
+	pktgen.stop = bus->pktgen_stop;
+
+	bcopy(&pktgen, arg, sizeof(pktgen));
+
+	return 0;
+}
+
+static int
+dhdsdio_pktgen_set(dhd_bus_t *bus, uint8 *arg)
+{
+	dhd_pktgen_t pktgen;
+	uint oldcnt, oldmode;
+
+	bcopy(arg, &pktgen, sizeof(pktgen));
+	if (pktgen.version != DHD_PKTGEN_VERSION)
+		return BCME_BADARG;
+
+	oldcnt = bus->pktgen_count;
+	oldmode = bus->pktgen_mode;
+
+	bus->pktgen_freq = pktgen.freq;
+	bus->pktgen_count = pktgen.count;
+	bus->pktgen_print = pktgen.print;
+	bus->pktgen_total = pktgen.total;
+	bus->pktgen_minlen = pktgen.minlen;
+	bus->pktgen_maxlen = pktgen.maxlen;
+	bus->pktgen_mode = pktgen.mode;
+	bus->pktgen_stop = pktgen.stop;
+
+	bus->pktgen_tick = bus->pktgen_ptick = 0;
+	bus->pktgen_prev_time = jiffies;
+	bus->pktgen_len = MAX(bus->pktgen_len, bus->pktgen_minlen);
+	bus->pktgen_len = MIN(bus->pktgen_len, bus->pktgen_maxlen);
+
+	/* Clear counts for a new pktgen (mode change, or was stopped) */
+	if (bus->pktgen_count && (!oldcnt || oldmode != bus->pktgen_mode)) {
+		bus->pktgen_sent = bus->pktgen_prev_sent = bus->pktgen_rcvd = 0;
+		bus->pktgen_prev_rcvd = bus->pktgen_fail = 0;
+	}
+
+	return 0;
+}
+#endif /* SDTEST */
+
+static void
+dhdsdio_devram_remap(dhd_bus_t *bus, bool val)
+{
+	uint8 enable, protect, remap;
+
+	si_socdevram(bus->sih, FALSE, &enable, &protect, &remap);
+	remap = val ? TRUE : FALSE;
+	si_socdevram(bus->sih, TRUE, &enable, &protect, &remap);
+}
+
+static int
+dhdsdio_membytes(dhd_bus_t *bus, bool write, uint32 address, uint8 *data, uint size)
+{
+	int bcmerror = 0;
+	uint32 sdaddr;
+	uint dsize;
+
+	/* In remap mode, adjust address beyond socram and redirect
+	 * to devram at SOCDEVRAM_BP_ADDR since remap address > orig_ramsize
+	 * is not backplane accessible
+	 */
+	if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address)) {
+		address -= bus->orig_ramsize;
+		address += SOCDEVRAM_BP_ADDR;
+	}
+
+	/* Determine initial transfer parameters */
+	sdaddr = address & SBSDIO_SB_OFT_ADDR_MASK;
+	if ((sdaddr + size) & SBSDIO_SBWINDOW_MASK)
+		dsize = (SBSDIO_SB_OFT_ADDR_LIMIT - sdaddr);
+	else
+		dsize = size;
+
+	/* Set the backplane window to include the start address */
+	if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+		DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+		goto xfer_done;
+	}
+
+	/* Do the transfer(s) */
+	while (size) {
+		DHD_INFO(("%s: %s %d bytes at offset 0x%08x in window 0x%08x\n",
+		          __FUNCTION__, (write ? "write" : "read"), dsize, sdaddr,
+		          (address & SBSDIO_SBWINDOW_MASK)));
+		if ((bcmerror = bcmsdh_rwdata(bus->sdh, write, sdaddr, data, dsize))) {
+			DHD_ERROR(("%s: membytes transfer failed\n", __FUNCTION__));
+			break;
+		}
+
+		/* Adjust for next transfer (if any) */
+		if ((size -= dsize)) {
+			data += dsize;
+			address += dsize;
+			if ((bcmerror = dhdsdio_set_siaddr_window(bus, address))) {
+				DHD_ERROR(("%s: window change failed\n", __FUNCTION__));
+				break;
+			}
+			sdaddr = 0;
+			dsize = MIN(SBSDIO_SB_OFT_ADDR_LIMIT, size);
+		}
+
+	}
+
+xfer_done:
+	/* Return the window to backplane enumeration space for core access */
+	if (dhdsdio_set_siaddr_window(bus, bcmsdh_cur_sbwad(bus->sdh))) {
+		DHD_ERROR(("%s: FAILED to set window back to 0x%x\n", __FUNCTION__,
+			bcmsdh_cur_sbwad(bus->sdh)));
+	}
+
+	return bcmerror;
+}
+
+#ifdef DHD_DEBUG
+static int
+dhdsdio_readshared(dhd_bus_t *bus, sdpcm_shared_t *sh)
+{
+	uint32 addr;
+	int rv, i;
+	uint32 shaddr = 0;
+
+	if (CHIPID(bus->sih->chip) == BCM43430_CHIP_ID && !dhdsdio_sr_cap(bus))
+		bus->srmemsize = 0;
+
+	shaddr = bus->dongle_ram_base + bus->ramsize - 4;
+	i = 0;
+	do {
+		/* Read last word in memory to determine address of sdpcm_shared structure */
+		if ((rv = dhdsdio_membytes(bus, FALSE, shaddr, (uint8 *)&addr, 4)) < 0)
+			return rv;
+
+		addr = ltoh32(addr);
+
+		DHD_INFO(("sdpcm_shared address 0x%08X\n", addr));
+
+		/*
+		 * Check if addr is valid.
+		 * NVRAM length at the end of memory should have been overwritten.
+		 */
+		if (addr == 0 || ((~addr >> 16) & 0xffff) == (addr & 0xffff)) {
+			if ((bus->srmemsize > 0) && (i++ == 0)) {
+				shaddr -= bus->srmemsize;
+			} else {
+				DHD_ERROR(("%s: address (0x%08x) of sdpcm_shared invalid\n",
+					__FUNCTION__, addr));
+				return BCME_ERROR;
+			}
+		} else
+			break;
+	} while (i < 2);
+
+	/* Read hndrte_shared structure */
+	if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)sh, sizeof(sdpcm_shared_t))) < 0)
+		return rv;
+
+	/* Endianness */
+	sh->flags = ltoh32(sh->flags);
+	sh->trap_addr = ltoh32(sh->trap_addr);
+	sh->assert_exp_addr = ltoh32(sh->assert_exp_addr);
+	sh->assert_file_addr = ltoh32(sh->assert_file_addr);
+	sh->assert_line = ltoh32(sh->assert_line);
+	sh->console_addr = ltoh32(sh->console_addr);
+	sh->msgtrace_addr = ltoh32(sh->msgtrace_addr);
+
+	if ((sh->flags & SDPCM_SHARED_VERSION_MASK) == 3 && SDPCM_SHARED_VERSION == 1)
+		return BCME_OK;
+
+	if ((sh->flags & SDPCM_SHARED_VERSION_MASK) != SDPCM_SHARED_VERSION) {
+		DHD_ERROR(("%s: sdpcm_shared version %d in dhd "
+		           "is different than sdpcm_shared version %d in dongle\n",
+		           __FUNCTION__, SDPCM_SHARED_VERSION,
+		           sh->flags & SDPCM_SHARED_VERSION_MASK));
+		return BCME_ERROR;
+	}
+
+	return BCME_OK;
+}
+
+#define CONSOLE_LINE_MAX	192
+
+static int
+dhdsdio_readconsole(dhd_bus_t *bus)
+{
+	dhd_console_t *c = &bus->console;
+	uint8 line[CONSOLE_LINE_MAX], ch;
+	uint32 n, idx, addr;
+	int rv;
+
+	/* Don't do anything until FWREADY updates console address */
+	if (bus->console_addr == 0)
+		return 0;
+
+	if (!KSO_ENAB(bus))
+		return 0;
+
+	/* Read console log struct */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, log);
+	if ((rv = dhdsdio_membytes(bus, FALSE, addr, (uint8 *)&c->log, sizeof(c->log))) < 0)
+		return rv;
+
+	/* Allocate console buffer (one time only) */
+	if (c->buf == NULL) {
+		c->bufsize = ltoh32(c->log.buf_size);
+		if ((c->buf = MALLOC(bus->dhd->osh, c->bufsize)) == NULL)
+			return BCME_NOMEM;
+	}
+
+	idx = ltoh32(c->log.idx);
+
+	/* Protect against corrupt value */
+	if (idx > c->bufsize)
+		return BCME_ERROR;
+
+	/* Skip reading the console buffer if the index pointer has not moved */
+	if (idx == c->last)
+		return BCME_OK;
+
+	/* Read the console buffer */
+	addr = ltoh32(c->log.buf);
+	if ((rv = dhdsdio_membytes(bus, FALSE, addr, c->buf, c->bufsize)) < 0)
+		return rv;
+
+	while (c->last != idx) {
+		for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+			if (c->last == idx) {
+				/* This would output a partial line.  Instead, back up
+				 * the buffer pointer and output this line next time around.
+				 */
+				if (c->last >= n)
+					c->last -= n;
+				else
+					c->last = c->bufsize - n;
+				goto break2;
+			}
+			ch = c->buf[c->last];
+			c->last = (c->last + 1) % c->bufsize;
+			if (ch == '\n')
+				break;
+			line[n] = ch;
+		}
+
+		if (n > 0) {
+			if (line[n - 1] == '\r')
+				n--;
+			line[n] = 0;
+			printf("CONSOLE: %s\n", line);
+#ifdef LOG_INTO_TCPDUMP
+			dhd_sendup_log(bus->dhd, line, n);
+#endif /* LOG_INTO_TCPDUMP */
+		}
+	}
+break2:
+
+	return BCME_OK;
+}
+
+static int
+dhdsdio_checkdied(dhd_bus_t *bus, char *data, uint size)
+{
+	int bcmerror = 0;
+	uint msize = 512;
+	char *mbuffer = NULL;
+	char *console_buffer = NULL;
+	uint maxstrlen = 256;
+	char *str = NULL;
+	trap_t tr;
+	sdpcm_shared_t sdpcm_shared;
+	struct bcmstrbuf strbuf;
+	uint32 console_ptr, console_size, console_index;
+	uint8 line[CONSOLE_LINE_MAX], ch;
+	uint32 n, i, addr;
+	int rv;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (DHD_NOCHECKDIED_ON())
+		return 0;
+
+	if (data == NULL) {
+		/*
+		 * Called after a rx ctrl timeout. "data" is NULL.
+		 * allocate memory to trace the trap or assert.
+		 */
+		size = msize;
+		mbuffer = data = MALLOC(bus->dhd->osh, msize);
+		if (mbuffer == NULL) {
+			DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, msize));
+			bcmerror = BCME_NOMEM;
+			goto done;
+		}
+	}
+
+	if ((str = MALLOC(bus->dhd->osh, maxstrlen)) == NULL) {
+		DHD_ERROR(("%s: MALLOC(%d) failed \n", __FUNCTION__, maxstrlen));
+		bcmerror = BCME_NOMEM;
+		goto done;
+	}
+
+	if ((bcmerror = dhdsdio_readshared(bus, &sdpcm_shared)) < 0)
+		goto done;
+
+	bcm_binit(&strbuf, data, size);
+
+	bcm_bprintf(&strbuf, "msgtrace address : 0x%08X\nconsole address  : 0x%08X\n",
+	            sdpcm_shared.msgtrace_addr, sdpcm_shared.console_addr);
+
+	if ((sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT) == 0) {
+		/* NOTE: Misspelled assert is intentional - DO NOT FIX.
+		 * (Avoids conflict with real asserts for programmatic parsing of output.)
+		 */
+		bcm_bprintf(&strbuf, "Assrt not built in dongle\n");
+	}
+
+	if ((sdpcm_shared.flags & (SDPCM_SHARED_ASSERT|SDPCM_SHARED_TRAP)) == 0) {
+		/* NOTE: Misspelled assert is intentional - DO NOT FIX.
+		 * (Avoids conflict with real asserts for programmatic parsing of output.)
+		 */
+		bcm_bprintf(&strbuf, "No trap%s in dongle",
+		          (sdpcm_shared.flags & SDPCM_SHARED_ASSERT_BUILT)
+		          ?"/assrt" :"");
+	} else {
+		if (sdpcm_shared.flags & SDPCM_SHARED_ASSERT) {
+			/* Download assert */
+			bcm_bprintf(&strbuf, "Dongle assert");
+			if (sdpcm_shared.assert_exp_addr != 0) {
+				str[0] = '\0';
+				if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+				                                 sdpcm_shared.assert_exp_addr,
+				                                 (uint8 *)str, maxstrlen)) < 0)
+					goto done;
+
+				str[maxstrlen - 1] = '\0';
+				bcm_bprintf(&strbuf, " expr \"%s\"", str);
+			}
+
+			if (sdpcm_shared.assert_file_addr != 0) {
+				str[0] = '\0';
+				if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+				                                 sdpcm_shared.assert_file_addr,
+				                                 (uint8 *)str, maxstrlen)) < 0)
+					goto done;
+
+				str[maxstrlen - 1] = '\0';
+				bcm_bprintf(&strbuf, " file \"%s\"", str);
+			}
+
+			bcm_bprintf(&strbuf, " line %d ", sdpcm_shared.assert_line);
+		}
+
+		if (sdpcm_shared.flags & SDPCM_SHARED_TRAP) {
+			bus->dhd->dongle_trap_occured = TRUE;
+			if ((bcmerror = dhdsdio_membytes(bus, FALSE,
+			                                 sdpcm_shared.trap_addr,
+			                                 (uint8*)&tr, sizeof(trap_t))) < 0)
+				goto done;
+
+			bcm_bprintf(&strbuf,
+			"Dongle trap type 0x%x @ epc 0x%x, cpsr 0x%x, spsr 0x%x, sp 0x%x,"
+			            "lp 0x%x, rpc 0x%x Trap offset 0x%x, "
+			"r0 0x%x, r1 0x%x, r2 0x%x, r3 0x%x, "
+			"r4 0x%x, r5 0x%x, r6 0x%x, r7 0x%x\n\n",
+			ltoh32(tr.type), ltoh32(tr.epc), ltoh32(tr.cpsr), ltoh32(tr.spsr),
+			ltoh32(tr.r13), ltoh32(tr.r14), ltoh32(tr.pc),
+			ltoh32(sdpcm_shared.trap_addr),
+			ltoh32(tr.r0), ltoh32(tr.r1), ltoh32(tr.r2), ltoh32(tr.r3),
+			ltoh32(tr.r4), ltoh32(tr.r5), ltoh32(tr.r6), ltoh32(tr.r7));
+
+			addr = sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log);
+			if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+				(uint8 *)&console_ptr, sizeof(console_ptr))) < 0)
+				goto printbuf;
+
+			addr = sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log.buf_size);
+			if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+				(uint8 *)&console_size, sizeof(console_size))) < 0)
+				goto printbuf;
+
+			addr = sdpcm_shared.console_addr + OFFSETOF(hnd_cons_t, log.idx);
+			if ((rv = dhdsdio_membytes(bus, FALSE, addr,
+				(uint8 *)&console_index, sizeof(console_index))) < 0)
+				goto printbuf;
+
+			console_ptr = ltoh32(console_ptr);
+			console_size = ltoh32(console_size);
+			console_index = ltoh32(console_index);
+
+			if (console_size > CONSOLE_BUFFER_MAX ||
+				!(console_buffer = MALLOC(bus->dhd->osh, console_size)))
+				goto printbuf;
+
+			if ((rv = dhdsdio_membytes(bus, FALSE, console_ptr,
+				(uint8 *)console_buffer, console_size)) < 0)
+				goto printbuf;
+
+			for (i = 0, n = 0; i < console_size; i += n + 1) {
+				for (n = 0; n < CONSOLE_LINE_MAX - 2; n++) {
+					ch = console_buffer[(console_index + i + n) % console_size];
+					if (ch == '\n')
+						break;
+					line[n] = ch;
+				}
+
+
+				if (n > 0) {
+					if (line[n - 1] == '\r')
+						n--;
+					line[n] = 0;
+					/* Don't use DHD_ERROR macro since we print
+					 * a lot of information quickly. The macro
+					 * will truncate a lot of the printfs
+					 */
+
+					if (dhd_msg_level & DHD_ERROR_VAL)
+						printf("CONSOLE: %s\n", line);
+				}
+			}
+		}
+	}
+
+printbuf:
+	if (sdpcm_shared.flags & (SDPCM_SHARED_ASSERT | SDPCM_SHARED_TRAP)) {
+		DHD_ERROR(("%s: %s\n", __FUNCTION__, strbuf.origbuf));
+	}
+
+
+done:
+	if (mbuffer)
+		MFREE(bus->dhd->osh, mbuffer, msize);
+	if (str)
+		MFREE(bus->dhd->osh, str, maxstrlen);
+	if (console_buffer)
+		MFREE(bus->dhd->osh, console_buffer, console_size);
+
+	return bcmerror;
+}
+#endif /* #ifdef DHD_DEBUG */
+
+
+int
+dhdsdio_downloadvars(dhd_bus_t *bus, void *arg, int len)
+{
+	int bcmerror = BCME_OK;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Basic sanity checks */
+	if (bus->dhd->up) {
+		bcmerror = BCME_NOTDOWN;
+		goto err;
+	}
+	if (!len) {
+		bcmerror = BCME_BUFTOOSHORT;
+		goto err;
+	}
+
+	/* Free the old ones and replace with passed variables */
+	if (bus->vars)
+		MFREE(bus->dhd->osh, bus->vars, bus->varsz);
+
+	bus->vars = MALLOC(bus->dhd->osh, len);
+	bus->varsz = bus->vars ? len : 0;
+	if (bus->vars == NULL) {
+		bcmerror = BCME_NOMEM;
+		goto err;
+	}
+
+	/* Copy the passed variables, which should include the terminating double-null */
+	bcopy(arg, bus->vars, bus->varsz);
+err:
+	return bcmerror;
+}
+
+#ifdef DHD_DEBUG
+
+#define CC_PLL_CHIPCTRL_SERIAL_ENAB		(1  << 24)
+#define CC_CHIPCTRL_JTAG_SEL			(1  << 3)
+#define CC_CHIPCTRL_GPIO_SEL				(0x3)
+#define CC_PLL_CHIPCTRL_SERIAL_ENAB_4334	(1  << 28)
+
+static int
+dhd_serialconsole(dhd_bus_t *bus, bool set, bool enable, int *bcmerror)
+{
+	int int_val;
+	uint32 addr, data, uart_enab = 0;
+	uint32 jtag_sel = CC_CHIPCTRL_JTAG_SEL;
+	uint32 gpio_sel = CC_CHIPCTRL_GPIO_SEL;
+
+	addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_addr);
+	data = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol_data);
+	*bcmerror = 0;
+
+	bcmsdh_reg_write(bus->sdh, addr, 4, 1);
+	if (bcmsdh_regfail(bus->sdh)) {
+		*bcmerror = BCME_SDIO_ERROR;
+		return -1;
+	}
+	int_val = bcmsdh_reg_read(bus->sdh, data, 4);
+	if (bcmsdh_regfail(bus->sdh)) {
+		*bcmerror = BCME_SDIO_ERROR;
+		return -1;
+	}
+	if (bus->sih->chip == BCM4330_CHIP_ID) {
+		uart_enab = CC_PLL_CHIPCTRL_SERIAL_ENAB;
+	}
+	else if (bus->sih->chip == BCM4334_CHIP_ID ||
+		bus->sih->chip == BCM43340_CHIP_ID ||
+		bus->sih->chip == BCM43341_CHIP_ID ||
+		bus->sih->chip == BCM43342_CHIP_ID ||
+		0) {
+		if (enable) {
+			/* Moved to PMU chipcontrol 1 from 4330 */
+			int_val &= ~gpio_sel;
+			int_val |= jtag_sel;
+		} else {
+			int_val |= gpio_sel;
+			int_val &= ~jtag_sel;
+		}
+		uart_enab = CC_PLL_CHIPCTRL_SERIAL_ENAB_4334;
+	}
+
+	if (!set)
+		return (int_val & uart_enab);
+	if (enable)
+		int_val |= uart_enab;
+	else
+		int_val &= ~uart_enab;
+	bcmsdh_reg_write(bus->sdh, data, 4, int_val);
+	if (bcmsdh_regfail(bus->sdh)) {
+		*bcmerror = BCME_SDIO_ERROR;
+		return -1;
+	}
+	if (bus->sih->chip == BCM4330_CHIP_ID) {
+		uint32 chipcontrol;
+		addr = SI_ENUM_BASE + OFFSETOF(chipcregs_t, chipcontrol);
+		chipcontrol = bcmsdh_reg_read(bus->sdh, addr, 4);
+		chipcontrol &= ~jtag_sel;
+		if (enable) {
+			chipcontrol |=  jtag_sel;
+			chipcontrol &= ~gpio_sel;
+		}
+		bcmsdh_reg_write(bus->sdh, addr, 4, chipcontrol);
+	}
+
+	return (int_val & uart_enab);
+}
+#endif
+
+static int
+dhdsdio_doiovar(dhd_bus_t *bus, const bcm_iovar_t *vi, uint32 actionid, const char *name,
+                void *params, int plen, void *arg, int len, int val_size)
+{
+	int bcmerror = 0;
+	int32 int_val = 0;
+	bool bool_val = 0;
+
+	DHD_TRACE(("%s: Enter, action %d name %s params %p plen %d arg %p len %d val_size %d\n",
+	           __FUNCTION__, actionid, name, params, plen, arg, len, val_size));
+
+	if ((bcmerror = bcm_iovar_lencheck(vi, arg, len, IOV_ISSET(actionid))) != 0)
+		goto exit;
+
+	if (plen >= (int)sizeof(int_val))
+		bcopy(params, &int_val, sizeof(int_val));
+
+	bool_val = (int_val != 0) ? TRUE : FALSE;
+
+
+	/* Some ioctls use the bus */
+	dhd_os_sdlock(bus->dhd);
+
+	/* Check if dongle is in reset. If so, only allow DEVRESET iovars */
+	if (bus->dhd->dongle_reset && !(actionid == IOV_SVAL(IOV_DEVRESET) ||
+	                                actionid == IOV_GVAL(IOV_DEVRESET))) {
+		bcmerror = BCME_NOTREADY;
+		goto exit;
+	}
+
+	/*
+	 * Special handling for keepSdioOn: New SDIO Wake-up Mechanism
+	 */
+	if ((vi->varid == IOV_KSO) && (IOV_ISSET(actionid))) {
+		dhdsdio_clk_kso_iovar(bus, bool_val);
+		goto exit;
+	} else if ((vi->varid == IOV_DEVSLEEP) && (IOV_ISSET(actionid))) {
+		{
+			dhdsdio_clk_devsleep_iovar(bus, bool_val);
+			if (!SLPAUTO_ENAB(bus) && (bool_val == FALSE) && (bus->ipend)) {
+				DHD_ERROR(("INT pending in devsleep 1, dpc_sched: %d\n",
+					bus->dpc_sched));
+				if (!bus->dpc_sched) {
+					bus->dpc_sched = TRUE;
+					dhd_sched_dpc(bus->dhd);
+				}
+			}
+		}
+		goto exit;
+	}
+
+	/* Handle sleep stuff before any clock mucking */
+	if (vi->varid == IOV_SLEEP) {
+		if (IOV_ISSET(actionid)) {
+			bcmerror = dhdsdio_bussleep(bus, bool_val);
+		} else {
+			int_val = (int32)bus->sleeping;
+			bcopy(&int_val, arg, val_size);
+		}
+		goto exit;
+	}
+
+	/* Request clock to allow SDIO accesses */
+	if (!bus->dhd->dongle_reset) {
+		BUS_WAKE(bus);
+		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+	}
+
+	switch (actionid) {
+	case IOV_GVAL(IOV_INTR):
+		int_val = (int32)bus->intr;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_INTR):
+		bus->intr = bool_val;
+		bus->intdis = FALSE;
+		if (bus->dhd->up) {
+			if (bus->intr) {
+				DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+				// terence 20141207: enbale intdis
+				bus->intdis = TRUE;
+				bcmsdh_intr_enable(bus->sdh);
+			} else {
+				DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+				bcmsdh_intr_disable(bus->sdh);
+			}
+		}
+		break;
+
+	case IOV_GVAL(IOV_POLLRATE):
+		int_val = (int32)bus->pollrate;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_POLLRATE):
+		bus->pollrate = (uint)int_val;
+		bus->poll = (bus->pollrate != 0);
+		break;
+
+	case IOV_GVAL(IOV_IDLETIME):
+		int_val = bus->idletime;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_IDLETIME):
+		if ((int_val < 0) && (int_val != DHD_IDLE_IMMEDIATE)) {
+			bcmerror = BCME_BADARG;
+		} else {
+			bus->idletime = int_val;
+		}
+		break;
+
+	case IOV_GVAL(IOV_IDLECLOCK):
+		int_val = (int32)bus->idleclock;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_IDLECLOCK):
+		bus->idleclock = int_val;
+		break;
+
+	case IOV_GVAL(IOV_SD1IDLE):
+		int_val = (int32)sd1idle;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_SD1IDLE):
+		sd1idle = bool_val;
+		break;
+
+
+	case IOV_SVAL(IOV_MEMBYTES):
+	case IOV_GVAL(IOV_MEMBYTES):
+	{
+		uint32 address;
+		uint size, dsize;
+		uint8 *data;
+
+		bool set = (actionid == IOV_SVAL(IOV_MEMBYTES));
+
+		ASSERT(plen >= 2*sizeof(int));
+
+		address = (uint32)int_val;
+		bcopy((char *)params + sizeof(int_val), &int_val, sizeof(int_val));
+		size = (uint)int_val;
+
+		/* Do some validation */
+		dsize = set ? plen - (2 * sizeof(int)) : len;
+		if (dsize < size) {
+			DHD_ERROR(("%s: error on %s membytes, addr 0x%08x size %d dsize %d\n",
+			           __FUNCTION__, (set ? "set" : "get"), address, size, dsize));
+			bcmerror = BCME_BADARG;
+			break;
+		}
+
+		DHD_INFO(("%s: Request to %s %d bytes at address 0x%08x\n", __FUNCTION__,
+		          (set ? "write" : "read"), size, address));
+
+		/* check if CR4 */
+		if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			/*
+			 * If address is start of RAM (i.e. a downloaded image),
+			 * store the reset instruction to be written in 0
+			 */
+			if (set && address == bus->dongle_ram_base) {
+				bus->resetinstr = *(((uint32*)params) + 2);
+			}
+		} else {
+		/* If we know about SOCRAM, check for a fit */
+		if ((bus->orig_ramsize) &&
+		    ((address > bus->orig_ramsize) || (address + size > bus->orig_ramsize)))
+		{
+			uint8 enable, protect, remap;
+			si_socdevram(bus->sih, FALSE, &enable, &protect, &remap);
+			if (!enable || protect) {
+				DHD_ERROR(("%s: ramsize 0x%08x doesn't have %d bytes at 0x%08x\n",
+					__FUNCTION__, bus->orig_ramsize, size, address));
+				DHD_ERROR(("%s: socram enable %d, protect %d\n",
+					__FUNCTION__, enable, protect));
+				bcmerror = BCME_BADARG;
+				break;
+			}
+
+			if (!REMAP_ENAB(bus) && (address >= SOCDEVRAM_ARM_ADDR)) {
+				uint32 devramsize = si_socdevram_size(bus->sih);
+				if ((address < SOCDEVRAM_ARM_ADDR) ||
+					(address + size > (SOCDEVRAM_ARM_ADDR + devramsize))) {
+					DHD_ERROR(("%s: bad address 0x%08x, size 0x%08x\n",
+						__FUNCTION__, address, size));
+					DHD_ERROR(("%s: socram range 0x%08x,size 0x%08x\n",
+						__FUNCTION__, SOCDEVRAM_ARM_ADDR, devramsize));
+					bcmerror = BCME_BADARG;
+					break;
+				}
+				/* move it such that address is real now */
+				address -= SOCDEVRAM_ARM_ADDR;
+				address += SOCDEVRAM_BP_ADDR;
+				DHD_INFO(("%s: Request to %s %d bytes @ Mapped address 0x%08x\n",
+					__FUNCTION__, (set ? "write" : "read"), size, address));
+			} else if (REMAP_ENAB(bus) && REMAP_ISADDR(bus, address) && remap) {
+				/* Can not access remap region while devram remap bit is set
+				 * ROM content would be returned in this case
+				 */
+				DHD_ERROR(("%s: Need to disable remap for address 0x%08x\n",
+					__FUNCTION__, address));
+				bcmerror = BCME_ERROR;
+				break;
+			}
+		}
+		}
+
+		/* Generate the actual data pointer */
+		data = set ? (uint8*)params + 2 * sizeof(int): (uint8*)arg;
+
+		/* Call to do the transfer */
+		bcmerror = dhdsdio_membytes(bus, set, address, data, size);
+
+		break;
+	}
+
+	case IOV_GVAL(IOV_RAMSIZE):
+		int_val = (int32)bus->ramsize;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_RAMSTART):
+		int_val = (int32)bus->dongle_ram_base;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_SDIOD_DRIVE):
+		int_val = (int32)dhd_sdiod_drive_strength;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_SDIOD_DRIVE):
+		dhd_sdiod_drive_strength = int_val;
+		si_sdiod_drive_strength_init(bus->sih, bus->dhd->osh, dhd_sdiod_drive_strength);
+		break;
+
+	case IOV_SVAL(IOV_SET_DOWNLOAD_STATE):
+		bcmerror = dhdsdio_download_state(bus, bool_val);
+		break;
+
+	case IOV_SVAL(IOV_SOCRAM_STATE):
+		bcmerror = dhdsdio_download_state(bus, bool_val);
+		break;
+
+	case IOV_SVAL(IOV_VARS):
+		bcmerror = dhdsdio_downloadvars(bus, arg, len);
+		break;
+
+	case IOV_GVAL(IOV_READAHEAD):
+		int_val = (int32)dhd_readahead;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_READAHEAD):
+		if (bool_val && !dhd_readahead)
+			bus->nextlen = 0;
+		dhd_readahead = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_SDRXCHAIN):
+		int_val = (int32)bus->use_rxchain;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_SDRXCHAIN):
+		if (bool_val && !bus->sd_rxchain)
+			bcmerror = BCME_UNSUPPORTED;
+		else
+			bus->use_rxchain = bool_val;
+		break;
+	case IOV_GVAL(IOV_ALIGNCTL):
+		int_val = (int32)dhd_alignctl;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_ALIGNCTL):
+		dhd_alignctl = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_SDALIGN):
+		int_val = DHD_SDALIGN;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+#ifdef DHD_DEBUG
+	case IOV_GVAL(IOV_VARS):
+		if (bus->varsz < (uint)len)
+			bcopy(bus->vars, arg, bus->varsz);
+		else
+			bcmerror = BCME_BUFTOOSHORT;
+		break;
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+	case IOV_GVAL(IOV_SDREG):
+	{
+		sdreg_t *sd_ptr;
+		uint32 addr, size;
+
+		sd_ptr = (sdreg_t *)params;
+
+		addr = (uint32)((ulong)bus->regs + sd_ptr->offset);
+		size = sd_ptr->func;
+		int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+		if (bcmsdh_regfail(bus->sdh))
+			bcmerror = BCME_SDIO_ERROR;
+		bcopy(&int_val, arg, sizeof(int32));
+		break;
+	}
+
+	case IOV_SVAL(IOV_SDREG):
+	{
+		sdreg_t *sd_ptr;
+		uint32 addr, size;
+
+		sd_ptr = (sdreg_t *)params;
+
+		addr = (uint32)((ulong)bus->regs + sd_ptr->offset);
+		size = sd_ptr->func;
+		bcmsdh_reg_write(bus->sdh, addr, size, sd_ptr->value);
+		if (bcmsdh_regfail(bus->sdh))
+			bcmerror = BCME_SDIO_ERROR;
+		break;
+	}
+
+	/* Same as above, but offset is not backplane (not SDIO core) */
+	case IOV_GVAL(IOV_SBREG):
+	{
+		sdreg_t sdreg;
+		uint32 addr, size;
+
+		bcopy(params, &sdreg, sizeof(sdreg));
+
+		addr = SI_ENUM_BASE + sdreg.offset;
+		size = sdreg.func;
+		int_val = (int32)bcmsdh_reg_read(bus->sdh, addr, size);
+		if (bcmsdh_regfail(bus->sdh))
+			bcmerror = BCME_SDIO_ERROR;
+		bcopy(&int_val, arg, sizeof(int32));
+		break;
+	}
+
+	case IOV_SVAL(IOV_SBREG):
+	{
+		sdreg_t sdreg;
+		uint32 addr, size;
+
+		bcopy(params, &sdreg, sizeof(sdreg));
+
+		addr = SI_ENUM_BASE + sdreg.offset;
+		size = sdreg.func;
+		bcmsdh_reg_write(bus->sdh, addr, size, sdreg.value);
+		if (bcmsdh_regfail(bus->sdh))
+			bcmerror = BCME_SDIO_ERROR;
+		break;
+	}
+
+	case IOV_GVAL(IOV_SDCIS):
+	{
+		*(char *)arg = 0;
+
+		bcmstrcat(arg, "\nFunc 0\n");
+		bcmsdh_cis_read(bus->sdh, 0x10, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+		bcmstrcat(arg, "\nFunc 1\n");
+		bcmsdh_cis_read(bus->sdh, 0x11, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+		bcmstrcat(arg, "\nFunc 2\n");
+		bcmsdh_cis_read(bus->sdh, 0x12, (uint8 *)arg + strlen(arg), SBSDIO_CIS_SIZE_LIMIT);
+		break;
+	}
+
+	case IOV_GVAL(IOV_FORCEEVEN):
+		int_val = (int32)forcealign;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_FORCEEVEN):
+		forcealign = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_TXBOUND):
+		int_val = (int32)dhd_txbound;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_TXBOUND):
+		dhd_txbound = (uint)int_val;
+		break;
+
+	case IOV_GVAL(IOV_RXBOUND):
+		int_val = (int32)dhd_rxbound;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_RXBOUND):
+		dhd_rxbound = (uint)int_val;
+		break;
+
+	case IOV_GVAL(IOV_TXMINMAX):
+		int_val = (int32)dhd_txminmax;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_TXMINMAX):
+		dhd_txminmax = (uint)int_val;
+		break;
+
+	case IOV_GVAL(IOV_SERIALCONS):
+		int_val = dhd_serialconsole(bus, FALSE, 0, &bcmerror);
+		if (bcmerror != 0)
+			break;
+
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_SERIALCONS):
+		dhd_serialconsole(bus, TRUE, bool_val, &bcmerror);
+		break;
+
+
+#endif /* DHD_DEBUG */
+
+
+#ifdef SDTEST
+	case IOV_GVAL(IOV_EXTLOOP):
+		int_val = (int32)bus->ext_loop;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_EXTLOOP):
+		bus->ext_loop = bool_val;
+		break;
+
+	case IOV_GVAL(IOV_PKTGEN):
+		bcmerror = dhdsdio_pktgen_get(bus, arg);
+		break;
+
+	case IOV_SVAL(IOV_PKTGEN):
+		bcmerror = dhdsdio_pktgen_set(bus, arg);
+		break;
+#endif /* SDTEST */
+
+#if defined(USE_SDIOFIFO_IOVAR)
+	case IOV_GVAL(IOV_WATERMARK):
+		int_val = (int32)watermark;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_WATERMARK):
+		watermark = (uint)int_val;
+		watermark = (watermark > SBSDIO_WATERMARK_MASK) ? SBSDIO_WATERMARK_MASK : watermark;
+		DHD_ERROR(("Setting watermark as 0x%x.\n", watermark));
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK, (uint8)watermark, NULL);
+		break;
+
+	case IOV_GVAL(IOV_MESBUSYCTRL):
+		int_val = (int32)mesbusyctrl;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_MESBUSYCTRL):
+		mesbusyctrl = (uint)int_val;
+		mesbusyctrl = (mesbusyctrl > SBSDIO_MESBUSYCTRL_MASK)
+			? SBSDIO_MESBUSYCTRL_MASK : mesbusyctrl;
+		DHD_ERROR(("Setting mesbusyctrl as 0x%x.\n", mesbusyctrl));
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_MESBUSYCTRL,
+			((uint8)mesbusyctrl | 0x80), NULL);
+		break;
+#endif
+
+
+	case IOV_GVAL(IOV_DONGLEISOLATION):
+		int_val = bus->dhd->dongle_isolation;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DONGLEISOLATION):
+		bus->dhd->dongle_isolation = bool_val;
+		break;
+
+	case IOV_SVAL(IOV_DEVRESET):
+		DHD_TRACE(("%s: Called set IOV_DEVRESET=%d dongle_reset=%d busstate=%d\n",
+		           __FUNCTION__, bool_val, bus->dhd->dongle_reset,
+		           bus->dhd->busstate));
+
+		ASSERT(bus->dhd->osh);
+		/* ASSERT(bus->cl_devid); */
+
+		dhd_bus_devreset(bus->dhd, (uint8)bool_val);
+
+		break;
+	/*
+	 * softap firmware is updated through module parameter or android private command
+	 */
+
+	case IOV_GVAL(IOV_DEVRESET):
+		DHD_TRACE(("%s: Called get IOV_DEVRESET\n", __FUNCTION__));
+
+		/* Get its status */
+		int_val = (bool) bus->dhd->dongle_reset;
+		bcopy(&int_val, arg, val_size);
+
+		break;
+
+	case IOV_GVAL(IOV_KSO):
+		int_val = dhdsdio_sleepcsr_get(bus);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_DEVCAP):
+		int_val = dhdsdio_devcap_get(bus);
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_DEVCAP):
+		dhdsdio_devcap_set(bus, (uint8) int_val);
+		break;
+	case IOV_GVAL(IOV_TXGLOMSIZE):
+		int_val = (int32)bus->txglomsize;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_SVAL(IOV_TXGLOMSIZE):
+		if (int_val > SDPCM_MAXGLOM_SIZE) {
+			bcmerror = BCME_ERROR;
+		} else {
+			bus->txglomsize = (uint)int_val;
+		}
+		break;
+	case IOV_SVAL(IOV_HANGREPORT):
+		bus->dhd->hang_report = bool_val;
+		DHD_ERROR(("%s: Set hang_report as %d\n", __FUNCTION__, bus->dhd->hang_report));
+		break;
+
+	case IOV_GVAL(IOV_HANGREPORT):
+		int_val = (int32)bus->dhd->hang_report;
+		bcopy(&int_val, arg, val_size);
+		break;
+
+	case IOV_GVAL(IOV_TXINRX_THRES):
+		int_val = bus->txinrx_thres;
+		bcopy(&int_val, arg, val_size);
+		break;
+	case IOV_SVAL(IOV_TXINRX_THRES):
+		if (int_val < 0) {
+			bcmerror = BCME_BADARG;
+		} else {
+			bus->txinrx_thres = int_val;
+		}
+		break;
+
+	default:
+		bcmerror = BCME_UNSUPPORTED;
+		break;
+	}
+
+exit:
+	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+		bus->activity = FALSE;
+		dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+	}
+
+	dhd_os_sdunlock(bus->dhd);
+
+	return bcmerror;
+}
+
+static int
+dhdsdio_write_vars(dhd_bus_t *bus)
+{
+	int bcmerror = 0;
+	uint32 varsize, phys_size;
+	uint32 varaddr;
+	uint8 *vbuffer;
+	uint32 varsizew;
+#ifdef DHD_DEBUG
+	uint8 *nvram_ularray;
+#endif /* DHD_DEBUG */
+
+	/* Even if there are no vars are to be written, we still need to set the ramsize. */
+	varsize = bus->varsz ? ROUNDUP(bus->varsz, 4) : 0;
+	varaddr = (bus->ramsize - 4) - varsize;
+
+	// terence 20150412: fix for nvram failed to download
+	if (bus->dhd->conf->chip == BCM43340_CHIP_ID ||
+			bus->dhd->conf->chip == BCM43341_CHIP_ID) {
+		varsize = varsize ? ROUNDUP(varsize, 64) : 0;
+		varaddr = (bus->ramsize - 64) - varsize;
+	}
+
+	varaddr += bus->dongle_ram_base;
+
+	if (bus->vars) {
+		if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 7)) {
+			if (((varaddr & 0x3C) == 0x3C) && (varsize > 4)) {
+				DHD_ERROR(("PR85623WAR in place\n"));
+				varsize += 4;
+				varaddr -= 4;
+			}
+		}
+
+		vbuffer = (uint8 *)MALLOC(bus->dhd->osh, varsize);
+		if (!vbuffer)
+			return BCME_NOMEM;
+
+		bzero(vbuffer, varsize);
+		bcopy(bus->vars, vbuffer, bus->varsz);
+
+		/* Write the vars list */
+		bcmerror = dhdsdio_membytes(bus, TRUE, varaddr, vbuffer, varsize);
+#ifdef DHD_DEBUG
+		/* Verify NVRAM bytes */
+		DHD_INFO(("Compare NVRAM dl & ul; varsize=%d\n", varsize));
+		nvram_ularray = (uint8*)MALLOC(bus->dhd->osh, varsize);
+		if (!nvram_ularray)
+			return BCME_NOMEM;
+
+		/* Upload image to verify downloaded contents. */
+		memset(nvram_ularray, 0xaa, varsize);
+
+		/* Read the vars list to temp buffer for comparison */
+		bcmerror = dhdsdio_membytes(bus, FALSE, varaddr, nvram_ularray, varsize);
+		if (bcmerror) {
+				DHD_ERROR(("%s: error %d on reading %d nvram bytes at 0x%08x\n",
+					__FUNCTION__, bcmerror, varsize, varaddr));
+		}
+		/* Compare the org NVRAM with the one read from RAM */
+		if (memcmp(vbuffer, nvram_ularray, varsize)) {
+			DHD_ERROR(("%s: Downloaded NVRAM image is corrupted.\n", __FUNCTION__));
+		} else
+			DHD_ERROR(("%s: Download, Upload and compare of NVRAM succeeded.\n",
+			__FUNCTION__));
+
+		MFREE(bus->dhd->osh, nvram_ularray, varsize);
+#endif /* DHD_DEBUG */
+
+		MFREE(bus->dhd->osh, vbuffer, varsize);
+	}
+
+	phys_size = REMAP_ENAB(bus) ? bus->ramsize : bus->orig_ramsize;
+
+	phys_size += bus->dongle_ram_base;
+
+	/* adjust to the user specified RAM */
+	DHD_INFO(("Physical memory size: %d, usable memory size: %d\n",
+		phys_size, bus->ramsize));
+	DHD_INFO(("Vars are at %d, orig varsize is %d\n",
+		varaddr, varsize));
+	varsize = ((phys_size - 4) - varaddr);
+
+	/*
+	 * Determine the length token:
+	 * Varsize, converted to words, in lower 16-bits, checksum in upper 16-bits.
+	 */
+	if (bcmerror) {
+		varsizew = 0;
+	} else {
+		varsizew = varsize / 4;
+		varsizew = (~varsizew << 16) | (varsizew & 0x0000FFFF);
+		varsizew = htol32(varsizew);
+	}
+
+	DHD_INFO(("New varsize is %d, length token=0x%08x\n", varsize, varsizew));
+
+	/* Write the length token to the last word */
+	bcmerror = dhdsdio_membytes(bus, TRUE, (phys_size - 4),
+		(uint8*)&varsizew, 4);
+
+	return bcmerror;
+}
+
+static int
+dhdsdio_download_state(dhd_bus_t *bus, bool enter)
+{
+	uint retries;
+	int bcmerror = 0;
+	int foundcr4 = 0;
+
+	if (!bus->sih)
+		return BCME_ERROR;
+	/* To enter download state, disable ARM and reset SOCRAM.
+	 * To exit download state, simply reset ARM (default is RAM boot).
+	 */
+	if (enter) {
+		bus->alp_only = TRUE;
+
+		if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+		    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+			if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+				foundcr4 = 1;
+			} else {
+				DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+		}
+
+		if (!foundcr4) {
+			si_core_disable(bus->sih, 0);
+			if (bcmsdh_regfail(bus->sdh)) {
+				bcmerror = BCME_SDIO_ERROR;
+				goto fail;
+			}
+
+			if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+			si_core_reset(bus->sih, 0, 0);
+			if (bcmsdh_regfail(bus->sdh)) {
+				DHD_ERROR(("%s: Failure trying reset SOCRAM core?\n",
+				           __FUNCTION__));
+				bcmerror = BCME_SDIO_ERROR;
+				goto fail;
+			}
+
+			/* Disable remap for download */
+			if (REMAP_ENAB(bus) && si_socdevram_remap_isenb(bus->sih))
+				dhdsdio_devram_remap(bus, FALSE);
+
+			if (CHIPID(bus->sih->chip) == BCM43430_CHIP_ID) {
+				/* Disabling Remap for SRAM_3 */
+				si_socram_set_bankpda(bus->sih, 0x3, 0x0);
+			}
+
+			/* Clear the top bit of memory */
+			if (bus->ramsize) {
+				uint32 zeros = 0;
+				if (dhdsdio_membytes(bus, TRUE, bus->ramsize - 4,
+				                     (uint8*)&zeros, 4) < 0) {
+					bcmerror = BCME_SDIO_ERROR;
+					goto fail;
+				}
+			}
+		} else {
+			/* For CR4,
+			 * Halt ARM
+			 * Remove ARM reset
+			 * Read RAM base address [0x18_0000]
+			 * [next] Download firmware
+			 * [done at else] Populate the reset vector
+			 * [done at else] Remove ARM halt
+			*/
+			/* Halt ARM & remove reset */
+			si_core_reset(bus->sih, SICF_CPUHALT, SICF_CPUHALT);
+		}
+	} else {
+		if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			if (!(si_setcore(bus->sih, SOCRAM_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find SOCRAM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+			if (!si_iscoreup(bus->sih)) {
+				DHD_ERROR(("%s: SOCRAM core is down after reset?\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+
+			if ((bcmerror = dhdsdio_write_vars(bus))) {
+				DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+				goto fail;
+			}
+
+			/* Enable remap before ARM reset but after vars.
+			 * No backplane access in remap mode
+			 */
+			if (REMAP_ENAB(bus) && !si_socdevram_remap_isenb(bus->sih))
+				dhdsdio_devram_remap(bus, TRUE);
+
+			if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+			    !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+				DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+			W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+
+			if (!(si_setcore(bus->sih, ARM7S_CORE_ID, 0)) &&
+			    !(si_setcore(bus->sih, ARMCM3_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find ARM core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+		} else {
+			/* cr4 has no socram, but tcm's */
+			/* write vars */
+			if ((bcmerror = dhdsdio_write_vars(bus))) {
+				DHD_ERROR(("%s: could not write vars to RAM\n", __FUNCTION__));
+				goto fail;
+			}
+
+			if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0) &&
+			    !si_setcore(bus->sih, SDIOD_CORE_ID, 0)) {
+				DHD_ERROR(("%s: Can't change back to SDIO core?\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+			W_SDREG(0xFFFFFFFF, &bus->regs->intstatus, retries);
+
+			/* switch back to arm core again */
+			if (!(si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+				DHD_ERROR(("%s: Failed to find ARM CR4 core!\n", __FUNCTION__));
+				bcmerror = BCME_ERROR;
+				goto fail;
+			}
+			/* write address 0 with reset instruction */
+			bcmerror = dhdsdio_membytes(bus, TRUE, 0,
+				(uint8 *)&bus->resetinstr, sizeof(bus->resetinstr));
+
+			/* now remove reset and halt and continue to run CR4 */
+		}
+
+		si_core_reset(bus->sih, 0, 0);
+		if (bcmsdh_regfail(bus->sdh)) {
+			DHD_ERROR(("%s: Failure trying to reset ARM core?\n", __FUNCTION__));
+			bcmerror = BCME_SDIO_ERROR;
+			goto fail;
+		}
+
+		/* Allow HT Clock now that the ARM is running. */
+		bus->alp_only = FALSE;
+
+		bus->dhd->busstate = DHD_BUS_LOAD;
+	}
+
+fail:
+	/* Always return to SDIOD core */
+	if (!si_setcore(bus->sih, PCMCIA_CORE_ID, 0))
+		si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+
+	return bcmerror;
+}
+
+int
+dhd_bus_iovar_op(dhd_pub_t *dhdp, const char *name,
+                 void *params, int plen, void *arg, int len, bool set)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	const bcm_iovar_t *vi = NULL;
+	int bcmerror = 0;
+	int val_size;
+	uint32 actionid;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(name);
+	ASSERT(len >= 0);
+
+	/* Get MUST have return space */
+	ASSERT(set || (arg && len));
+
+	/* Set does NOT take qualifiers */
+	ASSERT(!set || (!params && !plen));
+
+	/* Look up var locally; if not found pass to host driver */
+	if ((vi = bcm_iovar_lookup(dhdsdio_iovars, name)) == NULL) {
+		dhd_os_sdlock(bus->dhd);
+
+		BUS_WAKE(bus);
+
+		/* Turn on clock in case SD command needs backplane */
+		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+		bcmerror = bcmsdh_iovar_op(bus->sdh, name, params, plen, arg, len, set);
+
+		/* Check for bus configuration changes of interest */
+
+		/* If it was divisor change, read the new one */
+		if (set && strcmp(name, "sd_divisor") == 0) {
+			if (bcmsdh_iovar_op(bus->sdh, "sd_divisor", NULL, 0,
+			                    &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+				bus->sd_divisor = -1;
+				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+			} else {
+				DHD_INFO(("%s: noted %s update, value now %d\n",
+				          __FUNCTION__, name, bus->sd_divisor));
+			}
+		}
+		/* If it was a mode change, read the new one */
+		if (set && strcmp(name, "sd_mode") == 0) {
+			if (bcmsdh_iovar_op(bus->sdh, "sd_mode", NULL, 0,
+			                    &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+				bus->sd_mode = -1;
+				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, name));
+			} else {
+				DHD_INFO(("%s: noted %s update, value now %d\n",
+				          __FUNCTION__, name, bus->sd_mode));
+			}
+		}
+		/* Similar check for blocksize change */
+		if (set && strcmp(name, "sd_blocksize") == 0) {
+			int32 fnum = 2;
+			if (bcmsdh_iovar_op(bus->sdh, "sd_blocksize", &fnum, sizeof(int32),
+			                    &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+				bus->blocksize = 0;
+				DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+			} else {
+				DHD_INFO(("%s: noted %s update, value now %d\n",
+				          __FUNCTION__, "sd_blocksize", bus->blocksize));
+
+				dhdsdio_tune_fifoparam(bus);
+			}
+		}
+		bus->roundup = MIN(max_roundup, bus->blocksize);
+
+		if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+			bus->activity = FALSE;
+			dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+		}
+
+		dhd_os_sdunlock(bus->dhd);
+		goto exit;
+	}
+
+	DHD_CTL(("%s: %s %s, len %d plen %d\n", __FUNCTION__,
+	         name, (set ? "set" : "get"), len, plen));
+
+	/* set up 'params' pointer in case this is a set command so that
+	 * the convenience int and bool code can be common to set and get
+	 */
+	if (params == NULL) {
+		params = arg;
+		plen = len;
+	}
+
+	if (vi->type == IOVT_VOID)
+		val_size = 0;
+	else if (vi->type == IOVT_BUFFER)
+		val_size = len;
+	else
+		/* all other types are integer sized */
+		val_size = sizeof(int);
+
+	actionid = set ? IOV_SVAL(vi->varid) : IOV_GVAL(vi->varid);
+	bcmerror = dhdsdio_doiovar(bus, vi, actionid, name, params, plen, arg, len, val_size);
+
+exit:
+	return bcmerror;
+}
+
+void
+dhd_bus_stop(struct dhd_bus *bus, bool enforce_mutex)
+{
+	osl_t *osh;
+	uint32 local_hostintmask;
+	uint8 saveclk;
+	uint retries;
+	int err;
+	bool wlfc_enabled = FALSE;
+
+	if (!bus->dhd)
+		return;
+
+	osh = bus->dhd->osh;
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	bcmsdh_waitlockfree(bus->sdh);
+
+	if (enforce_mutex)
+		dhd_os_sdlock(bus->dhd);
+
+	if ((bus->dhd->busstate == DHD_BUS_DOWN) || bus->dhd->hang_was_sent) {
+		/* if Firmware already hangs disbale any interrupt */
+		bus->dhd->busstate = DHD_BUS_DOWN;
+		bus->hostintmask = 0;
+		bcmsdh_intr_disable(bus->sdh);
+	} else {
+
+		BUS_WAKE(bus);
+
+		/* Change our idea of bus state */
+		bus->dhd->busstate = DHD_BUS_DOWN;
+
+		if (KSO_ENAB(bus)) {
+
+		/* Enable clock for device interrupts */
+		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+		/* Disable and clear interrupts at the chip level also */
+		W_SDREG(0, &bus->regs->hostintmask, retries);
+		local_hostintmask = bus->hostintmask;
+		bus->hostintmask = 0;
+
+		/* Force clocks on backplane to be sure F2 interrupt propagates */
+		saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+		if (!err) {
+			bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+			                 (saveclk | SBSDIO_FORCE_HT), &err);
+		}
+		if (err) {
+			DHD_ERROR(("%s: Failed to force clock for F2: err %d\n",
+			            __FUNCTION__, err));
+		}
+
+		/* Turn off the bus (F2), free any pending packets */
+		DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+		bcmsdh_intr_disable(bus->sdh);
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+
+		/* Clear any pending interrupts now that F2 is disabled */
+		W_SDREG(local_hostintmask, &bus->regs->intstatus, retries);
+		}
+
+		/* Turn off the backplane clock (only) */
+		dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+	}
+
+#ifdef PROP_TXSTATUS
+	wlfc_enabled = (dhd_wlfc_cleanup_txq(bus->dhd, NULL, 0) != WLFC_UNSUPPORTED);
+#endif
+	if (!wlfc_enabled) {
+#ifdef DHDTCPACK_SUPPRESS
+		/* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+		 * when there is a newly coming packet from network stack.
+		 */
+		dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+		/* Clear the data packet queues */
+		pktq_flush(osh, &bus->txq, TRUE, NULL, 0);
+	}
+
+	/* Clear any held glomming stuff */
+	if (bus->glomd)
+		PKTFREE(osh, bus->glomd, FALSE);
+
+	if (bus->glom)
+		PKTFREE(osh, bus->glom, FALSE);
+
+	bus->glom = bus->glomd = NULL;
+
+	/* Clear rx control and wake any waiters */
+	bus->rxlen = 0;
+	dhd_os_ioctl_resp_wake(bus->dhd);
+
+	/* Reset some F2 state stuff */
+	bus->rxskip = FALSE;
+	bus->tx_seq = bus->rx_seq = 0;
+
+	bus->tx_max = 4;
+
+	if (enforce_mutex)
+		dhd_os_sdunlock(bus->dhd);
+}
+
+#if defined(BCMSDIOH_TXGLOM) && defined(BCMSDIOH_STD)
+extern uint sd_txglom;
+#endif
+void
+dhd_txglom_enable(dhd_pub_t *dhdp, bool enable)
+{
+	/* can't enable host txglom by default, some platforms have no
+	 * (or crappy) ADMA support and txglom will cause kernel assertions (e.g.
+	 * panda board)
+	 */
+	dhd_bus_t *bus = dhdp->bus;
+#ifdef BCMSDIOH_TXGLOM
+	char buf[256];
+	uint32 rxglom;
+	int32 ret;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#ifdef BCMSDIOH_STD
+	if (enable)
+		enable = sd_txglom;
+#endif /* BCMSDIOH_STD */
+
+	if (enable) {
+		rxglom = 1;
+		memset(buf, 0, sizeof(buf));
+		bcm_mkiovar("bus:rxglom", (void *)&rxglom, 4, buf, sizeof(buf));
+		ret = dhd_wl_ioctl_cmd(dhdp, WLC_SET_VAR, buf, sizeof(buf), TRUE, 0);
+		if (ret >= 0)
+			bus->txglom_enable = TRUE;
+		else {
+#ifdef BCMSDIOH_STD
+			sd_txglom = 0;
+#endif /* BCMSDIOH_STD */
+			bus->txglom_enable = FALSE;
+		}
+	} else
+#endif /* BCMSDIOH_TXGLOM */
+		bus->txglom_enable = FALSE;
+	printf("%s: enable %d\n",  __FUNCTION__, bus->txglom_enable);
+}
+
+int
+dhd_bus_init(dhd_pub_t *dhdp, bool enforce_mutex)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	dhd_timeout_t tmo;
+	uint retries = 0;
+	uint8 ready, enable;
+	int err, ret = 0;
+	uint8 saveclk;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	ASSERT(bus->dhd);
+	if (!bus->dhd)
+		return 0;
+
+	if (enforce_mutex)
+		dhd_os_sdlock(bus->dhd);
+
+	if (bus->sih->chip == BCM43362_CHIP_ID) {
+		printf("%s: delay 100ms for BCM43362\n", __FUNCTION__);
+		OSL_DELAY(100000); // terence 20131209: delay for 43362
+	}
+
+	/* Make sure backplane clock is on, needed to generate F2 interrupt */
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+	if (bus->clkstate != CLK_AVAIL) {
+		DHD_ERROR(("%s: clock state is wrong. state = %d\n", __FUNCTION__, bus->clkstate));
+		ret = -1;
+		goto exit;
+	}
+
+
+	/* Force clocks on backplane to be sure F2 interrupt propagates */
+	saveclk = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+	if (!err) {
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+		                 (saveclk | SBSDIO_FORCE_HT), &err);
+	}
+	if (err) {
+		DHD_ERROR(("%s: Failed to force clock for F2: err %d\n", __FUNCTION__, err));
+		ret = -1;
+		goto exit;
+	}
+
+	/* Enable function 2 (frame transfers) */
+	W_SDREG((SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT),
+	        &bus->regs->tosbmailboxdata, retries);
+	enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
+
+	bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+
+	/* Give the dongle some time to do its thing and set IOR2 */
+	dhd_timeout_start(&tmo, DHD_WAIT_F2RDY * 1000);
+
+	ready = 0;
+	while (ready != enable && !dhd_timeout_expired(&tmo))
+	        ready = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IORDY, NULL);
+
+	DHD_ERROR(("%s: enable 0x%02x, ready 0x%02x (waited %uus)\n",
+	          __FUNCTION__, enable, ready, tmo.elapsed));
+
+
+	/* If F2 successfully enabled, set core and enable interrupts */
+	if (ready == enable) {
+		/* Make sure we're talking to the core. */
+		if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)))
+			bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0);
+		ASSERT(bus->regs != NULL);
+
+		/* Set up the interrupt mask and enable interrupts */
+		bus->hostintmask = HOSTINTMASK;
+		/* corerev 4 could use the newer interrupt logic to detect the frames */
+		if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev == 4) &&
+			(bus->rxint_mode != SDIO_DEVICE_HMB_RXINT)) {
+			bus->hostintmask &= ~I_HMB_FRAME_IND;
+			bus->hostintmask |= I_XMTDATA_AVAIL;
+		}
+		W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+
+		if (bus->sih->buscorerev < 15) {
+			bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1, SBSDIO_WATERMARK,
+				(uint8)watermark, &err);
+		}
+
+		/* Set bus state according to enable result */
+		dhdp->busstate = DHD_BUS_DATA;
+
+		/* bcmsdh_intr_unmask(bus->sdh); */
+
+		bus->intdis = FALSE;
+		if (bus->intr) {
+			DHD_INTR(("%s: enable SDIO device interrupts\n", __FUNCTION__));
+			bcmsdh_intr_enable(bus->sdh);
+		} else {
+			DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+			bcmsdh_intr_disable(bus->sdh);
+		}
+
+	}
+
+
+	else {
+		/* Disable F2 again */
+		enable = SDIO_FUNC_ENABLE_1;
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, enable, NULL);
+	}
+
+	if (dhdsdio_sr_cap(bus)) {
+		dhdsdio_sr_init(bus);
+		/* Masking the chip active interrupt  permanantly */
+		bus->hostintmask &= ~I_CHIPACTIVE;
+		W_SDREG(bus->hostintmask, &bus->regs->hostintmask, retries);
+		DHD_INFO(("%s: disable I_CHIPACTIVE in hostintmask[0x%08x]\n",
+		__FUNCTION__, bus->hostintmask));
+	}
+	else
+		bcmsdh_cfg_write(bus->sdh, SDIO_FUNC_1,
+			SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
+
+	/* If we didn't come up, turn off backplane clock */
+	if (dhdp->busstate != DHD_BUS_DATA)
+		dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+exit:
+	if (enforce_mutex)
+		dhd_os_sdunlock(bus->dhd);
+
+	return ret;
+}
+
+static void
+dhdsdio_rxfail(dhd_bus_t *bus, bool abort, bool rtx)
+{
+	bcmsdh_info_t *sdh = bus->sdh;
+	sdpcmd_regs_t *regs = bus->regs;
+	uint retries = 0;
+	uint16 lastrbc;
+	uint8 hi, lo;
+	int err;
+
+	DHD_ERROR(("%s: %sterminate frame%s\n", __FUNCTION__,
+	           (abort ? "abort command, " : ""), (rtx ? ", send NAK" : "")));
+
+	if (!KSO_ENAB(bus)) {
+		DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+		return;
+	}
+
+	if (abort) {
+		bcmsdh_abort(sdh, SDIO_FUNC_2);
+	}
+
+	bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM, &err);
+	if (err) {
+		DHD_ERROR(("%s: SBSDIO_FUNC1_FRAMECTRL cmd err\n", __FUNCTION__));
+		goto fail;
+	}
+	bus->f1regdata++;
+
+	/* Wait until the packet has been flushed (device/FIFO stable) */
+	for (lastrbc = retries = 0xffff; retries > 0; retries--) {
+		hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCHI, NULL);
+		lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_RFRAMEBCLO, &err);
+		if (err) {
+			DHD_ERROR(("%s: SBSDIO_FUNC1_RFAMEBCLO cmd err\n", __FUNCTION__));
+			goto fail;
+		}
+
+		bus->f1regdata += 2;
+
+		if ((hi == 0) && (lo == 0))
+			break;
+
+		if ((hi > (lastrbc >> 8)) && (lo > (lastrbc & 0x00ff))) {
+			DHD_ERROR(("%s: count growing: last 0x%04x now 0x%04x\n",
+			           __FUNCTION__, lastrbc, ((hi << 8) + lo)));
+		}
+		lastrbc = (hi << 8) + lo;
+	}
+
+	if (!retries) {
+		DHD_ERROR(("%s: count never zeroed: last 0x%04x\n", __FUNCTION__, lastrbc));
+	} else {
+		DHD_INFO(("%s: flush took %d iterations\n", __FUNCTION__, (0xffff - retries)));
+	}
+
+	if (rtx) {
+		bus->rxrtx++;
+		W_SDREG(SMB_NAK, &regs->tosbmailbox, retries);
+		bus->f1regdata++;
+		if (retries <= retry_limit) {
+			bus->rxskip = TRUE;
+		}
+	}
+
+	/* Clear partial in any case */
+	bus->nextlen = 0;
+
+fail:
+	/* If we can't reach the device, signal failure */
+	if (err || bcmsdh_regfail(sdh))
+		bus->dhd->busstate = DHD_BUS_DOWN;
+}
+
+static void
+dhdsdio_read_control(dhd_bus_t *bus, uint8 *hdr, uint len, uint doff)
+{
+	bcmsdh_info_t *sdh = bus->sdh;
+	uint rdlen, pad;
+
+	int sdret;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Control data already received in aligned rxctl */
+	if ((bus->bus == SPI_BUS) && (!bus->usebufpool))
+		goto gotpkt;
+
+	ASSERT(bus->rxbuf);
+	/* Set rxctl for frame (w/optional alignment) */
+	bus->rxctl = bus->rxbuf;
+	if (dhd_alignctl) {
+		bus->rxctl += firstread;
+		if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+			bus->rxctl += (DHD_SDALIGN - pad);
+		bus->rxctl -= firstread;
+	}
+	ASSERT(bus->rxctl >= bus->rxbuf);
+
+	/* Copy the already-read portion over */
+	bcopy(hdr, bus->rxctl, firstread);
+	if (len <= firstread)
+		goto gotpkt;
+
+	/* Copy the full data pkt in gSPI case and process ioctl. */
+	if (bus->bus == SPI_BUS) {
+		bcopy(hdr, bus->rxctl, len);
+		goto gotpkt;
+	}
+
+	/* Raise rdlen to next SDIO block to avoid tail command */
+	rdlen = len - firstread;
+	if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+		pad = bus->blocksize - (rdlen % bus->blocksize);
+		if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+		    ((len + pad) < bus->dhd->maxctl))
+			rdlen += pad;
+	} else if (rdlen % DHD_SDALIGN) {
+		rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+	}
+
+	/* Satisfy length-alignment requirements */
+	if (forcealign && (rdlen & (ALIGNMENT - 1)))
+		rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+	/* Drop if the read is too big or it exceeds our maximum */
+	if ((rdlen + firstread) > bus->dhd->maxctl) {
+		DHD_ERROR(("%s: %d-byte control read exceeds %d-byte buffer\n",
+		           __FUNCTION__, rdlen, bus->dhd->maxctl));
+		bus->dhd->rx_errors++;
+		dhdsdio_rxfail(bus, FALSE, FALSE);
+		goto done;
+	}
+
+	if ((len - doff) > bus->dhd->maxctl) {
+		DHD_ERROR(("%s: %d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
+		           __FUNCTION__, len, (len - doff), bus->dhd->maxctl));
+		bus->dhd->rx_errors++; bus->rx_toolong++;
+		dhdsdio_rxfail(bus, FALSE, FALSE);
+		goto done;
+	}
+
+
+	/* Read remainder of frame body into the rxctl buffer */
+	sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+	                            (bus->rxctl + firstread), rdlen, NULL, NULL, NULL);
+	bus->f2rxdata++;
+	ASSERT(sdret != BCME_PENDING);
+
+	/* Control frame failures need retransmission */
+	if (sdret < 0) {
+		DHD_ERROR(("%s: read %d control bytes failed: %d\n", __FUNCTION__, rdlen, sdret));
+		bus->rxc_errors++; /* dhd.rx_ctlerrs is higher level */
+		dhdsdio_rxfail(bus, TRUE, TRUE);
+		goto done;
+	}
+
+gotpkt:
+
+#ifdef DHD_DEBUG
+	if (DHD_BYTES_ON() && DHD_CTL_ON()) {
+		prhex("RxCtrl", bus->rxctl, len);
+	}
+#endif
+
+	/* Point to valid data and indicate its length */
+	bus->rxctl += doff;
+	bus->rxlen = len - doff;
+
+done:
+	/* Awake any waiters */
+	dhd_os_ioctl_resp_wake(bus->dhd);
+}
+int
+dhd_process_pkt_reorder_info(dhd_pub_t *dhd, uchar *reorder_info_buf, uint reorder_info_len,
+	void **pkt, uint32 *pkt_count);
+
+static uint8
+dhdsdio_rxglom(dhd_bus_t *bus, uint8 rxseq)
+{
+	uint16 dlen, totlen;
+	uint8 *dptr, num = 0;
+
+	uint16 sublen, check;
+	void *pfirst, *plast, *pnext;
+	void * list_tail[DHD_MAX_IFS] = { NULL };
+	void * list_head[DHD_MAX_IFS] = { NULL };
+	uint8 idx;
+	osl_t *osh = bus->dhd->osh;
+
+	int errcode;
+	uint8 chan, seq, doff, sfdoff;
+	uint8 txmax;
+	uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+	uint reorder_info_len;
+
+	int ifidx = 0;
+	bool usechain = bus->use_rxchain;
+
+	/* If packets, issue read(s) and send up packet chain */
+	/* Return sequence numbers consumed? */
+
+	DHD_TRACE(("dhdsdio_rxglom: start: glomd %p glom %p\n", bus->glomd, bus->glom));
+
+	/* If there's a descriptor, generate the packet chain */
+	if (bus->glomd) {
+		dhd_os_sdlock_rxq(bus->dhd);
+
+		pfirst = plast = pnext = NULL;
+		dlen = (uint16)PKTLEN(osh, bus->glomd);
+		dptr = PKTDATA(osh, bus->glomd);
+		if (!dlen || (dlen & 1)) {
+			DHD_ERROR(("%s: bad glomd len (%d), ignore descriptor\n",
+			           __FUNCTION__, dlen));
+			dlen = 0;
+		}
+
+		for (totlen = num = 0; dlen; num++) {
+			/* Get (and move past) next length */
+			sublen = ltoh16_ua(dptr);
+			dlen -= sizeof(uint16);
+			dptr += sizeof(uint16);
+			if ((sublen < SDPCM_HDRLEN) ||
+			    ((num == 0) && (sublen < (2 * SDPCM_HDRLEN)))) {
+				DHD_ERROR(("%s: descriptor len %d bad: %d\n",
+				           __FUNCTION__, num, sublen));
+				pnext = NULL;
+				break;
+			}
+			if (sublen % DHD_SDALIGN) {
+				DHD_ERROR(("%s: sublen %d not a multiple of %d\n",
+				           __FUNCTION__, sublen, DHD_SDALIGN));
+				usechain = FALSE;
+			}
+			totlen += sublen;
+
+			/* For last frame, adjust read len so total is a block multiple */
+			if (!dlen) {
+				sublen += (ROUNDUP(totlen, bus->blocksize) - totlen);
+				totlen = ROUNDUP(totlen, bus->blocksize);
+			}
+
+			/* Allocate/chain packet for next subframe */
+			if ((pnext = PKTGET(osh, sublen + DHD_SDALIGN, FALSE)) == NULL) {
+				DHD_ERROR(("%s: PKTGET failed, num %d len %d\n",
+				           __FUNCTION__, num, sublen));
+				break;
+			}
+			ASSERT(!PKTLINK(pnext));
+			if (!pfirst) {
+				ASSERT(!plast);
+				pfirst = plast = pnext;
+			} else {
+				ASSERT(plast);
+				PKTSETNEXT(osh, plast, pnext);
+				plast = pnext;
+			}
+
+			/* Adhere to start alignment requirements */
+			PKTALIGN(osh, pnext, sublen, DHD_SDALIGN);
+		}
+
+		/* If all allocations succeeded, save packet chain in bus structure */
+		if (pnext) {
+			DHD_GLOM(("%s: allocated %d-byte packet chain for %d subframes\n",
+			          __FUNCTION__, totlen, num));
+			if (DHD_GLOM_ON() && bus->nextlen) {
+				if (totlen != bus->nextlen) {
+					DHD_GLOM(("%s: glomdesc mismatch: nextlen %d glomdesc %d "
+					          "rxseq %d\n", __FUNCTION__, bus->nextlen,
+					          totlen, rxseq));
+				}
+			}
+			bus->glom = pfirst;
+			pfirst = pnext = NULL;
+		} else {
+			if (pfirst)
+				PKTFREE(osh, pfirst, FALSE);
+			bus->glom = NULL;
+			num = 0;
+		}
+
+		/* Done with descriptor packet */
+		PKTFREE(osh, bus->glomd, FALSE);
+		bus->glomd = NULL;
+		bus->nextlen = 0;
+
+		dhd_os_sdunlock_rxq(bus->dhd);
+	}
+
+	/* Ok -- either we just generated a packet chain, or had one from before */
+	if (bus->glom) {
+		if (DHD_GLOM_ON()) {
+			DHD_GLOM(("%s: attempt superframe read, packet chain:\n", __FUNCTION__));
+			for (pnext = bus->glom; pnext; pnext = PKTNEXT(osh, pnext)) {
+				DHD_GLOM(("    %p: %p len 0x%04x (%d)\n",
+				          pnext, (uint8*)PKTDATA(osh, pnext),
+				          PKTLEN(osh, pnext), PKTLEN(osh, pnext)));
+			}
+		}
+
+		pfirst = bus->glom;
+		dlen = (uint16)pkttotlen(osh, pfirst);
+
+		/* Do an SDIO read for the superframe.  Configurable iovar to
+		 * read directly into the chained packet, or allocate a large
+		 * packet and and copy into the chain.
+		 */
+		if (usechain) {
+			errcode = dhd_bcmsdh_recv_buf(bus,
+			                              bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+			                              F2SYNC, (uint8*)PKTDATA(osh, pfirst),
+			                              dlen, pfirst, NULL, NULL);
+		} else if (bus->dataptr) {
+			errcode = dhd_bcmsdh_recv_buf(bus,
+			                              bcmsdh_cur_sbwad(bus->sdh), SDIO_FUNC_2,
+			                              F2SYNC, bus->dataptr,
+			                              dlen, NULL, NULL, NULL);
+			sublen = (uint16)pktfrombuf(osh, pfirst, 0, dlen, bus->dataptr);
+			if (sublen != dlen) {
+				DHD_ERROR(("%s: FAILED TO COPY, dlen %d sublen %d\n",
+				           __FUNCTION__, dlen, sublen));
+				errcode = -1;
+			}
+			pnext = NULL;
+		} else {
+			DHD_ERROR(("COULDN'T ALLOC %d-BYTE GLOM, FORCE FAILURE\n", dlen));
+			errcode = -1;
+		}
+		bus->f2rxdata++;
+		ASSERT(errcode != BCME_PENDING);
+
+		/* On failure, kill the superframe, allow a couple retries */
+		if (errcode < 0) {
+			DHD_ERROR(("%s: glom read of %d bytes failed: %d\n",
+			           __FUNCTION__, dlen, errcode));
+			bus->dhd->rx_errors++;
+
+			if (bus->glomerr++ < 3) {
+				dhdsdio_rxfail(bus, TRUE, TRUE);
+			} else {
+				bus->glomerr = 0;
+				dhdsdio_rxfail(bus, TRUE, FALSE);
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE(osh, bus->glom, FALSE);
+				dhd_os_sdunlock_rxq(bus->dhd);
+				bus->rxglomfail++;
+				bus->glom = NULL;
+			}
+			return 0;
+		}
+
+#ifdef DHD_DEBUG
+		if (DHD_GLOM_ON()) {
+			prhex("SUPERFRAME", PKTDATA(osh, pfirst),
+			      MIN(PKTLEN(osh, pfirst), 48));
+		}
+#endif
+
+
+		/* Validate the superframe header */
+		dptr = (uint8 *)PKTDATA(osh, pfirst);
+		sublen = ltoh16_ua(dptr);
+		check = ltoh16_ua(dptr + sizeof(uint16));
+
+		chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+		seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+		bus->nextlen = dptr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+		if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+			DHD_INFO(("%s: got frame w/nextlen too large (%d) seq %d\n",
+			          __FUNCTION__, bus->nextlen, seq));
+			bus->nextlen = 0;
+		}
+		doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+		txmax = SDPCM_WINDOW_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+		errcode = 0;
+		if ((uint16)~(sublen^check)) {
+			DHD_ERROR(("%s (superframe): HW hdr error: len/check 0x%04x/0x%04x\n",
+			           __FUNCTION__, sublen, check));
+			errcode = -1;
+		} else if (ROUNDUP(sublen, bus->blocksize) != dlen) {
+			DHD_ERROR(("%s (superframe): len 0x%04x, rounded 0x%04x, expect 0x%04x\n",
+			           __FUNCTION__, sublen, ROUNDUP(sublen, bus->blocksize), dlen));
+			errcode = -1;
+		} else if (SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]) != SDPCM_GLOM_CHANNEL) {
+			DHD_ERROR(("%s (superframe): bad channel %d\n", __FUNCTION__,
+			           SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN])));
+			errcode = -1;
+		} else if (SDPCM_GLOMDESC(&dptr[SDPCM_FRAMETAG_LEN])) {
+			DHD_ERROR(("%s (superframe): got second descriptor?\n", __FUNCTION__));
+			errcode = -1;
+		} else if ((doff < SDPCM_HDRLEN) ||
+		           (doff > (PKTLEN(osh, pfirst) - SDPCM_HDRLEN))) {
+			DHD_ERROR(("%s (superframe): Bad data offset %d: HW %d pkt %d min %d\n",
+				__FUNCTION__, doff, sublen, PKTLEN(osh, pfirst),
+				SDPCM_HDRLEN));
+			errcode = -1;
+		}
+
+		/* Check sequence number of superframe SW header */
+		if (rxseq != seq) {
+			DHD_INFO(("%s: (superframe) rx_seq %d, expected %d\n",
+			          __FUNCTION__, seq, rxseq));
+			bus->rx_badseq++;
+			rxseq = seq;
+		}
+
+		/* Check window for sanity */
+		if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+			DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+			           __FUNCTION__, txmax, bus->tx_seq));
+			txmax = bus->tx_max;
+		}
+		bus->tx_max = txmax;
+
+		/* Remove superframe header, remember offset */
+		PKTPULL(osh, pfirst, doff);
+		sfdoff = doff;
+
+		/* Validate all the subframe headers */
+		for (num = 0, pnext = pfirst; pnext && !errcode;
+		     num++, pnext = PKTNEXT(osh, pnext)) {
+			dptr = (uint8 *)PKTDATA(osh, pnext);
+			dlen = (uint16)PKTLEN(osh, pnext);
+			sublen = ltoh16_ua(dptr);
+			check = ltoh16_ua(dptr + sizeof(uint16));
+			chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+			doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+#ifdef DHD_DEBUG
+			if (DHD_GLOM_ON()) {
+				prhex("subframe", dptr, 32);
+			}
+#endif
+
+			if ((uint16)~(sublen^check)) {
+				DHD_ERROR(("%s (subframe %d): HW hdr error: "
+				           "len/check 0x%04x/0x%04x\n",
+				           __FUNCTION__, num, sublen, check));
+				errcode = -1;
+			} else if ((sublen > dlen) || (sublen < SDPCM_HDRLEN)) {
+				DHD_ERROR(("%s (subframe %d): length mismatch: "
+				           "len 0x%04x, expect 0x%04x\n",
+				           __FUNCTION__, num, sublen, dlen));
+				errcode = -1;
+			} else if ((chan != SDPCM_DATA_CHANNEL) &&
+			           (chan != SDPCM_EVENT_CHANNEL)) {
+				DHD_ERROR(("%s (subframe %d): bad channel %d\n",
+				           __FUNCTION__, num, chan));
+				errcode = -1;
+			} else if ((doff < SDPCM_HDRLEN) || (doff > sublen)) {
+				DHD_ERROR(("%s (subframe %d): Bad data offset %d: HW %d min %d\n",
+				           __FUNCTION__, num, doff, sublen, SDPCM_HDRLEN));
+				errcode = -1;
+			}
+		}
+
+		if (errcode) {
+			/* Terminate frame on error, request a couple retries */
+			if (bus->glomerr++ < 3) {
+				/* Restore superframe header space */
+				PKTPUSH(osh, pfirst, sfdoff);
+				dhdsdio_rxfail(bus, TRUE, TRUE);
+			} else {
+				bus->glomerr = 0;
+				dhdsdio_rxfail(bus, TRUE, FALSE);
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE(osh, bus->glom, FALSE);
+				dhd_os_sdunlock_rxq(bus->dhd);
+				bus->rxglomfail++;
+				bus->glom = NULL;
+			}
+			bus->nextlen = 0;
+			return 0;
+		}
+
+		/* Basic SD framing looks ok - process each packet (header) */
+		bus->glom = NULL;
+		plast = NULL;
+
+		dhd_os_sdlock_rxq(bus->dhd);
+		for (num = 0; pfirst; rxseq++, pfirst = pnext) {
+			pnext = PKTNEXT(osh, pfirst);
+			PKTSETNEXT(osh, pfirst, NULL);
+
+			dptr = (uint8 *)PKTDATA(osh, pfirst);
+			sublen = ltoh16_ua(dptr);
+			chan = SDPCM_PACKET_CHANNEL(&dptr[SDPCM_FRAMETAG_LEN]);
+			seq = SDPCM_PACKET_SEQUENCE(&dptr[SDPCM_FRAMETAG_LEN]);
+			doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+
+			DHD_GLOM(("%s: Get subframe %d, %p(%p/%d), sublen %d chan %d seq %d\n",
+			          __FUNCTION__, num, pfirst, PKTDATA(osh, pfirst),
+			          PKTLEN(osh, pfirst), sublen, chan, seq));
+
+			ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL));
+
+			if (rxseq != seq) {
+				DHD_GLOM(("%s: rx_seq %d, expected %d\n",
+				          __FUNCTION__, seq, rxseq));
+				bus->rx_badseq++;
+				rxseq = seq;
+			}
+
+#ifdef DHD_DEBUG
+			if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+				prhex("Rx Subframe Data", dptr, dlen);
+			}
+#endif
+
+			PKTSETLEN(osh, pfirst, sublen);
+			PKTPULL(osh, pfirst, doff);
+
+			reorder_info_len = sizeof(reorder_info_buf);
+
+			if (PKTLEN(osh, pfirst) == 0) {
+				PKTFREE(bus->dhd->osh, pfirst, FALSE);
+				continue;
+			} else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pfirst, reorder_info_buf,
+				&reorder_info_len) != 0) {
+				DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+				bus->dhd->rx_errors++;
+				PKTFREE(osh, pfirst, FALSE);
+				continue;
+			}
+			if (reorder_info_len) {
+				uint32 free_buf_count;
+				void *ppfirst;
+
+				ppfirst = pfirst;
+				/* Reordering info from the firmware */
+				dhd_process_pkt_reorder_info(bus->dhd, reorder_info_buf,
+					reorder_info_len, &ppfirst, &free_buf_count);
+
+				if (free_buf_count == 0) {
+					continue;
+				}
+				else {
+					void *temp;
+
+					/*  go to the end of the chain and attach the pnext there */
+					temp = ppfirst;
+					while (PKTNEXT(osh, temp) != NULL) {
+						temp = PKTNEXT(osh, temp);
+					}
+					pfirst = temp;
+					if (list_tail[ifidx] == NULL)
+						list_head[ifidx] = ppfirst;
+					else
+						PKTSETNEXT(osh, list_tail[ifidx], ppfirst);
+					list_tail[ifidx] = pfirst;
+				}
+
+				num += (uint8)free_buf_count;
+			}
+			else {
+				/* this packet will go up, link back into chain and count it */
+
+				if (list_tail[ifidx] == NULL) {
+					list_head[ifidx] = list_tail[ifidx] = pfirst;
+				}
+				else {
+					PKTSETNEXT(osh, list_tail[ifidx], pfirst);
+					list_tail[ifidx] = pfirst;
+				}
+				num++;
+			}
+#ifdef DHD_DEBUG
+			if (DHD_GLOM_ON()) {
+				DHD_GLOM(("%s subframe %d to stack, %p(%p/%d) nxt/lnk %p/%p\n",
+				          __FUNCTION__, num, pfirst,
+				          PKTDATA(osh, pfirst), PKTLEN(osh, pfirst),
+				          PKTNEXT(osh, pfirst), PKTLINK(pfirst)));
+				prhex("", (uint8 *)PKTDATA(osh, pfirst),
+				      MIN(PKTLEN(osh, pfirst), 32));
+			}
+#endif /* DHD_DEBUG */
+		}
+		dhd_os_sdunlock_rxq(bus->dhd);
+
+		for (idx = 0; idx < DHD_MAX_IFS; idx++) {
+			if (list_head[idx]) {
+				void *temp;
+				uint8 cnt = 0;
+				temp = list_head[idx];
+				do {
+					temp = PKTNEXT(osh, temp);
+					cnt++;
+				} while (temp);
+				if (cnt) {
+					dhd_os_sdunlock(bus->dhd);
+					dhd_rx_frame(bus->dhd, idx, list_head[idx], cnt, 0);
+					dhd_os_sdlock(bus->dhd);
+				}
+			}
+		}
+		bus->rxglomframes++;
+		bus->rxglompkts += num;
+	}
+	return num;
+}
+
+
+/* Return TRUE if there may be more frames to read */
+static uint
+dhdsdio_readframes(dhd_bus_t *bus, uint maxframes, bool *finished)
+{
+	osl_t *osh = bus->dhd->osh;
+	bcmsdh_info_t *sdh = bus->sdh;
+
+	uint16 len, check;	/* Extracted hardware header fields */
+	uint8 chan, seq, doff;	/* Extracted software header fields */
+	uint8 fcbits;		/* Extracted fcbits from software header */
+	uint8 delta;
+
+	void *pkt;	/* Packet for event or data frames */
+	uint16 pad;	/* Number of pad bytes to read */
+	uint16 rdlen;	/* Total number of bytes to read */
+	uint8 rxseq;	/* Next sequence number to expect */
+	uint rxleft = 0;	/* Remaining number of frames allowed */
+	int sdret;	/* Return code from bcmsdh calls */
+	uint8 txmax;	/* Maximum tx sequence offered */
+	bool len_consistent; /* Result of comparing readahead len and len from hw-hdr */
+	uint8 *rxbuf;
+	int ifidx = 0;
+	uint rxcount = 0; /* Total frames read */
+	uchar reorder_info_buf[WLHOST_REORDERDATA_TOTLEN];
+	uint reorder_info_len;
+	uint pkt_count;
+
+#if defined(DHD_DEBUG) || defined(SDTEST)
+	bool sdtest = FALSE;	/* To limit message spew from test mode */
+#endif
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	bus->readframes = TRUE;
+
+	if (!KSO_ENAB(bus)) {
+		DHD_ERROR(("%s: KSO off\n", __FUNCTION__));
+		bus->readframes = FALSE;
+		return 0;
+	}
+
+	ASSERT(maxframes);
+
+#ifdef SDTEST
+	/* Allow pktgen to override maxframes */
+	if (bus->pktgen_count && (bus->pktgen_mode == DHD_PKTGEN_RECV)) {
+		maxframes = bus->pktgen_count;
+		sdtest = TRUE;
+	}
+#endif
+
+	/* Not finished unless we encounter no more frames indication */
+	*finished = FALSE;
+
+
+	for (rxseq = bus->rx_seq, rxleft = maxframes;
+	     !bus->rxskip && rxleft && bus->dhd->busstate != DHD_BUS_DOWN;
+	     rxseq++, rxleft--) {
+#ifdef DHDTCPACK_SUP_DBG
+		if (bus->dhd->tcpack_sup_mode != TCPACK_SUP_DELAYTX) {
+			if (bus->dotxinrx == FALSE)
+				DHD_ERROR(("%s %d: dotxinrx FALSE with tcpack_sub_mode %d\n",
+					__FUNCTION__, __LINE__, bus->dhd->tcpack_sup_mode));
+		}
+#ifdef DEBUG_COUNTER
+		else if (pktq_mlen(&bus->txq, ~bus->flowcontrol) > 0) {
+			tack_tbl.cnt[bus->dotxinrx ? 6 : 7]++;
+		}
+#endif /* DEBUG_COUNTER */
+#endif /* DHDTCPACK_SUP_DBG */
+		/* tx more to improve rx performance */
+		if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL)) {
+			dhdsdio_sendpendctl(bus);
+		} else if (bus->dotxinrx && (bus->clkstate == CLK_AVAIL) &&
+			!bus->fcstate && DATAOK(bus) &&
+			(pktq_mlen(&bus->txq, ~bus->flowcontrol) > bus->txinrx_thres)) {
+			dhdsdio_sendfromq(bus, dhd_txbound);
+#ifdef DHDTCPACK_SUPPRESS
+			/* In TCPACK_SUP_DELAYTX mode, do txinrx only if
+			 * 1. Any DATA packet to TX
+			 * 2. TCPACK to TCPDATA PSH packets.
+			 * in bus txq.
+			 */
+			bus->dotxinrx = (bus->dhd->tcpack_sup_mode == TCPACK_SUP_DELAYTX) ?
+				FALSE : TRUE;
+#endif
+		}
+
+		/* Handle glomming separately */
+		if (bus->glom || bus->glomd) {
+			uint8 cnt;
+			DHD_GLOM(("%s: calling rxglom: glomd %p, glom %p\n",
+			          __FUNCTION__, bus->glomd, bus->glom));
+			cnt = dhdsdio_rxglom(bus, rxseq);
+			DHD_GLOM(("%s: rxglom returned %d\n", __FUNCTION__, cnt));
+			rxseq += cnt - 1;
+			rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
+			continue;
+		}
+
+		/* Try doing single read if we can */
+		if (dhd_readahead && bus->nextlen) {
+			uint16 nextlen = bus->nextlen;
+			bus->nextlen = 0;
+
+			if (bus->bus == SPI_BUS) {
+				rdlen = len = nextlen;
+			}
+			else {
+				rdlen = len = nextlen << 4;
+
+				/* Pad read to blocksize for efficiency */
+				if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+					pad = bus->blocksize - (rdlen % bus->blocksize);
+					if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+						((rdlen + pad + firstread) < MAX_RX_DATASZ))
+						rdlen += pad;
+				} else if (rdlen % DHD_SDALIGN) {
+					rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+				}
+			}
+
+			/* We use bus->rxctl buffer in WinXP for initial control pkt receives.
+			 * Later we use buffer-poll for data as well as control packets.
+			 * This is required because dhd receives full frame in gSPI unlike SDIO.
+			 * After the frame is received we have to distinguish whether it is data
+			 * or non-data frame.
+			 */
+			/* Allocate a packet buffer */
+			dhd_os_sdlock_rxq(bus->dhd);
+			if (!(pkt = PKTGET(osh, rdlen + DHD_SDALIGN, FALSE))) {
+				if (bus->bus == SPI_BUS) {
+					bus->usebufpool = FALSE;
+					bus->rxctl = bus->rxbuf;
+					if (dhd_alignctl) {
+						bus->rxctl += firstread;
+						if ((pad = ((uintptr)bus->rxctl % DHD_SDALIGN)))
+							bus->rxctl += (DHD_SDALIGN - pad);
+						bus->rxctl -= firstread;
+					}
+					ASSERT(bus->rxctl >= bus->rxbuf);
+					rxbuf = bus->rxctl;
+					/* Read the entire frame */
+					sdret = dhd_bcmsdh_recv_buf(bus,
+					                            bcmsdh_cur_sbwad(sdh),
+					                            SDIO_FUNC_2,
+					                            F2SYNC, rxbuf, rdlen,
+					                            NULL, NULL, NULL);
+					bus->f2rxdata++;
+					ASSERT(sdret != BCME_PENDING);
+
+
+					/* Control frame failures need retransmission */
+					if (sdret < 0) {
+						DHD_ERROR(("%s: read %d control bytes failed: %d\n",
+						   __FUNCTION__, rdlen, sdret));
+						/* dhd.rx_ctlerrs is higher level */
+						bus->rxc_errors++;
+						dhd_os_sdunlock_rxq(bus->dhd);
+						dhdsdio_rxfail(bus, TRUE,
+						    (bus->bus == SPI_BUS) ? FALSE : TRUE);
+						continue;
+					}
+				} else {
+					/* Give up on data, request rtx of events */
+					DHD_ERROR(("%s (nextlen): PKTGET failed: len %d rdlen %d "
+					           "expected rxseq %d\n",
+					           __FUNCTION__, len, rdlen, rxseq));
+					/* Just go try again w/normal header read */
+					dhd_os_sdunlock_rxq(bus->dhd);
+					continue;
+				}
+			} else {
+				if (bus->bus == SPI_BUS)
+					bus->usebufpool = TRUE;
+
+				ASSERT(!PKTLINK(pkt));
+				PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+				rxbuf = (uint8 *)PKTDATA(osh, pkt);
+				/* Read the entire frame */
+				sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh),
+				                            SDIO_FUNC_2,
+				                            F2SYNC, rxbuf, rdlen,
+				                            pkt, NULL, NULL);
+				bus->f2rxdata++;
+				ASSERT(sdret != BCME_PENDING);
+
+				if (sdret < 0) {
+					DHD_ERROR(("%s (nextlen): read %d bytes failed: %d\n",
+					   __FUNCTION__, rdlen, sdret));
+					PKTFREE(bus->dhd->osh, pkt, FALSE);
+					bus->dhd->rx_errors++;
+					dhd_os_sdunlock_rxq(bus->dhd);
+					/* Force retry w/normal header read.  Don't attempt NAK for
+					 * gSPI
+					 */
+					dhdsdio_rxfail(bus, TRUE,
+					      (bus->bus == SPI_BUS) ? FALSE : TRUE);
+					continue;
+				}
+			}
+			dhd_os_sdunlock_rxq(bus->dhd);
+
+			/* Now check the header */
+			bcopy(rxbuf, bus->rxhdr, SDPCM_HDRLEN);
+
+			/* Extract hardware header fields */
+			len = ltoh16_ua(bus->rxhdr);
+			check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+			/* All zeros means readahead info was bad */
+			if (!(len|check)) {
+				DHD_INFO(("%s (nextlen): read zeros in HW header???\n",
+				           __FUNCTION__));
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE2();
+				dhd_os_sdunlock_rxq(bus->dhd);
+				GSPI_PR55150_BAILOUT;
+				continue;
+			}
+
+			/* Validate check bytes */
+			if ((uint16)~(len^check)) {
+				DHD_ERROR(("%s (nextlen): HW hdr error: nextlen/len/check"
+				           " 0x%04x/0x%04x/0x%04x\n", __FUNCTION__, nextlen,
+				           len, check));
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE2();
+				dhd_os_sdunlock_rxq(bus->dhd);
+				bus->rx_badhdr++;
+				dhdsdio_rxfail(bus, FALSE, FALSE);
+				GSPI_PR55150_BAILOUT;
+				continue;
+			}
+
+			/* Validate frame length */
+			if (len < SDPCM_HDRLEN) {
+				DHD_ERROR(("%s (nextlen): HW hdr length invalid: %d\n",
+				           __FUNCTION__, len));
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE2();
+				dhd_os_sdunlock_rxq(bus->dhd);
+				GSPI_PR55150_BAILOUT;
+				continue;
+			}
+
+			/* Check for consistency with readahead info */
+				len_consistent = (nextlen != (ROUNDUP(len, 16) >> 4));
+			if (len_consistent) {
+				/* Mismatch, force retry w/normal header (may be >4K) */
+				DHD_ERROR(("%s (nextlen): mismatch, nextlen %d len %d rnd %d; "
+				           "expected rxseq %d\n",
+				           __FUNCTION__, nextlen, len, ROUNDUP(len, 16), rxseq));
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE2();
+				dhd_os_sdunlock_rxq(bus->dhd);
+				dhdsdio_rxfail(bus, TRUE, (bus->bus == SPI_BUS) ? FALSE : TRUE);
+				GSPI_PR55150_BAILOUT;
+				continue;
+			}
+
+
+			/* Extract software header fields */
+			chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+			seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+			doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+			txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+				bus->nextlen =
+				         bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+				if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+					DHD_INFO(("%s (nextlen): got frame w/nextlen too large"
+					          " (%d), seq %d\n", __FUNCTION__, bus->nextlen,
+					          seq));
+					bus->nextlen = 0;
+				}
+
+				bus->dhd->rx_readahead_cnt ++;
+			/* Handle Flow Control */
+			fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+			delta = 0;
+			if (~bus->flowcontrol & fcbits) {
+				bus->fc_xoff++;
+				delta = 1;
+			}
+			if (bus->flowcontrol & ~fcbits) {
+				bus->fc_xon++;
+				delta = 1;
+			}
+
+			if (delta) {
+				bus->fc_rcvd++;
+				bus->flowcontrol = fcbits;
+			}
+
+			/* Check and update sequence number */
+			if (rxseq != seq) {
+				DHD_INFO(("%s (nextlen): rx_seq %d, expected %d\n",
+				          __FUNCTION__, seq, rxseq));
+				bus->rx_badseq++;
+				rxseq = seq;
+			}
+
+			/* Check window for sanity */
+			if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+					DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+						__FUNCTION__, txmax, bus->tx_seq));
+					txmax = bus->tx_max;
+			}
+			bus->tx_max = txmax;
+
+#ifdef DHD_DEBUG
+			if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+				prhex("Rx Data", rxbuf, len);
+			} else if (DHD_HDRS_ON()) {
+				prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+			}
+#endif
+
+			if (chan == SDPCM_CONTROL_CHANNEL) {
+				if (bus->bus == SPI_BUS) {
+					dhdsdio_read_control(bus, rxbuf, len, doff);
+					if (bus->usebufpool) {
+						dhd_os_sdlock_rxq(bus->dhd);
+						PKTFREE(bus->dhd->osh, pkt, FALSE);
+						dhd_os_sdunlock_rxq(bus->dhd);
+					}
+					continue;
+				} else {
+					DHD_ERROR(("%s (nextlen): readahead on control"
+					           " packet %d?\n", __FUNCTION__, seq));
+					/* Force retry w/normal header read */
+					bus->nextlen = 0;
+					dhdsdio_rxfail(bus, FALSE, TRUE);
+					dhd_os_sdlock_rxq(bus->dhd);
+					PKTFREE2();
+					dhd_os_sdunlock_rxq(bus->dhd);
+					continue;
+				}
+			}
+
+			if ((bus->bus == SPI_BUS) && !bus->usebufpool) {
+				DHD_ERROR(("Received %d bytes on %d channel. Running out of "
+				           "rx pktbuf's or not yet malloced.\n", len, chan));
+				continue;
+			}
+
+			/* Validate data offset */
+			if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+				DHD_ERROR(("%s (nextlen): bad data offset %d: HW len %d min %d\n",
+				           __FUNCTION__, doff, len, SDPCM_HDRLEN));
+				dhd_os_sdlock_rxq(bus->dhd);
+				PKTFREE2();
+				dhd_os_sdunlock_rxq(bus->dhd);
+				ASSERT(0);
+				dhdsdio_rxfail(bus, FALSE, FALSE);
+				continue;
+			}
+
+			/* All done with this one -- now deliver the packet */
+			goto deliver;
+		}
+		/* gSPI frames should not be handled in fractions */
+		if (bus->bus == SPI_BUS) {
+			break;
+		}
+
+		/* Read frame header (hardware and software) */
+		sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+		                            bus->rxhdr, firstread, NULL, NULL, NULL);
+		bus->f2rxhdrs++;
+		ASSERT(sdret != BCME_PENDING);
+
+		if (sdret < 0) {
+			DHD_ERROR(("%s: RXHEADER FAILED: %d\n", __FUNCTION__, sdret));
+			bus->rx_hdrfail++;
+			dhdsdio_rxfail(bus, TRUE, TRUE);
+			continue;
+		}
+
+#ifdef DHD_DEBUG
+		if (DHD_BYTES_ON() || DHD_HDRS_ON()) {
+			prhex("RxHdr", bus->rxhdr, SDPCM_HDRLEN);
+		}
+#endif
+
+		/* Extract hardware header fields */
+		len = ltoh16_ua(bus->rxhdr);
+		check = ltoh16_ua(bus->rxhdr + sizeof(uint16));
+
+		/* All zeros means no more frames */
+		if (!(len|check)) {
+			*finished = TRUE;
+			break;
+		}
+
+		/* Validate check bytes */
+		if ((uint16)~(len^check)) {
+			DHD_ERROR(("%s: HW hdr error: len/check 0x%04x/0x%04x\n",
+			           __FUNCTION__, len, check));
+			bus->rx_badhdr++;
+			dhdsdio_rxfail(bus, FALSE, FALSE);
+			continue;
+		}
+
+		/* Validate frame length */
+		if (len < SDPCM_HDRLEN) {
+			DHD_ERROR(("%s: HW hdr length invalid: %d\n", __FUNCTION__, len));
+			continue;
+		}
+
+		/* Extract software header fields */
+		chan = SDPCM_PACKET_CHANNEL(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+		seq = SDPCM_PACKET_SEQUENCE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+		doff = SDPCM_DOFFSET_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+		txmax = SDPCM_WINDOW_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+		/* Validate data offset */
+		if ((doff < SDPCM_HDRLEN) || (doff > len)) {
+			DHD_ERROR(("%s: Bad data offset %d: HW len %d, min %d seq %d\n",
+			           __FUNCTION__, doff, len, SDPCM_HDRLEN, seq));
+			bus->rx_badhdr++;
+			ASSERT(0);
+			dhdsdio_rxfail(bus, FALSE, FALSE);
+			continue;
+		}
+
+		/* Save the readahead length if there is one */
+		bus->nextlen = bus->rxhdr[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+		if ((bus->nextlen << 4) > MAX_RX_DATASZ) {
+			DHD_INFO(("%s (nextlen): got frame w/nextlen too large (%d), seq %d\n",
+			          __FUNCTION__, bus->nextlen, seq));
+			bus->nextlen = 0;
+		}
+
+		/* Handle Flow Control */
+		fcbits = SDPCM_FCMASK_VALUE(&bus->rxhdr[SDPCM_FRAMETAG_LEN]);
+
+		delta = 0;
+		if (~bus->flowcontrol & fcbits) {
+			bus->fc_xoff++;
+			delta = 1;
+		}
+		if (bus->flowcontrol & ~fcbits) {
+			bus->fc_xon++;
+			delta = 1;
+		}
+
+		if (delta) {
+			bus->fc_rcvd++;
+			bus->flowcontrol = fcbits;
+		}
+
+		/* Check and update sequence number */
+		if (rxseq != seq) {
+			DHD_INFO(("%s: rx_seq %d, expected %d\n", __FUNCTION__, seq, rxseq));
+			bus->rx_badseq++;
+			rxseq = seq;
+		}
+
+		/* Check window for sanity */
+		if ((uint8)(txmax - bus->tx_seq) > 0x70) {
+			DHD_ERROR(("%s: got unlikely tx max %d with tx_seq %d\n",
+			           __FUNCTION__, txmax, bus->tx_seq));
+			txmax = bus->tx_max;
+		}
+		bus->tx_max = txmax;
+
+		/* Call a separate function for control frames */
+		if (chan == SDPCM_CONTROL_CHANNEL) {
+			dhdsdio_read_control(bus, bus->rxhdr, len, doff);
+			continue;
+		}
+
+		ASSERT((chan == SDPCM_DATA_CHANNEL) || (chan == SDPCM_EVENT_CHANNEL) ||
+		       (chan == SDPCM_TEST_CHANNEL) || (chan == SDPCM_GLOM_CHANNEL));
+
+		/* Length to read */
+		rdlen = (len > firstread) ? (len - firstread) : 0;
+
+		/* May pad read to blocksize for efficiency */
+		if (bus->roundup && bus->blocksize && (rdlen > bus->blocksize)) {
+			pad = bus->blocksize - (rdlen % bus->blocksize);
+			if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
+			    ((rdlen + pad + firstread) < MAX_RX_DATASZ))
+				rdlen += pad;
+		} else if (rdlen % DHD_SDALIGN) {
+			rdlen += DHD_SDALIGN - (rdlen % DHD_SDALIGN);
+		}
+
+		/* Satisfy length-alignment requirements */
+		if (forcealign && (rdlen & (ALIGNMENT - 1)))
+			rdlen = ROUNDUP(rdlen, ALIGNMENT);
+
+		if ((rdlen + firstread) > MAX_RX_DATASZ) {
+			/* Too long -- skip this frame */
+			DHD_ERROR(("%s: too long: len %d rdlen %d\n", __FUNCTION__, len, rdlen));
+			bus->dhd->rx_errors++; bus->rx_toolong++;
+			dhdsdio_rxfail(bus, FALSE, FALSE);
+			continue;
+		}
+
+		dhd_os_sdlock_rxq(bus->dhd);
+		if (!(pkt = PKTGET(osh, (rdlen + firstread + DHD_SDALIGN), FALSE))) {
+			/* Give up on data, request rtx of events */
+			DHD_ERROR(("%s: PKTGET failed: rdlen %d chan %d\n",
+			           __FUNCTION__, rdlen, chan));
+			bus->dhd->rx_dropped++;
+			dhd_os_sdunlock_rxq(bus->dhd);
+			dhdsdio_rxfail(bus, FALSE, RETRYCHAN(chan));
+			continue;
+		}
+		dhd_os_sdunlock_rxq(bus->dhd);
+
+		ASSERT(!PKTLINK(pkt));
+
+		/* Leave room for what we already read, and align remainder */
+		ASSERT(firstread < (PKTLEN(osh, pkt)));
+		PKTPULL(osh, pkt, firstread);
+		PKTALIGN(osh, pkt, rdlen, DHD_SDALIGN);
+
+		/* Read the remaining frame data */
+		sdret = dhd_bcmsdh_recv_buf(bus, bcmsdh_cur_sbwad(sdh), SDIO_FUNC_2, F2SYNC,
+		                            ((uint8 *)PKTDATA(osh, pkt)), rdlen, pkt, NULL, NULL);
+		bus->f2rxdata++;
+		ASSERT(sdret != BCME_PENDING);
+
+		if (sdret < 0) {
+			DHD_ERROR(("%s: read %d %s bytes failed: %d\n", __FUNCTION__, rdlen,
+			           ((chan == SDPCM_EVENT_CHANNEL) ? "event" :
+			            ((chan == SDPCM_DATA_CHANNEL) ? "data" : "test")), sdret));
+			dhd_os_sdlock_rxq(bus->dhd);
+			PKTFREE(bus->dhd->osh, pkt, FALSE);
+			dhd_os_sdunlock_rxq(bus->dhd);
+			bus->dhd->rx_errors++;
+			dhdsdio_rxfail(bus, TRUE, RETRYCHAN(chan));
+			continue;
+		}
+
+		/* Copy the already-read portion */
+		PKTPUSH(osh, pkt, firstread);
+		bcopy(bus->rxhdr, PKTDATA(osh, pkt), firstread);
+
+#ifdef DHD_DEBUG
+		if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+			prhex("Rx Data", PKTDATA(osh, pkt), len);
+		}
+#endif
+
+deliver:
+		/* Save superframe descriptor and allocate packet frame */
+		if (chan == SDPCM_GLOM_CHANNEL) {
+			if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
+				DHD_GLOM(("%s: got glom descriptor, %d bytes:\n",
+				          __FUNCTION__, len));
+#ifdef DHD_DEBUG
+				if (DHD_GLOM_ON()) {
+					prhex("Glom Data", PKTDATA(osh, pkt), len);
+				}
+#endif
+				PKTSETLEN(osh, pkt, len);
+				ASSERT(doff == SDPCM_HDRLEN);
+				PKTPULL(osh, pkt, SDPCM_HDRLEN);
+				bus->glomd = pkt;
+			} else {
+				DHD_ERROR(("%s: glom superframe w/o descriptor!\n", __FUNCTION__));
+				dhdsdio_rxfail(bus, FALSE, FALSE);
+			}
+			continue;
+		}
+
+		/* Fill in packet len and prio, deliver upward */
+		PKTSETLEN(osh, pkt, len);
+		PKTPULL(osh, pkt, doff);
+
+#ifdef SDTEST
+		/* Test channel packets are processed separately */
+		if (chan == SDPCM_TEST_CHANNEL) {
+			dhdsdio_testrcv(bus, pkt, seq);
+			continue;
+		}
+#endif /* SDTEST */
+
+		if (PKTLEN(osh, pkt) == 0) {
+			dhd_os_sdlock_rxq(bus->dhd);
+			PKTFREE(bus->dhd->osh, pkt, FALSE);
+			dhd_os_sdunlock_rxq(bus->dhd);
+			continue;
+		} else if (dhd_prot_hdrpull(bus->dhd, &ifidx, pkt, reorder_info_buf,
+			&reorder_info_len) != 0) {
+			DHD_ERROR(("%s: rx protocol error\n", __FUNCTION__));
+			dhd_os_sdlock_rxq(bus->dhd);
+			PKTFREE(bus->dhd->osh, pkt, FALSE);
+			dhd_os_sdunlock_rxq(bus->dhd);
+			bus->dhd->rx_errors++;
+			continue;
+		}
+		if (reorder_info_len) {
+			/* Reordering info from the firmware */
+			dhd_process_pkt_reorder_info(bus->dhd, reorder_info_buf, reorder_info_len,
+				&pkt, &pkt_count);
+			if (pkt_count == 0)
+				continue;
+		}
+		else
+			pkt_count = 1;
+
+		/* Unlock during rx call */
+		dhd_os_sdunlock(bus->dhd);
+		dhd_rx_frame(bus->dhd, ifidx, pkt, pkt_count, chan);
+		dhd_os_sdlock(bus->dhd);
+#if defined(SDIO_ISR_THREAD)
+		/* terence 20150615: fix for below error due to bussleep in watchdog after dhd_os_sdunlock here,
+		  * so call BUS_WAKE to wake up bus again
+		  * dhd_bcmsdh_recv_buf: Device asleep
+		  * dhdsdio_readframes: RXHEADER FAILED: -40
+		  * dhdsdio_rxfail: abort command, terminate frame, send NAK
+		*/
+		BUS_WAKE(bus);
+#endif
+	}
+	rxcount = maxframes - rxleft;
+#ifdef DHD_DEBUG
+	/* Message if we hit the limit */
+	if (!rxleft && !sdtest)
+		DHD_DATA(("%s: hit rx limit of %d frames\n", __FUNCTION__, maxframes));
+	else
+#endif /* DHD_DEBUG */
+	DHD_DATA(("%s: processed %d frames\n", __FUNCTION__, rxcount));
+	/* Back off rxseq if awaiting rtx, update rx_seq */
+	if (bus->rxskip)
+		rxseq--;
+	bus->rx_seq = rxseq;
+
+	if (bus->reqbussleep)
+	{
+		dhdsdio_bussleep(bus, TRUE);
+		bus->reqbussleep = FALSE;
+	}
+	bus->readframes = FALSE;
+
+	return rxcount;
+}
+
+static uint32
+dhdsdio_hostmail(dhd_bus_t *bus)
+{
+	sdpcmd_regs_t *regs = bus->regs;
+	uint32 intstatus = 0;
+	uint32 hmb_data;
+	uint8 fcbits;
+	uint retries = 0;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Read mailbox data and ack that we did so */
+	R_SDREG(hmb_data, &regs->tohostmailboxdata, retries);
+	if (retries <= retry_limit)
+		W_SDREG(SMB_INT_ACK, &regs->tosbmailbox, retries);
+	bus->f1regdata += 2;
+
+	/* Dongle recomposed rx frames, accept them again */
+	if (hmb_data & HMB_DATA_NAKHANDLED) {
+		DHD_INFO(("Dongle reports NAK handled, expect rtx of %d\n", bus->rx_seq));
+		if (!bus->rxskip) {
+			DHD_ERROR(("%s: unexpected NAKHANDLED!\n", __FUNCTION__));
+		}
+		bus->rxskip = FALSE;
+		intstatus |= FRAME_AVAIL_MASK(bus);
+	}
+
+	/*
+	 * DEVREADY does not occur with gSPI.
+	 */
+	if (hmb_data & (HMB_DATA_DEVREADY | HMB_DATA_FWREADY)) {
+		bus->sdpcm_ver = (hmb_data & HMB_DATA_VERSION_MASK) >> HMB_DATA_VERSION_SHIFT;
+		if (bus->sdpcm_ver != SDPCM_PROT_VERSION)
+			DHD_ERROR(("Version mismatch, dongle reports %d, expecting %d\n",
+			           bus->sdpcm_ver, SDPCM_PROT_VERSION));
+		else
+			DHD_INFO(("Dongle ready, protocol version %d\n", bus->sdpcm_ver));
+		/* make sure for the SDIO_DEVICE_RXDATAINT_MODE_1 corecontrol is proper */
+		if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+		    (bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1)) {
+			uint32 val;
+
+			val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+			val &= ~CC_XMTDATAAVAIL_MODE;
+			val |= CC_XMTDATAAVAIL_CTRL;
+			W_REG(bus->dhd->osh, &bus->regs->corecontrol, val);
+
+			val = R_REG(bus->dhd->osh, &bus->regs->corecontrol);
+		}
+
+#ifdef DHD_DEBUG
+		/* Retrieve console state address now that firmware should have updated it */
+		{
+			sdpcm_shared_t shared;
+			if (dhdsdio_readshared(bus, &shared) == 0)
+				bus->console_addr = shared.console_addr;
+		}
+#endif /* DHD_DEBUG */
+	}
+
+	/*
+	 * Flow Control has been moved into the RX headers and this out of band
+	 * method isn't used any more.  Leave this here for possibly remaining backward
+	 * compatible with older dongles
+	 */
+	if (hmb_data & HMB_DATA_FC) {
+		fcbits = (hmb_data & HMB_DATA_FCDATA_MASK) >> HMB_DATA_FCDATA_SHIFT;
+
+		if (fcbits & ~bus->flowcontrol)
+			bus->fc_xoff++;
+		if (bus->flowcontrol & ~fcbits)
+			bus->fc_xon++;
+
+		bus->fc_rcvd++;
+		bus->flowcontrol = fcbits;
+	}
+
+#ifdef DHD_DEBUG
+	/* At least print a message if FW halted */
+	if (hmb_data & HMB_DATA_FWHALT) {
+		DHD_ERROR(("INTERNAL ERROR: FIRMWARE HALTED : set BUS DOWN\n"));
+		dhdsdio_checkdied(bus, NULL, 0);
+		bus->dhd->busstate = DHD_BUS_DOWN;
+	}
+#endif /* DHD_DEBUG */
+
+	/* Shouldn't be any others */
+	if (hmb_data & ~(HMB_DATA_DEVREADY |
+	                 HMB_DATA_FWHALT |
+	                 HMB_DATA_NAKHANDLED |
+	                 HMB_DATA_FC |
+	                 HMB_DATA_FWREADY |
+	                 HMB_DATA_FCDATA_MASK |
+	                 HMB_DATA_VERSION_MASK)) {
+		DHD_ERROR(("Unknown mailbox data content: 0x%02x\n", hmb_data));
+	}
+
+	return intstatus;
+}
+
+static bool
+dhdsdio_dpc(dhd_bus_t *bus)
+{
+	bcmsdh_info_t *sdh = bus->sdh;
+	sdpcmd_regs_t *regs = bus->regs;
+	uint32 intstatus, newstatus = 0;
+	uint retries = 0;
+	uint rxlimit = dhd_rxbound; /* Rx frames to read before resched */
+	uint txlimit = dhd_txbound; /* Tx frames to send before resched */
+	uint framecnt = 0;		  /* Temporary counter of tx/rx frames */
+	bool rxdone = TRUE;		  /* Flag for no more read data */
+	bool resched = FALSE;	  /* Flag indicating resched wanted */
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	dhd_os_sdlock(bus->dhd);
+
+	if (bus->dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s: Bus down, ret\n", __FUNCTION__));
+		bus->intstatus = 0;
+		dhd_os_sdunlock(bus->dhd);
+		return 0;
+	}
+
+	/* Start with leftover status bits */
+	intstatus = bus->intstatus;
+
+	if (!SLPAUTO_ENAB(bus) && !KSO_ENAB(bus)) {
+		DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+		goto exit;
+	}
+
+	/* If waiting for HTAVAIL, check status */
+	if (!SLPAUTO_ENAB(bus) && (bus->clkstate == CLK_PENDING)) {
+		int err;
+		uint8 clkctl, devctl = 0;
+
+#ifdef DHD_DEBUG
+		/* Check for inconsistent device control */
+		devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+		if (err) {
+			DHD_ERROR(("%s: error reading DEVCTL: %d\n", __FUNCTION__, err));
+			bus->dhd->busstate = DHD_BUS_DOWN;
+		} else {
+			ASSERT(devctl & SBSDIO_DEVCTL_CA_INT_ONLY);
+		}
+#endif /* DHD_DEBUG */
+
+		/* Read CSR, if clock on switch to AVAIL, else ignore */
+		clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+		if (err) {
+			DHD_ERROR(("%s: error reading CSR: %d\n", __FUNCTION__, err));
+			bus->dhd->busstate = DHD_BUS_DOWN;
+		}
+
+		DHD_INFO(("DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n", devctl, clkctl));
+
+		if (SBSDIO_HTAV(clkctl)) {
+			devctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, &err);
+			if (err) {
+				DHD_ERROR(("%s: error reading DEVCTL: %d\n",
+				           __FUNCTION__, err));
+				bus->dhd->busstate = DHD_BUS_DOWN;
+			}
+			devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_DEVICE_CTL, devctl, &err);
+			if (err) {
+				DHD_ERROR(("%s: error writing DEVCTL: %d\n",
+				           __FUNCTION__, err));
+				bus->dhd->busstate = DHD_BUS_DOWN;
+			}
+			bus->clkstate = CLK_AVAIL;
+		} else {
+			goto clkwait;
+		}
+	}
+
+	BUS_WAKE(bus);
+
+	/* Make sure backplane clock is on */
+	dhdsdio_clkctl(bus, CLK_AVAIL, TRUE);
+	if (bus->clkstate != CLK_AVAIL)
+		goto clkwait;
+
+	/* Pending interrupt indicates new device status */
+	if (bus->ipend) {
+		bus->ipend = FALSE;
+		R_SDREG(newstatus, &regs->intstatus, retries);
+		bus->f1regdata++;
+		if (bcmsdh_regfail(bus->sdh))
+			newstatus = 0;
+		newstatus &= bus->hostintmask;
+		bus->fcstate = !!(newstatus & I_HMB_FC_STATE);
+		if (newstatus) {
+			bus->f1regdata++;
+			if ((bus->rxint_mode == SDIO_DEVICE_RXDATAINT_MODE_0) &&
+				(newstatus == I_XMTDATA_AVAIL)) {
+			}
+			else
+				W_SDREG(newstatus, &regs->intstatus, retries);
+		}
+	}
+
+	/* Merge new bits with previous */
+	intstatus |= newstatus;
+	bus->intstatus = 0;
+
+	/* Handle flow-control change: read new state in case our ack
+	 * crossed another change interrupt.  If change still set, assume
+	 * FC ON for safety, let next loop through do the debounce.
+	 */
+	if (intstatus & I_HMB_FC_CHANGE) {
+		intstatus &= ~I_HMB_FC_CHANGE;
+		W_SDREG(I_HMB_FC_CHANGE, &regs->intstatus, retries);
+		R_SDREG(newstatus, &regs->intstatus, retries);
+		bus->f1regdata += 2;
+		bus->fcstate = !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
+		intstatus |= (newstatus & bus->hostintmask);
+	}
+
+	/* Just being here means nothing more to do for chipactive */
+	if (intstatus & I_CHIPACTIVE) {
+		/* ASSERT(bus->clkstate == CLK_AVAIL); */
+		intstatus &= ~I_CHIPACTIVE;
+	}
+
+	/* Handle host mailbox indication */
+	if (intstatus & I_HMB_HOST_INT) {
+		intstatus &= ~I_HMB_HOST_INT;
+		intstatus |= dhdsdio_hostmail(bus);
+	}
+
+	/* Generally don't ask for these, can get CRC errors... */
+	if (intstatus & I_WR_OOSYNC) {
+		DHD_ERROR(("Dongle reports WR_OOSYNC\n"));
+		intstatus &= ~I_WR_OOSYNC;
+	}
+
+	if (intstatus & I_RD_OOSYNC) {
+		DHD_ERROR(("Dongle reports RD_OOSYNC\n"));
+		intstatus &= ~I_RD_OOSYNC;
+	}
+
+	if (intstatus & I_SBINT) {
+		DHD_ERROR(("Dongle reports SBINT\n"));
+		intstatus &= ~I_SBINT;
+	}
+
+	/* Would be active due to wake-wlan in gSPI */
+	if (intstatus & I_CHIPACTIVE) {
+		DHD_INFO(("Dongle reports CHIPACTIVE\n"));
+		intstatus &= ~I_CHIPACTIVE;
+	}
+
+	if (intstatus & I_HMB_FC_STATE) {
+		DHD_INFO(("Dongle reports HMB_FC_STATE\n"));
+		intstatus &= ~I_HMB_FC_STATE;
+	}
+
+	/* Ignore frame indications if rxskip is set */
+	if (bus->rxskip) {
+		intstatus &= ~FRAME_AVAIL_MASK(bus);
+	}
+
+	/* On frame indication, read available frames */
+	if (PKT_AVAILABLE(bus, intstatus)) {
+		framecnt = dhdsdio_readframes(bus, rxlimit, &rxdone);
+		if (rxdone || bus->rxskip)
+			intstatus  &= ~FRAME_AVAIL_MASK(bus);
+		rxlimit -= MIN(framecnt, rxlimit);
+	}
+
+	/* Keep still-pending events for next scheduling */
+	bus->intstatus = intstatus;
+
+clkwait:
+	/* Re-enable interrupts to detect new device events (mailbox, rx frame)
+	 * or clock availability.  (Allows tx loop to check ipend if desired.)
+	 * (Unless register access seems hosed, as we may not be able to ACK...)
+	 */
+	if (bus->intr && bus->intdis && !bcmsdh_regfail(sdh)) {
+		DHD_INTR(("%s: enable SDIO interrupts, rxdone %d framecnt %d\n",
+		          __FUNCTION__, rxdone, framecnt));
+		bus->intdis = FALSE;
+#if defined(OOB_INTR_ONLY)
+		bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif /* defined(OOB_INTR_ONLY) */
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+		bcmsdh_intr_enable(sdh);
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+	}
+
+#if defined(OOB_INTR_ONLY) && !defined(HW_OOB)
+	/* In case of SW-OOB(using edge trigger),
+	 * Check interrupt status in the dongle again after enable irq on the host.
+	 * and rechedule dpc if interrupt is pended in the dongle.
+	 * There is a chance to miss OOB interrupt while irq is disabled on the host.
+	 * No need to do this with HW-OOB(level trigger)
+	 */
+	R_SDREG(newstatus, &regs->intstatus, retries);
+	if (bcmsdh_regfail(bus->sdh))
+		newstatus = 0;
+	if (newstatus & bus->hostintmask) {
+		bus->ipend = TRUE;
+		resched = TRUE;
+	}
+#endif /* defined(OOB_INTR_ONLY) && !defined(HW_OOB) */
+
+#ifdef PROP_TXSTATUS
+	dhd_wlfc_commit_packets(bus->dhd, (f_commitpkt_t)dhd_bus_txdata, (void *)bus, NULL, FALSE);
+#endif
+
+	if (TXCTLOK(bus) && bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL))
+		dhdsdio_sendpendctl(bus);
+
+	/* Send queued frames (limit 1 if rx may still be pending) */
+	else if ((bus->clkstate == CLK_AVAIL) && !bus->fcstate &&
+	    pktq_mlen(&bus->txq, ~bus->flowcontrol) && txlimit && DATAOK(bus)) {
+		framecnt = rxdone ? txlimit : MIN(txlimit, dhd_txminmax);
+		framecnt = dhdsdio_sendfromq(bus, framecnt);
+		txlimit -= framecnt;
+	}
+	/* Resched the DPC if ctrl cmd is pending on bus credit */
+	if (bus->ctrl_frame_stat)
+		resched = TRUE;
+
+	/* Resched if events or tx frames are pending, else await next interrupt */
+	/* On failed register access, all bets are off: no resched or interrupts */
+	if ((bus->dhd->busstate == DHD_BUS_DOWN) || bcmsdh_regfail(sdh)) {
+		if ((bus->sih && bus->sih->buscorerev >= 12) && !(dhdsdio_sleepcsr_get(bus) &
+			SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
+			/* Bus failed because of KSO */
+			DHD_ERROR(("%s: Bus failed due to KSO\n", __FUNCTION__));
+			bus->kso = FALSE;
+		} else {
+			DHD_ERROR(("%s: failed backplane access over SDIO, halting operation\n",
+				__FUNCTION__));
+			bus->dhd->busstate = DHD_BUS_DOWN;
+			bus->intstatus = 0;
+		}
+	} else if (bus->clkstate == CLK_PENDING) {
+		/* Awaiting I_CHIPACTIVE; don't resched */
+	} else if (bus->intstatus || bus->ipend ||
+	           (!bus->fcstate && pktq_mlen(&bus->txq, ~bus->flowcontrol) && DATAOK(bus)) ||
+			PKT_AVAILABLE(bus, bus->intstatus)) {  /* Read multiple frames */
+		resched = TRUE;
+	}
+
+	bus->dpc_sched = resched;
+
+	/* If we're done for now, turn off clock request. */
+	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && (bus->clkstate != CLK_PENDING)) {
+		bus->activity = FALSE;
+		dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+	}
+
+exit:
+
+	if (!resched && dhd_dpcpoll) {
+		if (dhdsdio_readframes(bus, dhd_rxbound, &rxdone) != 0)
+			resched = TRUE;
+	}
+
+	dhd_os_sdunlock(bus->dhd);
+	return resched;
+}
+
+bool
+dhd_bus_dpc(struct dhd_bus *bus)
+{
+	bool resched;
+
+	/* Call the DPC directly. */
+	DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+	resched = dhdsdio_dpc(bus);
+
+	return resched;
+}
+
+void
+dhdsdio_isr(void *arg)
+{
+	dhd_bus_t *bus = (dhd_bus_t*)arg;
+	bcmsdh_info_t *sdh;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (!bus) {
+		DHD_ERROR(("%s : bus is null pointer , exit \n", __FUNCTION__));
+		return;
+	}
+	sdh = bus->sdh;
+
+	if (bus->dhd->busstate == DHD_BUS_DOWN) {
+		DHD_ERROR(("%s : bus is down. we have nothing to do\n", __FUNCTION__));
+		return;
+	}
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	/* Count the interrupt call */
+	bus->intrcount++;
+	bus->ipend = TRUE;
+
+	/* Shouldn't get this interrupt if we're sleeping? */
+	if (!SLPAUTO_ENAB(bus)) {
+		if (bus->sleeping) {
+			DHD_ERROR(("INTERRUPT WHILE SLEEPING??\n"));
+			return;
+		} else if (!KSO_ENAB(bus)) {
+			DHD_ERROR(("ISR in devsleep 1\n"));
+		}
+	}
+
+	/* Disable additional interrupts (is this needed now)? */
+	if (bus->intr) {
+		DHD_INTR(("%s: disable SDIO interrupts\n", __FUNCTION__));
+	} else {
+		DHD_ERROR(("dhdsdio_isr() w/o interrupt configured!\n"));
+	}
+
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+	bcmsdh_intr_disable(sdh);
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+	bus->intdis = TRUE;
+
+#if defined(SDIO_ISR_THREAD)
+	DHD_TRACE(("Calling dhdsdio_dpc() from %s\n", __FUNCTION__));
+	DHD_OS_WAKE_LOCK(bus->dhd);
+	/* terence 20150209: dpc should be scheded again if dpc_sched is TRUE or dhd_bus_txdata can
+	    not schedule anymore because dpc_sched is TRUE now.
+	 */
+	if (dhdsdio_dpc(bus)) {
+		bus->dpc_sched = TRUE;
+		dhd_sched_dpc(bus->dhd);
+	}
+	DHD_OS_WAKE_UNLOCK(bus->dhd);
+#else
+
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+	bus->dpc_sched = TRUE;
+	dhd_sched_dpc(bus->dhd);
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+
+#endif /* defined(SDIO_ISR_THREAD) */
+
+}
+
+#ifdef SDTEST
+static void
+dhdsdio_pktgen_init(dhd_bus_t *bus)
+{
+	/* Default to specified length, or full range */
+	if (dhd_pktgen_len) {
+		bus->pktgen_maxlen = MIN(dhd_pktgen_len, MAX_PKTGEN_LEN);
+		bus->pktgen_minlen = bus->pktgen_maxlen;
+	} else {
+		bus->pktgen_maxlen = MAX_PKTGEN_LEN;
+		bus->pktgen_minlen = 0;
+	}
+	bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+	/* Default to per-watchdog burst with 10s print time */
+	bus->pktgen_freq = 1;
+	bus->pktgen_print = dhd_watchdog_ms ? (10000 / dhd_watchdog_ms) : 0;
+	bus->pktgen_count = (dhd_pktgen * dhd_watchdog_ms + 999) / 1000;
+
+	/* Default to echo mode */
+	bus->pktgen_mode = DHD_PKTGEN_ECHO;
+	bus->pktgen_stop = 1;
+}
+
+static void
+dhdsdio_pktgen(dhd_bus_t *bus)
+{
+	void *pkt;
+	uint8 *data;
+	uint pktcount;
+	uint fillbyte;
+	osl_t *osh = bus->dhd->osh;
+	uint16 len;
+	ulong time_lapse;
+	uint sent_pkts;
+	uint rcvd_pkts;
+
+	/* Display current count if appropriate */
+	if (bus->pktgen_print && (++bus->pktgen_ptick >= bus->pktgen_print)) {
+		bus->pktgen_ptick = 0;
+		printf("%s: send attempts %d, rcvd %d, errors %d\n",
+		       __FUNCTION__, bus->pktgen_sent, bus->pktgen_rcvd, bus->pktgen_fail);
+
+		/* Print throughput stats only for constant length packet runs */
+		if (bus->pktgen_minlen == bus->pktgen_maxlen) {
+			time_lapse = jiffies - bus->pktgen_prev_time;
+			bus->pktgen_prev_time = jiffies;
+			sent_pkts = bus->pktgen_sent - bus->pktgen_prev_sent;
+			bus->pktgen_prev_sent = bus->pktgen_sent;
+			rcvd_pkts = bus->pktgen_rcvd - bus->pktgen_prev_rcvd;
+			bus->pktgen_prev_rcvd = bus->pktgen_rcvd;
+
+			printf("%s: Tx Throughput %d kbps, Rx Throughput %d kbps\n",
+			  __FUNCTION__,
+			  (sent_pkts * bus->pktgen_len / jiffies_to_msecs(time_lapse)) * 8,
+			  (rcvd_pkts * bus->pktgen_len  / jiffies_to_msecs(time_lapse)) * 8);
+		}
+	}
+
+	/* For recv mode, just make sure dongle has started sending */
+	if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+		if (bus->pktgen_rcv_state == PKTGEN_RCV_IDLE) {
+			bus->pktgen_rcv_state = PKTGEN_RCV_ONGOING;
+			dhdsdio_sdtest_set(bus, bus->pktgen_total);
+		}
+		return;
+	}
+
+	/* Otherwise, generate or request the specified number of packets */
+	for (pktcount = 0; pktcount < bus->pktgen_count; pktcount++) {
+		/* Stop if total has been reached */
+		if (bus->pktgen_total && (bus->pktgen_sent >= bus->pktgen_total)) {
+			bus->pktgen_count = 0;
+			break;
+		}
+
+		/* Allocate an appropriate-sized packet */
+		if (bus->pktgen_mode == DHD_PKTGEN_RXBURST) {
+			len = SDPCM_TEST_PKT_CNT_FLD_LEN;
+		} else {
+			len = bus->pktgen_len;
+		}
+		if (!(pkt = PKTGET(osh, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN + DHD_SDALIGN),
+		                   TRUE))) {;
+			DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+			break;
+		}
+		PKTALIGN(osh, pkt, (len + SDPCM_HDRLEN + SDPCM_TEST_HDRLEN), DHD_SDALIGN);
+		data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+		/* Write test header cmd and extra based on mode */
+		switch (bus->pktgen_mode) {
+		case DHD_PKTGEN_ECHO:
+			*data++ = SDPCM_TEST_ECHOREQ;
+			*data++ = (uint8)bus->pktgen_sent;
+			break;
+
+		case DHD_PKTGEN_SEND:
+			*data++ = SDPCM_TEST_DISCARD;
+			*data++ = (uint8)bus->pktgen_sent;
+			break;
+
+		case DHD_PKTGEN_RXBURST:
+			*data++ = SDPCM_TEST_BURST;
+			*data++ = (uint8)bus->pktgen_count; /* Just for backward compatability */
+			break;
+
+		default:
+			DHD_ERROR(("Unrecognized pktgen mode %d\n", bus->pktgen_mode));
+			PKTFREE(osh, pkt, TRUE);
+			bus->pktgen_count = 0;
+			return;
+		}
+
+		/* Write test header length field */
+		*data++ = (bus->pktgen_len >> 0);
+		*data++ = (bus->pktgen_len >> 8);
+
+		/* Write frame count in a 4 byte field adjucent to SDPCM test header for
+		 * burst mode
+		 */
+		if (bus->pktgen_mode == DHD_PKTGEN_RXBURST) {
+			*data++ = (uint8)(bus->pktgen_count >> 0);
+			*data++ = (uint8)(bus->pktgen_count >> 8);
+			*data++ = (uint8)(bus->pktgen_count >> 16);
+			*data++ = (uint8)(bus->pktgen_count >> 24);
+		} else {
+
+			/* Then fill in the remainder -- N/A for burst */
+			for (fillbyte = 0; fillbyte < len; fillbyte++)
+				*data++ = SDPCM_TEST_FILL(fillbyte, (uint8)bus->pktgen_sent);
+		}
+
+#ifdef DHD_DEBUG
+		if (DHD_BYTES_ON() && DHD_DATA_ON()) {
+			data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+			prhex("dhdsdio_pktgen: Tx Data", data, PKTLEN(osh, pkt) - SDPCM_HDRLEN);
+		}
+#endif
+
+		/* Send it */
+		if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) != BCME_OK) {
+			bus->pktgen_fail++;
+			if (bus->pktgen_stop && bus->pktgen_stop == bus->pktgen_fail)
+				bus->pktgen_count = 0;
+		}
+		bus->pktgen_sent++;
+
+		/* Bump length if not fixed, wrap at max */
+		if (++bus->pktgen_len > bus->pktgen_maxlen)
+			bus->pktgen_len = (uint16)bus->pktgen_minlen;
+
+		/* Special case for burst mode: just send one request! */
+		if (bus->pktgen_mode == DHD_PKTGEN_RXBURST)
+			break;
+	}
+}
+
+static void
+dhdsdio_sdtest_set(dhd_bus_t *bus, uint count)
+{
+	void *pkt;
+	uint8 *data;
+	osl_t *osh = bus->dhd->osh;
+
+	/* Allocate the packet */
+	if (!(pkt = PKTGET(osh, SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+		SDPCM_TEST_PKT_CNT_FLD_LEN + DHD_SDALIGN, TRUE))) {
+		DHD_ERROR(("%s: PKTGET failed!\n", __FUNCTION__));
+		return;
+	}
+	PKTALIGN(osh, pkt, (SDPCM_HDRLEN + SDPCM_TEST_HDRLEN +
+		SDPCM_TEST_PKT_CNT_FLD_LEN), DHD_SDALIGN);
+	data = (uint8*)PKTDATA(osh, pkt) + SDPCM_HDRLEN;
+
+	/* Fill in the test header */
+	*data++ = SDPCM_TEST_SEND;
+	*data++ = (count > 0)?TRUE:FALSE;
+	*data++ = (bus->pktgen_maxlen >> 0);
+	*data++ = (bus->pktgen_maxlen >> 8);
+	*data++ = (uint8)(count >> 0);
+	*data++ = (uint8)(count >> 8);
+	*data++ = (uint8)(count >> 16);
+	*data++ = (uint8)(count >> 24);
+
+	/* Send it */
+	if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) != BCME_OK)
+		bus->pktgen_fail++;
+}
+
+
+static void
+dhdsdio_testrcv(dhd_bus_t *bus, void *pkt, uint seq)
+{
+	osl_t *osh = bus->dhd->osh;
+	uint8 *data;
+	uint pktlen;
+
+	uint8 cmd;
+	uint8 extra;
+	uint16 len;
+	uint16 offset;
+
+	/* Check for min length */
+	if ((pktlen = PKTLEN(osh, pkt)) < SDPCM_TEST_HDRLEN) {
+		DHD_ERROR(("dhdsdio_restrcv: toss runt frame, pktlen %d\n", pktlen));
+		PKTFREE(osh, pkt, FALSE);
+		return;
+	}
+
+	/* Extract header fields */
+	data = PKTDATA(osh, pkt);
+	cmd = *data++;
+	extra = *data++;
+	len = *data++; len += *data++ << 8;
+	DHD_TRACE(("%s:cmd:%d, xtra:%d,len:%d\n", __FUNCTION__, cmd, extra, len));
+	/* Check length for relevant commands */
+	if (cmd == SDPCM_TEST_DISCARD || cmd == SDPCM_TEST_ECHOREQ || cmd == SDPCM_TEST_ECHORSP) {
+		if (pktlen != len + SDPCM_TEST_HDRLEN) {
+			DHD_ERROR(("dhdsdio_testrcv: frame length mismatch, pktlen %d seq %d"
+			           " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+			PKTFREE(osh, pkt, FALSE);
+			return;
+		}
+	}
+
+	/* Process as per command */
+	switch (cmd) {
+	case SDPCM_TEST_ECHOREQ:
+		/* Rx->Tx turnaround ok (even on NDIS w/current implementation) */
+		*(uint8 *)(PKTDATA(osh, pkt)) = SDPCM_TEST_ECHORSP;
+		if (dhdsdio_txpkt(bus, SDPCM_TEST_CHANNEL, &pkt, 1, TRUE) == BCME_OK) {
+			bus->pktgen_sent++;
+		} else {
+			bus->pktgen_fail++;
+			PKTFREE(osh, pkt, FALSE);
+		}
+		bus->pktgen_rcvd++;
+		break;
+
+	case SDPCM_TEST_ECHORSP:
+		if (bus->ext_loop) {
+			PKTFREE(osh, pkt, FALSE);
+			bus->pktgen_rcvd++;
+			break;
+		}
+
+		for (offset = 0; offset < len; offset++, data++) {
+			if (*data != SDPCM_TEST_FILL(offset, extra)) {
+				DHD_ERROR(("dhdsdio_testrcv: echo data mismatch: "
+				           "offset %d (len %d) expect 0x%02x rcvd 0x%02x\n",
+				           offset, len, SDPCM_TEST_FILL(offset, extra), *data));
+				break;
+			}
+		}
+		PKTFREE(osh, pkt, FALSE);
+		bus->pktgen_rcvd++;
+		break;
+
+	case SDPCM_TEST_DISCARD:
+		{
+			int i = 0;
+			uint8 *prn = data;
+			uint8 testval = extra;
+			for (i = 0; i < len; i++) {
+				if (*prn != testval) {
+					DHD_ERROR(("DIErr@Pkt#:%d,Ix:%d, expected:0x%x, got:0x%x\n",
+						i, bus->pktgen_rcvd_rcvsession, testval, *prn));
+					prn++; testval++;
+				}
+			}
+		}
+		PKTFREE(osh, pkt, FALSE);
+		bus->pktgen_rcvd++;
+		break;
+
+	case SDPCM_TEST_BURST:
+	case SDPCM_TEST_SEND:
+	default:
+		DHD_INFO(("dhdsdio_testrcv: unsupported or unknown command, pktlen %d seq %d"
+		          " cmd %d extra %d len %d\n", pktlen, seq, cmd, extra, len));
+		PKTFREE(osh, pkt, FALSE);
+		break;
+	}
+
+	/* For recv mode, stop at limit (and tell dongle to stop sending) */
+	if (bus->pktgen_mode == DHD_PKTGEN_RECV) {
+		if (bus->pktgen_rcv_state != PKTGEN_RCV_IDLE) {
+			bus->pktgen_rcvd_rcvsession++;
+
+			if (bus->pktgen_total &&
+				(bus->pktgen_rcvd_rcvsession >= bus->pktgen_total)) {
+			bus->pktgen_count = 0;
+			DHD_ERROR(("Pktgen:rcv test complete!\n"));
+			bus->pktgen_rcv_state = PKTGEN_RCV_IDLE;
+			dhdsdio_sdtest_set(bus, FALSE);
+				bus->pktgen_rcvd_rcvsession = 0;
+			}
+		}
+	}
+}
+#endif /* SDTEST */
+
+int dhd_bus_oob_intr_register(dhd_pub_t *dhdp)
+{
+	int err = 0;
+
+#if defined(OOB_INTR_ONLY)
+	err = bcmsdh_oob_intr_register(dhdp->bus->sdh, dhdsdio_isr, dhdp->bus);
+#endif
+	return err;
+}
+
+void dhd_bus_oob_intr_unregister(dhd_pub_t *dhdp)
+{
+#if defined(OOB_INTR_ONLY)
+	bcmsdh_oob_intr_unregister(dhdp->bus->sdh);
+#endif
+}
+
+void dhd_bus_oob_intr_set(dhd_pub_t *dhdp, bool enable)
+{
+#if defined(OOB_INTR_ONLY)
+	bcmsdh_oob_intr_set(dhdp->bus->sdh, enable);
+#endif
+}
+
+void dhd_bus_dev_pm_stay_awake(dhd_pub_t *dhdpub)
+{
+	bcmsdh_dev_pm_stay_awake(dhdpub->bus->sdh);
+}
+
+void dhd_bus_dev_pm_relax(dhd_pub_t *dhdpub)
+{
+	bcmsdh_dev_relax(dhdpub->bus->sdh);
+}
+
+bool dhd_bus_dev_pm_enabled(dhd_pub_t *dhdpub)
+{
+	bool enabled = FALSE;
+
+	enabled = bcmsdh_dev_pm_enabled(dhdpub->bus->sdh);
+	return enabled;
+}
+
+extern bool
+dhd_bus_watchdog(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus;
+
+	DHD_TIMER(("%s: Enter\n", __FUNCTION__));
+
+	bus = dhdp->bus;
+
+	if (bus->dhd->dongle_reset)
+		return FALSE;
+
+	if (bus->dhd->hang_was_sent) {
+		dhd_os_wd_timer(bus->dhd, 0);
+		return FALSE;
+	}
+
+	/* Ignore the timer if simulating bus down */
+	if (!SLPAUTO_ENAB(bus) && bus->sleeping)
+		return FALSE;
+
+	if (dhdp->busstate == DHD_BUS_DOWN)
+		return FALSE;
+
+	dhd_os_sdlock(bus->dhd);
+
+	/* Poll period: check device if appropriate. */
+	if (!SLPAUTO_ENAB(bus) && (bus->poll && (++bus->polltick >= bus->pollrate))) {
+		uint32 intstatus = 0;
+
+		/* Reset poll tick */
+		bus->polltick = 0;
+
+		/* Check device if no interrupts */
+		if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
+
+			if (!bus->dpc_sched) {
+				uint8 devpend;
+				devpend = bcmsdh_cfg_read(bus->sdh, SDIO_FUNC_0,
+				                          SDIOD_CCCR_INTPEND, NULL);
+				intstatus = devpend & (INTR_STATUS_FUNC1 | INTR_STATUS_FUNC2);
+			}
+
+			/* If there is something, make like the ISR and schedule the DPC */
+			if (intstatus) {
+				bus->pollcnt++;
+				bus->ipend = TRUE;
+				if (bus->intr) {
+					bcmsdh_intr_disable(bus->sdh);
+				}
+				bus->dpc_sched = TRUE;
+				dhd_sched_dpc(bus->dhd);
+			}
+		}
+
+		/* Update interrupt tracking */
+		bus->lastintrs = bus->intrcount;
+	}
+
+#ifdef DHD_DEBUG
+	/* Poll for console output periodically */
+	if (dhdp->busstate == DHD_BUS_DATA && dhd_console_ms != 0) {
+		bus->console.count += dhd_watchdog_ms;
+		if (bus->console.count >= dhd_console_ms) {
+			bus->console.count -= dhd_console_ms;
+			/* Make sure backplane clock is on */
+			if (SLPAUTO_ENAB(bus))
+				dhdsdio_bussleep(bus, FALSE);
+			else
+			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+			if (dhdsdio_readconsole(bus) < 0)
+				dhd_console_ms = 0;	/* On error, stop trying */
+		}
+	}
+#endif /* DHD_DEBUG */
+
+#ifdef SDTEST
+	/* Generate packets if configured */
+	if (bus->pktgen_count && (++bus->pktgen_tick >= bus->pktgen_freq)) {
+		/* Make sure backplane clock is on */
+		if (SLPAUTO_ENAB(bus))
+			dhdsdio_bussleep(bus, FALSE);
+		else
+			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+		bus->pktgen_tick = 0;
+		dhdsdio_pktgen(bus);
+	}
+#endif
+
+	/* On idle timeout clear activity flag and/or turn off clock */
+#ifdef DHD_USE_IDLECOUNT
+	if (bus->activity)
+		bus->activity = FALSE;
+	else {
+		bus->idlecount++;
+
+		if ((bus->idletime > 0) && (bus->idlecount >= bus->idletime)) {
+			DHD_TIMER(("%s: DHD Idle state!!\n", __FUNCTION__));
+			if (SLPAUTO_ENAB(bus)) {
+				if (dhdsdio_bussleep(bus, TRUE) != BCME_BUSY)
+					dhd_os_wd_timer(bus->dhd, 0);
+			} else
+				dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+
+			bus->idlecount = 0;
+		}
+	}
+#else
+	if ((bus->idletime > 0) && (bus->clkstate == CLK_AVAIL)) {
+		if (++bus->idlecount >= bus->idletime) {
+			bus->idlecount = 0;
+			if (bus->activity) {
+				bus->activity = FALSE;
+				if (SLPAUTO_ENAB(bus)) {
+					if (!bus->readframes)
+						dhdsdio_bussleep(bus, TRUE);
+					else
+						bus->reqbussleep = TRUE;
+				}
+				else
+					dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+			}
+		}
+	}
+#endif /* DHD_USE_IDLECOUNT */
+
+	dhd_os_sdunlock(bus->dhd);
+
+	return bus->ipend;
+}
+
+#ifdef DHD_DEBUG
+extern int
+dhd_bus_console_in(dhd_pub_t *dhdp, uchar *msg, uint msglen)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	uint32 addr, val;
+	int rv;
+	void *pkt;
+
+	/* Address could be zero if CONSOLE := 0 in dongle Makefile */
+	if (bus->console_addr == 0)
+		return BCME_UNSUPPORTED;
+
+	/* Exclusive bus access */
+	dhd_os_sdlock(bus->dhd);
+
+	/* Don't allow input if dongle is in reset */
+	if (bus->dhd->dongle_reset) {
+		dhd_os_sdunlock(bus->dhd);
+		return BCME_NOTREADY;
+	}
+
+	/* Request clock to allow SDIO accesses */
+	BUS_WAKE(bus);
+	/* No pend allowed since txpkt is called later, ht clk has to be on */
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+	/* Zero cbuf_index */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf_idx);
+	val = htol32(0);
+	if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+		goto done;
+
+	/* Write message into cbuf */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, cbuf);
+	if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)msg, msglen)) < 0)
+		goto done;
+
+	/* Write length into vcons_in */
+	addr = bus->console_addr + OFFSETOF(hnd_cons_t, vcons_in);
+	val = htol32(msglen);
+	if ((rv = dhdsdio_membytes(bus, TRUE, addr, (uint8 *)&val, sizeof(val))) < 0)
+		goto done;
+
+	/* Bump dongle by sending an empty packet on the event channel.
+	 * sdpcm_sendup (RX) checks for virtual console input.
+	 */
+	if ((pkt = PKTGET(bus->dhd->osh, 4 + SDPCM_RESERVE, TRUE)) != NULL)
+		rv = dhdsdio_txpkt(bus, SDPCM_EVENT_CHANNEL, &pkt, 1, TRUE);
+
+done:
+	if ((bus->idletime == DHD_IDLE_IMMEDIATE) && !bus->dpc_sched) {
+		bus->activity = FALSE;
+		dhdsdio_clkctl(bus, CLK_NONE, TRUE);
+	}
+
+	dhd_os_sdunlock(bus->dhd);
+
+	return rv;
+}
+#endif /* DHD_DEBUG */
+
+#ifdef DHD_DEBUG
+static void
+dhd_dump_cis(uint fn, uint8 *cis)
+{
+	uint byte, tag, tdata;
+	DHD_INFO(("Function %d CIS:\n", fn));
+
+	for (tdata = byte = 0; byte < SBSDIO_CIS_SIZE_LIMIT; byte++) {
+		if ((byte % 16) == 0)
+			DHD_INFO(("    "));
+		DHD_INFO(("%02x ", cis[byte]));
+		if ((byte % 16) == 15)
+			DHD_INFO(("\n"));
+		if (!tdata--) {
+			tag = cis[byte];
+			if (tag == 0xff)
+				break;
+			else if (!tag)
+				tdata = 0;
+			else if ((byte + 1) < SBSDIO_CIS_SIZE_LIMIT)
+				tdata = cis[byte + 1] + 1;
+			else
+				DHD_INFO(("]"));
+		}
+	}
+	if ((byte % 16) != 15)
+		DHD_INFO(("\n"));
+}
+#endif /* DHD_DEBUG */
+
+static bool
+dhdsdio_chipmatch(uint16 chipid)
+{
+	if (chipid == BCM4325_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4329_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4315_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4319_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4336_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4330_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43237_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43362_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4314_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43242_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43340_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43341_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43143_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43342_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4334_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43239_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4324_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4335_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4339_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43349_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4345_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4350_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4354_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4356_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4358_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM4371_CHIP_ID)
+		return TRUE;
+	if (chipid == BCM43430_CHIP_ID)
+		return TRUE;
+	if (BCM4349_CHIP(chipid))
+		return TRUE;
+	return FALSE;
+}
+
+#if defined(MULTIPLE_SUPPLICANT)
+extern void wl_android_post_init(void); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#endif
+
+static void *
+dhdsdio_probe(uint16 venid, uint16 devid, uint16 bus_no, uint16 slot,
+	uint16 func, uint bustype, void *regsva, osl_t * osh, void *sdh)
+{
+	int ret;
+	dhd_bus_t *bus;
+	struct ether_addr ea_addr;
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	if (mutex_is_locked(&_dhd_sdio_mutex_lock_) == 0) {
+		DHD_ERROR(("%s : no mutex held. set lock\n", __FUNCTION__));
+	}
+	else {
+		DHD_ERROR(("%s : mutex is locked!. wait for unlocking\n", __FUNCTION__));
+	}
+	mutex_lock(&_dhd_sdio_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+
+	/* Init global variables at run-time, not as part of the declaration.
+	 * This is required to support init/de-init of the driver. Initialization
+	 * of globals as part of the declaration results in non-deterministic
+	 * behavior since the value of the globals may be different on the
+	 * first time that the driver is initialized vs subsequent initializations.
+	 */
+	dhd_txbound = DHD_TXBOUND;
+	dhd_rxbound = DHD_RXBOUND;
+	dhd_alignctl = TRUE;
+	sd1idle = TRUE;
+	dhd_readahead = TRUE;
+	retrydata = FALSE;
+#if !defined(PLATFORM_MPS)
+	dhd_doflow = FALSE;
+#else
+	dhd_doflow = TRUE;
+#endif /* OEM_ANDROID */
+	dhd_dongle_ramsize = 0;
+	dhd_txminmax = DHD_TXMINMAX;
+
+	forcealign = TRUE;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+	DHD_INFO(("%s: venid 0x%04x devid 0x%04x\n", __FUNCTION__, venid, devid));
+
+	/* We make assumptions about address window mappings */
+	ASSERT((uintptr)regsva == SI_ENUM_BASE);
+
+	/* BCMSDH passes venid and devid based on CIS parsing -- but low-power start
+	 * means early parse could fail, so here we should get either an ID
+	 * we recognize OR (-1) indicating we must request power first.
+	 */
+	/* Check the Vendor ID */
+	switch (venid) {
+		case 0x0000:
+		case VENDOR_BROADCOM:
+			break;
+		default:
+			DHD_ERROR(("%s: unknown vendor: 0x%04x\n",
+			           __FUNCTION__, venid));
+			goto forcereturn;
+	}
+
+	/* Check the Device ID and make sure it's one that we support */
+	switch (devid) {
+		case BCM4325_D11DUAL_ID:		/* 4325 802.11a/g id */
+		case BCM4325_D11G_ID:			/* 4325 802.11g 2.4Ghz band id */
+		case BCM4325_D11A_ID:			/* 4325 802.11a 5Ghz band id */
+			DHD_INFO(("%s: found 4325 Dongle\n", __FUNCTION__));
+			break;
+		case BCM4329_D11N_ID:		/* 4329 802.11n dualband device */
+		case BCM4329_D11N2G_ID:		/* 4329 802.11n 2.4G device */
+		case BCM4329_D11N5G_ID:		/* 4329 802.11n 5G device */
+		case 0x4329:
+			DHD_INFO(("%s: found 4329 Dongle\n", __FUNCTION__));
+			break;
+		case BCM4315_D11DUAL_ID:		/* 4315 802.11a/g id */
+		case BCM4315_D11G_ID:			/* 4315 802.11g id */
+		case BCM4315_D11A_ID:			/* 4315 802.11a id */
+			DHD_INFO(("%s: found 4315 Dongle\n", __FUNCTION__));
+			break;
+		case BCM4319_D11N_ID:			/* 4319 802.11n id */
+		case BCM4319_D11N2G_ID:			/* 4319 802.11n2g id */
+		case BCM4319_D11N5G_ID:			/* 4319 802.11n5g id */
+			DHD_INFO(("%s: found 4319 Dongle\n", __FUNCTION__));
+			break;
+		case 0:
+			DHD_INFO(("%s: allow device id 0, will check chip internals\n",
+			          __FUNCTION__));
+			break;
+
+		default:
+			DHD_ERROR(("%s: skipping 0x%04x/0x%04x, not a dongle\n",
+			           __FUNCTION__, venid, devid));
+			goto forcereturn;
+	}
+
+	if (osh == NULL) {
+		DHD_ERROR(("%s: osh is NULL!\n", __FUNCTION__));
+		goto forcereturn;
+	}
+
+	/* Allocate private bus interface state */
+	if (!(bus = MALLOC(osh, sizeof(dhd_bus_t)))) {
+		DHD_ERROR(("%s: MALLOC of dhd_bus_t failed\n", __FUNCTION__));
+		goto fail;
+	}
+	bzero(bus, sizeof(dhd_bus_t));
+	bus->sdh = sdh;
+	bus->cl_devid = (uint16)devid;
+	bus->bus = DHD_BUS;
+	bus->bus_num = bus_no;
+	bus->slot_num = slot;
+	bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
+	bus->usebufpool = FALSE; /* Use bufpool if allocated, else use locally malloced rxbuf */
+
+	/* attempt to attach to the dongle */
+	if (!(dhdsdio_probe_attach(bus, osh, sdh, regsva, devid))) {
+		DHD_ERROR(("%s: dhdsdio_probe_attach failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	/* Attach to the dhd/OS/network interface */
+	if (!(bus->dhd = dhd_attach(osh, bus, SDPCM_RESERVE))) {
+		DHD_ERROR(("%s: dhd_attach failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	/* Allocate buffers */
+	if (!(dhdsdio_probe_malloc(bus, osh, sdh))) {
+		DHD_ERROR(("%s: dhdsdio_probe_malloc failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	if (!(dhdsdio_probe_init(bus, osh, sdh))) {
+		DHD_ERROR(("%s: dhdsdio_probe_init failed\n", __FUNCTION__));
+		goto fail;
+	}
+
+	if (bus->intr) {
+		/* Register interrupt callback, but mask it (not operational yet). */
+		DHD_INTR(("%s: disable SDIO interrupts (not interested yet)\n", __FUNCTION__));
+		bcmsdh_intr_disable(sdh);
+		if ((ret = bcmsdh_intr_reg(sdh, dhdsdio_isr, bus)) != 0) {
+			DHD_ERROR(("%s: FAILED: bcmsdh_intr_reg returned %d\n",
+			           __FUNCTION__, ret));
+			goto fail;
+		}
+		DHD_INTR(("%s: registered SDIO interrupt function ok\n", __FUNCTION__));
+	} else {
+		DHD_INFO(("%s: SDIO interrupt function is NOT registered due to polling mode\n",
+		           __FUNCTION__));
+	}
+
+	DHD_INFO(("%s: completed!!\n", __FUNCTION__));
+
+	/* if firmware path present try to download and bring up bus */
+	bus->dhd->hang_report  = TRUE;
+#if 0 // terence 20150325: fix for WPA/WPA2 4-way handshake fail in hostapd
+	if (dhd_download_fw_on_driverload) {
+		if ((ret = dhd_bus_start(bus->dhd)) != 0) {
+			DHD_ERROR(("%s: dhd_bus_start failed\n", __FUNCTION__));
+				goto fail;
+		}
+	}
+#endif
+
+#ifdef GET_OTP_MAC_ENABLE
+	if (dhd_conf_get_mac(bus->dhd, sdh, ea_addr.octet)) {
+		DHD_TRACE(("%s: Can not read MAC address\n", __FUNCTION__));
+	} else
+		memcpy(bus->dhd->mac.octet, (void *)&ea_addr, ETHER_ADDR_LEN);
+#endif /* GET_CUSTOM_MAC_ENABLE */
+
+	/* Ok, have the per-port tell the stack we're open for business */
+	if (dhd_register_if(bus->dhd, 0, TRUE) != 0) {
+		DHD_ERROR(("%s: Net attach failed!!\n", __FUNCTION__));
+		goto fail;
+	}
+
+
+#if defined(MULTIPLE_SUPPLICANT)
+	wl_android_post_init(); // terence 20120530: fix critical section in dhd_open and dhdsdio_probe
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	mutex_unlock(&_dhd_sdio_mutex_lock_);
+	DHD_ERROR(("%s : the lock is released.\n", __FUNCTION__));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#endif
+
+	init_waitqueue_head(&bus->bus_sleep);
+
+	return bus;
+
+fail:
+	dhdsdio_release(bus, osh);
+
+forcereturn:
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	mutex_unlock(&_dhd_sdio_mutex_lock_);
+	DHD_ERROR(("%s : the lock is released.\n", __FUNCTION__));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#endif
+
+	return NULL;
+}
+
+#ifdef REGON_BP_HANG_FIX
+static int dhd_sdio_backplane_reset(struct dhd_bus *bus)
+{
+	uint32 temp = 0;
+	DHD_ERROR(("Resetting  the backplane to avoid failure in firmware download..\n"));
+
+	temp = bcmsdh_reg_read(bus->sdh, 0x180021e0, 4);
+	DHD_INFO(("SDIO Clk Control Reg = %x\n", temp));
+
+	/* Force HT req from PMU */
+	bcmsdh_reg_write(bus->sdh, 0x18000644, 4, 0x6000005);
+
+	/* Increase the clock stretch duration. */
+	bcmsdh_reg_write(bus->sdh, 0x18000630, 4, 0xC8FFC8);
+
+	/* Setting ALP clock request in SDIOD clock control status register */
+	bcmsdh_reg_write(bus->sdh, 0x180021e0, 4, 0x41);
+
+	/* Allowing clock from SR engine to SR memory */
+	bcmsdh_reg_write(bus->sdh, 0x18004400, 4, 0xf92f1);
+	/* Disabling SR Engine before SR binary download. */
+	bcmsdh_reg_write(bus->sdh, 0x18000650, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18000654, 4, 0x0);
+
+	/* Enabling clock from backplane to SR memory */
+	bcmsdh_reg_write(bus->sdh, 0x18004400, 4, 0xf9af1);
+
+	/* Initializing SR memory address register in SOCRAM */
+	bcmsdh_reg_write(bus->sdh, 0x18004408, 4, 0x0);
+
+	/* Downloading the SR binary */
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0xc0002000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x80008000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x1051f080);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x80008000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x1050f080);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x80008000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x1050f080);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x80008000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x1050f080);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000004);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000604);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00001604);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00001404);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a08c80);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010001);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x14a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00011404);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00002000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x04a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00002000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0xf8000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00002000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x04a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00002000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0xf8000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00011604);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010604);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010004);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x14a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000004);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010001);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x14a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010004);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00010000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x14a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x30a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000008);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x04a00000);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0x00000008);
+	bcmsdh_reg_write(bus->sdh, 0x1800440c, 4, 0xfc000000);
+	/* SR Binary Download complete */
+
+	/* Allowing clock from SR engine to SR memory */
+	bcmsdh_reg_write(bus->sdh, 0x18004400, 4, 0xf92f1);
+
+	/* Turning ON SR Engine to initiate backplane reset  Repeated ?? Maharana */
+	bcmsdh_reg_write(bus->sdh, 0x18000650, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18000654, 4, 0x0);
+	bcmsdh_reg_write(bus->sdh, 0x18000650, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18000654, 4, 0x2);
+	bcmsdh_reg_write(bus->sdh, 0x18000650, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18000654, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18000650, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18000654, 4, 0x37);
+	bcmsdh_reg_write(bus->sdh, 0x18000650, 4, 0x3);
+	temp = bcmsdh_reg_read(bus->sdh, 0x18000654, 4);
+	DHD_INFO(("0x18000654 = %x\n", temp));
+	bcmsdh_reg_write(bus->sdh, 0x18000654, 4, 0x800037);
+	OSL_DELAY(100000);
+	/* Rolling back the original values for clock stretch and PMU timers */
+	bcmsdh_reg_write(bus->sdh, 0x18000644, 4, 0x0);
+	bcmsdh_reg_write(bus->sdh, 0x18000630, 4, 0xC800C8);
+	/* Removing ALP clock request in SDIOD clock control status register */
+	bcmsdh_reg_write(bus->sdh, 0x180021e0, 4, 0x40);
+	OSL_DELAY(10000);
+	return TRUE;
+}
+
+static int dhdsdio_sdio_hang_war(struct dhd_bus *bus)
+{
+	uint32 temp = 0, temp2 = 0, counter = 0, BT_pwr_up = 0, BT_ready = 0;
+	/* Removing reset of D11 Core */
+	bcmsdh_reg_write(bus->sdh, 0x18101408, 4, 0x3);
+	bcmsdh_reg_write(bus->sdh, 0x18101800, 4, 0x0);
+	bcmsdh_reg_write(bus->sdh, 0x18101408, 4, 0x1);
+	/* Reading CLB XTAL BT cntrl register */
+	bcmsdh_reg_write(bus->sdh, 0x180013D8, 2, 0xD1);
+	bcmsdh_reg_write(bus->sdh, 0x180013DA, 2, 0x12);
+	bcmsdh_reg_write(bus->sdh, 0x180013D8, 2, 0x2D0);
+	/* Read if BT is powered up */
+	temp = bcmsdh_reg_read(bus->sdh, 0x180013DA, 2);
+	/* Read BT_ready from WLAN wireless register */
+	temp2 = bcmsdh_reg_read(bus->sdh, 0x1800002C, 4);
+	/*
+	Check if the BT is powered up and ready. The duration between BT being powered up
+	and BT becoming ready is the problematic window for WLAN. If we move ahead at this
+	time then we may encounter a corrupted backplane later. So we wait for BT to be ready
+	and then proceed after checking the health of the backplane. If the backplane shows
+	indications of failure then we	have to do a full reset of the backplane using SR engine
+	and then proceed.
+	*/
+	(temp & 0xF0) ? (BT_pwr_up = 1):(BT_pwr_up = 0);
+	(temp2 & (1<<17)) ? (BT_ready = 1):(BT_ready = 0);
+	DHD_ERROR(("WARNING: Checking if BT is ready BT_pwr_up = %x"
+		"BT_ready = %x \n", BT_pwr_up, BT_ready));
+	while (BT_pwr_up && !BT_ready)
+	{
+		OSL_DELAY(1000);
+		bcmsdh_reg_write(bus->sdh, 0x180013D8, 2, 0x2D0);
+		temp = bcmsdh_reg_read(bus->sdh, 0x180013DA, 2);
+		temp2 = bcmsdh_reg_read(bus->sdh, 0x1800002C, 4);
+		(temp & 0xF0) ? (BT_pwr_up = 1):(BT_pwr_up = 0);
+		(temp2 & (1<<17)) ? (BT_ready = 1):(BT_ready = 0);
+		counter++;
+		if (counter == 5000)
+		{
+			DHD_ERROR(("WARNING: Going ahead after 5 secs with"
+					"risk of failure because BT ready is not yet set\n"));
+			break;
+		}
+	}
+	DHD_ERROR(("\nWARNING: WL Proceeding BT_pwr_up = %x BT_ready = %x"
+			"\n", BT_pwr_up, BT_ready));
+	counter = 0;
+	OSL_DELAY(10000);
+	/*
+	Get the information of who accessed the crucial backplane entities
+	by reading read and write access registers
+	*/
+	DHD_TRACE(("%d: Read Value @ 0x18104808 = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18104808, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810480C = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810480C, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x18106808 = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18106808, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810680C = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810680C, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x18107808 = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18107808, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810780C = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810780C, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x18108808 = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18108808, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810880C = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810880C, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x18109808 = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18109808, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810980C = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810980C, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810C808 = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810c808, 4)));
+	DHD_TRACE(("%d: Read Value @ 0x1810C80C = %x."
+			"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810c80C, 4)));
+	counter = 0;
+	while ((bcmsdh_reg_read(bus->sdh, 0x18104808, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810480C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x18106808, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810680C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810780C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810780C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810880C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810880C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810980C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810980C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810C80C, 4) == 5) ||
+		(bcmsdh_reg_read(bus->sdh, 0x1810C80C, 4) == 5))
+	{
+		if (++counter > 10)
+		{
+			DHD_ERROR(("Unable to recover the backkplane corruption"
+					"..Tried %d times.. Exiting\n", counter));
+			break;
+		}
+		OSL_DELAY(10000);
+		dhd_sdio_backplane_reset(bus);
+		/*
+		Get the information of who accessed the crucial backplane
+		entities by reading read and write access registers
+		*/
+		DHD_ERROR(("%d: Read Value @ 0x18104808 = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18104808, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810480C = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810480C, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x18106808 = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18106808, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810680C = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810680C, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x18107808 = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18107808, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810780C = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810780C, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x18108808 = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18108808, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810880C = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810880C, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x18109808 = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x18109808, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810980C = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810980C, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810C808 = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810c808, 4)));
+		DHD_ERROR(("%d: Read Value @ 0x1810C80C = %x."
+				"\n", __LINE__, bcmsdh_reg_read(bus->sdh, 0x1810c80C, 4)));
+	}
+	/* Set the WL ready to indicate BT that we are done with backplane reset */
+	DHD_ERROR(("Setting up AXI_OK\n"));
+	bcmsdh_reg_write(bus->sdh, 0x18000658, 4, 0x3);
+	temp = bcmsdh_reg_read(bus->sdh, 0x1800065c, 4);
+	temp |= 0x80000000;
+	bcmsdh_reg_write(bus->sdh, 0x1800065c, 4, temp);
+	return TRUE;
+}
+#endif /* REGON_BP_HANG_FIX */
+static bool
+dhdsdio_probe_attach(struct dhd_bus *bus, osl_t *osh, void *sdh, void *regsva,
+                     uint16 devid)
+{
+	int err = 0;
+	uint8 clkctl = 0;
+
+	bus->alp_only = TRUE;
+	bus->sih = NULL;
+
+	/* Return the window to backplane enumeration space for core access */
+	if (dhdsdio_set_siaddr_window(bus, SI_ENUM_BASE)) {
+		DHD_ERROR(("%s: FAILED to return to SI_ENUM_BASE\n", __FUNCTION__));
+	}
+
+#if defined(DHD_DEBUG)
+	DHD_ERROR(("F1 signature read @0x18000000=0x%4x\n",
+		bcmsdh_reg_read(bus->sdh, SI_ENUM_BASE, 4)));
+#endif
+
+
+	/* Force PLL off until si_attach() programs PLL control regs */
+
+
+
+	bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, DHD_INIT_CLKCTL1, &err);
+	if (!err)
+		clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+
+	if (err || ((clkctl & ~SBSDIO_AVBITS) != DHD_INIT_CLKCTL1)) {
+		DHD_ERROR(("dhdsdio_probe: ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
+		           err, DHD_INIT_CLKCTL1, clkctl));
+		goto fail;
+	}
+
+#ifdef DHD_DEBUG
+	if (DHD_INFO_ON()) {
+		uint fn, numfn;
+		uint8 *cis[SDIOD_MAX_IOFUNCS];
+		int err = 0;
+
+		numfn = bcmsdh_query_iofnum(sdh);
+		ASSERT(numfn <= SDIOD_MAX_IOFUNCS);
+
+		/* Make sure ALP is available before trying to read CIS */
+		SPINWAIT(((clkctl = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+		                                    SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+		          !SBSDIO_ALPAV(clkctl)), PMU_MAX_TRANSITION_DLY);
+
+		/* Now request ALP be put on the bus */
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+		                 DHD_INIT_CLKCTL2, &err);
+		OSL_DELAY(65);
+
+		for (fn = 0; fn <= numfn; fn++) {
+			if (!(cis[fn] = MALLOC(osh, SBSDIO_CIS_SIZE_LIMIT))) {
+				DHD_INFO(("dhdsdio_probe: fn %d cis malloc failed\n", fn));
+				break;
+			}
+			bzero(cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+
+			if ((err = bcmsdh_cis_read(sdh, fn, cis[fn], SBSDIO_CIS_SIZE_LIMIT))) {
+				DHD_INFO(("dhdsdio_probe: fn %d cis read err %d\n", fn, err));
+				MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+				break;
+			}
+			dhd_dump_cis(fn, cis[fn]);
+		}
+
+		while (fn-- > 0) {
+			ASSERT(cis[fn]);
+			MFREE(osh, cis[fn], SBSDIO_CIS_SIZE_LIMIT);
+		}
+
+		if (err) {
+			DHD_ERROR(("dhdsdio_probe: failure reading or parsing CIS\n"));
+			goto fail;
+		}
+	}
+#endif /* DHD_DEBUG */
+
+	/* si_attach() will provide an SI handle and scan the backplane */
+	if (!(bus->sih = si_attach((uint)devid, osh, regsva, DHD_BUS, sdh,
+	                           &bus->vars, &bus->varsz))) {
+		DHD_ERROR(("%s: si_attach failed!\n", __FUNCTION__));
+		goto fail;
+	}
+
+#ifdef DHD_DEBUG
+	DHD_ERROR(("F1 signature OK, socitype:0x%x chip:0x%4x rev:0x%x pkg:0x%x\n",
+		bus->sih->socitype, bus->sih->chip, bus->sih->chiprev, bus->sih->chippkg));
+#endif /* DHD_DEBUG */
+
+#ifdef REGON_BP_HANG_FIX
+	/* WAR - for 43241 B0-B1-B2. B3 onwards do not need this */
+	if (((uint16)bus->sih->chip == BCM4324_CHIP_ID) && (bus->sih->chiprev < 3))
+			dhdsdio_sdio_hang_war(bus);
+#endif /* REGON_BP_HANG_FIX */
+
+	bcmsdh_chipinfo(sdh, bus->sih->chip, bus->sih->chiprev);
+
+	if (!dhdsdio_chipmatch((uint16)bus->sih->chip)) {
+		DHD_ERROR(("%s: unsupported chip: 0x%04x\n",
+		           __FUNCTION__, bus->sih->chip));
+		goto fail;
+	}
+
+	if (bus->sih->buscorerev >= 12)
+		dhdsdio_clk_kso_init(bus);
+	else
+		bus->kso = TRUE;
+
+	if (CST4330_CHIPMODE_SDIOD(bus->sih->chipst)) {
+	}
+
+	si_sdiod_drive_strength_init(bus->sih, osh, dhd_sdiod_drive_strength);
+
+
+	/* Get info on the ARM and SOCRAM cores... */
+	if (!DHD_NOPMU(bus)) {
+		if ((si_setcore(bus->sih, ARM7S_CORE_ID, 0)) ||
+		    (si_setcore(bus->sih, ARMCM3_CORE_ID, 0)) ||
+		    (si_setcore(bus->sih, ARMCR4_CORE_ID, 0))) {
+			bus->armrev = si_corerev(bus->sih);
+		} else {
+			DHD_ERROR(("%s: failed to find ARM core!\n", __FUNCTION__));
+			goto fail;
+		}
+
+		if (!si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			if (!(bus->orig_ramsize = si_socram_size(bus->sih))) {
+				DHD_ERROR(("%s: failed to find SOCRAM memory!\n", __FUNCTION__));
+				goto fail;
+			}
+		} else {
+			/* cr4 has a different way to find the RAM size from TCM's */
+			if (!(bus->orig_ramsize = si_tcm_size(bus->sih))) {
+				DHD_ERROR(("%s: failed to find CR4-TCM memory!\n", __FUNCTION__));
+				goto fail;
+			}
+			/* also populate base address */
+			switch ((uint16)bus->sih->chip) {
+			case BCM4335_CHIP_ID:
+			case BCM4339_CHIP_ID:
+			case BCM43349_CHIP_ID:
+				bus->dongle_ram_base = CR4_4335_RAM_BASE;
+				break;
+			case BCM4350_CHIP_ID:
+			case BCM4354_CHIP_ID:
+			case BCM4356_CHIP_ID:
+			case BCM4358_CHIP_ID:
+			case BCM4371_CHIP_ID:
+				bus->dongle_ram_base = CR4_4350_RAM_BASE;
+				break;
+			case BCM4360_CHIP_ID:
+				bus->dongle_ram_base = CR4_4360_RAM_BASE;
+				break;
+			case BCM4345_CHIP_ID:
+				bus->dongle_ram_base = (bus->sih->chiprev < 6)  /* from 4345C0 */
+					? CR4_4345_LT_C0_RAM_BASE : CR4_4345_GE_C0_RAM_BASE;
+				break;
+			case BCM4349_CHIP_GRPID:
+				bus->dongle_ram_base = CR4_4349_RAM_BASE;
+				break;
+			default:
+				bus->dongle_ram_base = 0;
+				DHD_ERROR(("%s: WARNING: Using default ram base at 0x%x\n",
+				           __FUNCTION__, bus->dongle_ram_base));
+			}
+		}
+		bus->ramsize = bus->orig_ramsize;
+		if (dhd_dongle_ramsize)
+			dhd_dongle_setramsize(bus, dhd_dongle_ramsize);
+
+		DHD_ERROR(("DHD: dongle ram size is set to %d(orig %d) at 0x%x\n",
+		           bus->ramsize, bus->orig_ramsize, bus->dongle_ram_base));
+
+		bus->srmemsize = si_socram_srmem_size(bus->sih);
+	}
+
+	/* ...but normally deal with the SDPCMDEV core */
+	if (!(bus->regs = si_setcore(bus->sih, PCMCIA_CORE_ID, 0)) &&
+	    !(bus->regs = si_setcore(bus->sih, SDIOD_CORE_ID, 0))) {
+		DHD_ERROR(("%s: failed to find SDIODEV core!\n", __FUNCTION__));
+		goto fail;
+	}
+	bus->sdpcmrev = si_corerev(bus->sih);
+
+	/* Set core control so an SDIO reset does a backplane reset */
+	OR_REG(osh, &bus->regs->corecontrol, CC_BPRESEN);
+	bus->rxint_mode = SDIO_DEVICE_HMB_RXINT;
+
+	if ((bus->sih->buscoretype == SDIOD_CORE_ID) && (bus->sdpcmrev >= 4) &&
+		(bus->rxint_mode  == SDIO_DEVICE_RXDATAINT_MODE_1))
+	{
+		uint32 val;
+
+		val = R_REG(osh, &bus->regs->corecontrol);
+		val &= ~CC_XMTDATAAVAIL_MODE;
+		val |= CC_XMTDATAAVAIL_CTRL;
+		W_REG(osh, &bus->regs->corecontrol, val);
+	}
+
+
+	pktq_init(&bus->txq, (PRIOMASK + 1), QLEN);
+
+	/* Locate an appropriately-aligned portion of hdrbuf */
+	bus->rxhdr = (uint8 *)ROUNDUP((uintptr)&bus->hdrbuf[0], DHD_SDALIGN);
+
+	/* Set the poll and/or interrupt flags */
+	bus->intr = (bool)dhd_intr;
+	if ((bus->poll = (bool)dhd_poll))
+		bus->pollrate = 1;
+
+	/* Setting default Glom size */
+	bus->txglomsize = SDPCM_DEFGLOM_SIZE;
+
+	return TRUE;
+
+fail:
+	if (bus->sih != NULL) {
+		si_detach(bus->sih);
+		bus->sih = NULL;
+	}
+	return FALSE;
+}
+
+static bool
+dhdsdio_probe_malloc(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd->maxctl) {
+		bus->rxblen = ROUNDUP((bus->dhd->maxctl+SDPCM_HDRLEN), ALIGNMENT) + DHD_SDALIGN;
+		if (!(bus->rxbuf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_RXBUF, bus->rxblen))) {
+			DHD_ERROR(("%s: MALLOC of %d-byte rxbuf failed\n",
+			           __FUNCTION__, bus->rxblen));
+			goto fail;
+		}
+	}
+	/* Allocate buffer to receive glomed packet */
+	if (!(bus->databuf = DHD_OS_PREALLOC(bus->dhd, DHD_PREALLOC_DATABUF, MAX_DATA_BUF))) {
+		DHD_ERROR(("%s: MALLOC of %d-byte databuf failed\n",
+			__FUNCTION__, MAX_DATA_BUF));
+		/* release rxbuf which was already located as above */
+		if (!bus->rxblen)
+			DHD_OS_PREFREE(bus->dhd, bus->rxbuf, bus->rxblen);
+		goto fail;
+	}
+
+	/* Align the buffer */
+	if ((uintptr)bus->databuf % DHD_SDALIGN)
+		bus->dataptr = bus->databuf + (DHD_SDALIGN - ((uintptr)bus->databuf % DHD_SDALIGN));
+	else
+		bus->dataptr = bus->databuf;
+
+	return TRUE;
+
+fail:
+	return FALSE;
+}
+
+static bool
+dhdsdio_probe_init(dhd_bus_t *bus, osl_t *osh, void *sdh)
+{
+	int32 fnum;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	bus->_srenab = FALSE;
+
+#ifdef SDTEST
+	dhdsdio_pktgen_init(bus);
+#endif /* SDTEST */
+
+	/* Disable F2 to clear any intermediate frame state on the dongle */
+	bcmsdh_cfg_write(sdh, SDIO_FUNC_0, SDIOD_CCCR_IOEN, SDIO_FUNC_ENABLE_1, NULL);
+
+	bus->dhd->busstate = DHD_BUS_DOWN;
+	bus->sleeping = FALSE;
+	bus->rxflow = FALSE;
+	bus->prev_rxlim_hit = 0;
+
+	/* Done with backplane-dependent accesses, can drop clock... */
+	bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+
+	/* ...and initialize clock/power states */
+	bus->clkstate = CLK_SDONLY;
+	bus->idletime = (int32)dhd_idletime;
+	bus->idleclock = DHD_IDLE_ACTIVE;
+
+	/* Query the SD clock speed */
+	if (bcmsdh_iovar_op(sdh, "sd_divisor", NULL, 0,
+	                    &bus->sd_divisor, sizeof(int32), FALSE) != BCME_OK) {
+		DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_divisor"));
+		bus->sd_divisor = -1;
+	} else {
+		DHD_INFO(("%s: Initial value for %s is %d\n",
+		          __FUNCTION__, "sd_divisor", bus->sd_divisor));
+	}
+
+	/* Query the SD bus mode */
+	if (bcmsdh_iovar_op(sdh, "sd_mode", NULL, 0,
+	                    &bus->sd_mode, sizeof(int32), FALSE) != BCME_OK) {
+		DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_mode"));
+		bus->sd_mode = -1;
+	} else {
+		DHD_INFO(("%s: Initial value for %s is %d\n",
+		          __FUNCTION__, "sd_mode", bus->sd_mode));
+	}
+
+	/* Query the F2 block size, set roundup accordingly */
+	fnum = 2;
+	if (bcmsdh_iovar_op(sdh, "sd_blocksize", &fnum, sizeof(int32),
+	                    &bus->blocksize, sizeof(int32), FALSE) != BCME_OK) {
+		bus->blocksize = 0;
+		DHD_ERROR(("%s: fail on %s get\n", __FUNCTION__, "sd_blocksize"));
+	} else {
+		DHD_INFO(("%s: Initial value for %s is %d\n",
+		          __FUNCTION__, "sd_blocksize", bus->blocksize));
+
+		dhdsdio_tune_fifoparam(bus);
+	}
+	bus->roundup = MIN(max_roundup, bus->blocksize);
+
+#ifdef DHDENABLE_TAILPAD
+	if (bus->pad_pkt)
+		PKTFREE(osh, bus->pad_pkt, FALSE);
+	bus->pad_pkt = PKTGET(osh, SDIO_MAX_BLOCK_SIZE, FALSE);
+	if (bus->pad_pkt == NULL)
+		DHD_ERROR(("failed to allocate padding packet\n"));
+	else {
+		int alignment_offset = 0;
+		uintptr pktprt = (uintptr)PKTDATA(osh, bus->pad_pkt);
+		if (!(pktprt&1) && (pktprt = (pktprt % DHD_SDALIGN)))
+			PKTPUSH(osh, bus->pad_pkt, alignment_offset);
+		PKTSETNEXT(osh, bus->pad_pkt, NULL);
+	}
+#endif /* DHDENABLE_TAILPAD */
+
+	/* Query if bus module supports packet chaining, default to use if supported */
+	if (bcmsdh_iovar_op(sdh, "sd_rxchain", NULL, 0,
+	                    &bus->sd_rxchain, sizeof(int32), FALSE) != BCME_OK) {
+		bus->sd_rxchain = FALSE;
+	} else {
+		DHD_INFO(("%s: bus module (through bcmsdh API) %s chaining\n",
+		          __FUNCTION__, (bus->sd_rxchain ? "supports" : "does not support")));
+	}
+	bus->use_rxchain = (bool)bus->sd_rxchain;
+	if (bus->dhd->conf->use_rxchain >= 0) {
+		printf("%s: set use_rxchain %d from config.txt\n", __FUNCTION__, bus->dhd->conf->use_rxchain);
+		bus->use_rxchain = (bool)bus->dhd->conf->use_rxchain;
+	}
+	/* Setting default Glom size */
+	if (bus->dhd->conf->txglomsize >= 0) {
+		printf("%s: set txglomsize %d from config.txt\n", __FUNCTION__, bus->dhd->conf->txglomsize);
+		bus->txglomsize = bus->dhd->conf->txglomsize;
+	}
+	bus->txinrx_thres = CUSTOM_TXINRX_THRES;
+	/* TX first in dhdsdio_readframes() */
+	bus->dotxinrx = TRUE;
+
+	return TRUE;
+}
+
+int
+dhd_bus_download_firmware(struct dhd_bus *bus, osl_t *osh,
+                          char *pfw_path, char *pnv_path, char *pconf_path)
+{
+	int ret;
+
+	bus->fw_path = pfw_path;
+	bus->nv_path = pnv_path;
+	bus->dhd->conf_path = pconf_path;
+
+	ret = dhdsdio_download_firmware(bus, osh, bus->sdh);
+
+
+	return ret;
+}
+
+static int
+dhdsdio_download_firmware(struct dhd_bus *bus, osl_t *osh, void *sdh)
+{
+	int ret;
+
+	DHD_TRACE_HW4(("%s: firmware path=%s, nvram path=%s\n",
+		__FUNCTION__, bus->fw_path, bus->nv_path));
+	DHD_OS_WAKE_LOCK(bus->dhd);
+
+	/* Download the firmware */
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+	/* External conf takes precedence if specified */
+	dhd_conf_preinit(bus->dhd);
+	dhd_conf_read_config(bus->dhd, bus->dhd->conf_path);
+	dhd_conf_set_fw_name_by_chip(bus->dhd, bus->fw_path);
+	dhd_conf_set_nv_name_by_chip(bus->dhd, bus->nv_path);
+	dhd_conf_set_fw_name_by_mac(bus->dhd, bus->sdh, bus->fw_path);
+	dhd_conf_set_nv_name_by_mac(bus->dhd, bus->sdh, bus->nv_path);
+
+	printf("Final fw_path=%s\n", bus->fw_path);
+	printf("Final nv_path=%s\n", bus->nv_path);
+	printf("Final conf_path=%s\n", bus->dhd->conf_path);
+
+	ret = _dhdsdio_download_firmware(bus);
+
+	dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+
+	DHD_OS_WAKE_UNLOCK(bus->dhd);
+	return ret;
+}
+
+/* Detach and free everything */
+static void
+dhdsdio_release(dhd_bus_t *bus, osl_t *osh)
+{
+	bool dongle_isolation = FALSE;
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus) {
+		ASSERT(osh);
+
+		if (bus->dhd) {
+			dongle_isolation = bus->dhd->dongle_isolation;
+			dhd_detach(bus->dhd);
+		}
+
+		/* De-register interrupt handler */
+		bcmsdh_intr_disable(bus->sdh);
+		bcmsdh_intr_dereg(bus->sdh);
+
+		if (bus->dhd) {
+			dhdsdio_release_dongle(bus, osh, dongle_isolation, TRUE);
+			dhd_free(bus->dhd);
+			bus->dhd = NULL;
+		}
+
+		dhdsdio_release_malloc(bus, osh);
+
+#ifdef DHD_DEBUG
+		if (bus->console.buf != NULL)
+			MFREE(osh, bus->console.buf, bus->console.bufsize);
+#endif
+
+#ifdef DHDENABLE_TAILPAD
+		if (bus->pad_pkt)
+			PKTFREE(osh, bus->pad_pkt, FALSE);
+#endif /* DHDENABLE_TAILPAD */
+
+		MFREE(osh, bus, sizeof(dhd_bus_t));
+	}
+
+	DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_release_malloc(dhd_bus_t *bus, osl_t *osh)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	if (bus->dhd && bus->dhd->dongle_reset)
+		return;
+
+	if (bus->rxbuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+		MFREE(osh, bus->rxbuf, bus->rxblen);
+#endif
+		bus->rxctl = bus->rxbuf = NULL;
+		bus->rxlen = 0;
+	}
+
+	if (bus->databuf) {
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+		MFREE(osh, bus->databuf, MAX_DATA_BUF);
+#endif
+		bus->databuf = NULL;
+	}
+
+	if (bus->vars && bus->varsz) {
+		MFREE(osh, bus->vars, bus->varsz);
+		bus->vars = NULL;
+	}
+
+}
+
+
+static void
+dhdsdio_release_dongle(dhd_bus_t *bus, osl_t *osh, bool dongle_isolation, bool reset_flag)
+{
+	DHD_TRACE(("%s: Enter bus->dhd %p bus->dhd->dongle_reset %d \n", __FUNCTION__,
+		bus->dhd, bus->dhd->dongle_reset));
+
+	if ((bus->dhd && bus->dhd->dongle_reset) && reset_flag)
+		return;
+
+	if (bus->sih) {
+#if !defined(BCMLXSDMMC)
+		if (bus->dhd) {
+			dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+		}
+		if (KSO_ENAB(bus) && (dongle_isolation == FALSE))
+			si_watchdog(bus->sih, 4);
+#endif /* !defined(BCMLXSDMMC) */
+		if (bus->dhd) {
+			dhdsdio_clkctl(bus, CLK_NONE, FALSE);
+		}
+		si_detach(bus->sih);
+		bus->sih = NULL;
+		if (bus->vars && bus->varsz)
+			MFREE(osh, bus->vars, bus->varsz);
+		bus->vars = NULL;
+	}
+
+	DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static void
+dhdsdio_disconnect(void *ptr)
+{
+	dhd_bus_t *bus = (dhd_bus_t *)ptr;
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	if (mutex_is_locked(&_dhd_sdio_mutex_lock_) == 0) {
+		DHD_ERROR(("%s : no mutex held. set lock\n", __FUNCTION__));
+	}
+	else {
+		DHD_ERROR(("%s : mutex is locked!. wait for unlocking\n", __FUNCTION__));
+	}
+	mutex_lock(&_dhd_sdio_mutex_lock_);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif
+
+
+	if (bus) {
+		ASSERT(bus->dhd);
+		dhdsdio_release(bus, bus->dhd->osh);
+	}
+
+#if defined(MULTIPLE_SUPPLICANT)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+	mutex_unlock(&_dhd_sdio_mutex_lock_);
+	DHD_ERROR(("%s : the lock is released.\n", __FUNCTION__));
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)) */
+#endif /* LINUX */
+
+
+	DHD_TRACE(("%s: Disconnected\n", __FUNCTION__));
+}
+
+static int
+dhdsdio_suspend(void *context)
+{
+	int ret = 0;
+
+	dhd_bus_t *bus = (dhd_bus_t*)context;
+	int wait_time = 0;
+	if (bus->idletime > 0) {
+		wait_time = msecs_to_jiffies(bus->idletime * dhd_watchdog_ms);
+	}
+
+	ret = dhd_os_check_wakelock(bus->dhd);
+	// terence 20141124: fix for suspend issue
+	if (SLPAUTO_ENAB(bus) && (!ret) && (bus->dhd->up)) {
+		if (wait_event_timeout(bus->bus_sleep, bus->sleeping, wait_time) == 0) {
+			if (!bus->sleeping) {
+				return 1;
+			}
+		}
+	}
+	return ret;
+}
+
+static int
+dhdsdio_resume(void *context)
+{
+#if defined(OOB_INTR_ONLY)
+	dhd_bus_t *bus = (dhd_bus_t*)context;
+
+	if (dhd_os_check_if_up(bus->dhd))
+		bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif
+	return 0;
+}
+
+
+/* Register/Unregister functions are called by the main DHD entry
+ * point (e.g. module insertion) to link with the bus driver, in
+ * order to look for or await the device.
+ */
+
+static bcmsdh_driver_t dhd_sdio = {
+	dhdsdio_probe,
+	dhdsdio_disconnect,
+	dhdsdio_suspend,
+	dhdsdio_resume
+};
+
+int
+dhd_bus_register(void)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	return bcmsdh_register(&dhd_sdio);
+}
+
+void
+dhd_bus_unregister(void)
+{
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	bcmsdh_unregister();
+}
+
+#if defined(BCMLXSDMMC)
+/* Register a dummy SDIO client driver in order to be notified of new SDIO device */
+int dhd_bus_reg_sdio_notify(void* semaphore)
+{
+	return bcmsdh_reg_sdio_notify(semaphore);
+}
+
+void dhd_bus_unreg_sdio_notify(void)
+{
+	bcmsdh_unreg_sdio_notify();
+}
+#endif /* defined(BCMLXSDMMC) */
+
+#ifdef BCMEMBEDIMAGE
+static int
+dhdsdio_download_code_array(struct dhd_bus *bus)
+{
+	int bcmerror = -1;
+	int offset = 0;
+	unsigned char *ularray = NULL;
+
+	DHD_INFO(("%s: download embedded firmware...\n", __FUNCTION__));
+
+	/* Download image */
+	while ((offset + MEMBLOCK) < sizeof(dlarray)) {
+		/* check if CR4 */
+		if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			/* if address is 0, store the reset instruction to be written in 0 */
+
+			if (offset == 0) {
+				bus->resetinstr = *(((uint32*)dlarray));
+				/* Add start of RAM address to the address given by user */
+				offset += bus->dongle_ram_base;
+			}
+		}
+
+		bcmerror = dhdsdio_membytes(bus, TRUE, offset,
+			(uint8 *) (dlarray + offset), MEMBLOCK);
+		if (bcmerror) {
+			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+			        __FUNCTION__, bcmerror, MEMBLOCK, offset));
+			goto err;
+		}
+
+		offset += MEMBLOCK;
+	}
+
+	if (offset < sizeof(dlarray)) {
+		bcmerror = dhdsdio_membytes(bus, TRUE, offset,
+			(uint8 *) (dlarray + offset), sizeof(dlarray) - offset);
+		if (bcmerror) {
+			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+			        __FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
+			goto err;
+		}
+	}
+
+#ifdef DHD_DEBUG
+	/* Upload and compare the downloaded code */
+	{
+		ularray = MALLOC(bus->dhd->osh, bus->ramsize);
+		/* Upload image to verify downloaded contents. */
+		offset = 0;
+		memset(ularray, 0xaa, bus->ramsize);
+		while ((offset + MEMBLOCK) < sizeof(dlarray)) {
+			bcmerror = dhdsdio_membytes(bus, FALSE, offset, ularray + offset, MEMBLOCK);
+			if (bcmerror) {
+				DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+					__FUNCTION__, bcmerror, MEMBLOCK, offset));
+				goto err;
+			}
+
+			offset += MEMBLOCK;
+		}
+
+		if (offset < sizeof(dlarray)) {
+			bcmerror = dhdsdio_membytes(bus, FALSE, offset,
+				ularray + offset, sizeof(dlarray) - offset);
+			if (bcmerror) {
+				DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+					__FUNCTION__, bcmerror, sizeof(dlarray) - offset, offset));
+				goto err;
+			}
+		}
+
+		if (memcmp(dlarray, ularray, sizeof(dlarray))) {
+			DHD_ERROR(("%s: Downloaded image is corrupted (%s, %s, %s).\n",
+			           __FUNCTION__, dlimagename, dlimagever, dlimagedate));
+			goto err;
+		} else
+			DHD_ERROR(("%s: Download, Upload and compare succeeded (%s, %s, %s).\n",
+			           __FUNCTION__, dlimagename, dlimagever, dlimagedate));
+
+	}
+#endif /* DHD_DEBUG */
+
+err:
+	if (ularray)
+		MFREE(bus->dhd->osh, ularray, bus->ramsize);
+	return bcmerror;
+}
+#endif /* BCMEMBEDIMAGE */
+
+static int
+dhdsdio_download_code_file(struct dhd_bus *bus, char *pfw_path)
+{
+	int bcmerror = -1;
+	int offset = 0;
+	int len;
+	void *image = NULL;
+	uint8 *memblock = NULL, *memptr;
+	uint8 *memptr_tmp = NULL; // terence: check downloaded firmware is correct
+
+	DHD_INFO(("%s: download firmware %s\n", __FUNCTION__, pfw_path));
+
+	image = dhd_os_open_image(pfw_path);
+	if (image == NULL) {
+		printf("%s: Open firmware file failed %s\n", __FUNCTION__, pfw_path);
+		goto err;
+	}
+
+	memptr = memblock = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+	if (memblock == NULL) {
+		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+		goto err;
+	}
+	if (dhd_msg_level & DHD_TRACE_VAL) {
+		memptr_tmp = MALLOC(bus->dhd->osh, MEMBLOCK + DHD_SDALIGN);
+		if (memptr_tmp == NULL) {
+			DHD_ERROR(("%s: Failed to allocate memory %d bytes\n", __FUNCTION__, MEMBLOCK));
+			goto err;
+		}
+	}
+	if ((uint32)(uintptr)memblock % DHD_SDALIGN)
+		memptr += (DHD_SDALIGN - ((uint32)(uintptr)memblock % DHD_SDALIGN));
+
+	/* Download image */
+	while ((len = dhd_os_get_image_block((char*)memptr, MEMBLOCK, image))) {
+		// terence 20150412: fix for firmware failed to download
+		if (bus->dhd->conf->chip == BCM43340_CHIP_ID ||
+				bus->dhd->conf->chip == BCM43341_CHIP_ID) {
+	    	if (len%64 != 0) {
+	            memset(memptr+len, 0, len%64);
+	            len += (64 - len%64);
+	        }
+		}
+		if (len < 0) {
+			DHD_ERROR(("%s: dhd_os_get_image_block failed (%d)\n", __FUNCTION__, len));
+			bcmerror = BCME_ERROR;
+			goto err;
+		}
+		/* check if CR4 */
+		if (si_setcore(bus->sih, ARMCR4_CORE_ID, 0)) {
+			/* if address is 0, store the reset instruction to be written in 0 */
+
+			if (offset == 0) {
+				bus->resetinstr = *(((uint32*)memptr));
+				/* Add start of RAM address to the address given by user */
+				offset += bus->dongle_ram_base;
+			}
+		}
+
+		bcmerror = dhdsdio_membytes(bus, TRUE, offset, memptr, len);
+		if (bcmerror) {
+			DHD_ERROR(("%s: error %d on writing %d membytes at 0x%08x\n",
+			        __FUNCTION__, bcmerror, MEMBLOCK, offset));
+			goto err;
+		}
+
+		if (dhd_msg_level & DHD_TRACE_VAL) {
+			bcmerror = dhdsdio_membytes(bus, FALSE, offset, memptr_tmp, len);
+			if (bcmerror) {
+				DHD_ERROR(("%s: error %d on reading %d membytes at 0x%08x\n",
+				        __FUNCTION__, bcmerror, MEMBLOCK, offset));
+				goto err;
+			}
+			if (memcmp(memptr_tmp, memptr, len)) {
+				DHD_ERROR(("%s: Downloaded image is corrupted.\n", __FUNCTION__));
+				goto err;
+			} else
+				DHD_INFO(("%s: Download, Upload and compare succeeded.\n", __FUNCTION__));
+		}
+		offset += MEMBLOCK;
+	}
+
+err:
+	if (memblock)
+		MFREE(bus->dhd->osh, memblock, MEMBLOCK + DHD_SDALIGN);
+	if (dhd_msg_level & DHD_TRACE_VAL) {
+		if (memptr_tmp)
+			MFREE(bus->dhd->osh, memptr_tmp, MEMBLOCK + DHD_SDALIGN);
+	}
+
+	if (image)
+		dhd_os_close_image(image);
+
+	return bcmerror;
+}
+
+/*
+	EXAMPLE: nvram_array
+	nvram_arry format:
+	name=value
+	Use carriage return at the end of each assignment, and an empty string with
+	carriage return at the end of array.
+
+	For example:
+	unsigned char  nvram_array[] = {"name1=value1\n", "name2=value2\n", "\n"};
+	Hex values start with 0x, and mac addr format: xx:xx:xx:xx:xx:xx.
+
+	Search "EXAMPLE: nvram_array" to see how the array is activated.
+*/
+
+void
+dhd_bus_set_nvram_params(struct dhd_bus * bus, const char *nvram_params)
+{
+	bus->nvram_params = nvram_params;
+}
+
+static int
+dhdsdio_download_nvram(struct dhd_bus *bus)
+{
+	int bcmerror = -1;
+	uint len;
+	void * image = NULL;
+	char * memblock = NULL;
+	char *bufp;
+	char *pnv_path;
+	bool nvram_file_exists;
+
+	pnv_path = bus->nv_path;
+
+	nvram_file_exists = ((pnv_path != NULL) && (pnv_path[0] != '\0'));
+	if (!nvram_file_exists && (bus->nvram_params == NULL))
+		return (0);
+
+	if (nvram_file_exists) {
+		image = dhd_os_open_image(pnv_path);
+		if (image == NULL) {
+			printf("%s: Open nvram file failed %s\n", __FUNCTION__, pnv_path);
+			goto err;
+		}
+	}
+
+	memblock = MALLOC(bus->dhd->osh, MAX_NVRAMBUF_SIZE);
+	if (memblock == NULL) {
+		DHD_ERROR(("%s: Failed to allocate memory %d bytes\n",
+		           __FUNCTION__, MAX_NVRAMBUF_SIZE));
+		goto err;
+	}
+
+	/* Download variables */
+	if (nvram_file_exists) {
+		len = dhd_os_get_image_block(memblock, MAX_NVRAMBUF_SIZE, image);
+	}
+	else {
+		len = strlen(bus->nvram_params);
+		ASSERT(len <= MAX_NVRAMBUF_SIZE);
+		memcpy(memblock, bus->nvram_params, len);
+	}
+	if (len > 0 && len < MAX_NVRAMBUF_SIZE) {
+		bufp = (char *)memblock;
+		bufp[len] = 0;
+		len = process_nvram_vars(bufp, len);
+		if (len % 4) {
+			len += 4 - (len % 4);
+		}
+		bufp += len;
+		*bufp++ = 0;
+		if (len)
+			bcmerror = dhdsdio_downloadvars(bus, memblock, len + 1);
+		if (bcmerror) {
+			DHD_ERROR(("%s: error downloading vars: %d\n",
+			           __FUNCTION__, bcmerror));
+		}
+	}
+	else {
+		DHD_ERROR(("%s: error reading nvram file: %d\n",
+		           __FUNCTION__, len));
+		bcmerror = BCME_SDIO_ERROR;
+	}
+
+err:
+	if (memblock)
+		MFREE(bus->dhd->osh, memblock, MAX_NVRAMBUF_SIZE);
+
+	if (image)
+		dhd_os_close_image(image);
+
+	return bcmerror;
+}
+
+static int
+_dhdsdio_download_firmware(struct dhd_bus *bus)
+{
+	int bcmerror = -1;
+
+	bool embed = FALSE;	/* download embedded firmware */
+	bool dlok = FALSE;	/* download firmware succeeded */
+
+	/* Out immediately if no image to download */
+	if ((bus->fw_path == NULL) || (bus->fw_path[0] == '\0')) {
+#ifdef BCMEMBEDIMAGE
+		embed = TRUE;
+#else
+		return 0;
+#endif
+	}
+
+	/* Keep arm in reset */
+	if (dhdsdio_download_state(bus, TRUE)) {
+		DHD_ERROR(("%s: error placing ARM core in reset\n", __FUNCTION__));
+		goto err;
+	}
+
+	/* External image takes precedence if specified */
+	if ((bus->fw_path != NULL) && (bus->fw_path[0] != '\0')) {
+		if (dhdsdio_download_code_file(bus, bus->fw_path)) {
+			DHD_ERROR(("%s: dongle image file download failed\n", __FUNCTION__));
+#ifdef BCMEMBEDIMAGE
+			embed = TRUE;
+#else
+			goto err;
+#endif
+		}
+		else {
+			embed = FALSE;
+			dlok = TRUE;
+		}
+	}
+
+#ifdef BCMEMBEDIMAGE
+	if (embed) {
+		if (dhdsdio_download_code_array(bus)) {
+			DHD_ERROR(("%s: dongle image array download failed\n", __FUNCTION__));
+			goto err;
+		}
+		else {
+			dlok = TRUE;
+		}
+	}
+#else
+	BCM_REFERENCE(embed);
+#endif
+	if (!dlok) {
+		DHD_ERROR(("%s: dongle image download failed\n", __FUNCTION__));
+		goto err;
+	}
+
+	/* EXAMPLE: nvram_array */
+	/* If a valid nvram_arry is specified as above, it can be passed down to dongle */
+	/* dhd_bus_set_nvram_params(bus, (char *)&nvram_array); */
+
+	/* External nvram takes precedence if specified */
+	if (dhdsdio_download_nvram(bus)) {
+		DHD_ERROR(("%s: dongle nvram file download failed\n", __FUNCTION__));
+		goto err;
+	}
+
+	/* Take arm out of reset */
+	if (dhdsdio_download_state(bus, FALSE)) {
+		DHD_ERROR(("%s: error getting out of ARM core reset\n", __FUNCTION__));
+		goto err;
+	}
+
+	bcmerror = 0;
+
+err:
+	return bcmerror;
+}
+
+static int
+dhd_bcmsdh_recv_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle)
+{
+	int status;
+
+	if (!KSO_ENAB(bus)) {
+		DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+		return BCME_NODEVICE;
+	}
+
+	status = bcmsdh_recv_buf(bus->sdh, addr, fn, flags, buf, nbytes, pkt, complete, handle);
+
+	return status;
+}
+
+static int
+dhd_bcmsdh_send_buf(dhd_bus_t *bus, uint32 addr, uint fn, uint flags, uint8 *buf, uint nbytes,
+	void *pkt, bcmsdh_cmplt_fn_t complete, void *handle, int max_retry)
+{
+	int ret;
+	int i = 0;
+	int retries = 0;
+	bcmsdh_info_t *sdh;
+
+	if (!KSO_ENAB(bus)) {
+		DHD_ERROR(("%s: Device asleep\n", __FUNCTION__));
+		return BCME_NODEVICE;
+	}
+
+	sdh = bus->sdh;
+	do {
+		ret = bcmsdh_send_buf(bus->sdh, addr, fn, flags, buf, nbytes,
+			pkt, complete, handle);
+
+		bus->f2txdata++;
+		ASSERT(ret != BCME_PENDING);
+
+		if (ret == BCME_NODEVICE) {
+			DHD_ERROR(("%s: Device asleep already\n", __FUNCTION__));
+		} else if (ret < 0) {
+			/* On failure, abort the command and terminate the frame */
+			DHD_ERROR(("%s: sdio error %d, abort command and terminate frame.\n",
+				__FUNCTION__, ret));
+			bus->tx_sderrs++;
+			bus->f1regdata++;
+			bus->dhd->tx_errors++;
+			bcmsdh_abort(sdh, SDIO_FUNC_2);
+			bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_FRAMECTRL,
+				SFC_WF_TERM, NULL);
+			for (i = 0; i < READ_FRM_CNT_RETRIES; i++) {
+				uint8 hi, lo;
+				hi = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WFRAMEBCHI,
+					NULL);
+				lo = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_WFRAMEBCLO,
+					NULL);
+				bus->f1regdata += 2;
+				if ((hi == 0) && (lo == 0))
+					break;
+			}
+		}
+	} while ((ret < 0) && retrydata && ++retries < max_retry);
+
+	return ret;
+}
+
+uint
+dhd_bus_chip(struct dhd_bus *bus)
+{
+	ASSERT(bus->sih != NULL);
+	return bus->sih->chip;
+}
+
+uint
+dhd_bus_chiprev(struct dhd_bus *bus)
+{
+	ASSERT(bus);
+	ASSERT(bus->sih != NULL);
+	return bus->sih->chiprev;
+}
+
+void *
+dhd_bus_pub(struct dhd_bus *bus)
+{
+	return bus->dhd;
+}
+
+void *
+dhd_bus_sih(struct dhd_bus *bus)
+{
+	return (void *)bus->sih;
+}
+
+void *
+dhd_bus_txq(struct dhd_bus *bus)
+{
+	return &bus->txq;
+}
+
+uint
+dhd_bus_hdrlen(struct dhd_bus *bus)
+{
+	return (bus->txglom_enable) ? SDPCM_HDRLEN_TXGLOM : SDPCM_HDRLEN;
+}
+
+void
+dhd_bus_set_dotxinrx(struct dhd_bus *bus, bool val)
+{
+	bus->dotxinrx = val;
+}
+
+int
+dhd_bus_devreset(dhd_pub_t *dhdp, uint8 flag)
+{
+	int bcmerror = 0;
+	dhd_bus_t *bus;
+
+	bus = dhdp->bus;
+
+	if (flag == TRUE) {
+		if (!bus->dhd->dongle_reset) {
+			dhd_os_sdlock(dhdp);
+			dhd_os_wd_timer(dhdp, 0);
+#if !defined(IGNORE_ETH0_DOWN)
+			/* Force flow control as protection when stop come before ifconfig_down */
+			dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, ON);
+#endif /* !defined(IGNORE_ETH0_DOWN) */
+			/* Expect app to have torn down any connection before calling */
+			/* Stop the bus, disable F2 */
+			dhd_bus_stop(bus, FALSE);
+
+#if defined(OOB_INTR_ONLY)
+			/* Clean up any pending IRQ */
+			dhd_enable_oob_intr(bus, FALSE);
+			bcmsdh_oob_intr_set(bus->sdh, FALSE);
+			bcmsdh_oob_intr_unregister(bus->sdh);
+#endif
+
+			/* Clean tx/rx buffer pointers, detach from the dongle */
+			dhdsdio_release_dongle(bus, bus->dhd->osh, TRUE, TRUE);
+
+			bus->dhd->dongle_reset = TRUE;
+			bus->dhd->up = FALSE;
+			dhd_txglom_enable(dhdp, FALSE);
+			dhd_os_sdunlock(dhdp);
+
+			printf("%s:  WLAN OFF DONE\n", __FUNCTION__);
+			/* App can now remove power from device */
+		} else
+			bcmerror = BCME_SDIO_ERROR;
+	} else {
+		/* App must have restored power to device before calling */
+
+		printf("\n\n%s: == WLAN ON ==\n", __FUNCTION__);
+
+		if (bus->dhd->dongle_reset) {
+			/* Turn on WLAN */
+			dhd_os_sdlock(dhdp);
+			/* Reset SD client */
+			bcmsdh_reset(bus->sdh);
+
+			/* Attempt to re-attach & download */
+			if (dhdsdio_probe_attach(bus, bus->dhd->osh, bus->sdh,
+				(uint32 *)SI_ENUM_BASE,
+				bus->cl_devid)) {
+				/* Attempt to download binary to the dongle */
+				if (dhdsdio_probe_init(bus, bus->dhd->osh, bus->sdh) &&
+				    dhdsdio_download_firmware(bus, bus->dhd->osh, bus->sdh) >= 0) {
+
+					/* Re-init bus, enable F2 transfer */
+					bcmerror = dhd_bus_init((dhd_pub_t *) bus->dhd, FALSE);
+					if (bcmerror == BCME_OK) {
+#if defined(OOB_INTR_ONLY)
+						dhd_enable_oob_intr(bus, TRUE);
+						bcmsdh_oob_intr_register(bus->sdh,
+							dhdsdio_isr, bus);
+						bcmsdh_oob_intr_set(bus->sdh, TRUE);
+#endif
+
+						bus->dhd->dongle_reset = FALSE;
+						bus->dhd->up = TRUE;
+
+#if !defined(IGNORE_ETH0_DOWN)
+						/* Restore flow control  */
+						dhd_txflowcontrol(bus->dhd, ALL_INTERFACES, OFF);
+#endif
+						dhd_os_wd_timer(dhdp, dhd_watchdog_ms);
+
+						DHD_TRACE(("%s: WLAN ON DONE\n", __FUNCTION__));
+					} else {
+						dhd_bus_stop(bus, FALSE);
+						dhdsdio_release_dongle(bus, bus->dhd->osh,
+							TRUE, FALSE);
+					}
+				} else
+					bcmerror = BCME_SDIO_ERROR;
+			} else
+				bcmerror = BCME_SDIO_ERROR;
+
+			dhd_os_sdunlock(dhdp);
+		} else {
+			bcmerror = BCME_SDIO_ERROR;
+			printf("%s called when dongle is not in reset\n",
+				__FUNCTION__);
+			printf("Will call dhd_bus_start instead\n");
+			dhd_bus_resume(dhdp, 1);
+#if defined(HW_OOB)
+			dhd_conf_set_hw_oob_intr(bus->sdh, bus->sih->chip); // terence 20120615: fix for OOB initial issue
+#endif
+			if ((bcmerror = dhd_bus_start(dhdp)) != 0)
+				DHD_ERROR(("%s: dhd_bus_start fail with %d\n",
+					__FUNCTION__, bcmerror));
+		}
+	}
+	return bcmerror;
+}
+
+int dhd_bus_suspend(dhd_pub_t *dhdpub)
+{
+	return bcmsdh_stop(dhdpub->bus->sdh);
+}
+
+int dhd_bus_resume(dhd_pub_t *dhdpub, int stage)
+{
+	return bcmsdh_start(dhdpub->bus->sdh, stage);
+}
+
+/* Get Chip ID version */
+uint dhd_bus_chip_id(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+
+	if (bus && bus->sih)
+		return bus->sih->chip;
+	else
+		return 0;
+}
+
+/* Get Chip Rev ID version */
+uint dhd_bus_chiprev_id(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+
+	if (bus && bus->sih)
+		return bus->sih->chiprev;
+	else
+		return 0;
+}
+
+/* Get Chip Pkg ID version */
+uint dhd_bus_chippkg_id(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+
+	return bus->sih->chippkg;
+}
+
+int dhd_bus_get_ids(struct dhd_bus *bus, uint32 *bus_type, uint32 *bus_num, uint32 *slot_num)
+{
+	*bus_type = bus->bus;
+	*bus_num = bus->bus_num;
+	*slot_num = bus->slot_num;
+	return 0;
+}
+
+int
+dhd_bus_membytes(dhd_pub_t *dhdp, bool set, uint32 address, uint8 *data, uint size)
+{
+	dhd_bus_t *bus;
+
+	bus = dhdp->bus;
+	return dhdsdio_membytes(bus, set, address, data, size);
+}
+
+#if defined(NDISVER) && (NDISVER >= 0x0630)
+void
+dhd_bus_reject_ioreqs(dhd_pub_t *dhdp, bool reject)
+{
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	bcmsdh_reject_ioreqs(dhdp->bus->sdh, reject);
+}
+
+void
+dhd_bus_waitfor_iodrain(dhd_pub_t *dhdp)
+{
+
+	DHD_TRACE(("%s: Enter\n", __FUNCTION__));
+
+	bcmsdh_waitfor_iodrain(dhdp->bus->sdh);
+}
+#endif /* (NDISVER) && (NDISVER >= 0x0630) */
+
+void
+dhd_bus_update_fw_nv_path(struct dhd_bus *bus, char *pfw_path, char *pnv_path, char *pconf_path)
+{
+	bus->fw_path = pfw_path;
+	bus->nv_path = pnv_path;
+	bus->dhd->conf_path = pconf_path;
+}
+
+int
+dhd_enableOOB(dhd_pub_t *dhd, bool sleep)
+{
+	dhd_bus_t *bus = dhd->bus;
+	sdpcmd_regs_t *regs = bus->regs;
+	uint retries = 0;
+
+	if (sleep) {
+		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+		/* Tell device to start using OOB wakeup */
+		W_SDREG(SMB_USE_OOB, &regs->tosbmailbox, retries);
+		if (retries > retry_limit) {
+			DHD_ERROR(("CANNOT SIGNAL CHIP, WILL NOT WAKE UP!!\n"));
+			return BCME_BUSY;
+		}
+		/* Turn off our contribution to the HT clock request */
+		dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+	} else {
+		/* Make sure the controller has the bus up */
+		dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+		/* Send misc interrupt to indicate OOB not needed */
+		W_SDREG(0, &regs->tosbmailboxdata, retries);
+		if (retries <= retry_limit)
+			W_SDREG(SMB_DEV_INT, &regs->tosbmailbox, retries);
+
+		if (retries > retry_limit)
+			DHD_ERROR(("CANNOT SIGNAL CHIP TO CLEAR OOB!!\n"));
+
+		/* Make sure we have SD bus access */
+		dhdsdio_clkctl(bus, CLK_SDONLY, FALSE);
+	}
+	return BCME_OK;
+}
+
+void
+dhd_bus_pktq_flush(dhd_pub_t *dhdp)
+{
+	dhd_bus_t *bus = dhdp->bus;
+	bool wlfc_enabled = FALSE;
+
+#ifdef PROP_TXSTATUS
+	wlfc_enabled = (dhd_wlfc_cleanup_txq(dhdp, NULL, 0) != WLFC_UNSUPPORTED);
+#endif
+	if (!wlfc_enabled) {
+#ifdef DHDTCPACK_SUPPRESS
+		/* Clean tcp_ack_info_tbl in order to prevent access to flushed pkt,
+		 * when there is a newly coming packet from network stack.
+		 */
+		dhd_tcpack_info_tbl_clean(bus->dhd);
+#endif /* DHDTCPACK_SUPPRESS */
+		/* Clear the data packet queues */
+		pktq_flush(dhdp->osh, &bus->txq, TRUE, NULL, 0);
+	}
+}
+
+#ifdef BCMSDIO
+int
+dhd_sr_config(dhd_pub_t *dhd, bool on)
+{
+	dhd_bus_t *bus = dhd->bus;
+
+	if (!bus->_srenab)
+		return -1;
+
+	return dhdsdio_clk_devsleep_iovar(bus, on);
+}
+
+uint16
+dhd_get_chipid(dhd_pub_t *dhd)
+{
+	dhd_bus_t *bus = dhd->bus;
+
+	if (bus && bus->sih)
+		return (uint16)bus->sih->chip;
+	else
+		return 0;
+}
+#endif /* BCMSDIO */
+
+#ifdef DEBUGGER
+uint32 dhd_sdio_reg_read(void *h, uint32 addr)
+{
+	uint32 rval;
+	struct dhd_bus *bus = (struct dhd_bus *) h;
+
+	dhd_os_sdlock(bus->dhd);
+
+	BUS_WAKE(bus);
+
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+	rval = bcmsdh_reg_read(bus->sdh, addr, 4);
+
+	dhd_os_sdunlock(bus->dhd);
+
+	return rval;
+}
+
+void dhd_sdio_reg_write(void *h, uint32 addr, uint32 val)
+{
+	struct dhd_bus *bus = (struct dhd_bus *) h;
+
+	dhd_os_sdlock(bus->dhd);
+
+	BUS_WAKE(bus);
+
+	dhdsdio_clkctl(bus, CLK_AVAIL, FALSE);
+
+	bcmsdh_reg_write(bus->sdh, addr, 4, val);
+
+	dhd_os_sdunlock(bus->dhd);
+}
+#endif /* DEBUGGER */
+
+#if defined(SOFTAP_TPUT_ENHANCE)
+void dhd_bus_setidletime(dhd_pub_t *dhdp, int idle_time)
+{
+	if (!dhdp || !dhdp->bus) {
+		DHD_ERROR(("%s:Bus is Invalid\n", __FUNCTION__));
+		return;
+	}
+	dhdp->bus->idletime = idle_time;
+}
+
+void dhd_bus_getidletime(dhd_pub_t *dhdp, int* idle_time)
+{
+	if (!dhdp || !dhdp->bus) {
+		DHD_ERROR(("%s:Bus is Invalid\n", __FUNCTION__));
+		return;
+	}
+
+	if (!idle_time) {
+		DHD_ERROR(("%s:Arg idle_time is NULL\n", __FUNCTION__));
+		return;
+	}
+	*idle_time = dhdp->bus->idletime;
+}
+#endif /* SOFTAP_TPUT_ENHANCE */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_static_buf.c b/drivers/net/wireless/bcm4336/dhd_static_buf.c
--- a/drivers/net/wireless/bcm4336/dhd_static_buf.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_static_buf.c	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,171 @@
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/skbuff.h>
+#include <linux/wlan_plat.h>
+
+#define CONFIG_BROADCOM_WIFI_RESERVED_MEM
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+
+#define WLAN_STATIC_PKT_BUF			4
+#define WLAN_STATIC_SCAN_BUF0		5
+#define WLAN_STATIC_SCAN_BUF1		6
+#define WLAN_STATIC_DHD_INFO		7
+#define PREALLOC_WLAN_SEC_NUM		5
+#define PREALLOC_WLAN_BUF_NUM		160
+#define PREALLOC_WLAN_SECTION_HEADER	24
+
+#define WLAN_SECTION_SIZE_0	(PREALLOC_WLAN_BUF_NUM * 128)
+#define WLAN_SECTION_SIZE_1	(PREALLOC_WLAN_BUF_NUM * 128)
+#define WLAN_SECTION_SIZE_2	(PREALLOC_WLAN_BUF_NUM * 512)
+#define WLAN_SECTION_SIZE_3	(PREALLOC_WLAN_BUF_NUM * 1024)
+#define WLAN_SECTION_SIZE_7	(PREALLOC_WLAN_BUF_NUM * 128)
+
+#define DHD_SKB_HDRSIZE			336
+#define DHD_SKB_1PAGE_BUFSIZE	((PAGE_SIZE*1)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_2PAGE_BUFSIZE	((PAGE_SIZE*2)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_4PAGE_BUFSIZE	((PAGE_SIZE*4)-DHD_SKB_HDRSIZE)
+
+#define WLAN_SKB_BUF_NUM	17
+
+static struct sk_buff *wlan_static_skb[WLAN_SKB_BUF_NUM];
+
+struct wlan_mem_prealloc {
+	void *mem_ptr;
+	unsigned long size;
+};
+
+static struct wlan_mem_prealloc wlan_mem_array[PREALLOC_WLAN_SEC_NUM] = {
+	{NULL, (WLAN_SECTION_SIZE_0 + PREALLOC_WLAN_SECTION_HEADER)},
+	{NULL, (WLAN_SECTION_SIZE_1 + PREALLOC_WLAN_SECTION_HEADER)},
+	{NULL, (WLAN_SECTION_SIZE_2 + PREALLOC_WLAN_SECTION_HEADER)},
+	{NULL, (WLAN_SECTION_SIZE_3 + PREALLOC_WLAN_SECTION_HEADER)},
+	{NULL, (WLAN_SECTION_SIZE_7 + PREALLOC_WLAN_SECTION_HEADER)}
+};
+
+void *wlan_static_scan_buf0;
+void *wlan_static_scan_buf1;
+void *bcmdhd_mem_prealloc(int section, unsigned long size)
+{
+	if (section == WLAN_STATIC_PKT_BUF) {
+		printk("1 %s: section=%d, wlan_static_skb=%p\n",
+			__FUNCTION__, section, wlan_static_skb);
+		return wlan_static_skb;
+	}
+	if (section == WLAN_STATIC_SCAN_BUF0) {
+		printk("2 %s: section=%d, wlan_static_scan_buf0=%p\n",
+			__FUNCTION__, section, wlan_static_scan_buf0);
+		return wlan_static_scan_buf0;
+	}
+	if (section == WLAN_STATIC_SCAN_BUF1) {
+		printk("3 %s: section=%d, wlan_static_scan_buf1=%p\n",
+			__FUNCTION__, section, wlan_static_scan_buf1);
+		return wlan_static_scan_buf1;
+	}
+	if (section == WLAN_STATIC_DHD_INFO) {
+		printk("4 %s: section=%d, wlan_mem_array[4]=%p\n",
+			__FUNCTION__, section, wlan_mem_array[4].mem_ptr);
+		return wlan_mem_array[4].mem_ptr;
+	}
+	if ((section < 0) || (section > PREALLOC_WLAN_SEC_NUM)) {
+		printk("5 %s: out of section %d\n", __FUNCTION__, section);
+		return NULL;
+	}
+
+	if (wlan_mem_array[section].size < size) {
+		printk("6 %s: wlan_mem_array[section].size=%lu, size=%lu\n",
+			__FUNCTION__, wlan_mem_array[section].size, size);
+		return NULL;
+	}
+	printk("7 %s: wlan_mem_array[section].mem_ptr=%p, size=%lu\n",
+		__FUNCTION__, &wlan_mem_array[section], size);
+
+	return wlan_mem_array[section].mem_ptr;
+}
+
+EXPORT_SYMBOL(bcmdhd_mem_prealloc);
+
+int bcmdhd_init_wlan_mem(void)
+{
+	int i;
+	int j;
+
+	for (i=0; i<8; i++) {
+		wlan_static_skb[i] = dev_alloc_skb(DHD_SKB_1PAGE_BUFSIZE);
+		if (!wlan_static_skb[i])
+			goto err_skb_alloc;
+		printk("1 %s: wlan_static_skb[%d]=%p, size=%lu\n",
+			__FUNCTION__, i, wlan_static_skb[i], DHD_SKB_1PAGE_BUFSIZE);
+	}
+
+	for (; i<16; i++) {
+		wlan_static_skb[i] = dev_alloc_skb(DHD_SKB_2PAGE_BUFSIZE);
+		if (!wlan_static_skb[i])
+			goto err_skb_alloc;
+		printk("2 %s: wlan_static_skb[%d]=%p, size=%lu\n",
+			__FUNCTION__, i, wlan_static_skb[i], DHD_SKB_2PAGE_BUFSIZE);
+	}
+
+	wlan_static_skb[i] = dev_alloc_skb(DHD_SKB_4PAGE_BUFSIZE);
+	if (!wlan_static_skb[i])
+		goto err_skb_alloc;
+	printk("3 %s: wlan_static_skb[%d]=%p, size=%lu\n",
+		__FUNCTION__, i, wlan_static_skb[i], DHD_SKB_4PAGE_BUFSIZE);
+
+	for (i=0; i<PREALLOC_WLAN_SEC_NUM; i++) {
+		wlan_mem_array[i].mem_ptr =
+				kmalloc(wlan_mem_array[i].size, GFP_KERNEL);
+
+		if (!wlan_mem_array[i].mem_ptr)
+			goto err_mem_alloc;
+		printk("4 %s: wlan_mem_array[%d]=%p, size=%lu\n",
+			__FUNCTION__, i, wlan_static_skb[i], wlan_mem_array[i].size);
+	}
+
+	wlan_static_scan_buf0 = kmalloc (65536, GFP_KERNEL);
+	if (!wlan_static_scan_buf0)
+		goto err_mem_alloc;
+	printk("5 %s: wlan_static_scan_buf0=%p, size=%d\n",
+		__FUNCTION__, wlan_static_scan_buf0, 65536);
+
+	wlan_static_scan_buf1 = kmalloc (65536, GFP_KERNEL);
+	if (!wlan_static_scan_buf1)
+		goto err_mem_alloc;
+	printk("6 %s: wlan_static_scan_buf1=%p, size=%d\n",
+		__FUNCTION__, wlan_static_scan_buf1, 65536);
+
+	printk("%s: WIFI MEM Allocated\n", __FUNCTION__);
+	return 0;
+
+err_mem_alloc:
+	pr_err("Failed to mem_alloc for WLAN\n");
+	for (j=0; j<i; j++)
+		kfree(wlan_mem_array[j].mem_ptr);
+
+	i = WLAN_SKB_BUF_NUM;
+
+err_skb_alloc:
+	pr_err("Failed to skb_alloc for WLAN\n");
+	for (j=0; j<i; j++)
+		dev_kfree_skb(wlan_static_skb[j]);
+
+	return -ENOMEM;
+}
+#endif /* CONFIG_BROADCOM_WIFI_RESERVED_MEM */
+
+static int __init bcmdhd_wlan_init(void)
+{
+	printk("%s()\n", __FUNCTION__);
+
+#ifdef CONFIG_BROADCOM_WIFI_RESERVED_MEM
+	bcmdhd_init_wlan_mem();
+#endif
+
+	return 0;
+}
+
+__initcall(bcmdhd_wlan_init);
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_wlfc.c b/drivers/net/wireless/bcm4336/dhd_wlfc.c
--- a/drivers/net/wireless/bcm4336/dhd_wlfc.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_wlfc.c	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,4094 @@
+/*
+ * DHD PROP_TXSTATUS Module.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhd_wlfc.c 501046 2014-09-06 01:25:16Z $
+ *
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+
+#include <dhd_bus.h>
+#include <dhd_dbg.h>
+
+#ifdef PROP_TXSTATUS
+#include <wlfc_proto.h>
+#include <dhd_wlfc.h>
+#endif
+#include <dhd_ip.h>
+
+
+/*
+ * wlfc naming and lock rules:
+ *
+ * 1. Private functions name like _dhd_wlfc_XXX, declared as static and avoid wlfc lock operation.
+ * 2. Public functions name like dhd_wlfc_XXX, use wlfc lock if needed.
+ * 3. Non-Proptxstatus module call public functions only and avoid wlfc lock operation.
+ *
+ */
+
+
+#ifdef PROP_TXSTATUS
+
+#ifdef QMONITOR
+#define DHD_WLFC_QMON_COMPLETE(entry) dhd_qmon_txcomplete(&entry->qmon)
+#else
+#define DHD_WLFC_QMON_COMPLETE(entry)
+#endif /* QMONITOR */
+
+#define LIMIT_BORROW
+
+
+static uint16
+_dhd_wlfc_adjusted_seq(void* p, uint8 current_seq)
+{
+	uint16 seq;
+
+	if (!p) {
+		return 0xffff;
+	}
+
+	seq = WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+	if (seq < current_seq) {
+		/* wrap around */
+		seq += 256;
+	}
+
+	return seq;
+}
+
+static void
+_dhd_wlfc_prec_enque(struct pktq *pq, int prec, void* p, bool qHead,
+	uint8 current_seq, bool reOrder)
+{
+	struct pktq_prec *q;
+	uint16 seq, seq2;
+	void *p2, *p2_prev;
+
+	if (!p)
+		return;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+	/* queueing chains not allowed */
+	ASSERT(!((PKTLINK(p) != NULL) && (PKTLINK(p) != p)));
+
+	ASSERT(!pktq_full(pq));
+	ASSERT(!pktq_pfull(pq, prec));
+
+	q = &pq->q[prec];
+
+	PKTSETLINK(p, NULL);
+	if (q->head == NULL) {
+		/* empty queue */
+		q->head = p;
+		q->tail = p;
+	} else {
+		if (reOrder && (prec & 1)) {
+			seq = _dhd_wlfc_adjusted_seq(p, current_seq);
+			p2 = qHead ? q->head : q->tail;
+			seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+
+			if ((qHead &&((seq+1) > seq2)) || (!qHead && ((seq2+1) > seq))) {
+				/* need reorder */
+				p2 = q->head;
+				p2_prev = NULL;
+				seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+
+				while (seq > seq2) {
+					p2_prev = p2;
+					p2 = PKTLINK(p2);
+					if (!p2) {
+						break;
+					}
+					seq2 = _dhd_wlfc_adjusted_seq(p2, current_seq);
+				}
+
+				if (p2_prev == NULL) {
+					/* insert head */
+					PKTSETLINK(p, q->head);
+					q->head = p;
+				} else if (p2 == NULL) {
+					/* insert tail */
+					PKTSETLINK(p2_prev, p);
+					q->tail = p;
+				} else {
+					/* insert after p2_prev */
+					PKTSETLINK(p, PKTLINK(p2_prev));
+					PKTSETLINK(p2_prev, p);
+				}
+				goto exit;
+			}
+		}
+
+		if (qHead) {
+			PKTSETLINK(p, q->head);
+			q->head = p;
+		} else {
+			PKTSETLINK(q->tail, p);
+			q->tail = p;
+		}
+	}
+
+exit:
+
+	q->len++;
+	pq->len++;
+
+	if (pq->hi_prec < prec)
+		pq->hi_prec = (uint8)prec;
+}
+
+/* Create a place to store all packet pointers submitted to the firmware until
+	a status comes back, suppress or otherwise.
+
+	hang-er: noun, a contrivance on which things are hung, as a hook.
+*/
+static void*
+_dhd_wlfc_hanger_create(osl_t *osh, int max_items)
+{
+	int i;
+	wlfc_hanger_t* hanger;
+
+	/* allow only up to a specific size for now */
+	ASSERT(max_items == WLFC_HANGER_MAXITEMS);
+
+	if ((hanger = (wlfc_hanger_t*)MALLOC(osh, WLFC_HANGER_SIZE(max_items))) == NULL)
+		return NULL;
+
+	memset(hanger, 0, WLFC_HANGER_SIZE(max_items));
+	hanger->max_items = max_items;
+
+	for (i = 0; i < hanger->max_items; i++) {
+		hanger->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+	}
+	return hanger;
+}
+
+static int
+_dhd_wlfc_hanger_delete(osl_t *osh, void* hanger)
+{
+	wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+	if (h) {
+		MFREE(osh, h, WLFC_HANGER_SIZE(h->max_items));
+		return BCME_OK;
+	}
+	return BCME_BADARG;
+}
+
+static uint16
+_dhd_wlfc_hanger_get_free_slot(void* hanger)
+{
+	uint32 i;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+	if (h) {
+		i = h->slot_pos + 1;
+		if (i == h->max_items) {
+			i = 0;
+		}
+		while (i != h->slot_pos) {
+			if (h->items[i].state == WLFC_HANGER_ITEM_STATE_FREE) {
+				h->slot_pos = i;
+				return (uint16)i;
+			}
+			i++;
+			if (i == h->max_items)
+				i = 0;
+		}
+		h->failed_slotfind++;
+	}
+	return WLFC_HANGER_MAXITEMS;
+}
+
+static int
+_dhd_wlfc_hanger_get_genbit(void* hanger, void* pkt, uint32 slot_id, int* gen)
+{
+	int rc = BCME_OK;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+	*gen = 0xff;
+
+	/* this packet was not pushed at the time it went to the firmware */
+	if (slot_id == WLFC_HANGER_MAXITEMS)
+		return BCME_NOTFOUND;
+
+	if (h) {
+		if ((h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_INUSE) ||
+			(h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED)) {
+			*gen = h->items[slot_id].gen;
+		}
+		else {
+			rc = BCME_NOTFOUND;
+		}
+	}
+	else
+		rc = BCME_BADARG;
+	return rc;
+}
+
+static int
+_dhd_wlfc_hanger_pushpkt(void* hanger, void* pkt, uint32 slot_id)
+{
+	int rc = BCME_OK;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+	if (h && (slot_id < WLFC_HANGER_MAXITEMS)) {
+		if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_FREE) {
+			h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE;
+			h->items[slot_id].pkt = pkt;
+			h->items[slot_id].pkt_state = 0;
+			h->items[slot_id].pkt_txstatus = 0;
+			h->pushed++;
+		}
+		else {
+			h->failed_to_push++;
+			rc = BCME_NOTFOUND;
+		}
+	}
+	else
+		rc = BCME_BADARG;
+	return rc;
+}
+
+static int
+_dhd_wlfc_hanger_poppkt(void* hanger, uint32 slot_id, void** pktout, bool remove_from_hanger)
+{
+	int rc = BCME_OK;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+	/* this packet was not pushed at the time it went to the firmware */
+	if (slot_id == WLFC_HANGER_MAXITEMS)
+		return BCME_NOTFOUND;
+
+	if (h) {
+		if (h->items[slot_id].state != WLFC_HANGER_ITEM_STATE_FREE) {
+			*pktout = h->items[slot_id].pkt;
+			if (remove_from_hanger) {
+				h->items[slot_id].state =
+					WLFC_HANGER_ITEM_STATE_FREE;
+				h->items[slot_id].pkt = NULL;
+				h->items[slot_id].gen = 0xff;
+				h->items[slot_id].identifier = 0;
+				h->popped++;
+			}
+		}
+		else {
+			h->failed_to_pop++;
+			rc = BCME_NOTFOUND;
+		}
+	}
+	else
+		rc = BCME_BADARG;
+	return rc;
+}
+
+static int
+_dhd_wlfc_hanger_mark_suppressed(void* hanger, uint32 slot_id, uint8 gen)
+{
+	int rc = BCME_OK;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)hanger;
+
+	/* this packet was not pushed at the time it went to the firmware */
+	if (slot_id == WLFC_HANGER_MAXITEMS)
+		return BCME_NOTFOUND;
+	if (h) {
+		h->items[slot_id].gen = gen;
+		if (h->items[slot_id].state == WLFC_HANGER_ITEM_STATE_INUSE) {
+			h->items[slot_id].state = WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED;
+		}
+		else
+			rc = BCME_BADARG;
+	}
+	else
+		rc = BCME_BADARG;
+
+	return rc;
+}
+
+/* remove reference of specific packet in hanger */
+static bool
+_dhd_wlfc_hanger_remove_reference(wlfc_hanger_t* h, void* pkt)
+{
+	int i;
+
+	if (!h || !pkt) {
+		return FALSE;
+	}
+
+	for (i = 0; i < h->max_items; i++) {
+		if (pkt == h->items[i].pkt) {
+			if ((h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE) ||
+				(h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED)) {
+				h->items[i].state = WLFC_HANGER_ITEM_STATE_FREE;
+				h->items[i].pkt = NULL;
+				h->items[i].gen = 0xff;
+				h->items[i].identifier = 0;
+			}
+			return TRUE;
+		}
+	}
+
+	return FALSE;
+}
+
+
+static int
+_dhd_wlfc_enque_afq(athost_wl_status_info_t* ctx, void *p)
+{
+	wlfc_mac_descriptor_t* entry;
+	uint16 entry_idx = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+	uint8 prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+
+	if (entry_idx < WLFC_MAC_DESC_TABLE_SIZE)
+		entry  = &ctx->destination_entries.nodes[entry_idx];
+	else if (entry_idx < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+		entry = &ctx->destination_entries.interfaces[entry_idx - WLFC_MAC_DESC_TABLE_SIZE];
+	else
+		entry = &ctx->destination_entries.other;
+
+	pktq_penq(&entry->afq, prec, p);
+
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_deque_afq(athost_wl_status_info_t* ctx, uint16 hslot, uint8 hcnt, uint8 prec,
+	void **pktout)
+{
+	wlfc_mac_descriptor_t *entry;
+	struct pktq *pq;
+	struct pktq_prec *q;
+	void *p, *b;
+
+	if (!ctx) {
+		DHD_ERROR(("%s: ctx(%p), pktout(%p)\n", __FUNCTION__, ctx, pktout));
+		return BCME_BADARG;
+	}
+
+	if (pktout) {
+		*pktout = NULL;
+	}
+
+	ASSERT(hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM + 1));
+
+	if (hslot < WLFC_MAC_DESC_TABLE_SIZE)
+		entry  = &ctx->destination_entries.nodes[hslot];
+	else if (hslot < (WLFC_MAC_DESC_TABLE_SIZE + WLFC_MAX_IFNUM))
+		entry = &ctx->destination_entries.interfaces[hslot - WLFC_MAC_DESC_TABLE_SIZE];
+	else
+		entry = &ctx->destination_entries.other;
+
+	pq = &entry->afq;
+
+	ASSERT(prec < pq->num_prec);
+
+	q = &pq->q[prec];
+
+	b = NULL;
+	p = q->head;
+
+	while (p && (hcnt != WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)))))
+	{
+		b = p;
+		p = PKTLINK(p);
+	}
+
+	if (p == NULL) {
+		/* none is matched */
+		if (b) {
+			DHD_ERROR(("%s: can't find matching seq(%d)\n", __FUNCTION__, hcnt));
+		} else {
+			DHD_ERROR(("%s: queue is empty\n", __FUNCTION__));
+		}
+
+		return BCME_ERROR;
+	}
+
+	if (!b) {
+		/* head packet is matched */
+		if ((q->head = PKTLINK(p)) == NULL) {
+			q->tail = NULL;
+		}
+	} else {
+		/* middle packet is matched */
+		DHD_INFO(("%s: out of order, seq(%d), head_seq(%d)\n", __FUNCTION__, hcnt,
+			WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(q->head)))));
+		ctx->stats.ooo_pkts[prec]++;
+		PKTSETLINK(b, PKTLINK(p));
+		if (PKTLINK(p) == NULL) {
+			q->tail = b;
+		}
+	}
+
+	q->len--;
+	pq->len--;
+
+	PKTSETLINK(p, NULL);
+
+	if (pktout) {
+		*pktout = p;
+	}
+
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_pushheader(athost_wl_status_info_t* ctx, void** packet, bool tim_signal,
+	uint8 tim_bmp, uint8 mac_handle, uint32 htodtag, uint16 htodseq, bool skip_wlfc_hdr)
+{
+	uint32 wl_pktinfo = 0;
+	uint8* wlh;
+	uint8 dataOffset = 0;
+	uint8 fillers;
+	uint8 tim_signal_len = 0;
+	dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+	struct bdc_header *h;
+	void *p = *packet;
+
+	if (skip_wlfc_hdr)
+		goto push_bdc_hdr;
+
+	if (tim_signal) {
+		tim_signal_len = TLV_HDR_LEN + WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+	}
+
+	/* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
+	dataOffset = WLFC_CTL_VALUE_LEN_PKTTAG + TLV_HDR_LEN + tim_signal_len;
+	if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+		dataOffset += WLFC_CTL_VALUE_LEN_SEQ;
+	}
+
+	fillers = ROUNDUP(dataOffset, 4) - dataOffset;
+	dataOffset += fillers;
+
+	PKTPUSH(ctx->osh, p, dataOffset);
+	wlh = (uint8*) PKTDATA(ctx->osh, p);
+
+	wl_pktinfo = htol32(htodtag);
+
+	wlh[TLV_TAG_OFF] = WLFC_CTL_TYPE_PKTTAG;
+	wlh[TLV_LEN_OFF] = WLFC_CTL_VALUE_LEN_PKTTAG;
+	memcpy(&wlh[TLV_HDR_LEN], &wl_pktinfo, sizeof(uint32));
+
+	if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+		uint16 wl_seqinfo = htol16(htodseq);
+		wlh[TLV_LEN_OFF] += WLFC_CTL_VALUE_LEN_SEQ;
+		memcpy(&wlh[TLV_HDR_LEN + WLFC_CTL_VALUE_LEN_PKTTAG], &wl_seqinfo,
+			WLFC_CTL_VALUE_LEN_SEQ);
+	}
+
+	if (tim_signal_len) {
+		wlh[dataOffset - fillers - tim_signal_len ] =
+			WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP;
+		wlh[dataOffset - fillers - tim_signal_len + 1] =
+			WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP;
+		wlh[dataOffset - fillers - tim_signal_len + 2] = mac_handle;
+		wlh[dataOffset - fillers - tim_signal_len + 3] = tim_bmp;
+	}
+	if (fillers)
+		memset(&wlh[dataOffset - fillers], WLFC_CTL_TYPE_FILLER, fillers);
+
+push_bdc_hdr:
+
+	PKTPUSH(ctx->osh, p, BDC_HEADER_LEN);
+	h = (struct bdc_header *)PKTDATA(ctx->osh, p);
+	h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
+	if (PKTSUMNEEDED(p))
+		h->flags |= BDC_FLAG_SUM_NEEDED;
+
+
+	h->priority = (PKTPRIO(p) & BDC_PRIORITY_MASK);
+	h->flags2 = 0;
+	h->dataOffset = dataOffset >> 2;
+	BDC_SET_IF_IDX(h, DHD_PKTTAG_IF(PKTTAG(p)));
+	*packet = p;
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_pullheader(athost_wl_status_info_t* ctx, void* pktbuf)
+{
+	struct bdc_header *h;
+
+	if (PKTLEN(ctx->osh, pktbuf) < BDC_HEADER_LEN) {
+		DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+		           PKTLEN(ctx->osh, pktbuf), BDC_HEADER_LEN));
+		return BCME_ERROR;
+	}
+	h = (struct bdc_header *)PKTDATA(ctx->osh, pktbuf);
+
+	/* pull BDC header */
+	PKTPULL(ctx->osh, pktbuf, BDC_HEADER_LEN);
+
+	if (PKTLEN(ctx->osh, pktbuf) < (uint)(h->dataOffset << 2)) {
+		DHD_ERROR(("%s: rx data too short (%d < %d)\n", __FUNCTION__,
+		           PKTLEN(ctx->osh, pktbuf), (h->dataOffset << 2)));
+		return BCME_ERROR;
+	}
+
+	/* pull wl-header */
+	PKTPULL(ctx->osh, pktbuf, (h->dataOffset << 2));
+	return BCME_OK;
+}
+
+static wlfc_mac_descriptor_t*
+_dhd_wlfc_find_table_entry(athost_wl_status_info_t* ctx, void* p)
+{
+	int i;
+	wlfc_mac_descriptor_t* table = ctx->destination_entries.nodes;
+	uint8 ifid = DHD_PKTTAG_IF(PKTTAG(p));
+	uint8* dstn = DHD_PKTTAG_DSTN(PKTTAG(p));
+	wlfc_mac_descriptor_t* entry = DHD_PKTTAG_ENTRY(PKTTAG(p));
+	int iftype = ctx->destination_entries.interfaces[ifid].iftype;
+
+	/* saved one exists, return it */
+	if (entry)
+		return entry;
+
+	/* Multicast destination, STA and P2P clients get the interface entry.
+	 * STA/GC gets the Mac Entry for TDLS destinations, TDLS destinations
+	 * have their own entry.
+	 */
+	if ((DHD_IF_ROLE_STA(iftype) || ETHER_ISMULTI(dstn)) &&
+		(ctx->destination_entries.interfaces[ifid].occupied)) {
+			entry = &ctx->destination_entries.interfaces[ifid];
+	}
+
+	if (entry && ETHER_ISMULTI(dstn)) {
+		DHD_PKTTAG_SET_ENTRY(PKTTAG(p), entry);
+		return entry;
+	}
+
+	for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+		if (table[i].occupied) {
+			if (table[i].interface_id == ifid) {
+				if (!memcmp(table[i].ea, dstn, ETHER_ADDR_LEN)) {
+					entry = &table[i];
+					break;
+				}
+			}
+		}
+	}
+
+	if (entry == NULL)
+		entry = &ctx->destination_entries.other;
+
+	DHD_PKTTAG_SET_ENTRY(PKTTAG(p), entry);
+
+	return entry;
+}
+
+static int
+_dhd_wlfc_prec_drop(dhd_pub_t *dhdp, int prec, void* p, bool bPktInQ)
+{
+	athost_wl_status_info_t* ctx;
+	void *pout = NULL;
+
+	ASSERT(dhdp && p);
+	ASSERT(prec >= 0 && prec <= WLFC_PSQ_PREC_COUNT);
+
+	ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+	if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && (prec & 1)) {
+		/* suppressed queue, need pop from hanger */
+		_dhd_wlfc_hanger_poppkt(ctx->hanger, WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG
+					(PKTTAG(p))), &pout, TRUE);
+		ASSERT(p == pout);
+	}
+
+	if (!(prec & 1)) {
+#ifdef DHDTCPACK_SUPPRESS
+		/* pkt in delayed q, so fake push BDC header for
+		 * dhd_tcpack_check_xmit() and dhd_txcomplete().
+		 */
+		_dhd_wlfc_pushheader(ctx, &p, FALSE, 0, 0, 0, 0, TRUE);
+
+		/* This packet is about to be freed, so remove it from tcp_ack_info_tbl
+		 * This must be one of...
+		 * 1. A pkt already in delayQ is evicted by another pkt with higher precedence
+		 * in _dhd_wlfc_prec_enq_with_drop()
+		 * 2. A pkt could not be enqueued to delayQ because it is full,
+		 * in _dhd_wlfc_enque_delayq().
+		 * 3. A pkt could not be enqueued to delayQ because it is full,
+		 * in _dhd_wlfc_rollback_packet_toq().
+		 */
+		if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+			DHD_ERROR(("%s %d: tcpack_suppress ERROR!!!"
+				" Stop using it\n",
+				__FUNCTION__, __LINE__));
+			dhd_tcpack_suppress_set(dhdp, TCPACK_SUP_OFF);
+		}
+#endif /* DHDTCPACK_SUPPRESS */
+	}
+
+	if (bPktInQ) {
+		ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+		ctx->pkt_cnt_per_ac[prec>>1]--;
+	}
+
+	ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))][DHD_PKTTAG_FIFO(PKTTAG(p))]--;
+	ctx->stats.pktout++;
+	ctx->stats.drop_pkts[prec]++;
+
+	dhd_txcomplete(dhdp, p, FALSE);
+	PKTFREE(ctx->osh, p, TRUE);
+
+	return 0;
+}
+
+static bool
+_dhd_wlfc_prec_enq_with_drop(dhd_pub_t *dhdp, struct pktq *pq, void *pkt, int prec, bool qHead,
+	uint8 current_seq)
+{
+	void *p = NULL;
+	int eprec = -1;		/* precedence to evict from */
+	athost_wl_status_info_t* ctx;
+
+	ASSERT(dhdp && pq && pkt);
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+	/* Fast case, precedence queue is not full and we are also not
+	 * exceeding total queue length
+	 */
+	if (!pktq_pfull(pq, prec) && !pktq_full(pq)) {
+		goto exit;
+	}
+
+	/* Determine precedence from which to evict packet, if any */
+	if (pktq_pfull(pq, prec))
+		eprec = prec;
+	else if (pktq_full(pq)) {
+		p = pktq_peek_tail(pq, &eprec);
+		if (!p) {
+			DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+			return FALSE;
+		}
+		if ((eprec > prec) || (eprec < 0)) {
+			if (!pktq_pempty(pq, prec)) {
+				eprec = prec;
+			} else {
+				return FALSE;
+			}
+		}
+	}
+
+	/* Evict if needed */
+	if (eprec >= 0) {
+		/* Detect queueing to unconfigured precedence */
+		ASSERT(!pktq_pempty(pq, eprec));
+		/* Evict all fragmented frames */
+		dhd_prec_drop_pkts(dhdp, pq, eprec, _dhd_wlfc_prec_drop);
+	}
+
+exit:
+	/* Enqueue */
+	_dhd_wlfc_prec_enque(pq, prec, pkt, qHead, current_seq,
+		WLFC_GET_REORDERSUPP(dhdp->wlfc_mode));
+	ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(pkt))][prec>>1]++;
+	ctx->pkt_cnt_per_ac[prec>>1]++;
+
+	return TRUE;
+}
+
+
+static int
+_dhd_wlfc_rollback_packet_toq(athost_wl_status_info_t* ctx,
+	void* p, ewlfc_packet_state_t pkt_type, uint32 hslot)
+{
+	/*
+	put the packet back to the head of queue
+
+	- suppressed packet goes back to suppress sub-queue
+	- pull out the header, if new or delayed packet
+
+	Note: hslot is used only when header removal is done.
+	*/
+	wlfc_mac_descriptor_t* entry;
+	int rc = BCME_OK;
+	int prec, fifo_id;
+
+	entry = _dhd_wlfc_find_table_entry(ctx, p);
+	prec = DHD_PKTTAG_FIFO(PKTTAG(p));
+	fifo_id = prec << 1;
+	if (pkt_type == eWLFC_PKTTYPE_SUPPRESSED)
+		fifo_id += 1;
+	if (entry != NULL) {
+		/*
+		if this packet did not count against FIFO credit, it must have
+		taken a requested_credit from the firmware (for pspoll etc.)
+		*/
+		if ((prec != AC_COUNT) && !DHD_PKTTAG_CREDITCHECK(PKTTAG(p)))
+			entry->requested_credit++;
+
+		if (pkt_type == eWLFC_PKTTYPE_DELAYED) {
+			/* decrement sequence count */
+			WLFC_DECR_SEQCOUNT(entry, prec);
+			/* remove header first */
+			rc = _dhd_wlfc_pullheader(ctx, p);
+			if (rc != BCME_OK) {
+				DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+				goto exit;
+			}
+		}
+
+		if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, p, fifo_id, TRUE,
+			WLFC_SEQCOUNT(entry, fifo_id>>1))
+			== FALSE) {
+			/* enque failed */
+			DHD_ERROR(("Error: %s():%d, fifo_id(%d)\n",
+				__FUNCTION__, __LINE__, fifo_id));
+			rc = BCME_ERROR;
+		}
+	} else {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		rc = BCME_ERROR;
+	}
+exit:
+	if (rc != BCME_OK) {
+		ctx->stats.rollback_failed++;
+		_dhd_wlfc_prec_drop(ctx->dhdp, fifo_id, p, FALSE);
+	}
+	else
+		ctx->stats.rollback++;
+
+	return rc;
+}
+
+static bool
+_dhd_wlfc_allow_fc(athost_wl_status_info_t* ctx, uint8 ifid)
+{
+	int prec, ac_traffic = WLFC_NO_TRAFFIC;
+
+	for (prec = 0; prec < AC_COUNT; prec++) {
+		if (ctx->pkt_cnt_in_drv[ifid][prec] > 0) {
+			if (ac_traffic == WLFC_NO_TRAFFIC)
+				ac_traffic = prec + 1;
+			else if (ac_traffic != (prec + 1))
+				ac_traffic = WLFC_MULTI_TRAFFIC;
+		}
+	}
+
+	if (ac_traffic >= 1 && ac_traffic <= AC_COUNT) {
+		/* single AC (BE/BK/VI/VO) in queue */
+		if (ctx->allow_fc) {
+			return TRUE;
+		} else {
+			uint32 delta;
+			uint32 curr_t = OSL_SYSUPTIME();
+
+			if (ctx->fc_defer_timestamp == 0) {
+				/* first signle ac scenario */
+				ctx->fc_defer_timestamp = curr_t;
+				return FALSE;
+			}
+
+			/* single AC duration, this handles wrap around, e.g. 1 - ~0 = 2. */
+			delta = curr_t - ctx->fc_defer_timestamp;
+			if (delta >= WLFC_FC_DEFER_PERIOD_MS) {
+				ctx->allow_fc = TRUE;
+			}
+		}
+	} else {
+		/* multiple ACs or BCMC in queue */
+		ctx->allow_fc = FALSE;
+		ctx->fc_defer_timestamp = 0;
+	}
+
+	return ctx->allow_fc;
+}
+
+static void
+_dhd_wlfc_flow_control_check(athost_wl_status_info_t* ctx, struct pktq* pq, uint8 if_id)
+{
+	dhd_pub_t *dhdp;
+
+	ASSERT(ctx);
+
+	dhdp = (dhd_pub_t *)ctx->dhdp;
+	ASSERT(dhdp);
+
+	if (dhdp->skip_fc && dhdp->skip_fc())
+		return;
+
+	if ((ctx->hostif_flow_state[if_id] == OFF) && !_dhd_wlfc_allow_fc(ctx, if_id))
+		return;
+
+	if ((pq->len <= WLFC_FLOWCONTROL_LOWATER) && (ctx->hostif_flow_state[if_id] == ON)) {
+		/* start traffic */
+		ctx->hostif_flow_state[if_id] = OFF;
+		/*
+		WLFC_DBGMESG(("qlen:%02d, if:%02d, ->OFF, start traffic %s()\n",
+		pq->len, if_id, __FUNCTION__));
+		*/
+		WLFC_DBGMESG(("F"));
+
+		dhd_txflowcontrol(dhdp, if_id, OFF);
+
+		ctx->toggle_host_if = 0;
+	}
+
+	if ((pq->len >= WLFC_FLOWCONTROL_HIWATER) && (ctx->hostif_flow_state[if_id] == OFF)) {
+		/* stop traffic */
+		ctx->hostif_flow_state[if_id] = ON;
+		/*
+		WLFC_DBGMESG(("qlen:%02d, if:%02d, ->ON, stop traffic   %s()\n",
+		pq->len, if_id, __FUNCTION__));
+		*/
+		WLFC_DBGMESG(("N"));
+
+		dhd_txflowcontrol(dhdp, if_id, ON);
+
+		ctx->host_ifidx = if_id;
+		ctx->toggle_host_if = 1;
+	}
+
+	return;
+}
+
+static int
+_dhd_wlfc_send_signalonly_packet(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+	uint8 ta_bmp)
+{
+	int rc = BCME_OK;
+	void* p = NULL;
+	int dummylen = ((dhd_pub_t *)ctx->dhdp)->hdrlen+ 16;
+	dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+	if (dhdp->proptxstatus_txoff) {
+		rc = BCME_NORESOURCE;
+		return rc;
+	}
+
+	/* allocate a dummy packet */
+	p = PKTGET(ctx->osh, dummylen, TRUE);
+	if (p) {
+		PKTPULL(ctx->osh, p, dummylen);
+		DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), 0);
+		_dhd_wlfc_pushheader(ctx, &p, TRUE, ta_bmp, entry->mac_handle, 0, 0, FALSE);
+		DHD_PKTTAG_SETSIGNALONLY(PKTTAG(p), 1);
+		DHD_PKTTAG_WLFCPKT_SET(PKTTAG(p), 1);
+#ifdef PROP_TXSTATUS_DEBUG
+		ctx->stats.signal_only_pkts_sent++;
+#endif
+
+#if defined(BCMPCIE)
+		rc = dhd_bus_txdata(dhdp->bus, p, ctx->host_ifidx);
+#else
+		rc = dhd_bus_txdata(dhdp->bus, p);
+#endif
+		if (rc != BCME_OK) {
+			_dhd_wlfc_pullheader(ctx, p);
+			PKTFREE(ctx->osh, p, TRUE);
+		}
+	}
+	else {
+		DHD_ERROR(("%s: couldn't allocate new %d-byte packet\n",
+		           __FUNCTION__, dummylen));
+		rc = BCME_NOMEM;
+	}
+	return rc;
+}
+
+/* Return TRUE if traffic availability changed */
+static bool
+_dhd_wlfc_traffic_pending_check(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+	int prec)
+{
+	bool rc = FALSE;
+
+	if (entry->state == WLFC_STATE_CLOSE) {
+		if ((pktq_plen(&entry->psq, (prec << 1)) == 0) &&
+			(pktq_plen(&entry->psq, ((prec << 1) + 1)) == 0)) {
+
+			if (entry->traffic_pending_bmp & NBITVAL(prec)) {
+				rc = TRUE;
+				entry->traffic_pending_bmp =
+					entry->traffic_pending_bmp & ~ NBITVAL(prec);
+			}
+		}
+		else {
+			if (!(entry->traffic_pending_bmp & NBITVAL(prec))) {
+				rc = TRUE;
+				entry->traffic_pending_bmp =
+					entry->traffic_pending_bmp | NBITVAL(prec);
+			}
+		}
+	}
+	if (rc) {
+		/* request a TIM update to firmware at the next piggyback opportunity */
+		if (entry->traffic_lastreported_bmp != entry->traffic_pending_bmp) {
+			entry->send_tim_signal = 1;
+			_dhd_wlfc_send_signalonly_packet(ctx, entry, entry->traffic_pending_bmp);
+			entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+			entry->send_tim_signal = 0;
+		}
+		else {
+			rc = FALSE;
+		}
+	}
+	return rc;
+}
+
+static int
+_dhd_wlfc_enque_suppressed(athost_wl_status_info_t* ctx, int prec, void* p)
+{
+	wlfc_mac_descriptor_t* entry;
+
+	entry = _dhd_wlfc_find_table_entry(ctx, p);
+	if (entry == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_NOTFOUND;
+	}
+	/*
+	- suppressed packets go to sub_queue[2*prec + 1] AND
+	- delayed packets go to sub_queue[2*prec + 0] to ensure
+	order of delivery.
+	*/
+	if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, p, ((prec << 1) + 1), FALSE,
+		WLFC_SEQCOUNT(entry, prec))
+		== FALSE) {
+		ctx->stats.delayq_full_error++;
+		/* WLFC_DBGMESG(("Error: %s():%d\n", __FUNCTION__, __LINE__)); */
+		WLFC_DBGMESG(("s"));
+		return BCME_ERROR;
+	}
+
+	/* A packet has been pushed, update traffic availability bitmap, if applicable */
+	_dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+	_dhd_wlfc_flow_control_check(ctx, &entry->psq, DHD_PKTTAG_IF(PKTTAG(p)));
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_pretx_pktprocess(athost_wl_status_info_t* ctx,
+	wlfc_mac_descriptor_t* entry, void** packet, int header_needed, uint32* slot)
+{
+	int rc = BCME_OK;
+	int hslot = WLFC_HANGER_MAXITEMS;
+	bool send_tim_update = FALSE;
+	uint32 htod = 0;
+	uint16 htodseq = 0;
+	uint8 free_ctr, flags = 0;
+	int gen = 0xff;
+	dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+	void * p = *packet;
+
+	*slot = hslot;
+
+	if (entry == NULL) {
+		entry = _dhd_wlfc_find_table_entry(ctx, p);
+	}
+
+	if (entry == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_ERROR;
+	}
+
+	if (entry->send_tim_signal) {
+		send_tim_update = TRUE;
+		entry->send_tim_signal = 0;
+		entry->traffic_lastreported_bmp = entry->traffic_pending_bmp;
+	}
+
+	if (header_needed) {
+		if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+			hslot = (uint)(entry - &ctx->destination_entries.nodes[0]);
+		} else {
+			hslot = _dhd_wlfc_hanger_get_free_slot(ctx->hanger);
+		}
+		gen = entry->generation;
+		free_ctr = WLFC_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+	} else {
+		if (WLFC_GET_REUSESEQ(dhdp->wlfc_mode)) {
+			htodseq = DHD_PKTTAG_H2DSEQ(PKTTAG(p));
+		}
+
+		hslot = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+
+		if (WLFC_GET_REORDERSUPP(dhdp->wlfc_mode)) {
+			gen = entry->generation;
+		} else if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+			gen = WL_TXSTATUS_GET_GENERATION(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+		} else {
+			_dhd_wlfc_hanger_get_genbit(ctx->hanger, p, hslot, &gen);
+		}
+
+		free_ctr = WL_TXSTATUS_GET_FREERUNCTR(DHD_PKTTAG_H2DTAG(PKTTAG(p)));
+		/* remove old header */
+		_dhd_wlfc_pullheader(ctx, p);
+	}
+
+	if (hslot >= WLFC_HANGER_MAXITEMS) {
+		DHD_ERROR(("Error: %s():no hanger slot available\n", __FUNCTION__));
+		return BCME_ERROR;
+	}
+
+	flags = WLFC_PKTFLAG_PKTFROMHOST;
+	if (!DHD_PKTTAG_CREDITCHECK(PKTTAG(p))) {
+		/*
+		Indicate that this packet is being sent in response to an
+		explicit request from the firmware side.
+		*/
+		flags |= WLFC_PKTFLAG_PKT_REQUESTED;
+	}
+	if (pkt_is_dhcp(ctx->osh, p)) {
+		flags |= WLFC_PKTFLAG_PKT_FORCELOWRATE;
+	}
+
+	WL_TXSTATUS_SET_FREERUNCTR(htod, free_ctr);
+	WL_TXSTATUS_SET_HSLOT(htod, hslot);
+	WL_TXSTATUS_SET_FIFO(htod, DHD_PKTTAG_FIFO(PKTTAG(p)));
+	WL_TXSTATUS_SET_FLAGS(htod, flags);
+	WL_TXSTATUS_SET_GENERATION(htod, gen);
+	DHD_PKTTAG_SETPKTDIR(PKTTAG(p), 1);
+
+	rc = _dhd_wlfc_pushheader(ctx, &p, send_tim_update,
+		entry->traffic_lastreported_bmp, entry->mac_handle, htod, htodseq, FALSE);
+	if (rc == BCME_OK) {
+		DHD_PKTTAG_SET_H2DTAG(PKTTAG(p), htod);
+
+		if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && header_needed) {
+			/*
+			a new header was created for this packet.
+			push to hanger slot and scrub q. Since bus
+			send succeeded, increment seq number as well.
+			*/
+			rc = _dhd_wlfc_hanger_pushpkt(ctx->hanger, p, hslot);
+			if (rc == BCME_OK) {
+#ifdef PROP_TXSTATUS_DEBUG
+				((wlfc_hanger_t*)(ctx->hanger))->items[hslot].push_time =
+					OSL_SYSUPTIME();
+#endif
+			} else {
+				DHD_ERROR(("%s() hanger_pushpkt() failed, rc: %d\n",
+					__FUNCTION__, rc));
+			}
+		}
+
+		if ((rc == BCME_OK) && header_needed) {
+			/* increment free running sequence count */
+			WLFC_INCR_SEQCOUNT(entry, DHD_PKTTAG_FIFO(PKTTAG(p)));
+		}
+	}
+	*slot = hslot;
+	*packet = p;
+	return rc;
+}
+
+static int
+_dhd_wlfc_is_destination_open(athost_wl_status_info_t* ctx,
+	wlfc_mac_descriptor_t* entry, int prec)
+{
+	if (entry->interface_id >= WLFC_MAX_IFNUM) {
+		ASSERT(&ctx->destination_entries.other == entry);
+		return 1;
+	}
+	if (ctx->destination_entries.interfaces[entry->interface_id].iftype ==
+		WLC_E_IF_ROLE_P2P_GO) {
+		/* - destination interface is of type p2p GO.
+		For a p2pGO interface, if the destination is OPEN but the interface is
+		CLOSEd, do not send traffic. But if the dstn is CLOSEd while there is
+		destination-specific-credit left send packets. This is because the
+		firmware storing the destination-specific-requested packet in queue.
+		*/
+		if ((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+			(entry->requested_packet == 0)) {
+			return 0;
+		}
+	}
+	/* AP, p2p_go -> unicast desc entry, STA/p2p_cl -> interface desc. entry */
+	if (((entry->state == WLFC_STATE_CLOSE) && (entry->requested_credit == 0) &&
+		(entry->requested_packet == 0)) ||
+		(!(entry->ac_bitmap & (1 << prec)))) {
+		return 0;
+	}
+
+	return 1;
+}
+
+static void*
+_dhd_wlfc_deque_delayedq(athost_wl_status_info_t* ctx, int prec,
+	uint8* ac_credit_spent, uint8* needs_hdr, wlfc_mac_descriptor_t** entry_out,
+	bool only_no_credit)
+{
+	dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+	wlfc_mac_descriptor_t* entry;
+	int total_entries;
+	void* p = NULL;
+	int i;
+
+	*entry_out = NULL;
+	/* most cases a packet will count against FIFO credit */
+	*ac_credit_spent = ((prec == AC_COUNT) && !ctx->bcmc_credit_supported) ? 0 : 1;
+
+	/* search all entries, include nodes as well as interfaces */
+	if (only_no_credit) {
+		total_entries = ctx->requested_entry_count;
+	} else {
+		total_entries = ctx->active_entry_count;
+	}
+
+	for (i = 0; i < total_entries; i++) {
+		if (only_no_credit) {
+			entry = ctx->requested_entry[i];
+		} else {
+			entry = ctx->active_entry_head;
+			/* move head to ensure fair round-robin */
+			ctx->active_entry_head = ctx->active_entry_head->next;
+		}
+		ASSERT(entry);
+
+		if (entry->transit_count < 0) {
+			DHD_ERROR(("Error: %s():%d transit_count %d < 0\n",
+			    __FUNCTION__, __LINE__, entry->transit_count));
+			continue;
+		}
+		if (entry->occupied && _dhd_wlfc_is_destination_open(ctx, entry, prec) &&
+			(entry->transit_count < WL_TXSTATUS_FREERUNCTR_MASK) &&
+			!(WLFC_GET_REORDERSUPP(dhdp->wlfc_mode) && entry->suppressed)) {
+			if (entry->state == WLFC_STATE_CLOSE) {
+				*ac_credit_spent = 0;
+			}
+
+			/* higher precedence will be picked up first,
+			 * i.e. suppressed packets before delayed ones
+			 */
+			p = pktq_pdeq(&entry->psq, PSQ_SUP_IDX(prec));
+			*needs_hdr = 0;
+			if (p == NULL) {
+				if (entry->suppressed == TRUE) {
+					/* skip this entry */
+					continue;
+				}
+				/* De-Q from delay Q */
+				p = pktq_pdeq(&entry->psq, PSQ_DLY_IDX(prec));
+				*needs_hdr = 1;
+			}
+
+			if (p != NULL) {
+				/* did the packet come from suppress sub-queue? */
+				if (entry->requested_credit > 0) {
+					entry->requested_credit--;
+#ifdef PROP_TXSTATUS_DEBUG
+					entry->dstncredit_sent_packets++;
+#endif
+				} else if (entry->requested_packet > 0) {
+					entry->requested_packet--;
+					DHD_PKTTAG_SETONETIMEPKTRQST(PKTTAG(p));
+				}
+
+				*entry_out = entry;
+				ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec]--;
+				ctx->pkt_cnt_per_ac[prec]--;
+				_dhd_wlfc_flow_control_check(ctx, &entry->psq,
+					DHD_PKTTAG_IF(PKTTAG(p)));
+				/*
+				A packet has been picked up, update traffic
+				availability bitmap, if applicable
+				*/
+				_dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+				return p;
+			}
+		}
+	}
+	return NULL;
+}
+
+static int
+_dhd_wlfc_enque_delayq(athost_wl_status_info_t* ctx, void* pktbuf, int prec)
+{
+	wlfc_mac_descriptor_t* entry;
+
+	if (pktbuf != NULL) {
+		entry = _dhd_wlfc_find_table_entry(ctx, pktbuf);
+		if (entry == NULL) {
+			DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+			return BCME_ERROR;
+		}
+
+		/*
+		- suppressed packets go to sub_queue[2*prec + 1] AND
+		- delayed packets go to sub_queue[2*prec + 0] to ensure
+		order of delivery.
+		*/
+		if (_dhd_wlfc_prec_enq_with_drop(ctx->dhdp, &entry->psq, pktbuf, (prec << 1),
+			FALSE, WLFC_SEQCOUNT(entry, prec))
+			== FALSE) {
+			WLFC_DBGMESG(("D"));
+			ctx->stats.delayq_full_error++;
+			return BCME_ERROR;
+		}
+
+#ifdef QMONITOR
+		dhd_qmon_tx(&entry->qmon);
+#endif
+
+		/*
+		A packet has been pushed, update traffic availability bitmap,
+		if applicable
+		*/
+		_dhd_wlfc_traffic_pending_check(ctx, entry, prec);
+	}
+
+	return BCME_OK;
+}
+
+static bool _dhd_wlfc_ifpkt_fn(void* p, void *p_ifid)
+{
+	if (!p || !p_ifid)
+		return FALSE;
+
+	return (DHD_PKTTAG_WLFCPKT(PKTTAG(p))&& (*((uint8 *)p_ifid) == DHD_PKTTAG_IF(PKTTAG(p))));
+}
+
+static bool _dhd_wlfc_entrypkt_fn(void* p, void *entry)
+{
+	if (!p || !entry)
+		return FALSE;
+
+	return (DHD_PKTTAG_WLFCPKT(PKTTAG(p))&& (entry == DHD_PKTTAG_ENTRY(PKTTAG(p))));
+}
+
+static void
+_dhd_wlfc_return_implied_credit(athost_wl_status_info_t* wlfc, void* pkt)
+{
+	dhd_pub_t *dhdp;
+
+	if (!wlfc || !pkt) {
+		return;
+	}
+
+	dhdp = (dhd_pub_t *)(wlfc->dhdp);
+	if (dhdp && (dhdp->proptxstatus_mode == WLFC_FCMODE_IMPLIED_CREDIT) &&
+		DHD_PKTTAG_CREDITCHECK(PKTTAG(pkt))) {
+		int lender, credit_returned = 0;
+		uint8 fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pkt));
+
+		/* Note that borrower is fifo_id */
+		/* Return credits to highest priority lender first */
+		for (lender = AC_COUNT; lender >= 0; lender--) {
+			if (wlfc->credits_borrowed[fifo_id][lender] > 0) {
+				wlfc->FIFO_credit[lender]++;
+				wlfc->credits_borrowed[fifo_id][lender]--;
+				credit_returned = 1;
+				break;
+			}
+		}
+
+		if (!credit_returned) {
+			wlfc->FIFO_credit[fifo_id]++;
+		}
+	}
+}
+
+static void
+_dhd_wlfc_hanger_free_pkt(athost_wl_status_info_t* wlfc, uint32 slot_id, uint8 pkt_state,
+	int pkt_txstatus)
+{
+	wlfc_hanger_t* hanger;
+	wlfc_hanger_item_t* item;
+
+	if (!wlfc)
+		return;
+
+	hanger = (wlfc_hanger_t*)wlfc->hanger;
+	if (!hanger)
+		return;
+
+	if (slot_id == WLFC_HANGER_MAXITEMS)
+		return;
+
+	item = &hanger->items[slot_id];
+	item->pkt_state |= pkt_state;
+	if (pkt_txstatus != -1) {
+		item->pkt_txstatus = pkt_txstatus;
+	}
+
+	if (item->pkt) {
+		if ((item->pkt_state & WLFC_HANGER_PKT_STATE_TXCOMPLETE) &&
+			(item->pkt_state & (WLFC_HANGER_PKT_STATE_TXSTATUS |
+			WLFC_HANGER_PKT_STATE_CLEANUP))) {
+			void *p = NULL;
+			void *pkt = item->pkt;
+			uint8 old_state = item->state;
+			int ret = _dhd_wlfc_hanger_poppkt(wlfc->hanger, slot_id, &p, TRUE);
+			BCM_REFERENCE(ret);
+			BCM_REFERENCE(pkt);
+			ASSERT((ret == BCME_OK) && p && (pkt == p));
+
+			/* free packet */
+			if (!(item->pkt_state & WLFC_HANGER_PKT_STATE_TXSTATUS)) {
+				/* cleanup case */
+				wlfc_mac_descriptor_t *entry = _dhd_wlfc_find_table_entry(wlfc, p);
+
+				ASSERT(entry);
+				entry->transit_count--;
+				if (entry->suppressed &&
+					(--entry->suppr_transit_count == 0)) {
+					entry->suppressed = FALSE;
+				}
+				_dhd_wlfc_return_implied_credit(wlfc, p);
+				wlfc->stats.cleanup_fw_cnt++;
+				/* slot not freeable yet */
+				item->state = old_state;
+			}
+
+			wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))]
+				[DHD_PKTTAG_FIFO(PKTTAG(p))]--;
+			wlfc->stats.pktout++;
+			dhd_txcomplete((dhd_pub_t *)wlfc->dhdp, p, item->pkt_txstatus);
+			PKTFREE(wlfc->osh, p, TRUE);
+		}
+	} else {
+		if (item->pkt_state & WLFC_HANGER_PKT_STATE_TXSTATUS) {
+			/* free slot */
+			if (item->state == WLFC_HANGER_ITEM_STATE_FREE)
+				DHD_ERROR(("Error: %s():%d get multi TXSTATUS for one packet???\n",
+				    __FUNCTION__, __LINE__));
+			item->state = WLFC_HANGER_ITEM_STATE_FREE;
+		}
+	}
+}
+
+static void
+_dhd_wlfc_pktq_flush(athost_wl_status_info_t* ctx, struct pktq *pq,
+	bool dir, f_processpkt_t fn, void *arg, q_type_t q_type)
+{
+	int prec;
+	dhd_pub_t *dhdp = (dhd_pub_t *)ctx->dhdp;
+
+	ASSERT(dhdp);
+
+	/* Optimize flush, if pktq len = 0, just return.
+	 * pktq len of 0 means pktq's prec q's are all empty.
+	 */
+	if (pq->len == 0) {
+		return;
+	}
+
+
+	for (prec = 0; prec < pq->num_prec; prec++) {
+		struct pktq_prec *q;
+		void *p, *prev = NULL;
+
+		q = &pq->q[prec];
+		p = q->head;
+		while (p) {
+			if (fn == NULL || (*fn)(p, arg)) {
+				bool head = (p == q->head);
+				if (head)
+					q->head = PKTLINK(p);
+				else
+					PKTSETLINK(prev, PKTLINK(p));
+				if (q_type == Q_TYPE_PSQ) {
+					if (!WLFC_GET_AFQ(dhdp->wlfc_mode) && (prec & 1)) {
+						_dhd_wlfc_hanger_remove_reference(ctx->hanger, p);
+					}
+					ctx->pkt_cnt_in_q[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+					ctx->pkt_cnt_per_ac[prec>>1]--;
+					ctx->stats.cleanup_psq_cnt++;
+					if (!(prec & 1)) {
+						/* pkt in delayed q, so fake push BDC header for
+						 * dhd_tcpack_check_xmit() and dhd_txcomplete().
+						 */
+						_dhd_wlfc_pushheader(ctx, &p, FALSE, 0, 0,
+							0, 0, TRUE);
+#ifdef DHDTCPACK_SUPPRESS
+						if (dhd_tcpack_check_xmit(dhdp, p) == BCME_ERROR) {
+							DHD_ERROR(("%s %d: tcpack_suppress ERROR!!!"
+								" Stop using it\n",
+								__FUNCTION__, __LINE__));
+							dhd_tcpack_suppress_set(dhdp,
+								TCPACK_SUP_OFF);
+						}
+#endif /* DHDTCPACK_SUPPRESS */
+					}
+				} else if (q_type == Q_TYPE_AFQ) {
+					wlfc_mac_descriptor_t* entry =
+						_dhd_wlfc_find_table_entry(ctx, p);
+					entry->transit_count--;
+					if (entry->suppressed &&
+						(--entry->suppr_transit_count == 0)) {
+						entry->suppressed = FALSE;
+					}
+					_dhd_wlfc_return_implied_credit(ctx, p);
+					ctx->stats.cleanup_fw_cnt++;
+				}
+				PKTSETLINK(p, NULL);
+				if (dir) {
+					ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(p))][prec>>1]--;
+					ctx->stats.pktout++;
+					dhd_txcomplete(dhdp, p, FALSE);
+				}
+				PKTFREE(ctx->osh, p, dir);
+
+				q->len--;
+				pq->len--;
+				p = (head ? q->head : PKTLINK(prev));
+			} else {
+				prev = p;
+				p = PKTLINK(p);
+			}
+		}
+
+		if (q->head == NULL) {
+			ASSERT(q->len == 0);
+			q->tail = NULL;
+		}
+
+	}
+
+	if (fn == NULL)
+		ASSERT(pq->len == 0);
+}
+
+static void*
+_dhd_wlfc_pktq_pdeq_with_fn(struct pktq *pq, int prec, f_processpkt_t fn, void *arg)
+{
+	struct pktq_prec *q;
+	void *p, *prev = NULL;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+	p = q->head;
+
+	while (p) {
+		if (fn == NULL || (*fn)(p, arg)) {
+			break;
+		} else {
+			prev = p;
+			p = PKTLINK(p);
+		}
+	}
+	if (p == NULL)
+		return NULL;
+
+	if (prev == NULL) {
+		if ((q->head = PKTLINK(p)) == NULL) {
+			q->tail = NULL;
+		}
+	} else {
+		PKTSETLINK(prev, PKTLINK(p));
+		if (q->tail == p) {
+			q->tail = prev;
+		}
+	}
+
+	q->len--;
+
+	pq->len--;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+static void
+_dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+	int prec;
+	void *pkt = NULL, *head = NULL, *tail = NULL;
+	struct pktq *txq = (struct pktq *)dhd_bus_txq(dhd->bus);
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+	wlfc_mac_descriptor_t* entry;
+
+	dhd_os_sdlock_txq(dhd);
+	for (prec = 0; prec < txq->num_prec; prec++) {
+		while ((pkt = _dhd_wlfc_pktq_pdeq_with_fn(txq, prec, fn, arg))) {
+#ifdef DHDTCPACK_SUPPRESS
+			if (dhd_tcpack_check_xmit(dhd, pkt) == BCME_ERROR) {
+				DHD_ERROR(("%s %d: tcpack_suppress ERROR!!! Stop using it\n",
+					__FUNCTION__, __LINE__));
+				dhd_tcpack_suppress_set(dhd, TCPACK_SUP_OFF);
+			}
+#endif /* DHDTCPACK_SUPPRESS */
+			if (!head) {
+				head = pkt;
+			}
+			if (tail) {
+				PKTSETLINK(tail, pkt);
+			}
+			tail = pkt;
+		}
+	}
+	dhd_os_sdunlock_txq(dhd);
+
+
+	while ((pkt = head)) {
+		head = PKTLINK(pkt);
+		PKTSETLINK(pkt, NULL);
+		entry = _dhd_wlfc_find_table_entry(wlfc, pkt);
+
+		if (!WLFC_GET_AFQ(dhd->wlfc_mode) &&
+			!_dhd_wlfc_hanger_remove_reference(h, pkt)) {
+			DHD_ERROR(("%s: can't find pkt(%p) in hanger, free it anyway\n",
+				__FUNCTION__, pkt));
+		}
+		entry->transit_count--;
+		if (entry->suppressed &&
+			(--entry->suppr_transit_count == 0)) {
+			entry->suppressed = FALSE;
+		}
+		_dhd_wlfc_return_implied_credit(wlfc, pkt);
+		wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pkt))][DHD_PKTTAG_FIFO(PKTTAG(pkt))]--;
+		wlfc->stats.pktout++;
+		wlfc->stats.cleanup_txq_cnt++;
+		dhd_txcomplete(dhd, pkt, FALSE);
+		PKTFREE(wlfc->osh, pkt, TRUE);
+	}
+}
+
+void
+_dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+	int i;
+	int total_entries;
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* table;
+	wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+
+	wlfc->stats.cleanup_txq_cnt = 0;
+	wlfc->stats.cleanup_psq_cnt = 0;
+	wlfc->stats.cleanup_fw_cnt = 0;
+	/*
+	*  flush sequence shoulde be txq -> psq -> hanger/afq, hanger has to be last one
+	*/
+	/* flush bus->txq */
+	_dhd_wlfc_cleanup_txq(dhd, fn, arg);
+
+
+	/* flush psq, search all entries, include nodes as well as interfaces */
+	total_entries = sizeof(wlfc->destination_entries)/sizeof(wlfc_mac_descriptor_t);
+	table = (wlfc_mac_descriptor_t*)&wlfc->destination_entries;
+
+	for (i = 0; i < total_entries; i++) {
+		if (table[i].occupied) {
+			/* release packets held in PSQ (both delayed and suppressed) */
+			if (table[i].psq.len) {
+				WLFC_DBGMESG(("%s(): PSQ[%d].len = %d\n",
+					__FUNCTION__, i, table[i].psq.len));
+				_dhd_wlfc_pktq_flush(wlfc, &table[i].psq, TRUE,
+					fn, arg, Q_TYPE_PSQ);
+			}
+
+			/* free packets held in AFQ */
+			if (WLFC_GET_AFQ(dhd->wlfc_mode) && (table[i].afq.len)) {
+				_dhd_wlfc_pktq_flush(wlfc, &table[i].afq, TRUE,
+					fn, arg, Q_TYPE_AFQ);
+			}
+
+			if ((fn == NULL) && (&table[i] != &wlfc->destination_entries.other)) {
+				table[i].occupied = 0;
+				if (table[i].transit_count || table[i].suppr_transit_count) {
+					DHD_ERROR(("%s: table[%d] transit(%d), suppr_tansit(%d)\n",
+						__FUNCTION__, i,
+						table[i].transit_count,
+						table[i].suppr_transit_count));
+				}
+			}
+		}
+	}
+
+	/*
+		. flush remained pkt in hanger queue, not in bus->txq nor psq.
+		. the remained pkt was successfully downloaded to dongle already.
+		. hanger slot state cannot be set to free until receive txstatus update.
+	*/
+	if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+		for (i = 0; i < h->max_items; i++) {
+			if ((h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE) ||
+				(h->items[i].state == WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED)) {
+				if (fn == NULL || (*fn)(h->items[i].pkt, arg)) {
+					_dhd_wlfc_hanger_free_pkt(wlfc, i,
+						WLFC_HANGER_PKT_STATE_CLEANUP, FALSE);
+				}
+			}
+		}
+	}
+
+	return;
+}
+
+static int
+_dhd_wlfc_mac_entry_update(athost_wl_status_info_t* ctx, wlfc_mac_descriptor_t* entry,
+	uint8 action, uint8 ifid, uint8 iftype, uint8* ea,
+	f_processpkt_t fn, void *arg)
+{
+	int rc = BCME_OK;
+
+#ifdef QMONITOR
+	dhd_qmon_reset(&entry->qmon);
+#endif
+
+	if ((action == eWLFC_MAC_ENTRY_ACTION_ADD) || (action == eWLFC_MAC_ENTRY_ACTION_UPDATE)) {
+		entry->occupied = 1;
+		entry->state = WLFC_STATE_OPEN;
+		entry->requested_credit = 0;
+		entry->interface_id = ifid;
+		entry->iftype = iftype;
+		entry->ac_bitmap = 0xff; /* update this when handling APSD */
+		/* for an interface entry we may not care about the MAC address */
+		if (ea != NULL)
+			memcpy(&entry->ea[0], ea, ETHER_ADDR_LEN);
+
+		if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+			entry->suppressed = FALSE;
+			entry->transit_count = 0;
+			entry->suppr_transit_count = 0;
+		}
+
+#ifdef P2PONEINT
+		if ((action == eWLFC_MAC_ENTRY_ACTION_ADD) ||
+		   ((action == eWLFC_MAC_ENTRY_ACTION_UPDATE) && (entry->psq.num_prec == 0))) {
+#else
+		if (action == eWLFC_MAC_ENTRY_ACTION_ADD) {
+#endif
+			dhd_pub_t *dhdp = (dhd_pub_t *)(ctx->dhdp);
+			pktq_init(&entry->psq, WLFC_PSQ_PREC_COUNT, WLFC_PSQ_LEN);
+			if (WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+				pktq_init(&entry->afq, WLFC_AFQ_PREC_COUNT, WLFC_PSQ_LEN);
+			}
+
+			if (entry->next == NULL) {
+				/* not linked to anywhere, add to tail */
+				if (ctx->active_entry_head) {
+					entry->prev = ctx->active_entry_head->prev;
+					ctx->active_entry_head->prev->next = entry;
+					ctx->active_entry_head->prev = entry;
+					entry->next = ctx->active_entry_head;
+
+				} else {
+					ASSERT(ctx->active_entry_count == 0);
+					entry->prev = entry->next = entry;
+					ctx->active_entry_head = entry;
+				}
+				ctx->active_entry_count++;
+			} else {
+				DHD_ERROR(("%s():%d, entry(%d)\n", __FUNCTION__, __LINE__,
+					(int)(entry - &ctx->destination_entries.nodes[0])));
+			}
+		}
+	} else if (action == eWLFC_MAC_ENTRY_ACTION_DEL) {
+		/* When the entry is deleted, the packets that are queued in the entry must be
+		   cleanup. The cleanup action should be before the occupied is set as 0.
+		*/
+		_dhd_wlfc_cleanup(ctx->dhdp, fn, arg);
+		_dhd_wlfc_flow_control_check(ctx, &entry->psq, ifid);
+
+		entry->occupied = 0;
+		entry->state = WLFC_STATE_CLOSE;
+		memset(&entry->ea[0], 0, ETHER_ADDR_LEN);
+
+		if (entry->next) {
+			/* not floating, remove from Q */
+			if (ctx->active_entry_count <= 1) {
+				/* last item */
+				ctx->active_entry_head = NULL;
+				ctx->active_entry_count = 0;
+			} else {
+				entry->prev->next = entry->next;
+				entry->next->prev = entry->prev;
+				if (entry == ctx->active_entry_head) {
+					ctx->active_entry_head = entry->next;
+				}
+				ctx->active_entry_count--;
+			}
+			entry->next = entry->prev = NULL;
+		} else {
+			DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		}
+	}
+	return rc;
+}
+
+#ifdef LIMIT_BORROW
+static int
+_dhd_wlfc_borrow_credit(athost_wl_status_info_t* ctx, int highest_lender_ac, int borrower_ac,
+	bool bBorrowAll)
+{
+	int lender_ac, borrow_limit = 0;
+	int rc = -1;
+
+	if (ctx == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return -1;
+	}
+
+	/* Borrow from lowest priority available AC (including BC/MC credits) */
+	for (lender_ac = 0; lender_ac <= highest_lender_ac; lender_ac++) {
+		if (!bBorrowAll) {
+			borrow_limit = ctx->Init_FIFO_credit[lender_ac]/WLFC_BORROW_LIMIT_RATIO;
+		} else {
+			borrow_limit = 0;
+		}
+
+		if (ctx->FIFO_credit[lender_ac] > borrow_limit) {
+			ctx->credits_borrowed[borrower_ac][lender_ac]++;
+			ctx->FIFO_credit[lender_ac]--;
+			rc = lender_ac;
+			break;
+		}
+	}
+
+	return rc;
+}
+
+static int _dhd_wlfc_return_credit(athost_wl_status_info_t* ctx, int lender_ac, int borrower_ac)
+{
+	if ((ctx == NULL) || (lender_ac < 0) || (lender_ac > AC_COUNT) ||
+		(borrower_ac < 0) || (borrower_ac > AC_COUNT)) {
+		DHD_ERROR(("Error: %s():%d, ctx(%p), lender_ac(%d), borrower_ac(%d)\n",
+			__FUNCTION__, __LINE__, ctx, lender_ac, borrower_ac));
+
+		return BCME_BADARG;
+	}
+
+	ctx->credits_borrowed[borrower_ac][lender_ac]--;
+	ctx->FIFO_credit[lender_ac]++;
+
+	return BCME_OK;
+}
+#endif /* LIMIT_BORROW */
+
+static int
+_dhd_wlfc_interface_entry_update(void* state,
+	uint8 action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+	athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+	wlfc_mac_descriptor_t* entry;
+
+	if (ifid >= WLFC_MAX_IFNUM)
+		return BCME_BADARG;
+
+	entry = &ctx->destination_entries.interfaces[ifid];
+
+	return _dhd_wlfc_mac_entry_update(ctx, entry, action, ifid, iftype, ea,
+		_dhd_wlfc_ifpkt_fn, &ifid);
+}
+
+static int
+_dhd_wlfc_BCMCCredit_support_update(void* state)
+{
+	athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+
+	ctx->bcmc_credit_supported = TRUE;
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_FIFOcreditmap_update(void* state, uint8* credits)
+{
+	athost_wl_status_info_t* ctx = (athost_wl_status_info_t*)state;
+	int i;
+
+	for (i = 0; i <= 4; i++) {
+		if (ctx->Init_FIFO_credit[i] != ctx->FIFO_credit[i]) {
+			DHD_ERROR(("%s: credit[i] is not returned, (%d %d)\n",
+				__FUNCTION__, ctx->Init_FIFO_credit[i], ctx->FIFO_credit[i]));
+		}
+	}
+
+	/* update the AC FIFO credit map */
+	ctx->FIFO_credit[0] += (credits[0] - ctx->Init_FIFO_credit[0]);
+	ctx->FIFO_credit[1] += (credits[1] - ctx->Init_FIFO_credit[1]);
+	ctx->FIFO_credit[2] += (credits[2] - ctx->Init_FIFO_credit[2]);
+	ctx->FIFO_credit[3] += (credits[3] - ctx->Init_FIFO_credit[3]);
+	ctx->FIFO_credit[4] += (credits[4] - ctx->Init_FIFO_credit[4]);
+
+	ctx->Init_FIFO_credit[0] = credits[0];
+	ctx->Init_FIFO_credit[1] = credits[1];
+	ctx->Init_FIFO_credit[2] = credits[2];
+	ctx->Init_FIFO_credit[3] = credits[3];
+	ctx->Init_FIFO_credit[4] = credits[4];
+
+	/* credit for ATIM FIFO is not used yet. */
+	ctx->Init_FIFO_credit[5] = ctx->FIFO_credit[5] = 0;
+
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_handle_packet_commit(athost_wl_status_info_t* ctx, int ac,
+    dhd_wlfc_commit_info_t *commit_info, f_commitpkt_t fcommit, void* commit_ctx)
+{
+	uint32 hslot;
+	int	rc;
+	dhd_pub_t *dhdp = (dhd_pub_t *)(ctx->dhdp);
+
+	/*
+		if ac_fifo_credit_spent = 0
+
+		This packet will not count against the FIFO credit.
+		To ensure the txstatus corresponding to this packet
+		does not provide an implied credit (default behavior)
+		mark the packet accordingly.
+
+		if ac_fifo_credit_spent = 1
+
+		This is a normal packet and it counts against the FIFO
+		credit count.
+	*/
+	DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), commit_info->ac_fifo_credit_spent);
+	rc = _dhd_wlfc_pretx_pktprocess(ctx, commit_info->mac_entry, &commit_info->p,
+	     commit_info->needs_hdr, &hslot);
+
+	if (rc == BCME_OK) {
+		rc = fcommit(commit_ctx, commit_info->p);
+		if (rc == BCME_OK) {
+			uint8 gen = WL_TXSTATUS_GET_GENERATION(
+				DHD_PKTTAG_H2DTAG(PKTTAG(commit_info->p)));
+			ctx->stats.pkt2bus++;
+			if (commit_info->ac_fifo_credit_spent || (ac == AC_COUNT)) {
+				ctx->stats.send_pkts[ac]++;
+				WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac);
+			}
+
+			if (gen != commit_info->mac_entry->generation) {
+				/* will be suppressed back by design */
+				if (!commit_info->mac_entry->suppressed) {
+					commit_info->mac_entry->suppressed = TRUE;
+				}
+				commit_info->mac_entry->suppr_transit_count++;
+			}
+			commit_info->mac_entry->transit_count++;
+		} else if (commit_info->needs_hdr) {
+			if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+				void *pout = NULL;
+				/* pop hanger for delayed packet */
+				_dhd_wlfc_hanger_poppkt(ctx->hanger, WL_TXSTATUS_GET_HSLOT(
+					DHD_PKTTAG_H2DTAG(PKTTAG(commit_info->p))), &pout, TRUE);
+				ASSERT(commit_info->p == pout);
+			}
+		}
+	} else {
+		ctx->stats.generic_error++;
+	}
+
+	if (rc != BCME_OK) {
+		/*
+		   pretx pkt process or bus commit has failed, rollback.
+		   - remove wl-header for a delayed packet
+		   - save wl-header header for suppressed packets
+		   - reset credit check flag
+		*/
+		_dhd_wlfc_rollback_packet_toq(ctx, commit_info->p, commit_info->pkt_type, hslot);
+		DHD_PKTTAG_SETCREDITCHECK(PKTTAG(commit_info->p), 0);
+	}
+
+	return rc;
+}
+
+static uint8
+_dhd_wlfc_find_mac_desc_id_from_mac(dhd_pub_t *dhdp, uint8* ea)
+{
+	wlfc_mac_descriptor_t* table =
+		((athost_wl_status_info_t*)dhdp->wlfc_state)->destination_entries.nodes;
+	uint8 table_index;
+
+	if (ea != NULL) {
+		for (table_index = 0; table_index < WLFC_MAC_DESC_TABLE_SIZE; table_index++) {
+			if ((memcmp(ea, &table[table_index].ea[0], ETHER_ADDR_LEN) == 0) &&
+				table[table_index].occupied)
+				return table_index;
+		}
+	}
+	return WLFC_MAC_DESC_ID_INVALID;
+}
+
+static int
+_dhd_wlfc_compressed_txstatus_update(dhd_pub_t *dhd, uint8* pkt_info, uint8 len, void** p_mac)
+{
+	uint8 status_flag;
+	uint32 status;
+	int ret = BCME_OK;
+	int remove_from_hanger = 1;
+	void* pktbuf = NULL;
+	uint8 fifo_id = 0, gen = 0, count = 0, hcnt;
+	uint16 hslot;
+	wlfc_mac_descriptor_t* entry = NULL;
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	uint16 seq = 0, seq_fromfw = 0, seq_num = 0;
+
+	memcpy(&status, pkt_info, sizeof(uint32));
+	status_flag = WL_TXSTATUS_GET_FLAGS(status);
+	hcnt = WL_TXSTATUS_GET_FREERUNCTR(status);
+	hslot = WL_TXSTATUS_GET_HSLOT(status);
+	fifo_id = WL_TXSTATUS_GET_FIFO(status);
+	gen = WL_TXSTATUS_GET_GENERATION(status);
+
+	if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+		memcpy(&seq, pkt_info + WLFC_CTL_VALUE_LEN_TXSTATUS, WLFC_CTL_VALUE_LEN_SEQ);
+		seq_fromfw = WL_SEQ_GET_FROMFW(seq);
+		seq_num = WL_SEQ_GET_NUM(seq);
+	}
+
+	wlfc->stats.txstatus_in += len;
+
+	if (status_flag == WLFC_CTL_PKTFLAG_DISCARD) {
+		wlfc->stats.pkt_freed += len;
+	}
+
+	else if (status_flag == WLFC_CTL_PKTFLAG_DISCARD_NOACK) {
+		wlfc->stats.pkt_freed += len;
+	}
+
+	else if (status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) {
+		wlfc->stats.d11_suppress += len;
+		remove_from_hanger = 0;
+	}
+
+	else if (status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS) {
+		wlfc->stats.wl_suppress += len;
+		remove_from_hanger = 0;
+	}
+
+	else if (status_flag == WLFC_CTL_PKTFLAG_TOSSED_BYWLC) {
+		wlfc->stats.wlc_tossed_pkts += len;
+	}
+
+	if (dhd->proptxstatus_txstatus_ignore) {
+		if (!remove_from_hanger) {
+			DHD_ERROR(("suppress txstatus: %d\n", status_flag));
+		}
+		return BCME_OK;
+	}
+
+	while (count < len) {
+		if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+			ret = _dhd_wlfc_deque_afq(wlfc, hslot, hcnt, fifo_id, &pktbuf);
+		} else {
+			ret = _dhd_wlfc_hanger_poppkt(wlfc->hanger, hslot, &pktbuf, FALSE);
+			if (!pktbuf) {
+				_dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+					WLFC_HANGER_PKT_STATE_TXSTATUS, -1);
+				goto cont;
+			}
+		}
+
+		if ((ret != BCME_OK) || !pktbuf) {
+			goto cont;
+		}
+
+		/* set fifo_id to correct value because not all FW does that */
+		fifo_id = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+
+		entry = _dhd_wlfc_find_table_entry(wlfc, pktbuf);
+
+		if (!remove_from_hanger) {
+			/* this packet was suppressed */
+			if (!entry->suppressed || (entry->generation != gen)) {
+				if (!entry->suppressed) {
+					entry->suppr_transit_count = entry->transit_count;
+					if (p_mac) {
+						*p_mac = entry;
+					}
+				} else {
+					DHD_ERROR(("gen(%d), entry->generation(%d)\n",
+						gen, entry->generation));
+				}
+				entry->suppressed = TRUE;
+
+			}
+			entry->generation = gen;
+		}
+
+#ifdef PROP_TXSTATUS_DEBUG
+		if (!WLFC_GET_AFQ(dhd->wlfc_mode))
+		{
+			uint32 new_t = OSL_SYSUPTIME();
+			uint32 old_t;
+			uint32 delta;
+			old_t = ((wlfc_hanger_t*)(wlfc->hanger))->items[hslot].push_time;
+
+
+			wlfc->stats.latency_sample_count++;
+			if (new_t > old_t)
+				delta = new_t - old_t;
+			else
+				delta = 0xffffffff + new_t - old_t;
+			wlfc->stats.total_status_latency += delta;
+			wlfc->stats.latency_most_recent = delta;
+
+			wlfc->stats.deltas[wlfc->stats.idx_delta++] = delta;
+			if (wlfc->stats.idx_delta == sizeof(wlfc->stats.deltas)/sizeof(uint32))
+				wlfc->stats.idx_delta = 0;
+		}
+#endif /* PROP_TXSTATUS_DEBUG */
+
+		/* pick up the implicit credit from this packet */
+		if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pktbuf))) {
+			_dhd_wlfc_return_implied_credit(wlfc, pktbuf);
+		} else {
+			/*
+			if this packet did not count against FIFO credit, it must have
+			taken a requested_credit from the destination entry (for pspoll etc.)
+			*/
+			if (!DHD_PKTTAG_ONETIMEPKTRQST(PKTTAG(pktbuf)))
+				entry->requested_credit++;
+#ifdef PROP_TXSTATUS_DEBUG
+			entry->dstncredit_acks++;
+#endif
+		}
+
+		if ((status_flag == WLFC_CTL_PKTFLAG_D11SUPPRESS) ||
+			(status_flag == WLFC_CTL_PKTFLAG_WLSUPPRESS)) {
+			/* save generation bit inside packet */
+			WL_TXSTATUS_SET_GENERATION(DHD_PKTTAG_H2DTAG(PKTTAG(pktbuf)), gen);
+
+			if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+				WL_SEQ_SET_FROMDRV(DHD_PKTTAG_H2DSEQ(PKTTAG(pktbuf)), seq_fromfw);
+				WL_SEQ_SET_NUM(DHD_PKTTAG_H2DSEQ(PKTTAG(pktbuf)), seq_num);
+			}
+
+			ret = _dhd_wlfc_enque_suppressed(wlfc, fifo_id, pktbuf);
+			if (ret != BCME_OK) {
+				/* delay q is full, drop this packet */
+				DHD_WLFC_QMON_COMPLETE(entry);
+				_dhd_wlfc_prec_drop(dhd, (fifo_id << 1) + 1, pktbuf, FALSE);
+			} else {
+				if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+					/* Mark suppressed to avoid a double free
+					during wlfc cleanup
+					*/
+					_dhd_wlfc_hanger_mark_suppressed(wlfc->hanger, hslot, gen);
+				}
+			}
+		} else {
+
+			DHD_WLFC_QMON_COMPLETE(entry);
+
+			if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+				_dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+					WLFC_HANGER_PKT_STATE_TXSTATUS, TRUE);
+			} else {
+				dhd_txcomplete(dhd, pktbuf, TRUE);
+				wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pktbuf))]
+					[DHD_PKTTAG_FIFO(PKTTAG(pktbuf))]--;
+				wlfc->stats.pktout++;
+				/* free the packet */
+				PKTFREE(wlfc->osh, pktbuf, TRUE);
+			}
+		}
+		/* pkt back from firmware side */
+		entry->transit_count--;
+		if (entry->suppressed && (--entry->suppr_transit_count == 0)) {
+			entry->suppressed = FALSE;
+		}
+
+cont:
+		hcnt = (hcnt + 1) & WL_TXSTATUS_FREERUNCTR_MASK;
+		if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+			hslot = (hslot + 1) & WL_TXSTATUS_HSLOT_MASK;
+		}
+
+		if (WLFC_GET_REUSESEQ(dhd->wlfc_mode) && seq_fromfw) {
+			seq_num = (seq_num + 1) & WL_SEQ_NUM_MASK;
+		}
+
+		count++;
+	}
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_fifocreditback_indicate(dhd_pub_t *dhd, uint8* credits)
+{
+	int i;
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	for (i = 0; i < WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK; i++) {
+#ifdef PROP_TXSTATUS_DEBUG
+		wlfc->stats.fifo_credits_back[i] += credits[i];
+#endif
+
+		/* update FIFO credits */
+		if (dhd->proptxstatus_mode == WLFC_FCMODE_EXPLICIT_CREDIT)
+		{
+			int lender; /* Note that borrower is i */
+
+			/* Return credits to highest priority lender first */
+			for (lender = AC_COUNT; (lender >= 0) && (credits[i] > 0); lender--) {
+				if (wlfc->credits_borrowed[i][lender] > 0) {
+					if (credits[i] >= wlfc->credits_borrowed[i][lender]) {
+						credits[i] -=
+							(uint8)wlfc->credits_borrowed[i][lender];
+						wlfc->FIFO_credit[lender] +=
+						    wlfc->credits_borrowed[i][lender];
+						wlfc->credits_borrowed[i][lender] = 0;
+					}
+					else {
+						wlfc->credits_borrowed[i][lender] -= credits[i];
+						wlfc->FIFO_credit[lender] += credits[i];
+						credits[i] = 0;
+					}
+				}
+			}
+
+			/* If we have more credits left over, these must belong to the AC */
+			if (credits[i] > 0) {
+				wlfc->FIFO_credit[i] += credits[i];
+			}
+
+			if (wlfc->FIFO_credit[i] > wlfc->Init_FIFO_credit[i]) {
+				wlfc->FIFO_credit[i] = wlfc->Init_FIFO_credit[i];
+			}
+		}
+	}
+
+	return BCME_OK;
+}
+
+static void
+_dhd_wlfc_suppress_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* entry;
+	int prec;
+	void *pkt = NULL, *head = NULL, *tail = NULL;
+	struct pktq *txq = (struct pktq *)dhd_bus_txq(dhd->bus);
+	uint8	results[WLFC_CTL_VALUE_LEN_TXSTATUS+WLFC_CTL_VALUE_LEN_SEQ];
+	uint8 credits[WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK] = {0};
+	uint32 htod = 0;
+	uint16 htodseq = 0;
+	bool bCreditUpdate = FALSE;
+
+	dhd_os_sdlock_txq(dhd);
+	for (prec = 0; prec < txq->num_prec; prec++) {
+		while ((pkt = _dhd_wlfc_pktq_pdeq_with_fn(txq, prec, fn, arg))) {
+			if (!head) {
+				head = pkt;
+			}
+			if (tail) {
+				PKTSETLINK(tail, pkt);
+			}
+			tail = pkt;
+		}
+	}
+	dhd_os_sdunlock_txq(dhd);
+
+	while ((pkt = head)) {
+		head = PKTLINK(pkt);
+		PKTSETLINK(pkt, NULL);
+
+		entry = _dhd_wlfc_find_table_entry(wlfc, pkt);
+
+		/* fake a suppression txstatus */
+		htod = DHD_PKTTAG_H2DTAG(PKTTAG(pkt));
+		WL_TXSTATUS_SET_FLAGS(htod, WLFC_CTL_PKTFLAG_WLSUPPRESS);
+		WL_TXSTATUS_SET_GENERATION(htod, entry->generation);
+		memcpy(results, &htod, WLFC_CTL_VALUE_LEN_TXSTATUS);
+		if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+			htodseq = DHD_PKTTAG_H2DSEQ(PKTTAG(pkt));
+			if (WL_SEQ_GET_FROMDRV(htodseq)) {
+				WL_SEQ_SET_FROMFW(htodseq, 1);
+				WL_SEQ_SET_FROMDRV(htodseq, 0);
+			}
+			memcpy(results + WLFC_CTL_VALUE_LEN_TXSTATUS, &htodseq,
+				WLFC_CTL_VALUE_LEN_SEQ);
+		}
+		if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+			_dhd_wlfc_enque_afq(wlfc, pkt);
+		}
+		_dhd_wlfc_compressed_txstatus_update(dhd, results, 1, NULL);
+
+		/* fake a fifo credit back */
+		if (DHD_PKTTAG_CREDITCHECK(PKTTAG(pkt))) {
+			credits[DHD_PKTTAG_FIFO(PKTTAG(pkt))]++;
+			bCreditUpdate = TRUE;
+		}
+	}
+
+	if (bCreditUpdate) {
+		_dhd_wlfc_fifocreditback_indicate(dhd, credits);
+	}
+}
+
+
+static int
+_dhd_wlfc_dbg_senum_check(dhd_pub_t *dhd, uint8 *value)
+{
+	uint32 timestamp;
+
+	(void)dhd;
+
+	bcopy(&value[2], &timestamp, sizeof(uint32));
+	DHD_INFO(("RXPKT: SEQ: %d, timestamp %d\n", value[1], timestamp));
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_rssi_indicate(dhd_pub_t *dhd, uint8* rssi)
+{
+	(void)dhd;
+	(void)rssi;
+	return BCME_OK;
+}
+
+static void
+_dhd_wlfc_add_requested_entry(athost_wl_status_info_t* wlfc, wlfc_mac_descriptor_t* entry)
+{
+	int i;
+
+	if (!wlfc || !entry) {
+		return;
+	}
+
+	for (i = 0; i < wlfc->requested_entry_count; i++) {
+		if (entry == wlfc->requested_entry[i]) {
+			break;
+		}
+	}
+
+	if (i == wlfc->requested_entry_count) {
+		/* no match entry found */
+		ASSERT(wlfc->requested_entry_count <= (WLFC_MAC_DESC_TABLE_SIZE-1));
+		wlfc->requested_entry[wlfc->requested_entry_count++] = entry;
+	}
+}
+
+static void
+_dhd_wlfc_remove_requested_entry(athost_wl_status_info_t* wlfc, wlfc_mac_descriptor_t* entry)
+{
+	int i;
+
+	if (!wlfc || !entry) {
+		return;
+	}
+
+	for (i = 0; i < wlfc->requested_entry_count; i++) {
+		if (entry == wlfc->requested_entry[i]) {
+			break;
+		}
+	}
+
+	if (i < wlfc->requested_entry_count) {
+		/* found */
+		ASSERT(wlfc->requested_entry_count > 0);
+		wlfc->requested_entry_count--;
+		if (i != wlfc->requested_entry_count) {
+			wlfc->requested_entry[i] =
+				wlfc->requested_entry[wlfc->requested_entry_count];
+		}
+		wlfc->requested_entry[wlfc->requested_entry_count] = NULL;
+	}
+}
+
+static int
+_dhd_wlfc_mac_table_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+	int rc;
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* table;
+	uint8 existing_index;
+	uint8 table_index;
+	uint8 ifid;
+	uint8* ea;
+
+	WLFC_DBGMESG(("%s(), mac [%02x:%02x:%02x:%02x:%02x:%02x],%s,idx:%d,id:0x%02x\n",
+		__FUNCTION__, value[2], value[3], value[4], value[5], value[6], value[7],
+		((type == WLFC_CTL_TYPE_MACDESC_ADD) ? "ADD":"DEL"),
+		WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]), value[0]));
+
+	table = wlfc->destination_entries.nodes;
+	table_index = WLFC_MAC_DESC_GET_LOOKUP_INDEX(value[0]);
+	ifid = value[1];
+	ea = &value[2];
+
+	_dhd_wlfc_remove_requested_entry(wlfc, &table[table_index]);
+	if (type == WLFC_CTL_TYPE_MACDESC_ADD) {
+		existing_index = _dhd_wlfc_find_mac_desc_id_from_mac(dhd, &value[2]);
+		if ((existing_index != WLFC_MAC_DESC_ID_INVALID) &&
+			(existing_index != table_index) && table[existing_index].occupied) {
+			/*
+			there is an existing different entry, free the old one
+			and move it to new index if necessary.
+			*/
+			rc = _dhd_wlfc_mac_entry_update(wlfc, &table[existing_index],
+				eWLFC_MAC_ENTRY_ACTION_DEL, table[existing_index].interface_id,
+				table[existing_index].iftype, NULL, _dhd_wlfc_entrypkt_fn,
+				&table[existing_index]);
+		}
+
+		if (!table[table_index].occupied) {
+			/* this new MAC entry does not exist, create one */
+			table[table_index].mac_handle = value[0];
+			rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+				eWLFC_MAC_ENTRY_ACTION_ADD, ifid,
+				wlfc->destination_entries.interfaces[ifid].iftype,
+				ea, NULL, NULL);
+		} else {
+			/* the space should have been empty, but it's not */
+			wlfc->stats.mac_update_failed++;
+		}
+	}
+
+	if (type == WLFC_CTL_TYPE_MACDESC_DEL) {
+		if (table[table_index].occupied) {
+				rc = _dhd_wlfc_mac_entry_update(wlfc, &table[table_index],
+					eWLFC_MAC_ENTRY_ACTION_DEL, ifid,
+					wlfc->destination_entries.interfaces[ifid].iftype,
+					ea, _dhd_wlfc_entrypkt_fn, &table[table_index]);
+		} else {
+			/* the space should have been occupied, but it's not */
+			wlfc->stats.mac_update_failed++;
+		}
+	}
+	BCM_REFERENCE(rc);
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_psmode_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+	/* Handle PS on/off indication */
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* table;
+	wlfc_mac_descriptor_t* desc;
+	uint8 mac_handle = value[0];
+	int i;
+
+	table = wlfc->destination_entries.nodes;
+	desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+	if (desc->occupied) {
+		if (type == WLFC_CTL_TYPE_MAC_OPEN) {
+			desc->state = WLFC_STATE_OPEN;
+			desc->ac_bitmap = 0xff;
+			DHD_WLFC_CTRINC_MAC_OPEN(desc);
+			desc->requested_credit = 0;
+			desc->requested_packet = 0;
+			_dhd_wlfc_remove_requested_entry(wlfc, desc);
+		}
+		else {
+			desc->state = WLFC_STATE_CLOSE;
+			DHD_WLFC_CTRINC_MAC_CLOSE(desc);
+			/*
+			Indicate to firmware if there is any traffic pending.
+			*/
+			for (i = 0; i < AC_COUNT; i++) {
+				_dhd_wlfc_traffic_pending_check(wlfc, desc, i);
+			}
+		}
+	}
+	else {
+		wlfc->stats.psmode_update_failed++;
+	}
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_interface_update(dhd_pub_t *dhd, uint8* value, uint8 type)
+{
+	/* Handle PS on/off indication */
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* table;
+	uint8 if_id = value[0];
+
+	if (if_id < WLFC_MAX_IFNUM) {
+		table = wlfc->destination_entries.interfaces;
+		if (table[if_id].occupied) {
+			if (type == WLFC_CTL_TYPE_INTERFACE_OPEN) {
+				table[if_id].state = WLFC_STATE_OPEN;
+				/* WLFC_DBGMESG(("INTERFACE[%d] OPEN\n", if_id)); */
+			}
+			else {
+				table[if_id].state = WLFC_STATE_CLOSE;
+				/* WLFC_DBGMESG(("INTERFACE[%d] CLOSE\n", if_id)); */
+			}
+			return BCME_OK;
+		}
+	}
+	wlfc->stats.interface_update_failed++;
+
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_credit_request(dhd_pub_t *dhd, uint8* value)
+{
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* table;
+	wlfc_mac_descriptor_t* desc;
+	uint8 mac_handle;
+	uint8 credit;
+
+	table = wlfc->destination_entries.nodes;
+	mac_handle = value[1];
+	credit = value[0];
+
+	desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+	if (desc->occupied) {
+		desc->requested_credit = credit;
+
+		desc->ac_bitmap = value[2] & (~(1<<AC_COUNT));
+		_dhd_wlfc_add_requested_entry(wlfc, desc);
+	}
+	else {
+		wlfc->stats.credit_request_failed++;
+	}
+	return BCME_OK;
+}
+
+static int
+_dhd_wlfc_packet_request(dhd_pub_t *dhd, uint8* value)
+{
+	athost_wl_status_info_t* wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	wlfc_mac_descriptor_t* table;
+	wlfc_mac_descriptor_t* desc;
+	uint8 mac_handle;
+	uint8 packet_count;
+
+	table = wlfc->destination_entries.nodes;
+	mac_handle = value[1];
+	packet_count = value[0];
+
+	desc = &table[WLFC_MAC_DESC_GET_LOOKUP_INDEX(mac_handle)];
+	if (desc->occupied) {
+		desc->requested_packet = packet_count;
+
+		desc->ac_bitmap = value[2] & (~(1<<AC_COUNT));
+		_dhd_wlfc_add_requested_entry(wlfc, desc);
+	}
+	else {
+		wlfc->stats.packet_request_failed++;
+	}
+	return BCME_OK;
+}
+
+static void
+_dhd_wlfc_reorderinfo_indicate(uint8 *val, uint8 len, uchar *info_buf, uint *info_len)
+{
+	if (info_len) {
+		if (info_buf) {
+			bcopy(val, info_buf, len);
+			*info_len = len;
+		}
+		else
+			*info_len = 0;
+	}
+}
+
+/*
+ * public functions
+ */
+
+bool dhd_wlfc_is_supported(dhd_pub_t *dhd)
+{
+	bool rc = TRUE;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return FALSE;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		rc =  FALSE;
+	}
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return rc;
+}
+
+int dhd_wlfc_enable(dhd_pub_t *dhd)
+{
+	int i, rc = BCME_OK;
+	athost_wl_status_info_t* wlfc;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_enabled || dhd->wlfc_state) {
+		rc = BCME_OK;
+		goto exit;
+	}
+
+	/* allocate space to track txstatus propagated from firmware */
+	dhd->wlfc_state = DHD_OS_PREALLOC(dhd, DHD_PREALLOC_DHD_WLFC_INFO,
+		sizeof(athost_wl_status_info_t));
+	if (dhd->wlfc_state == NULL) {
+		rc = BCME_NOMEM;
+		goto exit;
+	}
+
+	/* initialize state space */
+	wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	memset(wlfc, 0, sizeof(athost_wl_status_info_t));
+
+	/* remember osh & dhdp */
+	wlfc->osh = dhd->osh;
+	wlfc->dhdp = dhd;
+
+	if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+		wlfc->hanger = _dhd_wlfc_hanger_create(dhd->osh, WLFC_HANGER_MAXITEMS);
+		if (wlfc->hanger == NULL) {
+			DHD_OS_PREFREE(dhd, dhd->wlfc_state,
+				sizeof(athost_wl_status_info_t));
+			dhd->wlfc_state = NULL;
+			rc = BCME_NOMEM;
+			goto exit;
+		}
+	}
+
+	dhd->proptxstatus_mode = WLFC_FCMODE_EXPLICIT_CREDIT;
+	/* default to check rx pkt */
+	if (dhd->op_mode & DHD_FLAG_IBSS_MODE) {
+		dhd->wlfc_rxpkt_chk = FALSE;
+	} else {
+		dhd->wlfc_rxpkt_chk = TRUE;
+	}
+
+
+	/* initialize all interfaces to accept traffic */
+	for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+		wlfc->hostif_flow_state[i] = OFF;
+	}
+
+	_dhd_wlfc_mac_entry_update(wlfc, &wlfc->destination_entries.other,
+		eWLFC_MAC_ENTRY_ACTION_ADD, 0xff, 0, NULL, NULL, NULL);
+
+	wlfc->allow_credit_borrow = 0;
+	wlfc->single_ac = 0;
+	wlfc->single_ac_timestamp = 0;
+
+
+exit:
+	dhd_os_wlfc_unblock(dhd);
+
+	return rc;
+}
+#ifdef SUPPORT_P2P_GO_PS
+int
+dhd_wlfc_suspend(dhd_pub_t *dhd)
+{
+
+	uint32 iovbuf[4]; /* Room for "tlv" + '\0' + parameter */
+	uint32 tlv = 0;
+
+	DHD_TRACE(("%s: masking wlfc events\n", __FUNCTION__));
+	if (!dhd->wlfc_enabled)
+		return -1;
+
+	bcm_mkiovar("tlv", NULL, 0, (char*)iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0) < 0) {
+		DHD_ERROR(("%s: failed to get bdcv2 tlv signaling\n", __FUNCTION__));
+		return -1;
+	}
+	tlv = iovbuf[0];
+	if ((tlv & (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS)) == 0)
+		return 0;
+	tlv &= ~(WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS);
+	bcm_mkiovar("tlv", (char *)&tlv, 4, (char*)iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+		DHD_ERROR(("%s: failed to set bdcv2 tlv signaling to 0x%x\n",
+			__FUNCTION__, tlv));
+		return -1;
+	}
+
+	return 0;
+}
+
+	int
+dhd_wlfc_resume(dhd_pub_t *dhd)
+{
+	uint32 iovbuf[4]; /* Room for "tlv" + '\0' + parameter */
+	uint32 tlv = 0;
+
+	DHD_TRACE(("%s: unmasking wlfc events\n", __FUNCTION__));
+	if (!dhd->wlfc_enabled)
+		return -1;
+
+	bcm_mkiovar("tlv", NULL, 0, (char*)iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0) < 0) {
+		DHD_ERROR(("%s: failed to get bdcv2 tlv signaling\n", __FUNCTION__));
+		return -1;
+	}
+	tlv = iovbuf[0];
+	if ((tlv & (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS)) ==
+		(WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS))
+		return 0;
+	tlv |= (WLFC_FLAGS_RSSI_SIGNALS | WLFC_FLAGS_XONXOFF_SIGNALS);
+	bcm_mkiovar("tlv", (char *)&tlv, 4, (char*)iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, (char*)iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+		DHD_ERROR(("%s: failed to set bdcv2 tlv signaling to 0x%x\n",
+			__FUNCTION__, tlv));
+		return -1;
+	}
+
+	return 0;
+}
+#endif /* SUPPORT_P2P_GO_PS */
+
+int
+dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len, uchar *reorder_info_buf,
+	uint *reorder_info_len)
+{
+	uint8 type, len;
+	uint8* value;
+	uint8* tmpbuf;
+	uint16 remainder = (uint16)tlv_hdr_len;
+	uint16 processed = 0;
+	athost_wl_status_info_t* wlfc = NULL;
+	void* entry;
+
+	if ((dhd == NULL) || (pktbuf == NULL)) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (dhd->proptxstatus_mode != WLFC_ONLY_AMPDU_HOSTREORDER) {
+		if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+			dhd_os_wlfc_unblock(dhd);
+			return WLFC_UNSUPPORTED;
+		}
+		wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	}
+
+	tmpbuf = (uint8*)PKTDATA(dhd->osh, pktbuf);
+
+	if (remainder) {
+		while ((processed < (WLFC_MAX_PENDING_DATALEN * 2)) && (remainder > 0)) {
+			type = tmpbuf[processed];
+			if (type == WLFC_CTL_TYPE_FILLER) {
+				remainder -= 1;
+				processed += 1;
+				continue;
+			}
+
+			len  = tmpbuf[processed + 1];
+			value = &tmpbuf[processed + 2];
+
+			if (remainder < (2 + len))
+				break;
+
+			remainder -= 2 + len;
+			processed += 2 + len;
+			entry = NULL;
+
+			DHD_INFO(("%s():%d type %d remainder %d processed %d\n",
+				__FUNCTION__, __LINE__, type, remainder, processed));
+
+			if (type == WLFC_CTL_TYPE_HOST_REORDER_RXPKTS)
+				_dhd_wlfc_reorderinfo_indicate(value, len, reorder_info_buf,
+					reorder_info_len);
+
+			if (wlfc == NULL) {
+				ASSERT(dhd->proptxstatus_mode == WLFC_ONLY_AMPDU_HOSTREORDER);
+
+				if (type != WLFC_CTL_TYPE_HOST_REORDER_RXPKTS &&
+					type != WLFC_CTL_TYPE_TRANS_ID)
+					DHD_INFO(("%s():%d dhd->wlfc_state is NULL yet!"
+					" type %d remainder %d processed %d\n",
+					__FUNCTION__, __LINE__, type, remainder, processed));
+				continue;
+			}
+
+			if (type == WLFC_CTL_TYPE_TXSTATUS) {
+				_dhd_wlfc_compressed_txstatus_update(dhd, value, 1, &entry);
+			}
+			else if (type == WLFC_CTL_TYPE_COMP_TXSTATUS) {
+				uint8 compcnt_offset = WLFC_CTL_VALUE_LEN_TXSTATUS;
+
+				if (WLFC_GET_REUSESEQ(dhd->wlfc_mode)) {
+					compcnt_offset += WLFC_CTL_VALUE_LEN_SEQ;
+				}
+				_dhd_wlfc_compressed_txstatus_update(dhd, value,
+					value[compcnt_offset], &entry);
+			}
+			else if (type == WLFC_CTL_TYPE_FIFO_CREDITBACK)
+				_dhd_wlfc_fifocreditback_indicate(dhd, value);
+
+			else if (type == WLFC_CTL_TYPE_RSSI)
+				_dhd_wlfc_rssi_indicate(dhd, value);
+
+			else if (type == WLFC_CTL_TYPE_MAC_REQUEST_CREDIT)
+				_dhd_wlfc_credit_request(dhd, value);
+
+			else if (type == WLFC_CTL_TYPE_MAC_REQUEST_PACKET)
+				_dhd_wlfc_packet_request(dhd, value);
+
+			else if ((type == WLFC_CTL_TYPE_MAC_OPEN) ||
+				(type == WLFC_CTL_TYPE_MAC_CLOSE))
+				_dhd_wlfc_psmode_update(dhd, value, type);
+
+			else if ((type == WLFC_CTL_TYPE_MACDESC_ADD) ||
+				(type == WLFC_CTL_TYPE_MACDESC_DEL))
+				_dhd_wlfc_mac_table_update(dhd, value, type);
+
+			else if (type == WLFC_CTL_TYPE_TRANS_ID)
+				_dhd_wlfc_dbg_senum_check(dhd, value);
+
+			else if ((type == WLFC_CTL_TYPE_INTERFACE_OPEN) ||
+				(type == WLFC_CTL_TYPE_INTERFACE_CLOSE)) {
+				_dhd_wlfc_interface_update(dhd, value, type);
+			}
+
+			if (entry && WLFC_GET_REORDERSUPP(dhd->wlfc_mode)) {
+				/* suppress all packets for this mac entry from bus->txq */
+				_dhd_wlfc_suppress_txq(dhd, _dhd_wlfc_entrypkt_fn, entry);
+			}
+		}
+		if (remainder != 0 && wlfc) {
+			/* trouble..., something is not right */
+			wlfc->stats.tlv_parse_failed++;
+		}
+	}
+
+	if (wlfc)
+		wlfc->stats.dhd_hdrpulls++;
+
+	dhd_os_wlfc_unblock(dhd);
+	return BCME_OK;
+}
+
+int
+dhd_wlfc_commit_packets(dhd_pub_t *dhdp, f_commitpkt_t fcommit, void* commit_ctx, void *pktbuf,
+	bool need_toggle_host_if)
+{
+	int ac, single_ac = 0, rc = BCME_OK;
+	dhd_wlfc_commit_info_t  commit_info;
+	athost_wl_status_info_t* ctx;
+	int bus_retry_count = 0;
+
+	uint8 tx_map = 0; /* packets (send + in queue), Bitmask for 4 ACs + BC/MC */
+	uint8 rx_map = 0; /* received packets, Bitmask for 4 ACs + BC/MC */
+	uint8 packets_map = 0; /* packets in queue, Bitmask for 4 ACs + BC/MC */
+	bool no_credit = FALSE;
+
+	int lender;
+
+	if ((dhdp == NULL) || (fcommit == NULL)) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhdp);
+
+	if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		if (pktbuf) {
+			DHD_PKTTAG_WLFCPKT_SET(PKTTAG(pktbuf), 0);
+		}
+		rc =  WLFC_UNSUPPORTED;
+		goto exit2;
+	}
+
+	ctx = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+
+	if (dhdp->proptxstatus_module_ignore) {
+		if (pktbuf) {
+			uint32 htod = 0;
+			WL_TXSTATUS_SET_FLAGS(htod, WLFC_PKTFLAG_PKTFROMHOST);
+			_dhd_wlfc_pushheader(ctx, &pktbuf, FALSE, 0, 0, htod, 0, FALSE);
+			if (fcommit(commit_ctx, pktbuf))
+				PKTFREE(ctx->osh, pktbuf, TRUE);
+			rc = BCME_OK;
+		}
+		goto exit;
+	}
+
+	memset(&commit_info, 0, sizeof(commit_info));
+
+	/*
+	Commit packets for regular AC traffic. Higher priority first.
+	First, use up FIFO credits available to each AC. Based on distribution
+	and credits left, borrow from other ACs as applicable
+
+	-NOTE:
+	If the bus between the host and firmware is overwhelmed by the
+	traffic from host, it is possible that higher priority traffic
+	starves the lower priority queue. If that occurs often, we may
+	have to employ weighted round-robin or ucode scheme to avoid
+	low priority packet starvation.
+	*/
+
+	if (pktbuf) {
+		DHD_PKTTAG_WLFCPKT_SET(PKTTAG(pktbuf), 1);
+		ac = DHD_PKTTAG_FIFO(PKTTAG(pktbuf));
+		/* en-queue the packets to respective queue. */
+		rc = _dhd_wlfc_enque_delayq(ctx, pktbuf, ac);
+		if (rc) {
+			_dhd_wlfc_prec_drop(ctx->dhdp, (ac << 1), pktbuf, FALSE);
+		} else {
+			ctx->stats.pktin++;
+			ctx->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(pktbuf))][ac]++;
+		}
+	}
+
+	for (ac = AC_COUNT; ac >= 0; ac--) {
+		if (dhdp->wlfc_rxpkt_chk) {
+			/* check rx packet */
+			uint32 curr_t = OSL_SYSUPTIME(), delta;
+
+			delta = curr_t - ctx->rx_timestamp[ac];
+			if (delta < WLFC_RX_DETECTION_THRESHOLD_MS) {
+				rx_map |= (1 << ac);
+			}
+		}
+
+		if (ctx->pkt_cnt_per_ac[ac] == 0) {
+			continue;
+		}
+		tx_map |= (1 << ac);
+		single_ac = ac + 1;
+		while (FALSE == dhdp->proptxstatus_txoff) {
+			/* packets from delayQ with less priority are fresh and
+			 * they'd need header and have no MAC entry
+			 */
+			no_credit = (ctx->FIFO_credit[ac] < 1);
+			if (dhdp->proptxstatus_credit_ignore ||
+				((ac == AC_COUNT) && !ctx->bcmc_credit_supported)) {
+				no_credit = FALSE;
+			}
+
+			lender = -1;
+#ifdef LIMIT_BORROW
+			if (no_credit && (ac < AC_COUNT) && (tx_map >= rx_map)) {
+				/* try borrow from lower priority */
+				lender = _dhd_wlfc_borrow_credit(ctx, ac - 1, ac, FALSE);
+				if (lender != -1) {
+					no_credit = FALSE;
+				}
+			}
+#endif
+			commit_info.needs_hdr = 1;
+			commit_info.mac_entry = NULL;
+			commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+				&(commit_info.ac_fifo_credit_spent),
+				&(commit_info.needs_hdr),
+				&(commit_info.mac_entry),
+				no_credit);
+			commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+				eWLFC_PKTTYPE_SUPPRESSED;
+
+			if (commit_info.p == NULL) {
+#ifdef LIMIT_BORROW
+				if (lender != -1) {
+					_dhd_wlfc_return_credit(ctx, lender, ac);
+				}
+#endif
+				break;
+			}
+
+			if (!dhdp->proptxstatus_credit_ignore && (lender == -1)) {
+				ASSERT(ctx->FIFO_credit[ac] >= commit_info.ac_fifo_credit_spent);
+			}
+			/* here we can ensure have credit or no credit needed */
+			rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info, fcommit,
+				commit_ctx);
+
+			/* Bus commits may fail (e.g. flow control); abort after retries */
+			if (rc == BCME_OK) {
+				if (commit_info.ac_fifo_credit_spent && (lender == -1)) {
+					ctx->FIFO_credit[ac]--;
+				}
+#ifdef LIMIT_BORROW
+				else if (!commit_info.ac_fifo_credit_spent && (lender != -1)) {
+					_dhd_wlfc_return_credit(ctx, lender, ac);
+				}
+#endif
+			} else {
+#ifdef LIMIT_BORROW
+				if (lender != -1) {
+					_dhd_wlfc_return_credit(ctx, lender, ac);
+				}
+#endif
+				bus_retry_count++;
+				if (bus_retry_count >= BUS_RETRIES) {
+					DHD_ERROR(("%s: bus error %d\n", __FUNCTION__, rc));
+					goto exit;
+				}
+			}
+		}
+
+		if (ctx->pkt_cnt_per_ac[ac]) {
+			packets_map |= (1 << ac);
+		}
+	}
+
+	if ((tx_map == 0) || dhdp->proptxstatus_credit_ignore) {
+		/* nothing send out or remain in queue */
+		rc = BCME_OK;
+		goto exit;
+	}
+
+	if (((tx_map & (tx_map - 1)) == 0) && (tx_map >= rx_map)) {
+		/* only one tx ac exist and no higher rx ac */
+		if ((single_ac == ctx->single_ac) && ctx->allow_credit_borrow) {
+			ac = single_ac - 1;
+		} else {
+			uint32 delta;
+			uint32 curr_t = OSL_SYSUPTIME();
+
+			if (single_ac != ctx->single_ac) {
+				/* new single ac traffic (first single ac or different single ac) */
+				ctx->allow_credit_borrow = 0;
+				ctx->single_ac_timestamp = curr_t;
+				ctx->single_ac = (uint8)single_ac;
+				rc = BCME_OK;
+				goto exit;
+			}
+			/* same ac traffic, check if it lasts enough time */
+			delta = curr_t - ctx->single_ac_timestamp;
+
+			if (delta >= WLFC_BORROW_DEFER_PERIOD_MS) {
+				/* wait enough time, can borrow now */
+				ctx->allow_credit_borrow = 1;
+				ac = single_ac - 1;
+			} else {
+				rc = BCME_OK;
+				goto exit;
+			}
+		}
+	} else {
+		/* If we have multiple AC traffic, turn off borrowing, mark time and bail out */
+		ctx->allow_credit_borrow = 0;
+		ctx->single_ac_timestamp = 0;
+		ctx->single_ac = 0;
+		rc = BCME_OK;
+		goto exit;
+	}
+
+	if (packets_map == 0) {
+		/* nothing to send, skip borrow */
+		rc = BCME_OK;
+		goto exit;
+	}
+
+	/* At this point, borrow all credits only for ac */
+	while (FALSE == dhdp->proptxstatus_txoff) {
+#ifdef LIMIT_BORROW
+		if ((lender = _dhd_wlfc_borrow_credit(ctx, AC_COUNT, ac, TRUE)) == -1) {
+			break;
+		}
+#endif
+		commit_info.p = _dhd_wlfc_deque_delayedq(ctx, ac,
+			&(commit_info.ac_fifo_credit_spent),
+			&(commit_info.needs_hdr),
+			&(commit_info.mac_entry),
+			FALSE);
+		if (commit_info.p == NULL) {
+			/* before borrow only one ac exists and now this only ac is empty */
+#ifdef LIMIT_BORROW
+			_dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+			break;
+		}
+
+		commit_info.pkt_type = (commit_info.needs_hdr) ? eWLFC_PKTTYPE_DELAYED :
+			eWLFC_PKTTYPE_SUPPRESSED;
+
+		rc = _dhd_wlfc_handle_packet_commit(ctx, ac, &commit_info,
+		     fcommit, commit_ctx);
+
+		/* Bus commits may fail (e.g. flow control); abort after retries */
+		if (rc == BCME_OK) {
+
+			if (commit_info.ac_fifo_credit_spent) {
+#ifndef LIMIT_BORROW
+				ctx->FIFO_credit[ac]--;
+#endif
+			} else {
+#ifdef LIMIT_BORROW
+				_dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+			}
+		} else {
+#ifdef LIMIT_BORROW
+			_dhd_wlfc_return_credit(ctx, lender, ac);
+#endif
+			bus_retry_count++;
+			if (bus_retry_count >= BUS_RETRIES) {
+				DHD_ERROR(("%s: bus error %d\n", __FUNCTION__, rc));
+				goto exit;
+			}
+		}
+	}
+
+exit:
+	if (need_toggle_host_if && ctx->toggle_host_if) {
+		ctx->toggle_host_if = 0;
+	}
+
+exit2:
+	dhd_os_wlfc_unblock(dhdp);
+	return rc;
+}
+
+int
+dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success)
+{
+	athost_wl_status_info_t* wlfc;
+	void* pout = NULL;
+	int rtn = BCME_OK;
+	if ((dhd == NULL) || (txp == NULL)) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		rtn = WLFC_UNSUPPORTED;
+		goto EXIT;
+	}
+
+	wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+	if (DHD_PKTTAG_SIGNALONLY(PKTTAG(txp))) {
+#ifdef PROP_TXSTATUS_DEBUG
+		wlfc->stats.signal_only_pkts_freed++;
+#endif
+		/* is this a signal-only packet? */
+		_dhd_wlfc_pullheader(wlfc, txp);
+		PKTFREE(wlfc->osh, txp, TRUE);
+		goto EXIT;
+	}
+
+	if (!success || dhd->proptxstatus_txstatus_ignore) {
+		wlfc_mac_descriptor_t *entry = _dhd_wlfc_find_table_entry(wlfc, txp);
+
+		WLFC_DBGMESG(("At: %s():%d, bus_complete() failure for %p, htod_tag:0x%08x\n",
+			__FUNCTION__, __LINE__, txp, DHD_PKTTAG_H2DTAG(PKTTAG(txp))));
+		if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+			_dhd_wlfc_hanger_poppkt(wlfc->hanger, WL_TXSTATUS_GET_HSLOT(
+				DHD_PKTTAG_H2DTAG(PKTTAG(txp))), &pout, TRUE);
+			ASSERT(txp == pout);
+		}
+
+		/* indicate failure and free the packet */
+		dhd_txcomplete(dhd, txp, success);
+
+		/* return the credit, if necessary */
+		_dhd_wlfc_return_implied_credit(wlfc, txp);
+
+		entry->transit_count--;
+		if (entry->suppressed && (--entry->suppr_transit_count == 0)) {
+			entry->suppressed = FALSE;
+		}
+		wlfc->pkt_cnt_in_drv[DHD_PKTTAG_IF(PKTTAG(txp))][DHD_PKTTAG_FIFO(PKTTAG(txp))]--;
+		wlfc->stats.pktout++;
+		PKTFREE(wlfc->osh, txp, TRUE);
+	} else {
+		/* bus confirmed pkt went to firmware side */
+		if (WLFC_GET_AFQ(dhd->wlfc_mode)) {
+			_dhd_wlfc_enque_afq(wlfc, txp);
+		} else {
+			int hslot = WL_TXSTATUS_GET_HSLOT(DHD_PKTTAG_H2DTAG(PKTTAG(txp)));
+			_dhd_wlfc_hanger_free_pkt(wlfc, hslot,
+				WLFC_HANGER_PKT_STATE_TXCOMPLETE, -1);
+		}
+	}
+
+EXIT:
+	dhd_os_wlfc_unblock(dhd);
+	return rtn;
+}
+
+int
+dhd_wlfc_init(dhd_pub_t *dhd)
+{
+	char iovbuf[14]; /* Room for "tlv" + '\0' + parameter */
+	/* enable all signals & indicate host proptxstatus logic is active */
+	uint32 tlv, mode, fw_caps;
+	int ret = 0;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+	if (dhd->wlfc_enabled) {
+		DHD_ERROR(("%s():%d, Already enabled!\n", __FUNCTION__, __LINE__));
+		dhd_os_wlfc_unblock(dhd);
+		return BCME_OK;
+	}
+	dhd->wlfc_enabled = TRUE;
+	dhd_os_wlfc_unblock(dhd);
+
+	tlv = WLFC_FLAGS_RSSI_SIGNALS |
+		WLFC_FLAGS_XONXOFF_SIGNALS |
+		WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+		WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE |
+		WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+
+
+	/*
+	try to enable/disable signaling by sending "tlv" iovar. if that fails,
+	fallback to no flow control? Print a message for now.
+	*/
+
+	/* enable proptxtstatus signaling by default */
+	bcm_mkiovar("tlv", (char *)&tlv, 4, iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+		DHD_ERROR(("dhd_wlfc_init(): failed to enable/disable bdcv2 tlv signaling\n"));
+	}
+	else {
+		/*
+		Leaving the message for now, it should be removed after a while; once
+		the tlv situation is stable.
+		*/
+		DHD_ERROR(("dhd_wlfc_init(): successfully %s bdcv2 tlv signaling, %d\n",
+			dhd->wlfc_enabled?"enabled":"disabled", tlv));
+	}
+
+	/* query caps */
+	ret = bcm_mkiovar("wlfc_mode", (char *)&mode, 4, iovbuf, sizeof(iovbuf));
+	if (ret > 0) {
+		ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+	}
+
+	if (ret >= 0) {
+		fw_caps = *((uint32 *)iovbuf);
+		mode = 0;
+		DHD_ERROR(("%s: query wlfc_mode succeed, fw_caps=0x%x\n", __FUNCTION__, fw_caps));
+
+		if (WLFC_IS_OLD_DEF(fw_caps)) {
+			/* enable proptxtstatus v2 by default */
+			mode = WLFC_MODE_AFQ;
+		} else {
+			WLFC_SET_AFQ(mode, WLFC_GET_AFQ(fw_caps));
+			WLFC_SET_REUSESEQ(mode, WLFC_GET_REUSESEQ(fw_caps));
+			WLFC_SET_REORDERSUPP(mode, WLFC_GET_REORDERSUPP(fw_caps));
+		}
+		ret = bcm_mkiovar("wlfc_mode", (char *)&mode, 4, iovbuf, sizeof(iovbuf));
+		if (ret > 0) {
+			ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+		}
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	dhd->wlfc_mode = 0;
+	if (ret >= 0) {
+		if (WLFC_IS_OLD_DEF(mode)) {
+			WLFC_SET_AFQ(dhd->wlfc_mode, (mode == WLFC_MODE_AFQ));
+		} else {
+			dhd->wlfc_mode = mode;
+		}
+	}
+	DHD_ERROR(("dhd_wlfc_init(): wlfc_mode=0x%x, ret=%d\n", dhd->wlfc_mode, ret));
+
+	dhd_os_wlfc_unblock(dhd);
+
+	if (dhd->plat_init)
+		dhd->plat_init((void *)dhd);
+
+	return BCME_OK;
+}
+
+int
+dhd_wlfc_hostreorder_init(dhd_pub_t *dhd)
+{
+	char iovbuf[14]; /* Room for "tlv" + '\0' + parameter */
+	/* enable only ampdu hostreorder here */
+	uint32 tlv;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	DHD_TRACE(("%s():%d Enter\n", __FUNCTION__, __LINE__));
+
+	tlv = WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+
+	/* enable proptxtstatus signaling by default */
+	bcm_mkiovar("tlv", (char *)&tlv, 4, iovbuf, sizeof(iovbuf));
+	if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+		DHD_ERROR(("%s(): failed to enable/disable bdcv2 tlv signaling\n",
+			__FUNCTION__));
+	}
+	else {
+		/*
+		Leaving the message for now, it should be removed after a while; once
+		the tlv situation is stable.
+		*/
+		DHD_ERROR(("%s(): successful bdcv2 tlv signaling, %d\n",
+			__FUNCTION__, tlv));
+	}
+
+	dhd_os_wlfc_block(dhd);
+	dhd->proptxstatus_mode = WLFC_ONLY_AMPDU_HOSTREORDER;
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int
+dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhd);
+		return WLFC_UNSUPPORTED;
+	}
+
+	_dhd_wlfc_cleanup_txq(dhd, fn, arg);
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+/* release all packet resources */
+int
+dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void *arg)
+{
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhd);
+		return WLFC_UNSUPPORTED;
+	}
+
+	_dhd_wlfc_cleanup(dhd, fn, arg);
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int
+dhd_wlfc_deinit(dhd_pub_t *dhd)
+{
+	char iovbuf[32]; /* Room for "ampdu_hostreorder" or "tlv" + '\0' + parameter */
+	/* cleanup all psq related resources */
+	athost_wl_status_info_t* wlfc;
+	uint32 tlv = 0;
+	uint32 hostreorder = 0;
+	int ret = BCME_OK;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+	if (!dhd->wlfc_enabled) {
+		DHD_ERROR(("%s():%d, Already disabled!\n", __FUNCTION__, __LINE__));
+		dhd_os_wlfc_unblock(dhd);
+		return BCME_OK;
+	}
+	dhd->wlfc_enabled = FALSE;
+	dhd_os_wlfc_unblock(dhd);
+
+	/* query ampdu hostreorder */
+	bcm_mkiovar("ampdu_hostreorder", NULL, 0, iovbuf, sizeof(iovbuf));
+	ret = dhd_wl_ioctl_cmd(dhd, WLC_GET_VAR, iovbuf, sizeof(iovbuf), FALSE, 0);
+	if (ret == BCME_OK)
+		hostreorder = *((uint32 *)iovbuf);
+	else {
+		hostreorder = 0;
+		DHD_ERROR(("%s():%d, ampdu_hostreorder get failed Err = %d\n",
+			__FUNCTION__, __LINE__, ret));
+	}
+
+	if (hostreorder) {
+		tlv = WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+		DHD_ERROR(("%s():%d, maintain HOST RXRERODER flag in tvl\n",
+			__FUNCTION__, __LINE__));
+	}
+
+	/* Disable proptxtstatus signaling for deinit */
+	bcm_mkiovar("tlv", (char *)&tlv, 4, iovbuf, sizeof(iovbuf));
+	ret = dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0);
+
+	if (ret == BCME_OK) {
+		/*
+		Leaving the message for now, it should be removed after a while; once
+		the tlv situation is stable.
+		*/
+		DHD_ERROR(("%s():%d successfully %s bdcv2 tlv signaling, %d\n",
+			__FUNCTION__, __LINE__,
+			dhd->wlfc_enabled?"enabled":"disabled", tlv));
+	} else
+		DHD_ERROR(("%s():%d failed to enable/disable bdcv2 tlv signaling Err = %d\n",
+			__FUNCTION__, __LINE__, ret));
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhd);
+		return WLFC_UNSUPPORTED;
+	}
+
+	wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+#ifdef PROP_TXSTATUS_DEBUG
+	if (!WLFC_GET_AFQ(dhd->wlfc_mode))
+	{
+		int i;
+		wlfc_hanger_t* h = (wlfc_hanger_t*)wlfc->hanger;
+		for (i = 0; i < h->max_items; i++) {
+			if (h->items[i].state != WLFC_HANGER_ITEM_STATE_FREE) {
+				WLFC_DBGMESG(("%s() pkt[%d] = 0x%p, FIFO_credit_used:%d\n",
+					__FUNCTION__, i, h->items[i].pkt,
+					DHD_PKTTAG_CREDITCHECK(PKTTAG(h->items[i].pkt))));
+			}
+		}
+	}
+#endif
+
+	_dhd_wlfc_cleanup(dhd, NULL, NULL);
+
+	if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+		/* delete hanger */
+		_dhd_wlfc_hanger_delete(dhd->osh, wlfc->hanger);
+	}
+
+
+	/* free top structure */
+	DHD_OS_PREFREE(dhd, dhd->wlfc_state,
+		sizeof(athost_wl_status_info_t));
+	dhd->wlfc_state = NULL;
+	dhd->proptxstatus_mode = hostreorder ?
+		WLFC_ONLY_AMPDU_HOSTREORDER : WLFC_FCMODE_NONE;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	if (dhd->plat_deinit)
+		dhd->plat_deinit((void *)dhd);
+	return BCME_OK;
+}
+
+int dhd_wlfc_interface_event(dhd_pub_t *dhdp, uint8 action, uint8 ifid, uint8 iftype, uint8* ea)
+{
+	int rc;
+
+	if (dhdp == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhdp);
+
+	if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhdp);
+		return WLFC_UNSUPPORTED;
+	}
+
+	rc = _dhd_wlfc_interface_entry_update(dhdp->wlfc_state, action, ifid, iftype, ea);
+
+	dhd_os_wlfc_unblock(dhdp);
+	return rc;
+}
+
+int dhd_wlfc_FIFOcreditmap_event(dhd_pub_t *dhdp, uint8* event_data)
+{
+	int rc;
+
+	if (dhdp == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhdp);
+
+	if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhdp);
+		return WLFC_UNSUPPORTED;
+	}
+
+	rc = _dhd_wlfc_FIFOcreditmap_update(dhdp->wlfc_state, event_data);
+
+	dhd_os_wlfc_unblock(dhdp);
+
+	return rc;
+}
+
+int dhd_wlfc_BCMCCredit_support_event(dhd_pub_t *dhdp)
+{
+	int rc;
+
+	if (dhdp == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhdp);
+
+	if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhdp);
+		return WLFC_UNSUPPORTED;
+	}
+
+	rc = _dhd_wlfc_BCMCCredit_support_update(dhdp->wlfc_state);
+
+	dhd_os_wlfc_unblock(dhdp);
+	return rc;
+}
+
+int
+dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf)
+{
+	int i;
+	uint8* ea;
+	athost_wl_status_info_t* wlfc;
+	wlfc_hanger_t* h;
+	wlfc_mac_descriptor_t* mac_table;
+	wlfc_mac_descriptor_t* interfaces;
+	char* iftypes[] = {"STA", "AP", "WDS", "p2pGO", "p2pCL"};
+
+	if (!dhdp || !strbuf) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhdp);
+
+	if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhdp);
+		return WLFC_UNSUPPORTED;
+	}
+
+	wlfc = (athost_wl_status_info_t*)dhdp->wlfc_state;
+
+	h = (wlfc_hanger_t*)wlfc->hanger;
+	if (h == NULL) {
+		bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+	}
+
+	mac_table = wlfc->destination_entries.nodes;
+	interfaces = wlfc->destination_entries.interfaces;
+	bcm_bprintf(strbuf, "---- wlfc stats ----\n");
+
+	if (!WLFC_GET_AFQ(dhdp->wlfc_mode)) {
+		h = (wlfc_hanger_t*)wlfc->hanger;
+		if (h == NULL) {
+			bcm_bprintf(strbuf, "wlfc-hanger not initialized yet\n");
+		} else {
+			bcm_bprintf(strbuf, "wlfc hanger (pushed,popped,f_push,"
+				"f_pop,f_slot, pending) = (%d,%d,%d,%d,%d,%d)\n",
+				h->pushed,
+				h->popped,
+				h->failed_to_push,
+				h->failed_to_pop,
+				h->failed_slotfind,
+				(h->pushed - h->popped));
+		}
+	}
+
+	bcm_bprintf(strbuf, "wlfc fail(tlv,credit_rqst,mac_update,psmode_update), "
+		"(dq_full,rollback_fail) = (%d,%d,%d,%d), (%d,%d)\n",
+		wlfc->stats.tlv_parse_failed,
+		wlfc->stats.credit_request_failed,
+		wlfc->stats.mac_update_failed,
+		wlfc->stats.psmode_update_failed,
+		wlfc->stats.delayq_full_error,
+		wlfc->stats.rollback_failed);
+
+	bcm_bprintf(strbuf, "PKTS (init_credit,credit,sent,drop_d,drop_s,outoforder) "
+		"(AC0[%d,%d,%d,%d,%d,%d],AC1[%d,%d,%d,%d,%d,%d],AC2[%d,%d,%d,%d,%d,%d],"
+		"AC3[%d,%d,%d,%d,%d,%d],BC_MC[%d,%d,%d,%d,%d,%d])\n",
+		wlfc->Init_FIFO_credit[0], wlfc->FIFO_credit[0], wlfc->stats.send_pkts[0],
+		wlfc->stats.drop_pkts[0], wlfc->stats.drop_pkts[1], wlfc->stats.ooo_pkts[0],
+		wlfc->Init_FIFO_credit[1], wlfc->FIFO_credit[1], wlfc->stats.send_pkts[1],
+		wlfc->stats.drop_pkts[2], wlfc->stats.drop_pkts[3], wlfc->stats.ooo_pkts[1],
+		wlfc->Init_FIFO_credit[2], wlfc->FIFO_credit[2], wlfc->stats.send_pkts[2],
+		wlfc->stats.drop_pkts[4], wlfc->stats.drop_pkts[5], wlfc->stats.ooo_pkts[2],
+		wlfc->Init_FIFO_credit[3], wlfc->FIFO_credit[3], wlfc->stats.send_pkts[3],
+		wlfc->stats.drop_pkts[6], wlfc->stats.drop_pkts[7], wlfc->stats.ooo_pkts[3],
+		wlfc->Init_FIFO_credit[4], wlfc->FIFO_credit[4], wlfc->stats.send_pkts[4],
+		wlfc->stats.drop_pkts[8], wlfc->stats.drop_pkts[9], wlfc->stats.ooo_pkts[4]);
+
+	bcm_bprintf(strbuf, "\n");
+	for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+		if (interfaces[i].occupied) {
+			char* iftype_desc;
+
+			if (interfaces[i].iftype > WLC_E_IF_ROLE_P2P_CLIENT)
+				iftype_desc = "<Unknown";
+			else
+				iftype_desc = iftypes[interfaces[i].iftype];
+
+			ea = interfaces[i].ea;
+			bcm_bprintf(strbuf, "INTERFACE[%d].ea = "
+				"[%02x:%02x:%02x:%02x:%02x:%02x], if:%d, type: %s "
+				"netif_flow_control:%s\n", i,
+				ea[0], ea[1], ea[2], ea[3], ea[4], ea[5],
+				interfaces[i].interface_id,
+				iftype_desc, ((wlfc->hostif_flow_state[i] == OFF)
+				? " OFF":" ON"));
+
+			bcm_bprintf(strbuf, "INTERFACE[%d].PSQ(len,state,credit),(trans,supp_trans)"
+				"= (%d,%s,%d),(%d,%d)\n",
+				i,
+				interfaces[i].psq.len,
+				((interfaces[i].state ==
+				WLFC_STATE_OPEN) ? "OPEN":"CLOSE"),
+				interfaces[i].requested_credit,
+				interfaces[i].transit_count, interfaces[i].suppr_transit_count);
+
+			bcm_bprintf(strbuf, "INTERFACE[%d].PSQ"
+				"(delay0,sup0,afq0),(delay1,sup1,afq1),(delay2,sup2,afq2),"
+				"(delay3,sup3,afq3),(delay4,sup4,afq4) = (%d,%d,%d),"
+				"(%d,%d,%d),(%d,%d,%d),(%d,%d,%d),(%d,%d,%d)\n",
+				i,
+				interfaces[i].psq.q[0].len,
+				interfaces[i].psq.q[1].len,
+				interfaces[i].afq.q[0].len,
+				interfaces[i].psq.q[2].len,
+				interfaces[i].psq.q[3].len,
+				interfaces[i].afq.q[1].len,
+				interfaces[i].psq.q[4].len,
+				interfaces[i].psq.q[5].len,
+				interfaces[i].afq.q[2].len,
+				interfaces[i].psq.q[6].len,
+				interfaces[i].psq.q[7].len,
+				interfaces[i].afq.q[3].len,
+				interfaces[i].psq.q[8].len,
+				interfaces[i].psq.q[9].len,
+				interfaces[i].afq.q[4].len);
+		}
+	}
+
+	bcm_bprintf(strbuf, "\n");
+	for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+		if (mac_table[i].occupied) {
+			ea = mac_table[i].ea;
+			bcm_bprintf(strbuf, "MAC_table[%d].ea = "
+				"[%02x:%02x:%02x:%02x:%02x:%02x], if:%d \n", i,
+				ea[0], ea[1], ea[2], ea[3], ea[4], ea[5],
+				mac_table[i].interface_id);
+
+			bcm_bprintf(strbuf, "MAC_table[%d].PSQ(len,state,credit),(trans,supp_trans)"
+				"= (%d,%s,%d),(%d,%d)\n",
+				i,
+				mac_table[i].psq.len,
+				((mac_table[i].state ==
+				WLFC_STATE_OPEN) ? " OPEN":"CLOSE"),
+				mac_table[i].requested_credit,
+				mac_table[i].transit_count, mac_table[i].suppr_transit_count);
+#ifdef PROP_TXSTATUS_DEBUG
+			bcm_bprintf(strbuf, "MAC_table[%d]: (opened, closed) = (%d, %d)\n",
+				i, mac_table[i].opened_ct, mac_table[i].closed_ct);
+#endif
+			bcm_bprintf(strbuf, "MAC_table[%d].PSQ"
+				"(delay0,sup0,afq0),(delay1,sup1,afq1),(delay2,sup2,afq2),"
+				"(delay3,sup3,afq3),(delay4,sup4,afq4) =(%d,%d,%d),"
+				"(%d,%d,%d),(%d,%d,%d),(%d,%d,%d),(%d,%d,%d)\n",
+				i,
+				mac_table[i].psq.q[0].len,
+				mac_table[i].psq.q[1].len,
+				mac_table[i].afq.q[0].len,
+				mac_table[i].psq.q[2].len,
+				mac_table[i].psq.q[3].len,
+				mac_table[i].afq.q[1].len,
+				mac_table[i].psq.q[4].len,
+				mac_table[i].psq.q[5].len,
+				mac_table[i].afq.q[2].len,
+				mac_table[i].psq.q[6].len,
+				mac_table[i].psq.q[7].len,
+				mac_table[i].afq.q[3].len,
+				mac_table[i].psq.q[8].len,
+				mac_table[i].psq.q[9].len,
+				mac_table[i].afq.q[4].len);
+
+		}
+	}
+
+#ifdef PROP_TXSTATUS_DEBUG
+	{
+		int avg;
+		int moving_avg = 0;
+		int moving_samples;
+
+		if (wlfc->stats.latency_sample_count) {
+			moving_samples = sizeof(wlfc->stats.deltas)/sizeof(uint32);
+
+			for (i = 0; i < moving_samples; i++)
+				moving_avg += wlfc->stats.deltas[i];
+			moving_avg /= moving_samples;
+
+			avg = (100 * wlfc->stats.total_status_latency) /
+				wlfc->stats.latency_sample_count;
+			bcm_bprintf(strbuf, "txstatus latency (average, last, moving[%d]) = "
+				"(%d.%d, %03d, %03d)\n",
+				moving_samples, avg/100, (avg - (avg/100)*100),
+				wlfc->stats.latency_most_recent,
+				moving_avg);
+		}
+	}
+
+	bcm_bprintf(strbuf, "wlfc- fifo[0-5] credit stats: sent = (%d,%d,%d,%d,%d,%d), "
+		"back = (%d,%d,%d,%d,%d,%d)\n",
+		wlfc->stats.fifo_credits_sent[0],
+		wlfc->stats.fifo_credits_sent[1],
+		wlfc->stats.fifo_credits_sent[2],
+		wlfc->stats.fifo_credits_sent[3],
+		wlfc->stats.fifo_credits_sent[4],
+		wlfc->stats.fifo_credits_sent[5],
+
+		wlfc->stats.fifo_credits_back[0],
+		wlfc->stats.fifo_credits_back[1],
+		wlfc->stats.fifo_credits_back[2],
+		wlfc->stats.fifo_credits_back[3],
+		wlfc->stats.fifo_credits_back[4],
+		wlfc->stats.fifo_credits_back[5]);
+	{
+		uint32 fifo_cr_sent = 0;
+		uint32 fifo_cr_acked = 0;
+		uint32 request_cr_sent = 0;
+		uint32 request_cr_ack = 0;
+		uint32 bc_mc_cr_ack = 0;
+
+		for (i = 0; i < sizeof(wlfc->stats.fifo_credits_sent)/sizeof(uint32); i++) {
+			fifo_cr_sent += wlfc->stats.fifo_credits_sent[i];
+		}
+
+		for (i = 0; i < sizeof(wlfc->stats.fifo_credits_back)/sizeof(uint32); i++) {
+			fifo_cr_acked += wlfc->stats.fifo_credits_back[i];
+		}
+
+		for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+			if (wlfc->destination_entries.nodes[i].occupied) {
+				request_cr_sent +=
+					wlfc->destination_entries.nodes[i].dstncredit_sent_packets;
+			}
+		}
+		for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+			if (wlfc->destination_entries.interfaces[i].occupied) {
+				request_cr_sent +=
+				wlfc->destination_entries.interfaces[i].dstncredit_sent_packets;
+			}
+		}
+		for (i = 0; i < WLFC_MAC_DESC_TABLE_SIZE; i++) {
+			if (wlfc->destination_entries.nodes[i].occupied) {
+				request_cr_ack +=
+					wlfc->destination_entries.nodes[i].dstncredit_acks;
+			}
+		}
+		for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+			if (wlfc->destination_entries.interfaces[i].occupied) {
+				request_cr_ack +=
+					wlfc->destination_entries.interfaces[i].dstncredit_acks;
+			}
+		}
+		bcm_bprintf(strbuf, "wlfc- (sent, status) => pq(%d,%d), vq(%d,%d),"
+			"other:%d, bc_mc:%d, signal-only, (sent,freed): (%d,%d)",
+			fifo_cr_sent, fifo_cr_acked,
+			request_cr_sent, request_cr_ack,
+			wlfc->destination_entries.other.dstncredit_acks,
+			bc_mc_cr_ack,
+			wlfc->stats.signal_only_pkts_sent, wlfc->stats.signal_only_pkts_freed);
+	}
+#endif /* PROP_TXSTATUS_DEBUG */
+	bcm_bprintf(strbuf, "\n");
+	bcm_bprintf(strbuf, "wlfc- pkt((in,2bus,txstats,hdrpull,out),(dropped,hdr_only,wlc_tossed)"
+		"(freed,free_err,rollback)) = "
+		"((%d,%d,%d,%d,%d),(%d,%d,%d),(%d,%d,%d))\n",
+		wlfc->stats.pktin,
+		wlfc->stats.pkt2bus,
+		wlfc->stats.txstatus_in,
+		wlfc->stats.dhd_hdrpulls,
+		wlfc->stats.pktout,
+
+		wlfc->stats.pktdropped,
+		wlfc->stats.wlfc_header_only_pkt,
+		wlfc->stats.wlc_tossed_pkts,
+
+		wlfc->stats.pkt_freed,
+		wlfc->stats.pkt_free_err, wlfc->stats.rollback);
+
+	bcm_bprintf(strbuf, "wlfc- suppress((d11,wlc,err),enq(d11,wl,hq,mac?),retx(d11,wlc,hq)) = "
+		"((%d,%d,%d),(%d,%d,%d,%d),(%d,%d,%d))\n",
+		wlfc->stats.d11_suppress,
+		wlfc->stats.wl_suppress,
+		wlfc->stats.bad_suppress,
+
+		wlfc->stats.psq_d11sup_enq,
+		wlfc->stats.psq_wlsup_enq,
+		wlfc->stats.psq_hostq_enq,
+		wlfc->stats.mac_handle_notfound,
+
+		wlfc->stats.psq_d11sup_retx,
+		wlfc->stats.psq_wlsup_retx,
+		wlfc->stats.psq_hostq_retx);
+
+	bcm_bprintf(strbuf, "wlfc- cleanup(txq,psq,fw) = (%d,%d,%d)\n",
+		wlfc->stats.cleanup_txq_cnt,
+		wlfc->stats.cleanup_psq_cnt,
+		wlfc->stats.cleanup_fw_cnt);
+
+	bcm_bprintf(strbuf, "wlfc- generic error: %d\n", wlfc->stats.generic_error);
+
+	for (i = 0; i < WLFC_MAX_IFNUM; i++) {
+		bcm_bprintf(strbuf, "wlfc- if[%d], pkt_cnt_in_q/AC[0-4] = (%d,%d,%d,%d,%d)\n", i,
+			wlfc->pkt_cnt_in_q[i][0],
+			wlfc->pkt_cnt_in_q[i][1],
+			wlfc->pkt_cnt_in_q[i][2],
+			wlfc->pkt_cnt_in_q[i][3],
+			wlfc->pkt_cnt_in_q[i][4]);
+	}
+	bcm_bprintf(strbuf, "\n");
+
+	dhd_os_wlfc_unblock(dhdp);
+	return BCME_OK;
+}
+
+int dhd_wlfc_clear_counts(dhd_pub_t *dhd)
+{
+	athost_wl_status_info_t* wlfc;
+	wlfc_hanger_t* hanger;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhd);
+		return WLFC_UNSUPPORTED;
+	}
+
+	wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+	memset(&wlfc->stats, 0, sizeof(athost_wl_stat_counters_t));
+
+	if (!WLFC_GET_AFQ(dhd->wlfc_mode)) {
+		hanger = (wlfc_hanger_t*)wlfc->hanger;
+
+		hanger->pushed = 0;
+		hanger->popped = 0;
+		hanger->failed_slotfind = 0;
+		hanger->failed_to_pop = 0;
+		hanger->failed_to_push = 0;
+	}
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_get_enable(dhd_pub_t *dhd, bool *val)
+{
+	if (!dhd || !val) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	*val = dhd->wlfc_enabled;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_get_mode(dhd_pub_t *dhd, int *val)
+{
+	if (!dhd || !val) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	*val = dhd->wlfc_state ? dhd->proptxstatus_mode : 0;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_set_mode(dhd_pub_t *dhd, int val)
+{
+	if (!dhd) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (dhd->wlfc_state) {
+		dhd->proptxstatus_mode = val & 0xff;
+	}
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+bool dhd_wlfc_is_header_only_pkt(dhd_pub_t * dhd, void *pktbuf)
+{
+	athost_wl_status_info_t* wlfc;
+	bool rc = FALSE;
+
+	if (dhd == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return FALSE;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhd);
+		return FALSE;
+	}
+
+	wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+	if (PKTLEN(wlfc->osh, pktbuf) == 0) {
+		wlfc->stats.wlfc_header_only_pkt++;
+		rc = TRUE;
+	}
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return rc;
+}
+
+int dhd_wlfc_flowcontrol(dhd_pub_t *dhdp, bool state, bool bAcquireLock)
+{
+	if (dhdp == NULL) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	if (bAcquireLock) {
+		dhd_os_wlfc_block(dhdp);
+	}
+
+	if (!dhdp->wlfc_state || (dhdp->proptxstatus_mode == WLFC_FCMODE_NONE) ||
+		dhdp->proptxstatus_module_ignore) {
+		if (bAcquireLock) {
+			dhd_os_wlfc_unblock(dhdp);
+		}
+		return WLFC_UNSUPPORTED;
+	}
+
+	if (state != dhdp->proptxstatus_txoff) {
+		dhdp->proptxstatus_txoff = state;
+	}
+
+	if (bAcquireLock) {
+		dhd_os_wlfc_unblock(dhdp);
+	}
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_save_rxpath_ac_time(dhd_pub_t * dhd, uint8 prio)
+{
+	athost_wl_status_info_t* wlfc;
+	int rx_path_ac = -1;
+
+	if ((dhd == NULL) || (prio >= NUMPRIO)) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if (!dhd->wlfc_rxpkt_chk) {
+		dhd_os_wlfc_unblock(dhd);
+		return BCME_OK;
+	}
+
+	if (!dhd->wlfc_state || (dhd->proptxstatus_mode == WLFC_FCMODE_NONE)) {
+		dhd_os_wlfc_unblock(dhd);
+		return WLFC_UNSUPPORTED;
+	}
+
+	wlfc = (athost_wl_status_info_t*)dhd->wlfc_state;
+
+	rx_path_ac = prio2fifo[prio];
+	wlfc->rx_timestamp[rx_path_ac] = OSL_SYSUPTIME();
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_get_module_ignore(dhd_pub_t *dhd, int *val)
+{
+	if (!dhd || !val) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	*val = dhd->proptxstatus_module_ignore;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_set_module_ignore(dhd_pub_t *dhd, int val)
+{
+	char iovbuf[14]; /* Room for "tlv" + '\0' + parameter */
+	uint32 tlv = 0;
+	bool bChanged = FALSE;
+
+	if (!dhd) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	if ((bool)val != dhd->proptxstatus_module_ignore) {
+		dhd->proptxstatus_module_ignore = (val != 0);
+		/* force txstatus_ignore sync with proptxstatus_module_ignore */
+		dhd->proptxstatus_txstatus_ignore = dhd->proptxstatus_module_ignore;
+		if (FALSE == dhd->proptxstatus_module_ignore) {
+			tlv = WLFC_FLAGS_RSSI_SIGNALS |
+				WLFC_FLAGS_XONXOFF_SIGNALS |
+				WLFC_FLAGS_CREDIT_STATUS_SIGNALS |
+				WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE;
+		}
+		/* always enable host reorder */
+		tlv |= WLFC_FLAGS_HOST_RXRERODER_ACTIVE;
+		bChanged = TRUE;
+	}
+
+	dhd_os_wlfc_unblock(dhd);
+
+	if (bChanged) {
+		/* select enable proptxtstatus signaling */
+		bcm_mkiovar("tlv", (char *)&tlv, 4, iovbuf, sizeof(iovbuf));
+		if (dhd_wl_ioctl_cmd(dhd, WLC_SET_VAR, iovbuf, sizeof(iovbuf), TRUE, 0) < 0) {
+			DHD_ERROR(("%s: failed to set bdcv2 tlv signaling to 0x%x\n",
+				__FUNCTION__, tlv));
+		}
+		else {
+			DHD_ERROR(("%s: successfully set bdcv2 tlv signaling to 0x%x\n",
+				__FUNCTION__, tlv));
+		}
+	}
+	return BCME_OK;
+}
+
+int dhd_wlfc_get_credit_ignore(dhd_pub_t *dhd, int *val)
+{
+	if (!dhd || !val) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	*val = dhd->proptxstatus_credit_ignore;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_set_credit_ignore(dhd_pub_t *dhd, int val)
+{
+	if (!dhd) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	dhd->proptxstatus_credit_ignore = (val != 0);
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_get_txstatus_ignore(dhd_pub_t *dhd, int *val)
+{
+	if (!dhd || !val) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	*val = dhd->proptxstatus_txstatus_ignore;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_set_txstatus_ignore(dhd_pub_t *dhd, int val)
+{
+	if (!dhd) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	dhd->proptxstatus_txstatus_ignore = (val != 0);
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_get_rxpkt_chk(dhd_pub_t *dhd, int *val)
+{
+	if (!dhd || !val) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	*val = dhd->wlfc_rxpkt_chk;
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+
+int dhd_wlfc_set_rxpkt_chk(dhd_pub_t *dhd, int val)
+{
+	if (!dhd) {
+		DHD_ERROR(("Error: %s():%d\n", __FUNCTION__, __LINE__));
+		return BCME_BADARG;
+	}
+
+	dhd_os_wlfc_block(dhd);
+
+	dhd->wlfc_rxpkt_chk = (val != 0);
+
+	dhd_os_wlfc_unblock(dhd);
+
+	return BCME_OK;
+}
+#endif /* PROP_TXSTATUS */
diff -ENwbur a/drivers/net/wireless/bcm4336/dhd_wlfc.h b/drivers/net/wireless/bcm4336/dhd_wlfc.h
--- a/drivers/net/wireless/bcm4336/dhd_wlfc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dhd_wlfc.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,505 @@
+/*
+* $Copyright Open 2009 Broadcom Corporation$
+* $Id: dhd_wlfc.h 501046 2014-09-06 01:25:16Z $
+*
+*/
+#ifndef __wlfc_host_driver_definitions_h__
+#define __wlfc_host_driver_definitions_h__
+
+#ifdef QMONITOR
+#include <dhd_qmon.h>
+#endif
+
+/* #define OOO_DEBUG */
+
+#define WLFC_UNSUPPORTED -9999
+
+#define WLFC_NO_TRAFFIC	-1
+#define WLFC_MULTI_TRAFFIC 0
+
+#define BUS_RETRIES 1	/* # of retries before aborting a bus tx operation */
+
+/* 16 bits will provide an absolute max of 65536 slots */
+#define WLFC_HANGER_MAXITEMS 3072
+
+#define WLFC_HANGER_ITEM_STATE_FREE			1
+#define WLFC_HANGER_ITEM_STATE_INUSE			2
+#define WLFC_HANGER_ITEM_STATE_INUSE_SUPPRESSED		3
+
+#define WLFC_HANGER_PKT_STATE_TXSTATUS			1
+#define WLFC_HANGER_PKT_STATE_TXCOMPLETE		2
+#define WLFC_HANGER_PKT_STATE_CLEANUP			4
+
+typedef enum {
+	Q_TYPE_PSQ,
+	Q_TYPE_AFQ
+} q_type_t;
+
+typedef enum ewlfc_packet_state {
+	eWLFC_PKTTYPE_NEW,
+	eWLFC_PKTTYPE_DELAYED,
+	eWLFC_PKTTYPE_SUPPRESSED,
+	eWLFC_PKTTYPE_MAX
+} ewlfc_packet_state_t;
+
+typedef enum ewlfc_mac_entry_action {
+	eWLFC_MAC_ENTRY_ACTION_ADD,
+	eWLFC_MAC_ENTRY_ACTION_DEL,
+	eWLFC_MAC_ENTRY_ACTION_UPDATE,
+	eWLFC_MAC_ENTRY_ACTION_MAX
+} ewlfc_mac_entry_action_t;
+
+typedef struct wlfc_hanger_item {
+	uint8	state;
+	uint8   gen;
+	uint8	pkt_state;
+	uint8	pkt_txstatus;
+	uint32	identifier;
+	void*	pkt;
+#ifdef PROP_TXSTATUS_DEBUG
+	uint32	push_time;
+#endif
+	struct wlfc_hanger_item *next;
+} wlfc_hanger_item_t;
+
+typedef struct wlfc_hanger {
+	int max_items;
+	uint32 pushed;
+	uint32 popped;
+	uint32 failed_to_push;
+	uint32 failed_to_pop;
+	uint32 failed_slotfind;
+	uint32 slot_pos;
+	wlfc_hanger_item_t items[1];
+} wlfc_hanger_t;
+
+#define WLFC_HANGER_SIZE(n)	((sizeof(wlfc_hanger_t) - \
+	sizeof(wlfc_hanger_item_t)) + ((n)*sizeof(wlfc_hanger_item_t)))
+
+#define WLFC_STATE_OPEN		1
+#define WLFC_STATE_CLOSE	2
+
+#define WLFC_PSQ_PREC_COUNT		((AC_COUNT + 1) * 2) /* 2 for each AC traffic and bc/mc */
+#define WLFC_AFQ_PREC_COUNT		(AC_COUNT + 1)
+
+#define WLFC_PSQ_LEN			2048
+
+#define WLFC_FLOWCONTROL_HIWATER	(2048 - 256)
+#define WLFC_FLOWCONTROL_LOWATER	256
+
+#define WLFC_LOG_BUF_SIZE		(1024*1024)
+
+typedef struct wlfc_mac_descriptor {
+	uint8 occupied;
+	uint8 interface_id;
+	uint8 iftype;
+	uint8 state;
+	uint8 ac_bitmap; /* for APSD */
+	uint8 requested_credit;
+	uint8 requested_packet;
+	uint8 ea[ETHER_ADDR_LEN];
+	/*
+	maintain (MAC,AC) based seq count for
+	packets going to the device. As well as bc/mc.
+	*/
+	uint8 seq[AC_COUNT + 1];
+	uint8 generation;
+	struct pktq	psq;
+	/* packets at firmware */
+	struct pktq	afq;
+	/* The AC pending bitmap that was reported to the fw at last change */
+	uint8 traffic_lastreported_bmp;
+	/* The new AC pending bitmap */
+	uint8 traffic_pending_bmp;
+	/* 1= send on next opportunity */
+	uint8 send_tim_signal;
+	uint8 mac_handle;
+	/* Number of packets at dongle for this entry. */
+	int transit_count;
+	/* Numbe of suppression to wait before evict from delayQ */
+	int suppr_transit_count;
+	/* flag. TRUE when in suppress state */
+	uint8 suppressed;
+
+#ifdef QMONITOR
+	dhd_qmon_t qmon;
+#endif /* QMONITOR */
+
+#ifdef PROP_TXSTATUS_DEBUG
+	uint32 dstncredit_sent_packets;
+	uint32 dstncredit_acks;
+	uint32 opened_ct;
+	uint32 closed_ct;
+#endif
+	struct wlfc_mac_descriptor* prev;
+	struct wlfc_mac_descriptor* next;
+} wlfc_mac_descriptor_t;
+
+typedef struct dhd_wlfc_commit_info {
+	uint8					needs_hdr;
+	uint8					ac_fifo_credit_spent;
+	ewlfc_packet_state_t	pkt_type;
+	wlfc_mac_descriptor_t*	mac_entry;
+	void*					p;
+} dhd_wlfc_commit_info_t;
+
+#define WLFC_DECR_SEQCOUNT(entry, prec) do { if (entry->seq[(prec)] == 0) {\
+	entry->seq[prec] = 0xff; } else entry->seq[prec]--;} while (0)
+
+#define WLFC_INCR_SEQCOUNT(entry, prec) entry->seq[(prec)]++
+#define WLFC_SEQCOUNT(entry, prec) entry->seq[(prec)]
+
+typedef struct athost_wl_stat_counters {
+	uint32	pktin;
+	uint32	pktout;
+	uint32	pkt2bus;
+	uint32	pktdropped;
+	uint32	tlv_parse_failed;
+	uint32	rollback;
+	uint32	rollback_failed;
+	uint32	delayq_full_error;
+	uint32	credit_request_failed;
+	uint32	packet_request_failed;
+	uint32	mac_update_failed;
+	uint32	psmode_update_failed;
+	uint32	interface_update_failed;
+	uint32	wlfc_header_only_pkt;
+	uint32	txstatus_in;
+	uint32	d11_suppress;
+	uint32	wl_suppress;
+	uint32	bad_suppress;
+	uint32	pkt_freed;
+	uint32	pkt_free_err;
+	uint32	psq_wlsup_retx;
+	uint32	psq_wlsup_enq;
+	uint32	psq_d11sup_retx;
+	uint32	psq_d11sup_enq;
+	uint32	psq_hostq_retx;
+	uint32	psq_hostq_enq;
+	uint32	mac_handle_notfound;
+	uint32	wlc_tossed_pkts;
+	uint32	dhd_hdrpulls;
+	uint32	generic_error;
+	/* an extra one for bc/mc traffic */
+	uint32	send_pkts[AC_COUNT + 1];
+	uint32	drop_pkts[WLFC_PSQ_PREC_COUNT];
+	uint32	ooo_pkts[AC_COUNT + 1];
+#ifdef PROP_TXSTATUS_DEBUG
+	/* all pkt2bus -> txstatus latency accumulated */
+	uint32	latency_sample_count;
+	uint32	total_status_latency;
+	uint32	latency_most_recent;
+	int	idx_delta;
+	uint32	deltas[10];
+	uint32	fifo_credits_sent[6];
+	uint32	fifo_credits_back[6];
+	uint32	dropped_qfull[6];
+	uint32	signal_only_pkts_sent;
+	uint32	signal_only_pkts_freed;
+#endif
+	uint32	cleanup_txq_cnt;
+	uint32	cleanup_psq_cnt;
+	uint32	cleanup_fw_cnt;
+} athost_wl_stat_counters_t;
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do { \
+	(ctx)->stats.fifo_credits_sent[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do { \
+	(ctx)->stats.fifo_credits_back[(ac)]++;} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do { \
+	(ctx)->stats.dropped_qfull[(ac)]++;} while (0)
+#else
+#define WLFC_HOST_FIFO_CREDIT_INC_SENTCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_CREDIT_INC_BACKCTRS(ctx, ac) do {} while (0)
+#define WLFC_HOST_FIFO_DROPPEDCTR_INC(ctx, ac) do {} while (0)
+#endif
+
+#define WLFC_FCMODE_NONE				0
+#define WLFC_FCMODE_IMPLIED_CREDIT		1
+#define WLFC_FCMODE_EXPLICIT_CREDIT		2
+#define WLFC_ONLY_AMPDU_HOSTREORDER		3
+
+/* Reserved credits ratio when borrowed by hihger priority */
+#define WLFC_BORROW_LIMIT_RATIO		4
+
+/* How long to defer borrowing in milliseconds */
+#define WLFC_BORROW_DEFER_PERIOD_MS 100
+
+/* How long to defer flow control in milliseconds */
+#define WLFC_FC_DEFER_PERIOD_MS 200
+
+/* How long to detect occurance per AC in miliseconds */
+#define WLFC_RX_DETECTION_THRESHOLD_MS	100
+
+/* Mask to represent available ACs (note: BC/MC is ignored */
+#define WLFC_AC_MASK 0xF
+
+typedef struct athost_wl_status_info {
+	uint8	last_seqid_to_wlc;
+
+	/* OSL handle */
+	osl_t*	osh;
+	/* dhd pub */
+	void*	dhdp;
+
+	/* stats */
+	athost_wl_stat_counters_t stats;
+
+	int		Init_FIFO_credit[AC_COUNT + 2];
+
+	/* the additional ones are for bc/mc and ATIM FIFO */
+	int		FIFO_credit[AC_COUNT + 2];
+
+	/* Credit borrow counts for each FIFO from each of the other FIFOs */
+	int		credits_borrowed[AC_COUNT + 2][AC_COUNT + 2];
+
+	/* packet hanger and MAC->handle lookup table */
+	void*	hanger;
+	struct {
+		/* table for individual nodes */
+		wlfc_mac_descriptor_t	nodes[WLFC_MAC_DESC_TABLE_SIZE];
+		/* table for interfaces */
+		wlfc_mac_descriptor_t	interfaces[WLFC_MAX_IFNUM];
+		/* OS may send packets to unknown (unassociated) destinations */
+		/* A place holder for bc/mc and packets to unknown destinations */
+		wlfc_mac_descriptor_t	other;
+	} destination_entries;
+
+	wlfc_mac_descriptor_t *active_entry_head;
+	int active_entry_count;
+
+	wlfc_mac_descriptor_t* requested_entry[WLFC_MAC_DESC_TABLE_SIZE];
+	int requested_entry_count;
+
+	/* pkt counts for each interface and ac */
+	int	pkt_cnt_in_q[WLFC_MAX_IFNUM][AC_COUNT+1];
+	int	pkt_cnt_per_ac[AC_COUNT+1];
+	int	pkt_cnt_in_drv[WLFC_MAX_IFNUM][AC_COUNT+1];
+	uint8	allow_fc;
+	uint32  fc_defer_timestamp;
+	uint32	rx_timestamp[AC_COUNT+1];
+	/* ON/OFF state for flow control to the host network interface */
+	uint8	hostif_flow_state[WLFC_MAX_IFNUM];
+	uint8	host_ifidx;
+	/* to flow control an OS interface */
+	uint8	toggle_host_if;
+
+	/* To borrow credits */
+	uint8   allow_credit_borrow;
+
+	/* ac number for the first single ac traffic */
+	uint8	single_ac;
+
+	/* Timestamp for the first single ac traffic */
+	uint32  single_ac_timestamp;
+
+	bool	bcmc_credit_supported;
+
+} athost_wl_status_info_t;
+
+/* Please be mindful that total pkttag space is 32 octets only */
+typedef struct dhd_pkttag {
+	/*
+	b[15]  - 1 = wlfc packet
+	b[14:13]  - encryption exemption
+	b[12 ] - 1 = event channel
+	b[11 ] - 1 = this packet was sent in response to one time packet request,
+	do not increment credit on status for this one. [WLFC_CTL_TYPE_MAC_REQUEST_PACKET].
+	b[10 ] - 1 = signal-only-packet to firmware [i.e. nothing to piggyback on]
+	b[9  ] - 1 = packet is host->firmware (transmit direction)
+	       - 0 = packet received from firmware (firmware->host)
+	b[8  ] - 1 = packet was sent due to credit_request (pspoll),
+	             packet does not count against FIFO credit.
+	       - 0 = normal transaction, packet counts against FIFO credit
+	b[7  ] - 1 = AP, 0 = STA
+	b[6:4] - AC FIFO number
+	b[3:0] - interface index
+	*/
+	uint16	if_flags;
+	/* destination MAC address for this packet so that not every
+	module needs to open the packet to find this
+	*/
+	uint8	dstn_ether[ETHER_ADDR_LEN];
+	/*
+	This 32-bit goes from host to device for every packet.
+	*/
+	uint32	htod_tag;
+
+	/*
+	This 16-bit is original seq number for every suppress packet.
+	*/
+	uint16	htod_seq;
+
+	/*
+	This address is mac entry for every packet.
+	*/
+	void*	entry;
+	/* bus specific stuff */
+	union {
+		struct {
+			void* stuff;
+			uint32 thing1;
+			uint32 thing2;
+		} sd;
+		struct {
+			void* bus;
+			void* urb;
+		} usb;
+	} bus_specific;
+} dhd_pkttag_t;
+
+#define DHD_PKTTAG_WLFCPKT_MASK			0x1
+#define DHD_PKTTAG_WLFCPKT_SHIFT		15
+#define DHD_PKTTAG_WLFCPKT_SET(tag, value)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_WLFCPKT_MASK << DHD_PKTTAG_WLFCPKT_SHIFT)) | \
+	(((value) & DHD_PKTTAG_WLFCPKT_MASK) << DHD_PKTTAG_WLFCPKT_SHIFT)
+#define DHD_PKTTAG_WLFCPKT(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_WLFCPKT_SHIFT) & DHD_PKTTAG_WLFCPKT_MASK)
+
+#define DHD_PKTTAG_EXEMPT_MASK			0x3
+#define DHD_PKTTAG_EXEMPT_SHIFT			13
+#define DHD_PKTTAG_EXEMPT_SET(tag, value)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_EXEMPT_MASK << DHD_PKTTAG_EXEMPT_SHIFT)) | \
+	(((value) & DHD_PKTTAG_EXEMPT_MASK) << DHD_PKTTAG_EXEMPT_SHIFT)
+#define DHD_PKTTAG_EXEMPT(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_EXEMPT_SHIFT) & DHD_PKTTAG_EXEMPT_MASK)
+
+#define DHD_PKTTAG_EVENT_MASK			0x1
+#define DHD_PKTTAG_EVENT_SHIFT			12
+#define DHD_PKTTAG_SETEVENT(tag, event)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_EVENT_MASK << DHD_PKTTAG_EVENT_SHIFT)) | \
+	(((event) & DHD_PKTTAG_EVENT_MASK) << DHD_PKTTAG_EVENT_SHIFT)
+#define DHD_PKTTAG_EVENT(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_EVENT_SHIFT) & DHD_PKTTAG_EVENT_MASK)
+
+#define DHD_PKTTAG_ONETIMEPKTRQST_MASK		0x1
+#define DHD_PKTTAG_ONETIMEPKTRQST_SHIFT		11
+#define DHD_PKTTAG_SETONETIMEPKTRQST(tag)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_ONETIMEPKTRQST_MASK << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)) | \
+	(1 << DHD_PKTTAG_ONETIMEPKTRQST_SHIFT)
+#define DHD_PKTTAG_ONETIMEPKTRQST(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_ONETIMEPKTRQST_SHIFT) & DHD_PKTTAG_ONETIMEPKTRQST_MASK)
+
+#define DHD_PKTTAG_SIGNALONLY_MASK		0x1
+#define DHD_PKTTAG_SIGNALONLY_SHIFT		10
+#define DHD_PKTTAG_SETSIGNALONLY(tag, signalonly)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_SIGNALONLY_MASK << DHD_PKTTAG_SIGNALONLY_SHIFT)) | \
+	(((signalonly) & DHD_PKTTAG_SIGNALONLY_MASK) << DHD_PKTTAG_SIGNALONLY_SHIFT)
+#define DHD_PKTTAG_SIGNALONLY(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_SIGNALONLY_SHIFT) & DHD_PKTTAG_SIGNALONLY_MASK)
+
+#define DHD_PKTTAG_PKTDIR_MASK			0x1
+#define DHD_PKTTAG_PKTDIR_SHIFT			9
+#define DHD_PKTTAG_SETPKTDIR(tag, dir)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_PKTDIR_MASK << DHD_PKTTAG_PKTDIR_SHIFT)) | \
+	(((dir) & DHD_PKTTAG_PKTDIR_MASK) << DHD_PKTTAG_PKTDIR_SHIFT)
+#define DHD_PKTTAG_PKTDIR(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_PKTDIR_SHIFT) & DHD_PKTTAG_PKTDIR_MASK)
+
+#define DHD_PKTTAG_CREDITCHECK_MASK		0x1
+#define DHD_PKTTAG_CREDITCHECK_SHIFT		8
+#define DHD_PKTTAG_SETCREDITCHECK(tag, check)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_CREDITCHECK_MASK << DHD_PKTTAG_CREDITCHECK_SHIFT)) | \
+	(((check) & DHD_PKTTAG_CREDITCHECK_MASK) << DHD_PKTTAG_CREDITCHECK_SHIFT)
+#define DHD_PKTTAG_CREDITCHECK(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_CREDITCHECK_SHIFT) & DHD_PKTTAG_CREDITCHECK_MASK)
+
+#define DHD_PKTTAG_IFTYPE_MASK			0x1
+#define DHD_PKTTAG_IFTYPE_SHIFT			7
+#define DHD_PKTTAG_SETIFTYPE(tag, isAP)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & \
+	~(DHD_PKTTAG_IFTYPE_MASK << DHD_PKTTAG_IFTYPE_SHIFT)) | \
+	(((isAP) & DHD_PKTTAG_IFTYPE_MASK) << DHD_PKTTAG_IFTYPE_SHIFT)
+#define DHD_PKTTAG_IFTYPE(tag)	((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_IFTYPE_SHIFT) & DHD_PKTTAG_IFTYPE_MASK)
+
+#define DHD_PKTTAG_FIFO_MASK			0x7
+#define DHD_PKTTAG_FIFO_SHIFT			4
+#define DHD_PKTTAG_SETFIFO(tag, fifo)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_FIFO_MASK << DHD_PKTTAG_FIFO_SHIFT)) | \
+	(((fifo) & DHD_PKTTAG_FIFO_MASK) << DHD_PKTTAG_FIFO_SHIFT)
+#define DHD_PKTTAG_FIFO(tag)		((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_FIFO_SHIFT) & DHD_PKTTAG_FIFO_MASK)
+
+#define DHD_PKTTAG_IF_MASK			0xf
+#define DHD_PKTTAG_IF_SHIFT			0
+#define DHD_PKTTAG_SETIF(tag, if)	((dhd_pkttag_t*)(tag))->if_flags = \
+	(((dhd_pkttag_t*)(tag))->if_flags & ~(DHD_PKTTAG_IF_MASK << DHD_PKTTAG_IF_SHIFT)) | \
+	(((if) & DHD_PKTTAG_IF_MASK) << DHD_PKTTAG_IF_SHIFT)
+#define DHD_PKTTAG_IF(tag)		((((dhd_pkttag_t*)(tag))->if_flags >> \
+	DHD_PKTTAG_IF_SHIFT) & DHD_PKTTAG_IF_MASK)
+
+#define DHD_PKTTAG_SETDSTN(tag, dstn_MAC_ea)	memcpy(((dhd_pkttag_t*)((tag)))->dstn_ether, \
+	(dstn_MAC_ea), ETHER_ADDR_LEN)
+#define DHD_PKTTAG_DSTN(tag)	((dhd_pkttag_t*)(tag))->dstn_ether
+
+#define DHD_PKTTAG_SET_H2DTAG(tag, h2dvalue)	((dhd_pkttag_t*)(tag))->htod_tag = (h2dvalue)
+#define DHD_PKTTAG_H2DTAG(tag)			(((dhd_pkttag_t*)(tag))->htod_tag)
+
+#define DHD_PKTTAG_SET_H2DSEQ(tag, seq)		((dhd_pkttag_t*)(tag))->htod_seq = (seq)
+#define DHD_PKTTAG_H2DSEQ(tag)			(((dhd_pkttag_t*)(tag))->htod_seq)
+
+#define DHD_PKTTAG_SET_ENTRY(tag, entry)	((dhd_pkttag_t*)(tag))->entry = (entry)
+#define DHD_PKTTAG_ENTRY(tag)			(((dhd_pkttag_t*)(tag))->entry)
+
+#define PSQ_SUP_IDX(x) (x * 2 + 1)
+#define PSQ_DLY_IDX(x) (x * 2)
+
+typedef int (*f_commitpkt_t)(void* ctx, void* p);
+typedef bool (*f_processpkt_t)(void* p, void* arg);
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)	do { (entry)->closed_ct++; } while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)		do { (entry)->opened_ct++; } while (0)
+#else
+#define DHD_WLFC_CTRINC_MAC_CLOSE(entry)	do {} while (0)
+#define DHD_WLFC_CTRINC_MAC_OPEN(entry)		do {} while (0)
+#endif
+
+/* public functions */
+int dhd_wlfc_parse_header_info(dhd_pub_t *dhd, void* pktbuf, int tlv_hdr_len,
+	uchar *reorder_info_buf, uint *reorder_info_len);
+int dhd_wlfc_commit_packets(dhd_pub_t *dhdp, f_commitpkt_t fcommit,
+	void* commit_ctx, void *pktbuf, bool need_toggle_host_if);
+int dhd_wlfc_txcomplete(dhd_pub_t *dhd, void *txp, bool success);
+int dhd_wlfc_init(dhd_pub_t *dhd);
+#ifdef SUPPORT_P2P_GO_PS
+int dhd_wlfc_suspend(dhd_pub_t *dhd);
+int dhd_wlfc_resume(dhd_pub_t *dhd);
+#endif /* SUPPORT_P2P_GO_PS */
+int dhd_wlfc_hostreorder_init(dhd_pub_t *dhd);
+int dhd_wlfc_cleanup_txq(dhd_pub_t *dhd, f_processpkt_t fn, void *arg);
+int dhd_wlfc_cleanup(dhd_pub_t *dhd, f_processpkt_t fn, void* arg);
+int dhd_wlfc_deinit(dhd_pub_t *dhd);
+int dhd_wlfc_interface_event(dhd_pub_t *dhdp, uint8 action, uint8 ifid, uint8 iftype, uint8* ea);
+int dhd_wlfc_FIFOcreditmap_event(dhd_pub_t *dhdp, uint8* event_data);
+int dhd_wlfc_BCMCCredit_support_event(dhd_pub_t *dhdp);
+int dhd_wlfc_enable(dhd_pub_t *dhdp);
+int dhd_wlfc_dump(dhd_pub_t *dhdp, struct bcmstrbuf *strbuf);
+int dhd_wlfc_clear_counts(dhd_pub_t *dhd);
+int dhd_wlfc_get_enable(dhd_pub_t *dhd, bool *val);
+int dhd_wlfc_get_mode(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_mode(dhd_pub_t *dhd, int val);
+bool dhd_wlfc_is_supported(dhd_pub_t *dhd);
+bool dhd_wlfc_is_header_only_pkt(dhd_pub_t * dhd, void *pktbuf);
+int dhd_wlfc_flowcontrol(dhd_pub_t *dhdp, bool state, bool bAcquireLock);
+int dhd_wlfc_save_rxpath_ac_time(dhd_pub_t * dhd, uint8 prio);
+
+int dhd_wlfc_get_module_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_module_ignore(dhd_pub_t *dhd, int val);
+int dhd_wlfc_get_credit_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_credit_ignore(dhd_pub_t *dhd, int val);
+int dhd_wlfc_get_txstatus_ignore(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_txstatus_ignore(dhd_pub_t *dhd, int val);
+
+int dhd_wlfc_get_rxpkt_chk(dhd_pub_t *dhd, int *val);
+int dhd_wlfc_set_rxpkt_chk(dhd_pub_t *dhd, int val);
+#endif /* __wlfc_host_driver_definitions_h__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dngl_stats.h b/drivers/net/wireless/bcm4336/dngl_stats.h
--- a/drivers/net/wireless/bcm4336/dngl_stats.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dngl_stats.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,25 @@
+/*
+ * Common stats definitions for clients of dongle
+ * ports
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dngl_stats.h 464743 2014-03-25 21:04:32Z $
+ */
+
+#ifndef _dngl_stats_h_
+#define _dngl_stats_h_
+
+typedef struct {
+	unsigned long	rx_packets;		/* total packets received */
+	unsigned long	tx_packets;		/* total packets transmitted */
+	unsigned long	rx_bytes;		/* total bytes received */
+	unsigned long	tx_bytes;		/* total bytes transmitted */
+	unsigned long	rx_errors;		/* bad packets received */
+	unsigned long	tx_errors;		/* packet transmit problems */
+	unsigned long	rx_dropped;		/* packets dropped by dongle */
+	unsigned long	tx_dropped;		/* packets dropped by dongle */
+	unsigned long   multicast;      /* multicast packets received */
+} dngl_stats_t;
+
+#endif /* _dngl_stats_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/dngl_wlhdr.h b/drivers/net/wireless/bcm4336/dngl_wlhdr.h
--- a/drivers/net/wireless/bcm4336/dngl_wlhdr.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/dngl_wlhdr.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,22 @@
+/*
+ * Dongle WL Header definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dngl_wlhdr.h 464743 2014-03-25 21:04:32Z $
+ */
+
+#ifndef _dngl_wlhdr_h_
+#define _dngl_wlhdr_h_
+
+typedef struct wl_header {
+    uint8   type;           /* Header type */
+    uint8   version;        /* Header version */
+	int8	rssi;			/* RSSI */
+	uint8	pad;			/* Unused */
+} wl_header_t;
+
+#define WL_HEADER_LEN   sizeof(wl_header_t)
+#define WL_HEADER_TYPE  0
+#define WL_HEADER_VER   1
+#endif /* _dngl_wlhdr_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/hnd_pktpool.c b/drivers/net/wireless/bcm4336/hnd_pktpool.c
--- a/drivers/net/wireless/bcm4336/hnd_pktpool.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/hnd_pktpool.c	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,733 @@
+/*
+ * HND generic packet pool operation primitives
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <hnd_pktpool.h>
+
+/* Registry size is one larger than max pools, as slot #0 is reserved */
+#define PKTPOOLREG_RSVD_ID				(0U)
+#define PKTPOOLREG_RSVD_PTR				(POOLPTR(0xdeaddead))
+#define PKTPOOLREG_FREE_PTR				(POOLPTR(NULL))
+
+#define PKTPOOL_REGISTRY_SET(id, pp)	(pktpool_registry_set((id), (pp)))
+#define PKTPOOL_REGISTRY_CMP(id, pp)	(pktpool_registry_cmp((id), (pp)))
+
+/* Tag a registry entry as free for use */
+#define PKTPOOL_REGISTRY_CLR(id)		\
+		PKTPOOL_REGISTRY_SET((id), PKTPOOLREG_FREE_PTR)
+#define PKTPOOL_REGISTRY_ISCLR(id)		\
+		(PKTPOOL_REGISTRY_CMP((id), PKTPOOLREG_FREE_PTR))
+
+/* Tag registry entry 0 as reserved */
+#define PKTPOOL_REGISTRY_RSV()			\
+		PKTPOOL_REGISTRY_SET(PKTPOOLREG_RSVD_ID, PKTPOOLREG_RSVD_PTR)
+#define PKTPOOL_REGISTRY_ISRSVD()		\
+		(PKTPOOL_REGISTRY_CMP(PKTPOOLREG_RSVD_ID, PKTPOOLREG_RSVD_PTR))
+
+/* Walk all un-reserved entries in registry */
+#define PKTPOOL_REGISTRY_FOREACH(id)	\
+		for ((id) = 1U; (id) <= pktpools_max; (id)++)
+
+uint32 pktpools_max = 0U; /* maximum number of pools that may be initialized */
+pktpool_t *pktpools_registry[PKTPOOL_MAXIMUM_ID + 1]; /* Pktpool registry */
+
+/* Register/Deregister a pktpool with registry during pktpool_init/deinit */
+static int pktpool_register(pktpool_t * poolptr);
+static int pktpool_deregister(pktpool_t * poolptr);
+
+/** accessor functions required when ROMming this file, forced into RAM */
+static void
+BCMRAMFN(pktpool_registry_set)(int id, pktpool_t *pp)
+{
+	pktpools_registry[id] = pp;
+}
+
+static bool
+BCMRAMFN(pktpool_registry_cmp)(int id, pktpool_t *pp)
+{
+	return pktpools_registry[id] == pp;
+}
+
+int /* Construct a pool registry to serve a maximum of total_pools */
+pktpool_attach(osl_t *osh, uint32 total_pools)
+{
+	uint32 poolid;
+
+	if (pktpools_max != 0U) {
+		return BCME_ERROR;
+	}
+
+	ASSERT(total_pools <= PKTPOOL_MAXIMUM_ID);
+
+	/* Initialize registry: reserve slot#0 and tag others as free */
+	PKTPOOL_REGISTRY_RSV();		/* reserve slot#0 */
+
+	PKTPOOL_REGISTRY_FOREACH(poolid) {	/* tag all unreserved entries as free */
+		PKTPOOL_REGISTRY_CLR(poolid);
+	}
+
+	pktpools_max = total_pools;
+
+	return (int)pktpools_max;
+}
+
+int /* Destruct the pool registry. Ascertain all pools were first de-inited */
+pktpool_dettach(osl_t *osh)
+{
+	uint32 poolid;
+
+	if (pktpools_max == 0U) {
+		return BCME_OK;
+	}
+
+	/* Ascertain that no pools are still registered */
+	ASSERT(PKTPOOL_REGISTRY_ISRSVD()); /* assert reserved slot */
+
+	PKTPOOL_REGISTRY_FOREACH(poolid) {	/* ascertain all others are free */
+		ASSERT(PKTPOOL_REGISTRY_ISCLR(poolid));
+	}
+
+	pktpools_max = 0U; /* restore boot state */
+
+	return BCME_OK;
+}
+
+static int	/* Register a pool in a free slot; return the registry slot index */
+pktpool_register(pktpool_t * poolptr)
+{
+	uint32 poolid;
+
+	if (pktpools_max == 0U) {
+		return PKTPOOL_INVALID_ID; /* registry has not yet been constructed */
+	}
+
+	ASSERT(pktpools_max != 0U);
+
+	/* find an empty slot in pktpools_registry */
+	PKTPOOL_REGISTRY_FOREACH(poolid) {
+		if (PKTPOOL_REGISTRY_ISCLR(poolid)) {
+			PKTPOOL_REGISTRY_SET(poolid, POOLPTR(poolptr)); /* register pool */
+			return (int)poolid; /* return pool ID */
+		}
+	} /* FOREACH */
+
+	return PKTPOOL_INVALID_ID;	/* error: registry is full */
+}
+
+static int	/* Deregister a pktpool, given the pool pointer; tag slot as free */
+pktpool_deregister(pktpool_t * poolptr)
+{
+	uint32 poolid;
+
+	ASSERT(POOLPTR(poolptr) != POOLPTR(NULL));
+
+	poolid = POOLID(poolptr);
+	ASSERT(poolid <= pktpools_max);
+
+	/* Asertain that a previously registered poolptr is being de-registered */
+	if (PKTPOOL_REGISTRY_CMP(poolid, POOLPTR(poolptr))) {
+		PKTPOOL_REGISTRY_CLR(poolid); /* mark as free */
+	} else {
+		ASSERT(0);
+		return BCME_ERROR; /* mismatch in registry */
+	}
+
+	return BCME_OK;
+}
+
+
+/*
+ * pktpool_init:
+ * User provides a pktpool_t sturcture and specifies the number of packets to
+ * be pre-filled into the pool (pplen). The size of all packets in a pool must
+ * be the same and is specified by plen.
+ * pktpool_init first attempts to register the pool and fetch a unique poolid.
+ * If registration fails, it is considered an BCME_ERR, caused by either the
+ * registry was not pre-created (pktpool_attach) or the registry is full.
+ * If registration succeeds, then the requested number of packets will be filled
+ * into the pool as part of initialization. In the event that there is no
+ * available memory to service the request, then BCME_NOMEM will be returned
+ * along with the count of how many packets were successfully allocated.
+ * In dongle builds, prior to memory reclaimation, one should limit the number
+ * of packets to be allocated during pktpool_init and fill the pool up after
+ * reclaim stage.
+ */
+int
+pktpool_init(osl_t *osh, pktpool_t *pktp, int *pplen, int plen, bool istx, uint8 type)
+{
+	int i, err = BCME_OK;
+	int pktplen;
+	uint8 pktp_id;
+
+	ASSERT(pktp != NULL);
+	ASSERT(osh != NULL);
+	ASSERT(pplen != NULL);
+
+	pktplen = *pplen;
+
+	bzero(pktp, sizeof(pktpool_t));
+
+	/* assign a unique pktpool id */
+	if ((pktp_id = (uint8) pktpool_register(pktp)) == PKTPOOL_INVALID_ID) {
+		return BCME_ERROR;
+	}
+	POOLSETID(pktp, pktp_id);
+
+	pktp->inited = TRUE;
+	pktp->istx = istx ? TRUE : FALSE;
+	pktp->plen = (uint16)plen;
+	pktp->type = type;
+
+	pktp->maxlen = PKTPOOL_LEN_MAX;
+	pktplen = LIMIT_TO_MAX(pktplen, pktp->maxlen);
+
+	for (i = 0; i < pktplen; i++) {
+		void *p;
+		p = PKTGET(osh, plen, TRUE);
+
+		if (p == NULL) {
+			/* Not able to allocate all requested pkts
+			 * so just return what was actually allocated
+			 * We can add to the pool later
+			 */
+			if (pktp->freelist == NULL) /* pktpool free list is empty */
+				err = BCME_NOMEM;
+
+			goto exit;
+		}
+
+		PKTSETPOOL(osh, p, TRUE, pktp); /* Tag packet with pool ID */
+
+		PKTSETFREELIST(p, pktp->freelist); /* insert p at head of free list */
+		pktp->freelist = p;
+
+		pktp->avail++;
+
+#ifdef BCMDBG_POOL
+		pktp->dbg_q[pktp->dbg_qlen++].p = p;
+#endif
+	}
+
+exit:
+	pktp->len = pktp->avail;
+
+	*pplen = pktp->len;
+	return err;
+}
+
+/*
+ * pktpool_deinit:
+ * Prior to freeing a pktpool, all packets must be first freed into the pktpool.
+ * Upon pktpool_deinit, all packets in the free pool will be freed to the heap.
+ * An assert is in place to ensure that there are no packets still lingering
+ * around. Packets freed to a pool after the deinit will cause a memory
+ * corruption as the pktpool_t structure no longer exists.
+ */
+int
+pktpool_deinit(osl_t *osh, pktpool_t *pktp)
+{
+	uint16 freed = 0;
+
+	ASSERT(osh != NULL);
+	ASSERT(pktp != NULL);
+
+#ifdef BCMDBG_POOL
+	{
+		int i;
+		for (i = 0; i <= pktp->len; i++) {
+			pktp->dbg_q[i].p = NULL;
+		}
+	}
+#endif
+
+	while (pktp->freelist != NULL) {
+		void * p = pktp->freelist;
+
+		pktp->freelist = PKTFREELIST(p); /* unlink head packet from free list */
+		PKTSETFREELIST(p, NULL);
+
+		PKTSETPOOL(osh, p, FALSE, NULL); /* clear pool ID tag in pkt */
+
+		PKTFREE(osh, p, pktp->istx); /* free the packet */
+
+		freed++;
+		ASSERT(freed <= pktp->len);
+	}
+
+	pktp->avail -= freed;
+	ASSERT(pktp->avail == 0);
+
+	pktp->len -= freed;
+
+	pktpool_deregister(pktp); /* release previously acquired unique pool id */
+	POOLSETID(pktp, PKTPOOL_INVALID_ID);
+
+	pktp->inited = FALSE;
+
+	/* Are there still pending pkts? */
+	ASSERT(pktp->len == 0);
+
+	return 0;
+}
+
+int
+pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal)
+{
+	void *p;
+	int err = 0;
+	int len, psize, maxlen;
+
+	ASSERT(pktp->plen != 0);
+
+	maxlen = pktp->maxlen;
+	psize = minimal ? (maxlen >> 2) : maxlen;
+	for (len = (int)pktp->len; len < psize; len++) {
+
+		p = PKTGET(osh, pktp->len, TRUE);
+
+		if (p == NULL) {
+			err = BCME_NOMEM;
+			break;
+		}
+
+		if (pktpool_add(pktp, p) != BCME_OK) {
+			PKTFREE(osh, p, FALSE);
+			err = BCME_ERROR;
+			break;
+		}
+	}
+
+	return err;
+}
+
+static void *
+pktpool_deq(pktpool_t *pktp)
+{
+	void *p;
+
+	if (pktp->avail == 0)
+		return NULL;
+
+	ASSERT(pktp->freelist != NULL);
+
+	p = pktp->freelist;  /* dequeue packet from head of pktpool free list */
+	pktp->freelist = PKTFREELIST(p); /* free list points to next packet */
+	PKTSETFREELIST(p, NULL);
+
+	pktp->avail--;
+
+	return p;
+}
+
+static void
+pktpool_enq(pktpool_t *pktp, void *p)
+{
+	ASSERT(p != NULL);
+
+	PKTSETFREELIST(p, pktp->freelist); /* insert at head of pktpool free list */
+	pktp->freelist = p; /* free list points to newly inserted packet */
+
+	pktp->avail++;
+	ASSERT(pktp->avail <= pktp->len);
+}
+
+/* utility for registering host addr fill function called from pciedev */
+int
+/* BCMATTACHFN */
+(pktpool_hostaddr_fill_register)(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg)
+{
+
+	ASSERT(cb != NULL);
+
+	ASSERT(pktp->cbext.cb == NULL);
+	pktp->cbext.cb = cb;
+	pktp->cbext.arg = arg;
+	return 0;
+}
+
+int
+pktpool_rxcplid_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg)
+{
+
+	ASSERT(cb != NULL);
+
+	ASSERT(pktp->rxcplidfn.cb == NULL);
+	pktp->rxcplidfn.cb = cb;
+	pktp->rxcplidfn.arg = arg;
+	return 0;
+}
+/* Callback functions for split rx modes */
+/* when evr host posts rxbuffer, invike dma_rxfill from pciedev layer */
+void
+pktpool_invoke_dmarxfill(pktpool_t *pktp)
+{
+	ASSERT(pktp->dmarxfill.cb);
+	ASSERT(pktp->dmarxfill.arg);
+
+	if (pktp->dmarxfill.cb)
+		pktp->dmarxfill.cb(pktp, pktp->dmarxfill.arg);
+}
+int
+pkpool_haddr_avail_register_cb(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+
+	ASSERT(cb != NULL);
+
+	pktp->dmarxfill.cb = cb;
+	pktp->dmarxfill.arg = arg;
+
+	return 0;
+}
+/* No BCMATTACHFN as it is used in xdc_enable_ep which is not an attach function */
+int
+pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+	int i;
+
+	ASSERT(cb != NULL);
+
+	i = pktp->cbcnt;
+	if (i == PKTPOOL_CB_MAX)
+		return BCME_ERROR;
+
+	ASSERT(pktp->cbs[i].cb == NULL);
+	pktp->cbs[i].cb = cb;
+	pktp->cbs[i].arg = arg;
+	pktp->cbcnt++;
+
+	return 0;
+}
+
+int
+pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+	int i;
+
+	ASSERT(cb != NULL);
+
+	i = pktp->ecbcnt;
+	if (i == PKTPOOL_CB_MAX)
+		return BCME_ERROR;
+
+	ASSERT(pktp->ecbs[i].cb == NULL);
+	pktp->ecbs[i].cb = cb;
+	pktp->ecbs[i].arg = arg;
+	pktp->ecbcnt++;
+
+	return 0;
+}
+
+static int
+pktpool_empty_notify(pktpool_t *pktp)
+{
+	int i;
+
+	pktp->empty = TRUE;
+	for (i = 0; i < pktp->ecbcnt; i++) {
+		ASSERT(pktp->ecbs[i].cb != NULL);
+		pktp->ecbs[i].cb(pktp, pktp->ecbs[i].arg);
+	}
+	pktp->empty = FALSE;
+
+	return 0;
+}
+
+#ifdef BCMDBG_POOL
+int
+pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg)
+{
+	int i;
+
+	ASSERT(cb);
+
+	i = pktp->dbg_cbcnt;
+	if (i == PKTPOOL_CB_MAX)
+		return BCME_ERROR;
+
+	ASSERT(pktp->dbg_cbs[i].cb == NULL);
+	pktp->dbg_cbs[i].cb = cb;
+	pktp->dbg_cbs[i].arg = arg;
+	pktp->dbg_cbcnt++;
+
+	return 0;
+}
+
+int pktpool_dbg_notify(pktpool_t *pktp);
+
+int
+pktpool_dbg_notify(pktpool_t *pktp)
+{
+	int i;
+
+	for (i = 0; i < pktp->dbg_cbcnt; i++) {
+		ASSERT(pktp->dbg_cbs[i].cb);
+		pktp->dbg_cbs[i].cb(pktp, pktp->dbg_cbs[i].arg);
+	}
+
+	return 0;
+}
+
+int
+pktpool_dbg_dump(pktpool_t *pktp)
+{
+	int i;
+
+	printf("pool len=%d maxlen=%d\n",  pktp->dbg_qlen, pktp->maxlen);
+	for (i = 0; i < pktp->dbg_qlen; i++) {
+		ASSERT(pktp->dbg_q[i].p);
+		printf("%d, p: 0x%x dur:%lu us state:%d\n", i,
+			pktp->dbg_q[i].p, pktp->dbg_q[i].dur/100, PKTPOOLSTATE(pktp->dbg_q[i].p));
+	}
+
+	return 0;
+}
+
+int
+pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats)
+{
+	int i;
+	int state;
+
+	bzero(stats, sizeof(pktpool_stats_t));
+	for (i = 0; i < pktp->dbg_qlen; i++) {
+		ASSERT(pktp->dbg_q[i].p != NULL);
+
+		state = PKTPOOLSTATE(pktp->dbg_q[i].p);
+		switch (state) {
+			case POOL_TXENQ:
+				stats->enq++; break;
+			case POOL_TXDH:
+				stats->txdh++; break;
+			case POOL_TXD11:
+				stats->txd11++; break;
+			case POOL_RXDH:
+				stats->rxdh++; break;
+			case POOL_RXD11:
+				stats->rxd11++; break;
+			case POOL_RXFILL:
+				stats->rxfill++; break;
+			case POOL_IDLE:
+				stats->idle++; break;
+		}
+	}
+
+	return 0;
+}
+
+int
+pktpool_start_trigger(pktpool_t *pktp, void *p)
+{
+	uint32 cycles, i;
+
+	if (!PKTPOOL(OSH_NULL, p))
+		return 0;
+
+	OSL_GETCYCLES(cycles);
+
+	for (i = 0; i < pktp->dbg_qlen; i++) {
+		ASSERT(pktp->dbg_q[i].p != NULL);
+
+		if (pktp->dbg_q[i].p == p) {
+			pktp->dbg_q[i].cycles = cycles;
+			break;
+		}
+	}
+
+	return 0;
+}
+
+int pktpool_stop_trigger(pktpool_t *pktp, void *p);
+int
+pktpool_stop_trigger(pktpool_t *pktp, void *p)
+{
+	uint32 cycles, i;
+
+	if (!PKTPOOL(OSH_NULL, p))
+		return 0;
+
+	OSL_GETCYCLES(cycles);
+
+	for (i = 0; i < pktp->dbg_qlen; i++) {
+		ASSERT(pktp->dbg_q[i].p != NULL);
+
+		if (pktp->dbg_q[i].p == p) {
+			if (pktp->dbg_q[i].cycles == 0)
+				break;
+
+			if (cycles >= pktp->dbg_q[i].cycles)
+				pktp->dbg_q[i].dur = cycles - pktp->dbg_q[i].cycles;
+			else
+				pktp->dbg_q[i].dur =
+					(((uint32)-1) - pktp->dbg_q[i].cycles) + cycles + 1;
+
+			pktp->dbg_q[i].cycles = 0;
+			break;
+		}
+	}
+
+	return 0;
+}
+#endif /* BCMDBG_POOL */
+
+int
+pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp)
+{
+	ASSERT(pktp);
+	pktp->availcb_excl = NULL;
+	return 0;
+}
+
+int
+pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb)
+{
+	int i;
+
+	ASSERT(pktp);
+	ASSERT(pktp->availcb_excl == NULL);
+	for (i = 0; i < pktp->cbcnt; i++) {
+		if (cb == pktp->cbs[i].cb) {
+			pktp->availcb_excl = &pktp->cbs[i];
+			break;
+		}
+	}
+
+	if (pktp->availcb_excl == NULL)
+		return BCME_ERROR;
+	else
+		return 0;
+}
+
+static int
+pktpool_avail_notify(pktpool_t *pktp)
+{
+	int i, k, idx;
+	int avail;
+
+	ASSERT(pktp);
+	if (pktp->availcb_excl != NULL) {
+		pktp->availcb_excl->cb(pktp, pktp->availcb_excl->arg);
+		return 0;
+	}
+
+	k = pktp->cbcnt - 1;
+	for (i = 0; i < pktp->cbcnt; i++) {
+		avail = pktp->avail;
+
+		if (avail) {
+			if (pktp->cbtoggle)
+				idx = i;
+			else
+				idx = k--;
+
+			ASSERT(pktp->cbs[idx].cb != NULL);
+			pktp->cbs[idx].cb(pktp, pktp->cbs[idx].arg);
+		}
+	}
+
+	/* Alternate between filling from head or tail
+	 */
+	pktp->cbtoggle ^= 1;
+
+	return 0;
+}
+
+void *
+pktpool_get(pktpool_t *pktp)
+{
+	void *p;
+
+	p = pktpool_deq(pktp);
+
+	if (p == NULL) {
+		/* Notify and try to reclaim tx pkts */
+		if (pktp->ecbcnt)
+			pktpool_empty_notify(pktp);
+
+		p = pktpool_deq(pktp);
+		if (p == NULL)
+			return NULL;
+	}
+
+	return p;
+}
+
+void
+pktpool_free(pktpool_t *pktp, void *p)
+{
+	ASSERT(p != NULL);
+#ifdef BCMDBG_POOL
+	/* pktpool_stop_trigger(pktp, p); */
+#endif
+
+	pktpool_enq(pktp, p);
+
+	if (pktp->emptycb_disable)
+		return;
+
+	if (pktp->cbcnt) {
+		if (pktp->empty == FALSE)
+			pktpool_avail_notify(pktp);
+	}
+}
+
+int
+pktpool_add(pktpool_t *pktp, void *p)
+{
+	ASSERT(p != NULL);
+
+	if (pktp->len == pktp->maxlen)
+		return BCME_RANGE;
+
+	/* pkts in pool have same length */
+	ASSERT(pktp->plen == PKTLEN(OSH_NULL, p));
+	PKTSETPOOL(OSH_NULL, p, TRUE, pktp);
+
+	pktp->len++;
+	pktpool_enq(pktp, p);
+
+#ifdef BCMDBG_POOL
+	pktp->dbg_q[pktp->dbg_qlen++].p = p;
+#endif
+
+	return 0;
+}
+
+/* Force pktpool_setmaxlen () into RAM as it uses a constant
+ * (PKTPOOL_LEN_MAX) that may be changed post tapeout for ROM-based chips.
+ */
+int
+BCMRAMFN(pktpool_setmaxlen)(pktpool_t *pktp, uint16 maxlen)
+{
+	if (maxlen > PKTPOOL_LEN_MAX)
+		maxlen = PKTPOOL_LEN_MAX;
+
+	/* if pool is already beyond maxlen, then just cap it
+	 * since we currently do not reduce the pool len
+	 * already allocated
+	 */
+	pktp->maxlen = (pktp->len > maxlen) ? pktp->len : maxlen;
+
+	return pktp->maxlen;
+}
+
+void
+pktpool_emptycb_disable(pktpool_t *pktp, bool disable)
+{
+	ASSERT(pktp);
+
+	pktp->emptycb_disable = disable;
+}
+
+bool
+pktpool_emptycb_disabled(pktpool_t *pktp)
+{
+	ASSERT(pktp);
+	return pktp->emptycb_disable;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/hnd_pktq.c b/drivers/net/wireless/bcm4336/hnd_pktq.c
--- a/drivers/net/wireless/bcm4336/hnd_pktq.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/hnd_pktq.c	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,586 @@
+/*
+ * HND generic pktq operation primitives
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: $
+ */
+
+#include <typedefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <hnd_pktq.h>
+
+/*
+ * osl multiple-precedence packet queue
+ * hi_prec is always >= the number of the highest non-empty precedence
+ */
+void * BCMFASTPATH
+pktq_penq(struct pktq *pq, int prec, void *p)
+{
+	struct pktq_prec *q;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+	/* queueing chains not allowed */
+	ASSERT(!((PKTLINK(p) != NULL) && (PKTLINK(p) != p)));
+	ASSERT(!pktq_full(pq));
+	ASSERT(!pktq_pfull(pq, prec));
+	PKTSETLINK(p, NULL);
+
+	q = &pq->q[prec];
+
+	if (q->head)
+		PKTSETLINK(q->tail, p);
+	else
+		q->head = p;
+
+	q->tail = p;
+	q->len++;
+
+	pq->len++;
+
+	if (pq->hi_prec < prec)
+		pq->hi_prec = (uint8)prec;
+
+	return p;
+}
+
+void * BCMFASTPATH
+pktq_penq_head(struct pktq *pq, int prec, void *p)
+{
+	struct pktq_prec *q;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+	/* queueing chains not allowed */
+	ASSERT(!((PKTLINK(p) != NULL) && (PKTLINK(p) != p)));
+	ASSERT(!pktq_full(pq));
+	ASSERT(!pktq_pfull(pq, prec));
+	PKTSETLINK(p, NULL);
+
+	q = &pq->q[prec];
+
+	if (q->head == NULL)
+		q->tail = p;
+
+	PKTSETLINK(p, q->head);
+	q->head = p;
+	q->len++;
+
+	pq->len++;
+
+	if (pq->hi_prec < prec)
+		pq->hi_prec = (uint8)prec;
+
+	return p;
+}
+
+/*
+ * Append spktq 'list' to the tail of pktq 'pq'
+ */
+void BCMFASTPATH
+pktq_append(struct pktq *pq, int prec, struct spktq *list)
+{
+	struct pktq_prec *q;
+	struct pktq_prec *list_q;
+
+	list_q = &list->q[0];
+
+	/* empty list check */
+	if (list_q->head == NULL)
+		return;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+	ASSERT(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+	ASSERT(!pktq_full(pq));
+	ASSERT(!pktq_pfull(pq, prec));
+
+	q = &pq->q[prec];
+
+	if (q->head)
+		PKTSETLINK(q->tail, list_q->head);
+	else
+		q->head = list_q->head;
+
+	q->tail = list_q->tail;
+	q->len += list_q->len;
+	pq->len += list_q->len;
+
+	if (pq->hi_prec < prec)
+		pq->hi_prec = (uint8)prec;
+
+	list_q->head = NULL;
+	list_q->tail = NULL;
+	list_q->len = 0;
+	list->len = 0;
+}
+
+/*
+ * Prepend spktq 'list' to the head of pktq 'pq'
+ */
+void BCMFASTPATH
+pktq_prepend(struct pktq *pq, int prec, struct spktq *list)
+{
+	struct pktq_prec *q;
+	struct pktq_prec *list_q;
+
+	list_q = &list->q[0];
+
+	/* empty list check */
+	if (list_q->head == NULL)
+		return;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+	ASSERT(PKTLINK(list_q->tail) == NULL);         /* terminated list */
+
+	ASSERT(!pktq_full(pq));
+	ASSERT(!pktq_pfull(pq, prec));
+
+	q = &pq->q[prec];
+
+	/* set the tail packet of list to point at the former pq head */
+	PKTSETLINK(list_q->tail, q->head);
+	/* the new q head is the head of list */
+	q->head = list_q->head;
+
+	/* If the q tail was non-null, then it stays as is.
+	 * If the q tail was null, it is now the tail of list
+	 */
+	if (q->tail == NULL) {
+		q->tail = list_q->tail;
+	}
+
+	q->len += list_q->len;
+	pq->len += list_q->len;
+
+	if (pq->hi_prec < prec)
+		pq->hi_prec = (uint8)prec;
+
+	list_q->head = NULL;
+	list_q->tail = NULL;
+	list_q->len = 0;
+	list->len = 0;
+}
+
+void * BCMFASTPATH
+pktq_pdeq(struct pktq *pq, int prec)
+{
+	struct pktq_prec *q;
+	void *p;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	if ((q->head = PKTLINK(p)) == NULL)
+		q->tail = NULL;
+
+	q->len--;
+
+	pq->len--;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p)
+{
+	struct pktq_prec *q;
+	void *p;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+
+	if (prev_p == NULL)
+		return NULL;
+
+	if ((p = PKTLINK(prev_p)) == NULL)
+		return NULL;
+
+	q->len--;
+
+	pq->len--;
+
+	PKTSETLINK(prev_p, PKTLINK(p));
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg)
+{
+	struct pktq_prec *q;
+	void *p, *prev = NULL;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+	p = q->head;
+
+	while (p) {
+		if (fn == NULL || (*fn)(p, arg)) {
+			break;
+		} else {
+			prev = p;
+			p = PKTLINK(p);
+		}
+	}
+	if (p == NULL)
+		return NULL;
+
+	if (prev == NULL) {
+		if ((q->head = PKTLINK(p)) == NULL) {
+			q->tail = NULL;
+		}
+	} else {
+		PKTSETLINK(prev, PKTLINK(p));
+		if (q->tail == p) {
+			q->tail = prev;
+		}
+	}
+
+	q->len--;
+
+	pq->len--;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void * BCMFASTPATH
+pktq_pdeq_tail(struct pktq *pq, int prec)
+{
+	struct pktq_prec *q;
+	void *p, *prev;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	for (prev = NULL; p != q->tail; p = PKTLINK(p))
+		prev = p;
+
+	if (prev)
+		PKTSETLINK(prev, NULL);
+	else
+		q->head = NULL;
+
+	q->tail = prev;
+	q->len--;
+
+	pq->len--;
+
+	return p;
+}
+
+void
+pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir, ifpkt_cb_t fn, int arg)
+{
+	struct pktq_prec *q;
+	void *p, *prev = NULL;
+
+	q = &pq->q[prec];
+	p = q->head;
+	while (p) {
+		if (fn == NULL || (*fn)(p, arg)) {
+			bool head = (p == q->head);
+			if (head)
+				q->head = PKTLINK(p);
+			else
+				PKTSETLINK(prev, PKTLINK(p));
+			PKTSETLINK(p, NULL);
+			PKTFREE(osh, p, dir);
+			q->len--;
+			pq->len--;
+			p = (head ? q->head : PKTLINK(prev));
+		} else {
+			prev = p;
+			p = PKTLINK(p);
+		}
+	}
+
+	if (q->head == NULL) {
+		ASSERT(q->len == 0);
+		q->tail = NULL;
+	}
+}
+
+bool BCMFASTPATH
+pktq_pdel(struct pktq *pq, void *pktbuf, int prec)
+{
+	struct pktq_prec *q;
+	void *p;
+
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	/* Should this just assert pktbuf? */
+	if (!pktbuf)
+		return FALSE;
+
+	q = &pq->q[prec];
+
+	if (q->head == pktbuf) {
+		if ((q->head = PKTLINK(pktbuf)) == NULL)
+			q->tail = NULL;
+	} else {
+		for (p = q->head; p && PKTLINK(p) != pktbuf; p = PKTLINK(p))
+			;
+		if (p == NULL)
+			return FALSE;
+
+		PKTSETLINK(p, PKTLINK(pktbuf));
+		if (q->tail == pktbuf)
+			q->tail = p;
+	}
+
+	q->len--;
+	pq->len--;
+	PKTSETLINK(pktbuf, NULL);
+	return TRUE;
+}
+
+void
+pktq_init(struct pktq *pq, int num_prec, int max_len)
+{
+	int prec;
+
+	ASSERT(num_prec > 0 && num_prec <= PKTQ_MAX_PREC);
+
+	/* pq is variable size; only zero out what's requested */
+	bzero(pq, OFFSETOF(struct pktq, q) + (sizeof(struct pktq_prec) * num_prec));
+
+	pq->num_prec = (uint16)num_prec;
+
+	pq->max = (uint16)max_len;
+
+	for (prec = 0; prec < num_prec; prec++)
+		pq->q[prec].max = pq->max;
+}
+
+void
+pktq_set_max_plen(struct pktq *pq, int prec, int max_len)
+{
+	ASSERT(prec >= 0 && prec < pq->num_prec);
+
+	if (prec < pq->num_prec)
+		pq->q[prec].max = (uint16)max_len;
+}
+
+void * BCMFASTPATH
+pktq_deq(struct pktq *pq, int *prec_out)
+{
+	struct pktq_prec *q;
+	void *p;
+	int prec;
+
+	if (pq->len == 0)
+		return NULL;
+
+	while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+		pq->hi_prec--;
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	if ((q->head = PKTLINK(p)) == NULL)
+		q->tail = NULL;
+
+	q->len--;
+
+	pq->len--;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void * BCMFASTPATH
+pktq_deq_tail(struct pktq *pq, int *prec_out)
+{
+	struct pktq_prec *q;
+	void *p, *prev;
+	int prec;
+
+	if (pq->len == 0)
+		return NULL;
+
+	for (prec = 0; prec < pq->hi_prec; prec++)
+		if (pq->q[prec].head)
+			break;
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	for (prev = NULL; p != q->tail; p = PKTLINK(p))
+		prev = p;
+
+	if (prev)
+		PKTSETLINK(prev, NULL);
+	else
+		q->head = NULL;
+
+	q->tail = prev;
+	q->len--;
+
+	pq->len--;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
+
+void *
+pktq_peek(struct pktq *pq, int *prec_out)
+{
+	int prec;
+
+	if (pq->len == 0)
+		return NULL;
+
+	while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+		pq->hi_prec--;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	return (pq->q[prec].head);
+}
+
+void *
+pktq_peek_tail(struct pktq *pq, int *prec_out)
+{
+	int prec;
+
+	if (pq->len == 0)
+		return NULL;
+
+	for (prec = 0; prec < pq->hi_prec; prec++)
+		if (pq->q[prec].head)
+			break;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	return (pq->q[prec].tail);
+}
+
+void
+pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg)
+{
+	int prec;
+
+	/* Optimize flush, if pktq len = 0, just return.
+	 * pktq len of 0 means pktq's prec q's are all empty.
+	 */
+	if (pq->len == 0) {
+		return;
+	}
+
+	for (prec = 0; prec < pq->num_prec; prec++)
+		pktq_pflush(osh, pq, prec, dir, fn, arg);
+	if (fn == NULL)
+		ASSERT(pq->len == 0);
+}
+
+/* Return sum of lengths of a specific set of precedences */
+int
+pktq_mlen(struct pktq *pq, uint prec_bmp)
+{
+	int prec, len;
+
+	len = 0;
+
+	for (prec = 0; prec <= pq->hi_prec; prec++)
+		if (prec_bmp & (1 << prec))
+			len += pq->q[prec].len;
+
+	return len;
+}
+
+/* Priority peek from a specific set of precedences */
+void * BCMFASTPATH
+pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+	struct pktq_prec *q;
+	void *p;
+	int prec;
+
+	if (pq->len == 0)
+	{
+		return NULL;
+	}
+	while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+		pq->hi_prec--;
+
+	while ((prec_bmp & (1 << prec)) == 0 || pq->q[prec].head == NULL)
+		if (prec-- == 0)
+			return NULL;
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	return p;
+}
+/* Priority dequeue from a specific set of precedences */
+void * BCMFASTPATH
+pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out)
+{
+	struct pktq_prec *q;
+	void *p;
+	int prec;
+
+	if (pq->len == 0)
+		return NULL;
+
+	while ((prec = pq->hi_prec) > 0 && pq->q[prec].head == NULL)
+		pq->hi_prec--;
+
+	while ((pq->q[prec].head == NULL) || ((prec_bmp & (1 << prec)) == 0))
+		if (prec-- == 0)
+			return NULL;
+
+	q = &pq->q[prec];
+
+	if ((p = q->head) == NULL)
+		return NULL;
+
+	if ((q->head = PKTLINK(p)) == NULL)
+		q->tail = NULL;
+
+	q->len--;
+
+	if (prec_out)
+		*prec_out = prec;
+
+	pq->len--;
+
+	PKTSETLINK(p, NULL);
+
+	return p;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/hndpmu.c b/drivers/net/wireless/bcm4336/hndpmu.c
--- a/drivers/net/wireless/bcm4336/hndpmu.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/hndpmu.c	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,291 @@
+/*
+ * Misc utility routines for accessing PMU corerev specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: hndpmu.c 475037 2014-05-02 23:55:49Z $
+ */
+
+
+/*
+ * Note: this file contains PLL/FLL related functions. A chip can contain multiple PLLs/FLLs.
+ * However, in the context of this file the baseband ('BB') PLL/FLL is referred to.
+ *
+ * Throughout this code, the prefixes 'pmu0_', 'pmu1_' and 'pmu2_' are used.
+ * They refer to different revisions of the PMU (which is at revision 18 @ Apr 25, 2012)
+ * pmu1_ marks the transition from PLL to ADFLL (Digital Frequency Locked Loop). It supports
+ * fractional frequency generation. pmu2_ does not support fractional frequency generation.
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <hndpmu.h>
+
+#define	PMU_ERROR(args)
+
+#define	PMU_MSG(args)
+
+/* To check in verbose debugging messages not intended
+ * to be on except on private builds.
+ */
+#define	PMU_NONE(args)
+
+/** contains resource bit positions for a specific chip */
+struct rsc_per_chip_s {
+	uint8 ht_avail;
+	uint8 macphy_clkavail;
+	uint8 ht_start;
+	uint8 otp_pu;
+};
+
+typedef struct rsc_per_chip_s rsc_per_chip_t;
+
+
+/* SDIO Pad drive strength to select value mappings.
+ * The last strength value in each table must be 0 (the tri-state value).
+ */
+typedef struct {
+	uint8 strength;			/* Pad Drive Strength in mA */
+	uint8 sel;			/* Chip-specific select value */
+} sdiod_drive_str_t;
+
+/* SDIO Drive Strength to sel value table for PMU Rev 1 */
+static const sdiod_drive_str_t sdiod_drive_strength_tab1[] = {
+	{4, 0x2},
+	{2, 0x3},
+	{1, 0x0},
+	{0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 2, 3 */
+static const sdiod_drive_str_t sdiod_drive_strength_tab2[] = {
+	{12, 0x7},
+	{10, 0x6},
+	{8, 0x5},
+	{6, 0x4},
+	{4, 0x2},
+	{2, 0x1},
+	{0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 8 (1.8V) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab3[] = {
+	{32, 0x7},
+	{26, 0x6},
+	{22, 0x5},
+	{16, 0x4},
+	{12, 0x3},
+	{8, 0x2},
+	{4, 0x1},
+	{0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab4_1v8[] = {
+	{32, 0x6},
+	{26, 0x7},
+	{22, 0x4},
+	{16, 0x5},
+	{12, 0x2},
+	{8, 0x3},
+	{4, 0x0},
+	{0, 0x1} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (1.2v) */
+
+/* SDIO Drive Strength to sel value table for PMU Rev 11 (2.5v) */
+
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab5_1v8[] = {
+	{6, 0x7},
+	{5, 0x6},
+	{4, 0x5},
+	{3, 0x4},
+	{2, 0x2},
+	{1, 0x1},
+	{0, 0x0} };
+
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (3.3v) */
+
+/** SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
+static const sdiod_drive_str_t sdiod_drive_strength_tab6_1v8[] = {
+	{3, 0x3},
+	{2, 0x2},
+	{1, 0x1},
+	{0, 0x0} };
+
+
+/**
+ * SDIO Drive Strength to sel value table for 43143 PMU Rev 17, see Confluence 43143 Toplevel
+ * architecture page, section 'PMU Chip Control 1 Register definition', click link to picture
+ * BCM43143_sel_sdio_signals.jpg. Valid after PMU Chip Control 0 Register, bit31 (override) has
+ * been written '1'.
+ */
+#if !defined(BCM_SDIO_VDDIO) || BCM_SDIO_VDDIO == 33
+
+static const sdiod_drive_str_t sdiod_drive_strength_tab7_3v3[] = {
+	/* note: for 14, 10, 6 and 2mA hw timing is not met according to rtl team */
+	{16, 0x7},
+	{12, 0x5},
+	{8,  0x3},
+	{4,  0x1} }; /* note: 43143 does not support tristate */
+
+#else
+
+static const sdiod_drive_str_t sdiod_drive_strength_tab7_1v8[] = {
+	/* note: for 7, 5, 3 and 1mA hw timing is not met according to rtl team */
+	{8, 0x7},
+	{6, 0x5},
+	{4,  0x3},
+	{2,  0x1} }; /* note: 43143 does not support tristate */
+
+#endif /* BCM_SDIO_VDDIO */
+
+#define SDIOD_DRVSTR_KEY(chip, pmu)	(((chip) << 16) | (pmu))
+
+/**
+ * Balance between stable SDIO operation and power consumption is achieved using this function.
+ * Note that each drive strength table is for a specific VDDIO of the SDIO pads, ideally this
+ * function should read the VDDIO itself to select the correct table. For now it has been solved
+ * with the 'BCM_SDIO_VDDIO' preprocessor constant.
+ *
+ * 'drivestrength': desired pad drive strength in mA. Drive strength of 0 requests tri-state (if
+ *		    hardware supports this), if no hw support drive strength is not programmed.
+ */
+void
+si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength)
+{
+	chipcregs_t *cc = NULL;
+	uint origidx, intr_val = 0;
+	sdiod_drive_str_t *str_tab = NULL;
+	uint32 str_mask = 0;	/* only alter desired bits in PMU chipcontrol 1 register */
+	uint32 str_shift = 0;
+	uint32 str_ovr_pmuctl = PMU_CHIPCTL0; /* PMU chipcontrol register containing override bit */
+	uint32 str_ovr_pmuval = 0;            /* position of bit within this register */
+
+	if (!(sih->cccaps & CC_CAP_PMU)) {
+		return;
+	}
+
+	/* Remember original core before switch to chipc */
+	if (CHIPID(sih->chip) == BCM43362_CHIP_ID)
+		cc = (chipcregs_t *) si_switch_core(sih, CC_CORE_ID, &origidx, &intr_val);
+
+	switch (SDIOD_DRVSTR_KEY(sih->chip, sih->pmurev)) {
+	case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 1):
+		str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab1;
+		str_mask = 0x30000000;
+		str_shift = 28;
+		break;
+	case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 2):
+	case SDIOD_DRVSTR_KEY(BCM4325_CHIP_ID, 3):
+	case SDIOD_DRVSTR_KEY(BCM4315_CHIP_ID, 4):
+		str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab2;
+		str_mask = 0x00003800;
+		str_shift = 11;
+		break;
+	case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 8):
+	case SDIOD_DRVSTR_KEY(BCM4336_CHIP_ID, 11):
+		if (sih->pmurev == 8) {
+			str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab3;
+		}
+		else if (sih->pmurev == 11) {
+			str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab4_1v8;
+		}
+		str_mask = 0x00003800;
+		str_shift = 11;
+		break;
+	case SDIOD_DRVSTR_KEY(BCM4330_CHIP_ID, 12):
+		str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab4_1v8;
+		str_mask = 0x00003800;
+		str_shift = 11;
+		break;
+	case SDIOD_DRVSTR_KEY(BCM43362_CHIP_ID, 13):
+		str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab5_1v8;
+		str_mask = 0x00003800;
+		str_shift = 11;
+		break;
+	case SDIOD_DRVSTR_KEY(BCM4334_CHIP_ID, 17):
+		str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab6_1v8;
+		str_mask = 0x00001800;
+		str_shift = 11;
+		break;
+	case SDIOD_DRVSTR_KEY(BCM43143_CHIP_ID, 17):
+#if !defined(BCM_SDIO_VDDIO) || BCM_SDIO_VDDIO == 33
+		if (drivestrength >=  ARRAYLAST(sdiod_drive_strength_tab7_3v3)->strength) {
+			str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab7_3v3;
+		}
+#else
+		if (drivestrength >=  ARRAYLAST(sdiod_drive_strength_tab7_1v8)->strength) {
+			str_tab = (sdiod_drive_str_t *)&sdiod_drive_strength_tab7_1v8;
+		}
+#endif /* BCM_SDIO_VDDIO */
+		str_mask = 0x00000007;
+		str_ovr_pmuval = PMU43143_CC0_SDIO_DRSTR_OVR;
+		break;
+	default:
+		PMU_MSG(("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
+		         bcm_chipname(sih->chip, chn, 8), sih->chiprev, sih->pmurev));
+		break;
+	}
+
+	if (CHIPID(sih->chip) == BCM43362_CHIP_ID) {
+		if (str_tab != NULL && cc != NULL) {
+			uint32 cc_data_temp;
+			int i;
+
+			/* Pick the lowest available drive strength equal or greater than the
+			 * requested strength.	Drive strength of 0 requests tri-state.
+			 */
+			for (i = 0; drivestrength < str_tab[i].strength; i++)
+				;
+
+			if (i > 0 && drivestrength > str_tab[i].strength)
+				i--;
+
+			W_REG(osh, &cc->chipcontrol_addr, PMU_CHIPCTL1);
+			cc_data_temp = R_REG(osh, &cc->chipcontrol_data);
+			cc_data_temp &= ~str_mask;
+			cc_data_temp |= str_tab[i].sel << str_shift;
+			W_REG(osh, &cc->chipcontrol_data, cc_data_temp);
+			if (str_ovr_pmuval) { /* enables the selected drive strength */
+				W_REG(osh,  &cc->chipcontrol_addr, str_ovr_pmuctl);
+				OR_REG(osh, &cc->chipcontrol_data, str_ovr_pmuval);
+			}
+			PMU_MSG(("SDIO: %dmA drive strength requested; set to %dmA\n",
+			         drivestrength, str_tab[i].strength));
+		}
+		/* Return to original core */
+		si_restore_core(sih, origidx, intr_val);
+	}
+	else if (str_tab != NULL) {
+		uint32 cc_data_temp;
+		int i;
+
+		/* Pick the lowest available drive strength equal or greater than the
+		 * requested strength.	Drive strength of 0 requests tri-state.
+		 */
+		for (i = 0; drivestrength < str_tab[i].strength; i++)
+			;
+
+		if (i > 0 && drivestrength > str_tab[i].strength)
+			i--;
+
+		W_REG(osh, PMUREG(sih, chipcontrol_addr), PMU_CHIPCTL1);
+		cc_data_temp = R_REG(osh, PMUREG(sih, chipcontrol_data));
+		cc_data_temp &= ~str_mask;
+		cc_data_temp |= str_tab[i].sel << str_shift;
+		W_REG(osh, PMUREG(sih, chipcontrol_data), cc_data_temp);
+		if (str_ovr_pmuval) { /* enables the selected drive strength */
+			W_REG(osh,  PMUREG(sih, chipcontrol_addr), str_ovr_pmuctl);
+			OR_REG(osh, PMUREG(sih, chipcontrol_data), str_ovr_pmuval);
+		}
+		PMU_MSG(("SDIO: %dmA drive strength requested; set to %dmA\n",
+		         drivestrength, str_tab[i].strength));
+	}
+} /* si_sdiod_drive_strength_init */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/aidmp.h b/drivers/net/wireless/bcm4336/include/aidmp.h
--- a/drivers/net/wireless/bcm4336/include/aidmp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/aidmp.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,368 @@
+/*
+ * Broadcom AMBA Interconnect definitions.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: aidmp.h 456346 2014-02-18 16:48:52Z $
+ */
+
+#ifndef	_AIDMP_H
+#define	_AIDMP_H
+
+/* Manufacturer Ids */
+#define	MFGID_ARM		0x43b
+#define	MFGID_BRCM		0x4bf
+#define	MFGID_MIPS		0x4a7
+
+/* Component Classes */
+#define	CC_SIM			0
+#define	CC_EROM			1
+#define	CC_CORESIGHT		9
+#define	CC_VERIF		0xb
+#define	CC_OPTIMO		0xd
+#define	CC_GEN			0xe
+#define	CC_PRIMECELL		0xf
+
+/* Enumeration ROM registers */
+#define	ER_EROMENTRY		0x000
+#define	ER_REMAPCONTROL		0xe00
+#define	ER_REMAPSELECT		0xe04
+#define	ER_MASTERSELECT		0xe10
+#define	ER_ITCR			0xf00
+#define	ER_ITIP			0xf04
+
+/* Erom entries */
+#define	ER_TAG			0xe
+#define	ER_TAG1			0x6
+#define	ER_VALID		1
+#define	ER_CI			0
+#define	ER_MP			2
+#define	ER_ADD			4
+#define	ER_END			0xe
+#define	ER_BAD			0xffffffff
+
+/* EROM CompIdentA */
+#define	CIA_MFG_MASK		0xfff00000
+#define	CIA_MFG_SHIFT		20
+#define	CIA_CID_MASK		0x000fff00
+#define	CIA_CID_SHIFT		8
+#define	CIA_CCL_MASK		0x000000f0
+#define	CIA_CCL_SHIFT		4
+
+/* EROM CompIdentB */
+#define	CIB_REV_MASK		0xff000000
+#define	CIB_REV_SHIFT		24
+#define	CIB_NSW_MASK		0x00f80000
+#define	CIB_NSW_SHIFT		19
+#define	CIB_NMW_MASK		0x0007c000
+#define	CIB_NMW_SHIFT		14
+#define	CIB_NSP_MASK		0x00003e00
+#define	CIB_NSP_SHIFT		9
+#define	CIB_NMP_MASK		0x000001f0
+#define	CIB_NMP_SHIFT		4
+
+/* EROM MasterPortDesc */
+#define	MPD_MUI_MASK		0x0000ff00
+#define	MPD_MUI_SHIFT		8
+#define	MPD_MP_MASK		0x000000f0
+#define	MPD_MP_SHIFT		4
+
+/* EROM AddrDesc */
+#define	AD_ADDR_MASK		0xfffff000
+#define	AD_SP_MASK		0x00000f00
+#define	AD_SP_SHIFT		8
+#define	AD_ST_MASK		0x000000c0
+#define	AD_ST_SHIFT		6
+#define	AD_ST_SLAVE		0x00000000
+#define	AD_ST_BRIDGE		0x00000040
+#define	AD_ST_SWRAP		0x00000080
+#define	AD_ST_MWRAP		0x000000c0
+#define	AD_SZ_MASK		0x00000030
+#define	AD_SZ_SHIFT		4
+#define	AD_SZ_4K		0x00000000
+#define	AD_SZ_8K		0x00000010
+#define	AD_SZ_16K		0x00000020
+#define	AD_SZ_SZD		0x00000030
+#define	AD_AG32			0x00000008
+#define	AD_ADDR_ALIGN		0x00000fff
+#define	AD_SZ_BASE		0x00001000	/* 4KB */
+
+/* EROM SizeDesc */
+#define	SD_SZ_MASK		0xfffff000
+#define	SD_SG32			0x00000008
+#define	SD_SZ_ALIGN		0x00000fff
+
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+typedef volatile struct _aidmp {
+	uint32	oobselina30;	/* 0x000 */
+	uint32	oobselina74;	/* 0x004 */
+	uint32	PAD[6];
+	uint32	oobselinb30;	/* 0x020 */
+	uint32	oobselinb74;	/* 0x024 */
+	uint32	PAD[6];
+	uint32	oobselinc30;	/* 0x040 */
+	uint32	oobselinc74;	/* 0x044 */
+	uint32	PAD[6];
+	uint32	oobselind30;	/* 0x060 */
+	uint32	oobselind74;	/* 0x064 */
+	uint32	PAD[38];
+	uint32	oobselouta30;	/* 0x100 */
+	uint32	oobselouta74;	/* 0x104 */
+	uint32	PAD[6];
+	uint32	oobseloutb30;	/* 0x120 */
+	uint32	oobseloutb74;	/* 0x124 */
+	uint32	PAD[6];
+	uint32	oobseloutc30;	/* 0x140 */
+	uint32	oobseloutc74;	/* 0x144 */
+	uint32	PAD[6];
+	uint32	oobseloutd30;	/* 0x160 */
+	uint32	oobseloutd74;	/* 0x164 */
+	uint32	PAD[38];
+	uint32	oobsynca;	/* 0x200 */
+	uint32	oobseloutaen;	/* 0x204 */
+	uint32	PAD[6];
+	uint32	oobsyncb;	/* 0x220 */
+	uint32	oobseloutben;	/* 0x224 */
+	uint32	PAD[6];
+	uint32	oobsyncc;	/* 0x240 */
+	uint32	oobseloutcen;	/* 0x244 */
+	uint32	PAD[6];
+	uint32	oobsyncd;	/* 0x260 */
+	uint32	oobseloutden;	/* 0x264 */
+	uint32	PAD[38];
+	uint32	oobaextwidth;	/* 0x300 */
+	uint32	oobainwidth;	/* 0x304 */
+	uint32	oobaoutwidth;	/* 0x308 */
+	uint32	PAD[5];
+	uint32	oobbextwidth;	/* 0x320 */
+	uint32	oobbinwidth;	/* 0x324 */
+	uint32	oobboutwidth;	/* 0x328 */
+	uint32	PAD[5];
+	uint32	oobcextwidth;	/* 0x340 */
+	uint32	oobcinwidth;	/* 0x344 */
+	uint32	oobcoutwidth;	/* 0x348 */
+	uint32	PAD[5];
+	uint32	oobdextwidth;	/* 0x360 */
+	uint32	oobdinwidth;	/* 0x364 */
+	uint32	oobdoutwidth;	/* 0x368 */
+	uint32	PAD[37];
+	uint32	ioctrlset;	/* 0x400 */
+	uint32	ioctrlclear;	/* 0x404 */
+	uint32	ioctrl;		/* 0x408 */
+	uint32	PAD[61];
+	uint32	iostatus;	/* 0x500 */
+	uint32	PAD[127];
+	uint32	ioctrlwidth;	/* 0x700 */
+	uint32	iostatuswidth;	/* 0x704 */
+	uint32	PAD[62];
+	uint32	resetctrl;	/* 0x800 */
+	uint32	resetstatus;	/* 0x804 */
+	uint32	resetreadid;	/* 0x808 */
+	uint32	resetwriteid;	/* 0x80c */
+	uint32	PAD[60];
+	uint32	errlogctrl;	/* 0x900 */
+	uint32	errlogdone;	/* 0x904 */
+	uint32	errlogstatus;	/* 0x908 */
+	uint32	errlogaddrlo;	/* 0x90c */
+	uint32	errlogaddrhi;	/* 0x910 */
+	uint32	errlogid;	/* 0x914 */
+	uint32	errloguser;	/* 0x918 */
+	uint32	errlogflags;	/* 0x91c */
+	uint32	PAD[56];
+	uint32	intstatus;	/* 0xa00 */
+	uint32	PAD[255];
+	uint32	config;		/* 0xe00 */
+	uint32	PAD[63];
+	uint32	itcr;		/* 0xf00 */
+	uint32	PAD[3];
+	uint32	itipooba;	/* 0xf10 */
+	uint32	itipoobb;	/* 0xf14 */
+	uint32	itipoobc;	/* 0xf18 */
+	uint32	itipoobd;	/* 0xf1c */
+	uint32	PAD[4];
+	uint32	itipoobaout;	/* 0xf30 */
+	uint32	itipoobbout;	/* 0xf34 */
+	uint32	itipoobcout;	/* 0xf38 */
+	uint32	itipoobdout;	/* 0xf3c */
+	uint32	PAD[4];
+	uint32	itopooba;	/* 0xf50 */
+	uint32	itopoobb;	/* 0xf54 */
+	uint32	itopoobc;	/* 0xf58 */
+	uint32	itopoobd;	/* 0xf5c */
+	uint32	PAD[4];
+	uint32	itopoobain;	/* 0xf70 */
+	uint32	itopoobbin;	/* 0xf74 */
+	uint32	itopoobcin;	/* 0xf78 */
+	uint32	itopoobdin;	/* 0xf7c */
+	uint32	PAD[4];
+	uint32	itopreset;	/* 0xf90 */
+	uint32	PAD[15];
+	uint32	peripherialid4;	/* 0xfd0 */
+	uint32	peripherialid5;	/* 0xfd4 */
+	uint32	peripherialid6;	/* 0xfd8 */
+	uint32	peripherialid7;	/* 0xfdc */
+	uint32	peripherialid0;	/* 0xfe0 */
+	uint32	peripherialid1;	/* 0xfe4 */
+	uint32	peripherialid2;	/* 0xfe8 */
+	uint32	peripherialid3;	/* 0xfec */
+	uint32	componentid0;	/* 0xff0 */
+	uint32	componentid1;	/* 0xff4 */
+	uint32	componentid2;	/* 0xff8 */
+	uint32	componentid3;	/* 0xffc */
+} aidmp_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+/* Out-of-band Router registers */
+#define	OOB_BUSCONFIG		0x020
+#define	OOB_STATUSA		0x100
+#define	OOB_STATUSB		0x104
+#define	OOB_STATUSC		0x108
+#define	OOB_STATUSD		0x10c
+#define	OOB_ENABLEA0		0x200
+#define	OOB_ENABLEA1		0x204
+#define	OOB_ENABLEA2		0x208
+#define	OOB_ENABLEA3		0x20c
+#define	OOB_ENABLEB0		0x280
+#define	OOB_ENABLEB1		0x284
+#define	OOB_ENABLEB2		0x288
+#define	OOB_ENABLEB3		0x28c
+#define	OOB_ENABLEC0		0x300
+#define	OOB_ENABLEC1		0x304
+#define	OOB_ENABLEC2		0x308
+#define	OOB_ENABLEC3		0x30c
+#define	OOB_ENABLED0		0x380
+#define	OOB_ENABLED1		0x384
+#define	OOB_ENABLED2		0x388
+#define	OOB_ENABLED3		0x38c
+#define	OOB_ITCR		0xf00
+#define	OOB_ITIPOOBA		0xf10
+#define	OOB_ITIPOOBB		0xf14
+#define	OOB_ITIPOOBC		0xf18
+#define	OOB_ITIPOOBD		0xf1c
+#define	OOB_ITOPOOBA		0xf30
+#define	OOB_ITOPOOBB		0xf34
+#define	OOB_ITOPOOBC		0xf38
+#define	OOB_ITOPOOBD		0xf3c
+
+/* DMP wrapper registers */
+#define	AI_OOBSELINA30		0x000
+#define	AI_OOBSELINA74		0x004
+#define	AI_OOBSELINB30		0x020
+#define	AI_OOBSELINB74		0x024
+#define	AI_OOBSELINC30		0x040
+#define	AI_OOBSELINC74		0x044
+#define	AI_OOBSELIND30		0x060
+#define	AI_OOBSELIND74		0x064
+#define	AI_OOBSELOUTA30		0x100
+#define	AI_OOBSELOUTA74		0x104
+#define	AI_OOBSELOUTB30		0x120
+#define	AI_OOBSELOUTB74		0x124
+#define	AI_OOBSELOUTC30		0x140
+#define	AI_OOBSELOUTC74		0x144
+#define	AI_OOBSELOUTD30		0x160
+#define	AI_OOBSELOUTD74		0x164
+#define	AI_OOBSYNCA		0x200
+#define	AI_OOBSELOUTAEN		0x204
+#define	AI_OOBSYNCB		0x220
+#define	AI_OOBSELOUTBEN		0x224
+#define	AI_OOBSYNCC		0x240
+#define	AI_OOBSELOUTCEN		0x244
+#define	AI_OOBSYNCD		0x260
+#define	AI_OOBSELOUTDEN		0x264
+#define	AI_OOBAEXTWIDTH		0x300
+#define	AI_OOBAINWIDTH		0x304
+#define	AI_OOBAOUTWIDTH		0x308
+#define	AI_OOBBEXTWIDTH		0x320
+#define	AI_OOBBINWIDTH		0x324
+#define	AI_OOBBOUTWIDTH		0x328
+#define	AI_OOBCEXTWIDTH		0x340
+#define	AI_OOBCINWIDTH		0x344
+#define	AI_OOBCOUTWIDTH		0x348
+#define	AI_OOBDEXTWIDTH		0x360
+#define	AI_OOBDINWIDTH		0x364
+#define	AI_OOBDOUTWIDTH		0x368
+
+
+#define	AI_IOCTRLSET		0x400
+#define	AI_IOCTRLCLEAR		0x404
+#define	AI_IOCTRL		0x408
+#define	AI_IOSTATUS		0x500
+#define	AI_RESETCTRL		0x800
+#define	AI_RESETSTATUS		0x804
+
+#define	AI_IOCTRLWIDTH		0x700
+#define	AI_IOSTATUSWIDTH	0x704
+
+#define	AI_RESETREADID		0x808
+#define	AI_RESETWRITEID		0x80c
+#define	AI_ERRLOGCTRL		0xa00
+#define	AI_ERRLOGDONE		0xa04
+#define	AI_ERRLOGSTATUS		0xa08
+#define	AI_ERRLOGADDRLO		0xa0c
+#define	AI_ERRLOGADDRHI		0xa10
+#define	AI_ERRLOGID		0xa14
+#define	AI_ERRLOGUSER		0xa18
+#define	AI_ERRLOGFLAGS		0xa1c
+#define	AI_INTSTATUS		0xa00
+#define	AI_CONFIG		0xe00
+#define	AI_ITCR			0xf00
+#define	AI_ITIPOOBA		0xf10
+#define	AI_ITIPOOBB		0xf14
+#define	AI_ITIPOOBC		0xf18
+#define	AI_ITIPOOBD		0xf1c
+#define	AI_ITIPOOBAOUT		0xf30
+#define	AI_ITIPOOBBOUT		0xf34
+#define	AI_ITIPOOBCOUT		0xf38
+#define	AI_ITIPOOBDOUT		0xf3c
+#define	AI_ITOPOOBA		0xf50
+#define	AI_ITOPOOBB		0xf54
+#define	AI_ITOPOOBC		0xf58
+#define	AI_ITOPOOBD		0xf5c
+#define	AI_ITOPOOBAIN		0xf70
+#define	AI_ITOPOOBBIN		0xf74
+#define	AI_ITOPOOBCIN		0xf78
+#define	AI_ITOPOOBDIN		0xf7c
+#define	AI_ITOPRESET		0xf90
+#define	AI_PERIPHERIALID4	0xfd0
+#define	AI_PERIPHERIALID5	0xfd4
+#define	AI_PERIPHERIALID6	0xfd8
+#define	AI_PERIPHERIALID7	0xfdc
+#define	AI_PERIPHERIALID0	0xfe0
+#define	AI_PERIPHERIALID1	0xfe4
+#define	AI_PERIPHERIALID2	0xfe8
+#define	AI_PERIPHERIALID3	0xfec
+#define	AI_COMPONENTID0		0xff0
+#define	AI_COMPONENTID1		0xff4
+#define	AI_COMPONENTID2		0xff8
+#define	AI_COMPONENTID3		0xffc
+
+/* resetctrl */
+#define	AIRC_RESET		1
+
+/* config */
+#define	AICFG_OOB		0x00000020
+#define	AICFG_IOS		0x00000010
+#define	AICFG_IOC		0x00000008
+#define	AICFG_TO		0x00000004
+#define	AICFG_ERRL		0x00000002
+#define	AICFG_RST		0x00000001
+
+/* bit defines for AI_OOBSELOUTB74 reg */
+#define OOB_SEL_OUTEN_B_5	15
+#define OOB_SEL_OUTEN_B_6	23
+
+/* AI_OOBSEL for A/B/C/D, 0-7 */
+#define AI_OOBSEL_MASK		0x1F
+#define AI_OOBSEL_0_SHIFT	0
+#define AI_OOBSEL_1_SHIFT	8
+#define AI_OOBSEL_2_SHIFT	16
+#define AI_OOBSEL_3_SHIFT	24
+#define AI_OOBSEL_4_SHIFT	0
+#define AI_OOBSEL_5_SHIFT	8
+#define AI_OOBSEL_6_SHIFT	16
+#define AI_OOBSEL_7_SHIFT	24
+
+#endif	/* _AIDMP_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmcdc.h b/drivers/net/wireless/bcm4336/include/bcmcdc.h
--- a/drivers/net/wireless/bcm4336/include/bcmcdc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmcdc.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,114 @@
+/*
+ * CDC network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmcdc.h 318308 2012-03-02 02:23:42Z $
+ */
+#ifndef _bcmcdc_h_
+#define	_bcmcdc_h_
+#include <proto/ethernet.h>
+
+typedef struct cdc_ioctl {
+	uint32 cmd;      /* ioctl command value */
+	uint32 len;      /* lower 16: output buflen; upper 16: input buflen (excludes header) */
+	uint32 flags;    /* flag defns given below */
+	uint32 status;   /* status code returned from the device */
+} cdc_ioctl_t;
+
+/* Max valid buffer size that can be sent to the dongle */
+#define CDC_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+/* len field is divided into input and output buffer lengths */
+#define CDCL_IOC_OUTLEN_MASK   0x0000FFFF  /* maximum or expected response length, */
+					   /* excluding IOCTL header */
+#define CDCL_IOC_OUTLEN_SHIFT  0
+#define CDCL_IOC_INLEN_MASK    0xFFFF0000   /* input buffer length, excluding IOCTL header */
+#define CDCL_IOC_INLEN_SHIFT   16
+
+/* CDC flag definitions */
+#define CDCF_IOC_ERROR		0x01	/* 0=success, 1=ioctl cmd failed */
+#define CDCF_IOC_SET		0x02	/* 0=get, 1=set cmd */
+#define CDCF_IOC_OVL_IDX_MASK	0x3c	/* overlay region index mask */
+#define CDCF_IOC_OVL_RSV	0x40	/* 1=reserve this overlay region */
+#define CDCF_IOC_OVL		0x80	/* 1=this ioctl corresponds to an overlay */
+#define CDCF_IOC_ACTION_MASK	0xfe	/* SET/GET, OVL_IDX, OVL_RSV, OVL mask */
+#define CDCF_IOC_ACTION_SHIFT	1	/* SET/GET, OVL_IDX, OVL_RSV, OVL shift */
+#define CDCF_IOC_IF_MASK	0xF000	/* I/F index */
+#define CDCF_IOC_IF_SHIFT	12
+#define CDCF_IOC_ID_MASK	0xFFFF0000	/* used to uniquely id an ioctl req/resp pairing */
+#define CDCF_IOC_ID_SHIFT	16		/* # of bits of shift for ID Mask */
+
+#define CDC_IOC_IF_IDX(flags)	(((flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT)
+#define CDC_IOC_ID(flags)	(((flags) & CDCF_IOC_ID_MASK) >> CDCF_IOC_ID_SHIFT)
+
+#define CDC_GET_IF_IDX(hdr) \
+	((int)((((hdr)->flags) & CDCF_IOC_IF_MASK) >> CDCF_IOC_IF_SHIFT))
+#define CDC_SET_IF_IDX(hdr, idx) \
+	((hdr)->flags = (((hdr)->flags & ~CDCF_IOC_IF_MASK) | ((idx) << CDCF_IOC_IF_SHIFT)))
+
+/*
+ * BDC header
+ *
+ *   The BDC header is used on data packets to convey priority across USB.
+ */
+
+struct bdc_header {
+	uint8	flags;			/* Flags */
+	uint8	priority;		/* 802.1d Priority 0:2 bits, 4:7 USB flow control info */
+	uint8	flags2;
+	uint8	dataOffset;		/* Offset from end of BDC header to packet data, in
+					 * 4-byte words.  Leaves room for optional headers.
+					 */
+};
+
+#define	BDC_HEADER_LEN		4
+
+/* flags field bitmap */
+#define BDC_FLAG_80211_PKT	0x01	/* Packet is in 802.11 format (dongle -> host) */
+#define BDC_FLAG_SUM_GOOD	0x04	/* Dongle has verified good RX checksums */
+#define BDC_FLAG_SUM_NEEDED	0x08	/* Dongle needs to do TX checksums: host->device */
+#define BDC_FLAG_EVENT_MSG	0x08	/* Payload contains an event msg: device->host */
+#define BDC_FLAG_VER_MASK	0xf0	/* Protocol version mask */
+#define BDC_FLAG_VER_SHIFT	4	/* Protocol version shift */
+
+/* priority field bitmap */
+#define BDC_PRIORITY_MASK	0x07
+#define BDC_PRIORITY_FC_MASK	0xf0	/* flow control info mask */
+#define BDC_PRIORITY_FC_SHIFT	4	/* flow control info shift */
+
+/* flags2 field bitmap */
+#define BDC_FLAG2_IF_MASK	0x0f	/* interface index (host <-> dongle) */
+#define BDC_FLAG2_IF_SHIFT	0
+#define BDC_FLAG2_FC_FLAG	0x10	/* flag to indicate if pkt contains */
+					/* FLOW CONTROL info only */
+
+/* version numbers */
+#define BDC_PROTO_VER_1		1	/* Old Protocol version */
+#define BDC_PROTO_VER		2	/* Protocol version */
+
+/* flags2.if field access macros */
+#define BDC_GET_IF_IDX(hdr) \
+	((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
+#define BDC_SET_IF_IDX(hdr, idx) \
+	((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | ((idx) << BDC_FLAG2_IF_SHIFT)))
+
+#define BDC_FLAG2_PAD_MASK		0xf0
+#define BDC_FLAG_PAD_MASK		0x03
+#define BDC_FLAG2_PAD_SHIFT		2
+#define BDC_FLAG_PAD_SHIFT		0
+#define BDC_FLAG2_PAD_IDX		0x3c
+#define BDC_FLAG_PAD_IDX		0x03
+#define BDC_GET_PAD_LEN(hdr) \
+	((int)(((((hdr)->flags2) & BDC_FLAG2_PAD_MASK) >> BDC_FLAG2_PAD_SHIFT) | \
+	((((hdr)->flags) & BDC_FLAG_PAD_MASK) >> BDC_FLAG_PAD_SHIFT)))
+#define BDC_SET_PAD_LEN(hdr, idx) \
+	((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_PAD_MASK) | \
+	(((idx) & BDC_FLAG2_PAD_IDX) << BDC_FLAG2_PAD_SHIFT))); \
+	((hdr)->flags = (((hdr)->flags & ~BDC_FLAG_PAD_MASK) | \
+	(((idx) & BDC_FLAG_PAD_IDX) << BDC_FLAG_PAD_SHIFT)))
+
+#endif /* _bcmcdc_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcm_cfg.h b/drivers/net/wireless/bcm4336/include/bcm_cfg.h
--- a/drivers/net/wireless/bcm4336/include/bcm_cfg.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcm_cfg.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,11 @@
+/*
+ * BCM common config options
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcm_cfg.h 351867 2012-08-21 18:46:16Z $
+ */
+
+#ifndef _bcm_cfg_h_
+#define _bcm_cfg_h_
+#endif /* _bcm_cfg_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmdefs.h b/drivers/net/wireless/bcm4336/include/bcmdefs.h
--- a/drivers/net/wireless/bcm4336/include/bcmdefs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmdefs.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,320 @@
+/*
+ * Misc system wide definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmdefs.h 474209 2014-04-30 12:16:47Z $
+ */
+
+#ifndef	_bcmdefs_h_
+#define	_bcmdefs_h_
+
+/*
+ * One doesn't need to include this file explicitly, gets included automatically if
+ * typedefs.h is included.
+ */
+
+/* Use BCM_REFERENCE to suppress warnings about intentionally-unused function
+ * arguments or local variables.
+ */
+#define BCM_REFERENCE(data)	((void)(data))
+
+/* Allow for suppressing unused variable warnings. */
+#ifdef __GNUC__
+#define UNUSED_VAR     __attribute__ ((unused))
+#else
+#define UNUSED_VAR
+#endif
+
+/* Compile-time assert can be used in place of ASSERT if the expression evaluates
+ * to a constant at compile time.
+ */
+#define STATIC_ASSERT(expr) { \
+	/* Make sure the expression is constant. */ \
+	typedef enum { _STATIC_ASSERT_NOT_CONSTANT = (expr) } _static_assert_e UNUSED_VAR; \
+	/* Make sure the expression is true. */ \
+	typedef char STATIC_ASSERT_FAIL[(expr) ? 1 : -1] UNUSED_VAR; \
+}
+
+/* Reclaiming text and data :
+ * The following macros specify special linker sections that can be reclaimed
+ * after a system is considered 'up'.
+ * BCMATTACHFN is also used for detach functions (it's not worth having a BCMDETACHFN,
+ * as in most cases, the attach function calls the detach function to clean up on error).
+ */
+
+#define bcmreclaimed 		0
+#define _data	_data
+#define _fn	_fn
+#define BCMPREATTACHDATA(_data)	_data
+#define BCMPREATTACHFN(_fn)	_fn
+#define _data	_data
+#define _fn		_fn
+#define _fn	_fn
+#define	BCMNMIATTACHFN(_fn)	_fn
+#define	BCMNMIATTACHDATA(_data)	_data
+#define CONST	const
+
+#undef BCM47XX_CA9
+
+#ifndef BCMFASTPATH
+#if defined(BCM47XX_CA9)
+#define BCMFASTPATH		__attribute__ ((__section__ (".text.fastpath")))
+#define BCMFASTPATH_HOST	__attribute__ ((__section__ (".text.fastpath_host")))
+#else
+#define BCMFASTPATH
+#define BCMFASTPATH_HOST
+#endif
+#endif /* BCMFASTPATH */
+
+
+/* Use the BCMRAMFN() macro to tag functions in source that must be included in RAM (excluded from
+ * ROM). This should eliminate the need to manually specify these functions in the ROM config file.
+ * It should only be used in special cases where the function must be in RAM for *all* ROM-based
+ * chips.
+ */
+	#define BCMRAMFN(_fn)	_fn
+
+#define STATIC	static
+
+/* Bus types */
+#define	SI_BUS			0	/* SOC Interconnect */
+#define	PCI_BUS			1	/* PCI target */
+#define	PCMCIA_BUS		2	/* PCMCIA target */
+#define SDIO_BUS		3	/* SDIO target */
+#define JTAG_BUS		4	/* JTAG */
+#define USB_BUS			5	/* USB (does not support R/W REG) */
+#define SPI_BUS			6	/* gSPI target */
+#define RPC_BUS			7	/* RPC target */
+
+/* Allows size optimization for single-bus image */
+#ifdef BCMBUSTYPE
+#define BUSTYPE(bus) 	(BCMBUSTYPE)
+#else
+#define BUSTYPE(bus) 	(bus)
+#endif
+
+/* Allows size optimization for single-backplane image */
+#ifdef BCMCHIPTYPE
+#define CHIPTYPE(bus) 	(BCMCHIPTYPE)
+#else
+#define CHIPTYPE(bus) 	(bus)
+#endif
+
+
+/* Allows size optimization for SPROM support */
+#if defined(BCMSPROMBUS)
+#define SPROMBUS	(BCMSPROMBUS)
+#elif defined(SI_PCMCIA_SROM)
+#define SPROMBUS	(PCMCIA_BUS)
+#else
+#define SPROMBUS	(PCI_BUS)
+#endif
+
+/* Allows size optimization for single-chip image */
+#ifdef BCMCHIPID
+#define CHIPID(chip)	(BCMCHIPID)
+#else
+#define CHIPID(chip)	(chip)
+#endif
+
+#ifdef BCMCHIPREV
+#define CHIPREV(rev)	(BCMCHIPREV)
+#else
+#define CHIPREV(rev)	(rev)
+#endif
+
+/* Defines for DMA Address Width - Shared between OSL and HNDDMA */
+#define DMADDR_MASK_32 0x0		/* Address mask for 32-bits */
+#define DMADDR_MASK_30 0xc0000000	/* Address mask for 30-bits */
+#define DMADDR_MASK_26 0xFC000000	/* Address maks for 26-bits */
+#define DMADDR_MASK_0  0xffffffff	/* Address mask for 0-bits (hi-part) */
+
+#define	DMADDRWIDTH_26  26 /* 26-bit addressing capability */
+#define	DMADDRWIDTH_30  30 /* 30-bit addressing capability */
+#define	DMADDRWIDTH_32  32 /* 32-bit addressing capability */
+#define	DMADDRWIDTH_63  63 /* 64-bit addressing capability */
+#define	DMADDRWIDTH_64  64 /* 64-bit addressing capability */
+
+typedef struct {
+	uint32 loaddr;
+	uint32 hiaddr;
+} dma64addr_t;
+
+#define PHYSADDR64HI(_pa) ((_pa).hiaddr)
+#define PHYSADDR64HISET(_pa, _val) \
+	do { \
+		(_pa).hiaddr = (_val);		\
+	} while (0)
+#define PHYSADDR64LO(_pa) ((_pa).loaddr)
+#define PHYSADDR64LOSET(_pa, _val) \
+	do { \
+		(_pa).loaddr = (_val);		\
+	} while (0)
+
+#ifdef BCMDMA64OSL
+typedef dma64addr_t dmaaddr_t;
+#define PHYSADDRHI(_pa) PHYSADDR64HI(_pa)
+#define PHYSADDRHISET(_pa, _val) PHYSADDR64HISET(_pa, _val)
+#define PHYSADDRLO(_pa)  PHYSADDR64LO(_pa)
+#define PHYSADDRLOSET(_pa, _val) PHYSADDR64LOSET(_pa, _val)
+
+#else
+typedef unsigned long dmaaddr_t;
+#define PHYSADDRHI(_pa) (0)
+#define PHYSADDRHISET(_pa, _val)
+#define PHYSADDRLO(_pa) ((_pa))
+#define PHYSADDRLOSET(_pa, _val) \
+	do { \
+		(_pa) = (_val);			\
+	} while (0)
+#endif /* BCMDMA64OSL */
+#define PHYSADDRISZERO(_pa) (PHYSADDRLO(_pa) == 0 && PHYSADDRHI(_pa) == 0)
+
+/* One physical DMA segment */
+typedef struct  {
+	dmaaddr_t addr;
+	uint32	  length;
+} hnddma_seg_t;
+
+#define MAX_DMA_SEGS 8
+
+
+typedef struct {
+	void *oshdmah; /* Opaque handle for OSL to store its information */
+	uint origsize; /* Size of the virtual packet */
+	uint nsegs;
+	hnddma_seg_t segs[MAX_DMA_SEGS];
+} hnddma_seg_map_t;
+
+
+/* packet headroom necessary to accommodate the largest header in the system, (i.e TXOFF).
+ * By doing, we avoid the need  to allocate an extra buffer for the header when bridging to WL.
+ * There is a compile time check in wlc.c which ensure that this value is at least as big
+ * as TXOFF. This value is used in dma_rxfill (hnddma.c).
+ */
+
+#if defined(BCM_RPC_NOCOPY) || defined(BCM_RCP_TXNOCOPY)
+/* add 40 bytes to allow for extra RPC header and info  */
+#define BCMEXTRAHDROOM 260
+#else /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY */
+#if defined(BCM47XX_CA9)
+#define BCMEXTRAHDROOM 224
+#else
+#define BCMEXTRAHDROOM 204
+#endif /* linux && BCM47XX_CA9 */
+#endif /* BCM_RPC_NOCOPY || BCM_RPC_TXNOCOPY */
+
+/* Packet alignment for most efficient SDIO (can change based on platform) */
+#ifndef SDALIGN
+#define SDALIGN	32
+#endif
+
+/* Headroom required for dongle-to-host communication.  Packets allocated
+ * locally in the dongle (e.g. for CDC ioctls or RNDIS messages) should
+ * leave this much room in front for low-level message headers which may
+ * be needed to get across the dongle bus to the host.  (These messages
+ * don't go over the network, so room for the full WL header above would
+ * be a waste.).
+*/
+#define BCMDONGLEHDRSZ 12
+#define BCMDONGLEPADSZ 16
+
+#define BCMDONGLEOVERHEAD	(BCMDONGLEHDRSZ + BCMDONGLEPADSZ)
+
+
+#if defined(NO_BCMDBG_ASSERT)
+# undef BCMDBG_ASSERT
+# undef BCMASSERT_LOG
+#endif
+
+#if defined(BCMASSERT_LOG)
+#define BCMASSERT_SUPPORT
+#endif
+
+/* Macros for doing definition and get/set of bitfields
+ * Usage example, e.g. a three-bit field (bits 4-6):
+ *    #define <NAME>_M	BITFIELD_MASK(3)
+ *    #define <NAME>_S	4
+ * ...
+ *    regval = R_REG(osh, &regs->regfoo);
+ *    field = GFIELD(regval, <NAME>);
+ *    regval = SFIELD(regval, <NAME>, 1);
+ *    W_REG(osh, &regs->regfoo, regval);
+ */
+#define BITFIELD_MASK(width) \
+		(((unsigned)1 << (width)) - 1)
+#define GFIELD(val, field) \
+		(((val) >> field ## _S) & field ## _M)
+#define SFIELD(val, field, bits) \
+		(((val) & (~(field ## _M << field ## _S))) | \
+		 ((unsigned)(bits) << field ## _S))
+
+/* define BCMSMALL to remove misc features for memory-constrained environments */
+#ifdef BCMSMALL
+#undef	BCMSPACE
+#define bcmspace	FALSE	/* if (bcmspace) code is discarded */
+#else
+#define	BCMSPACE
+#define bcmspace	TRUE	/* if (bcmspace) code is retained */
+#endif
+
+/* Max. nvram variable table size */
+#ifndef MAXSZ_NVRAM_VARS
+#define	MAXSZ_NVRAM_VARS	4096
+#endif
+
+
+
+/* WL_ENAB_RUNTIME_CHECK may be set based upon the #define below (for ROM builds). It may also
+ * be defined via makefiles (e.g. ROM auto abandon unoptimized compiles).
+ */
+
+
+#ifdef BCMLFRAG /* BCMLFRAG support enab macros  */
+	extern bool _bcmlfrag;
+	#if defined(WL_ENAB_RUNTIME_CHECK) || !defined(DONGLEBUILD)
+		#define BCMLFRAG_ENAB() (_bcmlfrag)
+	#elif defined(BCMLFRAG_DISABLED)
+		#define BCMLFRAG_ENAB()	(0)
+	#else
+		#define BCMLFRAG_ENAB()	(1)
+	#endif
+#else
+	#define BCMLFRAG_ENAB()		(0)
+#endif /* BCMLFRAG_ENAB */
+#ifdef BCMSPLITRX /* BCMLFRAG support enab macros  */
+	extern bool _bcmsplitrx;
+	#if defined(WL_ENAB_RUNTIME_CHECK) || !defined(DONGLEBUILD)
+		#define BCMSPLITRX_ENAB() (_bcmsplitrx)
+	#elif defined(BCMSPLITRX_DISABLED)
+		#define BCMSPLITRX_ENAB()	(0)
+	#else
+		#define BCMSPLITRX_ENAB()	(1)
+	#endif
+#else
+	#define BCMSPLITRX_ENAB()		(0)
+#endif /* BCMSPLITRX */
+#ifdef BCM_SPLITBUF
+	extern bool _bcmsplitbuf;
+	#if defined(WL_ENAB_RUNTIME_CHECK) || !defined(DONGLEBUILD)
+		#define BCM_SPLITBUF_ENAB() (_bcmsplitbuf)
+	#elif defined(BCM_SPLITBUF_DISABLED)
+		#define BCM_SPLITBUF_ENAB()	(0)
+	#else
+		#define BCM_SPLITBUF_ENAB()	(1)
+	#endif
+#else
+	#define BCM_SPLITBUF_ENAB()		(0)
+#endif	/* BCM_SPLITBUF */
+/* Max size for reclaimable NVRAM array */
+#ifdef DL_NVRAM
+#define NVRAM_ARRAY_MAXSIZE	DL_NVRAM
+#else
+#define NVRAM_ARRAY_MAXSIZE	MAXSZ_NVRAM_VARS
+#endif /* DL_NVRAM */
+
+extern uint32 gFWID;
+
+
+#endif /* _bcmdefs_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmdevs.h b/drivers/net/wireless/bcm4336/include/bcmdevs.h
--- a/drivers/net/wireless/bcm4336/include/bcmdevs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmdevs.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,1088 @@
+/*
+ * Broadcom device-specific manifest constants.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmdevs.h 484136 2014-06-12 04:36:10Z $
+ */
+
+#ifndef	_BCMDEVS_H
+#define	_BCMDEVS_H
+
+/* PCI vendor IDs */
+#define	VENDOR_EPIGRAM		0xfeda
+#define	VENDOR_BROADCOM		0x14e4
+#define	VENDOR_3COM		0x10b7
+#define	VENDOR_NETGEAR		0x1385
+#define	VENDOR_DIAMOND		0x1092
+#define	VENDOR_INTEL		0x8086
+#define	VENDOR_DELL		0x1028
+#define	VENDOR_HP		0x103c
+#define	VENDOR_HP_COMPAQ	0x0e11
+#define	VENDOR_APPLE		0x106b
+#define VENDOR_SI_IMAGE		0x1095		/* Silicon Image, used by Arasan SDIO Host */
+#define VENDOR_BUFFALO		0x1154		/* Buffalo vendor id */
+#define VENDOR_TI		0x104c		/* Texas Instruments */
+#define VENDOR_RICOH		0x1180		/* Ricoh */
+#define VENDOR_JMICRON		0x197b
+
+
+/* PCMCIA vendor IDs */
+#define	VENDOR_BROADCOM_PCMCIA	0x02d0
+
+/* SDIO vendor IDs */
+#define	VENDOR_BROADCOM_SDIO	0x00BF
+
+/* DONGLE VID/PIDs */
+#define BCM_DNGL_VID		0x0a5c
+#define BCM_DNGL_BL_PID_4328	0xbd12
+#define BCM_DNGL_BL_PID_4322	0xbd13
+#define BCM_DNGL_BL_PID_4319    0xbd16
+#define BCM_DNGL_BL_PID_43236   0xbd17
+#define BCM_DNGL_BL_PID_4332	0xbd18
+#define BCM_DNGL_BL_PID_4330	0xbd19
+#define BCM_DNGL_BL_PID_4334	0xbd1a
+#define BCM_DNGL_BL_PID_43239   0xbd1b
+#define BCM_DNGL_BL_PID_4324	0xbd1c
+#define BCM_DNGL_BL_PID_4360	0xbd1d
+#define BCM_DNGL_BL_PID_43143	0xbd1e
+#define BCM_DNGL_BL_PID_43242	0xbd1f
+#define BCM_DNGL_BL_PID_43342	0xbd21
+#define BCM_DNGL_BL_PID_4335	0xbd20
+#define BCM_DNGL_BL_PID_43341	0xbd22
+#define BCM_DNGL_BL_PID_4350    0xbd23
+#define BCM_DNGL_BL_PID_4345    0xbd24
+#define BCM_DNGL_BL_PID_4349	0xbd25
+#define BCM_DNGL_BL_PID_4354	0xbd26
+#define BCM_DNGL_BL_PID_43569   0xbd27
+#define BCM_DNGL_BL_PID_43909	0xbd28
+
+#define BCM_DNGL_BDC_PID	0x0bdc
+#define BCM_DNGL_JTAG_PID	0x4a44
+
+/* HW USB BLOCK [CPULESS USB] PIDs */
+#define BCM_HWUSB_PID_43239     43239
+
+/* PCI Device IDs */
+#define	BCM4210_DEVICE_ID	0x1072		/* never used */
+#define	BCM4230_DEVICE_ID	0x1086		/* never used */
+#define	BCM4401_ENET_ID		0x170c		/* 4401b0 production enet cards */
+#define	BCM3352_DEVICE_ID	0x3352		/* bcm3352 device id */
+#define	BCM3360_DEVICE_ID	0x3360		/* bcm3360 device id */
+#define	BCM4211_DEVICE_ID	0x4211
+#define	BCM4231_DEVICE_ID	0x4231
+#define	BCM4303_D11B_ID		0x4303		/* 4303 802.11b */
+#define	BCM4311_D11G_ID		0x4311		/* 4311 802.11b/g id */
+#define	BCM4311_D11DUAL_ID	0x4312		/* 4311 802.11a/b/g id */
+#define	BCM4311_D11A_ID		0x4313		/* 4311 802.11a id */
+#define	BCM4328_D11DUAL_ID	0x4314		/* 4328/4312 802.11a/g id */
+#define	BCM4328_D11G_ID		0x4315		/* 4328/4312 802.11g id */
+#define	BCM4328_D11A_ID		0x4316		/* 4328/4312 802.11a id */
+#define	BCM4318_D11G_ID		0x4318		/* 4318 802.11b/g id */
+#define	BCM4318_D11DUAL_ID	0x4319		/* 4318 802.11a/b/g id */
+#define	BCM4318_D11A_ID		0x431a		/* 4318 802.11a id */
+#define	BCM4325_D11DUAL_ID	0x431b		/* 4325 802.11a/g id */
+#define	BCM4325_D11G_ID		0x431c		/* 4325 802.11g id */
+#define	BCM4325_D11A_ID		0x431d		/* 4325 802.11a id */
+#define	BCM4306_D11G_ID		0x4320		/* 4306 802.11g */
+#define	BCM4306_D11A_ID		0x4321		/* 4306 802.11a */
+#define	BCM4306_UART_ID		0x4322		/* 4306 uart */
+#define	BCM4306_V90_ID		0x4323		/* 4306 v90 codec */
+#define	BCM4306_D11DUAL_ID	0x4324		/* 4306 dual A+B */
+#define	BCM4306_D11G_ID2	0x4325		/* BCM4306_D11G_ID; INF w/loose binding war */
+#define	BCM4321_D11N_ID		0x4328		/* 4321 802.11n dualband id */
+#define	BCM4321_D11N2G_ID	0x4329		/* 4321 802.11n 2.4Ghz band id */
+#define	BCM4321_D11N5G_ID	0x432a		/* 4321 802.11n 5Ghz band id */
+#define BCM4322_D11N_ID		0x432b		/* 4322 802.11n dualband device */
+#define BCM4322_D11N2G_ID	0x432c		/* 4322 802.11n 2.4GHz device */
+#define BCM4322_D11N5G_ID	0x432d		/* 4322 802.11n 5GHz device */
+#define BCM4329_D11N_ID		0x432e		/* 4329 802.11n dualband device */
+#define BCM4329_D11N2G_ID	0x432f		/* 4329 802.11n 2.4G device */
+#define BCM4329_D11N5G_ID	0x4330		/* 4329 802.11n 5G device */
+#define	BCM4315_D11DUAL_ID	0x4334		/* 4315 802.11a/g id */
+#define	BCM4315_D11G_ID		0x4335		/* 4315 802.11g id */
+#define	BCM4315_D11A_ID		0x4336		/* 4315 802.11a id */
+#define BCM4319_D11N_ID		0x4337		/* 4319 802.11n dualband device */
+#define BCM4319_D11N2G_ID	0x4338		/* 4319 802.11n 2.4G device */
+#define BCM4319_D11N5G_ID	0x4339		/* 4319 802.11n 5G device */
+#define BCM43231_D11N2G_ID	0x4340		/* 43231 802.11n 2.4GHz device */
+#define BCM43221_D11N2G_ID	0x4341		/* 43221 802.11n 2.4GHz device */
+#define BCM43222_D11N_ID	0x4350		/* 43222 802.11n dualband device */
+#define BCM43222_D11N2G_ID	0x4351		/* 43222 802.11n 2.4GHz device */
+#define BCM43222_D11N5G_ID	0x4352		/* 43222 802.11n 5GHz device */
+#define BCM43224_D11N_ID	0x4353		/* 43224 802.11n dualband device */
+#define BCM43224_D11N_ID_VEN1	0x0576		/* Vendor specific 43224 802.11n db device */
+#define BCM43226_D11N_ID	0x4354		/* 43226 802.11n dualband device */
+#define BCM43236_D11N_ID	0x4346		/* 43236 802.11n dualband device */
+#define BCM43236_D11N2G_ID	0x4347		/* 43236 802.11n 2.4GHz device */
+#define BCM43236_D11N5G_ID	0x4348		/* 43236 802.11n 5GHz device */
+#define BCM43225_D11N2G_ID	0x4357		/* 43225 802.11n 2.4GHz device */
+#define BCM43421_D11N_ID	0xA99D		/* 43421 802.11n dualband device */
+#define BCM4313_D11N2G_ID	0x4727		/* 4313 802.11n 2.4G device */
+#define BCM4330_D11N_ID         0x4360          /* 4330 802.11n dualband device */
+#define BCM4330_D11N2G_ID       0x4361          /* 4330 802.11n 2.4G device */
+#define BCM4330_D11N5G_ID       0x4362          /* 4330 802.11n 5G device */
+#define BCM4336_D11N_ID		0x4343		/* 4336 802.11n 2.4GHz device */
+#define BCM6362_D11N_ID		0x435f		/* 6362 802.11n dualband device */
+#define BCM6362_D11N2G_ID	0x433f		/* 6362 802.11n 2.4Ghz band id */
+#define BCM6362_D11N5G_ID	0x434f		/* 6362 802.11n 5Ghz band id */
+#define BCM4331_D11N_ID		0x4331		/* 4331 802.11n dualband id */
+#define BCM4331_D11N2G_ID	0x4332		/* 4331 802.11n 2.4Ghz band id */
+#define BCM4331_D11N5G_ID	0x4333		/* 4331 802.11n 5Ghz band id */
+#define BCM43237_D11N_ID	0x4355		/* 43237 802.11n dualband device */
+#define BCM43237_D11N5G_ID	0x4356		/* 43237 802.11n 5GHz device */
+#define BCM43227_D11N2G_ID	0x4358		/* 43228 802.11n 2.4GHz device */
+#define BCM43228_D11N_ID	0x4359		/* 43228 802.11n DualBand device */
+#define BCM43228_D11N5G_ID	0x435a		/* 43228 802.11n 5GHz device */
+#define BCM43362_D11N_ID	0x4363		/* 43362 802.11n 2.4GHz device */
+#define BCM43239_D11N_ID	0x4370		/* 43239 802.11n dualband device */
+#define BCM4324_D11N_ID		0x4374		/* 4324 802.11n dualband device */
+#define BCM43217_D11N2G_ID	0x43a9		/* 43217 802.11n 2.4GHz device */
+#define BCM43131_D11N2G_ID	0x43aa		/* 43131 802.11n 2.4GHz device */
+#define BCM4314_D11N2G_ID	0x4364		/* 4314 802.11n 2.4G device */
+#define BCM43142_D11N2G_ID	0x4365		/* 43142 802.11n 2.4G device */
+#define BCM43143_D11N2G_ID	0x4366		/* 43143 802.11n 2.4G device */
+#define BCM4334_D11N_ID		0x4380		/* 4334 802.11n dualband device */
+#define BCM4334_D11N2G_ID	0x4381		/* 4334 802.11n 2.4G device */
+#define BCM4334_D11N5G_ID	0x4382		/* 4334 802.11n 5G device */
+#define BCM43342_D11N_ID	0x4383		/* 43342 802.11n dualband device */
+#define BCM43342_D11N2G_ID	0x4384		/* 43342 802.11n 2.4G device */
+#define BCM43342_D11N5G_ID	0x4385		/* 43342 802.11n 5G device */
+#define BCM43341_D11N_ID	0x4386		/* 43341 802.11n dualband device */
+#define BCM43341_D11N2G_ID	0x4387		/* 43341 802.11n 2.4G device */
+#define BCM43341_D11N5G_ID	0x4388		/* 43341 802.11n 5G device */
+#define BCM4360_D11AC_ID	0x43a0
+#define BCM4360_D11AC2G_ID	0x43a1
+#define BCM4360_D11AC5G_ID	0x43a2
+#define BCM4345_D11AC_ID	0x43ab		/* 4345 802.11ac dualband device */
+#define BCM4345_D11AC2G_ID	0x43ac		/* 4345 802.11ac 2.4G device */
+#define BCM4345_D11AC5G_ID	0x43ad		/* 4345 802.11ac 5G device */
+#define BCM4335_D11AC_ID	0x43ae
+#define BCM4335_D11AC2G_ID	0x43af
+#define BCM4335_D11AC5G_ID	0x43b0
+#define BCM4352_D11AC_ID	0x43b1		/* 4352 802.11ac dualband device */
+#define BCM4352_D11AC2G_ID	0x43b2		/* 4352 802.11ac 2.4G device */
+#define BCM4352_D11AC5G_ID	0x43b3		/* 4352 802.11ac 5G device */
+#define BCM43602_D11AC_ID	0x43ba		/* ac dualband PCI devid SPROM programmed */
+#define BCM43602_D11AC2G_ID	0x43bb		/* 43602 802.11ac 2.4G device */
+#define BCM43602_D11AC5G_ID	0x43bc		/* 43602 802.11ac 5G device */
+#define BCM4349_D11AC_ID	0x4349		/* 4349 802.11ac dualband device */
+#define BCM4349_D11AC2G_ID	0x43dd		/* 4349 802.11ac 2.4G device */
+#define BCM4349_D11AC5G_ID	0x43de		/* 4349 802.11ac 5G device */
+#define BCM4355_D11AC_ID	0x43d3		/* 4355 802.11ac dualband device */
+#define BCM4355_D11AC2G_ID	0x43d4		/* 4355 802.11ac 2.4G device */
+#define BCM4355_D11AC5G_ID	0x43d5		/* 4355 802.11ac 5G device */
+#define BCM4359_D11AC_ID	0x43d6		/* 4359 802.11ac dualband device */
+#define BCM4359_D11AC2G_ID	0x43d7		/* 4359 802.11ac 2.4G device */
+#define BCM4359_D11AC5G_ID	0x43d8		/* 4359 802.11ac 5G device */
+
+/* PCI Subsystem ID */
+#define BCM943228HMB_SSID_VEN1	0x0607
+#define BCM94313HMGBL_SSID_VEN1	0x0608
+#define BCM94313HMG_SSID_VEN1	0x0609
+#define BCM943142HM_SSID_VEN1	0x0611
+
+#define BCM43143_D11N2G_ID	0x4366		/* 43143 802.11n 2.4G device */
+
+#define BCM43242_D11N_ID	0x4367		/* 43242 802.11n dualband device */
+#define BCM43242_D11N2G_ID	0x4368		/* 43242 802.11n 2.4G device */
+#define BCM43242_D11N5G_ID	0x4369		/* 43242 802.11n 5G device */
+
+#define BCM4350_D11AC_ID	0x43a3
+#define BCM4350_D11AC2G_ID	0x43a4
+#define BCM4350_D11AC5G_ID	0x43a5
+
+#define BCM43556_D11AC_ID	0x43b7
+#define BCM43556_D11AC2G_ID	0x43b8
+#define BCM43556_D11AC5G_ID	0x43b9
+
+#define BCM43558_D11AC_ID	0x43c0
+#define BCM43558_D11AC2G_ID	0x43c1
+#define BCM43558_D11AC5G_ID	0x43c2
+
+#define BCM43566_D11AC_ID	0x43d3
+#define BCM43566_D11AC2G_ID	0x43d4
+#define BCM43566_D11AC5G_ID	0x43d5
+
+#define BCM43568_D11AC_ID	0x43d6
+#define BCM43568_D11AC2G_ID	0x43d7
+#define BCM43568_D11AC5G_ID	0x43d8
+
+#define BCM43569_D11AC_ID	0x43d9
+#define BCM43569_D11AC2G_ID	0x43da
+#define BCM43569_D11AC5G_ID	0x43db
+
+#define BCM43570_D11AC_ID	0x43d9
+#define BCM43570_D11AC2G_ID	0x43da
+#define BCM43570_D11AC5G_ID	0x43db
+
+#define BCM4354_D11AC_ID	0x43df		/* 4354 802.11ac dualband device */
+#define BCM4354_D11AC2G_ID	0x43e0		/* 4354 802.11ac 2.4G device */
+#define BCM4354_D11AC5G_ID	0x43e1		/* 4354 802.11ac 5G device */
+#define BCM43430_D11N2G_ID	0x43e2		/* 43430 802.11n 2.4G device */
+
+
+#define BCM43349_D11N_ID	0x43e6		/* 43349 802.11n dualband id */
+#define BCM43349_D11N2G_ID	0x43e7		/* 43349 802.11n 2.4Ghz band id */
+#define BCM43349_D11N5G_ID	0x43e8		/* 43349 802.11n 5Ghz band id */
+
+#define BCM4358_D11AC_ID        0x43e9          /* 4358 802.11ac dualband device */
+#define BCM4358_D11AC2G_ID      0x43ea          /* 4358 802.11ac 2.4G device */
+#define BCM4358_D11AC5G_ID      0x43eb          /* 4358 802.11ac 5G device */
+
+#define BCM4356_D11AC_ID	0x43ec		/* 4356 802.11ac dualband device */
+#define BCM4356_D11AC2G_ID	0x43ed		/* 4356 802.11ac 2.4G device */
+#define BCM4356_D11AC5G_ID	0x43ee		/* 4356 802.11ac 5G device */
+
+#define	BCMGPRS_UART_ID		0x4333		/* Uart id used by 4306/gprs card */
+#define	BCMGPRS2_UART_ID	0x4344		/* Uart id used by 4306/gprs card */
+#define FPGA_JTAGM_ID		0x43f0		/* FPGA jtagm device id */
+#define BCM_JTAGM_ID		0x43f1		/* BCM jtagm device id */
+#define SDIOH_FPGA_ID		0x43f2		/* sdio host fpga */
+#define BCM_SDIOH_ID		0x43f3		/* BCM sdio host id */
+#define SDIOD_FPGA_ID		0x43f4		/* sdio device fpga */
+#define SPIH_FPGA_ID		0x43f5		/* PCI SPI Host Controller FPGA */
+#define BCM_SPIH_ID		0x43f6		/* Synopsis SPI Host Controller */
+#define MIMO_FPGA_ID		0x43f8		/* FPGA mimo minimacphy device id */
+#define BCM_JTAGM2_ID		0x43f9		/* BCM alternate jtagm device id */
+#define SDHCI_FPGA_ID		0x43fa		/* Standard SDIO Host Controller FPGA */
+#define	BCM4402_ENET_ID		0x4402		/* 4402 enet */
+#define	BCM4402_V90_ID		0x4403		/* 4402 v90 codec */
+#define	BCM4410_DEVICE_ID	0x4410		/* bcm44xx family pci iline */
+#define	BCM4412_DEVICE_ID	0x4412		/* bcm44xx family pci enet */
+#define	BCM4430_DEVICE_ID	0x4430		/* bcm44xx family cardbus iline */
+#define	BCM4432_DEVICE_ID	0x4432		/* bcm44xx family cardbus enet */
+#define	BCM4704_ENET_ID		0x4706		/* 4704 enet (Use 47XX_ENET_ID instead!) */
+#define	BCM4710_DEVICE_ID	0x4710		/* 4710 primary function 0 */
+#define	BCM47XX_AUDIO_ID	0x4711		/* 47xx audio codec */
+#define	BCM47XX_V90_ID		0x4712		/* 47xx v90 codec */
+#define	BCM47XX_ENET_ID		0x4713		/* 47xx enet */
+#define	BCM47XX_EXT_ID		0x4714		/* 47xx external i/f */
+#define	BCM47XX_GMAC_ID		0x4715		/* 47xx Unimac based GbE */
+#define	BCM47XX_USBH_ID		0x4716		/* 47xx usb host */
+#define	BCM47XX_USBD_ID		0x4717		/* 47xx usb device */
+#define	BCM47XX_IPSEC_ID	0x4718		/* 47xx ipsec */
+#define	BCM47XX_ROBO_ID		0x4719		/* 47xx/53xx roboswitch core */
+#define	BCM47XX_USB20H_ID	0x471a		/* 47xx usb 2.0 host */
+#define	BCM47XX_USB20D_ID	0x471b		/* 47xx usb 2.0 device */
+#define	BCM47XX_ATA100_ID	0x471d		/* 47xx parallel ATA */
+#define	BCM47XX_SATAXOR_ID	0x471e		/* 47xx serial ATA & XOR DMA */
+#define	BCM47XX_GIGETH_ID	0x471f		/* 47xx GbE (5700) */
+#define	BCM4712_MIPS_ID		0x4720		/* 4712 base devid */
+#define	BCM4716_DEVICE_ID	0x4722		/* 4716 base devid */
+#define	BCM47XX_USB30H_ID	0x472a		/* 47xx usb 3.0 host */
+#define	BCM47XX_USB30D_ID	0x472b		/* 47xx usb 3.0 device */
+#define BCM47XX_SMBUS_EMU_ID	0x47fe		/* 47xx emulated SMBus device */
+#define	BCM47XX_XOR_EMU_ID	0x47ff		/* 47xx emulated XOR engine */
+#define	EPI41210_DEVICE_ID	0xa0fa		/* bcm4210 */
+#define	EPI41230_DEVICE_ID	0xa10e		/* bcm4230 */
+#define JINVANI_SDIOH_ID	0x4743		/* Jinvani SDIO Gold Host */
+#define BCM27XX_SDIOH_ID	0x2702		/* BCM27xx Standard SDIO Host */
+#define PCIXX21_FLASHMEDIA_ID	0x803b		/* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH_ID	0x803c		/* TI PCI xx21 Standard Host Controller */
+#define R5C822_SDIOH_ID		0x0822		/* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host */
+#define JMICRON_SDIOH_ID	0x2381		/* JMicron Standard SDIO Host Controller */
+
+/* Chip IDs */
+#define	BCM4306_CHIP_ID		0x4306		/* 4306 chipcommon chipid */
+#define	BCM4311_CHIP_ID		0x4311		/* 4311 PCIe 802.11a/b/g */
+#define	BCM43111_CHIP_ID	43111		/* 43111 chipcommon chipid (OTP chipid) */
+#define	BCM43112_CHIP_ID	43112		/* 43112 chipcommon chipid (OTP chipid) */
+#define	BCM4312_CHIP_ID		0x4312		/* 4312 chipcommon chipid */
+#define BCM4313_CHIP_ID		0x4313		/* 4313 chip id */
+#define	BCM43131_CHIP_ID	43131		/* 43131 chip id (OTP chipid) */
+#define	BCM4315_CHIP_ID		0x4315		/* 4315 chip id */
+#define	BCM4318_CHIP_ID		0x4318		/* 4318 chipcommon chipid */
+#define	BCM4319_CHIP_ID		0x4319		/* 4319 chip id */
+#define	BCM4320_CHIP_ID		0x4320		/* 4320 chipcommon chipid */
+#define	BCM4321_CHIP_ID		0x4321		/* 4321 chipcommon chipid */
+#define	BCM43217_CHIP_ID	43217		/* 43217 chip id (OTP chipid) */
+#define	BCM4322_CHIP_ID		0x4322		/* 4322 chipcommon chipid */
+#define	BCM43221_CHIP_ID	43221		/* 43221 chipcommon chipid (OTP chipid) */
+#define	BCM43222_CHIP_ID	43222		/* 43222 chipcommon chipid */
+#define	BCM43224_CHIP_ID	43224		/* 43224 chipcommon chipid */
+#define	BCM43225_CHIP_ID	43225		/* 43225 chipcommon chipid */
+#define	BCM43227_CHIP_ID	43227		/* 43227 chipcommon chipid */
+#define	BCM43228_CHIP_ID	43228		/* 43228 chipcommon chipid */
+#define	BCM43226_CHIP_ID	43226		/* 43226 chipcommon chipid */
+#define	BCM43231_CHIP_ID	43231		/* 43231 chipcommon chipid (OTP chipid) */
+#define	BCM43234_CHIP_ID	43234		/* 43234 chipcommon chipid */
+#define	BCM43235_CHIP_ID	43235		/* 43235 chipcommon chipid */
+#define	BCM43236_CHIP_ID	43236		/* 43236 chipcommon chipid */
+#define	BCM43237_CHIP_ID	43237		/* 43237 chipcommon chipid */
+#define	BCM43238_CHIP_ID	43238		/* 43238 chipcommon chipid */
+#define	BCM43239_CHIP_ID	43239		/* 43239 chipcommon chipid */
+#define	BCM43420_CHIP_ID	43420		/* 43222 chipcommon chipid (OTP, RBBU) */
+#define	BCM43421_CHIP_ID	43421		/* 43224 chipcommon chipid (OTP, RBBU) */
+#define	BCM43428_CHIP_ID	43428		/* 43228 chipcommon chipid (OTP, RBBU) */
+#define	BCM43431_CHIP_ID	43431		/* 4331  chipcommon chipid (OTP, RBBU) */
+#define	BCM43460_CHIP_ID	43460		/* 4360  chipcommon chipid (OTP, RBBU) */
+#define	BCM4325_CHIP_ID		0x4325		/* 4325 chip id */
+#define	BCM4328_CHIP_ID		0x4328		/* 4328 chip id */
+#define	BCM4329_CHIP_ID		0x4329		/* 4329 chipcommon chipid */
+#define	BCM4331_CHIP_ID		0x4331		/* 4331 chipcommon chipid */
+#define BCM4336_CHIP_ID		0x4336		/* 4336 chipcommon chipid */
+#define BCM43362_CHIP_ID	43362		/* 43362 chipcommon chipid */
+#define BCM4330_CHIP_ID		0x4330		/* 4330 chipcommon chipid */
+#define BCM6362_CHIP_ID		0x6362		/* 6362 chipcommon chipid */
+#define BCM4314_CHIP_ID		0x4314		/* 4314 chipcommon chipid */
+#define BCM43142_CHIP_ID	43142		/* 43142 chipcommon chipid */
+#define BCM43143_CHIP_ID	43143		/* 43143 chipcommon chipid */
+#define	BCM4324_CHIP_ID		0x4324		/* 4324 chipcommon chipid */
+#define	BCM43242_CHIP_ID	43242		/* 43242 chipcommon chipid */
+#define	BCM43243_CHIP_ID	43243		/* 43243 chipcommon chipid */
+#define BCM4334_CHIP_ID		0x4334		/* 4334 chipcommon chipid */
+#define BCM4335_CHIP_ID		0x4335		/* 4335 chipcommon chipid */
+#define BCM4339_CHIP_ID		0x4339		/* 4339 chipcommon chipid */
+#define BCM43349_CHIP_ID	43349			/* 43349(0xA955) chipcommon chipid */
+#define BCM4360_CHIP_ID		0x4360          /* 4360 chipcommon chipid */
+#define BCM4352_CHIP_ID		0x4352          /* 4352 chipcommon chipid */
+#define BCM43526_CHIP_ID	0xAA06
+#define BCM43340_CHIP_ID	43340		/* 43340 chipcommon chipid */
+#define BCM43341_CHIP_ID	43341		/* 43341 chipcommon chipid */
+#define BCM43342_CHIP_ID	43342		/* 43342 chipcommon chipid */
+#define BCM4350_CHIP_ID		0x4350          /* 4350 chipcommon chipid */
+#define BCM4354_CHIP_ID		0x4354          /* 4354 chipcommon chipid */
+#define BCM4356_CHIP_ID		0x4356          /* 4356 chipcommon chipid */
+#define BCM43556_CHIP_ID	0xAA24          /* 43556 chipcommon chipid */
+#define BCM43558_CHIP_ID	0xAA26          /* 43558 chipcommon chipid */
+#define BCM43566_CHIP_ID	0xAA2E          /* 43566 chipcommon chipid */
+#define BCM43567_CHIP_ID	0xAA2F          /* 43567 chipcommon chipid */
+#define BCM43568_CHIP_ID	0xAA30          /* 43568 chipcommon chipid */
+#define BCM43569_CHIP_ID	0xAA31          /* 43569 chipcommon chipid */
+#define BCM43570_CHIP_ID	0xAA32          /* 43570 chipcommon chipid */
+#define BCM4358_CHIP_ID         0x4358          /* 4358 chipcommon chipid */
+#define BCM4371_CHIP_ID		0x4371          /* 4371 chipcommon chipid */
+#define BCM4350_CHIP(chipid)	((CHIPID(chipid) == BCM4350_CHIP_ID) || \
+				(CHIPID(chipid) == BCM4354_CHIP_ID) || \
+				(CHIPID(chipid) == BCM4356_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43556_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43558_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43566_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43567_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43568_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43569_CHIP_ID) || \
+				(CHIPID(chipid) == BCM43570_CHIP_ID) || \
+				(CHIPID(chipid) == BCM4358_CHIP_ID)) /* 4350 variations */
+#define BCM4345_CHIP_ID		0x4345		/* 4345 chipcommon chipid */
+#define BCM43430_CHIP_ID	43430		/* 43430 chipcommon chipid */
+#define BCM4349_CHIP_ID		0x4349		/* 4349 chipcommon chipid */
+#define BCM4355_CHIP_ID		0x4355		/* 4355 chipcommon chipid */
+#define BCM4359_CHIP_ID		0x4359		/* 4359 chipcommon chipid */
+#define BCM4349_CHIP(chipid)	((CHIPID(chipid) == BCM4349_CHIP_ID) || \
+				(CHIPID(chipid) == BCM4355_CHIP_ID) || \
+				(CHIPID(chipid) == BCM4359_CHIP_ID))
+#define BCM4349_CHIP_GRPID		BCM4349_CHIP_ID: \
+					case BCM4355_CHIP_ID: \
+					case BCM4359_CHIP_ID
+
+#define BCM43602_CHIP_ID	0xaa52		/* 43602 chipcommon chipid */
+#define BCM43462_CHIP_ID	0xa9c6		/* 43462 chipcommon chipid */
+
+#define	BCM4342_CHIP_ID		4342		/* 4342 chipcommon chipid (OTP, RBBU) */
+#define	BCM4402_CHIP_ID		0x4402		/* 4402 chipid */
+#define	BCM4704_CHIP_ID		0x4704		/* 4704 chipcommon chipid */
+#define	BCM4706_CHIP_ID		0x5300		/* 4706 chipcommon chipid */
+#define BCM4707_CHIP_ID		53010		/* 4707 chipcommon chipid */
+#define BCM53018_CHIP_ID	53018		/* 53018 chipcommon chipid */
+#define BCM4707_CHIP(chipid)	(((chipid) == BCM4707_CHIP_ID) || ((chipid) == BCM53018_CHIP_ID))
+#define	BCM4710_CHIP_ID		0x4710		/* 4710 chipid */
+#define	BCM4712_CHIP_ID		0x4712		/* 4712 chipcommon chipid */
+#define	BCM4716_CHIP_ID		0x4716		/* 4716 chipcommon chipid */
+#define	BCM47162_CHIP_ID	47162		/* 47162 chipcommon chipid */
+#define	BCM4748_CHIP_ID		0x4748		/* 4716 chipcommon chipid (OTP, RBBU) */
+#define	BCM4749_CHIP_ID		0x4749		/* 5357 chipcommon chipid (OTP, RBBU) */
+#define BCM4785_CHIP_ID		0x4785		/* 4785 chipcommon chipid */
+#define	BCM5350_CHIP_ID		0x5350		/* 5350 chipcommon chipid */
+#define	BCM5352_CHIP_ID		0x5352		/* 5352 chipcommon chipid */
+#define	BCM5354_CHIP_ID		0x5354		/* 5354 chipcommon chipid */
+#define BCM5365_CHIP_ID		0x5365		/* 5365 chipcommon chipid */
+#define	BCM5356_CHIP_ID		0x5356		/* 5356 chipcommon chipid */
+#define	BCM5357_CHIP_ID		0x5357		/* 5357 chipcommon chipid */
+#define	BCM53572_CHIP_ID	53572		/* 53572 chipcommon chipid */
+
+/* Package IDs */
+#define	BCM4303_PKG_ID		2		/* 4303 package id */
+#define	BCM4309_PKG_ID		1		/* 4309 package id */
+#define	BCM4712LARGE_PKG_ID	0		/* 340pin 4712 package id */
+#define	BCM4712SMALL_PKG_ID	1		/* 200pin 4712 package id */
+#define	BCM4712MID_PKG_ID	2		/* 225pin 4712 package id */
+#define BCM4328USBD11G_PKG_ID	2		/* 4328 802.11g USB package id */
+#define BCM4328USBDUAL_PKG_ID	3		/* 4328 802.11a/g USB package id */
+#define BCM4328SDIOD11G_PKG_ID	4		/* 4328 802.11g SDIO package id */
+#define BCM4328SDIODUAL_PKG_ID	5		/* 4328 802.11a/g SDIO package id */
+#define BCM4329_289PIN_PKG_ID	0		/* 4329 289-pin package id */
+#define BCM4329_182PIN_PKG_ID	1		/* 4329N 182-pin package id */
+#define BCM5354E_PKG_ID		1		/* 5354E package id */
+#define	BCM4716_PKG_ID		8		/* 4716 package id */
+#define	BCM4717_PKG_ID		9		/* 4717 package id */
+#define	BCM4718_PKG_ID		10		/* 4718 package id */
+#define BCM5356_PKG_NONMODE	1		/* 5356 package without nmode suppport */
+#define BCM5358U_PKG_ID		8		/* 5358U package id */
+#define BCM5358_PKG_ID		9		/* 5358 package id */
+#define BCM47186_PKG_ID		10		/* 47186 package id */
+#define BCM5357_PKG_ID		11		/* 5357 package id */
+#define BCM5356U_PKG_ID		12		/* 5356U package id */
+#define BCM53572_PKG_ID		8		/* 53572 package id */
+#define BCM5357C0_PKG_ID	8		/* 5357c0 package id (the same as 53572) */
+#define BCM47188_PKG_ID		9		/* 47188 package id */
+#define BCM5358C0_PKG_ID	0xa		/* 5358c0 package id */
+#define BCM5356C0_PKG_ID	0xb		/* 5356c0 package id */
+#define BCM4331TT_PKG_ID        8		/* 4331 12x12 package id */
+#define BCM4331TN_PKG_ID        9		/* 4331 12x9 package id */
+#define BCM4331TNA0_PKG_ID     0xb		/* 4331 12x9 package id */
+#define	BCM4706L_PKG_ID		1		/* 4706L package id */
+
+#define HDLSIM5350_PKG_ID	1		/* HDL simulator package id for a 5350 */
+#define HDLSIM_PKG_ID		14		/* HDL simulator package id */
+#define HWSIM_PKG_ID		15		/* Hardware simulator package id */
+#define BCM43224_FAB_CSM	0x8		/* the chip is manufactured by CSM */
+#define BCM43224_FAB_SMIC	0xa		/* the chip is manufactured by SMIC */
+#define BCM4336_WLBGA_PKG_ID	0x8
+#define BCM4330_WLBGA_PKG_ID	0x0
+#define BCM4314PCIE_ARM_PKG_ID		(8 | 0)	/* 4314 QFN PCI package id, bit 3 tie high */
+#define BCM4314SDIO_PKG_ID		(8 | 1)	/* 4314 QFN SDIO package id */
+#define BCM4314PCIE_PKG_ID		(8 | 2)	/* 4314 QFN PCI (ARM-less) package id */
+#define BCM4314SDIO_ARM_PKG_ID		(8 | 3)	/* 4314 QFN SDIO (ARM-less) package id */
+#define BCM4314SDIO_FPBGA_PKG_ID	(8 | 4)	/* 4314 FpBGA SDIO package id */
+#define BCM4314DEV_PKG_ID		(8 | 6)	/* 4314 Developement package id */
+
+#define BCM4707_PKG_ID		1		/* 4707 package id */
+#define BCM4708_PKG_ID		2		/* 4708 package id */
+#define BCM4709_PKG_ID		0		/* 4709 package id */
+
+#define PCIXX21_FLASHMEDIA0_ID	0x8033		/* TI PCI xx21 Standard Host Controller */
+#define PCIXX21_SDIOH0_ID	0x8034		/* TI PCI xx21 Standard Host Controller */
+
+#define BCM4335_WLCSP_PKG_ID	(0x0)	/* WLCSP Module/Mobile SDIO/HSIC. */
+#define BCM4335_FCBGA_PKG_ID	(0x1)	/* FCBGA PC/Embeded/Media PCIE/SDIO */
+#define BCM4335_WLBGA_PKG_ID	(0x2)	/* WLBGA COB/Mobile SDIO/HSIC. */
+#define BCM4335_FCBGAD_PKG_ID	(0x3)	/* FCBGA Debug Debug/Dev All if's. */
+#define BCM4335_PKG_MASK	(0x3)
+
+/* boardflags */
+#define	BFL_BTC2WIRE		0x00000001  /* old 2wire Bluetooth coexistence, OBSOLETE */
+#define BFL_BTCOEX      0x00000001      /* Board supports BTCOEX */
+#define	BFL_PACTRL		0x00000002  /* Board has gpio 9 controlling the PA */
+#define BFL_AIRLINEMODE	0x00000004  /* Board implements gpio 13 radio disable indication, UNUSED */
+#define	BFL_ADCDIV		0x00000008  /* Board has the rssi ADC divider */
+#define BFL_DIS_256QAM		0x00000008
+#define	BFL_ENETROBO		0x00000010  /* Board has robo switch or core */
+#define	BFL_TSSIAVG   		0x00000010  /* TSSI averaging for ACPHY chips */
+#define	BFL_NOPLLDOWN		0x00000020  /* Not ok to power down the chip pll and oscillator */
+#define	BFL_CCKHIPWR		0x00000040  /* Can do high-power CCK transmission */
+#define	BFL_ENETADM		0x00000080  /* Board has ADMtek switch */
+#define	BFL_ENETVLAN		0x00000100  /* Board has VLAN capability */
+#define	BFL_LTECOEX		0x00000200  /* LTE Coex enabled */
+#define BFL_NOPCI		0x00000400  /* Board leaves PCI floating */
+#define BFL_FEM			0x00000800  /* Board supports the Front End Module */
+#define BFL_EXTLNA		0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_HGPA		0x00002000  /* Board has a high gain PA */
+#define	BFL_BTC2WIRE_ALTGPIO	0x00004000  /* Board's BTC 2wire is in the alternate gpios */
+#define	BFL_ALTIQ		0x00008000  /* Alternate I/Q settings */
+#define BFL_NOPA		0x00010000  /* Board has no PA */
+#define BFL_RSSIINV		0x00020000  /* Board's RSSI uses positive slope(not TSSI) */
+#define BFL_PAREF		0x00040000  /* Board uses the PARef LDO */
+#define BFL_3TSWITCH		0x00080000  /* Board uses a triple throw switch shared with BT */
+#define BFL_PHASESHIFT		0x00100000  /* Board can support phase shifter */
+#define BFL_BUCKBOOST		0x00200000  /* Power topology uses BUCKBOOST */
+#define BFL_FEM_BT		0x00400000  /* Board has FEM and switch to share antenna w/ BT */
+#define BFL_NOCBUCK		0x00800000  /* Power topology doesn't use CBUCK */
+#define BFL_CCKFAVOREVM		0x01000000  /* Favor CCK EVM over spectral mask */
+#define BFL_PALDO		0x02000000  /* Power topology uses PALDO */
+#define BFL_LNLDO2_2P5		0x04000000  /* Select 2.5V as LNLDO2 output voltage */
+#define BFL_FASTPWR		0x08000000
+#define BFL_UCPWRCTL_MININDX	0x08000000  /* Enforce min power index to avoid FEM damage */
+#define BFL_EXTLNA_5GHz		0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_TRSW_1by2		0x20000000  /* Board has 2 TRSW's in 1by2 designs */
+#define BFL_GAINBOOSTA01        0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL_LO_TRSW_R_5GHz	0x40000000  /* In 5G do not throw TRSW to T for clipLO gain */
+#define BFL_ELNA_GAINDEF	0x80000000  /* Backoff InitGain based on elna_2g/5g field
+					     * when this flag is set
+					     */
+#define BFL_EXTLNA_TX	0x20000000	/* Temp boardflag to indicate to */
+
+/* boardflags2 */
+#define BFL2_RXBB_INT_REG_DIS	0x00000001  /* Board has an external rxbb regulator */
+#define BFL2_APLL_WAR		0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_TXPWRCTRL_EN	0x00000004  /* Board permits enabling TX Power Control */
+#define BFL2_2X4_DIV		0x00000008  /* Board supports the 2X4 diversity switch */
+#define BFL2_5G_PWRGAIN		0x00000010  /* Board supports 5G band power gain */
+#define BFL2_PCIEWAR_OVR	0x00000020  /* Board overrides ASPM and Clkreq settings */
+#define BFL2_CAESERS_BRD	0x00000040  /* Board is Caesers brd (unused by sw) */
+#define BFL2_BTC3WIRE		0x00000080  /* Board support legacy 3 wire or 4 wire */
+#define BFL2_BTCLEGACY          0x00000080  /* Board support legacy 3/4 wire, to replace
+					     * BFL2_BTC3WIRE
+					     */
+#define BFL2_SKWRKFEM_BRD	0x00000100  /* 4321mcm93 board uses Skyworks FEM */
+#define BFL2_SPUR_WAR		0x00000200  /* Board has a WAR for clock-harmonic spurs */
+#define BFL2_GPLL_WAR		0x00000400  /* Flag to narrow G-band PLL loop b/w */
+#define BFL2_TRISTATE_LED	0x00000800  /* Tri-state the LED */
+#define BFL2_SINGLEANT_CCK	0x00001000  /* Tx CCK pkts on Ant 0 only */
+#define BFL2_2G_SPUR_WAR	0x00002000  /* WAR to reduce and avoid clock-harmonic spurs in 2G */
+#define BFL2_BPHY_ALL_TXCORES	0x00004000  /* Transmit bphy frames using all tx cores */
+#define BFL2_FCC_BANDEDGE_WAR	0x00008000  /* Activates WAR to improve FCC bandedge performance */
+#define BFL2_DAC_SPUR_IMPROVEMENT 0x00008000       /* Reducing DAC Spurs */
+#define BFL2_GPLL_WAR2	        0x00010000  /* Flag to widen G-band PLL loop b/w */
+#define BFL2_REDUCED_PA_TURNONTIME 0x00010000  /* Flag to reduce PA turn on Time */
+#define BFL2_IPALVLSHIFT_3P3    0x00020000
+#define BFL2_INTERNDET_TXIQCAL  0x00040000  /* Use internal envelope detector for TX IQCAL */
+#define BFL2_XTALBUFOUTEN       0x00080000  /* Keep the buffered Xtal output from radio on */
+				/* Most drivers will turn it off without this flag */
+				/* to save power. */
+
+#define BFL2_ANAPACTRL_2G	0x00100000  /* 2G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ANAPACTRL_5G	0x00200000  /* 5G ext PAs are controlled by analog PA ctrl lines */
+#define BFL2_ELNACTRL_TRSW_2G	0x00400000  /* AZW4329: 2G gmode_elna_gain controls TR Switch */
+#define BFL2_BT_SHARE_ANT0	0x00800000  /* share core0 antenna with BT */
+#define BFL2_TEMPSENSE_HIGHER	0x01000000  /* The tempsense threshold can sustain higher value
+					     * than programmed. The exact delta is decided by
+					     * driver per chip/boardtype. This can be used
+					     * when tempsense qualification happens after shipment
+					     */
+#define BFL2_BTC3WIREONLY       0x02000000  /* standard 3 wire btc only.  4 wire not supported */
+#define BFL2_PWR_NOMINAL	0x04000000  /* 0: power reduction on, 1: no power reduction */
+#define BFL2_EXTLNA_PWRSAVE	0x08000000  /* boardflag to enable ucode to apply power save */
+						/* ucode control of eLNA during Tx */
+#define BFL2_4313_RADIOREG	0x10000000
+									   /*  board rework */
+#define BFL2_DYNAMIC_VMID	0x10000000  /* enable dynamic Vmid in idle TSSI CAL for 4331 */
+
+#define BFL2_SDR_EN		0x20000000  /* SDR enabled or disabled */
+#define BFL2_DYNAMIC_VMID	0x10000000  /* boardflag to enable dynamic Vmid idle TSSI CAL */
+#define BFL2_LNA1BYPFORTR2G	0x40000000  /* acphy, enable lna1 bypass for clip gain, 2g */
+#define BFL2_LNA1BYPFORTR5G	0x80000000  /* acphy, enable lna1 bypass for clip gain, 5g */
+
+/* SROM 11 - 11ac boardflag definitions */
+#define BFL_SROM11_BTCOEX  0x00000001  /* Board supports BTCOEX */
+#define BFL_SROM11_WLAN_BT_SH_XTL  0x00000002  /* bluetooth and wlan share same crystal */
+#define BFL_SROM11_EXTLNA	0x00001000  /* Board has an external LNA in 2.4GHz band */
+#define BFL_SROM11_EPA_TURNON_TIME     0x00018000  /* 2 bits for different PA turn on times */
+#define BFL_SROM11_EPA_TURNON_TIME_SHIFT  15
+#define BFL_SROM11_EXTLNA_5GHz	0x10000000  /* Board has an external LNA in 5GHz band */
+#define BFL_SROM11_GAINBOOSTA01	0x20000000  /* 5g Gainboost for core0 and core1 */
+#define BFL2_SROM11_APLL_WAR	0x00000002  /* Flag to implement alternative A-band PLL settings */
+#define BFL2_SROM11_ANAPACTRL_2G  0x00100000  /* 2G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_ANAPACTRL_5G  0x00200000  /* 5G ext PAs are ctrl-ed by analog PA ctrl lines */
+#define BFL2_SROM11_SINGLEANT_CCK	0x00001000  /* Tx CCK pkts on Ant 0 only */
+
+/* boardflags3 */
+#define BFL3_FEMCTRL_SUB	  0x00000007  /* acphy, subrevs of femctrl on top of srom_femctrl */
+#define BFL3_RCAL_WAR		  0x00000008  /* acphy, rcal war active on this board (4335a0) */
+#define BFL3_TXGAINTBLID	  0x00000070  /* acphy, txgain table id */
+#define BFL3_TXGAINTBLID_SHIFT	  0x4         /* acphy, txgain table id shift bit */
+#define BFL3_TSSI_DIV_WAR	  0x00000080  /* acphy, Seperate paparam for 20/40/80 */
+#define BFL3_TSSI_DIV_WAR_SHIFT	  0x7         /* acphy, Seperate paparam for 20/40/80 shift bit */
+#define BFL3_FEMTBL_FROM_NVRAM    0x00000100  /* acphy, femctrl table is read from nvram */
+#define BFL3_FEMTBL_FROM_NVRAM_SHIFT 0x8         /* acphy, femctrl table is read from nvram */
+#define BFL3_AGC_CFG_2G           0x00000200  /* acphy, gain control configuration for 2G */
+#define BFL3_AGC_CFG_5G           0x00000400  /* acphy, gain control configuration for 5G */
+#define BFL3_PPR_BIT_EXT          0x00000800  /* acphy, bit position for 1bit extension for ppr */
+#define BFL3_PPR_BIT_EXT_SHIFT    11          /* acphy, bit shift for 1bit extension for ppr */
+#define BFL3_BBPLL_SPR_MODE_DIS	  0x00001000  /* acphy, disables bbpll spur modes */
+#define BFL3_RCAL_OTP_VAL_EN      0x00002000  /* acphy, to read rcal_trim value from otp */
+#define BFL3_2GTXGAINTBL_BLANK	  0x00004000  /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_2GTXGAINTBL_BLANK_SHIFT 14       /* acphy, blank the first X ticks of 2g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK	  0x00008000  /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_5GTXGAINTBL_BLANK_SHIFT 15       /* acphy, blank the first X ticks of 5g gaintbl */
+#define BFL3_PHASETRACK_MAX_ALPHABETA	  0x00010000  /* acphy, to max out alpha,beta to 511 */
+#define BFL3_PHASETRACK_MAX_ALPHABETA_SHIFT 16       /* acphy, to max out alpha,beta to 511 */
+/* acphy, to use backed off gaintbl for lte-coex */
+#define BFL3_LTECOEX_GAINTBL_EN           0x00060000
+/* acphy, to use backed off gaintbl for lte-coex */
+#define BFL3_LTECOEX_GAINTBL_EN_SHIFT 17
+#define BFL3_5G_SPUR_WAR          0x00080000  /* acphy, enable spur WAR in 5G band */
+#define BFL3_1X1_RSDB_ANT	  0x01000000  /* to find if 2-ant RSDB board or 1-ant RSDB board */
+#define BFL3_1X1_RSDB_ANT_SHIFT           24
+
+/* acphy: lpmode2g and lpmode_5g related boardflags */
+#define BFL3_ACPHY_LPMODE_2G	  0x00300000  /* bits 20:21 for lpmode_2g choice */
+#define BFL3_ACPHY_LPMODE_2G_SHIFT	  20
+
+#define BFL3_ACPHY_LPMODE_5G	  0x00C00000  /* bits 22:23 for lpmode_5g choice */
+#define BFL3_ACPHY_LPMODE_5G_SHIFT	  22
+
+#define BFL3_EXT_LPO_ISCLOCK      0x02000000  /* External LPO is clock, not x-tal */
+#define BFL3_FORCE_INT_LPO_SEL    0x04000000  /* Force internal lpo */
+#define BFL3_FORCE_EXT_LPO_SEL    0x08000000  /* Force external lpo */
+
+#define BFL3_EN_BRCM_IMPBF        0x10000000  /* acphy, Allow BRCM Implicit TxBF */
+#define BFL3_AVVMID_FROM_NVRAM    0x40000000  /* Read Av Vmid from NVRAM  */
+#define BFL3_VLIN_EN_FROM_NVRAM    0x80000000  /* Read Vlin En from NVRAM  */
+
+#define BFL3_AVVMID_FROM_NVRAM_SHIFT   30   /* Read Av Vmid from NVRAM  */
+#define BFL3_VLIN_EN_FROM_NVRAM_SHIFT   31   /* Enable Vlin  from NVRAM  */
+
+
+/* board specific GPIO assignment, gpio 0-3 are also customer-configurable led */
+#define	BOARD_GPIO_BTC3W_IN	0x850	/* bit 4 is RF_ACTIVE, bit 6 is STATUS, bit 11 is PRI */
+#define	BOARD_GPIO_BTC3W_OUT	0x020	/* bit 5 is TX_CONF */
+#define	BOARD_GPIO_BTCMOD_IN	0x010	/* bit 4 is the alternate BT Coexistence Input */
+#define	BOARD_GPIO_BTCMOD_OUT	0x020	/* bit 5 is the alternate BT Coexistence Out */
+#define	BOARD_GPIO_BTC_IN	0x080	/* bit 7 is BT Coexistence Input */
+#define	BOARD_GPIO_BTC_OUT	0x100	/* bit 8 is BT Coexistence Out */
+#define	BOARD_GPIO_PACTRL	0x200	/* bit 9 controls the PA on new 4306 boards */
+#define BOARD_GPIO_12		0x1000	/* gpio 12 */
+#define BOARD_GPIO_13		0x2000	/* gpio 13 */
+#define BOARD_GPIO_BTC4_IN	0x0800	/* gpio 11, coex4, in */
+#define BOARD_GPIO_BTC4_BT	0x2000	/* gpio 12, coex4, bt active */
+#define BOARD_GPIO_BTC4_STAT	0x4000	/* gpio 14, coex4, status */
+#define BOARD_GPIO_BTC4_WLAN	0x8000	/* gpio 15, coex4, wlan active */
+#define	BOARD_GPIO_1_WLAN_PWR	0x02	/* throttle WLAN power on X21 board */
+#define	BOARD_GPIO_2_WLAN_PWR	0x04	/* throttle WLAN power on X29C board */
+#define	BOARD_GPIO_3_WLAN_PWR	0x08	/* throttle WLAN power on X28 board */
+#define	BOARD_GPIO_4_WLAN_PWR	0x10	/* throttle WLAN power on X19 board */
+
+#define GPIO_BTC4W_OUT_4312  0x010  /* bit 4 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43224  0x020  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43224_SHARED  0x0e0  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_43225  0x0e0  /* bit 5 BT_IODISABLE, bit 6 SW_BT, bit 7 SW_WL */
+#define GPIO_BTC4W_OUT_43421  0x020  /* bit 5 is BT_IODISABLE */
+#define GPIO_BTC4W_OUT_4313  0x060  /* bit 5 SW_BT, bit 6 SW_WL */
+#define GPIO_BTC4W_OUT_4331_SHARED  0x010  /* GPIO 4  */
+
+#define	PCI_CFG_GPIO_SCS	0x10	/* PCI config space bit 4 for 4306c0 slow clock source */
+#define PCI_CFG_GPIO_HWRAD	0x20	/* PCI config space GPIO 13 for hw radio disable */
+#define PCI_CFG_GPIO_XTAL	0x40	/* PCI config space GPIO 14 for Xtal power-up */
+#define PCI_CFG_GPIO_PLL	0x80	/* PCI config space GPIO 15 for PLL power-down */
+
+/* power control defines */
+#define PLL_DELAY		150		/* us pll on delay */
+#define FREF_DELAY		200		/* us fref change delay */
+#define MIN_SLOW_CLK		32		/* us Slow clock period */
+#define	XTAL_ON_DELAY		1000		/* us crystal power-on delay */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* Reference Board Types */
+#define	BU4710_BOARD		0x0400
+#define	VSIM4710_BOARD		0x0401
+#define	QT4710_BOARD		0x0402
+
+#define	BU4309_BOARD		0x040a
+#define	BCM94309CB_BOARD	0x040b
+#define	BCM94309MP_BOARD	0x040c
+#define	BCM4309AP_BOARD		0x040d
+
+#define	BCM94302MP_BOARD	0x040e
+
+#define	BU4306_BOARD		0x0416
+#define	BCM94306CB_BOARD	0x0417
+#define	BCM94306MP_BOARD	0x0418
+
+#define	BCM94710D_BOARD		0x041a
+#define	BCM94710R1_BOARD	0x041b
+#define	BCM94710R4_BOARD	0x041c
+#define	BCM94710AP_BOARD	0x041d
+
+#define	BU2050_BOARD		0x041f
+
+#define	BCM94306P50_BOARD	0x0420
+
+#define	BCM94309G_BOARD		0x0421
+
+#define	BU4704_BOARD		0x0423
+#define	BU4702_BOARD		0x0424
+
+#define	BCM94306PC_BOARD	0x0425		/* pcmcia 3.3v 4306 card */
+
+#define	MPSG4306_BOARD		0x0427
+
+#define	BCM94702MN_BOARD	0x0428
+
+/* BCM4702 1U CompactPCI Board */
+#define	BCM94702CPCI_BOARD	0x0429
+
+/* BCM4702 with BCM95380 VLAN Router */
+#define	BCM95380RR_BOARD	0x042a
+
+/* cb4306 with SiGe PA */
+#define	BCM94306CBSG_BOARD	0x042b
+
+/* cb4306 with SiGe PA */
+#define	PCSG94306_BOARD		0x042d
+
+/* bu4704 with sdram */
+#define	BU4704SD_BOARD		0x042e
+
+/* Dual 11a/11g Router */
+#define	BCM94704AGR_BOARD	0x042f
+
+/* 11a-only minipci */
+#define	BCM94308MP_BOARD	0x0430
+
+/* 4306/gprs combo */
+#define	BCM94306GPRS_BOARD	0x0432
+
+/* BCM5365/BCM4704 FPGA Bringup Board */
+#define BU5365_FPGA_BOARD	0x0433
+
+#define BU4712_BOARD		0x0444
+#define	BU4712SD_BOARD		0x045d
+#define	BU4712L_BOARD		0x045f
+
+/* BCM4712 boards */
+#define BCM94712AP_BOARD	0x0445
+#define BCM94712P_BOARD		0x0446
+
+/* BCM4318 boards */
+#define BU4318_BOARD		0x0447
+#define CB4318_BOARD		0x0448
+#define MPG4318_BOARD		0x0449
+#define MP4318_BOARD		0x044a
+#define SD4318_BOARD		0x044b
+
+/* BCM4313 boards */
+#define BCM94313BU_BOARD	0x050f
+#define BCM94313HM_BOARD	0x0510
+#define BCM94313EPA_BOARD	0x0511
+#define BCM94313HMG_BOARD       0x051C
+
+/* BCM63XX boards */
+#define BCM96338_BOARD		0x6338
+#define BCM96348_BOARD		0x6348
+#define BCM96358_BOARD		0x6358
+#define BCM96368_BOARD		0x6368
+
+/* Another mp4306 with SiGe */
+#define	BCM94306P_BOARD		0x044c
+
+/* mp4303 */
+#define	BCM94303MP_BOARD	0x044e
+
+/* mpsgh4306 */
+#define	BCM94306MPSGH_BOARD	0x044f
+
+/* BRCM 4306 w/ Front End Modules */
+#define BCM94306MPM		0x0450
+#define BCM94306MPL		0x0453
+
+/* 4712agr */
+#define	BCM94712AGR_BOARD	0x0451
+
+/* pcmcia 4303 */
+#define	PC4303_BOARD		0x0454
+
+/* 5350K */
+#define	BCM95350K_BOARD		0x0455
+
+/* 5350R */
+#define	BCM95350R_BOARD		0x0456
+
+/* 4306mplna */
+#define	BCM94306MPLNA_BOARD	0x0457
+
+/* 4320 boards */
+#define	BU4320_BOARD		0x0458
+#define	BU4320S_BOARD		0x0459
+#define	BCM94320PH_BOARD	0x045a
+
+/* 4306mph */
+#define	BCM94306MPH_BOARD	0x045b
+
+/* 4306pciv */
+#define	BCM94306PCIV_BOARD	0x045c
+
+#define	BU4712SD_BOARD		0x045d
+
+#define	BCM94320PFLSH_BOARD	0x045e
+
+#define	BU4712L_BOARD		0x045f
+#define	BCM94712LGR_BOARD	0x0460
+#define	BCM94320R_BOARD		0x0461
+
+#define	BU5352_BOARD		0x0462
+
+#define	BCM94318MPGH_BOARD	0x0463
+
+#define	BU4311_BOARD		0x0464
+#define	BCM94311MC_BOARD	0x0465
+#define	BCM94311MCAG_BOARD	0x0466
+
+#define	BCM95352GR_BOARD	0x0467
+
+/* bcm95351agr */
+#define	BCM95351AGR_BOARD	0x0470
+
+/* bcm94704mpcb */
+#define	BCM94704MPCB_BOARD	0x0472
+
+/* 4785 boards */
+#define BU4785_BOARD		0x0478
+
+/* 4321 boards */
+#define BU4321_BOARD		0x046b
+#define BU4321E_BOARD		0x047c
+#define MP4321_BOARD		0x046c
+#define CB2_4321_BOARD		0x046d
+#define CB2_4321_AG_BOARD	0x0066
+#define MC4321_BOARD		0x046e
+
+/* 4328 boards */
+#define BU4328_BOARD		0x0481
+#define BCM4328SDG_BOARD	0x0482
+#define BCM4328SDAG_BOARD	0x0483
+#define BCM4328UG_BOARD		0x0484
+#define BCM4328UAG_BOARD	0x0485
+#define BCM4328PC_BOARD		0x0486
+#define BCM4328CF_BOARD		0x0487
+
+/* 4325 boards */
+#define BCM94325DEVBU_BOARD	0x0490
+#define BCM94325BGABU_BOARD	0x0491
+
+#define BCM94325SDGWB_BOARD	0x0492
+
+#define BCM94325SDGMDL_BOARD	0x04aa
+#define BCM94325SDGMDL2_BOARD	0x04c6
+#define BCM94325SDGMDL3_BOARD	0x04c9
+
+#define BCM94325SDABGWBA_BOARD	0x04e1
+
+/* 4322 boards */
+#define BCM94322MC_SSID		0x04a4
+#define BCM94322USB_SSID	0x04a8	/* dualband */
+#define BCM94322HM_SSID		0x04b0
+#define BCM94322USB2D_SSID	0x04bf	/* single band discrete front end */
+
+/* 4312 boards */
+#define	BCM4312MCGSG_BOARD	0x04b5
+
+/* 4315 boards */
+#define BCM94315DEVBU_SSID	0x04c2
+#define BCM94315USBGP_SSID	0x04c7
+#define BCM94315BGABU_SSID	0x04ca
+#define BCM94315USBGP41_SSID	0x04cb
+
+/* 4319 boards */
+#define BCM94319DEVBU_SSID	0X04e5
+#define BCM94319USB_SSID	0X04e6
+#define BCM94319SD_SSID		0X04e7
+
+/* 4716 boards */
+#define BCM94716NR2_SSID	0x04cd
+
+/* 4319 boards */
+#define BCM94319DEVBU_SSID	0X04e5
+#define BCM94319USBNP4L_SSID	0X04e6
+#define BCM94319WLUSBN4L_SSID	0X04e7
+#define BCM94319SDG_SSID	0X04ea
+#define BCM94319LCUSBSDN4L_SSID	0X04eb
+#define BCM94319USBB_SSID       0x04ee
+#define BCM94319LCSDN4L_SSID	0X0507
+#define BCM94319LSUSBN4L_SSID	0X0508
+#define BCM94319SDNA4L_SSID	0X0517
+#define BCM94319SDELNA4L_SSID	0X0518
+#define BCM94319SDELNA6L_SSID	0X0539
+#define BCM94319ARCADYAN_SSID	0X0546
+#define BCM94319WINDSOR_SSID    0x0561
+#define BCM94319MLAP_SSID       0x0562
+#define BCM94319SDNA_SSID       0x058b
+#define BCM94319BHEMU3_SSID     0x0563
+#define BCM94319SDHMB_SSID     0x058c
+#define BCM94319SDBREF_SSID     0x05a1
+#define BCM94319USBSDB_SSID     0x05a2
+
+
+/* 4329 boards */
+#define BCM94329AGB_SSID	0X04b9
+#define BCM94329TDKMDL1_SSID	0X04ba
+#define BCM94329TDKMDL11_SSID	0X04fc
+#define BCM94329OLYMPICN18_SSID	0X04fd
+#define BCM94329OLYMPICN90_SSID	0X04fe
+#define BCM94329OLYMPICN90U_SSID 0X050c
+#define BCM94329OLYMPICN90M_SSID 0X050b
+#define BCM94329AGBF_SSID	0X04ff
+#define BCM94329OLYMPICX17_SSID	0X0504
+#define BCM94329OLYMPICX17M_SSID	0X050a
+#define BCM94329OLYMPICX17U_SSID	0X0509
+#define BCM94329OLYMPICUNO_SSID	0X0564
+#define BCM94329MOTOROLA_SSID   0X0565
+#define BCM94329OLYMPICLOCO_SSID	0X0568
+/* 4336 SDIO board types */
+#define BCM94336SD_WLBGABU_SSID		0x0511
+#define BCM94336SD_WLBGAREF_SSID	0x0519
+#define BCM94336SDGP_SSID	0x0538
+#define BCM94336SDG_SSID	0x0519
+#define BCM94336SDGN_SSID	0x0538
+#define BCM94336SDGFC_SSID	0x056B
+
+/* 4330 SDIO board types */
+#define BCM94330SDG_SSID	0x0528
+#define BCM94330SD_FCBGABU_SSID	0x052e
+#define BCM94330SD_WLBGABU_SSID	0x052f
+#define BCM94330SD_FCBGA_SSID	0x0530
+#define BCM94330FCSDAGB_SSID		0x0532
+#define BCM94330OLYMPICAMG_SSID		0x0549
+#define BCM94330OLYMPICAMGEPA_SSID		0x054F
+#define BCM94330OLYMPICUNO3_SSID	0x0551
+#define BCM94330WLSDAGB_SSID	0x0547
+#define BCM94330CSPSDAGBB_SSID	0x054A
+
+/* 43224 boards */
+#define BCM943224X21        0x056e
+#define BCM943224X21_FCC    0x00d1
+#define BCM943224X21B	    0x00e9
+#define BCM943224M93	    0x008b
+#define BCM943224M93A	    0x0090
+#define BCM943224X16	    0x0093
+#define BCM94322X9		    0x008d
+#define BCM94322M35e	    0x008e
+
+/* 43228 Boards */
+#define BCM943228BU8_SSID	0x0540
+#define BCM943228BU9_SSID	0x0541
+#define BCM943228BU_SSID	0x0542
+#define BCM943227HM4L_SSID	0x0543
+#define BCM943227HMB_SSID	0x0544
+#define BCM943228HM4L_SSID	0x0545
+#define BCM943228SD_SSID	0x0573
+
+/* 43239 Boards */
+#define BCM943239MOD_SSID	0x05ac
+#define BCM943239REF_SSID	0x05aa
+
+/* 4331 boards */
+#define BCM94331X19               0x00D6	/* X19B */
+#define BCM94331X28               0x00E4	/* X28 */
+#define BCM94331X28B              0x010E	/* X28B */
+#define BCM94331PCIEBT3Ax_SSID    BCM94331X28
+#define BCM94331X12_2G_SSID       0x00EC	/* X12 2G */
+#define BCM94331X12_5G_SSID       0x00ED	/* X12 5G */
+#define BCM94331X29B              0x00EF	/* X29B */
+#define BCM94331X29D              0x010F	/* X29D */
+#define BCM94331CSAX_SSID         BCM94331X29B
+#define BCM94331X19C              0x00F5	/* X19C */
+#define BCM94331X33	          0x00F4	/* X33 */
+#define BCM94331BU_SSID           0x0523
+#define BCM94331S9BU_SSID         0x0524
+#define BCM94331MC_SSID           0x0525
+#define BCM94331MCI_SSID          0x0526
+#define BCM94331PCIEBT4_SSID      0x0527
+#define BCM94331HM_SSID           0x0574
+#define BCM94331PCIEDUAL_SSID     0x059B
+#define BCM94331MCH5_SSID         0x05A9
+#define BCM94331CS_SSID           0x05C6
+#define BCM94331CD_SSID           0x05DA
+
+/* 4314 Boards */
+#define BCM94314BU_SSID         0x05b1
+
+/* 53572 Boards */
+#define BCM953572BU_SSID       0x058D
+#define BCM953572NR2_SSID      0x058E
+#define BCM947188NR2_SSID      0x058F
+#define BCM953572SDRNR2_SSID   0x0590
+
+/* 43236 boards */
+#define BCM943236OLYMPICSULLEY_SSID 0x594
+#define BCM943236PREPROTOBLU2O3_SSID 0x5b9
+#define BCM943236USBELNA_SSID 0x5f8
+
+/* 4314 Boards */
+#define BCM94314BUSDIO_SSID	0x05c8
+#define BCM94314BGABU_SSID	0x05c9
+#define BCM94314HMEPA_SSID	0x05ca
+#define BCM94314HMEPABK_SSID	0x05cb
+#define BCM94314SUHMEPA_SSID	0x05cc
+#define BCM94314SUHM_SSID	0x05cd
+#define BCM94314HM_SSID		0x05d1
+
+/* 4334 Boards */
+#define BCM94334FCAGBI_SSID	0x05df
+#define BCM94334WLAGBI_SSID	0x05dd
+
+/* 4335 Boards */
+#define BCM94335X52             0x0114
+
+/* 4345 Boards */
+#define BCM94345_SSID           0x0687
+
+/* 4360 Boards */
+#define BCM94360X52C            0X0117
+#define BCM94360X52D            0X0137
+#define BCM94360X29C            0X0112
+#define BCM94360X29CP2          0X0134
+#define BCM94360X29CP3          0X013B
+#define BCM94360X51             0x0111
+#define BCM94360X51P2           0x0129
+#define BCM94360X51P3           0x0142
+#define BCM94360X51A            0x0135
+#define BCM94360X51B            0x0136
+#define BCM94360CS              0x061B
+#define BCM94360J28_D11AC2G     0x0c00
+#define BCM94360J28_D11AC5G     0x0c01
+#define BCM94360USBH5_D11AC5G   0x06aa
+#define BCM94360MCM5            0x06d8
+
+/* 4350 Boards */
+#define BCM94350X52B            0X0116
+#define BCM94350X14             0X0131
+
+/* 43217 Boards */
+#define BCM943217BU_SSID	0x05d5
+#define BCM943217HM2L_SSID	0x05d6
+#define BCM943217HMITR2L_SSID	0x05d7
+
+/* 43142 Boards */
+#define BCM943142HM_SSID	0x05e0
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* 43341 Boards */
+#define BCM943341WLABGS_SSID	0x062d
+
+/* 43342 Boards */
+#define BCM943342FCAGBI_SSID	0x0641
+
+/* 43602 Boards, unclear yet what boards will be created. */
+#define BCM943602RSVD1_SSID	0x06a5
+#define BCM943602RSVD2_SSID	0x06a6
+#define BCM943602X87            0X0133
+#define BCM943602X238           0X0132
+
+/* # of GPIO pins */
+#define GPIO_NUMPINS		32
+
+/* These values are used by dhd host driver. */
+#define RDL_RAM_BASE_4319 0x60000000
+#define RDL_RAM_BASE_4329 0x60000000
+#define RDL_RAM_SIZE_4319 0x48000
+#define RDL_RAM_SIZE_4329  0x48000
+#define RDL_RAM_SIZE_43236 0x70000
+#define RDL_RAM_BASE_43236 0x60000000
+#define RDL_RAM_SIZE_4328 0x60000
+#define RDL_RAM_BASE_4328 0x80000000
+#define RDL_RAM_SIZE_4322 0x60000
+#define RDL_RAM_BASE_4322 0x60000000
+#define RDL_RAM_SIZE_4360  0xA0000
+#define RDL_RAM_BASE_4360  0x60000000
+#define RDL_RAM_SIZE_43242  0x90000
+#define RDL_RAM_BASE_43242  0x60000000
+#define RDL_RAM_SIZE_43143  0x70000
+#define RDL_RAM_BASE_43143  0x60000000
+#define RDL_RAM_SIZE_4350  0xC0000
+#define RDL_RAM_BASE_4350  0x180800
+
+/* generic defs for nvram "muxenab" bits
+* Note: these differ for 4335a0. refer bcmchipc.h for specific mux options.
+*/
+#define MUXENAB_UART		0x00000001
+#define MUXENAB_GPIO		0x00000002
+#define MUXENAB_ERCX		0x00000004	/* External Radio BT coex */
+#define MUXENAB_JTAG		0x00000008
+#define MUXENAB_HOST_WAKE	0x00000010	/* configure GPIO for SDIO host_wake */
+#define MUXENAB_I2S_EN		0x00000020
+#define MUXENAB_I2S_MASTER	0x00000040
+#define MUXENAB_I2S_FULL	0x00000080
+#define MUXENAB_SFLASH		0x00000100
+#define MUXENAB_RFSWCTRL0	0x00000200
+#define MUXENAB_RFSWCTRL1	0x00000400
+#define MUXENAB_RFSWCTRL2	0x00000800
+#define MUXENAB_SECI		0x00001000
+#define MUXENAB_BT_LEGACY	0x00002000
+#define MUXENAB_HOST_WAKE1	0x00004000	/* configure alternative GPIO for SDIO host_wake */
+
+/* Boot flags */
+#define FLASH_KERNEL_NFLASH	0x00000001
+#define FLASH_BOOT_NFLASH	0x00000002
+
+#endif /* _BCMDEVS_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmendian.h b/drivers/net/wireless/bcm4336/include/bcmendian.h
--- a/drivers/net/wireless/bcm4336/include/bcmendian.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmendian.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,311 @@
+/*
+ * Byte order utilities
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ *  $Id: bcmendian.h 402715 2013-05-16 18:50:09Z $
+ *
+ * This file by default provides proper behavior on little-endian architectures.
+ * On big-endian architectures, IL_BIGENDIAN should be defined.
+ */
+
+#ifndef _BCMENDIAN_H_
+#define _BCMENDIAN_H_
+
+#include <typedefs.h>
+
+/* Reverse the bytes in a 16-bit value */
+#define BCMSWAP16(val) \
+	((uint16)((((uint16)(val) & (uint16)0x00ffU) << 8) | \
+		  (((uint16)(val) & (uint16)0xff00U) >> 8)))
+
+/* Reverse the bytes in a 32-bit value */
+#define BCMSWAP32(val) \
+	((uint32)((((uint32)(val) & (uint32)0x000000ffU) << 24) | \
+		  (((uint32)(val) & (uint32)0x0000ff00U) <<  8) | \
+		  (((uint32)(val) & (uint32)0x00ff0000U) >>  8) | \
+		  (((uint32)(val) & (uint32)0xff000000U) >> 24)))
+
+/* Reverse the two 16-bit halves of a 32-bit value */
+#define BCMSWAP32BY16(val) \
+	((uint32)((((uint32)(val) & (uint32)0x0000ffffU) << 16) | \
+		  (((uint32)(val) & (uint32)0xffff0000U) >> 16)))
+
+/* Reverse the bytes in a 64-bit value */
+#define BCMSWAP64(val) \
+	((uint64)((((uint64)(val) & 0x00000000000000ffULL) << 56) | \
+	          (((uint64)(val) & 0x000000000000ff00ULL) << 40) | \
+	          (((uint64)(val) & 0x0000000000ff0000ULL) << 24) | \
+	          (((uint64)(val) & 0x00000000ff000000ULL) <<  8) | \
+	          (((uint64)(val) & 0x000000ff00000000ULL) >>  8) | \
+	          (((uint64)(val) & 0x0000ff0000000000ULL) >> 24) | \
+	          (((uint64)(val) & 0x00ff000000000000ULL) >> 40) | \
+	          (((uint64)(val) & 0xff00000000000000ULL) >> 56)))
+
+/* Reverse the two 32-bit halves of a 64-bit value */
+#define BCMSWAP64BY32(val) \
+	((uint64)((((uint64)(val) & 0x00000000ffffffffULL) << 32) | \
+	          (((uint64)(val) & 0xffffffff00000000ULL) >> 32)))
+
+
+/* Byte swapping macros
+ *    Host <=> Network (Big Endian) for 16- and 32-bit values
+ *    Host <=> Little-Endian for 16- and 32-bit values
+ */
+#ifndef hton16
+#define HTON16(i) BCMSWAP16(i)
+#define	hton16(i) bcmswap16(i)
+#define	HTON32(i) BCMSWAP32(i)
+#define	hton32(i) bcmswap32(i)
+#define	NTOH16(i) BCMSWAP16(i)
+#define	ntoh16(i) bcmswap16(i)
+#define	NTOH32(i) BCMSWAP32(i)
+#define	ntoh32(i) bcmswap32(i)
+#define LTOH16(i) (i)
+#define ltoh16(i) (i)
+#define LTOH32(i) (i)
+#define ltoh32(i) (i)
+#define HTOL16(i) (i)
+#define htol16(i) (i)
+#define HTOL32(i) (i)
+#define htol32(i) (i)
+#define HTOL64(i) (i)
+#define htol64(i) (i)
+#endif /* hton16 */
+
+#define ltoh16_buf(buf, i)
+#define htol16_buf(buf, i)
+
+/* Unaligned loads and stores in host byte order */
+#define load32_ua(a)		ltoh32_ua(a)
+#define store32_ua(a, v)	htol32_ua_store(v, a)
+#define load16_ua(a)		ltoh16_ua(a)
+#define store16_ua(a, v)	htol16_ua_store(v, a)
+
+#define _LTOH16_UA(cp)	((cp)[0] | ((cp)[1] << 8))
+#define _LTOH32_UA(cp)	((cp)[0] | ((cp)[1] << 8) | ((cp)[2] << 16) | ((cp)[3] << 24))
+#define _NTOH16_UA(cp)	(((cp)[0] << 8) | (cp)[1])
+#define _NTOH32_UA(cp)	(((cp)[0] << 24) | ((cp)[1] << 16) | ((cp)[2] << 8) | (cp)[3])
+
+#define ltoh_ua(ptr) \
+	(sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+	 sizeof(*(ptr)) == sizeof(uint16) ? _LTOH16_UA((const uint8 *)(ptr)) : \
+	 sizeof(*(ptr)) == sizeof(uint32) ? _LTOH32_UA((const uint8 *)(ptr)) : \
+	 *(uint8 *)0)
+
+#define ntoh_ua(ptr) \
+	(sizeof(*(ptr)) == sizeof(uint8) ? *(const uint8 *)(ptr) : \
+	 sizeof(*(ptr)) == sizeof(uint16) ? _NTOH16_UA((const uint8 *)(ptr)) : \
+	 sizeof(*(ptr)) == sizeof(uint32) ? _NTOH32_UA((const uint8 *)(ptr)) : \
+	 *(uint8 *)0)
+
+#ifdef __GNUC__
+
+/* GNU macro versions avoid referencing the argument multiple times, while also
+ * avoiding the -fno-inline used in ROM builds.
+ */
+
+#define bcmswap16(val) ({ \
+	uint16 _val = (val); \
+	BCMSWAP16(_val); \
+})
+
+#define bcmswap32(val) ({ \
+	uint32 _val = (val); \
+	BCMSWAP32(_val); \
+})
+
+#define bcmswap64(val) ({ \
+	uint64 _val = (val); \
+	BCMSWAP64(_val); \
+})
+
+#define bcmswap32by16(val) ({ \
+	uint32 _val = (val); \
+	BCMSWAP32BY16(_val); \
+})
+
+#define bcmswap16_buf(buf, len) ({ \
+	uint16 *_buf = (uint16 *)(buf); \
+	uint _wds = (len) / 2; \
+	while (_wds--) { \
+		*_buf = bcmswap16(*_buf); \
+		_buf++; \
+	} \
+})
+
+#define htol16_ua_store(val, bytes) ({ \
+	uint16 _val = (val); \
+	uint8 *_bytes = (uint8 *)(bytes); \
+	_bytes[0] = _val & 0xff; \
+	_bytes[1] = _val >> 8; \
+})
+
+#define htol32_ua_store(val, bytes) ({ \
+	uint32 _val = (val); \
+	uint8 *_bytes = (uint8 *)(bytes); \
+	_bytes[0] = _val & 0xff; \
+	_bytes[1] = (_val >> 8) & 0xff; \
+	_bytes[2] = (_val >> 16) & 0xff; \
+	_bytes[3] = _val >> 24; \
+})
+
+#define hton16_ua_store(val, bytes) ({ \
+	uint16 _val = (val); \
+	uint8 *_bytes = (uint8 *)(bytes); \
+	_bytes[0] = _val >> 8; \
+	_bytes[1] = _val & 0xff; \
+})
+
+#define hton32_ua_store(val, bytes) ({ \
+	uint32 _val = (val); \
+	uint8 *_bytes = (uint8 *)(bytes); \
+	_bytes[0] = _val >> 24; \
+	_bytes[1] = (_val >> 16) & 0xff; \
+	_bytes[2] = (_val >> 8) & 0xff; \
+	_bytes[3] = _val & 0xff; \
+})
+
+#define ltoh16_ua(bytes) ({ \
+	const uint8 *_bytes = (const uint8 *)(bytes); \
+	_LTOH16_UA(_bytes); \
+})
+
+#define ltoh32_ua(bytes) ({ \
+	const uint8 *_bytes = (const uint8 *)(bytes); \
+	_LTOH32_UA(_bytes); \
+})
+
+#define ntoh16_ua(bytes) ({ \
+	const uint8 *_bytes = (const uint8 *)(bytes); \
+	_NTOH16_UA(_bytes); \
+})
+
+#define ntoh32_ua(bytes) ({ \
+	const uint8 *_bytes = (const uint8 *)(bytes); \
+	_NTOH32_UA(_bytes); \
+})
+
+#else /* !__GNUC__ */
+
+/* Inline versions avoid referencing the argument multiple times */
+static INLINE uint16
+bcmswap16(uint16 val)
+{
+	return BCMSWAP16(val);
+}
+
+static INLINE uint32
+bcmswap32(uint32 val)
+{
+	return BCMSWAP32(val);
+}
+
+static INLINE uint64
+bcmswap64(uint64 val)
+{
+	return BCMSWAP64(val);
+}
+
+static INLINE uint32
+bcmswap32by16(uint32 val)
+{
+	return BCMSWAP32BY16(val);
+}
+
+/* Reverse pairs of bytes in a buffer (not for high-performance use) */
+/* buf	- start of buffer of shorts to swap */
+/* len  - byte length of buffer */
+static INLINE void
+bcmswap16_buf(uint16 *buf, uint len)
+{
+	len = len / 2;
+
+	while (len--) {
+		*buf = bcmswap16(*buf);
+		buf++;
+	}
+}
+
+/*
+ * Store 16-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol16_ua_store(uint16 val, uint8 *bytes)
+{
+	bytes[0] = val & 0xff;
+	bytes[1] = val >> 8;
+}
+
+/*
+ * Store 32-bit value to unaligned little-endian byte array.
+ */
+static INLINE void
+htol32_ua_store(uint32 val, uint8 *bytes)
+{
+	bytes[0] = val & 0xff;
+	bytes[1] = (val >> 8) & 0xff;
+	bytes[2] = (val >> 16) & 0xff;
+	bytes[3] = val >> 24;
+}
+
+/*
+ * Store 16-bit value to unaligned network-(big-)endian byte array.
+ */
+static INLINE void
+hton16_ua_store(uint16 val, uint8 *bytes)
+{
+	bytes[0] = val >> 8;
+	bytes[1] = val & 0xff;
+}
+
+/*
+ * Store 32-bit value to unaligned network-(big-)endian byte array.
+ */
+static INLINE void
+hton32_ua_store(uint32 val, uint8 *bytes)
+{
+	bytes[0] = val >> 24;
+	bytes[1] = (val >> 16) & 0xff;
+	bytes[2] = (val >> 8) & 0xff;
+	bytes[3] = val & 0xff;
+}
+
+/*
+ * Load 16-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint16
+ltoh16_ua(const void *bytes)
+{
+	return _LTOH16_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 32-bit value from unaligned little-endian byte array.
+ */
+static INLINE uint32
+ltoh32_ua(const void *bytes)
+{
+	return _LTOH32_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 16-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint16
+ntoh16_ua(const void *bytes)
+{
+	return _NTOH16_UA((const uint8 *)bytes);
+}
+
+/*
+ * Load 32-bit value from unaligned big-(network-)endian byte array.
+ */
+static INLINE uint32
+ntoh32_ua(const void *bytes)
+{
+	return _NTOH32_UA((const uint8 *)bytes);
+}
+
+#endif /* !__GNUC__ */
+#endif /* !_BCMENDIAN_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcm_mpool_pub.h b/drivers/net/wireless/bcm4336/include/bcm_mpool_pub.h
--- a/drivers/net/wireless/bcm4336/include/bcm_mpool_pub.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcm_mpool_pub.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,343 @@
+/*
+ * Memory pools library, Public interface
+ *
+ * API Overview
+ *
+ * This package provides a memory allocation subsystem based on pools of
+ * homogenous objects.
+ *
+ * Instrumentation is available for reporting memory utilization both
+ * on a per-data-structure basis and system wide.
+ *
+ * There are two main types defined in this API.
+ *
+ *    pool manager: A singleton object that acts as a factory for
+ *                  pool allocators. It also is used for global
+ *                  instrumentation, such as reporting all blocks
+ *                  in use across all data structures. The pool manager
+ *                  creates and provides individual memory pools
+ *                  upon request to application code.
+ *
+ *    memory pool:  An object for allocating homogenous memory blocks.
+ *
+ * Global identifiers in this module use the following prefixes:
+ *    bcm_mpm_*     Memory pool manager
+ *    bcm_mp_*      Memory pool
+ *
+ * There are two main types of memory pools:
+ *
+ *    prealloc: The contiguous memory block of objects can either be supplied
+ *              by the client or malloc'ed by the memory manager. The objects are
+ *              allocated out of a block of memory and freed back to the block.
+ *
+ *    heap:     The memory pool allocator uses the heap (malloc/free) for memory.
+ *              In this case, the pool allocator is just providing statistics
+ *              and instrumentation on top of the heap, without modifying the heap
+ *              allocation implementation.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcm_mpool_pub.h 407097 2013-06-11 18:43:16Z $
+ */
+
+#ifndef _BCM_MPOOL_PUB_H
+#define _BCM_MPOOL_PUB_H 1
+
+#include <typedefs.h> /* needed for uint16 */
+
+
+/*
+**************************************************************************
+*
+* Type definitions, handles
+*
+**************************************************************************
+*/
+
+/* Forward declaration of OSL handle. */
+struct osl_info;
+
+/* Forward declaration of string buffer. */
+struct bcmstrbuf;
+
+/*
+ * Opaque type definition for the pool manager handle. This object is used for global
+ * memory pool operations such as obtaining a new pool, deleting a pool, iterating and
+ * instrumentation/debugging.
+ */
+struct bcm_mpm_mgr;
+typedef struct bcm_mpm_mgr *bcm_mpm_mgr_h;
+
+/*
+ * Opaque type definition for an instance of a pool. This handle is used for allocating
+ * and freeing memory through the pool, as well as management/instrumentation on this
+ * specific pool.
+ */
+struct bcm_mp_pool;
+typedef struct bcm_mp_pool *bcm_mp_pool_h;
+
+
+/*
+ * To make instrumentation more readable, every memory
+ * pool must have a readable name. Pool names are up to
+ * 8 bytes including '\0' termination. (7 printable characters.)
+ */
+#define BCM_MP_NAMELEN 8
+
+
+/*
+ * Type definition for pool statistics.
+ */
+typedef struct bcm_mp_stats {
+	char name[BCM_MP_NAMELEN];  /* Name of this pool. */
+	unsigned int objsz;         /* Object size allocated in this pool */
+	uint16 nobj;                /* Total number of objects in this pool */
+	uint16 num_alloc;           /* Number of objects currently allocated */
+	uint16 high_water;          /* Max number of allocated objects. */
+	uint16 failed_alloc;        /* Failed allocations. */
+} bcm_mp_stats_t;
+
+
+/*
+**************************************************************************
+*
+* API Routines on the pool manager.
+*
+**************************************************************************
+*/
+
+/*
+ * bcm_mpm_init() - initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    osh:       INPUT  Operating system handle. Needed for heap memory allocation.
+ *    max_pools: INPUT Maximum number of mempools supported.
+ *    mgr:       OUTPUT The handle is written with the new pools manager object/handle.
+ *
+ * Returns:
+ *    BCME_OK     Object initialized successfully. May be used.
+ *    BCME_NOMEM  Initialization failed due to no memory. Object must not be used.
+ */
+int bcm_mpm_init(struct osl_info *osh, int max_pools, bcm_mpm_mgr_h *mgrp);
+
+
+/*
+ * bcm_mpm_deinit() - de-initialize the whole memory pool system.
+ *
+ * Parameters:
+ *    mgr:     INPUT  Pointer to pool manager handle.
+ *
+ * Returns:
+ *    BCME_OK  Memory pool manager successfully de-initialized.
+ *    other    Indicated error occured during de-initialization.
+ */
+int bcm_mpm_deinit(bcm_mpm_mgr_h *mgrp);
+
+/*
+ * bcm_mpm_create_prealloc_pool() - Create a new pool for fixed size objects. The
+ *                                  pool uses a contiguous block of pre-alloced
+ *                                  memory. The memory block may either be provided
+ *                                  by the client or dynamically allocated by the
+ *                                  pool manager.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *                     Must be >= sizeof(void *).
+ *    nobj:     INPUT  Maximum number of concurrently existing objects to support
+ *    memstart  INPUT  Pointer to the memory to use, or NULL to malloc()
+ *    memsize   INPUT  Number of bytes referenced from memstart (for error checking).
+ *                     Must be 0 if 'memstart' is NULL.
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_prealloc_pool(bcm_mpm_mgr_h mgr,
+                                 unsigned int obj_sz,
+                                 int nobj,
+                                 void *memstart,
+                                 unsigned int memsize,
+                                 const char poolname[BCM_MP_NAMELEN],
+                                 bcm_mp_pool_h *newp);
+
+
+/*
+ * bcm_mpm_delete_prealloc_pool() - Delete a memory pool. This should only be called after
+ *                                  all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_prealloc_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+/*
+ * bcm_mpm_create_heap_pool() - Create a new pool for fixed size objects. The memory
+ *                              pool allocator uses the heap (malloc/free) for memory.
+ *                              In this case, the pool allocator is just providing
+ *                              statistics and instrumentation on top of the heap,
+ *                              without modifying the heap allocation implementation.
+ *
+ * Parameters:
+ *    mgr:      INPUT  The handle to the pool manager
+ *    obj_sz:   INPUT  Size of objects that will be allocated by the new pool
+ *    poolname  INPUT  For instrumentation, the name of the pool
+ *    newp:     OUTPUT The handle for the new pool, if creation is successful
+ *
+ * Returns:
+ *    BCME_OK   Pool created ok.
+ *    other     Pool not created due to indicated error. newpoolp set to NULL.
+ *
+ *
+ */
+int bcm_mpm_create_heap_pool(bcm_mpm_mgr_h mgr, unsigned int obj_sz,
+                             const char poolname[BCM_MP_NAMELEN],
+                             bcm_mp_pool_h *newp);
+
+
+/*
+ * bcm_mpm_delete_heap_pool() - Delete a memory pool. This should only be called after
+ *                              all memory objects have been freed back to the pool.
+ *
+ * Parameters:
+ *    mgr:     INPUT The handle to the pools manager
+ *    pool:    INPUT The handle of the  pool to delete
+ *
+ * Returns:
+ *    BCME_OK   Pool deleted ok.
+ *    other     Pool not deleted due to indicated error.
+ *
+ */
+int bcm_mpm_delete_heap_pool(bcm_mpm_mgr_h mgr, bcm_mp_pool_h *poolp);
+
+
+/*
+ * bcm_mpm_stats() - Return stats for all pools
+ *
+ * Parameters:
+ *    mgr:         INPUT   The handle to the pools manager
+ *    stats:       OUTPUT  Array of pool statistics.
+ *    nentries:    MOD     Max elements in 'stats' array on INPUT. Actual number
+ *                         of array elements copied to 'stats' on OUTPUT.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting stats.
+ *
+ */
+int bcm_mpm_stats(bcm_mpm_mgr_h mgr, bcm_mp_stats_t *stats, int *nentries);
+
+
+/*
+ * bcm_mpm_dump() - Display statistics on all pools
+ *
+ * Parameters:
+ *    mgr:     INPUT  The handle to the pools manager
+ *    b:       OUTPUT Output buffer.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mpm_dump(bcm_mpm_mgr_h mgr, struct bcmstrbuf *b);
+
+
+/*
+ * bcm_mpm_get_obj_size() - The size of memory objects may need to be padded to
+ *                          compensate for alignment requirements of the objects.
+ *                          This function provides the padded object size. If clients
+ *                          pre-allocate a memory slab for a memory pool, the
+ *                          padded object size should be used by the client to allocate
+ *                          the memory slab (in order to provide sufficent space for
+ *                          the maximum number of objects).
+ *
+ * Parameters:
+ *    mgr:            INPUT   The handle to the pools manager.
+ *    obj_sz:         INPUT   Input object size.
+ *    padded_obj_sz:  OUTPUT  Padded object size.
+ *
+ * Returns:
+ *    BCME_OK      Ok
+ *    BCME_BADARG  Bad arguments.
+ *
+ */
+int bcm_mpm_get_obj_size(bcm_mpm_mgr_h mgr, unsigned int obj_sz, unsigned int *padded_obj_sz);
+
+
+/*
+***************************************************************************
+*
+* API Routines on a specific pool.
+*
+***************************************************************************
+*/
+
+
+/*
+ * bcm_mp_alloc() - Allocate a memory pool object.
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool.
+ *
+ * Returns:
+ *    A pointer to the new object. NULL on error.
+ *
+ */
+void* bcm_mp_alloc(bcm_mp_pool_h pool);
+
+/*
+ * bcm_mp_free() - Free a memory pool object.
+ *
+ * Parameters:
+ *    pool:  INPUT   The handle to the pool.
+ *    objp:  INPUT   A pointer to the object to free.
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during free.
+ *
+ */
+int bcm_mp_free(bcm_mp_pool_h pool, void *objp);
+
+/*
+ * bcm_mp_stats() - Return stats for this pool
+ *
+ * Parameters:
+ *    pool:     INPUT    The handle to the pool
+ *    stats:    OUTPUT   Pool statistics
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error getting statistics.
+ *
+ */
+int bcm_mp_stats(bcm_mp_pool_h pool, bcm_mp_stats_t *stats);
+
+
+/*
+ * bcm_mp_dump() - Dump a pool
+ *
+ * Parameters:
+ *    pool:    INPUT    The handle to the pool
+ *    b        OUTPUT   Output buffer
+ *
+ * Returns:
+ *    BCME_OK   Ok
+ *    other     Error during dump.
+ *
+ */
+int bcm_mp_dump(bcm_mp_pool_h pool, struct bcmstrbuf *b);
+
+
+#endif /* _BCM_MPOOL_PUB_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmmsgbuf.h b/drivers/net/wireless/bcm4336/include/bcmmsgbuf.h
--- a/drivers/net/wireless/bcm4336/include/bcmmsgbuf.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmmsgbuf.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,731 @@
+/*
+ * MSGBUF network driver ioctl/indication encoding
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmmsgbuf.h 499474 2014-08-28 21:30:10Z $
+ */
+#ifndef _bcmmsgbuf_h_
+#define	_bcmmsgbuf_h_
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+#include <bcmpcie.h>
+
+#define MSGBUF_MAX_MSG_SIZE   ETHER_MAX_LEN
+
+#define D2H_EPOCH_MODULO			253 /* sequence number wrap */
+#define D2H_EPOCH_INIT_VAL			(D2H_EPOCH_MODULO + 1)
+
+#define H2DRING_TXPOST_ITEMSIZE		48
+#define H2DRING_RXPOST_ITEMSIZE		32
+#define H2DRING_CTRL_SUB_ITEMSIZE	40
+#define D2HRING_TXCMPLT_ITEMSIZE	16
+#define D2HRING_RXCMPLT_ITEMSIZE	32
+#define D2HRING_CTRL_CMPLT_ITEMSIZE	24
+
+#define H2DRING_TXPOST_MAX_ITEM			512
+#define H2DRING_RXPOST_MAX_ITEM			256
+#define H2DRING_CTRL_SUB_MAX_ITEM		20
+#define D2HRING_TXCMPLT_MAX_ITEM		1024
+#define D2HRING_RXCMPLT_MAX_ITEM		256
+#define D2HRING_CTRL_CMPLT_MAX_ITEM		20
+enum {
+	DNGL_TO_HOST_MSGBUF,
+	HOST_TO_DNGL_MSGBUF
+};
+
+enum {
+	HOST_TO_DNGL_TXP_DATA,
+	HOST_TO_DNGL_RXP_DATA,
+	HOST_TO_DNGL_CTRL,
+	DNGL_TO_HOST_DATA,
+	DNGL_TO_HOST_CTRL
+};
+
+#define MESSAGE_PAYLOAD(a) (a & MSG_TYPE_INTERNAL_USE_START) ? TRUE : FALSE
+
+#ifdef PCIE_API_REV1
+
+#define BCMMSGBUF_DUMMY_REF(a, b)	do {BCM_REFERENCE((a));BCM_REFERENCE((b));}  while (0)
+
+#define BCMMSGBUF_API_IFIDX(a)		0
+#define BCMMSGBUF_API_SEQNUM(a)		0
+#define BCMMSGBUF_IOCTL_XTID(a)		0
+#define BCMMSGBUF_IOCTL_PKTID(a)	((a)->cmd_id)
+
+#define BCMMSGBUF_SET_API_IFIDX(a, b)	BCMMSGBUF_DUMMY_REF(a, b)
+#define BCMMSGBUF_SET_API_SEQNUM(a, b)	BCMMSGBUF_DUMMY_REF(a, b)
+#define BCMMSGBUF_IOCTL_SET_PKTID(a, b)	(BCMMSGBUF_IOCTL_PKTID(a) = (b))
+#define BCMMSGBUF_IOCTL_SET_XTID(a, b)	BCMMSGBUF_DUMMY_REF(a, b)
+
+#else /* PCIE_API_REV1 */
+
+#define BCMMSGBUF_API_IFIDX(a)		((a)->if_id)
+#define BCMMSGBUF_IOCTL_PKTID(a)	((a)->pkt_id)
+#define BCMMSGBUF_API_SEQNUM(a)		((a)->u.seq.seq_no)
+#define BCMMSGBUF_IOCTL_XTID(a)		((a)->xt_id)
+
+#define BCMMSGBUF_SET_API_IFIDX(a, b)	(BCMMSGBUF_API_IFIDX((a)) = (b))
+#define BCMMSGBUF_SET_API_SEQNUM(a, b)	(BCMMSGBUF_API_SEQNUM((a)) = (b))
+#define BCMMSGBUF_IOCTL_SET_PKTID(a, b)	(BCMMSGBUF_IOCTL_PKTID((a)) = (b))
+#define BCMMSGBUF_IOCTL_SET_XTID(a, b)	(BCMMSGBUF_IOCTL_XTID((a)) = (b))
+
+#endif /* PCIE_API_REV1 */
+
+/* utility data structures */
+union addr64 {
+	struct {
+		uint32 low;
+		uint32 high;
+	};
+	struct {
+		uint32 low_addr;
+		uint32 high_addr;
+	};
+	uint64 u64;
+} DECLSPEC_ALIGN(8);
+
+typedef union addr64 addr64_t;
+
+/* IOCTL req Hdr */
+/* cmn Msg Hdr */
+typedef struct cmn_msg_hdr {
+	/* message type */
+	uint8 msg_type;
+	/* interface index this is valid for */
+	uint8 if_id;
+	/* flags */
+	uint8 flags;
+	/* sequence number */
+	uint8 epoch;
+	/* packet Identifier for the associated host buffer */
+	uint32 request_id;
+} cmn_msg_hdr_t;
+
+/* message type */
+typedef enum bcmpcie_msgtype {
+	MSG_TYPE_GEN_STATUS 		= 0x1,
+	MSG_TYPE_RING_STATUS		= 0x2,
+	MSG_TYPE_FLOW_RING_CREATE	= 0x3,
+	MSG_TYPE_FLOW_RING_CREATE_CMPLT	= 0x4,
+	MSG_TYPE_FLOW_RING_DELETE	= 0x5,
+	MSG_TYPE_FLOW_RING_DELETE_CMPLT	= 0x6,
+	MSG_TYPE_FLOW_RING_FLUSH	= 0x7,
+	MSG_TYPE_FLOW_RING_FLUSH_CMPLT	= 0x8,
+	MSG_TYPE_IOCTLPTR_REQ		= 0x9,
+	MSG_TYPE_IOCTLPTR_REQ_ACK	= 0xA,
+	MSG_TYPE_IOCTLRESP_BUF_POST	= 0xB,
+	MSG_TYPE_IOCTL_CMPLT		= 0xC,
+	MSG_TYPE_EVENT_BUF_POST		= 0xD,
+	MSG_TYPE_WL_EVENT		= 0xE,
+	MSG_TYPE_TX_POST		= 0xF,
+	MSG_TYPE_TX_STATUS		= 0x10,
+	MSG_TYPE_RXBUF_POST		= 0x11,
+	MSG_TYPE_RX_CMPLT		= 0x12,
+	MSG_TYPE_LPBK_DMAXFER 		= 0x13,
+	MSG_TYPE_LPBK_DMAXFER_CMPLT	= 0x14,
+	MSG_TYPE_API_MAX_RSVD		= 0x3F
+} bcmpcie_msg_type_t;
+
+typedef enum bcmpcie_msgtype_int {
+	MSG_TYPE_INTERNAL_USE_START	= 0x40,
+	MSG_TYPE_EVENT_PYLD		= 0x41,
+	MSG_TYPE_IOCT_PYLD		= 0x42,
+	MSG_TYPE_RX_PYLD		= 0x43,
+	MSG_TYPE_HOST_FETCH		= 0x44,
+	MSG_TYPE_LPBK_DMAXFER_PYLD	= 0x45,
+	MSG_TYPE_TXMETADATA_PYLD	= 0x46,
+	MSG_TYPE_HOSTDMA_PTRS		= 0x47
+} bcmpcie_msgtype_int_t;
+
+typedef enum bcmpcie_msgtype_u {
+	MSG_TYPE_TX_BATCH_POST		= 0x80,
+	MSG_TYPE_IOCTL_REQ		= 0x81,
+	MSG_TYPE_HOST_EVNT		= 0x82,
+	MSG_TYPE_LOOPBACK		= 0x83
+} bcmpcie_msgtype_u_t;
+
+
+/* if_id */
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT	5
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX	0x7
+#define BCMPCIE_CMNHDR_IFIDX_PHYINTF_MASK	\
+	(BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX << BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT)
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_SHFT	0
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_MAX	0x1F
+#define BCMPCIE_CMNHDR_IFIDX_VIRTINTF_MASK	\
+	(BCMPCIE_CMNHDR_IFIDX_PHYINTF_MAX << BCMPCIE_CMNHDR_IFIDX_PHYINTF_SHFT)
+
+/* flags */
+#define BCMPCIE_CMNHDR_FLAGS_DMA_R_IDX		0x1
+#define BCMPCIE_CMNHDR_FLAGS_DMA_R_IDX_INTR	0x2
+#define BCMPCIE_CMNHDR_FLAGS_PHASE_BIT		0x80
+
+
+/* IOCTL request message */
+typedef struct ioctl_req_msg {
+	/* common message header */
+	cmn_msg_hdr_t 	cmn_hdr;
+
+	/* ioctl command type */
+	uint32		cmd;
+	/* ioctl transaction ID, to pair with a ioctl response */
+	uint16		trans_id;
+	/* input arguments buffer len */
+	uint16		input_buf_len;
+	/* expected output len */
+	uint16		output_buf_len;
+	/* to aling the host address on 8 byte boundary */
+	uint16		rsvd[3];
+	/* always aling on 8 byte boundary */
+	addr64_t	host_input_buf_addr;
+	/* rsvd */
+	uint32		rsvd1[2];
+} ioctl_req_msg_t;
+
+/* buffer post messages for device to use to return IOCTL responses, Events */
+typedef struct ioctl_resp_evt_buf_post_msg {
+	/* common message header */
+	cmn_msg_hdr_t	cmn_hdr;
+	/* length of the host buffer supplied */
+	uint16		host_buf_len;
+	/* to aling the host address on 8 byte boundary */
+	uint16		reserved[3];
+	/* always aling on 8 byte boundary */
+	addr64_t	host_buf_addr;
+	uint32		rsvd[4];
+} ioctl_resp_evt_buf_post_msg_t;
+
+
+typedef struct pcie_dma_xfer_params {
+	/* common message header */
+	cmn_msg_hdr_t	cmn_hdr;
+
+	/* always aling on 8 byte boundary */
+	addr64_t	host_input_buf_addr;
+
+	/* always aling on 8 byte boundary */
+	addr64_t	host_ouput_buf_addr;
+
+	/* length of transfer */
+	uint32		xfer_len;
+	/* delay before doing the src txfer */
+	uint32		srcdelay;
+	/* delay before doing the dest txfer */
+	uint32		destdelay;
+	uint32		rsvd;
+} pcie_dma_xfer_params_t;
+
+/* Complete msgbuf hdr for flow ring update from host to dongle */
+typedef struct tx_flowring_create_request {
+	cmn_msg_hdr_t   msg;
+	uint8	da[ETHER_ADDR_LEN];
+	uint8	sa[ETHER_ADDR_LEN];
+	uint8	tid;
+	uint8 	if_flags;
+	uint16	flow_ring_id;
+	uint8 	tc;
+	uint8	priority;
+	uint16 	int_vector;
+	uint16	max_items;
+	uint16	len_item;
+	addr64_t flow_ring_ptr;
+} tx_flowring_create_request_t;
+
+typedef struct tx_flowring_delete_request {
+	cmn_msg_hdr_t   msg;
+	uint16	flow_ring_id;
+	uint16 	reason;
+	uint32	rsvd[7];
+} tx_flowring_delete_request_t;
+
+typedef struct tx_flowring_flush_request {
+	cmn_msg_hdr_t   msg;
+	uint16	flow_ring_id;
+	uint16 	reason;
+	uint32	rsvd[7];
+} tx_flowring_flush_request_t;
+
+typedef union ctrl_submit_item {
+	ioctl_req_msg_t			ioctl_req;
+	ioctl_resp_evt_buf_post_msg_t	resp_buf_post;
+	pcie_dma_xfer_params_t		dma_xfer;
+	tx_flowring_create_request_t	flow_create;
+	tx_flowring_delete_request_t	flow_delete;
+	tx_flowring_flush_request_t	flow_flush;
+	unsigned char			check[H2DRING_CTRL_SUB_ITEMSIZE];
+} ctrl_submit_item_t;
+
+/* Control Completion messages (20 bytes) */
+typedef struct compl_msg_hdr {
+	/* status for the completion */
+	int16	status;
+	/* submisison flow ring id which generated this status */
+	uint16	flow_ring_id;
+} compl_msg_hdr_t;
+
+/* XOR checksum or a magic number to audit DMA done */
+typedef uint32 dma_done_t;
+
+/* completion header status codes */
+#define	BCMPCIE_SUCCESS			0
+#define BCMPCIE_NOTFOUND		1
+#define BCMPCIE_NOMEM			2
+#define BCMPCIE_BADOPTION		3
+#define BCMPCIE_RING_IN_USE		4
+#define BCMPCIE_RING_ID_INVALID		5
+#define BCMPCIE_PKT_FLUSH		6
+#define BCMPCIE_NO_EVENT_BUF		7
+#define BCMPCIE_NO_RX_BUF		8
+#define BCMPCIE_NO_IOCTLRESP_BUF	9
+#define BCMPCIE_MAX_IOCTLRESP_BUF	10
+#define BCMPCIE_MAX_EVENT_BUF		11
+
+/* IOCTL completion response */
+typedef struct ioctl_compl_resp_msg {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t		compl_hdr;
+	/* response buffer len where a host buffer is involved */
+	uint16			resp_len;
+	/* transaction id to pair with a request */
+	uint16			trans_id;
+	/* cmd id */
+	uint32			cmd;
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} ioctl_comp_resp_msg_t;
+
+/* IOCTL request acknowledgement */
+typedef struct ioctl_req_ack_msg {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t 	compl_hdr;
+	/* cmd id */
+	uint32			cmd;
+	uint32			rsvd[1];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} ioctl_req_ack_msg_t;
+
+/* WL event message: send from device to host */
+typedef struct wlevent_req_msg {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t		compl_hdr;
+	/* event data len valid with the event buffer */
+	uint16			event_data_len;
+	/* sequence number */
+	uint16			seqnum;
+	/* rsvd	*/
+	uint32			rsvd;
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} wlevent_req_msg_t;
+
+/* dma xfer complete message */
+typedef struct pcie_dmaxfer_cmplt {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t		compl_hdr;
+	uint32			rsvd[2];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} pcie_dmaxfer_cmplt_t;
+
+/* general status message */
+typedef struct pcie_gen_status {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t		compl_hdr;
+	uint32			rsvd[2];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} pcie_gen_status_t;
+
+/* ring status message */
+typedef struct pcie_ring_status {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t		compl_hdr;
+	/* message which firmware couldn't decode */
+	uint16			write_idx;
+	uint16			rsvd[3];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} pcie_ring_status_t;
+
+typedef struct tx_flowring_create_response {
+	cmn_msg_hdr_t		msg;
+	compl_msg_hdr_t 	cmplt;
+	uint32			rsvd[2];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} tx_flowring_create_response_t;
+typedef struct tx_flowring_delete_response {
+	cmn_msg_hdr_t		msg;
+	compl_msg_hdr_t 	cmplt;
+	uint32			rsvd[2];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} tx_flowring_delete_response_t;
+
+typedef struct tx_flowring_flush_response {
+	cmn_msg_hdr_t		msg;
+	compl_msg_hdr_t 	cmplt;
+	uint32			rsvd[2];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} tx_flowring_flush_response_t;
+
+/* Common layout of all d2h control messages */
+typedef struct ctrl_compl_msg {
+	/* common message header */
+	cmn_msg_hdr_t		cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t		compl_hdr;
+	uint32			rsvd[2];
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} ctrl_compl_msg_t;
+
+typedef union ctrl_completion_item {
+	ioctl_comp_resp_msg_t		ioctl_resp;
+	wlevent_req_msg_t		event;
+	ioctl_req_ack_msg_t		ioct_ack;
+	pcie_dmaxfer_cmplt_t		pcie_xfer_cmplt;
+	pcie_gen_status_t		pcie_gen_status;
+	pcie_ring_status_t		pcie_ring_status;
+	tx_flowring_create_response_t	txfl_create_resp;
+	tx_flowring_delete_response_t	txfl_delete_resp;
+	tx_flowring_flush_response_t	txfl_flush_resp;
+	ctrl_compl_msg_t		ctrl_compl;
+	unsigned char		check[D2HRING_CTRL_CMPLT_ITEMSIZE];
+} ctrl_completion_item_t;
+
+/* H2D Rxpost ring work items */
+typedef struct host_rxbuf_post {
+	/* common message header */
+	cmn_msg_hdr_t   cmn_hdr;
+	/* provided meta data buffer len */
+	uint16		metadata_buf_len;
+	/* provided data buffer len to receive data */
+	uint16		data_buf_len;
+	/* alignment to make the host buffers start on 8 byte boundary */
+	uint32		rsvd;
+	/* provided meta data buffer */
+	addr64_t	metadata_buf_addr;
+	/* provided data buffer to receive data */
+	addr64_t	data_buf_addr;
+} host_rxbuf_post_t;
+
+typedef union rxbuf_submit_item {
+	host_rxbuf_post_t	rxpost;
+	unsigned char		check[H2DRING_RXPOST_ITEMSIZE];
+} rxbuf_submit_item_t;
+
+
+/* D2H Rxcompletion ring work items */
+typedef struct host_rxbuf_cmpl {
+	/* common message header */
+	cmn_msg_hdr_t	cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t	compl_hdr;
+	/*  filled up meta data len */
+	uint16		metadata_len;
+	/* filled up buffer len to receive data */
+	uint16		data_len;
+	/* offset in the host rx buffer where the data starts */
+	uint16		data_offset;
+	/* offset in the host rx buffer where the data starts */
+	uint16		flags;
+	/* rx status */
+	uint32		rx_status_0;
+	uint32		rx_status_1;
+	/* XOR checksum or a magic number to audit DMA done */
+	dma_done_t		marker;
+} host_rxbuf_cmpl_t;
+
+typedef union rxbuf_complete_item {
+	host_rxbuf_cmpl_t	rxcmpl;
+	unsigned char		check[D2HRING_RXCMPLT_ITEMSIZE];
+} rxbuf_complete_item_t;
+
+
+typedef struct host_txbuf_post {
+	/* common message header */
+	cmn_msg_hdr_t   cmn_hdr;
+	/* eth header */
+	uint8		txhdr[ETHER_HDR_LEN];
+	/* flags */
+	uint8		flags;
+	/* number of segments */
+	uint8		seg_cnt;
+
+	/* provided meta data buffer for txstatus */
+	addr64_t	metadata_buf_addr;
+	/* provided data buffer to receive data */
+	addr64_t	data_buf_addr;
+	/* provided meta data buffer len */
+	uint16		metadata_buf_len;
+	/* provided data buffer len to receive data */
+	uint16		data_len;
+	uint32		flag2;
+} host_txbuf_post_t;
+
+#define BCMPCIE_PKT_FLAGS_FRAME_802_3	0x01
+#define BCMPCIE_PKT_FLAGS_FRAME_802_11	0x02
+
+#define BCMPCIE_PKT_FLAGS_FRAME_EXEMPT_MASK	0x03	/* Exempt uses 2 bits */
+#define BCMPCIE_PKT_FLAGS_FRAME_EXEMPT_SHIFT	0x02	/* needs to be shifted past other bits */
+
+
+#define BCMPCIE_PKT_FLAGS_PRIO_SHIFT		5
+#define BCMPCIE_PKT_FLAGS_PRIO_MASK		(7 << BCMPCIE_PKT_FLAGS_PRIO_SHIFT)
+
+/* These are added to fix up teh compile issues */
+#define BCMPCIE_TXPOST_FLAGS_FRAME_802_3	BCMPCIE_PKT_FLAGS_FRAME_802_3
+#define BCMPCIE_TXPOST_FLAGS_FRAME_802_11	BCMPCIE_PKT_FLAGS_FRAME_802_11
+#define BCMPCIE_TXPOST_FLAGS_PRIO_SHIFT		BCMPCIE_PKT_FLAGS_PRIO_SHIFT
+#define BCMPCIE_TXPOST_FLAGS_PRIO_MASK		BCMPCIE_PKT_FLAGS_PRIO_MASK
+
+#define BCMPCIE_PKT_FLAGS2_FORCELOWRATE_MASK	0x01
+#define BCMPCIE_PKT_FLAGS2_FORCELOWRATE_SHIFT	0
+
+/* H2D Txpost ring work items */
+typedef union txbuf_submit_item {
+	host_txbuf_post_t	txpost;
+	unsigned char		check[H2DRING_TXPOST_ITEMSIZE];
+} txbuf_submit_item_t;
+
+/* D2H Txcompletion ring work items */
+typedef struct host_txbuf_cmpl {
+	/* common message header */
+	cmn_msg_hdr_t	cmn_hdr;
+	/* completion message header */
+	compl_msg_hdr_t	compl_hdr;
+	union {
+		struct {
+			/* provided meta data len */
+			uint16	metadata_len;
+			/* WLAN side txstatus */
+			uint16	tx_status;
+		};
+		/* XOR checksum or a magic number to audit DMA done */
+		dma_done_t		marker;
+	};
+} host_txbuf_cmpl_t;
+
+typedef union txbuf_complete_item {
+	host_txbuf_cmpl_t	txcmpl;
+	unsigned char		check[D2HRING_TXCMPLT_ITEMSIZE];
+} txbuf_complete_item_t;
+
+#define BCMPCIE_D2H_METADATA_HDRLEN	4
+#define BCMPCIE_D2H_METADATA_MINLEN	(BCMPCIE_D2H_METADATA_HDRLEN + 4)
+
+/* ret buf struct */
+typedef struct ret_buf_ptr {
+	uint32 low_addr;
+	uint32 high_addr;
+} ret_buf_t;
+
+#ifdef PCIE_API_REV1
+/* ioctl specific hdr */
+typedef struct ioctl_hdr {
+	uint16 		cmd;
+	uint16		retbuf_len;
+	uint32		cmd_id;
+} ioctl_hdr_t;
+typedef struct ioctlptr_hdr {
+	uint16 		cmd;
+	uint16		retbuf_len;
+	uint16 		buflen;
+	uint16		rsvd;
+	uint32		cmd_id;
+} ioctlptr_hdr_t;
+#else /* PCIE_API_REV1 */
+typedef struct ioctl_req_hdr {
+	uint32		pkt_id; /* Packet ID */
+	uint32 		cmd; /* IOCTL ID */
+	uint16		retbuf_len;
+	uint16 		buflen;
+	uint16		xt_id; /* transaction ID */
+	uint16		rsvd[1];
+} ioctl_req_hdr_t;
+#endif /* PCIE_API_REV1 */
+
+
+/* Complete msgbuf hdr for ioctl from host to dongle */
+typedef struct ioct_reqst_hdr {
+	cmn_msg_hdr_t msg;
+#ifdef PCIE_API_REV1
+	ioctl_hdr_t ioct_hdr;
+#else
+	ioctl_req_hdr_t ioct_hdr;
+#endif
+	ret_buf_t ret_buf;
+} ioct_reqst_hdr_t;
+typedef struct ioctptr_reqst_hdr {
+	cmn_msg_hdr_t msg;
+#ifdef PCIE_API_REV1
+	ioctlptr_hdr_t ioct_hdr;
+#else
+	ioctl_req_hdr_t ioct_hdr;
+#endif
+	ret_buf_t ret_buf;
+	ret_buf_t ioct_buf;
+} ioctptr_reqst_hdr_t;
+
+/* ioctl response header */
+typedef struct ioct_resp_hdr {
+	cmn_msg_hdr_t   msg;
+#ifdef PCIE_API_REV1
+	uint32	cmd_id;
+#else
+	uint32	pkt_id;
+#endif
+	uint32	status;
+	uint32	ret_len;
+	uint32  inline_data;
+#ifdef PCIE_API_REV1
+#else
+	uint16	xt_id;	/* transaction ID */
+	uint16	rsvd[1];
+#endif
+} ioct_resp_hdr_t;
+
+/* ioct resp header used in dongle */
+/* ret buf hdr will be stripped off inside dongle itself */
+typedef struct msgbuf_ioctl_resp {
+	ioct_resp_hdr_t	ioct_hdr;
+	ret_buf_t	ret_buf;	/* ret buf pointers */
+} msgbuf_ioct_resp_t;
+
+/* WL evet hdr info */
+typedef struct wl_event_hdr {
+	cmn_msg_hdr_t   msg;
+	uint16 event;
+	uint8 flags;
+	uint8 rsvd;
+	uint16 retbuf_len;
+	uint16 rsvd1;
+	uint32 rxbufid;
+} wl_event_hdr_t;
+
+#define TXDESCR_FLOWID_PCIELPBK_1	0xFF
+#define TXDESCR_FLOWID_PCIELPBK_2	0xFE
+
+typedef struct txbatch_lenptr_tup {
+	uint32 pktid;
+	uint16 pktlen;
+	uint16 rsvd;
+	ret_buf_t	ret_buf;	/* ret buf pointers */
+} txbatch_lenptr_tup_t;
+
+typedef struct txbatch_cmn_msghdr {
+	cmn_msg_hdr_t   msg;
+	uint8 priority;
+	uint8 hdrlen;
+	uint8 pktcnt;
+	uint8 flowid;
+	uint8 txhdr[ETHER_HDR_LEN];
+	uint16 rsvd;
+} txbatch_cmn_msghdr_t;
+
+typedef struct txbatch_msghdr {
+	txbatch_cmn_msghdr_t txcmn;
+	txbatch_lenptr_tup_t tx_tup[0]; /* Based on packet count */
+} txbatch_msghdr_t;
+
+/* TX desc posting header */
+typedef struct tx_lenptr_tup {
+	uint16 pktlen;
+	uint16 rsvd;
+	ret_buf_t	ret_buf;	/* ret buf pointers */
+} tx_lenptr_tup_t;
+
+typedef struct txdescr_cmn_msghdr {
+	cmn_msg_hdr_t   msg;
+	uint8 priority;
+	uint8 hdrlen;
+	uint8 descrcnt;
+	uint8 flowid;
+	uint32 pktid;
+} txdescr_cmn_msghdr_t;
+
+typedef struct txdescr_msghdr {
+	txdescr_cmn_msghdr_t txcmn;
+	uint8 txhdr[ETHER_HDR_LEN];
+	uint16 rsvd;
+	tx_lenptr_tup_t tx_tup[0]; /* Based on descriptor count */
+} txdescr_msghdr_t;
+
+/* Tx status header info */
+typedef struct txstatus_hdr {
+	cmn_msg_hdr_t   msg;
+	uint32 pktid;
+} txstatus_hdr_t;
+/* RX bufid-len-ptr tuple */
+typedef struct rx_lenptr_tup {
+	uint32 rxbufid;
+	uint16 len;
+	uint16 rsvd2;
+	ret_buf_t	ret_buf;	/* ret buf pointers */
+} rx_lenptr_tup_t;
+/* Rx descr Post hdr info */
+typedef struct rxdesc_msghdr {
+	cmn_msg_hdr_t   msg;
+	uint16 rsvd0;
+	uint8 rsvd1;
+	uint8 descnt;
+	rx_lenptr_tup_t rx_tup[0];
+} rxdesc_msghdr_t;
+
+/* RX complete tuples */
+typedef struct rxcmplt_tup {
+	uint16 retbuf_len;
+	uint16 data_offset;
+	uint32 rxstatus0;
+	uint32 rxstatus1;
+	uint32 rxbufid;
+} rxcmplt_tup_t;
+/* RX complete messge hdr */
+typedef struct rxcmplt_hdr {
+	cmn_msg_hdr_t   msg;
+	uint16 rsvd0;
+	uint16 rxcmpltcnt;
+	rxcmplt_tup_t rx_tup[0];
+} rxcmplt_hdr_t;
+typedef struct hostevent_hdr {
+	cmn_msg_hdr_t   msg;
+	uint32 evnt_pyld;
+} hostevent_hdr_t;
+
+typedef struct dma_xfer_params {
+	uint32 src_physaddr_hi;
+	uint32 src_physaddr_lo;
+	uint32 dest_physaddr_hi;
+	uint32 dest_physaddr_lo;
+	uint32 len;
+	uint32 srcdelay;
+	uint32 destdelay;
+} dma_xfer_params_t;
+
+enum {
+	HOST_EVENT_CONS_CMD = 1
+};
+
+/* defines for flags */
+#define MSGBUF_IOC_ACTION_MASK 0x1
+
+#endif /* _bcmmsgbuf_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmpcie.h b/drivers/net/wireless/bcm4336/include/bcmpcie.h
--- a/drivers/net/wireless/bcm4336/include/bcmpcie.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmpcie.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,203 @@
+/*
+ * Broadcom PCIE
+ * Software-specific definitions shared between device and host side
+ * Explains the shared area between host and dongle
+ * $Copyright Open 2005 Broadcom Corporation$
+ *
+ * $Id: bcmpcie.h 497456 2014-08-19 15:06:33Z $
+ */
+
+#ifndef	_bcmpcie_h_
+#define	_bcmpcie_h_
+
+#include <bcmutils.h>
+
+#define ADDR_64(x)			(x.addr)
+#define HIGH_ADDR_32(x)     ((uint32) (((sh_addr_t) x).high_addr))
+#define LOW_ADDR_32(x)      ((uint32) (((sh_addr_t) x).low_addr))
+
+typedef struct {
+	uint32 low_addr;
+	uint32 high_addr;
+} sh_addr_t;
+
+
+
+#ifdef BCMPCIE_SUPPORT_TX_PUSH_RING
+#define BCMPCIE_PUSH_TX_RING	1
+#else
+#define BCMPCIE_PUSH_TX_RING	0
+#endif /* BCMPCIE_SUPPORT_TX_PUSH_RING */
+
+/* May be overridden by 43xxxxx-roml.mk */
+#if !defined(BCMPCIE_MAX_TX_FLOWS)
+#define BCMPCIE_MAX_TX_FLOWS	40
+#endif /* ! BCMPCIE_MAX_TX_FLOWS */
+
+#define PCIE_SHARED_VERSION		0x00005
+#define PCIE_SHARED_VERSION_MASK	0x000FF
+#define PCIE_SHARED_ASSERT_BUILT	0x00100
+#define PCIE_SHARED_ASSERT		0x00200
+#define PCIE_SHARED_TRAP		0x00400
+#define PCIE_SHARED_IN_BRPT		0x00800
+#define PCIE_SHARED_SET_BRPT		0x01000
+#define PCIE_SHARED_PENDING_BRPT	0x02000
+#define PCIE_SHARED_TXPUSH_SPRT		0x04000
+#define PCIE_SHARED_EVT_SEQNUM		0x08000
+#define PCIE_SHARED_DMA_INDEX		0x10000
+
+/* D2H M2M DMA Complete Sync mechanism: Modulo-253-SeqNum or XORCSUM */
+#define PCIE_SHARED_D2H_SYNC_SEQNUM		0x20000
+#define PCIE_SHARED_D2H_SYNC_XORCSUM		0x40000
+#define PCIE_SHARED_D2H_SYNC_MODE_MASK \
+	(PCIE_SHARED_D2H_SYNC_SEQNUM | PCIE_SHARED_D2H_SYNC_XORCSUM)
+
+#define BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT		0
+#define BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT		1
+#define BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE		2
+#define BCMPCIE_D2H_MSGRING_TX_COMPLETE			3
+#define BCMPCIE_D2H_MSGRING_RX_COMPLETE			4
+#define BCMPCIE_COMMON_MSGRING_MAX_ID			4
+
+/* Added only for single tx ring */
+#define BCMPCIE_H2D_TXFLOWRINGID			5
+
+#define BCMPCIE_H2D_COMMON_MSGRINGS			2
+#define BCMPCIE_D2H_COMMON_MSGRINGS			3
+#define BCMPCIE_COMMON_MSGRINGS				5
+
+enum h2dring_idx {
+	BCMPCIE_H2D_MSGRING_CONTROL_SUBMIT_IDX = 0,
+	BCMPCIE_H2D_MSGRING_RXPOST_SUBMIT_IDX =	1,
+	BCMPCIE_H2D_MSGRING_TXFLOW_IDX_START = 2
+};
+
+enum d2hring_idx {
+	BCMPCIE_D2H_MSGRING_CONTROL_COMPLETE_IDX = 0,
+	BCMPCIE_D2H_MSGRING_TX_COMPLETE_IDX = 1,
+	BCMPCIE_D2H_MSGRING_RX_COMPLETE_IDX = 2
+};
+
+typedef struct ring_mem {
+	uint16		idx;
+	uint8		type;
+	uint8		rsvd;
+	uint16		max_item;
+	uint16		len_items;
+	sh_addr_t	base_addr;
+} ring_mem_t;
+
+#define RINGSTATE_INITED	1
+
+typedef struct ring_state {
+	uint8 idx;
+	uint8 state;
+	uint16 r_offset;
+	uint16 w_offset;
+	uint16 e_offset;
+} ring_state_t;
+
+
+
+typedef struct ring_info {
+	/* locations in the TCM where the ringmem is and ringstate are defined */
+	uint32		ringmem_ptr;	/* ring mem location in TCM */
+	uint32		h2d_w_idx_ptr;
+
+	uint32		h2d_r_idx_ptr;
+	uint32		d2h_w_idx_ptr;
+
+	uint32		d2h_r_idx_ptr;
+	/* host locations where the DMA of read/write indices are */
+	sh_addr_t	h2d_w_idx_hostaddr;
+	sh_addr_t	h2d_r_idx_hostaddr;
+	sh_addr_t	d2h_w_idx_hostaddr;
+	sh_addr_t	d2h_r_idx_hostaddr;
+	uint16		max_sub_queues;
+	uint16		rsvd;
+} ring_info_t;
+
+typedef struct {
+	/* shared area version captured at flags 7:0 */
+	uint32	flags;
+
+	uint32  trap_addr;
+	uint32  assert_exp_addr;
+	uint32  assert_file_addr;
+	uint32  assert_line;
+	uint32	console_addr;		/* Address of hnd_cons_t */
+
+	uint32  msgtrace_addr;
+
+	uint32  fwid;
+
+	/* Used for debug/flow control */
+	uint16  total_lfrag_pkt_cnt;
+	uint16  max_host_rxbufs; /* rsvd in spec */
+
+	uint32 dma_rxoffset; /* rsvd in spec */
+
+	/* these will be used for sleep request/ack, d3 req/ack */
+	uint32  h2d_mb_data_ptr;
+	uint32  d2h_mb_data_ptr;
+
+	/* information pertinent to host IPC/msgbuf channels */
+	/* location in the TCM memory which has the ring_info */
+	uint32	rings_info_ptr;
+
+	/* block of host memory for the scratch buffer */
+	uint32		host_dma_scratch_buffer_len;
+	sh_addr_t	host_dma_scratch_buffer;
+
+	/* block of host memory for the dongle to push the status into */
+	uint32		device_rings_stsblk_len;
+	sh_addr_t	device_rings_stsblk;
+#ifdef BCM_BUZZZ
+	uint32	buzzz;	/* BUZZZ state format strings and trace buffer */
+#endif
+} pciedev_shared_t;
+
+
+/* H2D mail box Data */
+#define H2D_HOST_D3_INFORM	0x00000001
+#define H2D_HOST_DS_ACK		0x00000002
+#define H2D_HOST_CONS_INT	0x80000000	/* h2d int for console cmds  */
+
+/* D2H mail box Data */
+#define D2H_DEV_D3_ACK		0x00000001
+#define D2H_DEV_DS_ENTER_REQ	0x00000002
+#define D2H_DEV_DS_EXIT_NOTE	0x00000004
+#define D2H_DEV_FWHALT		0x10000000
+
+
+extern pciedev_shared_t pciedev_shared;
+#define NEXTTXP(i, d)           ((((i)+1) >= (d)) ? 0 : ((i)+1))
+#define NTXPACTIVE(r, w, d)     (((r) <= (w)) ? ((w)-(r)) : ((d)-(r)+(w)))
+#define NTXPAVAIL(r, w, d)      (((d) - NTXPACTIVE((r), (w), (d))) > 1)
+
+/* Function can be used to notify host of FW halt */
+#define READ_AVAIL_SPACE(w, r, d)		\
+			((w >= r) ? (w - r) : (d - r))
+
+#define WRT_PEND(x)	((x)->wr_pending)
+#define DNGL_RING_WPTR(msgbuf)		(*((msgbuf)->tcm_rs_w_ptr))
+#define BCMMSGBUF_RING_SET_W_PTR(msgbuf, a)	(DNGL_RING_WPTR(msgbuf) = (a))
+
+#define DNGL_RING_RPTR(msgbuf)		(*((msgbuf)->tcm_rs_r_ptr))
+#define BCMMSGBUF_RING_SET_R_PTR(msgbuf, a)	(DNGL_RING_RPTR(msgbuf) = (a))
+
+#define  RING_READ_PTR(x)	((x)->ringstate->r_offset)
+#define  RING_WRITE_PTR(x)	((x)->ringstate->w_offset)
+#define  RING_START_PTR(x)	((x)->ringmem->base_addr.low_addr)
+#define  RING_MAX_ITEM(x)	((x)->ringmem->max_item)
+#define  RING_LEN_ITEMS(x)	((x)->ringmem->len_items)
+#define	 HOST_RING_BASE(x)	((x)->ring_base.va)
+#define	 HOST_RING_END(x)	((uint8 *)HOST_RING_BASE((x)) + \
+			 ((RING_MAX_ITEM((x))-1)*RING_LEN_ITEMS((x))))
+
+#define WRITE_SPACE_AVAIL_CONTINUOUS(r, w, d)		((w >= r) ? (d - w) : (r - w))
+#define WRITE_SPACE_AVAIL(r, w, d)	(d - (NTXPACTIVE(r, w, d)) - 1)
+#define CHECK_WRITE_SPACE(r, w, d)	\
+	MIN(WRITE_SPACE_AVAIL(r, w, d), WRITE_SPACE_AVAIL_CONTINUOUS(r, w, d))
+
+#endif	/* _bcmpcie_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmpcispi.h b/drivers/net/wireless/bcm4336/include/bcmpcispi.h
--- a/drivers/net/wireless/bcm4336/include/bcmpcispi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmpcispi.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,163 @@
+/*
+ * Broadcom PCI-SPI Host Controller Register Definitions
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: bcmpcispi.h 241182 2011-02-17 21:50:03Z $
+ */
+#ifndef	_BCM_PCI_SPI_H
+#define	_BCM_PCI_SPI_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+
+typedef volatile struct {
+	uint32 spih_ctrl;		/* 0x00 SPI Control Register */
+	uint32 spih_stat;		/* 0x04 SPI Status Register */
+	uint32 spih_data;		/* 0x08 SPI Data Register, 32-bits wide */
+	uint32 spih_ext;		/* 0x0C SPI Extension Register */
+	uint32 PAD[4];			/* 0x10-0x1F PADDING */
+
+	uint32 spih_gpio_ctrl;		/* 0x20 SPI GPIO Control Register */
+	uint32 spih_gpio_data;		/* 0x24 SPI GPIO Data Register */
+	uint32 PAD[6];			/* 0x28-0x3F PADDING */
+
+	uint32 spih_int_edge;		/* 0x40 SPI Interrupt Edge Register (0=Level, 1=Edge) */
+	uint32 spih_int_pol;		/* 0x44 SPI Interrupt Polarity Register (0=Active Low, */
+							/* 1=Active High) */
+	uint32 spih_int_mask;		/* 0x48 SPI Interrupt Mask */
+	uint32 spih_int_status;		/* 0x4C SPI Interrupt Status */
+	uint32 PAD[4];			/* 0x50-0x5F PADDING */
+
+	uint32 spih_hex_disp;		/* 0x60 SPI 4-digit hex display value */
+	uint32 spih_current_ma;		/* 0x64 SPI SD card current consumption in mA */
+	uint32 PAD[1];			/* 0x68 PADDING */
+	uint32 spih_disp_sel;		/* 0x6c SPI 4-digit hex display mode select (1=current) */
+	uint32 PAD[4];			/* 0x70-0x7F PADDING */
+	uint32 PAD[8];			/* 0x80-0x9F PADDING */
+	uint32 PAD[8];			/* 0xA0-0xBF PADDING */
+	uint32 spih_pll_ctrl;	/* 0xC0 PLL Control Register */
+	uint32 spih_pll_status;	/* 0xC4 PLL Status Register */
+	uint32 spih_xtal_freq;	/* 0xC8 External Clock Frequency in units of 10000Hz */
+	uint32 spih_clk_count;	/* 0xCC External Clock Count Register */
+
+} spih_regs_t;
+
+typedef volatile struct {
+	uint32 cfg_space[0x40];		/* 0x000-0x0FF PCI Configuration Space (Read Only) */
+	uint32 P_IMG_CTRL0;		/* 0x100 PCI Image0 Control Register */
+
+	uint32 P_BA0;			/* 0x104 32 R/W PCI Image0 Base Address register */
+	uint32 P_AM0;			/* 0x108 32 R/W PCI Image0 Address Mask register */
+	uint32 P_TA0;			/* 0x10C 32 R/W PCI Image0 Translation Address register */
+	uint32 P_IMG_CTRL1;		/* 0x110 32 R/W PCI Image1 Control register */
+	uint32 P_BA1;			/* 0x114 32 R/W PCI Image1 Base Address register */
+	uint32 P_AM1;			/* 0x118 32 R/W PCI Image1 Address Mask register */
+	uint32 P_TA1;			/* 0x11C 32 R/W PCI Image1 Translation Address register */
+	uint32 P_IMG_CTRL2;		/* 0x120 32 R/W PCI Image2 Control register */
+	uint32 P_BA2;			/* 0x124 32 R/W PCI Image2 Base Address register */
+	uint32 P_AM2;			/* 0x128 32 R/W PCI Image2 Address Mask register */
+	uint32 P_TA2;			/* 0x12C 32 R/W PCI Image2 Translation Address register */
+	uint32 P_IMG_CTRL3;		/* 0x130 32 R/W PCI Image3 Control register */
+	uint32 P_BA3;			/* 0x134 32 R/W PCI Image3 Base Address register */
+	uint32 P_AM3;			/* 0x138 32 R/W PCI Image3 Address Mask register */
+	uint32 P_TA3;			/* 0x13C 32 R/W PCI Image3 Translation Address register */
+	uint32 P_IMG_CTRL4;		/* 0x140 32 R/W PCI Image4 Control register */
+	uint32 P_BA4;			/* 0x144 32 R/W PCI Image4 Base Address register */
+	uint32 P_AM4;			/* 0x148 32 R/W PCI Image4 Address Mask register */
+	uint32 P_TA4;			/* 0x14C 32 R/W PCI Image4 Translation Address register */
+	uint32 P_IMG_CTRL5;		/* 0x150 32 R/W PCI Image5 Control register */
+	uint32 P_BA5;			/* 0x154 32 R/W PCI Image5 Base Address register */
+	uint32 P_AM5;			/* 0x158 32 R/W PCI Image5 Address Mask register */
+	uint32 P_TA5;			/* 0x15C 32 R/W PCI Image5 Translation Address register */
+	uint32 P_ERR_CS;		/* 0x160 32 R/W PCI Error Control and Status register */
+	uint32 P_ERR_ADDR;		/* 0x164 32 R PCI Erroneous Address register */
+	uint32 P_ERR_DATA;		/* 0x168 32 R PCI Erroneous Data register */
+
+	uint32 PAD[5];			/* 0x16C-0x17F PADDING */
+
+	uint32 WB_CONF_SPC_BAR;		/* 0x180 32 R WISHBONE Configuration Space Base Address */
+	uint32 W_IMG_CTRL1;		/* 0x184 32 R/W WISHBONE Image1 Control register */
+	uint32 W_BA1;			/* 0x188 32 R/W WISHBONE Image1 Base Address register */
+	uint32 W_AM1;			/* 0x18C 32 R/W WISHBONE Image1 Address Mask register */
+	uint32 W_TA1;			/* 0x190 32 R/W WISHBONE Image1 Translation Address reg */
+	uint32 W_IMG_CTRL2;		/* 0x194 32 R/W WISHBONE Image2 Control register */
+	uint32 W_BA2;			/* 0x198 32 R/W WISHBONE Image2 Base Address register */
+	uint32 W_AM2;			/* 0x19C 32 R/W WISHBONE Image2 Address Mask register */
+	uint32 W_TA2;			/* 0x1A0 32 R/W WISHBONE Image2 Translation Address reg */
+	uint32 W_IMG_CTRL3;		/* 0x1A4 32 R/W WISHBONE Image3 Control register */
+	uint32 W_BA3;			/* 0x1A8 32 R/W WISHBONE Image3 Base Address register */
+	uint32 W_AM3;			/* 0x1AC 32 R/W WISHBONE Image3 Address Mask register */
+	uint32 W_TA3;			/* 0x1B0 32 R/W WISHBONE Image3 Translation Address reg */
+	uint32 W_IMG_CTRL4;		/* 0x1B4 32 R/W WISHBONE Image4 Control register */
+	uint32 W_BA4;			/* 0x1B8 32 R/W WISHBONE Image4 Base Address register */
+	uint32 W_AM4;			/* 0x1BC 32 R/W WISHBONE Image4 Address Mask register */
+	uint32 W_TA4;			/* 0x1C0 32 R/W WISHBONE Image4 Translation Address reg */
+	uint32 W_IMG_CTRL5;		/* 0x1C4 32 R/W WISHBONE Image5 Control register */
+	uint32 W_BA5;			/* 0x1C8 32 R/W WISHBONE Image5 Base Address register */
+	uint32 W_AM5;			/* 0x1CC 32 R/W WISHBONE Image5 Address Mask register */
+	uint32 W_TA5;			/* 0x1D0 32 R/W WISHBONE Image5 Translation Address reg */
+	uint32 W_ERR_CS;		/* 0x1D4 32 R/W WISHBONE Error Control and Status reg */
+	uint32 W_ERR_ADDR;		/* 0x1D8 32 R WISHBONE Erroneous Address register */
+	uint32 W_ERR_DATA;		/* 0x1DC 32 R WISHBONE Erroneous Data register */
+	uint32 CNF_ADDR;		/* 0x1E0 32 R/W Configuration Cycle register */
+	uint32 CNF_DATA;		/* 0x1E4 32 R/W Configuration Cycle Generation Data reg */
+
+	uint32 INT_ACK;			/* 0x1E8 32 R Interrupt Acknowledge register */
+	uint32 ICR;			/* 0x1EC 32 R/W Interrupt Control register */
+	uint32 ISR;			/* 0x1F0 32 R/W Interrupt Status register */
+} spih_pciregs_t;
+
+/*
+ * PCI Core interrupt enable and status bit definitions.
+ */
+
+/* PCI Core ICR Register bit definitions */
+#define PCI_INT_PROP_EN		(1 << 0)	/* Interrupt Propagation Enable */
+#define PCI_WB_ERR_INT_EN	(1 << 1)	/* Wishbone Error Interrupt Enable */
+#define PCI_PCI_ERR_INT_EN	(1 << 2)	/* PCI Error Interrupt Enable */
+#define PCI_PAR_ERR_INT_EN	(1 << 3)	/* Parity Error Interrupt Enable */
+#define PCI_SYS_ERR_INT_EN	(1 << 4)	/* System Error Interrupt Enable */
+#define PCI_SOFTWARE_RESET	(1U << 31)	/* Software reset of the PCI Core. */
+
+
+/* PCI Core ISR Register bit definitions */
+#define PCI_INT_PROP_ST		(1 << 0)	/* Interrupt Propagation Status */
+#define PCI_WB_ERR_INT_ST	(1 << 1)	/* Wishbone Error Interrupt Status */
+#define PCI_PCI_ERR_INT_ST	(1 << 2)	/* PCI Error Interrupt Status */
+#define PCI_PAR_ERR_INT_ST	(1 << 3)	/* Parity Error Interrupt Status */
+#define PCI_SYS_ERR_INT_ST	(1 << 4)	/* System Error Interrupt Status */
+
+
+/* Registers on the Wishbone bus */
+#define SPIH_CTLR_INTR		(1 << 0)	/* SPI Host Controller Core Interrupt */
+#define SPIH_DEV_INTR		(1 << 1)	/* SPI Device Interrupt */
+#define SPIH_WFIFO_INTR		(1 << 2)	/* SPI Tx FIFO Empty Intr (FPGA Rev >= 8) */
+
+/* GPIO Bit definitions */
+#define SPIH_CS			(1 << 0)	/* SPI Chip Select (active low) */
+#define SPIH_SLOT_POWER		(1 << 1)	/* SD Card Slot Power Enable */
+#define SPIH_CARD_DETECT	(1 << 2)	/* SD Card Detect */
+
+/* SPI Status Register Bit definitions */
+#define SPIH_STATE_MASK		0x30		/* SPI Transfer State Machine state mask */
+#define SPIH_STATE_SHIFT	4		/* SPI Transfer State Machine state shift */
+#define SPIH_WFFULL		(1 << 3)	/* SPI Write FIFO Full */
+#define SPIH_WFEMPTY		(1 << 2)	/* SPI Write FIFO Empty */
+#define SPIH_RFFULL		(1 << 1)	/* SPI Read FIFO Full */
+#define SPIH_RFEMPTY		(1 << 0)	/* SPI Read FIFO Empty */
+
+#define SPIH_EXT_CLK		(1U << 31)	/* Use External Clock as PLL Clock source. */
+
+#define SPIH_PLL_NO_CLK		(1 << 1)	/* Set to 1 if the PLL's input clock is lost. */
+#define SPIH_PLL_LOCKED		(1 << 3)	/* Set to 1 when the PLL is locked. */
+
+/* Spin bit loop bound check */
+#define SPI_SPIN_BOUND		0xf4240		/* 1 million */
+
+#endif /* _BCM_PCI_SPI_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmperf.h b/drivers/net/wireless/bcm4336/include/bcmperf.h
--- a/drivers/net/wireless/bcm4336/include/bcmperf.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmperf.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,18 @@
+/*
+ * Performance counters software interface.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmperf.h 241182 2011-02-17 21:50:03Z $
+ */
+/* essai */
+#ifndef _BCMPERF_H_
+#define _BCMPERF_H_
+/* get cache hits and misses */
+#define BCMPERF_ENABLE_INSTRCOUNT()
+#define BCMPERF_ENABLE_ICACHE_MISS()
+#define BCMPERF_ENABLE_ICACHE_HIT()
+#define	BCMPERF_GETICACHE_MISS(x)	((x) = 0)
+#define	BCMPERF_GETICACHE_HIT(x)	((x) = 0)
+#define	BCMPERF_GETINSTRCOUNT(x)	((x) = 0)
+#endif /* _BCMPERF_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmsdbus.h b/drivers/net/wireless/bcm4336/include/bcmsdbus.h
--- a/drivers/net/wireless/bcm4336/include/bcmsdbus.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmsdbus.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,125 @@
+/*
+ * Definitions for API from sdio common code (bcmsdh) to individual
+ * host controller drivers.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmsdbus.h 408158 2013-06-17 22:15:35Z $
+ */
+
+#ifndef	_sdio_api_h_
+#define	_sdio_api_h_
+
+
+#define SDIOH_API_RC_SUCCESS                          (0x00)
+#define SDIOH_API_RC_FAIL	                      (0x01)
+#define SDIOH_API_SUCCESS(status) (status == 0)
+
+#define SDIOH_READ              0	/* Read request */
+#define SDIOH_WRITE             1	/* Write request */
+
+#define SDIOH_DATA_FIX          0	/* Fixed addressing */
+#define SDIOH_DATA_INC          1	/* Incremental addressing */
+
+#define SDIOH_CMD_TYPE_NORMAL   0       /* Normal command */
+#define SDIOH_CMD_TYPE_APPEND   1       /* Append command */
+#define SDIOH_CMD_TYPE_CUTTHRU  2       /* Cut-through command */
+
+#define SDIOH_DATA_PIO          0       /* PIO mode */
+#define SDIOH_DATA_DMA          1       /* DMA mode */
+
+/* Max number of glommed pkts */
+#ifdef CUSTOM_MAX_TXGLOM_SIZE
+#define SDPCM_MAXGLOM_SIZE  CUSTOM_MAX_TXGLOM_SIZE
+#else
+#define SDPCM_MAXGLOM_SIZE	40
+#endif /* CUSTOM_MAX_TXGLOM_SIZE */
+
+#define SDPCM_TXGLOM_CPY 0			/* SDIO 2.0 should use copy mode */
+#define SDPCM_TXGLOM_MDESC	1		/* SDIO 3.0 should use multi-desc mode */
+
+#ifdef CUSTOM_DEF_TXGLOM_SIZE
+#define SDPCM_DEFGLOM_SIZE  CUSTOM_DEF_TXGLOM_SIZE
+#else
+#define SDPCM_DEFGLOM_SIZE SDPCM_MAXGLOM_SIZE
+#endif /* CUSTOM_DEF_TXGLOM_SIZE */
+
+#if SDPCM_DEFGLOM_SIZE > SDPCM_MAXGLOM_SIZE
+#warning "SDPCM_DEFGLOM_SIZE cannot be higher than SDPCM_MAXGLOM_SIZE!!"
+#undef SDPCM_DEFGLOM_SIZE
+#define SDPCM_DEFGLOM_SIZE SDPCM_MAXGLOM_SIZE
+#endif
+
+typedef int SDIOH_API_RC;
+
+/* SDio Host structure */
+typedef struct sdioh_info sdioh_info_t;
+
+/* callback function, taking one arg */
+typedef void (*sdioh_cb_fn_t)(void *);
+
+extern SDIOH_API_RC sdioh_interrupt_register(sdioh_info_t *si, sdioh_cb_fn_t fn, void *argh);
+extern SDIOH_API_RC sdioh_interrupt_deregister(sdioh_info_t *si);
+
+/* query whether SD interrupt is enabled or not */
+extern SDIOH_API_RC sdioh_interrupt_query(sdioh_info_t *si, bool *onoff);
+
+/* enable or disable SD interrupt */
+extern SDIOH_API_RC sdioh_interrupt_set(sdioh_info_t *si, bool enable_disable);
+
+#if defined(DHD_DEBUG)
+extern bool sdioh_interrupt_pending(sdioh_info_t *si);
+#endif
+
+/* read or write one byte using cmd52 */
+extern SDIOH_API_RC sdioh_request_byte(sdioh_info_t *si, uint rw, uint fnc, uint addr, uint8 *byte);
+
+/* read or write 2/4 bytes using cmd53 */
+extern SDIOH_API_RC sdioh_request_word(sdioh_info_t *si, uint cmd_type, uint rw, uint fnc,
+	uint addr, uint32 *word, uint nbyte);
+
+/* read or write any buffer using cmd53 */
+extern SDIOH_API_RC sdioh_request_buffer(sdioh_info_t *si, uint pio_dma, uint fix_inc,
+	uint rw, uint fnc_num, uint32 addr, uint regwidth, uint32 buflen, uint8 *buffer,
+	void *pkt);
+
+/* get cis data */
+extern SDIOH_API_RC sdioh_cis_read(sdioh_info_t *si, uint fuc, uint8 *cis, uint32 length);
+
+extern SDIOH_API_RC sdioh_cfg_read(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+extern SDIOH_API_RC sdioh_cfg_write(sdioh_info_t *si, uint fuc, uint32 addr, uint8 *data);
+
+/* query number of io functions */
+extern uint sdioh_query_iofnum(sdioh_info_t *si);
+
+/* handle iovars */
+extern int sdioh_iovar_op(sdioh_info_t *si, const char *name,
+                          void *params, int plen, void *arg, int len, bool set);
+
+/* Issue abort to the specified function and clear controller as needed */
+extern int sdioh_abort(sdioh_info_t *si, uint fnc);
+
+/* Start and Stop SDIO without re-enumerating the SD card. */
+extern int sdioh_start(sdioh_info_t *si, int stage);
+extern int sdioh_stop(sdioh_info_t *si);
+
+/* Wait system lock free */
+extern int sdioh_waitlockfree(sdioh_info_t *si);
+
+/* Reset and re-initialize the device */
+extern int sdioh_sdio_reset(sdioh_info_t *si);
+
+
+
+#if defined(BCMSDIOH_STD)
+	#define SDIOH_SLEEP_ENABLED
+#endif
+extern SDIOH_API_RC sdioh_sleep(sdioh_info_t *si, bool enab);
+
+/* GPIO support */
+extern SDIOH_API_RC sdioh_gpio_init(sdioh_info_t *sd);
+extern bool sdioh_gpioin(sdioh_info_t *sd, uint32 gpio);
+extern SDIOH_API_RC sdioh_gpioouten(sdioh_info_t *sd, uint32 gpio);
+extern SDIOH_API_RC sdioh_gpioout(sdioh_info_t *sd, uint32 gpio, bool enab);
+
+#endif /* _sdio_api_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmsdh.h b/drivers/net/wireless/bcm4336/include/bcmsdh.h
--- a/drivers/net/wireless/bcm4336/include/bcmsdh.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmsdh.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,239 @@
+/*
+ * SDIO host client driver interface of Broadcom HNBU
+ *     export functions to client drivers
+ *     abstract OS and BUS specific details of SDIO
+ *
+ * $ Copyright Open License Broadcom Corporation $
+ *
+ * $Id: bcmsdh.h 450676 2014-01-22 22:45:13Z $
+ */
+
+/**
+ * @file bcmsdh.h
+ */
+
+#ifndef	_bcmsdh_h_
+#define	_bcmsdh_h_
+
+#define BCMSDH_ERROR_VAL	0x0001 /* Error */
+#define BCMSDH_INFO_VAL		0x0002 /* Info */
+extern const uint bcmsdh_msglevel;
+
+#define BCMSDH_ERROR(x) printf x
+#define BCMSDH_INFO(x)
+
+#if defined(BCMSDIO) && (defined(BCMSDIOH_STD) || defined(BCMSDIOH_BCM) || \
+	defined(BCMSDIOH_SPI))
+#define BCMSDH_ADAPTER
+#endif /* BCMSDIO && (BCMSDIOH_STD || BCMSDIOH_BCM || BCMSDIOH_SPI) */
+
+/* forward declarations */
+typedef struct bcmsdh_info bcmsdh_info_t;
+typedef void (*bcmsdh_cb_fn_t)(void *);
+
+#if 0 && (NDISVER >= 0x0630) && 1
+extern bcmsdh_info_t *bcmsdh_attach(osl_t *osh, void *cfghdl,
+	void **regsva, uint irq, shared_info_t *sh);
+#else
+extern bcmsdh_info_t *bcmsdh_attach(osl_t *osh, void *sdioh, ulong *regsva);
+/**
+ * BCMSDH API context
+ */
+struct bcmsdh_info
+{
+	bool	init_success;	/* underlying driver successfully attached */
+	void	*sdioh;		/* handler for sdioh */
+	uint32  vendevid;	/* Target Vendor and Device ID on SD bus */
+	osl_t   *osh;
+	bool	regfail;	/* Save status of last reg_read/reg_write call */
+	uint32	sbwad;		/* Save backplane window address */
+	void	*os_cxt;        /* Pointer to per-OS private data */
+};
+#endif
+
+/* Detach - freeup resources allocated in attach */
+extern int bcmsdh_detach(osl_t *osh, void *sdh);
+
+/* Query if SD device interrupts are enabled */
+extern bool bcmsdh_intr_query(void *sdh);
+
+/* Enable/disable SD interrupt */
+extern int bcmsdh_intr_enable(void *sdh);
+extern int bcmsdh_intr_disable(void *sdh);
+
+/* Register/deregister device interrupt handler. */
+extern int bcmsdh_intr_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+extern int bcmsdh_intr_dereg(void *sdh);
+/* Enable/disable SD card interrupt forward */
+extern void bcmsdh_intr_forward(void *sdh, bool pass);
+
+#if defined(DHD_DEBUG)
+/* Query pending interrupt status from the host controller */
+extern bool bcmsdh_intr_pending(void *sdh);
+#endif
+
+/* Register a callback to be called if and when bcmsdh detects
+ * device removal. No-op in the case of non-removable/hardwired devices.
+ */
+extern int bcmsdh_devremove_reg(void *sdh, bcmsdh_cb_fn_t fn, void *argh);
+
+/* Access SDIO address space (e.g. CCCR) using CMD52 (single-byte interface).
+ *   fn:   function number
+ *   addr: unmodified SDIO-space address
+ *   data: data byte to write
+ *   err:  pointer to error code (or NULL)
+ */
+extern uint8 bcmsdh_cfg_read(void *sdh, uint func, uint32 addr, int *err);
+extern void bcmsdh_cfg_write(void *sdh, uint func, uint32 addr, uint8 data, int *err);
+
+/* Read/Write 4bytes from/to cfg space */
+extern uint32 bcmsdh_cfg_read_word(void *sdh, uint fnc_num, uint32 addr, int *err);
+extern void bcmsdh_cfg_write_word(void *sdh, uint fnc_num, uint32 addr, uint32 data, int *err);
+
+/* Read CIS content for specified function.
+ *   fn:     function whose CIS is being requested (0 is common CIS)
+ *   cis:    pointer to memory location to place results
+ *   length: number of bytes to read
+ * Internally, this routine uses the values from the cis base regs (0x9-0xB)
+ * to form an SDIO-space address to read the data from.
+ */
+extern int bcmsdh_cis_read(void *sdh, uint func, uint8 *cis, uint length);
+
+/* Synchronous access to device (client) core registers via CMD53 to F1.
+ *   addr: backplane address (i.e. >= regsva from attach)
+ *   size: register width in bytes (2 or 4)
+ *   data: data for register write
+ */
+extern uint32 bcmsdh_reg_read(void *sdh, uint32 addr, uint size);
+extern uint32 bcmsdh_reg_write(void *sdh, uint32 addr, uint size, uint32 data);
+
+/* set sb address window */
+extern int bcmsdhsdio_set_sbaddr_window(void *sdh, uint32 address, bool force_set);
+
+/* Indicate if last reg read/write failed */
+extern bool bcmsdh_regfail(void *sdh);
+
+/* Buffer transfer to/from device (client) core via cmd53.
+ *   fn:       function number
+ *   addr:     backplane address (i.e. >= regsva from attach)
+ *   flags:    backplane width, address increment, sync/async
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ *   pkt:      pointer to packet associated with buf (if any)
+ *   complete: callback function for command completion (async only)
+ *   handle:   handle for completion callback (first arg in callback)
+ * Returns 0 or error code.
+ * NOTE: Async operation is not currently supported.
+ */
+typedef void (*bcmsdh_cmplt_fn_t)(void *handle, int status, bool sync_waiting);
+extern int bcmsdh_send_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete_fn, void *handle);
+extern int bcmsdh_recv_buf(void *sdh, uint32 addr, uint fn, uint flags,
+                           uint8 *buf, uint nbytes, void *pkt,
+                           bcmsdh_cmplt_fn_t complete_fn, void *handle);
+
+extern void bcmsdh_glom_post(void *sdh, uint8 *frame, void *pkt, uint len);
+extern void bcmsdh_glom_clear(void *sdh);
+extern uint bcmsdh_set_mode(void *sdh, uint mode);
+extern bool bcmsdh_glom_enabled(void);
+/* Flags bits */
+#define SDIO_REQ_4BYTE	0x1	/* Four-byte target (backplane) width (vs. two-byte) */
+#define SDIO_REQ_FIXED	0x2	/* Fixed address (FIFO) (vs. incrementing address) */
+#define SDIO_REQ_ASYNC	0x4	/* Async request (vs. sync request) */
+#define SDIO_BYTE_MODE	0x8	/* Byte mode request(non-block mode) */
+
+/* Pending (non-error) return code */
+#define BCME_PENDING	1
+
+/* Read/write to memory block (F1, no FIFO) via CMD53 (sync only).
+ *   rw:       read or write (0/1)
+ *   addr:     direct SDIO address
+ *   buf:      pointer to memory data buffer
+ *   nbytes:   number of bytes to transfer to/from buf
+ * Returns 0 or error code.
+ */
+extern int bcmsdh_rwdata(void *sdh, uint rw, uint32 addr, uint8 *buf, uint nbytes);
+
+/* Issue an abort to the specified function */
+extern int bcmsdh_abort(void *sdh, uint fn);
+
+/* Start SDIO Host Controller communication */
+extern int bcmsdh_start(void *sdh, int stage);
+
+/* Stop SDIO Host Controller communication */
+extern int bcmsdh_stop(void *sdh);
+
+/* Wait system lock free */
+extern int bcmsdh_waitlockfree(void *sdh);
+
+/* Returns the "Device ID" of target device on the SDIO bus. */
+extern int bcmsdh_query_device(void *sdh);
+
+/* Returns the number of IO functions reported by the device */
+extern uint bcmsdh_query_iofnum(void *sdh);
+
+/* Miscellaneous knob tweaker. */
+extern int bcmsdh_iovar_op(void *sdh, const char *name,
+                           void *params, int plen, void *arg, int len, bool set);
+
+/* Reset and reinitialize the device */
+extern int bcmsdh_reset(bcmsdh_info_t *sdh);
+
+/* helper functions */
+
+/* callback functions */
+typedef struct {
+	/* probe the device */
+	void *(*probe)(uint16 vend_id, uint16 dev_id, uint16 bus, uint16 slot,
+	                uint16 func, uint bustype, void * regsva, osl_t * osh,
+	                void * param);
+	/* remove the device */
+	void (*remove)(void *context);
+	/* can we suspend now */
+	int (*suspend)(void *context);
+	/* resume from suspend */
+	int (*resume)(void *context);
+} bcmsdh_driver_t;
+
+/* platform specific/high level functions */
+extern int bcmsdh_register(bcmsdh_driver_t *driver);
+extern void bcmsdh_unregister(void);
+extern bool bcmsdh_chipmatch(uint16 vendor, uint16 device);
+extern void bcmsdh_device_remove(void * sdh);
+
+extern int bcmsdh_reg_sdio_notify(void* semaphore);
+extern void bcmsdh_unreg_sdio_notify(void);
+
+#if defined(OOB_INTR_ONLY)
+extern int bcmsdh_oob_intr_register(bcmsdh_info_t *bcmsdh, bcmsdh_cb_fn_t oob_irq_handler,
+	void* oob_irq_handler_context);
+extern void bcmsdh_oob_intr_unregister(bcmsdh_info_t *sdh);
+extern void bcmsdh_oob_intr_set(bcmsdh_info_t *sdh, bool enable);
+#endif
+extern void bcmsdh_dev_pm_stay_awake(bcmsdh_info_t *sdh);
+extern void bcmsdh_dev_relax(bcmsdh_info_t *sdh);
+extern bool bcmsdh_dev_pm_enabled(bcmsdh_info_t *sdh);
+
+int bcmsdh_suspend(bcmsdh_info_t *bcmsdh);
+int bcmsdh_resume(bcmsdh_info_t *bcmsdh);
+
+/* Function to pass device-status bits to DHD. */
+extern uint32 bcmsdh_get_dstatus(void *sdh);
+
+/* Function to return current window addr */
+extern uint32 bcmsdh_cur_sbwad(void *sdh);
+
+/* Function to pass chipid and rev to lower layers for controlling pr's */
+extern void bcmsdh_chipinfo(void *sdh, uint32 chip, uint32 chiprev);
+
+
+extern int bcmsdh_sleep(void *sdh, bool enab);
+
+/* GPIO support */
+extern int bcmsdh_gpio_init(void *sd);
+extern bool bcmsdh_gpioin(void *sd, uint32 gpio);
+extern int bcmsdh_gpioouten(void *sd, uint32 gpio);
+extern int bcmsdh_gpioout(void *sd, uint32 gpio, bool enab);
+
+#endif	/* _bcmsdh_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmsdh_sdmmc.h b/drivers/net/wireless/bcm4336/include/bcmsdh_sdmmc.h
--- a/drivers/net/wireless/bcm4336/include/bcmsdh_sdmmc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmsdh_sdmmc.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,125 @@
+/*
+ * BCMSDH Function Driver for the native SDIO/MMC driver in the Linux Kernel
+ *
+ * Copyright (C) 1999-2014, Broadcom Corporation
+ *
+ *      Unless you and Broadcom execute a separate written software license
+ * agreement governing use of this software, this software is licensed to you
+ * under the terms of the GNU General Public License version 2 (the "GPL"),
+ * available at http://www.broadcom.com/licenses/GPLv2.php, with the
+ * following added to such license:
+ *
+ *      As a special exception, the copyright holders of this software give you
+ * permission to link this software with independent modules, and to copy and
+ * distribute the resulting executable under terms of your choice, provided that
+ * you also meet, for each linked independent module, the terms and conditions of
+ * the license of that module.  An independent module is a module which is not
+ * derived from this software.  The special exception does not apply to any
+ * modifications of the software.
+ *
+ *      Notwithstanding the above, under no circumstances may you combine this
+ * software in any way with any other Broadcom software provided under a license
+ * other than the GPL, without Broadcom's express prior written consent.
+ *
+ * $Id: bcmsdh_sdmmc.h 496576 2014-08-13 15:04:56Z $
+ */
+
+#ifndef __BCMSDH_SDMMC_H__
+#define __BCMSDH_SDMMC_H__
+
+#define sd_err(x)	do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)	do { if (sd_msglevel & SDH_TRACE_VAL) printf x; } while (0)
+#define sd_info(x)	do { if (sd_msglevel & SDH_INFO_VAL) printf x; } while (0)
+#define sd_debug(x)	do { if (sd_msglevel & SDH_DEBUG_VAL) printf x; } while (0)
+#define sd_data(x)	do { if (sd_msglevel & SDH_DATA_VAL) printf x; } while (0)
+#define sd_ctrl(x)	do { if (sd_msglevel & SDH_CTRL_VAL) printf x; } while (0)
+
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+	do { if (!(exp)) \
+		printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+	} while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS	0
+#define ERROR	1
+
+/* private bus modes */
+#define SDIOH_MODE_SD4		2
+#define CLIENT_INTR			0x100	/* Get rid of this! */
+#define SDIOH_SDMMC_MAX_SG_ENTRIES	(SDPCM_MAXGLOM_SIZE+2)
+
+struct sdioh_info {
+	osl_t		*osh;			/* osh handler */
+	void		*bcmsdh;		/* upper layer handle */
+	bool		client_intr_enabled;	/* interrupt connnected flag */
+	bool		intr_handler_valid;	/* client driver interrupt handler valid */
+	sdioh_cb_fn_t	intr_handler;		/* registered interrupt handler */
+	void		*intr_handler_arg;	/* argument to call interrupt handler */
+	uint16		intmask;		/* Current active interrupts */
+
+	int		intrcount;		/* Client interrupts */
+	bool		sd_use_dma;		/* DMA on CMD53 */
+	bool		sd_blockmode;		/* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+						/*  Must be on for sd_multiblock to be effective */
+	bool		use_client_ints;	/* If this is false, make sure to restore */
+	int		sd_mode;		/* SD1/SD4/SPI */
+	int		client_block_size[SDIOD_MAX_IOFUNCS];		/* Blocksize */
+	uint8		num_funcs;		/* Supported funcs on client */
+	uint32		com_cis_ptr;
+	uint32		func_cis_ptr[SDIOD_MAX_IOFUNCS];
+	bool		use_rxchain;
+	struct scatterlist	sg_list[SDIOH_SDMMC_MAX_SG_ENTRIES];
+	struct sdio_func	fake_func0;
+	struct sdio_func	*func[SDIOD_MAX_IOFUNCS];
+
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdh_sdmmc.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdioh_sdmmc_devintr_on(sdioh_info_t *sd);
+extern void sdioh_sdmmc_devintr_off(sdioh_info_t *sd);
+
+
+/**************************************************************
+ * Internal interfaces: bcmsdh_sdmmc.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdioh_sdmmc_reg_map(osl_t *osh, int32 addr, int size);
+extern void sdioh_sdmmc_reg_unmap(osl_t *osh, int32 addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdioh_sdmmc_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdioh_sdmmc_free_irq(uint irq, sdioh_info_t *sd);
+
+extern sdioh_info_t *sdioh_attach(osl_t *osh, struct sdio_func *func);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+
+#ifdef GLOBAL_SDMMC_INSTANCE
+typedef struct _BCMSDH_SDMMC_INSTANCE {
+	sdioh_info_t	*sd;
+	struct sdio_func *func[SDIOD_MAX_IOFUNCS];
+} BCMSDH_SDMMC_INSTANCE, *PBCMSDH_SDMMC_INSTANCE;
+#endif
+
+#endif /* __BCMSDH_SDMMC_H__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmsdpcm.h b/drivers/net/wireless/bcm4336/include/bcmsdpcm.h
--- a/drivers/net/wireless/bcm4336/include/bcmsdpcm.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmsdpcm.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,260 @@
+/*
+ * Broadcom SDIO/PCMCIA
+ * Software-specific definitions shared between device and host side
+ *
+ * $Copyright Open 2005 Broadcom Corporation$
+ *
+ * $Id: bcmsdpcm.h 472405 2014-04-23 23:46:55Z $
+ */
+
+#ifndef	_bcmsdpcm_h_
+#define	_bcmsdpcm_h_
+
+/*
+ * Software allocation of To SB Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_SMB_NAK	I_SMB_SW0	/* To SB Mailbox Frame NAK */
+#define I_SMB_INT_ACK	I_SMB_SW1	/* To SB Mailbox Host Interrupt ACK */
+#define I_SMB_USE_OOB	I_SMB_SW2	/* To SB Mailbox Use OOB Wakeup */
+#define I_SMB_DEV_INT	I_SMB_SW3	/* To SB Mailbox Miscellaneous Interrupt */
+
+#define I_TOSBMAIL      (I_SMB_NAK | I_SMB_INT_ACK | I_SMB_USE_OOB | I_SMB_DEV_INT)
+
+/* tosbmailbox bits corresponding to intstatus bits */
+#define SMB_NAK		(1 << 0)	/* To SB Mailbox Frame NAK */
+#define SMB_INT_ACK	(1 << 1)	/* To SB Mailbox Host Interrupt ACK */
+#define SMB_USE_OOB	(1 << 2)	/* To SB Mailbox Use OOB Wakeup */
+#define SMB_DEV_INT	(1 << 3)	/* To SB Mailbox Miscellaneous Interrupt */
+#define SMB_MASK	0x0000000f	/* To SB Mailbox Mask */
+
+/* tosbmailboxdata */
+#define SMB_DATA_VERSION_MASK	0x00ff0000	/* host protocol version (sent with F2 enable) */
+#define SMB_DATA_VERSION_SHIFT	16		/* host protocol version (sent with F2 enable) */
+
+/*
+ * Software allocation of To Host Mailbox resources
+ */
+
+/* intstatus bits */
+#define I_HMB_FC_STATE	I_HMB_SW0	/* To Host Mailbox Flow Control State */
+#define I_HMB_FC_CHANGE	I_HMB_SW1	/* To Host Mailbox Flow Control State Changed */
+#define I_HMB_FRAME_IND	I_HMB_SW2	/* To Host Mailbox Frame Indication */
+#define I_HMB_HOST_INT	I_HMB_SW3	/* To Host Mailbox Miscellaneous Interrupt */
+
+#define I_TOHOSTMAIL    (I_HMB_FC_CHANGE | I_HMB_FRAME_IND | I_HMB_HOST_INT)
+
+/* tohostmailbox bits corresponding to intstatus bits */
+#define HMB_FC_ON	(1 << 0)	/* To Host Mailbox Flow Control State */
+#define HMB_FC_CHANGE	(1 << 1)	/* To Host Mailbox Flow Control State Changed */
+#define HMB_FRAME_IND	(1 << 2)	/* To Host Mailbox Frame Indication */
+#define HMB_HOST_INT	(1 << 3)	/* To Host Mailbox Miscellaneous Interrupt */
+#define HMB_MASK	0x0000000f	/* To Host Mailbox Mask */
+
+/* tohostmailboxdata */
+#define HMB_DATA_NAKHANDLED	0x01	/* we're ready to retransmit NAK'd frame to host */
+#define HMB_DATA_DEVREADY	0x02	/* we're ready to to talk to host after enable */
+#define HMB_DATA_FC		0x04	/* per prio flowcontrol update flag to host */
+#define HMB_DATA_FWREADY	0x08	/* firmware is ready for protocol activity */
+#define HMB_DATA_FWHALT		0x10	/* firmware has halted operation */
+
+#define HMB_DATA_FCDATA_MASK	0xff000000	/* per prio flowcontrol data */
+#define HMB_DATA_FCDATA_SHIFT	24		/* per prio flowcontrol data */
+
+#define HMB_DATA_VERSION_MASK	0x00ff0000	/* device protocol version (with devready) */
+#define HMB_DATA_VERSION_SHIFT	16		/* device protocol version (with devready) */
+
+/*
+ * Software-defined protocol header
+ */
+
+/* Current protocol version */
+#define SDPCM_PROT_VERSION	4
+
+/* SW frame header */
+#define SDPCM_SEQUENCE_MASK		0x000000ff	/* Sequence Number Mask */
+#define SDPCM_PACKET_SEQUENCE(p) (((uint8 *)p)[0] & 0xff) /* p starts w/SW Header */
+
+#define SDPCM_CHANNEL_MASK		0x00000f00	/* Channel Number Mask */
+#define SDPCM_CHANNEL_SHIFT		8		/* Channel Number Shift */
+#define SDPCM_PACKET_CHANNEL(p) (((uint8 *)p)[1] & 0x0f) /* p starts w/SW Header */
+
+#define SDPCM_FLAGS_MASK		0x0000f000	/* Mask of flag bits */
+#define SDPCM_FLAGS_SHIFT		12		/* Flag bits shift */
+#define SDPCM_PACKET_FLAGS(p) ((((uint8 *)p)[1] & 0xf0) >> 4) /* p starts w/SW Header */
+
+/* Next Read Len: lookahead length of next frame, in 16-byte units (rounded up) */
+#define SDPCM_NEXTLEN_MASK		0x00ff0000	/* Next Read Len Mask */
+#define SDPCM_NEXTLEN_SHIFT		16		/* Next Read Len Shift */
+#define SDPCM_NEXTLEN_VALUE(p) ((((uint8 *)p)[2] & 0xff) << 4) /* p starts w/SW Header */
+#define SDPCM_NEXTLEN_OFFSET		2
+
+/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
+#define SDPCM_DOFFSET_OFFSET		3		/* Data Offset */
+#define SDPCM_DOFFSET_VALUE(p) 		(((uint8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
+#define SDPCM_DOFFSET_MASK		0xff000000
+#define SDPCM_DOFFSET_SHIFT		24
+
+#define SDPCM_FCMASK_OFFSET		4		/* Flow control */
+#define SDPCM_FCMASK_VALUE(p)		(((uint8 *)p)[SDPCM_FCMASK_OFFSET ] & 0xff)
+#define SDPCM_WINDOW_OFFSET		5		/* Credit based fc */
+#define SDPCM_WINDOW_VALUE(p)		(((uint8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
+#define SDPCM_VERSION_OFFSET		6		/* Version # */
+#define SDPCM_VERSION_VALUE(p)		(((uint8 *)p)[SDPCM_VERSION_OFFSET] & 0xff)
+#define SDPCM_UNUSED_OFFSET		7		/* Spare */
+#define SDPCM_UNUSED_VALUE(p)		(((uint8 *)p)[SDPCM_UNUSED_OFFSET] & 0xff)
+
+#define SDPCM_SWHEADER_LEN	8	/* SW header is 64 bits */
+
+/* logical channel numbers */
+#define SDPCM_CONTROL_CHANNEL	0	/* Control Request/Response Channel Id */
+#define SDPCM_EVENT_CHANNEL	1	/* Asyc Event Indication Channel Id */
+#define SDPCM_DATA_CHANNEL	2	/* Data Xmit/Recv Channel Id */
+#define SDPCM_GLOM_CHANNEL	3	/* For coalesced packets (superframes) */
+#define SDPCM_TEST_CHANNEL	15	/* Reserved for test/debug packets */
+#define SDPCM_MAX_CHANNEL	15
+
+#define SDPCM_SEQUENCE_WRAP	256	/* wrap-around val for eight-bit frame seq number */
+
+#define SDPCM_FLAG_RESVD0	0x01
+#define SDPCM_FLAG_RESVD1	0x02
+#define SDPCM_FLAG_GSPI_TXENAB	0x04
+#define SDPCM_FLAG_GLOMDESC	0x08	/* Superframe descriptor mask */
+
+/* For GLOM_CHANNEL frames, use a flag to indicate descriptor frame */
+#define SDPCM_GLOMDESC_FLAG	(SDPCM_FLAG_GLOMDESC << SDPCM_FLAGS_SHIFT)
+
+#define SDPCM_GLOMDESC(p)	(((uint8 *)p)[1] & 0x80)
+
+/* For TEST_CHANNEL packets, define another 4-byte header */
+#define SDPCM_TEST_HDRLEN		4	/* Generally: Cmd(1), Ext(1), Len(2);
+						 * Semantics of Ext byte depend on command.
+						 * Len is current or requested frame length, not
+						 * including test header; sent little-endian.
+						 */
+#define SDPCM_TEST_PKT_CNT_FLD_LEN	4	/* Packet count filed legth */
+#define SDPCM_TEST_DISCARD		0x01	/* Receiver discards. Ext is a pattern id. */
+#define SDPCM_TEST_ECHOREQ		0x02	/* Echo request. Ext is a pattern id. */
+#define SDPCM_TEST_ECHORSP		0x03	/* Echo response. Ext is a pattern id. */
+#define SDPCM_TEST_BURST		0x04	/* Receiver to send a burst. Ext is a frame count
+						 * (Backward compatabilty) Set frame count in a
+						 * 4 byte filed adjacent to the HDR
+						 */
+#define SDPCM_TEST_SEND			0x05	/* Receiver sets send mode. Ext is boolean on/off
+						 * Set frame count in a 4 byte filed adjacent to
+						 * the HDR
+						 */
+
+/* Handy macro for filling in datagen packets with a pattern */
+#define SDPCM_TEST_FILL(byteno, id)	((uint8)(id + byteno))
+
+/*
+ * Software counters (first part matches hardware counters)
+ */
+
+typedef volatile struct {
+	uint32 cmd52rd;		/* Cmd52RdCount, SDIO: cmd52 reads */
+	uint32 cmd52wr;		/* Cmd52WrCount, SDIO: cmd52 writes */
+	uint32 cmd53rd;		/* Cmd53RdCount, SDIO: cmd53 reads */
+	uint32 cmd53wr;		/* Cmd53WrCount, SDIO: cmd53 writes */
+	uint32 abort;		/* AbortCount, SDIO: aborts */
+	uint32 datacrcerror;	/* DataCrcErrorCount, SDIO: frames w/CRC error */
+	uint32 rdoutofsync;	/* RdOutOfSyncCount, SDIO/PCMCIA: Rd Frm out of sync */
+	uint32 wroutofsync;	/* RdOutOfSyncCount, SDIO/PCMCIA: Wr Frm out of sync */
+	uint32 writebusy;	/* WriteBusyCount, SDIO: device asserted "busy" */
+	uint32 readwait;	/* ReadWaitCount, SDIO: no data ready for a read cmd */
+	uint32 readterm;	/* ReadTermCount, SDIO: read frame termination cmds */
+	uint32 writeterm;	/* WriteTermCount, SDIO: write frames termination cmds */
+	uint32 rxdescuflo;	/* receive descriptor underflows */
+	uint32 rxfifooflo;	/* receive fifo overflows */
+	uint32 txfifouflo;	/* transmit fifo underflows */
+	uint32 runt;		/* runt (too short) frames recv'd from bus */
+	uint32 badlen;		/* frame's rxh len does not match its hw tag len */
+	uint32 badcksum;	/* frame's hw tag chksum doesn't agree with len value */
+	uint32 seqbreak;	/* break in sequence # space from one rx frame to the next */
+	uint32 rxfcrc;		/* frame rx header indicates crc error */
+	uint32 rxfwoos;		/* frame rx header indicates write out of sync */
+	uint32 rxfwft;		/* frame rx header indicates write frame termination */
+	uint32 rxfabort;	/* frame rx header indicates frame aborted */
+	uint32 woosint;		/* write out of sync interrupt */
+	uint32 roosint;		/* read out of sync interrupt */
+	uint32 rftermint;	/* read frame terminate interrupt */
+	uint32 wftermint;	/* write frame terminate interrupt */
+} sdpcmd_cnt_t;
+
+/*
+ * Register Access Macros
+ */
+
+#define SDIODREV_IS(var, val)	((var) == (val))
+#define SDIODREV_GE(var, val)	((var) >= (val))
+#define SDIODREV_GT(var, val)	((var) > (val))
+#define SDIODREV_LT(var, val)	((var) < (val))
+#define SDIODREV_LE(var, val)	((var) <= (val))
+
+#define SDIODDMAREG32(h, dir, chnl) \
+	((dir) == DMA_TX ? \
+	 (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].xmt) : \
+	 (void *)(uintptr)&((h)->regs->dma.sdiod32.dma32regs[chnl].rcv))
+
+#define SDIODDMAREG64(h, dir, chnl) \
+	((dir) == DMA_TX ? \
+	 (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].xmt) : \
+	 (void *)(uintptr)&((h)->regs->dma.sdiod64.dma64regs[chnl].rcv))
+
+#define SDIODDMAREG(h, dir, chnl) \
+	(SDIODREV_LT((h)->corerev, 1) ? \
+	 SDIODDMAREG32((h), (dir), (chnl)) : \
+	 SDIODDMAREG64((h), (dir), (chnl)))
+
+#define PCMDDMAREG(h, dir, chnl) \
+	((dir) == DMA_TX ? \
+	 (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.xmt) : \
+	 (void *)(uintptr)&((h)->regs->dma.pcm32.dmaregs.rcv))
+
+#define SDPCMDMAREG(h, dir, chnl, coreid) \
+	((coreid) == SDIOD_CORE_ID ? \
+	 SDIODDMAREG(h, dir, chnl) : \
+	 PCMDDMAREG(h, dir, chnl))
+
+#define SDIODFIFOREG(h, corerev) \
+	(SDIODREV_LT((corerev), 1) ? \
+	 ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod32.dmafifo)) : \
+	 ((dma32diag_t *)(uintptr)&((h)->regs->dma.sdiod64.dmafifo)))
+
+#define PCMDFIFOREG(h) \
+	((dma32diag_t *)(uintptr)&((h)->regs->dma.pcm32.dmafifo))
+
+#define SDPCMFIFOREG(h, coreid, corerev) \
+	((coreid) == SDIOD_CORE_ID ? \
+	 SDIODFIFOREG(h, corerev) : \
+	 PCMDFIFOREG(h))
+
+/*
+ * Shared structure between dongle and the host.
+ * The structure contains pointers to trap or assert information.
+ */
+#define SDPCM_SHARED_VERSION       0x0001
+#define SDPCM_SHARED_VERSION_MASK  0x00FF
+#define SDPCM_SHARED_ASSERT_BUILT  0x0100
+#define SDPCM_SHARED_ASSERT        0x0200
+#define SDPCM_SHARED_TRAP          0x0400
+#define SDPCM_SHARED_IN_BRPT       0x0800
+#define SDPCM_SHARED_SET_BRPT      0x1000
+#define SDPCM_SHARED_PENDING_BRPT  0x2000
+
+typedef struct {
+	uint32	flags;
+	uint32  trap_addr;
+	uint32  assert_exp_addr;
+	uint32  assert_file_addr;
+	uint32  assert_line;
+	uint32	console_addr;		/* Address of hnd_cons_t */
+	uint32  msgtrace_addr;
+	uint32  fwid;
+} sdpcm_shared_t;
+
+extern sdpcm_shared_t sdpcm_shared;
+
+#endif	/* _bcmsdpcm_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmsdspi.h b/drivers/net/wireless/bcm4336/include/bcmsdspi.h
--- a/drivers/net/wireless/bcm4336/include/bcmsdspi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmsdspi.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,117 @@
+/*
+ * SD-SPI Protocol Conversion - BCMSDH->SPI Translation Layer
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: bcmsdspi.h 294363 2011-11-06 23:02:20Z $
+ */
+#ifndef	_BCM_SD_SPI_H
+#define	_BCM_SD_SPI_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+
+#define sd_err(x)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+	do { if (!(exp)) \
+		printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+	} while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS	0
+#undef ERROR
+#define ERROR	1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI		0
+
+#define USE_BLOCKMODE		0x2	/* Block mode can be single block or multi */
+#define USE_MULTIBLOCK		0x4
+
+struct sdioh_info {
+	uint cfg_bar;                   	/* pci cfg address for bar */
+	uint32 caps;                    	/* cached value of capabilities reg */
+	uint		bar0;			/* BAR0 for PCI Device */
+	osl_t 		*osh;			/* osh handler */
+	void		*controller;	/* Pointer to SPI Controller's private data struct */
+
+	uint		lockcount; 		/* nest count of sdspi_lock() calls */
+	bool		client_intr_enabled;	/* interrupt connnected flag */
+	bool		intr_handler_valid;	/* client driver interrupt handler valid */
+	sdioh_cb_fn_t	intr_handler;		/* registered interrupt handler */
+	void		*intr_handler_arg;	/* argument to call interrupt handler */
+	bool		initialized;		/* card initialized */
+	uint32		target_dev;		/* Target device ID */
+	uint32		intmask;		/* Current active interrupts */
+	void		*sdos_info;		/* Pointer to per-OS private data */
+
+	uint32		controller_type;	/* Host controller type */
+	uint8		version;		/* Host Controller Spec Compliance Version */
+	uint 		irq;			/* Client irq */
+	uint32 		intrcount;		/* Client interrupts */
+	uint32 		local_intrcount;	/* Controller interrupts */
+	bool 		host_init_done;		/* Controller initted */
+	bool 		card_init_done;		/* Client SDIO interface initted */
+	bool 		polled_mode;		/* polling for command completion */
+
+	bool		sd_use_dma;		/* DMA on CMD53 */
+	bool 		sd_blockmode;		/* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+						/*  Must be on for sd_multiblock to be effective */
+	bool 		use_client_ints;	/* If this is false, make sure to restore */
+	bool		got_hcint;		/* Host Controller interrupt. */
+						/*  polling hack in wl_linux.c:wl_timer() */
+	int 		adapter_slot;		/* Maybe dealing with multiple slots/controllers */
+	int 		sd_mode;		/* SD1/SD4/SPI */
+	int 		client_block_size[SDIOD_MAX_IOFUNCS];		/* Blocksize */
+	uint32 		data_xfer_count;	/* Current register transfer size */
+	uint32		cmd53_wr_data;		/* Used to pass CMD53 write data */
+	uint32		card_response;		/* Used to pass back response status byte */
+	uint32		card_rsp_data;		/* Used to pass back response data word */
+	uint16 		card_rca;		/* Current Address */
+	uint8 		num_funcs;		/* Supported funcs on client */
+	uint32 		com_cis_ptr;
+	uint32 		func_cis_ptr[SDIOD_MAX_IOFUNCS];
+	void		*dma_buf;
+	ulong		dma_phys;
+	int 		r_cnt;			/* rx count */
+	int 		t_cnt;			/* tx_count */
+};
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdspi.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/**************************************************************
+ * Internal interfaces: bcmsdspi.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *spi_reg_map(osl_t *osh, uintptr addr, int size);
+extern void spi_reg_unmap(osl_t *osh, uintptr addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int spi_register_irq(sdioh_info_t *sd, uint irq);
+extern void spi_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void spi_lock(sdioh_info_t *sd);
+extern void spi_unlock(sdioh_info_t *sd);
+
+/* Allocate/init/free per-OS private data */
+extern int spi_osinit(sdioh_info_t *sd);
+extern void spi_osfree(sdioh_info_t *sd);
+
+#endif /* _BCM_SD_SPI_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmsdstd.h b/drivers/net/wireless/bcm4336/include/bcmsdstd.h
--- a/drivers/net/wireless/bcm4336/include/bcmsdstd.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmsdstd.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,264 @@
+/*
+ *  'Standard' SDIO HOST CONTROLLER driver
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: bcmsdstd.h 455390 2014-02-13 22:14:56Z $
+ */
+#ifndef	_BCM_SD_STD_H
+#define	_BCM_SD_STD_H
+
+/* global msglevel for debug messages - bitvals come from sdiovar.h */
+#define sd_err(x)	do { if (sd_msglevel & SDH_ERROR_VAL) printf x; } while (0)
+#define sd_trace(x)
+#define sd_info(x)
+#define sd_debug(x)
+#define sd_data(x)
+#define sd_ctrl(x)
+#define sd_dma(x)
+
+#define sd_sync_dma(sd, read, nbytes)
+#define sd_init_dma(sd)
+#define sd_ack_intr(sd)
+#define sd_wakeup(sd);
+/* Allocate/init/free per-OS private data */
+extern int sdstd_osinit(sdioh_info_t *sd);
+extern void sdstd_osfree(sdioh_info_t *sd);
+
+#define sd_log(x)
+
+#define SDIOH_ASSERT(exp) \
+	do { if (!(exp)) \
+		printf("!!!ASSERT fail: file %s lines %d", __FILE__, __LINE__); \
+	} while (0)
+
+#define BLOCK_SIZE_4318 64
+#define BLOCK_SIZE_4328 512
+
+/* internal return code */
+#define SUCCESS	0
+#define ERROR	1
+
+/* private bus modes */
+#define SDIOH_MODE_SPI		0
+#define SDIOH_MODE_SD1		1
+#define SDIOH_MODE_SD4		2
+
+#define MAX_SLOTS 6 	/* For PCI: Only 6 BAR entries => 6 slots */
+#define SDIOH_REG_WINSZ	0x100 /* Number of registers in Standard Host Controller */
+
+#define SDIOH_TYPE_ARASAN_HDK	1
+#define SDIOH_TYPE_BCM27XX	2
+#define SDIOH_TYPE_TI_PCIXX21	4	/* TI PCIxx21 Standard Host Controller */
+#define SDIOH_TYPE_RICOH_R5C822	5	/* Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter */
+#define SDIOH_TYPE_JMICRON	6	/* JMicron Standard SDIO Host Controller */
+
+/* For linux, allow yielding for dongle */
+#define BCMSDYIELD
+
+/* Expected card status value for CMD7 */
+#define SDIOH_CMD7_EXP_STATUS   0x00001E00
+
+#define RETRIES_LARGE 100000
+#define sdstd_os_yield(sd)	do {} while (0)
+#define RETRIES_SMALL 100
+
+
+#define USE_BLOCKMODE		0x2	/* Block mode can be single block or multi */
+#define USE_MULTIBLOCK		0x4
+
+#define USE_FIFO		0x8	/* Fifo vs non-fifo */
+
+#define CLIENT_INTR 		0x100	/* Get rid of this! */
+
+#define HC_INTR_RETUNING	0x1000
+
+
+#ifdef BCMSDIOH_TXGLOM
+/* Total glom pkt can not exceed 64K
+ * need one more slot for glom padding packet
+ */
+#define SDIOH_MAXGLOM_SIZE	(40+1)
+
+typedef struct glom_buf {
+	uint32 count;				/* Total number of pkts queued */
+	void *dma_buf_arr[SDIOH_MAXGLOM_SIZE];	/* Frame address */
+	ulong dma_phys_arr[SDIOH_MAXGLOM_SIZE]; /* DMA_MAPed address of frames */
+	uint16 nbytes[SDIOH_MAXGLOM_SIZE];	/* Size of each frame */
+} glom_buf_t;
+#endif
+
+struct sdioh_info {
+	uint cfg_bar;                   	/* pci cfg address for bar */
+	uint32 caps;                    	/* cached value of capabilities reg */
+	uint32 curr_caps;                    	/* max current capabilities reg */
+
+	osl_t 		*osh;			/* osh handler */
+	volatile char 	*mem_space;		/* pci device memory va */
+	uint		lockcount; 		/* nest count of sdstd_lock() calls */
+	bool		client_intr_enabled;	/* interrupt connnected flag */
+	bool		intr_handler_valid;	/* client driver interrupt handler valid */
+	sdioh_cb_fn_t	intr_handler;		/* registered interrupt handler */
+	void		*intr_handler_arg;	/* argument to call interrupt handler */
+	bool		initialized;		/* card initialized */
+	uint		target_dev;		/* Target device ID */
+	uint16		intmask;		/* Current active interrupts */
+	void		*sdos_info;		/* Pointer to per-OS private data */
+	void		*bcmsdh;		/* handler to upper layer stack (bcmsdh) */
+
+	uint32		controller_type;	/* Host controller type */
+	uint8		version;		/* Host Controller Spec Compliance Version */
+	uint		irq;			/* Client irq */
+	int		intrcount;		/* Client interrupts */
+	int		local_intrcount;	/* Controller interrupts */
+	bool		host_init_done;		/* Controller initted */
+	bool		card_init_done;		/* Client SDIO interface initted */
+	bool		polled_mode;		/* polling for command completion */
+
+	bool		sd_blockmode;		/* sd_blockmode == FALSE => 64 Byte Cmd 53s. */
+						/*  Must be on for sd_multiblock to be effective */
+	bool		use_client_ints;	/* If this is false, make sure to restore */
+						/*  polling hack in wl_linux.c:wl_timer() */
+	int		adapter_slot;		/* Maybe dealing with multiple slots/controllers */
+	int		sd_mode;		/* SD1/SD4/SPI */
+	int		client_block_size[SDIOD_MAX_IOFUNCS];		/* Blocksize */
+	uint32		data_xfer_count;	/* Current transfer */
+	uint16		card_rca;		/* Current Address */
+	int8		sd_dma_mode;		/* DMA Mode (PIO, SDMA, ... ADMA2) on CMD53 */
+	uint8		num_funcs;		/* Supported funcs on client */
+	uint32		com_cis_ptr;
+	uint32		func_cis_ptr[SDIOD_MAX_IOFUNCS];
+	void		*dma_buf;		/* DMA Buffer virtual address */
+	ulong		dma_phys;		/* DMA Buffer physical address */
+	void		*adma2_dscr_buf;	/* ADMA2 Descriptor Buffer virtual address */
+	ulong		adma2_dscr_phys;	/* ADMA2 Descriptor Buffer physical address */
+
+	/* adjustments needed to make the dma align properly */
+	void		*dma_start_buf;
+	ulong		dma_start_phys;
+	uint		alloced_dma_size;
+	void		*adma2_dscr_start_buf;
+	ulong		adma2_dscr_start_phys;
+	uint		alloced_adma2_dscr_size;
+
+	int 		r_cnt;			/* rx count */
+	int 		t_cnt;			/* tx_count */
+	bool		got_hcint;		/* local interrupt flag */
+	uint16		last_intrstatus;	/* to cache intrstatus */
+	int 	host_UHSISupported;		/* whether UHSI is supported for HC. */
+	int 	card_UHSI_voltage_Supported; 	/* whether UHSI is supported for
+						 * Card in terms of Voltage [1.8 or 3.3].
+						 */
+	int	global_UHSI_Supp;	/* type of UHSI support in both host and card.
+					 * HOST_SDR_UNSUPP: capabilities not supported/matched
+					 * HOST_SDR_12_25: SDR12 and SDR25 supported
+					 * HOST_SDR_50_104_DDR: one of SDR50/SDR104 or DDR50 supptd
+					 */
+	volatile int	sd3_dat_state; 		/* data transfer state used for retuning check */
+	volatile int	sd3_tun_state; 		/* tuning state used for retuning check */
+	bool	sd3_tuning_reqd; 	/* tuning requirement parameter */
+	uint32	caps3;			/* cached value of 32 MSbits capabilities reg (SDIO 3.0) */
+#ifdef BCMSDIOH_TXGLOM
+	glom_buf_t glom_info;		/* pkt information used for glomming */
+	uint	txglom_mode;		/* Txglom mode: 0 - copy, 1 - multi-descriptor */
+#endif
+};
+
+#define DMA_MODE_NONE	0
+#define DMA_MODE_SDMA	1
+#define DMA_MODE_ADMA1	2
+#define DMA_MODE_ADMA2	3
+#define DMA_MODE_ADMA2_64 4
+#define DMA_MODE_AUTO	-1
+
+#define USE_DMA(sd)		((bool)((sd->sd_dma_mode > 0) ? TRUE : FALSE))
+
+/* States for Tuning and corr data */
+#define TUNING_IDLE 			0
+#define TUNING_START 			1
+#define TUNING_START_AFTER_DAT 	2
+#define TUNING_ONGOING 			3
+
+#define DATA_TRANSFER_IDLE 		0
+#define DATA_TRANSFER_ONGOING	1
+
+#define CHECK_TUNING_PRE_DATA	1
+#define CHECK_TUNING_POST_DATA	2
+
+
+#ifdef DHD_DEBUG
+#define SD_DHD_DISABLE_PERIODIC_TUNING 0x01
+#define SD_DHD_ENABLE_PERIODIC_TUNING  0x00
+#endif
+
+
+/************************************************************
+ * Internal interfaces: per-port references into bcmsdstd.c
+ */
+
+/* Global message bits */
+extern uint sd_msglevel;
+
+/* OS-independent interrupt handler */
+extern bool check_client_intr(sdioh_info_t *sd);
+
+/* Core interrupt enable/disable of device interrupts */
+extern void sdstd_devintr_on(sdioh_info_t *sd);
+extern void sdstd_devintr_off(sdioh_info_t *sd);
+
+/* Enable/disable interrupts for local controller events */
+extern void sdstd_intrs_on(sdioh_info_t *sd, uint16 norm, uint16 err);
+extern void sdstd_intrs_off(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+/* Wait for specified interrupt and error bits to be set */
+extern void sdstd_spinbits(sdioh_info_t *sd, uint16 norm, uint16 err);
+
+
+/**************************************************************
+ * Internal interfaces: bcmsdstd.c references to per-port code
+ */
+
+/* Register mapping routines */
+extern uint32 *sdstd_reg_map(osl_t *osh, ulong addr, int size);
+extern void sdstd_reg_unmap(osl_t *osh, ulong addr, int size);
+
+/* Interrupt (de)registration routines */
+extern int sdstd_register_irq(sdioh_info_t *sd, uint irq);
+extern void sdstd_free_irq(uint irq, sdioh_info_t *sd);
+
+/* OS-specific interrupt wrappers (atomic interrupt enable/disable) */
+extern void sdstd_lock(sdioh_info_t *sd);
+extern void sdstd_unlock(sdioh_info_t *sd);
+extern void sdstd_waitlockfree(sdioh_info_t *sd);
+
+/* OS-specific wrappers for safe concurrent register access */
+extern void sdstd_os_lock_irqsave(sdioh_info_t *sd, ulong* flags);
+extern void sdstd_os_unlock_irqrestore(sdioh_info_t *sd, ulong* flags);
+
+/* OS-specific wait-for-interrupt-or-status */
+extern int sdstd_waitbits(sdioh_info_t *sd, uint16 norm, uint16 err, bool yield, uint16 *bits);
+
+/* used by bcmsdstd_linux [implemented in sdstd] */
+extern void sdstd_3_enable_retuning_int(sdioh_info_t *sd);
+extern void sdstd_3_disable_retuning_int(sdioh_info_t *sd);
+extern bool sdstd_3_is_retuning_int_set(sdioh_info_t *sd);
+extern void sdstd_3_check_and_do_tuning(sdioh_info_t *sd, int tuning_param);
+extern bool sdstd_3_check_and_set_retuning(sdioh_info_t *sd);
+extern int sdstd_3_get_tune_state(sdioh_info_t *sd);
+extern int sdstd_3_get_data_state(sdioh_info_t *sd);
+extern void sdstd_3_set_tune_state(sdioh_info_t *sd, int state);
+extern void sdstd_3_set_data_state(sdioh_info_t *sd, int state);
+extern uint8 sdstd_3_get_tuning_exp(sdioh_info_t *sd);
+extern uint32 sdstd_3_get_uhsi_clkmode(sdioh_info_t *sd);
+extern int sdstd_3_clk_tuning(sdioh_info_t *sd, uint32 sd3ClkMode);
+
+/* used by sdstd [implemented in bcmsdstd_linux/ndis] */
+extern void sdstd_3_start_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osinit_tuning(sdioh_info_t *sd);
+extern void sdstd_3_osclean_tuning(sdioh_info_t *sd);
+
+extern void sdstd_enable_disable_periodic_timer(sdioh_info_t * sd, uint val);
+
+extern sdioh_info_t *sdioh_attach(osl_t *osh, void *bar0, uint irq);
+extern SDIOH_API_RC sdioh_detach(osl_t *osh, sdioh_info_t *sd);
+#endif /* _BCM_SD_STD_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmspi.h b/drivers/net/wireless/bcm4336/include/bcmspi.h
--- a/drivers/net/wireless/bcm4336/include/bcmspi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmspi.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,22 @@
+/*
+ * Broadcom SPI Low-Level Hardware Driver API
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: bcmspi.h 241182 2011-02-17 21:50:03Z $
+ */
+#ifndef	_BCM_SPI_H
+#define	_BCM_SPI_H
+
+extern void spi_devintr_off(sdioh_info_t *sd);
+extern void spi_devintr_on(sdioh_info_t *sd);
+extern bool spi_start_clock(sdioh_info_t *sd, uint16 new_sd_divisor);
+extern bool spi_controller_highspeed_mode(sdioh_info_t *sd, bool hsmode);
+extern bool spi_check_client_intr(sdioh_info_t *sd, int *is_dev_intr);
+extern bool spi_hw_attach(sdioh_info_t *sd);
+extern bool spi_hw_detach(sdioh_info_t *sd);
+extern void spi_sendrecv(sdioh_info_t *sd, uint8 *msg_out, uint8 *msg_in, int msglen);
+extern void spi_spinbits(sdioh_info_t *sd);
+extern void spi_waitbits(sdioh_info_t *sd, bool yield);
+
+#endif /* _BCM_SPI_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmutils.h b/drivers/net/wireless/bcm4336/include/bcmutils.h
--- a/drivers/net/wireless/bcm4336/include/bcmutils.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmutils.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,1156 @@
+/*
+ * Misc useful os-independent macros and functions.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmutils.h 504037 2014-09-22 19:03:15Z $
+ */
+
+#ifndef	_bcmutils_h_
+#define	_bcmutils_h_
+
+#define bcm_strcpy_s(dst, noOfElements, src)            strcpy((dst), (src))
+#define bcm_strncpy_s(dst, noOfElements, src, count)    strncpy((dst), (src), (count))
+#define bcm_strcat_s(dst, noOfElements, src)            strcat((dst), (src))
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+#ifdef PKTQ_LOG
+#include <wlioctl.h>
+#endif
+
+/* ctype replacement */
+#define _BCM_U	0x01	/* upper */
+#define _BCM_L	0x02	/* lower */
+#define _BCM_D	0x04	/* digit */
+#define _BCM_C	0x08	/* cntrl */
+#define _BCM_P	0x10	/* punct */
+#define _BCM_S	0x20	/* white space (space/lf/tab) */
+#define _BCM_X	0x40	/* hex digit */
+#define _BCM_SP	0x80	/* hard space (0x20) */
+
+extern const unsigned char bcm_ctype[];
+#define bcm_ismask(x)	(bcm_ctype[(int)(unsigned char)(x)])
+
+#define bcm_isalnum(c)	((bcm_ismask(c)&(_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_isalpha(c)	((bcm_ismask(c)&(_BCM_U|_BCM_L)) != 0)
+#define bcm_iscntrl(c)	((bcm_ismask(c)&(_BCM_C)) != 0)
+#define bcm_isdigit(c)	((bcm_ismask(c)&(_BCM_D)) != 0)
+#define bcm_isgraph(c)	((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D)) != 0)
+#define bcm_islower(c)	((bcm_ismask(c)&(_BCM_L)) != 0)
+#define bcm_isprint(c)	((bcm_ismask(c)&(_BCM_P|_BCM_U|_BCM_L|_BCM_D|_BCM_SP)) != 0)
+#define bcm_ispunct(c)	((bcm_ismask(c)&(_BCM_P)) != 0)
+#define bcm_isspace(c)	((bcm_ismask(c)&(_BCM_S)) != 0)
+#define bcm_isupper(c)	((bcm_ismask(c)&(_BCM_U)) != 0)
+#define bcm_isxdigit(c)	((bcm_ismask(c)&(_BCM_D|_BCM_X)) != 0)
+#define bcm_tolower(c)	(bcm_isupper((c)) ? ((c) + 'a' - 'A') : (c))
+#define bcm_toupper(c)	(bcm_islower((c)) ? ((c) + 'A' - 'a') : (c))
+
+#define CIRCULAR_ARRAY_FULL(rd_idx, wr_idx, max) ((wr_idx + 1)%max == rd_idx)
+
+/* Buffer structure for collecting string-formatted data
+* using bcm_bprintf() API.
+* Use bcm_binit() to initialize before use
+*/
+
+struct bcmstrbuf {
+	char *buf;	/* pointer to current position in origbuf */
+	unsigned int size;	/* current (residual) size in bytes */
+	char *origbuf;	/* unmodified pointer to orignal buffer */
+	unsigned int origsize;	/* unmodified orignal buffer size in bytes */
+};
+
+/* ** driver-only section ** */
+#ifdef BCMDRIVER
+#include <osl.h>
+#include <hnd_pktq.h>
+#include <hnd_pktpool.h>
+
+#define GPIO_PIN_NOTDEFINED 	0x20	/* Pin not defined */
+
+/*
+ * Spin at most 'us' microseconds while 'exp' is true.
+ * Caller should explicitly test 'exp' when this completes
+ * and take appropriate error action if 'exp' is still true.
+ */
+#ifndef SPINWAIT_POLL_PERIOD
+#define SPINWAIT_POLL_PERIOD	10
+#endif
+
+#define SPINWAIT(exp, us) { \
+	uint countdown = (us) + (SPINWAIT_POLL_PERIOD - 1); \
+	while ((exp) && (countdown >= SPINWAIT_POLL_PERIOD)) { \
+		OSL_DELAY(SPINWAIT_POLL_PERIOD); \
+		countdown -= SPINWAIT_POLL_PERIOD; \
+	} \
+}
+
+/* forward definition of ether_addr structure used by some function prototypes */
+
+struct ether_addr;
+
+extern int ether_isbcast(const void *ea);
+extern int ether_isnulladdr(const void *ea);
+
+#define BCM_MAC_RXCPL_IDX_BITS			12
+#define BCM_MAX_RXCPL_IDX_INVALID		0
+#define BCM_MAC_RXCPL_IFIDX_BITS		3
+#define BCM_MAC_RXCPL_DOT11_BITS		1
+#define BCM_MAX_RXCPL_IFIDX			((1 << BCM_MAC_RXCPL_IFIDX_BITS) - 1)
+#define BCM_MAC_RXCPL_FLAG_BITS			4
+#define BCM_RXCPL_FLAGS_IN_TRANSIT		0x1
+#define BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST	0x2
+#define BCM_RXCPL_FLAGS_RXCPLVALID		0x4
+#define BCM_RXCPL_FLAGS_RSVD			0x8
+
+#define BCM_RXCPL_SET_IN_TRANSIT(a)	((a)->rxcpl_id.flags |= BCM_RXCPL_FLAGS_IN_TRANSIT)
+#define BCM_RXCPL_CLR_IN_TRANSIT(a)	((a)->rxcpl_id.flags &= ~BCM_RXCPL_FLAGS_IN_TRANSIT)
+#define BCM_RXCPL_IN_TRANSIT(a)		((a)->rxcpl_id.flags & BCM_RXCPL_FLAGS_IN_TRANSIT)
+
+#define BCM_RXCPL_SET_FRST_IN_FLUSH(a)	((a)->rxcpl_id.flags |= BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST)
+#define BCM_RXCPL_CLR_FRST_IN_FLUSH(a)	((a)->rxcpl_id.flags &= ~BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST)
+#define BCM_RXCPL_FRST_IN_FLUSH(a)	((a)->rxcpl_id.flags & BCM_RXCPL_FLAGS_FIRST_IN_FLUSHLIST)
+
+#define BCM_RXCPL_SET_VALID_INFO(a)	((a)->rxcpl_id.flags |= BCM_RXCPL_FLAGS_RXCPLVALID)
+#define BCM_RXCPL_CLR_VALID_INFO(a)	((a)->rxcpl_id.flags &= ~BCM_RXCPL_FLAGS_RXCPLVALID)
+#define BCM_RXCPL_VALID_INFO(a) (((a)->rxcpl_id.flags & BCM_RXCPL_FLAGS_RXCPLVALID) ? TRUE : FALSE)
+
+
+struct reorder_rxcpl_id_list {
+	uint16 head;
+	uint16 tail;
+	uint32 cnt;
+};
+
+typedef struct rxcpl_id {
+	uint32		idx : BCM_MAC_RXCPL_IDX_BITS;
+	uint32		next_idx : BCM_MAC_RXCPL_IDX_BITS;
+	uint32		ifidx : BCM_MAC_RXCPL_IFIDX_BITS;
+	uint32		dot11 : BCM_MAC_RXCPL_DOT11_BITS;
+	uint32		flags : BCM_MAC_RXCPL_FLAG_BITS;
+} rxcpl_idx_id_t;
+
+typedef struct rxcpl_data_len {
+	uint32		metadata_len_w : 6;
+	uint32		dataoffset: 10;
+	uint32		datalen : 16;
+} rxcpl_data_len_t;
+
+typedef struct rxcpl_info {
+	rxcpl_idx_id_t		rxcpl_id;
+	uint32		host_pktref;
+	union {
+		rxcpl_data_len_t	rxcpl_len;
+		struct rxcpl_info	*free_next;
+	};
+} rxcpl_info_t;
+
+/* rx completion list */
+typedef struct bcm_rxcplid_list {
+	uint32			max;
+	uint32			avail;
+	rxcpl_info_t		*rxcpl_ptr;
+	rxcpl_info_t		*free_list;
+} bcm_rxcplid_list_t;
+
+extern bool bcm_alloc_rxcplid_list(osl_t *osh, uint32 max);
+extern rxcpl_info_t * bcm_alloc_rxcplinfo(void);
+extern void bcm_free_rxcplinfo(rxcpl_info_t *ptr);
+extern void bcm_chain_rxcplid(uint16 first,  uint16 next);
+extern rxcpl_info_t *bcm_id2rxcplinfo(uint16 id);
+extern uint16 bcm_rxcplinfo2id(rxcpl_info_t *ptr);
+extern rxcpl_info_t *bcm_rxcpllist_end(rxcpl_info_t *ptr, uint32 *count);
+
+/* externs */
+/* packet */
+extern uint pktcopy(osl_t *osh, void *p, uint offset, int len, uchar *buf);
+extern uint pktfrombuf(osl_t *osh, void *p, uint offset, int len, uchar *buf);
+extern uint pkttotlen(osl_t *osh, void *p);
+extern void *pktlast(osl_t *osh, void *p);
+extern uint pktsegcnt(osl_t *osh, void *p);
+extern uint pktsegcnt_war(osl_t *osh, void *p);
+extern uint8 *pktdataoffset(osl_t *osh, void *p,  uint offset);
+extern void *pktoffset(osl_t *osh, void *p,  uint offset);
+
+/* Get priority from a packet and pass it back in scb (or equiv) */
+#define	PKTPRIO_VDSCP	0x100		/* DSCP prio found after VLAN tag */
+#define	PKTPRIO_VLAN	0x200		/* VLAN prio found */
+#define	PKTPRIO_UPD	0x400		/* DSCP used to update VLAN prio */
+#define	PKTPRIO_DSCP	0x800		/* DSCP prio found */
+
+/* DSCP type definitions (RFC4594) */
+/* AF1x: High-Throughput Data (RFC2597) */
+#define DSCP_AF11	0x0A
+#define DSCP_AF12	0x0C
+#define DSCP_AF13	0x0E
+/* AF2x: Low-Latency Data (RFC2597) */
+#define DSCP_AF21	0x12
+#define DSCP_AF22	0x14
+#define DSCP_AF23	0x16
+/* AF3x: Multimedia Streaming (RFC2597) */
+#define DSCP_AF31	0x1A
+#define DSCP_AF32	0x1C
+#define DSCP_AF33	0x1E
+/* EF: Telephony (RFC3246) */
+#define DSCP_EF		0x2E
+
+extern uint pktsetprio(void *pkt, bool update_vtag);
+extern bool pktgetdscp(uint8 *pktdata, uint pktlen, uint8 *dscp);
+
+/* string */
+extern int bcm_atoi(const char *s);
+extern ulong bcm_strtoul(const char *cp, char **endp, uint base);
+extern char *bcmstrstr(const char *haystack, const char *needle);
+extern char *bcmstrnstr(const char *s, uint s_len, const char *substr, uint substr_len);
+extern char *bcmstrcat(char *dest, const char *src);
+extern char *bcmstrncat(char *dest, const char *src, uint size);
+extern ulong wchar2ascii(char *abuf, ushort *wbuf, ushort wbuflen, ulong abuflen);
+char* bcmstrtok(char **string, const char *delimiters, char *tokdelim);
+int bcmstricmp(const char *s1, const char *s2);
+int bcmstrnicmp(const char* s1, const char* s2, int cnt);
+
+
+/* ethernet address */
+extern char *bcm_ether_ntoa(const struct ether_addr *ea, char *buf);
+extern int bcm_ether_atoe(const char *p, struct ether_addr *ea);
+
+/* ip address */
+struct ipv4_addr;
+extern char *bcm_ip_ntoa(struct ipv4_addr *ia, char *buf);
+extern char *bcm_ipv6_ntoa(void *ipv6, char *buf);
+extern int bcm_atoipv4(const char *p, struct ipv4_addr *ip);
+
+/* delay */
+extern void bcm_mdelay(uint ms);
+/* variable access */
+#define NVRAM_RECLAIM_CHECK(name)
+
+extern char *getvar(char *vars, const char *name);
+extern int getintvar(char *vars, const char *name);
+extern int getintvararray(char *vars, const char *name, int index);
+extern int getintvararraysize(char *vars, const char *name);
+extern uint getgpiopin(char *vars, char *pin_name, uint def_pin);
+#define bcm_perf_enable()
+#define bcmstats(fmt)
+#define	bcmlog(fmt, a1, a2)
+#define	bcmdumplog(buf, size)	*buf = '\0'
+#define	bcmdumplogent(buf, idx)	-1
+
+#define TSF_TICKS_PER_MS	1000
+#define TS_ENTER		0xdeadbeef	/* Timestamp profiling enter */
+#define TS_EXIT			0xbeefcafe	/* Timestamp profiling exit */
+
+#define bcmtslog(tstamp, fmt, a1, a2)
+#define bcmprinttslogs()
+#define bcmprinttstamp(us)
+#define bcmdumptslog(buf, size)
+
+extern char *bcm_nvram_vars(uint *length);
+extern int bcm_nvram_cache(void *sih);
+
+/* Support for sharing code across in-driver iovar implementations.
+ * The intent is that a driver use this structure to map iovar names
+ * to its (private) iovar identifiers, and the lookup function to
+ * find the entry.  Macros are provided to map ids and get/set actions
+ * into a single number space for a switch statement.
+ */
+
+/* iovar structure */
+typedef struct bcm_iovar {
+	const char *name;	/* name for lookup and display */
+	uint16 varid;		/* id for switch */
+	uint16 flags;		/* driver-specific flag bits */
+	uint16 type;		/* base type of argument */
+	uint16 minlen;		/* min length for buffer vars */
+} bcm_iovar_t;
+
+/* varid definitions are per-driver, may use these get/set bits */
+
+/* IOVar action bits for id mapping */
+#define IOV_GET 0 /* Get an iovar */
+#define IOV_SET 1 /* Set an iovar */
+
+/* Varid to actionid mapping */
+#define IOV_GVAL(id)		((id) * 2)
+#define IOV_SVAL(id)		((id) * 2 + IOV_SET)
+#define IOV_ISSET(actionid)	((actionid & IOV_SET) == IOV_SET)
+#define IOV_ID(actionid)	(actionid >> 1)
+
+/* flags are per-driver based on driver attributes */
+
+extern const bcm_iovar_t *bcm_iovar_lookup(const bcm_iovar_t *table, const char *name);
+extern int bcm_iovar_lencheck(const bcm_iovar_t *table, void *arg, int len, bool set);
+#if defined(WLTINYDUMP) || defined(WLMSG_INFORM) || defined(WLMSG_ASSOC) || \
+	defined(WLMSG_PRPKT) || defined(WLMSG_WSEC)
+extern int bcm_format_ssid(char* buf, const uchar ssid[], uint ssid_len);
+#endif
+#endif	/* BCMDRIVER */
+
+/* Base type definitions */
+#define IOVT_VOID	0	/* no value (implictly set only) */
+#define IOVT_BOOL	1	/* any value ok (zero/nonzero) */
+#define IOVT_INT8	2	/* integer values are range-checked */
+#define IOVT_UINT8	3	/* unsigned int 8 bits */
+#define IOVT_INT16	4	/* int 16 bits */
+#define IOVT_UINT16	5	/* unsigned int 16 bits */
+#define IOVT_INT32	6	/* int 32 bits */
+#define IOVT_UINT32	7	/* unsigned int 32 bits */
+#define IOVT_BUFFER	8	/* buffer is size-checked as per minlen */
+#define BCM_IOVT_VALID(type) (((unsigned int)(type)) <= IOVT_BUFFER)
+
+/* Initializer for IOV type strings */
+#define BCM_IOV_TYPE_INIT { \
+	"void", \
+	"bool", \
+	"int8", \
+	"uint8", \
+	"int16", \
+	"uint16", \
+	"int32", \
+	"uint32", \
+	"buffer", \
+	"" }
+
+#define BCM_IOVT_IS_INT(type) (\
+	(type == IOVT_BOOL) || \
+	(type == IOVT_INT8) || \
+	(type == IOVT_UINT8) || \
+	(type == IOVT_INT16) || \
+	(type == IOVT_UINT16) || \
+	(type == IOVT_INT32) || \
+	(type == IOVT_UINT32))
+
+/* ** driver/apps-shared section ** */
+
+#define BCME_STRLEN 		64	/* Max string length for BCM errors */
+#define VALID_BCMERROR(e)  ((e <= 0) && (e >= BCME_LAST))
+
+
+/*
+ * error codes could be added but the defined ones shouldn't be changed/deleted
+ * these error codes are exposed to the user code
+ * when ever a new error code is added to this list
+ * please update errorstring table with the related error string and
+ * update osl files with os specific errorcode map
+*/
+
+#define BCME_OK				0	/* Success */
+#define BCME_ERROR			-1	/* Error generic */
+#define BCME_BADARG			-2	/* Bad Argument */
+#define BCME_BADOPTION			-3	/* Bad option */
+#define BCME_NOTUP			-4	/* Not up */
+#define BCME_NOTDOWN			-5	/* Not down */
+#define BCME_NOTAP			-6	/* Not AP */
+#define BCME_NOTSTA			-7	/* Not STA  */
+#define BCME_BADKEYIDX			-8	/* BAD Key Index */
+#define BCME_RADIOOFF 			-9	/* Radio Off */
+#define BCME_NOTBANDLOCKED		-10	/* Not  band locked */
+#define BCME_NOCLK			-11	/* No Clock */
+#define BCME_BADRATESET			-12	/* BAD Rate valueset */
+#define BCME_BADBAND			-13	/* BAD Band */
+#define BCME_BUFTOOSHORT		-14	/* Buffer too short */
+#define BCME_BUFTOOLONG			-15	/* Buffer too long */
+#define BCME_BUSY			-16	/* Busy */
+#define BCME_NOTASSOCIATED		-17	/* Not Associated */
+#define BCME_BADSSIDLEN			-18	/* Bad SSID len */
+#define BCME_OUTOFRANGECHAN		-19	/* Out of Range Channel */
+#define BCME_BADCHAN			-20	/* Bad Channel */
+#define BCME_BADADDR			-21	/* Bad Address */
+#define BCME_NORESOURCE			-22	/* Not Enough Resources */
+#define BCME_UNSUPPORTED		-23	/* Unsupported */
+#define BCME_BADLEN			-24	/* Bad length */
+#define BCME_NOTREADY			-25	/* Not Ready */
+#define BCME_EPERM			-26	/* Not Permitted */
+#define BCME_NOMEM			-27	/* No Memory */
+#define BCME_ASSOCIATED			-28	/* Associated */
+#define BCME_RANGE			-29	/* Not In Range */
+#define BCME_NOTFOUND			-30	/* Not Found */
+#define BCME_WME_NOT_ENABLED		-31	/* WME Not Enabled */
+#define BCME_TSPEC_NOTFOUND		-32	/* TSPEC Not Found */
+#define BCME_ACM_NOTSUPPORTED		-33	/* ACM Not Supported */
+#define BCME_NOT_WME_ASSOCIATION	-34	/* Not WME Association */
+#define BCME_SDIO_ERROR			-35	/* SDIO Bus Error */
+#define BCME_DONGLE_DOWN		-36	/* Dongle Not Accessible */
+#define BCME_VERSION			-37 	/* Incorrect version */
+#define BCME_TXFAIL			-38 	/* TX failure */
+#define BCME_RXFAIL			-39	/* RX failure */
+#define BCME_NODEVICE			-40 	/* Device not present */
+#define BCME_NMODE_DISABLED		-41 	/* NMODE disabled */
+#define BCME_NONRESIDENT		-42 /* access to nonresident overlay */
+#define BCME_SCANREJECT			-43 	/* reject scan request */
+#define BCME_USAGE_ERROR                -44     /* WLCMD usage error */
+#define BCME_IOCTL_ERROR                -45     /* WLCMD ioctl error */
+#define BCME_SERIAL_PORT_ERR            -46     /* RWL serial port error */
+#define BCME_DISABLED			-47     /* Disabled in this build */
+#define BCME_DECERR				-48		/* Decrypt error */
+#define BCME_ENCERR				-49		/* Encrypt error */
+#define BCME_MICERR				-50		/* Integrity/MIC error */
+#define BCME_REPLAY				-51		/* Replay */
+#define BCME_IE_NOTFOUND		-52		/* IE not found */
+#define BCME_LAST			BCME_IE_NOTFOUND
+
+#define BCME_NOTENABLED BCME_DISABLED
+
+/* These are collection of BCME Error strings */
+#define BCMERRSTRINGTABLE {		\
+	"OK",				\
+	"Undefined error",		\
+	"Bad Argument",			\
+	"Bad Option",			\
+	"Not up",			\
+	"Not down",			\
+	"Not AP",			\
+	"Not STA",			\
+	"Bad Key Index",		\
+	"Radio Off",			\
+	"Not band locked",		\
+	"No clock",			\
+	"Bad Rate valueset",		\
+	"Bad Band",			\
+	"Buffer too short",		\
+	"Buffer too long",		\
+	"Busy",				\
+	"Not Associated",		\
+	"Bad SSID len",			\
+	"Out of Range Channel",		\
+	"Bad Channel",			\
+	"Bad Address",			\
+	"Not Enough Resources",		\
+	"Unsupported",			\
+	"Bad length",			\
+	"Not Ready",			\
+	"Not Permitted",		\
+	"No Memory",			\
+	"Associated",			\
+	"Not In Range",			\
+	"Not Found",			\
+	"WME Not Enabled",		\
+	"TSPEC Not Found",		\
+	"ACM Not Supported",		\
+	"Not WME Association",		\
+	"SDIO Bus Error",		\
+	"Dongle Not Accessible",	\
+	"Incorrect version",		\
+	"TX Failure",			\
+	"RX Failure",			\
+	"Device Not Present",		\
+	"NMODE Disabled",		\
+	"Nonresident overlay access", \
+	"Scan Rejected",		\
+	"WLCMD usage error",		\
+	"WLCMD ioctl error",		\
+	"RWL serial port error", 	\
+	"Disabled",			\
+	"Decrypt error", \
+	"Encrypt error", \
+	"MIC error", \
+	"Replay", \
+	"IE not found", \
+}
+
+#ifndef ABS
+#define	ABS(a)			(((a) < 0) ? -(a) : (a))
+#endif /* ABS */
+
+#ifndef MIN
+#define	MIN(a, b)		(((a) < (b)) ? (a) : (b))
+#endif /* MIN */
+
+#ifndef MAX
+#define	MAX(a, b)		(((a) > (b)) ? (a) : (b))
+#endif /* MAX */
+
+/* limit to [min, max] */
+#ifndef LIMIT_TO_RANGE
+#define LIMIT_TO_RANGE(x, min, max) \
+	((x) < (min) ? (min) : ((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_RANGE */
+
+/* limit to  max */
+#ifndef LIMIT_TO_MAX
+#define LIMIT_TO_MAX(x, max) \
+	(((x) > (max) ? (max) : (x)))
+#endif /* LIMIT_TO_MAX */
+
+/* limit to min */
+#ifndef LIMIT_TO_MIN
+#define LIMIT_TO_MIN(x, min) \
+	(((x) < (min) ? (min) : (x)))
+#endif /* LIMIT_TO_MIN */
+
+#define DELTA(curr, prev) ((curr) > (prev) ? ((curr) - (prev)) : \
+	(0xffffffff - (prev) + (curr) + 1))
+#define CEIL(x, y)		(((x) + ((y) - 1)) / (y))
+#define ROUNDUP(x, y)		((((x) + ((y) - 1)) / (y)) * (y))
+#define ROUNDDN(p, align)	((p) & ~((align) - 1))
+#define	ISALIGNED(a, x)		(((uintptr)(a) & ((x) - 1)) == 0)
+#define ALIGN_ADDR(addr, boundary) (void *)(((uintptr)(addr) + (boundary) - 1) \
+	                                         & ~((boundary) - 1))
+#define ALIGN_SIZE(size, boundary) (((size) + (boundary) - 1) \
+	                                         & ~((boundary) - 1))
+#define	ISPOWEROF2(x)		((((x) - 1) & (x)) == 0)
+#define VALID_MASK(mask)	!((mask) & ((mask) + 1))
+
+#ifndef OFFSETOF
+#ifdef __ARMCC_VERSION
+/*
+ * The ARM RVCT compiler complains when using OFFSETOF where a constant
+ * expression is expected, such as an initializer for a static object.
+ * offsetof from the runtime library doesn't have that problem.
+ */
+#include <stddef.h>
+#define	OFFSETOF(type, member)	offsetof(type, member)
+#else
+#  if ((__GNUC__ >= 4) && (__GNUC_MINOR__ >= 8))
+/* GCC 4.8+ complains when using our OFFSETOF macro in array length declarations. */
+#    define	OFFSETOF(type, member)	__builtin_offsetof(type, member)
+#  else
+#    define	OFFSETOF(type, member)	((uint)(uintptr)&((type *)0)->member)
+#  endif /* GCC 4.8 or newer */
+#endif /* __ARMCC_VERSION */
+#endif /* OFFSETOF */
+
+#ifndef ARRAYSIZE
+#define ARRAYSIZE(a)		(sizeof(a) / sizeof(a[0]))
+#endif
+
+#ifndef ARRAYLAST /* returns pointer to last array element */
+#define ARRAYLAST(a)		(&a[ARRAYSIZE(a)-1])
+#endif
+
+/* Reference a function; used to prevent a static function from being optimized out */
+extern void *_bcmutils_dummy_fn;
+#define REFERENCE_FUNCTION(f)	(_bcmutils_dummy_fn = (void *)(f))
+
+/* bit map related macros */
+#ifndef setbit
+#ifndef NBBY		/* the BSD family defines NBBY */
+#define	NBBY	8	/* 8 bits per byte */
+#endif /* #ifndef NBBY */
+#ifdef BCMUTILS_BIT_MACROS_USE_FUNCS
+extern void setbit(void *array, uint bit);
+extern void clrbit(void *array, uint bit);
+extern bool isset(const void *array, uint bit);
+extern bool isclr(const void *array, uint bit);
+#else
+#define	setbit(a, i)	(((uint8 *)a)[(i) / NBBY] |= 1 << ((i) % NBBY))
+#define	clrbit(a, i)	(((uint8 *)a)[(i) / NBBY] &= ~(1 << ((i) % NBBY)))
+#define	isset(a, i)	(((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY)))
+#define	isclr(a, i)	((((const uint8 *)a)[(i) / NBBY] & (1 << ((i) % NBBY))) == 0)
+#endif
+#endif /* setbit */
+extern void set_bitrange(void *array, uint start, uint end, uint maxbit);
+
+#define	isbitset(a, i)	(((a) & (1 << (i))) != 0)
+
+#define	NBITS(type)	(sizeof(type) * 8)
+#define NBITVAL(nbits)	(1 << (nbits))
+#define MAXBITVAL(nbits)	((1 << (nbits)) - 1)
+#define	NBITMASK(nbits)	MAXBITVAL(nbits)
+#define MAXNBVAL(nbyte)	MAXBITVAL((nbyte) * 8)
+
+extern void bcm_bitprint32(const uint32 u32);
+
+/*
+ * ----------------------------------------------------------------------------
+ * Multiword map of 2bits, nibbles
+ * setbit2 setbit4 (void *ptr, uint32 ix, uint32 val)
+ * getbit2 getbit4 (void *ptr, uint32 ix)
+ * ----------------------------------------------------------------------------
+ */
+
+#define DECLARE_MAP_API(NB, RSH, LSH, OFF, MSK)                     \
+static INLINE void setbit##NB(void *ptr, uint32 ix, uint32 val)     \
+{                                                                   \
+	uint32 *addr = (uint32 *)ptr;                                   \
+	uint32 *a = addr + (ix >> RSH); /* (ix / 2^RSH) */              \
+	uint32 pos = (ix & OFF) << LSH; /* (ix % 2^RSH) * 2^LSH */      \
+	uint32 mask = (MSK << pos);                                     \
+	uint32 tmp = *a & ~mask;                                        \
+	*a = tmp | (val << pos);                                        \
+}                                                                   \
+static INLINE uint32 getbit##NB(void *ptr, uint32 ix)               \
+{                                                                   \
+	uint32 *addr = (uint32 *)ptr;                                   \
+	uint32 *a = addr + (ix >> RSH);                                 \
+	uint32 pos = (ix & OFF) << LSH;                                 \
+	return ((*a >> pos) & MSK);                                     \
+}
+
+DECLARE_MAP_API(2, 4, 1, 15U, 0x0003) /* setbit2() and getbit2() */
+DECLARE_MAP_API(4, 3, 2, 7U, 0x000F) /* setbit4() and getbit4() */
+DECLARE_MAP_API(8, 2, 3, 3U, 0x00FF) /* setbit8() and getbit8() */
+
+/* basic mux operation - can be optimized on several architectures */
+#define MUX(pred, true, false) ((pred) ? (true) : (false))
+
+/* modulo inc/dec - assumes x E [0, bound - 1] */
+#define MODDEC(x, bound) MUX((x) == 0, (bound) - 1, (x) - 1)
+#define MODINC(x, bound) MUX((x) == (bound) - 1, 0, (x) + 1)
+
+/* modulo inc/dec, bound = 2^k */
+#define MODDEC_POW2(x, bound) (((x) - 1) & ((bound) - 1))
+#define MODINC_POW2(x, bound) (((x) + 1) & ((bound) - 1))
+
+/* modulo add/sub - assumes x, y E [0, bound - 1] */
+#define MODADD(x, y, bound) \
+    MUX((x) + (y) >= (bound), (x) + (y) - (bound), (x) + (y))
+#define MODSUB(x, y, bound) \
+    MUX(((int)(x)) - ((int)(y)) < 0, (x) - (y) + (bound), (x) - (y))
+
+/* module add/sub, bound = 2^k */
+#define MODADD_POW2(x, y, bound) (((x) + (y)) & ((bound) - 1))
+#define MODSUB_POW2(x, y, bound) (((x) - (y)) & ((bound) - 1))
+
+/* crc defines */
+#define CRC8_INIT_VALUE  0xff		/* Initial CRC8 checksum value */
+#define CRC8_GOOD_VALUE  0x9f		/* Good final CRC8 checksum value */
+#define CRC16_INIT_VALUE 0xffff		/* Initial CRC16 checksum value */
+#define CRC16_GOOD_VALUE 0xf0b8		/* Good final CRC16 checksum value */
+#define CRC32_INIT_VALUE 0xffffffff	/* Initial CRC32 checksum value */
+#define CRC32_GOOD_VALUE 0xdebb20e3	/* Good final CRC32 checksum value */
+
+/* use for direct output of MAC address in printf etc */
+#define MACF				"%02x:%02x:%02x:%02x:%02x:%02x"
+#define ETHERP_TO_MACF(ea)	((struct ether_addr *) (ea))->octet[0], \
+							((struct ether_addr *) (ea))->octet[1], \
+							((struct ether_addr *) (ea))->octet[2], \
+							((struct ether_addr *) (ea))->octet[3], \
+							((struct ether_addr *) (ea))->octet[4], \
+							((struct ether_addr *) (ea))->octet[5]
+
+#define ETHER_TO_MACF(ea) 	(ea).octet[0], \
+							(ea).octet[1], \
+							(ea).octet[2], \
+							(ea).octet[3], \
+							(ea).octet[4], \
+							(ea).octet[5]
+#if !defined(SIMPLE_MAC_PRINT)
+#define MACDBG "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC2STRDBG(ea) (ea)[0], (ea)[1], (ea)[2], (ea)[3], (ea)[4], (ea)[5]
+#else
+#define MACDBG				"%02x:%02x:%02x"
+#define MAC2STRDBG(ea) (ea)[0], (ea)[4], (ea)[5]
+#endif /* SIMPLE_MAC_PRINT */
+
+/* bcm_format_flags() bit description structure */
+typedef struct bcm_bit_desc {
+	uint32	bit;
+	const char* name;
+} bcm_bit_desc_t;
+
+/* bcm_format_field */
+typedef struct bcm_bit_desc_ex {
+	uint32 mask;
+	const bcm_bit_desc_t *bitfield;
+} bcm_bit_desc_ex_t;
+
+/* buffer length for ethernet address from bcm_ether_ntoa() */
+#define ETHER_ADDR_STR_LEN	18	/* 18-bytes of Ethernet address buffer length */
+
+static INLINE uint32 /* 32bit word aligned xor-32 */
+bcm_compute_xor32(volatile uint32 *u32, int num_u32)
+{
+	int i;
+	uint32 xor32 = 0;
+	for (i = 0; i < num_u32; i++)
+		xor32 ^= *(u32 + i);
+	return xor32;
+}
+
+/* crypto utility function */
+/* 128-bit xor: *dst = *src1 xor *src2. dst1, src1 and src2 may have any alignment */
+static INLINE void
+xor_128bit_block(const uint8 *src1, const uint8 *src2, uint8 *dst)
+{
+	if (
+#ifdef __i386__
+	    1 ||
+#endif
+	    (((uintptr)src1 | (uintptr)src2 | (uintptr)dst) & 3) == 0) {
+		/* ARM CM3 rel time: 1229 (727 if alignment check could be omitted) */
+		/* x86 supports unaligned.  This version runs 6x-9x faster on x86. */
+		((uint32 *)dst)[0] = ((const uint32 *)src1)[0] ^ ((const uint32 *)src2)[0];
+		((uint32 *)dst)[1] = ((const uint32 *)src1)[1] ^ ((const uint32 *)src2)[1];
+		((uint32 *)dst)[2] = ((const uint32 *)src1)[2] ^ ((const uint32 *)src2)[2];
+		((uint32 *)dst)[3] = ((const uint32 *)src1)[3] ^ ((const uint32 *)src2)[3];
+	} else {
+		/* ARM CM3 rel time: 4668 (4191 if alignment check could be omitted) */
+		int k;
+		for (k = 0; k < 16; k++)
+			dst[k] = src1[k] ^ src2[k];
+	}
+}
+
+/* externs */
+/* crc */
+extern uint8 hndcrc8(uint8 *p, uint nbytes, uint8 crc);
+extern uint16 hndcrc16(uint8 *p, uint nbytes, uint16 crc);
+extern uint32 hndcrc32(uint8 *p, uint nbytes, uint32 crc);
+
+/* format/print */
+#if defined(DHD_DEBUG) || defined(WLMSG_PRHDRS) || defined(WLMSG_PRPKT) || \
+	defined(WLMSG_ASSOC)
+/* print out the value a field has: fields may have 1-32 bits and may hold any value */
+extern int bcm_format_field(const bcm_bit_desc_ex_t *bd, uint32 field, char* buf, int len);
+/* print out which bits in flags are set */
+extern int bcm_format_flags(const bcm_bit_desc_t *bd, uint32 flags, char* buf, int len);
+#endif
+
+extern int bcm_format_hex(char *str, const void *bytes, int len);
+
+extern const char *bcm_crypto_algo_name(uint algo);
+extern char *bcm_chipname(uint chipid, char *buf, uint len);
+extern char *bcm_brev_str(uint32 brev, char *buf);
+extern void printbig(char *buf);
+extern void prhex(const char *msg, uchar *buf, uint len);
+
+/* IE parsing */
+
+/* tag_ID/length/value_buffer tuple */
+typedef struct bcm_tlv {
+	uint8	id;
+	uint8	len;
+	uint8	data[1];
+} bcm_tlv_t;
+
+/* bcm tlv w/ 16 bit id/len */
+typedef struct bcm_xtlv {
+	uint16	id;
+	uint16	len;
+	uint8	data[1];
+} bcm_xtlv_t;
+
+/* descriptor of xtlv data src or dst  */
+typedef struct {
+	uint16	type;
+	uint16	len;
+	void	*ptr; /* ptr to memory location */
+} xtlv_desc_t;
+
+/*  set a var from xtlv buffer */
+typedef int
+(bcm_set_var_from_tlv_cbfn_t)(void *ctx, void **tlv_buf, uint16 type, uint16 len);
+
+struct bcm_tlvbuf {
+    uint16 size;
+    uint8 *head; /* point to head of buffer */
+    uint8 *buf; /* current position of buffer */
+	/* followed by the allocated buffer */
+};
+
+#define BCM_TLV_MAX_DATA_SIZE (255)
+#define BCM_XTLV_MAX_DATA_SIZE (65535)
+#define BCM_TLV_HDR_SIZE (OFFSETOF(bcm_tlv_t, data))
+
+#define BCM_XTLV_HDR_SIZE (OFFSETOF(bcm_xtlv_t, data))
+#define BCM_XTLV_LEN(elt) ltoh16_ua(&(elt->len))
+#define BCM_XTLV_ID(elt) ltoh16_ua(&(elt->id))
+#define BCM_XTLV_SIZE(elt) (BCM_XTLV_HDR_SIZE + BCM_XTLV_LEN(elt))
+
+/* Check that bcm_tlv_t fits into the given buflen */
+#define bcm_valid_tlv(elt, buflen) (\
+	 ((int)(buflen) >= (int)BCM_TLV_HDR_SIZE) && \
+	 ((int)(buflen) >= (int)(BCM_TLV_HDR_SIZE + (elt)->len)))
+
+#define bcm_valid_xtlv(elt, buflen) (\
+	 ((int)(buflen) >= (int)BCM_XTLV_HDR_SIZE) && \
+	 ((int)(buflen) >= (int)BCM_XTLV_SIZE(elt)))
+
+extern bcm_tlv_t *bcm_next_tlv(bcm_tlv_t *elt, int *buflen);
+extern bcm_tlv_t *bcm_parse_tlvs(void *buf, int buflen, uint key);
+extern bcm_tlv_t *bcm_parse_tlvs_min_bodylen(void *buf, int buflen, uint key, int min_bodylen);
+
+extern bcm_tlv_t *bcm_parse_ordered_tlvs(void *buf, int buflen, uint key);
+
+extern bcm_tlv_t *bcm_find_vendor_ie(void *tlvs, int tlvs_len, const char *voui, uint8 *type,
+	int type_len);
+
+extern uint8 *bcm_write_tlv(int type, const void *data, int datalen, uint8 *dst);
+extern uint8 *bcm_write_tlv_safe(int type, const void *data, int datalen, uint8 *dst,
+	int dst_maxlen);
+
+extern uint8 *bcm_copy_tlv(const void *src, uint8 *dst);
+extern uint8 *bcm_copy_tlv_safe(const void *src, uint8 *dst, int dst_maxlen);
+
+/* xtlv */
+extern bcm_xtlv_t *bcm_next_xtlv(bcm_xtlv_t *elt, int *buflen);
+extern struct bcm_tlvbuf *bcm_xtlv_buf_alloc(void *osh, uint16 len);
+extern void bcm_xtlv_buf_free(void *osh, struct bcm_tlvbuf *tbuf);
+extern uint16 bcm_xtlv_buf_len(struct bcm_tlvbuf *tbuf);
+extern uint16 bcm_xtlv_buf_rlen(struct bcm_tlvbuf *tbuf);
+extern uint8 *bcm_xtlv_buf(struct bcm_tlvbuf *tbuf);
+extern uint8 *bcm_xtlv_head(struct bcm_tlvbuf *tbuf);
+extern int bcm_xtlv_put_data(struct bcm_tlvbuf *tbuf, uint16 type, const void *data, uint16 dlen);
+extern int bcm_xtlv_put_8(struct bcm_tlvbuf *tbuf, uint16 type, const int8 data);
+extern int bcm_xtlv_put_16(struct bcm_tlvbuf *tbuf, uint16 type, const int16 data);
+extern int bcm_xtlv_put_32(struct bcm_tlvbuf *tbuf, uint16 type, const int32 data);
+extern int bcm_unpack_xtlv_entry(void **tlv_buf, uint16 xpct_type, uint16 xpct_len, void *dst);
+extern int bcm_skip_xtlv(void **tlv_buf);
+extern int bcm_pack_xtlv_entry(void **tlv_buf, uint16 *buflen, uint16 type, uint16 len, void *src);
+extern int bcm_unpack_xtlv_buf(void *ctx,
+	void *tlv_buf, uint16 buflen, bcm_set_var_from_tlv_cbfn_t *cbfn);
+extern int
+bcm_unpack_xtlv_buf_to_mem(void *tlv_buf, int *buflen, xtlv_desc_t *items);
+extern int
+bcm_pack_xtlv_buf_from_mem(void **tlv_buf, uint16 *buflen, xtlv_desc_t *items);
+extern int
+bcm_pack_xtlv_entry_from_hex_string(void **tlv_buf, uint16 *buflen, uint16 type, char *hex);
+
+/* bcmerror */
+extern const char *bcmerrorstr(int bcmerror);
+
+/* multi-bool data type: set of bools, mbool is true if any is set */
+typedef uint32 mbool;
+#define mboolset(mb, bit)		((mb) |= (bit))		/* set one bool */
+#define mboolclr(mb, bit)		((mb) &= ~(bit))	/* clear one bool */
+#define mboolisset(mb, bit)		(((mb) & (bit)) != 0)	/* TRUE if one bool is set */
+#define	mboolmaskset(mb, mask, val)	((mb) = (((mb) & ~(mask)) | (val)))
+
+/* generic datastruct to help dump routines */
+struct fielddesc {
+	const char *nameandfmt;
+	uint32 	offset;
+	uint32 	len;
+};
+
+extern void bcm_binit(struct bcmstrbuf *b, char *buf, uint size);
+extern void bcm_bprhex(struct bcmstrbuf *b, const char *msg, bool newline, uint8 *buf, int len);
+
+extern void bcm_inc_bytes(uchar *num, int num_bytes, uint8 amount);
+extern int bcm_cmp_bytes(const uchar *arg1, const uchar *arg2, uint8 nbytes);
+extern void bcm_print_bytes(const char *name, const uchar *cdata, int len);
+
+typedef  uint32 (*bcmutl_rdreg_rtn)(void *arg0, uint arg1, uint32 offset);
+extern uint bcmdumpfields(bcmutl_rdreg_rtn func_ptr, void *arg0, uint arg1, struct fielddesc *str,
+                          char *buf, uint32 bufsize);
+extern uint bcm_bitcount(uint8 *bitmap, uint bytelength);
+
+extern int bcm_bprintf(struct bcmstrbuf *b, const char *fmt, ...);
+
+/* power conversion */
+extern uint16 bcm_qdbm_to_mw(uint8 qdbm);
+extern uint8 bcm_mw_to_qdbm(uint16 mw);
+extern uint bcm_mkiovar(char *name, char *data, uint datalen, char *buf, uint len);
+
+unsigned int process_nvram_vars(char *varbuf, unsigned int len);
+
+/* calculate a * b + c */
+extern void bcm_uint64_multiple_add(uint32* r_high, uint32* r_low, uint32 a, uint32 b, uint32 c);
+/* calculate a / b */
+extern void bcm_uint64_divide(uint32* r, uint32 a_high, uint32 a_low, uint32 b);
+
+
+/* Public domain bit twiddling hacks/utilities: Sean Eron Anderson */
+
+/* Table driven count set bits. */
+static const uint8 /* Table only for use by bcm_cntsetbits */
+_CSBTBL[256] =
+{
+#	define B2(n)    n,     n + 1,     n + 1,     n + 2
+#	define B4(n) B2(n), B2(n + 1), B2(n + 1), B2(n + 2)
+#	define B6(n) B4(n), B4(n + 1), B4(n + 1), B4(n + 2)
+	B6(0), B6(0 + 1), B6(0 + 1), B6(0 + 2)
+};
+
+static INLINE uint32 /* Uses table _CSBTBL for fast counting of 1's in a u32 */
+bcm_cntsetbits(const uint32 u32)
+{
+	/* function local scope declaration of const _CSBTBL[] */
+	const uint8 * p = (const uint8 *)&u32;
+	return (_CSBTBL[p[0]] + _CSBTBL[p[1]] + _CSBTBL[p[2]] + _CSBTBL[p[3]]);
+}
+
+
+static INLINE int /* C equivalent count of leading 0's in a u32 */
+C_bcm_count_leading_zeros(uint32 u32)
+{
+	int shifts = 0;
+	while (u32) {
+		shifts++; u32 >>= 1;
+	}
+	return (32U - shifts);
+}
+
+#ifdef BCMDRIVER
+/*
+ * Assembly instructions: Count Leading Zeros
+ * "clz"	: MIPS, ARM
+ * "cntlzw"	: PowerPC
+ * "BSF"	: x86
+ * "lzcnt"	: AMD, SPARC
+ */
+
+#if defined(__arm__)
+
+#if defined(__ARM_ARCH_7M__) /* Cortex M3 */
+#define __USE_ASM_CLZ__
+#endif /* __ARM_ARCH_7M__ */
+
+#if defined(__ARM_ARCH_7R__) /* Cortex R4 */
+#define __USE_ASM_CLZ__
+#endif /* __ARM_ARCH_7R__ */
+
+#endif /* __arm__ */
+
+static INLINE int
+bcm_count_leading_zeros(uint32 u32)
+{
+#if defined(__USE_ASM_CLZ__)
+	int zeros;
+	__asm__ volatile("clz    %0, %1 \n" : "=r" (zeros) : "r"  (u32));
+	return zeros;
+#else	/* C equivalent */
+	return C_bcm_count_leading_zeros(u32);
+#endif  /* C equivalent */
+}
+
+/* INTERFACE: Multiword bitmap based small id allocator. */
+struct bcm_mwbmap;	/* forward declaration for use as an opaque mwbmap handle */
+
+#define BCM_MWBMAP_INVALID_HDL	((struct bcm_mwbmap *)NULL)
+#define BCM_MWBMAP_INVALID_IDX	((uint32)(~0U))
+
+/* Incarnate a multiword bitmap based small index allocator */
+extern struct bcm_mwbmap * bcm_mwbmap_init(osl_t * osh, uint32 items_max);
+
+/* Free up the multiword bitmap index allocator */
+extern void bcm_mwbmap_fini(osl_t * osh, struct bcm_mwbmap * mwbmap_hdl);
+
+/* Allocate a unique small index using a multiword bitmap index allocator */
+extern uint32 bcm_mwbmap_alloc(struct bcm_mwbmap * mwbmap_hdl);
+
+/* Force an index at a specified position to be in use */
+extern void bcm_mwbmap_force(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Free a previously allocated index back into the multiword bitmap allocator */
+extern void bcm_mwbmap_free(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Fetch the toal number of free indices in the multiword bitmap allocator */
+extern uint32 bcm_mwbmap_free_cnt(struct bcm_mwbmap * mwbmap_hdl);
+
+/* Determine whether an index is inuse or free */
+extern bool bcm_mwbmap_isfree(struct bcm_mwbmap * mwbmap_hdl, uint32 bitix);
+
+/* Debug dump a multiword bitmap allocator */
+extern void bcm_mwbmap_show(struct bcm_mwbmap * mwbmap_hdl);
+
+extern void bcm_mwbmap_audit(struct bcm_mwbmap * mwbmap_hdl);
+/* End - Multiword bitmap based small Id allocator. */
+
+
+/* INTERFACE: Simple unique 16bit Id Allocator using a stack implementation. */
+
+#define ID16_INVALID                ((uint16)(~0))
+
+/*
+ * Construct a 16bit id allocator, managing 16bit ids in the range:
+ *    [start_val16 .. start_val16+total_ids)
+ * Note: start_val16 is inclusive.
+ * Returns an opaque handle to the 16bit id allocator.
+ */
+extern void * id16_map_init(osl_t *osh, uint16 total_ids, uint16 start_val16);
+extern void * id16_map_fini(osl_t *osh, void * id16_map_hndl);
+extern void id16_map_clear(void * id16_map_hndl, uint16 total_ids, uint16 start_val16);
+
+/* Allocate a unique 16bit id */
+extern uint16 id16_map_alloc(void * id16_map_hndl);
+
+/* Free a 16bit id value into the id16 allocator */
+extern void id16_map_free(void * id16_map_hndl, uint16 val16);
+
+/* Get the number of failures encountered during id allocation. */
+extern uint32 id16_map_failures(void * id16_map_hndl);
+
+/* Audit the 16bit id allocator state. */
+extern bool id16_map_audit(void * id16_map_hndl);
+/* End - Simple 16bit Id Allocator. */
+
+#endif /* BCMDRIVER */
+
+extern void bcm_uint64_right_shift(uint32* r, uint32 a_high, uint32 a_low, uint32 b);
+
+void bcm_add_64(uint32* r_hi, uint32* r_lo, uint32 offset);
+void bcm_sub_64(uint32* r_hi, uint32* r_lo, uint32 offset);
+
+/* calculate checksum for ip header, tcp / udp header / data */
+uint16 bcm_ip_cksum(uint8 *buf, uint32 len, uint32 sum);
+
+#ifndef _dll_t_
+#define _dll_t_
+/*
+ * -----------------------------------------------------------------------------
+ *                      Double Linked List Macros
+ * -----------------------------------------------------------------------------
+ *
+ * All dll operations must be performed on a pre-initialized node.
+ * Inserting an uninitialized node into a list effectively initialized it.
+ *
+ * When a node is deleted from a list, you may initialize it to avoid corruption
+ * incurred by double deletion. You may skip initialization if the node is
+ * immediately inserted into another list.
+ *
+ * By placing a dll_t element at the start of a struct, you may cast a dll_t *
+ * to the struct or vice versa.
+ *
+ * Example of declaring an initializing someList and inserting nodeA, nodeB
+ *
+ *     typedef struct item {
+ *         dll_t node;
+ *         int someData;
+ *     } Item_t;
+ *     Item_t nodeA, nodeB, nodeC;
+ *     nodeA.someData = 11111, nodeB.someData = 22222, nodeC.someData = 33333;
+ *
+ *     dll_t someList;
+ *     dll_init(&someList);
+ *
+ *     dll_append(&someList, (dll_t *) &nodeA);
+ *     dll_prepend(&someList, &nodeB.node);
+ *     dll_insert((dll_t *)&nodeC, &nodeA.node);
+ *
+ *     dll_delete((dll_t *) &nodeB);
+ *
+ * Example of a for loop to walk someList of node_p
+ *
+ *   extern void mydisplay(Item_t * item_p);
+ *
+ *   dll_t * item_p, * next_p;
+ *   for (item_p = dll_head_p(&someList); ! dll_end(&someList, item_p);
+ *        item_p = next_p)
+ *   {
+ *       next_p = dll_next_p(item_p);
+ *       ... use item_p at will, including removing it from list ...
+ *       mydisplay((PItem_t)item_p);
+ *   }
+ *
+ * -----------------------------------------------------------------------------
+ */
+typedef struct dll {
+	struct dll * next_p;
+	struct dll * prev_p;
+} dll_t;
+
+static INLINE void
+dll_init(dll_t *node_p)
+{
+	node_p->next_p = node_p;
+	node_p->prev_p = node_p;
+}
+/* dll macros returing a pointer to dll_t */
+
+static INLINE dll_t *
+dll_head_p(dll_t *list_p)
+{
+	return list_p->next_p;
+}
+
+
+static INLINE dll_t *
+dll_tail_p(dll_t *list_p)
+{
+	return (list_p)->prev_p;
+}
+
+
+static INLINE dll_t *
+dll_next_p(dll_t *node_p)
+{
+	return (node_p)->next_p;
+}
+
+
+static INLINE dll_t *
+dll_prev_p(dll_t *node_p)
+{
+	return (node_p)->prev_p;
+}
+
+
+static INLINE bool
+dll_empty(dll_t *list_p)
+{
+	return ((list_p)->next_p == (list_p));
+}
+
+
+static INLINE bool
+dll_end(dll_t *list_p, dll_t * node_p)
+{
+	return (list_p == node_p);
+}
+
+
+/* inserts the node new_p "after" the node at_p */
+static INLINE void
+dll_insert(dll_t *new_p, dll_t * at_p)
+{
+	new_p->next_p = at_p->next_p;
+	new_p->prev_p = at_p;
+	at_p->next_p = new_p;
+	(new_p->next_p)->prev_p = new_p;
+}
+
+static INLINE void
+dll_append(dll_t *list_p, dll_t *node_p)
+{
+	dll_insert(node_p, dll_tail_p(list_p));
+}
+
+static INLINE void
+dll_prepend(dll_t *list_p, dll_t *node_p)
+{
+	dll_insert(node_p, list_p);
+}
+
+
+/* deletes a node from any list that it "may" be in, if at all. */
+static INLINE void
+dll_delete(dll_t *node_p)
+{
+	node_p->prev_p->next_p = node_p->next_p;
+	node_p->next_p->prev_p = node_p->prev_p;
+}
+#endif  /* ! defined(_dll_t_) */
+
+/* Elements managed in a double linked list */
+
+typedef struct dll_pool {
+	dll_t       free_list;
+	uint16      free_count;
+	uint16      elems_max;
+	uint16      elem_size;
+	dll_t       elements[1];
+} dll_pool_t;
+
+dll_pool_t * dll_pool_init(void * osh, uint16 elems_max, uint16 elem_size);
+void * dll_pool_alloc(dll_pool_t * dll_pool_p);
+void dll_pool_free(dll_pool_t * dll_pool_p, void * elem_p);
+void dll_pool_free_tail(dll_pool_t * dll_pool_p, void * elem_p);
+typedef void (* dll_elem_dump)(void * elem_p);
+void dll_pool_detach(void * osh, dll_pool_t * pool, uint16 elems_max, uint16 elem_size);
+
+#ifdef __cplusplus
+	}
+#endif
+
+/* #define DEBUG_COUNTER */
+#ifdef DEBUG_COUNTER
+#define CNTR_TBL_MAX 10
+typedef struct _counter_tbl_t {
+	char name[16];				/* name of this counter table */
+	uint32 prev_log_print;		/* Internal use. Timestamp of the previous log print */
+	uint log_print_interval;	/* Desired interval to print logs in ms */
+	uint needed_cnt;			/* How many counters need to be used */
+	uint32 cnt[CNTR_TBL_MAX];		/* Counting entries to increase at desired places */
+	bool enabled;				/* Whether to enable printing log */
+} counter_tbl_t;
+
+
+void counter_printlog(counter_tbl_t *ctr_tbl);
+#endif /* DEBUG_COUNTER */
+
+#endif	/* _bcmutils_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmwifi_channels.h b/drivers/net/wireless/bcm4336/include/bcmwifi_channels.h
--- a/drivers/net/wireless/bcm4336/include/bcmwifi_channels.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmwifi_channels.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,530 @@
+/*
+ * Misc utility routines for WL and Apps
+ * This header file housing the define and function prototype use by
+ * both the wl driver, tools & Apps.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmwifi_channels.h 309193 2012-01-19 00:03:57Z $
+ */
+
+#ifndef	_bcmwifi_channels_h_
+#define	_bcmwifi_channels_h_
+
+
+/* A chanspec holds the channel number, band, bandwidth and control sideband */
+typedef uint16 chanspec_t;
+
+/* channel defines */
+#define CH_UPPER_SB			0x01
+#define CH_LOWER_SB			0x02
+#define CH_EWA_VALID			0x04
+#define CH_80MHZ_APART			16
+#define CH_40MHZ_APART			8
+#define CH_20MHZ_APART			4
+#define CH_10MHZ_APART			2
+#define CH_5MHZ_APART			1	/* 2G band channels are 5 Mhz apart */
+#define CH_MAX_2G_CHANNEL		14	/* Max channel in 2G band */
+#define MAXCHANNEL		224	/* max # supported channels. The max channel no is above,
+					 * this is that + 1 rounded up to a multiple of NBBY (8).
+					 * DO NOT MAKE it > 255: channels are uint8's all over
+					 */
+#define MAXCHANNEL_NUM	(MAXCHANNEL - 1)	/* max channel number */
+
+/* make sure channel num is within valid range */
+#define CH_NUM_VALID_RANGE(ch_num) ((ch_num) > 0 && (ch_num) <= MAXCHANNEL_NUM)
+
+#define CHSPEC_CTLOVLP(sp1, sp2, sep)	(ABS(wf_chspec_ctlchan(sp1) - wf_chspec_ctlchan(sp2)) < \
+				  (sep))
+
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+#define WL_CHANSPEC_CHAN_MASK		0x00ff
+#define WL_CHANSPEC_CHAN_SHIFT		0
+#define WL_CHANSPEC_CHAN1_MASK		0x000f
+#define WL_CHANSPEC_CHAN1_SHIFT		0
+#define WL_CHANSPEC_CHAN2_MASK		0x00f0
+#define WL_CHANSPEC_CHAN2_SHIFT		4
+
+#define WL_CHANSPEC_CTL_SB_MASK		0x0700
+#define WL_CHANSPEC_CTL_SB_SHIFT	8
+#define WL_CHANSPEC_CTL_SB_LLL		0x0000
+#define WL_CHANSPEC_CTL_SB_LLU		0x0100
+#define WL_CHANSPEC_CTL_SB_LUL		0x0200
+#define WL_CHANSPEC_CTL_SB_LUU		0x0300
+#define WL_CHANSPEC_CTL_SB_ULL		0x0400
+#define WL_CHANSPEC_CTL_SB_ULU		0x0500
+#define WL_CHANSPEC_CTL_SB_UUL		0x0600
+#define WL_CHANSPEC_CTL_SB_UUU		0x0700
+#define WL_CHANSPEC_CTL_SB_LL		WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_LU		WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_UL		WL_CHANSPEC_CTL_SB_LUL
+#define WL_CHANSPEC_CTL_SB_UU		WL_CHANSPEC_CTL_SB_LUU
+#define WL_CHANSPEC_CTL_SB_L		WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_U		WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_LOWER	WL_CHANSPEC_CTL_SB_LLL
+#define WL_CHANSPEC_CTL_SB_UPPER	WL_CHANSPEC_CTL_SB_LLU
+#define WL_CHANSPEC_CTL_SB_NONE		WL_CHANSPEC_CTL_SB_LLL
+
+#define WL_CHANSPEC_BW_MASK		0x3800
+#define WL_CHANSPEC_BW_SHIFT		11
+#define WL_CHANSPEC_BW_5		0x0000
+#define WL_CHANSPEC_BW_10		0x0800
+#define WL_CHANSPEC_BW_20		0x1000
+#define WL_CHANSPEC_BW_40		0x1800
+#define WL_CHANSPEC_BW_80		0x2000
+#define WL_CHANSPEC_BW_160		0x2800
+#define WL_CHANSPEC_BW_8080		0x3000
+
+#define WL_CHANSPEC_BAND_MASK		0xc000
+#define WL_CHANSPEC_BAND_SHIFT		14
+#define WL_CHANSPEC_BAND_2G		0x0000
+#define WL_CHANSPEC_BAND_3G		0x4000
+#define WL_CHANSPEC_BAND_4G		0x8000
+#define WL_CHANSPEC_BAND_5G		0xc000
+#define INVCHANSPEC			255
+
+/* channel defines */
+#define LOWER_20_SB(channel)		(((channel) > CH_10MHZ_APART) ? \
+					((channel) - CH_10MHZ_APART) : 0)
+#define UPPER_20_SB(channel)		(((channel) < (MAXCHANNEL - CH_10MHZ_APART)) ? \
+					((channel) + CH_10MHZ_APART) : 0)
+
+#define LL_20_SB(channel) (((channel) > 3 * CH_10MHZ_APART) ? ((channel) - 3 * CH_10MHZ_APART) : 0)
+#define UU_20_SB(channel) 	(((channel) < (MAXCHANNEL - 3 * CH_10MHZ_APART)) ? \
+				((channel) + 3 * CH_10MHZ_APART) : 0)
+#define LU_20_SB(channel) LOWER_20_SB(channel)
+#define UL_20_SB(channel) UPPER_20_SB(channel)
+
+#define LOWER_40_SB(channel)		((channel) - CH_20MHZ_APART)
+#define UPPER_40_SB(channel)		((channel) + CH_20MHZ_APART)
+#define CHSPEC_WLCBANDUNIT(chspec)	(CHSPEC_IS5G(chspec) ? BAND_5G_INDEX : BAND_2G_INDEX)
+#define CH20MHZ_CHSPEC(channel)		(chanspec_t)((chanspec_t)(channel) | WL_CHANSPEC_BW_20 | \
+					(((channel) <= CH_MAX_2G_CHANNEL) ? \
+					WL_CHANSPEC_BAND_2G : WL_CHANSPEC_BAND_5G))
+#define NEXT_20MHZ_CHAN(channel)	(((channel) < (MAXCHANNEL - CH_20MHZ_APART)) ? \
+					((channel) + CH_20MHZ_APART) : 0)
+#define CH40MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | WL_CHANSPEC_BW_40 | \
+					((channel) <= CH_MAX_2G_CHANNEL ? WL_CHANSPEC_BAND_2G : \
+					WL_CHANSPEC_BAND_5G))
+#define CH80MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | \
+					 WL_CHANSPEC_BW_80 | WL_CHANSPEC_BAND_5G)
+#define CH160MHZ_CHSPEC(channel, ctlsb)	(chanspec_t) \
+					((channel) | (ctlsb) | \
+					 WL_CHANSPEC_BW_160 | WL_CHANSPEC_BAND_5G)
+
+/* simple MACROs to get different fields of chanspec */
+#ifdef WL11AC_80P80
+#define CHSPEC_CHANNEL(chspec)	wf_chspec_channel(chspec)
+#else
+#define CHSPEC_CHANNEL(chspec)	((uint8)((chspec) & WL_CHANSPEC_CHAN_MASK))
+#endif
+#define CHSPEC_CHAN1(chspec)	((chspec) & WL_CHANSPEC_CHAN1_MASK) >> WL_CHANSPEC_CHAN1_SHIFT
+#define CHSPEC_CHAN2(chspec)	((chspec) & WL_CHANSPEC_CHAN2_MASK) >> WL_CHANSPEC_CHAN2_SHIFT
+#define CHSPEC_BAND(chspec)		((chspec) & WL_CHANSPEC_BAND_MASK)
+#define CHSPEC_CTL_SB(chspec)	((chspec) & WL_CHANSPEC_CTL_SB_MASK)
+#define CHSPEC_BW(chspec)		((chspec) & WL_CHANSPEC_BW_MASK)
+
+#ifdef WL11N_20MHZONLY
+
+#define CHSPEC_IS10(chspec)	0
+#define CHSPEC_IS20(chspec)	1
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)	0
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)	0
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)	0
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)	0
+#endif
+
+#else /* !WL11N_20MHZONLY */
+
+#define CHSPEC_IS10(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_10)
+#define CHSPEC_IS20(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_20)
+#ifndef CHSPEC_IS40
+#define CHSPEC_IS40(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40)
+#endif
+#ifndef CHSPEC_IS80
+#define CHSPEC_IS80(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_80)
+#endif
+#ifndef CHSPEC_IS160
+#define CHSPEC_IS160(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_160)
+#endif
+#ifndef CHSPEC_IS8080
+#define CHSPEC_IS8080(chspec)	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_8080)
+#endif
+
+#endif /* !WL11N_20MHZONLY */
+
+#define CHSPEC_IS5G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_5G)
+#define CHSPEC_IS2G(chspec)	(((chspec) & WL_CHANSPEC_BAND_MASK) == WL_CHANSPEC_BAND_2G)
+#define CHSPEC_SB_UPPER(chspec)	\
+	((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_UPPER) && \
+	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC_SB_LOWER(chspec)	\
+	((((chspec) & WL_CHANSPEC_CTL_SB_MASK) == WL_CHANSPEC_CTL_SB_LOWER) && \
+	(((chspec) & WL_CHANSPEC_BW_MASK) == WL_CHANSPEC_BW_40))
+#define CHSPEC2WLC_BAND(chspec) (CHSPEC_IS5G(chspec) ? WLC_BAND_5G : WLC_BAND_2G)
+
+/**
+ * Number of chars needed for wf_chspec_ntoa() destination character buffer.
+ */
+#define CHANSPEC_STR_LEN    20
+
+
+#define CHSPEC_IS_BW_160_WIDE(chspec) (CHSPEC_BW(chspec) == WL_CHANSPEC_BW_160 ||\
+	CHSPEC_BW(chspec) == WL_CHANSPEC_BW_8080)
+
+/* BW inequality comparisons, LE (<=), GE (>=), LT (<), GT (>), comparisons can be made
+* as simple numeric comparisons, with the exception that 160 is the same BW as 80+80,
+* but have different numeric values; (WL_CHANSPEC_BW_160 < WL_CHANSPEC_BW_8080).
+*
+* The LT/LE/GT/GE macros check first checks whether both chspec bandwidth and bw are 160 wide.
+* If both chspec bandwidth and bw is not 160 wide, then the comparison is made.
+*/
+#define CHSPEC_BW_GE(chspec, bw) \
+	((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+	(bw == WL_CHANSPEC_BW_160 || bw == WL_CHANSPEC_BW_8080)) ||\
+	(CHSPEC_BW(chspec) >= bw))
+
+#define CHSPEC_BW_LE(chspec, bw) \
+	((CHSPEC_IS_BW_160_WIDE(chspec) &&\
+	(bw == WL_CHANSPEC_BW_160 || bw == WL_CHANSPEC_BW_8080)) ||\
+	(CHSPEC_BW(chspec) <= bw))
+
+#define CHSPEC_BW_GT(chspec, bw) \
+	(!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+	(bw == WL_CHANSPEC_BW_160 || bw == WL_CHANSPEC_BW_8080)) &&\
+	(CHSPEC_BW(chspec) > bw))
+
+#define CHSPEC_BW_LT(chspec, bw) \
+	(!(CHSPEC_IS_BW_160_WIDE(chspec) &&\
+	(bw == WL_CHANSPEC_BW_160 || bw == WL_CHANSPEC_BW_8080)) &&\
+	(CHSPEC_BW(chspec) < bw))
+
+/* Legacy Chanspec defines
+ * These are the defines for the previous format of the chanspec_t
+ */
+#define WL_LCHANSPEC_CHAN_MASK		0x00ff
+#define WL_LCHANSPEC_CHAN_SHIFT		     0
+
+#define WL_LCHANSPEC_CTL_SB_MASK	0x0300
+#define WL_LCHANSPEC_CTL_SB_SHIFT	     8
+#define WL_LCHANSPEC_CTL_SB_LOWER	0x0100
+#define WL_LCHANSPEC_CTL_SB_UPPER	0x0200
+#define WL_LCHANSPEC_CTL_SB_NONE	0x0300
+
+#define WL_LCHANSPEC_BW_MASK		0x0C00
+#define WL_LCHANSPEC_BW_SHIFT		    10
+#define WL_LCHANSPEC_BW_10		0x0400
+#define WL_LCHANSPEC_BW_20		0x0800
+#define WL_LCHANSPEC_BW_40		0x0C00
+
+#define WL_LCHANSPEC_BAND_MASK		0xf000
+#define WL_LCHANSPEC_BAND_SHIFT		    12
+#define WL_LCHANSPEC_BAND_5G		0x1000
+#define WL_LCHANSPEC_BAND_2G		0x2000
+
+#define LCHSPEC_CHANNEL(chspec)	((uint8)((chspec) & WL_LCHANSPEC_CHAN_MASK))
+#define LCHSPEC_BAND(chspec)	((chspec) & WL_LCHANSPEC_BAND_MASK)
+#define LCHSPEC_CTL_SB(chspec)	((chspec) & WL_LCHANSPEC_CTL_SB_MASK)
+#define LCHSPEC_BW(chspec)	((chspec) & WL_LCHANSPEC_BW_MASK)
+#define LCHSPEC_IS10(chspec)	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_10)
+#define LCHSPEC_IS20(chspec)	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_20)
+#define LCHSPEC_IS40(chspec)	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40)
+#define LCHSPEC_IS5G(chspec)	(((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_5G)
+#define LCHSPEC_IS2G(chspec)	(((chspec) & WL_LCHANSPEC_BAND_MASK) == WL_LCHANSPEC_BAND_2G)
+
+#define LCHSPEC_SB_UPPER(chspec)	\
+	((((chspec) & WL_LCHANSPEC_CTL_SB_MASK) == WL_LCHANSPEC_CTL_SB_UPPER) && \
+	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40))
+#define LCHSPEC_SB_LOWER(chspec)	\
+	((((chspec) & WL_LCHANSPEC_CTL_SB_MASK) == WL_LCHANSPEC_CTL_SB_LOWER) && \
+	(((chspec) & WL_LCHANSPEC_BW_MASK) == WL_LCHANSPEC_BW_40))
+
+#define LCHSPEC_CREATE(chan, band, bw, sb)  ((uint16)((chan) | (sb) | (bw) | (band)))
+
+#define CH20MHZ_LCHSPEC(channel) \
+	(chanspec_t)((chanspec_t)(channel) | WL_LCHANSPEC_BW_20 | \
+	WL_LCHANSPEC_CTL_SB_NONE | (((channel) <= CH_MAX_2G_CHANNEL) ? \
+	WL_LCHANSPEC_BAND_2G : WL_LCHANSPEC_BAND_5G))
+
+/*
+ * WF_CHAN_FACTOR_* constants are used to calculate channel frequency
+ * given a channel number.
+ * chan_freq = chan_factor * 500Mhz + chan_number * 5
+ */
+
+/**
+ * Channel Factor for the starting frequence of 2.4 GHz channels.
+ * The value corresponds to 2407 MHz.
+ */
+#define WF_CHAN_FACTOR_2_4_G		4814	/* 2.4 GHz band, 2407 MHz */
+
+/**
+ * Channel Factor for the starting frequence of 5 GHz channels.
+ * The value corresponds to 5000 MHz.
+ */
+#define WF_CHAN_FACTOR_5_G		10000	/* 5   GHz band, 5000 MHz */
+
+/**
+ * Channel Factor for the starting frequence of 4.9 GHz channels.
+ * The value corresponds to 4000 MHz.
+ */
+#define WF_CHAN_FACTOR_4_G		8000	/* 4.9 GHz band for Japan */
+
+#define WLC_2G_25MHZ_OFFSET		5	/* 2.4GHz band channel offset */
+
+/**
+ *  No of sub-band vlaue of the specified Mhz chanspec
+ */
+#define WF_NUM_SIDEBANDS_40MHZ   2
+#define WF_NUM_SIDEBANDS_80MHZ   4
+#define WF_NUM_SIDEBANDS_8080MHZ 4
+#define WF_NUM_SIDEBANDS_160MHZ  8
+
+/**
+ * Convert chanspec to ascii string
+ *
+ * @param	chspec		chanspec format
+ * @param	buf		ascii string of chanspec
+ *
+ * @return	pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *		Original chanspec in case of error
+ *
+ * @see		CHANSPEC_STR_LEN
+ */
+extern char * wf_chspec_ntoa_ex(chanspec_t chspec, char *buf);
+
+/**
+ * Convert chanspec to ascii string
+ *
+ * @param	chspec		chanspec format
+ * @param	buf		ascii string of chanspec
+ *
+ * @return	pointer to buf with room for at least CHANSPEC_STR_LEN bytes
+ *		NULL in case of error
+ *
+ * @see		CHANSPEC_STR_LEN
+ */
+extern char * wf_chspec_ntoa(chanspec_t chspec, char *buf);
+
+/**
+ * Convert ascii string to chanspec
+ *
+ * @param	a     pointer to input string
+ *
+ * @return	>= 0 if successful or 0 otherwise
+ */
+extern chanspec_t wf_chspec_aton(const char *a);
+
+/**
+ * Verify the chanspec fields are valid.
+ *
+ * Verify the chanspec is using a legal set field values, i.e. that the chanspec
+ * specified a band, bw, ctl_sb and channel and that the combination could be
+ * legal given some set of circumstances.
+ *
+ * @param	chanspec   input chanspec to verify
+ *
+ * @return TRUE if the chanspec is malformed, FALSE if it looks good.
+ */
+extern bool wf_chspec_malformed(chanspec_t chanspec);
+
+/**
+ * Verify the chanspec specifies a valid channel according to 802.11.
+ *
+ * @param	chanspec   input chanspec to verify
+ *
+ * @return TRUE if the chanspec is a valid 802.11 channel
+ */
+extern bool wf_chspec_valid(chanspec_t chanspec);
+
+/**
+ * Return the primary (control) channel.
+ *
+ * This function returns the channel number of the primary 20MHz channel. For
+ * 20MHz channels this is just the channel number. For 40MHz or wider channels
+ * it is the primary 20MHz channel specified by the chanspec.
+ *
+ * @param	chspec    input chanspec
+ *
+ * @return Returns the channel number of the primary 20MHz channel
+ */
+extern uint8 wf_chspec_ctlchan(chanspec_t chspec);
+
+/**
+ * Return the bandwidth string.
+ *
+ * This function returns the bandwidth string for the passed chanspec.
+ *
+ * @param	chspec    input chanspec
+ *
+ * @return Returns the bandwidth string
+ */
+extern char * wf_chspec_to_bw_str(chanspec_t chspec);
+
+/**
+ * Return the primary (control) chanspec.
+ *
+ * This function returns the chanspec of the primary 20MHz channel. For 20MHz
+ * channels this is just the chanspec. For 40MHz or wider channels it is the
+ * chanspec of the primary 20MHZ channel specified by the chanspec.
+ *
+ * @param	chspec    input chanspec
+ *
+ * @return Returns the chanspec of the primary 20MHz channel
+ */
+extern chanspec_t wf_chspec_ctlchspec(chanspec_t chspec);
+
+/**
+ * Return a channel number corresponding to a frequency.
+ *
+ * This function returns the chanspec for the primary 40MHz of an 80MHz channel.
+ * The control sideband specifies the same 20MHz channel that the 80MHz channel is using
+ * as the primary 20MHz channel.
+ */
+extern chanspec_t wf_chspec_primary40_chspec(chanspec_t chspec);
+
+/*
+ * Return the channel number for a given frequency and base frequency.
+ * The returned channel number is relative to the given base frequency.
+ * If the given base frequency is zero, a base frequency of 5 GHz is assumed for
+ * frequencies from 5 - 6 GHz, and 2.407 GHz is assumed for 2.4 - 2.5 GHz.
+ *
+ * Frequency is specified in MHz.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ *
+ * The returned channel will be in the range [1, 14] in the 2.4 GHz band
+ * and [0, 200] otherwise.
+ * -1 is returned if the start_factor is WF_CHAN_FACTOR_2_4_G and the
+ * frequency is not a 2.4 GHz channel, or if the frequency is not and even
+ * multiple of 5 MHz from the base frequency to the base plus 1 GHz.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ *
+ * @param	freq          frequency in MHz
+ * @param	start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a channel number
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ */
+extern int wf_mhz2channel(uint freq, uint start_factor);
+
+/**
+ * Return the center frequency in MHz of the given channel and base frequency.
+ *
+ * Return the center frequency in MHz of the given channel and base frequency.
+ * The channel number is interpreted relative to the given base frequency.
+ *
+ * The valid channel range is [1, 14] in the 2.4 GHz band and [0, 200] otherwise.
+ * The base frequency is specified as (start_factor * 500 kHz).
+ * Constants WF_CHAN_FACTOR_2_4_G, WF_CHAN_FACTOR_5_G are defined for
+ * 2.4 GHz and 5 GHz bands.
+ * The channel range of [1, 14] is only checked for a start_factor of
+ * WF_CHAN_FACTOR_2_4_G (4814).
+ * Odd start_factors produce channels on .5 MHz boundaries, in which case
+ * the answer is rounded down to an integral MHz.
+ * -1 is returned for an out of range channel.
+ *
+ * Reference 802.11 REVma, section 17.3.8.3, and 802.11B section 18.4.6.2
+ *
+ * @param	channel       input channel number
+ * @param	start_factor  base frequency in 500 kHz units, e.g. 10000 for 5 GHz
+ *
+ * @return Returns a frequency in MHz
+ *
+ * @see  WF_CHAN_FACTOR_2_4_G
+ * @see  WF_CHAN_FACTOR_5_G
+ */
+extern int wf_channel2mhz(uint channel, uint start_factor);
+
+/**
+ * Returns the chanspec 80Mhz channel corresponding to the following input
+ * parameters
+ *
+ *	primary_channel - primary 20Mhz channel
+ *	center_channel   - center frequecny of the 80Mhz channel
+ *
+ * The center_channel can be one of {42, 58, 106, 122, 138, 155}
+ *
+ * returns INVCHANSPEC in case of error
+ */
+extern chanspec_t wf_chspec_80(uint8 center_channel, uint8 primary_channel);
+
+/**
+ * Convert ctl chan and bw to chanspec
+ *
+ * @param	ctl_ch		channel
+ * @param	bw	        bandwidth
+ *
+ * @return	> 0 if successful or 0 otherwise
+ *
+ */
+extern uint16 wf_channel2chspec(uint ctl_ch, uint bw);
+
+extern uint wf_channel2freq(uint channel);
+extern uint wf_freq2channel(uint freq);
+
+/*
+ * Returns the 80+80 MHz chanspec corresponding to the following input parameters
+ *
+ *    primary_20mhz - Primary 20 MHz channel
+ *    chan0_80MHz - center channel number of one frequency segment
+ *    chan1_80MHz - center channel number of the other frequency segment
+ *
+ * Parameters chan0_80MHz and chan1_80MHz are channel numbers in {42, 58, 106, 122, 138, 155}.
+ * The primary channel must be contained in one of the 80MHz channels. This routine
+ * will determine which frequency segment is the primary 80 MHz segment.
+ *
+ * Returns INVCHANSPEC in case of error.
+ *
+ * Refer to IEEE802.11ac section 22.3.14 "Channelization".
+ */
+extern chanspec_t wf_chspec_get8080_chspec(uint8 primary_20mhz,
+	uint8 chan0_80Mhz, uint8 chan1_80Mhz);
+
+/*
+ * Returns the primary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz primary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40 Mhz chanspec
+ */
+extern uint8 wf_chspec_primary80_channel(chanspec_t chanspec);
+
+/*
+ * Returns the secondary 80 Mhz channel for the provided chanspec
+ *
+ *    chanspec - Input chanspec for which the 80MHz secondary channel has to be retrieved
+ *
+ *  returns -1 in case the provided channel is 20/40 Mhz chanspec
+ */
+extern uint8 wf_chspec_secondary80_channel(chanspec_t chanspec);
+
+/*
+ * This function returns the chanspec for the primary 80MHz of an 160MHz or 80+80 channel.
+ */
+extern chanspec_t wf_chspec_primary80_chspec(chanspec_t chspec);
+
+#ifdef WL11AC_80P80
+/*
+ * This function returns the centre chanel for the given chanspec.
+ * In case of 80+80 chanspec it returns the primary 80 Mhz centre channel
+ */
+extern uint8 wf_chspec_channel(chanspec_t chspec);
+#endif
+#endif	/* _bcmwifi_channels_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/bcmwifi_rates.h b/drivers/net/wireless/bcm4336/include/bcmwifi_rates.h
--- a/drivers/net/wireless/bcm4336/include/bcmwifi_rates.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/bcmwifi_rates.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,452 @@
+/*
+ * Indices for 802.11 a/b/g/n/ac 1-3 chain symmetric transmit rates
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmwifi_rates.h 5187 2012-06-29 06:17:50Z $
+ */
+
+#ifndef _bcmwifi_rates_h_
+#define _bcmwifi_rates_h_
+
+#ifdef __cplusplus
+extern "C" {
+#endif /* __cplusplus */
+
+
+#define WL_RATESET_SZ_DSSS		4
+#define WL_RATESET_SZ_OFDM		8
+#define WL_RATESET_SZ_VHT_MCS	10
+
+#if defined(WLPROPRIETARY_11N_RATES)
+#define WL_RATESET_SZ_HT_MCS	WL_RATESET_SZ_VHT_MCS
+#else
+#define WL_RATESET_SZ_HT_MCS	8
+#endif
+
+#define WL_RATESET_SZ_HT_IOCTL	8	/* MAC histogram, compatibility with wl utility */
+
+#define WL_TX_CHAINS_MAX	3
+
+#define WL_RATE_DISABLED		(-128) /* Power value corresponding to unsupported rate */
+
+/* Transmit channel bandwidths */
+typedef enum wl_tx_bw {
+	WL_TX_BW_20,
+	WL_TX_BW_40,
+	WL_TX_BW_80,
+	WL_TX_BW_20IN40,
+	WL_TX_BW_20IN80,
+	WL_TX_BW_40IN80,
+	WL_TX_BW_160,
+	WL_TX_BW_20IN160,
+	WL_TX_BW_40IN160,
+	WL_TX_BW_80IN160,
+	WL_TX_BW_ALL,
+	WL_TX_BW_8080,
+	WL_TX_BW_8080CHAN2,
+	WL_TX_BW_20IN8080,
+	WL_TX_BW_40IN8080,
+	WL_TX_BW_80IN8080
+} wl_tx_bw_t;
+
+
+/*
+ * Transmit modes.
+ * Not all modes are listed here, only those required for disambiguation. e.g. SPEXP is not listed
+ */
+typedef enum wl_tx_mode {
+	WL_TX_MODE_NONE,
+	WL_TX_MODE_STBC,
+	WL_TX_MODE_CDD,
+	WL_TX_MODE_TXBF,
+	WL_NUM_TX_MODES
+} wl_tx_mode_t;
+
+
+/* Number of transmit chains */
+typedef enum wl_tx_chains {
+	WL_TX_CHAINS_1 = 1,
+	WL_TX_CHAINS_2,
+	WL_TX_CHAINS_3
+} wl_tx_chains_t;
+
+
+/* Number of transmit streams */
+typedef enum wl_tx_nss {
+	WL_TX_NSS_1 = 1,
+	WL_TX_NSS_2,
+	WL_TX_NSS_3
+} wl_tx_nss_t;
+
+
+typedef enum clm_rates {
+	/************
+	* 1 chain  *
+	************
+	*/
+
+	/* 1 Stream */
+	WL_RATE_1X1_DSSS_1         = 0,
+	WL_RATE_1X1_DSSS_2         = 1,
+	WL_RATE_1X1_DSSS_5_5       = 2,
+	WL_RATE_1X1_DSSS_11        = 3,
+
+	WL_RATE_1X1_OFDM_6         = 4,
+	WL_RATE_1X1_OFDM_9         = 5,
+	WL_RATE_1X1_OFDM_12        = 6,
+	WL_RATE_1X1_OFDM_18        = 7,
+	WL_RATE_1X1_OFDM_24        = 8,
+	WL_RATE_1X1_OFDM_36        = 9,
+	WL_RATE_1X1_OFDM_48        = 10,
+	WL_RATE_1X1_OFDM_54        = 11,
+
+	WL_RATE_1X1_MCS0           = 12,
+	WL_RATE_1X1_MCS1           = 13,
+	WL_RATE_1X1_MCS2           = 14,
+	WL_RATE_1X1_MCS3           = 15,
+	WL_RATE_1X1_MCS4           = 16,
+	WL_RATE_1X1_MCS5           = 17,
+	WL_RATE_1X1_MCS6           = 18,
+	WL_RATE_1X1_MCS7           = 19,
+
+	WL_RATE_1X1_VHT0SS1        = 12,
+	WL_RATE_1X1_VHT1SS1        = 13,
+	WL_RATE_1X1_VHT2SS1        = 14,
+	WL_RATE_1X1_VHT3SS1        = 15,
+	WL_RATE_1X1_VHT4SS1        = 16,
+	WL_RATE_1X1_VHT5SS1        = 17,
+	WL_RATE_1X1_VHT6SS1        = 18,
+	WL_RATE_1X1_VHT7SS1        = 19,
+	WL_RATE_1X1_VHT8SS1        = 20,
+	WL_RATE_1X1_VHT9SS1        = 21,
+
+
+	/************
+	* 2 chains *
+	************
+	*/
+
+	/* 1 Stream expanded + 1 */
+	WL_RATE_1X2_DSSS_1         = 22,
+	WL_RATE_1X2_DSSS_2         = 23,
+	WL_RATE_1X2_DSSS_5_5       = 24,
+	WL_RATE_1X2_DSSS_11        = 25,
+
+	WL_RATE_1X2_CDD_OFDM_6     = 26,
+	WL_RATE_1X2_CDD_OFDM_9     = 27,
+	WL_RATE_1X2_CDD_OFDM_12    = 28,
+	WL_RATE_1X2_CDD_OFDM_18    = 29,
+	WL_RATE_1X2_CDD_OFDM_24    = 30,
+	WL_RATE_1X2_CDD_OFDM_36    = 31,
+	WL_RATE_1X2_CDD_OFDM_48    = 32,
+	WL_RATE_1X2_CDD_OFDM_54    = 33,
+
+	WL_RATE_1X2_CDD_MCS0       = 34,
+	WL_RATE_1X2_CDD_MCS1       = 35,
+	WL_RATE_1X2_CDD_MCS2       = 36,
+	WL_RATE_1X2_CDD_MCS3       = 37,
+	WL_RATE_1X2_CDD_MCS4       = 38,
+	WL_RATE_1X2_CDD_MCS5       = 39,
+	WL_RATE_1X2_CDD_MCS6       = 40,
+	WL_RATE_1X2_CDD_MCS7       = 41,
+
+	WL_RATE_1X2_VHT0SS1        = 34,
+	WL_RATE_1X2_VHT1SS1        = 35,
+	WL_RATE_1X2_VHT2SS1        = 36,
+	WL_RATE_1X2_VHT3SS1        = 37,
+	WL_RATE_1X2_VHT4SS1        = 38,
+	WL_RATE_1X2_VHT5SS1        = 39,
+	WL_RATE_1X2_VHT6SS1        = 40,
+	WL_RATE_1X2_VHT7SS1        = 41,
+	WL_RATE_1X2_VHT8SS1        = 42,
+	WL_RATE_1X2_VHT9SS1        = 43,
+
+	/* 2 Streams */
+	WL_RATE_2X2_STBC_MCS0      = 44,
+	WL_RATE_2X2_STBC_MCS1      = 45,
+	WL_RATE_2X2_STBC_MCS2      = 46,
+	WL_RATE_2X2_STBC_MCS3      = 47,
+	WL_RATE_2X2_STBC_MCS4      = 48,
+	WL_RATE_2X2_STBC_MCS5      = 49,
+	WL_RATE_2X2_STBC_MCS6      = 50,
+	WL_RATE_2X2_STBC_MCS7      = 51,
+
+	WL_RATE_2X2_STBC_VHT0SS1   = 44,
+	WL_RATE_2X2_STBC_VHT1SS1   = 45,
+	WL_RATE_2X2_STBC_VHT2SS1   = 46,
+	WL_RATE_2X2_STBC_VHT3SS1   = 47,
+	WL_RATE_2X2_STBC_VHT4SS1   = 48,
+	WL_RATE_2X2_STBC_VHT5SS1   = 49,
+	WL_RATE_2X2_STBC_VHT6SS1   = 50,
+	WL_RATE_2X2_STBC_VHT7SS1   = 51,
+	WL_RATE_2X2_STBC_VHT8SS1   = 52,
+	WL_RATE_2X2_STBC_VHT9SS1   = 53,
+
+	WL_RATE_2X2_SDM_MCS8       = 54,
+	WL_RATE_2X2_SDM_MCS9       = 55,
+	WL_RATE_2X2_SDM_MCS10      = 56,
+	WL_RATE_2X2_SDM_MCS11      = 57,
+	WL_RATE_2X2_SDM_MCS12      = 58,
+	WL_RATE_2X2_SDM_MCS13      = 59,
+	WL_RATE_2X2_SDM_MCS14      = 60,
+	WL_RATE_2X2_SDM_MCS15      = 61,
+
+	WL_RATE_2X2_VHT0SS2        = 54,
+	WL_RATE_2X2_VHT1SS2        = 55,
+	WL_RATE_2X2_VHT2SS2        = 56,
+	WL_RATE_2X2_VHT3SS2        = 57,
+	WL_RATE_2X2_VHT4SS2        = 58,
+	WL_RATE_2X2_VHT5SS2        = 59,
+	WL_RATE_2X2_VHT6SS2        = 60,
+	WL_RATE_2X2_VHT7SS2        = 61,
+	WL_RATE_2X2_VHT8SS2        = 62,
+	WL_RATE_2X2_VHT9SS2        = 63,
+
+	/************
+	* 3 chains *
+	************
+	*/
+
+	/* 1 Stream expanded + 2 */
+	WL_RATE_1X3_DSSS_1         = 64,
+	WL_RATE_1X3_DSSS_2         = 65,
+	WL_RATE_1X3_DSSS_5_5       = 66,
+	WL_RATE_1X3_DSSS_11        = 67,
+
+	WL_RATE_1X3_CDD_OFDM_6     = 68,
+	WL_RATE_1X3_CDD_OFDM_9     = 69,
+	WL_RATE_1X3_CDD_OFDM_12    = 70,
+	WL_RATE_1X3_CDD_OFDM_18    = 71,
+	WL_RATE_1X3_CDD_OFDM_24    = 72,
+	WL_RATE_1X3_CDD_OFDM_36    = 73,
+	WL_RATE_1X3_CDD_OFDM_48    = 74,
+	WL_RATE_1X3_CDD_OFDM_54    = 75,
+
+	WL_RATE_1X3_CDD_MCS0       = 76,
+	WL_RATE_1X3_CDD_MCS1       = 77,
+	WL_RATE_1X3_CDD_MCS2       = 78,
+	WL_RATE_1X3_CDD_MCS3       = 79,
+	WL_RATE_1X3_CDD_MCS4       = 80,
+	WL_RATE_1X3_CDD_MCS5       = 81,
+	WL_RATE_1X3_CDD_MCS6       = 82,
+	WL_RATE_1X3_CDD_MCS7       = 83,
+
+	WL_RATE_1X3_VHT0SS1        = 76,
+	WL_RATE_1X3_VHT1SS1        = 77,
+	WL_RATE_1X3_VHT2SS1        = 78,
+	WL_RATE_1X3_VHT3SS1        = 79,
+	WL_RATE_1X3_VHT4SS1        = 80,
+	WL_RATE_1X3_VHT5SS1        = 81,
+	WL_RATE_1X3_VHT6SS1        = 82,
+	WL_RATE_1X3_VHT7SS1        = 83,
+	WL_RATE_1X3_VHT8SS1        = 84,
+	WL_RATE_1X3_VHT9SS1        = 85,
+
+	/* 2 Streams expanded + 1 */
+	WL_RATE_2X3_STBC_MCS0      = 86,
+	WL_RATE_2X3_STBC_MCS1      = 87,
+	WL_RATE_2X3_STBC_MCS2      = 88,
+	WL_RATE_2X3_STBC_MCS3      = 89,
+	WL_RATE_2X3_STBC_MCS4      = 90,
+	WL_RATE_2X3_STBC_MCS5      = 91,
+	WL_RATE_2X3_STBC_MCS6      = 92,
+	WL_RATE_2X3_STBC_MCS7      = 93,
+
+	WL_RATE_2X3_STBC_VHT0SS1   = 86,
+	WL_RATE_2X3_STBC_VHT1SS1   = 87,
+	WL_RATE_2X3_STBC_VHT2SS1   = 88,
+	WL_RATE_2X3_STBC_VHT3SS1   = 89,
+	WL_RATE_2X3_STBC_VHT4SS1   = 90,
+	WL_RATE_2X3_STBC_VHT5SS1   = 91,
+	WL_RATE_2X3_STBC_VHT6SS1   = 92,
+	WL_RATE_2X3_STBC_VHT7SS1   = 93,
+	WL_RATE_2X3_STBC_VHT8SS1   = 94,
+	WL_RATE_2X3_STBC_VHT9SS1   = 95,
+
+	WL_RATE_2X3_SDM_MCS8       = 96,
+	WL_RATE_2X3_SDM_MCS9       = 97,
+	WL_RATE_2X3_SDM_MCS10      = 98,
+	WL_RATE_2X3_SDM_MCS11      = 99,
+	WL_RATE_2X3_SDM_MCS12      = 100,
+	WL_RATE_2X3_SDM_MCS13      = 101,
+	WL_RATE_2X3_SDM_MCS14      = 102,
+	WL_RATE_2X3_SDM_MCS15      = 103,
+
+	WL_RATE_2X3_VHT0SS2        = 96,
+	WL_RATE_2X3_VHT1SS2        = 97,
+	WL_RATE_2X3_VHT2SS2        = 98,
+	WL_RATE_2X3_VHT3SS2        = 99,
+	WL_RATE_2X3_VHT4SS2        = 100,
+	WL_RATE_2X3_VHT5SS2        = 101,
+	WL_RATE_2X3_VHT6SS2        = 102,
+	WL_RATE_2X3_VHT7SS2        = 103,
+	WL_RATE_2X3_VHT8SS2        = 104,
+	WL_RATE_2X3_VHT9SS2        = 105,
+
+	/* 3 Streams */
+	WL_RATE_3X3_SDM_MCS16      = 106,
+	WL_RATE_3X3_SDM_MCS17      = 107,
+	WL_RATE_3X3_SDM_MCS18      = 108,
+	WL_RATE_3X3_SDM_MCS19      = 109,
+	WL_RATE_3X3_SDM_MCS20      = 110,
+	WL_RATE_3X3_SDM_MCS21      = 111,
+	WL_RATE_3X3_SDM_MCS22      = 112,
+	WL_RATE_3X3_SDM_MCS23      = 113,
+
+	WL_RATE_3X3_VHT0SS3        = 106,
+	WL_RATE_3X3_VHT1SS3        = 107,
+	WL_RATE_3X3_VHT2SS3        = 108,
+	WL_RATE_3X3_VHT3SS3        = 109,
+	WL_RATE_3X3_VHT4SS3        = 110,
+	WL_RATE_3X3_VHT5SS3        = 111,
+	WL_RATE_3X3_VHT6SS3        = 112,
+	WL_RATE_3X3_VHT7SS3        = 113,
+	WL_RATE_3X3_VHT8SS3        = 114,
+	WL_RATE_3X3_VHT9SS3        = 115,
+
+
+	/****************************
+	 * TX Beamforming, 2 chains *
+	 ****************************
+	 */
+
+	/* 1 Stream expanded + 1 */
+
+	WL_RATE_1X2_TXBF_OFDM_6    = 116,
+	WL_RATE_1X2_TXBF_OFDM_9    = 117,
+	WL_RATE_1X2_TXBF_OFDM_12   = 118,
+	WL_RATE_1X2_TXBF_OFDM_18   = 119,
+	WL_RATE_1X2_TXBF_OFDM_24   = 120,
+	WL_RATE_1X2_TXBF_OFDM_36   = 121,
+	WL_RATE_1X2_TXBF_OFDM_48   = 122,
+	WL_RATE_1X2_TXBF_OFDM_54   = 123,
+
+	WL_RATE_1X2_TXBF_MCS0      = 124,
+	WL_RATE_1X2_TXBF_MCS1      = 125,
+	WL_RATE_1X2_TXBF_MCS2      = 126,
+	WL_RATE_1X2_TXBF_MCS3      = 127,
+	WL_RATE_1X2_TXBF_MCS4      = 128,
+	WL_RATE_1X2_TXBF_MCS5      = 129,
+	WL_RATE_1X2_TXBF_MCS6      = 130,
+	WL_RATE_1X2_TXBF_MCS7      = 131,
+
+	WL_RATE_1X2_TXBF_VHT0SS1   = 124,
+	WL_RATE_1X2_TXBF_VHT1SS1   = 125,
+	WL_RATE_1X2_TXBF_VHT2SS1   = 126,
+	WL_RATE_1X2_TXBF_VHT3SS1   = 127,
+	WL_RATE_1X2_TXBF_VHT4SS1   = 128,
+	WL_RATE_1X2_TXBF_VHT5SS1   = 129,
+	WL_RATE_1X2_TXBF_VHT6SS1   = 130,
+	WL_RATE_1X2_TXBF_VHT7SS1   = 131,
+	WL_RATE_1X2_TXBF_VHT8SS1   = 132,
+	WL_RATE_1X2_TXBF_VHT9SS1   = 133,
+
+	/* 2 Streams */
+
+	WL_RATE_2X2_TXBF_SDM_MCS8  = 134,
+	WL_RATE_2X2_TXBF_SDM_MCS9  = 135,
+	WL_RATE_2X2_TXBF_SDM_MCS10 = 136,
+	WL_RATE_2X2_TXBF_SDM_MCS11 = 137,
+	WL_RATE_2X2_TXBF_SDM_MCS12 = 138,
+	WL_RATE_2X2_TXBF_SDM_MCS13 = 139,
+	WL_RATE_2X2_TXBF_SDM_MCS14 = 140,
+	WL_RATE_2X2_TXBF_SDM_MCS15 = 141,
+
+	WL_RATE_2X2_TXBF_VHT0SS2   = 134,
+	WL_RATE_2X2_TXBF_VHT1SS2   = 135,
+	WL_RATE_2X2_TXBF_VHT2SS2   = 136,
+	WL_RATE_2X2_TXBF_VHT3SS2   = 137,
+	WL_RATE_2X2_TXBF_VHT4SS2   = 138,
+	WL_RATE_2X2_TXBF_VHT5SS2   = 139,
+	WL_RATE_2X2_TXBF_VHT6SS2   = 140,
+	WL_RATE_2X2_TXBF_VHT7SS2   = 141,
+
+
+	/****************************
+	 * TX Beamforming, 3 chains *
+	 ****************************
+	 */
+
+	/* 1 Stream expanded + 2 */
+
+	WL_RATE_1X3_TXBF_OFDM_6    = 142,
+	WL_RATE_1X3_TXBF_OFDM_9    = 143,
+	WL_RATE_1X3_TXBF_OFDM_12   = 144,
+	WL_RATE_1X3_TXBF_OFDM_18   = 145,
+	WL_RATE_1X3_TXBF_OFDM_24   = 146,
+	WL_RATE_1X3_TXBF_OFDM_36   = 147,
+	WL_RATE_1X3_TXBF_OFDM_48   = 148,
+	WL_RATE_1X3_TXBF_OFDM_54   = 149,
+
+	WL_RATE_1X3_TXBF_MCS0      = 150,
+	WL_RATE_1X3_TXBF_MCS1      = 151,
+	WL_RATE_1X3_TXBF_MCS2      = 152,
+	WL_RATE_1X3_TXBF_MCS3      = 153,
+	WL_RATE_1X3_TXBF_MCS4      = 154,
+	WL_RATE_1X3_TXBF_MCS5      = 155,
+	WL_RATE_1X3_TXBF_MCS6      = 156,
+	WL_RATE_1X3_TXBF_MCS7      = 157,
+
+	WL_RATE_1X3_TXBF_VHT0SS1   = 150,
+	WL_RATE_1X3_TXBF_VHT1SS1   = 151,
+	WL_RATE_1X3_TXBF_VHT2SS1   = 152,
+	WL_RATE_1X3_TXBF_VHT3SS1   = 153,
+	WL_RATE_1X3_TXBF_VHT4SS1   = 154,
+	WL_RATE_1X3_TXBF_VHT5SS1   = 155,
+	WL_RATE_1X3_TXBF_VHT6SS1   = 156,
+	WL_RATE_1X3_TXBF_VHT7SS1   = 157,
+	WL_RATE_1X3_TXBF_VHT8SS1   = 158,
+	WL_RATE_1X3_TXBF_VHT9SS1   = 159,
+
+	/* 2 Streams expanded + 1 */
+
+	WL_RATE_2X3_TXBF_SDM_MCS8  = 160,
+	WL_RATE_2X3_TXBF_SDM_MCS9  = 161,
+	WL_RATE_2X3_TXBF_SDM_MCS10 = 162,
+	WL_RATE_2X3_TXBF_SDM_MCS11 = 163,
+	WL_RATE_2X3_TXBF_SDM_MCS12 = 164,
+	WL_RATE_2X3_TXBF_SDM_MCS13 = 165,
+	WL_RATE_2X3_TXBF_SDM_MCS14 = 166,
+	WL_RATE_2X3_TXBF_SDM_MCS15 = 167,
+
+	WL_RATE_2X3_TXBF_VHT0SS2   = 160,
+	WL_RATE_2X3_TXBF_VHT1SS2   = 161,
+	WL_RATE_2X3_TXBF_VHT2SS2   = 162,
+	WL_RATE_2X3_TXBF_VHT3SS2   = 163,
+	WL_RATE_2X3_TXBF_VHT4SS2   = 164,
+	WL_RATE_2X3_TXBF_VHT5SS2   = 165,
+	WL_RATE_2X3_TXBF_VHT6SS2   = 166,
+	WL_RATE_2X3_TXBF_VHT7SS2   = 167,
+	WL_RATE_2X3_TXBF_VHT8SS2   = 168,
+	WL_RATE_2X3_TXBF_VHT9SS2   = 169,
+
+	/* 3 Streams */
+
+	WL_RATE_3X3_TXBF_SDM_MCS16 = 170,
+	WL_RATE_3X3_TXBF_SDM_MCS17 = 171,
+	WL_RATE_3X3_TXBF_SDM_MCS18 = 172,
+	WL_RATE_3X3_TXBF_SDM_MCS19 = 173,
+	WL_RATE_3X3_TXBF_SDM_MCS20 = 174,
+	WL_RATE_3X3_TXBF_SDM_MCS21 = 175,
+	WL_RATE_3X3_TXBF_SDM_MCS22 = 176,
+	WL_RATE_3X3_TXBF_SDM_MCS23 = 177,
+
+	WL_RATE_3X3_TXBF_VHT0SS3   = 170,
+	WL_RATE_3X3_TXBF_VHT1SS3   = 171,
+	WL_RATE_3X3_TXBF_VHT2SS3   = 172,
+	WL_RATE_3X3_TXBF_VHT3SS3   = 173,
+	WL_RATE_3X3_TXBF_VHT4SS3   = 174,
+	WL_RATE_3X3_TXBF_VHT5SS3   = 175,
+	WL_RATE_3X3_TXBF_VHT6SS3   = 176,
+	WL_RATE_3X3_TXBF_VHT7SS3   = 177
+} clm_rates_t;
+
+/* Number of rate codes */
+#define WL_NUMRATES 178
+
+#ifdef __cplusplus
+}
+#endif /* __cplusplus */
+
+#endif /* _bcmwifi_rates_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/brcm_nl80211.h b/drivers/net/wireless/bcm4336/include/brcm_nl80211.h
--- a/drivers/net/wireless/bcm4336/include/brcm_nl80211.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/brcm_nl80211.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,45 @@
+/*
+ * Definitions for nl80211 vendor command/event access to host driver
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: brcm_nl80211.h 487126 2014-06-24 23:06:12Z $
+ *
+ */
+
+#ifndef _brcm_nl80211_h_
+#define _brcm_nl80211_h_
+
+#define OUI_BRCM  0x001018
+
+enum wl_vendor_subcmd {
+	BRCM_VENDOR_SCMD_UNSPEC,
+	BRCM_VENDOR_SCMD_PRIV_STR
+};
+
+struct bcm_nlmsg_hdr {
+	uint cmd;	/* common ioctl definition */
+	uint len;	/* expected return buffer length */
+	uint offset;	/* user buffer offset */
+	uint set;	/* get or set request optional */
+	uint magic;	/* magic number for verification */
+};
+
+enum bcmnl_attrs {
+	BCM_NLATTR_UNSPEC,
+
+	BCM_NLATTR_LEN,
+	BCM_NLATTR_DATA,
+
+	__BCM_NLATTR_AFTER_LAST,
+	BCM_NLATTR_MAX = __BCM_NLATTR_AFTER_LAST - 1
+};
+
+struct nl_prv_data {
+	int err;			/* return result */
+	void *data;			/* ioctl return buffer pointer */
+	uint len;			/* ioctl return buffer length */
+	struct bcm_nlmsg_hdr *nlioc;	/* bcm_nlmsg_hdr header pointer */
+};
+
+#endif /* _brcm_nl80211_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/circularbuf.h b/drivers/net/wireless/bcm4336/include/circularbuf.h
--- a/drivers/net/wireless/bcm4336/include/circularbuf.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/circularbuf.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,97 @@
+/*
+ * Initialization and support routines for self-booting compressed image.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: circularbuf.h 452258 2014-01-29 19:17:57Z $
+ */
+
+#ifndef __CIRCULARBUF_H_INCLUDED__
+#define __CIRCULARBUF_H_INCLUDED__
+
+#include <osl.h>
+#include <typedefs.h>
+#include <bcmendian.h>
+
+/* Enumerations of return values provided by MsgBuf implementation */
+typedef enum {
+	CIRCULARBUF_FAILURE = -1,
+	CIRCULARBUF_SUCCESS
+} circularbuf_ret_t;
+
+/* Core circularbuf circular buffer structure */
+typedef struct circularbuf_s
+{
+	uint16 depth;	/* Depth of circular buffer */
+	uint16 r_ptr;	/* Read Ptr */
+	uint16 w_ptr;	/* Write Ptr */
+	uint16 e_ptr;	/* End Ptr */
+	uint16 wp_ptr;	/* wp_ptr/pending - scheduled for DMA. But, not yet complete. */
+	uint16 rp_ptr;	/* rp_ptr/pending - scheduled for DMA. But, not yet complete. */
+
+	uint8  *buf_addr;
+	void  *mb_ctx;
+	void  (*mb_ring_bell)(void *ctx);
+} circularbuf_t;
+
+#define CBUF_ERROR_VAL   0x00000001      /* Error level tracing */
+#define CBUF_TRACE_VAL   0x00000002      /* Function level tracing */
+#define CBUF_INFORM_VAL  0x00000004      /* debug level tracing */
+
+extern int cbuf_msg_level;
+
+#define CBUF_ERROR(args)         do {if (cbuf_msg_level & CBUF_ERROR_VAL) printf args;} while (0)
+#define CBUF_TRACE(args)         do {if (cbuf_msg_level & CBUF_TRACE_VAL) printf args;} while (0)
+#define CBUF_INFO(args)          do {if (cbuf_msg_level & CBUF_INFORM_VAL) printf args;} while (0)
+
+#define     CIRCULARBUF_START(x)     ((x)->buf_addr)
+#define     CIRCULARBUF_WRITE_PTR(x) ((x)->w_ptr)
+#define     CIRCULARBUF_READ_PTR(x)  ((x)->r_ptr)
+#define     CIRCULARBUF_END_PTR(x)   ((x)->e_ptr)
+
+#define circularbuf_debug_print(handle)                                 \
+			CBUF_INFO(("%s:%d:\t%p  rp=%4d  r=%4d  wp=%4d  w=%4d  e=%4d\n", \
+					__FUNCTION__, __LINE__,                             \
+					(void *) CIRCULARBUF_START(handle),                 \
+					(int) (handle)->rp_ptr, (int) (handle)->r_ptr,          \
+					(int) (handle)->wp_ptr, (int) (handle)->w_ptr,          \
+					(int) (handle)->e_ptr));
+
+
+/* Callback registered by application/mail-box with the circularbuf implementation.
+ * This will be invoked by the circularbuf implementation when write is complete and
+ * ready for informing the peer
+ */
+typedef void (*mb_ring_t)(void *ctx);
+
+
+/* Public Functions exposed by circularbuf */
+void
+circularbuf_init(circularbuf_t *handle, void *buf_base_addr, uint16 total_buf_len);
+void
+circularbuf_register_cb(circularbuf_t *handle, mb_ring_t mb_ring_func, void *ctx);
+
+/* Write Functions */
+void *
+circularbuf_reserve_for_write(circularbuf_t *handle, uint16 size);
+void
+circularbuf_write_complete(circularbuf_t *handle, uint16 bytes_written);
+
+/* Read Functions */
+void *
+circularbuf_get_read_ptr(circularbuf_t *handle, uint16 *avail_len);
+circularbuf_ret_t
+circularbuf_read_complete(circularbuf_t *handle, uint16 bytes_read);
+
+/*
+ * circularbuf_get_read_ptr() updates rp_ptr by the amount that the consumer
+ * is supposed to read. The consumer may not read the entire amount.
+ * In such a case, circularbuf_revert_rp_ptr() call follows a corresponding
+ * circularbuf_get_read_ptr() call to revert the rp_ptr back to
+ * the point till which data has actually been processed.
+ * It is not valid if it is preceded by multiple get_read_ptr() calls
+ */
+circularbuf_ret_t
+circularbuf_revert_rp_ptr(circularbuf_t *handle, uint16 bytes);
+
+#endif /* __CIRCULARBUF_H_INCLUDED__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/devctrl_if/wlioctl_defs.h b/drivers/net/wireless/bcm4336/include/devctrl_if/wlioctl_defs.h
--- a/drivers/net/wireless/bcm4336/include/devctrl_if/wlioctl_defs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/devctrl_if/wlioctl_defs.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,2103 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wlioctl_defs.h 403826 2013-05-22 16:40:55Z $
+ */
+
+
+#ifndef wlioctl_defs_h
+#define wlioctl_defs_h
+
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+
+
+/* All builds use the new 11ac ratespec/chanspec */
+#undef  D11AC_IOTYPES
+#define D11AC_IOTYPES
+
+/* WL_RSPEC defines for rate information */
+#define WL_RSPEC_RATE_MASK      0x000000FF      /* rate or HT MCS value */
+#define WL_RSPEC_VHT_MCS_MASK   0x0000000F      /* VHT MCS value */
+#define WL_RSPEC_VHT_NSS_MASK   0x000000F0      /* VHT Nss value */
+#define WL_RSPEC_VHT_NSS_SHIFT  4               /* VHT Nss value shift */
+#define WL_RSPEC_TXEXP_MASK     0x00000300
+#define WL_RSPEC_TXEXP_SHIFT    8
+#define WL_RSPEC_BW_MASK        0x00070000      /* bandwidth mask */
+#define WL_RSPEC_BW_SHIFT       16              /* bandwidth shift */
+#define WL_RSPEC_STBC           0x00100000      /* STBC encoding, Nsts = 2 x Nss */
+#define WL_RSPEC_TXBF           0x00200000      /* bit indicates TXBF mode */
+#define WL_RSPEC_LDPC           0x00400000      /* bit indicates adv coding in use */
+#define WL_RSPEC_SGI            0x00800000      /* Short GI mode */
+#define WL_RSPEC_ENCODING_MASK  0x03000000      /* Encoding of Rate/MCS field */
+#define WL_RSPEC_OVERRIDE_RATE  0x40000000      /* bit indicate to override mcs only */
+#define WL_RSPEC_OVERRIDE_MODE  0x80000000      /* bit indicates override both rate & mode */
+
+/* WL_RSPEC_ENCODING field defs */
+#define WL_RSPEC_ENCODE_RATE    0x00000000      /* Legacy rate is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_HT      0x01000000      /* HT MCS is stored in RSPEC_RATE_MASK */
+#define WL_RSPEC_ENCODE_VHT     0x02000000      /* VHT MCS and Nss is stored in RSPEC_RATE_MASK */
+
+/* WL_RSPEC_BW field defs */
+#define WL_RSPEC_BW_UNSPECIFIED 0
+#define WL_RSPEC_BW_20MHZ       0x00010000
+#define WL_RSPEC_BW_40MHZ       0x00020000
+#define WL_RSPEC_BW_80MHZ       0x00030000
+#define WL_RSPEC_BW_160MHZ      0x00040000
+
+/* Legacy defines for the nrate iovar */
+#define OLD_NRATE_MCS_INUSE         0x00000080 /* MSC in use,indicates b0-6 holds an mcs */
+#define OLD_NRATE_RATE_MASK         0x0000007f /* rate/mcs value */
+#define OLD_NRATE_STF_MASK          0x0000ff00 /* stf mode mask: siso, cdd, stbc, sdm */
+#define OLD_NRATE_STF_SHIFT         8          /* stf mode shift */
+#define OLD_NRATE_OVERRIDE          0x80000000 /* bit indicates override both rate & mode */
+#define OLD_NRATE_OVERRIDE_MCS_ONLY 0x40000000 /* bit indicate to override mcs only */
+#define OLD_NRATE_SGI               0x00800000 /* sgi mode */
+#define OLD_NRATE_LDPC_CODING       0x00400000 /* bit indicates adv coding in use */
+
+#define OLD_NRATE_STF_SISO	0		/* stf mode SISO */
+#define OLD_NRATE_STF_CDD	1		/* stf mode CDD */
+#define OLD_NRATE_STF_STBC	2		/* stf mode STBC */
+#define OLD_NRATE_STF_SDM	3		/* stf mode SDM */
+
+#define HIGHEST_SINGLE_STREAM_MCS	7 /* MCS values greater than this enable multiple streams */
+
+#define GET_PRO_PRIETARY_11N_MCS_NSS(mcs) (1 + ((mcs) - 85) / 8)
+
+#define GET_11N_MCS_NSS(mcs) ((mcs) < 32 ? (1 + ((mcs) / 8)) \
+				: ((mcs) == 32 ? 1 : GET_PRO_PRIETARY_11N_MCS_NSS(mcs)))
+
+#define MAX_CCA_CHANNELS 38	/* Max number of 20 Mhz wide channels */
+#define MAX_CCA_SECS	60	/* CCA keeps this many seconds history */
+
+#define IBSS_MED        15	/* Mediom in-bss congestion percentage */
+#define IBSS_HI         25	/* Hi in-bss congestion percentage */
+#define OBSS_MED        12
+#define OBSS_HI         25
+#define INTERFER_MED    5
+#define INTERFER_HI     10
+
+#define  CCA_FLAG_2G_ONLY		0x01	/* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_5G_ONLY		0x02	/* Return a channel from 2.4 Ghz band */
+#define  CCA_FLAG_IGNORE_DURATION	0x04	/* Ignore dwell time for each channel */
+#define  CCA_FLAGS_PREFER_1_6_11	0x10
+#define  CCA_FLAG_IGNORE_INTERFER 	0x20 /* do not exlude channel based on interfer level */
+
+#define CCA_ERRNO_BAND 		1	/* After filtering for band pref, no choices left */
+#define CCA_ERRNO_DURATION	2	/* After filtering for duration, no choices left */
+#define CCA_ERRNO_PREF_CHAN	3	/* After filtering for chan pref, no choices left */
+#define CCA_ERRNO_INTERFER	4	/* After filtering for interference, no choices left */
+#define CCA_ERRNO_TOO_FEW	5	/* Only 1 channel was input */
+
+#define WL_STA_AID(a)		((a) &~ 0xc000)
+
+/* Flags for sta_info_t indicating properties of STA */
+#define WL_STA_BRCM		0x00000001	/* Running a Broadcom driver */
+#define WL_STA_WME		0x00000002	/* WMM association */
+#define WL_STA_NONERP		0x00000004	/* No ERP */
+#define WL_STA_AUTHE		0x00000008	/* Authenticated */
+#define WL_STA_ASSOC		0x00000010	/* Associated */
+#define WL_STA_AUTHO		0x00000020	/* Authorized */
+#define WL_STA_WDS		0x00000040	/* Wireless Distribution System */
+#define WL_STA_WDS_LINKUP	0x00000080	/* WDS traffic/probes flowing properly */
+#define WL_STA_PS		0x00000100	/* STA is in power save mode from AP's viewpoint */
+#define WL_STA_APSD_BE		0x00000200	/* APSD delv/trigger for AC_BE is default enabled */
+#define WL_STA_APSD_BK		0x00000400	/* APSD delv/trigger for AC_BK is default enabled */
+#define WL_STA_APSD_VI		0x00000800	/* APSD delv/trigger for AC_VI is default enabled */
+#define WL_STA_APSD_VO		0x00001000	/* APSD delv/trigger for AC_VO is default enabled */
+#define WL_STA_N_CAP		0x00002000	/* STA 802.11n capable */
+#define WL_STA_SCBSTATS		0x00004000	/* Per STA debug stats */
+#define WL_STA_AMPDU_CAP	0x00008000	/* STA AMPDU capable */
+#define WL_STA_AMSDU_CAP	0x00010000	/* STA AMSDU capable */
+#define WL_STA_MIMO_PS		0x00020000	/* mimo ps mode is enabled */
+#define WL_STA_MIMO_RTS		0x00040000	/* send rts in mimo ps mode */
+#define WL_STA_RIFS_CAP		0x00080000	/* rifs enabled */
+#define WL_STA_VHT_CAP		0x00100000	/* STA VHT(11ac) capable */
+#define WL_STA_WPS		0x00200000	/* WPS state */
+
+#define WL_WDS_LINKUP		WL_STA_WDS_LINKUP	/* deprecated */
+
+/* STA HT cap fields */
+#define WL_STA_CAP_LDPC_CODING		0x0001	/* Support for rx of LDPC coded pkts */
+#define WL_STA_CAP_40MHZ		0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define WL_STA_CAP_MIMO_PS_MASK		0x000C  /* Mimo PS mask */
+#define WL_STA_CAP_MIMO_PS_SHIFT	0x0002	/* Mimo PS shift */
+#define WL_STA_CAP_MIMO_PS_OFF		0x0003	/* Mimo PS, no restriction */
+#define WL_STA_CAP_MIMO_PS_RTS		0x0001	/* Mimo PS, send RTS/CTS around MIMO frames */
+#define WL_STA_CAP_MIMO_PS_ON		0x0000	/* Mimo PS, MIMO disallowed */
+#define WL_STA_CAP_GF			0x0010	/* Greenfield preamble support */
+#define WL_STA_CAP_SHORT_GI_20		0x0020	/* 20MHZ short guard interval support */
+#define WL_STA_CAP_SHORT_GI_40		0x0040	/* 40Mhz short guard interval support */
+#define WL_STA_CAP_TX_STBC		0x0080	/* Tx STBC support */
+#define WL_STA_CAP_RX_STBC_MASK		0x0300	/* Rx STBC mask */
+#define WL_STA_CAP_RX_STBC_SHIFT	8	/* Rx STBC shift */
+#define WL_STA_CAP_DELAYED_BA		0x0400	/* delayed BA support */
+#define WL_STA_CAP_MAX_AMSDU		0x0800	/* Max AMSDU size in bytes , 0=3839, 1=7935 */
+#define WL_STA_CAP_DSSS_CCK		0x1000	/* DSSS/CCK supported by the BSS */
+#define WL_STA_CAP_PSMP			0x2000	/* Power Save Multi Poll support */
+#define WL_STA_CAP_40MHZ_INTOLERANT	0x4000	/* 40MHz Intolerant */
+#define WL_STA_CAP_LSIG_TXOP		0x8000	/* L-SIG TXOP protection support */
+
+#define WL_STA_CAP_RX_STBC_NO		0x0	/* no rx STBC support */
+#define WL_STA_CAP_RX_STBC_ONE_STREAM	0x1	/* rx STBC support of 1 spatial stream */
+#define WL_STA_CAP_RX_STBC_TWO_STREAM	0x2	/* rx STBC support of 1-2 spatial streams */
+#define WL_STA_CAP_RX_STBC_THREE_STREAM	0x3	/* rx STBC support of 1-3 spatial streams */
+
+/* scb vht flags */
+#define WL_STA_VHT_LDPCCAP	0x0001
+#define WL_STA_SGI80		0x0002
+#define WL_STA_SGI160		0x0004
+#define WL_STA_VHT_TX_STBCCAP	0x0008
+#define WL_STA_VHT_RX_STBCCAP	0x0010
+#define WL_STA_SU_BEAMFORMER	0x0020
+#define WL_STA_SU_BEAMFORMEE	0x0040
+#define WL_STA_MU_BEAMFORMER	0x0080
+#define WL_STA_MU_BEAMFORMEE	0x0100
+#define WL_STA_VHT_TXOP_PS	0x0200
+#define WL_STA_HTC_VHT_CAP	0x0400
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+#define WL_IOCTL_ACTION_GET				0x0
+#define WL_IOCTL_ACTION_SET				0x1
+#define WL_IOCTL_ACTION_OVL_IDX_MASK	0x1e
+#define WL_IOCTL_ACTION_OVL_RSV			0x20
+#define WL_IOCTL_ACTION_OVL				0x40
+#define WL_IOCTL_ACTION_MASK			0x7e
+#define WL_IOCTL_ACTION_OVL_SHIFT		1
+
+#define WL_BSSTYPE_INFRA 1
+#define WL_BSSTYPE_INDEP 0
+#define WL_BSSTYPE_ANY   2
+
+/* Bitmask for scan_type */
+#define WL_SCANFLAGS_PASSIVE	0x01	/* force passive scan */
+#define WL_SCANFLAGS_RESERVED	0x02	/* Reserved */
+#define WL_SCANFLAGS_PROHIBITED	0x04	/* allow scanning prohibited channels */
+#define WL_SCANFLAGS_OFFCHAN	0x08	/* allow scanning/reporting off-channel APs */
+#define WL_SCANFLAGS_HOTSPOT	0x10	/* automatic ANQP to hotspot APs */
+#define WL_SCANFLAGS_SWTCHAN	0x20	/* Force channel switch for differerent bandwidth */
+
+/* wl_iscan_results status values */
+#define WL_SCAN_RESULTS_SUCCESS	0
+#define WL_SCAN_RESULTS_PARTIAL	1
+#define WL_SCAN_RESULTS_PENDING	2
+#define WL_SCAN_RESULTS_ABORTED	3
+#define WL_SCAN_RESULTS_NO_MEM  4
+
+#define SCANOL_ENABLED			(1 << 0)
+#define SCANOL_BCAST_SSID		(1 << 1)
+#define SCANOL_NOTIFY_BCAST_SSID	(1 << 2)
+#define SCANOL_RESULTS_PER_CYCLE	(1 << 3)
+
+/* scan times in milliseconds */
+#define SCANOL_HOME_TIME		45	/* for home channel processing */
+#define SCANOL_ASSOC_TIME		20	/* dwell on a channel while associated */
+#define SCANOL_UNASSOC_TIME		40	/* dwell on a channel while unassociated */
+#define SCANOL_PASSIVE_TIME		110	/* listen on a channelfor passive scan */
+#define SCANOL_AWAY_LIMIT		100	/* max time to be away from home channel */
+#define SCANOL_IDLE_REST_TIME		40
+#define SCANOL_IDLE_REST_MULTIPLIER	0
+#define SCANOL_ACTIVE_REST_TIME		20
+#define SCANOL_ACTIVE_REST_MULTIPLIER	0
+#define SCANOL_CYCLE_IDLE_REST_TIME	300000	/* Idle Rest Time between Scan Cycle (msec) */
+#define SCANOL_CYCLE_IDLE_REST_MULTIPLIER	0	/* Idle Rest Time Multiplier */
+#define SCANOL_CYCLE_ACTIVE_REST_TIME	200
+#define SCANOL_CYCLE_ACTIVE_REST_MULTIPLIER	0
+#define SCANOL_MAX_REST_TIME		3600000	/* max rest time between scan cycle (msec) */
+#define SCANOL_CYCLE_DEFAULT		0	/* default for Max Scan Cycle, 0 = forever */
+#define SCANOL_CYCLE_MAX		864000	/* Max Scan Cycle */
+						/* 10 sec/scan cycle => 100 days */
+#define SCANOL_NPROBES			2	/* for Active scan; send n probes on each channel */
+#define SCANOL_NPROBES_MAX		5	/* for Active scan; send n probes on each channel */
+#define SCANOL_SCAN_START_DLY		10	/* delay start of offload scan (sec) */
+#define SCANOL_SCAN_START_DLY_MAX	240	/* delay start of offload scan (sec) */
+#define SCANOL_MULTIPLIER_MAX		10	/* Max Multiplier */
+#define SCANOL_UNASSOC_TIME_MAX		100	/* max dwell on a channel while unassociated */
+#define SCANOL_PASSIVE_TIME_MAX		500	/* max listen on a channel for passive scan */
+#define SCANOL_SSID_MAX			16	/* max supported preferred SSID */
+
+/* masks for channel and ssid count */
+#define WL_SCAN_PARAMS_COUNT_MASK 0x0000ffff
+#define WL_SCAN_PARAMS_NSSID_SHIFT 16
+
+#define WL_SCAN_ACTION_START      1
+#define WL_SCAN_ACTION_CONTINUE   2
+#define WL_SCAN_ACTION_ABORT      3
+
+
+#define ANTENNA_NUM_1	1		/* total number of antennas to be used */
+#define ANTENNA_NUM_2	2
+#define ANTENNA_NUM_3	3
+#define ANTENNA_NUM_4	4
+
+#define ANT_SELCFG_AUTO		0x80	/* bit indicates antenna sel AUTO */
+#define ANT_SELCFG_MASK		0x33	/* antenna configuration mask */
+#define ANT_SELCFG_TX_UNICAST	0	/* unicast tx antenna configuration */
+#define ANT_SELCFG_RX_UNICAST	1	/* unicast rx antenna configuration */
+#define ANT_SELCFG_TX_DEF	2	/* default tx antenna configuration */
+#define ANT_SELCFG_RX_DEF	3	/* default rx antenna configuration */
+
+/* interference source detection and identification mode */
+#define ITFR_MODE_DISABLE	0	/* disable feature */
+#define ITFR_MODE_MANUAL_ENABLE	1	/* enable manual detection */
+#define ITFR_MODE_AUTO_ENABLE	2	/* enable auto detection */
+
+/* bit definitions for flags in interference source report */
+#define ITFR_INTERFERENCED	1	/* interference detected */
+#define ITFR_HOME_CHANNEL	2	/* home channel has interference */
+#define ITFR_NOISY_ENVIRONMENT	4	/* noisy environemnt so feature stopped */
+
+#define WL_NUM_RPI_BINS		8
+#define WL_RM_TYPE_BASIC	1
+#define WL_RM_TYPE_CCA		2
+#define WL_RM_TYPE_RPI		3
+#define WL_RM_TYPE_ABORT	-1	/* ABORT any in-progress RM request */
+
+#define WL_RM_FLAG_PARALLEL	(1<<0)
+
+#define WL_RM_FLAG_LATE		(1<<1)
+#define WL_RM_FLAG_INCAPABLE	(1<<2)
+#define WL_RM_FLAG_REFUSED	(1<<3)
+
+/* flags */
+#define WLC_ASSOC_REQ_IS_REASSOC 0x01 /* assoc req was actually a reassoc */
+
+#define WLC_CIS_DEFAULT	0	/* built-in default */
+#define WLC_CIS_SROM	1	/* source is sprom */
+#define WLC_CIS_OTP	2	/* source is otp */
+
+/* PCL - Power Control Loop */
+/* current gain setting is replaced by user input */
+#define WL_ATTEN_APP_INPUT_PCL_OFF	0	/* turn off PCL, apply supplied input */
+#define WL_ATTEN_PCL_ON			1	/* turn on PCL */
+/* current gain setting is maintained */
+#define WL_ATTEN_PCL_OFF		2	/* turn off PCL. */
+
+#define	PLC_CMD_FAILOVER	1
+#define	PLC_CMD_MAC_COST	2
+#define	PLC_CMD_LINK_COST	3
+#define	PLC_CMD_NODE_LIST	4
+
+#define NODE_TYPE_UNKNOWN	0	/* Unknown link */
+#define NODE_TYPE_WIFI_ONLY	1	/* Pure Wireless STA node */
+#define NODE_TYPE_PLC_ONLY	2	/* Pure PLC only node */
+#define NODE_TYPE_WIFI_PLC	3	/* WiFi PLC capable node */
+
+/* defines used by poweridx iovar - it controls power in a-band */
+/* current gain setting is maintained */
+#define WL_PWRIDX_PCL_OFF	-2	/* turn off PCL.  */
+#define WL_PWRIDX_PCL_ON	-1	/* turn on PCL */
+#define WL_PWRIDX_LOWER_LIMIT	-2	/* lower limit */
+#define WL_PWRIDX_UPPER_LIMIT	63	/* upper limit */
+/* value >= 0 causes
+ *	- input to be set to that value
+ *	- PCL to be off
+ */
+
+#define BCM_MAC_STATUS_INDICATION	(0x40010200L)
+
+/* Values for TX Filter override mode */
+#define WLC_TXFILTER_OVERRIDE_DISABLED  0
+#define WLC_TXFILTER_OVERRIDE_ENABLED   1
+
+/* magic pattern used for mismatch driver and wl */
+#define WL_TXFIFO_SZ_MAGIC	0xa5a5
+
+/* check this magic number */
+#define WLC_IOCTL_MAGIC		0x14e46c77
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* bss_info_cap_t flags */
+#define WL_BSS_FLAGS_FROM_BEACON	0x01	/* bss_info derived from beacon */
+#define WL_BSS_FLAGS_FROM_CACHE		0x02	/* bss_info collected from cache */
+#define WL_BSS_FLAGS_RSSI_ONCHANNEL	0x04	/* rssi info received on channel (vs offchannel) */
+#define WL_BSS_FLAGS_HS20		0x08	/* hotspot 2.0 capable */
+#define WL_BSS_FLAGS_RSSI_INVALID	0x10	/* BSS contains invalid RSSI */
+#define WL_BSS_FLAGS_RSSI_INACCURATE	0x20	/* BSS contains inaccurate RSSI */
+#define WL_BSS_FLAGS_SNR_INVALID	0x40	/* BSS contains invalid SNR */
+#define WL_BSS_FLAGS_NF_INVALID		0x80	/* BSS contains invalid noise floor */
+
+/* bssinfo flag for nbss_cap */
+#define VHT_BI_SGI_80MHZ			0x00000100
+#define VHT_BI_80MHZ			    0x00000200
+#define VHT_BI_160MHZ			    0x00000400
+#define VHT_BI_8080MHZ			    0x00000800
+
+/* reference to wl_ioctl_t struct used by usermode driver */
+#define ioctl_subtype	set		/* subtype param */
+#define ioctl_pid	used		/* pid param */
+#define ioctl_status	needed		/* status param */
+
+
+/* Enumerate crypto algorithms */
+#define	CRYPTO_ALGO_OFF			0
+#define	CRYPTO_ALGO_WEP1		1
+#define	CRYPTO_ALGO_TKIP		2
+#define	CRYPTO_ALGO_WEP128		3
+#define CRYPTO_ALGO_AES_CCM		4
+#define CRYPTO_ALGO_AES_OCB_MSDU	5
+#define CRYPTO_ALGO_AES_OCB_MPDU	6
+#if !defined(BCMCCX) && !defined(BCMEXTCCX)
+#define CRYPTO_ALGO_NALG		7
+#else
+#define CRYPTO_ALGO_CKIP		7
+#define CRYPTO_ALGO_CKIP_MMH	8
+#define CRYPTO_ALGO_WEP_MMH		9
+#define CRYPTO_ALGO_NALG		10
+#endif /* !BCMCCX && !BCMEXTCCX */
+
+#define CRYPTO_ALGO_SMS4		11
+#define CRYPTO_ALGO_PMK			12	/* for 802.1x supp to set PMK before 4-way */
+#define CRYPTO_ALGO_BIP			13  /* 802.11w BIP (aes cmac) */
+
+#define CRYPTO_ALGO_AES_GCM     14  /* 128 bit GCM */
+#define CRYPTO_ALGO_AES_CCM256  15  /* 256 bit CCM */
+#define CRYPTO_ALGO_AES_GCM256  16  /* 256 bit GCM */
+#define CRYPTO_ALGO_BIP_CMAC256 17  /* 256 bit BIP CMAC */
+#define CRYPTO_ALGO_BIP_GMAC    18  /* 128 bit BIP GMAC */
+#define CRYPTO_ALGO_BIP_GMAC256 19  /* 256 bit BIP GMAC */
+
+#define CRYPTO_ALGO_NONE        CRYPTO_ALGO_OFF
+
+#define WSEC_GEN_MIC_ERROR	0x0001
+#define WSEC_GEN_REPLAY		0x0002
+#define WSEC_GEN_ICV_ERROR	0x0004
+#define WSEC_GEN_MFP_ACT_ERROR	0x0008
+#define WSEC_GEN_MFP_DISASSOC_ERROR	0x0010
+#define WSEC_GEN_MFP_DEAUTH_ERROR	0x0020
+
+#define WL_SOFT_KEY	(1 << 0)	/* Indicates this key is using soft encrypt */
+#define WL_PRIMARY_KEY	(1 << 1)	/* Indicates this key is the primary (ie tx) key */
+#if defined(BCMCCX) || defined(BCMEXTCCX)
+#define WL_CKIP_KP	(1 << 4)	/* CMIC */
+#define WL_CKIP_MMH	(1 << 5)	/* CKIP */
+#else
+#define WL_KF_RES_4	(1 << 4)	/* Reserved for backward compat */
+#define WL_KF_RES_5	(1 << 5)	/* Reserved for backward compat */
+#endif /* BCMCCX || BCMEXTCCX */
+#define WL_IBSS_PEER_GROUP_KEY	(1 << 6)	/* Indicates a group key for a IBSS PEER */
+
+/* wireless security bitvec */
+#define WEP_ENABLED		0x0001
+#define TKIP_ENABLED		0x0002
+#define AES_ENABLED		0x0004
+#define WSEC_SWFLAG		0x0008
+#ifdef BCMCCX
+#define CKIP_KP_ENABLED		0x0010
+#define CKIP_MIC_ENABLED	0x0020
+#endif /* BCMCCX */
+#define SES_OW_ENABLED		0x0040	/* to go into transition mode without setting wep */
+#ifdef BCMWAPI_WPI
+#define SMS4_ENABLED		0x0100
+#endif /* BCMWAPI_WPI */
+
+/* wsec macros for operating on the above definitions */
+#define WSEC_WEP_ENABLED(wsec)	((wsec) & WEP_ENABLED)
+#define WSEC_TKIP_ENABLED(wsec)	((wsec) & TKIP_ENABLED)
+#define WSEC_AES_ENABLED(wsec)	((wsec) & AES_ENABLED)
+
+#ifdef BCMCCX
+#define WSEC_CKIP_KP_ENABLED(wsec)	((wsec) & CKIP_KP_ENABLED)
+#define WSEC_CKIP_MIC_ENABLED(wsec)	((wsec) & CKIP_MIC_ENABLED)
+#define WSEC_CKIP_ENABLED(wsec)	((wsec) & (CKIP_KP_ENABLED|CKIP_MIC_ENABLED))
+
+#ifdef BCMWAPI_WPI
+#define WSEC_ENABLED(wsec) \
+	((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | CKIP_KP_ENABLED |	\
+	  CKIP_MIC_ENABLED | SMS4_ENABLED))
+#else /* BCMWAPI_WPI */
+#define WSEC_ENABLED(wsec) \
+		((wsec) & \
+		 (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | CKIP_KP_ENABLED | CKIP_MIC_ENABLED))
+#endif /* BCMWAPI_WPI */
+#else /* defined BCMCCX */
+#ifdef BCMWAPI_WPI
+#define WSEC_ENABLED(wsec)	((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | SMS4_ENABLED))
+#else /* BCMWAPI_WPI */
+#define WSEC_ENABLED(wsec)	((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+#endif /* BCMWAPI_WPI */
+#endif /* BCMCCX */
+#define WSEC_SES_OW_ENABLED(wsec)	((wsec) & SES_OW_ENABLED)
+#ifdef BCMWAPI_WAI
+#define WSEC_SMS4_ENABLED(wsec)	((wsec) & SMS4_ENABLED)
+#endif /* BCMWAPI_WAI */
+
+#define MFP_CAPABLE		0x0200
+#define MFP_REQUIRED	0x0400
+#define MFP_SHA256		0x0800 /* a special configuration for STA for WIFI test tool */
+
+/* WPA authentication mode bitvec */
+#define WPA_AUTH_DISABLED	0x0000	/* Legacy (i.e., non-WPA) */
+#define WPA_AUTH_NONE		0x0001	/* none (IBSS) */
+#define WPA_AUTH_UNSPECIFIED	0x0002	/* over 802.1x */
+#define WPA_AUTH_PSK		0x0004	/* Pre-shared key */
+#if defined(BCMCCX) || defined(BCMEXTCCX)
+#define WPA_AUTH_CCKM		0x0008	/* CCKM */
+#define WPA2_AUTH_CCKM		0x0010	/* CCKM2 */
+#endif	/* BCMCCX || BCMEXTCCX */
+/* #define WPA_AUTH_8021X 0x0020 */	/* 802.1x, reserved */
+#define WPA2_AUTH_UNSPECIFIED	0x0040	/* over 802.1x */
+#define WPA2_AUTH_PSK		0x0080	/* Pre-shared key */
+#define BRCM_AUTH_PSK           0x0100  /* BRCM specific PSK */
+#define BRCM_AUTH_DPT		0x0200	/* DPT PSK without group keys */
+#if defined(BCMWAPI_WAI) || defined(BCMWAPI_WPI)
+#define WPA_AUTH_WAPI           0x0400
+#define WAPI_AUTH_NONE		WPA_AUTH_NONE	/* none (IBSS) */
+#define WAPI_AUTH_UNSPECIFIED	0x0400	/* over AS */
+#define WAPI_AUTH_PSK		0x0800	/* Pre-shared key */
+#endif /* BCMWAPI_WAI || BCMWAPI_WPI */
+#define WPA2_AUTH_MFP           0x1000  /* MFP (11w) in contrast to CCX */
+#define WPA2_AUTH_TPK		0x2000 	/* TDLS Peer Key */
+#define WPA2_AUTH_FT		0x4000 	/* Fast Transition. */
+#define WPA_AUTH_PFN_ANY	0xffffffff	/* for PFN, match only ssid */
+
+/* pmkid */
+#define	MAXPMKID		16
+
+#ifdef SROM12
+#define	WLC_IOCTL_MAXLEN		10000	/* max length ioctl buffer required */
+#else
+#define	WLC_IOCTL_MAXLEN		8192	/* max length ioctl buffer required */
+#endif /* SROM12 */
+
+#define	WLC_IOCTL_SMLEN			256	/* "small" length ioctl buffer required */
+#define WLC_IOCTL_MEDLEN		1536    /* "med" length ioctl buffer required */
+#if defined(LCNCONF) || defined(LCN40CONF)
+#define WLC_SAMPLECOLLECT_MAXLEN	1024	/* Max Sample Collect buffer */
+#else
+#define WLC_SAMPLECOLLECT_MAXLEN	10240	/* Max Sample Collect buffer for two cores */
+#endif
+#define WLC_SAMPLECOLLECT_MAXLEN_LCN40  8192
+
+/* common ioctl definitions */
+#define WLC_GET_MAGIC				0
+#define WLC_GET_VERSION				1
+#define WLC_UP					2
+#define WLC_DOWN				3
+#define WLC_GET_LOOP				4
+#define WLC_SET_LOOP				5
+#define WLC_DUMP				6
+#define WLC_GET_MSGLEVEL			7
+#define WLC_SET_MSGLEVEL			8
+#define WLC_GET_PROMISC				9
+#define WLC_SET_PROMISC				10
+/* #define WLC_OVERLAY_IOCTL			11 */ /* not supported */
+#define WLC_GET_RATE				12
+#define WLC_GET_MAX_RATE			13
+#define WLC_GET_INSTANCE			14
+/* #define WLC_GET_FRAG				15 */ /* no longer supported */
+/* #define WLC_SET_FRAG				16 */ /* no longer supported */
+/* #define WLC_GET_RTS				17 */ /* no longer supported */
+/* #define WLC_SET_RTS				18 */ /* no longer supported */
+#define WLC_GET_INFRA				19
+#define WLC_SET_INFRA				20
+#define WLC_GET_AUTH				21
+#define WLC_SET_AUTH				22
+#define WLC_GET_BSSID				23
+#define WLC_SET_BSSID				24
+#define WLC_GET_SSID				25
+#define WLC_SET_SSID				26
+#define WLC_RESTART				27
+#define WLC_TERMINATED				28
+/* #define WLC_DUMP_SCB				28 */ /* no longer supported */
+#define WLC_GET_CHANNEL				29
+#define WLC_SET_CHANNEL				30
+#define WLC_GET_SRL				31
+#define WLC_SET_SRL				32
+#define WLC_GET_LRL				33
+#define WLC_SET_LRL				34
+#define WLC_GET_PLCPHDR				35
+#define WLC_SET_PLCPHDR				36
+#define WLC_GET_RADIO				37
+#define WLC_SET_RADIO				38
+#define WLC_GET_PHYTYPE				39
+#define WLC_DUMP_RATE				40
+#define WLC_SET_RATE_PARAMS			41
+#define WLC_GET_FIXRATE				42
+#define WLC_SET_FIXRATE				43
+/* #define WLC_GET_WEP				42 */ /* no longer supported */
+/* #define WLC_SET_WEP				43 */ /* no longer supported */
+#define WLC_GET_KEY				44
+#define WLC_SET_KEY				45
+#define WLC_GET_REGULATORY			46
+#define WLC_SET_REGULATORY			47
+#define WLC_GET_PASSIVE_SCAN			48
+#define WLC_SET_PASSIVE_SCAN			49
+#define WLC_SCAN				50
+#define WLC_SCAN_RESULTS			51
+#define WLC_DISASSOC				52
+#define WLC_REASSOC				53
+#define WLC_GET_ROAM_TRIGGER			54
+#define WLC_SET_ROAM_TRIGGER			55
+#define WLC_GET_ROAM_DELTA			56
+#define WLC_SET_ROAM_DELTA			57
+#define WLC_GET_ROAM_SCAN_PERIOD		58
+#define WLC_SET_ROAM_SCAN_PERIOD		59
+#define WLC_EVM					60	/* diag */
+#define WLC_GET_TXANT				61
+#define WLC_SET_TXANT				62
+#define WLC_GET_ANTDIV				63
+#define WLC_SET_ANTDIV				64
+/* #define WLC_GET_TXPWR			65 */ /* no longer supported */
+/* #define WLC_SET_TXPWR			66 */ /* no longer supported */
+#define WLC_GET_CLOSED				67
+#define WLC_SET_CLOSED				68
+#define WLC_GET_MACLIST				69
+#define WLC_SET_MACLIST				70
+#define WLC_GET_RATESET				71
+#define WLC_SET_RATESET				72
+/* #define WLC_GET_LOCALE			73 */ /* no longer supported */
+#define WLC_LONGTRAIN				74
+#define WLC_GET_BCNPRD				75
+#define WLC_SET_BCNPRD				76
+#define WLC_GET_DTIMPRD				77
+#define WLC_SET_DTIMPRD				78
+#define WLC_GET_SROM				79
+#define WLC_SET_SROM				80
+#define WLC_GET_WEP_RESTRICT			81
+#define WLC_SET_WEP_RESTRICT			82
+#define WLC_GET_COUNTRY				83
+#define WLC_SET_COUNTRY				84
+#define WLC_GET_PM				85
+#define WLC_SET_PM				86
+#define WLC_GET_WAKE				87
+#define WLC_SET_WAKE				88
+/* #define WLC_GET_D11CNTS			89 */ /* -> "counters" iovar */
+#define WLC_GET_FORCELINK			90	/* ndis only */
+#define WLC_SET_FORCELINK			91	/* ndis only */
+#define WLC_FREQ_ACCURACY			92	/* diag */
+#define WLC_CARRIER_SUPPRESS			93	/* diag */
+#define WLC_GET_PHYREG				94
+#define WLC_SET_PHYREG				95
+#define WLC_GET_RADIOREG			96
+#define WLC_SET_RADIOREG			97
+#define WLC_GET_REVINFO				98
+#define WLC_GET_UCANTDIV			99
+#define WLC_SET_UCANTDIV			100
+#define WLC_R_REG				101
+#define WLC_W_REG				102
+/* #define WLC_DIAG_LOOPBACK			103	old tray diag */
+/* #define WLC_RESET_D11CNTS			104 */ /* -> "reset_d11cnts" iovar */
+#define WLC_GET_MACMODE				105
+#define WLC_SET_MACMODE				106
+#define WLC_GET_MONITOR				107
+#define WLC_SET_MONITOR				108
+#define WLC_GET_GMODE				109
+#define WLC_SET_GMODE				110
+#define WLC_GET_LEGACY_ERP			111
+#define WLC_SET_LEGACY_ERP			112
+#define WLC_GET_RX_ANT				113
+#define WLC_GET_CURR_RATESET			114	/* current rateset */
+#define WLC_GET_SCANSUPPRESS			115
+#define WLC_SET_SCANSUPPRESS			116
+#define WLC_GET_AP				117
+#define WLC_SET_AP				118
+#define WLC_GET_EAP_RESTRICT			119
+#define WLC_SET_EAP_RESTRICT			120
+#define WLC_SCB_AUTHORIZE			121
+#define WLC_SCB_DEAUTHORIZE			122
+#define WLC_GET_WDSLIST				123
+#define WLC_SET_WDSLIST				124
+#define WLC_GET_ATIM				125
+#define WLC_SET_ATIM				126
+#define WLC_GET_RSSI				127
+#define WLC_GET_PHYANTDIV			128
+#define WLC_SET_PHYANTDIV			129
+#define WLC_AP_RX_ONLY				130
+#define WLC_GET_TX_PATH_PWR			131
+#define WLC_SET_TX_PATH_PWR			132
+#define WLC_GET_WSEC				133
+#define WLC_SET_WSEC				134
+#define WLC_GET_PHY_NOISE			135
+#define WLC_GET_BSS_INFO			136
+#define WLC_GET_PKTCNTS				137
+#define WLC_GET_LAZYWDS				138
+#define WLC_SET_LAZYWDS				139
+#define WLC_GET_BANDLIST			140
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_GET_BAND				141
+#define WLC_SET_BAND				142
+#define WLC_SCB_DEAUTHENTICATE			143
+#define WLC_GET_SHORTSLOT			144
+#define WLC_GET_SHORTSLOT_OVERRIDE		145
+#define WLC_SET_SHORTSLOT_OVERRIDE		146
+#define WLC_GET_SHORTSLOT_RESTRICT		147
+#define WLC_SET_SHORTSLOT_RESTRICT		148
+#define WLC_GET_GMODE_PROTECTION		149
+#define WLC_GET_GMODE_PROTECTION_OVERRIDE	150
+#define WLC_SET_GMODE_PROTECTION_OVERRIDE	151
+#define WLC_UPGRADE				152
+/* #define WLC_GET_MRATE			153 */ /* no longer supported */
+/* #define WLC_SET_MRATE			154 */ /* no longer supported */
+#define WLC_GET_IGNORE_BCNS			155
+#define WLC_SET_IGNORE_BCNS			156
+#define WLC_GET_SCB_TIMEOUT			157
+#define WLC_SET_SCB_TIMEOUT			158
+#define WLC_GET_ASSOCLIST			159
+#define WLC_GET_CLK				160
+#define WLC_SET_CLK				161
+#define WLC_GET_UP				162
+#define WLC_OUT					163
+#define WLC_GET_WPA_AUTH			164
+#define WLC_SET_WPA_AUTH			165
+#define WLC_GET_UCFLAGS				166
+#define WLC_SET_UCFLAGS				167
+#define WLC_GET_PWRIDX				168
+#define WLC_SET_PWRIDX				169
+#define WLC_GET_TSSI				170
+#define WLC_GET_SUP_RATESET_OVERRIDE		171
+#define WLC_SET_SUP_RATESET_OVERRIDE		172
+/* #define WLC_SET_FAST_TIMER			173 */ /* no longer supported */
+/* #define WLC_GET_FAST_TIMER			174 */ /* no longer supported */
+/* #define WLC_SET_SLOW_TIMER			175 */ /* no longer supported */
+/* #define WLC_GET_SLOW_TIMER			176 */ /* no longer supported */
+/* #define WLC_DUMP_PHYREGS			177 */ /* no longer supported */
+#define WLC_GET_PROTECTION_CONTROL		178
+#define WLC_SET_PROTECTION_CONTROL		179
+#endif /* LINUX_POSTMOGRIFY_REMOVAL  */
+#define WLC_GET_PHYLIST				180
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_ENCRYPT_STRENGTH			181	/* ndis only */
+#define WLC_DECRYPT_STATUS			182	/* ndis only */
+#define WLC_GET_KEY_SEQ				183
+#define WLC_GET_SCAN_CHANNEL_TIME		184
+#define WLC_SET_SCAN_CHANNEL_TIME		185
+#define WLC_GET_SCAN_UNASSOC_TIME		186
+#define WLC_SET_SCAN_UNASSOC_TIME		187
+#define WLC_GET_SCAN_HOME_TIME			188
+#define WLC_SET_SCAN_HOME_TIME			189
+#define WLC_GET_SCAN_NPROBES			190
+#define WLC_SET_SCAN_NPROBES			191
+#define WLC_GET_PRB_RESP_TIMEOUT		192
+#define WLC_SET_PRB_RESP_TIMEOUT		193
+#define WLC_GET_ATTEN				194
+#define WLC_SET_ATTEN				195
+#define WLC_GET_SHMEM				196	/* diag */
+#define WLC_SET_SHMEM				197	/* diag */
+/* #define WLC_GET_GMODE_PROTECTION_CTS		198 */ /* no longer supported */
+/* #define WLC_SET_GMODE_PROTECTION_CTS		199 */ /* no longer supported */
+#define WLC_SET_WSEC_TEST			200
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_SCB_DEAUTHENTICATE_FOR_REASON	201
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_TKIP_COUNTERMEASURES		202
+#define WLC_GET_PIOMODE				203
+#define WLC_SET_PIOMODE				204
+#define WLC_SET_ASSOC_PREFER			205
+#define WLC_GET_ASSOC_PREFER			206
+#define WLC_SET_ROAM_PREFER			207
+#define WLC_GET_ROAM_PREFER			208
+#define WLC_SET_LED				209
+#define WLC_GET_LED				210
+#define WLC_GET_INTERFERENCE_MODE		211
+#define WLC_SET_INTERFERENCE_MODE		212
+#define WLC_GET_CHANNEL_QA			213
+#define WLC_START_CHANNEL_QA			214
+#define WLC_GET_CHANNEL_SEL			215
+#define WLC_START_CHANNEL_SEL			216
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_GET_VALID_CHANNELS			217
+#define WLC_GET_FAKEFRAG			218
+#define WLC_SET_FAKEFRAG			219
+#define WLC_GET_PWROUT_PERCENTAGE		220
+#define WLC_SET_PWROUT_PERCENTAGE		221
+#define WLC_SET_BAD_FRAME_PREEMPT		222
+#define WLC_GET_BAD_FRAME_PREEMPT		223
+#define WLC_SET_LEAP_LIST			224
+#define WLC_GET_LEAP_LIST			225
+#define WLC_GET_CWMIN				226
+#define WLC_SET_CWMIN				227
+#define WLC_GET_CWMAX				228
+#define WLC_SET_CWMAX				229
+#define WLC_GET_WET				230
+#define WLC_SET_WET				231
+#define WLC_GET_PUB				232
+/* #define WLC_SET_GLACIAL_TIMER		233 */ /* no longer supported */
+/* #define WLC_GET_GLACIAL_TIMER		234 */ /* no longer supported */
+#define WLC_GET_KEY_PRIMARY			235
+#define WLC_SET_KEY_PRIMARY			236
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+/* #define WLC_DUMP_RADIOREGS			237 */ /* no longer supported */
+#define WLC_GET_ACI_ARGS			238
+#define WLC_SET_ACI_ARGS			239
+#define WLC_UNSET_CALLBACK			240
+#define WLC_SET_CALLBACK			241
+#define WLC_GET_RADAR				242
+#define WLC_SET_RADAR				243
+#define WLC_SET_SPECT_MANAGMENT			244
+#define WLC_GET_SPECT_MANAGMENT			245
+#define WLC_WDS_GET_REMOTE_HWADDR		246	/* handled in wl_linux.c/wl_vx.c */
+#define WLC_WDS_GET_WPA_SUP			247
+#define WLC_SET_CS_SCAN_TIMER			248
+#define WLC_GET_CS_SCAN_TIMER			249
+#define WLC_MEASURE_REQUEST			250
+#define WLC_INIT				251
+#define WLC_SEND_QUIET				252
+#define WLC_KEEPALIVE			253
+#define WLC_SEND_PWR_CONSTRAINT			254
+#define WLC_UPGRADE_STATUS			255
+#define WLC_CURRENT_PWR				256
+#define WLC_GET_SCAN_PASSIVE_TIME		257
+#define WLC_SET_SCAN_PASSIVE_TIME		258
+#define WLC_LEGACY_LINK_BEHAVIOR		259
+#define WLC_GET_CHANNELS_IN_COUNTRY		260
+#define WLC_GET_COUNTRY_LIST			261
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_GET_VAR				262	/* get value of named variable */
+#define WLC_SET_VAR				263	/* set named variable to value */
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_NVRAM_GET				264	/* deprecated */
+#define WLC_NVRAM_SET				265
+#define WLC_NVRAM_DUMP				266
+#define WLC_REBOOT				267
+#endif /* !LINUX_POSTMOGRIFY_REMOVAL */
+#define WLC_SET_WSEC_PMK			268
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#define WLC_GET_AUTH_MODE			269
+#define WLC_SET_AUTH_MODE			270
+#define WLC_GET_WAKEENTRY			271
+#define WLC_SET_WAKEENTRY			272
+#define WLC_NDCONFIG_ITEM			273	/* currently handled in wl_oid.c */
+#define WLC_NVOTPW				274
+#define WLC_OTPW				275
+#define WLC_IOV_BLOCK_GET			276
+#define WLC_IOV_MODULES_GET			277
+#define WLC_SOFT_RESET				278
+#define WLC_GET_ALLOW_MODE			279
+#define WLC_SET_ALLOW_MODE			280
+#define WLC_GET_DESIRED_BSSID			281
+#define WLC_SET_DESIRED_BSSID			282
+#define	WLC_DISASSOC_MYAP			283
+#define WLC_GET_NBANDS				284	/* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES			285	/* for Dongle EXT_STA support */
+#define WLC_GET_WLC_BSS_INFO			286	/* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_INFO			287	/* for Dongle EXT_STA support */
+#define WLC_GET_OID_PHY				288	/* for Dongle EXT_STA support */
+#define WLC_SET_OID_PHY				289	/* for Dongle EXT_STA support */
+#define WLC_SET_ASSOC_TIME			290	/* for Dongle EXT_STA support */
+#define WLC_GET_DESIRED_SSID			291	/* for Dongle EXT_STA support */
+#define WLC_GET_CHANSPEC			292	/* for Dongle EXT_STA support */
+#define WLC_GET_ASSOC_STATE			293	/* for Dongle EXT_STA support */
+#define WLC_SET_PHY_STATE			294	/* for Dongle EXT_STA support */
+#define WLC_GET_SCAN_PENDING			295	/* for Dongle EXT_STA support */
+#define WLC_GET_SCANREQ_PENDING			296	/* for Dongle EXT_STA support */
+#define WLC_GET_PREV_ROAM_REASON		297	/* for Dongle EXT_STA support */
+#define WLC_SET_PREV_ROAM_REASON		298	/* for Dongle EXT_STA support */
+#define WLC_GET_BANDSTATES_PI			299	/* for Dongle EXT_STA support */
+#define WLC_GET_PHY_STATE			300	/* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA_RSN			301	/* for Dongle EXT_STA support */
+#define WLC_GET_BSS_WPA2_RSN			302	/* for Dongle EXT_STA support */
+#define WLC_GET_BSS_BCN_TS			303	/* for Dongle EXT_STA support */
+#define WLC_GET_INT_DISASSOC			304	/* for Dongle EXT_STA support */
+#define WLC_SET_NUM_PEERS			305     /* for Dongle EXT_STA support */
+#define WLC_GET_NUM_BSS				306	/* for Dongle EXT_STA support */
+#define WLC_PHY_SAMPLE_COLLECT			307	/* phy sample collect mode */
+/* #define WLC_UM_PRIV				308 */	/* Deprecated: usermode driver */
+#define WLC_GET_CMD				309
+/* #define WLC_LAST				310 */	/* Never used - can be reused */
+#define WLC_SET_INTERFERENCE_OVERRIDE_MODE	311	/* set inter mode override */
+#define WLC_GET_INTERFERENCE_OVERRIDE_MODE	312	/* get inter mode override */
+/* #define WLC_GET_WAI_RESTRICT			313 */	/* for WAPI, deprecated use iovar instead */
+/* #define WLC_SET_WAI_RESTRICT			314 */	/* for WAPI, deprecated use iovar instead */
+/* #define WLC_SET_WAI_REKEY			315 */	/* for WAPI, deprecated use iovar instead */
+#define WLC_SET_NAT_CONFIG			316	/* for configuring NAT filter driver */
+#define WLC_GET_NAT_STATE			317
+#define WLC_GET_TXBF_RATESET			318
+#define WLC_SET_TXBF_RATESET			319
+#define WLC_SCAN_CQ				320
+#define WLC_GET_RSSI_QDB			321 /* qdB portion of the RSSI */
+#define WLC_DUMP_RATESET			322
+#define WLC_ECHO				323
+#define WLC_LAST				324
+#ifndef EPICTRL_COOKIE
+#define EPICTRL_COOKIE		0xABADCEDE
+#endif
+
+/* vx wlc ioctl's offset */
+#define CMN_IOCTL_OFF 0x180
+
+/*
+ * custom OID support
+ *
+ * 0xFF - implementation specific OID
+ * 0xE4 - first byte of Broadcom PCI vendor ID
+ * 0x14 - second byte of Broadcom PCI vendor ID
+ * 0xXX - the custom OID number
+ */
+
+/* begin 0x1f values beyond the start of the ET driver range. */
+#define WL_OID_BASE		0xFFE41420
+
+/* NDIS overrides */
+#define OID_WL_GETINSTANCE	(WL_OID_BASE + WLC_GET_INSTANCE)
+#define OID_WL_GET_FORCELINK	(WL_OID_BASE + WLC_GET_FORCELINK)
+#define OID_WL_SET_FORCELINK	(WL_OID_BASE + WLC_SET_FORCELINK)
+#define	OID_WL_ENCRYPT_STRENGTH	(WL_OID_BASE + WLC_ENCRYPT_STRENGTH)
+#define OID_WL_DECRYPT_STATUS	(WL_OID_BASE + WLC_DECRYPT_STATUS)
+#define OID_LEGACY_LINK_BEHAVIOR (WL_OID_BASE + WLC_LEGACY_LINK_BEHAVIOR)
+#define OID_WL_NDCONFIG_ITEM	(WL_OID_BASE + WLC_NDCONFIG_ITEM)
+
+/* EXT_STA Dongle suuport */
+#define OID_STA_CHANSPEC	(WL_OID_BASE + WLC_GET_CHANSPEC)
+#define OID_STA_NBANDS		(WL_OID_BASE + WLC_GET_NBANDS)
+#define OID_STA_GET_PHY		(WL_OID_BASE + WLC_GET_OID_PHY)
+#define OID_STA_SET_PHY		(WL_OID_BASE + WLC_SET_OID_PHY)
+#define OID_STA_ASSOC_TIME	(WL_OID_BASE + WLC_SET_ASSOC_TIME)
+#define OID_STA_DESIRED_SSID	(WL_OID_BASE + WLC_GET_DESIRED_SSID)
+#define OID_STA_SET_PHY_STATE	(WL_OID_BASE + WLC_SET_PHY_STATE)
+#define OID_STA_SCAN_PENDING	(WL_OID_BASE + WLC_GET_SCAN_PENDING)
+#define OID_STA_SCANREQ_PENDING (WL_OID_BASE + WLC_GET_SCANREQ_PENDING)
+#define OID_STA_GET_ROAM_REASON (WL_OID_BASE + WLC_GET_PREV_ROAM_REASON)
+#define OID_STA_SET_ROAM_REASON (WL_OID_BASE + WLC_SET_PREV_ROAM_REASON)
+#define OID_STA_GET_PHY_STATE	(WL_OID_BASE + WLC_GET_PHY_STATE)
+#define OID_STA_INT_DISASSOC	(WL_OID_BASE + WLC_GET_INT_DISASSOC)
+#define OID_STA_SET_NUM_PEERS	(WL_OID_BASE + WLC_SET_NUM_PEERS)
+#define OID_STA_GET_NUM_BSS	(WL_OID_BASE + WLC_GET_NUM_BSS)
+
+/* NAT filter driver support */
+#define OID_NAT_SET_CONFIG	(WL_OID_BASE + WLC_SET_NAT_CONFIG)
+#define OID_NAT_GET_STATE	(WL_OID_BASE + WLC_GET_NAT_STATE)
+
+#define WL_DECRYPT_STATUS_SUCCESS	1
+#define WL_DECRYPT_STATUS_FAILURE	2
+#define WL_DECRYPT_STATUS_UNKNOWN	3
+
+/* allows user-mode app to poll the status of USB image upgrade */
+#define WLC_UPGRADE_SUCCESS			0
+#define WLC_UPGRADE_PENDING			1
+
+/* WLC_GET_AUTH, WLC_SET_AUTH values */
+#define WL_AUTH_OPEN_SYSTEM		0	/* d11 open authentication */
+#define WL_AUTH_SHARED_KEY		1	/* d11 shared authentication */
+#define WL_AUTH_OPEN_SHARED		2	/* try open, then shared if open failed w/rc 13 */
+
+/* a large TX Power as an init value to factor out of MIN() calculations,
+ * keep low enough to fit in an int8, units are .25 dBm
+ */
+#define WLC_TXPWR_MAX		(127)	/* ~32 dBm = 1,500 mW */
+
+/* "diag" iovar argument and error code */
+#define WL_DIAG_INTERRUPT			1	/* d11 loopback interrupt test */
+#define WL_DIAG_LOOPBACK			2	/* d11 loopback data test */
+#define WL_DIAG_MEMORY				3	/* d11 memory test */
+#define WL_DIAG_LED				4	/* LED test */
+#define WL_DIAG_REG				5	/* d11/phy register test */
+#define WL_DIAG_SROM				6	/* srom read/crc test */
+#define WL_DIAG_DMA				7	/* DMA test */
+#define WL_DIAG_LOOPBACK_EXT			8	/* enhenced d11 loopback data test */
+
+#define WL_DIAGERR_SUCCESS			0
+#define WL_DIAGERR_FAIL_TO_RUN			1	/* unable to run requested diag */
+#define WL_DIAGERR_NOT_SUPPORTED		2	/* diag requested is not supported */
+#define WL_DIAGERR_INTERRUPT_FAIL		3	/* loopback interrupt test failed */
+#define WL_DIAGERR_LOOPBACK_FAIL		4	/* loopback data test failed */
+#define WL_DIAGERR_SROM_FAIL			5	/* srom read failed */
+#define WL_DIAGERR_SROM_BADCRC			6	/* srom crc failed */
+#define WL_DIAGERR_REG_FAIL			7	/* d11/phy register test failed */
+#define WL_DIAGERR_MEMORY_FAIL			8	/* d11 memory test failed */
+#define WL_DIAGERR_NOMEM			9	/* diag test failed due to no memory */
+#define WL_DIAGERR_DMA_FAIL			10	/* DMA test failed */
+
+#define WL_DIAGERR_MEMORY_TIMEOUT		11	/* d11 memory test didn't finish in time */
+#define WL_DIAGERR_MEMORY_BADPATTERN		12	/* d11 memory test result in bad pattern */
+
+/* band types */
+#define	WLC_BAND_AUTO		0	/* auto-select */
+#define	WLC_BAND_5G		1	/* 5 Ghz */
+#define	WLC_BAND_2G		2	/* 2.4 Ghz */
+#define	WLC_BAND_ALL		3	/* all bands */
+
+/* band range returned by band_range iovar */
+#define WL_CHAN_FREQ_RANGE_2G      0
+#define WL_CHAN_FREQ_RANGE_5GL     1
+#define WL_CHAN_FREQ_RANGE_5GM     2
+#define WL_CHAN_FREQ_RANGE_5GH     3
+
+#define WL_CHAN_FREQ_RANGE_5GLL_5BAND    4
+#define WL_CHAN_FREQ_RANGE_5GLH_5BAND    5
+#define WL_CHAN_FREQ_RANGE_5GML_5BAND    6
+#define WL_CHAN_FREQ_RANGE_5GMH_5BAND    7
+#define WL_CHAN_FREQ_RANGE_5GH_5BAND     8
+
+#define WL_CHAN_FREQ_RANGE_5G_BAND0     1
+#define WL_CHAN_FREQ_RANGE_5G_BAND1     2
+#define WL_CHAN_FREQ_RANGE_5G_BAND2     3
+#define WL_CHAN_FREQ_RANGE_5G_BAND3     4
+
+#ifdef SROM12
+#define WL_CHAN_FREQ_RANGE_5G_BAND4 5
+#define WL_CHAN_FREQ_RANGE_2G_40 6
+#define WL_CHAN_FREQ_RANGE_5G_BAND0_40 7
+#define WL_CHAN_FREQ_RANGE_5G_BAND1_40 8
+#define WL_CHAN_FREQ_RANGE_5G_BAND2_40 9
+#define WL_CHAN_FREQ_RANGE_5G_BAND3_40 10
+#define WL_CHAN_FREQ_RANGE_5G_BAND4_40 11
+#define WL_CHAN_FREQ_RANGE_5G_BAND0_80 12
+#define WL_CHAN_FREQ_RANGE_5G_BAND1_80 13
+#define WL_CHAN_FREQ_RANGE_5G_BAND2_80 14
+#define WL_CHAN_FREQ_RANGE_5G_BAND3_80 15
+#define WL_CHAN_FREQ_RANGE_5G_BAND4_80 16
+
+#define WL_CHAN_FREQ_RANGE_5G_4BAND	17
+#define WL_CHAN_FREQ_RANGE_5G_5BAND	18
+#define WL_CHAN_FREQ_RANGE_5G_5BAND_40	19
+#define WL_CHAN_FREQ_RANGE_5G_5BAND_80	20
+#else
+#define WL_CHAN_FREQ_RANGE_5G_4BAND	5
+#endif /* SROM12 */
+/* MAC list modes */
+#define WLC_MACMODE_DISABLED	0	/* MAC list disabled */
+#define WLC_MACMODE_DENY	1	/* Deny specified (i.e. allow unspecified) */
+#define WLC_MACMODE_ALLOW	2	/* Allow specified (i.e. deny unspecified) */
+
+/*
+ * 54g modes (basic bits may still be overridden)
+ *
+ * GMODE_LEGACY_B			Rateset: 1b, 2b, 5.5, 11
+ *					Preamble: Long
+ *					Shortslot: Off
+ * GMODE_AUTO				Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *					Extended Rateset: 6, 9, 12, 48
+ *					Preamble: Long
+ *					Shortslot: Auto
+ * GMODE_ONLY				Rateset: 1b, 2b, 5.5b, 11b, 18, 24b, 36, 54
+ *					Extended Rateset: 6b, 9, 12b, 48
+ *					Preamble: Short required
+ *					Shortslot: Auto
+ * GMODE_B_DEFERRED			Rateset: 1b, 2b, 5.5b, 11b, 18, 24, 36, 54
+ *					Extended Rateset: 6, 9, 12, 48
+ *					Preamble: Long
+ *					Shortslot: On
+ * GMODE_PERFORMANCE			Rateset: 1b, 2b, 5.5b, 6b, 9, 11b, 12b, 18, 24b, 36, 48, 54
+ *					Preamble: Short required
+ *					Shortslot: On and required
+ * GMODE_LRS				Rateset: 1b, 2b, 5.5b, 11b
+ *					Extended Rateset: 6, 9, 12, 18, 24, 36, 48, 54
+ *					Preamble: Long
+ *					Shortslot: Auto
+ */
+#define GMODE_LEGACY_B		0
+#define GMODE_AUTO		1
+#define GMODE_ONLY		2
+#define GMODE_B_DEFERRED	3
+#define GMODE_PERFORMANCE	4
+#define GMODE_LRS		5
+#define GMODE_MAX		6
+
+/* values for PLCPHdr_override */
+#define WLC_PLCP_AUTO	-1
+#define WLC_PLCP_SHORT	0
+#define WLC_PLCP_LONG	1
+
+/* values for g_protection_override and n_protection_override */
+#define WLC_PROTECTION_AUTO		-1
+#define WLC_PROTECTION_OFF		0
+#define WLC_PROTECTION_ON		1
+#define WLC_PROTECTION_MMHDR_ONLY	2
+#define WLC_PROTECTION_CTS_ONLY		3
+
+/* values for g_protection_control and n_protection_control */
+#define WLC_PROTECTION_CTL_OFF		0
+#define WLC_PROTECTION_CTL_LOCAL	1
+#define WLC_PROTECTION_CTL_OVERLAP	2
+
+/* values for n_protection */
+#define WLC_N_PROTECTION_OFF		0
+#define WLC_N_PROTECTION_OPTIONAL	1
+#define WLC_N_PROTECTION_20IN40		2
+#define WLC_N_PROTECTION_MIXEDMODE	3
+
+/* values for n_preamble_type */
+#define WLC_N_PREAMBLE_MIXEDMODE	0
+#define WLC_N_PREAMBLE_GF		1
+#define WLC_N_PREAMBLE_GF_BRCM          2
+
+/* values for band specific 40MHz capabilities (deprecated) */
+#define WLC_N_BW_20ALL			0
+#define WLC_N_BW_40ALL			1
+#define WLC_N_BW_20IN2G_40IN5G		2
+
+#define WLC_BW_20MHZ_BIT		(1<<0)
+#define WLC_BW_40MHZ_BIT		(1<<1)
+#define WLC_BW_80MHZ_BIT		(1<<2)
+#define WLC_BW_160MHZ_BIT		(1<<3)
+
+/* Bandwidth capabilities */
+#define WLC_BW_CAP_20MHZ		(WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_40MHZ		(WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_80MHZ		(WLC_BW_80MHZ_BIT|WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_160MHZ		(WLC_BW_160MHZ_BIT|WLC_BW_80MHZ_BIT| \
+	WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_UNRESTRICTED		0xFF
+
+#define WL_BW_CAP_20MHZ(bw_cap)	(((bw_cap) & WLC_BW_20MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_40MHZ(bw_cap)	(((bw_cap) & WLC_BW_40MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_80MHZ(bw_cap)	(((bw_cap) & WLC_BW_80MHZ_BIT) ? TRUE : FALSE)
+#define WL_BW_CAP_160MHZ(bw_cap)(((bw_cap) & WLC_BW_160MHZ_BIT) ? TRUE : FALSE)
+
+/* values to force tx/rx chain */
+#define WLC_N_TXRX_CHAIN0		0
+#define WLC_N_TXRX_CHAIN1		1
+
+/* bitflags for SGI support (sgi_rx iovar) */
+#define WLC_N_SGI_20			0x01
+#define WLC_N_SGI_40			0x02
+#define WLC_VHT_SGI_80			0x04
+
+/* when sgi_tx==WLC_SGI_ALL, bypass rate selection, enable sgi for all mcs */
+#define WLC_SGI_ALL				0x02
+
+#define LISTEN_INTERVAL			10
+/* interference mitigation options */
+#define	INTERFERE_OVRRIDE_OFF	-1	/* interference override off */
+#define	INTERFERE_NONE	0	/* off */
+#define	NON_WLAN	1	/* foreign/non 802.11 interference, no auto detect */
+#define	WLAN_MANUAL	2	/* ACI: no auto detection */
+#define	WLAN_AUTO	3	/* ACI: auto detect */
+#define	WLAN_AUTO_W_NOISE	4	/* ACI: auto - detect and non 802.11 interference */
+#define AUTO_ACTIVE	(1 << 7) /* Auto is currently active */
+
+/* interfernece mode bit-masks (ACPHY) */
+#define ACPHY_ACI_GLITCHBASED_DESENSE 1   /* bit 0 */
+#define ACPHY_ACI_HWACI_PKTGAINLMT 2      /* bit 1 */
+#define ACPHY_ACI_W2NB_PKTGAINLMT 4       /* bit 2 */
+#define ACPHY_ACI_PREEMPTION 8            /* bit 3 */
+#define ACPHY_HWACI_MITIGATION 16            /* bit 4 */
+#define ACPHY_ACI_MAX_MODE 31
+
+/* AP environment */
+#define AP_ENV_DETECT_NOT_USED		0 /* We aren't using AP environment detection */
+#define AP_ENV_DENSE			1 /* "Corporate" or other AP dense environment */
+#define AP_ENV_SPARSE			2 /* "Home" or other sparse environment */
+#define AP_ENV_INDETERMINATE		3 /* AP environment hasn't been identified */
+
+#define TRIGGER_NOW				0
+#define TRIGGER_CRS				0x01
+#define TRIGGER_CRSDEASSERT			0x02
+#define TRIGGER_GOODFCS				0x04
+#define TRIGGER_BADFCS				0x08
+#define TRIGGER_BADPLCP				0x10
+#define TRIGGER_CRSGLITCH			0x20
+
+#define	WL_SAMPLEDATA_HEADER_TYPE	1
+#define WL_SAMPLEDATA_HEADER_SIZE	80	/* sample collect header size (bytes) */
+#define	WL_SAMPLEDATA_TYPE		2
+#define	WL_SAMPLEDATA_SEQ		0xff	/* sequence # */
+#define	WL_SAMPLEDATA_MORE_DATA		0x100	/* more data mask */
+
+/* WL_OTA START */
+#define WL_OTA_ARG_PARSE_BLK_SIZE	1200
+#define WL_OTA_TEST_MAX_NUM_RATE	30
+#define WL_OTA_TEST_MAX_NUM_SEQ		100
+
+#define WL_THRESHOLD_LO_BAND	70	/* range from 5250MHz - 5350MHz */
+
+/* radar iovar SET defines */
+#define WL_RADAR_DETECTOR_OFF		0	/* radar detector off */
+#define WL_RADAR_DETECTOR_ON		1	/* radar detector on */
+#define WL_RADAR_SIMULATED		2	/* force radar detector to declare
+						 * detection once
+						 */
+#define WL_RSSI_ANT_VERSION	1	/* current version of wl_rssi_ant_t */
+#define WL_ANT_RX_MAX		2	/* max 2 receive antennas */
+#define WL_ANT_HT_RX_MAX	3	/* max 3 receive antennas/cores */
+#define WL_ANT_IDX_1		0	/* antenna index 1 */
+#define WL_ANT_IDX_2		1	/* antenna index 2 */
+
+#ifndef WL_RSSI_ANT_MAX
+#define WL_RSSI_ANT_MAX		4	/* max possible rx antennas */
+#elif WL_RSSI_ANT_MAX != 4
+#error "WL_RSSI_ANT_MAX does not match"
+#endif
+
+/* dfs_status iovar-related defines */
+
+/* cac - channel availability check,
+ * ism - in-service monitoring
+ * csa - channel switching announcement
+ */
+
+/* cac state values */
+#define WL_DFS_CACSTATE_IDLE		0	/* state for operating in non-radar channel */
+#define	WL_DFS_CACSTATE_PREISM_CAC	1	/* CAC in progress */
+#define WL_DFS_CACSTATE_ISM		2	/* ISM in progress */
+#define WL_DFS_CACSTATE_CSA		3	/* csa */
+#define WL_DFS_CACSTATE_POSTISM_CAC	4	/* ISM CAC */
+#define WL_DFS_CACSTATE_PREISM_OOC	5	/* PREISM OOC */
+#define WL_DFS_CACSTATE_POSTISM_OOC	6	/* POSTISM OOC */
+#define WL_DFS_CACSTATES		7	/* this many states exist */
+
+/* Defines used with channel_bandwidth for curpower */
+#define WL_BW_20MHZ		0
+#define WL_BW_40MHZ		1
+#define WL_BW_80MHZ		2
+#define WL_BW_160MHZ		3
+#define WL_BW_8080MHZ		4
+
+/* tx_power_t.flags bits */
+#define WL_TX_POWER_F_ENABLED	1
+#define WL_TX_POWER_F_HW		2
+#define WL_TX_POWER_F_MIMO		4
+#define WL_TX_POWER_F_SISO		8
+#define WL_TX_POWER_F_HT		0x10
+#define WL_TX_POWER_F_VHT		0x20
+#define WL_TX_POWER_F_OPENLOOP		0x40
+
+/* Message levels */
+#define WL_ERROR_VAL		0x00000001
+#define WL_TRACE_VAL		0x00000002
+#define WL_PRHDRS_VAL		0x00000004
+#define WL_PRPKT_VAL		0x00000008
+#define WL_INFORM_VAL		0x00000010
+#define WL_TMP_VAL		0x00000020
+#define WL_OID_VAL		0x00000040
+#define WL_RATE_VAL		0x00000080
+#define WL_ASSOC_VAL		0x00000100
+#define WL_PRUSR_VAL		0x00000200
+#define WL_PS_VAL		0x00000400
+#define WL_TXPWR_VAL		0x00000800	/* retired in TOT on 6/10/2009 */
+#define WL_MODE_SWITCH_VAL	0x00000800 /* Using retired TXPWR val */
+#define WL_PORT_VAL		0x00001000
+#define WL_DUAL_VAL		0x00002000
+#define WL_WSEC_VAL		0x00004000
+#define WL_WSEC_DUMP_VAL	0x00008000
+#define WL_LOG_VAL		0x00010000
+#define WL_NRSSI_VAL		0x00020000	/* retired in TOT on 6/10/2009 */
+#define WL_LOFT_VAL		0x00040000	/* retired in TOT on 6/10/2009 */
+#define WL_REGULATORY_VAL	0x00080000
+#define WL_TAF_VAL		0x00100000
+#define WL_RADAR_VAL		0x00200000	/* retired in TOT on 6/10/2009 */
+#define WL_MPC_VAL		0x00400000
+#define WL_APSTA_VAL		0x00800000
+#define WL_DFS_VAL		0x01000000
+#define WL_BA_VAL		0x02000000	/* retired in TOT on 6/14/2010 */
+#define WL_ACI_VAL		0x04000000
+#define WL_PRMAC_VAL		0x04000000
+#define WL_MBSS_VAL		0x04000000
+#define WL_CAC_VAL		0x08000000
+#define WL_AMSDU_VAL		0x10000000
+#define WL_AMPDU_VAL		0x20000000
+#define WL_FFPLD_VAL		0x40000000
+
+/* wl_msg_level is full. For new bits take the next one and AND with
+ * wl_msg_level2 in wl_dbg.h
+ */
+#define WL_DPT_VAL		0x00000001
+#define WL_SCAN_VAL		0x00000002
+#define WL_WOWL_VAL		0x00000004
+#define WL_COEX_VAL		0x00000008
+#define WL_RTDC_VAL		0x00000010
+#define WL_PROTO_VAL		0x00000020
+#define WL_BTA_VAL		0x00000040
+#define WL_CHANINT_VAL		0x00000080
+#define WL_WMF_VAL		0x00000100
+#define WL_P2P_VAL		0x00000200
+#define WL_ITFR_VAL		0x00000400
+#define WL_MCHAN_VAL		0x00000800
+#define WL_TDLS_VAL		0x00001000
+#define WL_MCNX_VAL		0x00002000
+#define WL_PROT_VAL		0x00004000
+#define WL_PSTA_VAL		0x00008000
+#define WL_TSO_VAL		0x00010000
+#define WL_TRF_MGMT_VAL		0x00020000
+#define WL_LPC_VAL	        0x00040000
+#define WL_L2FILTER_VAL		0x00080000
+#define WL_TXBF_VAL		0x00100000
+#define WL_P2PO_VAL		0x00200000
+#define WL_TBTT_VAL		0x00400000
+#define WL_MQ_VAL		0x01000000
+
+/* This level is currently used in Phoenix2 only */
+#define WL_SRSCAN_VAL		0x02000000
+
+#define WL_WNM_VAL		0x04000000
+#define WL_PWRSEL_VAL		0x10000000
+#define WL_NET_DETECT_VAL	0x20000000
+#define WL_PCIE_VAL		0x40000000
+
+/* use top-bit for WL_TIME_STAMP_VAL because this is a modifier
+ * rather than a message-type of its own
+ */
+#define WL_TIMESTAMP_VAL        0x80000000
+
+/* max # of leds supported by GPIO (gpio pin# == led index#) */
+#define	WL_LED_NUMGPIO		32	/* gpio 0-31 */
+
+/* led per-pin behaviors */
+#define	WL_LED_OFF		0		/* always off */
+#define	WL_LED_ON		1		/* always on */
+#define	WL_LED_ACTIVITY		2		/* activity */
+#define	WL_LED_RADIO		3		/* radio enabled */
+#define	WL_LED_ARADIO		4		/* 5  Ghz radio enabled */
+#define	WL_LED_BRADIO		5		/* 2.4Ghz radio enabled */
+#define	WL_LED_BGMODE		6		/* on if gmode, off if bmode */
+#define	WL_LED_WI1		7
+#define	WL_LED_WI2		8
+#define	WL_LED_WI3		9
+#define	WL_LED_ASSOC		10		/* associated state indicator */
+#define	WL_LED_INACTIVE		11		/* null behavior (clears default behavior) */
+#define	WL_LED_ASSOCACT		12		/* on when associated; blink fast for activity */
+#define WL_LED_WI4		13
+#define WL_LED_WI5		14
+#define	WL_LED_BLINKSLOW	15		/* blink slow */
+#define	WL_LED_BLINKMED		16		/* blink med */
+#define	WL_LED_BLINKFAST	17		/* blink fast */
+#define	WL_LED_BLINKCUSTOM	18		/* blink custom */
+#define	WL_LED_BLINKPERIODIC	19		/* blink periodic (custom 1000ms / off 400ms) */
+#define WL_LED_ASSOC_WITH_SEC	20		/* when connected with security */
+						/* keep on for 300 sec */
+#define WL_LED_START_OFF	21		/* off upon boot, could be turned on later */
+#define WL_LED_WI6		22
+#define WL_LED_WI7		23
+#define WL_LED_WI8		24
+#define	WL_LED_NUMBEHAVIOR	25
+
+/* led behavior numeric value format */
+#define	WL_LED_BEH_MASK		0x7f		/* behavior mask */
+#define	WL_LED_AL_MASK		0x80		/* activelow (polarity) bit */
+
+/* number of bytes needed to define a proper bit mask for MAC event reporting */
+#define BCMIO_ROUNDUP(x, y)	((((x) + ((y) - 1)) / (y)) * (y))
+#define BCMIO_NBBY		8
+#define WL_EVENTING_MASK_LEN	16
+
+
+/* join preference types */
+#define WL_JOIN_PREF_RSSI	1	/* by RSSI */
+#define WL_JOIN_PREF_WPA	2	/* by akm and ciphers */
+#define WL_JOIN_PREF_BAND	3	/* by 802.11 band */
+#define WL_JOIN_PREF_RSSI_DELTA	4	/* by 802.11 band only if RSSI delta condition matches */
+#define WL_JOIN_PREF_TRANS_PREF	5	/* defined by requesting AP */
+
+/* band preference */
+#define WLJP_BAND_ASSOC_PREF	255	/* use what WLC_SET_ASSOC_PREFER ioctl specifies */
+
+/* any multicast cipher suite */
+#define WL_WPA_ACP_MCS_ANY	"\x00\x00\x00\x00"
+
+/* 802.11h measurement types */
+#define WLC_MEASURE_TPC			1
+#define WLC_MEASURE_CHANNEL_BASIC	2
+#define WLC_MEASURE_CHANNEL_CCA		3
+#define WLC_MEASURE_CHANNEL_RPI		4
+
+/* regulatory enforcement levels */
+#define SPECT_MNGMT_OFF			0		/* both 11h and 11d disabled */
+#define SPECT_MNGMT_LOOSE_11H		1		/* allow non-11h APs in scan lists */
+#define SPECT_MNGMT_STRICT_11H		2		/* prune out non-11h APs from scan list */
+#define SPECT_MNGMT_STRICT_11D		3		/* switch to 802.11D mode */
+/* SPECT_MNGMT_LOOSE_11H_D - same as SPECT_MNGMT_LOOSE with the exception that Country IE
+ * adoption is done regardless of capability spectrum_management
+ */
+#define SPECT_MNGMT_LOOSE_11H_D		4		/* operation defined above */
+
+#define WL_CHAN_VALID_HW	(1 << 0)	/* valid with current HW */
+#define WL_CHAN_VALID_SW	(1 << 1)	/* valid with current country setting */
+#define WL_CHAN_BAND_5G		(1 << 2)	/* 5GHz-band channel */
+#define WL_CHAN_RADAR		(1 << 3)	/* radar sensitive  channel */
+#define WL_CHAN_INACTIVE	(1 << 4)	/* temporarily inactive due to radar */
+#define WL_CHAN_PASSIVE		(1 << 5)	/* channel is in passive mode */
+#define WL_CHAN_RESTRICTED	(1 << 6)	/* restricted use channel */
+
+/* BTC mode used by "btc_mode" iovar */
+#define	WL_BTC_DISABLE		0	/* disable BT coexistence */
+#define WL_BTC_FULLTDM      1	/* full TDM COEX */
+#define WL_BTC_ENABLE       1	/* full TDM COEX to maintain backward compatiblity */
+#define WL_BTC_PREMPT      2    /* full TDM COEX with preemption */
+#define WL_BTC_LITE        3	/* light weight coex for large isolation platform */
+#define WL_BTC_PARALLEL		4   /* BT and WLAN run in parallel with separate antenna  */
+#define WL_BTC_HYBRID		5   /* hybrid coex, only ack is allowed to transmit in BT slot */
+#define WL_BTC_DEFAULT		8	/* set the default mode for the device */
+#define WL_INF_BTC_DISABLE      0
+#define WL_INF_BTC_ENABLE       1
+#define WL_INF_BTC_AUTO         3
+
+/* BTC wire used by "btc_wire" iovar */
+#define	WL_BTC_DEFWIRE		0	/* use default wire setting */
+#define WL_BTC_2WIRE		2	/* use 2-wire BTC */
+#define WL_BTC_3WIRE		3	/* use 3-wire BTC */
+#define WL_BTC_4WIRE		4	/* use 4-wire BTC */
+
+/* BTC flags: BTC configuration that can be set by host */
+#define WL_BTC_FLAG_PREMPT               (1 << 0)
+#define WL_BTC_FLAG_BT_DEF               (1 << 1)
+#define WL_BTC_FLAG_ACTIVE_PROT          (1 << 2)
+#define WL_BTC_FLAG_SIM_RSP              (1 << 3)
+#define WL_BTC_FLAG_PS_PROTECT           (1 << 4)
+#define WL_BTC_FLAG_SIM_TX_LP	         (1 << 5)
+#define WL_BTC_FLAG_ECI                  (1 << 6)
+#define WL_BTC_FLAG_LIGHT                (1 << 7)
+#define WL_BTC_FLAG_PARALLEL             (1 << 8)
+
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS		64
+
+/* max number of chanspecs (used by the iovar to calc. buf space) */
+#ifdef WL11AC_80P80
+#define WL_NUMCHANSPECS 206
+#else
+#define WL_NUMCHANSPECS 110
+#endif
+
+
+/* WDS link local endpoint WPA role */
+#define WL_WDS_WPA_ROLE_AUTH	0	/* authenticator */
+#define WL_WDS_WPA_ROLE_SUP	1	/* supplicant */
+#define WL_WDS_WPA_ROLE_AUTO	255	/* auto, based on mac addr value */
+
+/* Base offset values */
+#define WL_PKT_FILTER_BASE_PKT   0
+#define WL_PKT_FILTER_BASE_END   1
+#define WL_PKT_FILTER_BASE_D11_H 2 /* May be removed */
+#define WL_PKT_FILTER_BASE_D11_D 3 /* May be removed */
+#define WL_PKT_FILTER_BASE_ETH_H 4
+#define WL_PKT_FILTER_BASE_ETH_D 5
+#define WL_PKT_FILTER_BASE_ARP_H 6
+#define WL_PKT_FILTER_BASE_ARP_D 7 /* May be removed */
+#define WL_PKT_FILTER_BASE_IP4_H 8
+#define WL_PKT_FILTER_BASE_IP4_D 9
+#define WL_PKT_FILTER_BASE_IP6_H 10
+#define WL_PKT_FILTER_BASE_IP6_D 11
+#define WL_PKT_FILTER_BASE_TCP_H 12
+#define WL_PKT_FILTER_BASE_TCP_D 13 /* May be removed */
+#define WL_PKT_FILTER_BASE_UDP_H 14
+#define WL_PKT_FILTER_BASE_UDP_D 15
+#define WL_PKT_FILTER_BASE_IP6_P 16
+#define WL_PKT_FILTER_BASE_COUNT 17 /* May be removed */
+
+/* String mapping for bases that may be used by applications or debug */
+#define WL_PKT_FILTER_BASE_NAMES \
+	{ "START", WL_PKT_FILTER_BASE_PKT },   \
+	{ "END",   WL_PKT_FILTER_BASE_END },   \
+	{ "ETH_H", WL_PKT_FILTER_BASE_ETH_H }, \
+	{ "ETH_D", WL_PKT_FILTER_BASE_ETH_D }, \
+	{ "D11_H", WL_PKT_FILTER_BASE_D11_H }, \
+	{ "D11_D", WL_PKT_FILTER_BASE_D11_D }, \
+	{ "ARP_H", WL_PKT_FILTER_BASE_ARP_H }, \
+	{ "IP4_H", WL_PKT_FILTER_BASE_IP4_H }, \
+	{ "IP4_D", WL_PKT_FILTER_BASE_IP4_D }, \
+	{ "IP6_H", WL_PKT_FILTER_BASE_IP6_H }, \
+	{ "IP6_D", WL_PKT_FILTER_BASE_IP6_D }, \
+	{ "IP6_P", WL_PKT_FILTER_BASE_IP6_P }, \
+	{ "TCP_H", WL_PKT_FILTER_BASE_TCP_H }, \
+	{ "TCP_D", WL_PKT_FILTER_BASE_TCP_D }, \
+	{ "UDP_H", WL_PKT_FILTER_BASE_UDP_H }, \
+	{ "UDP_D", WL_PKT_FILTER_BASE_UDP_D }
+
+/* Flags for a pattern list element */
+#define WL_PKT_FILTER_MFLAG_NEG 0x0001
+
+/*
+ * Packet engine interface
+ */
+
+#define WL_PKTENG_PER_TX_START			0x01
+#define WL_PKTENG_PER_TX_STOP			0x02
+#define WL_PKTENG_PER_RX_START			0x04
+#define WL_PKTENG_PER_RX_WITH_ACK_START		0x05
+#define WL_PKTENG_PER_TX_WITH_ACK_START		0x06
+#define WL_PKTENG_PER_RX_STOP			0x08
+#define WL_PKTENG_PER_MASK			0xff
+
+#define WL_PKTENG_SYNCHRONOUS			0x100	/* synchronous flag */
+
+#define WL_PKTENG_MAXPKTSZ				16384	/* max pktsz limit for pkteng */
+
+#define NUM_80211b_RATES	4
+#define NUM_80211ag_RATES	8
+#define NUM_80211n_RATES	32
+#define NUM_80211_RATES		(NUM_80211b_RATES+NUM_80211ag_RATES+NUM_80211n_RATES)
+
+/*
+ * WOWL capability/override settings
+ */
+#define WL_WOWL_MAGIC           (1 << 0)    /* Wakeup on Magic packet */
+#define WL_WOWL_NET             (1 << 1)    /* Wakeup on Netpattern */
+#define WL_WOWL_DIS             (1 << 2)    /* Wakeup on loss-of-link due to Disassoc/Deauth */
+#define WL_WOWL_RETR            (1 << 3)    /* Wakeup on retrograde TSF */
+#define WL_WOWL_BCN             (1 << 4)    /* Wakeup on loss of beacon */
+#define WL_WOWL_TST             (1 << 5)    /* Wakeup after test */
+#define WL_WOWL_M1              (1 << 6)    /* Wakeup after PTK refresh */
+#define WL_WOWL_EAPID           (1 << 7)    /* Wakeup after receipt of EAP-Identity Req */
+#define WL_WOWL_PME_GPIO        (1 << 8)    /* Wakeind via PME(0) or GPIO(1) */
+#define WL_WOWL_NEEDTKIP1       (1 << 9)    /* need tkip phase 1 key to be updated by the driver */
+#define WL_WOWL_GTK_FAILURE     (1 << 10)   /* enable wakeup if GTK fails */
+#define WL_WOWL_EXTMAGPAT       (1 << 11)   /* support extended magic packets */
+#define WL_WOWL_ARPOFFLOAD      (1 << 12)   /* support ARP/NS/keepalive offloading */
+#define WL_WOWL_WPA2            (1 << 13)   /* read protocol version for EAPOL frames */
+#define WL_WOWL_KEYROT          (1 << 14)   /* If the bit is set, use key rotaton */
+#define WL_WOWL_BCAST           (1 << 15)   /* If the bit is set, frm received was bcast frame */
+#define WL_WOWL_SCANOL          (1 << 16)   /* If the bit is set, scan offload is enabled */
+#define WL_WOWL_TCPKEEP_TIME    (1 << 17)   /* Wakeup on tcpkeep alive timeout */
+#define WL_WOWL_MDNS_CONFLICT   (1 << 18)   /* Wakeup on mDNS Conflict Resolution */
+#define WL_WOWL_MDNS_SERVICE    (1 << 19)   /* Wakeup on mDNS Service Connect */
+#define WL_WOWL_TCPKEEP_DATA    (1 << 20)   /* tcp keepalive got data */
+#define WL_WOWL_FW_HALT         (1 << 21)   /* Firmware died in wowl mode */
+#define WL_WOWL_ENAB_HWRADIO    (1 << 22)   /* Enable detection of radio button changes */
+#define WL_WOWL_MIC_FAIL        (1 << 23)   /* Offloads detected MIC failure(s) */
+#define WL_WOWL_UNASSOC         (1 << 24)   /* Wakeup in Unassociated state (Net/Magic Pattern) */
+#define WL_WOWL_SECURE          (1 << 25)   /* Wakeup if received matched secured pattern */
+#define WL_WOWL_LINKDOWN        (1 << 31)   /* Link Down indication in WoWL mode */
+
+#define WL_WOWL_TCPKEEP         (1 << 20)   /* temp copy to satisfy automerger */
+#define MAGIC_PKT_MINLEN 102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+
+#define WOWL_PATTEN_TYPE_ARP	(1 << 0)	/* ARP offload Pattern */
+#define WOWL_PATTEN_TYPE_NA	(1 << 1)	/* NA offload Pattern */
+
+#define MAGIC_PKT_MINLEN	102    /* Magic pkt min length is 6 * 0xFF + 16 * ETHER_ADDR_LEN */
+#define MAGIC_PKT_NUM_MAC_ADDRS	16
+
+
+/* Overlap BSS Scan parameters default, minimum, maximum */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_DEFAULT		20	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MIN			5	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_DWELL_MAX			1000	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_DEFAULT		10	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MIN			10	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_DWELL_MAX			1000	/* unit TU */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_DEFAULT	300	/* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MIN		10	/* unit Sec */
+#define WLC_OBSS_SCAN_WIDTHSCAN_INTERVAL_MAX		900	/* unit Sec */
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_DEFAULT	5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MIN	5
+#define WLC_OBSS_SCAN_CHANWIDTH_TRANSITION_DLY_MAX	100
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_DEFAULT	200	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MIN	200	/* unit TU */
+#define WLC_OBSS_SCAN_PASSIVE_TOTAL_PER_CHANNEL_MAX	10000	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_DEFAULT	20	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MIN	20	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVE_TOTAL_PER_CHANNEL_MAX	10000	/* unit TU */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_DEFAULT	25	/* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MIN		0	/* unit percent */
+#define WLC_OBSS_SCAN_ACTIVITY_THRESHOLD_MAX		100	/* unit percent */
+
+#define WL_MIN_NUM_OBSS_SCAN_ARG 7	/* minimum number of arguments required for OBSS Scan */
+
+#define WL_COEX_INFO_MASK		0x07
+#define WL_COEX_INFO_REQ		0x01
+#define	WL_COEX_40MHZ_INTOLERANT	0x02
+#define	WL_COEX_WIDTH20			0x04
+
+#define	WLC_RSSI_INVALID	 0	/* invalid RSSI value */
+
+#define MAX_RSSI_LEVELS 8
+
+/* **** EXTLOG **** */
+#define EXTLOG_CUR_VER		0x0100
+
+#define MAX_ARGSTR_LEN		18 /* At least big enough for storing ETHER_ADDR_STR_LEN */
+
+/* log modules (bitmap) */
+#define LOG_MODULE_COMMON	0x0001
+#define LOG_MODULE_ASSOC	0x0002
+#define LOG_MODULE_EVENT	0x0004
+#define LOG_MODULE_MAX		3			/* Update when adding module */
+
+/* log levels */
+#define WL_LOG_LEVEL_DISABLE	0
+#define WL_LOG_LEVEL_ERR	1
+#define WL_LOG_LEVEL_WARN	2
+#define WL_LOG_LEVEL_INFO	3
+#define WL_LOG_LEVEL_MAX	WL_LOG_LEVEL_INFO	/* Update when adding level */
+
+/* flag */
+#define LOG_FLAG_EVENT		1
+
+/* log arg_type */
+#define LOG_ARGTYPE_NULL	0
+#define LOG_ARGTYPE_STR		1	/* %s */
+#define LOG_ARGTYPE_INT		2	/* %d */
+#define LOG_ARGTYPE_INT_STR	3	/* %d...%s */
+#define LOG_ARGTYPE_STR_INT	4	/* %s...%d */
+
+/* 802.11 Mgmt Packet flags */
+#define VNDR_IE_BEACON_FLAG	0x1
+#define VNDR_IE_PRBRSP_FLAG	0x2
+#define VNDR_IE_ASSOCRSP_FLAG	0x4
+#define VNDR_IE_AUTHRSP_FLAG	0x8
+#define VNDR_IE_PRBREQ_FLAG	0x10
+#define VNDR_IE_ASSOCREQ_FLAG	0x20
+#define VNDR_IE_IWAPID_FLAG	0x40 /* vendor IE in IW advertisement protocol ID field */
+#define VNDR_IE_CUSTOM_FLAG	0x100 /* allow custom IE id */
+
+#if defined(WLP2P)
+/* P2P Action Frames flags (spec ordered) */
+#define VNDR_IE_GONREQ_FLAG     0x001000
+#define VNDR_IE_GONRSP_FLAG     0x002000
+#define VNDR_IE_GONCFM_FLAG     0x004000
+#define VNDR_IE_INVREQ_FLAG     0x008000
+#define VNDR_IE_INVRSP_FLAG     0x010000
+#define VNDR_IE_DISREQ_FLAG     0x020000
+#define VNDR_IE_DISRSP_FLAG     0x040000
+#define VNDR_IE_PRDREQ_FLAG     0x080000
+#define VNDR_IE_PRDRSP_FLAG     0x100000
+
+#define VNDR_IE_P2PAF_SHIFT	12
+#endif /* WLP2P */
+
+/* channel interference measurement (chanim) related defines */
+
+/* chanim mode */
+#define CHANIM_DISABLE	0	/* disabled */
+#define CHANIM_DETECT	1	/* detection only */
+#define CHANIM_EXT		2	/* external state machine */
+#define CHANIM_ACT		3	/* full internal state machine, detect + act */
+#define CHANIM_MODE_MAX 4
+
+/* define for apcs reason code */
+#define APCS_INIT		0
+#define APCS_IOCTL		1
+#define APCS_CHANIM		2
+#define APCS_CSTIMER		3
+#define APCS_BTA		4
+#define APCS_TXDLY		5
+#define APCS_NONACSD		6
+#define APCS_DFS_REENTRY	7
+#define APCS_TXFAIL		8
+#define APCS_MAX		9
+
+/* number of ACS record entries */
+#define CHANIM_ACS_RECORD			10
+
+/* CHANIM */
+#define CCASTATS_TXDUR  0
+#define CCASTATS_INBSS  1
+#define CCASTATS_OBSS   2
+#define CCASTATS_NOCTG  3
+#define CCASTATS_NOPKT  4
+#define CCASTATS_DOZE   5
+#define CCASTATS_TXOP	6
+#define CCASTATS_GDTXDUR        7
+#define CCASTATS_BDTXDUR        8
+#define CCASTATS_MAX    9
+
+#define WL_CHANIM_COUNT_ALL	0xff
+#define WL_CHANIM_COUNT_ONE	0x1
+
+/* ap tpc modes */
+#define	AP_TPC_OFF		0
+#define	AP_TPC_BSS_PWR		1	/* BSS power control */
+#define AP_TPC_AP_PWR		2	/* AP power control */
+#define	AP_TPC_AP_BSS_PWR	3	/* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN	127
+
+/* ap tpc modes */
+#define	AP_TPC_OFF		0
+#define	AP_TPC_BSS_PWR		1	/* BSS power control */
+#define AP_TPC_AP_PWR		2	/* AP power control */
+#define	AP_TPC_AP_BSS_PWR	3	/* Both AP and BSS power control */
+#define AP_TPC_MAX_LINK_MARGIN	127
+
+/* state */
+#define WL_P2P_DISC_ST_SCAN	0
+#define WL_P2P_DISC_ST_LISTEN	1
+#define WL_P2P_DISC_ST_SEARCH	2
+
+/* i/f type */
+#define WL_P2P_IF_CLIENT	0
+#define WL_P2P_IF_GO		1
+#define WL_P2P_IF_DYNBCN_GO	2
+#define WL_P2P_IF_DEV		3
+
+/* count */
+#define WL_P2P_SCHED_RSVD	0
+#define WL_P2P_SCHED_REPEAT	255	/* anything > 255 will be treated as 255 */
+
+#define WL_P2P_SCHED_FIXED_LEN		3
+
+/* schedule type */
+#define WL_P2P_SCHED_TYPE_ABS		0	/* Scheduled Absence */
+#define WL_P2P_SCHED_TYPE_REQ_ABS	1	/* Requested Absence */
+
+/* schedule action during absence periods (for WL_P2P_SCHED_ABS type) */
+#define WL_P2P_SCHED_ACTION_NONE	0	/* no action */
+#define WL_P2P_SCHED_ACTION_DOZE	1	/* doze */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_ACTION_GOOFF	2	/* turn off GO beacon/prbrsp functions */
+/* schedule option - WL_P2P_SCHED_TYPE_XXX */
+#define WL_P2P_SCHED_ACTION_RESET	255	/* reset */
+
+/* schedule option - WL_P2P_SCHED_TYPE_ABS */
+#define WL_P2P_SCHED_OPTION_NORMAL	0	/* normal start/interval/duration/count */
+#define WL_P2P_SCHED_OPTION_BCNPCT	1	/* percentage of beacon interval */
+/* schedule option - WL_P2P_SCHED_TYPE_REQ_ABS */
+#define WL_P2P_SCHED_OPTION_TSFOFS	2	/* normal start/internal/duration/count with
+						 * start being an offset of the 'current' TSF
+						 */
+
+/* feature flags */
+#define WL_P2P_FEAT_GO_CSA	(1 << 0)	/* GO moves with the STA using CSA method */
+#define WL_P2P_FEAT_GO_NOLEGACY	(1 << 1)	/* GO does not probe respond to non-p2p probe
+						 * requests
+						 */
+#define WL_P2P_FEAT_RESTRICT_DEV_RESP (1 << 2)	/* Restrict p2p dev interface from responding */
+
+/* n-mode support capability */
+/* 2x2 includes both 1x1 & 2x2 devices
+ * reserved #define 2 for future when we want to separate 1x1 & 2x2 and
+ * control it independently
+ */
+#define WL_11N_2x2			1
+#define WL_11N_3x3			3
+#define WL_11N_4x4			4
+
+/* define 11n feature disable flags */
+#define WLFEATURE_DISABLE_11N		0x00000001
+#define WLFEATURE_DISABLE_11N_STBC_TX	0x00000002
+#define WLFEATURE_DISABLE_11N_STBC_RX	0x00000004
+#define WLFEATURE_DISABLE_11N_SGI_TX	0x00000008
+#define WLFEATURE_DISABLE_11N_SGI_RX	0x00000010
+#define WLFEATURE_DISABLE_11N_AMPDU_TX	0x00000020
+#define WLFEATURE_DISABLE_11N_AMPDU_RX	0x00000040
+#define WLFEATURE_DISABLE_11N_GF	0x00000080
+
+/* Proxy STA modes */
+#define PSTA_MODE_DISABLED		0
+#define PSTA_MODE_PROXY			1
+#define PSTA_MODE_REPEATER		2
+
+/* op code in nat_cfg */
+#define NAT_OP_ENABLE		1	/* enable NAT on given interface */
+#define NAT_OP_DISABLE		2	/* disable NAT on given interface */
+#define NAT_OP_DISABLE_ALL	3	/* disable NAT on all interfaces */
+
+/* NAT state */
+#define NAT_STATE_ENABLED	1	/* NAT is enabled */
+#define NAT_STATE_DISABLED	2	/* NAT is disabled */
+
+#define CHANNEL_5G_LOW_START	36	/* 5G low (36..48) CDD enable/disable bit mask */
+#define CHANNEL_5G_MID_START	52	/* 5G mid (52..64) CDD enable/disable bit mask */
+#define CHANNEL_5G_HIGH_START	100	/* 5G high (100..140) CDD enable/disable bit mask */
+#define CHANNEL_5G_UPPER_START	149	/* 5G upper (149..161) CDD enable/disable bit mask */
+
+/* D0 Coalescing */
+#define IPV4_ARP_FILTER		0x0001
+#define IPV4_NETBT_FILTER	0x0002
+#define IPV4_LLMNR_FILTER	0x0004
+#define IPV4_SSDP_FILTER	0x0008
+#define IPV4_WSD_FILTER		0x0010
+#define IPV6_NETBT_FILTER	0x0200
+#define IPV6_LLMNR_FILTER	0x0400
+#define IPV6_SSDP_FILTER	0x0800
+#define IPV6_WSD_FILTER		0x1000
+
+/* Network Offload Engine */
+#define NWOE_OL_ENABLE		0x00000001
+
+/*
+ * Traffic management structures/defines.
+ */
+
+/* Traffic management bandwidth parameters */
+#define TRF_MGMT_MAX_PRIORITIES                 3
+
+#define TRF_MGMT_FLAG_ADD_DSCP                  0x0001  /* Add DSCP to IP TOS field */
+#define TRF_MGMT_FLAG_DISABLE_SHAPING           0x0002  /* Don't shape traffic */
+#define TRF_MGMT_FLAG_MANAGE_LOCAL_TRAFFIC      0x0008  /* Manage traffic over our local subnet */
+#define TRF_MGMT_FLAG_FILTER_ON_MACADDR         0x0010  /* filter on MAC address */
+#define TRF_MGMT_FLAG_NO_RX                     0x0020  /* do not apply fiters to rx packets */
+
+#define TRF_FILTER_MAC_ADDR              0x0001 /* L2 filter use dst mac address for filtering */
+#define TRF_FILTER_IP_ADDR               0x0002 /* L3 filter use ip ddress for filtering */
+#define TRF_FILTER_L4                    0x0004 /* L4 filter use tcp/udp for filtering */
+#define TRF_FILTER_DWM                   0x0008 /* L3 filter use DSCP for filtering */
+#define TRF_FILTER_FAVORED               0x0010 /* Tag the packet FAVORED */
+
+/* WNM/NPS subfeatures mask */
+#define WL_WNM_BSSTRANS		0x00000001
+#define WL_WNM_PROXYARP		0x00000002
+#define WL_WNM_MAXIDLE		0x00000004
+#define WL_WNM_TIMBC		0x00000008
+#define WL_WNM_TFS		0x00000010
+#define WL_WNM_SLEEP		0x00000020
+#define WL_WNM_DMS		0x00000040
+#define WL_WNM_FMS		0x00000080
+#define WL_WNM_NOTIF		0x00000100
+#define WL_WNM_MAX		0x00000200
+
+#ifndef ETHER_MAX_DATA
+#define ETHER_MAX_DATA	1500
+#endif /* ETHER_MAX_DATA */
+
+/* Different discovery modes for dpt */
+#define	DPT_DISCOVERY_MANUAL	0x01	/* manual discovery mode */
+#define	DPT_DISCOVERY_AUTO	0x02	/* auto discovery mode */
+#define	DPT_DISCOVERY_SCAN	0x04	/* scan-based discovery mode */
+
+/* different path selection values */
+#define DPT_PATHSEL_AUTO	0	/* auto mode for path selection */
+#define DPT_PATHSEL_DIRECT	1	/* always use direct DPT path */
+#define DPT_PATHSEL_APPATH	2	/* always use AP path */
+
+/* different ops for deny list */
+#define DPT_DENY_LIST_ADD	1	/* add to dpt deny list */
+#define DPT_DENY_LIST_REMOVE	2	/* remove from dpt deny list */
+
+/* different ops for manual end point */
+#define DPT_MANUAL_EP_CREATE	1	/* create manual dpt endpoint */
+#define DPT_MANUAL_EP_MODIFY	2	/* modify manual dpt endpoint */
+#define DPT_MANUAL_EP_DELETE	3	/* delete manual dpt endpoint */
+
+/* flags to indicate DPT status */
+#define	DPT_STATUS_ACTIVE	0x01	/* link active (though may be suspended) */
+#define	DPT_STATUS_AES		0x02	/* link secured through AES encryption */
+#define	DPT_STATUS_FAILED	0x04	/* DPT link failed */
+
+#ifdef WLTDLS
+/* different ops for manual end point */
+#define TDLS_MANUAL_EP_CREATE	1	/* create manual dpt endpoint */
+#define TDLS_MANUAL_EP_MODIFY	2	/* modify manual dpt endpoint */
+#define TDLS_MANUAL_EP_DELETE	3	/* delete manual dpt endpoint */
+#define TDLS_MANUAL_EP_PM		4	/*  put dpt endpoint in PM mode */
+#define TDLS_MANUAL_EP_WAKE		5	/* wake up dpt endpoint from PM */
+#define TDLS_MANUAL_EP_DISCOVERY	6	/* discover if endpoint is TDLS capable */
+#define TDLS_MANUAL_EP_CHSW		7	/* channel switch */
+#define TDLS_MANUAL_EP_WFD_TPQ	8	/* WiFi-Display Tunneled Probe reQuest */
+
+/* modes */
+#define TDLS_WFD_IE_TX			0
+#define TDLS_WFD_IE_RX			1
+#define TDLS_WFD_PROBE_IE_TX	2
+#define TDLS_WFD_PROBE_IE_RX	3
+#endif /* WLTDLS */
+
+/* define for flag */
+#define TSPEC_PENDING		0	/* TSPEC pending */
+#define TSPEC_ACCEPTED		1	/* TSPEC accepted */
+#define TSPEC_REJECTED		2	/* TSPEC rejected */
+#define TSPEC_UNKNOWN		3	/* TSPEC unknown */
+#define TSPEC_STATUS_MASK	7	/* TSPEC status mask */
+
+#ifdef BCMCCX
+/* "wlan_reason" iovar interface */
+#define WL_WLAN_ASSOC_REASON_NORMAL_NETWORK	0 /* normal WLAN network setup */
+#define WL_WLAN_ASSOC_REASON_ROAM_FROM_CELLULAR_NETWORK	1 /* roam from Cellular network */
+#define WL_WLAN_ASSOC_REASON_ROAM_FROM_LAN	2 /* roam from LAN */
+#define WL_WLAN_ASSOC_REASON_MAX		2 /* largest value allowed */
+#endif /* BCMCCX */
+
+/* Software feature flag defines used by wlfeatureflag */
+#ifdef WLAFTERBURNER
+#define WL_SWFL_ABBFL       0x0001 /* Allow Afterburner on systems w/o hardware BFL */
+#define WL_SWFL_ABENCORE    0x0002 /* Allow AB on non-4318E chips */
+#endif /* WLAFTERBURNER */
+#define WL_SWFL_NOHWRADIO	0x0004
+#define WL_SWFL_FLOWCONTROL     0x0008 /* Enable backpressure to OS stack */
+#define WL_SWFL_WLBSSSORT	0x0010 /* Per-port supports sorting of BSS */
+
+#define WL_LIFETIME_MAX 0xFFFF /* Max value in ms */
+
+#define CSA_BROADCAST_ACTION_FRAME	0	/* csa broadcast action frame */
+#define CSA_UNICAST_ACTION_FRAME	  1 /* csa unicast action frame */
+
+/* Roaming trigger definitions for WLC_SET_ROAM_TRIGGER.
+ *
+ * (-100 < value < 0)   value is used directly as a roaming trigger in dBm
+ * (0 <= value) value specifies a logical roaming trigger level from
+ *                      the list below
+ *
+ * WLC_GET_ROAM_TRIGGER always returns roaming trigger value in dBm, never
+ * the logical roam trigger value.
+ */
+#define WLC_ROAM_TRIGGER_DEFAULT	0 /* default roaming trigger */
+#define WLC_ROAM_TRIGGER_BANDWIDTH	1 /* optimize for bandwidth roaming trigger */
+#define WLC_ROAM_TRIGGER_DISTANCE	2 /* optimize for distance roaming trigger */
+#define WLC_ROAM_TRIGGER_AUTO		3 /* auto-detect environment */
+#define WLC_ROAM_TRIGGER_MAX_VALUE	3 /* max. valid value */
+
+#define WLC_ROAM_NEVER_ROAM_TRIGGER	(-100) /* Avoid Roaming by setting a large value */
+
+/* Preferred Network Offload (PNO, formerly PFN) defines */
+#define WPA_AUTH_PFN_ANY	0xffffffff	/* for PFN, match only ssid */
+
+#define SORT_CRITERIA_BIT		0
+#define AUTO_NET_SWITCH_BIT		1
+#define ENABLE_BKGRD_SCAN_BIT		2
+#define IMMEDIATE_SCAN_BIT		3
+#define	AUTO_CONNECT_BIT		4
+#define	ENABLE_BD_SCAN_BIT		5
+#define ENABLE_ADAPTSCAN_BIT		6
+#define IMMEDIATE_EVENT_BIT		8
+#define SUPPRESS_SSID_BIT		9
+#define ENABLE_NET_OFFLOAD_BIT		10
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_BIT		11
+#define BESTN_BSSID_ONLY_BIT		12
+
+#define SORT_CRITERIA_MASK		0x0001
+#define AUTO_NET_SWITCH_MASK		0x0002
+#define ENABLE_BKGRD_SCAN_MASK		0x0004
+#define IMMEDIATE_SCAN_MASK		0x0008
+#define	AUTO_CONNECT_MASK		0x0010
+
+#define ENABLE_BD_SCAN_MASK		0x0020
+#define ENABLE_ADAPTSCAN_MASK		0x00c0
+#define IMMEDIATE_EVENT_MASK		0x0100
+#define SUPPRESS_SSID_MASK		0x0200
+#define ENABLE_NET_OFFLOAD_MASK		0x0400
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_MASK		0x0800
+#define BESTN_BSSID_ONLY_MASK		0x1000
+
+#define PFN_VERSION			2
+#define PFN_SCANRESULT_VERSION		1
+#define MAX_PFN_LIST_COUNT		16
+
+#define PFN_COMPLETE			1
+#define PFN_INCOMPLETE			0
+
+#define DEFAULT_BESTN			2
+#define DEFAULT_MSCAN			0
+#define DEFAULT_REPEAT			10
+#define DEFAULT_EXP				2
+
+#define PFN_PARTIAL_SCAN_BIT		0
+#define PFN_PARTIAL_SCAN_MASK		1
+
+#define WL_PFN_SUPPRESSFOUND_MASK	0x08
+#define WL_PFN_SUPPRESSLOST_MASK	0x10
+#define WL_PFN_RSSI_MASK		0xff00
+#define WL_PFN_RSSI_SHIFT		8
+
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+
+#define WL_PFN_CFG_FLAGS_PROHIBITED	0x00000001	/* Accept and use prohibited channels */
+#define WL_PFN_CFG_FLAGS_HISTORY_OFF	0x00000002	/* Scan history suppressed */
+
+#define WL_PFN_HIDDEN_BIT		2
+#define PNO_SCAN_MAX_FW			508*1000	/* max time scan time in msec */
+#define PNO_SCAN_MAX_FW_SEC		PNO_SCAN_MAX_FW/1000 /* max time scan time in SEC */
+#define PNO_SCAN_MIN_FW_SEC		10			/* min time scan time in SEC */
+#define WL_PFN_HIDDEN_MASK		0x4
+
+#ifndef BESTN_MAX
+#define BESTN_MAX			8
+#endif
+
+#ifndef MSCAN_MAX
+#define MSCAN_MAX			32
+#endif
+
+/* TCP Checksum Offload error injection for testing */
+#define TOE_ERRTEST_TX_CSUM	0x00000001
+#define TOE_ERRTEST_RX_CSUM	0x00000002
+#define TOE_ERRTEST_RX_CSUM2	0x00000004
+
+/* ARP Offload feature flags for arp_ol iovar */
+#define ARP_OL_AGENT		0x00000001
+#define ARP_OL_SNOOP		0x00000002
+#define ARP_OL_HOST_AUTO_REPLY	0x00000004
+#define ARP_OL_PEER_AUTO_REPLY	0x00000008
+
+/* ARP Offload error injection */
+#define ARP_ERRTEST_REPLY_PEER	0x1
+#define ARP_ERRTEST_REPLY_HOST	0x2
+
+#define ARP_MULTIHOMING_MAX	8	/* Maximum local host IP addresses */
+#define ND_MULTIHOMING_MAX 10	/* Maximum local host IP addresses */
+#define ND_REQUEST_MAX		5	/* Max set of offload params */
+
+
+/* AOAC wake event flag */
+#define WAKE_EVENT_NLO_DISCOVERY_BIT		1
+#define WAKE_EVENT_AP_ASSOCIATION_LOST_BIT	2
+#define WAKE_EVENT_GTK_HANDSHAKE_ERROR_BIT 4
+#define WAKE_EVENT_4WAY_HANDSHAKE_REQUEST_BIT 8
+
+
+#define MAX_NUM_WOL_PATTERN	22 /* LOGO requirements min 22 */
+
+
+/* Packet filter operation mode */
+/* True: 1; False: 0 */
+#define PKT_FILTER_MODE_FORWARD_ON_MATCH		1
+/* Enable and disable pkt_filter as a whole */
+#define PKT_FILTER_MODE_DISABLE					2
+/* Cache first matched rx pkt(be queried by host later) */
+#define PKT_FILTER_MODE_PKT_CACHE_ON_MATCH		4
+/* If pkt_filter is enabled and no filter is set, don't forward anything */
+#define PKT_FILTER_MODE_PKT_FORWARD_OFF_DEFAULT 8
+
+#ifdef DONGLEOVERLAYS
+#define OVERLAY_IDX_MASK		0x000000ff
+#define OVERLAY_IDX_SHIFT		0
+#define OVERLAY_FLAGS_MASK		0xffffff00
+#define OVERLAY_FLAGS_SHIFT		8
+/* overlay written to device memory immediately after loading the base image */
+#define OVERLAY_FLAG_POSTLOAD	0x100
+/* defer overlay download until the device responds w/WLC_E_OVL_DOWNLOAD event */
+#define OVERLAY_FLAG_DEFER_DL	0x200
+/* overlay downloaded prior to the host going to sleep */
+#define OVERLAY_FLAG_PRESLEEP	0x400
+#define OVERLAY_DOWNLOAD_CHUNKSIZE	1024
+#endif /* DONGLEOVERLAYS */
+
+/* reuse two number in the sc/rc space */
+#define	SMFS_CODE_MALFORMED 0xFFFE
+#define SMFS_CODE_IGNORED	0xFFFD
+
+/* RFAWARE def */
+#define BCM_ACTION_RFAWARE		0x77
+#define BCM_ACTION_RFAWARE_DCS  0x01
+
+/* DCS reason code define */
+#define BCM_DCS_IOVAR		0x1
+#define BCM_DCS_UNKNOWN		0xFF
+
+
+#ifdef PROP_TXSTATUS
+/* Bit definitions for tlv iovar */
+/*
+ * enable RSSI signals:
+ * WLFC_CTL_TYPE_RSSI
+ */
+#define WLFC_FLAGS_RSSI_SIGNALS			0x0001
+
+/* enable (if/mac_open, if/mac_close,, mac_add, mac_del) signals:
+ *
+ * WLFC_CTL_TYPE_MAC_OPEN
+ * WLFC_CTL_TYPE_MAC_CLOSE
+ *
+ * WLFC_CTL_TYPE_INTERFACE_OPEN
+ * WLFC_CTL_TYPE_INTERFACE_CLOSE
+ *
+ * WLFC_CTL_TYPE_MACDESC_ADD
+ * WLFC_CTL_TYPE_MACDESC_DEL
+ *
+ */
+#define WLFC_FLAGS_XONXOFF_SIGNALS		0x0002
+
+/* enable (status, fifo_credit, mac_credit) signals
+ * WLFC_CTL_TYPE_MAC_REQUEST_CREDIT
+ * WLFC_CTL_TYPE_TXSTATUS
+ * WLFC_CTL_TYPE_FIFO_CREDITBACK
+ */
+#define WLFC_FLAGS_CREDIT_STATUS_SIGNALS	0x0004
+
+#define WLFC_FLAGS_HOST_PROPTXSTATUS_ACTIVE	0x0008
+#define WLFC_FLAGS_PSQ_GENERATIONFSM_ENABLE	0x0010
+#define WLFC_FLAGS_PSQ_ZERO_BUFFER_ENABLE	0x0020
+#define WLFC_FLAGS_HOST_RXRERODER_ACTIVE	0x0040
+#define WLFC_FLAGS_PKT_STAMP_SIGNALS		0x0080
+
+#endif /* PROP_TXSTATUS */
+
+#define WL_TIMBC_STATUS_AP_UNKNOWN	255	/* AP status for internal use only */
+
+#define WL_DFRTS_LOGIC_OFF	0	/* Feature is disabled */
+#define WL_DFRTS_LOGIC_OR	1	/* OR all non-zero threshold conditions */
+#define WL_DFRTS_LOGIC_AND	2	/* AND all non-zero threshold conditions */
+
+/* Definitions for Reliable Multicast */
+#define WL_RELMCAST_MAX_CLIENT		32
+#define WL_RELMCAST_FLAG_INBLACKLIST	1
+#define WL_RELMCAST_FLAG_ACTIVEACKER	2
+#define WL_RELMCAST_FLAG_RELMCAST	4
+
+/* structures for proximity detection device role */
+#define WL_PROXD_MODE_DISABLE	0
+#define WL_PROXD_MODE_NEUTRAL	1
+#define WL_PROXD_MODE_INITIATOR	2
+#define WL_PROXD_MODE_TARGET	3
+#define WL_PROXD_RANDOM_WAKEUP	0x8000
+
+
+#ifdef NET_DETECT
+#define NET_DETECT_MAX_WAKE_DATA_SIZE	2048
+#define NET_DETECT_MAX_PROFILES		16
+#define NET_DETECT_MAX_CHANNELS		50
+#endif /* NET_DETECT */
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* Bit masks for radio disabled status - returned by WL_GET_RADIO */
+#define WL_RADIO_SW_DISABLE		(1<<0)
+#define WL_RADIO_HW_DISABLE		(1<<1)
+#define WL_RADIO_MPC_DISABLE		(1<<2)
+#define WL_RADIO_COUNTRY_DISABLE	(1<<3)	/* some countries don't support any channel */
+
+#define	WL_SPURAVOID_OFF	0
+#define	WL_SPURAVOID_ON1	1
+#define	WL_SPURAVOID_ON2	2
+
+
+#define WL_4335_SPURAVOID_ON1	1
+#define WL_4335_SPURAVOID_ON2	2
+#define WL_4335_SPURAVOID_ON3	3
+#define WL_4335_SPURAVOID_ON4	4
+#define WL_4335_SPURAVOID_ON5	5
+#define WL_4335_SPURAVOID_ON6	6
+#define WL_4335_SPURAVOID_ON7	7
+#define WL_4335_SPURAVOID_ON8	8
+#define WL_4335_SPURAVOID_ON9	9
+
+/* Override bit for WLC_SET_TXPWR.  if set, ignore other level limits */
+#define WL_TXPWR_OVERRIDE	(1U<<31)
+#define WL_TXPWR_NEG   (1U<<30)
+
+
+/* phy types (returned by WLC_GET_PHYTPE) */
+#define	WLC_PHY_TYPE_A		0
+#define	WLC_PHY_TYPE_B		1
+#define	WLC_PHY_TYPE_G		2
+#define	WLC_PHY_TYPE_N		4
+#define	WLC_PHY_TYPE_LP		5
+#define	WLC_PHY_TYPE_SSN	6
+#define	WLC_PHY_TYPE_HT		7
+#define	WLC_PHY_TYPE_LCN	8
+#define	WLC_PHY_TYPE_LCN40	10
+#define WLC_PHY_TYPE_AC		11
+#define	WLC_PHY_TYPE_NULL	0xf
+
+/* Values for PM */
+#define PM_OFF	0
+#define PM_MAX	1
+#define PM_FAST 2
+#define PM_FORCE_OFF 3		/* use this bit to force PM off even bt is active */
+
+#define WL_WME_CNT_VERSION	1	/* current version of wl_wme_cnt_t */
+
+/* fbt_cap: FBT assoc / reassoc modes. */
+#define WLC_FBT_CAP_DRV_4WAY_AND_REASSOC  1 /* Driver 4-way handshake & reassoc (WLFBT). */
+
+/* monitor_promisc_level bits */
+#define WL_MONPROMISC_PROMISC 0x0001
+#define WL_MONPROMISC_CTRL 0x0002
+#define WL_MONPROMISC_FCS 0x0004
+
+/* TCP Checksum Offload defines */
+#define TOE_TX_CSUM_OL		0x00000001
+#define TOE_RX_CSUM_OL		0x00000002
+
+/* Wi-Fi Display Services (WFDS) */
+#define WL_P2P_SOCIAL_CHANNELS_MAX  WL_NUMCHANNELS
+#define MAX_WFDS_SEEK_SVC 4	/* Max # of wfds services to seek */
+#define MAX_WFDS_ADVERT_SVC 4	/* Max # of wfds services to advertise */
+#define MAX_WFDS_SVC_NAME_LEN 200	/* maximum service_name length */
+#define MAX_WFDS_ADV_SVC_INFO_LEN 65000	/* maximum adv service_info length */
+#define P2P_WFDS_HASH_LEN 6		/* Length of a WFDS service hash */
+#define MAX_WFDS_SEEK_SVC_INFO_LEN 255	/* maximum seek service_info req length */
+#define MAX_WFDS_SEEK_SVC_NAME_LEN 200	/* maximum service_name length */
+
+/* ap_isolate bitmaps */
+#define AP_ISOLATE_DISABLED		0x0
+#define AP_ISOLATE_SENDUP_ALL		0x01
+#define AP_ISOLATE_SENDUP_MCAST		0x02
+
+#endif /* wlioctl_defs_h */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/dhdioctl.h b/drivers/net/wireless/bcm4336/include/dhdioctl.h
--- a/drivers/net/wireless/bcm4336/include/dhdioctl.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/dhdioctl.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,123 @@
+/*
+ * Definitions for ioctls to access DHD iovars.
+ * Based on wlioctl.h (for Broadcom 802.11abg driver).
+ * (Moves towards generic ioctls for BCM drivers/iovars.)
+ *
+ * Definitions subject to change without notice.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: dhdioctl.h 438755 2013-11-22 23:20:40Z $
+ */
+
+#ifndef _dhdioctl_h_
+#define	_dhdioctl_h_
+
+#include <typedefs.h>
+
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+
+/* Linux network driver ioctl encoding */
+typedef struct dhd_ioctl {
+	uint cmd;	/* common ioctl definition */
+	void *buf;	/* pointer to user buffer */
+	uint len;	/* length of user buffer */
+	bool set;	/* get or set request (optional) */
+	uint used;	/* bytes read or written (optional) */
+	uint needed;	/* bytes needed (optional) */
+	uint driver;	/* to identify target driver */
+} dhd_ioctl_t;
+
+/* Underlying BUS definition */
+enum {
+	BUS_TYPE_USB = 0, /* for USB dongles */
+	BUS_TYPE_SDIO, /* for SDIO dongles */
+	BUS_TYPE_PCIE /* for PCIE dongles */
+};
+
+/* per-driver magic numbers */
+#define DHD_IOCTL_MAGIC		0x00444944
+
+/* bump this number if you change the ioctl interface */
+#define DHD_IOCTL_VERSION	1
+
+#define	DHD_IOCTL_MAXLEN	8192		/* max length ioctl buffer required */
+#define	DHD_IOCTL_SMLEN		256		/* "small" length ioctl buffer required */
+
+/* common ioctl definitions */
+#define DHD_GET_MAGIC				0
+#define DHD_GET_VERSION				1
+#define DHD_GET_VAR				2
+#define DHD_SET_VAR				3
+
+/* message levels */
+#define DHD_ERROR_VAL	0x0001
+#define DHD_TRACE_VAL	0x0002
+#define DHD_INFO_VAL	0x0004
+#define DHD_DATA_VAL	0x0008
+#define DHD_CTL_VAL	0x0010
+#define DHD_TIMER_VAL	0x0020
+#define DHD_HDRS_VAL	0x0040
+#define DHD_BYTES_VAL	0x0080
+#define DHD_INTR_VAL	0x0100
+#define DHD_LOG_VAL	0x0200
+#define DHD_GLOM_VAL	0x0400
+#define DHD_EVENT_VAL	0x0800
+#define DHD_BTA_VAL	0x1000
+#if 0 && (NDISVER >= 0x0630) && 1
+#define DHD_SCAN_VAL	0x2000
+#else
+#define DHD_ISCAN_VAL	0x2000
+#endif
+#define DHD_ARPOE_VAL	0x4000
+#define DHD_REORDER_VAL	0x8000
+#define DHD_NOCHECKDIED_VAL		0x20000 /* UTF WAR */
+#define DHD_PNO_VAL		0x80000
+#define DHD_ANDROID_VAL	0x10000
+#define DHD_IW_VAL	0x20000
+#define DHD_CFG_VAL	0x40000
+#define DHD_CONFIG_VAL	0x80000
+
+#ifdef SDTEST
+/* For pktgen iovar */
+typedef struct dhd_pktgen {
+	uint version;		/* To allow structure change tracking */
+	uint freq;		/* Max ticks between tx/rx attempts */
+	uint count;		/* Test packets to send/rcv each attempt */
+	uint print;		/* Print counts every <print> attempts */
+	uint total;		/* Total packets (or bursts) */
+	uint minlen;		/* Minimum length of packets to send */
+	uint maxlen;		/* Maximum length of packets to send */
+	uint numsent;		/* Count of test packets sent */
+	uint numrcvd;		/* Count of test packets received */
+	uint numfail;		/* Count of test send failures */
+	uint mode;		/* Test mode (type of test packets) */
+	uint stop;		/* Stop after this many tx failures */
+} dhd_pktgen_t;
+
+/* Version in case structure changes */
+#define DHD_PKTGEN_VERSION 2
+
+/* Type of test packets to use */
+#define DHD_PKTGEN_ECHO		1 /* Send echo requests */
+#define DHD_PKTGEN_SEND 	2 /* Send discard packets */
+#define DHD_PKTGEN_RXBURST	3 /* Request dongle send N packets */
+#define DHD_PKTGEN_RECV		4 /* Continuous rx from continuous tx dongle */
+#endif /* SDTEST */
+
+/* Enter idle immediately (no timeout) */
+#define DHD_IDLE_IMMEDIATE	(-1)
+
+/* Values for idleclock iovar: other values are the sd_divisor to use when idle */
+#define DHD_IDLE_ACTIVE	0	/* Do not request any SD clock change when idle */
+#define DHD_IDLE_STOP   (-1)	/* Request SD clock be stopped (and use SD1 mode) */
+
+
+/* require default structure packing */
+#include <packed_section_end.h>
+
+#endif /* _dhdioctl_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/epivers.h b/drivers/net/wireless/bcm4336/include/epivers.h
--- a/drivers/net/wireless/bcm4336/include/epivers.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/epivers.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,30 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: epivers.h.in,v 13.33 2010-09-08 22:08:53 $
+ *
+*/
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#define	EPI_MAJOR_VERSION	1
+
+#define	EPI_MINOR_VERSION	201
+
+#define	EPI_RC_NUMBER		59
+
+#define	EPI_INCREMENTAL_NUMBER	0
+
+#define	EPI_BUILD_NUMBER	0
+
+#define	EPI_VERSION		1, 201, 59, 0
+
+#define	EPI_VERSION_NUM		0x01c93b00
+
+#define EPI_VERSION_DEV		1.201.59
+
+/* Driver Version String, ASCII, 32 chars max */
+#define	EPI_VERSION_STR		"1.201.59.5 (r506368)"
+
+#endif /* _epivers_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/epivers.h.in b/drivers/net/wireless/bcm4336/include/epivers.h.in
--- a/drivers/net/wireless/bcm4336/include/epivers.h.in	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/epivers.h.in	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,30 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: epivers.h.in,v 13.33 2010-09-08 22:08:53 $
+ *
+*/
+
+#ifndef _epivers_h_
+#define _epivers_h_
+
+#define	EPI_MAJOR_VERSION	@EPI_MAJOR_VERSION@
+
+#define	EPI_MINOR_VERSION	@EPI_MINOR_VERSION@
+
+#define	EPI_RC_NUMBER		@EPI_RC_NUMBER@
+
+#define	EPI_INCREMENTAL_NUMBER	@EPI_INCREMENTAL_NUMBER@
+
+#define	EPI_BUILD_NUMBER	@EPI_BUILD_NUMBER@
+
+#define	EPI_VERSION		@EPI_VERSION@
+
+#define	EPI_VERSION_NUM		@EPI_VERSION_NUM@
+
+#define EPI_VERSION_DEV		@EPI_VERSION_DEV@
+
+/* Driver Version String, ASCII, 32 chars max */
+#define	EPI_VERSION_STR		"@EPI_VERSION_STR@@EPI_VERSION_TYPE@ (@VC_VERSION_NUM@)"
+
+#endif /* _epivers_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/epivers.sh b/drivers/net/wireless/bcm4336/include/epivers.sh
--- a/drivers/net/wireless/bcm4336/include/epivers.sh	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/epivers.sh	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,333 @@
+#! /bin/bash
+#
+# Create the epivers.h file from epivers.h.in
+#
+# Epivers.h version support svn/sparse/gclient workspaces
+#
+# $Id: epivers.sh 389103 2013-03-05 17:24:49Z $
+#
+# Version generation works off of svn property HeadURL, if
+# not set it keys its versions from current svn workspace or
+# via .gclient_info deps contents
+#
+# GetCompVer.py return value and action needed
+#    i. trunk => use current date as version string
+#   ii. local => use SVNURL expanded by HeadURL keyword
+#  iii. <tag> => use it as as is
+#                (some components can override and say give me native ver)
+#   iv. empty =>
+#             a) If TAG is specified use it
+#             a) If no TAG is specified use date
+#
+# Contact: Prakash Dhavali
+# Contact: hnd-software-scm-list
+#
+
+# If the version header file already exists, increment its build number.
+# Otherwise, create a new file.
+if [ -f epivers.h ]; then
+
+	# If REUSE_VERSION is set, epivers iteration is not incremented
+	# This can be used precommit and continuous integration projects
+	if [ -n "$REUSE_VERSION" ]; then
+		echo "Previous epivers.h exists. Skipping version increment"
+		exit 0
+	fi
+
+	build=$(grep EPI_BUILD_NUMBER epivers.h | sed -e "s,.*BUILD_NUMBER[ 	]*,,")
+	build=$(expr ${build} + 1)
+	echo build=${build}
+	sed -e "s,.*_BUILD_NUMBER.*,#define EPI_BUILD_NUMBER	${build}," \
+		< epivers.h > epivers.h.new
+	cp -p epivers.h epivers.h.prev
+	mv epivers.h.new epivers.h
+	exit 0
+
+else # epivers.h doesn't exist
+
+	SVNCMD=${SVNCMD:-"svn --non-interactive"}
+	SRCBASE=${SRCBASE:-..}
+	NULL=/dev/null
+	[ -z "$VERBOSE" ] || NULL=/dev/stderr
+
+	# Check for the in file, if not there we're in the wrong directory
+	if [ ! -f epivers.h.in ]; then
+		echo "ERROR: No epivers.h.in found"
+		exit 1
+	fi
+
+	# Following SVNURL should be expanded on checkout
+	SVNURL='$HeadURL: http://svn.sj.broadcom.com/svn/wlansvn/proj/tags/DHD/DHD_REL_1_201_59/src/include/epivers.sh $'
+
+	# .gclient_info is created by gclient checkout/sync steps
+	# and contains "DEPS='<deps-url1> <deps-url2> ..." entry
+	GCLIENT_INFO=${GCLIENT_INFO:-${SRCBASE}/../.gclient_info}
+
+	# In gclient, derive SVNURL from gclient_info file
+	if [ -s "${GCLIENT_INFO}" ]; then
+		source ${GCLIENT_INFO}
+		if [ -z "$DEPS" ]; then
+			echo "ERROR: DEPS entry missing in $GCLIENT_INFO"
+			exit 1
+		else
+			for dep in $DEPS; do
+				SVNURL=${SVNURL:-$dep}
+				# Set SVNURL to first DEPS with /tags/ (if any)
+				if [[ $dep == */tags/* ]]; then
+					SVNURL=$dep
+					echo "INFO: Found gclient DEPS: $SVNURL"
+					break
+				fi
+			done
+		fi
+	elif [ -f "${GCLIENT_INFO}" ]; then
+		echo "ERROR: $GCLIENT_INFO exists, but it is empty"
+		exit 1
+	fi
+
+	# If SVNURL isn't expanded, extract it from svn info
+	if echo "$SVNURL" | egrep -vq 'HeadURL.*epivers.sh.*|http://.*/DEPS'; then
+		[ -n "$VERBOSE" ] && \
+			echo "DBG: SVN URL ($SVNURL) wasn't expanded. Getting it from svn info"
+		SVNURL=$($SVNCMD info epivers.sh 2> $NULL | egrep "^URL:")
+	fi
+
+	if echo "${TAG}" | grep -q "_BRANCH_\|_TWIG_"; then
+		branchtag=$TAG
+	else
+		branchtag=""
+	fi
+
+	# If this is a tagged build, use the tag to supply the numbers
+	# Tag should be in the form
+	#    <NAME>_REL_<MAJ>_<MINOR>
+	# or
+	#    <NAME>_REL_<MAJ>_<MINOR>_RC<RCNUM>
+	# or
+	#    <NAME>_REL_<MAJ>_<MINOR>_RC<RCNUM>_<INCREMENTAL>
+
+	MERGERLOG=${SRCBASE}/../merger_sources.log
+	GETCOMPVER=getcompver.py
+	GETCOMPVER_NET=/projects/hnd_software/gallery/src/tools/build/$GETCOMPVER
+	GETCOMPVER_NET_WIN=Z:${GETCOMPVER_NET}
+
+	#
+	# If there is a local copy GETCOMPVER use it ahead of network copy
+	#
+	if [ -s "$GETCOMPVER" ]; then
+	        GETCOMPVER_PATH="$GETCOMPVER"
+	elif [ -s "${SRCBASE}/../src/tools/build/$GETCOMPVER" ]; then
+	        GETCOMPVER_PATH="${SRCBASE}/../src/tools/build/$GETCOMPVER"
+	elif [ -s "$GETCOMPVER_NET" ]; then
+	        GETCOMPVER_PATH="$GETCOMPVER_NET"
+	elif [ -s "$GETCOMPVER_NET_WIN" ]; then
+	        GETCOMPVER_PATH="$GETCOMPVER_NET_WIN"
+	fi
+
+	#
+	# If $GETCOMPVER isn't found, fetch it from SVN
+	# (this should be very rare)
+	#
+	if [ ! -s "$GETCOMPVER_PATH" ]; then
+		[ -n "$VERBOSE" ] && \
+			echo "DBG: Fetching $GETCOMPVER from trunk"
+
+		$SVNCMD export -q \
+			^/proj/trunk/src/tools/build/${GETCOMPVER} \
+			${GETCOMPVER} 2> $NULL
+
+		GETCOMPVER_PATH=$GETCOMPVER
+	fi
+
+	# Now get tag for src/include from automerger log
+	[ -n "$VERBOSE" ] && \
+		echo "DBG: python $GETCOMPVER_PATH $MERGERLOG src/include"
+
+	COMPTAG=$(python $GETCOMPVER_PATH $MERGERLOG src/include 2> $NULL | sed -e 's/[[:space:]]*//g')
+
+	echo "DBG: Component Tag String Derived = $COMPTAG"
+
+	# Process COMPTAG values
+	# Rule:
+	# If trunk is returned, use date as component tag
+	# If LOCAL_COMPONENT is returned, use SVN URL to get native tag
+	# If component is returned or empty, assign it to SVNTAG
+	# GetCompVer.py return value and action needed
+	#    i. trunk => use current date as version string
+	#   ii. local => use SVNURL expanded by HeadURL keyword
+	#  iii. <tag> => use it as as is
+	#   iv. empty =>
+	#             a) If TAG is specified use it
+	#             a) If no TAG is specified use SVNURL from HeadURL
+
+	SVNURL_VER=false
+
+	if [ "$COMPTAG" == "" ]; then
+		SVNURL_VER=true
+	elif [ "$COMPTAG" == "LOCAL_COMPONENT" ]; then
+		SVNURL_VER=true
+	elif [ "$COMPTAG" == "trunk" ]; then
+		SVNTAG=$(date '+TRUNKCOMP_REL_%Y_%m_%d')
+	else
+		SVNTAG=$COMPTAG
+	fi
+
+	# Given SVNURL path conventions or naming conventions, derive SVNTAG
+	# TO-DO: SVNTAG derivation logic can move to a central common API
+	# TO-DO: ${SRCBASE}/tools/build/svnurl2tag.sh
+	if [ "$SVNURL_VER" == "true" ]; then
+		case "${SVNURL}" in
+			*_BRANCH_*)
+				SVNTAG=$(echo $SVNURL | tr '/' '\n' | awk '/_BRANCH_/{printf "%s",$1}')
+				;;
+			*_TWIG_*)
+				SVNTAG=$(echo $SVNURL | tr '/' '\n' | awk '/_TWIG_/{printf "%s",$1}')
+				;;
+			*_REL_*)
+				SVNTAG=$(echo $SVNURL | tr '/' '\n' | awk '/_REL_/{printf "%s",$1}')
+				;;
+			*/branches/*)
+				SVNTAG=${SVNURL#*/branches/}
+				SVNTAG=${SVNTAG%%/*}
+				;;
+			*/proj/tags/*|*/deps/tags/*)
+				SVNTAG=${SVNURL#*/tags/*/}
+				SVNTAG=${SVNTAG%%/*}
+				;;
+			*/trunk/*)
+				SVNTAG=$(date '+TRUNKURL_REL_%Y_%m_%d')
+				;;
+			*)
+				SVNTAG=$(date '+OTHER_REL_%Y_%m_%d')
+				;;
+		esac
+		echo "DBG: Native Tag String Derived from URL: $SVNTAG"
+	else
+		echo "DBG: Native Tag String Derived: $SVNTAG"
+	fi
+
+	TAG=${SVNTAG}
+
+	# Normalize the branch name portion to "D11" in case it has underscores in it
+	branch_name=$(expr match "$TAG" '\(.*\)_\(BRANCH\|TWIG\|REL\)_.*')
+		TAG=$(echo $TAG | sed -e "s%^$branch_name%D11%")
+
+	# Split the tag into an array on underbar or whitespace boundaries.
+	IFS="_	     " tag=(${TAG})
+	unset IFS
+
+	tagged=1
+	if [ ${#tag[*]} -eq 0 ]; then
+	   tag=($(date '+TOT REL %Y %m %d 0 %y'));
+	   # reconstruct a TAG from the date
+	   TAG=${tag[0]}_${tag[1]}_${tag[2]}_${tag[3]}_${tag[4]}_${tag[5]}
+	   tagged=0
+	fi
+
+	# Allow environment variable to override values.
+	# Missing values default to 0
+	#
+	maj=${EPI_MAJOR_VERSION:-${tag[2]:-0}}
+	min=${EPI_MINOR_VERSION:-${tag[3]:-0}}
+	rcnum=${EPI_RC_NUMBER:-${tag[4]:-0}}
+
+	# If increment field is 0, set it to date suffix if on TOB
+	if [ -n "$branchtag" ]; then
+		[ "${tag[5]:-0}" -eq 0 ] && echo "Using date suffix for incr"
+		today=${EPI_DATE_STR:-$(date '+%Y%m%d')}
+		incremental=${EPI_INCREMENTAL_NUMBER:-${tag[5]:-${today:-0}}}
+	else
+		incremental=${EPI_INCREMENTAL_NUMBER:-${tag[5]:-0}}
+	fi
+	origincr=${EPI_INCREMENTAL_NUMBER:-${tag[5]:-0}}
+	build=${EPI_BUILD_NUMBER:-0}
+
+	# Strip 'RC' from front of rcnum if present
+	rcnum=${rcnum/#RC/}
+
+	# strip leading zero off the number (otherwise they look like octal)
+	maj=${maj/#0/}
+	min=${min/#0/}
+	rcnum=${rcnum/#0/}
+	incremental=${incremental/#0/}
+	origincr=${origincr/#0/}
+	build=${build/#0/}
+
+	# some numbers may now be null.  replace with with zero.
+	maj=${maj:-0}
+	min=${min:-0}
+
+	rcnum=${rcnum:-0}
+	incremental=${incremental:-0}
+	origincr=${origincr:-0}
+	build=${build:-0}
+
+	if [ -n "$EPI_VERSION_NUM" ]; then
+	    vernum=$EPI_VERSION_NUM
+	elif [ ${tagged} -eq 1 ]; then
+	    # vernum is 32chars max
+	    vernum=$(printf "0x%02x%02x%02x%02x" ${maj} ${min} ${rcnum} ${origincr})
+	else
+	    vernum=$(printf "0x00%02x%02x%02x" ${tag[7]} ${min} ${rcnum})
+	fi
+
+	# make sure the size of vernum is under 32 bits.
+	# Otherwise, truncate. The string will keep full information.
+	vernum=${vernum:0:10}
+
+	# build the string directly from the tag, irrespective of its length
+	# remove the name , the tag type, then replace all _ by .
+	tag_ver_str=${TAG/${tag[0]}_}
+	tag_ver_str=${tag_ver_str/${tag[1]}_}
+	tag_ver_str=${tag_ver_str//_/.}
+
+	# record tag type
+	tagtype=
+
+	if [ "${tag[1]}" = "BRANCH" -o "${tag[1]}" = "TWIG" ]; then
+	   tagtype=" (TOB)"
+	   echo "tag type: $tagtype"
+	fi
+
+	echo "Effective version string: $tag_ver_str"
+
+	if [ "$(uname -s)" == "Darwin" ]; then
+	   # Mac does not like 2-digit numbers so convert the number to single
+	   # digit. 5.100 becomes 5.1
+	   if [ $min -gt 99 ]; then
+	       minmac=$(expr $min / 100)
+	   else
+	       minmac=$min
+	   fi
+	   epi_ver_dev="${maj}.${minmac}.0"
+	else
+	   epi_ver_dev="${maj}.${min}.${rcnum}"
+	fi
+
+	# Finally get version control revision number of <SRCBASE> (if any)
+	vc_version_num=$($SVNCMD info ${SRCBASE} 2> $NULL | awk -F': ' '/^Last Changed Rev: /{printf "%s", $2}')
+
+	# OK, go do it
+	echo "maj=${maj}, min=${min}, rc=${rcnum}, inc=${incremental}, build=${build}"
+
+	sed \
+		-e "s;@EPI_MAJOR_VERSION@;${maj};" \
+		-e "s;@EPI_MINOR_VERSION@;${min};" \
+		-e "s;@EPI_RC_NUMBER@;${rcnum};" \
+		-e "s;@EPI_INCREMENTAL_NUMBER@;${incremental};" \
+		-e "s;@EPI_BUILD_NUMBER@;${build};" \
+		-e "s;@EPI_VERSION@;${maj}, ${min}, ${rcnum}, ${incremental};" \
+		-e "s;@EPI_VERSION_STR@;${tag_ver_str};" \
+		-e "s;@EPI_VERSION_TYPE@;${tagtype};" \
+		-e "s;@VERSION_TYPE@;${tagtype};" \
+		-e "s;@EPI_VERSION_NUM@;${vernum};" \
+		-e "s;@EPI_VERSION_DEV@;${epi_ver_dev};" \
+		-e "s;@VC_VERSION_NUM@;r${vc_version_num};" \
+		< epivers.h.in > epivers.h
+
+	# In shared workspaces across different platforms, ensure that
+	# windows generated file is made platform neutral without CRLF
+	if uname -s | egrep -i -q "cygwin"; then
+	   dos2unix epivers.h > $NULL 2>&1
+	fi
+fi # epivers.h
diff -ENwbur a/drivers/net/wireless/bcm4336/include/event_log.h b/drivers/net/wireless/bcm4336/include/event_log.h
--- a/drivers/net/wireless/bcm4336/include/event_log.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/event_log.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,293 @@
+/*
+ * EVENT_LOG system definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: event_log.h 241182 2011-02-17 21:50:03Z $
+ */
+
+#ifndef _EVENT_LOG_H_
+#define _EVENT_LOG_H_
+
+#include <typedefs.h>
+
+/* Set a maximum number of sets here.  It is not dynamic for
+ *  efficiency of the EVENT_LOG calls.
+ */
+#define NUM_EVENT_LOG_SETS 4
+#define EVENT_LOG_SET_BUS	0
+#define EVENT_LOG_SET_WL	1
+#define EVENT_LOG_SET_PSM	2
+#define EVENT_LOG_SET_DBG	3
+
+/* Define new event log tags here */
+#define EVENT_LOG_TAG_NULL	0	/* Special null tag */
+#define EVENT_LOG_TAG_TS	1	/* Special timestamp tag */
+#define EVENT_LOG_TAG_BUS_OOB	2
+#define EVENT_LOG_TAG_BUS_STATE	3
+#define EVENT_LOG_TAG_BUS_PROTO	4
+#define EVENT_LOG_TAG_BUS_CTL	5
+#define EVENT_LOG_TAG_BUS_EVENT	6
+#define EVENT_LOG_TAG_BUS_PKT	7
+#define EVENT_LOG_TAG_BUS_FRAME	8
+#define EVENT_LOG_TAG_BUS_DESC	9
+#define EVENT_LOG_TAG_BUS_SETUP	10
+#define EVENT_LOG_TAG_BUS_MISC	11
+#define EVENT_LOG_TAG_SRSCAN		22
+#define EVENT_LOG_TAG_PWRSTATS_INFO	23
+#define EVENT_LOG_TAG_UCODE_WATCHDOG 26
+#define EVENT_LOG_TAG_UCODE_FIFO 27
+#define EVENT_LOG_TAG_SCAN_TRACE_LOW	28
+#define EVENT_LOG_TAG_SCAN_TRACE_HIGH	29
+#define EVENT_LOG_TAG_SCAN_ERROR	30
+#define EVENT_LOG_TAG_SCAN_WARN	31
+#define EVENT_LOG_TAG_MPF_ERR	32
+#define EVENT_LOG_TAG_MPF_WARN	33
+#define EVENT_LOG_TAG_MPF_INFO	34
+#define EVENT_LOG_TAG_MPF_DEBUG	35
+#define EVENT_LOG_TAG_EVENT_INFO	36
+#define EVENT_LOG_TAG_EVENT_ERR	37
+#define EVENT_LOG_TAG_PWRSTATS_ERROR	38
+#define EVENT_LOG_TAG_EXCESS_PM_ERROR	39
+#define EVENT_LOG_TAG_IOCTL_LOG			40
+#define EVENT_LOG_TAG_PFN_ERR	41
+#define EVENT_LOG_TAG_PFN_WARN	42
+#define EVENT_LOG_TAG_PFN_INFO	43
+#define EVENT_LOG_TAG_PFN_DEBUG	44
+#define EVENT_LOG_TAG_BEACON_LOG	45
+#define EVENT_LOG_TAG_WNM_BSSTRANS_INFO 46
+#define EVENT_LOG_TAG_TRACE_CHANSW 47
+#define EVENT_LOG_TAG_PCI_ERROR	48
+#define EVENT_LOG_TAG_PCI_TRACE	49
+#define EVENT_LOG_TAG_PCI_WARN	50
+#define EVENT_LOG_TAG_PCI_INFO	51
+#define EVENT_LOG_TAG_PCI_DBG	52
+#define EVENT_LOG_TAG_PCI_DATA  53
+#define EVENT_LOG_TAG_PCI_RING	54
+#define EVENT_LOG_TAG_MAX	55      /* Set to the same value of last tag, not last tag + 1 */
+/* Note: New event should be added/reserved in trunk before adding it to branches */
+
+/* Flags for tag control */
+#define EVENT_LOG_TAG_FLAG_NONE		0
+#define EVENT_LOG_TAG_FLAG_LOG		0x80
+#define EVENT_LOG_TAG_FLAG_PRINT	0x40
+#define EVENT_LOG_TAG_FLAG_MASK		0x3f
+
+/* logstrs header */
+#define LOGSTRS_MAGIC   0x4C4F4753
+#define LOGSTRS_VERSION 0x1
+
+/* We make sure that the block size will fit in a single packet
+ *  (allowing for a bit of overhead on each packet
+ */
+#define EVENT_LOG_MAX_BLOCK_SIZE 1400
+#define EVENT_LOG_PSM_BLOCK	0x200
+#define EVENT_LOG_BUS_BLOCK	0x200
+#define EVENT_LOG_DBG_BLOCK	0x100
+
+/*
+ * There are multiple levels of objects define here:
+ *   event_log_set - a set of buffers
+ *   event log groups - every event log call is part of just one.  All
+ *                      event log calls in a group are handled the
+ *                      same way.  Each event log group is associated
+ *                      with an event log set or is off.
+ */
+
+#ifndef __ASSEMBLER__
+
+/* On the external system where the dumper is we need to make sure
+ * that these types are the same size as they are on the ARM the
+ * produced them
+ */
+#ifdef EVENT_LOG_DUMPER
+#define _EL_BLOCK_PTR uint32
+#define _EL_TYPE_PTR uint32
+#define _EL_SET_PTR uint32
+#define _EL_TOP_PTR uint32
+#else
+#define _EL_BLOCK_PTR struct event_log_block *
+#define _EL_TYPE_PTR uint32 *
+#define _EL_SET_PTR struct event_log_set **
+#define _EL_TOP_PTR struct event_log_top *
+#endif /* EVENT_LOG_DUMPER */
+
+/* Each event log entry has a type.  The type is the LAST word of the
+ * event log.  The printing code walks the event entries in reverse
+ * order to find the first entry.
+ */
+typedef union event_log_hdr {
+	struct {
+		uint8 tag;		/* Event_log entry tag */
+		uint8 count;		/* Count of 4-byte entries */
+		uint16 fmt_num;		/* Format number */
+	};
+	uint32 t;			/* Type cheat */
+} event_log_hdr_t;
+
+/* Event log sets (a logical circurlar buffer) consist of one or more
+ * event_log_blocks.  The blocks themselves form a logical circular
+ * list.  The log entries are placed in each event_log_block until it
+ * is full.  Logging continues with the next event_log_block in the
+ * event_set until the last event_log_block is reached and then
+ * logging starts over with the first event_log_block in the
+ * event_set.
+ */
+typedef struct event_log_block {
+	_EL_BLOCK_PTR next_block;
+	_EL_BLOCK_PTR prev_block;
+	_EL_TYPE_PTR end_ptr;
+
+	/* Start of packet sent for log tracing */
+	uint16 pktlen;			/* Size of rest of block */
+	uint16 count;			/* Logtrace counter */
+	uint32 timestamp;		/* Timestamp at start of use */
+	uint32 event_logs;
+} event_log_block_t;
+
+/* There can be multiple event_sets with each logging a set of
+ * associated events (i.e, "fast" and "slow" events).
+ */
+typedef struct event_log_set {
+	_EL_BLOCK_PTR first_block; 	/* Pointer to first event_log block */
+	_EL_BLOCK_PTR last_block; 	/* Pointer to last event_log block */
+	_EL_BLOCK_PTR logtrace_block;	/* next block traced */
+	_EL_BLOCK_PTR cur_block;   	/* Pointer to current event_log block */
+	_EL_TYPE_PTR cur_ptr;      	/* Current event_log pointer */
+	uint32 blockcount;		/* Number of blocks */
+	uint16 logtrace_count;		/* Last count for logtrace */
+	uint16 blockfill_count;		/* Fill count for logtrace */
+	uint32 timestamp;		/* Last timestamp event */
+	uint32 cyclecount;		/* Cycles at last timestamp event */
+} event_log_set_t;
+
+/* Top data structure for access to everything else */
+typedef struct event_log_top {
+	uint32 magic;
+#define EVENT_LOG_TOP_MAGIC 0x474C8669 /* 'EVLG' */
+	uint32 version;
+#define EVENT_LOG_VERSION 1
+	uint32 num_sets;
+	uint32 logstrs_size;		/* Size of lognums + logstrs area */
+	uint32 timestamp;		/* Last timestamp event */
+	uint32 cyclecount;		/* Cycles at last timestamp event */
+	_EL_SET_PTR sets; 		/* Ptr to array of <num_sets> set ptrs */
+} event_log_top_t;
+
+/* Data structure of Keeping the Header from logstrs.bin */
+typedef struct {
+	uint32 logstrs_size;    /* Size of the file */
+	uint32 rom_lognums_offset; /* Offset to the ROM lognum */
+	uint32 ram_lognums_offset; /* Offset to the RAM lognum */
+	uint32 rom_logstrs_offset; /* Offset to the ROM logstr */
+	uint32 ram_logstrs_offset; /* Offset to the RAM logstr */
+	/* Keep version and magic last since "header" is appended to the end of logstrs file. */
+	uint32 version;            /* Header version */
+	uint32 log_magic;       /* MAGIC number for verification 'LOGS' */
+} logstr_header_t;
+
+
+#ifndef EVENT_LOG_DUMPER
+
+#ifndef EVENT_LOG_COMPILE
+
+/* Null define if no tracing */
+#define EVENT_LOG(format, ...)
+
+#else  /* EVENT_LOG_COMPILE */
+
+/* The first few are special because they can be done more efficiently
+ * this way and they are the common case.  Once there are too many
+ * parameters the code size starts to be an issue and a loop is better
+ */
+#define _EVENT_LOG0(tag, fmt_num) 			\
+	event_log0(tag, fmt_num)
+#define _EVENT_LOG1(tag, fmt_num, t1) 			\
+	event_log1(tag, fmt_num, t1)
+#define _EVENT_LOG2(tag, fmt_num, t1, t2) 		\
+	event_log2(tag, fmt_num, t1, t2)
+#define _EVENT_LOG3(tag, fmt_num, t1, t2, t3) 		\
+	event_log3(tag, fmt_num, t1, t2, t3)
+#define _EVENT_LOG4(tag, fmt_num, t1, t2, t3, t4) 	\
+	event_log4(tag, fmt_num, t1, t2, t3, t4)
+
+/* The rest call the generic routine that takes a count */
+#define _EVENT_LOG5(tag, fmt_num, ...) event_logn(5, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG6(tag, fmt_num, ...) event_logn(6, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG7(tag, fmt_num, ...) event_logn(7, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG8(tag, fmt_num, ...) event_logn(8, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOG9(tag, fmt_num, ...) event_logn(9, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGA(tag, fmt_num, ...) event_logn(10, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGB(tag, fmt_num, ...) event_logn(11, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGC(tag, fmt_num, ...) event_logn(12, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGD(tag, fmt_num, ...) event_logn(13, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGE(tag, fmt_num, ...) event_logn(14, tag, fmt_num, __VA_ARGS__)
+#define _EVENT_LOGF(tag, fmt_num, ...) event_logn(15, tag, fmt_num, __VA_ARGS__)
+
+/* Hack to make the proper routine call when variadic macros get
+ * passed.  Note the max of 15 arguments.  More than that can't be
+ * handled by the event_log entries anyways so best to catch it at compile
+ * time
+ */
+
+#define _EVENT_LOG_VA_NUM_ARGS(F, _1, _2, _3, _4, _5, _6, _7, _8, _9,	\
+			       _A, _B, _C, _D, _E, _F, N, ...) F ## N
+
+#define _EVENT_LOG(tag, fmt, ...)					\
+	static char logstr[] __attribute__ ((section(".logstrs"))) = fmt; \
+	static uint32 fmtnum __attribute__ ((section(".lognums"))) = (uint32) &logstr; \
+	_EVENT_LOG_VA_NUM_ARGS(_EVENT_LOG, ##__VA_ARGS__,		\
+			       F, E, D, C, B, A, 9, 8,			\
+			       7, 6, 5, 4, 3, 2, 1, 0)			\
+	(tag, (int) &fmtnum , ## __VA_ARGS__);				\
+
+
+#define EVENT_LOG_FAST(tag, fmt, ...)					\
+	if (event_log_tag_sets != NULL) {				\
+		uint8 tag_flag = *(event_log_tag_sets + tag);		\
+		if (tag_flag != 0) {					\
+			_EVENT_LOG(tag, fmt , ## __VA_ARGS__);		\
+		}							\
+	}
+
+#define EVENT_LOG_COMPACT(tag, fmt, ...)				\
+	if (1) {							\
+		_EVENT_LOG(tag, fmt , ## __VA_ARGS__);			\
+	}
+
+#define EVENT_LOG(tag, fmt, ...) EVENT_LOG_COMPACT(tag, fmt , ## __VA_ARGS__)
+
+#define EVENT_LOG_IS_LOG_ON(tag) (*(event_log_tag_sets + (tag)) & EVENT_LOG_TAG_FLAG_LOG)
+
+#define EVENT_DUMP	event_log_buffer
+
+extern uint8 *event_log_tag_sets;
+
+#include <siutils.h>
+
+extern int event_log_init(si_t *sih);
+extern int event_log_set_init(si_t *sih, int set_num, int size);
+extern int event_log_set_expand(si_t *sih, int set_num, int size);
+extern int event_log_set_shrink(si_t *sih, int set_num, int size);
+extern int event_log_tag_start(int tag, int set_num, int flags);
+extern int event_log_tag_stop(int tag);
+extern int event_log_get(int set_num, int buflen, void *buf);
+extern uint8 * event_log_next_logtrace(int set_num);
+
+extern void event_log0(int tag, int fmtNum);
+extern void event_log1(int tag, int fmtNum, uint32 t1);
+extern void event_log2(int tag, int fmtNum, uint32 t1, uint32 t2);
+extern void event_log3(int tag, int fmtNum, uint32 t1, uint32 t2, uint32 t3);
+extern void event_log4(int tag, int fmtNum, uint32 t1, uint32 t2, uint32 t3, uint32 t4);
+extern void event_logn(int num_args, int tag, int fmtNum, ...);
+
+extern void event_log_time_sync(void);
+extern void event_log_buffer(int tag, uint8 *buf, int size);
+
+#endif /* EVENT_LOG_DUMPER */
+
+#endif /* EVENT_LOG_COMPILE */
+
+#endif /* __ASSEMBLER__ */
+
+#endif /* _EVENT_LOG_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/hnd_armtrap.h b/drivers/net/wireless/bcm4336/include/hnd_armtrap.h
--- a/drivers/net/wireless/bcm4336/include/hnd_armtrap.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/hnd_armtrap.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,70 @@
+/*
+ * HND arm trap handling.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: hnd_armtrap.h 470663 2014-04-16 00:24:43Z $
+ */
+
+#ifndef	_hnd_armtrap_h_
+#define	_hnd_armtrap_h_
+
+
+/* ARM trap handling */
+
+/* Trap types defined by ARM (see arminc.h) */
+
+/* Trap locations in lo memory */
+#define	TRAP_STRIDE	4
+#define FIRST_TRAP	TR_RST
+#define LAST_TRAP	(TR_FIQ * TRAP_STRIDE)
+
+#if defined(__ARM_ARCH_4T__)
+#define	MAX_TRAP_TYPE	(TR_FIQ + 1)
+#elif defined(__ARM_ARCH_7M__)
+#define	MAX_TRAP_TYPE	(TR_ISR + ARMCM3_NUMINTS)
+#endif	/* __ARM_ARCH_7M__ */
+
+/* The trap structure is defined here as offsets for assembly */
+#define	TR_TYPE		0x00
+#define	TR_EPC		0x04
+#define	TR_CPSR		0x08
+#define	TR_SPSR		0x0c
+#define	TR_REGS		0x10
+#define	TR_REG(n)	(TR_REGS + (n) * 4)
+#define	TR_SP		TR_REG(13)
+#define	TR_LR		TR_REG(14)
+#define	TR_PC		TR_REG(15)
+
+#define	TRAP_T_SIZE	80
+
+#ifndef	_LANGUAGE_ASSEMBLY
+
+#include <typedefs.h>
+
+typedef struct _trap_struct {
+	uint32		type;
+	uint32		epc;
+	uint32		cpsr;
+	uint32		spsr;
+	uint32		r0;	/* a1 */
+	uint32		r1;	/* a2 */
+	uint32		r2;	/* a3 */
+	uint32		r3;	/* a4 */
+	uint32		r4;	/* v1 */
+	uint32		r5;	/* v2 */
+	uint32		r6;	/* v3 */
+	uint32		r7;	/* v4 */
+	uint32		r8;	/* v5 */
+	uint32		r9;	/* sb/v6 */
+	uint32		r10;	/* sl/v7 */
+	uint32		r11;	/* fp/v8 */
+	uint32		r12;	/* ip */
+	uint32		r13;	/* sp */
+	uint32		r14;	/* lr */
+	uint32		pc;	/* r15 */
+} trap_t;
+
+#endif	/* !_LANGUAGE_ASSEMBLY */
+
+#endif	/* _hnd_armtrap_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/hnd_cons.h b/drivers/net/wireless/bcm4336/include/hnd_cons.h
--- a/drivers/net/wireless/bcm4336/include/hnd_cons.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/hnd_cons.h	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,59 @@
+/*
+ * Console support for RTE - for host use only.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: hnd_cons.h 473343 2014-04-29 01:45:22Z $
+ */
+#ifndef	_hnd_cons_h_
+#define	_hnd_cons_h_
+
+#include <typedefs.h>
+#include <siutils.h>
+
+#define CBUF_LEN	(128)
+
+#define LOG_BUF_LEN	1024
+
+#ifdef BOOTLOADER_CONSOLE_OUTPUT
+#undef RWL_MAX_DATA_LEN
+#undef CBUF_LEN
+#undef LOG_BUF_LEN
+#define RWL_MAX_DATA_LEN (4 * 1024 + 8)
+#define CBUF_LEN	(RWL_MAX_DATA_LEN + 64)
+#define LOG_BUF_LEN (16 * 1024)
+#endif
+
+typedef struct {
+	uint32		buf;		/* Can't be pointer on (64-bit) hosts */
+	uint		buf_size;
+	uint		idx;
+	uint		out_idx;	/* output index */
+} hnd_log_t;
+
+typedef struct {
+	/* Virtual UART
+	 *   When there is no UART (e.g. Quickturn), the host should write a complete
+	 *   input line directly into cbuf and then write the length into vcons_in.
+	 *   This may also be used when there is a real UART (at risk of conflicting with
+	 *   the real UART).  vcons_out is currently unused.
+	 */
+	volatile uint	vcons_in;
+	volatile uint	vcons_out;
+
+	/* Output (logging) buffer
+	 *   Console output is written to a ring buffer log_buf at index log_idx.
+	 *   The host may read the output when it sees log_idx advance.
+	 *   Output will be lost if the output wraps around faster than the host polls.
+	 */
+	hnd_log_t	log;
+
+	/* Console input line buffer
+	 *   Characters are read one at a time into cbuf until <CR> is received, then
+	 *   the buffer is processed as a command line.  Also used for virtual UART.
+	 */
+	uint		cbuf_idx;
+	char		cbuf[CBUF_LEN];
+} hnd_cons_t;
+
+#endif /* _hnd_cons_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/hnd_pktpool.h b/drivers/net/wireless/bcm4336/include/hnd_pktpool.h
--- a/drivers/net/wireless/bcm4336/include/hnd_pktpool.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/hnd_pktpool.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,186 @@
+/*
+ * HND generic packet pool operation primitives
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: $
+ */
+
+#ifndef _hnd_pktpool_h_
+#define _hnd_pktpool_h_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef BCMPKTPOOL
+#define POOL_ENAB(pool)		((pool) && (pool)->inited)
+#define SHARED_POOL		(pktpool_shared)
+#else /* BCMPKTPOOL */
+#define POOL_ENAB(bus)		0
+#define SHARED_POOL		((struct pktpool *)NULL)
+#endif /* BCMPKTPOOL */
+
+#ifdef BCMFRAGPOOL
+#define SHARED_FRAG_POOL	(pktpool_shared_lfrag)
+#endif
+#define SHARED_RXFRAG_POOL	(pktpool_shared_rxlfrag)
+
+
+#ifndef PKTPOOL_LEN_MAX
+#define PKTPOOL_LEN_MAX		40
+#endif /* PKTPOOL_LEN_MAX */
+#define PKTPOOL_CB_MAX		3
+
+/* forward declaration */
+struct pktpool;
+
+typedef void (*pktpool_cb_t)(struct pktpool *pool, void *arg);
+typedef struct {
+	pktpool_cb_t cb;
+	void *arg;
+} pktpool_cbinfo_t;
+/* call back fn extension to populate host address in pool pkt */
+typedef int (*pktpool_cb_extn_t)(struct pktpool *pool, void *arg1, void* pkt, bool arg2);
+typedef struct {
+	pktpool_cb_extn_t cb;
+	void *arg;
+} pktpool_cbextn_info_t;
+
+
+#ifdef BCMDBG_POOL
+/* pkt pool debug states */
+#define POOL_IDLE	0
+#define POOL_RXFILL	1
+#define POOL_RXDH	2
+#define POOL_RXD11	3
+#define POOL_TXDH	4
+#define POOL_TXD11	5
+#define POOL_AMPDU	6
+#define POOL_TXENQ	7
+
+typedef struct {
+	void *p;
+	uint32 cycles;
+	uint32 dur;
+} pktpool_dbg_t;
+
+typedef struct {
+	uint8 txdh;	/* tx to host */
+	uint8 txd11;	/* tx to d11 */
+	uint8 enq;	/* waiting in q */
+	uint8 rxdh;	/* rx from host */
+	uint8 rxd11;	/* rx from d11 */
+	uint8 rxfill;	/* dma_rxfill */
+	uint8 idle;	/* avail in pool */
+} pktpool_stats_t;
+#endif /* BCMDBG_POOL */
+
+typedef struct pktpool {
+	bool inited;            /* pktpool_init was successful */
+	uint8 type;             /* type of lbuf: basic, frag, etc */
+	uint8 id;               /* pktpool ID:  index in registry */
+	bool istx;              /* direction: transmit or receive data path */
+
+	void * freelist;        /* free list: see PKTNEXTFREE(), PKTSETNEXTFREE() */
+	uint16 avail;           /* number of packets in pool's free list */
+	uint16 len;             /* number of packets managed by pool */
+	uint16 maxlen;          /* maximum size of pool <= PKTPOOL_LEN_MAX */
+	uint16 plen;            /* size of pkt buffer, excluding lbuf|lbuf_frag */
+
+	bool empty;
+	uint8 cbtoggle;
+	uint8 cbcnt;
+	uint8 ecbcnt;
+	bool emptycb_disable;
+	pktpool_cbinfo_t *availcb_excl;
+	pktpool_cbinfo_t cbs[PKTPOOL_CB_MAX];
+	pktpool_cbinfo_t ecbs[PKTPOOL_CB_MAX];
+	pktpool_cbextn_info_t cbext;
+	pktpool_cbextn_info_t rxcplidfn;
+#ifdef BCMDBG_POOL
+	uint8 dbg_cbcnt;
+	pktpool_cbinfo_t dbg_cbs[PKTPOOL_CB_MAX];
+	uint16 dbg_qlen;
+	pktpool_dbg_t dbg_q[PKTPOOL_LEN_MAX + 1];
+#endif
+	pktpool_cbinfo_t dmarxfill;
+} pktpool_t;
+
+extern pktpool_t *pktpool_shared;
+#ifdef BCMFRAGPOOL
+extern pktpool_t *pktpool_shared_lfrag;
+#endif
+extern pktpool_t *pktpool_shared_rxlfrag;
+
+/* Incarnate a pktpool registry. On success returns total_pools. */
+extern int pktpool_attach(osl_t *osh, uint32 total_pools);
+extern int pktpool_dettach(osl_t *osh); /* Relinquish registry */
+
+extern int pktpool_init(osl_t *osh, pktpool_t *pktp, int *pktplen, int plen, bool istx, uint8 type);
+extern int pktpool_deinit(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_fill(osl_t *osh, pktpool_t *pktp, bool minimal);
+extern void* pktpool_get(pktpool_t *pktp);
+extern void pktpool_free(pktpool_t *pktp, void *p);
+extern int pktpool_add(pktpool_t *pktp, void *p);
+extern int pktpool_avail_notify_normal(osl_t *osh, pktpool_t *pktp);
+extern int pktpool_avail_notify_exclusive(osl_t *osh, pktpool_t *pktp, pktpool_cb_t cb);
+extern int pktpool_avail_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_empty_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_setmaxlen(pktpool_t *pktp, uint16 maxlen);
+extern int pktpool_setmaxlen_strict(osl_t *osh, pktpool_t *pktp, uint16 maxlen);
+extern void pktpool_emptycb_disable(pktpool_t *pktp, bool disable);
+extern bool pktpool_emptycb_disabled(pktpool_t *pktp);
+extern int pktpool_hostaddr_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg1);
+extern int pktpool_rxcplid_fill_register(pktpool_t *pktp, pktpool_cb_extn_t cb, void *arg);
+extern void pktpool_invoke_dmarxfill(pktpool_t *pktp);
+extern int pkpool_haddr_avail_register_cb(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+
+#define POOLPTR(pp)         ((pktpool_t *)(pp))
+#define POOLID(pp)          (POOLPTR(pp)->id)
+
+#define POOLSETID(pp, ppid) (POOLPTR(pp)->id = (ppid))
+
+#define pktpool_len(pp)     (POOLPTR(pp)->len)
+#define pktpool_avail(pp)   (POOLPTR(pp)->avail)
+#define pktpool_plen(pp)    (POOLPTR(pp)->plen)
+#define pktpool_maxlen(pp)  (POOLPTR(pp)->maxlen)
+
+
+/*
+ * ----------------------------------------------------------------------------
+ * A pool ID is assigned with a pkt pool during pool initialization. This is
+ * done by maintaining a registry of all initialized pools, and the registry
+ * index at which the pool is registered is used as the pool's unique ID.
+ * ID 0 is reserved and is used to signify an invalid pool ID.
+ * All packets henceforth allocated from a pool will be tagged with the pool's
+ * unique ID. Packets allocated from the heap will use the reserved ID = 0.
+ * Packets with non-zero pool id signify that they were allocated from a pool.
+ * A maximum of 15 pools are supported, allowing a 4bit pool ID to be used
+ * in place of a 32bit pool pointer in each packet.
+ * ----------------------------------------------------------------------------
+ */
+#define PKTPOOL_INVALID_ID          (0)
+#define PKTPOOL_MAXIMUM_ID          (15)
+
+/* Registry of pktpool(s) */
+extern pktpool_t *pktpools_registry[PKTPOOL_MAXIMUM_ID + 1];
+
+/* Pool ID to/from Pool Pointer converters */
+#define PKTPOOL_ID2PTR(id)          (pktpools_registry[id])
+#define PKTPOOL_PTR2ID(pp)          (POOLID(pp))
+
+
+#ifdef BCMDBG_POOL
+extern int pktpool_dbg_register(pktpool_t *pktp, pktpool_cb_t cb, void *arg);
+extern int pktpool_start_trigger(pktpool_t *pktp, void *p);
+extern int pktpool_dbg_dump(pktpool_t *pktp);
+extern int pktpool_dbg_notify(pktpool_t *pktp);
+extern int pktpool_stats_dump(pktpool_t *pktp, pktpool_stats_t *stats);
+#endif /* BCMDBG_POOL */
+
+#ifdef __cplusplus
+	}
+#endif
+
+#endif /* _hnd_pktpool_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/hnd_pktq.h b/drivers/net/wireless/bcm4336/include/hnd_pktq.h
--- a/drivers/net/wireless/bcm4336/include/hnd_pktq.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/hnd_pktq.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,168 @@
+/*
+ * HND generic pktq operation primitives
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: $
+ */
+
+#ifndef _hnd_pktq_h_
+#define _hnd_pktq_h_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* osl multi-precedence packet queue */
+#define PKTQ_LEN_MAX            0xFFFF  /* Max uint16 65535 packets */
+#ifndef PKTQ_LEN_DEFAULT
+#define PKTQ_LEN_DEFAULT        128	/* Max 128 packets */
+#endif
+#ifndef PKTQ_MAX_PREC
+#define PKTQ_MAX_PREC           16	/* Maximum precedence levels */
+#endif
+
+typedef struct pktq_prec {
+	void *head;     /* first packet to dequeue */
+	void *tail;     /* last packet to dequeue */
+	uint16 len;     /* number of queued packets */
+	uint16 max;     /* maximum number of queued packets */
+} pktq_prec_t;
+
+#ifdef PKTQ_LOG
+typedef struct {
+	uint32 requested;    /* packets requested to be stored */
+	uint32 stored;	     /* packets stored */
+	uint32 saved;	     /* packets saved,
+	                            because a lowest priority queue has given away one packet
+	                      */
+	uint32 selfsaved;    /* packets saved,
+	                            because an older packet from the same queue has been dropped
+	                      */
+	uint32 full_dropped; /* packets dropped,
+	                            because pktq is full with higher precedence packets
+	                      */
+	uint32 dropped;      /* packets dropped because pktq per that precedence is full */
+	uint32 sacrificed;   /* packets dropped,
+	                            in order to save one from a queue of a highest priority
+	                      */
+	uint32 busy;         /* packets droped because of hardware/transmission error */
+	uint32 retry;        /* packets re-sent because they were not received */
+	uint32 ps_retry;     /* packets retried again prior to moving power save mode */
+	uint32 suppress;     /* packets which were suppressed and not transmitted */
+	uint32 retry_drop;   /* packets finally dropped after retry limit */
+	uint32 max_avail;    /* the high-water mark of the queue capacity for packets -
+	                            goes to zero as queue fills
+	                      */
+	uint32 max_used;     /* the high-water mark of the queue utilisation for packets -
+						        increases with use ('inverse' of max_avail)
+				          */
+	uint32 queue_capacity; /* the maximum capacity of the queue */
+	uint32 rtsfail;        /* count of rts attempts that failed to receive cts */
+	uint32 acked;          /* count of packets sent (acked) successfully */
+	uint32 txrate_succ;    /* running total of phy rate of packets sent successfully */
+	uint32 txrate_main;    /* running totoal of primary phy rate of all packets */
+	uint32 throughput;     /* actual data transferred successfully */
+	uint32 airtime;        /* cumulative total medium access delay in useconds */
+	uint32  _logtime;      /* timestamp of last counter clear  */
+} pktq_counters_t;
+
+typedef struct {
+	uint32                  _prec_log;
+	pktq_counters_t*        _prec_cnt[PKTQ_MAX_PREC];     /* Counters per queue  */
+} pktq_log_t;
+#endif /* PKTQ_LOG */
+
+
+#define PKTQ_COMMON	\
+	uint16 num_prec;        /* number of precedences in use */			\
+	uint16 hi_prec;         /* rapid dequeue hint (>= highest non-empty prec) */	\
+	uint16 max;             /* total max packets */					\
+	uint16 len;             /* total number of packets */
+
+/* multi-priority pkt queue */
+struct pktq {
+	PKTQ_COMMON
+	/* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
+	struct pktq_prec q[PKTQ_MAX_PREC];
+#ifdef PKTQ_LOG
+	pktq_log_t*      pktqlog;
+#endif
+};
+
+/* simple, non-priority pkt queue */
+struct spktq {
+	PKTQ_COMMON
+	/* q array must be last since # of elements can be either PKTQ_MAX_PREC or 1 */
+	struct pktq_prec q[1];
+};
+
+#define PKTQ_PREC_ITER(pq, prec)        for (prec = (pq)->num_prec - 1; prec >= 0; prec--)
+
+/* fn(pkt, arg).  return true if pkt belongs to if */
+typedef bool (*ifpkt_cb_t)(void*, int);
+
+/* operations on a specific precedence in packet queue */
+
+#define pktq_psetmax(pq, prec, _max)	((pq)->q[prec].max = (_max))
+#define pktq_pmax(pq, prec)		((pq)->q[prec].max)
+#define pktq_plen(pq, prec)		((pq)->q[prec].len)
+#define pktq_pavail(pq, prec)		((pq)->q[prec].max - (pq)->q[prec].len)
+#define pktq_pfull(pq, prec)		((pq)->q[prec].len >= (pq)->q[prec].max)
+#define pktq_pempty(pq, prec)		((pq)->q[prec].len == 0)
+
+#define pktq_ppeek(pq, prec)		((pq)->q[prec].head)
+#define pktq_ppeek_tail(pq, prec)	((pq)->q[prec].tail)
+
+extern void  pktq_append(struct pktq *pq, int prec, struct spktq *list);
+extern void  pktq_prepend(struct pktq *pq, int prec, struct spktq *list);
+
+extern void *pktq_penq(struct pktq *pq, int prec, void *p);
+extern void *pktq_penq_head(struct pktq *pq, int prec, void *p);
+extern void *pktq_pdeq(struct pktq *pq, int prec);
+extern void *pktq_pdeq_prev(struct pktq *pq, int prec, void *prev_p);
+extern void *pktq_pdeq_with_fn(struct pktq *pq, int prec, ifpkt_cb_t fn, int arg);
+extern void *pktq_pdeq_tail(struct pktq *pq, int prec);
+/* Empty the queue at particular precedence level */
+extern void pktq_pflush(osl_t *osh, struct pktq *pq, int prec, bool dir,
+	ifpkt_cb_t fn, int arg);
+/* Remove a specified packet from its queue */
+extern bool pktq_pdel(struct pktq *pq, void *p, int prec);
+
+/* operations on a set of precedences in packet queue */
+
+extern int pktq_mlen(struct pktq *pq, uint prec_bmp);
+extern void *pktq_mdeq(struct pktq *pq, uint prec_bmp, int *prec_out);
+extern void *pktq_mpeek(struct pktq *pq, uint prec_bmp, int *prec_out);
+
+/* operations on packet queue as a whole */
+
+#define pktq_len(pq)		((int)(pq)->len)
+#define pktq_max(pq)		((int)(pq)->max)
+#define pktq_avail(pq)		((int)((pq)->max - (pq)->len))
+#define pktq_full(pq)		((pq)->len >= (pq)->max)
+#define pktq_empty(pq)		((pq)->len == 0)
+
+/* operations for single precedence queues */
+#define pktenq(pq, p)		pktq_penq(((struct pktq *)(void *)pq), 0, (p))
+#define pktenq_head(pq, p)	pktq_penq_head(((struct pktq *)(void *)pq), 0, (p))
+#define pktdeq(pq)		pktq_pdeq(((struct pktq *)(void *)pq), 0)
+#define pktdeq_tail(pq)		pktq_pdeq_tail(((struct pktq *)(void *)pq), 0)
+#define pktqflush(osh, pq)	pktq_flush(osh, ((struct pktq *)(void *)pq), TRUE, NULL, 0)
+#define pktqinit(pq, len)	pktq_init(((struct pktq *)(void *)pq), 1, len)
+
+extern void pktq_init(struct pktq *pq, int num_prec, int max_len);
+extern void pktq_set_max_plen(struct pktq *pq, int prec, int max_len);
+
+/* prec_out may be NULL if caller is not interested in return value */
+extern void *pktq_deq(struct pktq *pq, int *prec_out);
+extern void *pktq_deq_tail(struct pktq *pq, int *prec_out);
+extern void *pktq_peek(struct pktq *pq, int *prec_out);
+extern void *pktq_peek_tail(struct pktq *pq, int *prec_out);
+extern void pktq_flush(osl_t *osh, struct pktq *pq, bool dir, ifpkt_cb_t fn, int arg);
+
+#ifdef __cplusplus
+	}
+#endif
+
+#endif /* _hnd_pktq_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/hndpmu.h b/drivers/net/wireless/bcm4336/include/hndpmu.h
--- a/drivers/net/wireless/bcm4336/include/hndpmu.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/hndpmu.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,23 @@
+/*
+ * HND SiliconBackplane PMU support.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: hndpmu.h 471127 2014-04-17 23:24:23Z $
+ */
+
+#ifndef _hndpmu_h_
+#define _hndpmu_h_
+
+#include <typedefs.h>
+#include <osl_decl.h>
+#include <siutils.h>
+
+
+extern void si_pmu_otp_power(si_t *sih, osl_t *osh, bool on, uint32* min_res_mask);
+extern void si_sdiod_drive_strength_init(si_t *sih, osl_t *osh, uint32 drivestrength);
+
+extern void si_pmu_minresmask_htavail_set(si_t *sih, osl_t *osh, bool set_clear);
+extern void si_pmu_slow_clk_reinit(si_t *sih, osl_t *osh);
+
+#endif /* _hndpmu_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/hndsoc.h b/drivers/net/wireless/bcm4336/include/hndsoc.h
--- a/drivers/net/wireless/bcm4336/include/hndsoc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/hndsoc.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,268 @@
+/*
+ * Broadcom HND chip & on-chip-interconnect-related definitions.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: hndsoc.h 473238 2014-04-28 19:14:56Z $
+ */
+
+#ifndef	_HNDSOC_H
+#define	_HNDSOC_H
+
+/* Include the soci specific files */
+#include <sbconfig.h>
+#include <aidmp.h>
+
+/*
+ * SOC Interconnect Address Map.
+ * All regions may not exist on all chips.
+ */
+#define SI_SDRAM_BASE		0x00000000	/* Physical SDRAM */
+#define SI_PCI_MEM		0x08000000	/* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI_MEM_SZ		(64 * 1024 * 1024)
+#define SI_PCI_CFG		0x0c000000	/* Host Mode sb2pcitranslation1 (64 MB) */
+#define	SI_SDRAM_SWAPPED	0x10000000	/* Byteswapped Physical SDRAM */
+#define SI_SDRAM_R2		0x80000000	/* Region 2 for sdram (512 MB) */
+
+#define SI_ENUM_BASE    	0x18000000	/* Enumeration space base */
+
+#define SI_WRAP_BASE    	0x18100000	/* Wrapper space base */
+#define SI_CORE_SIZE    	0x1000		/* each core gets 4Kbytes for registers */
+
+#ifndef SI_MAXCORES
+#define	SI_MAXCORES		32		/* NorthStar has more cores */
+#endif /* SI_MAXCORES */
+
+#define	SI_FASTRAM		0x19000000	/* On-chip RAM on chips that also have DDR */
+#define	SI_FASTRAM_SWAPPED	0x19800000
+
+#define	SI_FLASH2		0x1c000000	/* Flash Region 2 (region 1 shadowed here) */
+#define	SI_FLASH2_SZ		0x02000000	/* Size of Flash Region 2 */
+#define	SI_ARMCM3_ROM		0x1e000000	/* ARM Cortex-M3 ROM */
+#define	SI_FLASH1		0x1fc00000	/* MIPS Flash Region 1 */
+#define	SI_FLASH1_SZ		0x00400000	/* MIPS Size of Flash Region 1 */
+#define	SI_FLASH_WINDOW		0x01000000	/* Flash XIP Window */
+
+#define SI_NS_NANDFLASH		0x1c000000	/* NorthStar NAND flash base */
+#define SI_NS_NORFLASH		0x1e000000	/* NorthStar NOR flash base */
+#define SI_NS_ROM		0xfffd0000	/* NorthStar ROM */
+#define	SI_NS_FLASH_WINDOW	0x02000000	/* Flash XIP Window */
+
+#define	SI_ARM7S_ROM		0x20000000	/* ARM7TDMI-S ROM */
+#define	SI_ARMCR4_ROM		0x000f0000	/* ARM Cortex-R4 ROM */
+#define	SI_ARMCM3_SRAM2		0x60000000	/* ARM Cortex-M3 SRAM Region 2 */
+#define	SI_ARM7S_SRAM2		0x80000000	/* ARM7TDMI-S SRAM Region 2 */
+#define	SI_ARM_FLASH1		0xffff0000	/* ARM Flash Region 1 */
+#define	SI_ARM_FLASH1_SZ	0x00010000	/* ARM Size of Flash Region 1 */
+
+#define SI_SFLASH		0x14000000
+#define SI_PCI_DMA		0x40000000	/* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA2		0x80000000	/* Client Mode sb2pcitranslation2 (1 GB) */
+#define SI_PCI_DMA_SZ		0x40000000	/* Client Mode sb2pcitranslation2 size in bytes */
+#define SI_PCIE_DMA_L32		0x00000000	/* PCIE Client Mode sb2pcitranslation2
+						 * (2 ZettaBytes), low 32 bits
+						 */
+#define SI_PCIE_DMA_H32		0x80000000	/* PCIE Client Mode sb2pcitranslation2
+						 * (2 ZettaBytes), high 32 bits
+						 */
+/* core codes */
+#define	NODEV_CORE_ID		0x700		/* Invalid coreid */
+#define	CC_CORE_ID		0x800		/* chipcommon core */
+#define	ILINE20_CORE_ID		0x801		/* iline20 core */
+#define	SRAM_CORE_ID		0x802		/* sram core */
+#define	SDRAM_CORE_ID		0x803		/* sdram core */
+#define	PCI_CORE_ID		0x804		/* pci core */
+#define	MIPS_CORE_ID		0x805		/* mips core */
+#define	ENET_CORE_ID		0x806		/* enet mac core */
+#define	CODEC_CORE_ID		0x807		/* v90 codec core */
+#define	USB_CORE_ID		0x808		/* usb 1.1 host/device core */
+#define	ADSL_CORE_ID		0x809		/* ADSL core */
+#define	ILINE100_CORE_ID	0x80a		/* iline100 core */
+#define	IPSEC_CORE_ID		0x80b		/* ipsec core */
+#define	UTOPIA_CORE_ID		0x80c		/* utopia core */
+#define	PCMCIA_CORE_ID		0x80d		/* pcmcia core */
+#define	SOCRAM_CORE_ID		0x80e		/* internal memory core */
+#define	MEMC_CORE_ID		0x80f		/* memc sdram core */
+#define	OFDM_CORE_ID		0x810		/* OFDM phy core */
+#define	EXTIF_CORE_ID		0x811		/* external interface core */
+#define	D11_CORE_ID		0x812		/* 802.11 MAC core */
+#define	APHY_CORE_ID		0x813		/* 802.11a phy core */
+#define	BPHY_CORE_ID		0x814		/* 802.11b phy core */
+#define	GPHY_CORE_ID		0x815		/* 802.11g phy core */
+#define	MIPS33_CORE_ID		0x816		/* mips3302 core */
+#define	USB11H_CORE_ID		0x817		/* usb 1.1 host core */
+#define	USB11D_CORE_ID		0x818		/* usb 1.1 device core */
+#define	USB20H_CORE_ID		0x819		/* usb 2.0 host core */
+#define	USB20D_CORE_ID		0x81a		/* usb 2.0 device core */
+#define	SDIOH_CORE_ID		0x81b		/* sdio host core */
+#define	ROBO_CORE_ID		0x81c		/* roboswitch core */
+#define	ATA100_CORE_ID		0x81d		/* parallel ATA core */
+#define	SATAXOR_CORE_ID		0x81e		/* serial ATA & XOR DMA core */
+#define	GIGETH_CORE_ID		0x81f		/* gigabit ethernet core */
+#define	PCIE_CORE_ID		0x820		/* pci express core */
+#define	NPHY_CORE_ID		0x821		/* 802.11n 2x2 phy core */
+#define	SRAMC_CORE_ID		0x822		/* SRAM controller core */
+#define	MINIMAC_CORE_ID		0x823		/* MINI MAC/phy core */
+#define	ARM11_CORE_ID		0x824		/* ARM 1176 core */
+#define	ARM7S_CORE_ID		0x825		/* ARM7tdmi-s core */
+#define	LPPHY_CORE_ID		0x826		/* 802.11a/b/g phy core */
+#define	PMU_CORE_ID		0x827		/* PMU core */
+#define	SSNPHY_CORE_ID		0x828		/* 802.11n single-stream phy core */
+#define	SDIOD_CORE_ID		0x829		/* SDIO device core */
+#define	ARMCM3_CORE_ID		0x82a		/* ARM Cortex M3 core */
+#define	HTPHY_CORE_ID		0x82b		/* 802.11n 4x4 phy core */
+#define	MIPS74K_CORE_ID		0x82c		/* mips 74k core */
+#define	GMAC_CORE_ID		0x82d		/* Gigabit MAC core */
+#define	DMEMC_CORE_ID		0x82e		/* DDR1/2 memory controller core */
+#define	PCIERC_CORE_ID		0x82f		/* PCIE Root Complex core */
+#define	OCP_CORE_ID		0x830		/* OCP2OCP bridge core */
+#define	SC_CORE_ID		0x831		/* shared common core */
+#define	AHB_CORE_ID		0x832		/* OCP2AHB bridge core */
+#define	SPIH_CORE_ID		0x833		/* SPI host core */
+#define	I2S_CORE_ID		0x834		/* I2S core */
+#define	DMEMS_CORE_ID		0x835		/* SDR/DDR1 memory controller core */
+#define	DEF_SHIM_COMP		0x837		/* SHIM component in ubus/6362 */
+
+#define ACPHY_CORE_ID		0x83b		/* Dot11 ACPHY */
+#define PCIE2_CORE_ID		0x83c		/* pci express Gen2 core */
+#define USB30D_CORE_ID		0x83d		/* usb 3.0 device core */
+#define ARMCR4_CORE_ID		0x83e		/* ARM CR4 CPU */
+#define GCI_CORE_ID		0x840		/* GCI Core */
+#define M2MDMA_CORE_ID          0x844           /* memory to memory dma */
+#define APB_BRIDGE_CORE_ID	0x135		/* APB bridge core ID */
+#define AXI_CORE_ID		0x301		/* AXI/GPV core ID */
+#define EROM_CORE_ID		0x366		/* EROM core ID */
+#define OOB_ROUTER_CORE_ID	0x367		/* OOB router core ID */
+#define DEF_AI_COMP		0xfff		/* Default component, in ai chips it maps all
+						 * unused address ranges
+						 */
+
+#define CC_4706_CORE_ID		0x500		/* chipcommon core */
+#define NS_PCIEG2_CORE_ID	0x501		/* PCIE Gen 2 core */
+#define NS_DMA_CORE_ID		0x502		/* DMA core */
+#define NS_SDIO3_CORE_ID	0x503		/* SDIO3 core */
+#define NS_USB20_CORE_ID	0x504		/* USB2.0 core */
+#define NS_USB30_CORE_ID	0x505		/* USB3.0 core */
+#define NS_A9JTAG_CORE_ID	0x506		/* ARM Cortex A9 JTAG core */
+#define NS_DDR23_CORE_ID	0x507		/* Denali DDR2/DDR3 memory controller */
+#define NS_ROM_CORE_ID		0x508		/* ROM core */
+#define NS_NAND_CORE_ID		0x509		/* NAND flash controller core */
+#define NS_QSPI_CORE_ID		0x50a		/* SPI flash controller core */
+#define NS_CCB_CORE_ID		0x50b		/* ChipcommonB core */
+#define SOCRAM_4706_CORE_ID	0x50e		/* internal memory core */
+#define NS_SOCRAM_CORE_ID	SOCRAM_4706_CORE_ID
+#define	ARMCA9_CORE_ID		0x510		/* ARM Cortex A9 core (ihost) */
+#define	NS_IHOST_CORE_ID	ARMCA9_CORE_ID	/* ARM Cortex A9 core (ihost) */
+#define GMAC_COMMON_4706_CORE_ID	0x5dc		/* Gigabit MAC core */
+#define GMAC_4706_CORE_ID	0x52d		/* Gigabit MAC core */
+#define AMEMC_CORE_ID		0x52e		/* DDR1/2 memory controller core */
+#define ALTA_CORE_ID		0x534		/* I2S core */
+#define DDR23_PHY_CORE_ID	0x5dd
+
+#define SI_PCI1_MEM     0x40000000  /* Host Mode sb2pcitranslation0 (64 MB) */
+#define SI_PCI1_CFG     0x44000000  /* Host Mode sb2pcitranslation1 (64 MB) */
+#define SI_PCIE1_DMA_H32		0xc0000000	/* PCIE Client Mode sb2pcitranslation2
+						 * (2 ZettaBytes), high 32 bits
+						 */
+#define CC_4706B0_CORE_REV	0x8000001f		/* chipcommon core */
+#define SOCRAM_4706B0_CORE_REV	0x80000005		/* internal memory core */
+#define GMAC_4706B0_CORE_REV	0x80000000		/* Gigabit MAC core */
+#define NS_PCIEG2_CORE_REV_B0	0x7		/* NS-B0 PCIE Gen 2 core rev */
+
+/* There are TWO constants on all HND chips: SI_ENUM_BASE above,
+ * and chipcommon being the first core:
+ */
+#define	SI_CC_IDX		0
+/* SOC Interconnect types (aka chip types) */
+#define	SOCI_SB			0
+#define	SOCI_AI			1
+#define	SOCI_UBUS		2
+#define	SOCI_NAI		3
+
+/* Common core control flags */
+#define	SICF_BIST_EN		0x8000
+#define	SICF_PME_EN		0x4000
+#define	SICF_CORE_BITS		0x3ffc
+#define	SICF_FGC		0x0002
+#define	SICF_CLOCK_EN		0x0001
+
+/* Common core status flags */
+#define	SISF_BIST_DONE		0x8000
+#define	SISF_BIST_ERROR		0x4000
+#define	SISF_GATED_CLK		0x2000
+#define	SISF_DMA64		0x1000
+#define	SISF_CORE_BITS		0x0fff
+
+/* Norstar core status flags */
+#define SISF_NS_BOOTDEV_MASK	0x0003	/* ROM core */
+#define SISF_NS_BOOTDEV_NOR	0x0000	/* ROM core */
+#define SISF_NS_BOOTDEV_NAND	0x0001	/* ROM core */
+#define SISF_NS_BOOTDEV_ROM	0x0002	/* ROM core */
+#define SISF_NS_BOOTDEV_OFFLOAD	0x0003	/* ROM core */
+#define SISF_NS_SKUVEC_MASK	0x000c	/* ROM core */
+
+/* A register that is common to all cores to
+ * communicate w/PMU regarding clock control.
+ */
+#define SI_CLK_CTL_ST		0x1e0		/* clock control and status */
+#define SI_PWR_CTL_ST		0x1e8		/* For memory clock gating */
+
+/* clk_ctl_st register */
+#define	CCS_FORCEALP		0x00000001	/* force ALP request */
+#define	CCS_FORCEHT		0x00000002	/* force HT request */
+#define	CCS_FORCEILP		0x00000004	/* force ILP request */
+#define	CCS_ALPAREQ		0x00000008	/* ALP Avail Request */
+#define	CCS_HTAREQ		0x00000010	/* HT Avail Request */
+#define	CCS_FORCEHWREQOFF	0x00000020	/* Force HW Clock Request Off */
+#define CCS_HQCLKREQ		0x00000040	/* HQ Clock Required */
+#define CCS_USBCLKREQ		0x00000100	/* USB Clock Req */
+#define CCS_SECICLKREQ		0x00000100	/* SECI Clock Req */
+#define CCS_ARMFASTCLOCKREQ	0x00000100	/* ARM CR4 fast clock request */
+#define CCS_AVBCLKREQ		0x00000400	/* AVB Clock enable request */
+#define CCS_ERSRC_REQ_MASK	0x00000700	/* external resource requests */
+#define CCS_ERSRC_REQ_SHIFT	8
+#define	CCS_ALPAVAIL		0x00010000	/* ALP is available */
+#define	CCS_HTAVAIL		0x00020000	/* HT is available */
+#define CCS_BP_ON_APL		0x00040000	/* RO: Backplane is running on ALP clock */
+#define CCS_BP_ON_HT		0x00080000	/* RO: Backplane is running on HT clock */
+#define CCS_ARMFASTCLOCKSTATUS	0x01000000	/* Fast CPU clock is running */
+#define CCS_ERSRC_STS_MASK	0x07000000	/* external resource status */
+#define CCS_ERSRC_STS_SHIFT	24
+
+#define	CCS0_HTAVAIL		0x00010000	/* HT avail in chipc and pcmcia on 4328a0 */
+#define	CCS0_ALPAVAIL		0x00020000	/* ALP avail in chipc and pcmcia on 4328a0 */
+
+/* Not really related to SOC Interconnect, but a couple of software
+ * conventions for the use the flash space:
+ */
+
+/* Minumum amount of flash we support */
+#define FLASH_MIN		0x00020000	/* Minimum flash size */
+
+/* A boot/binary may have an embedded block that describes its size  */
+#define	BISZ_OFFSET		0x3e0		/* At this offset into the binary */
+#define	BISZ_MAGIC		0x4249535a	/* Marked with this value: 'BISZ' */
+#define	BISZ_MAGIC_IDX		0		/* Word 0: magic */
+#define	BISZ_TXTST_IDX		1		/*	1: text start */
+#define	BISZ_TXTEND_IDX		2		/*	2: text end */
+#define	BISZ_DATAST_IDX		3		/*	3: data start */
+#define	BISZ_DATAEND_IDX	4		/*	4: data end */
+#define	BISZ_BSSST_IDX		5		/*	5: bss start */
+#define	BISZ_BSSEND_IDX		6		/*	6: bss end */
+#define BISZ_SIZE		7		/* descriptor size in 32-bit integers */
+
+/* Boot/Kernel related defintion and functions */
+#define	SOC_BOOTDEV_ROM		0x00000001
+#define	SOC_BOOTDEV_PFLASH	0x00000002
+#define	SOC_BOOTDEV_SFLASH	0x00000004
+#define	SOC_BOOTDEV_NANDFLASH	0x00000008
+
+#define	SOC_KNLDEV_NORFLASH	0x00000002
+#define	SOC_KNLDEV_NANDFLASH	0x00000004
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+int soc_boot_dev(void *sih);
+int soc_knl_dev(void *sih);
+#endif	/* !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__) */
+
+#endif /* _HNDSOC_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/linux_osl.h b/drivers/net/wireless/bcm4336/include/linux_osl.h
--- a/drivers/net/wireless/bcm4336/include/linux_osl.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/linux_osl.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,1028 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: linux_osl.h 503131 2014-09-17 12:16:08Z $
+ */
+
+#ifndef _linux_osl_h_
+#define _linux_osl_h_
+
+#include <typedefs.h>
+#define DECLSPEC_ALIGN(x)	__attribute__ ((aligned(x)))
+
+/* Linux Kernel: File Operations: start */
+extern void * osl_os_open_image(char * filename);
+extern int osl_os_get_image_block(char * buf, int len, void * image);
+extern void osl_os_close_image(void * image);
+extern int osl_os_image_size(void *image);
+/* Linux Kernel: File Operations: end */
+
+#ifdef BCMDRIVER
+
+/* OSL initialization */
+#ifdef SHARED_OSL_CMN
+extern osl_t *osl_attach(void *pdev, uint bustype, bool pkttag, void **osh_cmn);
+#else
+extern osl_t *osl_attach(void *pdev, uint bustype, bool pkttag);
+#endif /* SHARED_OSL_CMN */
+
+extern void osl_detach(osl_t *osh);
+extern int osl_static_mem_init(osl_t *osh, void *adapter);
+extern int osl_static_mem_deinit(osl_t *osh, void *adapter);
+extern void osl_set_bus_handle(osl_t *osh, void *bus_handle);
+extern void* osl_get_bus_handle(osl_t *osh);
+
+/* Global ASSERT type */
+extern uint32 g_assert_type;
+
+/* ASSERT */
+#if defined(BCMASSERT_LOG)
+	#define ASSERT(exp) \
+	  do { if (!(exp)) osl_assert(#exp, __FILE__, __LINE__); } while (0)
+extern void osl_assert(const char *exp, const char *file, int line);
+#else
+	#ifdef __GNUC__
+		#define GCC_VERSION \
+			(__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
+		#if GCC_VERSION > 30100
+			#define ASSERT(exp)	do {} while (0)
+		#else
+			/* ASSERT could cause segmentation fault on GCC3.1, use empty instead */
+			#define ASSERT(exp)
+		#endif /* GCC_VERSION > 30100 */
+	#endif /* __GNUC__ */
+#endif
+
+/* bcm_prefetch_32B */
+static inline void bcm_prefetch_32B(const uint8 *addr, const int cachelines_32B)
+{
+#if defined(BCM47XX_CA9) && (__LINUX_ARM_ARCH__ >= 5)
+	switch (cachelines_32B) {
+		case 4: __asm__ __volatile__("pld\t%a0" :: "p"(addr + 96) : "cc");
+		case 3: __asm__ __volatile__("pld\t%a0" :: "p"(addr + 64) : "cc");
+		case 2: __asm__ __volatile__("pld\t%a0" :: "p"(addr + 32) : "cc");
+		case 1: __asm__ __volatile__("pld\t%a0" :: "p"(addr +  0) : "cc");
+	}
+#endif
+}
+
+/* microsecond delay */
+#define	OSL_DELAY(usec)		osl_delay(usec)
+extern void osl_delay(uint usec);
+
+#define OSL_SLEEP(ms)			osl_sleep(ms)
+extern void osl_sleep(uint ms);
+
+#define	OSL_PCMCIA_READ_ATTR(osh, offset, buf, size) \
+	osl_pcmcia_read_attr((osh), (offset), (buf), (size))
+#define	OSL_PCMCIA_WRITE_ATTR(osh, offset, buf, size) \
+	osl_pcmcia_write_attr((osh), (offset), (buf), (size))
+extern void osl_pcmcia_read_attr(osl_t *osh, uint offset, void *buf, int size);
+extern void osl_pcmcia_write_attr(osl_t *osh, uint offset, void *buf, int size);
+
+/* PCI configuration space access macros */
+#define	OSL_PCI_READ_CONFIG(osh, offset, size) \
+	osl_pci_read_config((osh), (offset), (size))
+#define	OSL_PCI_WRITE_CONFIG(osh, offset, size, val) \
+	osl_pci_write_config((osh), (offset), (size), (val))
+extern uint32 osl_pci_read_config(osl_t *osh, uint offset, uint size);
+extern void osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val);
+
+/* PCI device bus # and slot # */
+#define OSL_PCI_BUS(osh)	osl_pci_bus(osh)
+#define OSL_PCI_SLOT(osh)	osl_pci_slot(osh)
+#define OSL_PCIE_DOMAIN(osh)	osl_pcie_domain(osh)
+#define OSL_PCIE_BUS(osh)	osl_pcie_bus(osh)
+extern uint osl_pci_bus(osl_t *osh);
+extern uint osl_pci_slot(osl_t *osh);
+extern uint osl_pcie_domain(osl_t *osh);
+extern uint osl_pcie_bus(osl_t *osh);
+extern struct pci_dev *osl_pci_device(osl_t *osh);
+
+
+/* Pkttag flag should be part of public information */
+typedef struct {
+	bool pkttag;
+	bool mmbus;		/* Bus supports memory-mapped register accesses */
+	pktfree_cb_fn_t tx_fn;  /* Callback function for PKTFREE */
+	void *tx_ctx;		/* Context to the callback function */
+	void	*unused[3];
+} osl_pubinfo_t;
+
+extern void osl_flag_set(osl_t *osh, uint32 mask);
+extern bool osl_is_flag_set(osl_t *osh, uint32 mask);
+
+#define PKTFREESETCB(osh, _tx_fn, _tx_ctx)		\
+	do {						\
+	   ((osl_pubinfo_t*)osh)->tx_fn = _tx_fn;	\
+	   ((osl_pubinfo_t*)osh)->tx_ctx = _tx_ctx;	\
+	} while (0)
+
+
+/* host/bus architecture-specific byte swap */
+#define BUS_SWAP32(v)		(v)
+	#define MALLOC(osh, size)	osl_malloc((osh), (size))
+	#define MALLOCZ(osh, size)	osl_mallocz((osh), (size))
+	#define MFREE(osh, addr, size)	osl_mfree((osh), (addr), (size))
+	#define MALLOCED(osh)		osl_malloced((osh))
+	#define MEMORY_LEFTOVER(osh) osl_check_memleak(osh)
+	extern void *osl_malloc(osl_t *osh, uint size);
+	extern void *osl_mallocz(osl_t *osh, uint size);
+	extern void osl_mfree(osl_t *osh, void *addr, uint size);
+	extern uint osl_malloced(osl_t *osh);
+	extern uint osl_check_memleak(osl_t *osh);
+
+
+#define	MALLOC_FAILED(osh)	osl_malloc_failed((osh))
+extern uint osl_malloc_failed(osl_t *osh);
+
+/* allocate/free shared (dma-able) consistent memory */
+#define	DMA_CONSISTENT_ALIGN	osl_dma_consistent_align()
+#define	DMA_ALLOC_CONSISTENT(osh, size, align, tot, pap, dmah) \
+	osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define	DMA_FREE_CONSISTENT(osh, va, size, pa, dmah) \
+	osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+
+#define	DMA_ALLOC_CONSISTENT_FORCE32(osh, size, align, tot, pap, dmah) \
+	osl_dma_alloc_consistent((osh), (size), (align), (tot), (pap))
+#define	DMA_FREE_CONSISTENT_FORCE32(osh, va, size, pa, dmah) \
+	osl_dma_free_consistent((osh), (void*)(va), (size), (pa))
+
+#if defined(BCMPCIE)
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_FLOWRING)
+#define	DMA_ALLOC_CONSISTENT_STATIC(osh, size, align, tot, pap, dmah, idx) \
+	osl_dma_alloc_consistent_static((osh), (size), (align), (tot), (pap), (idx))
+#define	DMA_FREE_CONSISTENT_STATIC(osh, va, size, pa, dmah, idx) \
+	osl_dma_free_consistent_static((osh), (void*)(va), (size), (pa), (idx))
+
+extern void *osl_dma_alloc_consistent_static(osl_t *osh, uint size, uint16 align,
+	uint *tot, dmaaddr_t *pap, uint16 idx);
+extern void osl_dma_free_consistent_static(osl_t *osh, void *va, uint size, dmaaddr_t pa,
+	uint16 idx);
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_FLOWRING */
+#endif /* BCMPCIE */
+
+extern uint osl_dma_consistent_align(void);
+extern void *osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align,
+	uint *tot, dmaaddr_t *pap);
+extern void osl_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa);
+
+/* map/unmap direction */
+#define	DMA_TX	1	/* TX direction for DMA */
+#define	DMA_RX	2	/* RX direction for DMA */
+
+/* map/unmap shared (dma-able) memory */
+#define	DMA_UNMAP(osh, pa, size, direction, p, dmah) \
+	osl_dma_unmap((osh), (pa), (size), (direction))
+extern dmaaddr_t osl_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+	hnddma_seg_map_t *txp_dmah);
+extern void osl_dma_unmap(osl_t *osh, uint pa, uint size, int direction);
+
+/* API for DMA addressing capability */
+#define OSL_DMADDRWIDTH(osh, addrwidth) ({BCM_REFERENCE(osh); BCM_REFERENCE(addrwidth);})
+
+#if (defined(BCM47XX_CA9) && defined(__ARM_ARCH_7A__))
+	extern void osl_cache_flush(void *va, uint size);
+	extern void osl_cache_inv(void *va, uint size);
+	extern void osl_prefetch(const void *ptr);
+	#define OSL_CACHE_FLUSH(va, len)	osl_cache_flush((void *) va, len)
+	#define OSL_CACHE_INV(va, len)		osl_cache_inv((void *) va, len)
+	#define OSL_PREFETCH(ptr)			osl_prefetch(ptr)
+#ifdef __ARM_ARCH_7A__
+	extern int osl_arch_is_coherent(void);
+	#define OSL_ARCH_IS_COHERENT()		osl_arch_is_coherent()
+#else
+	#define OSL_ARCH_IS_COHERENT()		NULL
+#endif /* __ARM_ARCH_7A__ */
+#else
+	#define OSL_CACHE_FLUSH(va, len)	BCM_REFERENCE(va)
+	#define OSL_CACHE_INV(va, len)		BCM_REFERENCE(va)
+	#define OSL_PREFETCH(ptr)		BCM_REFERENCE(ptr)
+
+	#define OSL_ARCH_IS_COHERENT()		NULL
+#endif
+
+/* register access macros */
+#if defined(BCMSDIO)
+	#include <bcmsdh.h>
+	#define OSL_WRITE_REG(osh, r, v) (bcmsdh_reg_write(osl_get_bus_handle(osh), \
+		(uintptr)(r), sizeof(*(r)), (v)))
+	#define OSL_READ_REG(osh, r) (bcmsdh_reg_read(osl_get_bus_handle(osh), \
+		(uintptr)(r), sizeof(*(r))))
+#elif defined(BCM47XX_ACP_WAR)
+extern void osl_pcie_rreg(osl_t *osh, ulong addr, void *v, uint size);
+
+#define OSL_READ_REG(osh, r) \
+	({\
+		__typeof(*(r)) __osl_v; \
+		osl_pcie_rreg(osh, (uintptr)(r), (void *)&__osl_v, sizeof(*(r))); \
+		__osl_v; \
+	})
+#endif
+
+#if defined(BCM47XX_ACP_WAR)
+	#define SELECT_BUS_WRITE(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+	#define SELECT_BUS_READ(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); bus_op;})
+#else
+
+#if defined(BCMSDIO)
+	#define SELECT_BUS_WRITE(osh, mmap_op, bus_op) if (((osl_pubinfo_t*)(osh))->mmbus) \
+		mmap_op else bus_op
+	#define SELECT_BUS_READ(osh, mmap_op, bus_op) (((osl_pubinfo_t*)(osh))->mmbus) ? \
+		mmap_op : bus_op
+#else
+	#define SELECT_BUS_WRITE(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+	#define SELECT_BUS_READ(osh, mmap_op, bus_op) ({BCM_REFERENCE(osh); mmap_op;})
+#endif
+#endif /* BCM47XX_ACP_WAR */
+
+#define OSL_ERROR(bcmerror)	osl_error(bcmerror)
+extern int osl_error(int bcmerror);
+
+/* the largest reasonable packet buffer driver uses for ethernet MTU in bytes */
+#define	PKTBUFSZ	2048   /* largest reasonable packet buffer, driver uses for ethernet MTU */
+
+#define OSH_NULL   NULL
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ * Macros expand to calls to functions defined in linux_osl.c .
+ */
+#include <linuxver.h>           /* use current 2.4.x calling conventions */
+#include <linux/kernel.h>       /* for vsn/printf's */
+#include <linux/string.h>       /* for mem*, str* */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 29)
+#define OSL_SYSUPTIME()		((uint32)jiffies_to_msecs(jiffies))
+#else
+#define OSL_SYSUPTIME()		((uint32)jiffies * (1000 / HZ))
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 29) */
+
+#ifdef DHD_PRINTF_LL			/* should be KERN_XXX */
+#define	printf(fmt, args...)	printk(DHD_PRINTF_LL fmt, ## args)
+#else
+#define	printf(fmt, args...)	printk(fmt, ## args)
+#endif
+
+#include <linux/kernel.h>	/* for vsn/printf's */
+#include <linux/string.h>	/* for mem*, str* */
+
+/* bcopy's: Linux kernel doesn't provide these (anymore) */
+#define	bcopy(src, dst, len)	memcpy((dst), (src), (len))
+#define	bcmp(b1, b2, len)	memcmp((b1), (b2), (len))
+#define	bzero(b, len)		memset((b), '\0', (len))
+
+/* register access macros */
+
+#define R_REG(osh, r) (\
+	SELECT_BUS_READ(osh, \
+		({ \
+			__typeof(*(r)) __osl_v; \
+			switch (sizeof(*(r))) { \
+				case sizeof(uint8):	__osl_v = \
+					readb((volatile uint8*)(r)); break; \
+				case sizeof(uint16):	__osl_v = \
+					readw((volatile uint16*)(r)); break; \
+				case sizeof(uint32):	__osl_v = \
+					readl((volatile uint32*)(r)); break; \
+			} \
+			__osl_v; \
+		}), \
+		OSL_READ_REG(osh, r)) \
+)
+
+#define W_REG(osh, r, v) do { \
+	SELECT_BUS_WRITE(osh, \
+		switch (sizeof(*(r))) { \
+			case sizeof(uint8):	writeb((uint8)(v), (volatile uint8*)(r)); break; \
+			case sizeof(uint16):	writew((uint16)(v), (volatile uint16*)(r)); break; \
+			case sizeof(uint32):	writel((uint32)(v), (volatile uint32*)(r)); break; \
+		}, \
+		(OSL_WRITE_REG(osh, r, v))); \
+	} while (0)
+
+#define	AND_REG(osh, r, v)		W_REG(osh, (r), R_REG(osh, r) & (v))
+#define	OR_REG(osh, r, v)		W_REG(osh, (r), R_REG(osh, r) | (v))
+
+/* bcopy, bcmp, and bzero functions */
+#define	bcopy(src, dst, len)	memcpy((dst), (src), (len))
+#define	bcmp(b1, b2, len)	memcmp((b1), (b2), (len))
+#define	bzero(b, len)		memset((b), '\0', (len))
+
+/* uncached/cached virtual address */
+#define OSL_UNCACHED(va)	((void *)va)
+#define OSL_CACHED(va)		((void *)va)
+
+#define OSL_PREF_RANGE_LD(va, sz) BCM_REFERENCE(va)
+#define OSL_PREF_RANGE_ST(va, sz) BCM_REFERENCE(va)
+
+/* get processor cycle count */
+#if defined(__i386__)
+#define	OSL_GETCYCLES(x)	rdtscl((x))
+#else
+#define OSL_GETCYCLES(x)	((x) = 0)
+#endif
+
+/* dereference an address that may cause a bus exception */
+#define	BUSPROBE(val, addr)	({ (val) = R_REG(NULL, (addr)); 0; })
+
+/* map/unmap physical to virtual I/O */
+#if !defined(CONFIG_MMC_MSM7X00A)
+#define	REG_MAP(pa, size)	ioremap_nocache((unsigned long)(pa), (unsigned long)(size))
+#else
+#define REG_MAP(pa, size)       (void *)(0)
+#endif /* !defined(CONFIG_MMC_MSM7X00A */
+#define	REG_UNMAP(va)		iounmap((va))
+
+/* shared (dma-able) memory access macros */
+#define	R_SM(r)			*(r)
+#define	W_SM(r, v)		(*(r) = (v))
+#define	BZERO_SM(r, len)	memset((r), '\0', (len))
+
+/* Because the non BINOSL implemenation of the PKT OSL routines are macros (for
+ * performance reasons),  we need the Linux headers.
+ */
+#include <linuxver.h>		/* use current 2.4.x calling conventions */
+
+/* packet primitives */
+#ifdef BCMDBG_CTRACE
+#define	PKTGET(osh, len, send)		osl_pktget((osh), (len), __LINE__, __FILE__)
+#define	PKTDUP(osh, skb)		osl_pktdup((osh), (skb), __LINE__, __FILE__)
+#else
+#define	PKTGET(osh, len, send)		osl_pktget((osh), (len))
+#define	PKTDUP(osh, skb)		osl_pktdup((osh), (skb))
+#endif /* BCMDBG_CTRACE */
+#define PKTLIST_DUMP(osh, buf)		BCM_REFERENCE(osh)
+#define PKTDBG_TRACE(osh, pkt, bit)	BCM_REFERENCE(osh)
+#define	PKTFREE(osh, skb, send)		osl_pktfree((osh), (skb), (send))
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+#define	PKTGET_STATIC(osh, len, send)		osl_pktget_static((osh), (len))
+#define	PKTFREE_STATIC(osh, skb, send)		osl_pktfree_static((osh), (skb), (send))
+#else
+#define	PKTGET_STATIC	PKTGET
+#define	PKTFREE_STATIC	PKTFREE
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+#define	PKTDATA(osh, skb)		({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->data);})
+#define	PKTLEN(osh, skb)		({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->len);})
+#define PKTHEADROOM(osh, skb)		(PKTDATA(osh, skb)-(((struct sk_buff*)(skb))->head))
+#define PKTEXPHEADROOM(osh, skb, b)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 skb_realloc_headroom((struct sk_buff*)(skb), (b)); \
+	 })
+#define PKTTAILROOM(osh, skb)		\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 skb_tailroom((struct sk_buff*)(skb)); \
+	 })
+#define PKTPADTAILROOM(osh, skb, padlen) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 skb_pad((struct sk_buff*)(skb), (padlen)); \
+	 })
+#define	PKTNEXT(osh, skb)		({BCM_REFERENCE(osh); (((struct sk_buff*)(skb))->next);})
+#define	PKTSETNEXT(osh, skb, x)		\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->next = (struct sk_buff*)(x)); \
+	 })
+#define	PKTSETLEN(osh, skb, len)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 __skb_trim((struct sk_buff*)(skb), (len)); \
+	 })
+#define	PKTPUSH(osh, skb, bytes)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 skb_push((struct sk_buff*)(skb), (bytes)); \
+	 })
+#define	PKTPULL(osh, skb, bytes)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 skb_pull((struct sk_buff*)(skb), (bytes)); \
+	 })
+#define	PKTTAG(skb)			((void*)(((struct sk_buff*)(skb))->cb))
+#define PKTSETPOOL(osh, skb, x, y)	BCM_REFERENCE(osh)
+#define	PKTPOOL(osh, skb)		({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+#define PKTFREELIST(skb)        PKTLINK(skb)
+#define PKTSETFREELIST(skb, x)  PKTSETLINK((skb), (x))
+#define PKTPTR(skb)             (skb)
+#define PKTID(skb)              ({BCM_REFERENCE(skb); 0;})
+#define PKTSETID(skb, id)       ({BCM_REFERENCE(skb); BCM_REFERENCE(id);})
+#define PKTSHRINK(osh, m)		({BCM_REFERENCE(osh); m;})
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)
+#define PKTORPHAN(skb)          skb_orphan(skb)
+#else
+#define PKTORPHAN(skb)          ({BCM_REFERENCE(skb); 0;})
+#endif /* LINUX VERSION >= 3.6 */
+
+
+#ifdef BCMDBG_CTRACE
+#define	DEL_CTRACE(zosh, zskb) { \
+	unsigned long zflags; \
+	spin_lock_irqsave(&(zosh)->ctrace_lock, zflags); \
+	list_del(&(zskb)->ctrace_list); \
+	(zosh)->ctrace_num--; \
+	(zskb)->ctrace_start = 0; \
+	(zskb)->ctrace_count = 0; \
+	spin_unlock_irqrestore(&(zosh)->ctrace_lock, zflags); \
+}
+
+#define	UPDATE_CTRACE(zskb, zfile, zline) { \
+	struct sk_buff *_zskb = (struct sk_buff *)(zskb); \
+	if (_zskb->ctrace_count < CTRACE_NUM) { \
+		_zskb->func[_zskb->ctrace_count] = zfile; \
+		_zskb->line[_zskb->ctrace_count] = zline; \
+		_zskb->ctrace_count++; \
+	} \
+	else { \
+		_zskb->func[_zskb->ctrace_start] = zfile; \
+		_zskb->line[_zskb->ctrace_start] = zline; \
+		_zskb->ctrace_start++; \
+		if (_zskb->ctrace_start >= CTRACE_NUM) \
+			_zskb->ctrace_start = 0; \
+	} \
+}
+
+#define	ADD_CTRACE(zosh, zskb, zfile, zline) { \
+	unsigned long zflags; \
+	spin_lock_irqsave(&(zosh)->ctrace_lock, zflags); \
+	list_add(&(zskb)->ctrace_list, &(zosh)->ctrace_list); \
+	(zosh)->ctrace_num++; \
+	UPDATE_CTRACE(zskb, zfile, zline); \
+	spin_unlock_irqrestore(&(zosh)->ctrace_lock, zflags); \
+}
+
+#define PKTCALLER(zskb)	UPDATE_CTRACE((struct sk_buff *)zskb, (char *)__FUNCTION__, __LINE__)
+#endif /* BCMDBG_CTRACE */
+
+#ifdef CTFPOOL
+#define	CTFPOOL_REFILL_THRESH	3
+typedef struct ctfpool {
+	void		*head;
+	spinlock_t	lock;
+	uint		max_obj;
+	uint		curr_obj;
+	uint		obj_size;
+	uint		refills;
+	uint		fast_allocs;
+	uint 		fast_frees;
+	uint 		slow_allocs;
+} ctfpool_t;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define	FASTBUF	(1 << 0)
+#define	PKTSETFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->pktc_flags) |= FASTBUF); \
+	 })
+#define	PKTCLRFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->pktc_flags) &= (~FASTBUF)); \
+	 })
+#define	PKTISFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->pktc_flags) & FASTBUF); \
+	 })
+#define	PKTFAST(osh, skb)	(((struct sk_buff*)(skb))->pktc_flags)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define	FASTBUF	(1 << 16)
+#define	PKTSETFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->mac_len) |= FASTBUF); \
+	 })
+#define	PKTCLRFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->mac_len) &= (~FASTBUF)); \
+	 })
+#define	PKTISFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->mac_len) & FASTBUF); \
+	 })
+#define	PKTFAST(osh, skb)	(((struct sk_buff*)(skb))->mac_len)
+#else
+#define	FASTBUF	(1 << 0)
+#define	PKTSETFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->__unused) |= FASTBUF); \
+	 })
+#define	PKTCLRFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->__unused) &= (~FASTBUF)); \
+	 })
+#define	PKTISFAST(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 ((((struct sk_buff*)(skb))->__unused) & FASTBUF); \
+	 })
+#define	PKTFAST(osh, skb)	(((struct sk_buff*)(skb))->__unused)
+#endif /* 2.6.22 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define	CTFPOOLPTR(osh, skb)	(((struct sk_buff*)(skb))->ctfpool)
+#define	CTFPOOLHEAD(osh, skb)	(((ctfpool_t *)((struct sk_buff*)(skb))->ctfpool)->head)
+#else
+#define	CTFPOOLPTR(osh, skb)	(((struct sk_buff*)(skb))->sk)
+#define	CTFPOOLHEAD(osh, skb)	(((ctfpool_t *)((struct sk_buff*)(skb))->sk)->head)
+#endif
+
+extern void *osl_ctfpool_add(osl_t *osh);
+extern void osl_ctfpool_replenish(osl_t *osh, uint thresh);
+extern int32 osl_ctfpool_init(osl_t *osh, uint numobj, uint size);
+extern void osl_ctfpool_cleanup(osl_t *osh);
+extern void osl_ctfpool_stats(osl_t *osh, void *b);
+#else /* CTFPOOL */
+#define	PKTSETFAST(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTCLRFAST(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTISFAST(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+#endif /* CTFPOOL */
+
+#define	PKTSETCTF(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTCLRCTF(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTISCTF(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+
+#ifdef HNDCTF
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define	SKIPCT	(1 << 2)
+#define	CHAINED	(1 << 3)
+#define	PKTSETSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags |= SKIPCT); \
+	 })
+#define	PKTCLRSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags &= (~SKIPCT)); \
+	 })
+#define	PKTSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags & SKIPCT); \
+	 })
+#define	PKTSETCHAINED(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags |= CHAINED); \
+	 })
+#define	PKTCLRCHAINED(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags &= (~CHAINED)); \
+	 })
+#define	PKTISCHAINED(skb)	(((struct sk_buff*)(skb))->pktc_flags & CHAINED)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define	SKIPCT	(1 << 18)
+#define	CHAINED	(1 << 19)
+#define	PKTSETSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len |= SKIPCT); \
+	 })
+#define	PKTCLRSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len &= (~SKIPCT)); \
+	 })
+#define	PKTSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len & SKIPCT); \
+	 })
+#define	PKTSETCHAINED(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len |= CHAINED); \
+	 })
+#define	PKTCLRCHAINED(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len &= (~CHAINED)); \
+	 })
+#define	PKTISCHAINED(skb)	(((struct sk_buff*)(skb))->mac_len & CHAINED)
+#else /* 2.6.22 */
+#define	SKIPCT	(1 << 2)
+#define	CHAINED	(1 << 3)
+#define	PKTSETSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused |= SKIPCT); \
+	 })
+#define	PKTCLRSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused &= (~SKIPCT)); \
+	 })
+#define	PKTSKIPCT(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused & SKIPCT); \
+	 })
+#define	PKTSETCHAINED(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused |= CHAINED); \
+	 })
+#define	PKTCLRCHAINED(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused &= (~CHAINED)); \
+	 })
+#define	PKTISCHAINED(skb)	(((struct sk_buff*)(skb))->__unused & CHAINED)
+#endif /* 2.6.22 */
+typedef struct ctf_mark {
+	uint32	value;
+}	ctf_mark_t;
+#define CTF_MARK(m)				(m.value)
+#else /* HNDCTF */
+#define	PKTSETSKIPCT(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTCLRSKIPCT(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTSKIPCT(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define CTF_MARK(m)		({BCM_REFERENCE(m); 0;})
+#endif /* HNDCTF */
+
+#if defined(BCM_GMAC3)
+
+/** pktalloced accounting in devices using GMAC Bulk Forwarding to DHD */
+
+/* Account for packets delivered to downstream forwarder by GMAC interface. */
+extern void osl_pkt_tofwder(osl_t *osh, void *skbs, int skb_cnt);
+#define PKTTOFWDER(osh, skbs, skb_cnt)  \
+	osl_pkt_tofwder(((osl_t *)osh), (void *)(skbs), (skb_cnt))
+
+/* Account for packets received from downstream forwarder. */
+#if defined(BCMDBG_CTRACE) /* pkt logging */
+extern void osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt,
+                             int line, char *file);
+#define PKTFRMFWDER(osh, skbs, skb_cnt) \
+	osl_pkt_frmfwder(((osl_t *)osh), (void *)(skbs), (skb_cnt), \
+	                 __LINE__, __FILE__)
+#else  /* ! (BCMDBG_PKT || BCMDBG_CTRACE) */
+extern void osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt);
+#define PKTFRMFWDER(osh, skbs, skb_cnt) \
+	osl_pkt_frmfwder(((osl_t *)osh), (void *)(skbs), (skb_cnt))
+#endif
+
+
+/** GMAC Forwarded packet tagging for reduced cache flush/invalidate.
+ * In FWDERBUF tagged packet, only FWDER_PKTMAPSZ amount of data would have
+ * been accessed in the GMAC forwarder. This may be used to limit the number of
+ * cachelines that need to be flushed or invalidated.
+ * Packets sent to the DHD from a GMAC forwarder will be tagged w/ FWDERBUF.
+ * DHD may clear the FWDERBUF tag, if more than FWDER_PKTMAPSZ was accessed.
+ * Likewise, a debug print of a packet payload in say the ethernet driver needs
+ * to be accompanied with a clear of the FWDERBUF tag.
+ */
+
+/** Forwarded packets, have a HWRXOFF sized rx header (etc.h) */
+#define FWDER_HWRXOFF       (30)
+
+/** Maximum amount of a pktadat that a downstream forwarder (GMAC) may have
+ * read into the L1 cache (not dirty). This may be used in reduced cache ops.
+ *
+ * Max 56: ET HWRXOFF[30] + BRCMHdr[4] + EtherHdr[14] + VlanHdr[4] + IP[4]
+ */
+#define FWDER_PKTMAPSZ      (FWDER_HWRXOFF + 4 + 14 + 4 + 4)
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+
+#define FWDERBUF            (1 << 4)
+#define PKTSETFWDERBUF(osh, skb) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags |= FWDERBUF); \
+	 })
+#define PKTCLRFWDERBUF(osh, skb) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags &= (~FWDERBUF)); \
+	 })
+#define PKTISFWDERBUF(osh, skb) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags & FWDERBUF); \
+	 })
+
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+
+#define FWDERBUF	        (1 << 20)
+#define PKTSETFWDERBUF(osh, skb) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len |= FWDERBUF); \
+	 })
+#define PKTCLRFWDERBUF(osh, skb)  \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len &= (~FWDERBUF)); \
+	 })
+#define PKTISFWDERBUF(osh, skb) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->mac_len & FWDERBUF); \
+	 })
+
+#else /* 2.6.22 */
+
+#define FWDERBUF            (1 << 4)
+#define PKTSETFWDERBUF(osh, skb)  \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused |= FWDERBUF); \
+	 })
+#define PKTCLRFWDERBUF(osh, skb)  \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused &= (~FWDERBUF)); \
+	 })
+#define PKTISFWDERBUF(osh, skb) \
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->__unused & FWDERBUF); \
+	 })
+
+#endif /* 2.6.22 */
+
+#else  /* ! BCM_GMAC3 */
+
+#define PKTSETFWDERBUF(osh, skb)  ({ BCM_REFERENCE(osh); BCM_REFERENCE(skb); })
+#define PKTCLRFWDERBUF(osh, skb)  ({ BCM_REFERENCE(osh); BCM_REFERENCE(skb); })
+#define PKTISFWDERBUF(osh, skb)   ({ BCM_REFERENCE(osh); BCM_REFERENCE(skb); FALSE;})
+
+#endif /* ! BCM_GMAC3 */
+
+
+#ifdef HNDCTF
+/* For broadstream iqos */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#define	TOBR		(1 << 5)
+#define	PKTSETTOBR(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags |= TOBR); \
+	 })
+#define	PKTCLRTOBR(osh, skb)	\
+	({ \
+	 BCM_REFERENCE(osh); \
+	 (((struct sk_buff*)(skb))->pktc_flags &= (~TOBR)); \
+	 })
+#define	PKTISTOBR(skb)	(((struct sk_buff*)(skb))->pktc_flags & TOBR)
+#define	PKTSETCTFIPCTXIF(skb, ifp)	(((struct sk_buff*)(skb))->ctf_ipc_txif = ifp)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22)
+#define	PKTSETTOBR(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTCLRTOBR(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTISTOBR(skb)	({BCM_REFERENCE(skb); FALSE;})
+#define	PKTSETCTFIPCTXIF(skb, ifp)	({BCM_REFERENCE(skb); BCM_REFERENCE(ifp);})
+#else /* 2.6.22 */
+#define	PKTSETTOBR(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTCLRTOBR(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTISTOBR(skb)	({BCM_REFERENCE(skb); FALSE;})
+#define	PKTSETCTFIPCTXIF(skb, ifp)	({BCM_REFERENCE(skb); BCM_REFERENCE(ifp);})
+#endif /* 2.6.22 */
+#else /* HNDCTF */
+#define	PKTSETTOBR(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTCLRTOBR(osh, skb)	({BCM_REFERENCE(osh); BCM_REFERENCE(skb);})
+#define	PKTISTOBR(skb)	({BCM_REFERENCE(skb); FALSE;})
+#endif /* HNDCTF */
+
+
+#ifdef BCMFA
+#ifdef BCMFA_HW_HASH
+#define PKTSETFAHIDX(skb, idx)	(((struct sk_buff*)(skb))->napt_idx = idx)
+#else
+#define PKTSETFAHIDX(skb, idx)	({BCM_REFERENCE(skb); BCM_REFERENCE(idx);})
+#endif /* BCMFA_SW_HASH */
+#define PKTGETFAHIDX(skb)	(((struct sk_buff*)(skb))->napt_idx)
+#define PKTSETFADEV(skb, imp)	(((struct sk_buff*)(skb))->dev = imp)
+#define PKTSETRXDEV(skb)	(((struct sk_buff*)(skb))->rxdev = ((struct sk_buff*)(skb))->dev)
+
+#define	AUX_TCP_FIN_RST	(1 << 0)
+#define	AUX_FREED	(1 << 1)
+#define PKTSETFAAUX(skb)	(((struct sk_buff*)(skb))->napt_flags |= AUX_TCP_FIN_RST)
+#define	PKTCLRFAAUX(skb)	(((struct sk_buff*)(skb))->napt_flags &= (~AUX_TCP_FIN_RST))
+#define	PKTISFAAUX(skb)		(((struct sk_buff*)(skb))->napt_flags & AUX_TCP_FIN_RST)
+#define PKTSETFAFREED(skb)	(((struct sk_buff*)(skb))->napt_flags |= AUX_FREED)
+#define	PKTCLRFAFREED(skb)	(((struct sk_buff*)(skb))->napt_flags &= (~AUX_FREED))
+#define	PKTISFAFREED(skb)	(((struct sk_buff*)(skb))->napt_flags & AUX_FREED)
+#define	PKTISFABRIDGED(skb)	PKTISFAAUX(skb)
+#else
+#define	PKTISFAAUX(skb)		({BCM_REFERENCE(skb); FALSE;})
+#define	PKTISFABRIDGED(skb)	({BCM_REFERENCE(skb); FALSE;})
+#define	PKTISFAFREED(skb)	({BCM_REFERENCE(skb); FALSE;})
+
+#define	PKTCLRFAAUX(skb)	BCM_REFERENCE(skb)
+#define PKTSETFAFREED(skb)	BCM_REFERENCE(skb)
+#define	PKTCLRFAFREED(skb)	BCM_REFERENCE(skb)
+#endif /* BCMFA */
+
+extern void osl_pktfree(osl_t *osh, void *skb, bool send);
+extern void *osl_pktget_static(osl_t *osh, uint len);
+extern void osl_pktfree_static(osl_t *osh, void *skb, bool send);
+extern void osl_pktclone(osl_t *osh, void **pkt);
+
+#ifdef BCMDBG_CTRACE
+#define PKT_CTRACE_DUMP(osh, b)	osl_ctrace_dump((osh), (b))
+extern void *osl_pktget(osl_t *osh, uint len, int line, char *file);
+extern void *osl_pkt_frmnative(osl_t *osh, void *skb, int line, char *file);
+extern int osl_pkt_is_frmnative(osl_t *osh, struct sk_buff *pkt);
+extern void *osl_pktdup(osl_t *osh, void *skb, int line, char *file);
+struct bcmstrbuf;
+extern void osl_ctrace_dump(osl_t *osh, struct bcmstrbuf *b);
+#else
+extern void *osl_pkt_frmnative(osl_t *osh, void *skb);
+extern void *osl_pktget(osl_t *osh, uint len);
+extern void *osl_pktdup(osl_t *osh, void *skb);
+#endif /* BCMDBG_CTRACE */
+extern struct sk_buff *osl_pkt_tonative(osl_t *osh, void *pkt);
+#ifdef BCMDBG_CTRACE
+#define PKTFRMNATIVE(osh, skb)  osl_pkt_frmnative(((osl_t *)osh), \
+				(struct sk_buff*)(skb), __LINE__, __FILE__)
+#define	PKTISFRMNATIVE(osh, skb) osl_pkt_is_frmnative((osl_t *)(osh), (struct sk_buff *)(skb))
+#else
+#define PKTFRMNATIVE(osh, skb)	osl_pkt_frmnative(((osl_t *)osh), (struct sk_buff*)(skb))
+#endif /* BCMDBG_CTRACE */
+#define PKTTONATIVE(osh, pkt)		osl_pkt_tonative((osl_t *)(osh), (pkt))
+
+#define	PKTLINK(skb)			(((struct sk_buff*)(skb))->prev)
+#define	PKTSETLINK(skb, x)		(((struct sk_buff*)(skb))->prev = (struct sk_buff*)(x))
+#define	PKTPRIO(skb)			(((struct sk_buff*)(skb))->priority)
+#define	PKTSETPRIO(skb, x)		(((struct sk_buff*)(skb))->priority = (x))
+#define PKTSUMNEEDED(skb)		(((struct sk_buff*)(skb))->ip_summed == CHECKSUM_HW)
+#define PKTSETSUMGOOD(skb, x)		(((struct sk_buff*)(skb))->ip_summed = \
+						((x) ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE))
+/* PKTSETSUMNEEDED and PKTSUMGOOD are not possible because skb->ip_summed is overloaded */
+#define PKTSHARED(skb)                  (((struct sk_buff*)(skb))->cloned)
+
+#ifdef CONFIG_NF_CONNTRACK_MARK
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define PKTMARK(p)                     (((struct sk_buff *)(p))->mark)
+#define PKTSETMARK(p, m)               ((struct sk_buff *)(p))->mark = (m)
+#else /* !2.6.0 */
+#define PKTMARK(p)                     (((struct sk_buff *)(p))->nfmark)
+#define PKTSETMARK(p, m)               ((struct sk_buff *)(p))->nfmark = (m)
+#endif /* 2.6.0 */
+#else /* CONFIG_NF_CONNTRACK_MARK */
+#define PKTMARK(p)                     0
+#define PKTSETMARK(p, m)
+#endif /* CONFIG_NF_CONNTRACK_MARK */
+
+#define PKTALLOCED(osh)		osl_pktalloced(osh)
+extern uint osl_pktalloced(osl_t *osh);
+
+#define OSL_RAND()		osl_rand()
+extern uint32 osl_rand(void);
+
+#define	DMA_MAP(osh, va, size, direction, p, dmah) \
+	osl_dma_map((osh), (va), (size), (direction), (p), (dmah))
+
+#ifdef PKTC
+/* Use 8 bytes of skb tstamp field to store below info */
+struct chain_node {
+	struct sk_buff	*link;
+	unsigned int	flags:3, pkts:9, bytes:20;
+};
+
+#define CHAIN_NODE(skb)		((struct chain_node*)(((struct sk_buff*)skb)->pktc_cb))
+
+#define	PKTCSETATTR(s, f, p, b)	({CHAIN_NODE(s)->flags = (f); CHAIN_NODE(s)->pkts = (p); \
+	                         CHAIN_NODE(s)->bytes = (b);})
+#define	PKTCCLRATTR(s)		({CHAIN_NODE(s)->flags = CHAIN_NODE(s)->pkts = \
+	                         CHAIN_NODE(s)->bytes = 0;})
+#define	PKTCGETATTR(s)		(CHAIN_NODE(s)->flags << 29 | CHAIN_NODE(s)->pkts << 20 | \
+	                         CHAIN_NODE(s)->bytes)
+#define	PKTCCNT(skb)		(CHAIN_NODE(skb)->pkts)
+#define	PKTCLEN(skb)		(CHAIN_NODE(skb)->bytes)
+#define	PKTCGETFLAGS(skb)	(CHAIN_NODE(skb)->flags)
+#define	PKTCSETFLAGS(skb, f)	(CHAIN_NODE(skb)->flags = (f))
+#define	PKTCCLRFLAGS(skb)	(CHAIN_NODE(skb)->flags = 0)
+#define	PKTCFLAGS(skb)		(CHAIN_NODE(skb)->flags)
+#define	PKTCSETCNT(skb, c)	(CHAIN_NODE(skb)->pkts = (c))
+#define	PKTCINCRCNT(skb)	(CHAIN_NODE(skb)->pkts++)
+#define	PKTCADDCNT(skb, c)	(CHAIN_NODE(skb)->pkts += (c))
+#define	PKTCSETLEN(skb, l)	(CHAIN_NODE(skb)->bytes = (l))
+#define	PKTCADDLEN(skb, l)	(CHAIN_NODE(skb)->bytes += (l))
+#define	PKTCSETFLAG(skb, fb)	(CHAIN_NODE(skb)->flags |= (fb))
+#define	PKTCCLRFLAG(skb, fb)	(CHAIN_NODE(skb)->flags &= ~(fb))
+#define	PKTCLINK(skb)		(CHAIN_NODE(skb)->link)
+#define	PKTSETCLINK(skb, x)	(CHAIN_NODE(skb)->link = (struct sk_buff*)(x))
+#define FOREACH_CHAINED_PKT(skb, nskb) \
+	for (; (skb) != NULL; (skb) = (nskb)) \
+		if ((nskb) = (PKTISCHAINED(skb) ? PKTCLINK(skb) : NULL), \
+		    PKTSETCLINK((skb), NULL), 1)
+#define	PKTCFREE(osh, skb, send) \
+do { \
+	void *nskb; \
+	ASSERT((skb) != NULL); \
+	FOREACH_CHAINED_PKT((skb), nskb) { \
+		PKTCLRCHAINED((osh), (skb)); \
+		PKTCCLRFLAGS((skb)); \
+		PKTFREE((osh), (skb), (send)); \
+	} \
+} while (0)
+#define PKTCENQTAIL(h, t, p) \
+do { \
+	if ((t) == NULL) { \
+		(h) = (t) = (p); \
+	} else { \
+		PKTSETCLINK((t), (p)); \
+		(t) = (p); \
+	} \
+} while (0)
+#endif /* PKTC */
+
+#else /* ! BCMDRIVER */
+
+
+/* ASSERT */
+	#define ASSERT(exp)	do {} while (0)
+
+/* MALLOC and MFREE */
+#define MALLOC(o, l) malloc(l)
+#define MFREE(o, p, l) free(p)
+#include <stdlib.h>
+
+/* str* and mem* functions */
+#include <string.h>
+
+/* *printf functions */
+#include <stdio.h>
+
+/* bcopy, bcmp, and bzero */
+extern void bcopy(const void *src, void *dst, size_t len);
+extern int bcmp(const void *b1, const void *b2, size_t len);
+extern void bzero(void *b, size_t len);
+#endif /* ! BCMDRIVER */
+
+typedef struct sec_cma_info {
+	struct sec_mem_elem *sec_alloc_list;
+	struct sec_mem_elem *sec_alloc_list_tail;
+} sec_cma_info_t;
+
+#ifdef BCM_SECURE_DMA
+
+#define	SECURE_DMA_MAP(osh, va, size, direction, p, dmah, pcma, offset) \
+	osl_sec_dma_map((osh), (va), (size), (direction), (p), (dmah), (pcma), (offset))
+#define	SECURE_DMA_DD_MAP(osh, va, size, direction, p, dmah) \
+	osl_sec_dma_dd_map((osh), (va), (size), (direction), (p), (dmah))
+#define	SECURE_DMA_MAP_TXMETA(osh, va, size, direction, p, dmah, pcma) \
+	osl_sec_dma_map_txmeta((osh), (va), (size), (direction), (p), (dmah), (pcma))
+#define	SECURE_DMA_UNMAP(osh, pa, size, direction, p, dmah, pcma, offset) \
+	osl_sec_dma_unmap((osh), (pa), (size), (direction), (p), (dmah), (pcma), (offset))
+#define	SECURE_DMA_UNMAP_ALL(osh, pcma) \
+osl_sec_dma_unmap_all((osh), (pcma))
+
+#if defined(__ARM_ARCH_7A__)
+#define ACP_WAR_ENAB() 0
+#define ACP_WIN_LIMIT 0
+#define arch_is_coherent() 0
+
+#define CMA_BUFSIZE_4K	4096
+#define CMA_BUFSIZE_2K	2048
+#define CMA_BUFSIZE_512	512
+
+#define	CMA_BUFNUM		2048
+#define SEC_CMA_COHERENT_BLK 0x8000 /* 32768 */
+#define SEC_CMA_COHERENT_MAX 32
+#define CMA_DMA_DESC_MEMBLOCK	(SEC_CMA_COHERENT_BLK * SEC_CMA_COHERENT_MAX)
+#define CMA_DMA_DATA_MEMBLOCK	(CMA_BUFSIZE_4K*CMA_BUFNUM)
+#define	CMA_MEMBLOCK		(CMA_DMA_DESC_MEMBLOCK + CMA_DMA_DATA_MEMBLOCK)
+#define CONT_ARMREGION	0x02		/* Region CMA */
+#else
+#define CONT_MIPREGION	0x00		/* To access the MIPs mem, Not yet... */
+#endif /* !defined __ARM_ARCH_7A__ */
+
+#define SEC_DMA_ALIGN	(1<<16)
+typedef struct sec_mem_elem {
+	size_t			size;
+	int				direction;
+	phys_addr_t		pa_cma;     /* physical  address */
+	void			*va;        /* virtual address of driver pkt */
+	dma_addr_t		dma_handle; /* bus address assign by linux */
+	void			*vac;       /* virtual address of cma buffer */
+	struct	sec_mem_elem	*next;
+} sec_mem_elem_t;
+
+extern dma_addr_t osl_sec_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+	hnddma_seg_map_t *dmah, void *ptr_cma_info, uint offset);
+extern dma_addr_t osl_sec_dma_dd_map(osl_t *osh, void *va, uint size, int direction, void *p,
+	hnddma_seg_map_t *dmah);
+extern dma_addr_t osl_sec_dma_map_txmeta(osl_t *osh, void *va, uint size,
+  int direction, void *p, hnddma_seg_map_t *dmah, void *ptr_cma_info);
+extern void osl_sec_dma_unmap(osl_t *osh, dma_addr_t dma_handle, uint size, int direction,
+	void *p, hnddma_seg_map_t *map, void *ptr_cma_info, uint offset);
+extern void osl_sec_dma_unmap_all(osl_t *osh, void *ptr_cma_info);
+
+#endif /* BCM_SECURE_DMA */
+#endif	/* _linux_osl_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/linuxver.h b/drivers/net/wireless/bcm4336/include/linuxver.h
--- a/drivers/net/wireless/bcm4336/include/linuxver.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/linuxver.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,730 @@
+/*
+ * Linux-specific abstractions to gain some independence from linux kernel versions.
+ * Pave over some 2.2 versus 2.4 versus 2.6 kernel differences.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: linuxver.h 431983 2013-10-25 06:53:27Z $
+ */
+
+#ifndef _linuxver_h_
+#define _linuxver_h_
+
+#include <typedefs.h>
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#include <linux/config.h>
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 33))
+#include <generated/autoconf.h>
+#else
+#include <linux/autoconf.h>
+#endif
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+#include <linux/module.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 1, 0))
+#include <linux/kconfig.h>
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0))
+/* __NO_VERSION__ must be defined for all linkables except one in 2.2 */
+#ifdef __UNDEF_NO_VERSION__
+#undef __NO_VERSION__
+#else
+#define __NO_VERSION__
+#endif
+#endif	/* LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+#define module_param(_name_, _type_, _perm_)	MODULE_PARM(_name_, "i")
+#define module_param_string(_name_, _string_, _size_, _perm_) \
+		MODULE_PARM(_string_, "c" __MODULE_STRING(_size_))
+#endif
+
+/* linux/malloc.h is deprecated, use linux/slab.h instead. */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 9))
+#include <linux/malloc.h>
+#else
+#include <linux/slab.h>
+#endif
+
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+#include <linux/semaphore.h>
+#else
+#include <asm/semaphore.h>
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28))
+#undef IP_TOS
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28)) */
+#include <asm/io.h>
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41))
+#include <linux/workqueue.h>
+#else
+#include <linux/tqueue.h>
+#ifndef work_struct
+#define work_struct tq_struct
+#endif
+#ifndef INIT_WORK
+#define INIT_WORK(_work, _func, _data) INIT_TQUEUE((_work), (_func), (_data))
+#endif
+#ifndef schedule_work
+#define schedule_work(_work) schedule_task((_work))
+#endif
+#ifndef flush_scheduled_work
+#define flush_scheduled_work() flush_scheduled_tasks()
+#endif
+#endif	/* LINUX_VERSION_CODE > KERNEL_VERSION(2, 5, 41) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define DAEMONIZE(a)	do { \
+		allow_signal(SIGKILL);	\
+		allow_signal(SIGTERM);	\
+	} while (0)
+#elif ((LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)) && \
+	(LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)))
+#define DAEMONIZE(a) daemonize(a); \
+	allow_signal(SIGKILL); \
+	allow_signal(SIGTERM);
+#else /* Linux 2.4 (w/o preemption patch) */
+#define RAISE_RX_SOFTIRQ() \
+	cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+	do { if (a) \
+		strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a)))); \
+	} while (0);
+#endif /* LINUX_VERSION_CODE  */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define	MY_INIT_WORK(_work, _func)	INIT_WORK(_work, _func)
+#else
+#define	MY_INIT_WORK(_work, _func)	INIT_WORK(_work, _func, _work)
+#if !(LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18) && defined(RHEL_MAJOR) && \
+	(RHEL_MAJOR == 5))
+/* Exclude RHEL 5 */
+typedef void (*work_func_t)(void *work);
+#endif
+#endif	/* >= 2.6.20 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/* Some distributions have their own 2.6.x compatibility layers */
+#ifndef IRQ_NONE
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
+#endif
+#else
+typedef irqreturn_t(*FN_ISR) (int irq, void *dev_id, struct pt_regs *ptregs);
+#endif	/* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#define IRQF_SHARED	SA_SHIRQ
+#endif /* < 2.6.18 */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 17)
+#ifdef	CONFIG_NET_RADIO
+#define	CONFIG_WIRELESS_EXT
+#endif
+#endif	/* < 2.6.17 */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67)
+#define MOD_INC_USE_COUNT
+#define MOD_DEC_USE_COUNT
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 67) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32)
+#include <linux/sched.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 32) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+#include <linux/sched/rt.h>
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <net/lib80211.h>
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+#include <linux/ieee80211.h>
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+#include <net/ieee80211.h>
+#endif
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 30) */
+
+
+#ifndef __exit
+#define __exit
+#endif
+#ifndef __devexit
+#define __devexit
+#endif
+#ifndef __devinit
+#  if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0))
+#    define __devinit	__init
+#  else
+/* All devices are hotpluggable since linux 3.8.0 */
+#    define __devinit
+#  endif
+#endif /* !__devinit */
+#ifndef __devinitdata
+#define __devinitdata
+#endif
+#ifndef __devexit_p
+#define __devexit_p(x)	x
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0))
+
+#define pci_get_drvdata(dev)		(dev)->sysdata
+#define pci_set_drvdata(dev, value)	(dev)->sysdata = (value)
+
+/*
+ * New-style (2.4.x) PCI/hot-pluggable PCI/CardBus registration
+ */
+
+struct pci_device_id {
+	unsigned int vendor, device;		/* Vendor and device ID or PCI_ANY_ID */
+	unsigned int subvendor, subdevice;	/* Subsystem ID's or PCI_ANY_ID */
+	unsigned int class, class_mask;		/* (class,subclass,prog-if) triplet */
+	unsigned long driver_data;		/* Data private to the driver */
+};
+
+struct pci_driver {
+	struct list_head node;
+	char *name;
+	const struct pci_device_id *id_table;	/* NULL if wants all devices */
+	int (*probe)(struct pci_dev *dev,
+	             const struct pci_device_id *id); /* New device inserted */
+	void (*remove)(struct pci_dev *dev);	/* Device removed (NULL if not a hot-plug
+						 * capable driver)
+						 */
+	void (*suspend)(struct pci_dev *dev);	/* Device suspended */
+	void (*resume)(struct pci_dev *dev);	/* Device woken up */
+};
+
+#define MODULE_DEVICE_TABLE(type, name)
+#define PCI_ANY_ID (~0)
+
+/* compatpci.c */
+#define pci_module_init pci_register_driver
+extern int pci_register_driver(struct pci_driver *drv);
+extern void pci_unregister_driver(struct pci_driver *drv);
+
+#endif /* PCI registration */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18))
+#define pci_module_init pci_register_driver
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18))
+#ifdef MODULE
+#define module_init(x) int init_module(void) { return x(); }
+#define module_exit(x) void cleanup_module(void) { x(); }
+#else
+#define module_init(x)	__initcall(x);
+#define module_exit(x)	__exitcall(x);
+#endif
+#endif	/* LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18) */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)
+#define WL_USE_NETDEV_OPS
+#else
+#undef WL_USE_NETDEV_OPS
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31)) && defined(CONFIG_RFKILL)
+#define WL_CONFIG_RFKILL
+#else
+#undef WL_CONFIG_RFKILL
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 48))
+#define list_for_each(pos, head) \
+	for (pos = (head)->next; pos != (head); pos = pos->next)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 13))
+#define pci_resource_start(dev, bar)	((dev)->base_address[(bar)])
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 44))
+#define pci_resource_start(dev, bar)	((dev)->resource[(bar)].start)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 23))
+#define pci_enable_device(dev) do { } while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 14))
+#define net_device device
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 42))
+
+/*
+ * DMA mapping
+ *
+ * See linux/Documentation/DMA-mapping.txt
+ */
+
+#ifndef PCI_DMA_TODEVICE
+#define	PCI_DMA_TODEVICE	1
+#define	PCI_DMA_FROMDEVICE	2
+#endif
+
+typedef u32 dma_addr_t;
+
+/* Pure 2^n version of get_order */
+static inline int get_order(unsigned long size)
+{
+	int order;
+
+	size = (size-1) >> (PAGE_SHIFT-1);
+	order = -1;
+	do {
+		size >>= 1;
+		order++;
+	} while (size);
+	return order;
+}
+
+static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size,
+                                         dma_addr_t *dma_handle)
+{
+	void *ret;
+	int gfp = GFP_ATOMIC | GFP_DMA;
+
+	ret = (void *)__get_free_pages(gfp, get_order(size));
+
+	if (ret != NULL) {
+		memset(ret, 0, size);
+		*dma_handle = virt_to_bus(ret);
+	}
+	return ret;
+}
+static inline void pci_free_consistent(struct pci_dev *hwdev, size_t size,
+                                       void *vaddr, dma_addr_t dma_handle)
+{
+	free_pages((unsigned long)vaddr, get_order(size));
+}
+#define pci_map_single(cookie, address, size, dir)	virt_to_bus(address)
+#define pci_unmap_single(cookie, address, size, dir)
+
+#endif /* DMA mapping */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 43))
+
+#define dev_kfree_skb_any(a)		dev_kfree_skb(a)
+#define netif_down(dev)			do { (dev)->start = 0; } while (0)
+
+/* pcmcia-cs provides its own netdevice compatibility layer */
+#ifndef _COMPAT_NETDEVICE_H
+
+/*
+ * SoftNet
+ *
+ * For pre-softnet kernels we need to tell the upper layer not to
+ * re-enter start_xmit() while we are in there. However softnet
+ * guarantees not to enter while we are in there so there is no need
+ * to do the netif_stop_queue() dance unless the transmit queue really
+ * gets stuck. This should also improve performance according to tests
+ * done by Aman Singla.
+ */
+
+#define dev_kfree_skb_irq(a)	dev_kfree_skb(a)
+#define netif_wake_queue(dev) \
+		do { clear_bit(0, &(dev)->tbusy); mark_bh(NET_BH); } while (0)
+#define netif_stop_queue(dev)	set_bit(0, &(dev)->tbusy)
+
+static inline void netif_start_queue(struct net_device *dev)
+{
+	dev->tbusy = 0;
+	dev->interrupt = 0;
+	dev->start = 1;
+}
+
+#define netif_queue_stopped(dev)	(dev)->tbusy
+#define netif_running(dev)		(dev)->start
+
+#endif /* _COMPAT_NETDEVICE_H */
+
+#define netif_device_attach(dev)	netif_start_queue(dev)
+#define netif_device_detach(dev)	netif_stop_queue(dev)
+
+/* 2.4.x renamed bottom halves to tasklets */
+#define tasklet_struct				tq_struct
+static inline void tasklet_schedule(struct tasklet_struct *tasklet)
+{
+	queue_task(tasklet, &tq_immediate);
+	mark_bh(IMMEDIATE_BH);
+}
+
+static inline void tasklet_init(struct tasklet_struct *tasklet,
+                                void (*func)(unsigned long),
+                                unsigned long data)
+{
+	tasklet->next = NULL;
+	tasklet->sync = 0;
+	tasklet->routine = (void (*)(void *))func;
+	tasklet->data = (void *)data;
+}
+#define tasklet_kill(tasklet)	{ do {} while (0); }
+
+/* 2.4.x introduced del_timer_sync() */
+#define del_timer_sync(timer) del_timer(timer)
+
+#else
+
+#define netif_down(dev)
+
+#endif /* SoftNet */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3))
+
+/*
+ * Emit code to initialise a tq_struct's routine and data pointers
+ */
+#define PREPARE_TQUEUE(_tq, _routine, _data)			\
+	do {							\
+		(_tq)->routine = _routine;			\
+		(_tq)->data = _data;				\
+	} while (0)
+
+/*
+ * Emit code to initialise all of a tq_struct
+ */
+#define INIT_TQUEUE(_tq, _routine, _data)			\
+	do {							\
+		INIT_LIST_HEAD(&(_tq)->list);			\
+		(_tq)->sync = 0;				\
+		PREPARE_TQUEUE((_tq), (_routine), (_data));	\
+	} while (0)
+
+#endif	/* LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 3) */
+
+/* Power management related macro & routines */
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 9)
+#define	PCI_SAVE_STATE(a, b)	pci_save_state(a)
+#define	PCI_RESTORE_STATE(a, b)	pci_restore_state(a)
+#else
+#define	PCI_SAVE_STATE(a, b)	pci_save_state(a, b)
+#define	PCI_RESTORE_STATE(a, b)	pci_restore_state(a, b)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 6))
+static inline int
+pci_save_state(struct pci_dev *dev, u32 *buffer)
+{
+	int i;
+	if (buffer) {
+		for (i = 0; i < 16; i++)
+			pci_read_config_dword(dev, i * 4, &buffer[i]);
+	}
+	return 0;
+}
+
+static inline int
+pci_restore_state(struct pci_dev *dev, u32 *buffer)
+{
+	int i;
+
+	if (buffer) {
+		for (i = 0; i < 16; i++)
+			pci_write_config_dword(dev, i * 4, buffer[i]);
+	}
+	/*
+	 * otherwise, write the context information we know from bootup.
+	 * This works around a problem where warm-booting from Windows
+	 * combined with a D3(hot)->D0 transition causes PCI config
+	 * header data to be forgotten.
+	 */
+	else {
+		for (i = 0; i < 6; i ++)
+			pci_write_config_dword(dev,
+			                       PCI_BASE_ADDRESS_0 + (i * 4),
+			                       pci_resource_start(dev, i));
+		pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
+	}
+	return 0;
+}
+#endif /* PCI power management */
+
+/* Old cp0 access macros deprecated in 2.4.19 */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 19))
+#define read_c0_count() read_32bit_cp0_register(CP0_COUNT)
+#endif
+
+/* Module refcount handled internally in 2.6.x */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)		do {} while (0)
+#define OLD_MOD_INC_USE_COUNT		MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT		MOD_DEC_USE_COUNT
+#else
+#define OLD_MOD_INC_USE_COUNT		do {} while (0)
+#define OLD_MOD_DEC_USE_COUNT		do {} while (0)
+#endif
+#else /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24) */
+#ifndef SET_MODULE_OWNER
+#define SET_MODULE_OWNER(dev)		do {} while (0)
+#endif
+#ifndef MOD_INC_USE_COUNT
+#define MOD_INC_USE_COUNT			do {} while (0)
+#endif
+#ifndef MOD_DEC_USE_COUNT
+#define MOD_DEC_USE_COUNT			do {} while (0)
+#endif
+#define OLD_MOD_INC_USE_COUNT		MOD_INC_USE_COUNT
+#define OLD_MOD_DEC_USE_COUNT		MOD_DEC_USE_COUNT
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24) */
+
+#ifndef SET_NETDEV_DEV
+#define SET_NETDEV_DEV(net, pdev)	do {} while (0)
+#endif
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0))
+#ifndef HAVE_FREE_NETDEV
+#define free_netdev(dev)		kfree(dev)
+#endif
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0) */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+/* struct packet_type redefined in 2.6.x */
+#define af_packet_priv			data
+#endif
+
+/* suspend args */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+#define DRV_SUSPEND_STATE_TYPE pm_message_t
+#else
+#define DRV_SUSPEND_STATE_TYPE uint32
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#define CHECKSUM_HW	CHECKSUM_PARTIAL
+#endif
+
+typedef struct {
+	void	*parent;  /* some external entity that the thread supposed to work for */
+	char	*proc_name;
+	struct	task_struct *p_task;
+	long	thr_pid;
+	int		prio; /* priority */
+	struct	semaphore sema;
+	int	terminated;
+	struct	completion completed;
+	spinlock_t	spinlock;
+	int		up_cnt;
+} tsk_ctl_t;
+
+
+/* requires  tsk_ctl_t tsk  argument, the caller's priv data is passed in owner ptr */
+/* note this macro assumes there may be only one context waiting on thread's completion */
+#ifdef DHD_DEBUG
+#define DBG_THR(x) printk x
+#else
+#define DBG_THR(x)
+#endif
+
+static inline bool binary_sema_down(tsk_ctl_t *tsk)
+{
+	if (down_interruptible(&tsk->sema) == 0) {
+		unsigned long flags = 0;
+		spin_lock_irqsave(&tsk->spinlock, flags);
+		if (tsk->up_cnt == 1)
+			tsk->up_cnt--;
+		else {
+			DBG_THR(("dhd_dpc_thread: Unexpected up_cnt %d\n", tsk->up_cnt));
+		}
+		spin_unlock_irqrestore(&tsk->spinlock, flags);
+		return false;
+	} else
+		return true;
+}
+
+static inline bool binary_sema_up(tsk_ctl_t *tsk)
+{
+	bool sem_up = false;
+	unsigned long flags = 0;
+
+	spin_lock_irqsave(&tsk->spinlock, flags);
+	if (tsk->up_cnt == 0) {
+		tsk->up_cnt++;
+		sem_up = true;
+	} else if (tsk->up_cnt == 1) {
+		/* dhd_sched_dpc: dpc is alread up! */
+	} else
+		DBG_THR(("dhd_sched_dpc: unexpected up cnt %d!\n", tsk->up_cnt));
+
+	spin_unlock_irqrestore(&tsk->spinlock, flags);
+
+	if (sem_up)
+		up(&tsk->sema);
+
+	return sem_up;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#define SMP_RD_BARRIER_DEPENDS(x) smp_read_barrier_depends(x)
+#else
+#define SMP_RD_BARRIER_DEPENDS(x) smp_rmb(x)
+#endif
+
+#define PROC_START(thread_func, owner, tsk_ctl, flags, name) \
+{ \
+	sema_init(&((tsk_ctl)->sema), 0); \
+	init_completion(&((tsk_ctl)->completed)); \
+	(tsk_ctl)->parent = owner; \
+	(tsk_ctl)->proc_name = name;  \
+	(tsk_ctl)->terminated = FALSE; \
+	(tsk_ctl)->p_task  = kthread_run(thread_func, tsk_ctl, (char*)name); \
+	(tsk_ctl)->thr_pid = (tsk_ctl)->p_task->pid; \
+	spin_lock_init(&((tsk_ctl)->spinlock)); \
+	DBG_THR(("%s(): thread:%s:%lx started\n", __FUNCTION__, \
+		(tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+}
+
+#define PROC_STOP(tsk_ctl) \
+{ \
+	(tsk_ctl)->terminated = TRUE; \
+	smp_wmb(); \
+	up(&((tsk_ctl)->sema));	\
+	wait_for_completion(&((tsk_ctl)->completed)); \
+	DBG_THR(("%s(): thread:%s:%lx terminated OK\n", __FUNCTION__, \
+			 (tsk_ctl)->proc_name, (tsk_ctl)->thr_pid)); \
+	(tsk_ctl)->thr_pid = -1; \
+}
+
+/*  ----------------------- */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31))
+#define KILL_PROC(nr, sig) \
+{ \
+struct task_struct *tsk; \
+struct pid *pid;    \
+pid = find_get_pid((pid_t)nr);    \
+tsk = pid_task(pid, PIDTYPE_PID);    \
+if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)) && (LINUX_VERSION_CODE <= \
+	KERNEL_VERSION(2, 6, 30))
+#define KILL_PROC(pid, sig) \
+{ \
+	struct task_struct *tsk; \
+	tsk = find_task_by_vpid(pid); \
+	if (tsk) send_sig(sig, tsk, 1); \
+}
+#else
+#define KILL_PROC(pid, sig) \
+{ \
+	kill_proc(pid, sig, 1); \
+}
+#endif
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 31) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0))
+#include <linux/time.h>
+#include <linux/wait.h>
+#else
+#include <linux/sched.h>
+
+#define __wait_event_interruptible_timeout(wq, condition, ret)		\
+do {									\
+	wait_queue_t __wait;						\
+	init_waitqueue_entry(&__wait, current);				\
+									\
+	add_wait_queue(&wq, &__wait);					\
+	for (;;) {							\
+		set_current_state(TASK_INTERRUPTIBLE);			\
+		if (condition)						\
+			break;						\
+		if (!signal_pending(current)) {				\
+			ret = schedule_timeout(ret);			\
+			if (!ret)					\
+				break;					\
+			continue;					\
+		}							\
+		ret = -ERESTARTSYS;					\
+		break;							\
+	}								\
+	current->state = TASK_RUNNING;					\
+	remove_wait_queue(&wq, &__wait);				\
+} while (0)
+
+#define wait_event_interruptible_timeout(wq, condition, timeout)	\
+({									\
+	long __ret = timeout;						\
+	if (!(condition))						\
+		__wait_event_interruptible_timeout(wq, condition, __ret); \
+	__ret;								\
+})
+
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)) */
+
+/*
+For < 2.6.24, wl creates its own netdev but doesn't
+align the priv area like the genuine alloc_netdev().
+Since netdev_priv() always gives us the aligned address, it will
+not match our unaligned address for < 2.6.24
+*/
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#define DEV_PRIV(dev)	(dev->priv)
+#else
+#define DEV_PRIV(dev)	netdev_priv(dev)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20)
+#define WL_ISR(i, d, p)         wl_isr((i), (d))
+#else
+#define WL_ISR(i, d, p)         wl_isr((i), (d), (p))
+#endif  /* < 2.6.20 */
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0))
+#define netdev_priv(dev) dev->priv
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25))
+#define CAN_SLEEP()	((!in_atomic() && !irqs_disabled()))
+#else
+#define CAN_SLEEP()	(FALSE)
+#endif
+
+#define KMALLOC_FLAG (CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define RANDOM32	prandom_u32
+#else
+#define RANDOM32	random32
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define SRANDOM32(entropy)	prandom_seed(entropy)
+#else
+#define SRANDOM32(entropy)	srandom32(entropy)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0) */
+
+/*
+ * Overide latest kfifo functions with
+ * older version to work on older kernels
+ */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) && !defined(WL_COMPAT_WIRELESS)
+#define kfifo_in_spinlocked(a, b, c, d)		kfifo_put(a, (u8 *)b, c)
+#define kfifo_out_spinlocked(a, b, c, d)	kfifo_get(a, (u8 *)b, c)
+#define kfifo_esize(a)				1
+#elif (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 32)) && \
+	(LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)) &&	!defined(WL_COMPAT_WIRELESS)
+#define kfifo_in_spinlocked(a, b, c, d)		kfifo_in_locked(a, b, c, d)
+#define kfifo_out_spinlocked(a, b, c, d)	kfifo_out_locked(a, b, c, d)
+#define kfifo_esize(a)				1
+#endif /* (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 33)) */
+
+#endif /* _linuxver_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/Makefile b/drivers/net/wireless/bcm4336/include/Makefile
--- a/drivers/net/wireless/bcm4336/include/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/Makefile	2018-05-06 08:49:50.626754176 +0200
@@ -0,0 +1,53 @@
+#!/bin/bash
+#
+# This script serves following purpose:
+#
+# 1. It generates native version information by querying
+#    automerger maintained database to see where src/include
+#    came from
+# 2. For select components, as listed in compvers.sh
+#    it generates component version files
+#
+# Copyright 2005, Broadcom, Inc.
+#
+# $Id: Makefile 347587 2012-07-27 09:13:31Z $
+#
+
+export SRCBASE:=..
+
+TARGETS := epivers.h
+
+ifdef VERBOSE
+export VERBOSE
+endif
+
+all release: epivers compvers
+
+# Generate epivers.h for native branch url
+epivers:
+	bash epivers.sh
+
+# Generate component versions based on component url
+compvers:
+	@if [ -s "compvers.sh" ]; then \
+		echo "Generating component versions, if any"; \
+		bash compvers.sh; \
+	else \
+		echo "Skipping component version generation"; \
+	fi
+
+# Generate epivers.h for native branch version
+clean_compvers:
+	@if [ -s "compvers.sh" ]; then \
+		echo "bash compvers.sh clean"; \
+		bash compvers.sh clean; \
+	else \
+		echo "Skipping component version clean"; \
+	fi
+
+clean:
+	rm -f $(TARGETS) *.prev
+
+clean_all: clean clean_compvers
+
+.PHONY: all release clean epivers compvers clean_compvers
diff -ENwbur a/drivers/net/wireless/bcm4336/include/miniopt.h b/drivers/net/wireless/bcm4336/include/miniopt.h
--- a/drivers/net/wireless/bcm4336/include/miniopt.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/miniopt.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,61 @@
+/*
+ * Command line options parser.
+ *
+ * $Copyright Open Broadcom Corporation$
+ * $Id: miniopt.h 484281 2014-06-12 22:42:26Z $
+ */
+
+
+#ifndef MINI_OPT_H
+#define MINI_OPT_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* ---- Include Files ---------------------------------------------------- */
+
+
+/* ---- Constants and Types ---------------------------------------------- */
+
+#define MINIOPT_MAXKEY	128	/* Max options */
+typedef struct miniopt {
+
+	/* These are persistent after miniopt_init() */
+	const char* name;		/* name for prompt in error strings */
+	const char* flags;		/* option chars that take no args */
+	bool longflags;		/* long options may be flags */
+	bool opt_end;		/* at end of options (passed a "--") */
+
+	/* These are per-call to miniopt() */
+
+	int consumed;		/* number of argv entries cosumed in
+				 * the most recent call to miniopt()
+				 */
+	bool positional;
+	bool good_int;		/* 'val' member is the result of a sucessful
+				 * strtol conversion of the option value
+				 */
+	char opt;
+	char key[MINIOPT_MAXKEY];
+	char* valstr;		/* positional param, or value for the option,
+				 * or null if the option had
+				 * no accompanying value
+				 */
+	uint uval;		/* strtol translation of valstr */
+	int  val;		/* strtol translation of valstr */
+} miniopt_t;
+
+void miniopt_init(miniopt_t *t, const char* name, const char* flags, bool longflags);
+int miniopt(miniopt_t *t, char **argv);
+
+
+/* ---- Variable Externs ------------------------------------------------- */
+/* ---- Function Prototypes ---------------------------------------------- */
+
+
+#ifdef __cplusplus
+	}
+#endif
+
+#endif  /* MINI_OPT_H  */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/msgtrace.h b/drivers/net/wireless/bcm4336/include/msgtrace.h
--- a/drivers/net/wireless/bcm4336/include/msgtrace.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/msgtrace.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,60 @@
+/*
+ * Trace messages sent over HBUS
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: msgtrace.h 439681 2013-11-27 15:39:50Z $
+ */
+
+#ifndef	_MSGTRACE_H
+#define	_MSGTRACE_H
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+/* for osl_t */
+#include <osl_decl.h>
+#define MSGTRACE_VERSION 1
+
+/* Message trace header */
+typedef BWL_PRE_PACKED_STRUCT struct msgtrace_hdr {
+	uint8	version;
+	uint8   trace_type;
+#define MSGTRACE_HDR_TYPE_MSG 0
+#define MSGTRACE_HDR_TYPE_LOG 1
+	uint16	len;	/* Len of the trace */
+	uint32	seqnum;	/* Sequence number of message. Useful if the messsage has been lost
+			 * because of DMA error or a bus reset (ex: SDIO Func2)
+			 */
+	/* Msgtrace type  only */
+	uint32  discarded_bytes;  /* Number of discarded bytes because of trace overflow  */
+	uint32  discarded_printf; /* Number of discarded printf because of trace overflow */
+} BWL_POST_PACKED_STRUCT msgtrace_hdr_t;
+
+#define MSGTRACE_HDRLEN 	sizeof(msgtrace_hdr_t)
+
+/* The hbus driver generates traces when sending a trace message. This causes endless traces.
+ * This flag must be set to TRUE in any hbus traces. The flag is reset in the function msgtrace_put.
+ * This prevents endless traces but generates hasardous lost of traces only in bus device code.
+ * It is recommendat to set this flag in macro SD_TRACE but not in SD_ERROR for avoiding missing
+ * hbus error traces. hbus error trace should not generates endless traces.
+ */
+extern bool msgtrace_hbus_trace;
+
+typedef void (*msgtrace_func_send_t)(void *hdl1, void *hdl2, uint8 *hdr,
+                                     uint16 hdrlen, uint8 *buf, uint16 buflen);
+extern void msgtrace_start(void);
+extern void msgtrace_stop(void);
+extern int msgtrace_sent(void);
+extern void msgtrace_put(char *buf, int count);
+extern void msgtrace_init(void *hdl1, void *hdl2, msgtrace_func_send_t func_send);
+extern bool msgtrace_event_enabled(void);
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif	/* _MSGTRACE_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/osl_decl.h b/drivers/net/wireless/bcm4336/include/osl_decl.h
--- a/drivers/net/wireless/bcm4336/include/osl_decl.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/osl_decl.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,16 @@
+/*
+ * osl forward declarations
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id$
+ */
+
+#ifndef _osl_decl_h_
+#define _osl_decl_h_
+
+/* osl handle type forward declaration */
+typedef struct osl_info osl_t;
+typedef struct osl_dmainfo osldma_t;
+
+#endif
diff -ENwbur a/drivers/net/wireless/bcm4336/include/osl.h b/drivers/net/wireless/bcm4336/include/osl.h
--- a/drivers/net/wireless/bcm4336/include/osl.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/osl.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,143 @@
+/*
+ * OS Abstraction Layer
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: osl.h 503131 2014-09-17 12:16:08Z $
+ */
+
+#ifndef _osl_h_
+#define _osl_h_
+
+#include <osl_decl.h>
+
+#define OSL_PKTTAG_SZ	32 /* Size of PktTag */
+
+/* Drivers use PKTFREESETCB to register a callback function when a packet is freed by OSL */
+typedef void (*pktfree_cb_fn_t)(void *ctx, void *pkt, unsigned int status);
+
+/* Drivers use REGOPSSET() to register register read/write funcitons */
+typedef unsigned int (*osl_rreg_fn_t)(void *ctx, volatile void *reg, unsigned int size);
+typedef void  (*osl_wreg_fn_t)(void *ctx, volatile void *reg, unsigned int val, unsigned int size);
+
+
+
+#include <linux_osl.h>
+
+#ifndef PKTDBG_TRACE
+#define PKTDBG_TRACE(osh, pkt, bit)	BCM_REFERENCE(osh)
+#endif
+
+#define PKTCTFMAP(osh, p)		BCM_REFERENCE(osh)
+
+/* --------------------------------------------------------------------------
+** Register manipulation macros.
+*/
+
+#define	SET_REG(osh, r, mask, val)	W_REG((osh), (r), ((R_REG((osh), r) & ~(mask)) | (val)))
+
+#ifndef AND_REG
+#define AND_REG(osh, r, v)		W_REG(osh, (r), R_REG(osh, r) & (v))
+#endif   /* !AND_REG */
+
+#ifndef OR_REG
+#define OR_REG(osh, r, v)		W_REG(osh, (r), R_REG(osh, r) | (v))
+#endif   /* !OR_REG */
+
+#if !defined(OSL_SYSUPTIME)
+#define OSL_SYSUPTIME() (0)
+#define OSL_SYSUPTIME_SUPPORT FALSE
+#else
+#define OSL_SYSUPTIME_SUPPORT TRUE
+#endif /* OSL_SYSUPTIME */
+
+#if !defined(PKTC) && !defined(PKTC_DONGLE)
+#define	PKTCGETATTR(skb)	(0)
+#define	PKTCSETATTR(skb, f, p, b) BCM_REFERENCE(skb)
+#define	PKTCCLRATTR(skb)	BCM_REFERENCE(skb)
+#define	PKTCCNT(skb)		(1)
+#define	PKTCLEN(skb)		PKTLEN(NULL, skb)
+#define	PKTCGETFLAGS(skb)	(0)
+#define	PKTCSETFLAGS(skb, f)	BCM_REFERENCE(skb)
+#define	PKTCCLRFLAGS(skb)	BCM_REFERENCE(skb)
+#define	PKTCFLAGS(skb)		(0)
+#define	PKTCSETCNT(skb, c)	BCM_REFERENCE(skb)
+#define	PKTCINCRCNT(skb)	BCM_REFERENCE(skb)
+#define	PKTCADDCNT(skb, c)	BCM_REFERENCE(skb)
+#define	PKTCSETLEN(skb, l)	BCM_REFERENCE(skb)
+#define	PKTCADDLEN(skb, l)	BCM_REFERENCE(skb)
+#define	PKTCSETFLAG(skb, fb)	BCM_REFERENCE(skb)
+#define	PKTCCLRFLAG(skb, fb)	BCM_REFERENCE(skb)
+#define	PKTCLINK(skb)		NULL
+#define	PKTSETCLINK(skb, x)	BCM_REFERENCE(skb)
+#define FOREACH_CHAINED_PKT(skb, nskb) \
+	for ((nskb) = NULL; (skb) != NULL; (skb) = (nskb))
+#define	PKTCFREE		PKTFREE
+#define PKTCENQTAIL(h, t, p) \
+do { \
+	if ((t) == NULL) { \
+		(h) = (t) = (p); \
+	} \
+} while (0)
+#endif /* !linux || !PKTC */
+
+#if !defined(HNDCTF) && !defined(PKTC_TX_DONGLE)
+#define PKTSETCHAINED(osh, skb)		BCM_REFERENCE(osh)
+#define PKTCLRCHAINED(osh, skb)		BCM_REFERENCE(osh)
+#define PKTISCHAINED(skb)		FALSE
+#endif
+
+/* Lbuf with fraglist */
+#define PKTFRAGPKTID(osh, lb)		(0)
+#define PKTSETFRAGPKTID(osh, lb, id)	BCM_REFERENCE(osh)
+#define PKTFRAGTOTNUM(osh, lb)		(0)
+#define PKTSETFRAGTOTNUM(osh, lb, tot)	BCM_REFERENCE(osh)
+#define PKTFRAGTOTLEN(osh, lb)		(0)
+#define PKTSETFRAGTOTLEN(osh, lb, len)	BCM_REFERENCE(osh)
+#define PKTIFINDEX(osh, lb)		(0)
+#define PKTSETIFINDEX(osh, lb, idx)	BCM_REFERENCE(osh)
+#define	PKTGETLF(osh, len, send, lbuf_type)	(0)
+
+/* in rx path, reuse totlen as used len */
+#define PKTFRAGUSEDLEN(osh, lb)			(0)
+#define PKTSETFRAGUSEDLEN(osh, lb, len)		BCM_REFERENCE(osh)
+
+#define PKTFRAGLEN(osh, lb, ix)			(0)
+#define PKTSETFRAGLEN(osh, lb, ix, len)		BCM_REFERENCE(osh)
+#define PKTFRAGDATA_LO(osh, lb, ix)		(0)
+#define PKTSETFRAGDATA_LO(osh, lb, ix, addr)	BCM_REFERENCE(osh)
+#define PKTFRAGDATA_HI(osh, lb, ix)		(0)
+#define PKTSETFRAGDATA_HI(osh, lb, ix, addr)	BCM_REFERENCE(osh)
+
+/* RX FRAG */
+#define PKTISRXFRAG(osh, lb)    	(0)
+#define PKTSETRXFRAG(osh, lb)		BCM_REFERENCE(osh)
+#define PKTRESETRXFRAG(osh, lb)		BCM_REFERENCE(osh)
+
+/* TX FRAG */
+#define PKTISTXFRAG(osh, lb)		(0)
+#define PKTSETTXFRAG(osh, lb)		BCM_REFERENCE(osh)
+
+/* Need Rx completion used for AMPDU reordering */
+#define PKTNEEDRXCPL(osh, lb)           (TRUE)
+#define PKTSETNORXCPL(osh, lb)          BCM_REFERENCE(osh)
+#define PKTRESETNORXCPL(osh, lb)        BCM_REFERENCE(osh)
+
+#define PKTISFRAG(osh, lb)		(0)
+#define PKTFRAGISCHAINED(osh, i)	(0)
+/* TRIM Tail bytes from lfrag */
+#define PKTFRAG_TRIM_TAILBYTES(osh, p, len)	PKTSETLEN(osh, p, PKTLEN(osh, p) - len)
+#ifdef BCM_SECURE_DMA
+#define SECURE_DMA_ENAB(osh) (1)
+#else
+
+#define SECURE_DMA_ENAB(osh) (0)
+#define	SECURE_DMA_MAP(osh, va, size, direction, p, dmah, pcma, offset) ((dmaaddr_t) {(0)})
+#define	SECURE_DMA_DD_MAP(osh, va, size, direction, p, dmah) 0
+#define	SECURE_DMA_MAP_TXMETA(osh, va, size, direction, p, dmah, pcma) ((dmaaddr_t) {(0)})
+#define	SECURE_DMA_UNMAP(osh, pa, size, direction, p, dmah, pcma, offset)
+#define	SECURE_DMA_UNMAP_ALL(osh, pcma)
+
+#endif
+
+#endif	/* _osl_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/packed_section_end.h b/drivers/net/wireless/bcm4336/include/packed_section_end.h
--- a/drivers/net/wireless/bcm4336/include/packed_section_end.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/packed_section_end.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,41 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * $Copyright Open Broadcom Corporation$
+ * $Id: packed_section_end.h 437241 2013-11-18 07:39:24Z $
+ */
+
+
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is NOT defined at this
+ * point, then there is a missing include of packed_section_start.h.
+ */
+#ifdef BWL_PACKED_SECTION
+	#undef BWL_PACKED_SECTION
+#else
+	#error "BWL_PACKED_SECTION is NOT defined!"
+#endif
+
+
+
+
+/* Compiler-specific directives for structure packing are declared in
+ * packed_section_start.h. This marks the end of the structure packing section,
+ * so, undef them here.
+ */
+#undef	BWL_PRE_PACKED_STRUCT
+#undef	BWL_POST_PACKED_STRUCT
diff -ENwbur a/drivers/net/wireless/bcm4336/include/packed_section_start.h b/drivers/net/wireless/bcm4336/include/packed_section_start.h
--- a/drivers/net/wireless/bcm4336/include/packed_section_start.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/packed_section_start.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,45 @@
+/*
+ * Declare directives for structure packing. No padding will be provided
+ * between the members of packed structures, and therefore, there is no
+ * guarantee that structure members will be aligned.
+ *
+ * Declaring packed structures is compiler specific. In order to handle all
+ * cases, packed structures should be delared as:
+ *
+ * #include <packed_section_start.h>
+ *
+ * typedef BWL_PRE_PACKED_STRUCT struct foobar_t {
+ *    some_struct_members;
+ * } BWL_POST_PACKED_STRUCT foobar_t;
+ *
+ * #include <packed_section_end.h>
+ *
+ *
+ * $Copyright Open Broadcom Corporation$
+ * $Id: packed_section_start.h 437241 2013-11-18 07:39:24Z $
+ */
+
+
+/* Error check - BWL_PACKED_SECTION is defined in packed_section_start.h
+ * and undefined in packed_section_end.h. If it is already defined at this
+ * point, then there is a missing include of packed_section_end.h.
+ */
+#ifdef BWL_PACKED_SECTION
+	#error "BWL_PACKED_SECTION is already defined!"
+#else
+	#define BWL_PACKED_SECTION
+#endif
+
+
+
+
+/* Declare compiler-specific directives for structure packing. */
+#if defined(__GNUC__) || defined(__lint)
+	#define	BWL_PRE_PACKED_STRUCT
+	#define	BWL_POST_PACKED_STRUCT	__attribute__ ((packed))
+#elif defined(__CC_ARM)
+	#define	BWL_PRE_PACKED_STRUCT	__packed
+	#define	BWL_POST_PACKED_STRUCT
+#else
+	#error "Unknown compiler!"
+#endif
diff -ENwbur a/drivers/net/wireless/bcm4336/include/pcicfg.h b/drivers/net/wireless/bcm4336/include/pcicfg.h
--- a/drivers/net/wireless/bcm4336/include/pcicfg.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/pcicfg.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,600 @@
+/*
+ * pcicfg.h: PCI configuration constants and structures.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: pcicfg.h 506084 2014-10-02 15:34:59Z $
+ */
+
+#ifndef	_h_pcicfg_
+#define	_h_pcicfg_
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* The following inside ifndef's so we don't collide with NTDDK.H */
+#ifndef PCI_MAX_BUS
+#define PCI_MAX_BUS		0x100
+#endif
+#ifndef PCI_MAX_DEVICES
+#define PCI_MAX_DEVICES		0x20
+#endif
+#ifndef PCI_MAX_FUNCTION
+#define PCI_MAX_FUNCTION	0x8
+#endif
+
+#ifndef PCI_INVALID_VENDORID
+#define PCI_INVALID_VENDORID	0xffff
+#endif
+#ifndef PCI_INVALID_DEVICEID
+#define PCI_INVALID_DEVICEID	0xffff
+#endif
+
+
+/* Convert between bus-slot-function-register and config addresses */
+
+#define	PCICFG_BUS_SHIFT	16	/* Bus shift */
+#define	PCICFG_SLOT_SHIFT	11	/* Slot shift */
+#define	PCICFG_FUN_SHIFT	8	/* Function shift */
+#define	PCICFG_OFF_SHIFT	0	/* Register shift */
+
+#define	PCICFG_BUS_MASK		0xff	/* Bus mask */
+#define	PCICFG_SLOT_MASK	0x1f	/* Slot mask */
+#define	PCICFG_FUN_MASK		7	/* Function mask */
+#define	PCICFG_OFF_MASK		0xff	/* Bus mask */
+
+#define	PCI_CONFIG_ADDR(b, s, f, o)					\
+		((((b) & PCICFG_BUS_MASK) << PCICFG_BUS_SHIFT)		\
+		 | (((s) & PCICFG_SLOT_MASK) << PCICFG_SLOT_SHIFT)	\
+		 | (((f) & PCICFG_FUN_MASK) << PCICFG_FUN_SHIFT)	\
+		 | (((o) & PCICFG_OFF_MASK) << PCICFG_OFF_SHIFT))
+
+#define	PCI_CONFIG_BUS(a)	(((a) >> PCICFG_BUS_SHIFT) & PCICFG_BUS_MASK)
+#define	PCI_CONFIG_SLOT(a)	(((a) >> PCICFG_SLOT_SHIFT) & PCICFG_SLOT_MASK)
+#define	PCI_CONFIG_FUN(a)	(((a) >> PCICFG_FUN_SHIFT) & PCICFG_FUN_MASK)
+#define	PCI_CONFIG_OFF(a)	(((a) >> PCICFG_OFF_SHIFT) & PCICFG_OFF_MASK)
+
+/* PCIE Config space accessing MACROS */
+
+#define	PCIECFG_BUS_SHIFT	24	/* Bus shift */
+#define	PCIECFG_SLOT_SHIFT	19	/* Slot/Device shift */
+#define	PCIECFG_FUN_SHIFT	16	/* Function shift */
+#define	PCIECFG_OFF_SHIFT	0	/* Register shift */
+
+#define	PCIECFG_BUS_MASK	0xff	/* Bus mask */
+#define	PCIECFG_SLOT_MASK	0x1f	/* Slot/Device mask */
+#define	PCIECFG_FUN_MASK	7	/* Function mask */
+#define	PCIECFG_OFF_MASK	0xfff	/* Register mask */
+
+#define	PCIE_CONFIG_ADDR(b, s, f, o)					\
+		((((b) & PCIECFG_BUS_MASK) << PCIECFG_BUS_SHIFT)		\
+		 | (((s) & PCIECFG_SLOT_MASK) << PCIECFG_SLOT_SHIFT)	\
+		 | (((f) & PCIECFG_FUN_MASK) << PCIECFG_FUN_SHIFT)	\
+		 | (((o) & PCIECFG_OFF_MASK) << PCIECFG_OFF_SHIFT))
+
+#define	PCIE_CONFIG_BUS(a)	(((a) >> PCIECFG_BUS_SHIFT) & PCIECFG_BUS_MASK)
+#define	PCIE_CONFIG_SLOT(a)	(((a) >> PCIECFG_SLOT_SHIFT) & PCIECFG_SLOT_MASK)
+#define	PCIE_CONFIG_FUN(a)	(((a) >> PCIECFG_FUN_SHIFT) & PCIECFG_FUN_MASK)
+#define	PCIE_CONFIG_OFF(a)	(((a) >> PCIECFG_OFF_SHIFT) & PCIECFG_OFF_MASK)
+
+/* The actual config space */
+
+#define	PCI_BAR_MAX		6
+
+#define	PCI_ROM_BAR		8
+
+#define	PCR_RSVDA_MAX		2
+
+/* Bits in PCI bars' flags */
+
+#define	PCIBAR_FLAGS		0xf
+#define	PCIBAR_IO		0x1
+#define	PCIBAR_MEM1M		0x2
+#define	PCIBAR_MEM64		0x4
+#define	PCIBAR_PREFETCH		0x8
+#define	PCIBAR_MEM32_MASK	0xFFFFFF80
+
+typedef struct _pci_config_regs {
+	uint16	vendor;
+	uint16	device;
+	uint16	command;
+	uint16	status;
+	uint8	rev_id;
+	uint8	prog_if;
+	uint8	sub_class;
+	uint8	base_class;
+	uint8	cache_line_size;
+	uint8	latency_timer;
+	uint8	header_type;
+	uint8	bist;
+	uint32	base[PCI_BAR_MAX];
+	uint32	cardbus_cis;
+	uint16	subsys_vendor;
+	uint16	subsys_id;
+	uint32	baserom;
+	uint32	rsvd_a[PCR_RSVDA_MAX];
+	uint8	int_line;
+	uint8	int_pin;
+	uint8	min_gnt;
+	uint8	max_lat;
+	uint8	dev_dep[192];
+} pci_config_regs;
+
+#define	SZPCR		(sizeof (pci_config_regs))
+#define	MINSZPCR	64		/* offsetof (dev_dep[0] */
+
+#endif /* !LINUX_POSTMOGRIFY_REMOVAL */
+
+/* pci config status reg has a bit to indicate that capability ptr is present */
+
+#define PCI_CAPPTR_PRESENT	0x0010
+
+/* A structure for the config registers is nice, but in most
+ * systems the config space is not memory mapped, so we need
+ * field offsetts. :-(
+ */
+#define	PCI_CFG_VID		0
+#define	PCI_CFG_DID		2
+#define	PCI_CFG_CMD		4
+#define	PCI_CFG_STAT		6
+#define	PCI_CFG_REV		8
+#define	PCI_CFG_PROGIF		9
+#define	PCI_CFG_SUBCL		0xa
+#define	PCI_CFG_BASECL		0xb
+#define	PCI_CFG_CLSZ		0xc
+#define	PCI_CFG_LATTIM		0xd
+#define	PCI_CFG_HDR		0xe
+#define	PCI_CFG_BIST		0xf
+#define	PCI_CFG_BAR0		0x10
+#define	PCI_CFG_BAR1		0x14
+#define	PCI_CFG_BAR2		0x18
+#define	PCI_CFG_BAR3		0x1c
+#define	PCI_CFG_BAR4		0x20
+#define	PCI_CFG_BAR5		0x24
+#define	PCI_CFG_CIS		0x28
+#define	PCI_CFG_SVID		0x2c
+#define	PCI_CFG_SSID		0x2e
+#define	PCI_CFG_ROMBAR		0x30
+#define PCI_CFG_CAPPTR		0x34
+#define	PCI_CFG_INT		0x3c
+#define	PCI_CFG_PIN		0x3d
+#define	PCI_CFG_MINGNT		0x3e
+#define	PCI_CFG_MAXLAT		0x3f
+#define	PCI_CFG_DEVCTRL		0xd8
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+
+
+/* Classes and subclasses */
+
+typedef enum {
+	PCI_CLASS_OLD = 0,
+	PCI_CLASS_DASDI,
+	PCI_CLASS_NET,
+	PCI_CLASS_DISPLAY,
+	PCI_CLASS_MMEDIA,
+	PCI_CLASS_MEMORY,
+	PCI_CLASS_BRIDGE,
+	PCI_CLASS_COMM,
+	PCI_CLASS_BASE,
+	PCI_CLASS_INPUT,
+	PCI_CLASS_DOCK,
+	PCI_CLASS_CPU,
+	PCI_CLASS_SERIAL,
+	PCI_CLASS_INTELLIGENT = 0xe,
+	PCI_CLASS_SATELLITE,
+	PCI_CLASS_CRYPT,
+	PCI_CLASS_DSP,
+	PCI_CLASS_XOR = 0xfe
+} pci_classes;
+
+typedef enum {
+	PCI_DASDI_SCSI,
+	PCI_DASDI_IDE,
+	PCI_DASDI_FLOPPY,
+	PCI_DASDI_IPI,
+	PCI_DASDI_RAID,
+	PCI_DASDI_OTHER = 0x80
+} pci_dasdi_subclasses;
+
+typedef enum {
+	PCI_NET_ETHER,
+	PCI_NET_TOKEN,
+	PCI_NET_FDDI,
+	PCI_NET_ATM,
+	PCI_NET_OTHER = 0x80
+} pci_net_subclasses;
+
+typedef enum {
+	PCI_DISPLAY_VGA,
+	PCI_DISPLAY_XGA,
+	PCI_DISPLAY_3D,
+	PCI_DISPLAY_OTHER = 0x80
+} pci_display_subclasses;
+
+typedef enum {
+	PCI_MMEDIA_VIDEO,
+	PCI_MMEDIA_AUDIO,
+	PCI_MMEDIA_PHONE,
+	PCI_MEDIA_OTHER = 0x80
+} pci_mmedia_subclasses;
+
+typedef enum {
+	PCI_MEMORY_RAM,
+	PCI_MEMORY_FLASH,
+	PCI_MEMORY_OTHER = 0x80
+} pci_memory_subclasses;
+
+typedef enum {
+	PCI_BRIDGE_HOST,
+	PCI_BRIDGE_ISA,
+	PCI_BRIDGE_EISA,
+	PCI_BRIDGE_MC,
+	PCI_BRIDGE_PCI,
+	PCI_BRIDGE_PCMCIA,
+	PCI_BRIDGE_NUBUS,
+	PCI_BRIDGE_CARDBUS,
+	PCI_BRIDGE_RACEWAY,
+	PCI_BRIDGE_OTHER = 0x80
+} pci_bridge_subclasses;
+
+typedef enum {
+	PCI_COMM_UART,
+	PCI_COMM_PARALLEL,
+	PCI_COMM_MULTIUART,
+	PCI_COMM_MODEM,
+	PCI_COMM_OTHER = 0x80
+} pci_comm_subclasses;
+
+typedef enum {
+	PCI_BASE_PIC,
+	PCI_BASE_DMA,
+	PCI_BASE_TIMER,
+	PCI_BASE_RTC,
+	PCI_BASE_PCI_HOTPLUG,
+	PCI_BASE_OTHER = 0x80
+} pci_base_subclasses;
+
+typedef enum {
+	PCI_INPUT_KBD,
+	PCI_INPUT_PEN,
+	PCI_INPUT_MOUSE,
+	PCI_INPUT_SCANNER,
+	PCI_INPUT_GAMEPORT,
+	PCI_INPUT_OTHER = 0x80
+} pci_input_subclasses;
+
+typedef enum {
+	PCI_DOCK_GENERIC,
+	PCI_DOCK_OTHER = 0x80
+} pci_dock_subclasses;
+
+typedef enum {
+	PCI_CPU_386,
+	PCI_CPU_486,
+	PCI_CPU_PENTIUM,
+	PCI_CPU_ALPHA = 0x10,
+	PCI_CPU_POWERPC = 0x20,
+	PCI_CPU_MIPS = 0x30,
+	PCI_CPU_COPROC = 0x40,
+	PCI_CPU_OTHER = 0x80
+} pci_cpu_subclasses;
+
+typedef enum {
+	PCI_SERIAL_IEEE1394,
+	PCI_SERIAL_ACCESS,
+	PCI_SERIAL_SSA,
+	PCI_SERIAL_USB,
+	PCI_SERIAL_FIBER,
+	PCI_SERIAL_SMBUS,
+	PCI_SERIAL_OTHER = 0x80
+} pci_serial_subclasses;
+
+typedef enum {
+	PCI_INTELLIGENT_I2O
+} pci_intelligent_subclasses;
+
+typedef enum {
+	PCI_SATELLITE_TV,
+	PCI_SATELLITE_AUDIO,
+	PCI_SATELLITE_VOICE,
+	PCI_SATELLITE_DATA,
+	PCI_SATELLITE_OTHER = 0x80
+} pci_satellite_subclasses;
+
+typedef enum {
+	PCI_CRYPT_NETWORK,
+	PCI_CRYPT_ENTERTAINMENT,
+	PCI_CRYPT_OTHER = 0x80
+} pci_crypt_subclasses;
+
+typedef enum {
+	PCI_DSP_DPIO,
+	PCI_DSP_OTHER = 0x80
+} pci_dsp_subclasses;
+
+typedef enum {
+	PCI_XOR_QDMA,
+	PCI_XOR_OTHER = 0x80
+} pci_xor_subclasses;
+
+/* Overlay for a PCI-to-PCI bridge */
+
+#define	PPB_RSVDA_MAX		2
+#define	PPB_RSVDD_MAX		8
+
+typedef struct _ppb_config_regs {
+	uint16	vendor;
+	uint16	device;
+	uint16	command;
+	uint16	status;
+	uint8	rev_id;
+	uint8	prog_if;
+	uint8	sub_class;
+	uint8	base_class;
+	uint8	cache_line_size;
+	uint8	latency_timer;
+	uint8	header_type;
+	uint8	bist;
+	uint32	rsvd_a[PPB_RSVDA_MAX];
+	uint8	prim_bus;
+	uint8	sec_bus;
+	uint8	sub_bus;
+	uint8	sec_lat;
+	uint8	io_base;
+	uint8	io_lim;
+	uint16	sec_status;
+	uint16	mem_base;
+	uint16	mem_lim;
+	uint16	pf_mem_base;
+	uint16	pf_mem_lim;
+	uint32	pf_mem_base_hi;
+	uint32	pf_mem_lim_hi;
+	uint16	io_base_hi;
+	uint16	io_lim_hi;
+	uint16	subsys_vendor;
+	uint16	subsys_id;
+	uint32	rsvd_b;
+	uint8	rsvd_c;
+	uint8	int_pin;
+	uint16	bridge_ctrl;
+	uint8	chip_ctrl;
+	uint8	diag_ctrl;
+	uint16	arb_ctrl;
+	uint32	rsvd_d[PPB_RSVDD_MAX];
+	uint8	dev_dep[192];
+} ppb_config_regs;
+
+/* Everything below is BRCM HND proprietary */
+
+
+/* Brcm PCI configuration registers */
+#define cap_list	rsvd_a[0]
+#define bar0_window	dev_dep[0x80 - 0x40]
+#define bar1_window	dev_dep[0x84 - 0x40]
+#define sprom_control	dev_dep[0x88 - 0x40]
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+
+/* PCI CAPABILITY DEFINES */
+#define PCI_CAP_POWERMGMTCAP_ID		0x01
+#define PCI_CAP_MSICAP_ID		0x05
+#define PCI_CAP_VENDSPEC_ID		0x09
+#define PCI_CAP_PCIECAP_ID		0x10
+
+/* Data structure to define the Message Signalled Interrupt facility
+ * Valid for PCI and PCIE configurations
+ */
+typedef struct _pciconfig_cap_msi {
+	uint8	capID;
+	uint8	nextptr;
+	uint16	msgctrl;
+	uint32	msgaddr;
+} pciconfig_cap_msi;
+#define MSI_ENABLE	0x1		/* bit 0 of msgctrl */
+
+/* Data structure to define the Power managment facility
+ * Valid for PCI and PCIE configurations
+ */
+typedef struct _pciconfig_cap_pwrmgmt {
+	uint8	capID;
+	uint8	nextptr;
+	uint16	pme_cap;
+	uint16	pme_sts_ctrl;
+	uint8	pme_bridge_ext;
+	uint8	data;
+} pciconfig_cap_pwrmgmt;
+
+#define PME_CAP_PM_STATES (0x1f << 27)	/* Bits 31:27 states that can generate PME */
+#define PME_CSR_OFFSET	    0x4		/* 4-bytes offset */
+#define PME_CSR_PME_EN	  (1 << 8)	/* Bit 8 Enable generating of PME */
+#define PME_CSR_PME_STAT  (1 << 15)	/* Bit 15 PME got asserted */
+
+/* Data structure to define the PCIE capability */
+typedef struct _pciconfig_cap_pcie {
+	uint8	capID;
+	uint8	nextptr;
+	uint16	pcie_cap;
+	uint32	dev_cap;
+	uint16	dev_ctrl;
+	uint16	dev_status;
+	uint32	link_cap;
+	uint16	link_ctrl;
+	uint16	link_status;
+	uint32	slot_cap;
+	uint16	slot_ctrl;
+	uint16	slot_status;
+	uint16	root_ctrl;
+	uint16	root_cap;
+	uint32	root_status;
+} pciconfig_cap_pcie;
+
+/* PCIE Enhanced CAPABILITY DEFINES */
+#define PCIE_EXTCFG_OFFSET	0x100
+#define PCIE_ADVERRREP_CAPID	0x0001
+#define PCIE_VC_CAPID		0x0002
+#define PCIE_DEVSNUM_CAPID	0x0003
+#define PCIE_PWRBUDGET_CAPID	0x0004
+
+/* PCIE Extended configuration */
+#define PCIE_ADV_CORR_ERR_MASK	0x114
+#define CORR_ERR_RE	(1 << 0) /* Receiver  */
+#define CORR_ERR_BT 	(1 << 6) /* Bad TLP  */
+#define CORR_ERR_BD	(1 << 7) /* Bad DLLP */
+#define CORR_ERR_RR	(1 << 8) /* REPLAY_NUM rollover */
+#define CORR_ERR_RT	(1 << 12) /* Reply timer timeout */
+#define ALL_CORR_ERRORS (CORR_ERR_RE | CORR_ERR_BT | CORR_ERR_BD | \
+			 CORR_ERR_RR | CORR_ERR_RT)
+
+/* PCIE Root Control Register bits (Host mode only) */
+#define	PCIE_RC_CORR_SERR_EN		0x0001
+#define	PCIE_RC_NONFATAL_SERR_EN	0x0002
+#define	PCIE_RC_FATAL_SERR_EN		0x0004
+#define	PCIE_RC_PME_INT_EN		0x0008
+#define	PCIE_RC_CRS_EN			0x0010
+
+/* PCIE Root Capability Register bits (Host mode only) */
+#define	PCIE_RC_CRS_VISIBILITY		0x0001
+
+/* Header to define the PCIE specific capabilities in the extended config space */
+typedef struct _pcie_enhanced_caphdr {
+	uint16	capID;
+	uint16	cap_ver : 4;
+	uint16	next_ptr : 12;
+} pcie_enhanced_caphdr;
+
+
+#define	PCI_BAR0_WIN		0x80	/* backplane addres space accessed by BAR0 */
+#define	PCI_BAR1_WIN		0x84	/* backplane addres space accessed by BAR1 */
+#define	PCI_SPROM_CONTROL	0x88	/* sprom property control */
+#define	PCI_BAR1_CONTROL	0x8c	/* BAR1 region burst control */
+#define	PCI_INT_STATUS		0x90	/* PCI and other cores interrupts */
+#define	PCI_INT_MASK		0x94	/* mask of PCI and other cores interrupts */
+#define PCI_TO_SB_MB		0x98	/* signal backplane interrupts */
+#define PCI_BACKPLANE_ADDR	0xa0	/* address an arbitrary location on the system backplane */
+#define PCI_BACKPLANE_DATA	0xa4	/* data at the location specified by above address */
+#define	PCI_CLK_CTL_ST		0xa8	/* pci config space clock control/status (>=rev14) */
+#define	PCI_BAR0_WIN2		0xac	/* backplane addres space accessed by second 4KB of BAR0 */
+#define	PCI_GPIO_IN		0xb0	/* pci config space gpio input (>=rev3) */
+#define	PCI_GPIO_OUT		0xb4	/* pci config space gpio output (>=rev3) */
+#define	PCI_GPIO_OUTEN		0xb8	/* pci config space gpio output enable (>=rev3) */
+#define PCI_LINK_CTRL		0xbc	/* PCI link control register */
+#define PCI_DEV_STAT_CTRL2	0xd4	/* PCI device status control 2 register */
+#define PCIE_LTR_MAX_SNOOP	0x1b4	/* PCIE LTRMaxSnoopLatency */
+#define PCI_L1SS_CTRL		0x248	/* The L1 PM Substates Control register */
+#define	PCI_L1SS_CTRL2		0x24c	/* The L1 PM Substates Control 2 register */
+
+/* Private Registers */
+#define	PCI_STAT_CTRL		0xa80
+#define	PCI_L0_EVENTCNT		0xa84
+#define	PCI_L0_STATETMR		0xa88
+#define	PCI_L1_EVENTCNT		0xa8c
+#define	PCI_L1_STATETMR		0xa90
+#define	PCI_L1_1_EVENTCNT	0xa94
+#define	PCI_L1_1_STATETMR	0xa98
+#define	PCI_L1_2_EVENTCNT	0xa9c
+#define	PCI_L1_2_STATETMR	0xaa0
+#define	PCI_L2_EVENTCNT		0xaa4
+#define	PCI_L2_STATETMR		0xaa8
+
+#define	PCI_PMCR_REFUP		0x1814	/* Trefup time */
+#define	PCI_PMCR_REFUP_EXT	0x1818	/* Trefup extend Max */
+#define PCI_TPOWER_SCALE_MASK 0x3
+#define PCI_TPOWER_SCALE_SHIFT 3 /* 0:1 is scale and 2 is rsvd */
+
+
+#define	PCI_BAR0_SHADOW_OFFSET	(2 * 1024)	/* bar0 + 2K accesses sprom shadow (in pci core) */
+#define	PCI_BAR0_SPROM_OFFSET	(4 * 1024)	/* bar0 + 4K accesses external sprom */
+#define	PCI_BAR0_PCIREGS_OFFSET	(6 * 1024)	/* bar0 + 6K accesses pci core registers */
+#define	PCI_BAR0_PCISBR_OFFSET	(4 * 1024)	/* pci core SB registers are at the end of the
+						 * 8KB window, so their address is the "regular"
+						 * address plus 4K
+						 */
+/*
+ * PCIE GEN2 changed some of the above locations for
+ * Bar0WrapperBase, SecondaryBAR0Window and SecondaryBAR0WrapperBase
+ * BAR0 maps 32K of register space
+*/
+#define PCIE2_BAR0_WIN2		0x70 /* backplane addres space accessed by second 4KB of BAR0 */
+#define PCIE2_BAR0_CORE2_WIN	0x74 /* backplane addres space accessed by second 4KB of BAR0 */
+#define PCIE2_BAR0_CORE2_WIN2	0x78 /* backplane addres space accessed by second 4KB of BAR0 */
+
+#define PCI_BAR0_WINSZ		(16 * 1024)	/* bar0 window size Match with corerev 13 */
+/* On pci corerev >= 13 and all pcie, the bar0 is now 16KB and it maps: */
+#define	PCI_16KB0_PCIREGS_OFFSET (8 * 1024)	/* bar0 + 8K accesses pci/pcie core registers */
+#define	PCI_16KB0_CCREGS_OFFSET	(12 * 1024)	/* bar0 + 12K accesses chipc core registers */
+#define PCI_16KBB0_WINSZ	(16 * 1024)	/* bar0 window size */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* On AI chips we have a second window to map DMP regs are mapped: */
+#define	PCI_16KB0_WIN2_OFFSET	(4 * 1024)	/* bar0 + 4K is "Window 2" */
+
+/* PCI_INT_STATUS */
+#define	PCI_SBIM_STATUS_SERR	0x4	/* backplane SBErr interrupt status */
+
+/* PCI_INT_MASK */
+#define	PCI_SBIM_SHIFT		8	/* backplane core interrupt mask bits offset */
+#define	PCI_SBIM_MASK		0xff00	/* backplane core interrupt mask */
+#define	PCI_SBIM_MASK_SERR	0x4	/* backplane SBErr interrupt mask */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* PCI_SPROM_CONTROL */
+#define SPROM_SZ_MSK		0x02	/* SPROM Size Mask */
+#define SPROM_LOCKED		0x08	/* SPROM Locked */
+#define	SPROM_BLANK		0x04	/* indicating a blank SPROM */
+#define SPROM_WRITEEN		0x10	/* SPROM write enable */
+#define SPROM_BOOTROM_WE	0x20	/* external bootrom write enable */
+#define SPROM_BACKPLANE_EN	0x40	/* Enable indirect backplane access */
+#define SPROM_OTPIN_USE		0x80	/* device OTP In use */
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* Bits in PCI command and status regs */
+#define PCI_CMD_IO		0x00000001	/* I/O enable */
+#define PCI_CMD_MEMORY		0x00000002	/* Memory enable */
+#define PCI_CMD_MASTER		0x00000004	/* Master enable */
+#define PCI_CMD_SPECIAL		0x00000008	/* Special cycles enable */
+#define PCI_CMD_INVALIDATE	0x00000010	/* Invalidate? */
+#define PCI_CMD_VGA_PAL		0x00000040	/* VGA Palate */
+#define PCI_STAT_TA		0x08000000	/* target abort status */
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* Header types */
+#define	PCI_HEADER_MULTI	0x80
+#define	PCI_HEADER_MASK		0x7f
+typedef enum {
+	PCI_HEADER_NORMAL,
+	PCI_HEADER_BRIDGE,
+	PCI_HEADER_CARDBUS
+} pci_header_types;
+
+#define PCI_CONFIG_SPACE_SIZE	256
+
+#define DWORD_ALIGN(x)  (x & ~(0x03))
+#define BYTE_POS(x) (x & 0x3)
+#define WORD_POS(x) (x & 0x1)
+
+#define BYTE_SHIFT(x)  (8 * BYTE_POS(x))
+#define WORD_SHIFT(x)  (16 * WORD_POS(x))
+
+#define BYTE_VAL(a, x) ((a >> BYTE_SHIFT(x)) & 0xFF)
+#define WORD_VAL(a, x) ((a >> WORD_SHIFT(x)) & 0xFFFF)
+
+#define read_pci_cfg_byte(a) \
+	(BYTE_VAL(OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4), a) & 0xff)
+
+#define read_pci_cfg_word(a) \
+	(WORD_VAL(OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4), a) & 0xffff)
+
+#define write_pci_cfg_byte(a, val) do { \
+	uint32 tmpval; \
+	tmpval = (OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4) & ~0xFF << BYTE_POS(a)) | \
+		val << BYTE_POS(a); \
+	OSL_PCI_WRITE_CONFIG(osh, DWORD_ALIGN(a), 4, tmpval); \
+	} while (0)
+
+#define write_pci_cfg_word(a, val) do { \
+	uint32 tmpval; \
+	tmpval = (OSL_PCI_READ_CONFIG(osh, DWORD_ALIGN(a), 4) & ~0xFFFF << WORD_POS(a)) | \
+		val << WORD_POS(a); \
+	OSL_PCI_WRITE_CONFIG(osh, DWORD_ALIGN(a), 4, tmpval); \
+	} while (0)
+
+#endif	/* _h_pcicfg_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/pcie_core.h b/drivers/net/wireless/bcm4336/include/pcie_core.h
--- a/drivers/net/wireless/bcm4336/include/pcie_core.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/pcie_core.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,624 @@
+/*
+ * BCM43XX PCIE core hardware definitions.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: pcie_core.h 483003 2014-06-05 19:57:46Z $
+ */
+#ifndef	_PCIE_CORE_H
+#define	_PCIE_CORE_H
+
+#include <sbhnddma.h>
+#include <siutils.h>
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif
+
+/* PCIE Enumeration space offsets */
+#define  PCIE_CORE_CONFIG_OFFSET	0x0
+#define  PCIE_FUNC0_CONFIG_OFFSET	0x400
+#define  PCIE_FUNC1_CONFIG_OFFSET	0x500
+#define  PCIE_FUNC2_CONFIG_OFFSET	0x600
+#define  PCIE_FUNC3_CONFIG_OFFSET	0x700
+#define  PCIE_SPROM_SHADOW_OFFSET	0x800
+#define  PCIE_SBCONFIG_OFFSET		0xE00
+
+
+#define PCIEDEV_MAX_DMAS			4
+
+/* PCIE Bar0 Address Mapping. Each function maps 16KB config space */
+#define PCIE_DEV_BAR0_SIZE		0x4000
+#define PCIE_BAR0_WINMAPCORE_OFFSET	0x0
+#define PCIE_BAR0_EXTSPROM_OFFSET	0x1000
+#define PCIE_BAR0_PCIECORE_OFFSET	0x2000
+#define PCIE_BAR0_CCCOREREG_OFFSET	0x3000
+
+/* different register spaces to access thr'u pcie indirect access */
+#define PCIE_CONFIGREGS 	1		/* Access to config space */
+#define PCIE_PCIEREGS 		2		/* Access to pcie registers */
+
+/* dma regs to control the flow between host2dev and dev2host  */
+typedef struct pcie_devdmaregs {
+	dma64regs_t	tx;
+	uint32		PAD[2];
+	dma64regs_t	rx;
+	uint32		PAD[2];
+} pcie_devdmaregs_t;
+
+#define PCIE_DB_HOST2DEV_0		0x1
+#define PCIE_DB_HOST2DEV_1		0x2
+#define PCIE_DB_DEV2HOST_0		0x3
+#define PCIE_DB_DEV2HOST_1		0x4
+
+/* door bell register sets */
+typedef struct pcie_doorbell {
+	uint32		host2dev_0;
+	uint32		host2dev_1;
+	uint32		dev2host_0;
+	uint32		dev2host_1;
+} pcie_doorbell_t;
+
+/* SB side: PCIE core and host control registers */
+typedef struct sbpcieregs {
+	uint32 control;		/* host mode only */
+	uint32 iocstatus;	/* PCIE2: iostatus */
+	uint32 PAD[1];
+	uint32 biststatus;	/* bist Status: 0x00C */
+	uint32 gpiosel;		/* PCIE gpio sel: 0x010 */
+	uint32 gpioouten;	/* PCIE gpio outen: 0x14 */
+	uint32 PAD[2];
+	uint32 intstatus;	/* Interrupt status: 0x20 */
+	uint32 intmask;		/* Interrupt mask: 0x24 */
+	uint32 sbtopcimailbox;	/* sb to pcie mailbox: 0x028 */
+	uint32 obffcontrol;	/* PCIE2: 0x2C */
+	uint32 obffintstatus;	/* PCIE2: 0x30 */
+	uint32 obffdatastatus;	/* PCIE2: 0x34 */
+	uint32 PAD[2];
+	uint32 errlog;		/* PCIE2: 0x40 */
+	uint32 errlogaddr;	/* PCIE2: 0x44 */
+	uint32 mailboxint;	/* PCIE2: 0x48 */
+	uint32 mailboxintmsk; /* PCIE2: 0x4c */
+	uint32 ltrspacing;	/* PCIE2: 0x50 */
+	uint32 ltrhysteresiscnt;	/* PCIE2: 0x54 */
+	uint32 PAD[42];
+
+	uint32 sbtopcie0;	/* sb to pcie translation 0: 0x100 */
+	uint32 sbtopcie1;	/* sb to pcie translation 1: 0x104 */
+	uint32 sbtopcie2;	/* sb to pcie translation 2: 0x108 */
+	uint32 PAD[5];
+
+	/* pcie core supports in direct access to config space */
+	uint32 configaddr;	/* pcie config space access: Address field: 0x120 */
+	uint32 configdata;	/* pcie config space access: Data field: 0x124 */
+	union {
+		struct {
+			/* mdio access to serdes */
+			uint32 mdiocontrol;	/* controls the mdio access: 0x128 */
+			uint32 mdiodata;	/* Data to the mdio access: 0x12c */
+			/* pcie protocol phy/dllp/tlp register indirect access mechanism */
+			uint32 pcieindaddr; /* indirect access to the internal register: 0x130 */
+			uint32 pcieinddata;	/* Data to/from the internal regsiter: 0x134 */
+			uint32 clkreqenctrl;	/* >= rev 6, Clkreq rdma control : 0x138 */
+			uint32 PAD[177];
+		} pcie1;
+		struct {
+			/* mdio access to serdes */
+			uint32 mdiocontrol;	/* controls the mdio access: 0x128 */
+			uint32 mdiowrdata;	/* write data to mdio 0x12C */
+			uint32 mdiorddata;	/* read data to mdio 0x130 */
+			uint32	PAD[3]; 	/* 0x134-0x138-0x13c */
+			/* door bell registers available from gen2 rev5 onwards */
+			pcie_doorbell_t	   dbls[PCIEDEV_MAX_DMAS]; /* 0x140 - 0x17F */
+			uint32	dataintf;	/* 0x180 */
+			uint32  PAD[1];		/* 0x184 */
+			uint32	d2h_intrlazy_0; /* 0x188 */
+			uint32	h2d_intrlazy_0; /* 0x18c */
+			uint32  h2d_intstat_0;  /* 0x190 */
+			uint32  h2d_intmask_0;	/* 0x194 */
+			uint32  d2h_intstat_0;  /* 0x198 */
+			uint32  d2h_intmask_0;  /* 0x19c */
+			uint32	ltr_state;	/* 0x1A0 */
+			uint32	pwr_int_status;	/* 0x1A4 */
+			uint32	pwr_int_mask;	/* 0x1A8 */
+			uint32  PAD[21]; 	/* 0x1AC - 0x200 */
+			pcie_devdmaregs_t  h2d0_dmaregs; /* 0x200 - 0x23c */
+			pcie_devdmaregs_t  d2h0_dmaregs; /* 0x240 - 0x27c */
+			pcie_devdmaregs_t  h2d1_dmaregs; /* 0x280 - 0x2bc */
+			pcie_devdmaregs_t  d2h1_dmaregs; /* 0x2c0 - 0x2fc */
+			pcie_devdmaregs_t  h2d2_dmaregs; /* 0x300 - 0x33c */
+			pcie_devdmaregs_t  d2h2_dmaregs; /* 0x340 - 0x37c */
+			pcie_devdmaregs_t  h2d3_dmaregs; /* 0x380 - 0x3bc */
+			pcie_devdmaregs_t  d2h3_dmaregs; /* 0x3c0 - 0x3fc */
+		} pcie2;
+	} u;
+	uint32 pciecfg[4][64];	/* 0x400 - 0x7FF, PCIE Cfg Space */
+	uint16 sprom[64];	/* SPROM shadow Area */
+} sbpcieregs_t;
+
+/* PCI control */
+#define PCIE_RST_OE	0x01	/* When set, drives PCI_RESET out to pin */
+#define PCIE_RST	0x02	/* Value driven out to pin */
+#define PCIE_SPERST	0x04	/* SurvivePeRst */
+#define PCIE_DISABLE_L1CLK_GATING	0x10
+#define PCIE_DLYPERST	0x100	/* Delay PeRst to CoE Core */
+#define PCIE_DISSPROMLD	0x200	/* DisableSpromLoadOnPerst */
+#define PCIE_WakeModeL2	0x1000	/* Wake on L2 */
+
+#define	PCIE_CFGADDR	0x120	/* offsetof(configaddr) */
+#define	PCIE_CFGDATA	0x124	/* offsetof(configdata) */
+
+/* Interrupt status/mask */
+#define PCIE_INTA	0x01	/* PCIE INTA message is received */
+#define PCIE_INTB	0x02	/* PCIE INTB message is received */
+#define PCIE_INTFATAL	0x04	/* PCIE INTFATAL message is received */
+#define PCIE_INTNFATAL	0x08	/* PCIE INTNONFATAL message is received */
+#define PCIE_INTCORR	0x10	/* PCIE INTCORR message is received */
+#define PCIE_INTPME	0x20	/* PCIE INTPME message is received */
+#define PCIE_PERST	0x40	/* PCIE Reset Interrupt */
+
+#define PCIE_INT_MB_FN0_0 0x0100 /* PCIE to SB Mailbox int Fn0.0 is received */
+#define PCIE_INT_MB_FN0_1 0x0200 /* PCIE to SB Mailbox int Fn0.1 is received */
+#define PCIE_INT_MB_FN1_0 0x0400 /* PCIE to SB Mailbox int Fn1.0 is received */
+#define PCIE_INT_MB_FN1_1 0x0800 /* PCIE to SB Mailbox int Fn1.1 is received */
+#define PCIE_INT_MB_FN2_0 0x1000 /* PCIE to SB Mailbox int Fn2.0 is received */
+#define PCIE_INT_MB_FN2_1 0x2000 /* PCIE to SB Mailbox int Fn2.1 is received */
+#define PCIE_INT_MB_FN3_0 0x4000 /* PCIE to SB Mailbox int Fn3.0 is received */
+#define PCIE_INT_MB_FN3_1 0x8000 /* PCIE to SB Mailbox int Fn3.1 is received */
+
+/* PCIE MailboxInt/MailboxIntMask register */
+#define PCIE_MB_TOSB_FN0_0   	0x0001 /* write to assert PCIEtoSB Mailbox interrupt */
+#define PCIE_MB_TOSB_FN0_1   	0x0002
+#define PCIE_MB_TOSB_FN1_0   	0x0004
+#define PCIE_MB_TOSB_FN1_1   	0x0008
+#define PCIE_MB_TOSB_FN2_0   	0x0010
+#define PCIE_MB_TOSB_FN2_1   	0x0020
+#define PCIE_MB_TOSB_FN3_0   	0x0040
+#define PCIE_MB_TOSB_FN3_1   	0x0080
+#define PCIE_MB_TOPCIE_FN0_0 	0x0100 /* int status/mask for SBtoPCIE Mailbox interrupts */
+#define PCIE_MB_TOPCIE_FN0_1 	0x0200
+#define PCIE_MB_TOPCIE_FN1_0 	0x0400
+#define PCIE_MB_TOPCIE_FN1_1 	0x0800
+#define PCIE_MB_TOPCIE_FN2_0 	0x1000
+#define PCIE_MB_TOPCIE_FN2_1 	0x2000
+#define PCIE_MB_TOPCIE_FN3_0 	0x4000
+#define PCIE_MB_TOPCIE_FN3_1 	0x8000
+#define	PCIE_MB_TOPCIE_D2H0_DB0	0x10000
+#define	PCIE_MB_TOPCIE_D2H0_DB1	0x20000
+#define	PCIE_MB_TOPCIE_D2H1_DB0	0x40000
+#define	PCIE_MB_TOPCIE_D2H1_DB1	0x80000
+#define	PCIE_MB_TOPCIE_D2H2_DB0	0x100000
+#define	PCIE_MB_TOPCIE_D2H2_DB1	0x200000
+#define	PCIE_MB_TOPCIE_D2H3_DB0	0x400000
+#define	PCIE_MB_TOPCIE_D2H3_DB1	0x800000
+
+#define PCIE_MB_D2H_MB_MASK		\
+	(PCIE_MB_TOPCIE_D2H0_DB0 | PCIE_MB_TOPCIE_D2H0_DB1 |	\
+	PCIE_MB_TOPCIE_D2H1_DB1  | PCIE_MB_TOPCIE_D2H1_DB1 |	\
+	PCIE_MB_TOPCIE_D2H2_DB1  | PCIE_MB_TOPCIE_D2H2_DB1 |	\
+	PCIE_MB_TOPCIE_D2H3_DB1  | PCIE_MB_TOPCIE_D2H3_DB1)
+
+/* SB to PCIE translation masks */
+#define SBTOPCIE0_MASK	0xfc000000
+#define SBTOPCIE1_MASK	0xfc000000
+#define SBTOPCIE2_MASK	0xc0000000
+
+/* Access type bits (0:1) */
+#define SBTOPCIE_MEM	0
+#define SBTOPCIE_IO	1
+#define SBTOPCIE_CFG0	2
+#define SBTOPCIE_CFG1	3
+
+/* Prefetch enable bit 2 */
+#define SBTOPCIE_PF		4
+
+/* Write Burst enable for memory write bit 3 */
+#define SBTOPCIE_WR_BURST	8
+
+/* config access */
+#define CONFIGADDR_FUNC_MASK	0x7000
+#define CONFIGADDR_FUNC_SHF	12
+#define CONFIGADDR_REG_MASK	0x0FFF
+#define CONFIGADDR_REG_SHF	0
+
+#define PCIE_CONFIG_INDADDR(f, r)	((((f) & CONFIGADDR_FUNC_MASK) << CONFIGADDR_FUNC_SHF) | \
+			                 (((r) & CONFIGADDR_REG_MASK) << CONFIGADDR_REG_SHF))
+
+/* PCIE protocol regs Indirect Address */
+#define PCIEADDR_PROT_MASK	0x300
+#define PCIEADDR_PROT_SHF	8
+#define PCIEADDR_PL_TLP		0
+#define PCIEADDR_PL_DLLP	1
+#define PCIEADDR_PL_PLP		2
+
+/* PCIE protocol PHY diagnostic registers */
+#define	PCIE_PLP_MODEREG		0x200 /* Mode */
+#define	PCIE_PLP_STATUSREG		0x204 /* Status */
+#define PCIE_PLP_LTSSMCTRLREG		0x208 /* LTSSM control */
+#define PCIE_PLP_LTLINKNUMREG		0x20c /* Link Training Link number */
+#define PCIE_PLP_LTLANENUMREG		0x210 /* Link Training Lane number */
+#define PCIE_PLP_LTNFTSREG		0x214 /* Link Training N_FTS */
+#define PCIE_PLP_ATTNREG		0x218 /* Attention */
+#define PCIE_PLP_ATTNMASKREG		0x21C /* Attention Mask */
+#define PCIE_PLP_RXERRCTR		0x220 /* Rx Error */
+#define PCIE_PLP_RXFRMERRCTR		0x224 /* Rx Framing Error */
+#define PCIE_PLP_RXERRTHRESHREG		0x228 /* Rx Error threshold */
+#define PCIE_PLP_TESTCTRLREG		0x22C /* Test Control reg */
+#define PCIE_PLP_SERDESCTRLOVRDREG	0x230 /* SERDES Control Override */
+#define PCIE_PLP_TIMINGOVRDREG		0x234 /* Timing param override */
+#define PCIE_PLP_RXTXSMDIAGREG		0x238 /* RXTX State Machine Diag */
+#define PCIE_PLP_LTSSMDIAGREG		0x23C /* LTSSM State Machine Diag */
+
+/* PCIE protocol DLLP diagnostic registers */
+#define PCIE_DLLP_LCREG			0x100 /* Link Control */
+#define PCIE_DLLP_LSREG			0x104 /* Link Status */
+#define PCIE_DLLP_LAREG			0x108 /* Link Attention */
+#define PCIE_DLLP_LAMASKREG		0x10C /* Link Attention Mask */
+#define PCIE_DLLP_NEXTTXSEQNUMREG	0x110 /* Next Tx Seq Num */
+#define PCIE_DLLP_ACKEDTXSEQNUMREG	0x114 /* Acked Tx Seq Num */
+#define PCIE_DLLP_PURGEDTXSEQNUMREG	0x118 /* Purged Tx Seq Num */
+#define PCIE_DLLP_RXSEQNUMREG		0x11C /* Rx Sequence Number */
+#define PCIE_DLLP_LRREG			0x120 /* Link Replay */
+#define PCIE_DLLP_LACKTOREG		0x124 /* Link Ack Timeout */
+#define PCIE_DLLP_PMTHRESHREG		0x128 /* Power Management Threshold */
+#define PCIE_DLLP_RTRYWPREG		0x12C /* Retry buffer write ptr */
+#define PCIE_DLLP_RTRYRPREG		0x130 /* Retry buffer Read ptr */
+#define PCIE_DLLP_RTRYPPREG		0x134 /* Retry buffer Purged ptr */
+#define PCIE_DLLP_RTRRWREG		0x138 /* Retry buffer Read/Write */
+#define PCIE_DLLP_ECTHRESHREG		0x13C /* Error Count Threshold */
+#define PCIE_DLLP_TLPERRCTRREG		0x140 /* TLP Error Counter */
+#define PCIE_DLLP_ERRCTRREG		0x144 /* Error Counter */
+#define PCIE_DLLP_NAKRXCTRREG		0x148 /* NAK Received Counter */
+#define PCIE_DLLP_TESTREG		0x14C /* Test */
+#define PCIE_DLLP_PKTBIST		0x150 /* Packet BIST */
+#define PCIE_DLLP_PCIE11		0x154 /* DLLP PCIE 1.1 reg */
+
+#define PCIE_DLLP_LSREG_LINKUP		(1 << 16)
+
+/* PCIE protocol TLP diagnostic registers */
+#define PCIE_TLP_CONFIGREG		0x000 /* Configuration */
+#define PCIE_TLP_WORKAROUNDSREG		0x004 /* TLP Workarounds */
+#define PCIE_TLP_WRDMAUPPER		0x010 /* Write DMA Upper Address */
+#define PCIE_TLP_WRDMALOWER		0x014 /* Write DMA Lower Address */
+#define PCIE_TLP_WRDMAREQ_LBEREG	0x018 /* Write DMA Len/ByteEn Req */
+#define PCIE_TLP_RDDMAUPPER		0x01C /* Read DMA Upper Address */
+#define PCIE_TLP_RDDMALOWER		0x020 /* Read DMA Lower Address */
+#define PCIE_TLP_RDDMALENREG		0x024 /* Read DMA Len Req */
+#define PCIE_TLP_MSIDMAUPPER		0x028 /* MSI DMA Upper Address */
+#define PCIE_TLP_MSIDMALOWER		0x02C /* MSI DMA Lower Address */
+#define PCIE_TLP_MSIDMALENREG		0x030 /* MSI DMA Len Req */
+#define PCIE_TLP_SLVREQLENREG		0x034 /* Slave Request Len */
+#define PCIE_TLP_FCINPUTSREQ		0x038 /* Flow Control Inputs */
+#define PCIE_TLP_TXSMGRSREQ		0x03C /* Tx StateMachine and Gated Req */
+#define PCIE_TLP_ADRACKCNTARBLEN	0x040 /* Address Ack XferCnt and ARB Len */
+#define PCIE_TLP_DMACPLHDR0		0x044 /* DMA Completion Hdr 0 */
+#define PCIE_TLP_DMACPLHDR1		0x048 /* DMA Completion Hdr 1 */
+#define PCIE_TLP_DMACPLHDR2		0x04C /* DMA Completion Hdr 2 */
+#define PCIE_TLP_DMACPLMISC0		0x050 /* DMA Completion Misc0 */
+#define PCIE_TLP_DMACPLMISC1		0x054 /* DMA Completion Misc1 */
+#define PCIE_TLP_DMACPLMISC2		0x058 /* DMA Completion Misc2 */
+#define PCIE_TLP_SPTCTRLLEN		0x05C /* Split Controller Req len */
+#define PCIE_TLP_SPTCTRLMSIC0		0x060 /* Split Controller Misc 0 */
+#define PCIE_TLP_SPTCTRLMSIC1		0x064 /* Split Controller Misc 1 */
+#define PCIE_TLP_BUSDEVFUNC		0x068 /* Bus/Device/Func */
+#define PCIE_TLP_RESETCTR		0x06C /* Reset Counter */
+#define PCIE_TLP_RTRYBUF		0x070 /* Retry Buffer value */
+#define PCIE_TLP_TGTDEBUG1		0x074 /* Target Debug Reg1 */
+#define PCIE_TLP_TGTDEBUG2		0x078 /* Target Debug Reg2 */
+#define PCIE_TLP_TGTDEBUG3		0x07C /* Target Debug Reg3 */
+#define PCIE_TLP_TGTDEBUG4		0x080 /* Target Debug Reg4 */
+
+/* PCIE2 MDIO register offsets */
+#define PCIE2_MDIO_CONTROL    0x128
+#define PCIE2_MDIO_WR_DATA    0x12C
+#define PCIE2_MDIO_RD_DATA    0x130
+
+
+/* MDIO control */
+#define MDIOCTL_DIVISOR_MASK		0x7f	/* clock to be used on MDIO */
+#define MDIOCTL_DIVISOR_VAL		0x2
+#define MDIOCTL_PREAM_EN		0x80	/* Enable preamble sequnce */
+#define MDIOCTL_ACCESS_DONE		0x100   /* Tranaction complete */
+
+/* MDIO Data */
+#define MDIODATA_MASK			0x0000ffff	/* data 2 bytes */
+#define MDIODATA_TA			0x00020000	/* Turnaround */
+#define MDIODATA_REGADDR_SHF_OLD	18		/* Regaddr shift (rev < 10) */
+#define MDIODATA_REGADDR_MASK_OLD	0x003c0000	/* Regaddr Mask (rev < 10) */
+#define MDIODATA_DEVADDR_SHF_OLD	22		/* Physmedia devaddr shift (rev < 10) */
+#define MDIODATA_DEVADDR_MASK_OLD	0x0fc00000	/* Physmedia devaddr Mask (rev < 10) */
+#define MDIODATA_REGADDR_SHF		18		/* Regaddr shift */
+#define MDIODATA_REGADDR_MASK		0x007c0000	/* Regaddr Mask */
+#define MDIODATA_DEVADDR_SHF		23		/* Physmedia devaddr shift */
+#define MDIODATA_DEVADDR_MASK		0x0f800000	/* Physmedia devaddr Mask */
+#define MDIODATA_WRITE			0x10000000	/* write Transaction */
+#define MDIODATA_READ			0x20000000	/* Read Transaction */
+#define MDIODATA_START			0x40000000	/* start of Transaction */
+
+#define MDIODATA_DEV_ADDR		0x0		/* dev address for serdes */
+#define	MDIODATA_BLK_ADDR		0x1F		/* blk address for serdes */
+
+/* MDIO control/wrData/rdData register defines for PCIE Gen 2 */
+#define MDIOCTL2_DIVISOR_MASK		0x7f	/* clock to be used on MDIO */
+#define MDIOCTL2_DIVISOR_VAL		0x2
+#define MDIOCTL2_REGADDR_SHF		8		/* Regaddr shift */
+#define MDIOCTL2_REGADDR_MASK		0x00FFFF00	/* Regaddr Mask */
+#define MDIOCTL2_DEVADDR_SHF		24		/* Physmedia devaddr shift */
+#define MDIOCTL2_DEVADDR_MASK		0x0f000000	/* Physmedia devaddr Mask */
+#define MDIOCTL2_SLAVE_BYPASS		0x10000000	/* IP slave bypass */
+#define MDIOCTL2_READ			0x20000000	/* IP slave bypass */
+
+#define MDIODATA2_DONE			0x80000000	/* rd/wr transaction done */
+#define MDIODATA2_MASK			0x7FFFFFFF	/* rd/wr transaction data */
+#define MDIODATA2_DEVADDR_SHF		4		/* Physmedia devaddr shift */
+
+
+/* MDIO devices (SERDES modules)
+ *  unlike old pcie cores (rev < 10), rev10 pcie serde organizes registers into a few blocks.
+ *  two layers mapping (blockidx, register offset) is required
+ */
+#define MDIO_DEV_IEEE0		0x000
+#define MDIO_DEV_IEEE1		0x001
+#define MDIO_DEV_BLK0		0x800
+#define MDIO_DEV_BLK1		0x801
+#define MDIO_DEV_BLK2		0x802
+#define MDIO_DEV_BLK3		0x803
+#define MDIO_DEV_BLK4		0x804
+#define MDIO_DEV_TXPLL		0x808	/* TXPLL register block idx */
+#define MDIO_DEV_TXCTRL0	0x820
+#define MDIO_DEV_SERDESID	0x831
+#define MDIO_DEV_RXCTRL0	0x840
+
+
+/* XgxsBlk1_A Register Offsets */
+#define BLK1_PWR_MGMT0		0x16
+#define BLK1_PWR_MGMT1		0x17
+#define BLK1_PWR_MGMT2		0x18
+#define BLK1_PWR_MGMT3		0x19
+#define BLK1_PWR_MGMT4		0x1A
+
+/* serdes regs (rev < 10) */
+#define MDIODATA_DEV_PLL       		0x1d	/* SERDES PLL Dev */
+#define MDIODATA_DEV_TX        		0x1e	/* SERDES TX Dev */
+#define MDIODATA_DEV_RX        		0x1f	/* SERDES RX Dev */
+	/* SERDES RX registers */
+#define SERDES_RX_CTRL			1	/* Rx cntrl */
+#define SERDES_RX_TIMER1		2	/* Rx Timer1 */
+#define SERDES_RX_CDR			6	/* CDR */
+#define SERDES_RX_CDRBW			7	/* CDR BW */
+
+	/* SERDES RX control register */
+#define SERDES_RX_CTRL_FORCE		0x80	/* rxpolarity_force */
+#define SERDES_RX_CTRL_POLARITY		0x40	/* rxpolarity_value */
+
+	/* SERDES PLL registers */
+#define SERDES_PLL_CTRL                 1       /* PLL control reg */
+#define PLL_CTRL_FREQDET_EN             0x4000  /* bit 14 is FREQDET on */
+
+/* Power management threshold */
+#define PCIE_L0THRESHOLDTIME_MASK       0xFF00	/* bits 0 - 7 */
+#define PCIE_L1THRESHOLDTIME_MASK       0xFF00	/* bits 8 - 15 */
+#define PCIE_L1THRESHOLDTIME_SHIFT      8	/* PCIE_L1THRESHOLDTIME_SHIFT */
+#define PCIE_L1THRESHOLD_WARVAL         0x72	/* WAR value */
+#define PCIE_ASPMTIMER_EXTEND		0x01000000	/* > rev7: enable extend ASPM timer */
+
+/* SPROM offsets */
+#define SRSH_ASPM_OFFSET		4	/* word 4 */
+#define SRSH_ASPM_ENB			0x18	/* bit 3, 4 */
+#define SRSH_ASPM_L1_ENB		0x10	/* bit 4 */
+#define SRSH_ASPM_L0s_ENB		0x8	/* bit 3 */
+#define SRSH_PCIE_MISC_CONFIG		5	/* word 5 */
+#define SRSH_L23READY_EXIT_NOPERST	0x8000	/* bit 15 */
+#define SRSH_CLKREQ_OFFSET_REV5		20	/* word 20 for srom rev <= 5 */
+#define SRSH_CLKREQ_OFFSET_REV8		52	/* word 52 for srom rev 8 */
+#define SRSH_CLKREQ_ENB			0x0800	/* bit 11 */
+#define SRSH_BD_OFFSET                  6       /* word 6 */
+#define SRSH_AUTOINIT_OFFSET            18      /* auto initialization enable */
+
+/* Linkcontrol reg offset in PCIE Cap */
+#define PCIE_CAP_LINKCTRL_OFFSET	16	/* linkctrl offset in pcie cap */
+#define PCIE_CAP_LCREG_ASPML0s		0x01	/* ASPM L0s in linkctrl */
+#define PCIE_CAP_LCREG_ASPML1		0x02	/* ASPM L1 in linkctrl */
+#define PCIE_CLKREQ_ENAB		0x100	/* CLKREQ Enab in linkctrl */
+#define PCIE_LINKSPEED_MASK       	0xF0000	/* bits 0 - 3 of high word */
+#define PCIE_LINKSPEED_SHIFT      	16	/* PCIE_LINKSPEED_SHIFT */
+
+/* Devcontrol reg offset in PCIE Cap */
+#define PCIE_CAP_DEVCTRL_OFFSET		8	/* devctrl offset in pcie cap */
+#define PCIE_CAP_DEVCTRL_MRRS_MASK	0x7000	/* Max read request size mask */
+#define PCIE_CAP_DEVCTRL_MRRS_SHIFT	12	/* Max read request size shift */
+#define PCIE_CAP_DEVCTRL_MRRS_128B	0	/* 128 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_256B	1	/* 256 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_512B	2	/* 512 Byte */
+#define PCIE_CAP_DEVCTRL_MRRS_1024B	3	/* 1024 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_MASK	0x00e0	/* Max payload size mask */
+#define PCIE_CAP_DEVCTRL_MPS_SHIFT	5	/* Max payload size shift */
+#define PCIE_CAP_DEVCTRL_MPS_128B	0	/* 128 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_256B	1	/* 256 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_512B	2	/* 512 Byte */
+#define PCIE_CAP_DEVCTRL_MPS_1024B	3	/* 1024 Byte */
+
+#define PCIE_ASPM_ENAB			3	/* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_L1_ENAB		2	/* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_L0s_ENAB		1	/* ASPM L0s & L1 in linkctrl */
+#define PCIE_ASPM_DISAB			0	/* ASPM L0s & L1 in linkctrl */
+
+#define PCIE_ASPM_L11_ENAB		8	/* ASPM L1.1 in PML1_sub_control2 */
+#define PCIE_ASPM_L12_ENAB		4	/* ASPM L1.2 in PML1_sub_control2 */
+
+/* Devcontrol2 reg offset in PCIE Cap */
+#define PCIE_CAP_DEVCTRL2_OFFSET	0x28	/* devctrl2 offset in pcie cap */
+#define PCIE_CAP_DEVCTRL2_LTR_ENAB_MASK	0x400	/* Latency Tolerance Reporting Enable */
+#define PCIE_CAP_DEVCTRL2_OBFF_ENAB_SHIFT 13	/* Enable OBFF mechanism, select signaling method */
+#define PCIE_CAP_DEVCTRL2_OBFF_ENAB_MASK 0x6000	/* Enable OBFF mechanism, select signaling method */
+
+/* LTR registers in PCIE Cap */
+#define PCIE_LTR0_REG_OFFSET	0x844	/* ltr0_reg offset in pcie cap */
+#define PCIE_LTR1_REG_OFFSET	0x848	/* ltr1_reg offset in pcie cap */
+#define PCIE_LTR2_REG_OFFSET	0x84c	/* ltr2_reg offset in pcie cap */
+#define PCIE_LTR0_REG_DEFAULT_60	0x883c883c	/* active latency default to 60usec */
+#define PCIE_LTR0_REG_DEFAULT_150	0x88968896	/* active latency default to 150usec */
+#define PCIE_LTR1_REG_DEFAULT		0x88648864	/* idle latency default to 100usec */
+#define PCIE_LTR2_REG_DEFAULT		0x90039003	/* sleep latency default to 3msec */
+
+/* Status reg PCIE_PLP_STATUSREG */
+#define PCIE_PLP_POLARITYINV_STAT	0x10
+
+
+/* PCIE BRCM Vendor CAP REVID reg  bits */
+#define BRCMCAP_PCIEREV_CT_MASK			0xF00
+#define BRCMCAP_PCIEREV_CT_SHIFT		8
+#define BRCMCAP_PCIEREV_REVID_MASK		0xFF
+#define BRCMCAP_PCIEREV_REVID_SHIFT		0
+
+#define PCIE_REVREG_CT_PCIE1		0
+#define PCIE_REVREG_CT_PCIE2		1
+
+/* PCIE GEN2 specific defines */
+/* PCIE BRCM Vendor Cap offsets w.r.t to vendor cap ptr */
+#define PCIE2R0_BRCMCAP_REVID_OFFSET		4
+#define PCIE2R0_BRCMCAP_BAR0_WIN0_WRAP_OFFSET	8
+#define PCIE2R0_BRCMCAP_BAR0_WIN2_OFFSET	12
+#define PCIE2R0_BRCMCAP_BAR0_WIN2_WRAP_OFFSET	16
+#define PCIE2R0_BRCMCAP_BAR0_WIN_OFFSET		20
+#define PCIE2R0_BRCMCAP_BAR1_WIN_OFFSET		24
+#define PCIE2R0_BRCMCAP_SPROM_CTRL_OFFSET	28
+#define PCIE2R0_BRCMCAP_BAR2_WIN_OFFSET		32
+#define PCIE2R0_BRCMCAP_INTSTATUS_OFFSET	36
+#define PCIE2R0_BRCMCAP_INTMASK_OFFSET		40
+#define PCIE2R0_BRCMCAP_PCIE2SB_MB_OFFSET	44
+#define PCIE2R0_BRCMCAP_BPADDR_OFFSET		48
+#define PCIE2R0_BRCMCAP_BPDATA_OFFSET		52
+#define PCIE2R0_BRCMCAP_CLKCTLSTS_OFFSET	56
+
+/* definition of configuration space registers of PCIe gen2
+ * http://hwnbu-twiki.sj.broadcom.com/twiki/pub/Mwgroup/CurrentPcieGen2ProgramGuide/pcie_ep.htm
+ */
+#define PCIECFGREG_STATUS_CMD		0x4
+#define PCIECFGREG_PM_CSR		0x4C
+#define PCIECFGREG_MSI_CAP		0x58
+#define PCIECFGREG_MSI_ADDR_L		0x5C
+#define PCIECFGREG_MSI_ADDR_H		0x60
+#define PCIECFGREG_MSI_DATA		0x64
+#define PCIECFGREG_LINK_STATUS_CTRL	0xBC
+#define PCIECFGREG_LINK_STATUS_CTRL2	0xDC
+#define PCIECFGREG_RBAR_CTRL		0x228
+#define PCIECFGREG_PML1_SUB_CTRL1	0x248
+#define PCIECFGREG_REG_BAR2_CONFIG	0x4E0
+#define PCIECFGREG_REG_BAR3_CONFIG	0x4F4
+#define PCIECFGREG_PDL_CTRL1		0x1004
+#define PCIECFGREG_PDL_IDDQ		0x1814
+#define PCIECFGREG_REG_PHY_CTL7		0x181c
+
+/* PCIECFGREG_PML1_SUB_CTRL1 Bit Definition */
+#define PCI_PM_L1_2_ENA_MASK		0x00000001	/* PCI-PM L1.2 Enabled */
+#define PCI_PM_L1_1_ENA_MASK		0x00000002	/* PCI-PM L1.1 Enabled */
+#define ASPM_L1_2_ENA_MASK		0x00000004	/* ASPM L1.2 Enabled */
+#define ASPM_L1_1_ENA_MASK		0x00000008	/* ASPM L1.1 Enabled */
+
+/* PCIe gen2 mailbox interrupt masks */
+#define I_MB    0x3
+#define I_BIT0  0x1
+#define I_BIT1  0x2
+
+/* PCIE gen2 config regs */
+#define PCIIntstatus	0x090
+#define PCIIntmask	0x094
+#define PCISBMbx	0x98
+
+/* enumeration Core regs */
+#define PCIH2D_MailBox  0x140
+#define PCIH2D_DB1 0x144
+#define PCID2H_MailBox  0x148
+#define PCIMailBoxInt	0x48
+#define PCIMailBoxMask	0x4C
+
+#define I_F0_B0         (0x1 << 8) /* Mail box interrupt Function 0 interrupt, bit 0 */
+#define I_F0_B1         (0x1 << 9) /* Mail box interrupt Function 0 interrupt, bit 1 */
+
+#define PCIECFGREG_DEVCONTROL	0xB4
+
+/* SROM hardware region */
+#define SROM_OFFSET_BAR1_CTRL  52
+
+#define BAR1_ENC_SIZE_MASK	0x000e
+#define BAR1_ENC_SIZE_SHIFT	1
+
+#define BAR1_ENC_SIZE_1M	0
+#define BAR1_ENC_SIZE_2M	1
+#define BAR1_ENC_SIZE_4M	2
+
+#define PCIEGEN2_CAP_DEVSTSCTRL2_OFFSET		0xD4
+#define PCIEGEN2_CAP_DEVSTSCTRL2_LTRENAB	0x400
+
+/*
+ * Latency Tolerance Reporting (LTR) states
+ * Active has the least tolerant latency requirement
+ * Sleep is most tolerant
+ */
+#define LTR_ACTIVE				2
+#define LTR_ACTIVE_IDLE				1
+#define LTR_SLEEP				0
+#define LTR_FINAL_MASK				0x300
+#define LTR_FINAL_SHIFT				8
+
+/* pwrinstatus, pwrintmask regs */
+#define PCIEGEN2_PWRINT_D0_STATE_SHIFT		0
+#define PCIEGEN2_PWRINT_D1_STATE_SHIFT		1
+#define PCIEGEN2_PWRINT_D2_STATE_SHIFT		2
+#define PCIEGEN2_PWRINT_D3_STATE_SHIFT		3
+#define PCIEGEN2_PWRINT_L0_LINK_SHIFT		4
+#define PCIEGEN2_PWRINT_L0s_LINK_SHIFT		5
+#define PCIEGEN2_PWRINT_L1_LINK_SHIFT		6
+#define PCIEGEN2_PWRINT_L2_L3_LINK_SHIFT	7
+#define PCIEGEN2_PWRINT_OBFF_CHANGE_SHIFT	8
+
+#define PCIEGEN2_PWRINT_D0_STATE_MASK		(1 << PCIEGEN2_PWRINT_D0_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D1_STATE_MASK		(1 << PCIEGEN2_PWRINT_D1_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D2_STATE_MASK		(1 << PCIEGEN2_PWRINT_D2_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_D3_STATE_MASK		(1 << PCIEGEN2_PWRINT_D3_STATE_SHIFT)
+#define PCIEGEN2_PWRINT_L0_LINK_MASK		(1 << PCIEGEN2_PWRINT_L0_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L0s_LINK_MASK		(1 << PCIEGEN2_PWRINT_L0s_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L1_LINK_MASK		(1 << PCIEGEN2_PWRINT_L1_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_L2_L3_LINK_MASK		(1 << PCIEGEN2_PWRINT_L2_L3_LINK_SHIFT)
+#define PCIEGEN2_PWRINT_OBFF_CHANGE_MASK	(1 << PCIEGEN2_PWRINT_OBFF_CHANGE_SHIFT)
+
+/* sbtopcie mail box */
+#define SBTOPCIE_MB_FUNC0_SHIFT 8
+#define SBTOPCIE_MB_FUNC1_SHIFT 10
+#define SBTOPCIE_MB_FUNC2_SHIFT 12
+#define SBTOPCIE_MB_FUNC3_SHIFT 14
+
+/* pcieiocstatus */
+#define PCIEGEN2_IOC_D0_STATE_SHIFT		8
+#define PCIEGEN2_IOC_D1_STATE_SHIFT		9
+#define PCIEGEN2_IOC_D2_STATE_SHIFT		10
+#define PCIEGEN2_IOC_D3_STATE_SHIFT		11
+#define PCIEGEN2_IOC_L0_LINK_SHIFT		12
+#define PCIEGEN2_IOC_L1_LINK_SHIFT		13
+#define PCIEGEN2_IOC_L1L2_LINK_SHIFT		14
+#define PCIEGEN2_IOC_L2_L3_LINK_SHIFT		15
+
+#define PCIEGEN2_IOC_D0_STATE_MASK		(1 << PCIEGEN2_IOC_D0_STATE_SHIFT)
+#define PCIEGEN2_IOC_D1_STATE_MASK		(1 << PCIEGEN2_IOC_D1_STATE_SHIF)
+#define PCIEGEN2_IOC_D2_STATE_MASK		(1 << PCIEGEN2_IOC_D2_STATE_SHIF)
+#define PCIEGEN2_IOC_D3_STATE_MASK		(1 << PCIEGEN2_IOC_D3_STATE_SHIF)
+#define PCIEGEN2_IOC_L0_LINK_MASK		(1 << PCIEGEN2_IOC_L0_LINK_SHIF)
+#define PCIEGEN2_IOC_L1_LINK_MASK		(1 << PCIEGEN2_IOC_L1_LINK_SHIF)
+#define PCIEGEN2_IOC_L1L2_LINK_MASK		(1 << PCIEGEN2_IOC_L1L2_LINK_SHIFT)
+#define PCIEGEN2_IOC_L2_L3_LINK_MASK		(1 << PCIEGEN2_IOC_L2_L3_LINK_SHIFT)
+
+/* stat_ctrl */
+#define PCIE_STAT_CTRL_RESET		0x1
+#define PCIE_STAT_CTRL_ENABLE		0x2
+#define PCIE_STAT_CTRL_INTENABLE	0x4
+#define PCIE_STAT_CTRL_INTSTATUS	0x8
+
+#ifdef BCMDRIVER
+void pcie_watchdog_reset(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs);
+#endif /* BCMDRIVER */
+
+#endif	/* _PCIE_CORE_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/802.11_bta.h b/drivers/net/wireless/bcm4336/include/proto/802.11_bta.h
--- a/drivers/net/wireless/bcm4336/include/proto/802.11_bta.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/802.11_bta.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,27 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) 802.11 PAL (Protocol Adaptation Layer)
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: 802.11_bta.h 382882 2013-02-04 23:24:31Z $
+*/
+
+#ifndef _802_11_BTA_H_
+#define _802_11_BTA_H_
+
+#define BT_SIG_SNAP_MPROT		"\xAA\xAA\x03\x00\x19\x58"
+
+/* BT-AMP 802.11 PAL Protocols */
+#define BTA_PROT_L2CAP				1
+#define	BTA_PROT_ACTIVITY_REPORT		2
+#define BTA_PROT_SECURITY			3
+#define BTA_PROT_LINK_SUPERVISION_REQUEST	4
+#define BTA_PROT_LINK_SUPERVISION_REPLY		5
+
+/* BT-AMP 802.11 PAL AMP_ASSOC Type IDs */
+#define BTA_TYPE_ID_MAC_ADDRESS			1
+#define BTA_TYPE_ID_PREFERRED_CHANNELS		2
+#define BTA_TYPE_ID_CONNECTED_CHANNELS		3
+#define BTA_TYPE_ID_CAPABILITIES		4
+#define BTA_TYPE_ID_VERSION			5
+#endif /* _802_11_bta_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/802.11e.h b/drivers/net/wireless/bcm4336/include/proto/802.11e.h
--- a/drivers/net/wireless/bcm4336/include/proto/802.11e.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/802.11e.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,120 @@
+/*
+ * 802.11e protocol header file
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: 802.11e.h 382883 2013-02-04 23:26:09Z $
+ */
+
+#ifndef _802_11e_H_
+#define _802_11e_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WME Traffic Specification (TSPEC) element */
+#define WME_TSPEC_HDR_LEN           2           /* WME TSPEC header length */
+#define WME_TSPEC_BODY_OFF          2           /* WME TSPEC body offset */
+
+#define WME_CATEGORY_CODE_OFFSET	0		/* WME Category code offset */
+#define WME_ACTION_CODE_OFFSET		1		/* WME Action code offset */
+#define WME_TOKEN_CODE_OFFSET		2		/* WME Token code offset */
+#define WME_STATUS_CODE_OFFSET		3		/* WME Status code offset */
+
+BWL_PRE_PACKED_STRUCT struct tsinfo {
+	uint8 octets[3];
+} BWL_POST_PACKED_STRUCT;
+
+typedef struct tsinfo tsinfo_t;
+
+/* 802.11e TSPEC IE */
+typedef BWL_PRE_PACKED_STRUCT struct tspec {
+	uint8 oui[DOT11_OUI_LEN];	/* WME_OUI */
+	uint8 type;					/* WME_TYPE */
+	uint8 subtype;				/* WME_SUBTYPE_TSPEC */
+	uint8 version;				/* WME_VERSION */
+	tsinfo_t tsinfo;			/* TS Info bit field */
+	uint16 nom_msdu_size;		/* (Nominal or fixed) MSDU Size (bytes) */
+	uint16 max_msdu_size;		/* Maximum MSDU Size (bytes) */
+	uint32 min_srv_interval;	/* Minimum Service Interval (us) */
+	uint32 max_srv_interval;	/* Maximum Service Interval (us) */
+	uint32 inactivity_interval;	/* Inactivity Interval (us) */
+	uint32 suspension_interval; /* Suspension Interval (us) */
+	uint32 srv_start_time;		/* Service Start Time (us) */
+	uint32 min_data_rate;		/* Minimum Data Rate (bps) */
+	uint32 mean_data_rate;		/* Mean Data Rate (bps) */
+	uint32 peak_data_rate;		/* Peak Data Rate (bps) */
+	uint32 max_burst_size;		/* Maximum Burst Size (bytes) */
+	uint32 delay_bound;			/* Delay Bound (us) */
+	uint32 min_phy_rate;		/* Minimum PHY Rate (bps) */
+	uint16 surplus_bw;			/* Surplus Bandwidth Allowance (range 1.0-8.0) */
+	uint16 medium_time;			/* Medium Time (32 us/s periods) */
+} BWL_POST_PACKED_STRUCT tspec_t;
+
+#define WME_TSPEC_LEN	(sizeof(tspec_t))		/* not including 2-bytes of header */
+
+/* ts_info */
+/* 802.1D priority is duplicated - bits 13-11 AND bits 3-1 */
+#define TS_INFO_TID_SHIFT		1	/* TS info. TID shift */
+#define TS_INFO_TID_MASK		(0xf << TS_INFO_TID_SHIFT)	/* TS info. TID mask */
+#define TS_INFO_CONTENTION_SHIFT	7	/* TS info. contention shift */
+#define TS_INFO_CONTENTION_MASK	(0x1 << TS_INFO_CONTENTION_SHIFT) /* TS info. contention mask */
+#define TS_INFO_DIRECTION_SHIFT	5	/* TS info. direction shift */
+#define TS_INFO_DIRECTION_MASK	(0x3 << TS_INFO_DIRECTION_SHIFT) /* TS info. direction mask */
+#define TS_INFO_PSB_SHIFT		2		/* TS info. PSB bit Shift */
+#define TS_INFO_PSB_MASK		(1 << TS_INFO_PSB_SHIFT)	/* TS info. PSB mask */
+#define TS_INFO_UPLINK			(0 << TS_INFO_DIRECTION_SHIFT)	/* TS info. uplink */
+#define TS_INFO_DOWNLINK		(1 << TS_INFO_DIRECTION_SHIFT)	/* TS info. downlink */
+#define TS_INFO_BIDIRECTIONAL	(3 << TS_INFO_DIRECTION_SHIFT)	/* TS info. bidirectional */
+#define TS_INFO_USER_PRIO_SHIFT	3	/* TS info. user priority shift */
+/* TS info. user priority mask */
+#define TS_INFO_USER_PRIO_MASK	(0x7 << TS_INFO_USER_PRIO_SHIFT)
+
+/* Macro to get/set bit(s) field in TSINFO */
+#define WLC_CAC_GET_TID(pt)	((((pt).octets[0]) & TS_INFO_TID_MASK) >> TS_INFO_TID_SHIFT)
+#define WLC_CAC_GET_DIR(pt)	((((pt).octets[0]) & \
+	TS_INFO_DIRECTION_MASK) >> TS_INFO_DIRECTION_SHIFT)
+#define WLC_CAC_GET_PSB(pt)	((((pt).octets[1]) & TS_INFO_PSB_MASK) >> TS_INFO_PSB_SHIFT)
+#define WLC_CAC_GET_USER_PRIO(pt)	((((pt).octets[1]) & \
+	TS_INFO_USER_PRIO_MASK) >> TS_INFO_USER_PRIO_SHIFT)
+
+#define WLC_CAC_SET_TID(pt, id)	((((pt).octets[0]) & (~TS_INFO_TID_MASK)) | \
+	((id) << TS_INFO_TID_SHIFT))
+#define WLC_CAC_SET_USER_PRIO(pt, prio)	((((pt).octets[0]) & (~TS_INFO_USER_PRIO_MASK)) | \
+	((prio) << TS_INFO_USER_PRIO_SHIFT))
+
+/* 802.11e QBSS Load IE */
+#define QBSS_LOAD_IE_LEN		5	/* QBSS Load IE length */
+#define QBSS_LOAD_AAC_OFF		3	/* AAC offset in IE */
+
+#define CAC_ADDTS_RESP_TIMEOUT		1000	/* default ADDTS response timeout in ms */
+						/* DEFVAL dot11ADDTSResponseTimeout = 1s */
+
+/* 802.11e ADDTS status code */
+#define DOT11E_STATUS_ADMISSION_ACCEPTED	0	/* TSPEC Admission accepted status */
+#define DOT11E_STATUS_ADDTS_INVALID_PARAM	1	/* TSPEC invalid parameter status */
+#define DOT11E_STATUS_ADDTS_REFUSED_NSBW	3	/* ADDTS refused (non-sufficient BW) */
+#define DOT11E_STATUS_ADDTS_REFUSED_AWHILE	47	/* ADDTS refused but could retry later */
+#ifdef BCMCCX
+#define CCX_STATUS_ASSOC_DENIED_UNKNOWN    0xc8	/* unspecified QoS related failure */
+#define CCX_STATUS_ASSOC_DENIED_AP_POLICY  0xc9	/* TSPEC refused due to AP policy */
+#define CCX_STATUS_ASSOC_DENIED_NO_BW	   0xca	/* Assoc denied due to AP insufficient BW */
+#define CCX_STATUS_ASSOC_DENIED_BAD_PARAM  0xcb	/* one or more TSPEC with invalid parameter */
+#endif	/* BCMCCX */
+
+/* 802.11e DELTS status code */
+#define DOT11E_STATUS_QSTA_LEAVE_QBSS		36	/* STA leave QBSS */
+#define DOT11E_STATUS_END_TS				37	/* END TS */
+#define DOT11E_STATUS_UNKNOWN_TS			38	/* UNKNOWN TS */
+#define DOT11E_STATUS_QSTA_REQ_TIMEOUT		39	/* STA ADDTS request timeout */
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11e_CAC_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/802.11.h b/drivers/net/wireless/bcm4336/include/proto/802.11.h
--- a/drivers/net/wireless/bcm4336/include/proto/802.11.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/802.11.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,3865 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Fundamental types and constants relating to 802.11
+ *
+ * $Id: 802.11.h 495738 2014-08-08 03:36:17Z $
+ */
+
+#ifndef _802_11_H_
+#define _802_11_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+#ifndef _NET_ETHERNET_H_
+#include <proto/ethernet.h>
+#endif
+
+#include <proto/wpa.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+#define DOT11_TU_TO_US			1024	/* 802.11 Time Unit is 1024 microseconds */
+
+/* Generic 802.11 frame constants */
+#define DOT11_A3_HDR_LEN		24	/* d11 header length with A3 */
+#define DOT11_A4_HDR_LEN		30	/* d11 header length with A4 */
+#define DOT11_MAC_HDR_LEN		DOT11_A3_HDR_LEN	/* MAC header length */
+#define DOT11_FCS_LEN			4	/* d11 FCS length */
+#define DOT11_ICV_LEN			4	/* d11 ICV length */
+#define DOT11_ICV_AES_LEN		8	/* d11 ICV/AES length */
+#define DOT11_QOS_LEN			2	/* d11 QoS length */
+#define DOT11_HTC_LEN			4	/* d11 HT Control field length */
+
+#define DOT11_KEY_INDEX_SHIFT		6	/* d11 key index shift */
+#define DOT11_IV_LEN			4	/* d11 IV length */
+#define DOT11_IV_TKIP_LEN		8	/* d11 IV TKIP length */
+#define DOT11_IV_AES_OCB_LEN		4	/* d11 IV/AES/OCB length */
+#define DOT11_IV_AES_CCM_LEN		8	/* d11 IV/AES/CCM length */
+#define DOT11_IV_MAX_LEN		8	/* maximum iv len for any encryption */
+
+/* Includes MIC */
+#define DOT11_MAX_MPDU_BODY_LEN		2304	/* max MPDU body length */
+/* A4 header + QoS + CCMP + PDU + ICV + FCS = 2352 */
+#define DOT11_MAX_MPDU_LEN		(DOT11_A4_HDR_LEN + \
+					 DOT11_QOS_LEN + \
+					 DOT11_IV_AES_CCM_LEN + \
+					 DOT11_MAX_MPDU_BODY_LEN + \
+					 DOT11_ICV_LEN + \
+					 DOT11_FCS_LEN)	/* d11 max MPDU length */
+
+#define DOT11_MAX_SSID_LEN		32	/* d11 max ssid length */
+
+/* dot11RTSThreshold */
+#define DOT11_DEFAULT_RTS_LEN		2347	/* d11 default RTS length */
+#define DOT11_MAX_RTS_LEN		2347	/* d11 max RTS length */
+
+/* dot11FragmentationThreshold */
+#define DOT11_MIN_FRAG_LEN		256	/* d11 min fragmentation length */
+#define DOT11_MAX_FRAG_LEN		2346	/* Max frag is also limited by aMPDUMaxLength
+						* of the attached PHY
+						*/
+#define DOT11_DEFAULT_FRAG_LEN		2346	/* d11 default fragmentation length */
+
+/* dot11BeaconPeriod */
+#define DOT11_MIN_BEACON_PERIOD		1	/* d11 min beacon period */
+#define DOT11_MAX_BEACON_PERIOD		0xFFFF	/* d11 max beacon period */
+
+/* dot11DTIMPeriod */
+#define DOT11_MIN_DTIM_PERIOD		1	/* d11 min DTIM period */
+#define DOT11_MAX_DTIM_PERIOD		0xFF	/* d11 max DTIM period */
+
+/** 802.2 LLC/SNAP header used by 802.11 per 802.1H */
+#define DOT11_LLC_SNAP_HDR_LEN		8	/* d11 LLC/SNAP header length */
+#define DOT11_OUI_LEN			3	/* d11 OUI length */
+BWL_PRE_PACKED_STRUCT struct dot11_llc_snap_header {
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[DOT11_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
+						 * Bridge-Tunnel: 0x00 0x00 0xF8
+						 */
+	uint16	type;				/* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* RFC1042 header used by 802.11 per 802.1H */
+#define RFC1042_HDR_LEN	(ETHER_HDR_LEN + DOT11_LLC_SNAP_HDR_LEN)	/* RCF1042 header length */
+
+/* Generic 802.11 MAC header */
+/**
+ * N.B.: This struct reflects the full 4 address 802.11 MAC header.
+ *		 The fields are defined such that the shorter 1, 2, and 3
+ *		 address headers just use the first k fields.
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	a1;		/* address 1 */
+	struct ether_addr	a2;		/* address 2 */
+	struct ether_addr	a3;		/* address 3 */
+	uint16			seq;		/* sequence control */
+	struct ether_addr	a4;		/* address 4 */
+} BWL_POST_PACKED_STRUCT;
+
+/* Control frames */
+
+BWL_PRE_PACKED_STRUCT struct dot11_rts_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	ta;		/* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_RTS_LEN		16		/* d11 RTS frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_cts_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_CTS_LEN		10		/* d11 CTS frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ack_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_ACK_LEN		10		/* d11 ACK frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_ps_poll_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* AID */
+	struct ether_addr	bssid;		/* receiver address, STA in AP */
+	struct ether_addr	ta;		/* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_PS_POLL_LEN	16		/* d11 PS poll frame length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_cf_end_frame {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	bssid;		/* transmitter address, STA in AP */
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_CS_END_LEN	16		/* d11 CF-END frame length */
+
+/**
+ * RWL wifi protocol: The Vendor Specific Action frame is defined for vendor-specific signaling
+ *  category+OUI+vendor specific content ( this can be variable)
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_action_wifi_vendor_specific {
+	uint8	category;
+	uint8	OUI[3];
+	uint8	type;
+	uint8	subtype;
+	uint8	data[1040];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_wifi_vendor_specific dot11_action_wifi_vendor_specific_t;
+
+/** generic vendor specific action frame with variable length */
+BWL_PRE_PACKED_STRUCT struct dot11_action_vs_frmhdr {
+	uint8	category;
+	uint8	OUI[3];
+	uint8	type;
+	uint8	subtype;
+	uint8	data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_action_vs_frmhdr dot11_action_vs_frmhdr_t;
+
+#define DOT11_ACTION_VS_HDR_LEN	6
+
+#define BCM_ACTION_OUI_BYTE0	0x00
+#define BCM_ACTION_OUI_BYTE1	0x90
+#define BCM_ACTION_OUI_BYTE2	0x4c
+
+/* BA/BAR Control parameters */
+#define DOT11_BA_CTL_POLICY_NORMAL	0x0000	/* normal ack */
+#define DOT11_BA_CTL_POLICY_NOACK	0x0001	/* no ack */
+#define DOT11_BA_CTL_POLICY_MASK	0x0001	/* ack policy mask */
+
+#define DOT11_BA_CTL_MTID		0x0002	/* multi tid BA */
+#define DOT11_BA_CTL_COMPRESSED		0x0004	/* compressed bitmap */
+
+#define DOT11_BA_CTL_NUMMSDU_MASK	0x0FC0	/* num msdu in bitmap mask */
+#define DOT11_BA_CTL_NUMMSDU_SHIFT	6	/* num msdu in bitmap shift */
+
+#define DOT11_BA_CTL_TID_MASK		0xF000	/* tid mask */
+#define DOT11_BA_CTL_TID_SHIFT		12	/* tid shift */
+
+/** control frame header (BA/BAR) */
+BWL_PRE_PACKED_STRUCT struct dot11_ctl_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	ra;		/* receiver address */
+	struct ether_addr	ta;		/* transmitter address */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_CTL_HDR_LEN	16		/* control frame hdr len */
+
+/** BAR frame payload */
+BWL_PRE_PACKED_STRUCT struct dot11_bar {
+	uint16			bar_control;	/* BAR Control */
+	uint16			seqnum;		/* Starting Sequence control */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BAR_LEN		4		/* BAR frame payload length */
+
+#define DOT11_BA_BITMAP_LEN	128		/* bitmap length */
+#define DOT11_BA_CMP_BITMAP_LEN	8		/* compressed bitmap length */
+/** BA frame payload */
+BWL_PRE_PACKED_STRUCT struct dot11_ba {
+	uint16			ba_control;	/* BA Control */
+	uint16			seqnum;		/* Starting Sequence control */
+	uint8			bitmap[DOT11_BA_BITMAP_LEN];	/* Block Ack Bitmap */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_BA_LEN		4		/* BA frame payload len (wo bitmap) */
+
+/** Management frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_management_header {
+	uint16			fc;		/* frame control */
+	uint16			durid;		/* duration/ID */
+	struct ether_addr	da;		/* receiver address */
+	struct ether_addr	sa;		/* transmitter address */
+	struct ether_addr	bssid;		/* BSS ID */
+	uint16			seq;		/* sequence control */
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_MGMT_HDR_LEN	24		/* d11 management header length */
+
+/* Management frame payloads */
+
+BWL_PRE_PACKED_STRUCT struct dot11_bcn_prb {
+	uint32			timestamp[2];
+	uint16			beacon_interval;
+	uint16			capability;
+} BWL_POST_PACKED_STRUCT;
+#define	DOT11_BCN_PRB_LEN	12		/* 802.11 beacon/probe frame fixed length */
+#define	DOT11_BCN_PRB_FIXED_LEN	12		/* 802.11 beacon/probe frame fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_auth {
+	uint16			alg;		/* algorithm */
+	uint16			seq;		/* sequence control */
+	uint16			status;		/* status code */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_AUTH_FIXED_LEN	6		/* length of auth frame without challenge IE */
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_req {
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_REQ_FIXED_LEN	4	/* length of assoc frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_reassoc_req {
+	uint16			capability;	/* capability information */
+	uint16			listen;		/* listen interval */
+	struct ether_addr	ap;		/* Current AP address */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_REASSOC_REQ_FIXED_LEN	10	/* length of assoc frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_assoc_resp {
+	uint16			capability;	/* capability information */
+	uint16			status;		/* status code */
+	uint16			aid;		/* association ID */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ASSOC_RESP_FIXED_LEN	6	/* length of assoc resp frame without info elts */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_measure {
+	uint8	category;
+	uint8	action;
+	uint8	token;
+	uint8	data[1];
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACTION_MEASURE_LEN	3	/* d11 action measurement header length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_ch_width {
+	uint8	category;
+	uint8	action;
+	uint8	ch_width;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ht_mimops {
+	uint8	category;
+	uint8	action;
+	uint8	control;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_sa_query {
+	uint8	category;
+	uint8	action;
+	uint16	id;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_vht_oper_mode {
+	uint8	category;
+	uint8	action;
+	uint8	mode;
+} BWL_POST_PACKED_STRUCT;
+
+#define SM_PWRSAVE_ENABLE	1
+#define SM_PWRSAVE_MODE		2
+
+/* ************* 802.11h related definitions. ************* */
+BWL_PRE_PACKED_STRUCT struct dot11_power_cnst {
+	uint8 id;
+	uint8 len;
+	uint8 power;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cnst dot11_power_cnst_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_power_cap {
+	int8 min;
+	int8 max;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_power_cap dot11_power_cap_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_tpc_rep {
+	uint8 id;
+	uint8 len;
+	uint8 tx_pwr;
+	uint8 margin;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tpc_rep dot11_tpc_rep_t;
+#define DOT11_MNG_IE_TPC_REPORT_LEN	2 	/* length of IE data, not including 2 byte header */
+
+BWL_PRE_PACKED_STRUCT struct dot11_supp_channels {
+	uint8 id;
+	uint8 len;
+	uint8 first_channel;
+	uint8 num_channels;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_supp_channels dot11_supp_channels_t;
+
+/**
+ * Extension Channel Offset IE: 802.11n-D1.0 spec. added sideband
+ * offset for 40MHz operation.  The possible 3 values are:
+ * 1 = above control channel
+ * 3 = below control channel
+ * 0 = no extension channel
+ */
+BWL_PRE_PACKED_STRUCT struct dot11_extch {
+	uint8	id;		/* IE ID, 62, DOT11_MNG_EXT_CHANNEL_OFFSET */
+	uint8	len;		/* IE length */
+	uint8	extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extch dot11_extch_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_brcm_extch {
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];
+	uint8	type;           /* type indicates what follows */
+	uint8	extch;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_brcm_extch dot11_brcm_extch_ie_t;
+
+#define BRCM_EXTCH_IE_LEN	5
+#define BRCM_EXTCH_IE_TYPE	53	/* 802.11n ID not yet assigned */
+#define DOT11_EXTCH_IE_LEN	1
+#define DOT11_EXT_CH_MASK	0x03	/* extension channel mask */
+#define DOT11_EXT_CH_UPPER	0x01	/* ext. ch. on upper sb */
+#define DOT11_EXT_CH_LOWER	0x03	/* ext. ch. on lower sb */
+#define DOT11_EXT_CH_NONE	0x00	/* no extension ch.  */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_frmhdr {
+	uint8	category;
+	uint8	action;
+	uint8	data[1];
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_ACTION_FRMHDR_LEN	2
+
+/** CSA IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch {
+	uint8 id;	/* id DOT11_MNG_CHANNEL_SWITCH_ID */
+	uint8 len;	/* length of IE */
+	uint8 mode;	/* mode 0 or 1 */
+	uint8 channel;	/* channel switch to */
+	uint8 count;	/* number of beacons before switching */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch dot11_chan_switch_ie_t;
+
+#define DOT11_SWITCH_IE_LEN	3	/* length of IE data, not including 2 byte header */
+/* CSA mode - 802.11h-2003 $7.3.2.20 */
+#define DOT11_CSA_MODE_ADVISORY		0	/* no DOT11_CSA_MODE_NO_TX restriction imposed */
+#define DOT11_CSA_MODE_NO_TX		1	/* no transmission upon receiving CSA frame. */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_switch_channel {
+	uint8	category;
+	uint8	action;
+	dot11_chan_switch_ie_t chan_switch_ie;	/* for switch IE */
+	dot11_brcm_extch_ie_t extch_ie;		/* extension channel offset */
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11_csa_body {
+	uint8 mode;	/* mode 0 or 1 */
+	uint8 reg;	/* regulatory class */
+	uint8 channel;	/* channel switch to */
+	uint8 count;	/* number of beacons before switching */
+} BWL_POST_PACKED_STRUCT;
+
+/** 11n Extended Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_ext_csa {
+	uint8 id;	/* id DOT11_MNG_EXT_CHANNEL_SWITCH_ID */
+	uint8 len;	/* length of IE */
+	struct dot11_csa_body b;	/* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ext_csa dot11_ext_csa_ie_t;
+#define DOT11_EXT_CSA_IE_LEN	4	/* length of extended channel switch IE body */
+
+BWL_PRE_PACKED_STRUCT struct dot11_action_ext_csa {
+	uint8	category;
+	uint8	action;
+	dot11_ext_csa_ie_t chan_switch_ie;	/* for switch IE */
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct dot11y_action_ext_csa {
+	uint8	category;
+	uint8	action;
+	struct dot11_csa_body b;	/* body of the ie */
+} BWL_POST_PACKED_STRUCT;
+
+/**  Wide Bandwidth Channel Switch IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_wide_bw_channel_switch {
+	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+	uint8 len;				/* length of IE */
+	uint8 channel_width;			/* new channel width */
+	uint8 center_frequency_segment_0;	/* center frequency segment 0 */
+	uint8 center_frequency_segment_1;	/* center frequency segment 1 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wide_bw_channel_switch dot11_wide_bw_chan_switch_ie_t;
+
+#define DOT11_WIDE_BW_SWITCH_IE_LEN     3       /* length of IE data, not including 2 byte header */
+
+/** Channel Switch Wrapper IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_channel_switch_wrapper {
+	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+	uint8 len;				/* length of IE */
+	dot11_wide_bw_chan_switch_ie_t wb_chan_switch_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_channel_switch_wrapper dot11_chan_switch_wrapper_ie_t;
+
+/** VHT Transmit Power Envelope IE data structure */
+BWL_PRE_PACKED_STRUCT struct dot11_vht_transmit_power_envelope {
+	uint8 id;				/* id DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID */
+	uint8 len;				/* length of IE */
+	uint8 transmit_power_info;
+	uint8 local_max_transmit_power_20;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_vht_transmit_power_envelope dot11_vht_transmit_power_envelope_ie_t;
+
+/* vht transmit power envelope IE length depends on channel width */
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_40MHZ	1
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_80MHZ	2
+#define DOT11_VHT_TRANSMIT_PWR_ENVELOPE_IE_LEN_160MHZ	3
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_coex {
+	uint8	id;
+	uint8	len;
+	uint8	info;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_coex dot11_obss_coex_t;
+#define DOT11_OBSS_COEXINFO_LEN	1	/* length of OBSS Coexistence INFO IE */
+
+#define	DOT11_OBSS_COEX_INFO_REQ		0x01
+#define	DOT11_OBSS_COEX_40MHZ_INTOLERANT	0x02
+#define	DOT11_OBSS_COEX_20MHZ_WIDTH_REQ	0x04
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_chanlist {
+	uint8	id;
+	uint8	len;
+	uint8	regclass;
+	uint8	chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_chanlist dot11_obss_chanlist_t;
+#define DOT11_OBSS_CHANLIST_FIXED_LEN	1	/* fixed length of regclass */
+
+BWL_PRE_PACKED_STRUCT struct dot11_extcap_ie {
+	uint8 id;
+	uint8 len;
+	uint8 cap[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap_ie dot11_extcap_ie_t;
+
+#define DOT11_EXTCAP_LEN_MAX	8
+
+#define DOT11_EXTCAP_LEN_COEX	1
+#define DOT11_EXTCAP_LEN_BT	3
+#define DOT11_EXTCAP_LEN_IW	4
+#define DOT11_EXTCAP_LEN_SI	6
+
+#define DOT11_EXTCAP_LEN_TDLS	5
+#define DOT11_11AC_EXTCAP_LEN_TDLS	8
+
+#define DOT11_EXTCAP_LEN_FMS			2
+#define DOT11_EXTCAP_LEN_PROXY_ARP		2
+#define DOT11_EXTCAP_LEN_TFS			3
+#define DOT11_EXTCAP_LEN_WNM_SLEEP		3
+#define DOT11_EXTCAP_LEN_TIMBC			3
+#define DOT11_EXTCAP_LEN_BSSTRANS		3
+#define DOT11_EXTCAP_LEN_DMS			4
+#define DOT11_EXTCAP_LEN_WNM_NOTIFICATION	6
+#define DOT11_EXTCAP_LEN_TDLS_WBW		8
+#define DOT11_EXTCAP_LEN_OPMODE_NOTIFICATION	8
+
+BWL_PRE_PACKED_STRUCT struct dot11_extcap {
+	uint8 extcap[DOT11_EXTCAP_LEN_MAX];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_extcap dot11_extcap_t;
+
+/* TDLS Capabilities */
+#define DOT11_TDLS_CAP_TDLS			37		/* TDLS support */
+#define DOT11_TDLS_CAP_PU_BUFFER_STA	28		/* TDLS Peer U-APSD buffer STA support */
+#define DOT11_TDLS_CAP_PEER_PSM		20		/* TDLS Peer PSM support */
+#define DOT11_TDLS_CAP_CH_SW			30		/* TDLS Channel switch */
+#define DOT11_TDLS_CAP_PROH			38		/* TDLS prohibited */
+#define DOT11_TDLS_CAP_CH_SW_PROH		39		/* TDLS Channel switch prohibited */
+#define DOT11_TDLS_CAP_TDLS_WIDER_BW	61	/* TDLS Wider Band-Width */
+
+#define TDLS_CAP_MAX_BIT		39		/* TDLS max bit defined in ext cap */
+
+/* 802.11h/802.11k Measurement Request/Report IEs */
+/* Measurement Type field */
+#define DOT11_MEASURE_TYPE_BASIC 	0	/* d11 measurement basic type */
+#define DOT11_MEASURE_TYPE_CCA 		1	/* d11 measurement CCA type */
+#define DOT11_MEASURE_TYPE_RPI		2	/* d11 measurement RPI type */
+#define DOT11_MEASURE_TYPE_CHLOAD		3	/* d11 measurement Channel Load type */
+#define DOT11_MEASURE_TYPE_NOISE		4	/* d11 measurement Noise Histogram type */
+#define DOT11_MEASURE_TYPE_BEACON		5	/* d11 measurement Beacon type */
+#define DOT11_MEASURE_TYPE_FRAME	6	/* d11 measurement Frame type */
+#define DOT11_MEASURE_TYPE_STAT		7	/* d11 measurement STA Statistics type */
+#define DOT11_MEASURE_TYPE_LCI		8	/* d11 measurement LCI type */
+#define DOT11_MEASURE_TYPE_TXSTREAM		9	/* d11 measurement TX Stream type */
+#define DOT11_MEASURE_TYPE_PAUSE		255	/* d11 measurement pause type */
+
+/* Measurement Request Modes */
+#define DOT11_MEASURE_MODE_PARALLEL 	(1<<0)	/* d11 measurement parallel */
+#define DOT11_MEASURE_MODE_ENABLE 	(1<<1)	/* d11 measurement enable */
+#define DOT11_MEASURE_MODE_REQUEST	(1<<2)	/* d11 measurement request */
+#define DOT11_MEASURE_MODE_REPORT 	(1<<3)	/* d11 measurement report */
+#define DOT11_MEASURE_MODE_DUR 	(1<<4)	/* d11 measurement dur mandatory */
+/* Measurement Report Modes */
+#define DOT11_MEASURE_MODE_LATE 	(1<<0)	/* d11 measurement late */
+#define DOT11_MEASURE_MODE_INCAPABLE	(1<<1)	/* d11 measurement incapable */
+#define DOT11_MEASURE_MODE_REFUSED	(1<<2)	/* d11 measurement refuse */
+/* Basic Measurement Map bits */
+#define DOT11_MEASURE_BASIC_MAP_BSS	((uint8)(1<<0))	/* d11 measurement basic map BSS */
+#define DOT11_MEASURE_BASIC_MAP_OFDM	((uint8)(1<<1))	/* d11 measurement map OFDM */
+#define DOT11_MEASURE_BASIC_MAP_UKNOWN	((uint8)(1<<2))	/* d11 measurement map unknown */
+#define DOT11_MEASURE_BASIC_MAP_RADAR	((uint8)(1<<3))	/* d11 measurement map radar */
+#define DOT11_MEASURE_BASIC_MAP_UNMEAS	((uint8)(1<<4))	/* d11 measurement map unmeasuremnt */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_req {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 channel;
+	uint8 start_time[8];
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_req dot11_meas_req_t;
+#define DOT11_MNG_IE_MREQ_LEN 14	/* d11 measurement request IE length */
+/* length of Measure Request IE data not including variable len */
+#define DOT11_MNG_IE_MREQ_FIXED_LEN 3	/* d11 measurement request IE fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	BWL_PRE_PACKED_STRUCT union
+	{
+		BWL_PRE_PACKED_STRUCT struct {
+			uint8 channel;
+			uint8 start_time[8];
+			uint16 duration;
+			uint8 map;
+		} BWL_POST_PACKED_STRUCT basic;
+		uint8 data[1];
+	} BWL_POST_PACKED_STRUCT rep;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep dot11_meas_rep_t;
+
+/* length of Measure Report IE data not including variable len */
+#define DOT11_MNG_IE_MREP_FIXED_LEN	3	/* d11 measurement response IE fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_meas_rep_basic {
+	uint8 channel;
+	uint8 start_time[8];
+	uint16 duration;
+	uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_meas_rep_basic dot11_meas_rep_basic_t;
+#define DOT11_MEASURE_BASIC_REP_LEN	12	/* d11 measurement basic report length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_quiet {
+	uint8 id;
+	uint8 len;
+	uint8 count;	/* TBTTs until beacon interval in quiet starts */
+	uint8 period;	/* Beacon intervals between periodic quiet periods ? */
+	uint16 duration;	/* Length of quiet period, in TU's */
+	uint16 offset;	/* TU's offset from TBTT in Count field */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_quiet dot11_quiet_t;
+
+BWL_PRE_PACKED_STRUCT struct chan_map_tuple {
+	uint8 channel;
+	uint8 map;
+} BWL_POST_PACKED_STRUCT;
+typedef struct chan_map_tuple chan_map_tuple_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ibss_dfs {
+	uint8 id;
+	uint8 len;
+	uint8 eaddr[ETHER_ADDR_LEN];
+	uint8 interval;
+	chan_map_tuple_t map[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ibss_dfs dot11_ibss_dfs_t;
+
+/* WME Elements */
+#define WME_OUI			"\x00\x50\xf2"	/* WME OUI */
+#define WME_OUI_LEN		3
+#define WME_OUI_TYPE		2	/* WME type */
+#define WME_TYPE		2	/* WME type, deprecated */
+#define WME_SUBTYPE_IE		0	/* Information Element */
+#define WME_SUBTYPE_PARAM_IE	1	/* Parameter Element */
+#define WME_SUBTYPE_TSPEC	2	/* Traffic Specification */
+#define WME_VER			1	/* WME version */
+
+/* WME Access Category Indices (ACIs) */
+#define AC_BE			0	/* Best Effort */
+#define AC_BK			1	/* Background */
+#define AC_VI			2	/* Video */
+#define AC_VO			3	/* Voice */
+#define AC_COUNT		4	/* number of ACs */
+
+typedef uint8 ac_bitmap_t;	/* AC bitmap of (1 << AC_xx) */
+
+#define AC_BITMAP_NONE		0x0	/* No ACs */
+#define AC_BITMAP_ALL		0xf	/* All ACs */
+#define AC_BITMAP_TST(ab, ac)	(((ab) & (1 << (ac))) != 0)
+#define AC_BITMAP_SET(ab, ac)	(((ab) |= (1 << (ac))))
+#define AC_BITMAP_RESET(ab, ac) (((ab) &= ~(1 << (ac))))
+
+/** WME Information Element (IE) */
+BWL_PRE_PACKED_STRUCT struct wme_ie {
+	uint8 oui[3];
+	uint8 type;
+	uint8 subtype;
+	uint8 version;
+	uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_ie wme_ie_t;
+#define WME_IE_LEN 7	/* WME IE length */
+
+BWL_PRE_PACKED_STRUCT struct edcf_acparam {
+	uint8	ACI;
+	uint8	ECW;
+	uint16  TXOP;		/* stored in network order (ls octet first) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct edcf_acparam edcf_acparam_t;
+
+/** WME Parameter Element (PE) */
+BWL_PRE_PACKED_STRUCT struct wme_param_ie {
+	uint8 oui[3];
+	uint8 type;
+	uint8 subtype;
+	uint8 version;
+	uint8 qosinfo;
+	uint8 rsvd;
+	edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct wme_param_ie wme_param_ie_t;
+#define WME_PARAM_IE_LEN            24          /* WME Parameter IE length */
+
+/* QoS Info field for IE as sent from AP */
+#define WME_QI_AP_APSD_MASK         0x80        /* U-APSD Supported mask */
+#define WME_QI_AP_APSD_SHIFT        7           /* U-APSD Supported shift */
+#define WME_QI_AP_COUNT_MASK        0x0f        /* Parameter set count mask */
+#define WME_QI_AP_COUNT_SHIFT       0           /* Parameter set count shift */
+
+/* QoS Info field for IE as sent from STA */
+#define WME_QI_STA_MAXSPLEN_MASK    0x60        /* Max Service Period Length mask */
+#define WME_QI_STA_MAXSPLEN_SHIFT   5           /* Max Service Period Length shift */
+#define WME_QI_STA_APSD_ALL_MASK    0xf         /* APSD all AC bits mask */
+#define WME_QI_STA_APSD_ALL_SHIFT   0           /* APSD all AC bits shift */
+#define WME_QI_STA_APSD_BE_MASK     0x8         /* APSD AC_BE mask */
+#define WME_QI_STA_APSD_BE_SHIFT    3           /* APSD AC_BE shift */
+#define WME_QI_STA_APSD_BK_MASK     0x4         /* APSD AC_BK mask */
+#define WME_QI_STA_APSD_BK_SHIFT    2           /* APSD AC_BK shift */
+#define WME_QI_STA_APSD_VI_MASK     0x2         /* APSD AC_VI mask */
+#define WME_QI_STA_APSD_VI_SHIFT    1           /* APSD AC_VI shift */
+#define WME_QI_STA_APSD_VO_MASK     0x1         /* APSD AC_VO mask */
+#define WME_QI_STA_APSD_VO_SHIFT    0           /* APSD AC_VO shift */
+
+/* ACI */
+#define EDCF_AIFSN_MIN               1           /* AIFSN minimum value */
+#define EDCF_AIFSN_MAX               15          /* AIFSN maximum value */
+#define EDCF_AIFSN_MASK              0x0f        /* AIFSN mask */
+#define EDCF_ACM_MASK                0x10        /* ACM mask */
+#define EDCF_ACI_MASK                0x60        /* ACI mask */
+#define EDCF_ACI_SHIFT               5           /* ACI shift */
+#define EDCF_AIFSN_SHIFT             12          /* 4 MSB(0xFFF) in ifs_ctl for AC idx */
+
+/* ECW */
+#define EDCF_ECW_MIN                 0           /* cwmin/cwmax exponent minimum value */
+#define EDCF_ECW_MAX                 15          /* cwmin/cwmax exponent maximum value */
+#define EDCF_ECW2CW(exp)             ((1 << (exp)) - 1)
+#define EDCF_ECWMIN_MASK             0x0f        /* cwmin exponent form mask */
+#define EDCF_ECWMAX_MASK             0xf0        /* cwmax exponent form mask */
+#define EDCF_ECWMAX_SHIFT            4           /* cwmax exponent form shift */
+
+/* TXOP */
+#define EDCF_TXOP_MIN                0           /* TXOP minimum value */
+#define EDCF_TXOP_MAX                65535       /* TXOP maximum value */
+#define EDCF_TXOP2USEC(txop)         ((txop) << 5)
+
+/* Default BE ACI value for non-WME connection STA */
+#define NON_EDCF_AC_BE_ACI_STA          0x02
+
+/* Default EDCF parameters that AP advertises for STA to use; WMM draft Table 12 */
+#define EDCF_AC_BE_ACI_STA           0x03	/* STA ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_STA           0xA4	/* STA ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_STA          0x0000	/* STA TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_STA           0x27	/* STA ACI value for background AC */
+#define EDCF_AC_BK_ECW_STA           0xA4	/* STA ECW value for background AC */
+#define EDCF_AC_BK_TXOP_STA          0x0000	/* STA TXOP value for background AC */
+#define EDCF_AC_VI_ACI_STA           0x42	/* STA ACI value for video AC */
+#define EDCF_AC_VI_ECW_STA           0x43	/* STA ECW value for video AC */
+#define EDCF_AC_VI_TXOP_STA          0x005e	/* STA TXOP value for video AC */
+#define EDCF_AC_VO_ACI_STA           0x62	/* STA ACI value for audio AC */
+#define EDCF_AC_VO_ECW_STA           0x32	/* STA ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_STA          0x002f	/* STA TXOP value for audio AC */
+
+/* Default EDCF parameters that AP uses; WMM draft Table 14 */
+#define EDCF_AC_BE_ACI_AP            0x03	/* AP ACI value for best effort AC */
+#define EDCF_AC_BE_ECW_AP            0x64	/* AP ECW value for best effort AC */
+#define EDCF_AC_BE_TXOP_AP           0x0000	/* AP TXOP value for best effort AC */
+#define EDCF_AC_BK_ACI_AP            0x27	/* AP ACI value for background AC */
+#define EDCF_AC_BK_ECW_AP            0xA4	/* AP ECW value for background AC */
+#define EDCF_AC_BK_TXOP_AP           0x0000	/* AP TXOP value for background AC */
+#define EDCF_AC_VI_ACI_AP            0x41	/* AP ACI value for video AC */
+#define EDCF_AC_VI_ECW_AP            0x43	/* AP ECW value for video AC */
+#define EDCF_AC_VI_TXOP_AP           0x005e	/* AP TXOP value for video AC */
+#define EDCF_AC_VO_ACI_AP            0x61	/* AP ACI value for audio AC */
+#define EDCF_AC_VO_ECW_AP            0x32	/* AP ECW value for audio AC */
+#define EDCF_AC_VO_TXOP_AP           0x002f	/* AP TXOP value for audio AC */
+
+/** EDCA Parameter IE */
+BWL_PRE_PACKED_STRUCT struct edca_param_ie {
+	uint8 qosinfo;
+	uint8 rsvd;
+	edcf_acparam_t acparam[AC_COUNT];
+} BWL_POST_PACKED_STRUCT;
+typedef struct edca_param_ie edca_param_ie_t;
+#define EDCA_PARAM_IE_LEN            18          /* EDCA Parameter IE length */
+
+/** QoS Capability IE */
+BWL_PRE_PACKED_STRUCT struct qos_cap_ie {
+	uint8 qosinfo;
+} BWL_POST_PACKED_STRUCT;
+typedef struct qos_cap_ie qos_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_qbss_load_ie {
+	uint8 id; 			/* 11, DOT11_MNG_QBSS_LOAD_ID */
+	uint8 length;
+	uint16 station_count; 		/* total number of STAs associated */
+	uint8 channel_utilization;	/* % of time, normalized to 255, QAP sensed medium busy */
+	uint16 aac; 			/* available admission capacity */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_qbss_load_ie dot11_qbss_load_ie_t;
+#define BSS_LOAD_IE_SIZE 	7	/* BSS load IE size */
+
+#define WLC_QBSS_LOAD_CHAN_FREE_MAX	0xff	/* max for channel free score */
+
+/* nom_msdu_size */
+#define FIXED_MSDU_SIZE 0x8000		/* MSDU size is fixed */
+#define MSDU_SIZE_MASK	0x7fff		/* (Nominal or fixed) MSDU size */
+
+/* surplus_bandwidth */
+/* Represented as 3 bits of integer, binary point, 13 bits fraction */
+#define	INTEGER_SHIFT	13	/* integer shift */
+#define FRACTION_MASK	0x1FFF	/* fraction mask */
+
+/** Management Notification Frame */
+BWL_PRE_PACKED_STRUCT struct dot11_management_notification {
+	uint8 category;			/* DOT11_ACTION_NOTIFICATION */
+	uint8 action;
+	uint8 token;
+	uint8 status;
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+#define DOT11_MGMT_NOTIFICATION_LEN 4	/* Fixed length */
+
+/** Timeout Interval IE */
+BWL_PRE_PACKED_STRUCT struct ti_ie {
+	uint8 ti_type;
+	uint32 ti_val;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ti_ie ti_ie_t;
+#define TI_TYPE_REASSOC_DEADLINE	1
+#define TI_TYPE_KEY_LIFETIME		2
+
+/* WME Action Codes */
+#define WME_ADDTS_REQUEST	0	/* WME ADDTS request */
+#define WME_ADDTS_RESPONSE	1	/* WME ADDTS response */
+#define WME_DELTS_REQUEST	2	/* WME DELTS request */
+
+/* WME Setup Response Status Codes */
+#define WME_ADMISSION_ACCEPTED		0	/* WME admission accepted */
+#define WME_INVALID_PARAMETERS		1	/* WME invalide parameters */
+#define WME_ADMISSION_REFUSED		3	/* WME admission refused */
+
+/* Macro to take a pointer to a beacon or probe response
+ * body and return the char* pointer to the SSID info element
+ */
+#define BCN_PRB_SSID(body) ((char*)(body) + DOT11_BCN_PRB_LEN)
+
+/* Authentication frame payload constants */
+#define DOT11_OPEN_SYSTEM	0	/* d11 open authentication */
+#define DOT11_SHARED_KEY	1	/* d11 shared authentication */
+#define DOT11_FAST_BSS		2	/* d11 fast bss authentication */
+#define DOT11_CHALLENGE_LEN	128	/* d11 challenge text length */
+
+/* Frame control macros */
+#define FC_PVER_MASK		0x3	/* PVER mask */
+#define FC_PVER_SHIFT		0	/* PVER shift */
+#define FC_TYPE_MASK		0xC	/* type mask */
+#define FC_TYPE_SHIFT		2	/* type shift */
+#define FC_SUBTYPE_MASK		0xF0	/* subtype mask */
+#define FC_SUBTYPE_SHIFT	4	/* subtype shift */
+#define FC_TODS			0x100	/* to DS */
+#define FC_TODS_SHIFT		8	/* to DS shift */
+#define FC_FROMDS		0x200	/* from DS */
+#define FC_FROMDS_SHIFT		9	/* from DS shift */
+#define FC_MOREFRAG		0x400	/* more frag. */
+#define FC_MOREFRAG_SHIFT	10	/* more frag. shift */
+#define FC_RETRY		0x800	/* retry */
+#define FC_RETRY_SHIFT		11	/* retry shift */
+#define FC_PM			0x1000	/* PM */
+#define FC_PM_SHIFT		12	/* PM shift */
+#define FC_MOREDATA		0x2000	/* more data */
+#define FC_MOREDATA_SHIFT	13	/* more data shift */
+#define FC_WEP			0x4000	/* WEP */
+#define FC_WEP_SHIFT		14	/* WEP shift */
+#define FC_ORDER		0x8000	/* order */
+#define FC_ORDER_SHIFT		15	/* order shift */
+
+/* sequence control macros */
+#define SEQNUM_SHIFT		4	/* seq. number shift */
+#define SEQNUM_MAX		0x1000	/* max seqnum + 1 */
+#define FRAGNUM_MASK		0xF	/* frag. number mask */
+
+/* Frame Control type/subtype defs */
+
+/* FC Types */
+#define FC_TYPE_MNG		0	/* management type */
+#define FC_TYPE_CTL		1	/* control type */
+#define FC_TYPE_DATA		2	/* data type */
+
+/* Management Subtypes */
+#define FC_SUBTYPE_ASSOC_REQ		0	/* assoc. request */
+#define FC_SUBTYPE_ASSOC_RESP		1	/* assoc. response */
+#define FC_SUBTYPE_REASSOC_REQ		2	/* reassoc. request */
+#define FC_SUBTYPE_REASSOC_RESP		3	/* reassoc. response */
+#define FC_SUBTYPE_PROBE_REQ		4	/* probe request */
+#define FC_SUBTYPE_PROBE_RESP		5	/* probe response */
+#define FC_SUBTYPE_BEACON		8	/* beacon */
+#define FC_SUBTYPE_ATIM			9	/* ATIM */
+#define FC_SUBTYPE_DISASSOC		10	/* disassoc. */
+#define FC_SUBTYPE_AUTH			11	/* authentication */
+#define FC_SUBTYPE_DEAUTH		12	/* de-authentication */
+#define FC_SUBTYPE_ACTION		13	/* action */
+#define FC_SUBTYPE_ACTION_NOACK		14	/* action no-ack */
+
+/* Control Subtypes */
+#define FC_SUBTYPE_CTL_WRAPPER		7	/* Control Wrapper */
+#define FC_SUBTYPE_BLOCKACK_REQ		8	/* Block Ack Req */
+#define FC_SUBTYPE_BLOCKACK		9	/* Block Ack */
+#define FC_SUBTYPE_PS_POLL		10	/* PS poll */
+#define FC_SUBTYPE_RTS			11	/* RTS */
+#define FC_SUBTYPE_CTS			12	/* CTS */
+#define FC_SUBTYPE_ACK			13	/* ACK */
+#define FC_SUBTYPE_CF_END		14	/* CF-END */
+#define FC_SUBTYPE_CF_END_ACK		15	/* CF-END ACK */
+
+/* Data Subtypes */
+#define FC_SUBTYPE_DATA			0	/* Data */
+#define FC_SUBTYPE_DATA_CF_ACK		1	/* Data + CF-ACK */
+#define FC_SUBTYPE_DATA_CF_POLL		2	/* Data + CF-Poll */
+#define FC_SUBTYPE_DATA_CF_ACK_POLL	3	/* Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_NULL			4	/* Null */
+#define FC_SUBTYPE_CF_ACK		5	/* CF-Ack */
+#define FC_SUBTYPE_CF_POLL		6	/* CF-Poll */
+#define FC_SUBTYPE_CF_ACK_POLL		7	/* CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA		8	/* QoS Data */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK	9	/* QoS Data + CF-Ack */
+#define FC_SUBTYPE_QOS_DATA_CF_POLL	10	/* QoS Data + CF-Poll */
+#define FC_SUBTYPE_QOS_DATA_CF_ACK_POLL	11	/* QoS Data + CF-Ack + CF-Poll */
+#define FC_SUBTYPE_QOS_NULL		12	/* QoS Null */
+#define FC_SUBTYPE_QOS_CF_POLL		14	/* QoS CF-Poll */
+#define FC_SUBTYPE_QOS_CF_ACK_POLL	15	/* QoS CF-Ack + CF-Poll */
+
+/* Data Subtype Groups */
+#define FC_SUBTYPE_ANY_QOS(s)		(((s) & 8) != 0)
+#define FC_SUBTYPE_ANY_NULL(s)		(((s) & 4) != 0)
+#define FC_SUBTYPE_ANY_CF_POLL(s)	(((s) & 2) != 0)
+#define FC_SUBTYPE_ANY_CF_ACK(s)	(((s) & 1) != 0)
+#define FC_SUBTYPE_ANY_PSPOLL(s)	(((s) & 10) != 0)
+
+/* Type/Subtype Combos */
+#define FC_KIND_MASK		(FC_TYPE_MASK | FC_SUBTYPE_MASK)	/* FC kind mask */
+
+#define FC_KIND(t, s)	(((t) << FC_TYPE_SHIFT) | ((s) << FC_SUBTYPE_SHIFT))	/* FC kind */
+
+#define FC_SUBTYPE(fc)	(((fc) & FC_SUBTYPE_MASK) >> FC_SUBTYPE_SHIFT)	/* Subtype from FC */
+#define FC_TYPE(fc)	(((fc) & FC_TYPE_MASK) >> FC_TYPE_SHIFT)	/* Type from FC */
+
+#define FC_ASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_REQ)	/* assoc. request */
+#define FC_ASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ASSOC_RESP)	/* assoc. response */
+#define FC_REASSOC_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_REQ)	/* reassoc. request */
+#define FC_REASSOC_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_REASSOC_RESP)	/* reassoc. response */
+#define FC_PROBE_REQ	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_REQ)	/* probe request */
+#define FC_PROBE_RESP	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_PROBE_RESP)	/* probe response */
+#define FC_BEACON	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_BEACON)		/* beacon */
+#define FC_ATIM		FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ATIM)		/* ATIM */
+#define FC_DISASSOC	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DISASSOC)	/* disassoc */
+#define FC_AUTH		FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_AUTH)		/* authentication */
+#define FC_DEAUTH	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_DEAUTH)		/* deauthentication */
+#define FC_ACTION	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION)		/* action */
+#define FC_ACTION_NOACK	FC_KIND(FC_TYPE_MNG, FC_SUBTYPE_ACTION_NOACK)	/* action no-ack */
+
+#define FC_CTL_WRAPPER	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTL_WRAPPER)	/* Control Wrapper */
+#define FC_BLOCKACK_REQ	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK_REQ)	/* Block Ack Req */
+#define FC_BLOCKACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_BLOCKACK)	/* Block Ack */
+#define FC_PS_POLL	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_PS_POLL)	/* PS poll */
+#define FC_RTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_RTS)		/* RTS */
+#define FC_CTS		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CTS)		/* CTS */
+#define FC_ACK		FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_ACK)		/* ACK */
+#define FC_CF_END	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END)		/* CF-END */
+#define FC_CF_END_ACK	FC_KIND(FC_TYPE_CTL, FC_SUBTYPE_CF_END_ACK)	/* CF-END ACK */
+
+#define FC_DATA		FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA)		/* data */
+#define FC_NULL_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_NULL)		/* null data */
+#define FC_DATA_CF_ACK	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_DATA_CF_ACK)	/* data CF ACK */
+#define FC_QOS_DATA	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_DATA)	/* QoS data */
+#define FC_QOS_NULL	FC_KIND(FC_TYPE_DATA, FC_SUBTYPE_QOS_NULL)	/* QoS null */
+
+/* QoS Control Field */
+
+/* 802.1D Priority */
+#define QOS_PRIO_SHIFT		0	/* QoS priority shift */
+#define QOS_PRIO_MASK		0x0007	/* QoS priority mask */
+#define QOS_PRIO(qos)		(((qos) & QOS_PRIO_MASK) >> QOS_PRIO_SHIFT)	/* QoS priority */
+
+/* Traffic Identifier */
+#define QOS_TID_SHIFT		0	/* QoS TID shift */
+#define QOS_TID_MASK		0x000f	/* QoS TID mask */
+#define QOS_TID(qos)		(((qos) & QOS_TID_MASK) >> QOS_TID_SHIFT)	/* QoS TID */
+
+/* End of Service Period (U-APSD) */
+#define QOS_EOSP_SHIFT		4	/* QoS End of Service Period shift */
+#define QOS_EOSP_MASK		0x0010	/* QoS End of Service Period mask */
+#define QOS_EOSP(qos)		(((qos) & QOS_EOSP_MASK) >> QOS_EOSP_SHIFT)	/* Qos EOSP */
+
+/* Ack Policy */
+#define QOS_ACK_NORMAL_ACK	0	/* Normal Ack */
+#define QOS_ACK_NO_ACK		1	/* No Ack (eg mcast) */
+#define QOS_ACK_NO_EXP_ACK	2	/* No Explicit Ack */
+#define QOS_ACK_BLOCK_ACK	3	/* Block Ack */
+#define QOS_ACK_SHIFT		5	/* QoS ACK shift */
+#define QOS_ACK_MASK		0x0060	/* QoS ACK mask */
+#define QOS_ACK(qos)		(((qos) & QOS_ACK_MASK) >> QOS_ACK_SHIFT)	/* QoS ACK */
+
+/* A-MSDU flag */
+#define QOS_AMSDU_SHIFT		7	/* AMSDU shift */
+#define QOS_AMSDU_MASK		0x0080	/* AMSDU mask */
+
+/* Management Frames */
+
+/* Management Frame Constants */
+
+/* Fixed fields */
+#define DOT11_MNG_AUTH_ALGO_LEN		2	/* d11 management auth. algo. length */
+#define DOT11_MNG_AUTH_SEQ_LEN		2	/* d11 management auth. seq. length */
+#define DOT11_MNG_BEACON_INT_LEN	2	/* d11 management beacon interval length */
+#define DOT11_MNG_CAP_LEN		2	/* d11 management cap. length */
+#define DOT11_MNG_AP_ADDR_LEN		6	/* d11 management AP address length */
+#define DOT11_MNG_LISTEN_INT_LEN	2	/* d11 management listen interval length */
+#define DOT11_MNG_REASON_LEN		2	/* d11 management reason length */
+#define DOT11_MNG_AID_LEN		2	/* d11 management AID length */
+#define DOT11_MNG_STATUS_LEN		2	/* d11 management status length */
+#define DOT11_MNG_TIMESTAMP_LEN		8	/* d11 management timestamp length */
+
+/* DUR/ID field in assoc resp is 0xc000 | AID */
+#define DOT11_AID_MASK			0x3fff	/* d11 AID mask */
+
+/* Reason Codes */
+#define DOT11_RC_RESERVED		0	/* d11 RC reserved */
+#define DOT11_RC_UNSPECIFIED		1	/* Unspecified reason */
+#define DOT11_RC_AUTH_INVAL		2	/* Previous authentication no longer valid */
+#define DOT11_RC_DEAUTH_LEAVING		3	/* Deauthenticated because sending station
+						 * is leaving (or has left) IBSS or ESS
+						 */
+#define DOT11_RC_INACTIVITY		4	/* Disassociated due to inactivity */
+#define DOT11_RC_BUSY			5	/* Disassociated because AP is unable to handle
+						 * all currently associated stations
+						 */
+#define DOT11_RC_INVAL_CLASS_2		6	/* Class 2 frame received from
+						 * nonauthenticated station
+						 */
+#define DOT11_RC_INVAL_CLASS_3		7	/* Class 3 frame received from
+						 *  nonassociated station
+						 */
+#define DOT11_RC_DISASSOC_LEAVING	8	/* Disassociated because sending station is
+						 * leaving (or has left) BSS
+						 */
+#define DOT11_RC_NOT_AUTH		9	/* Station requesting (re)association is not
+						 * authenticated with responding station
+						 */
+#define DOT11_RC_BAD_PC			10	/* Unacceptable power capability element */
+#define DOT11_RC_BAD_CHANNELS		11	/* Unacceptable supported channels element */
+/* 12 is unused */
+
+/* 32-39 are QSTA specific reasons added in 11e */
+#define DOT11_RC_UNSPECIFIED_QOS	32	/* unspecified QoS-related reason */
+#define DOT11_RC_INSUFFCIENT_BW		33	/* QAP lacks sufficient bandwidth */
+#define DOT11_RC_EXCESSIVE_FRAMES	34	/* excessive number of frames need ack */
+#define DOT11_RC_TX_OUTSIDE_TXOP	35	/* transmitting outside the limits of txop */
+#define DOT11_RC_LEAVING_QBSS		36	/* QSTA is leaving the QBSS (or restting) */
+#define DOT11_RC_BAD_MECHANISM		37	/* does not want to use the mechanism */
+#define DOT11_RC_SETUP_NEEDED		38	/* mechanism needs a setup */
+#define DOT11_RC_TIMEOUT		39	/* timeout */
+
+#define DOT11_RC_MAX			23	/* Reason codes > 23 are reserved */
+
+#define DOT11_RC_TDLS_PEER_UNREACH	25
+#define DOT11_RC_TDLS_DOWN_UNSPECIFIED	26
+
+/* Status Codes */
+#define DOT11_SC_SUCCESS		0	/* Successful */
+#define DOT11_SC_FAILURE		1	/* Unspecified failure */
+#define DOT11_SC_TDLS_WAKEUP_SCH_ALT 2	/* TDLS wakeup schedule rejected but alternative  */
+					/* schedule provided */
+#define DOT11_SC_TDLS_WAKEUP_SCH_REJ 3	/* TDLS wakeup schedule rejected */
+#define DOT11_SC_TDLS_SEC_DISABLED	5	/* TDLS Security disabled */
+#define DOT11_SC_LIFETIME_REJ		6	/* Unacceptable lifetime */
+#define DOT11_SC_NOT_SAME_BSS		7	/* Not in same BSS */
+#define DOT11_SC_CAP_MISMATCH		10	/* Cannot support all requested
+						 * capabilities in the Capability
+						 * Information field
+						 */
+#define DOT11_SC_REASSOC_FAIL		11	/* Reassociation denied due to inability
+						 * to confirm that association exists
+						 */
+#define DOT11_SC_ASSOC_FAIL		12	/* Association denied due to reason
+						 * outside the scope of this standard
+						 */
+#define DOT11_SC_AUTH_MISMATCH		13	/* Responding station does not support
+						 * the specified authentication
+						 * algorithm
+						 */
+#define DOT11_SC_AUTH_SEQ		14	/* Received an Authentication frame
+						 * with authentication transaction
+						 * sequence number out of expected
+						 * sequence
+						 */
+#define DOT11_SC_AUTH_CHALLENGE_FAIL	15	/* Authentication rejected because of
+						 * challenge failure
+						 */
+#define DOT11_SC_AUTH_TIMEOUT		16	/* Authentication rejected due to timeout
+						 * waiting for next frame in sequence
+						 */
+#define DOT11_SC_ASSOC_BUSY_FAIL	17	/* Association denied because AP is
+						 * unable to handle additional
+						 * associated stations
+						 */
+#define DOT11_SC_ASSOC_RATE_MISMATCH	18	/* Association denied due to requesting
+						 * station not supporting all of the
+						 * data rates in the BSSBasicRateSet
+						 * parameter
+						 */
+#define DOT11_SC_ASSOC_SHORT_REQUIRED	19	/* Association denied due to requesting
+						 * station not supporting the Short
+						 * Preamble option
+						 */
+#define DOT11_SC_ASSOC_PBCC_REQUIRED	20	/* Association denied due to requesting
+						 * station not supporting the PBCC
+						 * Modulation option
+						 */
+#define DOT11_SC_ASSOC_AGILITY_REQUIRED	21	/* Association denied due to requesting
+						 * station not supporting the Channel
+						 * Agility option
+						 */
+#define DOT11_SC_ASSOC_SPECTRUM_REQUIRED	22	/* Association denied because Spectrum
+							 * Management capability is required.
+							 */
+#define DOT11_SC_ASSOC_BAD_POWER_CAP	23	/* Association denied because the info
+						 * in the Power Cap element is
+						 * unacceptable.
+						 */
+#define DOT11_SC_ASSOC_BAD_SUP_CHANNELS	24	/* Association denied because the info
+						 * in the Supported Channel element is
+						 * unacceptable
+						 */
+#define DOT11_SC_ASSOC_SHORTSLOT_REQUIRED	25	/* Association denied due to requesting
+							 * station not supporting the Short Slot
+							 * Time option
+							 */
+#define DOT11_SC_ASSOC_DSSSOFDM_REQUIRED 26	/* Association denied because requesting station
+						 * does not support the DSSS-OFDM option
+						 */
+#define DOT11_SC_ASSOC_HT_REQUIRED	27	/* Association denied because the requesting
+						 * station does not support HT features
+						 */
+#define DOT11_SC_ASSOC_R0KH_UNREACHABLE	28	/* Association denied due to AP
+						 * being unable to reach the R0 Key Holder
+						 */
+#define DOT11_SC_ASSOC_TRY_LATER	30	/* Association denied temporarily, try again later
+						 */
+#define DOT11_SC_ASSOC_MFP_VIOLATION	31	/* Association denied due to Robust Management
+						 * frame policy violation
+						 */
+
+#define	DOT11_SC_DECLINED		37	/* request declined */
+#define	DOT11_SC_INVALID_PARAMS		38	/* One or more params have invalid values */
+#define DOT11_SC_INVALID_PAIRWISE_CIPHER	42 /* invalid pairwise cipher */
+#define	DOT11_SC_INVALID_AKMP		43	/* Association denied due to invalid AKMP */
+#define DOT11_SC_INVALID_RSNIE_CAP	45	/* invalid RSN IE capabilities */
+#define DOT11_SC_DLS_NOT_ALLOWED	48	/* DLS is not allowed in the BSS by policy */
+#define	DOT11_SC_INVALID_PMKID		53	/* Association denied due to invalid PMKID */
+#define	DOT11_SC_INVALID_MDID		54	/* Association denied due to invalid MDID */
+#define	DOT11_SC_INVALID_FTIE		55	/* Association denied due to invalid FTIE */
+
+#define DOT11_SC_ADV_PROTO_NOT_SUPPORTED	59	/* ad proto not supported */
+#define DOT11_SC_NO_OUTSTAND_REQ			60	/* no outstanding req */
+#define DOT11_SC_RSP_NOT_RX_FROM_SERVER		61	/* no response from server */
+#define DOT11_SC_TIMEOUT					62	/* timeout */
+#define DOT11_SC_QUERY_RSP_TOO_LARGE		63	/* query rsp too large */
+#define DOT11_SC_SERVER_UNREACHABLE			65	/* server unreachable */
+
+#define DOT11_SC_UNEXP_MSG			70	/* Unexpected message */
+#define DOT11_SC_INVALID_SNONCE		71	/* Invalid SNonce */
+#define DOT11_SC_INVALID_RSNIE		72	/* Invalid contents of RSNIE */
+#define DOT11_SC_ASSOC_VHT_REQUIRED	104	/* Association denied because the requesting
+						 * station does not support VHT features.
+						 */
+
+#define DOT11_SC_TRANSMIT_FAILURE	79	/* transmission failure */
+
+/* Info Elts, length of INFORMATION portion of Info Elts */
+#define DOT11_MNG_DS_PARAM_LEN			1	/* d11 management DS parameter length */
+#define DOT11_MNG_IBSS_PARAM_LEN		2	/* d11 management IBSS parameter length */
+
+/* TIM Info element has 3 bytes fixed info in INFORMATION field,
+ * followed by 1 to 251 bytes of Partial Virtual Bitmap
+ */
+#define DOT11_MNG_TIM_FIXED_LEN			3	/* d11 management TIM fixed length */
+#define DOT11_MNG_TIM_DTIM_COUNT		0	/* d11 management DTIM count */
+#define DOT11_MNG_TIM_DTIM_PERIOD		1	/* d11 management DTIM period */
+#define DOT11_MNG_TIM_BITMAP_CTL		2	/* d11 management TIM BITMAP control  */
+#define DOT11_MNG_TIM_PVB			3	/* d11 management TIM PVB */
+
+/* TLV defines */
+#define TLV_TAG_OFF		0	/* tag offset */
+#define TLV_LEN_OFF		1	/* length offset */
+#define TLV_HDR_LEN		2	/* header length */
+#define TLV_BODY_OFF		2	/* body offset */
+#define TLV_BODY_LEN_MAX	255	/* max body length */
+
+/* Management Frame Information Element IDs */
+#define DOT11_MNG_SSID_ID			0	/* d11 management SSID id */
+#define DOT11_MNG_RATES_ID			1	/* d11 management rates id */
+#define DOT11_MNG_FH_PARMS_ID			2	/* d11 management FH parameter id */
+#define DOT11_MNG_DS_PARMS_ID			3	/* d11 management DS parameter id */
+#define DOT11_MNG_CF_PARMS_ID			4	/* d11 management CF parameter id */
+#define DOT11_MNG_TIM_ID			5	/* d11 management TIM id */
+#define DOT11_MNG_IBSS_PARMS_ID			6	/* d11 management IBSS parameter id */
+#define DOT11_MNG_COUNTRY_ID			7	/* d11 management country id */
+#define DOT11_MNG_HOPPING_PARMS_ID		8	/* d11 management hopping parameter id */
+#define DOT11_MNG_HOPPING_TABLE_ID		9	/* d11 management hopping table id */
+#define DOT11_MNG_REQUEST_ID			10	/* d11 management request id */
+#define DOT11_MNG_QBSS_LOAD_ID 			11	/* d11 management QBSS Load id */
+#define DOT11_MNG_EDCA_PARAM_ID			12	/* 11E EDCA Parameter id */
+#define DOT11_MNG_TSPEC_ID			13	/* d11 management TSPEC id */
+#define DOT11_MNG_TCLAS_ID			14	/* d11 management TCLAS id */
+#define DOT11_MNG_CHALLENGE_ID			16	/* d11 management chanllenge id */
+#define DOT11_MNG_PWR_CONSTRAINT_ID		32	/* 11H PowerConstraint */
+#define DOT11_MNG_PWR_CAP_ID			33	/* 11H PowerCapability */
+#define DOT11_MNG_TPC_REQUEST_ID 		34	/* 11H TPC Request */
+#define DOT11_MNG_TPC_REPORT_ID			35	/* 11H TPC Report */
+#define DOT11_MNG_SUPP_CHANNELS_ID		36	/* 11H Supported Channels */
+#define DOT11_MNG_CHANNEL_SWITCH_ID		37	/* 11H ChannelSwitch Announcement */
+#define DOT11_MNG_MEASURE_REQUEST_ID		38	/* 11H MeasurementRequest */
+#define DOT11_MNG_MEASURE_REPORT_ID		39	/* 11H MeasurementReport */
+#define DOT11_MNG_QUIET_ID			40	/* 11H Quiet */
+#define DOT11_MNG_IBSS_DFS_ID			41	/* 11H IBSS_DFS */
+#define DOT11_MNG_ERP_ID			42	/* d11 management ERP id */
+#define DOT11_MNG_TS_DELAY_ID			43	/* d11 management TS Delay id */
+#define DOT11_MNG_TCLAS_PROC_ID			44	/* d11 management TCLAS processing id */
+#define	DOT11_MNG_HT_CAP			45	/* d11 mgmt HT cap id */
+#define DOT11_MNG_QOS_CAP_ID			46	/* 11E QoS Capability id */
+#define DOT11_MNG_NONERP_ID			47	/* d11 management NON-ERP id */
+#define DOT11_MNG_RSN_ID			48	/* d11 management RSN id */
+#define DOT11_MNG_EXT_RATES_ID			50	/* d11 management ext. rates id */
+#define DOT11_MNG_AP_CHREP_ID			51	/* 11k AP Channel report id */
+#define DOT11_MNG_NEIGHBOR_REP_ID		52	/* 11k & 11v Neighbor report id */
+#define DOT11_MNG_RCPI_ID			53	/* 11k RCPI */
+#define DOT11_MNG_MDIE_ID			54	/* 11r Mobility domain id */
+#define DOT11_MNG_FTIE_ID			55	/* 11r Fast Bss Transition id */
+#define DOT11_MNG_FT_TI_ID			56	/* 11r Timeout Interval id */
+#define DOT11_MNG_RDE_ID			57	/* 11r RIC Data Element id */
+#define	DOT11_MNG_REGCLASS_ID			59	/* d11 management regulatory class id */
+#define DOT11_MNG_EXT_CSA_ID			60	/* d11 Extended CSA */
+#define	DOT11_MNG_HT_ADD			61	/* d11 mgmt additional HT info */
+#define	DOT11_MNG_EXT_CHANNEL_OFFSET		62	/* d11 mgmt ext channel offset */
+#define DOT11_MNG_BSS_AVR_ACCESS_DELAY_ID	63	/* 11k bss average access delay */
+#define DOT11_MNG_ANTENNA_ID			64	/* 11k antenna id */
+#define DOT11_MNG_RSNI_ID			65	/* 11k RSNI id */
+#define DOT11_MNG_MEASUREMENT_PILOT_TX_ID	66	/* 11k measurement pilot tx info id */
+#define DOT11_MNG_BSS_AVAL_ADMISSION_CAP_ID	67	/* 11k bss aval admission cap id */
+#define DOT11_MNG_BSS_AC_ACCESS_DELAY_ID	68	/* 11k bss AC access delay id */
+#define DOT11_MNG_WAPI_ID			68	/* d11 management WAPI id */
+#define DOT11_MNG_TIME_ADVERTISE_ID	69	/* 11p time advertisement */
+#define DOT11_MNG_RRM_CAP_ID		70	/* 11k radio measurement capability */
+#define DOT11_MNG_MULTIPLE_BSSID_ID		71	/* 11k multiple BSSID id */
+#define	DOT11_MNG_HT_BSS_COEXINFO_ID		72	/* d11 mgmt OBSS Coexistence INFO */
+#define	DOT11_MNG_HT_BSS_CHANNEL_REPORT_ID	73	/* d11 mgmt OBSS Intolerant Channel list */
+#define	DOT11_MNG_HT_OBSS_ID			74	/* d11 mgmt OBSS HT info */
+#define DOT11_MNG_MMIE_ID			76	/* d11 mgmt MIC IE */
+#define DOT11_MNG_FMS_DESCR_ID			86	/* 11v FMS descriptor */
+#define DOT11_MNG_FMS_REQ_ID			87	/* 11v FMS request id */
+#define DOT11_MNG_FMS_RESP_ID			88	/* 11v FMS response id */
+#define DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID	90	/* 11v bss max idle id */
+#define DOT11_MNG_TFS_REQUEST_ID		91	/* 11v tfs request id */
+#define DOT11_MNG_TFS_RESPONSE_ID		92	/* 11v tfs response id */
+#define DOT11_MNG_WNM_SLEEP_MODE_ID		93	/* 11v wnm-sleep mode id */
+#define DOT11_MNG_TIMBC_REQ_ID			94	/* 11v TIM broadcast request id */
+#define DOT11_MNG_TIMBC_RESP_ID			95	/* 11v TIM broadcast response id */
+#define DOT11_MNG_CHANNEL_USAGE			97	/* 11v channel usage */
+#define DOT11_MNG_TIME_ZONE_ID			98	/* 11v time zone */
+#define DOT11_MNG_DMS_REQUEST_ID		99	/* 11v dms request id */
+#define DOT11_MNG_DMS_RESPONSE_ID		100	/* 11v dms response id */
+#define DOT11_MNG_LINK_IDENTIFIER_ID		101	/* 11z TDLS Link Identifier IE */
+#define DOT11_MNG_WAKEUP_SCHEDULE_ID		102	/* 11z TDLS Wakeup Schedule IE */
+#define DOT11_MNG_CHANNEL_SWITCH_TIMING_ID	104	/* 11z TDLS Channel Switch Timing IE */
+#define DOT11_MNG_PTI_CONTROL_ID		105	/* 11z TDLS PTI Control IE */
+#define DOT11_MNG_PU_BUFFER_STATUS_ID	106	/* 11z TDLS PU Buffer Status IE */
+#define DOT11_MNG_INTERWORKING_ID		107	/* 11u interworking */
+#define DOT11_MNG_ADVERTISEMENT_ID		108	/* 11u advertisement protocol */
+#define DOT11_MNG_EXP_BW_REQ_ID			109	/* 11u expedited bandwith request */
+#define DOT11_MNG_QOS_MAP_ID			110	/* 11u QoS map set */
+#define DOT11_MNG_ROAM_CONSORT_ID		111	/* 11u roaming consortium */
+#define DOT11_MNG_EMERGCY_ALERT_ID		112	/* 11u emergency alert identifier */
+#define	DOT11_MNG_EXT_CAP_ID			127	/* d11 mgmt ext capability */
+#define	DOT11_MNG_VHT_CAP_ID			191	/* d11 mgmt VHT cap id */
+#define	DOT11_MNG_VHT_OPERATION_ID		192	/* d11 mgmt VHT op id */
+#define DOT11_MNG_WIDE_BW_CHANNEL_SWITCH_ID		194	/* Wide BW Channel Switch IE */
+#define DOT11_MNG_VHT_TRANSMIT_POWER_ENVELOPE_ID	195	/* VHT transmit Power Envelope IE */
+#define DOT11_MNG_CHANNEL_SWITCH_WRAPPER_ID		196	/* Channel Switch Wrapper IE */
+#define DOT11_MNG_AID_ID					197	/* Association ID  IE */
+#define	DOT11_MNG_OPER_MODE_NOTIF_ID	199	/* d11 mgmt VHT oper mode notif */
+
+
+#define DOT11_MNG_WPA_ID			221	/* d11 management WPA id */
+#define DOT11_MNG_PROPR_ID			221
+/* should start using this one instead of above two */
+#define DOT11_MNG_VS_ID				221	/* d11 management Vendor Specific IE */
+
+/* Rate Defines */
+
+/* Valid rates for the Supported Rates and Extended Supported Rates IEs.
+ * Encoding is the rate in 500kbps units, rouding up for fractional values.
+ * 802.11-2012, section 6.5.5.2, DATA_RATE parameter enumerates all the values.
+ * The rate values cover DSSS, HR/DSSS, ERP, and OFDM phy rates.
+ * The defines below do not cover the rates specific to 10MHz, {3, 4.5, 27},
+ * and 5MHz, {1.5, 2.25, 3, 4.5, 13.5}, which are not supported by Broadcom devices.
+ */
+
+#define DOT11_RATE_1M   2       /* 1  Mbps in 500kbps units */
+#define DOT11_RATE_2M   4       /* 2  Mbps in 500kbps units */
+#define DOT11_RATE_5M5  11      /* 5.5 Mbps in 500kbps units */
+#define DOT11_RATE_11M  22      /* 11 Mbps in 500kbps units */
+#define DOT11_RATE_6M   12      /* 6  Mbps in 500kbps units */
+#define DOT11_RATE_9M   18      /* 9  Mbps in 500kbps units */
+#define DOT11_RATE_12M  24      /* 12 Mbps in 500kbps units */
+#define DOT11_RATE_18M  36      /* 18 Mbps in 500kbps units */
+#define DOT11_RATE_24M  48      /* 24 Mbps in 500kbps units */
+#define DOT11_RATE_36M  72      /* 36 Mbps in 500kbps units */
+#define DOT11_RATE_48M  96      /* 48 Mbps in 500kbps units */
+#define DOT11_RATE_54M  108     /* 54 Mbps in 500kbps units */
+#define DOT11_RATE_MAX  108     /* highest rate (54 Mbps) in 500kbps units */
+
+/* Supported Rates and Extended Supported Rates IEs
+ * The supported rates octets are defined a the MSB indicatin a Basic Rate
+ * and bits 0-6 as the rate value
+ */
+#define DOT11_RATE_BASIC                0x80 /* flag for a Basic Rate */
+#define DOT11_RATE_MASK                 0x7F /* mask for numeric part of rate */
+
+/* BSS Membership Selector parameters
+ * 802.11-2012 and 802.11ac_D4.0 sec 8.4.2.3
+ * These selector values are advertised in Supported Rates and Extended Supported Rates IEs
+ * in the supported rates list with the Basic rate bit set.
+ * Constants below include the basic bit.
+ */
+#define DOT11_BSS_MEMBERSHIP_HT         0xFF  /* Basic 0x80 + 127, HT Required to join */
+#define DOT11_BSS_MEMBERSHIP_VHT        0xFE  /* Basic 0x80 + 126, VHT Required to join */
+
+/* ERP info element bit values */
+#define DOT11_MNG_ERP_LEN			1	/* ERP is currently 1 byte long */
+#define DOT11_MNG_NONERP_PRESENT		0x01	/* NonERP (802.11b) STAs are present
+							 *in the BSS
+							 */
+#define DOT11_MNG_USE_PROTECTION		0x02	/* Use protection mechanisms for
+							 *ERP-OFDM frames
+							 */
+#define DOT11_MNG_BARKER_PREAMBLE		0x04	/* Short Preambles: 0 == allowed,
+							 * 1 == not allowed
+							 */
+/* TS Delay element offset & size */
+#define DOT11_MGN_TS_DELAY_LEN		4	/* length of TS DELAY IE */
+#define TS_DELAY_FIELD_SIZE			4	/* TS DELAY field size */
+
+/* Capability Information Field */
+#define DOT11_CAP_ESS				0x0001	/* d11 cap. ESS */
+#define DOT11_CAP_IBSS				0x0002	/* d11 cap. IBSS */
+#define DOT11_CAP_POLLABLE			0x0004	/* d11 cap. pollable */
+#define DOT11_CAP_POLL_RQ			0x0008	/* d11 cap. poll request */
+#define DOT11_CAP_PRIVACY			0x0010	/* d11 cap. privacy */
+#define DOT11_CAP_SHORT				0x0020	/* d11 cap. short */
+#define DOT11_CAP_PBCC				0x0040	/* d11 cap. PBCC */
+#define DOT11_CAP_AGILITY			0x0080	/* d11 cap. agility */
+#define DOT11_CAP_SPECTRUM			0x0100	/* d11 cap. spectrum */
+#define DOT11_CAP_QOS				0x0200	/* d11 cap. qos */
+#define DOT11_CAP_SHORTSLOT			0x0400	/* d11 cap. shortslot */
+#define DOT11_CAP_APSD				0x0800	/* d11 cap. apsd */
+#define DOT11_CAP_RRM				0x1000	/* d11 cap. 11k radio measurement */
+#define DOT11_CAP_CCK_OFDM			0x2000	/* d11 cap. CCK/OFDM */
+#define DOT11_CAP_DELAY_BA			0x4000	/* d11 cap. delayed block ack */
+#define DOT11_CAP_IMMEDIATE_BA			0x8000	/* d11 cap. immediate block ack */
+
+/* Extended capabilities IE bitfields */
+/* 20/40 BSS Coexistence Management support bit position */
+#define DOT11_EXT_CAP_OBSS_COEX_MGMT		0
+/* Extended Channel Switching support bit position */
+#define DOT11_EXT_CAP_EXT_CHAN_SWITCHING	2
+/* scheduled PSMP support bit position */
+#define DOT11_EXT_CAP_SPSMP			6
+/*  Flexible Multicast Service */
+#define DOT11_EXT_CAP_FMS			11
+/* proxy ARP service support bit position */
+#define DOT11_EXT_CAP_PROXY_ARP			12
+/* Traffic Filter Service */
+#define DOT11_EXT_CAP_TFS			16
+/* WNM-Sleep Mode */
+#define DOT11_EXT_CAP_WNM_SLEEP			17
+/* TIM Broadcast service */
+#define DOT11_EXT_CAP_TIMBC			18
+/* BSS Transition Management support bit position */
+#define DOT11_EXT_CAP_BSSTRANS_MGMT		19
+/* Direct Multicast Service */
+#define DOT11_EXT_CAP_DMS			26
+/* Interworking support bit position */
+#define DOT11_EXT_CAP_IW			31
+/* QoS map support bit position */
+#define DOT11_EXT_CAP_QOS_MAP		32
+/* service Interval granularity bit position and mask */
+#define DOT11_EXT_CAP_SI			41
+#define DOT11_EXT_CAP_SI_MASK			0x0E
+/* WNM notification */
+#define DOT11_EXT_CAP_WNM_NOTIF			46
+/* Operating mode notification - VHT (11ac D3.0 - 8.4.2.29) */
+#define DOT11_EXT_CAP_OPER_MODE_NOTIF		62
+
+/* VHT Operating mode bit fields -  (11ac D3.0 - 8.4.1.50) */
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT 0
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_MASK 0x3
+#define DOT11_OPER_MODE_RXNSS_SHIFT 4
+#define DOT11_OPER_MODE_RXNSS_MASK 0x70
+#define DOT11_OPER_MODE_RXNSS_TYPE_SHIFT 7
+#define DOT11_OPER_MODE_RXNSS_TYPE_MASK 0x80
+
+#define DOT11_OPER_MODE(type, nss, chanw) (\
+	((type) << DOT11_OPER_MODE_RXNSS_TYPE_SHIFT &\
+		 DOT11_OPER_MODE_RXNSS_TYPE_MASK) |\
+	(((nss) - 1) << DOT11_OPER_MODE_RXNSS_SHIFT & DOT11_OPER_MODE_RXNSS_MASK) |\
+	((chanw) << DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT &\
+		 DOT11_OPER_MODE_CHANNEL_WIDTH_MASK))
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH(mode) \
+	(((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK)\
+		>> DOT11_OPER_MODE_CHANNEL_WIDTH_SHIFT)
+#define DOT11_OPER_MODE_RXNSS(mode) \
+	((((mode) & DOT11_OPER_MODE_RXNSS_MASK)		\
+		>> DOT11_OPER_MODE_RXNSS_SHIFT) + 1)
+#define DOT11_OPER_MODE_RXNSS_TYPE(mode) \
+	(((mode) & DOT11_OPER_MODE_RXNSS_TYPE_MASK)\
+		>> DOT11_OPER_MODE_RXNSS_TYPE_SHIFT)
+
+#define DOT11_OPER_MODE_20MHZ 0
+#define DOT11_OPER_MODE_40MHZ 1
+#define DOT11_OPER_MODE_80MHZ 2
+#define DOT11_OPER_MODE_160MHZ 3
+#define DOT11_OPER_MODE_8080MHZ 3
+
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_20MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_20MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_40MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_40MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_80MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_80MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_160MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_160MHZ)
+#define DOT11_OPER_MODE_CHANNEL_WIDTH_8080MHZ(mode) (\
+	((mode) & DOT11_OPER_MODE_CHANNEL_WIDTH_MASK) == DOT11_OPER_MODE_8080MHZ)
+
+/* Operating mode information element 802.11ac D3.0 - 8.4.2.168 */
+BWL_PRE_PACKED_STRUCT struct dot11_oper_mode_notif_ie {
+	uint8 mode;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_oper_mode_notif_ie dot11_oper_mode_notif_ie_t;
+
+#define DOT11_OPER_MODE_NOTIF_IE_LEN 1
+
+/* Extended Capability Information Field */
+#define DOT11_OBSS_COEX_MNG_SUPPORT	0x01	/* 20/40 BSS Coexistence Management support */
+
+/*
+ * Action Frame Constants
+ */
+#define DOT11_ACTION_HDR_LEN		2	/* action frame category + action field */
+#define DOT11_ACTION_CAT_OFF		0	/* category offset */
+#define DOT11_ACTION_ACT_OFF		1	/* action offset */
+
+/* Action Category field (sec 8.4.1.11) */
+#define DOT11_ACTION_CAT_ERR_MASK	0x80	/* category error mask */
+#define DOT11_ACTION_CAT_MASK		0x7F	/* category mask */
+#define DOT11_ACTION_CAT_SPECT_MNG	0	/* category spectrum management */
+#define DOT11_ACTION_CAT_QOS		1	/* category QoS */
+#define DOT11_ACTION_CAT_DLS		2	/* category DLS */
+#define DOT11_ACTION_CAT_BLOCKACK	3	/* category block ack */
+#define DOT11_ACTION_CAT_PUBLIC		4	/* category public */
+#define DOT11_ACTION_CAT_RRM		5	/* category radio measurements */
+#define DOT11_ACTION_CAT_FBT	6	/* category fast bss transition */
+#define DOT11_ACTION_CAT_HT		7	/* category for HT */
+#define	DOT11_ACTION_CAT_SA_QUERY	8	/* security association query */
+#define	DOT11_ACTION_CAT_PDPA		9	/* protected dual of public action */
+#define DOT11_ACTION_CAT_WNM		10	/* category for WNM */
+#define DOT11_ACTION_CAT_UWNM		11	/* category for Unprotected WNM */
+#define DOT11_ACTION_NOTIFICATION	17
+#define DOT11_ACTION_CAT_VHT		21	/* VHT action */
+#define DOT11_ACTION_CAT_VSP		126	/* protected vendor specific */
+#define DOT11_ACTION_CAT_VS		127	/* category Vendor Specific */
+
+/* Spectrum Management Action IDs (sec 7.4.1) */
+#define DOT11_SM_ACTION_M_REQ		0	/* d11 action measurement request */
+#define DOT11_SM_ACTION_M_REP		1	/* d11 action measurement response */
+#define DOT11_SM_ACTION_TPC_REQ		2	/* d11 action TPC request */
+#define DOT11_SM_ACTION_TPC_REP		3	/* d11 action TPC response */
+#define DOT11_SM_ACTION_CHANNEL_SWITCH	4	/* d11 action channel switch */
+#define DOT11_SM_ACTION_EXT_CSA		5	/* d11 extened CSA for 11n */
+
+/* QoS action ids */
+#define DOT11_QOS_ACTION_ADDTS_REQ	0	/* d11 action ADDTS request */
+#define DOT11_QOS_ACTION_ADDTS_RESP	1	/* d11 action ADDTS response */
+#define DOT11_QOS_ACTION_DELTS		2	/* d11 action DELTS */
+#define DOT11_QOS_ACTION_SCHEDULE	3	/* d11 action schedule */
+#define DOT11_QOS_ACTION_QOS_MAP	4	/* d11 action QOS map */
+
+/* HT action ids */
+#define DOT11_ACTION_ID_HT_CH_WIDTH	0	/* notify channel width action id */
+#define DOT11_ACTION_ID_HT_MIMO_PS	1	/* mimo ps action id */
+
+/* Public action ids */
+#define DOT11_PUB_ACTION_BSS_COEX_MNG	0	/* 20/40 Coexistence Management action id */
+#define DOT11_PUB_ACTION_CHANNEL_SWITCH	4	/* d11 action channel switch */
+#define DOT11_PUB_ACTION_GAS_CB_REQ	12	/* GAS Comeback Request */
+
+/* Block Ack action types */
+#define DOT11_BA_ACTION_ADDBA_REQ	0	/* ADDBA Req action frame type */
+#define DOT11_BA_ACTION_ADDBA_RESP	1	/* ADDBA Resp action frame type */
+#define DOT11_BA_ACTION_DELBA		2	/* DELBA action frame type */
+
+/* ADDBA action parameters */
+#define DOT11_ADDBA_PARAM_AMSDU_SUP	0x0001	/* AMSDU supported under BA */
+#define DOT11_ADDBA_PARAM_POLICY_MASK	0x0002	/* policy mask(ack vs delayed) */
+#define DOT11_ADDBA_PARAM_POLICY_SHIFT	1	/* policy shift */
+#define DOT11_ADDBA_PARAM_TID_MASK	0x003c	/* tid mask */
+#define DOT11_ADDBA_PARAM_TID_SHIFT	2	/* tid shift */
+#define DOT11_ADDBA_PARAM_BSIZE_MASK	0xffc0	/* buffer size mask */
+#define DOT11_ADDBA_PARAM_BSIZE_SHIFT	6	/* buffer size shift */
+
+#define DOT11_ADDBA_POLICY_DELAYED	0	/* delayed BA policy */
+#define DOT11_ADDBA_POLICY_IMMEDIATE	1	/* immediate BA policy */
+
+/* Fast Transition action types */
+#define DOT11_FT_ACTION_FT_RESERVED		0
+#define DOT11_FT_ACTION_FT_REQ			1	/* FBT request - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_RES			2	/* FBT response - for over-the-DS FBT */
+#define DOT11_FT_ACTION_FT_CON			3	/* FBT confirm - for OTDS with RRP */
+#define DOT11_FT_ACTION_FT_ACK			4	/* FBT ack */
+
+/* DLS action types */
+#define DOT11_DLS_ACTION_REQ			0	/* DLS Request */
+#define DOT11_DLS_ACTION_RESP			1	/* DLS Response */
+#define DOT11_DLS_ACTION_TD			2	/* DLS Teardown */
+
+/* Wireless Network Management (WNM) action types */
+#define DOT11_WNM_ACTION_EVENT_REQ		0
+#define DOT11_WNM_ACTION_EVENT_REP		1
+#define DOT11_WNM_ACTION_DIAG_REQ		2
+#define DOT11_WNM_ACTION_DIAG_REP		3
+#define DOT11_WNM_ACTION_LOC_CFG_REQ		4
+#define DOT11_WNM_ACTION_LOC_RFG_RESP		5
+#define DOT11_WNM_ACTION_BSSTRANS_QUERY		6
+#define DOT11_WNM_ACTION_BSSTRANS_REQ		7
+#define DOT11_WNM_ACTION_BSSTRANS_RESP		8
+#define DOT11_WNM_ACTION_FMS_REQ		9
+#define DOT11_WNM_ACTION_FMS_RESP		10
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REQ	11
+#define DOT11_WNM_ACTION_COL_INTRFRNCE_REP	12
+#define DOT11_WNM_ACTION_TFS_REQ		13
+#define DOT11_WNM_ACTION_TFS_RESP		14
+#define DOT11_WNM_ACTION_TFS_NOTIFY_REQ		15
+#define DOT11_WNM_ACTION_WNM_SLEEP_REQ		16
+#define DOT11_WNM_ACTION_WNM_SLEEP_RESP		17
+#define DOT11_WNM_ACTION_TIMBC_REQ		18
+#define DOT11_WNM_ACTION_TIMBC_RESP		19
+#define DOT11_WNM_ACTION_QOS_TRFC_CAP_UPD	20
+#define DOT11_WNM_ACTION_CHAN_USAGE_REQ		21
+#define DOT11_WNM_ACTION_CHAN_USAGE_RESP	22
+#define DOT11_WNM_ACTION_DMS_REQ		23
+#define DOT11_WNM_ACTION_DMS_RESP		24
+#define DOT11_WNM_ACTION_TMNG_MEASUR_REQ	25
+#define DOT11_WNM_ACTION_NOTFCTN_REQ		26
+#define DOT11_WNM_ACTION_NOTFCTN_RESP		27
+#define DOT11_WNM_ACTION_TFS_NOTIFY_RESP	28
+
+/* Unprotected Wireless Network Management (WNM) action types */
+#define DOT11_UWNM_ACTION_TIM			0
+#define DOT11_UWNM_ACTION_TIMING_MEASUREMENT	1
+
+#define DOT11_MNG_COUNTRY_ID_LEN 3
+
+/* VHT category action types - 802.11ac D3.0 - 8.5.23.1 */
+#define DOT11_VHT_ACTION_CBF				0	/* Compressed Beamforming */
+#define DOT11_VHT_ACTION_GID_MGMT			1	/* Group ID Management */
+#define DOT11_VHT_ACTION_OPER_MODE_NOTIF	2	/* Operating mode notif'n */
+
+/** DLS Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_req {
+	uint8 category;			/* category of action frame (2) */
+	uint8 action;				/* DLS action: req (0) */
+	struct ether_addr	da;		/* destination address */
+	struct ether_addr	sa;		/* source address */
+	uint16 cap;				/* capability */
+	uint16 timeout;			/* timeout value */
+	uint8 data[1];				/* IE:support rate, extend support rate, HT cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_req dot11_dls_req_t;
+#define DOT11_DLS_REQ_LEN 18	/* Fixed length */
+
+/** DLS response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dls_resp {
+	uint8 category;			/* category of action frame (2) */
+	uint8 action;				/* DLS action: req (0) */
+	uint16 status;				/* status code field */
+	struct ether_addr	da;		/* destination address */
+	struct ether_addr	sa;		/* source address */
+	uint8 data[1];				/* optional: capability, rate ... */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dls_resp dot11_dls_resp_t;
+#define DOT11_DLS_RESP_LEN 16	/* Fixed length */
+
+
+/* ************* 802.11v related definitions. ************* */
+
+/** BSS Management Transition Query frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_query {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* WNM action: trans_query (6) */
+	uint8 token;			/* dialog token */
+	uint8 reason;			/* transition query reason */
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_query dot11_bsstrans_query_t;
+#define DOT11_BSSTRANS_QUERY_LEN 4	/* Fixed length */
+
+/** BSS Management Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_req {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* WNM action: trans_req (7) */
+	uint8 token;			/* dialog token */
+	uint8 reqmode;			/* transition request mode */
+	uint16 disassoc_tmr;		/* disassociation timer */
+	uint8 validity_intrvl;		/* validity interval */
+	uint8 data[1];			/* optional: BSS term duration, ... */
+						/* ...session info URL, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_req dot11_bsstrans_req_t;
+#define DOT11_BSSTRANS_REQ_LEN 7	/* Fixed length */
+
+/* BSS Mgmt Transition Request Mode Field - 802.11v */
+#define DOT11_BSSTRANS_REQMODE_PREF_LIST_INCL		0x01
+#define DOT11_BSSTRANS_REQMODE_ABRIDGED			0x02
+#define DOT11_BSSTRANS_REQMODE_DISASSOC_IMMINENT	0x04
+#define DOT11_BSSTRANS_REQMODE_BSS_TERM_INCL		0x08
+#define DOT11_BSSTRANS_REQMODE_ESS_DISASSOC_IMNT	0x10
+
+/** BSS Management transition response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_bsstrans_resp {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* WNM action: trans_resp (8) */
+	uint8 token;			/* dialog token */
+	uint8 status;			/* transition status */
+	uint8 term_delay;		/* validity interval */
+	uint8 data[1];			/* optional: BSSID target, candidate list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bsstrans_resp dot11_bsstrans_resp_t;
+#define DOT11_BSSTRANS_RESP_LEN 5	/* Fixed length */
+
+/* BSS Mgmt Transition Response Status Field */
+#define DOT11_BSSTRANS_RESP_STATUS_ACCEPT			0
+#define DOT11_BSSTRANS_RESP_STATUS_REJECT			1
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_BCN		2
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_INSUFF_CAP		3
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_UNDESIRED		4
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_TERM_DELAY_REQ		5
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_BSS_LIST_PROVIDED	6
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_NO_SUITABLE_BSS		7
+#define DOT11_BSSTRANS_RESP_STATUS_REJ_LEAVING_ESS		8
+
+
+/** BSS Max Idle Period element */
+BWL_PRE_PACKED_STRUCT struct dot11_bss_max_idle_period_ie {
+	uint8 id;				/* 90, DOT11_MNG_BSS_MAX_IDLE_PERIOD_ID */
+	uint8 len;
+	uint16 max_idle_period;			/* in unit of 1000 TUs */
+	uint8 idle_opt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_bss_max_idle_period_ie dot11_bss_max_idle_period_ie_t;
+#define DOT11_BSS_MAX_IDLE_PERIOD_IE_LEN	3	/* bss max idle period IE size */
+#define DOT11_BSS_MAX_IDLE_PERIOD_OPT_PROTECTED	1	/* BSS max idle option */
+
+/** TIM Broadcast request element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req_ie {
+	uint8 id;				/* 94, DOT11_MNG_TIMBC_REQ_ID */
+	uint8 len;
+	uint8 interval;				/* in unit of beacon interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req_ie dot11_timbc_req_ie_t;
+#define DOT11_TIMBC_REQ_IE_LEN		1	/* Fixed length */
+
+/** TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: DOT11_WNM_ACTION_TIMBC_REQ(18) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* TIM broadcast request element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_req dot11_timbc_req_t;
+#define DOT11_TIMBC_REQ_LEN		3	/* Fixed length */
+
+/** TIM Broadcast response element */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp_ie {
+	uint8 id;				/* 95, DOT11_MNG_TIM_BROADCAST_RESP_ID */
+	uint8 len;
+	uint8 status;				/* status of add request */
+	uint8 interval;				/* in unit of beacon interval */
+	int32 offset;				/* in unit of ms */
+	uint16 high_rate;			/* in unit of 0.5 Mb/s */
+	uint16 low_rate;			/* in unit of 0.5 Mb/s */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp_ie dot11_timbc_resp_ie_t;
+#define DOT11_TIMBC_DENY_RESP_IE_LEN	1	/* Deny. Fixed length */
+#define DOT11_TIMBC_ACCEPT_RESP_IE_LEN	10	/* Accept. Fixed length */
+
+#define DOT11_TIMBC_STATUS_ACCEPT		0
+#define DOT11_TIMBC_STATUS_ACCEPT_TSTAMP	1
+#define DOT11_TIMBC_STATUS_DENY			2
+#define DOT11_TIMBC_STATUS_OVERRIDDEN		3
+#define DOT11_TIMBC_STATUS_RESERVED		4
+
+/** TIM Broadcast request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc_resp {
+	uint8 category;			/* category of action frame (10) */
+	uint8 action;			/* action: DOT11_WNM_ACTION_TIMBC_RESP(19) */
+	uint8 token;			/* dialog token */
+	uint8 data[1];			/* TIM broadcast response element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc_resp dot11_timbc_resp_t;
+#define DOT11_TIMBC_RESP_LEN	3	/* Fixed length */
+
+/** TIM element */
+BWL_PRE_PACKED_STRUCT struct dot11_tim_ie {
+	uint8 id;			/* 5, DOT11_MNG_TIM_ID	 */
+	uint8 len;			/* 4 - 255 */
+	uint8 dtim_count;		/* DTIM decrementing counter */
+	uint8 dtim_period;		/* DTIM period */
+	uint8 bitmap_control;		/* AID 0 + bitmap offset */
+	uint8 pvb[1];			/* Partial Virtual Bitmap, variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tim_ie dot11_tim_ie_t;
+#define DOT11_TIM_IE_FIXED_LEN	3	/* Fixed length, without id and len */
+#define DOT11_TIM_IE_FIXED_TOTAL_LEN	5	/* Fixed length, with id and len */
+
+/** TIM Broadcast frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_timbc {
+	uint8 category;			/* category of action frame (11) */
+	uint8 action;			/* action: TIM (0) */
+	uint8 check_beacon;		/* need to check-beacon */
+	uint8 tsf[8];			/* Time Synchronization Function */
+	dot11_tim_ie_t tim_ie;		/* TIM element */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timbc dot11_timbc_t;
+#define DOT11_TIMBC_HDR_LEN	(sizeof(dot11_timbc_t) - sizeof(dot11_tim_ie_t))
+#define DOT11_TIMBC_FIXED_LEN	(sizeof(dot11_timbc_t) - 1)	/* Fixed length */
+#define DOT11_TIMBC_LEN			11	/* Fixed length */
+
+/** TCLAS frame classifier type */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_hdr {
+	uint8 type;
+	uint8 mask;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_hdr dot11_tclas_fc_hdr_t;
+#define DOT11_TCLAS_FC_HDR_LEN		2	/* Fixed length */
+
+#define DOT11_TCLAS_MASK_0		0x1
+#define DOT11_TCLAS_MASK_1		0x2
+#define DOT11_TCLAS_MASK_2		0x4
+#define DOT11_TCLAS_MASK_3		0x8
+#define DOT11_TCLAS_MASK_4		0x10
+#define DOT11_TCLAS_MASK_5		0x20
+#define DOT11_TCLAS_MASK_6		0x40
+#define DOT11_TCLAS_MASK_7		0x80
+
+#define DOT11_TCLAS_FC_0_ETH		0
+#define DOT11_TCLAS_FC_1_IP		1
+#define DOT11_TCLAS_FC_2_8021Q		2
+#define DOT11_TCLAS_FC_3_OFFSET		3
+#define DOT11_TCLAS_FC_4_IP_HIGHER	4
+#define DOT11_TCLAS_FC_5_8021D		5
+
+/** TCLAS frame classifier type 0 parameters for Ethernet */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_0_eth {
+	uint8 type;
+	uint8 mask;
+	uint8 sa[ETHER_ADDR_LEN];
+	uint8 da[ETHER_ADDR_LEN];
+	uint16 eth_type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_0_eth dot11_tclas_fc_0_eth_t;
+#define DOT11_TCLAS_FC_0_ETH_LEN	16
+
+/** TCLAS frame classifier type 1 parameters for IPV4 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_1_ipv4 {
+	uint8 type;
+	uint8 mask;
+	uint8 version;
+	uint32 src_ip;
+	uint32 dst_ip;
+	uint16 src_port;
+	uint16 dst_port;
+	uint8 dscp;
+	uint8 protocol;
+	uint8 reserved;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_1_ipv4_t;
+#define DOT11_TCLAS_FC_1_IPV4_LEN	18
+
+/** TCLAS frame classifier type 2 parameters for 802.1Q */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_2_8021q {
+	uint8 type;
+	uint8 mask;
+	uint16 tci;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_2_8021q dot11_tclas_fc_2_8021q_t;
+#define DOT11_TCLAS_FC_2_8021Q_LEN	4
+
+/** TCLAS frame classifier type 3 parameters for filter offset */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_3_filter {
+	uint8 type;
+	uint8 mask;
+	uint16 offset;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_3_filter dot11_tclas_fc_3_filter_t;
+#define DOT11_TCLAS_FC_3_FILTER_LEN	4
+
+/** TCLAS frame classifier type 4 parameters for IPV4 is the same as TCLAS type 1 */
+typedef struct dot11_tclas_fc_1_ipv4 dot11_tclas_fc_4_ipv4_t;
+#define DOT11_TCLAS_FC_4_IPV4_LEN	DOT11_TCLAS_FC_1_IPV4_LEN
+
+/** TCLAS frame classifier type 4 parameters for IPV6 */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_4_ipv6 {
+	uint8 type;
+	uint8 mask;
+	uint8 version;
+	uint8 saddr[16];
+	uint8 daddr[16];
+	uint16 src_port;
+	uint16 dst_port;
+	uint8 dscp;
+	uint8 nexthdr;
+	uint8 flow_lbl[3];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_4_ipv6 dot11_tclas_fc_4_ipv6_t;
+#define DOT11_TCLAS_FC_4_IPV6_LEN	44
+
+/** TCLAS frame classifier type 5 parameters for 802.1D */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_fc_5_8021d {
+	uint8 type;
+	uint8 mask;
+	uint8 pcp;
+	uint8 cfi;
+	uint16 vid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_fc_5_8021d dot11_tclas_fc_5_8021d_t;
+#define DOT11_TCLAS_FC_5_8021D_LEN	6
+
+/** TCLAS frame classifier type parameters */
+BWL_PRE_PACKED_STRUCT union dot11_tclas_fc {
+	uint8 data[1];
+	dot11_tclas_fc_hdr_t hdr;
+	dot11_tclas_fc_0_eth_t t0_eth;
+	dot11_tclas_fc_1_ipv4_t	t1_ipv4;
+	dot11_tclas_fc_2_8021q_t t2_8021q;
+	dot11_tclas_fc_3_filter_t t3_filter;
+	dot11_tclas_fc_4_ipv4_t	t4_ipv4;
+	dot11_tclas_fc_4_ipv6_t	t4_ipv6;
+	dot11_tclas_fc_5_8021d_t t5_8021d;
+} BWL_POST_PACKED_STRUCT;
+typedef union dot11_tclas_fc dot11_tclas_fc_t;
+
+#define DOT11_TCLAS_FC_MIN_LEN		4	/* Classifier Type 2 has the min size */
+#define DOT11_TCLAS_FC_MAX_LEN		254
+
+/** TCLAS element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_ie {
+	uint8 id;				/* 14, DOT11_MNG_TCLAS_ID */
+	uint8 len;
+	uint8 user_priority;
+	dot11_tclas_fc_t fc;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_ie dot11_tclas_ie_t;
+#define DOT11_TCLAS_IE_LEN		3	/* Fixed length, include id and len */
+
+/** TCLAS processing element */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_proc_ie {
+	uint8 id;				/* 44, DOT11_MNG_TCLAS_PROC_ID */
+	uint8 len;
+	uint8 process;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_proc_ie dot11_tclas_proc_ie_t;
+#define DOT11_TCLAS_PROC_IE_LEN		3	/* Fixed length, include id and len */
+
+#define DOT11_TCLAS_PROC_MATCHALL	0	/* All high level element need to match */
+#define DOT11_TCLAS_PROC_MATCHONE	1	/* One high level element need to match */
+#define DOT11_TCLAS_PROC_NONMATCH	2	/* Non match to any high level element */
+
+
+/* TSPEC element defined in 802.11 std section 8.4.2.32 - Not supported */
+#define DOT11_TSPEC_IE_LEN		57	/* Fixed length */
+
+/** TFS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req_ie {
+	uint8 id;				/* 91, DOT11_MNG_TFS_REQUEST_ID */
+	uint8 len;
+	uint8 tfs_id;
+	uint8 actcode;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req_ie dot11_tfs_req_ie_t;
+#define DOT11_TFS_REQ_IE_LEN		2	/* Fixed length, without id and len */
+
+/** TFS request action codes (bitfield) */
+#define DOT11_TFS_ACTCODE_DELETE	1
+#define DOT11_TFS_ACTCODE_NOTIFY	2
+
+/** TFS request subelement IDs */
+#define DOT11_TFS_REQ_TFS_SE_ID		1
+#define DOT11_TFS_REQ_VENDOR_SE_ID	221
+
+/** TFS subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 data[1];				/* TCLAS element(s) + optional TCLAS proc */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_se dot11_tfs_se_t;
+
+
+/** TFS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp_ie {
+	uint8 id;				/* 92, DOT11_MNG_TFS_RESPONSE_ID */
+	uint8 len;
+	uint8 tfs_id;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp_ie dot11_tfs_resp_ie_t;
+#define DOT11_TFS_RESP_IE_LEN		1	/* Fixed length, without id and len */
+
+/** TFS response subelement IDs (same subelments, but different IDs than in TFS request */
+#define DOT11_TFS_RESP_TFS_STATUS_SE_ID		1
+#define DOT11_TFS_RESP_TFS_SE_ID		2
+#define DOT11_TFS_RESP_VENDOR_SE_ID		221
+
+/** TFS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_status_se {
+	uint8 sub_id;				/* 92, DOT11_MNG_TFS_RESPONSE_ID */
+	uint8 len;
+	uint8 resp_st;
+	uint8 data[1];				/* Potential dot11_tfs_se_t included */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_status_se dot11_tfs_status_se_t;
+#define DOT11_TFS_STATUS_SE_LEN			1	/* Fixed length, without id and len */
+
+/* Following Definition should be merged to FMS_TFS macro below */
+/* TFS Response status code. Identical to FMS Element status, without N/A  */
+#define DOT11_TFS_STATUS_ACCEPT			0
+#define DOT11_TFS_STATUS_DENY_FORMAT		1
+#define DOT11_TFS_STATUS_DENY_RESOURCE		2
+#define DOT11_TFS_STATUS_DENY_POLICY		4
+#define DOT11_TFS_STATUS_DENY_UNSPECIFIED	5
+#define DOT11_TFS_STATUS_ALTPREF_POLICY		7
+#define DOT11_TFS_STATUS_ALTPREF_TCLAS_UNSUPP	14
+
+/* FMS Element Status and TFS Response Status Definition */
+#define DOT11_FMS_TFS_STATUS_ACCEPT		0
+#define DOT11_FMS_TFS_STATUS_DENY_FORMAT	1
+#define DOT11_FMS_TFS_STATUS_DENY_RESOURCE	2
+#define DOT11_FMS_TFS_STATUS_DENY_MULTIPLE_DI	3
+#define DOT11_FMS_TFS_STATUS_DENY_POLICY	4
+#define DOT11_FMS_TFS_STATUS_DENY_UNSPECIFIED	5
+#define DOT11_FMS_TFS_STATUS_ALT_DIFF_DI	6
+#define DOT11_FMS_TFS_STATUS_ALT_POLICY		7
+#define DOT11_FMS_TFS_STATUS_ALT_CHANGE_DI	8
+#define DOT11_FMS_TFS_STATUS_ALT_MCRATE		9
+#define DOT11_FMS_TFS_STATUS_TERM_POLICY	10
+#define DOT11_FMS_TFS_STATUS_TERM_RESOURCE	11
+#define DOT11_FMS_TFS_STATUS_TERM_HIGHER_PRIO	12
+#define DOT11_FMS_TFS_STATUS_ALT_CHANGE_MDI	13
+#define DOT11_FMS_TFS_STATUS_ALT_TCLAS_UNSUPP	14
+
+/** TFS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: TFS request (13) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_req dot11_tfs_req_t;
+#define DOT11_TFS_REQ_LEN		3	/* Fixed length */
+
+/** TFS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: TFS request (14) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_resp dot11_tfs_resp_t;
+#define DOT11_TFS_RESP_LEN		3	/* Fixed length */
+
+/** TFS Management Notify frame request header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: TFS notify request (15) */
+	uint8 tfs_id_cnt;			/* TFS IDs count */
+	uint8 tfs_id[1];			/* Array of TFS IDs */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify_req dot11_tfs_notify_req_t;
+#define DOT11_TFS_NOTIFY_REQ_LEN	3	/* Fixed length */
+
+/** TFS Management Notify frame response header */
+BWL_PRE_PACKED_STRUCT struct dot11_tfs_notify_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: TFS notify response (28) */
+	uint8 tfs_id_cnt;			/* TFS IDs count */
+	uint8 tfs_id[1];			/* Array of TFS IDs */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tfs_notify_resp dot11_tfs_notify_resp_t;
+#define DOT11_TFS_NOTIFY_RESP_LEN	3	/* Fixed length */
+
+
+/** WNM-Sleep Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: wnm-sleep request (16) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_req dot11_wnm_sleep_req_t;
+#define DOT11_WNM_SLEEP_REQ_LEN		3	/* Fixed length */
+
+/** WNM-Sleep Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: wnm-sleep request (17) */
+	uint8 token;				/* dialog token */
+	uint16 key_len;				/* key data length */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_resp dot11_wnm_sleep_resp_t;
+#define DOT11_WNM_SLEEP_RESP_LEN	5	/* Fixed length */
+
+#define DOT11_WNM_SLEEP_SUBELEM_ID_GTK	0
+#define DOT11_WNM_SLEEP_SUBELEM_ID_IGTK	1
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_gtk {
+	uint8 sub_id;
+	uint8 len;
+	uint16 key_info;
+	uint8 key_length;
+	uint8 rsc[8];
+	uint8 key[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_gtk dot11_wnm_sleep_subelem_gtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_FIXED_LEN	11	/* without sub_id, len, and key */
+#define DOT11_WNM_SLEEP_SUBELEM_GTK_MAX_LEN	43	/* without sub_id and len */
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_subelem_igtk {
+	uint8 sub_id;
+	uint8 len;
+	uint16 key_id;
+	uint8 pn[6];
+	uint8 key[16];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_subelem_igtk dot11_wnm_sleep_subelem_igtk_t;
+#define DOT11_WNM_SLEEP_SUBELEM_IGTK_LEN 24	/* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_wnm_sleep_ie {
+	uint8 id;				/* 93, DOT11_MNG_WNM_SLEEP_MODE_ID */
+	uint8 len;
+	uint8 act_type;
+	uint8 resp_status;
+	uint16 interval;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_wnm_sleep_ie dot11_wnm_sleep_ie_t;
+#define DOT11_WNM_SLEEP_IE_LEN		4	/* Fixed length */
+
+#define DOT11_WNM_SLEEP_ACT_TYPE_ENTER	0
+#define DOT11_WNM_SLEEP_ACT_TYPE_EXIT	1
+
+#define DOT11_WNM_SLEEP_RESP_ACCEPT	0
+#define DOT11_WNM_SLEEP_RESP_UPDATE	1
+#define DOT11_WNM_SLEEP_RESP_DENY	2
+#define DOT11_WNM_SLEEP_RESP_DENY_TEMP	3
+#define DOT11_WNM_SLEEP_RESP_DENY_KEY	4
+#define DOT11_WNM_SLEEP_RESP_DENY_INUSE	5
+#define DOT11_WNM_SLEEP_RESP_LAST	6
+
+/** DMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: dms request (23) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req dot11_dms_req_t;
+#define DOT11_DMS_REQ_LEN		3	/* Fixed length */
+
+/** DMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: dms request (24) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp dot11_dms_resp_t;
+#define DOT11_DMS_RESP_LEN		3	/* Fixed length */
+
+/** DMS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_ie {
+	uint8 id;				/* 99, DOT11_MNG_DMS_REQUEST_ID */
+	uint8 len;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_ie dot11_dms_req_ie_t;
+#define DOT11_DMS_REQ_IE_LEN		2	/* Fixed length */
+
+/** DMS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_ie {
+	uint8 id;				/* 100, DOT11_MNG_DMS_RESPONSE_ID */
+	uint8 len;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_ie dot11_dms_resp_ie_t;
+#define DOT11_DMS_RESP_IE_LEN		2	/* Fixed length */
+
+/** DMS request descriptor */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_req_desc {
+	uint8 dms_id;
+	uint8 len;
+	uint8 type;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_req_desc dot11_dms_req_desc_t;
+#define DOT11_DMS_REQ_DESC_LEN		3	/* Fixed length */
+
+#define DOT11_DMS_REQ_TYPE_ADD		0
+#define DOT11_DMS_REQ_TYPE_REMOVE	1
+#define DOT11_DMS_REQ_TYPE_CHANGE	2
+
+/** DMS response status */
+BWL_PRE_PACKED_STRUCT struct dot11_dms_resp_st {
+	uint8 dms_id;
+	uint8 len;
+	uint8 type;
+	uint16 lsc;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_dms_resp_st dot11_dms_resp_st_t;
+#define DOT11_DMS_RESP_STATUS_LEN	5	/* Fixed length */
+
+#define DOT11_DMS_RESP_TYPE_ACCEPT	0
+#define DOT11_DMS_RESP_TYPE_DENY	1
+#define DOT11_DMS_RESP_TYPE_TERM	2
+
+#define DOT11_DMS_RESP_LSC_UNSUPPORTED	0xFFFF
+
+/** FMS Management Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_req {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: fms request (9) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_req dot11_fms_req_t;
+#define DOT11_FMS_REQ_LEN		3	/* Fixed length */
+
+/** FMS Management Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_resp {
+	uint8 category;				/* category of action frame (10) */
+	uint8 action;				/* WNM action: fms request (10) */
+	uint8 token;				/* dialog token */
+	uint8 data[1];				/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_resp dot11_fms_resp_t;
+#define DOT11_FMS_RESP_LEN		3	/* Fixed length */
+
+/** FMS Descriptor element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_desc {
+	uint8 id;
+	uint8 len;
+	uint8 num_fms_cnt;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_desc dot11_fms_desc_t;
+#define DOT11_FMS_DESC_LEN		1	/* Fixed length */
+
+#define DOT11_FMS_CNTR_MAX		0x8
+#define DOT11_FMS_CNTR_ID_MASK		0x7
+#define DOT11_FMS_CNTR_ID_SHIFT		0x0
+#define DOT11_FMS_CNTR_COUNT_MASK	0xf1
+#define DOT11_FMS_CNTR_SHIFT		0x3
+
+/** FMS request element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_req_ie {
+	uint8 id;
+	uint8 len;
+	uint8 fms_token;			/* token used to identify fms stream set */
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_req_ie dot11_fms_req_ie_t;
+#define DOT11_FMS_REQ_IE_FIX_LEN		1	/* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_rate_id_field {
+	uint8 mask;
+	uint8 mcs_idx;
+	uint16 rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rate_id_field dot11_rate_id_field_t;
+#define DOT11_RATE_ID_FIELD_MCS_SEL_MASK	0x7
+#define DOT11_RATE_ID_FIELD_MCS_SEL_OFFSET	0
+#define DOT11_RATE_ID_FIELD_RATETYPE_MASK	0x18
+#define DOT11_RATE_ID_FIELD_RATETYPE_OFFSET	3
+#define DOT11_RATE_ID_FIELD_LEN		sizeof(dot11_rate_id_field_t)
+
+/** FMS request subelements */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 interval;
+	uint8 max_interval;
+	dot11_rate_id_field_t rate;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_se dot11_fms_se_t;
+#define DOT11_FMS_REQ_SE_LEN		6	/* Fixed length */
+
+#define DOT11_FMS_REQ_SE_ID_FMS		1	/* FMS subelement */
+#define DOT11_FMS_REQ_SE_ID_VS		221	/* Vendor Specific subelement */
+
+/** FMS response element */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_resp_ie {
+	uint8 id;
+	uint8 len;
+	uint8 fms_token;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_resp_ie dot11_fms_resp_ie_t;
+#define DOT11_FMS_RESP_IE_FIX_LEN		1	/* Fixed length */
+
+/* FMS status subelements */
+#define DOT11_FMS_STATUS_SE_ID_FMS	1	/* FMS Status */
+#define DOT11_FMS_STATUS_SE_ID_TCLAS	2	/* TCLAS Status */
+#define DOT11_FMS_STATUS_SE_ID_VS	221	/* Vendor Specific subelement */
+
+/** FMS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_fms_status_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 status;
+	uint8 interval;
+	uint8 max_interval;
+	uint8 fmsid;
+	uint8 counter;
+	dot11_rate_id_field_t rate;
+	uint8 mcast_addr[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_fms_status_se dot11_fms_status_se_t;
+#define DOT11_FMS_STATUS_SE_LEN		15	/* Fixed length */
+
+/** TCLAS status subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_tclas_status_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 fmsid;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_tclas_status_se dot11_tclas_status_se_t;
+#define DOT11_TCLAS_STATUS_SE_LEN		1	/* Fixed length */
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_req {
+	uint8 category;				/* category of action frame (3) */
+	uint8 action;				/* action: addba req */
+	uint8 token;				/* identifier */
+	uint16 addba_param_set;		/* parameter set */
+	uint16 timeout;				/* timeout in seconds */
+	uint16 start_seqnum;		/* starting sequence number */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_req dot11_addba_req_t;
+#define DOT11_ADDBA_REQ_LEN		9	/* length of addba req frame */
+
+BWL_PRE_PACKED_STRUCT struct dot11_addba_resp {
+	uint8 category;				/* category of action frame (3) */
+	uint8 action;				/* action: addba resp */
+	uint8 token;				/* identifier */
+	uint16 status;				/* status of add request */
+	uint16 addba_param_set;			/* negotiated parameter set */
+	uint16 timeout;				/* negotiated timeout in seconds */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_addba_resp dot11_addba_resp_t;
+#define DOT11_ADDBA_RESP_LEN		9	/* length of addba resp frame */
+
+/* DELBA action parameters */
+#define DOT11_DELBA_PARAM_INIT_MASK	0x0800	/* initiator mask */
+#define DOT11_DELBA_PARAM_INIT_SHIFT	11	/* initiator shift */
+#define DOT11_DELBA_PARAM_TID_MASK	0xf000	/* tid mask */
+#define DOT11_DELBA_PARAM_TID_SHIFT	12	/* tid shift */
+
+BWL_PRE_PACKED_STRUCT struct dot11_delba {
+	uint8 category;				/* category of action frame (3) */
+	uint8 action;				/* action: addba req */
+	uint16 delba_param_set;			/* paarmeter set */
+	uint16 reason;				/* reason for dellba */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_delba dot11_delba_t;
+#define DOT11_DELBA_LEN			6	/* length of delba frame */
+
+/* SA Query action field value */
+#define SA_QUERY_REQUEST		0
+#define SA_QUERY_RESPONSE		1
+
+/* ************* 802.11r related definitions. ************* */
+
+/** Over-the-DS Fast Transition Request frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_req {
+	uint8 category;			/* category of action frame (6) */
+	uint8 action;			/* action: ft req */
+	uint8 sta_addr[ETHER_ADDR_LEN];
+	uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_req dot11_ft_req_t;
+#define DOT11_FT_REQ_FIXED_LEN 14
+
+/** Over-the-DS Fast Transition Response frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_res {
+	uint8 category;			/* category of action frame (6) */
+	uint8 action;			/* action: ft resp */
+	uint8 sta_addr[ETHER_ADDR_LEN];
+	uint8 tgt_ap_addr[ETHER_ADDR_LEN];
+	uint16 status;			/* status code */
+	uint8 data[1];			/* Elements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_res dot11_ft_res_t;
+#define DOT11_FT_RES_FIXED_LEN 16
+
+/** RDE RIC Data Element. */
+BWL_PRE_PACKED_STRUCT struct dot11_rde_ie {
+	uint8 id;			/* 11r, DOT11_MNG_RDE_ID */
+	uint8 length;
+	uint8 rde_id;			/* RDE identifier. */
+	uint8 rd_count;			/* Resource Descriptor Count. */
+	uint16 status;			/* Status Code. */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rde_ie dot11_rde_ie_t;
+
+/* 11r - Size of the RDE (RIC Data Element) IE, including TLV header. */
+#define DOT11_MNG_RDE_IE_LEN sizeof(dot11_rde_ie_t)
+
+
+/* ************* 802.11k related definitions. ************* */
+
+/* Radio measurements enabled capability ie */
+#define DOT11_RRM_CAP_LEN		5	/* length of rrm cap bitmap */
+#define RCPI_IE_LEN 1
+#define RSNI_IE_LEN 1
+BWL_PRE_PACKED_STRUCT struct dot11_rrm_cap_ie {
+	uint8 cap[DOT11_RRM_CAP_LEN];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rrm_cap_ie dot11_rrm_cap_ie_t;
+
+/* Bitmap definitions for cap ie */
+#define DOT11_RRM_CAP_LINK		0
+#define DOT11_RRM_CAP_NEIGHBOR_REPORT	1
+#define DOT11_RRM_CAP_PARALLEL		2
+#define DOT11_RRM_CAP_REPEATED		3
+#define DOT11_RRM_CAP_BCN_PASSIVE	4
+#define DOT11_RRM_CAP_BCN_ACTIVE	5
+#define DOT11_RRM_CAP_BCN_TABLE		6
+#define DOT11_RRM_CAP_BCN_REP_COND	7
+#define DOT11_RRM_CAP_FM		8
+#define DOT11_RRM_CAP_CLM		9
+#define DOT11_RRM_CAP_NHM		10
+#define DOT11_RRM_CAP_SM		11
+#define DOT11_RRM_CAP_LCIM		12
+#define DOT11_RRM_CAP_LCIA		13
+#define DOT11_RRM_CAP_TSCM		14
+#define DOT11_RRM_CAP_TTSCM		15
+#define DOT11_RRM_CAP_AP_CHANREP	16
+#define DOT11_RRM_CAP_RMMIB		17
+/* bit18-bit26, not used for RRM_IOVAR */
+#define DOT11_RRM_CAP_MPTI		27
+#define DOT11_RRM_CAP_NBRTSFO		28
+#define DOT11_RRM_CAP_RCPI		29
+#define DOT11_RRM_CAP_RSNI		30
+#define DOT11_RRM_CAP_BSSAAD		31
+#define DOT11_RRM_CAP_BSSAAC		32
+#define DOT11_RRM_CAP_AI		33
+
+/* Operating Class (formerly "Regulatory Class") definitions */
+#define DOT11_OP_CLASS_NONE			255
+
+BWL_PRE_PACKED_STRUCT struct do11_ap_chrep {
+	uint8 id;
+	uint8 len;
+	uint8 reg;
+	uint8 chanlist[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct do11_ap_chrep dot11_ap_chrep_t;
+
+/* Radio Measurements action ids */
+#define DOT11_RM_ACTION_RM_REQ		0	/* Radio measurement request */
+#define DOT11_RM_ACTION_RM_REP		1	/* Radio measurement report */
+#define DOT11_RM_ACTION_LM_REQ		2	/* Link measurement request */
+#define DOT11_RM_ACTION_LM_REP		3	/* Link measurement report */
+#define DOT11_RM_ACTION_NR_REQ		4	/* Neighbor report request */
+#define DOT11_RM_ACTION_NR_REP		5	/* Neighbor report response */
+
+/** Generic radio measurement action frame header */
+BWL_PRE_PACKED_STRUCT struct dot11_rm_action {
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_action dot11_rm_action_t;
+#define DOT11_RM_ACTION_LEN 3
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq {
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	uint16 reps;				/* no. of repetitions */
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq dot11_rmreq_t;
+#define DOT11_RMREQ_LEN	5
+
+BWL_PRE_PACKED_STRUCT struct dot11_rm_ie {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rm_ie dot11_rm_ie_t;
+#define DOT11_RM_IE_LEN	5
+
+/* Definitions for "mode" bits in rm req */
+#define DOT11_RMREQ_MODE_PARALLEL	1
+#define DOT11_RMREQ_MODE_ENABLE		2
+#define DOT11_RMREQ_MODE_REQUEST	4
+#define DOT11_RMREQ_MODE_REPORT		8
+#define DOT11_RMREQ_MODE_DURMAND	0x10	/* Duration Mandatory */
+
+/* Definitions for "mode" bits in rm rep */
+#define DOT11_RMREP_MODE_LATE		1
+#define DOT11_RMREP_MODE_INCAPABLE	2
+#define DOT11_RMREP_MODE_REFUSED	4
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_bcn {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 reg;
+	uint8 channel;
+	uint16 interval;
+	uint16 duration;
+	uint8 bcn_mode;
+	struct ether_addr	bssid;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_bcn dot11_rmreq_bcn_t;
+#define DOT11_RMREQ_BCN_LEN	18
+
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_bcn {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+	uint8 frame_info;
+	uint8 rcpi;
+	uint8 rsni;
+	struct ether_addr	bssid;
+	uint8 antenna_id;
+	uint32 parent_tsf;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_bcn dot11_rmrep_bcn_t;
+#define DOT11_RMREP_BCN_LEN	26
+
+/* Beacon request measurement mode */
+#define DOT11_RMREQ_BCN_PASSIVE	0
+#define DOT11_RMREQ_BCN_ACTIVE	1
+#define DOT11_RMREQ_BCN_TABLE	2
+
+/* Sub-element IDs for Beacon Request */
+#define DOT11_RMREQ_BCN_SSID_ID 0
+#define DOT11_RMREQ_BCN_REPINFO_ID  1
+#define DOT11_RMREQ_BCN_REPDET_ID   2
+#define DOT11_RMREQ_BCN_REQUEST_ID  10
+#define DOT11_RMREQ_BCN_APCHREP_ID  DOT11_MNG_AP_CHREP_ID
+
+/* Reporting Detail element definition */
+#define DOT11_RMREQ_BCN_REPDET_FIXED	0	/* Fixed length fields only */
+#define DOT11_RMREQ_BCN_REPDET_REQUEST	1	/* + requested information elems */
+#define DOT11_RMREQ_BCN_REPDET_ALL	2	/* All fields */
+
+/* Sub-element IDs for Beacon Report */
+#define DOT11_RMREP_BCN_FRM_BODY	1
+
+/* Sub-element IDs for Frame Report */
+#define DOT11_RMREP_FRAME_COUNT_REPORT 1
+
+/** Channel load request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_chanload {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 reg;
+	uint8 channel;
+	uint16 interval;
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_chanload dot11_rmreq_chanload_t;
+#define DOT11_RMREQ_CHANLOAD_LEN	11
+
+/** Channel load report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_chanload {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+	uint8 channel_load;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_chanload dot11_rmrep_chanload_t;
+#define DOT11_RMREP_CHANLOAD_LEN	13
+
+/** Noise histogram request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_noise {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 reg;
+	uint8 channel;
+	uint16 interval;
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_noise dot11_rmreq_noise_t;
+#define DOT11_RMREQ_NOISE_LEN 11
+
+/** Noise histogram report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_noise {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+	uint8 antid;
+	uint8 anpi;
+	uint8 ipi0_dens;
+	uint8 ipi1_dens;
+	uint8 ipi2_dens;
+	uint8 ipi3_dens;
+	uint8 ipi4_dens;
+	uint8 ipi5_dens;
+	uint8 ipi6_dens;
+	uint8 ipi7_dens;
+	uint8 ipi8_dens;
+	uint8 ipi9_dens;
+	uint8 ipi10_dens;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_noise dot11_rmrep_noise_t;
+#define DOT11_RMREP_NOISE_LEN 25
+
+/** Frame request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_frame {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint8 reg;
+	uint8 channel;
+	uint16 interval;
+	uint16 duration;
+	uint8 req_type;
+	struct ether_addr	ta;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_frame dot11_rmreq_frame_t;
+#define DOT11_RMREQ_FRAME_LEN 18
+
+/** Frame report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frame {
+	uint8 reg;
+	uint8 channel;
+	uint32 starttime[2];
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frame dot11_rmrep_frame_t;
+#define DOT11_RMREP_FRAME_LEN 12
+
+/** Frame report entry */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_frmentry {
+	struct ether_addr	ta;
+	struct ether_addr	bssid;
+	uint8 phy_type;
+	uint8 avg_rcpi;
+	uint8 last_rsni;
+	uint8 last_rcpi;
+	uint8 ant_id;
+	uint16 frame_cnt;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_frmentry dot11_rmrep_frmentry_t;
+#define DOT11_RMREP_FRMENTRY_LEN 19
+
+/** STA statistics request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_stat {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	struct ether_addr	peer;
+	uint16 interval;
+	uint16 duration;
+	uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_stat dot11_rmreq_stat_t;
+#define DOT11_RMREQ_STAT_LEN 16
+
+/** STA statistics report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_stat {
+	uint16 duration;
+	uint8 group_id;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_stat dot11_rmrep_stat_t;
+
+/** Transmit stream/category measurement request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_tx_stream {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint16 interval;
+	uint16 duration;
+	struct ether_addr	peer;
+	uint8 traffic_id;
+	uint8 bin0_range;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_tx_stream dot11_rmreq_tx_stream_t;
+
+/** Transmit stream/category measurement report */
+BWL_PRE_PACKED_STRUCT struct dot11_rmrep_tx_stream {
+	uint32 starttime[2];
+	uint16 duration;
+	struct ether_addr	peer;
+	uint8 traffic_id;
+	uint8 reason;
+	uint32 txmsdu_cnt;
+	uint32 msdu_discarded_cnt;
+	uint32 msdufailed_cnt;
+	uint32 msduretry_cnt;
+	uint32 cfpolls_lost_cnt;
+	uint32 avrqueue_delay;
+	uint32 avrtx_delay;
+	uint8 bin0_range;
+	uint32 bin0;
+	uint32 bin1;
+	uint32 bin2;
+	uint32 bin3;
+	uint32 bin4;
+	uint32 bin5;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmrep_tx_stream dot11_rmrep_tx_stream_t;
+
+/** Measurement pause request */
+BWL_PRE_PACKED_STRUCT struct dot11_rmreq_pause_time {
+	uint8 id;
+	uint8 len;
+	uint8 token;
+	uint8 mode;
+	uint8 type;
+	uint16 pause_time;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_rmreq_pause_time dot11_rmreq_pause_time_t;
+
+
+/* Neighbor Report subelements ID (11k & 11v) */
+#define DOT11_NGBR_TSF_INFO_SE_ID	1
+#define DOT11_NGBR_CCS_SE_ID		2
+#define DOT11_NGBR_BSSTRANS_PREF_SE_ID	3
+#define DOT11_NGBR_BSS_TERM_DUR_SE_ID	4
+#define DOT11_NGBR_BEARING_SE_ID	5
+
+/** Neighbor Report, BSS Transition Candidate Preference subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bsstrans_pref_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 preference;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bsstrans_pref_se dot11_ngbr_bsstrans_pref_se_t;
+#define DOT11_NGBR_BSSTRANS_PREF_SE_LEN	1
+
+/** Neighbor Report, BSS Termination Duration subelement */
+BWL_PRE_PACKED_STRUCT struct dot11_ngbr_bss_term_dur_se {
+	uint8 sub_id;
+	uint8 len;
+	uint8 tsf[8];
+	uint16 duration;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ngbr_bss_term_dur_se dot11_ngbr_bss_term_dur_se_t;
+#define DOT11_NGBR_BSS_TERM_DUR_SE_LEN	10
+
+/* Neighbor Report BSSID Information Field */
+#define DOT11_NGBR_BI_REACHABILTY_UNKN	0x0002
+#define DOT11_NGBR_BI_REACHABILTY	0x0003
+#define DOT11_NGBR_BI_SEC		0x0004
+#define DOT11_NGBR_BI_KEY_SCOPE		0x0008
+#define DOT11_NGBR_BI_CAP		0x03f0
+#define DOT11_NGBR_BI_CAP_SPEC_MGMT	0x0010
+#define DOT11_NGBR_BI_CAP_QOS		0x0020
+#define DOT11_NGBR_BI_CAP_APSD		0x0040
+#define DOT11_NGBR_BI_CAP_RDIO_MSMT	0x0080
+#define DOT11_NGBR_BI_CAP_DEL_BA	0x0100
+#define DOT11_NGBR_BI_CAP_IMM_BA	0x0200
+#define DOT11_NGBR_BI_MOBILITY		0x0400
+#define DOT11_NGBR_BI_HT		0x0800
+
+/** Neighbor Report element (11k & 11v) */
+BWL_PRE_PACKED_STRUCT struct dot11_neighbor_rep_ie {
+	uint8 id;
+	uint8 len;
+	struct ether_addr bssid;
+	uint32 bssid_info;
+	uint8 reg;		/* Operating class */
+	uint8 channel;
+	uint8 phytype;
+	uint8 data[1]; 		/* Variable size subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_neighbor_rep_ie dot11_neighbor_rep_ie_t;
+#define DOT11_NEIGHBOR_REP_IE_FIXED_LEN	13
+
+
+/* MLME Enumerations */
+#define DOT11_BSSTYPE_INFRASTRUCTURE		0	/* d11 infrastructure */
+#define DOT11_BSSTYPE_INDEPENDENT		1	/* d11 independent */
+#define DOT11_BSSTYPE_ANY			2	/* d11 any BSS type */
+#define DOT11_SCANTYPE_ACTIVE			0	/* d11 scan active */
+#define DOT11_SCANTYPE_PASSIVE			1	/* d11 scan passive */
+
+/** Link Measurement */
+BWL_PRE_PACKED_STRUCT struct dot11_lmreq {
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	uint8 txpwr;				/* Transmit Power Used */
+	uint8 maxtxpwr;				/* Max Transmit Power */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmreq dot11_lmreq_t;
+#define DOT11_LMREQ_LEN	5
+
+BWL_PRE_PACKED_STRUCT struct dot11_lmrep {
+	uint8 category;				/* category of action frame (5) */
+	uint8 action;				/* radio measurement action */
+	uint8 token;				/* dialog token */
+	dot11_tpc_rep_t tpc;			/* TPC element */
+	uint8 rxant;				/* Receive Antenna ID */
+	uint8 txant;				/* Transmit Antenna ID */
+	uint8 rcpi;				/* RCPI */
+	uint8 rsni;				/* RSNI */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_lmrep dot11_lmrep_t;
+#define DOT11_LMREP_LEN	11
+
+/* 802.11 BRCM "Compromise" Pre N constants */
+#define PREN_PREAMBLE		24	/* green field preamble time */
+#define PREN_MM_EXT		12	/* extra mixed mode preamble time */
+#define PREN_PREAMBLE_EXT	4	/* extra preamble (multiply by unique_streams-1) */
+
+/* 802.11N PHY constants */
+#define RIFS_11N_TIME		2	/* NPHY RIFS time */
+
+/* 802.11 HT PLCP format 802.11n-2009, sec 20.3.9.4.3
+ * HT-SIG is composed of two 24 bit parts, HT-SIG1 and HT-SIG2
+ */
+/* HT-SIG1 */
+#define HT_SIG1_MCS_MASK        0x00007F
+#define HT_SIG1_CBW             0x000080
+#define HT_SIG1_HT_LENGTH       0xFFFF00
+
+/* HT-SIG2 */
+#define HT_SIG2_SMOOTHING       0x000001
+#define HT_SIG2_NOT_SOUNDING    0x000002
+#define HT_SIG2_RESERVED        0x000004
+#define HT_SIG2_AGGREGATION     0x000008
+#define HT_SIG2_STBC_MASK       0x000030
+#define HT_SIG2_STBC_SHIFT      4
+#define HT_SIG2_FEC_CODING      0x000040
+#define HT_SIG2_SHORT_GI        0x000080
+#define HT_SIG2_ESS_MASK        0x000300
+#define HT_SIG2_ESS_SHIFT       8
+#define HT_SIG2_CRC             0x03FC00
+#define HT_SIG2_TAIL            0x1C0000
+
+/* HT Timing-related parameters (802.11-2012, sec 20.3.6) */
+#define HT_T_LEG_PREAMBLE      16
+#define HT_T_L_SIG              4
+#define HT_T_SIG                8
+#define HT_T_LTF1               4
+#define HT_T_GF_LTF1            8
+#define HT_T_LTFs               4
+#define HT_T_STF                4
+#define HT_T_GF_STF             8
+#define HT_T_SYML               4
+
+#define HT_N_SERVICE           16       /* bits in SERVICE field */
+#define HT_N_TAIL               6       /* tail bits per BCC encoder */
+
+/* 802.11 A PHY constants */
+#define APHY_SLOT_TIME          9       /* APHY slot time */
+#define APHY_SIFS_TIME          16      /* APHY SIFS time */
+#define APHY_DIFS_TIME          (APHY_SIFS_TIME + (2 * APHY_SLOT_TIME))  /* APHY DIFS time */
+#define APHY_PREAMBLE_TIME      16      /* APHY preamble time */
+#define APHY_SIGNAL_TIME        4       /* APHY signal time */
+#define APHY_SYMBOL_TIME        4       /* APHY symbol time */
+#define APHY_SERVICE_NBITS      16      /* APHY service nbits */
+#define APHY_TAIL_NBITS         6       /* APHY tail nbits */
+#define APHY_CWMIN              15      /* APHY cwmin */
+
+/* 802.11 B PHY constants */
+#define BPHY_SLOT_TIME          20      /* BPHY slot time */
+#define BPHY_SIFS_TIME          10      /* BPHY SIFS time */
+#define BPHY_DIFS_TIME          50      /* BPHY DIFS time */
+#define BPHY_PLCP_TIME          192     /* BPHY PLCP time */
+#define BPHY_PLCP_SHORT_TIME    96      /* BPHY PLCP short time */
+#define BPHY_CWMIN              31      /* BPHY cwmin */
+
+/* 802.11 G constants */
+#define DOT11_OFDM_SIGNAL_EXTENSION	6	/* d11 OFDM signal extension */
+
+#define PHY_CWMAX		1023	/* PHY cwmax */
+
+#define	DOT11_MAXNUMFRAGS	16	/* max # fragments per MSDU */
+
+/* 802.11 VHT constants */
+
+typedef int vht_group_id_t;
+
+/* for VHT-A1 */
+/* SIG-A1 reserved bits */
+#define VHT_SIGA1_CONST_MASK            0x800004
+
+#define VHT_SIGA1_BW_MASK               0x000003
+#define VHT_SIGA1_20MHZ_VAL             0x000000
+#define VHT_SIGA1_40MHZ_VAL             0x000001
+#define VHT_SIGA1_80MHZ_VAL             0x000002
+#define VHT_SIGA1_160MHZ_VAL            0x000003
+
+#define VHT_SIGA1_STBC                  0x000008
+
+#define VHT_SIGA1_GID_MASK              0x0003f0
+#define VHT_SIGA1_GID_SHIFT             4
+#define VHT_SIGA1_GID_TO_AP             0x00
+#define VHT_SIGA1_GID_NOT_TO_AP         0x3f
+#define VHT_SIGA1_GID_MAX_GID           0x3f
+
+#define VHT_SIGA1_NSTS_SHIFT_MASK_USER0 0x001C00
+#define VHT_SIGA1_NSTS_SHIFT            10
+
+#define VHT_SIGA1_PARTIAL_AID_MASK      0x3fe000
+#define VHT_SIGA1_PARTIAL_AID_SHIFT     13
+
+#define VHT_SIGA1_TXOP_PS_NOT_ALLOWED   0x400000
+
+/* for VHT-A2 */
+#define VHT_SIGA2_GI_NONE               0x000000
+#define VHT_SIGA2_GI_SHORT              0x000001
+#define VHT_SIGA2_GI_W_MOD10            0x000002
+#define VHT_SIGA2_CODING_LDPC           0x000004
+#define VHT_SIGA2_LDPC_EXTRA_OFDM_SYM   0x000008
+#define VHT_SIGA2_BEAMFORM_ENABLE       0x000100
+#define VHT_SIGA2_MCS_SHIFT             4
+
+#define VHT_SIGA2_B9_RESERVED           0x000200
+#define VHT_SIGA2_TAIL_MASK             0xfc0000
+#define VHT_SIGA2_TAIL_VALUE            0x000000
+
+/* VHT Timing-related parameters (802.11ac D4.0, sec 22.3.6) */
+#define VHT_T_LEG_PREAMBLE      16
+#define VHT_T_L_SIG              4
+#define VHT_T_SIG_A              8
+#define VHT_T_LTF                4
+#define VHT_T_STF                4
+#define VHT_T_SIG_B              4
+#define VHT_T_SYML               4
+
+#define VHT_N_SERVICE           16	/* bits in SERVICE field */
+#define VHT_N_TAIL               6	/* tail bits per BCC encoder */
+
+
+/** dot11Counters Table - 802.11 spec., Annex D */
+typedef struct d11cnt {
+	uint32		txfrag;		/* dot11TransmittedFragmentCount */
+	uint32		txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32		txfail;		/* dot11FailedCount */
+	uint32		txretry;	/* dot11RetryCount */
+	uint32		txretrie;	/* dot11MultipleRetryCount */
+	uint32		rxdup;		/* dot11FrameduplicateCount */
+	uint32		txrts;		/* dot11RTSSuccessCount */
+	uint32		txnocts;	/* dot11RTSFailureCount */
+	uint32		txnoack;	/* dot11ACKFailureCount */
+	uint32		rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32		rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32		rxcrc;		/* dot11FCSErrorCount */
+	uint32		txfrmsnt;	/* dot11TransmittedFrameCount */
+	uint32		rxundec;	/* dot11WEPUndecryptableCount */
+} d11cnt_t;
+
+#define BRCM_PROP_OUI		"\x00\x90\x4C"
+
+
+/* Action frame type for RWL */
+#define RWL_WIFI_DEFAULT		0
+#define RWL_WIFI_FIND_MY_PEER		9 /* Used while finding server */
+#define RWL_WIFI_FOUND_PEER		10 /* Server response to the client  */
+#define RWL_ACTION_WIFI_FRAG_TYPE	85 /* Fragment indicator for receiver */
+
+#define PROXD_AF_TYPE			11 /* Wifi proximity action frame type */
+#define BRCM_RELMACST_AF_TYPE	        12 /* RMC action frame type */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/*
+ * This BRCM_PROP_OUI types is intended for use in events to embed additional
+ * data, and would not be expected to appear on the air -- but having an IE
+ * format allows IE frame data with extra data in events in that allows for
+ * more flexible parsing.
+ */
+#define BRCM_EVT_WL_BSS_INFO	64
+
+/**
+ * Following is the generic structure for brcm_prop_ie (uses BRCM_PROP_OUI).
+ * DPT uses this format with type set to DPT_IE_TYPE
+ */
+BWL_PRE_PACKED_STRUCT struct brcm_prop_ie_s {
+	uint8 id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8 len;		/* IE length */
+	uint8 oui[3];
+	uint8 type;		/* type of this IE */
+	uint16 cap;		/* DPT capabilities */
+} BWL_POST_PACKED_STRUCT;
+typedef struct brcm_prop_ie_s brcm_prop_ie_t;
+
+#define BRCM_PROP_IE_LEN	6	/* len of fixed part of brcm_prop ie */
+
+#define DPT_IE_TYPE             2
+
+
+#define BRCM_SYSCAP_IE_TYPE	3
+#define WET_TUNNEL_IE_TYPE	3
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* brcm syscap_ie cap */
+#define BRCM_SYSCAP_WET_TUNNEL	0x0100	/* Device with WET_TUNNEL support */
+
+#define BRCM_OUI		"\x00\x10\x18"	/* Broadcom OUI */
+
+/** BRCM info element */
+BWL_PRE_PACKED_STRUCT struct brcm_ie {
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];
+	uint8	ver;		/* type/ver of this IE */
+	uint8	assoc;		/* # of assoc STAs */
+	uint8	flags;		/* misc flags */
+	uint8	flags1;		/* misc flags */
+	uint16	amsdu_mtu_pref;	/* preferred A-MSDU MTU */
+} BWL_POST_PACKED_STRUCT;
+typedef	struct brcm_ie brcm_ie_t;
+#define BRCM_IE_LEN		11	/* BRCM IE length */
+#define BRCM_IE_VER		2	/* BRCM IE version */
+#define BRCM_IE_LEGACY_AES_VER	1	/* BRCM IE legacy AES version */
+
+/* brcm_ie flags */
+#define	BRF_ABCAP		0x1	/* afterburner is obsolete,  defined for backward compat */
+#define	BRF_ABRQRD		0x2	/* afterburner is obsolete,  defined for backward compat */
+#define	BRF_LZWDS		0x4	/* lazy wds enabled */
+#define	BRF_BLOCKACK		0x8	/* BlockACK capable */
+#define BRF_ABCOUNTER_MASK	0xf0	/* afterburner is obsolete,  defined for backward compat */
+#define BRF_PROP_11N_MCS	0x10	/* re-use afterburner bit */
+
+#define GET_BRF_PROP_11N_MCS(brcm_ie) \
+	(!((brcm_ie)->flags & BRF_ABCAP) && ((brcm_ie)->flags & BRF_PROP_11N_MCS))
+
+/* brcm_ie flags1 */
+#define	BRF1_AMSDU		0x1	/* A-MSDU capable */
+#define BRF1_WMEPS		0x4	/* AP is capable of handling WME + PS w/o APSD */
+#define BRF1_PSOFIX		0x8	/* AP has fixed PS mode out-of-order packets */
+#define	BRF1_RX_LARGE_AGG	0x10	/* device can rx large aggregates */
+#define BRF1_RFAWARE_DCS	0x20    /* RFAWARE dynamic channel selection (DCS) */
+#define BRF1_SOFTAP		0x40    /* Configure as Broadcom SOFTAP */
+#define BRF1_DWDS		0x80    /* DWDS capable */
+
+/** Vendor IE structure */
+BWL_PRE_PACKED_STRUCT struct vndr_ie {
+	uchar id;
+	uchar len;
+	uchar oui [3];
+	uchar data [1]; 	/* Variable size data */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vndr_ie vndr_ie_t;
+
+#define VNDR_IE_HDR_LEN		2	/* id + len field */
+#define VNDR_IE_MIN_LEN		3	/* size of the oui field */
+#define VNDR_IE_FIXED_LEN	(VNDR_IE_HDR_LEN + VNDR_IE_MIN_LEN)
+
+#define VNDR_IE_MAX_LEN		255	/* vendor IE max length, without ID and len */
+
+/** BRCM PROP DEVICE PRIMARY MAC ADDRESS IE */
+BWL_PRE_PACKED_STRUCT struct member_of_brcm_prop_ie {
+	uchar id;
+	uchar len;
+	uchar oui[3];
+	uint8	type;           /* type indicates what follows */
+	struct ether_addr ea;   /* Device Primary MAC Adrress */
+} BWL_POST_PACKED_STRUCT;
+typedef struct member_of_brcm_prop_ie member_of_brcm_prop_ie_t;
+
+#define MEMBER_OF_BRCM_PROP_IE_LEN		10	/* IE max length */
+#define MEMBER_OF_BRCM_PROP_IE_HDRLEN	        (sizeof(member_of_brcm_prop_ie_t))
+#define MEMBER_OF_BRCM_PROP_IE_TYPE		54
+
+/** BRCM Reliable Multicast IE */
+BWL_PRE_PACKED_STRUCT struct relmcast_brcm_prop_ie {
+	uint8 id;
+	uint8 len;
+	uint8 oui[3];
+	uint8 type;           /* type indicates what follows */
+	struct ether_addr ea;   /* The ack sender's MAC Adrress */
+	struct ether_addr mcast_ea;  /* The multicast MAC address */
+	uint8 updtmo; /* time interval(second) for client to send null packet to report its rssi */
+} BWL_POST_PACKED_STRUCT;
+typedef struct relmcast_brcm_prop_ie relmcast_brcm_prop_ie_t;
+
+/* IE length */
+/* BRCM_PROP_IE_LEN = sizeof(relmcast_brcm_prop_ie_t)-((sizeof (id) + sizeof (len)))? */
+#define RELMCAST_BRCM_PROP_IE_LEN	(sizeof(relmcast_brcm_prop_ie_t)-(2*sizeof(uint8)))
+
+#define RELMCAST_BRCM_PROP_IE_TYPE	55
+
+/* ************* HT definitions. ************* */
+#define MCSSET_LEN	16	/* 16-bits per 8-bit set to give 128-bits bitmap of MCS Index */
+#define MAX_MCS_NUM	(128)	/* max mcs number = 128 */
+
+BWL_PRE_PACKED_STRUCT struct ht_cap_ie {
+	uint16	cap;
+	uint8	params;
+	uint8	supp_mcs[MCSSET_LEN];
+	uint16	ext_htcap;
+	uint32	txbf_cap;
+	uint8	as_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_cap_ie ht_cap_ie_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_ht_cap_ie {
+	uint8	id;
+	uint8	len;
+	ht_cap_ie_t ht_cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ht_cap_ie dot11_ht_cap_ie_t;
+
+/* CAP IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the capability IE is primarily used to convey this nodes abilities */
+BWL_PRE_PACKED_STRUCT struct ht_prop_cap_ie {
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];
+	uint8	type;           /* type indicates what follows */
+	ht_cap_ie_t cap_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_cap_ie ht_prop_cap_ie_t;
+
+#define HT_PROP_IE_OVERHEAD	4	/* overhead bytes for prop oui ie */
+#define HT_CAP_IE_LEN		26	/* HT capability len (based on .11n d2.0) */
+#define HT_CAP_IE_TYPE		51
+
+#define HT_CAP_LDPC_CODING	0x0001	/* Support for rx of LDPC coded pkts */
+#define HT_CAP_40MHZ		0x0002  /* FALSE:20Mhz, TRUE:20/40MHZ supported */
+#define HT_CAP_MIMO_PS_MASK	0x000C  /* Mimo PS mask */
+#define HT_CAP_MIMO_PS_SHIFT	0x0002	/* Mimo PS shift */
+#define HT_CAP_MIMO_PS_OFF	0x0003	/* Mimo PS, no restriction */
+#define HT_CAP_MIMO_PS_RTS	0x0001	/* Mimo PS, send RTS/CTS around MIMO frames */
+#define HT_CAP_MIMO_PS_ON	0x0000	/* Mimo PS, MIMO disallowed */
+#define HT_CAP_GF		0x0010	/* Greenfield preamble support */
+#define HT_CAP_SHORT_GI_20	0x0020	/* 20MHZ short guard interval support */
+#define HT_CAP_SHORT_GI_40	0x0040	/* 40Mhz short guard interval support */
+#define HT_CAP_TX_STBC		0x0080	/* Tx STBC support */
+#define HT_CAP_RX_STBC_MASK	0x0300	/* Rx STBC mask */
+#define HT_CAP_RX_STBC_SHIFT	8	/* Rx STBC shift */
+#define HT_CAP_DELAYED_BA	0x0400	/* delayed BA support */
+#define HT_CAP_MAX_AMSDU	0x0800	/* Max AMSDU size in bytes , 0=3839, 1=7935 */
+
+#define HT_CAP_DSSS_CCK	0x1000	/* DSSS/CCK supported by the BSS */
+#define HT_CAP_PSMP		0x2000	/* Power Save Multi Poll support */
+#define HT_CAP_40MHZ_INTOLERANT 0x4000	/* 40MHz Intolerant */
+#define HT_CAP_LSIG_TXOP	0x8000	/* L-SIG TXOP protection support */
+
+#define HT_CAP_RX_STBC_NO		0x0	/* no rx STBC support */
+#define HT_CAP_RX_STBC_ONE_STREAM	0x1	/* rx STBC support of 1 spatial stream */
+#define HT_CAP_RX_STBC_TWO_STREAM	0x2	/* rx STBC support of 1-2 spatial streams */
+#define HT_CAP_RX_STBC_THREE_STREAM	0x3	/* rx STBC support of 1-3 spatial streams */
+
+
+#define HT_CAP_TXBF_CAP_IMPLICIT_TXBF_RX	0x1
+#define HT_CAP_TXBF_CAP_NDP_RX			0x8
+#define HT_CAP_TXBF_CAP_NDP_TX			0x10
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI		0x100
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_STEERING	0x200
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_STEERING	0x400
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_MASK	0x1800
+#define HT_CAP_TXBF_CAP_EXPLICIT_CSI_FB_SHIFT	11
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_MASK	0x6000
+#define HT_CAP_TXBF_CAP_EXPLICIT_NC_FB_SHIFT	13
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_MASK	0x18000
+#define HT_CAP_TXBF_CAP_EXPLICIT_C_FB_SHIFT	15
+#define HT_CAP_TXBF_CAP_CSI_BFR_ANT_SHIFT	19
+#define HT_CAP_TXBF_CAP_NC_BFR_ANT_SHIFT	21
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_SHIFT		23
+#define HT_CAP_TXBF_CAP_C_BFR_ANT_MASK		0x1800000
+
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_SHIFT	27
+#define HT_CAP_TXBF_CAP_CHAN_ESTIM_MASK		0x18000000
+
+#define HT_CAP_TXBF_FB_TYPE_NONE 	0
+#define HT_CAP_TXBF_FB_TYPE_DELAYED 	1
+#define HT_CAP_TXBF_FB_TYPE_IMMEDIATE 	2
+#define HT_CAP_TXBF_FB_TYPE_BOTH 	3
+
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_MASK	0x400
+#define HT_CAP_TX_BF_CAP_EXPLICIT_CSI_FB_SHIFT	10
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_MASK 0x18000
+#define HT_CAP_TX_BF_CAP_EXPLICIT_COMPRESSED_FB_SHIFT 15
+
+#define VHT_MAX_MPDU		11454	/* max mpdu size for now (bytes) */
+#define VHT_MPDU_MSDU_DELTA	56		/* Difference in spec - vht mpdu, amsdu len */
+/* Max AMSDU len - per spec */
+#define VHT_MAX_AMSDU		(VHT_MAX_MPDU - VHT_MPDU_MSDU_DELTA)
+
+#define HT_MAX_AMSDU		7935	/* max amsdu size (bytes) per the HT spec */
+#define HT_MIN_AMSDU		3835	/* min amsdu size (bytes) per the HT spec */
+
+#define HT_PARAMS_RX_FACTOR_MASK	0x03	/* ampdu rcv factor mask */
+#define HT_PARAMS_DENSITY_MASK		0x1C	/* ampdu density mask */
+#define HT_PARAMS_DENSITY_SHIFT	2	/* ampdu density shift */
+
+/* HT/AMPDU specific define */
+#define AMPDU_MAX_MPDU_DENSITY  7       /* max mpdu density; in 1/4 usec units */
+#define AMPDU_DENSITY_NONE      0       /* No density requirement */
+#define AMPDU_DENSITY_1over4_US 1       /* 1/4 us density */
+#define AMPDU_DENSITY_1over2_US 2       /* 1/2 us density */
+#define AMPDU_DENSITY_1_US      3       /*   1 us density */
+#define AMPDU_DENSITY_2_US      4       /*   2 us density */
+#define AMPDU_DENSITY_4_US      5       /*   4 us density */
+#define AMPDU_DENSITY_8_US      6       /*   8 us density */
+#define AMPDU_DENSITY_16_US     7       /*  16 us density */
+#define AMPDU_RX_FACTOR_8K      0       /* max rcv ampdu len (8kb) */
+#define AMPDU_RX_FACTOR_16K     1       /* max rcv ampdu len (16kb) */
+#define AMPDU_RX_FACTOR_32K     2       /* max rcv ampdu len (32kb) */
+#define AMPDU_RX_FACTOR_64K     3       /* max rcv ampdu len (64kb) */
+
+/* AMPDU RX factors for VHT rates */
+#define AMPDU_RX_FACTOR_128K    4       /* max rcv ampdu len (128kb) */
+#define AMPDU_RX_FACTOR_256K    5       /* max rcv ampdu len (256kb) */
+#define AMPDU_RX_FACTOR_512K    6       /* max rcv ampdu len (512kb) */
+#define AMPDU_RX_FACTOR_1024K   7       /* max rcv ampdu len (1024kb) */
+
+#define AMPDU_RX_FACTOR_BASE    8*1024  /* ampdu factor base for rx len */
+#define AMPDU_RX_FACTOR_BASE_PWR	13	/* ampdu factor base for rx len in power of 2 */
+
+#define AMPDU_DELIMITER_LEN	4	/* length of ampdu delimiter */
+#define AMPDU_DELIMITER_LEN_MAX	63	/* max length of ampdu delimiter(enforced in HW) */
+
+#define HT_CAP_EXT_PCO			0x0001
+#define HT_CAP_EXT_PCO_TTIME_MASK	0x0006
+#define HT_CAP_EXT_PCO_TTIME_SHIFT	1
+#define HT_CAP_EXT_MCS_FEEDBACK_MASK	0x0300
+#define HT_CAP_EXT_MCS_FEEDBACK_SHIFT	8
+#define HT_CAP_EXT_HTC			0x0400
+#define HT_CAP_EXT_RD_RESP		0x0800
+
+/** 'ht_add' is called 'HT Operation' information element in the 802.11 standard */
+BWL_PRE_PACKED_STRUCT struct ht_add_ie {
+	uint8	ctl_ch;			/* control channel number */
+	uint8	byte1;			/* ext ch,rec. ch. width, RIFS support */
+	uint16	opmode;			/* operation mode */
+	uint16	misc_bits;		/* misc bits */
+	uint8	basic_mcs[MCSSET_LEN];  /* required MCS set */
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_add_ie ht_add_ie_t;
+
+/* ADD IE: HT 1.0 spec. simply stole a 802.11 IE, we use our prop. IE until this is resolved */
+/* the additional IE is primarily used to convey the current BSS configuration */
+BWL_PRE_PACKED_STRUCT struct ht_prop_add_ie {
+	uint8	id;		/* IE ID, 221, DOT11_MNG_PROPR_ID */
+	uint8	len;		/* IE length */
+	uint8	oui[3];
+	uint8	type;		/* indicates what follows */
+	ht_add_ie_t add_ie;
+} BWL_POST_PACKED_STRUCT;
+typedef struct ht_prop_add_ie ht_prop_add_ie_t;
+
+#define HT_ADD_IE_LEN	22
+#define HT_ADD_IE_TYPE	52
+
+/* byte1 defn's */
+#define HT_BW_ANY		0x04	/* set, STA can use 20 or 40MHz */
+#define HT_RIFS_PERMITTED     	0x08	/* RIFS allowed */
+
+/* opmode defn's */
+#define HT_OPMODE_MASK	        0x0003	/* protection mode mask */
+#define HT_OPMODE_SHIFT		0	/* protection mode shift */
+#define HT_OPMODE_PURE		0x0000	/* protection mode PURE */
+#define HT_OPMODE_OPTIONAL	0x0001	/* protection mode optional */
+#define HT_OPMODE_HT20IN40	0x0002	/* protection mode 20MHz HT in 40MHz BSS */
+#define HT_OPMODE_MIXED	0x0003	/* protection mode Mixed Mode */
+#define HT_OPMODE_NONGF	0x0004	/* protection mode non-GF */
+#define DOT11N_TXBURST		0x0008	/* Tx burst limit */
+#define DOT11N_OBSS_NONHT	0x0010	/* OBSS Non-HT STA present */
+
+/* misc_bites defn's */
+#define HT_BASIC_STBC_MCS	0x007f	/* basic STBC MCS */
+#define HT_DUAL_STBC_PROT	0x0080	/* Dual STBC Protection */
+#define HT_SECOND_BCN		0x0100	/* Secondary beacon support */
+#define HT_LSIG_TXOP		0x0200	/* L-SIG TXOP Protection full support */
+#define HT_PCO_ACTIVE		0x0400	/* PCO active */
+#define HT_PCO_PHASE		0x0800	/* PCO phase */
+#define HT_DUALCTS_PROTECTION	0x0080	/* DUAL CTS protection needed */
+
+/* Tx Burst Limits */
+#define DOT11N_2G_TXBURST_LIMIT	6160	/* 2G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+#define DOT11N_5G_TXBURST_LIMIT	3080	/* 5G band Tx burst limit per 802.11n Draft 1.10 (usec) */
+
+/* Macros for opmode */
+#define GET_HT_OPMODE(add_ie)		((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					>> HT_OPMODE_SHIFT)
+#define HT_MIXEDMODE_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					== HT_OPMODE_MIXED)	/* mixed mode present */
+#define HT_HT20_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					== HT_OPMODE_HT20IN40)	/* 20MHz HT present */
+#define HT_OPTIONAL_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_MASK) \
+					== HT_OPMODE_OPTIONAL)	/* Optional protection present */
+#define HT_USE_PROTECTION(add_ie)	(HT_HT20_PRESENT((add_ie)) || \
+					HT_MIXEDMODE_PRESENT((add_ie))) /* use protection */
+#define HT_NONGF_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & HT_OPMODE_NONGF) \
+					== HT_OPMODE_NONGF)	/* non-GF present */
+#define DOT11N_TXBURST_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & DOT11N_TXBURST) \
+					== DOT11N_TXBURST)	/* Tx Burst present */
+#define DOT11N_OBSS_NONHT_PRESENT(add_ie)	((ltoh16_ua(&add_ie->opmode) & DOT11N_OBSS_NONHT) \
+					== DOT11N_OBSS_NONHT)	/* OBSS Non-HT present */
+
+BWL_PRE_PACKED_STRUCT struct obss_params {
+	uint16	passive_dwell;
+	uint16	active_dwell;
+	uint16	bss_widthscan_interval;
+	uint16	passive_total;
+	uint16	active_total;
+	uint16	chanwidth_transition_dly;
+	uint16	activity_threshold;
+} BWL_POST_PACKED_STRUCT;
+typedef struct obss_params obss_params_t;
+
+BWL_PRE_PACKED_STRUCT struct dot11_obss_ie {
+	uint8	id;
+	uint8	len;
+	obss_params_t obss_params;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_obss_ie dot11_obss_ie_t;
+#define DOT11_OBSS_SCAN_IE_LEN	sizeof(obss_params_t)	/* HT OBSS len (based on 802.11n d3.0) */
+
+/* HT control field */
+#define HT_CTRL_LA_TRQ		0x00000002	/* sounding request */
+#define HT_CTRL_LA_MAI		0x0000003C	/* MCS request or antenna selection indication */
+#define HT_CTRL_LA_MAI_SHIFT	2
+#define HT_CTRL_LA_MAI_MRQ	0x00000004	/* MCS request */
+#define HT_CTRL_LA_MAI_MSI	0x00000038	/* MCS request sequence identifier */
+#define HT_CTRL_LA_MFSI		0x000001C0	/* MFB sequence identifier */
+#define HT_CTRL_LA_MFSI_SHIFT	6
+#define HT_CTRL_LA_MFB_ASELC	0x0000FE00	/* MCS feedback, antenna selection command/data */
+#define HT_CTRL_LA_MFB_ASELC_SH	9
+#define HT_CTRL_LA_ASELC_CMD	0x00000C00	/* ASEL command */
+#define HT_CTRL_LA_ASELC_DATA	0x0000F000	/* ASEL data */
+#define HT_CTRL_CAL_POS		0x00030000	/* Calibration position */
+#define HT_CTRL_CAL_SEQ		0x000C0000	/* Calibration sequence */
+#define HT_CTRL_CSI_STEERING	0x00C00000	/* CSI/Steering */
+#define HT_CTRL_CSI_STEER_SHIFT	22
+#define HT_CTRL_CSI_STEER_NFB	0		/* no fedback required */
+#define HT_CTRL_CSI_STEER_CSI	1		/* CSI, H matrix */
+#define HT_CTRL_CSI_STEER_NCOM	2		/* non-compressed beamforming */
+#define HT_CTRL_CSI_STEER_COM	3		/* compressed beamforming */
+#define HT_CTRL_NDP_ANNOUNCE	0x01000000	/* NDP announcement */
+#define HT_CTRL_AC_CONSTRAINT	0x40000000	/* AC Constraint */
+#define HT_CTRL_RDG_MOREPPDU	0x80000000	/* RDG/More PPDU */
+
+/* ************* VHT definitions. ************* */
+
+/**
+ * VHT Capabilites IE (sec 8.4.2.160)
+ */
+
+BWL_PRE_PACKED_STRUCT struct vht_cap_ie {
+	uint32  vht_cap_info;
+	/* supported MCS set - 64 bit field */
+	uint16	rx_mcs_map;
+	uint16  rx_max_rate;
+	uint16  tx_mcs_map;
+	uint16	tx_max_rate;
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_cap_ie vht_cap_ie_t;
+
+/* 4B cap_info + 8B supp_mcs */
+#define VHT_CAP_IE_LEN 12
+
+/* VHT Capabilities Info field - 32bit - in VHT Cap IE */
+#define VHT_CAP_INFO_MAX_MPDU_LEN_MASK          0x00000003
+#define VHT_CAP_INFO_SUPP_CHAN_WIDTH_MASK       0x0000000c
+#define VHT_CAP_INFO_LDPC                       0x00000010
+#define VHT_CAP_INFO_SGI_80MHZ                  0x00000020
+#define VHT_CAP_INFO_SGI_160MHZ                 0x00000040
+#define VHT_CAP_INFO_TX_STBC                    0x00000080
+#define VHT_CAP_INFO_RX_STBC_MASK               0x00000700
+#define VHT_CAP_INFO_RX_STBC_SHIFT              8
+#define VHT_CAP_INFO_SU_BEAMFMR                 0x00000800
+#define VHT_CAP_INFO_SU_BEAMFMEE                0x00001000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_MASK         0x0000e000
+#define VHT_CAP_INFO_NUM_BMFMR_ANT_SHIFT        13
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_MASK      0x00070000
+#define VHT_CAP_INFO_NUM_SOUNDING_DIM_SHIFT     16
+#define VHT_CAP_INFO_MU_BEAMFMR                 0x00080000
+#define VHT_CAP_INFO_MU_BEAMFMEE                0x00100000
+#define VHT_CAP_INFO_TXOPPS                     0x00200000
+#define VHT_CAP_INFO_HTCVHT                     0x00400000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_MASK      0x03800000
+#define VHT_CAP_INFO_AMPDU_MAXLEN_EXP_SHIFT     23
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_MASK        0x0c000000
+#define VHT_CAP_INFO_LINK_ADAPT_CAP_SHIFT       26
+
+/* VHT Supported MCS Set - 64-bit - in VHT Cap IE */
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_RX_HIGHEST_RATE_SHIFT  0
+
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_MASK   0x1fff
+#define VHT_CAP_SUPP_MCS_TX_HIGHEST_RATE_SHIFT  0
+
+#define VHT_CAP_MCS_MAP_0_7                     0
+#define VHT_CAP_MCS_MAP_0_8                     1
+#define VHT_CAP_MCS_MAP_0_9                     2
+#define VHT_CAP_MCS_MAP_NONE                    3
+#define VHT_CAP_MCS_MAP_S                       2 /* num bits for 1-stream */
+#define VHT_CAP_MCS_MAP_M                       0x3 /* mask for 1-stream */
+/* assumes VHT_CAP_MCS_MAP_NONE is 3 and 2 bits are used for encoding */
+#define VHT_CAP_MCS_MAP_NONE_ALL                0xffff
+/* mcsmap with MCS0-9 for Nss = 3 */
+#define VHT_CAP_MCS_MAP_0_9_NSS3 \
+	        ((VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(1)) | \
+	         (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(2)) | \
+	         (VHT_CAP_MCS_MAP_0_9 << VHT_MCS_MAP_GET_SS_IDX(3)))
+
+#define VHT_CAP_MCS_MAP_NSS_MAX                 8
+
+/* get mcsmap with given mcs for given nss streams */
+#define VHT_CAP_MCS_MAP_CREATE(mcsmap, nss, mcs) \
+	do { \
+		int i; \
+		for (i = 1; i <= nss; i++) { \
+			VHT_MCS_MAP_SET_MCS_PER_SS(i, mcs, mcsmap); \
+		} \
+	} while (0)
+
+/* Map the mcs code to mcs bit map */
+#define VHT_MCS_CODE_TO_MCS_MAP(mcs_code) \
+	((mcs_code == VHT_CAP_MCS_MAP_0_7) ? 0xff : \
+	 (mcs_code == VHT_CAP_MCS_MAP_0_8) ? 0x1ff : \
+	 (mcs_code == VHT_CAP_MCS_MAP_0_9) ? 0x3ff : 0)
+
+/* Map the mcs bit map to mcs code */
+#define VHT_MCS_MAP_TO_MCS_CODE(mcs_map) \
+	((mcs_map == 0xff)  ? VHT_CAP_MCS_MAP_0_7 : \
+	 (mcs_map == 0x1ff) ? VHT_CAP_MCS_MAP_0_8 : \
+	 (mcs_map == 0x3ff) ? VHT_CAP_MCS_MAP_0_9 : VHT_CAP_MCS_MAP_NONE)
+
+/** VHT Capabilities Supported Channel Width */
+typedef enum vht_cap_chan_width {
+	VHT_CAP_CHAN_WIDTH_SUPPORT_MANDATORY = 0x00,
+	VHT_CAP_CHAN_WIDTH_SUPPORT_160       = 0x04,
+	VHT_CAP_CHAN_WIDTH_SUPPORT_160_8080  = 0x08
+} vht_cap_chan_width_t;
+
+/** VHT Capabilities Supported max MPDU LEN (sec 8.4.2.160.2) */
+typedef enum vht_cap_max_mpdu_len {
+	VHT_CAP_MPDU_MAX_4K     = 0x00,
+	VHT_CAP_MPDU_MAX_8K     = 0x01,
+	VHT_CAP_MPDU_MAX_11K    = 0x02
+} vht_cap_max_mpdu_len_t;
+
+/* Maximum MPDU Length byte counts for the VHT Capabilities advertised limits */
+#define VHT_MPDU_LIMIT_4K        3895
+#define VHT_MPDU_LIMIT_8K        7991
+#define VHT_MPDU_LIMIT_11K      11454
+
+
+/**
+ * VHT Operation IE (sec 8.4.2.161)
+ */
+
+BWL_PRE_PACKED_STRUCT struct vht_op_ie {
+	uint8	chan_width;
+	uint8	chan1;
+	uint8	chan2;
+	uint16	supp_mcs;  /*  same def as above in vht cap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_op_ie vht_op_ie_t;
+
+/* 3B VHT Op info + 2B Basic MCS */
+#define VHT_OP_IE_LEN 5
+
+typedef enum vht_op_chan_width {
+	VHT_OP_CHAN_WIDTH_20_40	= 0,
+	VHT_OP_CHAN_WIDTH_80	= 1,
+	VHT_OP_CHAN_WIDTH_160	= 2,
+	VHT_OP_CHAN_WIDTH_80_80	= 3
+} vht_op_chan_width_t;
+
+/* AID length */
+#define AID_IE_LEN		2
+/**
+ * BRCM vht features IE header
+ * The header if the fixed part of the IE
+ * On the 5GHz band this is the entire IE,
+ * on 2.4GHz the VHT IEs as defined in the 802.11ac
+ * specification follows
+ *
+ *
+ * VHT features rates  bitmap.
+ * Bit0:		5G MCS 0-9 BW 160MHz
+ * Bit1:		5G MCS 0-9 support BW 80MHz
+ * Bit2:		5G MCS 0-9 support BW 20MHz
+ * Bit3:		2.4G MCS 0-9 support BW 20MHz
+ * Bits:4-7	Reserved for future use
+ *
+ */
+#define VHT_FEATURES_IE_TYPE	0x4
+BWL_PRE_PACKED_STRUCT struct vht_features_ie_hdr {
+	uint8 oui[3];
+	uint8 type;		/* type of this IE = 4 */
+	uint8 rate_mask;	/* VHT rate mask */
+} BWL_POST_PACKED_STRUCT;
+typedef struct vht_features_ie_hdr vht_features_ie_hdr_t;
+
+/* Def for rx & tx basic mcs maps - ea ss num has 2 bits of info */
+#define VHT_MCS_MAP_GET_SS_IDX(nss) (((nss)-1) * VHT_CAP_MCS_MAP_S)
+#define VHT_MCS_MAP_GET_MCS_PER_SS(nss, mcsMap) \
+	(((mcsMap) >> VHT_MCS_MAP_GET_SS_IDX(nss)) & VHT_CAP_MCS_MAP_M)
+#define VHT_MCS_MAP_SET_MCS_PER_SS(nss, numMcs, mcsMap) \
+	do { \
+	 (mcsMap) &= (~(VHT_CAP_MCS_MAP_M << VHT_MCS_MAP_GET_SS_IDX(nss))); \
+	 (mcsMap) |= (((numMcs) & VHT_CAP_MCS_MAP_M) << VHT_MCS_MAP_GET_SS_IDX(nss)); \
+	} while (0)
+#define VHT_MCS_SS_SUPPORTED(nss, mcsMap) \
+		 (VHT_MCS_MAP_GET_MCS_PER_SS((nss), (mcsMap)) != VHT_CAP_MCS_MAP_NONE)
+
+
+/* ************* WPA definitions. ************* */
+#define WPA_OUI			"\x00\x50\xF2"	/* WPA OUI */
+#define WPA_OUI_LEN		3		/* WPA OUI length */
+#define WPA_OUI_TYPE		1
+#define WPA_VERSION		1		/* WPA version */
+#define WPA2_OUI		"\x00\x0F\xAC"	/* WPA2 OUI */
+#define WPA2_OUI_LEN		3		/* WPA2 OUI length */
+#define WPA2_VERSION		1		/* WPA2 version */
+#define WPA2_VERSION_LEN	2		/* WAP2 version length */
+
+/* ************* WPS definitions. ************* */
+#define WPS_OUI			"\x00\x50\xF2"	/* WPS OUI */
+#define WPS_OUI_LEN		3		/* WPS OUI length */
+#define WPS_OUI_TYPE		4
+
+/* ************* WFA definitions. ************* */
+
+#ifdef P2P_IE_OVRD
+#define WFA_OUI			MAC_OUI
+#else
+#define WFA_OUI			"\x50\x6F\x9A"	/* WFA OUI */
+#endif /* P2P_IE_OVRD */
+#define WFA_OUI_LEN		3		/* WFA OUI length */
+#ifdef P2P_IE_OVRD
+#define WFA_OUI_TYPE_P2P	MAC_OUI_TYPE_P2P
+#else
+#define WFA_OUI_TYPE_TPC	8
+#define WFA_OUI_TYPE_P2P	9
+#endif
+
+#define WFA_OUI_TYPE_TPC	8
+#ifdef WLTDLS
+#define WFA_OUI_TYPE_TPQ	4	/* WFD Tunneled Probe ReQuest */
+#define WFA_OUI_TYPE_TPS	5	/* WFD Tunneled Probe ReSponse */
+#define WFA_OUI_TYPE_WFD	10
+#endif /* WTDLS */
+#define WFA_OUI_TYPE_HS20	0x10
+#define WFA_OUI_TYPE_OSEN	0x12
+#define WFA_OUI_TYPE_NAN	0x13
+
+/* RSN authenticated key managment suite */
+#define RSN_AKM_NONE		0	/* None (IBSS) */
+#define RSN_AKM_UNSPECIFIED	1	/* Over 802.1x */
+#define RSN_AKM_PSK		2	/* Pre-shared Key */
+#define RSN_AKM_FBT_1X		3	/* Fast Bss transition using 802.1X */
+#define RSN_AKM_FBT_PSK		4	/* Fast Bss transition using Pre-shared Key */
+#define RSN_AKM_MFP_1X		5	/* SHA256 key derivation, using 802.1X */
+#define RSN_AKM_MFP_PSK		6	/* SHA256 key derivation, using Pre-shared Key */
+#define RSN_AKM_TPK			7	/* TPK(TDLS Peer Key) handshake */
+
+/* OSEN authenticated key managment suite */
+#define OSEN_AKM_UNSPECIFIED	RSN_AKM_UNSPECIFIED	/* Over 802.1x */
+
+/* Key related defines */
+#define DOT11_MAX_DEFAULT_KEYS	4	/* number of default keys */
+#define DOT11_MAX_IGTK_KEYS		2
+#define DOT11_MAX_KEY_SIZE	32	/* max size of any key */
+#define DOT11_MAX_IV_SIZE	16	/* max size of any IV */
+#define DOT11_EXT_IV_FLAG	(1<<5)	/* flag to indicate IV is > 4 bytes */
+#define DOT11_WPA_KEY_RSC_LEN   8       /* WPA RSC key len */
+
+#define WEP1_KEY_SIZE		5	/* max size of any WEP key */
+#define WEP1_KEY_HEX_SIZE	10	/* size of WEP key in hex. */
+#define WEP128_KEY_SIZE		13	/* max size of any WEP key */
+#define WEP128_KEY_HEX_SIZE	26	/* size of WEP key in hex. */
+#define TKIP_MIC_SIZE		8	/* size of TKIP MIC */
+#define TKIP_EOM_SIZE		7	/* max size of TKIP EOM */
+#define TKIP_EOM_FLAG		0x5a	/* TKIP EOM flag byte */
+#define TKIP_KEY_SIZE		32	/* size of any TKIP key, includs MIC keys */
+#define TKIP_TK_SIZE		16
+#define TKIP_MIC_KEY_SIZE	8
+#define TKIP_MIC_AUTH_TX	16	/* offset to Authenticator MIC TX key */
+#define TKIP_MIC_AUTH_RX	24	/* offset to Authenticator MIC RX key */
+#define TKIP_MIC_SUP_RX		TKIP_MIC_AUTH_TX	/* offset to Supplicant MIC RX key */
+#define TKIP_MIC_SUP_TX		TKIP_MIC_AUTH_RX	/* offset to Supplicant MIC TX key */
+#define AES_KEY_SIZE		16	/* size of AES key */
+#define AES_MIC_SIZE		8	/* size of AES MIC */
+#define BIP_KEY_SIZE		16	/* size of BIP key */
+#define BIP_MIC_SIZE		8   /* sizeof BIP MIC */
+
+#define AES_GCM_MIC_SIZE	16	/* size of MIC for 128-bit GCM - .11adD9 */
+
+#define AES256_KEY_SIZE		32	/* size of AES 256 key - .11acD5 */
+#define AES256_MIC_SIZE		16	/* size of MIC for 256 bit keys, incl BIP */
+
+/* WCN */
+#define WCN_OUI			"\x00\x50\xf2"	/* WCN OUI */
+#define WCN_TYPE		4	/* WCN type */
+
+#ifdef BCMWAPI_WPI
+#define SMS4_KEY_LEN		16
+#define SMS4_WPI_CBC_MAC_LEN	16
+#endif
+
+/* 802.11r protocol definitions */
+
+/** Mobility Domain IE */
+BWL_PRE_PACKED_STRUCT struct dot11_mdid_ie {
+	uint8 id;
+	uint8 len;
+	uint16 mdid;		/* Mobility Domain Id */
+	uint8 cap;
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_mdid_ie dot11_mdid_ie_t;
+
+#define FBT_MDID_CAP_OVERDS	0x01	/* Fast Bss transition over the DS support */
+#define FBT_MDID_CAP_RRP	0x02	/* Resource request protocol support */
+
+/** Fast Bss Transition IE */
+BWL_PRE_PACKED_STRUCT struct dot11_ft_ie {
+	uint8 id;
+	uint8 len;
+	uint16 mic_control;		/* Mic Control */
+	uint8 mic[16];
+	uint8 anonce[32];
+	uint8 snonce[32];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_ft_ie dot11_ft_ie_t;
+
+#define TIE_TYPE_RESERVED		0
+#define TIE_TYPE_REASSOC_DEADLINE	1
+#define TIE_TYPE_KEY_LIEFTIME		2
+#define TIE_TYPE_ASSOC_COMEBACK		3
+BWL_PRE_PACKED_STRUCT struct dot11_timeout_ie {
+	uint8 id;
+	uint8 len;
+	uint8 type;		/* timeout interval type */
+	uint32 value;		/* timeout interval value */
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_timeout_ie dot11_timeout_ie_t;
+
+/** GTK ie */
+BWL_PRE_PACKED_STRUCT struct dot11_gtk_ie {
+	uint8 id;
+	uint8 len;
+	uint16 key_info;
+	uint8 key_len;
+	uint8 rsc[8];
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT;
+typedef struct dot11_gtk_ie dot11_gtk_ie_t;
+
+/** Management MIC ie */
+BWL_PRE_PACKED_STRUCT struct mmic_ie {
+	uint8   id;					/* IE ID: DOT11_MNG_MMIE_ID */
+	uint8   len;				/* IE length */
+	uint16  key_id;				/* key id */
+	uint8   ipn[6];				/* ipn */
+	uint8   mic[16];			/* mic */
+} BWL_POST_PACKED_STRUCT;
+typedef struct mmic_ie mmic_ie_t;
+
+#define BSSID_INVALID           "\x00\x00\x00\x00\x00\x00"
+#define BSSID_BROADCAST         "\xFF\xFF\xFF\xFF\xFF\xFF"
+
+#ifdef BCMWAPI_WAI
+#define WAPI_IE_MIN_LEN 	20	/* WAPI IE min length */
+#define WAPI_VERSION		1	/* WAPI version */
+#define WAPI_VERSION_LEN	2	/* WAPI version length */
+#define WAPI_OUI		"\x00\x14\x72"	/* WAPI OUI */
+#define WAPI_OUI_LEN		DOT11_OUI_LEN	/* WAPI OUI length */
+#endif /* BCMWAPI_WAI */
+
+/* ************* WMM Parameter definitions. ************* */
+#define WMM_OUI			"\x00\x50\xF2"	/* WNN OUI */
+#define WMM_OUI_LEN		3		/* WMM OUI length */
+#define WMM_OUI_TYPE	2		/* WMM OUT type */
+#define WMM_VERSION		1
+#define WMM_VERSION_LEN	1
+
+/* WMM OUI subtype */
+#define WMM_OUI_SUBTYPE_PARAMETER	1
+#define WMM_PARAMETER_IE_LEN		24
+
+/** Link Identifier Element */
+BWL_PRE_PACKED_STRUCT struct link_id_ie {
+	uint8 id;
+	uint8 len;
+	struct ether_addr	bssid;
+	struct ether_addr	tdls_init_mac;
+	struct ether_addr	tdls_resp_mac;
+} BWL_POST_PACKED_STRUCT;
+typedef struct link_id_ie link_id_ie_t;
+#define TDLS_LINK_ID_IE_LEN		18
+
+/** Link Wakeup Schedule Element */
+BWL_PRE_PACKED_STRUCT struct wakeup_sch_ie {
+	uint8 id;
+	uint8 len;
+	uint32 offset;			/* in ms between TSF0 and start of 1st Awake Window */
+	uint32 interval;		/* in ms bwtween the start of 2 Awake Windows */
+	uint32 awake_win_slots;	/* in backof slots, duration of Awake Window */
+	uint32 max_wake_win;	/* in ms, max duration of Awake Window */
+	uint16 idle_cnt;		/* number of consecutive Awake Windows */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wakeup_sch_ie wakeup_sch_ie_t;
+#define TDLS_WAKEUP_SCH_IE_LEN		18
+
+/** Channel Switch Timing Element */
+BWL_PRE_PACKED_STRUCT struct channel_switch_timing_ie {
+	uint8 id;
+	uint8 len;
+	uint16 switch_time;		/* in ms, time to switch channels */
+	uint16 switch_timeout;	/* in ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct channel_switch_timing_ie channel_switch_timing_ie_t;
+#define TDLS_CHANNEL_SWITCH_TIMING_IE_LEN		4
+
+/** PTI Control Element */
+BWL_PRE_PACKED_STRUCT struct pti_control_ie {
+	uint8 id;
+	uint8 len;
+	uint8 tid;
+	uint16 seq_control;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pti_control_ie pti_control_ie_t;
+#define TDLS_PTI_CONTROL_IE_LEN		3
+
+/** PU Buffer Status Element */
+BWL_PRE_PACKED_STRUCT struct pu_buffer_status_ie {
+	uint8 id;
+	uint8 len;
+	uint8 status;
+} BWL_POST_PACKED_STRUCT;
+typedef struct pu_buffer_status_ie pu_buffer_status_ie_t;
+#define TDLS_PU_BUFFER_STATUS_IE_LEN	1
+#define TDLS_PU_BUFFER_STATUS_AC_BK		1
+#define TDLS_PU_BUFFER_STATUS_AC_BE		2
+#define TDLS_PU_BUFFER_STATUS_AC_VI		4
+#define TDLS_PU_BUFFER_STATUS_AC_VO		8
+
+/* TDLS Action Field Values */
+#define TDLS_SETUP_REQ				0
+#define TDLS_SETUP_RESP				1
+#define TDLS_SETUP_CONFIRM			2
+#define TDLS_TEARDOWN				3
+#define TDLS_PEER_TRAFFIC_IND			4
+#define TDLS_CHANNEL_SWITCH_REQ			5
+#define TDLS_CHANNEL_SWITCH_RESP		6
+#define TDLS_PEER_PSM_REQ			7
+#define TDLS_PEER_PSM_RESP			8
+#define TDLS_PEER_TRAFFIC_RESP			9
+#define TDLS_DISCOVERY_REQ			10
+
+/* 802.11z TDLS Public Action Frame action field */
+#define TDLS_DISCOVERY_RESP			14
+
+/* 802.11u GAS action frames */
+#define GAS_REQUEST_ACTION_FRAME				10
+#define GAS_RESPONSE_ACTION_FRAME				11
+#define GAS_COMEBACK_REQUEST_ACTION_FRAME		12
+#define GAS_COMEBACK_RESPONSE_ACTION_FRAME		13
+
+/* 802.11u interworking access network options */
+#define IW_ANT_MASK				0x0f
+#define IW_INTERNET_MASK		0x10
+#define IW_ASRA_MASK			0x20
+#define IW_ESR_MASK				0x40
+#define IW_UESA_MASK			0x80
+
+/* 802.11u interworking access network type */
+#define IW_ANT_PRIVATE_NETWORK					0
+#define IW_ANT_PRIVATE_NETWORK_WITH_GUEST		1
+#define IW_ANT_CHARGEABLE_PUBLIC_NETWORK		2
+#define IW_ANT_FREE_PUBLIC_NETWORK				3
+#define IW_ANT_PERSONAL_DEVICE_NETWORK			4
+#define IW_ANT_EMERGENCY_SERVICES_NETWORK		5
+#define IW_ANT_TEST_NETWORK						14
+#define IW_ANT_WILDCARD_NETWORK					15
+
+/* 802.11u advertisement protocol */
+#define ADVP_ANQP_PROTOCOL_ID	0
+
+/* 802.11u advertisement protocol masks */
+#define ADVP_QRL_MASK					0x7f
+#define ADVP_PAME_BI_MASK				0x80
+
+/* 802.11u advertisement protocol values */
+#define ADVP_QRL_REQUEST				0x00
+#define ADVP_QRL_RESPONSE				0x7f
+#define ADVP_PAME_BI_DEPENDENT			0x00
+#define ADVP_PAME_BI_INDEPENDENT		ADVP_PAME_BI_MASK
+
+/* 802.11u ANQP information ID */
+#define ANQP_ID_QUERY_LIST							256
+#define ANQP_ID_CAPABILITY_LIST						257
+#define ANQP_ID_VENUE_NAME_INFO						258
+#define ANQP_ID_EMERGENCY_CALL_NUMBER_INFO			259
+#define ANQP_ID_NETWORK_AUTHENTICATION_TYPE_INFO	260
+#define ANQP_ID_ROAMING_CONSORTIUM_LIST				261
+#define ANQP_ID_IP_ADDRESS_TYPE_AVAILABILITY_INFO	262
+#define ANQP_ID_NAI_REALM_LIST						263
+#define ANQP_ID_G3PP_CELLULAR_NETWORK_INFO			264
+#define ANQP_ID_AP_GEOSPATIAL_LOCATION				265
+#define ANQP_ID_AP_CIVIC_LOCATION					266
+#define ANQP_ID_AP_LOCATION_PUBLIC_ID_URI			267
+#define ANQP_ID_DOMAIN_NAME_LIST					268
+#define ANQP_ID_EMERGENCY_ALERT_ID_URI				269
+#define ANQP_ID_EMERGENCY_NAI						271
+#define ANQP_ID_VENDOR_SPECIFIC_LIST				56797
+
+/* 802.11u ANQP OUI */
+#define ANQP_OUI_SUBTYPE	9
+
+/* 802.11u venue name */
+#define VENUE_LANGUAGE_CODE_SIZE		3
+#define VENUE_NAME_SIZE					255
+
+/* 802.11u venue groups */
+#define VENUE_UNSPECIFIED				0
+#define VENUE_ASSEMBLY					1
+#define VENUE_BUSINESS					2
+#define VENUE_EDUCATIONAL				3
+#define VENUE_FACTORY					4
+#define VENUE_INSTITUTIONAL				5
+#define VENUE_MERCANTILE				6
+#define VENUE_RESIDENTIAL				7
+#define VENUE_STORAGE					8
+#define VENUE_UTILITY					9
+#define VENUE_VEHICULAR					10
+#define VENUE_OUTDOOR					11
+
+/* 802.11u network authentication type indicator */
+#define NATI_UNSPECIFIED							-1
+#define NATI_ACCEPTANCE_OF_TERMS_CONDITIONS			0
+#define NATI_ONLINE_ENROLLMENT_SUPPORTED			1
+#define NATI_HTTP_HTTPS_REDIRECTION					2
+#define NATI_DNS_REDIRECTION						3
+
+/* 802.11u IP address type availability - IPv6 */
+#define IPA_IPV6_SHIFT						0
+#define IPA_IPV6_MASK						(0x03 << IPA_IPV6_SHIFT)
+#define	IPA_IPV6_NOT_AVAILABLE				0x00
+#define IPA_IPV6_AVAILABLE					0x01
+#define IPA_IPV6_UNKNOWN_AVAILABILITY		0x02
+
+/* 802.11u IP address type availability - IPv4 */
+#define IPA_IPV4_SHIFT						2
+#define IPA_IPV4_MASK						(0x3f << IPA_IPV4_SHIFT)
+#define	IPA_IPV4_NOT_AVAILABLE				0x00
+#define IPA_IPV4_PUBLIC						0x01
+#define IPA_IPV4_PORT_RESTRICT				0x02
+#define IPA_IPV4_SINGLE_NAT					0x03
+#define IPA_IPV4_DOUBLE_NAT					0x04
+#define IPA_IPV4_PORT_RESTRICT_SINGLE_NAT	0x05
+#define IPA_IPV4_PORT_RESTRICT_DOUBLE_NAT	0x06
+#define IPA_IPV4_UNKNOWN_AVAILABILITY		0x07
+
+/* 802.11u NAI realm encoding */
+#define REALM_ENCODING_RFC4282	0
+#define REALM_ENCODING_UTF8		1
+
+/* 802.11u IANA EAP method type numbers */
+#define REALM_EAP_TLS					13
+#define REALM_EAP_LEAP					17
+#define REALM_EAP_SIM					18
+#define REALM_EAP_TTLS					21
+#define REALM_EAP_AKA					23
+#define REALM_EAP_PEAP					25
+#define REALM_EAP_FAST					43
+#define REALM_EAP_PSK					47
+#define REALM_EAP_AKAP					50
+#define REALM_EAP_EXPANDED				254
+
+/* 802.11u authentication ID */
+#define REALM_EXPANDED_EAP						1
+#define REALM_NON_EAP_INNER_AUTHENTICATION		2
+#define REALM_INNER_AUTHENTICATION_EAP			3
+#define REALM_EXPANDED_INNER_EAP				4
+#define REALM_CREDENTIAL						5
+#define REALM_TUNNELED_EAP_CREDENTIAL			6
+#define REALM_VENDOR_SPECIFIC_EAP				221
+
+/* 802.11u non-EAP inner authentication type */
+#define REALM_RESERVED_AUTH			0
+#define REALM_PAP					1
+#define REALM_CHAP					2
+#define REALM_MSCHAP				3
+#define REALM_MSCHAPV2				4
+
+/* 802.11u credential type */
+#define REALM_SIM					1
+#define REALM_USIM					2
+#define REALM_NFC					3
+#define REALM_HARDWARE_TOKEN		4
+#define REALM_SOFTOKEN				5
+#define REALM_CERTIFICATE			6
+#define REALM_USERNAME_PASSWORD		7
+#define REALM_SERVER_SIDE			8
+#define REALM_RESERVED_CRED			9
+#define REALM_VENDOR_SPECIFIC_CRED	10
+
+/* 802.11u 3GPP PLMN */
+#define G3PP_GUD_VERSION		0
+#define G3PP_PLMN_LIST_IE		0
+
+/** hotspot2.0 indication element (vendor specific) */
+BWL_PRE_PACKED_STRUCT struct hs20_ie {
+	uint8 oui[3];
+	uint8 type;
+	uint8 config;
+} BWL_POST_PACKED_STRUCT;
+typedef struct hs20_ie hs20_ie_t;
+#define HS20_IE_LEN 5	/* HS20 IE length */
+
+/** IEEE 802.11 Annex E */
+typedef enum {
+	DOT11_2GHZ_20MHZ_CLASS_12		= 81,	/* Ch 1-11			 */
+	DOT11_5GHZ_20MHZ_CLASS_1		= 115,	/* Ch 36-48			 */
+	DOT11_5GHZ_20MHZ_CLASS_2_DFS	= 118,	/* Ch 52-64			 */
+	DOT11_5GHZ_20MHZ_CLASS_3		= 124,	/* Ch 149-161		 */
+	DOT11_5GHZ_20MHZ_CLASS_4_DFS	= 121,	/* Ch 100-140		 */
+	DOT11_5GHZ_20MHZ_CLASS_5		= 125,	/* Ch 149-165		 */
+	DOT11_5GHZ_40MHZ_CLASS_22		= 116,	/* Ch 36-44,   lower */
+	DOT11_5GHZ_40MHZ_CLASS_23_DFS 	= 119,	/* Ch 52-60,   lower */
+	DOT11_5GHZ_40MHZ_CLASS_24_DFS	= 122,	/* Ch 100-132, lower */
+	DOT11_5GHZ_40MHZ_CLASS_25		= 126,	/* Ch 149-157, lower */
+	DOT11_5GHZ_40MHZ_CLASS_27		= 117,	/* Ch 40-48,   upper */
+	DOT11_5GHZ_40MHZ_CLASS_28_DFS	= 120,	/* Ch 56-64,   upper */
+	DOT11_5GHZ_40MHZ_CLASS_29_DFS	= 123,	/* Ch 104-136, upper */
+	DOT11_5GHZ_40MHZ_CLASS_30		= 127,	/* Ch 153-161, upper */
+	DOT11_2GHZ_40MHZ_CLASS_32		= 83,	/* Ch 1-7,     lower */
+	DOT11_2GHZ_40MHZ_CLASS_33		= 84,	/* Ch 5-11,    upper */
+} dot11_op_class_t;
+
+/* QoS map */
+#define QOS_MAP_FIXED_LENGTH	(8 * 2)	/* DSCP ranges fixed with 8 entries */
+
+#define BCM_AIBSS_IE_TYPE 56
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _802_11_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/802.1d.h b/drivers/net/wireless/bcm4336/include/proto/802.1d.h
--- a/drivers/net/wireless/bcm4336/include/proto/802.1d.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/802.1d.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,32 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Fundamental types and constants relating to 802.1D
+ *
+ * $Id: 802.1d.h 382882 2013-02-04 23:24:31Z $
+ */
+
+#ifndef _802_1_D_
+#define _802_1_D_
+
+/* 802.1D priority defines */
+#define	PRIO_8021D_NONE		2	/* None = - */
+#define	PRIO_8021D_BK		1	/* BK - Background */
+#define	PRIO_8021D_BE		0	/* BE - Best-effort */
+#define	PRIO_8021D_EE		3	/* EE - Excellent-effort */
+#define	PRIO_8021D_CL		4	/* CL - Controlled Load */
+#define	PRIO_8021D_VI		5	/* Vi - Video */
+#define	PRIO_8021D_VO		6	/* Vo - Voice */
+#define	PRIO_8021D_NC		7	/* NC - Network Control */
+#define	MAXPRIO			7	/* 0-7 */
+#define NUMPRIO			(MAXPRIO + 1)
+
+#define ALLPRIO		-1	/* All prioirty */
+
+/* Converts prio to precedence since the numerical value of
+ * PRIO_8021D_BE and PRIO_8021D_NONE are swapped.
+ */
+#define PRIO2PREC(prio) \
+	(((prio) == PRIO_8021D_NONE || (prio) == PRIO_8021D_BE) ? ((prio^2)) : (prio))
+
+#endif /* _802_1_D__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/802.3.h b/drivers/net/wireless/bcm4336/include/proto/802.3.h
--- a/drivers/net/wireless/bcm4336/include/proto/802.3.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/802.3.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,34 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Fundamental constants relating to 802.3
+ *
+ * $Id: 802.3.h 417943 2013-08-13 07:54:04Z $
+ */
+
+#ifndef _802_3_h_
+#define _802_3_h_
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define SNAP_HDR_LEN	6	/* 802.3 SNAP header length */
+#define DOT3_OUI_LEN	3	/* 802.3 oui length */
+
+BWL_PRE_PACKED_STRUCT struct dot3_mac_llc_snap_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];	/* dest mac */
+	uint8	ether_shost[ETHER_ADDR_LEN];	/* src mac */
+	uint16	length;				/* frame length incl header */
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[DOT3_OUI_LEN];		/* RFC1042: 0x00 0x00 0x00
+						 * Bridge-Tunnel: 0x00 0x00 0xF8
+						 */
+	uint16	type;				/* ethertype */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif	/* #ifndef _802_3_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmdhcp.h b/drivers/net/wireless/bcm4336/include/proto/bcmdhcp.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmdhcp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmdhcp.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2014, Broadcom Corporation
+ * All Rights Reserved.
+ *
+ * This is UNPUBLISHED PROPRIETARY SOURCE CODE of Broadcom Corporation;
+ * the contents of this file may not be disclosed to third parties, copied
+ * or duplicated in any form, in whole or in part, without the prior
+ * written permission of Broadcom Corporation.
+ *
+ * Fundamental constants relating to DHCP Protocol
+ *
+ * $Id: bcmdhcp.h 382883 2013-02-04 23:26:09Z $
+ */
+
+#ifndef _bcmdhcp_h_
+#define _bcmdhcp_h_
+
+/* DHCP params */
+#define DHCP_TYPE_OFFSET	0	/* DHCP type (request|reply) offset */
+#define DHCP_TID_OFFSET		4	/* DHCP transition id offset */
+#define DHCP_FLAGS_OFFSET	10	/* DHCP flags offset */
+#define DHCP_CIADDR_OFFSET	12	/* DHCP client IP address offset */
+#define DHCP_YIADDR_OFFSET	16	/* DHCP your IP address offset */
+#define DHCP_GIADDR_OFFSET	24	/* DHCP relay agent IP address offset */
+#define DHCP_CHADDR_OFFSET	28	/* DHCP client h/w address offset */
+#define DHCP_OPT_OFFSET		236	/* DHCP options offset */
+
+#define DHCP_OPT_MSGTYPE	53	/* DHCP message type */
+#define DHCP_OPT_MSGTYPE_REQ	3
+#define DHCP_OPT_MSGTYPE_ACK	5	/* DHCP message type - ACK */
+
+#define DHCP_OPT_CODE_OFFSET	0	/* Option identifier */
+#define DHCP_OPT_LEN_OFFSET	1	/* Option data length */
+#define DHCP_OPT_DATA_OFFSET	2	/* Option data */
+
+#define DHCP_OPT_CODE_CLIENTID	61	/* Option identifier */
+
+#define DHCP_TYPE_REQUEST	1	/* DHCP request (discover|request) */
+#define DHCP_TYPE_REPLY		2	/* DHCP reply (offset|ack) */
+
+#define DHCP_PORT_SERVER	67	/* DHCP server UDP port */
+#define DHCP_PORT_CLIENT	68	/* DHCP client UDP port */
+
+#define DHCP_FLAG_BCAST	0x8000	/* DHCP broadcast flag */
+
+#define DHCP_FLAGS_LEN	2	/* DHCP flags field length */
+
+#define DHCP6_TYPE_SOLICIT	1	/* DHCP6 solicit */
+#define DHCP6_TYPE_ADVERTISE	2	/* DHCP6 advertise */
+#define DHCP6_TYPE_REQUEST	3	/* DHCP6 request */
+#define DHCP6_TYPE_CONFIRM	4	/* DHCP6 confirm */
+#define DHCP6_TYPE_RENEW	5	/* DHCP6 renew */
+#define DHCP6_TYPE_REBIND	6	/* DHCP6 rebind */
+#define DHCP6_TYPE_REPLY	7	/* DHCP6 reply */
+#define DHCP6_TYPE_RELEASE	8	/* DHCP6 release */
+#define DHCP6_TYPE_DECLINE	9	/* DHCP6 decline */
+#define DHCP6_TYPE_RECONFIGURE	10	/* DHCP6 reconfigure */
+#define DHCP6_TYPE_INFOREQ	11	/* DHCP6 information request */
+#define DHCP6_TYPE_RELAYFWD	12	/* DHCP6 relay forward */
+#define DHCP6_TYPE_RELAYREPLY	13	/* DHCP6 relay reply */
+
+#define DHCP6_TYPE_OFFSET	0	/* DHCP6 type offset */
+
+#define	DHCP6_MSG_OPT_OFFSET	4	/* Offset of options in client server messages */
+#define	DHCP6_RELAY_OPT_OFFSET	34	/* Offset of options in relay messages */
+
+#define	DHCP6_OPT_CODE_OFFSET	0	/* Option identifier */
+#define	DHCP6_OPT_LEN_OFFSET	2	/* Option data length */
+#define	DHCP6_OPT_DATA_OFFSET	4	/* Option data */
+
+#define	DHCP6_OPT_CODE_CLIENTID	1	/* DHCP6 CLIENTID option */
+#define	DHCP6_OPT_CODE_SERVERID	2	/* DHCP6 SERVERID option */
+
+#define DHCP6_PORT_SERVER	547	/* DHCP6 server UDP port */
+#define DHCP6_PORT_CLIENT	546	/* DHCP6 client UDP port */
+
+#endif	/* #ifndef _bcmdhcp_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmeth.h b/drivers/net/wireless/bcm4336/include/proto/bcmeth.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmeth.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmeth.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,94 @@
+/*
+ * Broadcom Ethernettype  protocol definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmeth.h 445746 2013-12-30 12:57:26Z $
+ */
+
+/*
+ * Broadcom Ethernet protocol defines
+ */
+
+#ifndef _BCMETH_H_
+#define _BCMETH_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* ETHER_TYPE_BRCM is defined in ethernet.h */
+
+/*
+ * Following the 2byte BRCM ether_type is a 16bit BRCM subtype field
+ * in one of two formats: (only subtypes 32768-65535 are in use now)
+ *
+ * subtypes 0-32767:
+ *     8 bit subtype (0-127)
+ *     8 bit length in bytes (0-255)
+ *
+ * subtypes 32768-65535:
+ *     16 bit big-endian subtype
+ *     16 bit big-endian length in bytes (0-65535)
+ *
+ * length is the number of additional bytes beyond the 4 or 6 byte header
+ *
+ * Reserved values:
+ * 0 reserved
+ * 5-15 reserved for iLine protocol assignments
+ * 17-126 reserved, assignable
+ * 127 reserved
+ * 32768 reserved
+ * 32769-65534 reserved, assignable
+ * 65535 reserved
+ */
+
+/*
+ * While adding the subtypes and their specific processing code make sure
+ * bcmeth_bcm_hdr_t is the first data structure in the user specific data structure definition
+ */
+
+#define	BCMILCP_SUBTYPE_RATE		1
+#define	BCMILCP_SUBTYPE_LINK		2
+#define	BCMILCP_SUBTYPE_CSA		3
+#define	BCMILCP_SUBTYPE_LARQ		4
+#define BCMILCP_SUBTYPE_VENDOR		5
+#define	BCMILCP_SUBTYPE_FLH		17
+
+#define BCMILCP_SUBTYPE_VENDOR_LONG	32769
+#define BCMILCP_SUBTYPE_CERT		32770
+#define BCMILCP_SUBTYPE_SES		32771
+
+
+#define BCMILCP_BCM_SUBTYPE_RESERVED		0
+#define BCMILCP_BCM_SUBTYPE_EVENT		1
+#define BCMILCP_BCM_SUBTYPE_SES			2
+/*
+ * The EAPOL type is not used anymore. Instead EAPOL messages are now embedded
+ * within BCMILCP_BCM_SUBTYPE_EVENT type messages
+ */
+/* #define BCMILCP_BCM_SUBTYPE_EAPOL		3 */
+#define BCMILCP_BCM_SUBTYPE_DPT                 4
+
+#define BCMILCP_BCM_SUBTYPEHDR_MINLENGTH	8
+#define BCMILCP_BCM_SUBTYPEHDR_VERSION		0
+
+/* These fields are stored in network order */
+typedef BWL_PRE_PACKED_STRUCT struct bcmeth_hdr
+{
+	uint16	subtype;	/* Vendor specific..32769 */
+	uint16	length;
+	uint8	version;	/* Version is 0 */
+	uint8	oui[3];		/* Broadcom OUI */
+	/* user specific Data */
+	uint16	usr_subtype;
+} BWL_POST_PACKED_STRUCT bcmeth_hdr_t;
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif	/*  _BCMETH_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmevent.h b/drivers/net/wireless/bcm4336/include/proto/bcmevent.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmevent.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmevent.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,518 @@
+/*
+ * Broadcom Event  protocol definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Dependencies: proto/bcmeth.h
+ *
+ * $Id: bcmevent.h 505096 2014-09-26 12:49:04Z $
+ *
+ */
+
+/*
+ * Broadcom Ethernet Events protocol defines
+ *
+ */
+
+#ifndef _BCMEVENT_H_
+#define _BCMEVENT_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+/* #include <ethernet.h> -- TODO: req., excluded to overwhelming coupling (break up ethernet.h) */
+#include <proto/bcmeth.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#define BCM_EVENT_MSG_VERSION		2	/* wl_event_msg_t struct version */
+#define BCM_MSG_IFNAME_MAX		16	/* max length of interface name */
+
+/* flags */
+#define WLC_EVENT_MSG_LINK		0x01	/* link is up */
+#define WLC_EVENT_MSG_FLUSHTXQ		0x02	/* flush tx queue on MIC error */
+#define WLC_EVENT_MSG_GROUP		0x04	/* group MIC error */
+#define WLC_EVENT_MSG_UNKBSS		0x08	/* unknown source bsscfg */
+#define WLC_EVENT_MSG_UNKIF		0x10	/* unknown source OS i/f */
+
+/* these fields are stored in network order */
+
+/* version 1 */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+	uint16	version;
+	uint16	flags;			/* see flags below */
+	uint32	event_type;		/* Message (see below) */
+	uint32	status;			/* Status code (see below) */
+	uint32	reason;			/* Reason code (if applicable) */
+	uint32	auth_type;		/* WLC_E_AUTH */
+	uint32	datalen;		/* data buf */
+	struct ether_addr	addr;	/* Station address (if applicable) */
+	char	ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+} BWL_POST_PACKED_STRUCT wl_event_msg_v1_t;
+
+/* the current version */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+	uint16	version;
+	uint16	flags;			/* see flags below */
+	uint32	event_type;		/* Message (see below) */
+	uint32	status;			/* Status code (see below) */
+	uint32	reason;			/* Reason code (if applicable) */
+	uint32	auth_type;		/* WLC_E_AUTH */
+	uint32	datalen;		/* data buf */
+	struct ether_addr	addr;	/* Station address (if applicable) */
+	char	ifname[BCM_MSG_IFNAME_MAX]; /* name of the packet incoming interface */
+	uint8	ifidx;			/* destination OS i/f index */
+	uint8	bsscfgidx;		/* source bsscfg index */
+} BWL_POST_PACKED_STRUCT wl_event_msg_t;
+
+/* used by driver msgs */
+typedef BWL_PRE_PACKED_STRUCT struct bcm_event {
+	struct ether_header eth;
+	bcmeth_hdr_t		bcm_hdr;
+	wl_event_msg_t		event;
+	/* data portion follows */
+} BWL_POST_PACKED_STRUCT bcm_event_t;
+
+#define BCM_MSG_LEN	(sizeof(bcm_event_t) - sizeof(bcmeth_hdr_t) - sizeof(struct ether_header))
+
+/* Event messages */
+#define WLC_E_SET_SSID		0	/* indicates status of set SSID */
+#define WLC_E_JOIN		1	/* differentiates join IBSS from found (WLC_E_START) IBSS */
+#define WLC_E_START		2	/* STA founded an IBSS or AP started a BSS */
+#define WLC_E_AUTH		3	/* 802.11 AUTH request */
+#define WLC_E_AUTH_IND		4	/* 802.11 AUTH indication */
+#define WLC_E_DEAUTH		5	/* 802.11 DEAUTH request */
+#define WLC_E_DEAUTH_IND	6	/* 802.11 DEAUTH indication */
+#define WLC_E_ASSOC		7	/* 802.11 ASSOC request */
+#define WLC_E_ASSOC_IND		8	/* 802.11 ASSOC indication */
+#define WLC_E_REASSOC		9	/* 802.11 REASSOC request */
+#define WLC_E_REASSOC_IND	10	/* 802.11 REASSOC indication */
+#define WLC_E_DISASSOC		11	/* 802.11 DISASSOC request */
+#define WLC_E_DISASSOC_IND	12	/* 802.11 DISASSOC indication */
+#define WLC_E_QUIET_START	13	/* 802.11h Quiet period started */
+#define WLC_E_QUIET_END		14	/* 802.11h Quiet period ended */
+#define WLC_E_BEACON_RX		15	/* BEACONS received/lost indication */
+#define WLC_E_LINK		16	/* generic link indication */
+#define WLC_E_MIC_ERROR		17	/* TKIP MIC error occurred */
+#define WLC_E_NDIS_LINK		18	/* NDIS style link indication */
+#define WLC_E_ROAM		19	/* roam attempt occurred: indicate status & reason */
+#define WLC_E_TXFAIL		20	/* change in dot11FailedCount (txfail) */
+#define WLC_E_PMKID_CACHE	21	/* WPA2 pmkid cache indication */
+#define WLC_E_RETROGRADE_TSF	22	/* current AP's TSF value went backward */
+#define WLC_E_PRUNE		23	/* AP was pruned from join list for reason */
+#define WLC_E_AUTOAUTH		24	/* report AutoAuth table entry match for join attempt */
+#define WLC_E_EAPOL_MSG		25	/* Event encapsulating an EAPOL message */
+#define WLC_E_SCAN_COMPLETE	26	/* Scan results are ready or scan was aborted */
+#define WLC_E_ADDTS_IND		27	/* indicate to host addts fail/success */
+#define WLC_E_DELTS_IND		28	/* indicate to host delts fail/success */
+#define WLC_E_BCNSENT_IND	29	/* indicate to host of beacon transmit */
+#define WLC_E_BCNRX_MSG		30	/* Send the received beacon up to the host */
+#define WLC_E_BCNLOST_MSG	31	/* indicate to host loss of beacon */
+#define WLC_E_ROAM_PREP		32	/* before attempting to roam */
+#define WLC_E_PFN_NET_FOUND	33	/* PFN network found event */
+#define WLC_E_PFN_NET_LOST	34	/* PFN network lost event */
+#define WLC_E_RESET_COMPLETE	35
+#define WLC_E_JOIN_START	36
+#define WLC_E_ROAM_START	37
+#define WLC_E_ASSOC_START	38
+#define WLC_E_IBSS_ASSOC	39
+#define WLC_E_RADIO		40
+#define WLC_E_PSM_WATCHDOG	41	/* PSM microcode watchdog fired */
+#if defined(BCMCCX) && defined(CCX_SDK)
+#define WLC_E_CCX_ASSOC_START	42	/* CCX association start */
+#define WLC_E_CCX_ASSOC_ABORT	43	/* CCX association abort */
+#endif /* BCMCCX && CCX_SDK */
+#define WLC_E_PROBREQ_MSG       44      /* probe request received */
+#define WLC_E_SCAN_CONFIRM_IND  45
+#define WLC_E_PSK_SUP		46	/* WPA Handshake fail */
+#define WLC_E_COUNTRY_CODE_CHANGED	47
+#define	WLC_E_EXCEEDED_MEDIUM_TIME	48	/* WMMAC excedded medium time */
+#define WLC_E_ICV_ERROR		49	/* WEP ICV error occurred */
+#define WLC_E_UNICAST_DECODE_ERROR	50	/* Unsupported unicast encrypted frame */
+#define WLC_E_MULTICAST_DECODE_ERROR	51	/* Unsupported multicast encrypted frame */
+#define WLC_E_TRACE		52
+#ifdef WLBTAMP
+#define WLC_E_BTA_HCI_EVENT	53	/* BT-AMP HCI event */
+#endif
+#define WLC_E_IF		54	/* I/F change (for dongle host notification) */
+#define WLC_E_P2P_DISC_LISTEN_COMPLETE	55	/* listen state expires */
+#define WLC_E_RSSI		56	/* indicate RSSI change based on configured levels */
+#define WLC_E_PFN_SCAN_COMPLETE	57	/* PFN completed scan of network list */
+/* PFN best network batching event, re-use obsolete WLC_E_PFN_SCAN_COMPLETE */
+#define WLC_E_PFN_BEST_BATCHING	57
+#define WLC_E_EXTLOG_MSG	58
+#define WLC_E_ACTION_FRAME      59	/* Action frame Rx */
+#define WLC_E_ACTION_FRAME_COMPLETE	60	/* Action frame Tx complete */
+#define WLC_E_PRE_ASSOC_IND	61	/* assoc request received */
+#define WLC_E_PRE_REASSOC_IND	62	/* re-assoc request received */
+#define WLC_E_CHANNEL_ADOPTED	63
+#define WLC_E_AP_STARTED	64	/* AP started */
+#define WLC_E_DFS_AP_STOP	65	/* AP stopped due to DFS */
+#define WLC_E_DFS_AP_RESUME	66	/* AP resumed due to DFS */
+#define WLC_E_WAI_STA_EVENT	67	/* WAI stations event */
+#define WLC_E_WAI_MSG 		68	/* event encapsulating an WAI message */
+#define WLC_E_ESCAN_RESULT 	69	/* escan result event */
+#define WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE 	70	/* action frame off channel complete */
+#define WLC_E_PROBRESP_MSG	71	/* probe response received */
+#define WLC_E_P2P_PROBREQ_MSG	72	/* P2P Probe request received */
+#define WLC_E_DCS_REQUEST	73
+#define WLC_E_FIFO_CREDIT_MAP	74	/* credits for D11 FIFOs. [AC0,AC1,AC2,AC3,BC_MC,ATIM] */
+#define WLC_E_ACTION_FRAME_RX	75	/* Received action frame event WITH
+					 * wl_event_rx_frame_data_t header
+					 */
+#define WLC_E_WAKE_EVENT	76	/* Wake Event timer fired, used for wake WLAN test mode */
+#define WLC_E_RM_COMPLETE	77	/* Radio measurement complete */
+#define WLC_E_HTSFSYNC		78	/* Synchronize TSF with the host */
+#define WLC_E_OVERLAY_REQ	79	/* request an overlay IOCTL/iovar from the host */
+#define WLC_E_CSA_COMPLETE_IND		80	/* 802.11 CHANNEL SWITCH ACTION completed */
+#define WLC_E_EXCESS_PM_WAKE_EVENT	81	/* excess PM Wake Event to inform host  */
+#define WLC_E_PFN_SCAN_NONE		82	/* no PFN networks around */
+/* PFN BSSID network found event, conflict/share with  WLC_E_PFN_SCAN_NONE */
+#define WLC_E_PFN_BSSID_NET_FOUND	82
+#define WLC_E_PFN_SCAN_ALLGONE		83	/* last found PFN network gets lost */
+/* PFN BSSID network lost event, conflict/share with WLC_E_PFN_SCAN_ALLGONE */
+#define WLC_E_PFN_BSSID_NET_LOST	83
+#define WLC_E_GTK_PLUMBED		84
+#define WLC_E_ASSOC_IND_NDIS		85	/* 802.11 ASSOC indication for NDIS only */
+#define WLC_E_REASSOC_IND_NDIS		86	/* 802.11 REASSOC indication for NDIS only */
+#define WLC_E_ASSOC_REQ_IE		87
+#define WLC_E_ASSOC_RESP_IE		88
+#define WLC_E_ASSOC_RECREATED		89	/* association recreated on resume */
+#define WLC_E_ACTION_FRAME_RX_NDIS	90	/* rx action frame event for NDIS only */
+#define WLC_E_AUTH_REQ			91	/* authentication request received */
+#define WLC_E_TDLS_PEER_EVENT		92	/* discovered peer, connected/disconnected peer */
+#define WLC_E_SPEEDY_RECREATE_FAIL	93	/* fast assoc recreation failed */
+#define WLC_E_NATIVE			94	/* port-specific event and payload (e.g. NDIS) */
+#define WLC_E_PKTDELAY_IND		95	/* event for tx pkt delay suddently jump */
+#define WLC_E_PSTA_PRIMARY_INTF_IND	99	/* psta primary interface indication */
+#define WLC_E_NAN			100     /* NAN event */
+#define WLC_E_BEACON_FRAME_RX		101
+#define WLC_E_SERVICE_FOUND		102	/* desired service found */
+#define WLC_E_GAS_FRAGMENT_RX		103	/* GAS fragment received */
+#define WLC_E_GAS_COMPLETE		104	/* GAS sessions all complete */
+#define WLC_E_P2PO_ADD_DEVICE		105	/* New device found by p2p offload */
+#define WLC_E_P2PO_DEL_DEVICE		106	/* device has been removed by p2p offload */
+#define WLC_E_WNM_STA_SLEEP		107	/* WNM event to notify STA enter sleep mode */
+#define WLC_E_TXFAIL_THRESH		108	/* Indication of MAC tx failures (exhaustion of
+						 * 802.11 retries) exceeding threshold(s)
+						 */
+#define WLC_E_PROXD			109	/* Proximity Detection event */
+#define WLC_E_IBSS_COALESCE		110	/* IBSS Coalescing */
+#define WLC_E_AIBSS_TXFAIL		110	/* TXFAIL event for AIBSS, re using event 110 */
+#define WLC_E_BSS_LOAD			114	/* Inform host of beacon bss load */
+#define WLC_E_CSA_START_IND		121
+#define WLC_E_CSA_DONE_IND		122
+#define WLC_E_CSA_FAILURE_IND		123
+#define WLC_E_CCA_CHAN_QUAL		124	/* CCA based channel quality report */
+#define WLC_E_BSSID		125	/* to report change in BSSID while roaming */
+#define WLC_E_TX_STAT_ERROR		126	/* tx error indication */
+#define WLC_E_BCMC_CREDIT_SUPPORT	127	/* credit check for BCMC supported */
+#define WLC_E_BT_WIFI_HANDOVER_REQ	130	/* Handover Request Initiated */
+#define WLC_E_SPW_TXINHIBIT		131     /* Southpaw TxInhibit notification */
+#define WLC_E_FBT_AUTH_REQ_IND		132	/* FBT Authentication Request Indication */
+#define WLC_E_RSSI_LQM			133	/* Enhancement addition for WLC_E_RSSI */
+#define WLC_E_PFN_GSCAN_FULL_RESULT		134 /* Full probe/beacon (IEs etc) results */
+#define WLC_E_PFN_SWC		135 /* Significant change in rssi of bssids being tracked */
+#define WLC_E_RMC_EVENT			139	/* RMC event */
+#define WLC_E_LAST			140	/* highest val + 1 for range checking */
+
+#if (WLC_E_LAST > 140)
+#error "WLC_E_LAST: Invalid value for last event; must be <= 140."
+#endif /* WLC_E_LAST */
+
+/* define an API for getting the string name of an event */
+extern const char *bcmevent_get_name(uint event_type);
+
+
+
+/* Event status codes */
+#define WLC_E_STATUS_SUCCESS		0	/* operation was successful */
+#define WLC_E_STATUS_FAIL		1	/* operation failed */
+#define WLC_E_STATUS_TIMEOUT		2	/* operation timed out */
+#define WLC_E_STATUS_NO_NETWORKS	3	/* failed due to no matching network found */
+#define WLC_E_STATUS_ABORT		4	/* operation was aborted */
+#define WLC_E_STATUS_NO_ACK		5	/* protocol failure: packet not ack'd */
+#define WLC_E_STATUS_UNSOLICITED	6	/* AUTH or ASSOC packet was unsolicited */
+#define WLC_E_STATUS_ATTEMPT		7	/* attempt to assoc to an auto auth configuration */
+#define WLC_E_STATUS_PARTIAL		8	/* scan results are incomplete */
+#define WLC_E_STATUS_NEWSCAN		9	/* scan aborted by another scan */
+#define WLC_E_STATUS_NEWASSOC		10	/* scan aborted due to assoc in progress */
+#define WLC_E_STATUS_11HQUIET		11	/* 802.11h quiet period started */
+#define WLC_E_STATUS_SUPPRESS		12	/* user disabled scanning (WLC_SET_SCANSUPPRESS) */
+#define WLC_E_STATUS_NOCHANS		13	/* no allowable channels to scan */
+#ifdef BCMCCX
+#define WLC_E_STATUS_CCXFASTRM		14	/* scan aborted due to CCX fast roam */
+#endif /* BCMCCX */
+#define WLC_E_STATUS_CS_ABORT		15	/* abort channel select */
+#define WLC_E_STATUS_ERROR		16	/* request failed due to error */
+#define WLC_E_STATUS_INVALID 0xff  /* Invalid status code to init variables. */
+
+
+/* roam reason codes */
+#define WLC_E_REASON_INITIAL_ASSOC	0	/* initial assoc */
+#define WLC_E_REASON_LOW_RSSI		1	/* roamed due to low RSSI */
+#define WLC_E_REASON_DEAUTH		2	/* roamed due to DEAUTH indication */
+#define WLC_E_REASON_DISASSOC		3	/* roamed due to DISASSOC indication */
+#define WLC_E_REASON_BCNS_LOST		4	/* roamed due to lost beacons */
+
+/* Roam codes used primarily by CCX */
+#define WLC_E_REASON_FAST_ROAM_FAILED	5	/* roamed due to fast roam failure */
+#define WLC_E_REASON_DIRECTED_ROAM	6	/* roamed due to request by AP */
+#define WLC_E_REASON_TSPEC_REJECTED	7	/* roamed due to TSPEC rejection */
+#define WLC_E_REASON_BETTER_AP		8	/* roamed due to finding better AP */
+#define WLC_E_REASON_MINTXRATE		9	/* roamed because at mintxrate for too long */
+#define WLC_E_REASON_TXFAIL		10	/* We can hear AP, but AP can't hear us */
+/* retained for precommit auto-merging errors; remove once all branches are synced */
+#define WLC_E_REASON_REQUESTED_ROAM	11
+#define WLC_E_REASON_BSSTRANS_REQ	11	/* roamed due to BSS Transition request by AP */
+
+/* prune reason codes */
+#define WLC_E_PRUNE_ENCR_MISMATCH	1	/* encryption mismatch */
+#define WLC_E_PRUNE_BCAST_BSSID		2	/* AP uses a broadcast BSSID */
+#define WLC_E_PRUNE_MAC_DENY		3	/* STA's MAC addr is in AP's MAC deny list */
+#define WLC_E_PRUNE_MAC_NA		4	/* STA's MAC addr is not in AP's MAC allow list */
+#define WLC_E_PRUNE_REG_PASSV		5	/* AP not allowed due to regulatory restriction */
+#define WLC_E_PRUNE_SPCT_MGMT		6	/* AP does not support STA locale spectrum mgmt */
+#define WLC_E_PRUNE_RADAR		7	/* AP is on a radar channel of STA locale */
+#define WLC_E_RSN_MISMATCH		8	/* STA does not support AP's RSN */
+#define WLC_E_PRUNE_NO_COMMON_RATES	9	/* No rates in common with AP */
+#define WLC_E_PRUNE_BASIC_RATES		10	/* STA does not support all basic rates of BSS */
+#ifdef BCMCCX
+#define WLC_E_PRUNE_CCXFAST_PREVAP	11	/* CCX FAST ROAM: prune previous AP */
+#endif /* def BCMCCX */
+#define WLC_E_PRUNE_CIPHER_NA		12	/* BSS's cipher not supported */
+#define WLC_E_PRUNE_KNOWN_STA		13	/* AP is already known to us as a STA */
+#ifdef BCMCCX
+#define WLC_E_PRUNE_CCXFAST_DROAM	14	/* CCX FAST ROAM: prune unqualified AP */
+#endif /* def BCMCCX */
+#define WLC_E_PRUNE_WDS_PEER		15	/* AP is already known to us as a WDS peer */
+#define WLC_E_PRUNE_QBSS_LOAD		16	/* QBSS LOAD - AAC is too low */
+#define WLC_E_PRUNE_HOME_AP		17	/* prune home AP */
+#ifdef BCMCCX
+#define WLC_E_PRUNE_AP_BLOCKED		18	/* prune blocked AP */
+#define WLC_E_PRUNE_NO_DIAG_SUPPORT	19	/* prune due to diagnostic mode not supported */
+#endif /* BCMCCX */
+
+/* WPA failure reason codes carried in the WLC_E_PSK_SUP event */
+#define WLC_E_SUP_OTHER			0	/* Other reason */
+#define WLC_E_SUP_DECRYPT_KEY_DATA	1	/* Decryption of key data failed */
+#define WLC_E_SUP_BAD_UCAST_WEP128	2	/* Illegal use of ucast WEP128 */
+#define WLC_E_SUP_BAD_UCAST_WEP40	3	/* Illegal use of ucast WEP40 */
+#define WLC_E_SUP_UNSUP_KEY_LEN		4	/* Unsupported key length */
+#define WLC_E_SUP_PW_KEY_CIPHER		5	/* Unicast cipher mismatch in pairwise key */
+#define WLC_E_SUP_MSG3_TOO_MANY_IE	6	/* WPA IE contains > 1 RSN IE in key msg 3 */
+#define WLC_E_SUP_MSG3_IE_MISMATCH	7	/* WPA IE mismatch in key message 3 */
+#define WLC_E_SUP_NO_INSTALL_FLAG	8	/* INSTALL flag unset in 4-way msg */
+#define WLC_E_SUP_MSG3_NO_GTK		9	/* encapsulated GTK missing from msg 3 */
+#define WLC_E_SUP_GRP_KEY_CIPHER	10	/* Multicast cipher mismatch in group key */
+#define WLC_E_SUP_GRP_MSG1_NO_GTK	11	/* encapsulated GTK missing from group msg 1 */
+#define WLC_E_SUP_GTK_DECRYPT_FAIL	12	/* GTK decrypt failure */
+#define WLC_E_SUP_SEND_FAIL		13	/* message send failure */
+#define WLC_E_SUP_DEAUTH		14	/* received FC_DEAUTH */
+#define WLC_E_SUP_WPA_PSK_TMO		15	/* WPA PSK 4-way handshake timeout */
+
+/* Event data for events that include frames received over the air */
+/* WLC_E_PROBRESP_MSG
+ * WLC_E_P2P_PROBREQ_MSG
+ * WLC_E_ACTION_FRAME_RX
+ */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_rx_frame_data {
+	uint16	version;
+	uint16	channel;	/* Matches chanspec_t format from bcmwifi_channels.h */
+	int32	rssi;
+	uint32	mactime;
+	uint32	rate;
+} BWL_POST_PACKED_STRUCT wl_event_rx_frame_data_t;
+
+#define BCM_RX_FRAME_DATA_VERSION 1
+
+/* WLC_E_IF event data */
+typedef struct wl_event_data_if {
+	uint8 ifidx;		/* RTE virtual device index (for dongle) */
+	uint8 opcode;		/* see I/F opcode */
+	uint8 reserved;		/* bit mask (WLC_E_IF_FLAGS_XXX ) */
+	uint8 bssidx;		/* bsscfg index */
+	uint8 role;		/* see I/F role */
+} wl_event_data_if_t;
+
+/* opcode in WLC_E_IF event */
+#define WLC_E_IF_ADD		1	/* bsscfg add */
+#define WLC_E_IF_DEL		2	/* bsscfg delete */
+#define WLC_E_IF_CHANGE		3	/* bsscfg role change */
+
+/* I/F role code in WLC_E_IF event */
+#define WLC_E_IF_ROLE_STA		0	/* Infra STA */
+#define WLC_E_IF_ROLE_AP		1	/* Access Point */
+#define WLC_E_IF_ROLE_WDS		2	/* WDS link */
+#define WLC_E_IF_ROLE_P2P_GO		3	/* P2P Group Owner */
+#define WLC_E_IF_ROLE_P2P_CLIENT	4	/* P2P Client */
+#ifdef WLBTAMP
+#define WLC_E_IF_ROLE_BTA_CREATOR	5	/* BT-AMP Creator */
+#define WLC_E_IF_ROLE_BTA_ACCEPTOR	6	/* BT-AMP Acceptor */
+#endif
+
+/* WLC_E_RSSI event data */
+typedef struct wl_event_data_rssi {
+	int32 rssi;
+	int32 snr;
+	int32 noise;
+} wl_event_data_rssi_t;
+
+/* WLC_E_IF flag */
+#define WLC_E_IF_FLAGS_BSSCFG_NOIF	0x1	/* no host I/F creation needed */
+
+/* Reason codes for LINK */
+#define WLC_E_LINK_BCN_LOSS	1	/* Link down because of beacon loss */
+#define WLC_E_LINK_DISASSOC	2	/* Link down because of disassoc */
+#define WLC_E_LINK_ASSOC_REC	3	/* Link down because assoc recreate failed */
+#define WLC_E_LINK_BSSCFG_DIS	4	/* Link down due to bsscfg down */
+
+/* reason codes for WLC_E_OVERLAY_REQ event */
+#define WLC_E_OVL_DOWNLOAD		0	/* overlay download request */
+#define WLC_E_OVL_UPDATE_IND	1	/* device indication of host overlay update */
+
+/* reason codes for WLC_E_TDLS_PEER_EVENT event */
+#define WLC_E_TDLS_PEER_DISCOVERED		0	/* peer is ready to establish TDLS */
+#define WLC_E_TDLS_PEER_CONNECTED		1
+#define WLC_E_TDLS_PEER_DISCONNECTED	2
+
+/* reason codes for WLC_E_RMC_EVENT event */
+#define WLC_E_REASON_RMC_NONE		0
+#define WLC_E_REASON_RMC_AR_LOST		1
+#define WLC_E_REASON_RMC_AR_NO_ACK		2
+
+#ifdef WLTDLS
+/* TDLS Action Category code */
+#define TDLS_AF_CATEGORY		12
+/* Wi-Fi Display (WFD) Vendor Specific Category */
+/* used for WFD Tunneled Probe Request and Response */
+#define TDLS_VENDOR_SPECIFIC					127
+/* TDLS Action Field Values */
+#define TDLS_ACTION_SETUP_REQ					0
+#define TDLS_ACTION_SETUP_RESP					1
+#define TDLS_ACTION_SETUP_CONFIRM				2
+#define TDLS_ACTION_TEARDOWN					3
+#define WLAN_TDLS_SET_PROBE_WFD_IE		 11
+#define WLAN_TDLS_SET_SETUP_WFD_IE		 12
+#endif
+
+
+/* GAS event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_gas {
+	uint16	channel;		/* channel of GAS protocol */
+	uint8	dialog_token;	/* GAS dialog token */
+	uint8	fragment_id;	/* fragment id */
+	uint16	status_code;	/* status code on GAS completion */
+	uint16 	data_len;		/* length of data to follow */
+	uint8	data[1];		/* variable length specified by data_len */
+} BWL_POST_PACKED_STRUCT wl_event_gas_t;
+
+/* service discovery TLV */
+typedef BWL_PRE_PACKED_STRUCT struct wl_sd_tlv {
+	uint16	length;			/* length of response_data */
+	uint8	protocol;		/* service protocol type */
+	uint8	transaction_id;		/* service transaction id */
+	uint8	status_code;		/* status code */
+	uint8	data[1];		/* response data */
+} BWL_POST_PACKED_STRUCT wl_sd_tlv_t;
+
+/* service discovery event data */
+typedef BWL_PRE_PACKED_STRUCT struct wl_event_sd {
+	uint16	channel;		/* channel */
+	uint8	count;			/* number of tlvs */
+	wl_sd_tlv_t	tlv[1];		/* service discovery TLV */
+} BWL_POST_PACKED_STRUCT wl_event_sd_t;
+
+/* Reason codes for WLC_E_PROXD */
+#define WLC_E_PROXD_FOUND		1	/* Found a proximity device */
+#define WLC_E_PROXD_GONE		2	/* Lost a proximity device */
+#define WLC_E_PROXD_START		3	/* used by: target  */
+#define WLC_E_PROXD_STOP		4	/* used by: target   */
+#define WLC_E_PROXD_COMPLETED		5	/* used by: initiator completed */
+#define WLC_E_PROXD_ERROR		6	/* used by both initiator and target */
+#define WLC_E_PROXD_COLLECT_START	7	/* used by: target & initiator */
+#define WLC_E_PROXD_COLLECT_STOP	8	/* used by: target */
+#define WLC_E_PROXD_COLLECT_COMPLETED	9	/* used by: initiator completed */
+#define WLC_E_PROXD_COLLECT_ERROR	10	/* used by both initiator and target */
+#define WLC_E_PROXD_NAN_EVENT		11	/* used by both initiator and target */
+
+/*  proxd_event data */
+typedef struct ftm_sample {
+	uint32 value;	/* RTT in ns */
+	int8 rssi;	/* RSSI */
+} ftm_sample_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct proxd_event_data {
+	uint16 ver;			/* version */
+	uint16 mode;			/* mode: target/initiator */
+	uint16 method;			/* method: rssi/TOF/AOA */
+	uint8  err_code;		/* error classification */
+	uint8  TOF_type;		/* one way or two way TOF */
+	uint8  OFDM_frame_type;		/* legacy or VHT */
+	uint8  bandwidth;		/* Bandwidth is 20, 40,80, MHZ */
+	struct ether_addr peer_mac;	/* (e.g for tgt:initiator's */
+	uint32 distance;		/* dst to tgt, units meter */
+	uint32 meanrtt;			/* mean delta */
+	uint32 modertt;			/* Mode delta */
+	uint32 medianrtt;		/* median RTT */
+	uint32 sdrtt;			/* Standard deviation of RTT */
+	int    gdcalcresult;		/* Software or Hardware Kind of redundant, but if */
+					/* frame type is VHT, then we should do it by hardware */
+	int16  avg_rssi;		/* avg rssi accroos the ftm frames */
+	int16  validfrmcnt;		/* Firmware's valid frame counts */
+	char  *peer_router_info;	/* Peer router information if available in TLV, */
+					/* We will add this field later  */
+	int32 var1;			/* average of group delay */
+	int32 var2;			/* average of threshold crossing */
+	int32 var3;			/* difference between group delay and threshold crossing */
+					/* raw Fine Time Measurements (ftm) data */
+	uint16 ftm_unit;		/* ftm cnt resolution in picoseconds , 6250ps - default */
+	uint16 ftm_cnt;			/*  num of rtd measurments/length in the ftm buffer  */
+	ftm_sample_t ftm_buff[1];	/* 1 ... ftm_cnt  */
+} BWL_POST_PACKED_STRUCT wl_proxd_event_data_t;
+
+
+/* Video Traffic Interference Monitor Event */
+#define INTFER_EVENT_VERSION		1
+#define INTFER_STREAM_TYPE_NONTCP	1
+#define INTFER_STREAM_TYPE_TCP		2
+#define WLINTFER_STATS_NSMPLS		4
+typedef struct wl_intfer_event {
+	uint16 version;			/* version */
+	uint16 status;			/* status */
+	uint8 txfail_histo[WLINTFER_STATS_NSMPLS]; /* txfail histo */
+} wl_intfer_event_t;
+
+/* WLC_E_PSTA_PRIMARY_INTF_IND event data */
+typedef struct wl_psta_primary_intf_event {
+	struct ether_addr prim_ea;	/* primary intf ether addr */
+} wl_psta_primary_intf_event_t;
+
+
+/*  **********  NAN protocol events/subevents  ********** */
+#define NAN_EVENT_BUFFER_SIZE 512 /* max size */
+/* nan application events to the host driver */
+enum nan_app_events {
+	WL_NAN_EVENT_START = 1,     /* NAN cluster started */
+	WL_NAN_EVENT_JOIN = 2,      /* Joined to a NAN cluster */
+	WL_NAN_EVENT_ROLE = 3,      /* Role or State changed */
+	WL_NAN_EVENT_SCAN_COMPLETE = 4,
+	WL_NAN_EVENT_DISCOVERY_RESULT = 5,
+	WL_NAN_EVENT_REPLIED = 6,
+	WL_NAN_EVENT_TERMINATED = 7,	/* the instance ID will be present in the ev data */
+	WL_NAN_EVENT_RECEIVE = 8,
+	WL_NAN_EVENT_STATUS_CHG = 9,  /* generated on any change in nan_mac status */
+	WL_NAN_EVENT_MERGE = 10,      /* Merged to a NAN cluster */
+	WL_NAN_EVENT_STOP = 11,       /* NAN stopped */
+	WL_NAN_EVENT_INVALID = 12,	/* delimiter for max value */
+};
+#define IS_NAN_EVT_ON(var, evt) ((var & (1 << (evt-1))) != 0)
+/*  ******************* end of NAN section *************** */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _BCMEVENT_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmip.h b/drivers/net/wireless/bcm4336/include/proto/bcmip.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmip.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmip.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,227 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Fundamental constants relating to IP Protocol
+ *
+ * $Id: bcmip.h 458522 2014-02-27 02:26:15Z $
+ */
+
+#ifndef _bcmip_h_
+#define _bcmip_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* IPV4 and IPV6 common */
+#define IP_VER_OFFSET		0x0	/* offset to version field */
+#define IP_VER_MASK		0xf0	/* version mask */
+#define IP_VER_SHIFT		4	/* version shift */
+#define IP_VER_4		4	/* version number for IPV4 */
+#define IP_VER_6		6	/* version number for IPV6 */
+
+#define IP_VER(ip_body) \
+	((((uint8 *)(ip_body))[IP_VER_OFFSET] & IP_VER_MASK) >> IP_VER_SHIFT)
+
+#define IP_PROT_ICMP		0x1	/* ICMP protocol */
+#define IP_PROT_IGMP		0x2	/* IGMP protocol */
+#define IP_PROT_TCP		0x6	/* TCP protocol */
+#define IP_PROT_UDP		0x11	/* UDP protocol type */
+#define IP_PROT_ICMP6		0x3a	/* ICMPv6 protocol type */
+
+/* IPV4 field offsets */
+#define IPV4_VER_HL_OFFSET      0       /* version and ihl byte offset */
+#define IPV4_TOS_OFFSET         1       /* type of service offset */
+#define IPV4_PKTLEN_OFFSET      2       /* packet length offset */
+#define IPV4_PKTFLAG_OFFSET     6       /* more-frag,dont-frag flag offset */
+#define IPV4_PROT_OFFSET        9       /* protocol type offset */
+#define IPV4_CHKSUM_OFFSET      10      /* IP header checksum offset */
+#define IPV4_SRC_IP_OFFSET      12      /* src IP addr offset */
+#define IPV4_DEST_IP_OFFSET     16      /* dest IP addr offset */
+#define IPV4_OPTIONS_OFFSET     20      /* IP options offset */
+#define IPV4_MIN_HEADER_LEN     20      /* Minimum size for an IP header (no options) */
+
+/* IPV4 field decodes */
+#define IPV4_VER_MASK		0xf0	/* IPV4 version mask */
+#define IPV4_VER_SHIFT		4	/* IPV4 version shift */
+
+#define IPV4_HLEN_MASK		0x0f	/* IPV4 header length mask */
+#define IPV4_HLEN(ipv4_body)	(4 * (((uint8 *)(ipv4_body))[IPV4_VER_HL_OFFSET] & IPV4_HLEN_MASK))
+
+#define IPV4_ADDR_LEN		4	/* IPV4 address length */
+
+#define IPV4_ADDR_NULL(a)	((((uint8 *)(a))[0] | ((uint8 *)(a))[1] | \
+				  ((uint8 *)(a))[2] | ((uint8 *)(a))[3]) == 0)
+
+#define IPV4_ADDR_BCAST(a)	((((uint8 *)(a))[0] & ((uint8 *)(a))[1] & \
+				  ((uint8 *)(a))[2] & ((uint8 *)(a))[3]) == 0xff)
+
+#define	IPV4_TOS_DSCP_MASK	0xfc	/* DiffServ codepoint mask */
+#define	IPV4_TOS_DSCP_SHIFT	2	/* DiffServ codepoint shift */
+
+#define	IPV4_TOS(ipv4_body)	(((uint8 *)(ipv4_body))[IPV4_TOS_OFFSET])
+
+#define	IPV4_TOS_PREC_MASK	0xe0	/* Historical precedence mask */
+#define	IPV4_TOS_PREC_SHIFT	5	/* Historical precedence shift */
+
+#define IPV4_TOS_LOWDELAY	0x10	/* Lowest delay requested */
+#define IPV4_TOS_THROUGHPUT	0x8	/* Best throughput requested */
+#define IPV4_TOS_RELIABILITY	0x4	/* Most reliable delivery requested */
+
+#define IPV4_TOS_ROUTINE        0
+#define IPV4_TOS_PRIORITY       1
+#define IPV4_TOS_IMMEDIATE      2
+#define IPV4_TOS_FLASH          3
+#define IPV4_TOS_FLASHOVERRIDE  4
+#define IPV4_TOS_CRITICAL       5
+#define IPV4_TOS_INETWORK_CTRL  6
+#define IPV4_TOS_NETWORK_CTRL   7
+
+#define IPV4_PROT(ipv4_body)	(((uint8 *)(ipv4_body))[IPV4_PROT_OFFSET])
+
+#define IPV4_FRAG_RESV		0x8000	/* Reserved */
+#define IPV4_FRAG_DONT		0x4000	/* Don't fragment */
+#define IPV4_FRAG_MORE		0x2000	/* More fragments */
+#define IPV4_FRAG_OFFSET_MASK	0x1fff	/* Fragment offset */
+
+#define IPV4_ADDR_STR_LEN	16	/* Max IP address length in string format */
+
+/* IPV4 packet formats */
+BWL_PRE_PACKED_STRUCT struct ipv4_addr {
+	uint8	addr[IPV4_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv4_hdr {
+	uint8	version_ihl;		/* Version and Internet Header Length */
+	uint8	tos;			/* Type Of Service */
+	uint16	tot_len;		/* Number of bytes in packet (max 65535) */
+	uint16	id;
+	uint16	frag;			/* 3 flag bits and fragment offset */
+	uint8	ttl;			/* Time To Live */
+	uint8	prot;			/* Protocol */
+	uint16	hdr_chksum;		/* IP header checksum */
+	uint8	src_ip[IPV4_ADDR_LEN];	/* Source IP Address */
+	uint8	dst_ip[IPV4_ADDR_LEN];	/* Destination IP Address */
+} BWL_POST_PACKED_STRUCT;
+
+/* IPV6 field offsets */
+#define IPV6_PAYLOAD_LEN_OFFSET	4	/* payload length offset */
+#define IPV6_NEXT_HDR_OFFSET	6	/* next header/protocol offset */
+#define IPV6_HOP_LIMIT_OFFSET	7	/* hop limit offset */
+#define IPV6_SRC_IP_OFFSET	8	/* src IP addr offset */
+#define IPV6_DEST_IP_OFFSET	24	/* dst IP addr offset */
+
+/* IPV6 field decodes */
+#define IPV6_TRAFFIC_CLASS(ipv6_body) \
+	(((((uint8 *)(ipv6_body))[0] & 0x0f) << 4) | \
+	 ((((uint8 *)(ipv6_body))[1] & 0xf0) >> 4))
+
+#define IPV6_FLOW_LABEL(ipv6_body) \
+	(((((uint8 *)(ipv6_body))[1] & 0x0f) << 16) | \
+	 (((uint8 *)(ipv6_body))[2] << 8) | \
+	 (((uint8 *)(ipv6_body))[3]))
+
+#define IPV6_PAYLOAD_LEN(ipv6_body) \
+	((((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 0] << 8) | \
+	 ((uint8 *)(ipv6_body))[IPV6_PAYLOAD_LEN_OFFSET + 1])
+
+#define IPV6_NEXT_HDR(ipv6_body) \
+	(((uint8 *)(ipv6_body))[IPV6_NEXT_HDR_OFFSET])
+
+#define IPV6_PROT(ipv6_body)	IPV6_NEXT_HDR(ipv6_body)
+
+#define IPV6_ADDR_LEN		16	/* IPV6 address length */
+
+/* IPV4 TOS or IPV6 Traffic Classifier or 0 */
+#define IP_TOS46(ip_body) \
+	(IP_VER(ip_body) == IP_VER_4 ? IPV4_TOS(ip_body) : \
+	 IP_VER(ip_body) == IP_VER_6 ? IPV6_TRAFFIC_CLASS(ip_body) : 0)
+
+#define IP_DSCP46(ip_body) (IP_TOS46(ip_body) >> IPV4_TOS_DSCP_SHIFT);
+
+/* IPV4 or IPV6 Protocol Classifier or 0 */
+#define IP_PROT46(ip_body) \
+	(IP_VER(ip_body) == IP_VER_4 ? IPV4_PROT(ip_body) : \
+	 IP_VER(ip_body) == IP_VER_6 ? IPV6_PROT(ip_body) : 0)
+
+/* IPV6 extension headers (options) */
+#define IPV6_EXTHDR_HOP		0
+#define IPV6_EXTHDR_ROUTING	43
+#define IPV6_EXTHDR_FRAGMENT	44
+#define IPV6_EXTHDR_AUTH	51
+#define IPV6_EXTHDR_NONE	59
+#define IPV6_EXTHDR_DEST	60
+
+#define IPV6_EXTHDR(prot)	(((prot) == IPV6_EXTHDR_HOP) || \
+	                         ((prot) == IPV6_EXTHDR_ROUTING) || \
+	                         ((prot) == IPV6_EXTHDR_FRAGMENT) || \
+	                         ((prot) == IPV6_EXTHDR_AUTH) || \
+	                         ((prot) == IPV6_EXTHDR_NONE) || \
+	                         ((prot) == IPV6_EXTHDR_DEST))
+
+#define IPV6_MIN_HLEN 		40
+
+#define IPV6_EXTHDR_LEN(eh)	((((struct ipv6_exthdr *)(eh))->hdrlen + 1) << 3)
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr {
+	uint8	nexthdr;
+	uint8	hdrlen;
+} BWL_POST_PACKED_STRUCT;
+
+BWL_PRE_PACKED_STRUCT struct ipv6_exthdr_frag {
+	uint8	nexthdr;
+	uint8	rsvd;
+	uint16	frag_off;
+	uint32	ident;
+} BWL_POST_PACKED_STRUCT;
+
+static INLINE int32
+ipv6_exthdr_len(uint8 *h, uint8 *proto)
+{
+	uint16 len = 0, hlen;
+	struct ipv6_exthdr *eh = (struct ipv6_exthdr *)h;
+
+	while (IPV6_EXTHDR(eh->nexthdr)) {
+		if (eh->nexthdr == IPV6_EXTHDR_NONE)
+			return -1;
+		else if (eh->nexthdr == IPV6_EXTHDR_FRAGMENT)
+			hlen = 8;
+		else if (eh->nexthdr == IPV6_EXTHDR_AUTH)
+			hlen = (eh->hdrlen + 2) << 2;
+		else
+			hlen = IPV6_EXTHDR_LEN(eh);
+
+		len += hlen;
+		eh = (struct ipv6_exthdr *)(h + len);
+	}
+
+	*proto = eh->nexthdr;
+	return len;
+}
+
+#define IPV4_ISMULTI(a) (((a) & 0xf0000000) == 0xe0000000)
+
+#define IPV4_MCAST_TO_ETHER_MCAST(ipv4, ether) \
+{ \
+	ether[0] = 0x01; \
+	ether[1] = 0x00; \
+	ether[2] = 0x5E; \
+	ether[3] = (ipv4 & 0x7f0000) >> 16; \
+	ether[4] = (ipv4 & 0xff00) >> 8; \
+	ether[5] = (ipv4 & 0xff); \
+}
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#define IPV4_ADDR_STR "%d.%d.%d.%d"
+#define IPV4_ADDR_TO_STR(addr)	((uint32)addr & 0xff000000) >> 24, \
+								((uint32)addr & 0x00ff0000) >> 16, \
+								((uint32)addr & 0x0000ff00) >> 8, \
+								((uint32)addr & 0x000000ff)
+
+#endif	/* _bcmip_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmipv6.h b/drivers/net/wireless/bcm4336/include/proto/bcmipv6.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmipv6.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmipv6.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,142 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Fundamental constants relating to Neighbor Discovery Protocol
+ *
+ * $Id: bcmipv6.h 439574 2013-11-27 06:37:37Z $
+ */
+
+#ifndef _bcmipv6_h_
+#define _bcmipv6_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* Extension headers */
+#define IPV6_EXT_HOP	0
+#define IPV6_EXT_ROUTE	43
+#define IPV6_EXT_FRAG	44
+#define IPV6_EXT_DEST	60
+#define IPV6_EXT_ESEC	50
+#define IPV6_EXT_AUTH	51
+
+/* Minimum size (extension header "word" length) */
+#define IPV6_EXT_WORD	8
+
+/* Offsets for most extension headers */
+#define IPV6_EXT_NEXTHDR	0
+#define IPV6_EXT_HDRLEN		1
+
+/* Constants specific to fragmentation header */
+#define IPV6_FRAG_MORE_MASK	0x0001
+#define IPV6_FRAG_MORE_SHIFT	0
+#define IPV6_FRAG_OFFS_MASK	0xfff8
+#define IPV6_FRAG_OFFS_SHIFT	3
+
+/* For icmpv6 */
+#define ICMPV6_HEADER_TYPE	0x3A
+#define ICMPV6_PKT_TYPE_RA	134
+#define ICMPV6_PKT_TYPE_NS	135
+#define ICMPV6_PKT_TYPE_NA	136
+
+#define ICMPV6_ND_OPT_TYPE_TARGET_MAC	2
+#define ICMPV6_ND_OPT_TYPE_SRC_MAC		1
+
+#define ICMPV6_ND_OPT_LEN_LINKADDR		1
+
+#define ICMPV6_ND_OPT_LEN_LINKADDR		1
+
+#define IPV6_VERSION 	6
+#define IPV6_HOP_LIMIT 	255
+
+#define IPV6_ADDR_NULL(a)	((a[0] | a[1] | a[2] | a[3] | a[4] | \
+							 a[5] | a[6] | a[7] | a[8] | a[9] | \
+							 a[10] | a[11] | a[12] | a[13] | \
+							 a[14] | a[15]) == 0)
+
+#define IPV6_ADDR_LOCAL(a)	(((a[0] == 0xfe) && (a[1] & 0x80))? TRUE: FALSE)
+
+/* IPV6 address */
+BWL_PRE_PACKED_STRUCT struct ipv6_addr {
+		uint8		addr[16];
+} BWL_POST_PACKED_STRUCT;
+
+
+/* ICMPV6 Header */
+BWL_PRE_PACKED_STRUCT struct icmp6_hdr {
+	uint8	icmp6_type;
+	uint8	icmp6_code;
+	uint16	icmp6_cksum;
+	BWL_PRE_PACKED_STRUCT union {
+		uint32 reserved;
+		BWL_PRE_PACKED_STRUCT struct nd_advt {
+			uint32	reserved1:5,
+				override:1,
+				solicited:1,
+				router:1,
+				reserved2:24;
+		} BWL_POST_PACKED_STRUCT nd_advt;
+	} BWL_POST_PACKED_STRUCT opt;
+} BWL_POST_PACKED_STRUCT;
+
+/* Ipv6 Header Format */
+BWL_PRE_PACKED_STRUCT struct ipv6_hdr {
+	uint8	priority:4,
+		version:4;
+	uint8	flow_lbl[3];
+	uint16	payload_len;
+	uint8	nexthdr;
+	uint8 	hop_limit;
+	struct	ipv6_addr	saddr;
+	struct	ipv6_addr	daddr;
+} BWL_POST_PACKED_STRUCT;
+
+/* Neighbor Advertisement/Solicitation Packet Structure */
+BWL_PRE_PACKED_STRUCT struct nd_msg {
+	struct icmp6_hdr	icmph;
+	struct ipv6_addr target;
+} BWL_POST_PACKED_STRUCT;
+
+
+/* Neighibor Solicitation/Advertisement Optional Structure */
+BWL_PRE_PACKED_STRUCT struct nd_msg_opt {
+	uint8 type;
+	uint8 len;
+	uint8 mac_addr[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+
+/* Ipv6 Fragmentation Header */
+BWL_PRE_PACKED_STRUCT struct ipv6_frag {
+	uint8	nexthdr;
+	uint8	reserved;
+	uint16	frag_offset;
+	uint32	ident;
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+static const struct ipv6_addr all_node_ipv6_maddr = {
+									{ 0xff, 0x2, 0, 0,
+									0, 0, 0, 0,
+									0, 0, 0, 0,
+									0, 0, 0, 1
+									}};
+
+#define IPV6_ISMULTI(a) (a[0] == 0xff)
+
+#define IPV6_MCAST_TO_ETHER_MCAST(ipv6, ether) \
+{ \
+	ether[0] = 0x33; \
+	ether[1] = 0x33; \
+	ether[2] = ipv6[12]; \
+	ether[3] = ipv6[13]; \
+	ether[4] = ipv6[14]; \
+	ether[5] = ipv6[15]; \
+}
+
+#endif	/* !defined(_bcmipv6_h_) */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmtcp.h b/drivers/net/wireless/bcm4336/include/proto/bcmtcp.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmtcp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmtcp.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,72 @@
+/*
+ * Fundamental constants relating to TCP Protocol
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bcmtcp.h 458522 2014-02-27 02:26:15Z $
+ */
+
+#ifndef _bcmtcp_h_
+#define _bcmtcp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+#define TCP_SRC_PORT_OFFSET	0	/* TCP source port offset */
+#define TCP_DEST_PORT_OFFSET	2	/* TCP dest port offset */
+#define TCP_SEQ_NUM_OFFSET	4	/* TCP sequence number offset */
+#define TCP_ACK_NUM_OFFSET	8	/* TCP acknowledgement number offset */
+#define TCP_HLEN_OFFSET		12	/* HLEN and reserved bits offset */
+#define TCP_FLAGS_OFFSET	13	/* FLAGS and reserved bits offset */
+#define TCP_CHKSUM_OFFSET	16	/* TCP body checksum offset */
+
+#define TCP_PORT_LEN		2	/* TCP port field length */
+
+/* 8bit TCP flag field */
+#define TCP_FLAG_URG            0x20
+#define TCP_FLAG_ACK            0x10
+#define TCP_FLAG_PSH            0x08
+#define TCP_FLAG_RST            0x04
+#define TCP_FLAG_SYN            0x02
+#define TCP_FLAG_FIN            0x01
+
+#define TCP_HLEN_MASK           0xf000
+#define TCP_HLEN_SHIFT          12
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmtcp_hdr
+{
+	uint16	src_port;	/* Source Port Address */
+	uint16	dst_port;	/* Destination Port Address */
+	uint32	seq_num;	/* TCP Sequence Number */
+	uint32	ack_num;	/* TCP Sequence Number */
+	uint16	hdrlen_rsvd_flags;	/* Header length, reserved bits and flags */
+	uint16	tcpwin;		/* TCP window */
+	uint16	chksum;		/* Segment checksum with pseudoheader */
+	uint16	urg_ptr;	/* Points to seq-num of byte following urg data */
+} BWL_POST_PACKED_STRUCT;
+
+#define TCP_MIN_HEADER_LEN 20
+
+#define TCP_HDRLEN_MASK 0xf0
+#define TCP_HDRLEN_SHIFT 4
+#define TCP_HDRLEN(hdrlen) (((hdrlen) & TCP_HDRLEN_MASK) >> TCP_HDRLEN_SHIFT)
+
+#define TCP_FLAGS_MASK  0x1f
+#define TCP_FLAGS(hdrlen) ((hdrlen) & TCP_FLAGS_MASK)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+/* To address round up by 32bit. */
+#define IS_TCPSEQ_GE(a, b) ((a - b) < NBITVAL(31))		/* a >= b */
+#define IS_TCPSEQ_LE(a, b) ((b - a) < NBITVAL(31))		/* a =< b */
+#define IS_TCPSEQ_GT(a, b) !IS_TCPSEQ_LE(a, b)		/* a > b */
+#define IS_TCPSEQ_LT(a, b) !IS_TCPSEQ_GE(a, b)		/* a < b */
+
+#endif	/* #ifndef _bcmtcp_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bcmudp.h b/drivers/net/wireless/bcm4336/include/proto/bcmudp.h
--- a/drivers/net/wireless/bcm4336/include/proto/bcmudp.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bcmudp.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2014, Broadcom Corporation
+ * All Rights Reserved.
+ *
+ * This is UNPUBLISHED PROPRIETARY SOURCE CODE of Broadcom Corporation;
+ * the contents of this file may not be disclosed to third parties, copied
+ * or duplicated in any form, in whole or in part, without the prior
+ * written permission of Broadcom Corporation.
+ *
+ * Fundamental constants relating to UDP Protocol
+ *
+ * $Id: bcmudp.h 382882 2013-02-04 23:24:31Z $
+ */
+
+#ifndef _bcmudp_h_
+#define _bcmudp_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* UDP header */
+#define UDP_DEST_PORT_OFFSET	2	/* UDP dest port offset */
+#define UDP_LEN_OFFSET		4	/* UDP length offset */
+#define UDP_CHKSUM_OFFSET	6	/* UDP body checksum offset */
+
+#define UDP_HDR_LEN	8	/* UDP header length */
+#define UDP_PORT_LEN	2	/* UDP port length */
+
+/* These fields are stored in network order */
+BWL_PRE_PACKED_STRUCT struct bcmudp_hdr
+{
+	uint16	src_port;	/* Source Port Address */
+	uint16	dst_port;	/* Destination Port Address */
+	uint16	len;		/* Number of bytes in datagram including header */
+	uint16	chksum;		/* entire datagram checksum with pseudoheader */
+} BWL_POST_PACKED_STRUCT;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif	/* #ifndef _bcmudp_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/bt_amp_hci.h b/drivers/net/wireless/bcm4336/include/proto/bt_amp_hci.h
--- a/drivers/net/wireless/bcm4336/include/proto/bt_amp_hci.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/bt_amp_hci.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,423 @@
+/*
+ * BT-AMP (BlueTooth Alternate Mac and Phy) HCI (Host/Controller Interface)
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: bt_amp_hci.h 382882 2013-02-04 23:24:31Z $
+*/
+
+#ifndef _bt_amp_hci_h
+#define _bt_amp_hci_h
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* AMP HCI CMD packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_cmd {
+	uint16 opcode;
+	uint8 plen;
+	uint8 parms[1];
+} BWL_POST_PACKED_STRUCT amp_hci_cmd_t;
+
+#define HCI_CMD_PREAMBLE_SIZE		OFFSETOF(amp_hci_cmd_t, parms)
+#define HCI_CMD_DATA_SIZE		255
+
+/* AMP HCI CMD opcode layout */
+#define HCI_CMD_OPCODE(ogf, ocf)	((((ogf) & 0x3F) << 10) | ((ocf) & 0x03FF))
+#define HCI_CMD_OGF(opcode)		((uint8)(((opcode) >> 10) & 0x3F))
+#define HCI_CMD_OCF(opcode)		((opcode) & 0x03FF)
+
+/* AMP HCI command opcodes */
+#define HCI_Read_Failed_Contact_Counter		HCI_CMD_OPCODE(0x05, 0x0001)
+#define HCI_Reset_Failed_Contact_Counter	HCI_CMD_OPCODE(0x05, 0x0002)
+#define HCI_Read_Link_Quality			HCI_CMD_OPCODE(0x05, 0x0003)
+#define HCI_Read_Local_AMP_Info			HCI_CMD_OPCODE(0x05, 0x0009)
+#define HCI_Read_Local_AMP_ASSOC		HCI_CMD_OPCODE(0x05, 0x000A)
+#define HCI_Write_Remote_AMP_ASSOC		HCI_CMD_OPCODE(0x05, 0x000B)
+#define HCI_Create_Physical_Link		HCI_CMD_OPCODE(0x01, 0x0035)
+#define HCI_Accept_Physical_Link_Request	HCI_CMD_OPCODE(0x01, 0x0036)
+#define HCI_Disconnect_Physical_Link		HCI_CMD_OPCODE(0x01, 0x0037)
+#define HCI_Create_Logical_Link			HCI_CMD_OPCODE(0x01, 0x0038)
+#define HCI_Accept_Logical_Link			HCI_CMD_OPCODE(0x01, 0x0039)
+#define HCI_Disconnect_Logical_Link		HCI_CMD_OPCODE(0x01, 0x003A)
+#define HCI_Logical_Link_Cancel			HCI_CMD_OPCODE(0x01, 0x003B)
+#define HCI_Flow_Spec_Modify			HCI_CMD_OPCODE(0x01, 0x003C)
+#define HCI_Write_Flow_Control_Mode		HCI_CMD_OPCODE(0x01, 0x0067)
+#define HCI_Read_Best_Effort_Flush_Timeout	HCI_CMD_OPCODE(0x01, 0x0069)
+#define HCI_Write_Best_Effort_Flush_Timeout	HCI_CMD_OPCODE(0x01, 0x006A)
+#define HCI_Short_Range_Mode			HCI_CMD_OPCODE(0x01, 0x006B)
+#define HCI_Reset				HCI_CMD_OPCODE(0x03, 0x0003)
+#define HCI_Read_Connection_Accept_Timeout	HCI_CMD_OPCODE(0x03, 0x0015)
+#define HCI_Write_Connection_Accept_Timeout	HCI_CMD_OPCODE(0x03, 0x0016)
+#define HCI_Read_Link_Supervision_Timeout	HCI_CMD_OPCODE(0x03, 0x0036)
+#define HCI_Write_Link_Supervision_Timeout	HCI_CMD_OPCODE(0x03, 0x0037)
+#define HCI_Enhanced_Flush			HCI_CMD_OPCODE(0x03, 0x005F)
+#define HCI_Read_Logical_Link_Accept_Timeout	HCI_CMD_OPCODE(0x03, 0x0061)
+#define HCI_Write_Logical_Link_Accept_Timeout	HCI_CMD_OPCODE(0x03, 0x0062)
+#define HCI_Set_Event_Mask_Page_2		HCI_CMD_OPCODE(0x03, 0x0063)
+#define HCI_Read_Location_Data_Command		HCI_CMD_OPCODE(0x03, 0x0064)
+#define HCI_Write_Location_Data_Command		HCI_CMD_OPCODE(0x03, 0x0065)
+#define HCI_Read_Local_Version_Info		HCI_CMD_OPCODE(0x04, 0x0001)
+#define HCI_Read_Local_Supported_Commands	HCI_CMD_OPCODE(0x04, 0x0002)
+#define HCI_Read_Buffer_Size			HCI_CMD_OPCODE(0x04, 0x0005)
+#define HCI_Read_Data_Block_Size		HCI_CMD_OPCODE(0x04, 0x000A)
+
+/* AMP HCI command parameters */
+typedef BWL_PRE_PACKED_STRUCT struct read_local_cmd_parms {
+	uint8 plh;
+	uint8 offset[2];			/* length so far */
+	uint8 max_remote[2];
+} BWL_POST_PACKED_STRUCT read_local_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct write_remote_cmd_parms {
+	uint8 plh;
+	uint8 offset[2];
+	uint8 len[2];
+	uint8 frag[1];
+} BWL_POST_PACKED_STRUCT write_remote_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct phy_link_cmd_parms {
+	uint8 plh;
+	uint8 key_length;
+	uint8 key_type;
+	uint8 key[1];
+} BWL_POST_PACKED_STRUCT phy_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct dis_phy_link_cmd_parms {
+	uint8 plh;
+	uint8 reason;
+} BWL_POST_PACKED_STRUCT dis_phy_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cmd_parms {
+	uint8 plh;
+	uint8 txflow[16];
+	uint8 rxflow[16];
+} BWL_POST_PACKED_STRUCT log_link_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ext_flow_spec {
+	uint8 id;
+	uint8 service_type;
+	uint8 max_sdu[2];
+	uint8 sdu_ia_time[4];
+	uint8 access_latency[4];
+	uint8 flush_timeout[4];
+} BWL_POST_PACKED_STRUCT ext_flow_spec_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cancel_cmd_parms {
+	uint8 plh;
+	uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_cancel_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flow_spec_mod_cmd_parms {
+	uint8 llh[2];
+	uint8 txflow[16];
+	uint8 rxflow[16];
+} BWL_POST_PACKED_STRUCT flow_spec_mod_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct plh_pad {
+	uint8 plh;
+	uint8 pad;
+} BWL_POST_PACKED_STRUCT plh_pad_t;
+
+typedef BWL_PRE_PACKED_STRUCT union hci_handle {
+	uint16 bredr;
+	plh_pad_t amp;
+} BWL_POST_PACKED_STRUCT hci_handle_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ls_to_cmd_parms {
+	hci_handle_t handle;
+	uint8 timeout[2];
+} BWL_POST_PACKED_STRUCT ls_to_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct befto_cmd_parms {
+	uint8 llh[2];
+	uint8 befto[4];
+} BWL_POST_PACKED_STRUCT befto_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct srm_cmd_parms {
+	uint8 plh;
+	uint8 srm;
+} BWL_POST_PACKED_STRUCT srm_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ld_cmd_parms {
+	uint8 ld_aware;
+	uint8 ld[2];
+	uint8 ld_opts;
+	uint8 l_opts;
+} BWL_POST_PACKED_STRUCT ld_cmd_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct eflush_cmd_parms {
+	uint8 llh[2];
+	uint8 packet_type;
+} BWL_POST_PACKED_STRUCT eflush_cmd_parms_t;
+
+/* Generic AMP extended flow spec service types */
+#define EFS_SVCTYPE_NO_TRAFFIC		0
+#define EFS_SVCTYPE_BEST_EFFORT		1
+#define EFS_SVCTYPE_GUARANTEED		2
+
+/* AMP HCI event packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_event {
+	uint8 ecode;
+	uint8 plen;
+	uint8 parms[1];
+} BWL_POST_PACKED_STRUCT amp_hci_event_t;
+
+#define HCI_EVT_PREAMBLE_SIZE			OFFSETOF(amp_hci_event_t, parms)
+
+/* AMP HCI event codes */
+#define HCI_Command_Complete			0x0E
+#define HCI_Command_Status			0x0F
+#define HCI_Flush_Occurred			0x11
+#define HCI_Enhanced_Flush_Complete		0x39
+#define HCI_Physical_Link_Complete		0x40
+#define HCI_Channel_Select			0x41
+#define HCI_Disconnect_Physical_Link_Complete	0x42
+#define HCI_Logical_Link_Complete		0x45
+#define HCI_Disconnect_Logical_Link_Complete	0x46
+#define HCI_Flow_Spec_Modify_Complete		0x47
+#define HCI_Number_of_Completed_Data_Blocks	0x48
+#define HCI_Short_Range_Mode_Change_Complete	0x4C
+#define HCI_Status_Change_Event			0x4D
+#define HCI_Vendor_Specific			0xFF
+
+/* AMP HCI event mask bit positions */
+#define HCI_Physical_Link_Complete_Event_Mask			0x0001
+#define HCI_Channel_Select_Event_Mask				0x0002
+#define HCI_Disconnect_Physical_Link_Complete_Event_Mask	0x0004
+#define HCI_Logical_Link_Complete_Event_Mask			0x0020
+#define HCI_Disconnect_Logical_Link_Complete_Event_Mask		0x0040
+#define HCI_Flow_Spec_Modify_Complete_Event_Mask		0x0080
+#define HCI_Number_of_Completed_Data_Blocks_Event_Mask		0x0100
+#define HCI_Short_Range_Mode_Change_Complete_Event_Mask		0x1000
+#define HCI_Status_Change_Event_Mask				0x2000
+#define HCI_All_Event_Mask					0x31e7
+/* AMP HCI event parameters */
+typedef BWL_PRE_PACKED_STRUCT struct cmd_status_parms {
+	uint8 status;
+	uint8 cmdpkts;
+	uint16 opcode;
+} BWL_POST_PACKED_STRUCT cmd_status_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct cmd_complete_parms {
+	uint8 cmdpkts;
+	uint16 opcode;
+	uint8 parms[1];
+} BWL_POST_PACKED_STRUCT cmd_complete_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flush_occurred_evt_parms {
+	uint16 handle;
+} BWL_POST_PACKED_STRUCT flush_occurred_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct write_remote_evt_parms {
+	uint8 status;
+	uint8 plh;
+} BWL_POST_PACKED_STRUCT write_remote_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_local_evt_parms {
+	uint8 status;
+	uint8 plh;
+	uint16 len;
+	uint8 frag[1];
+} BWL_POST_PACKED_STRUCT read_local_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_local_info_evt_parms {
+	uint8 status;
+	uint8 AMP_status;
+	uint32 bandwidth;
+	uint32 gbandwidth;
+	uint32 latency;
+	uint32 PDU_size;
+	uint8 ctrl_type;
+	uint16 PAL_cap;
+	uint16 AMP_ASSOC_len;
+	uint32 max_flush_timeout;
+	uint32 be_flush_timeout;
+} BWL_POST_PACKED_STRUCT read_local_info_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_evt_parms {
+	uint8 status;
+	uint16 llh;
+	uint8 plh;
+	uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct disc_log_link_evt_parms {
+	uint8 status;
+	uint16 llh;
+	uint8 reason;
+} BWL_POST_PACKED_STRUCT disc_log_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct log_link_cancel_evt_parms {
+	uint8 status;
+	uint8 plh;
+	uint8 tx_fs_ID;
+} BWL_POST_PACKED_STRUCT log_link_cancel_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct flow_spec_mod_evt_parms {
+	uint8 status;
+	uint16 llh;
+} BWL_POST_PACKED_STRUCT flow_spec_mod_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct phy_link_evt_parms {
+	uint8 status;
+	uint8 plh;
+} BWL_POST_PACKED_STRUCT phy_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct dis_phy_link_evt_parms {
+	uint8 status;
+	uint8 plh;
+	uint8 reason;
+} BWL_POST_PACKED_STRUCT dis_phy_link_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_ls_to_evt_parms {
+	uint8 status;
+	hci_handle_t handle;
+	uint16 timeout;
+} BWL_POST_PACKED_STRUCT read_ls_to_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_lla_ca_to_evt_parms {
+	uint8 status;
+	uint16 timeout;
+} BWL_POST_PACKED_STRUCT read_lla_ca_to_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_data_block_size_evt_parms {
+	uint8 status;
+	uint16 ACL_pkt_len;
+	uint16 data_block_len;
+	uint16 data_block_num;
+} BWL_POST_PACKED_STRUCT read_data_block_size_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct data_blocks {
+	uint16 handle;
+	uint16 pkts;
+	uint16 blocks;
+} BWL_POST_PACKED_STRUCT data_blocks_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct num_completed_data_blocks_evt_parms {
+	uint16 num_blocks;
+	uint8 num_handles;
+	data_blocks_t completed[1];
+} BWL_POST_PACKED_STRUCT num_completed_data_blocks_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct befto_evt_parms {
+	uint8 status;
+	uint32 befto;
+} BWL_POST_PACKED_STRUCT befto_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct srm_evt_parms {
+	uint8 status;
+	uint8 plh;
+	uint8 srm;
+} BWL_POST_PACKED_STRUCT srm_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct contact_counter_evt_parms {
+	uint8 status;
+	uint8 llh[2];
+	uint16 counter;
+} BWL_POST_PACKED_STRUCT contact_counter_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct contact_counter_reset_evt_parms {
+	uint8 status;
+	uint8 llh[2];
+} BWL_POST_PACKED_STRUCT contact_counter_reset_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct read_linkq_evt_parms {
+	uint8 status;
+	hci_handle_t handle;
+	uint8 link_quality;
+} BWL_POST_PACKED_STRUCT read_linkq_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct ld_evt_parms {
+	uint8 status;
+	uint8 ld_aware;
+	uint8 ld[2];
+	uint8 ld_opts;
+	uint8 l_opts;
+} BWL_POST_PACKED_STRUCT ld_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct eflush_complete_evt_parms {
+	uint16 handle;
+} BWL_POST_PACKED_STRUCT eflush_complete_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct vendor_specific_evt_parms {
+	uint8 len;
+	uint8 parms[1];
+} BWL_POST_PACKED_STRUCT vendor_specific_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct local_version_info_evt_parms {
+	uint8 status;
+	uint8 hci_version;
+	uint16 hci_revision;
+	uint8 pal_version;
+	uint16 mfg_name;
+	uint16 pal_subversion;
+} BWL_POST_PACKED_STRUCT local_version_info_evt_parms_t;
+
+#define MAX_SUPPORTED_CMD_BYTE	64
+typedef BWL_PRE_PACKED_STRUCT struct local_supported_cmd_evt_parms {
+	uint8 status;
+	uint8 cmd[MAX_SUPPORTED_CMD_BYTE];
+} BWL_POST_PACKED_STRUCT local_supported_cmd_evt_parms_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct status_change_evt_parms {
+	uint8 status;
+	uint8 amp_status;
+} BWL_POST_PACKED_STRUCT status_change_evt_parms_t;
+
+/* AMP HCI error codes */
+#define HCI_SUCCESS				0x00
+#define HCI_ERR_ILLEGAL_COMMAND			0x01
+#define HCI_ERR_NO_CONNECTION			0x02
+#define HCI_ERR_MEMORY_FULL			0x07
+#define HCI_ERR_CONNECTION_TIMEOUT		0x08
+#define HCI_ERR_MAX_NUM_OF_CONNECTIONS		0x09
+#define HCI_ERR_CONNECTION_EXISTS		0x0B
+#define HCI_ERR_CONNECTION_DISALLOWED		0x0C
+#define HCI_ERR_CONNECTION_ACCEPT_TIMEOUT	0x10
+#define HCI_ERR_UNSUPPORTED_VALUE		0x11
+#define HCI_ERR_ILLEGAL_PARAMETER_FMT		0x12
+#define HCI_ERR_CONN_TERM_BY_LOCAL_HOST		0x16
+#define HCI_ERR_UNSPECIFIED			0x1F
+#define HCI_ERR_UNIT_KEY_USED			0x26
+#define HCI_ERR_QOS_REJECTED			0x2D
+#define HCI_ERR_PARAM_OUT_OF_RANGE		0x30
+#define HCI_ERR_NO_SUITABLE_CHANNEL		0x39
+#define HCI_ERR_CHANNEL_MOVE			0xFF
+
+/* AMP HCI ACL Data packet format */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_ACL_data {
+	uint16	handle;			/* 12-bit connection handle + 2-bit PB and 2-bit BC flags */
+	uint16	dlen;			/* data total length */
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT amp_hci_ACL_data_t;
+
+#define HCI_ACL_DATA_PREAMBLE_SIZE	OFFSETOF(amp_hci_ACL_data_t, data)
+
+#define HCI_ACL_DATA_BC_FLAGS		(0x0 << 14)
+#define HCI_ACL_DATA_PB_FLAGS		(0x3 << 12)
+
+#define HCI_ACL_DATA_HANDLE(handle)	((handle) & 0x0fff)
+#define HCI_ACL_DATA_FLAGS(handle)	((handle) >> 12)
+
+/* AMP Activity Report packet formats */
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_activity_report {
+	uint8	ScheduleKnown;
+	uint8	NumReports;
+	uint8	data[1];
+} BWL_POST_PACKED_STRUCT amp_hci_activity_report_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct amp_hci_activity_report_triple {
+	uint32	StartTime;
+	uint32	Duration;
+	uint32	Periodicity;
+} BWL_POST_PACKED_STRUCT amp_hci_activity_report_triple_t;
+
+#define HCI_AR_SCHEDULE_KNOWN		0x01
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _bt_amp_hci_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/eapol.h b/drivers/net/wireless/bcm4336/include/proto/eapol.h
--- a/drivers/net/wireless/bcm4336/include/proto/eapol.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/eapol.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,194 @@
+/*
+ * 802.1x EAPOL definitions
+ *
+ * See
+ * IEEE Std 802.1X-2001
+ * IEEE 802.1X RADIUS Usage Guidelines
+ *
+ * Copyright Open Broadcom Corporation
+ *
+ * $Id: eapol.h 452703 2014-01-31 20:33:06Z $
+ */
+
+#ifndef _eapol_h_
+#define _eapol_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#include <bcmcrypto/aeskeywrap.h>
+
+/* EAPOL for 802.3/Ethernet */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	struct ether_header eth;	/* 802.3/Ethernet header */
+	unsigned char version;		/* EAPOL protocol version */
+	unsigned char type;		/* EAPOL type */
+	unsigned short length;		/* Length of body */
+	unsigned char body[1];		/* Body (optional) */
+} BWL_POST_PACKED_STRUCT eapol_header_t;
+
+#define EAPOL_HEADER_LEN 18
+
+typedef struct {
+	unsigned char version;		/* EAPOL protocol version */
+	unsigned char type;		/* EAPOL type */
+	unsigned short length;		/* Length of body */
+} eapol_hdr_t;
+
+#define EAPOL_HDR_LEN 4
+
+/* EAPOL version */
+#define WPA2_EAPOL_VERSION	2
+#define WPA_EAPOL_VERSION	1
+#define LEAP_EAPOL_VERSION	1
+#define SES_EAPOL_VERSION	1
+
+/* EAPOL types */
+#define EAP_PACKET		0
+#define EAPOL_START		1
+#define EAPOL_LOGOFF		2
+#define EAPOL_KEY		3
+#define EAPOL_ASF		4
+
+/* EAPOL-Key types */
+#define EAPOL_RC4_KEY		1
+#define EAPOL_WPA2_KEY		2	/* 802.11i/WPA2 */
+#define EAPOL_WPA_KEY		254	/* WPA */
+
+/* RC4 EAPOL-Key header field sizes */
+#define EAPOL_KEY_REPLAY_LEN	8
+#define EAPOL_KEY_IV_LEN	16
+#define EAPOL_KEY_SIG_LEN	16
+
+/* RC4 EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	unsigned char type;			/* Key Descriptor Type */
+	unsigned short length;			/* Key Length (unaligned) */
+	unsigned char replay[EAPOL_KEY_REPLAY_LEN];	/* Replay Counter */
+	unsigned char iv[EAPOL_KEY_IV_LEN];		/* Key IV */
+	unsigned char index;				/* Key Flags & Index */
+	unsigned char signature[EAPOL_KEY_SIG_LEN];	/* Key Signature */
+	unsigned char key[1];				/* Key (optional) */
+} BWL_POST_PACKED_STRUCT eapol_key_header_t;
+
+#define EAPOL_KEY_HEADER_LEN 	44
+
+/* RC4 EAPOL-Key flags */
+#define EAPOL_KEY_FLAGS_MASK	0x80
+#define EAPOL_KEY_BROADCAST	0
+#define EAPOL_KEY_UNICAST	0x80
+
+/* RC4 EAPOL-Key index */
+#define EAPOL_KEY_INDEX_MASK	0x7f
+
+/* WPA/802.11i/WPA2 EAPOL-Key header field sizes */
+#define EAPOL_WPA_KEY_REPLAY_LEN	8
+#define EAPOL_WPA_KEY_NONCE_LEN		32
+#define EAPOL_WPA_KEY_IV_LEN		16
+#define EAPOL_WPA_KEY_RSC_LEN		8
+#define EAPOL_WPA_KEY_ID_LEN		8
+#define EAPOL_WPA_KEY_MIC_LEN		16
+#define EAPOL_WPA_KEY_DATA_LEN		(EAPOL_WPA_MAX_KEY_SIZE + AKW_BLOCK_LEN)
+#define EAPOL_WPA_MAX_KEY_SIZE		32
+
+/* WPA EAPOL-Key */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	unsigned char type;		/* Key Descriptor Type */
+	unsigned short key_info;	/* Key Information (unaligned) */
+	unsigned short key_len;		/* Key Length (unaligned) */
+	unsigned char replay[EAPOL_WPA_KEY_REPLAY_LEN];	/* Replay Counter */
+	unsigned char nonce[EAPOL_WPA_KEY_NONCE_LEN];	/* Nonce */
+	unsigned char iv[EAPOL_WPA_KEY_IV_LEN];		/* Key IV */
+	unsigned char rsc[EAPOL_WPA_KEY_RSC_LEN];	/* Key RSC */
+	unsigned char id[EAPOL_WPA_KEY_ID_LEN];		/* WPA:Key ID, 802.11i/WPA2: Reserved */
+	unsigned char mic[EAPOL_WPA_KEY_MIC_LEN];	/* Key MIC */
+	unsigned short data_len;			/* Key Data Length */
+	unsigned char data[EAPOL_WPA_KEY_DATA_LEN];	/* Key data */
+} BWL_POST_PACKED_STRUCT eapol_wpa_key_header_t;
+
+#define EAPOL_WPA_KEY_LEN 		95
+
+/* WPA/802.11i/WPA2 KEY KEY_INFO bits */
+#define WPA_KEY_DESC_OSEN	0x0
+#define WPA_KEY_DESC_V1		0x01
+#define WPA_KEY_DESC_V2		0x02
+#define WPA_KEY_DESC_V3		0x03
+#define WPA_KEY_PAIRWISE	0x08
+#define WPA_KEY_INSTALL		0x40
+#define WPA_KEY_ACK		0x80
+#define WPA_KEY_MIC		0x100
+#define WPA_KEY_SECURE		0x200
+#define WPA_KEY_ERROR		0x400
+#define WPA_KEY_REQ		0x800
+
+#define WPA_KEY_DESC_V2_OR_V3 WPA_KEY_DESC_V2
+
+/* WPA-only KEY KEY_INFO bits */
+#define WPA_KEY_INDEX_0		0x00
+#define WPA_KEY_INDEX_1		0x10
+#define WPA_KEY_INDEX_2		0x20
+#define WPA_KEY_INDEX_3		0x30
+#define WPA_KEY_INDEX_MASK	0x30
+#define WPA_KEY_INDEX_SHIFT	0x04
+
+/* 802.11i/WPA2-only KEY KEY_INFO bits */
+#define WPA_KEY_ENCRYPTED_DATA	0x1000
+
+/* Key Data encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8 type;
+	uint8 length;
+	uint8 oui[3];
+	uint8 subtype;
+	uint8 data[1];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_encap_data_t;
+
+#define EAPOL_WPA2_ENCAP_DATA_HDR_LEN 	6
+
+#define WPA2_KEY_DATA_SUBTYPE_GTK	1
+#define WPA2_KEY_DATA_SUBTYPE_STAKEY	2
+#define WPA2_KEY_DATA_SUBTYPE_MAC	3
+#define WPA2_KEY_DATA_SUBTYPE_PMKID	4
+#define WPA2_KEY_DATA_SUBTYPE_IGTK	9
+
+/* GTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8	flags;
+	uint8	reserved;
+	uint8	gtk[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_gtk_encap_t;
+
+#define EAPOL_WPA2_KEY_GTK_ENCAP_HDR_LEN 	2
+
+#define WPA2_GTK_INDEX_MASK	0x03
+#define WPA2_GTK_INDEX_SHIFT	0x00
+
+#define WPA2_GTK_TRANSMIT	0x04
+
+/* IGTK encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16	key_id;
+	uint8	ipn[6];
+	uint8	key[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_igtk_encap_t;
+
+#define EAPOL_WPA2_KEY_IGTK_ENCAP_HDR_LEN 	8
+
+/* STAKey encapsulation */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8	reserved[2];
+	uint8	mac[ETHER_ADDR_LEN];
+	uint8	stakey[EAPOL_WPA_MAX_KEY_SIZE];
+} BWL_POST_PACKED_STRUCT eapol_wpa2_key_stakey_encap_t;
+
+#define WPA2_KEY_DATA_PAD	0xdd
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _eapol_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/ethernet.h b/drivers/net/wireless/bcm4336/include/proto/ethernet.h
--- a/drivers/net/wireless/bcm4336/include/proto/ethernet.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/ethernet.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,210 @@
+/*
+ * From FreeBSD 2.2.7: Fundamental constants relating to ethernet.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: ethernet.h 473238 2014-04-28 19:14:56Z $
+ */
+
+#ifndef _NET_ETHERNET_H_	/* use native BSD ethernet.h when available */
+#define _NET_ETHERNET_H_
+
+#ifndef _TYPEDEFS_H_
+#include "typedefs.h"
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/*
+ * The number of bytes in an ethernet (MAC) address.
+ */
+#define	ETHER_ADDR_LEN		6
+
+/*
+ * The number of bytes in the type field.
+ */
+#define	ETHER_TYPE_LEN		2
+
+/*
+ * The number of bytes in the trailing CRC field.
+ */
+#define	ETHER_CRC_LEN		4
+
+/*
+ * The length of the combined header.
+ */
+#define	ETHER_HDR_LEN		(ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
+
+/*
+ * The minimum packet length.
+ */
+#define	ETHER_MIN_LEN		64
+
+/*
+ * The minimum packet user data length.
+ */
+#define	ETHER_MIN_DATA		46
+
+/*
+ * The maximum packet length.
+ */
+#define	ETHER_MAX_LEN		1518
+
+/*
+ * The maximum packet user data length.
+ */
+#define	ETHER_MAX_DATA		1500
+
+/* ether types */
+#define ETHER_TYPE_MIN		0x0600		/* Anything less than MIN is a length */
+#define	ETHER_TYPE_IP		0x0800		/* IP */
+#define ETHER_TYPE_ARP		0x0806		/* ARP */
+#define ETHER_TYPE_8021Q	0x8100		/* 802.1Q */
+#define	ETHER_TYPE_IPV6		0x86dd		/* IPv6 */
+#define	ETHER_TYPE_BRCM		0x886c		/* Broadcom Corp. */
+#define	ETHER_TYPE_802_1X	0x888e		/* 802.1x */
+#ifdef PLC
+#define	ETHER_TYPE_88E1		0x88e1		/* GIGLE */
+#define	ETHER_TYPE_8912		0x8912		/* GIGLE */
+#define ETHER_TYPE_GIGLED	0xffff		/* GIGLE */
+#endif /* PLC */
+#define	ETHER_TYPE_802_1X_PREAUTH 0x88c7	/* 802.1x preauthentication */
+#define ETHER_TYPE_WAI		0x88b4		/* WAI */
+#define ETHER_TYPE_89_0D	0x890d		/* 89-0d frame for TDLS */
+
+#define ETHER_TYPE_PPP_SES	0x8864		/* PPPoE Session */
+
+#define ETHER_TYPE_IAPP_L2_UPDATE	0x6	/* IAPP L2 update frame */
+
+/* Broadcom subtype follows ethertype;  First 2 bytes are reserved; Next 2 are subtype; */
+#define	ETHER_BRCM_SUBTYPE_LEN	4	/* Broadcom 4 byte subtype */
+
+/* ether header */
+#define ETHER_DEST_OFFSET	(0 * ETHER_ADDR_LEN)	/* dest address offset */
+#define ETHER_SRC_OFFSET	(1 * ETHER_ADDR_LEN)	/* src address offset */
+#define ETHER_TYPE_OFFSET	(2 * ETHER_ADDR_LEN)	/* ether type offset */
+
+/*
+ * A macro to validate a length with
+ */
+#define	ETHER_IS_VALID_LEN(foo)	\
+	((foo) >= ETHER_MIN_LEN && (foo) <= ETHER_MAX_LEN)
+
+#define ETHER_FILL_MCAST_ADDR_FROM_IP(ea, mgrp_ip) {		\
+		((uint8 *)ea)[0] = 0x01;			\
+		((uint8 *)ea)[1] = 0x00;			\
+		((uint8 *)ea)[2] = 0x5e;			\
+		((uint8 *)ea)[3] = ((mgrp_ip) >> 16) & 0x7f;	\
+		((uint8 *)ea)[4] = ((mgrp_ip) >>  8) & 0xff;	\
+		((uint8 *)ea)[5] = ((mgrp_ip) >>  0) & 0xff;	\
+}
+
+#ifndef __INCif_etherh /* Quick and ugly hack for VxWorks */
+/*
+ * Structure of a 10Mb/s Ethernet header.
+ */
+BWL_PRE_PACKED_STRUCT struct ether_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];
+	uint8	ether_shost[ETHER_ADDR_LEN];
+	uint16	ether_type;
+} BWL_POST_PACKED_STRUCT;
+
+/*
+ * Structure of a 48-bit Ethernet address.
+ */
+BWL_PRE_PACKED_STRUCT struct	ether_addr {
+	uint8 octet[ETHER_ADDR_LEN];
+} BWL_POST_PACKED_STRUCT;
+#endif	/* !__INCif_etherh Quick and ugly hack for VxWorks */
+
+/*
+ * Takes a pointer, set, test, clear, toggle locally admininistered
+ * address bit in the 48-bit Ethernet address.
+ */
+#define ETHER_SET_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] | 2))
+#define ETHER_IS_LOCALADDR(ea) 	(((uint8 *)(ea))[0] & 2)
+#define ETHER_CLR_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & 0xfd))
+#define ETHER_TOGGLE_LOCALADDR(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] ^ 2))
+
+/* Takes a pointer, marks unicast address bit in the MAC address */
+#define ETHER_SET_UNICAST(ea)	(((uint8 *)(ea))[0] = (((uint8 *)(ea))[0] & ~1))
+
+/*
+ * Takes a pointer, returns true if a 48-bit multicast address
+ * (including broadcast, since it is all ones)
+ */
+#define ETHER_ISMULTI(ea) (((const uint8 *)(ea))[0] & 1)
+
+
+/* compare two ethernet addresses - assumes the pointers can be referenced as shorts */
+#define eacmp(a, b)	((((const uint16 *)(a))[0] ^ ((const uint16 *)(b))[0]) | \
+	                 (((const uint16 *)(a))[1] ^ ((const uint16 *)(b))[1]) | \
+	                 (((const uint16 *)(a))[2] ^ ((const uint16 *)(b))[2]))
+
+#define	ether_cmp(a, b)	eacmp(a, b)
+
+/* copy an ethernet address - assumes the pointers can be referenced as shorts */
+#define eacopy(s, d) \
+do { \
+	((uint16 *)(d))[0] = ((const uint16 *)(s))[0]; \
+	((uint16 *)(d))[1] = ((const uint16 *)(s))[1]; \
+	((uint16 *)(d))[2] = ((const uint16 *)(s))[2]; \
+} while (0)
+
+#define	ether_copy(s, d) eacopy(s, d)
+
+/* Copy an ethernet address in reverse order */
+#define	ether_rcopy(s, d) \
+do { \
+	((uint16 *)(d))[2] = ((uint16 *)(s))[2]; \
+	((uint16 *)(d))[1] = ((uint16 *)(s))[1]; \
+	((uint16 *)(d))[0] = ((uint16 *)(s))[0]; \
+} while (0)
+
+/* Copy 14B ethernet header: 32bit aligned source and destination. */
+#define ehcopy32(s, d) \
+do { \
+	((uint32 *)(d))[0] = ((const uint32 *)(s))[0]; \
+	((uint32 *)(d))[1] = ((const uint32 *)(s))[1]; \
+	((uint32 *)(d))[2] = ((const uint32 *)(s))[2]; \
+	((uint16 *)(d))[6] = ((const uint16 *)(s))[6]; \
+} while (0)
+
+
+static const struct ether_addr ether_bcast = {{255, 255, 255, 255, 255, 255}};
+static const struct ether_addr ether_null = {{0, 0, 0, 0, 0, 0}};
+static const struct ether_addr ether_ipv6_mcast = {{0x33, 0x33, 0x00, 0x00, 0x00, 0x01}};
+
+#define ETHER_ISBCAST(ea)	((((const uint8 *)(ea))[0] &		\
+	                          ((const uint8 *)(ea))[1] &		\
+				  ((const uint8 *)(ea))[2] &		\
+				  ((const uint8 *)(ea))[3] &		\
+				  ((const uint8 *)(ea))[4] &		\
+				  ((const uint8 *)(ea))[5]) == 0xff)
+#define ETHER_ISNULLADDR(ea)	((((const uint8 *)(ea))[0] |		\
+				  ((const uint8 *)(ea))[1] |		\
+				  ((const uint8 *)(ea))[2] |		\
+				  ((const uint8 *)(ea))[3] |		\
+				  ((const uint8 *)(ea))[4] |		\
+				  ((const uint8 *)(ea))[5]) == 0)
+
+#define ETHER_ISNULLDEST(da)	((((const uint16 *)(da))[0] |           \
+				  ((const uint16 *)(da))[1] |           \
+				  ((const uint16 *)(da))[2]) == 0)
+#define ETHER_ISNULLSRC(sa)	ETHER_ISNULLDEST(sa)
+
+#define ETHER_MOVE_HDR(d, s) \
+do { \
+	struct ether_header t; \
+	t = *(struct ether_header *)(s); \
+	*(struct ether_header *)(d) = t; \
+} while (0)
+
+#define  ETHER_ISUCAST(ea) ((((uint8 *)(ea))[0] & 0x01) == 0)
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _NET_ETHERNET_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/p2p.h b/drivers/net/wireless/bcm4336/include/proto/p2p.h
--- a/drivers/net/wireless/bcm4336/include/proto/p2p.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/p2p.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,692 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ *
+ * Fundamental types and constants relating to WFA P2P (aka WiFi Direct)
+ *
+ * $Id: p2p.h 457033 2014-02-20 19:39:45Z $
+ */
+
+#ifndef _P2P_H_
+#define _P2P_H_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+#include <wlioctl.h>
+#include <proto/802.11.h>
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+
+/* WiFi P2P OUI values */
+#define P2P_OUI			WFA_OUI			/* WiFi P2P OUI */
+#define P2P_VER			WFA_OUI_TYPE_P2P	/* P2P version: 9=WiFi P2P v1.0 */
+
+#define P2P_IE_ID		0xdd			/* P2P IE element ID */
+
+/* WiFi P2P IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ie {
+	uint8	id;		/* IE ID: 0xDD */
+	uint8	len;		/* IE length */
+	uint8	OUI[3];		/* WiFi P2P specific OUI: P2P_OUI */
+	uint8	oui_type;	/* Identifies P2P version: P2P_VER */
+	uint8	subelts[1];	/* variable length subelements */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ie wifi_p2p_ie_t;
+
+#define P2P_IE_FIXED_LEN	6
+
+#define P2P_ATTR_ID_OFF		0
+#define P2P_ATTR_LEN_OFF	1
+#define P2P_ATTR_DATA_OFF	3
+
+#define P2P_ATTR_ID_LEN		1	/* ID filed length */
+#define P2P_ATTR_LEN_LEN	2	/* length field length */
+#define P2P_ATTR_HDR_LEN	3 /* ID + 2-byte length field spec 1.02 */
+
+#define P2P_WFDS_HASH_LEN		6
+#define P2P_WFDS_MAX_SVC_NAME_LEN	32
+
+/* P2P IE Subelement IDs from WiFi P2P Technical Spec 1.00 */
+#define P2P_SEID_STATUS			0	/* Status */
+#define P2P_SEID_MINOR_RC		1	/* Minor Reason Code */
+#define P2P_SEID_P2P_INFO		2	/* P2P Capability (capabilities info) */
+#define P2P_SEID_DEV_ID			3	/* P2P Device ID */
+#define P2P_SEID_INTENT			4	/* Group Owner Intent */
+#define P2P_SEID_CFG_TIMEOUT		5	/* Configuration Timeout */
+#define P2P_SEID_CHANNEL		6	/* Listen channel */
+#define P2P_SEID_GRP_BSSID		7	/* P2P Group BSSID */
+#define P2P_SEID_XT_TIMING		8	/* Extended Listen Timing */
+#define P2P_SEID_INTINTADDR		9	/* Intended P2P Interface Address */
+#define P2P_SEID_P2P_MGBTY		10	/* P2P Manageability */
+#define P2P_SEID_CHAN_LIST		11	/* Channel List */
+#define P2P_SEID_ABSENCE		12	/* Notice of Absence */
+#define P2P_SEID_DEV_INFO		13	/* Device Info */
+#define P2P_SEID_GROUP_INFO		14	/* Group Info */
+#define P2P_SEID_GROUP_ID		15	/* Group ID */
+#define P2P_SEID_P2P_IF			16	/* P2P Interface */
+#define P2P_SEID_OP_CHANNEL		17	/* Operating Channel */
+#define P2P_SEID_INVITE_FLAGS		18	/* Invitation Flags */
+#define P2P_SEID_SERVICE_HASH		21	/* Service hash */
+#define P2P_SEID_SESSION		22	/* Session information */
+#define P2P_SEID_CONNECT_CAP		23	/* Connection capability */
+#define P2P_SEID_ADVERTISE_ID		24	/* Advertisement ID */
+#define P2P_SEID_ADVERTISE_SERVICE	25	/* Advertised service */
+#define P2P_SEID_SESSION_ID		26	/* Session ID */
+#define P2P_SEID_FEATURE_CAP		27	/* Feature capability */
+#define	P2P_SEID_PERSISTENT_GROUP	28	/* Persistent group */
+#define P2P_SEID_SESSION_INFO_RESP	29	/* Session Information Response */
+#define P2P_SEID_VNDR			221	/* Vendor-specific subelement */
+
+#define P2P_SE_VS_ID_SERVICES	0x1b
+
+
+/* WiFi P2P IE subelement: P2P Capability (capabilities info) */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_info_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_P2P_INFO */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	dev;		/* Device Capability Bitmap */
+	uint8	group;		/* Group Capability Bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_info_se_s wifi_p2p_info_se_t;
+
+/* P2P Capability subelement's Device Capability Bitmap bit values */
+#define P2P_CAPSE_DEV_SERVICE_DIS	0x1 /* Service Discovery */
+#define P2P_CAPSE_DEV_CLIENT_DIS	0x2 /* Client Discoverability */
+#define P2P_CAPSE_DEV_CONCURRENT	0x4 /* Concurrent Operation */
+#define P2P_CAPSE_DEV_INFRA_MAN		0x8 /* P2P Infrastructure Managed */
+#define P2P_CAPSE_DEV_LIMIT			0x10 /* P2P Device Limit */
+#define P2P_CAPSE_INVITE_PROC		0x20 /* P2P Invitation Procedure */
+
+/* P2P Capability subelement's Group Capability Bitmap bit values */
+#define P2P_CAPSE_GRP_OWNER			0x1 /* P2P Group Owner */
+#define P2P_CAPSE_PERSIST_GRP		0x2 /* Persistent P2P Group */
+#define P2P_CAPSE_GRP_LIMIT			0x4 /* P2P Group Limit */
+#define P2P_CAPSE_GRP_INTRA_BSS		0x8 /* Intra-BSS Distribution */
+#define P2P_CAPSE_GRP_X_CONNECT		0x10 /* Cross Connection */
+#define P2P_CAPSE_GRP_PERSISTENT	0x20 /* Persistent Reconnect */
+#define P2P_CAPSE_GRP_FORMATION		0x40 /* Group Formation */
+
+
+/* WiFi P2P IE subelement: Group Owner Intent */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intent_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_INTENT */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	intent;		/* Intent Value 0...15 (0=legacy 15=master only) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intent_se_s wifi_p2p_intent_se_t;
+
+/* WiFi P2P IE subelement: Configuration Timeout */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cfg_tmo_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_CFG_TIMEOUT */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	go_tmo;		/* GO config timeout in units of 10 ms */
+	uint8	client_tmo;	/* Client config timeout in units of 10 ms */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cfg_tmo_se_s wifi_p2p_cfg_tmo_se_t;
+
+/* WiFi P2P IE subelement: Listen Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_listen_channel_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_CHANNEL */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	country[3];	/* Country String */
+	uint8	op_class;	/* Operating Class */
+	uint8	channel;	/* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_listen_channel_se_s wifi_p2p_listen_channel_se_t;
+
+/* WiFi P2P IE subelement: P2P Group BSSID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_bssid_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_GRP_BSSID */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* P2P group bssid */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_bssid_se_s wifi_p2p_grp_bssid_se_t;
+
+/* WiFi P2P IE subelement: P2P Group ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grp_id_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_GROUP_ID */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* P2P device address */
+	uint8	ssid[1];	/* ssid. device id. variable length */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grp_id_se_s wifi_p2p_grp_id_se_t;
+
+/* WiFi P2P IE subelement: P2P Interface */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intf_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_P2P_IF */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* P2P device address */
+	uint8	ifaddrs;	/* P2P Interface Address count */
+	uint8	ifaddr[1][6];	/* P2P Interface Address list */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intf_se_s wifi_p2p_intf_se_t;
+
+/* WiFi P2P IE subelement: Status */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_status_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_STATUS */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	status;		/* Status Code: P2P_STATSE_* */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_status_se_s wifi_p2p_status_se_t;
+
+/* Status subelement Status Code definitions */
+#define P2P_STATSE_SUCCESS			0
+				/* Success */
+#define P2P_STATSE_FAIL_INFO_CURR_UNAVAIL	1
+				/* Failed, information currently unavailable */
+#define P2P_STATSE_PASSED_UP			P2P_STATSE_FAIL_INFO_CURR_UNAVAIL
+				/* Old name for above in P2P spec 1.08 and older */
+#define P2P_STATSE_FAIL_INCOMPAT_PARAMS		2
+				/* Failed, incompatible parameters */
+#define P2P_STATSE_FAIL_LIMIT_REACHED		3
+				/* Failed, limit reached */
+#define P2P_STATSE_FAIL_INVALID_PARAMS		4
+				/* Failed, invalid parameters */
+#define P2P_STATSE_FAIL_UNABLE_TO_ACCOM		5
+				/* Failed, unable to accomodate request */
+#define P2P_STATSE_FAIL_PROTO_ERROR		6
+				/* Failed, previous protocol error or disruptive behaviour */
+#define P2P_STATSE_FAIL_NO_COMMON_CHAN		7
+				/* Failed, no common channels */
+#define P2P_STATSE_FAIL_UNKNOWN_GROUP		8
+				/* Failed, unknown P2P Group */
+#define P2P_STATSE_FAIL_INTENT			9
+				/* Failed, both peers indicated Intent 15 in GO Negotiation */
+#define P2P_STATSE_FAIL_INCOMPAT_PROVIS		10
+				/* Failed, incompatible provisioning method */
+#define P2P_STATSE_FAIL_USER_REJECT		11
+				/* Failed, rejected by user */
+#define P2P_STATSE_SUCCESS_USER_ACCEPT		12
+				/* Success, accepted by user */
+
+/* WiFi P2P IE attribute: Extended Listen Timing */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ext_se_s {
+	uint8	eltId;		/* ID: P2P_SEID_EXT_TIMING */
+	uint8	len[2];		/* length not including eltId, len fields */
+	uint8	avail[2];	/* availibility period */
+	uint8	interval[2];	/* availibility interval */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ext_se_s wifi_p2p_ext_se_t;
+
+#define P2P_EXT_MIN	10	/* minimum 10ms */
+
+/* WiFi P2P IE subelement: Intended P2P Interface Address */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_intintad_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_INTINTADDR */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mac[6];		/* intended P2P interface MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_intintad_se_s wifi_p2p_intintad_se_t;
+
+/* WiFi P2P IE subelement: Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_channel_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_STATUS */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	band;		/* Regulatory Class (band) */
+	uint8	channel;	/* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_channel_se_s wifi_p2p_channel_se_t;
+
+
+/* Channel Entry structure within the Channel List SE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_entry_s {
+	uint8	band;						/* Regulatory Class (band) */
+	uint8	num_channels;				/* # of channels in the channel list */
+	uint8	channels[WL_NUMCHANNELS];	/* Channel List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_entry_s wifi_p2p_chanlist_entry_t;
+#define WIFI_P2P_CHANLIST_SE_MAX_ENTRIES 2
+
+/* WiFi P2P IE subelement: Channel List */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_chanlist_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_CHAN_LIST */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	country[3];	/* Country String */
+	uint8	num_entries;	/* # of channel entries */
+	wifi_p2p_chanlist_entry_t	entries[WIFI_P2P_CHANLIST_SE_MAX_ENTRIES];
+						/* Channel Entry List */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_chanlist_se_s wifi_p2p_chanlist_se_t;
+
+/* WiFi Primary Device Type structure */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pri_devtype_s {
+	uint16	cat_id;		/* Category ID */
+	uint8	OUI[3];		/* WFA OUI: 0x0050F2 */
+	uint8	oui_type;	/* WPS_OUI_TYPE */
+	uint16	sub_cat_id;	/* Sub Category ID */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pri_devtype_s wifi_p2p_pri_devtype_t;
+
+/* WiFi P2P Device Info Sub Element Primary Device Type Sub Category
+ * maximum values for each category
+ */
+#define P2P_DISE_SUBCATEGORY_MINVAL		1
+#define P2P_DISE_CATEGORY_COMPUTER		1
+#define P2P_DISE_SUBCATEGORY_COMPUTER_MAXVAL		8
+#define P2P_DISE_CATEGORY_INPUT_DEVICE		2
+#define P2P_DISE_SUBCATEGORY_INPUT_DEVICE_MAXVAL	9
+#define P2P_DISE_CATEGORY_PRINTER		3
+#define P2P_DISE_SUBCATEGORY_PRINTER_MAXVAL		5
+#define P2P_DISE_CATEGORY_CAMERA		4
+#define P2P_DISE_SUBCATEGORY_CAMERA_MAXVAL		4
+#define P2P_DISE_CATEGORY_STORAGE		5
+#define P2P_DISE_SUBCATEGORY_STORAGE_MAXVAL		1
+#define P2P_DISE_CATEGORY_NETWORK_INFRA		6
+#define P2P_DISE_SUBCATEGORY_NETWORK_INFRA_MAXVAL	4
+#define P2P_DISE_CATEGORY_DISPLAY		7
+#define P2P_DISE_SUBCATEGORY_DISPLAY_MAXVAL		4
+#define P2P_DISE_CATEGORY_MULTIMEDIA		8
+#define P2P_DISE_SUBCATEGORY_MULTIMEDIA_MAXVAL		6
+#define P2P_DISE_CATEGORY_GAMING		9
+#define P2P_DISE_SUBCATEGORY_GAMING_MAXVAL		5
+#define P2P_DISE_CATEGORY_TELEPHONE		10
+#define P2P_DISE_SUBCATEGORY_TELEPHONE_MAXVAL		5
+#define P2P_DISE_CATEGORY_AUDIO			11
+#define P2P_DISE_SUBCATEGORY_AUDIO_MAXVAL		6
+
+/* WiFi P2P IE's Device Info subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devinfo_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_DEVINFO */
+	uint8	len[2];			/* SE length not including eltId, len fields */
+	uint8	mac[6];			/* P2P Device MAC address */
+	uint16	wps_cfg_meths;		/* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+	uint8	pri_devtype[8];		/* Primary Device Type */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devinfo_se_s wifi_p2p_devinfo_se_t;
+
+#define P2P_DEV_TYPE_LEN	8
+
+/* WiFi P2P IE's Group Info subelement Client Info Descriptor */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_cid_fixed_s {
+	uint8	len;
+	uint8	devaddr[ETHER_ADDR_LEN];	/* P2P Device Address */
+	uint8	ifaddr[ETHER_ADDR_LEN];		/* P2P Interface Address */
+	uint8	devcap;				/* Device Capability */
+	uint8	cfg_meths[2];			/* Config Methods: reg_prototlv.h WPS_CONFMET_* */
+	uint8	pridt[P2P_DEV_TYPE_LEN];	/* Primary Device Type */
+	uint8	secdts;				/* Number of Secondary Device Types */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_cid_fixed_s wifi_p2p_cid_fixed_t;
+
+/* WiFi P2P IE's Device ID subelement */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_devid_se_s {
+	uint8	eltId;
+	uint8	len[2];
+	struct ether_addr	addr;			/* P2P Device MAC address */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_devid_se_s wifi_p2p_devid_se_t;
+
+/* WiFi P2P IE subelement: P2P Manageability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_mgbt_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_P2P_MGBTY */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	mg_bitmap;	/* manageability bitmap */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_mgbt_se_s wifi_p2p_mgbt_se_t;
+/* mg_bitmap field bit values */
+#define P2P_MGBTSE_P2PDEVMGMT_FLAG   0x1 /* AP supports Managed P2P Device */
+
+/* WiFi P2P IE subelement: Group Info */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_grpinfo_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_GROUP_INFO */
+	uint8	len[2];			/* SE length not including eltId, len fields */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_grpinfo_se_s wifi_p2p_grpinfo_se_t;
+
+/* WiFi IE subelement: Operating Channel */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_op_channel_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_OP_CHANNEL */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	country[3];	/* Country String */
+	uint8	op_class;	/* Operating Class */
+	uint8	channel;	/* Channel */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_op_channel_se_s wifi_p2p_op_channel_se_t;
+
+/* WiFi IE subelement: INVITATION FLAGS */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_invite_flags_se_s {
+	uint8	eltId;		/* SE ID: P2P_SEID_INVITE_FLAGS */
+	uint8	len[2];		/* SE length not including eltId, len fields */
+	uint8	flags;		/* Flags */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_invite_flags_se_s wifi_p2p_invite_flags_se_t;
+
+/* WiFi P2P IE subelement: Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_serv_hash_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_SERVICE_HASH */
+	uint8	len[2];			/* SE length not including eltId, len fields
+					 * in multiple of 6 Bytes
+					*/
+	uint8	hash[1];		/* Variable length - SHA256 hash of
+					 * service names (can be more than one hashes)
+					*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_serv_hash_se_s wifi_p2p_serv_hash_se_t;
+
+/* WiFi P2P IE subelement: Service Instance Data */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_serv_inst_data_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_SESSION */
+	uint8	len[2];			/* SE length not including eltId, len */
+	uint8	ssn_info[1];		/* Variable length - Session information as specified by
+					 * the service layer, type matches serv. name
+					*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_serv_inst_data_se_s wifi_p2p_serv_inst_data_se_t;
+
+
+/* WiFi P2P IE subelement: Connection capability */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_conn_cap_data_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_CONNECT_CAP */
+	uint8	len[2];			/* SE length not including eltId, len */
+	uint8	conn_cap;		/* 1byte capability as specified by the
+					 * service layer, valid bitmask/values
+					*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_conn_cap_data_se_s wifi_p2p_conn_cap_data_se_t;
+
+
+/* WiFi P2P IE subelement: Advertisement ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_advt_id_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_ADVERTISE_ID */
+	uint8	len[2];			/* SE length not including eltId, len fixed 4 Bytes */
+	uint8	advt_id[4];		/* 4byte Advertisement ID of the peer device sent in
+					 * PROV Disc in Network byte order
+					*/
+	uint8	advt_mac[6];			/* P2P device address of the service advertiser */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_advt_id_se_s wifi_p2p_advt_id_se_t;
+
+
+/* WiFi P2P IE subelement: Advertise Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_adv_serv_info_s {
+	uint8	advt_id[4];		/* SE Advertise ID for the service */
+	uint16	nw_cfg_method;	/* SE Network Config method for the service */
+	uint8	serv_name_len;	/* SE length of the service name */
+	uint8	serv_name[1];	/* Variable length service name field */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_adv_serv_info_s wifi_p2p_adv_serv_info_t;
+
+
+/* WiFi P2P IE subelement: Advertise Service Hash */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_advt_serv_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_ADVERTISE_SERVICE */
+	uint8	len[2];			/* SE length not including eltId, len fields mutiple len of
+					 * wifi_p2p_adv_serv_info_t entries
+					*/
+	wifi_p2p_adv_serv_info_t	p_advt_serv_info[1]; /* Variable length
+								of multiple instances
+								of the advertise service info
+								*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_advt_serv_se_s wifi_p2p_advt_serv_se_t;
+
+
+/* WiFi P2P IE subelement: Session ID */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_ssn_id_se_s {
+	uint8	eltId;			/* SE ID: P2P_SEID_SESSION_ID */
+	uint8	len[2];			/* SE length not including eltId, len fixed 4 Bytes */
+	uint8	ssn_id[4];		/* 4byte Session ID of the peer device sent in
+							 * PROV Disc in Network byte order
+							 */
+	uint8	ssn_mac[6];		/* P2P device address of the seeker - session mac */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_ssn_id_se_s wifi_p2p_ssn_id_se_t;
+
+
+#define P2P_ADVT_SERV_SE_FIXED_LEN	3	/* Includes only the element ID and len */
+#define P2P_ADVT_SERV_INFO_FIXED_LEN	7	/* Per ADV Service Instance advt_id +
+						 * nw_config_method + serv_name_len
+						 */
+
+/* WiFi P2P Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_action_frame {
+	uint8	category;	/* P2P_AF_CATEGORY */
+	uint8	OUI[3];		/* OUI - P2P_OUI */
+	uint8	type;		/* OUI Type - P2P_VER */
+	uint8	subtype;	/* OUI Subtype - P2P_AF_* */
+	uint8	dialog_token;	/* nonzero, identifies req/resp tranaction */
+	uint8	elts[1];	/* Variable length information elements.  Max size =
+				 * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+				 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_action_frame wifi_p2p_action_frame_t;
+#define P2P_AF_CATEGORY		0x7f
+
+#define P2P_AF_FIXED_LEN	7
+
+/* WiFi P2P Action Frame OUI Subtypes */
+#define P2P_AF_NOTICE_OF_ABSENCE	0	/* Notice of Absence */
+#define P2P_AF_PRESENCE_REQ		1	/* P2P Presence Request */
+#define P2P_AF_PRESENCE_RSP		2	/* P2P Presence Response */
+#define P2P_AF_GO_DISC_REQ		3	/* GO Discoverability Request */
+
+
+/* WiFi P2P Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_pub_act_frame {
+	uint8	category;	/* P2P_PUB_AF_CATEGORY */
+	uint8	action;		/* P2P_PUB_AF_ACTION */
+	uint8	oui[3];		/* P2P_OUI */
+	uint8	oui_type;	/* OUI type - P2P_VER */
+	uint8	subtype;	/* OUI subtype - P2P_TYPE_* */
+	uint8	dialog_token;	/* nonzero, identifies req/rsp transaction */
+	uint8	elts[1];	/* Variable length information elements.  Max size =
+				 * ACTION_FRAME_SIZE - sizeof(this structure) - 1
+				 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_pub_act_frame wifi_p2p_pub_act_frame_t;
+#define P2P_PUB_AF_FIXED_LEN	8
+#define P2P_PUB_AF_CATEGORY	0x04
+#define P2P_PUB_AF_ACTION	0x09
+
+/* WiFi P2P Public Action Frame OUI Subtypes */
+#define P2P_PAF_GON_REQ		0	/* Group Owner Negotiation Req */
+#define P2P_PAF_GON_RSP		1	/* Group Owner Negotiation Rsp */
+#define P2P_PAF_GON_CONF	2	/* Group Owner Negotiation Confirm */
+#define P2P_PAF_INVITE_REQ	3	/* P2P Invitation Request */
+#define P2P_PAF_INVITE_RSP	4	/* P2P Invitation Response */
+#define P2P_PAF_DEVDIS_REQ	5	/* Device Discoverability Request */
+#define P2P_PAF_DEVDIS_RSP	6	/* Device Discoverability Response */
+#define P2P_PAF_PROVDIS_REQ	7	/* Provision Discovery Request */
+#define P2P_PAF_PROVDIS_RSP	8	/* Provision Discovery Response */
+#define P2P_PAF_SUBTYPE_INVALID	255	/* Invalid Subtype */
+
+/* TODO: Stop using these obsolete aliases for P2P_PAF_GON_* */
+#define P2P_TYPE_MNREQ		P2P_PAF_GON_REQ
+#define P2P_TYPE_MNRSP		P2P_PAF_GON_RSP
+#define P2P_TYPE_MNCONF		P2P_PAF_GON_CONF
+
+/* WiFi P2P IE subelement: Notice of Absence */
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_desc {
+	uint8	cnt_type;	/* Count/Type */
+	uint32	duration;	/* Duration */
+	uint32	interval;	/* Interval */
+	uint32	start;		/* Start Time */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_desc wifi_p2p_noa_desc_t;
+
+BWL_PRE_PACKED_STRUCT struct wifi_p2p_noa_se {
+	uint8	eltId;		/* Subelement ID */
+	uint8	len[2];		/* Length */
+	uint8	index;		/* Index */
+	uint8	ops_ctw_parms;	/* CTWindow and OppPS Parameters */
+	wifi_p2p_noa_desc_t	desc[1];	/* Notice of Absence Descriptor(s) */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2p_noa_se wifi_p2p_noa_se_t;
+
+#define P2P_NOA_SE_FIXED_LEN	5
+
+#define P2P_NOA_SE_MAX_DESC	2	/* max NoA descriptors in presence request */
+
+/* cnt_type field values */
+#define P2P_NOA_DESC_CNT_RESERVED	0	/* reserved and should not be used */
+#define P2P_NOA_DESC_CNT_REPEAT		255	/* continuous schedule */
+#define P2P_NOA_DESC_TYPE_PREFERRED	1	/* preferred values */
+#define P2P_NOA_DESC_TYPE_ACCEPTABLE	2	/* acceptable limits */
+
+/* ctw_ops_parms field values */
+#define P2P_NOA_CTW_MASK	0x7f
+#define P2P_NOA_OPS_MASK	0x80
+#define P2P_NOA_OPS_SHIFT	7
+
+#define P2P_CTW_MIN	10	/* minimum 10TU */
+
+/*
+ * P2P Service Discovery related
+ */
+#define	P2PSD_ACTION_CATEGORY		0x04
+				/* Public action frame */
+#define	P2PSD_ACTION_ID_GAS_IREQ	0x0a
+				/* Action value for GAS Initial Request AF */
+#define	P2PSD_ACTION_ID_GAS_IRESP	0x0b
+				/* Action value for GAS Initial Response AF */
+#define	P2PSD_ACTION_ID_GAS_CREQ	0x0c
+				/* Action value for GAS Comback Request AF */
+#define	P2PSD_ACTION_ID_GAS_CRESP	0x0d
+				/* Action value for GAS Comback Response AF */
+#define P2PSD_AD_EID				0x6c
+				/* Advertisement Protocol IE ID */
+#define P2PSD_ADP_TUPLE_QLMT_PAMEBI	0x00
+				/* Query Response Length Limit 7 bits plus PAME-BI 1 bit */
+#define P2PSD_ADP_PROTO_ID			0x00
+				/* Advertisement Protocol ID. Always 0 for P2P SD */
+#define P2PSD_GAS_OUI				P2P_OUI
+				/* WFA OUI */
+#define P2PSD_GAS_OUI_SUBTYPE		P2P_VER
+				/* OUI Subtype for GAS IE */
+#define P2PSD_GAS_NQP_INFOID		0xDDDD
+				/* NQP Query Info ID: 56797 */
+#define P2PSD_GAS_COMEBACKDEALY		0x00
+				/* Not used in the Native GAS protocol */
+
+/* Service Protocol Type */
+typedef enum p2psd_svc_protype {
+	SVC_RPOTYPE_ALL = 0,
+	SVC_RPOTYPE_BONJOUR = 1,
+	SVC_RPOTYPE_UPNP = 2,
+	SVC_RPOTYPE_WSD = 3,
+	SVC_RPOTYPE_WFDS = 11,
+	SVC_RPOTYPE_VENDOR = 255
+} p2psd_svc_protype_t;
+
+/* Service Discovery response status code */
+typedef enum {
+	P2PSD_RESP_STATUS_SUCCESS = 0,
+	P2PSD_RESP_STATUS_PROTYPE_NA = 1,
+	P2PSD_RESP_STATUS_DATA_NA = 2,
+	P2PSD_RESP_STATUS_BAD_REQUEST = 3
+} p2psd_resp_status_t;
+
+/* Advertisement Protocol IE tuple field */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_tpl {
+	uint8	llm_pamebi;	/* Query Response Length Limit bit 0-6, set to 0 plus
+				* Pre-Associated Message Exchange BSSID Independent bit 7, set to 0
+				*/
+	uint8	adp_id;		/* Advertisement Protocol ID: 0 for NQP Native Query Protocol */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_tpl wifi_p2psd_adp_tpl_t;
+
+/* Advertisement Protocol IE */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_adp_ie {
+	uint8	id;		/* IE ID: 0x6c - 108 */
+	uint8	len;	/* IE length */
+	wifi_p2psd_adp_tpl_t adp_tpl;  /* Advertisement Protocol Tuple field. Only one
+				* tuple is defined for P2P Service Discovery
+				*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_adp_ie wifi_p2psd_adp_ie_t;
+
+/* NQP Vendor-specific Content */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_nqp_query_vsc {
+	uint8	oui_subtype;	/* OUI Subtype: 0x09 */
+	uint16	svc_updi;		/* Service Update Indicator */
+	uint8	svc_tlvs[1];	/* wifi_p2psd_qreq_tlv_t type for service request,
+				* wifi_p2psd_qresp_tlv_t type for service response
+				*/
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_nqp_query_vsc wifi_p2psd_nqp_query_vsc_t;
+
+/* Service Request TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_tlv {
+	uint16	len;			/* Length: 5 plus size of Query Data */
+	uint8	svc_prot;		/* Service Protocol Type */
+	uint8	svc_tscid;		/* Service Transaction ID */
+	uint8	query_data[1];	/* Query Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_tlv wifi_p2psd_qreq_tlv_t;
+
+/* Query Request Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qreq_frame {
+	uint16	info_id;	/* Info ID: 0xDDDD */
+	uint16	len;		/* Length of service request TLV, 5 plus the size of request data */
+	uint8	oui[3];		/* WFA OUI: 0x0050F2 */
+	uint8	qreq_vsc[1]; /* Vendor-specific Content: wifi_p2psd_nqp_query_vsc_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qreq_frame wifi_p2psd_qreq_frame_t;
+
+/* GAS Initial Request AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_ireq_frame {
+	wifi_p2psd_adp_ie_t		adp_ie;		/* Advertisement Protocol IE */
+	uint16					qreq_len;	/* Query Request Length */
+	uint8	qreq_frm[1];	/* Query Request Frame wifi_p2psd_qreq_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_ireq_frame wifi_p2psd_gas_ireq_frame_t;
+
+/* Service Response TLV */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_tlv {
+	uint16	len;				/* Length: 5 plus size of Query Data */
+	uint8	svc_prot;			/* Service Protocol Type */
+	uint8	svc_tscid;			/* Service Transaction ID */
+	uint8	status;				/* Value defined in Table 57 of P2P spec. */
+	uint8	query_data[1];		/* Response Data, passed in from above Layer 2 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_tlv wifi_p2psd_qresp_tlv_t;
+
+/* Query Response Frame, defined in generic format, instead of NQP specific */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_qresp_frame {
+	uint16	info_id;	/* Info ID: 0xDDDD */
+	uint16	len;		/* Lenth of service response TLV, 6 plus the size of resp data */
+	uint8	oui[3];		/* WFA OUI: 0x0050F2 */
+	uint8	qresp_vsc[1]; /* Vendor-specific Content: wifi_p2psd_qresp_tlv_t type for NQP */
+
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_qresp_frame wifi_p2psd_qresp_frame_t;
+
+/* GAS Initial Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_iresp_frame {
+	uint16	status;			/* Value defined in Table 7-23 of IEEE P802.11u */
+	uint16	cb_delay;		/* GAS Comeback Delay */
+	wifi_p2psd_adp_ie_t	adp_ie;		/* Advertisement Protocol IE */
+	uint16		qresp_len;	/* Query Response Length */
+	uint8	qresp_frm[1];	/* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_iresp_frame wifi_p2psd_gas_iresp_frame_t;
+
+/* GAS Comeback Response AF body, "elts" in wifi_p2p_pub_act_frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_cresp_frame {
+	uint16	status;			/* Value defined in Table 7-23 of IEEE P802.11u */
+	uint8	fragment_id;	/* Fragmentation ID */
+	uint16	cb_delay;		/* GAS Comeback Delay */
+	wifi_p2psd_adp_ie_t	adp_ie;		/* Advertisement Protocol IE */
+	uint16	qresp_len;		/* Query Response Length */
+	uint8	qresp_frm[1];	/* Query Response Frame wifi_p2psd_qresp_frame_t */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_cresp_frame wifi_p2psd_gas_cresp_frame_t;
+
+/* Wi-Fi GAS Public Action Frame */
+BWL_PRE_PACKED_STRUCT struct wifi_p2psd_gas_pub_act_frame {
+	uint8	category;		/* 0x04 Public Action Frame */
+	uint8	action;			/* 0x6c Advertisement Protocol */
+	uint8	dialog_token;	/* nonzero, identifies req/rsp transaction */
+	uint8	query_data[1];	/* Query Data. wifi_p2psd_gas_ireq_frame_t
+					 * or wifi_p2psd_gas_iresp_frame_t format
+					 */
+} BWL_POST_PACKED_STRUCT;
+typedef struct wifi_p2psd_gas_pub_act_frame wifi_p2psd_gas_pub_act_frame_t;
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _P2P_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/sdspi.h b/drivers/net/wireless/bcm4336/include/proto/sdspi.h
--- a/drivers/net/wireless/bcm4336/include/proto/sdspi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/sdspi.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,57 @@
+/*
+ * SD-SPI Protocol Standard
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: sdspi.h 382882 2013-02-04 23:24:31Z $
+ */
+#ifndef	_SD_SPI_H
+#define	_SD_SPI_H
+
+#define SPI_START_M		BITFIELD_MASK(1)	/* Bit [31] 	- Start Bit */
+#define SPI_START_S		31
+#define SPI_DIR_M		BITFIELD_MASK(1)	/* Bit [30] 	- Direction */
+#define SPI_DIR_S		30
+#define SPI_CMD_INDEX_M		BITFIELD_MASK(6)	/* Bits [29:24] - Command number */
+#define SPI_CMD_INDEX_S		24
+#define SPI_RW_M		BITFIELD_MASK(1)	/* Bit [23] 	- Read=0, Write=1 */
+#define SPI_RW_S		23
+#define SPI_FUNC_M		BITFIELD_MASK(3)	/* Bits [22:20]	- Function Number */
+#define SPI_FUNC_S		20
+#define SPI_RAW_M		BITFIELD_MASK(1)	/* Bit [19] 	- Read After Wr */
+#define SPI_RAW_S		19
+#define SPI_STUFF_M		BITFIELD_MASK(1)	/* Bit [18] 	- Stuff bit */
+#define SPI_STUFF_S		18
+#define SPI_BLKMODE_M		BITFIELD_MASK(1)	/* Bit [19] 	- Blockmode 1=blk */
+#define SPI_BLKMODE_S		19
+#define SPI_OPCODE_M		BITFIELD_MASK(1)	/* Bit [18] 	- OP Code */
+#define SPI_OPCODE_S		18
+#define SPI_ADDR_M		BITFIELD_MASK(17)	/* Bits [17:1] 	- Address */
+#define SPI_ADDR_S		1
+#define SPI_STUFF0_M		BITFIELD_MASK(1)	/* Bit [0] 	- Stuff bit */
+#define SPI_STUFF0_S		0
+
+#define SPI_RSP_START_M		BITFIELD_MASK(1)	/* Bit [7] 	- Start Bit (always 0) */
+#define SPI_RSP_START_S		7
+#define SPI_RSP_PARAM_ERR_M	BITFIELD_MASK(1)	/* Bit [6] 	- Parameter Error */
+#define SPI_RSP_PARAM_ERR_S	6
+#define SPI_RSP_RFU5_M		BITFIELD_MASK(1)	/* Bit [5] 	- RFU (Always 0) */
+#define SPI_RSP_RFU5_S		5
+#define SPI_RSP_FUNC_ERR_M	BITFIELD_MASK(1)	/* Bit [4] 	- Function number error */
+#define SPI_RSP_FUNC_ERR_S	4
+#define SPI_RSP_CRC_ERR_M	BITFIELD_MASK(1)	/* Bit [3] 	- COM CRC Error */
+#define SPI_RSP_CRC_ERR_S	3
+#define SPI_RSP_ILL_CMD_M	BITFIELD_MASK(1)	/* Bit [2] 	- Illegal Command error */
+#define SPI_RSP_ILL_CMD_S	2
+#define SPI_RSP_RFU1_M		BITFIELD_MASK(1)	/* Bit [1] 	- RFU (Always 0) */
+#define SPI_RSP_RFU1_S		1
+#define SPI_RSP_IDLE_M		BITFIELD_MASK(1)	/* Bit [0] 	- In idle state */
+#define SPI_RSP_IDLE_S		0
+
+/* SD-SPI Protocol Definitions */
+#define SDSPI_COMMAND_LEN	6	/* Number of bytes in an SD command */
+#define SDSPI_START_BLOCK	0xFE	/* SD Start Block Token */
+#define SDSPI_IDLE_PAD		0xFF	/* SD-SPI idle value for MOSI */
+#define SDSPI_START_BIT_MASK	0x80
+
+#endif /* _SD_SPI_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/vlan.h b/drivers/net/wireless/bcm4336/include/proto/vlan.h
--- a/drivers/net/wireless/bcm4336/include/proto/vlan.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/vlan.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,77 @@
+/*
+ * 802.1Q VLAN protocol definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: vlan.h 382883 2013-02-04 23:26:09Z $
+ */
+
+#ifndef _vlan_h_
+#define _vlan_h_
+
+#ifndef _TYPEDEFS_H_
+#include <typedefs.h>
+#endif
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+#ifndef	 VLAN_VID_MASK
+#define VLAN_VID_MASK		0xfff	/* low 12 bits are vlan id */
+#endif
+
+#define	VLAN_CFI_SHIFT		12	/* canonical format indicator bit */
+#define VLAN_PRI_SHIFT		13	/* user priority */
+
+#define VLAN_PRI_MASK		7	/* 3 bits of priority */
+
+#define	VLAN_TPID_OFFSET	12	/* offset of tag protocol id field */
+#define	VLAN_TCI_OFFSET		14	/* offset of tag ctrl info field */
+
+#define	VLAN_TAG_LEN		4
+#define	VLAN_TAG_OFFSET		(2 * ETHER_ADDR_LEN)	/* offset in Ethernet II packet only */
+
+#define VLAN_TPID		0x8100	/* VLAN ethertype/Tag Protocol ID */
+
+struct vlan_header {
+	uint16	vlan_type;		/* 0x8100 */
+	uint16	vlan_tag;		/* priority, cfi and vid */
+};
+
+struct ethervlan_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];
+	uint8	ether_shost[ETHER_ADDR_LEN];
+	uint16	vlan_type;		/* 0x8100 */
+	uint16	vlan_tag;		/* priority, cfi and vid */
+	uint16	ether_type;
+};
+
+struct dot3_mac_llc_snapvlan_header {
+	uint8	ether_dhost[ETHER_ADDR_LEN];	/* dest mac */
+	uint8	ether_shost[ETHER_ADDR_LEN];	/* src mac */
+	uint16	length;				/* frame length incl header */
+	uint8	dsap;				/* always 0xAA */
+	uint8	ssap;				/* always 0xAA */
+	uint8	ctl;				/* always 0x03 */
+	uint8	oui[3];				/* RFC1042: 0x00 0x00 0x00
+						 * Bridge-Tunnel: 0x00 0x00 0xF8
+						 */
+	uint16	vlan_type;			/* 0x8100 */
+	uint16	vlan_tag;			/* priority, cfi and vid */
+	uint16	ether_type;			/* ethertype */
+};
+
+#define	ETHERVLAN_HDR_LEN	(ETHER_HDR_LEN + VLAN_TAG_LEN)
+
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#define ETHERVLAN_MOVE_HDR(d, s) \
+do { \
+	struct ethervlan_header t; \
+	t = *(struct ethervlan_header *)(s); \
+	*(struct ethervlan_header *)(d) = t; \
+} while (0)
+
+#endif /* _vlan_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/proto/wpa.h b/drivers/net/wireless/bcm4336/include/proto/wpa.h
--- a/drivers/net/wireless/bcm4336/include/proto/wpa.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/proto/wpa.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,199 @@
+/*
+ * Fundamental types and constants relating to WPA
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wpa.h 492853 2014-07-23 17:20:34Z $
+ */
+
+#ifndef _proto_wpa_h_
+#define _proto_wpa_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+
+
+/* This marks the start of a packed structure section. */
+#include <packed_section_start.h>
+
+/* Reason Codes */
+
+/* 13 through 23 taken from IEEE Std 802.11i-2004 */
+#define DOT11_RC_INVALID_WPA_IE		13	/* Invalid info. element */
+#define DOT11_RC_MIC_FAILURE		14	/* Michael failure */
+#define DOT11_RC_4WH_TIMEOUT		15	/* 4-way handshake timeout */
+#define DOT11_RC_GTK_UPDATE_TIMEOUT	16	/* Group key update timeout */
+#define DOT11_RC_WPA_IE_MISMATCH	17	/* WPA IE in 4-way handshake differs from
+						 * (re-)assoc. request/probe response
+						 */
+#define DOT11_RC_INVALID_MC_CIPHER	18	/* Invalid multicast cipher */
+#define DOT11_RC_INVALID_UC_CIPHER	19	/* Invalid unicast cipher */
+#define DOT11_RC_INVALID_AKMP		20	/* Invalid authenticated key management protocol */
+#define DOT11_RC_BAD_WPA_VERSION	21	/* Unsupported WPA version */
+#define DOT11_RC_INVALID_WPA_CAP	22	/* Invalid WPA IE capabilities */
+#define DOT11_RC_8021X_AUTH_FAIL	23	/* 802.1X authentication failure */
+
+#define WPA2_PMKID_LEN	16
+
+/* WPA IE fixed portion */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+	uint8 tag;	/* TAG */
+	uint8 length;	/* TAG length */
+	uint8 oui[3];	/* IE OUI */
+	uint8 oui_type;	/* OUI type */
+	BWL_PRE_PACKED_STRUCT struct {
+		uint8 low;
+		uint8 high;
+	} BWL_POST_PACKED_STRUCT version;	/* IE version */
+} BWL_POST_PACKED_STRUCT wpa_ie_fixed_t;
+#define WPA_IE_OUITYPE_LEN	4
+#define WPA_IE_FIXED_LEN	8
+#define WPA_IE_TAG_FIXED_LEN	6
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8 tag;	/* TAG */
+	uint8 length;	/* TAG length */
+	BWL_PRE_PACKED_STRUCT struct {
+		uint8 low;
+		uint8 high;
+	} BWL_POST_PACKED_STRUCT version;	/* IE version */
+} BWL_POST_PACKED_STRUCT wpa_rsn_ie_fixed_t;
+#define WPA_RSN_IE_FIXED_LEN	4
+#define WPA_RSN_IE_TAG_FIXED_LEN	2
+typedef uint8 wpa_pmkid_t[WPA2_PMKID_LEN];
+
+#define WFA_OSEN_IE_FIXED_LEN	6
+
+/* WPA suite/multicast suite */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+	uint8 oui[3];
+	uint8 type;
+} BWL_POST_PACKED_STRUCT wpa_suite_t, wpa_suite_mcast_t;
+#define WPA_SUITE_LEN	4
+
+/* WPA unicast suite list/key management suite list */
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+	BWL_PRE_PACKED_STRUCT struct {
+		uint8 low;
+		uint8 high;
+	} BWL_POST_PACKED_STRUCT count;
+	wpa_suite_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_suite_ucast_t, wpa_suite_auth_key_mgmt_t;
+#define WPA_IE_SUITE_COUNT_LEN	2
+typedef BWL_PRE_PACKED_STRUCT struct
+{
+	BWL_PRE_PACKED_STRUCT struct {
+		uint8 low;
+		uint8 high;
+	} BWL_POST_PACKED_STRUCT count;
+	wpa_pmkid_t list[1];
+} BWL_POST_PACKED_STRUCT wpa_pmkid_list_t;
+
+/* WPA cipher suites */
+#define WPA_CIPHER_NONE		0	/* None */
+#define WPA_CIPHER_WEP_40	1	/* WEP (40-bit) */
+#define WPA_CIPHER_TKIP		2	/* TKIP: default for WPA */
+#define WPA_CIPHER_AES_OCB	3	/* AES (OCB) */
+#define WPA_CIPHER_AES_CCM	4	/* AES (CCM) */
+#define WPA_CIPHER_WEP_104	5	/* WEP (104-bit) */
+#define WPA_CIPHER_BIP		6	/* WEP (104-bit) */
+#define WPA_CIPHER_TPK		7	/* Group addressed traffic not allowed */
+#ifdef BCMCCX
+#define WPA_CIPHER_CKIP		8	/* KP with no MIC */
+#define WPA_CIPHER_CKIP_MMH	9	/* KP with MIC ("CKIP/MMH", "CKIP+CMIC") */
+#define WPA_CIPHER_WEP_MMH	10	/* MIC with no KP ("WEP/MMH", "CMIC") */
+
+#define IS_CCX_CIPHER(cipher)	((cipher) == WPA_CIPHER_CKIP || \
+				 (cipher) == WPA_CIPHER_CKIP_MMH || \
+				 (cipher) == WPA_CIPHER_WEP_MMH)
+#endif
+
+#ifdef BCMWAPI_WAI
+#define WAPI_CIPHER_NONE	WPA_CIPHER_NONE
+#define WAPI_CIPHER_SMS4	11
+
+#define WAPI_CSE_WPI_SMS4	1
+#endif /* BCMWAPI_WAI */
+
+#define IS_WPA_CIPHER(cipher)	((cipher) == WPA_CIPHER_NONE || \
+				 (cipher) == WPA_CIPHER_WEP_40 || \
+				 (cipher) == WPA_CIPHER_WEP_104 || \
+				 (cipher) == WPA_CIPHER_TKIP || \
+				 (cipher) == WPA_CIPHER_AES_OCB || \
+				 (cipher) == WPA_CIPHER_AES_CCM || \
+				 (cipher) == WPA_CIPHER_TPK)
+
+#ifdef BCMWAPI_WAI
+#define IS_WAPI_CIPHER(cipher)	((cipher) == WAPI_CIPHER_NONE || \
+				 (cipher) == WAPI_CSE_WPI_SMS4)
+
+/* convert WAPI_CSE_WPI_XXX to WAPI_CIPHER_XXX */
+#define WAPI_CSE_WPI_2_CIPHER(cse) ((cse) == WAPI_CSE_WPI_SMS4 ? \
+				WAPI_CIPHER_SMS4 : WAPI_CIPHER_NONE)
+
+#define WAPI_CIPHER_2_CSE_WPI(cipher) ((cipher) == WAPI_CIPHER_SMS4 ? \
+				WAPI_CSE_WPI_SMS4 : WAPI_CIPHER_NONE)
+#endif /* BCMWAPI_WAI */
+
+/* WPA TKIP countermeasures parameters */
+#define WPA_TKIP_CM_DETECT	60	/* multiple MIC failure window (seconds) */
+#define WPA_TKIP_CM_BLOCK	60	/* countermeasures active window (seconds) */
+
+/* RSN IE defines */
+#define RSN_CAP_LEN		2	/* Length of RSN capabilities field (2 octets) */
+
+/* RSN Capabilities defined in 802.11i */
+#define RSN_CAP_PREAUTH			0x0001
+#define RSN_CAP_NOPAIRWISE		0x0002
+#define RSN_CAP_PTK_REPLAY_CNTR_MASK	0x000C
+#define RSN_CAP_PTK_REPLAY_CNTR_SHIFT	2
+#define RSN_CAP_GTK_REPLAY_CNTR_MASK	0x0030
+#define RSN_CAP_GTK_REPLAY_CNTR_SHIFT	4
+#define RSN_CAP_1_REPLAY_CNTR		0
+#define RSN_CAP_2_REPLAY_CNTRS		1
+#define RSN_CAP_4_REPLAY_CNTRS		2
+#define RSN_CAP_16_REPLAY_CNTRS		3
+#define RSN_CAP_MFPR			0x0040
+#define RSN_CAP_MFPC			0x0080
+#define RSN_CAP_SPPC			0x0400
+#define RSN_CAP_SPPR			0x0800
+
+/* WPA capabilities defined in 802.11i */
+#define WPA_CAP_4_REPLAY_CNTRS		RSN_CAP_4_REPLAY_CNTRS
+#define WPA_CAP_16_REPLAY_CNTRS		RSN_CAP_16_REPLAY_CNTRS
+#define WPA_CAP_REPLAY_CNTR_SHIFT	RSN_CAP_PTK_REPLAY_CNTR_SHIFT
+#define WPA_CAP_REPLAY_CNTR_MASK	RSN_CAP_PTK_REPLAY_CNTR_MASK
+
+/* WPA capabilities defined in 802.11zD9.0 */
+#define WPA_CAP_PEER_KEY_ENABLE		(0x1 << 1)	/* bit 9 */
+
+/* WPA Specific defines */
+#define WPA_CAP_LEN	RSN_CAP_LEN	/* Length of RSN capabilities in RSN IE (2 octets) */
+#define WPA_PMKID_CNT_LEN	2 	/* Length of RSN PMKID count (2 octests) */
+
+#define	WPA_CAP_WPA2_PREAUTH		RSN_CAP_PREAUTH
+
+#define WPA2_PMKID_COUNT_LEN	2
+#define RSN_GROUPMANAGE_CIPHER_LEN 4
+
+#ifdef BCMWAPI_WAI
+#define WAPI_CAP_PREAUTH		RSN_CAP_PREAUTH
+
+/* Other WAI definition */
+#define WAPI_WAI_REQUEST		0x00F1
+#define WAPI_UNICAST_REKEY		0x00F2
+#define WAPI_STA_AGING			0x00F3
+#define WAPI_MUTIL_REKEY		0x00F4
+#define WAPI_STA_STATS			0x00F5
+
+#define WAPI_USK_REKEY_COUNT		0x4000000 /* 0xA00000 */
+#define WAPI_MSK_REKEY_COUNT		0x4000000 /* 0xA00000 */
+#endif /* BCMWAPI_WAI */
+
+/* This marks the end of a packed structure section. */
+#include <packed_section_end.h>
+
+#endif /* _proto_wpa_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbchipc.h b/drivers/net/wireless/bcm4336/include/sbchipc.h
--- a/drivers/net/wireless/bcm4336/include/sbchipc.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbchipc.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,3629 @@
+/*
+ * SiliconBackplane Chipcommon core hardware definitions.
+ *
+ * The chipcommon core provides chip identification, SB control,
+ * JTAG, 0/1/2 UARTs, clock frequency control, a watchdog interrupt timer,
+ * GPIO interface, extbus, and support for serial and parallel flashes.
+ *
+ * $Id: sbchipc.h 474281 2014-04-30 18:24:55Z $
+ *
+ * $Copyright Open Broadcom Corporation$
+ */
+
+#ifndef	_SBCHIPC_H
+#define	_SBCHIPC_H
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+/**
+ * In chipcommon rev 49 the pmu registers have been moved from chipc to the pmu core if the
+ * 'AOBPresent' bit of 'CoreCapabilitiesExt' is set. If this field is set, the traditional chipc to
+ * [pmu|gci|sreng] register interface is deprecated and removed. These register blocks would instead
+ * be assigned their respective chipc-specific address space and connected to the Always On
+ * Backplane via the APB interface.
+ */
+typedef volatile struct {
+	uint32  PAD[384];
+	uint32	pmucontrol;		/* 0x600 */
+	uint32	pmucapabilities;
+	uint32	pmustatus;
+	uint32	res_state;
+	uint32	res_pending;
+	uint32	pmutimer;
+	uint32	min_res_mask;
+	uint32	max_res_mask;
+	uint32	res_table_sel;
+	uint32	res_dep_mask;
+	uint32	res_updn_timer;
+	uint32	res_timer;
+	uint32	clkstretch;
+	uint32	pmuwatchdog;
+	uint32	gpiosel;		/* 0x638, rev >= 1 */
+	uint32	gpioenable;		/* 0x63c, rev >= 1 */
+	uint32	res_req_timer_sel;
+	uint32	res_req_timer;
+	uint32	res_req_mask;
+	uint32	PAD;
+	uint32	chipcontrol_addr;	/* 0x650 */
+	uint32	chipcontrol_data;	/* 0x654 */
+	uint32	regcontrol_addr;
+	uint32	regcontrol_data;
+	uint32	pllcontrol_addr;
+	uint32	pllcontrol_data;
+	uint32	pmustrapopt;		/* 0x668, corerev >= 28 */
+	uint32	pmu_xtalfreq;		/* 0x66C, pmurev >= 10 */
+	uint32  retention_ctl;		/* 0x670 */
+	uint32  PAD[3];
+	uint32  retention_grpidx;	/* 0x680 */
+	uint32  retention_grpctl;	/* 0x684 */
+	uint32  PAD[20];
+	uint32	pmucontrol_ext;		/* 0x6d8 */
+	uint32	slowclkperiod;		/* 0x6dc */
+	uint32	PAD[8];
+	uint32	pmuintmask0;		/* 0x700 */
+	uint32	pmuintmask1;		/* 0x704 */
+	uint32  PAD[14];
+	uint32  pmuintstatus;		/* 0x740 */
+} pmuregs_t;
+
+typedef struct eci_prerev35 {
+	uint32	eci_output;
+	uint32	eci_control;
+	uint32	eci_inputlo;
+	uint32	eci_inputmi;
+	uint32	eci_inputhi;
+	uint32	eci_inputintpolaritylo;
+	uint32	eci_inputintpolaritymi;
+	uint32	eci_inputintpolarityhi;
+	uint32	eci_intmasklo;
+	uint32	eci_intmaskmi;
+	uint32	eci_intmaskhi;
+	uint32	eci_eventlo;
+	uint32	eci_eventmi;
+	uint32	eci_eventhi;
+	uint32	eci_eventmasklo;
+	uint32	eci_eventmaskmi;
+	uint32	eci_eventmaskhi;
+	uint32	PAD[3];
+} eci_prerev35_t;
+
+typedef struct eci_rev35 {
+	uint32	eci_outputlo;
+	uint32	eci_outputhi;
+	uint32	eci_controllo;
+	uint32	eci_controlhi;
+	uint32	eci_inputlo;
+	uint32	eci_inputhi;
+	uint32	eci_inputintpolaritylo;
+	uint32	eci_inputintpolarityhi;
+	uint32	eci_intmasklo;
+	uint32	eci_intmaskhi;
+	uint32	eci_eventlo;
+	uint32	eci_eventhi;
+	uint32	eci_eventmasklo;
+	uint32	eci_eventmaskhi;
+	uint32	eci_auxtx;
+	uint32	eci_auxrx;
+	uint32	eci_datatag;
+	uint32	eci_uartescvalue;
+	uint32	eci_autobaudctr;
+	uint32	eci_uartfifolevel;
+} eci_rev35_t;
+
+typedef struct flash_config {
+	uint32	PAD[19];
+	/* Flash struct configuration registers (0x18c) for BCM4706 (corerev = 31) */
+	uint32 flashstrconfig;
+} flash_config_t;
+
+typedef volatile struct {
+	uint32	chipid;			/* 0x0 */
+	uint32	capabilities;
+	uint32	corecontrol;		/* corerev >= 1 */
+	uint32	bist;
+
+	/* OTP */
+	uint32	otpstatus;		/* 0x10, corerev >= 10 */
+	uint32	otpcontrol;
+	uint32	otpprog;
+	uint32	otplayout;		/* corerev >= 23 */
+
+	/* Interrupt control */
+	uint32	intstatus;		/* 0x20 */
+	uint32	intmask;
+
+	/* Chip specific regs */
+	uint32	chipcontrol;		/* 0x28, rev >= 11 */
+	uint32	chipstatus;		/* 0x2c, rev >= 11 */
+
+	/* Jtag Master */
+	uint32	jtagcmd;		/* 0x30, rev >= 10 */
+	uint32	jtagir;
+	uint32	jtagdr;
+	uint32	jtagctrl;
+
+	/* serial flash interface registers */
+	uint32	flashcontrol;		/* 0x40 */
+	uint32	flashaddress;
+	uint32	flashdata;
+	uint32	otplayoutextension;	/* rev >= 35 */
+
+	/* Silicon backplane configuration broadcast control */
+	uint32	broadcastaddress;	/* 0x50 */
+	uint32	broadcastdata;
+
+	/* gpio - cleared only by power-on-reset */
+	uint32	gpiopullup;		/* 0x58, corerev >= 20 */
+	uint32	gpiopulldown;		/* 0x5c, corerev >= 20 */
+	uint32	gpioin;			/* 0x60 */
+	uint32	gpioout;		/* 0x64 */
+	uint32	gpioouten;		/* 0x68 */
+	uint32	gpiocontrol;		/* 0x6C */
+	uint32	gpiointpolarity;	/* 0x70 */
+	uint32	gpiointmask;		/* 0x74 */
+
+	/* GPIO events corerev >= 11 */
+	uint32	gpioevent;
+	uint32	gpioeventintmask;
+
+	/* Watchdog timer */
+	uint32	watchdog;		/* 0x80 */
+
+	/* GPIO events corerev >= 11 */
+	uint32	gpioeventintpolarity;
+
+	/* GPIO based LED powersave registers corerev >= 16 */
+	uint32  gpiotimerval;		/* 0x88 */
+	uint32  gpiotimeroutmask;
+
+	/* clock control */
+	uint32	clockcontrol_n;		/* 0x90 */
+	uint32	clockcontrol_sb;	/* aka m0 */
+	uint32	clockcontrol_pci;	/* aka m1 */
+	uint32	clockcontrol_m2;	/* mii/uart/mipsref */
+	uint32	clockcontrol_m3;	/* cpu */
+	uint32	clkdiv;			/* corerev >= 3 */
+	uint32	gpiodebugsel;		/* corerev >= 28 */
+	uint32	capabilities_ext;               	/* 0xac  */
+
+	/* pll delay registers (corerev >= 4) */
+	uint32	pll_on_delay;		/* 0xb0 */
+	uint32	fref_sel_delay;
+	uint32	slow_clk_ctl;		/* 5 < corerev < 10 */
+	uint32	PAD;
+
+	/* Instaclock registers (corerev >= 10) */
+	uint32	system_clk_ctl;		/* 0xc0 */
+	uint32	clkstatestretch;
+	uint32	PAD[2];
+
+	/* Indirect backplane access (corerev >= 22) */
+	uint32	bp_addrlow;		/* 0xd0 */
+	uint32	bp_addrhigh;
+	uint32	bp_data;
+	uint32	PAD;
+	uint32	bp_indaccess;
+	/* SPI registers, corerev >= 37 */
+	uint32	gsioctrl;
+	uint32	gsioaddress;
+	uint32	gsiodata;
+
+	/* More clock dividers (corerev >= 32) */
+	uint32	clkdiv2;
+	/* FAB ID (corerev >= 40) */
+	uint32	otpcontrol1;
+	uint32	fabid;			/* 0xf8 */
+
+	/* In AI chips, pointer to erom */
+	uint32	eromptr;		/* 0xfc */
+
+	/* ExtBus control registers (corerev >= 3) */
+	uint32	pcmcia_config;		/* 0x100 */
+	uint32	pcmcia_memwait;
+	uint32	pcmcia_attrwait;
+	uint32	pcmcia_iowait;
+	uint32	ide_config;
+	uint32	ide_memwait;
+	uint32	ide_attrwait;
+	uint32	ide_iowait;
+	uint32	prog_config;
+	uint32	prog_waitcount;
+	uint32	flash_config;
+	uint32	flash_waitcount;
+	uint32  SECI_config;		/* 0x130 SECI configuration */
+	uint32	SECI_status;
+	uint32	SECI_statusmask;
+	uint32	SECI_rxnibchanged;
+
+	uint32	PAD[20];
+
+	/* SROM interface (corerev >= 32) */
+	uint32	sromcontrol;		/* 0x190 */
+	uint32	sromaddress;
+	uint32	sromdata;
+	uint32	PAD[1];				/* 0x19C */
+	/* NAND flash registers for BCM4706 (corerev = 31) */
+	uint32  nflashctrl;         /* 0x1a0 */
+	uint32  nflashconf;
+	uint32  nflashcoladdr;
+	uint32  nflashrowaddr;
+	uint32  nflashdata;
+	uint32  nflashwaitcnt0;		/* 0x1b4 */
+	uint32  PAD[2];
+
+	uint32  seci_uart_data;		/* 0x1C0 */
+	uint32  seci_uart_bauddiv;
+	uint32  seci_uart_fcr;
+	uint32  seci_uart_lcr;
+	uint32  seci_uart_mcr;
+	uint32  seci_uart_lsr;
+	uint32  seci_uart_msr;
+	uint32  seci_uart_baudadj;
+	/* Clock control and hardware workarounds (corerev >= 20) */
+	uint32	clk_ctl_st;		/* 0x1e0 */
+	uint32	hw_war;
+	uint32	PAD[70];
+
+	/* UARTs */
+	uint8	uart0data;		/* 0x300 */
+	uint8	uart0imr;
+	uint8	uart0fcr;
+	uint8	uart0lcr;
+	uint8	uart0mcr;
+	uint8	uart0lsr;
+	uint8	uart0msr;
+	uint8	uart0scratch;
+	uint8	PAD[248];		/* corerev >= 1 */
+
+	uint8	uart1data;		/* 0x400 */
+	uint8	uart1imr;
+	uint8	uart1fcr;
+	uint8	uart1lcr;
+	uint8	uart1mcr;
+	uint8	uart1lsr;
+	uint8	uart1msr;
+	uint8	uart1scratch;		/* 0x407 */
+	uint32	PAD[62];
+
+	/* save/restore, corerev >= 48 */
+	uint32	sr_capability;		/* 0x500 */
+	uint32	sr_control0;		/* 0x504 */
+	uint32	sr_control1;		/* 0x508 */
+	uint32  gpio_control;		/* 0x50C */
+	uint32	PAD[60];
+
+	/* PMU registers (corerev >= 20) */
+	/* Note: all timers driven by ILP clock are updated asynchronously to HT/ALP.
+	 * The CPU must read them twice, compare, and retry if different.
+	 */
+	uint32	pmucontrol;		/* 0x600 */
+	uint32	pmucapabilities;
+	uint32	pmustatus;
+	uint32	res_state;
+	uint32	res_pending;
+	uint32	pmutimer;
+	uint32	min_res_mask;
+	uint32	max_res_mask;
+	uint32	res_table_sel;
+	uint32	res_dep_mask;
+	uint32	res_updn_timer;
+	uint32	res_timer;
+	uint32	clkstretch;
+	uint32	pmuwatchdog;
+	uint32	gpiosel;		/* 0x638, rev >= 1 */
+	uint32	gpioenable;		/* 0x63c, rev >= 1 */
+	uint32	res_req_timer_sel;
+	uint32	res_req_timer;
+	uint32	res_req_mask;
+	uint32	PAD;
+	uint32	chipcontrol_addr;	/* 0x650 */
+	uint32	chipcontrol_data;	/* 0x654 */
+	uint32	regcontrol_addr;
+	uint32	regcontrol_data;
+	uint32	pllcontrol_addr;
+	uint32	pllcontrol_data;
+	uint32	pmustrapopt;		/* 0x668, corerev >= 28 */
+	uint32	pmu_xtalfreq;		/* 0x66C, pmurev >= 10 */
+	uint32  retention_ctl;		/* 0x670 */
+	uint32  PAD[3];
+	uint32  retention_grpidx;	/* 0x680 */
+	uint32  retention_grpctl;	/* 0x684 */
+	uint32  PAD[20];
+	uint32	pmucontrol_ext;		/* 0x6d8 */
+	uint32	slowclkperiod;		/* 0x6dc */
+	uint32	PAD[8];
+	uint32	pmuintmask0;		/* 0x700 */
+	uint32	pmuintmask1;		/* 0x704 */
+	uint32  PAD[14];
+	uint32  pmuintstatus;		/* 0x740 */
+	uint32	PAD[47];
+	uint16	sromotp[512];		/* 0x800 */
+#ifdef NFLASH_SUPPORT
+	/* Nand flash MLC controller registers (corerev >= 38) */
+	uint32	nand_revision;		/* 0xC00 */
+	uint32	nand_cmd_start;
+	uint32	nand_cmd_addr_x;
+	uint32	nand_cmd_addr;
+	uint32	nand_cmd_end_addr;
+	uint32	nand_cs_nand_select;
+	uint32	nand_cs_nand_xor;
+	uint32	PAD;
+	uint32	nand_spare_rd0;
+	uint32	nand_spare_rd4;
+	uint32	nand_spare_rd8;
+	uint32	nand_spare_rd12;
+	uint32	nand_spare_wr0;
+	uint32	nand_spare_wr4;
+	uint32	nand_spare_wr8;
+	uint32	nand_spare_wr12;
+	uint32	nand_acc_control;
+	uint32	PAD;
+	uint32	nand_config;
+	uint32	PAD;
+	uint32	nand_timing_1;
+	uint32	nand_timing_2;
+	uint32	nand_semaphore;
+	uint32	PAD;
+	uint32	nand_devid;
+	uint32	nand_devid_x;
+	uint32	nand_block_lock_status;
+	uint32	nand_intfc_status;
+	uint32	nand_ecc_corr_addr_x;
+	uint32	nand_ecc_corr_addr;
+	uint32	nand_ecc_unc_addr_x;
+	uint32	nand_ecc_unc_addr;
+	uint32	nand_read_error_count;
+	uint32	nand_corr_stat_threshold;
+	uint32	PAD[2];
+	uint32	nand_read_addr_x;
+	uint32	nand_read_addr;
+	uint32	nand_page_program_addr_x;
+	uint32	nand_page_program_addr;
+	uint32	nand_copy_back_addr_x;
+	uint32	nand_copy_back_addr;
+	uint32	nand_block_erase_addr_x;
+	uint32	nand_block_erase_addr;
+	uint32	nand_inv_read_addr_x;
+	uint32	nand_inv_read_addr;
+	uint32	PAD[2];
+	uint32	nand_blk_wr_protect;
+	uint32	PAD[3];
+	uint32	nand_acc_control_cs1;
+	uint32	nand_config_cs1;
+	uint32	nand_timing_1_cs1;
+	uint32	nand_timing_2_cs1;
+	uint32	PAD[20];
+	uint32	nand_spare_rd16;
+	uint32	nand_spare_rd20;
+	uint32	nand_spare_rd24;
+	uint32	nand_spare_rd28;
+	uint32	nand_cache_addr;
+	uint32	nand_cache_data;
+	uint32	nand_ctrl_config;
+	uint32	nand_ctrl_status;
+#endif /* NFLASH_SUPPORT */
+	uint32  gci_corecaps0; /* GCI starting at 0xC00 */
+	uint32  gci_corecaps1;
+	uint32  gci_corecaps2;
+	uint32  gci_corectrl;
+	uint32  gci_corestat; /* 0xC10 */
+	uint32  gci_intstat; /* 0xC14 */
+	uint32  gci_intmask; /* 0xC18 */
+	uint32  gci_wakemask; /* 0xC1C */
+	uint32  gci_levelintstat; /* 0xC20 */
+	uint32  gci_eventintstat; /* 0xC24 */
+	uint32  PAD[6];
+	uint32  gci_indirect_addr; /* 0xC40 */
+	uint32  gci_gpioctl; /* 0xC44 */
+	uint32	gci_gpiostatus;
+	uint32  gci_gpiomask; /* 0xC4C */
+	uint32  PAD;
+	uint32  gci_miscctl; /* 0xC54 */
+	uint32	gci_gpiointmask;
+	uint32	gci_gpiowakemask;
+	uint32  gci_input[32]; /* C60 */
+	uint32  gci_event[32]; /* CE0 */
+	uint32  gci_output[4]; /* D60 */
+	uint32  gci_control_0; /* 0xD70 */
+	uint32  gci_control_1; /* 0xD74 */
+	uint32  gci_intpolreg; /* 0xD78 */
+	uint32  gci_levelintmask; /* 0xD7C */
+	uint32  gci_eventintmask; /* 0xD80 */
+	uint32  PAD[3];
+	uint32  gci_inbandlevelintmask; /* 0xD90 */
+	uint32  gci_inbandeventintmask; /* 0xD94 */
+	uint32  PAD[2];
+	uint32  gci_seciauxtx; /* 0xDA0 */
+	uint32  gci_seciauxrx; /* 0xDA4 */
+	uint32  gci_secitx_datatag; /* 0xDA8 */
+	uint32  gci_secirx_datatag; /* 0xDAC */
+	uint32  gci_secitx_datamask; /* 0xDB0 */
+	uint32  gci_seciusef0tx_reg; /* 0xDB4 */
+	uint32  gci_secif0tx_offset; /* 0xDB8 */
+	uint32  gci_secif0rx_offset; /* 0xDBC */
+	uint32  gci_secif1tx_offset; /* 0xDC0 */
+	uint32	gci_rxfifo_common_ctrl; /* 0xDC4 */
+	uint32	gci_rxfifoctrl; /* 0xDC8 */
+	uint32	gci_uartreadid; /* DCC */
+	uint32  gci_uartescval; /* DD0 */
+	uint32	PAD;
+	uint32	gci_secififolevel; /* DD8 */
+	uint32	gci_seciuartdata; /* DDC */
+	uint32  gci_secibauddiv; /* DE0 */
+	uint32  gci_secifcr; /* DE4 */
+	uint32  gci_secilcr; /* DE8 */
+	uint32  gci_secimcr; /* DEC */
+	uint32	gci_secilsr; /* DF0 */
+	uint32	gci_secimsr; /* DF4 */
+	uint32  gci_baudadj; /* DF8 */
+	uint32  PAD;
+	uint32  gci_chipctrl; /* 0xE00 */
+	uint32  gci_chipsts; /* 0xE04 */
+	uint32	gci_gpioout; /* 0xE08 */
+	uint32	gci_gpioout_read; /* 0xE0C */
+	uint32	gci_mpwaketx; /* 0xE10 */
+	uint32	gci_mpwakedetect; /* 0xE14 */
+	uint32	gci_seciin_ctrl; /* 0xE18 */
+	uint32	gci_seciout_ctrl; /* 0xE1C */
+	uint32	gci_seciin_auxfifo_en; /* 0xE20 */
+	uint32	gci_seciout_txen_txbr; /* 0xE24 */
+	uint32	gci_seciin_rxbrstatus; /* 0xE28 */
+	uint32	gci_seciin_rxerrstatus; /* 0xE2C */
+	uint32	gci_seciin_fcstatus; /* 0xE30 */
+	uint32	gci_seciout_txstatus; /* 0xE34 */
+	uint32	gci_seciout_txbrstatus; /* 0xE38 */
+} chipcregs_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+
+#define	CC_CHIPID		0
+#define	CC_CAPABILITIES		4
+#define	CC_CHIPST		0x2c
+#define	CC_EROMPTR		0xfc
+
+#define	CC_OTPST		0x10
+#define	CC_INTSTATUS		0x20
+#define	CC_INTMASK		0x24
+#define	CC_JTAGCMD		0x30
+#define	CC_JTAGIR		0x34
+#define	CC_JTAGDR		0x38
+#define	CC_JTAGCTRL		0x3c
+#define	CC_GPIOPU		0x58
+#define	CC_GPIOPD		0x5c
+#define	CC_GPIOIN		0x60
+#define	CC_GPIOOUT		0x64
+#define	CC_GPIOOUTEN		0x68
+#define	CC_GPIOCTRL		0x6c
+#define	CC_GPIOPOL		0x70
+#define	CC_GPIOINTM		0x74
+#define	CC_GPIOEVENT		0x78
+#define	CC_GPIOEVENTMASK	0x7c
+#define	CC_WATCHDOG		0x80
+#define	CC_GPIOEVENTPOL		0x84
+#define	CC_CLKC_N		0x90
+#define	CC_CLKC_M0		0x94
+#define	CC_CLKC_M1		0x98
+#define	CC_CLKC_M2		0x9c
+#define	CC_CLKC_M3		0xa0
+#define	CC_CLKDIV		0xa4
+#define	CC_SYS_CLK_CTL		0xc0
+#define	CC_CLK_CTL_ST		SI_CLK_CTL_ST
+#define	PMU_CTL			0x600
+#define	PMU_CAP			0x604
+#define	PMU_ST			0x608
+#define PMU_RES_STATE		0x60c
+#define PMU_RES_PENDING		0x610
+#define PMU_TIMER		0x614
+#define	PMU_MIN_RES_MASK	0x618
+#define	PMU_MAX_RES_MASK	0x61c
+#define CC_CHIPCTL_ADDR         0x650
+#define CC_CHIPCTL_DATA         0x654
+#define PMU_REG_CONTROL_ADDR	0x658
+#define PMU_REG_CONTROL_DATA	0x65C
+#define PMU_PLL_CONTROL_ADDR 	0x660
+#define PMU_PLL_CONTROL_DATA 	0x664
+#define CC_SROM_CTRL		0x190
+#define	CC_SROM_OTP		0x800		/* SROM/OTP address space */
+#define CC_GCI_INDIRECT_ADDR_REG	0xC40
+#define CC_GCI_CHIP_CTRL_REG	0xE00
+#define CC_GCI_CC_OFFSET_2	2
+#define CC_GCI_CC_OFFSET_5	5
+#define CC_SWD_CTRL		0x380
+#define CC_SWD_REQACK		0x384
+#define CC_SWD_DATA		0x388
+
+
+#define CHIPCTRLREG0 0x0
+#define CHIPCTRLREG1 0x1
+#define CHIPCTRLREG2 0x2
+#define CHIPCTRLREG3 0x3
+#define CHIPCTRLREG4 0x4
+#define CHIPCTRLREG5 0x5
+#define CHIPCTRLREG6 0x6
+#define REGCTRLREG4 0x4
+#define REGCTRLREG5 0x5
+#define REGCTRLREG6 0x6
+#define MINRESMASKREG 0x618
+#define MAXRESMASKREG 0x61c
+#define CHIPCTRLADDR 0x650
+#define CHIPCTRLDATA 0x654
+#define RSRCTABLEADDR 0x620
+#define PMU_RES_DEP_MASK 0x624
+#define RSRCUPDWNTIME 0x628
+#define PMUREG_RESREQ_MASK 0x68c
+#define EXT_LPO_AVAIL 0x100
+#define LPO_SEL					(1 << 0)
+#define CC_EXT_LPO_PU 0x200000
+#define GC_EXT_LPO_PU 0x2
+#define CC_INT_LPO_PU 0x100000
+#define GC_INT_LPO_PU 0x1
+#define EXT_LPO_SEL 0x8
+#define INT_LPO_SEL 0x4
+#define ENABLE_FINE_CBUCK_CTRL 			(1 << 30)
+#define REGCTRL5_PWM_AUTO_CTRL_MASK 		0x007e0000
+#define REGCTRL5_PWM_AUTO_CTRL_SHIFT		17
+#define REGCTRL6_PWM_AUTO_CTRL_MASK 		0x3fff0000
+#define REGCTRL6_PWM_AUTO_CTRL_SHIFT		16
+
+#ifdef SR_DEBUG
+#define SUBCORE_POWER_ON 0x0001
+#define PHY_POWER_ON 0x0010
+#define VDDM_POWER_ON 0x0100
+#define MEMLPLDO_POWER_ON 0x1000
+#define SUBCORE_POWER_ON_CHK 0x00040000
+#define PHY_POWER_ON_CHK 0x00080000
+#define VDDM_POWER_ON_CHK 0x00100000
+#define MEMLPLDO_POWER_ON_CHK 0x00200000
+#endif /* SR_DEBUG */
+
+#ifdef NFLASH_SUPPORT
+/* NAND flash support */
+#define CC_NAND_REVISION	0xC00
+#define CC_NAND_CMD_START	0xC04
+#define CC_NAND_CMD_ADDR	0xC0C
+#define CC_NAND_SPARE_RD_0	0xC20
+#define CC_NAND_SPARE_RD_4	0xC24
+#define CC_NAND_SPARE_RD_8	0xC28
+#define CC_NAND_SPARE_RD_C	0xC2C
+#define CC_NAND_CONFIG		0xC48
+#define CC_NAND_DEVID		0xC60
+#define CC_NAND_DEVID_EXT	0xC64
+#define CC_NAND_INTFC_STATUS	0xC6C
+#endif /* NFLASH_SUPPORT */
+
+/* chipid */
+#define	CID_ID_MASK		0x0000ffff	/* Chip Id mask */
+#define	CID_REV_MASK		0x000f0000	/* Chip Revision mask */
+#define	CID_REV_SHIFT		16		/* Chip Revision shift */
+#define	CID_PKG_MASK		0x00f00000	/* Package Option mask */
+#define	CID_PKG_SHIFT		20		/* Package Option shift */
+#define	CID_CC_MASK		0x0f000000	/* CoreCount (corerev >= 4) */
+#define CID_CC_SHIFT		24
+#define	CID_TYPE_MASK		0xf0000000	/* Chip Type */
+#define CID_TYPE_SHIFT		28
+
+/* capabilities */
+#define	CC_CAP_UARTS_MASK	0x00000003	/* Number of UARTs */
+#define CC_CAP_MIPSEB		0x00000004	/* MIPS is in big-endian mode */
+#define CC_CAP_UCLKSEL		0x00000018	/* UARTs clock select */
+#define CC_CAP_UINTCLK		0x00000008	/* UARTs are driven by internal divided clock */
+#define CC_CAP_UARTGPIO		0x00000020	/* UARTs own GPIOs 15:12 */
+#define CC_CAP_EXTBUS_MASK	0x000000c0	/* External bus mask */
+#define CC_CAP_EXTBUS_NONE	0x00000000	/* No ExtBus present */
+#define CC_CAP_EXTBUS_FULL	0x00000040	/* ExtBus: PCMCIA, IDE & Prog */
+#define CC_CAP_EXTBUS_PROG	0x00000080	/* ExtBus: ProgIf only */
+#define	CC_CAP_FLASH_MASK	0x00000700	/* Type of flash */
+#define	CC_CAP_PLL_MASK		0x00038000	/* Type of PLL */
+#define CC_CAP_PWR_CTL		0x00040000	/* Power control */
+#define CC_CAP_OTPSIZE		0x00380000	/* OTP Size (0 = none) */
+#define CC_CAP_OTPSIZE_SHIFT	19		/* OTP Size shift */
+#define CC_CAP_OTPSIZE_BASE	5		/* OTP Size base */
+#define CC_CAP_JTAGP		0x00400000	/* JTAG Master Present */
+#define CC_CAP_ROM		0x00800000	/* Internal boot rom active */
+#define CC_CAP_BKPLN64		0x08000000	/* 64-bit backplane */
+#define	CC_CAP_PMU		0x10000000	/* PMU Present, rev >= 20 */
+#define	CC_CAP_ECI		0x20000000	/* ECI Present, rev >= 21 */
+#define	CC_CAP_SROM		0x40000000	/* Srom Present, rev >= 32 */
+#define	CC_CAP_NFLASH		0x80000000	/* Nand flash present, rev >= 35 */
+
+#define	CC_CAP2_SECI		0x00000001	/* SECI Present, rev >= 36 */
+#define	CC_CAP2_GSIO		0x00000002	/* GSIO (spi/i2c) present, rev >= 37 */
+
+/* capabilities extension */
+#define CC_CAP_EXT_SECI_PRESENT	0x00000001    /* SECI present */
+#define CC_CAP_EXT_GSIO_PRESENT	0x00000002    /* GSIO present */
+#define CC_CAP_EXT_GCI_PRESENT  0x00000004    /* GCI present */
+#define CC_CAP_EXT_AOB_PRESENT  0x00000040    /* AOB present */
+
+/* WL Channel Info to BT via GCI - bits 40 - 47 */
+#define GCI_WL_CHN_INFO_MASK 	(0xFF00)
+/* PLL type */
+#define PLL_NONE		0x00000000
+#define PLL_TYPE1		0x00010000	/* 48MHz base, 3 dividers */
+#define PLL_TYPE2		0x00020000	/* 48MHz, 4 dividers */
+#define PLL_TYPE3		0x00030000	/* 25MHz, 2 dividers */
+#define PLL_TYPE4		0x00008000	/* 48MHz, 4 dividers */
+#define PLL_TYPE5		0x00018000	/* 25MHz, 4 dividers */
+#define PLL_TYPE6		0x00028000	/* 100/200 or 120/240 only */
+#define PLL_TYPE7		0x00038000	/* 25MHz, 4 dividers */
+
+/* ILP clock */
+#define	ILP_CLOCK		32000
+
+/* ALP clock on pre-PMU chips */
+#define	ALP_CLOCK		20000000
+
+#ifdef CFG_SIM
+#define NS_ALP_CLOCK		84922
+#define NS_SLOW_ALP_CLOCK	84922
+#define NS_CPU_CLOCK		534500
+#define NS_SLOW_CPU_CLOCK	534500
+#define NS_SI_CLOCK		271750
+#define NS_SLOW_SI_CLOCK	271750
+#define NS_FAST_MEM_CLOCK	271750
+#define NS_MEM_CLOCK		271750
+#define NS_SLOW_MEM_CLOCK	271750
+#else
+#define NS_ALP_CLOCK		125000000
+#define NS_SLOW_ALP_CLOCK	100000000
+#define NS_CPU_CLOCK		1000000000
+#define NS_SLOW_CPU_CLOCK	800000000
+#define NS_SI_CLOCK		250000000
+#define NS_SLOW_SI_CLOCK	200000000
+#define NS_FAST_MEM_CLOCK	800000000
+#define NS_MEM_CLOCK		533000000
+#define NS_SLOW_MEM_CLOCK	400000000
+#endif /* CFG_SIM */
+
+/* HT clock */
+#define	HT_CLOCK		80000000
+
+/* corecontrol */
+#define CC_UARTCLKO		0x00000001	/* Drive UART with internal clock */
+#define	CC_SE			0x00000002	/* sync clk out enable (corerev >= 3) */
+#define CC_ASYNCGPIO	0x00000004	/* 1=generate GPIO interrupt without backplane clock */
+#define CC_UARTCLKEN		0x00000008	/* enable UART Clock (corerev > = 21 */
+
+/* 4321 chipcontrol */
+#define CHIPCTRL_4321A0_DEFAULT	0x3a4
+#define CHIPCTRL_4321A1_DEFAULT	0x0a4
+#define CHIPCTRL_4321_PLL_DOWN	0x800000	/* serdes PLL down override */
+
+/* Fields in the otpstatus register in rev >= 21 */
+#define OTPS_OL_MASK		0x000000ff
+#define OTPS_OL_MFG		0x00000001	/* manuf row is locked */
+#define OTPS_OL_OR1		0x00000002	/* otp redundancy row 1 is locked */
+#define OTPS_OL_OR2		0x00000004	/* otp redundancy row 2 is locked */
+#define OTPS_OL_GU		0x00000008	/* general use region is locked */
+#define OTPS_GUP_MASK		0x00000f00
+#define OTPS_GUP_SHIFT		8
+#define OTPS_GUP_HW		0x00000100	/* h/w subregion is programmed */
+#define OTPS_GUP_SW		0x00000200	/* s/w subregion is programmed */
+#define OTPS_GUP_CI		0x00000400	/* chipid/pkgopt subregion is programmed */
+#define OTPS_GUP_FUSE		0x00000800	/* fuse subregion is programmed */
+#define OTPS_READY		0x00001000
+#define OTPS_RV(x)		(1 << (16 + (x)))	/* redundancy entry valid */
+#define OTPS_RV_MASK		0x0fff0000
+#define OTPS_PROGOK     0x40000000
+
+/* Fields in the otpcontrol register in rev >= 21 */
+#define OTPC_PROGSEL		0x00000001
+#define OTPC_PCOUNT_MASK	0x0000000e
+#define OTPC_PCOUNT_SHIFT	1
+#define OTPC_VSEL_MASK		0x000000f0
+#define OTPC_VSEL_SHIFT		4
+#define OTPC_TMM_MASK		0x00000700
+#define OTPC_TMM_SHIFT		8
+#define OTPC_ODM		0x00000800
+#define OTPC_PROGEN		0x80000000
+
+/* Fields in the 40nm otpcontrol register in rev >= 40 */
+#define OTPC_40NM_PROGSEL_SHIFT	0
+#define OTPC_40NM_PCOUNT_SHIFT	1
+#define OTPC_40NM_PCOUNT_WR	0xA
+#define OTPC_40NM_PCOUNT_V1X	0xB
+#define OTPC_40NM_REGCSEL_SHIFT	5
+#define OTPC_40NM_REGCSEL_DEF	0x4
+#define OTPC_40NM_PROGIN_SHIFT	8
+#define OTPC_40NM_R2X_SHIFT	10
+#define OTPC_40NM_ODM_SHIFT	11
+#define OTPC_40NM_DF_SHIFT	15
+#define OTPC_40NM_VSEL_SHIFT	16
+#define OTPC_40NM_VSEL_WR	0xA
+#define OTPC_40NM_VSEL_V1X	0xA
+#define OTPC_40NM_VSEL_R1X	0x5
+#define OTPC_40NM_COFAIL_SHIFT	30
+
+#define OTPC1_CPCSEL_SHIFT	0
+#define OTPC1_CPCSEL_DEF	6
+#define OTPC1_TM_SHIFT		8
+#define OTPC1_TM_WR		0x84
+#define OTPC1_TM_V1X		0x84
+#define OTPC1_TM_R1X		0x4
+#define OTPC1_CLK_EN_MASK	0x00020000
+#define OTPC1_CLK_DIV_MASK	0x00FC0000
+
+/* Fields in otpprog in rev >= 21 and HND OTP */
+#define OTPP_COL_MASK		0x000000ff
+#define OTPP_COL_SHIFT		0
+#define OTPP_ROW_MASK		0x0000ff00
+#define OTPP_ROW_MASK9		0x0001ff00		/* for ccrev >= 49 */
+#define OTPP_ROW_SHIFT		8
+#define OTPP_OC_MASK		0x0f000000
+#define OTPP_OC_SHIFT		24
+#define OTPP_READERR		0x10000000
+#define OTPP_VALUE_MASK		0x20000000
+#define OTPP_VALUE_SHIFT	29
+#define OTPP_START_BUSY		0x80000000
+#define	OTPP_READ		0x40000000	/* HND OTP */
+
+/* Fields in otplayout register */
+#define OTPL_HWRGN_OFF_MASK	0x00000FFF
+#define OTPL_HWRGN_OFF_SHIFT	0
+#define OTPL_WRAP_REVID_MASK	0x00F80000
+#define OTPL_WRAP_REVID_SHIFT	19
+#define OTPL_WRAP_TYPE_MASK	0x00070000
+#define OTPL_WRAP_TYPE_SHIFT	16
+#define OTPL_WRAP_TYPE_65NM	0
+#define OTPL_WRAP_TYPE_40NM	1
+#define OTPL_ROW_SIZE_MASK	0x0000F000
+#define OTPL_ROW_SIZE_SHIFT	12
+
+/* otplayout reg corerev >= 36 */
+#define OTP_CISFORMAT_NEW	0x80000000
+
+/* Opcodes for OTPP_OC field */
+#define OTPPOC_READ		0
+#define OTPPOC_BIT_PROG		1
+#define OTPPOC_VERIFY		3
+#define OTPPOC_INIT		4
+#define OTPPOC_SET		5
+#define OTPPOC_RESET		6
+#define OTPPOC_OCST		7
+#define OTPPOC_ROW_LOCK		8
+#define OTPPOC_PRESCN_TEST	9
+
+/* Opcodes for OTPP_OC field (40NM) */
+#define OTPPOC_READ_40NM	0
+#define OTPPOC_PROG_ENABLE_40NM 1
+#define OTPPOC_PROG_DISABLE_40NM	2
+#define OTPPOC_VERIFY_40NM	3
+#define OTPPOC_WORD_VERIFY_1_40NM	4
+#define OTPPOC_ROW_LOCK_40NM	5
+#define OTPPOC_STBY_40NM	6
+#define OTPPOC_WAKEUP_40NM	7
+#define OTPPOC_WORD_VERIFY_0_40NM	8
+#define OTPPOC_PRESCN_TEST_40NM 9
+#define OTPPOC_BIT_PROG_40NM	10
+#define OTPPOC_WORDPROG_40NM	11
+#define OTPPOC_BURNIN_40NM	12
+#define OTPPOC_AUTORELOAD_40NM	13
+#define OTPPOC_OVST_READ_40NM	14
+#define OTPPOC_OVST_PROG_40NM	15
+
+/* Fields in otplayoutextension */
+#define OTPLAYOUTEXT_FUSE_MASK	0x3FF
+
+
+/* Jtagm characteristics that appeared at a given corerev */
+#define	JTAGM_CREV_OLD		10	/* Old command set, 16bit max IR */
+#define	JTAGM_CREV_IRP		22	/* Able to do pause-ir */
+#define	JTAGM_CREV_RTI		28	/* Able to do return-to-idle */
+
+/* jtagcmd */
+#define JCMD_START		0x80000000
+#define JCMD_BUSY		0x80000000
+#define JCMD_STATE_MASK		0x60000000
+#define JCMD_STATE_TLR		0x00000000	/* Test-logic-reset */
+#define JCMD_STATE_PIR		0x20000000	/* Pause IR */
+#define JCMD_STATE_PDR		0x40000000	/* Pause DR */
+#define JCMD_STATE_RTI		0x60000000	/* Run-test-idle */
+#define JCMD0_ACC_MASK		0x0000f000
+#define JCMD0_ACC_IRDR		0x00000000
+#define JCMD0_ACC_DR		0x00001000
+#define JCMD0_ACC_IR		0x00002000
+#define JCMD0_ACC_RESET		0x00003000
+#define JCMD0_ACC_IRPDR		0x00004000
+#define JCMD0_ACC_PDR		0x00005000
+#define JCMD0_IRW_MASK		0x00000f00
+#define JCMD_ACC_MASK		0x000f0000	/* Changes for corerev 11 */
+#define JCMD_ACC_IRDR		0x00000000
+#define JCMD_ACC_DR		0x00010000
+#define JCMD_ACC_IR		0x00020000
+#define JCMD_ACC_RESET		0x00030000
+#define JCMD_ACC_IRPDR		0x00040000
+#define JCMD_ACC_PDR		0x00050000
+#define JCMD_ACC_PIR		0x00060000
+#define JCMD_ACC_IRDR_I		0x00070000	/* rev 28: return to run-test-idle */
+#define JCMD_ACC_DR_I		0x00080000	/* rev 28: return to run-test-idle */
+#define JCMD_IRW_MASK		0x00001f00
+#define JCMD_IRW_SHIFT		8
+#define JCMD_DRW_MASK		0x0000003f
+
+/* jtagctrl */
+#define JCTRL_FORCE_CLK		4		/* Force clock */
+#define JCTRL_EXT_EN		2		/* Enable external targets */
+#define JCTRL_EN		1		/* Enable Jtag master */
+
+#define JCTRL_TAPSEL_BIT	0x00000008	/* JtagMasterCtrl tap_sel bit */
+
+/* Fields in clkdiv */
+#define	CLKD_SFLASH		0x0f000000
+#define	CLKD_SFLASH_SHIFT	24
+#define	CLKD_OTP		0x000f0000
+#define	CLKD_OTP_SHIFT		16
+#define	CLKD_JTAG		0x00000f00
+#define	CLKD_JTAG_SHIFT		8
+#define	CLKD_UART		0x000000ff
+
+#define	CLKD2_SROM		0x00000003
+
+/* intstatus/intmask */
+#define	CI_GPIO			0x00000001	/* gpio intr */
+#define	CI_EI			0x00000002	/* extif intr (corerev >= 3) */
+#define	CI_TEMP			0x00000004	/* temp. ctrl intr (corerev >= 15) */
+#define	CI_SIRQ			0x00000008	/* serial IRQ intr (corerev >= 15) */
+#define	CI_ECI			0x00000010	/* eci intr (corerev >= 21) */
+#define	CI_PMU			0x00000020	/* pmu intr (corerev >= 21) */
+#define	CI_UART			0x00000040	/* uart intr (corerev >= 21) */
+#define	CI_WDRESET		0x80000000	/* watchdog reset occurred */
+
+/* slow_clk_ctl */
+#define SCC_SS_MASK		0x00000007	/* slow clock source mask */
+#define	SCC_SS_LPO		0x00000000	/* source of slow clock is LPO */
+#define	SCC_SS_XTAL		0x00000001	/* source of slow clock is crystal */
+#define	SCC_SS_PCI		0x00000002	/* source of slow clock is PCI */
+#define SCC_LF			0x00000200	/* LPOFreqSel, 1: 160Khz, 0: 32KHz */
+#define SCC_LP			0x00000400	/* LPOPowerDown, 1: LPO is disabled,
+						 * 0: LPO is enabled
+						 */
+#define SCC_FS			0x00000800	/* ForceSlowClk, 1: sb/cores running on slow clock,
+						 * 0: power logic control
+						 */
+#define SCC_IP			0x00001000	/* IgnorePllOffReq, 1/0: power logic ignores/honors
+						 * PLL clock disable requests from core
+						 */
+#define SCC_XC			0x00002000	/* XtalControlEn, 1/0: power logic does/doesn't
+						 * disable crystal when appropriate
+						 */
+#define SCC_XP			0x00004000	/* XtalPU (RO), 1/0: crystal running/disabled */
+#define SCC_CD_MASK		0xffff0000	/* ClockDivider (SlowClk = 1/(4+divisor)) */
+#define SCC_CD_SHIFT		16
+
+/* system_clk_ctl */
+#define	SYCC_IE			0x00000001	/* ILPen: Enable Idle Low Power */
+#define	SYCC_AE			0x00000002	/* ALPen: Enable Active Low Power */
+#define	SYCC_FP			0x00000004	/* ForcePLLOn */
+#define	SYCC_AR			0x00000008	/* Force ALP (or HT if ALPen is not set */
+#define	SYCC_HR			0x00000010	/* Force HT */
+#define SYCC_CD_MASK		0xffff0000	/* ClkDiv  (ILP = 1/(4 * (divisor + 1)) */
+#define SYCC_CD_SHIFT		16
+
+/* Indirect backplane access */
+#define	BPIA_BYTEEN		0x0000000f
+#define	BPIA_SZ1		0x00000001
+#define	BPIA_SZ2		0x00000003
+#define	BPIA_SZ4		0x00000007
+#define	BPIA_SZ8		0x0000000f
+#define	BPIA_WRITE		0x00000100
+#define	BPIA_START		0x00000200
+#define	BPIA_BUSY		0x00000200
+#define	BPIA_ERROR		0x00000400
+
+/* pcmcia/prog/flash_config */
+#define	CF_EN			0x00000001	/* enable */
+#define	CF_EM_MASK		0x0000000e	/* mode */
+#define	CF_EM_SHIFT		1
+#define	CF_EM_FLASH		0		/* flash/asynchronous mode */
+#define	CF_EM_SYNC		2		/* synchronous mode */
+#define	CF_EM_PCMCIA		4		/* pcmcia mode */
+#define	CF_DS			0x00000010	/* destsize:  0=8bit, 1=16bit */
+#define	CF_BS			0x00000020	/* byteswap */
+#define	CF_CD_MASK		0x000000c0	/* clock divider */
+#define	CF_CD_SHIFT		6
+#define	CF_CD_DIV2		0x00000000	/* backplane/2 */
+#define	CF_CD_DIV3		0x00000040	/* backplane/3 */
+#define	CF_CD_DIV4		0x00000080	/* backplane/4 */
+#define	CF_CE			0x00000100	/* clock enable */
+#define	CF_SB			0x00000200	/* size/bytestrobe (synch only) */
+
+/* pcmcia_memwait */
+#define	PM_W0_MASK		0x0000003f	/* waitcount0 */
+#define	PM_W1_MASK		0x00001f00	/* waitcount1 */
+#define	PM_W1_SHIFT		8
+#define	PM_W2_MASK		0x001f0000	/* waitcount2 */
+#define	PM_W2_SHIFT		16
+#define	PM_W3_MASK		0x1f000000	/* waitcount3 */
+#define	PM_W3_SHIFT		24
+
+/* pcmcia_attrwait */
+#define	PA_W0_MASK		0x0000003f	/* waitcount0 */
+#define	PA_W1_MASK		0x00001f00	/* waitcount1 */
+#define	PA_W1_SHIFT		8
+#define	PA_W2_MASK		0x001f0000	/* waitcount2 */
+#define	PA_W2_SHIFT		16
+#define	PA_W3_MASK		0x1f000000	/* waitcount3 */
+#define	PA_W3_SHIFT		24
+
+/* pcmcia_iowait */
+#define	PI_W0_MASK		0x0000003f	/* waitcount0 */
+#define	PI_W1_MASK		0x00001f00	/* waitcount1 */
+#define	PI_W1_SHIFT		8
+#define	PI_W2_MASK		0x001f0000	/* waitcount2 */
+#define	PI_W2_SHIFT		16
+#define	PI_W3_MASK		0x1f000000	/* waitcount3 */
+#define	PI_W3_SHIFT		24
+
+/* prog_waitcount */
+#define	PW_W0_MASK		0x0000001f	/* waitcount0 */
+#define	PW_W1_MASK		0x00001f00	/* waitcount1 */
+#define	PW_W1_SHIFT		8
+#define	PW_W2_MASK		0x001f0000	/* waitcount2 */
+#define	PW_W2_SHIFT		16
+#define	PW_W3_MASK		0x1f000000	/* waitcount3 */
+#define	PW_W3_SHIFT		24
+
+#define PW_W0       		0x0000000c
+#define PW_W1       		0x00000a00
+#define PW_W2       		0x00020000
+#define PW_W3       		0x01000000
+
+/* flash_waitcount */
+#define	FW_W0_MASK		0x0000003f	/* waitcount0 */
+#define	FW_W1_MASK		0x00001f00	/* waitcount1 */
+#define	FW_W1_SHIFT		8
+#define	FW_W2_MASK		0x001f0000	/* waitcount2 */
+#define	FW_W2_SHIFT		16
+#define	FW_W3_MASK		0x1f000000	/* waitcount3 */
+#define	FW_W3_SHIFT		24
+
+/* When Srom support present, fields in sromcontrol */
+#define	SRC_START		0x80000000
+#define	SRC_BUSY		0x80000000
+#define	SRC_OPCODE		0x60000000
+#define	SRC_OP_READ		0x00000000
+#define	SRC_OP_WRITE		0x20000000
+#define	SRC_OP_WRDIS		0x40000000
+#define	SRC_OP_WREN		0x60000000
+#define	SRC_OTPSEL		0x00000010
+#define SRC_OTPPRESENT		0x00000020
+#define	SRC_LOCK		0x00000008
+#define	SRC_SIZE_MASK		0x00000006
+#define	SRC_SIZE_1K		0x00000000
+#define	SRC_SIZE_4K		0x00000002
+#define	SRC_SIZE_16K		0x00000004
+#define	SRC_SIZE_SHIFT		1
+#define	SRC_PRESENT		0x00000001
+
+/* Fields in pmucontrol */
+#define	PCTL_ILP_DIV_MASK	0xffff0000
+#define	PCTL_ILP_DIV_SHIFT	16
+#define PCTL_LQ_REQ_EN		0x00008000
+#define PCTL_PLL_PLLCTL_UPD	0x00000400	/* rev 2 */
+#define PCTL_NOILP_ON_WAIT	0x00000200	/* rev 1 */
+#define	PCTL_HT_REQ_EN		0x00000100
+#define	PCTL_ALP_REQ_EN		0x00000080
+#define	PCTL_XTALFREQ_MASK	0x0000007c
+#define	PCTL_XTALFREQ_SHIFT	2
+#define	PCTL_ILP_DIV_EN		0x00000002
+#define	PCTL_LPO_SEL		0x00000001
+
+/*  Retention Control */
+#define PMU_RCTL_CLK_DIV_SHIFT		0
+#define PMU_RCTL_CHAIN_LEN_SHIFT	12
+#define PMU_RCTL_MACPHY_DISABLE_SHIFT	26
+#define PMU_RCTL_MACPHY_DISABLE_MASK	(1 << 26)
+#define PMU_RCTL_LOGIC_DISABLE_SHIFT	27
+#define PMU_RCTL_LOGIC_DISABLE_MASK	(1 << 27)
+#define PMU_RCTL_MEMSLP_LOG_SHIFT	28
+#define PMU_RCTL_MEMSLP_LOG_MASK	(1 << 28)
+#define PMU_RCTL_MEMRETSLP_LOG_SHIFT	29
+#define PMU_RCTL_MEMRETSLP_LOG_MASK	(1 << 29)
+
+/*  Retention Group Control */
+#define PMU_RCTLGRP_CHAIN_LEN_SHIFT	0
+#define PMU_RCTLGRP_RMODE_ENABLE_SHIFT	14
+#define PMU_RCTLGRP_RMODE_ENABLE_MASK	(1 << 14)
+#define PMU_RCTLGRP_DFT_ENABLE_SHIFT	15
+#define PMU_RCTLGRP_DFT_ENABLE_MASK	(1 << 15)
+#define PMU_RCTLGRP_NSRST_DISABLE_SHIFT	16
+#define PMU_RCTLGRP_NSRST_DISABLE_MASK	(1 << 16)
+/*  Retention Group Control special for 4334 */
+#define PMU4334_RCTLGRP_CHAIN_LEN_GRP0	338
+#define PMU4334_RCTLGRP_CHAIN_LEN_GRP1	315
+/*  Retention Group Control special for 43341 */
+#define PMU43341_RCTLGRP_CHAIN_LEN_GRP0	366
+#define PMU43341_RCTLGRP_CHAIN_LEN_GRP1	330
+
+/* Fields in clkstretch */
+#define CSTRETCH_HT		0xffff0000
+#define CSTRETCH_ALP		0x0000ffff
+
+/* gpiotimerval */
+#define GPIO_ONTIME_SHIFT	16
+
+/* clockcontrol_n */
+#define	CN_N1_MASK		0x3f		/* n1 control */
+#define	CN_N2_MASK		0x3f00		/* n2 control */
+#define	CN_N2_SHIFT		8
+#define	CN_PLLC_MASK		0xf0000		/* pll control */
+#define	CN_PLLC_SHIFT		16
+
+/* clockcontrol_sb/pci/uart */
+#define	CC_M1_MASK		0x3f		/* m1 control */
+#define	CC_M2_MASK		0x3f00		/* m2 control */
+#define	CC_M2_SHIFT		8
+#define	CC_M3_MASK		0x3f0000	/* m3 control */
+#define	CC_M3_SHIFT		16
+#define	CC_MC_MASK		0x1f000000	/* mux control */
+#define	CC_MC_SHIFT		24
+
+/* N3M Clock control magic field values */
+#define	CC_F6_2			0x02		/* A factor of 2 in */
+#define	CC_F6_3			0x03		/* 6-bit fields like */
+#define	CC_F6_4			0x05		/* N1, M1 or M3 */
+#define	CC_F6_5			0x09
+#define	CC_F6_6			0x11
+#define	CC_F6_7			0x21
+
+#define	CC_F5_BIAS		5		/* 5-bit fields get this added */
+
+#define	CC_MC_BYPASS		0x08
+#define	CC_MC_M1		0x04
+#define	CC_MC_M1M2		0x02
+#define	CC_MC_M1M2M3		0x01
+#define	CC_MC_M1M3		0x11
+
+/* Type 2 Clock control magic field values */
+#define	CC_T2_BIAS		2		/* n1, n2, m1 & m3 bias */
+#define	CC_T2M2_BIAS		3		/* m2 bias */
+
+#define	CC_T2MC_M1BYP		1
+#define	CC_T2MC_M2BYP		2
+#define	CC_T2MC_M3BYP		4
+
+/* Type 6 Clock control magic field values */
+#define	CC_T6_MMASK		1		/* bits of interest in m */
+#define	CC_T6_M0		120000000	/* sb clock for m = 0 */
+#define	CC_T6_M1		100000000	/* sb clock for m = 1 */
+#define	SB2MIPS_T6(sb)		(2 * (sb))
+
+/* Common clock base */
+#define	CC_CLOCK_BASE1		24000000	/* Half the clock freq */
+#define CC_CLOCK_BASE2		12500000	/* Alternate crystal on some PLLs */
+
+/* Clock control values for 200MHz in 5350 */
+#define	CLKC_5350_N		0x0311
+#define	CLKC_5350_M		0x04020009
+
+/* Flash types in the chipcommon capabilities register */
+#define FLASH_NONE		0x000		/* No flash */
+#define SFLASH_ST		0x100		/* ST serial flash */
+#define SFLASH_AT		0x200		/* Atmel serial flash */
+#define NFLASH			0x300
+#define	PFLASH			0x700		/* Parallel flash */
+#define QSPIFLASH_ST		0x800
+#define QSPIFLASH_AT		0x900
+
+/* Bits in the ExtBus config registers */
+#define	CC_CFG_EN		0x0001		/* Enable */
+#define	CC_CFG_EM_MASK		0x000e		/* Extif Mode */
+#define	CC_CFG_EM_ASYNC		0x0000		/*   Async/Parallel flash */
+#define	CC_CFG_EM_SYNC		0x0002		/*   Synchronous */
+#define	CC_CFG_EM_PCMCIA	0x0004		/*   PCMCIA */
+#define	CC_CFG_EM_IDE		0x0006		/*   IDE */
+#define	CC_CFG_DS		0x0010		/* Data size, 0=8bit, 1=16bit */
+#define	CC_CFG_CD_MASK		0x00e0		/* Sync: Clock divisor, rev >= 20 */
+#define	CC_CFG_CE		0x0100		/* Sync: Clock enable, rev >= 20 */
+#define	CC_CFG_SB		0x0200		/* Sync: Size/Bytestrobe, rev >= 20 */
+#define	CC_CFG_IS		0x0400		/* Extif Sync Clk Select, rev >= 20 */
+
+/* ExtBus address space */
+#define	CC_EB_BASE		0x1a000000	/* Chipc ExtBus base address */
+#define	CC_EB_PCMCIA_MEM	0x1a000000	/* PCMCIA 0 memory base address */
+#define	CC_EB_PCMCIA_IO		0x1a200000	/* PCMCIA 0 I/O base address */
+#define	CC_EB_PCMCIA_CFG	0x1a400000	/* PCMCIA 0 config base address */
+#define	CC_EB_IDE		0x1a800000	/* IDE memory base */
+#define	CC_EB_PCMCIA1_MEM	0x1a800000	/* PCMCIA 1 memory base address */
+#define	CC_EB_PCMCIA1_IO	0x1aa00000	/* PCMCIA 1 I/O base address */
+#define	CC_EB_PCMCIA1_CFG	0x1ac00000	/* PCMCIA 1 config base address */
+#define	CC_EB_PROGIF		0x1b000000	/* ProgIF Async/Sync base address */
+
+
+/* Start/busy bit in flashcontrol */
+#define SFLASH_OPCODE		0x000000ff
+#define SFLASH_ACTION		0x00000700
+#define	SFLASH_CS_ACTIVE	0x00001000	/* Chip Select Active, rev >= 20 */
+#define SFLASH_START		0x80000000
+#define SFLASH_BUSY		SFLASH_START
+
+/* flashcontrol action codes */
+#define	SFLASH_ACT_OPONLY	0x0000		/* Issue opcode only */
+#define	SFLASH_ACT_OP1D		0x0100		/* opcode + 1 data byte */
+#define	SFLASH_ACT_OP3A		0x0200		/* opcode + 3 addr bytes */
+#define	SFLASH_ACT_OP3A1D	0x0300		/* opcode + 3 addr & 1 data bytes */
+#define	SFLASH_ACT_OP3A4D	0x0400		/* opcode + 3 addr & 4 data bytes */
+#define	SFLASH_ACT_OP3A4X4D	0x0500		/* opcode + 3 addr, 4 don't care & 4 data bytes */
+#define	SFLASH_ACT_OP3A1X4D	0x0700		/* opcode + 3 addr, 1 don't care & 4 data bytes */
+
+/* flashcontrol action+opcodes for ST flashes */
+#define SFLASH_ST_WREN		0x0006		/* Write Enable */
+#define SFLASH_ST_WRDIS		0x0004		/* Write Disable */
+#define SFLASH_ST_RDSR		0x0105		/* Read Status Register */
+#define SFLASH_ST_WRSR		0x0101		/* Write Status Register */
+#define SFLASH_ST_READ		0x0303		/* Read Data Bytes */
+#define SFLASH_ST_PP		0x0302		/* Page Program */
+#define SFLASH_ST_SE		0x02d8		/* Sector Erase */
+#define SFLASH_ST_BE		0x00c7		/* Bulk Erase */
+#define SFLASH_ST_DP		0x00b9		/* Deep Power-down */
+#define SFLASH_ST_RES		0x03ab		/* Read Electronic Signature */
+#define SFLASH_ST_CSA		0x1000		/* Keep chip select asserted */
+#define SFLASH_ST_SSE		0x0220		/* Sub-sector Erase */
+
+#define SFLASH_MXIC_RDID	0x0390		/* Read Manufacture ID */
+#define SFLASH_MXIC_MFID	0xc2		/* MXIC Manufacture ID */
+
+/* Status register bits for ST flashes */
+#define SFLASH_ST_WIP		0x01		/* Write In Progress */
+#define SFLASH_ST_WEL		0x02		/* Write Enable Latch */
+#define SFLASH_ST_BP_MASK	0x1c		/* Block Protect */
+#define SFLASH_ST_BP_SHIFT	2
+#define SFLASH_ST_SRWD		0x80		/* Status Register Write Disable */
+
+/* flashcontrol action+opcodes for Atmel flashes */
+#define SFLASH_AT_READ				0x07e8
+#define SFLASH_AT_PAGE_READ			0x07d2
+#define SFLASH_AT_BUF1_READ
+#define SFLASH_AT_BUF2_READ
+#define SFLASH_AT_STATUS			0x01d7
+#define SFLASH_AT_BUF1_WRITE			0x0384
+#define SFLASH_AT_BUF2_WRITE			0x0387
+#define SFLASH_AT_BUF1_ERASE_PROGRAM		0x0283
+#define SFLASH_AT_BUF2_ERASE_PROGRAM		0x0286
+#define SFLASH_AT_BUF1_PROGRAM			0x0288
+#define SFLASH_AT_BUF2_PROGRAM			0x0289
+#define SFLASH_AT_PAGE_ERASE			0x0281
+#define SFLASH_AT_BLOCK_ERASE			0x0250
+#define SFLASH_AT_BUF1_WRITE_ERASE_PROGRAM	0x0382
+#define SFLASH_AT_BUF2_WRITE_ERASE_PROGRAM	0x0385
+#define SFLASH_AT_BUF1_LOAD			0x0253
+#define SFLASH_AT_BUF2_LOAD			0x0255
+#define SFLASH_AT_BUF1_COMPARE			0x0260
+#define SFLASH_AT_BUF2_COMPARE			0x0261
+#define SFLASH_AT_BUF1_REPROGRAM		0x0258
+#define SFLASH_AT_BUF2_REPROGRAM		0x0259
+
+/* Status register bits for Atmel flashes */
+#define SFLASH_AT_READY				0x80
+#define SFLASH_AT_MISMATCH			0x40
+#define SFLASH_AT_ID_MASK			0x38
+#define SFLASH_AT_ID_SHIFT			3
+
+/* SPI register bits, corerev >= 37 */
+#define GSIO_START			0x80000000
+#define GSIO_BUSY			GSIO_START
+
+/*
+ * These are the UART port assignments, expressed as offsets from the base
+ * register.  These assignments should hold for any serial port based on
+ * a 8250, 16450, or 16550(A).
+ */
+
+#define UART_RX		0	/* In:  Receive buffer (DLAB=0) */
+#define UART_TX		0	/* Out: Transmit buffer (DLAB=0) */
+#define UART_DLL	0	/* Out: Divisor Latch Low (DLAB=1) */
+#define UART_IER	1	/* In/Out: Interrupt Enable Register (DLAB=0) */
+#define UART_DLM	1	/* Out: Divisor Latch High (DLAB=1) */
+#define UART_IIR	2	/* In: Interrupt Identity Register  */
+#define UART_FCR	2	/* Out: FIFO Control Register */
+#define UART_LCR	3	/* Out: Line Control Register */
+#define UART_MCR	4	/* Out: Modem Control Register */
+#define UART_LSR	5	/* In:  Line Status Register */
+#define UART_MSR	6	/* In:  Modem Status Register */
+#define UART_SCR	7	/* I/O: Scratch Register */
+#define UART_LCR_DLAB	0x80	/* Divisor latch access bit */
+#define UART_LCR_WLEN8	0x03	/* Word length: 8 bits */
+#define UART_MCR_OUT2	0x08	/* MCR GPIO out 2 */
+#define UART_MCR_LOOP	0x10	/* Enable loopback test mode */
+#define UART_LSR_RX_FIFO 	0x80	/* Receive FIFO error */
+#define UART_LSR_TDHR		0x40	/* Data-hold-register empty */
+#define UART_LSR_THRE		0x20	/* Transmit-hold-register empty */
+#define UART_LSR_BREAK		0x10	/* Break interrupt */
+#define UART_LSR_FRAMING	0x08	/* Framing error */
+#define UART_LSR_PARITY		0x04	/* Parity error */
+#define UART_LSR_OVERRUN	0x02	/* Overrun error */
+#define UART_LSR_RXRDY		0x01	/* Receiver ready */
+#define UART_FCR_FIFO_ENABLE 1	/* FIFO control register bit controlling FIFO enable/disable */
+
+/* Interrupt Identity Register (IIR) bits */
+#define UART_IIR_FIFO_MASK	0xc0	/* IIR FIFO disable/enabled mask */
+#define UART_IIR_INT_MASK	0xf	/* IIR interrupt ID source */
+#define UART_IIR_MDM_CHG	0x0	/* Modem status changed */
+#define UART_IIR_NOINT		0x1	/* No interrupt pending */
+#define UART_IIR_THRE		0x2	/* THR empty */
+#define UART_IIR_RCVD_DATA	0x4	/* Received data available */
+#define UART_IIR_RCVR_STATUS 	0x6	/* Receiver status */
+#define UART_IIR_CHAR_TIME 	0xc	/* Character time */
+
+/* Interrupt Enable Register (IER) bits */
+#define UART_IER_PTIME	128	/* Programmable THRE Interrupt Mode Enable */
+#define UART_IER_EDSSI	8	/* enable modem status interrupt */
+#define UART_IER_ELSI	4	/* enable receiver line status interrupt */
+#define UART_IER_ETBEI  2	/* enable transmitter holding register empty interrupt */
+#define UART_IER_ERBFI	1	/* enable data available interrupt */
+
+/* pmustatus */
+#define PST_SLOW_WR_PENDING 0x0400
+#define PST_EXTLPOAVAIL	0x0100
+#define PST_WDRESET	0x0080
+#define	PST_INTPEND	0x0040
+#define	PST_SBCLKST	0x0030
+#define	PST_SBCLKST_ILP	0x0010
+#define	PST_SBCLKST_ALP	0x0020
+#define	PST_SBCLKST_HT	0x0030
+#define	PST_ALPAVAIL	0x0008
+#define	PST_HTAVAIL	0x0004
+#define	PST_RESINIT	0x0003
+
+/* pmucapabilities */
+#define PCAP_REV_MASK	0x000000ff
+#define PCAP_RC_MASK	0x00001f00
+#define PCAP_RC_SHIFT	8
+#define PCAP_TC_MASK	0x0001e000
+#define PCAP_TC_SHIFT	13
+#define PCAP_PC_MASK	0x001e0000
+#define PCAP_PC_SHIFT	17
+#define PCAP_VC_MASK	0x01e00000
+#define PCAP_VC_SHIFT	21
+#define PCAP_CC_MASK	0x1e000000
+#define PCAP_CC_SHIFT	25
+#define PCAP5_PC_MASK	0x003e0000	/* PMU corerev >= 5 */
+#define PCAP5_PC_SHIFT	17
+#define PCAP5_VC_MASK	0x07c00000
+#define PCAP5_VC_SHIFT	22
+#define PCAP5_CC_MASK	0xf8000000
+#define PCAP5_CC_SHIFT	27
+
+/* PMU Resource Request Timer registers */
+/* This is based on PmuRev0 */
+#define	PRRT_TIME_MASK	0x03ff
+#define	PRRT_INTEN	0x0400
+#define	PRRT_REQ_ACTIVE	0x0800
+#define	PRRT_ALP_REQ	0x1000
+#define	PRRT_HT_REQ	0x2000
+#define PRRT_HQ_REQ 0x4000
+
+/* bit 0 of the PMU interrupt vector is asserted if this mask is enabled */
+#define RSRC_INTR_MASK_TIMER_INT_0 1
+
+/* PMU resource bit position */
+#define PMURES_BIT(bit)	(1 << (bit))
+
+/* PMU resource number limit */
+#define PMURES_MAX_RESNUM	30
+
+/* PMU chip control0 register */
+#define	PMU_CHIPCTL0		0
+#define PMU43143_CC0_SDIO_DRSTR_OVR	(1 << 31) /* sdio drive strength override enable */
+
+/* clock req types */
+#define PMU_CC1_CLKREQ_TYPE_SHIFT	19
+#define PMU_CC1_CLKREQ_TYPE_MASK	(1 << PMU_CC1_CLKREQ_TYPE_SHIFT)
+
+#define CLKREQ_TYPE_CONFIG_OPENDRAIN		0
+#define CLKREQ_TYPE_CONFIG_PUSHPULL		1
+
+/* PMU chip control1 register */
+#define	PMU_CHIPCTL1			1
+#define	PMU_CC1_RXC_DLL_BYPASS		0x00010000
+#define PMU_CC1_ENABLE_BBPLL_PWR_DOWN	0x00000010
+
+#define PMU_CC1_IF_TYPE_MASK   		0x00000030
+#define PMU_CC1_IF_TYPE_RMII    	0x00000000
+#define PMU_CC1_IF_TYPE_MII     	0x00000010
+#define PMU_CC1_IF_TYPE_RGMII   	0x00000020
+
+#define PMU_CC1_SW_TYPE_MASK    	0x000000c0
+#define PMU_CC1_SW_TYPE_EPHY    	0x00000000
+#define PMU_CC1_SW_TYPE_EPHYMII 	0x00000040
+#define PMU_CC1_SW_TYPE_EPHYRMII	0x00000080
+#define PMU_CC1_SW_TYPE_RGMII   	0x000000c0
+
+/* PMU chip control2 register */
+#define	PMU_CHIPCTL2		2
+#define PMU_CC2_FORCE_SUBCORE_PWR_SWITCH_ON   	(1 << 18)
+#define PMU_CC2_FORCE_PHY_PWR_SWITCH_ON   	(1 << 19)
+#define PMU_CC2_FORCE_VDDM_PWR_SWITCH_ON   	(1 << 20)
+#define PMU_CC2_FORCE_MEMLPLDO_PWR_SWITCH_ON   	(1 << 21)
+
+/* PMU chip control3 register */
+#define	PMU_CHIPCTL3		3
+#define PMU_CC3_ENABLE_SDIO_WAKEUP_SHIFT  19
+#define PMU_CC3_ENABLE_RF_SHIFT           22
+#define PMU_CC3_RF_DISABLE_IVALUE_SHIFT   23
+
+/* PMU chip control5 register */
+#define PMU_CHIPCTL5                    5
+
+/* PMU chip control6 register */
+#define PMU_CHIPCTL6                    6
+#define PMU_CC6_ENABLE_CLKREQ_WAKEUP    (1 << 4)
+#define PMU_CC6_ENABLE_PMU_WAKEUP_ALP   (1 << 6)
+
+/* PMU chip control7 register */
+#define PMU_CHIPCTL7				7
+#define PMU_CC7_ENABLE_L2REFCLKPAD_PWRDWN	(1 << 25)
+#define PMU_CC7_ENABLE_MDIO_RESET_WAR		(1 << 27)
+
+
+/* PMU corerev and chip specific PLL controls.
+ * PMU<rev>_PLL<num>_XX where <rev> is PMU corerev and <num> is an arbitrary number
+ * to differentiate different PLLs controlled by the same PMU rev.
+ */
+/* pllcontrol registers */
+/* PDIV, div_phy, div_arm, div_adc, dith_sel, ioff, kpd_scale, lsb_sel, mash_sel, lf_c & lf_r */
+#define	PMU0_PLL0_PLLCTL0		0
+#define	PMU0_PLL0_PC0_PDIV_MASK		1
+#define	PMU0_PLL0_PC0_PDIV_FREQ		25000
+#define PMU0_PLL0_PC0_DIV_ARM_MASK	0x00000038
+#define PMU0_PLL0_PC0_DIV_ARM_SHIFT	3
+#define PMU0_PLL0_PC0_DIV_ARM_BASE	8
+
+/* PC0_DIV_ARM for PLLOUT_ARM */
+#define PMU0_PLL0_PC0_DIV_ARM_110MHZ	0
+#define PMU0_PLL0_PC0_DIV_ARM_97_7MHZ	1
+#define PMU0_PLL0_PC0_DIV_ARM_88MHZ	2
+#define PMU0_PLL0_PC0_DIV_ARM_80MHZ	3 /* Default */
+#define PMU0_PLL0_PC0_DIV_ARM_73_3MHZ	4
+#define PMU0_PLL0_PC0_DIV_ARM_67_7MHZ	5
+#define PMU0_PLL0_PC0_DIV_ARM_62_9MHZ	6
+#define PMU0_PLL0_PC0_DIV_ARM_58_6MHZ	7
+
+/* Wildcard base, stop_mod, en_lf_tp, en_cal & lf_r2 */
+#define	PMU0_PLL0_PLLCTL1		1
+#define	PMU0_PLL0_PC1_WILD_INT_MASK	0xf0000000
+#define	PMU0_PLL0_PC1_WILD_INT_SHIFT	28
+#define	PMU0_PLL0_PC1_WILD_FRAC_MASK	0x0fffff00
+#define	PMU0_PLL0_PC1_WILD_FRAC_SHIFT	8
+#define	PMU0_PLL0_PC1_STOP_MOD		0x00000040
+
+/* Wildcard base, vco_calvar, vco_swc, vco_var_selref, vso_ical & vco_sel_avdd */
+#define	PMU0_PLL0_PLLCTL2		2
+#define	PMU0_PLL0_PC2_WILD_INT_MASK	0xf
+#define	PMU0_PLL0_PC2_WILD_INT_SHIFT	4
+
+/* pllcontrol registers */
+/* ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>, p1div, p2div, _bypass_sdmod */
+#define PMU1_PLL0_PLLCTL0		0
+#define PMU1_PLL0_PC0_P1DIV_MASK	0x00f00000
+#define PMU1_PLL0_PC0_P1DIV_SHIFT	20
+#define PMU1_PLL0_PC0_P2DIV_MASK	0x0f000000
+#define PMU1_PLL0_PC0_P2DIV_SHIFT	24
+
+/* m<x>div */
+#define PMU1_PLL0_PLLCTL1		1
+#define PMU1_PLL0_PC1_M1DIV_MASK	0x000000ff
+#define PMU1_PLL0_PC1_M1DIV_SHIFT	0
+#define PMU1_PLL0_PC1_M2DIV_MASK	0x0000ff00
+#define PMU1_PLL0_PC1_M2DIV_SHIFT	8
+#define PMU1_PLL0_PC1_M3DIV_MASK	0x00ff0000
+#define PMU1_PLL0_PC1_M3DIV_SHIFT	16
+#define PMU1_PLL0_PC1_M4DIV_MASK	0xff000000
+#define PMU1_PLL0_PC1_M4DIV_SHIFT	24
+#define PMU1_PLL0_PC1_M4DIV_BY_9	9
+#define PMU1_PLL0_PC1_M4DIV_BY_18	0x12
+#define PMU1_PLL0_PC1_M4DIV_BY_36	0x24
+#define PMU1_PLL0_PC1_M4DIV_BY_60	0x3C
+
+#define DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT 8
+#define DOT11MAC_880MHZ_CLK_DIVISOR_MASK (0xFF << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+#define DOT11MAC_880MHZ_CLK_DIVISOR_VAL  (0xE << DOT11MAC_880MHZ_CLK_DIVISOR_SHIFT)
+
+/* m<x>div, ndiv_dither_mfb, ndiv_mode, ndiv_int */
+#define PMU1_PLL0_PLLCTL2		2
+#define PMU1_PLL0_PC2_M5DIV_MASK	0x000000ff
+#define PMU1_PLL0_PC2_M5DIV_SHIFT	0
+#define PMU1_PLL0_PC2_M5DIV_BY_12	0xc
+#define PMU1_PLL0_PC2_M5DIV_BY_18	0x12
+#define PMU1_PLL0_PC2_M5DIV_BY_36	0x24
+#define PMU1_PLL0_PC2_M6DIV_MASK	0x0000ff00
+#define PMU1_PLL0_PC2_M6DIV_SHIFT	8
+#define PMU1_PLL0_PC2_M6DIV_BY_18	0x12
+#define PMU1_PLL0_PC2_M6DIV_BY_36	0x24
+#define PMU1_PLL0_PC2_NDIV_MODE_MASK	0x000e0000
+#define PMU1_PLL0_PC2_NDIV_MODE_SHIFT	17
+#define PMU1_PLL0_PC2_NDIV_MODE_MASH	1
+#define PMU1_PLL0_PC2_NDIV_MODE_MFB	2	/* recommended for 4319 */
+#define PMU1_PLL0_PC2_NDIV_INT_MASK	0x1ff00000
+#define PMU1_PLL0_PC2_NDIV_INT_SHIFT	20
+
+/* ndiv_frac */
+#define PMU1_PLL0_PLLCTL3		3
+#define PMU1_PLL0_PC3_NDIV_FRAC_MASK	0x00ffffff
+#define PMU1_PLL0_PC3_NDIV_FRAC_SHIFT	0
+
+/* pll_ctrl */
+#define PMU1_PLL0_PLLCTL4		4
+
+/* pll_ctrl, vco_rng, clkdrive_ch<x> */
+#define PMU1_PLL0_PLLCTL5		5
+#define PMU1_PLL0_PC5_CLK_DRV_MASK 0xffffff00
+#define PMU1_PLL0_PC5_CLK_DRV_SHIFT 8
+
+#define PMU1_PLL0_PLLCTL6		6
+#define PMU1_PLL0_PLLCTL7		7
+
+#define PMU1_PLL0_PLLCTL8		8
+#define PMU1_PLLCTL8_OPENLOOP_MASK	0x2
+
+/* PMU rev 2 control words */
+#define PMU2_PHY_PLL_PLLCTL		4
+#define PMU2_SI_PLL_PLLCTL		10
+
+/* PMU rev 2 */
+/* pllcontrol registers */
+/* ndiv_pwrdn, pwrdn_ch<x>, refcomp_pwrdn, dly_ch<x>, p1div, p2div, _bypass_sdmod */
+#define PMU2_PLL_PLLCTL0		0
+#define PMU2_PLL_PC0_P1DIV_MASK 	0x00f00000
+#define PMU2_PLL_PC0_P1DIV_SHIFT	20
+#define PMU2_PLL_PC0_P2DIV_MASK 	0x0f000000
+#define PMU2_PLL_PC0_P2DIV_SHIFT	24
+
+/* m<x>div */
+#define PMU2_PLL_PLLCTL1		1
+#define PMU2_PLL_PC1_M1DIV_MASK 	0x000000ff
+#define PMU2_PLL_PC1_M1DIV_SHIFT	0
+#define PMU2_PLL_PC1_M2DIV_MASK 	0x0000ff00
+#define PMU2_PLL_PC1_M2DIV_SHIFT	8
+#define PMU2_PLL_PC1_M3DIV_MASK 	0x00ff0000
+#define PMU2_PLL_PC1_M3DIV_SHIFT	16
+#define PMU2_PLL_PC1_M4DIV_MASK 	0xff000000
+#define PMU2_PLL_PC1_M4DIV_SHIFT	24
+
+/* m<x>div, ndiv_dither_mfb, ndiv_mode, ndiv_int */
+#define PMU2_PLL_PLLCTL2		2
+#define PMU2_PLL_PC2_M5DIV_MASK 	0x000000ff
+#define PMU2_PLL_PC2_M5DIV_SHIFT	0
+#define PMU2_PLL_PC2_M6DIV_MASK 	0x0000ff00
+#define PMU2_PLL_PC2_M6DIV_SHIFT	8
+#define PMU2_PLL_PC2_NDIV_MODE_MASK	0x000e0000
+#define PMU2_PLL_PC2_NDIV_MODE_SHIFT	17
+#define PMU2_PLL_PC2_NDIV_INT_MASK	0x1ff00000
+#define PMU2_PLL_PC2_NDIV_INT_SHIFT	20
+
+/* ndiv_frac */
+#define PMU2_PLL_PLLCTL3		3
+#define PMU2_PLL_PC3_NDIV_FRAC_MASK	0x00ffffff
+#define PMU2_PLL_PC3_NDIV_FRAC_SHIFT	0
+
+/* pll_ctrl */
+#define PMU2_PLL_PLLCTL4		4
+
+/* pll_ctrl, vco_rng, clkdrive_ch<x> */
+#define PMU2_PLL_PLLCTL5		5
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_MASK	0x00000f00
+#define PMU2_PLL_PC5_CLKDRIVE_CH1_SHIFT	8
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_MASK	0x0000f000
+#define PMU2_PLL_PC5_CLKDRIVE_CH2_SHIFT	12
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_MASK	0x000f0000
+#define PMU2_PLL_PC5_CLKDRIVE_CH3_SHIFT	16
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_MASK	0x00f00000
+#define PMU2_PLL_PC5_CLKDRIVE_CH4_SHIFT	20
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_MASK	0x0f000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH5_SHIFT	24
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_MASK	0xf0000000
+#define PMU2_PLL_PC5_CLKDRIVE_CH6_SHIFT	28
+
+/* PMU rev 5 (& 6) */
+#define	PMU5_PLL_P1P2_OFF		0
+#define	PMU5_PLL_P1_MASK		0x0f000000
+#define	PMU5_PLL_P1_SHIFT		24
+#define	PMU5_PLL_P2_MASK		0x00f00000
+#define	PMU5_PLL_P2_SHIFT		20
+#define	PMU5_PLL_M14_OFF		1
+#define	PMU5_PLL_MDIV_MASK		0x000000ff
+#define	PMU5_PLL_MDIV_WIDTH		8
+#define	PMU5_PLL_NM5_OFF		2
+#define	PMU5_PLL_NDIV_MASK		0xfff00000
+#define	PMU5_PLL_NDIV_SHIFT		20
+#define	PMU5_PLL_NDIV_MODE_MASK		0x000e0000
+#define	PMU5_PLL_NDIV_MODE_SHIFT	17
+#define	PMU5_PLL_FMAB_OFF		3
+#define	PMU5_PLL_MRAT_MASK		0xf0000000
+#define	PMU5_PLL_MRAT_SHIFT		28
+#define	PMU5_PLL_ABRAT_MASK		0x08000000
+#define	PMU5_PLL_ABRAT_SHIFT		27
+#define	PMU5_PLL_FDIV_MASK		0x07ffffff
+#define	PMU5_PLL_PLLCTL_OFF		4
+#define	PMU5_PLL_PCHI_OFF		5
+#define	PMU5_PLL_PCHI_MASK		0x0000003f
+
+/* pmu XtalFreqRatio */
+#define	PMU_XTALFREQ_REG_ILPCTR_MASK	0x00001FFF
+#define	PMU_XTALFREQ_REG_MEASURE_MASK	0x80000000
+#define	PMU_XTALFREQ_REG_MEASURE_SHIFT	31
+
+/* Divider allocation in 4716/47162/5356/5357 */
+#define	PMU5_MAINPLL_CPU		1
+#define	PMU5_MAINPLL_MEM		2
+#define	PMU5_MAINPLL_SI			3
+
+/* 4706 PMU */
+#define PMU4706_MAINPLL_PLL0	0
+#define PMU6_4706_PROCPLL_OFF	4	/* The CPU PLL */
+#define PMU6_4706_PROC_P2DIV_MASK		0x000f0000
+#define PMU6_4706_PROC_P2DIV_SHIFT	16
+#define PMU6_4706_PROC_P1DIV_MASK		0x0000f000
+#define PMU6_4706_PROC_P1DIV_SHIFT	12
+#define PMU6_4706_PROC_NDIV_INT_MASK	0x00000ff8
+#define PMU6_4706_PROC_NDIV_INT_SHIFT	3
+#define PMU6_4706_PROC_NDIV_MODE_MASK		0x00000007
+#define PMU6_4706_PROC_NDIV_MODE_SHIFT	0
+
+#define PMU7_PLL_PLLCTL7                7
+#define PMU7_PLL_CTL7_M4DIV_MASK	0xff000000
+#define PMU7_PLL_CTL7_M4DIV_SHIFT 	24
+#define PMU7_PLL_CTL7_M4DIV_BY_6	6
+#define PMU7_PLL_CTL7_M4DIV_BY_12	0xc
+#define PMU7_PLL_CTL7_M4DIV_BY_24	0x18
+#define PMU7_PLL_PLLCTL8                8
+#define PMU7_PLL_CTL8_M5DIV_MASK	0x000000ff
+#define PMU7_PLL_CTL8_M5DIV_SHIFT	0
+#define PMU7_PLL_CTL8_M5DIV_BY_8	8
+#define PMU7_PLL_CTL8_M5DIV_BY_12	0xc
+#define PMU7_PLL_CTL8_M5DIV_BY_24	0x18
+#define PMU7_PLL_CTL8_M6DIV_MASK	0x0000ff00
+#define PMU7_PLL_CTL8_M6DIV_SHIFT	8
+#define PMU7_PLL_CTL8_M6DIV_BY_12	0xc
+#define PMU7_PLL_CTL8_M6DIV_BY_24	0x18
+#define PMU7_PLL_PLLCTL11		11
+#define PMU7_PLL_PLLCTL11_MASK		0xffffff00
+#define PMU7_PLL_PLLCTL11_VAL		0x22222200
+
+/* PMU rev 15 */
+#define PMU15_PLL_PLLCTL0		0
+#define PMU15_PLL_PC0_CLKSEL_MASK	0x00000003
+#define PMU15_PLL_PC0_CLKSEL_SHIFT	0
+#define PMU15_PLL_PC0_FREQTGT_MASK	0x003FFFFC
+#define PMU15_PLL_PC0_FREQTGT_SHIFT	2
+#define PMU15_PLL_PC0_PRESCALE_MASK	0x00C00000
+#define PMU15_PLL_PC0_PRESCALE_SHIFT	22
+#define PMU15_PLL_PC0_KPCTRL_MASK	0x07000000
+#define PMU15_PLL_PC0_KPCTRL_SHIFT	24
+#define PMU15_PLL_PC0_FCNTCTRL_MASK	0x38000000
+#define PMU15_PLL_PC0_FCNTCTRL_SHIFT	27
+#define PMU15_PLL_PC0_FDCMODE_MASK	0x40000000
+#define PMU15_PLL_PC0_FDCMODE_SHIFT	30
+#define PMU15_PLL_PC0_CTRLBIAS_MASK	0x80000000
+#define PMU15_PLL_PC0_CTRLBIAS_SHIFT	31
+
+#define PMU15_PLL_PLLCTL1			1
+#define PMU15_PLL_PC1_BIAS_CTLM_MASK		0x00000060
+#define PMU15_PLL_PC1_BIAS_CTLM_SHIFT		5
+#define PMU15_PLL_PC1_BIAS_CTLM_RST_MASK	0x00000040
+#define PMU15_PLL_PC1_BIAS_CTLM_RST_SHIFT	6
+#define PMU15_PLL_PC1_BIAS_SS_DIVR_MASK		0x0001FF80
+#define PMU15_PLL_PC1_BIAS_SS_DIVR_SHIFT	7
+#define PMU15_PLL_PC1_BIAS_SS_RSTVAL_MASK	0x03FE0000
+#define PMU15_PLL_PC1_BIAS_SS_RSTVAL_SHIFT	17
+#define PMU15_PLL_PC1_BIAS_INTG_BW_MASK		0x0C000000
+#define PMU15_PLL_PC1_BIAS_INTG_BW_SHIFT	26
+#define PMU15_PLL_PC1_BIAS_INTG_BYP_MASK	0x10000000
+#define PMU15_PLL_PC1_BIAS_INTG_BYP_SHIFT	28
+#define PMU15_PLL_PC1_OPENLP_EN_MASK		0x40000000
+#define PMU15_PLL_PC1_OPENLP_EN_SHIFT		30
+
+#define PMU15_PLL_PLLCTL2			2
+#define PMU15_PLL_PC2_CTEN_MASK			0x00000001
+#define PMU15_PLL_PC2_CTEN_SHIFT		0
+
+#define PMU15_PLL_PLLCTL3			3
+#define PMU15_PLL_PC3_DITHER_EN_MASK		0x00000001
+#define PMU15_PLL_PC3_DITHER_EN_SHIFT		0
+#define PMU15_PLL_PC3_DCOCTLSP_MASK		0xFE000000
+#define PMU15_PLL_PC3_DCOCTLSP_SHIFT		25
+#define PMU15_PLL_PC3_DCOCTLSP_DIV2EN_MASK	0x01
+#define PMU15_PLL_PC3_DCOCTLSP_DIV2EN_SHIFT	0
+#define PMU15_PLL_PC3_DCOCTLSP_CH0EN_MASK	0x02
+#define PMU15_PLL_PC3_DCOCTLSP_CH0EN_SHIFT	1
+#define PMU15_PLL_PC3_DCOCTLSP_CH1EN_MASK	0x04
+#define PMU15_PLL_PC3_DCOCTLSP_CH1EN_SHIFT	2
+#define PMU15_PLL_PC3_DCOCTLSP_CH0SEL_MASK	0x18
+#define PMU15_PLL_PC3_DCOCTLSP_CH0SEL_SHIFT	3
+#define PMU15_PLL_PC3_DCOCTLSP_CH1SEL_MASK	0x60
+#define PMU15_PLL_PC3_DCOCTLSP_CH1SEL_SHIFT	5
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV1	0
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV2	1
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV3	2
+#define PMU15_PLL_PC3_DCOCTLSP_CHSEL_OUTP_DIV5	3
+
+#define PMU15_PLL_PLLCTL4			4
+#define PMU15_PLL_PC4_FLLCLK1_DIV_MASK		0x00000007
+#define PMU15_PLL_PC4_FLLCLK1_DIV_SHIFT		0
+#define PMU15_PLL_PC4_FLLCLK2_DIV_MASK		0x00000038
+#define PMU15_PLL_PC4_FLLCLK2_DIV_SHIFT		3
+#define PMU15_PLL_PC4_FLLCLK3_DIV_MASK		0x000001C0
+#define PMU15_PLL_PC4_FLLCLK3_DIV_SHIFT		6
+#define PMU15_PLL_PC4_DBGMODE_MASK		0x00000E00
+#define PMU15_PLL_PC4_DBGMODE_SHIFT		9
+#define PMU15_PLL_PC4_FLL480_CTLSP_LK_MASK	0x00001000
+#define PMU15_PLL_PC4_FLL480_CTLSP_LK_SHIFT	12
+#define PMU15_PLL_PC4_FLL480_CTLSP_MASK		0x000FE000
+#define PMU15_PLL_PC4_FLL480_CTLSP_SHIFT	13
+#define PMU15_PLL_PC4_DINPOL_MASK		0x00100000
+#define PMU15_PLL_PC4_DINPOL_SHIFT		20
+#define PMU15_PLL_PC4_CLKOUT_PD_MASK		0x00200000
+#define PMU15_PLL_PC4_CLKOUT_PD_SHIFT		21
+#define PMU15_PLL_PC4_CLKDIV2_PD_MASK		0x00400000
+#define PMU15_PLL_PC4_CLKDIV2_PD_SHIFT		22
+#define PMU15_PLL_PC4_CLKDIV4_PD_MASK		0x00800000
+#define PMU15_PLL_PC4_CLKDIV4_PD_SHIFT		23
+#define PMU15_PLL_PC4_CLKDIV8_PD_MASK		0x01000000
+#define PMU15_PLL_PC4_CLKDIV8_PD_SHIFT		24
+#define PMU15_PLL_PC4_CLKDIV16_PD_MASK		0x02000000
+#define PMU15_PLL_PC4_CLKDIV16_PD_SHIFT		25
+#define PMU15_PLL_PC4_TEST_EN_MASK		0x04000000
+#define PMU15_PLL_PC4_TEST_EN_SHIFT		26
+
+#define PMU15_PLL_PLLCTL5			5
+#define PMU15_PLL_PC5_FREQTGT_MASK		0x000FFFFF
+#define PMU15_PLL_PC5_FREQTGT_SHIFT		0
+#define PMU15_PLL_PC5_DCOCTLSP_MASK		0x07F00000
+#define PMU15_PLL_PC5_DCOCTLSP_SHIFT		20
+#define PMU15_PLL_PC5_PRESCALE_MASK		0x18000000
+#define PMU15_PLL_PC5_PRESCALE_SHIFT		27
+
+#define PMU15_PLL_PLLCTL6		6
+#define PMU15_PLL_PC6_FREQTGT_MASK	0x000FFFFF
+#define PMU15_PLL_PC6_FREQTGT_SHIFT	0
+#define PMU15_PLL_PC6_DCOCTLSP_MASK	0x07F00000
+#define PMU15_PLL_PC6_DCOCTLSP_SHIFT	20
+#define PMU15_PLL_PC6_PRESCALE_MASK	0x18000000
+#define PMU15_PLL_PC6_PRESCALE_SHIFT	27
+
+#define PMU15_FREQTGT_480_DEFAULT	0x19AB1
+#define PMU15_FREQTGT_492_DEFAULT	0x1A4F5
+#define PMU15_ARM_96MHZ			96000000	/* 96 Mhz */
+#define PMU15_ARM_98MHZ			98400000	/* 98.4 Mhz */
+#define PMU15_ARM_97MHZ			97000000	/* 97 Mhz */
+
+
+#define PMU17_PLLCTL2_NDIVTYPE_MASK		0x00000070
+#define PMU17_PLLCTL2_NDIVTYPE_SHIFT		4
+
+#define PMU17_PLLCTL2_NDIV_MODE_INT		0
+#define PMU17_PLLCTL2_NDIV_MODE_INT1B8		1
+#define PMU17_PLLCTL2_NDIV_MODE_MASH111		2
+#define PMU17_PLLCTL2_NDIV_MODE_MASH111B8	3
+
+#define PMU17_PLLCTL0_BBPLL_PWRDWN		0
+#define PMU17_PLLCTL0_BBPLL_DRST		3
+#define PMU17_PLLCTL0_BBPLL_DISBL_CLK		8
+
+/* PLL usage in 4716/47162 */
+#define	PMU4716_MAINPLL_PLL0		12
+
+/* PLL usage in 4335 */
+#define PMU4335_PLL0_PC2_P1DIV_MASK			0x000f0000
+#define PMU4335_PLL0_PC2_P1DIV_SHIFT		16
+#define PMU4335_PLL0_PC2_NDIV_INT_MASK		0xff800000
+#define PMU4335_PLL0_PC2_NDIV_INT_SHIFT		23
+#define PMU4335_PLL0_PC1_MDIV2_MASK			0x0000ff00
+#define PMU4335_PLL0_PC1_MDIV2_SHIFT		8
+
+
+/* PLL usage in 5356/5357 */
+#define	PMU5356_MAINPLL_PLL0		0
+#define	PMU5357_MAINPLL_PLL0		0
+
+/* 4716/47162 resources */
+#define RES4716_PROC_PLL_ON		0x00000040
+#define RES4716_PROC_HT_AVAIL		0x00000080
+
+/* 4716/4717/4718 Chip specific ChipControl register bits */
+#define CCTRL_471X_I2S_PINS_ENABLE	0x0080 /* I2S pins off by default, shared w/ pflash */
+
+/* 5357 Chip specific ChipControl register bits */
+/* 2nd - 32-bit reg */
+#define CCTRL_5357_I2S_PINS_ENABLE	0x00040000 /* I2S pins enable */
+#define CCTRL_5357_I2CSPI_PINS_ENABLE	0x00080000 /* I2C/SPI pins enable */
+
+/* 5354 resources */
+#define RES5354_EXT_SWITCHER_PWM	0	/* 0x00001 */
+#define RES5354_BB_SWITCHER_PWM		1	/* 0x00002 */
+#define RES5354_BB_SWITCHER_BURST	2	/* 0x00004 */
+#define RES5354_BB_EXT_SWITCHER_BURST	3	/* 0x00008 */
+#define RES5354_ILP_REQUEST		4	/* 0x00010 */
+#define RES5354_RADIO_SWITCHER_PWM	5	/* 0x00020 */
+#define RES5354_RADIO_SWITCHER_BURST	6	/* 0x00040 */
+#define RES5354_ROM_SWITCH		7	/* 0x00080 */
+#define RES5354_PA_REF_LDO		8	/* 0x00100 */
+#define RES5354_RADIO_LDO		9	/* 0x00200 */
+#define RES5354_AFE_LDO			10	/* 0x00400 */
+#define RES5354_PLL_LDO			11	/* 0x00800 */
+#define RES5354_BG_FILTBYP		12	/* 0x01000 */
+#define RES5354_TX_FILTBYP		13	/* 0x02000 */
+#define RES5354_RX_FILTBYP		14	/* 0x04000 */
+#define RES5354_XTAL_PU			15	/* 0x08000 */
+#define RES5354_XTAL_EN			16	/* 0x10000 */
+#define RES5354_BB_PLL_FILTBYP		17	/* 0x20000 */
+#define RES5354_RF_PLL_FILTBYP		18	/* 0x40000 */
+#define RES5354_BB_PLL_PU		19	/* 0x80000 */
+
+/* 5357 Chip specific ChipControl register bits */
+#define CCTRL5357_EXTPA                 (1<<14) /* extPA in ChipControl 1, bit 14 */
+#define CCTRL5357_ANT_MUX_2o3		(1<<15) /* 2o3 in ChipControl 1, bit 15 */
+#define CCTRL5357_NFLASH		(1<<16) /* Nandflash in ChipControl 1, bit 16 */
+
+/* 43217 Chip specific ChipControl register bits */
+#define CCTRL43217_EXTPA_C0             (1<<13) /* core0 extPA in ChipControl 1, bit 13 */
+#define CCTRL43217_EXTPA_C1             (1<<8)  /* core1 extPA in ChipControl 1, bit 8 */
+
+/* 43228 Chip specific ChipControl register bits */
+#define CCTRL43228_EXTPA_C0             (1<<14) /* core1 extPA in ChipControl 1, bit 14 */
+#define CCTRL43228_EXTPA_C1             (1<<9)  /* core0 extPA in ChipControl 1, bit 1 */
+
+/* 4328 resources */
+#define RES4328_EXT_SWITCHER_PWM	0	/* 0x00001 */
+#define RES4328_BB_SWITCHER_PWM		1	/* 0x00002 */
+#define RES4328_BB_SWITCHER_BURST	2	/* 0x00004 */
+#define RES4328_BB_EXT_SWITCHER_BURST	3	/* 0x00008 */
+#define RES4328_ILP_REQUEST		4	/* 0x00010 */
+#define RES4328_RADIO_SWITCHER_PWM	5	/* 0x00020 */
+#define RES4328_RADIO_SWITCHER_BURST	6	/* 0x00040 */
+#define RES4328_ROM_SWITCH		7	/* 0x00080 */
+#define RES4328_PA_REF_LDO		8	/* 0x00100 */
+#define RES4328_RADIO_LDO		9	/* 0x00200 */
+#define RES4328_AFE_LDO			10	/* 0x00400 */
+#define RES4328_PLL_LDO			11	/* 0x00800 */
+#define RES4328_BG_FILTBYP		12	/* 0x01000 */
+#define RES4328_TX_FILTBYP		13	/* 0x02000 */
+#define RES4328_RX_FILTBYP		14	/* 0x04000 */
+#define RES4328_XTAL_PU			15	/* 0x08000 */
+#define RES4328_XTAL_EN			16	/* 0x10000 */
+#define RES4328_BB_PLL_FILTBYP		17	/* 0x20000 */
+#define RES4328_RF_PLL_FILTBYP		18	/* 0x40000 */
+#define RES4328_BB_PLL_PU		19	/* 0x80000 */
+
+/* 4325 A0/A1 resources */
+#define RES4325_BUCK_BOOST_BURST	0	/* 0x00000001 */
+#define RES4325_CBUCK_BURST		1	/* 0x00000002 */
+#define RES4325_CBUCK_PWM		2	/* 0x00000004 */
+#define RES4325_CLDO_CBUCK_BURST	3	/* 0x00000008 */
+#define RES4325_CLDO_CBUCK_PWM		4	/* 0x00000010 */
+#define RES4325_BUCK_BOOST_PWM		5	/* 0x00000020 */
+#define RES4325_ILP_REQUEST		6	/* 0x00000040 */
+#define RES4325_ABUCK_BURST		7	/* 0x00000080 */
+#define RES4325_ABUCK_PWM		8	/* 0x00000100 */
+#define RES4325_LNLDO1_PU		9	/* 0x00000200 */
+#define RES4325_OTP_PU			10	/* 0x00000400 */
+#define RES4325_LNLDO3_PU		11	/* 0x00000800 */
+#define RES4325_LNLDO4_PU		12	/* 0x00001000 */
+#define RES4325_XTAL_PU			13	/* 0x00002000 */
+#define RES4325_ALP_AVAIL		14	/* 0x00004000 */
+#define RES4325_RX_PWRSW_PU		15	/* 0x00008000 */
+#define RES4325_TX_PWRSW_PU		16	/* 0x00010000 */
+#define RES4325_RFPLL_PWRSW_PU		17	/* 0x00020000 */
+#define RES4325_LOGEN_PWRSW_PU		18	/* 0x00040000 */
+#define RES4325_AFE_PWRSW_PU		19	/* 0x00080000 */
+#define RES4325_BBPLL_PWRSW_PU		20	/* 0x00100000 */
+#define RES4325_HT_AVAIL		21	/* 0x00200000 */
+
+/* 4325 B0/C0 resources */
+#define RES4325B0_CBUCK_LPOM		1	/* 0x00000002 */
+#define RES4325B0_CBUCK_BURST		2	/* 0x00000004 */
+#define RES4325B0_CBUCK_PWM		3	/* 0x00000008 */
+#define RES4325B0_CLDO_PU		4	/* 0x00000010 */
+
+/* 4325 C1 resources */
+#define RES4325C1_LNLDO2_PU		12	/* 0x00001000 */
+
+/* 4325 chip-specific ChipStatus register bits */
+#define CST4325_SPROM_OTP_SEL_MASK	0x00000003
+#define CST4325_DEFCIS_SEL		0	/* OTP is powered up, use def. CIS, no SPROM */
+#define CST4325_SPROM_SEL		1	/* OTP is powered up, SPROM is present */
+#define CST4325_OTP_SEL			2	/* OTP is powered up, no SPROM */
+#define CST4325_OTP_PWRDN		3	/* OTP is powered down, SPROM is present */
+#define CST4325_SDIO_USB_MODE_MASK	0x00000004
+#define CST4325_SDIO_USB_MODE_SHIFT	2
+#define CST4325_RCAL_VALID_MASK		0x00000008
+#define CST4325_RCAL_VALID_SHIFT	3
+#define CST4325_RCAL_VALUE_MASK		0x000001f0
+#define CST4325_RCAL_VALUE_SHIFT	4
+#define CST4325_PMUTOP_2B_MASK 		0x00000200	/* 1 for 2b, 0 for to 2a */
+#define CST4325_PMUTOP_2B_SHIFT   	9
+
+#define RES4329_RESERVED0		0	/* 0x00000001 */
+#define RES4329_CBUCK_LPOM		1	/* 0x00000002 */
+#define RES4329_CBUCK_BURST		2	/* 0x00000004 */
+#define RES4329_CBUCK_PWM		3	/* 0x00000008 */
+#define RES4329_CLDO_PU			4	/* 0x00000010 */
+#define RES4329_PALDO_PU		5	/* 0x00000020 */
+#define RES4329_ILP_REQUEST		6	/* 0x00000040 */
+#define RES4329_RESERVED7		7	/* 0x00000080 */
+#define RES4329_RESERVED8		8	/* 0x00000100 */
+#define RES4329_LNLDO1_PU		9	/* 0x00000200 */
+#define RES4329_OTP_PU			10	/* 0x00000400 */
+#define RES4329_RESERVED11		11	/* 0x00000800 */
+#define RES4329_LNLDO2_PU		12	/* 0x00001000 */
+#define RES4329_XTAL_PU			13	/* 0x00002000 */
+#define RES4329_ALP_AVAIL		14	/* 0x00004000 */
+#define RES4329_RX_PWRSW_PU		15	/* 0x00008000 */
+#define RES4329_TX_PWRSW_PU		16	/* 0x00010000 */
+#define RES4329_RFPLL_PWRSW_PU		17	/* 0x00020000 */
+#define RES4329_LOGEN_PWRSW_PU		18	/* 0x00040000 */
+#define RES4329_AFE_PWRSW_PU		19	/* 0x00080000 */
+#define RES4329_BBPLL_PWRSW_PU		20	/* 0x00100000 */
+#define RES4329_HT_AVAIL		21	/* 0x00200000 */
+
+#define CST4329_SPROM_OTP_SEL_MASK	0x00000003
+#define CST4329_DEFCIS_SEL		0	/* OTP is powered up, use def. CIS, no SPROM */
+#define CST4329_SPROM_SEL		1	/* OTP is powered up, SPROM is present */
+#define CST4329_OTP_SEL			2	/* OTP is powered up, no SPROM */
+#define CST4329_OTP_PWRDN		3	/* OTP is powered down, SPROM is present */
+#define CST4329_SPI_SDIO_MODE_MASK	0x00000004
+#define CST4329_SPI_SDIO_MODE_SHIFT	2
+
+/* 4312 chip-specific ChipStatus register bits */
+#define CST4312_SPROM_OTP_SEL_MASK	0x00000003
+#define CST4312_DEFCIS_SEL		0	/* OTP is powered up, use def. CIS, no SPROM */
+#define CST4312_SPROM_SEL		1	/* OTP is powered up, SPROM is present */
+#define CST4312_OTP_SEL			2	/* OTP is powered up, no SPROM */
+#define CST4312_OTP_BAD			3	/* OTP is broken, SPROM is present */
+
+/* 4312 resources (all PMU chips with little memory constraint) */
+#define RES4312_SWITCHER_BURST		0	/* 0x00000001 */
+#define RES4312_SWITCHER_PWM    	1	/* 0x00000002 */
+#define RES4312_PA_REF_LDO		2	/* 0x00000004 */
+#define RES4312_CORE_LDO_BURST		3	/* 0x00000008 */
+#define RES4312_CORE_LDO_PWM		4	/* 0x00000010 */
+#define RES4312_RADIO_LDO		5	/* 0x00000020 */
+#define RES4312_ILP_REQUEST		6	/* 0x00000040 */
+#define RES4312_BG_FILTBYP		7	/* 0x00000080 */
+#define RES4312_TX_FILTBYP		8	/* 0x00000100 */
+#define RES4312_RX_FILTBYP		9	/* 0x00000200 */
+#define RES4312_XTAL_PU			10	/* 0x00000400 */
+#define RES4312_ALP_AVAIL		11	/* 0x00000800 */
+#define RES4312_BB_PLL_FILTBYP		12	/* 0x00001000 */
+#define RES4312_RF_PLL_FILTBYP		13	/* 0x00002000 */
+#define RES4312_HT_AVAIL		14	/* 0x00004000 */
+
+/* 4322 resources */
+#define RES4322_RF_LDO			0
+#define RES4322_ILP_REQUEST		1
+#define RES4322_XTAL_PU			2
+#define RES4322_ALP_AVAIL		3
+#define RES4322_SI_PLL_ON		4
+#define RES4322_HT_SI_AVAIL		5
+#define RES4322_PHY_PLL_ON		6
+#define RES4322_HT_PHY_AVAIL		7
+#define RES4322_OTP_PU			8
+
+/* 4322 chip-specific ChipStatus register bits */
+#define CST4322_XTAL_FREQ_20_40MHZ	0x00000020
+#define CST4322_SPROM_OTP_SEL_MASK	0x000000c0
+#define CST4322_SPROM_OTP_SEL_SHIFT	6
+#define CST4322_NO_SPROM_OTP		0	/* no OTP, no SPROM */
+#define CST4322_SPROM_PRESENT		1	/* SPROM is present */
+#define CST4322_OTP_PRESENT		2	/* OTP is present */
+#define CST4322_PCI_OR_USB		0x00000100
+#define CST4322_BOOT_MASK		0x00000600
+#define CST4322_BOOT_SHIFT		9
+#define CST4322_BOOT_FROM_SRAM		0	/* boot from SRAM, ARM in reset */
+#define CST4322_BOOT_FROM_ROM		1	/* boot from ROM */
+#define CST4322_BOOT_FROM_FLASH		2	/* boot from FLASH */
+#define CST4322_BOOT_FROM_INVALID	3
+#define CST4322_ILP_DIV_EN		0x00000800
+#define CST4322_FLASH_TYPE_MASK		0x00001000
+#define CST4322_FLASH_TYPE_SHIFT	12
+#define CST4322_FLASH_TYPE_SHIFT_ST	0	/* ST serial FLASH */
+#define CST4322_FLASH_TYPE_SHIFT_ATMEL	1	/* ATMEL flash */
+#define CST4322_ARM_TAP_SEL		0x00002000
+#define CST4322_RES_INIT_MODE_MASK	0x0000c000
+#define CST4322_RES_INIT_MODE_SHIFT	14
+#define CST4322_RES_INIT_MODE_ILPAVAIL	0	/* resinitmode: ILP available */
+#define CST4322_RES_INIT_MODE_ILPREQ	1	/* resinitmode: ILP request */
+#define CST4322_RES_INIT_MODE_ALPAVAIL	2	/* resinitmode: ALP available */
+#define CST4322_RES_INIT_MODE_HTAVAIL	3	/* resinitmode: HT available */
+#define CST4322_PCIPLLCLK_GATING	0x00010000
+#define CST4322_CLK_SWITCH_PCI_TO_ALP	0x00020000
+#define CST4322_PCI_CARDBUS_MODE	0x00040000
+
+/* 43224 chip-specific ChipControl register bits */
+#define CCTRL43224_GPIO_TOGGLE          0x8000 /* gpio[3:0] pins as btcoex or s/w gpio */
+#define CCTRL_43224A0_12MA_LED_DRIVE    0x00F000F0 /* 12 mA drive strength */
+#define CCTRL_43224B0_12MA_LED_DRIVE    0xF0    /* 12 mA drive strength for later 43224s */
+
+/* 43236 resources */
+#define RES43236_REGULATOR		0
+#define RES43236_ILP_REQUEST		1
+#define RES43236_XTAL_PU		2
+#define RES43236_ALP_AVAIL		3
+#define RES43236_SI_PLL_ON		4
+#define RES43236_HT_SI_AVAIL		5
+
+/* 43236 chip-specific ChipControl register bits */
+#define CCTRL43236_BT_COEXIST		(1<<0)	/* 0 disable */
+#define CCTRL43236_SECI			(1<<1)	/* 0 SECI is disabled (JATG functional) */
+#define CCTRL43236_EXT_LNA		(1<<2)	/* 0 disable */
+#define CCTRL43236_ANT_MUX_2o3          (1<<3)	/* 2o3 mux, chipcontrol bit 3 */
+#define CCTRL43236_GSIO			(1<<4)	/* 0 disable */
+
+/* 43236 Chip specific ChipStatus register bits */
+#define CST43236_SFLASH_MASK		0x00000040
+#define CST43236_OTP_SEL_MASK		0x00000080
+#define CST43236_OTP_SEL_SHIFT		7
+#define CST43236_HSIC_MASK		0x00000100	/* USB/HSIC */
+#define CST43236_BP_CLK			0x00000200	/* 120/96Mbps */
+#define CST43236_BOOT_MASK		0x00001800
+#define CST43236_BOOT_SHIFT		11
+#define CST43236_BOOT_FROM_SRAM		0	/* boot from SRAM, ARM in reset */
+#define CST43236_BOOT_FROM_ROM		1	/* boot from ROM */
+#define CST43236_BOOT_FROM_FLASH	2	/* boot from FLASH */
+#define CST43236_BOOT_FROM_INVALID	3
+
+/* 43237 resources */
+#define RES43237_REGULATOR		0
+#define RES43237_ILP_REQUEST		1
+#define RES43237_XTAL_PU		2
+#define RES43237_ALP_AVAIL		3
+#define RES43237_SI_PLL_ON		4
+#define RES43237_HT_SI_AVAIL		5
+
+/* 43237 chip-specific ChipControl register bits */
+#define CCTRL43237_BT_COEXIST		(1<<0)	/* 0 disable */
+#define CCTRL43237_SECI			(1<<1)	/* 0 SECI is disabled (JATG functional) */
+#define CCTRL43237_EXT_LNA		(1<<2)	/* 0 disable */
+#define CCTRL43237_ANT_MUX_2o3          (1<<3)	/* 2o3 mux, chipcontrol bit 3 */
+#define CCTRL43237_GSIO			(1<<4)	/* 0 disable */
+
+/* 43237 Chip specific ChipStatus register bits */
+#define CST43237_SFLASH_MASK		0x00000040
+#define CST43237_OTP_SEL_MASK		0x00000080
+#define CST43237_OTP_SEL_SHIFT		7
+#define CST43237_HSIC_MASK		0x00000100	/* USB/HSIC */
+#define CST43237_BP_CLK			0x00000200	/* 120/96Mbps */
+#define CST43237_BOOT_MASK		0x00001800
+#define CST43237_BOOT_SHIFT		11
+#define CST43237_BOOT_FROM_SRAM		0	/* boot from SRAM, ARM in reset */
+#define CST43237_BOOT_FROM_ROM		1	/* boot from ROM */
+#define CST43237_BOOT_FROM_FLASH	2	/* boot from FLASH */
+#define CST43237_BOOT_FROM_INVALID	3
+
+/* 43239 resources */
+#define RES43239_OTP_PU			9
+#define RES43239_MACPHY_CLKAVAIL	23
+#define RES43239_HT_AVAIL		24
+
+/* 43239 Chip specific ChipStatus register bits */
+#define CST43239_SPROM_MASK			0x00000002
+#define CST43239_SFLASH_MASK		0x00000004
+#define	CST43239_RES_INIT_MODE_SHIFT	7
+#define	CST43239_RES_INIT_MODE_MASK		0x000001f0
+#define CST43239_CHIPMODE_SDIOD(cs)	((cs) & (1 << 15))	/* SDIO || gSPI */
+#define CST43239_CHIPMODE_USB20D(cs)	(~(cs) & (1 << 15))	/* USB || USBDA */
+#define CST43239_CHIPMODE_SDIO(cs)	(((cs) & (1 << 0)) == 0)	/* SDIO */
+#define CST43239_CHIPMODE_GSPI(cs)	(((cs) & (1 << 0)) == (1 << 0))	/* gSPI */
+
+/* 4324 resources */
+/* 43242 use same PMU as 4324 */
+#define RES4324_LPLDO_PU			0
+#define RES4324_RESET_PULLDN_DIS		1
+#define RES4324_PMU_BG_PU			2
+#define RES4324_HSIC_LDO_PU			3
+#define RES4324_CBUCK_LPOM_PU			4
+#define RES4324_CBUCK_PFM_PU			5
+#define RES4324_CLDO_PU				6
+#define RES4324_LPLDO2_LVM			7
+#define RES4324_LNLDO1_PU			8
+#define RES4324_LNLDO2_PU			9
+#define RES4324_LDO3P3_PU			10
+#define RES4324_OTP_PU				11
+#define RES4324_XTAL_PU				12
+#define RES4324_BBPLL_PU			13
+#define RES4324_LQ_AVAIL			14
+#define RES4324_WL_CORE_READY			17
+#define RES4324_ILP_REQ				18
+#define RES4324_ALP_AVAIL			19
+#define RES4324_PALDO_PU			20
+#define RES4324_RADIO_PU			21
+#define RES4324_SR_CLK_STABLE			22
+#define RES4324_SR_SAVE_RESTORE			23
+#define RES4324_SR_PHY_PWRSW			24
+#define RES4324_SR_PHY_PIC			25
+#define RES4324_SR_SUBCORE_PWRSW		26
+#define RES4324_SR_SUBCORE_PIC			27
+#define RES4324_SR_MEM_PM0			28
+#define RES4324_HT_AVAIL			29
+#define RES4324_MACPHY_CLKAVAIL			30
+
+/* 4324 Chip specific ChipStatus register bits */
+#define CST4324_SPROM_MASK			0x00000080
+#define CST4324_SFLASH_MASK			0x00400000
+#define	CST4324_RES_INIT_MODE_SHIFT	10
+#define	CST4324_RES_INIT_MODE_MASK	0x00000c00
+#define CST4324_CHIPMODE_MASK		0x7
+#define CST4324_CHIPMODE_SDIOD(cs)	((~(cs)) & (1 << 2))	/* SDIO || gSPI */
+#define CST4324_CHIPMODE_USB20D(cs)	(((cs) & CST4324_CHIPMODE_MASK) == 0x6)	/* USB || USBDA */
+
+/* 43242 Chip specific ChipStatus register bits */
+#define CST43242_SFLASH_MASK                    0x00000008
+#define CST43242_SR_HALT			(1<<25)
+#define CST43242_SR_CHIP_STATUS_2		27 /* bit 27 */
+
+/* 4331 resources */
+#define RES4331_REGULATOR		0
+#define RES4331_ILP_REQUEST		1
+#define RES4331_XTAL_PU			2
+#define RES4331_ALP_AVAIL		3
+#define RES4331_SI_PLL_ON		4
+#define RES4331_HT_SI_AVAIL		5
+
+/* 4331 chip-specific ChipControl register bits */
+#define CCTRL4331_BT_COEXIST		(1<<0)	/* 0 disable */
+#define CCTRL4331_SECI			(1<<1)	/* 0 SECI is disabled (JATG functional) */
+#define CCTRL4331_EXT_LNA_G		(1<<2)	/* 0 disable */
+#define CCTRL4331_SPROM_GPIO13_15       (1<<3)  /* sprom/gpio13-15 mux */
+#define CCTRL4331_EXTPA_EN		(1<<4)	/* 0 ext pa disable, 1 ext pa enabled */
+#define CCTRL4331_GPIOCLK_ON_SPROMCS	(1<<5)	/* set drive out GPIO_CLK on sprom_cs pin */
+#define CCTRL4331_PCIE_MDIO_ON_SPROMCS	(1<<6)	/* use sprom_cs pin as PCIE mdio interface */
+#define CCTRL4331_EXTPA_ON_GPIO2_5	(1<<7)	/* aband extpa will be at gpio2/5 and sprom_dout */
+#define CCTRL4331_OVR_PIPEAUXCLKEN	(1<<8)	/* override core control on pipe_AuxClkEnable */
+#define CCTRL4331_OVR_PIPEAUXPWRDOWN	(1<<9)	/* override core control on pipe_AuxPowerDown */
+#define CCTRL4331_PCIE_AUXCLKEN		(1<<10)	/* pcie_auxclkenable */
+#define CCTRL4331_PCIE_PIPE_PLLDOWN	(1<<11)	/* pcie_pipe_pllpowerdown */
+#define CCTRL4331_EXTPA_EN2		(1<<12)	/* 0 ext pa disable, 1 ext pa enabled */
+#define CCTRL4331_EXT_LNA_A		(1<<13)	/* 0 disable */
+#define CCTRL4331_BT_SHD0_ON_GPIO4	(1<<16)	/* enable bt_shd0 at gpio4 */
+#define CCTRL4331_BT_SHD1_ON_GPIO5	(1<<17)	/* enable bt_shd1 at gpio5 */
+#define CCTRL4331_EXTPA_ANA_EN		(1<<24)	/* 0 ext pa disable, 1 ext pa enabled */
+
+/* 4331 Chip specific ChipStatus register bits */
+#define	CST4331_XTAL_FREQ		0x00000001	/* crystal frequency 20/40Mhz */
+#define	CST4331_SPROM_OTP_SEL_MASK	0x00000006
+#define	CST4331_SPROM_OTP_SEL_SHIFT	1
+#define	CST4331_SPROM_PRESENT		0x00000002
+#define	CST4331_OTP_PRESENT		0x00000004
+#define	CST4331_LDO_RF			0x00000008
+#define	CST4331_LDO_PAR			0x00000010
+
+/* 4315 resource */
+#define RES4315_CBUCK_LPOM		1	/* 0x00000002 */
+#define RES4315_CBUCK_BURST		2	/* 0x00000004 */
+#define RES4315_CBUCK_PWM		3	/* 0x00000008 */
+#define RES4315_CLDO_PU			4	/* 0x00000010 */
+#define RES4315_PALDO_PU		5	/* 0x00000020 */
+#define RES4315_ILP_REQUEST		6	/* 0x00000040 */
+#define RES4315_LNLDO1_PU		9	/* 0x00000200 */
+#define RES4315_OTP_PU			10	/* 0x00000400 */
+#define RES4315_LNLDO2_PU		12	/* 0x00001000 */
+#define RES4315_XTAL_PU			13	/* 0x00002000 */
+#define RES4315_ALP_AVAIL		14	/* 0x00004000 */
+#define RES4315_RX_PWRSW_PU		15	/* 0x00008000 */
+#define RES4315_TX_PWRSW_PU		16	/* 0x00010000 */
+#define RES4315_RFPLL_PWRSW_PU		17	/* 0x00020000 */
+#define RES4315_LOGEN_PWRSW_PU		18	/* 0x00040000 */
+#define RES4315_AFE_PWRSW_PU		19	/* 0x00080000 */
+#define RES4315_BBPLL_PWRSW_PU		20	/* 0x00100000 */
+#define RES4315_HT_AVAIL		21	/* 0x00200000 */
+
+/* 4315 chip-specific ChipStatus register bits */
+#define CST4315_SPROM_OTP_SEL_MASK	0x00000003	/* gpio [7:6], SDIO CIS selection */
+#define CST4315_DEFCIS_SEL		0x00000000	/* use default CIS, OTP is powered up */
+#define CST4315_SPROM_SEL		0x00000001	/* use SPROM, OTP is powered up */
+#define CST4315_OTP_SEL			0x00000002	/* use OTP, OTP is powered up */
+#define CST4315_OTP_PWRDN		0x00000003	/* use SPROM, OTP is powered down */
+#define CST4315_SDIO_MODE		0x00000004	/* gpio [8], sdio/usb mode */
+#define CST4315_RCAL_VALID		0x00000008
+#define CST4315_RCAL_VALUE_MASK		0x000001f0
+#define CST4315_RCAL_VALUE_SHIFT	4
+#define CST4315_PALDO_EXTPNP		0x00000200	/* PALDO is configured with external PNP */
+#define CST4315_CBUCK_MODE_MASK		0x00000c00
+#define CST4315_CBUCK_MODE_BURST	0x00000400
+#define CST4315_CBUCK_MODE_LPBURST	0x00000c00
+
+/* 4319 resources */
+#define RES4319_CBUCK_LPOM		1	/* 0x00000002 */
+#define RES4319_CBUCK_BURST		2	/* 0x00000004 */
+#define RES4319_CBUCK_PWM		3	/* 0x00000008 */
+#define RES4319_CLDO_PU			4	/* 0x00000010 */
+#define RES4319_PALDO_PU		5	/* 0x00000020 */
+#define RES4319_ILP_REQUEST		6	/* 0x00000040 */
+#define RES4319_LNLDO1_PU		9	/* 0x00000200 */
+#define RES4319_OTP_PU			10	/* 0x00000400 */
+#define RES4319_LNLDO2_PU		12	/* 0x00001000 */
+#define RES4319_XTAL_PU			13	/* 0x00002000 */
+#define RES4319_ALP_AVAIL		14	/* 0x00004000 */
+#define RES4319_RX_PWRSW_PU		15	/* 0x00008000 */
+#define RES4319_TX_PWRSW_PU		16	/* 0x00010000 */
+#define RES4319_RFPLL_PWRSW_PU		17	/* 0x00020000 */
+#define RES4319_LOGEN_PWRSW_PU		18	/* 0x00040000 */
+#define RES4319_AFE_PWRSW_PU		19	/* 0x00080000 */
+#define RES4319_BBPLL_PWRSW_PU		20	/* 0x00100000 */
+#define RES4319_HT_AVAIL		21	/* 0x00200000 */
+
+/* 4319 chip-specific ChipStatus register bits */
+#define	CST4319_SPI_CPULESSUSB		0x00000001
+#define	CST4319_SPI_CLK_POL		0x00000002
+#define	CST4319_SPI_CLK_PH		0x00000008
+#define	CST4319_SPROM_OTP_SEL_MASK	0x000000c0	/* gpio [7:6], SDIO CIS selection */
+#define	CST4319_SPROM_OTP_SEL_SHIFT	6
+#define	CST4319_DEFCIS_SEL		0x00000000	/* use default CIS, OTP is powered up */
+#define	CST4319_SPROM_SEL		0x00000040	/* use SPROM, OTP is powered up */
+#define	CST4319_OTP_SEL			0x00000080      /* use OTP, OTP is powered up */
+#define	CST4319_OTP_PWRDN		0x000000c0      /* use SPROM, OTP is powered down */
+#define	CST4319_SDIO_USB_MODE		0x00000100	/* gpio [8], sdio/usb mode */
+#define	CST4319_REMAP_SEL_MASK		0x00000600
+#define	CST4319_ILPDIV_EN		0x00000800
+#define	CST4319_XTAL_PD_POL		0x00001000
+#define	CST4319_LPO_SEL			0x00002000
+#define	CST4319_RES_INIT_MODE		0x0000c000
+#define	CST4319_PALDO_EXTPNP		0x00010000	/* PALDO is configured with external PNP */
+#define	CST4319_CBUCK_MODE_MASK		0x00060000
+#define CST4319_CBUCK_MODE_BURST	0x00020000
+#define CST4319_CBUCK_MODE_LPBURST	0x00060000
+#define	CST4319_RCAL_VALID		0x01000000
+#define	CST4319_RCAL_VALUE_MASK		0x3e000000
+#define	CST4319_RCAL_VALUE_SHIFT	25
+
+#define PMU1_PLL0_CHIPCTL0		0
+#define PMU1_PLL0_CHIPCTL1		1
+#define PMU1_PLL0_CHIPCTL2		2
+#define CCTL_4319USB_XTAL_SEL_MASK	0x00180000
+#define CCTL_4319USB_XTAL_SEL_SHIFT	19
+#define CCTL_4319USB_48MHZ_PLL_SEL	1
+#define CCTL_4319USB_24MHZ_PLL_SEL	2
+
+/* PMU resources for 4336 */
+#define	RES4336_CBUCK_LPOM		0
+#define	RES4336_CBUCK_BURST		1
+#define	RES4336_CBUCK_LP_PWM		2
+#define	RES4336_CBUCK_PWM		3
+#define	RES4336_CLDO_PU			4
+#define	RES4336_DIS_INT_RESET_PD	5
+#define	RES4336_ILP_REQUEST		6
+#define	RES4336_LNLDO_PU		7
+#define	RES4336_LDO3P3_PU		8
+#define	RES4336_OTP_PU			9
+#define	RES4336_XTAL_PU			10
+#define	RES4336_ALP_AVAIL		11
+#define	RES4336_RADIO_PU		12
+#define	RES4336_BG_PU			13
+#define	RES4336_VREG1p4_PU_PU		14
+#define	RES4336_AFE_PWRSW_PU		15
+#define	RES4336_RX_PWRSW_PU		16
+#define	RES4336_TX_PWRSW_PU		17
+#define	RES4336_BB_PWRSW_PU		18
+#define	RES4336_SYNTH_PWRSW_PU		19
+#define	RES4336_MISC_PWRSW_PU		20
+#define	RES4336_LOGEN_PWRSW_PU		21
+#define	RES4336_BBPLL_PWRSW_PU		22
+#define	RES4336_MACPHY_CLKAVAIL		23
+#define	RES4336_HT_AVAIL		24
+#define	RES4336_RSVD			25
+
+/* 4336 chip-specific ChipStatus register bits */
+#define	CST4336_SPI_MODE_MASK		0x00000001
+#define	CST4336_SPROM_PRESENT		0x00000002
+#define	CST4336_OTP_PRESENT		0x00000004
+#define	CST4336_ARMREMAP_0		0x00000008
+#define	CST4336_ILPDIV_EN_MASK		0x00000010
+#define	CST4336_ILPDIV_EN_SHIFT		4
+#define	CST4336_XTAL_PD_POL_MASK	0x00000020
+#define	CST4336_XTAL_PD_POL_SHIFT	5
+#define	CST4336_LPO_SEL_MASK		0x00000040
+#define	CST4336_LPO_SEL_SHIFT		6
+#define	CST4336_RES_INIT_MODE_MASK	0x00000180
+#define	CST4336_RES_INIT_MODE_SHIFT	7
+#define	CST4336_CBUCK_MODE_MASK		0x00000600
+#define	CST4336_CBUCK_MODE_SHIFT	9
+
+/* 4336 Chip specific PMU ChipControl register bits */
+#define PCTL_4336_SERIAL_ENAB	(1  << 24)
+
+/* 4330 resources */
+#define	RES4330_CBUCK_LPOM		0
+#define	RES4330_CBUCK_BURST		1
+#define	RES4330_CBUCK_LP_PWM		2
+#define	RES4330_CBUCK_PWM		3
+#define	RES4330_CLDO_PU			4
+#define	RES4330_DIS_INT_RESET_PD	5
+#define	RES4330_ILP_REQUEST		6
+#define	RES4330_LNLDO_PU		7
+#define	RES4330_LDO3P3_PU		8
+#define	RES4330_OTP_PU			9
+#define	RES4330_XTAL_PU			10
+#define	RES4330_ALP_AVAIL		11
+#define	RES4330_RADIO_PU		12
+#define	RES4330_BG_PU			13
+#define	RES4330_VREG1p4_PU_PU		14
+#define	RES4330_AFE_PWRSW_PU		15
+#define	RES4330_RX_PWRSW_PU		16
+#define	RES4330_TX_PWRSW_PU		17
+#define	RES4330_BB_PWRSW_PU		18
+#define	RES4330_SYNTH_PWRSW_PU		19
+#define	RES4330_MISC_PWRSW_PU		20
+#define	RES4330_LOGEN_PWRSW_PU		21
+#define	RES4330_BBPLL_PWRSW_PU		22
+#define	RES4330_MACPHY_CLKAVAIL		23
+#define	RES4330_HT_AVAIL		24
+#define	RES4330_5gRX_PWRSW_PU		25
+#define	RES4330_5gTX_PWRSW_PU		26
+#define	RES4330_5g_LOGEN_PWRSW_PU	27
+
+/* 4330 chip-specific ChipStatus register bits */
+#define CST4330_CHIPMODE_SDIOD(cs)	(((cs) & 0x7) < 6)	/* SDIO || gSPI */
+#define CST4330_CHIPMODE_USB20D(cs)	(((cs) & 0x7) >= 6)	/* USB || USBDA */
+#define CST4330_CHIPMODE_SDIO(cs)	(((cs) & 0x4) == 0)	/* SDIO */
+#define CST4330_CHIPMODE_GSPI(cs)	(((cs) & 0x6) == 4)	/* gSPI */
+#define CST4330_CHIPMODE_USB(cs)	(((cs) & 0x7) == 6)	/* USB packet-oriented */
+#define CST4330_CHIPMODE_USBDA(cs)	(((cs) & 0x7) == 7)	/* USB Direct Access */
+#define	CST4330_OTP_PRESENT		0x00000010
+#define	CST4330_LPO_AUTODET_EN		0x00000020
+#define	CST4330_ARMREMAP_0		0x00000040
+#define	CST4330_SPROM_PRESENT		0x00000080	/* takes priority over OTP if both set */
+#define	CST4330_ILPDIV_EN		0x00000100
+#define	CST4330_LPO_SEL			0x00000200
+#define	CST4330_RES_INIT_MODE_SHIFT	10
+#define	CST4330_RES_INIT_MODE_MASK	0x00000c00
+#define CST4330_CBUCK_MODE_SHIFT	12
+#define CST4330_CBUCK_MODE_MASK		0x00003000
+#define	CST4330_CBUCK_POWER_OK		0x00004000
+#define	CST4330_BB_PLL_LOCKED		0x00008000
+#define SOCDEVRAM_BP_ADDR		0x1E000000
+#define SOCDEVRAM_ARM_ADDR		0x00800000
+
+/* 4330 Chip specific PMU ChipControl register bits */
+#define PCTL_4330_SERIAL_ENAB	(1  << 24)
+
+/* 4330 Chip specific ChipControl register bits */
+#define CCTRL_4330_GPIO_SEL		0x00000001    /* 1=select GPIOs to be muxed out */
+#define CCTRL_4330_ERCX_SEL		0x00000002    /* 1=select ERCX BT coex to be muxed out */
+#define CCTRL_4330_SDIO_HOST_WAKE	0x00000004    /* SDIO: 1=configure GPIO0 for host wake */
+#define CCTRL_4330_JTAG_DISABLE	0x00000008    /* 1=disable JTAG interface on mux'd pins */
+
+#define PMU_VREG0_ADDR				0
+#define PMU_VREG0_DISABLE_PULLD_BT_SHIFT	2
+#define PMU_VREG0_DISABLE_PULLD_WL_SHIFT	3
+
+#define PMU_VREG4_ADDR			4
+
+#define PMU_VREG4_CLDO_PWM_SHIFT	4
+#define PMU_VREG4_CLDO_PWM_MASK		0x7
+
+#define PMU_VREG4_LPLDO1_SHIFT		15
+#define PMU_VREG4_LPLDO1_MASK		0x7
+#define PMU_VREG4_LPLDO1_1p20V		0
+#define PMU_VREG4_LPLDO1_1p15V		1
+#define PMU_VREG4_LPLDO1_1p10V		2
+#define PMU_VREG4_LPLDO1_1p25V		3
+#define PMU_VREG4_LPLDO1_1p05V		4
+#define PMU_VREG4_LPLDO1_1p00V		5
+#define PMU_VREG4_LPLDO1_0p95V		6
+#define PMU_VREG4_LPLDO1_0p90V		7
+
+/* 4350/4345 VREG4 settings */
+#define PMU4350_VREG4_LPLDO1_1p10V	0
+#define PMU4350_VREG4_LPLDO1_1p15V	1
+#define PMU4350_VREG4_LPLDO1_1p21V	2
+#define PMU4350_VREG4_LPLDO1_1p24V	3
+#define PMU4350_VREG4_LPLDO1_0p90V	4
+#define PMU4350_VREG4_LPLDO1_0p96V	5
+#define PMU4350_VREG4_LPLDO1_1p01V	6
+#define PMU4350_VREG4_LPLDO1_1p04V	7
+
+#define PMU_VREG4_LPLDO2_LVM_SHIFT	18
+#define PMU_VREG4_LPLDO2_LVM_MASK	0x7
+#define PMU_VREG4_LPLDO2_HVM_SHIFT	21
+#define PMU_VREG4_LPLDO2_HVM_MASK	0x7
+#define PMU_VREG4_LPLDO2_LVM_HVM_MASK	0x3f
+#define PMU_VREG4_LPLDO2_1p00V		0
+#define PMU_VREG4_LPLDO2_1p15V		1
+#define PMU_VREG4_LPLDO2_1p20V		2
+#define PMU_VREG4_LPLDO2_1p10V		3
+#define PMU_VREG4_LPLDO2_0p90V		4	/* 4 - 7 is 0.90V */
+
+#define PMU_VREG4_HSICLDO_BYPASS_SHIFT	27
+#define PMU_VREG4_HSICLDO_BYPASS_MASK	0x1
+
+#define PMU_VREG5_ADDR			5
+#define PMU_VREG5_HSICAVDD_PD_SHIFT	6
+#define PMU_VREG5_HSICAVDD_PD_MASK	0x1
+#define PMU_VREG5_HSICDVDD_PD_SHIFT	11
+#define PMU_VREG5_HSICDVDD_PD_MASK	0x1
+
+/* 4334 resources */
+#define RES4334_LPLDO_PU		0
+#define RES4334_RESET_PULLDN_DIS	1
+#define RES4334_PMU_BG_PU		2
+#define RES4334_HSIC_LDO_PU		3
+#define RES4334_CBUCK_LPOM_PU		4
+#define RES4334_CBUCK_PFM_PU		5
+#define RES4334_CLDO_PU			6
+#define RES4334_LPLDO2_LVM		7
+#define RES4334_LNLDO_PU		8
+#define RES4334_LDO3P3_PU		9
+#define RES4334_OTP_PU			10
+#define RES4334_XTAL_PU			11
+#define RES4334_WL_PWRSW_PU		12
+#define RES4334_LQ_AVAIL		13
+#define RES4334_LOGIC_RET		14
+#define RES4334_MEM_SLEEP		15
+#define RES4334_MACPHY_RET		16
+#define RES4334_WL_CORE_READY		17
+#define RES4334_ILP_REQ			18
+#define RES4334_ALP_AVAIL		19
+#define RES4334_MISC_PWRSW_PU		20
+#define RES4334_SYNTH_PWRSW_PU		21
+#define RES4334_RX_PWRSW_PU		22
+#define RES4334_RADIO_PU		23
+#define RES4334_WL_PMU_PU		24
+#define RES4334_VCO_LDO_PU		25
+#define RES4334_AFE_LDO_PU		26
+#define RES4334_RX_LDO_PU		27
+#define RES4334_TX_LDO_PU		28
+#define RES4334_HT_AVAIL		29
+#define RES4334_MACPHY_CLK_AVAIL	30
+
+/* 4334 chip-specific ChipStatus register bits */
+#define CST4334_CHIPMODE_MASK		7
+#define CST4334_SDIO_MODE		0x00000000
+#define CST4334_SPI_MODE		0x00000004
+#define CST4334_HSIC_MODE		0x00000006
+#define CST4334_BLUSB_MODE		0x00000007
+#define CST4334_CHIPMODE_HSIC(cs)	(((cs) & CST4334_CHIPMODE_MASK) == CST4334_HSIC_MODE)
+#define CST4334_OTP_PRESENT		0x00000010
+#define CST4334_LPO_AUTODET_EN		0x00000020
+#define CST4334_ARMREMAP_0		0x00000040
+#define CST4334_SPROM_PRESENT		0x00000080
+#define CST4334_ILPDIV_EN_MASK		0x00000100
+#define CST4334_ILPDIV_EN_SHIFT		8
+#define CST4334_LPO_SEL_MASK		0x00000200
+#define CST4334_LPO_SEL_SHIFT		9
+#define CST4334_RES_INIT_MODE_MASK	0x00000C00
+#define CST4334_RES_INIT_MODE_SHIFT	10
+
+/* 4334 Chip specific PMU ChipControl register bits */
+#define PCTL_4334_GPIO3_ENAB    (1  << 3)
+
+/* 4334 Chip control */
+#define CCTRL4334_PMU_WAKEUP_GPIO1	(1  << 0)
+#define CCTRL4334_PMU_WAKEUP_HSIC	(1  << 1)
+#define CCTRL4334_PMU_WAKEUP_AOS	(1  << 2)
+#define CCTRL4334_HSIC_WAKE_MODE	(1  << 3)
+#define CCTRL4334_HSIC_INBAND_GPIO1	(1  << 4)
+#define CCTRL4334_HSIC_LDO_PU		(1  << 23)
+
+/* 4334 Chip control 3 */
+#define CCTRL4334_BLOCK_EXTRNL_WAKE		(1  << 4)
+#define CCTRL4334_SAVERESTORE_FIX		(1  << 5)
+
+/* 43341 Chip control 3 */
+#define CCTRL43341_BLOCK_EXTRNL_WAKE		(1  << 13)
+#define CCTRL43341_SAVERESTORE_FIX		(1  << 14)
+#define CCTRL43341_BT_ISO_SEL			(1  << 16)
+
+/* 4334 Chip specific ChipControl1 register bits */
+#define CCTRL1_4334_GPIO_SEL		(1 << 0)    /* 1=select GPIOs to be muxed out */
+#define CCTRL1_4334_ERCX_SEL		(1 << 1)    /* 1=select ERCX BT coex to be muxed out */
+#define CCTRL1_4334_SDIO_HOST_WAKE (1 << 2)  /* SDIO: 1=configure GPIO0 for host wake */
+#define CCTRL1_4334_JTAG_DISABLE	(1 << 3)    /* 1=disable JTAG interface on mux'd pins */
+#define CCTRL1_4334_UART_ON_4_5	(1 << 28)  	/* 1=UART_TX/UART_RX muxed on GPIO_4/5 (4334B0/1) */
+
+/* 4324 Chip specific ChipControl1 register bits */
+#define CCTRL1_4324_GPIO_SEL            (1 << 0)    /* 1=select GPIOs to be muxed out */
+#define CCTRL1_4324_SDIO_HOST_WAKE (1 << 2)  /* SDIO: 1=configure GPIO0 for host wake */
+
+/* 43143 chip-specific ChipStatus register bits based on Confluence documentation */
+/* register contains strap values sampled during POR */
+#define CST43143_REMAP_TO_ROM	 (3 << 0)    /* 00=Boot SRAM, 01=Boot ROM, 10=Boot SFLASH */
+#define CST43143_SDIO_EN	 (1 << 2)    /* 0 = USB Enab, SDIO pins are GPIO or I2S */
+#define CST43143_SDIO_ISO	 (1 << 3)    /* 1 = SDIO isolated */
+#define CST43143_USB_CPU_LESS	 (1 << 4)   /* 1 = CPULess mode Enabled */
+#define CST43143_CBUCK_MODE	 (3 << 6)   /* Indicates what controller mode CBUCK is in */
+#define CST43143_POK_CBUCK	 (1 << 8)   /* 1 = 1.2V CBUCK voltage ready */
+#define CST43143_PMU_OVRSPIKE	 (1 << 9)
+#define CST43143_PMU_OVRTEMP	 (0xF << 10)
+#define CST43143_SR_FLL_CAL_DONE (1 << 14)
+#define CST43143_USB_PLL_LOCKDET (1 << 15)
+#define CST43143_PMU_PLL_LOCKDET (1 << 16)
+#define CST43143_CHIPMODE_SDIOD(cs)	(((cs) & CST43143_SDIO_EN) != 0) /* SDIO */
+
+/* 43143 Chip specific ChipControl register bits */
+/* 00: SECI is disabled (JATG functional), 01: 2 wire, 10: 4 wire  */
+#define CCTRL_43143_SECI		(1<<0)
+#define CCTRL_43143_BT_LEGACY		(1<<1)
+#define CCTRL_43143_I2S_MODE		(1<<2)	/* 0: SDIO enabled */
+#define CCTRL_43143_I2S_MASTER		(1<<3)	/* 0: I2S MCLK input disabled */
+#define CCTRL_43143_I2S_FULL		(1<<4)	/* 0: I2S SDIN and SPDIF_TX inputs disabled */
+#define CCTRL_43143_GSIO		(1<<5)	/* 0: sFlash enabled */
+#define CCTRL_43143_RF_SWCTRL_MASK	(7<<6)	/* 0: disabled */
+#define CCTRL_43143_RF_SWCTRL_0		(1<<6)
+#define CCTRL_43143_RF_SWCTRL_1		(2<<6)
+#define CCTRL_43143_RF_SWCTRL_2		(4<<6)
+#define CCTRL_43143_RF_XSWCTRL		(1<<9)	/* 0: UART enabled */
+#define CCTRL_43143_HOST_WAKE0		(1<<11)	/* 1: SDIO separate interrupt output from GPIO4 */
+#define CCTRL_43143_HOST_WAKE1		(1<<12)	/* 1: SDIO separate interrupt output from GPIO16 */
+
+/* 43143 resources, based on pmu_params.xls V1.19 */
+#define RES43143_EXT_SWITCHER_PWM	0	/* 0x00001 */
+#define RES43143_XTAL_PU		1	/* 0x00002 */
+#define RES43143_ILP_REQUEST		2	/* 0x00004 */
+#define RES43143_ALP_AVAIL		3	/* 0x00008 */
+#define RES43143_WL_CORE_READY		4	/* 0x00010 */
+#define RES43143_BBPLL_PWRSW_PU		5	/* 0x00020 */
+#define RES43143_HT_AVAIL		6	/* 0x00040 */
+#define RES43143_RADIO_PU		7	/* 0x00080 */
+#define RES43143_MACPHY_CLK_AVAIL	8	/* 0x00100 */
+#define RES43143_OTP_PU			9	/* 0x00200 */
+#define RES43143_LQ_AVAIL		10	/* 0x00400 */
+
+#define PMU43143_XTAL_CORE_SIZE_MASK	0x3F
+
+/* 4313 resources */
+#define	RES4313_BB_PU_RSRC		0
+#define	RES4313_ILP_REQ_RSRC		1
+#define	RES4313_XTAL_PU_RSRC		2
+#define	RES4313_ALP_AVAIL_RSRC		3
+#define	RES4313_RADIO_PU_RSRC		4
+#define	RES4313_BG_PU_RSRC		5
+#define	RES4313_VREG1P4_PU_RSRC		6
+#define	RES4313_AFE_PWRSW_RSRC		7
+#define	RES4313_RX_PWRSW_RSRC		8
+#define	RES4313_TX_PWRSW_RSRC		9
+#define	RES4313_BB_PWRSW_RSRC		10
+#define	RES4313_SYNTH_PWRSW_RSRC	11
+#define	RES4313_MISC_PWRSW_RSRC		12
+#define	RES4313_BB_PLL_PWRSW_RSRC	13
+#define	RES4313_HT_AVAIL_RSRC		14
+#define	RES4313_MACPHY_CLK_AVAIL_RSRC	15
+
+/* 4313 chip-specific ChipStatus register bits */
+#define	CST4313_SPROM_PRESENT			1
+#define	CST4313_OTP_PRESENT			2
+#define	CST4313_SPROM_OTP_SEL_MASK		0x00000002
+#define	CST4313_SPROM_OTP_SEL_SHIFT		0
+
+/* 4313 Chip specific ChipControl register bits */
+#define CCTRL_4313_12MA_LED_DRIVE    0x00000007    /* 12 mA drive strengh for later 4313 */
+
+/* PMU respources for 4314 */
+#define RES4314_LPLDO_PU		0
+#define RES4314_PMU_SLEEP_DIS		1
+#define RES4314_PMU_BG_PU		2
+#define RES4314_CBUCK_LPOM_PU		3
+#define RES4314_CBUCK_PFM_PU		4
+#define RES4314_CLDO_PU			5
+#define RES4314_LPLDO2_LVM		6
+#define RES4314_WL_PMU_PU		7
+#define RES4314_LNLDO_PU		8
+#define RES4314_LDO3P3_PU		9
+#define RES4314_OTP_PU			10
+#define RES4314_XTAL_PU			11
+#define RES4314_WL_PWRSW_PU		12
+#define RES4314_LQ_AVAIL		13
+#define RES4314_LOGIC_RET		14
+#define RES4314_MEM_SLEEP		15
+#define RES4314_MACPHY_RET		16
+#define RES4314_WL_CORE_READY		17
+#define RES4314_ILP_REQ			18
+#define RES4314_ALP_AVAIL		19
+#define RES4314_MISC_PWRSW_PU		20
+#define RES4314_SYNTH_PWRSW_PU		21
+#define RES4314_RX_PWRSW_PU		22
+#define RES4314_RADIO_PU		23
+#define RES4314_VCO_LDO_PU		24
+#define RES4314_AFE_LDO_PU		25
+#define RES4314_RX_LDO_PU		26
+#define RES4314_TX_LDO_PU		27
+#define RES4314_HT_AVAIL		28
+#define RES4314_MACPHY_CLK_AVAIL	29
+
+/* 4314 chip-specific ChipStatus register bits */
+#define CST4314_OTP_ENABLED		0x00200000
+
+/* 43228 resources */
+#define RES43228_NOT_USED		0
+#define RES43228_ILP_REQUEST		1
+#define RES43228_XTAL_PU		2
+#define RES43228_ALP_AVAIL		3
+#define RES43228_PLL_EN			4
+#define RES43228_HT_PHY_AVAIL		5
+
+/* 43228 chipstatus  reg bits */
+#define CST43228_ILP_DIV_EN		0x1
+#define	CST43228_OTP_PRESENT		0x2
+#define	CST43228_SERDES_REFCLK_PADSEL	0x4
+#define	CST43228_SDIO_MODE		0x8
+#define	CST43228_SDIO_OTP_PRESENT	0x10
+#define	CST43228_SDIO_RESET		0x20
+
+/* 4706 chipstatus reg bits */
+#define	CST4706_PKG_OPTION		(1<<0) /* 0: full-featured package 1: low-cost package */
+#define	CST4706_SFLASH_PRESENT	(1<<1) /* 0: parallel, 1: serial flash is present */
+#define	CST4706_SFLASH_TYPE		(1<<2) /* 0: 8b-p/ST-s flash, 1: 16b-p/Atmal-s flash */
+#define	CST4706_MIPS_BENDIAN	(1<<3) /* 0: little,  1: big endian */
+#define	CST4706_PCIE1_DISABLE	(1<<5) /* PCIE1 enable strap pin */
+
+/* 4706 flashstrconfig reg bits */
+#define FLSTRCF4706_MASK		0x000000ff
+#define FLSTRCF4706_SF1			0x00000001	/* 2nd serial flash present */
+#define FLSTRCF4706_PF1			0x00000002	/* 2nd parallel flash present */
+#define FLSTRCF4706_SF1_TYPE	0x00000004	/* 2nd serial flash type : 0 : ST, 1 : Atmel */
+#define FLSTRCF4706_NF1			0x00000008	/* 2nd NAND flash present */
+#define FLSTRCF4706_1ST_MADDR_SEG_MASK		0x000000f0	/* Valid value mask */
+#define FLSTRCF4706_1ST_MADDR_SEG_4MB		0x00000010	/* 4MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_8MB		0x00000020	/* 8MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_16MB		0x00000030	/* 16MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_32MB		0x00000040	/* 32MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_64MB		0x00000050	/* 64MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_128MB		0x00000060	/* 128MB */
+#define FLSTRCF4706_1ST_MADDR_SEG_256MB		0x00000070	/* 256MB */
+
+/* 4360 Chip specific ChipControl register bits */
+#define CCTRL4360_I2C_MODE			(1 << 0)
+#define CCTRL4360_UART_MODE			(1 << 1)
+#define CCTRL4360_SECI_MODE			(1 << 2)
+#define CCTRL4360_BTSWCTRL_MODE			(1 << 3)
+#define CCTRL4360_DISCRETE_FEMCTRL_MODE		(1 << 4)
+#define CCTRL4360_DIGITAL_PACTRL_MODE		(1 << 5)
+#define CCTRL4360_BTSWCTRL_AND_DIGPA_PRESENT	(1 << 6)
+#define CCTRL4360_EXTRA_GPIO_MODE		(1 << 7)
+#define CCTRL4360_EXTRA_FEMCTRL_MODE		(1 << 8)
+#define CCTRL4360_BT_LGCY_MODE			(1 << 9)
+#define CCTRL4360_CORE2FEMCTRL4_ON		(1 << 21)
+#define CCTRL4360_SECI_ON_GPIO01		(1 << 24)
+
+/* 4360 Chip specific Regulator Control register bits */
+#define RCTRL4360_RFLDO_PWR_DOWN		(1 << 1)
+
+/* 4360 PMU resources and chip status bits */
+#define RES4360_REGULATOR          0
+#define RES4360_ILP_AVAIL          1
+#define RES4360_ILP_REQ            2
+#define RES4360_XTAL_LDO_PU        3
+#define RES4360_XTAL_PU            4
+#define RES4360_ALP_AVAIL          5
+#define RES4360_BBPLLPWRSW_PU      6
+#define RES4360_HT_AVAIL           7
+#define RES4360_OTP_PU             8
+
+#define CST4360_XTAL_40MZ                  0x00000001
+#define CST4360_SFLASH                     0x00000002
+#define CST4360_SPROM_PRESENT              0x00000004
+#define CST4360_SFLASH_TYPE                0x00000004
+#define CST4360_OTP_ENABLED                0x00000008
+#define CST4360_REMAP_ROM                  0x00000010
+#define CST4360_RSRC_INIT_MODE_MASK        0x00000060
+#define CST4360_RSRC_INIT_MODE_SHIFT       5
+#define CST4360_ILP_DIVEN                  0x00000080
+#define CST4360_MODE_USB                   0x00000100
+#define CST4360_SPROM_SIZE_MASK            0x00000600
+#define CST4360_SPROM_SIZE_SHIFT           9
+#define CST4360_BBPLL_LOCK                 0x00000800
+#define CST4360_AVBBPLL_LOCK               0x00001000
+#define CST4360_USBBBPLL_LOCK              0x00002000
+#define CST4360_RSRC_INIT_MODE(cs)	((cs & CST4360_RSRC_INIT_MODE_MASK) >> \
+					CST4360_RSRC_INIT_MODE_SHIFT)
+
+#define CCTRL_4360_UART_SEL	0x2
+#define CST4360_RSRC_INIT_MODE(cs)	((cs & CST4360_RSRC_INIT_MODE_MASK) >> \
+					CST4360_RSRC_INIT_MODE_SHIFT)
+
+
+/* 43602 PMU resources based on pmu_params.xls version v0.95 */
+#define RES43602_LPLDO_PU		0
+#define RES43602_REGULATOR		1
+#define RES43602_PMU_SLEEP		2
+#define RES43602_RSVD_3			3
+#define RES43602_XTALLDO_PU		4
+#define RES43602_SERDES_PU		5
+#define RES43602_BBPLL_PWRSW_PU		6
+#define RES43602_SR_CLK_START		7
+#define RES43602_SR_PHY_PWRSW		8
+#define RES43602_SR_SUBCORE_PWRSW	9
+#define RES43602_XTAL_PU		10
+#define	RES43602_PERST_OVR		11
+#define RES43602_SR_CLK_STABLE		12
+#define RES43602_SR_SAVE_RESTORE	13
+#define RES43602_SR_SLEEP		14
+#define RES43602_LQ_START		15
+#define RES43602_LQ_AVAIL		16
+#define RES43602_WL_CORE_RDY		17
+#define RES43602_ILP_REQ		18
+#define RES43602_ALP_AVAIL		19
+#define RES43602_RADIO_PU		20
+#define RES43602_RFLDO_PU		21
+#define RES43602_HT_START		22
+#define RES43602_HT_AVAIL		23
+#define RES43602_MACPHY_CLKAVAIL	24
+#define RES43602_PARLDO_PU		25
+#define RES43602_RSVD_26		26
+
+/* 43602 chip status bits */
+#define CST43602_SPROM_PRESENT             (1<<1)
+#define CST43602_SPROM_SIZE                (1<<10) /* 0 = 16K, 1 = 4K */
+#define CST43602_BBPLL_LOCK                (1<<11)
+#define CST43602_RF_LDO_OUT_OK             (1<<15) /* RF LDO output OK */
+
+#define PMU43602_CC1_GPIO12_OVRD           (1<<28) /* GPIO12 override */
+
+#define PMU43602_CC2_PCIE_CLKREQ_L_WAKE_EN (1<<1)  /* creates gated_pcie_wake, pmu_wakeup logic */
+#define PMU43602_CC2_PCIE_PERST_L_WAKE_EN  (1<<2)  /* creates gated_pcie_wake, pmu_wakeup logic */
+#define PMU43602_CC2_ENABLE_L2REFCLKPAD_PWRDWN (1<<3)
+#define PMU43602_CC2_PMU_WAKE_ALP_AVAIL_EN (1<<5)  /* enable pmu_wakeup to request for ALP_AVAIL */
+#define PMU43602_CC2_PERST_L_EXTEND_EN     (1<<9)  /* extend perst_l until rsc PERST_OVR comes up */
+#define PMU43602_CC2_FORCE_EXT_LPO         (1<<19) /* 1=ext LPO clock is the final LPO clock */
+#define PMU43602_CC2_XTAL32_SEL            (1<<30) /* 0=ext_clock, 1=xtal */
+
+#define CC_SR1_43602_SR_ASM_ADDR	(0x0)
+
+/* PLL CTL register values for open loop, used during S/R operation */
+#define PMU43602_PLL_CTL6_VAL		0x68000528
+#define PMU43602_PLL_CTL7_VAL		0x6
+
+#define PMU43602_CC3_ARMCR4_DBG_CLK	(1 << 29)
+
+/* 4349 related */
+#define RES4349_LPLDO_PU			0
+#define RES4349_BG_PU				1
+#define RES4349_PMU_SLEEP			2
+#define RES4349_PALDO3P3_PU			3
+#define RES4349_CBUCK_LPOM_PU		4
+#define RES4349_CBUCK_PFM_PU		5
+#define RES4349_COLD_START_WAIT		6
+#define RES4349_RSVD_7				7
+#define RES4349_LNLDO_PU			8
+#define RES4349_XTALLDO_PU			9
+#define RES4349_LDO3P3_PU			10
+#define RES4349_OTP_PU				11
+#define RES4349_XTAL_PU				12
+#define RES4349_SR_CLK_START		13
+#define RES4349_LQ_AVAIL			14
+#define RES4349_LQ_START			15
+#define RES4349_PERST_OVR			16
+#define RES4349_WL_CORE_RDY			17
+#define RES4349_ILP_REQ				18
+#define RES4349_ALP_AVAIL			19
+#define RES4349_MINI_PMU			20
+#define RES4349_RADIO_PU			21
+#define RES4349_SR_CLK_STABLE		22
+#define RES4349_SR_SAVE_RESTORE		23
+#define RES4349_SR_PHY_PWRSW		24
+#define RES4349_SR_VDDM_PWRSW		25
+#define RES4349_SR_SUBCORE_PWRSW	26
+#define RES4349_SR_SLEEP			27
+#define RES4349_HT_START			28
+#define RES4349_HT_AVAIL			29
+#define RES4349_MACPHY_CLKAVAIL		30
+
+#define CR4_4349_RAM_BASE			(0x180000)
+#define CC4_4349_SR_ASM_ADDR		(0x48)
+
+#define CST4349_CHIPMODE_SDIOD(cs)	(((cs) & (1 << 6)) != 0)	/* SDIO */
+#define CST4349_CHIPMODE_PCIE(cs)	(((cs) & (1 << 7)) != 0)	/* PCIE */
+
+#define CST4349_SPROM_PRESENT		0x00000010
+
+
+/* 43430 PMU resources based on pmu_params.xls */
+#define RES43430_LPLDO_PU				0
+#define RES43430_BG_PU					1
+#define RES43430_PMU_SLEEP				2
+#define RES43430_RSVD_3					3
+#define RES43430_CBUCK_LPOM_PU			4
+#define RES43430_CBUCK_PFM_PU			5
+#define RES43430_COLD_START_WAIT		6
+#define RES43430_RSVD_7					7
+#define RES43430_LNLDO_PU				8
+#define RES43430_RSVD_9					9
+#define RES43430_LDO3P3_PU				10
+#define RES43430_OTP_PU					11
+#define RES43430_XTAL_PU				12
+#define RES43430_SR_CLK_START			13
+#define RES43430_LQ_AVAIL				14
+#define RES43430_LQ_START				15
+#define RES43430_RSVD_16				16
+#define RES43430_WL_CORE_RDY			17
+#define RES43430_ILP_REQ				18
+#define RES43430_ALP_AVAIL				19
+#define RES43430_MINI_PMU				20
+#define RES43430_RADIO_PU				21
+#define RES43430_SR_CLK_STABLE			22
+#define RES43430_SR_SAVE_RESTORE		23
+#define RES43430_SR_PHY_PWRSW			24
+#define RES43430_SR_VDDM_PWRSW			25
+#define RES43430_SR_SUBCORE_PWRSW		26
+#define RES43430_SR_SLEEP				27
+#define RES43430_HT_START				28
+#define RES43430_HT_AVAIL				29
+#define RES43430_MACPHY_CLK_AVAIL		30
+
+/* 43430 chip status bits */
+#define CST43430_SDIO_MODE				0x00000001
+#define CST43430_GSPI_MODE				0x00000002
+#define CST43430_RSRC_INIT_MODE_0		0x00000080
+#define CST43430_RSRC_INIT_MODE_1		0x00000100
+#define CST43430_SEL0_SDIO				0x00000200
+#define CST43430_SEL1_SDIO				0x00000400
+#define CST43430_SEL2_SDIO				0x00000800
+#define CST43430_BBPLL_LOCKED			0x00001000
+#define CST43430_DBG_INST_DETECT		0x00004000
+#define CST43430_CLB2WL_BT_READY		0x00020000
+#define CST43430_JTAG_MODE				0x00100000
+#define CST43430_HOST_IFACE				0x00400000
+#define CST43430_TRIM_EN				0x00800000
+#define CST43430_DIN_PACKAGE_OPTION		0x10000000
+
+/* defines to detect active host interface in use */
+#define CHIP_HOSTIF_PCIEMODE	0x1
+#define CHIP_HOSTIF_USBMODE	0x2
+#define CHIP_HOSTIF_SDIOMODE	0x4
+#define CHIP_HOSTIF_PCIE(sih)	(si_chip_hostif(sih) == CHIP_HOSTIF_PCIEMODE)
+#define CHIP_HOSTIF_USB(sih)	(si_chip_hostif(sih) == CHIP_HOSTIF_USBMODE)
+#define CHIP_HOSTIF_SDIO(sih)	(si_chip_hostif(sih) == CHIP_HOSTIF_SDIOMODE)
+
+/* 4335 resources */
+#define RES4335_LPLDO_PO           0
+#define RES4335_PMU_BG_PU          1
+#define RES4335_PMU_SLEEP          2
+#define RES4335_RSVD_3             3
+#define RES4335_CBUCK_LPOM_PU		4
+#define RES4335_CBUCK_PFM_PU		5
+#define RES4335_RSVD_6             6
+#define RES4335_RSVD_7             7
+#define RES4335_LNLDO_PU           8
+#define RES4335_XTALLDO_PU         9
+#define RES4335_LDO3P3_PU			10
+#define RES4335_OTP_PU				11
+#define RES4335_XTAL_PU				12
+#define RES4335_SR_CLK_START       13
+#define RES4335_LQ_AVAIL			14
+#define RES4335_LQ_START           15
+#define RES4335_RSVD_16            16
+#define RES4335_WL_CORE_RDY        17
+#define RES4335_ILP_REQ				18
+#define RES4335_ALP_AVAIL			19
+#define RES4335_MINI_PMU           20
+#define RES4335_RADIO_PU			21
+#define RES4335_SR_CLK_STABLE		22
+#define RES4335_SR_SAVE_RESTORE		23
+#define RES4335_SR_PHY_PWRSW		24
+#define RES4335_SR_VDDM_PWRSW      25
+#define RES4335_SR_SUBCORE_PWRSW	26
+#define RES4335_SR_SLEEP           27
+#define RES4335_HT_START           28
+#define RES4335_HT_AVAIL			29
+#define RES4335_MACPHY_CLKAVAIL		30
+
+/* 4335 Chip specific ChipStatus register bits */
+#define CST4335_SPROM_MASK			0x00000020
+#define CST4335_SFLASH_MASK			0x00000040
+#define	CST4335_RES_INIT_MODE_SHIFT	7
+#define	CST4335_RES_INIT_MODE_MASK	0x00000180
+#define CST4335_CHIPMODE_MASK		0xF
+#define CST4335_CHIPMODE_SDIOD(cs)	(((cs) & (1 << 0)) != 0)	/* SDIO */
+#define CST4335_CHIPMODE_GSPI(cs)	(((cs) & (1 << 1)) != 0)	/* gSPI */
+#define CST4335_CHIPMODE_USB20D(cs)	(((cs) & (1 << 2)) != 0)	/* HSIC || USBDA */
+#define CST4335_CHIPMODE_PCIE(cs)	(((cs) & (1 << 3)) != 0)	/* PCIE */
+
+/* 4335 Chip specific ChipControl1 register bits */
+#define CCTRL1_4335_GPIO_SEL		(1 << 0)    /* 1=select GPIOs to be muxed out */
+#define CCTRL1_4335_SDIO_HOST_WAKE (1 << 2)  /* SDIO: 1=configure GPIO0 for host wake */
+
+/* 4335 Chip specific ChipControl2 register bits */
+#define CCTRL2_4335_AOSBLOCK		(1 << 30)
+#define CCTRL2_4335_PMUWAKE		(1 << 31)
+#define PATCHTBL_SIZE			(0x800)
+#define CR4_4335_RAM_BASE                    (0x180000)
+#define CR4_4345_LT_C0_RAM_BASE              (0x1b0000)
+#define CR4_4345_GE_C0_RAM_BASE              (0x198000)
+#define CR4_4349_RAM_BASE                    (0x180000)
+#define CR4_4350_RAM_BASE                    (0x180000)
+#define CR4_4360_RAM_BASE                    (0x0)
+#define CR4_43602_RAM_BASE                   (0x180000)
+
+/* 4335 chip OTP present & OTP select bits. */
+#define SPROM4335_OTP_SELECT	0x00000010
+#define SPROM4335_OTP_PRESENT	0x00000020
+
+/* 4335 GCI specific bits. */
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_PRESENT	(1 << 24)
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_TYPE	25
+#define CC4335_GCI_FUNC_SEL_PAD_SDIO	0x00707770
+
+/* SFLASH clkdev specific bits. */
+#define CC4335_SFLASH_CLKDIV_MASK	0x1F000000
+#define CC4335_SFLASH_CLKDIV_SHIFT	25
+
+/* 4335 OTP bits for SFLASH. */
+#define CC4335_SROM_OTP_SFLASH	40
+#define CC4335_SROM_OTP_SFLASH_PRESENT	0x1
+#define CC4335_SROM_OTP_SFLASH_TYPE	0x2
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_MASK	0x003C
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_SHIFT	2
+
+
+/* 4335 chip OTP present & OTP select bits. */
+#define SPROM4335_OTP_SELECT	0x00000010
+#define SPROM4335_OTP_PRESENT	0x00000020
+
+/* 4335 GCI specific bits. */
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_PRESENT	(1 << 24)
+#define CC4335_GCI_STRAP_OVERRIDE_SFLASH_TYPE	25
+#define CC4335_GCI_FUNC_SEL_PAD_SDIO	0x00707770
+
+/* SFLASH clkdev specific bits. */
+#define CC4335_SFLASH_CLKDIV_MASK	0x1F000000
+#define CC4335_SFLASH_CLKDIV_SHIFT	25
+
+/* 4335 OTP bits for SFLASH. */
+#define CC4335_SROM_OTP_SFLASH	40
+#define CC4335_SROM_OTP_SFLASH_PRESENT	0x1
+#define CC4335_SROM_OTP_SFLASH_TYPE	0x2
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_MASK	0x003C
+#define CC4335_SROM_OTP_SFLASH_CLKDIV_SHIFT	2
+
+/* 4335 resources--END */
+
+/* 4345 Chip specific ChipStatus register bits */
+#define CST4345_SPROM_MASK		0x00000020
+#define CST4345_SFLASH_MASK		0x00000040
+#define CST4345_RES_INIT_MODE_SHIFT	7
+#define CST4345_RES_INIT_MODE_MASK	0x00000180
+#define CST4345_CHIPMODE_MASK		0x4000F
+#define CST4345_CHIPMODE_SDIOD(cs)	(((cs) & (1 << 0)) != 0)	/* SDIO */
+#define CST4345_CHIPMODE_GSPI(cs)	(((cs) & (1 << 1)) != 0)	/* gSPI */
+#define CST4345_CHIPMODE_HSIC(cs)	(((cs) & (1 << 2)) != 0)	/* HSIC */
+#define CST4345_CHIPMODE_PCIE(cs)	(((cs) & (1 << 3)) != 0)	/* PCIE */
+#define CST4345_CHIPMODE_USB20D(cs)	(((cs) & (1 << 18)) != 0)	/* USBDA */
+
+/* 4350 Chipcommon ChipStatus bits */
+#define CST4350_SDIO_MODE		0x00000001
+#define CST4350_HSIC20D_MODE		0x00000002
+#define CST4350_BP_ON_HSIC_CLK		0x00000004
+#define CST4350_PCIE_MODE		0x00000008
+#define CST4350_USB20D_MODE		0x00000010
+#define CST4350_USB30D_MODE		0x00000020
+#define CST4350_SPROM_PRESENT		0x00000040
+#define CST4350_RSRC_INIT_MODE_0	0x00000080
+#define CST4350_RSRC_INIT_MODE_1	0x00000100
+#define CST4350_SEL0_SDIO		0x00000200
+#define CST4350_SEL1_SDIO		0x00000400
+#define CST4350_SDIO_PAD_MODE		0x00000800
+#define CST4350_BBPLL_LOCKED		0x00001000
+#define CST4350_USBPLL_LOCKED		0x00002000
+#define CST4350_LINE_STATE		0x0000C000
+#define CST4350_SERDES_PIPE_PLLLOCK	0x00010000
+#define CST4350_BT_READY		0x00020000
+#define CST4350_SFLASH_PRESENT		0x00040000
+#define CST4350_CPULESS_ENABLE		0x00080000
+#define CST4350_STRAP_HOST_IFC_1	0x00100000
+#define CST4350_STRAP_HOST_IFC_2	0x00200000
+#define CST4350_STRAP_HOST_IFC_3	0x00400000
+#define CST4350_RAW_SPROM_PRESENT	0x00800000
+#define CST4350_APP_CLK_SWITCH_SEL_RDBACK	0x01000000
+#define CST4350_RAW_RSRC_INIT_MODE_0	0x02000000
+#define CST4350_SDIO_PAD_VDDIO		0x04000000
+#define CST4350_GSPI_MODE		0x08000000
+#define CST4350_PACKAGE_OPTION		0xF0000000
+#define CST4350_PACKAGE_SHIFT		28
+
+/* package option for 4350 */
+#define CST4350_PACKAGE_WLCSP		0x0
+#define CST4350_PACKAGE_PCIE		0x1
+#define CST4350_PACKAGE_WLBGA		0x2
+#define CST4350_PACKAGE_DBG		0x3
+#define CST4350_PACKAGE_USB		0x4
+#define CST4350_PACKAGE_USB_HSIC	0x4
+
+#define CST4350_PKG_MODE(cs)	((cs & CST4350_PACKAGE_OPTION) >> CST4350_PACKAGE_SHIFT)
+
+#define CST4350_PKG_WLCSP(cs)		(CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_WLCSP))
+#define CST4350_PKG_PCIE(cs)		(CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_PCIE))
+#define CST4350_PKG_WLBGA(cs)		(CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_WLBGA))
+#define CST4350_PKG_USB(cs)		(CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_USB))
+#define CST4350_PKG_USB_HSIC(cs)	(CST4350_PKG_MODE(cs) == (CST4350_PACKAGE_USB_HSIC))
+
+/* 4350C0 USB PACKAGE using raw_sprom_present to indicate 40mHz xtal */
+#define CST4350_PKG_USB_40M(cs)		(cs & CST4350_RAW_SPROM_PRESENT)
+
+#define CST4350_CHIPMODE_SDIOD(cs)	(CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_SDIOD))
+#define CST4350_CHIPMODE_USB20D(cs)	((CST4350_IFC_MODE(cs)) == (CST4350_IFC_MODE_USB20D))
+#define CST4350_CHIPMODE_HSIC20D(cs)	(CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_HSIC20D))
+#define CST4350_CHIPMODE_HSIC30D(cs)	(CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_HSIC30D))
+#define CST4350_CHIPMODE_USB30D(cs)	(CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_USB30D))
+#define CST4350_CHIPMODE_USB30D_WL(cs)	(CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_USB30D_WL))
+#define CST4350_CHIPMODE_PCIE(cs)	(CST4350_IFC_MODE(cs) == (CST4350_IFC_MODE_PCIE))
+
+/* strap_host_ifc strap value */
+#define CST4350_HOST_IFC_MASK		0x00700000
+#define CST4350_HOST_IFC_SHIFT		20
+
+/* host_ifc raw mode */
+#define CST4350_IFC_MODE_SDIOD			0x0
+#define CST4350_IFC_MODE_HSIC20D		0x1
+#define CST4350_IFC_MODE_HSIC30D		0x2
+#define CST4350_IFC_MODE_PCIE			0x3
+#define CST4350_IFC_MODE_USB20D			0x4
+#define CST4350_IFC_MODE_USB30D			0x5
+#define CST4350_IFC_MODE_USB30D_WL		0x6
+#define CST4350_IFC_MODE_USB30D_BT		0x7
+
+#define CST4350_IFC_MODE(cs)	((cs & CST4350_HOST_IFC_MASK) >> CST4350_HOST_IFC_SHIFT)
+
+/* 4350 PMU resources */
+#define RES4350_LPLDO_PU	0
+#define RES4350_PMU_BG_PU	1
+#define RES4350_PMU_SLEEP	2
+#define RES4350_RSVD_3		3
+#define RES4350_CBUCK_LPOM_PU	4
+#define RES4350_CBUCK_PFM_PU	5
+#define RES4350_COLD_START_WAIT	6
+#define RES4350_RSVD_7		7
+#define RES4350_LNLDO_PU	8
+#define RES4350_XTALLDO_PU	9
+#define RES4350_LDO3P3_PU	10
+#define RES4350_OTP_PU		11
+#define RES4350_XTAL_PU		12
+#define RES4350_SR_CLK_START	13
+#define RES4350_LQ_AVAIL	14
+#define RES4350_LQ_START	15
+#define RES4350_PERST_OVR	16
+#define RES4350_WL_CORE_RDY	17
+#define RES4350_ILP_REQ		18
+#define RES4350_ALP_AVAIL	19
+#define RES4350_MINI_PMU	20
+#define RES4350_RADIO_PU	21
+#define RES4350_SR_CLK_STABLE	22
+#define RES4350_SR_SAVE_RESTORE	23
+#define RES4350_SR_PHY_PWRSW	24
+#define RES4350_SR_VDDM_PWRSW	25
+#define RES4350_SR_SUBCORE_PWRSW	26
+#define RES4350_SR_SLEEP	27
+#define RES4350_HT_START	28
+#define RES4350_HT_AVAIL	29
+#define RES4350_MACPHY_CLKAVAIL	30
+
+#define MUXENAB4350_UART_MASK		(0x0000000f)
+#define MUXENAB4350_UART_SHIFT		0
+#define MUXENAB4350_HOSTWAKE_MASK	(0x000000f0)	/* configure GPIO for SDIO host_wake */
+#define MUXENAB4350_HOSTWAKE_SHIFT	4
+
+
+/* 4350 GCI function sel values */
+#define CC4350_FNSEL_HWDEF		(0)
+#define CC4350_FNSEL_SAMEASPIN		(1)
+#define CC4350_FNSEL_UART		(2)
+#define CC4350_FNSEL_SFLASH		(3)
+#define CC4350_FNSEL_SPROM		(4)
+#define CC4350_FNSEL_I2C		(5)
+#define CC4350_FNSEL_MISC0		(6)
+#define CC4350_FNSEL_GCI		(7)
+#define CC4350_FNSEL_MISC1		(8)
+#define CC4350_FNSEL_MISC2		(9)
+#define CC4350_FNSEL_PWDOG 		(10)
+#define CC4350_FNSEL_IND		(12)
+#define CC4350_FNSEL_PDN		(13)
+#define CC4350_FNSEL_PUP		(14)
+#define CC4350_FNSEL_TRISTATE		(15)
+#define CC4350C_FNSEL_UART		(3)
+
+
+/* 4350 GPIO */
+#define CC4350_PIN_GPIO_00		(0)
+#define CC4350_PIN_GPIO_01		(1)
+#define CC4350_PIN_GPIO_02		(2)
+#define CC4350_PIN_GPIO_03		(3)
+#define CC4350_PIN_GPIO_04		(4)
+#define CC4350_PIN_GPIO_05		(5)
+#define CC4350_PIN_GPIO_06		(6)
+#define CC4350_PIN_GPIO_07		(7)
+#define CC4350_PIN_GPIO_08		(8)
+#define CC4350_PIN_GPIO_09		(9)
+#define CC4350_PIN_GPIO_10		(10)
+#define CC4350_PIN_GPIO_11		(11)
+#define CC4350_PIN_GPIO_12		(12)
+#define CC4350_PIN_GPIO_13		(13)
+#define CC4350_PIN_GPIO_14		(14)
+#define CC4350_PIN_GPIO_15		(15)
+
+#define CC4350_RSVD_16_SHIFT		16
+
+#define CC2_4350_PHY_PWRSW_UPTIME_MASK		(0xf << 0)
+#define CC2_4350_PHY_PWRSW_UPTIME_SHIFT		(0)
+#define CC2_4350_VDDM_PWRSW_UPDELAY_MASK	(0xf << 4)
+#define CC2_4350_VDDM_PWRSW_UPDELAY_SHIFT	(4)
+#define CC2_4350_VDDM_PWRSW_UPTIME_MASK		(0xf << 8)
+#define CC2_4350_VDDM_PWRSW_UPTIME_SHIFT	(8)
+#define CC2_4350_SBC_PWRSW_DNDELAY_MASK		(0x3 << 12)
+#define CC2_4350_SBC_PWRSW_DNDELAY_SHIFT	(12)
+#define CC2_4350_PHY_PWRSW_DNDELAY_MASK		(0x3 << 14)
+#define CC2_4350_PHY_PWRSW_DNDELAY_SHIFT	(14)
+#define CC2_4350_VDDM_PWRSW_DNDELAY_MASK	(0x3 << 16)
+#define CC2_4350_VDDM_PWRSW_DNDELAY_SHIFT	(16)
+#define CC2_4350_VDDM_PWRSW_EN_MASK		(1 << 20)
+#define CC2_4350_VDDM_PWRSW_EN_SHIFT		(20)
+#define CC2_4350_MEMLPLDO_PWRSW_EN_MASK		(1 << 21)
+#define CC2_4350_MEMLPLDO_PWRSW_EN_SHIFT	(21)
+#define CC2_4350_SDIO_AOS_WAKEUP_MASK		(1 << 24)
+#define CC2_4350_SDIO_AOS_WAKEUP_SHIFT		(24)
+
+/* Applies to 4335/4350/4345 */
+#define CC3_SR_CLK_SR_MEM_MASK			(1 << 0)
+#define CC3_SR_CLK_SR_MEM_SHIFT			(0)
+#define CC3_SR_BIT1_TBD_MASK			(1 << 1)
+#define CC3_SR_BIT1_TBD_SHIFT			(1)
+#define CC3_SR_ENGINE_ENABLE_MASK		(1 << 2)
+#define CC3_SR_ENGINE_ENABLE_SHIFT		(2)
+#define CC3_SR_BIT3_TBD_MASK			(1 << 3)
+#define CC3_SR_BIT3_TBD_SHIFT			(3)
+#define CC3_SR_MINDIV_FAST_CLK_MASK		(0xF << 4)
+#define CC3_SR_MINDIV_FAST_CLK_SHIFT		(4)
+#define CC3_SR_R23_SR2_RISE_EDGE_TRIG_MASK	(1 << 8)
+#define CC3_SR_R23_SR2_RISE_EDGE_TRIG_SHIFT	(8)
+#define CC3_SR_R23_SR2_FALL_EDGE_TRIG_MASK	(1 << 9)
+#define CC3_SR_R23_SR2_FALL_EDGE_TRIG_SHIFT	(9)
+#define CC3_SR_R23_SR_RISE_EDGE_TRIG_MASK	(1 << 10)
+#define CC3_SR_R23_SR_RISE_EDGE_TRIG_SHIFT	(10)
+#define CC3_SR_R23_SR_FALL_EDGE_TRIG_MASK	(1 << 11)
+#define CC3_SR_R23_SR_FALL_EDGE_TRIG_SHIFT	(11)
+#define CC3_SR_NUM_CLK_HIGH_MASK		(0x7 << 12)
+#define CC3_SR_NUM_CLK_HIGH_SHIFT		(12)
+#define CC3_SR_BIT15_TBD_MASK			(1 << 15)
+#define CC3_SR_BIT15_TBD_SHIFT			(15)
+#define CC3_SR_PHY_FUNC_PIC_MASK		(1 << 16)
+#define CC3_SR_PHY_FUNC_PIC_SHIFT		(16)
+#define CC3_SR_BIT17_19_TBD_MASK		(0x7 << 17)
+#define CC3_SR_BIT17_19_TBD_SHIFT		(17)
+#define CC3_SR_CHIP_TRIGGER_1_MASK		(1 << 20)
+#define CC3_SR_CHIP_TRIGGER_1_SHIFT		(20)
+#define CC3_SR_CHIP_TRIGGER_2_MASK		(1 << 21)
+#define CC3_SR_CHIP_TRIGGER_2_SHIFT		(21)
+#define CC3_SR_CHIP_TRIGGER_3_MASK		(1 << 22)
+#define CC3_SR_CHIP_TRIGGER_3_SHIFT		(22)
+#define CC3_SR_CHIP_TRIGGER_4_MASK		(1 << 23)
+#define CC3_SR_CHIP_TRIGGER_4_SHIFT		(23)
+#define CC3_SR_ALLOW_SBC_FUNC_PIC_MASK		(1 << 24)
+#define CC3_SR_ALLOW_SBC_FUNC_PIC_SHIFT		(24)
+#define CC3_SR_BIT25_26_TBD_MASK		(0x3 << 25)
+#define CC3_SR_BIT25_26_TBD_SHIFT		(25)
+#define CC3_SR_ALLOW_SBC_STBY_MASK		(1 << 27)
+#define CC3_SR_ALLOW_SBC_STBY_SHIFT		(27)
+#define CC3_SR_GPIO_MUX_MASK			(0xF << 28)
+#define CC3_SR_GPIO_MUX_SHIFT			(28)
+
+/* Applies to 4335/4350/4345 */
+#define CC4_SR_INIT_ADDR_MASK		(0x3FF0000)
+#define 	CC4_4350_SR_ASM_ADDR	(0x30)
+#define CC4_4350_C0_SR_ASM_ADDR		(0x0)
+#define 	CC4_4335_SR_ASM_ADDR	(0x48)
+#define 	CC4_4345_SR_ASM_ADDR	(0x48)
+#define CC4_SR_INIT_ADDR_SHIFT		(16)
+
+#define CC4_4350_EN_SR_CLK_ALP_MASK	(1 << 30)
+#define CC4_4350_EN_SR_CLK_ALP_SHIFT	(30)
+#define CC4_4350_EN_SR_CLK_HT_MASK	(1 << 31)
+#define CC4_4350_EN_SR_CLK_HT_SHIFT	(31)
+
+#define VREG4_4350_MEMLPDO_PU_MASK	(1 << 31)
+#define VREG4_4350_MEMLPDO_PU_SHIFT	31
+
+#define VREG6_4350_SR_EXT_CLKDIR_MASK	(1 << 20)
+#define VREG6_4350_SR_EXT_CLKDIR_SHIFT	20
+#define VREG6_4350_SR_EXT_CLKDIV_MASK	(0x3 << 21)
+#define VREG6_4350_SR_EXT_CLKDIV_SHIFT	21
+#define VREG6_4350_SR_EXT_CLKEN_MASK	(1 << 23)
+#define VREG6_4350_SR_EXT_CLKEN_SHIFT	23
+
+#define CC5_4350_PMU_EN_ASSERT_MASK	(1 << 13)
+#define CC5_4350_PMU_EN_ASSERT_SHIFT	(13)
+
+#define CC6_4350_PCIE_CLKREQ_WAKEUP_MASK	(1 << 4)
+#define CC6_4350_PCIE_CLKREQ_WAKEUP_SHIFT	(4)
+#define CC6_4350_PMU_WAKEUP_ALPAVAIL_MASK	(1 << 6)
+#define CC6_4350_PMU_WAKEUP_ALPAVAIL_SHIFT	(6)
+#define CC6_4350_PMU_EN_EXT_PERST_MASK		(1 << 17)
+#define CC6_4350_PMU_EN_EXT_PERST_SHIFT		(17)
+#define CC6_4350_PMU_EN_WAKEUP_MASK		(1 << 18)
+#define CC6_4350_PMU_EN_WAKEUP_SHIFT		(18)
+
+#define CC7_4350_PMU_EN_ASSERT_L2_MASK	(1 << 26)
+#define CC7_4350_PMU_EN_ASSERT_L2_SHIFT	(26)
+#define CC7_4350_PMU_EN_MDIO_MASK	(1 << 27)
+#define CC7_4350_PMU_EN_MDIO_SHIFT	(27)
+
+#define CC6_4345_PMU_EN_PERST_DEASSERT_MASK		(1 << 13)
+#define CC6_4345_PMU_EN_PERST_DEASSERT_SHIF		(13)
+#define CC6_4345_PMU_EN_L2_DEASSERT_MASK		(1 << 14)
+#define CC6_4345_PMU_EN_L2_DEASSERT_SHIF		(14)
+#define CC6_4345_PMU_EN_ASSERT_L2_MASK		(1 << 15)
+#define CC6_4345_PMU_EN_ASSERT_L2_SHIFT		(15)
+#define CC6_4345_PMU_EN_MDIO_MASK		(1 << 24)
+#define CC6_4345_PMU_EN_MDIO_SHIFT		(24)
+
+/* GCI chipcontrol register indices */
+#define CC_GCI_CHIPCTRL_00	(0)
+#define CC_GCI_CHIPCTRL_01	(1)
+#define CC_GCI_CHIPCTRL_02	(2)
+#define CC_GCI_CHIPCTRL_03	(3)
+#define CC_GCI_CHIPCTRL_04	(4)
+#define CC_GCI_CHIPCTRL_05	(5)
+#define CC_GCI_CHIPCTRL_06	(6)
+#define CC_GCI_CHIPCTRL_07	(7)
+#define CC_GCI_CHIPCTRL_08	(8)
+#define CC_GCI_XTAL_BUFSTRG_NFC (0xff << 12)
+
+#define CC_GCI_06_JTAG_SEL_SHIFT	4
+#define CC_GCI_06_JTAG_SEL_MASK		(1 << 4)
+
+#define CC_GCI_NUMCHIPCTRLREGS(cap1)	((cap1 & 0xF00) >> 8)
+
+/* 4345 PMU resources */
+#define RES4345_LPLDO_PU		0
+#define RES4345_PMU_BG_PU		1
+#define RES4345_PMU_SLEEP 		2
+#define RES4345_HSICLDO_PU		3
+#define RES4345_CBUCK_LPOM_PU		4
+#define RES4345_CBUCK_PFM_PU		5
+#define RES4345_COLD_START_WAIT		6
+#define RES4345_RSVD_7			7
+#define RES4345_LNLDO_PU		8
+#define RES4345_XTALLDO_PU		9
+#define RES4345_LDO3P3_PU		10
+#define RES4345_OTP_PU			11
+#define RES4345_XTAL_PU			12
+#define RES4345_SR_CLK_START		13
+#define RES4345_LQ_AVAIL		14
+#define RES4345_LQ_START		15
+#define RES4345_PERST_OVR		16
+#define RES4345_WL_CORE_RDY		17
+#define RES4345_ILP_REQ			18
+#define RES4345_ALP_AVAIL		19
+#define RES4345_MINI_PMU		20
+#define RES4345_RADIO_PU		21
+#define RES4345_SR_CLK_STABLE		22
+#define RES4345_SR_SAVE_RESTORE		23
+#define RES4345_SR_PHY_PWRSW		24
+#define RES4345_SR_VDDM_PWRSW		25
+#define RES4345_SR_SUBCORE_PWRSW	26
+#define RES4345_SR_SLEEP		27
+#define RES4345_HT_START		28
+#define RES4345_HT_AVAIL		29
+#define RES4345_MACPHY_CLK_AVAIL	30
+
+/* 4335 pins
+* note: only the values set as default/used are added here.
+*/
+#define CC4335_PIN_GPIO_00		(0)
+#define CC4335_PIN_GPIO_01		(1)
+#define CC4335_PIN_GPIO_02		(2)
+#define CC4335_PIN_GPIO_03		(3)
+#define CC4335_PIN_GPIO_04		(4)
+#define CC4335_PIN_GPIO_05		(5)
+#define CC4335_PIN_GPIO_06		(6)
+#define CC4335_PIN_GPIO_07		(7)
+#define CC4335_PIN_GPIO_08		(8)
+#define CC4335_PIN_GPIO_09		(9)
+#define CC4335_PIN_GPIO_10		(10)
+#define CC4335_PIN_GPIO_11		(11)
+#define CC4335_PIN_GPIO_12		(12)
+#define CC4335_PIN_GPIO_13		(13)
+#define CC4335_PIN_GPIO_14		(14)
+#define CC4335_PIN_GPIO_15		(15)
+#define CC4335_PIN_SDIO_CLK		(16)
+#define CC4335_PIN_SDIO_CMD		(17)
+#define CC4335_PIN_SDIO_DATA0	(18)
+#define CC4335_PIN_SDIO_DATA1	(19)
+#define CC4335_PIN_SDIO_DATA2	(20)
+#define CC4335_PIN_SDIO_DATA3	(21)
+#define CC4335_PIN_RF_SW_CTRL_6	(22)
+#define CC4335_PIN_RF_SW_CTRL_7	(23)
+#define CC4335_PIN_RF_SW_CTRL_8	(24)
+#define CC4335_PIN_RF_SW_CTRL_9	(25)
+/* Last GPIO Pad */
+#define CC4335_PIN_GPIO_LAST	(31)
+
+/* 4335 GCI function sel values
+*/
+#define CC4335_FNSEL_HWDEF		(0)
+#define CC4335_FNSEL_SAMEASPIN	(1)
+#define CC4335_FNSEL_GPIO0		(2)
+#define CC4335_FNSEL_GPIO1		(3)
+#define CC4335_FNSEL_GCI0		(4)
+#define CC4335_FNSEL_GCI1		(5)
+#define CC4335_FNSEL_UART		(6)
+#define CC4335_FNSEL_SFLASH		(7)
+#define CC4335_FNSEL_SPROM		(8)
+#define CC4335_FNSEL_MISC0		(9)
+#define CC4335_FNSEL_MISC1		(10)
+#define CC4335_FNSEL_MISC2		(11)
+#define CC4335_FNSEL_IND		(12)
+#define CC4335_FNSEL_PDN		(13)
+#define CC4335_FNSEL_PUP		(14)
+#define CC4335_FNSEL_TRI		(15)
+
+/* GCI Core Control Reg */
+#define	GCI_CORECTRL_SR_MASK	(1 << 0)	/* SECI block Reset */
+#define	GCI_CORECTRL_RSL_MASK	(1 << 1)	/* ResetSECILogic */
+#define	GCI_CORECTRL_ES_MASK	(1 << 2)	/* EnableSECI */
+#define	GCI_CORECTRL_FSL_MASK	(1 << 3)	/* Force SECI Out Low */
+#define	GCI_CORECTRL_SOM_MASK	(7 << 4)	/* SECI Op Mode */
+#define	GCI_CORECTRL_US_MASK	(1 << 7)	/* Update SECI */
+#define	GCI_CORECTRL_BOS_MASK	(1 << 8)	/* Break On Sleep */
+
+/* 4345 pins
+* note: only the values set as default/used are added here.
+*/
+#define CC4345_PIN_GPIO_00		(0)
+#define CC4345_PIN_GPIO_01		(1)
+#define CC4345_PIN_GPIO_02		(2)
+#define CC4345_PIN_GPIO_03		(3)
+#define CC4345_PIN_GPIO_04		(4)
+#define CC4345_PIN_GPIO_05		(5)
+#define CC4345_PIN_GPIO_06		(6)
+#define CC4345_PIN_GPIO_07		(7)
+#define CC4345_PIN_GPIO_08		(8)
+#define CC4345_PIN_GPIO_09		(9)
+#define CC4345_PIN_GPIO_10		(10)
+#define CC4345_PIN_GPIO_11		(11)
+#define CC4345_PIN_GPIO_12		(12)
+#define CC4345_PIN_GPIO_13		(13)
+#define CC4345_PIN_GPIO_14		(14)
+#define CC4345_PIN_GPIO_15		(15)
+#define CC4345_PIN_GPIO_16		(16)
+#define CC4345_PIN_SDIO_CLK		(17)
+#define CC4345_PIN_SDIO_CMD		(18)
+#define CC4345_PIN_SDIO_DATA0	(19)
+#define CC4345_PIN_SDIO_DATA1	(20)
+#define CC4345_PIN_SDIO_DATA2	(21)
+#define CC4345_PIN_SDIO_DATA3	(22)
+#define CC4345_PIN_RF_SW_CTRL_0	(23)
+#define CC4345_PIN_RF_SW_CTRL_1	(24)
+#define CC4345_PIN_RF_SW_CTRL_2	(25)
+#define CC4345_PIN_RF_SW_CTRL_3	(26)
+#define CC4345_PIN_RF_SW_CTRL_4	(27)
+#define CC4345_PIN_RF_SW_CTRL_5	(28)
+#define CC4345_PIN_RF_SW_CTRL_6	(29)
+#define CC4345_PIN_RF_SW_CTRL_7	(30)
+#define CC4345_PIN_RF_SW_CTRL_8	(31)
+#define CC4345_PIN_RF_SW_CTRL_9	(32)
+
+/* 4345 GCI function sel values
+*/
+#define CC4345_FNSEL_HWDEF		(0)
+#define CC4345_FNSEL_SAMEASPIN		(1)
+#define CC4345_FNSEL_GPIO0		(2)
+#define CC4345_FNSEL_GPIO1		(3)
+#define CC4345_FNSEL_GCI0		(4)
+#define CC4345_FNSEL_GCI1		(5)
+#define CC4345_FNSEL_UART		(6)
+#define CC4345_FNSEL_SFLASH		(7)
+#define CC4345_FNSEL_SPROM		(8)
+#define CC4345_FNSEL_MISC0		(9)
+#define CC4345_FNSEL_MISC1		(10)
+#define CC4345_FNSEL_MISC2		(11)
+#define CC4345_FNSEL_IND		(12)
+#define CC4345_FNSEL_PDN		(13)
+#define CC4345_FNSEL_PUP		(14)
+#define CC4345_FNSEL_TRI		(15)
+
+#define MUXENAB4345_UART_MASK		(0x0000000f)
+#define MUXENAB4345_UART_SHIFT		0
+#define MUXENAB4345_HOSTWAKE_MASK	(0x000000f0)
+#define MUXENAB4345_HOSTWAKE_SHIFT	4
+
+/* 4349 Group (4349, 4355, 4359) GCI AVS function sel values */
+#define CC4349_GRP_GCI_AVS_CTRL_MASK   (0xffe00000)
+#define CC4349_GRP_GCI_AVS_CTRL_SHIFT  (21)
+#define CC4349_GRP_GCI_AVS_CTRL_ENAB   (1 << 5)
+
+/* 4345 GCI AVS function sel values */
+#define CC4345_GCI_AVS_CTRL_MASK   (0xfc)
+#define CC4345_GCI_AVS_CTRL_SHIFT  (2)
+#define CC4345_GCI_AVS_CTRL_ENAB   (1 << 5)
+
+/* GCI GPIO for function sel GCI-0/GCI-1 */
+#define CC_GCI_GPIO_0			(0)
+#define CC_GCI_GPIO_1			(1)
+#define CC_GCI_GPIO_2			(2)
+#define CC_GCI_GPIO_3			(3)
+#define CC_GCI_GPIO_4			(4)
+#define CC_GCI_GPIO_5			(5)
+#define CC_GCI_GPIO_6			(6)
+#define CC_GCI_GPIO_7			(7)
+#define CC_GCI_GPIO_8			(8)
+#define CC_GCI_GPIO_9			(9)
+#define CC_GCI_GPIO_10			(10)
+#define CC_GCI_GPIO_11			(11)
+#define CC_GCI_GPIO_12			(12)
+#define CC_GCI_GPIO_13			(13)
+#define CC_GCI_GPIO_14			(14)
+#define CC_GCI_GPIO_15			(15)
+
+
+/* indicates Invalid GPIO, e.g. when PAD GPIO doesn't map to GCI GPIO */
+#define CC_GCI_GPIO_INVALID		0xFF
+
+/* find the 4 bit mask given the bit position */
+#define GCIMASK(pos)  (((uint32)0xF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL(val, pos)  ((((uint32)val) << pos) & GCIMASK(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL(val, pos)	((val >> pos) & 0xF)
+
+
+/* find the 8 bit mask given the bit position */
+#define GCIMASK_8B(pos)  (((uint32)0xFF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL_8B(val, pos)  ((((uint32)val) << pos) & GCIMASK_8B(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL_8B(val, pos)	((val >> pos) & 0xFF)
+
+/* find the 4 bit mask given the bit position */
+#define GCIMASK_4B(pos)  (((uint32)0xF) << pos)
+/* get the value which can be used to directly OR with chipcontrol reg */
+#define GCIPOSVAL_4B(val, pos)  ((((uint32)val) << pos) & GCIMASK_4B(pos))
+/* Extract nibble from a given position */
+#define GCIGETNBL_4B(val, pos)	((val >> pos) & 0xF)
+
+
+/* 4335 GCI Intstatus(Mask)/WakeMask Register bits. */
+#define GCI_INTSTATUS_RBI	(1 << 0)	/* Rx Break Interrupt */
+#define GCI_INTSTATUS_UB	(1 << 1)	/* UART Break Interrupt */
+#define GCI_INTSTATUS_SPE	(1 << 2)	/* SECI Parity Error Interrupt */
+#define GCI_INTSTATUS_SFE	(1 << 3)	/* SECI Framing Error Interrupt */
+#define GCI_INTSTATUS_SRITI	(1 << 9)	/* SECI Rx Idle Timer Interrupt */
+#define GCI_INTSTATUS_STFF	(1 << 10)	/* SECI Tx FIFO Full Interrupt */
+#define GCI_INTSTATUS_STFAE	(1 << 11)	/* SECI Tx FIFO Almost Empty Intr */
+#define GCI_INTSTATUS_SRFAF	(1 << 12)	/* SECI Rx FIFO Almost Full */
+#define GCI_INTSTATUS_SRFNE	(1 << 14)	/* SECI Rx FIFO Not Empty */
+#define GCI_INTSTATUS_SRFOF	(1 << 15)	/* SECI Rx FIFO Not Empty Timeout */
+#define GCI_INTSTATUS_GPIOINT	(1 << 25)	/* GCIGpioInt */
+#define GCI_INTSTATUS_GPIOWAKE	(1 << 26)	/* GCIGpioWake */
+
+/* 4335 GCI IntMask Register bits. */
+#define GCI_INTMASK_RBI		(1 << 0)	/* Rx Break Interrupt */
+#define GCI_INTMASK_UB		(1 << 1)	/* UART Break Interrupt */
+#define GCI_INTMASK_SPE		(1 << 2)	/* SECI Parity Error Interrupt */
+#define GCI_INTMASK_SFE		(1 << 3)	/* SECI Framing Error Interrupt */
+#define GCI_INTMASK_SRITI	(1 << 9)	/* SECI Rx Idle Timer Interrupt */
+#define GCI_INTMASK_STFF	(1 << 10)	/* SECI Tx FIFO Full Interrupt */
+#define GCI_INTMASK_STFAE	(1 << 11)	/* SECI Tx FIFO Almost Empty Intr */
+#define GCI_INTMASK_SRFAF	(1 << 12)	/* SECI Rx FIFO Almost Full */
+#define GCI_INTMASK_SRFNE	(1 << 14)	/* SECI Rx FIFO Not Empty */
+#define GCI_INTMASK_SRFOF	(1 << 15)	/* SECI Rx FIFO Not Empty Timeout */
+#define GCI_INTMASK_GPIOINT	(1 << 25)	/* GCIGpioInt */
+#define GCI_INTMASK_GPIOWAKE	(1 << 26)	/* GCIGpioWake */
+
+/* 4335 GCI WakeMask Register bits. */
+#define GCI_WAKEMASK_RBI	(1 << 0)	/* Rx Break Interrupt */
+#define GCI_WAKEMASK_UB		(1 << 1)	/* UART Break Interrupt */
+#define GCI_WAKEMASK_SPE	(1 << 2)	/* SECI Parity Error Interrupt */
+#define GCI_WAKEMASK_SFE	(1 << 3)	/* SECI Framing Error Interrupt */
+#define GCI_WAKE_SRITI		(1 << 9)	/* SECI Rx Idle Timer Interrupt */
+#define GCI_WAKEMASK_STFF	(1 << 10)	/* SECI Tx FIFO Full Interrupt */
+#define GCI_WAKEMASK_STFAE	(1 << 11)	/* SECI Tx FIFO Almost Empty Intr */
+#define GCI_WAKEMASK_SRFAF	(1 << 12)	/* SECI Rx FIFO Almost Full */
+#define GCI_WAKEMASK_SRFNE	(1 << 14)	/* SECI Rx FIFO Not Empty */
+#define GCI_WAKEMASK_SRFOF	(1 << 15)	/* SECI Rx FIFO Not Empty Timeout */
+#define GCI_WAKEMASK_GPIOINT	(1 << 25)	/* GCIGpioInt */
+#define GCI_WAKEMASK_GPIOWAKE	(1 << 26)	/* GCIGpioWake */
+
+#define	GCI_WAKE_ON_GCI_GPIO1	1
+#define	GCI_WAKE_ON_GCI_GPIO2	2
+#define	GCI_WAKE_ON_GCI_GPIO3	3
+#define	GCI_WAKE_ON_GCI_GPIO4	4
+#define	GCI_WAKE_ON_GCI_GPIO5	5
+#define	GCI_WAKE_ON_GCI_GPIO6	6
+#define	GCI_WAKE_ON_GCI_GPIO7	7
+#define	GCI_WAKE_ON_GCI_GPIO8	8
+#define	GCI_WAKE_ON_GCI_SECI_IN	9
+
+/* 4335 MUX options. each nibble belongs to a setting. Non-zero value specifies a logic
+* for now only UART for bootloader.
+*/
+#define MUXENAB4335_UART_MASK		(0x0000000f)
+
+#define MUXENAB4335_UART_SHIFT		0
+#define MUXENAB4335_HOSTWAKE_MASK	(0x000000f0)	/* configure GPIO for SDIO host_wake */
+#define MUXENAB4335_HOSTWAKE_SHIFT	4
+#define MUXENAB4335_GETIX(val, name) \
+	((((val) & MUXENAB4335_ ## name ## _MASK) >> MUXENAB4335_ ## name ## _SHIFT) - 1)
+
+/*
+* Maximum delay for the PMU state transition in us.
+* This is an upper bound intended for spinwaits etc.
+*/
+#define PMU_MAX_TRANSITION_DLY	15000
+
+/* PMU resource up transition time in ILP cycles */
+#define PMURES_UP_TRANSITION	2
+
+
+/* SECI configuration */
+#define SECI_MODE_UART			0x0
+#define SECI_MODE_SECI			0x1
+#define SECI_MODE_LEGACY_3WIRE_BT	0x2
+#define SECI_MODE_LEGACY_3WIRE_WLAN	0x3
+#define SECI_MODE_HALF_SECI		0x4
+
+#define SECI_RESET		(1 << 0)
+#define SECI_RESET_BAR_UART	(1 << 1)
+#define SECI_ENAB_SECI_ECI	(1 << 2)
+#define SECI_ENAB_SECIOUT_DIS	(1 << 3)
+#define SECI_MODE_MASK		0x7
+#define SECI_MODE_SHIFT		4 /* (bits 5, 6, 7) */
+#define SECI_UPD_SECI		(1 << 7)
+
+#define SECI_SLIP_ESC_CHAR	0xDB
+#define SECI_SIGNOFF_0		SECI_SLIP_ESC_CHAR
+#define SECI_SIGNOFF_1     0
+#define SECI_REFRESH_REQ	0xDA
+
+/* seci clk_ctl_st bits */
+#define CLKCTL_STS_SECI_CLK_REQ		(1 << 8)
+#define CLKCTL_STS_SECI_CLK_AVAIL	(1 << 24)
+
+#define SECI_UART_MSR_CTS_STATE		(1 << 0)
+#define SECI_UART_MSR_RTS_STATE		(1 << 1)
+#define SECI_UART_SECI_IN_STATE		(1 << 2)
+#define SECI_UART_SECI_IN2_STATE	(1 << 3)
+
+/* GCI RX FIFO Control Register */
+#define	GCI_RXF_LVL_MASK	(0xFF << 0)
+#define	GCI_RXF_TIMEOUT_MASK	(0xFF << 8)
+
+/* GCI UART Registers' Bit definitions */
+/* Seci Fifo Level Register */
+#define	SECI_TXF_LVL_MASK	(0x3F << 8)
+#define	TXF_AE_LVL_DEFAULT	0x4
+#define	SECI_RXF_LVL_FC_MASK	(0x3F << 16)
+
+/* SeciUARTFCR Bit definitions */
+#define	SECI_UART_FCR_RFR		(1 << 0)
+#define	SECI_UART_FCR_TFR		(1 << 1)
+#define	SECI_UART_FCR_SR		(1 << 2)
+#define	SECI_UART_FCR_THP		(1 << 3)
+#define	SECI_UART_FCR_AB		(1 << 4)
+#define	SECI_UART_FCR_ATOE		(1 << 5)
+#define	SECI_UART_FCR_ARTSOE		(1 << 6)
+#define	SECI_UART_FCR_ABV		(1 << 7)
+#define	SECI_UART_FCR_ALM		(1 << 8)
+
+/* SECI UART LCR register bits */
+#define SECI_UART_LCR_STOP_BITS		(1 << 0) /* 0 - 1bit, 1 - 2bits */
+#define SECI_UART_LCR_PARITY_EN		(1 << 1)
+#define SECI_UART_LCR_PARITY		(1 << 2) /* 0 - odd, 1 - even */
+#define SECI_UART_LCR_RX_EN		(1 << 3)
+#define SECI_UART_LCR_LBRK_CTRL		(1 << 4) /* 1 => SECI_OUT held low */
+#define SECI_UART_LCR_TXO_EN		(1 << 5)
+#define SECI_UART_LCR_RTSO_EN		(1 << 6)
+#define SECI_UART_LCR_SLIPMODE_EN	(1 << 7)
+#define SECI_UART_LCR_RXCRC_CHK		(1 << 8)
+#define SECI_UART_LCR_TXCRC_INV		(1 << 9)
+#define SECI_UART_LCR_TXCRC_LSBF	(1 << 10)
+#define SECI_UART_LCR_TXCRC_EN		(1 << 11)
+#define	SECI_UART_LCR_RXSYNC_EN		(1 << 12)
+
+#define SECI_UART_MCR_TX_EN		(1 << 0)
+#define SECI_UART_MCR_PRTS		(1 << 1)
+#define SECI_UART_MCR_SWFLCTRL_EN	(1 << 2)
+#define SECI_UART_MCR_HIGHRATE_EN	(1 << 3)
+#define SECI_UART_MCR_LOOPBK_EN		(1 << 4)
+#define SECI_UART_MCR_AUTO_RTS		(1 << 5)
+#define SECI_UART_MCR_AUTO_TX_DIS	(1 << 6)
+#define SECI_UART_MCR_BAUD_ADJ_EN	(1 << 7)
+#define SECI_UART_MCR_XONOFF_RPT	(1 << 9)
+
+/* SeciUARTLSR Bit Mask */
+#define	SECI_UART_LSR_RXOVR_MASK	(1 << 0)
+#define	SECI_UART_LSR_RFF_MASK		(1 << 1)
+#define	SECI_UART_LSR_TFNE_MASK		(1 << 2)
+#define	SECI_UART_LSR_TI_MASK		(1 << 3)
+#define	SECI_UART_LSR_TPR_MASK		(1 << 4)
+#define	SECI_UART_LSR_TXHALT_MASK	(1 << 5)
+
+/* SeciUARTMSR Bit Mask */
+#define	SECI_UART_MSR_CTSS_MASK		(1 << 0)
+#define	SECI_UART_MSR_RTSS_MASK		(1 << 1)
+#define	SECI_UART_MSR_SIS_MASK		(1 << 2)
+#define	SECI_UART_MSR_SIS2_MASK		(1 << 3)
+
+/* SeciUARTData Bits */
+#define SECI_UART_DATA_RF_NOT_EMPTY_BIT	(1 << 12)
+#define SECI_UART_DATA_RF_FULL_BIT	(1 << 13)
+#define SECI_UART_DATA_RF_OVRFLOW_BIT	(1 << 14)
+#define	SECI_UART_DATA_FIFO_PTR_MASK	0xFF
+#define	SECI_UART_DATA_RF_RD_PTR_SHIFT	16
+#define	SECI_UART_DATA_RF_WR_PTR_SHIFT	24
+
+/* LTECX: ltecxmux */
+#define LTECX_EXTRACT_MUX(val, idx)	(getbit4(&(val), (idx)))
+
+/* LTECX: ltecxmux MODE */
+#define LTECX_MUX_MODE_IDX		0
+#define LTECX_MUX_MODE_WCI2		0x0
+#define LTECX_MUX_MODE_GPIO		0x1
+
+
+/* LTECX GPIO Information Index */
+#define LTECX_NVRAM_FSYNC_IDX	0
+#define LTECX_NVRAM_LTERX_IDX	1
+#define LTECX_NVRAM_LTETX_IDX	2
+#define LTECX_NVRAM_WLPRIO_IDX	3
+
+/* LTECX WCI2 Information Index */
+#define LTECX_NVRAM_WCI2IN_IDX	0
+#define LTECX_NVRAM_WCI2OUT_IDX	1
+
+/* LTECX: Macros to get GPIO/FNSEL/GCIGPIO */
+#define LTECX_EXTRACT_PADNUM(val, idx)	(getbit8(&(val), (idx)))
+#define LTECX_EXTRACT_FNSEL(val, idx)	(getbit4(&(val), (idx)))
+#define LTECX_EXTRACT_GCIGPIO(val, idx)	(getbit4(&(val), (idx)))
+
+/* WLAN channel numbers - used from wifi.h */
+
+/* WLAN BW */
+#define ECI_BW_20   0x0
+#define ECI_BW_25   0x1
+#define ECI_BW_30   0x2
+#define ECI_BW_35   0x3
+#define ECI_BW_40   0x4
+#define ECI_BW_45   0x5
+#define ECI_BW_50   0x6
+#define ECI_BW_ALL  0x7
+
+/* WLAN - number of antenna */
+#define WLAN_NUM_ANT1 TXANT_0
+#define WLAN_NUM_ANT2 TXANT_1
+
+/* otpctrl1 0xF4 */
+#define OTPC_FORCE_PWR_OFF	0x02000000
+/* chipcommon s/r registers introduced with cc rev >= 48 */
+#define CC_SR_CTL0_ENABLE_MASK             0x1
+#define CC_SR_CTL0_ENABLE_SHIFT              0
+#define CC_SR_CTL0_EN_SR_ENG_CLK_SHIFT       1 /* sr_clk to sr_memory enable */
+#define CC_SR_CTL0_RSRC_TRIGGER_SHIFT        2 /* Rising edge resource trigger 0 to sr_engine  */
+#define CC_SR_CTL0_MIN_DIV_SHIFT             6 /* Min division value for fast clk in sr_engine */
+#define CC_SR_CTL0_EN_SBC_STBY_SHIFT        16 /* Allow Subcore mem StandBy? */
+#define CC_SR_CTL0_EN_SR_ALP_CLK_MASK_SHIFT 18
+#define CC_SR_CTL0_EN_SR_HT_CLK_SHIFT       19
+#define CC_SR_CTL0_ALLOW_PIC_SHIFT          20 /* Allow pic to separate power domains */
+#define CC_SR_CTL0_MAX_SR_LQ_CLK_CNT_SHIFT  25
+#define CC_SR_CTL0_EN_MEM_DISABLE_FOR_SLEEP 30
+
+#define CC_SR_CTL1_SR_INIT_MASK             0x3FF
+#define CC_SR_CTL1_SR_INIT_SHIFT            0
+
+#define	ECI_INLO_PKTDUR_MASK	0x000000f0 /* [7:4] - 4 bits */
+#define ECI_INLO_PKTDUR_SHIFT	4
+
+/* gci chip control bits */
+#define GCI_GPIO_CHIPCTRL_ENAB_IN_BIT		0
+#define GCI_GPIO_CHIPCTRL_ENAB_OP_BIT		1
+#define GCI_GPIO_CHIPCTRL_INVERT_BIT		2
+#define GCI_GPIO_CHIPCTRL_PULLUP_BIT		3
+#define GCI_GPIO_CHIPCTRL_PULLDN_BIT		4
+#define GCI_GPIO_CHIPCTRL_ENAB_BTSIG_BIT	5
+#define GCI_GPIO_CHIPCTRL_ENAB_OD_OP_BIT	6
+#define GCI_GPIO_CHIPCTRL_ENAB_EXT_GPIO_BIT	7
+
+/* gci GPIO input status bits */
+#define GCI_GPIO_STS_VALUE_BIT			0
+#define GCI_GPIO_STS_POS_EDGE_BIT		1
+#define GCI_GPIO_STS_NEG_EDGE_BIT		2
+#define GCI_GPIO_STS_FAST_EDGE_BIT		3
+#define GCI_GPIO_STS_CLEAR			0xF
+
+#define GCI_GPIO_STS_VALUE	(1 << GCI_GPIO_STS_VALUE_BIT)
+
+#endif	/* _SBCHIPC_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbconfig.h b/drivers/net/wireless/bcm4336/include/sbconfig.h
--- a/drivers/net/wireless/bcm4336/include/sbconfig.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbconfig.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,264 @@
+/*
+ * Broadcom SiliconBackplane hardware register definitions.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sbconfig.h 456346 2014-02-18 16:48:52Z $
+ */
+
+#ifndef	_SBCONFIG_H
+#define	_SBCONFIG_H
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif
+
+/* enumeration in SB is based on the premise that cores are contiguos in the
+ * enumeration space.
+ */
+#define SB_BUS_SIZE		0x10000		/* Each bus gets 64Kbytes for cores */
+#define SB_BUS_BASE(b)		(SI_ENUM_BASE + (b) * SB_BUS_SIZE)
+#define	SB_BUS_MAXCORES		(SB_BUS_SIZE / SI_CORE_SIZE)	/* Max cores per bus */
+
+/*
+ * Sonics Configuration Space Registers.
+ */
+#define	SBCONFIGOFF		0xf00		/* core sbconfig regs are top 256bytes of regs */
+#define	SBCONFIGSIZE		256		/* sizeof (sbconfig_t) */
+
+#define SBIPSFLAG		0x08
+#define SBTPSFLAG		0x18
+#define	SBTMERRLOGA		0x48		/* sonics >= 2.3 */
+#define	SBTMERRLOG		0x50		/* sonics >= 2.3 */
+#define SBADMATCH3		0x60
+#define SBADMATCH2		0x68
+#define SBADMATCH1		0x70
+#define SBIMSTATE		0x90
+#define SBINTVEC		0x94
+#define SBTMSTATELOW		0x98
+#define SBTMSTATEHIGH		0x9c
+#define SBBWA0			0xa0
+#define SBIMCONFIGLOW		0xa8
+#define SBIMCONFIGHIGH		0xac
+#define SBADMATCH0		0xb0
+#define SBTMCONFIGLOW		0xb8
+#define SBTMCONFIGHIGH		0xbc
+#define SBBCONFIG		0xc0
+#define SBBSTATE		0xc8
+#define SBACTCNFG		0xd8
+#define	SBFLAGST		0xe8
+#define SBIDLOW			0xf8
+#define SBIDHIGH		0xfc
+
+/* All the previous registers are above SBCONFIGOFF, but with Sonics 2.3, we have
+ * a few registers *below* that line. I think it would be very confusing to try
+ * and change the value of SBCONFIGOFF, so I'm definig them as absolute offsets here,
+ */
+
+#define SBIMERRLOGA		0xea8
+#define SBIMERRLOG		0xeb0
+#define SBTMPORTCONNID0		0xed8
+#define SBTMPORTLOCK0		0xef8
+
+#if !defined(_LANGUAGE_ASSEMBLY) && !defined(__ASSEMBLY__)
+
+typedef volatile struct _sbconfig {
+	uint32	PAD[2];
+	uint32	sbipsflag;		/* initiator port ocp slave flag */
+	uint32	PAD[3];
+	uint32	sbtpsflag;		/* target port ocp slave flag */
+	uint32	PAD[11];
+	uint32	sbtmerrloga;		/* (sonics >= 2.3) */
+	uint32	PAD;
+	uint32	sbtmerrlog;		/* (sonics >= 2.3) */
+	uint32	PAD[3];
+	uint32	sbadmatch3;		/* address match3 */
+	uint32	PAD;
+	uint32	sbadmatch2;		/* address match2 */
+	uint32	PAD;
+	uint32	sbadmatch1;		/* address match1 */
+	uint32	PAD[7];
+	uint32	sbimstate;		/* initiator agent state */
+	uint32	sbintvec;		/* interrupt mask */
+	uint32	sbtmstatelow;		/* target state */
+	uint32	sbtmstatehigh;		/* target state */
+	uint32	sbbwa0;			/* bandwidth allocation table0 */
+	uint32	PAD;
+	uint32	sbimconfiglow;		/* initiator configuration */
+	uint32	sbimconfighigh;		/* initiator configuration */
+	uint32	sbadmatch0;		/* address match0 */
+	uint32	PAD;
+	uint32	sbtmconfiglow;		/* target configuration */
+	uint32	sbtmconfighigh;		/* target configuration */
+	uint32	sbbconfig;		/* broadcast configuration */
+	uint32	PAD;
+	uint32	sbbstate;		/* broadcast state */
+	uint32	PAD[3];
+	uint32	sbactcnfg;		/* activate configuration */
+	uint32	PAD[3];
+	uint32	sbflagst;		/* current sbflags */
+	uint32	PAD[3];
+	uint32	sbidlow;		/* identification */
+	uint32	sbidhigh;		/* identification */
+} sbconfig_t;
+
+#endif /* !_LANGUAGE_ASSEMBLY && !__ASSEMBLY__ */
+
+/* sbipsflag */
+#define	SBIPS_INT1_MASK		0x3f		/* which sbflags get routed to mips interrupt 1 */
+#define	SBIPS_INT1_SHIFT	0
+#define	SBIPS_INT2_MASK		0x3f00		/* which sbflags get routed to mips interrupt 2 */
+#define	SBIPS_INT2_SHIFT	8
+#define	SBIPS_INT3_MASK		0x3f0000	/* which sbflags get routed to mips interrupt 3 */
+#define	SBIPS_INT3_SHIFT	16
+#define	SBIPS_INT4_MASK		0x3f000000	/* which sbflags get routed to mips interrupt 4 */
+#define	SBIPS_INT4_SHIFT	24
+
+/* sbtpsflag */
+#define	SBTPS_NUM0_MASK		0x3f		/* interrupt sbFlag # generated by this core */
+#define	SBTPS_F0EN0		0x40		/* interrupt is always sent on the backplane */
+
+/* sbtmerrlog */
+#define	SBTMEL_CM		0x00000007	/* command */
+#define	SBTMEL_CI		0x0000ff00	/* connection id */
+#define	SBTMEL_EC		0x0f000000	/* error code */
+#define	SBTMEL_ME		0x80000000	/* multiple error */
+
+/* sbimstate */
+#define	SBIM_PC			0xf		/* pipecount */
+#define	SBIM_AP_MASK		0x30		/* arbitration policy */
+#define	SBIM_AP_BOTH		0x00		/* use both timeslaces and token */
+#define	SBIM_AP_TS		0x10		/* use timesliaces only */
+#define	SBIM_AP_TK		0x20		/* use token only */
+#define	SBIM_AP_RSV		0x30		/* reserved */
+#define	SBIM_IBE		0x20000		/* inbanderror */
+#define	SBIM_TO			0x40000		/* timeout */
+#define	SBIM_BY			0x01800000	/* busy (sonics >= 2.3) */
+#define	SBIM_RJ			0x02000000	/* reject (sonics >= 2.3) */
+
+/* sbtmstatelow */
+#define	SBTML_RESET		0x0001		/* reset */
+#define	SBTML_REJ_MASK		0x0006		/* reject field */
+#define	SBTML_REJ		0x0002		/* reject */
+#define	SBTML_TMPREJ		0x0004		/* temporary reject, for error recovery */
+
+#define	SBTML_SICF_SHIFT	16		/* Shift to locate the SI control flags in sbtml */
+
+/* sbtmstatehigh */
+#define	SBTMH_SERR		0x0001		/* serror */
+#define	SBTMH_INT		0x0002		/* interrupt */
+#define	SBTMH_BUSY		0x0004		/* busy */
+#define	SBTMH_TO		0x0020		/* timeout (sonics >= 2.3) */
+
+#define	SBTMH_SISF_SHIFT	16		/* Shift to locate the SI status flags in sbtmh */
+
+/* sbbwa0 */
+#define	SBBWA_TAB0_MASK		0xffff		/* lookup table 0 */
+#define	SBBWA_TAB1_MASK		0xffff		/* lookup table 1 */
+#define	SBBWA_TAB1_SHIFT	16
+
+/* sbimconfiglow */
+#define	SBIMCL_STO_MASK		0x7		/* service timeout */
+#define	SBIMCL_RTO_MASK		0x70		/* request timeout */
+#define	SBIMCL_RTO_SHIFT	4
+#define	SBIMCL_CID_MASK		0xff0000	/* connection id */
+#define	SBIMCL_CID_SHIFT	16
+
+/* sbimconfighigh */
+#define	SBIMCH_IEM_MASK		0xc		/* inband error mode */
+#define	SBIMCH_TEM_MASK		0x30		/* timeout error mode */
+#define	SBIMCH_TEM_SHIFT	4
+#define	SBIMCH_BEM_MASK		0xc0		/* bus error mode */
+#define	SBIMCH_BEM_SHIFT	6
+
+/* sbadmatch0 */
+#define	SBAM_TYPE_MASK		0x3		/* address type */
+#define	SBAM_AD64		0x4		/* reserved */
+#define	SBAM_ADINT0_MASK	0xf8		/* type0 size */
+#define	SBAM_ADINT0_SHIFT	3
+#define	SBAM_ADINT1_MASK	0x1f8		/* type1 size */
+#define	SBAM_ADINT1_SHIFT	3
+#define	SBAM_ADINT2_MASK	0x1f8		/* type2 size */
+#define	SBAM_ADINT2_SHIFT	3
+#define	SBAM_ADEN		0x400		/* enable */
+#define	SBAM_ADNEG		0x800		/* negative decode */
+#define	SBAM_BASE0_MASK		0xffffff00	/* type0 base address */
+#define	SBAM_BASE0_SHIFT	8
+#define	SBAM_BASE1_MASK		0xfffff000	/* type1 base address for the core */
+#define	SBAM_BASE1_SHIFT	12
+#define	SBAM_BASE2_MASK		0xffff0000	/* type2 base address for the core */
+#define	SBAM_BASE2_SHIFT	16
+
+/* sbtmconfiglow */
+#define	SBTMCL_CD_MASK		0xff		/* clock divide */
+#define	SBTMCL_CO_MASK		0xf800		/* clock offset */
+#define	SBTMCL_CO_SHIFT		11
+#define	SBTMCL_IF_MASK		0xfc0000	/* interrupt flags */
+#define	SBTMCL_IF_SHIFT		18
+#define	SBTMCL_IM_MASK		0x3000000	/* interrupt mode */
+#define	SBTMCL_IM_SHIFT		24
+
+/* sbtmconfighigh */
+#define	SBTMCH_BM_MASK		0x3		/* busy mode */
+#define	SBTMCH_RM_MASK		0x3		/* retry mode */
+#define	SBTMCH_RM_SHIFT		2
+#define	SBTMCH_SM_MASK		0x30		/* stop mode */
+#define	SBTMCH_SM_SHIFT		4
+#define	SBTMCH_EM_MASK		0x300		/* sb error mode */
+#define	SBTMCH_EM_SHIFT		8
+#define	SBTMCH_IM_MASK		0xc00		/* int mode */
+#define	SBTMCH_IM_SHIFT		10
+
+/* sbbconfig */
+#define	SBBC_LAT_MASK		0x3		/* sb latency */
+#define	SBBC_MAX0_MASK		0xf0000		/* maxccntr0 */
+#define	SBBC_MAX0_SHIFT		16
+#define	SBBC_MAX1_MASK		0xf00000	/* maxccntr1 */
+#define	SBBC_MAX1_SHIFT		20
+
+/* sbbstate */
+#define	SBBS_SRD		0x1		/* st reg disable */
+#define	SBBS_HRD		0x2		/* hold reg disable */
+
+/* sbidlow */
+#define	SBIDL_CS_MASK		0x3		/* config space */
+#define	SBIDL_AR_MASK		0x38		/* # address ranges supported */
+#define	SBIDL_AR_SHIFT		3
+#define	SBIDL_SYNCH		0x40		/* sync */
+#define	SBIDL_INIT		0x80		/* initiator */
+#define	SBIDL_MINLAT_MASK	0xf00		/* minimum backplane latency */
+#define	SBIDL_MINLAT_SHIFT	8
+#define	SBIDL_MAXLAT		0xf000		/* maximum backplane latency */
+#define	SBIDL_MAXLAT_SHIFT	12
+#define	SBIDL_FIRST		0x10000		/* this initiator is first */
+#define	SBIDL_CW_MASK		0xc0000		/* cycle counter width */
+#define	SBIDL_CW_SHIFT		18
+#define	SBIDL_TP_MASK		0xf00000	/* target ports */
+#define	SBIDL_TP_SHIFT		20
+#define	SBIDL_IP_MASK		0xf000000	/* initiator ports */
+#define	SBIDL_IP_SHIFT		24
+#define	SBIDL_RV_MASK		0xf0000000	/* sonics backplane revision code */
+#define	SBIDL_RV_SHIFT		28
+#define	SBIDL_RV_2_2		0x00000000	/* version 2.2 or earlier */
+#define	SBIDL_RV_2_3		0x10000000	/* version 2.3 */
+
+/* sbidhigh */
+#define	SBIDH_RC_MASK		0x000f		/* revision code */
+#define	SBIDH_RCE_MASK		0x7000		/* revision code extension field */
+#define	SBIDH_RCE_SHIFT		8
+#define	SBCOREREV(sbidh) \
+	((((sbidh) & SBIDH_RCE_MASK) >> SBIDH_RCE_SHIFT) | ((sbidh) & SBIDH_RC_MASK))
+#define	SBIDH_CC_MASK		0x8ff0		/* core code */
+#define	SBIDH_CC_SHIFT		4
+#define	SBIDH_VC_MASK		0xffff0000	/* vendor code */
+#define	SBIDH_VC_SHIFT		16
+
+#define	SB_COMMIT		0xfd8		/* update buffered registers value */
+
+/* vendor codes */
+#define	SB_VEND_BCM		0x4243		/* Broadcom's SB vendor code */
+
+#endif	/* _SBCONFIG_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbhnddma.h b/drivers/net/wireless/bcm4336/include/sbhnddma.h
--- a/drivers/net/wireless/bcm4336/include/sbhnddma.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbhnddma.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,399 @@
+/*
+ * Generic Broadcom Home Networking Division (HND) DMA engine HW interface
+ * This supports the following chips: BCM42xx, 44xx, 47xx .
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sbhnddma.h 452424 2014-01-30 09:43:39Z $
+ */
+
+#ifndef	_sbhnddma_h_
+#define	_sbhnddma_h_
+
+/* DMA structure:
+ *  support two DMA engines: 32 bits address or 64 bit addressing
+ *  basic DMA register set is per channel(transmit or receive)
+ *  a pair of channels is defined for convenience
+ */
+
+
+/* 32 bits addressing */
+
+/* dma registers per channel(xmt or rcv) */
+typedef volatile struct {
+	uint32	control;		/* enable, et al */
+	uint32	addr;			/* descriptor ring base address (4K aligned) */
+	uint32	ptr;			/* last descriptor posted to chip */
+	uint32	status;			/* current active descriptor, et al */
+} dma32regs_t;
+
+typedef volatile struct {
+	dma32regs_t	xmt;		/* dma tx channel */
+	dma32regs_t	rcv;		/* dma rx channel */
+} dma32regp_t;
+
+typedef volatile struct {	/* diag access */
+	uint32	fifoaddr;		/* diag address */
+	uint32	fifodatalow;		/* low 32bits of data */
+	uint32	fifodatahigh;		/* high 32bits of data */
+	uint32	pad;			/* reserved */
+} dma32diag_t;
+
+/*
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+	uint32	ctrl;		/* misc control bits & bufcount */
+	uint32	addr;		/* data buffer address */
+} dma32dd_t;
+
+/*
+ * Each descriptor ring must be 4096byte aligned, and fit within a single 4096byte page.
+ */
+#define	D32RINGALIGN_BITS	12
+#define	D32MAXRINGSZ		(1 << D32RINGALIGN_BITS)
+#define	D32RINGALIGN		(1 << D32RINGALIGN_BITS)
+
+#define	D32MAXDD	(D32MAXRINGSZ / sizeof (dma32dd_t))
+
+/* transmit channel control */
+#define	XC_XE		((uint32)1 << 0)	/* transmit enable */
+#define	XC_SE		((uint32)1 << 1)	/* transmit suspend request */
+#define	XC_LE		((uint32)1 << 2)	/* loopback enable */
+#define	XC_FL		((uint32)1 << 4)	/* flush request */
+#define XC_MR_MASK	0x000001C0		/* Multiple outstanding reads */
+#define XC_MR_SHIFT	6
+#define	XC_PD		((uint32)1 << 11)	/* parity check disable */
+#define	XC_AE		((uint32)3 << 16)	/* address extension bits */
+#define	XC_AE_SHIFT	16
+#define XC_BL_MASK	0x001C0000		/* BurstLen bits */
+#define XC_BL_SHIFT	18
+#define XC_PC_MASK	0x00E00000		/* Prefetch control */
+#define XC_PC_SHIFT	21
+#define XC_PT_MASK	0x03000000		/* Prefetch threshold */
+#define XC_PT_SHIFT	24
+
+/* Multiple outstanding reads */
+#define DMA_MR_1	0
+#define DMA_MR_2	1
+#define DMA_MR_4	2
+#define DMA_MR_8	3
+#define DMA_MR_12	4
+#define DMA_MR_16	5
+#define DMA_MR_20	6
+#define DMA_MR_32	7
+
+/* DMA Burst Length in bytes */
+#define DMA_BL_16	0
+#define DMA_BL_32	1
+#define DMA_BL_64	2
+#define DMA_BL_128	3
+#define DMA_BL_256	4
+#define DMA_BL_512	5
+#define DMA_BL_1024	6
+
+/* Prefetch control */
+#define DMA_PC_0	0
+#define DMA_PC_4	1
+#define DMA_PC_8	2
+#define DMA_PC_16	3
+/* others: reserved */
+
+/* Prefetch threshold */
+#define DMA_PT_1	0
+#define DMA_PT_2	1
+#define DMA_PT_4	2
+#define DMA_PT_8	3
+
+/* transmit descriptor table pointer */
+#define	XP_LD_MASK	0xfff			/* last valid descriptor */
+
+/* transmit channel status */
+#define	XS_CD_MASK	0x0fff			/* current descriptor pointer */
+#define	XS_XS_MASK	0xf000			/* transmit state */
+#define	XS_XS_SHIFT	12
+#define	XS_XS_DISABLED	0x0000			/* disabled */
+#define	XS_XS_ACTIVE	0x1000			/* active */
+#define	XS_XS_IDLE	0x2000			/* idle wait */
+#define	XS_XS_STOPPED	0x3000			/* stopped */
+#define	XS_XS_SUSP	0x4000			/* suspend pending */
+#define	XS_XE_MASK	0xf0000			/* transmit errors */
+#define	XS_XE_SHIFT	16
+#define	XS_XE_NOERR	0x00000			/* no error */
+#define	XS_XE_DPE	0x10000			/* descriptor protocol error */
+#define	XS_XE_DFU	0x20000			/* data fifo underrun */
+#define	XS_XE_BEBR	0x30000			/* bus error on buffer read */
+#define	XS_XE_BEDA	0x40000			/* bus error on descriptor access */
+#define	XS_AD_MASK	0xfff00000		/* active descriptor */
+#define	XS_AD_SHIFT	20
+
+/* receive channel control */
+#define	RC_RE		((uint32)1 << 0)	/* receive enable */
+#define	RC_RO_MASK	0xfe			/* receive frame offset */
+#define	RC_RO_SHIFT	1
+#define	RC_FM		((uint32)1 << 8)	/* direct fifo receive (pio) mode */
+#define	RC_SH		((uint32)1 << 9)	/* separate rx header descriptor enable */
+#define	RC_OC		((uint32)1 << 10)	/* overflow continue */
+#define	RC_PD		((uint32)1 << 11)	/* parity check disable */
+#define	RC_AE		((uint32)3 << 16)	/* address extension bits */
+#define	RC_AE_SHIFT	16
+#define RC_BL_MASK	0x001C0000		/* BurstLen bits */
+#define RC_BL_SHIFT	18
+#define RC_PC_MASK	0x00E00000		/* Prefetch control */
+#define RC_PC_SHIFT	21
+#define RC_PT_MASK	0x03000000		/* Prefetch threshold */
+#define RC_PT_SHIFT	24
+
+/* receive descriptor table pointer */
+#define	RP_LD_MASK	0xfff			/* last valid descriptor */
+
+/* receive channel status */
+#define	RS_CD_MASK	0x0fff			/* current descriptor pointer */
+#define	RS_RS_MASK	0xf000			/* receive state */
+#define	RS_RS_SHIFT	12
+#define	RS_RS_DISABLED	0x0000			/* disabled */
+#define	RS_RS_ACTIVE	0x1000			/* active */
+#define	RS_RS_IDLE	0x2000			/* idle wait */
+#define	RS_RS_STOPPED	0x3000			/* reserved */
+#define	RS_RE_MASK	0xf0000			/* receive errors */
+#define	RS_RE_SHIFT	16
+#define	RS_RE_NOERR	0x00000			/* no error */
+#define	RS_RE_DPE	0x10000			/* descriptor protocol error */
+#define	RS_RE_DFO	0x20000			/* data fifo overflow */
+#define	RS_RE_BEBW	0x30000			/* bus error on buffer write */
+#define	RS_RE_BEDA	0x40000			/* bus error on descriptor access */
+#define	RS_AD_MASK	0xfff00000		/* active descriptor */
+#define	RS_AD_SHIFT	20
+
+/* fifoaddr */
+#define	FA_OFF_MASK	0xffff			/* offset */
+#define	FA_SEL_MASK	0xf0000			/* select */
+#define	FA_SEL_SHIFT	16
+#define	FA_SEL_XDD	0x00000			/* transmit dma data */
+#define	FA_SEL_XDP	0x10000			/* transmit dma pointers */
+#define	FA_SEL_RDD	0x40000			/* receive dma data */
+#define	FA_SEL_RDP	0x50000			/* receive dma pointers */
+#define	FA_SEL_XFD	0x80000			/* transmit fifo data */
+#define	FA_SEL_XFP	0x90000			/* transmit fifo pointers */
+#define	FA_SEL_RFD	0xc0000			/* receive fifo data */
+#define	FA_SEL_RFP	0xd0000			/* receive fifo pointers */
+#define	FA_SEL_RSD	0xe0000			/* receive frame status data */
+#define	FA_SEL_RSP	0xf0000			/* receive frame status pointers */
+
+/* descriptor control flags */
+#define	CTRL_BC_MASK	0x00001fff		/* buffer byte count, real data len must <= 4KB */
+#define	CTRL_AE		((uint32)3 << 16)	/* address extension bits */
+#define	CTRL_AE_SHIFT	16
+#define	CTRL_PARITY	((uint32)3 << 18)	/* parity bit */
+#define	CTRL_EOT	((uint32)1 << 28)	/* end of descriptor table */
+#define	CTRL_IOC	((uint32)1 << 29)	/* interrupt on completion */
+#define	CTRL_EOF	((uint32)1 << 30)	/* end of frame */
+#define	CTRL_SOF	((uint32)1 << 31)	/* start of frame */
+
+/* control flags in the range [27:20] are core-specific and not defined here */
+#define	CTRL_CORE_MASK	0x0ff00000
+
+/* 64 bits addressing */
+
+/* dma registers per channel(xmt or rcv) */
+typedef volatile struct {
+	uint32	control;		/* enable, et al */
+	uint32	ptr;			/* last descriptor posted to chip */
+	uint32	addrlow;		/* descriptor ring base address low 32-bits (8K aligned) */
+	uint32	addrhigh;		/* descriptor ring base address bits 63:32 (8K aligned) */
+	uint32	status0;		/* current descriptor, xmt state */
+	uint32	status1;		/* active descriptor, xmt error */
+} dma64regs_t;
+
+typedef volatile struct {
+	dma64regs_t	tx;		/* dma64 tx channel */
+	dma64regs_t	rx;		/* dma64 rx channel */
+} dma64regp_t;
+
+typedef volatile struct {		/* diag access */
+	uint32	fifoaddr;		/* diag address */
+	uint32	fifodatalow;		/* low 32bits of data */
+	uint32	fifodatahigh;		/* high 32bits of data */
+	uint32	pad;			/* reserved */
+} dma64diag_t;
+
+/*
+ * DMA Descriptor
+ * Descriptors are only read by the hardware, never written back.
+ */
+typedef volatile struct {
+	uint32	ctrl1;		/* misc control bits */
+	uint32	ctrl2;		/* buffer count and address extension */
+	uint32	addrlow;	/* memory address of the date buffer, bits 31:0 */
+	uint32	addrhigh;	/* memory address of the date buffer, bits 63:32 */
+} dma64dd_t;
+
+/*
+ * Each descriptor ring must be 8kB aligned, and fit within a contiguous 8kB physical addresss.
+ */
+#define D64RINGALIGN_BITS	13
+#define	D64MAXRINGSZ		(1 << D64RINGALIGN_BITS)
+#define	D64RINGBOUNDARY		(1 << D64RINGALIGN_BITS)
+
+#define	D64MAXDD	(D64MAXRINGSZ / sizeof (dma64dd_t))
+
+/* for cores with large descriptor ring support, descriptor ring size can be up to 4096 */
+#define	D64MAXDD_LARGE		((1 << 16) / sizeof (dma64dd_t))
+
+/* for cores with large descriptor ring support (4k descriptors), descriptor ring cannot cross
+ * 64K boundary
+ */
+#define	D64RINGBOUNDARY_LARGE	(1 << 16)
+
+/*
+ * Default DMA Burstlen values for USBRev >= 12 and SDIORev >= 11.
+ * When this field contains the value N, the burst length is 2**(N + 4) bytes.
+ */
+#define D64_DEF_USBBURSTLEN     2
+#define D64_DEF_SDIOBURSTLEN    1
+
+
+#ifndef D64_USBBURSTLEN
+#define D64_USBBURSTLEN	DMA_BL_64
+#endif
+#ifndef D64_SDIOBURSTLEN
+#define D64_SDIOBURSTLEN	DMA_BL_32
+#endif
+
+/* transmit channel control */
+#define	D64_XC_XE		0x00000001	/* transmit enable */
+#define	D64_XC_SE		0x00000002	/* transmit suspend request */
+#define	D64_XC_LE		0x00000004	/* loopback enable */
+#define	D64_XC_FL		0x00000010	/* flush request */
+#define D64_XC_MR_MASK		0x000001C0	/* Multiple outstanding reads */
+#define D64_XC_MR_SHIFT		6
+#define	D64_XC_PD		0x00000800	/* parity check disable */
+#define	D64_XC_AE		0x00030000	/* address extension bits */
+#define	D64_XC_AE_SHIFT		16
+#define D64_XC_BL_MASK		0x001C0000	/* BurstLen bits */
+#define D64_XC_BL_SHIFT		18
+#define D64_XC_PC_MASK		0x00E00000		/* Prefetch control */
+#define D64_XC_PC_SHIFT		21
+#define D64_XC_PT_MASK		0x03000000		/* Prefetch threshold */
+#define D64_XC_PT_SHIFT		24
+
+/* transmit descriptor table pointer */
+#define	D64_XP_LD_MASK		0x00001fff	/* last valid descriptor */
+
+/* transmit channel status */
+#define	D64_XS0_CD_MASK		(di->d64_xs0_cd_mask)	/* current descriptor pointer */
+#define	D64_XS0_XS_MASK		0xf0000000     	/* transmit state */
+#define	D64_XS0_XS_SHIFT		28
+#define	D64_XS0_XS_DISABLED	0x00000000	/* disabled */
+#define	D64_XS0_XS_ACTIVE	0x10000000	/* active */
+#define	D64_XS0_XS_IDLE		0x20000000	/* idle wait */
+#define	D64_XS0_XS_STOPPED	0x30000000	/* stopped */
+#define	D64_XS0_XS_SUSP		0x40000000	/* suspend pending */
+
+#define	D64_XS1_AD_MASK		(di->d64_xs1_ad_mask)	/* active descriptor */
+#define	D64_XS1_XE_MASK		0xf0000000     	/* transmit errors */
+#define	D64_XS1_XE_SHIFT		28
+#define	D64_XS1_XE_NOERR	0x00000000	/* no error */
+#define	D64_XS1_XE_DPE		0x10000000	/* descriptor protocol error */
+#define	D64_XS1_XE_DFU		0x20000000	/* data fifo underrun */
+#define	D64_XS1_XE_DTE		0x30000000	/* data transfer error */
+#define	D64_XS1_XE_DESRE	0x40000000	/* descriptor read error */
+#define	D64_XS1_XE_COREE	0x50000000	/* core error */
+
+/* receive channel control */
+#define	D64_RC_RE		0x00000001	/* receive enable */
+#define	D64_RC_RO_MASK		0x000000fe	/* receive frame offset */
+#define	D64_RC_RO_SHIFT		1
+#define	D64_RC_FM		0x00000100	/* direct fifo receive (pio) mode */
+#define	D64_RC_SH		0x00000200	/* separate rx header descriptor enable */
+#define	D64_RC_SHIFT		9	/* separate rx header descriptor enable */
+#define	D64_RC_OC		0x00000400	/* overflow continue */
+#define	D64_RC_PD		0x00000800	/* parity check disable */
+#define D64_RC_GE		0x00004000	/* Glom enable */
+#define	D64_RC_AE		0x00030000	/* address extension bits */
+#define	D64_RC_AE_SHIFT		16
+#define D64_RC_BL_MASK		0x001C0000	/* BurstLen bits */
+#define D64_RC_BL_SHIFT		18
+#define D64_RC_PC_MASK		0x00E00000	/* Prefetch control */
+#define D64_RC_PC_SHIFT		21
+#define D64_RC_PT_MASK		0x03000000	/* Prefetch threshold */
+#define D64_RC_PT_SHIFT		24
+
+/* flags for dma controller */
+#define DMA_CTRL_PEN		(1 << 0)	/* partity enable */
+#define DMA_CTRL_ROC		(1 << 1)	/* rx overflow continue */
+#define DMA_CTRL_RXMULTI	(1 << 2)	/* allow rx scatter to multiple descriptors */
+#define DMA_CTRL_UNFRAMED	(1 << 3)	/* Unframed Rx/Tx data */
+#define DMA_CTRL_USB_BOUNDRY4KB_WAR (1 << 4)
+#define DMA_CTRL_DMA_AVOIDANCE_WAR (1 << 5)	/* DMA avoidance WAR for 4331 */
+#define DMA_CTRL_RXSINGLE	(1 << 6)	/* always single buffer */
+#define DMA_CTRL_SDIO_RXGLOM	(1 << 7)	/* DMA Rx glome is enabled */
+
+/* receive descriptor table pointer */
+#define	D64_RP_LD_MASK		0x00001fff	/* last valid descriptor */
+
+/* receive channel status */
+#define	D64_RS0_CD_MASK		(di->d64_rs0_cd_mask)	/* current descriptor pointer */
+#define	D64_RS0_RS_MASK		0xf0000000     	/* receive state */
+#define	D64_RS0_RS_SHIFT		28
+#define	D64_RS0_RS_DISABLED	0x00000000	/* disabled */
+#define	D64_RS0_RS_ACTIVE	0x10000000	/* active */
+#define	D64_RS0_RS_IDLE		0x20000000	/* idle wait */
+#define	D64_RS0_RS_STOPPED	0x30000000	/* stopped */
+#define	D64_RS0_RS_SUSP		0x40000000	/* suspend pending */
+
+#define	D64_RS1_AD_MASK		0x0001ffff	/* active descriptor */
+#define	D64_RS1_RE_MASK		0xf0000000     	/* receive errors */
+#define	D64_RS1_RE_SHIFT		28
+#define	D64_RS1_RE_NOERR	0x00000000	/* no error */
+#define	D64_RS1_RE_DPO		0x10000000	/* descriptor protocol error */
+#define	D64_RS1_RE_DFU		0x20000000	/* data fifo overflow */
+#define	D64_RS1_RE_DTE		0x30000000	/* data transfer error */
+#define	D64_RS1_RE_DESRE	0x40000000	/* descriptor read error */
+#define	D64_RS1_RE_COREE	0x50000000	/* core error */
+
+/* fifoaddr */
+#define	D64_FA_OFF_MASK		0xffff		/* offset */
+#define	D64_FA_SEL_MASK		0xf0000		/* select */
+#define	D64_FA_SEL_SHIFT	16
+#define	D64_FA_SEL_XDD		0x00000		/* transmit dma data */
+#define	D64_FA_SEL_XDP		0x10000		/* transmit dma pointers */
+#define	D64_FA_SEL_RDD		0x40000		/* receive dma data */
+#define	D64_FA_SEL_RDP		0x50000		/* receive dma pointers */
+#define	D64_FA_SEL_XFD		0x80000		/* transmit fifo data */
+#define	D64_FA_SEL_XFP		0x90000		/* transmit fifo pointers */
+#define	D64_FA_SEL_RFD		0xc0000		/* receive fifo data */
+#define	D64_FA_SEL_RFP		0xd0000		/* receive fifo pointers */
+#define	D64_FA_SEL_RSD		0xe0000		/* receive frame status data */
+#define	D64_FA_SEL_RSP		0xf0000		/* receive frame status pointers */
+
+/* descriptor control flags 1 */
+#define D64_CTRL_COREFLAGS	0x0ff00000	/* core specific flags */
+#define	D64_CTRL1_NOTPCIE	((uint32)1 << 18)	/* buirst size control */
+#define	D64_CTRL1_EOT		((uint32)1 << 28)	/* end of descriptor table */
+#define	D64_CTRL1_IOC		((uint32)1 << 29)	/* interrupt on completion */
+#define	D64_CTRL1_EOF		((uint32)1 << 30)	/* end of frame */
+#define	D64_CTRL1_SOF		((uint32)1 << 31)	/* start of frame */
+
+/* descriptor control flags 2 */
+#define	D64_CTRL2_BC_MASK	0x00007fff	/* buffer byte count. real data len must <= 16KB */
+#define	D64_CTRL2_AE		0x00030000	/* address extension bits */
+#define	D64_CTRL2_AE_SHIFT	16
+#define D64_CTRL2_PARITY	0x00040000      /* parity bit */
+
+/* control flags in the range [27:20] are core-specific and not defined here */
+#define	D64_CTRL_CORE_MASK	0x0ff00000
+
+#define D64_RX_FRM_STS_LEN	0x0000ffff	/* frame length mask */
+#define D64_RX_FRM_STS_OVFL	0x00800000	/* RxOverFlow */
+#define D64_RX_FRM_STS_DSCRCNT	0x0f000000	/* no. of descriptors used - 1, d11corerev >= 22 */
+#define D64_RX_FRM_STS_DATATYPE	0xf0000000	/* core-dependent data type */
+
+/* receive frame status */
+typedef volatile struct {
+	uint16 len;
+	uint16 flags;
+} dma_rxh_t;
+
+#endif	/* _sbhnddma_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbpcmcia.h b/drivers/net/wireless/bcm4336/include/sbpcmcia.h
--- a/drivers/net/wireless/bcm4336/include/sbpcmcia.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbpcmcia.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,352 @@
+/*
+ * BCM43XX Sonics SiliconBackplane PCMCIA core hardware definitions.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sbpcmcia.h 446298 2014-01-03 11:30:17Z $
+ */
+
+#ifndef	_SBPCMCIA_H
+#define	_SBPCMCIA_H
+
+/* All the addresses that are offsets in attribute space are divided
+ * by two to account for the fact that odd bytes are invalid in
+ * attribute space and our read/write routines make the space appear
+ * as if they didn't exist. Still we want to show the original numbers
+ * as documented in the hnd_pcmcia core manual.
+ */
+
+/* PCMCIA Function Configuration Registers */
+#define	PCMCIA_FCR		(0x700 / 2)
+
+#define	FCR0_OFF		0
+#define	FCR1_OFF		(0x40 / 2)
+#define	FCR2_OFF		(0x80 / 2)
+#define	FCR3_OFF		(0xc0 / 2)
+
+#define	PCMCIA_FCR0		(0x700 / 2)
+#define	PCMCIA_FCR1		(0x740 / 2)
+#define	PCMCIA_FCR2		(0x780 / 2)
+#define	PCMCIA_FCR3		(0x7c0 / 2)
+
+/* Standard PCMCIA FCR registers */
+
+#define	PCMCIA_COR		0
+
+#define	COR_RST			0x80
+#define	COR_LEV			0x40
+#define	COR_IRQEN		0x04
+#define	COR_BLREN		0x01
+#define	COR_FUNEN		0x01
+
+
+#define	PCICIA_FCSR		(2 / 2)
+#define	PCICIA_PRR		(4 / 2)
+#define	PCICIA_SCR		(6 / 2)
+#define	PCICIA_ESR		(8 / 2)
+
+
+#define PCM_MEMOFF		0x0000
+#define F0_MEMOFF		0x1000
+#define F1_MEMOFF		0x2000
+#define F2_MEMOFF		0x3000
+#define F3_MEMOFF		0x4000
+
+/* Memory base in the function fcr's */
+#define MEM_ADDR0		(0x728 / 2)
+#define MEM_ADDR1		(0x72a / 2)
+#define MEM_ADDR2		(0x72c / 2)
+
+/* PCMCIA base plus Srom access in fcr0: */
+#define PCMCIA_ADDR0		(0x072e / 2)
+#define PCMCIA_ADDR1		(0x0730 / 2)
+#define PCMCIA_ADDR2		(0x0732 / 2)
+
+#define MEM_SEG			(0x0734 / 2)
+#define SROM_CS			(0x0736 / 2)
+#define SROM_DATAL		(0x0738 / 2)
+#define SROM_DATAH		(0x073a / 2)
+#define SROM_ADDRL		(0x073c / 2)
+#define SROM_ADDRH		(0x073e / 2)
+#define	SROM_INFO2		(0x0772 / 2)	/* Corerev >= 2 && <= 5 */
+#define	SROM_INFO		(0x07be / 2)	/* Corerev >= 6 */
+
+/*  Values for srom_cs: */
+#define SROM_IDLE		0
+#define SROM_WRITE		1
+#define SROM_READ		2
+#define SROM_WEN		4
+#define SROM_WDS		7
+#define SROM_DONE		8
+
+/* Fields in srom_info: */
+#define	SRI_SZ_MASK		0x03
+#define	SRI_BLANK		0x04
+#define	SRI_OTP			0x80
+
+#if !defined(LINUX_POSTMOGRIFY_REMOVAL)
+/* CIS stuff */
+
+/* The CIS stops where the FCRs start */
+#define	CIS_SIZE		PCMCIA_FCR
+#define CIS_SIZE_12K    1154    /* Maximum h/w + s/w sub region size for 12k OTP */
+
+/* CIS tuple length field max */
+#define CIS_TUPLE_LEN_MAX	0xff
+
+/* Standard tuples we know about */
+
+#define CISTPL_NULL			0x00
+#define	CISTPL_VERS_1		0x15		/* CIS ver, manf, dev & ver strings */
+#define	CISTPL_MANFID		0x20		/* Manufacturer and device id */
+#define CISTPL_FUNCID		0x21		/* Function identification */
+#define	CISTPL_FUNCE		0x22		/* Function extensions */
+#define	CISTPL_CFTABLE		0x1b		/* Config table entry */
+#define	CISTPL_END		0xff		/* End of the CIS tuple chain */
+
+/* Function identifier provides context for the function extentions tuple */
+#define CISTPL_FID_SDIO		0x0c		/* Extensions defined by SDIO spec */
+
+/* Function extensions for LANs (assumed for extensions other than SDIO) */
+#define	LAN_TECH		1		/* Technology type */
+#define	LAN_SPEED		2		/* Raw bit rate */
+#define	LAN_MEDIA		3		/* Transmission media */
+#define	LAN_NID			4		/* Node identification (aka MAC addr) */
+#define	LAN_CONN		5		/* Connector standard */
+
+
+/* CFTable */
+#define CFTABLE_REGWIN_2K	0x08		/* 2k reg windows size */
+#define CFTABLE_REGWIN_4K	0x10		/* 4k reg windows size */
+#define CFTABLE_REGWIN_8K	0x20		/* 8k reg windows size */
+
+/* Vendor unique tuples are 0x80-0x8f. Within Broadcom we'll
+ * take one for HNBU, and use "extensions" (a la FUNCE) within it.
+ */
+
+#define	CISTPL_BRCM_HNBU	0x80
+
+/* Subtypes of BRCM_HNBU: */
+
+#define HNBU_SROMREV		0x00	/* A byte with sromrev, 1 if not present */
+#define HNBU_CHIPID		0x01	/* Two 16bit values: PCI vendor & device id */
+#define HNBU_BOARDREV		0x02	/* One byte board revision */
+#define HNBU_PAPARMS		0x03	/* PA parameters: 8 (sromrev == 1)
+					 * or 9 (sromrev > 1) bytes
+					 */
+#define HNBU_OEM		0x04	/* Eight bytes OEM data (sromrev == 1) */
+#define HNBU_CC			0x05	/* Default country code (sromrev == 1) */
+#define	HNBU_AA			0x06	/* Antennas available */
+#define	HNBU_AG			0x07	/* Antenna gain */
+#define HNBU_BOARDFLAGS		0x08	/* board flags (2 or 4 bytes) */
+#define HNBU_LEDS		0x09	/* LED set */
+#define HNBU_CCODE		0x0a	/* Country code (2 bytes ascii + 1 byte cctl)
+					 * in rev 2
+					 */
+#define HNBU_CCKPO		0x0b	/* 2 byte cck power offsets in rev 3 */
+#define HNBU_OFDMPO		0x0c	/* 4 byte 11g ofdm power offsets in rev 3 */
+#define HNBU_GPIOTIMER		0x0d	/* 2 bytes with on/off values in rev 3 */
+#define HNBU_PAPARMS5G		0x0e	/* 5G PA params */
+#define HNBU_ANT5G		0x0f	/* 4328 5G antennas available/gain */
+#define HNBU_RDLID		0x10	/* 2 byte USB remote downloader (RDL) product Id */
+#define HNBU_RSSISMBXA2G	0x11	/* 4328 2G RSSI mid pt sel & board switch arch,
+					 * 2 bytes, rev 3.
+					 */
+#define HNBU_RSSISMBXA5G	0x12	/* 4328 5G RSSI mid pt sel & board switch arch,
+					 * 2 bytes, rev 3.
+					 */
+#define HNBU_XTALFREQ		0x13	/* 4 byte Crystal frequency in kilohertz */
+#define HNBU_TRI2G		0x14	/* 4328 2G TR isolation, 1 byte */
+#define HNBU_TRI5G		0x15	/* 4328 5G TR isolation, 3 bytes */
+#define HNBU_RXPO2G		0x16	/* 4328 2G RX power offset, 1 byte */
+#define HNBU_RXPO5G		0x17	/* 4328 5G RX power offset, 1 byte */
+#define HNBU_BOARDNUM		0x18	/* board serial number, independent of mac addr */
+#define HNBU_MACADDR		0x19	/* mac addr override for the standard CIS LAN_NID */
+#define HNBU_RDLSN		0x1a	/* 2 bytes; serial # advertised in USB descriptor */
+#define HNBU_BOARDTYPE		0x1b	/* 2 bytes; boardtype */
+#define HNBU_LEDDC		0x1c	/* 2 bytes; LED duty cycle */
+#define HNBU_HNBUCIS		0x1d	/* what follows is proprietary HNBU CIS format */
+#define HNBU_PAPARMS_SSLPNPHY	0x1e	/* SSLPNPHY PA params */
+#define HNBU_RSSISMBXA2G_SSLPNPHY 0x1f /* SSLPNPHY RSSI mid pt sel & board switch arch */
+#define HNBU_RDLRNDIS		0x20	/* 1 byte; 1 = RDL advertises RNDIS config */
+#define HNBU_CHAINSWITCH	0x21	/* 2 byte; txchain, rxchain */
+#define HNBU_REGREV		0x22	/* 1 byte; */
+#define HNBU_FEM		0x23	/* 2 or 4 byte: 11n frontend specification */
+#define HNBU_PAPARMS_C0		0x24	/* 8 or 30 bytes: 11n pa paramater for chain 0 */
+#define HNBU_PAPARMS_C1		0x25	/* 8 or 30 bytes: 11n pa paramater for chain 1 */
+#define HNBU_PAPARMS_C2		0x26	/* 8 or 30 bytes: 11n pa paramater for chain 2 */
+#define HNBU_PAPARMS_C3		0x27	/* 8 or 30 bytes: 11n pa paramater for chain 3 */
+#define HNBU_PO_CCKOFDM		0x28	/* 6 or 18 bytes: cck2g/ofdm2g/ofdm5g power offset */
+#define HNBU_PO_MCS2G		0x29	/* 8 bytes: mcs2g power offset */
+#define HNBU_PO_MCS5GM		0x2a	/* 8 bytes: mcs5g mid band power offset */
+#define HNBU_PO_MCS5GLH		0x2b	/* 16 bytes: mcs5g low-high band power offset */
+#define HNBU_PO_CDD		0x2c	/* 2 bytes: cdd2g/5g power offset */
+#define HNBU_PO_STBC		0x2d	/* 2 bytes: stbc2g/5g power offset */
+#define HNBU_PO_40M		0x2e	/* 2 bytes: 40Mhz channel 2g/5g power offset */
+#define HNBU_PO_40MDUP		0x2f	/* 2 bytes: 40Mhz channel dup 2g/5g power offset */
+
+#define HNBU_RDLRWU		0x30	/* 1 byte; 1 = RDL advertises Remote Wake-up */
+#define HNBU_WPS		0x31	/* 1 byte; GPIO pin for WPS button */
+#define HNBU_USBFS		0x32	/* 1 byte; 1 = USB advertises FS mode only */
+#define HNBU_BRMIN		0x33	/* 4 byte bootloader min resource mask */
+#define HNBU_BRMAX		0x34	/* 4 byte bootloader max resource mask */
+#define HNBU_PATCH		0x35	/* bootloader patch addr(2b) & data(4b) pair */
+#define HNBU_CCKFILTTYPE	0x36	/* CCK digital filter selection options */
+#define HNBU_OFDMPO5G		0x37	/* 4 * 3 = 12 byte 11a ofdm power offsets in rev 3 */
+#define HNBU_ELNA2G             0x38
+#define HNBU_ELNA5G             0x39
+#define HNBU_TEMPTHRESH 0x3A /* 2 bytes
+					 * byte1 tempthresh
+					 * byte2 period(msb 4 bits) | hysterisis(lsb 4 bits)
+					 */
+#define HNBU_UUID 0x3B /* 16 Bytes Hex */
+
+#define HNBU_USBEPNUM		0x40	/* USB endpoint numbers */
+
+/* POWER PER RATE for SROM V9 */
+#define HNBU_CCKBW202GPO       0x41    /* 2 bytes each
+					 * CCK Power offsets for 20 MHz rates (11, 5.5, 2, 1Mbps)
+					 * cckbw202gpo cckbw20ul2gpo
+					 */
+
+#define HNBU_LEGOFDMBW202GPO    0x42    /* 4 bytes each
+					 * OFDM power offsets for 20 MHz Legacy rates
+					 * (54, 48, 36, 24, 18, 12, 9, 6 Mbps)
+					 * legofdmbw202gpo  legofdmbw20ul2gpo
+					 */
+
+#define HNBU_LEGOFDMBW205GPO   0x43    /* 4 bytes each
+					* 5G band: OFDM power offsets for 20 MHz Legacy rates
+					* (54, 48, 36, 24, 18, 12, 9, 6 Mbps)
+					* low subband : legofdmbw205glpo  legofdmbw20ul2glpo
+					* mid subband :legofdmbw205gmpo  legofdmbw20ul2gmpo
+					* high subband :legofdmbw205ghpo  legofdmbw20ul2ghpo
+					*/
+
+#define HNBU_MCS2GPO    0x44    /* 4 bytes each
+				     * mcs 0-7  power-offset. LSB nibble: m0, MSB nibble: m7
+				     * mcsbw202gpo  mcsbw20ul2gpo mcsbw402gpo
+				     */
+#define HNBU_MCS5GLPO    0x45    /* 4 bytes each
+				     * 5G low subband mcs 0-7 power-offset.
+				     * LSB nibble: m0, MSB nibble: m7
+				     * mcsbw205glpo  mcsbw20ul5glpo mcsbw405glpo
+				     */
+#define HNBU_MCS5GMPO    0x46    /* 4 bytes each
+				     * 5G mid subband mcs 0-7 power-offset.
+				     * LSB nibble: m0, MSB nibble: m7
+				     * mcsbw205gmpo  mcsbw20ul5gmpo mcsbw405gmpo
+				     */
+#define HNBU_MCS5GHPO    0x47    /* 4 bytes each
+				     * 5G high subband mcs 0-7 power-offset.
+				     * LSB nibble: m0, MSB nibble: m7
+				     * mcsbw205ghpo  mcsbw20ul5ghpo mcsbw405ghpo
+				     */
+#define HNBU_MCS32PO	0x48	/*  2 bytes total
+				 * mcs-32 power offset for each band/subband.
+				 * LSB nibble: 2G band, MSB nibble:
+				 * mcs322ghpo, mcs325gmpo, mcs325glpo, mcs322gpo
+				 */
+#define HNBU_LEG40DUPPO	0x49 /*  2 bytes total
+				* Additional power offset for Legacy Dup40 transmissions.
+				 * Applied in addition to legofdmbw20ulXpo, X=2g, 5gl, 5gm, or 5gh.
+				 * LSB nibble: 2G band, MSB nibble: 5G band high subband.
+				 * leg40dup5ghpo, leg40dup5gmpo, leg40dup5glpo, leg40dup2gpo
+				 */
+
+#define HNBU_PMUREGS	0x4a /* Variable length (5 bytes for each register)
+				* The setting of the ChipCtrl, PLL, RegulatorCtrl, Up/Down Timer and
+				* ResourceDependency Table registers.
+				*/
+
+#define HNBU_PATCH2		0x4b	/* bootloader TCAM patch addr(4b) & data(4b) pair .
+				* This is required for socram rev 15 onwards.
+				*/
+
+#define HNBU_USBRDY		0x4c	/* Variable length (upto 5 bytes)
+				* This is to indicate the USB/HSIC host controller
+				* that the device is ready for enumeration.
+				*/
+
+#define HNBU_USBREGS	0x4d	/* Variable length
+				* The setting of the devcontrol, HSICPhyCtrl1 and HSICPhyCtrl2
+				* registers during the USB initialization.
+				*/
+
+#define HNBU_BLDR_TIMEOUT	0x4e	/* 2 bytes used for HSIC bootloader to reset chip
+				* on connect timeout.
+				* The Delay after USBConnect for timeout till dongle receives
+				* get_descriptor request.
+				*/
+#define HNBU_USBFLAGS		0x4f
+#define HNBU_PATCH_AUTOINC	0x50
+#define HNBU_MDIO_REGLIST	0x51
+#define HNBU_MDIOEX_REGLIST	0x52
+/* Unified OTP: tupple to embed USB manfid inside SDIO CIS */
+#define HNBU_UMANFID		0x53
+#define HNBU_PUBKEY		0x54	/* 128 byte; publick key to validate downloaded FW */
+#define HNBU_WOWLGPIO       0x55   /* 1 byte bit 7 initial polarity, bit 6..0 gpio pin */
+#define HNBU_MUXENAB		0x56	/* 1 byte to enable mux options */
+#define HNBU_GCI_CCR		0x57	/* GCI Chip control register */
+
+#define HNBU_FEM_CFG		0x58	/* FEM config */
+#define HNBU_ACPA_C0		0x59	/* ACPHY PA parameters: chain 0 */
+#define HNBU_ACPA_C1		0x5a	/* ACPHY PA parameters: chain 1 */
+#define HNBU_ACPA_C2		0x5b	/* ACPHY PA parameters: chain 2 */
+#define HNBU_MEAS_PWR		0x5c
+#define HNBU_PDOFF		0x5d
+#define HNBU_ACPPR_2GPO		0x5e	/* ACPHY Power-per-rate 2gpo */
+#define HNBU_ACPPR_5GPO		0x5f	/* ACPHY Power-per-rate 5gpo */
+#define HNBU_ACPPR_SBPO		0x60	/* ACPHY Power-per-rate sbpo */
+#define HNBU_NOISELVL		0x61
+#define HNBU_RXGAIN_ERR		0x62
+#define HNBU_AGBGA		0x63
+#define HNBU_USBDESC_COMPOSITE	0x64    /* USB WLAN/BT composite descriptor */
+#define HNBU_PATCH_AUTOINC8	0x65	/* Auto increment patch entry for 8 byte patching */
+#define HNBU_PATCH8		0x66	/* Patch entry for 8 byte patching */
+#define HNBU_ACRXGAINS_C0	0x67	/* ACPHY rxgains: chain 0 */
+#define HNBU_ACRXGAINS_C1	0x68	/* ACPHY rxgains: chain 1 */
+#define HNBU_ACRXGAINS_C2	0x69	/* ACPHY rxgains: chain 2 */
+#define HNBU_TXDUTY		0x6a	/* Tx duty cycle for ACPHY 5g 40/80 Mhz */
+#define HNBU_USBUTMI_CTL        0x6b    /* 2 byte USB UTMI/LDO Control */
+#define HNBU_PDOFF_2G		0x6c
+#define HNBU_USBSSPHY_UTMI_CTL0 0x6d    /* 4 byte USB SSPHY UTMI Control */
+#define HNBU_USBSSPHY_UTMI_CTL1 0x6e    /* 4 byte USB SSPHY UTMI Control */
+#define HNBU_USBSSPHY_UTMI_CTL2 0x6f    /* 4 byte USB SSPHY UTMI Control */
+#define HNBU_USBSSPHY_SLEEP0    0x70    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_SLEEP1    0x71    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_SLEEP2    0x72    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_SLEEP3    0x73    /* 2 byte USB SSPHY sleep */
+#define HNBU_USBSSPHY_MDIO		0x74	/* USB SSPHY INIT regs setting */
+#define HNBU_USB30PHY_NOSS		0x75	/* USB30 NO Super Speed */
+#define HNBU_USB30PHY_U1U2		0x76	/* USB30 PHY U1U2 Enable */
+#define HNBU_USB30PHY_REGS		0x77	/* USB30 PHY REGs update */
+
+#define HNBU_SROM3SWRGN		0x80	/* 78 bytes; srom rev 3 s/w region without crc8
+					 * plus extra info appended.
+					 */
+#define HNBU_RESERVED		0x81	/* Reserved for non-BRCM post-mfg additions */
+#define HNBU_CUSTOM1		0x82	/* 4 byte; For non-BRCM post-mfg additions */
+#define HNBU_CUSTOM2		0x83	/* Reserved; For non-BRCM post-mfg additions */
+#define HNBU_ACPAPARAM		0x84	/* ACPHY PAPARAM */
+#define HNBU_ACPA_CCK		0x86	/* ACPHY PA trimming parameters: CCK */
+#define HNBU_ACPA_40		0x87	/* ACPHY PA trimming parameters: 40 */
+#define HNBU_ACPA_80		0x88	/* ACPHY PA trimming parameters: 80 */
+#define HNBU_ACPA_4080		0x89	/* ACPHY PA trimming parameters: 40/80 */
+#define HNBU_SUBBAND5GVER	0x8a	/* subband5gver */
+#define HNBU_PAPARAMBWVER	0x8b	/* paparambwver */
+
+#define HNBU_MCS5Gx1PO		0x8c
+#define HNBU_ACPPR_SB8080_PO		0x8d
+
+
+#endif /* !defined(LINUX_POSTMOGRIFY_REMOVAL) */
+
+/* sbtmstatelow */
+#define SBTML_INT_ACK		0x40000		/* ack the sb interrupt */
+#define SBTML_INT_EN		0x20000		/* enable sb interrupt */
+
+/* sbtmstatehigh */
+#define SBTMH_INT_STATUS	0x40000		/* sb interrupt status */
+
+#endif	/* _SBPCMCIA_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbsdio.h b/drivers/net/wireless/bcm4336/include/sbsdio.h
--- a/drivers/net/wireless/bcm4336/include/sbsdio.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbsdio.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,168 @@
+/*
+ * SDIO device core hardware definitions.
+ * sdio is a portion of the pcmcia core in core rev 3 - rev 8
+ *
+ * SDIO core support 1bit, 4 bit SDIO mode as well as SPI mode.
+ *
+ * $Copyright Open 2003 Broadcom Corporation$
+ *
+ * $Id: sbsdio.h 383835 2013-02-07 23:32:39Z $
+ */
+
+#ifndef	_SBSDIO_H
+#define	_SBSDIO_H
+
+#define SBSDIO_NUM_FUNCTION		3	/* as of sdiod rev 0, supports 3 functions */
+
+/* function 1 miscellaneous registers */
+#define SBSDIO_SPROM_CS			0x10000		/* sprom command and status */
+#define SBSDIO_SPROM_INFO		0x10001		/* sprom info register */
+#define SBSDIO_SPROM_DATA_LOW		0x10002		/* sprom indirect access data byte 0 */
+#define SBSDIO_SPROM_DATA_HIGH		0x10003 	/* sprom indirect access data byte 1 */
+#define SBSDIO_SPROM_ADDR_LOW		0x10004		/* sprom indirect access addr byte 0 */
+#define SBSDIO_SPROM_ADDR_HIGH		0x10005		/* sprom indirect access addr byte 0 */
+#define SBSDIO_CHIP_CTRL_DATA		0x10006		/* xtal_pu (gpio) output */
+#define SBSDIO_CHIP_CTRL_EN		0x10007		/* xtal_pu (gpio) enable */
+#define SBSDIO_WATERMARK		0x10008		/* rev < 7, watermark for sdio device */
+#define SBSDIO_DEVICE_CTL		0x10009		/* control busy signal generation */
+
+/* registers introduced in rev 8, some content (mask/bits) defs in sbsdpcmdev.h */
+#define SBSDIO_FUNC1_SBADDRLOW		0x1000A		/* SB Address Window Low (b15) */
+#define SBSDIO_FUNC1_SBADDRMID		0x1000B		/* SB Address Window Mid (b23:b16) */
+#define SBSDIO_FUNC1_SBADDRHIGH		0x1000C		/* SB Address Window High (b31:b24)    */
+#define SBSDIO_FUNC1_FRAMECTRL		0x1000D		/* Frame Control (frame term/abort) */
+#define SBSDIO_FUNC1_CHIPCLKCSR		0x1000E		/* ChipClockCSR (ALP/HT ctl/status) */
+#define SBSDIO_FUNC1_SDIOPULLUP 	0x1000F		/* SdioPullUp (on cmd, d0-d2) */
+#define SBSDIO_FUNC1_WFRAMEBCLO		0x10019		/* Write Frame Byte Count Low */
+#define SBSDIO_FUNC1_WFRAMEBCHI		0x1001A		/* Write Frame Byte Count High */
+#define SBSDIO_FUNC1_RFRAMEBCLO		0x1001B		/* Read Frame Byte Count Low */
+#define SBSDIO_FUNC1_RFRAMEBCHI		0x1001C		/* Read Frame Byte Count High */
+#define SBSDIO_FUNC1_MESBUSYCTRL	0x1001D		/* MesBusyCtl at 0x1001D (rev 11) */
+
+#define SBSDIO_FUNC1_MISC_REG_START	0x10000 	/* f1 misc register start */
+#define SBSDIO_FUNC1_MISC_REG_LIMIT	0x1001C 	/* f1 misc register end */
+
+/* Sdio Core Rev 12 */
+#define SBSDIO_FUNC1_WAKEUPCTRL			0x1001E
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK		0x1
+#define SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT	0
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_MASK		0x2
+#define SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT		1
+#define SBSDIO_FUNC1_SLEEPCSR			0x1001F
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_MASK		0x1
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT		0
+#define SBSDIO_FUNC1_SLEEPCSR_KSO_EN		1
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_MASK	0x2
+#define SBSDIO_FUNC1_SLEEPCSR_DEVON_SHIFT	1
+
+/* SBSDIO_SPROM_CS */
+#define SBSDIO_SPROM_IDLE		0
+#define SBSDIO_SPROM_WRITE		1
+#define SBSDIO_SPROM_READ		2
+#define SBSDIO_SPROM_WEN		4
+#define SBSDIO_SPROM_WDS		7
+#define SBSDIO_SPROM_DONE		8
+
+/* SBSDIO_SPROM_INFO */
+#define SROM_SZ_MASK			0x03		/* SROM size, 1: 4k, 2: 16k */
+#define SROM_BLANK			0x04		/* depreciated in corerev 6 */
+#define	SROM_OTP			0x80		/* OTP present */
+
+/* SBSDIO_CHIP_CTRL */
+#define SBSDIO_CHIP_CTRL_XTAL		0x01		/* or'd with onchip xtal_pu,
+							 * 1: power on oscillator
+							 * (for 4318 only)
+							 */
+/* SBSDIO_WATERMARK */
+#define SBSDIO_WATERMARK_MASK		0x7f		/* number of words - 1 for sd device
+							 * to wait before sending data to host
+							 */
+
+/* SBSDIO_MESBUSYCTRL */
+/* When RX FIFO has less entries than this & MBE is set
+ * => busy signal is asserted between data blocks.
+*/
+#define SBSDIO_MESBUSYCTRL_MASK		0x7f
+#define SBSDIO_MESBUSYCTRL_ENAB		0x80		/* Enable busy capability for MES access */
+
+/* SBSDIO_DEVICE_CTL */
+#define SBSDIO_DEVCTL_SETBUSY		0x01		/* 1: device will assert busy signal when
+							 * receiving CMD53
+							 */
+#define SBSDIO_DEVCTL_SPI_INTR_SYNC	0x02		/* 1: assertion of sdio interrupt is
+							 * synchronous to the sdio clock
+							 */
+#define SBSDIO_DEVCTL_CA_INT_ONLY	0x04		/* 1: mask all interrupts to host
+							 * except the chipActive (rev 8)
+							 */
+#define SBSDIO_DEVCTL_PADS_ISO		0x08		/* 1: isolate internal sdio signals, put
+							 * external pads in tri-state; requires
+							 * sdio bus power cycle to clear (rev 9)
+							 */
+#define SBSDIO_DEVCTL_EN_F2_BLK_WATERMARK 0x10  /* Enable function 2 tx for each block */
+#define SBSDIO_DEVCTL_F2WM_ENAB		0x10		/* Enable F2 Watermark */
+#define SBSDIO_DEVCTL_NONDAT_PADS_ISO 	0x20		/* Isolate sdio clk and cmd (non-data) */
+
+/* SBSDIO_FUNC1_CHIPCLKCSR */
+#define SBSDIO_FORCE_ALP		0x01		/* Force ALP request to backplane */
+#define SBSDIO_FORCE_HT			0x02		/* Force HT request to backplane */
+#define SBSDIO_FORCE_ILP		0x04		/* Force ILP request to backplane */
+#define SBSDIO_ALP_AVAIL_REQ		0x08		/* Make ALP ready (power up xtal) */
+#define SBSDIO_HT_AVAIL_REQ		0x10		/* Make HT ready (power up PLL) */
+#define SBSDIO_FORCE_HW_CLKREQ_OFF	0x20		/* Squelch clock requests from HW */
+#define SBSDIO_ALP_AVAIL		0x40		/* Status: ALP is ready */
+#define SBSDIO_HT_AVAIL			0x80		/* Status: HT is ready */
+/* In rev8, actual avail bits followed original docs */
+#define SBSDIO_Rev8_HT_AVAIL		0x40
+#define SBSDIO_Rev8_ALP_AVAIL		0x80
+#define SBSDIO_CSR_MASK			0x1F
+
+#define SBSDIO_AVBITS			(SBSDIO_HT_AVAIL | SBSDIO_ALP_AVAIL)
+#define SBSDIO_ALPAV(regval)		((regval) & SBSDIO_AVBITS)
+#define SBSDIO_HTAV(regval)		(((regval) & SBSDIO_AVBITS) == SBSDIO_AVBITS)
+#define SBSDIO_ALPONLY(regval)		(SBSDIO_ALPAV(regval) && !SBSDIO_HTAV(regval))
+#define SBSDIO_CLKAV(regval, alponly)	(SBSDIO_ALPAV(regval) && \
+					(alponly ? 1 : SBSDIO_HTAV(regval)))
+
+/* SBSDIO_FUNC1_SDIOPULLUP */
+#define SBSDIO_PULLUP_D0		0x01		/* Enable D0/MISO pullup */
+#define SBSDIO_PULLUP_D1		0x02		/* Enable D1/INT# pullup */
+#define SBSDIO_PULLUP_D2		0x04		/* Enable D2 pullup */
+#define SBSDIO_PULLUP_CMD		0x08		/* Enable CMD/MOSI pullup */
+#define SBSDIO_PULLUP_ALL		0x0f		/* All valid bits */
+
+/* function 1 OCP space */
+#define SBSDIO_SB_OFT_ADDR_MASK		0x07FFF		/* sb offset addr is <= 15 bits, 32k */
+#define SBSDIO_SB_OFT_ADDR_LIMIT	0x08000
+#define SBSDIO_SB_ACCESS_2_4B_FLAG	0x08000		/* with b15, maps to 32-bit SB access */
+
+/* some duplication with sbsdpcmdev.h here */
+/* valid bits in SBSDIO_FUNC1_SBADDRxxx regs */
+#define SBSDIO_SBADDRLOW_MASK		0x80		/* Valid bits in SBADDRLOW */
+#define SBSDIO_SBADDRMID_MASK		0xff		/* Valid bits in SBADDRMID */
+#define SBSDIO_SBADDRHIGH_MASK		0xffU		/* Valid bits in SBADDRHIGH */
+#define SBSDIO_SBWINDOW_MASK		0xffff8000	/* Address bits from SBADDR regs */
+
+/* direct(mapped) cis space */
+#define SBSDIO_CIS_BASE_COMMON		0x1000		/* MAPPED common CIS address */
+#define SBSDIO_CIS_SIZE_LIMIT		0x200		/* maximum bytes in one CIS */
+#define SBSDIO_OTP_CIS_SIZE_LIMIT       0x078           /* maximum bytes OTP CIS */
+
+#define SBSDIO_CIS_OFT_ADDR_MASK	0x1FFFF		/* cis offset addr is < 17 bits */
+
+#define SBSDIO_CIS_MANFID_TUPLE_LEN	6		/* manfid tuple length, include tuple,
+							 * link bytes
+							 */
+
+/* indirect cis access (in sprom) */
+#define SBSDIO_SPROM_CIS_OFFSET		0x8		/* 8 control bytes first, CIS starts from
+							 * 8th byte
+							 */
+
+#define SBSDIO_BYTEMODE_DATALEN_MAX	64		/* sdio byte mode: maximum length of one
+							 * data comamnd
+							 */
+
+#define SBSDIO_CORE_ADDR_MASK		0x1FFFF		/* sdio core function one address mask */
+
+#endif	/* _SBSDIO_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbsdpcmdev.h b/drivers/net/wireless/bcm4336/include/sbsdpcmdev.h
--- a/drivers/net/wireless/bcm4336/include/sbsdpcmdev.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbsdpcmdev.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,281 @@
+/*
+ * Broadcom SiliconBackplane SDIO/PCMCIA hardware-specific
+ * device core support
+ *
+ * $Copyright Open 2005 Broadcom Corporation$
+ *
+ * $Id: sbsdpcmdev.h 416730 2013-08-06 09:33:19Z $
+ */
+
+#ifndef	_sbsdpcmdev_h_
+#define	_sbsdpcmdev_h_
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+
+typedef volatile struct {
+	dma64regs_t	xmt;		/* dma tx */
+	uint32 PAD[2];
+	dma64regs_t	rcv;		/* dma rx */
+	uint32 PAD[2];
+} dma64p_t;
+
+/* dma64 sdiod corerev >= 1 */
+typedef volatile struct {
+	dma64p_t dma64regs[2];
+	dma64diag_t dmafifo;		/* DMA Diagnostic Regs, 0x280-0x28c */
+	uint32 PAD[92];
+} sdiodma64_t;
+
+/* dma32 sdiod corerev == 0 */
+typedef volatile struct {
+	dma32regp_t dma32regs[2];	/* dma tx & rx, 0x200-0x23c */
+	dma32diag_t dmafifo;		/* DMA Diagnostic Regs, 0x240-0x24c */
+	uint32 PAD[108];
+} sdiodma32_t;
+
+/* dma32 regs for pcmcia core */
+typedef volatile struct {
+	dma32regp_t dmaregs;		/* DMA Regs, 0x200-0x21c, rev8 */
+	dma32diag_t dmafifo;		/* DMA Diagnostic Regs, 0x220-0x22c */
+	uint32 PAD[116];
+} pcmdma32_t;
+
+/* core registers */
+typedef volatile struct {
+	uint32 corecontrol;		/* CoreControl, 0x000, rev8 */
+	uint32 corestatus;		/* CoreStatus, 0x004, rev8  */
+	uint32 PAD[1];
+	uint32 biststatus;		/* BistStatus, 0x00c, rev8  */
+
+	/* PCMCIA access */
+	uint16 pcmciamesportaladdr;	/* PcmciaMesPortalAddr, 0x010, rev8   */
+	uint16 PAD[1];
+	uint16 pcmciamesportalmask;	/* PcmciaMesPortalMask, 0x014, rev8   */
+	uint16 PAD[1];
+	uint16 pcmciawrframebc;		/* PcmciaWrFrameBC, 0x018, rev8   */
+	uint16 PAD[1];
+	uint16 pcmciaunderflowtimer;	/* PcmciaUnderflowTimer, 0x01c, rev8   */
+	uint16 PAD[1];
+
+	/* interrupt */
+	uint32 intstatus;		/* IntStatus, 0x020, rev8   */
+	uint32 hostintmask;		/* IntHostMask, 0x024, rev8   */
+	uint32 intmask;			/* IntSbMask, 0x028, rev8   */
+	uint32 sbintstatus;		/* SBIntStatus, 0x02c, rev8   */
+	uint32 sbintmask;		/* SBIntMask, 0x030, rev8   */
+	uint32 funcintmask;		/* SDIO Function Interrupt Mask, SDIO rev4 */
+	uint32 PAD[2];
+	uint32 tosbmailbox;		/* ToSBMailbox, 0x040, rev8   */
+	uint32 tohostmailbox;		/* ToHostMailbox, 0x044, rev8   */
+	uint32 tosbmailboxdata;		/* ToSbMailboxData, 0x048, rev8   */
+	uint32 tohostmailboxdata;	/* ToHostMailboxData, 0x04c, rev8   */
+
+	/* synchronized access to registers in SDIO clock domain */
+	uint32 sdioaccess;		/* SdioAccess, 0x050, rev8   */
+	uint32 PAD[3];
+
+	/* PCMCIA frame control */
+	uint8 pcmciaframectrl;		/* pcmciaFrameCtrl, 0x060, rev8   */
+	uint8 PAD[3];
+	uint8 pcmciawatermark;		/* pcmciaWaterMark, 0x064, rev8   */
+	uint8 PAD[155];
+
+	/* interrupt batching control */
+	uint32 intrcvlazy;		/* IntRcvLazy, 0x100, rev8 */
+	uint32 PAD[3];
+
+	/* counters */
+	uint32 cmd52rd;			/* Cmd52RdCount, 0x110, rev8, SDIO: cmd52 reads */
+	uint32 cmd52wr;			/* Cmd52WrCount, 0x114, rev8, SDIO: cmd52 writes */
+	uint32 cmd53rd;			/* Cmd53RdCount, 0x118, rev8, SDIO: cmd53 reads */
+	uint32 cmd53wr;			/* Cmd53WrCount, 0x11c, rev8, SDIO: cmd53 writes */
+	uint32 abort;			/* AbortCount, 0x120, rev8, SDIO: aborts */
+	uint32 datacrcerror;		/* DataCrcErrorCount, 0x124, rev8, SDIO: frames w/bad CRC */
+	uint32 rdoutofsync;		/* RdOutOfSyncCount, 0x128, rev8, SDIO/PCMCIA: Rd Frm OOS */
+	uint32 wroutofsync;		/* RdOutOfSyncCount, 0x12c, rev8, SDIO/PCMCIA: Wr Frm OOS */
+	uint32 writebusy;		/* WriteBusyCount, 0x130, rev8, SDIO: dev asserted "busy" */
+	uint32 readwait;		/* ReadWaitCount, 0x134, rev8, SDIO: read: no data avail */
+	uint32 readterm;		/* ReadTermCount, 0x138, rev8, SDIO: rd frm terminates */
+	uint32 writeterm;		/* WriteTermCount, 0x13c, rev8, SDIO: wr frm terminates */
+	uint32 PAD[40];
+	uint32 clockctlstatus;		/* ClockCtlStatus, 0x1e0, rev8 */
+	uint32 PAD[7];
+
+	/* DMA engines */
+	volatile union {
+		pcmdma32_t pcm32;
+		sdiodma32_t sdiod32;
+		sdiodma64_t sdiod64;
+	} dma;
+
+	/* SDIO/PCMCIA CIS region */
+	char cis[512];			/* 512 byte CIS, 0x400-0x5ff, rev6 */
+
+	/* PCMCIA function control registers */
+	char pcmciafcr[256];		/* PCMCIA FCR, 0x600-6ff, rev6 */
+	uint16 PAD[55];
+
+	/* PCMCIA backplane access */
+	uint16 backplanecsr;		/* BackplaneCSR, 0x76E, rev6 */
+	uint16 backplaneaddr0;		/* BackplaneAddr0, 0x770, rev6 */
+	uint16 backplaneaddr1;		/* BackplaneAddr1, 0x772, rev6 */
+	uint16 backplaneaddr2;		/* BackplaneAddr2, 0x774, rev6 */
+	uint16 backplaneaddr3;		/* BackplaneAddr3, 0x776, rev6 */
+	uint16 backplanedata0;		/* BackplaneData0, 0x778, rev6 */
+	uint16 backplanedata1;		/* BackplaneData1, 0x77a, rev6 */
+	uint16 backplanedata2;		/* BackplaneData2, 0x77c, rev6 */
+	uint16 backplanedata3;		/* BackplaneData3, 0x77e, rev6 */
+	uint16 PAD[31];
+
+	/* sprom "size" & "blank" info */
+	uint16 spromstatus;		/* SPROMStatus, 0x7BE, rev2 */
+	uint32 PAD[464];
+
+	/* Sonics SiliconBackplane registers */
+	sbconfig_t sbconfig;		/* SbConfig Regs, 0xf00-0xfff, rev8 */
+} sdpcmd_regs_t;
+
+/* corecontrol */
+#define CC_CISRDY		(1 << 0)	/* CIS Ready */
+#define CC_BPRESEN		(1 << 1)	/* CCCR RES signal causes backplane reset */
+#define CC_F2RDY		(1 << 2)	/* set CCCR IOR2 bit */
+#define CC_CLRPADSISO		(1 << 3)	/* clear SDIO pads isolation bit (rev 11) */
+#define CC_XMTDATAAVAIL_MODE	(1 << 4)	/* data avail generates an interrupt */
+#define CC_XMTDATAAVAIL_CTRL	(1 << 5)	/* data avail interrupt ctrl */
+
+/* corestatus */
+#define CS_PCMCIAMODE	(1 << 0)	/* Device Mode; 0=SDIO, 1=PCMCIA */
+#define CS_SMARTDEV	(1 << 1)	/* 1=smartDev enabled */
+#define CS_F2ENABLED	(1 << 2)	/* 1=host has enabled the device */
+
+#define PCMCIA_MES_PA_MASK	0x7fff	/* PCMCIA Message Portal Address Mask */
+#define PCMCIA_MES_PM_MASK	0x7fff	/* PCMCIA Message Portal Mask Mask */
+#define PCMCIA_WFBC_MASK	0xffff	/* PCMCIA Write Frame Byte Count Mask */
+#define PCMCIA_UT_MASK		0x07ff	/* PCMCIA Underflow Timer Mask */
+
+/* intstatus */
+#define I_SMB_SW0	(1 << 0)	/* To SB Mail S/W interrupt 0 */
+#define I_SMB_SW1	(1 << 1)	/* To SB Mail S/W interrupt 1 */
+#define I_SMB_SW2	(1 << 2)	/* To SB Mail S/W interrupt 2 */
+#define I_SMB_SW3	(1 << 3)	/* To SB Mail S/W interrupt 3 */
+#define I_SMB_SW_MASK	0x0000000f	/* To SB Mail S/W interrupts mask */
+#define I_SMB_SW_SHIFT	0		/* To SB Mail S/W interrupts shift */
+#define I_HMB_SW0	(1 << 4)	/* To Host Mail S/W interrupt 0 */
+#define I_HMB_SW1	(1 << 5)	/* To Host Mail S/W interrupt 1 */
+#define I_HMB_SW2	(1 << 6)	/* To Host Mail S/W interrupt 2 */
+#define I_HMB_SW3	(1 << 7)	/* To Host Mail S/W interrupt 3 */
+#define I_HMB_SW_MASK	0x000000f0	/* To Host Mail S/W interrupts mask */
+#define I_HMB_SW_SHIFT	4		/* To Host Mail S/W interrupts shift */
+#define I_WR_OOSYNC	(1 << 8)	/* Write Frame Out Of Sync */
+#define I_RD_OOSYNC	(1 << 9)	/* Read Frame Out Of Sync */
+#define	I_PC		(1 << 10)	/* descriptor error */
+#define	I_PD		(1 << 11)	/* data error */
+#define	I_DE		(1 << 12)	/* Descriptor protocol Error */
+#define	I_RU		(1 << 13)	/* Receive descriptor Underflow */
+#define	I_RO		(1 << 14)	/* Receive fifo Overflow */
+#define	I_XU		(1 << 15)	/* Transmit fifo Underflow */
+#define	I_RI		(1 << 16)	/* Receive Interrupt */
+#define I_BUSPWR	(1 << 17)	/* SDIO Bus Power Change (rev 9) */
+#define I_XMTDATA_AVAIL (1 << 23)	/* bits in fifo */
+#define	I_XI		(1 << 24)	/* Transmit Interrupt */
+#define I_RF_TERM	(1 << 25)	/* Read Frame Terminate */
+#define I_WF_TERM	(1 << 26)	/* Write Frame Terminate */
+#define I_PCMCIA_XU	(1 << 27)	/* PCMCIA Transmit FIFO Underflow */
+#define I_SBINT		(1 << 28)	/* sbintstatus Interrupt */
+#define I_CHIPACTIVE	(1 << 29)	/* chip transitioned from doze to active state */
+#define I_SRESET	(1 << 30)	/* CCCR RES interrupt */
+#define I_IOE2		(1U << 31)	/* CCCR IOE2 Bit Changed */
+#define	I_ERRORS	(I_PC | I_PD | I_DE | I_RU | I_RO | I_XU)	/* DMA Errors */
+#define I_DMA		(I_RI | I_XI | I_ERRORS)
+
+/* sbintstatus */
+#define I_SB_SERR	(1 << 8)	/* Backplane SError (write) */
+#define I_SB_RESPERR	(1 << 9)	/* Backplane Response Error (read) */
+#define I_SB_SPROMERR	(1 << 10)	/* Error accessing the sprom */
+
+/* sdioaccess */
+#define SDA_DATA_MASK	0x000000ff	/* Read/Write Data Mask */
+#define SDA_ADDR_MASK	0x000fff00	/* Read/Write Address Mask */
+#define SDA_ADDR_SHIFT	8		/* Read/Write Address Shift */
+#define SDA_WRITE	0x01000000	/* Write bit  */
+#define SDA_READ	0x00000000	/* Write bit cleared for Read */
+#define SDA_BUSY	0x80000000	/* Busy bit */
+
+/* sdioaccess-accessible register address spaces */
+#define SDA_CCCR_SPACE		0x000	/* sdioAccess CCCR register space */
+#define SDA_F1_FBR_SPACE	0x100	/* sdioAccess F1 FBR register space */
+#define SDA_F2_FBR_SPACE	0x200	/* sdioAccess F2 FBR register space */
+#define SDA_F1_REG_SPACE	0x300	/* sdioAccess F1 core-specific register space */
+
+/* SDA_F1_REG_SPACE sdioaccess-accessible F1 reg space register offsets */
+#define SDA_CHIPCONTROLDATA	0x006	/* ChipControlData */
+#define SDA_CHIPCONTROLENAB	0x007	/* ChipControlEnable */
+#define SDA_F2WATERMARK		0x008	/* Function 2 Watermark */
+#define SDA_DEVICECONTROL	0x009	/* DeviceControl */
+#define SDA_SBADDRLOW		0x00a	/* SbAddrLow */
+#define SDA_SBADDRMID		0x00b	/* SbAddrMid */
+#define SDA_SBADDRHIGH		0x00c	/* SbAddrHigh */
+#define SDA_FRAMECTRL		0x00d	/* FrameCtrl */
+#define SDA_CHIPCLOCKCSR	0x00e	/* ChipClockCSR */
+#define SDA_SDIOPULLUP		0x00f	/* SdioPullUp */
+#define SDA_SDIOWRFRAMEBCLOW	0x019	/* SdioWrFrameBCLow */
+#define SDA_SDIOWRFRAMEBCHIGH	0x01a	/* SdioWrFrameBCHigh */
+#define SDA_SDIORDFRAMEBCLOW	0x01b	/* SdioRdFrameBCLow */
+#define SDA_SDIORDFRAMEBCHIGH	0x01c	/* SdioRdFrameBCHigh */
+
+/* SDA_F2WATERMARK */
+#define SDA_F2WATERMARK_MASK	0x7f	/* F2Watermark Mask */
+
+/* SDA_SBADDRLOW */
+#define SDA_SBADDRLOW_MASK	0x80	/* SbAddrLow Mask */
+
+/* SDA_SBADDRMID */
+#define SDA_SBADDRMID_MASK	0xff	/* SbAddrMid Mask */
+
+/* SDA_SBADDRHIGH */
+#define SDA_SBADDRHIGH_MASK	0xff	/* SbAddrHigh Mask */
+
+/* SDA_FRAMECTRL */
+#define SFC_RF_TERM	(1 << 0)	/* Read Frame Terminate */
+#define SFC_WF_TERM	(1 << 1)	/* Write Frame Terminate */
+#define SFC_CRC4WOOS	(1 << 2)	/* HW reports CRC error for write out of sync */
+#define SFC_ABORTALL	(1 << 3)	/* Abort cancels all in-progress frames */
+
+/* pcmciaframectrl */
+#define PFC_RF_TERM	(1 << 0)	/* Read Frame Terminate */
+#define PFC_WF_TERM	(1 << 1)	/* Write Frame Terminate */
+
+/* intrcvlazy */
+#define	IRL_TO_MASK	0x00ffffff	/* timeout */
+#define	IRL_FC_MASK	0xff000000	/* frame count */
+#define	IRL_FC_SHIFT	24		/* frame count */
+
+/* rx header */
+typedef volatile struct {
+	uint16 len;
+	uint16 flags;
+} sdpcmd_rxh_t;
+
+/* rx header flags */
+#define RXF_CRC		0x0001		/* CRC error detected */
+#define RXF_WOOS	0x0002		/* write frame out of sync */
+#define RXF_WF_TERM	0x0004		/* write frame terminated */
+#define RXF_ABORT	0x0008		/* write frame aborted */
+#define RXF_DISCARD	(RXF_CRC | RXF_WOOS | RXF_WF_TERM | RXF_ABORT)	/* bad frame */
+
+/* HW frame tag */
+#define SDPCM_FRAMETAG_LEN	4	/* HW frametag: 2 bytes len, 2 bytes check val */
+
+#if !defined(NDISVER) || (NDISVER < 0x0630)
+#define SDPCM_HWEXT_LEN	8
+#else
+#define SDPCM_HWEXT_LEN	0
+#endif /* !defined(NDISVER) || (NDISVER < 0x0630) */
+
+#endif	/* _sbsdpcmdev_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sbsocram.h b/drivers/net/wireless/bcm4336/include/sbsocram.h
--- a/drivers/net/wireless/bcm4336/include/sbsocram.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sbsocram.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,182 @@
+/*
+ * BCM47XX Sonics SiliconBackplane embedded ram core
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sbsocram.h 481602 2014-05-29 22:43:34Z $
+ */
+
+#ifndef	_SBSOCRAM_H
+#define	_SBSOCRAM_H
+
+#ifndef _LANGUAGE_ASSEMBLY
+
+/* cpp contortions to concatenate w/arg prescan */
+#ifndef PAD
+#define	_PADLINE(line)	pad ## line
+#define	_XSTR(line)	_PADLINE(line)
+#define	PAD		_XSTR(__LINE__)
+#endif	/* PAD */
+
+/* Memcsocram core registers */
+typedef volatile struct sbsocramregs {
+	uint32	coreinfo;
+	uint32	bwalloc;
+	uint32	extracoreinfo;
+	uint32	biststat;
+	uint32	bankidx;
+	uint32	standbyctrl;
+
+	uint32	errlogstatus;	/* rev 6 */
+	uint32	errlogaddr;	/* rev 6 */
+	/* used for patching rev 3 & 5 */
+	uint32	cambankidx;
+	uint32	cambankstandbyctrl;
+	uint32	cambankpatchctrl;
+	uint32	cambankpatchtblbaseaddr;
+	uint32	cambankcmdreg;
+	uint32	cambankdatareg;
+	uint32	cambankmaskreg;
+	uint32	PAD[1];
+	uint32	bankinfo;	/* corev 8 */
+	uint32	bankpda;
+	uint32	PAD[14];
+	uint32	extmemconfig;
+	uint32	extmemparitycsr;
+	uint32	extmemparityerrdata;
+	uint32	extmemparityerrcnt;
+	uint32	extmemwrctrlandsize;
+	uint32	PAD[84];
+	uint32	workaround;
+	uint32	pwrctl;		/* corerev >= 2 */
+	uint32	PAD[133];
+	uint32  sr_control;     /* corerev >= 15 */
+	uint32  sr_status;      /* corerev >= 15 */
+	uint32  sr_address;     /* corerev >= 15 */
+	uint32  sr_data;        /* corerev >= 15 */
+} sbsocramregs_t;
+
+#endif	/* _LANGUAGE_ASSEMBLY */
+
+/* Register offsets */
+#define	SR_COREINFO		0x00
+#define	SR_BWALLOC		0x04
+#define	SR_BISTSTAT		0x0c
+#define	SR_BANKINDEX		0x10
+#define	SR_BANKSTBYCTL		0x14
+#define SR_PWRCTL		0x1e8
+
+/* Coreinfo register */
+#define	SRCI_PT_MASK		0x00070000	/* corerev >= 6; port type[18:16] */
+#define	SRCI_PT_SHIFT		16
+/* port types : SRCI_PT_<processorPT>_<backplanePT> */
+#define SRCI_PT_OCP_OCP		0
+#define SRCI_PT_AXI_OCP		1
+#define SRCI_PT_ARM7AHB_OCP	2
+#define SRCI_PT_CM3AHB_OCP	3
+#define SRCI_PT_AXI_AXI		4
+#define SRCI_PT_AHB_AXI		5
+/* corerev >= 3 */
+#define SRCI_LSS_MASK		0x00f00000
+#define SRCI_LSS_SHIFT		20
+#define SRCI_LRS_MASK		0x0f000000
+#define SRCI_LRS_SHIFT		24
+
+/* In corerev 0, the memory size is 2 to the power of the
+ * base plus 16 plus to the contents of the memsize field plus 1.
+ */
+#define	SRCI_MS0_MASK		0xf
+#define SR_MS0_BASE		16
+
+/*
+ * In corerev 1 the bank size is 2 ^ the bank size field plus 14,
+ * the memory size is number of banks times bank size.
+ * The same applies to rom size.
+ */
+#define	SRCI_ROMNB_MASK		0xf000
+#define	SRCI_ROMNB_SHIFT	12
+#define	SRCI_ROMBSZ_MASK	0xf00
+#define	SRCI_ROMBSZ_SHIFT	8
+#define	SRCI_SRNB_MASK		0xf0
+#define	SRCI_SRNB_SHIFT		4
+#define	SRCI_SRBSZ_MASK		0xf
+#define	SRCI_SRBSZ_SHIFT	0
+
+#define SR_BSZ_BASE		14
+
+/* Standby control register */
+#define	SRSC_SBYOVR_MASK	0x80000000
+#define	SRSC_SBYOVR_SHIFT	31
+#define	SRSC_SBYOVRVAL_MASK	0x60000000
+#define	SRSC_SBYOVRVAL_SHIFT	29
+#define	SRSC_SBYEN_MASK		0x01000000	/* rev >= 3 */
+#define	SRSC_SBYEN_SHIFT	24
+
+/* Power control register */
+#define SRPC_PMU_STBYDIS_MASK	0x00000010	/* rev >= 3 */
+#define SRPC_PMU_STBYDIS_SHIFT	4
+#define SRPC_STBYOVRVAL_MASK	0x00000008
+#define SRPC_STBYOVRVAL_SHIFT	3
+#define SRPC_STBYOVR_MASK	0x00000007
+#define SRPC_STBYOVR_SHIFT	0
+
+/* Extra core capability register */
+#define SRECC_NUM_BANKS_MASK   0x000000F0
+#define SRECC_NUM_BANKS_SHIFT  4
+#define SRECC_BANKSIZE_MASK    0x0000000F
+#define SRECC_BANKSIZE_SHIFT   0
+
+#define SRECC_BANKSIZE(value)	 (1 << (value))
+
+/* CAM bank patch control */
+#define SRCBPC_PATCHENABLE 0x80000000
+
+#define SRP_ADDRESS   0x0001FFFC
+#define SRP_VALID     0x8000
+
+/* CAM bank command reg */
+#define SRCMD_WRITE  0x00020000
+#define SRCMD_READ   0x00010000
+#define SRCMD_DONE   0x80000000
+
+#define SRCMD_DONE_DLY	1000
+
+/* bankidx and bankinfo reg defines corerev >= 8 */
+#define SOCRAM_BANKINFO_SZMASK		0x7f
+#define SOCRAM_BANKIDX_ROM_MASK		0x100
+
+#define SOCRAM_BANKIDX_MEMTYPE_SHIFT	8
+/* socram bankinfo memtype */
+#define SOCRAM_MEMTYPE_RAM		0
+#define SOCRAM_MEMTYPE_R0M		1
+#define SOCRAM_MEMTYPE_DEVRAM		2
+
+#define	SOCRAM_BANKINFO_REG		0x40
+#define	SOCRAM_BANKIDX_REG		0x10
+#define	SOCRAM_BANKINFO_STDBY_MASK	0x400
+#define	SOCRAM_BANKINFO_STDBY_TIMER	0x800
+
+/* bankinfo rev >= 10 */
+#define SOCRAM_BANKINFO_DEVRAMSEL_SHIFT		13
+#define SOCRAM_BANKINFO_DEVRAMSEL_MASK		0x2000
+#define SOCRAM_BANKINFO_DEVRAMPRO_SHIFT		14
+#define SOCRAM_BANKINFO_DEVRAMPRO_MASK		0x4000
+#define SOCRAM_BANKINFO_SLPSUPP_SHIFT		15
+#define SOCRAM_BANKINFO_SLPSUPP_MASK		0x8000
+#define SOCRAM_BANKINFO_RETNTRAM_SHIFT		16
+#define SOCRAM_BANKINFO_RETNTRAM_MASK		0x00010000
+#define SOCRAM_BANKINFO_PDASZ_SHIFT		17
+#define SOCRAM_BANKINFO_PDASZ_MASK		0x003E0000
+#define SOCRAM_BANKINFO_DEVRAMREMAP_SHIFT	24
+#define SOCRAM_BANKINFO_DEVRAMREMAP_MASK	0x01000000
+
+/* extracoreinfo register */
+#define SOCRAM_DEVRAMBANK_MASK		0xF000
+#define SOCRAM_DEVRAMBANK_SHIFT		12
+
+/* bank info to calculate bank size */
+#define   SOCRAM_BANKINFO_SZBASE          8192
+#define SOCRAM_BANKSIZE_SHIFT         13      /* SOCRAM_BANKINFO_SZBASE */
+
+
+#endif	/* _SBSOCRAM_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sdio.h b/drivers/net/wireless/bcm4336/include/sdio.h
--- a/drivers/net/wireless/bcm4336/include/sdio.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sdio.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,604 @@
+/*
+ * SDIO spec header file
+ * Protocol and standard (common) device definitions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sdio.h 416730 2013-08-06 09:33:19Z $
+ */
+
+#ifndef	_SDIO_H
+#define	_SDIO_H
+
+#ifdef BCMSDIO
+
+/* CCCR structure for function 0 */
+typedef volatile struct {
+	uint8	cccr_sdio_rev;		/* RO, cccr and sdio revision */
+	uint8	sd_rev;			/* RO, sd spec revision */
+	uint8	io_en;			/* I/O enable */
+	uint8	io_rdy;			/* I/O ready reg */
+	uint8	intr_ctl;		/* Master and per function interrupt enable control */
+	uint8	intr_status;		/* RO, interrupt pending status */
+	uint8	io_abort;		/* read/write abort or reset all functions */
+	uint8	bus_inter;		/* bus interface control */
+	uint8	capability;		/* RO, card capability */
+
+	uint8	cis_base_low;		/* 0x9 RO, common CIS base address, LSB */
+	uint8	cis_base_mid;
+	uint8	cis_base_high;		/* 0xB RO, common CIS base address, MSB */
+
+	/* suspend/resume registers */
+	uint8	bus_suspend;		/* 0xC */
+	uint8	func_select;		/* 0xD */
+	uint8	exec_flag;		/* 0xE */
+	uint8	ready_flag;		/* 0xF */
+
+	uint8	fn0_blk_size[2];	/* 0x10(LSB), 0x11(MSB) */
+
+	uint8	power_control;		/* 0x12 (SDIO version 1.10) */
+
+	uint8	speed_control;		/* 0x13 */
+} sdio_regs_t;
+
+/* SDIO Device CCCR offsets */
+#define SDIOD_CCCR_REV			0x00
+#define SDIOD_CCCR_SDREV		0x01
+#define SDIOD_CCCR_IOEN			0x02
+#define SDIOD_CCCR_IORDY		0x03
+#define SDIOD_CCCR_INTEN		0x04
+#define SDIOD_CCCR_INTPEND		0x05
+#define SDIOD_CCCR_IOABORT		0x06
+#define SDIOD_CCCR_BICTRL		0x07
+#define SDIOD_CCCR_CAPABLITIES		0x08
+#define SDIOD_CCCR_CISPTR_0		0x09
+#define SDIOD_CCCR_CISPTR_1		0x0A
+#define SDIOD_CCCR_CISPTR_2		0x0B
+#define SDIOD_CCCR_BUSSUSP		0x0C
+#define SDIOD_CCCR_FUNCSEL		0x0D
+#define SDIOD_CCCR_EXECFLAGS		0x0E
+#define SDIOD_CCCR_RDYFLAGS		0x0F
+#define SDIOD_CCCR_BLKSIZE_0		0x10
+#define SDIOD_CCCR_BLKSIZE_1		0x11
+#define SDIOD_CCCR_POWER_CONTROL	0x12
+#define SDIOD_CCCR_SPEED_CONTROL	0x13
+#define SDIOD_CCCR_UHSI_SUPPORT		0x14
+#define SDIOD_CCCR_DRIVER_STRENGTH	0x15
+#define SDIOD_CCCR_INTR_EXTN		0x16
+
+/* Broadcom extensions (corerev >= 1) */
+#define SDIOD_CCCR_BRCM_CARDCAP		0xf0
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD14_SUPPORT	0x02
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD14_EXT	0x04
+#define SDIOD_CCCR_BRCM_CARDCAP_CMD_NODEC	0x08
+#define SDIOD_CCCR_BRCM_CARDCTL			0xf1
+#define SDIOD_CCCR_BRCM_SEPINT			0xf2
+
+/* cccr_sdio_rev */
+#define SDIO_REV_SDIOID_MASK	0xf0	/* SDIO spec revision number */
+#define SDIO_REV_CCCRID_MASK	0x0f	/* CCCR format version number */
+#define SDIO_SPEC_VERSION_3_0	0x40	/* SDIO spec version 3.0 */
+
+/* sd_rev */
+#define SD_REV_PHY_MASK		0x0f	/* SD format version number */
+
+/* io_en */
+#define SDIO_FUNC_ENABLE_1	0x02	/* function 1 I/O enable */
+#define SDIO_FUNC_ENABLE_2	0x04	/* function 2 I/O enable */
+
+/* io_rdys */
+#define SDIO_FUNC_READY_1	0x02	/* function 1 I/O ready */
+#define SDIO_FUNC_READY_2	0x04	/* function 2 I/O ready */
+
+/* intr_ctl */
+#define INTR_CTL_MASTER_EN	0x1	/* interrupt enable master */
+#define INTR_CTL_FUNC1_EN	0x2	/* interrupt enable for function 1 */
+#define INTR_CTL_FUNC2_EN	0x4	/* interrupt enable for function 2 */
+
+/* intr_status */
+#define INTR_STATUS_FUNC1	0x2	/* interrupt pending for function 1 */
+#define INTR_STATUS_FUNC2	0x4	/* interrupt pending for function 2 */
+
+/* io_abort */
+#define IO_ABORT_RESET_ALL	0x08	/* I/O card reset */
+#define IO_ABORT_FUNC_MASK	0x07	/* abort selction: function x */
+
+/* bus_inter */
+#define BUS_CARD_DETECT_DIS	0x80	/* Card Detect disable */
+#define BUS_SPI_CONT_INTR_CAP	0x40	/* support continuous SPI interrupt */
+#define BUS_SPI_CONT_INTR_EN	0x20	/* continuous SPI interrupt enable */
+#define BUS_SD_DATA_WIDTH_MASK	0x03	/* bus width mask */
+#define BUS_SD_DATA_WIDTH_4BIT	0x02	/* bus width 4-bit mode */
+#define BUS_SD_DATA_WIDTH_1BIT	0x00	/* bus width 1-bit mode */
+
+/* capability */
+#define SDIO_CAP_4BLS		0x80	/* 4-bit support for low speed card */
+#define SDIO_CAP_LSC		0x40	/* low speed card */
+#define SDIO_CAP_E4MI		0x20	/* enable interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_S4MI		0x10	/* support interrupt between block of data in 4-bit mode */
+#define SDIO_CAP_SBS		0x08	/* support suspend/resume */
+#define SDIO_CAP_SRW		0x04	/* support read wait */
+#define SDIO_CAP_SMB		0x02	/* support multi-block transfer */
+#define SDIO_CAP_SDC		0x01	/* Support Direct commands during multi-byte transfer */
+
+/* power_control */
+#define SDIO_POWER_SMPC		0x01	/* supports master power control (RO) */
+#define SDIO_POWER_EMPC		0x02	/* enable master power control (allow > 200mA) (RW) */
+
+/* speed_control (control device entry into high-speed clocking mode) */
+#define SDIO_SPEED_SHS		0x01	/* supports high-speed [clocking] mode (RO) */
+#define SDIO_SPEED_EHS		0x02	/* enable high-speed [clocking] mode (RW) */
+#define SDIO_SPEED_UHSI_DDR50	   0x08
+
+/* for setting bus speed in card: 0x13h */
+#define SDIO_BUS_SPEED_UHSISEL_M	BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSISEL_S	1
+
+/* for getting bus speed cap in card: 0x14h */
+#define SDIO_BUS_SPEED_UHSICAP_M	BITFIELD_MASK(3)
+#define SDIO_BUS_SPEED_UHSICAP_S	0
+
+/* for getting driver type CAP in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_CAP_M	BITFIELD_MASK(3)
+#define SDIO_BUS_DRVR_TYPE_CAP_S	0
+
+/* for setting driver type selection in card: 0x15h */
+#define SDIO_BUS_DRVR_TYPE_SEL_M	BITFIELD_MASK(2)
+#define SDIO_BUS_DRVR_TYPE_SEL_S	4
+
+/* for getting async int support in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_CAP_M	BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_CAP_S	0
+
+/* for setting async int selection in card: 0x16h */
+#define SDIO_BUS_ASYNCINT_SEL_M	BITFIELD_MASK(1)
+#define SDIO_BUS_ASYNCINT_SEL_S	1
+
+/* brcm sepint */
+#define SDIO_SEPINT_MASK	0x01	/* route sdpcmdev intr onto separate pad (chip-specific) */
+#define SDIO_SEPINT_OE		0x02	/* 1 asserts output enable for above pad */
+#define SDIO_SEPINT_ACT_HI	0x04	/* use active high interrupt level instead of active low */
+
+/* FBR structure for function 1-7, FBR addresses and register offsets */
+typedef volatile struct {
+	uint8	devctr;			/* device interface, CSA control */
+	uint8	ext_dev;		/* extended standard I/O device type code */
+	uint8	pwr_sel;		/* power selection support */
+	uint8	PAD[6];			/* reserved */
+
+	uint8	cis_low;		/* CIS LSB */
+	uint8	cis_mid;
+	uint8	cis_high;		/* CIS MSB */
+	uint8	csa_low;		/* code storage area, LSB */
+	uint8	csa_mid;
+	uint8	csa_high;		/* code storage area, MSB */
+	uint8	csa_dat_win;		/* data access window to function */
+
+	uint8	fnx_blk_size[2];	/* block size, little endian */
+} sdio_fbr_t;
+
+/* Maximum number of I/O funcs */
+#define SDIOD_MAX_FUNCS			8
+#define SDIOD_MAX_IOFUNCS		7
+
+/* SDIO Device FBR Start Address  */
+#define SDIOD_FBR_STARTADDR		0x100
+
+/* SDIO Device FBR Size */
+#define SDIOD_FBR_SIZE			0x100
+
+/* Macro to calculate FBR register base */
+#define SDIOD_FBR_BASE(n)		((n) * 0x100)
+
+/* Function register offsets */
+#define SDIOD_FBR_DEVCTR		0x00	/* basic info for function */
+#define SDIOD_FBR_EXT_DEV		0x01	/* extended I/O device code */
+#define SDIOD_FBR_PWR_SEL		0x02	/* power selection bits */
+
+/* SDIO Function CIS ptr offset */
+#define SDIOD_FBR_CISPTR_0		0x09
+#define SDIOD_FBR_CISPTR_1		0x0A
+#define SDIOD_FBR_CISPTR_2		0x0B
+
+/* Code Storage Area pointer */
+#define SDIOD_FBR_CSA_ADDR_0		0x0C
+#define SDIOD_FBR_CSA_ADDR_1		0x0D
+#define SDIOD_FBR_CSA_ADDR_2		0x0E
+#define SDIOD_FBR_CSA_DATA		0x0F
+
+/* SDIO Function I/O Block Size */
+#define SDIOD_FBR_BLKSIZE_0		0x10
+#define SDIOD_FBR_BLKSIZE_1		0x11
+
+/* devctr */
+#define SDIOD_FBR_DEVCTR_DIC	0x0f	/* device interface code */
+#define SDIOD_FBR_DECVTR_CSA	0x40	/* CSA support flag */
+#define SDIOD_FBR_DEVCTR_CSA_EN	0x80	/* CSA enabled */
+/* interface codes */
+#define SDIOD_DIC_NONE		0	/* SDIO standard interface is not supported */
+#define SDIOD_DIC_UART		1
+#define SDIOD_DIC_BLUETOOTH_A	2
+#define SDIOD_DIC_BLUETOOTH_B	3
+#define SDIOD_DIC_GPS		4
+#define SDIOD_DIC_CAMERA	5
+#define SDIOD_DIC_PHS		6
+#define SDIOD_DIC_WLAN		7
+#define SDIOD_DIC_EXT		0xf	/* extended device interface, read ext_dev register */
+
+/* pwr_sel */
+#define SDIOD_PWR_SEL_SPS	0x01	/* supports power selection */
+#define SDIOD_PWR_SEL_EPS	0x02	/* enable power selection (low-current mode) */
+
+/* misc defines */
+#define SDIO_FUNC_0		0
+#define SDIO_FUNC_1		1
+#define SDIO_FUNC_2		2
+#define SDIO_FUNC_3		3
+#define SDIO_FUNC_4		4
+#define SDIO_FUNC_5		5
+#define SDIO_FUNC_6		6
+#define SDIO_FUNC_7		7
+
+#define SD_CARD_TYPE_UNKNOWN	0	/* bad type or unrecognized */
+#define SD_CARD_TYPE_IO		1	/* IO only card */
+#define SD_CARD_TYPE_MEMORY	2	/* memory only card */
+#define SD_CARD_TYPE_COMBO	3	/* IO and memory combo card */
+
+#define SDIO_MAX_BLOCK_SIZE	2048	/* maximum block size for block mode operation */
+#define SDIO_MIN_BLOCK_SIZE	1	/* minimum block size for block mode operation */
+
+/* Card registers: status bit position */
+#define CARDREG_STATUS_BIT_OUTOFRANGE		31
+#define CARDREG_STATUS_BIT_COMCRCERROR		23
+#define CARDREG_STATUS_BIT_ILLEGALCOMMAND	22
+#define CARDREG_STATUS_BIT_ERROR		19
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE3	12
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE2	11
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE1	10
+#define CARDREG_STATUS_BIT_IOCURRENTSTATE0	9
+#define CARDREG_STATUS_BIT_FUN_NUM_ERROR	4
+
+
+
+#define SD_CMD_GO_IDLE_STATE		0	/* mandatory for SDIO */
+#define SD_CMD_SEND_OPCOND		1
+#define SD_CMD_MMC_SET_RCA		3
+#define SD_CMD_IO_SEND_OP_COND		5	/* mandatory for SDIO */
+#define SD_CMD_SELECT_DESELECT_CARD	7
+#define SD_CMD_SEND_CSD			9
+#define SD_CMD_SEND_CID			10
+#define SD_CMD_STOP_TRANSMISSION	12
+#define SD_CMD_SEND_STATUS		13
+#define SD_CMD_GO_INACTIVE_STATE	15
+#define SD_CMD_SET_BLOCKLEN		16
+#define SD_CMD_READ_SINGLE_BLOCK	17
+#define SD_CMD_READ_MULTIPLE_BLOCK	18
+#define SD_CMD_WRITE_BLOCK		24
+#define SD_CMD_WRITE_MULTIPLE_BLOCK	25
+#define SD_CMD_PROGRAM_CSD		27
+#define SD_CMD_SET_WRITE_PROT		28
+#define SD_CMD_CLR_WRITE_PROT		29
+#define SD_CMD_SEND_WRITE_PROT		30
+#define SD_CMD_ERASE_WR_BLK_START	32
+#define SD_CMD_ERASE_WR_BLK_END		33
+#define SD_CMD_ERASE			38
+#define SD_CMD_LOCK_UNLOCK		42
+#define SD_CMD_IO_RW_DIRECT		52	/* mandatory for SDIO */
+#define SD_CMD_IO_RW_EXTENDED		53	/* mandatory for SDIO */
+#define SD_CMD_APP_CMD			55
+#define SD_CMD_GEN_CMD			56
+#define SD_CMD_READ_OCR			58
+#define SD_CMD_CRC_ON_OFF		59	/* mandatory for SDIO */
+#define SD_ACMD_SD_STATUS		13
+#define SD_ACMD_SEND_NUM_WR_BLOCKS	22
+#define SD_ACMD_SET_WR_BLOCK_ERASE_CNT	23
+#define SD_ACMD_SD_SEND_OP_COND		41
+#define SD_ACMD_SET_CLR_CARD_DETECT	42
+#define SD_ACMD_SEND_SCR		51
+
+/* argument for SD_CMD_IO_RW_DIRECT and SD_CMD_IO_RW_EXTENDED */
+#define SD_IO_OP_READ		0   /* Read_Write: Read */
+#define SD_IO_OP_WRITE		1   /* Read_Write: Write */
+#define SD_IO_RW_NORMAL		0   /* no RAW */
+#define SD_IO_RW_RAW		1   /* RAW */
+#define SD_IO_BYTE_MODE		0   /* Byte Mode */
+#define SD_IO_BLOCK_MODE	1   /* BlockMode */
+#define SD_IO_FIXED_ADDRESS	0   /* fix Address */
+#define SD_IO_INCREMENT_ADDRESS	1   /* IncrementAddress */
+
+/* build SD_CMD_IO_RW_DIRECT Argument */
+#define SDIO_IO_RW_DIRECT_ARG(rw, raw, func, addr, data) \
+	((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((raw) & 1) << 27) | \
+	 (((addr) & 0x1FFFF) << 9) | ((data) & 0xFF))
+
+/* build SD_CMD_IO_RW_EXTENDED Argument */
+#define SDIO_IO_RW_EXTENDED_ARG(rw, blk, func, addr, inc_addr, count) \
+	((((rw) & 1) << 31) | (((func) & 0x7) << 28) | (((blk) & 1) << 27) | \
+	 (((inc_addr) & 1) << 26) | (((addr) & 0x1FFFF) << 9) | ((count) & 0x1FF))
+
+/* SDIO response parameters */
+#define SD_RSP_NO_NONE			0
+#define SD_RSP_NO_1			1
+#define SD_RSP_NO_2			2
+#define SD_RSP_NO_3			3
+#define SD_RSP_NO_4			4
+#define SD_RSP_NO_5			5
+#define SD_RSP_NO_6			6
+
+	/* Modified R6 response (to CMD3) */
+#define SD_RSP_MR6_COM_CRC_ERROR	0x8000
+#define SD_RSP_MR6_ILLEGAL_COMMAND	0x4000
+#define SD_RSP_MR6_ERROR		0x2000
+
+	/* Modified R1 in R4 Response (to CMD5) */
+#define SD_RSP_MR1_SBIT			0x80
+#define SD_RSP_MR1_PARAMETER_ERROR	0x40
+#define SD_RSP_MR1_RFU5			0x20
+#define SD_RSP_MR1_FUNC_NUM_ERROR	0x10
+#define SD_RSP_MR1_COM_CRC_ERROR	0x08
+#define SD_RSP_MR1_ILLEGAL_COMMAND	0x04
+#define SD_RSP_MR1_RFU1			0x02
+#define SD_RSP_MR1_IDLE_STATE		0x01
+
+	/* R5 response (to CMD52 and CMD53) */
+#define SD_RSP_R5_COM_CRC_ERROR		0x80
+#define SD_RSP_R5_ILLEGAL_COMMAND	0x40
+#define SD_RSP_R5_IO_CURRENTSTATE1	0x20
+#define SD_RSP_R5_IO_CURRENTSTATE0	0x10
+#define SD_RSP_R5_ERROR			0x08
+#define SD_RSP_R5_RFU			0x04
+#define SD_RSP_R5_FUNC_NUM_ERROR	0x02
+#define SD_RSP_R5_OUT_OF_RANGE		0x01
+
+#define SD_RSP_R5_ERRBITS		0xCB
+
+
+/* ------------------------------------------------
+ *  SDIO Commands and responses
+ *
+ *  I/O only commands are:
+ *      CMD0, CMD3, CMD5, CMD7, CMD14, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+/* SDIO Commands */
+#define SDIOH_CMD_0		0
+#define SDIOH_CMD_3		3
+#define SDIOH_CMD_5		5
+#define SDIOH_CMD_7		7
+#define SDIOH_CMD_11		11
+#define SDIOH_CMD_14		14
+#define SDIOH_CMD_15		15
+#define SDIOH_CMD_19		19
+#define SDIOH_CMD_52		52
+#define SDIOH_CMD_53		53
+#define SDIOH_CMD_59		59
+
+/* SDIO Command Responses */
+#define SDIOH_RSP_NONE		0
+#define SDIOH_RSP_R1		1
+#define SDIOH_RSP_R2		2
+#define SDIOH_RSP_R3		3
+#define SDIOH_RSP_R4		4
+#define SDIOH_RSP_R5		5
+#define SDIOH_RSP_R6		6
+
+/*
+ *  SDIO Response Error flags
+ */
+#define SDIOH_RSP5_ERROR_FLAGS	0xCB
+
+/* ------------------------------------------------
+ * SDIO Command structures. I/O only commands are:
+ *
+ * 	CMD0, CMD3, CMD5, CMD7, CMD15, CMD52, CMD53
+ * ------------------------------------------------
+ */
+
+#define CMD5_OCR_M		BITFIELD_MASK(24)
+#define CMD5_OCR_S		0
+
+#define CMD5_S18R_M		BITFIELD_MASK(1)
+#define CMD5_S18R_S		24
+
+#define CMD7_RCA_M		BITFIELD_MASK(16)
+#define CMD7_RCA_S		16
+
+#define CMD14_RCA_M		BITFIELD_MASK(16)
+#define CMD14_RCA_S		16
+#define CMD14_SLEEP_M		BITFIELD_MASK(1)
+#define CMD14_SLEEP_S		15
+
+#define CMD_15_RCA_M		BITFIELD_MASK(16)
+#define CMD_15_RCA_S		16
+
+#define CMD52_DATA_M		BITFIELD_MASK(8)  /* Bits [7:0]    - Write Data/Stuff bits of CMD52
+						   */
+#define CMD52_DATA_S		0
+#define CMD52_REG_ADDR_M	BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD52_REG_ADDR_S	9
+#define CMD52_RAW_M		BITFIELD_MASK(1)  /* Bit  27       - Read after Write flag */
+#define CMD52_RAW_S		27
+#define CMD52_FUNCTION_M	BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD52_FUNCTION_S	28
+#define CMD52_RW_FLAG_M		BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD52_RW_FLAG_S		31
+
+
+#define CMD53_BYTE_BLK_CNT_M	BITFIELD_MASK(9) /* Bits [8:0]     - Byte/Block Count of CMD53 */
+#define CMD53_BYTE_BLK_CNT_S	0
+#define CMD53_REG_ADDR_M	BITFIELD_MASK(17) /* Bits [25:9]   - register address */
+#define CMD53_REG_ADDR_S	9
+#define CMD53_OP_CODE_M		BITFIELD_MASK(1)  /* Bit  26       - R/W Operation Code */
+#define CMD53_OP_CODE_S		26
+#define CMD53_BLK_MODE_M	BITFIELD_MASK(1)  /* Bit  27       - Block Mode */
+#define CMD53_BLK_MODE_S	27
+#define CMD53_FUNCTION_M	BITFIELD_MASK(3)  /* Bits [30:28]  - Function number */
+#define CMD53_FUNCTION_S	28
+#define CMD53_RW_FLAG_M		BITFIELD_MASK(1)  /* Bit  31       - R/W flag */
+#define CMD53_RW_FLAG_S		31
+
+/* ------------------------------------------------------
+ * SDIO Command Response structures for SD1 and SD4 modes
+ *  -----------------------------------------------------
+ */
+#define RSP4_IO_OCR_M		BITFIELD_MASK(24) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_IO_OCR_S		0
+
+#define RSP4_S18A_M			BITFIELD_MASK(1) /* Bits [23:0]  - Card's OCR Bits [23:0] */
+#define RSP4_S18A_S			24
+
+#define RSP4_STUFF_M		BITFIELD_MASK(3)  /* Bits [26:24] - Stuff bits */
+#define RSP4_STUFF_S		24
+#define RSP4_MEM_PRESENT_M	BITFIELD_MASK(1)  /* Bit  27      - Memory present */
+#define RSP4_MEM_PRESENT_S	27
+#define RSP4_NUM_FUNCS_M	BITFIELD_MASK(3)  /* Bits [30:28] - Number of I/O funcs */
+#define RSP4_NUM_FUNCS_S	28
+#define RSP4_CARD_READY_M	BITFIELD_MASK(1)  /* Bit  31      - SDIO card ready */
+#define RSP4_CARD_READY_S	31
+
+#define RSP6_STATUS_M		BITFIELD_MASK(16) /* Bits [15:0]  - Card status bits [19,22,23,12:0]
+						   */
+#define RSP6_STATUS_S		0
+#define RSP6_IO_RCA_M		BITFIELD_MASK(16) /* Bits [31:16] - RCA bits[31-16] */
+#define RSP6_IO_RCA_S		16
+
+#define RSP1_AKE_SEQ_ERROR_M	BITFIELD_MASK(1)  /* Bit 3       - Authentication seq error */
+#define RSP1_AKE_SEQ_ERROR_S	3
+#define RSP1_APP_CMD_M		BITFIELD_MASK(1)  /* Bit 5       - Card expects ACMD */
+#define RSP1_APP_CMD_S		5
+#define RSP1_READY_FOR_DATA_M	BITFIELD_MASK(1)  /* Bit 8       - Ready for data (buff empty) */
+#define RSP1_READY_FOR_DATA_S	8
+#define RSP1_CURR_STATE_M	BITFIELD_MASK(4)  /* Bits [12:9] - State of card
+						   * when Cmd was received
+						   */
+#define RSP1_CURR_STATE_S	9
+#define RSP1_EARSE_RESET_M	BITFIELD_MASK(1)  /* Bit 13   - Erase seq cleared */
+#define RSP1_EARSE_RESET_S	13
+#define RSP1_CARD_ECC_DISABLE_M	BITFIELD_MASK(1)  /* Bit 14   - Card ECC disabled */
+#define RSP1_CARD_ECC_DISABLE_S	14
+#define RSP1_WP_ERASE_SKIP_M	BITFIELD_MASK(1)  /* Bit 15   - Partial blocks erased due to W/P */
+#define RSP1_WP_ERASE_SKIP_S	15
+#define RSP1_CID_CSD_OVERW_M	BITFIELD_MASK(1)  /* Bit 16   - Illegal write to CID or R/O bits
+						   * of CSD
+						   */
+#define RSP1_CID_CSD_OVERW_S	16
+#define RSP1_ERROR_M		BITFIELD_MASK(1)  /* Bit 19   - General/Unknown error */
+#define RSP1_ERROR_S		19
+#define RSP1_CC_ERROR_M		BITFIELD_MASK(1)  /* Bit 20   - Internal Card Control error */
+#define RSP1_CC_ERROR_S		20
+#define RSP1_CARD_ECC_FAILED_M	BITFIELD_MASK(1)  /* Bit 21   - Card internal ECC failed
+						   * to correct data
+						   */
+#define RSP1_CARD_ECC_FAILED_S	21
+#define RSP1_ILLEGAL_CMD_M	BITFIELD_MASK(1)  /* Bit 22   - Cmd not legal for the card state */
+#define RSP1_ILLEGAL_CMD_S	22
+#define RSP1_COM_CRC_ERROR_M	BITFIELD_MASK(1)  /* Bit 23   - CRC check of previous command failed
+						   */
+#define RSP1_COM_CRC_ERROR_S	23
+#define RSP1_LOCK_UNLOCK_FAIL_M	BITFIELD_MASK(1)  /* Bit 24   - Card lock-unlock Cmd Seq error */
+#define RSP1_LOCK_UNLOCK_FAIL_S	24
+#define RSP1_CARD_LOCKED_M	BITFIELD_MASK(1)  /* Bit 25   - Card locked by the host */
+#define RSP1_CARD_LOCKED_S	25
+#define RSP1_WP_VIOLATION_M	BITFIELD_MASK(1)  /* Bit 26   - Attempt to program
+						   * write-protected blocks
+						   */
+#define RSP1_WP_VIOLATION_S	26
+#define RSP1_ERASE_PARAM_M	BITFIELD_MASK(1)  /* Bit 27   - Invalid erase blocks */
+#define RSP1_ERASE_PARAM_S	27
+#define RSP1_ERASE_SEQ_ERR_M	BITFIELD_MASK(1)  /* Bit 28   - Erase Cmd seq error */
+#define RSP1_ERASE_SEQ_ERR_S	28
+#define RSP1_BLK_LEN_ERR_M	BITFIELD_MASK(1)  /* Bit 29   - Block length error */
+#define RSP1_BLK_LEN_ERR_S	29
+#define RSP1_ADDR_ERR_M		BITFIELD_MASK(1)  /* Bit 30   - Misaligned address */
+#define RSP1_ADDR_ERR_S		30
+#define RSP1_OUT_OF_RANGE_M	BITFIELD_MASK(1)  /* Bit 31   - Cmd arg was out of range */
+#define RSP1_OUT_OF_RANGE_S	31
+
+
+#define RSP5_DATA_M		BITFIELD_MASK(8)  /* Bits [0:7]   - data */
+#define RSP5_DATA_S		0
+#define RSP5_FLAGS_M		BITFIELD_MASK(8)  /* Bit  [15:8]  - Rsp flags */
+#define RSP5_FLAGS_S		8
+#define RSP5_STUFF_M		BITFIELD_MASK(16) /* Bits [31:16] - Stuff bits */
+#define RSP5_STUFF_S		16
+
+/* ----------------------------------------------
+ * SDIO Command Response structures for SPI mode
+ * ----------------------------------------------
+ */
+#define SPIRSP4_IO_OCR_M	BITFIELD_MASK(16) /* Bits [15:0]    - Card's OCR Bits [23:8] */
+#define SPIRSP4_IO_OCR_S	0
+#define SPIRSP4_STUFF_M		BITFIELD_MASK(3)  /* Bits [18:16]   - Stuff bits */
+#define SPIRSP4_STUFF_S		16
+#define SPIRSP4_MEM_PRESENT_M	BITFIELD_MASK(1)  /* Bit  19        - Memory present */
+#define SPIRSP4_MEM_PRESENT_S	19
+#define SPIRSP4_NUM_FUNCS_M	BITFIELD_MASK(3)  /* Bits [22:20]   - Number of I/O funcs */
+#define SPIRSP4_NUM_FUNCS_S	20
+#define SPIRSP4_CARD_READY_M	BITFIELD_MASK(1)  /* Bit  23        - SDIO card ready */
+#define SPIRSP4_CARD_READY_S	23
+#define SPIRSP4_IDLE_STATE_M	BITFIELD_MASK(1)  /* Bit  24        - idle state */
+#define SPIRSP4_IDLE_STATE_S	24
+#define SPIRSP4_ILLEGAL_CMD_M	BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP4_ILLEGAL_CMD_S	26
+#define SPIRSP4_COM_CRC_ERROR_M	BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP4_COM_CRC_ERROR_S	27
+#define SPIRSP4_FUNC_NUM_ERROR_M	BITFIELD_MASK(1)  /* Bit  28        - Function number error
+							   */
+#define SPIRSP4_FUNC_NUM_ERROR_S	28
+#define SPIRSP4_PARAM_ERROR_M	BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP4_PARAM_ERROR_S	30
+#define SPIRSP4_START_BIT_M	BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP4_START_BIT_S	31
+
+#define SPIRSP5_DATA_M			BITFIELD_MASK(8)  /* Bits [23:16]   - R/W Data */
+#define SPIRSP5_DATA_S			16
+#define SPIRSP5_IDLE_STATE_M		BITFIELD_MASK(1)  /* Bit  24        - Idle state */
+#define SPIRSP5_IDLE_STATE_S		24
+#define SPIRSP5_ILLEGAL_CMD_M		BITFIELD_MASK(1)  /* Bit  26        - Illegal Cmd error */
+#define SPIRSP5_ILLEGAL_CMD_S		26
+#define SPIRSP5_COM_CRC_ERROR_M		BITFIELD_MASK(1)  /* Bit  27        - COM CRC error */
+#define SPIRSP5_COM_CRC_ERROR_S		27
+#define SPIRSP5_FUNC_NUM_ERROR_M	BITFIELD_MASK(1)  /* Bit  28        - Function number error
+							   */
+#define SPIRSP5_FUNC_NUM_ERROR_S	28
+#define SPIRSP5_PARAM_ERROR_M		BITFIELD_MASK(1)  /* Bit  30        - Parameter Error Bit */
+#define SPIRSP5_PARAM_ERROR_S		30
+#define SPIRSP5_START_BIT_M		BITFIELD_MASK(1)  /* Bit  31        - Start Bit */
+#define SPIRSP5_START_BIT_S		31
+
+/* RSP6 card status format; Pg 68 Physical Layer spec v 1.10 */
+#define RSP6STAT_AKE_SEQ_ERROR_M	BITFIELD_MASK(1)  /* Bit 3	- Authentication seq error
+							   */
+#define RSP6STAT_AKE_SEQ_ERROR_S	3
+#define RSP6STAT_APP_CMD_M		BITFIELD_MASK(1)  /* Bit 5	- Card expects ACMD */
+#define RSP6STAT_APP_CMD_S		5
+#define RSP6STAT_READY_FOR_DATA_M	BITFIELD_MASK(1)  /* Bit 8	- Ready for data
+							   * (buff empty)
+							   */
+#define RSP6STAT_READY_FOR_DATA_S	8
+#define RSP6STAT_CURR_STATE_M		BITFIELD_MASK(4)  /* Bits [12:9] - Card state at
+							   * Cmd reception
+							   */
+#define RSP6STAT_CURR_STATE_S		9
+#define RSP6STAT_ERROR_M		BITFIELD_MASK(1)  /* Bit 13  - General/Unknown error Bit 19
+							   */
+#define RSP6STAT_ERROR_S		13
+#define RSP6STAT_ILLEGAL_CMD_M		BITFIELD_MASK(1)  /* Bit 14  - Illegal cmd for
+							   * card state Bit 22
+							   */
+#define RSP6STAT_ILLEGAL_CMD_S		14
+#define RSP6STAT_COM_CRC_ERROR_M	BITFIELD_MASK(1)  /* Bit 15  - CRC previous command
+							   * failed Bit 23
+							   */
+#define RSP6STAT_COM_CRC_ERROR_S	15
+
+#define SDIOH_XFER_TYPE_READ    SD_IO_OP_READ
+#define SDIOH_XFER_TYPE_WRITE   SD_IO_OP_WRITE
+
+/* command issue options */
+#define CMD_OPTION_DEFAULT	0
+#define CMD_OPTION_TUNING	1
+
+#endif /* def BCMSDIO */
+#endif /* _SDIO_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sdioh.h b/drivers/net/wireless/bcm4336/include/sdioh.h
--- a/drivers/net/wireless/bcm4336/include/sdioh.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sdioh.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,427 @@
+/*
+ * SDIO Host Controller Spec header file
+ * Register map and definitions for the Standard Host Controller
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sdioh.h 345499 2012-07-18 06:59:05Z $
+ */
+
+#ifndef	_SDIOH_H
+#define	_SDIOH_H
+
+#define SD_SysAddr			0x000
+#define SD_BlockSize			0x004
+#define SD_BlockCount 			0x006
+#define SD_Arg0				0x008
+#define SD_Arg1 			0x00A
+#define SD_TransferMode			0x00C
+#define SD_Command 			0x00E
+#define SD_Response0			0x010
+#define SD_Response1 			0x012
+#define SD_Response2			0x014
+#define SD_Response3 			0x016
+#define SD_Response4			0x018
+#define SD_Response5 			0x01A
+#define SD_Response6			0x01C
+#define SD_Response7 			0x01E
+#define SD_BufferDataPort0		0x020
+#define SD_BufferDataPort1 		0x022
+#define SD_PresentState			0x024
+#define SD_HostCntrl			0x028
+#define SD_PwrCntrl			0x029
+#define SD_BlockGapCntrl 		0x02A
+#define SD_WakeupCntrl 			0x02B
+#define SD_ClockCntrl			0x02C
+#define SD_TimeoutCntrl 		0x02E
+#define SD_SoftwareReset		0x02F
+#define SD_IntrStatus			0x030
+#define SD_ErrorIntrStatus 		0x032
+#define SD_IntrStatusEnable		0x034
+#define SD_ErrorIntrStatusEnable 	0x036
+#define SD_IntrSignalEnable		0x038
+#define SD_ErrorIntrSignalEnable 	0x03A
+#define SD_CMD12ErrorStatus		0x03C
+#define SD_Capabilities			0x040
+#define SD_Capabilities3		0x044
+#define SD_MaxCurCap			0x048
+#define SD_MaxCurCap_Reserved		0x04C
+#define SD_ADMA_ErrStatus		0x054
+#define SD_ADMA_SysAddr			0x58
+#define SD_SlotInterruptStatus		0x0FC
+#define SD_HostControllerVersion 	0x0FE
+#define	SD_GPIO_Reg			0x100
+#define	SD_GPIO_OE			0x104
+#define	SD_GPIO_Enable			0x108
+
+/* SD specific registers in PCI config space */
+#define SD_SlotInfo	0x40
+
+/* HC 3.0 specific registers and offsets */
+#define SD3_HostCntrl2			0x03E
+/* preset regsstart and count */
+#define SD3_PresetValStart		0x060
+#define SD3_PresetValCount		8
+/* preset-indiv regs */
+#define SD3_PresetVal_init		0x060
+#define SD3_PresetVal_default	0x062
+#define SD3_PresetVal_HS		0x064
+#define SD3_PresetVal_SDR12		0x066
+#define SD3_PresetVal_SDR25		0x068
+#define SD3_PresetVal_SDR50		0x06a
+#define SD3_PresetVal_SDR104	0x06c
+#define SD3_PresetVal_DDR50		0x06e
+/* SDIO3.0 Revx specific Registers */
+#define SD3_Tuning_Info_Register 0x0EC
+#define SD3_WL_BT_reset_register 0x0F0
+
+
+/* preset value indices */
+#define SD3_PRESETVAL_INITIAL_IX	0
+#define SD3_PRESETVAL_DESPEED_IX	1
+#define SD3_PRESETVAL_HISPEED_IX	2
+#define SD3_PRESETVAL_SDR12_IX		3
+#define SD3_PRESETVAL_SDR25_IX		4
+#define SD3_PRESETVAL_SDR50_IX		5
+#define SD3_PRESETVAL_SDR104_IX		6
+#define SD3_PRESETVAL_DDR50_IX		7
+
+/* SD_Capabilities reg (0x040) */
+#define CAP_TO_CLKFREQ_M 	BITFIELD_MASK(6)
+#define CAP_TO_CLKFREQ_S 	0
+#define CAP_TO_CLKUNIT_M  	BITFIELD_MASK(1)
+#define CAP_TO_CLKUNIT_S 	7
+/* Note: for sdio-2.0 case, this mask has to be 6 bits, but msb 2
+	bits are reserved. going ahead with 8 bits, as it is req for 3.0
+*/
+#define CAP_BASECLK_M 		BITFIELD_MASK(8)
+#define CAP_BASECLK_S 		8
+#define CAP_MAXBLOCK_M 		BITFIELD_MASK(2)
+#define CAP_MAXBLOCK_S		16
+#define CAP_ADMA2_M		BITFIELD_MASK(1)
+#define CAP_ADMA2_S		19
+#define CAP_ADMA1_M		BITFIELD_MASK(1)
+#define CAP_ADMA1_S		20
+#define CAP_HIGHSPEED_M		BITFIELD_MASK(1)
+#define CAP_HIGHSPEED_S		21
+#define CAP_DMA_M		BITFIELD_MASK(1)
+#define CAP_DMA_S		22
+#define CAP_SUSPEND_M		BITFIELD_MASK(1)
+#define CAP_SUSPEND_S		23
+#define CAP_VOLT_3_3_M		BITFIELD_MASK(1)
+#define CAP_VOLT_3_3_S		24
+#define CAP_VOLT_3_0_M		BITFIELD_MASK(1)
+#define CAP_VOLT_3_0_S		25
+#define CAP_VOLT_1_8_M		BITFIELD_MASK(1)
+#define CAP_VOLT_1_8_S		26
+#define CAP_64BIT_HOST_M	BITFIELD_MASK(1)
+#define CAP_64BIT_HOST_S	28
+
+#define SDIO_OCR_READ_FAIL	(2)
+
+
+#define CAP_ASYNCINT_SUP_M	BITFIELD_MASK(1)
+#define CAP_ASYNCINT_SUP_S	29
+
+#define CAP_SLOTTYPE_M		BITFIELD_MASK(2)
+#define CAP_SLOTTYPE_S		30
+
+#define CAP3_MSBits_OFFSET	(32)
+/* note: following are caps MSB32 bits.
+	So the bits start from 0, instead of 32. that is why
+	CAP3_MSBits_OFFSET is subtracted.
+*/
+#define CAP3_SDR50_SUP_M		BITFIELD_MASK(1)
+#define CAP3_SDR50_SUP_S		(32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_SDR104_SUP_M	BITFIELD_MASK(1)
+#define CAP3_SDR104_SUP_S	(33 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DDR50_SUP_M	BITFIELD_MASK(1)
+#define CAP3_DDR50_SUP_S	(34 - CAP3_MSBits_OFFSET)
+
+/* for knowing the clk caps in a single read */
+#define CAP3_30CLKCAP_M		BITFIELD_MASK(3)
+#define CAP3_30CLKCAP_S		(32 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_A_M	BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_A_S	(36 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_C_M	BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_C_S	(37 - CAP3_MSBits_OFFSET)
+
+#define CAP3_DRIVTYPE_D_M	BITFIELD_MASK(1)
+#define CAP3_DRIVTYPE_D_S	(38 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_TC_M	BITFIELD_MASK(4)
+#define CAP3_RETUNING_TC_S	(40 - CAP3_MSBits_OFFSET)
+
+#define CAP3_TUNING_SDR50_M	BITFIELD_MASK(1)
+#define CAP3_TUNING_SDR50_S	(45 - CAP3_MSBits_OFFSET)
+
+#define CAP3_RETUNING_MODES_M	BITFIELD_MASK(2)
+#define CAP3_RETUNING_MODES_S	(46 - CAP3_MSBits_OFFSET)
+
+#define CAP3_CLK_MULT_M		BITFIELD_MASK(8)
+#define CAP3_CLK_MULT_S		(48 - CAP3_MSBits_OFFSET)
+
+#define PRESET_DRIVR_SELECT_M	BITFIELD_MASK(2)
+#define PRESET_DRIVR_SELECT_S	14
+
+#define PRESET_CLK_DIV_M	BITFIELD_MASK(10)
+#define PRESET_CLK_DIV_S	0
+
+/* SD_MaxCurCap reg (0x048) */
+#define CAP_CURR_3_3_M		BITFIELD_MASK(8)
+#define CAP_CURR_3_3_S		0
+#define CAP_CURR_3_0_M		BITFIELD_MASK(8)
+#define CAP_CURR_3_0_S		8
+#define CAP_CURR_1_8_M		BITFIELD_MASK(8)
+#define CAP_CURR_1_8_S		16
+
+/* SD_SysAddr: Offset 0x0000, Size 4 bytes */
+
+/* SD_BlockSize: Offset 0x004, Size 2 bytes */
+#define BLKSZ_BLKSZ_M		BITFIELD_MASK(12)
+#define BLKSZ_BLKSZ_S		0
+#define BLKSZ_BNDRY_M		BITFIELD_MASK(3)
+#define BLKSZ_BNDRY_S		12
+
+/* SD_BlockCount: Offset 0x006, size 2 bytes */
+
+/* SD_Arg0: Offset 0x008, size = 4 bytes  */
+/* SD_TransferMode Offset 0x00C, size = 2 bytes */
+#define XFER_DMA_ENABLE_M   	BITFIELD_MASK(1)
+#define XFER_DMA_ENABLE_S	0
+#define XFER_BLK_COUNT_EN_M 	BITFIELD_MASK(1)
+#define XFER_BLK_COUNT_EN_S	1
+#define XFER_CMD_12_EN_M    	BITFIELD_MASK(1)
+#define XFER_CMD_12_EN_S 	2
+#define XFER_DATA_DIRECTION_M	BITFIELD_MASK(1)
+#define XFER_DATA_DIRECTION_S	4
+#define XFER_MULTI_BLOCK_M	BITFIELD_MASK(1)
+#define XFER_MULTI_BLOCK_S	5
+
+/* SD_Command: Offset 0x00E, size = 2 bytes */
+/* resp_type field */
+#define RESP_TYPE_NONE 		0
+#define RESP_TYPE_136  		1
+#define RESP_TYPE_48   		2
+#define RESP_TYPE_48_BUSY	3
+/* type field */
+#define CMD_TYPE_NORMAL		0
+#define CMD_TYPE_SUSPEND	1
+#define CMD_TYPE_RESUME		2
+#define CMD_TYPE_ABORT		3
+
+#define CMD_RESP_TYPE_M		BITFIELD_MASK(2)	/* Bits [0-1] 	- Response type */
+#define CMD_RESP_TYPE_S		0
+#define CMD_CRC_EN_M		BITFIELD_MASK(1)	/* Bit 3 	- CRC enable */
+#define CMD_CRC_EN_S		3
+#define CMD_INDEX_EN_M		BITFIELD_MASK(1)	/* Bit 4 	- Enable index checking */
+#define CMD_INDEX_EN_S		4
+#define CMD_DATA_EN_M		BITFIELD_MASK(1)	/* Bit 5 	- Using DAT line */
+#define CMD_DATA_EN_S		5
+#define CMD_TYPE_M		BITFIELD_MASK(2)	/* Bit [6-7] 	- Normal, abort, resume, etc
+							 */
+#define CMD_TYPE_S		6
+#define CMD_INDEX_M		BITFIELD_MASK(6)	/* Bits [8-13] 	- Command number */
+#define CMD_INDEX_S		8
+
+/* SD_BufferDataPort0	: Offset 0x020, size = 2 or 4 bytes */
+/* SD_BufferDataPort1 	: Offset 0x022, size = 2 bytes */
+/* SD_PresentState	: Offset 0x024, size = 4 bytes */
+#define PRES_CMD_INHIBIT_M	BITFIELD_MASK(1)	/* Bit 0	May use CMD */
+#define PRES_CMD_INHIBIT_S	0
+#define PRES_DAT_INHIBIT_M	BITFIELD_MASK(1)	/* Bit 1	May use DAT */
+#define PRES_DAT_INHIBIT_S	1
+#define PRES_DAT_BUSY_M		BITFIELD_MASK(1)	/* Bit 2	DAT is busy */
+#define PRES_DAT_BUSY_S		2
+#define PRES_PRESENT_RSVD_M	BITFIELD_MASK(5)	/* Bit [3-7]	rsvd */
+#define PRES_PRESENT_RSVD_S	3
+#define PRES_WRITE_ACTIVE_M	BITFIELD_MASK(1)	/* Bit 8	Write is active */
+#define PRES_WRITE_ACTIVE_S	8
+#define PRES_READ_ACTIVE_M	BITFIELD_MASK(1)	/* Bit 9	Read is active */
+#define PRES_READ_ACTIVE_S	9
+#define PRES_WRITE_DATA_RDY_M	BITFIELD_MASK(1)	/* Bit 10	Write buf is avail */
+#define PRES_WRITE_DATA_RDY_S	10
+#define PRES_READ_DATA_RDY_M	BITFIELD_MASK(1)	/* Bit 11	Read buf data avail */
+#define PRES_READ_DATA_RDY_S	11
+#define PRES_CARD_PRESENT_M	BITFIELD_MASK(1)	/* Bit 16	Card present - debounced */
+#define PRES_CARD_PRESENT_S	16
+#define PRES_CARD_STABLE_M	BITFIELD_MASK(1)	/* Bit 17	Debugging */
+#define PRES_CARD_STABLE_S	17
+#define PRES_CARD_PRESENT_RAW_M	BITFIELD_MASK(1)	/* Bit 18	Not debounced */
+#define PRES_CARD_PRESENT_RAW_S	18
+#define PRES_WRITE_ENABLED_M	BITFIELD_MASK(1)	/* Bit 19	Write protected? */
+#define PRES_WRITE_ENABLED_S	19
+#define PRES_DAT_SIGNAL_M	BITFIELD_MASK(4)	/* Bit [20-23]	Debugging */
+#define PRES_DAT_SIGNAL_S	20
+#define PRES_CMD_SIGNAL_M	BITFIELD_MASK(1)	/* Bit 24	Debugging */
+#define PRES_CMD_SIGNAL_S	24
+
+/* SD_HostCntrl: Offset 0x028, size = 1 bytes */
+#define HOST_LED_M		BITFIELD_MASK(1)	/* Bit 0	LED On/Off */
+#define HOST_LED_S		0
+#define HOST_DATA_WIDTH_M	BITFIELD_MASK(1)	/* Bit 1	4 bit enable */
+#define HOST_DATA_WIDTH_S	1
+#define HOST_HI_SPEED_EN_M	BITFIELD_MASK(1)	/* Bit 2	High speed vs low speed */
+#define HOST_DMA_SEL_S		3
+#define HOST_DMA_SEL_M		BITFIELD_MASK(2)	/* Bit 4:3	DMA Select */
+#define HOST_HI_SPEED_EN_S	2
+
+/* Host Control2: */
+#define HOSTCtrl2_PRESVAL_EN_M	BITFIELD_MASK(1)	/* 1 bit */
+#define HOSTCtrl2_PRESVAL_EN_S	15					/* bit# */
+
+#define HOSTCtrl2_ASYINT_EN_M	BITFIELD_MASK(1)	/* 1 bit */
+#define HOSTCtrl2_ASYINT_EN_S	14					/* bit# */
+
+#define HOSTCtrl2_SAMPCLK_SEL_M	BITFIELD_MASK(1)	/* 1 bit */
+#define HOSTCtrl2_SAMPCLK_SEL_S	7					/* bit# */
+
+#define HOSTCtrl2_EXEC_TUNING_M	BITFIELD_MASK(1)	/* 1 bit */
+#define HOSTCtrl2_EXEC_TUNING_S	6					/* bit# */
+
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_M	BITFIELD_MASK(2)	/* 2 bit */
+#define HOSTCtrl2_DRIVSTRENGTH_SEL_S	4					/* bit# */
+
+#define HOSTCtrl2_1_8SIG_EN_M	BITFIELD_MASK(1)	/* 1 bit */
+#define HOSTCtrl2_1_8SIG_EN_S	3					/* bit# */
+
+#define HOSTCtrl2_UHSMODE_SEL_M	BITFIELD_MASK(3)	/* 3 bit */
+#define HOSTCtrl2_UHSMODE_SEL_S	0					/* bit# */
+
+#define HOST_CONTR_VER_2		(1)
+#define HOST_CONTR_VER_3		(2)
+
+/* misc defines */
+#define SD1_MODE 		0x1	/* SD Host Cntrlr Spec */
+#define SD4_MODE 		0x2	/* SD Host Cntrlr Spec */
+
+/* SD_PwrCntrl: Offset 0x029, size = 1 bytes */
+#define PWR_BUS_EN_M		BITFIELD_MASK(1)	/* Bit 0	Power the bus */
+#define PWR_BUS_EN_S		0
+#define PWR_VOLTS_M		BITFIELD_MASK(3)	/* Bit [1-3]	Voltage Select */
+#define PWR_VOLTS_S		1
+
+/* SD_SoftwareReset: Offset 0x02F, size = 1 byte */
+#define SW_RESET_ALL_M		BITFIELD_MASK(1)	/* Bit 0	Reset All */
+#define SW_RESET_ALL_S		0
+#define SW_RESET_CMD_M		BITFIELD_MASK(1)	/* Bit 1	CMD Line Reset */
+#define SW_RESET_CMD_S		1
+#define SW_RESET_DAT_M		BITFIELD_MASK(1)	/* Bit 2	DAT Line Reset */
+#define SW_RESET_DAT_S		2
+
+/* SD_IntrStatus: Offset 0x030, size = 2 bytes */
+/* Defs also serve SD_IntrStatusEnable and SD_IntrSignalEnable */
+#define INTSTAT_CMD_COMPLETE_M		BITFIELD_MASK(1)	/* Bit 0 */
+#define INTSTAT_CMD_COMPLETE_S		0
+#define INTSTAT_XFER_COMPLETE_M		BITFIELD_MASK(1)
+#define INTSTAT_XFER_COMPLETE_S		1
+#define INTSTAT_BLOCK_GAP_EVENT_M	BITFIELD_MASK(1)
+#define INTSTAT_BLOCK_GAP_EVENT_S	2
+#define INTSTAT_DMA_INT_M		BITFIELD_MASK(1)
+#define INTSTAT_DMA_INT_S		3
+#define INTSTAT_BUF_WRITE_READY_M	BITFIELD_MASK(1)
+#define INTSTAT_BUF_WRITE_READY_S	4
+#define INTSTAT_BUF_READ_READY_M	BITFIELD_MASK(1)
+#define INTSTAT_BUF_READ_READY_S	5
+#define INTSTAT_CARD_INSERTION_M	BITFIELD_MASK(1)
+#define INTSTAT_CARD_INSERTION_S	6
+#define INTSTAT_CARD_REMOVAL_M		BITFIELD_MASK(1)
+#define INTSTAT_CARD_REMOVAL_S		7
+#define INTSTAT_CARD_INT_M		BITFIELD_MASK(1)
+#define INTSTAT_CARD_INT_S		8
+#define INTSTAT_RETUNING_INT_M		BITFIELD_MASK(1)	/* Bit 12 */
+#define INTSTAT_RETUNING_INT_S		12
+#define INTSTAT_ERROR_INT_M		BITFIELD_MASK(1)	/* Bit 15 */
+#define INTSTAT_ERROR_INT_S		15
+
+/* SD_ErrorIntrStatus: Offset 0x032, size = 2 bytes */
+/* Defs also serve SD_ErrorIntrStatusEnable and SD_ErrorIntrSignalEnable */
+#define ERRINT_CMD_TIMEOUT_M		BITFIELD_MASK(1)
+#define ERRINT_CMD_TIMEOUT_S		0
+#define ERRINT_CMD_CRC_M		BITFIELD_MASK(1)
+#define ERRINT_CMD_CRC_S		1
+#define ERRINT_CMD_ENDBIT_M		BITFIELD_MASK(1)
+#define ERRINT_CMD_ENDBIT_S		2
+#define ERRINT_CMD_INDEX_M		BITFIELD_MASK(1)
+#define ERRINT_CMD_INDEX_S		3
+#define ERRINT_DATA_TIMEOUT_M		BITFIELD_MASK(1)
+#define ERRINT_DATA_TIMEOUT_S		4
+#define ERRINT_DATA_CRC_M		BITFIELD_MASK(1)
+#define ERRINT_DATA_CRC_S		5
+#define ERRINT_DATA_ENDBIT_M		BITFIELD_MASK(1)
+#define ERRINT_DATA_ENDBIT_S		6
+#define ERRINT_CURRENT_LIMIT_M		BITFIELD_MASK(1)
+#define ERRINT_CURRENT_LIMIT_S		7
+#define ERRINT_AUTO_CMD12_M		BITFIELD_MASK(1)
+#define ERRINT_AUTO_CMD12_S		8
+#define ERRINT_VENDOR_M			BITFIELD_MASK(4)
+#define ERRINT_VENDOR_S			12
+#define ERRINT_ADMA_M			BITFIELD_MASK(1)
+#define ERRINT_ADMA_S			9
+
+/* Also provide definitions in "normal" form to allow combined masks */
+#define ERRINT_CMD_TIMEOUT_BIT		0x0001
+#define ERRINT_CMD_CRC_BIT		0x0002
+#define ERRINT_CMD_ENDBIT_BIT		0x0004
+#define ERRINT_CMD_INDEX_BIT		0x0008
+#define ERRINT_DATA_TIMEOUT_BIT		0x0010
+#define ERRINT_DATA_CRC_BIT		0x0020
+#define ERRINT_DATA_ENDBIT_BIT		0x0040
+#define ERRINT_CURRENT_LIMIT_BIT	0x0080
+#define ERRINT_AUTO_CMD12_BIT		0x0100
+#define ERRINT_ADMA_BIT		0x0200
+
+/* Masks to select CMD vs. DATA errors */
+#define ERRINT_CMD_ERRS		(ERRINT_CMD_TIMEOUT_BIT | ERRINT_CMD_CRC_BIT |\
+				 ERRINT_CMD_ENDBIT_BIT | ERRINT_CMD_INDEX_BIT)
+#define ERRINT_DATA_ERRS	(ERRINT_DATA_TIMEOUT_BIT | ERRINT_DATA_CRC_BIT |\
+				 ERRINT_DATA_ENDBIT_BIT | ERRINT_ADMA_BIT)
+#define ERRINT_TRANSFER_ERRS	(ERRINT_CMD_ERRS | ERRINT_DATA_ERRS)
+
+/* SD_WakeupCntr_BlockGapCntrl : Offset 0x02A , size = bytes */
+/* SD_ClockCntrl	: Offset 0x02C , size = bytes */
+/* SD_SoftwareReset_TimeoutCntrl 	: Offset 0x02E , size = bytes */
+/* SD_IntrStatus	: Offset 0x030 , size = bytes */
+/* SD_ErrorIntrStatus 	: Offset 0x032 , size = bytes */
+/* SD_IntrStatusEnable	: Offset 0x034 , size = bytes */
+/* SD_ErrorIntrStatusEnable : Offset 0x036 , size = bytes */
+/* SD_IntrSignalEnable	: Offset 0x038 , size = bytes */
+/* SD_ErrorIntrSignalEnable : Offset 0x03A , size = bytes */
+/* SD_CMD12ErrorStatus	: Offset 0x03C , size = bytes */
+/* SD_Capabilities	: Offset 0x040 , size = bytes */
+/* SD_MaxCurCap		: Offset 0x048 , size = bytes */
+/* SD_MaxCurCap_Reserved: Offset 0x04C , size = bytes */
+/* SD_SlotInterruptStatus: Offset 0x0FC , size = bytes */
+/* SD_HostControllerVersion : Offset 0x0FE , size = bytes */
+
+/* SDIO Host Control Register DMA Mode Definitions */
+#define SDIOH_SDMA_MODE			0
+#define SDIOH_ADMA1_MODE		1
+#define SDIOH_ADMA2_MODE		2
+#define SDIOH_ADMA2_64_MODE		3
+
+#define ADMA2_ATTRIBUTE_VALID		(1 << 0)	/* ADMA Descriptor line valid */
+#define ADMA2_ATTRIBUTE_END			(1 << 1)	/* End of Descriptor */
+#define ADMA2_ATTRIBUTE_INT			(1 << 2)	/* Interrupt when line is done */
+#define ADMA2_ATTRIBUTE_ACT_NOP		(0 << 4)	/* Skip current line, go to next. */
+#define ADMA2_ATTRIBUTE_ACT_RSV		(1 << 4)	/* Same as NOP */
+#define ADMA1_ATTRIBUTE_ACT_SET		(1 << 4)	/* ADMA1 Only - set transfer length */
+#define ADMA2_ATTRIBUTE_ACT_TRAN	(2 << 4)	/* Transfer Data of one descriptor line. */
+#define ADMA2_ATTRIBUTE_ACT_LINK	(3 << 4)	/* Link Descriptor */
+
+/* ADMA2 Descriptor Table Entry for 32-bit Address */
+typedef struct adma2_dscr_32b {
+	uint32 len_attr;
+	uint32 phys_addr;
+} adma2_dscr_32b_t;
+
+/* ADMA1 Descriptor Table Entry */
+typedef struct adma1_dscr {
+	uint32 phys_addr_attr;
+} adma1_dscr_t;
+
+#endif /* _SDIOH_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/sdiovar.h b/drivers/net/wireless/bcm4336/include/sdiovar.h
--- a/drivers/net/wireless/bcm4336/include/sdiovar.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/sdiovar.h	2018-05-06 08:49:50.630754337 +0200
@@ -0,0 +1,40 @@
+/*
+ * Structure used by apps whose drivers access SDIO drivers.
+ * Pulled out separately so dhdu and wlu can both use it.
+ *
+ * $ Copyright Open Broadcom Corporation $
+ *
+ * $Id: sdiovar.h 241182 2011-02-17 21:50:03Z $
+ */
+
+#ifndef _sdiovar_h_
+#define _sdiovar_h_
+
+#include <typedefs.h>
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+typedef struct sdreg {
+	int func;
+	int offset;
+	int value;
+} sdreg_t;
+
+/* Common msglevel constants */
+#define SDH_ERROR_VAL		0x0001	/* Error */
+#define SDH_TRACE_VAL		0x0002	/* Trace */
+#define SDH_INFO_VAL		0x0004	/* Info */
+#define SDH_DEBUG_VAL		0x0008	/* Debug */
+#define SDH_DATA_VAL		0x0010	/* Data */
+#define SDH_CTRL_VAL		0x0020	/* Control Regs */
+#define SDH_LOG_VAL		0x0040	/* Enable bcmlog */
+#define SDH_DMA_VAL		0x0080	/* DMA */
+
+#define NUM_PREV_TRANSACTIONS	16
+
+
+#include <packed_section_end.h>
+
+#endif /* _sdiovar_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/siutils.h b/drivers/net/wireless/bcm4336/include/siutils.h
--- a/drivers/net/wireless/bcm4336/include/siutils.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/siutils.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,571 @@
+/*
+ * Misc utility routines for accessing the SOC Interconnects
+ * of Broadcom HNBU chips.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: siutils.h 481602 2014-05-29 22:43:34Z $
+ */
+
+#ifndef	_siutils_h_
+#define	_siutils_h_
+
+#ifdef SR_DEBUG
+#include "wlioctl.h"
+#endif /* SR_DEBUG */
+
+
+/*
+ * Data structure to export all chip specific common variables
+ *   public (read-only) portion of siutils handle returned by si_attach()/si_kattach()
+ */
+struct si_pub {
+	uint	socitype;		/* SOCI_SB, SOCI_AI */
+
+	uint	bustype;		/* SI_BUS, PCI_BUS */
+	uint	buscoretype;		/* PCI_CORE_ID, PCIE_CORE_ID, PCMCIA_CORE_ID */
+	uint	buscorerev;		/* buscore rev */
+	uint	buscoreidx;		/* buscore index */
+	int	ccrev;			/* chip common core rev */
+	uint32	cccaps;			/* chip common capabilities */
+	uint32  cccaps_ext;			/* chip common capabilities extension */
+	int	pmurev;			/* pmu core rev */
+	uint32	pmucaps;		/* pmu capabilities */
+	uint	boardtype;		/* board type */
+	uint    boardrev;               /* board rev */
+	uint	boardvendor;		/* board vendor */
+	uint	boardflags;		/* board flags */
+	uint	boardflags2;		/* board flags2 */
+	uint	chip;			/* chip number */
+	uint	chiprev;		/* chip revision */
+	uint	chippkg;		/* chip package option */
+	uint32	chipst;			/* chip status */
+	bool	issim;			/* chip is in simulation or emulation */
+	uint    socirev;		/* SOC interconnect rev */
+	bool	pci_pr32414;
+
+};
+
+/* for HIGH_ONLY driver, the si_t must be writable to allow states sync from BMAC to HIGH driver
+ * for monolithic driver, it is readonly to prevent accident change
+ */
+typedef const struct si_pub si_t;
+
+/*
+ * Many of the routines below take an 'sih' handle as their first arg.
+ * Allocate this by calling si_attach().  Free it by calling si_detach().
+ * At any one time, the sih is logically focused on one particular si core
+ * (the "current core").
+ * Use si_setcore() or si_setcoreidx() to change the association to another core.
+ */
+#define	SI_OSH		NULL	/* Use for si_kattach when no osh is available */
+
+#define	BADIDX		(SI_MAXCORES + 1)
+
+/* clkctl xtal what flags */
+#define	XTAL			0x1	/* primary crystal oscillator (2050) */
+#define	PLL			0x2	/* main chip pll */
+
+/* clkctl clk mode */
+#define	CLK_FAST		0	/* force fast (pll) clock */
+#define	CLK_DYNAMIC		2	/* enable dynamic clock control */
+
+/* GPIO usage priorities */
+#define GPIO_DRV_PRIORITY	0	/* Driver */
+#define GPIO_APP_PRIORITY	1	/* Application */
+#define GPIO_HI_PRIORITY	2	/* Highest priority. Ignore GPIO reservation */
+
+/* GPIO pull up/down */
+#define GPIO_PULLUP		0
+#define GPIO_PULLDN		1
+
+/* GPIO event regtype */
+#define GPIO_REGEVT		0	/* GPIO register event */
+#define GPIO_REGEVT_INTMSK	1	/* GPIO register event int mask */
+#define GPIO_REGEVT_INTPOL	2	/* GPIO register event int polarity */
+
+/* device path */
+#define SI_DEVPATH_BUFSZ	16	/* min buffer size in bytes */
+
+/* SI routine enumeration: to be used by update function with multiple hooks */
+#define	SI_DOATTACH	1
+#define SI_PCIDOWN	2	/* wireless interface is down */
+#define SI_PCIUP	3	/* wireless interface is up */
+
+#ifdef SR_DEBUG
+#define PMU_RES		31
+#endif /* SR_DEBUG */
+
+#define	ISSIM_ENAB(sih)	FALSE
+
+/* PMU clock/power control */
+#if defined(BCMPMUCTL)
+#define PMUCTL_ENAB(sih)	(BCMPMUCTL)
+#else
+#define PMUCTL_ENAB(sih)	((sih)->cccaps & CC_CAP_PMU)
+#endif
+
+#define AOB_ENAB(sih)	((sih)->ccrev >= 35 ? \
+			((sih)->cccaps_ext & CC_CAP_EXT_AOB_PRESENT) : 0)
+
+/* chipcommon clock/power control (exclusive with PMU's) */
+#if defined(BCMPMUCTL) && BCMPMUCTL
+#define CCCTL_ENAB(sih)		(0)
+#define CCPLL_ENAB(sih)		(0)
+#else
+#define CCCTL_ENAB(sih)		((sih)->cccaps & CC_CAP_PWR_CTL)
+#define CCPLL_ENAB(sih)		((sih)->cccaps & CC_CAP_PLL_MASK)
+#endif
+
+typedef void (*gpio_handler_t)(uint32 stat, void *arg);
+typedef void (*gci_gpio_handler_t)(uint32 stat, void *arg);
+/* External BT Coex enable mask */
+#define CC_BTCOEX_EN_MASK  0x01
+/* External PA enable mask */
+#define GPIO_CTRL_EPA_EN_MASK 0x40
+/* WL/BT control enable mask */
+#define GPIO_CTRL_5_6_EN_MASK 0x60
+#define GPIO_CTRL_7_6_EN_MASK 0xC0
+#define GPIO_OUT_7_EN_MASK 0x80
+
+
+/* CR4 specific defines used by the host driver */
+#define SI_CR4_CAP			(0x04)
+#define SI_CR4_BANKIDX		(0x40)
+#define SI_CR4_BANKINFO		(0x44)
+#define SI_CR4_BANKPDA		(0x4C)
+
+#define	ARMCR4_TCBBNB_MASK	0xf0
+#define	ARMCR4_TCBBNB_SHIFT	4
+#define	ARMCR4_TCBANB_MASK	0xf
+#define	ARMCR4_TCBANB_SHIFT	0
+
+#define	SICF_CPUHALT		(0x0020)
+#define	ARMCR4_BSZ_MASK		0x3f
+#define	ARMCR4_BSZ_MULT		8192
+
+#include <osl_decl.h>
+/* === exported functions === */
+extern si_t *si_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *si_kattach(osl_t *osh);
+extern void si_detach(si_t *sih);
+extern bool si_pci_war16165(si_t *sih);
+extern void *
+si_d11_switch_addrbase(si_t *sih, uint coreunit);
+extern uint si_corelist(si_t *sih, uint coreid[]);
+extern uint si_coreid(si_t *sih);
+extern uint si_flag(si_t *sih);
+extern uint si_flag_alt(si_t *sih);
+extern uint si_intflag(si_t *sih);
+extern uint si_coreidx(si_t *sih);
+extern uint si_coreunit(si_t *sih);
+extern uint si_corevendor(si_t *sih);
+extern uint si_corerev(si_t *sih);
+extern void *si_osh(si_t *sih);
+extern void si_setosh(si_t *sih, osl_t *osh);
+extern uint si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint si_pmu_corereg(si_t *sih, uint32 idx, uint regoff, uint mask, uint val);
+extern uint32 *si_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern void *si_coreregs(si_t *sih);
+extern uint si_wrapperreg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint si_core_wrapperreg(si_t *sih, uint32 coreidx, uint32 offset, uint32 mask, uint32 val);
+extern void *si_wrapperregs(si_t *sih);
+extern uint32 si_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void si_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern bool si_iscoreup(si_t *sih);
+extern uint si_numcoreunits(si_t *sih, uint coreid);
+extern uint si_numd11coreunits(si_t *sih);
+extern uint si_findcoreidx(si_t *sih, uint coreid, uint coreunit);
+extern void *si_setcoreidx(si_t *sih, uint coreidx);
+extern void *si_setcore(si_t *sih, uint coreid, uint coreunit);
+extern void *si_switch_core(si_t *sih, uint coreid, uint *origidx, uint *intr_val);
+extern void si_restore_core(si_t *sih, uint coreid, uint intr_val);
+extern int si_numaddrspaces(si_t *sih);
+extern uint32 si_addrspace(si_t *sih, uint asidx);
+extern uint32 si_addrspacesize(si_t *sih, uint asidx);
+extern void si_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size);
+extern int si_corebist(si_t *sih);
+extern void si_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void si_core_disable(si_t *sih, uint32 bits);
+extern uint32 si_clock_rate(uint32 pll_type, uint32 n, uint32 m);
+extern uint si_chip_hostif(si_t *sih);
+extern bool si_read_pmu_autopll(si_t *sih);
+extern uint32 si_clock(si_t *sih);
+extern uint32 si_alp_clock(si_t *sih); /* returns [Hz] units */
+extern uint32 si_ilp_clock(si_t *sih); /* returns [Hz] units */
+extern void si_pci_setup(si_t *sih, uint coremask);
+extern void si_pcmcia_init(si_t *sih);
+extern void si_setint(si_t *sih, int siflag);
+extern bool si_backplane64(si_t *sih);
+extern void si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+	void *intrsenabled_fn, void *intr_arg);
+extern void si_deregister_intr_callback(si_t *sih);
+extern void si_clkctl_init(si_t *sih);
+extern uint16 si_clkctl_fast_pwrup_delay(si_t *sih);
+extern bool si_clkctl_cc(si_t *sih, uint mode);
+extern int si_clkctl_xtal(si_t *sih, uint what, bool on);
+extern uint32 si_gpiotimerval(si_t *sih, uint32 mask, uint32 val);
+extern void si_btcgpiowar(si_t *sih);
+extern bool si_deviceremoved(si_t *sih);
+extern uint32 si_socram_size(si_t *sih);
+extern uint32 si_socdevram_size(si_t *sih);
+extern uint32 si_socram_srmem_size(si_t *sih);
+extern void si_socram_set_bankpda(si_t *sih, uint32 bankidx, uint32 bankpda);
+extern void si_socdevram(si_t *sih, bool set, uint8 *ennable, uint8 *protect, uint8 *remap);
+extern bool si_socdevram_pkg(si_t *sih);
+extern bool si_socdevram_remap_isenb(si_t *sih);
+extern uint32 si_socdevram_remap_size(si_t *sih);
+
+extern void si_watchdog(si_t *sih, uint ticks);
+extern void si_watchdog_ms(si_t *sih, uint32 ms);
+extern uint32 si_watchdog_msticks(void);
+extern void *si_gpiosetcore(si_t *sih);
+extern uint32 si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioin(si_t *sih);
+extern uint32 si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority);
+extern uint32 si_gpioled(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_gpioreserve(si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiorelease(si_t *sih, uint32 gpio_num, uint8 priority);
+extern uint32 si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val);
+extern uint32 si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val);
+extern uint32 si_gpio_int_enable(si_t *sih, bool enable);
+extern void si_gci_uart_init(si_t *sih, osl_t *osh, uint8 seci_mode);
+extern void si_gci_enable_gpio(si_t *sih, uint8 gpio, uint32 mask, uint32 value);
+extern uint8 si_gci_host_wake_gpio_init(si_t *sih);
+extern void si_gci_host_wake_gpio_enable(si_t *sih, uint8 gpio, bool state);
+
+/* GPIO event handlers */
+extern void *si_gpio_handler_register(si_t *sih, uint32 e, bool lev, gpio_handler_t cb, void *arg);
+extern void si_gpio_handler_unregister(si_t *sih, void* gpioh);
+extern void si_gpio_handler_process(si_t *sih);
+
+/* GCI interrupt handlers */
+extern void si_gci_handler_process(si_t *sih);
+
+/* GCI GPIO event handlers */
+extern void *si_gci_gpioint_handler_register(si_t *sih, uint8 gpio, uint8 sts,
+	gci_gpio_handler_t cb, void *arg);
+extern void si_gci_gpioint_handler_unregister(si_t *sih, void* gci_i);
+extern uint8 si_gci_gpio_status(si_t *sih, uint8 gci_gpio, uint8 mask, uint8 value);
+
+/* Wake-on-wireless-LAN (WOWL) */
+extern bool si_pci_pmecap(si_t *sih);
+extern bool si_pci_fastpmecap(struct osl_info *osh);
+extern bool si_pci_pmestat(si_t *sih);
+extern void si_pci_pmeclr(si_t *sih);
+extern void si_pci_pmeen(si_t *sih);
+extern void si_pci_pmestatclr(si_t *sih);
+extern uint si_pcie_readreg(void *sih, uint addrtype, uint offset);
+extern uint si_pcie_writereg(void *sih, uint addrtype, uint offset, uint val);
+
+
+#ifdef BCMSDIO
+extern void si_sdio_init(si_t *sih);
+#endif
+
+extern uint16 si_d11_devid(si_t *sih);
+extern int si_corepciid(si_t *sih, uint func, uint16 *pcivendor, uint16 *pcidevice,
+	uint8 *pciclass, uint8 *pcisubclass, uint8 *pciprogif, uint8 *pciheader);
+
+#define si_eci(sih) 0
+static INLINE void * si_eci_init(si_t *sih) {return NULL;}
+#define si_eci_notify_bt(sih, type, val)  (0)
+#define si_seci(sih) 0
+#define si_seci_upd(sih, a)	do {} while (0)
+static INLINE void * si_seci_init(si_t *sih, uint8 use_seci) {return NULL;}
+static INLINE void * si_gci_init(si_t *sih) {return NULL;}
+#define si_seci_down(sih) do {} while (0)
+#define si_gci(sih) 0
+
+/* OTP status */
+extern bool si_is_otp_disabled(si_t *sih);
+extern bool si_is_otp_powered(si_t *sih);
+extern void si_otp_power(si_t *sih, bool on, uint32* min_res_mask);
+
+/* SPROM availability */
+extern bool si_is_sprom_available(si_t *sih);
+extern bool si_is_sprom_enabled(si_t *sih);
+extern void si_sprom_enable(si_t *sih, bool enable);
+
+/* OTP/SROM CIS stuff */
+extern int si_cis_source(si_t *sih);
+#define CIS_DEFAULT	0
+#define CIS_SROM	1
+#define CIS_OTP		2
+
+/* Fab-id information */
+#define	DEFAULT_FAB	0x0	/* Original/first fab used for this chip */
+#define	CSM_FAB7	0x1	/* CSM Fab7 chip */
+#define	TSMC_FAB12	0x2	/* TSMC Fab12/Fab14 chip */
+#define	SMIC_FAB4	0x3	/* SMIC Fab4 chip */
+
+extern int si_otp_fabid(si_t *sih, uint16 *fabid, bool rw);
+extern uint16 si_fabid(si_t *sih);
+extern uint16 si_chipid(si_t *sih);
+
+/*
+ * Build device path. Path size must be >= SI_DEVPATH_BUFSZ.
+ * The returned path is NULL terminated and has trailing '/'.
+ * Return 0 on success, nonzero otherwise.
+ */
+extern int si_devpath(si_t *sih, char *path, int size);
+extern int si_devpath_pcie(si_t *sih, char *path, int size);
+/* Read variable with prepending the devpath to the name */
+extern char *si_getdevpathvar(si_t *sih, const char *name);
+extern int si_getdevpathintvar(si_t *sih, const char *name);
+extern char *si_coded_devpathvar(si_t *sih, char *varname, int var_len, const char *name);
+
+
+extern uint8 si_pcieclkreq(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcielcreg(si_t *sih, uint32 mask, uint32 val);
+extern uint8 si_pcieltrenable(si_t *sih, uint32 mask, uint32 val);
+extern uint8 si_pcieobffenable(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcieltr_reg(si_t *sih, uint32 reg, uint32 mask, uint32 val);
+extern uint32 si_pcieltrspacing_reg(si_t *sih, uint32 mask, uint32 val);
+extern uint32 si_pcieltrhysteresiscnt_reg(si_t *sih, uint32 mask, uint32 val);
+extern void si_pcie_set_error_injection(si_t *sih, uint32 mode);
+extern void si_pcie_set_L1substate(si_t *sih, uint32 substate);
+extern uint32 si_pcie_get_L1substate(si_t *sih);
+extern void si_war42780_clkreq(si_t *sih, bool clkreq);
+extern void si_pci_down(si_t *sih);
+extern void si_pci_up(si_t *sih);
+extern void si_pci_sleep(si_t *sih);
+extern void si_pcie_war_ovr_update(si_t *sih, uint8 aspm);
+extern void si_pcie_power_save_enable(si_t *sih, bool enable);
+extern void si_pcie_extendL1timer(si_t *sih, bool extend);
+extern int si_pci_fixcfg(si_t *sih);
+extern void si_chippkg_set(si_t *sih, uint);
+
+extern void si_chipcontrl_btshd0_4331(si_t *sih, bool on);
+extern void si_chipcontrl_restore(si_t *sih, uint32 val);
+extern uint32 si_chipcontrl_read(si_t *sih);
+extern void si_chipcontrl_epa4331(si_t *sih, bool on);
+extern void si_chipcontrl_epa4331_wowl(si_t *sih, bool enter_wowl);
+extern void si_chipcontrl_srom4360(si_t *sih, bool on);
+/* Enable BT-COEX & Ex-PA for 4313 */
+extern void si_epa_4313war(si_t *sih);
+extern void si_btc_enable_chipcontrol(si_t *sih);
+/* BT/WL selection for 4313 bt combo >= P250 boards */
+extern void si_btcombo_p250_4313_war(si_t *sih);
+extern void si_btcombo_43228_war(si_t *sih);
+extern void si_clk_pmu_htavail_set(si_t *sih, bool set_clear);
+extern void si_pmu_synth_pwrsw_4313_war(si_t *sih);
+extern uint si_pll_reset(si_t *sih);
+/* === debug routines === */
+
+extern bool si_taclear(si_t *sih, bool details);
+
+
+#if defined(BCMDBG_PHYDUMP)
+extern void si_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif
+
+extern uint32 si_ccreg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+extern uint32 si_pciereg(si_t *sih, uint32 offset, uint32 mask, uint32 val, uint type);
+#ifdef SR_DEBUG
+extern void si_dump_pmu(si_t *sih, void *pmu_var);
+extern void si_pmu_keep_on(si_t *sih, int32 int_val);
+extern uint32 si_pmu_keep_on_get(si_t *sih);
+extern uint32 si_power_island_set(si_t *sih, uint32 int_val);
+extern uint32 si_power_island_get(si_t *sih);
+#endif /* SR_DEBUG */
+extern uint32 si_pcieserdesreg(si_t *sih, uint32 mdioslave, uint32 offset, uint32 mask, uint32 val);
+extern void si_pcie_set_request_size(si_t *sih, uint16 size);
+extern uint16 si_pcie_get_request_size(si_t *sih);
+extern void si_pcie_set_maxpayload_size(si_t *sih, uint16 size);
+extern uint16 si_pcie_get_maxpayload_size(si_t *sih);
+extern uint16 si_pcie_get_ssid(si_t *sih);
+extern uint32 si_pcie_get_bar0(si_t *sih);
+extern int si_pcie_configspace_cache(si_t *sih);
+extern int si_pcie_configspace_restore(si_t *sih);
+extern int si_pcie_configspace_get(si_t *sih, uint8 *buf, uint size);
+
+char *si_getnvramflvar(si_t *sih, const char *name);
+
+
+extern uint32 si_tcm_size(si_t *sih);
+extern bool si_has_flops(si_t *sih);
+
+extern int si_set_sromctl(si_t *sih, uint32 value);
+extern uint32 si_get_sromctl(si_t *sih);
+
+extern uint32 si_gci_direct(si_t *sih, uint offset, uint32 mask, uint32 val);
+extern uint32 si_gci_indirect(si_t *sih, uint regidx, uint offset, uint32 mask, uint32 val);
+extern uint32 si_gci_output(si_t *sih, uint reg, uint32 mask, uint32 val);
+extern uint32 si_gci_input(si_t *sih, uint reg);
+extern uint32 si_gci_int_enable(si_t *sih, bool enable);
+extern void si_gci_reset(si_t *sih);
+#ifdef BCMLTECOEX
+extern void si_gci_seci_init(si_t *sih);
+extern void si_ercx_init(si_t *sih, uint32 ltecx_mux, uint32 ltecx_padnum,
+	uint32 ltecx_fnsel, uint32 ltecx_gcigpio);
+extern void si_wci2_init(si_t *sih, uint8 baudrate, uint32 ltecx_mux, uint32 ltecx_padnum,
+	uint32 ltecx_fnsel, uint32 ltecx_gcigpio);
+#endif /* BCMLTECOEX */
+extern void si_gci_set_functionsel(si_t *sih, uint32 pin, uint8 fnsel);
+extern uint32 si_gci_get_functionsel(si_t *sih, uint32 pin);
+extern void si_gci_clear_functionsel(si_t *sih, uint8 fnsel);
+extern uint8 si_gci_get_chipctrlreg_idx(uint32 pin, uint32 *regidx, uint32 *pos);
+extern uint32 si_gci_chipcontrol(si_t *sih, uint reg, uint32 mask, uint32 val);
+extern uint32 si_gci_chipstatus(si_t *sih, uint reg);
+extern uint16 si_cc_get_reg16(uint32 reg_offs);
+extern uint32 si_cc_get_reg32(uint32 reg_offs);
+extern uint32 si_cc_set_reg32(uint32 reg_offs, uint32 val);
+extern uint32 si_gci_preinit_upd_indirect(uint32 regidx, uint32 setval, uint32 mask);
+extern uint8 si_enable_device_wake(si_t *sih, uint8 *wake_status, uint8 *cur_status);
+extern void si_swdenable(si_t *sih, uint32 swdflag);
+
+#define CHIPCTRLREG1 0x1
+#define CHIPCTRLREG2 0x2
+#define CHIPCTRLREG3 0x3
+#define CHIPCTRLREG4 0x4
+#define CHIPCTRLREG5 0x5
+#define MINRESMASKREG 0x618
+#define MAXRESMASKREG 0x61c
+#define CHIPCTRLADDR 0x650
+#define CHIPCTRLDATA 0x654
+#define RSRCTABLEADDR 0x620
+#define RSRCUPDWNTIME 0x628
+#define PMUREG_RESREQ_MASK 0x68c
+
+void si_update_masks(si_t *sih);
+void si_force_islanding(si_t *sih, bool enable);
+extern uint32 si_pmu_res_req_timer_clr(si_t *sih);
+extern void si_pmu_rfldo(si_t *sih, bool on);
+extern void si_survive_perst_war(si_t *sih, bool reset, uint32 sperst_mask, uint32 spert_val);
+extern uint32 si_pcie_set_ctrlreg(si_t *sih, uint32 sperst_mask, uint32 spert_val);
+extern void si_pcie_ltr_war(si_t *sih);
+extern void si_pcie_hw_LTR_war(si_t *sih);
+extern void si_pcie_hw_L1SS_war(si_t *sih);
+extern void si_pciedev_crwlpciegen2(si_t *sih);
+extern void si_pcie_prep_D3(si_t *sih, bool enter_D3);
+extern void si_pciedev_reg_pm_clk_period(si_t *sih);
+
+#ifdef WLRSDB
+extern void si_d11rsdb_core_disable(si_t *sih, uint32 bits);
+extern void si_d11rsdb_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+#endif
+
+
+/* Macro to enable clock gating changes in different cores */
+#define MEM_CLK_GATE_BIT 	5
+#define GCI_CLK_GATE_BIT 	18
+
+#define USBAPP_CLK_BIT		0
+#define PCIE_CLK_BIT		3
+#define ARMCR4_DBG_CLK_BIT	4
+#define SAMPLE_SYNC_CLK_BIT 	17
+#define PCIE_TL_CLK_BIT		18
+#define HQ_REQ_BIT		24
+#define PLL_DIV2_BIT_START	9
+#define PLL_DIV2_MASK		(0x37 << PLL_DIV2_BIT_START)
+#define PLL_DIV2_DIS_OP		(0x37 << PLL_DIV2_BIT_START)
+
+#define PMUREG(si, member) \
+	(AOB_ENAB(si) ? \
+		si_corereg_addr(si, si_findcoreidx(si, PMU_CORE_ID, 0), \
+			OFFSETOF(pmuregs_t, member)): \
+		si_corereg_addr(si, SI_CC_IDX, OFFSETOF(chipcregs_t, member)))
+
+#define pmu_corereg(si, cc_idx, member, mask, val) \
+	(AOB_ENAB(si) ? \
+		si_pmu_corereg(si, si_findcoreidx(sih, PMU_CORE_ID, 0), \
+			       OFFSETOF(pmuregs_t, member), mask, val): \
+		si_pmu_corereg(si, cc_idx, OFFSETOF(chipcregs_t, member), mask, val))
+
+/* GCI Macros */
+#define ALLONES_32				0xFFFFFFFF
+#define GCI_CCTL_SECIRST_OFFSET			0 /* SeciReset */
+#define GCI_CCTL_RSTSL_OFFSET			1 /* ResetSeciLogic */
+#define GCI_CCTL_SECIEN_OFFSET			2 /* EnableSeci  */
+#define GCI_CCTL_FSL_OFFSET			3 /* ForceSeciOutLow */
+#define GCI_CCTL_SMODE_OFFSET			4 /* SeciOpMode, 6:4 */
+#define GCI_CCTL_US_OFFSET			7 /* UpdateSeci */
+#define GCI_CCTL_BRKONSLP_OFFSET		8 /* BreakOnSleep */
+#define GCI_CCTL_SILOWTOUT_OFFSET		9 /* SeciInLowTimeout, 10:9 */
+#define GCI_CCTL_RSTOCC_OFFSET			11 /* ResetOffChipCoex */
+#define GCI_CCTL_ARESEND_OFFSET			12 /* AutoBTSigResend */
+#define GCI_CCTL_FGCR_OFFSET			16 /* ForceGciClkReq */
+#define GCI_CCTL_FHCRO_OFFSET			17 /* ForceHWClockReqOff */
+#define GCI_CCTL_FREGCLK_OFFSET			18 /* ForceRegClk */
+#define GCI_CCTL_FSECICLK_OFFSET		19 /* ForceSeciClk */
+#define GCI_CCTL_FGCA_OFFSET			20 /* ForceGciClkAvail */
+#define GCI_CCTL_FGCAV_OFFSET			21 /* ForceGciClkAvailValue */
+#define GCI_CCTL_SCS_OFFSET			24 /* SeciClkStretch, 31:24 */
+
+#define GCI_MODE_UART				0x0
+#define GCI_MODE_SECI				0x1
+#define GCI_MODE_BTSIG				0x2
+#define GCI_MODE_GPIO				0x3
+#define GCI_MODE_MASK				0x7
+
+#define GCI_CCTL_LOWTOUT_DIS			0x0
+#define GCI_CCTL_LOWTOUT_10BIT			0x1
+#define GCI_CCTL_LOWTOUT_20BIT			0x2
+#define GCI_CCTL_LOWTOUT_30BIT			0x3
+#define GCI_CCTL_LOWTOUT_MASK			0x3
+
+#define GCI_CCTL_SCS_DEF			0x19
+#define GCI_CCTL_SCS_MASK			0xFF
+
+#define GCI_SECIIN_MODE_OFFSET			0
+#define GCI_SECIIN_GCIGPIO_OFFSET		4
+#define GCI_SECIIN_RXID2IP_OFFSET		8
+
+#define GCI_SECIOUT_MODE_OFFSET			0
+#define GCI_SECIOUT_GCIGPIO_OFFSET		4
+#define GCI_SECIOUT_SECIINRELATED_OFFSET	16
+
+#define GCI_SECIAUX_RXENABLE_OFFSET		0
+#define GCI_SECIFIFO_RXENABLE_OFFSET		16
+
+#define GCI_SECITX_ENABLE_OFFSET		0
+
+#define GCI_GPIOCTL_INEN_OFFSET			0
+#define GCI_GPIOCTL_OUTEN_OFFSET		1
+#define GCI_GPIOCTL_PDN_OFFSET			4
+
+#define GCI_GPIOIDX_OFFSET			16
+
+#define GCI_LTECX_SECI_ID			0 /* SECI port for LTECX */
+
+/* To access per GCI bit registers */
+#define GCI_REG_WIDTH				32
+
+/* GCI bit positions */
+/* GCI [127:000] = WLAN [127:0] */
+#define GCI_WLAN_IP_ID				0
+#define GCI_WLAN_BEGIN				0
+#define GCI_WLAN_PRIO_POS			(GCI_WLAN_BEGIN + 4)
+
+/* GCI [639:512] = LTE [127:0] */
+#define GCI_LTE_IP_ID				4
+#define GCI_LTE_BEGIN				512
+#define GCI_LTE_FRAMESYNC_POS			(GCI_LTE_BEGIN + 0)
+#define GCI_LTE_RX_POS				(GCI_LTE_BEGIN + 1)
+#define GCI_LTE_TX_POS				(GCI_LTE_BEGIN + 2)
+#define GCI_LTE_AUXRXDVALID_POS			(GCI_LTE_BEGIN + 56)
+
+/* Reg Index corresponding to ECI bit no x of ECI space */
+#define GCI_REGIDX(x)				((x)/GCI_REG_WIDTH)
+/* Bit offset of ECI bit no x in 32-bit words */
+#define GCI_BITOFFSET(x)			((x)%GCI_REG_WIDTH)
+
+/* End - GCI Macros */
+
+#ifdef REROUTE_OOBINT
+#define CC_OOB          0x0
+#define M2MDMA_OOB      0x1
+#define PMU_OOB         0x2
+#define D11_OOB         0x3
+#define SDIOD_OOB       0x4
+#define PMU_OOB_BIT     (0x10 | PMU_OOB)
+#endif /* REROUTE_OOBINT */
+
+
+#endif	/* _siutils_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/trxhdr.h b/drivers/net/wireless/bcm4336/include/trxhdr.h
--- a/drivers/net/wireless/bcm4336/include/trxhdr.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/trxhdr.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,74 @@
+/*
+ * TRX image file header format.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: trxhdr.h 349211 2012-08-07 09:45:24Z $
+ */
+
+#ifndef _TRX_HDR_H
+#define _TRX_HDR_H
+
+#include <typedefs.h>
+
+#define TRX_MAGIC	0x30524448	/* "HDR0" */
+#define TRX_MAX_LEN	0x3B0000	/* Max length */
+#define TRX_NO_HEADER	1		/* Do not write TRX header */
+#define TRX_GZ_FILES	0x2     /* Contains up to TRX_MAX_OFFSET individual gzip files */
+#define TRX_EMBED_UCODE	0x8	/* Trx contains embedded ucode image */
+#define TRX_ROMSIM_IMAGE	0x10	/* Trx contains ROM simulation image */
+#define TRX_UNCOMP_IMAGE	0x20	/* Trx contains uncompressed rtecdc.bin image */
+#define TRX_BOOTLOADER		0x40	/* the image is a bootloader */
+
+#define TRX_V1		1
+#define TRX_V1_MAX_OFFSETS	3		/* V1: Max number of individual files */
+
+#ifndef BCMTRXV2
+#define TRX_VERSION	TRX_V1		/* Version 1 */
+#define TRX_MAX_OFFSET TRX_V1_MAX_OFFSETS
+#endif
+
+/* BMAC Host driver/application like bcmdl need to support both Ver 1 as well as
+ * Ver 2 of trx header. To make it generic, trx_header is structure is modified
+ * as below where size of "offsets" field will vary as per the TRX version.
+ * Currently, BMAC host driver and bcmdl are modified to support TRXV2 as well.
+ * To make sure, other applications like "dhdl" which are yet to be enhanced to support
+ * TRXV2 are not broken, new macro and structure defintion take effect only when BCMTRXV2
+ * is defined.
+ */
+struct trx_header {
+	uint32 magic;		/* "HDR0" */
+	uint32 len;		/* Length of file including header */
+	uint32 crc32;		/* 32-bit CRC from flag_version to end of file */
+	uint32 flag_version;	/* 0:15 flags, 16:31 version */
+#ifndef BCMTRXV2
+	uint32 offsets[TRX_MAX_OFFSET];	/* Offsets of partitions from start of header */
+#else
+	uint32 offsets[1];	/* Offsets of partitions from start of header */
+#endif
+};
+
+#ifdef BCMTRXV2
+#define TRX_VERSION		TRX_V2		/* Version 2 */
+#define TRX_MAX_OFFSET  TRX_V2_MAX_OFFSETS
+
+#define TRX_V2		2
+/* V2: Max number of individual files
+ * To support SDR signature + Config data region
+ */
+#define TRX_V2_MAX_OFFSETS	5
+#define SIZEOF_TRXHDR_V1	(sizeof(struct trx_header)+(TRX_V1_MAX_OFFSETS-1)*sizeof(uint32))
+#define SIZEOF_TRXHDR_V2	(sizeof(struct trx_header)+(TRX_V2_MAX_OFFSETS-1)*sizeof(uint32))
+#define TRX_VER(trx)		(trx->flag_version>>16)
+#define ISTRX_V1(trx)		(TRX_VER(trx) == TRX_V1)
+#define ISTRX_V2(trx)		(TRX_VER(trx) == TRX_V2)
+/* For V2, return size of V2 size: others, return V1 size */
+#define SIZEOF_TRX(trx)	    (ISTRX_V2(trx) ? SIZEOF_TRXHDR_V2: SIZEOF_TRXHDR_V1)
+#else
+#define SIZEOF_TRX(trx)	    (sizeof(struct trx_header))
+#endif /* BCMTRXV2 */
+
+/* Compatibility */
+typedef struct trx_header TRXHDR, *PTRXHDR;
+
+#endif /* _TRX_HDR_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/typedefs.h b/drivers/net/wireless/bcm4336/include/typedefs.h
--- a/drivers/net/wireless/bcm4336/include/typedefs.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/typedefs.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,321 @@
+/*
+ * $Copyright Open Broadcom Corporation$
+ * $Id: typedefs.h 484281 2014-06-12 22:42:26Z $
+ */
+
+#ifndef _TYPEDEFS_H_
+#define _TYPEDEFS_H_
+
+#ifdef SITE_TYPEDEFS
+
+/*
+ * Define SITE_TYPEDEFS in the compile to include a site-specific
+ * typedef file "site_typedefs.h".
+ *
+ * If SITE_TYPEDEFS is not defined, then the code section below makes
+ * inferences about the compile environment based on defined symbols and
+ * possibly compiler pragmas.
+ *
+ * Following these two sections is the Default Typedefs section.
+ * This section is only processed if USE_TYPEDEF_DEFAULTS is
+ * defined. This section has a default set of typedefs and a few
+ * preprocessor symbols (TRUE, FALSE, NULL, ...).
+ */
+
+#include "site_typedefs.h"
+
+#else
+
+/*
+ * Infer the compile environment based on preprocessor symbols and pragmas.
+ * Override type definitions as needed, and include configuration-dependent
+ * header files to define types.
+ */
+
+#ifdef __cplusplus
+
+#define TYPEDEF_BOOL
+#ifndef FALSE
+#define FALSE	false
+#endif
+#ifndef TRUE
+#define TRUE	true
+#endif
+
+#else	/* ! __cplusplus */
+
+
+#endif	/* ! __cplusplus */
+
+#if defined(__LP64__)
+#define TYPEDEF_UINTPTR
+typedef unsigned long long int uintptr;
+#endif
+
+
+
+
+
+#if defined(_NEED_SIZE_T_)
+typedef long unsigned int size_t;
+#endif
+
+
+
+
+
+#if defined(__sparc__)
+#define TYPEDEF_ULONG
+#endif
+
+/*
+ * If this is either a Linux hybrid build or the per-port code of a hybrid build
+ * then use the Linux header files to get some of the typedefs.  Otherwise, define
+ * them entirely in this file.  We can't always define the types because we get
+ * a duplicate typedef error; there is no way to "undefine" a typedef.
+ * We know when it's per-port code because each file defines LINUX_PORT at the top.
+ */
+#if !defined(LINUX_HYBRID) || defined(LINUX_PORT)
+#define TYPEDEF_UINT
+#ifndef TARGETENV_android
+#define TYPEDEF_USHORT
+#define TYPEDEF_ULONG
+#endif /* TARGETENV_android */
+#ifdef __KERNEL__
+#include <linux/version.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19))
+#define TYPEDEF_BOOL
+#endif	/* >= 2.6.19 */
+/* special detection for 2.6.18-128.7.1.0.1.el5 */
+#if (LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 18))
+#include <linux/compiler.h>
+#ifdef noinline_for_stack
+#define TYPEDEF_BOOL
+#endif
+#endif	/* == 2.6.18 */
+#endif	/* __KERNEL__ */
+#endif  /* !defined(LINUX_HYBRID) || defined(LINUX_PORT) */
+
+
+/* Do not support the (u)int64 types with strict ansi for GNU C */
+#if defined(__GNUC__) && defined(__STRICT_ANSI__)
+#define TYPEDEF_INT64
+#define TYPEDEF_UINT64
+#endif /* defined(__GNUC__) && defined(__STRICT_ANSI__) */
+
+/* ICL accepts unsigned 64 bit type only, and complains in ANSI mode
+ * for signed or unsigned
+ */
+#if defined(__ICL)
+
+#define TYPEDEF_INT64
+
+#if defined(__STDC__)
+#define TYPEDEF_UINT64
+#endif
+
+#endif /* __ICL */
+
+#if !defined(__DJGPP__)
+
+/* pick up ushort & uint from standard types.h */
+#if defined(__KERNEL__)
+
+/* See note above */
+#if !defined(LINUX_HYBRID) || defined(LINUX_PORT)
+#include <linux/types.h>	/* sys/types.h and linux/types.h are oil and water */
+#endif /* !defined(LINUX_HYBRID) || defined(LINUX_PORT) */
+
+#else
+
+#include <sys/types.h>
+
+#endif /* linux && __KERNEL__ */
+
+#endif
+
+
+/* use the default typedefs in the next section of this file */
+#define USE_TYPEDEF_DEFAULTS
+
+#endif /* SITE_TYPEDEFS */
+
+
+/*
+ * Default Typedefs
+ */
+
+#ifdef USE_TYPEDEF_DEFAULTS
+#undef USE_TYPEDEF_DEFAULTS
+
+#ifndef TYPEDEF_BOOL
+typedef	/* @abstract@ */ unsigned char	bool;
+#endif /* endif TYPEDEF_BOOL */
+
+/* define uchar, ushort, uint, ulong */
+
+#ifndef TYPEDEF_UCHAR
+typedef unsigned char	uchar;
+#endif
+
+#ifndef TYPEDEF_USHORT
+typedef unsigned short	ushort;
+#endif
+
+#ifndef TYPEDEF_UINT
+typedef unsigned int	uint;
+#endif
+
+#ifndef TYPEDEF_ULONG
+typedef unsigned long	ulong;
+#endif
+
+/* define [u]int8/16/32/64, uintptr */
+
+#ifndef TYPEDEF_UINT8
+typedef unsigned char	uint8;
+#endif
+
+#ifndef TYPEDEF_UINT16
+typedef unsigned short	uint16;
+#endif
+
+#ifndef TYPEDEF_UINT32
+typedef unsigned int	uint32;
+#endif
+
+#ifndef TYPEDEF_UINT64
+typedef unsigned long long uint64;
+#endif
+
+#ifndef TYPEDEF_UINTPTR
+typedef unsigned int	uintptr;
+#endif
+
+#ifndef TYPEDEF_INT8
+typedef signed char	int8;
+#endif
+
+#ifndef TYPEDEF_INT16
+typedef signed short	int16;
+#endif
+
+#ifndef TYPEDEF_INT32
+typedef signed int	int32;
+#endif
+
+#ifndef TYPEDEF_INT64
+typedef signed long long int64;
+#endif
+
+/* define float32/64, float_t */
+
+#ifndef TYPEDEF_FLOAT32
+typedef float		float32;
+#endif
+
+#ifndef TYPEDEF_FLOAT64
+typedef double		float64;
+#endif
+
+/*
+ * abstracted floating point type allows for compile time selection of
+ * single or double precision arithmetic.  Compiling with -DFLOAT32
+ * selects single precision; the default is double precision.
+ */
+
+#ifndef TYPEDEF_FLOAT_T
+
+#if defined(FLOAT32)
+typedef float32 float_t;
+#else /* default to double precision floating point */
+typedef float64 float_t;
+#endif
+
+#endif /* TYPEDEF_FLOAT_T */
+
+/* define macro values */
+
+#ifndef FALSE
+#define FALSE	0
+#endif
+
+#ifndef TRUE
+#define TRUE	1  /* TRUE */
+#endif
+
+#ifndef NULL
+#define	NULL	0
+#endif
+
+#ifndef OFF
+#define	OFF	0
+#endif
+
+#ifndef ON
+#define	ON	1  /* ON = 1 */
+#endif
+
+#define	AUTO	(-1) /* Auto = -1 */
+
+/* define PTRSZ, INLINE */
+
+#ifndef PTRSZ
+#define	PTRSZ	sizeof(char*)
+#endif
+
+
+/* Detect compiler type. */
+#if defined(__GNUC__) || defined(__lint)
+	#define BWL_COMPILER_GNU
+#elif defined(__CC_ARM) && __CC_ARM
+	#define BWL_COMPILER_ARMCC
+#else
+	#error "Unknown compiler!"
+#endif
+
+
+#ifndef INLINE
+	#if defined(BWL_COMPILER_MICROSOFT)
+		#define INLINE __inline
+	#elif defined(BWL_COMPILER_GNU)
+		#define INLINE __inline__
+	#elif defined(BWL_COMPILER_ARMCC)
+		#define INLINE	__inline
+	#else
+		#define INLINE
+	#endif
+#endif /* INLINE */
+
+#undef TYPEDEF_BOOL
+#undef TYPEDEF_UCHAR
+#undef TYPEDEF_USHORT
+#undef TYPEDEF_UINT
+#undef TYPEDEF_ULONG
+#undef TYPEDEF_UINT8
+#undef TYPEDEF_UINT16
+#undef TYPEDEF_UINT32
+#undef TYPEDEF_UINT64
+#undef TYPEDEF_UINTPTR
+#undef TYPEDEF_INT8
+#undef TYPEDEF_INT16
+#undef TYPEDEF_INT32
+#undef TYPEDEF_INT64
+#undef TYPEDEF_FLOAT32
+#undef TYPEDEF_FLOAT64
+#undef TYPEDEF_FLOAT_T
+
+#endif /* USE_TYPEDEF_DEFAULTS */
+
+/* Suppress unused parameter warning */
+#define UNUSED_PARAMETER(x) (void)(x)
+
+/* Avoid warning for discarded const or volatile qualifier in special cases (-Wcast-qual) */
+#define DISCARD_QUAL(ptr, type) ((type *)(uintptr)(ptr))
+
+/*
+ * Including the bcmdefs.h here, to make sure everyone including typedefs.h
+ * gets this automatically
+*/
+#include <bcmdefs.h>
+#endif /* _TYPEDEFS_H_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/wlfc_proto.h b/drivers/net/wireless/bcm4336/include/wlfc_proto.h
--- a/drivers/net/wireless/bcm4336/include/wlfc_proto.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/wlfc_proto.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,283 @@
+/*
+* $Copyright Open 2009 Broadcom Corporation$
+* $Id: wlfc_proto.h 499510 2014-08-28 23:40:47Z $
+*
+*/
+#ifndef __wlfc_proto_definitions_h__
+#define __wlfc_proto_definitions_h__
+
+	/* Use TLV to convey WLFC information.
+	 ---------------------------------------------------------------------------
+	| Type |  Len | value                    | Description
+	 ---------------------------------------------------------------------------
+	|  1   |   1  | (handle)                 | MAC OPEN
+	 ---------------------------------------------------------------------------
+	|  2   |   1  | (handle)                 | MAC CLOSE
+	 ---------------------------------------------------------------------------
+	|  3   |   2  | (count, handle, prec_bmp)| Set the credit depth for a MAC dstn
+	 ---------------------------------------------------------------------------
+	|  4   |   4+ | see pkttag comments      | TXSTATUS
+	|      |      | TX status & timestamps   | Present only when pkt timestamp is enabled
+	 ---------------------------------------------------------------------------
+	|  5   |   4  | see pkttag comments      | PKKTTAG [host->firmware]
+	 ---------------------------------------------------------------------------
+	|  6   |   8  | (handle, ifid, MAC)      | MAC ADD
+	 ---------------------------------------------------------------------------
+	|  7   |   8  | (handle, ifid, MAC)      | MAC DEL
+	 ---------------------------------------------------------------------------
+	|  8   |   1  | (rssi)                   | RSSI - RSSI value for the packet.
+	 ---------------------------------------------------------------------------
+	|  9   |   1  | (interface ID)           | Interface OPEN
+	 ---------------------------------------------------------------------------
+	|  10  |   1  | (interface ID)           | Interface CLOSE
+	 ---------------------------------------------------------------------------
+	|  11  |   8  | fifo credit returns map  | FIFO credits back to the host
+	|      |      |                          |
+	|      |      |                          | --------------------------------------
+	|      |      |                          | | ac0 | ac1 | ac2 | ac3 | bcmc | atim |
+	|      |      |                          | --------------------------------------
+	|      |      |                          |
+	 ---------------------------------------------------------------------------
+	|  12  |   2  | MAC handle,              | Host provides a bitmap of pending
+	|      |      | AC[0-3] traffic bitmap   | unicast traffic for MAC-handle dstn.
+	|      |      |                          | [host->firmware]
+	 ---------------------------------------------------------------------------
+	|  13  |   3  | (count, handle, prec_bmp)| One time request for packet to a specific
+	|      |      |                          | MAC destination.
+	 ---------------------------------------------------------------------------
+	|  15  |  12  | (pkttag, timestamps)     | Send TX timestamp at reception from host
+	 ---------------------------------------------------------------------------
+	|  16  |  12  | (pkttag, timestamps)     | Send WLAN RX timestamp along with RX frame
+	 ---------------------------------------------------------------------------
+	| 255  |  N/A |  N/A                     | FILLER - This is a special type
+	|      |      |                          | that has no length or value.
+	|      |      |                          | Typically used for padding.
+	 ---------------------------------------------------------------------------
+	*/
+
+#define WLFC_CTL_TYPE_MAC_OPEN			1
+#define WLFC_CTL_TYPE_MAC_CLOSE			2
+#define WLFC_CTL_TYPE_MAC_REQUEST_CREDIT	3
+#define WLFC_CTL_TYPE_TXSTATUS			4
+#define WLFC_CTL_TYPE_PKTTAG			5
+
+#define WLFC_CTL_TYPE_MACDESC_ADD		6
+#define WLFC_CTL_TYPE_MACDESC_DEL		7
+#define WLFC_CTL_TYPE_RSSI			8
+
+#define WLFC_CTL_TYPE_INTERFACE_OPEN		9
+#define WLFC_CTL_TYPE_INTERFACE_CLOSE		10
+
+#define WLFC_CTL_TYPE_FIFO_CREDITBACK		11
+
+#define WLFC_CTL_TYPE_PENDING_TRAFFIC_BMP	12
+#define WLFC_CTL_TYPE_MAC_REQUEST_PACKET	13
+#define WLFC_CTL_TYPE_HOST_REORDER_RXPKTS	14
+
+
+#define WLFC_CTL_TYPE_TX_ENTRY_STAMP		15
+#define WLFC_CTL_TYPE_RX_STAMP			16
+
+#define WLFC_CTL_TYPE_TRANS_ID			18
+#define WLFC_CTL_TYPE_COMP_TXSTATUS		19
+
+#define WLFC_CTL_TYPE_TID_OPEN			20
+#define WLFC_CTL_TYPE_TID_CLOSE			21
+
+
+#define WLFC_CTL_TYPE_FILLER			255
+
+#define WLFC_CTL_VALUE_LEN_MACDESC		8	/* handle, interface, MAC */
+
+#define WLFC_CTL_VALUE_LEN_MAC			1	/* MAC-handle */
+#define WLFC_CTL_VALUE_LEN_RSSI			1
+
+#define WLFC_CTL_VALUE_LEN_INTERFACE		1
+#define WLFC_CTL_VALUE_LEN_PENDING_TRAFFIC_BMP	2
+
+#define WLFC_CTL_VALUE_LEN_TXSTATUS		4
+#define WLFC_CTL_VALUE_LEN_PKTTAG		4
+
+#define WLFC_CTL_VALUE_LEN_SEQ			2
+
+/* enough space to host all 4 ACs, bc/mc and atim fifo credit */
+#define WLFC_CTL_VALUE_LEN_FIFO_CREDITBACK	6
+
+#define WLFC_CTL_VALUE_LEN_REQUEST_CREDIT	3	/* credit, MAC-handle, prec_bitmap */
+#define WLFC_CTL_VALUE_LEN_REQUEST_PACKET	3	/* credit, MAC-handle, prec_bitmap */
+
+
+#define WLFC_PKTFLAG_PKTFROMHOST	0x01 /* packet originated from hot side */
+#define WLFC_PKTFLAG_PKT_REQUESTED	0x02 /* packet requsted by firmware side */
+#define WLFC_PKTFLAG_PKT_FORCELOWRATE	0x04 /* force low rate for this packet */
+
+#define WL_TXSTATUS_STATUS_MASK			0xff /* allow 8 bits */
+#define WL_TXSTATUS_STATUS_SHIFT		24
+
+#define WL_TXSTATUS_SET_STATUS(x, status)	((x)  = \
+	((x) & ~(WL_TXSTATUS_STATUS_MASK << WL_TXSTATUS_STATUS_SHIFT)) | \
+	(((status) & WL_TXSTATUS_STATUS_MASK) << WL_TXSTATUS_STATUS_SHIFT))
+#define WL_TXSTATUS_GET_STATUS(x)	(((x) >> WL_TXSTATUS_STATUS_SHIFT) & \
+	WL_TXSTATUS_STATUS_MASK)
+
+#define WL_TXSTATUS_GENERATION_MASK		1 /* allow 1 bit */
+#define WL_TXSTATUS_GENERATION_SHIFT		31
+
+#define WL_TXSTATUS_SET_GENERATION(x, gen)	((x) = \
+	((x) & ~(WL_TXSTATUS_GENERATION_MASK << WL_TXSTATUS_GENERATION_SHIFT)) | \
+	(((gen) & WL_TXSTATUS_GENERATION_MASK) << WL_TXSTATUS_GENERATION_SHIFT))
+
+#define WL_TXSTATUS_GET_GENERATION(x)	(((x) >> WL_TXSTATUS_GENERATION_SHIFT) & \
+	WL_TXSTATUS_GENERATION_MASK)
+
+#define WL_TXSTATUS_FLAGS_MASK			0xf /* allow 4 bits only */
+#define WL_TXSTATUS_FLAGS_SHIFT			27
+
+#define WL_TXSTATUS_SET_FLAGS(x, flags)	((x)  = \
+	((x) & ~(WL_TXSTATUS_FLAGS_MASK << WL_TXSTATUS_FLAGS_SHIFT)) | \
+	(((flags) & WL_TXSTATUS_FLAGS_MASK) << WL_TXSTATUS_FLAGS_SHIFT))
+#define WL_TXSTATUS_GET_FLAGS(x)		(((x) >> WL_TXSTATUS_FLAGS_SHIFT) & \
+	WL_TXSTATUS_FLAGS_MASK)
+
+#define WL_TXSTATUS_FIFO_MASK			0x7 /* allow 3 bits for FIFO ID */
+#define WL_TXSTATUS_FIFO_SHIFT			24
+
+#define WL_TXSTATUS_SET_FIFO(x, flags)	((x)  = \
+	((x) & ~(WL_TXSTATUS_FIFO_MASK << WL_TXSTATUS_FIFO_SHIFT)) | \
+	(((flags) & WL_TXSTATUS_FIFO_MASK) << WL_TXSTATUS_FIFO_SHIFT))
+#define WL_TXSTATUS_GET_FIFO(x)		(((x) >> WL_TXSTATUS_FIFO_SHIFT) & WL_TXSTATUS_FIFO_MASK)
+
+#define WL_TXSTATUS_PKTID_MASK			0xffffff /* allow 24 bits */
+#define WL_TXSTATUS_SET_PKTID(x, num)	((x) = \
+	((x) & ~WL_TXSTATUS_PKTID_MASK) | (num))
+#define WL_TXSTATUS_GET_PKTID(x)		((x) & WL_TXSTATUS_PKTID_MASK)
+
+#define WL_TXSTATUS_HSLOT_MASK			0xffff /* allow 16 bits */
+#define WL_TXSTATUS_HSLOT_SHIFT			8
+
+#define WL_TXSTATUS_SET_HSLOT(x, hslot)	((x)  = \
+	((x) & ~(WL_TXSTATUS_HSLOT_MASK << WL_TXSTATUS_HSLOT_SHIFT)) | \
+	(((hslot) & WL_TXSTATUS_HSLOT_MASK) << WL_TXSTATUS_HSLOT_SHIFT))
+#define WL_TXSTATUS_GET_HSLOT(x)	(((x) >> WL_TXSTATUS_HSLOT_SHIFT)& \
+	WL_TXSTATUS_HSLOT_MASK)
+
+#define WL_TXSTATUS_FREERUNCTR_MASK		0xff /* allow 8 bits */
+
+#define WL_TXSTATUS_SET_FREERUNCTR(x, ctr)	((x)  = \
+	((x) & ~(WL_TXSTATUS_FREERUNCTR_MASK)) | \
+	((ctr) & WL_TXSTATUS_FREERUNCTR_MASK))
+#define WL_TXSTATUS_GET_FREERUNCTR(x)		((x)& WL_TXSTATUS_FREERUNCTR_MASK)
+
+#define WL_SEQ_FROMFW_MASK		0x1 /* allow 1 bit */
+#define WL_SEQ_FROMFW_SHIFT		13
+#define WL_SEQ_SET_FROMFW(x, val)	((x) = \
+	((x) & ~(WL_SEQ_FROMFW_MASK << WL_SEQ_FROMFW_SHIFT)) | \
+	(((val) & WL_SEQ_FROMFW_MASK) << WL_SEQ_FROMFW_SHIFT))
+#define WL_SEQ_GET_FROMFW(x)	(((x) >> WL_SEQ_FROMFW_SHIFT) & \
+	WL_SEQ_FROMFW_MASK)
+
+#define WL_SEQ_FROMDRV_MASK		0x1 /* allow 1 bit */
+#define WL_SEQ_FROMDRV_SHIFT		12
+#define WL_SEQ_SET_FROMDRV(x, val)	((x) = \
+	((x) & ~(WL_SEQ_FROMDRV_MASK << WL_SEQ_FROMDRV_SHIFT)) | \
+	(((val) & WL_SEQ_FROMDRV_MASK) << WL_SEQ_FROMDRV_SHIFT))
+#define WL_SEQ_GET_FROMDRV(x)	(((x) >> WL_SEQ_FROMDRV_SHIFT) & \
+	WL_SEQ_FROMDRV_MASK)
+
+#define WL_SEQ_NUM_MASK			0xfff /* allow 12 bit */
+#define WL_SEQ_NUM_SHIFT		0
+#define WL_SEQ_SET_NUM(x, val)	((x) = \
+	((x) & ~(WL_SEQ_NUM_MASK << WL_SEQ_NUM_SHIFT)) | \
+	(((val) & WL_SEQ_NUM_MASK) << WL_SEQ_NUM_SHIFT))
+#define WL_SEQ_GET_NUM(x)	(((x) >> WL_SEQ_NUM_SHIFT) & \
+	WL_SEQ_NUM_MASK)
+
+/* 32 STA should be enough??, 6 bits; Must be power of 2 */
+#define WLFC_MAC_DESC_TABLE_SIZE	32
+#define WLFC_MAX_IFNUM				16
+#define WLFC_MAC_DESC_ID_INVALID	0xff
+
+/* b[7:5] -reuse guard, b[4:0] -value */
+#define WLFC_MAC_DESC_GET_LOOKUP_INDEX(x) ((x) & 0x1f)
+
+#define WLFC_MAX_PENDING_DATALEN	120
+
+/* host is free to discard the packet */
+#define WLFC_CTL_PKTFLAG_DISCARD	0
+/* D11 suppressed a packet */
+#define WLFC_CTL_PKTFLAG_D11SUPPRESS	1
+/* WL firmware suppressed a packet because MAC is
+	already in PSMode (short time window)
+*/
+#define WLFC_CTL_PKTFLAG_WLSUPPRESS	2
+/* Firmware tossed this packet */
+#define WLFC_CTL_PKTFLAG_TOSSED_BYWLC	3
+/* Firmware tossed after retries */
+#define WLFC_CTL_PKTFLAG_DISCARD_NOACK	4
+
+#define WLFC_D11_STATUS_INTERPRET(txs)	\
+	(((txs)->status.suppr_ind !=  TX_STATUS_SUPR_NONE) ? \
+	WLFC_CTL_PKTFLAG_D11SUPPRESS : \
+	((txs)->status.was_acked ? \
+		WLFC_CTL_PKTFLAG_DISCARD : WLFC_CTL_PKTFLAG_DISCARD_NOACK))
+
+#ifdef PROP_TXSTATUS_DEBUG
+#define WLFC_DBGMESG(x) printf x
+/* wlfc-breadcrumb */
+#define WLFC_BREADCRUMB(x) do {if ((x) == NULL) \
+	{printf("WLFC: %s():%d:caller:%p\n", \
+	__FUNCTION__, __LINE__, __builtin_return_address(0));}} while (0)
+#define WLFC_PRINTMAC(banner, ea) do {printf("%s MAC: [%02x:%02x:%02x:%02x:%02x:%02x]\n", \
+	banner, ea[0], 	ea[1], 	ea[2], 	ea[3], 	ea[4], 	ea[5]); } while (0)
+#define WLFC_WHEREIS(s) printf("WLFC: at %s():%d, %s\n", __FUNCTION__, __LINE__, (s))
+#else
+#define WLFC_DBGMESG(x)
+#define WLFC_BREADCRUMB(x)
+#define WLFC_PRINTMAC(banner, ea)
+#define WLFC_WHEREIS(s)
+#endif
+
+/* AMPDU host reorder packet flags */
+#define WLHOST_REORDERDATA_MAXFLOWS		256
+#define WLHOST_REORDERDATA_LEN		 10
+#define WLHOST_REORDERDATA_TOTLEN	(WLHOST_REORDERDATA_LEN + 1 + 1) /* +tag +len */
+
+#define WLHOST_REORDERDATA_FLOWID_OFFSET		0
+#define WLHOST_REORDERDATA_MAXIDX_OFFSET		2
+#define WLHOST_REORDERDATA_FLAGS_OFFSET			4
+#define WLHOST_REORDERDATA_CURIDX_OFFSET		6
+#define WLHOST_REORDERDATA_EXPIDX_OFFSET		8
+
+#define WLHOST_REORDERDATA_DEL_FLOW		0x01
+#define WLHOST_REORDERDATA_FLUSH_ALL		0x02
+#define WLHOST_REORDERDATA_CURIDX_VALID		0x04
+#define WLHOST_REORDERDATA_EXPIDX_VALID		0x08
+#define WLHOST_REORDERDATA_NEW_HOLE		0x10
+
+/* transaction id data len byte 0: rsvd, byte 1: seqnumber, byte 2-5 will be used for timestampe */
+#define WLFC_CTL_TRANS_ID_LEN			6
+#define WLFC_TYPE_TRANS_ID_LEN			6
+
+#define WLFC_MODE_HANGER	1 /* use hanger */
+#define WLFC_MODE_AFQ		2 /* use afq */
+#define WLFC_IS_OLD_DEF(x) ((x & 1) || (x & 2))
+
+#define WLFC_MODE_AFQ_SHIFT		2	/* afq bit */
+#define WLFC_SET_AFQ(x, val)	((x) = \
+	((x) & ~(1 << WLFC_MODE_AFQ_SHIFT)) | \
+	(((val) & 1) << WLFC_MODE_AFQ_SHIFT))
+#define WLFC_GET_AFQ(x)	(((x) >> WLFC_MODE_AFQ_SHIFT) & 1)
+
+#define WLFC_MODE_REUSESEQ_SHIFT	3	/* seq reuse bit */
+#define WLFC_SET_REUSESEQ(x, val)	((x) = \
+	((x) & ~(1 << WLFC_MODE_REUSESEQ_SHIFT)) | \
+	(((val) & 1) << WLFC_MODE_REUSESEQ_SHIFT))
+#define WLFC_GET_REUSESEQ(x)	(((x) >> WLFC_MODE_REUSESEQ_SHIFT) & 1)
+
+#define WLFC_MODE_REORDERSUPP_SHIFT	4	/* host reorder suppress pkt bit */
+#define WLFC_SET_REORDERSUPP(x, val)	((x) = \
+	((x) & ~(1 << WLFC_MODE_REORDERSUPP_SHIFT)) | \
+	(((val) & 1) << WLFC_MODE_REORDERSUPP_SHIFT))
+#define WLFC_GET_REORDERSUPP(x)	(((x) >> WLFC_MODE_REORDERSUPP_SHIFT) & 1)
+
+#endif /* __wlfc_proto_definitions_h__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/include/wlioctl.h b/drivers/net/wireless/bcm4336/include/wlioctl.h
--- a/drivers/net/wireless/bcm4336/include/wlioctl.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/include/wlioctl.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,5930 @@
+/*
+ * Custom OID/ioctl definitions for
+ * Broadcom 802.11abg Networking Device Driver
+ *
+ * Definitions subject to change without notice.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wlioctl.h 504503 2014-09-24 11:28:56Z $
+ */
+
+#ifndef _wlioctl_h_
+#define	_wlioctl_h_
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <proto/bcmip.h>
+#include <proto/bcmeth.h>
+#include <proto/bcmip.h>
+#include <proto/bcmevent.h>
+#include <proto/802.11.h>
+#include <proto/802.1d.h>
+#include <bcmwifi_channels.h>
+#include <bcmwifi_rates.h>
+#include <devctrl_if/wlioctl_defs.h>
+
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#include <bcm_mpool_pub.h>
+#include <bcmcdc.h>
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+
+
+
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+#ifndef INTF_NAME_SIZ
+#define INTF_NAME_SIZ	16
+#endif
+
+/* Used to send ioctls over the transport pipe */
+typedef struct remote_ioctl {
+	cdc_ioctl_t	msg;
+	uint32		data_len;
+	char           intf_name[INTF_NAME_SIZ];
+} rem_ioctl_t;
+#define REMOTE_SIZE	sizeof(rem_ioctl_t)
+
+typedef struct {
+	uint32 num;
+	chanspec_t list[1];
+} chanspec_list_t;
+
+/* DFS Forced param */
+typedef struct wl_dfs_forced_params {
+	chanspec_t chspec;
+	uint16 version;
+	chanspec_list_t chspec_list;
+} wl_dfs_forced_t;
+
+#define DFS_PREFCHANLIST_VER 0x01
+#define WL_CHSPEC_LIST_FIXED_SIZE	OFFSETOF(chanspec_list_t, list)
+#define WL_DFS_FORCED_PARAMS_FIXED_SIZE \
+	(WL_CHSPEC_LIST_FIXED_SIZE + OFFSETOF(wl_dfs_forced_t, chspec_list))
+#define WL_DFS_FORCED_PARAMS_MAX_SIZE \
+	WL_DFS_FORCED_PARAMS_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(chanspec_t))
+
+/* association decision information */
+typedef struct {
+	bool		assoc_approved;		/* (re)association approved */
+	uint16		reject_reason;		/* reason code for rejecting association */
+	struct		ether_addr   da;
+#if 0 && (NDISVER >= 0x0620)
+	LARGE_INTEGER	sys_time;		/* current system time */
+#else
+	int64		sys_time;		/* current system time */
+#endif
+} assoc_decision_t;
+
+#define ACTION_FRAME_SIZE 1800
+
+typedef struct wl_action_frame {
+	struct ether_addr 	da;
+	uint16 			len;
+	uint32 			packetId;
+	uint8			data[ACTION_FRAME_SIZE];
+} wl_action_frame_t;
+
+#define WL_WIFI_ACTION_FRAME_SIZE sizeof(struct wl_action_frame)
+
+typedef struct ssid_info
+{
+	uint8		ssid_len;	/* the length of SSID */
+	uint8		ssid[32];	/* SSID string */
+} ssid_info_t;
+
+typedef struct wl_af_params {
+	uint32 			channel;
+	int32 			dwell_time;
+	struct ether_addr 	BSSID;
+	wl_action_frame_t	action_frame;
+} wl_af_params_t;
+
+#define WL_WIFI_AF_PARAMS_SIZE sizeof(struct wl_af_params)
+
+#define MFP_TEST_FLAG_NORMAL	0
+#define MFP_TEST_FLAG_ANY_KEY	1
+typedef struct wl_sa_query {
+	uint32			flag;
+	uint8 			action;
+	uint16 			id;
+	struct ether_addr 	da;
+} wl_sa_query_t;
+
+#endif /*  LINUX_POSTMOGRIFY_REMOVAL */
+
+/* require default structure packing */
+#define BWL_DEFAULT_PACKING
+#include <packed_section_start.h>
+
+
+/* Flags for OBSS IOVAR Parameters */
+#define WL_OBSS_DYN_BWSW_FLAG_ACTIVITY_PERIOD        (0x01)
+#define WL_OBSS_DYN_BWSW_FLAG_NOACTIVITY_PERIOD      (0x02)
+#define WL_OBSS_DYN_BWSW_FLAG_NOACTIVITY_INCR_PERIOD (0x04)
+#define WL_OBSS_DYN_BWSW_FLAG_PSEUDO_SENSE_PERIOD    (0x08)
+#define WL_OBSS_DYN_BWSW_FLAG_RX_CRS_PERIOD          (0x10)
+#define WL_OBSS_DYN_BWSW_FLAG_DUR_THRESHOLD          (0x20)
+#define WL_OBSS_DYN_BWSW_FLAG_TXOP_PERIOD            (0x40)
+
+/* OBSS IOVAR Version information */
+#define WL_PROT_OBSS_CONFIG_PARAMS_VERSION 1
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8 obss_bwsw_activity_cfm_count_cfg; /* configurable count in
+		* seconds before we confirm that OBSS is present and
+		* dynamically activate dynamic bwswitch.
+		*/
+	uint8 obss_bwsw_no_activity_cfm_count_cfg; /* configurable count in
+		* seconds before we confirm that OBSS is GONE and
+		* dynamically start pseudo upgrade. If in pseudo sense time, we
+		* will see OBSS, [means that, we false detected that OBSS-is-gone
+		* in watchdog] this count will be incremented in steps of
+		* obss_bwsw_no_activity_cfm_count_incr_cfg for confirming OBSS
+		* detection again. Note that, at present, max 30seconds is
+		* allowed like this. [OBSS_BWSW_NO_ACTIVITY_MAX_INCR_DEFAULT]
+		*/
+	uint8 obss_bwsw_no_activity_cfm_count_incr_cfg; /* see above
+		*/
+	uint16 obss_bwsw_pseudo_sense_count_cfg; /* number of msecs/cnt to be in
+		* pseudo state. This is used to sense/measure the stats from lq.
+		*/
+	uint8 obss_bwsw_rx_crs_threshold_cfg; /* RX CRS default threshold */
+	uint8 obss_bwsw_dur_thres; /* OBSS dyn bwsw trigger/RX CRS Sec */
+	uint8 obss_bwsw_txop_threshold_cfg; /* TXOP default threshold */
+} BWL_POST_PACKED_STRUCT wlc_prot_dynbwsw_config_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 version;	/* version field */
+	uint32 config_mask;
+	uint32 reset_mask;
+	wlc_prot_dynbwsw_config_t config_params;
+} BWL_POST_PACKED_STRUCT obss_config_params_t;
+
+
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* Legacy structure to help keep backward compatible wl tool and tray app */
+
+#define	LEGACY_WL_BSS_INFO_VERSION	107	/* older version of wl_bss_info struct */
+
+typedef struct wl_bss_info_107 {
+	uint32		version;		/* version field */
+	uint32		length;			/* byte length of data in this record,
+						 * starting at version and including IEs
+						 */
+	struct ether_addr BSSID;
+	uint16		beacon_period;		/* units are Kusec */
+	uint16		capability;		/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	struct {
+		uint	count;			/* # rates in this set */
+		uint8	rates[16];		/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/* supported rates */
+	uint8		channel;		/* Channel no. */
+	uint16		atim_window;		/* units are Kusec */
+	uint8		dtim_period;		/* DTIM period */
+	int16		RSSI;			/* receive signal strength (in dBm) */
+	int8		phy_noise;		/* noise (in dBm) */
+	uint32		ie_length;		/* byte length of Information Elements */
+	/* variable length Information Elements */
+} wl_bss_info_107_t;
+
+/*
+ * Per-BSS information structure.
+ */
+
+#define	LEGACY2_WL_BSS_INFO_VERSION	108		/* old version of wl_bss_info struct */
+
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info_108 {
+	uint32		version;		/* version field */
+	uint32		length;			/* byte length of data in this record,
+						 * starting at version and including IEs
+						 */
+	struct ether_addr BSSID;
+	uint16		beacon_period;		/* units are Kusec */
+	uint16		capability;		/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	struct {
+		uint	count;			/* # rates in this set */
+		uint8	rates[16];		/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/* supported rates */
+	chanspec_t	chanspec;		/* chanspec for bss */
+	uint16		atim_window;		/* units are Kusec */
+	uint8		dtim_period;		/* DTIM period */
+	int16		RSSI;			/* receive signal strength (in dBm) */
+	int8		phy_noise;		/* noise (in dBm) */
+
+	uint8		n_cap;			/* BSS is 802.11N Capable */
+	uint32		nbss_cap;		/* 802.11N BSS Capabilities (based on HT_CAP_*) */
+	uint8		ctl_ch;			/* 802.11N BSS control channel number */
+	uint32		reserved32[1];		/* Reserved for expansion of BSS properties */
+	uint8		flags;			/* flags */
+	uint8		reserved[3];		/* Reserved for expansion of BSS properties */
+	uint8		basic_mcs[MCSSET_LEN];	/* 802.11N BSS required MCS set */
+
+	uint16		ie_offset;		/* offset at which IEs start, from beginning */
+	uint32		ie_length;		/* byte length of Information Elements */
+	/* Add new fields here */
+	/* variable length Information Elements */
+} wl_bss_info_108_t;
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define	WL_BSS_INFO_VERSION	109		/* current version of wl_bss_info struct */
+
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in wl_scan_results_t)
+ */
+typedef struct wl_bss_info {
+	uint32		version;		/* version field */
+	uint32		length;			/* byte length of data in this record,
+						 * starting at version and including IEs
+						 */
+	struct ether_addr BSSID;
+	uint16		beacon_period;		/* units are Kusec */
+	uint16		capability;		/* Capability information */
+	uint8		SSID_len;
+	uint8		SSID[32];
+	struct {
+		uint	count;			/* # rates in this set */
+		uint8	rates[16];		/* rates in 500kbps units w/hi bit set if basic */
+	} rateset;				/* supported rates */
+	chanspec_t	chanspec;		/* chanspec for bss */
+	uint16		atim_window;		/* units are Kusec */
+	uint8		dtim_period;		/* DTIM period */
+	int16		RSSI;			/* receive signal strength (in dBm) */
+	int8		phy_noise;		/* noise (in dBm) */
+
+	uint8		n_cap;			/* BSS is 802.11N Capable */
+	uint32		nbss_cap;		/* 802.11N+AC BSS Capabilities */
+	uint8		ctl_ch;			/* 802.11N BSS control channel number */
+	uint8		padding1[3];		/* explicit struct alignment padding */
+	uint16		vht_rxmcsmap;	/* VHT rx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+	uint16		vht_txmcsmap;	/* VHT tx mcs map (802.11ac IE, VHT_CAP_MCS_MAP_*) */
+	uint8		flags;			/* flags */
+	uint8		vht_cap;		/* BSS is vht capable */
+	uint8		reserved[2];		/* Reserved for expansion of BSS properties */
+	uint8		basic_mcs[MCSSET_LEN];	/* 802.11N BSS required MCS set */
+
+	uint16		ie_offset;		/* offset at which IEs start, from beginning */
+	uint32		ie_length;		/* byte length of Information Elements */
+	int16		SNR;			/* average SNR of during frame reception */
+	/* Add new fields here */
+	/* variable length Information Elements */
+} wl_bss_info_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+typedef struct wl_bsscfg {
+	uint32  bsscfg_idx;
+	uint32  wsec;
+	uint32  WPA_auth;
+	uint32  wsec_index;
+	uint32  associated;
+	uint32  BSS;
+	uint32  phytest_on;
+	struct ether_addr   prev_BSSID;
+	struct ether_addr   BSSID;
+	uint32  targetbss_wpa2_flags;
+	uint32 assoc_type;
+	uint32 assoc_state;
+} wl_bsscfg_t;
+
+typedef struct wl_if_add {
+	uint32  bsscfg_flags;
+	uint32  if_flags;
+	uint32  ap;
+	struct ether_addr   mac_addr;
+} wl_if_add_t;
+
+typedef struct wl_bss_config {
+	uint32	atim_window;
+	uint32	beacon_period;
+	uint32	chanspec;
+} wl_bss_config_t;
+
+#define WL_BSS_USER_RADAR_CHAN_SELECT	0x1	/* User application will randomly select
+						 * radar channel.
+						 */
+
+#define DLOAD_HANDLER_VER			1	/* Downloader version */
+#define DLOAD_FLAG_VER_MASK		0xf000	/* Downloader version mask */
+#define DLOAD_FLAG_VER_SHIFT	12	/* Downloader version shift */
+
+#define DL_CRC_NOT_INUSE 			0x0001
+
+/* generic download types & flags */
+enum {
+	DL_TYPE_UCODE = 1,
+	DL_TYPE_CLM = 2
+};
+
+/* ucode type values */
+enum {
+	UCODE_FW,
+	INIT_VALS,
+	BS_INIT_VALS
+};
+
+struct wl_dload_data {
+	uint16 flag;
+	uint16 dload_type;
+	uint32 len;
+	uint32 crc;
+	uint8  data[1];
+};
+typedef struct wl_dload_data wl_dload_data_t;
+
+struct wl_ucode_info {
+	uint32 ucode_type;
+	uint32 num_chunks;
+	uint32 chunk_len;
+	uint32 chunk_num;
+	uint8  data_chunk[1];
+};
+typedef struct wl_ucode_info wl_ucode_info_t;
+
+struct wl_clm_dload_info {
+	uint32 ds_id;
+	uint32 clm_total_len;
+	uint32 num_chunks;
+	uint32 chunk_len;
+	uint32 chunk_offset;
+	uint8  data_chunk[1];
+};
+typedef struct wl_clm_dload_info wl_clm_dload_info_t;
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+typedef struct wlc_ssid {
+	uint32		SSID_len;
+	uchar		SSID[DOT11_MAX_SSID_LEN];
+} wlc_ssid_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+#define MAX_PREFERRED_AP_NUM     5
+typedef struct wlc_fastssidinfo {
+	uint32				SSID_channel[MAX_PREFERRED_AP_NUM];
+	wlc_ssid_t		SSID_info[MAX_PREFERRED_AP_NUM];
+} wlc_fastssidinfo_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wnm_url {
+	uint8   len;
+	uint8   data[1];
+} BWL_POST_PACKED_STRUCT wnm_url_t;
+
+typedef struct chan_scandata {
+	uint8		txpower;
+	uint8		pad;
+	chanspec_t	channel;	/* Channel num, bw, ctrl_sb and band */
+	uint32		channel_mintime;
+	uint32		channel_maxtime;
+} chan_scandata_t;
+
+typedef enum wl_scan_type {
+	EXTDSCAN_FOREGROUND_SCAN,
+	EXTDSCAN_BACKGROUND_SCAN,
+	EXTDSCAN_FORCEDBACKGROUND_SCAN
+} wl_scan_type_t;
+
+#define WLC_EXTDSCAN_MAX_SSID		5
+
+typedef struct wl_extdscan_params {
+	int8 		nprobes;		/* 0, passive, otherwise active */
+	int8    	split_scan;		/* split scan */
+	int8		band;			/* band */
+	int8		pad;
+	wlc_ssid_t 	ssid[WLC_EXTDSCAN_MAX_SSID]; /* ssid list */
+	uint32		tx_rate;		/* in 500ksec units */
+	wl_scan_type_t	scan_type;		/* enum */
+	int32 		channel_num;
+	chan_scandata_t channel_list[1];	/* list of chandata structs */
+} wl_extdscan_params_t;
+
+#define WL_EXTDSCAN_PARAMS_FIXED_SIZE 	(sizeof(wl_extdscan_params_t) - sizeof(chan_scandata_t))
+
+#define WL_SCAN_PARAMS_SSID_MAX 	10
+
+typedef struct wl_scan_params {
+	wlc_ssid_t ssid;		/* default: {0, ""} */
+	struct ether_addr bssid;	/* default: bcast */
+	int8 bss_type;			/* default: any,
+					 * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+					 */
+	uint8 scan_type;		/* flags, 0 use default */
+	int32 nprobes;			/* -1 use default, number of probes per channel */
+	int32 active_time;		/* -1 use default, dwell time per channel for
+					 * active scanning
+					 */
+	int32 passive_time;		/* -1 use default, dwell time per channel
+					 * for passive scanning
+					 */
+	int32 home_time;		/* -1 use default, dwell time for the home channel
+					 * between channel scans
+					 */
+	int32 channel_num;		/* count of channels and ssids that follow
+					 *
+					 * low half is count of channels in channel_list, 0
+					 * means default (use all available channels)
+					 *
+					 * high half is entries in wlc_ssid_t array that
+					 * follows channel_list, aligned for int32 (4 bytes)
+					 * meaning an odd channel count implies a 2-byte pad
+					 * between end of channel_list and first ssid
+					 *
+					 * if ssid count is zero, single ssid in the fixed
+					 * parameter portion is assumed, otherwise ssid in
+					 * the fixed portion is ignored
+					 */
+	uint16 channel_list[1];		/* list of chanspecs */
+} wl_scan_params_t;
+
+/* size of wl_scan_params not including variable length array */
+#define WL_SCAN_PARAMS_FIXED_SIZE 64
+#define WL_MAX_ROAMSCAN_DATSZ	(WL_SCAN_PARAMS_FIXED_SIZE + (WL_NUMCHANNELS * sizeof(uint16)))
+
+#define ISCAN_REQ_VERSION 1
+
+/* incremental scan struct */
+typedef struct wl_iscan_params {
+	uint32 version;
+	uint16 action;
+	uint16 scan_duration;
+	wl_scan_params_t params;
+} wl_iscan_params_t;
+
+/* 3 fields + size of wl_scan_params, not including variable length array */
+#define WL_ISCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_iscan_params_t, params) + sizeof(wlc_ssid_t))
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+typedef struct wl_scan_results {
+	uint32 buflen;
+	uint32 version;
+	uint32 count;
+	wl_bss_info_t bss_info[1];
+} wl_scan_results_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* size of wl_scan_results not including variable length array */
+#define WL_SCAN_RESULTS_FIXED_SIZE (sizeof(wl_scan_results_t) - sizeof(wl_bss_info_t))
+
+
+#define ESCAN_REQ_VERSION 1
+
+typedef struct wl_escan_params {
+	uint32 version;
+	uint16 action;
+	uint16 sync_id;
+	wl_scan_params_t params;
+} wl_escan_params_t;
+
+#define WL_ESCAN_PARAMS_FIXED_SIZE (OFFSETOF(wl_escan_params_t, params) + sizeof(wlc_ssid_t))
+
+typedef struct wl_escan_result {
+	uint32 buflen;
+	uint32 version;
+	uint16 sync_id;
+	uint16 bss_count;
+	wl_bss_info_t bss_info[1];
+} wl_escan_result_t;
+
+#define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(wl_escan_result_t) - sizeof(wl_bss_info_t))
+
+/* incremental scan results struct */
+typedef struct wl_iscan_results {
+	uint32 status;
+	wl_scan_results_t results;
+} wl_iscan_results_t;
+
+/* size of wl_iscan_results not including variable length array */
+#define WL_ISCAN_RESULTS_FIXED_SIZE \
+	(WL_SCAN_RESULTS_FIXED_SIZE + OFFSETOF(wl_iscan_results_t, results))
+
+#define SCANOL_PARAMS_VERSION	1
+
+typedef struct scanol_params {
+	uint32 version;
+	uint32 flags;	/* offload scanning flags */
+	int32 active_time;	/* -1 use default, dwell time per channel for active scanning */
+	int32 passive_time;	/* -1 use default, dwell time per channel for passive scanning */
+	int32 idle_rest_time;	/* -1 use default, time idle between scan cycle */
+	int32 idle_rest_time_multiplier;
+	int32 active_rest_time;
+	int32 active_rest_time_multiplier;
+	int32 scan_cycle_idle_rest_time;
+	int32 scan_cycle_idle_rest_multiplier;
+	int32 scan_cycle_active_rest_time;
+	int32 scan_cycle_active_rest_multiplier;
+	int32 max_rest_time;
+	int32 max_scan_cycles;
+	int32 nprobes;		/* -1 use default, number of probes per channel */
+	int32 scan_start_delay;
+	uint32 nchannels;
+	uint32 ssid_count;
+	wlc_ssid_t ssidlist[1];
+} scanol_params_t;
+
+typedef struct wl_probe_params {
+	wlc_ssid_t ssid;
+	struct ether_addr bssid;
+	struct ether_addr mac;
+} wl_probe_params_t;
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define WL_MAXRATES_IN_SET		16	/* max # of rates in a rateset */
+typedef struct wl_rateset {
+	uint32	count;			/* # rates in this set */
+	uint8	rates[WL_MAXRATES_IN_SET];	/* rates in 500kbps units w/hi bit set if basic */
+} wl_rateset_t;
+
+typedef struct wl_rateset_args {
+	uint32	count;			/* # rates in this set */
+	uint8	rates[WL_MAXRATES_IN_SET];	/* rates in 500kbps units w/hi bit set if basic */
+	uint8   mcs[MCSSET_LEN];        /* supported mcs index bit map */
+	uint16 vht_mcs[VHT_CAP_MCS_MAP_NSS_MAX]; /* supported mcs index bit map per nss */
+} wl_rateset_args_t;
+
+#define TXBF_RATE_MCS_ALL		4
+#define TXBF_RATE_VHT_ALL		4
+#define TXBF_RATE_OFDM_ALL		8
+
+typedef struct wl_txbf_rateset {
+	uint8	txbf_rate_mcs[TXBF_RATE_MCS_ALL];	/* one for each stream */
+	uint8	txbf_rate_mcs_bcm[TXBF_RATE_MCS_ALL];	/* one for each stream */
+	uint16	txbf_rate_vht[TXBF_RATE_VHT_ALL];	/* one for each stream */
+	uint16	txbf_rate_vht_bcm[TXBF_RATE_VHT_ALL];	/* one for each stream */
+	uint8	txbf_rate_ofdm[TXBF_RATE_OFDM_ALL];	/* bitmap of ofdm rates that enables txbf */
+	uint8	txbf_rate_ofdm_bcm[TXBF_RATE_OFDM_ALL]; /* bitmap of ofdm rates that enables txbf */
+	uint8	txbf_rate_ofdm_cnt;
+	uint8	txbf_rate_ofdm_cnt_bcm;
+} wl_txbf_rateset_t;
+
+#define OFDM_RATE_MASK			0x0000007f
+typedef uint8 ofdm_rates_t;
+
+typedef struct wl_rates_info {
+	wl_rateset_t rs_tgt;
+	uint32 phy_type;
+	int32 bandtype;
+	uint8 cck_only;
+	uint8 rate_mask;
+	uint8 mcsallow;
+	uint8 bw;
+	uint8 txstreams;
+} wl_rates_info_t;
+
+/* uint32 list */
+typedef struct wl_uint32_list {
+	/* in - # of elements, out - # of entries */
+	uint32 count;
+	/* variable length uint32 list */
+	uint32 element[1];
+} wl_uint32_list_t;
+
+/* used for association with a specific BSSID and chanspec list */
+typedef struct wl_assoc_params {
+	struct ether_addr bssid;	/* 00:00:00:00:00:00: broadcast scan */
+	uint16 bssid_cnt;		/* 0: use chanspec_num, and the single bssid,
+					* otherwise count of chanspecs in chanspec_list
+					* AND paired bssids following chanspec_list
+					* also, chanspec_num has to be set to zero
+					* for bssid list to be used
+					*/
+	int32 chanspec_num;		/* 0: all available channels,
+					* otherwise count of chanspecs in chanspec_list
+					*/
+	chanspec_t chanspec_list[1];	/* list of chanspecs */
+} wl_assoc_params_t;
+
+#define WL_ASSOC_PARAMS_FIXED_SIZE 	OFFSETOF(wl_assoc_params_t, chanspec_list)
+
+/* used for reassociation/roam to a specific BSSID and channel */
+typedef wl_assoc_params_t wl_reassoc_params_t;
+#define WL_REASSOC_PARAMS_FIXED_SIZE	WL_ASSOC_PARAMS_FIXED_SIZE
+
+/* used for association to a specific BSSID and channel */
+typedef wl_assoc_params_t wl_join_assoc_params_t;
+#define WL_JOIN_ASSOC_PARAMS_FIXED_SIZE	WL_ASSOC_PARAMS_FIXED_SIZE
+
+/* used for join with or without a specific bssid and channel list */
+typedef struct wl_join_params {
+	wlc_ssid_t ssid;
+	wl_assoc_params_t params;	/* optional field, but it must include the fixed portion
+					 * of the wl_assoc_params_t struct when it does present.
+					 */
+} wl_join_params_t;
+
+#ifndef  LINUX_POSTMOGRIFY_REMOVAL
+#define WL_JOIN_PARAMS_FIXED_SIZE 	(OFFSETOF(wl_join_params_t, params) + \
+					 WL_ASSOC_PARAMS_FIXED_SIZE)
+/* scan params for extended join */
+typedef struct wl_join_scan_params {
+	uint8 scan_type;		/* 0 use default, active or passive scan */
+	int32 nprobes;			/* -1 use default, number of probes per channel */
+	int32 active_time;		/* -1 use default, dwell time per channel for
+					 * active scanning
+					 */
+	int32 passive_time;		/* -1 use default, dwell time per channel
+					 * for passive scanning
+					 */
+	int32 home_time;		/* -1 use default, dwell time for the home channel
+					 * between channel scans
+					 */
+} wl_join_scan_params_t;
+
+/* extended join params */
+typedef struct wl_extjoin_params {
+	wlc_ssid_t ssid;		/* {0, ""}: wildcard scan */
+	wl_join_scan_params_t scan;
+	wl_join_assoc_params_t assoc;	/* optional field, but it must include the fixed portion
+					 * of the wl_join_assoc_params_t struct when it does
+					 * present.
+					 */
+} wl_extjoin_params_t;
+#define WL_EXTJOIN_PARAMS_FIXED_SIZE 	(OFFSETOF(wl_extjoin_params_t, assoc) + \
+					 WL_JOIN_ASSOC_PARAMS_FIXED_SIZE)
+
+#define ANT_SELCFG_MAX		4	/* max number of antenna configurations */
+#define MAX_STREAMS_SUPPORTED	4	/* max number of streams supported */
+typedef struct {
+	uint8 ant_config[ANT_SELCFG_MAX];	/* antenna configuration */
+	uint8 num_antcfg;	/* number of available antenna configurations */
+} wlc_antselcfg_t;
+
+typedef struct {
+	uint32 duration;	/* millisecs spent sampling this channel */
+	uint32 congest_ibss;	/* millisecs in our bss (presumably this traffic will */
+				/*  move if cur bss moves channels) */
+	uint32 congest_obss;	/* traffic not in our bss */
+	uint32 interference;	/* millisecs detecting a non 802.11 interferer. */
+	uint32 timestamp;	/* second timestamp */
+} cca_congest_t;
+
+typedef struct {
+	chanspec_t chanspec;	/* Which channel? */
+	uint8 num_secs;		/* How many secs worth of data */
+	cca_congest_t  secs[1];	/* Data */
+} cca_congest_channel_req_t;
+
+
+/* interference sources */
+enum interference_source {
+	ITFR_NONE = 0,		/* interference */
+	ITFR_PHONE,		/* wireless phone */
+	ITFR_VIDEO_CAMERA,	/* wireless video camera */
+	ITFR_MICROWAVE_OVEN,	/* microwave oven */
+	ITFR_BABY_MONITOR,	/* wireless baby monitor */
+	ITFR_BLUETOOTH,		/* bluetooth */
+	ITFR_VIDEO_CAMERA_OR_BABY_MONITOR,	/* wireless camera or baby monitor */
+	ITFR_BLUETOOTH_OR_BABY_MONITOR,	/* bluetooth or baby monitor */
+	ITFR_VIDEO_CAMERA_OR_PHONE,	/* video camera or phone */
+	ITFR_UNIDENTIFIED	/* interference from unidentified source */
+};
+
+/* structure for interference source report */
+typedef struct {
+	uint32 flags;	/* flags.  bit definitions below */
+	uint32 source;	/* last detected interference source */
+	uint32 timestamp;	/* second timestamp on interferenced flag change */
+} interference_source_rep_t;
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define WLC_CNTRY_BUF_SZ	4		/* Country string is 3 bytes + NUL */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+typedef struct wl_country {
+	char country_abbrev[WLC_CNTRY_BUF_SZ];	/* nul-terminated country code used in
+						 * the Country IE
+						 */
+	int32 rev;				/* revision specifier for ccode
+						 * on set, -1 indicates unspecified.
+						 * on get, rev >= 0
+						 */
+	char ccode[WLC_CNTRY_BUF_SZ];		/* nul-terminated built-in country code.
+						 * variable length, but fixed size in
+						 * struct allows simple allocation for
+						 * expected country strings <= 3 chars.
+						 */
+} wl_country_t;
+
+typedef struct wl_channels_in_country {
+	uint32 buflen;
+	uint32 band;
+	char country_abbrev[WLC_CNTRY_BUF_SZ];
+	uint32 count;
+	uint32 channel[1];
+} wl_channels_in_country_t;
+
+typedef struct wl_country_list {
+	uint32 buflen;
+	uint32 band_set;
+	uint32 band;
+	uint32 count;
+	char country_abbrev[1];
+} wl_country_list_t;
+
+typedef struct wl_rm_req_elt {
+	int8	type;
+	int8	flags;
+	chanspec_t	chanspec;
+	uint32	token;		/* token for this measurement */
+	uint32	tsf_h;		/* TSF high 32-bits of Measurement start time */
+	uint32	tsf_l;		/* TSF low 32-bits */
+	uint32	dur;		/* TUs */
+} wl_rm_req_elt_t;
+
+typedef struct wl_rm_req {
+	uint32	token;		/* overall measurement set token */
+	uint32	count;		/* number of measurement requests */
+	void	*cb;		/* completion callback function: may be NULL */
+	void	*cb_arg;	/* arg to completion callback function */
+	wl_rm_req_elt_t	req[1];	/* variable length block of requests */
+} wl_rm_req_t;
+#define WL_RM_REQ_FIXED_LEN	OFFSETOF(wl_rm_req_t, req)
+
+typedef struct wl_rm_rep_elt {
+	int8	type;
+	int8	flags;
+	chanspec_t	chanspec;
+	uint32	token;		/* token for this measurement */
+	uint32	tsf_h;		/* TSF high 32-bits of Measurement start time */
+	uint32	tsf_l;		/* TSF low 32-bits */
+	uint32	dur;		/* TUs */
+	uint32	len;		/* byte length of data block */
+	uint8	data[1];	/* variable length data block */
+} wl_rm_rep_elt_t;
+#define WL_RM_REP_ELT_FIXED_LEN	24	/* length excluding data block */
+
+#define WL_RPI_REP_BIN_NUM 8
+typedef struct wl_rm_rpi_rep {
+	uint8	rpi[WL_RPI_REP_BIN_NUM];
+	int8	rpi_max[WL_RPI_REP_BIN_NUM];
+} wl_rm_rpi_rep_t;
+
+typedef struct wl_rm_rep {
+	uint32	token;		/* overall measurement set token */
+	uint32	len;		/* length of measurement report block */
+	wl_rm_rep_elt_t	rep[1];	/* variable length block of reports */
+} wl_rm_rep_t;
+#define WL_RM_REP_FIXED_LEN	8
+
+#ifdef BCMCCX
+
+#define LEAP_USER_MAX		32
+#define LEAP_DOMAIN_MAX		32
+#define LEAP_PASSWORD_MAX	32
+
+typedef struct wl_leap_info {
+	wlc_ssid_t ssid;
+	uint8 user_len;
+	uchar user[LEAP_USER_MAX];
+	uint8 password_len;
+	uchar password[LEAP_PASSWORD_MAX];
+	uint8 domain_len;
+	uchar domain[LEAP_DOMAIN_MAX];
+} wl_leap_info_t;
+
+typedef struct wl_leap_list {
+	uint32 buflen;
+	uint32 version;
+	uint32 count;
+	wl_leap_info_t leap_info[1];
+} wl_leap_list_t;
+#endif	/* BCMCCX */
+
+typedef enum sup_auth_status {
+	/* Basic supplicant authentication states */
+	WLC_SUP_DISCONNECTED = 0,
+	WLC_SUP_CONNECTING,
+	WLC_SUP_IDREQUIRED,
+	WLC_SUP_AUTHENTICATING,
+	WLC_SUP_AUTHENTICATED,
+	WLC_SUP_KEYXCHANGE,
+	WLC_SUP_KEYED,
+	WLC_SUP_TIMEOUT,
+	WLC_SUP_LAST_BASIC_STATE,
+
+	/* Extended supplicant authentication states */
+	/* Waiting to receive handshake msg M1 */
+	WLC_SUP_KEYXCHANGE_WAIT_M1 = WLC_SUP_AUTHENTICATED,
+	/* Preparing to send handshake msg M2 */
+	WLC_SUP_KEYXCHANGE_PREP_M2 = WLC_SUP_KEYXCHANGE,
+	/* Waiting to receive handshake msg M3 */
+	WLC_SUP_KEYXCHANGE_WAIT_M3 = WLC_SUP_LAST_BASIC_STATE,
+	WLC_SUP_KEYXCHANGE_PREP_M4,	/* Preparing to send handshake msg M4 */
+	WLC_SUP_KEYXCHANGE_WAIT_G1,	/* Waiting to receive handshake msg G1 */
+	WLC_SUP_KEYXCHANGE_PREP_G2	/* Preparing to send handshake msg G2 */
+} sup_auth_status_t;
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+typedef struct wl_wsec_key {
+	uint32		index;		/* key index */
+	uint32		len;		/* key length */
+	uint8		data[DOT11_MAX_KEY_SIZE];	/* key data */
+	uint32		pad_1[18];
+	uint32		algo;		/* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+	uint32		flags;		/* misc flags */
+	uint32		pad_2[2];
+	int		pad_3;
+	int		iv_initialized;	/* has IV been initialized already? */
+	int		pad_4;
+	/* Rx IV */
+	struct {
+		uint32	hi;		/* upper 32 bits of IV */
+		uint16	lo;		/* lower 16 bits of IV */
+	} rxiv;
+	uint32		pad_5[2];
+	struct ether_addr ea;		/* per station */
+} wl_wsec_key_t;
+
+#define WSEC_MIN_PSK_LEN	8
+#define WSEC_MAX_PSK_LEN	64
+
+/* Flag for key material needing passhash'ing */
+#define WSEC_PASSPHRASE		(1<<0)
+
+/* receptacle for WLC_SET_WSEC_PMK parameter */
+typedef struct {
+	ushort	key_len;		/* octets in key material */
+	ushort	flags;			/* key handling qualification */
+	uint8	key[WSEC_MAX_PSK_LEN];	/* PMK material */
+} wsec_pmk_t;
+
+typedef struct _pmkid {
+	struct ether_addr	BSSID;
+	uint8			PMKID[WPA2_PMKID_LEN];
+} pmkid_t;
+
+typedef struct _pmkid_list {
+	uint32	npmkid;
+	pmkid_t	pmkid[1];
+} pmkid_list_t;
+
+typedef struct _pmkid_cand {
+	struct ether_addr	BSSID;
+	uint8			preauth;
+} pmkid_cand_t;
+
+typedef struct _pmkid_cand_list {
+	uint32	npmkid_cand;
+	pmkid_cand_t	pmkid_cand[1];
+} pmkid_cand_list_t;
+
+#define WL_STA_ANT_MAX		4	/* max possible rx antennas */
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+typedef struct wl_assoc_info {
+	uint32		req_len;
+	uint32		resp_len;
+	uint32		flags;
+	struct dot11_assoc_req req;
+	struct ether_addr reassoc_bssid; /* used in reassoc's */
+	struct dot11_assoc_resp resp;
+} wl_assoc_info_t;
+
+typedef struct wl_led_info {
+	uint32      index;      /* led index */
+	uint32      behavior;
+	uint8       activehi;
+} wl_led_info_t;
+
+
+/* srom read/write struct passed through ioctl */
+typedef struct {
+	uint	byteoff;	/* byte offset */
+	uint	nbytes;		/* number of bytes */
+	uint16	buf[1];
+} srom_rw_t;
+
+#define CISH_FLAG_PCIECIS	(1 << 15)	/* write CIS format bit for PCIe CIS */
+/* similar cis (srom or otp) struct [iovar: may not be aligned] */
+typedef struct {
+	uint16	source;		/* cis source */
+	uint16	flags;		/* flags */
+	uint32	byteoff;	/* byte offset */
+	uint32	nbytes;		/* number of bytes */
+	/* data follows here */
+} cis_rw_t;
+
+/* R_REG and W_REG struct passed through ioctl */
+typedef struct {
+	uint32	byteoff;	/* byte offset of the field in d11regs_t */
+	uint32	val;		/* read/write value of the field */
+	uint32	size;		/* sizeof the field */
+	uint	band;		/* band (optional) */
+} rw_reg_t;
+
+/* Structure used by GET/SET_ATTEN ioctls - it controls power in b/g-band */
+/* PCL - Power Control Loop */
+typedef struct {
+	uint16	auto_ctrl;	/* WL_ATTEN_XX */
+	uint16	bb;		/* Baseband attenuation */
+	uint16	radio;		/* Radio attenuation */
+	uint16	txctl1;		/* Radio TX_CTL1 value */
+} atten_t;
+
+/* Per-AC retry parameters */
+struct wme_tx_params_s {
+	uint8  short_retry;
+	uint8  short_fallback;
+	uint8  long_retry;
+	uint8  long_fallback;
+	uint16 max_rate;  /* In units of 512 Kbps */
+};
+
+typedef struct wme_tx_params_s wme_tx_params_t;
+
+#define WL_WME_TX_PARAMS_IO_BYTES (sizeof(wme_tx_params_t) * AC_COUNT)
+
+typedef struct wl_plc_nodelist {
+	uint32 count;			/* Number of nodes */
+	struct _node {
+		struct ether_addr ea;	/* Node ether address */
+		uint32 node_type;	/* Node type */
+		uint32 cost;		/* PLC affinity */
+	} node[1];
+} wl_plc_nodelist_t;
+
+typedef struct wl_plc_params {
+	uint32	cmd;			/* Command */
+	uint8	plc_failover;		/* PLC failover control/status */
+	struct	ether_addr node_ea;	/* Node ether address */
+	uint32	cost;			/* Link cost or mac cost */
+} wl_plc_params_t;
+
+/* Used to get specific link/ac parameters */
+typedef struct {
+	int32 ac;
+	uint8 val;
+	struct ether_addr ea;
+} link_val_t;
+
+
+#define WL_PM_MUTE_TX_VER 1
+
+typedef struct wl_pm_mute_tx {
+	uint16 version;		/* version */
+	uint16 len;		/* length */
+	uint16 deadline;	/* deadline timer (in milliseconds) */
+	uint8  enable;		/* set to 1 to enable mode; set to 0 to disable it */
+} wl_pm_mute_tx_t;
+
+
+typedef struct {
+	uint16			ver;		/* version of this struct */
+	uint16			len;		/* length in bytes of this structure */
+	uint16			cap;		/* sta's advertised capabilities */
+	uint32			flags;		/* flags defined below */
+	uint32			idle;		/* time since data pkt rx'd from sta */
+	struct ether_addr	ea;		/* Station address */
+	wl_rateset_t		rateset;	/* rateset in use */
+	uint32			in;		/* seconds elapsed since associated */
+	uint32			listen_interval_inms; /* Min Listen interval in ms for this STA */
+	uint32			tx_pkts;	/* # of user packets transmitted (unicast) */
+	uint32			tx_failures;	/* # of user packets failed */
+	uint32			rx_ucast_pkts;	/* # of unicast packets received */
+	uint32			rx_mcast_pkts;	/* # of multicast packets received */
+	uint32			tx_rate;	/* Rate used by last tx frame */
+	uint32			rx_rate;	/* Rate of last successful rx frame */
+	uint32			rx_decrypt_succeeds;	/* # of packet decrypted successfully */
+	uint32			rx_decrypt_failures;	/* # of packet decrypted unsuccessfully */
+	uint32			tx_tot_pkts;	/* # of user tx pkts (ucast + mcast) */
+	uint32			rx_tot_pkts;	/* # of data packets recvd (uni + mcast) */
+	uint32			tx_mcast_pkts;	/* # of mcast pkts txed */
+	uint64			tx_tot_bytes;	/* data bytes txed (ucast + mcast) */
+	uint64			rx_tot_bytes;	/* data bytes recvd (ucast + mcast) */
+	uint64			tx_ucast_bytes;	/* data bytes txed (ucast) */
+	uint64			tx_mcast_bytes;	/* # data bytes txed (mcast) */
+	uint64			rx_ucast_bytes;	/* data bytes recvd (ucast) */
+	uint64			rx_mcast_bytes;	/* data bytes recvd (mcast) */
+	int8			rssi[WL_STA_ANT_MAX]; /* average rssi per antenna
+										   * of data frames
+										   */
+	int8			nf[WL_STA_ANT_MAX];	/* per antenna noise floor */
+	uint16			aid;		/* association ID */
+	uint16			ht_capabilities;	/* advertised ht caps */
+	uint16			vht_flags;		/* converted vht flags */
+	uint32			tx_pkts_retried;	/* # of frames where a retry was
+							 * necessary
+							 */
+	uint32			tx_pkts_retry_exhausted; /* # of user frames where a retry
+							  * was exhausted
+							  */
+	int8			rx_lastpkt_rssi[WL_STA_ANT_MAX]; /* Per antenna RSSI of last
+								  * received data frame.
+								  */
+	/* TX WLAN retry/failure statistics:
+	 * Separated for host requested frames and WLAN locally generated frames.
+	 * Include unicast frame only where the retries/failures can be counted.
+	 */
+	uint32			tx_pkts_total;		/* # user frames sent successfully */
+	uint32			tx_pkts_retries;	/* # user frames retries */
+	uint32			tx_pkts_fw_total;	/* # FW generated sent successfully */
+	uint32			tx_pkts_fw_retries;	/* # retries for FW generated frames */
+	uint32			tx_pkts_fw_retry_exhausted;	/* # FW generated where a retry
+								 * was exhausted
+								 */
+	uint32			rx_pkts_retried;	/* # rx with retry bit set */
+	uint32			tx_rate_fallback;	/* lowest fallback TX rate */
+} sta_info_t;
+
+#define WL_OLD_STAINFO_SIZE	OFFSETOF(sta_info_t, tx_tot_pkts)
+
+#define WL_STA_VER		4
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define	WLC_NUMRATES	16	/* max # of rates in a rateset */
+
+typedef struct wlc_rateset {
+	uint32	count;			/* number of rates in rates[] */
+	uint8	rates[WLC_NUMRATES];	/* rates in 500kbps units w/hi bit set if basic */
+	uint8	htphy_membership;	/* HT PHY Membership */
+	uint8	mcs[MCSSET_LEN];	/* supported mcs index bit map */
+	uint16  vht_mcsmap;		/* supported vht mcs nss bit map */
+} wlc_rateset_t;
+
+/* Used to get specific STA parameters */
+typedef struct {
+	uint32	val;
+	struct ether_addr ea;
+} scb_val_t;
+
+/* Used by iovar versions of some ioctls, i.e. WLC_SCB_AUTHORIZE et al */
+typedef struct {
+	uint32 code;
+	scb_val_t ioctl_args;
+} authops_t;
+
+/* channel encoding */
+typedef struct channel_info {
+	int hw_channel;
+	int target_channel;
+	int scan_channel;
+} channel_info_t;
+
+/* For ioctls that take a list of MAC addresses */
+typedef struct maclist {
+	uint count;			/* number of MAC addresses */
+	struct ether_addr ea[1];	/* variable length array of MAC addresses */
+} maclist_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+/* get pkt count struct passed through ioctl */
+typedef struct get_pktcnt {
+	uint rx_good_pkt;
+	uint rx_bad_pkt;
+	uint tx_good_pkt;
+	uint tx_bad_pkt;
+	uint rx_ocast_good_pkt; /* unicast packets destined for others */
+} get_pktcnt_t;
+
+/* NINTENDO2 */
+#define LQ_IDX_MIN              0
+#define LQ_IDX_MAX              1
+#define LQ_IDX_AVG              2
+#define LQ_IDX_SUM              2
+#define LQ_IDX_LAST             3
+#define LQ_STOP_MONITOR         0
+#define LQ_START_MONITOR        1
+
+/* Get averages RSSI, Rx PHY rate and SNR values */
+typedef struct {
+	int rssi[LQ_IDX_LAST];  /* Array to keep min, max, avg rssi */
+	int snr[LQ_IDX_LAST];   /* Array to keep min, max, avg snr */
+	int isvalid;            /* Flag indicating whether above data is valid */
+} wl_lq_t; /* Link Quality */
+
+typedef enum wl_wakeup_reason_type {
+	LCD_ON = 1,
+	LCD_OFF,
+	DRC1_WAKE,
+	DRC2_WAKE,
+	REASON_LAST
+} wl_wr_type_t;
+
+typedef struct {
+/* Unique filter id */
+	uint32	id;
+
+/* stores the reason for the last wake up */
+	uint8	reason;
+} wl_wr_t;
+
+/* Get MAC specific rate histogram command */
+typedef struct {
+	struct	ether_addr ea;	/* MAC Address */
+	uint8	ac_cat;	/* Access Category */
+	uint8	num_pkts;	/* Number of packet entries to be averaged */
+} wl_mac_ratehisto_cmd_t;	/* MAC Specific Rate Histogram command */
+
+/* Get MAC rate histogram response */
+typedef struct {
+	uint32	rate[DOT11_RATE_MAX + 1];	/* Rates */
+	uint32	mcs[WL_RATESET_SZ_HT_MCS * WL_TX_CHAINS_MAX];	/* MCS counts */
+	uint32	vht[WL_RATESET_SZ_VHT_MCS][WL_TX_CHAINS_MAX];	/* VHT counts */
+	uint32	tsf_timer[2][2];	/* Start and End time for 8bytes value */
+} wl_mac_ratehisto_res_t;	/* MAC Specific Rate Histogram Response */
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* Linux network driver ioctl encoding */
+typedef struct wl_ioctl {
+	uint cmd;	/* common ioctl definition */
+	void *buf;	/* pointer to user buffer */
+	uint len;	/* length of user buffer */
+	uint8 set;		/* 1=set IOCTL; 0=query IOCTL */
+	uint used;	/* bytes read or written (optional) */
+	uint needed;	/* bytes needed (optional) */
+} wl_ioctl_t;
+
+#ifdef CONFIG_COMPAT
+typedef struct compat_wl_ioctl {
+	uint cmd;	/* common ioctl definition */
+	uint32 buf;	/* pointer to user buffer */
+	uint len;	/* length of user buffer */
+	uint8 set;		/* 1=set IOCTL; 0=query IOCTL */
+	uint used;	/* bytes read or written (optional) */
+	uint needed;	/* bytes needed (optional) */
+} compat_wl_ioctl_t;
+#endif /* CONFIG_COMPAT */
+
+#define WL_NUM_RATES_CCK			4 /* 1, 2, 5.5, 11 Mbps */
+#define WL_NUM_RATES_OFDM			8 /* 6, 9, 12, 18, 24, 36, 48, 54 Mbps SISO/CDD */
+#define WL_NUM_RATES_MCS_1STREAM	8 /* MCS 0-7 1-stream rates - SISO/CDD/STBC/MCS */
+#define WL_NUM_RATES_EXTRA_VHT		2 /* Additional VHT 11AC rates */
+#define WL_NUM_RATES_VHT			10
+#define WL_NUM_RATES_MCS32			1
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+/*
+ * Structure for passing hardware and software
+ * revision info up from the driver.
+ */
+typedef struct wlc_rev_info {
+	uint		vendorid;	/* PCI vendor id */
+	uint		deviceid;	/* device id of chip */
+	uint		radiorev;	/* radio revision */
+	uint		chiprev;	/* chip revision */
+	uint		corerev;	/* core revision */
+	uint		boardid;	/* board identifier (usu. PCI sub-device id) */
+	uint		boardvendor;	/* board vendor (usu. PCI sub-vendor id) */
+	uint		boardrev;	/* board revision */
+	uint		driverrev;	/* driver version */
+	uint		ucoderev;	/* microcode version */
+	uint		bus;		/* bus type */
+	uint		chipnum;	/* chip number */
+	uint		phytype;	/* phy type */
+	uint		phyrev;		/* phy revision */
+	uint		anarev;		/* anacore rev */
+	uint		chippkg;	/* chip package info */
+	uint		nvramrev;	/* nvram revision number */
+} wlc_rev_info_t;
+
+#define WL_REV_INFO_LEGACY_LENGTH	48
+
+#define WL_BRAND_MAX 10
+typedef struct wl_instance_info {
+	uint instance;
+	char brand[WL_BRAND_MAX];
+} wl_instance_info_t;
+
+/* structure to change size of tx fifo */
+typedef struct wl_txfifo_sz {
+	uint16	magic;
+	uint16	fifo;
+	uint16	size;
+} wl_txfifo_sz_t;
+
+/* Transfer info about an IOVar from the driver */
+/* Max supported IOV name size in bytes, + 1 for nul termination */
+#define WLC_IOV_NAME_LEN 30
+typedef struct wlc_iov_trx_s {
+	uint8 module;
+	uint8 type;
+	char name[WLC_IOV_NAME_LEN];
+} wlc_iov_trx_t;
+
+/* bump this number if you change the ioctl interface */
+#define WLC_IOCTL_VERSION	2
+#define WLC_IOCTL_VERSION_LEGACY_IOTYPES	1
+
+#ifdef CONFIG_USBRNDIS_RETAIL
+/* struct passed in for WLC_NDCONFIG_ITEM */
+typedef struct {
+	char *name;
+	void *param;
+} ndconfig_item_t;
+#endif
+
+
+#define WL_PHY_PAVARS_LEN	32	/* Phy type, Band range, chain, a1[0], b0[0], b1[0] ... */
+
+#define WL_PHY_PAVAR_VER	1	/* pavars version */
+#define WL_PHY_PAVARS2_NUM	3	/* a1, b0, b1 */
+typedef struct wl_pavars2 {
+	uint16 ver;		/* version of this struct */
+	uint16 len;		/* len of this structure */
+	uint16 inuse;		/* driver return 1 for a1,b0,b1 in current band range */
+	uint16 phy_type;	/* phy type */
+	uint16 bandrange;
+	uint16 chain;
+	uint16 inpa[WL_PHY_PAVARS2_NUM];	/* phy pavars for one band range */
+} wl_pavars2_t;
+
+typedef struct wl_po {
+	uint16	phy_type;	/* Phy type */
+	uint16	band;
+	uint16	cckpo;
+	uint32	ofdmpo;
+	uint16	mcspo[8];
+} wl_po_t;
+
+#define WL_NUM_RPCALVARS 5	/* number of rpcal vars */
+
+typedef struct wl_rpcal {
+	uint16 value;
+	uint16 update;
+} wl_rpcal_t;
+
+typedef struct wl_aci_args {
+	int enter_aci_thresh; /* Trigger level to start detecting ACI */
+	int exit_aci_thresh; /* Trigger level to exit ACI mode */
+	int usec_spin; /* microsecs to delay between rssi samples */
+	int glitch_delay; /* interval between ACI scans when glitch count is consistently high */
+	uint16 nphy_adcpwr_enter_thresh;	/* ADC power to enter ACI mitigation mode */
+	uint16 nphy_adcpwr_exit_thresh;	/* ADC power to exit ACI mitigation mode */
+	uint16 nphy_repeat_ctr;		/* Number of tries per channel to compute power */
+	uint16 nphy_num_samples;	/* Number of samples to compute power on one channel */
+	uint16 nphy_undetect_window_sz;	/* num of undetects to exit ACI Mitigation mode */
+	uint16 nphy_b_energy_lo_aci;	/* low ACI power energy threshold for bphy */
+	uint16 nphy_b_energy_md_aci;	/* mid ACI power energy threshold for bphy */
+	uint16 nphy_b_energy_hi_aci;	/* high ACI power energy threshold for bphy */
+	uint16 nphy_noise_noassoc_glitch_th_up; /* wl interference 4 */
+	uint16 nphy_noise_noassoc_glitch_th_dn;
+	uint16 nphy_noise_assoc_glitch_th_up;
+	uint16 nphy_noise_assoc_glitch_th_dn;
+	uint16 nphy_noise_assoc_aci_glitch_th_up;
+	uint16 nphy_noise_assoc_aci_glitch_th_dn;
+	uint16 nphy_noise_assoc_enter_th;
+	uint16 nphy_noise_noassoc_enter_th;
+	uint16 nphy_noise_assoc_rx_glitch_badplcp_enter_th;
+	uint16 nphy_noise_noassoc_crsidx_incr;
+	uint16 nphy_noise_assoc_crsidx_incr;
+	uint16 nphy_noise_crsidx_decr;
+} wl_aci_args_t;
+
+#define WL_ACI_ARGS_LEGACY_LENGTH	16	/* bytes of pre NPHY aci args */
+#define	WL_SAMPLECOLLECT_T_VERSION	2	/* version of wl_samplecollect_args_t struct */
+typedef struct wl_samplecollect_args {
+	/* version 0 fields */
+	uint8 coll_us;
+	int cores;
+	/* add'l version 1 fields */
+	uint16 version;     /* see definition of WL_SAMPLECOLLECT_T_VERSION */
+	uint16 length;      /* length of entire structure */
+	int8 trigger;
+	uint16 timeout;
+	uint16 mode;
+	uint32 pre_dur;
+	uint32 post_dur;
+	uint8 gpio_sel;
+	uint8 downsamp;
+	uint8 be_deaf;
+	uint8 agc;		/* loop from init gain and going down */
+	uint8 filter;		/* override high pass corners to lowest */
+	/* add'l version 2 fields */
+	uint8 trigger_state;
+	uint8 module_sel1;
+	uint8 module_sel2;
+	uint16 nsamps;
+	int bitStart;
+	uint32 gpioCapMask;
+} wl_samplecollect_args_t;
+
+#define	WL_SAMPLEDATA_T_VERSION		1	/* version of wl_samplecollect_args_t struct */
+/* version for unpacked sample data, int16 {(I,Q),Core(0..N)} */
+#define	WL_SAMPLEDATA_T_VERSION_SPEC_AN 2
+
+typedef struct wl_sampledata {
+	uint16 version;	/* structure version */
+	uint16 size;	/* size of structure */
+	uint16 tag;	/* Header/Data */
+	uint16 length;	/* data length */
+	uint32 flag;	/* bit def */
+} wl_sampledata_t;
+
+
+/* WL_OTA START */
+/* OTA Test Status */
+enum {
+	WL_OTA_TEST_IDLE = 0,	/* Default Idle state */
+	WL_OTA_TEST_ACTIVE = 1,	/* Test Running */
+	WL_OTA_TEST_SUCCESS = 2,	/* Successfully Finished Test */
+	WL_OTA_TEST_FAIL = 3	/* Test Failed in the Middle */
+};
+/* OTA SYNC Status */
+enum {
+	WL_OTA_SYNC_IDLE = 0,	/* Idle state */
+	WL_OTA_SYNC_ACTIVE = 1,	/* Waiting for Sync */
+	WL_OTA_SYNC_FAIL = 2	/* Sync pkt not recieved */
+};
+
+/* Various error states dut can get stuck during test */
+enum {
+	WL_OTA_SKIP_TEST_CAL_FAIL = 1,		/* Phy calibration failed */
+	WL_OTA_SKIP_TEST_SYNCH_FAIL = 2,		/* Sync Packet not recieved */
+	WL_OTA_SKIP_TEST_FILE_DWNLD_FAIL = 3,	/* Cmd flow file download failed */
+	WL_OTA_SKIP_TEST_NO_TEST_FOUND = 4,	/* No test found in Flow file */
+	WL_OTA_SKIP_TEST_WL_NOT_UP = 5,		/* WL UP failed */
+	WL_OTA_SKIP_TEST_UNKNOWN_CALL		/* Unintentional scheduling on ota test */
+};
+
+/* Differentiator for ota_tx and ota_rx */
+enum {
+	WL_OTA_TEST_TX = 0,		/* ota_tx */
+	WL_OTA_TEST_RX = 1,		/* ota_rx */
+};
+
+/* Catch 3 modes of operation: 20Mhz, 40Mhz, 20 in 40 Mhz */
+enum {
+	WL_OTA_TEST_BW_20_IN_40MHZ = 0,	/* 20 in 40 operation */
+	WL_OTA_TEST_BW_20MHZ = 1,		/* 20 Mhz operation */
+	WL_OTA_TEST_BW_40MHZ = 2		/* full 40Mhz operation */
+};
+typedef struct ota_rate_info {
+	uint8 rate_cnt;					/* Total number of rates */
+	uint8 rate_val_mbps[WL_OTA_TEST_MAX_NUM_RATE];	/* array of rates from 1mbps to 130mbps */
+							/* for legacy rates : ratein mbps * 2 */
+							/* for HT rates : mcs index */
+} ota_rate_info_t;
+
+typedef struct ota_power_info {
+	int8 pwr_ctrl_on;	/* power control on/off */
+	int8 start_pwr;		/* starting power/index */
+	int8 delta_pwr;		/* delta power/index */
+	int8 end_pwr;		/* end power/index */
+} ota_power_info_t;
+
+typedef struct ota_packetengine {
+	uint16 delay;           /* Inter-packet delay */
+				/* for ota_tx, delay is tx ifs in micro seconds */
+				/* for ota_rx, delay is wait time in milliseconds */
+	uint16 nframes;         /* Number of frames */
+	uint16 length;          /* Packet length */
+} ota_packetengine_t;
+
+/* Test info vector */
+typedef struct wl_ota_test_args {
+	uint8 cur_test;			/* test phase */
+	uint8 chan;			/* channel */
+	uint8 bw;			/* bandwidth */
+	uint8 control_band;		/* control band */
+	uint8 stf_mode;			/* stf mode */
+	ota_rate_info_t rt_info;	/* Rate info */
+	ota_packetengine_t pkteng;	/* packeteng info */
+	uint8 txant;			/* tx antenna */
+	uint8 rxant;			/* rx antenna */
+	ota_power_info_t pwr_info;	/* power sweep info */
+	uint8 wait_for_sync;		/* wait for sync or not */
+} wl_ota_test_args_t;
+
+typedef struct wl_ota_test_vector {
+	wl_ota_test_args_t test_arg[WL_OTA_TEST_MAX_NUM_SEQ];	/* Test argument struct */
+	uint16 test_cnt;					/* Total no of test */
+	uint8 file_dwnld_valid;					/* File successfully downloaded */
+	uint8 sync_timeout;					/* sync packet timeout */
+	int8 sync_fail_action;					/* sync fail action */
+	struct ether_addr sync_mac;				/* macaddress for sync pkt */
+	struct ether_addr tx_mac;				/* macaddress for tx */
+	struct ether_addr rx_mac;				/* macaddress for rx */
+	int8 loop_test;					/* dbg feature to loop the test */
+} wl_ota_test_vector_t;
+
+
+/* struct copied back form dongle to host to query the status */
+typedef struct wl_ota_test_status {
+	int16 cur_test_cnt;		/* test phase */
+	int8 skip_test_reason;		/* skip test reasoin */
+	wl_ota_test_args_t test_arg;	/* cur test arg details */
+	uint16 test_cnt;		/* total no of test downloaded */
+	uint8 file_dwnld_valid;		/* file successfully downloaded ? */
+	uint8 sync_timeout;		/* sync timeout */
+	int8 sync_fail_action;		/* sync fail action */
+	struct ether_addr sync_mac;	/* macaddress for sync pkt */
+	struct ether_addr tx_mac;	/* tx mac address */
+	struct ether_addr rx_mac;	/* rx mac address */
+	uint8  test_stage;		/* check the test status */
+	int8 loop_test;		/* Debug feature to puts test enfine in a loop */
+	uint8 sync_status;		/* sync status */
+} wl_ota_test_status_t;
+
+/* WL_OTA END */
+
+/* wl_radar_args_t */
+typedef struct {
+	int npulses;	/* required number of pulses at n * t_int */
+	int ncontig;	/* required number of pulses at t_int */
+	int min_pw;	/* minimum pulse width (20 MHz clocks) */
+	int max_pw;	/* maximum pulse width (20 MHz clocks) */
+	uint16 thresh0;	/* Radar detection, thresh 0 */
+	uint16 thresh1;	/* Radar detection, thresh 1 */
+	uint16 blank;	/* Radar detection, blank control */
+	uint16 fmdemodcfg;	/* Radar detection, fmdemod config */
+	int npulses_lp;  /* Radar detection, minimum long pulses */
+	int min_pw_lp; /* Minimum pulsewidth for long pulses */
+	int max_pw_lp; /* Maximum pulsewidth for long pulses */
+	int min_fm_lp; /* Minimum fm for long pulses */
+	int max_span_lp;  /* Maximum deltat for long pulses */
+	int min_deltat; /* Minimum spacing between pulses */
+	int max_deltat; /* Maximum spacing between pulses */
+	uint16 autocorr;	/* Radar detection, autocorr on or off */
+	uint16 st_level_time;	/* Radar detection, start_timing level */
+	uint16 t2_min; /* minimum clocks needed to remain in state 2 */
+	uint32 version; /* version */
+	uint32 fra_pulse_err;	/* sample error margin for detecting French radar pulsed */
+	int npulses_fra;  /* Radar detection, minimum French pulses set */
+	int npulses_stg2;  /* Radar detection, minimum staggered-2 pulses set */
+	int npulses_stg3;  /* Radar detection, minimum staggered-3 pulses set */
+	uint16 percal_mask;	/* defines which period cal is masked from radar detection */
+	int quant;	/* quantization resolution to pulse positions */
+	uint32 min_burst_intv_lp;	/* minimum burst to burst interval for bin3 radar */
+	uint32 max_burst_intv_lp;	/* maximum burst to burst interval for bin3 radar */
+	int nskip_rst_lp;	/* number of skipped pulses before resetting lp buffer */
+	int max_pw_tol;	/* maximum tollerance allowed in detected pulse width for radar detection */
+	uint16 feature_mask; /* 16-bit mask to specify enabled features */
+} wl_radar_args_t;
+
+#define WL_RADAR_ARGS_VERSION 2
+
+typedef struct {
+	uint32 version; /* version */
+	uint16 thresh0_20_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 20MHz */
+	uint16 thresh1_20_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 20MHz */
+	uint16 thresh0_40_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 40MHz */
+	uint16 thresh1_40_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 40MHz */
+	uint16 thresh0_80_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 80MHz */
+	uint16 thresh1_80_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 80MHz */
+	uint16 thresh0_20_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 20MHz */
+	uint16 thresh1_20_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 20MHz */
+	uint16 thresh0_40_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 40MHz */
+	uint16 thresh1_40_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 40MHz */
+	uint16 thresh0_80_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 80MHz */
+	uint16 thresh1_80_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 80MHz */
+#ifdef WL11AC160
+	uint16 thresh0_160_lo;	/* Radar detection, thresh 0 (range 5250-5350MHz) for BW 160MHz */
+	uint16 thresh1_160_lo;	/* Radar detection, thresh 1 (range 5250-5350MHz) for BW 160MHz */
+	uint16 thresh0_160_hi;	/* Radar detection, thresh 0 (range 5470-5725MHz) for BW 160MHz */
+	uint16 thresh1_160_hi;	/* Radar detection, thresh 1 (range 5470-5725MHz) for BW 160MHz */
+#endif /* WL11AC160 */
+} wl_radar_thr_t;
+
+#define WL_RADAR_THR_VERSION	2
+
+/* RSSI per antenna */
+typedef struct {
+	uint32	version;		/* version field */
+	uint32	count;			/* number of valid antenna rssi */
+	int8 rssi_ant[WL_RSSI_ANT_MAX];	/* rssi per antenna */
+} wl_rssi_ant_t;
+
+/* data structure used in 'dfs_status' wl interface, which is used to query dfs status */
+typedef struct {
+	uint state;		/* noted by WL_DFS_CACSTATE_XX. */
+	uint duration;		/* time spent in ms in state. */
+	/* as dfs enters ISM state, it removes the operational channel from quiet channel
+	 * list and notes the channel in channel_cleared. set to 0 if no channel is cleared
+	 */
+	chanspec_t chanspec_cleared;
+	/* chanspec cleared used to be a uint, add another to uint16 to maintain size */
+	uint16 pad;
+} wl_dfs_status_t;
+
+/* data structure used in 'radar_status' wl interface, which is use to query radar det status */
+typedef struct {
+	bool detected;
+	int count;
+	bool pretended;
+	uint32 radartype;
+	uint32 timenow;
+	uint32 timefromL;
+	int lp_csect_single;
+	int detected_pulse_index;
+	int nconsecq_pulses;
+	chanspec_t ch;
+	int pw[10];
+	int intv[10];
+	int fm[10];
+} wl_radar_status_t;
+
+#define NUM_PWRCTRL_RATES 12
+
+typedef struct {
+	uint8 txpwr_band_max[NUM_PWRCTRL_RATES];	/* User set target */
+	uint8 txpwr_limit[NUM_PWRCTRL_RATES];		/* reg and local power limit */
+	uint8 txpwr_local_max;				/* local max according to the AP */
+	uint8 txpwr_local_constraint;			/* local constraint according to the AP */
+	uint8 txpwr_chan_reg_max;			/* Regulatory max for this channel */
+	uint8 txpwr_target[2][NUM_PWRCTRL_RATES];	/* Latest target for 2.4 and 5 Ghz */
+	uint8 txpwr_est_Pout[2];			/* Latest estimate for 2.4 and 5 Ghz */
+	uint8 txpwr_opo[NUM_PWRCTRL_RATES];		/* On G phy, OFDM power offset */
+	uint8 txpwr_bphy_cck_max[NUM_PWRCTRL_RATES];	/* Max CCK power for this band (SROM) */
+	uint8 txpwr_bphy_ofdm_max;			/* Max OFDM power for this band (SROM) */
+	uint8 txpwr_aphy_max[NUM_PWRCTRL_RATES];	/* Max power for A band (SROM) */
+	int8  txpwr_antgain[2];				/* Ant gain for each band - from SROM */
+	uint8 txpwr_est_Pout_gofdm;			/* Pwr estimate for 2.4 OFDM */
+} tx_power_legacy_t;
+
+#define WL_TX_POWER_RATES_LEGACY    45
+#define WL_TX_POWER_MCS20_FIRST         12
+#define WL_TX_POWER_MCS20_NUM           16
+#define WL_TX_POWER_MCS40_FIRST         28
+#define WL_TX_POWER_MCS40_NUM           17
+
+typedef struct {
+	uint32 flags;
+	chanspec_t chanspec;                 /* txpwr report for this channel */
+	chanspec_t local_chanspec;           /* channel on which we are associated */
+	uint8 local_max;                 /* local max according to the AP */
+	uint8 local_constraint;              /* local constraint according to the AP */
+	int8  antgain[2];                /* Ant gain for each band - from SROM */
+	uint8 rf_cores;                  /* count of RF Cores being reported */
+	uint8 est_Pout[4];                           /* Latest tx power out estimate per RF
+							  * chain without adjustment
+							  */
+	uint8 est_Pout_cck;                          /* Latest CCK tx power out estimate */
+	uint8 user_limit[WL_TX_POWER_RATES_LEGACY];  /* User limit */
+	uint8 reg_limit[WL_TX_POWER_RATES_LEGACY];   /* Regulatory power limit */
+	uint8 board_limit[WL_TX_POWER_RATES_LEGACY]; /* Max power board can support (SROM) */
+	uint8 target[WL_TX_POWER_RATES_LEGACY];      /* Latest target power */
+} tx_power_legacy2_t;
+
+/* TX Power index defines */
+#define WLC_NUM_RATES_CCK       WL_NUM_RATES_CCK
+#define WLC_NUM_RATES_OFDM      WL_NUM_RATES_OFDM
+#define WLC_NUM_RATES_MCS_1_STREAM  WL_NUM_RATES_MCS_1STREAM
+#define WLC_NUM_RATES_MCS_2_STREAM  WL_NUM_RATES_MCS_1STREAM
+#define WLC_NUM_RATES_MCS32     WL_NUM_RATES_MCS32
+#define WL_TX_POWER_CCK_NUM     WL_NUM_RATES_CCK
+#define WL_TX_POWER_OFDM_NUM        WL_NUM_RATES_OFDM
+#define WL_TX_POWER_MCS_1_STREAM_NUM    WL_NUM_RATES_MCS_1STREAM
+#define WL_TX_POWER_MCS_2_STREAM_NUM    WL_NUM_RATES_MCS_1STREAM
+#define WL_TX_POWER_MCS_32_NUM      WL_NUM_RATES_MCS32
+
+#define WL_NUM_2x2_ELEMENTS		4
+#define WL_NUM_3x3_ELEMENTS		6
+
+typedef struct {
+	uint16 ver;				/* version of this struct */
+	uint16 len;				/* length in bytes of this structure */
+	uint32 flags;
+	chanspec_t chanspec;			/* txpwr report for this channel */
+	chanspec_t local_chanspec;		/* channel on which we are associated */
+	uint32     buflen;			/* ppr buffer length */
+	uint8      pprbuf[1];			/* Latest target power buffer */
+} wl_txppr_t;
+
+#define WL_TXPPR_VERSION	1
+#define WL_TXPPR_LENGTH	(sizeof(wl_txppr_t))
+#define TX_POWER_T_VERSION	45
+/* number of ppr serialization buffers, it should be reg, board and target */
+#define WL_TXPPR_SER_BUF_NUM	(3)
+
+typedef struct chanspec_txpwr_max {
+	chanspec_t chanspec;   /* chanspec */
+	uint8 txpwr_max;       /* max txpwr in all the rates */
+	uint8 padding;
+} chanspec_txpwr_max_t;
+
+typedef struct  wl_chanspec_txpwr_max {
+	uint16 ver;			/* version of this struct */
+	uint16 len;			/* length in bytes of this structure */
+	uint32 count;		/* number of elements of (chanspec, txpwr_max) pair */
+	chanspec_txpwr_max_t txpwr[1];	/* array of (chanspec, max_txpwr) pair */
+} wl_chanspec_txpwr_max_t;
+
+#define WL_CHANSPEC_TXPWR_MAX_VER	1
+#define WL_CHANSPEC_TXPWR_MAX_LEN	(sizeof(wl_chanspec_txpwr_max_t))
+
+typedef struct tx_inst_power {
+	uint8 txpwr_est_Pout[2];			/* Latest estimate for 2.4 and 5 Ghz */
+	uint8 txpwr_est_Pout_gofdm;			/* Pwr estimate for 2.4 OFDM */
+} tx_inst_power_t;
+
+#define WL_NUM_TXCHAIN_MAX	4
+typedef struct wl_txchain_pwr_offsets {
+	int8 offset[WL_NUM_TXCHAIN_MAX];	/* quarter dBm signed offset for each chain */
+} wl_txchain_pwr_offsets_t;
+/* maximum channels returned by the get valid channels iovar */
+#define WL_NUMCHANNELS		64
+
+/*
+ * Join preference iovar value is an array of tuples. Each tuple has a one-byte type,
+ * a one-byte length, and a variable length value.  RSSI type tuple must be present
+ * in the array.
+ *
+ * Types are defined in "join preference types" section.
+ *
+ * Length is the value size in octets. It is reserved for WL_JOIN_PREF_WPA type tuple
+ * and must be set to zero.
+ *
+ * Values are defined below.
+ *
+ * 1. RSSI - 2 octets
+ * offset 0: reserved
+ * offset 1: reserved
+ *
+ * 2. WPA - 2 + 12 * n octets (n is # tuples defined below)
+ * offset 0: reserved
+ * offset 1: # of tuples
+ * offset 2: tuple 1
+ * offset 14: tuple 2
+ * ...
+ * offset 2 + 12 * (n - 1) octets: tuple n
+ *
+ * struct wpa_cfg_tuple {
+ *   uint8 akm[DOT11_OUI_LEN+1];     akm suite
+ *   uint8 ucipher[DOT11_OUI_LEN+1]; unicast cipher suite
+ *   uint8 mcipher[DOT11_OUI_LEN+1]; multicast cipher suite
+ * };
+ *
+ * multicast cipher suite can be specified as a specific cipher suite or WL_WPA_ACP_MCS_ANY.
+ *
+ * 3. BAND - 2 octets
+ * offset 0: reserved
+ * offset 1: see "band preference" and "band types"
+ *
+ * 4. BAND RSSI - 2 octets
+ * offset 0: band types
+ * offset 1: +ve RSSI boost value in dB
+ */
+
+struct tsinfo_arg {
+	uint8 octets[3];
+};
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define RATE_CCK_1MBPS 0
+#define RATE_CCK_2MBPS 1
+#define RATE_CCK_5_5MBPS 2
+#define RATE_CCK_11MBPS 3
+
+#define RATE_LEGACY_OFDM_6MBPS 0
+#define RATE_LEGACY_OFDM_9MBPS 1
+#define RATE_LEGACY_OFDM_12MBPS 2
+#define RATE_LEGACY_OFDM_18MBPS 3
+#define RATE_LEGACY_OFDM_24MBPS 4
+#define RATE_LEGACY_OFDM_36MBPS 5
+#define RATE_LEGACY_OFDM_48MBPS 6
+#define RATE_LEGACY_OFDM_54MBPS 7
+
+#define WL_BSSTRANS_RSSI_RATE_MAP_VERSION 1
+
+typedef struct wl_bsstrans_rssi {
+	int8 rssi_2g;	/* RSSI in dbm for 2.4 G */
+	int8 rssi_5g;	/* RSSI in dbm for 5G, unused for cck */
+} wl_bsstrans_rssi_t;
+
+#define RSSI_RATE_MAP_MAX_STREAMS 4	/* max streams supported */
+
+/* RSSI to rate mapping, all 20Mhz, no SGI */
+typedef struct wl_bsstrans_rssi_rate_map {
+	uint16 ver;
+	uint16 len; /* length of entire structure */
+	wl_bsstrans_rssi_t cck[WL_NUM_RATES_CCK]; /* 2.4G only */
+	wl_bsstrans_rssi_t ofdm[WL_NUM_RATES_OFDM]; /* 6 to 54mbps */
+	wl_bsstrans_rssi_t phy_n[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_MCS_1STREAM]; /* MCS0-7 */
+	wl_bsstrans_rssi_t phy_ac[RSSI_RATE_MAP_MAX_STREAMS][WL_NUM_RATES_VHT]; /* MCS0-9 */
+} wl_bsstrans_rssi_rate_map_t;
+
+#define WL_BSSTRANS_ROAMTHROTTLE_VERSION 1
+
+/* Configure number of scans allowed per throttle period */
+typedef struct wl_bsstrans_roamthrottle {
+	uint16 ver;
+	uint16 period;
+	uint16 scans_allowed;
+} wl_bsstrans_roamthrottle_t;
+
+#define	NFIFO			6	/* # tx/rx fifopairs */
+#define NREINITREASONCOUNT	8
+#define REINITREASONIDX(_x)	(((_x) < NREINITREASONCOUNT) ? (_x) : 0)
+
+#define	WL_CNT_T_VERSION	10	/* current version of wl_cnt_t struct */
+
+typedef struct {
+	uint16	version;	/* see definition of WL_CNT_T_VERSION */
+	uint16	length;		/* length of entire structure */
+
+	/* transmit stat counters */
+	uint32	txframe;	/* tx data frames */
+	uint32	txbyte;		/* tx data bytes */
+	uint32	txretrans;	/* tx mac retransmits */
+	uint32	txerror;	/* tx data errors (derived: sum of others) */
+	uint32	txctl;		/* tx management frames */
+	uint32	txprshort;	/* tx short preamble frames */
+	uint32	txserr;		/* tx status errors */
+	uint32	txnobuf;	/* tx out of buffers errors */
+	uint32	txnoassoc;	/* tx discard because we're not associated */
+	uint32	txrunt;		/* tx runt frames */
+	uint32	txchit;		/* tx header cache hit (fastpath) */
+	uint32	txcmiss;	/* tx header cache miss (slowpath) */
+
+	/* transmit chip error counters */
+	uint32	txuflo;		/* tx fifo underflows */
+	uint32	txphyerr;	/* tx phy errors (indicated in tx status) */
+	uint32	txphycrs;
+
+	/* receive stat counters */
+	uint32	rxframe;	/* rx data frames */
+	uint32	rxbyte;		/* rx data bytes */
+	uint32	rxerror;	/* rx data errors (derived: sum of others) */
+	uint32	rxctl;		/* rx management frames */
+	uint32	rxnobuf;	/* rx out of buffers errors */
+	uint32	rxnondata;	/* rx non data frames in the data channel errors */
+	uint32	rxbadds;	/* rx bad DS errors */
+	uint32	rxbadcm;	/* rx bad control or management frames */
+	uint32	rxfragerr;	/* rx fragmentation errors */
+	uint32	rxrunt;		/* rx runt frames */
+	uint32	rxgiant;	/* rx giant frames */
+	uint32	rxnoscb;	/* rx no scb error */
+	uint32	rxbadproto;	/* rx invalid frames */
+	uint32	rxbadsrcmac;	/* rx frames with Invalid Src Mac */
+	uint32	rxbadda;	/* rx frames tossed for invalid da */
+	uint32	rxfilter;	/* rx frames filtered out */
+
+	/* receive chip error counters */
+	uint32	rxoflo;		/* rx fifo overflow errors */
+	uint32	rxuflo[NFIFO];	/* rx dma descriptor underflow errors */
+
+	uint32	d11cnt_txrts_off;	/* d11cnt txrts value when reset d11cnt */
+	uint32	d11cnt_rxcrc_off;	/* d11cnt rxcrc value when reset d11cnt */
+	uint32	d11cnt_txnocts_off;	/* d11cnt txnocts value when reset d11cnt */
+
+	/* misc counters */
+	uint32	dmade;		/* tx/rx dma descriptor errors */
+	uint32	dmada;		/* tx/rx dma data errors */
+	uint32	dmape;		/* tx/rx dma descriptor protocol errors */
+	uint32	reset;		/* reset count */
+	uint32	tbtt;		/* cnts the TBTT int's */
+	uint32	txdmawar;
+	uint32	pkt_callback_reg_fail;	/* callbacks register failure */
+
+	/* MAC counters: 32-bit version of d11.h's macstat_t */
+	uint32	txallfrm;	/* total number of frames sent, incl. Data, ACK, RTS, CTS,
+				 * Control Management (includes retransmissions)
+				 */
+	uint32	txrtsfrm;	/* number of RTS sent out by the MAC */
+	uint32	txctsfrm;	/* number of CTS sent out by the MAC */
+	uint32	txackfrm;	/* number of ACK frames sent out */
+	uint32	txdnlfrm;	/* Not used */
+	uint32	txbcnfrm;	/* beacons transmitted */
+	uint32	txfunfl[6];	/* per-fifo tx underflows */
+	uint32	rxtoolate;	/* receive too late */
+	uint32  txfbw;		/* transmit at fallback bw (dynamic bw) */
+	uint32	txtplunfl;	/* Template underflows (mac was too slow to transmit ACK/CTS
+				 * or BCN)
+				 */
+	uint32	txphyerror;	/* Transmit phy error, type of error is reported in tx-status for
+				 * driver enqueued frames
+				 */
+	uint32	rxfrmtoolong;	/* Received frame longer than legal limit (2346 bytes) */
+	uint32	rxfrmtooshrt;	/* Received frame did not contain enough bytes for its frame type */
+	uint32	rxinvmachdr;	/* Either the protocol version != 0 or frame type not
+				 * data/control/management
+				 */
+	uint32	rxbadfcs;	/* number of frames for which the CRC check failed in the MAC */
+	uint32	rxbadplcp;	/* parity check of the PLCP header failed */
+	uint32	rxcrsglitch;	/* PHY was able to correlate the preamble but not the header */
+	uint32	rxstrt;		/* Number of received frames with a good PLCP
+				 * (i.e. passing parity check)
+				 */
+	uint32	rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+	uint32	rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+	uint32	rxcfrmucast;	/* number of received CNTRL frames with good FCS and matching RA */
+	uint32	rxrtsucast;	/* number of unicast RTS addressed to the MAC (good FCS) */
+	uint32	rxctsucast;	/* number of unicast CTS addressed to the MAC (good FCS) */
+	uint32	rxackucast;	/* number of ucast ACKS received (good FCS) */
+	uint32	rxdfrmocast;	/* number of received DATA frames (good FCS and not matching RA) */
+	uint32	rxmfrmocast;	/* number of received MGMT frames (good FCS and not matching RA) */
+	uint32	rxcfrmocast;	/* number of received CNTRL frame (good FCS and not matching RA) */
+	uint32	rxrtsocast;	/* number of received RTS not addressed to the MAC */
+	uint32	rxctsocast;	/* number of received CTS not addressed to the MAC */
+	uint32	rxdfrmmcast;	/* number of RX Data multicast frames received by the MAC */
+	uint32	rxmfrmmcast;	/* number of RX Management multicast frames received by the MAC */
+	uint32	rxcfrmmcast;	/* number of RX Control multicast frames received by the MAC
+				 * (unlikely to see these)
+				 */
+	uint32	rxbeaconmbss;	/* beacons received from member of BSS */
+	uint32	rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+				  * other BSS (WDS FRAME)
+				  */
+	uint32	rxbeaconobss;	/* beacons received from other BSS */
+	uint32	rxrsptmout;	/* Number of response timeouts for transmitted frames
+				 * expecting a response
+				 */
+	uint32	bcntxcancl;	/* transmit beacons canceled due to receipt of beacon (IBSS) */
+	uint32	rxf0ovfl;	/* Number of receive fifo 0 overflows */
+	uint32	rxf1ovfl;	/* Number of receive fifo 1 overflows (obsolete) */
+	uint32	rxf2ovfl;	/* Number of receive fifo 2 overflows (obsolete) */
+	uint32	txsfovfl;	/* Number of transmit status fifo overflows (obsolete) */
+	uint32	pmqovfl;	/* Number of PMQ overflows */
+	uint32	rxcgprqfrm;	/* Number of received Probe requests that made it into
+				 * the PRQ fifo
+				 */
+	uint32	rxcgprsqovfl;	/* Rx Probe Request Que overflow in the AP */
+	uint32	txcgprsfail;	/* Tx Probe Response Fail. AP sent probe response but did
+				 * not get ACK
+				 */
+	uint32	txcgprssuc;	/* Tx Probe Response Success (ACK was received) */
+	uint32	prs_timeout;	/* Number of probe requests that were dropped from the PRQ
+				 * fifo because a probe response could not be sent out within
+				 * the time limit defined in M_PRS_MAXTIME
+				 */
+	uint32	rxnack;		/* obsolete */
+	uint32	frmscons;	/* obsolete */
+	uint32  txnack;		/* obsolete */
+	uint32	rxback;		/* blockack rxcnt */
+	uint32	txback;		/* blockack txcnt */
+
+	/* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+	uint32	txfrag;		/* dot11TransmittedFragmentCount */
+	uint32	txmulti;	/* dot11MulticastTransmittedFrameCount */
+	uint32	txfail;		/* dot11FailedCount */
+	uint32	txretry;	/* dot11RetryCount */
+	uint32	txretrie;	/* dot11MultipleRetryCount */
+	uint32	rxdup;		/* dot11FrameduplicateCount */
+	uint32	txrts;		/* dot11RTSSuccessCount */
+	uint32	txnocts;	/* dot11RTSFailureCount */
+	uint32	txnoack;	/* dot11ACKFailureCount */
+	uint32	rxfrag;		/* dot11ReceivedFragmentCount */
+	uint32	rxmulti;	/* dot11MulticastReceivedFrameCount */
+	uint32	rxcrc;		/* dot11FCSErrorCount */
+	uint32	txfrmsnt;	/* dot11TransmittedFrameCount (bogus MIB?) */
+	uint32	rxundec;	/* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32	tkipmicfaill;	/* TKIPLocalMICFailures */
+	uint32	tkipcntrmsr;	/* TKIPCounterMeasuresInvoked */
+	uint32	tkipreplay;	/* TKIPReplays */
+	uint32	ccmpfmterr;	/* CCMPFormatErrors */
+	uint32	ccmpreplay;	/* CCMPReplays */
+	uint32	ccmpundec;	/* CCMPDecryptErrors */
+	uint32	fourwayfail;	/* FourWayHandshakeFailures */
+	uint32	wepundec;	/* dot11WEPUndecryptableCount */
+	uint32	wepicverr;	/* dot11WEPICVErrorCount */
+	uint32	decsuccess;	/* DecryptSuccessCount */
+	uint32	tkipicverr;	/* TKIPICVErrorCount */
+	uint32	wepexcluded;	/* dot11WEPExcludedCount */
+
+	uint32	txchanrej;	/* Tx frames suppressed due to channel rejection */
+	uint32	psmwds;		/* Count PSM watchdogs */
+	uint32	phywatchdog;	/* Count Phy watchdogs (triggered by ucode) */
+
+	/* MBSS counters, AP only */
+	uint32	prq_entries_handled;	/* PRQ entries read in */
+	uint32	prq_undirected_entries;	/*    which were bcast bss & ssid */
+	uint32	prq_bad_entries;	/*    which could not be translated to info */
+	uint32	atim_suppress_count;	/* TX suppressions on ATIM fifo */
+	uint32	bcn_template_not_ready;	/* Template marked in use on send bcn ... */
+	uint32	bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+	uint32	late_tbtt_dpc;	/* TBTT DPC did not happen in time */
+
+	/* per-rate receive stat counters */
+	uint32  rx1mbps;	/* packets rx at 1Mbps */
+	uint32  rx2mbps;	/* packets rx at 2Mbps */
+	uint32  rx5mbps5;	/* packets rx at 5.5Mbps */
+	uint32  rx6mbps;	/* packets rx at 6Mbps */
+	uint32  rx9mbps;	/* packets rx at 9Mbps */
+	uint32  rx11mbps;	/* packets rx at 11Mbps */
+	uint32  rx12mbps;	/* packets rx at 12Mbps */
+	uint32  rx18mbps;	/* packets rx at 18Mbps */
+	uint32  rx24mbps;	/* packets rx at 24Mbps */
+	uint32  rx36mbps;	/* packets rx at 36Mbps */
+	uint32  rx48mbps;	/* packets rx at 48Mbps */
+	uint32  rx54mbps;	/* packets rx at 54Mbps */
+	uint32  rx108mbps;	/* packets rx at 108mbps */
+	uint32  rx162mbps;	/* packets rx at 162mbps */
+	uint32  rx216mbps;	/* packets rx at 216 mbps */
+	uint32  rx270mbps;	/* packets rx at 270 mbps */
+	uint32  rx324mbps;	/* packets rx at 324 mbps */
+	uint32  rx378mbps;	/* packets rx at 378 mbps */
+	uint32  rx432mbps;	/* packets rx at 432 mbps */
+	uint32  rx486mbps;	/* packets rx at 486 mbps */
+	uint32  rx540mbps;	/* packets rx at 540 mbps */
+
+	/* pkteng rx frame stats */
+	uint32	pktengrxducast; /* unicast frames rxed by the pkteng code */
+	uint32	pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+	uint32	rfdisable;	/* count of radio disables */
+	uint32	bphy_rxcrsglitch;	/* PHY count of bphy glitches */
+	uint32  bphy_badplcp;
+
+	uint32	txexptime;	/* Tx frames suppressed due to timer expiration */
+
+	uint32	txmpdu_sgi;	/* count for sgi transmit */
+	uint32	rxmpdu_sgi;	/* count for sgi received */
+	uint32	txmpdu_stbc;	/* count for stbc transmit */
+	uint32	rxmpdu_stbc;	/* count for stbc received */
+
+	uint32	rxundec_mcst;	/* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32	tkipmicfaill_mcst;	/* TKIPLocalMICFailures */
+	uint32	tkipcntrmsr_mcst;	/* TKIPCounterMeasuresInvoked */
+	uint32	tkipreplay_mcst;	/* TKIPReplays */
+	uint32	ccmpfmterr_mcst;	/* CCMPFormatErrors */
+	uint32	ccmpreplay_mcst;	/* CCMPReplays */
+	uint32	ccmpundec_mcst;	/* CCMPDecryptErrors */
+	uint32	fourwayfail_mcst;	/* FourWayHandshakeFailures */
+	uint32	wepundec_mcst;	/* dot11WEPUndecryptableCount */
+	uint32	wepicverr_mcst;	/* dot11WEPICVErrorCount */
+	uint32	decsuccess_mcst;	/* DecryptSuccessCount */
+	uint32	tkipicverr_mcst;	/* TKIPICVErrorCount */
+	uint32	wepexcluded_mcst;	/* dot11WEPExcludedCount */
+
+	uint32	dma_hang;	/* count for dma hang */
+	uint32	reinit;		/* count for reinit */
+
+	uint32  pstatxucast;	/* count of ucast frames xmitted on all psta assoc */
+	uint32  pstatxnoassoc;	/* count of txnoassoc frames xmitted on all psta assoc */
+	uint32  pstarxucast;	/* count of ucast frames received on all psta assoc */
+	uint32  pstarxbcmc;	/* count of bcmc frames received on all psta */
+	uint32  pstatxbcmc;	/* count of bcmc frames transmitted on all psta */
+
+	uint32  cso_passthrough; /* hw cso required but passthrough */
+	uint32	cso_normal;	/* hw cso hdr for normal process */
+	uint32	chained;	/* number of frames chained */
+	uint32	chainedsz1;	/* number of chain size 1 frames */
+	uint32	unchained;	/* number of frames not chained */
+	uint32	maxchainsz;	/* max chain size so far */
+	uint32	currchainsz;	/* current chain size */
+	uint32	rxdrop20s;	/* drop secondary cnt */
+	uint32	pciereset;	/* Secondary Bus Reset issued by driver */
+	uint32	cfgrestore;	/* configspace restore by driver */
+	uint32	reinitreason[NREINITREASONCOUNT]; /* reinitreason counters; 0: Unknown reason */
+} wl_cnt_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+typedef struct {
+	uint16  version;    /* see definition of WL_CNT_T_VERSION */
+	uint16  length;     /* length of entire structure */
+
+	/* transmit stat counters */
+	uint32  txframe;    /* tx data frames */
+	uint32  txbyte;     /* tx data bytes */
+	uint32  txretrans;  /* tx mac retransmits */
+	uint32  txerror;    /* tx data errors (derived: sum of others) */
+	uint32  txctl;      /* tx management frames */
+	uint32  txprshort;  /* tx short preamble frames */
+	uint32  txserr;     /* tx status errors */
+	uint32  txnobuf;    /* tx out of buffers errors */
+	uint32  txnoassoc;  /* tx discard because we're not associated */
+	uint32  txrunt;     /* tx runt frames */
+	uint32  txchit;     /* tx header cache hit (fastpath) */
+	uint32  txcmiss;    /* tx header cache miss (slowpath) */
+
+	/* transmit chip error counters */
+	uint32  txuflo;     /* tx fifo underflows */
+	uint32  txphyerr;   /* tx phy errors (indicated in tx status) */
+	uint32  txphycrs;
+
+	/* receive stat counters */
+	uint32  rxframe;    /* rx data frames */
+	uint32  rxbyte;     /* rx data bytes */
+	uint32  rxerror;    /* rx data errors (derived: sum of others) */
+	uint32  rxctl;      /* rx management frames */
+	uint32  rxnobuf;    /* rx out of buffers errors */
+	uint32  rxnondata;  /* rx non data frames in the data channel errors */
+	uint32  rxbadds;    /* rx bad DS errors */
+	uint32  rxbadcm;    /* rx bad control or management frames */
+	uint32  rxfragerr;  /* rx fragmentation errors */
+	uint32  rxrunt;     /* rx runt frames */
+	uint32  rxgiant;    /* rx giant frames */
+	uint32  rxnoscb;    /* rx no scb error */
+	uint32  rxbadproto; /* rx invalid frames */
+	uint32  rxbadsrcmac;    /* rx frames with Invalid Src Mac */
+	uint32  rxbadda;    /* rx frames tossed for invalid da */
+	uint32  rxfilter;   /* rx frames filtered out */
+
+	/* receive chip error counters */
+	uint32  rxoflo;     /* rx fifo overflow errors */
+	uint32  rxuflo[NFIFO];  /* rx dma descriptor underflow errors */
+
+	uint32  d11cnt_txrts_off;   /* d11cnt txrts value when reset d11cnt */
+	uint32  d11cnt_rxcrc_off;   /* d11cnt rxcrc value when reset d11cnt */
+	uint32  d11cnt_txnocts_off; /* d11cnt txnocts value when reset d11cnt */
+
+	/* misc counters */
+	uint32  dmade;      /* tx/rx dma descriptor errors */
+	uint32  dmada;      /* tx/rx dma data errors */
+	uint32  dmape;      /* tx/rx dma descriptor protocol errors */
+	uint32  reset;      /* reset count */
+	uint32  tbtt;       /* cnts the TBTT int's */
+	uint32  txdmawar;
+	uint32  pkt_callback_reg_fail;  /* callbacks register failure */
+
+	/* MAC counters: 32-bit version of d11.h's macstat_t */
+	uint32  txallfrm;   /* total number of frames sent, incl. Data, ACK, RTS, CTS,
+			     * Control Management (includes retransmissions)
+			     */
+	uint32  txrtsfrm;   /* number of RTS sent out by the MAC */
+	uint32  txctsfrm;   /* number of CTS sent out by the MAC */
+	uint32  txackfrm;   /* number of ACK frames sent out */
+	uint32  txdnlfrm;   /* Not used */
+	uint32  txbcnfrm;   /* beacons transmitted */
+	uint32  txfunfl[6]; /* per-fifo tx underflows */
+	uint32	rxtoolate;	/* receive too late */
+	uint32  txfbw;	    /* transmit at fallback bw (dynamic bw) */
+	uint32  txtplunfl;  /* Template underflows (mac was too slow to transmit ACK/CTS
+			     * or BCN)
+			     */
+	uint32  txphyerror; /* Transmit phy error, type of error is reported in tx-status for
+			     * driver enqueued frames
+			     */
+	uint32  rxfrmtoolong;   /* Received frame longer than legal limit (2346 bytes) */
+	uint32  rxfrmtooshrt;   /* Received frame did not contain enough bytes for its frame type */
+	uint32  rxinvmachdr;    /* Either the protocol version != 0 or frame type not
+				 * data/control/management
+			   */
+	uint32  rxbadfcs;   /* number of frames for which the CRC check failed in the MAC */
+	uint32  rxbadplcp;  /* parity check of the PLCP header failed */
+	uint32  rxcrsglitch;    /* PHY was able to correlate the preamble but not the header */
+	uint32  rxstrt;     /* Number of received frames with a good PLCP
+			     * (i.e. passing parity check)
+			     */
+	uint32  rxdfrmucastmbss; /* Number of received DATA frames with good FCS and matching RA */
+	uint32  rxmfrmucastmbss; /* number of received mgmt frames with good FCS and matching RA */
+	uint32  rxcfrmucast;    /* number of received CNTRL frames with good FCS and matching RA */
+	uint32  rxrtsucast; /* number of unicast RTS addressed to the MAC (good FCS) */
+	uint32  rxctsucast; /* number of unicast CTS addressed to the MAC (good FCS) */
+	uint32  rxackucast; /* number of ucast ACKS received (good FCS) */
+	uint32  rxdfrmocast;    /* number of received DATA frames (good FCS and not matching RA) */
+	uint32  rxmfrmocast;    /* number of received MGMT frames (good FCS and not matching RA) */
+	uint32  rxcfrmocast;    /* number of received CNTRL frame (good FCS and not matching RA) */
+	uint32  rxrtsocast; /* number of received RTS not addressed to the MAC */
+	uint32  rxctsocast; /* number of received CTS not addressed to the MAC */
+	uint32  rxdfrmmcast;    /* number of RX Data multicast frames received by the MAC */
+	uint32  rxmfrmmcast;    /* number of RX Management multicast frames received by the MAC */
+	uint32  rxcfrmmcast;    /* number of RX Control multicast frames received by the MAC
+				 * (unlikely to see these)
+				 */
+	uint32  rxbeaconmbss;   /* beacons received from member of BSS */
+	uint32  rxdfrmucastobss; /* number of unicast frames addressed to the MAC from
+				  * other BSS (WDS FRAME)
+				  */
+	uint32  rxbeaconobss;   /* beacons received from other BSS */
+	uint32  rxrsptmout; /* Number of response timeouts for transmitted frames
+			     * expecting a response
+			     */
+	uint32  bcntxcancl; /* transmit beacons canceled due to receipt of beacon (IBSS) */
+	uint32  rxf0ovfl;   /* Number of receive fifo 0 overflows */
+	uint32  rxf1ovfl;   /* Number of receive fifo 1 overflows (obsolete) */
+	uint32  rxf2ovfl;   /* Number of receive fifo 2 overflows (obsolete) */
+	uint32  txsfovfl;   /* Number of transmit status fifo overflows (obsolete) */
+	uint32  pmqovfl;    /* Number of PMQ overflows */
+	uint32  rxcgprqfrm; /* Number of received Probe requests that made it into
+			     * the PRQ fifo
+			     */
+	uint32  rxcgprsqovfl;   /* Rx Probe Request Que overflow in the AP */
+	uint32  txcgprsfail;    /* Tx Probe Response Fail. AP sent probe response but did
+				 * not get ACK
+				 */
+	uint32  txcgprssuc; /* Tx Probe Response Success (ACK was received) */
+	uint32  prs_timeout;    /* Number of probe requests that were dropped from the PRQ
+				 * fifo because a probe response could not be sent out within
+				 * the time limit defined in M_PRS_MAXTIME
+				 */
+	uint32  rxnack;
+	uint32  frmscons;
+	uint32  txnack;		/* obsolete */
+	uint32	rxback;		/* blockack rxcnt */
+	uint32	txback;		/* blockack txcnt */
+
+	/* 802.11 MIB counters, pp. 614 of 802.11 reaff doc. */
+	uint32  txfrag;     /* dot11TransmittedFragmentCount */
+	uint32  txmulti;    /* dot11MulticastTransmittedFrameCount */
+	uint32  txfail;     /* dot11FailedCount */
+	uint32  txretry;    /* dot11RetryCount */
+	uint32  txretrie;   /* dot11MultipleRetryCount */
+	uint32  rxdup;      /* dot11FrameduplicateCount */
+	uint32  txrts;      /* dot11RTSSuccessCount */
+	uint32  txnocts;    /* dot11RTSFailureCount */
+	uint32  txnoack;    /* dot11ACKFailureCount */
+	uint32  rxfrag;     /* dot11ReceivedFragmentCount */
+	uint32  rxmulti;    /* dot11MulticastReceivedFrameCount */
+	uint32  rxcrc;      /* dot11FCSErrorCount */
+	uint32  txfrmsnt;   /* dot11TransmittedFrameCount (bogus MIB?) */
+	uint32  rxundec;    /* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32  tkipmicfaill;   /* TKIPLocalMICFailures */
+	uint32  tkipcntrmsr;    /* TKIPCounterMeasuresInvoked */
+	uint32  tkipreplay; /* TKIPReplays */
+	uint32  ccmpfmterr; /* CCMPFormatErrors */
+	uint32  ccmpreplay; /* CCMPReplays */
+	uint32  ccmpundec;  /* CCMPDecryptErrors */
+	uint32  fourwayfail;    /* FourWayHandshakeFailures */
+	uint32  wepundec;   /* dot11WEPUndecryptableCount */
+	uint32  wepicverr;  /* dot11WEPICVErrorCount */
+	uint32  decsuccess; /* DecryptSuccessCount */
+	uint32  tkipicverr; /* TKIPICVErrorCount */
+	uint32  wepexcluded;    /* dot11WEPExcludedCount */
+
+	uint32  rxundec_mcst;   /* dot11WEPUndecryptableCount */
+
+	/* WPA2 counters (see rxundec for DecryptFailureCount) */
+	uint32  tkipmicfaill_mcst;  /* TKIPLocalMICFailures */
+	uint32  tkipcntrmsr_mcst;   /* TKIPCounterMeasuresInvoked */
+	uint32  tkipreplay_mcst;    /* TKIPReplays */
+	uint32  ccmpfmterr_mcst;    /* CCMPFormatErrors */
+	uint32  ccmpreplay_mcst;    /* CCMPReplays */
+	uint32  ccmpundec_mcst; /* CCMPDecryptErrors */
+	uint32  fourwayfail_mcst;   /* FourWayHandshakeFailures */
+	uint32  wepundec_mcst;  /* dot11WEPUndecryptableCount */
+	uint32  wepicverr_mcst; /* dot11WEPICVErrorCount */
+	uint32  decsuccess_mcst;    /* DecryptSuccessCount */
+	uint32  tkipicverr_mcst;    /* TKIPICVErrorCount */
+	uint32  wepexcluded_mcst;   /* dot11WEPExcludedCount */
+
+	uint32  txchanrej;  /* Tx frames suppressed due to channel rejection */
+	uint32  txexptime;  /* Tx frames suppressed due to timer expiration */
+	uint32  psmwds;     /* Count PSM watchdogs */
+	uint32  phywatchdog;    /* Count Phy watchdogs (triggered by ucode) */
+
+	/* MBSS counters, AP only */
+	uint32  prq_entries_handled;    /* PRQ entries read in */
+	uint32  prq_undirected_entries; /*    which were bcast bss & ssid */
+	uint32  prq_bad_entries;    /*    which could not be translated to info */
+	uint32  atim_suppress_count;    /* TX suppressions on ATIM fifo */
+	uint32  bcn_template_not_ready; /* Template marked in use on send bcn ... */
+	uint32  bcn_template_not_ready_done; /* ...but "DMA done" interrupt rcvd */
+	uint32  late_tbtt_dpc;  /* TBTT DPC did not happen in time */
+
+	/* per-rate receive stat counters */
+	uint32  rx1mbps;    /* packets rx at 1Mbps */
+	uint32  rx2mbps;    /* packets rx at 2Mbps */
+	uint32  rx5mbps5;   /* packets rx at 5.5Mbps */
+	uint32  rx6mbps;    /* packets rx at 6Mbps */
+	uint32  rx9mbps;    /* packets rx at 9Mbps */
+	uint32  rx11mbps;   /* packets rx at 11Mbps */
+	uint32  rx12mbps;   /* packets rx at 12Mbps */
+	uint32  rx18mbps;   /* packets rx at 18Mbps */
+	uint32  rx24mbps;   /* packets rx at 24Mbps */
+	uint32  rx36mbps;   /* packets rx at 36Mbps */
+	uint32  rx48mbps;   /* packets rx at 48Mbps */
+	uint32  rx54mbps;   /* packets rx at 54Mbps */
+	uint32  rx108mbps;  /* packets rx at 108mbps */
+	uint32  rx162mbps;  /* packets rx at 162mbps */
+	uint32  rx216mbps;  /* packets rx at 216 mbps */
+	uint32  rx270mbps;  /* packets rx at 270 mbps */
+	uint32  rx324mbps;  /* packets rx at 324 mbps */
+	uint32  rx378mbps;  /* packets rx at 378 mbps */
+	uint32  rx432mbps;  /* packets rx at 432 mbps */
+	uint32  rx486mbps;  /* packets rx at 486 mbps */
+	uint32  rx540mbps;  /* packets rx at 540 mbps */
+
+	/* pkteng rx frame stats */
+	uint32  pktengrxducast; /* unicast frames rxed by the pkteng code */
+	uint32  pktengrxdmcast; /* multicast frames rxed by the pkteng code */
+
+	uint32  rfdisable;  /* count of radio disables */
+	uint32  bphy_rxcrsglitch;   /* PHY count of bphy glitches */
+	uint32  bphy_badplcp;
+
+	uint32  txmpdu_sgi; /* count for sgi transmit */
+	uint32  rxmpdu_sgi; /* count for sgi received */
+	uint32  txmpdu_stbc;    /* count for stbc transmit */
+	uint32  rxmpdu_stbc;    /* count for stbc received */
+
+	uint32	rxdrop20s;	/* drop secondary cnt */
+
+} wl_cnt_ver_six_t;
+
+#define	WL_DELTA_STATS_T_VERSION	2	/* current version of wl_delta_stats_t struct */
+
+typedef struct {
+	uint16 version;     /* see definition of WL_DELTA_STATS_T_VERSION */
+	uint16 length;      /* length of entire structure */
+
+	/* transmit stat counters */
+	uint32 txframe;     /* tx data frames */
+	uint32 txbyte;      /* tx data bytes */
+	uint32 txretrans;   /* tx mac retransmits */
+	uint32 txfail;      /* tx failures */
+
+	/* receive stat counters */
+	uint32 rxframe;     /* rx data frames */
+	uint32 rxbyte;      /* rx data bytes */
+
+	/* per-rate receive stat counters */
+	uint32  rx1mbps;	/* packets rx at 1Mbps */
+	uint32  rx2mbps;	/* packets rx at 2Mbps */
+	uint32  rx5mbps5;	/* packets rx at 5.5Mbps */
+	uint32  rx6mbps;	/* packets rx at 6Mbps */
+	uint32  rx9mbps;	/* packets rx at 9Mbps */
+	uint32  rx11mbps;	/* packets rx at 11Mbps */
+	uint32  rx12mbps;	/* packets rx at 12Mbps */
+	uint32  rx18mbps;	/* packets rx at 18Mbps */
+	uint32  rx24mbps;	/* packets rx at 24Mbps */
+	uint32  rx36mbps;	/* packets rx at 36Mbps */
+	uint32  rx48mbps;	/* packets rx at 48Mbps */
+	uint32  rx54mbps;	/* packets rx at 54Mbps */
+	uint32  rx108mbps;	/* packets rx at 108mbps */
+	uint32  rx162mbps;	/* packets rx at 162mbps */
+	uint32  rx216mbps;	/* packets rx at 216 mbps */
+	uint32  rx270mbps;	/* packets rx at 270 mbps */
+	uint32  rx324mbps;	/* packets rx at 324 mbps */
+	uint32  rx378mbps;	/* packets rx at 378 mbps */
+	uint32  rx432mbps;	/* packets rx at 432 mbps */
+	uint32  rx486mbps;	/* packets rx at 486 mbps */
+	uint32  rx540mbps;	/* packets rx at 540 mbps */
+
+	/* phy stats */
+	uint32 rxbadplcp;
+	uint32 rxcrsglitch;
+	uint32 bphy_rxcrsglitch;
+	uint32 bphy_badplcp;
+
+} wl_delta_stats_t;
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+/* structure to store per-rate rx statistics */
+typedef struct wl_scb_rx_rate_stats {
+	uint32  rx1mbps[2];	/* packets rx at 1Mbps */
+	uint32  rx2mbps[2];	/* packets rx at 2Mbps */
+	uint32  rx5mbps5[2];	/* packets rx at 5.5Mbps */
+	uint32  rx6mbps[2];	/* packets rx at 6Mbps */
+	uint32  rx9mbps[2];	/* packets rx at 9Mbps */
+	uint32  rx11mbps[2];	/* packets rx at 11Mbps */
+	uint32  rx12mbps[2];	/* packets rx at 12Mbps */
+	uint32  rx18mbps[2];	/* packets rx at 18Mbps */
+	uint32  rx24mbps[2];	/* packets rx at 24Mbps */
+	uint32  rx36mbps[2];	/* packets rx at 36Mbps */
+	uint32  rx48mbps[2];	/* packets rx at 48Mbps */
+	uint32  rx54mbps[2];	/* packets rx at 54Mbps */
+} wl_scb_rx_rate_stats_t;
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+typedef struct {
+	uint32 packets;
+	uint32 bytes;
+} wl_traffic_stats_t;
+
+typedef struct {
+	uint16	version;	/* see definition of WL_WME_CNT_VERSION */
+	uint16	length;		/* length of entire structure */
+
+	wl_traffic_stats_t tx[AC_COUNT];	/* Packets transmitted */
+	wl_traffic_stats_t tx_failed[AC_COUNT];	/* Packets dropped or failed to transmit */
+	wl_traffic_stats_t rx[AC_COUNT];	/* Packets received */
+	wl_traffic_stats_t rx_failed[AC_COUNT];	/* Packets failed to receive */
+
+	wl_traffic_stats_t forward[AC_COUNT];	/* Packets forwarded by AP */
+
+	wl_traffic_stats_t tx_expired[AC_COUNT];	/* packets dropped due to lifetime expiry */
+
+} wl_wme_cnt_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+struct wl_msglevel2 {
+	uint32 low;
+	uint32 high;
+};
+
+typedef struct wl_mkeep_alive_pkt {
+	uint16	version; /* Version for mkeep_alive */
+	uint16	length; /* length of fixed parameters in the structure */
+	uint32	period_msec;
+	uint16	len_bytes;
+	uint8	keep_alive_id; /* 0 - 3 for N = 4 */
+	uint8	data[1];
+} wl_mkeep_alive_pkt_t;
+
+#define WL_MKEEP_ALIVE_VERSION		1
+#define WL_MKEEP_ALIVE_FIXED_LEN	OFFSETOF(wl_mkeep_alive_pkt_t, data)
+#define WL_MKEEP_ALIVE_PRECISION	500
+
+/* TCP Keep-Alive conn struct */
+typedef struct wl_mtcpkeep_alive_conn_pkt {
+	struct ether_addr saddr;		/* src mac address */
+	struct ether_addr daddr;		/* dst mac address */
+	struct ipv4_addr sipaddr;		/* source IP addr */
+	struct ipv4_addr dipaddr;		/* dest IP addr */
+	uint16 sport;				/* src port */
+	uint16 dport;				/* dest port */
+	uint32 seq;				/* seq number */
+	uint32 ack;				/* ACK number */
+	uint16 tcpwin;				/* TCP window */
+} wl_mtcpkeep_alive_conn_pkt_t;
+
+/* TCP Keep-Alive interval struct */
+typedef struct wl_mtcpkeep_alive_timers_pkt {
+	uint16 interval;		/* interval timer */
+	uint16 retry_interval;		/* retry_interval timer */
+	uint16 retry_count;		/* retry_count */
+} wl_mtcpkeep_alive_timers_pkt_t;
+
+typedef struct wake_info {
+	uint32 wake_reason;
+	uint32 wake_info_len;		/* size of packet */
+	uchar  packet[1];
+} wake_info_t;
+
+typedef struct wake_pkt {
+	uint32 wake_pkt_len;		/* size of packet */
+	uchar  packet[1];
+} wake_pkt_t;
+
+
+#define WL_MTCPKEEP_ALIVE_VERSION		1
+
+#ifdef WLBA
+
+#define WLC_BA_CNT_VERSION  1   /* current version of wlc_ba_cnt_t */
+
+/* block ack related stats */
+typedef struct wlc_ba_cnt {
+	uint16  version;    /* WLC_BA_CNT_VERSION */
+	uint16  length;     /* length of entire structure */
+
+	/* transmit stat counters */
+	uint32 txpdu;       /* pdus sent */
+	uint32 txsdu;       /* sdus sent */
+	uint32 txfc;        /* tx side flow controlled packets */
+	uint32 txfci;       /* tx side flow control initiated */
+	uint32 txretrans;   /* retransmitted pdus */
+	uint32 txbatimer;   /* ba resend due to timer */
+	uint32 txdrop;      /* dropped packets */
+	uint32 txaddbareq;  /* addba req sent */
+	uint32 txaddbaresp; /* addba resp sent */
+	uint32 txdelba;     /* delba sent */
+	uint32 txba;        /* ba sent */
+	uint32 txbar;       /* bar sent */
+	uint32 txpad[4];    /* future */
+
+	/* receive side counters */
+	uint32 rxpdu;       /* pdus recd */
+	uint32 rxqed;       /* pdus buffered before sending up */
+	uint32 rxdup;       /* duplicate pdus */
+	uint32 rxnobuf;     /* pdus discarded due to no buf */
+	uint32 rxaddbareq;  /* addba req recd */
+	uint32 rxaddbaresp; /* addba resp recd */
+	uint32 rxdelba;     /* delba recd */
+	uint32 rxba;        /* ba recd */
+	uint32 rxbar;       /* bar recd */
+	uint32 rxinvba;     /* invalid ba recd */
+	uint32 rxbaholes;   /* ba recd with holes */
+	uint32 rxunexp;     /* unexpected packets */
+	uint32 rxpad[4];    /* future */
+} wlc_ba_cnt_t;
+#endif /* WLBA */
+
+/* structure for per-tid ampdu control */
+struct ampdu_tid_control {
+	uint8 tid;			/* tid */
+	uint8 enable;			/* enable/disable */
+};
+
+/* struct for ampdu tx/rx aggregation control */
+struct ampdu_aggr {
+	int8 aggr_override;	/* aggr overrided by dongle. Not to be set by host. */
+	uint16 conf_TID_bmap;	/* bitmap of TIDs to configure */
+	uint16 enab_TID_bmap;	/* enable/disable per TID */
+};
+
+/* structure for identifying ea/tid for sending addba/delba */
+struct ampdu_ea_tid {
+	struct ether_addr ea;		/* Station address */
+	uint8 tid;			/* tid */
+	uint8 initiator;	/* 0 is recipient, 1 is originator */
+};
+/* structure for identifying retry/tid for retry_limit_tid/rr_retry_limit_tid */
+struct ampdu_retry_tid {
+	uint8 tid;	/* tid */
+	uint8 retry;	/* retry value */
+};
+
+#define BDD_FNAME_LEN       32  /* Max length of friendly name */
+typedef struct bdd_fname {
+	uint8 len;          /* length of friendly name */
+	uchar name[BDD_FNAME_LEN];  /* friendly name */
+} bdd_fname_t;
+
+/* structure for addts arguments */
+/* For ioctls that take a list of TSPEC */
+struct tslist {
+	int count;			/* number of tspecs */
+	struct tsinfo_arg tsinfo[1];	/* variable length array of tsinfo */
+};
+
+#ifdef WLTDLS
+/* structure for tdls iovars */
+typedef struct tdls_iovar {
+	struct ether_addr ea;		/* Station address */
+	uint8 mode;			/* mode: depends on iovar */
+	chanspec_t chanspec;
+	uint32 pad;			/* future */
+} tdls_iovar_t;
+
+#define TDLS_WFD_IE_SIZE		512
+/* structure for tdls wfd ie */
+typedef struct tdls_wfd_ie_iovar {
+	struct ether_addr ea;		/* Station address */
+	uint8 mode;
+	uint16 length;
+	uint8 data[TDLS_WFD_IE_SIZE];
+} tdls_wfd_ie_iovar_t;
+#endif /* WLTDLS */
+
+/* structure for addts/delts arguments */
+typedef struct tspec_arg {
+	uint16 version;			/* see definition of TSPEC_ARG_VERSION */
+	uint16 length;			/* length of entire structure */
+	uint flag;			/* bit field */
+	/* TSPEC Arguments */
+	struct tsinfo_arg tsinfo;	/* TS Info bit field */
+	uint16 nom_msdu_size;		/* (Nominal or fixed) MSDU Size (bytes) */
+	uint16 max_msdu_size;		/* Maximum MSDU Size (bytes) */
+	uint min_srv_interval;		/* Minimum Service Interval (us) */
+	uint max_srv_interval;		/* Maximum Service Interval (us) */
+	uint inactivity_interval;	/* Inactivity Interval (us) */
+	uint suspension_interval;	/* Suspension Interval (us) */
+	uint srv_start_time;		/* Service Start Time (us) */
+	uint min_data_rate;		/* Minimum Data Rate (bps) */
+	uint mean_data_rate;		/* Mean Data Rate (bps) */
+	uint peak_data_rate;		/* Peak Data Rate (bps) */
+	uint max_burst_size;		/* Maximum Burst Size (bytes) */
+	uint delay_bound;		/* Delay Bound (us) */
+	uint min_phy_rate;		/* Minimum PHY Rate (bps) */
+	uint16 surplus_bw;		/* Surplus Bandwidth Allowance (range 1.0 to 8.0) */
+	uint16 medium_time;		/* Medium Time (32 us/s periods) */
+	uint8 dialog_token;		/* dialog token */
+} tspec_arg_t;
+
+/* tspec arg for desired station */
+typedef	struct tspec_per_sta_arg {
+	struct ether_addr ea;
+	struct tspec_arg ts;
+} tspec_per_sta_arg_t;
+
+/* structure for max bandwidth for each access category */
+typedef	struct wme_max_bandwidth {
+	uint32	ac[AC_COUNT];	/* max bandwidth for each access category */
+} wme_max_bandwidth_t;
+
+#define WL_WME_MBW_PARAMS_IO_BYTES (sizeof(wme_max_bandwidth_t))
+
+/* current version of wl_tspec_arg_t struct */
+#define	TSPEC_ARG_VERSION		2	/* current version of wl_tspec_arg_t struct */
+#define TSPEC_ARG_LENGTH		55	/* argument length from tsinfo to medium_time */
+#define TSPEC_DEFAULT_DIALOG_TOKEN	42	/* default dialog token */
+#define TSPEC_DEFAULT_SBW_FACTOR	0x3000	/* default surplus bw */
+
+
+#define WL_WOWL_KEEPALIVE_MAX_PACKET_SIZE  80
+#define WLC_WOWL_MAX_KEEPALIVE	2
+
+/* Packet lifetime configuration per ac */
+typedef struct wl_lifetime {
+	uint32 ac;	        /* access class */
+	uint32 lifetime;    /* Packet lifetime value in ms */
+} wl_lifetime_t;
+
+/* Channel Switch Announcement param */
+typedef struct wl_chan_switch {
+	uint8 mode;		/* value 0 or 1 */
+	uint8 count;		/* count # of beacons before switching */
+	chanspec_t chspec;	/* chanspec */
+	uint8 reg;		/* regulatory class */
+	uint8 frame_type;		/* csa frame type, unicast or broadcast */
+} wl_chan_switch_t;
+
+enum {
+	PFN_LIST_ORDER,
+	PFN_RSSI
+};
+
+enum {
+	DISABLE,
+	ENABLE
+};
+
+enum {
+	OFF_ADAPT,
+	SMART_ADAPT,
+	STRICT_ADAPT,
+	SLOW_ADAPT
+};
+
+#define SORT_CRITERIA_BIT		0
+#define AUTO_NET_SWITCH_BIT		1
+#define ENABLE_BKGRD_SCAN_BIT		2
+#define IMMEDIATE_SCAN_BIT		3
+#define	AUTO_CONNECT_BIT		4
+#define	ENABLE_BD_SCAN_BIT		5
+#define ENABLE_ADAPTSCAN_BIT		6
+#define IMMEDIATE_EVENT_BIT		8
+#define SUPPRESS_SSID_BIT		9
+#define ENABLE_NET_OFFLOAD_BIT		10
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_BIT		11
+
+#define SORT_CRITERIA_MASK	0x0001
+#define AUTO_NET_SWITCH_MASK	0x0002
+#define ENABLE_BKGRD_SCAN_MASK	0x0004
+#define IMMEDIATE_SCAN_MASK	0x0008
+#define AUTO_CONNECT_MASK	0x0010
+
+#define ENABLE_BD_SCAN_MASK	0x0020
+#define ENABLE_ADAPTSCAN_MASK	0x00c0
+#define IMMEDIATE_EVENT_MASK	0x0100
+#define SUPPRESS_SSID_MASK	0x0200
+#define ENABLE_NET_OFFLOAD_MASK	0x0400
+/* report found/lost events for SSID and BSSID networks seperately */
+#define REPORT_SEPERATELY_MASK	0x0800
+
+#define PFN_VERSION			2
+#define PFN_SCANRESULT_VERSION		1
+#define MAX_PFN_LIST_COUNT		16
+
+#define PFN_COMPLETE			1
+#define PFN_INCOMPLETE			0
+
+#define DEFAULT_BESTN			2
+#define DEFAULT_MSCAN			0
+#define DEFAULT_REPEAT			10
+#define DEFAULT_EXP			2
+
+#define PFN_PARTIAL_SCAN_BIT		0
+#define PFN_PARTIAL_SCAN_MASK		1
+
+/* PFN network info structure */
+typedef struct wl_pfn_subnet_info {
+	struct ether_addr BSSID;
+	uint8	channel; /* channel number only */
+	uint8	SSID_len;
+	uint8	SSID[32];
+} wl_pfn_subnet_info_t;
+
+typedef struct wl_pfn_net_info {
+	wl_pfn_subnet_info_t pfnsubnet;
+	int16	RSSI; /* receive signal strength (in dBm) */
+	uint16	timestamp; /* age in seconds */
+} wl_pfn_net_info_t;
+
+typedef struct wl_pfn_lnet_info {
+	wl_pfn_subnet_info_t pfnsubnet; /* BSSID + channel + SSID len + SSID */
+	uint16	flags; /* partial scan, etc */
+	int16	RSSI; /* receive signal strength (in dBm) */
+	uint32	timestamp; /* age in miliseconds */
+	uint16	rtt0; /* estimated distance to this AP in centimeters */
+	uint16	rtt1; /* standard deviation of the distance to this AP in centimeters */
+} wl_pfn_lnet_info_t;
+
+typedef struct wl_pfn_lscanresults {
+	uint32 version;
+	uint32 status;
+	uint32 count;
+	wl_pfn_lnet_info_t netinfo[1];
+} wl_pfn_lscanresults_t;
+
+/* this is used to report on 1-* pfn scan results */
+typedef struct wl_pfn_scanresults {
+	uint32 version;
+	uint32 status;
+	uint32 count;
+	wl_pfn_net_info_t netinfo[1];
+} wl_pfn_scanresults_t;
+
+/* used to report exactly one scan result */
+/* plus reports detailed scan info in bss_info */
+typedef struct wl_pfn_scanresult {
+	uint32 version;
+	uint32 status;
+	uint32 count;
+	wl_pfn_net_info_t netinfo;
+	wl_bss_info_t bss_info;
+} wl_pfn_scanresult_t;
+
+/* PFN data structure */
+typedef struct wl_pfn_param {
+	int32 version;			/* PNO parameters version */
+	int32 scan_freq;		/* Scan frequency */
+	int32 lost_network_timeout;	/* Timeout in sec. to declare
+								* discovered network as lost
+								*/
+	int16 flags;			/* Bit field to control features
+							* of PFN such as sort criteria auto
+							* enable switch and background scan
+							*/
+	int16 rssi_margin;		/* Margin to avoid jitter for choosing a
+							* PFN based on RSSI sort criteria
+							*/
+	uint8 bestn; /* number of best networks in each scan */
+	uint8 mscan; /* number of scans recorded */
+	uint8 repeat; /* Minimum number of scan intervals
+				     *before scan frequency changes in adaptive scan
+				     */
+	uint8 exp; /* Exponent of 2 for maximum scan interval */
+	int32 slow_freq; /* slow scan period */
+} wl_pfn_param_t;
+
+typedef struct wl_pfn_bssid {
+	struct ether_addr  macaddr;
+	/* Bit4: suppress_lost, Bit3: suppress_found */
+	uint16             flags;
+} wl_pfn_bssid_t;
+#define WL_PFN_SUPPRESSFOUND_MASK	0x08
+#define WL_PFN_SUPPRESSLOST_MASK	0x10
+#define WL_PFN_RSSI_MASK		0xff00
+#define WL_PFN_RSSI_SHIFT		8
+
+typedef struct wl_pfn_cfg {
+	uint32	reporttype;
+	int32	channel_num;
+	uint16	channel_list[WL_NUMCHANNELS];
+	uint32	flags;
+} wl_pfn_cfg_t;
+#define WL_PFN_REPORT_ALLNET    0
+#define WL_PFN_REPORT_SSIDNET   1
+#define WL_PFN_REPORT_BSSIDNET  2
+
+#define WL_PFN_CFG_FLAGS_PROHIBITED	0x00000001	/* Accept and use prohibited channels */
+#define WL_PFN_CFG_FLAGS_RESERVED	0xfffffffe	/* Remaining reserved for future use */
+
+typedef struct wl_pfn {
+	wlc_ssid_t		ssid;			/* ssid name and its length */
+	int32			flags;			/* bit2: hidden */
+	int32			infra;			/* BSS Vs IBSS */
+	int32			auth;			/* Open Vs Closed */
+	int32			wpa_auth;		/* WPA type */
+	int32			wsec;			/* wsec value */
+} wl_pfn_t;
+
+typedef struct wl_pfn_list {
+	uint32		version;
+	uint32		enabled;
+	uint32		count;
+	wl_pfn_t	pfn[1];
+} wl_pfn_list_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct pfn_olmsg_params_t {
+	wlc_ssid_t ssid;
+	uint32	cipher_type;
+	uint32	auth_type;
+	uint8	channels[4];
+} BWL_POST_PACKED_STRUCT pfn_olmsg_params;
+
+#define WL_PFN_HIDDEN_BIT		2
+#define WL_PFN_HIDDEN_MASK		0x4
+
+#ifndef BESTN_MAX
+#define BESTN_MAX			3
+#endif
+
+#ifndef MSCAN_MAX
+#define MSCAN_MAX			90
+#endif
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* Service discovery */
+typedef struct {
+	uint8	transaction_id;	/* Transaction id */
+	uint8	protocol;	/* Service protocol type */
+	uint16	query_len;	/* Length of query */
+	uint16	response_len;	/* Length of response */
+	uint8	qrbuf[1];
+} wl_p2po_qr_t;
+
+typedef struct {
+	uint16			period;			/* extended listen period */
+	uint16			interval;		/* extended listen interval */
+} wl_p2po_listen_t;
+
+/* GAS state machine tunable parameters.  Structure field values of 0 means use the default. */
+typedef struct wl_gas_config {
+	uint16 max_retransmit;		/* Max # of firmware/driver retransmits on no Ack
+					 * from peer (on top of the ucode retries).
+					 */
+	uint16 response_timeout;	/* Max time to wait for a GAS-level response
+					 * after sending a packet.
+					 */
+	uint16 max_comeback_delay;	/* Max GAS response comeback delay.
+					 * Exceeding this fails the GAS exchange.
+					 */
+	uint16 max_retries;		/* Max # of GAS state machine retries on failure
+					 * of a GAS frame exchange.
+					 */
+} wl_gas_config_t;
+
+/* P2P Find Offload parameters */
+typedef BWL_PRE_PACKED_STRUCT struct wl_p2po_find_config {
+	uint16 version;			/* Version of this struct */
+	uint16 length;			/* sizeof(wl_p2po_find_config_t) */
+	int32 search_home_time;		/* P2P search state home time when concurrent
+					 * connection exists.  -1 for default.
+					 */
+	uint8 num_social_channels;
+			/* Number of social channels up to WL_P2P_SOCIAL_CHANNELS_MAX.
+			 * 0 means use default social channels.
+			 */
+	uint8 flags;
+	uint16 social_channels[1];	/* Variable length array of social channels */
+} BWL_POST_PACKED_STRUCT wl_p2po_find_config_t;
+#define WL_P2PO_FIND_CONFIG_VERSION 2	/* value for version field */
+
+/* wl_p2po_find_config_t flags */
+#define P2PO_FIND_FLAG_SCAN_ALL_APS 0x01	/* Whether to scan for all APs in the p2po_find
+						 * periodic scans of all channels.
+						 * 0 means scan for only P2P devices.
+						 * 1 means scan for P2P devices plus non-P2P APs.
+						 */
+
+
+/* For adding a WFDS service to seek */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 seek_hdl;		/* unique id chosen by host */
+	uint8 addr[6];			/* Seek service from a specific device with this
+					 * MAC address, all 1's for any device.
+					 */
+	uint8 service_hash[P2P_WFDS_HASH_LEN];
+	uint8 service_name_len;
+	uint8 service_name[MAX_WFDS_SEEK_SVC_NAME_LEN];
+					/* Service name to seek, not null terminated */
+	uint8 service_info_req_len;
+	uint8 service_info_req[1];	/* Service info request, not null terminated.
+					 * Variable length specified by service_info_req_len.
+					 * Maximum length is MAX_WFDS_SEEK_SVC_INFO_LEN.
+					 */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_seek_add_t;
+
+/* For deleting a WFDS service to seek */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 seek_hdl;		/* delete service specified by id */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_seek_del_t;
+
+
+/* For adding a WFDS service to advertise */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 advertise_hdl;		/* unique id chosen by host */
+	uint8 service_hash[P2P_WFDS_HASH_LEN];
+	uint32 advertisement_id;
+	uint16 service_config_method;
+	uint8 service_name_len;
+	uint8 service_name[MAX_WFDS_SVC_NAME_LEN];
+					/* Service name , not null terminated */
+	uint8 service_status;
+	uint16 service_info_len;
+	uint8 service_info[1];		/* Service info, not null terminated.
+					 * Variable length specified by service_info_len.
+					 * Maximum length is MAX_WFDS_ADV_SVC_INFO_LEN.
+					 */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_advertise_add_t;
+
+/* For deleting a WFDS service to advertise */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 advertise_hdl;	/* delete service specified by hdl */
+} BWL_POST_PACKED_STRUCT wl_p2po_wfds_advertise_del_t;
+
+/* P2P Offload discovery mode for the p2po_state iovar */
+typedef enum {
+	WL_P2PO_DISC_STOP,
+	WL_P2PO_DISC_LISTEN,
+	WL_P2PO_DISC_DISCOVERY
+} disc_mode_t;
+
+/* ANQP offload */
+
+#define ANQPO_MAX_QUERY_SIZE		256
+typedef struct {
+	uint16 max_retransmit;		/* ~0 use default, max retransmit on no ACK from peer */
+	uint16 response_timeout;	/* ~0 use default, msec to wait for resp after tx packet */
+	uint16 max_comeback_delay;	/* ~0 use default, max comeback delay in resp else fail */
+	uint16 max_retries;			/* ~0 use default, max retries on failure */
+	uint16 query_len;			/* length of ANQP query */
+	uint8 query_data[1];		/* ANQP encoded query (max ANQPO_MAX_QUERY_SIZE) */
+} wl_anqpo_set_t;
+
+typedef struct {
+	uint16 channel;				/* channel of the peer */
+	struct ether_addr addr;		/* addr of the peer */
+} wl_anqpo_peer_t;
+
+#define ANQPO_MAX_PEER_LIST			64
+typedef struct {
+	uint16 count;				/* number of peers in list */
+	wl_anqpo_peer_t peer[1];	/* max ANQPO_MAX_PEER_LIST */
+} wl_anqpo_peer_list_t;
+
+#define ANQPO_MAX_IGNORE_SSID		64
+typedef struct {
+	bool is_clear;				/* set to clear list (not used on GET) */
+	uint16 count;				/* number of SSID in list */
+	wlc_ssid_t ssid[1];			/* max ANQPO_MAX_IGNORE_SSID */
+} wl_anqpo_ignore_ssid_list_t;
+
+#define ANQPO_MAX_IGNORE_BSSID		64
+typedef struct {
+	bool is_clear;				/* set to clear list (not used on GET) */
+	uint16 count;				/* number of addr in list */
+	struct ether_addr bssid[1];	/* max ANQPO_MAX_IGNORE_BSSID */
+} wl_anqpo_ignore_bssid_list_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+struct toe_ol_stats_t {
+	/* Num of tx packets that don't need to be checksummed */
+	uint32 tx_summed;
+
+	/* Num of tx packets where checksum is filled by offload engine */
+	uint32 tx_iph_fill;
+	uint32 tx_tcp_fill;
+	uint32 tx_udp_fill;
+	uint32 tx_icmp_fill;
+
+	/*  Num of rx packets where toe finds out if checksum is good or bad */
+	uint32 rx_iph_good;
+	uint32 rx_iph_bad;
+	uint32 rx_tcp_good;
+	uint32 rx_tcp_bad;
+	uint32 rx_udp_good;
+	uint32 rx_udp_bad;
+	uint32 rx_icmp_good;
+	uint32 rx_icmp_bad;
+
+	/* Num of tx packets in which csum error is injected */
+	uint32 tx_tcp_errinj;
+	uint32 tx_udp_errinj;
+	uint32 tx_icmp_errinj;
+
+	/* Num of rx packets in which csum error is injected */
+	uint32 rx_tcp_errinj;
+	uint32 rx_udp_errinj;
+	uint32 rx_icmp_errinj;
+};
+
+/* Arp offload statistic counts */
+struct arp_ol_stats_t {
+	uint32  host_ip_entries;	/* Host IP table addresses (more than one if multihomed) */
+	uint32  host_ip_overflow;	/* Host IP table additions skipped due to overflow */
+
+	uint32  arp_table_entries;	/* ARP table entries */
+	uint32  arp_table_overflow;	/* ARP table additions skipped due to overflow */
+
+	uint32  host_request;		/* ARP requests from host */
+	uint32  host_reply;		/* ARP replies from host */
+	uint32  host_service;		/* ARP requests from host serviced by ARP Agent */
+
+	uint32  peer_request;		/* ARP requests received from network */
+	uint32  peer_request_drop;	/* ARP requests from network that were dropped */
+	uint32  peer_reply;		/* ARP replies received from network */
+	uint32  peer_reply_drop;	/* ARP replies from network that were dropped */
+	uint32  peer_service;		/* ARP request from host serviced by ARP Agent */
+};
+
+/* NS offload statistic counts */
+struct nd_ol_stats_t {
+	uint32  host_ip_entries;    /* Host IP table addresses (more than one if multihomed) */
+	uint32  host_ip_overflow;   /* Host IP table additions skipped due to overflow */
+	uint32  peer_request;       /* NS requests received from network */
+	uint32  peer_request_drop;  /* NS requests from network that were dropped */
+	uint32  peer_reply_drop;    /* NA replies from network that were dropped */
+	uint32  peer_service;       /* NS request from host serviced by firmware */
+};
+
+/*
+ * Keep-alive packet offloading.
+ */
+
+/* NAT keep-alive packets format: specifies the re-transmission period, the packet
+ * length, and packet contents.
+ */
+typedef struct wl_keep_alive_pkt {
+	uint32	period_msec;	/* Retransmission period (0 to disable packet re-transmits) */
+	uint16	len_bytes;	/* Size of packet to transmit (0 to disable packet re-transmits) */
+	uint8	data[1];	/* Variable length packet to transmit.  Contents should include
+				 * entire ethernet packet (enet header, IP header, UDP header,
+				 * and UDP payload) in network byte order.
+				 */
+} wl_keep_alive_pkt_t;
+
+#define WL_KEEP_ALIVE_FIXED_LEN		OFFSETOF(wl_keep_alive_pkt_t, data)
+
+
+/*
+ * Dongle pattern matching filter.
+ */
+
+/* Packet filter operation mode */
+/* True: 1; False: 0 */
+#define PKT_FILTER_MODE_FORWARD_ON_MATCH		1
+/* Enable and disable pkt_filter as a whole */
+#define PKT_FILTER_MODE_DISABLE					2
+/* Cache first matched rx pkt(be queried by host later) */
+#define PKT_FILTER_MODE_PKT_CACHE_ON_MATCH		4
+/* If pkt_filter is enabled and no filter is set, don't forward anything */
+#define PKT_FILTER_MODE_PKT_FORWARD_OFF_DEFAULT 8
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+/* Ports only filter mode */
+#define PKT_FILTER_MODE_PORTS_ONLY				16
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+#define MAX_WAKE_PACKET_CACHE_BYTES 128 /* Maximum cached wake packet */
+
+#define MAX_WAKE_PACKET_BYTES	    (DOT11_A3_HDR_LEN +			    \
+				     DOT11_QOS_LEN +			    \
+				     sizeof(struct dot11_llc_snap_header) + \
+				     ETHER_MAX_DATA)
+
+typedef struct pm_wake_packet {
+	uint32	status;		/* Is the wake reason a packet (if all the other field's valid) */
+	uint32	pattern_id;	/* Pattern ID that matched */
+	uint32	original_packet_size;
+	uint32	saved_packet_size;
+	uchar	packet[MAX_WAKE_PACKET_CACHE_BYTES];
+} pm_wake_packet_t;
+
+/* Packet filter types. Currently, only pattern matching is supported. */
+typedef enum wl_pkt_filter_type {
+	WL_PKT_FILTER_TYPE_PATTERN_MATCH=0,	/* Pattern matching filter */
+	WL_PKT_FILTER_TYPE_MAGIC_PATTERN_MATCH=1, /* Magic packet match */
+	WL_PKT_FILTER_TYPE_PATTERN_LIST_MATCH=2, /* A pattern list (match all to match filter) */
+	WL_PKT_FILTER_TYPE_ENCRYPTED_PATTERN_MATCH=3, /* SECURE WOWL magic / net pattern match */
+} wl_pkt_filter_type_t;
+
+#define WL_PKT_FILTER_TYPE wl_pkt_filter_type_t
+
+/* String mapping for types that may be used by applications or debug */
+#define WL_PKT_FILTER_TYPE_NAMES \
+	{ "PATTERN", WL_PKT_FILTER_TYPE_PATTERN_MATCH },       \
+	{ "MAGIC",   WL_PKT_FILTER_TYPE_MAGIC_PATTERN_MATCH }, \
+	{ "PATLIST", WL_PKT_FILTER_TYPE_PATTERN_LIST_MATCH }
+
+/* Secured WOWL packet was encrypted, need decrypted before check filter match */
+typedef struct wl_pkt_decrypter {
+		uint8* (*dec_cb)(void* dec_ctx, const void *sdu, int sending);
+		void*  dec_ctx;
+} wl_pkt_decrypter_t;
+
+/* Pattern matching filter. Specifies an offset within received packets to
+ * start matching, the pattern to match, the size of the pattern, and a bitmask
+ * that indicates which bits within the pattern should be matched.
+ */
+typedef struct wl_pkt_filter_pattern {
+// terence 20150525: fix pkt filter error -14 in 64bit OS
+//	union {
+		uint32	offset;		/* Offset within received packet to start pattern matching.
+				 * Offset '0' is the first byte of the ethernet header.
+				 */
+//		wl_pkt_decrypter_t*	decrypt_ctx;	/* Decrypt context */
+//	};
+	uint32	size_bytes;	/* Size of the pattern.  Bitmask must be the same size. */
+	uint8   mask_and_pattern[1]; /* Variable length mask and pattern data.  mask starts
+				      * at offset 0.  Pattern immediately follows mask.
+				      */
+} wl_pkt_filter_pattern_t;
+
+/* A pattern list is a numerically specified list of modified pattern structures. */
+typedef struct wl_pkt_filter_pattern_listel {
+	uint16 rel_offs;	/* Offset to begin match (relative to 'base' below) */
+	uint16 base_offs;	/* Base for offset (defined below) */
+	uint16 size_bytes;	/* Size of mask/pattern */
+	uint16 match_flags;	/* Addition flags controlling the match */
+	uint8  mask_and_data[1]; /* Variable length mask followed by data, each size_bytes */
+} wl_pkt_filter_pattern_listel_t;
+
+typedef struct wl_pkt_filter_pattern_list {
+	uint8 list_cnt;		/* Number of elements in the list */
+	uint8 PAD1[1];		/* Reserved (possible version: reserved) */
+	uint16 totsize;		/* Total size of this pattern list (includes this struct) */
+	wl_pkt_filter_pattern_listel_t patterns[1]; /* Variable number of list elements */
+} wl_pkt_filter_pattern_list_t;
+
+/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
+typedef struct wl_pkt_filter {
+	uint32	id;		/* Unique filter id, specified by app. */
+	uint32	type;		/* Filter type (WL_PKT_FILTER_TYPE_xxx). */
+	uint32	negate_match;	/* Negate the result of filter matches */
+	union {			/* Filter definitions */
+		wl_pkt_filter_pattern_t pattern;	/* Pattern matching filter */
+		wl_pkt_filter_pattern_list_t patlist; /* List of patterns to match */
+	} u;
+} wl_pkt_filter_t;
+
+/* IOVAR "tcp_keep_set" parameter. Used to install tcp keep_alive stuff. */
+typedef struct wl_tcp_keep_set {
+	uint32	val1;
+	uint32	val2;
+} wl_tcp_keep_set_t;
+
+#define WL_PKT_FILTER_FIXED_LEN		  OFFSETOF(wl_pkt_filter_t, u)
+#define WL_PKT_FILTER_PATTERN_FIXED_LEN	  OFFSETOF(wl_pkt_filter_pattern_t, mask_and_pattern)
+#define WL_PKT_FILTER_PATTERN_LIST_FIXED_LEN OFFSETOF(wl_pkt_filter_pattern_list_t, patterns)
+#define WL_PKT_FILTER_PATTERN_LISTEL_FIXED_LEN	\
+			OFFSETOF(wl_pkt_filter_pattern_listel_t, mask_and_data)
+
+/* IOVAR "pkt_filter_enable" parameter. */
+typedef struct wl_pkt_filter_enable {
+	uint32	id;		/* Unique filter id */
+	uint32	enable;		/* Enable/disable bool */
+} wl_pkt_filter_enable_t;
+
+/* IOVAR "pkt_filter_list" parameter. Used to retrieve a list of installed filters. */
+typedef struct wl_pkt_filter_list {
+	uint32	num;		/* Number of installed packet filters */
+	wl_pkt_filter_t	filter[1];	/* Variable array of packet filters. */
+} wl_pkt_filter_list_t;
+
+#define WL_PKT_FILTER_LIST_FIXED_LEN	  OFFSETOF(wl_pkt_filter_list_t, filter)
+
+/* IOVAR "pkt_filter_stats" parameter. Used to retrieve debug statistics. */
+typedef struct wl_pkt_filter_stats {
+	uint32	num_pkts_matched;	/* # filter matches for specified filter id */
+	uint32	num_pkts_forwarded;	/* # packets fwded from dongle to host for all filters */
+	uint32	num_pkts_discarded;	/* # packets discarded by dongle for all filters */
+} wl_pkt_filter_stats_t;
+
+/* IOVAR "pkt_filter_ports" parameter.  Configure TCP/UDP port filters. */
+typedef struct wl_pkt_filter_ports {
+	uint8 version;		/* Be proper */
+	uint8 reserved;		/* Be really proper */
+	uint16 count;		/* Number of ports following */
+	/* End of fixed data */
+	uint16 ports[1];	/* Placeholder for ports[<count>] */
+} wl_pkt_filter_ports_t;
+
+#define WL_PKT_FILTER_PORTS_FIXED_LEN	OFFSETOF(wl_pkt_filter_ports_t, ports)
+
+#define WL_PKT_FILTER_PORTS_VERSION	0
+#define WL_PKT_FILTER_PORTS_MAX		128
+
+#define RSN_KCK_LENGTH 16
+#define RSN_KEK_LENGTH 16
+#define RSN_REPLAY_LEN 8
+typedef struct _gtkrefresh {
+	uchar	KCK[RSN_KCK_LENGTH];
+	uchar	KEK[RSN_KEK_LENGTH];
+	uchar	ReplayCounter[RSN_REPLAY_LEN];
+} gtk_keyinfo_t, *pgtk_keyinfo_t;
+
+/* Sequential Commands ioctl */
+typedef struct wl_seq_cmd_ioctl {
+	uint32 cmd;		/* common ioctl definition */
+	uint32 len;		/* length of user buffer */
+} wl_seq_cmd_ioctl_t;
+
+#define WL_SEQ_CMD_ALIGN_BYTES	4
+
+/* These are the set of get IOCTLs that should be allowed when using
+ * IOCTL sequence commands. These are issued implicitly by wl.exe each time
+ * it is invoked. We never want to buffer these, or else wl.exe will stop working.
+ */
+#define WL_SEQ_CMDS_GET_IOCTL_FILTER(cmd) \
+	(((cmd) == WLC_GET_MAGIC)		|| \
+	 ((cmd) == WLC_GET_VERSION)		|| \
+	 ((cmd) == WLC_GET_AP)			|| \
+	 ((cmd) == WLC_GET_INSTANCE))
+
+typedef struct wl_pkteng {
+	uint32 flags;
+	uint32 delay;			/* Inter-packet delay */
+	uint32 nframes;			/* Number of frames */
+	uint32 length;			/* Packet length */
+	uint8  seqno;			/* Enable/disable sequence no. */
+	struct ether_addr dest;		/* Destination address */
+	struct ether_addr src;		/* Source address */
+} wl_pkteng_t;
+
+typedef struct wl_pkteng_stats {
+	uint32 lostfrmcnt;		/* RX PER test: no of frames lost (skip seqno) */
+	int32 rssi;			/* RSSI */
+	int32 snr;			/* signal to noise ratio */
+	uint16 rxpktcnt[NUM_80211_RATES+1];
+	uint8 rssi_qdb;			/* qdB portion of the computed rssi */
+} wl_pkteng_stats_t;
+
+typedef struct wl_txcal_params {
+	wl_pkteng_t pkteng;
+	uint8 gidx_start;
+	int8 gidx_step;
+	uint8 gidx_stop;
+} wl_txcal_params_t;
+
+
+typedef enum {
+	wowl_pattern_type_bitmap = 0,
+	wowl_pattern_type_arp,
+	wowl_pattern_type_na
+} wowl_pattern_type_t;
+
+typedef struct wl_wowl_pattern {
+	uint32		    masksize;		/* Size of the mask in #of bytes */
+	uint32		    offset;		/* Pattern byte offset in packet */
+	uint32		    patternoffset;	/* Offset of start of pattern in the structure */
+	uint32		    patternsize;	/* Size of the pattern itself in #of bytes */
+	uint32		    id;			/* id */
+	uint32		    reasonsize;		/* Size of the wakeup reason code */
+	wowl_pattern_type_t type;		/* Type of pattern */
+	/* Mask follows the structure above */
+	/* Pattern follows the mask is at 'patternoffset' from the start */
+} wl_wowl_pattern_t;
+
+typedef struct wl_wowl_pattern_list {
+	uint			count;
+	wl_wowl_pattern_t	pattern[1];
+} wl_wowl_pattern_list_t;
+
+typedef struct wl_wowl_wakeind {
+	uint8	pci_wakeind;	/* Whether PCI PMECSR PMEStatus bit was set */
+	uint32	ucode_wakeind;	/* What wakeup-event indication was set by ucode */
+} wl_wowl_wakeind_t;
+
+typedef struct {
+	uint32		pktlen;		    /* size of packet */
+	void		*sdu;
+} tcp_keepalive_wake_pkt_infop_t;
+
+/* per AC rate control related data structure */
+typedef struct wl_txrate_class {
+	uint8		init_rate;
+	uint8		min_rate;
+	uint8		max_rate;
+} wl_txrate_class_t;
+
+/* structure for Overlap BSS scan arguments */
+typedef struct wl_obss_scan_arg {
+	int16	passive_dwell;
+	int16	active_dwell;
+	int16	bss_widthscan_interval;
+	int16	passive_total;
+	int16	active_total;
+	int16	chanwidth_transition_delay;
+	int16	activity_threshold;
+} wl_obss_scan_arg_t;
+
+#define WL_OBSS_SCAN_PARAM_LEN	sizeof(wl_obss_scan_arg_t)
+
+/* RSSI event notification configuration. */
+typedef struct wl_rssi_event {
+	uint32 rate_limit_msec;		/* # of events posted to application will be limited to
+					 * one per specified period (0 to disable rate limit).
+					 */
+	uint8 num_rssi_levels;		/* Number of entries in rssi_levels[] below */
+	int8 rssi_levels[MAX_RSSI_LEVELS];	/* Variable number of RSSI levels. An event
+						 * will be posted each time the RSSI of received
+						 * beacons/packets crosses a level.
+						 */
+} wl_rssi_event_t;
+
+typedef struct wl_action_obss_coex_req {
+	uint8 info;
+	uint8 num;
+	uint8 ch_list[1];
+} wl_action_obss_coex_req_t;
+
+
+/* IOVar parameter block for small MAC address array with type indicator */
+#define WL_IOV_MAC_PARAM_LEN  4
+
+#define WL_IOV_PKTQ_LOG_PRECS 16
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 num_addrs;
+	char   addr_type[WL_IOV_MAC_PARAM_LEN];
+	struct ether_addr ea[WL_IOV_MAC_PARAM_LEN];
+} BWL_POST_PACKED_STRUCT wl_iov_mac_params_t;
+
+/* This is extra info that follows wl_iov_mac_params_t */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 addr_info[WL_IOV_MAC_PARAM_LEN];
+} BWL_POST_PACKED_STRUCT wl_iov_mac_extra_params_t;
+
+/* Combined structure */
+typedef struct {
+	wl_iov_mac_params_t params;
+	wl_iov_mac_extra_params_t extra_params;
+} wl_iov_mac_full_params_t;
+
+/* Parameter block for PKTQ_LOG statistics */
+#define PKTQ_LOG_COUNTERS_V4 \
+	/* packets requested to be stored */ \
+	uint32 requested; \
+	/* packets stored */ \
+	uint32 stored; \
+	/* packets saved, because a lowest priority queue has given away one packet */ \
+	uint32 saved; \
+	/* packets saved, because an older packet from the same queue has been dropped */ \
+	uint32 selfsaved; \
+	/* packets dropped, because pktq is full with higher precedence packets */ \
+	uint32 full_dropped; \
+	 /* packets dropped because pktq per that precedence is full */ \
+	uint32 dropped; \
+	/* packets dropped, in order to save one from a queue of a highest priority */ \
+	uint32 sacrificed; \
+	/* packets droped because of hardware/transmission error */ \
+	uint32 busy; \
+	/* packets re-sent because they were not received */ \
+	uint32 retry; \
+	/* packets retried again (ps pretend) prior to moving power save mode */ \
+	uint32 ps_retry; \
+	 /* suppressed packet count */ \
+	uint32 suppress; \
+	/* packets finally dropped after retry limit */ \
+	uint32 retry_drop; \
+	/* the high-water mark of the queue capacity for packets - goes to zero as queue fills */ \
+	uint32 max_avail; \
+	/* the high-water mark of the queue utilisation for packets - ('inverse' of max_avail) */ \
+	uint32 max_used; \
+	 /* the maximum capacity of the queue */ \
+	uint32 queue_capacity; \
+	/* count of rts attempts that failed to receive cts */ \
+	uint32 rtsfail; \
+	/* count of packets sent (acked) successfully */ \
+	uint32 acked; \
+	/* running total of phy rate of packets sent successfully */ \
+	uint32 txrate_succ; \
+	/* running total of phy 'main' rate */ \
+	uint32 txrate_main; \
+	/* actual data transferred successfully */ \
+	uint32 throughput; \
+	/* time difference since last pktq_stats */ \
+	uint32 time_delta;
+
+typedef struct {
+	PKTQ_LOG_COUNTERS_V4
+} pktq_log_counters_v04_t;
+
+/* v5 is the same as V4 with extra parameter */
+typedef struct {
+	PKTQ_LOG_COUNTERS_V4
+	/* cumulative time to transmit */
+	uint32 airtime;
+} pktq_log_counters_v05_t;
+
+typedef struct {
+	uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+	pktq_log_counters_v04_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+	uint32               counter_info[WL_IOV_MAC_PARAM_LEN];
+	uint32               pspretend_time_delta[WL_IOV_MAC_PARAM_LEN];
+	char                 headings[1];
+} pktq_log_format_v04_t;
+
+typedef struct {
+	uint8                num_prec[WL_IOV_MAC_PARAM_LEN];
+	pktq_log_counters_v05_t  counters[WL_IOV_MAC_PARAM_LEN][WL_IOV_PKTQ_LOG_PRECS];
+	uint32               counter_info[WL_IOV_MAC_PARAM_LEN];
+	uint32               pspretend_time_delta[WL_IOV_MAC_PARAM_LEN];
+	char                 headings[1];
+} pktq_log_format_v05_t;
+
+
+typedef struct {
+	uint32               version;
+	wl_iov_mac_params_t  params;
+	union {
+		pktq_log_format_v04_t v04;
+		pktq_log_format_v05_t v05;
+	} pktq_log;
+} wl_iov_pktq_log_t;
+
+/* PKTQ_LOG_AUTO, PKTQ_LOG_DEF_PREC flags introduced in v05, they are ignored by v04 */
+#define PKTQ_LOG_AUTO     (1 << 31)
+#define PKTQ_LOG_DEF_PREC (1 << 30)
+
+/*
+ * SCB_BS_DATA iovar definitions start.
+ */
+#define SCB_BS_DATA_STRUCT_VERSION	1
+
+/* The actual counters maintained for each station */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	/* The following counters are a subset of what pktq_stats provides per precedence. */
+	uint32 retry;          /* packets re-sent because they were not received */
+	uint32 retry_drop;     /* packets finally dropped after retry limit */
+	uint32 rtsfail;        /* count of rts attempts that failed to receive cts */
+	uint32 acked;          /* count of packets sent (acked) successfully */
+	uint32 txrate_succ;    /* running total of phy rate of packets sent successfully */
+	uint32 txrate_main;    /* running total of phy 'main' rate */
+	uint32 throughput;     /* actual data transferred successfully */
+	uint32 time_delta;     /* time difference since last pktq_stats */
+	uint32 airtime;        /* cumulative total medium access delay in useconds */
+} BWL_POST_PACKED_STRUCT iov_bs_data_counters_t;
+
+/* The structure for individual station information. */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	struct ether_addr	station_address;	/* The station MAC address */
+	uint16			station_flags;		/* Bit mask of flags, for future use. */
+	iov_bs_data_counters_t	station_counters;	/* The actual counter values */
+} BWL_POST_PACKED_STRUCT iov_bs_data_record_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16	structure_version;	/* Structure version number (for wl/wlu matching) */
+	uint16	structure_count;	/* Number of iov_bs_data_record_t records following */
+	iov_bs_data_record_t	structure_record[1];	/* 0 - structure_count records */
+} BWL_POST_PACKED_STRUCT iov_bs_data_struct_t;
+
+/* Bitmask of options that can be passed in to the iovar. */
+enum {
+	SCB_BS_DATA_FLAG_NO_RESET = (1<<0)	/* Do not clear the counters after reading */
+};
+/*
+ * SCB_BS_DATA iovar definitions end.
+ */
+
+typedef struct wlc_extlog_cfg {
+	int max_number;
+	uint16 module;	/* bitmap */
+	uint8 level;
+	uint8 flag;
+	uint16 version;
+} wlc_extlog_cfg_t;
+
+typedef struct log_record {
+	uint32 time;
+	uint16 module;
+	uint16 id;
+	uint8 level;
+	uint8 sub_unit;
+	uint8 seq_num;
+	int32 arg;
+	char str[MAX_ARGSTR_LEN];
+} log_record_t;
+
+typedef struct wlc_extlog_req {
+	uint32 from_last;
+	uint32 num;
+} wlc_extlog_req_t;
+
+typedef struct wlc_extlog_results {
+	uint16 version;
+	uint16 record_len;
+	uint32 num;
+	log_record_t logs[1];
+} wlc_extlog_results_t;
+
+typedef struct log_idstr {
+	uint16	id;
+	uint16	flag;
+	uint8	arg_type;
+	const char	*fmt_str;
+} log_idstr_t;
+
+#define FMTSTRF_USER		1
+
+/* flat ID definitions
+ * New definitions HAVE TO BE ADDED at the end of the table. Otherwise, it will
+ * affect backward compatibility with pre-existing apps
+ */
+typedef enum {
+	FMTSTR_DRIVER_UP_ID = 0,
+	FMTSTR_DRIVER_DOWN_ID = 1,
+	FMTSTR_SUSPEND_MAC_FAIL_ID = 2,
+	FMTSTR_NO_PROGRESS_ID = 3,
+	FMTSTR_RFDISABLE_ID = 4,
+	FMTSTR_REG_PRINT_ID = 5,
+	FMTSTR_EXPTIME_ID = 6,
+	FMTSTR_JOIN_START_ID = 7,
+	FMTSTR_JOIN_COMPLETE_ID = 8,
+	FMTSTR_NO_NETWORKS_ID = 9,
+	FMTSTR_SECURITY_MISMATCH_ID = 10,
+	FMTSTR_RATE_MISMATCH_ID = 11,
+	FMTSTR_AP_PRUNED_ID = 12,
+	FMTSTR_KEY_INSERTED_ID = 13,
+	FMTSTR_DEAUTH_ID = 14,
+	FMTSTR_DISASSOC_ID = 15,
+	FMTSTR_LINK_UP_ID = 16,
+	FMTSTR_LINK_DOWN_ID = 17,
+	FMTSTR_RADIO_HW_OFF_ID = 18,
+	FMTSTR_RADIO_HW_ON_ID = 19,
+	FMTSTR_EVENT_DESC_ID = 20,
+	FMTSTR_PNP_SET_POWER_ID = 21,
+	FMTSTR_RADIO_SW_OFF_ID = 22,
+	FMTSTR_RADIO_SW_ON_ID = 23,
+	FMTSTR_PWD_MISMATCH_ID = 24,
+	FMTSTR_FATAL_ERROR_ID = 25,
+	FMTSTR_AUTH_FAIL_ID = 26,
+	FMTSTR_ASSOC_FAIL_ID = 27,
+	FMTSTR_IBSS_FAIL_ID = 28,
+	FMTSTR_EXTAP_FAIL_ID = 29,
+	FMTSTR_MAX_ID
+} log_fmtstr_id_t;
+
+#ifdef DONGLEOVERLAYS
+typedef struct {
+	uint32 flags_idx;	/* lower 8 bits: overlay index; upper 24 bits: flags */
+	uint32 offset;		/* offset into overlay region to write code */
+	uint32 len;			/* overlay code len */
+	/* overlay code follows this struct */
+} wl_ioctl_overlay_t;
+#endif /* DONGLEOVERLAYS */
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+/* 11k Neighbor Report element */
+typedef struct nbr_element {
+	uint8 id;
+	uint8 len;
+	struct ether_addr bssid;
+	uint32 bssid_info;
+	uint8 reg;
+	uint8 channel;
+	uint8 phytype;
+	uint8 pad;
+} nbr_element_t;
+
+
+typedef enum event_msgs_ext_command {
+	EVENTMSGS_NONE		=	0,
+	EVENTMSGS_SET_BIT	=	1,
+	EVENTMSGS_RESET_BIT	=	2,
+	EVENTMSGS_SET_MASK	=	3
+} event_msgs_ext_command_t;
+
+#define EVENTMSGS_VER 1
+#define EVENTMSGS_EXT_STRUCT_SIZE	OFFSETOF(eventmsgs_ext_t, mask[0])
+
+/* len-	for SET it would be mask size from the application to the firmware */
+/*		for GET it would be actual firmware mask size */
+/* maxgetsize -	is only used for GET. indicate max mask size that the */
+/*				application can read from the firmware */
+typedef struct eventmsgs_ext
+{
+	uint8	ver;
+	uint8	command;
+	uint8	len;
+	uint8	maxgetsize;
+	uint8	mask[1];
+} eventmsgs_ext_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_tput_params {
+	/* no of host dma descriptors programmed by the firmware before a commit */
+	uint16		max_dma_descriptors;
+
+	uint16		host_buf_len; /* length of host buffer */
+	dmaaddr_t	host_buf_addr; /* physical address for bus_throughput_buf */
+} BWL_POST_PACKED_STRUCT pcie_bus_tput_params_t;
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_tput_stats {
+	uint16		time_taken; /* no of secs the test is run */
+	uint16		nbytes_per_descriptor; /* no of bytes of data dma ed per descriptor */
+
+	/* no of desciptors fo which dma is sucessfully completed within the test time */
+	uint32		count;
+} BWL_POST_PACKED_STRUCT pcie_bus_tput_stats_t;
+
+#define MAX_ROAMOFFL_BSSID_NUM	100
+
+typedef BWL_PRE_PACKED_STRUCT struct roamoffl_bssid_list {
+	int cnt;
+	struct ether_addr bssid[1];
+} BWL_POST_PACKED_STRUCT roamoffl_bssid_list_t;
+
+/* no default structure packing */
+#include <packed_section_end.h>
+
+typedef struct keepalives_max_idle {
+	uint16  keepalive_count;        /* nmbr of keepalives per bss_max_idle period */
+	uint8   mkeepalive_index;       /* mkeepalive_index for keepalive frame to be used */
+	uint8   PAD;			/* to align next field */
+	uint16  max_interval;           /* seconds */
+} keepalives_max_idle_t;
+
+#define PM_IGNORE_BCMC_PROXY_ARP (1 << 0)
+#define PM_IGNORE_BCMC_ALL_DMS_ACCEPTED (1 << 1)
+
+/* require strict packing */
+#include <packed_section_start.h>
+
+/* ##### Power Stats section ##### */
+
+#define WL_PWRSTATS_VERSION	2
+
+/* Input structure for pwrstats IOVAR */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwrstats_query {
+	uint16 length;		/* Number of entries in type array. */
+	uint16 type[1];		/* Types (tags) to retrieve.
+				 * Length 0 (no types) means get all.
+				 */
+} BWL_POST_PACKED_STRUCT wl_pwrstats_query_t;
+
+/* This structure is for version 2; version 1 will be deprecated in by FW */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwrstats {
+	uint16 version;		      /* Version = 2 is TLV format */
+	uint16 length;		      /* Length of entire structure */
+	uint8 data[1];		      /* TLV data, a series of structures,
+				       * each starting with type and length.
+				       *
+				       * Padded as necessary so each section
+				       * starts on a 4-byte boundary.
+				       *
+				       * Both type and len are uint16, but the
+				       * upper nibble of length is reserved so
+				       * valid len values are 0-4095.
+				       */
+} BWL_POST_PACKED_STRUCT wl_pwrstats_t;
+#define WL_PWR_STATS_HDRLEN	OFFSETOF(wl_pwrstats_t, data)
+
+/* Type values for the data section */
+#define WL_PWRSTATS_TYPE_PHY		0 /* struct wl_pwr_phy_stats */
+#define WL_PWRSTATS_TYPE_SCAN		1 /* struct wl_pwr_scan_stats */
+#define WL_PWRSTATS_TYPE_USB_HSIC	2 /* struct wl_pwr_usb_hsic_stats */
+#define WL_PWRSTATS_TYPE_PM_AWAKE	3 /* struct wl_pwr_pm_awake_stats */
+#define WL_PWRSTATS_TYPE_CONNECTION	4 /* struct wl_pwr_connect_stats; assoc and key-exch time */
+#define WL_PWRSTATS_TYPE_PCIE		6 /* struct wl_pwr_pcie_stats */
+
+/* Bits for wake reasons */
+#define WLC_PMD_WAKE_SET		0x1
+#define WLC_PMD_PM_AWAKE_BCN		0x2
+#define WLC_PMD_BTA_ACTIVE		0x4
+#define WLC_PMD_SCAN_IN_PROGRESS	0x8
+#define WLC_PMD_RM_IN_PROGRESS		0x10
+#define WLC_PMD_AS_IN_PROGRESS		0x20
+#define WLC_PMD_PM_PEND			0x40
+#define WLC_PMD_PS_POLL			0x80
+#define WLC_PMD_CHK_UNALIGN_TBTT	0x100
+#define WLC_PMD_APSD_STA_UP		0x200
+#define WLC_PMD_TX_PEND_WAR		0x400
+#define WLC_PMD_GPTIMER_STAY_AWAKE	0x800
+#define WLC_PMD_PM2_RADIO_SOFF_PEND	0x2000
+#define WLC_PMD_NON_PRIM_STA_UP		0x4000
+#define WLC_PMD_AP_UP			0x8000
+
+typedef BWL_PRE_PACKED_STRUCT struct wlc_pm_debug {
+	uint32 timestamp;	     /* timestamp in millisecond */
+	uint32 reason;		     /* reason(s) for staying awake */
+} BWL_POST_PACKED_STRUCT wlc_pm_debug_t;
+
+/* Data sent as part of pwrstats IOVAR */
+typedef BWL_PRE_PACKED_STRUCT struct pm_awake_data {
+	uint32 curr_time;	/* ms */
+	uint32 hw_macc;		/* HW maccontrol */
+	uint32 sw_macc;		/* SW maccontrol */
+	uint32 pm_dur;		/* Total sleep time in PM, usecs */
+	uint32 mpc_dur;		/* Total sleep time in MPC, usecs */
+
+	/* int32 drifts = remote - local; +ve drift => local-clk slow */
+	int32 last_drift;	/* Most recent TSF drift from beacon */
+	int32 min_drift;	/* Min TSF drift from beacon in magnitude */
+	int32 max_drift;	/* Max TSF drift from beacon in magnitude */
+
+	uint32 avg_drift;	/* Avg TSF drift from beacon */
+
+	/* Wake history tracking */
+
+	/* pmstate array (type wlc_pm_debug_t) start offset */
+	uint16 pm_state_offset;
+	/* pmstate number of array entries */
+	uint16 pm_state_len;
+
+	/* array (type uint32) start offset */
+	uint16 pmd_event_wake_dur_offset;
+	/* pmd_event_wake_dur number of array entries */
+	uint16 pmd_event_wake_dur_len;
+
+	uint32 drift_cnt;	/* Count of drift readings over which avg_drift was computed */
+	uint8  pmwake_idx;	/* for stepping through pm_state */
+	uint8  pad[3];
+	uint32 frts_time;	/* Cumulative ms spent in frts since driver load */
+	uint32 frts_end_cnt;	/* No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT pm_awake_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pm_awake_stats {
+	uint16 type;	     /* WL_PWRSTATS_TYPE_PM_AWAKE */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+
+	pm_awake_data_t awake_data;
+} BWL_POST_PACKED_STRUCT wl_pwr_pm_awake_stats_t;
+
+/* Original bus structure is for HSIC */
+typedef BWL_PRE_PACKED_STRUCT struct bus_metrics {
+	uint32 suspend_ct;	/* suspend count */
+	uint32 resume_ct;	/* resume count */
+	uint32 disconnect_ct;	/* disconnect count */
+	uint32 reconnect_ct;	/* reconnect count */
+	uint32 active_dur;	/* msecs in bus, usecs for user */
+	uint32 suspend_dur;	/* msecs in bus, usecs for user */
+	uint32 disconnect_dur;	/* msecs in bus, usecs for user */
+} BWL_POST_PACKED_STRUCT bus_metrics_t;
+
+/* Bus interface info for USB/HSIC */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_usb_hsic_stats {
+	uint16 type;	     /* WL_PWRSTATS_TYPE_USB_HSIC */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+
+	bus_metrics_t hsic;	/* stats from hsic bus driver */
+} BWL_POST_PACKED_STRUCT wl_pwr_usb_hsic_stats_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct pcie_bus_metrics {
+	uint32 d3_suspend_ct;	/* suspend count */
+	uint32 d0_resume_ct;	/* resume count */
+	uint32 perst_assrt_ct;	/* PERST# assert count */
+	uint32 perst_deassrt_ct;	/* PERST# de-assert count */
+	uint32 active_dur;	/* msecs */
+	uint32 d3_suspend_dur;	/* msecs */
+	uint32 perst_dur;	/* msecs */
+	uint32 l0_cnt;		/* L0 entry count */
+	uint32 l0_usecs;	/* L0 duration in usecs */
+	uint32 l1_cnt;		/* L1 entry count */
+	uint32 l1_usecs;	/* L1 duration in usecs */
+	uint32 l1_1_cnt;	/* L1_1ss entry count */
+	uint32 l1_1_usecs;	/* L1_1ss duration in usecs */
+	uint32 l1_2_cnt;	/* L1_2ss entry count */
+	uint32 l1_2_usecs;	/* L1_2ss duration in usecs */
+	uint32 l2_cnt;		/* L2 entry count */
+	uint32 l2_usecs;	/* L2 duration in usecs */
+} BWL_POST_PACKED_STRUCT pcie_bus_metrics_t;
+
+/* Bus interface info for PCIE */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_pcie_stats {
+	uint16 type;	     /* WL_PWRSTATS_TYPE_PCIE */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+	pcie_bus_metrics_t pcie;	/* stats from pcie bus driver */
+} BWL_POST_PACKED_STRUCT wl_pwr_pcie_stats_t;
+
+/* Scan information history per category */
+typedef BWL_PRE_PACKED_STRUCT struct scan_data {
+	uint32 count;		/* Number of scans performed */
+	uint32 dur;		/* Total time (in us) used */
+} BWL_POST_PACKED_STRUCT scan_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_scan_stats {
+	uint16 type;	     /* WL_PWRSTATS_TYPE_SCAN */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+
+	/* Scan history */
+	scan_data_t user_scans;	  /* User-requested scans: (i/e/p)scan */
+	scan_data_t assoc_scans;  /* Scans initiated by association requests */
+	scan_data_t roam_scans;	  /* Scans initiated by the roam engine */
+	scan_data_t pno_scans[8]; /* For future PNO bucketing (BSSID, SSID, etc) */
+	scan_data_t other_scans;  /* Scan engine usage not assigned to the above */
+} BWL_POST_PACKED_STRUCT wl_pwr_scan_stats_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_connect_stats {
+	uint16 type;	     /* WL_PWRSTATS_TYPE_SCAN */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+
+	/* Connection (Association + Key exchange) data */
+	uint32 count;	/* Number of connections performed */
+	uint32 dur;		/* Total time (in ms) used */
+} BWL_POST_PACKED_STRUCT wl_pwr_connect_stats_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pwr_phy_stats {
+	uint16 type;	    /* WL_PWRSTATS_TYPE_PHY */
+	uint16 len;	    /* Up to 4K-1, top 4 bits are reserved */
+	uint32 tx_dur;	    /* TX Active duration in us */
+	uint32 rx_dur;	    /* RX Active duration in us */
+} BWL_POST_PACKED_STRUCT wl_pwr_phy_stats_t;
+
+
+/* ##### End of Power Stats section ##### */
+
+/* IPV4 Arp offloads for ndis context */
+BWL_PRE_PACKED_STRUCT struct hostip_id {
+	struct ipv4_addr ipa;
+	uint8 id;
+} BWL_POST_PACKED_STRUCT;
+
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pfn_roam_thresh {
+	uint32 pfn_alert_thresh; /* time in ms */
+	uint32 roam_alert_thresh; /* time in ms */
+} BWL_POST_PACKED_STRUCT wl_pfn_roam_thresh_t;
+
+
+/* Reasons for wl_pmalert_t */
+#define PM_DUR_EXCEEDED			(1<<0)
+#define MPC_DUR_EXCEEDED		(1<<1)
+#define ROAM_ALERT_THRESH_EXCEEDED	(1<<2)
+#define PFN_ALERT_THRESH_EXCEEDED	(1<<3)
+#define CONST_AWAKE_DUR_ALERT		(1<<4)
+#define CONST_AWAKE_DUR_RECOVERY	(1<<5)
+
+#define MIN_PM_ALERT_LEN 9
+
+/* Data sent in EXCESS_PM_WAKE event */
+#define WL_PM_ALERT_VERSION 3
+
+#define MAX_P2P_BSS_DTIM_PRD 4
+
+/* This structure is for version 3; version 2 will be deprecated in by FW */
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert {
+	uint16 version;		/* Version = 3 is TLV format */
+	uint16 length;		/* Length of entire structure */
+	uint32 reasons;		/* reason(s) for pm_alert */
+	uint8 data[1];		/* TLV data, a series of structures,
+				 * each starting with type and length.
+				 *
+				 * Padded as necessary so each section
+				 * starts on a 4-byte boundary.
+				 *
+				 * Both type and len are uint16, but the
+				 * upper nibble of length is reserved so
+				 * valid len values are 0-4095.
+				*/
+} BWL_POST_PACKED_STRUCT wl_pmalert_t;
+
+/* Type values for the data section */
+#define WL_PMALERT_FIXED	0 /* struct wl_pmalert_fixed_t, fixed fields */
+#define WL_PMALERT_PMSTATE	1 /* struct wl_pmalert_pmstate_t, variable */
+#define WL_PMALERT_EVENT_DUR	2 /* struct wl_pmalert_event_dur_t, variable */
+#define WL_PMALERT_UCODE_DBG	3 /* struct wl_pmalert_ucode_dbg_t, variable */
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_fixed {
+	uint16 type;	     /* WL_PMALERT_FIXED */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+	uint32 prev_stats_time;	/* msecs */
+	uint32 curr_time;	/* ms */
+	uint32 prev_pm_dur;	/* usecs */
+	uint32 pm_dur;		/* Total sleep time in PM, usecs */
+	uint32 prev_mpc_dur;	/* usecs */
+	uint32 mpc_dur;		/* Total sleep time in MPC, usecs */
+	uint32 hw_macc;		/* HW maccontrol */
+	uint32 sw_macc;		/* SW maccontrol */
+
+	/* int32 drifts = remote - local; +ve drift -> local-clk slow */
+	int32 last_drift;	/* Most recent TSF drift from beacon */
+	int32 min_drift;	/* Min TSF drift from beacon in magnitude */
+	int32 max_drift;	/* Max TSF drift from beacon in magnitude */
+
+	uint32 avg_drift;	/* Avg TSF drift from beacon */
+	uint32 drift_cnt;	/* Count of drift readings over which avg_drift was computed */
+	uint32 frts_time;	/* Cumulative ms spent in frts since driver load */
+	uint32 frts_end_cnt;	/* No of times frts ended since driver load */
+} BWL_POST_PACKED_STRUCT wl_pmalert_fixed_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_pmstate {
+	uint16 type;	     /* WL_PMALERT_PMSTATE */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+
+	uint8 pmwake_idx;   /* for stepping through pm_state */
+	uint8 pad[3];
+	/* Array of pmstate; len of array is based on tlv len */
+	wlc_pm_debug_t pmstate[1];
+} BWL_POST_PACKED_STRUCT wl_pmalert_pmstate_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_event_dur {
+	uint16 type;	     /* WL_PMALERT_EVENT_DUR */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+
+	/* Array of event_dur, len of array is based on tlv len */
+	uint32 event_dur[1];
+} BWL_POST_PACKED_STRUCT wl_pmalert_event_dur_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_pmalert_ucode_dbg {
+	uint16 type;	     /* WL_PMALERT_UCODE_DBG */
+	uint16 len;	     /* Up to 4K-1, top 4 bits are reserved */
+	uint32 macctrl;
+	uint16 m_p2p_hps;
+	uint32 psm_brc;
+	uint32 ifsstat;
+	uint16 m_p2p_bss_dtim_prd[MAX_P2P_BSS_DTIM_PRD];
+	uint32 psmdebug[20];
+	uint32 phydebug[20];
+} BWL_POST_PACKED_STRUCT wl_pmalert_ucode_dbg_t;
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+
+/* Structures and constants used for "vndr_ie" IOVar interface */
+#define VNDR_IE_CMD_LEN		4	/* length of the set command string:
+					 * "add", "del" (+ NUL)
+					 */
+
+#define VNDR_IE_INFO_HDR_LEN	(sizeof(uint32))
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 pktflag;			/* bitmask indicating which packet(s) contain this IE */
+	vndr_ie_t vndr_ie_data;		/* vendor IE data */
+} BWL_POST_PACKED_STRUCT vndr_ie_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	int iecount;			/* number of entries in the vndr_ie_list[] array */
+	vndr_ie_info_t vndr_ie_list[1];	/* variable size list of vndr_ie_info_t structs */
+} BWL_POST_PACKED_STRUCT vndr_ie_buf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	char cmd[VNDR_IE_CMD_LEN];	/* vndr_ie IOVar set command : "add", "del" + NUL */
+	vndr_ie_buf_t vndr_ie_buffer;	/* buffer containing Vendor IE list information */
+} BWL_POST_PACKED_STRUCT vndr_ie_setbuf_t;
+
+/* tag_ID/length/value_buffer tuple */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint8	id;
+	uint8	len;
+	uint8	data[1];
+} BWL_POST_PACKED_STRUCT tlv_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 pktflag;			/* bitmask indicating which packet(s) contain this IE */
+	tlv_t ie_data;		/* IE data */
+} BWL_POST_PACKED_STRUCT ie_info_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	int iecount;			/* number of entries in the ie_list[] array */
+	ie_info_t ie_list[1];	/* variable size list of ie_info_t structs */
+} BWL_POST_PACKED_STRUCT ie_buf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	char cmd[VNDR_IE_CMD_LEN];	/* ie IOVar set command : "add" + NUL */
+	ie_buf_t ie_buffer;	/* buffer containing IE list information */
+} BWL_POST_PACKED_STRUCT ie_setbuf_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 pktflag;		/* bitmask indicating which packet(s) contain this IE */
+	uint8 id;		/* IE type */
+} BWL_POST_PACKED_STRUCT ie_getbuf_t;
+
+/* structures used to define format of wps ie data from probe requests */
+/* passed up to applications via iovar "prbreq_wpsie" */
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_hdr {
+	struct ether_addr staAddr;
+	uint16 ieLen;
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_hdr_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_data {
+	sta_prbreq_wps_ie_hdr_t hdr;
+	uint8 ieData[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct sta_prbreq_wps_ie_list {
+	uint32 totLen;
+	uint8 ieDataList[1];
+} BWL_POST_PACKED_STRUCT sta_prbreq_wps_ie_list_t;
+
+
+#ifdef WLMEDIA_TXFAILEVENT
+typedef BWL_PRE_PACKED_STRUCT struct {
+	char   dest[ETHER_ADDR_LEN]; /* destination MAC */
+	uint8  prio;            /* Packet Priority */
+	uint8  flags;           /* Flags           */
+	uint32 tsf_l;           /* TSF timer low   */
+	uint32 tsf_h;           /* TSF timer high  */
+	uint16 rates;           /* Main Rates      */
+	uint16 txstatus;        /* TX Status       */
+} BWL_POST_PACKED_STRUCT txfailinfo_t;
+#endif /* WLMEDIA_TXFAILEVENT */
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 flags;
+	chanspec_t chanspec;			/* txpwr report for this channel */
+	chanspec_t local_chanspec;		/* channel on which we are associated */
+	uint8 local_max;			/* local max according to the AP */
+	uint8 local_constraint;			/* local constraint according to the AP */
+	int8  antgain[2];			/* Ant gain for each band - from SROM */
+	uint8 rf_cores;				/* count of RF Cores being reported */
+	uint8 est_Pout[4];			/* Latest tx power out estimate per RF chain */
+	uint8 est_Pout_act[4]; /* Latest tx power out estimate per RF chain w/o adjustment */
+	uint8 est_Pout_cck;			/* Latest CCK tx power out estimate */
+	uint8 tx_power_max[4];		/* Maximum target power among all rates */
+	uint tx_power_max_rate_ind[4];		/* Index of the rate with the max target power */
+	int8 sar;					/* SAR limit for display by wl executable */
+	int8 channel_bandwidth;		/* 20, 40 or 80 MHz bandwidth? */
+	uint8 version;				/* Version of the data format wlu <--> driver */
+	uint8 display_core;			/* Displayed curpower core */
+	int8 target_offsets[4];		/* Target power offsets for current rate per core */
+	uint32 last_tx_ratespec;	/* Ratespec for last transmition */
+	uint   user_target;		/* user limit */
+	uint32 ppr_len;		/* length of each ppr serialization buffer */
+	int8 SARLIMIT[MAX_STREAMS_SUPPORTED];
+	uint8  pprdata[1];		/* ppr serialization buffer */
+} BWL_POST_PACKED_STRUCT tx_pwr_rpt_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	struct ipv4_addr	ipv4_addr;
+	struct ether_addr nexthop;
+} BWL_POST_PACKED_STRUCT ibss_route_entry_t;
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint32 num_entry;
+	ibss_route_entry_t route_entry[1];
+} BWL_POST_PACKED_STRUCT ibss_route_tbl_t;
+
+#define MAX_IBSS_ROUTE_TBL_ENTRY	64
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+#define TXPWR_TARGET_VERSION  0
+typedef BWL_PRE_PACKED_STRUCT struct {
+	int32 version;		/* version number */
+	chanspec_t chanspec;	/* txpwr report for this channel */
+	int8 txpwr[WL_STA_ANT_MAX]; /* Max tx target power, in qdb */
+	uint8 rf_cores;		/* count of RF Cores being reported */
+} BWL_POST_PACKED_STRUCT txpwr_target_max_t;
+
+#define BSS_PEER_INFO_PARAM_CUR_VER	0
+/* Input structure for IOV_BSS_PEER_INFO */
+typedef BWL_PRE_PACKED_STRUCT	struct {
+	uint16			version;
+	struct	ether_addr ea;	/* peer MAC address */
+} BWL_POST_PACKED_STRUCT bss_peer_info_param_t;
+
+#define BSS_PEER_INFO_CUR_VER		0
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16			version;
+	struct ether_addr	ea;
+	int32			rssi;
+	uint32			tx_rate;	/* current tx rate */
+	uint32			rx_rate;	/* current rx rate */
+	wl_rateset_t		rateset;	/* rateset in use */
+	uint32			age;		/* age in seconds */
+} BWL_POST_PACKED_STRUCT bss_peer_info_t;
+
+#define BSS_PEER_LIST_INFO_CUR_VER	0
+
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16			version;
+	uint16			bss_peer_info_len;	/* length of bss_peer_info_t */
+	uint32			count;			/* number of peer info */
+	bss_peer_info_t		peer_info[1];		/* peer info */
+} BWL_POST_PACKED_STRUCT bss_peer_list_info_t;
+
+#define BSS_PEER_LIST_INFO_FIXED_LEN OFFSETOF(bss_peer_list_info_t, peer_info)
+
+#define AIBSS_BCN_FORCE_CONFIG_VER_0	0
+
+/* structure used to configure AIBSS beacon force xmit */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16  version;
+	uint16	len;
+	uint32 initial_min_bcn_dur;	/* dur in ms to check a bcn in bcn_flood period */
+	uint32 min_bcn_dur;	/* dur in ms to check a bcn after bcn_flood period */
+	uint32 bcn_flood_dur; /* Initial bcn xmit period in ms */
+} BWL_POST_PACKED_STRUCT aibss_bcn_force_config_t;
+
+#define AIBSS_TXFAIL_CONFIG_VER_0    0
+
+/* structure used to configure aibss tx fail event */
+typedef BWL_PRE_PACKED_STRUCT struct {
+	uint16  version;
+	uint16  len;
+	uint32 bcn_timeout;     /* dur in seconds to receive 1 bcn */
+	uint32 max_tx_retry;     /* no of consecutive no acks to send txfail event */
+} BWL_POST_PACKED_STRUCT aibss_txfail_config_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_aibss_if {
+	uint16 version;
+	uint16 len;
+	uint32 flags;
+	struct ether_addr addr;
+	chanspec_t chspec;
+} BWL_POST_PACKED_STRUCT wl_aibss_if_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wlc_ipfo_route_entry {
+	struct ipv4_addr ip_addr;
+	struct ether_addr nexthop;
+} BWL_POST_PACKED_STRUCT wlc_ipfo_route_entry_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wlc_ipfo_route_tbl {
+	uint32 num_entry;
+	wlc_ipfo_route_entry_t route_entry[1];
+} BWL_POST_PACKED_STRUCT wlc_ipfo_route_tbl_t;
+
+#define WL_IPFO_ROUTE_TBL_FIXED_LEN 4
+#define WL_MAX_IPFO_ROUTE_TBL_ENTRY	64
+
+/* no strict structure packing */
+#include <packed_section_end.h>
+
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+	/* Global ASSERT Logging */
+#define ASSERTLOG_CUR_VER	0x0100
+#define MAX_ASSRTSTR_LEN	64
+
+	typedef struct assert_record {
+		uint32 time;
+		uint8 seq_num;
+		char str[MAX_ASSRTSTR_LEN];
+	} assert_record_t;
+
+	typedef struct assertlog_results {
+		uint16 version;
+		uint16 record_len;
+		uint32 num;
+		assert_record_t logs[1];
+	} assertlog_results_t;
+
+#define LOGRRC_FIX_LEN	8
+#define IOBUF_ALLOWED_NUM_OF_LOGREC(type, len) ((len - LOGRRC_FIX_LEN)/sizeof(type))
+
+#ifdef BCMWAPI_WAI
+#define IV_LEN 16
+	struct wapi_sta_msg_t
+	{
+		uint16	msg_type;
+		uint16	datalen;
+		uint8	vap_mac[6];
+		uint8	reserve_data1[2];
+		uint8	sta_mac[6];
+		uint8	reserve_data2[2];
+		uint8	gsn[IV_LEN];
+		uint8	wie[256];
+	};
+#endif /* BCMWAPI_WAI */
+
+	/* chanim acs record */
+	typedef struct {
+		bool valid;
+		uint8 trigger;
+		chanspec_t selected_chspc;
+		int8 bgnoise;
+		uint32 glitch_cnt;
+		uint8 ccastats;
+		uint timestamp;
+	} chanim_acs_record_t;
+
+	typedef struct {
+		chanim_acs_record_t acs_record[CHANIM_ACS_RECORD];
+		uint8 count;
+		uint timestamp;
+	} wl_acs_record_t;
+
+	typedef struct chanim_stats {
+		uint32 glitchcnt;               /* normalized as per second count */
+		uint32 badplcp;                 /* normalized as per second count */
+		uint8 ccastats[CCASTATS_MAX];   /* normalized as 0-255 */
+		int8 bgnoise;			/* background noise level (in dBm) */
+		chanspec_t chanspec;
+		uint32 timestamp;
+		uint32 bphy_glitchcnt;          /* normalized as per second count */
+		uint32 bphy_badplcp;            /* normalized as per second count */
+		uint8 chan_idle;                /* normalized as 0~255 */
+	} chanim_stats_t;
+
+#define WL_CHANIM_STATS_VERSION 2
+
+typedef struct {
+	uint32 buflen;
+	uint32 version;
+	uint32 count;
+	chanim_stats_t stats[1];
+} wl_chanim_stats_t;
+
+#define WL_CHANIM_STATS_FIXED_LEN OFFSETOF(wl_chanim_stats_t, stats)
+
+/* Noise measurement metrics. */
+#define NOISE_MEASURE_KNOISE	0x1
+
+/* scb probe parameter */
+typedef struct {
+	uint32 scb_timeout;
+	uint32 scb_activity_time;
+	uint32 scb_max_probe;
+} wl_scb_probe_t;
+
+/* structure/defines for selective mgmt frame (smf) stats support */
+
+#define SMFS_VERSION 1
+/* selected mgmt frame (smf) stats element */
+typedef struct wl_smfs_elem {
+	uint32 count;
+	uint16 code;  /* SC or RC code */
+} wl_smfs_elem_t;
+
+typedef struct wl_smf_stats {
+	uint32 version;
+	uint16 length;	/* reserved for future usage */
+	uint8 type;
+	uint8 codetype;
+	uint32 ignored_cnt;
+	uint32 malformed_cnt;
+	uint32 count_total; /* count included the interested group */
+	wl_smfs_elem_t elem[1];
+} wl_smf_stats_t;
+
+#define WL_SMFSTATS_FIXED_LEN OFFSETOF(wl_smf_stats_t, elem);
+
+enum {
+	SMFS_CODETYPE_SC,
+	SMFS_CODETYPE_RC
+};
+
+typedef enum smfs_type {
+	SMFS_TYPE_AUTH,
+	SMFS_TYPE_ASSOC,
+	SMFS_TYPE_REASSOC,
+	SMFS_TYPE_DISASSOC_TX,
+	SMFS_TYPE_DISASSOC_RX,
+	SMFS_TYPE_DEAUTH_TX,
+	SMFS_TYPE_DEAUTH_RX,
+	SMFS_TYPE_MAX
+} smfs_type_t;
+
+#ifdef PHYMON
+
+#define PHYMON_VERSION 1
+
+typedef struct wl_phycal_core_state {
+	/* Tx IQ/LO calibration coeffs */
+	int16 tx_iqlocal_a;
+	int16 tx_iqlocal_b;
+	int8 tx_iqlocal_ci;
+	int8 tx_iqlocal_cq;
+	int8 tx_iqlocal_di;
+	int8 tx_iqlocal_dq;
+	int8 tx_iqlocal_ei;
+	int8 tx_iqlocal_eq;
+	int8 tx_iqlocal_fi;
+	int8 tx_iqlocal_fq;
+
+	/* Rx IQ calibration coeffs */
+	int16 rx_iqcal_a;
+	int16 rx_iqcal_b;
+
+	uint8 tx_iqlocal_pwridx; /* Tx Power Index for Tx IQ/LO calibration */
+	uint32 papd_epsilon_table[64]; /* PAPD epsilon table */
+	int16 papd_epsilon_offset; /* PAPD epsilon offset */
+	uint8 curr_tx_pwrindex; /* Tx power index */
+	int8 idle_tssi; /* Idle TSSI */
+	int8 est_tx_pwr; /* Estimated Tx Power (dB) */
+	int8 est_rx_pwr; /* Estimated Rx Power (dB) from RSSI */
+	uint16 rx_gaininfo; /* Rx gain applied on last Rx pkt */
+	uint16 init_gaincode; /* initgain required for ACI */
+	int8 estirr_tx;
+	int8 estirr_rx;
+
+} wl_phycal_core_state_t;
+
+typedef struct wl_phycal_state {
+	int version;
+	int8 num_phy_cores; /* number of cores */
+	int8 curr_temperature; /* on-chip temperature sensor reading */
+	chanspec_t chspec; /* channspec for this state */
+	bool aci_state; /* ACI state: ON/OFF */
+	uint16 crsminpower; /* crsminpower required for ACI */
+	uint16 crsminpowerl; /* crsminpowerl required for ACI */
+	uint16 crsminpoweru; /* crsminpoweru required for ACI */
+	wl_phycal_core_state_t phycal_core[1];
+} wl_phycal_state_t;
+
+#define WL_PHYCAL_STAT_FIXED_LEN OFFSETOF(wl_phycal_state_t, phycal_core)
+#endif /* PHYMON */
+
+/* discovery state */
+typedef struct wl_p2p_disc_st {
+	uint8 state;	/* see state */
+	chanspec_t chspec;	/* valid in listen state */
+	uint16 dwell;	/* valid in listen state, in ms */
+} wl_p2p_disc_st_t;
+
+/* scan request */
+typedef struct wl_p2p_scan {
+	uint8 type;		/* 'S' for WLC_SCAN, 'E' for "escan" */
+	uint8 reserved[3];
+	/* scan or escan parms... */
+} wl_p2p_scan_t;
+
+/* i/f request */
+typedef struct wl_p2p_if {
+	struct ether_addr addr;
+	uint8 type;	/* see i/f type */
+	chanspec_t chspec;	/* for p2p_ifadd GO */
+} wl_p2p_if_t;
+
+/* i/f query */
+typedef struct wl_p2p_ifq {
+	uint bsscfgidx;
+	char ifname[BCM_MSG_IFNAME_MAX];
+} wl_p2p_ifq_t;
+
+/* OppPS & CTWindow */
+typedef struct wl_p2p_ops {
+	uint8 ops;	/* 0: disable 1: enable */
+	uint8 ctw;	/* >= 10 */
+} wl_p2p_ops_t;
+
+/* absence and presence request */
+typedef struct wl_p2p_sched_desc {
+	uint32 start;
+	uint32 interval;
+	uint32 duration;
+	uint32 count;	/* see count */
+} wl_p2p_sched_desc_t;
+
+typedef struct wl_p2p_sched {
+	uint8 type;	/* see schedule type */
+	uint8 action;	/* see schedule action */
+	uint8 option;	/* see schedule option */
+	wl_p2p_sched_desc_t desc[1];
+} wl_p2p_sched_t;
+
+typedef struct wl_p2p_wfds_hash {
+	uint32	advt_id;
+	uint16	nw_cfg_method;
+	uint8	wfds_hash[6];
+	uint8	name_len;
+	uint8	service_name[MAX_WFDS_SVC_NAME_LEN];
+} wl_p2p_wfds_hash_t;
+
+typedef struct wl_bcmdcs_data {
+	uint reason;
+	chanspec_t chspec;
+} wl_bcmdcs_data_t;
+
+
+/* NAT configuration */
+typedef struct {
+	uint32 ipaddr;		/* interface ip address */
+	uint32 ipaddr_mask;	/* interface ip address mask */
+	uint32 ipaddr_gateway;	/* gateway ip address */
+	uint8 mac_gateway[6];	/* gateway mac address */
+	uint32 ipaddr_dns;	/* DNS server ip address, valid only for public if */
+	uint8 mac_dns[6];	/* DNS server mac address,  valid only for public if */
+	uint8 GUID[38];		/* interface GUID */
+} nat_if_info_t;
+
+typedef struct {
+	uint op;		/* operation code */
+	bool pub_if;		/* set for public if, clear for private if */
+	nat_if_info_t if_info;	/* interface info */
+} nat_cfg_t;
+
+typedef struct {
+	int state;	/* NAT state returned */
+} nat_state_t;
+
+
+#define BTA_STATE_LOG_SZ	64
+
+/* BTAMP Statemachine states */
+enum {
+	HCIReset = 1,
+	HCIReadLocalAMPInfo,
+	HCIReadLocalAMPASSOC,
+	HCIWriteRemoteAMPASSOC,
+	HCICreatePhysicalLink,
+	HCIAcceptPhysicalLinkRequest,
+	HCIDisconnectPhysicalLink,
+	HCICreateLogicalLink,
+	HCIAcceptLogicalLink,
+	HCIDisconnectLogicalLink,
+	HCILogicalLinkCancel,
+	HCIAmpStateChange,
+	HCIWriteLogicalLinkAcceptTimeout
+};
+
+typedef struct flush_txfifo {
+	uint32 txfifobmp;
+	uint32 hwtxfifoflush;
+	struct ether_addr ea;
+} flush_txfifo_t;
+
+enum {
+	SPATIAL_MODE_2G_IDX = 0,
+	SPATIAL_MODE_5G_LOW_IDX,
+	SPATIAL_MODE_5G_MID_IDX,
+	SPATIAL_MODE_5G_HIGH_IDX,
+	SPATIAL_MODE_5G_UPPER_IDX,
+	SPATIAL_MODE_MAX_IDX
+};
+
+#define WLC_TXCORE_MAX	4	/* max number of txcore supports */
+#define WLC_SUBBAND_MAX	4	/* max number of sub-band supports */
+typedef struct {
+	uint8	band2g[WLC_TXCORE_MAX];
+	uint8	band5g[WLC_SUBBAND_MAX][WLC_TXCORE_MAX];
+} sar_limit_t;
+
+#define WLC_TXCAL_CORE_MAX 2	/* max number of txcore supports for txcal */
+#define MAX_NUM_TXCAL_MEAS 128
+
+typedef struct wl_txcal_meas {
+	uint8 tssi[WLC_TXCAL_CORE_MAX][MAX_NUM_TXCAL_MEAS];
+	int16 pwr[WLC_TXCAL_CORE_MAX][MAX_NUM_TXCAL_MEAS];
+	uint8 valid_cnt;
+} wl_txcal_meas_t;
+
+typedef struct wl_txcal_power_tssi {
+	uint8 set_core;
+	uint8 channel;
+	int16 pwr_start[WLC_TXCAL_CORE_MAX];
+	uint8 num_entries[WLC_TXCAL_CORE_MAX];
+	uint8 tssi[WLC_TXCAL_CORE_MAX][MAX_NUM_TXCAL_MEAS];
+	bool gen_tbl;
+} wl_txcal_power_tssi_t;
+
+/* IOVAR "mempool" parameter. Used to retrieve a list of memory pool statistics. */
+typedef struct wl_mempool_stats {
+	int	num;		/* Number of memory pools */
+	bcm_mp_stats_t s[1];	/* Variable array of memory pool stats. */
+} wl_mempool_stats_t;
+
+typedef struct {
+	uint32 ipaddr;
+	uint32 ipaddr_netmask;
+	uint32 ipaddr_gateway;
+} nwoe_ifconfig_t;
+
+/* Traffic management priority classes */
+typedef enum trf_mgmt_priority_class {
+	trf_mgmt_priority_low           = 0,        /* Maps to 802.1p BK */
+	trf_mgmt_priority_medium        = 1,        /* Maps to 802.1p BE */
+	trf_mgmt_priority_high          = 2,        /* Maps to 802.1p VI */
+	trf_mgmt_priority_nochange	= 3,	    /* do not update the priority */
+	trf_mgmt_priority_invalid       = (trf_mgmt_priority_nochange + 1)
+} trf_mgmt_priority_class_t;
+
+/* Traffic management configuration parameters */
+typedef struct trf_mgmt_config {
+	uint32  trf_mgmt_enabled;                           /* 0 - disabled, 1 - enabled */
+	uint32  flags;                                      /* See TRF_MGMT_FLAG_xxx defines */
+	uint32  host_ip_addr;                               /* My IP address to determine subnet */
+	uint32  host_subnet_mask;                           /* My subnet mask */
+	uint32  downlink_bandwidth;                         /* In units of kbps */
+	uint32  uplink_bandwidth;                           /* In units of kbps */
+	uint32  min_tx_bandwidth[TRF_MGMT_MAX_PRIORITIES];  /* Minimum guaranteed tx bandwidth */
+	uint32  min_rx_bandwidth[TRF_MGMT_MAX_PRIORITIES];  /* Minimum guaranteed rx bandwidth */
+} trf_mgmt_config_t;
+
+/* Traffic management filter */
+typedef struct trf_mgmt_filter {
+	struct ether_addr           dst_ether_addr;         /* His L2 address */
+	uint32                      dst_ip_addr;            /* His IP address */
+	uint16                      dst_port;               /* His L4 port */
+	uint16                      src_port;               /* My L4 port */
+	uint16                      prot;                   /* L4 protocol (only TCP or UDP) */
+	uint16                      flags;                  /* TBD. For now, this must be zero. */
+	trf_mgmt_priority_class_t   priority;               /* Priority for filtered packets */
+	uint32                      dscp;                   /* DSCP */
+} trf_mgmt_filter_t;
+
+/* Traffic management filter list (variable length) */
+typedef struct trf_mgmt_filter_list     {
+	uint32              num_filters;
+	trf_mgmt_filter_t   filter[1];
+} trf_mgmt_filter_list_t;
+
+/* Traffic management global info used for all queues */
+typedef struct trf_mgmt_global_info {
+	uint32  maximum_bytes_per_second;
+	uint32  maximum_bytes_per_sampling_period;
+	uint32  total_bytes_consumed_per_second;
+	uint32  total_bytes_consumed_per_sampling_period;
+	uint32  total_unused_bytes_per_sampling_period;
+} trf_mgmt_global_info_t;
+
+/* Traffic management shaping info per priority queue */
+typedef struct trf_mgmt_shaping_info {
+	uint32  gauranteed_bandwidth_percentage;
+	uint32  guaranteed_bytes_per_second;
+	uint32  guaranteed_bytes_per_sampling_period;
+	uint32  num_bytes_produced_per_second;
+	uint32  num_bytes_consumed_per_second;
+	uint32  num_queued_packets;                         /* Number of packets in queue */
+	uint32  num_queued_bytes;                           /* Number of bytes in queue */
+} trf_mgmt_shaping_info_t;
+
+/* Traffic management shaping info array */
+typedef struct trf_mgmt_shaping_info_array {
+	trf_mgmt_global_info_t   tx_global_shaping_info;
+	trf_mgmt_shaping_info_t  tx_queue_shaping_info[TRF_MGMT_MAX_PRIORITIES];
+	trf_mgmt_global_info_t   rx_global_shaping_info;
+	trf_mgmt_shaping_info_t  rx_queue_shaping_info[TRF_MGMT_MAX_PRIORITIES];
+} trf_mgmt_shaping_info_array_t;
+
+
+/* Traffic management statistical counters */
+typedef struct trf_mgmt_stats {
+	uint32  num_processed_packets;      /* Number of packets processed */
+	uint32  num_processed_bytes;        /* Number of bytes processed */
+	uint32  num_discarded_packets;      /* Number of packets discarded from queue */
+} trf_mgmt_stats_t;
+
+/* Traffic management statisics array */
+typedef struct trf_mgmt_stats_array {
+	trf_mgmt_stats_t  tx_queue_stats[TRF_MGMT_MAX_PRIORITIES];
+	trf_mgmt_stats_t  rx_queue_stats[TRF_MGMT_MAX_PRIORITIES];
+} trf_mgmt_stats_array_t;
+
+typedef struct powersel_params {
+	/* LPC Params exposed via IOVAR */
+	int32		tp_ratio_thresh;  /* Throughput ratio threshold */
+	uint8		rate_stab_thresh; /* Thresh for rate stability based on nupd */
+	uint8		pwr_stab_thresh; /* Number of successes before power step down */
+	uint8		pwr_sel_exp_time; /* Time lapse for expiry of database */
+} powersel_params_t;
+
+typedef struct lpc_params {
+	/* LPC Params exposed via IOVAR */
+	uint8		rate_stab_thresh; /* Thresh for rate stability based on nupd */
+	uint8		pwr_stab_thresh; /* Number of successes before power step down */
+	uint8		lpc_exp_time; /* Time lapse for expiry of database */
+	uint8		pwrup_slow_step; /* Step size for slow step up */
+	uint8		pwrup_fast_step; /* Step size for fast step up */
+	uint8		pwrdn_slow_step; /* Step size for slow step down */
+} lpc_params_t;
+
+/* tx pkt delay statistics */
+#define	SCB_RETRY_SHORT_DEF	7	/* Default Short retry Limit */
+#define WLPKTDLY_HIST_NBINS	16	/* number of bins used in the Delay histogram */
+
+/* structure to store per-AC delay statistics */
+typedef struct scb_delay_stats {
+	uint32 txmpdu_lost;	/* number of MPDUs lost */
+	uint32 txmpdu_cnt[SCB_RETRY_SHORT_DEF]; /* retry times histogram */
+	uint32 delay_sum[SCB_RETRY_SHORT_DEF]; /* cumulative packet latency */
+	uint32 delay_min;	/* minimum packet latency observed */
+	uint32 delay_max;	/* maximum packet latency observed */
+	uint32 delay_avg;	/* packet latency average */
+	uint32 delay_hist[WLPKTDLY_HIST_NBINS];	/* delay histogram */
+} scb_delay_stats_t;
+
+/* structure for txdelay event */
+typedef struct txdelay_event {
+	uint8	status;
+	int		rssi;
+	chanim_stats_t		chanim_stats;
+	scb_delay_stats_t	delay_stats[AC_COUNT];
+} txdelay_event_t;
+
+/* structure for txdelay parameters */
+typedef struct txdelay_params {
+	uint16	ratio;	/* Avg Txdelay Delta */
+	uint8	cnt;	/* Sample cnt */
+	uint8	period;	/* Sample period */
+	uint8	tune;	/* Debug */
+} txdelay_params_t;
+
+enum {
+	WNM_SERVICE_DMS = 1,
+	WNM_SERVICE_FMS = 2,
+	WNM_SERVICE_TFS = 3
+};
+
+/* Definitions for WNM/NPS TCLAS */
+typedef struct wl_tclas {
+	uint8 user_priority;
+	uint8 fc_len;
+	dot11_tclas_fc_t fc;
+} wl_tclas_t;
+
+#define WL_TCLAS_FIXED_SIZE	OFFSETOF(wl_tclas_t, fc)
+
+typedef struct wl_tclas_list {
+	uint32 num;
+	wl_tclas_t tclas[1];
+} wl_tclas_list_t;
+
+/* Definitions for WNM/NPS Traffic Filter Service */
+typedef struct wl_tfs_req {
+	uint8 tfs_id;
+	uint8 tfs_actcode;
+	uint8 tfs_subelem_id;
+	uint8 send;
+} wl_tfs_req_t;
+
+typedef struct wl_tfs_filter {
+	uint8 status;			/* Status returned by the AP */
+	uint8 tclas_proc;		/* TCLAS processing value (0:and, 1:or)  */
+	uint8 tclas_cnt;		/* count of all wl_tclas_t in tclas array */
+	uint8 tclas[1];			/* VLA of wl_tclas_t */
+} wl_tfs_filter_t;
+#define WL_TFS_FILTER_FIXED_SIZE	OFFSETOF(wl_tfs_filter_t, tclas)
+
+typedef struct wl_tfs_fset {
+	struct ether_addr ea;		/* Address of AP/STA involved with this filter set */
+	uint8 tfs_id;			/* TFS ID field chosen by STA host */
+	uint8 status;			/* Internal status TFS_STATUS_xxx */
+	uint8 actcode;			/* Action code DOT11_TFS_ACTCODE_xxx */
+	uint8 token;			/* Token used in last request frame */
+	uint8 notify;			/* Notify frame sent/received because of this set */
+	uint8 filter_cnt;		/* count of all wl_tfs_filter_t in filter array */
+	uint8 filter[1];		/* VLA of wl_tfs_filter_t */
+} wl_tfs_fset_t;
+#define WL_TFS_FSET_FIXED_SIZE		OFFSETOF(wl_tfs_fset_t, filter)
+
+enum {
+	TFS_STATUS_DISABLED = 0,	/* TFS filter set disabled by user */
+	TFS_STATUS_DISABLING = 1,	/* Empty request just sent to AP */
+	TFS_STATUS_VALIDATED = 2,	/* Filter set validated by AP (but maybe not enabled!) */
+	TFS_STATUS_VALIDATING = 3,	/* Filter set just sent to AP */
+	TFS_STATUS_NOT_ASSOC = 4,	/* STA not associated */
+	TFS_STATUS_NOT_SUPPORT = 5,	/* TFS not supported by AP */
+	TFS_STATUS_DENIED = 6,		/* Filter set refused by AP (=> all sets are disabled!) */
+};
+
+typedef struct wl_tfs_status {
+	uint8 fset_cnt;			/* count of all wl_tfs_fset_t in fset array */
+	wl_tfs_fset_t fset[1];		/* VLA of wl_tfs_fset_t */
+} wl_tfs_status_t;
+
+typedef struct wl_tfs_set {
+	uint8 send;			/* Immediatly register registered sets on AP side */
+	uint8 tfs_id;			/* ID of a specific set (existing or new), or nul for all */
+	uint8 actcode;			/* Action code for this filter set */
+	uint8 tclas_proc;		/* TCLAS processing operator for this filter set */
+} wl_tfs_set_t;
+
+typedef struct wl_tfs_term {
+	uint8 del;			/* Delete internal set once confirmation received */
+	uint8 tfs_id;			/* ID of a specific set (existing), or nul for all */
+} wl_tfs_term_t;
+
+
+#define DMS_DEP_PROXY_ARP (1 << 0)
+
+/* Definitions for WNM/NPS Directed Multicast Service */
+enum {
+	DMS_STATUS_DISABLED = 0,	/* DMS desc disabled by user */
+	DMS_STATUS_ACCEPTED = 1,	/* Request accepted by AP */
+	DMS_STATUS_NOT_ASSOC = 2,	/* STA not associated */
+	DMS_STATUS_NOT_SUPPORT = 3,	/* DMS not supported by AP */
+	DMS_STATUS_DENIED = 4,		/* Request denied by AP */
+	DMS_STATUS_TERM = 5,		/* Request terminated by AP */
+	DMS_STATUS_REMOVING = 6,	/* Remove request just sent */
+	DMS_STATUS_ADDING = 7,		/* Add request just sent */
+	DMS_STATUS_ERROR = 8,		/* Non compliant AP behvior */
+	DMS_STATUS_IN_PROGRESS = 9, /* Request just sent */
+	DMS_STATUS_REQ_MISMATCH = 10 /* Conditions for sending DMS req not met */
+};
+
+typedef struct wl_dms_desc {
+	uint8 user_id;
+	uint8 status;
+	uint8 token;
+	uint8 dms_id;
+	uint8 tclas_proc;
+	uint8 mac_len;		/* length of all ether_addr in data array, 0 if STA */
+	uint8 tclas_len;	/* length of all wl_tclas_t in data array */
+	uint8 data[1];		/* VLA of 'ether_addr' and 'wl_tclas_t' (in this order ) */
+} wl_dms_desc_t;
+
+#define WL_DMS_DESC_FIXED_SIZE	OFFSETOF(wl_dms_desc_t, data)
+
+typedef struct wl_dms_status {
+	uint32 cnt;
+	wl_dms_desc_t desc[1];
+} wl_dms_status_t;
+
+typedef struct wl_dms_set {
+	uint8 send;
+	uint8 user_id;
+	uint8 tclas_proc;
+} wl_dms_set_t;
+
+typedef struct wl_dms_term {
+	uint8 del;
+	uint8 user_id;
+} wl_dms_term_t;
+
+typedef struct wl_service_term {
+	uint8 service;
+	union {
+		wl_dms_term_t dms;
+	} u;
+} wl_service_term_t;
+
+/* Definitions for WNM/NPS BSS Transistion */
+typedef struct wl_bsstrans_req {
+	uint16 tbtt;			/* time of BSS to end of life, in unit of TBTT */
+	uint16 dur;			/* time of BSS to keep off, in unit of minute */
+	uint8 reqmode;			/* request mode of BSS transition request */
+	uint8 unicast;			/* request by unicast or by broadcast */
+} wl_bsstrans_req_t;
+
+enum {
+	BSSTRANS_RESP_AUTO = 0,		/* Currently equivalent to ENABLE */
+	BSSTRANS_RESP_DISABLE = 1,	/* Never answer BSS Trans Req frames */
+	BSSTRANS_RESP_ENABLE = 2,	/* Always answer Req frames with preset data */
+	BSSTRANS_RESP_WAIT = 3,		/* Send ind, wait and/or send preset data (NOT IMPL) */
+	BSSTRANS_RESP_IMMEDIATE = 4	/* After an ind, set data and send resp (NOT IMPL) */
+};
+
+typedef struct wl_bsstrans_resp {
+	uint8 policy;
+	uint8 status;
+	uint8 delay;
+	struct ether_addr target;
+} wl_bsstrans_resp_t;
+
+/* "wnm_bsstrans_policy" argument programs behavior after BSSTRANS Req reception.
+ * BSS-Transition feature is used by multiple programs such as NPS-PF, VE-PF,
+ * Band-steering, Hotspot 2.0 and customer requirements. Each PF and its test plan
+ * mandates different behavior on receiving BSS-transition request. To accomodate
+ * such divergent behaviors these policies have been created.
+ */
+enum {
+	WL_BSSTRANS_POLICY_ROAM_ALWAYS = 0,	/* Roam (or disassociate) in all cases */
+	WL_BSSTRANS_POLICY_ROAM_IF_MODE = 1,	/* Roam only if requested by Request Mode field */
+	WL_BSSTRANS_POLICY_ROAM_IF_PREF = 2,	/* Roam only if Preferred BSS provided */
+	WL_BSSTRANS_POLICY_WAIT = 3,		/* Wait for deauth and send Accepted status */
+	WL_BSSTRANS_POLICY_PRODUCT = 4,		/* Policy for real product use cases (non-pf) */
+};
+
+/* Definitions for WNM/NPS TIM Broadcast */
+typedef struct wl_timbc_offset {
+	int16 offset;		/* offset in us */
+	uint16 fix_intv;	/* override interval sent from STA */
+	uint16 rate_override;	/* use rate override to send high rate TIM broadcast frame */
+	uint8 tsf_present;	/* show timestamp in TIM broadcast frame */
+} wl_timbc_offset_t;
+
+typedef struct wl_timbc_set {
+	uint8 interval;		/* Interval in DTIM wished or required. */
+	uint8 flags;		/* Bitfield described below */
+	uint16 rate_min;	/* Minimum rate required for High/Low TIM frames. Optionnal */
+	uint16 rate_max;	/* Maximum rate required for High/Low TIM frames. Optionnal */
+} wl_timbc_set_t;
+
+enum {
+	WL_TIMBC_SET_TSF_REQUIRED = 1,	/* Enable TIMBC only if TSF in TIM frames */
+	WL_TIMBC_SET_NO_OVERRIDE = 2,	/* ... if AP does not override interval */
+	WL_TIMBC_SET_PROXY_ARP = 4,	/* ... if AP support Proxy ARP */
+	WL_TIMBC_SET_DMS_ACCEPTED = 8	/* ... if all DMS desc have been accepted */
+};
+
+typedef struct wl_timbc_status {
+	uint8 status_sta;		/* Status from internal state machine (check below) */
+	uint8 status_ap;		/* From AP response frame (check 8.4.2.86 from 802.11) */
+	uint8 interval;
+	uint8 pad;
+	int32 offset;
+	uint16 rate_high;
+	uint16 rate_low;
+} wl_timbc_status_t;
+
+enum {
+	WL_TIMBC_STATUS_DISABLE = 0,		/* TIMBC disabled by user */
+	WL_TIMBC_STATUS_REQ_MISMATCH = 1,	/* AP settings do no match user requirements */
+	WL_TIMBC_STATUS_NOT_ASSOC = 2,		/* STA not associated */
+	WL_TIMBC_STATUS_NOT_SUPPORT = 3,	/* TIMBC not supported by AP */
+	WL_TIMBC_STATUS_DENIED = 4,		/* Req to disable TIMBC sent to AP */
+	WL_TIMBC_STATUS_ENABLE = 5		/* TIMBC enabled */
+};
+
+/* Definitions for PM2 Dynamic Fast Return To Sleep */
+typedef struct wl_pm2_sleep_ret_ext {
+	uint8 logic;			/* DFRTS logic: see WL_DFRTS_LOGIC_* below */
+	uint16 low_ms;			/* Low FRTS timeout */
+	uint16 high_ms;			/* High FRTS timeout */
+	uint16 rx_pkts_threshold;	/* switching threshold: # rx pkts */
+	uint16 tx_pkts_threshold;	/* switching threshold: # tx pkts */
+	uint16 txrx_pkts_threshold;	/* switching threshold: # (tx+rx) pkts */
+	uint32 rx_bytes_threshold;	/* switching threshold: # rx bytes */
+	uint32 tx_bytes_threshold;	/* switching threshold: # tx bytes */
+	uint32 txrx_bytes_threshold;	/* switching threshold: # (tx+rx) bytes */
+} wl_pm2_sleep_ret_ext_t;
+
+#define WL_DFRTS_LOGIC_OFF	0	/* Feature is disabled */
+#define WL_DFRTS_LOGIC_OR	1	/* OR all non-zero threshold conditions */
+#define WL_DFRTS_LOGIC_AND	2	/* AND all non-zero threshold conditions */
+
+/* Values for the passive_on_restricted_mode iovar.  When set to non-zero, this iovar
+ * disables automatic conversions of a channel from passively scanned to
+ * actively scanned.  These values only have an effect for country codes such
+ * as XZ where some 5 GHz channels are defined to be passively scanned.
+ */
+#define WL_PASSACTCONV_DISABLE_NONE	0	/* Enable permanent and temporary conversions */
+#define WL_PASSACTCONV_DISABLE_ALL	1	/* Disable permanent and temporary conversions */
+#define WL_PASSACTCONV_DISABLE_PERM	2	/* Disable only permanent conversions */
+
+/* Definitions for Reliable Multicast */
+#define WL_RMC_CNT_VERSION	   1
+#define WL_RMC_TR_VERSION	   1
+#define WL_RMC_MAX_CLIENT	   32
+#define WL_RMC_FLAG_INBLACKLIST	   1
+#define WL_RMC_FLAG_ACTIVEACKER	   2
+#define WL_RMC_FLAG_RELMCAST	   4
+#define WL_RMC_MAX_TABLE_ENTRY     4
+
+#define WL_RMC_VER		   1
+#define WL_RMC_INDEX_ACK_ALL       255
+#define WL_RMC_NUM_OF_MC_STREAMS   4
+#define WL_RMC_MAX_TRS_PER_GROUP   1
+#define WL_RMC_MAX_TRS_IN_ACKALL   1
+#define WL_RMC_ACK_MCAST0          0x02
+#define WL_RMC_ACK_MCAST_ALL       0x01
+#define WL_RMC_ACTF_TIME_MIN       300	 /* time in ms */
+#define WL_RMC_ACTF_TIME_MAX       20000 /* time in ms */
+#define WL_RMC_MAX_NUM_TRS	   32	 /* maximun transmitters allowed */
+#define WL_RMC_ARTMO_MIN           350	 /* time in ms */
+#define WL_RMC_ARTMO_MAX           40000	 /* time in ms */
+
+/* RMC events in action frames */
+enum rmc_opcodes {
+	RELMCAST_ENTRY_OP_DISABLE = 0,   /* Disable multi-cast group */
+	RELMCAST_ENTRY_OP_DELETE  = 1,   /* Delete multi-cast group */
+	RELMCAST_ENTRY_OP_ENABLE  = 2,   /* Enable multi-cast group */
+	RELMCAST_ENTRY_OP_ACK_ALL = 3    /* Enable ACK ALL bit in AMT */
+};
+
+/* RMC operational modes */
+enum rmc_modes {
+	WL_RMC_MODE_RECEIVER    = 0,	 /* Receiver mode by default */
+	WL_RMC_MODE_TRANSMITTER = 1,	 /* Transmitter mode using wl ackreq */
+	WL_RMC_MODE_INITIATOR   = 2	 /* Initiator mode using wl ackreq */
+};
+
+/* Each RMC mcast client info */
+typedef struct wl_relmcast_client {
+	uint8 flag;			/* status of client such as AR, R, or blacklisted */
+	int16 rssi;			/* rssi value of RMC client */
+	struct ether_addr addr;		/* mac address of RMC client */
+} wl_relmcast_client_t;
+
+/* RMC Counters */
+typedef struct wl_rmc_cnts {
+	uint16  version;		/* see definition of WL_CNT_T_VERSION */
+	uint16  length;			/* length of entire structure */
+	uint16	dupcnt;			/* counter for duplicate rmc MPDU */
+	uint16	ackreq_err;		/* counter for wl ackreq error    */
+	uint16	af_tx_err;		/* error count for action frame transmit   */
+	uint16	null_tx_err;		/* error count for rmc null frame transmit */
+	uint16	af_unicast_tx_err;	/* error count for rmc unicast frame transmit */
+	uint16	mc_no_amt_slot;		/* No mcast AMT entry available */
+	/* Unused. Keep for rom compatibility */
+	uint16	mc_no_glb_slot;		/* No mcast entry available in global table */
+	uint16	mc_not_mirrored;	/* mcast group is not mirrored */
+	uint16	mc_existing_tr;		/* mcast group is already taken by transmitter */
+	uint16	mc_exist_in_amt;	/* mcast group is already programmed in amt */
+	/* Unused. Keep for rom compatibility */
+	uint16	mc_not_exist_in_gbl;	/* mcast group is not in global table */
+	uint16	mc_not_exist_in_amt;	/* mcast group is not in AMT table */
+	uint16	mc_utilized;		/* mcast addressed is already taken */
+	uint16	mc_taken_other_tr;	/* multi-cast addressed is already taken */
+	uint32	rmc_rx_frames_mac;      /* no of mc frames received from mac */
+	uint32	rmc_tx_frames_mac;      /* no of mc frames transmitted to mac */
+	uint32	mc_null_ar_cnt;         /* no. of times NULL AR is received */
+	uint32	mc_ar_role_selected;	/* no. of times took AR role */
+	uint32	mc_ar_role_deleted;	/* no. of times AR role cancelled */
+	uint32	mc_noacktimer_expired;  /* no. of times noack timer expired */
+	uint16  mc_no_wl_clk;           /* no wl clk detected when trying to access amt */
+	uint16  mc_tr_cnt_exceeded;     /* No of transmitters in the network exceeded */
+} wl_rmc_cnts_t;
+
+/* RMC Status */
+typedef struct wl_relmcast_st {
+	uint8         ver;		/* version of RMC */
+	uint8         num;		/* number of clients detected by transmitter */
+	wl_relmcast_client_t clients[WL_RMC_MAX_CLIENT];
+	uint16        err;		/* error status (used in infra) */
+	uint16        actf_time;	/* action frame time period */
+} wl_relmcast_status_t;
+
+/* Entry for each STA/node */
+typedef struct wl_rmc_entry {
+	/* operation on multi-cast entry such add,
+	 * delete, ack-all
+	 */
+	int8    flag;
+	struct ether_addr addr;		/* multi-cast group mac address */
+} wl_rmc_entry_t;
+
+/* RMC table */
+typedef struct wl_rmc_entry_table {
+	uint8   index;			/* index to a particular mac entry in table */
+	uint8   opcode;			/* opcodes or operation on entry */
+	wl_rmc_entry_t entry[WL_RMC_MAX_TABLE_ENTRY];
+} wl_rmc_entry_table_t;
+
+typedef struct wl_rmc_trans_elem {
+	struct ether_addr tr_mac;	/* transmitter mac */
+	struct ether_addr ar_mac;	/* ar mac */
+	uint16 artmo;			/* AR timeout */
+	uint8 amt_idx;			/* amt table entry */
+	uint16 flag;			/* entry will be acked, not acked, programmed, full etc */
+} wl_rmc_trans_elem_t;
+
+/* RMC transmitters */
+typedef struct wl_rmc_trans_in_network {
+	uint8         ver;		/* version of RMC */
+	uint8         num_tr;		/* number of transmitters in the network */
+	wl_rmc_trans_elem_t trs[WL_RMC_MAX_NUM_TRS];
+} wl_rmc_trans_in_network_t;
+
+/* To update vendor specific ie for RMC */
+typedef struct wl_rmc_vsie {
+	uint8	oui[DOT11_OUI_LEN];
+	uint16	payload;	/* IE Data Payload */
+} wl_rmc_vsie_t;
+
+
+/* structures  & defines for proximity detection  */
+enum proxd_method {
+	PROXD_UNDEFINED_METHOD = 0,
+	PROXD_RSSI_METHOD = 1,
+	PROXD_TOF_METHOD = 2
+};
+
+/* structures for proximity detection device role */
+#define WL_PROXD_MODE_DISABLE	0
+#define WL_PROXD_MODE_NEUTRAL	1
+#define WL_PROXD_MODE_INITIATOR	2
+#define WL_PROXD_MODE_TARGET	3
+
+#define WL_PROXD_ACTION_STOP		0
+#define WL_PROXD_ACTION_START		1
+
+#define WL_PROXD_FLAG_TARGET_REPORT	0x1
+#define WL_PROXD_FLAG_REPORT_FAILURE	0x2
+#define WL_PROXD_FLAG_INITIATOR_REPORT	0x4
+#define WL_PROXD_FLAG_NOCHANSWT		0x8
+#define WL_PROXD_FLAG_NETRUAL		0x10
+#define WL_PROXD_FLAG_INITIATOR_RPTRTT	0x20
+#define WL_PROXD_FLAG_ONEWAY		0x40
+#define WL_PROXD_FLAG_SEQ_EN		0x80
+
+#define WL_PROXD_RANDOM_WAKEUP	0x8000
+
+typedef struct wl_proxd_iovar {
+	uint16	method;		/* Proxmity Detection method */
+	uint16	mode;		/* Mode (neutral, initiator, target) */
+} wl_proxd_iovar_t;
+
+/*
+ * structures for proximity detection parameters
+ * consists of two parts, common and method specific params
+ * common params should be placed at the beginning
+ */
+
+/* require strict packing */
+#include <packed_section_start.h>
+
+typedef	BWL_PRE_PACKED_STRUCT struct	wl_proxd_params_common	{
+	chanspec_t	chanspec;	/* channel spec */
+	int16		tx_power;	/* tx power of Proximity Detection(PD) frames (in dBm) */
+	uint16		tx_rate;	/* tx rate of PD rames  (in 500kbps units) */
+	uint16		timeout;	/* timeout value */
+	uint16		interval;	/* interval between neighbor finding attempts (in TU) */
+	uint16		duration;	/* duration of neighbor finding attempts (in ms) */
+} BWL_POST_PACKED_STRUCT wl_proxd_params_common_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_rssi_method {
+	chanspec_t	chanspec;	/* chanspec for home channel */
+	int16		tx_power;	/* tx power of Proximity Detection frames (in dBm) */
+	uint16		tx_rate;	/* tx rate of PD frames, 500kbps units */
+	uint16		timeout;	/* state machine wait timeout of the frames (in ms) */
+	uint16		interval;	/* interval between neighbor finding attempts (in TU) */
+	uint16		duration;	/* duration of neighbor finding attempts (in ms) */
+					/* method specific ones go after this line */
+	int16		rssi_thresh;	/* RSSI threshold (in dBm) */
+	uint16		maxconvergtmo;	/* max wait converge timeout (in ms) */
+} wl_proxd_params_rssi_method_t;
+
+#define Q1_NS			25	/* Q1 time units */
+
+#define TOF_BW_NUM		3	/* number of bandwidth that the TOF can support */
+#define TOF_BW_SEQ_NUM		(TOF_BW_NUM+2)	/* number of total index */
+enum tof_bw_index {
+	TOF_BW_20MHZ_INDEX = 0,
+	TOF_BW_40MHZ_INDEX = 1,
+	TOF_BW_80MHZ_INDEX = 2,
+	TOF_BW_SEQTX_INDEX = 3,
+	TOF_BW_SEQRX_INDEX = 4
+};
+
+#define BANDWIDTH_BASE	20	/* base value of bandwidth */
+#define TOF_BW_20MHZ    (BANDWIDTH_BASE << TOF_BW_20MHZ_INDEX)
+#define TOF_BW_40MHZ    (BANDWIDTH_BASE << TOF_BW_40MHZ_INDEX)
+#define TOF_BW_80MHZ    (BANDWIDTH_BASE << TOF_BW_80MHZ_INDEX)
+#define TOF_BW_10MHZ    10
+
+#define NFFT_BASE		64	/* base size of fft */
+#define TOF_NFFT_20MHZ  (NFFT_BASE << TOF_BW_20MHZ_INDEX)
+#define TOF_NFFT_40MHZ  (NFFT_BASE << TOF_BW_40MHZ_INDEX)
+#define TOF_NFFT_80MHZ  (NFFT_BASE << TOF_BW_80MHZ_INDEX)
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_tof_method {
+	chanspec_t	chanspec;	/* chanspec for home channel */
+	int16		tx_power;	/* tx power of Proximity Detection(PD) frames (in dBm) */
+	uint16		tx_rate;	/* tx rate of PD rames  (in 500kbps units) */
+	uint16		timeout;	/* state machine wait timeout of the frames (in ms) */
+	uint16		interval;	/* interval between neighbor finding attempts (in TU) */
+	uint16		duration;	/* duration of neighbor finding attempts (in ms) */
+	/* specific for the method go after this line */
+	struct ether_addr tgt_mac;	/* target mac addr for TOF method */
+	uint16		ftm_cnt;	/* number of the frames txed by initiator */
+	uint16		retry_cnt;	/* number of retransmit attampts for ftm frames */
+	int16		vht_rate;	/* ht or vht rate */
+	/* add more params required for other methods can be added here  */
+} BWL_POST_PACKED_STRUCT wl_proxd_params_tof_method_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_params_tof_tune {
+	uint32		Ki;			/* h/w delay K factor for initiator */
+	uint32		Kt;			/* h/w delay K factor for target */
+	int16		vhtack;			/* enable/disable VHT ACK */
+	int16		N_log2[TOF_BW_SEQ_NUM]; /* simple threshold crossing */
+	int16		w_offset[TOF_BW_NUM];	/* offset of threshold crossing window(per BW) */
+	int16		w_len[TOF_BW_NUM];	/* length of threshold crossing window(per BW) */
+	int32		maxDT;			/* max time difference of T4/T1 or T3/T2 */
+	int32		minDT;			/* min time difference of T4/T1 or T3/T2 */
+	uint8		totalfrmcnt;	/* total count of transfered measurement frames */
+	uint16		rsv_media;		/* reserve media value for TOF */
+	uint32		flags;			/* flags */
+	uint8		core;			/* core to use for tx */
+	uint8		force_K;		/* set to force value of K  */
+	int16		N_scale[TOF_BW_SEQ_NUM]; /* simple threshold crossing */
+	uint8		sw_adj;			/* enable sw assisted timestamp adjustment */
+	uint8		hw_adj;			/* enable hw assisted timestamp adjustment */
+	uint8		seq_en;			/* enable ranging sequence */
+	uint8		ftm_cnt[TOF_BW_SEQ_NUM]; /* number of ftm frames based on bandwidth */
+} BWL_POST_PACKED_STRUCT wl_proxd_params_tof_tune_t;
+
+typedef struct wl_proxd_params_iovar {
+	uint16	method;			/* Proxmity Detection method */
+	union {
+		/* common params for pdsvc */
+		wl_proxd_params_common_t	cmn_params;	/* common parameters */
+		/*  method specific */
+		wl_proxd_params_rssi_method_t	rssi_params;	/* RSSI method parameters */
+		wl_proxd_params_tof_method_t	tof_params;	/* TOF meothod parameters */
+		/* tune parameters */
+		wl_proxd_params_tof_tune_t	tof_tune;	/* TOF tune parameters */
+	} u;				/* Method specific optional parameters */
+} wl_proxd_params_iovar_t;
+
+#define PROXD_COLLECT_GET_STATUS	0
+#define PROXD_COLLECT_SET_STATUS	1
+#define PROXD_COLLECT_QUERY_HEADER	2
+#define PROXD_COLLECT_QUERY_DATA	3
+#define PROXD_COLLECT_QUERY_DEBUG	4
+#define PROXD_COLLECT_REMOTE_REQUEST	5
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_query {
+	uint32		method;		/* method */
+	uint8		request;	/* Query request. */
+	uint8		status;		/* 0 -- disable, 1 -- enable collection, */
+					/* 2 -- enable collection & debug */
+	uint16		index;		/* The current frame index [0 to total_frames - 1]. */
+	uint16		mode;		/* Initiator or Target */
+	bool		busy;		/* tof sm is busy */
+	bool		remote;		/* Remote collect data */
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_query_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_header {
+	uint16		total_frames;			/* The totral frames for this collect. */
+	uint16		nfft;				/* nfft value */
+	uint16		bandwidth;			/* bandwidth */
+	uint16		channel;			/* channel number */
+	uint32		chanspec;			/* channel spec */
+	uint32		fpfactor;			/* avb timer value factor */
+	uint16		fpfactor_shift;			/* avb timer value shift bits */
+	int32		distance;			/* distance calculated by fw */
+	uint32		meanrtt;			/* mean of RTTs */
+	uint32		modertt;			/* mode of RTTs */
+	uint32		medianrtt;			/* median of RTTs */
+	uint32		sdrtt;				/* standard deviation of RTTs */
+	uint32		clkdivisor;			/* clock divisor */
+	uint16		chipnum;			/* chip type */
+	uint8		chiprev;			/* chip revision */
+	uint8		phyver;				/* phy version */
+	struct ether_addr	loaclMacAddr;		/* local mac address */
+	struct ether_addr	remoteMacAddr;		/* remote mac address */
+	wl_proxd_params_tof_tune_t params;
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_header_t;
+
+
+/*  ********************** NAN wl interface struct types and defs ******************** */
+
+#define WL_NAN_IOCTL_VERSION	0x1
+
+/*   wl_nan_sub_cmd may also be used in dhd  */
+typedef struct wl_nan_sub_cmd wl_nan_sub_cmd_t;
+typedef int (cmd_handler_t)(void *wl, const wl_nan_sub_cmd_t *cmd, char **argv);
+/* nan cmd list entry  */
+struct wl_nan_sub_cmd {
+	char *name;
+	uint8  version;		/* cmd  version */
+	uint16 id;			/* id for the dongle f/w switch/case  */
+	uint16 type;		/* base type of argument */
+	cmd_handler_t *handler; /* cmd handler  */
+};
+
+/* container for nan iovtls & events */
+typedef BWL_PRE_PACKED_STRUCT struct wl_nan_ioc {
+	uint16	version;	/* interface command or event version */
+	uint16	id;			/* nan ioctl cmd  ID  */
+	uint16	len;		/* total length of all tlv records in data[]  */
+	uint8	data [1];	/* var len payload of bcm_xtlv_t type */
+} BWL_POST_PACKED_STRUCT wl_nan_ioc_t;
+
+typedef struct wl_nan_status {
+	uint8 inited;
+	uint8 joined;
+	uint8 role;
+	uint8 hop_count;
+	uint32 chspec;
+	uint8 amr[8];			/* Anchor Master Rank */
+	uint32 cnt_pend_txfrm;		/* pending TX frames */
+	uint32 cnt_bcn_tx;		/* TX disc/sync beacon count */
+	uint32 cnt_bcn_rx;		/* RX disc/sync beacon count */
+	uint32 cnt_svc_disc_tx;		/* TX svc disc frame count */
+	uint32 cnt_svc_disc_rx;		/* RX svc disc frame count */
+	struct ether_addr cid;
+} wl_nan_status_t;
+
+/* various params and ctl swithce for nan_debug instance  */
+typedef struct nan_debug_params {
+	uint8	enabled; /* runtime debuging enabled */
+	uint8	collect; /* enables debug svc sdf monitor mode  */
+	uint16	cmd;	/* debug cmd to perform a debug action */
+	uint32	msglevel; /* msg level if enabled */
+	uint16	status;
+} nan_debug_params_t;
+
+
+/* nan passive scan params */
+#define NAN_SCAN_MAX_CHCNT 8
+typedef BWL_PRE_PACKED_STRUCT struct nan_scan_params {
+	uint16 scan_time;
+	uint16 home_time;
+	uint16 ms_intvl; /* interval between merge scan */
+	uint16 ms_dur;  /* duration of merge scan */
+	uint16 chspec_num;
+	chanspec_t chspec_list[NAN_SCAN_MAX_CHCNT]; /* act. used 3, 5 rfu */
+} BWL_POST_PACKED_STRUCT nan_scan_params_t;
+
+enum wl_nan_role {
+	WL_NAN_ROLE_AUTO = 0,
+	WL_NAN_ROLE_NON_MASTER_NON_SYNC = 1,
+	WL_NAN_ROLE_NON_MASTER_SYNC = 2,
+	WL_NAN_ROLE_MASTER = 3,
+	WL_NAN_ROLE_ANCHOR_MASTER = 4
+};
+#define NAN_MASTER_RANK_LEN 8
+/* nan cmd IDs */
+enum wl_nan_cmds {
+	 /* nan cfg /disc & dbg ioctls */
+	WL_NAN_CMD_ENABLE = 1,
+	WL_NAN_CMD_ATTR = 2,
+	WL_NAN_CMD_NAN_JOIN = 3,
+	WL_NAN_CMD_LEAVE = 4,
+	WL_NAN_CMD_MERGE = 5,
+	WL_NAN_CMD_STATUS = 6,
+	/*  discovery engine commands */
+	WL_NAN_CMD_PUBLISH = 20,
+	WL_NAN_CMD_SUBSCRIBE = 21,
+	WL_NAN_CMD_CANCEL_PUBLISH = 22,
+	WL_NAN_CMD_CANCEL_SUBSCRIBE = 23,
+	WL_NAN_CMD_TRANSMIT = 24,
+	WL_NAN_CMD_CONNECTION = 25,
+	WL_NAN_CMD_SHOW = 26,
+	WL_NAN_CMD_STOP = 27,	/* stop nan for a given cluster ID  */
+	/*  nan debug iovars & cmds  */
+	WL_NAN_CMD_SCAN_PARAMS = 46,
+	WL_NAN_CMD_SCAN = 47,
+	WL_NAN_CMD_SCAN_RESULTS = 48,
+	WL_NAN_CMD_EVENT_MASK = 49,
+	WL_NAN_CMD_EVENT_CHECK = 50,
+
+	WL_NAN_CMD_DEBUG = 60,
+	WL_NAN_CMD_TEST1 = 61,
+	WL_NAN_CMD_TEST2 = 62,
+	WL_NAN_CMD_TEST3 = 63
+};
+
+/*
+ * tlv IDs uniquely identifies  cmd parameters
+ * packed into wl_nan_ioc_t container
+ */
+enum wl_nan_cmd_xtlv_id {
+	/* 0x00 ~ 0xFF: standard TLV ID whose data format is the same as NAN attribute TLV */
+	WL_NAN_XTLV_ZERO = 0,		/* used as tlv buf end marker */
+#ifdef NAN_STD_TLV 				/* rfu, don't use yet */
+	WL_NAN_XTLV_MASTER_IND = 1, /* == NAN_ATTR_MASTER_IND, */
+	WL_NAN_XTLV_CLUSTER = 2,	/* == NAN_ATTR_CLUSTER, */
+	WL_NAN_XTLV_VENDOR = 221,	/* == NAN_ATTR_VENDOR, */
+#endif
+	/* 0x02 ~ 0xFF: reserved. In case to use with the same data format as NAN attribute TLV */
+	/* 0x100 ~ : private TLV ID defined just for NAN command */
+	/* common types */
+	WL_NAN_XTLV_BUFFER = 0x101, /* generic type, function depends on cmd context */
+	WL_NAN_XTLV_MAC_ADDR = 0x102,	/* used in various cmds */
+	WL_NAN_XTLV_REASON = 0x103,
+	WL_NAN_XTLV_ENABLE = 0x104,
+	/* explicit types, primarily for discovery engine iovars  */
+	WL_NAN_XTLV_SVC_PARAMS = 0x120,     /* Contains required params: wl_nan_disc_params_t */
+	WL_NAN_XTLV_MATCH_RX = 0x121,       /* Matching filter to evaluate on receive */
+	WL_NAN_XTLV_MATCH_TX = 0x122,       /* Matching filter to send */
+	WL_NAN_XTLV_SVC_INFO = 0x123,       /* Service specific info */
+	WL_NAN_XTLV_SVC_NAME = 0x124,       /* Optional UTF-8 service name, for debugging. */
+	WL_NAN_XTLV_INSTANCE_ID = 0x125,    /* Identifies unique publish or subscribe instance */
+	WL_NAN_XTLV_PRIORITY = 0x126,       /* used in transmit cmd context */
+	WL_NAN_XTLV_REQUESTOR_ID = 0x127,	/* Requestor instance ID */
+	WL_NAN_XTLV_VNDR = 0x128,		/* Vendor specific attribute */
+	/* explicit types, primarily for NAN MAC iovars   */
+	WL_NAN_XTLV_DW_LEN = 0x140,            /* discovery win length */
+	WL_NAN_XTLV_BCN_INTERVAL = 0x141,      /* beacon interval, both sync and descovery bcns?  */
+	WL_NAN_XTLV_CLUSTER_ID = 0x142,
+	WL_NAN_XTLV_IF_ADDR = 0x143,
+	WL_NAN_XTLV_MC_ADDR = 0x144,
+	WL_NAN_XTLV_ROLE = 0x145,
+	WL_NAN_XTLV_START = 0x146,
+
+	WL_NAN_XTLV_MASTER_PREF = 0x147,
+	WL_NAN_XTLV_DW_INTERVAL = 0x148,
+	WL_NAN_XTLV_PTBTT_OVERRIDE = 0x149,
+	/*  nan status command xtlvs  */
+	WL_NAN_XTLV_MAC_INITED = 0x14a,
+	WL_NAN_XTLV_MAC_ENABLED = 0x14b,
+	WL_NAN_XTLV_MAC_CHANSPEC = 0x14c,
+	WL_NAN_XTLV_MAC_AMR = 0x14d,	/* anchormaster rank u8 amr[8] */
+	WL_NAN_XTLV_MAC_HOPCNT = 0x14e,
+	WL_NAN_XTLV_MAC_AMBTT = 0x14f,
+	WL_NAN_XTLV_MAC_TXRATE = 0x150,
+	WL_NAN_XTLV_MAC_STATUS = 0x151,  /* xtlv payload is nan_status_t */
+	WL_NAN_XTLV_NAN_SCANPARAMS = 0x152,  /* payload is nan_scan_params_t */
+	WL_NAN_XTLV_DEBUGPARAMS = 0x153,  /* payload is nan_scan_params_t */
+	WL_NAN_XTLV_SUBSCR_ID = 0x154,   /* subscriber id  */
+	WL_NAN_XTLV_PUBLR_ID = 0x155,	/* publisher id */
+	WL_NAN_XTLV_EVENT_MASK = 0x156,
+	WL_NAN_XTLV_MERGE = 0x157
+};
+
+/* Flag bits for Publish and Subscribe (wl_nan_disc_params_t flags) */
+#define WL_NAN_RANGE_LIMITED           0x0040
+/* Bits specific to Publish */
+/* Unsolicited transmissions */
+#define WL_NAN_PUB_UNSOLICIT           0x1000
+/* Solicited transmissions */
+#define WL_NAN_PUB_SOLICIT             0x2000
+#define WL_NAN_PUB_BOTH                0x3000
+/* Set for broadcast solicited transmission
+ * Do not set for unicast solicited transmission
+ */
+#define WL_NAN_PUB_BCAST               0x4000
+/* Generate event on each solicited transmission */
+#define WL_NAN_PUB_EVENT               0x8000
+/* Used for one-time solicited Publish functions to indicate transmision occurred */
+#define WL_NAN_PUB_SOLICIT_PENDING	0x10000
+/* Follow-up frames */
+#define WL_NAN_FOLLOWUP			0x20000
+/* Bits specific to Subscribe */
+/* Active subscribe mode (Leave unset for passive) */
+#define WL_NAN_SUB_ACTIVE              0x1000
+
+/* Special values for time to live (ttl) parameter */
+#define WL_NAN_TTL_UNTIL_CANCEL	0xFFFFFFFF
+/* Publish -  runs until first transmission
+ * Subscribe - runs until first  DiscoveryResult event
+ */
+#define WL_NAN_TTL_FIRST	0
+
+/* The service hash (service id) is exactly this many bytes. */
+#define WL_NAN_SVC_HASH_LEN	6
+
+/* Instance ID type (unique identifier) */
+typedef uint8 wl_nan_instance_id_t;
+
+/* Mandatory parameters for publish/subscribe iovars - NAN_TLV_SVC_PARAMS */
+typedef struct wl_nan_disc_params_s {
+	/* Periodicity of unsolicited/query transmissions, in DWs */
+	uint32 period;
+	/* Time to live in DWs */
+	uint32 ttl;
+	/* Flag bits */
+	uint32 flags;
+	/* Publish or subscribe service id, i.e. hash of the service name */
+	uint8 svc_hash[WL_NAN_SVC_HASH_LEN];
+	/* Publish or subscribe id */
+	wl_nan_instance_id_t instance_id;
+} wl_nan_disc_params_t;
+
+/*
+* desovery interface event structures *
+*/
+
+/* NAN Ranging */
+
+/* Bit defines for global flags */
+#define WL_NAN_RANGING_ENABLE		1 /* enable RTT */
+#define WL_NAN_RANGING_RANGED		2 /* Report to host if ranged as target */
+typedef struct nan_ranging_config {
+	uint32 chanspec;		/* Ranging chanspec */
+	uint16 timeslot;		/* NAN RTT start time slot  1-511 */
+	uint16 duration;		/* NAN RTT duration in ms */
+	struct ether_addr allow_mac;	/* peer initiated ranging: the allowed peer mac
+					 * address, a unicast (for one peer) or
+					 * a broadcast for all. Setting it to all zeros
+					 * means responding to none,same as not setting
+					 * the flag bit NAN_RANGING_RESPOND
+					 */
+	uint16 flags;
+} wl_nan_ranging_config_t;
+
+/* list of peers for self initiated ranging */
+/* Bit defines for per peer flags */
+#define WL_NAN_RANGING_REPORT (1<<0)	/* Enable reporting range to target */
+typedef struct nan_ranging_peer {
+	uint32 chanspec;		/* desired chanspec for this peer */
+	uint32 abitmap;			/* available bitmap */
+	struct ether_addr ea;		/* peer MAC address */
+	uint8 frmcnt;			/* frame count */
+	uint8 retrycnt;			/* retry count */
+	uint16 flags;			/* per peer flags, report or not */
+} wl_nan_ranging_peer_t;
+typedef struct nan_ranging_list {
+	uint8 count;			/* number of MAC addresses */
+	uint8 num_peers_done;		/* host set to 0, when read, shows number of peers
+					 * completed, success or fail
+					 */
+	uint8 num_dws;			/* time period to do the ranging, specified in dws */
+	uint8 reserve;			/* reserved field */
+	wl_nan_ranging_peer_t rp[1];	/* variable length array of peers */
+} wl_nan_ranging_list_t;
+
+/* ranging results, a list for self initiated ranging and one for peer initiated ranging */
+/* There will be one structure for each peer */
+#define WL_NAN_RANGING_STATUS_SUCCESS		1
+#define WL_NAN_RANGING_STATUS_FAIL			2
+#define WL_NAN_RANGING_STATUS_TIMEOUT		3
+#define WL_NAN_RANGING_STATUS_ABORT		4 /* with partial results if sounding count > 0 */
+typedef struct nan_ranging_result {
+	uint8 status;			/* 1: Success, 2: Fail 3: Timeout 4: Aborted */
+	uint8 sounding_count;		/* number of measurements completed (0 = failure) */
+	struct ether_addr ea;		/* initiator MAC address */
+	uint32 chanspec;		/* Chanspec where the ranging was done */
+	uint32 timestamp;		/* 32bits of the TSF timestamp ranging was completed at */
+	uint32 distance;		/* mean distance in meters expressed as Q4 number.
+					 * Only valid when sounding_count > 0. Examples:
+					 * 0x08 = 0.5m
+					 * 0x10 = 1m
+					 * 0x18 = 1.5m
+					 * set to 0xffffffff to indicate invalid number
+					 */
+	int32 rtt_var;			/* standard deviation in 10th of ns of RTTs measured.
+					 * Only valid when sounding_count > 0
+					 */
+	struct ether_addr tgtea;	/* target MAC address */
+} wl_nan_ranging_result_t;
+typedef struct nan_ranging_event_data {
+	uint8 mode;			/* 1: Result of host initiated ranging */
+					/* 2: Result of peer initiated ranging */
+	uint8 reserved;
+	uint8 success_count;		/* number of peers completed successfully */
+	uint8 count;			/* number of peers in the list */
+	wl_nan_ranging_result_t rr[1];	/* variable array of ranging peers */
+} wl_nan_ranging_event_data_t;
+
+/* ********************* end of NAN section ******************************** */
+
+
+#define RSSI_THRESHOLD_SIZE 16
+#define MAX_IMP_RESP_SIZE 256
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_rssi_bias {
+	int32		version;			/* version */
+	int32		threshold[RSSI_THRESHOLD_SIZE];	/* threshold */
+	int32		peak_offset;		/* peak offset */
+	int32		bias;				/* rssi bias */
+	int32		gd_delta;			/* GD - GD_ADJ */
+	int32		imp_resp[MAX_IMP_RESP_SIZE];	/* (Hi*Hi)+(Hr*Hr) */
+} BWL_POST_PACKED_STRUCT wl_proxd_rssi_bias_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_rssi_bias_avg {
+	int32		avg_threshold[RSSI_THRESHOLD_SIZE];	/* avg threshold */
+	int32		avg_peak_offset;			/* avg peak offset */
+	int32		avg_rssi;				/* avg rssi */
+	int32		avg_bias;				/* avg bias */
+} BWL_POST_PACKED_STRUCT wl_proxd_rssi_bias_avg_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_info {
+	uint16		type;	 /* type: 0 channel table, 1 channel smoothing table, 2 and 3 seq */
+	uint16		index;		/* The current frame index, from 1 to total_frames. */
+	uint16		tof_cmd;	/* M_TOF_CMD      */
+	uint16		tof_rsp;	/* M_TOF_RSP      */
+	uint16		tof_avb_rxl;	/* M_TOF_AVB_RX_L */
+	uint16		tof_avb_rxh;	/* M_TOF_AVB_RX_H */
+	uint16		tof_avb_txl;	/* M_TOF_AVB_TX_L */
+	uint16		tof_avb_txh;	/* M_TOF_AVB_TX_H */
+	uint16		tof_id;		/* M_TOF_ID */
+	uint8		tof_frame_type;
+	uint8		tof_frame_bw;
+	int8		tof_rssi;
+	int32		tof_cfo;
+	int32		gd_adj_ns;	/* gound delay */
+	int32		gd_h_adj_ns;	/* group delay + threshold crossing */
+#ifdef RSSI_REFINE
+	wl_proxd_rssi_bias_t rssi_bias; /* RSSI refinement info */
+#endif
+	int16		nfft;		/* number of samples stored in H */
+
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_info_t;
+
+#define k_tof_collect_H_pad  1
+#define k_tof_collect_H_size (256+16+k_tof_collect_H_pad)
+#define k_tof_collect_Hraw_size (2*k_tof_collect_H_size)
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_collect_data {
+	wl_proxd_collect_info_t  info;
+	uint32	H[k_tof_collect_H_size]; /* raw data read from phy used to adjust timestamps */
+
+} BWL_POST_PACKED_STRUCT wl_proxd_collect_data_t;
+
+typedef BWL_PRE_PACKED_STRUCT struct wl_proxd_debug_data {
+	uint8		count;		/* number of packets */
+	uint8		stage;		/* state machone stage */
+	uint8		received;	/* received or txed */
+	uint8		paket_type;	/* packet type */
+	uint8		category;	/* category field */
+	uint8		action;		/* action field */
+	uint8		token;		/* token number */
+	uint8		follow_token;	/* following token number */
+	uint16		index;		/* index of the packet */
+	uint16		tof_cmd;	/* M_TOF_CMD */
+	uint16		tof_rsp;	/* M_TOF_RSP */
+	uint16		tof_avb_rxl;	/* M_TOF_AVB_RX_L */
+	uint16		tof_avb_rxh;	/* M_TOF_AVB_RX_H */
+	uint16		tof_avb_txl;	/* M_TOF_AVB_TX_L */
+	uint16		tof_avb_txh;	/* M_TOF_AVB_TX_H */
+	uint16		tof_id;		/* M_TOF_ID */
+	uint16		tof_status0;	/* M_TOF_STATUS_0 */
+	uint16		tof_status2;	/* M_TOF_STATUS_2 */
+	uint16		tof_chsm0;	/* M_TOF_CHNSM_0 */
+	uint16		tof_phyctl0;	/* M_TOF_PHYCTL0 */
+	uint16		tof_phyctl1;	/* M_TOF_PHYCTL1 */
+	uint16		tof_phyctl2;	/* M_TOF_PHYCTL2 */
+	uint16		tof_lsig;	/* M_TOF_LSIG */
+	uint16		tof_vhta0;	/* M_TOF_VHTA0 */
+	uint16		tof_vhta1;	/* M_TOF_VHTA1 */
+	uint16		tof_vhta2;	/* M_TOF_VHTA2 */
+	uint16		tof_vhtb0;	/* M_TOF_VHTB0 */
+	uint16		tof_vhtb1;	/* M_TOF_VHTB1 */
+	uint16		tof_apmductl;	/* M_TOF_AMPDU_CTL */
+	uint16		tof_apmdudlim;	/* M_TOF_AMPDU_DLIM */
+	uint16		tof_apmdulen;	/* M_TOF_AMPDU_LEN */
+} BWL_POST_PACKED_STRUCT wl_proxd_debug_data_t;
+
+/* version of the wl_wsec_info structure */
+#define WL_WSEC_INFO_VERSION 0x01
+
+/* start enum value for BSS properties */
+#define WL_WSEC_INFO_BSS_BASE 0x0100
+
+/* size of len and type fields of wl_wsec_info_tlv_t struct */
+#define WL_WSEC_INFO_TLV_HDR_LEN OFFSETOF(wl_wsec_info_tlv_t, data)
+
+/* Allowed wl_wsec_info properties; not all of them may be supported. */
+typedef enum {
+	WL_WSEC_INFO_NONE = 0,
+	WL_WSEC_INFO_MAX_KEYS = 1,
+	WL_WSEC_INFO_NUM_KEYS = 2,
+	WL_WSEC_INFO_NUM_HW_KEYS = 3,
+	WL_WSEC_INFO_MAX_KEY_IDX = 4,
+	WL_WSEC_INFO_NUM_REPLAY_CNTRS = 5,
+	WL_WSEC_INFO_SUPPORTED_ALGOS = 6,
+	WL_WSEC_INFO_MAX_KEY_LEN = 7,
+	WL_WSEC_INFO_FLAGS = 8,
+	/* add global/per-wlc properties above */
+	WL_WSEC_INFO_BSS_FLAGS = (WL_WSEC_INFO_BSS_BASE + 1),
+	WL_WSEC_INFO_BSS_WSEC = (WL_WSEC_INFO_BSS_BASE + 2),
+	WL_WSEC_INFO_BSS_TX_KEY_ID = (WL_WSEC_INFO_BSS_BASE + 3),
+	WL_WSEC_INFO_BSS_ALGO = (WL_WSEC_INFO_BSS_BASE + 4),
+	WL_WSEC_INFO_BSS_KEY_LEN = (WL_WSEC_INFO_BSS_BASE + 5),
+	/* add per-BSS properties above */
+	WL_WSEC_INFO_MAX = 0xffff
+} wl_wsec_info_type_t;
+
+/* tlv used to return wl_wsec_info properties */
+typedef struct {
+	uint16 type;
+	uint16 len;		/* data length */
+	uint8 data[1];	/* data follows */
+} wl_wsec_info_tlv_t;
+
+/* input/output data type for wsec_info iovar */
+typedef struct wl_wsec_info {
+	uint8 version; /* structure version */
+	uint8 pad[2];
+	uint8 num_tlvs;
+	wl_wsec_info_tlv_t tlvs[1]; /* tlv data follows */
+} wl_wsec_info_t;
+
+/* no default structure packing */
+#include <packed_section_end.h>
+
+enum rssi_reason {
+	RSSI_REASON_UNKNOW = 0,
+	RSSI_REASON_LOWRSSI = 1,
+	RSSI_REASON_NSYC = 2,
+	RSSI_REASON_TIMEOUT = 3
+};
+
+enum tof_reason {
+	TOF_REASON_OK = 0,
+	TOF_REASON_REQEND = 1,
+	TOF_REASON_TIMEOUT = 2,
+	TOF_REASON_NOACK = 3,
+	TOF_REASON_INVALIDAVB = 4,
+	TOF_REASON_INITIAL = 5,
+	TOF_REASON_ABORT = 6
+};
+
+enum rssi_state {
+	RSSI_STATE_POLL = 0,
+	RSSI_STATE_TPAIRING = 1,
+	RSSI_STATE_IPAIRING = 2,
+	RSSI_STATE_THANDSHAKE = 3,
+	RSSI_STATE_IHANDSHAKE = 4,
+	RSSI_STATE_CONFIRMED = 5,
+	RSSI_STATE_PIPELINE = 6,
+	RSSI_STATE_NEGMODE = 7,
+	RSSI_STATE_MONITOR = 8,
+	RSSI_STATE_LAST = 9
+};
+
+enum tof_state {
+	TOF_STATE_IDLE	 = 0,
+	TOF_STATE_IWAITM = 1,
+	TOF_STATE_TWAITM = 2,
+	TOF_STATE_ILEGACY = 3,
+	TOF_STATE_IWAITCL = 4,
+	TOF_STATE_TWAITCL = 5,
+	TOF_STATE_ICONFIRM = 6,
+	TOF_STATE_IREPORT = 7
+};
+
+enum tof_mode_type {
+	TOF_LEGACY_UNKNOWN	= 0,
+	TOF_LEGACY_AP		= 1,
+	TOF_NONLEGACY_AP	= 2
+};
+
+enum tof_way_type {
+	TOF_TYPE_ONE_WAY = 0,
+	TOF_TYPE_TWO_WAY = 1,
+	TOF_TYPE_REPORT = 2
+};
+
+enum tof_rate_type {
+	TOF_FRAME_RATE_VHT = 0,
+	TOF_FRAME_RATE_LEGACY = 1
+};
+
+#define TOF_ADJ_TYPE_NUM	4	/* number of assisted timestamp adjustment */
+enum tof_adj_mode {
+	TOF_ADJ_SOFTWARE = 0,
+	TOF_ADJ_HARDWARE = 1,
+	TOF_ADJ_SEQ = 2,
+	TOF_ADJ_NONE = 3
+};
+
+#define FRAME_TYPE_NUM		4	/* number of frame type */
+enum frame_type {
+	FRAME_TYPE_CCK	= 0,
+	FRAME_TYPE_OFDM	= 1,
+	FRAME_TYPE_11N	= 2,
+	FRAME_TYPE_11AC	= 3
+};
+
+typedef struct wl_proxd_status_iovar {
+	uint16			method;				/* method */
+	uint8			mode;				/* mode */
+	uint8			peermode;			/* peer mode */
+	uint8			state;				/* state */
+	uint8			reason;				/* reason code */
+	uint32			distance;			/* distance */
+	uint32			txcnt;				/* tx pkt counter */
+	uint32			rxcnt;				/* rx pkt counter */
+	struct ether_addr	peer;				/* peer mac address */
+	int8			avg_rssi;			/* average rssi */
+	int8			hi_rssi;			/* highest rssi */
+	int8			low_rssi;			/* lowest rssi */
+	uint32			dbgstatus;			/* debug status */
+	uint16			frame_type_cnt[FRAME_TYPE_NUM];	/* frame types */
+	uint8			adj_type_cnt[TOF_ADJ_TYPE_NUM];	/* adj types HW/SW */
+} wl_proxd_status_iovar_t;
+
+#ifdef NET_DETECT
+typedef struct net_detect_adapter_features {
+	bool	wowl_enabled;
+	bool	net_detect_enabled;
+	bool	nlo_enabled;
+} net_detect_adapter_features_t;
+
+typedef enum net_detect_bss_type {
+	nd_bss_any = 0,
+	nd_ibss,
+	nd_ess
+} net_detect_bss_type_t;
+
+typedef struct net_detect_profile {
+	wlc_ssid_t		ssid;
+	net_detect_bss_type_t   bss_type;	/* Ignore for now since Phase 1 is only for ESS */
+	uint32			cipher_type;	/* DOT11_CIPHER_ALGORITHM enumeration values */
+	uint32			auth_type;	/* DOT11_AUTH_ALGORITHM enumeration values */
+} net_detect_profile_t;
+
+typedef struct net_detect_profile_list {
+	uint32			num_nd_profiles;
+	net_detect_profile_t	nd_profile[0];
+} net_detect_profile_list_t;
+
+typedef struct net_detect_config {
+	bool			    nd_enabled;
+	uint32			    scan_interval;
+	uint32			    wait_period;
+	bool			    wake_if_connected;
+	bool			    wake_if_disconnected;
+	net_detect_profile_list_t   nd_profile_list;
+} net_detect_config_t;
+
+typedef enum net_detect_wake_reason {
+	nd_reason_unknown,
+	nd_net_detected,
+	nd_wowl_event,
+	nd_ucode_error
+} net_detect_wake_reason_t;
+
+typedef struct net_detect_wake_data {
+	net_detect_wake_reason_t    nd_wake_reason;
+	uint32			    nd_wake_date_length;
+	uint8			    nd_wake_data[0];	    /* Wake data (currently unused) */
+} net_detect_wake_data_t;
+
+#endif /* NET_DETECT */
+
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+
+typedef struct bcnreq {
+	uint8 bcn_mode;
+	int dur;
+	int channel;
+	struct ether_addr da;
+	uint16 random_int;
+	wlc_ssid_t ssid;
+	uint16 reps;
+} bcnreq_t;
+
+typedef struct rrmreq {
+	struct ether_addr da;
+	uint8 reg;
+	uint8 chan;
+	uint16 random_int;
+	uint16 dur;
+	uint16 reps;
+} rrmreq_t;
+
+typedef struct framereq {
+	struct ether_addr da;
+	uint8 reg;
+	uint8 chan;
+	uint16 random_int;
+	uint16 dur;
+	struct ether_addr ta;
+	uint16 reps;
+} framereq_t;
+
+typedef struct statreq {
+	struct ether_addr da;
+	struct ether_addr peer;
+	uint16 random_int;
+	uint16 dur;
+	uint8 group_id;
+	uint16 reps;
+} statreq_t;
+
+#define WL_RRM_RPT_VER		0
+#define WL_RRM_RPT_MAX_PAYLOAD	64
+#define WL_RRM_RPT_MIN_PAYLOAD	7
+#define WL_RRM_RPT_FALG_ERR	0
+#define WL_RRM_RPT_FALG_OK	1
+typedef struct {
+	uint16 ver;		/* version */
+	struct ether_addr addr;	/* STA MAC addr */
+	uint32 timestamp;	/* timestamp of the report */
+	uint16 flag;		/* flag */
+	uint16 len;		/* length of payload data */
+	unsigned char data[WL_RRM_RPT_MAX_PAYLOAD];
+} statrpt_t;
+
+typedef struct wlc_l2keepalive_ol_params {
+	uint8	flags;
+	uint8	prio;
+	uint16	period_ms;
+} wlc_l2keepalive_ol_params_t;
+
+typedef struct wlc_dwds_config {
+	uint32		enable;
+	uint32		mode; /* STA/AP interface */
+	struct ether_addr ea;
+} wlc_dwds_config_t;
+
+typedef struct wl_el_set_params_s {
+	uint8 set;	/* Set number */
+	uint32 size;	/* Size to make/expand */
+} wl_el_set_params_t;
+
+typedef struct wl_el_tag_params_s {
+	uint16 tag;
+	uint8 set;
+	uint8 flags;
+} wl_el_tag_params_t;
+
+/* Video Traffic Interference Monitor config */
+#define INTFER_VERSION		1
+typedef struct wl_intfer_params {
+	uint16 version;			/* version */
+	uint8 period;			/* sample period */
+	uint8 cnt;			/* sample cnt */
+	uint8 txfail_thresh;	/* non-TCP txfail threshold */
+	uint8 tcptxfail_thresh;	/* tcptxfail threshold */
+} wl_intfer_params_t;
+
+typedef struct wl_staprio_cfg {
+	struct ether_addr ea;	/* mac addr */
+	uint8 prio;		/* scb priority */
+} wl_staprio_cfg_t;
+
+typedef enum wl_stamon_cfg_cmd_type {
+	STAMON_CFG_CMD_DEL = 0,
+	STAMON_CFG_CMD_ADD = 1
+} wl_stamon_cfg_cmd_type_t;
+
+typedef struct wlc_stamon_sta_config {
+	wl_stamon_cfg_cmd_type_t cmd; /* 0 - delete, 1 - add */
+	struct ether_addr ea;
+} wlc_stamon_sta_config_t;
+
+#ifdef SR_DEBUG
+typedef struct /* pmu_reg */{
+	uint32  pmu_control;
+	uint32  pmu_capabilities;
+	uint32  pmu_status;
+	uint32  res_state;
+	uint32  res_pending;
+	uint32  pmu_timer1;
+	uint32  min_res_mask;
+	uint32  max_res_mask;
+	uint32  pmu_chipcontrol1[4];
+	uint32  pmu_regcontrol[5];
+	uint32  pmu_pllcontrol[5];
+	uint32  pmu_rsrc_up_down_timer[31];
+	uint32  rsrc_dep_mask[31];
+} pmu_reg_t;
+#endif /* pmu_reg */
+
+typedef struct wl_taf_define {
+	struct ether_addr ea;	/* STA MAC or 0xFF... */
+	uint16 version;         /* version */
+	uint32 sch;             /* method index */
+	uint32 prio;            /* priority */
+	uint32 misc;            /* used for return value */
+	char   text[1];         /* used to pass and return ascii text */
+} wl_taf_define_t;
+
+/* Received Beacons lengths information */
+#define WL_LAST_BCNS_INFO_FIXED_LEN		OFFSETOF(wlc_bcn_len_hist_t, bcnlen_ring)
+typedef struct wlc_bcn_len_hist {
+	uint16	ver;				/* version field */
+	uint16	cur_index;			/* current pointed index in ring buffer */
+	uint32	max_bcnlen;		/* Max beacon length received */
+	uint32	min_bcnlen;		/* Min beacon length received */
+	uint32	ringbuff_len;		/* Length of the ring buffer 'bcnlen_ring' */
+	uint32	bcnlen_ring[1];	/* ring buffer storing received beacon lengths */
+} wlc_bcn_len_hist_t;
+
+/* WDS net interface types */
+#define WL_WDSIFTYPE_NONE  0x0 /* The interface type is neither WDS nor DWDS. */
+#define WL_WDSIFTYPE_WDS   0x1 /* The interface is WDS type. */
+#define WL_WDSIFTYPE_DWDS  0x2 /* The interface is DWDS type. */
+
+typedef struct wl_bssload_static {
+	bool is_static;
+	uint16 sta_count;
+	uint8 chan_util;
+	uint16 aac;
+} wl_bssload_static_t;
+
+
+/* LTE coex info */
+/* Analogue of HCI Set MWS Signaling cmd */
+typedef struct {
+	uint16	mws_rx_assert_offset;
+	uint16	mws_rx_assert_jitter;
+	uint16	mws_rx_deassert_offset;
+	uint16	mws_rx_deassert_jitter;
+	uint16	mws_tx_assert_offset;
+	uint16	mws_tx_assert_jitter;
+	uint16	mws_tx_deassert_offset;
+	uint16	mws_tx_deassert_jitter;
+	uint16	mws_pattern_assert_offset;
+	uint16	mws_pattern_assert_jitter;
+	uint16	mws_inact_dur_assert_offset;
+	uint16	mws_inact_dur_assert_jitter;
+	uint16	mws_scan_freq_assert_offset;
+	uint16	mws_scan_freq_assert_jitter;
+	uint16	mws_prio_assert_offset_req;
+} wci2_config_t;
+
+/* Analogue of HCI MWS Channel Params */
+typedef struct {
+	uint16	mws_rx_center_freq; /* MHz */
+	uint16	mws_tx_center_freq;
+	uint16	mws_rx_channel_bw;  /* KHz */
+	uint16	mws_tx_channel_bw;
+	uint8	mws_channel_en;
+	uint8	mws_channel_type;   /* Don't care for WLAN? */
+} mws_params_t;
+
+/* MWS wci2 message */
+typedef struct {
+	uint8	mws_wci2_data; /* BT-SIG msg */
+	uint16	mws_wci2_interval; /* Interval in us */
+	uint16	mws_wci2_repeat; /* No of msgs to send */
+} mws_wci2_msg_t;
+
+typedef struct {
+	uint32 config;	/* MODE: AUTO (-1), Disable (0), Enable (1) */
+	uint32 status;	/* Current state: Disabled (0), Enabled (1) */
+} wl_config_t;
+
+#define WLC_RSDB_MODE_AUTO_MASK 0x80
+#define WLC_RSDB_EXTRACT_MODE(val) ((int8)((val) & (~(WLC_RSDB_MODE_AUTO_MASK))))
+
+#define	WL_IF_STATS_T_VERSION 1	/* current version of wl_if_stats structure */
+
+/* per interface counters */
+typedef struct wl_if_stats {
+	uint16	version;		/* version of the structure */
+	uint16	length;			/* length of the entire structure */
+	uint32	PAD;			/* padding */
+
+	/* transmit stat counters */
+	uint64	txframe;		/* tx data frames */
+	uint64	txbyte;			/* tx data bytes */
+	uint64	txerror;		/* tx data errors (derived: sum of others) */
+	uint64  txnobuf;		/* tx out of buffer errors */
+	uint64  txrunt;			/* tx runt frames */
+	uint64  txfail;			/* tx failed frames */
+	uint64	txretry;		/* tx retry frames */
+	uint64	txretrie;		/* tx multiple retry frames */
+	uint64	txfrmsnt;		/* tx sent frames */
+	uint64	txmulti;		/* tx mulitcast sent frames */
+	uint64	txfrag;			/* tx fragments sent */
+
+	/* receive stat counters */
+	uint64	rxframe;		/* rx data frames */
+	uint64	rxbyte;			/* rx data bytes */
+	uint64	rxerror;		/* rx data errors (derived: sum of others) */
+	uint64	rxnobuf;		/* rx out of buffer errors */
+	uint64  rxrunt;			/* rx runt frames */
+	uint64  rxfragerr;		/* rx fragment errors */
+	uint64	rxmulti;		/* rx multicast frames */
+}
+wl_if_stats_t;
+
+typedef struct wl_band {
+	uint16		bandtype;		/* WL_BAND_2G, WL_BAND_5G */
+	uint16		bandunit;		/* bandstate[] index */
+	uint16		phytype;		/* phytype */
+	uint16		phyrev;
+}
+wl_band_t;
+
+#define	WL_WLC_VERSION_T_VERSION 1 /* current version of wlc_version structure */
+
+/* wlc interface version */
+typedef struct wl_wlc_version {
+	uint16	version;		/* version of the structure */
+	uint16	length;			/* length of the entire structure */
+
+	/* epi version numbers */
+	uint16	epi_ver_major;		/* epi major version number */
+	uint16	epi_ver_minor;		/* epi minor version number */
+	uint16	epi_rc_num;		/* epi RC number */
+	uint16	epi_incr_num;		/* epi increment number */
+
+	/* wlc interface version numbers */
+	uint16	wlc_ver_major;		/* wlc interface major version number */
+	uint16	wlc_ver_minor;		/* wlc interface minor version number */
+}
+wl_wlc_version_t;
+
+/* Version of WLC interface to be returned as a part of wl_wlc_version structure.
+ * For the discussion related to versions update policy refer to
+ * http://hwnbu-twiki.broadcom.com/bin/view/Mwgroup/WlShimAbstractionLayer
+ * For now the policy is to increment WLC_VERSION_MAJOR each time
+ * there is a change that involves both WLC layer and per-port layer.
+ * WLC_VERSION_MINOR is currently not in use.
+ */
+#define WLC_VERSION_MAJOR	3
+#define WLC_VERSION_MINOR	0
+
+
+/* require strict packing */
+#include <packed_section_start.h>
+/* Data returned by the bssload_report iovar.
+ * This is also the WLC_E_BSS_LOAD event data.
+ */
+typedef BWL_PRE_PACKED_STRUCT struct wl_bssload {
+	uint16 sta_count;		/* station count */
+	uint16 aac;			/* available admission capacity */
+	uint8 chan_util;		/* channel utilization */
+} BWL_POST_PACKED_STRUCT wl_bssload_t;
+
+/* Maximum number of configurable BSS Load levels.  The number of BSS Load
+ * ranges is always 1 more than the number of configured levels.  eg. if
+ * 3 levels of 10, 20, 30 are configured then this defines 4 load ranges:
+ * 0-10, 11-20, 21-30, 31-255.  A WLC_E_BSS_LOAD event is generated each time
+ * the utilization level crosses into another range, subject to the rate limit.
+ */
+#define MAX_BSSLOAD_LEVELS 8
+#define MAX_BSSLOAD_RANGES (MAX_BSSLOAD_LEVELS + 1)
+
+/* BSS Load event notification configuration. */
+typedef struct wl_bssload_cfg {
+	uint32 rate_limit_msec;	/* # of events posted to application will be limited to
+				 * one per specified period (0 to disable rate limit).
+				 */
+	uint8 num_util_levels;	/* Number of entries in util_levels[] below */
+	uint8 util_levels[MAX_BSSLOAD_LEVELS];
+				/* Variable number of BSS Load utilization levels in
+				 * low to high order.  An event will be posted each time
+				 * a received beacon's BSS Load IE channel utilization
+				 * value crosses a level.
+				 */
+} wl_bssload_cfg_t;
+
+/* Multiple roaming profile suport */
+#define WL_MAX_ROAM_PROF_BRACKETS	4
+
+#define WL_MAX_ROAM_PROF_VER	0
+
+#define WL_ROAM_PROF_NONE	(0 << 0)
+#define WL_ROAM_PROF_LAZY	(1 << 0)
+#define WL_ROAM_PROF_NO_CI	(1 << 1)
+#define WL_ROAM_PROF_SUSPEND	(1 << 2)
+#define WL_ROAM_PROF_SYNC_DTIM	(1 << 6)
+#define WL_ROAM_PROF_DEFAULT	(1 << 7)	/* backward compatible single default profile */
+
+typedef struct wl_roam_prof {
+	int8	roam_flags;		/* bit flags */
+	int8	roam_trigger;		/* RSSI trigger level per profile/RSSI bracket */
+	int8	rssi_lower;
+	int8	roam_delta;
+	int8	rssi_boost_thresh;	/* Min RSSI to qualify for RSSI boost */
+	int8	rssi_boost_delta;	/* RSSI boost for AP in the other band */
+	uint16	nfscan;			/* nuber of full scan to start with */
+	uint16	fullscan_period;
+	uint16	init_scan_period;
+	uint16	backoff_multiplier;
+	uint16	max_scan_period;
+} wl_roam_prof_t;
+
+typedef struct wl_roam_prof_band {
+	uint32	band;			/* Must be just one band */
+	uint16	ver;			/* version of this struct */
+	uint16	len;			/* length in bytes of this structure */
+	wl_roam_prof_t roam_prof[WL_MAX_ROAM_PROF_BRACKETS];
+} wl_roam_prof_band_t;
+
+/* Data structures for Interface Create/Remove  */
+
+#define WL_INTERFACE_CREATE_VER	(0)
+
+/*
+ * The flags filed of the wl_interface_create is designed to be
+ * a Bit Mask. As of now only Bit 0 and Bit 1 are used as mentioned below.
+ * The rest of the bits can be used, incase we have to provide
+ * more information to the dongle
+ */
+
+/*
+ * Bit 0 of flags field is used to inform whether the interface requested to
+ * be created is STA or AP.
+ * 0 - Create a STA interface
+ * 1 - Create an AP interface
+ */
+#define WL_INTERFACE_CREATE_STA	(0 << 0)
+#define WL_INTERFACE_CREATE_AP	(1 << 0)
+
+/*
+ * Bit 1 of flags field is used to inform whether MAC is present in the
+ * data structure or not.
+ * 0 - Ignore mac_addr field
+ * 1 - Use the mac_addr field
+ */
+#define WL_INTERFACE_MAC_DONT_USE	(0 << 1)
+#define WL_INTERFACE_MAC_USE		(1 << 1)
+
+typedef struct wl_interface_create {
+	uint16	ver;			/* version of this struct */
+	uint32  flags;			/* flags that defines the operation */
+	struct	ether_addr   mac_addr;	/* Optional Mac address */
+} wl_interface_create_t;
+
+typedef struct wl_interface_info {
+	uint16	ver;			/* version of this struct */
+	struct ether_addr    mac_addr;	/* MAC address of the interface */
+	char	ifname[BCM_MSG_IFNAME_MAX]; /* name of interface */
+	uint8	bsscfgidx;		/* source bsscfg index */
+} wl_interface_info_t;
+
+/* no default structure packing */
+#include <packed_section_end.h>
+
+#endif /* _wlioctl_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/Kconfig b/drivers/net/wireless/bcm4336/Kconfig
--- a/drivers/net/wireless/bcm4336/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/Kconfig	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,65 @@
+config BCMDHD
+	tristate "Broadcom FullMAC wireless cards support"
+	---help---
+	  This module adds support for wireless adapters based on
+	  Broadcom FullMAC chipset.
+
+config BCMDHD_FW_PATH
+	depends on BCMDHD
+	string "Firmware path"
+	default "/system/etc/firmware/fw_bcmdhd.bin"
+	---help---
+	  Path to the firmware file.
+
+config BCMDHD_NVRAM_PATH
+	depends on BCMDHD
+	string "NVRAM path"
+	default "/system/etc/firmware/nvram.txt"
+	---help---
+	  Path to the calibration file.
+
+config BCMDHD_WEXT
+	bool "Enable WEXT support"
+	depends on BCMDHD && CFG80211 = n
+	select WIRELESS_EXT
+	select WEXT_PRIV
+	help
+	  Enables WEXT support
+
+choice
+	prompt "Enable Chip Interface"
+	depends on BCMDHD
+	default BCMDHD_SDIO
+	---help---
+	  Enable Chip Interface.
+
+config BCMDHD_SDIO
+	bool "SDIO bus interface support"
+	depends on BCMDHD && MMC
+
+config BCMDHD_PCIE
+	bool "PCIe bus interface support"
+	depends on BCMDHD && PCI
+
+endchoice
+
+choice
+	depends on BCMDHD && BCMDHD_SDIO
+	prompt "Interrupt type"
+	default BCMDHD_OOB
+	---help---
+	  Interrupt type
+
+config BCMDHD_OOB
+	depends on BCMDHD && BCMDHD_SDIO
+	bool "Out-of-Band Interrupt"
+	---help---
+	  Interrupt from WL_HOST_WAKE.
+
+config BCMDHD_SDIO_IRQ
+	depends on BCMDHD && BCMDHD_SDIO
+	bool "In-Band Interrupt"
+	---help---
+	  Interrupt from SDIO DAT[1]
+
+endchoice
diff -ENwbur a/drivers/net/wireless/bcm4336/linux_osl.c b/drivers/net/wireless/bcm4336/linux_osl.c
--- a/drivers/net/wireless/bcm4336/linux_osl.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/linux_osl.c	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,2488 @@
+/*
+ * Linux OS Independent Layer
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: linux_osl.c 503131 2014-09-17 12:16:08Z $
+ */
+
+#define LINUX_PORT
+
+#include <typedefs.h>
+#include <bcmendian.h>
+#include <linuxver.h>
+#include <bcmdefs.h>
+
+#if defined(BCM47XX_CA9) && defined(__ARM_ARCH_7A__)
+#include <asm/cacheflush.h>
+#endif /* BCM47XX_CA9 && __ARM_ARCH_7A__ */
+
+#include <linux/random.h>
+
+#include <osl.h>
+#include <bcmutils.h>
+#include <linux/delay.h>
+#include <pcicfg.h>
+
+
+
+#ifdef BCM_SECURE_DMA
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include <linux/printk.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/moduleparam.h>
+#include <asm/io.h>
+#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
+#include <linux/highmem.h>
+#include <linux/dma-mapping.h>
+#include <asm/memory.h>
+#if defined(__ARM_ARCH_7A__)
+#include <arch/arm/include/asm/tlbflush.h>
+#include <arch/arm/mm/mm.h>
+#endif
+#include <linux/brcmstb/cma_driver.h>
+#endif /* BCM_SECURE_DMA */
+
+#include <linux/fs.h>
+
+#ifdef BCM47XX_ACP_WAR
+#include <linux/spinlock.h>
+extern spinlock_t l2x0_reg_lock;
+#endif
+
+#if defined(BCMPCIE)
+#if defined(CONFIG_DHD_USE_STATIC_BUF) && defined(DHD_USE_STATIC_FLOWRING)
+#include <bcmpcie.h>
+#endif /* CONFIG_DHD_USE_STATIC_BUF && DHD_USE_STATIC_FLOWRING */
+#endif /* BCMPCIE */
+
+#define PCI_CFG_RETRY		10
+
+#define OS_HANDLE_MAGIC		0x1234abcd	/* Magic # to recognize osh */
+#define BCM_MEM_FILENAME_LEN	24		/* Mem. filename length */
+#define DUMPBUFSZ 1024
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+#define DHD_SKB_HDRSIZE		336
+#define DHD_SKB_1PAGE_BUFSIZE	((PAGE_SIZE*1)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_2PAGE_BUFSIZE	((PAGE_SIZE*2)-DHD_SKB_HDRSIZE)
+#define DHD_SKB_4PAGE_BUFSIZE	((PAGE_SIZE*4)-DHD_SKB_HDRSIZE)
+
+#define STATIC_BUF_MAX_NUM	16
+#define STATIC_BUF_SIZE	(PAGE_SIZE*2)
+#define STATIC_BUF_TOTAL_LEN	(STATIC_BUF_MAX_NUM * STATIC_BUF_SIZE)
+
+typedef struct bcm_static_buf {
+	struct semaphore static_sem;
+	unsigned char *buf_ptr;
+	unsigned char buf_use[STATIC_BUF_MAX_NUM];
+} bcm_static_buf_t;
+
+static bcm_static_buf_t *bcm_static_buf = 0;
+
+#define STATIC_PKT_MAX_NUM	8
+#if defined(ENHANCED_STATIC_BUF)
+#define STATIC_PKT_4PAGE_NUM	1
+#define DHD_SKB_MAX_BUFSIZE	DHD_SKB_4PAGE_BUFSIZE
+#else
+#define STATIC_PKT_4PAGE_NUM	0
+#define DHD_SKB_MAX_BUFSIZE DHD_SKB_2PAGE_BUFSIZE
+#endif /* ENHANCED_STATIC_BUF */
+
+typedef struct bcm_static_pkt {
+	struct sk_buff *skb_4k[STATIC_PKT_MAX_NUM];
+	struct sk_buff *skb_8k[STATIC_PKT_MAX_NUM];
+#ifdef ENHANCED_STATIC_BUF
+	struct sk_buff *skb_16k;
+#endif
+	struct semaphore osl_pkt_sem;
+	unsigned char pkt_use[STATIC_PKT_MAX_NUM * 2 + STATIC_PKT_4PAGE_NUM];
+} bcm_static_pkt_t;
+
+static bcm_static_pkt_t *bcm_static_skb = 0;
+
+#if defined(BCMPCIE) && defined(DHD_USE_STATIC_FLOWRING)
+#define STATIC_BUF_FLOWRING_SIZE	((PAGE_SIZE)*(7))
+#define STATIC_BUF_FLOWRING_NUM		42
+#define RINGID_TO_FLOWID(idx)	((idx) + (BCMPCIE_H2D_COMMON_MSGRINGS) \
+	- (BCMPCIE_H2D_TXFLOWRINGID))
+typedef struct bcm_static_flowring_buf {
+	spinlock_t flowring_lock;
+	void *buf_ptr[STATIC_BUF_FLOWRING_NUM];
+	unsigned char buf_use[STATIC_BUF_FLOWRING_NUM];
+} bcm_static_flowring_buf_t;
+
+bcm_static_flowring_buf_t *bcm_static_flowring = 0;
+#endif /* BCMPCIE && DHD_USE_STATIC_FLOWRING */
+
+void* wifi_platform_prealloc(void *adapter, int section, unsigned long size);
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+typedef struct bcm_mem_link {
+	struct bcm_mem_link *prev;
+	struct bcm_mem_link *next;
+	uint	size;
+	int	line;
+	void 	*osh;
+	char	file[BCM_MEM_FILENAME_LEN];
+} bcm_mem_link_t;
+
+struct osl_cmn_info {
+	atomic_t malloced;
+	atomic_t pktalloced;    /* Number of allocated packet buffers */
+	spinlock_t dbgmem_lock;
+	bcm_mem_link_t *dbgmem_list;
+	spinlock_t pktalloc_lock;
+	atomic_t refcount; /* Number of references to this shared structure. */
+};
+typedef struct osl_cmn_info osl_cmn_t;
+
+struct osl_info {
+	osl_pubinfo_t pub;
+#ifdef CTFPOOL
+	ctfpool_t *ctfpool;
+#endif /* CTFPOOL */
+	uint magic;
+	void *pdev;
+	uint failed;
+	uint bustype;
+	osl_cmn_t *cmn; /* Common OSL related data shred between two OSH's */
+
+	void *bus_handle;
+#ifdef BCMDBG_CTRACE
+	spinlock_t ctrace_lock;
+	struct list_head ctrace_list;
+	int ctrace_num;
+#endif /* BCMDBG_CTRACE */
+	uint32  flags;		/* If specific cases to be handled in the OSL */
+#ifdef	BCM_SECURE_DMA
+	struct cma_dev *cma;
+	struct sec_mem_elem *sec_list_512;
+	struct sec_mem_elem *sec_list_base_512;
+	struct sec_mem_elem *sec_list_2048;
+	struct sec_mem_elem *sec_list_base_2048;
+	struct sec_mem_elem *sec_list_4096;
+	struct sec_mem_elem *sec_list_base_4096;
+	phys_addr_t  contig_base;
+	void *contig_base_va;
+	phys_addr_t  contig_base_alloc;
+	void *contig_base_alloc_va;
+	phys_addr_t contig_base_alloc_coherent;
+	void *contig_base_alloc_coherent_va;
+	phys_addr_t contig_delta_va_pa;
+	struct {
+		phys_addr_t pa;
+		void *va;
+		bool avail;
+	} sec_cma_coherent[SEC_CMA_COHERENT_MAX];
+
+#endif /* BCM_SECURE_DMA */
+
+};
+#ifdef BCM_SECURE_DMA
+phys_addr_t g_contig_delta_va_pa;
+static void osl_sec_dma_setup_contig_mem(osl_t *osh, unsigned long memsize, int regn);
+static int osl_sec_dma_alloc_contig_mem(osl_t *osh, unsigned long memsize, int regn);
+static void osl_sec_dma_free_contig_mem(osl_t *osh, u32 memsize, int regn);
+static void * osl_sec_dma_ioremap(osl_t *osh, struct page *page, size_t size,
+	bool iscache, bool isdecr);
+static void osl_sec_dma_iounmap(osl_t *osh, void *contig_base_va, size_t size);
+static void osl_sec_dma_init_elem_mem_block(osl_t *osh, size_t mbsize, int max,
+	sec_mem_elem_t **list);
+static void osl_sec_dma_deinit_elem_mem_block(osl_t *osh, size_t mbsize, int max,
+	void *sec_list_base);
+static sec_mem_elem_t * osl_sec_dma_alloc_mem_elem(osl_t *osh, void *va, uint size,
+	int direction, struct sec_cma_info *ptr_cma_info, uint offset);
+static void osl_sec_dma_free_mem_elem(osl_t *osh, sec_mem_elem_t *sec_mem_elem);
+static void osl_sec_dma_init_consistent(osl_t *osh);
+static void *osl_sec_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits,
+	ulong *pap);
+static void osl_sec_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa);
+#endif /* BCM_SECURE_DMA */
+
+#define OSL_PKTTAG_CLEAR(p) \
+do { \
+	struct sk_buff *s = (struct sk_buff *)(p); \
+	ASSERT(OSL_PKTTAG_SZ == 32); \
+	*(uint32 *)(&s->cb[0]) = 0; *(uint32 *)(&s->cb[4]) = 0; \
+	*(uint32 *)(&s->cb[8]) = 0; *(uint32 *)(&s->cb[12]) = 0; \
+	*(uint32 *)(&s->cb[16]) = 0; *(uint32 *)(&s->cb[20]) = 0; \
+	*(uint32 *)(&s->cb[24]) = 0; *(uint32 *)(&s->cb[28]) = 0; \
+} while (0)
+
+/* PCMCIA attribute space access macros */
+
+/* Global ASSERT type flag */
+uint32 g_assert_type = 0;
+module_param(g_assert_type, int, 0);
+
+static int16 linuxbcmerrormap[] =
+{	0, 			/* 0 */
+	-EINVAL,		/* BCME_ERROR */
+	-EINVAL,		/* BCME_BADARG */
+	-EINVAL,		/* BCME_BADOPTION */
+	-EINVAL,		/* BCME_NOTUP */
+	-EINVAL,		/* BCME_NOTDOWN */
+	-EINVAL,		/* BCME_NOTAP */
+	-EINVAL,		/* BCME_NOTSTA */
+	-EINVAL,		/* BCME_BADKEYIDX */
+	-EINVAL,		/* BCME_RADIOOFF */
+	-EINVAL,		/* BCME_NOTBANDLOCKED */
+	-EINVAL, 		/* BCME_NOCLK */
+	-EINVAL, 		/* BCME_BADRATESET */
+	-EINVAL, 		/* BCME_BADBAND */
+	-E2BIG,			/* BCME_BUFTOOSHORT */
+	-E2BIG,			/* BCME_BUFTOOLONG */
+	-EBUSY, 		/* BCME_BUSY */
+	-EINVAL, 		/* BCME_NOTASSOCIATED */
+	-EINVAL, 		/* BCME_BADSSIDLEN */
+	-EINVAL, 		/* BCME_OUTOFRANGECHAN */
+	-EINVAL, 		/* BCME_BADCHAN */
+	-EFAULT, 		/* BCME_BADADDR */
+	-ENOMEM, 		/* BCME_NORESOURCE */
+	-EOPNOTSUPP,		/* BCME_UNSUPPORTED */
+	-EMSGSIZE,		/* BCME_BADLENGTH */
+	-EINVAL,		/* BCME_NOTREADY */
+	-EPERM,			/* BCME_EPERM */
+	-ENOMEM, 		/* BCME_NOMEM */
+	-EINVAL, 		/* BCME_ASSOCIATED */
+	-ERANGE, 		/* BCME_RANGE */
+	-EINVAL, 		/* BCME_NOTFOUND */
+	-EINVAL, 		/* BCME_WME_NOT_ENABLED */
+	-EINVAL, 		/* BCME_TSPEC_NOTFOUND */
+	-EINVAL, 		/* BCME_ACM_NOTSUPPORTED */
+	-EINVAL,		/* BCME_NOT_WME_ASSOCIATION */
+	-EIO,			/* BCME_SDIO_ERROR */
+	-ENODEV,		/* BCME_DONGLE_DOWN */
+	-EINVAL,		/* BCME_VERSION */
+	-EIO,			/* BCME_TXFAIL */
+	-EIO,			/* BCME_RXFAIL */
+	-ENODEV,		/* BCME_NODEVICE */
+	-EINVAL,		/* BCME_NMODE_DISABLED */
+	-ENODATA,		/* BCME_NONRESIDENT */
+	-EINVAL,		/* BCME_SCANREJECT */
+	-EINVAL,		/* BCME_USAGE_ERROR */
+	-EIO,     		/* BCME_IOCTL_ERROR */
+	-EIO,			/* BCME_SERIAL_PORT_ERR */
+	-EOPNOTSUPP,	/* BCME_DISABLED, BCME_NOTENABLED */
+	-EIO,			/* BCME_DECERR */
+	-EIO,			/* BCME_ENCERR */
+	-EIO,			/* BCME_MICERR */
+	-ERANGE,		/* BCME_REPLAY */
+	-EINVAL,		/* BCME_IE_NOTFOUND */
+
+/* When an new error code is added to bcmutils.h, add os
+ * specific error translation here as well
+ */
+/* check if BCME_LAST changed since the last time this function was updated */
+#if BCME_LAST != -52
+#error "You need to add a OS error translation in the linuxbcmerrormap \
+	for new error code defined in bcmutils.h"
+#endif
+};
+
+/* translate bcmerrors into linux errors */
+int
+osl_error(int bcmerror)
+{
+	if (bcmerror > 0)
+		bcmerror = 0;
+	else if (bcmerror < BCME_LAST)
+		bcmerror = BCME_ERROR;
+
+	/* Array bounds covered by ASSERT in osl_attach */
+	return linuxbcmerrormap[-bcmerror];
+}
+
+osl_t *
+#ifdef SHARED_OSL_CMN
+osl_attach(void *pdev, uint bustype, bool pkttag, void **osl_cmn)
+#else
+osl_attach(void *pdev, uint bustype, bool pkttag)
+#endif /* SHARED_OSL_CMN */
+{
+#ifndef SHARED_OSL_CMN
+	void **osl_cmn = NULL;
+#endif /* SHARED_OSL_CMN */
+	osl_t *osh;
+	gfp_t flags;
+
+	flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+	if (!(osh = kmalloc(sizeof(osl_t), flags)))
+		return osh;
+
+	ASSERT(osh);
+
+	bzero(osh, sizeof(osl_t));
+
+	if (osl_cmn == NULL || *osl_cmn == NULL) {
+		if (!(osh->cmn = kmalloc(sizeof(osl_cmn_t), flags))) {
+			kfree(osh);
+			return NULL;
+		}
+		bzero(osh->cmn, sizeof(osl_cmn_t));
+		if (osl_cmn)
+			*osl_cmn = osh->cmn;
+		atomic_set(&osh->cmn->malloced, 0);
+		osh->cmn->dbgmem_list = NULL;
+		spin_lock_init(&(osh->cmn->dbgmem_lock));
+
+		spin_lock_init(&(osh->cmn->pktalloc_lock));
+
+	} else {
+		osh->cmn = *osl_cmn;
+	}
+	atomic_add(1, &osh->cmn->refcount);
+
+	/* Check that error map has the right number of entries in it */
+	ASSERT(ABS(BCME_LAST) == (ARRAYSIZE(linuxbcmerrormap) - 1));
+
+	osh->failed = 0;
+	osh->pdev = pdev;
+	osh->pub.pkttag = pkttag;
+	osh->bustype = bustype;
+	osh->magic = OS_HANDLE_MAGIC;
+#ifdef BCM_SECURE_DMA
+
+	osl_sec_dma_setup_contig_mem(osh, CMA_MEMBLOCK, CONT_ARMREGION);
+
+#ifdef BCM47XX_CA9
+	osh->contig_base_alloc_coherent_va = osl_sec_dma_ioremap(osh,
+		phys_to_page((u32)osh->contig_base_alloc),
+		CMA_DMA_DESC_MEMBLOCK, TRUE, TRUE);
+#else
+	osh->contig_base_alloc_coherent_va = osl_sec_dma_ioremap(osh,
+		phys_to_page((u32)osh->contig_base_alloc),
+		CMA_DMA_DESC_MEMBLOCK, FALSE, TRUE);
+#endif /* BCM47XX_CA9 */
+
+	osh->contig_base_alloc_coherent = osh->contig_base_alloc;
+	osl_sec_dma_init_consistent(osh);
+
+	osh->contig_base_alloc += CMA_DMA_DESC_MEMBLOCK;
+
+	osh->contig_base_alloc_va = osl_sec_dma_ioremap(osh,
+		phys_to_page((u32)osh->contig_base_alloc), CMA_DMA_DATA_MEMBLOCK, TRUE, FALSE);
+	osh->contig_base_va = osh->contig_base_alloc_va;
+
+	/*
+	* osl_sec_dma_init_elem_mem_block(osh, CMA_BUFSIZE_512, CMA_BUFNUM, &osh->sec_list_512);
+	* osh->sec_list_base_512 = osh->sec_list_512;
+	* osl_sec_dma_init_elem_mem_block(osh, CMA_BUFSIZE_2K, CMA_BUFNUM, &osh->sec_list_2048);
+	* osh->sec_list_base_2048 = osh->sec_list_2048;
+	*/
+	osl_sec_dma_init_elem_mem_block(osh, CMA_BUFSIZE_4K, CMA_BUFNUM, &osh->sec_list_4096);
+	osh->sec_list_base_4096 = osh->sec_list_4096;
+
+#endif /* BCM_SECURE_DMA */
+
+	switch (bustype) {
+		case PCI_BUS:
+		case SI_BUS:
+		case PCMCIA_BUS:
+			osh->pub.mmbus = TRUE;
+			break;
+		case JTAG_BUS:
+		case SDIO_BUS:
+		case USB_BUS:
+		case SPI_BUS:
+		case RPC_BUS:
+			osh->pub.mmbus = FALSE;
+			break;
+		default:
+			ASSERT(FALSE);
+			break;
+	}
+
+#ifdef BCMDBG_CTRACE
+	spin_lock_init(&osh->ctrace_lock);
+	INIT_LIST_HEAD(&osh->ctrace_list);
+	osh->ctrace_num = 0;
+#endif /* BCMDBG_CTRACE */
+
+
+	return osh;
+}
+
+int osl_static_mem_init(osl_t *osh, void *adapter)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+	if (!bcm_static_buf && adapter) {
+		if (!(bcm_static_buf = (bcm_static_buf_t *)wifi_platform_prealloc(adapter,
+			3, STATIC_BUF_SIZE + STATIC_BUF_TOTAL_LEN))) {
+			printk("can not alloc static buf!\n");
+			bcm_static_skb = NULL;
+			ASSERT(osh->magic == OS_HANDLE_MAGIC);
+			return -ENOMEM;
+		}
+		else
+			printk("alloc static buf at %p!\n", bcm_static_buf);
+
+
+		sema_init(&bcm_static_buf->static_sem, 1);
+
+		bcm_static_buf->buf_ptr = (unsigned char *)bcm_static_buf + STATIC_BUF_SIZE;
+	}
+
+#ifdef BCMSDIO
+	if (!bcm_static_skb && adapter) {
+		int i;
+		void *skb_buff_ptr = 0;
+		bcm_static_skb = (bcm_static_pkt_t *)((char *)bcm_static_buf + 2048);
+		skb_buff_ptr = wifi_platform_prealloc(adapter, 4, 0);
+		if (!skb_buff_ptr) {
+			printk("cannot alloc static buf!\n");
+			bcm_static_buf = NULL;
+			bcm_static_skb = NULL;
+			ASSERT(osh->magic == OS_HANDLE_MAGIC);
+			return -ENOMEM;
+		}
+
+		bcopy(skb_buff_ptr, bcm_static_skb, sizeof(struct sk_buff *) *
+			(STATIC_PKT_MAX_NUM * 2 + STATIC_PKT_4PAGE_NUM));
+		for (i = 0; i < STATIC_PKT_MAX_NUM * 2 + STATIC_PKT_4PAGE_NUM; i++)
+			bcm_static_skb->pkt_use[i] = 0;
+
+		sema_init(&bcm_static_skb->osl_pkt_sem, 1);
+	}
+#endif /* BCMSDIO */
+#if defined(BCMPCIE) && defined(DHD_USE_STATIC_FLOWRING)
+	if (!bcm_static_flowring && adapter) {
+		int i;
+		void *flowring_ptr = 0;
+		bcm_static_flowring =
+			(bcm_static_flowring_buf_t *)((char *)bcm_static_buf + 4096);
+		flowring_ptr = wifi_platform_prealloc(adapter, 10, 0);
+		if (!flowring_ptr) {
+			printk("%s: flowring_ptr is NULL\n", __FUNCTION__);
+			bcm_static_buf = NULL;
+			bcm_static_skb = NULL;
+			bcm_static_flowring = NULL;
+			ASSERT(osh->magic == OS_HANDLE_MAGIC);
+			return -ENOMEM;
+		}
+
+		bcopy(flowring_ptr, bcm_static_flowring->buf_ptr,
+			sizeof(void *) * STATIC_BUF_FLOWRING_NUM);
+		for (i = 0; i < STATIC_BUF_FLOWRING_NUM; i++) {
+			bcm_static_flowring->buf_use[i] = 0;
+		}
+
+		spin_lock_init(&bcm_static_flowring->flowring_lock);
+	}
+#endif /* BCMPCIE && DHD_USE_STATIC_FLOWRING */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+	return 0;
+}
+
+void osl_set_bus_handle(osl_t *osh, void *bus_handle)
+{
+	osh->bus_handle = bus_handle;
+}
+
+void* osl_get_bus_handle(osl_t *osh)
+{
+	return osh->bus_handle;
+}
+
+void
+osl_detach(osl_t *osh)
+{
+	if (osh == NULL)
+		return;
+#ifdef BCM_SECURE_DMA
+	osl_sec_dma_free_contig_mem(osh, CMA_MEMBLOCK, CONT_ARMREGION);
+	osl_sec_dma_deinit_elem_mem_block(osh, CMA_BUFSIZE_512, CMA_BUFNUM, osh->sec_list_base_512);
+	osl_sec_dma_deinit_elem_mem_block(osh, CMA_BUFSIZE_2K, CMA_BUFNUM, osh->sec_list_base_2048);
+	osl_sec_dma_deinit_elem_mem_block(osh, CMA_BUFSIZE_4K, CMA_BUFNUM, osh->sec_list_base_4096);
+	osl_sec_dma_iounmap(osh, osh->contig_base_va, CMA_MEMBLOCK);
+#endif /* BCM_SECURE_DMA */
+
+	ASSERT(osh->magic == OS_HANDLE_MAGIC);
+	atomic_sub(1, &osh->cmn->refcount);
+	if (atomic_read(&osh->cmn->refcount) == 0) {
+			kfree(osh->cmn);
+	}
+	kfree(osh);
+}
+
+int osl_static_mem_deinit(osl_t *osh, void *adapter)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+	if (bcm_static_buf) {
+		bcm_static_buf = 0;
+	}
+#ifdef BCMSDIO
+	if (bcm_static_skb) {
+		bcm_static_skb = 0;
+	}
+#endif /* BCMSDIO */
+#if defined(BCMPCIE) && defined(DHD_USE_STATIC_FLOWRING)
+	if (bcm_static_flowring) {
+		bcm_static_flowring = 0;
+	}
+#endif /* BCMPCIE && DHD_USE_STATIC_FLOWRING */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+	return 0;
+}
+
+static struct sk_buff *osl_alloc_skb(osl_t *osh, unsigned int len)
+{
+	struct sk_buff *skb;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+	gfp_t flags = (in_atomic() || irqs_disabled()) ? GFP_ATOMIC : GFP_KERNEL;
+#if defined(CONFIG_SPARSEMEM) && defined(CONFIG_ZONE_DMA)
+	flags |= GFP_ATOMIC;
+#endif
+	skb = __dev_alloc_skb(len, flags);
+#else
+	skb = dev_alloc_skb(len);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) */
+	return skb;
+}
+
+#ifdef CTFPOOL
+
+#ifdef CTFPOOL_SPINLOCK
+#define CTFPOOL_LOCK(ctfpool, flags)	spin_lock_irqsave(&(ctfpool)->lock, flags)
+#define CTFPOOL_UNLOCK(ctfpool, flags)	spin_unlock_irqrestore(&(ctfpool)->lock, flags)
+#else
+#define CTFPOOL_LOCK(ctfpool, flags)	spin_lock_bh(&(ctfpool)->lock)
+#define CTFPOOL_UNLOCK(ctfpool, flags)	spin_unlock_bh(&(ctfpool)->lock)
+#endif /* CTFPOOL_SPINLOCK */
+/*
+ * Allocate and add an object to packet pool.
+ */
+void *
+osl_ctfpool_add(osl_t *osh)
+{
+	struct sk_buff *skb;
+#ifdef CTFPOOL_SPINLOCK
+	unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+	if ((osh == NULL) || (osh->ctfpool == NULL))
+		return NULL;
+
+	CTFPOOL_LOCK(osh->ctfpool, flags);
+	ASSERT(osh->ctfpool->curr_obj <= osh->ctfpool->max_obj);
+
+	/* No need to allocate more objects */
+	if (osh->ctfpool->curr_obj == osh->ctfpool->max_obj) {
+		CTFPOOL_UNLOCK(osh->ctfpool, flags);
+		return NULL;
+	}
+
+	/* Allocate a new skb and add it to the ctfpool */
+	skb = osl_alloc_skb(osh, osh->ctfpool->obj_size);
+	if (skb == NULL) {
+		printf("%s: skb alloc of len %d failed\n", __FUNCTION__,
+		       osh->ctfpool->obj_size);
+		CTFPOOL_UNLOCK(osh->ctfpool, flags);
+		return NULL;
+	}
+
+	/* Add to ctfpool */
+	skb->next = (struct sk_buff *)osh->ctfpool->head;
+	osh->ctfpool->head = skb;
+	osh->ctfpool->fast_frees++;
+	osh->ctfpool->curr_obj++;
+
+	/* Hijack a skb member to store ptr to ctfpool */
+	CTFPOOLPTR(osh, skb) = (void *)osh->ctfpool;
+
+	/* Use bit flag to indicate skb from fast ctfpool */
+	PKTFAST(osh, skb) = FASTBUF;
+
+	CTFPOOL_UNLOCK(osh->ctfpool, flags);
+
+	return skb;
+}
+
+/*
+ * Add new objects to the pool.
+ */
+void
+osl_ctfpool_replenish(osl_t *osh, uint thresh)
+{
+	if ((osh == NULL) || (osh->ctfpool == NULL))
+		return;
+
+	/* Do nothing if no refills are required */
+	while ((osh->ctfpool->refills > 0) && (thresh--)) {
+		osl_ctfpool_add(osh);
+		osh->ctfpool->refills--;
+	}
+}
+
+/*
+ * Initialize the packet pool with specified number of objects.
+ */
+int32
+osl_ctfpool_init(osl_t *osh, uint numobj, uint size)
+{
+	gfp_t flags;
+
+	flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+	osh->ctfpool = kzalloc(sizeof(ctfpool_t), flags);
+	ASSERT(osh->ctfpool);
+
+	osh->ctfpool->max_obj = numobj;
+	osh->ctfpool->obj_size = size;
+
+	spin_lock_init(&osh->ctfpool->lock);
+
+	while (numobj--) {
+		if (!osl_ctfpool_add(osh))
+			return -1;
+		osh->ctfpool->fast_frees--;
+	}
+
+	return 0;
+}
+
+/*
+ * Cleanup the packet pool objects.
+ */
+void
+osl_ctfpool_cleanup(osl_t *osh)
+{
+	struct sk_buff *skb, *nskb;
+#ifdef CTFPOOL_SPINLOCK
+	unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+	if ((osh == NULL) || (osh->ctfpool == NULL))
+		return;
+
+	CTFPOOL_LOCK(osh->ctfpool, flags);
+
+	skb = osh->ctfpool->head;
+
+	while (skb != NULL) {
+		nskb = skb->next;
+		dev_kfree_skb(skb);
+		skb = nskb;
+		osh->ctfpool->curr_obj--;
+	}
+
+	ASSERT(osh->ctfpool->curr_obj == 0);
+	osh->ctfpool->head = NULL;
+	CTFPOOL_UNLOCK(osh->ctfpool, flags);
+
+	kfree(osh->ctfpool);
+	osh->ctfpool = NULL;
+}
+
+void
+osl_ctfpool_stats(osl_t *osh, void *b)
+{
+	struct bcmstrbuf *bb;
+
+	if ((osh == NULL) || (osh->ctfpool == NULL))
+		return;
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+	if (bcm_static_buf) {
+		bcm_static_buf = 0;
+	}
+#ifdef BCMSDIO
+	if (bcm_static_skb) {
+		bcm_static_skb = 0;
+	}
+#endif /* BCMSDIO */
+#if defined(BCMPCIE) && defined(DHD_USE_STATIC_FLOWRING)
+	if (bcm_static_flowring) {
+		bcm_static_flowring = 0;
+	}
+#endif /* BCMPCIE && DHD_USE_STATIC_FLOWRING */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+	bb = b;
+
+	ASSERT((osh != NULL) && (bb != NULL));
+
+	bcm_bprintf(bb, "max_obj %d obj_size %d curr_obj %d refills %d\n",
+	            osh->ctfpool->max_obj, osh->ctfpool->obj_size,
+	            osh->ctfpool->curr_obj, osh->ctfpool->refills);
+	bcm_bprintf(bb, "fast_allocs %d fast_frees %d slow_allocs %d\n",
+	            osh->ctfpool->fast_allocs, osh->ctfpool->fast_frees,
+	            osh->ctfpool->slow_allocs);
+}
+
+static inline struct sk_buff *
+osl_pktfastget(osl_t *osh, uint len)
+{
+	struct sk_buff *skb;
+#ifdef CTFPOOL_SPINLOCK
+	unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+	/* Try to do fast allocate. Return null if ctfpool is not in use
+	 * or if there are no items in the ctfpool.
+	 */
+	if (osh->ctfpool == NULL)
+		return NULL;
+
+	CTFPOOL_LOCK(osh->ctfpool, flags);
+	if (osh->ctfpool->head == NULL) {
+		ASSERT(osh->ctfpool->curr_obj == 0);
+		osh->ctfpool->slow_allocs++;
+		CTFPOOL_UNLOCK(osh->ctfpool, flags);
+		return NULL;
+	}
+
+	if (len > osh->ctfpool->obj_size) {
+		CTFPOOL_UNLOCK(osh->ctfpool, flags);
+		return NULL;
+	}
+
+	ASSERT(len <= osh->ctfpool->obj_size);
+
+	/* Get an object from ctfpool */
+	skb = (struct sk_buff *)osh->ctfpool->head;
+	osh->ctfpool->head = (void *)skb->next;
+
+	osh->ctfpool->fast_allocs++;
+	osh->ctfpool->curr_obj--;
+	ASSERT(CTFPOOLHEAD(osh, skb) == (struct sock *)osh->ctfpool->head);
+	CTFPOOL_UNLOCK(osh->ctfpool, flags);
+
+	/* Init skb struct */
+	skb->next = skb->prev = NULL;
+#if defined(__ARM_ARCH_7A__)
+	skb->data = skb->head + NET_SKB_PAD;
+	skb->tail = skb->head + NET_SKB_PAD;
+#else
+	skb->data = skb->head + 16;
+	skb->tail = skb->head + 16;
+#endif /* __ARM_ARCH_7A__ */
+	skb->len = 0;
+	skb->cloned = 0;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+	skb->list = NULL;
+#endif
+	atomic_set(&skb->users, 1);
+
+	PKTSETCLINK(skb, NULL);
+	PKTCCLRATTR(skb);
+	PKTFAST(osh, skb) &= ~(CTFBUF | SKIPCT | CHAINED);
+
+	return skb;
+}
+#endif /* CTFPOOL */
+
+#if defined(BCM_GMAC3)
+/* Account for a packet delivered to downstream forwarder.
+ * Decrement a GMAC forwarder interface's pktalloced count.
+ */
+void BCMFASTPATH
+osl_pkt_tofwder(osl_t *osh, void *skbs, int skb_cnt)
+{
+
+	atomic_sub(skb_cnt, &osh->cmn->pktalloced);
+}
+
+/* Account for a downstream forwarder delivered packet to a WL/DHD driver.
+ * Increment a GMAC forwarder interface's pktalloced count.
+ */
+void BCMFASTPATH
+#ifdef BCMDBG_CTRACE
+osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt, int line, char *file)
+#else
+osl_pkt_frmfwder(osl_t *osh, void *skbs, int skb_cnt)
+#endif /* BCMDBG_CTRACE */
+{
+#if defined(BCMDBG_CTRACE)
+	int i;
+	struct sk_buff *skb;
+#endif
+
+#if defined(BCMDBG_CTRACE)
+	if (skb_cnt > 1) {
+		struct sk_buff **skb_array = (struct sk_buff **)skbs;
+		for (i = 0; i < skb_cnt; i++) {
+			skb = skb_array[i];
+#if defined(BCMDBG_CTRACE)
+			ASSERT(!PKTISCHAINED(skb));
+			ADD_CTRACE(osh, skb, file, line);
+#endif /* BCMDBG_CTRACE */
+		}
+	} else {
+		skb = (struct sk_buff *)skbs;
+#if defined(BCMDBG_CTRACE)
+		ASSERT(!PKTISCHAINED(skb));
+		ADD_CTRACE(osh, skb, file, line);
+#endif /* BCMDBG_CTRACE */
+	}
+#endif
+
+	atomic_add(skb_cnt, &osh->cmn->pktalloced);
+}
+
+#endif /* BCM_GMAC3 */
+
+/* Convert a driver packet to native(OS) packet
+ * In the process, packettag is zeroed out before sending up
+ * IP code depends on skb->cb to be setup correctly with various options
+ * In our case, that means it should be 0
+ */
+struct sk_buff * BCMFASTPATH
+osl_pkt_tonative(osl_t *osh, void *pkt)
+{
+	struct sk_buff *nskb;
+#ifdef BCMDBG_CTRACE
+	struct sk_buff *nskb1, *nskb2;
+#endif
+
+	if (osh->pub.pkttag)
+		OSL_PKTTAG_CLEAR(pkt);
+
+	/* Decrement the packet counter */
+	for (nskb = (struct sk_buff *)pkt; nskb; nskb = nskb->next) {
+		atomic_sub(PKTISCHAINED(nskb) ? PKTCCNT(nskb) : 1, &osh->cmn->pktalloced);
+
+#ifdef BCMDBG_CTRACE
+		for (nskb1 = nskb; nskb1 != NULL; nskb1 = nskb2) {
+			if (PKTISCHAINED(nskb1)) {
+				nskb2 = PKTCLINK(nskb1);
+			}
+			else
+				nskb2 = NULL;
+
+			DEL_CTRACE(osh, nskb1);
+		}
+#endif /* BCMDBG_CTRACE */
+	}
+	return (struct sk_buff *)pkt;
+}
+
+/* Convert a native(OS) packet to driver packet.
+ * In the process, native packet is destroyed, there is no copying
+ * Also, a packettag is zeroed out
+ */
+void * BCMFASTPATH
+#ifdef BCMDBG_CTRACE
+osl_pkt_frmnative(osl_t *osh, void *pkt, int line, char *file)
+#else
+osl_pkt_frmnative(osl_t *osh, void *pkt)
+#endif /* BCMDBG_CTRACE */
+{
+	struct sk_buff *nskb;
+#ifdef BCMDBG_CTRACE
+	struct sk_buff *nskb1, *nskb2;
+#endif
+
+	if (osh->pub.pkttag)
+		OSL_PKTTAG_CLEAR(pkt);
+
+	/* Increment the packet counter */
+	for (nskb = (struct sk_buff *)pkt; nskb; nskb = nskb->next) {
+		atomic_add(PKTISCHAINED(nskb) ? PKTCCNT(nskb) : 1, &osh->cmn->pktalloced);
+
+#ifdef BCMDBG_CTRACE
+		for (nskb1 = nskb; nskb1 != NULL; nskb1 = nskb2) {
+			if (PKTISCHAINED(nskb1)) {
+				nskb2 = PKTCLINK(nskb1);
+			}
+			else
+				nskb2 = NULL;
+
+			ADD_CTRACE(osh, nskb1, file, line);
+		}
+#endif /* BCMDBG_CTRACE */
+	}
+	return (void *)pkt;
+}
+
+/* Return a new packet. zero out pkttag */
+void * BCMFASTPATH
+#ifdef BCMDBG_CTRACE
+osl_pktget(osl_t *osh, uint len, int line, char *file)
+#else
+osl_pktget(osl_t *osh, uint len)
+#endif /* BCMDBG_CTRACE */
+{
+	struct sk_buff *skb;
+
+#ifdef CTFPOOL
+	/* Allocate from local pool */
+	skb = osl_pktfastget(osh, len);
+	if ((skb != NULL) || ((skb = osl_alloc_skb(osh, len)) != NULL))
+#else /* CTFPOOL */
+	if ((skb = osl_alloc_skb(osh, len)))
+#endif /* CTFPOOL */
+	{
+		skb->tail += len;
+		skb->len  += len;
+		skb->priority = 0;
+
+#ifdef BCMDBG_CTRACE
+		ADD_CTRACE(osh, skb, file, line);
+#endif
+		atomic_inc(&osh->cmn->pktalloced);
+	}
+
+	return ((void*) skb);
+}
+
+#ifdef CTFPOOL
+static inline void
+osl_pktfastfree(osl_t *osh, struct sk_buff *skb)
+{
+	ctfpool_t *ctfpool;
+#ifdef CTFPOOL_SPINLOCK
+	unsigned long flags;
+#endif /* CTFPOOL_SPINLOCK */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+	skb->tstamp.tv.sec = 0;
+#else
+	skb->stamp.tv_sec = 0;
+#endif
+
+	/* We only need to init the fields that we change */
+	skb->dev = NULL;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 36)
+	skb->dst = NULL;
+#endif
+	OSL_PKTTAG_CLEAR(skb);
+	skb->ip_summed = 0;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	skb_orphan(skb);
+#else
+	skb->destructor = NULL;
+#endif
+
+	ctfpool = (ctfpool_t *)CTFPOOLPTR(osh, skb);
+	ASSERT(ctfpool != NULL);
+
+	/* Add object to the ctfpool */
+	CTFPOOL_LOCK(ctfpool, flags);
+	skb->next = (struct sk_buff *)ctfpool->head;
+	ctfpool->head = (void *)skb;
+
+	ctfpool->fast_frees++;
+	ctfpool->curr_obj++;
+
+	ASSERT(ctfpool->curr_obj <= ctfpool->max_obj);
+	CTFPOOL_UNLOCK(ctfpool, flags);
+}
+#endif /* CTFPOOL */
+
+/* Free the driver packet. Free the tag if present */
+void BCMFASTPATH
+osl_pktfree(osl_t *osh, void *p, bool send)
+{
+	struct sk_buff *skb, *nskb;
+	if (osh == NULL)
+		return;
+
+	skb = (struct sk_buff*) p;
+
+	if (send && osh->pub.tx_fn)
+		osh->pub.tx_fn(osh->pub.tx_ctx, p, 0);
+
+	PKTDBG_TRACE(osh, (void *) skb, PKTLIST_PKTFREE);
+
+	/* perversion: we use skb->next to chain multi-skb packets */
+	while (skb) {
+		nskb = skb->next;
+		skb->next = NULL;
+
+#ifdef BCMDBG_CTRACE
+		DEL_CTRACE(osh, skb);
+#endif
+
+
+#ifdef CTFPOOL
+		if (PKTISFAST(osh, skb)) {
+			if (atomic_read(&skb->users) == 1)
+				smp_rmb();
+			else if (!atomic_dec_and_test(&skb->users))
+				goto next_skb;
+			osl_pktfastfree(osh, skb);
+		} else
+#endif
+		{
+			dev_kfree_skb_any(skb);
+		}
+#ifdef CTFPOOL
+next_skb:
+#endif
+		atomic_dec(&osh->cmn->pktalloced);
+		skb = nskb;
+	}
+}
+
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+void*
+osl_pktget_static(osl_t *osh, uint len)
+{
+	int i = 0;
+	struct sk_buff *skb;
+
+	if (!bcm_static_skb)
+		return osl_pktget(osh, len);
+
+	if (len > DHD_SKB_MAX_BUFSIZE) {
+		printk("%s: attempt to allocate huge packet (0x%x)\n", __FUNCTION__, len);
+		return osl_pktget(osh, len);
+	}
+
+	down(&bcm_static_skb->osl_pkt_sem);
+
+	if (len <= DHD_SKB_1PAGE_BUFSIZE) {
+		for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+			if (bcm_static_skb->pkt_use[i] == 0)
+				break;
+		}
+
+		if (i != STATIC_PKT_MAX_NUM) {
+			bcm_static_skb->pkt_use[i] = 1;
+
+			skb = bcm_static_skb->skb_4k[i];
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+			skb_set_tail_pointer(skb, len);
+#else
+			skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+			skb->len = len;
+
+			up(&bcm_static_skb->osl_pkt_sem);
+			return skb;
+		}
+	}
+
+	if (len <= DHD_SKB_2PAGE_BUFSIZE) {
+		for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+			if (bcm_static_skb->pkt_use[i + STATIC_PKT_MAX_NUM]
+				== 0)
+				break;
+		}
+
+		if (i != STATIC_PKT_MAX_NUM) {
+			bcm_static_skb->pkt_use[i + STATIC_PKT_MAX_NUM] = 1;
+			skb = bcm_static_skb->skb_8k[i];
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+			skb_set_tail_pointer(skb, len);
+#else
+			skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+			skb->len = len;
+
+			up(&bcm_static_skb->osl_pkt_sem);
+			return skb;
+		}
+	}
+
+#if defined(ENHANCED_STATIC_BUF)
+	if (bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM * 2] == 0) {
+		bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM * 2] = 1;
+
+		skb = bcm_static_skb->skb_16k;
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+		skb_set_tail_pointer(skb, len);
+#else
+		skb->tail = skb->data + len;
+#endif /* NET_SKBUFF_DATA_USES_OFFSET */
+		skb->len = len;
+
+		up(&bcm_static_skb->osl_pkt_sem);
+		return skb;
+	}
+#endif /* ENHANCED_STATIC_BUF */
+
+	up(&bcm_static_skb->osl_pkt_sem);
+	printk("%s: all static pkt in use!\n", __FUNCTION__);
+	return osl_pktget(osh, len);
+}
+
+void
+osl_pktfree_static(osl_t *osh, void *p, bool send)
+{
+	int i;
+	if (!bcm_static_skb) {
+		osl_pktfree(osh, p, send);
+		return;
+	}
+
+	down(&bcm_static_skb->osl_pkt_sem);
+	for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+		if (p == bcm_static_skb->skb_4k[i]) {
+			bcm_static_skb->pkt_use[i] = 0;
+			up(&bcm_static_skb->osl_pkt_sem);
+			return;
+		}
+	}
+
+	for (i = 0; i < STATIC_PKT_MAX_NUM; i++) {
+		if (p == bcm_static_skb->skb_8k[i]) {
+			bcm_static_skb->pkt_use[i + STATIC_PKT_MAX_NUM] = 0;
+			up(&bcm_static_skb->osl_pkt_sem);
+			return;
+		}
+	}
+#ifdef ENHANCED_STATIC_BUF
+	if (p == bcm_static_skb->skb_16k) {
+		bcm_static_skb->pkt_use[STATIC_PKT_MAX_NUM * 2] = 0;
+		up(&bcm_static_skb->osl_pkt_sem);
+		return;
+	}
+#endif
+	up(&bcm_static_skb->osl_pkt_sem);
+	osl_pktfree(osh, p, send);
+}
+
+#if defined(BCMPCIE) && defined(DHD_USE_STATIC_FLOWRING)
+void*
+osl_dma_alloc_consistent_static(osl_t *osh, uint size, uint16 align_bits,
+	uint *alloced, dmaaddr_t *pap, uint16 idx)
+{
+	void *va = NULL;
+	uint16 align = (1 << align_bits);
+	uint16 flow_id = RINGID_TO_FLOWID(idx);
+	unsigned long flags;
+
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+	if (!ISALIGNED(DMA_CONSISTENT_ALIGN, align))
+		size += align;
+
+	if ((flow_id < 0) || (flow_id >= STATIC_BUF_FLOWRING_NUM)) {
+		printk("%s: flow_id %d is wrong\n", __FUNCTION__, flow_id);
+		return osl_dma_alloc_consistent(osh, size, align_bits,
+			alloced, pap);
+	}
+
+	if (!bcm_static_flowring) {
+		printk("%s: bcm_static_flowring is not initialized\n",
+			__FUNCTION__);
+		return osl_dma_alloc_consistent(osh, size, align_bits,
+			alloced, pap);
+	}
+
+	if (size > STATIC_BUF_FLOWRING_SIZE) {
+		printk("%s: attempt to allocate huge packet, size=%d\n",
+			__FUNCTION__, size);
+		return osl_dma_alloc_consistent(osh, size, align_bits,
+			alloced, pap);
+	}
+
+	*alloced = size;
+
+	spin_lock_irqsave(&bcm_static_flowring->flowring_lock, flags);
+	if (bcm_static_flowring->buf_use[flow_id]) {
+		printk("%s: flowring %d is already alloced\n",
+			__FUNCTION__, flow_id);
+		spin_unlock_irqrestore(&bcm_static_flowring->flowring_lock, flags);
+		return NULL;
+	}
+
+	va = bcm_static_flowring->buf_ptr[flow_id];
+	if (va) {
+		*pap = (ulong)__virt_to_phys((ulong)va);
+		bcm_static_flowring->buf_use[flow_id] = 1;
+	}
+	spin_unlock_irqrestore(&bcm_static_flowring->flowring_lock, flags);
+
+	return va;
+}
+
+void
+osl_dma_free_consistent_static(osl_t *osh, void *va, uint size,
+	dmaaddr_t pa, uint16 idx)
+{
+	uint16 flow_id = RINGID_TO_FLOWID(idx);
+	unsigned long flags;
+
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+	if ((flow_id < 0) || (flow_id >= STATIC_BUF_FLOWRING_NUM)) {
+		printk("%s: flow_id %d is wrong\n", __FUNCTION__, flow_id);
+		return osl_dma_free_consistent(osh, va, size, pa);
+	}
+
+	if (!bcm_static_flowring) {
+		printk("%s: bcm_static_flowring is not initialized\n",
+			__FUNCTION__);
+		return osl_dma_free_consistent(osh, va, size, pa);
+	}
+
+	spin_lock_irqsave(&bcm_static_flowring->flowring_lock, flags);
+	if (bcm_static_flowring->buf_use[flow_id]) {
+		bcm_static_flowring->buf_use[flow_id] = 0;
+	} else {
+		printk("%s: flowring %d is already freed\n",
+			__FUNCTION__, flow_id);
+	}
+	spin_unlock_irqrestore(&bcm_static_flowring->flowring_lock, flags);
+}
+#endif /* BCMPCIE && DHD_USE_STATIC_FLOWRING */
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+uint32
+osl_pci_read_config(osl_t *osh, uint offset, uint size)
+{
+	uint val = 0;
+	uint retry = PCI_CFG_RETRY;
+
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+	/* only 4byte access supported */
+	ASSERT(size == 4);
+
+	do {
+		pci_read_config_dword(osh->pdev, offset, &val);
+		if (val != 0xffffffff)
+			break;
+	} while (retry--);
+
+
+	return (val);
+}
+
+void
+osl_pci_write_config(osl_t *osh, uint offset, uint size, uint val)
+{
+	uint retry = PCI_CFG_RETRY;
+
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+	/* only 4byte access supported */
+	ASSERT(size == 4);
+
+	do {
+		pci_write_config_dword(osh->pdev, offset, val);
+		if (offset != PCI_BAR0_WIN)
+			break;
+		if (osl_pci_read_config(osh, offset, size) == val)
+			break;
+	} while (retry--);
+
+}
+
+/* return bus # for the pci device pointed by osh->pdev */
+uint
+osl_pci_bus(osl_t *osh)
+{
+	ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+#if defined(__ARM_ARCH_7A__) && LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35)
+	return pci_domain_nr(((struct pci_dev *)osh->pdev)->bus);
+#else
+	return ((struct pci_dev *)osh->pdev)->bus->number;
+#endif
+}
+
+/* return slot # for the pci device pointed by osh->pdev */
+uint
+osl_pci_slot(osl_t *osh)
+{
+	ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+#if defined(__ARM_ARCH_7A__) && LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 35)
+	return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn) + 1;
+#else
+	return PCI_SLOT(((struct pci_dev *)osh->pdev)->devfn);
+#endif
+}
+
+/* return domain # for the pci device pointed by osh->pdev */
+uint
+osl_pcie_domain(osl_t *osh)
+{
+	ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+	return pci_domain_nr(((struct pci_dev *)osh->pdev)->bus);
+}
+
+/* return bus # for the pci device pointed by osh->pdev */
+uint
+osl_pcie_bus(osl_t *osh)
+{
+	ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+	return ((struct pci_dev *)osh->pdev)->bus->number;
+}
+
+/* return the pci device pointed by osh->pdev */
+struct pci_dev *
+osl_pci_device(osl_t *osh)
+{
+	ASSERT(osh && (osh->magic == OS_HANDLE_MAGIC) && osh->pdev);
+
+	return osh->pdev;
+}
+
+static void
+osl_pcmcia_attr(osl_t *osh, uint offset, char *buf, int size, bool write)
+{
+}
+
+void
+osl_pcmcia_read_attr(osl_t *osh, uint offset, void *buf, int size)
+{
+	osl_pcmcia_attr(osh, offset, (char *) buf, size, FALSE);
+}
+
+void
+osl_pcmcia_write_attr(osl_t *osh, uint offset, void *buf, int size)
+{
+	osl_pcmcia_attr(osh, offset, (char *) buf, size, TRUE);
+}
+
+void *
+osl_malloc(osl_t *osh, uint size)
+{
+	void *addr;
+	gfp_t flags;
+
+	/* only ASSERT if osh is defined */
+	if (osh)
+		ASSERT(osh->magic == OS_HANDLE_MAGIC);
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+	if (bcm_static_buf)
+	{
+		int i = 0;
+		if ((size >= PAGE_SIZE)&&(size <= STATIC_BUF_SIZE))
+		{
+			down(&bcm_static_buf->static_sem);
+
+			for (i = 0; i < STATIC_BUF_MAX_NUM; i++)
+			{
+				if (bcm_static_buf->buf_use[i] == 0)
+					break;
+			}
+
+			if (i == STATIC_BUF_MAX_NUM)
+			{
+				up(&bcm_static_buf->static_sem);
+				printk("all static buff in use!\n");
+				goto original;
+			}
+
+			bcm_static_buf->buf_use[i] = 1;
+			up(&bcm_static_buf->static_sem);
+
+			bzero(bcm_static_buf->buf_ptr+STATIC_BUF_SIZE*i, size);
+			if (osh)
+				atomic_add(size, &osh->cmn->malloced);
+
+			return ((void *)(bcm_static_buf->buf_ptr+STATIC_BUF_SIZE*i));
+		}
+	}
+original:
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+
+	flags = CAN_SLEEP() ? GFP_KERNEL: GFP_ATOMIC;
+	if ((addr = kmalloc(size, flags)) == NULL) {
+		if (osh)
+			osh->failed++;
+		return (NULL);
+	}
+	if (osh && osh->cmn)
+		atomic_add(size, &osh->cmn->malloced);
+
+	return (addr);
+}
+
+void *
+osl_mallocz(osl_t *osh, uint size)
+{
+	void *ptr;
+
+	ptr = osl_malloc(osh, size);
+
+	if (ptr != NULL) {
+		bzero(ptr, size);
+	}
+
+	return ptr;
+}
+
+void
+osl_mfree(osl_t *osh, void *addr, uint size)
+{
+#ifdef CONFIG_DHD_USE_STATIC_BUF
+	if (bcm_static_buf)
+	{
+		if ((addr > (void *)bcm_static_buf) && ((unsigned char *)addr
+			<= ((unsigned char *)bcm_static_buf + STATIC_BUF_TOTAL_LEN)))
+		{
+			int buf_idx = 0;
+
+			buf_idx = ((unsigned char *)addr - bcm_static_buf->buf_ptr)/STATIC_BUF_SIZE;
+
+			down(&bcm_static_buf->static_sem);
+			bcm_static_buf->buf_use[buf_idx] = 0;
+			up(&bcm_static_buf->static_sem);
+
+			if (osh && osh->cmn) {
+				ASSERT(osh->magic == OS_HANDLE_MAGIC);
+				atomic_sub(size, &osh->cmn->malloced);
+			}
+			return;
+		}
+	}
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+	if (osh && osh->cmn) {
+		ASSERT(osh->magic == OS_HANDLE_MAGIC);
+
+		ASSERT(size <= osl_malloced(osh));
+
+		atomic_sub(size, &osh->cmn->malloced);
+	}
+	kfree(addr);
+}
+
+uint
+osl_check_memleak(osl_t *osh)
+{
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+	if (atomic_read(&osh->cmn->refcount) == 1)
+		return (atomic_read(&osh->cmn->malloced));
+	else
+		return 0;
+}
+
+uint
+osl_malloced(osl_t *osh)
+{
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+	return (atomic_read(&osh->cmn->malloced));
+}
+
+uint
+osl_malloc_failed(osl_t *osh)
+{
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+	return (osh->failed);
+}
+
+
+uint
+osl_dma_consistent_align(void)
+{
+	return (PAGE_SIZE);
+}
+
+void*
+osl_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits, uint *alloced, dmaaddr_t *pap)
+{
+	void *va;
+	uint16 align = (1 << align_bits);
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+	if (!ISALIGNED(DMA_CONSISTENT_ALIGN, align))
+		size += align;
+	*alloced = size;
+
+#ifndef	BCM_SECURE_DMA
+#if defined(BCM47XX_CA9) && defined(__ARM_ARCH_7A__)
+	va = kmalloc(size, GFP_ATOMIC | __GFP_ZERO);
+	if (va)
+		*pap = (ulong)__virt_to_phys((ulong)va);
+#else
+	{
+		dma_addr_t pap_lin;
+		struct pci_dev *hwdev = osh->pdev;
+#ifdef PCIE_TX_DEFERRAL
+		va = dma_alloc_coherent(&hwdev->dev, size, &pap_lin, GFP_KERNEL);
+#else
+		va = dma_alloc_coherent(&hwdev->dev, size, &pap_lin, GFP_ATOMIC);
+#endif
+		*pap = (dmaaddr_t)pap_lin;
+	}
+#endif /* BCM47XX_CA9 && __ARM_ARCH_7A__ */
+#else
+	va = osl_sec_dma_alloc_consistent(osh, size, align_bits, pap);
+#endif /* BCM_SECURE_DMA */
+	return va;
+}
+
+void
+osl_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa)
+{
+#ifndef BCM_SECURE_DMA
+#if !defined(BCM47XX_CA9) || !defined(__ARM_ARCH_7A__)
+	struct pci_dev *hwdev = osh->pdev;
+#endif
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+
+#if defined(BCM47XX_CA9) && defined(__ARM_ARCH_7A__)
+	kfree(va);
+#else
+	dma_free_coherent(&hwdev->dev, size, va, (dma_addr_t)pa);
+#endif /* BCM47XX_CA9 && __ARM_ARCH_7A__ */
+#else
+	osl_sec_dma_free_consistent(osh, va, size, pa);
+#endif /* BCM_SECURE_DMA */
+}
+
+dmaaddr_t BCMFASTPATH
+osl_dma_map(osl_t *osh, void *va, uint size, int direction, void *p, hnddma_seg_map_t *dmah)
+{
+	int dir;
+#ifdef BCM47XX_ACP_WAR
+	uint pa;
+#endif
+
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+	dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+
+#if defined(__ARM_ARCH_7A__) && defined(BCMDMASGLISTOSL)
+	if (dmah != NULL) {
+		int32 nsegs, i, totsegs = 0, totlen = 0;
+		struct scatterlist *sg, _sg[MAX_DMA_SEGS * 2];
+#ifdef BCM47XX_ACP_WAR
+		struct scatterlist *s;
+#endif
+		struct sk_buff *skb;
+		for (skb = (struct sk_buff *)p; skb != NULL; skb = PKTNEXT(osh, skb)) {
+			sg = &_sg[totsegs];
+			if (skb_is_nonlinear(skb)) {
+				nsegs = skb_to_sgvec(skb, sg, 0, PKTLEN(osh, skb));
+				ASSERT((nsegs > 0) && (totsegs + nsegs <= MAX_DMA_SEGS));
+#ifdef BCM47XX_ACP_WAR
+				for_each_sg(sg, s, nsegs, i) {
+					if (sg_phys(s) >= ACP_WIN_LIMIT) {
+						dma_map_page(&((struct pci_dev *)osh->pdev)->dev,
+							sg_page(s), s->offset, s->length, dir);
+					}
+				}
+#else
+				pci_map_sg(osh->pdev, sg, nsegs, dir);
+#endif
+			} else {
+				nsegs = 1;
+				ASSERT(totsegs + nsegs <= MAX_DMA_SEGS);
+				sg->page_link = 0;
+				sg_set_buf(sg, PKTDATA(osh, skb), PKTLEN(osh, skb));
+#ifdef BCM47XX_ACP_WAR
+				if (virt_to_phys(PKTDATA(osh, skb)) >= ACP_WIN_LIMIT)
+#endif
+				pci_map_single(osh->pdev, PKTDATA(osh, skb), PKTLEN(osh, skb), dir);
+			}
+			totsegs += nsegs;
+			totlen += PKTLEN(osh, skb);
+		}
+		dmah->nsegs = totsegs;
+		dmah->origsize = totlen;
+		for (i = 0, sg = _sg; i < totsegs; i++, sg++) {
+			dmah->segs[i].addr = sg_phys(sg);
+			dmah->segs[i].length = sg->length;
+		}
+		return dmah->segs[0].addr;
+	}
+#endif /* __ARM_ARCH_7A__ && BCMDMASGLISTOSL */
+
+#ifdef BCM47XX_ACP_WAR
+	pa = virt_to_phys(va);
+	if (pa < ACP_WIN_LIMIT)
+		return (pa);
+#endif
+	return (pci_map_single(osh->pdev, va, size, dir));
+}
+
+void BCMFASTPATH
+osl_dma_unmap(osl_t *osh, uint pa, uint size, int direction)
+{
+	int dir;
+
+	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
+#ifdef BCM47XX_ACP_WAR
+	if (pa < ACP_WIN_LIMIT)
+		return;
+#endif
+	dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+	pci_unmap_single(osh->pdev, (uint32)pa, size, dir);
+}
+
+
+#if defined(BCM47XX_CA9) && defined(__ARM_ARCH_7A__)
+
+inline void BCMFASTPATH
+osl_cache_flush(void *va, uint size)
+{
+#ifndef BCM_SECURE_DMA
+#ifdef BCM47XX_ACP_WAR
+	if (virt_to_phys(va) < ACP_WIN_LIMIT)
+		return;
+#endif
+	if (size > 0)
+		dma_sync_single_for_device(OSH_NULL, virt_to_dma(OSH_NULL, va), size, DMA_TX);
+#else
+	phys_addr_t orig_pa = (phys_addr_t)(va - g_contig_delta_va_pa);
+	if (size > 0)
+		dma_sync_single_for_device(OSH_NULL, orig_pa, size, DMA_TX);
+#endif /* defined BCM_SECURE_DMA */
+}
+
+inline void BCMFASTPATH
+osl_cache_inv(void *va, uint size)
+{
+#ifndef BCM_SECURE_DMA
+#ifdef BCM47XX_ACP_WAR
+	if (virt_to_phys(va) < ACP_WIN_LIMIT)
+		return;
+#endif
+	dma_sync_single_for_cpu(OSH_NULL, virt_to_dma(OSH_NULL, va), size, DMA_RX);
+#else
+	phys_addr_t orig_pa = (phys_addr_t)(va - g_contig_delta_va_pa);
+	dma_sync_single_for_cpu(OSH_NULL, orig_pa, size, DMA_RX);
+#endif /* defined BCM_SECURE_DMA */
+}
+
+inline void osl_prefetch(const void *ptr)
+{
+	/* Borrowed from linux/linux-2.6/include/asm-arm/processor.h */
+	__asm__ __volatile__(
+		"pld\t%0"
+		:
+		: "o" (*(char *)ptr)
+		: "cc");
+}
+
+int osl_arch_is_coherent(void)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0)
+	return 0;
+#else
+	return arch_is_coherent();
+#endif
+}
+#endif
+
+#if defined(BCMASSERT_LOG)
+void
+osl_assert(const char *exp, const char *file, int line)
+{
+	char tempbuf[256];
+	const char *basename;
+
+	basename = strrchr(file, '/');
+	/* skip the '/' */
+	if (basename)
+		basename++;
+
+	if (!basename)
+		basename = file;
+
+#ifdef BCMASSERT_LOG
+	snprintf(tempbuf, 64, "\"%s\": file \"%s\", line %d\n",
+		exp, basename, line);
+	printk("%s", tempbuf);
+#endif /* BCMASSERT_LOG */
+
+
+}
+#endif
+
+void
+osl_delay(uint usec)
+{
+	uint d;
+
+	while (usec > 0) {
+		d = MIN(usec, 1000);
+		udelay(d);
+		usec -= d;
+	}
+}
+
+void
+osl_sleep(uint ms)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	if (ms < 20)
+		usleep_range(ms*1000, ms*1000 + 1000);
+	else
+#endif
+	msleep(ms);
+}
+
+
+
+/* Clone a packet.
+ * The pkttag contents are NOT cloned.
+ */
+void *
+#ifdef BCMDBG_CTRACE
+osl_pktdup(osl_t *osh, void *skb, int line, char *file)
+#else
+osl_pktdup(osl_t *osh, void *skb)
+#endif /* BCMDBG_CTRACE */
+{
+	void * p;
+
+	ASSERT(!PKTISCHAINED(skb));
+
+	/* clear the CTFBUF flag if set and map the rest of the buffer
+	 * before cloning.
+	 */
+	PKTCTFMAP(osh, skb);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	if ((p = pskb_copy((struct sk_buff *)skb, GFP_ATOMIC)) == NULL)
+#else
+	if ((p = skb_clone((struct sk_buff *)skb, GFP_ATOMIC)) == NULL)
+#endif
+		return NULL;
+
+#ifdef CTFPOOL
+	if (PKTISFAST(osh, skb)) {
+		ctfpool_t *ctfpool;
+
+		/* if the buffer allocated from ctfpool is cloned then
+		 * we can't be sure when it will be freed. since there
+		 * is a chance that we will be losing a buffer
+		 * from our pool, we increment the refill count for the
+		 * object to be alloced later.
+		 */
+		ctfpool = (ctfpool_t *)CTFPOOLPTR(osh, skb);
+		ASSERT(ctfpool != NULL);
+		PKTCLRFAST(osh, p);
+		PKTCLRFAST(osh, skb);
+		ctfpool->refills++;
+	}
+#endif /* CTFPOOL */
+
+	/* Clear PKTC  context */
+	PKTSETCLINK(p, NULL);
+	PKTCCLRFLAGS(p);
+	PKTCSETCNT(p, 1);
+	PKTCSETLEN(p, PKTLEN(osh, skb));
+
+	/* skb_clone copies skb->cb.. we don't want that */
+	if (osh->pub.pkttag)
+		OSL_PKTTAG_CLEAR(p);
+
+	/* Increment the packet counter */
+	atomic_inc(&osh->cmn->pktalloced);
+#ifdef BCMDBG_CTRACE
+	ADD_CTRACE(osh, (struct sk_buff *)p, file, line);
+#endif
+	return (p);
+}
+
+#ifdef BCMDBG_CTRACE
+int osl_pkt_is_frmnative(osl_t *osh, struct sk_buff *pkt)
+{
+	unsigned long flags;
+	struct sk_buff *skb;
+	int ck = FALSE;
+
+	spin_lock_irqsave(&osh->ctrace_lock, flags);
+
+	list_for_each_entry(skb, &osh->ctrace_list, ctrace_list) {
+		if (pkt == skb) {
+			ck = TRUE;
+			break;
+		}
+	}
+
+	spin_unlock_irqrestore(&osh->ctrace_lock, flags);
+	return ck;
+}
+
+void osl_ctrace_dump(osl_t *osh, struct bcmstrbuf *b)
+{
+	unsigned long flags;
+	struct sk_buff *skb;
+	int idx = 0;
+	int i, j;
+
+	spin_lock_irqsave(&osh->ctrace_lock, flags);
+
+	if (b != NULL)
+		bcm_bprintf(b, " Total %d sbk not free\n", osh->ctrace_num);
+	else
+		printk(" Total %d sbk not free\n", osh->ctrace_num);
+
+	list_for_each_entry(skb, &osh->ctrace_list, ctrace_list) {
+		if (b != NULL)
+			bcm_bprintf(b, "[%d] skb %p:\n", ++idx, skb);
+		else
+			printk("[%d] skb %p:\n", ++idx, skb);
+
+		for (i = 0; i < skb->ctrace_count; i++) {
+			j = (skb->ctrace_start + i) % CTRACE_NUM;
+			if (b != NULL)
+				bcm_bprintf(b, "    [%s(%d)]\n", skb->func[j], skb->line[j]);
+			else
+				printk("    [%s(%d)]\n", skb->func[j], skb->line[j]);
+		}
+		if (b != NULL)
+			bcm_bprintf(b, "\n");
+		else
+			printk("\n");
+	}
+
+	spin_unlock_irqrestore(&osh->ctrace_lock, flags);
+
+	return;
+}
+#endif /* BCMDBG_CTRACE */
+
+
+/*
+ * OSLREGOPS specifies the use of osl_XXX routines to be used for register access
+ */
+
+/*
+ * BINOSL selects the slightly slower function-call-based binary compatible osl.
+ */
+
+uint
+osl_pktalloced(osl_t *osh)
+{
+	if (atomic_read(&osh->cmn->refcount) == 1)
+		return (atomic_read(&osh->cmn->pktalloced));
+	else
+		return 0;
+}
+
+uint32
+osl_rand(void)
+{
+	uint32 rand;
+
+	get_random_bytes(&rand, sizeof(rand));
+
+	return rand;
+}
+
+/* Linux Kernel: File Operations: start */
+void *
+osl_os_open_image(char *filename)
+{
+	struct file *fp;
+
+	fp = filp_open(filename, O_RDONLY, 0);
+	/*
+	 * 2.6.11 (FC4) supports filp_open() but later revs don't?
+	 * Alternative:
+	 * fp = open_namei(AT_FDCWD, filename, O_RD, 0);
+	 * ???
+	 */
+	 if (IS_ERR(fp))
+		 fp = NULL;
+
+	 return fp;
+}
+
+int
+osl_os_get_image_block(char *buf, int len, void *image)
+{
+	struct file *fp = (struct file *)image;
+	int rdlen;
+
+	if (!image)
+		return 0;
+
+	rdlen = kernel_read(fp, fp->f_pos, buf, len);
+	if (rdlen > 0)
+		fp->f_pos += rdlen;
+
+	return rdlen;
+}
+
+void
+osl_os_close_image(void *image)
+{
+	if (image)
+		filp_close((struct file *)image, NULL);
+}
+
+int
+osl_os_image_size(void *image)
+{
+	int len = 0, curroffset;
+
+	if (image) {
+		/* store the current offset */
+		curroffset = generic_file_llseek(image, 0, 1);
+		/* goto end of file to get length */
+		len = generic_file_llseek(image, 0, 2);
+		/* restore back the offset */
+		generic_file_llseek(image, curroffset, 0);
+	}
+	return len;
+}
+
+/* Linux Kernel: File Operations: end */
+
+#ifdef BCM47XX_ACP_WAR
+inline void osl_pcie_rreg(osl_t *osh, ulong addr, void *v, uint size)
+{
+	uint32 flags;
+	int pci_access = 0;
+
+	if (osh && BUSTYPE(osh->bustype) == PCI_BUS)
+		pci_access = 1;
+
+	if (pci_access)
+		spin_lock_irqsave(&l2x0_reg_lock, flags);
+	switch (size) {
+	case sizeof(uint8):
+		*(uint8*)v = readb((volatile uint8*)(addr));
+		break;
+	case sizeof(uint16):
+		*(uint16*)v = readw((volatile uint16*)(addr));
+		break;
+	case sizeof(uint32):
+		*(uint32*)v = readl((volatile uint32*)(addr));
+		break;
+	case sizeof(uint64):
+		*(uint64*)v = *((volatile uint64*)(addr));
+		break;
+	}
+	if (pci_access)
+		spin_unlock_irqrestore(&l2x0_reg_lock, flags);
+}
+#endif /* BCM47XX_ACP_WAR */
+
+/* APIs to set/get specific quirks in OSL layer */
+void
+osl_flag_set(osl_t *osh, uint32 mask)
+{
+	osh->flags |= mask;
+}
+
+bool
+osl_is_flag_set(osl_t *osh, uint32 mask)
+{
+	return (osh->flags & mask);
+}
+#ifdef BCM_SECURE_DMA
+
+static void
+osl_sec_dma_setup_contig_mem(osl_t *osh, unsigned long memsize, int regn)
+{
+	int ret;
+
+#if defined(__ARM_ARCH_7A__)
+	if (regn == CONT_ARMREGION) {
+		ret = osl_sec_dma_alloc_contig_mem(osh, memsize, regn);
+		if (ret != BCME_OK)
+			printk("linux_osl.c: CMA memory access failed\n");
+	}
+#endif
+	/* implement the MIPS Here */
+}
+
+static int
+osl_sec_dma_alloc_contig_mem(osl_t *osh, unsigned long memsize, int regn)
+{
+	u64 addr;
+
+	printk("linux_osl.c: The value of cma mem block size = %ld\n", memsize);
+	osh->cma = cma_dev_get_cma_dev(regn);
+	printk("The value of cma = %p\n", osh->cma);
+	if (!osh->cma) {
+		printk("linux_osl.c:contig_region index is invalid\n");
+		return BCME_ERROR;
+	}
+	if (cma_dev_get_mem(osh->cma, &addr, (u32)memsize, SEC_DMA_ALIGN) < 0) {
+		printk("linux_osl.c: contiguous memory block allocation failure\n");
+		return BCME_ERROR;
+	}
+	osh->contig_base_alloc = (phys_addr_t)addr;
+	osh->contig_base = (phys_addr_t)osh->contig_base_alloc;
+	printk("contig base alloc=%lx \n", (ulong)osh->contig_base_alloc);
+
+	return BCME_OK;
+}
+
+static void
+osl_sec_dma_free_contig_mem(osl_t *osh, u32 memsize, int regn)
+{
+	int ret;
+
+	ret = cma_dev_put_mem(osh->cma, (u64)osh->contig_base, memsize);
+	if (ret)
+		printf("%s contig base free failed\n", __FUNCTION__);
+}
+
+static void *
+osl_sec_dma_ioremap(osl_t *osh, struct page *page, size_t size, bool iscache, bool isdecr)
+{
+
+	struct page **map;
+	int order, i;
+	void *addr = NULL;
+
+	size = PAGE_ALIGN(size);
+	order = get_order(size);
+
+	map = kmalloc(sizeof(struct page *) << order, GFP_ATOMIC);
+
+	if (map == NULL)
+		return NULL;
+
+	for (i = 0; i < (size >> PAGE_SHIFT); i++)
+		map[i] = page + i;
+
+	if (iscache) {
+		addr = vmap(map, size >> PAGE_SHIFT, VM_MAP, __pgprot(PAGE_KERNEL));
+		if (isdecr) {
+			osh->contig_delta_va_pa = (phys_addr_t)(addr - page_to_phys(page));
+			g_contig_delta_va_pa = osh->contig_delta_va_pa;
+		}
+	}
+	else {
+
+#if defined(__ARM_ARCH_7A__)
+		addr = vmap(map, size >> PAGE_SHIFT, VM_MAP,
+			pgprot_noncached(__pgprot(PAGE_KERNEL)));
+#endif
+		if (isdecr) {
+			osh->contig_delta_va_pa = (phys_addr_t)(addr - page_to_phys(page));
+			g_contig_delta_va_pa = osh->contig_delta_va_pa;
+		}
+	}
+
+	kfree(map);
+	return (void *)addr;
+}
+
+static void
+osl_sec_dma_iounmap(osl_t *osh, void *contig_base_va, size_t size)
+{
+	vunmap(contig_base_va);
+}
+
+static void
+osl_sec_dma_deinit_elem_mem_block(osl_t *osh, size_t mbsize, int max, void *sec_list_base)
+{
+	if (sec_list_base)
+		kfree(sec_list_base);
+}
+
+static void
+osl_sec_dma_init_elem_mem_block(osl_t *osh, size_t mbsize, int max, sec_mem_elem_t **list)
+{
+	int i;
+	sec_mem_elem_t *sec_mem_elem;
+
+	if ((sec_mem_elem = kmalloc(sizeof(sec_mem_elem_t)*(max), GFP_ATOMIC)) != NULL) {
+
+		*list = sec_mem_elem;
+		bzero(sec_mem_elem, sizeof(sec_mem_elem_t)*(max));
+		for (i = 0; i < max-1; i++) {
+			sec_mem_elem->next = (sec_mem_elem + 1);
+			sec_mem_elem->size = mbsize;
+			sec_mem_elem->pa_cma = (u32)osh->contig_base_alloc;
+			sec_mem_elem->vac = osh->contig_base_alloc_va;
+
+			osh->contig_base_alloc += mbsize;
+			osh->contig_base_alloc_va += mbsize;
+
+			sec_mem_elem = sec_mem_elem + 1;
+		}
+		sec_mem_elem->next = NULL;
+		sec_mem_elem->size = mbsize;
+		sec_mem_elem->pa_cma = (u32)osh->contig_base_alloc;
+		sec_mem_elem->vac = osh->contig_base_alloc_va;
+
+		osh->contig_base_alloc += mbsize;
+		osh->contig_base_alloc_va += mbsize;
+
+	}
+	else
+		printf("%s sec mem elem kmalloc failed\n", __FUNCTION__);
+}
+
+
+static sec_mem_elem_t * BCMFASTPATH
+osl_sec_dma_alloc_mem_elem(osl_t *osh, void *va, uint size, int direction,
+	struct sec_cma_info *ptr_cma_info, uint offset)
+{
+	sec_mem_elem_t *sec_mem_elem = NULL;
+
+	if (size <= 512 && osh->sec_list_512) {
+		sec_mem_elem = osh->sec_list_512;
+		osh->sec_list_512 = sec_mem_elem->next;
+	}
+	else if (size <= 2048 && osh->sec_list_2048) {
+		sec_mem_elem = osh->sec_list_2048;
+		osh->sec_list_2048 = sec_mem_elem->next;
+	}
+	else if (osh->sec_list_4096) {
+		sec_mem_elem = osh->sec_list_4096;
+		osh->sec_list_4096 = sec_mem_elem->next;
+	} else {
+		printf("%s No matching Pool available size=%d \n", __FUNCTION__, size);
+		return NULL;
+	}
+
+	if (sec_mem_elem != NULL) {
+		sec_mem_elem->next = NULL;
+
+	if (ptr_cma_info->sec_alloc_list_tail) {
+		ptr_cma_info->sec_alloc_list_tail->next = sec_mem_elem;
+	}
+
+	ptr_cma_info->sec_alloc_list_tail = sec_mem_elem;
+	if (ptr_cma_info->sec_alloc_list == NULL)
+		ptr_cma_info->sec_alloc_list = sec_mem_elem;
+	}
+	return sec_mem_elem;
+}
+
+static void BCMFASTPATH
+osl_sec_dma_free_mem_elem(osl_t *osh, sec_mem_elem_t *sec_mem_elem)
+{
+	sec_mem_elem->dma_handle = 0x0;
+	sec_mem_elem->va = NULL;
+
+	if (sec_mem_elem->size == 512) {
+		sec_mem_elem->next = osh->sec_list_512;
+		osh->sec_list_512 = sec_mem_elem;
+	}
+	else if (sec_mem_elem->size == 2048) {
+		sec_mem_elem->next = osh->sec_list_2048;
+		osh->sec_list_2048 = sec_mem_elem;
+	}
+	else if (sec_mem_elem->size == 4096) {
+		sec_mem_elem->next = osh->sec_list_4096;
+		osh->sec_list_4096 = sec_mem_elem;
+	}
+	else
+	printf("%s free failed size=%d \n", __FUNCTION__, sec_mem_elem->size);
+}
+
+
+static sec_mem_elem_t * BCMFASTPATH
+osl_sec_dma_find_rem_elem(osl_t *osh, struct sec_cma_info *ptr_cma_info, dma_addr_t dma_handle)
+{
+	sec_mem_elem_t *sec_mem_elem = ptr_cma_info->sec_alloc_list;
+	sec_mem_elem_t *sec_prv_elem = ptr_cma_info->sec_alloc_list;
+
+	if (sec_mem_elem->dma_handle == dma_handle) {
+
+		ptr_cma_info->sec_alloc_list = sec_mem_elem->next;
+
+		if (sec_mem_elem == ptr_cma_info->sec_alloc_list_tail) {
+			ptr_cma_info->sec_alloc_list_tail = NULL;
+			ASSERT(ptr_cma_info->sec_alloc_list == NULL);
+		}
+
+		return sec_mem_elem;
+	}
+
+	while (sec_mem_elem != NULL) {
+
+		if (sec_mem_elem->dma_handle == dma_handle) {
+
+			sec_prv_elem->next = sec_mem_elem->next;
+			if (sec_mem_elem == ptr_cma_info->sec_alloc_list_tail)
+				ptr_cma_info->sec_alloc_list_tail = sec_prv_elem;
+
+			return sec_mem_elem;
+		}
+		sec_prv_elem = sec_mem_elem;
+		sec_mem_elem = sec_mem_elem->next;
+	}
+	return NULL;
+}
+
+static sec_mem_elem_t *
+osl_sec_dma_rem_first_elem(osl_t *osh, struct sec_cma_info *ptr_cma_info)
+{
+	sec_mem_elem_t *sec_mem_elem = ptr_cma_info->sec_alloc_list;
+
+	if (sec_mem_elem) {
+
+		ptr_cma_info->sec_alloc_list = sec_mem_elem->next;
+
+		if (ptr_cma_info->sec_alloc_list == NULL)
+			ptr_cma_info->sec_alloc_list_tail = NULL;
+
+		return sec_mem_elem;
+
+	} else
+		return NULL;
+}
+
+static void * BCMFASTPATH
+osl_sec_dma_last_elem(osl_t *osh, struct sec_cma_info *ptr_cma_info)
+{
+	return ptr_cma_info->sec_alloc_list_tail;
+}
+
+dma_addr_t BCMFASTPATH
+osl_sec_dma_map_txmeta(osl_t *osh, void *va, uint size, int direction, void *p,
+	hnddma_seg_map_t *dmah, void *ptr_cma_info)
+{
+	sec_mem_elem_t *sec_mem_elem;
+	struct page *pa_cma_page;
+	uint loffset;
+	void *vaorig = va + size;
+	dma_addr_t dma_handle = 0x0;
+	/* packet will be the one added with osl_sec_dma_map() just before this call */
+
+	sec_mem_elem = osl_sec_dma_last_elem(osh, ptr_cma_info);
+
+	if (sec_mem_elem && sec_mem_elem->va == vaorig) {
+
+		pa_cma_page = phys_to_page(sec_mem_elem->pa_cma);
+		loffset = sec_mem_elem->pa_cma -(sec_mem_elem->pa_cma & ~(PAGE_SIZE-1));
+
+		dma_handle = dma_map_page(osh->cma->dev, pa_cma_page, loffset, size,
+			(direction == DMA_TX ? DMA_TO_DEVICE:DMA_FROM_DEVICE));
+
+	} else {
+		printf("%s: error orig va not found va = 0x%p \n",
+			__FUNCTION__, vaorig);
+	}
+	return dma_handle;
+}
+
+dma_addr_t BCMFASTPATH
+osl_sec_dma_map(osl_t *osh, void *va, uint size, int direction, void *p,
+	hnddma_seg_map_t *dmah, void *ptr_cma_info, uint offset)
+{
+
+	sec_mem_elem_t *sec_mem_elem;
+	struct page *pa_cma_page;
+	void *pa_cma_kmap_va = NULL;
+	int *fragva;
+	uint buflen = 0;
+	struct sk_buff *skb;
+	dma_addr_t dma_handle = 0x0;
+	uint loffset;
+	int i = 0;
+
+	sec_mem_elem = osl_sec_dma_alloc_mem_elem(osh, va, size, direction, ptr_cma_info, offset);
+
+	if (sec_mem_elem == NULL) {
+		printk("linux_osl.c: osl_sec_dma_map - cma allocation failed\n");
+		return 0;
+	}
+	sec_mem_elem->va = va;
+	sec_mem_elem->direction = direction;
+	pa_cma_page = phys_to_page(sec_mem_elem->pa_cma);
+
+	loffset = sec_mem_elem->pa_cma -(sec_mem_elem->pa_cma & ~(PAGE_SIZE-1));
+	/* pa_cma_kmap_va = kmap_atomic(pa_cma_page);
+	* pa_cma_kmap_va += loffset;
+	*/
+
+	pa_cma_kmap_va = sec_mem_elem->vac;
+
+	if (direction == DMA_TX) {
+
+		if (p == NULL) {
+
+			memcpy(pa_cma_kmap_va+offset, va, size);
+			buflen = size;
+		}
+		else {
+			for (skb = (struct sk_buff *)p; skb != NULL; skb = PKTNEXT(osh, skb)) {
+				if (skb_is_nonlinear(skb)) {
+
+
+					for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+						skb_frag_t *f = &skb_shinfo(skb)->frags[i];
+						fragva = kmap_atomic(skb_frag_page(f));
+						memcpy((pa_cma_kmap_va+offset+buflen),
+						(fragva + f->page_offset), skb_frag_size(f));
+						kunmap_atomic(fragva);
+						buflen += skb_frag_size(f);
+					}
+				}
+				else {
+					memcpy((pa_cma_kmap_va+offset+buflen), skb->data, skb->len);
+					buflen += skb->len;
+				}
+			}
+
+		}
+		if (dmah) {
+			dmah->nsegs = 1;
+			dmah->origsize = buflen;
+		}
+	}
+
+	else if (direction == DMA_RX)
+	{
+		buflen = size;
+		if ((p != NULL) && (dmah != NULL)) {
+			dmah->nsegs = 1;
+			dmah->origsize = buflen;
+		}
+	}
+	if (direction == DMA_RX || direction == DMA_TX) {
+
+		dma_handle = dma_map_page(osh->cma->dev, pa_cma_page, loffset+offset, buflen,
+			(direction == DMA_TX ? DMA_TO_DEVICE:DMA_FROM_DEVICE));
+
+	}
+	if (dmah) {
+		dmah->segs[0].addr = dma_handle;
+		dmah->segs[0].length = buflen;
+	}
+	sec_mem_elem->dma_handle = dma_handle;
+	/* kunmap_atomic(pa_cma_kmap_va-loffset); */
+	return dma_handle;
+}
+
+dma_addr_t BCMFASTPATH
+osl_sec_dma_dd_map(osl_t *osh, void *va, uint size, int direction, void *p, hnddma_seg_map_t *map)
+{
+
+	struct page *pa_cma_page;
+	phys_addr_t pa_cma;
+	dma_addr_t dma_handle = 0x0;
+	uint loffset;
+
+	pa_cma = (phys_addr_t)(va - osh->contig_delta_va_pa);
+	pa_cma_page = phys_to_page(pa_cma);
+	loffset = pa_cma -(pa_cma & ~(PAGE_SIZE-1));
+
+	dma_handle = dma_map_page(osh->cma->dev, pa_cma_page, loffset, size,
+		(direction == DMA_TX ? DMA_TO_DEVICE:DMA_FROM_DEVICE));
+
+	return dma_handle;
+
+}
+
+void BCMFASTPATH
+osl_sec_dma_unmap(osl_t *osh, dma_addr_t dma_handle, uint size, int direction,
+void *p, hnddma_seg_map_t *map,	void *ptr_cma_info, uint offset)
+{
+	sec_mem_elem_t *sec_mem_elem;
+	struct page *pa_cma_page;
+	void *pa_cma_kmap_va = NULL;
+	uint buflen = 0;
+	dma_addr_t pa_cma;
+	void *va;
+	uint loffset = 0;
+	int read_count = 0;
+	BCM_REFERENCE(buflen);
+	BCM_REFERENCE(read_count);
+
+	sec_mem_elem = osl_sec_dma_find_rem_elem(osh, ptr_cma_info, dma_handle);
+	if (sec_mem_elem == NULL) {
+		printf("%s sec_mem_elem is NULL and dma_handle =0x%lx and dir=%d\n",
+			__FUNCTION__, (ulong)dma_handle, direction);
+		return;
+	}
+
+	va = sec_mem_elem->va;
+	va -= offset;
+	pa_cma = sec_mem_elem->pa_cma;
+
+	pa_cma_page = phys_to_page(pa_cma);
+	loffset = sec_mem_elem->pa_cma -(sec_mem_elem->pa_cma & ~(PAGE_SIZE-1));
+
+	if (direction == DMA_RX) {
+
+		if (p == NULL) {
+
+			/* pa_cma_kmap_va = kmap_atomic(pa_cma_page);
+			* pa_cma_kmap_va += loffset;
+			*/
+
+			pa_cma_kmap_va = sec_mem_elem->vac;
+
+			dma_unmap_page(osh->cma->dev, pa_cma, size, DMA_FROM_DEVICE);
+			memcpy(va, pa_cma_kmap_va, size);
+			/* kunmap_atomic(pa_cma_kmap_va); */
+		}
+	} else {
+		dma_unmap_page(osh->cma->dev, pa_cma, size+offset, DMA_TO_DEVICE);
+	}
+
+	osl_sec_dma_free_mem_elem(osh, sec_mem_elem);
+}
+
+void
+osl_sec_dma_unmap_all(osl_t *osh, void *ptr_cma_info)
+{
+
+	sec_mem_elem_t *sec_mem_elem;
+
+	sec_mem_elem = osl_sec_dma_rem_first_elem(osh, ptr_cma_info);
+
+	while (sec_mem_elem != NULL) {
+
+		dma_unmap_page(osh->cma->dev, sec_mem_elem->pa_cma, sec_mem_elem->size,
+			sec_mem_elem->direction == DMA_TX ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+		osl_sec_dma_free_mem_elem(osh, sec_mem_elem);
+
+		sec_mem_elem = osl_sec_dma_rem_first_elem(osh, ptr_cma_info);
+	}
+}
+
+static void
+osl_sec_dma_init_consistent(osl_t *osh)
+{
+	int i;
+	void *temp_va = osh->contig_base_alloc_coherent_va;
+	phys_addr_t temp_pa = osh->contig_base_alloc_coherent;
+
+	for (i = 0; i < SEC_CMA_COHERENT_MAX; i++) {
+		osh->sec_cma_coherent[i].avail = TRUE;
+		osh->sec_cma_coherent[i].va = temp_va;
+		osh->sec_cma_coherent[i].pa = temp_pa;
+		temp_va += SEC_CMA_COHERENT_BLK;
+		temp_pa += SEC_CMA_COHERENT_BLK;
+	}
+}
+
+static void *
+osl_sec_dma_alloc_consistent(osl_t *osh, uint size, uint16 align_bits, ulong *pap)
+{
+
+	void *temp_va = NULL;
+	ulong temp_pa = 0;
+	int i;
+
+	if (size > SEC_CMA_COHERENT_BLK) {
+		printf("%s unsupported size\n", __FUNCTION__);
+		return NULL;
+	}
+
+	for (i = 0; i < SEC_CMA_COHERENT_MAX; i++) {
+		if (osh->sec_cma_coherent[i].avail == TRUE) {
+			temp_va = osh->sec_cma_coherent[i].va;
+			temp_pa = osh->sec_cma_coherent[i].pa;
+			osh->sec_cma_coherent[i].avail = FALSE;
+			break;
+		}
+	}
+
+	if (i == SEC_CMA_COHERENT_MAX)
+		printf("%s:No coherent mem: va = 0x%p pa = 0x%lx size = %d\n", __FUNCTION__,
+			temp_va, (ulong)temp_pa, size);
+
+	*pap = (unsigned long)temp_pa;
+	return temp_va;
+}
+
+static void
+osl_sec_dma_free_consistent(osl_t *osh, void *va, uint size, dmaaddr_t pa)
+{
+	int i = 0;
+
+	for (i = 0; i < SEC_CMA_COHERENT_MAX; i++) {
+		if (osh->sec_cma_coherent[i].va == va) {
+			osh->sec_cma_coherent[i].avail = TRUE;
+			break;
+		}
+	}
+	if (i == SEC_CMA_COHERENT_MAX)
+		printf("%s:Error: va = 0x%p pa = 0x%lx size = %d\n", __FUNCTION__,
+			va, (ulong)pa, size);
+}
+
+#endif /* BCM_SECURE_DMA */
diff -ENwbur a/drivers/net/wireless/bcm4336/Makefile b/drivers/net/wireless/bcm4336/Makefile
--- a/drivers/net/wireless/bcm4336/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/Makefile	2018-05-06 08:49:50.618753851 +0200
@@ -0,0 +1,106 @@
+# bcmdhd
+# 1. WL_IFACE_COMB_NUM_CHANNELS must be added if Android version is 4.4 with Kernel version 3.0~3.4,
+#    otherwise please remove it.
+
+#CONFIG_BCMDHD_SDIO := y
+#CONFIG_BCMDHD_PCIE := y
+
+DHDCFLAGS = -Wall -Wstrict-prototypes -Dlinux -DBCMDRIVER -DSDTEST       \
+	-DBCMDONGLEHOST -DUNRELEASEDCHIP -DBCMDMA32 -DBCMFILEIMAGE            \
+	-DDHDTHREAD -DDHD_DEBUG -DSHOW_EVENTS -DBCMDBG -DGET_OTP_MAC_ENABLE   \
+	-DWIFI_ACT_FRAME -DARP_OFFLOAD_SUPPORT -DSUPPORT_PM2_ONLY             \
+	-DKEEP_ALIVE -DPKT_FILTER_SUPPORT -DPNO_SUPPORT -DDHDTCPACK_SUPPRESS  \
+	-DDHD_DONOT_FORWARD_BCMEVENT_AS_NETWORK_PKT -DRXFRAME_THREAD          \
+	-DSET_RANDOM_MAC_SOFTAP                                               \
+	-DENABLE_INSMOD_NO_FW_LOAD                                            \
+	-Idrivers/net/wireless/bcm4336 -Idrivers/net/wireless/bcm4336/include
+
+DHDOFILES = aiutils.o siutils.o sbutils.o bcmutils.o bcmwifi_channels.o \
+	dhd_linux.o dhd_linux_platdev.o dhd_linux_sched.o dhd_pno.o \
+	dhd_common.o dhd_ip.o dhd_linux_wq.o dhd_custom_gpio.o \
+	bcmevent.o hndpmu.o linux_osl.o wldev_common.o wl_android.o \
+	hnd_pktq.o hnd_pktpool.o dhd_config.o
+
+ifneq ($(CONFIG_BCMDHD_SDIO),)
+DHDCFLAGS += \
+	-DBCMSDIO -DMMC_SDIO_ABORT -DBCMLXSDMMC -DUSE_SDIOFIFO_IOVAR          \
+	-DBDC -DPROP_TXSTATUS -DDHD_USE_IDLECOUNT -DBCMSDIOH_TXGLOM           \
+	-DCUSTOM_SDIO_F2_BLKSIZE=128
+
+DHDOFILES += bcmsdh.o bcmsdh_linux.o bcmsdh_sdmmc.o bcmsdh_sdmmc_linux.o \
+	dhd_sdio.o dhd_cdc.o dhd_wlfc.o
+
+ifeq ($(CONFIG_BCMDHD_OOB),y)
+DHDCFLAGS += -DOOB_INTR_ONLY -DHW_OOB -DCUSTOMER_OOB
+ifeq ($(CONFIG_BCMDHD_DISABLE_WOWLAN),y)
+DHDCFLAGS += -DDISABLE_WOWLAN
+endif
+else
+DHDCFLAGS += -DSDIO_ISR_THREAD
+endif
+endif
+
+ifneq ($(CONFIG_BCMDHD_PCIE),)
+DHDCFLAGS += \
+	-DPCIE_FULL_DONGLE -DBCMPCIE -DSHOW_LOGTRACE -DDPCIE_TX_DEFERRAL      \
+	-DCUSTOM_DPC_PRIO_SETTING=-1
+
+DHDOFILES += dhd_pcie.o dhd_pcie_linux.o pcie_core.o dhd_flowring.o \
+	dhd_msgbuf.o
+endif
+
+obj-$(CONFIG_BCMDHD) += bcmdhd.o
+bcmdhd-objs += $(DHDOFILES)
+
+ifeq ($(CONFIG_MACH_MINI2451),y)
+DHDOFILES += dhd_gpio.o
+DHDCFLAGS += -DCUSTOMER_HW -DDHD_OF_SUPPORT
+#DHDCFLAGS += -DBCMWAPI_WPI -DBCMWAPI_WAI
+DHDCFLAGS += -DPOWERUP_MAX_RETRY=1 -DPOWERUP_WAIT_MS=1200
+endif
+
+ifeq ($(CONFIG_ARCH_S5P6818),y)
+DHDOFILES += dhd_gpio.o
+DHDCFLAGS += -DCUSTOMER_HW -DDHD_OF_SUPPORT
+#DHDCFLAGS += -DBCMWAPI_WPI -DBCMWAPI_WAI
+DHDCFLAGS += -DPOWERUP_MAX_RETRY=1 -DPOWERUP_WAIT_MS=1200
+DHDCFLAGS += -DPOWER_OFF_IN_SUSPEND
+DHDCFLAGS += -DDHD_PRINTF_LL=KERN_DEBUG
+endif
+
+ifeq ($(CONFIG_BCMDHD_AG),y)
+DHDCFLAGS += -DBAND_AG
+endif
+
+ifeq ($(CONFIG_DHD_USE_STATIC_BUF),y)
+# add dhd_static_buf to kernel image build
+#obj-y += dhd_static_buf.o
+DHDCFLAGS += -DSTATIC_WL_PRIV_STRUCT -DENHANCED_STATIC_BUF
+endif
+
+ifneq ($(CONFIG_WIRELESS_EXT),)
+bcmdhd-objs += wl_iw.o
+DHDCFLAGS += -DSOFTAP -DWL_WIRELESS_EXT -DUSE_IW
+endif
+ifneq ($(CONFIG_CFG80211),)
+bcmdhd-objs += wl_cfg80211.o wl_cfgp2p.o wl_linux_mon.o wl_cfg_btcoex.o
+bcmdhd-objs += dhd_cfg80211.o dhd_cfg_vendor.o
+DHDCFLAGS += -DWL_CFG80211 -DWLP2P -DWL_CFG80211_STA_EVENT -DWL_ENABLE_P2P_IF
+DHDCFLAGS += -DWL_IFACE_COMB_NUM_CHANNELS
+DHDCFLAGS += -DCUSTOM_ROAM_TRIGGER_SETTING=-65
+DHDCFLAGS += -DCUSTOM_ROAM_DELTA_SETTING=15
+DHDCFLAGS += -DCUSTOM_KEEP_ALIVE_SETTING=28000
+DHDCFLAGS += -DCUSTOM_PNO_EVENT_LOCK_xTIME=7
+DHDCFLAGS += -DWL_SUPPORT_AUTO_CHANNEL
+DHDCFLAGS += -DWL_SUPPORT_BACKPORTED_KPATCHES
+DHDCFLAGS += -DESCAN_RESULT_PATCH
+DHDCFLAGS += -DVSDB -DWL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+DHDCFLAGS += -DWLTDLS -DMIRACAST_AMPDU_SIZE=8 -DPROP_TXSTATUS_VSDB
+endif
+EXTRA_CFLAGS = $(DHDCFLAGS)
+ifeq ($(CONFIG_BCMDHD),m)
+DHDCFLAGS += -DMULTIPLE_SUPPLICANT
+EXTRA_LDFLAGS += --strip-debug
+else
+DHDCFLAGS += -DBUILD_IN_KERNEL
+endif
diff -ENwbur a/drivers/net/wireless/bcm4336/pcie_core.c b/drivers/net/wireless/bcm4336/pcie_core.c
--- a/drivers/net/wireless/bcm4336/pcie_core.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/pcie_core.c	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,70 @@
+/** @file pcie_core.c
+ *
+ * Contains PCIe related functions that are shared between different driver models (e.g. firmware
+ * builds, DHD builds, BMAC builds), in order to avoid code duplication.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: pcie_core.c 444841 2013-12-21 04:32:29Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmutils.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <siutils.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+
+#include "pcie_core.h"
+
+/* local prototypes */
+
+/* local variables */
+
+/* function definitions */
+
+#ifdef BCMDRIVER
+
+void pcie_watchdog_reset(osl_t *osh, si_t *sih, sbpcieregs_t *sbpcieregs)
+{
+	uint32 val, i, lsc;
+	uint16 cfg_offset[] = {PCIECFGREG_STATUS_CMD, PCIECFGREG_PM_CSR,
+		PCIECFGREG_MSI_CAP, PCIECFGREG_MSI_ADDR_L,
+		PCIECFGREG_MSI_ADDR_H, PCIECFGREG_MSI_DATA,
+		PCIECFGREG_LINK_STATUS_CTRL2, PCIECFGREG_RBAR_CTRL,
+		PCIECFGREG_PML1_SUB_CTRL1, PCIECFGREG_REG_BAR2_CONFIG,
+		PCIECFGREG_REG_BAR3_CONFIG};
+	sbpcieregs_t *pcie = NULL;
+	uint32 origidx = si_coreidx(sih);
+
+	/* Switch to PCIE2 core */
+	pcie = (sbpcieregs_t *)si_setcore(sih, PCIE2_CORE_ID, 0);
+	BCM_REFERENCE(pcie);
+	ASSERT(pcie != NULL);
+
+	/* Disable/restore ASPM Control to protect the watchdog reset */
+	W_REG(osh, &sbpcieregs->configaddr, PCIECFGREG_LINK_STATUS_CTRL);
+	lsc = R_REG(osh, &sbpcieregs->configdata);
+	val = lsc & (~PCIE_ASPM_ENAB);
+	W_REG(osh, &sbpcieregs->configdata, val);
+
+	si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, 4);
+	OSL_DELAY(100000);
+
+	W_REG(osh, &sbpcieregs->configaddr, PCIECFGREG_LINK_STATUS_CTRL);
+	W_REG(osh, &sbpcieregs->configdata, lsc);
+
+	/* Write configuration registers back to the shadow registers
+	 * cause shadow registers are cleared out after watchdog reset.
+	 */
+	for (i = 0; i < ARRAYSIZE(cfg_offset); i++) {
+		W_REG(osh, &sbpcieregs->configaddr, cfg_offset[i]);
+		val = R_REG(osh, &sbpcieregs->configdata);
+		W_REG(osh, &sbpcieregs->configdata, val);
+	}
+	si_setcoreidx(sih, origidx);
+}
+
+#endif /* BCMDRIVER */
diff -ENwbur a/drivers/net/wireless/bcm4336/sbutils.c b/drivers/net/wireless/bcm4336/sbutils.c
--- a/drivers/net/wireless/bcm4336/sbutils.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/sbutils.c	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,1087 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: sbutils.c 467150 2014-04-02 17:30:43Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+
+#include "siutils_priv.h"
+
+
+/* local prototypes */
+static uint _sb_coreidx(si_info_t *sii, uint32 sba);
+static uint _sb_scan(si_info_t *sii, uint32 sba, void *regs, uint bus, uint32 sbba,
+                     uint ncores);
+static uint32 _sb_coresba(si_info_t *sii);
+static void *_sb_setcoreidx(si_info_t *sii, uint coreidx);
+#define	SET_SBREG(sii, r, mask, val)	\
+		W_SBREG((sii), (r), ((R_SBREG((sii), (r)) & ~(mask)) | (val)))
+#define	REGS2SB(va)	(sbconfig_t*) ((int8*)(va) + SBCONFIGOFF)
+
+/* sonicsrev */
+#define	SONICS_2_2	(SBIDL_RV_2_2 >> SBIDL_RV_SHIFT)
+#define	SONICS_2_3	(SBIDL_RV_2_3 >> SBIDL_RV_SHIFT)
+
+#define	R_SBREG(sii, sbr)	sb_read_sbreg((sii), (sbr))
+#define	W_SBREG(sii, sbr, v)	sb_write_sbreg((sii), (sbr), (v))
+#define	AND_SBREG(sii, sbr, v)	W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) & (v)))
+#define	OR_SBREG(sii, sbr, v)	W_SBREG((sii), (sbr), (R_SBREG((sii), (sbr)) | (v)))
+
+static uint32
+sb_read_sbreg(si_info_t *sii, volatile uint32 *sbr)
+{
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint8 tmp;
+	uint32 val, intr_val = 0;
+
+
+	/*
+	 * compact flash only has 11 bits address, while we needs 12 bits address.
+	 * MEM_SEG will be OR'd with other 11 bits address in hardware,
+	 * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+	 * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+	 */
+	if (PCMCIA(sii)) {
+		INTR_OFF(sii, intr_val);
+		tmp = 1;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+		sbr = (volatile uint32 *)((uintptr)sbr & ~(1 << 11)); /* mask out bit 11 */
+	}
+
+	val = R_REG(sii->osh, sbr);
+
+	if (PCMCIA(sii)) {
+		tmp = 0;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+		INTR_RESTORE(sii, intr_val);
+	}
+
+	return (val);
+}
+
+static void
+sb_write_sbreg(si_info_t *sii, volatile uint32 *sbr, uint32 v)
+{
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint8 tmp;
+	volatile uint32 dummy;
+	uint32 intr_val = 0;
+
+
+	/*
+	 * compact flash only has 11 bits address, while we needs 12 bits address.
+	 * MEM_SEG will be OR'd with other 11 bits address in hardware,
+	 * so we program MEM_SEG with 12th bit when necessary(access sb regsiters).
+	 * For normal PCMCIA bus(CFTable_regwinsz > 2k), do nothing special
+	 */
+	if (PCMCIA(sii)) {
+		INTR_OFF(sii, intr_val);
+		tmp = 1;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+		sbr = (volatile uint32 *)((uintptr)sbr & ~(1 << 11)); /* mask out bit 11 */
+	}
+
+	if (BUSTYPE(sii->pub.bustype) == PCMCIA_BUS) {
+		dummy = R_REG(sii->osh, sbr);
+		BCM_REFERENCE(dummy);
+		W_REG(sii->osh, (volatile uint16 *)sbr, (uint16)(v & 0xffff));
+		dummy = R_REG(sii->osh, sbr);
+		BCM_REFERENCE(dummy);
+		W_REG(sii->osh, ((volatile uint16 *)sbr + 1), (uint16)((v >> 16) & 0xffff));
+	} else
+		W_REG(sii->osh, sbr, v);
+
+	if (PCMCIA(sii)) {
+		tmp = 0;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, MEM_SEG, &tmp, 1);
+		INTR_RESTORE(sii, intr_val);
+	}
+}
+
+uint
+sb_coreid(si_t *sih)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_CC_MASK) >> SBIDH_CC_SHIFT);
+}
+
+uint
+sb_intflag(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	void *corereg;
+	sbconfig_t *sb;
+	uint origidx, intflag, intr_val = 0;
+
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+	corereg = si_setcore(sih, CC_CORE_ID, 0);
+	ASSERT(corereg != NULL);
+	sb = REGS2SB(corereg);
+	intflag = R_SBREG(sii, &sb->sbflagst);
+	sb_setcoreidx(sih, origidx);
+	INTR_RESTORE(sii, intr_val);
+
+	return intflag;
+}
+
+uint
+sb_flag(si_t *sih)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	return R_SBREG(sii, &sb->sbtpsflag) & SBTPS_NUM0_MASK;
+}
+
+void
+sb_setint(si_t *sih, int siflag)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+	uint32 vec;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	if (siflag == -1)
+		vec = 0;
+	else
+		vec = 1 << siflag;
+	W_SBREG(sii, &sb->sbintvec, vec);
+}
+
+/* return core index of the core with address 'sba' */
+static uint
+_sb_coreidx(si_info_t *sii, uint32 sba)
+{
+	uint i;
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	for (i = 0; i < sii->numcores; i ++)
+		if (sba == cores_info->coresba[i])
+			return i;
+	return BADIDX;
+}
+
+/* return core address of the current core */
+static uint32
+_sb_coresba(si_info_t *sii)
+{
+	uint32 sbaddr;
+
+
+	switch (BUSTYPE(sii->pub.bustype)) {
+	case SI_BUS: {
+		sbconfig_t *sb = REGS2SB(sii->curmap);
+		sbaddr = sb_base(R_SBREG(sii, &sb->sbadmatch0));
+		break;
+	}
+
+	case PCI_BUS:
+		sbaddr = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+		break;
+
+	case PCMCIA_BUS: {
+		uint8 tmp = 0;
+		OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR0, &tmp, 1);
+		sbaddr  = (uint32)tmp << 12;
+		OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR1, &tmp, 1);
+		sbaddr |= (uint32)tmp << 16;
+		OSL_PCMCIA_READ_ATTR(sii->osh, PCMCIA_ADDR2, &tmp, 1);
+		sbaddr |= (uint32)tmp << 24;
+		break;
+	}
+
+#ifdef BCMSDIO
+	case SPI_BUS:
+	case SDIO_BUS:
+		sbaddr = (uint32)(uintptr)sii->curmap;
+		break;
+#endif
+
+
+	default:
+		sbaddr = BADCOREADDR;
+		break;
+	}
+
+	return sbaddr;
+}
+
+uint
+sb_corevendor(si_t *sih)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	return ((R_SBREG(sii, &sb->sbidhigh) & SBIDH_VC_MASK) >> SBIDH_VC_SHIFT);
+}
+
+uint
+sb_corerev(si_t *sih)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+	uint sbidh;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+	sbidh = R_SBREG(sii, &sb->sbidhigh);
+
+	return (SBCOREREV(sbidh));
+}
+
+/* set core-specific control flags */
+void
+sb_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+	uint32 w;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	ASSERT((val & ~mask) == 0);
+
+	/* mask and set */
+	w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+	        (val << SBTML_SICF_SHIFT);
+	W_SBREG(sii, &sb->sbtmstatelow, w);
+}
+
+/* set/clear core-specific control flags */
+uint32
+sb_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+	uint32 w;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	ASSERT((val & ~mask) == 0);
+
+	/* mask and set */
+	if (mask || val) {
+		w = (R_SBREG(sii, &sb->sbtmstatelow) & ~(mask << SBTML_SICF_SHIFT)) |
+		        (val << SBTML_SICF_SHIFT);
+		W_SBREG(sii, &sb->sbtmstatelow, w);
+	}
+
+	/* return the new value
+	 * for write operation, the following readback ensures the completion of write opration.
+	 */
+	return (R_SBREG(sii, &sb->sbtmstatelow) >> SBTML_SICF_SHIFT);
+}
+
+/* set/clear core-specific status flags */
+uint32
+sb_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+	uint32 w;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	ASSERT((val & ~mask) == 0);
+	ASSERT((mask & ~SISF_CORE_BITS) == 0);
+
+	/* mask and set */
+	if (mask || val) {
+		w = (R_SBREG(sii, &sb->sbtmstatehigh) & ~(mask << SBTMH_SISF_SHIFT)) |
+		        (val << SBTMH_SISF_SHIFT);
+		W_SBREG(sii, &sb->sbtmstatehigh, w);
+	}
+
+	/* return the new value */
+	return (R_SBREG(sii, &sb->sbtmstatehigh) >> SBTMH_SISF_SHIFT);
+}
+
+bool
+sb_iscoreup(si_t *sih)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	return ((R_SBREG(sii, &sb->sbtmstatelow) &
+	         (SBTML_RESET | SBTML_REJ_MASK | (SICF_CLOCK_EN << SBTML_SICF_SHIFT))) ==
+	        (SICF_CLOCK_EN << SBTML_SICF_SHIFT));
+}
+
+/*
+ * Switch to 'coreidx', issue a single arbitrary 32bit register mask&set operation,
+ * switch back to the original core, and return the new value.
+ *
+ * When using the silicon backplane, no fidleing with interrupts or core switches are needed.
+ *
+ * Also, when using pci/pcie, we can optimize away the core switching for pci registers
+ * and (on newer pci cores) chipcommon registers.
+ */
+uint
+sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+	uint origidx = 0;
+	uint32 *r = NULL;
+	uint w;
+	uint intr_val = 0;
+	bool fast = FALSE;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	ASSERT(GOODIDX(coreidx));
+	ASSERT(regoff < SI_CORE_SIZE);
+	ASSERT((val & ~mask) == 0);
+
+	if (coreidx >= SI_MAXCORES)
+		return 0;
+
+	if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+		/* If internal bus, we can always get at everything */
+		fast = TRUE;
+		/* map if does not exist */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+			                            SI_CORE_SIZE);
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+	} else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+		/* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+		if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+			/* Chipc registers are mapped at 12KB */
+
+			fast = TRUE;
+			r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+		} else if (sii->pub.buscoreidx == coreidx) {
+			/* pci registers are at either in the last 2KB of an 8KB window
+			 * or, in pcie and pci rev 13 at 8KB
+			 */
+			fast = TRUE;
+			if (SI_FAST(sii))
+				r = (uint32 *)((char *)sii->curmap +
+				               PCI_16KB0_PCIREGS_OFFSET + regoff);
+			else
+				r = (uint32 *)((char *)sii->curmap +
+				               ((regoff >= SBCONFIGOFF) ?
+				                PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+				               regoff);
+		}
+	}
+
+	if (!fast) {
+		INTR_OFF(sii, intr_val);
+
+		/* save current core index */
+		origidx = si_coreidx(&sii->pub);
+
+		/* switch core */
+		r = (uint32*) ((uchar*)sb_setcoreidx(&sii->pub, coreidx) + regoff);
+	}
+	ASSERT(r != NULL);
+
+	/* mask and set */
+	if (mask || val) {
+		if (regoff >= SBCONFIGOFF) {
+			w = (R_SBREG(sii, r) & ~mask) | val;
+			W_SBREG(sii, r, w);
+		} else {
+			w = (R_REG(sii->osh, r) & ~mask) | val;
+			W_REG(sii->osh, r, w);
+		}
+	}
+
+	/* readback */
+	if (regoff >= SBCONFIGOFF)
+		w = R_SBREG(sii, r);
+	else {
+		if ((CHIPID(sii->pub.chip) == BCM5354_CHIP_ID) &&
+		    (coreidx == SI_CC_IDX) &&
+		    (regoff == OFFSETOF(chipcregs_t, watchdog))) {
+			w = val;
+		} else
+			w = R_REG(sii->osh, r);
+	}
+
+	if (!fast) {
+		/* restore core index */
+		if (origidx != coreidx)
+			sb_setcoreidx(&sii->pub, origidx);
+
+		INTR_RESTORE(sii, intr_val);
+	}
+
+	return (w);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+uint32 *
+sb_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+	uint32 *r = NULL;
+	bool fast = FALSE;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	ASSERT(GOODIDX(coreidx));
+	ASSERT(regoff < SI_CORE_SIZE);
+
+	if (coreidx >= SI_MAXCORES)
+		return 0;
+
+	if (BUSTYPE(sii->pub.bustype) == SI_BUS) {
+		/* If internal bus, we can always get at everything */
+		fast = TRUE;
+		/* map if does not exist */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = REG_MAP(cores_info->coresba[coreidx],
+			                            SI_CORE_SIZE);
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		r = (uint32 *)((uchar *)cores_info->regs[coreidx] + regoff);
+	} else if (BUSTYPE(sii->pub.bustype) == PCI_BUS) {
+		/* If pci/pcie, we can get at pci/pcie regs and on newer cores to chipc */
+
+		if ((cores_info->coreid[coreidx] == CC_CORE_ID) && SI_FAST(sii)) {
+			/* Chipc registers are mapped at 12KB */
+
+			fast = TRUE;
+			r = (uint32 *)((char *)sii->curmap + PCI_16KB0_CCREGS_OFFSET + regoff);
+		} else if (sii->pub.buscoreidx == coreidx) {
+			/* pci registers are at either in the last 2KB of an 8KB window
+			 * or, in pcie and pci rev 13 at 8KB
+			 */
+			fast = TRUE;
+			if (SI_FAST(sii))
+				r = (uint32 *)((char *)sii->curmap +
+				               PCI_16KB0_PCIREGS_OFFSET + regoff);
+			else
+				r = (uint32 *)((char *)sii->curmap +
+				               ((regoff >= SBCONFIGOFF) ?
+				                PCI_BAR0_PCISBR_OFFSET : PCI_BAR0_PCIREGS_OFFSET) +
+				               regoff);
+		}
+	}
+
+	if (!fast)
+		return 0;
+
+	return (r);
+}
+
+/* Scan the enumeration space to find all cores starting from the given
+ * bus 'sbba'. Append coreid and other info to the lists in 'si'. 'sba'
+ * is the default core address at chip POR time and 'regs' is the virtual
+ * address that the default core is mapped at. 'ncores' is the number of
+ * cores expected on bus 'sbba'. It returns the total number of cores
+ * starting from bus 'sbba', inclusive.
+ */
+#define SB_MAXBUSES	2
+static uint
+_sb_scan(si_info_t *sii, uint32 sba, void *regs, uint bus, uint32 sbba, uint numcores)
+{
+	uint next;
+	uint ncc = 0;
+	uint i;
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	if (bus >= SB_MAXBUSES) {
+		SI_ERROR(("_sb_scan: bus 0x%08x at level %d is too deep to scan\n", sbba, bus));
+		return 0;
+	}
+	SI_MSG(("_sb_scan: scan bus 0x%08x assume %u cores\n", sbba, numcores));
+
+	/* Scan all cores on the bus starting from core 0.
+	 * Core addresses must be contiguous on each bus.
+	 */
+	for (i = 0, next = sii->numcores; i < numcores && next < SB_BUS_MAXCORES; i++, next++) {
+		cores_info->coresba[next] = sbba + (i * SI_CORE_SIZE);
+
+		/* keep and reuse the initial register mapping */
+		if ((BUSTYPE(sii->pub.bustype) == SI_BUS) && (cores_info->coresba[next] == sba)) {
+			SI_VMSG(("_sb_scan: reuse mapped regs %p for core %u\n", regs, next));
+			cores_info->regs[next] = regs;
+		}
+
+		/* change core to 'next' and read its coreid */
+		sii->curmap = _sb_setcoreidx(sii, next);
+		sii->curidx = next;
+
+		cores_info->coreid[next] = sb_coreid(&sii->pub);
+
+		/* core specific processing... */
+		/* chipc provides # cores */
+		if (cores_info->coreid[next] == CC_CORE_ID) {
+			chipcregs_t *cc = (chipcregs_t *)sii->curmap;
+			uint32 ccrev = sb_corerev(&sii->pub);
+
+			/* determine numcores - this is the total # cores in the chip */
+			if (((ccrev == 4) || (ccrev >= 6))) {
+				ASSERT(cc);
+				numcores = (R_REG(sii->osh, &cc->chipid) & CID_CC_MASK) >>
+				        CID_CC_SHIFT;
+			} else {
+				/* Older chips */
+				uint chip = CHIPID(sii->pub.chip);
+
+				if (chip == BCM4306_CHIP_ID)	/* < 4306c0 */
+					numcores = 6;
+				else if (chip == BCM4704_CHIP_ID)
+					numcores = 9;
+				else if (chip == BCM5365_CHIP_ID)
+					numcores = 7;
+				else {
+					SI_ERROR(("sb_chip2numcores: unsupported chip 0x%x\n",
+					          chip));
+					ASSERT(0);
+					numcores = 1;
+				}
+			}
+			SI_VMSG(("_sb_scan: there are %u cores in the chip %s\n", numcores,
+				sii->pub.issim ? "QT" : ""));
+		}
+		/* scan bridged SB(s) and add results to the end of the list */
+		else if (cores_info->coreid[next] == OCP_CORE_ID) {
+			sbconfig_t *sb = REGS2SB(sii->curmap);
+			uint32 nsbba = R_SBREG(sii, &sb->sbadmatch1);
+			uint nsbcc;
+
+			sii->numcores = next + 1;
+
+			if ((nsbba & 0xfff00000) != SI_ENUM_BASE)
+				continue;
+			nsbba &= 0xfffff000;
+			if (_sb_coreidx(sii, nsbba) != BADIDX)
+				continue;
+
+			nsbcc = (R_SBREG(sii, &sb->sbtmstatehigh) & 0x000f0000) >> 16;
+			nsbcc = _sb_scan(sii, sba, regs, bus + 1, nsbba, nsbcc);
+			if (sbba == SI_ENUM_BASE)
+				numcores -= nsbcc;
+			ncc += nsbcc;
+		}
+	}
+
+	SI_MSG(("_sb_scan: found %u cores on bus 0x%08x\n", i, sbba));
+
+	sii->numcores = i + ncc;
+	return sii->numcores;
+}
+
+/* scan the sb enumerated space to identify all cores */
+void
+sb_scan(si_t *sih, void *regs, uint devid)
+{
+	uint32 origsba;
+	sbconfig_t *sb;
+	si_info_t *sii = SI_INFO(sih);
+
+	sb = REGS2SB(sii->curmap);
+
+	sii->pub.socirev = (R_SBREG(sii, &sb->sbidlow) & SBIDL_RV_MASK) >> SBIDL_RV_SHIFT;
+
+	/* Save the current core info and validate it later till we know
+	 * for sure what is good and what is bad.
+	 */
+	origsba = _sb_coresba(sii);
+
+	/* scan all SB(s) starting from SI_ENUM_BASE */
+	sii->numcores = _sb_scan(sii, origsba, regs, 0, SI_ENUM_BASE, 1);
+}
+
+/*
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+void *
+sb_setcoreidx(si_t *sih, uint coreidx)
+{
+	si_info_t *sii = SI_INFO(sih);
+
+	if (coreidx >= sii->numcores)
+		return (NULL);
+
+	/*
+	 * If the user has provided an interrupt mask enabled function,
+	 * then assert interrupts are disabled before switching the core.
+	 */
+	ASSERT((sii->intrsenabled_fn == NULL) || !(*(sii)->intrsenabled_fn)((sii)->intr_arg));
+
+	sii->curmap = _sb_setcoreidx(sii, coreidx);
+	sii->curidx = coreidx;
+
+	return (sii->curmap);
+}
+
+/* This function changes the logical "focus" to the indicated core.
+ * Return the current core's virtual address.
+ */
+static void *
+_sb_setcoreidx(si_info_t *sii, uint coreidx)
+{
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint32 sbaddr = cores_info->coresba[coreidx];
+	void *regs;
+
+	switch (BUSTYPE(sii->pub.bustype)) {
+	case SI_BUS:
+		/* map new one */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = REG_MAP(sbaddr, SI_CORE_SIZE);
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		regs = cores_info->regs[coreidx];
+		break;
+
+	case PCI_BUS:
+		/* point bar0 window */
+		OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, sbaddr);
+		regs = sii->curmap;
+		break;
+
+	case PCMCIA_BUS: {
+		uint8 tmp = (sbaddr >> 12) & 0x0f;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR0, &tmp, 1);
+		tmp = (sbaddr >> 16) & 0xff;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR1, &tmp, 1);
+		tmp = (sbaddr >> 24) & 0xff;
+		OSL_PCMCIA_WRITE_ATTR(sii->osh, PCMCIA_ADDR2, &tmp, 1);
+		regs = sii->curmap;
+		break;
+	}
+#ifdef BCMSDIO
+	case SPI_BUS:
+	case SDIO_BUS:
+		/* map new one */
+		if (!cores_info->regs[coreidx]) {
+			cores_info->regs[coreidx] = (void *)(uintptr)sbaddr;
+			ASSERT(GOODREGS(cores_info->regs[coreidx]));
+		}
+		regs = cores_info->regs[coreidx];
+		break;
+#endif	/* BCMSDIO */
+
+
+	default:
+		ASSERT(0);
+		regs = NULL;
+		break;
+	}
+
+	return regs;
+}
+
+/* Return the address of sbadmatch0/1/2/3 register */
+static volatile uint32 *
+sb_admatch(si_info_t *sii, uint asidx)
+{
+	sbconfig_t *sb;
+	volatile uint32 *addrm;
+
+	sb = REGS2SB(sii->curmap);
+
+	switch (asidx) {
+	case 0:
+		addrm =  &sb->sbadmatch0;
+		break;
+
+	case 1:
+		addrm =  &sb->sbadmatch1;
+		break;
+
+	case 2:
+		addrm =  &sb->sbadmatch2;
+		break;
+
+	case 3:
+		addrm =  &sb->sbadmatch3;
+		break;
+
+	default:
+		SI_ERROR(("%s: Address space index (%d) out of range\n", __FUNCTION__, asidx));
+		return 0;
+	}
+
+	return (addrm);
+}
+
+/* Return the number of address spaces in current core */
+int
+sb_numaddrspaces(si_t *sih)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+
+	sii = SI_INFO(sih);
+	sb = REGS2SB(sii->curmap);
+
+	/* + 1 because of enumeration space */
+	return ((R_SBREG(sii, &sb->sbidlow) & SBIDL_AR_MASK) >> SBIDL_AR_SHIFT) + 1;
+}
+
+/* Return the address of the nth address space in the current core */
+uint32
+sb_addrspace(si_t *sih, uint asidx)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+
+	return (sb_base(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+/* Return the size of the nth address space in the current core */
+uint32
+sb_addrspacesize(si_t *sih, uint asidx)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+
+	return (sb_size(R_SBREG(sii, sb_admatch(sii, asidx))));
+}
+
+
+/* do buffered registers update */
+void
+sb_commit(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+
+	origidx = sii->curidx;
+	ASSERT(GOODIDX(origidx));
+
+	INTR_OFF(sii, intr_val);
+
+	/* switch over to chipcommon core if there is one, else use pci */
+	if (sii->pub.ccrev != NOREV) {
+		chipcregs_t *ccregs = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+		ASSERT(ccregs != NULL);
+
+		/* do the buffer registers update */
+		W_REG(sii->osh, &ccregs->broadcastaddress, SB_COMMIT);
+		W_REG(sii->osh, &ccregs->broadcastdata, 0x0);
+	} else
+		ASSERT(0);
+
+	/* restore core index */
+	sb_setcoreidx(sih, origidx);
+	INTR_RESTORE(sii, intr_val);
+}
+
+void
+sb_core_disable(si_t *sih, uint32 bits)
+{
+	si_info_t *sii;
+	volatile uint32 dummy;
+	sbconfig_t *sb;
+
+	sii = SI_INFO(sih);
+
+	ASSERT(GOODREGS(sii->curmap));
+	sb = REGS2SB(sii->curmap);
+
+	/* if core is already in reset, just return */
+	if (R_SBREG(sii, &sb->sbtmstatelow) & SBTML_RESET)
+		return;
+
+	/* if clocks are not enabled, put into reset and return */
+	if ((R_SBREG(sii, &sb->sbtmstatelow) & (SICF_CLOCK_EN << SBTML_SICF_SHIFT)) == 0)
+		goto disable;
+
+	/* set target reject and spin until busy is clear (preserve core-specific bits) */
+	OR_SBREG(sii, &sb->sbtmstatelow, SBTML_REJ);
+	dummy = R_SBREG(sii, &sb->sbtmstatelow);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(1);
+	SPINWAIT((R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY), 100000);
+	if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_BUSY)
+		SI_ERROR(("%s: target state still busy\n", __FUNCTION__));
+
+	if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT) {
+		OR_SBREG(sii, &sb->sbimstate, SBIM_RJ);
+		dummy = R_SBREG(sii, &sb->sbimstate);
+		BCM_REFERENCE(dummy);
+		OSL_DELAY(1);
+		SPINWAIT((R_SBREG(sii, &sb->sbimstate) & SBIM_BY), 100000);
+	}
+
+	/* set reset and reject while enabling the clocks */
+	W_SBREG(sii, &sb->sbtmstatelow,
+	        (((bits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+	         SBTML_REJ | SBTML_RESET));
+	dummy = R_SBREG(sii, &sb->sbtmstatelow);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(10);
+
+	/* don't forget to clear the initiator reject bit */
+	if (R_SBREG(sii, &sb->sbidlow) & SBIDL_INIT)
+		AND_SBREG(sii, &sb->sbimstate, ~SBIM_RJ);
+
+disable:
+	/* leave reset and reject asserted */
+	W_SBREG(sii, &sb->sbtmstatelow, ((bits << SBTML_SICF_SHIFT) | SBTML_REJ | SBTML_RESET));
+	OSL_DELAY(1);
+}
+
+/* reset and re-enable a core
+ * inputs:
+ * bits - core specific bits that are set during and after reset sequence
+ * resetbits - core specific bits that are set only during reset sequence
+ */
+void
+sb_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+	si_info_t *sii;
+	sbconfig_t *sb;
+	volatile uint32 dummy;
+
+	sii = SI_INFO(sih);
+	ASSERT(GOODREGS(sii->curmap));
+	sb = REGS2SB(sii->curmap);
+
+	/*
+	 * Must do the disable sequence first to work for arbitrary current core state.
+	 */
+	sb_core_disable(sih, (bits | resetbits));
+
+	/*
+	 * Now do the initialization sequence.
+	 */
+
+	/* set reset while enabling the clock and forcing them on throughout the core */
+	W_SBREG(sii, &sb->sbtmstatelow,
+	        (((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT) |
+	         SBTML_RESET));
+	dummy = R_SBREG(sii, &sb->sbtmstatelow);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(1);
+
+	if (R_SBREG(sii, &sb->sbtmstatehigh) & SBTMH_SERR) {
+		W_SBREG(sii, &sb->sbtmstatehigh, 0);
+	}
+	if ((dummy = R_SBREG(sii, &sb->sbimstate)) & (SBIM_IBE | SBIM_TO)) {
+		AND_SBREG(sii, &sb->sbimstate, ~(SBIM_IBE | SBIM_TO));
+	}
+
+	/* clear reset and allow it to propagate throughout the core */
+	W_SBREG(sii, &sb->sbtmstatelow,
+	        ((bits | resetbits | SICF_FGC | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+	dummy = R_SBREG(sii, &sb->sbtmstatelow);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(1);
+
+	/* leave clock enabled */
+	W_SBREG(sii, &sb->sbtmstatelow, ((bits | SICF_CLOCK_EN) << SBTML_SICF_SHIFT));
+	dummy = R_SBREG(sii, &sb->sbtmstatelow);
+	BCM_REFERENCE(dummy);
+	OSL_DELAY(1);
+}
+
+/*
+ * Set the initiator timeout for the "master core".
+ * The master core is defined to be the core in control
+ * of the chip and so it issues accesses to non-memory
+ * locations (Because of dma *any* core can access memeory).
+ *
+ * The routine uses the bus to decide who is the master:
+ *	SI_BUS => mips
+ *	JTAG_BUS => chipc
+ *	PCI_BUS => pci or pcie
+ *	PCMCIA_BUS => pcmcia
+ *	SDIO_BUS => pcmcia
+ *
+ * This routine exists so callers can disable initiator
+ * timeouts so accesses to very slow devices like otp
+ * won't cause an abort. The routine allows arbitrary
+ * settings of the service and request timeouts, though.
+ *
+ * Returns the timeout state before changing it or -1
+ * on error.
+ */
+
+#define	TO_MASK	(SBIMCL_RTO_MASK | SBIMCL_STO_MASK)
+
+uint32
+sb_set_initiator_to(si_t *sih, uint32 to, uint idx)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	uint32 tmp, ret = 0xffffffff;
+	sbconfig_t *sb;
+
+
+	if ((to & ~TO_MASK) != 0)
+		return ret;
+
+	/* Figure out the master core */
+	if (idx == BADIDX) {
+		switch (BUSTYPE(sii->pub.bustype)) {
+		case PCI_BUS:
+			idx = sii->pub.buscoreidx;
+			break;
+		case JTAG_BUS:
+			idx = SI_CC_IDX;
+			break;
+		case PCMCIA_BUS:
+#ifdef BCMSDIO
+		case SDIO_BUS:
+#endif
+			idx = si_findcoreidx(sih, PCMCIA_CORE_ID, 0);
+			break;
+		case SI_BUS:
+			idx = si_findcoreidx(sih, MIPS33_CORE_ID, 0);
+			break;
+		default:
+			ASSERT(0);
+		}
+		if (idx == BADIDX)
+			return ret;
+	}
+
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	sb = REGS2SB(sb_setcoreidx(sih, idx));
+
+	tmp = R_SBREG(sii, &sb->sbimconfiglow);
+	ret = tmp & TO_MASK;
+	W_SBREG(sii, &sb->sbimconfiglow, (tmp & ~TO_MASK) | to);
+
+	sb_commit(sih);
+	sb_setcoreidx(sih, origidx);
+	INTR_RESTORE(sii, intr_val);
+	return ret;
+}
+
+uint32
+sb_base(uint32 admatch)
+{
+	uint32 base;
+	uint type;
+
+	type = admatch & SBAM_TYPE_MASK;
+	ASSERT(type < 3);
+
+	base = 0;
+
+	if (type == 0) {
+		base = admatch & SBAM_BASE0_MASK;
+	} else if (type == 1) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		base = admatch & SBAM_BASE1_MASK;
+	} else if (type == 2) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		base = admatch & SBAM_BASE2_MASK;
+	}
+
+	return (base);
+}
+
+uint32
+sb_size(uint32 admatch)
+{
+	uint32 size;
+	uint type;
+
+	type = admatch & SBAM_TYPE_MASK;
+	ASSERT(type < 3);
+
+	size = 0;
+
+	if (type == 0) {
+		size = 1 << (((admatch & SBAM_ADINT0_MASK) >> SBAM_ADINT0_SHIFT) + 1);
+	} else if (type == 1) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		size = 1 << (((admatch & SBAM_ADINT1_MASK) >> SBAM_ADINT1_SHIFT) + 1);
+	} else if (type == 2) {
+		ASSERT(!(admatch & SBAM_ADNEG));	/* neg not supported */
+		size = 1 << (((admatch & SBAM_ADINT2_MASK) >> SBAM_ADINT2_SHIFT) + 1);
+	}
+
+	return (size);
+}
+
+#if defined(BCMDBG_PHYDUMP)
+/* print interesting sbconfig registers */
+void
+sb_dumpregs(si_t *sih, struct bcmstrbuf *b)
+{
+	sbconfig_t *sb;
+	uint origidx, i, intr_val = 0;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	origidx = sii->curidx;
+
+	INTR_OFF(sii, intr_val);
+
+	for (i = 0; i < sii->numcores; i++) {
+		sb = REGS2SB(sb_setcoreidx(sih, i));
+
+		bcm_bprintf(b, "core 0x%x: \n", cores_info->coreid[i]);
+
+		if (sii->pub.socirev > SONICS_2_2)
+			bcm_bprintf(b, "sbimerrlog 0x%x sbimerrloga 0x%x\n",
+			          sb_corereg(sih, si_coreidx(&sii->pub), SBIMERRLOG, 0, 0),
+			          sb_corereg(sih, si_coreidx(&sii->pub), SBIMERRLOGA, 0, 0));
+
+		bcm_bprintf(b, "sbtmstatelow 0x%x sbtmstatehigh 0x%x sbidhigh 0x%x "
+		            "sbimstate 0x%x\n sbimconfiglow 0x%x sbimconfighigh 0x%x\n",
+		            R_SBREG(sii, &sb->sbtmstatelow), R_SBREG(sii, &sb->sbtmstatehigh),
+		            R_SBREG(sii, &sb->sbidhigh), R_SBREG(sii, &sb->sbimstate),
+		            R_SBREG(sii, &sb->sbimconfiglow), R_SBREG(sii, &sb->sbimconfighigh));
+	}
+
+	sb_setcoreidx(sih, origidx);
+	INTR_RESTORE(sii, intr_val);
+}
+#endif
diff -ENwbur a/drivers/net/wireless/bcm4336/siutils.c b/drivers/net/wireless/bcm4336/siutils.c
--- a/drivers/net/wireless/bcm4336/siutils.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/siutils.c	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,3022 @@
+/*
+ * Misc utility routines for accessing chip-specific features
+ * of the SiliconBackplane-based Broadcom chips.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: siutils.c 497460 2014-08-19 15:14:13Z $
+ */
+
+#include <bcm_cfg.h>
+#include <typedefs.h>
+#include <bcmdefs.h>
+#include <osl.h>
+#include <bcmutils.h>
+#include <siutils.h>
+#include <bcmdevs.h>
+#include <hndsoc.h>
+#include <sbchipc.h>
+#include <pcicfg.h>
+#include <sbpcmcia.h>
+#include <sbsocram.h>
+#ifdef BCMSDIO
+#include <bcmsdh.h>
+#include <sdio.h>
+#include <sbsdio.h>
+#include <sbhnddma.h>
+#include <sbsdpcmdev.h>
+#include <bcmsdpcm.h>
+#endif /* BCMSDIO */
+#include <hndpmu.h>
+#include <dhd_config.h>
+
+#ifdef BCM_SDRBL
+#include <hndcpu.h>
+#endif /* BCM_SDRBL */
+#ifdef HNDGCI
+#include <hndgci.h>
+#endif /* HNDGCI */
+
+#include "siutils_priv.h"
+
+/**
+ * A set of PMU registers is clocked in the ILP domain, which has an implication on register write
+ * behavior: if such a register is written, it takes multiple ILP clocks for the PMU block to absorb
+ * the write. During that time the 'SlowWritePending' bit in the PMUStatus register is set.
+ */
+#define PMUREGS_ILP_SENSITIVE(regoff) \
+	((regoff) == OFFSETOF(pmuregs_t, pmutimer) || \
+	 (regoff) == OFFSETOF(pmuregs_t, pmuwatchdog) || \
+	 (regoff) == OFFSETOF(pmuregs_t, res_req_timer))
+
+#define CHIPCREGS_ILP_SENSITIVE(regoff) \
+	((regoff) == OFFSETOF(chipcregs_t, pmutimer) || \
+	 (regoff) == OFFSETOF(chipcregs_t, pmuwatchdog) || \
+	 (regoff) == OFFSETOF(chipcregs_t, res_req_timer))
+
+/* local prototypes */
+static si_info_t *si_doattach(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+                              uint bustype, void *sdh, char **vars, uint *varsz);
+static bool si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh);
+static bool si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+	uint *origidx, void *regs);
+
+
+static bool si_pmu_is_ilp_sensitive(uint32 idx, uint regoff);
+
+#ifdef BCMLTECOEX
+static void si_config_gcigpio(si_t *sih, uint32 gci_pos, uint8 gcigpio,
+	uint8 gpioctl_mask, uint8 gpioctl_val);
+#endif /* BCMLTECOEX */
+
+
+
+/* global variable to indicate reservation/release of gpio's */
+static uint32 si_gpioreservation = 0;
+
+/* global flag to prevent shared resources from being initialized multiple times in si_attach() */
+#ifdef SR_DEBUG
+static const uint32 si_power_island_test_array[] = {
+	0x0000, 0x0001, 0x0010, 0x0011,
+	0x0100, 0x0101, 0x0110, 0x0111,
+	0x1000, 0x1001, 0x1010, 0x1011,
+	0x1100, 0x1101, 0x1110, 0x1111
+};
+#endif /* SR_DEBUG */
+
+int do_4360_pcie2_war = 0;
+
+/* global kernel resource */
+static si_info_t ksii;
+static si_cores_info_t ksii_cores_info;
+
+/**
+ * Allocate an si handle. This function may be called multiple times.
+ *
+ * devid - pci device id (used to determine chip#)
+ * osh - opaque OS handle
+ * regs - virtual address of initial core registers
+ * bustype - pci/pcmcia/sb/sdio/etc
+ * vars - pointer to a to-be created pointer area for "environment" variables. Some callers of this
+ *        function set 'vars' to NULL, making dereferencing of this parameter undesired.
+ * varsz - pointer to int to return the size of the vars
+ */
+si_t *
+si_attach(uint devid, osl_t *osh, void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+	si_info_t *sii;
+	si_cores_info_t *cores_info;
+	/* alloc si_info_t */
+	if ((sii = MALLOCZ(osh, sizeof (si_info_t))) == NULL) {
+		SI_ERROR(("si_attach: malloc failed! malloced %d bytes\n", MALLOCED(osh)));
+		return (NULL);
+	}
+
+	/* alloc si_cores_info_t */
+	if ((cores_info = (si_cores_info_t *)MALLOCZ(osh, sizeof (si_cores_info_t))) == NULL) {
+		SI_ERROR(("si_attach: malloc failed! malloced %d bytes\n", MALLOCED(osh)));
+		MFREE(osh, sii, sizeof(si_info_t));
+		return (NULL);
+	}
+	sii->cores_info = cores_info;
+
+	if (si_doattach(sii, devid, osh, regs, bustype, sdh, vars, varsz) == NULL) {
+		MFREE(osh, sii, sizeof(si_info_t));
+		MFREE(osh, cores_info, sizeof(si_cores_info_t));
+		return (NULL);
+	}
+	sii->vars = vars ? *vars : NULL;
+	sii->varsz = varsz ? *varsz : 0;
+
+	return (si_t *)sii;
+}
+
+
+static uint32	wd_msticks;		/* watchdog timer ticks normalized to ms */
+
+/** generic kernel variant of si_attach() */
+si_t *
+si_kattach(osl_t *osh)
+{
+	static bool ksii_attached = FALSE;
+	si_cores_info_t *cores_info;
+
+	if (!ksii_attached) {
+		void *regs = NULL;
+		regs = REG_MAP(SI_ENUM_BASE, SI_CORE_SIZE);
+		cores_info = (si_cores_info_t *)&ksii_cores_info;
+		ksii.cores_info = cores_info;
+
+		ASSERT(osh);
+		if (si_doattach(&ksii, BCM4710_DEVICE_ID, osh, regs,
+		                SI_BUS, NULL,
+		                osh != SI_OSH ? &(ksii.vars) : NULL,
+		                osh != SI_OSH ? &(ksii.varsz) : NULL) == NULL) {
+			SI_ERROR(("si_kattach: si_doattach failed\n"));
+			REG_UNMAP(regs);
+			return NULL;
+		}
+		REG_UNMAP(regs);
+
+		/* save ticks normalized to ms for si_watchdog_ms() */
+		if (PMUCTL_ENAB(&ksii.pub)) {
+				/* based on 32KHz ILP clock */
+				wd_msticks = 32;
+		} else {
+			wd_msticks = ALP_CLOCK / 1000;
+		}
+
+		ksii_attached = TRUE;
+		SI_MSG(("si_kattach done. ccrev = %d, wd_msticks = %d\n",
+		        ksii.pub.ccrev, wd_msticks));
+	}
+
+	return &ksii.pub;
+}
+
+
+static bool
+si_buscore_prep(si_info_t *sii, uint bustype, uint devid, void *sdh)
+{
+	/* need to set memseg flag for CF card first before any sb registers access */
+	if (BUSTYPE(bustype) == PCMCIA_BUS)
+		sii->memseg = TRUE;
+
+
+#if defined(BCMSDIO)
+	if (BUSTYPE(bustype) == SDIO_BUS) {
+		int err;
+		uint8 clkset;
+
+		/* Try forcing SDIO core to do ALPAvail request only */
+		clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+		if (!err) {
+			uint8 clkval;
+
+			/* If register supported, wait for ALPAvail and then force ALP */
+			clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+			if ((clkval & ~SBSDIO_AVBITS) == clkset) {
+				SPINWAIT(((clkval = bcmsdh_cfg_read(sdh, SDIO_FUNC_1,
+					SBSDIO_FUNC1_CHIPCLKCSR, NULL)), !SBSDIO_ALPAV(clkval)),
+					PMU_MAX_TRANSITION_DLY);
+				if (!SBSDIO_ALPAV(clkval)) {
+					SI_ERROR(("timeout on ALPAV wait, clkval 0x%02x\n",
+						clkval));
+					return FALSE;
+				}
+				clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
+				bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_CHIPCLKCSR,
+					clkset, &err);
+				OSL_DELAY(65);
+			}
+		}
+
+		/* Also, disable the extra SDIO pull-ups */
+		bcmsdh_cfg_write(sdh, SDIO_FUNC_1, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+	}
+
+#endif /* BCMSDIO && BCMDONGLEHOST */
+
+	return TRUE;
+}
+
+static bool
+si_buscore_setup(si_info_t *sii, chipcregs_t *cc, uint bustype, uint32 savewin,
+	uint *origidx, void *regs)
+{
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	bool pci, pcie, pcie_gen2 = FALSE;
+	uint i;
+	uint pciidx, pcieidx, pcirev, pcierev;
+
+	cc = si_setcoreidx(&sii->pub, SI_CC_IDX);
+	ASSERT((uintptr)cc);
+
+	/* get chipcommon rev */
+	sii->pub.ccrev = (int)si_corerev(&sii->pub);
+
+	/* get chipcommon chipstatus */
+	if (sii->pub.ccrev >= 11)
+		sii->pub.chipst = R_REG(sii->osh, &cc->chipstatus);
+
+	/* get chipcommon capabilites */
+	sii->pub.cccaps = R_REG(sii->osh, &cc->capabilities);
+	/* get chipcommon extended capabilities */
+
+	if (sii->pub.ccrev >= 35)
+		sii->pub.cccaps_ext = R_REG(sii->osh, &cc->capabilities_ext);
+
+	/* get pmu rev and caps */
+	if (sii->pub.cccaps & CC_CAP_PMU) {
+		if (AOB_ENAB(&sii->pub)) {
+			uint pmucoreidx;
+			pmuregs_t *pmu;
+			pmucoreidx = si_findcoreidx(&sii->pub, PMU_CORE_ID, 0);
+			pmu = si_setcoreidx(&sii->pub, pmucoreidx);
+			sii->pub.pmucaps = R_REG(sii->osh, &pmu->pmucapabilities);
+			si_setcoreidx(&sii->pub, SI_CC_IDX);
+		} else
+			sii->pub.pmucaps = R_REG(sii->osh, &cc->pmucapabilities);
+
+		sii->pub.pmurev = sii->pub.pmucaps & PCAP_REV_MASK;
+	}
+
+	SI_MSG(("Chipc: rev %d, caps 0x%x, chipst 0x%x pmurev %d, pmucaps 0x%x\n",
+		sii->pub.ccrev, sii->pub.cccaps, sii->pub.chipst, sii->pub.pmurev,
+		sii->pub.pmucaps));
+
+	/* figure out bus/orignal core idx */
+	sii->pub.buscoretype = NODEV_CORE_ID;
+	sii->pub.buscorerev = (uint)NOREV;
+	sii->pub.buscoreidx = BADIDX;
+
+	pci = pcie = FALSE;
+	pcirev = pcierev = (uint)NOREV;
+	pciidx = pcieidx = BADIDX;
+
+	for (i = 0; i < sii->numcores; i++) {
+		uint cid, crev;
+
+		si_setcoreidx(&sii->pub, i);
+		cid = si_coreid(&sii->pub);
+		crev = si_corerev(&sii->pub);
+
+		/* Display cores found */
+		SI_VMSG(("CORE[%d]: id 0x%x rev %d base 0x%x regs 0x%p\n",
+		        i, cid, crev, cores_info->coresba[i], cores_info->regs[i]));
+
+		if (BUSTYPE(bustype) == SI_BUS) {
+			/* now look at the chipstatus register to figure the pacakge */
+			/* for SDIO but downloaded on PCIE dev */
+			if (cid == PCIE2_CORE_ID) {
+				if ((CHIPID(sii->pub.chip) == BCM43602_CHIP_ID) ||
+					((CHIPID(sii->pub.chip) == BCM4345_CHIP_ID) &&
+					CST4345_CHIPMODE_PCIE(sii->pub.chipst))) {
+					pcieidx = i;
+					pcierev = crev;
+					pcie = TRUE;
+					pcie_gen2 = TRUE;
+				}
+			}
+
+		}
+		else if (BUSTYPE(bustype) == PCI_BUS) {
+			if (cid == PCI_CORE_ID) {
+				pciidx = i;
+				pcirev = crev;
+				pci = TRUE;
+			} else if ((cid == PCIE_CORE_ID) || (cid == PCIE2_CORE_ID)) {
+				pcieidx = i;
+				pcierev = crev;
+				pcie = TRUE;
+				if (cid == PCIE2_CORE_ID)
+					pcie_gen2 = TRUE;
+			}
+		} else if ((BUSTYPE(bustype) == PCMCIA_BUS) &&
+		           (cid == PCMCIA_CORE_ID)) {
+			sii->pub.buscorerev = crev;
+			sii->pub.buscoretype = cid;
+			sii->pub.buscoreidx = i;
+		}
+#ifdef BCMSDIO
+		else if (((BUSTYPE(bustype) == SDIO_BUS) ||
+		          (BUSTYPE(bustype) == SPI_BUS)) &&
+		         ((cid == PCMCIA_CORE_ID) ||
+		          (cid == SDIOD_CORE_ID))) {
+			sii->pub.buscorerev = crev;
+			sii->pub.buscoretype = cid;
+			sii->pub.buscoreidx = i;
+		}
+#endif /* BCMSDIO */
+
+		/* find the core idx before entering this func. */
+		if ((savewin && (savewin == cores_info->coresba[i])) ||
+		    (regs == cores_info->regs[i]))
+			*origidx = i;
+	}
+
+#if defined(PCIE_FULL_DONGLE)
+	pci = FALSE;
+#endif
+	if (pci) {
+		sii->pub.buscoretype = PCI_CORE_ID;
+		sii->pub.buscorerev = pcirev;
+		sii->pub.buscoreidx = pciidx;
+	} else if (pcie) {
+		if (pcie_gen2)
+			sii->pub.buscoretype = PCIE2_CORE_ID;
+		else
+			sii->pub.buscoretype = PCIE_CORE_ID;
+		sii->pub.buscorerev = pcierev;
+		sii->pub.buscoreidx = pcieidx;
+	}
+
+	SI_VMSG(("Buscore id/type/rev %d/0x%x/%d\n", sii->pub.buscoreidx, sii->pub.buscoretype,
+	         sii->pub.buscorerev));
+
+	if (BUSTYPE(sii->pub.bustype) == SI_BUS && (CHIPID(sii->pub.chip) == BCM4712_CHIP_ID) &&
+	    (sii->pub.chippkg != BCM4712LARGE_PKG_ID) && (CHIPREV(sii->pub.chiprev) <= 3))
+		OR_REG(sii->osh, &cc->slow_clk_ctl, SCC_SS_XTAL);
+
+
+#if defined(BCMSDIO)
+	/* Make sure any on-chip ARM is off (in case strapping is wrong), or downloaded code was
+	 * already running.
+	 */
+	if ((BUSTYPE(bustype) == SDIO_BUS) || (BUSTYPE(bustype) == SPI_BUS)) {
+		if (si_setcore(&sii->pub, ARM7S_CORE_ID, 0) ||
+		    si_setcore(&sii->pub, ARMCM3_CORE_ID, 0))
+			si_core_disable(&sii->pub, 0);
+	}
+#endif /* BCMSDIO && BCMDONGLEHOST */
+
+	/* return to the original core */
+	si_setcoreidx(&sii->pub, *origidx);
+
+	return TRUE;
+}
+
+
+
+
+uint16
+si_chipid(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+
+	return (sii->chipnew) ? sii->chipnew : sih->chip;
+}
+
+static void
+si_chipid_fixup(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+
+	ASSERT(sii->chipnew == 0);
+	switch (sih->chip) {
+		case BCM43570_CHIP_ID:
+		case BCM4358_CHIP_ID:
+			sii->chipnew = sih->chip; /* save it */
+			sii->pub.chip = BCM43569_CHIP_ID; /* chip class */
+		break;
+		case BCM4356_CHIP_ID:
+			sii->chipnew = sih->chip; /* save it */
+			sii->pub.chip = BCM4354_CHIP_ID; /* chip class */
+		break;
+		default:
+		ASSERT(0);
+		break;
+	}
+}
+
+/**
+ * Allocate an si handle. This function may be called multiple times.
+ *
+ * vars - pointer to a to-be created pointer area for "environment" variables. Some callers of this
+ *        function set 'vars' to NULL.
+ */
+static si_info_t *
+si_doattach(si_info_t *sii, uint devid, osl_t *osh, void *regs,
+                       uint bustype, void *sdh, char **vars, uint *varsz)
+{
+	struct si_pub *sih = &sii->pub;
+	uint32 w, savewin;
+	chipcregs_t *cc;
+	char *pvars = NULL;
+	uint origidx;
+#if !defined(_CFEZ_) || defined(CFG_WL)
+#endif
+
+	ASSERT(GOODREGS(regs));
+
+	savewin = 0;
+
+	sih->buscoreidx = BADIDX;
+
+	sii->curmap = regs;
+	sii->sdh = sdh;
+	sii->osh = osh;
+
+
+	/* check to see if we are a si core mimic'ing a pci core */
+	if ((bustype == PCI_BUS) &&
+	    (OSL_PCI_READ_CONFIG(sii->osh, PCI_SPROM_CONTROL, sizeof(uint32)) == 0xffffffff)) {
+		SI_ERROR(("%s: incoming bus is PCI but it's a lie, switching to SI "
+		          "devid:0x%x\n", __FUNCTION__, devid));
+		bustype = SI_BUS;
+	}
+
+	/* find Chipcommon address */
+	if (bustype == PCI_BUS) {
+		savewin = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+		if (!GOODCOREADDR(savewin, SI_ENUM_BASE))
+			savewin = SI_ENUM_BASE;
+		OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, 4, SI_ENUM_BASE);
+		if (!regs)
+			return NULL;
+		cc = (chipcregs_t *)regs;
+#ifdef BCMSDIO
+	} else if ((bustype == SDIO_BUS) || (bustype == SPI_BUS)) {
+		cc = (chipcregs_t *)sii->curmap;
+#endif
+	} else {
+		cc = (chipcregs_t *)REG_MAP(SI_ENUM_BASE, SI_CORE_SIZE);
+	}
+
+	sih->bustype = bustype;
+	if (bustype != BUSTYPE(bustype)) {
+		SI_ERROR(("si_doattach: bus type %d does not match configured bus type %d\n",
+			bustype, BUSTYPE(bustype)));
+		return NULL;
+	}
+
+	/* bus/core/clk setup for register access */
+	if (!si_buscore_prep(sii, bustype, devid, sdh)) {
+		SI_ERROR(("si_doattach: si_core_clk_prep failed %d\n", bustype));
+		return NULL;
+	}
+
+	/* ChipID recognition.
+	*   We assume we can read chipid at offset 0 from the regs arg.
+	*   If we add other chiptypes (or if we need to support old sdio hosts w/o chipcommon),
+	*   some way of recognizing them needs to be added here.
+	*/
+	if (!cc) {
+		SI_ERROR(("%s: chipcommon register space is null \n", __FUNCTION__));
+		return NULL;
+	}
+#ifdef COSTOMER_HW4
+#ifdef CONFIG_MACH_UNIVERSAL5433
+	/* old revision check */
+	if (!check_rev()) {
+		/* abnormal link status */
+		if (!check_pcie_link_status()) {
+			printk("%s : PCIE LINK is abnormal status\n", __FUNCTION__);
+			return NULL;
+		}
+	}
+#endif /* CONFIG_MACH_UNIVERSAL5433 */
+#endif
+	w = R_REG(osh, &cc->chipid);
+	if ((w & 0xfffff) == 148277) w -= 65532;
+	sih->socitype = (w & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+	/* Might as wll fill in chip id rev & pkg */
+	sih->chip = w & CID_ID_MASK;
+	sih->chiprev = (w & CID_REV_MASK) >> CID_REV_SHIFT;
+	sih->chippkg = (w & CID_PKG_MASK) >> CID_PKG_SHIFT;
+
+#if defined(HW_OOB)
+	dhd_conf_set_hw_oob_intr(sdh, sih->chip);
+#endif
+
+	if ((sih->chip == BCM4358_CHIP_ID) ||
+		(sih->chip == BCM43570_CHIP_ID) ||
+		(sih->chip == BCM4358_CHIP_ID)) {
+		si_chipid_fixup(sih);
+	}
+
+	if ((CHIPID(sih->chip) == BCM4329_CHIP_ID) && (sih->chiprev == 0) &&
+		(sih->chippkg != BCM4329_289PIN_PKG_ID)) {
+		sih->chippkg = BCM4329_182PIN_PKG_ID;
+	}
+	sih->issim = IS_SIM(sih->chippkg);
+
+	/* scan for cores */
+	if (CHIPTYPE(sii->pub.socitype) == SOCI_SB) {
+		SI_MSG(("Found chip type SB (0x%08x)\n", w));
+		sb_scan(&sii->pub, regs, devid);
+	} else if ((CHIPTYPE(sii->pub.socitype) == SOCI_AI) ||
+		(CHIPTYPE(sii->pub.socitype) == SOCI_NAI)) {
+		if (CHIPTYPE(sii->pub.socitype) == SOCI_AI)
+			SI_MSG(("Found chip type AI (0x%08x)\n", w));
+		else
+			SI_MSG(("Found chip type NAI (0x%08x)\n", w));
+		/* pass chipc address instead of original core base */
+		ai_scan(&sii->pub, (void *)(uintptr)cc, devid);
+	} else if (CHIPTYPE(sii->pub.socitype) == SOCI_UBUS) {
+		SI_MSG(("Found chip type UBUS (0x%08x), chip id = 0x%4x\n", w, sih->chip));
+		/* pass chipc address instead of original core base */
+		ub_scan(&sii->pub, (void *)(uintptr)cc, devid);
+	} else {
+		SI_ERROR(("Found chip of unknown type (0x%08x)\n", w));
+		return NULL;
+	}
+	/* no cores found, bail out */
+	if (sii->numcores == 0) {
+		SI_ERROR(("si_doattach: could not find any cores\n"));
+		return NULL;
+	}
+	/* bus/core/clk setup */
+	origidx = SI_CC_IDX;
+	if (!si_buscore_setup(sii, cc, bustype, savewin, &origidx, regs)) {
+		SI_ERROR(("si_doattach: si_buscore_setup failed\n"));
+		goto exit;
+	}
+
+#if !defined(_CFEZ_) || defined(CFG_WL)
+	if (CHIPID(sih->chip) == BCM4322_CHIP_ID && (((sih->chipst & CST4322_SPROM_OTP_SEL_MASK)
+		>> CST4322_SPROM_OTP_SEL_SHIFT) == (CST4322_OTP_PRESENT |
+		CST4322_SPROM_PRESENT))) {
+		SI_ERROR(("%s: Invalid setting: both SPROM and OTP strapped.\n", __FUNCTION__));
+		return NULL;
+	}
+
+	/* assume current core is CC */
+	if ((sii->pub.ccrev == 0x25) && ((CHIPID(sih->chip) == BCM43236_CHIP_ID ||
+	                                  CHIPID(sih->chip) == BCM43235_CHIP_ID ||
+	                                  CHIPID(sih->chip) == BCM43234_CHIP_ID ||
+	                                  CHIPID(sih->chip) == BCM43238_CHIP_ID) &&
+	                                 (CHIPREV(sii->pub.chiprev) <= 2))) {
+
+		if ((cc->chipstatus & CST43236_BP_CLK) != 0) {
+			uint clkdiv;
+			clkdiv = R_REG(osh, &cc->clkdiv);
+			/* otp_clk_div is even number, 120/14 < 9mhz */
+			clkdiv = (clkdiv & ~CLKD_OTP) | (14 << CLKD_OTP_SHIFT);
+			W_REG(osh, &cc->clkdiv, clkdiv);
+			SI_ERROR(("%s: set clkdiv to %x\n", __FUNCTION__, clkdiv));
+		}
+		OSL_DELAY(10);
+	}
+
+	if (bustype == PCI_BUS) {
+
+	}
+#endif
+#ifdef BCM_SDRBL
+	/* 4360 rom bootloader in PCIE case, if the SDR is enabled, But preotection is
+	 * not turned on, then we want to hold arm in reset.
+	 * Bottomline: In sdrenable case, we allow arm to boot only when protection is
+	 * turned on.
+	 */
+	if (CHIP_HOSTIF_PCIE(&(sii->pub))) {
+		uint32 sflags = si_arm_sflags(&(sii->pub));
+
+		/* If SDR is enabled but protection is not turned on
+		* then we want to force arm to WFI.
+		*/
+		if ((sflags & (SISF_SDRENABLE | SISF_TCMPROT)) == SISF_SDRENABLE) {
+			disable_arm_irq();
+			while (1) {
+				hnd_cpu_wait(sih);
+			}
+		}
+	}
+#endif /* BCM_SDRBL */
+
+	pvars = NULL;
+	BCM_REFERENCE(pvars);
+
+
+
+		if (sii->pub.ccrev >= 20) {
+			uint32 gpiopullup = 0, gpiopulldown = 0;
+			cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+			ASSERT(cc != NULL);
+
+			/* 4314/43142 has pin muxing, don't clear gpio bits */
+			if ((CHIPID(sih->chip) == BCM4314_CHIP_ID) ||
+				(CHIPID(sih->chip) == BCM43142_CHIP_ID)) {
+				gpiopullup |= 0x402e0;
+				gpiopulldown |= 0x20500;
+			}
+
+			W_REG(osh, &cc->gpiopullup, gpiopullup);
+			W_REG(osh, &cc->gpiopulldown, gpiopulldown);
+			si_setcoreidx(sih, origidx);
+		}
+
+
+	/* clear any previous epidiag-induced target abort */
+	ASSERT(!si_taclear(sih, FALSE));
+
+
+#ifdef BOOTLOADER_CONSOLE_OUTPUT
+	/* Enable console prints */
+	si_muxenab(sii, 3);
+#endif
+
+	return (sii);
+
+exit:
+
+	return NULL;
+}
+
+/** may be called with core in reset */
+void
+si_detach(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint idx;
+
+
+	if (BUSTYPE(sih->bustype) == SI_BUS)
+		for (idx = 0; idx < SI_MAXCORES; idx++)
+			if (cores_info->regs[idx]) {
+				REG_UNMAP(cores_info->regs[idx]);
+				cores_info->regs[idx] = NULL;
+			}
+
+
+#if !defined(BCMBUSTYPE) || (BCMBUSTYPE == SI_BUS)
+	if (cores_info != &ksii_cores_info)
+#endif	/* !BCMBUSTYPE || (BCMBUSTYPE == SI_BUS) */
+		MFREE(sii->osh, cores_info, sizeof(si_cores_info_t));
+
+#if !defined(BCMBUSTYPE) || (BCMBUSTYPE == SI_BUS)
+	if (sii != &ksii)
+#endif	/* !BCMBUSTYPE || (BCMBUSTYPE == SI_BUS) */
+		MFREE(sii->osh, sii, sizeof(si_info_t));
+}
+
+void *
+si_osh(si_t *sih)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+	return sii->osh;
+}
+
+void
+si_setosh(si_t *sih, osl_t *osh)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+	if (sii->osh != NULL) {
+		SI_ERROR(("osh is already set....\n"));
+		ASSERT(!sii->osh);
+	}
+	sii->osh = osh;
+}
+
+/** register driver interrupt disabling and restoring callback functions */
+void
+si_register_intr_callback(si_t *sih, void *intrsoff_fn, void *intrsrestore_fn,
+                          void *intrsenabled_fn, void *intr_arg)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	sii->intr_arg = intr_arg;
+	sii->intrsoff_fn = (si_intrsoff_t)intrsoff_fn;
+	sii->intrsrestore_fn = (si_intrsrestore_t)intrsrestore_fn;
+	sii->intrsenabled_fn = (si_intrsenabled_t)intrsenabled_fn;
+	/* save current core id.  when this function called, the current core
+	 * must be the core which provides driver functions(il, et, wl, etc.)
+	 */
+	sii->dev_coreid = cores_info->coreid[sii->curidx];
+}
+
+void
+si_deregister_intr_callback(si_t *sih)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+	sii->intrsoff_fn = NULL;
+	sii->intrsrestore_fn = NULL;
+	sii->intrsenabled_fn = NULL;
+}
+
+uint
+si_intflag(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_intflag(sih);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return R_REG(sii->osh, ((uint32 *)(uintptr)
+			    (sii->oob_router + OOB_STATUSA)));
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+uint
+si_flag(si_t *sih)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_flag(sih);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_flag(sih);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_flag(sih);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+uint
+si_flag_alt(si_t *sih)
+{
+	if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_flag_alt(sih);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+void
+si_setint(si_t *sih, int siflag)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		sb_setint(sih, siflag);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		ai_setint(sih, siflag);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		ub_setint(sih, siflag);
+	else
+		ASSERT(0);
+}
+
+uint
+si_coreid(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	return cores_info->coreid[sii->curidx];
+}
+
+uint
+si_coreidx(si_t *sih)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+	return sii->curidx;
+}
+
+void *
+si_d11_switch_addrbase(si_t *sih, uint coreunit)
+{
+	return si_setcore(sih,  D11_CORE_ID, coreunit);
+}
+
+/** return the core-type instantiation # of the current core */
+uint
+si_coreunit(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint idx;
+	uint coreid;
+	uint coreunit;
+	uint i;
+
+	coreunit = 0;
+
+	idx = sii->curidx;
+
+	ASSERT(GOODREGS(sii->curmap));
+	coreid = si_coreid(sih);
+
+	/* count the cores of our type */
+	for (i = 0; i < idx; i++)
+		if (cores_info->coreid[i] == coreid)
+			coreunit++;
+
+	return (coreunit);
+}
+
+uint
+si_corevendor(si_t *sih)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_corevendor(sih);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_corevendor(sih);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_corevendor(sih);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+bool
+si_backplane64(si_t *sih)
+{
+	return ((sih->cccaps & CC_CAP_BKPLN64) != 0);
+}
+
+uint
+si_corerev(si_t *sih)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_corerev(sih);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_corerev(sih);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_corerev(sih);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+
+/* return index of coreid or BADIDX if not found */
+uint
+si_findcoreidx(si_t *sih, uint coreid, uint coreunit)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint found;
+	uint i;
+
+
+	found = 0;
+
+	for (i = 0; i < sii->numcores; i++)
+		if (cores_info->coreid[i] == coreid) {
+			if (found == coreunit)
+				return (i);
+			found++;
+		}
+
+	return (BADIDX);
+}
+
+/** return total coreunit of coreid or zero if not found */
+uint
+si_numcoreunits(si_t *sih, uint coreid)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint found = 0;
+	uint i;
+
+	for (i = 0; i < sii->numcores; i++) {
+		if (cores_info->coreid[i] == coreid) {
+			found++;
+		}
+	}
+
+	return found;
+}
+
+/** return total D11 coreunits */
+uint
+BCMRAMFN(si_numd11coreunits)(si_t *sih)
+{
+	uint found = 0;
+
+	found = si_numcoreunits(sih, D11_CORE_ID);
+
+#if defined(WLRSDB) && defined(WLRSDB_DISABLED)
+	/* If RSDB functionality is compiled out,
+	 * then ignore any D11 cores beyond the first
+	 * Used in norsdb dongle build variants for rsdb chip.
+	 */
+	found = 1;
+#endif /* defined(WLRSDB) && !defined(WLRSDB_DISABLED) */
+
+	return found;
+}
+
+/** return list of found cores */
+uint
+si_corelist(si_t *sih, uint coreid[])
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	bcopy((uchar*)cores_info->coreid, (uchar*)coreid, (sii->numcores * sizeof(uint)));
+	return (sii->numcores);
+}
+
+/** return current wrapper mapping */
+void *
+si_wrapperregs(si_t *sih)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+	ASSERT(GOODREGS(sii->curwrap));
+
+	return (sii->curwrap);
+}
+
+/** return current register mapping */
+void *
+si_coreregs(si_t *sih)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+	ASSERT(GOODREGS(sii->curmap));
+
+	return (sii->curmap);
+}
+
+/**
+ * This function changes logical "focus" to the indicated core;
+ * must be called with interrupts off.
+ * Moreover, callers should keep interrupts off during switching out of and back to d11 core
+ */
+void *
+si_setcore(si_t *sih, uint coreid, uint coreunit)
+{
+	uint idx;
+
+	idx = si_findcoreidx(sih, coreid, coreunit);
+	if (!GOODIDX(idx))
+		return (NULL);
+
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_setcoreidx(sih, idx);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_setcoreidx(sih, idx);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_setcoreidx(sih, idx);
+	else {
+		ASSERT(0);
+		return NULL;
+	}
+}
+
+void *
+si_setcoreidx(si_t *sih, uint coreidx)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_setcoreidx(sih, coreidx);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_setcoreidx(sih, coreidx);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_setcoreidx(sih, coreidx);
+	else {
+		ASSERT(0);
+		return NULL;
+	}
+}
+
+/** Turn off interrupt as required by sb_setcore, before switch core */
+void *
+si_switch_core(si_t *sih, uint coreid, uint *origidx, uint *intr_val)
+{
+	void *cc;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	if (SI_FAST(sii)) {
+		/* Overloading the origidx variable to remember the coreid,
+		 * this works because the core ids cannot be confused with
+		 * core indices.
+		 */
+		*origidx = coreid;
+		if (coreid == CC_CORE_ID)
+			return (void *)CCREGS_FAST(sii);
+		else if (coreid == sih->buscoretype)
+			return (void *)PCIEREGS(sii);
+	}
+	INTR_OFF(sii, *intr_val);
+	*origidx = sii->curidx;
+	cc = si_setcore(sih, coreid, 0);
+	ASSERT(cc != NULL);
+
+	return cc;
+}
+
+/* restore coreidx and restore interrupt */
+void
+si_restore_core(si_t *sih, uint coreid, uint intr_val)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	if (SI_FAST(sii) && ((coreid == CC_CORE_ID) || (coreid == sih->buscoretype)))
+		return;
+
+	si_setcoreidx(sih, coreid);
+	INTR_RESTORE(sii, intr_val);
+}
+
+int
+si_numaddrspaces(si_t *sih)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_numaddrspaces(sih);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_numaddrspaces(sih);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_numaddrspaces(sih);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+uint32
+si_addrspace(si_t *sih, uint asidx)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_addrspace(sih, asidx);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_addrspace(sih, asidx);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_addrspace(sih, asidx);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+uint32
+si_addrspacesize(si_t *sih, uint asidx)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_addrspacesize(sih, asidx);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_addrspacesize(sih, asidx);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_addrspacesize(sih, asidx);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+void
+si_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size)
+{
+	/* Only supported for SOCI_AI */
+	if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		ai_coreaddrspaceX(sih, asidx, addr, size);
+	else
+		*size = 0;
+}
+
+uint32
+si_core_cflags(si_t *sih, uint32 mask, uint32 val)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_core_cflags(sih, mask, val);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_core_cflags(sih, mask, val);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_core_cflags(sih, mask, val);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+void
+si_core_cflags_wo(si_t *sih, uint32 mask, uint32 val)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		sb_core_cflags_wo(sih, mask, val);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		ai_core_cflags_wo(sih, mask, val);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		ub_core_cflags_wo(sih, mask, val);
+	else
+		ASSERT(0);
+}
+
+uint32
+si_core_sflags(si_t *sih, uint32 mask, uint32 val)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_core_sflags(sih, mask, val);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_core_sflags(sih, mask, val);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_core_sflags(sih, mask, val);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+bool
+si_iscoreup(si_t *sih)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_iscoreup(sih);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_iscoreup(sih);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_iscoreup(sih);
+	else {
+		ASSERT(0);
+		return FALSE;
+	}
+}
+
+uint
+si_wrapperreg(si_t *sih, uint32 offset, uint32 mask, uint32 val)
+{
+	/* only for AI back plane chips */
+	if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return (ai_wrap_reg(sih, offset, mask, val));
+	return 0;
+}
+
+uint
+si_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_corereg(sih, coreidx, regoff, mask, val);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_corereg(sih, coreidx, regoff, mask, val);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		return ub_corereg(sih, coreidx, regoff, mask, val);
+	else {
+		ASSERT(0);
+		return 0;
+	}
+}
+
+/** ILP sensitive register access needs special treatment to avoid backplane stalls */
+bool si_pmu_is_ilp_sensitive(uint32 idx, uint regoff)
+{
+	if (idx == SI_CC_IDX) {
+		if (CHIPCREGS_ILP_SENSITIVE(regoff))
+			return TRUE;
+	} else if (PMUREGS_ILP_SENSITIVE(regoff)) {
+		return TRUE;
+	}
+
+	return FALSE;
+}
+
+/** 'idx' should refer either to the chipcommon core or the PMU core */
+uint
+si_pmu_corereg(si_t *sih, uint32 idx, uint regoff, uint mask, uint val)
+{
+	int pmustatus_offset;
+
+	/* prevent backplane stall on double write to 'ILP domain' registers in the PMU */
+	if (mask != 0 && sih->pmurev >= 22 &&
+	    si_pmu_is_ilp_sensitive(idx, regoff)) {
+		pmustatus_offset = AOB_ENAB(sih) ? OFFSETOF(pmuregs_t, pmustatus) :
+			OFFSETOF(chipcregs_t, pmustatus);
+
+		while (si_corereg(sih, idx, pmustatus_offset, 0, 0) & PST_SLOW_WR_PENDING)
+			{};
+	}
+
+	return si_corereg(sih, idx, regoff, mask, val);
+}
+
+/*
+ * If there is no need for fiddling with interrupts or core switches (typically silicon
+ * back plane registers, pci registers and chipcommon registers), this function
+ * returns the register offset on this core to a mapped address. This address can
+ * be used for W_REG/R_REG directly.
+ *
+ * For accessing registers that would need a core switch, this function will return
+ * NULL.
+ */
+uint32 *
+si_corereg_addr(si_t *sih, uint coreidx, uint regoff)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		return sb_corereg_addr(sih, coreidx, regoff);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		return ai_corereg_addr(sih, coreidx, regoff);
+	else {
+		return 0;
+	}
+}
+
+void
+si_core_disable(si_t *sih, uint32 bits)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		sb_core_disable(sih, bits);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		ai_core_disable(sih, bits);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		ub_core_disable(sih, bits);
+}
+
+void
+si_core_reset(si_t *sih, uint32 bits, uint32 resetbits)
+{
+	if (CHIPTYPE(sih->socitype) == SOCI_SB)
+		sb_core_reset(sih, bits, resetbits);
+	else if ((CHIPTYPE(sih->socitype) == SOCI_AI) || (CHIPTYPE(sih->socitype) == SOCI_NAI))
+		ai_core_reset(sih, bits, resetbits);
+	else if (CHIPTYPE(sih->socitype) == SOCI_UBUS)
+		ub_core_reset(sih, bits, resetbits);
+}
+
+/** Run bist on current core. Caller needs to take care of core-specific bist hazards */
+int
+si_corebist(si_t *sih)
+{
+	uint32 cflags;
+	int result = 0;
+
+	/* Read core control flags */
+	cflags = si_core_cflags(sih, 0, 0);
+
+	/* Set bist & fgc */
+	si_core_cflags(sih, ~0, (SICF_BIST_EN | SICF_FGC));
+
+	/* Wait for bist done */
+	SPINWAIT(((si_core_sflags(sih, 0, 0) & SISF_BIST_DONE) == 0), 100000);
+
+	if (si_core_sflags(sih, 0, 0) & SISF_BIST_ERROR)
+		result = BCME_ERROR;
+
+	/* Reset core control flags */
+	si_core_cflags(sih, 0xffff, cflags);
+
+	return result;
+}
+
+static uint32
+factor6(uint32 x)
+{
+	switch (x) {
+	case CC_F6_2:	return 2;
+	case CC_F6_3:	return 3;
+	case CC_F6_4:	return 4;
+	case CC_F6_5:	return 5;
+	case CC_F6_6:	return 6;
+	case CC_F6_7:	return 7;
+	default:	return 0;
+	}
+}
+
+/** calculate the speed the SI would run at given a set of clockcontrol values */
+uint32
+si_clock_rate(uint32 pll_type, uint32 n, uint32 m)
+{
+	uint32 n1, n2, clock, m1, m2, m3, mc;
+
+	n1 = n & CN_N1_MASK;
+	n2 = (n & CN_N2_MASK) >> CN_N2_SHIFT;
+
+	if (pll_type == PLL_TYPE6) {
+		if (m & CC_T6_MMASK)
+			return CC_T6_M1;
+		else
+			return CC_T6_M0;
+	} else if ((pll_type == PLL_TYPE1) ||
+	           (pll_type == PLL_TYPE3) ||
+	           (pll_type == PLL_TYPE4) ||
+	           (pll_type == PLL_TYPE7)) {
+		n1 = factor6(n1);
+		n2 += CC_F5_BIAS;
+	} else if (pll_type == PLL_TYPE2) {
+		n1 += CC_T2_BIAS;
+		n2 += CC_T2_BIAS;
+		ASSERT((n1 >= 2) && (n1 <= 7));
+		ASSERT((n2 >= 5) && (n2 <= 23));
+	} else if (pll_type == PLL_TYPE5) {
+		return (100000000);
+	} else
+		ASSERT(0);
+	/* PLL types 3 and 7 use BASE2 (25Mhz) */
+	if ((pll_type == PLL_TYPE3) ||
+	    (pll_type == PLL_TYPE7)) {
+		clock = CC_CLOCK_BASE2 * n1 * n2;
+	} else
+		clock = CC_CLOCK_BASE1 * n1 * n2;
+
+	if (clock == 0)
+		return 0;
+
+	m1 = m & CC_M1_MASK;
+	m2 = (m & CC_M2_MASK) >> CC_M2_SHIFT;
+	m3 = (m & CC_M3_MASK) >> CC_M3_SHIFT;
+	mc = (m & CC_MC_MASK) >> CC_MC_SHIFT;
+
+	if ((pll_type == PLL_TYPE1) ||
+	    (pll_type == PLL_TYPE3) ||
+	    (pll_type == PLL_TYPE4) ||
+	    (pll_type == PLL_TYPE7)) {
+		m1 = factor6(m1);
+		if ((pll_type == PLL_TYPE1) || (pll_type == PLL_TYPE3))
+			m2 += CC_F5_BIAS;
+		else
+			m2 = factor6(m2);
+		m3 = factor6(m3);
+
+		switch (mc) {
+		case CC_MC_BYPASS:	return (clock);
+		case CC_MC_M1:		return (clock / m1);
+		case CC_MC_M1M2:	return (clock / (m1 * m2));
+		case CC_MC_M1M2M3:	return (clock / (m1 * m2 * m3));
+		case CC_MC_M1M3:	return (clock / (m1 * m3));
+		default:		return (0);
+		}
+	} else {
+		ASSERT(pll_type == PLL_TYPE2);
+
+		m1 += CC_T2_BIAS;
+		m2 += CC_T2M2_BIAS;
+		m3 += CC_T2_BIAS;
+		ASSERT((m1 >= 2) && (m1 <= 7));
+		ASSERT((m2 >= 3) && (m2 <= 10));
+		ASSERT((m3 >= 2) && (m3 <= 7));
+
+		if ((mc & CC_T2MC_M1BYP) == 0)
+			clock /= m1;
+		if ((mc & CC_T2MC_M2BYP) == 0)
+			clock /= m2;
+		if ((mc & CC_T2MC_M3BYP) == 0)
+			clock /= m3;
+
+		return (clock);
+	}
+}
+
+/**
+ * Some chips could have multiple host interfaces, however only one will be active.
+ * For a given chip. Depending pkgopt and cc_chipst return the active host interface.
+ */
+uint
+si_chip_hostif(si_t *sih)
+{
+	uint hosti = 0;
+
+	switch (CHIPID(sih->chip)) {
+
+	case BCM43602_CHIP_ID:
+		hosti = CHIP_HOSTIF_PCIEMODE;
+		break;
+
+	case BCM4360_CHIP_ID:
+		/* chippkg bit-0 == 0 is PCIE only pkgs
+		 * chippkg bit-0 == 1 has both PCIE and USB cores enabled
+		 */
+		if ((sih->chippkg & 0x1) && (sih->chipst & CST4360_MODE_USB))
+			hosti = CHIP_HOSTIF_USBMODE;
+		else
+			hosti = CHIP_HOSTIF_PCIEMODE;
+
+		break;
+
+	case BCM4335_CHIP_ID:
+		/* TBD: like in 4360, do we need to check pkg? */
+		if (CST4335_CHIPMODE_USB20D(sih->chipst))
+			hosti = CHIP_HOSTIF_USBMODE;
+		else if (CST4335_CHIPMODE_SDIOD(sih->chipst))
+			hosti = CHIP_HOSTIF_SDIOMODE;
+		else
+			hosti = CHIP_HOSTIF_PCIEMODE;
+		break;
+
+	case BCM4345_CHIP_ID:
+		if (CST4345_CHIPMODE_USB20D(sih->chipst) || CST4345_CHIPMODE_HSIC(sih->chipst))
+			hosti = CHIP_HOSTIF_USBMODE;
+		else if (CST4345_CHIPMODE_SDIOD(sih->chipst))
+			hosti = CHIP_HOSTIF_SDIOMODE;
+		else if (CST4345_CHIPMODE_PCIE(sih->chipst))
+			hosti = CHIP_HOSTIF_PCIEMODE;
+		break;
+
+	case BCM4349_CHIP_GRPID:
+		if (CST4349_CHIPMODE_SDIOD(sih->chipst))
+			hosti = CHIP_HOSTIF_SDIOMODE;
+		else if (CST4349_CHIPMODE_PCIE(sih->chipst))
+			hosti = CHIP_HOSTIF_PCIEMODE;
+		break;
+
+	case BCM4350_CHIP_ID:
+	case BCM4354_CHIP_ID:
+	case BCM4356_CHIP_ID:
+	case BCM43556_CHIP_ID:
+	case BCM43558_CHIP_ID:
+	case BCM43566_CHIP_ID:
+	case BCM43568_CHIP_ID:
+	case BCM43569_CHIP_ID:
+	case BCM43570_CHIP_ID:
+	case BCM4358_CHIP_ID:
+		if (CST4350_CHIPMODE_USB20D(sih->chipst) ||
+		    CST4350_CHIPMODE_HSIC20D(sih->chipst) ||
+		    CST4350_CHIPMODE_USB30D(sih->chipst) ||
+		    CST4350_CHIPMODE_USB30D_WL(sih->chipst) ||
+		    CST4350_CHIPMODE_HSIC30D(sih->chipst))
+			hosti = CHIP_HOSTIF_USBMODE;
+		else if (CST4350_CHIPMODE_SDIOD(sih->chipst))
+			hosti = CHIP_HOSTIF_SDIOMODE;
+		else if (CST4350_CHIPMODE_PCIE(sih->chipst))
+			hosti = CHIP_HOSTIF_PCIEMODE;
+		break;
+
+	default:
+		break;
+	}
+
+	return hosti;
+}
+
+
+/** set chip watchdog reset timer to fire in 'ticks' */
+void
+si_watchdog(si_t *sih, uint ticks)
+{
+	uint nb, maxt;
+
+	if (PMUCTL_ENAB(sih)) {
+
+#if !defined(_CFEZ_) || defined(CFG_WL)
+		if ((CHIPID(sih->chip) == BCM4319_CHIP_ID) &&
+		    (CHIPREV(sih->chiprev) == 0) && (ticks != 0)) {
+			si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, clk_ctl_st), ~0, 0x2);
+			si_setcore(sih, USB20D_CORE_ID, 0);
+			si_core_disable(sih, 1);
+			si_setcore(sih, CC_CORE_ID, 0);
+		}
+#endif
+
+			nb = (sih->ccrev < 26) ? 16 : ((sih->ccrev >= 37) ? 32 : 24);
+		/* The mips compiler uses the sllv instruction,
+		 * so we specially handle the 32-bit case.
+		 */
+		if (nb == 32)
+			maxt = 0xffffffff;
+		else
+			maxt = ((1 << nb) - 1);
+
+		if (ticks == 1)
+			ticks = 2;
+		else if (ticks > maxt)
+			ticks = maxt;
+
+		pmu_corereg(sih, SI_CC_IDX, pmuwatchdog, ~0, ticks);
+	} else {
+		maxt = (1 << 28) - 1;
+		if (ticks > maxt)
+			ticks = maxt;
+
+		si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, watchdog), ~0, ticks);
+	}
+}
+
+/** trigger watchdog reset after ms milliseconds */
+void
+si_watchdog_ms(si_t *sih, uint32 ms)
+{
+	si_watchdog(sih, wd_msticks * ms);
+}
+
+uint32 si_watchdog_msticks(void)
+{
+	return wd_msticks;
+}
+
+bool
+si_taclear(si_t *sih, bool details)
+{
+	return FALSE;
+}
+
+
+
+/** return the slow clock source - LPO, XTAL, or PCI */
+static uint
+si_slowclk_src(si_info_t *sii)
+{
+	chipcregs_t *cc;
+
+	ASSERT(SI_FAST(sii) || si_coreid(&sii->pub) == CC_CORE_ID);
+
+	if (sii->pub.ccrev < 6) {
+		if ((BUSTYPE(sii->pub.bustype) == PCI_BUS) &&
+		    (OSL_PCI_READ_CONFIG(sii->osh, PCI_GPIO_OUT, sizeof(uint32)) &
+		     PCI_CFG_GPIO_SCS))
+			return (SCC_SS_PCI);
+		else
+			return (SCC_SS_XTAL);
+	} else if (sii->pub.ccrev < 10) {
+		cc = (chipcregs_t *)si_setcoreidx(&sii->pub, sii->curidx);
+		ASSERT(cc);
+		return (R_REG(sii->osh, &cc->slow_clk_ctl) & SCC_SS_MASK);
+	} else	/* Insta-clock */
+		return (SCC_SS_XTAL);
+}
+
+/** return the ILP (slowclock) min or max frequency */
+static uint
+si_slowclk_freq(si_info_t *sii, bool max_freq, chipcregs_t *cc)
+{
+	uint32 slowclk;
+	uint div;
+
+	ASSERT(SI_FAST(sii) || si_coreid(&sii->pub) == CC_CORE_ID);
+
+	/* shouldn't be here unless we've established the chip has dynamic clk control */
+	ASSERT(R_REG(sii->osh, &cc->capabilities) & CC_CAP_PWR_CTL);
+
+	slowclk = si_slowclk_src(sii);
+	if (sii->pub.ccrev < 6) {
+		if (slowclk == SCC_SS_PCI)
+			return (max_freq ? (PCIMAXFREQ / 64) : (PCIMINFREQ / 64));
+		else
+			return (max_freq ? (XTALMAXFREQ / 32) : (XTALMINFREQ / 32));
+	} else if (sii->pub.ccrev < 10) {
+		div = 4 *
+		        (((R_REG(sii->osh, &cc->slow_clk_ctl) & SCC_CD_MASK) >> SCC_CD_SHIFT) + 1);
+		if (slowclk == SCC_SS_LPO)
+			return (max_freq ? LPOMAXFREQ : LPOMINFREQ);
+		else if (slowclk == SCC_SS_XTAL)
+			return (max_freq ? (XTALMAXFREQ / div) : (XTALMINFREQ / div));
+		else if (slowclk == SCC_SS_PCI)
+			return (max_freq ? (PCIMAXFREQ / div) : (PCIMINFREQ / div));
+		else
+			ASSERT(0);
+	} else {
+		/* Chipc rev 10 is InstaClock */
+		div = R_REG(sii->osh, &cc->system_clk_ctl) >> SYCC_CD_SHIFT;
+		div = 4 * (div + 1);
+		return (max_freq ? XTALMAXFREQ : (XTALMINFREQ / div));
+	}
+	return (0);
+}
+
+static void
+si_clkctl_setdelay(si_info_t *sii, void *chipcregs)
+{
+	chipcregs_t *cc = (chipcregs_t *)chipcregs;
+	uint slowmaxfreq, pll_delay, slowclk;
+	uint pll_on_delay, fref_sel_delay;
+
+	pll_delay = PLL_DELAY;
+
+	/* If the slow clock is not sourced by the xtal then add the xtal_on_delay
+	 * since the xtal will also be powered down by dynamic clk control logic.
+	 */
+
+	slowclk = si_slowclk_src(sii);
+	if (slowclk != SCC_SS_XTAL)
+		pll_delay += XTAL_ON_DELAY;
+
+	/* Starting with 4318 it is ILP that is used for the delays */
+	slowmaxfreq = si_slowclk_freq(sii, (sii->pub.ccrev >= 10) ? FALSE : TRUE, cc);
+
+	pll_on_delay = ((slowmaxfreq * pll_delay) + 999999) / 1000000;
+	fref_sel_delay = ((slowmaxfreq * FREF_DELAY) + 999999) / 1000000;
+
+	W_REG(sii->osh, &cc->pll_on_delay, pll_on_delay);
+	W_REG(sii->osh, &cc->fref_sel_delay, fref_sel_delay);
+}
+
+/** initialize power control delay registers */
+void
+si_clkctl_init(si_t *sih)
+{
+	si_info_t *sii;
+	uint origidx = 0;
+	chipcregs_t *cc;
+	bool fast;
+
+	if (!CCCTL_ENAB(sih))
+		return;
+
+	sii = SI_INFO(sih);
+	fast = SI_FAST(sii);
+	if (!fast) {
+		origidx = sii->curidx;
+		if ((cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0)) == NULL)
+			return;
+	} else if ((cc = (chipcregs_t *)CCREGS_FAST(sii)) == NULL)
+		return;
+	ASSERT(cc != NULL);
+
+	/* set all Instaclk chip ILP to 1 MHz */
+	if (sih->ccrev >= 10)
+		SET_REG(sii->osh, &cc->system_clk_ctl, SYCC_CD_MASK,
+		        (ILP_DIV_1MHZ << SYCC_CD_SHIFT));
+
+	si_clkctl_setdelay(sii, (void *)(uintptr)cc);
+
+	OSL_DELAY(20000);
+
+	if (!fast)
+		si_setcoreidx(sih, origidx);
+}
+
+
+/** change logical "focus" to the gpio core for optimized access */
+void *
+si_gpiosetcore(si_t *sih)
+{
+	return (si_setcoreidx(sih, SI_CC_IDX));
+}
+
+/**
+ * mask & set gpiocontrol bits.
+ * If a gpiocontrol bit is set to 0, chipcommon controls the corresponding GPIO pin.
+ * If a gpiocontrol bit is set to 1, the GPIO pin is no longer a GPIO and becomes dedicated
+ *   to some chip-specific purpose.
+ */
+uint32
+si_gpiocontrol(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+	uint regoff;
+
+	regoff = 0;
+
+	/* gpios could be shared on router platforms
+	 * ignore reservation if it's high priority (e.g., test apps)
+	 */
+	if ((priority != GPIO_HI_PRIORITY) &&
+	    (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+		mask = priority ? (si_gpioreservation & mask) :
+			((si_gpioreservation | mask) & ~(si_gpioreservation));
+		val &= mask;
+	}
+
+	regoff = OFFSETOF(chipcregs_t, gpiocontrol);
+	return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** mask&set gpio output enable bits */
+uint32
+si_gpioouten(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+	uint regoff;
+
+	regoff = 0;
+
+	/* gpios could be shared on router platforms
+	 * ignore reservation if it's high priority (e.g., test apps)
+	 */
+	if ((priority != GPIO_HI_PRIORITY) &&
+	    (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+		mask = priority ? (si_gpioreservation & mask) :
+			((si_gpioreservation | mask) & ~(si_gpioreservation));
+		val &= mask;
+	}
+
+	regoff = OFFSETOF(chipcregs_t, gpioouten);
+	return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** mask&set gpio output bits */
+uint32
+si_gpioout(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+	uint regoff;
+
+	regoff = 0;
+
+	/* gpios could be shared on router platforms
+	 * ignore reservation if it's high priority (e.g., test apps)
+	 */
+	if ((priority != GPIO_HI_PRIORITY) &&
+	    (BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+		mask = priority ? (si_gpioreservation & mask) :
+			((si_gpioreservation | mask) & ~(si_gpioreservation));
+		val &= mask;
+	}
+
+	regoff = OFFSETOF(chipcregs_t, gpioout);
+	return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/** reserve one gpio */
+uint32
+si_gpioreserve(si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+	/* only cores on SI_BUS share GPIO's and only applcation users need to
+	 * reserve/release GPIO
+	 */
+	if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+		ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+		return 0xffffffff;
+	}
+	/* make sure only one bit is set */
+	if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+		ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+		return 0xffffffff;
+	}
+
+	/* already reserved */
+	if (si_gpioreservation & gpio_bitmask)
+		return 0xffffffff;
+	/* set reservation */
+	si_gpioreservation |= gpio_bitmask;
+
+	return si_gpioreservation;
+}
+
+/**
+ * release one gpio.
+ *
+ * releasing the gpio doesn't change the current value on the GPIO last write value
+ * persists till someone overwrites it.
+ */
+uint32
+si_gpiorelease(si_t *sih, uint32 gpio_bitmask, uint8 priority)
+{
+	/* only cores on SI_BUS share GPIO's and only applcation users need to
+	 * reserve/release GPIO
+	 */
+	if ((BUSTYPE(sih->bustype) != SI_BUS) || (!priority)) {
+		ASSERT((BUSTYPE(sih->bustype) == SI_BUS) && (priority));
+		return 0xffffffff;
+	}
+	/* make sure only one bit is set */
+	if ((!gpio_bitmask) || ((gpio_bitmask) & (gpio_bitmask - 1))) {
+		ASSERT((gpio_bitmask) && !((gpio_bitmask) & (gpio_bitmask - 1)));
+		return 0xffffffff;
+	}
+
+	/* already released */
+	if (!(si_gpioreservation & gpio_bitmask))
+		return 0xffffffff;
+
+	/* clear reservation */
+	si_gpioreservation &= ~gpio_bitmask;
+
+	return si_gpioreservation;
+}
+
+/* return the current gpioin register value */
+uint32
+si_gpioin(si_t *sih)
+{
+	uint regoff;
+
+	regoff = OFFSETOF(chipcregs_t, gpioin);
+	return (si_corereg(sih, SI_CC_IDX, regoff, 0, 0));
+}
+
+/* mask&set gpio interrupt polarity bits */
+uint32
+si_gpiointpolarity(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+	uint regoff;
+
+	/* gpios could be shared on router platforms */
+	if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+		mask = priority ? (si_gpioreservation & mask) :
+			((si_gpioreservation | mask) & ~(si_gpioreservation));
+		val &= mask;
+	}
+
+	regoff = OFFSETOF(chipcregs_t, gpiointpolarity);
+	return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* mask&set gpio interrupt mask bits */
+uint32
+si_gpiointmask(si_t *sih, uint32 mask, uint32 val, uint8 priority)
+{
+	uint regoff;
+
+	/* gpios could be shared on router platforms */
+	if ((BUSTYPE(sih->bustype) == SI_BUS) && (val || mask)) {
+		mask = priority ? (si_gpioreservation & mask) :
+			((si_gpioreservation | mask) & ~(si_gpioreservation));
+		val &= mask;
+	}
+
+	regoff = OFFSETOF(chipcregs_t, gpiointmask);
+	return (si_corereg(sih, SI_CC_IDX, regoff, mask, val));
+}
+
+/* assign the gpio to an led */
+uint32
+si_gpioled(si_t *sih, uint32 mask, uint32 val)
+{
+	if (sih->ccrev < 16)
+		return 0xffffffff;
+
+	/* gpio led powersave reg */
+	return (si_corereg(sih, SI_CC_IDX, OFFSETOF(chipcregs_t, gpiotimeroutmask), mask, val));
+}
+
+/* mask&set gpio timer val */
+uint32
+si_gpiotimerval(si_t *sih, uint32 mask, uint32 gpiotimerval)
+{
+	if (sih->ccrev < 16)
+		return 0xffffffff;
+
+	return (si_corereg(sih, SI_CC_IDX,
+		OFFSETOF(chipcregs_t, gpiotimerval), mask, gpiotimerval));
+}
+
+uint32
+si_gpiopull(si_t *sih, bool updown, uint32 mask, uint32 val)
+{
+	uint offs;
+
+	if (sih->ccrev < 20)
+		return 0xffffffff;
+
+	offs = (updown ? OFFSETOF(chipcregs_t, gpiopulldown) : OFFSETOF(chipcregs_t, gpiopullup));
+	return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+uint32
+si_gpioevent(si_t *sih, uint regtype, uint32 mask, uint32 val)
+{
+	uint offs;
+
+	if (sih->ccrev < 11)
+		return 0xffffffff;
+
+	if (regtype == GPIO_REGEVT)
+		offs = OFFSETOF(chipcregs_t, gpioevent);
+	else if (regtype == GPIO_REGEVT_INTMSK)
+		offs = OFFSETOF(chipcregs_t, gpioeventintmask);
+	else if (regtype == GPIO_REGEVT_INTPOL)
+		offs = OFFSETOF(chipcregs_t, gpioeventintpolarity);
+	else
+		return 0xffffffff;
+
+	return (si_corereg(sih, SI_CC_IDX, offs, mask, val));
+}
+
+void *
+si_gpio_handler_register(si_t *sih, uint32 event,
+	bool level, gpio_handler_t cb, void *arg)
+{
+	si_info_t *sii = SI_INFO(sih);
+	gpioh_item_t *gi;
+
+	ASSERT(event);
+	ASSERT(cb != NULL);
+
+	if (sih->ccrev < 11)
+		return NULL;
+
+	if ((gi = MALLOC(sii->osh, sizeof(gpioh_item_t))) == NULL)
+		return NULL;
+
+	bzero(gi, sizeof(gpioh_item_t));
+	gi->event = event;
+	gi->handler = cb;
+	gi->arg = arg;
+	gi->level = level;
+
+	gi->next = sii->gpioh_head;
+	sii->gpioh_head = gi;
+
+	return (void *)(gi);
+}
+
+void
+si_gpio_handler_unregister(si_t *sih, void *gpioh)
+{
+	si_info_t *sii = SI_INFO(sih);
+	gpioh_item_t *p, *n;
+
+	if (sih->ccrev < 11)
+		return;
+
+	ASSERT(sii->gpioh_head != NULL);
+	if ((void*)sii->gpioh_head == gpioh) {
+		sii->gpioh_head = sii->gpioh_head->next;
+		MFREE(sii->osh, gpioh, sizeof(gpioh_item_t));
+		return;
+	} else {
+		p = sii->gpioh_head;
+		n = p->next;
+		while (n) {
+			if ((void*)n == gpioh) {
+				p->next = n->next;
+				MFREE(sii->osh, gpioh, sizeof(gpioh_item_t));
+				return;
+			}
+			p = n;
+			n = n->next;
+		}
+	}
+
+	ASSERT(0); /* Not found in list */
+}
+
+void
+si_gpio_handler_process(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	gpioh_item_t *h;
+	uint32 level = si_gpioin(sih);
+	uint32 levelp = si_gpiointpolarity(sih, 0, 0, 0);
+	uint32 edge = si_gpioevent(sih, GPIO_REGEVT, 0, 0);
+	uint32 edgep = si_gpioevent(sih, GPIO_REGEVT_INTPOL, 0, 0);
+
+	for (h = sii->gpioh_head; h != NULL; h = h->next) {
+		if (h->handler) {
+			uint32 status = (h->level ? level : edge) & h->event;
+			uint32 polarity = (h->level ? levelp : edgep) & h->event;
+
+			/* polarity bitval is opposite of status bitval */
+			if ((h->level && (status ^ polarity)) || (!h->level && status))
+				h->handler(status, h->arg);
+		}
+	}
+
+	si_gpioevent(sih, GPIO_REGEVT, edge, edge); /* clear edge-trigger status */
+}
+
+uint32
+si_gpio_int_enable(si_t *sih, bool enable)
+{
+	uint offs;
+
+	if (sih->ccrev < 11)
+		return 0xffffffff;
+
+	offs = OFFSETOF(chipcregs_t, intmask);
+	return (si_corereg(sih, SI_CC_IDX, offs, CI_GPIO, (enable ? CI_GPIO : 0)));
+}
+
+
+/** Return the size of the specified SOCRAM bank */
+static uint
+socram_banksize(si_info_t *sii, sbsocramregs_t *regs, uint8 idx, uint8 mem_type)
+{
+	uint banksize, bankinfo;
+	uint bankidx = idx | (mem_type << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+
+	ASSERT(mem_type <= SOCRAM_MEMTYPE_DEVRAM);
+
+	W_REG(sii->osh, &regs->bankidx, bankidx);
+	bankinfo = R_REG(sii->osh, &regs->bankinfo);
+	banksize = SOCRAM_BANKINFO_SZBASE * ((bankinfo & SOCRAM_BANKINFO_SZMASK) + 1);
+	return banksize;
+}
+
+void si_socram_set_bankpda(si_t *sih, uint32 bankidx, uint32 bankpda)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	sbsocramregs_t *regs;
+	bool wasup;
+	uint corerev;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+
+	corerev = si_corerev(sih);
+	if (corerev >= 16) {
+		W_REG(sii->osh, &regs->bankidx, bankidx);
+		W_REG(sii->osh, &regs->bankpda, bankpda);
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+}
+
+void
+si_socdevram(si_t *sih, bool set, uint8 *enable, uint8 *protect, uint8 *remap)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	sbsocramregs_t *regs;
+	bool wasup;
+	uint corerev;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	if (!set)
+		*enable = *protect = *remap = 0;
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+
+	corerev = si_corerev(sih);
+	if (corerev >= 10) {
+		uint32 extcinfo;
+		uint8 nb;
+		uint8 i;
+		uint32 bankidx, bankinfo;
+
+		extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+		nb = ((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT);
+		for (i = 0; i < nb; i++) {
+			bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+			W_REG(sii->osh, &regs->bankidx, bankidx);
+			bankinfo = R_REG(sii->osh, &regs->bankinfo);
+			if (set) {
+				bankinfo &= ~SOCRAM_BANKINFO_DEVRAMSEL_MASK;
+				bankinfo &= ~SOCRAM_BANKINFO_DEVRAMPRO_MASK;
+				bankinfo &= ~SOCRAM_BANKINFO_DEVRAMREMAP_MASK;
+				if (*enable) {
+					bankinfo |= (1 << SOCRAM_BANKINFO_DEVRAMSEL_SHIFT);
+					if (*protect)
+						bankinfo |= (1 << SOCRAM_BANKINFO_DEVRAMPRO_SHIFT);
+					if ((corerev >= 16) && *remap)
+						bankinfo |=
+							(1 << SOCRAM_BANKINFO_DEVRAMREMAP_SHIFT);
+				}
+				W_REG(sii->osh, &regs->bankinfo, bankinfo);
+			}
+			else if (i == 0) {
+				if (bankinfo & SOCRAM_BANKINFO_DEVRAMSEL_MASK) {
+					*enable = 1;
+					if (bankinfo & SOCRAM_BANKINFO_DEVRAMPRO_MASK)
+						*protect = 1;
+					if (bankinfo & SOCRAM_BANKINFO_DEVRAMREMAP_MASK)
+						*remap = 1;
+				}
+			}
+		}
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+}
+
+bool
+si_socdevram_remap_isenb(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	sbsocramregs_t *regs;
+	bool wasup, remap = FALSE;
+	uint corerev;
+	uint32 extcinfo;
+	uint8 nb;
+	uint8 i;
+	uint32 bankidx, bankinfo;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+
+	corerev = si_corerev(sih);
+	if (corerev >= 16) {
+		extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+		nb = ((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT);
+		for (i = 0; i < nb; i++) {
+			bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+			W_REG(sii->osh, &regs->bankidx, bankidx);
+			bankinfo = R_REG(sii->osh, &regs->bankinfo);
+			if (bankinfo & SOCRAM_BANKINFO_DEVRAMREMAP_MASK) {
+				remap = TRUE;
+				break;
+			}
+		}
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+	return remap;
+}
+
+bool
+si_socdevram_pkg(si_t *sih)
+{
+	if (si_socdevram_size(sih) > 0)
+		return TRUE;
+	else
+		return FALSE;
+}
+
+uint32
+si_socdevram_size(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	uint32 memsize = 0;
+	sbsocramregs_t *regs;
+	bool wasup;
+	uint corerev;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+
+	corerev = si_corerev(sih);
+	if (corerev >= 10) {
+		uint32 extcinfo;
+		uint8 nb;
+		uint8 i;
+
+		extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+		nb = (((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT));
+		for (i = 0; i < nb; i++)
+			memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_DEVRAM);
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+
+	return memsize;
+}
+
+uint32
+si_socdevram_remap_size(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	uint32 memsize = 0, banksz;
+	sbsocramregs_t *regs;
+	bool wasup;
+	uint corerev;
+	uint32 extcinfo;
+	uint8 nb;
+	uint8 i;
+	uint32 bankidx, bankinfo;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+
+	corerev = si_corerev(sih);
+	if (corerev >= 16) {
+		extcinfo = R_REG(sii->osh, &regs->extracoreinfo);
+		nb = (((extcinfo & SOCRAM_DEVRAMBANK_MASK) >> SOCRAM_DEVRAMBANK_SHIFT));
+
+		/*
+		 * FIX: A0 Issue: Max addressable is 512KB, instead 640KB
+		 * Only four banks are accessible to ARM
+		 */
+		if ((corerev == 16) && (nb == 5))
+			nb = 4;
+
+		for (i = 0; i < nb; i++) {
+			bankidx = i | (SOCRAM_MEMTYPE_DEVRAM << SOCRAM_BANKIDX_MEMTYPE_SHIFT);
+			W_REG(sii->osh, &regs->bankidx, bankidx);
+			bankinfo = R_REG(sii->osh, &regs->bankinfo);
+			if (bankinfo & SOCRAM_BANKINFO_DEVRAMREMAP_MASK) {
+				banksz = socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_DEVRAM);
+				memsize += banksz;
+			} else {
+				/* Account only consecutive banks for now */
+				break;
+			}
+		}
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+
+	return memsize;
+}
+
+/** Return the RAM size of the SOCRAM core */
+uint32
+si_socram_size(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+
+	sbsocramregs_t *regs;
+	bool wasup;
+	uint corerev;
+	uint32 coreinfo;
+	uint memsize = 0;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+	corerev = si_corerev(sih);
+	coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+	/* Calculate size from coreinfo based on rev */
+	if (corerev == 0)
+		memsize = 1 << (16 + (coreinfo & SRCI_MS0_MASK));
+	else if (corerev < 3) {
+		memsize = 1 << (SR_BSZ_BASE + (coreinfo & SRCI_SRBSZ_MASK));
+		memsize *= (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+	} else if ((corerev <= 7) || (corerev == 12)) {
+		uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+		uint bsz = (coreinfo & SRCI_SRBSZ_MASK);
+		uint lss = (coreinfo & SRCI_LSS_MASK) >> SRCI_LSS_SHIFT;
+		if (lss != 0)
+			nb --;
+		memsize = nb * (1 << (bsz + SR_BSZ_BASE));
+		if (lss != 0)
+			memsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+	} else {
+		uint8 i;
+		uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+		for (i = 0; i < nb; i++)
+			memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+
+	return memsize;
+}
+
+
+/** Return the TCM-RAM size of the ARMCR4 core. */
+uint32
+si_tcm_size(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	uint8 *regs;
+	bool wasup;
+	uint32 corecap;
+	uint memsize = 0;
+	uint32 nab = 0;
+	uint32 nbb = 0;
+	uint32 totb = 0;
+	uint32 bxinfo = 0;
+	uint32 idx = 0;
+	uint32 *arm_cap_reg;
+	uint32 *arm_bidx;
+	uint32 *arm_binfo;
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to CR4 core */
+	if (!(regs = si_setcore(sih, ARMCR4_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size. If in reset, come out of reset,
+	 * but remain in halt
+	 */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, SICF_CPUHALT, SICF_CPUHALT);
+
+	arm_cap_reg = (uint32 *)(regs + SI_CR4_CAP);
+	corecap = R_REG(sii->osh, arm_cap_reg);
+
+	nab = (corecap & ARMCR4_TCBANB_MASK) >> ARMCR4_TCBANB_SHIFT;
+	nbb = (corecap & ARMCR4_TCBBNB_MASK) >> ARMCR4_TCBBNB_SHIFT;
+	totb = nab + nbb;
+
+	arm_bidx = (uint32 *)(regs + SI_CR4_BANKIDX);
+	arm_binfo = (uint32 *)(regs + SI_CR4_BANKINFO);
+	for (idx = 0; idx < totb; idx++) {
+		W_REG(sii->osh, arm_bidx, idx);
+
+		bxinfo = R_REG(sii->osh, arm_binfo);
+		memsize += ((bxinfo & ARMCR4_BSZ_MASK) + 1) * ARMCR4_BSZ_MULT;
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+
+	return memsize;
+}
+
+bool
+si_has_flops(si_t *sih)
+{
+	uint origidx, cr4_rev;
+
+	/* Find out CR4 core revision */
+	origidx = si_coreidx(sih);
+	if (si_setcore(sih, ARMCR4_CORE_ID, 0)) {
+		cr4_rev = si_corerev(sih);
+		si_setcoreidx(sih, origidx);
+
+		if (cr4_rev == 1 || cr4_rev >= 3)
+			return TRUE;
+	}
+	return FALSE;
+}
+
+uint32
+si_socram_srmem_size(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+
+	sbsocramregs_t *regs;
+	bool wasup;
+	uint corerev;
+	uint32 coreinfo;
+	uint memsize = 0;
+
+	if ((CHIPID(sih->chip) == BCM4334_CHIP_ID) && (CHIPREV(sih->chiprev) < 2)) {
+		return (32 * 1024);
+	}
+
+	if (CHIPID(sih->chip) == BCM43430_CHIP_ID) {
+		return (64 * 1024);
+	}
+
+	/* Block ints and save current core */
+	INTR_OFF(sii, intr_val);
+	origidx = si_coreidx(sih);
+
+	/* Switch to SOCRAM core */
+	if (!(regs = si_setcore(sih, SOCRAM_CORE_ID, 0)))
+		goto done;
+
+	/* Get info for determining size */
+	if (!(wasup = si_iscoreup(sih)))
+		si_core_reset(sih, 0, 0);
+	corerev = si_corerev(sih);
+	coreinfo = R_REG(sii->osh, &regs->coreinfo);
+
+	/* Calculate size from coreinfo based on rev */
+	if (corerev >= 16) {
+		uint8 i;
+		uint nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
+		for (i = 0; i < nb; i++) {
+			W_REG(sii->osh, &regs->bankidx, i);
+			if (R_REG(sii->osh, &regs->bankinfo) & SOCRAM_BANKINFO_RETNTRAM_MASK)
+				memsize += socram_banksize(sii, regs, i, SOCRAM_MEMTYPE_RAM);
+		}
+	}
+
+	/* Return to previous state and core */
+	if (!wasup)
+		si_core_disable(sih, 0);
+	si_setcoreidx(sih, origidx);
+
+done:
+	INTR_RESTORE(sii, intr_val);
+
+	return memsize;
+}
+
+
+#if !defined(_CFEZ_) || defined(CFG_WL)
+void
+si_btcgpiowar(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	uint origidx;
+	uint intr_val = 0;
+	chipcregs_t *cc;
+
+	/* Make sure that there is ChipCommon core present &&
+	 * UART_TX is strapped to 1
+	 */
+	if (!(sih->cccaps & CC_CAP_UARTGPIO))
+		return;
+
+	/* si_corereg cannot be used as we have to guarantee 8-bit read/writes */
+	INTR_OFF(sii, intr_val);
+
+	origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+	ASSERT(cc != NULL);
+
+	W_REG(sii->osh, &cc->uart0mcr, R_REG(sii->osh, &cc->uart0mcr) | 0x04);
+
+	/* restore the original index */
+	si_setcoreidx(sih, origidx);
+
+	INTR_RESTORE(sii, intr_val);
+}
+
+void
+si_chipcontrl_btshd0_4331(si_t *sih, bool on)
+{
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+	chipcregs_t *cc;
+	uint origidx;
+	uint32 val;
+	uint intr_val = 0;
+
+	INTR_OFF(sii, intr_val);
+
+	origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+
+	val = R_REG(sii->osh, &cc->chipcontrol);
+
+	/* bt_shd0 controls are same for 4331 chiprevs 0 and 1, packages 12x9 and 12x12 */
+	if (on) {
+		/* Enable bt_shd0 on gpio4: */
+		val |= (CCTRL4331_BT_SHD0_ON_GPIO4);
+		W_REG(sii->osh, &cc->chipcontrol, val);
+	} else {
+		val &= ~(CCTRL4331_BT_SHD0_ON_GPIO4);
+		W_REG(sii->osh, &cc->chipcontrol, val);
+	}
+
+	/* restore the original index */
+	si_setcoreidx(sih, origidx);
+
+	INTR_RESTORE(sii, intr_val);
+}
+
+void
+si_chipcontrl_restore(si_t *sih, uint32 val)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+	W_REG(sii->osh, &cc->chipcontrol, val);
+	si_setcoreidx(sih, origidx);
+}
+
+uint32
+si_chipcontrl_read(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+	uint32 val;
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+	val = R_REG(sii->osh, &cc->chipcontrol);
+	si_setcoreidx(sih, origidx);
+	return val;
+}
+
+void
+si_chipcontrl_epa4331(si_t *sih, bool on)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+	uint32 val;
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+	val = R_REG(sii->osh, &cc->chipcontrol);
+
+	if (on) {
+		if (sih->chippkg == 9 || sih->chippkg == 0xb) {
+			val |= (CCTRL4331_EXTPA_EN | CCTRL4331_EXTPA_ON_GPIO2_5);
+			/* Ext PA Controls for 4331 12x9 Package */
+			W_REG(sii->osh, &cc->chipcontrol, val);
+		} else {
+			/* Ext PA Controls for 4331 12x12 Package */
+			if (sih->chiprev > 0) {
+				W_REG(sii->osh, &cc->chipcontrol, val |
+				      (CCTRL4331_EXTPA_EN) | (CCTRL4331_EXTPA_EN2));
+			} else {
+				W_REG(sii->osh, &cc->chipcontrol, val | (CCTRL4331_EXTPA_EN));
+			}
+		}
+	} else {
+		val &= ~(CCTRL4331_EXTPA_EN | CCTRL4331_EXTPA_EN2 | CCTRL4331_EXTPA_ON_GPIO2_5);
+		W_REG(sii->osh, &cc->chipcontrol, val);
+	}
+
+	si_setcoreidx(sih, origidx);
+}
+
+/** switch muxed pins, on: SROM, off: FEMCTRL. Called for a family of ac chips, not just 4360. */
+void
+si_chipcontrl_srom4360(si_t *sih, bool on)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+	uint32 val;
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+	val = R_REG(sii->osh, &cc->chipcontrol);
+
+	if (on) {
+		val &= ~(CCTRL4360_SECI_MODE |
+			CCTRL4360_BTSWCTRL_MODE |
+			CCTRL4360_EXTRA_FEMCTRL_MODE |
+			CCTRL4360_BT_LGCY_MODE |
+			CCTRL4360_CORE2FEMCTRL4_ON);
+
+		W_REG(sii->osh, &cc->chipcontrol, val);
+	} else {
+	}
+
+	si_setcoreidx(sih, origidx);
+}
+
+void
+si_chipcontrl_epa4331_wowl(si_t *sih, bool enter_wowl)
+{
+	si_info_t *sii;
+	chipcregs_t *cc;
+	uint origidx;
+	uint32 val;
+	bool sel_chip;
+
+	sel_chip = (CHIPID(sih->chip) == BCM4331_CHIP_ID) ||
+		(CHIPID(sih->chip) == BCM43431_CHIP_ID);
+	sel_chip &= ((sih->chippkg == 9 || sih->chippkg == 0xb));
+
+	if (!sel_chip)
+		return;
+
+	sii = SI_INFO(sih);
+	origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+
+	val = R_REG(sii->osh, &cc->chipcontrol);
+
+	if (enter_wowl) {
+		val |= CCTRL4331_EXTPA_EN;
+		W_REG(sii->osh, &cc->chipcontrol, val);
+	} else {
+		val |= (CCTRL4331_EXTPA_EN | CCTRL4331_EXTPA_ON_GPIO2_5);
+		W_REG(sii->osh, &cc->chipcontrol, val);
+	}
+	si_setcoreidx(sih, origidx);
+}
+#endif
+
+uint
+si_pll_reset(si_t *sih)
+{
+	uint err = 0;
+
+	return (err);
+}
+
+/** Enable BT-COEX & Ex-PA for 4313 */
+void
+si_epa_4313war(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+
+	/* EPA Fix */
+	W_REG(sii->osh, &cc->gpiocontrol,
+	R_REG(sii->osh, &cc->gpiocontrol) | GPIO_CTRL_EPA_EN_MASK);
+
+	si_setcoreidx(sih, origidx);
+}
+
+void
+si_clk_pmu_htavail_set(si_t *sih, bool set_clear)
+{
+}
+
+/** Re-enable synth_pwrsw resource in min_res_mask for 4313 */
+void
+si_pmu_synth_pwrsw_4313_war(si_t *sih)
+{
+}
+
+/** WL/BT control for 4313 btcombo boards >= P250 */
+void
+si_btcombo_p250_4313_war(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+	W_REG(sii->osh, &cc->gpiocontrol,
+		R_REG(sii->osh, &cc->gpiocontrol) | GPIO_CTRL_5_6_EN_MASK);
+
+	W_REG(sii->osh, &cc->gpioouten,
+		R_REG(sii->osh, &cc->gpioouten) | GPIO_CTRL_5_6_EN_MASK);
+
+	si_setcoreidx(sih, origidx);
+}
+void
+si_btc_enable_chipcontrol(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+
+	/* BT fix */
+	W_REG(sii->osh, &cc->chipcontrol,
+		R_REG(sii->osh, &cc->chipcontrol) | CC_BTCOEX_EN_MASK);
+
+	si_setcoreidx(sih, origidx);
+}
+void
+si_btcombo_43228_war(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+
+	cc = (chipcregs_t *)si_setcore(sih, CC_CORE_ID, 0);
+
+	W_REG(sii->osh, &cc->gpioouten, GPIO_CTRL_7_6_EN_MASK);
+	W_REG(sii->osh, &cc->gpioout, GPIO_OUT_7_EN_MASK);
+
+	si_setcoreidx(sih, origidx);
+}
+
+/** check if the device is removed */
+bool
+si_deviceremoved(si_t *sih)
+{
+	uint32 w;
+
+	switch (BUSTYPE(sih->bustype)) {
+	case PCI_BUS:
+		ASSERT(SI_INFO(sih)->osh != NULL);
+		w = OSL_PCI_READ_CONFIG(SI_INFO(sih)->osh, PCI_CFG_VID, sizeof(uint32));
+		if ((w & 0xFFFF) != VENDOR_BROADCOM)
+			return TRUE;
+		break;
+	}
+	return FALSE;
+}
+
+bool
+si_is_sprom_available(si_t *sih)
+{
+	if (sih->ccrev >= 31) {
+		si_info_t *sii;
+		uint origidx;
+		chipcregs_t *cc;
+		uint32 sromctrl;
+
+		if ((sih->cccaps & CC_CAP_SROM) == 0)
+			return FALSE;
+
+		sii = SI_INFO(sih);
+		origidx = sii->curidx;
+		cc = si_setcoreidx(sih, SI_CC_IDX);
+		ASSERT(cc);
+		sromctrl = R_REG(sii->osh, &cc->sromcontrol);
+		si_setcoreidx(sih, origidx);
+		return (sromctrl & SRC_PRESENT);
+	}
+
+	switch (CHIPID(sih->chip)) {
+	case BCM4312_CHIP_ID:
+		return ((sih->chipst & CST4312_SPROM_OTP_SEL_MASK) != CST4312_OTP_SEL);
+	case BCM4325_CHIP_ID:
+		return (sih->chipst & CST4325_SPROM_SEL) != 0;
+	case BCM4322_CHIP_ID:	case BCM43221_CHIP_ID:	case BCM43231_CHIP_ID:
+	case BCM43222_CHIP_ID:	case BCM43111_CHIP_ID:	case BCM43112_CHIP_ID:
+	case BCM4342_CHIP_ID: {
+		uint32 spromotp;
+		spromotp = (sih->chipst & CST4322_SPROM_OTP_SEL_MASK) >>
+		        CST4322_SPROM_OTP_SEL_SHIFT;
+		return (spromotp & CST4322_SPROM_PRESENT) != 0;
+	}
+	case BCM4329_CHIP_ID:
+		return (sih->chipst & CST4329_SPROM_SEL) != 0;
+	case BCM4315_CHIP_ID:
+		return (sih->chipst & CST4315_SPROM_SEL) != 0;
+	case BCM4319_CHIP_ID:
+		return (sih->chipst & CST4319_SPROM_SEL) != 0;
+	case BCM4336_CHIP_ID:
+	case BCM43362_CHIP_ID:
+		return (sih->chipst & CST4336_SPROM_PRESENT) != 0;
+	case BCM4330_CHIP_ID:
+		return (sih->chipst & CST4330_SPROM_PRESENT) != 0;
+	case BCM4313_CHIP_ID:
+		return (sih->chipst & CST4313_SPROM_PRESENT) != 0;
+	case BCM4331_CHIP_ID:
+	case BCM43431_CHIP_ID:
+		return (sih->chipst & CST4331_SPROM_PRESENT) != 0;
+	case BCM43239_CHIP_ID:
+		return ((sih->chipst & CST43239_SPROM_MASK) &&
+			!(sih->chipst & CST43239_SFLASH_MASK));
+	case BCM4324_CHIP_ID:
+	case BCM43242_CHIP_ID:
+		return ((sih->chipst & CST4324_SPROM_MASK) &&
+			!(sih->chipst & CST4324_SFLASH_MASK));
+	case BCM4335_CHIP_ID:
+	case BCM4345_CHIP_ID:
+		return ((sih->chipst & CST4335_SPROM_MASK) &&
+			!(sih->chipst & CST4335_SFLASH_MASK));
+	case BCM4349_CHIP_GRPID:
+		return (sih->chipst & CST4349_SPROM_PRESENT) != 0;
+		break;
+	case BCM4350_CHIP_ID:
+	case BCM4354_CHIP_ID:
+	case BCM4356_CHIP_ID:
+	case BCM43556_CHIP_ID:
+	case BCM43558_CHIP_ID:
+	case BCM43566_CHIP_ID:
+	case BCM43568_CHIP_ID:
+	case BCM43569_CHIP_ID:
+	case BCM43570_CHIP_ID:
+	case BCM4358_CHIP_ID:
+		return (sih->chipst & CST4350_SPROM_PRESENT) != 0;
+	case BCM43602_CHIP_ID:
+		return (sih->chipst & CST43602_SPROM_PRESENT) != 0;
+	case BCM43131_CHIP_ID:
+	case BCM43217_CHIP_ID:
+	case BCM43227_CHIP_ID:
+	case BCM43228_CHIP_ID:
+	case BCM43428_CHIP_ID:
+		return (sih->chipst & CST43228_OTP_PRESENT) != CST43228_OTP_PRESENT;
+	default:
+		return TRUE;
+	}
+}
+
+
+uint32 si_get_sromctl(si_t *sih)
+{
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+	uint32 sromctl;
+	osl_t *osh = si_osh(sih);
+
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT((uintptr)cc);
+
+	sromctl = R_REG(osh, &cc->sromcontrol);
+
+	/* return to the original core */
+	si_setcoreidx(sih, origidx);
+	return sromctl;
+}
+
+int si_set_sromctl(si_t *sih, uint32 value)
+{
+	chipcregs_t *cc;
+	uint origidx = si_coreidx(sih);
+	osl_t *osh = si_osh(sih);
+
+	cc = si_setcoreidx(sih, SI_CC_IDX);
+	ASSERT((uintptr)cc);
+
+	/* get chipcommon rev */
+	if (si_corerev(sih) < 32)
+		return BCME_UNSUPPORTED;
+
+	W_REG(osh, &cc->sromcontrol, value);
+
+	/* return to the original core */
+	si_setcoreidx(sih, origidx);
+	return BCME_OK;
+
+}
+
+uint
+si_core_wrapperreg(si_t *sih, uint32 coreidx, uint32 offset, uint32 mask, uint32 val)
+{
+	uint origidx, intr_val = 0;
+	uint ret_val;
+	si_info_t *sii = SI_INFO(sih);
+	si_cores_info_t *cores_info = (si_cores_info_t *)sii->cores_info;
+
+	origidx = si_coreidx(sih);
+
+	INTR_OFF(sii, intr_val);
+	si_setcoreidx(sih, coreidx);
+
+	ret_val = si_wrapperreg(sih, offset, mask, val);
+
+	/* return to the original core */
+	si_setcoreidx(sih, origidx);
+	INTR_RESTORE(sii, intr_val);
+	return ret_val;
+}
+
+
+/* cleanup the timer from the host when ARM is been halted
+ * without a chance for ARM cleanup its resources
+ * If left not cleanup, Intr from a software timer can still
+ * request HT clk when ARM is halted.
+ */
+uint32
+si_pmu_res_req_timer_clr(si_t *sih)
+{
+	uint32 mask;
+
+	mask = PRRT_REQ_ACTIVE | PRRT_INTEN | PRRT_HT_REQ;
+	if (CHIPID(sih->chip) != BCM4328_CHIP_ID)
+		mask <<= 14;
+	/* clear mask bits */
+	pmu_corereg(sih, SI_CC_IDX, res_req_timer, mask, 0);
+	/* readback to ensure write completes */
+	return pmu_corereg(sih, SI_CC_IDX, res_req_timer, 0, 0);
+}
+
+/** turn on/off rfldo */
+void
+si_pmu_rfldo(si_t *sih, bool on)
+{
+}
+
+
+#ifdef SURVIVE_PERST_ENAB
+static uint32
+si_pcie_survive_perst(si_t *sih, uint32 mask, uint32 val)
+{
+	si_info_t *sii;
+
+	sii = SI_INFO(sih);
+
+	if (!PCIE(sii))
+		return (0);
+
+	return pcie_survive_perst(sii->pch, mask, val);
+}
+
+static void
+si_watchdog_reset(si_t *sih)
+{
+	si_info_t *sii = SI_INFO(sih);
+	uint32 i;
+
+	/* issue a watchdog reset */
+	pmu_corereg(sih, SI_CC_IDX, pmuwatchdog, 2, 2);
+	/* do busy wait for 20ms */
+	for (i = 0; i < 2000; i++) {
+		OSL_DELAY(10);
+	}
+}
+#endif /* SURVIVE_PERST_ENAB */
+
+void
+si_survive_perst_war(si_t *sih, bool reset, uint32 sperst_mask, uint32 sperst_val)
+{
+#ifdef SURVIVE_PERST_ENAB
+	if (BUSTYPE(sih->bustype) != PCI_BUS)
+		  return;
+
+	if ((CHIPID(sih->chip) != BCM4360_CHIP_ID && CHIPID(sih->chip) != BCM4352_CHIP_ID) ||
+	    (CHIPREV(sih->chiprev) >= 4))
+		return;
+
+	if (reset) {
+		si_info_t *sii = SI_INFO(sih);
+		uint32 bar0win, bar0win_after;
+
+		/* save the bar0win */
+		bar0win = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+
+		si_watchdog_reset(sih);
+
+		bar0win_after = OSL_PCI_READ_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32));
+		if (bar0win_after != bar0win) {
+			SI_ERROR(("%s: bar0win before %08x, bar0win after %08x\n",
+				__FUNCTION__, bar0win, bar0win_after));
+			OSL_PCI_WRITE_CONFIG(sii->osh, PCI_BAR0_WIN, sizeof(uint32), bar0win);
+		}
+	}
+	if (sperst_mask) {
+		/* enable survive perst */
+		si_pcie_survive_perst(sih, sperst_mask, sperst_val);
+	}
+#endif /* SURVIVE_PERST_ENAB */
+}
+
+void
+si_pcie_ltr_war(si_t *sih)
+{
+}
+
+void
+si_pcie_hw_LTR_war(si_t *sih)
+{
+}
+
+void
+si_pciedev_reg_pm_clk_period(si_t *sih)
+{
+}
+
+void
+si_pciedev_crwlpciegen2(si_t *sih)
+{
+}
+
+void
+si_pcie_prep_D3(si_t *sih, bool enter_D3)
+{
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/siutils_priv.h b/drivers/net/wireless/bcm4336/siutils_priv.h
--- a/drivers/net/wireless/bcm4336/siutils_priv.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/siutils_priv.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,265 @@
+/*
+ * Include file private to the SOC Interconnect support files.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: siutils_priv.h 474902 2014-05-02 18:31:33Z $
+ */
+
+#ifndef	_siutils_priv_h_
+#define	_siutils_priv_h_
+
+#define	SI_ERROR(args) printf args
+
+#define	SI_MSG(args)
+
+#ifdef BCMDBG_SI
+#define	SI_VMSG(args)	printf args
+#else
+#define	SI_VMSG(args)
+#endif
+
+#define	IS_SIM(chippkg)	((chippkg == HDLSIM_PKG_ID) || (chippkg == HWSIM_PKG_ID))
+
+typedef uint32 (*si_intrsoff_t)(void *intr_arg);
+typedef void (*si_intrsrestore_t)(void *intr_arg, uint32 arg);
+typedef bool (*si_intrsenabled_t)(void *intr_arg);
+
+typedef struct gpioh_item {
+	void			*arg;
+	bool			level;
+	gpio_handler_t		handler;
+	uint32			event;
+	struct gpioh_item	*next;
+} gpioh_item_t;
+
+
+#define SI_GPIO_MAX		16
+
+typedef struct gci_gpio_item {
+	void			*arg;
+	uint8			gci_gpio;
+	uint8			status;
+	gci_gpio_handler_t	handler;
+	struct gci_gpio_item	*next;
+} gci_gpio_item_t;
+
+
+typedef struct si_cores_info {
+	void	*regs[SI_MAXCORES];	/* other regs va */
+
+	uint	coreid[SI_MAXCORES];	/* id of each core */
+	uint32	coresba[SI_MAXCORES];	/* backplane address of each core */
+	void	*regs2[SI_MAXCORES];	/* va of each core second register set (usbh20) */
+	uint32	coresba2[SI_MAXCORES];	/* address of each core second register set (usbh20) */
+	uint32	coresba_size[SI_MAXCORES]; /* backplane address space size */
+	uint32	coresba2_size[SI_MAXCORES]; /* second address space size */
+
+	void	*wrappers[SI_MAXCORES];	/* other cores wrapper va */
+	uint32	wrapba[SI_MAXCORES];	/* address of controlling wrapper */
+
+	uint32	cia[SI_MAXCORES];	/* erom cia entry for each core */
+	uint32	cib[SI_MAXCORES];	/* erom cia entry for each core */
+} si_cores_info_t;
+
+/* misc si info needed by some of the routines */
+typedef struct si_info {
+	struct si_pub pub;		/* back plane public state (must be first field) */
+
+	void	*osh;			/* osl os handle */
+	void	*sdh;			/* bcmsdh handle */
+
+	uint	dev_coreid;		/* the core provides driver functions */
+	void	*intr_arg;		/* interrupt callback function arg */
+	si_intrsoff_t intrsoff_fn;	/* turns chip interrupts off */
+	si_intrsrestore_t intrsrestore_fn; /* restore chip interrupts */
+	si_intrsenabled_t intrsenabled_fn; /* check if interrupts are enabled */
+
+	void *pch;			/* PCI/E core handle */
+
+	gpioh_item_t *gpioh_head; 	/* GPIO event handlers list */
+
+	bool	memseg;			/* flag to toggle MEM_SEG register */
+
+	char *vars;
+	uint varsz;
+
+	void	*curmap;		/* current regs va */
+
+	uint	curidx;			/* current core index */
+	uint	numcores;		/* # discovered cores */
+
+	void	*curwrap;		/* current wrapper va */
+
+	uint32	oob_router;		/* oob router registers for axi */
+
+	void *cores_info;
+	gci_gpio_item_t	*gci_gpio_head;	/* gci gpio interrupts head */
+	uint	chipnew;		/* new chip number */
+} si_info_t;
+
+
+#define	SI_INFO(sih)	((si_info_t *)(uintptr)sih)
+
+#define	GOODCOREADDR(x, b) (((x) >= (b)) && ((x) < ((b) + SI_MAXCORES * SI_CORE_SIZE)) && \
+		ISALIGNED((x), SI_CORE_SIZE))
+#define	GOODREGS(regs)	((regs) != NULL && ISALIGNED((uintptr)(regs), SI_CORE_SIZE))
+#define BADCOREADDR	0
+#define	GOODIDX(idx)	(((uint)idx) < SI_MAXCORES)
+#define	NOREV		-1		/* Invalid rev */
+
+#define PCI(si)		((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&	\
+			 ((si)->pub.buscoretype == PCI_CORE_ID))
+
+#define PCIE_GEN1(si)	((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&	\
+			 ((si)->pub.buscoretype == PCIE_CORE_ID))
+
+#define PCIE_GEN2(si)	((BUSTYPE((si)->pub.bustype) == PCI_BUS) &&	\
+			 ((si)->pub.buscoretype == PCIE2_CORE_ID))
+
+#define PCIE(si)	(PCIE_GEN1(si) || PCIE_GEN2(si))
+
+#define PCMCIA(si)	((BUSTYPE((si)->pub.bustype) == PCMCIA_BUS) && ((si)->memseg == TRUE))
+
+/* Newer chips can access PCI/PCIE and CC core without requiring to change
+ * PCI BAR0 WIN
+ */
+#define SI_FAST(si) (PCIE(si) || (PCI(si) && ((si)->pub.buscorerev >= 13)))
+
+#define PCIEREGS(si) (((char *)((si)->curmap) + PCI_16KB0_PCIREGS_OFFSET))
+#define CCREGS_FAST(si) (((char *)((si)->curmap) + PCI_16KB0_CCREGS_OFFSET))
+
+/*
+ * Macros to disable/restore function core(D11, ENET, ILINE20, etc) interrupts before/
+ * after core switching to avoid invalid register accesss inside ISR.
+ */
+#define INTR_OFF(si, intr_val) \
+	if ((si)->intrsoff_fn && (cores_info)->coreid[(si)->curidx] == (si)->dev_coreid) {	\
+		intr_val = (*(si)->intrsoff_fn)((si)->intr_arg); }
+#define INTR_RESTORE(si, intr_val) \
+	if ((si)->intrsrestore_fn && (cores_info)->coreid[(si)->curidx] == (si)->dev_coreid) {	\
+		(*(si)->intrsrestore_fn)((si)->intr_arg, intr_val); }
+
+/* dynamic clock control defines */
+#define	LPOMINFREQ		25000		/* low power oscillator min */
+#define	LPOMAXFREQ		43000		/* low power oscillator max */
+#define	XTALMINFREQ		19800000	/* 20 MHz - 1% */
+#define	XTALMAXFREQ		20200000	/* 20 MHz + 1% */
+#define	PCIMINFREQ		25000000	/* 25 MHz */
+#define	PCIMAXFREQ		34000000	/* 33 MHz + fudge */
+
+#define	ILP_DIV_5MHZ		0		/* ILP = 5 MHz */
+#define	ILP_DIV_1MHZ		4		/* ILP = 1 MHz */
+
+/* Force fast clock for 4360b0 */
+#define PCI_FORCEHT(si)	\
+	(((PCIE_GEN1(si)) && (si->pub.chip == BCM4311_CHIP_ID) && ((si->pub.chiprev <= 1))) || \
+	((PCI(si) || PCIE_GEN1(si)) && (si->pub.chip == BCM4321_CHIP_ID)) || \
+	(PCIE_GEN1(si) && (si->pub.chip == BCM4716_CHIP_ID)) || \
+	(PCIE_GEN1(si) && (si->pub.chip == BCM4748_CHIP_ID)))
+
+/* GPIO Based LED powersave defines */
+#define DEFAULT_GPIO_ONTIME	10		/* Default: 10% on */
+#define DEFAULT_GPIO_OFFTIME	90		/* Default: 10% on */
+
+#ifndef DEFAULT_GPIOTIMERVAL
+#define DEFAULT_GPIOTIMERVAL  ((DEFAULT_GPIO_ONTIME << GPIO_ONTIME_SHIFT) | DEFAULT_GPIO_OFFTIME)
+#endif
+
+/* Silicon Backplane externs */
+extern void sb_scan(si_t *sih, void *regs, uint devid);
+extern uint sb_coreid(si_t *sih);
+extern uint sb_intflag(si_t *sih);
+extern uint sb_flag(si_t *sih);
+extern void sb_setint(si_t *sih, int siflag);
+extern uint sb_corevendor(si_t *sih);
+extern uint sb_corerev(si_t *sih);
+extern uint sb_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern uint32 *sb_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern bool sb_iscoreup(si_t *sih);
+extern void *sb_setcoreidx(si_t *sih, uint coreidx);
+extern uint32 sb_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void sb_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 sb_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern void sb_commit(si_t *sih);
+extern uint32 sb_base(uint32 admatch);
+extern uint32 sb_size(uint32 admatch);
+extern void sb_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void sb_core_disable(si_t *sih, uint32 bits);
+extern uint32 sb_addrspace(si_t *sih, uint asidx);
+extern uint32 sb_addrspacesize(si_t *sih, uint asidx);
+extern int sb_numaddrspaces(si_t *sih);
+
+extern uint32 sb_set_initiator_to(si_t *sih, uint32 to, uint idx);
+
+extern bool sb_taclear(si_t *sih, bool details);
+
+#if defined(BCMDBG_PHYDUMP)
+extern void sb_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif
+
+/* Wake-on-wireless-LAN (WOWL) */
+extern bool sb_pci_pmecap(si_t *sih);
+struct osl_info;
+extern bool sb_pci_fastpmecap(struct osl_info *osh);
+extern bool sb_pci_pmeclr(si_t *sih);
+extern void sb_pci_pmeen(si_t *sih);
+extern uint sb_pcie_readreg(void *sih, uint addrtype, uint offset);
+
+/* AMBA Interconnect exported externs */
+extern si_t *ai_attach(uint pcidev, osl_t *osh, void *regs, uint bustype,
+                       void *sdh, char **vars, uint *varsz);
+extern si_t *ai_kattach(osl_t *osh);
+extern void ai_scan(si_t *sih, void *regs, uint devid);
+
+extern uint ai_flag(si_t *sih);
+extern uint ai_flag_alt(si_t *sih);
+extern void ai_setint(si_t *sih, int siflag);
+extern uint ai_coreidx(si_t *sih);
+extern uint ai_corevendor(si_t *sih);
+extern uint ai_corerev(si_t *sih);
+extern uint32 *ai_corereg_addr(si_t *sih, uint coreidx, uint regoff);
+extern bool ai_iscoreup(si_t *sih);
+extern void *ai_setcoreidx(si_t *sih, uint coreidx);
+extern uint32 ai_core_cflags(si_t *sih, uint32 mask, uint32 val);
+extern void ai_core_cflags_wo(si_t *sih, uint32 mask, uint32 val);
+extern uint32 ai_core_sflags(si_t *sih, uint32 mask, uint32 val);
+extern uint ai_corereg(si_t *sih, uint coreidx, uint regoff, uint mask, uint val);
+extern void ai_core_reset(si_t *sih, uint32 bits, uint32 resetbits);
+extern void ai_d11rsdb_core_reset(si_t *sih, uint32 bits,
+	uint32 resetbits, void *p, void *s);
+extern void ai_core_disable(si_t *sih, uint32 bits);
+extern void ai_d11rsdb_core_disable(const si_info_t *sii, uint32 bits,
+	aidmp_t *pmacai, aidmp_t *smacai);
+extern int ai_numaddrspaces(si_t *sih);
+extern uint32 ai_addrspace(si_t *sih, uint asidx);
+extern uint32 ai_addrspacesize(si_t *sih, uint asidx);
+extern void ai_coreaddrspaceX(si_t *sih, uint asidx, uint32 *addr, uint32 *size);
+extern uint ai_wrap_reg(si_t *sih, uint32 offset, uint32 mask, uint32 val);
+
+#if defined(BCMDBG_PHYDUMP)
+extern void ai_dumpregs(si_t *sih, struct bcmstrbuf *b);
+#endif
+
+
+#define ub_scan(a, b, c) do {} while (0)
+#define ub_flag(a) (0)
+#define ub_setint(a, b) do {} while (0)
+#define ub_coreidx(a) (0)
+#define ub_corevendor(a) (0)
+#define ub_corerev(a) (0)
+#define ub_iscoreup(a) (0)
+#define ub_setcoreidx(a, b) (0)
+#define ub_core_cflags(a, b, c) (0)
+#define ub_core_cflags_wo(a, b, c) do {} while (0)
+#define ub_core_sflags(a, b, c) (0)
+#define ub_corereg(a, b, c, d, e) (0)
+#define ub_core_reset(a, b, c) do {} while (0)
+#define ub_core_disable(a, b) do {} while (0)
+#define ub_numaddrspaces(a) (0)
+#define ub_addrspace(a, b)  (0)
+#define ub_addrspacesize(a, b) (0)
+#define ub_view(a, b) do {} while (0)
+#define ub_dumpregs(a, b) do {} while (0)
+
+#endif	/* _siutils_priv_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/uamp_api.h b/drivers/net/wireless/bcm4336/uamp_api.h
--- a/drivers/net/wireless/bcm4336/uamp_api.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/uamp_api.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,160 @@
+/*
+ *  Name:       uamp_api.h
+ *
+ *  Description: Universal AMP API
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: uamp_api.h 467328 2014-04-03 01:23:40Z $
+ *
+ */
+
+
+#ifndef UAMP_API_H
+#define UAMP_API_H
+
+
+#include "typedefs.h"
+
+
+/*****************************************************************************
+**  Constant and Type Definitions
+******************************************************************************
+*/
+
+#define BT_API
+
+/* Types. */
+typedef bool	BOOLEAN;
+typedef uint8	UINT8;
+typedef uint16	UINT16;
+
+
+/* UAMP identifiers */
+#define UAMP_ID_1   1
+#define UAMP_ID_2   2
+typedef UINT8 tUAMP_ID;
+
+/* UAMP event ids (used by UAMP_CBACK) */
+#define UAMP_EVT_RX_READY           0   /* Data from AMP controller is ready to be read */
+#define UAMP_EVT_CTLR_REMOVED       1   /* Controller removed */
+#define UAMP_EVT_CTLR_READY         2   /* Controller added/ready */
+typedef UINT8 tUAMP_EVT;
+
+
+/* UAMP Channels */
+#define UAMP_CH_HCI_CMD            0   /* HCI Command channel */
+#define UAMP_CH_HCI_EVT            1   /* HCI Event channel */
+#define UAMP_CH_HCI_DATA           2   /* HCI ACL Data channel */
+typedef UINT8 tUAMP_CH;
+
+/* tUAMP_EVT_DATA: union for event-specific data, used by UAMP_CBACK */
+typedef union {
+    tUAMP_CH channel;       /* UAMP_EVT_RX_READY: channel for which rx occured */
+} tUAMP_EVT_DATA;
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_CBACK
+**
+** Description: Callback for events. Register callback using UAMP_Init.
+**
+** Parameters   amp_id:         AMP device identifier that generated the event
+**              amp_evt:        event id
+**              p_amp_evt_data: pointer to event-specific data
+**
+******************************************************************************
+*/
+typedef void (*tUAMP_CBACK)(tUAMP_ID amp_id, tUAMP_EVT amp_evt, tUAMP_EVT_DATA *p_amp_evt_data);
+
+/*****************************************************************************
+**  external function declarations
+******************************************************************************
+*/
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/*****************************************************************************
+**
+** Function:    UAMP_Init
+**
+** Description: Initialize UAMP driver
+**
+** Parameters   p_cback:    Callback function for UAMP event notification
+**
+******************************************************************************
+*/
+BT_API BOOLEAN UAMP_Init(tUAMP_CBACK p_cback);
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_Open
+**
+** Description: Open connection to local AMP device.
+**
+** Parameters   app_id: Application specific AMP identifer. This value
+**                      will be included in AMP messages sent to the
+**                      BTU task, to identify source of the message
+**
+******************************************************************************
+*/
+BT_API BOOLEAN UAMP_Open(tUAMP_ID amp_id);
+
+/*****************************************************************************
+**
+** Function:    UAMP_Close
+**
+** Description: Close connection to local AMP device.
+**
+** Parameters   app_id: Application specific AMP identifer.
+**
+******************************************************************************
+*/
+BT_API void UAMP_Close(tUAMP_ID amp_id);
+
+
+/*****************************************************************************
+**
+** Function:    UAMP_Write
+**
+** Description: Send buffer to AMP device. Frees GKI buffer when done.
+**
+**
+** Parameters:  app_id:     AMP identifer.
+**              p_buf:      pointer to buffer to write
+**              num_bytes:  number of bytes to write
+**              channel:    UAMP_CH_HCI_ACL, or UAMP_CH_HCI_CMD
+**
+** Returns:     number of bytes written
+**
+******************************************************************************
+*/
+BT_API UINT16 UAMP_Write(tUAMP_ID amp_id, UINT8 *p_buf, UINT16 num_bytes, tUAMP_CH channel);
+
+/*****************************************************************************
+**
+** Function:    UAMP_Read
+**
+** Description: Read incoming data from AMP. Call after receiving a
+**              UAMP_EVT_RX_READY callback event.
+**
+** Parameters:  app_id:     AMP identifer.
+**              p_buf:      pointer to buffer for holding incoming AMP data
+**              buf_size:   size of p_buf
+**              channel:    UAMP_CH_HCI_ACL, or UAMP_CH_HCI_EVT
+**
+** Returns:     number of bytes read
+**
+******************************************************************************
+*/
+BT_API UINT16 UAMP_Read(tUAMP_ID amp_id, UINT8 *p_buf, UINT16 buf_size, tUAMP_CH channel);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* UAMP_API_H */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_android.c b/drivers/net/wireless/bcm4336/wl_android.c
--- a/drivers/net/wireless/bcm4336/wl_android.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_android.c	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,3690 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_android.c 505064 2014-09-26 09:40:28Z $
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/string.h>
+#include <net/netlink.h>
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#include <wl_android.h>
+#include <wldev_common.h>
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <linux_osl.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_config.h>
+#include <proto/bcmip.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif
+#ifdef BCMSDIO
+#include <bcmsdbus.h>
+#endif
+#ifdef WL_CFG80211
+#include <wl_cfg80211.h>
+#endif
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+
+#ifndef WL_CFG80211
+#define htod32(i) i
+#define htod16(i) i
+#define dtoh32(i) i
+#define dtoh16(i) i
+#define htodchanspec(i) i
+#define dtohchanspec(i) i
+#endif
+
+/* message levels */
+#define ANDROID_ERROR_LEVEL	0x0001
+#define ANDROID_TRACE_LEVEL	0x0002
+#define ANDROID_INFO_LEVEL	0x0004
+
+uint android_msg_level = ANDROID_ERROR_LEVEL;
+
+#define ANDROID_ERROR(x) \
+	do { \
+		if (android_msg_level & ANDROID_ERROR_LEVEL) { \
+			printk(KERN_ERR "ANDROID-ERROR) ");	\
+			printk x; \
+		} \
+	} while (0)
+#define ANDROID_TRACE(x) \
+	do { \
+		if (android_msg_level & ANDROID_TRACE_LEVEL) { \
+			printk(KERN_ERR "ANDROID-TRACE) ");	\
+			printk x; \
+		} \
+	} while (0)
+#define ANDROID_INFO(x) \
+	do { \
+		if (android_msg_level & ANDROID_INFO_LEVEL) { \
+			printk(KERN_ERR "ANDROID-INFO) ");	\
+			printk x; \
+		} \
+	} while (0)
+
+/*
+ * Android private command strings, PLEASE define new private commands here
+ * so they can be updated easily in the future (if needed)
+ */
+
+#define CMD_START		"START"
+#define CMD_STOP		"STOP"
+#define	CMD_SCAN_ACTIVE		"SCAN-ACTIVE"
+#define	CMD_SCAN_PASSIVE	"SCAN-PASSIVE"
+#define CMD_RSSI		"RSSI"
+#define CMD_LINKSPEED		"LINKSPEED"
+#ifdef PKT_FILTER_SUPPORT
+#define CMD_RXFILTER_START	"RXFILTER-START"
+#define CMD_RXFILTER_STOP	"RXFILTER-STOP"
+#define CMD_RXFILTER_ADD	"RXFILTER-ADD"
+#define CMD_RXFILTER_REMOVE	"RXFILTER-REMOVE"
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#define CMD_PKT_FILTER_MODE		"PKT_FILTER_MODE"
+#define CMD_PKT_FILTER_PORTS	"PKT_FILTER_PORTS"
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+#endif /* PKT_FILTER_SUPPORT */
+#define CMD_BTCOEXSCAN_START	"BTCOEXSCAN-START"
+#define CMD_BTCOEXSCAN_STOP	"BTCOEXSCAN-STOP"
+#define CMD_BTCOEXMODE		"BTCOEXMODE"
+#define CMD_SETSUSPENDOPT	"SETSUSPENDOPT"
+#define CMD_SETSUSPENDMODE      "SETSUSPENDMODE"
+#define CMD_P2P_DEV_ADDR	"P2P_DEV_ADDR"
+#define CMD_SETFWPATH		"SETFWPATH"
+#define CMD_SETBAND		"SETBAND"
+#define CMD_GETBAND		"GETBAND"
+#define CMD_COUNTRY		"COUNTRY"
+#define CMD_P2P_SET_NOA		"P2P_SET_NOA"
+#if !defined WL_ENABLE_P2P_IF
+#define CMD_P2P_GET_NOA			"P2P_GET_NOA"
+#endif /* WL_ENABLE_P2P_IF */
+#define CMD_P2P_SD_OFFLOAD		"P2P_SD_"
+#define CMD_P2P_SET_PS		"P2P_SET_PS"
+#define CMD_SET_AP_WPS_P2P_IE 		"SET_AP_WPS_P2P_IE"
+#define CMD_SETROAMMODE 	"SETROAMMODE"
+#define CMD_SETIBSSBEACONOUIDATA	"SETIBSSBEACONOUIDATA"
+#define CMD_MIRACAST		"MIRACAST"
+#define CMD_NAN		"NAN_"
+#define CMD_GET_CHANNEL			"GET_CHANNEL"
+#define CMD_SET_ROAM			"SET_ROAM_TRIGGER"
+#define CMD_GET_ROAM			"GET_ROAM_TRIGGER"
+#define CMD_GET_KEEP_ALIVE		"GET_KEEP_ALIVE"
+#define CMD_GET_PM				"GET_PM"
+#define CMD_SET_PM				"SET_PM"
+#define CMD_MONITOR			"MONITOR"
+
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+#define CMD_GET_BEST_CHANNELS	"GET_BEST_CHANNELS"
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#define CMD_SETMIRACAST 	"SETMIRACAST"
+#define CMD_ASSOCRESPIE 	"ASSOCRESPIE"
+#define CMD_RXRATESTATS        "RXRATESTATS"
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+#define CMD_KEEP_ALIVE		"KEEPALIVE"
+
+/* CCX Private Commands */
+#ifdef BCMCCX
+#define CMD_GETCCKM_RN		"get cckm_rn"
+#define CMD_SETCCKM_KRK		"set cckm_krk"
+#define CMD_GET_ASSOC_RES_IES	"get assoc_res_ies"
+#endif
+
+#ifdef PNO_SUPPORT
+#define CMD_PNOSSIDCLR_SET	"PNOSSIDCLR"
+#define CMD_PNOSETUP_SET	"PNOSETUP "
+#define CMD_PNOENABLE_SET	"PNOFORCE"
+#define CMD_PNODEBUG_SET	"PNODEBUG"
+#define CMD_WLS_BATCHING	"WLS_BATCHING"
+#endif /* PNO_SUPPORT */
+
+#define CMD_OKC_SET_PMK		"SET_PMK"
+#define CMD_OKC_ENABLE		"OKC_ENABLE"
+
+#define	CMD_HAPD_MAC_FILTER	"HAPD_MAC_FILTER"
+
+#ifdef WLFBT
+#define CMD_GET_FTKEY      "GET_FTKEY"
+#endif
+
+#ifdef WLAIBSS
+#define CMD_SETIBSSTXFAILEVENT		"SETIBSSTXFAILEVENT"
+#define CMD_GET_IBSS_PEER_INFO		"GETIBSSPEERINFO"
+#define CMD_GET_IBSS_PEER_INFO_ALL	"GETIBSSPEERINFOALL"
+#define CMD_SETIBSSROUTETABLE		"SETIBSSROUTETABLE"
+#define CMD_SETIBSSAMPDU			"SETIBSSAMPDU"
+#define CMD_SETIBSSANTENNAMODE		"SETIBSSANTENNAMODE"
+#endif /* WLAIBSS */
+
+#define CMD_ROAM_OFFLOAD			"SETROAMOFFLOAD"
+#define CMD_ROAM_OFFLOAD_APLIST		"SETROAMOFFLAPLIST"
+#define CMD_GET_LINK_STATUS			"GETLINKSTATUS"
+
+#ifdef P2PRESP_WFDIE_SRC
+#define CMD_P2P_SET_WFDIE_RESP      "P2P_SET_WFDIE_RESP"
+#define CMD_P2P_GET_WFDIE_RESP      "P2P_GET_WFDIE_RESP"
+#endif /* P2PRESP_WFDIE_SRC */
+
+/* related with CMD_GET_LINK_STATUS */
+#define WL_ANDROID_LINK_VHT					0x01
+#define WL_ANDROID_LINK_MIMO					0x02
+#define WL_ANDROID_LINK_AP_VHT_SUPPORT		0x04
+#define WL_ANDROID_LINK_AP_MIMO_SUPPORT	0x08
+
+/* miracast related definition */
+#define MIRACAST_MODE_OFF	0
+#define MIRACAST_MODE_SOURCE	1
+#define MIRACAST_MODE_SINK	2
+
+#ifndef MIRACAST_AMPDU_SIZE
+#define MIRACAST_AMPDU_SIZE	8
+#endif
+
+#ifndef MIRACAST_MCHAN_ALGO
+#define MIRACAST_MCHAN_ALGO     1
+#endif
+
+#ifndef MIRACAST_MCHAN_BW
+#define MIRACAST_MCHAN_BW       25
+#endif
+
+#ifdef CONNECTION_STATISTICS
+#define CMD_GET_CONNECTION_STATS	"GET_CONNECTION_STATS"
+
+struct connection_stats {
+	u32 txframe;
+	u32 txbyte;
+	u32 txerror;
+	u32 rxframe;
+	u32 rxbyte;
+	u32 txfail;
+	u32 txretry;
+	u32 txretrie;
+	u32 txrts;
+	u32 txnocts;
+	u32 txexptime;
+	u32 txrate;
+	u8	chan_idle;
+};
+#endif /* CONNECTION_STATISTICS */
+
+static LIST_HEAD(miracast_resume_list);
+#ifdef WL_CFG80211
+static u8 miracast_cur_mode;
+#endif
+
+struct io_cfg {
+	s8 *iovar;
+	s32 param;
+	u32 ioctl;
+	void *arg;
+	u32 len;
+	struct list_head list;
+};
+
+typedef struct _android_wifi_priv_cmd {
+	char *buf;
+	int used_len;
+	int total_len;
+} android_wifi_priv_cmd;
+
+#ifdef CONFIG_COMPAT
+typedef struct _compat_android_wifi_priv_cmd {
+	compat_caddr_t buf;
+	int used_len;
+	int total_len;
+} compat_android_wifi_priv_cmd;
+#endif /* CONFIG_COMPAT */
+
+#if defined(BCMFW_ROAM_ENABLE)
+#define CMD_SET_ROAMPREF	"SET_ROAMPREF"
+
+#define MAX_NUM_SUITES		10
+#define WIDTH_AKM_SUITE		8
+#define JOIN_PREF_RSSI_LEN		0x02
+#define JOIN_PREF_RSSI_SIZE		4	/* RSSI pref header size in bytes */
+#define JOIN_PREF_WPA_HDR_SIZE		4 /* WPA pref header size in bytes */
+#define JOIN_PREF_WPA_TUPLE_SIZE	12	/* Tuple size in bytes */
+#define JOIN_PREF_MAX_WPA_TUPLES	16
+#define MAX_BUF_SIZE		(JOIN_PREF_RSSI_SIZE + JOIN_PREF_WPA_HDR_SIZE +	\
+				           (JOIN_PREF_WPA_TUPLE_SIZE * JOIN_PREF_MAX_WPA_TUPLES))
+#endif /* BCMFW_ROAM_ENABLE */
+
+#ifdef WL_GENL
+static s32 wl_genl_handle_msg(struct sk_buff *skb, struct genl_info *info);
+static int wl_genl_init(void);
+static int wl_genl_deinit(void);
+
+extern struct net init_net;
+/* attribute policy: defines which attribute has which type (e.g int, char * etc)
+ * possible values defined in net/netlink.h
+ */
+static struct nla_policy wl_genl_policy[BCM_GENL_ATTR_MAX + 1] = {
+	[BCM_GENL_ATTR_STRING] = { .type = NLA_NUL_STRING },
+	[BCM_GENL_ATTR_MSG] = { .type = NLA_BINARY },
+};
+
+#define WL_GENL_VER 1
+/* family definition */
+static struct genl_family wl_genl_family = {
+	.id = GENL_ID_GENERATE,    /* Genetlink would generate the ID */
+	.hdrsize = 0,
+	.name = "bcm-genl",        /* Netlink I/F for Android */
+	.version = WL_GENL_VER,     /* Version Number */
+	.maxattr = BCM_GENL_ATTR_MAX,
+};
+
+/* commands: mapping between the command enumeration and the actual function */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+struct genl_ops wl_genl_ops[] = {
+	{
+	.cmd = BCM_GENL_CMD_MSG,
+	.flags = 0,
+	.policy = wl_genl_policy,
+	.doit = wl_genl_handle_msg,
+	.dumpit = NULL,
+	},
+};
+#else
+struct genl_ops wl_genl_ops = {
+	.cmd = BCM_GENL_CMD_MSG,
+	.flags = 0,
+	.policy = wl_genl_policy,
+	.doit = wl_genl_handle_msg,
+	.dumpit = NULL,
+
+};
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0))
+static struct genl_multicast_group wl_genl_mcast[] = {
+	 { .name = "bcm-genl-mcast", },
+};
+#else
+static struct genl_multicast_group wl_genl_mcast = {
+	.id = GENL_ID_GENERATE,    /* Genetlink would generate the ID */
+	.name = "bcm-genl-mcast",
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0) */
+#endif /* WL_GENL */
+
+/**
+ * Extern function declarations (TODO: move them to dhd_linux.h)
+ */
+int dhd_net_bus_devreset(struct net_device *dev, uint8 flag);
+int dhd_dev_init_ioctl(struct net_device *dev);
+#ifdef WL_CFG80211
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, dhd_pub_t *dhd, char *command);
+#else
+int wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{ return 0; }
+int wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{ return 0; }
+int wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{ return 0; }
+#endif /* WL_CFG80211 */
+
+
+#ifdef ENABLE_4335BT_WAR
+extern int bcm_bt_lock(int cookie);
+extern void bcm_bt_unlock(int cookie);
+static int lock_cookie_wifi = 'W' | 'i'<<8 | 'F'<<16 | 'i'<<24;	/* cookie is "WiFi" */
+#endif /* ENABLE_4335BT_WAR */
+
+extern bool ap_fw_loaded;
+extern char iface_name[IFNAMSIZ];
+
+/**
+ * Local (static) functions and variables
+ */
+
+/* Initialize g_wifi_on to 1 so dhd_bus_start will be called for the first
+ * time (only) in dhd_open, subsequential wifi on will be handled by
+ * wl_android_wifi_on
+ */
+int g_wifi_on = TRUE;
+
+/**
+ * Local (static) function definitions
+ */
+static int wl_android_get_link_speed(struct net_device *net, char *command, int total_len)
+{
+	int link_speed;
+	int bytes_written;
+	int error;
+
+	error = wldev_get_link_speed(net, &link_speed);
+	if (error)
+		return -1;
+
+	/* Convert Kbps to Android Mbps */
+	link_speed = link_speed / 1000;
+	bytes_written = snprintf(command, total_len, "LinkSpeed %d", link_speed);
+	ANDROID_INFO(("%s: command result is %s\n", __FUNCTION__, command));
+	return bytes_written;
+}
+
+static int wl_android_get_rssi(struct net_device *net, char *command, int total_len)
+{
+	wlc_ssid_t ssid = {0};
+	int rssi;
+	int bytes_written = 0;
+	int error;
+
+	error = wldev_get_rssi(net, &rssi);
+	if (error)
+		return -1;
+#if defined(RSSIOFFSET)
+	rssi = wl_update_rssi_offset(net, rssi);
+#endif
+
+	error = wldev_get_ssid(net, &ssid);
+	if (error)
+		return -1;
+	if ((ssid.SSID_len == 0) || (ssid.SSID_len > DOT11_MAX_SSID_LEN)) {
+		ANDROID_ERROR(("%s: wldev_get_ssid failed\n", __FUNCTION__));
+	} else {
+		memcpy(command, ssid.SSID, ssid.SSID_len);
+		bytes_written = ssid.SSID_len;
+	}
+	bytes_written += snprintf(&command[bytes_written], total_len, " rssi %d", rssi);
+	ANDROID_INFO(("%s: command result is %s (%d)\n", __FUNCTION__, command, bytes_written));
+	return bytes_written;
+}
+
+static int wl_android_set_suspendopt(struct net_device *dev, char *command, int total_len)
+{
+	int suspend_flag;
+	int ret_now;
+	int ret = 0;
+
+	suspend_flag = *(command + strlen(CMD_SETSUSPENDOPT) + 1) - '0';
+
+	if (suspend_flag != 0)
+		suspend_flag = 1;
+	ret_now = net_os_set_suspend_disable(dev, suspend_flag);
+
+	if (ret_now != suspend_flag) {
+		if (!(ret = net_os_set_suspend(dev, ret_now, 1)))
+			ANDROID_INFO(("%s: Suspend Flag %d -> %d\n",
+				__FUNCTION__, ret_now, suspend_flag));
+		else
+			ANDROID_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+	}
+	return ret;
+}
+
+static int wl_android_set_suspendmode(struct net_device *dev, char *command, int total_len)
+{
+	int ret = 0;
+
+#if !defined(CONFIG_HAS_EARLYSUSPEND) || !defined(DHD_USE_EARLYSUSPEND)
+	int suspend_flag;
+
+	suspend_flag = *(command + strlen(CMD_SETSUSPENDMODE) + 1) - '0';
+	if (suspend_flag != 0)
+		suspend_flag = 1;
+
+	if (!(ret = net_os_set_suspend(dev, suspend_flag, 0)))
+		ANDROID_INFO(("%s: Suspend Mode %d\n", __FUNCTION__, suspend_flag));
+	else
+		ANDROID_ERROR(("%s: failed %d\n", __FUNCTION__, ret));
+#endif
+
+	return ret;
+}
+
+static int wl_android_get_band(struct net_device *dev, char *command, int total_len)
+{
+	uint band;
+	int bytes_written;
+	int error;
+
+	error = wldev_get_band(dev, &band);
+	if (error)
+		return -1;
+	bytes_written = snprintf(command, total_len, "Band %d", band);
+	return bytes_written;
+}
+
+
+#ifdef PNO_SUPPORT
+#define PNO_PARAM_SIZE 50
+#define VALUE_SIZE 50
+#define LIMIT_STR_FMT  ("%50s %50s")
+static int
+wls_parse_batching_cmd(struct net_device *dev, char *command, int total_len)
+{
+	int err = BCME_OK;
+	uint i, tokens;
+	char *pos, *pos2, *token, *token2, *delim;
+	char param[PNO_PARAM_SIZE], value[VALUE_SIZE];
+	struct dhd_pno_batch_params batch_params;
+	ANDROID_INFO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+	if (total_len < strlen(CMD_WLS_BATCHING)) {
+		ANDROID_ERROR(("%s argument=%d less min size\n", __FUNCTION__, total_len));
+		err = BCME_ERROR;
+		goto exit;
+	}
+	pos = command + strlen(CMD_WLS_BATCHING) + 1;
+	memset(&batch_params, 0, sizeof(struct dhd_pno_batch_params));
+
+	if (!strncmp(pos, PNO_BATCHING_SET, strlen(PNO_BATCHING_SET))) {
+		pos += strlen(PNO_BATCHING_SET) + 1;
+		while ((token = strsep(&pos, PNO_PARAMS_DELIMETER)) != NULL) {
+			memset(param, 0, sizeof(param));
+			memset(value, 0, sizeof(value));
+			if (token == NULL || !*token)
+				break;
+			if (*token == '\0')
+				continue;
+			delim = strchr(token, PNO_PARAM_VALUE_DELLIMETER);
+			if (delim != NULL)
+				*delim = ' ';
+
+			tokens = sscanf(token, LIMIT_STR_FMT, param, value);
+			if (!strncmp(param, PNO_PARAM_SCANFREQ, strlen(PNO_PARAM_SCANFREQ))) {
+				batch_params.scan_fr = simple_strtol(value, NULL, 0);
+				ANDROID_INFO(("scan_freq : %d\n", batch_params.scan_fr));
+			} else if (!strncmp(param, PNO_PARAM_BESTN, strlen(PNO_PARAM_BESTN))) {
+				batch_params.bestn = simple_strtol(value, NULL, 0);
+				ANDROID_INFO(("bestn : %d\n", batch_params.bestn));
+			} else if (!strncmp(param, PNO_PARAM_MSCAN, strlen(PNO_PARAM_MSCAN))) {
+				batch_params.mscan = simple_strtol(value, NULL, 0);
+				ANDROID_INFO(("mscan : %d\n", batch_params.mscan));
+			} else if (!strncmp(param, PNO_PARAM_CHANNEL, strlen(PNO_PARAM_CHANNEL))) {
+				i = 0;
+				pos2 = value;
+				tokens = sscanf(value, "<%s>", value);
+				if (tokens != 1) {
+					err = BCME_ERROR;
+					ANDROID_ERROR(("%s : invalid format for channel"
+					" <> params\n", __FUNCTION__));
+					goto exit;
+				}
+					while ((token2 = strsep(&pos2,
+					PNO_PARAM_CHANNEL_DELIMETER)) != NULL) {
+					if (token2 == NULL || !*token2)
+						break;
+					if (*token2 == '\0')
+						continue;
+					if (*token2 == 'A' || *token2 == 'B') {
+						batch_params.band = (*token2 == 'A')?
+							WLC_BAND_5G : WLC_BAND_2G;
+						ANDROID_INFO(("band : %s\n",
+							(*token2 == 'A')? "A" : "B"));
+					} else {
+						batch_params.chan_list[i++] =
+						simple_strtol(token2, NULL, 0);
+						batch_params.nchan++;
+						ANDROID_INFO(("channel :%d\n",
+						batch_params.chan_list[i-1]));
+					}
+				 }
+			} else if (!strncmp(param, PNO_PARAM_RTT, strlen(PNO_PARAM_RTT))) {
+				batch_params.rtt = simple_strtol(value, NULL, 0);
+				ANDROID_INFO(("rtt : %d\n", batch_params.rtt));
+			} else {
+				ANDROID_ERROR(("%s : unknown param: %s\n", __FUNCTION__, param));
+				err = BCME_ERROR;
+				goto exit;
+			}
+		}
+		err = dhd_dev_pno_set_for_batch(dev, &batch_params);
+		if (err < 0) {
+			ANDROID_ERROR(("failed to configure batch scan\n"));
+		} else {
+			memset(command, 0, total_len);
+			err = sprintf(command, "%d", err);
+		}
+	} else if (!strncmp(pos, PNO_BATCHING_GET, strlen(PNO_BATCHING_GET))) {
+		err = dhd_dev_pno_get_for_batch(dev, command, total_len);
+		if (err < 0) {
+			ANDROID_ERROR(("failed to getting batching results\n"));
+		} else {
+			err = strlen(command);
+		}
+	} else if (!strncmp(pos, PNO_BATCHING_STOP, strlen(PNO_BATCHING_STOP))) {
+		err = dhd_dev_pno_stop_for_batch(dev);
+		if (err < 0) {
+			ANDROID_ERROR(("failed to stop batching scan\n"));
+		} else {
+			memset(command, 0, total_len);
+			err = sprintf(command, "OK");
+		}
+	} else {
+		ANDROID_ERROR(("%s : unknown command\n", __FUNCTION__));
+		err = BCME_ERROR;
+		goto exit;
+	}
+exit:
+	return err;
+}
+#ifndef WL_SCHED_SCAN
+static int wl_android_set_pno_setup(struct net_device *dev, char *command, int total_len)
+{
+	wlc_ssid_t ssids_local[MAX_PFN_LIST_COUNT];
+	int res = -1;
+	int nssid = 0;
+	cmd_tlv_t *cmd_tlv_temp;
+	char *str_ptr;
+	int tlv_size_left;
+	int pno_time = 0;
+	int pno_repeat = 0;
+	int pno_freq_expo_max = 0;
+
+#ifdef PNO_SET_DEBUG
+	int i;
+	char pno_in_example[] = {
+		'P', 'N', 'O', 'S', 'E', 'T', 'U', 'P', ' ',
+		'S', '1', '2', '0',
+		'S',
+		0x05,
+		'd', 'l', 'i', 'n', 'k',
+		'S',
+		0x04,
+		'G', 'O', 'O', 'G',
+		'T',
+		'0', 'B',
+		'R',
+		'2',
+		'M',
+		'2',
+		0x00
+		};
+#endif /* PNO_SET_DEBUG */
+	ANDROID_INFO(("%s: command=%s, len=%d\n", __FUNCTION__, command, total_len));
+
+	if (total_len < (strlen(CMD_PNOSETUP_SET) + sizeof(cmd_tlv_t))) {
+		ANDROID_ERROR(("%s argument=%d less min size\n", __FUNCTION__, total_len));
+		goto exit_proc;
+	}
+#ifdef PNO_SET_DEBUG
+	memcpy(command, pno_in_example, sizeof(pno_in_example));
+	total_len = sizeof(pno_in_example);
+#endif
+	str_ptr = command + strlen(CMD_PNOSETUP_SET);
+	tlv_size_left = total_len - strlen(CMD_PNOSETUP_SET);
+
+	cmd_tlv_temp = (cmd_tlv_t *)str_ptr;
+	memset(ssids_local, 0, sizeof(ssids_local));
+
+	if ((cmd_tlv_temp->prefix == PNO_TLV_PREFIX) &&
+		(cmd_tlv_temp->version == PNO_TLV_VERSION) &&
+		(cmd_tlv_temp->subtype == PNO_TLV_SUBTYPE_LEGACY_PNO)) {
+
+		str_ptr += sizeof(cmd_tlv_t);
+		tlv_size_left -= sizeof(cmd_tlv_t);
+
+		if ((nssid = wl_iw_parse_ssid_list_tlv(&str_ptr, ssids_local,
+			MAX_PFN_LIST_COUNT, &tlv_size_left)) <= 0) {
+			ANDROID_ERROR(("SSID is not presented or corrupted ret=%d\n", nssid));
+			goto exit_proc;
+		} else {
+			if ((str_ptr[0] != PNO_TLV_TYPE_TIME) || (tlv_size_left <= 1)) {
+				ANDROID_ERROR(("%s scan duration corrupted field size %d\n",
+					__FUNCTION__, tlv_size_left));
+				goto exit_proc;
+			}
+			str_ptr++;
+			pno_time = simple_strtoul(str_ptr, &str_ptr, 16);
+			ANDROID_INFO(("%s: pno_time=%d\n", __FUNCTION__, pno_time));
+
+			if (str_ptr[0] != 0) {
+				if ((str_ptr[0] != PNO_TLV_FREQ_REPEAT)) {
+					ANDROID_ERROR(("%s pno repeat : corrupted field\n",
+						__FUNCTION__));
+					goto exit_proc;
+				}
+				str_ptr++;
+				pno_repeat = simple_strtoul(str_ptr, &str_ptr, 16);
+				ANDROID_INFO(("%s :got pno_repeat=%d\n", __FUNCTION__, pno_repeat));
+				if (str_ptr[0] != PNO_TLV_FREQ_EXPO_MAX) {
+					ANDROID_ERROR(("%s FREQ_EXPO_MAX corrupted field size\n",
+						__FUNCTION__));
+					goto exit_proc;
+				}
+				str_ptr++;
+				pno_freq_expo_max = simple_strtoul(str_ptr, &str_ptr, 16);
+				ANDROID_INFO(("%s: pno_freq_expo_max=%d\n",
+					__FUNCTION__, pno_freq_expo_max));
+			}
+		}
+	} else {
+		ANDROID_ERROR(("%s get wrong TLV command\n", __FUNCTION__));
+		goto exit_proc;
+	}
+
+	res = dhd_dev_pno_set_for_ssid(dev, ssids_local, nssid, pno_time, pno_repeat,
+		pno_freq_expo_max, NULL, 0);
+exit_proc:
+	return res;
+}
+#endif /* !WL_SCHED_SCAN */
+#endif /* PNO_SUPPORT  */
+
+static int wl_android_get_p2p_dev_addr(struct net_device *ndev, char *command, int total_len)
+{
+	int ret;
+	int bytes_written = 0;
+
+	ret = wl_cfg80211_get_p2p_dev_addr(ndev, (struct ether_addr*)command);
+	if (ret)
+		return 0;
+	bytes_written = sizeof(struct ether_addr);
+	return bytes_written;
+}
+
+#ifdef BCMCCX
+static int wl_android_get_cckm_rn(struct net_device *dev, char *command)
+{
+	int error, rn;
+
+	ANDROID_TRACE(("%s:wl_android_get_cckm_rn\n", dev->name));
+
+	error = wldev_iovar_getint(dev, "cckm_rn", &rn);
+	if (unlikely(error)) {
+		ANDROID_ERROR(("wl_android_get_cckm_rn error (%d)\n", error));
+		return -1;
+	}
+	memcpy(command, &rn, sizeof(int));
+
+	return sizeof(int);
+}
+
+static int wl_android_set_cckm_krk(struct net_device *dev, char *command)
+{
+	int error;
+	unsigned char key[16];
+	static char iovar_buf[WLC_IOCTL_MEDLEN];
+
+	ANDROID_TRACE(("%s: wl_iw_set_cckm_krk\n", dev->name));
+
+	memset(iovar_buf, 0, sizeof(iovar_buf));
+	memcpy(key, command+strlen("set cckm_krk")+1, 16);
+
+	error = wldev_iovar_setbuf(dev, "cckm_krk", key, sizeof(key),
+		iovar_buf, WLC_IOCTL_MEDLEN, NULL);
+	if (unlikely(error))
+	{
+		ANDROID_ERROR((" cckm_krk set error (%d)\n", error));
+		return -1;
+	}
+	return 0;
+}
+
+static int wl_android_get_assoc_res_ies(struct net_device *dev, char *command)
+{
+	int error;
+	u8 buf[WL_ASSOC_INFO_MAX];
+	wl_assoc_info_t assoc_info;
+	u32 resp_ies_len = 0;
+	int bytes_written = 0;
+
+	ANDROID_TRACE(("%s: wl_iw_get_assoc_res_ies\n", dev->name));
+
+	error = wldev_iovar_getbuf(dev, "assoc_info", NULL, 0, buf, WL_ASSOC_INFO_MAX, NULL);
+	if (unlikely(error)) {
+		ANDROID_ERROR(("could not get assoc info (%d)\n", error));
+		return -1;
+	}
+
+	memcpy(&assoc_info, buf, sizeof(wl_assoc_info_t));
+	assoc_info.req_len = htod32(assoc_info.req_len);
+	assoc_info.resp_len = htod32(assoc_info.resp_len);
+	assoc_info.flags = htod32(assoc_info.flags);
+
+	if (assoc_info.resp_len) {
+		resp_ies_len = assoc_info.resp_len - sizeof(struct dot11_assoc_resp);
+	}
+
+	/* first 4 bytes are ie len */
+	memcpy(command, &resp_ies_len, sizeof(u32));
+	bytes_written = sizeof(u32);
+
+	/* get the association resp IE's if there are any */
+	if (resp_ies_len) {
+		error = wldev_iovar_getbuf(dev, "assoc_resp_ies", NULL, 0,
+			buf, WL_ASSOC_INFO_MAX, NULL);
+		if (unlikely(error)) {
+			ANDROID_ERROR(("could not get assoc resp_ies (%d)\n", error));
+			return -1;
+		}
+
+		memcpy(command+sizeof(u32), buf, resp_ies_len);
+		bytes_written += resp_ies_len;
+	}
+	return bytes_written;
+}
+
+#endif /* BCMCCX */
+
+int
+wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist)
+{
+	int i, j, match;
+	int ret	= 0;
+	char mac_buf[MAX_NUM_OF_ASSOCLIST *
+		sizeof(struct ether_addr) + sizeof(uint)] = {0};
+	struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+
+	/* set filtering mode */
+	if ((ret = wldev_ioctl(dev, WLC_SET_MACMODE, &macmode, sizeof(macmode), true)) != 0) {
+		ANDROID_ERROR(("%s : WLC_SET_MACMODE error=%d\n", __FUNCTION__, ret));
+		return ret;
+	}
+	if (macmode != MACLIST_MODE_DISABLED) {
+		/* set the MAC filter list */
+		if ((ret = wldev_ioctl(dev, WLC_SET_MACLIST, maclist,
+			sizeof(int) + sizeof(struct ether_addr) * maclist->count, true)) != 0) {
+			ANDROID_ERROR(("%s : WLC_SET_MACLIST error=%d\n", __FUNCTION__, ret));
+			return ret;
+		}
+		/* get the current list of associated STAs */
+		assoc_maclist->count = MAX_NUM_OF_ASSOCLIST;
+		if ((ret = wldev_ioctl(dev, WLC_GET_ASSOCLIST, assoc_maclist,
+			sizeof(mac_buf), false)) != 0) {
+			ANDROID_ERROR(("%s : WLC_GET_ASSOCLIST error=%d\n", __FUNCTION__, ret));
+			return ret;
+		}
+		/* do we have any STA associated?  */
+		if (assoc_maclist->count) {
+			/* iterate each associated STA */
+			for (i = 0; i < assoc_maclist->count; i++) {
+				match = 0;
+				/* compare with each entry */
+				for (j = 0; j < maclist->count; j++) {
+					ANDROID_INFO(("%s : associated="MACDBG " list="MACDBG "\n",
+					__FUNCTION__, MAC2STRDBG(assoc_maclist->ea[i].octet),
+					MAC2STRDBG(maclist->ea[j].octet)));
+					if (memcmp(assoc_maclist->ea[i].octet,
+						maclist->ea[j].octet, ETHER_ADDR_LEN) == 0) {
+						match = 1;
+						break;
+					}
+				}
+				/* do conditional deauth */
+				/*   "if not in the allow list" or "if in the deny list" */
+				if ((macmode == MACLIST_MODE_ALLOW && !match) ||
+					(macmode == MACLIST_MODE_DENY && match)) {
+					scb_val_t scbval;
+
+					scbval.val = htod32(1);
+					memcpy(&scbval.ea, &assoc_maclist->ea[i],
+						ETHER_ADDR_LEN);
+					if ((ret = wldev_ioctl(dev,
+						WLC_SCB_DEAUTHENTICATE_FOR_REASON,
+						&scbval, sizeof(scb_val_t), true)) != 0)
+						ANDROID_ERROR(("%s WLC_SCB_DEAUTHENTICATE error=%d\n",
+							__FUNCTION__, ret));
+				}
+			}
+		}
+	}
+	return ret;
+}
+
+/*
+ * HAPD_MAC_FILTER mac_mode mac_cnt mac_addr1 mac_addr2
+ *
+ */
+static int
+wl_android_set_mac_address_filter(struct net_device *dev, const char* str)
+{
+	int i;
+	int ret = 0;
+	int macnum = 0;
+	int macmode = MACLIST_MODE_DISABLED;
+	struct maclist *list;
+	char eabuf[ETHER_ADDR_STR_LEN];
+
+	/* string should look like below (macmode/macnum/maclist) */
+	/*   1 2 00:11:22:33:44:55 00:11:22:33:44:ff  */
+
+	/* get the MAC filter mode */
+	macmode = bcm_atoi(strsep((char**)&str, " "));
+
+	if (macmode < MACLIST_MODE_DISABLED || macmode > MACLIST_MODE_ALLOW) {
+		ANDROID_ERROR(("%s : invalid macmode %d\n", __FUNCTION__, macmode));
+		return -1;
+	}
+
+	macnum = bcm_atoi(strsep((char**)&str, " "));
+	if (macnum < 0 || macnum > MAX_NUM_MAC_FILT) {
+		ANDROID_ERROR(("%s : invalid number of MAC address entries %d\n",
+			__FUNCTION__, macnum));
+		return -1;
+	}
+	/* allocate memory for the MAC list */
+	list = (struct maclist*)kmalloc(sizeof(int) +
+		sizeof(struct ether_addr) * macnum, GFP_KERNEL);
+	if (!list) {
+		ANDROID_ERROR(("%s : failed to allocate memory\n", __FUNCTION__));
+		return -1;
+	}
+	/* prepare the MAC list */
+	list->count = htod32(macnum);
+	bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+	for (i = 0; i < list->count; i++) {
+		strncpy(eabuf, strsep((char**)&str, " "), ETHER_ADDR_STR_LEN - 1);
+		if (!(ret = bcm_ether_atoe(eabuf, &list->ea[i]))) {
+			ANDROID_ERROR(("%s : mac parsing err index=%d, addr=%s\n",
+				__FUNCTION__, i, eabuf));
+			list->count--;
+			break;
+		}
+		ANDROID_INFO(("%s : %d/%d MACADDR=%s", __FUNCTION__, i, list->count, eabuf));
+	}
+	/* set the list */
+	if ((ret = wl_android_set_ap_mac_list(dev, macmode, list)) != 0)
+		ANDROID_ERROR(("%s : Setting MAC list failed error=%d\n", __FUNCTION__, ret));
+
+	kfree(list);
+
+	return 0;
+}
+
+/**
+ * Global function definitions (declared in wl_android.h)
+ */
+
+int wl_android_wifi_on(struct net_device *dev)
+{
+	int ret = 0;
+#ifdef CONFIG_MACH_UNIVERSAL5433
+	int retry;
+	/* Do not retry old revision Helsinki Prime */
+	if (!check_rev()) {
+		retry = 1;
+	} else {
+		retry = POWERUP_MAX_RETRY;
+	}
+#else
+	int retry = POWERUP_MAX_RETRY;
+#endif /* CONFIG_MACH_UNIVERSAL5433 */
+
+	if (!dev) {
+		ANDROID_ERROR(("%s: dev is null\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	printf("%s in 1\n", __FUNCTION__);
+	dhd_net_if_lock(dev);
+	printf("%s in 2: g_wifi_on=%d\n", __FUNCTION__, g_wifi_on);
+	if (!g_wifi_on) {
+		do {
+			dhd_net_wifi_platform_set_power(dev, TRUE, WIFI_TURNON_DELAY);
+#ifdef BCMSDIO
+			ret = dhd_net_bus_resume(dev, 0);
+#endif /* BCMSDIO */
+#ifdef BCMPCIE
+			ret = dhd_net_bus_devreset(dev, FALSE);
+#endif /* BCMPCIE */
+			if (ret == 0)
+				break;
+			ANDROID_ERROR(("\nfailed to power up wifi chip, retry again (%d left) **\n\n",
+				retry));
+#ifdef BCMPCIE
+			dhd_net_bus_devreset(dev, TRUE);
+#endif /* BCMPCIE */
+			dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+		} while (retry-- > 0);
+		if (ret != 0) {
+			ANDROID_ERROR(("\nfailed to power up wifi chip, max retry reached **\n\n"));
+			goto exit;
+		}
+#ifdef BCMSDIO
+		ret = dhd_net_bus_devreset(dev, FALSE);
+		if (ret)
+			goto err;
+		dhd_net_bus_resume(dev, 1);
+#endif /* BCMSDIO */
+
+#ifndef BCMPCIE
+		if (!ret) {
+			if (dhd_dev_init_ioctl(dev) < 0) {
+				ret = -EFAULT;
+				goto err;
+			}
+		}
+#endif /* !BCMPCIE */
+		g_wifi_on = TRUE;
+	}
+
+exit:
+	printf("%s: Success\n", __FUNCTION__);
+	dhd_net_if_unlock(dev);
+	return ret;
+
+#ifdef BCMSDIO
+err:
+	dhd_net_bus_devreset(dev, TRUE);
+	dhd_net_bus_suspend(dev);
+	dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+	printf("%s: Failed\n", __FUNCTION__);
+	dhd_net_if_unlock(dev);
+	return ret;
+#endif
+}
+
+int wl_android_wifi_off(struct net_device *dev)
+{
+	int ret = 0;
+
+	if (!dev) {
+		ANDROID_ERROR(("%s: dev is null\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	printf("%s in 1\n", __FUNCTION__);
+	dhd_net_if_lock(dev);
+	printf("%s in 2: g_wifi_on=%d\n", __FUNCTION__, g_wifi_on);
+	if (g_wifi_on) {
+#if defined(BCMSDIO) || defined(BCMPCIE)
+		ret = dhd_net_bus_devreset(dev, TRUE);
+#ifdef BCMSDIO
+		dhd_net_bus_suspend(dev);
+#endif /* BCMSDIO */
+#endif /* BCMSDIO || BCMPCIE */
+		dhd_net_wifi_platform_set_power(dev, FALSE, WIFI_TURNOFF_DELAY);
+		g_wifi_on = FALSE;
+	}
+	printf("%s out\n", __FUNCTION__);
+	dhd_net_if_unlock(dev);
+
+	return ret;
+}
+
+static int wl_android_set_fwpath(struct net_device *net, char *command, int total_len)
+{
+	if ((strlen(command) - strlen(CMD_SETFWPATH)) > MOD_PARAM_PATHLEN)
+		return -1;
+	return dhd_net_set_fw_path(net, command + strlen(CMD_SETFWPATH) + 1);
+}
+
+#ifdef CONNECTION_STATISTICS
+static int
+wl_chanim_stats(struct net_device *dev, u8 *chan_idle)
+{
+	int err;
+	wl_chanim_stats_t *list;
+	/* Parameter _and_ returned buffer of chanim_stats. */
+	wl_chanim_stats_t param;
+	u8 result[WLC_IOCTL_SMLEN];
+	chanim_stats_t *stats;
+
+	memset(&param, 0, sizeof(param));
+	memset(result, 0, sizeof(result));
+
+	param.buflen = htod32(sizeof(wl_chanim_stats_t));
+	param.count = htod32(WL_CHANIM_COUNT_ONE);
+
+	if ((err = wldev_iovar_getbuf(dev, "chanim_stats", (char*)&param, sizeof(wl_chanim_stats_t),
+		(char*)result, sizeof(result), 0)) < 0) {
+		ANDROID_ERROR(("Failed to get chanim results %d \n", err));
+		return err;
+	}
+
+	list = (wl_chanim_stats_t*)result;
+
+	list->buflen = dtoh32(list->buflen);
+	list->version = dtoh32(list->version);
+	list->count = dtoh32(list->count);
+
+	if (list->buflen == 0) {
+		list->version = 0;
+		list->count = 0;
+	} else if (list->version != WL_CHANIM_STATS_VERSION) {
+		ANDROID_ERROR(("Sorry, firmware has wl_chanim_stats version %d "
+			"but driver supports only version %d.\n",
+				list->version, WL_CHANIM_STATS_VERSION));
+		list->buflen = 0;
+		list->count = 0;
+	}
+
+	stats = list->stats;
+	stats->glitchcnt = dtoh32(stats->glitchcnt);
+	stats->badplcp = dtoh32(stats->badplcp);
+	stats->chanspec = dtoh16(stats->chanspec);
+	stats->timestamp = dtoh32(stats->timestamp);
+	stats->chan_idle = dtoh32(stats->chan_idle);
+
+	ANDROID_INFO(("chanspec: 0x%4x glitch: %d badplcp: %d idle: %d timestamp: %d\n",
+		stats->chanspec, stats->glitchcnt, stats->badplcp, stats->chan_idle,
+		stats->timestamp));
+
+	*chan_idle = stats->chan_idle;
+
+	return (err);
+}
+
+static int
+wl_android_get_connection_stats(struct net_device *dev, char *command, int total_len)
+{
+	wl_cnt_t* cnt = NULL;
+	int link_speed = 0;
+	struct connection_stats *output;
+	unsigned int bufsize = 0;
+	int bytes_written = 0;
+	int ret = 0;
+
+	ANDROID_INFO(("%s: enter Get Connection Stats\n", __FUNCTION__));
+
+	if (total_len <= 0) {
+		ANDROID_ERROR(("%s: invalid buffer size %d\n", __FUNCTION__, total_len));
+		goto error;
+	}
+
+	bufsize = total_len;
+	if (bufsize < sizeof(struct connection_stats)) {
+		ANDROID_ERROR(("%s: not enough buffer size, provided=%u, requires=%u\n",
+			__FUNCTION__, bufsize,
+			sizeof(struct connection_stats)));
+		goto error;
+	}
+
+	if ((cnt = kmalloc(sizeof(*cnt), GFP_KERNEL)) == NULL) {
+		ANDROID_ERROR(("kmalloc failed\n"));
+		return -1;
+	}
+	memset(cnt, 0, sizeof(*cnt));
+
+	ret = wldev_iovar_getbuf(dev, "counters", NULL, 0, (char *)cnt, sizeof(wl_cnt_t), NULL);
+	if (ret) {
+		ANDROID_ERROR(("%s: wldev_iovar_getbuf() failed, ret=%d\n",
+			__FUNCTION__, ret));
+		goto error;
+	}
+
+	if (dtoh16(cnt->version) > WL_CNT_T_VERSION) {
+		ANDROID_ERROR(("%s: incorrect version of wl_cnt_t, expected=%u got=%u\n",
+			__FUNCTION__,  WL_CNT_T_VERSION, cnt->version));
+		goto error;
+	}
+
+	/* link_speed is in kbps */
+	ret = wldev_get_link_speed(dev, &link_speed);
+	if (ret || link_speed < 0) {
+		ANDROID_ERROR(("%s: wldev_get_link_speed() failed, ret=%d, speed=%d\n",
+			__FUNCTION__, ret, link_speed));
+		goto error;
+	}
+
+	output = (struct connection_stats *)command;
+	output->txframe   = dtoh32(cnt->txframe);
+	output->txbyte    = dtoh32(cnt->txbyte);
+	output->txerror   = dtoh32(cnt->txerror);
+	output->rxframe   = dtoh32(cnt->rxframe);
+	output->rxbyte    = dtoh32(cnt->rxbyte);
+	output->txfail    = dtoh32(cnt->txfail);
+	output->txretry   = dtoh32(cnt->txretry);
+	output->txretrie  = dtoh32(cnt->txretrie);
+	output->txrts     = dtoh32(cnt->txrts);
+	output->txnocts   = dtoh32(cnt->txnocts);
+	output->txexptime = dtoh32(cnt->txexptime);
+	output->txrate    = link_speed;
+
+	/* Channel idle ratio. */
+	if (wl_chanim_stats(dev, &(output->chan_idle)) < 0) {
+		output->chan_idle = 0;
+	};
+
+	kfree(cnt);
+
+	bytes_written = sizeof(struct connection_stats);
+	return bytes_written;
+
+error:
+	if (cnt) {
+		kfree(cnt);
+	}
+	return -1;
+}
+#endif /* CONNECTION_STATISTICS */
+
+static int
+wl_android_set_pmk(struct net_device *dev, char *command, int total_len)
+{
+	uchar pmk[33];
+	int error = 0;
+	char smbuf[WLC_IOCTL_SMLEN];
+#ifdef OKC_DEBUG
+	int i = 0;
+#endif
+
+	bzero(pmk, sizeof(pmk));
+	memcpy((char *)pmk, command + strlen("SET_PMK "), 32);
+	error = wldev_iovar_setbuf(dev, "okc_info_pmk", pmk, 32, smbuf, sizeof(smbuf), NULL);
+	if (error) {
+		ANDROID_ERROR(("Failed to set PMK for OKC, error = %d\n", error));
+	}
+#ifdef OKC_DEBUG
+	ANDROID_ERROR(("PMK is "));
+	for (i = 0; i < 32; i++)
+		ANDROID_ERROR(("%02X ", pmk[i]));
+
+	ANDROID_ERROR(("\n"));
+#endif
+	return error;
+}
+
+static int
+wl_android_okc_enable(struct net_device *dev, char *command, int total_len)
+{
+	int error = 0;
+	char okc_enable = 0;
+
+	okc_enable = command[strlen(CMD_OKC_ENABLE) + 1] - '0';
+	error = wldev_iovar_setint(dev, "okc_enable", okc_enable);
+	if (error) {
+		ANDROID_ERROR(("Failed to %s OKC, error = %d\n",
+			okc_enable ? "enable" : "disable", error));
+	}
+
+	wldev_iovar_setint(dev, "ccx_enable", 0);
+
+	return error;
+}
+
+
+
+int wl_android_set_roam_mode(struct net_device *dev, char *command, int total_len)
+{
+	int error = 0;
+	int mode = 0;
+
+	if (sscanf(command, "%*s %d", &mode) != 1) {
+		ANDROID_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+		return -1;
+	}
+
+	error = wldev_iovar_setint(dev, "roam_off", mode);
+	if (error) {
+		ANDROID_ERROR(("%s: Failed to set roaming Mode %d, error = %d\n",
+		__FUNCTION__, mode, error));
+		return -1;
+	}
+	else
+		ANDROID_ERROR(("%s: succeeded to set roaming Mode %d, error = %d\n",
+		__FUNCTION__, mode, error));
+	return 0;
+}
+
+#ifdef WL_CFG80211
+int wl_android_set_ibss_beacon_ouidata(struct net_device *dev, char *command, int total_len)
+{
+	char ie_buf[VNDR_IE_MAX_LEN];
+	char *ioctl_buf = NULL;
+	char hex[] = "XX";
+	char *pcmd = NULL;
+	int ielen = 0, datalen = 0, idx = 0, tot_len = 0;
+	vndr_ie_setbuf_t *vndr_ie = NULL;
+	s32 iecount;
+	uint32 pktflag;
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+	s32 err = BCME_OK;
+
+	/* Check the VSIE (Vendor Specific IE) which was added.
+	 *  If exist then send IOVAR to delete it
+	 */
+	if (wl_cfg80211_ibss_vsie_delete(dev) != BCME_OK) {
+		return -EINVAL;
+	}
+
+	pcmd = command + strlen(CMD_SETIBSSBEACONOUIDATA) + 1;
+	for (idx = 0; idx < DOT11_OUI_LEN; idx++) {
+		hex[0] = *pcmd++;
+		hex[1] = *pcmd++;
+		ie_buf[idx] =  (uint8)simple_strtoul(hex, NULL, 16);
+	}
+	pcmd++;
+	while ((*pcmd != '\0') && (idx < VNDR_IE_MAX_LEN)) {
+		hex[0] = *pcmd++;
+		hex[1] = *pcmd++;
+		ie_buf[idx++] =  (uint8)simple_strtoul(hex, NULL, 16);
+		datalen++;
+	}
+	tot_len = sizeof(vndr_ie_setbuf_t) + (datalen - 1);
+	vndr_ie = (vndr_ie_setbuf_t *) kzalloc(tot_len, kflags);
+	if (!vndr_ie) {
+		ANDROID_ERROR(("IE memory alloc failed\n"));
+		return -ENOMEM;
+	}
+	/* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+	strncpy(vndr_ie->cmd, "add", VNDR_IE_CMD_LEN - 1);
+	vndr_ie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+	/* Set the IE count - the buffer contains only 1 IE */
+	iecount = htod32(1);
+	memcpy((void *)&vndr_ie->vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+	/* Set packet flag to indicate that BEACON's will contain this IE */
+	pktflag = htod32(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG);
+	memcpy((void *)&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+		sizeof(u32));
+	/* Set the IE ID */
+	vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = (uchar) DOT11_MNG_PROPR_ID;
+
+	memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui, &ie_buf,
+		DOT11_OUI_LEN);
+	memcpy(&vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data,
+		&ie_buf[DOT11_OUI_LEN], datalen);
+
+	ielen = DOT11_OUI_LEN + datalen;
+	vndr_ie->vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len = (uchar) ielen;
+
+	ioctl_buf = kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+	if (!ioctl_buf) {
+		ANDROID_ERROR(("ioctl memory alloc failed\n"));
+		if (vndr_ie) {
+			kfree(vndr_ie);
+		}
+		return -ENOMEM;
+	}
+	memset(ioctl_buf, 0, WLC_IOCTL_MEDLEN);	/* init the buffer */
+	err = wldev_iovar_setbuf(dev, "ie", vndr_ie, tot_len, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+
+
+	if (err != BCME_OK) {
+		err = -EINVAL;
+		if (vndr_ie) {
+			kfree(vndr_ie);
+		}
+	}
+	else {
+		/* do NOT free 'vndr_ie' for the next process */
+		wl_cfg80211_ibss_vsie_set_buffer(vndr_ie, tot_len);
+	}
+
+	if (ioctl_buf) {
+		kfree(ioctl_buf);
+	}
+
+	return err;
+}
+#endif
+
+#if defined(BCMFW_ROAM_ENABLE)
+static int
+wl_android_set_roampref(struct net_device *dev, char *command, int total_len)
+{
+	int error = 0;
+	char smbuf[WLC_IOCTL_SMLEN];
+	uint8 buf[MAX_BUF_SIZE];
+	uint8 *pref = buf;
+	char *pcmd;
+	int num_ucipher_suites = 0;
+	int num_akm_suites = 0;
+	wpa_suite_t ucipher_suites[MAX_NUM_SUITES];
+	wpa_suite_t akm_suites[MAX_NUM_SUITES];
+	int num_tuples = 0;
+	int total_bytes = 0;
+	int total_len_left;
+	int i, j;
+	char hex[] = "XX";
+
+	pcmd = command + strlen(CMD_SET_ROAMPREF) + 1;
+	total_len_left = total_len - strlen(CMD_SET_ROAMPREF) + 1;
+
+	num_akm_suites = simple_strtoul(pcmd, NULL, 16);
+	/* Increment for number of AKM suites field + space */
+	pcmd += 3;
+	total_len_left -= 3;
+
+	/* check to make sure pcmd does not overrun */
+	if (total_len_left < (num_akm_suites * WIDTH_AKM_SUITE))
+		return -1;
+
+	memset(buf, 0, sizeof(buf));
+	memset(akm_suites, 0, sizeof(akm_suites));
+	memset(ucipher_suites, 0, sizeof(ucipher_suites));
+
+	/* Save the AKM suites passed in the command */
+	for (i = 0; i < num_akm_suites; i++) {
+		/* Store the MSB first, as required by join_pref */
+		for (j = 0; j < 4; j++) {
+			hex[0] = *pcmd++;
+			hex[1] = *pcmd++;
+			buf[j] = (uint8)simple_strtoul(hex, NULL, 16);
+		}
+		memcpy((uint8 *)&akm_suites[i], buf, sizeof(uint32));
+	}
+
+	total_len_left -= (num_akm_suites * WIDTH_AKM_SUITE);
+	num_ucipher_suites = simple_strtoul(pcmd, NULL, 16);
+	/* Increment for number of cipher suites field + space */
+	pcmd += 3;
+	total_len_left -= 3;
+
+	if (total_len_left < (num_ucipher_suites * WIDTH_AKM_SUITE))
+		return -1;
+
+	/* Save the cipher suites passed in the command */
+	for (i = 0; i < num_ucipher_suites; i++) {
+		/* Store the MSB first, as required by join_pref */
+		for (j = 0; j < 4; j++) {
+			hex[0] = *pcmd++;
+			hex[1] = *pcmd++;
+			buf[j] = (uint8)simple_strtoul(hex, NULL, 16);
+		}
+		memcpy((uint8 *)&ucipher_suites[i], buf, sizeof(uint32));
+	}
+
+	/* Join preference for RSSI
+	 * Type	  : 1 byte (0x01)
+	 * Length : 1 byte (0x02)
+	 * Value  : 2 bytes	(reserved)
+	 */
+	*pref++ = WL_JOIN_PREF_RSSI;
+	*pref++ = JOIN_PREF_RSSI_LEN;
+	*pref++ = 0;
+	*pref++ = 0;
+
+	/* Join preference for WPA
+	 * Type	  : 1 byte (0x02)
+	 * Length : 1 byte (not used)
+	 * Value  : (variable length)
+	 *		reserved: 1 byte
+	 *      count	: 1 byte (no of tuples)
+	 *		Tuple1	: 12 bytes
+	 *			akm[4]
+	 *			ucipher[4]
+	 *			mcipher[4]
+	 *		Tuple2	: 12 bytes
+	 *		Tuplen	: 12 bytes
+	 */
+	num_tuples = num_akm_suites * num_ucipher_suites;
+	if (num_tuples != 0) {
+		if (num_tuples <= JOIN_PREF_MAX_WPA_TUPLES) {
+			*pref++ = WL_JOIN_PREF_WPA;
+			*pref++ = 0;
+			*pref++ = 0;
+			*pref++ = (uint8)num_tuples;
+			total_bytes = JOIN_PREF_RSSI_SIZE + JOIN_PREF_WPA_HDR_SIZE +
+				(JOIN_PREF_WPA_TUPLE_SIZE * num_tuples);
+		} else {
+			ANDROID_ERROR(("%s: Too many wpa configs for join_pref \n", __FUNCTION__));
+			return -1;
+		}
+	} else {
+		/* No WPA config, configure only RSSI preference */
+		total_bytes = JOIN_PREF_RSSI_SIZE;
+	}
+
+	/* akm-ucipher-mcipher tuples in the format required for join_pref */
+	for (i = 0; i < num_ucipher_suites; i++) {
+		for (j = 0; j < num_akm_suites; j++) {
+			memcpy(pref, (uint8 *)&akm_suites[j], WPA_SUITE_LEN);
+			pref += WPA_SUITE_LEN;
+			memcpy(pref, (uint8 *)&ucipher_suites[i], WPA_SUITE_LEN);
+			pref += WPA_SUITE_LEN;
+			/* Set to 0 to match any available multicast cipher */
+			memset(pref, 0, WPA_SUITE_LEN);
+			pref += WPA_SUITE_LEN;
+		}
+	}
+
+	prhex("join pref", (uint8 *)buf, total_bytes);
+	error = wldev_iovar_setbuf(dev, "join_pref", buf, total_bytes, smbuf, sizeof(smbuf), NULL);
+	if (error) {
+		ANDROID_ERROR(("Failed to set join_pref, error = %d\n", error));
+	}
+	return error;
+}
+#endif /* defined(BCMFW_ROAM_ENABLE */
+
+#ifdef WL_CFG80211
+static int
+wl_android_iolist_add(struct net_device *dev, struct list_head *head, struct io_cfg *config)
+{
+	struct io_cfg *resume_cfg;
+	s32 ret;
+
+	resume_cfg = kzalloc(sizeof(struct io_cfg), GFP_KERNEL);
+	if (!resume_cfg)
+		return -ENOMEM;
+
+	if (config->iovar) {
+		ret = wldev_iovar_getint(dev, config->iovar, &resume_cfg->param);
+		if (ret) {
+			ANDROID_ERROR(("%s: Failed to get current %s value\n",
+				__FUNCTION__, config->iovar));
+			goto error;
+		}
+
+		ret = wldev_iovar_setint(dev, config->iovar, config->param);
+		if (ret) {
+			ANDROID_ERROR(("%s: Failed to set %s to %d\n", __FUNCTION__,
+				config->iovar, config->param));
+			goto error;
+		}
+
+		resume_cfg->iovar = config->iovar;
+	} else {
+		resume_cfg->arg = kzalloc(config->len, GFP_KERNEL);
+		if (!resume_cfg->arg) {
+			ret = -ENOMEM;
+			goto error;
+		}
+		ret = wldev_ioctl(dev, config->ioctl, resume_cfg->arg, config->len, false);
+		if (ret) {
+			ANDROID_ERROR(("%s: Failed to get ioctl %d\n", __FUNCTION__,
+				config->ioctl));
+			goto error;
+		}
+		ret = wldev_ioctl(dev, config->ioctl + 1, config->arg, config->len, true);
+		if (ret) {
+			ANDROID_ERROR(("%s: Failed to set %s to %d\n", __FUNCTION__,
+				config->iovar, config->param));
+			goto error;
+		}
+		if (config->ioctl + 1 == WLC_SET_PM)
+			wl_cfg80211_update_power_mode(dev);
+		resume_cfg->ioctl = config->ioctl;
+		resume_cfg->len = config->len;
+	}
+
+	list_add(&resume_cfg->list, head);
+
+	return 0;
+error:
+	kfree(resume_cfg->arg);
+	kfree(resume_cfg);
+	return ret;
+}
+
+static void
+wl_android_iolist_resume(struct net_device *dev, struct list_head *head)
+{
+	struct io_cfg *config;
+	struct list_head *cur, *q;
+	s32 ret = 0;
+
+	list_for_each_safe(cur, q, head) {
+		config = list_entry(cur, struct io_cfg, list);
+		if (config->iovar) {
+			if (!ret)
+				ret = wldev_iovar_setint(dev, config->iovar,
+					config->param);
+		} else {
+			if (!ret)
+				ret = wldev_ioctl(dev, config->ioctl + 1,
+					config->arg, config->len, true);
+			if (config->ioctl + 1 == WLC_SET_PM)
+				wl_cfg80211_update_power_mode(dev);
+			kfree(config->arg);
+		}
+		list_del(cur);
+		kfree(config);
+	}
+}
+
+static int
+wl_android_set_miracast(struct net_device *dev, char *command, int total_len)
+{
+	int mode, val;
+	int ret = 0;
+	struct io_cfg config;
+
+	if (sscanf(command, "%*s %d", &mode) != 1) {
+		ANDROID_ERROR(("%s: Failed to get Parameter\n", __FUNCTION__));
+		return -1;
+	}
+
+	ANDROID_INFO(("%s: enter miracast mode %d\n", __FUNCTION__, mode));
+
+	if (miracast_cur_mode == mode)
+		return 0;
+
+	wl_android_iolist_resume(dev, &miracast_resume_list);
+	miracast_cur_mode = MIRACAST_MODE_OFF;
+
+	switch (mode) {
+	case MIRACAST_MODE_SOURCE:
+		/* setting mchan_algo to platform specific value */
+		config.iovar = "mchan_algo";
+
+		ret = wldev_ioctl(dev, WLC_GET_BCNPRD, &val, sizeof(int), false);
+		if (!ret && val > 100) {
+			config.param = 0;
+			ANDROID_ERROR(("%s: Connected station's beacon interval: "
+				"%d and set mchan_algo to %d \n",
+				__FUNCTION__, val, config.param));
+		}
+		else {
+			config.param = MIRACAST_MCHAN_ALGO;
+		}
+		ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+		if (ret)
+			goto resume;
+
+		/* setting mchan_bw to platform specific value */
+		config.iovar = "mchan_bw";
+		config.param = MIRACAST_MCHAN_BW;
+		ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+		if (ret)
+			goto resume;
+
+		/* setting apmdu to platform specific value */
+		config.iovar = "ampdu_mpdu";
+		config.param = MIRACAST_AMPDU_SIZE;
+		ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+		if (ret)
+			goto resume;
+		/* FALLTROUGH */
+		/* Source mode shares most configurations with sink mode.
+		 * Fall through here to avoid code duplication
+		 */
+	case MIRACAST_MODE_SINK:
+		/* disable internal roaming */
+		config.iovar = "roam_off";
+		config.param = 1;
+		ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+		if (ret)
+			goto resume;
+		/* tunr off pm */
+		val = 0;
+		config.iovar = NULL;
+		config.ioctl = WLC_GET_PM;
+		config.arg = &val;
+		config.len = sizeof(int);
+		ret = wl_android_iolist_add(dev, &miracast_resume_list, &config);
+		if (ret)
+			goto resume;
+
+		break;
+	case MIRACAST_MODE_OFF:
+	default:
+		break;
+	}
+	miracast_cur_mode = mode;
+
+	return 0;
+
+resume:
+	ANDROID_ERROR(("%s: turnoff miracast mode because of err%d\n", __FUNCTION__, ret));
+	wl_android_iolist_resume(dev, &miracast_resume_list);
+	return ret;
+}
+#endif
+
+#define NETLINK_OXYGEN     30
+#define AIBSS_BEACON_TIMEOUT	10
+
+static struct sock *nl_sk = NULL;
+
+static void wl_netlink_recv(struct sk_buff *skb)
+{
+	ANDROID_ERROR(("netlink_recv called\n"));
+}
+
+static int wl_netlink_init(void)
+{
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0))
+	struct netlink_kernel_cfg cfg = {
+		.input	= wl_netlink_recv,
+	};
+#endif
+
+	if (nl_sk != NULL) {
+		ANDROID_ERROR(("nl_sk already exist\n"));
+		return BCME_ERROR;
+	}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0))
+	nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN,
+		0, wl_netlink_recv, NULL, THIS_MODULE);
+#elif (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0))
+	nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN, THIS_MODULE, &cfg);
+#else
+	nl_sk = netlink_kernel_create(&init_net, NETLINK_OXYGEN, &cfg);
+#endif
+
+	if (nl_sk == NULL) {
+		ANDROID_ERROR(("nl_sk is not ready\n"));
+		return BCME_ERROR;
+	}
+
+	return BCME_OK;
+}
+
+static void wl_netlink_deinit(void)
+{
+	if (nl_sk) {
+		netlink_kernel_release(nl_sk);
+		nl_sk = NULL;
+	}
+}
+
+s32
+wl_netlink_send_msg(int pid, int type, int seq, void *data, size_t size)
+{
+	struct sk_buff *skb = NULL;
+	struct nlmsghdr *nlh = NULL;
+	int ret = -1;
+
+	if (nl_sk == NULL) {
+		ANDROID_ERROR(("nl_sk was not initialized\n"));
+		goto nlmsg_failure;
+	}
+
+	skb = alloc_skb(NLMSG_SPACE(size), GFP_ATOMIC);
+	if (skb == NULL) {
+		ANDROID_ERROR(("failed to allocate memory\n"));
+		goto nlmsg_failure;
+	}
+
+	nlh = nlmsg_put(skb, 0, 0, 0, size, 0);
+	if (nlh == NULL) {
+		ANDROID_ERROR(("failed to build nlmsg, skb_tailroom:%d, nlmsg_total_size:%d\n",
+			skb_tailroom(skb), nlmsg_total_size(size)));
+		dev_kfree_skb(skb);
+		goto nlmsg_failure;
+	}
+
+	memcpy(nlmsg_data(nlh), data, size);
+	nlh->nlmsg_seq = seq;
+	nlh->nlmsg_type = type;
+
+	/* netlink_unicast() takes ownership of the skb and frees it itself. */
+	ret = netlink_unicast(nl_sk, skb, pid, 0);
+	ANDROID_TRACE(("netlink_unicast() pid=%d, ret=%d\n", pid, ret));
+
+nlmsg_failure:
+	return ret;
+}
+
+#ifdef WLAIBSS
+static int wl_android_set_ibss_txfail_event(struct net_device *dev, char *command, int total_len)
+{
+	int err = 0;
+	int retry = 0;
+	int pid = 0;
+	aibss_txfail_config_t txfail_config = {0, 0, 0, 0};
+	char smbuf[WLC_IOCTL_SMLEN];
+
+	if (sscanf(command, CMD_SETIBSSTXFAILEVENT " %d %d", &retry, &pid) <= 0) {
+		ANDROID_ERROR(("Failed to get Parameter from : %s\n", command));
+		return -1;
+	}
+
+	/* set pid, and if the event was happened, let's send a notification through netlink */
+	wl_cfg80211_set_txfail_pid(pid);
+
+	/* If retry value is 0, it disables the functionality for TX Fail. */
+	if (retry > 0) {
+		txfail_config.max_tx_retry = retry;
+		txfail_config.bcn_timeout = 0;	/* 0 : disable tx fail from beacon */
+	}
+	txfail_config.version = AIBSS_TXFAIL_CONFIG_VER_0;
+	txfail_config.len = sizeof(txfail_config);
+
+	err = wldev_iovar_setbuf(dev, "aibss_txfail_config", (void *) &txfail_config,
+		sizeof(aibss_txfail_config_t), smbuf, WLC_IOCTL_SMLEN, NULL);
+	ANDROID_TRACE(("retry=%d, pid=%d, err=%d\n", retry, pid, err));
+
+	return ((err == 0)?total_len:err);
+}
+
+static int wl_android_get_ibss_peer_info(struct net_device *dev, char *command,
+	int total_len, bool bAll)
+{
+	int error;
+	int bytes_written = 0;
+	void *buf = NULL;
+	bss_peer_list_info_t peer_list_info;
+	bss_peer_info_t *peer_info;
+	int i;
+	bool found = false;
+	struct ether_addr mac_ea;
+
+	ANDROID_TRACE(("get ibss peer info(%s)\n", bAll?"true":"false"));
+
+	if (!bAll) {
+		if (sscanf (command, "GETIBSSPEERINFO %02x:%02x:%02x:%02x:%02x:%02x",
+			(unsigned int *)&mac_ea.octet[0], (unsigned int *)&mac_ea.octet[1],
+			(unsigned int *)&mac_ea.octet[2], (unsigned int *)&mac_ea.octet[3],
+			(unsigned int *)&mac_ea.octet[4], (unsigned int *)&mac_ea.octet[5]) != 6) {
+			ANDROID_TRACE(("invalid MAC address\n"));
+			return -1;
+		}
+	}
+
+	if ((buf = kmalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL)) == NULL) {
+		ANDROID_ERROR(("kmalloc failed\n"));
+		return -1;
+	}
+
+	error = wldev_iovar_getbuf(dev, "bss_peer_info", NULL, 0, buf, WLC_IOCTL_MAXLEN, NULL);
+	if (unlikely(error)) {
+		ANDROID_ERROR(("could not get ibss peer info (%d)\n", error));
+		kfree(buf);
+		return -1;
+	}
+
+	memcpy(&peer_list_info, buf, sizeof(peer_list_info));
+	peer_list_info.version = htod16(peer_list_info.version);
+	peer_list_info.bss_peer_info_len = htod16(peer_list_info.bss_peer_info_len);
+	peer_list_info.count = htod32(peer_list_info.count);
+
+	ANDROID_TRACE(("ver:%d, len:%d, count:%d\n", peer_list_info.version,
+		peer_list_info.bss_peer_info_len, peer_list_info.count));
+
+	if (peer_list_info.count > 0) {
+		if (bAll)
+			bytes_written += sprintf(&command[bytes_written], "%u ",
+				peer_list_info.count);
+
+		peer_info = (bss_peer_info_t *) ((void *)buf + BSS_PEER_LIST_INFO_FIXED_LEN);
+
+
+		for (i = 0; i < peer_list_info.count; i++) {
+
+			ANDROID_TRACE(("index:%d rssi:%d, tx:%u, rx:%u\n", i, peer_info->rssi,
+				peer_info->tx_rate, peer_info->rx_rate));
+
+			if (!bAll &&
+				memcmp(&mac_ea, &peer_info->ea, sizeof(struct ether_addr)) == 0) {
+				found = true;
+			}
+
+			if (bAll || found) {
+				bytes_written += sprintf(&command[bytes_written], MACF,
+					ETHER_TO_MACF(peer_info->ea));
+				bytes_written += sprintf(&command[bytes_written], " %u %d ",
+					peer_info->tx_rate/1000, peer_info->rssi);
+			}
+
+			if (found)
+				break;
+
+			peer_info = (bss_peer_info_t *)((void *)peer_info+sizeof(bss_peer_info_t));
+		}
+	}
+	else {
+		ANDROID_ERROR(("could not get ibss peer info : no item\n"));
+	}
+	bytes_written += sprintf(&command[bytes_written], "%s", "\0");
+
+	ANDROID_TRACE(("command(%u):%s\n", total_len, command));
+	ANDROID_TRACE(("bytes_written:%d\n", bytes_written));
+
+	kfree(buf);
+	return bytes_written;
+}
+
+int wl_android_set_ibss_routetable(struct net_device *dev, char *command, int total_len)
+{
+
+	char *pcmd = command;
+	char *str = NULL;
+
+	ibss_route_tbl_t *route_tbl = NULL;
+	char *ioctl_buf = NULL;
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+	s32 err = BCME_OK;
+	uint32 route_tbl_len;
+	uint32 entries;
+	char *endptr;
+	uint32 i = 0;
+	struct ipv4_addr  dipaddr;
+	struct ether_addr ea;
+
+	route_tbl_len = sizeof(ibss_route_tbl_t) +
+		(MAX_IBSS_ROUTE_TBL_ENTRY - 1) * sizeof(ibss_route_entry_t);
+	route_tbl = (ibss_route_tbl_t *)kzalloc(route_tbl_len, kflags);
+	if (!route_tbl) {
+		ANDROID_ERROR(("Route TBL alloc failed\n"));
+		return -ENOMEM;
+	}
+	ioctl_buf = kzalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+	if (!ioctl_buf) {
+		ANDROID_ERROR(("ioctl memory alloc failed\n"));
+		if (route_tbl) {
+			kfree(route_tbl);
+		}
+		return -ENOMEM;
+	}
+	memset(ioctl_buf, 0, WLC_IOCTL_MEDLEN);
+
+	/* drop command */
+	str = bcmstrtok(&pcmd, " ", NULL);
+
+	/* get count */
+	str = bcmstrtok(&pcmd, " ",  NULL);
+	if (!str) {
+		ANDROID_ERROR(("Invalid number parameter %s\n", str));
+		err = -EINVAL;
+		goto exit;
+	}
+	entries = bcm_strtoul(str, &endptr, 0);
+	if (*endptr != '\0') {
+		ANDROID_ERROR(("Invalid number parameter %s\n", str));
+		err = -EINVAL;
+		goto exit;
+	}
+	ANDROID_INFO(("Routing table count:%d\n", entries));
+	route_tbl->num_entry = entries;
+
+	for (i = 0; i < entries; i++) {
+		str = bcmstrtok(&pcmd, " ", NULL);
+		if (!str || !bcm_atoipv4(str, &dipaddr)) {
+			ANDROID_ERROR(("Invalid ip string %s\n", str));
+			err = -EINVAL;
+			goto exit;
+		}
+
+
+		str = bcmstrtok(&pcmd, " ", NULL);
+		if (!str || !bcm_ether_atoe(str, &ea)) {
+			ANDROID_ERROR(("Invalid ethernet string %s\n", str));
+			err = -EINVAL;
+			goto exit;
+		}
+		bcopy(&dipaddr, &route_tbl->route_entry[i].ipv4_addr, IPV4_ADDR_LEN);
+		bcopy(&ea, &route_tbl->route_entry[i].nexthop, ETHER_ADDR_LEN);
+	}
+
+	route_tbl_len = sizeof(ibss_route_tbl_t) +
+		((!entries?0:(entries - 1)) * sizeof(ibss_route_entry_t));
+	err = wldev_iovar_setbuf(dev, "ibss_route_tbl",
+		route_tbl, route_tbl_len, ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+	if (err != BCME_OK) {
+		ANDROID_ERROR(("Fail to set iovar %d\n", err));
+		err = -EINVAL;
+	}
+
+exit:
+	if (route_tbl)
+		kfree(route_tbl);
+	if (ioctl_buf)
+		kfree(ioctl_buf);
+	return err;
+
+}
+
+int
+wl_android_set_ibss_ampdu(struct net_device *dev, char *command, int total_len)
+{
+	char *pcmd = command;
+	char *str = NULL, *endptr = NULL;
+	struct ampdu_aggr aggr;
+	char smbuf[WLC_IOCTL_SMLEN];
+	int idx;
+	int err = 0;
+	int wme_AC2PRIO[AC_COUNT][2] = {
+		{PRIO_8021D_VO, PRIO_8021D_NC},		/* AC_VO - 3 */
+		{PRIO_8021D_CL, PRIO_8021D_VI},		/* AC_VI - 2 */
+		{PRIO_8021D_BK, PRIO_8021D_NONE},	/* AC_BK - 1 */
+		{PRIO_8021D_BE, PRIO_8021D_EE}};	/* AC_BE - 0 */
+
+	ANDROID_TRACE(("set ibss ampdu:%s\n", command));
+
+	memset(&aggr, 0, sizeof(aggr));
+	/* Cofigure all priorities */
+	aggr.conf_TID_bmap = NBITMASK(NUMPRIO);
+
+	/* acquire parameters */
+	/* drop command */
+	str = bcmstrtok(&pcmd, " ", NULL);
+
+	for (idx = 0; idx < AC_COUNT; idx++) {
+		bool on;
+		str = bcmstrtok(&pcmd, " ", NULL);
+		if (!str) {
+			ANDROID_ERROR(("Invalid parameter : %s\n", pcmd));
+			return -EINVAL;
+		}
+		on = bcm_strtoul(str, &endptr, 0) ? TRUE : FALSE;
+		if (*endptr != '\0') {
+			ANDROID_ERROR(("Invalid number format %s\n", str));
+			return -EINVAL;
+		}
+		if (on) {
+			setbit(&aggr.enab_TID_bmap, wme_AC2PRIO[idx][0]);
+			setbit(&aggr.enab_TID_bmap, wme_AC2PRIO[idx][1]);
+		}
+	}
+
+	err = wldev_iovar_setbuf(dev, "ampdu_txaggr", (void *)&aggr,
+	sizeof(aggr), smbuf, WLC_IOCTL_SMLEN, NULL);
+
+	return ((err == 0) ? total_len : err);
+}
+
+int wl_android_set_ibss_antenna(struct net_device *dev, char *command, int total_len)
+{
+	char *pcmd = command;
+	char *str = NULL;
+	int txchain, rxchain;
+	int err = 0;
+
+	ANDROID_TRACE(("set ibss antenna:%s\n", command));
+
+	/* acquire parameters */
+	/* drop command */
+	str = bcmstrtok(&pcmd, " ", NULL);
+
+	/* TX chain */
+	str = bcmstrtok(&pcmd, " ", NULL);
+	if (!str) {
+		ANDROID_ERROR(("Invalid parameter : %s\n", pcmd));
+		return -EINVAL;
+	}
+	txchain = bcm_atoi(str);
+
+	/* RX chain */
+	str = bcmstrtok(&pcmd, " ", NULL);
+	if (!str) {
+		ANDROID_ERROR(("Invalid parameter : %s\n", pcmd));
+		return -EINVAL;
+	}
+	rxchain = bcm_atoi(str);
+
+	err = wldev_iovar_setint(dev, "txchain", txchain);
+	if (err != 0)
+		return err;
+	err = wldev_iovar_setint(dev, "rxchain", rxchain);
+	return ((err == 0)?total_len:err);
+}
+#endif /* WLAIBSS */
+
+int wl_keep_alive_set(struct net_device *dev, char* extra, int total_len)
+{
+	char 				buf[256];
+	const char 			*str;
+	wl_mkeep_alive_pkt_t	mkeep_alive_pkt;
+	wl_mkeep_alive_pkt_t	*mkeep_alive_pktp;
+	int					buf_len;
+	int					str_len;
+	int res 				= -1;
+	uint period_msec = 0;
+
+	if (extra == NULL)
+	{
+		 ANDROID_ERROR(("%s: extra is NULL\n", __FUNCTION__));
+		 return -1;
+	}
+	if (sscanf(extra, "%d", &period_msec) != 1)
+	{
+		 ANDROID_ERROR(("%s: sscanf error. check period_msec value\n", __FUNCTION__));
+		 return -EINVAL;
+	}
+	ANDROID_ERROR(("%s: period_msec is %d\n", __FUNCTION__, period_msec));
+
+	memset(&mkeep_alive_pkt, 0, sizeof(wl_mkeep_alive_pkt_t));
+
+	str = "mkeep_alive";
+	str_len = strlen(str);
+	strncpy(buf, str, str_len);
+	buf[ str_len ] = '\0';
+	mkeep_alive_pktp = (wl_mkeep_alive_pkt_t *) (buf + str_len + 1);
+	mkeep_alive_pkt.period_msec = period_msec;
+	buf_len = str_len + 1;
+	mkeep_alive_pkt.version = htod16(WL_MKEEP_ALIVE_VERSION);
+	mkeep_alive_pkt.length = htod16(WL_MKEEP_ALIVE_FIXED_LEN);
+
+	/* Setup keep alive zero for null packet generation */
+	mkeep_alive_pkt.keep_alive_id = 0;
+	mkeep_alive_pkt.len_bytes = 0;
+	buf_len += WL_MKEEP_ALIVE_FIXED_LEN;
+	/* Keep-alive attributes are set in local	variable (mkeep_alive_pkt), and
+	 * then memcpy'ed into buffer (mkeep_alive_pktp) since there is no
+	 * guarantee that the buffer is properly aligned.
+	 */
+	memcpy((char *)mkeep_alive_pktp, &mkeep_alive_pkt, WL_MKEEP_ALIVE_FIXED_LEN);
+
+	if ((res = wldev_ioctl(dev, WLC_SET_VAR, buf, buf_len, TRUE)) < 0)
+	{
+		ANDROID_ERROR(("%s:keep_alive set failed. res[%d]\n", __FUNCTION__, res));
+	}
+	else
+	{
+		ANDROID_ERROR(("%s:keep_alive set ok. res[%d]\n", __FUNCTION__, res));
+	}
+
+	return res;
+}
+
+
+static const char *
+get_string_by_separator(char *result, int result_len, const char *src, char separator)
+{
+	char *end = result + result_len - 1;
+	while ((result != end) && (*src != separator) && (*src)) {
+		*result++ = *src++;
+	}
+	*result = 0;
+	if (*src == separator)
+		++src;
+	return src;
+}
+
+int
+wl_android_set_roam_offload_bssid_list(struct net_device *dev, const char *cmd)
+{
+	char sbuf[32];
+	int i, cnt, size, err, ioctl_buf_len;
+	roamoffl_bssid_list_t *bssid_list;
+	const char *str = cmd;
+	char *ioctl_buf;
+
+	str = get_string_by_separator(sbuf, 32, str, ',');
+	cnt = bcm_atoi(sbuf);
+	cnt = MIN(cnt, MAX_ROAMOFFL_BSSID_NUM);
+	size = sizeof(int) + sizeof(struct ether_addr) * cnt;
+	ANDROID_ERROR(("ROAM OFFLOAD BSSID LIST %d BSSIDs, size %d\n", cnt, size));
+	bssid_list = kmalloc(size, GFP_KERNEL);
+	if (bssid_list == NULL) {
+		ANDROID_ERROR(("%s: memory alloc for bssid list(%d) failed\n",
+			__FUNCTION__, size));
+		return -ENOMEM;
+	}
+	ioctl_buf_len = size + 64;
+	ioctl_buf = kmalloc(ioctl_buf_len, GFP_KERNEL);
+	if (ioctl_buf == NULL) {
+		ANDROID_ERROR(("%s: memory alloc for ioctl_buf(%d) failed\n",
+			__FUNCTION__, ioctl_buf_len));
+		kfree(bssid_list);
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < cnt; i++) {
+		str = get_string_by_separator(sbuf, 32, str, ',');
+		if (bcm_ether_atoe(sbuf, &bssid_list->bssid[i]) == 0) {
+			ANDROID_ERROR(("%s: Invalid station MAC Address!!!\n", __FUNCTION__));
+			kfree(bssid_list);
+			kfree(ioctl_buf);
+			return -1;
+		}
+	}
+
+	bssid_list->cnt = cnt;
+	err = wldev_iovar_setbuf(dev, "roamoffl_bssid_list",
+		bssid_list, size, ioctl_buf, ioctl_buf_len, NULL);
+	kfree(bssid_list);
+	kfree(ioctl_buf);
+
+	return err;
+}
+
+#ifdef P2PRESP_WFDIE_SRC
+static int wl_android_get_wfdie_resp(struct net_device *dev, char *command, int total_len)
+{
+	int error = 0;
+	int bytes_written = 0;
+	int only_resp_wfdsrc = 0;
+
+	error = wldev_iovar_getint(dev, "p2p_only_resp_wfdsrc", &only_resp_wfdsrc);
+	if (error) {
+		ANDROID_ERROR(("%s: Failed to get the mode for only_resp_wfdsrc, error = %d\n",
+			__FUNCTION__, error));
+		return -1;
+	}
+
+	bytes_written = snprintf(command, total_len, "%s %d",
+		CMD_P2P_GET_WFDIE_RESP, only_resp_wfdsrc);
+
+	return bytes_written;
+}
+
+static int wl_android_set_wfdie_resp(struct net_device *dev, int only_resp_wfdsrc)
+{
+	int error = 0;
+
+	error = wldev_iovar_setint(dev, "p2p_only_resp_wfdsrc", only_resp_wfdsrc);
+	if (error) {
+		ANDROID_ERROR(("%s: Failed to set only_resp_wfdsrc %d, error = %d\n",
+			__FUNCTION__, only_resp_wfdsrc, error));
+		return -1;
+	}
+
+	return 0;
+}
+#endif /* P2PRESP_WFDIE_SRC */
+
+static int wl_android_get_link_status(struct net_device *dev, char *command,
+	int total_len)
+{
+	int bytes_written, error, result = 0, single_stream, stf = -1, i, nss = 0, mcs_map;
+	uint32 rspec;
+	uint encode, rate, txexp;
+	struct wl_bss_info *bi;
+	int datalen = sizeof(uint32) + sizeof(wl_bss_info_t);
+	char buf[datalen];
+
+	/* get BSS information */
+	*(u32 *) buf = htod32(datalen);
+	error = wldev_ioctl(dev, WLC_GET_BSS_INFO, (void *)buf, datalen, false);
+	if (unlikely(error)) {
+		ANDROID_ERROR(("Could not get bss info %d\n", error));
+		return -1;
+	}
+
+	bi = (struct wl_bss_info *) (buf + sizeof(uint32));
+
+	for (i = 0; i < ETHER_ADDR_LEN; i++) {
+		if (bi->BSSID.octet[i] > 0) {
+			break;
+		}
+	}
+
+	if (i == ETHER_ADDR_LEN) {
+		ANDROID_TRACE(("No BSSID\n"));
+		return -1;
+	}
+
+	/* check VHT capability at beacon */
+	if (bi->vht_cap) {
+		if (CHSPEC_IS5G(bi->chanspec)) {
+			result |= WL_ANDROID_LINK_AP_VHT_SUPPORT;
+		}
+	}
+
+	/* get a rspec (radio spectrum) rate */
+	error = wldev_iovar_getint(dev, "nrate", &rspec);
+	if (unlikely(error) || rspec == 0) {
+		ANDROID_ERROR(("get link status error (%d)\n", error));
+		return -1;
+	}
+
+	encode = (rspec & WL_RSPEC_ENCODING_MASK);
+	rate = (rspec & WL_RSPEC_RATE_MASK);
+	txexp = (rspec & WL_RSPEC_TXEXP_MASK) >> WL_RSPEC_TXEXP_SHIFT;
+
+	switch (encode) {
+	case WL_RSPEC_ENCODE_HT:
+		/* check Rx MCS Map for HT */
+		for (i = 0; i < MAX_STREAMS_SUPPORTED; i++) {
+			int8 bitmap = 0xFF;
+			if (i == MAX_STREAMS_SUPPORTED-1) {
+				bitmap = 0x7F;
+			}
+			if (bi->basic_mcs[i] & bitmap) {
+				nss++;
+			}
+		}
+		break;
+	case WL_RSPEC_ENCODE_VHT:
+		/* check Rx MCS Map for VHT */
+		for (i = 1; i <= VHT_CAP_MCS_MAP_NSS_MAX; i++) {
+			mcs_map = VHT_MCS_MAP_GET_MCS_PER_SS(i, dtoh16(bi->vht_rxmcsmap));
+			if (mcs_map != VHT_CAP_MCS_MAP_NONE) {
+				nss++;
+			}
+		}
+		break;
+	}
+
+	/* check MIMO capability with nss in beacon */
+	if (nss > 1) {
+		result |= WL_ANDROID_LINK_AP_MIMO_SUPPORT;
+	}
+
+	single_stream = (encode == WL_RSPEC_ENCODE_RATE) ||
+		((encode == WL_RSPEC_ENCODE_HT) && rate < 8) ||
+		((encode == WL_RSPEC_ENCODE_VHT) &&
+		((rspec & WL_RSPEC_VHT_NSS_MASK) >> WL_RSPEC_VHT_NSS_SHIFT) == 1);
+
+	if (txexp == 0) {
+		if ((rspec & WL_RSPEC_STBC) && single_stream) {
+			stf = OLD_NRATE_STF_STBC;
+		} else {
+			stf = (single_stream) ? OLD_NRATE_STF_SISO : OLD_NRATE_STF_SDM;
+		}
+	} else if (txexp == 1 && single_stream) {
+		stf = OLD_NRATE_STF_CDD;
+	}
+
+	/* check 11ac (VHT) */
+	if (encode == WL_RSPEC_ENCODE_VHT) {
+		if (CHSPEC_IS5G(bi->chanspec)) {
+			result |= WL_ANDROID_LINK_VHT;
+		}
+	}
+
+	/* check MIMO */
+	if (result & WL_ANDROID_LINK_AP_MIMO_SUPPORT) {
+		switch (stf) {
+		case OLD_NRATE_STF_SISO:
+			break;
+		case OLD_NRATE_STF_CDD:
+		case OLD_NRATE_STF_STBC:
+			result |= WL_ANDROID_LINK_MIMO;
+			break;
+		case OLD_NRATE_STF_SDM:
+			if (!single_stream) {
+				result |= WL_ANDROID_LINK_MIMO;
+			}
+			break;
+		}
+	}
+
+	ANDROID_TRACE(("%s:result=%d, stf=%d, single_stream=%d, mcs map=%d\n",
+		__FUNCTION__, result, stf, single_stream, nss));
+
+	bytes_written = sprintf(command, "%s %d", CMD_GET_LINK_STATUS, result);
+
+	return bytes_written;
+}
+
+int
+wl_android_get_channel(
+struct net_device *dev, char* command, int total_len)
+{
+	int ret;
+	channel_info_t ci;
+	int bytes_written = 0;
+
+	if (!(ret = wldev_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(channel_info_t), FALSE))) {
+		ANDROID_TRACE(("hw_channel %d\n", ci.hw_channel));
+		ANDROID_TRACE(("target_channel %d\n", ci.target_channel));
+		ANDROID_TRACE(("scan_channel %d\n", ci.scan_channel));
+		bytes_written = snprintf(command, sizeof(channel_info_t)+2, "channel %d", ci.hw_channel);
+		ANDROID_TRACE(("%s: command result is %s\n", __FUNCTION__, command));
+	}
+
+	return bytes_written;
+}
+
+int
+wl_android_set_roam_trigger(
+struct net_device *dev, char* command, int total_len)
+{
+	int ret = 0;
+	int roam_trigger[2];
+
+	sscanf(command, "%*s %10d", &roam_trigger[0]);
+	roam_trigger[1] = WLC_BAND_ALL;
+
+	ret = wldev_ioctl(dev, WLC_SET_ROAM_TRIGGER, roam_trigger, sizeof(roam_trigger), 1);
+	if (ret)
+		ANDROID_ERROR(("WLC_SET_ROAM_TRIGGER ERROR %d ret=%d\n", roam_trigger[0], ret));
+
+	return ret;
+}
+
+int
+wl_android_get_roam_trigger(
+struct net_device *dev, char *command, int total_len)
+{
+	int ret;
+	int bytes_written;
+	int roam_trigger[2] = {0, 0};
+	int trigger[2]= {0, 0};
+
+	roam_trigger[1] = WLC_BAND_2G;
+	ret = wldev_ioctl(dev, WLC_GET_ROAM_TRIGGER, roam_trigger, sizeof(roam_trigger), 0);
+	if (!ret)
+		trigger[0] = roam_trigger[0];
+	else
+		ANDROID_ERROR(("2G WLC_GET_ROAM_TRIGGER ERROR %d ret=%d\n", roam_trigger[0], ret));
+
+	roam_trigger[1] = WLC_BAND_5G;
+	ret = wldev_ioctl(dev, WLC_GET_ROAM_TRIGGER, roam_trigger, sizeof(roam_trigger), 0);
+	if (!ret)
+		trigger[1] = roam_trigger[0];
+	else
+		ANDROID_ERROR(("5G WLC_GET_ROAM_TRIGGER ERROR %d ret=%d\n", roam_trigger[0], ret));
+
+	ANDROID_TRACE(("roam_trigger %d %d\n", trigger[0], trigger[1]));
+	bytes_written = snprintf(command, total_len, "%d %d", trigger[0], trigger[1]);
+
+	return bytes_written;
+}
+
+s32
+wl_android_get_keep_alive(struct net_device *dev, char *command, int total_len) {
+
+	wl_mkeep_alive_pkt_t *mkeep_alive_pktp;
+	int bytes_written = -1;
+	int res = -1, len, i = 0;
+	char* str = "mkeep_alive";
+
+	ANDROID_TRACE(("%s: command = %s\n", __FUNCTION__, command));
+
+	len = WLC_IOCTL_MEDLEN;
+	mkeep_alive_pktp = kmalloc(len, GFP_KERNEL);
+	memset(mkeep_alive_pktp, 0, len);
+	strcpy((char*)mkeep_alive_pktp, str);
+
+	if ((res = wldev_ioctl(dev, WLC_GET_VAR, mkeep_alive_pktp, len, FALSE))<0) {
+		ANDROID_ERROR(("%s: GET mkeep_alive ERROR %d\n", __FUNCTION__, res));
+		goto exit;
+	} else {
+		printf("Id            :%d\n"
+			   "Period (msec) :%d\n"
+			   "Length        :%d\n"
+			   "Packet        :0x",
+			   mkeep_alive_pktp->keep_alive_id,
+			   dtoh32(mkeep_alive_pktp->period_msec),
+			   dtoh16(mkeep_alive_pktp->len_bytes));
+		for (i=0; i<mkeep_alive_pktp->len_bytes; i++) {
+			printf("%02x", mkeep_alive_pktp->data[i]);
+		}
+		printf("\n");
+	}
+	bytes_written = snprintf(command, total_len, "mkeep_alive_period_msec %d ", dtoh32(mkeep_alive_pktp->period_msec));
+	bytes_written += snprintf(command+bytes_written, total_len, "0x");
+	for (i=0; i<mkeep_alive_pktp->len_bytes; i++) {
+		bytes_written += snprintf(command+bytes_written, total_len, "%x", mkeep_alive_pktp->data[i]);
+	}
+	ANDROID_TRACE(("%s: command result is %s\n", __FUNCTION__, command));
+
+exit:
+	kfree(mkeep_alive_pktp);
+	return bytes_written;
+}
+
+int
+wl_android_set_pm(struct net_device *dev,char *command, int total_len)
+{
+	int pm, ret = -1;
+
+	ANDROID_TRACE(("%s: cmd %s\n", __FUNCTION__, command));
+
+	sscanf(command, "%*s %d", &pm);
+
+	ret = wldev_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), FALSE);
+	if (ret)
+		ANDROID_ERROR(("WLC_SET_PM ERROR %d ret=%d\n", pm, ret));
+
+	return ret;
+}
+
+int
+wl_android_get_pm(struct net_device *dev,char *command, int total_len)
+{
+
+	int ret = 0;
+	int pm_local;
+	char *pm;
+	int bytes_written=-1;
+
+	ret = wldev_ioctl(dev, WLC_GET_PM, &pm_local, sizeof(pm_local),FALSE);
+	if (!ret) {
+		ANDROID_TRACE(("%s: PM = %d\n", __func__, pm_local));
+		if (pm_local == PM_OFF)
+			pm = "PM_OFF";
+		else if(pm_local == PM_MAX)
+			pm = "PM_MAX";
+		else if(pm_local == PM_FAST)
+			pm = "PM_FAST";
+		else {
+			pm_local = 0;
+			pm = "Invalid";
+		}
+		bytes_written = snprintf(command, total_len, "PM %s", pm);
+		ANDROID_TRACE(("%s: command result is %s\n", __FUNCTION__, command));
+	}
+	return bytes_written;
+}
+
+static int
+wl_android_set_monitor(struct net_device *dev, char *command, int total_len)
+{
+	int val;
+	int ret = 0;
+	int bytes_written;
+
+	sscanf(command, "%*s %d", &val);
+	bytes_written = wldev_ioctl(dev, WLC_SET_MONITOR, &val, sizeof(int), 1);
+	if (bytes_written)
+		ANDROID_ERROR(("WLC_SET_MONITOR ERROR %d ret=%d\n", val, ret));
+	return bytes_written;
+}
+
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+#define PRIVATE_COMMAND_MAX_LEN	8192
+	int ret = 0;
+	char *command = NULL;
+	int bytes_written = 0;
+	android_wifi_priv_cmd priv_cmd;
+
+	net_os_wake_lock(net);
+
+	if (!ifr->ifr_data) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+#ifdef CONFIG_COMPAT
+	if (is_compat_task()) {
+		compat_android_wifi_priv_cmd compat_priv_cmd;
+		if (copy_from_user(&compat_priv_cmd, ifr->ifr_data,
+			sizeof(compat_android_wifi_priv_cmd))) {
+			ret = -EFAULT;
+			goto exit;
+
+		}
+		priv_cmd.buf = compat_ptr(compat_priv_cmd.buf);
+		priv_cmd.used_len = compat_priv_cmd.used_len;
+		priv_cmd.total_len = compat_priv_cmd.total_len;
+	} else
+#endif /* CONFIG_COMPAT */
+	{
+		if (copy_from_user(&priv_cmd, ifr->ifr_data, sizeof(android_wifi_priv_cmd))) {
+			ret = -EFAULT;
+			goto exit;
+		}
+	}
+	if ((priv_cmd.total_len > PRIVATE_COMMAND_MAX_LEN) || (priv_cmd.total_len < 0)) {
+		ANDROID_ERROR(("%s: too long priavte command\n", __FUNCTION__));
+		ret = -EINVAL;
+		goto exit;
+	}
+	command = kmalloc((priv_cmd.total_len + 1), GFP_KERNEL);
+	if (!command)
+	{
+		ANDROID_ERROR(("%s: failed to allocate memory\n", __FUNCTION__));
+		ret = -ENOMEM;
+		goto exit;
+	}
+	if (copy_from_user(command, priv_cmd.buf, priv_cmd.total_len)) {
+		ret = -EFAULT;
+		goto exit;
+	}
+	command[priv_cmd.total_len] = '\0';
+
+	ANDROID_INFO(("%s: Android private cmd \"%s\" on %s\n", __FUNCTION__, command, ifr->ifr_name));
+
+	if (strncasecmp(command, CMD_START, strlen(CMD_START)) == 0) {
+		ANDROID_INFO(("%s, Received regular START command\n", __FUNCTION__));
+		bytes_written = wl_android_wifi_on(net);
+	}
+	else if (strncasecmp(command, CMD_SETFWPATH, strlen(CMD_SETFWPATH)) == 0) {
+		bytes_written = wl_android_set_fwpath(net, command, priv_cmd.total_len);
+	}
+
+	if (!g_wifi_on) {
+		ANDROID_ERROR(("%s: Ignore private cmd \"%s\" - iface %s is down\n",
+			__FUNCTION__, command, ifr->ifr_name));
+		ret = 0;
+		goto exit;
+	}
+
+	if (strncasecmp(command, CMD_STOP, strlen(CMD_STOP)) == 0) {
+		bytes_written = wl_android_wifi_off(net);
+	}
+	else if (strncasecmp(command, CMD_SCAN_ACTIVE, strlen(CMD_SCAN_ACTIVE)) == 0) {
+		/* TBD: SCAN-ACTIVE */
+	}
+	else if (strncasecmp(command, CMD_SCAN_PASSIVE, strlen(CMD_SCAN_PASSIVE)) == 0) {
+		/* TBD: SCAN-PASSIVE */
+	}
+	else if (strncasecmp(command, CMD_RSSI, strlen(CMD_RSSI)) == 0) {
+		bytes_written = wl_android_get_rssi(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_LINKSPEED, strlen(CMD_LINKSPEED)) == 0) {
+		bytes_written = wl_android_get_link_speed(net, command, priv_cmd.total_len);
+	}
+#ifdef PKT_FILTER_SUPPORT
+	else if (strncasecmp(command, CMD_RXFILTER_START, strlen(CMD_RXFILTER_START)) == 0) {
+		bytes_written = net_os_enable_packet_filter(net, 1);
+	}
+	else if (strncasecmp(command, CMD_RXFILTER_STOP, strlen(CMD_RXFILTER_STOP)) == 0) {
+		bytes_written = net_os_enable_packet_filter(net, 0);
+	}
+	else if (strncasecmp(command, CMD_RXFILTER_ADD, strlen(CMD_RXFILTER_ADD)) == 0) {
+		int filter_num = *(command + strlen(CMD_RXFILTER_ADD) + 1) - '0';
+		bytes_written = net_os_rxfilter_add_remove(net, TRUE, filter_num);
+	}
+	else if (strncasecmp(command, CMD_RXFILTER_REMOVE, strlen(CMD_RXFILTER_REMOVE)) == 0) {
+		int filter_num = *(command + strlen(CMD_RXFILTER_REMOVE) + 1) - '0';
+		bytes_written = net_os_rxfilter_add_remove(net, FALSE, filter_num);
+	}
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+	else if (strncasecmp(command, CMD_PKT_FILTER_MODE, strlen(CMD_PKT_FILTER_MODE)) == 0) {
+		dhd_set_packet_filter_mode(net, &command[strlen(CMD_PKT_FILTER_MODE) + 1]);
+	} else if (strncasecmp(command, CMD_PKT_FILTER_PORTS, strlen(CMD_PKT_FILTER_PORTS)) == 0) {
+		bytes_written = dhd_set_packet_filter_ports(net,
+			&command[strlen(CMD_PKT_FILTER_PORTS) + 1]);
+		ret = bytes_written;
+	}
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+#endif /* PKT_FILTER_SUPPORT */
+	else if (strncasecmp(command, CMD_BTCOEXSCAN_START, strlen(CMD_BTCOEXSCAN_START)) == 0) {
+		/* TBD: BTCOEXSCAN-START */
+	}
+	else if (strncasecmp(command, CMD_BTCOEXSCAN_STOP, strlen(CMD_BTCOEXSCAN_STOP)) == 0) {
+		/* TBD: BTCOEXSCAN-STOP */
+	}
+	else if (strncasecmp(command, CMD_BTCOEXMODE, strlen(CMD_BTCOEXMODE)) == 0) {
+#ifdef WL_CFG80211
+		void *dhdp = wl_cfg80211_get_dhdp();
+		bytes_written = wl_cfg80211_set_btcoex_dhcp(net, dhdp, command);
+#else
+#ifdef PKT_FILTER_SUPPORT
+		uint mode = *(command + strlen(CMD_BTCOEXMODE) + 1) - '0';
+
+		if (mode == 1)
+			net_os_enable_packet_filter(net, 0); /* DHCP starts */
+		else
+			net_os_enable_packet_filter(net, 1); /* DHCP ends */
+#endif /* PKT_FILTER_SUPPORT */
+#endif /* WL_CFG80211 */
+	}
+	else if (strncasecmp(command, CMD_SETSUSPENDOPT, strlen(CMD_SETSUSPENDOPT)) == 0) {
+		bytes_written = wl_android_set_suspendopt(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_SETSUSPENDMODE, strlen(CMD_SETSUSPENDMODE)) == 0) {
+		bytes_written = wl_android_set_suspendmode(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_SETBAND, strlen(CMD_SETBAND)) == 0) {
+		uint band = *(command + strlen(CMD_SETBAND) + 1) - '0';
+#ifdef WL_HOST_BAND_MGMT
+		s32 ret = 0;
+		if ((ret = wl_cfg80211_set_band(net, band)) < 0) {
+			if (ret == BCME_UNSUPPORTED) {
+				/* If roam_var is unsupported, fallback to the original method */
+				ANDROID_ERROR(("WL_HOST_BAND_MGMT defined, "
+					"but roam_band iovar unsupported in the firmware\n"));
+			} else {
+				bytes_written = -1;
+				goto exit;
+			}
+		}
+		if ((band == WLC_BAND_AUTO) || (ret == BCME_UNSUPPORTED))
+			bytes_written = wldev_set_band(net, band);
+#else
+		bytes_written = wldev_set_band(net, band);
+#endif /* WL_HOST_BAND_MGMT */
+	}
+	else if (strncasecmp(command, CMD_GETBAND, strlen(CMD_GETBAND)) == 0) {
+		bytes_written = wl_android_get_band(net, command, priv_cmd.total_len);
+	}
+#ifdef WL_CFG80211
+	/* CUSTOMER_SET_COUNTRY feature is define for only GGSM model */
+	else if (strncasecmp(command, CMD_COUNTRY, strlen(CMD_COUNTRY)) == 0) {
+		char *country_code = command + strlen(CMD_COUNTRY) + 1;
+#ifdef CUSTOMER_HW5
+		/* Customer_hw5 want to keep connections */
+		bytes_written = wldev_set_country(net, country_code, true, false);
+#else
+		bytes_written = wldev_set_country(net, country_code, true, true);
+#endif
+	}
+#endif /* WL_CFG80211 */
+
+
+#ifdef PNO_SUPPORT
+	else if (strncasecmp(command, CMD_PNOSSIDCLR_SET, strlen(CMD_PNOSSIDCLR_SET)) == 0) {
+		bytes_written = dhd_dev_pno_stop_for_ssid(net);
+	}
+#ifndef WL_SCHED_SCAN
+	else if (strncasecmp(command, CMD_PNOSETUP_SET, strlen(CMD_PNOSETUP_SET)) == 0) {
+		bytes_written = wl_android_set_pno_setup(net, command, priv_cmd.total_len);
+	}
+#endif /* !WL_SCHED_SCAN */
+	else if (strncasecmp(command, CMD_PNOENABLE_SET, strlen(CMD_PNOENABLE_SET)) == 0) {
+		int enable = *(command + strlen(CMD_PNOENABLE_SET) + 1) - '0';
+		bytes_written = (enable)? 0 : dhd_dev_pno_stop_for_ssid(net);
+	}
+	else if (strncasecmp(command, CMD_WLS_BATCHING, strlen(CMD_WLS_BATCHING)) == 0) {
+		bytes_written = wls_parse_batching_cmd(net, command, priv_cmd.total_len);
+	}
+#endif /* PNO_SUPPORT */
+	else if (strncasecmp(command, CMD_P2P_DEV_ADDR, strlen(CMD_P2P_DEV_ADDR)) == 0) {
+		bytes_written = wl_android_get_p2p_dev_addr(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_P2P_SET_NOA, strlen(CMD_P2P_SET_NOA)) == 0) {
+		int skip = strlen(CMD_P2P_SET_NOA) + 1;
+		bytes_written = wl_cfg80211_set_p2p_noa(net, command + skip,
+			priv_cmd.total_len - skip);
+	}
+#ifdef WL_SDO
+	else if (strncasecmp(command, CMD_P2P_SD_OFFLOAD, strlen(CMD_P2P_SD_OFFLOAD)) == 0) {
+		u8 *buf = command;
+		u8 *cmd_id = NULL;
+		int len;
+
+		cmd_id = strsep((char **)&buf, " ");
+		/* if buf == NULL, means no arg */
+		if (buf == NULL)
+			len = 0;
+		else
+			len = strlen(buf);
+
+		bytes_written = wl_cfg80211_sd_offload(net, cmd_id, buf, len);
+	}
+#endif /* WL_SDO */
+#ifdef WL_NAN
+	else if (strncasecmp(command, CMD_NAN, strlen(CMD_NAN)) == 0) {
+		bytes_written = wl_cfg80211_nan_cmd_handler(net, command,
+			priv_cmd.total_len);
+	}
+#endif /* WL_NAN */
+#if !defined WL_ENABLE_P2P_IF
+	else if (strncasecmp(command, CMD_P2P_GET_NOA, strlen(CMD_P2P_GET_NOA)) == 0) {
+		bytes_written = wl_cfg80211_get_p2p_noa(net, command, priv_cmd.total_len);
+	}
+#endif /* WL_ENABLE_P2P_IF */
+	else if (strncasecmp(command, CMD_P2P_SET_PS, strlen(CMD_P2P_SET_PS)) == 0) {
+		int skip = strlen(CMD_P2P_SET_PS) + 1;
+		bytes_written = wl_cfg80211_set_p2p_ps(net, command + skip,
+			priv_cmd.total_len - skip);
+	}
+#ifdef WL_CFG80211
+	else if (strncasecmp(command, CMD_SET_AP_WPS_P2P_IE,
+		strlen(CMD_SET_AP_WPS_P2P_IE)) == 0) {
+		int skip = strlen(CMD_SET_AP_WPS_P2P_IE) + 3;
+		bytes_written = wl_cfg80211_set_wps_p2p_ie(net, command + skip,
+			priv_cmd.total_len - skip, *(command + skip - 2) - '0');
+	}
+#ifdef WLFBT
+	else if (strncasecmp(command, CMD_GET_FTKEY, strlen(CMD_GET_FTKEY)) == 0) {
+		wl_cfg80211_get_fbt_key(command);
+		bytes_written = FBT_KEYLEN;
+	}
+#endif /* WLFBT */
+#endif /* WL_CFG80211 */
+	else if (strncasecmp(command, CMD_OKC_SET_PMK, strlen(CMD_OKC_SET_PMK)) == 0)
+		bytes_written = wl_android_set_pmk(net, command, priv_cmd.total_len);
+	else if (strncasecmp(command, CMD_OKC_ENABLE, strlen(CMD_OKC_ENABLE)) == 0)
+		bytes_written = wl_android_okc_enable(net, command, priv_cmd.total_len);
+#ifdef BCMCCX
+	else if (strncasecmp(command, CMD_GETCCKM_RN, strlen(CMD_GETCCKM_RN)) == 0) {
+		bytes_written = wl_android_get_cckm_rn(net, command);
+	}
+	else if (strncasecmp(command, CMD_SETCCKM_KRK, strlen(CMD_SETCCKM_KRK)) == 0) {
+		bytes_written = wl_android_set_cckm_krk(net, command);
+	}
+	else if (strncasecmp(command, CMD_GET_ASSOC_RES_IES, strlen(CMD_GET_ASSOC_RES_IES)) == 0) {
+		bytes_written = wl_android_get_assoc_res_ies(net, command);
+	}
+#endif /* BCMCCX */
+#if defined(WL_SUPPORT_AUTO_CHANNEL)
+	else if (strncasecmp(command, CMD_GET_BEST_CHANNELS,
+		strlen(CMD_GET_BEST_CHANNELS)) == 0) {
+		bytes_written = wl_cfg80211_get_best_channels(net, command,
+			priv_cmd.total_len);
+	}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+	else if (strncasecmp(command, CMD_HAPD_MAC_FILTER, strlen(CMD_HAPD_MAC_FILTER)) == 0) {
+		int skip = strlen(CMD_HAPD_MAC_FILTER) + 1;
+		wl_android_set_mac_address_filter(net, (const char*)command+skip);
+	}
+	else if (strncasecmp(command, CMD_SETROAMMODE, strlen(CMD_SETROAMMODE)) == 0)
+		bytes_written = wl_android_set_roam_mode(net, command, priv_cmd.total_len);
+#if defined(BCMFW_ROAM_ENABLE)
+	else if (strncasecmp(command, CMD_SET_ROAMPREF, strlen(CMD_SET_ROAMPREF)) == 0) {
+		bytes_written = wl_android_set_roampref(net, command, priv_cmd.total_len);
+	}
+#endif /* BCMFW_ROAM_ENABLE */
+#ifdef WL_CFG80211
+	else if (strncasecmp(command, CMD_MIRACAST, strlen(CMD_MIRACAST)) == 0)
+		bytes_written = wl_android_set_miracast(net, command, priv_cmd.total_len);
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+	else if (strncasecmp(command, CMD_SETMIRACAST, strlen(CMD_SETMIRACAST)) == 0)
+		bytes_written = wldev_miracast_tuning(net, command, priv_cmd.total_len);
+	else if (strncasecmp(command, CMD_ASSOCRESPIE, strlen(CMD_ASSOCRESPIE)) == 0)
+		bytes_written = wldev_get_assoc_resp_ie(net, command, priv_cmd.total_len);
+	else if (strncasecmp(command, CMD_RXRATESTATS, strlen(CMD_RXRATESTATS)) == 0)
+		bytes_written = wldev_get_rx_rate_stats(net, command, priv_cmd.total_len);
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+	else if (strncasecmp(command, CMD_SETIBSSBEACONOUIDATA, strlen(CMD_SETIBSSBEACONOUIDATA)) == 0)
+		bytes_written = wl_android_set_ibss_beacon_ouidata(net,
+		command, priv_cmd.total_len);
+#endif
+#ifdef WLAIBSS
+	else if (strncasecmp(command, CMD_SETIBSSTXFAILEVENT,
+		strlen(CMD_SETIBSSTXFAILEVENT)) == 0)
+		bytes_written = wl_android_set_ibss_txfail_event(net, command, priv_cmd.total_len);
+	else if (strncasecmp(command, CMD_GET_IBSS_PEER_INFO_ALL,
+		strlen(CMD_GET_IBSS_PEER_INFO_ALL)) == 0)
+		bytes_written = wl_android_get_ibss_peer_info(net, command, priv_cmd.total_len,
+			TRUE);
+	else if (strncasecmp(command, CMD_GET_IBSS_PEER_INFO,
+		strlen(CMD_GET_IBSS_PEER_INFO)) == 0)
+		bytes_written = wl_android_get_ibss_peer_info(net, command, priv_cmd.total_len,
+			FALSE);
+	else if (strncasecmp(command, CMD_SETIBSSROUTETABLE,
+		strlen(CMD_SETIBSSROUTETABLE)) == 0)
+		bytes_written = wl_android_set_ibss_routetable(net, command,
+			priv_cmd.total_len);
+	else if (strncasecmp(command, CMD_SETIBSSAMPDU, strlen(CMD_SETIBSSAMPDU)) == 0)
+		bytes_written = wl_android_set_ibss_ampdu(net, command, priv_cmd.total_len);
+	else if (strncasecmp(command, CMD_SETIBSSANTENNAMODE, strlen(CMD_SETIBSSANTENNAMODE)) == 0)
+		bytes_written = wl_android_set_ibss_antenna(net, command, priv_cmd.total_len);
+#endif /* WLAIBSS */
+	else if (strncasecmp(command, CMD_KEEP_ALIVE, strlen(CMD_KEEP_ALIVE)) == 0) {
+		int skip = strlen(CMD_KEEP_ALIVE) + 1;
+		bytes_written = wl_keep_alive_set(net, command + skip, priv_cmd.total_len - skip);
+	}
+#ifdef WL_CFG80211
+	else if (strncasecmp(command, CMD_ROAM_OFFLOAD, strlen(CMD_ROAM_OFFLOAD)) == 0) {
+		int enable = *(command + strlen(CMD_ROAM_OFFLOAD) + 1) - '0';
+		bytes_written = wl_cfg80211_enable_roam_offload(net, enable);
+	}
+	else if (strncasecmp(command, CMD_ROAM_OFFLOAD_APLIST, strlen(CMD_ROAM_OFFLOAD_APLIST)) == 0) {
+		bytes_written = wl_android_set_roam_offload_bssid_list(net,
+			command + strlen(CMD_ROAM_OFFLOAD_APLIST) + 1);
+	}
+#endif
+#ifdef P2PRESP_WFDIE_SRC
+	else if (strncasecmp(command, CMD_P2P_SET_WFDIE_RESP,
+		strlen(CMD_P2P_SET_WFDIE_RESP)) == 0) {
+		int mode = *(command + strlen(CMD_P2P_SET_WFDIE_RESP) + 1) - '0';
+		bytes_written = wl_android_set_wfdie_resp(net, mode);
+	} else if (strncasecmp(command, CMD_P2P_GET_WFDIE_RESP,
+		strlen(CMD_P2P_GET_WFDIE_RESP)) == 0) {
+		bytes_written = wl_android_get_wfdie_resp(net, command, priv_cmd.total_len);
+	}
+#endif /* P2PRESP_WFDIE_SRC */
+	else if (strncasecmp(command, CMD_GET_LINK_STATUS, strlen(CMD_GET_LINK_STATUS)) == 0) {
+		bytes_written = wl_android_get_link_status(net, command, priv_cmd.total_len);
+	}
+#ifdef CONNECTION_STATISTICS
+	else if (strncasecmp(command, CMD_GET_CONNECTION_STATS,
+		strlen(CMD_GET_CONNECTION_STATS)) == 0) {
+		bytes_written = wl_android_get_connection_stats(net, command,
+			priv_cmd.total_len);
+	}
+#endif
+	else if(strncasecmp(command, CMD_GET_CHANNEL, strlen(CMD_GET_CHANNEL)) == 0) {
+		bytes_written = wl_android_get_channel(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_SET_ROAM, strlen(CMD_SET_ROAM)) == 0) {
+		bytes_written = wl_android_set_roam_trigger(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_GET_ROAM, strlen(CMD_GET_ROAM)) == 0) {
+		bytes_written = wl_android_get_roam_trigger(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_GET_KEEP_ALIVE, strlen(CMD_GET_KEEP_ALIVE)) == 0) {
+		int skip = strlen(CMD_GET_KEEP_ALIVE) + 1;
+		bytes_written = wl_android_get_keep_alive(net, command+skip, priv_cmd.total_len-skip);
+	}
+	else if (strncasecmp(command, CMD_GET_PM, strlen(CMD_GET_PM)) == 0) {
+		bytes_written = wl_android_get_pm(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_SET_PM, strlen(CMD_SET_PM)) == 0) {
+		bytes_written = wl_android_set_pm(net, command, priv_cmd.total_len);
+	}
+	else if (strncasecmp(command, CMD_MONITOR, strlen(CMD_MONITOR)) == 0) {
+		bytes_written = wl_android_set_monitor(net, command, priv_cmd.total_len);
+	} else {
+		ANDROID_ERROR(("Unknown PRIVATE command %s - ignored\n", command));
+		snprintf(command, 3, "OK");
+		bytes_written = strlen("OK");
+	}
+
+	if (bytes_written >= 0) {
+		if ((bytes_written == 0) && (priv_cmd.total_len > 0))
+			command[0] = '\0';
+		if (bytes_written >= priv_cmd.total_len) {
+			ANDROID_ERROR(("%s: bytes_written = %d\n", __FUNCTION__, bytes_written));
+			bytes_written = priv_cmd.total_len;
+		} else {
+			bytes_written++;
+		}
+		priv_cmd.used_len = bytes_written;
+		if (copy_to_user(priv_cmd.buf, command, bytes_written)) {
+			ANDROID_ERROR(("%s: failed to copy data to user buffer\n", __FUNCTION__));
+			ret = -EFAULT;
+		}
+	}
+	else {
+		ret = bytes_written;
+	}
+
+exit:
+	net_os_wake_unlock(net);
+	if (command) {
+		kfree(command);
+	}
+
+	return ret;
+}
+
+int wl_android_init(void)
+{
+	int ret = 0;
+
+#ifdef ENABLE_INSMOD_NO_FW_LOAD
+	dhd_download_fw_on_driverload = FALSE;
+#endif /* ENABLE_INSMOD_NO_FW_LOAD */
+	if (!iface_name[0]) {
+		memset(iface_name, 0, IFNAMSIZ);
+		bcm_strncpy_s(iface_name, IFNAMSIZ, "wlan", IFNAMSIZ);
+	}
+
+#ifdef WL_GENL
+	wl_genl_init();
+#endif
+	wl_netlink_init();
+
+	return ret;
+}
+
+int wl_android_exit(void)
+{
+	int ret = 0;
+	struct io_cfg *cur, *q;
+
+#ifdef WL_GENL
+	wl_genl_deinit();
+#endif /* WL_GENL */
+	wl_netlink_deinit();
+
+	list_for_each_entry_safe(cur, q, &miracast_resume_list, list) {
+		list_del(&cur->list);
+		kfree(cur);
+	}
+
+	return ret;
+}
+
+void wl_android_post_init(void)
+{
+
+#ifdef ENABLE_4335BT_WAR
+	bcm_bt_unlock(lock_cookie_wifi);
+	printk("%s: btlock released\n", __FUNCTION__);
+#endif /* ENABLE_4335BT_WAR */
+
+	if (!dhd_download_fw_on_driverload)
+		g_wifi_on = FALSE;
+}
+
+#ifdef WL_GENL
+/* Generic Netlink Initializaiton */
+static int wl_genl_init(void)
+{
+	int ret;
+
+	ANDROID_TRACE(("GEN Netlink Init\n\n"));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+	/* register new family */
+	ret = genl_register_family(&wl_genl_family);
+	if (ret != 0)
+		goto failure;
+
+	/* register functions (commands) of the new family */
+	ret = genl_register_ops(&wl_genl_family, &wl_genl_ops);
+	if (ret != 0) {
+		ANDROID_ERROR(("register ops failed: %i\n", ret));
+		genl_unregister_family(&wl_genl_family);
+		goto failure;
+	}
+
+	ret = genl_register_mc_group(&wl_genl_family, &wl_genl_mcast);
+#else
+	ret = genl_register_family_with_ops_groups(&wl_genl_family, wl_genl_ops, wl_genl_mcast);
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0) */
+	if (ret != 0) {
+		ANDROID_ERROR(("register mc_group failed: %i\n", ret));
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+		genl_unregister_ops(&wl_genl_family, &wl_genl_ops);
+#endif
+		genl_unregister_family(&wl_genl_family);
+		goto failure;
+	}
+
+	return 0;
+
+failure:
+	ANDROID_ERROR(("Registering Netlink failed!!\n"));
+	return -1;
+}
+
+/* Generic netlink deinit */
+static int wl_genl_deinit(void)
+{
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+	if (genl_unregister_ops(&wl_genl_family, &wl_genl_ops) < 0)
+		ANDROID_ERROR(("Unregister wl_genl_ops failed\n"));
+#endif
+	if (genl_unregister_family(&wl_genl_family) < 0)
+		ANDROID_ERROR(("Unregister wl_genl_ops failed\n"));
+
+	return 0;
+}
+
+s32 wl_event_to_bcm_event(u16 event_type)
+{
+	u16 event = -1;
+
+	switch (event_type) {
+		case WLC_E_SERVICE_FOUND:
+			event = BCM_E_SVC_FOUND;
+			break;
+		case WLC_E_P2PO_ADD_DEVICE:
+			event = BCM_E_DEV_FOUND;
+			break;
+		case WLC_E_P2PO_DEL_DEVICE:
+			event = BCM_E_DEV_LOST;
+			break;
+	/* Above events are supported from BCM Supp ver 47 Onwards */
+#ifdef BT_WIFI_HANDOVER
+		case WLC_E_BT_WIFI_HANDOVER_REQ:
+			event = BCM_E_DEV_BT_WIFI_HO_REQ;
+			break;
+#endif /* BT_WIFI_HANDOVER */
+
+		default:
+			ANDROID_ERROR(("Event not supported\n"));
+	}
+
+	return event;
+}
+
+s32
+wl_genl_send_msg(
+	struct net_device *ndev,
+	u32 event_type,
+	u8 *buf,
+	u16 len,
+	u8 *subhdr,
+	u16 subhdr_len)
+{
+	int ret = 0;
+	struct sk_buff *skb = NULL;
+	void *msg;
+	u32 attr_type = 0;
+	bcm_event_hdr_t *hdr = NULL;
+	int mcast = 1; /* By default sent as mutlicast type */
+	int pid = 0;
+	u8 *ptr = NULL, *p = NULL;
+	u32 tot_len = sizeof(bcm_event_hdr_t) + subhdr_len + len;
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+
+	ANDROID_TRACE(("Enter \n"));
+
+	/* Decide between STRING event and Data event */
+	if (event_type == 0)
+		attr_type = BCM_GENL_ATTR_STRING;
+	else
+		attr_type = BCM_GENL_ATTR_MSG;
+
+	skb = genlmsg_new(NLMSG_GOODSIZE, kflags);
+	if (skb == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	msg = genlmsg_put(skb, 0, 0, &wl_genl_family, 0, BCM_GENL_CMD_MSG);
+	if (msg == NULL) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+
+	if (attr_type == BCM_GENL_ATTR_STRING) {
+		/* Add a BCM_GENL_MSG attribute. Since it is specified as a string.
+		 * make sure it is null terminated
+		 */
+		if (subhdr || subhdr_len) {
+			ANDROID_ERROR(("No sub hdr support for the ATTR STRING type \n"));
+			ret =  -EINVAL;
+			goto out;
+		}
+
+		ret = nla_put_string(skb, BCM_GENL_ATTR_STRING, buf);
+		if (ret != 0) {
+			ANDROID_ERROR(("nla_put_string failed\n"));
+			goto out;
+		}
+	} else {
+		/* ATTR_MSG */
+
+		/* Create a single buffer for all */
+		p = ptr = kzalloc(tot_len, kflags);
+		if (!ptr) {
+			ret = -ENOMEM;
+			ANDROID_ERROR(("ENOMEM!!\n"));
+			goto out;
+		}
+
+		/* Include the bcm event header */
+		hdr = (bcm_event_hdr_t *)ptr;
+		hdr->event_type = wl_event_to_bcm_event(event_type);
+		hdr->len = len + subhdr_len;
+		ptr += sizeof(bcm_event_hdr_t);
+
+		/* Copy subhdr (if any) */
+		if (subhdr && subhdr_len) {
+			memcpy(ptr, subhdr, subhdr_len);
+			ptr += subhdr_len;
+		}
+
+		/* Copy the data */
+		if (buf && len) {
+			memcpy(ptr, buf, len);
+		}
+
+		ret = nla_put(skb, BCM_GENL_ATTR_MSG, tot_len, p);
+		if (ret != 0) {
+			ANDROID_ERROR(("nla_put_string failed\n"));
+			goto out;
+		}
+	}
+
+	if (mcast) {
+		int err = 0;
+		/* finalize the message */
+		genlmsg_end(skb, msg);
+		/* NETLINK_CB(skb).dst_group = 1; */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0)
+		if ((err = genlmsg_multicast(skb, 0, wl_genl_mcast.id, GFP_ATOMIC)) < 0)
+#else
+		if ((err = genlmsg_multicast(&wl_genl_family, skb, 0, 0, GFP_ATOMIC)) < 0)
+#endif
+			ANDROID_ERROR(("genlmsg_multicast for attr(%d) failed. Error:%d \n",
+				attr_type, err));
+		else
+			ANDROID_TRACE(("Multicast msg sent successfully. attr_type:%d len:%d \n",
+				attr_type, tot_len));
+	} else {
+		NETLINK_CB(skb).dst_group = 0; /* Not in multicast group */
+
+		/* finalize the message */
+		genlmsg_end(skb, msg);
+
+		/* send the message back */
+		if (genlmsg_unicast(&init_net, skb, pid) < 0)
+			ANDROID_ERROR(("genlmsg_unicast failed\n"));
+	}
+
+out:
+	if (p)
+		kfree(p);
+	if (ret)
+		nlmsg_free(skb);
+
+	return ret;
+}
+
+static s32
+wl_genl_handle_msg(
+	struct sk_buff *skb,
+	struct genl_info *info)
+{
+	struct nlattr *na;
+	u8 *data = NULL;
+
+	ANDROID_TRACE(("Enter \n"));
+
+	if (info == NULL) {
+		return -EINVAL;
+	}
+
+	na = info->attrs[BCM_GENL_ATTR_MSG];
+	if (!na) {
+		ANDROID_ERROR(("nlattribute NULL\n"));
+		return -EINVAL;
+	}
+
+	data = (char *)nla_data(na);
+	if (!data) {
+		ANDROID_ERROR(("Invalid data\n"));
+		return -EINVAL;
+	} else {
+		/* Handle the data */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0)) || defined(WL_COMPAT_WIRELESS)
+		ANDROID_TRACE(("%s: Data received from pid (%d) \n", __func__,
+			info->snd_pid));
+#else
+		ANDROID_TRACE(("%s: Data received from pid (%d) \n", __func__,
+			info->snd_portid));
+#endif /* (LINUX_VERSION < VERSION(3, 7, 0) || WL_COMPAT_WIRELESS */
+	}
+
+	return 0;
+}
+#endif /* WL_GENL */
+
+
+#if defined(RSSIAVG)
+void
+wl_free_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl)
+{
+	wl_rssi_cache_t *node, *cur, **rssi_head;
+	int i=0;
+
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+	node = *rssi_head;
+
+	for (;node;) {
+		ANDROID_INFO(("%s: Free %d with BSSID %pM\n",
+			__FUNCTION__, i, &node->BSSID));
+		cur = node;
+		node = cur->next;
+		kfree(cur);
+		i++;
+	}
+	*rssi_head = NULL;
+}
+
+void
+wl_delete_dirty_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl)
+{
+	wl_rssi_cache_t *node, *prev, **rssi_head;
+	int i = -1, tmp = 0;
+	struct timeval now;
+
+	do_gettimeofday(&now);
+
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+	node = *rssi_head;
+	prev = node;
+	for (;node;) {
+		i++;
+		if (now.tv_sec > node->tv.tv_sec) {
+			if (node == *rssi_head) {
+				tmp = 1;
+				*rssi_head = node->next;
+			} else {
+				tmp = 0;
+				prev->next = node->next;
+			}
+			ANDROID_INFO(("%s: Del %d with BSSID %pM\n",
+				__FUNCTION__, i, &node->BSSID));
+			kfree(node);
+			if (tmp == 1) {
+				node = *rssi_head;
+				prev = node;
+			} else {
+				node = prev->next;
+			}
+			continue;
+		}
+		prev = node;
+		node = node->next;
+	}
+}
+
+void
+wl_delete_disconnected_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, u8 *bssid)
+{
+	wl_rssi_cache_t *node, *prev, **rssi_head;
+	int i = -1, tmp = 0;
+
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+	node = *rssi_head;
+	prev = node;
+	for (;node;) {
+		i++;
+		if (!memcmp(&node->BSSID, bssid, ETHER_ADDR_LEN)) {
+			if (node == *rssi_head) {
+				tmp = 1;
+				*rssi_head = node->next;
+			} else {
+				tmp = 0;
+				prev->next = node->next;
+			}
+			ANDROID_INFO(("%s: Del %d with BSSID %pM\n",
+				__FUNCTION__, i, &node->BSSID));
+			kfree(node);
+			if (tmp == 1) {
+				node = *rssi_head;
+				prev = node;
+			} else {
+				node = prev->next;
+			}
+			continue;
+		}
+		prev = node;
+		node = node->next;
+	}
+}
+
+void
+wl_reset_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl)
+{
+	wl_rssi_cache_t *node, **rssi_head;
+
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+
+	/* reset dirty */
+	node = *rssi_head;
+	for (;node;) {
+		node->dirty += 1;
+		node = node->next;
+	}
+}
+
+int
+wl_update_connected_rssi_cache(struct net_device *net, wl_rssi_cache_ctrl_t *rssi_cache_ctrl, int *rssi_avg)
+{
+	wl_rssi_cache_t *node, *prev, *leaf, **rssi_head;
+	int j, k=0;
+	int rssi, error=0;
+	struct ether_addr bssid;
+	struct timeval now, timeout;
+
+	if (!g_wifi_on)
+		return 0;
+
+	error = wldev_ioctl(net, WLC_GET_BSSID, &bssid, sizeof(bssid), false);
+	if (error == BCME_NOTASSOCIATED) {
+		ANDROID_INFO(("%s: Not Associated! res:%d\n", __FUNCTION__, error));
+		return 0;
+	}
+	if (error) {
+		ANDROID_ERROR(("Could not get bssid (%d)\n", error));
+	}
+	error = wldev_get_rssi(net, &rssi);
+	if (error) {
+		ANDROID_ERROR(("Could not get rssi (%d)\n", error));
+		return error;
+	}
+
+	do_gettimeofday(&now);
+	timeout.tv_sec = now.tv_sec + RSSICACHE_TIMEOUT;
+	if (timeout.tv_sec < now.tv_sec) {
+		/*
+		 * Integer overflow - assume long enough timeout to be assumed
+		 * to be infinite, i.e., the timeout would never happen.
+		 */
+		ANDROID_TRACE(("%s: Too long timeout (secs=%d) to ever happen - now=%lu, timeout=%lu",
+			__FUNCTION__, RSSICACHE_TIMEOUT, now.tv_sec, timeout.tv_sec));
+	}
+
+	/* update RSSI */
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+	node = *rssi_head;
+	prev = NULL;
+	for (;node;) {
+		if (!memcmp(&node->BSSID, &bssid, ETHER_ADDR_LEN)) {
+			ANDROID_INFO(("%s: Update %d with BSSID %pM, RSSI=%d\n",
+				__FUNCTION__, k, &bssid, rssi));
+			for (j=0; j<RSSIAVG_LEN-1; j++)
+				node->RSSI[j] = node->RSSI[j+1];
+			node->RSSI[j] = rssi;
+			node->dirty = 0;
+			node->tv = timeout;
+			goto exit;
+		}
+		prev = node;
+		node = node->next;
+		k++;
+	}
+
+	leaf = kmalloc(sizeof(wl_rssi_cache_t), GFP_KERNEL);
+	if (!leaf) {
+		ANDROID_ERROR(("%s: Memory alloc failure %d\n",
+			__FUNCTION__, sizeof(wl_rssi_cache_t)));
+		return 0;
+	}
+	ANDROID_INFO(("%s: Add %d with cached BSSID %pM, RSSI=%d in the leaf\n",
+			__FUNCTION__, k, &bssid, rssi));
+
+	leaf->next = NULL;
+	leaf->dirty = 0;
+	leaf->tv = timeout;
+	memcpy(&leaf->BSSID, &bssid, ETHER_ADDR_LEN);
+	for (j=0; j<RSSIAVG_LEN; j++)
+		leaf->RSSI[j] = rssi;
+
+	if (!prev)
+		*rssi_head = leaf;
+	else
+		prev->next = leaf;
+
+exit:
+	*rssi_avg = (int)wl_get_avg_rssi(rssi_cache_ctrl, &bssid);
+
+	return error;
+}
+
+void
+wl_update_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, wl_scan_results_t *ss_list)
+{
+	wl_rssi_cache_t *node, *prev, *leaf, **rssi_head;
+	wl_bss_info_t *bi = NULL;
+	int i, j, k;
+	struct timeval now, timeout;
+
+	if (!ss_list->count)
+		return;
+
+	do_gettimeofday(&now);
+	timeout.tv_sec = now.tv_sec + RSSICACHE_TIMEOUT;
+	if (timeout.tv_sec < now.tv_sec) {
+		/*
+		 * Integer overflow - assume long enough timeout to be assumed
+		 * to be infinite, i.e., the timeout would never happen.
+		 */
+		ANDROID_TRACE(("%s: Too long timeout (secs=%d) to ever happen - now=%lu, timeout=%lu",
+			__FUNCTION__, RSSICACHE_TIMEOUT, now.tv_sec, timeout.tv_sec));
+	}
+
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+
+	/* update RSSI */
+	for (i = 0; i < ss_list->count; i++) {
+		node = *rssi_head;
+		prev = NULL;
+		k = 0;
+		bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : ss_list->bss_info;
+		for (;node;) {
+			if (!memcmp(&node->BSSID, &bi->BSSID, ETHER_ADDR_LEN)) {
+				ANDROID_INFO(("%s: Update %d with BSSID %pM, RSSI=%d, SSID \"%s\"\n",
+					__FUNCTION__, k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID));
+				for (j=0; j<RSSIAVG_LEN-1; j++)
+					node->RSSI[j] = node->RSSI[j+1];
+				node->RSSI[j] = dtoh16(bi->RSSI);
+				node->dirty = 0;
+				node->tv = timeout;
+				break;
+			}
+			prev = node;
+			node = node->next;
+			k++;
+		}
+
+		if (node)
+			continue;
+
+		leaf = kmalloc(sizeof(wl_rssi_cache_t), GFP_KERNEL);
+		if (!leaf) {
+			ANDROID_ERROR(("%s: Memory alloc failure %d\n",
+				__FUNCTION__, sizeof(wl_rssi_cache_t)));
+			return;
+		}
+		ANDROID_INFO(("%s: Add %d with cached BSSID %pM, RSSI=%d, SSID \"%s\" in the leaf\n",
+				__FUNCTION__, k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID));
+
+		leaf->next = NULL;
+		leaf->dirty = 0;
+		leaf->tv = timeout;
+		memcpy(&leaf->BSSID, &bi->BSSID, ETHER_ADDR_LEN);
+		for (j=0; j<RSSIAVG_LEN; j++)
+			leaf->RSSI[j] = dtoh16(bi->RSSI);
+
+		if (!prev)
+			*rssi_head = leaf;
+		else
+			prev->next = leaf;
+	}
+}
+
+int16
+wl_get_avg_rssi(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, void *addr)
+{
+	wl_rssi_cache_t *node, **rssi_head;
+	int j, rssi_sum, rssi=RSSI_MINVAL;
+
+	rssi_head = &rssi_cache_ctrl->m_cache_head;
+
+	node = *rssi_head;
+	for (;node;) {
+		if (!memcmp(&node->BSSID, addr, ETHER_ADDR_LEN)) {
+			rssi_sum = 0;
+			rssi = 0;
+			for (j=0; j<RSSIAVG_LEN; j++)
+				rssi_sum += node->RSSI[RSSIAVG_LEN-j-1];
+			rssi = rssi_sum / j;
+			break;
+		}
+		node = node->next;
+	}
+	rssi = MIN(rssi, RSSI_MAXVAL);
+	if (rssi == RSSI_MINVAL) {
+		ANDROID_ERROR(("%s: BSSID %pM does not in RSSI cache\n",
+		__FUNCTION__, addr));
+	}
+	return (int16)rssi;
+}
+#endif
+
+#if defined(RSSIOFFSET)
+int
+wl_update_rssi_offset(struct net_device *net, int rssi)
+{
+	uint chip, chiprev;
+
+	if (!g_wifi_on)
+		return rssi;
+
+	chip = dhd_conf_get_chip(dhd_get_pub(net));
+	chiprev = dhd_conf_get_chiprev(dhd_get_pub(net));
+	if (chip == BCM4330_CHIP_ID && chiprev == BCM4330B2_CHIP_REV) {
+#if defined(RSSIOFFSET_NEW)
+		int j;
+		for (j=0; j<RSSI_OFFSET; j++) {
+			if (rssi - (RSSI_OFFSET_MINVAL+RSSI_OFFSET_INTVAL*(j+1)) < 0)
+				break;
+		}
+		rssi += j;
+#else
+		rssi += RSSI_OFFSET;
+#endif
+	}
+	return MIN(rssi, RSSI_MAXVAL);
+}
+#endif
+
+#if defined(BSSCACHE)
+#define WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN	32
+
+void
+wl_free_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+	wl_bss_cache_t *node, *cur, **bss_head;
+	int i=0;
+
+	ANDROID_TRACE(("%s called\n", __FUNCTION__));
+
+	bss_head = &bss_cache_ctrl->m_cache_head;
+	node = *bss_head;
+
+	for (;node;) {
+		ANDROID_TRACE(("%s: Free %d with BSSID %pM\n",
+			__FUNCTION__, i, &node->results.bss_info->BSSID));
+		cur = node;
+		node = cur->next;
+		kfree(cur);
+		i++;
+	}
+	*bss_head = NULL;
+}
+
+void
+wl_delete_dirty_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+	wl_bss_cache_t *node, *prev, **bss_head;
+	int i = -1, tmp = 0;
+	struct timeval now;
+
+	do_gettimeofday(&now);
+
+	bss_head = &bss_cache_ctrl->m_cache_head;
+	node = *bss_head;
+	prev = node;
+	for (;node;) {
+		i++;
+		if (now.tv_sec > node->tv.tv_sec) {
+			if (node == *bss_head) {
+				tmp = 1;
+				*bss_head = node->next;
+			} else {
+				tmp = 0;
+				prev->next = node->next;
+			}
+			ANDROID_TRACE(("%s: Del %d with BSSID %pM, RSSI=%d, SSID \"%s\"\n",
+				__FUNCTION__, i, &node->results.bss_info->BSSID,
+				dtoh16(node->results.bss_info->RSSI), node->results.bss_info->SSID));
+			kfree(node);
+			if (tmp == 1) {
+				node = *bss_head;
+				prev = node;
+			} else {
+				node = prev->next;
+			}
+			continue;
+		}
+		prev = node;
+		node = node->next;
+	}
+}
+
+void
+wl_delete_disconnected_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl, u8 *bssid)
+{
+	wl_bss_cache_t *node, *prev, **bss_head;
+	int i = -1, tmp = 0;
+
+	bss_head = &bss_cache_ctrl->m_cache_head;
+	node = *bss_head;
+	prev = node;
+	for (;node;) {
+		i++;
+		if (!memcmp(&node->results.bss_info->BSSID, bssid, ETHER_ADDR_LEN)) {
+			if (node == *bss_head) {
+				tmp = 1;
+				*bss_head = node->next;
+			} else {
+				tmp = 0;
+				prev->next = node->next;
+			}
+			ANDROID_TRACE(("%s: Del %d with BSSID %pM, RSSI=%d, SSID \"%s\"\n",
+				__FUNCTION__, i, &node->results.bss_info->BSSID,
+				dtoh16(node->results.bss_info->RSSI), node->results.bss_info->SSID));
+			kfree(node);
+			if (tmp == 1) {
+				node = *bss_head;
+				prev = node;
+			} else {
+				node = prev->next;
+			}
+			continue;
+		}
+		prev = node;
+		node = node->next;
+	}
+}
+
+void
+wl_reset_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+	wl_bss_cache_t *node, **bss_head;
+
+	bss_head = &bss_cache_ctrl->m_cache_head;
+
+	/* reset dirty */
+	node = *bss_head;
+	for (;node;) {
+		node->dirty += 1;
+		node = node->next;
+	}
+}
+
+void
+wl_update_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl, wl_scan_results_t *ss_list)
+{
+	wl_bss_cache_t *node, *prev, *leaf, *tmp, **bss_head;
+	wl_bss_info_t *bi = NULL;
+	int i, k=0;
+	struct timeval now, timeout;
+
+	if (!ss_list->count)
+		return;
+
+	do_gettimeofday(&now);
+	timeout.tv_sec = now.tv_sec + BSSCACHE_TIMEOUT;
+	if (timeout.tv_sec < now.tv_sec) {
+		/*
+		 * Integer overflow - assume long enough timeout to be assumed
+		 * to be infinite, i.e., the timeout would never happen.
+		 */
+		ANDROID_TRACE(("%s: Too long timeout (secs=%d) to ever happen - now=%lu, timeout=%lu",
+			__FUNCTION__, BSSCACHE_TIMEOUT, now.tv_sec, timeout.tv_sec));
+	}
+
+	bss_head = &bss_cache_ctrl->m_cache_head;
+
+	for (i=0; i < ss_list->count; i++) {
+		node = *bss_head;
+		prev = NULL;
+		bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : ss_list->bss_info;
+
+		for (;node;) {
+			if (!memcmp(&node->results.bss_info->BSSID, &bi->BSSID, ETHER_ADDR_LEN)) {
+				tmp = node;
+				leaf = kmalloc(dtoh32(bi->length) + WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN, GFP_KERNEL);
+				if (!leaf) {
+					ANDROID_ERROR(("%s: Memory alloc failure %d and keep old BSS info\n",
+						__FUNCTION__, dtoh32(bi->length) + WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN));
+					break;
+				}
+
+				memcpy(leaf->results.bss_info, bi, dtoh32(bi->length));
+				leaf->next = node->next;
+				leaf->dirty = 0;
+				leaf->tv = timeout;
+				leaf->results.count = 1;
+				leaf->results.version = ss_list->version;
+				ANDROID_TRACE(("%s: Update %d with BSSID %pM, RSSI=%d, SSID \"%s\", length=%d\n",
+					__FUNCTION__, k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID, dtoh32(bi->length)));
+				if (!prev)
+					*bss_head = leaf;
+				else
+					prev->next = leaf;
+				node = leaf;
+				prev = node;
+
+				kfree(tmp);
+				k++;
+				break;
+			}
+			prev = node;
+			node = node->next;
+		}
+
+		if (node)
+			continue;
+
+		leaf = kmalloc(dtoh32(bi->length) + WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN, GFP_KERNEL);
+		if (!leaf) {
+			ANDROID_ERROR(("%s: Memory alloc failure %d\n", __FUNCTION__,
+				dtoh32(bi->length) + WLC_IW_SS_CACHE_CTRL_FIELD_MAXLEN));
+			return;
+		}
+		ANDROID_TRACE(("%s: Add %d with cached BSSID %pM, RSSI=%d, SSID \"%s\" in the leaf\n",
+				__FUNCTION__, k, &bi->BSSID, dtoh16(bi->RSSI), bi->SSID));
+
+		memcpy(leaf->results.bss_info, bi, dtoh32(bi->length));
+		leaf->next = NULL;
+		leaf->dirty = 0;
+		leaf->tv = timeout;
+		leaf->results.count = 1;
+		leaf->results.version = ss_list->version;
+		k++;
+
+		if (!prev)
+			*bss_head = leaf;
+		else
+			prev->next = leaf;
+	}
+}
+
+void
+wl_release_bss_cache_ctrl(wl_bss_cache_ctrl_t *bss_cache_ctrl)
+{
+	ANDROID_TRACE(("%s:\n", __FUNCTION__));
+	wl_free_bss_cache(bss_cache_ctrl);
+}
+#endif
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_android.h b/drivers/net/wireless/bcm4336/wl_android.h
--- a/drivers/net/wireless/bcm4336/wl_android.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_android.h	2018-05-06 08:49:50.634754499 +0200
@@ -0,0 +1,180 @@
+/*
+ * Linux cfg80211 driver - Android related functions
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_android.h 487838 2014-06-27 05:51:44Z $
+ */
+
+#ifndef _wl_android_
+#define _wl_android_
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <wldev_common.h>
+
+/* If any feature uses the Generic Netlink Interface, put it here to enable WL_GENL
+ * automatically
+ */
+#if defined(WL_SDO) || defined(BT_WIFI_HANDOVER) || defined(WL_NAN)
+#define WL_GENL
+#endif
+
+
+#ifdef WL_GENL
+#include <net/genetlink.h>
+#endif
+
+/**
+ * Android platform dependent functions, feel free to add Android specific functions here
+ * (save the macros in dhd). Please do NOT declare functions that are NOT exposed to dhd
+ * or cfg, define them as static in wl_android.c
+ */
+
+/**
+ * wl_android_init will be called from module init function (dhd_module_init now), similarly
+ * wl_android_exit will be called from module exit function (dhd_module_cleanup now)
+ */
+int wl_android_init(void);
+int wl_android_exit(void);
+void wl_android_post_init(void);
+int wl_android_wifi_on(struct net_device *dev);
+int wl_android_wifi_off(struct net_device *dev);
+int wl_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd);
+
+#ifdef WL_GENL
+typedef struct bcm_event_hdr {
+	u16 event_type;
+	u16 len;
+} bcm_event_hdr_t;
+
+/* attributes (variables): the index in this enum is used as a reference for the type,
+ *             userspace application has to indicate the corresponding type
+ *             the policy is used for security considerations
+ */
+enum {
+	BCM_GENL_ATTR_UNSPEC,
+	BCM_GENL_ATTR_STRING,
+	BCM_GENL_ATTR_MSG,
+	__BCM_GENL_ATTR_MAX
+};
+#define BCM_GENL_ATTR_MAX (__BCM_GENL_ATTR_MAX - 1)
+
+/* commands: enumeration of all commands (functions),
+ * used by userspace application to identify command to be ececuted
+ */
+enum {
+	BCM_GENL_CMD_UNSPEC,
+	BCM_GENL_CMD_MSG,
+	__BCM_GENL_CMD_MAX
+};
+#define BCM_GENL_CMD_MAX (__BCM_GENL_CMD_MAX - 1)
+
+/* Enum values used by the BCM supplicant to identify the events */
+enum {
+	BCM_E_UNSPEC,
+	BCM_E_SVC_FOUND,
+	BCM_E_DEV_FOUND,
+	BCM_E_DEV_LOST,
+	BCM_E_DEV_BT_WIFI_HO_REQ,
+	BCM_E_MAX
+};
+
+s32 wl_genl_send_msg(struct net_device *ndev, u32 event_type,
+	u8 *string, u16 len, u8 *hdr, u16 hdrlen);
+#endif /* WL_GENL */
+s32 wl_netlink_send_msg(int pid, int type, int seq, void *data, size_t size);
+
+/* hostap mac mode */
+#define MACLIST_MODE_DISABLED   0
+#define MACLIST_MODE_DENY       1
+#define MACLIST_MODE_ALLOW      2
+
+/* max number of assoc list */
+#define MAX_NUM_OF_ASSOCLIST    64
+
+/* max number of mac filter list
+ * restrict max number to 10 as maximum cmd string size is 255
+ */
+#define MAX_NUM_MAC_FILT        10
+
+int wl_android_set_ap_mac_list(struct net_device *dev, int macmode, struct maclist *maclist);
+
+/* terence:
+ * BSSCACHE: Cache bss list
+ * RSSAVG: Average RSSI of BSS list
+ * RSSIOFFSET: RSSI offset
+ */
+//#define BSSCACHE
+//#define RSSIAVG
+//#define RSSIOFFSET
+//#define RSSIOFFSET_NEW
+
+#define RSSI_MAXVAL -2
+#define RSSI_MINVAL -200
+
+#if defined(ESCAN_RESULT_PATCH)
+#define REPEATED_SCAN_RESULT_CNT	2
+#else
+#define REPEATED_SCAN_RESULT_CNT	1
+#endif
+
+#if defined(RSSIAVG)
+#define RSSIAVG_LEN (4*REPEATED_SCAN_RESULT_CNT)
+#define RSSICACHE_TIMEOUT 15
+
+typedef struct wl_rssi_cache {
+	struct wl_rssi_cache *next;
+	int dirty;
+	struct timeval tv;
+	struct ether_addr BSSID;
+	int16 RSSI[RSSIAVG_LEN];
+} wl_rssi_cache_t;
+
+typedef struct wl_rssi_cache_ctrl {
+	wl_rssi_cache_t *m_cache_head;
+} wl_rssi_cache_ctrl_t;
+
+void wl_free_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl);
+void wl_delete_dirty_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl);
+void wl_delete_disconnected_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, u8 *bssid);
+void wl_reset_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl);
+void wl_update_rssi_cache(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, wl_scan_results_t *ss_list);
+int wl_update_connected_rssi_cache(struct net_device *net, wl_rssi_cache_ctrl_t *rssi_cache_ctrl, int *rssi_avg);
+int16 wl_get_avg_rssi(wl_rssi_cache_ctrl_t *rssi_cache_ctrl, void *addr);
+#endif
+
+#if defined(RSSIOFFSET)
+#define RSSI_OFFSET	5
+#if defined(RSSIOFFSET_NEW)
+#define RSSI_OFFSET_MAXVAL -80
+#define RSSI_OFFSET_MINVAL -94
+#define RSSI_OFFSET_INTVAL ((RSSI_OFFSET_MAXVAL-RSSI_OFFSET_MINVAL)/RSSI_OFFSET)
+#endif
+#define BCM4330_CHIP_ID		0x4330
+#define BCM4330B2_CHIP_REV      4
+int wl_update_rssi_offset(struct net_device *net, int rssi);
+#endif
+
+#if defined(BSSCACHE)
+#define BSSCACHE_TIMEOUT	15
+
+typedef struct wl_bss_cache {
+	struct wl_bss_cache *next;
+	int dirty;
+	struct timeval tv;
+	wl_scan_results_t results;
+} wl_bss_cache_t;
+
+typedef struct wl_bss_cache_ctrl {
+	wl_bss_cache_t *m_cache_head;
+} wl_bss_cache_ctrl_t;
+
+void wl_free_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+void wl_delete_dirty_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+void wl_delete_disconnected_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl, u8 *bssid);
+void wl_reset_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+void wl_update_bss_cache(wl_bss_cache_ctrl_t *bss_cache_ctrl, wl_scan_results_t *ss_list);
+void wl_release_bss_cache_ctrl(wl_bss_cache_ctrl_t *bss_cache_ctrl);
+#endif
+#endif /* _wl_android_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_cfg80211.c b/drivers/net/wireless/bcm4336/wl_cfg80211.c
--- a/drivers/net/wireless/bcm4336/wl_cfg80211.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_cfg80211.c	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,15542 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfg80211.c 506036 2014-10-02 11:33:14Z $
+ */
+/* */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+
+#include <bcmutils.h>
+#include <bcmwifi_channels.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhd_linux.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+#include <dhd_cfg80211.h>
+#ifdef PNO_SUPPORT
+#include <dhd_pno.h>
+#endif /* PNO_SUPPORT */
+
+#include <proto/ethernet.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/wait.h>
+#include <net/cfg80211.h>
+#include <net/rtnetlink.h>
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 16, 0))
+typedef const u8	NL_u8;
+#else
+typedef       u8	NL_u8;
+#endif
+
+#include <wlioctl.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wl_android.h>
+#include <wl_cfgvendor.h>
+#ifdef WL_NAN
+#include <wl_cfgnan.h>
+#endif /* WL_NAN */
+#include <dhd_config.h>
+
+#ifdef PROP_TXSTATUS
+#include <dhd_wlfc.h>
+#endif
+
+#ifdef WL11U
+#if !defined(WL_ENABLE_P2P_IF) && !defined(WL_CFG80211_P2P_DEV_IF)
+#error You should enable 'WL_ENABLE_P2P_IF' or 'WL_CFG80211_P2P_DEV_IF' \
+	according to Kernel version and is supported only in Android-JB
+#endif /* !WL_ENABLE_P2P_IF && !WL_CFG80211_P2P_DEV_IF */
+#endif /* WL11U */
+
+#ifdef BCMWAPI_WPI
+/* these items should evetually go into wireless.h of the linux system headfile dir */
+#ifndef IW_ENCODE_ALG_SM4
+#define IW_ENCODE_ALG_SM4 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_ENABLED
+#define IW_AUTH_WAPI_ENABLED 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_VERSION_1
+#define IW_AUTH_WAPI_VERSION_1  0x00000008
+#endif
+
+#ifndef IW_AUTH_CIPHER_SMS4
+#define IW_AUTH_CIPHER_SMS4     0x00000020
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_PSK
+#define IW_AUTH_KEY_MGMT_WAPI_PSK 4
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_CERT
+#define IW_AUTH_KEY_MGMT_WAPI_CERT 8
+#endif
+#endif /* BCMWAPI_WPI */
+
+#ifdef BCMWAPI_WPI
+#define IW_WSEC_ENABLED(wsec)   ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED | SMS4_ENABLED))
+#else /* BCMWAPI_WPI */
+#define IW_WSEC_ENABLED(wsec)   ((wsec) & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))
+#endif /* BCMWAPI_WPI */
+
+static struct device *cfg80211_parent_dev = NULL;
+/* g_bcm_cfg should be static. Do not change */
+static struct bcm_cfg80211 *g_bcm_cfg = NULL;
+u32 wl_dbg_level = WL_DBG_ERR;
+
+#ifdef WLAIBSS_MCHAN
+#define IBSS_IF_NAME "ibss%d"
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef VSDB
+/* sleep time to keep STA's connecting or connection for continuous af tx or finding a peer */
+#define DEFAULT_SLEEP_TIME_VSDB		120
+#define OFF_CHAN_TIME_THRESHOLD_MS	200
+#define AF_RETRY_DELAY_TIME			40
+
+/* if sta is connected or connecting, sleep for a while before retry af tx or finding a peer */
+#define WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg)	\
+	do {	\
+		if (wl_get_drv_status(cfg, CONNECTED, bcmcfg_to_prmry_ndev(cfg)) ||	\
+			wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {	\
+			OSL_SLEEP(DEFAULT_SLEEP_TIME_VSDB);			\
+		}	\
+	} while (0)
+#else /* VSDB */
+/* if not VSDB, do nothing */
+#define WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg)
+#endif /* VSDB */
+
+#ifdef WL_CFG80211_SYNC_GON
+#define WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) \
+	(wl_get_drv_status_all(cfg, SENDING_ACT_FRM) || \
+		wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN))
+#else
+#define WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg) wl_get_drv_status_all(cfg, SENDING_ACT_FRM)
+#endif /* WL_CFG80211_SYNC_GON */
+#define WL_IS_P2P_DEV_EVENT(e) ((e->emsg.ifidx == 0) && \
+		(e->emsg.bsscfgidx == P2PAPI_BSSCFG_DEVICE))
+
+#define COEX_DHCP
+
+#define WLAN_EID_SSID	0
+#define CH_MIN_5G_CHANNEL 34
+#define CH_MIN_2G_CHANNEL 1
+
+#ifdef WLAIBSS
+enum abiss_event_type {
+	AIBSS_EVENT_TXFAIL
+};
+#endif
+
+enum rmc_event_type {
+	RMC_EVENT_NONE,
+	RMC_EVENT_LEADER_CHECK_FAIL
+};
+
+/* This is to override regulatory domains defined in cfg80211 module (reg.c)
+ * By default world regulatory domain defined in reg.c puts the flags NL80211_RRF_PASSIVE_SCAN
+ * and NL80211_RRF_NO_IBSS for 5GHz channels (for 36..48 and 149..165).
+ * With respect to these flags, wpa_supplicant doesn't start p2p operations on 5GHz channels.
+ * All the chnages in world regulatory domain are to be done here.
+ */
+static const struct ieee80211_regdomain brcm_regdom = {
+	.n_reg_rules = 4,
+	.alpha2 =  "99",
+	.reg_rules = {
+		/* IEEE 802.11b/g, channels 1..11 */
+		REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
+		/* If any */
+		/* IEEE 802.11 channel 14 - Only JP enables
+		 * this and for 802.11b only
+		 */
+		REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
+		/* IEEE 802.11a, channel 36..64 */
+		REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+		/* IEEE 802.11a, channel 100..165 */
+		REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
+};
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+	(defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF))
+/*
+ * Possible interface combinations supported by driver
+ *
+ * ADHOC Mode     - #ADHOC <= 1 on channels = 1
+ * SoftAP Mode    - #AP <= 1 on channels = 1
+ * STA + P2P Mode - #STA <= 2, #{P2P-GO, P2P-client} <= 1, #P2P-device <= 1
+ *                  on channels = 2
+ */
+static const struct ieee80211_iface_limit common_if_limits[] = {
+	{
+	.max = 1,
+	.types = BIT(NL80211_IFTYPE_AP),
+	},
+	{
+	/*
+	 * During P2P-GO removal, P2P-GO is first changed to STA and later only
+	 * removed. So setting maximum possible number of STA interfaces according
+	 * to kernel version.
+	 *
+	 * less than linux-3.8 - max:3 (wlan0 + p2p0 + group removal of p2p-p2p0-x)
+	 * linux-3.8 and above - max:2 (wlan0 + group removal of p2p-wlan0-x)
+	 */
+#ifdef WL_ENABLE_P2P_IF
+	.max = 3,
+#else
+	.max = 2,
+#endif /* WL_ENABLE_P2P_IF */
+	.types = BIT(NL80211_IFTYPE_STATION),
+	},
+	{
+	.max = 2,
+	.types = BIT(NL80211_IFTYPE_P2P_GO) | BIT(NL80211_IFTYPE_P2P_CLIENT),
+	},
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	{
+	.max = 1,
+	.types = BIT(NL80211_IFTYPE_P2P_DEVICE),
+	},
+#endif /* WL_CFG80211_P2P_DEV_IF */
+	{
+	.max = 1,
+	.types = BIT(NL80211_IFTYPE_ADHOC),
+	},
+};
+#ifdef BCM4330_CHIP
+#define NUM_DIFF_CHANNELS 1
+#else
+#define NUM_DIFF_CHANNELS 2
+#endif
+static const struct ieee80211_iface_combination
+common_iface_combinations[] = {
+	{
+	.num_different_channels = NUM_DIFF_CHANNELS,
+	.max_interfaces = 4,
+	.limits = common_if_limits,
+	.n_limits = ARRAY_SIZE(common_if_limits),
+	},
+};
+#endif /* LINUX_VER >= 3.0 && (WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF) */
+
+/* Data Element Definitions */
+#define WPS_ID_CONFIG_METHODS     0x1008
+#define WPS_ID_REQ_TYPE           0x103A
+#define WPS_ID_DEVICE_NAME        0x1011
+#define WPS_ID_VERSION            0x104A
+#define WPS_ID_DEVICE_PWD_ID      0x1012
+#define WPS_ID_REQ_DEV_TYPE       0x106A
+#define WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS 0x1053
+#define WPS_ID_PRIM_DEV_TYPE      0x1054
+
+/* Device Password ID */
+#define DEV_PW_DEFAULT 0x0000
+#define DEV_PW_USER_SPECIFIED 0x0001,
+#define DEV_PW_MACHINE_SPECIFIED 0x0002
+#define DEV_PW_REKEY 0x0003
+#define DEV_PW_PUSHBUTTON 0x0004
+#define DEV_PW_REGISTRAR_SPECIFIED 0x0005
+
+/* Config Methods */
+#define WPS_CONFIG_USBA 0x0001
+#define WPS_CONFIG_ETHERNET 0x0002
+#define WPS_CONFIG_LABEL 0x0004
+#define WPS_CONFIG_DISPLAY 0x0008
+#define WPS_CONFIG_EXT_NFC_TOKEN 0x0010
+#define WPS_CONFIG_INT_NFC_TOKEN 0x0020
+#define WPS_CONFIG_NFC_INTERFACE 0x0040
+#define WPS_CONFIG_PUSHBUTTON 0x0080
+#define WPS_CONFIG_KEYPAD 0x0100
+#define WPS_CONFIG_VIRT_PUSHBUTTON 0x0280
+#define WPS_CONFIG_PHY_PUSHBUTTON 0x0480
+#define WPS_CONFIG_VIRT_DISPLAY 0x2008
+#define WPS_CONFIG_PHY_DISPLAY 0x4008
+
+#ifdef BCMCCX
+#ifndef WLAN_AKM_SUITE_CCKM
+#define WLAN_AKM_SUITE_CCKM 0x00409600
+#endif
+#define DOT11_LEAP_AUTH	0x80 /* LEAP auth frame paylod constants */
+#endif /* BCMCCX */
+
+#ifdef MFP
+#define WL_AKM_SUITE_MFP_1X  0x000FAC05
+#define WL_AKM_SUITE_MFP_PSK 0x000FAC06
+#define WL_MFP_CAPABLE 		0x1
+#define WL_MFP_REQUIRED		0x2
+#endif /* MFP */
+
+#ifndef IBSS_COALESCE_ALLOWED
+#define IBSS_COALESCE_ALLOWED 0
+#endif
+
+#ifndef IBSS_INITIAL_SCAN_ALLOWED
+#define IBSS_INITIAL_SCAN_ALLOWED 0
+#endif
+
+#define CUSTOM_RETRY_MASK 0xff000000 /* Mask for retry counter of custom dwell time */
+/*
+ * cfg80211_ops api/callback list
+ */
+static s32 wl_frame_get_mgmt(u16 fc, const struct ether_addr *da,
+	const struct ether_addr *sa, const struct ether_addr *bssid,
+	u8 **pheader, u32 *body_len, u8 *pbody);
+static s32 __wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+	struct cfg80211_scan_request *request,
+	struct cfg80211_ssid *this_ssid);
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request);
+#else
+wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+	struct cfg80211_scan_request *request);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed);
+#ifdef WLAIBSS_MCHAN
+static bcm_struct_cfgdev* bcm_cfg80211_add_ibss_if(struct wiphy *wiphy, char *name);
+static s32 bcm_cfg80211_del_ibss_if(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev);
+#endif /* WLAIBSS_MCHAN */
+static s32 wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_ibss_params *params);
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy,
+	struct net_device *dev);
+static s32 wl_cfg80211_get_station(struct wiphy *wiphy,
+	struct net_device *dev, NL_u8 *mac,
+	struct station_info *sinfo);
+static s32 wl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
+	struct net_device *dev, bool enabled,
+	s32 timeout);
+static int wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_connect_params *sme);
+static s32 wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+	u16 reason_code);
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+	enum nl80211_tx_power_setting type, s32 mbm);
+#else
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+	enum nl80211_tx_power_setting type, s32 dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_get_tx_power(struct wiphy *wiphy,
+	struct wireless_dev *wdev, s32 *dbm);
+#else
+wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+	struct net_device *dev,
+	u8 key_idx, bool unicast, bool multicast);
+static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool pairwise, const u8 *mac_addr,
+	struct key_params *params);
+static s32 wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool pairwise, const u8 *mac_addr);
+static s32 wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool pairwise, const u8 *mac_addr,
+	void *cookie, void (*callback) (void *cookie,
+	struct key_params *params));
+static s32 wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+	struct net_device *dev,	u8 key_idx);
+static s32 wl_cfg80211_resume(struct wiphy *wiphy);
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+	2, 0))
+static s32 wl_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+	bcm_struct_cfgdev *cfgdev, u64 cookie);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
+static s32 wl_cfg80211_del_station(struct wiphy *wiphy,
+	struct net_device *ndev, struct station_del_parameters *params);
+#else
+static s32 wl_cfg80211_del_station(struct wiphy *wiphy,
+	struct net_device *ndev, u8* mac_addr);
+#endif
+static s32 wl_cfg80211_change_station(struct wiphy *wiphy,
+	struct net_device *dev, NL_u8 *mac, struct station_parameters *params);
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VER >= KERNEL_VERSION(3, 2, 0)) */
+static s32
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+wl_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
+#else
+wl_cfg80211_suspend(struct wiphy *wiphy);
+#endif
+static s32 wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_pmksa *pmksa);
+static s32 wl_cfg80211_flush_pmksa(struct wiphy *wiphy,
+	struct net_device *dev);
+#ifdef  P2PONEINT
+void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg);
+#else
+void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg);
+#endif
+static s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
+	struct net_device *ndev, bool aborted, bool fw_abort);
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+#if defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+	u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+	u32 peer_capability, const u8 *data, size_t len);
+#else
+static s32 wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+	const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+	u32 peer_capability, bool initiator, const u8 *data, size_t len);
+#endif /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+static s32 wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+	NL_u8 *peer, enum nl80211_tdls_operation oper);
+#endif /* LINUX_VERSION > KERNEL_VERSION(3,2,0) || WL_COMPAT_WIRELESS */
+#ifdef WL_SCHED_SCAN
+static int wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev);
+#endif
+#if defined(DUAL_STA) || defined(DUAL_STA_STATIC_IF)
+bcm_struct_cfgdev*
+wl_cfg80211_create_iface(struct wiphy *wiphy, enum nl80211_iftype
+		 iface_type, u8 *mac_addr, const char *name);
+s32
+wl_cfg80211_del_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev);
+#endif /* defined(DUAL_STA) || defined(DUAL_STA_STATIC_IF) */
+
+/*
+ * event & event Q handlers for cfg80211 interfaces
+ */
+static s32 wl_create_event_handler(struct bcm_cfg80211 *cfg);
+static void wl_destroy_event_handler(struct bcm_cfg80211 *cfg);
+static s32 wl_event_handler(void *data);
+static void wl_init_eq(struct bcm_cfg80211 *cfg);
+static void wl_flush_eq(struct bcm_cfg80211 *cfg);
+static unsigned long wl_lock_eq(struct bcm_cfg80211 *cfg);
+static void wl_unlock_eq(struct bcm_cfg80211 *cfg, unsigned long flags);
+static void wl_init_eq_lock(struct bcm_cfg80211 *cfg);
+static void wl_init_event_handler(struct bcm_cfg80211 *cfg);
+static struct wl_event_q *wl_deq_event(struct bcm_cfg80211 *cfg);
+static s32 wl_enq_event(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 type,
+	const wl_event_msg_t *msg, void *data);
+static void wl_put_event(struct wl_event_q *e);
+static void wl_wakeup_event(struct bcm_cfg80211 *cfg);
+static s32 wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data);
+static s32 wl_notify_connect_status(struct bcm_cfg80211 *cfg,
+	bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_notify_roaming_status(struct bcm_cfg80211 *cfg,
+	bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+static s32 wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+static s32 wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data, bool completed);
+static s32 wl_bss_roaming_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data);
+static s32 wl_notify_mic_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+#ifdef BT_WIFI_HANDOVER
+static s32 wl_notify_bt_wifi_handover_req(struct bcm_cfg80211 *cfg,
+	bcm_struct_cfgdev *cfgdev, const wl_event_msg_t *e, void *data);
+#endif /* BT_WIFI_HANDOVER */
+#ifdef WL_SCHED_SCAN
+static s32
+wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data);
+#endif /* WL_SCHED_SCAN */
+#ifdef PNO_SUPPORT
+static s32 wl_notify_pfn_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+#endif /* PNO_SUPPORT */
+static s32 wl_notifier_change_state(struct bcm_cfg80211 *cfg, struct net_info *_net_info,
+	enum wl_status state, bool set);
+#ifdef WL_SDO
+static s32 wl_svc_resp_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+static s32 wl_notify_device_discovery(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+#endif
+
+#ifdef WLTDLS
+static s32 wl_tdls_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+#endif /* WLTDLS */
+/*
+ * register/deregister parent device
+ */
+static void wl_cfg80211_clear_parent_dev(void);
+
+/*
+ * ioctl utilites
+ */
+
+/*
+ * cfg80211 set_wiphy_params utilities
+ */
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_rts(struct net_device *dev, u32 frag_threshold);
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l);
+
+/*
+ * cfg profile utilities
+ */
+static s32 wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data, s32 item);
+static void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 item);
+static void wl_init_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+
+/*
+ * cfg80211 connect utilites
+ */
+static s32 wl_set_wpa_version(struct net_device *dev,
+	struct cfg80211_connect_params *sme);
+static s32 wl_set_auth_type(struct net_device *dev,
+	struct cfg80211_connect_params *sme);
+static s32 wl_set_set_cipher(struct net_device *dev,
+	struct cfg80211_connect_params *sme);
+static s32 wl_set_key_mgmt(struct net_device *dev,
+	struct cfg80211_connect_params *sme);
+static s32 wl_set_set_sharedkey(struct net_device *dev,
+	struct cfg80211_connect_params *sme);
+#ifdef BCMWAPI_WPI
+static s32 wl_set_set_wapi_ie(struct net_device *dev,
+        struct cfg80211_connect_params *sme);
+#endif
+static s32 wl_get_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+static void wl_ch_to_chanspec(int ch,
+	struct wl_join_params *join_params, size_t *join_params_size);
+
+/*
+ * information element utilities
+ */
+static void wl_rst_ie(struct bcm_cfg80211 *cfg);
+static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v);
+static void wl_update_hidden_ap_ie(struct wl_bss_info *bi, u8 *ie_stream, u32 *ie_size, bool roam);
+static s32 wl_mrg_ie(struct bcm_cfg80211 *cfg, u8 *ie_stream, u16 ie_size);
+static s32 wl_cp_ie(struct bcm_cfg80211 *cfg, u8 *dst, u16 dst_size);
+static u32 wl_get_ielen(struct bcm_cfg80211 *cfg);
+#ifdef MFP
+static int wl_cfg80211_get_rsn_capa(bcm_tlv_t *wpa2ie, u8* capa);
+#endif
+
+#ifdef WL11U
+bcm_tlv_t *
+wl_cfg80211_find_interworking_ie(u8 *parse, u32 len);
+static s32
+wl_cfg80211_add_iw_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx, s32 pktflag,
+            uint8 ie_id, uint8 *data, uint8 data_len);
+#endif /* WL11U */
+
+static s32 wl_setup_wiphy(struct wireless_dev *wdev, struct device *dev, void *data);
+static void wl_free_wdev(struct bcm_cfg80211 *cfg);
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+static int
+wl_cfg80211_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request);
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+static s32 wl_inform_bss(struct bcm_cfg80211 *cfg);
+static s32 wl_inform_single_bss(struct bcm_cfg80211 *cfg, struct wl_bss_info *bi, bool roam);
+static s32 wl_update_bss_info(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool roam);
+#ifdef  P2PONEINT
+chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy);
+#else
+chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy);
+#endif
+s32 wl_cfg80211_channel_to_freq(u32 channel);
+
+#if defined(DHCP_SCAN_SUPPRESS)
+static void wl_cfg80211_work_handler(struct work_struct *work);
+static void wl_cfg80211_scan_supp_timerfunc(ulong data);
+#endif /* DHCP_SCAN_SUPPRESS */
+
+static void wl_cfg80211_work_handler(struct work_struct *work);
+static s32 wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, const u8 *mac_addr,
+	struct key_params *params);
+/*
+ * key indianess swap utilities
+ */
+static void swap_key_from_BE(struct wl_wsec_key *key);
+static void swap_key_to_BE(struct wl_wsec_key *key);
+
+/*
+ * bcm_cfg80211 memory init/deinit utilities
+ */
+static s32 wl_init_priv_mem(struct bcm_cfg80211 *cfg);
+static void wl_deinit_priv_mem(struct bcm_cfg80211 *cfg);
+
+static void wl_delay(u32 ms);
+
+/*
+ * ibss mode utilities
+ */
+static bool wl_is_ibssmode(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+static __used bool wl_is_ibssstarter(struct bcm_cfg80211 *cfg);
+
+/*
+ * link up/down , default configuration utilities
+ */
+static s32 __wl_cfg80211_up(struct bcm_cfg80211 *cfg);
+static s32 __wl_cfg80211_down(struct bcm_cfg80211 *cfg);
+static bool wl_is_linkdown(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e);
+static bool wl_is_linkup(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e,
+	struct net_device *ndev);
+static bool wl_is_nonetwork(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e);
+static void wl_link_up(struct bcm_cfg80211 *cfg);
+static void wl_link_down(struct bcm_cfg80211 *cfg);
+static s32 wl_config_ifmode(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 iftype);
+static void wl_init_conf(struct wl_conf *conf);
+static s32 wl_cfg80211_handle_ifdel(struct bcm_cfg80211 *cfg, wl_if_event_info *if_event_info,
+	struct net_device* ndev);
+
+int wl_cfg80211_get_ioctl_version(void);
+
+/*
+ * find most significant bit set
+ */
+static __used u32 wl_find_msb(u16 bit16);
+
+/*
+ * rfkill support
+ */
+static int wl_setup_rfkill(struct bcm_cfg80211 *cfg, bool setup);
+static int wl_rfkill_set(void *data, bool blocked);
+#ifdef DEBUGFS_CFG80211
+static s32 wl_setup_debugfs(struct bcm_cfg80211 *cfg);
+static s32 wl_free_debugfs(struct bcm_cfg80211 *cfg);
+#endif
+
+static wl_scan_params_t *wl_cfg80211_scan_alloc_params(int channel,
+	int nprobes, int *out_params_size);
+static bool check_dev_role_integrity(struct bcm_cfg80211 *cfg, u32 dev_role);
+
+#ifdef WL_CFG80211_ACL
+/* ACL */
+static int wl_cfg80211_set_mac_acl(struct wiphy *wiphy, struct net_device *cfgdev,
+	const struct cfg80211_acl_data *acl);
+#endif /* WL_CFG80211_ACL */
+
+/*
+ * Some external functions, TODO: move them to dhd_linux.h
+ */
+int dhd_add_monitor(char *name, struct net_device **new_ndev);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+
+
+static int wl_cfg80211_delayed_roam(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const struct ether_addr *bssid);
+
+#ifdef WL_SDO
+s32 wl_cfg80211_sdo_init(struct bcm_cfg80211 *cfg);
+s32 wl_cfg80211_sdo_deinit(struct bcm_cfg80211 *cfg);
+#define MAX_SDO_PROTO 5
+wl_sdo_proto_t wl_sdo_protos [] = {
+	{ "all", SVC_RPOTYPE_ALL },
+	{ "upnp", SVC_RPOTYPE_UPNP },
+	{ "bonjour", SVC_RPOTYPE_BONJOUR },
+	{ "wsd", SVC_RPOTYPE_WSD },
+	{ "vendor", SVC_RPOTYPE_VENDOR },
+};
+#endif
+static int bw2cap[] = { 0, 0, WLC_BW_CAP_20MHZ, WLC_BW_CAP_40MHZ, WLC_BW_CAP_80MHZ,
+	WLC_BW_CAP_160MHZ, WLC_BW_CAP_160MHZ };
+
+#define RETURN_EIO_IF_NOT_UP(wlpriv)						\
+do {									\
+	struct net_device *checkSysUpNDev = bcmcfg_to_prmry_ndev(wlpriv);       	\
+	if (unlikely(!wl_get_drv_status(wlpriv, READY, checkSysUpNDev))) {	\
+		WL_INFORM(("device is not ready\n"));			\
+		return -EIO;						\
+	}								\
+} while (0)
+
+#define IS_WPA_AKM(akm) ((akm) == RSN_AKM_NONE || 			\
+				 (akm) == RSN_AKM_UNSPECIFIED || 	\
+				 (akm) == RSN_AKM_PSK)
+
+
+extern int dhd_wait_pend8021x(struct net_device *dev);
+#ifdef PROP_TXSTATUS_VSDB
+extern int disable_proptx;
+#endif /* PROP_TXSTATUS_VSDB */
+
+extern int passive_channel_skip;
+
+#if (WL_DBG_LEVEL > 0)
+#define WL_DBG_ESTR_MAX	50
+static s8 wl_dbg_estr[][WL_DBG_ESTR_MAX] = {
+	"SET_SSID", "JOIN", "START", "AUTH", "AUTH_IND",
+	"DEAUTH", "DEAUTH_IND", "ASSOC", "ASSOC_IND", "REASSOC",
+	"REASSOC_IND", "DISASSOC", "DISASSOC_IND", "QUIET_START", "QUIET_END",
+	"BEACON_RX", "LINK", "MIC_ERROR", "NDIS_LINK", "ROAM",
+	"TXFAIL", "PMKID_CACHE", "RETROGRADE_TSF", "PRUNE", "AUTOAUTH",
+	"EAPOL_MSG", "SCAN_COMPLETE", "ADDTS_IND", "DELTS_IND", "BCNSENT_IND",
+	"BCNRX_MSG", "BCNLOST_MSG", "ROAM_PREP", "PFN_NET_FOUND",
+	"PFN_NET_LOST",
+	"RESET_COMPLETE", "JOIN_START", "ROAM_START", "ASSOC_START",
+	"IBSS_ASSOC",
+	"RADIO", "PSM_WATCHDOG", "WLC_E_CCX_ASSOC_START", "WLC_E_CCX_ASSOC_ABORT",
+	"PROBREQ_MSG",
+	"SCAN_CONFIRM_IND", "PSK_SUP", "COUNTRY_CODE_CHANGED",
+	"EXCEEDED_MEDIUM_TIME", "ICV_ERROR",
+	"UNICAST_DECODE_ERROR", "MULTICAST_DECODE_ERROR", "TRACE",
+	"WLC_E_BTA_HCI_EVENT", "IF", "WLC_E_P2P_DISC_LISTEN_COMPLETE",
+	"RSSI", "PFN_SCAN_COMPLETE", "WLC_E_EXTLOG_MSG",
+	"ACTION_FRAME", "ACTION_FRAME_COMPLETE", "WLC_E_PRE_ASSOC_IND",
+	"WLC_E_PRE_REASSOC_IND", "WLC_E_CHANNEL_ADOPTED", "WLC_E_AP_STARTED",
+	"WLC_E_DFS_AP_STOP", "WLC_E_DFS_AP_RESUME", "WLC_E_WAI_STA_EVENT",
+	"WLC_E_WAI_MSG", "WLC_E_ESCAN_RESULT", "WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE",
+	"WLC_E_PROBRESP_MSG", "WLC_E_P2P_PROBREQ_MSG", "WLC_E_DCS_REQUEST", "WLC_E_FIFO_CREDIT_MAP",
+	"WLC_E_ACTION_FRAME_RX", "WLC_E_WAKE_EVENT", "WLC_E_RM_COMPLETE"
+};
+#endif				/* WL_DBG_LEVEL */
+
+#define CHAN2G(_channel, _freq, _flags) {			\
+	.band			= NL80211_BAND_2GHZ,		\
+	.center_freq		= (_freq),			\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+#define CHAN5G(_channel, _flags) {				\
+	.band			= NL80211_BAND_5GHZ,		\
+	.center_freq		= 5000 + (5 * (_channel)),	\
+	.hw_value		= (_channel),			\
+	.flags			= (_flags),			\
+	.max_antenna_gain	= 0,				\
+	.max_power		= 30,				\
+}
+
+#define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
+#define RATETAB_ENT(_rateid, _flags) \
+	{								\
+		.bitrate	= RATE_TO_BASE100KBPS(_rateid),     \
+		.hw_value	= (_rateid),			    \
+		.flags	  = (_flags),			     \
+	}
+
+static struct ieee80211_rate __wl_rates[] = {
+	RATETAB_ENT(DOT11_RATE_1M, 0),
+	RATETAB_ENT(DOT11_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
+	RATETAB_ENT(DOT11_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
+	RATETAB_ENT(DOT11_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
+	RATETAB_ENT(DOT11_RATE_6M, 0),
+	RATETAB_ENT(DOT11_RATE_9M, 0),
+	RATETAB_ENT(DOT11_RATE_12M, 0),
+	RATETAB_ENT(DOT11_RATE_18M, 0),
+	RATETAB_ENT(DOT11_RATE_24M, 0),
+	RATETAB_ENT(DOT11_RATE_36M, 0),
+	RATETAB_ENT(DOT11_RATE_48M, 0),
+	RATETAB_ENT(DOT11_RATE_54M, 0)
+};
+
+#define wl_a_rates		(__wl_rates + 4)
+#define wl_a_rates_size	8
+#define wl_g_rates		(__wl_rates + 0)
+#define wl_g_rates_size	12
+
+static struct ieee80211_channel __wl_2ghz_channels[] = {
+	CHAN2G(1, 2412, 0),
+	CHAN2G(2, 2417, 0),
+	CHAN2G(3, 2422, 0),
+	CHAN2G(4, 2427, 0),
+	CHAN2G(5, 2432, 0),
+	CHAN2G(6, 2437, 0),
+	CHAN2G(7, 2442, 0),
+	CHAN2G(8, 2447, 0),
+	CHAN2G(9, 2452, 0),
+	CHAN2G(10, 2457, 0),
+	CHAN2G(11, 2462, 0),
+	CHAN2G(12, 2467, 0),
+	CHAN2G(13, 2472, 0),
+	CHAN2G(14, 2484, 0)
+};
+
+static struct ieee80211_channel __wl_5ghz_a_channels[] = {
+	CHAN5G(34, 0), CHAN5G(36, 0),
+	CHAN5G(38, 0), CHAN5G(40, 0),
+	CHAN5G(42, 0), CHAN5G(44, 0),
+	CHAN5G(46, 0), CHAN5G(48, 0),
+	CHAN5G(52, 0), CHAN5G(56, 0),
+	CHAN5G(60, 0), CHAN5G(64, 0),
+	CHAN5G(100, 0), CHAN5G(104, 0),
+	CHAN5G(108, 0), CHAN5G(112, 0),
+	CHAN5G(116, 0), CHAN5G(120, 0),
+	CHAN5G(124, 0), CHAN5G(128, 0),
+	CHAN5G(132, 0), CHAN5G(136, 0),
+	CHAN5G(140, 0), CHAN5G(144, 0),
+	CHAN5G(149, 0),	CHAN5G(153, 0),
+	CHAN5G(157, 0),	CHAN5G(161, 0),
+	CHAN5G(165, 0)
+};
+
+static struct ieee80211_supported_band __wl_band_2ghz = {
+	.band = NL80211_BAND_2GHZ,
+	.channels = __wl_2ghz_channels,
+	.n_channels = ARRAY_SIZE(__wl_2ghz_channels),
+	.bitrates = wl_g_rates,
+	.n_bitrates = wl_g_rates_size
+};
+
+static struct ieee80211_supported_band __wl_band_5ghz_a = {
+	.band = NL80211_BAND_5GHZ,
+	.channels = __wl_5ghz_a_channels,
+	.n_channels = ARRAY_SIZE(__wl_5ghz_a_channels),
+	.bitrates = wl_a_rates,
+	.n_bitrates = wl_a_rates_size
+};
+
+static const u32 __wl_cipher_suites[] = {
+	WLAN_CIPHER_SUITE_WEP40,
+	WLAN_CIPHER_SUITE_WEP104,
+	WLAN_CIPHER_SUITE_TKIP,
+	WLAN_CIPHER_SUITE_CCMP,
+	WLAN_CIPHER_SUITE_AES_CMAC,
+#ifdef BCMWAPI_WPI
+	WLAN_CIPHER_SUITE_SMS4,
+#endif
+#if defined(WLFBT) && defined(WLAN_CIPHER_SUITE_PMK)
+	WLAN_CIPHER_SUITE_PMK,
+#endif
+};
+
+#ifdef WL_SUPPORT_ACS
+/*
+ * The firmware code required for this feature to work is currently under
+ * BCMINTERNAL flag. In future if this is to enabled we need to bring the
+ * required firmware code out of the BCMINTERNAL flag.
+ */
+struct wl_dump_survey {
+	u32 obss;
+	u32 ibss;
+	u32 no_ctg;
+	u32 no_pckt;
+	u32 tx;
+	u32 idle;
+};
+#endif /* WL_SUPPORT_ACS */
+
+
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+static int maxrxpktglom = 0;
+#endif
+
+/* IOCtl version read from targeted driver */
+static int ioctl_version;
+#ifdef DEBUGFS_CFG80211
+#define S_SUBLOGLEVEL 20
+static const struct {
+	u32 log_level;
+	char *sublogname;
+} sublogname_map[] = {
+	{WL_DBG_ERR, "ERR"},
+	{WL_DBG_INFO, "INFO"},
+	{WL_DBG_DBG, "DBG"},
+	{WL_DBG_SCAN, "SCAN"},
+	{WL_DBG_TRACE, "TRACE"},
+	{WL_DBG_P2P_ACTION, "P2PACTION"}
+};
+#endif
+
+
+static void wl_add_remove_pm_enable_work(struct bcm_cfg80211 *cfg, bool add_remove,
+	enum wl_handler_del_type type)
+{
+	if (cfg == NULL)
+		return;
+
+	if (cfg->pm_enable_work_on) {
+		if (add_remove) {
+			schedule_delayed_work(&cfg->pm_enable_work,
+				msecs_to_jiffies(WL_PM_ENABLE_TIMEOUT));
+		} else {
+			cancel_delayed_work_sync(&cfg->pm_enable_work);
+			switch (type) {
+				case WL_HANDLER_MAINTAIN:
+					schedule_delayed_work(&cfg->pm_enable_work,
+						msecs_to_jiffies(WL_PM_ENABLE_TIMEOUT));
+					break;
+				case WL_HANDLER_PEND:
+					schedule_delayed_work(&cfg->pm_enable_work,
+						msecs_to_jiffies(WL_PM_ENABLE_TIMEOUT*2));
+					break;
+				case WL_HANDLER_DEL:
+				default:
+					cfg->pm_enable_work_on = false;
+					break;
+			}
+		}
+	}
+}
+
+/* Return a new chanspec given a legacy chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_from_legacy(chanspec_t legacy_chspec)
+{
+	chanspec_t chspec;
+
+	/* get the channel number */
+	chspec = LCHSPEC_CHANNEL(legacy_chspec);
+
+	/* convert the band */
+	if (LCHSPEC_IS2G(legacy_chspec)) {
+		chspec |= WL_CHANSPEC_BAND_2G;
+	} else {
+		chspec |= WL_CHANSPEC_BAND_5G;
+	}
+
+	/* convert the bw and sideband */
+	if (LCHSPEC_IS20(legacy_chspec)) {
+		chspec |= WL_CHANSPEC_BW_20;
+	} else {
+		chspec |= WL_CHANSPEC_BW_40;
+		if (LCHSPEC_CTL_SB(legacy_chspec) == WL_LCHANSPEC_CTL_SB_LOWER) {
+			chspec |= WL_CHANSPEC_CTL_SB_L;
+		} else {
+			chspec |= WL_CHANSPEC_CTL_SB_U;
+		}
+	}
+
+	if (wf_chspec_malformed(chspec)) {
+		WL_ERR(("wl_chspec_from_legacy: output chanspec (0x%04X) malformed\n",
+		        chspec));
+		return INVCHANSPEC;
+	}
+
+	return chspec;
+}
+
+/* Return a legacy chanspec given a new chanspec
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_to_legacy(chanspec_t chspec)
+{
+	chanspec_t lchspec;
+
+	if (wf_chspec_malformed(chspec)) {
+		WL_ERR(("wl_chspec_to_legacy: input chanspec (0x%04X) malformed\n",
+		        chspec));
+		return INVCHANSPEC;
+	}
+
+	/* get the channel number */
+	lchspec = CHSPEC_CHANNEL(chspec);
+
+	/* convert the band */
+	if (CHSPEC_IS2G(chspec)) {
+		lchspec |= WL_LCHANSPEC_BAND_2G;
+	} else {
+		lchspec |= WL_LCHANSPEC_BAND_5G;
+	}
+
+	/* convert the bw and sideband */
+	if (CHSPEC_IS20(chspec)) {
+		lchspec |= WL_LCHANSPEC_BW_20;
+		lchspec |= WL_LCHANSPEC_CTL_SB_NONE;
+	} else if (CHSPEC_IS40(chspec)) {
+		lchspec |= WL_LCHANSPEC_BW_40;
+		if (CHSPEC_CTL_SB(chspec) == WL_CHANSPEC_CTL_SB_L) {
+			lchspec |= WL_LCHANSPEC_CTL_SB_LOWER;
+		} else {
+			lchspec |= WL_LCHANSPEC_CTL_SB_UPPER;
+		}
+	} else {
+		/* cannot express the bandwidth */
+		char chanbuf[CHANSPEC_STR_LEN];
+		WL_ERR((
+		        "wl_chspec_to_legacy: unable to convert chanspec %s (0x%04X) "
+		        "to pre-11ac format\n",
+		        wf_chspec_ntoa(chspec, chanbuf), chspec));
+		return INVCHANSPEC;
+	}
+
+	return lchspec;
+}
+
+/* given a chanspec value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_chspec_host_to_driver(chanspec_t chanspec)
+{
+	if (ioctl_version == 1) {
+		chanspec = wl_chspec_to_legacy(chanspec);
+		if (chanspec == INVCHANSPEC) {
+			return chanspec;
+		}
+	}
+	chanspec = htodchanspec(chanspec);
+
+	return chanspec;
+}
+
+/* given a channel value, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+chanspec_t
+wl_ch_host_to_driver(u16 channel)
+{
+
+	chanspec_t chanspec;
+
+	chanspec = channel & WL_CHANSPEC_CHAN_MASK;
+
+	if (channel <= CH_MAX_2G_CHANNEL)
+		chanspec |= WL_CHANSPEC_BAND_2G;
+	else
+		chanspec |= WL_CHANSPEC_BAND_5G;
+
+	chanspec |= WL_CHANSPEC_BW_20;
+	chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+	return wl_chspec_host_to_driver(chanspec);
+}
+
+/* given a chanspec value from the driver, do the endian and chanspec version conversion to
+ * a chanspec_t value
+ * Returns INVCHANSPEC on error
+ */
+static chanspec_t
+wl_chspec_driver_to_host(chanspec_t chanspec)
+{
+	chanspec = dtohchanspec(chanspec);
+	if (ioctl_version == 1) {
+		chanspec = wl_chspec_from_legacy(chanspec);
+	}
+
+	return chanspec;
+}
+
+/*
+ * convert ASCII string to MAC address (colon-delimited format)
+ * eg: 00:11:22:33:44:55
+ */
+int
+wl_cfg80211_ether_atoe(const char *a, struct ether_addr *n)
+{
+	char *c = NULL;
+	int count = 0;
+
+	memset(n, 0, ETHER_ADDR_LEN);
+	for (;;) {
+		n->octet[count++] = (uint8)simple_strtoul(a, &c, 16);
+		if (!*c++ || count == ETHER_ADDR_LEN)
+			break;
+		a = c;
+	}
+	return (count == ETHER_ADDR_LEN);
+}
+
+/* convert hex string buffer to binary */
+int
+wl_cfg80211_hex_str_to_bin(unsigned char *data, int dlen, char *str)
+{
+	int count, slen;
+	int hvalue;
+	char tmp[3] = {0};
+	char *ptr = str, *endp = NULL;
+
+	if (!data || !str || !dlen) {
+		WL_DBG((" passed buffer is empty \n"));
+		return 0;
+	}
+
+	slen = strlen(str);
+	if (dlen * 2 < slen) {
+		WL_DBG((" destination buffer too short \n"));
+		return 0;
+	}
+
+	if (slen % 2) {
+		WL_DBG((" source buffer is of odd length \n"));
+		return 0;
+	}
+
+	for (count = 0; count < slen; count += 2) {
+		memcpy(tmp, ptr, 2);
+		hvalue = simple_strtol(tmp, &endp, 16);
+		if (*endp != '\0') {
+			WL_DBG((" non hexadecimal character encountered \n"));
+			return 0;
+		}
+		*data++ = (unsigned char)hvalue;
+		ptr += 2;
+	}
+
+	return (slen / 2);
+}
+
+/* There isn't a lot of sense in it, but you can transmit anything you like */
+static const struct ieee80211_txrx_stypes
+wl_cfg80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+	[NL80211_IFTYPE_ADHOC] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_STATION] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+	[NL80211_IFTYPE_AP] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_AP_VLAN] = {
+		/* copy AP */
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+	[NL80211_IFTYPE_P2P_CLIENT] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+	[NL80211_IFTYPE_P2P_GO] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+		BIT(IEEE80211_STYPE_AUTH >> 4) |
+		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+		BIT(IEEE80211_STYPE_ACTION >> 4)
+	},
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	[NL80211_IFTYPE_P2P_DEVICE] = {
+		.tx = 0xffff,
+		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+	},
+#endif /* WL_CFG80211_P2P_DEV_IF */
+};
+
+static void swap_key_from_BE(struct wl_wsec_key *key)
+{
+	key->index = htod32(key->index);
+	key->len = htod32(key->len);
+	key->algo = htod32(key->algo);
+	key->flags = htod32(key->flags);
+	key->rxiv.hi = htod32(key->rxiv.hi);
+	key->rxiv.lo = htod16(key->rxiv.lo);
+	key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(struct wl_wsec_key *key)
+{
+	key->index = dtoh32(key->index);
+	key->len = dtoh32(key->len);
+	key->algo = dtoh32(key->algo);
+	key->flags = dtoh32(key->flags);
+	key->rxiv.hi = dtoh32(key->rxiv.hi);
+	key->rxiv.lo = dtoh16(key->rxiv.lo);
+	key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+/* Dump the contents of the encoded wps ie buffer and get pbc value */
+static void
+wl_validate_wps_ie(char *wps_ie, s32 wps_ie_len, bool *pbc)
+{
+	#define WPS_IE_FIXED_LEN 6
+	u16 len;
+	u8 *subel = NULL;
+	u16 subelt_id;
+	u16 subelt_len;
+	u16 val;
+	u8 *valptr = (uint8*) &val;
+	if (wps_ie == NULL || wps_ie_len < WPS_IE_FIXED_LEN) {
+		WL_ERR(("invalid argument : NULL\n"));
+		return;
+	}
+	len = (u16)wps_ie[TLV_LEN_OFF];
+
+	if (len > wps_ie_len) {
+		WL_ERR(("invalid length len %d, wps ie len %d\n", len, wps_ie_len));
+		return;
+	}
+	WL_DBG(("wps_ie len=%d\n", len));
+	len -= 4;	/* for the WPS IE's OUI, oui_type fields */
+	subel = wps_ie + WPS_IE_FIXED_LEN;
+	while (len >= 4) {		/* must have attr id, attr len fields */
+		valptr[0] = *subel++;
+		valptr[1] = *subel++;
+		subelt_id = HTON16(val);
+
+		valptr[0] = *subel++;
+		valptr[1] = *subel++;
+		subelt_len = HTON16(val);
+
+		len -= 4;			/* for the attr id, attr len fields */
+		len -= subelt_len;	/* for the remaining fields in this attribute */
+		WL_DBG((" subel=%p, subelt_id=0x%x subelt_len=%u\n",
+			subel, subelt_id, subelt_len));
+
+		if (subelt_id == WPS_ID_VERSION) {
+			WL_DBG(("  attr WPS_ID_VERSION: %u\n", *subel));
+		} else if (subelt_id == WPS_ID_REQ_TYPE) {
+			WL_DBG(("  attr WPS_ID_REQ_TYPE: %u\n", *subel));
+		} else if (subelt_id == WPS_ID_CONFIG_METHODS) {
+			valptr[0] = *subel;
+			valptr[1] = *(subel + 1);
+			WL_DBG(("  attr WPS_ID_CONFIG_METHODS: %x\n", HTON16(val)));
+		} else if (subelt_id == WPS_ID_DEVICE_NAME) {
+			char devname[100];
+			memcpy(devname, subel, subelt_len);
+			devname[subelt_len] = '\0';
+			WL_DBG(("  attr WPS_ID_DEVICE_NAME: %s (len %u)\n",
+				devname, subelt_len));
+		} else if (subelt_id == WPS_ID_DEVICE_PWD_ID) {
+			valptr[0] = *subel;
+			valptr[1] = *(subel + 1);
+			WL_DBG(("  attr WPS_ID_DEVICE_PWD_ID: %u\n", HTON16(val)));
+			*pbc = (HTON16(val) == DEV_PW_PUSHBUTTON) ? true : false;
+		} else if (subelt_id == WPS_ID_PRIM_DEV_TYPE) {
+			valptr[0] = *subel;
+			valptr[1] = *(subel + 1);
+			WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: cat=%u \n", HTON16(val)));
+			valptr[0] = *(subel + 6);
+			valptr[1] = *(subel + 7);
+			WL_DBG(("  attr WPS_ID_PRIM_DEV_TYPE: subcat=%u\n", HTON16(val)));
+		} else if (subelt_id == WPS_ID_REQ_DEV_TYPE) {
+			valptr[0] = *subel;
+			valptr[1] = *(subel + 1);
+			WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: cat=%u\n", HTON16(val)));
+			valptr[0] = *(subel + 6);
+			valptr[1] = *(subel + 7);
+			WL_DBG(("  attr WPS_ID_REQ_DEV_TYPE: subcat=%u\n", HTON16(val)));
+		} else if (subelt_id == WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS) {
+			valptr[0] = *subel;
+			valptr[1] = *(subel + 1);
+			WL_DBG(("  attr WPS_ID_SELECTED_REGISTRAR_CONFIG_METHODS"
+				": cat=%u\n", HTON16(val)));
+		} else {
+			WL_DBG(("  unknown attr 0x%x\n", subelt_id));
+		}
+
+		subel += subelt_len;
+	}
+}
+
+s32 wl_set_tx_power(struct net_device *dev,
+	enum nl80211_tx_power_setting type, s32 dbm)
+{
+	s32 err = 0;
+	s32 disable = 0;
+	s32 txpwrqdbm;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	/* Make sure radio is off or on as far as software is concerned */
+	disable = WL_RADIO_SW_DISABLE << 16;
+	disable = htod32(disable);
+	err = wldev_ioctl(dev, WLC_SET_RADIO, &disable, sizeof(disable), true);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_SET_RADIO error (%d)\n", err));
+		return err;
+	}
+
+	if (dbm > 0xffff)
+		dbm = 0xffff;
+	txpwrqdbm = dbm * 4;
+#ifdef SUPPORT_WL_TXPOWER
+	if (type == NL80211_TX_POWER_AUTOMATIC)
+		txpwrqdbm = 127;
+	else
+		txpwrqdbm |= WL_TXPWR_OVERRIDE;
+#endif /* SUPPORT_WL_TXPOWER */
+	err = wldev_iovar_setbuf_bsscfg(dev, "qtxpower", (void *)&txpwrqdbm,
+		sizeof(txpwrqdbm), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+		&cfg->ioctl_buf_sync);
+	if (unlikely(err))
+		WL_ERR(("qtxpower error (%d)\n", err));
+	else
+		WL_ERR(("dBm=%d, txpwrqdbm=0x%x\n", dbm, txpwrqdbm));
+
+	return err;
+}
+
+s32 wl_get_tx_power(struct net_device *dev, s32 *dbm)
+{
+	s32 err = 0;
+	s32 txpwrdbm;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	err = wldev_iovar_getbuf_bsscfg(dev, "qtxpower",
+		NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+	if (unlikely(err)) {
+		WL_ERR(("error (%d)\n", err));
+		return err;
+	}
+
+	memcpy(&txpwrdbm, cfg->ioctl_buf, sizeof(txpwrdbm));
+	txpwrdbm = dtoh32(txpwrdbm);
+	*dbm = (txpwrdbm & ~WL_TXPWR_OVERRIDE) / 4;
+
+	WL_INFORM(("dBm=%d, txpwrdbm=0x%x\n", *dbm, txpwrdbm));
+
+	return err;
+}
+
+chanspec_t
+#ifdef  P2PONEINT
+wl_cfg80211_get_shared_freq(struct wiphy *wiphy)
+#else
+wl_cfg80211_get_shared_freq(struct wiphy *wiphy)
+#endif
+{
+	chanspec_t chspec;
+	int err = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+	struct ether_addr bssid;
+	struct wl_bss_info *bss = NULL;
+
+	if ((err = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, sizeof(bssid), false))) {
+		/* STA interface is not associated. So start the new interface on a temp
+		 * channel . Later proper channel will be applied by the above framework
+		 * via set_channel (cfg80211 API).
+		 */
+		WL_DBG(("Not associated. Return a temp channel. \n"));
+		return wl_ch_host_to_driver(WL_P2P_TEMP_CHAN);
+	}
+
+
+	*(u32 *) cfg->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+	if ((err = wldev_ioctl(dev, WLC_GET_BSS_INFO, cfg->extra_buf,
+		WL_EXTRA_BUF_MAX, false))) {
+			WL_ERR(("Failed to get associated bss info, use temp channel \n"));
+			chspec = wl_ch_host_to_driver(WL_P2P_TEMP_CHAN);
+	}
+	else {
+			bss = (struct wl_bss_info *) (cfg->extra_buf + 4);
+			chspec =  bss->chanspec;
+
+			WL_DBG(("Valid BSS Found. chanspec:%d \n", chspec));
+	}
+	return chspec;
+}
+
+static bcm_struct_cfgdev *
+wl_cfg80211_add_monitor_if(char *name)
+{
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF)
+	WL_INFORM(("wl_cfg80211_add_monitor_if: No more support monitor interface\n"));
+	return ERR_PTR(-EOPNOTSUPP);
+#else
+	struct net_device* ndev = NULL;
+
+	dhd_add_monitor(name, &ndev);
+	WL_INFORM(("wl_cfg80211_add_monitor_if net device returned: 0x%p\n", ndev));
+	return ndev_to_cfgdev(ndev);
+#endif /* WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF */
+}
+
+static bcm_struct_cfgdev *
+wl_cfg80211_add_virtual_iface(struct wiphy *wiphy,
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	const char *name,
+#else
+	char *name,
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
+	unsigned char name_assign_type,
+#endif
+	enum nl80211_iftype type, u32 *flags,
+	struct vif_params *params)
+{
+	s32 err;
+	s32 timeout = -1;
+	s32 wlif_type = -1;
+	s32 mode = 0;
+	s32 val = 0;
+	s32 dhd_mode = 0;
+	chanspec_t chspec;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *primary_ndev;
+	struct net_device *new_ndev;
+	struct ether_addr primary_mac;
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+	s32 up = 1;
+	dhd_pub_t *dhd;
+	bool enabled;
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+#if defined(SUPPORT_AP_POWERSAVE)
+	dhd_pub_t *dhd;
+#endif
+
+	if (!cfg)
+		return ERR_PTR(-EINVAL);
+
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+	dhd = (dhd_pub_t *)(cfg->pub);
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+#if defined(SUPPORT_AP_POWERSAVE)
+	dhd = (dhd_pub_t *)(cfg->pub);
+#endif
+
+	/* Use primary I/F for sending cmds down to firmware */
+	primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	if (unlikely(!wl_get_drv_status(cfg, READY, primary_ndev))) {
+		WL_ERR(("device is not ready\n"));
+		return ERR_PTR(-ENODEV);
+	}
+
+	WL_DBG(("if name: %s, type: %d\n", name, type));
+	switch (type) {
+	case NL80211_IFTYPE_ADHOC:
+#ifdef WLAIBSS_MCHAN
+		return bcm_cfg80211_add_ibss_if(wiphy, (char *)name);
+#endif /* WLAIBSS_MCHAN */
+	case NL80211_IFTYPE_AP_VLAN:
+	case NL80211_IFTYPE_WDS:
+	case NL80211_IFTYPE_MESH_POINT:
+		WL_ERR(("Unsupported interface type\n"));
+		mode = WL_MODE_IBSS;
+		return NULL;
+	case NL80211_IFTYPE_MONITOR:
+		return wl_cfg80211_add_monitor_if((char *)name);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	case NL80211_IFTYPE_P2P_DEVICE:
+		return wl_cfgp2p_add_p2p_disc_if(cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+	case NL80211_IFTYPE_STATION:
+#ifdef DUAL_STA
+#ifdef WLAIBSS_MCHAN
+		if (cfg->ibss_cfgdev) {
+			WL_ERR(("AIBSS is already operational. "
+					" AIBSS & DUALSTA can't be used together \n"));
+			return NULL;
+		}
+#endif /* WLAIBSS_MCHAN */
+		if (!name) {
+			WL_ERR(("Interface name not provided \n"));
+			return NULL;
+		}
+		return wl_cfg80211_create_iface(cfg->wdev->wiphy,
+			NL80211_IFTYPE_STATION, NULL, name);
+#endif /* DUAL_STA */
+	case NL80211_IFTYPE_P2P_CLIENT:
+		wlif_type = WL_P2P_IF_CLIENT;
+		mode = WL_MODE_BSS;
+		break;
+	case NL80211_IFTYPE_P2P_GO:
+	case NL80211_IFTYPE_AP:
+		wlif_type = WL_P2P_IF_GO;
+		mode = WL_MODE_AP;
+		break;
+	default:
+		WL_ERR(("Unsupported interface type\n"));
+		return NULL;
+		break;
+	}
+
+	if (!name) {
+		WL_ERR(("name is NULL\n"));
+		return NULL;
+	}
+	if (cfg->p2p_supported && (wlif_type != -1)) {
+		ASSERT(cfg->p2p); /* ensure expectation of p2p initialization */
+
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+		if (!dhd)
+			return ERR_PTR(-ENODEV);
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+		if (!cfg->p2p)
+			return ERR_PTR(-ENODEV);
+
+		if (cfg->p2p && !cfg->p2p->on && strstr(name, WL_P2P_INTERFACE_PREFIX)) {
+			p2p_on(cfg) = true;
+			wl_cfgp2p_set_firm_p2p(cfg);
+			wl_cfgp2p_init_discovery(cfg);
+			get_primary_mac(cfg, &primary_mac);
+			wl_cfgp2p_generate_bss_mac(&primary_mac,
+				&cfg->p2p->dev_addr, &cfg->p2p->int_addr);
+		}
+
+		memset(cfg->p2p->vir_ifname, 0, IFNAMSIZ);
+		strncpy(cfg->p2p->vir_ifname, name, IFNAMSIZ - 1);
+
+		wl_cfg80211_scan_abort(cfg);
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+		if (!cfg->wlfc_on && !disable_proptx) {
+			dhd_wlfc_get_enable(dhd, &enabled);
+			if (!enabled && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+				dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+				dhd_wlfc_init(dhd);
+				err = wldev_ioctl(primary_ndev, WLC_UP, &up, sizeof(s32), true);
+				if (err < 0)
+					WL_ERR(("WLC_UP return err:%d\n", err));
+			}
+			cfg->wlfc_on = true;
+		}
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+
+		/* In concurrency case, STA may be already associated in a particular channel.
+		 * so retrieve the current channel of primary interface and then start the virtual
+		 * interface on that.
+		 */
+		 chspec = wl_cfg80211_get_shared_freq(wiphy);
+
+		/* For P2P mode, use P2P-specific driver features to create the
+		 * bss: "cfg p2p_ifadd"
+		 */
+		wl_set_p2p_status(cfg, IF_ADDING);
+		memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+		if (wlif_type == WL_P2P_IF_GO)
+			wldev_iovar_setint(primary_ndev, "mpc", 0);
+		err = wl_cfgp2p_ifadd(cfg, &cfg->p2p->int_addr, htod32(wlif_type), chspec);
+		if (unlikely(err)) {
+			wl_clr_p2p_status(cfg, IF_ADDING);
+			WL_ERR((" virtual iface add failed (%d) \n", err));
+			return ERR_PTR(-ENOMEM);
+		}
+
+		timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+			(wl_get_p2p_status(cfg, IF_ADDING) == false),
+			msecs_to_jiffies(MAX_WAIT_TIME));
+
+		if (timeout > 0 && !wl_get_p2p_status(cfg, IF_ADDING) && cfg->if_event_info.valid) {
+			struct wireless_dev *vwdev;
+			int pm_mode = PM_ENABLE;
+			wl_if_event_info *event = &cfg->if_event_info;
+
+			/* IF_ADD event has come back, we can proceed to to register
+			 * the new interface now, use the interface name provided by caller (thus
+			 * ignore the one from wlc)
+			 */
+			strncpy(cfg->if_event_info.name, name, IFNAMSIZ - 1);
+			new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx, cfg->p2p->vir_ifname,
+				event->mac, event->bssidx);
+			if (new_ndev == NULL)
+				goto fail;
+
+			wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION) = new_ndev;
+			wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION) = event->bssidx;
+			vwdev = kzalloc(sizeof(*vwdev), GFP_KERNEL);
+			if (unlikely(!vwdev)) {
+				WL_ERR(("Could not allocate wireless device\n"));
+				goto fail;
+			}
+			vwdev->wiphy = cfg->wdev->wiphy;
+			WL_INFORM(("virtual interface(%s) is created\n", cfg->p2p->vir_ifname));
+			vwdev->iftype = type;
+			vwdev->netdev = new_ndev;
+			new_ndev->ieee80211_ptr = vwdev;
+			SET_NETDEV_DEV(new_ndev, wiphy_dev(vwdev->wiphy));
+			wl_set_drv_status(cfg, READY, new_ndev);
+			cfg->p2p->vif_created = true;
+			wl_set_mode_by_netdev(cfg, new_ndev, mode);
+
+			if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK) {
+				wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+				goto fail;
+			}
+			wl_alloc_netinfo(cfg, new_ndev, vwdev, mode, pm_mode);
+			val = 1;
+			/* Disable firmware roaming for P2P interface  */
+			wldev_iovar_setint(new_ndev, "roam_off", val);
+
+			if (mode != WL_MODE_AP)
+				wldev_iovar_setint(new_ndev, "buf_key_b4_m4", 1);
+
+			WL_ERR((" virtual interface(%s) is "
+				"created net attach done\n", cfg->p2p->vir_ifname));
+			if (mode == WL_MODE_AP)
+				wl_set_drv_status(cfg, CONNECTED, new_ndev);
+#ifdef SUPPORT_AP_POWERSAVE
+			if (mode == WL_MODE_AP) {
+				dhd_set_ap_powersave(dhd, 0, TRUE);
+			}
+#endif
+			if (type == NL80211_IFTYPE_P2P_CLIENT)
+				dhd_mode = DHD_FLAG_P2P_GC_MODE;
+			else if (type == NL80211_IFTYPE_P2P_GO)
+				dhd_mode = DHD_FLAG_P2P_GO_MODE;
+			DNGL_FUNC(dhd_cfg80211_set_p2p_info, (cfg, dhd_mode));
+			/* reinitialize completion to clear previous count */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+			INIT_COMPLETION(cfg->iface_disable);
+#else
+			init_completion(&cfg->iface_disable);
+#endif
+			return ndev_to_cfgdev(new_ndev);
+		} else {
+			wl_clr_p2p_status(cfg, IF_ADDING);
+			WL_ERR((" virtual interface(%s) is not created \n", cfg->p2p->vir_ifname));
+
+			WL_ERR(("left timeout : %d\n", timeout));
+			WL_ERR(("IF_ADDING status : %d\n", wl_get_p2p_status(cfg, IF_ADDING)));
+			WL_ERR(("event valid : %d\n", cfg->if_event_info.valid));
+
+			wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+			wl_set_p2p_status(cfg, IF_DELETING);
+
+			err = wl_cfgp2p_ifdel(cfg, &cfg->p2p->int_addr);
+			if (err == BCME_OK) {
+				timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+					(wl_get_p2p_status(cfg, IF_DELETING) == false),
+					msecs_to_jiffies(MAX_WAIT_TIME));
+				if (timeout > 0 && !wl_get_p2p_status(cfg, IF_DELETING) &&
+					cfg->if_event_info.valid) {
+					WL_ERR(("IFDEL operation done\n"));
+				} else {
+					WL_ERR(("IFDEL didn't complete properly\n"));
+					err = BCME_ERROR;
+				}
+			}
+			if (err != BCME_OK) {
+				struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+				WL_ERR(("p2p_ifdel failed, error %d, sent HANG event to %s\n",
+					err, ndev->name));
+				net_os_send_hang_message(ndev);
+			}
+
+			memset(cfg->p2p->vir_ifname, '\0', IFNAMSIZ);
+			cfg->p2p->vif_created = false;
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+			dhd_wlfc_get_enable(dhd, &enabled);
+		if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+			dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+			dhd_wlfc_deinit(dhd);
+			cfg->wlfc_on = false;
+		}
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+		}
+	}
+
+fail:
+	if (wlif_type == WL_P2P_IF_GO)
+		wldev_iovar_setint(primary_ndev, "mpc", 1);
+	return ERR_PTR(-ENODEV);
+}
+
+static s32
+wl_cfg80211_del_virtual_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+	struct net_device *dev = NULL;
+	struct ether_addr p2p_mac;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 timeout = -1;
+	s32 ret = 0;
+	s32 index = -1;
+#ifdef CUSTOM_SET_CPUCORE
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_CPUCORE */
+	WL_DBG(("Enter\n"));
+
+#ifdef CUSTOM_SET_CPUCORE
+	dhd->chan_isvht80 &= ~DHD_FLAG_P2P_MODE;
+	if (!(dhd->chan_isvht80))
+		dhd_set_cpucore(dhd, FALSE);
+#endif /* CUSTOM_SET_CPUCORE */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	if (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+		return wl_cfgp2p_del_p2p_disc_if(cfgdev, cfg);
+	}
+#endif /* WL_CFG80211_P2P_DEV_IF */
+	dev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifdef WLAIBSS_MCHAN
+	if (cfgdev == cfg->ibss_cfgdev)
+		return bcm_cfg80211_del_ibss_if(wiphy, cfgdev);
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef DUAL_STA
+	if (cfgdev == cfg->bss_cfgdev)
+		return wl_cfg80211_del_iface(wiphy, cfgdev);
+#endif /* DUAL_STA */
+
+	if (wl_cfgp2p_find_idx(cfg, dev, &index) != BCME_OK) {
+		WL_ERR(("Find p2p index from ndev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	if (cfg->p2p_supported) {
+		memcpy(p2p_mac.octet, cfg->p2p->int_addr.octet, ETHER_ADDR_LEN);
+
+		/* Clear GO_NEG_PHASE bit to take care of GO-NEG-FAIL cases
+		 */
+		WL_DBG(("P2P: GO_NEG_PHASE status cleared "));
+		wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+		if (cfg->p2p->vif_created) {
+			if (wl_get_drv_status(cfg, SCANNING, dev)) {
+				wl_notify_escan_complete(cfg, dev, true, true);
+			}
+			wldev_iovar_setint(dev, "mpc", 1);
+			/* Delete pm_enable_work */
+			wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_DEL);
+
+			/* for GC */
+			if (wl_get_drv_status(cfg, DISCONNECTING, dev) &&
+				(wl_get_mode_by_netdev(cfg, dev) != WL_MODE_AP)) {
+				WL_ERR(("Wait for Link Down event for GC !\n"));
+				wait_for_completion_timeout
+					(&cfg->iface_disable, msecs_to_jiffies(500));
+			}
+
+			memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+			wl_set_p2p_status(cfg, IF_DELETING);
+			DNGL_FUNC(dhd_cfg80211_clean_p2p_info, (cfg));
+
+			/* for GO */
+			if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+				wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, false);
+				/* disable interface before bsscfg free */
+				ret = wl_cfgp2p_ifdisable(cfg, &p2p_mac);
+				/* if fw doesn't support "ifdis",
+				   do not wait for link down of ap mode
+				 */
+				if (ret == 0) {
+					WL_ERR(("Wait for Link Down event for GO !!!\n"));
+					wait_for_completion_timeout(&cfg->iface_disable,
+						msecs_to_jiffies(500));
+				} else if (ret != BCME_UNSUPPORTED) {
+					msleep(300);
+				}
+			}
+			wl_cfgp2p_clear_management_ie(cfg, index);
+
+			if (wl_get_mode_by_netdev(cfg, dev) != WL_MODE_AP)
+				wldev_iovar_setint(dev, "buf_key_b4_m4", 0);
+
+			/* delete interface after link down */
+			ret = wl_cfgp2p_ifdel(cfg, &p2p_mac);
+
+			if (ret != BCME_OK) {
+				struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+				WL_ERR(("p2p_ifdel failed, error %d, sent HANG event to %s\n",
+					ret, ndev->name));
+				#if defined(BCMDONGLEHOST) && defined(OEM_ANDROID)
+				net_os_send_hang_message(ndev);
+				#endif
+			} else {
+				/* Wait for IF_DEL operation to be finished */
+				timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+					(wl_get_p2p_status(cfg, IF_DELETING) == false),
+					msecs_to_jiffies(MAX_WAIT_TIME));
+				if (timeout > 0 && !wl_get_p2p_status(cfg, IF_DELETING) &&
+					cfg->if_event_info.valid) {
+
+					WL_DBG(("IFDEL operation done\n"));
+					wl_cfg80211_handle_ifdel(cfg, &cfg->if_event_info, dev);
+				} else {
+					WL_ERR(("IFDEL didn't complete properly\n"));
+				}
+			}
+
+			ret = dhd_del_monitor(dev);
+			if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+				DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_CANCEL((dhd_pub_t *)(cfg->pub));
+			}
+		}
+	}
+	return ret;
+}
+
+static s32
+wl_cfg80211_change_virtual_iface(struct wiphy *wiphy, struct net_device *ndev,
+	enum nl80211_iftype type, u32 *flags,
+	struct vif_params *params)
+{
+	s32 ap = 0;
+	s32 infra = 0;
+	s32 ibss = 0;
+	s32 wlif_type;
+	s32 mode = 0;
+	s32 err = BCME_OK;
+	chanspec_t chspec;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+	WL_DBG(("Enter type %d\n", type));
+	switch (type) {
+	case NL80211_IFTYPE_MONITOR:
+	case NL80211_IFTYPE_WDS:
+	case NL80211_IFTYPE_MESH_POINT:
+		ap = 1;
+		WL_ERR(("type (%d) : currently we do not support this type\n",
+			type));
+		break;
+	case NL80211_IFTYPE_ADHOC:
+		mode = WL_MODE_IBSS;
+		ibss = 1;
+		break;
+	case NL80211_IFTYPE_STATION:
+	case NL80211_IFTYPE_P2P_CLIENT:
+		mode = WL_MODE_BSS;
+		infra = 1;
+		break;
+	case NL80211_IFTYPE_AP:
+	case NL80211_IFTYPE_AP_VLAN:
+	case NL80211_IFTYPE_P2P_GO:
+		mode = WL_MODE_AP;
+		ap = 1;
+		break;
+	default:
+		return -EINVAL;
+	}
+	if (!dhd)
+		return -EINVAL;
+	if (ap) {
+		wl_set_mode_by_netdev(cfg, ndev, mode);
+		if (cfg->p2p_supported && cfg->p2p->vif_created) {
+			WL_DBG(("p2p_vif_created (%d) p2p_on (%d)\n", cfg->p2p->vif_created,
+			p2p_on(cfg)));
+			wldev_iovar_setint(ndev, "mpc", 0);
+			wl_notify_escan_complete(cfg, ndev, true, true);
+
+			/* In concurrency case, STA may be already associated in a particular
+			 * channel. so retrieve the current channel of primary interface and
+			 * then start the virtual interface on that.
+			 */
+			chspec = wl_cfg80211_get_shared_freq(wiphy);
+
+			wlif_type = WL_P2P_IF_GO;
+			printf("%s : ap (%d), infra (%d), iftype: (%d)\n",
+				ndev->name, ap, infra, type);
+			wl_set_p2p_status(cfg, IF_CHANGING);
+			wl_clr_p2p_status(cfg, IF_CHANGED);
+			wl_cfgp2p_ifchange(cfg, &cfg->p2p->int_addr, htod32(wlif_type), chspec);
+			wait_event_interruptible_timeout(cfg->netif_change_event,
+				(wl_get_p2p_status(cfg, IF_CHANGED) == true),
+				msecs_to_jiffies(MAX_WAIT_TIME));
+			wl_set_mode_by_netdev(cfg, ndev, mode);
+			dhd->op_mode &= ~DHD_FLAG_P2P_GC_MODE;
+			dhd->op_mode |= DHD_FLAG_P2P_GO_MODE;
+			wl_clr_p2p_status(cfg, IF_CHANGING);
+			wl_clr_p2p_status(cfg, IF_CHANGED);
+			if (mode == WL_MODE_AP)
+				wl_set_drv_status(cfg, CONNECTED, ndev);
+#ifdef SUPPORT_AP_POWERSAVE
+			dhd_set_ap_powersave(dhd, 0, TRUE);
+#endif
+		} else if (ndev == bcmcfg_to_prmry_ndev(cfg) &&
+			!wl_get_drv_status(cfg, AP_CREATED, ndev)) {
+			wl_set_drv_status(cfg, AP_CREATING, ndev);
+			if (!cfg->ap_info &&
+				!(cfg->ap_info = kzalloc(sizeof(struct ap_info), GFP_KERNEL))) {
+				WL_ERR(("struct ap_saved_ie allocation failed\n"));
+				return -ENOMEM;
+			}
+		} else {
+			WL_ERR(("Cannot change the interface for GO or SOFTAP\n"));
+			return -EINVAL;
+		}
+	} else {
+		WL_DBG(("Change_virtual_iface for transition from GO/AP to client/STA"));
+#ifdef SUPPORT_AP_POWERSAVE
+		dhd_set_ap_powersave(dhd, 0, FALSE);
+#endif
+#ifdef  P2PONEINT
+		wl_set_mode_by_netdev(cfg, ndev, mode);
+		if (cfg->p2p_supported && cfg->p2p->vif_created) {
+			WL_DBG(("p2p_vif_created (%d) p2p_on (%d)\n", cfg->p2p->vif_created,
+				p2p_on(cfg)));
+			wldev_iovar_setint(ndev, "mpc", 0);
+			wl_notify_escan_complete(cfg, ndev, true, true);
+
+			/* In concurrency case, STA may be already associated in a particular
+			 * channel. so retrieve the current channel of primary interface and
+			 * then start the virtual interface on that.
+			 */
+			chspec = wl_cfg80211_get_shared_freq(wiphy);
+
+			wlif_type = WL_P2P_IF_CLIENT;
+			WL_ERR(("%s : ap (%d), infra (%d), iftype: (%d) chspec 0x%x \n",
+				ndev->name, ap, infra, type, chspec));
+			wl_set_p2p_status(cfg, IF_CHANGING);
+			wl_clr_p2p_status(cfg, IF_CHANGED);
+			wl_cfgp2p_ifchange(cfg, &cfg->p2p->int_addr, htod32(wlif_type), chspec);
+			wait_event_interruptible_timeout(cfg->netif_change_event,
+				(wl_get_p2p_status(cfg, IF_CHANGED) == true),
+				msecs_to_jiffies(MAX_WAIT_TIME));
+			wl_set_mode_by_netdev(cfg, ndev, mode);
+			dhd->op_mode |= DHD_FLAG_P2P_GC_MODE;
+			dhd->op_mode &= ~DHD_FLAG_P2P_GO_MODE;
+			wl_clr_p2p_status(cfg, IF_CHANGING);
+			wl_clr_p2p_status(cfg, IF_CHANGED);
+
+#define INIT_IE(IE_TYPE, BSS_TYPE)      \
+		do {                            \
+		memset(wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie, 0, \
+		sizeof(wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie)); \
+		wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie_len = 0; \
+		} while (0);
+
+			INIT_IE(probe_req, P2PAPI_BSSCFG_CONNECTION);
+			INIT_IE(probe_res, P2PAPI_BSSCFG_CONNECTION);
+			INIT_IE(assoc_req, P2PAPI_BSSCFG_CONNECTION);
+			INIT_IE(assoc_res, P2PAPI_BSSCFG_CONNECTION);
+			INIT_IE(beacon,    P2PAPI_BSSCFG_CONNECTION);
+		}
+#endif /* P2PONEINT */
+	}
+
+	if (ibss) {
+		infra = 0;
+		wl_set_mode_by_netdev(cfg, ndev, mode);
+		err = wldev_ioctl(ndev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+		if (err < 0) {
+			WL_ERR(("SET Adhoc error %d\n", err));
+			return -EINVAL;
+		}
+	}
+
+	ndev->ieee80211_ptr->iftype = type;
+	return 0;
+}
+
+s32
+wl_cfg80211_notify_ifadd(int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+	bool ifadd_expected = FALSE;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	/* P2P may send WLC_E_IF_ADD and/or WLC_E_IF_CHANGE during IF updating ("p2p_ifupd")
+	 * redirect the IF_ADD event to ifchange as it is not a real "new" interface
+	 */
+	if (wl_get_p2p_status(cfg, IF_CHANGING))
+		return wl_cfg80211_notify_ifchange(ifidx, name, mac, bssidx);
+
+	/* Okay, we are expecting IF_ADD (as IF_ADDING is true) */
+	if (wl_get_p2p_status(cfg, IF_ADDING)) {
+		ifadd_expected = TRUE;
+		wl_clr_p2p_status(cfg, IF_ADDING);
+	} else if (cfg->bss_pending_op) {
+		ifadd_expected = TRUE;
+		cfg->bss_pending_op = FALSE;
+	}
+
+	if (ifadd_expected) {
+		wl_if_event_info *if_event_info = &cfg->if_event_info;
+
+		if_event_info->valid = TRUE;
+		if_event_info->ifidx = ifidx;
+		if_event_info->bssidx = bssidx;
+		strncpy(if_event_info->name, name, IFNAMSIZ);
+		if_event_info->name[IFNAMSIZ] = '\0';
+		if (mac)
+			memcpy(if_event_info->mac, mac, ETHER_ADDR_LEN);
+		wake_up_interruptible(&cfg->netif_change_event);
+		return BCME_OK;
+	}
+
+	return BCME_ERROR;
+}
+
+s32
+wl_cfg80211_notify_ifdel(int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+	bool ifdel_expected = FALSE;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	wl_if_event_info *if_event_info = &cfg->if_event_info;
+
+	if (wl_get_p2p_status(cfg, IF_DELETING)) {
+		ifdel_expected = TRUE;
+		wl_clr_p2p_status(cfg, IF_DELETING);
+	} else if (cfg->bss_pending_op) {
+		ifdel_expected = TRUE;
+		cfg->bss_pending_op = FALSE;
+	}
+
+	if (ifdel_expected) {
+		if_event_info->valid = TRUE;
+		if_event_info->ifidx = ifidx;
+		if_event_info->bssidx = bssidx;
+		wake_up_interruptible(&cfg->netif_change_event);
+		return BCME_OK;
+	}
+
+	return BCME_ERROR;
+}
+
+s32
+wl_cfg80211_notify_ifchange(int ifidx, char *name, uint8 *mac, uint8 bssidx)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	if (wl_get_p2p_status(cfg, IF_CHANGING)) {
+		wl_set_p2p_status(cfg, IF_CHANGED);
+		wake_up_interruptible(&cfg->netif_change_event);
+		return BCME_OK;
+	}
+
+	return BCME_ERROR;
+}
+
+static s32 wl_cfg80211_handle_ifdel(struct bcm_cfg80211 *cfg, wl_if_event_info *if_event_info,
+	struct net_device* ndev)
+{
+	s32 type = -1;
+	s32 bssidx = -1;
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+	dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+	bool enabled;
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+
+	bssidx = if_event_info->bssidx;
+	if (bssidx != wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION)) {
+		WL_ERR(("got IF_DEL for if %d, not owned by cfg driver\n", bssidx));
+		return BCME_ERROR;
+	}
+
+	if (p2p_is_on(cfg) && cfg->p2p->vif_created) {
+
+		if (cfg->scan_request && (cfg->escan_info.ndev == ndev)) {
+			/* Abort any pending scan requests */
+			cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+			WL_DBG(("ESCAN COMPLETED\n"));
+			wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, false);
+		}
+
+		memset(cfg->p2p->vir_ifname, '\0', IFNAMSIZ);
+		if (wl_cfgp2p_find_type(cfg, bssidx, &type) != BCME_OK) {
+			WL_ERR(("Find p2p type from bssidx(%d) failed\n", bssidx));
+			return BCME_ERROR;
+		}
+		wl_clr_drv_status(cfg, CONNECTED, wl_to_p2p_bss_ndev(cfg, type));
+		wl_to_p2p_bss_ndev(cfg, type) = NULL;
+		wl_to_p2p_bss_bssidx(cfg, type) = WL_INVALID;
+		cfg->p2p->vif_created = false;
+
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+		dhd_wlfc_get_enable(dhd, &enabled);
+		if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+			dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+			dhd_wlfc_deinit(dhd);
+			cfg->wlfc_on = false;
+		}
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+	}
+
+	wl_cfg80211_remove_if(cfg, if_event_info->ifidx, ndev);
+	return BCME_OK;
+}
+
+/* Find listen channel */
+static s32 wl_find_listen_channel(struct bcm_cfg80211 *cfg,
+	const u8 *ie, u32 ie_len)
+{
+	wifi_p2p_ie_t *p2p_ie;
+	u8 *end, *pos;
+	s32 listen_channel;
+
+	pos = (u8 *)ie;
+	p2p_ie = wl_cfgp2p_find_p2pie(pos, ie_len);
+
+	if (p2p_ie == NULL)
+		return 0;
+
+	pos = p2p_ie->subelts;
+	end = p2p_ie->subelts + (p2p_ie->len - 4);
+
+	CFGP2P_DBG((" found p2p ie ! lenth %d \n",
+		p2p_ie->len));
+
+	while (pos < end) {
+		uint16 attr_len;
+		if (pos + 2 >= end) {
+			CFGP2P_DBG((" -- Invalid P2P attribute"));
+			return 0;
+		}
+		attr_len = ((uint16) (((pos + 1)[1] << 8) | (pos + 1)[0]));
+
+		if (pos + 3 + attr_len > end) {
+			CFGP2P_DBG(("P2P: Attribute underflow "
+				   "(len=%u left=%d)",
+				   attr_len, (int) (end - pos - 3)));
+			return 0;
+		}
+
+		/* if Listen Channel att id is 6 and the vailue is valid,
+		 * return the listen channel
+		 */
+		if (pos[0] == 6) {
+			/* listen channel subel length format
+			 * 1(id) + 2(len) + 3(country) + 1(op. class) + 1(chan num)
+			 */
+			listen_channel = pos[1 + 2 + 3 + 1];
+
+			if (listen_channel == SOCIAL_CHAN_1 ||
+				listen_channel == SOCIAL_CHAN_2 ||
+				listen_channel == SOCIAL_CHAN_3) {
+				CFGP2P_DBG((" Found my Listen Channel %d \n", listen_channel));
+				return listen_channel;
+			}
+		}
+		pos += 3 + attr_len;
+	}
+	return 0;
+}
+
+static void wl_scan_prep(struct wl_scan_params *params, struct cfg80211_scan_request *request)
+{
+	u32 n_ssids;
+	u32 n_channels;
+	u16 channel;
+	chanspec_t chanspec;
+	s32 i = 0, j = 0, offset;
+	char *ptr;
+	wlc_ssid_t ssid;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+	params->bss_type = DOT11_BSSTYPE_ANY;
+	params->scan_type = 0;
+	params->nprobes = -1;
+	params->active_time = -1;
+	params->passive_time = -1;
+	params->home_time = -1;
+	params->channel_num = 0;
+	memset(&params->ssid, 0, sizeof(wlc_ssid_t));
+
+	WL_SCAN(("Preparing Scan request\n"));
+	WL_SCAN(("nprobes=%d\n", params->nprobes));
+	WL_SCAN(("active_time=%d\n", params->active_time));
+	WL_SCAN(("passive_time=%d\n", params->passive_time));
+	WL_SCAN(("home_time=%d\n", params->home_time));
+	WL_SCAN(("scan_type=%d\n", params->scan_type));
+
+	params->nprobes = htod32(params->nprobes);
+	params->active_time = htod32(params->active_time);
+	params->passive_time = htod32(params->passive_time);
+	params->home_time = htod32(params->home_time);
+
+	/* if request is null just exit so it will be all channel broadcast scan */
+	if (!request)
+		return;
+
+	n_ssids = request->n_ssids;
+	n_channels = request->n_channels;
+
+	/* Copy channel array if applicable */
+	WL_SCAN(("### List of channelspecs to scan ###\n"));
+	if (n_channels > 0) {
+		for (i = 0; i < n_channels; i++) {
+			chanspec = 0;
+			channel = ieee80211_frequency_to_channel(request->channels[i]->center_freq);
+			/* SKIP DFS channels for Secondary interface */
+			if ((cfg->escan_info.ndev != bcmcfg_to_prmry_ndev(cfg)) &&
+				(request->channels[i]->flags &
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+				(IEEE80211_CHAN_RADAR | IEEE80211_CHAN_PASSIVE_SCAN)))
+#else
+				(IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IR)))
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0) */
+				continue;
+
+			if (request->channels[i]->band == NL80211_BAND_2GHZ) {
+#ifdef WL_HOST_BAND_MGMT
+				if (cfg->curr_band == WLC_BAND_5G) {
+					WL_DBG(("In 5G only mode, omit 2G channel:%d\n", channel));
+					continue;
+				}
+#endif /* WL_HOST_BAND_MGMT */
+				chanspec |= WL_CHANSPEC_BAND_2G;
+			} else {
+#ifdef WL_HOST_BAND_MGMT
+				if (cfg->curr_band == WLC_BAND_2G) {
+					WL_DBG(("In 2G only mode, omit 5G channel:%d\n", channel));
+					continue;
+				}
+#endif /* WL_HOST_BAND_MGMT */
+				chanspec |= WL_CHANSPEC_BAND_5G;
+			}
+
+			chanspec |= WL_CHANSPEC_BW_20;
+			chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+			params->channel_list[j] = channel;
+			params->channel_list[j] &= WL_CHANSPEC_CHAN_MASK;
+			params->channel_list[j] |= chanspec;
+			WL_SCAN(("Chan : %d, Channel spec: %x \n",
+				channel, params->channel_list[j]));
+			params->channel_list[j] = wl_chspec_host_to_driver(params->channel_list[j]);
+			j++;
+		}
+	} else {
+		WL_SCAN(("Scanning all channels\n"));
+	}
+	n_channels = j;
+	/* Copy ssid array if applicable */
+	WL_SCAN(("### List of SSIDs to scan ###\n"));
+	if (n_ssids > 0) {
+		offset = offsetof(wl_scan_params_t, channel_list) + n_channels * sizeof(u16);
+		offset = roundup(offset, sizeof(u32));
+		ptr = (char*)params + offset;
+		for (i = 0; i < n_ssids; i++) {
+			memset(&ssid, 0, sizeof(wlc_ssid_t));
+			ssid.SSID_len = request->ssids[i].ssid_len;
+			memcpy(ssid.SSID, request->ssids[i].ssid, ssid.SSID_len);
+			if (!ssid.SSID_len)
+				WL_SCAN(("%d: Broadcast scan\n", i));
+			else
+				WL_SCAN(("%d: scan  for  %s size =%d\n", i,
+				ssid.SSID, ssid.SSID_len));
+			memcpy(ptr, &ssid, sizeof(wlc_ssid_t));
+			ptr += sizeof(wlc_ssid_t);
+		}
+	} else {
+		WL_SCAN(("Broadcast scan\n"));
+	}
+	/* Adding mask to channel numbers */
+	params->channel_num =
+	        htod32((n_ssids << WL_SCAN_PARAMS_NSSID_SHIFT) |
+	               (n_channels & WL_SCAN_PARAMS_COUNT_MASK));
+
+	if (n_channels == 1) {
+		params->active_time = htod32(WL_SCAN_CONNECT_DWELL_TIME_MS);
+		params->nprobes = htod32(params->active_time / WL_SCAN_JOIN_PROBE_INTERVAL_MS);
+	}
+}
+
+static s32
+wl_get_valid_channels(struct net_device *ndev, u8 *valid_chan_list, s32 size)
+{
+	wl_uint32_list_t *list;
+	s32 err = BCME_OK;
+	if (valid_chan_list == NULL || size <= 0)
+		return -ENOMEM;
+
+	memset(valid_chan_list, 0, size);
+	list = (wl_uint32_list_t *)(void *) valid_chan_list;
+	list->count = htod32(WL_NUMCHANNELS);
+	err = wldev_ioctl(ndev, WLC_GET_VALID_CHANNELS, valid_chan_list, size, false);
+	if (err != 0) {
+		WL_ERR(("get channels failed with %d\n", err));
+	}
+
+	return err;
+}
+
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+#define FIRST_SCAN_ACTIVE_DWELL_TIME_MS 40
+bool g_first_broadcast_scan = TRUE;
+#endif
+
+static s32
+wl_run_escan(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	struct cfg80211_scan_request *request, uint16 action)
+{
+	s32 err = BCME_OK;
+	u32 n_channels;
+	u32 n_ssids;
+	s32 params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_escan_params_t, params));
+	wl_escan_params_t *params = NULL;
+	u8 chan_buf[sizeof(u32)*(WL_NUMCHANNELS + 1)];
+	u32 num_chans = 0;
+	s32 channel;
+	s32 n_valid_chan;
+	s32 search_state = WL_P2P_DISC_ST_SCAN;
+	u32 i, j, n_nodfs = 0;
+	u16 *default_chan_list = NULL;
+	wl_uint32_list_t *list;
+	struct net_device *dev = NULL;
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+	bool is_first_init_2g_scan = false;
+#endif
+	p2p_scan_purpose_t	p2p_scan_purpose = P2P_SCAN_PURPOSE_MIN;
+	scb_val_t scbval;
+	static int cnt = 0;
+
+	WL_DBG(("Enter \n"));
+
+	/* scan request can come with empty request : perform all default scan */
+	if (!cfg) {
+		err = -EINVAL;
+		goto exit;
+	}
+	if (!cfg->p2p_supported || !p2p_scan(cfg)) {
+		/* LEGACY SCAN TRIGGER */
+		WL_SCAN((" LEGACY E-SCAN START\n"));
+
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+		if (!request) {
+			err = -EINVAL;
+			goto exit;
+		}
+		if (ndev == bcmcfg_to_prmry_ndev(cfg) && g_first_broadcast_scan == true) {
+			is_first_init_2g_scan = true;
+			g_first_broadcast_scan = false;
+		}
+#endif
+
+		/* if scan request is not empty parse scan request paramters */
+		if (request != NULL) {
+			n_channels = request->n_channels;
+			n_ssids = request->n_ssids;
+			if (n_channels % 2)
+				/* If n_channels is odd, add a padd of u16 */
+				params_size += sizeof(u16) * (n_channels + 1);
+			else
+				params_size += sizeof(u16) * n_channels;
+
+			/* Allocate space for populating ssids in wl_escan_params_t struct */
+			params_size += sizeof(struct wlc_ssid) * n_ssids;
+		}
+		params = (wl_escan_params_t *) kzalloc(params_size, GFP_KERNEL);
+		if (params == NULL) {
+			err = -ENOMEM;
+			goto exit;
+		}
+		wl_scan_prep(&params->params, request);
+
+#if defined(USE_INITIAL_SHORT_DWELL_TIME)
+		/* Override active_time to reduce scan time if it's first bradcast scan. */
+		if (is_first_init_2g_scan)
+			params->params.active_time = FIRST_SCAN_ACTIVE_DWELL_TIME_MS;
+#endif
+
+		params->version = htod32(ESCAN_REQ_VERSION);
+		params->action =  htod16(action);
+		wl_escan_set_sync_id(params->sync_id, cfg);
+		wl_escan_set_type(cfg, WL_SCANTYPE_LEGACY);
+		if (params_size + sizeof("escan") >= WLC_IOCTL_MEDLEN) {
+			WL_ERR(("ioctl buffer length not sufficient\n"));
+			kfree(params);
+			err = -ENOMEM;
+			goto exit;
+		}
+		err = wldev_iovar_setbuf(ndev, "escan", params, params_size,
+			cfg->escan_ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+		if (unlikely(err)) {
+			if (err == BCME_EPERM)
+				/* Scan Not permitted at this point of time */
+				WL_DBG((" Escan not permitted at this time (%d)\n", err));
+			else
+				WL_ERR((" Escan set error (%d)\n", err));
+		}
+		kfree(params);
+	}
+	else if (p2p_is_on(cfg) && p2p_scan(cfg)) {
+		/* P2P SCAN TRIGGER */
+		s32 _freq = 0;
+		n_nodfs = 0;
+		if (request && request->n_channels) {
+			num_chans = request->n_channels;
+			WL_SCAN((" chann number : %d\n", num_chans));
+			default_chan_list = kzalloc(num_chans * sizeof(*default_chan_list),
+				GFP_KERNEL);
+			if (default_chan_list == NULL) {
+				WL_ERR(("channel list allocation failed \n"));
+				err = -ENOMEM;
+				goto exit;
+			}
+			if (!wl_get_valid_channels(ndev, chan_buf, sizeof(chan_buf))) {
+				list = (wl_uint32_list_t *) chan_buf;
+				n_valid_chan = dtoh32(list->count);
+				for (i = 0; i < num_chans; i++)
+				{
+#ifdef WL_HOST_BAND_MGMT
+					int channel_band = 0;
+#endif /* WL_HOST_BAND_MGMT */
+					_freq = request->channels[i]->center_freq;
+					channel = ieee80211_frequency_to_channel(_freq);
+#ifdef WL_HOST_BAND_MGMT
+					channel_band = (channel > CH_MAX_2G_CHANNEL) ?
+						WLC_BAND_5G : WLC_BAND_2G;
+					if ((cfg->curr_band != WLC_BAND_AUTO) &&
+						(cfg->curr_band != channel_band) &&
+						!IS_P2P_SOCIAL_CHANNEL(channel))
+							continue;
+#endif /* WL_HOST_BAND_MGMT */
+
+					/* ignore DFS channels */
+					if (request->channels[i]->flags &
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+						(IEEE80211_CHAN_NO_IR
+						| IEEE80211_CHAN_RADAR))
+#else
+						(IEEE80211_CHAN_RADAR
+						| IEEE80211_CHAN_PASSIVE_SCAN))
+#endif
+						continue;
+
+					for (j = 0; j < n_valid_chan; j++) {
+						/* allows only supported channel on
+						*  current reguatory
+						*/
+						if (channel == (dtoh32(list->element[j])))
+							default_chan_list[n_nodfs++] =
+								channel;
+					}
+
+				}
+			}
+			if (num_chans == SOCIAL_CHAN_CNT && (
+						(default_chan_list[0] == SOCIAL_CHAN_1) &&
+						(default_chan_list[1] == SOCIAL_CHAN_2) &&
+						(default_chan_list[2] == SOCIAL_CHAN_3))) {
+				/* SOCIAL CHANNELS 1, 6, 11 */
+				search_state = WL_P2P_DISC_ST_SEARCH;
+				p2p_scan_purpose = P2P_SCAN_SOCIAL_CHANNEL;
+				WL_INFORM(("P2P SEARCH PHASE START \n"));
+			} else if ((dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION)) &&
+				(wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP)) {
+				/* If you are already a GO, then do SEARCH only */
+				WL_INFORM(("Already a GO. Do SEARCH Only"));
+				search_state = WL_P2P_DISC_ST_SEARCH;
+				num_chans = n_nodfs;
+				p2p_scan_purpose = P2P_SCAN_NORMAL;
+
+			} else if (num_chans == 1) {
+				p2p_scan_purpose = P2P_SCAN_CONNECT_TRY;
+			} else if (num_chans == SOCIAL_CHAN_CNT + 1) {
+			/* SOCIAL_CHAN_CNT + 1 takes care of the Progressive scan supported by
+			 * the supplicant
+			 */
+				p2p_scan_purpose = P2P_SCAN_SOCIAL_CHANNEL;
+			} else {
+				WL_INFORM(("P2P SCAN STATE START \n"));
+				num_chans = n_nodfs;
+				p2p_scan_purpose = P2P_SCAN_NORMAL;
+			}
+		} else {
+			err = -EINVAL;
+			goto exit;
+		}
+		err = wl_cfgp2p_escan(cfg, ndev, cfg->active_scan, num_chans, default_chan_list,
+			search_state, action,
+			wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE), NULL,
+			p2p_scan_purpose);
+
+		if (!err)
+			cfg->p2p->search_state = search_state;
+
+		kfree(default_chan_list);
+	}
+exit:
+	if (unlikely(err)) {
+		/* Don't print Error incase of Scan suppress */
+		if ((err == BCME_EPERM) && cfg->scan_suppressed)
+			WL_DBG(("Escan failed: Scan Suppressed \n"));
+		else {
+			cnt++;
+			WL_ERR(("error (%d), cnt=%d\n", err, cnt));
+			// terence 20140111: send disassoc to firmware
+			if (cnt >= 4) {
+				dev = bcmcfg_to_prmry_ndev(cfg);
+				memset(&scbval, 0, sizeof(scb_val_t));
+				wldev_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t), true);
+				WL_ERR(("Send disassoc to break the busy dev=%p\n", dev));
+				cnt = 0;
+			}
+		}
+	} else {
+		cnt = 0;
+	}
+	return err;
+}
+
+
+static s32
+wl_do_escan(struct bcm_cfg80211 *cfg, struct wiphy *wiphy, struct net_device *ndev,
+	struct cfg80211_scan_request *request)
+{
+	s32 err = BCME_OK;
+	s32 passive_scan;
+	s32 passive_scan_time;
+	s32 passive_scan_time_org;
+	wl_scan_results_t *results;
+	WL_SCAN(("Enter \n"));
+	mutex_lock(&cfg->usr_sync);
+
+	results = wl_escan_get_buf(cfg, FALSE);
+	results->version = 0;
+	results->count = 0;
+	results->buflen = WL_SCAN_RESULTS_FIXED_SIZE;
+
+	cfg->escan_info.ndev = ndev;
+	cfg->escan_info.wiphy = wiphy;
+	cfg->escan_info.escan_state = WL_ESCAN_STATE_SCANING;
+	passive_scan = cfg->active_scan ? 0 : 1;
+	err = wldev_ioctl(ndev, WLC_SET_PASSIVE_SCAN,
+		&passive_scan, sizeof(passive_scan), true);
+	if (unlikely(err)) {
+		WL_ERR(("error (%d)\n", err));
+		goto exit;
+	}
+
+	if (passive_channel_skip) {
+
+		err = wldev_ioctl(ndev, WLC_GET_SCAN_PASSIVE_TIME,
+			&passive_scan_time_org, sizeof(passive_scan_time_org), false);
+		if (unlikely(err)) {
+			WL_ERR(("== error (%d)\n", err));
+			goto exit;
+		}
+
+		WL_SCAN(("PASSIVE SCAN time : %d \n", passive_scan_time_org));
+
+		passive_scan_time = 0;
+		err = wldev_ioctl(ndev, WLC_SET_SCAN_PASSIVE_TIME,
+			&passive_scan_time, sizeof(passive_scan_time), true);
+		if (unlikely(err)) {
+			WL_ERR(("== error (%d)\n", err));
+			goto exit;
+		}
+
+		WL_SCAN(("PASSIVE SCAN SKIPED!! (passive_channel_skip:%d) \n",
+			passive_channel_skip));
+	}
+
+	err = wl_run_escan(cfg, ndev, request, WL_SCAN_ACTION_START);
+
+	if (passive_channel_skip) {
+		err = wldev_ioctl(ndev, WLC_SET_SCAN_PASSIVE_TIME,
+			&passive_scan_time_org, sizeof(passive_scan_time_org), true);
+		if (unlikely(err)) {
+			WL_ERR(("== error (%d)\n", err));
+			goto exit;
+		}
+
+		WL_SCAN(("PASSIVE SCAN RECOVERED!! (passive_scan_time_org:%d) \n",
+			passive_scan_time_org));
+	}
+
+exit:
+	mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+
+static s32
+__wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+	struct cfg80211_scan_request *request,
+	struct cfg80211_ssid *this_ssid)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct cfg80211_ssid *ssids;
+	struct ether_addr primary_mac;
+	bool p2p_ssid;
+#ifdef WL11U
+	bcm_tlv_t *interworking_ie;
+#endif
+	s32 err = 0;
+	s32 bssidx = -1;
+	s32 i;
+
+	unsigned long flags;
+	static s32 busy_count = 0;
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	struct net_device *remain_on_channel_ndev = NULL;
+#endif
+
+	dhd_pub_t *dhd;
+
+	dhd = (dhd_pub_t *)(cfg->pub);
+	/*
+	 * Hostapd triggers scan before starting automatic channel selection
+	 * also Dump stats IOVAR scans each channel hence returning from here.
+	 */
+	if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+#ifdef WL_SUPPORT_ACS
+		WL_INFORM(("Scan Command at SoftAP mode\n"));
+		return 0;
+#else
+		WL_ERR(("Invalid Scan Command at SoftAP mode\n"));
+		return -EINVAL;
+#endif /* WL_SUPPORT_ACS */
+	}
+
+	ndev = ndev_to_wlc_ndev(ndev, cfg);
+
+	if (WL_DRV_STATUS_SENDING_AF_FRM_EXT(cfg)) {
+		WL_ERR(("Sending Action Frames. Try it again.\n"));
+		return -EAGAIN;
+	}
+
+	WL_DBG(("Enter wiphy (%p)\n", wiphy));
+	if (wl_get_drv_status_all(cfg, SCANNING)) {
+		if (cfg->scan_request == NULL) {
+			wl_clr_drv_status_all(cfg, SCANNING);
+			WL_DBG(("<<<<<<<<<<<Force Clear Scanning Status>>>>>>>>>>>\n"));
+		} else {
+			WL_ERR(("Scanning already\n"));
+			return -EAGAIN;
+		}
+	}
+	if (wl_get_drv_status(cfg, SCAN_ABORTING, ndev)) {
+		WL_ERR(("Scanning being aborted\n"));
+		return -EAGAIN;
+	}
+	if (request && request->n_ssids > WL_SCAN_PARAMS_SSID_MAX) {
+		WL_ERR(("request null or n_ssids > WL_SCAN_PARAMS_SSID_MAX\n"));
+		return -EOPNOTSUPP;
+	}
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	remain_on_channel_ndev = wl_cfg80211_get_remain_on_channel_ndev(cfg);
+	if (remain_on_channel_ndev) {
+		WL_DBG(("Remain_on_channel bit is set, somehow it didn't get cleared\n"));
+		wl_notify_escan_complete(cfg, remain_on_channel_ndev, true, true);
+	}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef WL_SDO
+	if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+		wl_cfg80211_pause_sdo(ndev, cfg);
+	}
+#endif
+
+	/* Arm scan timeout timer */
+	mod_timer(&cfg->scan_timeout, jiffies + msecs_to_jiffies(WL_SCAN_TIMER_INTERVAL_MS));
+	if (request) {		/* scan bss */
+		ssids = request->ssids;
+		p2p_ssid = false;
+		for (i = 0; i < request->n_ssids; i++) {
+			if (ssids[i].ssid_len &&
+				IS_P2P_SSID(ssids[i].ssid, ssids[i].ssid_len)) {
+				p2p_ssid = true;
+				break;
+			}
+		}
+		if (p2p_ssid) {
+			if (cfg->p2p_supported) {
+				/* p2p scan trigger */
+				if (p2p_on(cfg) == false) {
+					/* p2p on at the first time */
+					p2p_on(cfg) = true;
+					wl_cfgp2p_set_firm_p2p(cfg);
+					get_primary_mac(cfg, &primary_mac);
+					wl_cfgp2p_generate_bss_mac(&primary_mac,
+						&cfg->p2p->dev_addr, &cfg->p2p->int_addr);
+				}
+				wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+				WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+				p2p_scan(cfg) = true;
+			}
+		} else {
+			/* legacy scan trigger
+			 * So, we have to disable p2p discovery if p2p discovery is on
+			 */
+			if (cfg->p2p_supported) {
+				p2p_scan(cfg) = false;
+				/* If Netdevice is not equals to primary and p2p is on
+				*  , we will do p2p scan using P2PAPI_BSSCFG_DEVICE.
+				*/
+
+				if (p2p_scan(cfg) == false) {
+					if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+						err = wl_cfgp2p_discover_enable_search(cfg,
+						false);
+						if (unlikely(err)) {
+							goto scan_out;
+						}
+
+					}
+				}
+			}
+			if (!cfg->p2p_supported || !p2p_scan(cfg)) {
+
+				if (wl_cfgp2p_find_idx(cfg, ndev, &bssidx) != BCME_OK) {
+					WL_ERR(("Find p2p index from ndev(%p) failed\n",
+						ndev));
+					err = BCME_ERROR;
+					goto scan_out;
+				}
+#ifdef WL11U
+				if ((interworking_ie = wl_cfg80211_find_interworking_ie(
+					(u8 *)request->ie, request->ie_len)) != NULL) {
+					err = wl_cfg80211_add_iw_ie(cfg, ndev, bssidx,
+					       VNDR_IE_CUSTOM_FLAG, interworking_ie->id,
+					       interworking_ie->data, interworking_ie->len);
+
+					if (unlikely(err)) {
+						goto scan_out;
+					}
+				} else if (cfg->iw_ie_len != 0) {
+				/* we have to clear IW IE and disable gratuitous APR */
+					wl_cfg80211_add_iw_ie(cfg, ndev, bssidx,
+						VNDR_IE_CUSTOM_FLAG,
+						DOT11_MNG_INTERWORKING_ID,
+						0, 0);
+
+					wldev_iovar_setint_bsscfg(ndev, "grat_arp", 0,
+						bssidx);
+					cfg->wl11u = FALSE;
+					/* we don't care about error */
+				}
+#endif /* WL11U */
+				err = wl_cfgp2p_set_management_ie(cfg, ndev, bssidx,
+					VNDR_IE_PRBREQ_FLAG, (u8 *)request->ie,
+					request->ie_len);
+
+				if (unlikely(err)) {
+					goto scan_out;
+				}
+
+			}
+		}
+	} else {		/* scan in ibss */
+		ssids = this_ssid;
+	}
+
+	if (request && !p2p_scan(cfg)) {
+		WL_TRACE_HW4(("START SCAN\n"));
+	}
+
+	cfg->scan_request = request;
+	wl_set_drv_status(cfg, SCANNING, ndev);
+
+	if (cfg->p2p_supported) {
+		if (p2p_on(cfg) && p2p_scan(cfg)) {
+
+#ifdef WL_SDO
+			if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+				/* We shouldn't be getting p2p_find while discovery
+				 * offload is in progress
+				 */
+				WL_SD(("P2P_FIND: Discovery offload is in progress."
+					" Do nothing\n"));
+				err = -EINVAL;
+				goto scan_out;
+			}
+#endif
+			/* find my listen channel */
+			cfg->afx_hdl->my_listen_chan =
+				wl_find_listen_channel(cfg, request->ie,
+				request->ie_len);
+			err = wl_cfgp2p_enable_discovery(cfg, ndev,
+			request->ie, request->ie_len);
+
+			if (unlikely(err)) {
+				goto scan_out;
+			}
+		}
+	}
+	err = wl_do_escan(cfg, wiphy, ndev, request);
+	if (likely(!err))
+		goto scan_success;
+	else
+		goto scan_out;
+
+scan_success:
+	busy_count = 0;
+
+	return 0;
+
+scan_out:
+	if (err == BCME_BUSY || err == BCME_NOTREADY) {
+		WL_ERR(("Scan err = (%d), busy?%d", err, -EBUSY));
+		err = -EBUSY;
+	}
+
+#define SCAN_EBUSY_RETRY_LIMIT 10
+	if (err == -EBUSY) {
+		if (busy_count++ > SCAN_EBUSY_RETRY_LIMIT) {
+			struct ether_addr bssid;
+			s32 ret = 0;
+			busy_count = 0;
+			WL_ERR(("Unusual continuous EBUSY error, %d %d %d %d %d %d %d %d %d\n",
+				wl_get_drv_status(cfg, SCANNING, ndev),
+				wl_get_drv_status(cfg, SCAN_ABORTING, ndev),
+				wl_get_drv_status(cfg, CONNECTING, ndev),
+				wl_get_drv_status(cfg, CONNECTED, ndev),
+				wl_get_drv_status(cfg, DISCONNECTING, ndev),
+				wl_get_drv_status(cfg, AP_CREATING, ndev),
+				wl_get_drv_status(cfg, AP_CREATED, ndev),
+				wl_get_drv_status(cfg, SENDING_ACT_FRM, ndev),
+				wl_get_drv_status(cfg, SENDING_ACT_FRM, ndev)));
+
+			bzero(&bssid, sizeof(bssid));
+			if ((ret = wldev_ioctl(ndev, WLC_GET_BSSID,
+				&bssid, ETHER_ADDR_LEN, false)) == 0)
+				WL_ERR(("FW is connected with " MACDBG "/n",
+					MAC2STRDBG(bssid.octet)));
+			else
+				WL_ERR(("GET BSSID failed with %d\n", ret));
+
+			wl_cfg80211_scan_abort(cfg);
+
+		}
+	} else {
+		busy_count = 0;
+	}
+
+	wl_clr_drv_status(cfg, SCANNING, ndev);
+	if (timer_pending(&cfg->scan_timeout))
+		del_timer_sync(&cfg->scan_timeout);
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	cfg->scan_request = NULL;
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+#ifdef WL_SDO
+	if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+		wl_cfg80211_resume_sdo(ndev, cfg);
+	}
+#endif
+	return err;
+}
+
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
+#else
+wl_cfg80211_scan(struct wiphy *wiphy, struct net_device *ndev,
+	struct cfg80211_scan_request *request)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+	s32 err = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	struct net_device *ndev = wdev_to_wlc_ndev(request->wdev, cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+	WL_DBG(("Enter \n"));
+	RETURN_EIO_IF_NOT_UP(cfg);
+
+#ifdef P2PONEINT
+	ndev = bcmcfg_to_prmry_ndev(cfg);
+	WL_DBG(("scan use  [dev name %s ] \n", ndev->name));
+#endif
+
+	err = __wl_cfg80211_scan(wiphy, ndev, request, NULL);
+	if (unlikely(err)) {
+		if ((err == BCME_EPERM) && cfg->scan_suppressed)
+			WL_DBG(("scan not permitted at this time (%d)\n", err));
+		else
+			WL_ERR(("scan error (%d)\n", err));
+		return err;
+	}
+
+	return err;
+}
+
+static s32 wl_set_rts(struct net_device *dev, u32 rts_threshold)
+{
+	s32 err = 0;
+
+	err = wldev_iovar_setint(dev, "rtsthresh", rts_threshold);
+	if (unlikely(err)) {
+		WL_ERR(("Error (%d)\n", err));
+		return err;
+	}
+	return err;
+}
+
+static s32 wl_set_frag(struct net_device *dev, u32 frag_threshold)
+{
+	s32 err = 0;
+
+	err = wldev_iovar_setint_bsscfg(dev, "fragthresh", frag_threshold, 0);
+	if (unlikely(err)) {
+		WL_ERR(("Error (%d)\n", err));
+		return err;
+	}
+	return err;
+}
+
+static s32 wl_set_retry(struct net_device *dev, u32 retry, bool l)
+{
+	s32 err = 0;
+	u32 cmd = (l ? WLC_SET_LRL : WLC_SET_SRL);
+
+	retry = htod32(retry);
+	err = wldev_ioctl(dev, cmd, &retry, sizeof(retry), true);
+	if (unlikely(err)) {
+		WL_ERR(("cmd (%d) , error (%d)\n", cmd, err));
+		return err;
+	}
+	return err;
+}
+
+static s32 wl_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+	struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	s32 err = 0;
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	WL_DBG(("Enter\n"));
+	if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
+		(cfg->conf->rts_threshold != wiphy->rts_threshold)) {
+		cfg->conf->rts_threshold = wiphy->rts_threshold;
+		err = wl_set_rts(ndev, cfg->conf->rts_threshold);
+		if (!err)
+			return err;
+	}
+	if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
+		(cfg->conf->frag_threshold != wiphy->frag_threshold)) {
+		cfg->conf->frag_threshold = wiphy->frag_threshold;
+		err = wl_set_frag(ndev, cfg->conf->frag_threshold);
+		if (!err)
+			return err;
+	}
+	if (changed & WIPHY_PARAM_RETRY_LONG &&
+		(cfg->conf->retry_long != wiphy->retry_long)) {
+		cfg->conf->retry_long = wiphy->retry_long;
+		err = wl_set_retry(ndev, cfg->conf->retry_long, true);
+		if (!err)
+			return err;
+	}
+	if (changed & WIPHY_PARAM_RETRY_SHORT &&
+		(cfg->conf->retry_short != wiphy->retry_short)) {
+		cfg->conf->retry_short = wiphy->retry_short;
+		err = wl_set_retry(ndev, cfg->conf->retry_short, false);
+		if (!err) {
+			return err;
+		}
+	}
+
+	return err;
+}
+static chanspec_t
+channel_to_chanspec(struct wiphy *wiphy, struct net_device *dev, u32 channel, u32 bw_cap)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	u8 *buf = NULL;
+	wl_uint32_list_t *list;
+	int err = BCME_OK;
+	chanspec_t c = 0, ret_c = 0;
+	int bw = 0, tmp_bw = 0;
+	int i;
+	u32 tmp_c;
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+#define LOCAL_BUF_SIZE	1024
+	buf = (u8 *) kzalloc(LOCAL_BUF_SIZE, kflags);
+	if (!buf) {
+		WL_ERR(("buf memory alloc failed\n"));
+		goto exit;
+	}
+	list = (wl_uint32_list_t *)(void *)buf;
+	list->count = htod32(WL_NUMCHANSPECS);
+	err = wldev_iovar_getbuf_bsscfg(dev, "chanspecs", NULL,
+		0, buf, LOCAL_BUF_SIZE, 0, &cfg->ioctl_buf_sync);
+	if (err != BCME_OK) {
+		WL_ERR(("get chanspecs failed with %d\n", err));
+		goto exit;
+	}
+	for (i = 0; i < dtoh32(list->count); i++) {
+		c = dtoh32(list->element[i]);
+		if (channel <= CH_MAX_2G_CHANNEL) {
+			if (!CHSPEC_IS20(c))
+				continue;
+			if (channel == CHSPEC_CHANNEL(c)) {
+				ret_c = c;
+				bw = 20;
+				goto exit;
+			}
+		}
+		tmp_c = wf_chspec_ctlchan(c);
+		tmp_bw = bw2cap[CHSPEC_BW(c) >> WL_CHANSPEC_BW_SHIFT];
+		if (tmp_c != channel)
+			continue;
+
+		if ((tmp_bw > bw) && (tmp_bw <= bw_cap)) {
+			bw = tmp_bw;
+			ret_c = c;
+			if (bw == bw_cap)
+				goto exit;
+		}
+	}
+exit:
+	if (buf)
+		kfree(buf);
+#undef LOCAL_BUF_SIZE
+	WL_INFORM(("return chanspec %x %d\n", ret_c, bw));
+	return ret_c;
+}
+
+void
+wl_cfg80211_ibss_vsie_set_buffer(vndr_ie_setbuf_t *ibss_vsie, int ibss_vsie_len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	if (cfg != NULL && ibss_vsie != NULL) {
+		if (cfg->ibss_vsie != NULL) {
+			kfree(cfg->ibss_vsie);
+		}
+		cfg->ibss_vsie = ibss_vsie;
+		cfg->ibss_vsie_len = ibss_vsie_len;
+	}
+}
+
+static void
+wl_cfg80211_ibss_vsie_free(struct bcm_cfg80211 *cfg)
+{
+	/* free & initiralize VSIE (Vendor Specific IE) */
+	if (cfg->ibss_vsie != NULL) {
+		kfree(cfg->ibss_vsie);
+		cfg->ibss_vsie = NULL;
+		cfg->ibss_vsie_len = 0;
+	}
+}
+
+s32
+wl_cfg80211_ibss_vsie_delete(struct net_device *dev)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	char *ioctl_buf = NULL;
+	s32 ret = BCME_OK;
+
+	if (cfg != NULL && cfg->ibss_vsie != NULL) {
+		ioctl_buf = kmalloc(WLC_IOCTL_MEDLEN, GFP_KERNEL);
+		if (!ioctl_buf) {
+			WL_ERR(("ioctl memory alloc failed\n"));
+			return -ENOMEM;
+		}
+
+		/* change the command from "add" to "del" */
+		strncpy(cfg->ibss_vsie->cmd, "del", VNDR_IE_CMD_LEN - 1);
+		cfg->ibss_vsie->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+		ret = wldev_iovar_setbuf(dev, "ie",
+			cfg->ibss_vsie, cfg->ibss_vsie_len,
+			ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+		WL_ERR(("ret=%d\n", ret));
+
+		if (ret == BCME_OK) {
+			/* free & initiralize VSIE */
+			kfree(cfg->ibss_vsie);
+			cfg->ibss_vsie = NULL;
+			cfg->ibss_vsie_len = 0;
+		}
+
+		if (ioctl_buf) {
+			kfree(ioctl_buf);
+		}
+	}
+
+	return ret;
+}
+
+#ifdef WLAIBSS_MCHAN
+static bcm_struct_cfgdev*
+bcm_cfg80211_add_ibss_if(struct wiphy *wiphy, char *name)
+{
+	int err = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct wireless_dev* wdev = NULL;
+	struct net_device *new_ndev = NULL;
+	struct net_device *primary_ndev = NULL;
+	s32 timeout;
+	wl_aibss_if_t aibss_if;
+	wl_if_event_info *event = NULL;
+
+	if (cfg->ibss_cfgdev != NULL) {
+		WL_ERR(("IBSS interface %s already exists\n", name));
+		return NULL;
+	}
+
+	WL_ERR(("Try to create IBSS interface %s\n", name));
+	primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+	/* generate a new MAC address for the IBSS interface */
+	get_primary_mac(cfg, &cfg->ibss_if_addr);
+	cfg->ibss_if_addr.octet[4] ^= 0x40;
+	memset(&aibss_if, sizeof(aibss_if), 0);
+	memcpy(&aibss_if.addr, &cfg->ibss_if_addr, sizeof(aibss_if.addr));
+	aibss_if.chspec = 0;
+	aibss_if.len = sizeof(aibss_if);
+
+	cfg->bss_pending_op = TRUE;
+	memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+	err = wldev_iovar_setbuf(primary_ndev, "aibss_ifadd", &aibss_if,
+		sizeof(aibss_if), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, NULL);
+	if (err) {
+		WL_ERR(("IOVAR aibss_ifadd failed with error %d\n", err));
+		goto fail;
+	}
+	timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+		!cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+	if (timeout <= 0 || cfg->bss_pending_op)
+		goto fail;
+
+	event = &cfg->if_event_info;
+	strncpy(event->name, name, IFNAMSIZ - 1);
+	/* By calling wl_cfg80211_allocate_if (dhd_allocate_if eventually) we give the control
+	 * over this net_device interface to dhd_linux, hence the interface is managed by dhd_liux
+	 * and will be freed by dhd_detach unless it gets unregistered before that. The
+	 * wireless_dev instance new_ndev->ieee80211_ptr associated with this net_device will
+	 * be freed by wl_dealloc_netinfo
+	 */
+	new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx, event->name,
+		event->mac, event->bssidx);
+	if (new_ndev == NULL)
+		goto fail;
+	wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+	if (wdev == NULL)
+		goto fail;
+	wdev->wiphy = wiphy;
+	wdev->iftype = NL80211_IFTYPE_ADHOC;
+	wdev->netdev = new_ndev;
+	new_ndev->ieee80211_ptr = wdev;
+	SET_NETDEV_DEV(new_ndev, wiphy_dev(wdev->wiphy));
+
+	/* rtnl lock must have been acquired, if this is not the case, wl_cfg80211_register_if
+	* needs to be modified to take one parameter (bool need_rtnl_lock)
+	 */
+	ASSERT_RTNL();
+	if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK)
+		goto fail;
+
+	wl_alloc_netinfo(cfg, new_ndev, wdev, WL_MODE_IBSS, PM_ENABLE);
+	cfg->ibss_cfgdev = ndev_to_cfgdev(new_ndev);
+	WL_ERR(("IBSS interface %s created\n", new_ndev->name));
+	return cfg->ibss_cfgdev;
+
+fail:
+	WL_ERR(("failed to create IBSS interface %s \n", name));
+	cfg->bss_pending_op = FALSE;
+	if (new_ndev)
+		wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+	if (wdev)
+		kfree(wdev);
+	return NULL;
+}
+
+static s32
+bcm_cfg80211_del_ibss_if(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+	int err = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *ndev = NULL;
+	struct net_device *primary_ndev = NULL;
+	s32 timeout;
+
+	if (!cfgdev || cfg->ibss_cfgdev != cfgdev || ETHER_ISNULLADDR(&cfg->ibss_if_addr.octet))
+		return -EINVAL;
+	ndev = (struct net_device *)cfgdev_to_ndev(cfg->ibss_cfgdev);
+	primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	cfg->bss_pending_op = TRUE;
+	memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+	err = wldev_iovar_setbuf(primary_ndev, "aibss_ifdel", &cfg->ibss_if_addr,
+		sizeof(cfg->ibss_if_addr), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, NULL);
+	if (err) {
+		WL_ERR(("IOVAR aibss_ifdel failed with error %d\n", err));
+		goto fail;
+	}
+	timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+		!cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+	if (timeout <= 0 || cfg->bss_pending_op) {
+		WL_ERR(("timeout in waiting IF_DEL event\n"));
+		goto fail;
+	}
+
+	wl_cfg80211_remove_if(cfg, cfg->if_event_info.ifidx, ndev);
+	cfg->ibss_cfgdev = NULL;
+	return 0;
+
+fail:
+	cfg->bss_pending_op = FALSE;
+	return -1;
+}
+#endif /* WLAIBSS_MCHAN */
+
+s32
+wl_cfg80211_interface_ops(struct bcm_cfg80211 *cfg,
+	struct net_device *ndev, s32 bsscfg_idx,
+	enum nl80211_iftype iface_type, s32 del, u8 *addr)
+{
+	wl_interface_create_t iface;
+	s32 ret;
+	wl_interface_info_t *info;
+
+	bzero(&iface, sizeof(wl_interface_create_t));
+
+	iface.ver = WL_INTERFACE_CREATE_VER;
+
+	if (iface_type == NL80211_IFTYPE_AP)
+		iface.flags = WL_INTERFACE_CREATE_AP;
+	else
+		iface.flags = WL_INTERFACE_CREATE_STA;
+
+	if (del) {
+		ret = wldev_iovar_setbuf(ndev, "interface_remove",
+			NULL, 0, cfg->ioctl_buf, WLC_IOCTL_MEDLEN, NULL);
+	} else {
+		if (addr) {
+			memcpy(&iface.mac_addr.octet, addr, ETH_ALEN);
+			iface.flags |= WL_INTERFACE_MAC_USE;
+		}
+		ret = wldev_iovar_getbuf(ndev, "interface_create",
+			&iface, sizeof(wl_interface_create_t),
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+		if (ret == 0) {
+			/* success */
+			info = (wl_interface_info_t *)cfg->ioctl_buf;
+			WL_DBG(("wl interface create success!! bssidx:%d \n",
+				info->bsscfgidx));
+			ret = info->bsscfgidx;
+		}
+	}
+
+	if (ret < 0)
+		WL_ERR(("Interface %s failed!! ret %d\n",
+			del ? "remove" : "create", ret));
+
+	return ret;
+}
+
+#if defined(DUAL_STA) || defined(DUAL_STA_STATIC_IF)
+s32
+wl_cfg80211_add_del_bss(struct bcm_cfg80211 *cfg,
+	struct net_device *ndev, s32 bsscfg_idx,
+	enum nl80211_iftype iface_type, s32 del, u8 *addr)
+{
+	s32 ret = BCME_OK;
+	s32 val = 0;
+
+	struct {
+		s32 cfg;
+		s32 val;
+		struct ether_addr ea;
+	} bss_setbuf;
+
+	WL_INFORM(("iface_type:%d del:%d \n", iface_type, del));
+
+	bzero(&bss_setbuf, sizeof(bss_setbuf));
+
+	/* AP=3, STA=2, up=1, down=0, val=-1 */
+	if (del) {
+		val = -1;
+	} else if (iface_type == NL80211_IFTYPE_AP) {
+		/* AP Interface */
+		WL_DBG(("Adding AP Interface \n"));
+		val = 3;
+	} else if (iface_type == NL80211_IFTYPE_STATION) {
+		WL_DBG(("Adding STA Interface \n"));
+		val = 2;
+	} else {
+		WL_ERR((" add_del_bss NOT supported for IFACE type:0x%x", iface_type));
+		return -EINVAL;
+	}
+
+	bss_setbuf.cfg = htod32(bsscfg_idx);
+	bss_setbuf.val = htod32(val);
+
+	if (addr) {
+		memcpy(&bss_setbuf.ea.octet, addr, ETH_ALEN);
+	}
+
+	ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+	if (ret != 0)
+		WL_ERR(("'bss %d' failed with %d\n", val, ret));
+
+	return ret;
+}
+
+/* Create a Generic Network Interface and initialize it depending up on
+ * the interface type
+ */
+bcm_struct_cfgdev*
+wl_cfg80211_create_iface(struct wiphy *wiphy,
+	enum nl80211_iftype iface_type,
+	u8 *mac_addr, const char *name)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *new_ndev = NULL;
+	struct net_device *primary_ndev = NULL;
+	s32 ret = BCME_OK;
+	s32 bsscfg_idx = 1;
+	u32 timeout;
+	wl_if_event_info *event = NULL;
+	struct wireless_dev *wdev = NULL;
+	u8 addr[ETH_ALEN];
+
+	WL_DBG(("Enter\n"));
+
+	if (!name) {
+		WL_ERR(("Interface name not provided\n"));
+		return NULL;
+	}
+
+	primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	if (likely(!mac_addr)) {
+		/* Use primary MAC with the locally administered bit for the Secondary STA I/F */
+		memcpy(addr, primary_ndev->dev_addr, ETH_ALEN);
+		addr[0] |= 0x02;
+	} else {
+		/* Use the application provided mac address (if any) */
+		memcpy(addr, mac_addr, ETH_ALEN);
+	}
+
+	if ((iface_type != NL80211_IFTYPE_STATION) && (iface_type != NL80211_IFTYPE_AP)) {
+		WL_ERR(("IFACE type:%d not supported. STA "
+					"or AP IFACE is only supported\n", iface_type));
+		return NULL;
+	}
+
+	cfg->bss_pending_op = TRUE;
+	memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+
+	/* De-initialize the p2p discovery interface, if operational */
+	if (p2p_is_on(cfg)) {
+		WL_DBG(("Disabling P2P Discovery Interface \n"));
+#ifdef WL_CFG80211_P2P_DEV_IF
+		ret = wl_cfg80211_scan_stop(bcmcfg_to_p2p_wdev(cfg));
+#else
+		ret = wl_cfg80211_scan_stop(cfg->p2p_net);
+#endif
+		if (unlikely(ret < 0)) {
+			CFGP2P_ERR(("P2P scan stop failed, ret=%d\n", ret));
+		}
+
+		wl_cfgp2p_disable_discovery(cfg);
+		wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+		p2p_on(cfg) = false;
+	}
+
+	/*
+	 * Intialize the firmware I/F.
+	 */
+	ret = wl_cfg80211_interface_ops(cfg, primary_ndev, bsscfg_idx,
+		NL80211_IFTYPE_STATION, 0, addr);
+	if (ret == BCME_UNSUPPORTED) {
+	    /* Use bssidx 1 by default */
+		if ((ret = wl_cfg80211_add_del_bss(cfg, primary_ndev,
+			bsscfg_idx, iface_type, 0, addr)) < 0) {
+			return NULL;
+		}
+	} else if (ret < 0) {
+	    WL_ERR(("Interface create failed!! ret:%d \n", ret));
+	    goto fail;
+	} else {
+	    /* Success */
+	    bsscfg_idx = ret;
+	}
+
+	/*
+	 * Wait till the firmware send a confirmation event back.
+	 */
+	WL_DBG(("Wait for the FW I/F Event\n"));
+	timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+		!cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+	if (timeout <= 0 || cfg->bss_pending_op) {
+		WL_ERR(("ADD_IF event, didn't come. Return \n"));
+		goto fail;
+	}
+
+	/*
+	 * Since FW operation is successful,we can go ahead with the
+	 * the host interface creation.
+	 */
+	event = &cfg->if_event_info;
+	strncpy(event->name, name, IFNAMSIZ - 1);
+	new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx,
+		event->name, addr, event->bssidx);
+	if (!new_ndev) {
+		WL_ERR(("I/F allocation failed! \n"));
+		goto fail;
+	} else
+		WL_DBG(("I/F allocation succeeded! ifidx:0x%x bssidx:0x%x \n",
+		 event->ifidx, event->bssidx));
+
+	wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+	if (!wdev) {
+		WL_ERR(("wireless_dev alloc failed! \n"));
+		goto fail;
+	}
+
+	wdev->wiphy = wiphy;
+	wdev->iftype = iface_type;
+	new_ndev->ieee80211_ptr = wdev;
+	SET_NETDEV_DEV(new_ndev, wiphy_dev(wdev->wiphy));
+
+	/* RTNL lock must have been acquired. */
+	ASSERT_RTNL();
+
+	/* Set the locally administed mac addr, if not applied already */
+	if (memcmp(addr, event->mac, ETH_ALEN) != 0) {
+		ret = wldev_iovar_setbuf_bsscfg(primary_ndev, "cur_etheraddr", addr, ETH_ALEN,
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, event->bssidx, &cfg->ioctl_buf_sync);
+		if (unlikely(ret)) {
+				WL_ERR(("set cur_etheraddr Error (%d)\n", ret));
+				goto fail;
+		}
+		memcpy(new_ndev->dev_addr, addr, ETH_ALEN);
+	}
+
+	if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK) {
+		WL_ERR(("IFACE register failed \n"));
+		goto fail;
+	}
+
+	/* Initialize with the station mode params */
+	wl_alloc_netinfo(cfg, new_ndev, wdev,
+		(iface_type == NL80211_IFTYPE_STATION) ?
+		WL_MODE_BSS : WL_MODE_AP, PM_ENABLE);
+	cfg->bss_cfgdev = ndev_to_cfgdev(new_ndev);
+	cfg->cfgdev_bssidx = event->bssidx;
+
+	WL_DBG(("Host Network Interface for Secondary I/F created"));
+
+	return cfg->bss_cfgdev;
+
+fail:
+	cfg->bss_pending_op = FALSE;
+	if (new_ndev)
+		wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+	if (wdev)
+		kfree(wdev);
+
+	return NULL;
+}
+
+s32
+wl_cfg80211_del_iface(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *ndev = NULL;
+	struct net_device *primary_ndev = NULL;
+	s32 ret = BCME_OK;
+	s32 bsscfg_idx = 1;
+	u32 timeout;
+	u32 ifidx;
+	enum nl80211_iftype iface_type = NL80211_IFTYPE_STATION;
+
+	WL_DBG(("Enter\n"));
+
+	if (!cfg->bss_cfgdev)
+		return 0;
+
+	/* If any scan is going on, abort it */
+	if (wl_get_drv_status_all(cfg, SCANNING)) {
+		WL_DBG(("Scan in progress. Aborting the scan!\n"));
+		wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+	}
+
+	ndev = (struct net_device *)cfgdev_to_ndev(cfg->bss_cfgdev);
+	primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	cfg->bss_pending_op = TRUE;
+	memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+
+	/* Delete the firmware interface */
+	ret = wl_cfg80211_interface_ops(cfg, ndev, cfg->cfgdev_bssidx,
+		NL80211_IFTYPE_STATION, 1, NULL);
+	if (ret == BCME_UNSUPPORTED) {
+		if ((ret = wl_cfg80211_add_del_bss(cfg, ndev,
+			bsscfg_idx, iface_type, true, NULL)) < 0) {
+			WL_ERR(("DEL bss failed ret:%d \n", ret));
+			return ret;
+		}
+	} else if (ret < 0) {
+	    WL_ERR(("Interface DEL failed ret:%d \n", ret));
+	    return ret;
+	}
+
+	timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+		!cfg->bss_pending_op, msecs_to_jiffies(MAX_WAIT_TIME));
+	if (timeout <= 0 || cfg->bss_pending_op) {
+		WL_ERR(("timeout in waiting IF_DEL event\n"));
+	}
+	ifidx = dhd_net2idx(((struct dhd_pub *)(cfg->pub))->info, ndev);
+	wl_cfg80211_remove_if(cfg, ifidx, ndev);
+	cfg->bss_cfgdev = NULL;
+	cfg->cfgdev_bssidx = -1;
+	cfg->bss_pending_op = FALSE;
+
+	WL_DBG(("IF_DEL Done.\n"));
+
+	return ret;
+}
+#endif /* defined(DUAL_STA) || defined(DUAL_STA_STATIC_IF) */
+
+static s32
+wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_ibss_params *params)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct cfg80211_bss *bss;
+	struct ieee80211_channel *chan;
+	struct wl_join_params join_params;
+	int scan_suppress;
+	struct cfg80211_ssid ssid;
+	s32 scan_retry = 0;
+	s32 err = 0;
+	size_t join_params_size;
+	chanspec_t chanspec = 0;
+	u32 param[2] = {0, 0};
+	u32 bw_cap = 0;
+#if defined(WLAIBSS) && defined(WLAIBSS_PS)
+	s32 atim = 10;
+#endif /* WLAIBSS & WLAIBSS_PS */
+
+	WL_TRACE(("In\n"));
+	RETURN_EIO_IF_NOT_UP(cfg);
+	WL_INFORM(("JOIN BSSID:" MACDBG "\n", MAC2STRDBG(params->bssid)));
+	if (!params->ssid || params->ssid_len <= 0) {
+		WL_ERR(("Invalid parameter\n"));
+		return -EINVAL;
+	}
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	chan = params->chandef.chan;
+#else
+	chan = params->channel;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+	if (chan)
+		cfg->channel = ieee80211_frequency_to_channel(chan->center_freq);
+	if (wl_get_drv_status(cfg, CONNECTED, dev)) {
+		struct wlc_ssid *ssid = (struct wlc_ssid *)wl_read_prof(cfg, dev, WL_PROF_SSID);
+		u8 *bssid = (u8 *)wl_read_prof(cfg, dev, WL_PROF_BSSID);
+		u32 *channel = (u32 *)wl_read_prof(cfg, dev, WL_PROF_CHAN);
+		if (!params->bssid || ((memcmp(params->bssid, bssid, ETHER_ADDR_LEN) == 0) &&
+			(memcmp(params->ssid, ssid->SSID, ssid->SSID_len) == 0) &&
+			(*channel == cfg->channel))) {
+			WL_ERR(("Connection already existed to " MACDBG "\n",
+				MAC2STRDBG((u8 *)wl_read_prof(cfg, dev, WL_PROF_BSSID))));
+			return -EISCONN;
+		}
+		WL_ERR(("Ignore Previous connecton to %s (" MACDBG ")\n",
+			ssid->SSID, MAC2STRDBG(bssid)));
+	}
+
+	/* remove the VSIE */
+	wl_cfg80211_ibss_vsie_delete(dev);
+
+	bss = cfg80211_get_ibss(wiphy, NULL, params->ssid, params->ssid_len);
+	if (!bss) {
+		if (IBSS_INITIAL_SCAN_ALLOWED == TRUE) {
+			memcpy(ssid.ssid, params->ssid, params->ssid_len);
+			ssid.ssid_len = params->ssid_len;
+			do {
+				if (unlikely
+					(__wl_cfg80211_scan(wiphy, dev, NULL, &ssid) ==
+					 -EBUSY)) {
+					wl_delay(150);
+				} else {
+					break;
+				}
+			} while (++scan_retry < WL_SCAN_RETRY_MAX);
+
+			/* rtnl lock code is removed here. don't see why rtnl lock
+			 * needs to be released.
+			 */
+
+			/* wait 4 secons till scan done.... */
+			schedule_timeout_interruptible(msecs_to_jiffies(4000));
+
+			bss = cfg80211_get_ibss(wiphy, NULL,
+				params->ssid, params->ssid_len);
+		}
+	}
+	if (bss && ((IBSS_COALESCE_ALLOWED == TRUE) ||
+		((IBSS_COALESCE_ALLOWED == FALSE) && params->bssid &&
+		!memcmp(bss->bssid, params->bssid, ETHER_ADDR_LEN)))) {
+		cfg->ibss_starter = false;
+		WL_DBG(("Found IBSS\n"));
+	} else {
+		cfg->ibss_starter = true;
+	}
+	if (chan) {
+		if (chan->band == NL80211_BAND_5GHZ)
+			param[0] = WLC_BAND_5G;
+		else if (chan->band == NL80211_BAND_2GHZ)
+			param[0] = WLC_BAND_2G;
+		err = wldev_iovar_getint(dev, "bw_cap", param);
+		if (unlikely(err)) {
+			WL_ERR(("Get bw_cap Failed (%d)\n", err));
+			return err;
+		}
+		bw_cap = param[0];
+		chanspec = channel_to_chanspec(wiphy, dev, cfg->channel, bw_cap);
+	}
+	/*
+	 * Join with specific BSSID and cached SSID
+	 * If SSID is zero join based on BSSID only
+	 */
+	memset(&join_params, 0, sizeof(join_params));
+	memcpy((void *)join_params.ssid.SSID, (void *)params->ssid,
+		params->ssid_len);
+	join_params.ssid.SSID_len = htod32(params->ssid_len);
+	if (params->bssid) {
+		memcpy(&join_params.params.bssid, params->bssid, ETHER_ADDR_LEN);
+		err = wldev_ioctl(dev, WLC_SET_DESIRED_BSSID, &join_params.params.bssid,
+			ETHER_ADDR_LEN, true);
+		if (unlikely(err)) {
+			WL_ERR(("Error (%d)\n", err));
+			return err;
+		}
+	} else
+		memset(&join_params.params.bssid, 0, ETHER_ADDR_LEN);
+	wldev_iovar_setint(dev, "ibss_coalesce_allowed", IBSS_COALESCE_ALLOWED);
+
+	if (IBSS_INITIAL_SCAN_ALLOWED == FALSE) {
+		scan_suppress = TRUE;
+		/* Set the SCAN SUPPRESS Flag in the firmware to skip join scan */
+		err = wldev_ioctl(dev, WLC_SET_SCANSUPPRESS,
+			&scan_suppress, sizeof(int), true);
+		if (unlikely(err)) {
+			WL_ERR(("Scan Suppress Setting Failed (%d)\n", err));
+			return err;
+		}
+	}
+
+	join_params.params.chanspec_list[0] = chanspec;
+	join_params.params.chanspec_num = 1;
+	wldev_iovar_setint(dev, "chanspec", chanspec);
+	join_params_size = sizeof(join_params);
+
+	/* Disable Authentication, IBSS will add key if it required */
+	wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_DISABLED);
+	wldev_iovar_setint(dev, "wsec", 0);
+
+#ifdef WLAIBSS
+	/* Enable custom ibss features */
+	err = wldev_iovar_setint(dev, "aibss", TRUE);
+
+	if (unlikely(err)) {
+		WL_ERR(("Enable custom IBSS mode failed (%d)\n", err));
+		return err;
+	}
+#ifdef WLAIBSS_PS
+	err = wldev_ioctl(dev, WLC_SET_ATIM, &atim, sizeof(int), true);
+	if (unlikely(err)) {
+		WL_ERR(("Enable custom IBSS ATIM mode failed (%d)\n", err));
+		return err;
+	}
+#endif /* WLAIBSS_PS */
+#endif /* WLAIBSS */
+
+	err = wldev_ioctl(dev, WLC_SET_SSID, &join_params,
+		join_params_size, true);
+	if (unlikely(err)) {
+		WL_ERR(("Error (%d)\n", err));
+		return err;
+	}
+
+	if (IBSS_INITIAL_SCAN_ALLOWED == FALSE) {
+		scan_suppress = FALSE;
+		/* Reset the SCAN SUPPRESS Flag */
+		err = wldev_ioctl(dev, WLC_SET_SCANSUPPRESS,
+			&scan_suppress, sizeof(int), true);
+		if (unlikely(err)) {
+			WL_ERR(("Reset Scan Suppress Flag Failed (%d)\n", err));
+			return err;
+		}
+	}
+	wl_update_prof(cfg, dev, NULL, &join_params.ssid, WL_PROF_SSID);
+	wl_update_prof(cfg, dev, NULL, &cfg->channel, WL_PROF_CHAN);
+#ifdef WLAIBSS
+	cfg->aibss_txfail_seq = 0;	/* initialize the sequence */
+#endif /* WLAIBSS */
+	cfg->rmc_event_seq = 0; /* initialize rmcfail sequence */
+	return err;
+}
+
+static s32 wl_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 err = 0;
+	scb_val_t scbval;
+	u8 *curbssid;
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	wl_link_down(cfg);
+
+	WL_ERR(("Leave IBSS\n"));
+	curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+	wl_set_drv_status(cfg, DISCONNECTING, dev);
+	scbval.val = 0;
+	memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+	err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+		sizeof(scb_val_t), true);
+	if (unlikely(err)) {
+		wl_clr_drv_status(cfg, DISCONNECTING, dev);
+		WL_ERR(("error(%d)\n", err));
+		return err;
+	}
+
+	/* remove the VSIE */
+	wl_cfg80211_ibss_vsie_delete(dev);
+
+	return err;
+}
+
+#ifdef MFP
+static int wl_cfg80211_get_rsn_capa(bcm_tlv_t *wpa2ie, u8* capa)
+{
+	u16 suite_count;
+	wpa_suite_mcast_t *mcast;
+	wpa_suite_ucast_t *ucast;
+	u16 len;
+	wpa_suite_auth_key_mgmt_t *mgmt;
+
+	if (!wpa2ie)
+		return -1;
+
+	len = wpa2ie->len;
+	mcast = (wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+	if ((len -= WPA_SUITE_LEN) <= 0)
+		return BCME_BADLEN;
+	ucast = (wpa_suite_ucast_t *)&mcast[1];
+	suite_count = ltoh16_ua(&ucast->count);
+	if ((suite_count > NL80211_MAX_NR_CIPHER_SUITES) ||
+		(len -= (WPA_IE_SUITE_COUNT_LEN +
+		(WPA_SUITE_LEN * suite_count))) <= 0)
+		return BCME_BADLEN;
+
+	mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+	suite_count = ltoh16_ua(&mgmt->count);
+
+	if ((suite_count > NL80211_MAX_NR_CIPHER_SUITES) ||
+		(len -= (WPA_IE_SUITE_COUNT_LEN +
+		(WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+		capa[0] = *(u8 *)&mgmt->list[suite_count];
+		capa[1] = *((u8 *)&mgmt->list[suite_count] + 1);
+	} else
+		return BCME_BADLEN;
+
+	return 0;
+}
+#endif /* MFP */
+
+static s32
+wl_set_wpa_version(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wl_security *sec;
+	s32 val = 0;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
+		val = WPA_AUTH_PSK |
+#ifdef BCMCCX
+			WPA_AUTH_CCKM |
+#endif
+			WPA_AUTH_UNSPECIFIED;
+	else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
+		val = WPA2_AUTH_PSK|
+#ifdef BCMCCX
+			WPA2_AUTH_CCKM |
+#endif
+			WPA2_AUTH_UNSPECIFIED;
+	else
+		val = WPA_AUTH_DISABLED;
+
+	if (is_wps_conn(sme))
+		val = WPA_AUTH_DISABLED;
+
+#ifdef BCMWAPI_WPI
+	if (sme->crypto.wpa_versions & NL80211_WAPI_VERSION_1) {
+		WL_DBG((" * wl_set_wpa_version, set wpa_auth"
+			" to WPA_AUTH_WAPI 0x400"));
+		val = WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED;
+	}
+#endif
+	WL_DBG(("setting wpa_auth to 0x%0x\n", val));
+	err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+	if (unlikely(err)) {
+		WL_ERR(("set wpa_auth failed (%d)\n", err));
+		return err;
+	}
+	sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+	sec->wpa_versions = sme->crypto.wpa_versions;
+	return err;
+}
+
+#ifdef BCMWAPI_WPI
+static s32
+wl_set_set_wapi_ie(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	WL_DBG((" %s \n", __FUNCTION__));
+
+	if (sme->crypto.wpa_versions & NL80211_WAPI_VERSION_1) {
+		err = wldev_iovar_setbuf_bsscfg(dev, "wapiie", sme->ie, sme->ie_len,
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+		if (unlikely(err)) {
+			WL_ERR(("===> set_wapi_ie Error (%d)\n", err));
+			return err;
+		}
+	} else
+		WL_DBG((" * skip \n"));
+	return err;
+}
+#endif /* BCMWAPI_WPI */
+
+static s32
+wl_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wl_security *sec;
+	s32 val = 0;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	switch (sme->auth_type) {
+	case NL80211_AUTHTYPE_OPEN_SYSTEM:
+		val = WL_AUTH_OPEN_SYSTEM;
+		WL_DBG(("open system\n"));
+		break;
+	case NL80211_AUTHTYPE_SHARED_KEY:
+		val = WL_AUTH_SHARED_KEY;
+		WL_DBG(("shared key\n"));
+		break;
+	case NL80211_AUTHTYPE_AUTOMATIC:
+		val = WL_AUTH_OPEN_SHARED;
+		WL_DBG(("automatic\n"));
+		break;
+#ifdef BCMCCX
+	case NL80211_AUTHTYPE_NETWORK_EAP:
+		WL_DBG(("network eap\n"));
+		val = DOT11_LEAP_AUTH;
+		break;
+#endif
+	default:
+		val = 2;
+		WL_ERR(("invalid auth type (%d)\n", sme->auth_type));
+		break;
+	}
+
+	err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+	if (unlikely(err)) {
+		WL_ERR(("set auth failed (%d)\n", err));
+		return err;
+	}
+	sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+	sec->auth_type = sme->auth_type;
+	return err;
+}
+
+static s32
+wl_set_set_cipher(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wl_security *sec;
+	s32 pval = 0;
+	s32 gval = 0;
+	s32 err = 0;
+	s32 wsec_val = 0;
+#ifdef MFP
+	s32 mfp = 0;
+	bcm_tlv_t *wpa2_ie;
+	u8 rsn_cap[2];
+#endif /* MFP */
+
+#ifdef BCMWAPI_WPI
+	s32 val = 0;
+#endif
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	if (sme->crypto.n_ciphers_pairwise) {
+		switch (sme->crypto.ciphers_pairwise[0]) {
+		case WLAN_CIPHER_SUITE_WEP40:
+		case WLAN_CIPHER_SUITE_WEP104:
+			pval = WEP_ENABLED;
+			break;
+		case WLAN_CIPHER_SUITE_TKIP:
+			pval = TKIP_ENABLED;
+			break;
+		case WLAN_CIPHER_SUITE_CCMP:
+		case WLAN_CIPHER_SUITE_AES_CMAC:
+			pval = AES_ENABLED;
+			break;
+#ifdef BCMWAPI_WPI
+		case WLAN_CIPHER_SUITE_SMS4:
+			val = SMS4_ENABLED;
+			pval = SMS4_ENABLED;
+			break;
+#endif
+		default:
+			WL_ERR(("invalid cipher pairwise (%d)\n",
+				sme->crypto.ciphers_pairwise[0]));
+			return -EINVAL;
+		}
+	}
+#if defined(BCMSUP_4WAY_HANDSHAKE) && defined(WLAN_AKM_SUITE_FT_8021X)
+	/* Ensure in-dongle supplicant is turned on when FBT wants to do the 4-way
+	 * handshake.
+	 * Note that the FW feature flag only exists on kernels that support the
+	 * FT-EAP AKM suite.
+	 */
+	if (cfg->wdev->wiphy->features & NL80211_FEATURE_FW_4WAY_HANDSHAKE) {
+		if (pval == AES_ENABLED)
+			err = wldev_iovar_setint_bsscfg(dev, "sup_wpa", 1, bssidx);
+		else
+			err = wldev_iovar_setint_bsscfg(dev, "sup_wpa", 0, bssidx);
+
+		if (err) {
+			WL_ERR(("FBT: Error setting sup_wpa (%d)\n", err));
+			return err;
+		}
+	}
+#endif /* BCMSUP_4WAY_HANDSHAKE && WLAN_AKM_SUITE_FT_8021X */
+	if (sme->crypto.cipher_group) {
+		switch (sme->crypto.cipher_group) {
+		case WLAN_CIPHER_SUITE_WEP40:
+		case WLAN_CIPHER_SUITE_WEP104:
+			gval = WEP_ENABLED;
+			break;
+		case WLAN_CIPHER_SUITE_TKIP:
+			gval = TKIP_ENABLED;
+			break;
+		case WLAN_CIPHER_SUITE_CCMP:
+			gval = AES_ENABLED;
+			break;
+		case WLAN_CIPHER_SUITE_AES_CMAC:
+			gval = AES_ENABLED;
+			break;
+#ifdef BCMWAPI_WPI
+		case WLAN_CIPHER_SUITE_SMS4:
+			val = SMS4_ENABLED;
+			gval = SMS4_ENABLED;
+			break;
+#endif
+		default:
+			WL_ERR(("invalid cipher group (%d)\n",
+				sme->crypto.cipher_group));
+			return -EINVAL;
+		}
+	}
+
+	WL_DBG(("pval (%d) gval (%d)\n", pval, gval));
+
+	if (is_wps_conn(sme)) {
+		if (sme->privacy)
+			err = wldev_iovar_setint_bsscfg(dev, "wsec", 4, bssidx);
+		else
+			/* WPS-2.0 allows no security */
+			err = wldev_iovar_setint_bsscfg(dev, "wsec", 0, bssidx);
+	} else {
+#ifdef BCMWAPI_WPI
+		if (sme->crypto.cipher_group == WLAN_CIPHER_SUITE_SMS4) {
+			WL_DBG((" NO, is_wps_conn, WAPI set to SMS4_ENABLED"));
+			err = wldev_iovar_setint_bsscfg(dev, "wsec", val, bssidx);
+		} else {
+#endif
+			WL_DBG((" NO, is_wps_conn, Set pval | gval to WSEC"));
+			wsec_val = pval | gval;
+
+#ifdef MFP
+			if (pval == AES_ENABLED) {
+				if (((wpa2_ie = bcm_parse_tlvs((u8 *)sme->ie, sme->ie_len,
+					DOT11_MNG_RSN_ID)) != NULL) &&
+					(wl_cfg80211_get_rsn_capa(wpa2_ie, rsn_cap) == 0)) {
+
+					if (rsn_cap[0] & RSN_CAP_MFPC) {
+						/* MFP Capability advertised by supplicant. Check
+						 * whether MFP is supported in the firmware
+						 */
+						if ((err = wldev_iovar_getint_bsscfg(dev,
+								"mfp", &mfp, bssidx)) < 0) {
+							WL_ERR(("Get MFP failed! "
+								"Check MFP support in FW \n"));
+							return -1;
+						}
+
+						if ((sme->crypto.n_akm_suites == 1) &&
+							((sme->crypto.akm_suites[0] ==
+							WL_AKM_SUITE_MFP_PSK) ||
+							(sme->crypto.akm_suites[0] ==
+							WL_AKM_SUITE_MFP_1X))) {
+							wsec_val |= MFP_SHA256;
+						} else if (sme->crypto.n_akm_suites > 1) {
+							WL_ERR(("Multiple AKM Specified \n"));
+							return -EINVAL;
+						}
+
+						wsec_val |= MFP_CAPABLE;
+						if (rsn_cap[0] & RSN_CAP_MFPR)
+							wsec_val |= MFP_REQUIRED;
+
+						if (rsn_cap[0] & RSN_CAP_MFPR)
+							mfp = WL_MFP_REQUIRED;
+						else
+							mfp = WL_MFP_CAPABLE;
+						err = wldev_iovar_setint_bsscfg(dev, "mfp",
+							mfp, bssidx);
+					}
+				}
+			}
+#endif /* MFP */
+			WL_DBG((" Set WSEC to fW 0x%x \n", wsec_val));
+			err = wldev_iovar_setint_bsscfg(dev, "wsec",
+				wsec_val, bssidx);
+#ifdef BCMWAPI_WPI
+		}
+#endif
+	}
+	if (unlikely(err)) {
+		WL_ERR(("error (%d)\n", err));
+		return err;
+	}
+
+	sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+	sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
+	sec->cipher_group = sme->crypto.cipher_group;
+
+	return err;
+}
+
+static s32
+wl_set_key_mgmt(struct net_device *dev, struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wl_security *sec;
+	s32 val = 0;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	if (sme->crypto.n_akm_suites) {
+		err = wldev_iovar_getint(dev, "wpa_auth", &val);
+		if (unlikely(err)) {
+			WL_ERR(("could not get wpa_auth (%d)\n", err));
+			return err;
+		}
+		if (val & (WPA_AUTH_PSK |
+#ifdef BCMCCX
+			WPA_AUTH_CCKM |
+#endif
+			WPA_AUTH_UNSPECIFIED)) {
+			switch (sme->crypto.akm_suites[0]) {
+			case WLAN_AKM_SUITE_8021X:
+				val = WPA_AUTH_UNSPECIFIED;
+				break;
+			case WLAN_AKM_SUITE_PSK:
+				val = WPA_AUTH_PSK;
+				break;
+#ifdef BCMCCX
+			case WLAN_AKM_SUITE_CCKM:
+				val = WPA_AUTH_CCKM;
+				break;
+#endif
+			default:
+				WL_ERR(("invalid cipher group (%d)\n",
+					sme->crypto.cipher_group));
+				return -EINVAL;
+			}
+		} else if (val & (WPA2_AUTH_PSK |
+#ifdef BCMCCX
+			WPA2_AUTH_CCKM |
+#endif
+			WPA2_AUTH_UNSPECIFIED)) {
+			switch (sme->crypto.akm_suites[0]) {
+			case WLAN_AKM_SUITE_8021X:
+				val = WPA2_AUTH_UNSPECIFIED;
+				break;
+#ifdef MFP
+			case WL_AKM_SUITE_MFP_1X:
+				val = WPA2_AUTH_UNSPECIFIED;
+				break;
+			case WL_AKM_SUITE_MFP_PSK:
+				val = WPA2_AUTH_PSK;
+				break;
+#endif
+			case WLAN_AKM_SUITE_PSK:
+				val = WPA2_AUTH_PSK;
+				break;
+#if defined(WLFBT) && defined(WLAN_AKM_SUITE_FT_8021X)
+			case WLAN_AKM_SUITE_FT_8021X:
+				val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
+				break;
+#endif
+#if defined(WLFBT) && defined(WLAN_AKM_SUITE_FT_PSK)
+			case WLAN_AKM_SUITE_FT_PSK:
+				val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
+				break;
+#endif
+#ifdef BCMCCX
+			case WLAN_AKM_SUITE_CCKM:
+				val = WPA2_AUTH_CCKM;
+				break;
+#endif
+			default:
+				WL_ERR(("invalid cipher group (%d)\n",
+					sme->crypto.cipher_group));
+				return -EINVAL;
+			}
+		}
+#ifdef BCMWAPI_WPI
+		else if (val & (WAPI_AUTH_PSK | WAPI_AUTH_UNSPECIFIED)) {
+			switch (sme->crypto.akm_suites[0]) {
+			case WLAN_AKM_SUITE_WAPI_CERT:
+				val = WAPI_AUTH_UNSPECIFIED;
+				break;
+			case WLAN_AKM_SUITE_WAPI_PSK:
+				val = WAPI_AUTH_PSK;
+				break;
+			default:
+				WL_ERR(("invalid cipher group (%d)\n",
+					sme->crypto.cipher_group));
+				return -EINVAL;
+			}
+		}
+#endif
+		WL_DBG(("setting wpa_auth to %d\n", val));
+
+		err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", val, bssidx);
+		if (unlikely(err)) {
+			WL_ERR(("could not set wpa_auth (%d)\n", err));
+			return err;
+		}
+	}
+	sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+	sec->wpa_auth = sme->crypto.akm_suites[0];
+
+	return err;
+}
+
+static s32
+wl_set_set_sharedkey(struct net_device *dev,
+	struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wl_security *sec;
+	struct wl_wsec_key key;
+	s32 val;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	WL_DBG(("key len (%d)\n", sme->key_len));
+	if (sme->key_len) {
+		sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+		WL_DBG(("wpa_versions 0x%x cipher_pairwise 0x%x\n",
+			sec->wpa_versions, sec->cipher_pairwise));
+		if (!(sec->wpa_versions & (NL80211_WPA_VERSION_1 |
+#ifdef BCMWAPI_WPI
+			NL80211_WPA_VERSION_2 | NL80211_WAPI_VERSION_1)) &&
+#else
+			NL80211_WPA_VERSION_2)) &&
+#endif
+			(sec->cipher_pairwise & (WLAN_CIPHER_SUITE_WEP40 |
+#ifdef BCMWAPI_WPI
+		WLAN_CIPHER_SUITE_WEP104 | WLAN_CIPHER_SUITE_SMS4)))
+#else
+		WLAN_CIPHER_SUITE_WEP104)))
+#endif
+		{
+			memset(&key, 0, sizeof(key));
+			key.len = (u32) sme->key_len;
+			key.index = (u32) sme->key_idx;
+			if (unlikely(key.len > sizeof(key.data))) {
+				WL_ERR(("Too long key length (%u)\n", key.len));
+				return -EINVAL;
+			}
+			memcpy(key.data, sme->key, key.len);
+			key.flags = WL_PRIMARY_KEY;
+			switch (sec->cipher_pairwise) {
+			case WLAN_CIPHER_SUITE_WEP40:
+				key.algo = CRYPTO_ALGO_WEP1;
+				break;
+			case WLAN_CIPHER_SUITE_WEP104:
+				key.algo = CRYPTO_ALGO_WEP128;
+				break;
+#ifdef BCMWAPI_WPI
+			case WLAN_CIPHER_SUITE_SMS4:
+				key.algo = CRYPTO_ALGO_SMS4;
+				break;
+#endif
+			default:
+				WL_ERR(("Invalid algorithm (%d)\n",
+					sme->crypto.ciphers_pairwise[0]));
+				return -EINVAL;
+			}
+			/* Set the new key/index */
+			WL_DBG(("key length (%d) key index (%d) algo (%d)\n",
+				key.len, key.index, key.algo));
+			WL_DBG(("key \"%s\"\n", key.data));
+			swap_key_from_BE(&key);
+			err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+				cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+			if (unlikely(err)) {
+				WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+				return err;
+			}
+			if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
+				WL_DBG(("set auth_type to shared key\n"));
+				val = WL_AUTH_SHARED_KEY;	/* shared key */
+				err = wldev_iovar_setint_bsscfg(dev, "auth", val, bssidx);
+				if (unlikely(err)) {
+					WL_ERR(("set auth failed (%d)\n", err));
+					return err;
+				}
+			}
+		}
+	}
+	return err;
+}
+
+#if defined(ESCAN_RESULT_PATCH)
+static u8 connect_req_bssid[6];
+static u8 broad_bssid[6];
+#endif /* ESCAN_RESULT_PATCH */
+
+
+
+#if defined(CUSTOM_SET_CPUCORE) || defined(CONFIG_TCPACK_FASTTX)
+static bool wl_get_chan_isvht80(struct net_device *net, dhd_pub_t *dhd)
+{
+	u32 chanspec = 0;
+	bool isvht80 = 0;
+
+	if (wldev_iovar_getint(net, "chanspec", (s32 *)&chanspec) == BCME_OK)
+		chanspec = wl_chspec_driver_to_host(chanspec);
+
+	isvht80 = chanspec & WL_CHANSPEC_BW_80;
+	WL_INFO(("%s: chanspec(%x:%d)\n", __FUNCTION__, chanspec, isvht80));
+
+	return isvht80;
+}
+#endif /* CUSTOM_SET_CPUCORE || CONFIG_TCPACK_FASTTX */
+
+static s32
+wl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_connect_params *sme)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct ieee80211_channel *chan = sme->channel;
+	wl_extjoin_params_t *ext_join_params;
+	struct wl_join_params join_params;
+	size_t join_params_size;
+	s32 err = 0;
+	wpa_ie_fixed_t *wpa_ie;
+	bcm_tlv_t *wpa2_ie;
+	u8* wpaie  = 0;
+	u32 wpaie_len = 0;
+	u32 chan_cnt = 0;
+	struct ether_addr bssid;
+	s32 bssidx;
+	int ret;
+	int wait_cnt;
+
+	WL_DBG(("In\n"));
+
+	if (unlikely(!sme->ssid)) {
+		WL_ERR(("Invalid ssid\n"));
+		return -EOPNOTSUPP;
+	}
+
+	if (unlikely(sme->ssid_len > DOT11_MAX_SSID_LEN)) {
+		WL_ERR(("Invalid SSID info: SSID=%s, length=%zd\n",
+			sme->ssid, sme->ssid_len));
+		return -EINVAL;
+	}
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+
+	/*
+	 * Cancel ongoing scan to sync up with sme state machine of cfg80211.
+	 */
+#if (!defined(ESCAN_RESULT_PATCH) || defined(CUSTOMER_HW10))
+	if (cfg->scan_request) {
+		wl_notify_escan_complete(cfg, dev, true, true);
+	}
+#endif
+#ifdef WL_SCHED_SCAN
+	if (cfg->sched_scan_req) {
+		wl_cfg80211_sched_scan_stop(wiphy, bcmcfg_to_prmry_ndev(cfg));
+	}
+#endif
+#if defined(ESCAN_RESULT_PATCH)
+	if (sme->bssid)
+		memcpy(connect_req_bssid, sme->bssid, ETHER_ADDR_LEN);
+	else
+		bzero(connect_req_bssid, ETHER_ADDR_LEN);
+	bzero(broad_bssid, ETHER_ADDR_LEN);
+#endif
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+	maxrxpktglom = 0;
+#endif
+	bzero(&bssid, sizeof(bssid));
+	if (!wl_get_drv_status(cfg, CONNECTED, dev)&&
+		(ret = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false)) == 0) {
+		if (!ETHER_ISNULLADDR(&bssid)) {
+			scb_val_t scbval;
+			wl_set_drv_status(cfg, DISCONNECTING, dev);
+			scbval.val = DOT11_RC_DISASSOC_LEAVING;
+			memcpy(&scbval.ea, &bssid, ETHER_ADDR_LEN);
+			scbval.val = htod32(scbval.val);
+
+			WL_DBG(("drv status CONNECTED is not set, but connected in FW!" MACDBG "/n",
+				MAC2STRDBG(bssid.octet)));
+			err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+				sizeof(scb_val_t), true);
+			if (unlikely(err)) {
+				wl_clr_drv_status(cfg, DISCONNECTING, dev);
+				WL_ERR(("error (%d)\n", err));
+				return err;
+			}
+			wait_cnt = 500/10;
+			while (wl_get_drv_status(cfg, DISCONNECTING, dev) && wait_cnt) {
+				WL_DBG(("Waiting for disconnection terminated, wait_cnt: %d\n",
+					wait_cnt));
+				wait_cnt--;
+				OSL_SLEEP(10);
+			}
+		} else
+			WL_DBG(("Currently not associated!\n"));
+	} else {
+		/* if status is DISCONNECTING, wait for disconnection terminated max 500 ms */
+		wait_cnt = 500/10;
+		while (wl_get_drv_status(cfg, DISCONNECTING, dev) && wait_cnt) {
+			WL_DBG(("Waiting for disconnection terminated, wait_cnt: %d\n", wait_cnt));
+			wait_cnt--;
+			OSL_SLEEP(10);
+		}
+	}
+
+	/* Clean BSSID */
+	bzero(&bssid, sizeof(bssid));
+	if (!wl_get_drv_status(cfg, DISCONNECTING, dev))
+		wl_update_prof(cfg, dev, NULL, (void *)&bssid, WL_PROF_BSSID);
+
+	if (p2p_is_on(cfg) && (dev != bcmcfg_to_prmry_ndev(cfg))) {
+		/* we only allow to connect using virtual interface in case of P2P */
+			if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+				WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+				return BCME_ERROR;
+			}
+			wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+				VNDR_IE_ASSOCREQ_FLAG, sme->ie, sme->ie_len);
+	} else if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		/* find the RSN_IE */
+		if ((wpa2_ie = bcm_parse_tlvs((u8 *)sme->ie, sme->ie_len,
+			DOT11_MNG_RSN_ID)) != NULL) {
+			WL_DBG((" WPA2 IE is found\n"));
+		}
+		/* find the WPA_IE */
+		if ((wpa_ie = wl_cfgp2p_find_wpaie((u8 *)sme->ie,
+			sme->ie_len)) != NULL) {
+			WL_DBG((" WPA IE is found\n"));
+		}
+		if (wpa_ie != NULL || wpa2_ie != NULL) {
+			wpaie = (wpa_ie != NULL) ? (u8 *)wpa_ie : (u8 *)wpa2_ie;
+			wpaie_len = (wpa_ie != NULL) ? wpa_ie->length : wpa2_ie->len;
+			wpaie_len += WPA_RSN_IE_TAG_FIXED_LEN;
+			err = wldev_iovar_setbuf(dev, "wpaie", wpaie, wpaie_len,
+				cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+			if (unlikely(err)) {
+				WL_ERR(("wpaie set error (%d)\n", err));
+				return err;
+			}
+		} else {
+			err = wldev_iovar_setbuf(dev, "wpaie", NULL, 0,
+				cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+			if (unlikely(err)) {
+				WL_ERR(("wpaie set error (%d)\n", err));
+				return err;
+			}
+		}
+
+		if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+			WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+			return BCME_ERROR;
+		}
+		err = wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+			VNDR_IE_ASSOCREQ_FLAG, (u8 *)sme->ie, sme->ie_len);
+		if (unlikely(err)) {
+			return err;
+		}
+	}
+	if (chan) {
+		cfg->channel = ieee80211_frequency_to_channel(chan->center_freq);
+		chan_cnt = 1;
+		WL_DBG(("channel (%d), center_req (%d), %d channels\n", cfg->channel,
+			chan->center_freq, chan_cnt));
+	} else
+		cfg->channel = 0;
+#ifdef BCMWAPI_WPI
+	WL_DBG(("1. enable wapi auth\n"));
+	if (sme->crypto.wpa_versions & NL80211_WAPI_VERSION_1) {
+		WL_DBG(("2. set wapi ie  \n"));
+		err = wl_set_set_wapi_ie(dev, sme);
+		if (unlikely(err))
+			return err;
+	} else
+		WL_DBG(("2. Not wapi ie  \n"));
+#endif
+	WL_DBG(("ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len));
+	WL_DBG(("3. set wapi version \n"));
+	err = wl_set_wpa_version(dev, sme);
+	if (unlikely(err)) {
+		WL_ERR(("Invalid wpa_version\n"));
+		return err;
+	}
+#ifdef BCMWAPI_WPI
+	if (sme->crypto.wpa_versions & NL80211_WAPI_VERSION_1)
+		WL_DBG(("4. WAPI Dont Set wl_set_auth_type\n"));
+	else {
+		WL_DBG(("4. wl_set_auth_type\n"));
+#endif
+		err = wl_set_auth_type(dev, sme);
+		if (unlikely(err)) {
+			WL_ERR(("Invalid auth type\n"));
+			return err;
+		}
+#ifdef BCMWAPI_WPI
+	}
+#endif
+
+	err = wl_set_set_cipher(dev, sme);
+	if (unlikely(err)) {
+		WL_ERR(("Invalid ciper\n"));
+		return err;
+	}
+
+	err = wl_set_key_mgmt(dev, sme);
+	if (unlikely(err)) {
+		WL_ERR(("Invalid key mgmt\n"));
+		return err;
+	}
+
+	err = wl_set_set_sharedkey(dev, sme);
+	if (unlikely(err)) {
+		WL_ERR(("Invalid shared key\n"));
+		return err;
+	}
+
+	/*
+	 *  Join with specific BSSID and cached SSID
+	 *  If SSID is zero join based on BSSID only
+	 */
+	join_params_size = WL_EXTJOIN_PARAMS_FIXED_SIZE +
+		chan_cnt * sizeof(chanspec_t);
+	ext_join_params =  (wl_extjoin_params_t*)kzalloc(join_params_size, GFP_KERNEL);
+	if (ext_join_params == NULL) {
+		err = -ENOMEM;
+		wl_clr_drv_status(cfg, CONNECTING, dev);
+		goto exit;
+	}
+	ext_join_params->ssid.SSID_len = min(sizeof(ext_join_params->ssid.SSID), sme->ssid_len);
+	memcpy(&ext_join_params->ssid.SSID, sme->ssid, ext_join_params->ssid.SSID_len);
+	wl_update_prof(cfg, dev, NULL, &ext_join_params->ssid, WL_PROF_SSID);
+	ext_join_params->ssid.SSID_len = htod32(ext_join_params->ssid.SSID_len);
+	/* increate dwell time to receive probe response or detect Beacon
+	* from target AP at a noisy air only during connect command
+	*/
+	ext_join_params->scan.active_time = chan_cnt ? WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS : -1;
+	ext_join_params->scan.passive_time = chan_cnt ? WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS : -1;
+	/* Set up join scan parameters */
+	ext_join_params->scan.scan_type = -1;
+	ext_join_params->scan.nprobes = chan_cnt ?
+		(ext_join_params->scan.active_time/WL_SCAN_JOIN_PROBE_INTERVAL_MS) : -1;
+	ext_join_params->scan.home_time = -1;
+
+	if (sme->bssid)
+		memcpy(&ext_join_params->assoc.bssid, sme->bssid, ETH_ALEN);
+	else
+		memcpy(&ext_join_params->assoc.bssid, &ether_bcast, ETH_ALEN);
+	ext_join_params->assoc.chanspec_num = chan_cnt;
+	if (chan_cnt) {
+		u16 channel, band, bw, ctl_sb;
+		chanspec_t chspec;
+		channel = cfg->channel;
+		band = (channel <= CH_MAX_2G_CHANNEL) ? WL_CHANSPEC_BAND_2G
+			: WL_CHANSPEC_BAND_5G;
+		bw = WL_CHANSPEC_BW_20;
+		ctl_sb = WL_CHANSPEC_CTL_SB_NONE;
+		chspec = (channel | band | bw | ctl_sb);
+		ext_join_params->assoc.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+		ext_join_params->assoc.chanspec_list[0] |= chspec;
+		ext_join_params->assoc.chanspec_list[0] =
+			wl_chspec_host_to_driver(ext_join_params->assoc.chanspec_list[0]);
+	}
+	ext_join_params->assoc.chanspec_num = htod32(ext_join_params->assoc.chanspec_num);
+	if (ext_join_params->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+		WL_INFORM(("ssid \"%s\", len (%d)\n", ext_join_params->ssid.SSID,
+			ext_join_params->ssid.SSID_len));
+	}
+	wl_set_drv_status(cfg, CONNECTING, dev);
+
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		kfree(ext_join_params);
+		return BCME_ERROR;
+	}
+	err = wldev_iovar_setbuf_bsscfg(dev, "join", ext_join_params, join_params_size,
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+	printf("Connectting with " MACDBG " channel (%d) ssid \"%s\", len (%d)\n\n",
+		MAC2STRDBG((u8*)(&ext_join_params->assoc.bssid)), cfg->channel,
+		ext_join_params->ssid.SSID, ext_join_params->ssid.SSID_len);
+
+	kfree(ext_join_params);
+	if (err) {
+		wl_clr_drv_status(cfg, CONNECTING, dev);
+		if (err == BCME_UNSUPPORTED) {
+			WL_DBG(("join iovar is not supported\n"));
+			goto set_ssid;
+		} else {
+			WL_ERR(("error (%d)\n", err));
+			goto exit;
+		}
+	} else
+		goto exit;
+
+set_ssid:
+	memset(&join_params, 0, sizeof(join_params));
+	join_params_size = sizeof(join_params.ssid);
+
+	join_params.ssid.SSID_len = min(sizeof(join_params.ssid.SSID), sme->ssid_len);
+	memcpy(&join_params.ssid.SSID, sme->ssid, join_params.ssid.SSID_len);
+	join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len);
+	wl_update_prof(cfg, dev, NULL, &join_params.ssid, WL_PROF_SSID);
+	if (sme->bssid)
+		memcpy(&join_params.params.bssid, sme->bssid, ETH_ALEN);
+	else
+		memcpy(&join_params.params.bssid, &ether_bcast, ETH_ALEN);
+
+	wl_ch_to_chanspec(cfg->channel, &join_params, &join_params_size);
+	WL_DBG(("join_param_size %zu\n", join_params_size));
+
+	if (join_params.ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+		WL_INFORM(("ssid \"%s\", len (%d)\n", join_params.ssid.SSID,
+			join_params.ssid.SSID_len));
+	}
+	wl_set_drv_status(cfg, CONNECTING, dev);
+	err = wldev_ioctl(dev, WLC_SET_SSID, &join_params, join_params_size, true);
+	if (err) {
+		WL_ERR(("error (%d)\n", err));
+		wl_clr_drv_status(cfg, CONNECTING, dev);
+	}
+exit:
+	return err;
+}
+
+static s32
+wl_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
+	u16 reason_code)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	scb_val_t scbval;
+	bool act = false;
+	s32 err = 0;
+	u8 *curbssid;
+#ifdef CUSTOM_SET_CPUCORE
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_CPUCORE */
+	WL_ERR(("Reason %d\n", reason_code));
+	RETURN_EIO_IF_NOT_UP(cfg);
+	act = *(bool *) wl_read_prof(cfg, dev, WL_PROF_ACT);
+	curbssid = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+#ifdef ESCAN_RESULT_PATCH
+	if (wl_get_drv_status(cfg, CONNECTING, dev) && curbssid &&
+		(memcmp(curbssid, connect_req_bssid, ETHER_ADDR_LEN) == 0)) {
+		WL_ERR(("Disconnecting from connecting device: " MACDBG "\n",
+			MAC2STRDBG(curbssid)));
+		act = true;
+	}
+#endif /* ESCAN_RESULT_PATCH */
+	if (act) {
+		/*
+		* Cancel ongoing scan to sync up with sme state machine of cfg80211.
+		*/
+#if (!defined(ESCAN_RESULT_PATCH) || defined(CUSTOMER_HW10))
+		/* Let scan aborted by F/W */
+		if (cfg->scan_request) {
+			wl_notify_escan_complete(cfg, dev, true, true);
+		}
+#endif /* ESCAN_RESULT_PATCH */
+		wl_set_drv_status(cfg, DISCONNECTING, dev);
+		scbval.val = reason_code;
+		memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+		scbval.val = htod32(scbval.val);
+		err = wldev_ioctl(dev, WLC_DISASSOC, &scbval,
+			sizeof(scb_val_t), true);
+		if (unlikely(err)) {
+			wl_clr_drv_status(cfg, DISCONNECTING, dev);
+			WL_ERR(("error (%d)\n", err));
+			return err;
+		}
+		cfg80211_disconnected(dev, reason_code, NULL, 0, true, GFP_KERNEL);
+	}
+#ifdef CUSTOM_SET_CPUCORE
+	/* set default cpucore */
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		dhd->chan_isvht80 &= ~DHD_FLAG_STA_MODE;
+		if (!(dhd->chan_isvht80))
+			dhd_set_cpucore(dhd, FALSE);
+	}
+#endif /* CUSTOM_SET_CPUCORE */
+
+	return err;
+}
+
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+	enum nl80211_tx_power_setting type, s32 mbm)
+#else
+wl_cfg80211_set_tx_power(struct wiphy *wiphy,
+	enum nl80211_tx_power_setting type, s32 dbm)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	s32 err = 0;
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	s32 dbm = MBM_TO_DBM(mbm);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || \
+	defined(WL_COMPAT_WIRELESS) || defined(WL_SUPPORT_BACKPORTED_KPATCHES)
+	dbm = MBM_TO_DBM(dbm);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	switch (type) {
+	case NL80211_TX_POWER_AUTOMATIC:
+		break;
+	case NL80211_TX_POWER_LIMITED:
+		if (dbm < 0) {
+			WL_ERR(("TX_POWER_LIMITTED - dbm is negative\n"));
+			return -EINVAL;
+		}
+		break;
+	case NL80211_TX_POWER_FIXED:
+		if (dbm < 0) {
+			WL_ERR(("TX_POWER_FIXED - dbm is negative..\n"));
+			return -EINVAL;
+		}
+		break;
+	}
+
+	err = wl_set_tx_power(ndev, type, dbm);
+	if (unlikely(err)) {
+		WL_ERR(("error (%d)\n", err));
+		return err;
+	}
+
+	cfg->conf->tx_power = dbm;
+
+	return err;
+}
+
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_get_tx_power(struct wiphy *wiphy,
+	struct wireless_dev *wdev, s32 *dbm)
+#else
+wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	s32 err = 0;
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	err = wl_get_tx_power(ndev, dbm);
+	if (unlikely(err))
+		WL_ERR(("error (%d)\n", err));
+
+	return err;
+}
+
+static s32
+wl_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool unicast, bool multicast)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	u32 index;
+	s32 wsec;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	WL_DBG(("key index (%d)\n", key_idx));
+	RETURN_EIO_IF_NOT_UP(cfg);
+	err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+		return err;
+	}
+	if (wsec == WEP_ENABLED) {
+		/* Just select a new current key */
+		index = (u32) key_idx;
+		index = htod32(index);
+		err = wldev_ioctl(dev, WLC_SET_KEY_PRIMARY, &index,
+			sizeof(index), true);
+		if (unlikely(err)) {
+			WL_ERR(("error (%d)\n", err));
+		}
+	}
+	return err;
+}
+
+static s32
+wl_add_keyext(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, const u8 *mac_addr, struct key_params *params)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct wl_wsec_key key;
+	s32 err = 0;
+	s32 bssidx;
+	s32 mode = wl_get_mode_by_netdev(cfg, dev);
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	memset(&key, 0, sizeof(key));
+	key.index = (u32) key_idx;
+
+	if (!ETHER_ISMULTI(mac_addr))
+		memcpy((char *)&key.ea, (void *)mac_addr, ETHER_ADDR_LEN);
+	key.len = (u32) params->key_len;
+
+	/* check for key index change */
+	if (key.len == 0) {
+		/* key delete */
+		swap_key_from_BE(&key);
+		err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+		if (unlikely(err)) {
+			WL_ERR(("key delete error (%d)\n", err));
+			return err;
+		}
+	} else {
+		if (key.len > sizeof(key.data)) {
+			WL_ERR(("Invalid key length (%d)\n", key.len));
+			return -EINVAL;
+		}
+		WL_DBG(("Setting the key index %d\n", key.index));
+		memcpy(key.data, params->key, key.len);
+
+		if ((mode == WL_MODE_BSS) &&
+			(params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
+			u8 keybuf[8];
+			memcpy(keybuf, &key.data[24], sizeof(keybuf));
+			memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+			memcpy(&key.data[16], keybuf, sizeof(keybuf));
+		}
+
+		/* if IW_ENCODE_EXT_RX_SEQ_VALID set */
+		if (params->seq && params->seq_len == 6) {
+			/* rx iv */
+			u8 *ivptr;
+			ivptr = (u8 *) params->seq;
+			key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+				(ivptr[3] << 8) | ivptr[2];
+			key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+			key.iv_initialized = true;
+		}
+
+		switch (params->cipher) {
+		case WLAN_CIPHER_SUITE_WEP40:
+			key.algo = CRYPTO_ALGO_WEP1;
+			WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+			break;
+		case WLAN_CIPHER_SUITE_WEP104:
+			key.algo = CRYPTO_ALGO_WEP128;
+			WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+			break;
+		case WLAN_CIPHER_SUITE_TKIP:
+			key.algo = CRYPTO_ALGO_TKIP;
+			WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+			break;
+		case WLAN_CIPHER_SUITE_AES_CMAC:
+			key.algo = CRYPTO_ALGO_AES_CCM;
+			WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+			break;
+		case WLAN_CIPHER_SUITE_CCMP:
+			key.algo = CRYPTO_ALGO_AES_CCM;
+			WL_DBG(("WLAN_CIPHER_SUITE_CCMP\n"));
+			break;
+#ifdef BCMWAPI_WPI
+		case WLAN_CIPHER_SUITE_SMS4:
+			key.algo = CRYPTO_ALGO_SMS4;
+			WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+			break;
+#endif
+		default:
+			WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+			return -EINVAL;
+		}
+		swap_key_from_BE(&key);
+		/* need to guarantee EAPOL 4/4 send out before set key */
+		dhd_wait_pend8021x(dev);
+		err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key),
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+		if (unlikely(err)) {
+			WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+			return err;
+		}
+	}
+	return err;
+}
+
+int
+wl_cfg80211_enable_roam_offload(struct net_device *dev, int enable)
+{
+	int err;
+	wl_eventmsg_buf_t ev_buf;
+
+	if (dev != bcmcfg_to_prmry_ndev(g_bcm_cfg)) {
+		/* roam offload is only for the primary device */
+		return -1;
+	}
+	err = wldev_iovar_setint(dev, "roam_offload", enable);
+	if (err)
+		return err;
+
+	bzero(&ev_buf, sizeof(wl_eventmsg_buf_t));
+	wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_PSK_SUP, !enable);
+	wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_REQ_IE, !enable);
+	wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ASSOC_RESP_IE, !enable);
+	wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_REASSOC, !enable);
+	wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_JOIN, !enable);
+	wl_cfg80211_add_to_eventbuffer(&ev_buf, WLC_E_ROAM, !enable);
+	err = wl_cfg80211_apply_eventbuffer(dev, g_bcm_cfg, &ev_buf);
+	if (!err) {
+		g_bcm_cfg->roam_offload = enable;
+	}
+	return err;
+}
+
+static s32
+wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool pairwise, const u8 *mac_addr,
+	struct key_params *params)
+{
+	struct wl_wsec_key key;
+	s32 val = 0;
+	s32 wsec = 0;
+	s32 err = 0;
+	u8 keybuf[8];
+	s32 bssidx = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 mode = wl_get_mode_by_netdev(cfg, dev);
+	WL_DBG(("key index (%d)\n", key_idx));
+	RETURN_EIO_IF_NOT_UP(cfg);
+
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+
+	if (mac_addr &&
+		((params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
+		(params->cipher != WLAN_CIPHER_SUITE_WEP104))) {
+			wl_add_keyext(wiphy, dev, key_idx, mac_addr, params);
+			goto exit;
+	}
+	memset(&key, 0, sizeof(key));
+
+	key.len = (u32) params->key_len;
+	key.index = (u32) key_idx;
+
+	if (unlikely(key.len > sizeof(key.data))) {
+		WL_ERR(("Too long key length (%u)\n", key.len));
+		return -EINVAL;
+	}
+	memcpy(key.data, params->key, key.len);
+
+	key.flags = WL_PRIMARY_KEY;
+	switch (params->cipher) {
+	case WLAN_CIPHER_SUITE_WEP40:
+		key.algo = CRYPTO_ALGO_WEP1;
+		val = WEP_ENABLED;
+		WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+		break;
+	case WLAN_CIPHER_SUITE_WEP104:
+		key.algo = CRYPTO_ALGO_WEP128;
+		val = WEP_ENABLED;
+		WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+		break;
+	case WLAN_CIPHER_SUITE_TKIP:
+		key.algo = CRYPTO_ALGO_TKIP;
+		val = TKIP_ENABLED;
+		/* wpa_supplicant switches the third and fourth quarters of the TKIP key */
+		if (mode == WL_MODE_BSS) {
+			bcopy(&key.data[24], keybuf, sizeof(keybuf));
+			bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+			bcopy(keybuf, &key.data[16], sizeof(keybuf));
+		}
+		WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+		break;
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+		key.algo = CRYPTO_ALGO_AES_CCM;
+		val = AES_ENABLED;
+		WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+		break;
+	case WLAN_CIPHER_SUITE_CCMP:
+		key.algo = CRYPTO_ALGO_AES_CCM;
+		val = AES_ENABLED;
+		WL_DBG(("WLAN_CIPHER_SUITE_CCMP\n"));
+		break;
+#ifdef BCMWAPI_WPI
+	case WLAN_CIPHER_SUITE_SMS4:
+		key.algo = CRYPTO_ALGO_SMS4;
+		WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+		val = SMS4_ENABLED;
+		break;
+#endif /* BCMWAPI_WPI */
+#if defined(WLFBT) && defined(WLAN_CIPHER_SUITE_PMK)
+	case WLAN_CIPHER_SUITE_PMK: {
+		int j;
+		wsec_pmk_t pmk;
+		char keystring[WSEC_MAX_PSK_LEN + 1];
+		char* charptr = keystring;
+		uint len;
+		struct wl_security *sec;
+
+		sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+		if (sec->wpa_auth == WLAN_AKM_SUITE_8021X) {
+			err = wldev_iovar_setbuf(dev, "okc_info_pmk", params->key,
+				WSEC_MAX_PSK_LEN / 2, keystring, sizeof(keystring), NULL);
+			if (err) {
+				/* could fail in case that 'okc' is not supported */
+				WL_INFORM(("Setting 'okc_info_pmk' failed, err=%d\n", err));
+			}
+		}
+		/* copy the raw hex key to the appropriate format */
+		for (j = 0; j < (WSEC_MAX_PSK_LEN / 2); j++) {
+			sprintf(charptr, "%02x", params->key[j]);
+			charptr += 2;
+		}
+		len = strlen(keystring);
+		pmk.key_len = htod16(len);
+		bcopy(keystring, pmk.key, len);
+		pmk.flags = htod16(WSEC_PASSPHRASE);
+
+		err = wldev_ioctl(dev, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk), true);
+		if (err)
+			return err;
+	} break;
+#endif /* WLFBT && WLAN_CIPHER_SUITE_PMK */
+	default:
+		WL_ERR(("Invalid cipher (0x%x)\n", params->cipher));
+		return -EINVAL;
+	}
+
+	/* Set the new key/index */
+	if ((mode == WL_MODE_IBSS) && (val & (TKIP_ENABLED | AES_ENABLED))) {
+		WL_ERR(("IBSS KEY setted\n"));
+		wldev_iovar_setint(dev, "wpa_auth", WPA_AUTH_NONE);
+	}
+	swap_key_from_BE(&key);
+	err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), cfg->ioctl_buf,
+		WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+		return err;
+	}
+
+exit:
+	err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+	if (unlikely(err)) {
+		WL_ERR(("get wsec error (%d)\n", err));
+		return err;
+	}
+
+	wsec |= val;
+	err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+	if (unlikely(err)) {
+		WL_ERR(("set wsec error (%d)\n", err));
+		return err;
+	}
+
+	return err;
+}
+
+static s32
+wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool pairwise, const u8 *mac_addr)
+{
+	struct wl_wsec_key key;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	WL_DBG(("Enter\n"));
+
+#ifndef IEEE80211W
+	if ((key_idx >= DOT11_MAX_DEFAULT_KEYS) && (key_idx < DOT11_MAX_DEFAULT_KEYS+2))
+		return -EINVAL;
+#endif
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	memset(&key, 0, sizeof(key));
+
+	key.flags = WL_PRIMARY_KEY;
+	key.algo = CRYPTO_ALGO_OFF;
+	key.index = (u32) key_idx;
+
+	WL_DBG(("key index (%d)\n", key_idx));
+	/* Set the new key/index */
+	swap_key_from_BE(&key);
+	err = wldev_iovar_setbuf_bsscfg(dev, "wsec_key", &key, sizeof(key), cfg->ioctl_buf,
+		WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+	if (unlikely(err)) {
+		if (err == -EINVAL) {
+			if (key.index >= DOT11_MAX_DEFAULT_KEYS) {
+				/* we ignore this key index in this case */
+				WL_DBG(("invalid key index (%d)\n", key_idx));
+			}
+		} else {
+			WL_ERR(("WLC_SET_KEY error (%d)\n", err));
+		}
+		return err;
+	}
+	return err;
+}
+
+static s32
+wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+	u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+	void (*callback) (void *cookie, struct key_params * params))
+{
+	struct key_params params;
+	struct wl_wsec_key key;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct wl_security *sec;
+	s32 wsec;
+	s32 err = 0;
+	s32 bssidx;
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	WL_DBG(("key index (%d)\n", key_idx));
+	RETURN_EIO_IF_NOT_UP(cfg);
+	memset(&key, 0, sizeof(key));
+	key.index = key_idx;
+	swap_key_to_BE(&key);
+	memset(&params, 0, sizeof(params));
+	params.key_len = (u8) min_t(u8, DOT11_MAX_KEY_SIZE, key.len);
+	memcpy((void *)params.key, key.data, params.key_len);
+
+	err = wldev_iovar_getint_bsscfg(dev, "wsec", &wsec, bssidx);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_GET_WSEC error (%d)\n", err));
+		return err;
+	}
+	switch (WSEC_ENABLED(wsec)) {
+		case WEP_ENABLED:
+			sec = wl_read_prof(cfg, dev, WL_PROF_SEC);
+			if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
+				params.cipher = WLAN_CIPHER_SUITE_WEP40;
+				WL_DBG(("WLAN_CIPHER_SUITE_WEP40\n"));
+			} else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
+				params.cipher = WLAN_CIPHER_SUITE_WEP104;
+				WL_DBG(("WLAN_CIPHER_SUITE_WEP104\n"));
+			}
+			break;
+		case TKIP_ENABLED:
+			params.cipher = WLAN_CIPHER_SUITE_TKIP;
+			WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+			break;
+		case AES_ENABLED:
+			params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+			WL_DBG(("WLAN_CIPHER_SUITE_AES_CMAC\n"));
+			break;
+#ifdef BCMWAPI_WPI
+		case WLAN_CIPHER_SUITE_SMS4:
+			key.algo = CRYPTO_ALGO_SMS4;
+			WL_DBG(("WLAN_CIPHER_SUITE_SMS4\n"));
+			break;
+#endif
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+		/* to connect to mixed mode AP */
+		case (AES_ENABLED | TKIP_ENABLED): /* TKIP CCMP */
+			params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+			WL_DBG(("WLAN_CIPHER_SUITE_TKIP\n"));
+			break;
+#endif
+		default:
+			WL_ERR(("Invalid algo (0x%x)\n", wsec));
+			return -EINVAL;
+	}
+
+	callback(cookie, &params);
+	return err;
+}
+
+// terence 20130703: Fix for wrong group_capab (timing issue)
+int p2p_disconnected = 0;
+struct ether_addr p2p_disconnected_bssid;
+
+#if defined(RSSIAVG)
+static wl_rssi_cache_ctrl_t g_rssi_cache_ctrl;
+static wl_rssi_cache_ctrl_t g_rssi2_cache_ctrl;
+#endif
+#if defined(BSSCACHE)
+static wl_bss_cache_ctrl_t g_bss_cache_ctrl;
+#endif
+
+static s32
+wl_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
+	struct net_device *dev, u8 key_idx)
+{
+#ifdef MFP
+	return 0;
+#else
+	WL_INFORM(("Not supported\n"));
+	return -EOPNOTSUPP;
+#endif /* MFP */
+}
+
+static s32
+wl_cfg80211_get_station(struct wiphy *wiphy, struct net_device *dev,
+	NL_u8 *mac, struct station_info *sinfo)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	scb_val_t scb_val;
+	s32 rssi;
+	s32 rate;
+	s32 err = 0;
+	sta_info_t *sta;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) || defined(WL_COMPAT_WIRELESS)
+	s8 eabuf[ETHER_ADDR_STR_LEN];
+#endif
+	static int err_cnt = 0;
+	dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+	RETURN_EIO_IF_NOT_UP(cfg);
+	if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_AP) {
+		err = wldev_iovar_getbuf(dev, "sta_info", (struct ether_addr *)mac,
+			ETHER_ADDR_LEN, cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+		if (err < 0) {
+			WL_ERR(("GET STA INFO failed, %d\n", err));
+			return err;
+		}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+		sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
+#else
+		sinfo->filled = STATION_INFO_INACTIVE_TIME;
+#endif
+		sta = (sta_info_t *)cfg->ioctl_buf;
+		sta->len = dtoh16(sta->len);
+		sta->cap = dtoh16(sta->cap);
+		sta->flags = dtoh32(sta->flags);
+		sta->idle = dtoh32(sta->idle);
+		sta->in = dtoh32(sta->in);
+		sinfo->inactive_time = sta->idle * 1000;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) || defined(WL_COMPAT_WIRELESS)
+		if (sta->flags & WL_STA_ASSOC) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+			sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
+#else
+			sinfo->filled |= STATION_INFO_CONNECTED_TIME;
+#endif
+			sinfo->connected_time = sta->in;
+		}
+		WL_INFORM(("STA %s : idle time : %d sec, connected time :%d ms\n",
+			bcm_ether_ntoa((const struct ether_addr *)mac, eabuf), sinfo->inactive_time,
+			sta->idle * 1000));
+#endif
+	} else if (wl_get_mode_by_netdev(cfg, dev) == WL_MODE_BSS ||
+		wl_get_mode_by_netdev(cfg, dev) == WL_MODE_IBSS) {
+		get_pktcnt_t pktcnt;
+		u8 *curmacp;
+
+		if (cfg->roam_offload) {
+			struct ether_addr bssid;
+			err = wldev_ioctl(dev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+			if (err) {
+				WL_ERR(("Failed to get current BSSID\n"));
+			} else {
+				if (memcmp(mac, &bssid.octet, ETHER_ADDR_LEN) != 0) {
+					/* roaming is detected */
+					err = wl_cfg80211_delayed_roam(cfg, dev, &bssid);
+					if (err)
+						WL_ERR(("Failed to handle the delayed roam, "
+							"err=%d", err));
+					mac = (u8 *)bssid.octet;
+				}
+			}
+		}
+		if (!wl_get_drv_status(cfg, CONNECTED, dev) ||
+			(dhd_is_associated(dhd, NULL, &err) == FALSE)) {
+			WL_ERR(("NOT assoc\n"));
+			if (err == -ERESTARTSYS)
+				return err;
+			err = -ENODEV;
+			return err;
+		}
+		curmacp = wl_read_prof(cfg, dev, WL_PROF_BSSID);
+		if (memcmp(mac, curmacp, ETHER_ADDR_LEN)) {
+			WL_ERR(("Wrong Mac address: "MACDBG" != "MACDBG"\n",
+				MAC2STRDBG(mac), MAC2STRDBG(curmacp)));
+		}
+
+		/* Report the current tx rate */
+		err = wldev_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate), false);
+		if (err) {
+			WL_ERR(("Could not get rate (%d)\n", err));
+		} else {
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+			int rxpktglom;
+#endif
+			rate = dtoh32(rate);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+			sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+#else
+			sinfo->filled |= STATION_INFO_TX_BITRATE;
+#endif
+			sinfo->txrate.legacy = rate * 5;
+			WL_DBG(("Rate %d Mbps\n", (rate / 2)));
+#if defined(USE_DYNAMIC_MAXPKT_RXGLOM)
+			rxpktglom = ((rate/2) > 150) ? 20 : 10;
+
+			if (maxrxpktglom != rxpktglom) {
+				maxrxpktglom = rxpktglom;
+				WL_DBG(("Rate %d Mbps, update bus:maxtxpktglom=%d\n", (rate/2),
+					maxrxpktglom));
+				err = wldev_iovar_setbuf(dev, "bus:maxtxpktglom",
+					(char*)&maxrxpktglom, 4, cfg->ioctl_buf,
+					WLC_IOCTL_MAXLEN, NULL);
+				if (err < 0) {
+					WL_ERR(("set bus:maxtxpktglom failed, %d\n", err));
+				}
+			}
+#endif
+		}
+
+		memset(&scb_val, 0, sizeof(scb_val));
+		scb_val.val = 0;
+		err = wldev_ioctl(dev, WLC_GET_RSSI, &scb_val,
+			sizeof(scb_val_t), false);
+		if (err) {
+			WL_ERR(("Could not get rssi (%d)\n", err));
+			goto get_station_err;
+		}
+		rssi = dtoh32(scb_val.val);
+#if defined(RSSIAVG)
+		err = wl_update_connected_rssi_cache(dev, &g_rssi2_cache_ctrl, &rssi);
+		if (err) {
+			WL_ERR(("Could not get rssi (%d)\n", err));
+			goto get_station_err;
+		}
+		wl_delete_dirty_rssi_cache(&g_rssi2_cache_ctrl);
+		wl_reset_rssi_cache(&g_rssi2_cache_ctrl);
+#endif
+#if defined(RSSIOFFSET)
+		rssi = wl_update_rssi_offset(dev, rssi);
+#endif
+#if !defined(RSSIAVG) && !defined(RSSIOFFSET)
+		// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+		rssi = MIN(rssi, RSSI_MAXVAL);
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+		sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+#else
+		sinfo->filled |= STATION_INFO_SIGNAL;
+#endif
+		sinfo->signal = rssi;
+		WL_DBG(("RSSI %d dBm\n", rssi));
+		err = wldev_ioctl(dev, WLC_GET_PKTCNTS, &pktcnt,
+			sizeof(pktcnt), false);
+		if (!err) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 0, 0)
+			sinfo->filled |= (BIT(NL80211_STA_INFO_RX_PACKETS) |
+				BIT(NL80211_STA_INFO_RX_DROP_MISC) |
+				BIT(NL80211_STA_INFO_TX_PACKETS) |
+				BIT(NL80211_STA_INFO_TX_FAILED));
+#else
+			sinfo->filled |= (STATION_INFO_RX_PACKETS |
+				STATION_INFO_RX_DROP_MISC |
+				STATION_INFO_TX_PACKETS |
+				STATION_INFO_TX_FAILED);
+#endif
+			sinfo->rx_packets = pktcnt.rx_good_pkt;
+			sinfo->rx_dropped_misc = pktcnt.rx_bad_pkt;
+			sinfo->tx_packets = pktcnt.tx_good_pkt;
+			sinfo->tx_failed  = pktcnt.tx_bad_pkt;
+		}
+get_station_err:
+		if (err)
+			err_cnt++;
+		else
+			err_cnt = 0;
+		if (err_cnt >= 3 && (err != -ERESTARTSYS)) {
+			/* Disconnect due to zero BSSID or error to get RSSI */
+			WL_ERR(("force cfg80211_disconnected: %d\n", err));
+			wl_clr_drv_status(cfg, CONNECTED, dev);
+			cfg80211_disconnected(dev, 0, NULL, 0, true, GFP_KERNEL);
+			wl_link_down(cfg);
+		}
+	}
+	else {
+		WL_ERR(("Invalid device mode %d\n", wl_get_mode_by_netdev(cfg, dev)));
+	}
+
+	return err;
+}
+
+static s32
+wl_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
+	bool enabled, s32 timeout)
+{
+	s32 pm;
+	s32 err = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_info *_net_info = wl_get_netinfo_by_netdev(cfg, dev);
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	WL_DBG(("Enter\n"));
+	if (cfg->p2p_net == dev || _net_info == NULL || cfg->vsdb_mode ||
+		!wl_get_drv_status(cfg, CONNECTED, dev)) {
+		return err;
+	}
+
+	/* Delete pm_enable_work */
+	wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_PEND);
+
+	pm = enabled ? PM_FAST : PM_OFF;
+	if (_net_info->pm_block) {
+		WL_ERR(("%s:Do not enable the power save for pm_block %d\n",
+			dev->name, _net_info->pm_block));
+		pm = PM_OFF;
+	}
+	if (enabled && dhd_conf_get_pm(dhd) >= 0)
+		pm = dhd_conf_get_pm(dhd);
+	pm = htod32(pm);
+	WL_DBG(("%s:power save %s\n", dev->name, (pm ? "enabled" : "disabled")));
+	err = wldev_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm), true);
+	if (unlikely(err)) {
+		if (err == -ENODEV)
+			WL_DBG(("net_device is not ready yet\n"));
+		else
+			WL_ERR(("error (%d)\n", err));
+		return err;
+	}
+	wl_cfg80211_update_power_mode(dev);
+	return err;
+}
+
+void wl_cfg80211_update_power_mode(struct net_device *dev)
+{
+	int err, pm = -1;
+
+	err = wldev_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm), false);
+	if (err)
+		WL_ERR(("%s:error (%d)\n", __FUNCTION__, err));
+	else if (pm != -1 && dev->ieee80211_ptr)
+		dev->ieee80211_ptr->ps = (pm == PM_OFF) ? false : true;
+}
+
+static __used u32 wl_find_msb(u16 bit16)
+{
+	u32 ret = 0;
+
+	if (bit16 & 0xff00) {
+		ret += 8;
+		bit16 >>= 8;
+	}
+
+	if (bit16 & 0xf0) {
+		ret += 4;
+		bit16 >>= 4;
+	}
+
+	if (bit16 & 0xc) {
+		ret += 2;
+		bit16 >>= 2;
+	}
+
+	if (bit16 & 2)
+		ret += bit16 & 2;
+	else if (bit16)
+		ret += bit16;
+
+	return ret;
+}
+
+static s32 wl_cfg80211_resume(struct wiphy *wiphy)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	s32 err = 0;
+
+	if (unlikely(!wl_get_drv_status(cfg, READY, ndev))) {
+		WL_INFORM(("device is not ready\n"));
+		return 0;
+	}
+
+	return err;
+}
+
+static s32
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+wl_cfg80211_suspend(struct wiphy *wiphy, struct cfg80211_wowlan *wow)
+#else
+wl_cfg80211_suspend(struct wiphy *wiphy)
+#endif
+{
+#ifdef DHD_CLEAR_ON_SUSPEND
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_info *iter, *next;
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	unsigned long flags;
+	if (unlikely(!wl_get_drv_status(cfg, READY, ndev))) {
+		WL_INFORM(("device is not ready : status (%d)\n",
+			(int)cfg->status));
+		return 0;
+	}
+	for_each_ndev(cfg, iter, next)
+		wl_set_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	if (cfg->scan_request) {
+		cfg80211_scan_done(cfg->scan_request, true);
+		cfg->scan_request = NULL;
+	}
+	for_each_ndev(cfg, iter, next) {
+		wl_clr_drv_status(cfg, SCANNING, iter->ndev);
+		wl_clr_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+	}
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+	for_each_ndev(cfg, iter, next) {
+		if (wl_get_drv_status(cfg, CONNECTING, iter->ndev)) {
+			wl_bss_connect_done(cfg, iter->ndev, NULL, NULL, false);
+		}
+	}
+#endif /* DHD_CLEAR_ON_SUSPEND */
+	return 0;
+}
+
+static s32
+wl_update_pmklist(struct net_device *dev, struct wl_pmk_list *pmk_list,
+	s32 err)
+{
+	int i, j;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+
+	if (!pmk_list) {
+		printk("pmk_list is NULL\n");
+		return -EINVAL;
+	}
+	/* pmk list is supported only for STA interface i.e. primary interface
+	 * Refer code wlc_bsscfg.c->wlc_bsscfg_sta_init
+	 */
+	if (primary_dev != dev) {
+		WL_INFORM(("Not supporting Flushing pmklist on virtual"
+			" interfaces than primary interface\n"));
+		return err;
+	}
+
+	WL_DBG(("No of elements %d\n", pmk_list->pmkids.npmkid));
+	for (i = 0; i < pmk_list->pmkids.npmkid; i++) {
+		WL_DBG(("PMKID[%d]: %pM =\n", i,
+			&pmk_list->pmkids.pmkid[i].BSSID));
+		for (j = 0; j < WPA2_PMKID_LEN; j++) {
+			WL_DBG(("%02x\n", pmk_list->pmkids.pmkid[i].PMKID[j]));
+		}
+	}
+	if (likely(!err)) {
+		err = wldev_iovar_setbuf(dev, "pmkid_info", (char *)pmk_list,
+			sizeof(*pmk_list), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+	}
+
+	return err;
+}
+
+static s32
+wl_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_pmksa *pmksa)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 err = 0;
+	int i;
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	for (i = 0; i < cfg->pmk_list->pmkids.npmkid; i++)
+		if (!memcmp(pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].BSSID,
+			ETHER_ADDR_LEN))
+			break;
+	if (i < WL_NUM_PMKIDS_MAX) {
+		memcpy(&cfg->pmk_list->pmkids.pmkid[i].BSSID, pmksa->bssid,
+			ETHER_ADDR_LEN);
+		memcpy(&cfg->pmk_list->pmkids.pmkid[i].PMKID, pmksa->pmkid,
+			WPA2_PMKID_LEN);
+		if (i == cfg->pmk_list->pmkids.npmkid)
+			cfg->pmk_list->pmkids.npmkid++;
+	} else {
+		err = -EINVAL;
+	}
+	WL_DBG(("set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
+		&cfg->pmk_list->pmkids.pmkid[cfg->pmk_list->pmkids.npmkid - 1].BSSID));
+	for (i = 0; i < WPA2_PMKID_LEN; i++) {
+		WL_DBG(("%02x\n",
+			cfg->pmk_list->pmkids.pmkid[cfg->pmk_list->pmkids.npmkid - 1].
+			PMKID[i]));
+	}
+
+	err = wl_update_pmklist(dev, cfg->pmk_list, err);
+
+	return err;
+}
+
+static s32
+wl_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *dev,
+	struct cfg80211_pmksa *pmksa)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct _pmkid_list pmkid = {0};
+	s32 err = 0;
+	int i;
+
+	RETURN_EIO_IF_NOT_UP(cfg);
+	memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETHER_ADDR_LEN);
+	memcpy(pmkid.pmkid[0].PMKID, pmksa->pmkid, WPA2_PMKID_LEN);
+
+	WL_DBG(("del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
+		&pmkid.pmkid[0].BSSID));
+	for (i = 0; i < WPA2_PMKID_LEN; i++) {
+		WL_DBG(("%02x\n", pmkid.pmkid[0].PMKID[i]));
+	}
+
+	for (i = 0; i < cfg->pmk_list->pmkids.npmkid; i++)
+		if (!memcmp
+		    (pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].BSSID,
+		     ETHER_ADDR_LEN))
+			break;
+
+	if ((cfg->pmk_list->pmkids.npmkid > 0) &&
+		(i < cfg->pmk_list->pmkids.npmkid)) {
+		memset(&cfg->pmk_list->pmkids.pmkid[i], 0, sizeof(pmkid_t));
+		for (; i < (cfg->pmk_list->pmkids.npmkid - 1); i++) {
+			memcpy(&cfg->pmk_list->pmkids.pmkid[i].BSSID,
+				&cfg->pmk_list->pmkids.pmkid[i + 1].BSSID,
+				ETHER_ADDR_LEN);
+			memcpy(&cfg->pmk_list->pmkids.pmkid[i].PMKID,
+				&cfg->pmk_list->pmkids.pmkid[i + 1].PMKID,
+				WPA2_PMKID_LEN);
+		}
+		cfg->pmk_list->pmkids.npmkid--;
+	} else {
+		err = -EINVAL;
+	}
+
+	err = wl_update_pmklist(dev, cfg->pmk_list, err);
+
+	return err;
+
+}
+
+static s32
+wl_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *dev)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 err = 0;
+	RETURN_EIO_IF_NOT_UP(cfg);
+	memset(cfg->pmk_list, 0, sizeof(*cfg->pmk_list));
+	err = wl_update_pmklist(dev, cfg->pmk_list, err);
+	return err;
+
+}
+
+static wl_scan_params_t *
+wl_cfg80211_scan_alloc_params(int channel, int nprobes, int *out_params_size)
+{
+	wl_scan_params_t *params;
+	int params_size;
+	int num_chans;
+
+	*out_params_size = 0;
+
+	/* Our scan params only need space for 1 channel and 0 ssids */
+	params_size = WL_SCAN_PARAMS_FIXED_SIZE + 1 * sizeof(uint16);
+	params = (wl_scan_params_t*) kzalloc(params_size, GFP_KERNEL);
+	if (params == NULL) {
+		WL_ERR(("mem alloc failed (%d bytes)\n", params_size));
+		return params;
+	}
+	memset(params, 0, params_size);
+	params->nprobes = nprobes;
+
+	num_chans = (channel == 0) ? 0 : 1;
+
+	memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+	params->bss_type = DOT11_BSSTYPE_ANY;
+	params->scan_type = DOT11_SCANTYPE_ACTIVE;
+	params->nprobes = htod32(1);
+	params->active_time = htod32(-1);
+	params->passive_time = htod32(-1);
+	params->home_time = htod32(10);
+	if (channel == -1)
+		params->channel_list[0] = htodchanspec(channel);
+	else
+		params->channel_list[0] = wl_ch_host_to_driver(channel);
+
+	/* Our scan params have 1 channel and 0 ssids */
+	params->channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+		(num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+	*out_params_size = params_size;	/* rtn size to the caller */
+	return params;
+}
+
+static s32
+#if defined(WL_CFG80211_P2P_DEV_IF)
+wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+	struct ieee80211_channel *channel, unsigned int duration, u64 *cookie)
+#else
+wl_cfg80211_remain_on_channel(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+	struct ieee80211_channel * channel,
+	enum nl80211_channel_type channel_type,
+	unsigned int duration, u64 *cookie)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+{
+	s32 target_channel;
+	u32 id;
+	s32 err = BCME_OK;
+	struct ether_addr primary_mac;
+	struct net_device *ndev = NULL;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	WL_DBG(("Enter, channel: %d, duration ms (%d) SCANNING ?? %s \n",
+		ieee80211_frequency_to_channel(channel->center_freq),
+		duration, (wl_get_drv_status(cfg, SCANNING, ndev)) ? "YES":"NO"));
+
+	if (!cfg->p2p) {
+		WL_ERR(("cfg->p2p is not initialized\n"));
+		err = BCME_ERROR;
+		goto exit;
+	}
+
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	if (wl_get_drv_status_all(cfg, SCANNING)) {
+		wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+	}
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+	target_channel = ieee80211_frequency_to_channel(channel->center_freq);
+	memcpy(&cfg->remain_on_chan, channel, sizeof(struct ieee80211_channel));
+#if defined(WL_ENABLE_P2P_IF)
+	cfg->remain_on_chan_type = channel_type;
+#endif /* WL_ENABLE_P2P_IF */
+	id = ++cfg->last_roc_id;
+	if (id == 0)
+		id = ++cfg->last_roc_id;
+	*cookie = id;
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	if (wl_get_drv_status(cfg, SCANNING, ndev)) {
+		struct timer_list *_timer;
+		WL_DBG(("scan is running. go to fake listen state\n"));
+
+		wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+
+		if (timer_pending(&cfg->p2p->listen_timer)) {
+			WL_DBG(("cancel current listen timer \n"));
+			del_timer_sync(&cfg->p2p->listen_timer);
+		}
+
+		_timer = &cfg->p2p->listen_timer;
+		wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+
+		INIT_TIMER(_timer, wl_cfgp2p_listen_expired, duration, 0);
+
+		err = BCME_OK;
+		goto exit;
+	}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef WL_CFG80211_SYNC_GON
+	if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+		/* do not enter listen mode again if we are in listen mode already for next af.
+		 * remain on channel completion will be returned by waiting next af completion.
+		 */
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+		wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+#else
+		wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+		goto exit;
+	}
+#endif /* WL_CFG80211_SYNC_GON */
+	if (cfg->p2p && !cfg->p2p->on) {
+		/* In case of p2p_listen command, supplicant send remain_on_channel
+		 * without turning on P2P
+		 */
+		get_primary_mac(cfg, &primary_mac);
+		wl_cfgp2p_generate_bss_mac(&primary_mac, &cfg->p2p->dev_addr, &cfg->p2p->int_addr);
+		p2p_on(cfg) = true;
+	}
+
+	if (p2p_is_on(cfg)) {
+		err = wl_cfgp2p_enable_discovery(cfg, ndev, NULL, 0);
+		if (unlikely(err)) {
+			goto exit;
+		}
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+		wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+		err = wl_cfgp2p_discover_listen(cfg, target_channel, duration);
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+		if (err == BCME_OK) {
+			wl_set_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+		} else {
+			/* if failed, firmware may be internal scanning state.
+			 * so other scan request shall not abort it
+			 */
+			wl_set_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+		}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+		/* WAR: set err = ok to prevent cookie mismatch in wpa_supplicant
+		 * and expire timer will send a completion to the upper layer
+		 */
+		err = BCME_OK;
+	}
+
+exit:
+	if (err == BCME_OK) {
+		WL_INFORM(("Success\n"));
+#if defined(WL_CFG80211_P2P_DEV_IF)
+		cfg80211_ready_on_channel(cfgdev, *cookie, channel,
+			duration, GFP_KERNEL);
+#else
+		cfg80211_ready_on_channel(cfgdev, *cookie, channel,
+			channel_type, duration, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+	} else {
+		WL_ERR(("Fail to Set (err=%d cookie:%llu)\n", err, *cookie));
+	}
+	return err;
+}
+
+static s32
+wl_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
+	bcm_struct_cfgdev *cfgdev, u64 cookie)
+{
+	s32 err = 0;
+
+#ifdef P2PLISTEN_AP_SAMECHN
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct net_device *dev;
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	if (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
+		WL_DBG((" enter ) on P2P dedicated discover interface\n"));
+	}
+#else
+	WL_DBG((" enter ) netdev_ifidx: %d \n", cfgdev->ifindex));
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#ifdef P2PLISTEN_AP_SAMECHN
+	if (cfg && cfg->p2p_resp_apchn_status) {
+		dev = bcmcfg_to_prmry_ndev(cfg);
+		wl_cfg80211_set_p2p_resp_ap_chn(dev, 0);
+		cfg->p2p_resp_apchn_status = false;
+		WL_DBG(("p2p_resp_apchn_status Turn OFF \n"));
+	}
+#endif /* P2PLISTEN_AP_SAMECHN */
+	return err;
+}
+
+static void
+wl_cfg80211_afx_handler(struct work_struct *work)
+{
+	struct afx_hdl *afx_instance;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 ret = BCME_OK;
+
+	afx_instance = container_of(work, struct afx_hdl, work);
+	if (afx_instance != NULL && cfg->afx_hdl->is_active) {
+		if (cfg->afx_hdl->is_listen && cfg->afx_hdl->my_listen_chan) {
+			ret = wl_cfgp2p_discover_listen(cfg, cfg->afx_hdl->my_listen_chan,
+				(100 * (1 + (RANDOM32() % 3)))); /* 100ms ~ 300ms */
+		} else {
+			ret = wl_cfgp2p_act_frm_search(cfg, cfg->afx_hdl->dev,
+				cfg->afx_hdl->bssidx, cfg->afx_hdl->peer_listen_chan,
+				NULL);
+		}
+		if (unlikely(ret != BCME_OK)) {
+			WL_ERR(("ERROR occurred! returned value is (%d)\n", ret));
+			if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL))
+				complete(&cfg->act_frm_scan);
+		}
+	}
+}
+
+static s32
+wl_cfg80211_af_searching_channel(struct bcm_cfg80211 *cfg, struct net_device *dev)
+{
+	u32 max_retry = WL_CHANNEL_SYNC_RETRY;
+
+	if (dev == NULL)
+		return -1;
+
+	WL_DBG((" enter ) \n"));
+
+	wl_set_drv_status(cfg, FINDING_COMMON_CHANNEL, dev);
+	cfg->afx_hdl->is_active = TRUE;
+
+	/* Loop to wait until we find a peer's channel or the
+	 * pending action frame tx is cancelled.
+	 */
+	while ((cfg->afx_hdl->retry < max_retry) &&
+		(cfg->afx_hdl->peer_chan == WL_INVALID)) {
+		cfg->afx_hdl->is_listen = FALSE;
+		wl_set_drv_status(cfg, SCANNING, dev);
+		WL_DBG(("Scheduling the action frame for sending.. retry %d\n",
+			cfg->afx_hdl->retry));
+		/* search peer on peer's listen channel */
+		schedule_work(&cfg->afx_hdl->work);
+		wait_for_completion_timeout(&cfg->act_frm_scan,
+			msecs_to_jiffies(WL_AF_SEARCH_TIME_MAX));
+
+		if ((cfg->afx_hdl->peer_chan != WL_INVALID) ||
+			!(wl_get_drv_status(cfg, FINDING_COMMON_CHANNEL, dev)))
+			break;
+
+		if (cfg->afx_hdl->my_listen_chan) {
+			WL_DBG(("Scheduling Listen peer in my listen channel = %d\n",
+				cfg->afx_hdl->my_listen_chan));
+			/* listen on my listen channel */
+			cfg->afx_hdl->is_listen = TRUE;
+			schedule_work(&cfg->afx_hdl->work);
+			wait_for_completion_timeout(&cfg->act_frm_scan,
+				msecs_to_jiffies(WL_AF_SEARCH_TIME_MAX));
+		}
+		if ((cfg->afx_hdl->peer_chan != WL_INVALID) ||
+			!(wl_get_drv_status(cfg, FINDING_COMMON_CHANNEL, dev)))
+			break;
+
+		cfg->afx_hdl->retry++;
+
+		WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg);
+	}
+
+	cfg->afx_hdl->is_active = FALSE;
+
+	wl_clr_drv_status(cfg, SCANNING, dev);
+	wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, dev);
+
+	return (cfg->afx_hdl->peer_chan);
+}
+
+struct p2p_config_af_params {
+	s32 max_tx_retry;	/* max tx retry count if tx no ack */
+	/* To make sure to send successfully action frame, we have to turn off mpc
+	 * 0: off, 1: on,  (-1): do nothing
+	 */
+	s32 mpc_onoff;
+#ifdef WL_CFG80211_SYNC_GON
+	bool extra_listen;
+#endif
+	bool search_channel;	/* 1: search peer's channel to send af */
+};
+
+static s32
+wl_cfg80211_config_p2p_pub_af_tx(struct wiphy *wiphy,
+	wl_action_frame_t *action_frame, wl_af_params_t *af_params,
+	struct p2p_config_af_params *config_af_params)
+{
+	s32 err = BCME_OK;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	wifi_p2p_pub_act_frame_t *act_frm =
+		(wifi_p2p_pub_act_frame_t *) (action_frame->data);
+
+	/* initialize default value */
+#ifdef WL_CFG80211_SYNC_GON
+	config_af_params->extra_listen = true;
+#endif
+	config_af_params->search_channel = false;
+	config_af_params->max_tx_retry = WL_AF_TX_MAX_RETRY;
+	config_af_params->mpc_onoff = -1;
+	cfg->next_af_subtype = P2P_PAF_SUBTYPE_INVALID;
+
+	switch (act_frm->subtype) {
+	case P2P_PAF_GON_REQ: {
+		WL_DBG(("P2P: GO_NEG_PHASE status set \n"));
+		wl_set_p2p_status(cfg, GO_NEG_PHASE);
+
+		config_af_params->mpc_onoff = 0;
+		config_af_params->search_channel = true;
+		cfg->next_af_subtype = act_frm->subtype + 1;
+
+		/* increase dwell time to wait for RESP frame */
+		af_params->dwell_time = WL_MED_DWELL_TIME;
+
+		break;
+	}
+	case P2P_PAF_GON_RSP: {
+		cfg->next_af_subtype = act_frm->subtype + 1;
+		/* increase dwell time to wait for CONF frame */
+		af_params->dwell_time = WL_MED_DWELL_TIME + 100;
+		break;
+	}
+	case P2P_PAF_GON_CONF: {
+		/* If we reached till GO Neg confirmation reset the filter */
+		WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+		wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+
+		/* turn on mpc again if go nego is done */
+		config_af_params->mpc_onoff = 1;
+
+		/* minimize dwell time */
+		af_params->dwell_time = WL_MIN_DWELL_TIME;
+
+#ifdef WL_CFG80211_SYNC_GON
+		config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+		break;
+	}
+	case P2P_PAF_INVITE_REQ: {
+		config_af_params->search_channel = true;
+		cfg->next_af_subtype = act_frm->subtype + 1;
+
+		/* increase dwell time */
+		af_params->dwell_time = WL_MED_DWELL_TIME;
+		break;
+	}
+	case P2P_PAF_INVITE_RSP:
+		/* minimize dwell time */
+		af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+		config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+		break;
+	case P2P_PAF_DEVDIS_REQ: {
+		if (IS_ACTPUB_WITHOUT_GROUP_ID(&act_frm->elts[0],
+			action_frame->len)) {
+			config_af_params->search_channel = true;
+		}
+
+		cfg->next_af_subtype = act_frm->subtype + 1;
+		/* maximize dwell time to wait for RESP frame */
+		af_params->dwell_time = WL_LONG_DWELL_TIME;
+		break;
+	}
+	case P2P_PAF_DEVDIS_RSP:
+		/* minimize dwell time */
+		af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+		config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+		break;
+	case P2P_PAF_PROVDIS_REQ: {
+		if (IS_ACTPUB_WITHOUT_GROUP_ID(&act_frm->elts[0],
+			action_frame->len)) {
+			config_af_params->search_channel = true;
+		}
+
+		config_af_params->mpc_onoff = 0;
+		cfg->next_af_subtype = act_frm->subtype + 1;
+		/* increase dwell time to wait for RESP frame */
+		af_params->dwell_time = WL_MED_DWELL_TIME;
+		break;
+	}
+	case P2P_PAF_PROVDIS_RSP: {
+		cfg->next_af_subtype = P2P_PAF_GON_REQ;
+		af_params->dwell_time = WL_MIN_DWELL_TIME;
+#ifdef WL_CFG80211_SYNC_GON
+		config_af_params->extra_listen = false;
+#endif /* WL_CFG80211_SYNC_GON */
+		break;
+	}
+	default:
+		WL_DBG(("Unknown p2p pub act frame subtype: %d\n",
+			act_frm->subtype));
+		err = BCME_BADARG;
+	}
+	return err;
+}
+
+#ifdef WL11U
+static bool
+wl_cfg80211_check_DFS_channel(struct bcm_cfg80211 *cfg, wl_af_params_t *af_params,
+	void *frame, u16 frame_len)
+{
+	struct wl_scan_results *bss_list;
+	struct wl_bss_info *bi = NULL;
+	bool result = false;
+	s32 i;
+	chanspec_t chanspec;
+
+	/* If DFS channel is 52~148, check to block it or not */
+	if (af_params &&
+		(af_params->channel >= 52 && af_params->channel <= 148)) {
+		if (!wl_cfgp2p_is_p2p_action(frame, frame_len)) {
+			bss_list = cfg->bss_list;
+			bi = next_bss(bss_list, bi);
+			for_each_bss(bss_list, bi, i) {
+				chanspec = wl_chspec_driver_to_host(bi->chanspec);
+				if (CHSPEC_IS5G(chanspec) &&
+					((bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(chanspec))
+					== af_params->channel)) {
+					result = true;	/* do not block the action frame */
+					break;
+				}
+			}
+		}
+	}
+	else {
+		result = true;
+	}
+
+	WL_DBG(("result=%s", result?"true":"false"));
+	return result;
+}
+#endif /* WL11U */
+
+
+static bool
+wl_cfg80211_send_action_frame(struct wiphy *wiphy, struct net_device *dev,
+	bcm_struct_cfgdev *cfgdev, wl_af_params_t *af_params,
+	wl_action_frame_t *action_frame, u16 action_frame_len, s32 bssidx)
+{
+#ifdef WL11U
+	struct net_device *ndev = NULL;
+#endif /* WL11U */
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	bool ack = false;
+	u8 category, action;
+	s32 tx_retry;
+	struct p2p_config_af_params config_af_params;
+#ifdef VSDB
+	ulong off_chan_started_jiffies = 0;
+#endif
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+
+
+	/* Add the default dwell time
+	 * Dwell time to stay off-channel to wait for a response action frame
+	 * after transmitting an GO Negotiation action frame
+	 */
+	af_params->dwell_time = WL_DWELL_TIME;
+
+#ifdef WL11U
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	ndev = dev;
+#else
+	ndev = ndev_to_cfgdev(cfgdev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+#endif /* WL11U */
+
+	category = action_frame->data[DOT11_ACTION_CAT_OFF];
+	action = action_frame->data[DOT11_ACTION_ACT_OFF];
+
+	/* initialize variables */
+	tx_retry = 0;
+	cfg->next_af_subtype = P2P_PAF_SUBTYPE_INVALID;
+	config_af_params.max_tx_retry = WL_AF_TX_MAX_RETRY;
+	config_af_params.mpc_onoff = -1;
+	config_af_params.search_channel = false;
+#ifdef WL_CFG80211_SYNC_GON
+	config_af_params.extra_listen = false;
+#endif
+
+	/* config parameters */
+	/* Public Action Frame Process - DOT11_ACTION_CAT_PUBLIC */
+	if (category == DOT11_ACTION_CAT_PUBLIC) {
+		if ((action == P2P_PUB_AF_ACTION) &&
+			(action_frame_len >= sizeof(wifi_p2p_pub_act_frame_t))) {
+			/* p2p public action frame process */
+			if (BCME_OK != wl_cfg80211_config_p2p_pub_af_tx(wiphy,
+				action_frame, af_params, &config_af_params)) {
+				WL_DBG(("Unknown subtype.\n"));
+			}
+
+		} else if (action_frame_len >= sizeof(wifi_p2psd_gas_pub_act_frame_t)) {
+			/* service discovery process */
+			if (action == P2PSD_ACTION_ID_GAS_IREQ ||
+				action == P2PSD_ACTION_ID_GAS_CREQ) {
+				/* configure service discovery query frame */
+
+				config_af_params.search_channel = true;
+
+				/* save next af suptype to cancel remained dwell time */
+				cfg->next_af_subtype = action + 1;
+
+				af_params->dwell_time = WL_MED_DWELL_TIME;
+			} else if (action == P2PSD_ACTION_ID_GAS_IRESP ||
+				action == P2PSD_ACTION_ID_GAS_CRESP) {
+				/* configure service discovery response frame */
+				af_params->dwell_time = WL_MIN_DWELL_TIME;
+			} else {
+				WL_DBG(("Unknown action type: %d\n", action));
+			}
+		} else {
+			WL_DBG(("Unknown Frame: category 0x%x, action 0x%x, length %d\n",
+				category, action, action_frame_len));
+		}
+	} else if (category == P2P_AF_CATEGORY) {
+		/* do not configure anything. it will be sent with a default configuration */
+	} else {
+		WL_DBG(("Unknown Frame: category 0x%x, action 0x%x\n",
+			category, action));
+		if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+			wl_clr_drv_status(cfg, SENDING_ACT_FRM, dev);
+			return false;
+		}
+	}
+
+	/* To make sure to send successfully action frame, we have to turn off mpc */
+	if (config_af_params.mpc_onoff == 0) {
+		wldev_iovar_setint(dev, "mpc", 0);
+	}
+
+	/* validate channel and p2p ies */
+	if (config_af_params.search_channel && IS_P2P_SOCIAL(af_params->channel) &&
+		wl_to_p2p_bss_saved_ie(cfg, P2PAPI_BSSCFG_DEVICE).p2p_probe_req_ie_len) {
+		config_af_params.search_channel = true;
+	} else {
+		config_af_params.search_channel = false;
+	}
+#ifdef WL11U
+	if (ndev == bcmcfg_to_prmry_ndev(cfg))
+		config_af_params.search_channel = false;
+#endif /* WL11U */
+
+#ifdef VSDB
+	/* if connecting on primary iface, sleep for a while before sending af tx for VSDB */
+	if (wl_get_drv_status(cfg, CONNECTING, bcmcfg_to_prmry_ndev(cfg))) {
+		OSL_SLEEP(50);
+	}
+#endif
+
+	/* if scan is ongoing, abort current scan. */
+	if (wl_get_drv_status_all(cfg, SCANNING)) {
+		wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+	}
+
+#ifdef WL11U
+	/* handling DFS channel exceptions */
+	if (!wl_cfg80211_check_DFS_channel(cfg, af_params, action_frame->data, action_frame->len)) {
+		return false;	/* the action frame was blocked */
+	}
+#endif /* WL11U */
+
+	/* set status and destination address before sending af */
+	if (cfg->next_af_subtype != P2P_PAF_SUBTYPE_INVALID) {
+		/* set this status to cancel the remained dwell time in rx process */
+		wl_set_drv_status(cfg, WAITING_NEXT_ACT_FRM, dev);
+	}
+	wl_set_drv_status(cfg, SENDING_ACT_FRM, dev);
+	memcpy(cfg->afx_hdl->tx_dst_addr.octet,
+		af_params->action_frame.da.octet,
+		sizeof(cfg->afx_hdl->tx_dst_addr.octet));
+
+	/* save af_params for rx process */
+	cfg->afx_hdl->pending_tx_act_frm = af_params;
+
+	/* search peer's channel */
+	if (config_af_params.search_channel) {
+		/* initialize afx_hdl */
+		if (wl_cfgp2p_find_idx(cfg, dev, &cfg->afx_hdl->bssidx) != BCME_OK) {
+			WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+			goto exit;
+		}
+		cfg->afx_hdl->dev = dev;
+		cfg->afx_hdl->retry = 0;
+		cfg->afx_hdl->peer_chan = WL_INVALID;
+
+		if (wl_cfg80211_af_searching_channel(cfg, dev) == WL_INVALID) {
+			WL_ERR(("couldn't find peer's channel.\n"));
+			wl_cfgp2p_print_actframe(true, action_frame->data, action_frame->len,
+				af_params->channel);
+			goto exit;
+		}
+
+		wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+		/*
+		 * Abort scan even for VSDB scenarios. Scan gets aborted in firmware
+		 * but after the check of piggyback algorithm.
+		 * To take care of current piggback algo, lets abort the scan here itself.
+		 */
+		wl_notify_escan_complete(cfg, dev, true, true);
+		/* Suspend P2P discovery's search-listen to prevent it from
+		 * starting a scan or changing the channel.
+		 */
+		wl_cfgp2p_discover_enable_search(cfg, false);
+
+		/* update channel */
+		af_params->channel = cfg->afx_hdl->peer_chan;
+	}
+
+#ifdef VSDB
+	off_chan_started_jiffies = jiffies;
+#endif /* VSDB */
+
+	wl_cfgp2p_print_actframe(true, action_frame->data, action_frame->len, af_params->channel);
+
+	/* Now send a tx action frame */
+	ack = wl_cfgp2p_tx_action_frame(cfg, dev, af_params, bssidx) ? false : true;
+
+	/* if failed, retry it. tx_retry_max value is configure by .... */
+	while ((ack == false) && (tx_retry++ < config_af_params.max_tx_retry)) {
+#ifdef VSDB
+		if (af_params->channel) {
+			if (jiffies_to_msecs(jiffies - off_chan_started_jiffies) >
+				OFF_CHAN_TIME_THRESHOLD_MS) {
+				WL_AF_TX_KEEP_PRI_CONNECTION_VSDB(cfg);
+				off_chan_started_jiffies = jiffies;
+			} else
+				OSL_SLEEP(AF_RETRY_DELAY_TIME);
+		}
+#endif /* VSDB */
+		ack = wl_cfgp2p_tx_action_frame(cfg, dev, af_params, bssidx) ?
+			false : true;
+	}
+
+	if (ack == false) {
+		WL_ERR(("Failed to send Action Frame(retry %d)\n", tx_retry));
+	}
+	WL_DBG(("Complete to send action frame\n"));
+exit:
+	/* Clear SENDING_ACT_FRM after all sending af is done */
+	wl_clr_drv_status(cfg, SENDING_ACT_FRM, dev);
+
+#ifdef WL_CFG80211_SYNC_GON
+	/* WAR: sometimes dongle does not keep the dwell time of 'actframe'.
+	 * if we coundn't get the next action response frame and dongle does not keep
+	 * the dwell time, go to listen state again to get next action response frame.
+	 */
+	if (ack && config_af_params.extra_listen &&
+		wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM) &&
+		cfg->af_sent_channel == cfg->afx_hdl->my_listen_chan) {
+		s32 extar_listen_time;
+
+		extar_listen_time = af_params->dwell_time -
+			jiffies_to_msecs(jiffies - cfg->af_tx_sent_jiffies);
+
+		if (extar_listen_time > 50) {
+			wl_set_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, dev);
+			WL_DBG(("Wait more time! actual af time:%d,"
+				"calculated extar listen:%d\n",
+				af_params->dwell_time, extar_listen_time));
+			if (wl_cfgp2p_discover_listen(cfg, cfg->af_sent_channel,
+				extar_listen_time + 100) == BCME_OK) {
+				wait_for_completion_timeout(&cfg->wait_next_af,
+					msecs_to_jiffies(extar_listen_time + 100 + 300));
+			}
+			wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, dev);
+		}
+	}
+#endif /* WL_CFG80211_SYNC_GON */
+	wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, dev);
+
+	if (cfg->afx_hdl->pending_tx_act_frm)
+		cfg->afx_hdl->pending_tx_act_frm = NULL;
+
+	WL_INFORM(("-- sending Action Frame is %s, listen chan: %d\n",
+		(ack) ? "Succeeded!!":"Failed!!", cfg->afx_hdl->my_listen_chan));
+
+
+	/* if all done, turn mpc on again */
+	if (config_af_params.mpc_onoff == 1) {
+		wldev_iovar_setint(dev, "mpc", 1);
+	}
+
+	return ack;
+}
+
+#define MAX_NUM_OF_ASSOCIATED_DEV       64
+static s32
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+	struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+#else
+wl_cfg80211_mgmt_tx(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+	struct ieee80211_channel *channel, bool offchan,
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(3, 7, 0))
+	enum nl80211_channel_type channel_type,
+	bool channel_type_valid,
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(3, 7, 0) */
+	unsigned int wait, const u8* buf, size_t len,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+	bool no_cck,
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || defined(WL_COMPAT_WIRELESS)
+	bool dont_wait_for_ack,
+#endif
+	u64 *cookie)
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+{
+	wl_action_frame_t *action_frame;
+	wl_af_params_t *af_params;
+	scb_val_t scb_val;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+	struct ieee80211_channel *channel = params->chan;
+	const u8 *buf = params->buf;
+	size_t len = params->len;
+#endif
+	const struct ieee80211_mgmt *mgmt;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *dev = NULL;
+	s32 err = BCME_OK;
+	s32 bssidx = 0;
+	u32 id;
+	bool ack = false;
+	s8 eabuf[ETHER_ADDR_STR_LEN];
+
+	WL_DBG(("Enter \n"));
+
+	dev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	if (!dev) {
+		WL_ERR(("dev is NULL\n"));
+		return -EINVAL;
+	}
+
+	/* set bsscfg idx for iovar (wlan0: P2PAPI_BSSCFG_PRIMARY, p2p: P2PAPI_BSSCFG_DEVICE)	*/
+	if (discover_cfgdev(cfgdev, cfg)) {
+		if (!cfg->p2p_supported || !cfg->p2p) {
+			WL_ERR(("P2P doesn't setup completed yet\n"));
+			return -EINVAL;
+		}
+		bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	}
+	else {
+		if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+			WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+			return BCME_ERROR;
+		}
+	}
+
+	WL_DBG(("TX target bssidx=%d\n", bssidx));
+
+	if (p2p_is_on(cfg)) {
+		/* Suspend P2P discovery search-listen to prevent it from changing the
+		 * channel.
+		 */
+		if ((err = wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+			WL_ERR(("Can not disable discovery mode\n"));
+			return -EFAULT;
+		}
+	}
+	*cookie = 0;
+	id = cfg->send_action_id++;
+	if (id == 0)
+		id = cfg->send_action_id++;
+	*cookie = id;
+	mgmt = (const struct ieee80211_mgmt *)buf;
+	if (ieee80211_is_mgmt(mgmt->frame_control)) {
+		if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+			s32 ie_offset =  DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+			s32 ie_len = len - ie_offset;
+#ifdef P2PONEINT
+			if (dev == wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION))
+				dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+			if ((dev == bcmcfg_to_prmry_ndev(cfg)) && cfg->p2p)
+				bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+			wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+				VNDR_IE_PRBRSP_FLAG, (u8 *)(buf + ie_offset), ie_len);
+			cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, true, GFP_KERNEL);
+			goto exit;
+		} else if (ieee80211_is_disassoc(mgmt->frame_control) ||
+			ieee80211_is_deauth(mgmt->frame_control)) {
+			char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+				sizeof(struct ether_addr) + sizeof(uint)] = {0};
+			int num_associated = 0;
+			struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+			if (!bcmp((const uint8 *)BSSID_BROADCAST,
+				(const struct ether_addr *)mgmt->da, ETHER_ADDR_LEN)) {
+				assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+				err = wldev_ioctl(dev, WLC_GET_ASSOCLIST,
+					assoc_maclist, sizeof(mac_buf), false);
+				if (err < 0)
+					WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+				else
+					num_associated = assoc_maclist->count;
+			}
+			memcpy(scb_val.ea.octet, mgmt->da, ETH_ALEN);
+			scb_val.val = mgmt->u.disassoc.reason_code;
+			err = wldev_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+				sizeof(scb_val_t), true);
+			if (err < 0)
+				WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON error %d\n", err));
+			WL_ERR(("Disconnect STA : %s scb_val.val %d\n",
+				bcm_ether_ntoa((const struct ether_addr *)mgmt->da, eabuf),
+				scb_val.val));
+
+			if (num_associated > 0 && ETHER_ISBCAST(mgmt->da))
+				wl_delay(400);
+
+			cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, true, GFP_KERNEL);
+			goto exit;
+
+		} else if (ieee80211_is_action(mgmt->frame_control)) {
+			/* Abort the dwell time of any previous off-channel
+			* action frame that may be still in effect.  Sending
+			* off-channel action frames relies on the driver's
+			* scan engine.  If a previous off-channel action frame
+			* tx is still in progress (including the dwell time),
+			* then this new action frame will not be sent out.
+			*/
+/* Do not abort scan for VSDB. Scan will be aborted in firmware if necessary.
+ * And previous off-channel action frame must be ended before new af tx.
+ */
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+			wl_notify_escan_complete(cfg, dev, true, true);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+		}
+
+	} else {
+		WL_ERR(("Driver only allows MGMT packet type\n"));
+		goto exit;
+	}
+
+	af_params = (wl_af_params_t *) kzalloc(WL_WIFI_AF_PARAMS_SIZE, GFP_KERNEL);
+
+	if (af_params == NULL)
+	{
+		WL_ERR(("unable to allocate frame\n"));
+		return -ENOMEM;
+	}
+
+	action_frame = &af_params->action_frame;
+
+	/* Add the packet Id */
+	action_frame->packetId = *cookie;
+	WL_DBG(("action frame %d\n", action_frame->packetId));
+	/* Add BSSID */
+	memcpy(&action_frame->da, &mgmt->da[0], ETHER_ADDR_LEN);
+	memcpy(&af_params->BSSID, &mgmt->bssid[0], ETHER_ADDR_LEN);
+
+	/* Add the length exepted for 802.11 header  */
+	action_frame->len = len - DOT11_MGMT_HDR_LEN;
+	WL_DBG(("action_frame->len: %d\n", action_frame->len));
+
+	/* Add the channel */
+	af_params->channel =
+		ieee80211_frequency_to_channel(channel->center_freq);
+	/* Save listen_chan for searching common channel */
+	cfg->afx_hdl->peer_listen_chan = af_params->channel;
+	WL_DBG(("channel from upper layer %d\n", cfg->afx_hdl->peer_listen_chan));
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+	af_params->dwell_time = params->wait;
+#else
+	af_params->dwell_time = wait;
+#endif
+
+	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN], action_frame->len);
+
+	ack = wl_cfg80211_send_action_frame(wiphy, dev, cfgdev, af_params,
+		action_frame, action_frame->len, bssidx);
+	cfg80211_mgmt_tx_status(cfgdev, *cookie, buf, len, ack, GFP_KERNEL);
+
+	kfree(af_params);
+exit:
+	return err;
+}
+
+
+static void
+wl_cfg80211_mgmt_frame_register(struct wiphy *wiphy, bcm_struct_cfgdev *cfgdev,
+	u16 frame_type, bool reg)
+{
+
+	WL_DBG(("frame_type: %x, reg: %d\n", frame_type, reg));
+
+	if (frame_type != (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ))
+		return;
+
+	return;
+}
+
+
+static s32
+wl_cfg80211_change_bss(struct wiphy *wiphy,
+	struct net_device *dev,
+	struct bss_parameters *params)
+{
+	s32 err = 0;
+	s32 ap_isolate = 0;
+#if defined(SUPPORT_HOSTAPD_BGN_MODE)
+	dhd_pub_t *dhd;
+	s32 gmode = -1, nmode = -1;
+	s32 gmode_prev = -1, nmode_prev = -1;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#if defined(WL_ENABLE_P2P_IF)
+	if (cfg->p2p_net == dev)
+		dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+	dhd = (dhd_pub_t *)(cfg->pub);
+#endif /* SUPPORT_HOSTAPD_BGN_MODE */
+
+	if (params->use_cts_prot >= 0) {
+	}
+
+	if (params->use_short_preamble >= 0) {
+	}
+
+	if (params->use_short_slot_time >= 0) {
+	}
+
+	if (params->basic_rates) {
+#if defined(SUPPORT_HOSTAPD_BGN_MODE)
+		switch ((int)(params->basic_rates[params->basic_rates_len -1])) {
+			case 22: /* B only , rate 11 */
+				gmode = 0;
+				nmode = 0;
+				break;
+			case 108: /* G only , rate 54 */
+				gmode = 2;
+				nmode = 0;
+				break;
+			default:
+				gmode = -1;
+				nmode = -1;
+				break;
+		}
+#endif /* SUPPORT_HOSTAPD_BGN_MODE */
+	}
+
+	if (params->ap_isolate >= 0) {
+		ap_isolate = params->ap_isolate;
+		err = wldev_iovar_setint(dev, "ap_isolate", ap_isolate);
+		if (unlikely(err))
+		{
+			WL_ERR(("set ap_isolate Error (%d)\n", err));
+		}
+	}
+
+	if (params->ht_opmode >= 0) {
+#if defined(SUPPORT_HOSTAPD_BGN_MODE)
+		nmode = 1;
+		gmode = 1;
+	} else {
+		nmode = 0;
+#endif /* SUPPORT_HOSTAPD_BGN_MODE */
+	}
+
+#if defined(SUPPORT_HOSTAPD_BGN_MODE)
+	err = wldev_iovar_getint(dev, "nmode", &nmode_prev);
+	if (unlikely(err)) {
+		WL_ERR(("error reading nmode (%d)\n", err));
+	}
+	if (nmode == nmode_prev) {
+		nmode = -1;
+	}
+	err = wldev_ioctl(dev, WLC_GET_GMODE, &gmode_prev, sizeof(gmode_prev), 0);
+	if (unlikely(err)) {
+		WL_ERR(("error reading gmode (%d)\n", err));
+	}
+	if (gmode == gmode_prev) {
+		gmode = -1;
+	}
+
+	if (((dhd->op_mode & DHD_FLAG_HOSTAP_MODE) == DHD_FLAG_HOSTAP_MODE) &&
+		((gmode > -1) || (nmode > -1))) {
+		s32 val = 0;
+
+		err = wldev_ioctl(dev, WLC_DOWN, &val, sizeof(s32), true);
+		if (unlikely(err))
+			WL_ERR(("WLC_DOWN command failed:[%d]\n", err));
+
+		if (nmode > -1) {
+			err = wldev_iovar_setint(dev, "nmode", nmode);
+			if (unlikely(err))
+				WL_ERR(("nmode command failed:mode[%d]:err[%d]\n", nmode, err));
+		}
+
+		if (gmode > -1) {
+			err = wldev_ioctl(dev, WLC_SET_GMODE, &gmode, sizeof(s32), true);
+			if (unlikely(err))
+				WL_ERR(("WLC_SET_GMODE command failed:mode[%d]:err[%d]\n",
+					gmode, err));
+		}
+
+		val = 0;
+		err = wldev_ioctl(dev, WLC_UP, &val, sizeof(s32), true);
+		if (unlikely(err))
+			WL_ERR(("WLC_UP command failed:err[%d]\n", err));
+
+	}
+#endif /* SUPPORT_HOSTAPD_BGN_MODE */
+
+	return 0;
+}
+
+static s32
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && !defined(WL_COMPAT_WIRELESS))
+wl_cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
+	struct ieee80211_channel *chan,
+	struct cfg80211_chan_def chandef)
+#else
+wl_cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
+	struct ieee80211_channel *chan,
+	enum nl80211_channel_type channel_type)
+#endif /* ((LINUX_VERSION >= VERSION(3, 6, 0) && !WL_COMPAT_WIRELESS) */
+{
+	s32 _chan;
+	chanspec_t chspec = 0;
+	chanspec_t fw_chspec = 0;
+	u32 bw = WL_CHANSPEC_BW_20;
+
+	s32 err = BCME_OK;
+	s32 bw_cap = 0;
+	struct {
+		u32 band;
+		u32 bw_cap;
+	} param = {0, 0};
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#ifdef CUSTOM_SET_CPUCORE
+	dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+#endif /* CUSTOM_SET_CPUCORE */
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && !defined(WL_COMPAT_WIRELESS))
+	enum nl80211_channel_type channel_type = NL80211_CHAN_HT20;
+#endif /* ((LINUX_VERSION >= VERSION(3, 6, 0) && !WL_COMPAT_WIRELESS) */
+
+#ifndef P2PONEINT
+	dev = ndev_to_wlc_ndev(dev, cfg);
+#endif
+	_chan = ieee80211_frequency_to_channel(chan->center_freq);
+	printf("netdev_ifidx(%d), chan_type(%d) target channel(%d) \n",
+		dev->ifindex, channel_type, _chan);
+
+#ifdef CUSTOM_PLATFORM_NV_TEGRA
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)) && !defined(WL_COMPAT_WIRELESS))
+	WL_ERR(("chan_width = %d\n", chandef.width));
+	switch (chandef.width) {
+		case NL80211_CHAN_WIDTH_40:
+			bw = WL_CHANSPEC_BW_40;
+			break;
+		case NL80211_CHAN_WIDTH_80:
+			bw = WL_CHANSPEC_BW_80;
+			break;
+		case NL80211_CHAN_WIDTH_80P80:
+			bw = WL_CHANSPEC_BW_8080;
+			break;
+		case NL80211_CHAN_WIDTH_160:
+			bw = WL_CHANSPEC_BW_160;
+			break;
+		default:
+			bw = WL_CHANSPEC_BW_20;
+			break;
+	}
+	goto set_channel;
+#endif /* ((LINUX_VERSION >= VERSION(3, 8, 0) && !WL_COMPAT_WIRELESS) */
+#endif /* CUSTOM_PLATFORM_NV_TEGRA */
+
+	if (chan->band == NL80211_BAND_5GHZ) {
+		param.band = WLC_BAND_5G;
+		err = wldev_iovar_getbuf(dev, "bw_cap", &param, sizeof(param),
+			cfg->ioctl_buf, WLC_IOCTL_SMLEN, &cfg->ioctl_buf_sync);
+		if (err) {
+			if (err != BCME_UNSUPPORTED) {
+				WL_ERR(("bw_cap failed, %d\n", err));
+				return err;
+			} else {
+				err = wldev_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+				if (err) {
+					WL_ERR(("error get mimo_bw_cap (%d)\n", err));
+				}
+				if (bw_cap != WLC_N_BW_20ALL)
+					bw = WL_CHANSPEC_BW_40;
+			}
+		} else {
+			if (WL_BW_CAP_80MHZ(cfg->ioctl_buf[0]))
+				bw = WL_CHANSPEC_BW_80;
+			else if (WL_BW_CAP_40MHZ(cfg->ioctl_buf[0]))
+				bw = WL_CHANSPEC_BW_40;
+			else
+				bw = WL_CHANSPEC_BW_20;
+
+		}
+
+	} else if (chan->band == NL80211_BAND_2GHZ)
+		bw = WL_CHANSPEC_BW_20;
+set_channel:
+	chspec = wf_channel2chspec(_chan, bw);
+	if (wf_chspec_valid(chspec)) {
+		fw_chspec = wl_chspec_host_to_driver(chspec);
+		if (fw_chspec != INVCHANSPEC) {
+			if ((err = wldev_iovar_setint(dev, "chanspec",
+				fw_chspec)) == BCME_BADCHAN) {
+				if (bw == WL_CHANSPEC_BW_80)
+					goto change_bw;
+				err = wldev_ioctl(dev, WLC_SET_CHANNEL,
+					&_chan, sizeof(_chan), true);
+				if (err < 0) {
+					WL_ERR(("WLC_SET_CHANNEL error %d"
+					"chip may not be supporting this channel\n", err));
+				}
+			} else if (err) {
+				WL_ERR(("failed to set chanspec error %d\n", err));
+			}
+		} else {
+			WL_ERR(("failed to convert host chanspec to fw chanspec\n"));
+			err = BCME_ERROR;
+		}
+	} else {
+change_bw:
+		if (bw == WL_CHANSPEC_BW_80)
+			bw = WL_CHANSPEC_BW_40;
+		else if (bw == WL_CHANSPEC_BW_40)
+			bw = WL_CHANSPEC_BW_20;
+		else
+			bw = 0;
+		if (bw)
+			goto set_channel;
+		WL_ERR(("Invalid chanspec 0x%x\n", chspec));
+		err = BCME_ERROR;
+	}
+#ifdef CUSTOM_SET_CPUCORE
+	if (dhd->op_mode == DHD_FLAG_HOSTAP_MODE) {
+		WL_DBG(("SoftAP mode do not need to set cpucore\n"));
+	} else if ((dev == wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION)) &&
+		(chspec & WL_CHANSPEC_BW_80)) {
+		/* If GO is vht80 */
+		dhd->chan_isvht80 |= DHD_FLAG_P2P_MODE;
+		dhd_set_cpucore(dhd, TRUE);
+	}
+#endif /* CUSTOM_SET_CPUCORE */
+	return err;
+}
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+struct net_device *
+wl_cfg80211_get_remain_on_channel_ndev(struct bcm_cfg80211 *cfg)
+{
+	struct net_info *_net_info, *next;
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+		if (_net_info->ndev &&
+			test_bit(WL_STATUS_REMAINING_ON_CHANNEL, &_net_info->sme_state))
+			return _net_info->ndev;
+	}
+	return NULL;
+}
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+static s32
+wl_validate_opensecurity(struct net_device *dev, s32 bssidx)
+{
+	s32 err = BCME_OK;
+
+	/* set auth */
+	err = wldev_iovar_setint_bsscfg(dev, "auth", 0, bssidx);
+	if (err < 0) {
+		WL_ERR(("auth error %d\n", err));
+		return BCME_ERROR;
+	}
+#ifndef CUSTOMER_HW10 /* for WEP Support */
+	/* set wsec */
+	err = wldev_iovar_setint_bsscfg(dev, "wsec", 0, bssidx);
+	if (err < 0) {
+		WL_ERR(("wsec error %d\n", err));
+		return BCME_ERROR;
+	}
+#endif /* CUSTOMER_HW10 */
+
+	/* set upper-layer auth */
+	err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", WPA_AUTH_NONE, bssidx);
+	if (err < 0) {
+		WL_ERR(("wpa_auth error %d\n", err));
+		return BCME_ERROR;
+	}
+
+	return 0;
+}
+
+static s32
+wl_validate_wpa2ie(struct net_device *dev, bcm_tlv_t *wpa2ie, s32 bssidx)
+{
+	s32 len = 0;
+	s32 err = BCME_OK;
+	u16 auth = 0; /* d11 open authentication */
+	u32 wsec;
+	u32 pval = 0;
+	u32 gval = 0;
+	u32 wpa_auth = 0;
+	wpa_suite_mcast_t *mcast;
+	wpa_suite_ucast_t *ucast;
+	wpa_suite_auth_key_mgmt_t *mgmt;
+	wpa_pmkid_list_t *pmkid;
+	int cnt = 0;
+#ifdef MFP
+	int mfp = 0;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+#endif /* MFP */
+
+	u16 suite_count;
+	u8 rsn_cap[2];
+	u32 wme_bss_disable;
+
+	if (wpa2ie == NULL)
+		goto exit;
+
+	WL_DBG(("Enter \n"));
+	len =  wpa2ie->len - WPA2_VERSION_LEN;
+	/* check the mcast cipher */
+	mcast = (wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+	switch (mcast->type) {
+		case WPA_CIPHER_NONE:
+			gval = 0;
+			break;
+		case WPA_CIPHER_WEP_40:
+		case WPA_CIPHER_WEP_104:
+			gval = WEP_ENABLED;
+			break;
+		case WPA_CIPHER_TKIP:
+			gval = TKIP_ENABLED;
+			break;
+		case WPA_CIPHER_AES_CCM:
+			gval = AES_ENABLED;
+			break;
+#ifdef BCMWAPI_WPI
+		case WAPI_CIPHER_SMS4:
+			gval = SMS4_ENABLED;
+			break;
+#endif
+		default:
+			WL_ERR(("No Security Info\n"));
+			break;
+	}
+	if ((len -= WPA_SUITE_LEN) <= 0)
+		return BCME_BADLEN;
+
+	/* check the unicast cipher */
+	ucast = (wpa_suite_ucast_t *)&mcast[1];
+	suite_count = ltoh16_ua(&ucast->count);
+	switch (ucast->list[0].type) {
+		case WPA_CIPHER_NONE:
+			pval = 0;
+			break;
+		case WPA_CIPHER_WEP_40:
+		case WPA_CIPHER_WEP_104:
+			pval = WEP_ENABLED;
+			break;
+		case WPA_CIPHER_TKIP:
+			pval = TKIP_ENABLED;
+			break;
+		case WPA_CIPHER_AES_CCM:
+			pval = AES_ENABLED;
+			break;
+#ifdef BCMWAPI_WPI
+		case WAPI_CIPHER_SMS4:
+			pval = SMS4_ENABLED;
+			break;
+#endif
+		default:
+			WL_ERR(("No Security Info\n"));
+	}
+	if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) <= 0)
+		return BCME_BADLEN;
+
+	/* FOR WPS , set SEC_OW_ENABLED */
+	wsec = (pval | gval | SES_OW_ENABLED);
+	/* check the AKM */
+	mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+	suite_count = cnt = ltoh16_ua(&mgmt->count);
+	while (cnt--) {
+		switch (mgmt->list[cnt].type) {
+			case RSN_AKM_NONE:
+				wpa_auth = WPA_AUTH_NONE;
+				break;
+			case RSN_AKM_UNSPECIFIED:
+				wpa_auth = WPA2_AUTH_UNSPECIFIED;
+				break;
+			case RSN_AKM_PSK:
+				wpa_auth = WPA2_AUTH_PSK;
+				break;
+#ifdef MFP
+			case RSN_AKM_MFP_PSK:
+				wpa_auth |= WPA2_AUTH_PSK;
+				wsec |= MFP_SHA256;
+				break;
+			case RSN_AKM_MFP_1X:
+				wpa_auth |= WPA2_AUTH_UNSPECIFIED;
+				wsec |= MFP_SHA256;
+				break;
+#endif /* MFP */
+			default:
+				WL_ERR(("No Key Mgmt Info\n"));
+		}
+	}
+
+	if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+		rsn_cap[0] = *(u8 *)&mgmt->list[suite_count];
+		rsn_cap[1] = *((u8 *)&mgmt->list[suite_count] + 1);
+
+		if (rsn_cap[0] & (RSN_CAP_16_REPLAY_CNTRS << RSN_CAP_PTK_REPLAY_CNTR_SHIFT)) {
+			wme_bss_disable = 0;
+		} else {
+			wme_bss_disable = 1;
+		}
+
+#ifdef MFP
+		if (rsn_cap[0] & RSN_CAP_MFPR) {
+			WL_DBG(("MFP Required \n"));
+			mfp = WL_MFP_REQUIRED;
+		} else if (rsn_cap[0] & RSN_CAP_MFPC) {
+			WL_DBG(("MFP Capable \n"));
+			mfp = WL_MFP_CAPABLE;
+		}
+#endif /* MFP */
+
+		/* set wme_bss_disable to sync RSN Capabilities */
+		err = wldev_iovar_setint_bsscfg(dev, "wme_bss_disable", wme_bss_disable, bssidx);
+		if (err < 0) {
+			WL_ERR(("wme_bss_disable error %d\n", err));
+			return BCME_ERROR;
+		}
+	} else {
+		WL_DBG(("There is no RSN Capabilities. remained len %d\n", len));
+	}
+
+	if ((len -= RSN_CAP_LEN) >= WPA2_PMKID_COUNT_LEN) {
+		pmkid = (wpa_pmkid_list_t *)((u8 *)&mgmt->list[suite_count] + RSN_CAP_LEN);
+		cnt = ltoh16_ua(&pmkid->count);
+		if (cnt != 0) {
+			WL_ERR(("AP has non-zero PMKID count. Wrong!\n"));
+			return BCME_ERROR;
+		}
+		/* since PMKID cnt is known to be 0 for AP, */
+		/* so don't bother to send down this info to firmware */
+	}
+
+#ifdef MFP
+	if ((len -= WPA2_PMKID_COUNT_LEN) >= RSN_GROUPMANAGE_CIPHER_LEN) {
+		err = wldev_iovar_setbuf_bsscfg(dev, "bip",
+		(void *)((u8 *)&mgmt->list[suite_count] + RSN_CAP_LEN + WPA2_PMKID_COUNT_LEN),
+		RSN_GROUPMANAGE_CIPHER_LEN,
+		cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync);
+		if (err < 0) {
+			WL_ERR(("bip set error %d\n", err));
+			return BCME_ERROR;
+		}
+	}
+#endif
+
+	/* set auth */
+	err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+	if (err < 0) {
+		WL_ERR(("auth error %d\n", err));
+		return BCME_ERROR;
+	}
+	/* set wsec */
+	err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+	if (err < 0) {
+		WL_ERR(("wsec error %d\n", err));
+		return BCME_ERROR;
+	}
+
+#ifdef MFP
+	if (mfp) {
+		/* This needs to go after wsec otherwise the wsec command will
+		 * overwrite the values set by MFP
+		 */
+		if ((err = wldev_iovar_setint_bsscfg(dev, "mfp", mfp, bssidx)) < 0) {
+			WL_ERR(("MFP Setting failed. ret = %d \n", err));
+			return err;
+		}
+	}
+#endif /* MFP */
+
+	/* set upper-layer auth */
+	err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+	if (err < 0) {
+		WL_ERR(("wpa_auth error %d\n", err));
+		return BCME_ERROR;
+	}
+exit:
+	return 0;
+}
+
+static s32
+wl_validate_wpaie(struct net_device *dev, wpa_ie_fixed_t *wpaie, s32 bssidx)
+{
+	wpa_suite_mcast_t *mcast;
+	wpa_suite_ucast_t *ucast;
+	wpa_suite_auth_key_mgmt_t *mgmt;
+	u16 auth = 0; /* d11 open authentication */
+	u16 count;
+	s32 err = BCME_OK;
+	s32 len = 0;
+	u32 i;
+	u32 wsec;
+	u32 pval = 0;
+	u32 gval = 0;
+	u32 wpa_auth = 0;
+	u32 tmp = 0;
+
+	if (wpaie == NULL)
+		goto exit;
+	WL_DBG(("Enter \n"));
+	len = wpaie->length;    /* value length */
+	len -= WPA_IE_TAG_FIXED_LEN;
+	/* check for multicast cipher suite */
+	if (len < WPA_SUITE_LEN) {
+		WL_INFORM(("no multicast cipher suite\n"));
+		goto exit;
+	}
+
+	/* pick up multicast cipher */
+	mcast = (wpa_suite_mcast_t *)&wpaie[1];
+	len -= WPA_SUITE_LEN;
+	if (!bcmp(mcast->oui, WPA_OUI, WPA_OUI_LEN)) {
+		if (IS_WPA_CIPHER(mcast->type)) {
+			tmp = 0;
+			switch (mcast->type) {
+				case WPA_CIPHER_NONE:
+					tmp = 0;
+					break;
+				case WPA_CIPHER_WEP_40:
+				case WPA_CIPHER_WEP_104:
+					tmp = WEP_ENABLED;
+					break;
+				case WPA_CIPHER_TKIP:
+					tmp = TKIP_ENABLED;
+					break;
+				case WPA_CIPHER_AES_CCM:
+					tmp = AES_ENABLED;
+					break;
+				default:
+					WL_ERR(("No Security Info\n"));
+			}
+			gval |= tmp;
+		}
+	}
+	/* Check for unicast suite(s) */
+	if (len < WPA_IE_SUITE_COUNT_LEN) {
+		WL_INFORM(("no unicast suite\n"));
+		goto exit;
+	}
+	/* walk thru unicast cipher list and pick up what we recognize */
+	ucast = (wpa_suite_ucast_t *)&mcast[1];
+	count = ltoh16_ua(&ucast->count);
+	len -= WPA_IE_SUITE_COUNT_LEN;
+	for (i = 0; i < count && len >= WPA_SUITE_LEN;
+		i++, len -= WPA_SUITE_LEN) {
+		if (!bcmp(ucast->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+			if (IS_WPA_CIPHER(ucast->list[i].type)) {
+				tmp = 0;
+				switch (ucast->list[i].type) {
+					case WPA_CIPHER_NONE:
+						tmp = 0;
+						break;
+					case WPA_CIPHER_WEP_40:
+					case WPA_CIPHER_WEP_104:
+						tmp = WEP_ENABLED;
+						break;
+					case WPA_CIPHER_TKIP:
+						tmp = TKIP_ENABLED;
+						break;
+					case WPA_CIPHER_AES_CCM:
+						tmp = AES_ENABLED;
+						break;
+					default:
+						WL_ERR(("No Security Info\n"));
+				}
+				pval |= tmp;
+			}
+		}
+	}
+	len -= (count - i) * WPA_SUITE_LEN;
+	/* Check for auth key management suite(s) */
+	if (len < WPA_IE_SUITE_COUNT_LEN) {
+		WL_INFORM((" no auth key mgmt suite\n"));
+		goto exit;
+	}
+	/* walk thru auth management suite list and pick up what we recognize */
+	mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[count];
+	count = ltoh16_ua(&mgmt->count);
+	len -= WPA_IE_SUITE_COUNT_LEN;
+	for (i = 0; i < count && len >= WPA_SUITE_LEN;
+		i++, len -= WPA_SUITE_LEN) {
+		if (!bcmp(mgmt->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+			if (IS_WPA_AKM(mgmt->list[i].type)) {
+				tmp = 0;
+				switch (mgmt->list[i].type) {
+					case RSN_AKM_NONE:
+						tmp = WPA_AUTH_NONE;
+						break;
+					case RSN_AKM_UNSPECIFIED:
+						tmp = WPA_AUTH_UNSPECIFIED;
+						break;
+					case RSN_AKM_PSK:
+						tmp = WPA_AUTH_PSK;
+						break;
+					default:
+						WL_ERR(("No Key Mgmt Info\n"));
+				}
+				wpa_auth |= tmp;
+			}
+		}
+
+	}
+	/* FOR WPS , set SEC_OW_ENABLED */
+	wsec = (pval | gval | SES_OW_ENABLED);
+	/* set auth */
+	err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+	if (err < 0) {
+		WL_ERR(("auth error %d\n", err));
+		return BCME_ERROR;
+	}
+	/* set wsec */
+	err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+	if (err < 0) {
+		WL_ERR(("wsec error %d\n", err));
+		return BCME_ERROR;
+	}
+	/* set upper-layer auth */
+	err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+	if (err < 0) {
+		WL_ERR(("wpa_auth error %d\n", err));
+		return BCME_ERROR;
+	}
+exit:
+	return 0;
+}
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+static u32 wl_get_cipher_type(uint8 type)
+{
+	u32 ret = 0;
+	switch (type) {
+		case WPA_CIPHER_NONE:
+			ret = 0;
+			break;
+		case WPA_CIPHER_WEP_40:
+		case WPA_CIPHER_WEP_104:
+			ret = WEP_ENABLED;
+			break;
+		case WPA_CIPHER_TKIP:
+			ret = TKIP_ENABLED;
+			break;
+		case WPA_CIPHER_AES_CCM:
+			ret = AES_ENABLED;
+			break;
+#ifdef BCMWAPI_WPI
+		case WAPI_CIPHER_SMS4:
+			ret = SMS4_ENABLED;
+			break;
+#endif
+		default:
+			WL_ERR(("No Security Info\n"));
+	}
+	return ret;
+}
+
+static u32 wl_get_suite_auth_key_mgmt_type(uint8 type)
+{
+	u32 ret = 0;
+	switch (type) {
+		case RSN_AKM_NONE:
+			ret = WPA_AUTH_NONE;
+			break;
+		case RSN_AKM_UNSPECIFIED:
+			ret = WPA_AUTH_UNSPECIFIED;
+			break;
+		case RSN_AKM_PSK:
+			ret = WPA_AUTH_PSK;
+			break;
+		default:
+			WL_ERR(("No Key Mgmt Info\n"));
+	}
+	return ret;
+}
+
+static s32
+wl_validate_wpaie_wpa2ie(struct net_device *dev, wpa_ie_fixed_t *wpaie,
+	bcm_tlv_t *wpa2ie, s32 bssidx)
+{
+	wpa_suite_mcast_t *mcast;
+	wpa_suite_ucast_t *ucast;
+	wpa_suite_auth_key_mgmt_t *mgmt;
+	u16 auth = 0; /* d11 open authentication */
+	u16 count;
+	s32 err = BCME_OK;
+	u32 wme_bss_disable;
+	u16 suite_count;
+	u8 rsn_cap[2];
+	s32 len = 0;
+	u32 i;
+	u32 wsec1, wsec2, wsec;
+	u32 pval = 0;
+	u32 gval = 0;
+	u32 wpa_auth = 0;
+	u32 wpa_auth1 = 0;
+	u32 wpa_auth2 = 0;
+	u8* ptmp;
+
+	if (wpaie == NULL || wpa2ie == NULL)
+		goto exit;
+
+	WL_DBG(("Enter \n"));
+	len = wpaie->length;    /* value length */
+	len -= WPA_IE_TAG_FIXED_LEN;
+	/* check for multicast cipher suite */
+	if (len < WPA_SUITE_LEN) {
+		WL_INFORM(("no multicast cipher suite\n"));
+		goto exit;
+	}
+
+	/* pick up multicast cipher */
+	mcast = (wpa_suite_mcast_t *)&wpaie[1];
+	len -= WPA_SUITE_LEN;
+	if (!bcmp(mcast->oui, WPA_OUI, WPA_OUI_LEN)) {
+		if (IS_WPA_CIPHER(mcast->type)) {
+			gval |= wl_get_cipher_type(mcast->type);
+		}
+	}
+	WL_ERR(("\nwpa ie validate\n"));
+	WL_ERR(("wpa ie mcast cipher = 0x%X\n", gval));
+
+	/* Check for unicast suite(s) */
+	if (len < WPA_IE_SUITE_COUNT_LEN) {
+		WL_INFORM(("no unicast suite\n"));
+		goto exit;
+	}
+
+	/* walk thru unicast cipher list and pick up what we recognize */
+	ucast = (wpa_suite_ucast_t *)&mcast[1];
+	count = ltoh16_ua(&ucast->count);
+	len -= WPA_IE_SUITE_COUNT_LEN;
+	for (i = 0; i < count && len >= WPA_SUITE_LEN;
+		i++, len -= WPA_SUITE_LEN) {
+		if (!bcmp(ucast->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+			if (IS_WPA_CIPHER(ucast->list[i].type)) {
+				pval |= wl_get_cipher_type(ucast->list[i].type);
+			}
+		}
+	}
+	WL_ERR(("wpa ie ucast count =%d, cipher = 0x%X\n", count, pval));
+
+	/* FOR WPS , set SEC_OW_ENABLED */
+	wsec1 = (pval | gval | SES_OW_ENABLED);
+	WL_ERR(("wpa ie wsec = 0x%X\n", wsec1));
+
+	len -= (count - i) * WPA_SUITE_LEN;
+	/* Check for auth key management suite(s) */
+	if (len < WPA_IE_SUITE_COUNT_LEN) {
+		WL_INFORM((" no auth key mgmt suite\n"));
+		goto exit;
+	}
+	/* walk thru auth management suite list and pick up what we recognize */
+	mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[count];
+	count = ltoh16_ua(&mgmt->count);
+	len -= WPA_IE_SUITE_COUNT_LEN;
+	for (i = 0; i < count && len >= WPA_SUITE_LEN;
+		i++, len -= WPA_SUITE_LEN) {
+		if (!bcmp(mgmt->list[i].oui, WPA_OUI, WPA_OUI_LEN)) {
+			if (IS_WPA_AKM(mgmt->list[i].type)) {
+
+				wpa_auth1 |= wl_get_suite_auth_key_mgmt_type(mgmt->list[i].type);
+			}
+		}
+
+	}
+	WL_ERR(("wpa ie wpa_suite_auth_key_mgmt count=%d, key_mgmt = 0x%X\n", count, wpa_auth1));
+	WL_ERR(("\nwpa2 ie validate\n"));
+
+	pval = 0;
+	gval = 0;
+	len =  wpa2ie->len;
+	/* check the mcast cipher */
+	mcast = (wpa_suite_mcast_t *)&wpa2ie->data[WPA2_VERSION_LEN];
+	ptmp = mcast->oui;
+	gval = wl_get_cipher_type(ptmp[DOT11_OUI_LEN]);
+
+	WL_ERR(("wpa2 ie mcast cipher = 0x%X\n", gval));
+	if ((len -= WPA_SUITE_LEN) <= 0)
+	{
+		WL_ERR(("P:wpa2 ie len[%d]", len));
+		return BCME_BADLEN;
+	}
+
+	/* check the unicast cipher */
+	ucast = (wpa_suite_ucast_t *)&mcast[1];
+	suite_count = ltoh16_ua(&ucast->count);
+	WL_ERR((" WPA2 ucast cipher count=%d\n", suite_count));
+	pval |= wl_get_cipher_type(ucast->list[0].type);
+
+	if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) <= 0)
+		return BCME_BADLEN;
+
+	WL_ERR(("wpa2 ie ucast cipher = 0x%X\n", pval));
+
+	/* FOR WPS , set SEC_OW_ENABLED */
+	wsec2 = (pval | gval | SES_OW_ENABLED);
+	WL_ERR(("wpa2 ie wsec = 0x%X\n", wsec2));
+
+	/* check the AKM */
+	mgmt = (wpa_suite_auth_key_mgmt_t *)&ucast->list[suite_count];
+	suite_count = ltoh16_ua(&mgmt->count);
+	ptmp = (u8 *)&mgmt->list[0];
+	wpa_auth2 = wl_get_suite_auth_key_mgmt_type(ptmp[DOT11_OUI_LEN]);
+	WL_ERR(("wpa ie wpa_suite_auth_key_mgmt count=%d, key_mgmt = 0x%X\n", count, wpa_auth2));
+
+	if ((len -= (WPA_IE_SUITE_COUNT_LEN + (WPA_SUITE_LEN * suite_count))) >= RSN_CAP_LEN) {
+		rsn_cap[0] = *(u8 *)&mgmt->list[suite_count];
+		rsn_cap[1] = *((u8 *)&mgmt->list[suite_count] + 1);
+		if (rsn_cap[0] & (RSN_CAP_16_REPLAY_CNTRS << RSN_CAP_PTK_REPLAY_CNTR_SHIFT)) {
+			wme_bss_disable = 0;
+		} else {
+			wme_bss_disable = 1;
+		}
+		WL_DBG(("P:rsn_cap[0]=[0x%X]:wme_bss_disabled[%d]\n", rsn_cap[0], wme_bss_disable));
+
+		/* set wme_bss_disable to sync RSN Capabilities */
+		err = wldev_iovar_setint_bsscfg(dev, "wme_bss_disable", wme_bss_disable, bssidx);
+		if (err < 0) {
+			WL_ERR(("wme_bss_disable error %d\n", err));
+			return BCME_ERROR;
+		}
+	} else {
+		WL_DBG(("There is no RSN Capabilities. remained len %d\n", len));
+	}
+
+	wsec = (wsec1 | wsec2);
+	wpa_auth = (wpa_auth1 | wpa_auth2);
+	WL_ERR(("wpa_wpa2 wsec=0x%X wpa_auth=0x%X\n", wsec, wpa_auth));
+
+	/* set auth */
+	err = wldev_iovar_setint_bsscfg(dev, "auth", auth, bssidx);
+	if (err < 0) {
+		WL_ERR(("auth error %d\n", err));
+		return BCME_ERROR;
+	}
+	/* set wsec */
+	err = wldev_iovar_setint_bsscfg(dev, "wsec", wsec, bssidx);
+	if (err < 0) {
+		WL_ERR(("wsec error %d\n", err));
+		return BCME_ERROR;
+	}
+	/* set upper-layer auth */
+	err = wldev_iovar_setint_bsscfg(dev, "wpa_auth", wpa_auth, bssidx);
+	if (err < 0) {
+		WL_ERR(("wpa_auth error %d\n", err));
+		return BCME_ERROR;
+	}
+exit:
+	return 0;
+}
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+
+static s32
+wl_cfg80211_bcn_validate_sec(
+	struct net_device *dev,
+	struct parsed_ies *ies,
+	u32 dev_role,
+	s32 bssidx)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	if (dev_role == NL80211_IFTYPE_P2P_GO && (ies->wpa2_ie)) {
+		/* For P2P GO, the sec type is WPA2-PSK */
+		WL_DBG(("P2P GO: validating wpa2_ie"));
+		if (wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0)
+			return BCME_ERROR;
+
+	} else if (dev_role == NL80211_IFTYPE_AP) {
+
+		WL_DBG(("SoftAP: validating security"));
+		/* If wpa2_ie or wpa_ie is present validate it */
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+		if ((ies->wpa_ie != NULL && ies->wpa2_ie != NULL)) {
+			if (wl_validate_wpaie_wpa2ie(dev, ies->wpa_ie, ies->wpa2_ie, bssidx)  < 0) {
+				cfg->ap_info->security_mode = false;
+				return BCME_ERROR;
+			}
+		}
+		else {
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+		if ((ies->wpa2_ie || ies->wpa_ie) &&
+			((wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0 ||
+			wl_validate_wpaie(dev, ies->wpa_ie, bssidx) < 0))) {
+			cfg->ap_info->security_mode = false;
+			return BCME_ERROR;
+		}
+
+		cfg->ap_info->security_mode = true;
+		if (cfg->ap_info->rsn_ie) {
+			kfree(cfg->ap_info->rsn_ie);
+			cfg->ap_info->rsn_ie = NULL;
+		}
+		if (cfg->ap_info->wpa_ie) {
+			kfree(cfg->ap_info->wpa_ie);
+			cfg->ap_info->wpa_ie = NULL;
+		}
+		if (cfg->ap_info->wps_ie) {
+			kfree(cfg->ap_info->wps_ie);
+			cfg->ap_info->wps_ie = NULL;
+		}
+		if (ies->wpa_ie != NULL) {
+			/* WPAIE */
+			cfg->ap_info->rsn_ie = NULL;
+			cfg->ap_info->wpa_ie = kmemdup(ies->wpa_ie,
+				ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+				GFP_KERNEL);
+		} else if (ies->wpa2_ie != NULL) {
+			/* RSNIE */
+			cfg->ap_info->wpa_ie = NULL;
+			cfg->ap_info->rsn_ie = kmemdup(ies->wpa2_ie,
+				ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+				GFP_KERNEL);
+		}
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+		}
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+		if (!ies->wpa2_ie && !ies->wpa_ie) {
+			wl_validate_opensecurity(dev, bssidx);
+			cfg->ap_info->security_mode = false;
+		}
+
+		if (ies->wps_ie) {
+			cfg->ap_info->wps_ie = kmemdup(ies->wps_ie, ies->wps_ie_len, GFP_KERNEL);
+		}
+	}
+
+	return 0;
+
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32 wl_cfg80211_bcn_set_params(
+	struct cfg80211_ap_settings *info,
+	struct net_device *dev,
+	u32 dev_role, s32 bssidx)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 err = BCME_OK;
+
+	WL_DBG(("interval (%d) \ndtim_period (%d) \n",
+		info->beacon_interval, info->dtim_period));
+
+	if (info->beacon_interval) {
+		if ((err = wldev_ioctl(dev, WLC_SET_BCNPRD,
+			&info->beacon_interval, sizeof(s32), true)) < 0) {
+			WL_ERR(("Beacon Interval Set Error, %d\n", err));
+			return err;
+		}
+	}
+
+	if (info->dtim_period) {
+		if ((err = wldev_ioctl(dev, WLC_SET_DTIMPRD,
+			&info->dtim_period, sizeof(s32), true)) < 0) {
+			WL_ERR(("DTIM Interval Set Error, %d\n", err));
+			return err;
+		}
+	}
+
+	if ((info->ssid) && (info->ssid_len > 0) &&
+		(info->ssid_len <= 32)) {
+		WL_DBG(("SSID (%s) len:%zd \n", info->ssid, info->ssid_len));
+		if (dev_role == NL80211_IFTYPE_AP) {
+			/* Store the hostapd SSID */
+			memset(cfg->hostapd_ssid.SSID, 0x00, 32);
+			memcpy(cfg->hostapd_ssid.SSID, info->ssid, info->ssid_len);
+			cfg->hostapd_ssid.SSID_len = info->ssid_len;
+		} else {
+				/* P2P GO */
+			memset(cfg->p2p->ssid.SSID, 0x00, 32);
+			memcpy(cfg->p2p->ssid.SSID, info->ssid, info->ssid_len);
+			cfg->p2p->ssid.SSID_len = info->ssid_len;
+		}
+	}
+
+	if (info->hidden_ssid) {
+		if ((err = wldev_iovar_setint(dev, "closednet", 1)) < 0)
+			WL_ERR(("failed to set hidden : %d\n", err));
+		WL_DBG(("hidden_ssid_enum_val: %d \n", info->hidden_ssid));
+	}
+
+	return err;
+}
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32
+wl_cfg80211_parse_ies(u8 *ptr, u32 len, struct parsed_ies *ies)
+{
+	s32 err = BCME_OK;
+
+	memset(ies, 0, sizeof(struct parsed_ies));
+
+	/* find the WPSIE */
+	if ((ies->wps_ie = wl_cfgp2p_find_wpsie(ptr, len)) != NULL) {
+		WL_DBG(("WPSIE in beacon \n"));
+		ies->wps_ie_len = ies->wps_ie->length + WPA_RSN_IE_TAG_FIXED_LEN;
+	} else {
+		WL_DBG(("No WPSIE in beacon \n"));
+	}
+
+	/* find the RSN_IE */
+	if ((ies->wpa2_ie = bcm_parse_tlvs(ptr, len,
+		DOT11_MNG_RSN_ID)) != NULL) {
+		WL_DBG((" WPA2 IE found\n"));
+		ies->wpa2_ie_len = ies->wpa2_ie->len;
+	}
+
+	/* find the WPA_IE */
+	if ((ies->wpa_ie = wl_cfgp2p_find_wpaie(ptr, len)) != NULL) {
+		WL_DBG((" WPA found\n"));
+		ies->wpa_ie_len = ies->wpa_ie->length;
+	}
+
+	return err;
+
+}
+
+static s32
+wl_cfg80211_bcn_bringup_ap(
+	struct net_device *dev,
+	struct parsed_ies *ies,
+	u32 dev_role, s32 bssidx)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wl_join_params join_params;
+	bool is_bssup = false;
+	s32 infra = 1;
+	s32 join_params_size = 0;
+	s32 ap = 1;
+#ifdef DISABLE_11H_SOFTAP
+	s32 spect = 0;
+#endif /* DISABLE_11H_SOFTAP */
+	s32 err = BCME_OK;
+
+	WL_DBG(("Enter dev_role: %d\n", dev_role));
+
+	/* Common code for SoftAP and P2P GO */
+	wldev_iovar_setint(dev, "mpc", 0);
+
+	if (dev_role == NL80211_IFTYPE_P2P_GO) {
+		is_bssup = wl_cfgp2p_bss_isup(dev, bssidx);
+		if (!is_bssup && (ies->wpa2_ie != NULL)) {
+
+			err = wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+			if (err < 0) {
+				WL_ERR(("SET INFRA error %d\n", err));
+				goto exit;
+			}
+
+			err = wldev_iovar_setbuf_bsscfg(dev, "ssid", &cfg->p2p->ssid,
+				sizeof(cfg->p2p->ssid), cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+				bssidx, &cfg->ioctl_buf_sync);
+			if (err < 0) {
+				WL_ERR(("GO SSID setting error %d\n", err));
+				goto exit;
+			}
+
+			/* Do abort scan before creating GO */
+			wl_cfg80211_scan_abort(cfg);
+
+			if ((err = wl_cfgp2p_bss(cfg, dev, bssidx, 1)) < 0) {
+				WL_ERR(("GO Bring up error %d\n", err));
+				goto exit;
+			}
+		} else
+			WL_DBG(("Bss is already up\n"));
+	} else if ((dev_role == NL80211_IFTYPE_AP) &&
+		(wl_get_drv_status(cfg, AP_CREATING, dev))) {
+		/* Device role SoftAP */
+		err = wldev_ioctl(dev, WLC_DOWN, &ap, sizeof(s32), true);
+		if (err < 0) {
+			WL_ERR(("WLC_DOWN error %d\n", err));
+			goto exit;
+		}
+		err = wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+		if (err < 0) {
+			WL_ERR(("SET INFRA error %d\n", err));
+			goto exit;
+		}
+		if ((err = wldev_ioctl(dev, WLC_SET_AP, &ap, sizeof(s32), true)) < 0) {
+			WL_ERR(("setting AP mode failed %d \n", err));
+			goto exit;
+		}
+#ifdef DISABLE_11H_SOFTAP
+		err = wldev_ioctl(dev, WLC_SET_SPECT_MANAGMENT,
+			&spect, sizeof(s32), true);
+		if (err < 0) {
+			WL_ERR(("SET SPECT_MANAGMENT error %d\n", err));
+			goto exit;
+		}
+#endif /* DISABLE_11H_SOFTAP */
+
+		err = wldev_ioctl(dev, WLC_UP, &ap, sizeof(s32), true);
+		if (unlikely(err)) {
+			WL_ERR(("WLC_UP error (%d)\n", err));
+			goto exit;
+		}
+
+		memset(&join_params, 0, sizeof(join_params));
+		/* join parameters starts with ssid */
+		join_params_size = sizeof(join_params.ssid);
+		memcpy(join_params.ssid.SSID, cfg->hostapd_ssid.SSID,
+			cfg->hostapd_ssid.SSID_len);
+		join_params.ssid.SSID_len = htod32(cfg->hostapd_ssid.SSID_len);
+
+		/* create softap */
+		if ((err = wldev_ioctl(dev, WLC_SET_SSID, &join_params,
+			join_params_size, true)) == 0) {
+			WL_DBG(("SoftAP set SSID (%s) success\n", join_params.ssid.SSID));
+			wl_clr_drv_status(cfg, AP_CREATING, dev);
+			wl_set_drv_status(cfg, AP_CREATED, dev);
+		}
+	}
+
+
+exit:
+	return err;
+}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+s32
+wl_cfg80211_parse_ap_ies(
+	struct net_device *dev,
+	struct cfg80211_beacon_data *info,
+	struct parsed_ies *ies)
+{
+	struct parsed_ies prb_ies;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+	u8 *vndr = NULL;
+	u32 vndr_ie_len = 0;
+	s32 err = BCME_OK;
+
+	/* Parse Beacon IEs */
+	if (wl_cfg80211_parse_ies((u8 *)info->tail,
+		info->tail_len, ies) < 0) {
+		WL_ERR(("Beacon get IEs failed \n"));
+		err = -EINVAL;
+		goto fail;
+	}
+
+	vndr = (u8 *)info->proberesp_ies;
+	vndr_ie_len = info->proberesp_ies_len;
+
+	if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+		/* SoftAP mode */
+		struct ieee80211_mgmt *mgmt;
+		mgmt = (struct ieee80211_mgmt *)info->probe_resp;
+		if (mgmt != NULL) {
+			vndr = (u8 *)&mgmt->u.probe_resp.variable;
+			vndr_ie_len = info->probe_resp_len -
+				offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+		}
+	}
+
+	/* Parse Probe Response IEs */
+	if (wl_cfg80211_parse_ies(vndr, vndr_ie_len, &prb_ies) < 0) {
+		WL_ERR(("PROBE RESP get IEs failed \n"));
+		err = -EINVAL;
+	}
+
+fail:
+
+	return err;
+}
+
+s32
+wl_cfg80211_set_ies(
+	struct net_device *dev,
+	struct cfg80211_beacon_data *info,
+	s32 bssidx)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+	u8 *vndr = NULL;
+	u32 vndr_ie_len = 0;
+	s32 err = BCME_OK;
+
+	/* Set Beacon IEs to FW */
+	if ((err = wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+		VNDR_IE_BEACON_FLAG, (u8 *)info->tail,
+		info->tail_len)) < 0) {
+		WL_ERR(("Set Beacon IE Failed \n"));
+	} else {
+		WL_DBG(("Applied Vndr IEs for Beacon \n"));
+	}
+
+	vndr = (u8 *)info->proberesp_ies;
+	vndr_ie_len = info->proberesp_ies_len;
+
+	if (dhd->op_mode & DHD_FLAG_HOSTAP_MODE) {
+		/* SoftAP mode */
+		struct ieee80211_mgmt *mgmt;
+		mgmt = (struct ieee80211_mgmt *)info->probe_resp;
+		if (mgmt != NULL) {
+			vndr = (u8 *)&mgmt->u.probe_resp.variable;
+			vndr_ie_len = info->probe_resp_len -
+				offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+		}
+	}
+
+	/* Set Probe Response IEs to FW */
+	if ((err = wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+		VNDR_IE_PRBRSP_FLAG, vndr, vndr_ie_len)) < 0) {
+		WL_ERR(("Set Probe Resp IE Failed \n"));
+	} else {
+		WL_DBG(("Applied Vndr IEs for Probe Resp \n"));
+	}
+
+	return err;
+}
+#endif /* LINUX_VERSION >= VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+static s32 wl_cfg80211_hostapd_sec(
+	struct net_device *dev,
+	struct parsed_ies *ies,
+	s32 bssidx)
+{
+	bool update_bss = 0;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+
+	if (ies->wps_ie) {
+		if (cfg->ap_info->wps_ie &&
+			memcmp(cfg->ap_info->wps_ie, ies->wps_ie, ies->wps_ie_len)) {
+			WL_DBG((" WPS IE is changed\n"));
+			kfree(cfg->ap_info->wps_ie);
+			cfg->ap_info->wps_ie = kmemdup(ies->wps_ie, ies->wps_ie_len, GFP_KERNEL);
+		} else if (cfg->ap_info->wps_ie == NULL) {
+			WL_DBG((" WPS IE is added\n"));
+			cfg->ap_info->wps_ie = kmemdup(ies->wps_ie, ies->wps_ie_len, GFP_KERNEL);
+		}
+
+#if defined(SUPPORT_SOFTAP_WPAWPA2_MIXED)
+		if (ies->wpa_ie != NULL && ies->wpa2_ie != NULL) {
+			WL_ERR(("update bss - wpa_ie and  wpa2_ie is not null\n"));
+			if (!cfg->ap_info->security_mode) {
+				/* change from open mode to security mode */
+				update_bss = true;
+				cfg->ap_info->wpa_ie =
+					kmemdup(ies->wpa_ie,
+					ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+					GFP_KERNEL);
+				cfg->ap_info->rsn_ie =
+					kmemdup(ies->wpa2_ie,
+					ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+					GFP_KERNEL);
+			} else {
+				/* change from (WPA or WPA2 or WPA/WPA2) to WPA/WPA2 mixed mode */
+				if (cfg->ap_info->wpa_ie) {
+					if (memcmp(cfg->ap_info->wpa_ie,
+					ies->wpa_ie, ies->wpa_ie->length +
+					WPA_RSN_IE_TAG_FIXED_LEN)) {
+						kfree(cfg->ap_info->wpa_ie);
+						update_bss = true;
+						cfg->ap_info->wpa_ie = kmemdup(ies->wpa_ie,
+						ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+						GFP_KERNEL);
+					}
+				}
+				else {
+					update_bss = true;
+					cfg->ap_info->wpa_ie =
+						kmemdup(ies->wpa_ie,
+						ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+						GFP_KERNEL);
+				}
+				if (cfg->ap_info->rsn_ie) {
+					if (memcmp(cfg->ap_info->rsn_ie,
+					ies->wpa2_ie,
+					ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN)) {
+						update_bss = true;
+						kfree(cfg->ap_info->rsn_ie);
+						cfg->ap_info->rsn_ie =
+							kmemdup(ies->wpa2_ie,
+							ies->wpa2_ie->len +
+							WPA_RSN_IE_TAG_FIXED_LEN,
+							GFP_KERNEL);
+					}
+				}
+				else {
+					update_bss = true;
+					cfg->ap_info->rsn_ie =
+						kmemdup(ies->wpa2_ie,
+						ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+						GFP_KERNEL);
+				}
+			}
+			WL_ERR(("update_bss=%d\n", update_bss));
+			if (update_bss) {
+				cfg->ap_info->security_mode = true;
+				wl_cfgp2p_bss(cfg, dev, bssidx, 0);
+				if (wl_validate_wpaie_wpa2ie(dev, ies->wpa_ie,
+					ies->wpa2_ie, bssidx)  < 0) {
+					return BCME_ERROR;
+				}
+				wl_cfgp2p_bss(cfg, dev, bssidx, 1);
+			}
+
+		}
+		else
+#endif /* SUPPORT_SOFTAP_WPAWPA2_MIXED */
+		if ((ies->wpa_ie != NULL || ies->wpa2_ie != NULL)) {
+			if (!cfg->ap_info->security_mode) {
+				/* change from open mode to security mode */
+				update_bss = true;
+				if (ies->wpa_ie != NULL) {
+					cfg->ap_info->wpa_ie = kmemdup(ies->wpa_ie,
+					ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+					GFP_KERNEL);
+				} else {
+					cfg->ap_info->rsn_ie = kmemdup(ies->wpa2_ie,
+					ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+					GFP_KERNEL);
+				}
+			} else if (cfg->ap_info->wpa_ie) {
+				/* change from WPA2 mode to WPA mode */
+				if (ies->wpa_ie != NULL) {
+					update_bss = true;
+					kfree(cfg->ap_info->rsn_ie);
+					cfg->ap_info->rsn_ie = NULL;
+					cfg->ap_info->wpa_ie = kmemdup(ies->wpa_ie,
+					ies->wpa_ie->length + WPA_RSN_IE_TAG_FIXED_LEN,
+					GFP_KERNEL);
+				} else if (memcmp(cfg->ap_info->rsn_ie,
+					ies->wpa2_ie, ies->wpa2_ie->len
+					+ WPA_RSN_IE_TAG_FIXED_LEN)) {
+					update_bss = true;
+					kfree(cfg->ap_info->rsn_ie);
+					cfg->ap_info->rsn_ie = kmemdup(ies->wpa2_ie,
+					ies->wpa2_ie->len + WPA_RSN_IE_TAG_FIXED_LEN,
+					GFP_KERNEL);
+					cfg->ap_info->wpa_ie = NULL;
+				}
+			}
+			if (update_bss) {
+				cfg->ap_info->security_mode = true;
+				wl_cfgp2p_bss(cfg, dev, bssidx, 0);
+				if (wl_validate_wpa2ie(dev, ies->wpa2_ie, bssidx)  < 0 ||
+					wl_validate_wpaie(dev, ies->wpa_ie, bssidx) < 0) {
+					return BCME_ERROR;
+				}
+				wl_cfgp2p_bss(cfg, dev, bssidx, 1);
+			}
+		}
+	} else {
+		WL_ERR(("No WPSIE in beacon \n"));
+	}
+	return 0;
+}
+
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+	2, 0))
+static s32
+wl_cfg80211_del_station(
+	struct wiphy *wiphy,
+	struct net_device *ndev,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
+	struct station_del_parameters *params
+#else
+	u8* mac_addr
+#endif
+	)
+{
+	struct net_device *dev;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0))
+	const u8 *mac_addr = params->mac;
+#endif
+	scb_val_t scb_val;
+	s8 eabuf[ETHER_ADDR_STR_LEN];
+	int err;
+	char mac_buf[MAX_NUM_OF_ASSOCIATED_DEV *
+		sizeof(struct ether_addr) + sizeof(uint)] = {0};
+	struct maclist *assoc_maclist = (struct maclist *)mac_buf;
+	int num_associated = 0;
+
+	WL_DBG(("Entry\n"));
+	if (mac_addr == NULL) {
+		WL_DBG(("mac_addr is NULL ignore it\n"));
+		return 0;
+	}
+
+	dev = ndev_to_wlc_ndev(ndev, cfg);
+
+	if (p2p_is_on(cfg)) {
+		/* Suspend P2P discovery search-listen to prevent it from changing the
+		 * channel.
+		 */
+		if ((wl_cfgp2p_discover_enable_search(cfg, false)) < 0) {
+			WL_ERR(("Can not disable discovery mode\n"));
+			return -EFAULT;
+		}
+	}
+
+	assoc_maclist->count = MAX_NUM_OF_ASSOCIATED_DEV;
+	err = wldev_ioctl(ndev, WLC_GET_ASSOCLIST,
+		assoc_maclist, sizeof(mac_buf), false);
+	if (err < 0)
+		WL_ERR(("WLC_GET_ASSOCLIST error %d\n", err));
+	else
+		num_associated = assoc_maclist->count;
+
+	memcpy(scb_val.ea.octet, mac_addr, ETHER_ADDR_LEN);
+	scb_val.val = DOT11_RC_DEAUTH_LEAVING;
+	err = wldev_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scb_val,
+		sizeof(scb_val_t), true);
+	if (err < 0)
+		WL_ERR(("WLC_SCB_DEAUTHENTICATE_FOR_REASON err %d\n", err));
+	printf("Disconnect STA : %s scb_val.val %d\n",
+		bcm_ether_ntoa((const struct ether_addr *)mac_addr, eabuf),
+		scb_val.val);
+
+	if (num_associated > 0 && ETHER_ISBCAST(mac_addr))
+		wl_delay(400);
+
+	return 0;
+}
+
+static s32
+wl_cfg80211_change_station(
+	struct wiphy *wiphy,
+	struct net_device *dev,
+	NL_u8 *mac,
+	struct station_parameters *params)
+{
+	int err;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	/* Processing only authorize/de-authorize flag for now */
+	if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
+		return -ENOTSUPP;
+
+	if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))) {
+		err = wldev_ioctl(primary_ndev, WLC_SCB_DEAUTHORIZE, (void*)mac, ETH_ALEN, true);
+		if (err)
+			WL_ERR(("WLC_SCB_DEAUTHORIZE error (%d)\n", err));
+		return err;
+	}
+
+	err = wldev_ioctl(primary_ndev, WLC_SCB_AUTHORIZE, (void*)mac, ETH_ALEN, true);
+	if (err)
+		WL_ERR(("WLC_SCB_AUTHORIZE error (%d)\n", err));
+	return err;
+}
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VER >= KERNEL_VERSION(3, 2, 0)) */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32
+wl_cfg80211_start_ap(
+	struct wiphy *wiphy,
+	struct net_device *dev,
+	struct cfg80211_ap_settings *info)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 err = BCME_OK;
+	struct parsed_ies ies;
+	s32 bssidx = 0;
+	u32 dev_role = 0;
+
+	WL_DBG(("Enter \n"));
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		WL_DBG(("Start AP req on primary iface: Softap\n"));
+		dev_role = NL80211_IFTYPE_AP;
+	}
+#if defined(WL_ENABLE_P2P_IF)
+	else if (dev == cfg->p2p_net) {
+		/* Group Add request on p2p0 */
+		WL_DBG(("Start AP req on P2P iface: GO\n"));
+#ifndef  P2PONEINT
+		dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+#endif /* WL_ENABLE_P2P_IF */
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	if (p2p_is_on(cfg) &&
+		(bssidx == wl_to_p2p_bss_bssidx(cfg,
+		P2PAPI_BSSCFG_CONNECTION))) {
+		dev_role = NL80211_IFTYPE_P2P_GO;
+		WL_DBG(("Start AP req on P2P connection iface\n"));
+	}
+
+	if (!check_dev_role_integrity(cfg, dev_role))
+		goto fail;
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 6, 0)) && !defined(WL_COMPAT_WIRELESS))
+	if ((err = wl_cfg80211_set_channel(wiphy, dev,
+		dev->ieee80211_ptr->preset_chandef.chan,
+		dev->ieee80211_ptr->preset_chandef) < 0)) {
+		WL_ERR(("Set channel failed \n"));
+		goto fail;
+	}
+#endif /* ((LINUX_VERSION >= VERSION(3, 6, 0) && !WL_COMPAT_WIRELESS) */
+
+	if ((err = wl_cfg80211_bcn_set_params(info, dev,
+		dev_role, bssidx)) < 0) {
+		WL_ERR(("Beacon params set failed \n"));
+		goto fail;
+	}
+
+	/* Parse IEs */
+	if ((err = wl_cfg80211_parse_ap_ies(dev, &info->beacon, &ies)) < 0) {
+		WL_ERR(("Set IEs failed \n"));
+		goto fail;
+	}
+
+	if ((wl_cfg80211_bcn_validate_sec(dev, &ies,
+		dev_role, bssidx)) < 0)
+	{
+		WL_ERR(("Beacon set security failed \n"));
+		goto fail;
+	}
+
+	if ((err = wl_cfg80211_bcn_bringup_ap(dev, &ies,
+		dev_role, bssidx)) < 0) {
+		WL_ERR(("Beacon bring up AP/GO failed \n"));
+		goto fail;
+	}
+
+	WL_DBG(("** AP/GO Created **\n"));
+
+#ifdef WL_CFG80211_ACL
+	/* Enfoce Admission Control. */
+	if ((err = wl_cfg80211_set_mac_acl(wiphy, dev, info->acl)) < 0) {
+		WL_ERR(("Set ACL failed\n"));
+	}
+#endif /* WL_CFG80211_ACL */
+
+	/* Set IEs to FW */
+	if ((err = wl_cfg80211_set_ies(dev, &info->beacon, bssidx)) < 0)
+		WL_ERR(("Set IEs failed \n"));
+
+	/* Enable Probe Req filter, WPS-AP certification 4.2.13 */
+	if ((dev_role == NL80211_IFTYPE_AP) && (ies.wps_ie != NULL)) {
+		bool pbc = 0;
+		wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+		if (pbc) {
+			WL_DBG(("set WLC_E_PROBREQ_MSG\n"));
+			wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+		}
+	}
+
+fail:
+	if (err) {
+		WL_ERR(("ADD/SET beacon failed\n"));
+		wldev_iovar_setint(dev, "mpc", 1);
+	}
+
+	return err;
+}
+
+static s32
+wl_cfg80211_stop_ap(
+	struct wiphy *wiphy,
+	struct net_device *dev)
+{
+	int err = 0;
+	u32 dev_role = 0;
+	int infra = 0;
+	int ap = 0;
+	s32 bssidx = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+	WL_DBG(("Enter \n"));
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		dev_role = NL80211_IFTYPE_AP;
+	}
+#if defined(WL_ENABLE_P2P_IF)
+	else if (dev == cfg->p2p_net) {
+		/* Group Add request on p2p0 */
+#ifndef  P2PONEINT
+		dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+#endif /* WL_ENABLE_P2P_IF */
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	if (p2p_is_on(cfg) &&
+		(bssidx == wl_to_p2p_bss_bssidx(cfg,
+		P2PAPI_BSSCFG_CONNECTION))) {
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+
+	if (!check_dev_role_integrity(cfg, dev_role))
+		goto exit;
+
+	if (dev_role == NL80211_IFTYPE_AP) {
+		/* SoftAp on primary Interface.
+		 * Shut down AP and turn on MPC
+		 */
+		if ((err = wldev_ioctl(dev, WLC_SET_AP, &ap, sizeof(s32), true)) < 0) {
+			WL_ERR(("setting AP mode failed %d \n", err));
+			err = -ENOTSUPP;
+			goto exit;
+		}
+		err = wldev_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(s32), true);
+		if (err < 0) {
+			WL_ERR(("SET INFRA error %d\n", err));
+			err = -ENOTSUPP;
+			goto exit;
+		}
+
+		err = wldev_ioctl(dev, WLC_UP, &ap, sizeof(s32), true);
+		if (unlikely(err)) {
+			WL_ERR(("WLC_UP error (%d)\n", err));
+			err = -EINVAL;
+			goto exit;
+		}
+
+		wl_clr_drv_status(cfg, AP_CREATED, dev);
+		/* Turn on the MPC */
+		wldev_iovar_setint(dev, "mpc", 1);
+		if (cfg->ap_info) {
+			kfree(cfg->ap_info->wpa_ie);
+			kfree(cfg->ap_info->rsn_ie);
+			kfree(cfg->ap_info->wps_ie);
+			kfree(cfg->ap_info);
+			cfg->ap_info = NULL;
+		}
+	} else {
+		WL_DBG(("Stopping P2P GO \n"));
+		DHD_OS_WAKE_LOCK_CTRL_TIMEOUT_ENABLE((dhd_pub_t *)(cfg->pub),
+			DHD_EVENT_TIMEOUT_MS*3);
+		DHD_OS_WAKE_LOCK_TIMEOUT((dhd_pub_t *)(cfg->pub));
+	}
+
+exit:
+	return err;
+}
+
+static s32
+wl_cfg80211_change_beacon(
+	struct wiphy *wiphy,
+	struct net_device *dev,
+	struct cfg80211_beacon_data *info)
+{
+	s32 err = BCME_OK;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct parsed_ies ies;
+	u32 dev_role = 0;
+	s32 bssidx = 0;
+	bool pbc = 0;
+
+	WL_DBG(("Enter \n"));
+
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		dev_role = NL80211_IFTYPE_AP;
+	}
+#if defined(WL_ENABLE_P2P_IF)
+	else if (dev == cfg->p2p_net) {
+		/* Group Add request on p2p0 */
+#ifndef  P2PONEINT
+		dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+#endif /* WL_ENABLE_P2P_IF */
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	if (p2p_is_on(cfg) &&
+		(bssidx == wl_to_p2p_bss_bssidx(cfg,
+		P2PAPI_BSSCFG_CONNECTION))) {
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+
+	if (!check_dev_role_integrity(cfg, dev_role))
+		goto fail;
+
+	if ((dev_role == NL80211_IFTYPE_P2P_GO) && (cfg->p2p_wdev == NULL)) {
+		WL_ERR(("P2P already down status!\n"));
+		err = BCME_ERROR;
+		goto fail;
+	}
+
+	/* Parse IEs */
+	if ((err = wl_cfg80211_parse_ap_ies(dev, info, &ies)) < 0) {
+		WL_ERR(("Parse IEs failed \n"));
+		goto fail;
+	}
+
+	/* Set IEs to FW */
+	if ((err = wl_cfg80211_set_ies(dev, info, bssidx)) < 0) {
+		WL_ERR(("Set IEs failed \n"));
+		goto fail;
+	}
+
+	if (dev_role == NL80211_IFTYPE_AP) {
+		if (wl_cfg80211_hostapd_sec(dev, &ies, bssidx) < 0) {
+			WL_ERR(("Hostapd update sec failed \n"));
+			err = -EINVAL;
+			goto fail;
+		}
+		/* Enable Probe Req filter, WPS-AP certification 4.2.13 */
+		if ((dev_role == NL80211_IFTYPE_AP) && (ies.wps_ie != NULL)) {
+			wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+			WL_DBG((" WPS AP, wps_ie is exists pbc=%d\n", pbc));
+			if (pbc)
+				wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+			else
+				wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, false);
+		}
+	}
+
+fail:
+	return err;
+}
+#else
+static s32
+wl_cfg80211_add_set_beacon(struct wiphy *wiphy, struct net_device *dev,
+	struct beacon_parameters *info)
+{
+	s32 err = BCME_OK;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	s32 ie_offset = 0;
+	s32 bssidx = 0;
+	u32 dev_role = NL80211_IFTYPE_AP;
+	struct parsed_ies ies;
+	bcm_tlv_t *ssid_ie;
+	bool pbc = 0;
+	WL_DBG(("interval (%d) dtim_period (%d) head_len (%d) tail_len (%d)\n",
+		info->interval, info->dtim_period, info->head_len, info->tail_len));
+
+	if (dev == bcmcfg_to_prmry_ndev(cfg)) {
+		dev_role = NL80211_IFTYPE_AP;
+	}
+#if defined(WL_ENABLE_P2P_IF)
+	else if (dev == cfg->p2p_net) {
+		/* Group Add request on p2p0 */
+#ifndef  P2PONEINT
+		dev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+#endif /* WL_ENABLE_P2P_IF */
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+		return BCME_ERROR;
+	}
+	if (p2p_is_on(cfg) &&
+		(bssidx == wl_to_p2p_bss_bssidx(cfg,
+		P2PAPI_BSSCFG_CONNECTION))) {
+		dev_role = NL80211_IFTYPE_P2P_GO;
+	}
+
+	if (!check_dev_role_integrity(cfg, dev_role))
+		goto fail;
+
+	if ((dev_role == NL80211_IFTYPE_P2P_GO) && (cfg->p2p_wdev == NULL)) {
+		WL_ERR(("P2P already down status!\n"));
+		err = BCME_ERROR;
+		goto fail;
+	}
+
+	ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
+	/* find the SSID */
+	if ((ssid_ie = bcm_parse_tlvs((u8 *)&info->head[ie_offset],
+		info->head_len - ie_offset,
+		DOT11_MNG_SSID_ID)) != NULL) {
+		if (dev_role == NL80211_IFTYPE_AP) {
+			/* Store the hostapd SSID */
+			memset(&cfg->hostapd_ssid.SSID[0], 0x00, 32);
+			memcpy(&cfg->hostapd_ssid.SSID[0], ssid_ie->data, ssid_ie->len);
+			cfg->hostapd_ssid.SSID_len = ssid_ie->len;
+		} else {
+				/* P2P GO */
+			memset(&cfg->p2p->ssid.SSID[0], 0x00, 32);
+			memcpy(cfg->p2p->ssid.SSID, ssid_ie->data, ssid_ie->len);
+			cfg->p2p->ssid.SSID_len = ssid_ie->len;
+		}
+	}
+
+	if (wl_cfg80211_parse_ies((u8 *)info->tail,
+		info->tail_len, &ies) < 0) {
+		WL_ERR(("Beacon get IEs failed \n"));
+		err = -EINVAL;
+		goto fail;
+	}
+
+	if (wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+		VNDR_IE_BEACON_FLAG, (u8 *)info->tail,
+		info->tail_len) < 0) {
+		WL_ERR(("Beacon set IEs failed \n"));
+		goto fail;
+	} else {
+		WL_DBG(("Applied Vndr IEs for Beacon \n"));
+	}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+	if (wl_cfgp2p_set_management_ie(cfg, dev, bssidx,
+		VNDR_IE_PRBRSP_FLAG, (u8 *)info->proberesp_ies,
+		info->proberesp_ies_len) < 0) {
+		WL_ERR(("ProbeRsp set IEs failed \n"));
+		goto fail;
+	} else {
+		WL_DBG(("Applied Vndr IEs for ProbeRsp \n"));
+	}
+#endif
+
+	if (!wl_cfgp2p_bss_isup(dev, bssidx) &&
+		(wl_cfg80211_bcn_validate_sec(dev, &ies, dev_role, bssidx) < 0))
+	{
+		WL_ERR(("Beacon set security failed \n"));
+		goto fail;
+	}
+
+	/* Set BI and DTIM period */
+	if (info->interval) {
+		if ((err = wldev_ioctl(dev, WLC_SET_BCNPRD,
+			&info->interval, sizeof(s32), true)) < 0) {
+			WL_ERR(("Beacon Interval Set Error, %d\n", err));
+			return err;
+		}
+	}
+	if (info->dtim_period) {
+		if ((err = wldev_ioctl(dev, WLC_SET_DTIMPRD,
+			&info->dtim_period, sizeof(s32), true)) < 0) {
+			WL_ERR(("DTIM Interval Set Error, %d\n", err));
+			return err;
+		}
+	}
+
+	if (wl_cfg80211_bcn_bringup_ap(dev, &ies, dev_role, bssidx) < 0) {
+		WL_ERR(("Beacon bring up AP/GO failed \n"));
+		goto fail;
+	}
+
+	if (wl_get_drv_status(cfg, AP_CREATED, dev)) {
+		/* Soft AP already running. Update changed params */
+		if (wl_cfg80211_hostapd_sec(dev, &ies, bssidx) < 0) {
+			WL_ERR(("Hostapd update sec failed \n"));
+			err = -EINVAL;
+			goto fail;
+		}
+	}
+
+	/* Enable Probe Req filter */
+	if (((dev_role == NL80211_IFTYPE_P2P_GO) ||
+		(dev_role == NL80211_IFTYPE_AP)) && (ies.wps_ie != NULL)) {
+		wl_validate_wps_ie((char *) ies.wps_ie, ies.wps_ie_len, &pbc);
+		if (pbc)
+			wl_add_remove_eventmsg(dev, WLC_E_PROBREQ_MSG, true);
+	}
+
+	WL_DBG(("** ADD/SET beacon done **\n"));
+
+fail:
+	if (err) {
+		WL_ERR(("ADD/SET beacon failed\n"));
+		wldev_iovar_setint(dev, "mpc", 1);
+	}
+	return err;
+
+}
+#endif /* LINUX_VERSION < VERSION(3,4,0) || WL_COMPAT_WIRELESS */
+
+#ifdef WL_SCHED_SCAN
+#define PNO_TIME		30
+#define PNO_REPEAT		4
+#define PNO_FREQ_EXPO_MAX	2
+static int
+wl_cfg80211_sched_scan_start(struct wiphy *wiphy,
+                             struct net_device *dev,
+                             struct cfg80211_sched_scan_request *request)
+{
+	ushort pno_time = PNO_TIME;
+	int pno_repeat = PNO_REPEAT;
+	int pno_freq_expo_max = PNO_FREQ_EXPO_MAX;
+	wlc_ssid_t ssids_local[MAX_PFN_LIST_COUNT];
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct cfg80211_ssid *ssid = NULL;
+	int ssid_count = 0;
+	int i;
+	int ret = 0;
+
+	WL_DBG(("Enter \n"));
+	WL_PNO((">>> SCHED SCAN START\n"));
+	WL_PNO(("Enter n_match_sets:%d   n_ssids:%d \n",
+		request->n_match_sets, request->n_ssids));
+	WL_PNO(("ssids:%d pno_time:%d pno_repeat:%d pno_freq:%d \n",
+		request->n_ssids, pno_time, pno_repeat, pno_freq_expo_max));
+
+
+	if (!request || !request->n_ssids || !request->n_match_sets) {
+		WL_ERR(("Invalid sched scan req!! n_ssids:%d \n", request->n_ssids));
+		return -EINVAL;
+	}
+
+	memset(&ssids_local, 0, sizeof(ssids_local));
+
+	if (request->n_match_sets > 0) {
+		for (i = 0; i < request->n_match_sets; i++) {
+			ssid = &request->match_sets[i].ssid;
+			memcpy(ssids_local[i].SSID, ssid->ssid, ssid->ssid_len);
+			ssids_local[i].SSID_len = ssid->ssid_len;
+			WL_PNO((">>> PNO filter set for ssid (%s) \n", ssid->ssid));
+			ssid_count++;
+		}
+	}
+
+	if (request->n_ssids > 0) {
+		for (i = 0; i < request->n_ssids; i++) {
+			/* Active scan req for ssids */
+			WL_PNO((">>> Active scan req for ssid (%s) \n", request->ssids[i].ssid));
+
+			/* match_set ssids is a supert set of n_ssid list, so we need
+			 * not add these set seperately
+			 */
+		}
+	}
+
+	if (ssid_count) {
+		if ((ret = dhd_dev_pno_set_for_ssid(dev, ssids_local, request->n_match_sets,
+			pno_time, pno_repeat, pno_freq_expo_max, NULL, 0)) < 0) {
+			WL_ERR(("PNO setup failed!! ret=%d \n", ret));
+			return -EINVAL;
+		}
+		cfg->sched_scan_req = request;
+	} else {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int
+wl_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+	WL_DBG(("Enter \n"));
+	WL_PNO((">>> SCHED SCAN STOP\n"));
+
+	if (dhd_dev_pno_stop_for_ssid(dev) < 0)
+		WL_ERR(("PNO Stop for SSID failed"));
+
+	if (cfg->scan_request && cfg->sched_scan_running) {
+		WL_PNO((">>> Sched scan running. Aborting it..\n"));
+		wl_notify_escan_complete(cfg, dev, true, true);
+	}
+
+	 cfg->sched_scan_req = NULL;
+	 cfg->sched_scan_running = FALSE;
+
+	return 0;
+}
+#endif /* WL_SCHED_SCAN */
+
+#ifdef WL_SUPPORT_ACS
+/*
+ * Currently the dump_obss IOVAR is returning string as output so we need to
+ * parse the output buffer in an unoptimized way. Going forward if we get the
+ * IOVAR output in binary format this method can be optimized
+ */
+static int wl_parse_dump_obss(char *buf, struct wl_dump_survey *survey)
+{
+	int i;
+	char *token;
+	char delim[] = " \n";
+
+	token = strsep(&buf, delim);
+	while (token != NULL) {
+		if (!strcmp(token, "OBSS")) {
+			for (i = 0; i < OBSS_TOKEN_IDX; i++)
+				token = strsep(&buf, delim);
+			survey->obss = simple_strtoul(token, NULL, 10);
+		}
+
+		if (!strcmp(token, "IBSS")) {
+			for (i = 0; i < IBSS_TOKEN_IDX; i++)
+				token = strsep(&buf, delim);
+			survey->ibss = simple_strtoul(token, NULL, 10);
+		}
+
+		if (!strcmp(token, "TXDur")) {
+			for (i = 0; i < TX_TOKEN_IDX; i++)
+				token = strsep(&buf, delim);
+			survey->tx = simple_strtoul(token, NULL, 10);
+		}
+
+		if (!strcmp(token, "Category")) {
+			for (i = 0; i < CTG_TOKEN_IDX; i++)
+				token = strsep(&buf, delim);
+			survey->no_ctg = simple_strtoul(token, NULL, 10);
+		}
+
+		if (!strcmp(token, "Packet")) {
+			for (i = 0; i < PKT_TOKEN_IDX; i++)
+				token = strsep(&buf, delim);
+			survey->no_pckt = simple_strtoul(token, NULL, 10);
+		}
+
+		if (!strcmp(token, "Opp(time):")) {
+			for (i = 0; i < IDLE_TOKEN_IDX; i++)
+				token = strsep(&buf, delim);
+			survey->idle = simple_strtoul(token, NULL, 10);
+		}
+
+		token = strsep(&buf, delim);
+	}
+
+	return 0;
+}
+
+static int wl_dump_obss(struct net_device *ndev, cca_msrmnt_query req,
+	struct wl_dump_survey *survey)
+{
+	cca_stats_n_flags *results;
+	char *buf;
+	int retry, err;
+
+	buf = kzalloc(sizeof(char) * WLC_IOCTL_MAXLEN, GFP_KERNEL);
+	if (unlikely(!buf)) {
+		WL_ERR(("%s: buf alloc failed\n", __func__));
+		return -ENOMEM;
+	}
+
+	retry = IOCTL_RETRY_COUNT;
+	while (retry--) {
+		err = wldev_iovar_getbuf(ndev, "dump_obss", &req, sizeof(req),
+			buf, WLC_IOCTL_MAXLEN, NULL);
+		if (err >=  0) {
+			break;
+		}
+		WL_DBG(("attempt = %d, err = %d, \n",
+			(IOCTL_RETRY_COUNT - retry), err));
+	}
+
+	if (retry <= 0)	{
+		WL_ERR(("failure, dump_obss IOVAR failed\n"));
+		err = -BCME_ERROR;
+		goto exit;
+	}
+
+	results = (cca_stats_n_flags *)(buf);
+	wl_parse_dump_obss(results->buf, survey);
+	kfree(buf);
+
+	return 0;
+exit:
+	kfree(buf);
+	return err;
+}
+
+static int wl_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
+	int idx, struct survey_info *info)
+{
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+	struct wl_dump_survey *survey;
+	struct ieee80211_supported_band *band;
+	struct ieee80211_channel*chan;
+	cca_msrmnt_query req;
+	int val, err, noise, retry;
+
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+	if (!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+		return -ENOENT;
+	}
+	band = wiphy->bands[NL80211_BAND_2GHZ];
+	if (band && idx >= band->n_channels) {
+		idx -= band->n_channels;
+		band = NULL;
+	}
+
+	if (!band || idx >= band->n_channels) {
+		/* Move to 5G band */
+		band = wiphy->bands[NL80211_BAND_5GHZ];
+		if (idx >= band->n_channels) {
+			return -ENOENT;
+		}
+	}
+
+	chan = &band->channels[idx];
+	/* Setting current channel to the requested channel */
+	if ((err = wl_cfg80211_set_channel(wiphy, ndev, chan,
+		NL80211_CHAN_HT20) < 0)) {
+		WL_ERR(("Set channel failed \n"));
+	}
+
+	if (!idx) {
+		/* Disable mpc */
+		val = 0;
+		err = wldev_iovar_setbuf_bsscfg(ndev, "mpc", (void *)&val,
+			sizeof(val), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+			&cfg->ioctl_buf_sync);
+		if (err < 0) {
+			WL_ERR(("set 'mpc' failed, error = %d\n", err));
+		}
+
+		/* Set interface up, explicitly. */
+		val = 1;
+		err = wldev_ioctl(ndev, WLC_UP, (void *)&val, sizeof(val), true);
+		if (err < 0) {
+			WL_ERR(("set interface up failed, error = %d\n", err));
+		}
+	}
+
+	/* Get noise value */
+	retry = IOCTL_RETRY_COUNT;
+	while (retry--) {
+		err = wldev_ioctl(ndev, WLC_GET_PHY_NOISE, &noise,
+			sizeof(noise), false);
+		if (err >=  0) {
+			break;
+		}
+		WL_DBG(("attempt = %d, err = %d, \n",
+			(IOCTL_RETRY_COUNT - retry), err));
+	}
+
+	if (retry <= 0)	{
+		WL_ERR(("Get Phy Noise failed, error = %d\n", err));
+		noise = CHAN_NOISE_DUMMY;
+	}
+
+	survey = (struct wl_dump_survey *) kzalloc(sizeof(struct wl_dump_survey),
+		GFP_KERNEL);
+	if (unlikely(!survey)) {
+		WL_ERR(("%s: alloc failed\n", __func__));
+		return -ENOMEM;
+	}
+
+	/* Start Measurement for obss stats on current channel */
+	req.msrmnt_query = 0;
+	req.time_req = ACS_MSRMNT_DELAY;
+	if ((err = wl_dump_obss(ndev, req, survey)) < 0) {
+		goto exit;
+	}
+
+	/*
+	 * Wait for the meaurement to complete, adding a buffer value of 10 to take
+	 * into consideration any delay in IOVAR completion
+	 */
+	msleep(ACS_MSRMNT_DELAY + 10);
+
+	/* Issue IOVAR to collect measurement results */
+	req.msrmnt_query = 1;
+	if ((err = wl_dump_obss(ndev, req, survey)) < 0) {
+		goto exit;
+	}
+
+	info->channel = chan;
+	info->noise = noise;
+	info->channel_time = ACS_MSRMNT_DELAY;
+	info->channel_time_busy = ACS_MSRMNT_DELAY - survey->idle;
+	info->channel_time_rx = survey->obss + survey->ibss + survey->no_ctg +
+		survey->no_pckt;
+	info->channel_time_tx = survey->tx;
+	info->filled = SURVEY_INFO_NOISE_DBM |SURVEY_INFO_CHANNEL_TIME |
+		SURVEY_INFO_CHANNEL_TIME_BUSY |	SURVEY_INFO_CHANNEL_TIME_RX |
+		SURVEY_INFO_CHANNEL_TIME_TX;
+	kfree(survey);
+
+	return 0;
+exit:
+	kfree(survey);
+	return err;
+}
+#endif /* WL_SUPPORT_ACS */
+
+static struct cfg80211_ops wl_cfg80211_ops = {
+	.add_virtual_intf = wl_cfg80211_add_virtual_iface,
+	.del_virtual_intf = wl_cfg80211_del_virtual_iface,
+	.change_virtual_intf = wl_cfg80211_change_virtual_iface,
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	.start_p2p_device = wl_cfgp2p_start_p2p_device,
+	.stop_p2p_device = wl_cfgp2p_stop_p2p_device,
+#endif /* WL_CFG80211_P2P_DEV_IF */
+	.scan = wl_cfg80211_scan,
+	.set_wiphy_params = wl_cfg80211_set_wiphy_params,
+	.join_ibss = wl_cfg80211_join_ibss,
+	.leave_ibss = wl_cfg80211_leave_ibss,
+	.get_station = wl_cfg80211_get_station,
+	.set_tx_power = wl_cfg80211_set_tx_power,
+	.get_tx_power = wl_cfg80211_get_tx_power,
+	.add_key = wl_cfg80211_add_key,
+	.del_key = wl_cfg80211_del_key,
+	.get_key = wl_cfg80211_get_key,
+	.set_default_key = wl_cfg80211_config_default_key,
+	.set_default_mgmt_key = wl_cfg80211_config_default_mgmt_key,
+	.set_power_mgmt = wl_cfg80211_set_power_mgmt,
+	.connect = wl_cfg80211_connect,
+	.disconnect = wl_cfg80211_disconnect,
+	.suspend = wl_cfg80211_suspend,
+	.resume = wl_cfg80211_resume,
+	.set_pmksa = wl_cfg80211_set_pmksa,
+	.del_pmksa = wl_cfg80211_del_pmksa,
+	.flush_pmksa = wl_cfg80211_flush_pmksa,
+	.remain_on_channel = wl_cfg80211_remain_on_channel,
+	.cancel_remain_on_channel = wl_cfg80211_cancel_remain_on_channel,
+	.mgmt_tx = wl_cfg80211_mgmt_tx,
+	.mgmt_frame_register = wl_cfg80211_mgmt_frame_register,
+	.change_bss = wl_cfg80211_change_bss,
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 6, 0)) || defined(WL_COMPAT_WIRELESS)
+	.set_channel = wl_cfg80211_set_channel,
+#endif /* ((LINUX_VERSION < VERSION(3, 6, 0)) || WL_COMPAT_WIRELESS */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 4, 0)) && !defined(WL_COMPAT_WIRELESS)
+	.set_beacon = wl_cfg80211_add_set_beacon,
+	.add_beacon = wl_cfg80211_add_set_beacon,
+#else
+	.change_beacon = wl_cfg80211_change_beacon,
+	.start_ap = wl_cfg80211_start_ap,
+	.stop_ap = wl_cfg80211_stop_ap,
+#endif /* LINUX_VERSION < KERNEL_VERSION(3,4,0) && !WL_COMPAT_WIRELESS */
+#ifdef WL_SCHED_SCAN
+	.sched_scan_start = wl_cfg80211_sched_scan_start,
+	.sched_scan_stop = wl_cfg80211_sched_scan_stop,
+#endif /* WL_SCHED_SCAN */
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+	2, 0))
+	.del_station = wl_cfg80211_del_station,
+	.change_station = wl_cfg80211_change_station,
+	.mgmt_tx_cancel_wait = wl_cfg80211_mgmt_tx_cancel_wait,
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES || KERNEL_VERSION >= (3,2,0) */
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+	.tdls_mgmt = wl_cfg80211_tdls_mgmt,
+	.tdls_oper = wl_cfg80211_tdls_oper,
+#endif /* LINUX_VERSION > VERSION(3, 2, 0) || WL_COMPAT_WIRELESS */
+#ifdef WL_SUPPORT_ACS
+	.dump_survey = wl_cfg80211_dump_survey,
+#endif /* WL_SUPPORT_ACS */
+#ifdef WL_CFG80211_ACL
+	.set_mac_acl = wl_cfg80211_set_mac_acl,
+#endif /* WL_CFG80211_ACL */
+};
+
+s32 wl_mode_to_nl80211_iftype(s32 mode)
+{
+	s32 err = 0;
+
+	switch (mode) {
+	case WL_MODE_BSS:
+		return NL80211_IFTYPE_STATION;
+	case WL_MODE_IBSS:
+		return NL80211_IFTYPE_ADHOC;
+	case WL_MODE_AP:
+		return NL80211_IFTYPE_AP;
+	default:
+		return NL80211_IFTYPE_UNSPECIFIED;
+	}
+
+	return err;
+}
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+static int
+wl_cfg80211_reg_notifier(
+	struct wiphy *wiphy,
+	struct regulatory_request *request)
+{
+	struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)wiphy_priv(wiphy);
+	int ret = 0;
+
+	if (!request || !cfg) {
+		WL_ERR(("Invalid arg\n"));
+		return -EINVAL;
+	}
+
+	WL_DBG(("ccode: %c%c Initiator: %d\n",
+		request->alpha2[0], request->alpha2[1], request->initiator));
+
+	/* We support only REGDOM_SET_BY_USER as of now */
+	if ((request->initiator != NL80211_REGDOM_SET_BY_USER) &&
+		(request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+		WL_ERR(("reg_notifier for intiator:%d not supported : set default\n",
+			request->initiator));
+		/* in case of no supported country by regdb
+		     lets driver setup platform default Locale
+		*/
+	}
+
+	WL_ERR(("Set country code %c%c from %s\n",
+		request->alpha2[0], request->alpha2[1],
+		((request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) ? " 11d AP" : "User")));
+
+	if ((ret = wldev_set_country(bcmcfg_to_prmry_ndev(cfg), request->alpha2,
+		false, (request->initiator == NL80211_REGDOM_SET_BY_USER ? true : false))) < 0) {
+		WL_ERR(("set country Failed :%d\n", ret));
+	}
+
+	return ret;
+}
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+#ifdef CONFIG_PM
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+static const struct wiphy_wowlan_support brcm_wowlan_support = {
+	.flags = WIPHY_WOWLAN_ANY,
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0) */
+#endif /* CONFIG_PM */
+
+static s32 wl_setup_wiphy(struct wireless_dev *wdev, struct device *sdiofunc_dev, void *context)
+{
+	s32 err = 0;
+#if 1 && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) || defined(WL_COMPAT_WIRELESS))
+	dhd_pub_t *dhd = (dhd_pub_t *)context;
+	BCM_REFERENCE(dhd);
+
+	if (!dhd) {
+		WL_ERR(("DHD is NULL!!"));
+		err = -ENODEV;
+		return err;
+	}
+#endif
+
+	wdev->wiphy =
+	    wiphy_new(&wl_cfg80211_ops, sizeof(struct bcm_cfg80211));
+	if (unlikely(!wdev->wiphy)) {
+		WL_ERR(("Couldn not allocate wiphy device\n"));
+		err = -ENOMEM;
+		return err;
+	}
+	set_wiphy_dev(wdev->wiphy, sdiofunc_dev);
+	wdev->wiphy->max_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+	/* Report  how many SSIDs Driver can support per Scan request */
+	wdev->wiphy->max_scan_ssids = WL_SCAN_PARAMS_SSID_MAX;
+	wdev->wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
+#ifdef WL_SCHED_SCAN
+	wdev->wiphy->max_sched_scan_ssids = MAX_PFN_LIST_COUNT;
+	wdev->wiphy->max_match_sets = MAX_PFN_LIST_COUNT;
+	wdev->wiphy->max_sched_scan_ie_len = WL_SCAN_IE_LEN_MAX;
+	wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+#endif /* WL_SCHED_SCAN */
+	wdev->wiphy->interface_modes =
+		BIT(NL80211_IFTYPE_STATION)
+		| BIT(NL80211_IFTYPE_ADHOC)
+#if !defined(WL_ENABLE_P2P_IF) && !defined(WL_CFG80211_P2P_DEV_IF)
+		| BIT(NL80211_IFTYPE_MONITOR)
+#endif /* !WL_ENABLE_P2P_IF && !WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF)
+		| BIT(NL80211_IFTYPE_P2P_CLIENT)
+		| BIT(NL80211_IFTYPE_P2P_GO)
+#endif /* WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+		| BIT(NL80211_IFTYPE_P2P_DEVICE)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+		| BIT(NL80211_IFTYPE_AP);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && \
+	(defined(WL_IFACE_COMB_NUM_CHANNELS) || defined(WL_CFG80211_P2P_DEV_IF))
+	WL_DBG(("Setting interface combinations for common mode\n"));
+	wdev->wiphy->iface_combinations = common_iface_combinations;
+	wdev->wiphy->n_iface_combinations =
+		ARRAY_SIZE(common_iface_combinations);
+#endif /* LINUX_VER >= 3.0 && (WL_IFACE_COMB_NUM_CHANNELS || WL_CFG80211_P2P_DEV_IF) */
+
+	wdev->wiphy->bands[NL80211_BAND_2GHZ] = &__wl_band_2ghz;
+
+	wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+	wdev->wiphy->cipher_suites = __wl_cipher_suites;
+	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
+	wdev->wiphy->max_remain_on_channel_duration = 5000;
+	wdev->wiphy->mgmt_stypes = wl_cfg80211_default_mgmt_stypes;
+#ifndef WL_POWERSAVE_DISABLED
+	wdev->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#else
+	wdev->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+#endif				/* !WL_POWERSAVE_DISABLED */
+	wdev->wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+		WIPHY_FLAG_4ADDR_AP |
+#if (LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 39)) && !defined(WL_COMPAT_WIRELESS)
+		WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS |
+#endif
+		WIPHY_FLAG_4ADDR_STATION;
+#if (defined(ROAM_ENABLE) || defined(BCMFW_ROAM_ENABLE)) && ((LINUX_VERSION_CODE >= \
+	KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)) && !0
+	/* Please use supplicant ver >= 76 if FW_ROAM is enabled
+	 * If driver advertises FW_ROAM, older supplicant wouldn't
+	 * send the BSSID & Freq in the connect req command. This
+	 * will delay the ASSOC as the FW need to do a full scan
+	 * before attempting to connect. Supplicant >=76 has patch
+	 * to allow bssid & freq to be sent down to driver even if
+	 * FW ROAM is advertised.
+	 */
+	wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
+#endif
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)) || defined(WL_COMPAT_WIRELESS)
+	wdev->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+		WIPHY_FLAG_OFFCHAN_TX;
+#endif
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+	4, 0))
+	/* From 3.4 kernel ownards AP_SME flag can be advertised
+	 * to remove the patch from supplicant
+	 */
+	wdev->wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
+
+#ifdef WL_CFG80211_ACL
+	/* Configure ACL capabilities. */
+	wdev->wiphy->max_acl_mac_addrs = MAX_NUM_MAC_FILT;
+#endif
+
+#if 1 && (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0) || defined(WL_COMPAT_WIRELESS))
+	/* Supplicant distinguish between the SoftAP mode and other
+	 * modes (e.g. P2P, WPS, HS2.0) when it builds the probe
+	 * response frame from Supplicant MR1 and Kernel 3.4.0 or
+	 * later version. To add Vendor specific IE into the
+	 * probe response frame in case of SoftAP mode,
+	 * AP_PROBE_RESP_OFFLOAD flag is set to wiphy->flags variable.
+	 */
+	if (dhd_get_fw_mode(dhd->info) == DHD_FLAG_HOSTAP_MODE) {
+		wdev->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+		wdev->wiphy->probe_resp_offload = 0;
+	}
+#endif
+#endif /* WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) */
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+	wdev->wiphy->reg_notifier = wl_cfg80211_reg_notifier;
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+	wdev->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
+#endif
+
+#if defined(CONFIG_PM) && defined(WL_CFG80211_P2P_DEV_IF)
+	/*
+	 * From linux-3.10 kernel, wowlan packet filter is mandated to avoid the
+	 * disconnection of connected network before suspend. So a dummy wowlan
+	 * filter is configured for kernels linux-3.8 and above.
+	 */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 0))
+	wdev->wiphy->wowlan = &brcm_wowlan_support;
+#else
+	wdev->wiphy->wowlan.flags = WIPHY_WOWLAN_ANY;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 11, 10) */
+#endif /* CONFIG_PM && WL_CFG80211_P2P_DEV_IF */
+
+	WL_DBG(("Registering custom regulatory)\n"));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 14, 0))
+	wdev->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+#else
+	wdev->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+#endif
+	wiphy_apply_custom_regulatory(wdev->wiphy, &brcm_regdom);
+
+	WL_DBG(("Registering Vendor80211)\n"));
+	err = cfgvendor_attach(wdev->wiphy);
+	if (unlikely(err < 0)) {
+		WL_ERR(("Couldn not attach vendor commands (%d)\n", err));
+	}
+
+	/* Now we can register wiphy with cfg80211 module */
+	err = wiphy_register(wdev->wiphy);
+	if (unlikely(err < 0)) {
+		WL_ERR(("Couldn not register wiphy device (%d)\n", err));
+		wiphy_free(wdev->wiphy);
+	}
+
+#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)) && (LINUX_VERSION_CODE <= \
+	KERNEL_VERSION(3, 3, 0))) && defined(WL_IFACE_COMB_NUM_CHANNELS)
+	wdev->wiphy->flags &= ~WIPHY_FLAG_ENFORCE_COMBINATIONS;
+#endif
+
+	return err;
+}
+
+static void wl_free_wdev(struct bcm_cfg80211 *cfg)
+{
+	struct wireless_dev *wdev = cfg->wdev;
+	struct wiphy *wiphy;
+	if (!wdev) {
+		WL_ERR(("wdev is invalid\n"));
+		return;
+	}
+	wiphy = wdev->wiphy;
+
+	cfgvendor_detach(wdev->wiphy);
+
+	wiphy_unregister(wdev->wiphy);
+	wdev->wiphy->dev.parent = NULL;
+
+	wl_delete_all_netinfo(cfg);
+	wiphy_free(wiphy);
+	/* PLEASE do NOT call any function after wiphy_free, the driver's private structure "cfg",
+	 * which is the private part of wiphy, has been freed in wiphy_free !!!!!!!!!!!
+	 */
+}
+
+static s32 wl_inform_bss(struct bcm_cfg80211 *cfg)
+{
+	struct wl_scan_results *bss_list;
+	struct wl_bss_info *bi = NULL;	/* must be initialized */
+	s32 err = 0;
+	s32 i;
+#if defined(RSSIAVG)
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	int rssi;
+#endif
+#if defined(BSSCACHE)
+	wl_bss_cache_t *node;
+#endif
+
+	bss_list = cfg->bss_list;
+
+#if defined(BSSCACHE)
+	if (p2p_is_on(cfg) && p2p_scan(cfg)) {
+#if defined(RSSIAVG)
+		wl_free_rssi_cache(&g_rssi_cache_ctrl);
+#endif
+		wl_free_bss_cache(&g_bss_cache_ctrl);
+	}
+	wl_update_bss_cache(&g_bss_cache_ctrl, bss_list);
+	wl_delete_dirty_bss_cache(&g_bss_cache_ctrl);
+	wl_reset_bss_cache(&g_bss_cache_ctrl);
+#endif
+
+#if defined(RSSIAVG)
+#if defined(BSSCACHE)
+	node = g_bss_cache_ctrl.m_cache_head;
+	for (;node;) {
+		wl_update_rssi_cache(&g_rssi_cache_ctrl, &node->results);
+		node = node->next;
+	}
+#else
+	wl_update_rssi_cache(&g_rssi_cache_ctrl, bss_list);
+#endif
+	if (!in_atomic())
+		wl_update_connected_rssi_cache(ndev, &g_rssi_cache_ctrl, &rssi);
+	wl_delete_dirty_rssi_cache(&g_rssi_cache_ctrl);
+	wl_reset_rssi_cache(&g_rssi_cache_ctrl);
+#endif
+
+#if defined(BSSCACHE)
+	if (p2p_disconnected > 0) {
+		// terence 20130703: Fix for wrong group_capab (timing issue)
+		wl_delete_disconnected_bss_cache(&g_bss_cache_ctrl, (u8*)&p2p_disconnected_bssid);
+#if defined(RSSIAVG)
+		wl_delete_disconnected_rssi_cache(&g_rssi_cache_ctrl, (u8*)&p2p_disconnected_bssid);
+#endif
+	}
+	WL_SCAN(("Inform cached AP list\n"));
+	node = g_bss_cache_ctrl.m_cache_head;
+	for (i=0; node && i<WL_AP_MAX; i++) {
+		if (node->dirty > 1) {
+			// just inform dirty bss
+			bi = node->results.bss_info;
+			err = wl_inform_single_bss(cfg, bi, false);
+		}
+		node = node->next;
+	}
+	bi = NULL;
+#endif
+
+	WL_SCAN(("scanned AP count (%d)\n", bss_list->count));
+
+	bi = next_bss(bss_list, bi);
+	for_each_bss(bss_list, bi, i) {
+		if (p2p_disconnected > 0 && !memcmp(&bi->BSSID, &p2p_disconnected_bssid, ETHER_ADDR_LEN))
+			continue;
+		err = wl_inform_single_bss(cfg, bi, false);
+	}
+
+	if (p2p_disconnected > 0) {
+		// terence 20130703: Fix for wrong group_capab (timing issue)
+		p2p_disconnected++;
+		if (p2p_disconnected >= REPEATED_SCAN_RESULT_CNT+1)
+			p2p_disconnected = 0;
+	}
+
+	return err;
+}
+
+static s32 wl_inform_single_bss(struct bcm_cfg80211 *cfg, struct wl_bss_info *bi, bool roam)
+{
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	struct ieee80211_mgmt *mgmt;
+	struct ieee80211_channel *channel;
+	struct ieee80211_supported_band *band;
+	struct wl_cfg80211_bss_info *notif_bss_info;
+	struct wl_scan_req *sr = wl_to_sr(cfg);
+	struct beacon_proberesp *beacon_proberesp;
+	struct cfg80211_bss *cbss = NULL;
+	s32 mgmt_type;
+	s32 signal;
+	u32 freq;
+	s32 err = 0;
+	gfp_t aflags;
+
+	if (unlikely(dtoh32(bi->length) > WL_BSS_INFO_MAX)) {
+		WL_DBG(("Beacon is larger than buffer. Discarding\n"));
+		return err;
+	}
+	aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+	notif_bss_info = kzalloc(sizeof(*notif_bss_info) + sizeof(*mgmt)
+		- sizeof(u8) + WL_BSS_INFO_MAX, aflags);
+	if (unlikely(!notif_bss_info)) {
+		WL_ERR(("notif_bss_info alloc failed\n"));
+		return -ENOMEM;
+	}
+	mgmt = (struct ieee80211_mgmt *)notif_bss_info->frame_buf;
+	notif_bss_info->channel =
+		wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+
+	if (notif_bss_info->channel <= CH_MAX_2G_CHANNEL)
+		band = wiphy->bands[NL80211_BAND_2GHZ];
+	else
+		band = wiphy->bands[NL80211_BAND_5GHZ];
+	if (!band) {
+		WL_ERR(("No valid band\n"));
+		kfree(notif_bss_info);
+		return -EINVAL;
+	}
+	notif_bss_info->rssi = dtoh16(bi->RSSI);
+#if defined(RSSIAVG)
+	notif_bss_info->rssi = wl_get_avg_rssi(&g_rssi_cache_ctrl, &bi->BSSID);
+	if (notif_bss_info->rssi == RSSI_MINVAL)
+		notif_bss_info->rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+#endif
+#if defined(RSSIOFFSET)
+	notif_bss_info->rssi = wl_update_rssi_offset(bcmcfg_to_prmry_ndev(cfg), notif_bss_info->rssi);
+#endif
+#if !defined(RSSIAVG) && !defined(RSSIOFFSET)
+	// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+	notif_bss_info->rssi = MIN(notif_bss_info->rssi, RSSI_MAXVAL);
+#endif
+	memcpy(mgmt->bssid, &bi->BSSID, ETHER_ADDR_LEN);
+	mgmt_type = cfg->active_scan ?
+		IEEE80211_STYPE_PROBE_RESP : IEEE80211_STYPE_BEACON;
+	if (!memcmp(bi->SSID, sr->ssid.SSID, bi->SSID_len)) {
+	    mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | mgmt_type);
+	}
+	beacon_proberesp = cfg->active_scan ?
+		(struct beacon_proberesp *)&mgmt->u.probe_resp :
+		(struct beacon_proberesp *)&mgmt->u.beacon;
+	beacon_proberesp->timestamp = 0;
+	beacon_proberesp->beacon_int = cpu_to_le16(bi->beacon_period);
+	beacon_proberesp->capab_info = cpu_to_le16(bi->capability);
+	wl_rst_ie(cfg);
+	wl_update_hidden_ap_ie(bi, ((u8 *) bi) + bi->ie_offset, &bi->ie_length, roam);
+	wl_mrg_ie(cfg, ((u8 *) bi) + bi->ie_offset, bi->ie_length);
+	wl_cp_ie(cfg, beacon_proberesp->variable, WL_BSS_INFO_MAX -
+		offsetof(struct wl_cfg80211_bss_info, frame_buf));
+	notif_bss_info->frame_len = offsetof(struct ieee80211_mgmt,
+		u.beacon.variable) + wl_get_ielen(cfg);
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+	freq = ieee80211_channel_to_frequency(notif_bss_info->channel);
+	(void)band->band;
+#else
+	freq = ieee80211_channel_to_frequency(notif_bss_info->channel, band->band);
+#endif
+	if (freq == 0) {
+		WL_ERR(("Invalid channel, fail to change channel to freq\n"));
+		kfree(notif_bss_info);
+		return -EINVAL;
+	}
+	channel = ieee80211_get_channel(wiphy, freq);
+	WL_SCAN(("BSSID %pM, channel %d, rssi %d, capa 0x04%x, mgmt_type %d, "
+		"frame_len %d, SSID \"%s\"\n", &bi->BSSID, notif_bss_info->channel,
+		notif_bss_info->rssi, mgmt->u.beacon.capab_info, mgmt_type,
+		notif_bss_info->frame_len, bi->SSID));
+	if (unlikely(!channel)) {
+		WL_ERR(("ieee80211_get_channel error, freq=%d, channel=%d\n",
+			freq, notif_bss_info->channel));
+		kfree(notif_bss_info);
+		return -EINVAL;
+	}
+
+	signal = notif_bss_info->rssi * 100;
+	if (!mgmt->u.probe_resp.timestamp) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39))
+		struct timespec ts;
+		get_monotonic_boottime(&ts);
+		mgmt->u.probe_resp.timestamp = ((u64)ts.tv_sec*1000000)
+				+ ts.tv_nsec / 1000;
+#else
+		struct timeval tv;
+		do_gettimeofday(&tv);
+		mgmt->u.probe_resp.timestamp = ((u64)tv.tv_sec*1000000)
+				+ tv.tv_usec;
+#endif
+	}
+
+
+	cbss = cfg80211_inform_bss_frame(wiphy, channel, mgmt,
+		le16_to_cpu(notif_bss_info->frame_len), signal, aflags);
+	if (unlikely(!cbss)) {
+		WL_ERR(("cfg80211_inform_bss_frame error\n"));
+		kfree(notif_bss_info);
+		return -EINVAL;
+	}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+	cfg80211_put_bss(wiphy, cbss);
+#else
+	cfg80211_put_bss(cbss);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+	kfree(notif_bss_info);
+	return err;
+}
+
+static bool wl_is_linkup(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e, struct net_device *ndev)
+{
+	u32 event = ntoh32(e->event_type);
+	u32 status =  ntoh32(e->status);
+	u16 flags = ntoh16(e->flags);
+
+	WL_DBG(("event %d, status %d flags %x\n", event, status, flags));
+	if (event == WLC_E_SET_SSID) {
+		if (status == WLC_E_STATUS_SUCCESS) {
+			if (!wl_is_ibssmode(cfg, ndev))
+				return true;
+		}
+	} else if (event == WLC_E_LINK) {
+		if (flags & WLC_EVENT_MSG_LINK)
+			return true;
+	}
+
+	WL_DBG(("wl_is_linkup false\n"));
+	return false;
+}
+
+static bool wl_is_linkdown(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+	u32 event = ntoh32(e->event_type);
+	u16 flags = ntoh16(e->flags);
+
+	if (event == WLC_E_DEAUTH_IND ||
+	event == WLC_E_DISASSOC_IND ||
+	event == WLC_E_DISASSOC ||
+	event == WLC_E_DEAUTH) {
+#if (WL_DBG_LEVEL > 0)
+	WL_ERR(("Link down Reason : WLC_E_%s\n", wl_dbg_estr[event]));
+#endif /* (WL_DBG_LEVEL > 0) */
+		return true;
+	} else if (event == WLC_E_LINK) {
+		if (!(flags & WLC_EVENT_MSG_LINK)) {
+#if (WL_DBG_LEVEL > 0)
+	WL_ERR(("Link down Reason : WLC_E_%s\n", wl_dbg_estr[event]));
+#endif /* (WL_DBG_LEVEL > 0) */
+			return true;
+		}
+	}
+
+	return false;
+}
+
+static bool wl_is_nonetwork(struct bcm_cfg80211 *cfg, const wl_event_msg_t *e)
+{
+	u32 event = ntoh32(e->event_type);
+	u32 status = ntoh32(e->status);
+
+	if (event == WLC_E_LINK && status == WLC_E_STATUS_NO_NETWORKS)
+		return true;
+	if (event == WLC_E_SET_SSID && status != WLC_E_STATUS_SUCCESS)
+		return true;
+
+	return false;
+}
+
+/* The mainline kernel >= 3.2.0 has support for indicating new/del station
+ * to AP/P2P GO via events. If this change is backported to kernel for which
+ * this driver is being built, then define WL_CFG80211_STA_EVENT. You
+ * should use this new/del sta event mechanism for BRCM supplicant >= 22.
+ */
+static s32
+wl_notify_connect_status_ap(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data)
+{
+	s32 err = 0;
+	u32 event = ntoh32(e->event_type);
+	u32 reason = ntoh32(e->reason);
+	u32 len = ntoh32(e->datalen);
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)) && !defined(WL_CFG80211_STA_EVENT) \
+	&& !defined(WL_COMPAT_WIRELESS)
+	bool isfree = false;
+	u8 *mgmt_frame;
+	u8 bsscfgidx = e->bsscfgidx;
+	s32 freq;
+	s32 channel;
+	u8 *body = NULL;
+	u16 fc = 0;
+
+	struct ieee80211_supported_band *band;
+	struct ether_addr da;
+	struct ether_addr bssid;
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	channel_info_t ci;
+#else
+	struct station_info sinfo;
+#endif /* (LINUX_VERSION < VERSION(3,2,0)) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+
+	WL_DBG(("event %d status %d reason %d\n", event, ntoh32(e->status), reason));
+	/* if link down, bsscfg is disabled. */
+	if (event == WLC_E_LINK && reason == WLC_E_LINK_BSSCFG_DIS &&
+		wl_get_p2p_status(cfg, IF_DELETING) && (ndev != bcmcfg_to_prmry_ndev(cfg))) {
+		wl_add_remove_eventmsg(ndev, WLC_E_PROBREQ_MSG, false);
+		WL_INFORM(("AP mode link down !! \n"));
+		complete(&cfg->iface_disable);
+		return 0;
+	}
+
+	if (event == WLC_E_DISASSOC_IND || event == WLC_E_DEAUTH_IND || event == WLC_E_DEAUTH) {
+		WL_ERR(("event %s(%d) status %d reason %d\n",
+		bcmevent_get_name(event), event, ntoh32(e->status), reason));
+	}
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)) && !defined(WL_CFG80211_STA_EVENT) \
+	&& !defined(WL_COMPAT_WIRELESS)
+	WL_DBG(("Enter \n"));
+	if (!len && (event == WLC_E_DEAUTH)) {
+		len = 2; /* reason code field */
+		data = &reason;
+	}
+	if (len) {
+		body = kzalloc(len, GFP_KERNEL);
+
+		if (body == NULL) {
+			WL_ERR(("wl_notify_connect_status: Failed to allocate body\n"));
+			return WL_INVALID;
+		}
+	}
+	memset(&bssid, 0, ETHER_ADDR_LEN);
+	WL_DBG(("Enter event %d ndev %p\n", event, ndev));
+	if (wl_get_mode_by_netdev(cfg, ndev) == WL_INVALID) {
+		kfree(body);
+		return WL_INVALID;
+	}
+	if (len)
+		memcpy(body, data, len);
+
+	wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+		NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, bsscfgidx, &cfg->ioctl_buf_sync);
+	memcpy(da.octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+	err = wldev_ioctl(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+	switch (event) {
+		case WLC_E_ASSOC_IND:
+			fc = FC_ASSOC_REQ;
+			break;
+		case WLC_E_REASSOC_IND:
+			fc = FC_REASSOC_REQ;
+			break;
+		case WLC_E_DISASSOC_IND:
+			fc = FC_DISASSOC;
+			break;
+		case WLC_E_DEAUTH_IND:
+			fc = FC_DISASSOC;
+			break;
+		case WLC_E_DEAUTH:
+			fc = FC_DISASSOC;
+			break;
+		default:
+			fc = 0;
+			goto exit;
+	}
+	if ((err = wldev_ioctl(ndev, WLC_GET_CHANNEL, &ci, sizeof(ci), false))) {
+		kfree(body);
+		return err;
+	}
+
+	channel = dtoh32(ci.hw_channel);
+	if (channel <= CH_MAX_2G_CHANNEL)
+		band = wiphy->bands[NL80211_BAND_2GHZ];
+	else
+		band = wiphy->bands[NL80211_BAND_5GHZ];
+	if (!band) {
+		WL_ERR(("No valid band\n"));
+		if (body)
+			kfree(body);
+		return -EINVAL;
+	}
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+	freq = ieee80211_channel_to_frequency(channel);
+	(void)band->band;
+#else
+	freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+
+	err = wl_frame_get_mgmt(fc, &da, &e->addr, &bssid,
+		&mgmt_frame, &len, body);
+	if (err < 0)
+		goto exit;
+	isfree = true;
+
+	if (event == WLC_E_ASSOC_IND && reason == DOT11_SC_SUCCESS) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+	defined(WL_COMPAT_WIRELESS)
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+		cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 12, 0) */
+	} else if (event == WLC_E_DISASSOC_IND) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+	defined(WL_COMPAT_WIRELESS)
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+		cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 12, 0) */
+	} else if ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH)) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+	defined(WL_COMPAT_WIRELESS)
+		cfg80211_rx_mgmt(ndev, freq, 0, mgmt_frame, len, GFP_ATOMIC);
+#else
+		cfg80211_rx_mgmt(ndev, freq, mgmt_frame, len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 12, 0) */
+	}
+
+exit:
+	if (isfree)
+		kfree(mgmt_frame);
+	if (body)
+		kfree(body);
+#else /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+	sinfo.filled = 0;
+	if (((event == WLC_E_ASSOC_IND) || (event == WLC_E_REASSOC_IND)) &&
+		reason == DOT11_SC_SUCCESS) {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)
+		sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
+#endif
+		if (!data) {
+			WL_ERR(("No IEs present in ASSOC/REASSOC_IND"));
+			return -EINVAL;
+		}
+		sinfo.assoc_req_ies = data;
+		sinfo.assoc_req_ies_len = len;
+		printf("%s: connected device "MACDBG"\n", __FUNCTION__, MAC2STRDBG(e->addr.octet));
+		cfg80211_new_sta(ndev, e->addr.octet, &sinfo, GFP_ATOMIC);
+	} else if (event == WLC_E_DISASSOC_IND) {
+		printf("%s: disassociated device "MACDBG"\n", __FUNCTION__, MAC2STRDBG(e->addr.octet));
+		cfg80211_del_sta(ndev, e->addr.octet, GFP_ATOMIC);
+	} else if ((event == WLC_E_DEAUTH_IND) || (event == WLC_E_DEAUTH)) {
+		printf("%s: deauthenticated device "MACDBG"\n", __FUNCTION__, MAC2STRDBG(e->addr.octet));
+		cfg80211_del_sta(ndev, e->addr.octet, GFP_ATOMIC);
+	}
+#endif /* LINUX_VERSION < VERSION(3,2,0) && !WL_CFG80211_STA_EVENT && !WL_COMPAT_WIRELESS */
+	return err;
+}
+
+static s32
+wl_get_auth_assoc_status(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e)
+{
+	u32 reason = ntoh32(e->reason);
+	u32 event = ntoh32(e->event_type);
+	struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+	WL_DBG(("event type : %d, reason : %d\n", event, reason));
+	if (sec) {
+		switch (event) {
+		case WLC_E_ASSOC:
+		case WLC_E_AUTH:
+				sec->auth_assoc_res_status = reason;
+		default:
+			break;
+		}
+	} else
+		WL_ERR(("sec is NULL\n"));
+	return 0;
+}
+
+static s32
+wl_notify_connect_status_ibss(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data)
+{
+	s32 err = 0;
+	u32 event = ntoh32(e->event_type);
+	u16 flags = ntoh16(e->flags);
+	u32 status =  ntoh32(e->status);
+	bool active;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+	struct ieee80211_channel *channel = NULL;
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	u32 chanspec, chan;
+	u32 freq, band;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+
+	if (event == WLC_E_JOIN) {
+		WL_DBG(("joined in IBSS network\n"));
+	}
+	if (event == WLC_E_START) {
+		WL_DBG(("started IBSS network\n"));
+	}
+	if (event == WLC_E_JOIN || event == WLC_E_START ||
+		(event == WLC_E_LINK && (flags == WLC_EVENT_MSG_LINK))) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+		err = wldev_iovar_getint(ndev, "chanspec", (s32 *)&chanspec);
+		if (unlikely(err)) {
+			WL_ERR(("Could not get chanspec %d\n", err));
+			return err;
+		}
+		chan = wf_chspec_ctlchan(wl_chspec_driver_to_host(chanspec));
+		band = (chan <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;
+		freq = ieee80211_channel_to_frequency(chan, band);
+		channel = ieee80211_get_channel(wiphy, freq);
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0) */
+		if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+			/* ROAM or Redundant */
+			u8 *cur_bssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+			if (memcmp(cur_bssid, &e->addr, ETHER_ADDR_LEN) == 0) {
+				WL_DBG(("IBSS connected event from same BSSID("
+					MACDBG "), ignore it\n", MAC2STRDBG(cur_bssid)));
+				return err;
+			}
+			WL_INFORM(("IBSS BSSID is changed from " MACDBG " to " MACDBG "\n",
+				MAC2STRDBG(cur_bssid), MAC2STRDBG((u8 *)&e->addr)));
+			wl_get_assoc_ies(cfg, ndev);
+			wl_update_prof(cfg, ndev, NULL, (void *)&e->addr, WL_PROF_BSSID);
+			wl_update_bss_info(cfg, ndev, false);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+			cfg80211_ibss_joined(ndev, (s8 *)&e->addr, channel, GFP_KERNEL);
+#else
+			cfg80211_ibss_joined(ndev, (s8 *)&e->addr, GFP_KERNEL);
+#endif
+		}
+		else {
+			/* New connection */
+			WL_INFORM(("IBSS connected to " MACDBG "\n", MAC2STRDBG((u8 *)&e->addr)));
+			wl_link_up(cfg);
+			wl_get_assoc_ies(cfg, ndev);
+			wl_update_prof(cfg, ndev, NULL, (void *)&e->addr, WL_PROF_BSSID);
+			wl_update_bss_info(cfg, ndev, false);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
+			cfg80211_ibss_joined(ndev, (s8 *)&e->addr, channel, GFP_KERNEL);
+#else
+			cfg80211_ibss_joined(ndev, (s8 *)&e->addr, GFP_KERNEL);
+#endif
+			wl_set_drv_status(cfg, CONNECTED, ndev);
+			active = true;
+			wl_update_prof(cfg, ndev, NULL, (void *)&active, WL_PROF_ACT);
+		}
+	} else if ((event == WLC_E_LINK && !(flags & WLC_EVENT_MSG_LINK)) ||
+		event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND) {
+		wl_clr_drv_status(cfg, CONNECTED, ndev);
+		wl_link_down(cfg);
+		wl_init_prof(cfg, ndev);
+	}
+	else if (event == WLC_E_SET_SSID && status == WLC_E_STATUS_NO_NETWORKS) {
+		WL_DBG(("no action - join fail (IBSS mode)\n"));
+	}
+	else {
+		WL_DBG(("no action (IBSS mode)\n"));
+}
+	return err;
+}
+
+static s32
+wl_notify_connect_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	bool act;
+	struct net_device *ndev = NULL;
+	s32 err = 0;
+	u32 event = ntoh32(e->event_type);
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+		err = wl_notify_connect_status_ap(cfg, ndev, e, data);
+	} else if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_IBSS) {
+		err = wl_notify_connect_status_ibss(cfg, ndev, e, data);
+	} else if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_BSS) {
+		WL_DBG(("wl_notify_connect_status : event %d status : %d ndev %p\n",
+			ntoh32(e->event_type), ntoh32(e->status), ndev));
+		if (event == WLC_E_ASSOC || event == WLC_E_AUTH) {
+			wl_get_auth_assoc_status(cfg, ndev, e);
+			return 0;
+		}
+		if (wl_is_linkup(cfg, e, ndev)) {
+			wl_link_up(cfg);
+			act = true;
+			if (!wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+					printf("wl_bss_connect_done succeeded with " MACDBG "\n",
+						MAC2STRDBG((u8*)(&e->addr)));
+					wl_bss_connect_done(cfg, ndev, e, data, true);
+					dhd_conf_set_phyoclscdenable((dhd_pub_t *)cfg->pub);
+					WL_DBG(("joined in BSS network \"%s\"\n",
+					((struct wlc_ssid *)
+					 wl_read_prof(cfg, ndev, WL_PROF_SSID))->SSID));
+				}
+			wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+			wl_update_prof(cfg, ndev, NULL, (void *)&e->addr, WL_PROF_BSSID);
+			dhd_conf_set_wme((dhd_pub_t *)cfg->pub);
+
+		} else if (wl_is_linkdown(cfg, e)) {
+#ifdef P2PLISTEN_AP_SAMECHN
+			if (ndev == bcmcfg_to_prmry_ndev(cfg)) {
+				wl_cfg80211_set_p2p_resp_ap_chn(ndev, 0);
+				cfg->p2p_resp_apchn_status = false;
+				WL_DBG(("p2p_resp_apchn_status Turn OFF \n"));
+			}
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+			if (cfg->scan_request)
+				wl_notify_escan_complete(cfg, ndev, true, true);
+			if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+				scb_val_t scbval;
+				u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+				s32 reason = 0;
+				if (event == WLC_E_DEAUTH_IND || event == WLC_E_DISASSOC_IND)
+					reason = ntoh32(e->reason);
+				/* WLAN_REASON_UNSPECIFIED is used for hang up event in Android */
+				reason = (reason == WLAN_REASON_UNSPECIFIED)? 0 : reason;
+
+				printf("link down if %s may call cfg80211_disconnected. "
+					"event : %d, reason=%d from " MACDBG "\n",
+					ndev->name, event, ntoh32(e->reason),
+					MAC2STRDBG((u8*)(&e->addr)));
+				if (!cfg->roam_offload &&
+					memcmp(curbssid, &e->addr, ETHER_ADDR_LEN) != 0) {
+					WL_ERR(("BSSID of event is not the connected BSSID"
+						"(ignore it) cur: " MACDBG " event: " MACDBG"\n",
+						MAC2STRDBG(curbssid), MAC2STRDBG((u8*)(&e->addr))));
+					return 0;
+				}
+				if (!memcmp(ndev->name, WL_P2P_INTERFACE_PREFIX, strlen(WL_P2P_INTERFACE_PREFIX))) {
+					// terence 20130703: Fix for wrong group_capab (timing issue)
+					p2p_disconnected = 1;
+					memcpy(&p2p_disconnected_bssid, curbssid, ETHER_ADDR_LEN);
+				}
+				wl_clr_drv_status(cfg, CONNECTED, ndev);
+				if (! wl_get_drv_status(cfg, DISCONNECTING, ndev)) {
+					/* To make sure disconnect, explictly send dissassoc
+					*  for BSSID 00:00:00:00:00:00 issue
+					*/
+					scbval.val = WLAN_REASON_DEAUTH_LEAVING;
+
+					memcpy(&scbval.ea, curbssid, ETHER_ADDR_LEN);
+					scbval.val = htod32(scbval.val);
+					err = wldev_ioctl(ndev, WLC_DISASSOC, &scbval,
+						sizeof(scb_val_t), true);
+					if (err < 0) {
+						WL_ERR(("WLC_DISASSOC error %d\n", err));
+						err = 0;
+					}
+					cfg80211_disconnected(ndev, reason, NULL, 0, true, GFP_KERNEL);
+					wl_link_down(cfg);
+					wl_init_prof(cfg, ndev);
+				}
+			}
+			else if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+				printf("link down, during connecting\n");
+#ifdef ESCAN_RESULT_PATCH
+				if ((memcmp(connect_req_bssid, broad_bssid, ETHER_ADDR_LEN) == 0) ||
+					(memcmp(&e->addr, broad_bssid, ETHER_ADDR_LEN) == 0) ||
+					(memcmp(&e->addr, connect_req_bssid, ETHER_ADDR_LEN) == 0))
+					/* In case this event comes while associating another AP */
+#endif /* ESCAN_RESULT_PATCH */
+					wl_bss_connect_done(cfg, ndev, e, data, false);
+			}
+			wl_clr_drv_status(cfg, DISCONNECTING, ndev);
+
+			/* if link down, bsscfg is diabled */
+			if (ndev != bcmcfg_to_prmry_ndev(cfg))
+				complete(&cfg->iface_disable);
+
+		} else if (wl_is_nonetwork(cfg, e)) {
+			printf("connect failed event=%d e->status %d e->reason %d \n",
+				event, (int)ntoh32(e->status), (int)ntoh32(e->reason));
+			/* Clean up any pending scan request */
+			if (cfg->scan_request)
+				wl_notify_escan_complete(cfg, ndev, true, true);
+			if (wl_get_drv_status(cfg, CONNECTING, ndev))
+				wl_bss_connect_done(cfg, ndev, e, data, false);
+		} else {
+			WL_DBG(("%s nothing\n", __FUNCTION__));
+		}
+	}
+		else {
+		WL_ERR(("Invalid ndev status %d\n", wl_get_mode_by_netdev(cfg, ndev)));
+	}
+	return err;
+}
+
+void wl_cfg80211_set_rmc_pid(int pid)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	if (pid > 0)
+		cfg->rmc_event_pid = pid;
+	WL_DBG(("set pid for rmc event : pid=%d\n", pid));
+}
+
+#ifdef WLAIBSS
+void wl_cfg80211_set_txfail_pid(int pid)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	if (pid > 0)
+		cfg->aibss_txfail_pid = pid;
+	WL_DBG(("set pid for aibss fail event : pid=%d\n", pid));
+}
+
+static s32
+wl_notify_aibss_txfail(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	u32 evt = ntoh32(e->event_type);
+	int ret = -1;
+
+	if (cfg->aibss_txfail_pid != 0) {
+		ret = wl_netlink_send_msg(cfg->aibss_txfail_pid, AIBSS_EVENT_TXFAIL,
+			cfg->aibss_txfail_seq++, (void *)&e->addr, ETHER_ADDR_LEN);
+	}
+
+	WL_DBG(("txfail : evt=%d, pid=%d, ret=%d, mac=" MACF "\n",
+		evt, cfg->aibss_txfail_pid, ret, ETHERP_TO_MACF(&e->addr)));
+	return ret;
+}
+#endif /* WLAIBSS */
+
+static s32
+wl_notify_rmc_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	u32 evt = ntoh32(e->event_type);
+	u32 reason = ntoh32(e->reason);
+	int ret = -1;
+
+	switch (reason) {
+		case WLC_E_REASON_RMC_AR_LOST:
+		case WLC_E_REASON_RMC_AR_NO_ACK:
+			if (cfg->rmc_event_pid != 0) {
+				ret = wl_netlink_send_msg(cfg->rmc_event_pid,
+					RMC_EVENT_LEADER_CHECK_FAIL,
+					cfg->rmc_event_seq++, NULL, 0);
+			}
+			break;
+		default:
+			break;
+	}
+	WL_DBG(("rmcevent : evt=%d, pid=%d, ret=%d\n", evt, cfg->rmc_event_pid, ret));
+	return ret;
+}
+
+static s32
+wl_notify_roaming_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	bool act;
+	struct net_device *ndev = NULL;
+	s32 err = 0;
+	u32 event = be32_to_cpu(e->event_type);
+	u32 status = be32_to_cpu(e->status);
+	WL_DBG(("Enter \n"));
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	if ((!cfg->disable_roam_event) && (event == WLC_E_BSSID)) {
+		wl_add_remove_eventmsg(ndev, WLC_E_ROAM, false);
+		cfg->disable_roam_event = TRUE;
+	}
+
+	if ((cfg->disable_roam_event) && (event == WLC_E_ROAM))
+		return err;
+
+	if ((event == WLC_E_ROAM || event == WLC_E_BSSID) && status == WLC_E_STATUS_SUCCESS) {
+		if (wl_get_drv_status(cfg, CONNECTED, ndev))
+			wl_bss_roaming_done(cfg, ndev, e, data);
+		else
+			wl_bss_connect_done(cfg, ndev, e, data, true);
+		act = true;
+		wl_update_prof(cfg, ndev, e, &act, WL_PROF_ACT);
+		wl_update_prof(cfg, ndev, NULL, (void *)&e->addr, WL_PROF_BSSID);
+		dhd_conf_set_wme((dhd_pub_t *)cfg->pub);
+	}
+	return err;
+}
+
+static s32 wl_get_assoc_ies(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	wl_assoc_info_t assoc_info;
+	struct wl_connect_info *conn_info = wl_to_conn(cfg);
+	s32 err = 0;
+
+	WL_DBG(("Enter \n"));
+	err = wldev_iovar_getbuf(ndev, "assoc_info", NULL, 0, cfg->extra_buf,
+		WL_ASSOC_INFO_MAX, NULL);
+	if (unlikely(err)) {
+		WL_ERR(("could not get assoc info (%d)\n", err));
+		return err;
+	}
+	memcpy(&assoc_info, cfg->extra_buf, sizeof(wl_assoc_info_t));
+	assoc_info.req_len = htod32(assoc_info.req_len);
+	assoc_info.resp_len = htod32(assoc_info.resp_len);
+	assoc_info.flags = htod32(assoc_info.flags);
+	if (conn_info->req_ie_len) {
+		conn_info->req_ie_len = 0;
+		bzero(conn_info->req_ie, sizeof(conn_info->req_ie));
+	}
+	if (conn_info->resp_ie_len) {
+		conn_info->resp_ie_len = 0;
+		bzero(conn_info->resp_ie, sizeof(conn_info->resp_ie));
+	}
+	if (assoc_info.req_len) {
+		err = wldev_iovar_getbuf(ndev, "assoc_req_ies", NULL, 0, cfg->extra_buf,
+			WL_ASSOC_INFO_MAX, NULL);
+		if (unlikely(err)) {
+			WL_ERR(("could not get assoc req (%d)\n", err));
+			return err;
+		}
+		conn_info->req_ie_len = assoc_info.req_len - sizeof(struct dot11_assoc_req);
+		if (assoc_info.flags & WLC_ASSOC_REQ_IS_REASSOC) {
+			conn_info->req_ie_len -= ETHER_ADDR_LEN;
+		}
+		if (conn_info->req_ie_len <= MAX_REQ_LINE)
+			memcpy(conn_info->req_ie, cfg->extra_buf, conn_info->req_ie_len);
+		else {
+			WL_ERR(("IE size %d above max %d size \n",
+				conn_info->req_ie_len, MAX_REQ_LINE));
+			return err;
+		}
+	} else {
+		conn_info->req_ie_len = 0;
+	}
+	if (assoc_info.resp_len) {
+		err = wldev_iovar_getbuf(ndev, "assoc_resp_ies", NULL, 0, cfg->extra_buf,
+			WL_ASSOC_INFO_MAX, NULL);
+		if (unlikely(err)) {
+			WL_ERR(("could not get assoc resp (%d)\n", err));
+			return err;
+		}
+		conn_info->resp_ie_len = assoc_info.resp_len -sizeof(struct dot11_assoc_resp);
+		if (conn_info->resp_ie_len <= MAX_REQ_LINE)
+			memcpy(conn_info->resp_ie, cfg->extra_buf, conn_info->resp_ie_len);
+		else {
+			WL_ERR(("IE size %d above max %d size \n",
+				conn_info->resp_ie_len, MAX_REQ_LINE));
+			return err;
+		}
+	} else {
+		conn_info->resp_ie_len = 0;
+	}
+	WL_DBG(("req len (%d) resp len (%d)\n", conn_info->req_ie_len,
+		conn_info->resp_ie_len));
+
+	return err;
+}
+
+static void wl_ch_to_chanspec(int ch, struct wl_join_params *join_params,
+        size_t *join_params_size)
+{
+	chanspec_t chanspec = 0;
+	if (ch != 0) {
+		join_params->params.chanspec_num = 1;
+		join_params->params.chanspec_list[0] = ch;
+
+		if (join_params->params.chanspec_list[0] <= CH_MAX_2G_CHANNEL)
+			chanspec |= WL_CHANSPEC_BAND_2G;
+		else
+			chanspec |= WL_CHANSPEC_BAND_5G;
+
+		chanspec |= WL_CHANSPEC_BW_20;
+		chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+		*join_params_size += WL_ASSOC_PARAMS_FIXED_SIZE +
+			join_params->params.chanspec_num * sizeof(chanspec_t);
+
+		join_params->params.chanspec_list[0]  &= WL_CHANSPEC_CHAN_MASK;
+		join_params->params.chanspec_list[0] |= chanspec;
+		join_params->params.chanspec_list[0] =
+			wl_chspec_host_to_driver(join_params->params.chanspec_list[0]);
+
+		join_params->params.chanspec_num =
+			htod32(join_params->params.chanspec_num);
+		WL_DBG(("join_params->params.chanspec_list[0]= %X, %d channels\n",
+			join_params->params.chanspec_list[0],
+			join_params->params.chanspec_num));
+	}
+}
+
+static s32 wl_update_bss_info(struct bcm_cfg80211 *cfg, struct net_device *ndev, bool roam)
+{
+	struct cfg80211_bss *bss;
+	struct wl_bss_info *bi;
+	struct wlc_ssid *ssid;
+	struct bcm_tlv *tim;
+	s32 beacon_interval;
+	s32 dtim_period;
+	size_t ie_len;
+	u8 *ie;
+	u8 *curbssid;
+	s32 err = 0;
+	struct wiphy *wiphy;
+	u32 channel;
+	struct ieee80211_channel *cur_channel;
+	u32 freq, band;
+
+	wiphy = bcmcfg_to_wiphy(cfg);
+
+	ssid = (struct wlc_ssid *)wl_read_prof(cfg, ndev, WL_PROF_SSID);
+	curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+
+	mutex_lock(&cfg->usr_sync);
+
+	*(u32 *) cfg->extra_buf = htod32(WL_EXTRA_BUF_MAX);
+	err = wldev_ioctl(ndev, WLC_GET_BSS_INFO,
+		cfg->extra_buf, WL_EXTRA_BUF_MAX, false);
+	if (unlikely(err)) {
+		WL_ERR(("Could not get bss info %d\n", err));
+		goto update_bss_info_out;
+	}
+	bi = (struct wl_bss_info *)(cfg->extra_buf + 4);
+	channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+	wl_update_prof(cfg, ndev, NULL, &channel, WL_PROF_CHAN);
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+	freq = ieee80211_channel_to_frequency(channel);
+#else
+	band = (channel <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;
+	freq = ieee80211_channel_to_frequency(channel, band);
+#endif
+	cur_channel = ieee80211_get_channel(wiphy, freq);
+
+	bss = cfg80211_get_bss(wiphy, cur_channel, curbssid,
+		ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS,
+		WLAN_CAPABILITY_ESS);
+
+	if (!bss) {
+		WL_DBG(("Could not find the AP\n"));
+		if (memcmp(bi->BSSID.octet, curbssid, ETHER_ADDR_LEN)) {
+			WL_ERR(("Bssid doesn't match\n"));
+			err = -EIO;
+			goto update_bss_info_out;
+		}
+		err = wl_inform_single_bss(cfg, bi, roam);
+		if (unlikely(err))
+			goto update_bss_info_out;
+
+		ie = ((u8 *)bi) + bi->ie_offset;
+		ie_len = bi->ie_length;
+		beacon_interval = cpu_to_le16(bi->beacon_period);
+	} else {
+		WL_DBG(("Found the AP in the list - BSSID %pM\n", bss->bssid));
+#if defined(WL_CFG80211_P2P_DEV_IF)
+		ie = (u8 *)bss->ies->data;
+		ie_len = bss->ies->len;
+#else
+		ie = bss->information_elements;
+		ie_len = bss->len_information_elements;
+#endif /* WL_CFG80211_P2P_DEV_IF */
+		beacon_interval = bss->beacon_interval;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0))
+		cfg80211_put_bss(wiphy, bss);
+#else
+		cfg80211_put_bss(bss);
+#endif /* (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 9, 0) */
+	}
+
+	tim = bcm_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
+	if (tim) {
+		dtim_period = tim->data[1];
+	} else {
+		/*
+		* active scan was done so we could not get dtim
+		* information out of probe response.
+		* so we speficially query dtim information.
+		*/
+		err = wldev_ioctl(ndev, WLC_GET_DTIMPRD,
+			&dtim_period, sizeof(dtim_period), false);
+		if (unlikely(err)) {
+			WL_ERR(("WLC_GET_DTIMPRD error (%d)\n", err));
+			goto update_bss_info_out;
+		}
+	}
+
+	wl_update_prof(cfg, ndev, NULL, &beacon_interval, WL_PROF_BEACONINT);
+	wl_update_prof(cfg, ndev, NULL, &dtim_period, WL_PROF_DTIMPERIOD);
+
+update_bss_info_out:
+	if (unlikely(err)) {
+		WL_ERR(("Failed with error %d\n", err));
+	}
+	mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+
+static s32
+wl_bss_roaming_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data)
+{
+	struct wl_connect_info *conn_info = wl_to_conn(cfg);
+	s32 err = 0;
+	u8 *curbssid;
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	struct ieee80211_supported_band *band;
+	struct ieee80211_channel *notify_channel = NULL;
+	u32 *channel;
+	u32 freq;
+#endif /* LINUX_VERSION > 2.6.39 || WL_COMPAT_WIRELESS */
+
+#ifdef WLFBT
+	uint32 data_len = 0;
+	if (data)
+		data_len = ntoh32(e->datalen);
+#endif /* WLFBT */
+
+	wl_get_assoc_ies(cfg, ndev);
+	wl_update_prof(cfg, ndev, NULL, (void *)(e->addr.octet), WL_PROF_BSSID);
+	curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+	wl_update_bss_info(cfg, ndev, true);
+	wl_update_pmklist(ndev, cfg->pmk_list, err);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+	/* channel info for cfg80211_roamed introduced in 2.6.39-rc1 */
+	channel = (u32 *)wl_read_prof(cfg, ndev, WL_PROF_CHAN);
+	if (*channel <= CH_MAX_2G_CHANNEL)
+		band = wiphy->bands[NL80211_BAND_2GHZ];
+	else
+		band = wiphy->bands[NL80211_BAND_5GHZ];
+	freq = ieee80211_channel_to_frequency(*channel, band->band);
+	notify_channel = ieee80211_get_channel(wiphy, freq);
+#endif /* LINUX_VERSION > 2.6.39  || WL_COMPAT_WIRELESS */
+#ifdef WLFBT
+	/* back up the given FBT key for the further supplicant request,
+	 * currently not checking the FBT is enabled for current BSS in DHD,
+	 * because the supplicant decides to take it or not.
+	 */
+	if (data && (data_len == FBT_KEYLEN)) {
+		memcpy(cfg->fbt_key, data, FBT_KEYLEN);
+	}
+#endif /* WLFBT */
+	printf("wl_bss_roaming_done succeeded to " MACDBG "\n",
+		MAC2STRDBG((u8*)(&e->addr)));
+	dhd_conf_set_wme((dhd_pub_t *)cfg->pub);
+
+	cfg80211_roamed(ndev,
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 39)) || defined(WL_COMPAT_WIRELESS)
+		notify_channel,
+#endif
+		curbssid,
+		conn_info->req_ie, conn_info->req_ie_len,
+		conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
+	WL_DBG(("Report roaming result\n"));
+
+	wl_set_drv_status(cfg, CONNECTED, ndev);
+
+	return err;
+}
+
+static s32
+wl_bss_connect_done(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data, bool completed)
+{
+	struct wl_connect_info *conn_info = wl_to_conn(cfg);
+	struct wl_security *sec = wl_read_prof(cfg, ndev, WL_PROF_SEC);
+#if defined(CUSTOM_SET_CPUCORE)
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+#endif
+	s32 err = 0;
+	u8 *curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+	if (!sec) {
+		WL_ERR(("sec is NULL\n"));
+		return -ENODEV;
+	}
+	WL_DBG((" enter\n"));
+#ifdef ESCAN_RESULT_PATCH
+	if (wl_get_drv_status(cfg, CONNECTED, ndev)) {
+		if (memcmp(curbssid, connect_req_bssid, ETHER_ADDR_LEN) == 0) {
+			WL_DBG((" Connected event of connected device e=%d s=%d, ignore it\n",
+				ntoh32(e->event_type), ntoh32(e->status)));
+			return err;
+		}
+	}
+	if (memcmp(curbssid, broad_bssid, ETHER_ADDR_LEN) == 0 &&
+		memcmp(broad_bssid, connect_req_bssid, ETHER_ADDR_LEN) != 0) {
+		WL_DBG(("copy bssid\n"));
+		memcpy(curbssid, connect_req_bssid, ETHER_ADDR_LEN);
+	}
+
+#else
+	if (cfg->scan_request) {
+		wl_notify_escan_complete(cfg, ndev, true, true);
+	}
+#endif /* ESCAN_RESULT_PATCH */
+	if (wl_get_drv_status(cfg, CONNECTING, ndev)) {
+		wl_cfg80211_scan_abort(cfg);
+		wl_clr_drv_status(cfg, CONNECTING, ndev);
+		if (completed) {
+			wl_get_assoc_ies(cfg, ndev);
+			wl_update_prof(cfg, ndev, NULL, (void *)(e->addr.octet), WL_PROF_BSSID);
+			curbssid = wl_read_prof(cfg, ndev, WL_PROF_BSSID);
+			wl_update_bss_info(cfg, ndev, false);
+			wl_update_pmklist(ndev, cfg->pmk_list, err);
+			wl_set_drv_status(cfg, CONNECTED, ndev);
+			if (ndev != bcmcfg_to_prmry_ndev(cfg)) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
+				init_completion(&cfg->iface_disable);
+#else
+				/* reinitialize completion to clear previous count */
+				INIT_COMPLETION(cfg->iface_disable);
+#endif
+			}
+#ifdef CUSTOM_SET_CPUCORE
+			if (wl_get_chan_isvht80(ndev, dhd)) {
+				if (ndev == bcmcfg_to_prmry_ndev(cfg))
+					dhd->chan_isvht80 |= DHD_FLAG_STA_MODE; /* STA mode */
+				else if (ndev == wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION))
+					dhd->chan_isvht80 |= DHD_FLAG_P2P_MODE; /* p2p mode */
+				dhd_set_cpucore(dhd, TRUE);
+			}
+#endif /* CUSTOM_SET_CPUCORE */
+
+		}
+		cfg80211_connect_result(ndev,
+			curbssid,
+			conn_info->req_ie,
+			conn_info->req_ie_len,
+			conn_info->resp_ie,
+			conn_info->resp_ie_len,
+			completed ? WLAN_STATUS_SUCCESS :
+			(sec->auth_assoc_res_status) ?
+			sec->auth_assoc_res_status :
+			WLAN_STATUS_UNSPECIFIED_FAILURE,
+			GFP_KERNEL);
+		if (completed) {
+			WL_INFORM(("Report connect result - connection succeeded\n"));
+			dhd_conf_set_wme((dhd_pub_t *)cfg->pub);
+		} else
+			WL_ERR(("Report connect result - connection failed\n"));
+	}
+#ifdef CONFIG_TCPACK_FASTTX
+	if (wl_get_chan_isvht80(ndev, dhd))
+		wldev_iovar_setint(ndev, "tcpack_fast_tx", 0);
+	else
+		wldev_iovar_setint(ndev, "tcpack_fast_tx", 1);
+#endif /* CONFIG_TCPACK_FASTTX */
+
+	return err;
+}
+
+static s32
+wl_notify_mic_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	struct net_device *ndev = NULL;
+	u16 flags = ntoh16(e->flags);
+	enum nl80211_key_type key_type;
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	mutex_lock(&cfg->usr_sync);
+	if (flags & WLC_EVENT_MSG_GROUP)
+		key_type = NL80211_KEYTYPE_GROUP;
+	else
+		key_type = NL80211_KEYTYPE_PAIRWISE;
+
+	cfg80211_michael_mic_failure(ndev, (u8 *)&e->addr, key_type, -1,
+		NULL, GFP_KERNEL);
+	mutex_unlock(&cfg->usr_sync);
+
+	return 0;
+}
+
+#ifdef BT_WIFI_HANDOVER
+static s32
+wl_notify_bt_wifi_handover_req(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	struct net_device *ndev = NULL;
+	u32 event = ntoh32(e->event_type);
+	u32 datalen = ntoh32(e->datalen);
+	s32 err;
+
+	WL_ERR(("wl_notify_bt_wifi_handover_req: event_type : %d, datalen : %d\n", event, datalen));
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+	err = wl_genl_send_msg(ndev, event, data, (u16)datalen, 0, 0);
+
+	return err;
+}
+#endif /* BT_WIFI_HANDOVER */
+
+#ifdef PNO_SUPPORT
+static s32
+wl_notify_pfn_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	struct net_device *ndev = NULL;
+
+	WL_ERR((">>> PNO Event\n"));
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#ifndef WL_SCHED_SCAN
+	mutex_lock(&cfg->usr_sync);
+	/* TODO: Use cfg80211_sched_scan_results(wiphy); */
+	cfg80211_disconnected(ndev, 0, NULL, 0, true, GFP_KERNEL);
+	mutex_unlock(&cfg->usr_sync);
+#else
+	/* If cfg80211 scheduled scan is supported, report the pno results via sched
+	 * scan results
+	 */
+	wl_notify_sched_scan_results(cfg, ndev, e, data);
+#endif /* WL_SCHED_SCAN */
+	return 0;
+}
+#endif /* PNO_SUPPORT */
+
+static s32
+wl_notify_scan_status(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	struct channel_info channel_inform;
+	struct wl_scan_results *bss_list;
+	struct net_device *ndev = NULL;
+	u32 len = WL_SCAN_BUF_MAX;
+	s32 err = 0;
+	unsigned long flags;
+
+	WL_DBG(("Enter \n"));
+	if (!wl_get_drv_status(cfg, SCANNING, ndev)) {
+		WL_ERR(("scan is not ready \n"));
+		return err;
+	}
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	mutex_lock(&cfg->usr_sync);
+	wl_clr_drv_status(cfg, SCANNING, ndev);
+	err = wldev_ioctl(ndev, WLC_GET_CHANNEL, &channel_inform,
+		sizeof(channel_inform), false);
+	if (unlikely(err)) {
+		WL_ERR(("scan busy (%d)\n", err));
+		goto scan_done_out;
+	}
+	channel_inform.scan_channel = dtoh32(channel_inform.scan_channel);
+	if (unlikely(channel_inform.scan_channel)) {
+
+		WL_DBG(("channel_inform.scan_channel (%d)\n",
+			channel_inform.scan_channel));
+	}
+	cfg->bss_list = cfg->scan_results;
+	bss_list = cfg->bss_list;
+	memset(bss_list, 0, len);
+	bss_list->buflen = htod32(len);
+	err = wldev_ioctl(ndev, WLC_SCAN_RESULTS, bss_list, len, false);
+	if (unlikely(err) && unlikely(!cfg->scan_suppressed)) {
+		WL_ERR(("%s Scan_results error (%d)\n", ndev->name, err));
+		err = -EINVAL;
+		goto scan_done_out;
+	}
+	bss_list->buflen = dtoh32(bss_list->buflen);
+	bss_list->version = dtoh32(bss_list->version);
+	bss_list->count = dtoh32(bss_list->count);
+
+	err = wl_inform_bss(cfg);
+
+scan_done_out:
+	del_timer_sync(&cfg->scan_timeout);
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	if (cfg->scan_request) {
+		cfg80211_scan_done(cfg->scan_request, false);
+		cfg->scan_request = NULL;
+	}
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+	WL_DBG(("cfg80211_scan_done\n"));
+	mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+
+static s32
+wl_frame_get_mgmt(u16 fc, const struct ether_addr *da,
+	const struct ether_addr *sa, const struct ether_addr *bssid,
+	u8 **pheader, u32 *body_len, u8 *pbody)
+{
+	struct dot11_management_header *hdr;
+	u32 totlen = 0;
+	s32 err = 0;
+	u8 *offset;
+	u32 prebody_len = *body_len;
+	switch (fc) {
+		case FC_ASSOC_REQ:
+			/* capability , listen interval */
+			totlen = DOT11_ASSOC_REQ_FIXED_LEN;
+			*body_len += DOT11_ASSOC_REQ_FIXED_LEN;
+			break;
+
+		case FC_REASSOC_REQ:
+			/* capability, listen inteval, ap address */
+			totlen = DOT11_REASSOC_REQ_FIXED_LEN;
+			*body_len += DOT11_REASSOC_REQ_FIXED_LEN;
+			break;
+	}
+	totlen += DOT11_MGMT_HDR_LEN + prebody_len;
+	*pheader = kzalloc(totlen, GFP_KERNEL);
+	if (*pheader == NULL) {
+		WL_ERR(("memory alloc failed \n"));
+		return -ENOMEM;
+	}
+	hdr = (struct dot11_management_header *) (*pheader);
+	hdr->fc = htol16(fc);
+	hdr->durid = 0;
+	hdr->seq = 0;
+	offset = (u8*)(hdr + 1) + (totlen - DOT11_MGMT_HDR_LEN - prebody_len);
+	bcopy((const char*)da, (u8*)&hdr->da, ETHER_ADDR_LEN);
+	bcopy((const char*)sa, (u8*)&hdr->sa, ETHER_ADDR_LEN);
+	bcopy((const char*)bssid, (u8*)&hdr->bssid, ETHER_ADDR_LEN);
+	if ((pbody != NULL) && prebody_len)
+		bcopy((const char*)pbody, offset, prebody_len);
+	*body_len = totlen;
+	return err;
+}
+
+
+void
+wl_stop_wait_next_action_frame(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+		if (timer_pending(&cfg->p2p->listen_timer)) {
+			del_timer_sync(&cfg->p2p->listen_timer);
+		}
+		if (cfg->afx_hdl != NULL) {
+			if (cfg->afx_hdl->dev != NULL) {
+				wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+				wl_clr_drv_status(cfg, FINDING_COMMON_CHANNEL, cfg->afx_hdl->dev);
+			}
+			cfg->afx_hdl->peer_chan = WL_INVALID;
+		}
+		complete(&cfg->act_frm_scan);
+		WL_DBG(("*** Wake UP ** Working afx searching is cleared\n"));
+	} else if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM)) {
+		if (!(wl_get_p2p_status(cfg, ACTION_TX_COMPLETED) ||
+			wl_get_p2p_status(cfg, ACTION_TX_NOACK)))
+			wl_set_p2p_status(cfg, ACTION_TX_COMPLETED);
+
+		WL_DBG(("*** Wake UP ** abort actframe iovar\n"));
+		/* if channel is not zero, "actfame" uses off channel scan.
+		 * So abort scan for off channel completion.
+		 */
+		if (cfg->af_sent_channel)
+			wl_cfg80211_scan_abort(cfg);
+	}
+#ifdef WL_CFG80211_SYNC_GON
+	else if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+		WL_DBG(("*** Wake UP ** abort listen for next af frame\n"));
+		/* So abort scan to cancel listen */
+		wl_cfg80211_scan_abort(cfg);
+	}
+#endif /* WL_CFG80211_SYNC_GON */
+}
+
+
+int wl_cfg80211_get_ioctl_version(void)
+{
+	return ioctl_version;
+}
+
+static s32
+wl_notify_rx_mgmt_frame(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	struct ieee80211_supported_band *band;
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	struct ether_addr da;
+	struct ether_addr bssid;
+	bool isfree = false;
+	s32 err = 0;
+	s32 freq;
+	struct net_device *ndev = NULL;
+	wifi_p2p_pub_act_frame_t *act_frm = NULL;
+	wifi_p2p_action_frame_t *p2p_act_frm = NULL;
+	wifi_p2psd_gas_pub_act_frame_t *sd_act_frm = NULL;
+	wl_event_rx_frame_data_t *rxframe =
+		(wl_event_rx_frame_data_t*)data;
+	u32 event = ntoh32(e->event_type);
+	u8 *mgmt_frame;
+	u8 bsscfgidx = e->bsscfgidx;
+	u32 mgmt_frame_len = ntoh32(e->datalen) - sizeof(wl_event_rx_frame_data_t);
+	u16 channel = ((ntoh16(rxframe->channel) & WL_CHANSPEC_CHAN_MASK));
+	bool retval;
+
+	memset(&bssid, 0, ETHER_ADDR_LEN);
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+#ifdef P2PONEINT
+	WL_DBG((" device name is ndev %s \n", ndev->name));
+#endif
+
+	if (channel <= CH_MAX_2G_CHANNEL)
+		band = wiphy->bands[NL80211_BAND_2GHZ];
+	else
+		band = wiphy->bands[NL80211_BAND_5GHZ];
+	if (!band) {
+		WL_ERR(("No valid band\n"));
+		return -EINVAL;
+	}
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+	freq = ieee80211_channel_to_frequency(channel);
+	(void)band->band;
+#else
+	freq = ieee80211_channel_to_frequency(channel, band->band);
+#endif
+	if (event == WLC_E_ACTION_FRAME_RX) {
+		wldev_iovar_getbuf_bsscfg(ndev, "cur_etheraddr",
+			NULL, 0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, bsscfgidx, &cfg->ioctl_buf_sync);
+
+		err = wldev_ioctl(ndev, WLC_GET_BSSID, &bssid, ETHER_ADDR_LEN, false);
+		if (err < 0)
+			 WL_ERR(("WLC_GET_BSSID error %d\n", err));
+		memcpy(da.octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+		err = wl_frame_get_mgmt(FC_ACTION, &da, &e->addr, &bssid,
+			&mgmt_frame, &mgmt_frame_len,
+			(u8 *)((wl_event_rx_frame_data_t *)rxframe + 1));
+		if (err < 0) {
+			WL_ERR(("Error in receiving action frame len %d channel %d freq %d\n",
+				mgmt_frame_len, channel, freq));
+			goto exit;
+		}
+		isfree = true;
+		if (wl_cfgp2p_is_pub_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+			mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+			act_frm = (wifi_p2p_pub_act_frame_t *)
+					(&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+		} else if (wl_cfgp2p_is_p2p_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+			mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+			p2p_act_frm = (wifi_p2p_action_frame_t *)
+					(&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+			(void) p2p_act_frm;
+		} else if (wl_cfgp2p_is_gas_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+			mgmt_frame_len - DOT11_MGMT_HDR_LEN)) {
+#ifdef WL_SDO
+			if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS)) {
+				WL_ERR(("SD offload is in progress. Don't report the"
+					"frame via rx_mgmt path\n"));
+				goto exit;
+			}
+#endif
+
+			sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)
+					(&mgmt_frame[DOT11_MGMT_HDR_LEN]);
+			if (sd_act_frm && wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM)) {
+				if (cfg->next_af_subtype == sd_act_frm->action) {
+					WL_DBG(("We got a right next frame of SD!(%d)\n",
+						sd_act_frm->action));
+					wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+					/* Stop waiting for next AF. */
+					wl_stop_wait_next_action_frame(cfg, ndev);
+				}
+			}
+			(void) sd_act_frm;
+#ifdef WLTDLS
+		} else if (mgmt_frame[DOT11_MGMT_HDR_LEN] == TDLS_AF_CATEGORY) {
+			WL_DBG((" TDLS Action Frame Received type = %d \n",
+				mgmt_frame[DOT11_MGMT_HDR_LEN + 1]));
+
+			if (mgmt_frame[DOT11_MGMT_HDR_LEN + 1] == TDLS_ACTION_SETUP_RESP) {
+				cfg->tdls_mgmt_frame = mgmt_frame;
+				cfg->tdls_mgmt_frame_len = mgmt_frame_len;
+				cfg->tdls_mgmt_freq = freq;
+				return 0;
+			}
+
+		} else if (mgmt_frame[DOT11_MGMT_HDR_LEN] == TDLS_VENDOR_SPECIFIC) {
+			WL_DBG((" TDLS Vendor Specific Received type \n"));
+#endif
+		} else {
+
+			if (cfg->next_af_subtype != P2P_PAF_SUBTYPE_INVALID) {
+				u8 action = 0;
+				if (wl_get_public_action(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+					mgmt_frame_len - DOT11_MGMT_HDR_LEN, &action) != BCME_OK) {
+					WL_DBG(("Recived action is not public action frame\n"));
+				} else if (cfg->next_af_subtype == action) {
+					WL_DBG(("Recived action is the waiting action(%d)\n",
+						action));
+					wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+					/* Stop waiting for next AF. */
+					wl_stop_wait_next_action_frame(cfg, ndev);
+				}
+			}
+		}
+
+		if (act_frm) {
+
+			if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM)) {
+				if (cfg->next_af_subtype == act_frm->subtype) {
+					WL_DBG(("We got a right next frame!(%d)\n",
+						act_frm->subtype));
+					wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+					if (cfg->next_af_subtype == P2P_PAF_GON_CONF) {
+						OSL_SLEEP(20);
+					}
+
+					/* Stop waiting for next AF. */
+					wl_stop_wait_next_action_frame(cfg, ndev);
+				}
+			}
+		}
+
+		wl_cfgp2p_print_actframe(false, &mgmt_frame[DOT11_MGMT_HDR_LEN],
+			mgmt_frame_len - DOT11_MGMT_HDR_LEN, channel);
+		/*
+		 * After complete GO Negotiation, roll back to mpc mode
+		 */
+		if (act_frm && ((act_frm->subtype == P2P_PAF_GON_CONF) ||
+			(act_frm->subtype == P2P_PAF_PROVDIS_RSP))) {
+			wldev_iovar_setint(ndev, "mpc", 1);
+		}
+		if (act_frm && (act_frm->subtype == P2P_PAF_GON_CONF)) {
+			WL_DBG(("P2P: GO_NEG_PHASE status cleared \n"));
+			wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+		}
+	} else if (event == WLC_E_PROBREQ_MSG) {
+
+		/* Handle probe reqs frame
+		 * WPS-AP certification 4.2.13
+		 */
+		struct parsed_ies prbreq_ies;
+		u32 prbreq_ie_len = 0;
+		bool pbc = 0;
+
+		WL_DBG((" Event WLC_E_PROBREQ_MSG received\n"));
+		mgmt_frame = (u8 *)(data);
+		mgmt_frame_len = ntoh32(e->datalen);
+
+		prbreq_ie_len = mgmt_frame_len - DOT11_MGMT_HDR_LEN;
+
+		/* Parse prob_req IEs */
+		if (wl_cfg80211_parse_ies(&mgmt_frame[DOT11_MGMT_HDR_LEN],
+			prbreq_ie_len, &prbreq_ies) < 0) {
+			WL_ERR(("Prob req get IEs failed\n"));
+			return 0;
+		}
+		if (prbreq_ies.wps_ie != NULL) {
+			wl_validate_wps_ie((char *)prbreq_ies.wps_ie, prbreq_ies.wps_ie_len, &pbc);
+			WL_DBG((" wps_ie exist pbc = %d\n", pbc));
+			/* if pbc method, send prob_req mgmt frame to upper layer */
+			if (!pbc)
+				return 0;
+		} else
+			return 0;
+	} else {
+		mgmt_frame = (u8 *)((wl_event_rx_frame_data_t *)rxframe + 1);
+
+		/* wpa supplicant use probe request event for restarting another GON Req.
+		 * but it makes GON Req repetition.
+		 * so if src addr of prb req is same as my target device,
+		 * do not send probe request event during sending action frame.
+		 */
+		if (event == WLC_E_P2P_PROBREQ_MSG) {
+			WL_DBG((" Event %s\n", (event == WLC_E_P2P_PROBREQ_MSG) ?
+				"WLC_E_P2P_PROBREQ_MSG":"WLC_E_PROBREQ_MSG"));
+
+
+			/* Filter any P2P probe reqs arriving during the
+			 * GO-NEG Phase
+			 */
+			if (cfg->p2p &&
+				wl_get_p2p_status(cfg, GO_NEG_PHASE)) {
+				WL_DBG(("Filtering P2P probe_req while "
+					"being in GO-Neg state\n"));
+				return 0;
+			}
+		}
+	}
+
+#ifdef P2PONEINT
+	if (ndev == cfg->p2p_net && ndev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) {
+		ndev = bcmcfg_to_prmry_ndev(cfg);
+		cfgdev = ndev_to_cfgdev(ndev);
+	}
+	WL_DBG((" device name is ndev %s \n", ndev->name));
+#endif
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+	retval = cfg80211_rx_mgmt(cfgdev, freq, 0,  mgmt_frame, mgmt_frame_len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+	retval = cfg80211_rx_mgmt(cfgdev, freq, 0,  mgmt_frame, mgmt_frame_len, 0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+	defined(WL_COMPAT_WIRELESS)
+	retval = cfg80211_rx_mgmt(cfgdev, freq, 0, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+#else
+	retval = cfg80211_rx_mgmt(cfgdev, freq, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 12, 0) */
+
+	WL_DBG(("mgmt_frame_len (%d) , e->datalen (%d), channel (%d), freq (%d) retval (%d)\n",
+		mgmt_frame_len, ntoh32(e->datalen), channel, freq, retval));
+exit:
+	if (isfree)
+		kfree(mgmt_frame);
+	return 0;
+}
+
+#ifdef WL_SCHED_SCAN
+/* If target scan is not reliable, set the below define to "1" to do a
+ * full escan
+ */
+#define FULL_ESCAN_ON_PFN_NET_FOUND		0
+static s32
+wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data)
+{
+	wl_pfn_net_info_t *netinfo, *pnetinfo;
+	struct wiphy *wiphy	= bcmcfg_to_wiphy(cfg);
+	int err = 0;
+	struct cfg80211_scan_request *request = NULL;
+	struct cfg80211_ssid ssid[MAX_PFN_LIST_COUNT];
+	struct ieee80211_channel *channel = NULL;
+	int channel_req = 0;
+	int band = 0;
+	struct wl_pfn_scanresults *pfn_result = (struct wl_pfn_scanresults *)data;
+	int n_pfn_results = pfn_result->count;
+
+	WL_DBG(("Enter\n"));
+
+	if (e->event_type == WLC_E_PFN_NET_LOST) {
+		WL_PNO(("PFN NET LOST event. Do Nothing \n"));
+		return 0;
+	}
+	WL_PNO((">>> PFN NET FOUND event. count:%d \n", n_pfn_results));
+	if (n_pfn_results > 0) {
+		int i;
+
+		if (n_pfn_results > MAX_PFN_LIST_COUNT)
+			n_pfn_results = MAX_PFN_LIST_COUNT;
+		pnetinfo = (wl_pfn_net_info_t *)(data + sizeof(wl_pfn_scanresults_t)
+				- sizeof(wl_pfn_net_info_t));
+
+		memset(&ssid, 0x00, sizeof(ssid));
+
+		request = kzalloc(sizeof(*request)
+			+ sizeof(*request->channels) * n_pfn_results,
+			GFP_KERNEL);
+		channel = (struct ieee80211_channel *)kzalloc(
+			(sizeof(struct ieee80211_channel) * n_pfn_results),
+			GFP_KERNEL);
+		if (!request || !channel) {
+			WL_ERR(("No memory"));
+			err = -ENOMEM;
+			goto out_err;
+		}
+
+		request->wiphy = wiphy;
+
+		for (i = 0; i < n_pfn_results; i++) {
+			netinfo = &pnetinfo[i];
+			if (!netinfo) {
+				WL_ERR(("Invalid netinfo ptr. index:%d", i));
+				err = -EINVAL;
+				goto out_err;
+			}
+			WL_PNO((">>> SSID:%s Channel:%d \n",
+				netinfo->pfnsubnet.SSID, netinfo->pfnsubnet.channel));
+			/* PFN result doesn't have all the info which are required by the supplicant
+			 * (For e.g IEs) Do a target Escan so that sched scan results are reported
+			 * via wl_inform_single_bss in the required format. Escan does require the
+			 * scan request in the form of cfg80211_scan_request. For timebeing, create
+			 * cfg80211_scan_request one out of the received PNO event.
+			 */
+			memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID,
+				netinfo->pfnsubnet.SSID_len);
+			ssid[i].ssid_len = netinfo->pfnsubnet.SSID_len;
+			request->n_ssids++;
+
+			channel_req = netinfo->pfnsubnet.channel;
+			band = (channel_req <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ
+				: NL80211_BAND_5GHZ;
+			channel[i].center_freq = ieee80211_channel_to_frequency(channel_req, band);
+			channel[i].band = band;
+			channel[i].flags |= IEEE80211_CHAN_NO_HT40;
+			request->channels[i] = &channel[i];
+			request->n_channels++;
+		}
+
+		/* assign parsed ssid array */
+		if (request->n_ssids)
+			request->ssids = &ssid[0];
+
+		if (wl_get_drv_status_all(cfg, SCANNING)) {
+			/* Abort any on-going scan */
+			wl_notify_escan_complete(cfg, ndev, true, true);
+		}
+
+		if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+			WL_PNO((">>> P2P discovery was ON. Disabling it\n"));
+			err = wl_cfgp2p_discover_enable_search(cfg, false);
+			if (unlikely(err)) {
+				wl_clr_drv_status(cfg, SCANNING, ndev);
+				goto out_err;
+			}
+			p2p_scan(cfg) = false;
+		}
+
+		wl_set_drv_status(cfg, SCANNING, ndev);
+#if FULL_ESCAN_ON_PFN_NET_FOUND
+		WL_PNO((">>> Doing Full ESCAN on PNO event\n"));
+		err = wl_do_escan(cfg, wiphy, ndev, NULL);
+#else
+		WL_PNO((">>> Doing targeted ESCAN on PNO event\n"));
+		err = wl_do_escan(cfg, wiphy, ndev, request);
+#endif
+		if (err) {
+			wl_clr_drv_status(cfg, SCANNING, ndev);
+			goto out_err;
+		}
+		cfg->sched_scan_running = TRUE;
+	}
+	else {
+		WL_ERR(("FALSE PNO Event. (pfn_count == 0) \n"));
+	}
+out_err:
+	if (request)
+		kfree(request);
+	if (channel)
+		kfree(channel);
+	return err;
+}
+#endif /* WL_SCHED_SCAN */
+
+static void wl_init_conf(struct wl_conf *conf)
+{
+	WL_DBG(("Enter \n"));
+	conf->frag_threshold = (u32)-1;
+	conf->rts_threshold = (u32)-1;
+	conf->retry_short = (u32)-1;
+	conf->retry_long = (u32)-1;
+	conf->tx_power = -1;
+}
+
+static void wl_init_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	unsigned long flags;
+	struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	memset(profile, 0, sizeof(struct wl_profile));
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+}
+
+static void wl_init_event_handler(struct bcm_cfg80211 *cfg)
+{
+	memset(cfg->evt_handler, 0, sizeof(cfg->evt_handler));
+
+	cfg->evt_handler[WLC_E_SCAN_COMPLETE] = wl_notify_scan_status;
+	cfg->evt_handler[WLC_E_AUTH] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_ASSOC] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_LINK] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_DEAUTH_IND] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_DEAUTH] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_DISASSOC_IND] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_ASSOC_IND] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_REASSOC_IND] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_ROAM] = wl_notify_roaming_status;
+	cfg->evt_handler[WLC_E_MIC_ERROR] = wl_notify_mic_status;
+	cfg->evt_handler[WLC_E_SET_SSID] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_ACTION_FRAME_RX] = wl_notify_rx_mgmt_frame;
+	cfg->evt_handler[WLC_E_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+	cfg->evt_handler[WLC_E_P2P_PROBREQ_MSG] = wl_notify_rx_mgmt_frame;
+	cfg->evt_handler[WLC_E_P2P_DISC_LISTEN_COMPLETE] = wl_cfgp2p_listen_complete;
+	cfg->evt_handler[WLC_E_ACTION_FRAME_COMPLETE] = wl_cfgp2p_action_tx_complete;
+	cfg->evt_handler[WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE] = wl_cfgp2p_action_tx_complete;
+	cfg->evt_handler[WLC_E_JOIN] = wl_notify_connect_status;
+	cfg->evt_handler[WLC_E_START] = wl_notify_connect_status;
+#ifdef PNO_SUPPORT
+	cfg->evt_handler[WLC_E_PFN_NET_FOUND] = wl_notify_pfn_status;
+#endif /* PNO_SUPPORT */
+#ifdef WL_SDO
+	cfg->evt_handler[WLC_E_SERVICE_FOUND] = wl_svc_resp_handler;
+	cfg->evt_handler[WLC_E_P2PO_ADD_DEVICE] = wl_notify_device_discovery;
+	cfg->evt_handler[WLC_E_P2PO_DEL_DEVICE] = wl_notify_device_discovery;
+#endif
+#ifdef WLTDLS
+	cfg->evt_handler[WLC_E_TDLS_PEER_EVENT] = wl_tdls_event_handler;
+#endif /* WLTDLS */
+	cfg->evt_handler[WLC_E_BSSID] = wl_notify_roaming_status;
+#ifdef WLAIBSS
+	cfg->evt_handler[WLC_E_AIBSS_TXFAIL] = wl_notify_aibss_txfail;
+#endif /* WLAIBSS */
+#ifdef BT_WIFI_HANDOVER
+	cfg->evt_handler[WLC_E_BT_WIFI_HANDOVER_REQ] = wl_notify_bt_wifi_handover_req;
+#endif
+#ifdef WL_NAN
+	cfg->evt_handler[WLC_E_NAN] = wl_cfgnan_notify_nan_status;
+	cfg->evt_handler[WLC_E_PROXD] = wl_cfgnan_notify_proxd_status;
+#endif /* WL_NAN */
+	cfg->evt_handler[WLC_E_RMC_EVENT] = wl_notify_rmc_status;
+}
+
+#if defined(STATIC_WL_PRIV_STRUCT)
+static void
+wl_init_escan_result_buf(struct bcm_cfg80211 *cfg)
+{
+	cfg->escan_info.escan_buf = DHD_OS_PREALLOC(cfg->pub,
+		DHD_PREALLOC_WIPHY_ESCAN0, ESCAN_BUF_SIZE);
+	bzero(cfg->escan_info.escan_buf, ESCAN_BUF_SIZE);
+}
+
+static void
+wl_deinit_escan_result_buf(struct bcm_cfg80211 *cfg)
+{
+	cfg->escan_info.escan_buf = NULL;
+
+}
+#endif /* STATIC_WL_PRIV_STRUCT */
+
+static s32 wl_init_priv_mem(struct bcm_cfg80211 *cfg)
+{
+	WL_DBG(("Enter \n"));
+	cfg->scan_results = (void *)kzalloc(WL_SCAN_BUF_MAX, GFP_KERNEL);
+	if (unlikely(!cfg->scan_results)) {
+		WL_ERR(("Scan results alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->conf = (void *)kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
+	if (unlikely(!cfg->conf)) {
+		WL_ERR(("wl_conf alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->scan_req_int =
+	    (void *)kzalloc(sizeof(*cfg->scan_req_int), GFP_KERNEL);
+	if (unlikely(!cfg->scan_req_int)) {
+		WL_ERR(("Scan req alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->ioctl_buf = (void *)kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+	if (unlikely(!cfg->ioctl_buf)) {
+		WL_ERR(("Ioctl buf alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->escan_ioctl_buf = (void *)kzalloc(WLC_IOCTL_MAXLEN, GFP_KERNEL);
+	if (unlikely(!cfg->escan_ioctl_buf)) {
+		WL_ERR(("Ioctl buf alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->extra_buf = (void *)kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
+	if (unlikely(!cfg->extra_buf)) {
+		WL_ERR(("Extra buf alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->pmk_list = (void *)kzalloc(sizeof(*cfg->pmk_list), GFP_KERNEL);
+	if (unlikely(!cfg->pmk_list)) {
+		WL_ERR(("pmk list alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->sta_info = (void *)kzalloc(sizeof(*cfg->sta_info), GFP_KERNEL);
+	if (unlikely(!cfg->sta_info)) {
+		WL_ERR(("sta info  alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+
+#if defined(STATIC_WL_PRIV_STRUCT)
+	cfg->conn_info = (void *)kzalloc(sizeof(*cfg->conn_info), GFP_KERNEL);
+	if (unlikely(!cfg->conn_info)) {
+		WL_ERR(("cfg->conn_info  alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	cfg->ie = (void *)kzalloc(sizeof(*cfg->ie), GFP_KERNEL);
+	if (unlikely(!cfg->ie)) {
+		WL_ERR(("cfg->ie  alloc failed\n"));
+		goto init_priv_mem_out;
+	}
+	wl_init_escan_result_buf(cfg);
+#endif /* STATIC_WL_PRIV_STRUCT */
+	cfg->afx_hdl = (void *)kzalloc(sizeof(*cfg->afx_hdl), GFP_KERNEL);
+	if (unlikely(!cfg->afx_hdl)) {
+		WL_ERR(("afx hdl  alloc failed\n"));
+		goto init_priv_mem_out;
+	} else {
+		init_completion(&cfg->act_frm_scan);
+		init_completion(&cfg->wait_next_af);
+
+		INIT_WORK(&cfg->afx_hdl->work, wl_cfg80211_afx_handler);
+	}
+	return 0;
+
+init_priv_mem_out:
+	wl_deinit_priv_mem(cfg);
+
+	return -ENOMEM;
+}
+
+static void wl_deinit_priv_mem(struct bcm_cfg80211 *cfg)
+{
+	kfree(cfg->scan_results);
+	cfg->scan_results = NULL;
+	kfree(cfg->conf);
+	cfg->conf = NULL;
+	kfree(cfg->scan_req_int);
+	cfg->scan_req_int = NULL;
+	kfree(cfg->ioctl_buf);
+	cfg->ioctl_buf = NULL;
+	kfree(cfg->escan_ioctl_buf);
+	cfg->escan_ioctl_buf = NULL;
+	kfree(cfg->extra_buf);
+	cfg->extra_buf = NULL;
+	kfree(cfg->pmk_list);
+	cfg->pmk_list = NULL;
+	kfree(cfg->sta_info);
+	cfg->sta_info = NULL;
+#if defined(STATIC_WL_PRIV_STRUCT)
+	kfree(cfg->conn_info);
+	cfg->conn_info = NULL;
+	kfree(cfg->ie);
+	cfg->ie = NULL;
+	wl_deinit_escan_result_buf(cfg);
+#endif /* STATIC_WL_PRIV_STRUCT */
+	if (cfg->afx_hdl) {
+		cancel_work_sync(&cfg->afx_hdl->work);
+		kfree(cfg->afx_hdl);
+		cfg->afx_hdl = NULL;
+	}
+
+	if (cfg->ap_info) {
+		kfree(cfg->ap_info->wpa_ie);
+		kfree(cfg->ap_info->rsn_ie);
+		kfree(cfg->ap_info->wps_ie);
+		kfree(cfg->ap_info);
+		cfg->ap_info = NULL;
+	}
+#ifdef WLTDLS
+	if (cfg->tdls_mgmt_frame) {
+		kfree(cfg->tdls_mgmt_frame);
+		cfg->tdls_mgmt_frame = NULL;
+	}
+#endif /* WLTDLS */
+}
+
+static s32 wl_create_event_handler(struct bcm_cfg80211 *cfg)
+{
+	int ret = 0;
+	WL_DBG(("Enter \n"));
+
+	/* Do not use DHD in cfg driver */
+	cfg->event_tsk.thr_pid = -1;
+
+	PROC_START(wl_event_handler, cfg, &cfg->event_tsk, 0, "wl_event_handler");
+	if (cfg->event_tsk.thr_pid < 0)
+		ret = -ENOMEM;
+	return ret;
+}
+
+static void wl_destroy_event_handler(struct bcm_cfg80211 *cfg)
+{
+	if (cfg->event_tsk.thr_pid >= 0)
+		PROC_STOP(&cfg->event_tsk);
+}
+
+static void wl_scan_timeout(unsigned long data)
+{
+	wl_event_msg_t msg;
+	struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+//	struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+
+	if (!(cfg->scan_request)) {
+		WL_ERR(("timer expired but no scan request\n"));
+		return;
+	}
+	bzero(&msg, sizeof(wl_event_msg_t));
+	WL_ERR(("timer expired\n"));
+	msg.event_type = hton32(WLC_E_ESCAN_RESULT);
+	msg.status = hton32(WLC_E_STATUS_TIMEOUT);
+	msg.reason = 0xFFFFFFFF;
+	wl_cfg80211_event(bcmcfg_to_prmry_ndev(cfg), &msg, NULL);
+
+	// terence 20130729: workaround to fix out of memory in firmware
+//	if (dhd_conf_get_chip(dhd_get_pub(dev)) == BCM43362_CHIP_ID) {
+//		WL_ERR(("Send hang event\n"));
+//		net_os_send_hang_message(dev);
+//	}
+}
+
+static s32
+wl_cfg80211_netdev_notifier_call(struct notifier_block * nb,
+	unsigned long state,
+	void *ptr)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0))
+	struct net_device *dev = ptr;
+#else
+	// terence 20150701: fix for p2p connection issue
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+#endif
+	struct wireless_dev *wdev = dev->ieee80211_ptr;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	WL_DBG(("Enter \n"));
+
+	if (!wdev || !cfg || dev == bcmcfg_to_prmry_ndev(cfg))
+		return NOTIFY_DONE;
+
+	switch (state) {
+		case NETDEV_DOWN:
+		{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 11, 0))
+			int max_wait_timeout = 2;
+			int max_wait_count = 100;
+			int refcnt = 0;
+			unsigned long limit = jiffies + max_wait_timeout * HZ;
+			while (work_pending(&wdev->cleanup_work)) {
+				if (refcnt%5 == 0) {
+					WL_ERR(("[NETDEV_DOWN] wait for "
+						"complete of cleanup_work"
+						" (%d th)\n", refcnt));
+				}
+				if (!time_before(jiffies, limit)) {
+					WL_ERR(("[NETDEV_DOWN] cleanup_work"
+						" of CFG80211 is not"
+						" completed in %d sec\n",
+						max_wait_timeout));
+					break;
+				}
+				if (refcnt >= max_wait_count) {
+					WL_ERR(("[NETDEV_DOWN] cleanup_work"
+						" of CFG80211 is not"
+						" completed in %d loop\n",
+						max_wait_count));
+					break;
+				}
+				set_current_state(TASK_INTERRUPTIBLE);
+				(void)schedule_timeout(100);
+				set_current_state(TASK_RUNNING);
+				refcnt++;
+			}
+#endif /* LINUX_VERSION <  VERSION(3, 14, 0) */
+			break;
+		}
+
+		case NETDEV_UNREGISTER:
+			/* after calling list_del_rcu(&wdev->list) */
+			wl_dealloc_netinfo(cfg, dev);
+			break;
+		case NETDEV_GOING_DOWN:
+			/* At NETDEV_DOWN state, wdev_cleanup_work work will be called.
+			*  In front of door, the function checks
+			*  whether current scan is working or not.
+			*  If the scanning is still working, wdev_cleanup_work call WARN_ON and
+			*  make the scan done forcibly.
+			*/
+			if (wl_get_drv_status(cfg, SCANNING, dev))
+				wl_notify_escan_complete(cfg, dev, true, true);
+			break;
+	}
+	return NOTIFY_DONE;
+}
+static struct notifier_block wl_cfg80211_netdev_notifier = {
+	.notifier_call = wl_cfg80211_netdev_notifier_call,
+};
+/* to make sure we won't register the same notifier twice, otherwise a loop is likely to be
+ * created in kernel notifier link list (with 'next' pointing to itself)
+ */
+static bool wl_cfg80211_netdev_notifier_registered = FALSE;
+
+void
+#ifdef  P2PONEINT
+wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg)
+#else
+wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg)
+#endif
+{
+	wl_scan_params_t *params = NULL;
+	s32 params_size = 0;
+	s32 err = BCME_OK;
+	struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+	if (!in_atomic()) {
+		/* Our scan params only need space for 1 channel and 0 ssids */
+		params = wl_cfg80211_scan_alloc_params(-1, 0, &params_size);
+		if (params == NULL) {
+			WL_ERR(("scan params allocation failed \n"));
+			err = -ENOMEM;
+		} else {
+			/* Do a scan abort to stop the driver's scan engine */
+			err = wldev_ioctl(dev, WLC_SCAN, params, params_size, true);
+			if (err < 0) {
+				WL_ERR(("scan abort  failed \n"));
+			}
+			kfree(params);
+		}
+	}
+}
+
+static s32 wl_notify_escan_complete(struct bcm_cfg80211 *cfg,
+	struct net_device *ndev,
+	bool aborted, bool fw_abort)
+{
+	s32 err = BCME_OK;
+	unsigned long flags;
+	struct net_device *dev;
+
+	WL_DBG(("Enter \n"));
+	if (!ndev) {
+		WL_ERR(("ndev is null\n"));
+		err = BCME_ERROR;
+		return err;
+	}
+
+	if (cfg->escan_info.ndev != ndev) {
+		WL_ERR(("ndev is different %p %p\n", cfg->escan_info.ndev, ndev));
+		err = BCME_ERROR;
+		return err;
+	}
+
+	if (cfg->scan_request) {
+		dev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(WL_ENABLE_P2P_IF)
+		if (cfg->scan_request->dev != cfg->p2p_net)
+			dev = cfg->scan_request->dev;
+#endif /* WL_ENABLE_P2P_IF */
+	}
+	else {
+		WL_DBG(("cfg->scan_request is NULL may be internal scan."
+			"doing scan_abort for ndev %p primary %p",
+				ndev, bcmcfg_to_prmry_ndev(cfg)));
+		dev = ndev;
+	}
+	if (fw_abort && !in_atomic())
+		wl_cfg80211_scan_abort(cfg);
+	if (timer_pending(&cfg->scan_timeout))
+		del_timer_sync(&cfg->scan_timeout);
+#if defined(ESCAN_RESULT_PATCH)
+	if (likely(cfg->scan_request)) {
+		cfg->bss_list = wl_escan_get_buf(cfg, aborted);
+		wl_inform_bss(cfg);
+	}
+#endif /* ESCAN_RESULT_PATCH */
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+#ifdef WL_SCHED_SCAN
+	if (cfg->sched_scan_req && !cfg->scan_request) {
+		WL_PNO((">>> REPORTING SCHED SCAN RESULTS \n"));
+		if (!aborted)
+			cfg80211_sched_scan_results(cfg->sched_scan_req->wiphy);
+		cfg->sched_scan_running = FALSE;
+		cfg->sched_scan_req = NULL;
+	}
+#endif /* WL_SCHED_SCAN */
+	if (likely(cfg->scan_request)) {
+		struct cfg80211_scan_info info = {
+			.aborted = aborted,
+		};
+		cfg80211_scan_done(cfg->scan_request, &info);
+		cfg->scan_request = NULL;
+	}
+	if (p2p_is_on(cfg))
+		wl_clr_p2p_status(cfg, SCANNING);
+	wl_clr_drv_status(cfg, SCANNING, dev);
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+#ifdef WL_SDO
+	if (wl_get_p2p_status(cfg, DISC_IN_PROGRESS) && !in_atomic()) {
+		wl_cfg80211_resume_sdo(ndev, cfg);
+	}
+#endif
+
+	return err;
+}
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+static void
+wl_cfg80211_find_removal_candidate(wl_bss_info_t *bss, removal_element_t *candidate)
+{
+	int idx;
+	for (idx = 0; idx < BUF_OVERFLOW_MGMT_COUNT; idx++) {
+		int len = BUF_OVERFLOW_MGMT_COUNT - idx - 1;
+		if (bss->RSSI < candidate[idx].RSSI) {
+			if (len)
+				memcpy(&candidate[idx + 1], &candidate[idx],
+					sizeof(removal_element_t) * len);
+			candidate[idx].RSSI = bss->RSSI;
+			candidate[idx].length = bss->length;
+			memcpy(&candidate[idx].BSSID, &bss->BSSID, ETHER_ADDR_LEN);
+			return;
+		}
+	}
+}
+
+static void
+wl_cfg80211_remove_lowRSSI_info(wl_scan_results_t *list, removal_element_t *candidate,
+	wl_bss_info_t *bi)
+{
+	int idx1, idx2;
+	int total_delete_len = 0;
+	for (idx1 = 0; idx1 < BUF_OVERFLOW_MGMT_COUNT; idx1++) {
+		int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+		wl_bss_info_t *bss = NULL;
+		if (candidate[idx1].RSSI >= bi->RSSI)
+			continue;
+		for (idx2 = 0; idx2 < list->count; idx2++) {
+			bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length)) :
+				list->bss_info;
+			if (!bcmp(&candidate[idx1].BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+				candidate[idx1].RSSI == bss->RSSI &&
+				candidate[idx1].length == dtoh32(bss->length)) {
+				u32 delete_len = dtoh32(bss->length);
+				WL_DBG(("delete scan info of " MACDBG " to add new AP\n",
+					MAC2STRDBG(bss->BSSID.octet)));
+				if (idx2 < list->count -1) {
+					memmove((u8 *)bss, (u8 *)bss + delete_len,
+						list->buflen - cur_len - delete_len);
+				}
+				list->buflen -= delete_len;
+				list->count--;
+				total_delete_len += delete_len;
+				/* if delete_len is greater than or equal to result length */
+				if (total_delete_len >= bi->length) {
+					return;
+				}
+				break;
+			}
+			cur_len += dtoh32(bss->length);
+		}
+	}
+}
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+static s32 wl_escan_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	s32 err = BCME_OK;
+	s32 status = ntoh32(e->status);
+	wl_bss_info_t *bi;
+	wl_escan_result_t *escan_result;
+	wl_bss_info_t *bss = NULL;
+	wl_scan_results_t *list;
+	wifi_p2p_ie_t * p2p_ie;
+	struct net_device *ndev = NULL;
+	u32 bi_length;
+	u32 i;
+	u8 *p2p_dev_addr = NULL;
+	u16 channel;
+	struct ieee80211_supported_band *band;
+
+	WL_DBG((" enter event type : %d, status : %d \n",
+		ntoh32(e->event_type), ntoh32(e->status)));
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	mutex_lock(&cfg->usr_sync);
+	/* P2P SCAN is coming from primary interface */
+	if (wl_get_p2p_status(cfg, SCANNING)) {
+		if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
+			ndev = cfg->afx_hdl->dev;
+		else
+			ndev = cfg->escan_info.ndev;
+
+	}
+	if (!ndev || (!wl_get_drv_status(cfg, SCANNING, ndev) && !cfg->sched_scan_running)) {
+		WL_ERR(("escan is not ready ndev %p drv_status 0x%x e_type %d e_states %d\n",
+			ndev, wl_get_drv_status(cfg, SCANNING, ndev),
+			ntoh32(e->event_type), ntoh32(e->status)));
+		goto exit;
+	}
+	escan_result = (wl_escan_result_t *)data;
+
+	if (status == WLC_E_STATUS_PARTIAL) {
+		WL_INFORM(("WLC_E_STATUS_PARTIAL \n"));
+		if (!escan_result) {
+			WL_ERR(("Invalid escan result (NULL pointer)\n"));
+			goto exit;
+		}
+		if (dtoh16(escan_result->bss_count) != 1) {
+			WL_ERR(("Invalid bss_count %d: ignoring\n", escan_result->bss_count));
+			goto exit;
+		}
+		bi = escan_result->bss_info;
+		if (!bi) {
+			WL_ERR(("Invalid escan bss info (NULL pointer)\n"));
+			goto exit;
+		}
+		bi_length = dtoh32(bi->length);
+		if (bi_length != (dtoh32(escan_result->buflen) - WL_ESCAN_RESULTS_FIXED_SIZE)) {
+			WL_ERR(("Invalid bss_info length %d: ignoring\n", bi_length));
+			goto exit;
+		}
+
+		/* +++++ terence 20130524: skip invalid bss */
+		channel =
+			bi->ctl_ch ? bi->ctl_ch : CHSPEC_CHANNEL(wl_chspec_driver_to_host(bi->chanspec));
+		if (channel <= CH_MAX_2G_CHANNEL)
+			band = bcmcfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
+		else
+			band = bcmcfg_to_wiphy(cfg)->bands[NL80211_BAND_5GHZ];
+		if (!band) {
+			WL_ERR(("No valid band\n"));
+			goto exit;
+		}
+		if (!dhd_conf_match_channel((dhd_pub_t *)cfg->pub, channel))
+			goto exit;
+		/* ----- terence 20130524: skip invalid bss */
+
+		if (wl_escan_check_sync_id(status, escan_result->sync_id,
+				cfg->escan_info.cur_sync_id) < 0)
+			goto exit;
+
+		if (!(bcmcfg_to_wiphy(cfg)->interface_modes & BIT(NL80211_IFTYPE_ADHOC))) {
+			if (dtoh16(bi->capability) & DOT11_CAP_IBSS) {
+				WL_DBG(("Ignoring IBSS result\n"));
+				goto exit;
+			}
+		}
+
+		if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+			p2p_dev_addr = wl_cfgp2p_retreive_p2p_dev_addr(bi, bi_length);
+			if (p2p_dev_addr && !memcmp(p2p_dev_addr,
+				cfg->afx_hdl->tx_dst_addr.octet, ETHER_ADDR_LEN)) {
+				s32 channel = wf_chspec_ctlchan(
+					wl_chspec_driver_to_host(bi->chanspec));
+
+				if ((channel > MAXCHANNEL) || (channel <= 0))
+					channel = WL_INVALID;
+				else
+					WL_ERR(("ACTION FRAME SCAN : Peer " MACDBG " found,"
+						" channel : %d\n",
+						MAC2STRDBG(cfg->afx_hdl->tx_dst_addr.octet),
+						channel));
+
+				wl_clr_p2p_status(cfg, SCANNING);
+				cfg->afx_hdl->peer_chan = channel;
+				complete(&cfg->act_frm_scan);
+				goto exit;
+			}
+
+		} else {
+			int cur_len = WL_SCAN_RESULTS_FIXED_SIZE;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+			removal_element_t candidate[BUF_OVERFLOW_MGMT_COUNT];
+			int remove_lower_rssi = FALSE;
+
+			bzero(candidate, sizeof(removal_element_t)*BUF_OVERFLOW_MGMT_COUNT);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+			list = wl_escan_get_buf(cfg, FALSE);
+			if (scan_req_match(cfg)) {
+#ifdef WL_HOST_BAND_MGMT
+				s32 channel = 0;
+				s32 channel_band = 0;
+				chanspec_t chspec;
+#endif /* WL_HOST_BAND_MGMT */
+				/* p2p scan && allow only probe response */
+				if ((cfg->p2p->search_state != WL_P2P_DISC_ST_SCAN) &&
+					(bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+					goto exit;
+				if ((p2p_ie = wl_cfgp2p_find_p2pie(((u8 *) bi) + bi->ie_offset,
+					bi->ie_length)) == NULL) {
+						WL_ERR(("Couldn't find P2PIE in probe"
+							" response/beacon\n"));
+						goto exit;
+				}
+#ifdef WL_HOST_BAND_MGMT
+				chspec = wl_chspec_driver_to_host(bi->chanspec);
+				channel = wf_chspec_ctlchan(chspec);
+				channel_band = CHSPEC2WLC_BAND(chspec);
+
+				if ((cfg->curr_band == WLC_BAND_5G) &&
+					(channel_band == WLC_BAND_2G)) {
+					/* Avoid sending the GO results in band conflict */
+					if (wl_cfgp2p_retreive_p2pattrib(p2p_ie,
+						P2P_SEID_GROUP_ID) != NULL)
+						goto exit;
+				}
+#endif /* WL_HOST_BAND_MGMT */
+			}
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+			if (bi_length > ESCAN_BUF_SIZE - list->buflen)
+				remove_lower_rssi = TRUE;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+			WL_SCAN(("%s("MACDBG") RSSI %d flags 0x%x length %d\n", bi->SSID,
+				MAC2STRDBG(bi->BSSID.octet), bi->RSSI, bi->flags, bi->length));
+			for (i = 0; i < list->count; i++) {
+				bss = bss ? (wl_bss_info_t *)((uintptr)bss + dtoh32(bss->length))
+					: list->bss_info;
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+				WL_TRACE(("%s("MACDBG"), i=%d bss: RSSI %d list->count %d\n",
+					bss->SSID, MAC2STRDBG(bss->BSSID.octet),
+					i, bss->RSSI, list->count));
+
+				if (remove_lower_rssi)
+					wl_cfg80211_find_removal_candidate(bss, candidate);
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+				if (!bcmp(&bi->BSSID, &bss->BSSID, ETHER_ADDR_LEN) &&
+					(CHSPEC_BAND(wl_chspec_driver_to_host(bi->chanspec))
+					== CHSPEC_BAND(wl_chspec_driver_to_host(bss->chanspec))) &&
+					bi->SSID_len == bss->SSID_len &&
+					!bcmp(bi->SSID, bss->SSID, bi->SSID_len)) {
+
+					/* do not allow beacon data to update
+					*the data recd from a probe response
+					*/
+					if (!(bss->flags & WL_BSS_FLAGS_FROM_BEACON) &&
+						(bi->flags & WL_BSS_FLAGS_FROM_BEACON))
+						goto exit;
+
+					WL_SCAN(("%s("MACDBG"), i=%d prev: RSSI %d"
+						" flags 0x%x, new: RSSI %d flags 0x%x\n",
+						bss->SSID, MAC2STRDBG(bi->BSSID.octet), i,
+						bss->RSSI, bss->flags, bi->RSSI, bi->flags));
+
+					if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) ==
+						(bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL)) {
+						/* preserve max RSSI if the measurements are
+						* both on-channel or both off-channel
+						*/
+						WL_SCAN(("%s("MACDBG"), same onchan"
+						", RSSI: prev %d new %d\n",
+						bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+						bss->RSSI, bi->RSSI));
+						bi->RSSI = MAX(bss->RSSI, bi->RSSI);
+					} else if ((bss->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) &&
+						(bi->flags & WL_BSS_FLAGS_RSSI_ONCHANNEL) == 0) {
+						/* preserve the on-channel rssi measurement
+						* if the new measurement is off channel
+						*/
+						WL_SCAN(("%s("MACDBG"), prev onchan"
+						", RSSI: prev %d new %d\n",
+						bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+						bss->RSSI, bi->RSSI));
+						bi->RSSI = bss->RSSI;
+						bi->flags |= WL_BSS_FLAGS_RSSI_ONCHANNEL;
+					}
+					if (dtoh32(bss->length) != bi_length) {
+						u32 prev_len = dtoh32(bss->length);
+
+						WL_SCAN(("bss info replacement"
+							" is occured(bcast:%d->probresp%d)\n",
+							bss->ie_length, bi->ie_length));
+						WL_SCAN(("%s("MACDBG"), replacement!(%d -> %d)\n",
+						bss->SSID, MAC2STRDBG(bi->BSSID.octet),
+						prev_len, bi_length));
+
+						if (list->buflen - prev_len + bi_length
+							> ESCAN_BUF_SIZE) {
+							WL_ERR(("Buffer is too small: keep the"
+								" previous result of this AP\n"));
+							/* Only update RSSI */
+							bss->RSSI = bi->RSSI;
+							bss->flags |= (bi->flags
+								& WL_BSS_FLAGS_RSSI_ONCHANNEL);
+							goto exit;
+						}
+
+						if (i < list->count - 1) {
+							/* memory copy required by this case only */
+							memmove((u8 *)bss + bi_length,
+								(u8 *)bss + prev_len,
+								list->buflen - cur_len - prev_len);
+						}
+						list->buflen -= prev_len;
+						list->buflen += bi_length;
+					}
+					list->version = dtoh32(bi->version);
+					memcpy((u8 *)bss, (u8 *)bi, bi_length);
+					goto exit;
+				}
+				cur_len += dtoh32(bss->length);
+			}
+			if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+				wl_cfg80211_remove_lowRSSI_info(list, candidate, bi);
+				if (bi_length > ESCAN_BUF_SIZE - list->buflen) {
+					WL_DBG(("RSSI(" MACDBG ") is too low(%d) to add Buffer\n",
+						MAC2STRDBG(bi->BSSID.octet), bi->RSSI));
+					goto exit;
+				}
+#else
+				WL_ERR(("Buffer is too small: ignoring\n"));
+				goto exit;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+			}
+			if (strlen(bi->SSID) == 0) { // terence: fix for hidden SSID
+				WL_SCAN(("Skip hidden SSID %pM\n", &bi->BSSID));
+				goto exit;
+			}
+
+			memcpy(&(((char *)list)[list->buflen]), bi, bi_length);
+			list->version = dtoh32(bi->version);
+			list->buflen += bi_length;
+			list->count++;
+
+		}
+
+	}
+	else if (status == WLC_E_STATUS_SUCCESS) {
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#if defined(P2P_DISCOVERY_WAR)
+		if (cfg->p2p_net && cfg->scan_request &&
+			cfg->scan_request->dev == cfg->p2p_net &&
+			!cfg->p2p->vif_created) {
+			if (wldev_iovar_setint(wl_to_prmry_ndev(cfg), "mpc", 1) < 0) {
+				WL_ERR(("mpc enabling back failed\n"));
+			}
+		}
+#endif /* defined(P2P_DISCOVERY_WAR) */
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+		cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+		wl_escan_print_sync_id(status, cfg->escan_info.cur_sync_id,
+			escan_result->sync_id);
+
+		if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+			WL_INFORM(("ACTION FRAME SCAN DONE\n"));
+			wl_clr_p2p_status(cfg, SCANNING);
+			wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+			if (cfg->afx_hdl->peer_chan == WL_INVALID)
+				complete(&cfg->act_frm_scan);
+		} else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+			WL_INFORM(("ESCAN COMPLETED\n"));
+			cfg->bss_list = wl_escan_get_buf(cfg, FALSE);
+			if (!scan_req_match(cfg)) {
+				WL_TRACE_HW4(("SCAN COMPLETED: scanned AP count=%d\n",
+					cfg->bss_list->count));
+			}
+			wl_inform_bss(cfg);
+			wl_notify_escan_complete(cfg, ndev, false, false);
+		}
+		wl_escan_increment_sync_id(cfg, SCAN_BUF_NEXT);
+	}
+	else if (status == WLC_E_STATUS_ABORT) {
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#if defined(P2P_DISCOVERY_WAR)
+		if (cfg->p2p_net && cfg->scan_request &&
+			cfg->scan_request->dev == cfg->p2p_net &&
+			!cfg->p2p->vif_created) {
+			if (wldev_iovar_setint(wl_to_prmry_ndev(cfg), "mpc", 1) < 0) {
+				WL_ERR(("mpc enabling back failed\n"));
+			}
+		}
+#endif /* defined(P2P_DISCOVERY_WAR) */
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+		cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+		wl_escan_print_sync_id(status, escan_result->sync_id,
+			cfg->escan_info.cur_sync_id);
+		if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+			WL_INFORM(("ACTION FRAME SCAN DONE\n"));
+			wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+			wl_clr_p2p_status(cfg, SCANNING);
+			if (cfg->afx_hdl->peer_chan == WL_INVALID)
+				complete(&cfg->act_frm_scan);
+		} else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+			WL_INFORM(("ESCAN ABORTED\n"));
+			cfg->bss_list = wl_escan_get_buf(cfg, TRUE);
+			if (!scan_req_match(cfg)) {
+				WL_TRACE_HW4(("SCAN ABORTED: scanned AP count=%d\n",
+					cfg->bss_list->count));
+			}
+			wl_inform_bss(cfg);
+			wl_notify_escan_complete(cfg, ndev, true, false);
+		}
+		wl_escan_increment_sync_id(cfg, SCAN_BUF_CNT);
+	} else if (status == WLC_E_STATUS_NEWSCAN) {
+		WL_ERR(("WLC_E_STATUS_NEWSCAN : scan_request[%p]\n", cfg->scan_request));
+		WL_ERR(("sync_id[%d], bss_count[%d]\n", escan_result->sync_id,
+			escan_result->bss_count));
+	} else if (status == WLC_E_STATUS_TIMEOUT) {
+		WL_ERR(("WLC_E_STATUS_TIMEOUT : scan_request[%p]\n", cfg->scan_request));
+		WL_ERR(("reason[0x%x]\n", e->reason));
+		if (e->reason == 0xFFFFFFFF) {
+			wl_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
+		}
+	} else {
+		WL_ERR(("unexpected Escan Event %d : abort\n", status));
+		cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+		wl_escan_print_sync_id(status, escan_result->sync_id,
+			cfg->escan_info.cur_sync_id);
+		if (wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+			WL_INFORM(("ACTION FRAME SCAN DONE\n"));
+			wl_clr_p2p_status(cfg, SCANNING);
+			wl_clr_drv_status(cfg, SCANNING, cfg->afx_hdl->dev);
+			if (cfg->afx_hdl->peer_chan == WL_INVALID)
+				complete(&cfg->act_frm_scan);
+		} else if ((likely(cfg->scan_request)) || (cfg->sched_scan_running)) {
+			cfg->bss_list = wl_escan_get_buf(cfg, TRUE);
+			if (!scan_req_match(cfg)) {
+				WL_TRACE_HW4(("SCAN ABORTED(UNEXPECTED): "
+					"scanned AP count=%d\n",
+					cfg->bss_list->count));
+			}
+			wl_inform_bss(cfg);
+			wl_notify_escan_complete(cfg, ndev, true, false);
+		}
+		wl_escan_increment_sync_id(cfg, 2);
+	}
+exit:
+	mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+
+static void wl_cfg80211_concurrent_roam(struct bcm_cfg80211 *cfg, int enable)
+{
+	u32 connected_cnt  = wl_get_drv_status_all(cfg, CONNECTED);
+	struct net_info *iter, *next;
+	int err;
+
+	if (!cfg->roamoff_on_concurrent)
+		return;
+	if (enable && connected_cnt > 1) {
+		for_each_ndev(cfg, iter, next) {
+			/* Save the current roam setting */
+			if ((err = wldev_iovar_getint(iter->ndev, "roam_off",
+				(s32 *)&iter->roam_off)) != BCME_OK) {
+				WL_ERR(("%s:Failed to get current roam setting err %d\n",
+					iter->ndev->name, err));
+				continue;
+			}
+			if ((err = wldev_iovar_setint(iter->ndev, "roam_off", 1)) != BCME_OK) {
+				WL_ERR((" %s:failed to set roam_off : %d\n",
+					iter->ndev->name, err));
+			}
+		}
+	}
+	else if (!enable) {
+		for_each_ndev(cfg, iter, next) {
+			if (iter->roam_off != WL_INVALID) {
+				if ((err = wldev_iovar_setint(iter->ndev, "roam_off",
+					iter->roam_off)) == BCME_OK)
+					iter->roam_off = WL_INVALID;
+				else {
+					WL_ERR((" %s:failed to set roam_off : %d\n",
+						iter->ndev->name, err));
+				}
+			}
+		}
+	}
+	return;
+}
+
+static void wl_cfg80211_determine_vsdb_mode(struct bcm_cfg80211 *cfg)
+{
+	struct net_info *iter, *next;
+	u32 ctl_chan = 0;
+	u32 chanspec = 0;
+	u32 pre_ctl_chan = 0;
+	u32 connected_cnt  = wl_get_drv_status_all(cfg, CONNECTED);
+	cfg->vsdb_mode = false;
+
+	if (connected_cnt <= 1)  {
+		return;
+	}
+	for_each_ndev(cfg, iter, next) {
+		chanspec = 0;
+		ctl_chan = 0;
+		if (wl_get_drv_status(cfg, CONNECTED, iter->ndev)) {
+			if (wldev_iovar_getint(iter->ndev, "chanspec",
+				(s32 *)&chanspec) == BCME_OK) {
+				chanspec = wl_chspec_driver_to_host(chanspec);
+				ctl_chan = wf_chspec_ctlchan(chanspec);
+				wl_update_prof(cfg, iter->ndev, NULL,
+					&ctl_chan, WL_PROF_CHAN);
+			}
+			if (!cfg->vsdb_mode) {
+				if (!pre_ctl_chan && ctl_chan)
+					pre_ctl_chan = ctl_chan;
+				else if (pre_ctl_chan && (pre_ctl_chan != ctl_chan)) {
+					cfg->vsdb_mode = true;
+				}
+			}
+		}
+	}
+	printf("%s concurrency is enabled\n", cfg->vsdb_mode ? "Multi Channel" : "Same Channel");
+	return;
+}
+
+static s32 wl_notifier_change_state(struct bcm_cfg80211 *cfg, struct net_info *_net_info,
+	enum wl_status state, bool set)
+{
+	s32 pm = PM_FAST;
+	s32 err = BCME_OK;
+	u32 mode;
+	u32 chan = 0;
+	struct net_info *iter, *next;
+	struct net_device *primary_dev = bcmcfg_to_prmry_ndev(cfg);
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+	WL_DBG(("Enter state %d set %d _net_info->pm_restore %d iface %s\n",
+		state, set, _net_info->pm_restore, _net_info->ndev->name));
+
+	if (state != WL_STATUS_CONNECTED)
+		return 0;
+	mode = wl_get_mode_by_netdev(cfg, _net_info->ndev);
+	if (set) {
+		wl_cfg80211_concurrent_roam(cfg, 1);
+
+		if (mode == WL_MODE_AP) {
+
+			if (wl_add_remove_eventmsg(primary_dev, WLC_E_P2P_PROBREQ_MSG, false))
+				WL_ERR((" failed to unset WLC_E_P2P_PROPREQ_MSG\n"));
+		}
+		wl_cfg80211_determine_vsdb_mode(cfg);
+		if (cfg->vsdb_mode || _net_info->pm_block) {
+			/* Delete pm_enable_work */
+			wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_MAINTAIN);
+			/* save PM_FAST in _net_info to restore this
+			 * if _net_info->pm_block is false
+			 */
+			if (!_net_info->pm_block && (mode == WL_MODE_BSS)) {
+				_net_info->pm = PM_FAST;
+				if (dhd_conf_get_pm(dhd) >= 0)
+					_net_info->pm = dhd_conf_get_pm(dhd);
+				_net_info->pm_restore = true;
+			}
+			pm = PM_OFF;
+			for_each_ndev(cfg, iter, next) {
+				if (iter->pm_restore)
+					continue;
+				/* Save the current power mode */
+				err = wldev_ioctl(iter->ndev, WLC_GET_PM, &iter->pm,
+					sizeof(iter->pm), false);
+				WL_DBG(("%s:power save %s\n", iter->ndev->name,
+					iter->pm ? "enabled" : "disabled"));
+				if (!err && iter->pm) {
+					iter->pm_restore = true;
+				}
+
+			}
+			for_each_ndev(cfg, iter, next) {
+				if (!wl_get_drv_status(cfg, CONNECTED, iter->ndev))
+					continue;
+				if (pm != PM_OFF && dhd_conf_get_pm(dhd) >= 0)
+					pm = dhd_conf_get_pm(dhd);
+				if ((err = wldev_ioctl(iter->ndev, WLC_SET_PM, &pm,
+					sizeof(pm), true)) != 0) {
+					if (err == -ENODEV)
+						WL_DBG(("%s:netdev not ready\n", iter->ndev->name));
+					else
+						WL_ERR(("%s:error (%d)\n", iter->ndev->name, err));
+					wl_cfg80211_update_power_mode(iter->ndev);
+				}
+			}
+		} else {
+			/* add PM Enable timer to go to power save mode
+			 * if supplicant control pm mode, it will be cleared or
+			 * updated by wl_cfg80211_set_power_mgmt() if not - for static IP & HW4 P2P,
+			 * PM will be configured when timer expired
+			 */
+
+			/*
+			 * before calling pm_enable_timer, we need to set PM -1 for all ndev
+			 */
+			pm = PM_OFF;
+			if (!_net_info->pm_block) {
+				for_each_ndev(cfg, iter, next) {
+					if (iter->pm_restore)
+						continue;
+					/* Save the current power mode */
+					err = wldev_ioctl(iter->ndev, WLC_GET_PM, &iter->pm,
+						sizeof(iter->pm), false);
+					WL_DBG(("%s:power save %s\n", iter->ndev->name,
+						iter->pm ? "enabled" : "disabled"));
+					if (!err && iter->pm) {
+						iter->pm_restore = true;
+					}
+				}
+			}
+			for_each_ndev(cfg, iter, next) {
+				if (!wl_get_drv_status(cfg, CONNECTED, iter->ndev))
+					continue;
+				if (pm != PM_OFF && dhd_conf_get_pm(dhd) >= 0)
+					pm = dhd_conf_get_pm(dhd);
+				if ((err = wldev_ioctl(iter->ndev, WLC_SET_PM, &pm,
+					sizeof(pm), true)) != 0) {
+					if (err == -ENODEV)
+						WL_DBG(("%s:netdev not ready\n", iter->ndev->name));
+					else
+						WL_ERR(("%s:error (%d)\n", iter->ndev->name, err));
+				}
+			}
+
+			if (cfg->pm_enable_work_on) {
+				wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_DEL);
+			}
+
+			cfg->pm_enable_work_on = true;
+			wl_add_remove_pm_enable_work(cfg, TRUE, WL_HANDLER_NOTUSE);
+		}
+#if defined(WLTDLS)
+#if defined(DISABLE_TDLS_IN_P2P)
+		if (cfg->vsdb_mode || p2p_is_on(cfg))
+#else
+		if (cfg->vsdb_mode)
+#endif /* defined(DISABLE_TDLS_IN_P2P) */
+		{
+
+			err = wldev_iovar_setint(primary_dev, "tdls_enable", 0);
+		}
+#endif /* defined(WLTDLS) */
+	}
+	 else { /* clear */
+		chan = 0;
+		/* clear chan information when the net device is disconnected */
+		wl_update_prof(cfg, _net_info->ndev, NULL, &chan, WL_PROF_CHAN);
+		wl_cfg80211_determine_vsdb_mode(cfg);
+		for_each_ndev(cfg, iter, next) {
+			if (iter->pm_restore && iter->pm) {
+				WL_DBG(("%s:restoring power save %s\n",
+					iter->ndev->name, (iter->pm ? "enabled" : "disabled")));
+				if (iter->pm != PM_OFF && dhd_conf_get_pm(dhd) >= 0)
+					iter->pm = dhd_conf_get_pm(dhd);
+				err = wldev_ioctl(iter->ndev,
+					WLC_SET_PM, &iter->pm, sizeof(iter->pm), true);
+				if (unlikely(err)) {
+					if (err == -ENODEV)
+						WL_DBG(("%s:netdev not ready\n", iter->ndev->name));
+					else
+						WL_ERR(("%s:error(%d)\n", iter->ndev->name, err));
+					break;
+				}
+				iter->pm_restore = 0;
+				wl_cfg80211_update_power_mode(iter->ndev);
+			}
+		}
+		wl_cfg80211_concurrent_roam(cfg, 0);
+#if defined(WLTDLS)
+		if (!cfg->vsdb_mode) {
+			err = wldev_iovar_setint(primary_dev, "tdls_enable", 1);
+		}
+#endif /* defined(WLTDLS) */
+	}
+	return err;
+}
+static s32 wl_init_scan(struct bcm_cfg80211 *cfg)
+{
+	int err = 0;
+
+	cfg->evt_handler[WLC_E_ESCAN_RESULT] = wl_escan_handler;
+	cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+	wl_escan_init_sync_id(cfg);
+
+	/* Init scan_timeout timer */
+	init_timer(&cfg->scan_timeout);
+	cfg->scan_timeout.data = (unsigned long) cfg;
+	cfg->scan_timeout.function = wl_scan_timeout;
+
+	return err;
+}
+
+static s32 wl_init_priv(struct bcm_cfg80211 *cfg)
+{
+	struct wiphy *wiphy = bcmcfg_to_wiphy(cfg);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	s32 err = 0;
+
+	cfg->scan_request = NULL;
+	cfg->pwr_save = !!(wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT);
+	cfg->roam_on = false;
+	cfg->active_scan = true;
+	cfg->rf_blocked = false;
+	cfg->vsdb_mode = false;
+#if defined(BCMSDIO)
+	cfg->wlfc_on = false;
+#endif
+	cfg->roamoff_on_concurrent = true;
+	cfg->disable_roam_event = false;
+	/* register interested state */
+	set_bit(WL_STATUS_CONNECTED, &cfg->interrested_state);
+	spin_lock_init(&cfg->cfgdrv_lock);
+	mutex_init(&cfg->ioctl_buf_sync);
+	init_waitqueue_head(&cfg->netif_change_event);
+	init_completion(&cfg->send_af_done);
+	init_completion(&cfg->iface_disable);
+	wl_init_eq(cfg);
+	err = wl_init_priv_mem(cfg);
+	if (err)
+		return err;
+	if (wl_create_event_handler(cfg))
+		return -ENOMEM;
+	wl_init_event_handler(cfg);
+	mutex_init(&cfg->usr_sync);
+	mutex_init(&cfg->event_sync);
+	err = wl_init_scan(cfg);
+	if (err)
+		return err;
+	wl_init_conf(cfg->conf);
+	wl_init_prof(cfg, ndev);
+	wl_link_down(cfg);
+	DNGL_FUNC(dhd_cfg80211_init, (cfg));
+
+	return err;
+}
+
+static void wl_deinit_priv(struct bcm_cfg80211 *cfg)
+{
+	DNGL_FUNC(dhd_cfg80211_deinit, (cfg));
+	wl_destroy_event_handler(cfg);
+	wl_flush_eq(cfg);
+	wl_link_down(cfg);
+	del_timer_sync(&cfg->scan_timeout);
+	wl_deinit_priv_mem(cfg);
+	if (wl_cfg80211_netdev_notifier_registered) {
+		wl_cfg80211_netdev_notifier_registered = FALSE;
+		unregister_netdevice_notifier(&wl_cfg80211_netdev_notifier);
+	}
+}
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+struct net_device *wl0dot1_dev;
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT) || \
+	defined(P2PONEINT)
+static s32 wl_cfg80211_attach_p2p(void)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	WL_TRACE(("Enter \n"));
+
+	if (wl_cfgp2p_register_ndev(cfg) < 0) {
+		WL_ERR(("P2P attach failed. \n"));
+		return -ENODEV;
+	}
+
+#if defined(CUSTOMER_HW20) && defined(WLANAUDIO)
+	wl0dot1_dev = cfg->p2p_net;
+#endif /* CUSTOMER_HW20 && WLANAUDIO */
+
+	return 0;
+}
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT || P2PONEINT */
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+static s32  wl_cfg80211_detach_p2p(void)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct wireless_dev *wdev;
+
+	WL_DBG(("Enter \n"));
+	if (!cfg) {
+		WL_ERR(("Invalid Ptr\n"));
+		return -EINVAL;
+	} else
+		wdev = cfg->p2p_wdev;
+
+#ifndef WL_NEWCFG_PRIVCMD_SUPPORT
+	if (!wdev) {
+		WL_ERR(("Invalid Ptr\n"));
+		return -EINVAL;
+	}
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	wl_cfgp2p_unregister_ndev(cfg);
+
+	cfg->p2p_wdev = NULL;
+	cfg->p2p_net = NULL;
+#ifndef WL_NEWCFG_PRIVCMD_SUPPORT
+	WL_DBG(("Freeing 0x%08x \n", (unsigned int)wdev));
+	kfree(wdev);
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	return 0;
+}
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT */
+
+s32 wl_cfg80211_attach_post(struct net_device *ndev)
+{
+	struct bcm_cfg80211 * cfg = NULL;
+	s32 err = 0;
+	s32 ret = 0;
+	WL_TRACE(("In\n"));
+	if (unlikely(!ndev)) {
+		WL_ERR(("ndev is invaild\n"));
+		return -ENODEV;
+	}
+	cfg = g_bcm_cfg;
+	if (unlikely(!cfg)) {
+		WL_ERR(("cfg is invaild\n"));
+		return -EINVAL;
+	}
+	if (!wl_get_drv_status(cfg, READY, ndev)) {
+		if (cfg->wdev) {
+			ret = wl_cfgp2p_supported(cfg, ndev);
+			if (ret > 0) {
+#if !defined(WL_ENABLE_P2P_IF)
+				cfg->wdev->wiphy->interface_modes |=
+					(BIT(NL80211_IFTYPE_P2P_CLIENT)|
+					BIT(NL80211_IFTYPE_P2P_GO));
+#endif /* !WL_ENABLE_P2P_IF */
+				if ((err = wl_cfgp2p_init_priv(cfg)) != 0)
+					goto fail;
+
+#ifdef P2PONEINT
+				if (!cfg->p2p_net) {
+					cfg->p2p_supported = true;
+
+					err = wl_cfg80211_attach_p2p();
+					if (err)
+						goto fail;
+
+					cfg->p2p_supported = true;
+				}
+#endif
+#if defined(WL_ENABLE_P2P_IF) || defined(P2PONEINT)
+				if (cfg->p2p_net) {
+					/* Update MAC addr for p2p0 interface here. */
+					memcpy(cfg->p2p_net->dev_addr, ndev->dev_addr, ETH_ALEN);
+					cfg->p2p_net->dev_addr[0] |= 0x02;
+					printf("%s: p2p_dev_addr="MACDBG "\n",
+						cfg->p2p_net->name,
+						MAC2STRDBG(cfg->p2p_net->dev_addr));
+				} else {
+					WL_ERR(("p2p_net not yet populated."
+					" Couldn't update the MAC Address for p2p0 \n"));
+					return -ENODEV;
+				}
+#endif /* WL_ENABLE_P2P_IF */
+#ifndef  P2PONEINT
+				cfg->p2p_supported = true;
+#endif
+			} else if (ret == 0) {
+				if ((err = wl_cfgp2p_init_priv(cfg)) != 0)
+					goto fail;
+			} else {
+				/* SDIO bus timeout */
+				err = -ENODEV;
+				goto fail;
+			}
+		}
+	}
+	wl_set_drv_status(cfg, READY, ndev);
+fail:
+	return err;
+}
+
+s32 wl_cfg80211_attach(struct net_device *ndev, void *context)
+{
+	struct wireless_dev *wdev;
+	struct bcm_cfg80211 *cfg;
+	s32 err = 0;
+	struct device *dev;
+
+	WL_TRACE(("In\n"));
+	if (!ndev) {
+		WL_ERR(("ndev is invaild\n"));
+		return -ENODEV;
+	}
+	WL_DBG(("func %p\n", wl_cfg80211_get_parent_dev()));
+	dev = wl_cfg80211_get_parent_dev();
+
+	wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+	if (unlikely(!wdev)) {
+		WL_ERR(("Could not allocate wireless device\n"));
+		return -ENOMEM;
+	}
+	err = wl_setup_wiphy(wdev, dev, context);
+	if (unlikely(err)) {
+		kfree(wdev);
+		return -ENOMEM;
+	}
+	wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+	cfg = (struct bcm_cfg80211 *)wiphy_priv(wdev->wiphy);
+	cfg->wdev = wdev;
+	cfg->pub = context;
+	INIT_LIST_HEAD(&cfg->net_list);
+	ndev->ieee80211_ptr = wdev;
+	SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+	wdev->netdev = ndev;
+	cfg->state_notifier = wl_notifier_change_state;
+	err = wl_alloc_netinfo(cfg, ndev, wdev, WL_MODE_BSS, PM_ENABLE);
+	if (err) {
+		WL_ERR(("Failed to alloc net_info (%d)\n", err));
+		goto cfg80211_attach_out;
+	}
+	err = wl_init_priv(cfg);
+	if (err) {
+		WL_ERR(("Failed to init iwm_priv (%d)\n", err));
+		goto cfg80211_attach_out;
+	}
+
+	err = wl_setup_rfkill(cfg, TRUE);
+	if (err) {
+		WL_ERR(("Failed to setup rfkill %d\n", err));
+		goto cfg80211_attach_out;
+	}
+#ifdef DEBUGFS_CFG80211
+	err = wl_setup_debugfs(cfg);
+	if (err) {
+		WL_ERR(("Failed to setup debugfs %d\n", err));
+		goto cfg80211_attach_out;
+	}
+#endif
+	if (!wl_cfg80211_netdev_notifier_registered) {
+		wl_cfg80211_netdev_notifier_registered = TRUE;
+		err = register_netdevice_notifier(&wl_cfg80211_netdev_notifier);
+		if (err) {
+			wl_cfg80211_netdev_notifier_registered = FALSE;
+			WL_ERR(("Failed to register notifierl %d\n", err));
+			goto cfg80211_attach_out;
+		}
+	}
+#if defined(COEX_DHCP)
+	cfg->btcoex_info = wl_cfg80211_btcoex_init(cfg->wdev->netdev);
+	if (!cfg->btcoex_info)
+		goto cfg80211_attach_out;
+#endif
+
+	g_bcm_cfg = cfg;
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+#ifndef  P2PONEINT
+	err = wl_cfg80211_attach_p2p();
+	if (err)
+		goto cfg80211_attach_out;
+#endif
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	return err;
+
+cfg80211_attach_out:
+	wl_setup_rfkill(cfg, FALSE);
+	wl_free_wdev(cfg);
+	return err;
+}
+
+void wl_cfg80211_detach(void *para)
+{
+	struct bcm_cfg80211 *cfg;
+
+	(void)para;
+	cfg = g_bcm_cfg;
+
+	WL_TRACE(("In\n"));
+
+	wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_DEL);
+
+#if defined(COEX_DHCP)
+	wl_cfg80211_btcoex_deinit();
+	cfg->btcoex_info = NULL;
+#endif
+
+	wl_setup_rfkill(cfg, FALSE);
+#ifdef DEBUGFS_CFG80211
+	wl_free_debugfs(cfg);
+#endif
+	if (cfg->p2p_supported) {
+		if (timer_pending(&cfg->p2p->listen_timer))
+			del_timer_sync(&cfg->p2p->listen_timer);
+		wl_cfgp2p_deinit_priv(cfg);
+	}
+
+	if (timer_pending(&cfg->scan_timeout))
+		del_timer_sync(&cfg->scan_timeout);
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF  */
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+	wl_cfg80211_detach_p2p();
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	wl_cfg80211_ibss_vsie_free(cfg);
+	wl_deinit_priv(cfg);
+	g_bcm_cfg = NULL;
+	wl_cfg80211_clear_parent_dev();
+	wl_free_wdev(cfg);
+#if defined(RSSIAVG)
+	wl_free_rssi_cache(&g_rssi_cache_ctrl);
+	wl_free_rssi_cache(&g_rssi2_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+	wl_release_bss_cache_ctrl(&g_bss_cache_ctrl);
+#endif
+	/* PLEASE do NOT call any function after wl_free_wdev, the driver's private
+	 * structure "cfg", which is the private part of wiphy, has been freed in
+	 * wl_free_wdev !!!!!!!!!!!
+	 */
+}
+
+static void wl_wakeup_event(struct bcm_cfg80211 *cfg)
+{
+	if (cfg->event_tsk.thr_pid >= 0) {
+		DHD_OS_WAKE_LOCK(cfg->pub);
+		up(&cfg->event_tsk.sema);
+	}
+}
+
+#if defined(P2PONEINT) || defined(WL_ENABLE_P2P_IF)
+static int wl_is_p2p_event(struct wl_event_q *e)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	switch (e->etype) {
+		case WLC_E_IF:
+			WL_TRACE(("P2P event(%d) on interface(ifidx:%d)\n",
+				e->etype, e->emsg.ifidx));
+
+			(void)schedule_timeout(20);
+
+			if (wl_get_p2p_status(cfg, IF_ADDING) ||
+				wl_get_p2p_status(cfg, IF_DELETING) ||
+				wl_get_p2p_status(cfg, IF_CHANGING) ||
+				wl_get_p2p_status(cfg, IF_CHANGED)) {
+				WL_TRACE(("P2P Event on Primary I/F (ifidx:%d)."
+					" Sent it to p2p0 \n", e->emsg.ifidx));
+				return TRUE;
+			} else {
+				WL_TRACE(("Event is Not p2p event return False \n"));
+				return FALSE;
+			}
+
+		case WLC_E_P2P_PROBREQ_MSG:
+		case WLC_E_P2P_DISC_LISTEN_COMPLETE:
+		case WLC_E_ACTION_FRAME_RX:
+		case WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE:
+		case WLC_E_ACTION_FRAME_COMPLETE:
+
+			if (e->emsg.ifidx != 0) {
+				WL_TRACE(("P2P event(%d) on virtual interface(ifidx:%d)\n",
+					e->etype, e->emsg.ifidx));
+				return FALSE;
+			} else {
+				WL_TRACE(("P2P event(%d) on interface(ifidx:%d)\n",
+					e->etype, e->emsg.ifidx));
+				return TRUE;
+			}
+			break;
+
+		default:
+			WL_TRACE(("NON-P2P event(%d) on interface(ifidx:%d)\n",
+				e->etype, e->emsg.ifidx));
+			return FALSE;
+	}
+}
+#endif
+
+static s32 wl_event_handler(void *data)
+{
+	struct bcm_cfg80211 *cfg = NULL;
+	struct wl_event_q *e;
+	tsk_ctl_t *tsk = (tsk_ctl_t *)data;
+	bcm_struct_cfgdev *cfgdev = NULL;
+
+	cfg = (struct bcm_cfg80211 *)tsk->parent;
+
+	printf("tsk Enter, tsk = 0x%p\n", tsk);
+
+	while (down_interruptible (&tsk->sema) == 0) {
+		SMP_RD_BARRIER_DEPENDS();
+		if (tsk->terminated)
+			break;
+		while ((e = wl_deq_event(cfg))) {
+			WL_DBG(("event type (%d), if idx: %d\n", e->etype, e->emsg.ifidx));
+			/* All P2P device address related events comes on primary interface since
+			 * there is no corresponding bsscfg for P2P interface. Map it to p2p0
+			 * interface.
+			 */
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#ifdef P2PONEINT
+			if ((wl_is_p2p_event(e) == TRUE) && (cfg->p2p_wdev))
+#else
+			if (WL_IS_P2P_DEV_EVENT(e) && (cfg->p2p_wdev))
+#endif
+			{
+				cfgdev = bcmcfg_to_p2p_wdev(cfg);
+			} else {
+				struct net_device *ndev = NULL;
+
+				ndev = dhd_idx2net((struct dhd_pub *)(cfg->pub), e->emsg.ifidx);
+				if (ndev)
+					cfgdev = ndev_to_wdev(ndev);
+#ifdef P2PONEINT
+				else if (e->etype == WLC_E_IF) {
+					wl_put_event(e);
+					DHD_OS_WAKE_UNLOCK(cfg->pub);
+					continue;
+				}
+
+				if (cfgdev == NULL) {
+					if (e->etype == WLC_E_IF)
+						cfgdev = bcmcfg_to_prmry_wdev(cfg);
+					else {
+						cfgdev = ndev_to_wdev(wl_to_p2p_bss_ndev(cfg,
+							P2PAPI_BSSCFG_CONNECTION));
+					}
+				}
+#endif
+			}
+#elif defined(WL_ENABLE_P2P_IF)
+			// terence 20150116: fix for p2p connection in kernel 3.4
+//			if (WL_IS_P2P_DEV_EVENT(e) && (cfg->p2p_net)) {
+			if ((wl_is_p2p_event(e) == TRUE) && (cfg->p2p_net)) {
+				cfgdev = cfg->p2p_net;
+			} else {
+				cfgdev = dhd_idx2net((struct dhd_pub *)(cfg->pub),
+					e->emsg.ifidx);
+			}
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+			if (!cfgdev) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+				cfgdev = bcmcfg_to_prmry_wdev(cfg);
+#else
+				cfgdev = bcmcfg_to_prmry_ndev(cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+			}
+			if (e->etype < WLC_E_LAST && cfg->evt_handler[e->etype]) {
+				cfg->evt_handler[e->etype] (cfg, cfgdev, &e->emsg, e->edata);
+			} else {
+				WL_DBG(("Unknown Event (%d): ignoring\n", e->etype));
+			}
+			wl_put_event(e);
+		}
+		DHD_OS_WAKE_UNLOCK(cfg->pub);
+	}
+	printf("%s: was terminated\n", __FUNCTION__);
+	complete_and_exit(&tsk->completed, 0);
+	return 0;
+}
+
+void
+wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t * e, void *data)
+{
+	u32 event_type = ntoh32(e->event_type);
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+#if (WL_DBG_LEVEL > 0)
+	s8 *estr = (event_type <= sizeof(wl_dbg_estr) / WL_DBG_ESTR_MAX - 1) ?
+	    wl_dbg_estr[event_type] : (s8 *) "Unknown";
+	WL_DBG(("event_type (%d):" "WLC_E_" "%s\n", event_type, estr));
+#endif /* (WL_DBG_LEVEL > 0) */
+
+	if (wl_get_p2p_status(cfg, IF_CHANGING) || wl_get_p2p_status(cfg, IF_ADDING)) {
+		WL_ERR(("during IF change, ignore event %d\n", event_type));
+		return;
+	}
+
+	if (ndev != bcmcfg_to_prmry_ndev(cfg) && cfg->p2p_supported) {
+		if ((cfg->bss_cfgdev) &&
+			(ndev == cfgdev_to_wlc_ndev(cfg->bss_cfgdev, cfg))) {
+			/* Event is corresponding to the secondary STA interface */
+			WL_DBG(("DualSta event (%d), proceed to enqueue it \n", event_type));
+		} else if (ndev != wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION) &&
+#if defined(WL_ENABLE_P2P_IF)
+			(ndev != (cfg->p2p_net ? cfg->p2p_net :
+			wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE))) &&
+#else
+			(ndev != wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE)) &&
+#endif /* WL_ENABLE_P2P_IF */
+			TRUE) {
+			WL_ERR(("ignore event %d, not interested\n", event_type));
+			return;
+		}
+	}
+
+	if (event_type == WLC_E_PFN_NET_FOUND) {
+		WL_DBG((" PNOEVENT: PNO_NET_FOUND\n"));
+	}
+	else if (event_type == WLC_E_PFN_NET_LOST) {
+		WL_DBG((" PNOEVENT: PNO_NET_LOST\n"));
+	}
+
+	if (likely(!wl_enq_event(cfg, ndev, event_type, e, data)))
+		wl_wakeup_event(cfg);
+}
+
+static void wl_init_eq(struct bcm_cfg80211 *cfg)
+{
+	wl_init_eq_lock(cfg);
+	INIT_LIST_HEAD(&cfg->eq_list);
+}
+
+static void wl_flush_eq(struct bcm_cfg80211 *cfg)
+{
+	struct wl_event_q *e;
+	unsigned long flags;
+
+	flags = wl_lock_eq(cfg);
+	while (!list_empty(&cfg->eq_list)) {
+		e = list_first_entry(&cfg->eq_list, struct wl_event_q, eq_list);
+		list_del(&e->eq_list);
+		kfree(e);
+	}
+	wl_unlock_eq(cfg, flags);
+}
+
+/*
+* retrieve first queued event from head
+*/
+
+static struct wl_event_q *wl_deq_event(struct bcm_cfg80211 *cfg)
+{
+	struct wl_event_q *e = NULL;
+	unsigned long flags;
+
+	flags = wl_lock_eq(cfg);
+	if (likely(!list_empty(&cfg->eq_list))) {
+		e = list_first_entry(&cfg->eq_list, struct wl_event_q, eq_list);
+		list_del(&e->eq_list);
+	}
+	wl_unlock_eq(cfg, flags);
+
+	return e;
+}
+
+/*
+ * push event to tail of the queue
+ */
+
+static s32
+wl_enq_event(struct bcm_cfg80211 *cfg, struct net_device *ndev, u32 event,
+	const wl_event_msg_t *msg, void *data)
+{
+	struct wl_event_q *e;
+	s32 err = 0;
+	uint32 evtq_size;
+	uint32 data_len;
+	unsigned long flags;
+	gfp_t aflags;
+
+	data_len = 0;
+	if (data)
+		data_len = ntoh32(msg->datalen);
+	evtq_size = sizeof(struct wl_event_q) + data_len;
+	aflags = (in_atomic()) ? GFP_ATOMIC : GFP_KERNEL;
+	e = kzalloc(evtq_size, aflags);
+	if (unlikely(!e)) {
+		WL_ERR(("event alloc failed\n"));
+		return -ENOMEM;
+	}
+	e->etype = event;
+	memcpy(&e->emsg, msg, sizeof(wl_event_msg_t));
+	if (data)
+		memcpy(e->edata, data, data_len);
+	flags = wl_lock_eq(cfg);
+	list_add_tail(&e->eq_list, &cfg->eq_list);
+	wl_unlock_eq(cfg, flags);
+
+	return err;
+}
+
+static void wl_put_event(struct wl_event_q *e)
+{
+	kfree(e);
+}
+
+static s32 wl_config_ifmode(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 iftype)
+{
+	s32 infra = 0;
+	s32 err = 0;
+	s32 mode = 0;
+	switch (iftype) {
+	case NL80211_IFTYPE_MONITOR:
+	case NL80211_IFTYPE_WDS:
+		WL_ERR(("type (%d) : currently we do not support this mode\n",
+			iftype));
+		err = -EINVAL;
+		return err;
+	case NL80211_IFTYPE_ADHOC:
+		mode = WL_MODE_IBSS;
+		break;
+	case NL80211_IFTYPE_STATION:
+	case NL80211_IFTYPE_P2P_CLIENT:
+		mode = WL_MODE_BSS;
+		infra = 1;
+		break;
+	case NL80211_IFTYPE_AP:
+	case NL80211_IFTYPE_P2P_GO:
+		mode = WL_MODE_AP;
+		infra = 1;
+		break;
+	default:
+		err = -EINVAL;
+		WL_ERR(("invalid type (%d)\n", iftype));
+		return err;
+	}
+	infra = htod32(infra);
+	err = wldev_ioctl(ndev, WLC_SET_INFRA, &infra, sizeof(infra), true);
+	if (unlikely(err)) {
+		WL_ERR(("WLC_SET_INFRA error (%d)\n", err));
+		return err;
+	}
+
+	wl_set_mode_by_netdev(cfg, ndev, mode);
+
+	return 0;
+}
+
+void wl_cfg80211_add_to_eventbuffer(struct wl_eventmsg_buf *ev, u16 event, bool set)
+{
+	if (!ev || (event > WLC_E_LAST))
+		return;
+
+	if (ev->num < MAX_EVENT_BUF_NUM) {
+		ev->event[ev->num].type = event;
+		ev->event[ev->num].set = set;
+		ev->num++;
+	} else {
+		WL_ERR(("evenbuffer doesn't support > %u events. Update"
+			" the define MAX_EVENT_BUF_NUM \n", MAX_EVENT_BUF_NUM));
+		ASSERT(0);
+	}
+}
+
+s32 wl_cfg80211_apply_eventbuffer(
+	struct net_device *ndev,
+	struct bcm_cfg80211 *cfg,
+	wl_eventmsg_buf_t *ev)
+{
+	char eventmask[WL_EVENTING_MASK_LEN];
+	int i, ret = 0;
+	s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+
+	if (!ev || (!ev->num))
+		return -EINVAL;
+
+	mutex_lock(&cfg->event_sync);
+
+	/* Read event_msgs mask */
+	bcm_mkiovar("event_msgs", NULL, 0, iovbuf,
+		sizeof(iovbuf));
+	ret = wldev_ioctl(ndev, WLC_GET_VAR, iovbuf, sizeof(iovbuf), false);
+	if (unlikely(ret)) {
+		WL_ERR(("Get event_msgs error (%d)\n", ret));
+		goto exit;
+	}
+	memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+
+	/* apply the set bits */
+	for (i = 0; i < ev->num; i++) {
+		if (ev->event[i].set)
+			setbit(eventmask, ev->event[i].type);
+		else
+			clrbit(eventmask, ev->event[i].type);
+	}
+
+	/* Write updated Event mask */
+	bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf,
+		sizeof(iovbuf));
+	ret = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+	if (unlikely(ret)) {
+		WL_ERR(("Set event_msgs error (%d)\n", ret));
+	}
+
+exit:
+	mutex_unlock(&cfg->event_sync);
+	return ret;
+}
+
+s32 wl_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add)
+{
+	s8 iovbuf[WL_EVENTING_MASK_LEN + 12];
+	s8 eventmask[WL_EVENTING_MASK_LEN];
+	s32 err = 0;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	if (!ndev || !cfg)
+		return -ENODEV;
+
+	mutex_lock(&cfg->event_sync);
+
+	/* Setup event_msgs */
+	bcm_mkiovar("event_msgs", NULL, 0, iovbuf,
+		sizeof(iovbuf));
+	err = wldev_ioctl(ndev, WLC_GET_VAR, iovbuf, sizeof(iovbuf), false);
+	if (unlikely(err)) {
+		WL_ERR(("Get event_msgs error (%d)\n", err));
+		goto eventmsg_out;
+	}
+	memcpy(eventmask, iovbuf, WL_EVENTING_MASK_LEN);
+	if (add) {
+		setbit(eventmask, event);
+	} else {
+		clrbit(eventmask, event);
+	}
+	bcm_mkiovar("event_msgs", eventmask, WL_EVENTING_MASK_LEN, iovbuf,
+		sizeof(iovbuf));
+	err = wldev_ioctl(ndev, WLC_SET_VAR, iovbuf, sizeof(iovbuf), true);
+	if (unlikely(err)) {
+		WL_ERR(("Set event_msgs error (%d)\n", err));
+		goto eventmsg_out;
+	}
+
+eventmsg_out:
+	mutex_unlock(&cfg->event_sync);
+	return err;
+}
+
+static int wl_construct_reginfo(struct bcm_cfg80211 *cfg, s32 bw_cap)
+{
+	struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+	struct ieee80211_channel *band_chan_arr = NULL;
+	wl_uint32_list_t *list;
+	u32 i, j, index, n_2g, n_5g, band, channel, array_size;
+	u32 *n_cnt = NULL;
+	chanspec_t c = 0;
+	s32 err = BCME_OK;
+	bool update;
+	bool ht40_allowed;
+	u8 *pbuf = NULL;
+	bool dfs_radar_disabled = FALSE;
+
+#define LOCAL_BUF_LEN 1024
+	pbuf = kzalloc(LOCAL_BUF_LEN, GFP_KERNEL);
+
+	if (pbuf == NULL) {
+		WL_ERR(("failed to allocate local buf\n"));
+		return -ENOMEM;
+	}
+	list = (wl_uint32_list_t *)(void *)pbuf;
+	list->count = htod32(WL_NUMCHANSPECS);
+
+
+	err = wldev_iovar_getbuf_bsscfg(dev, "chanspecs", NULL,
+		0, pbuf, LOCAL_BUF_LEN, 0, &cfg->ioctl_buf_sync);
+	if (err != 0) {
+		WL_ERR(("get chanspecs failed with %d\n", err));
+		kfree(pbuf);
+		return err;
+	}
+#undef LOCAL_BUF_LEN
+
+	list = (wl_uint32_list_t *)(void *)pbuf;
+	band = array_size = n_2g = n_5g = 0;
+	for (i = 0; i < dtoh32(list->count); i++) {
+		index = 0;
+		update = false;
+		ht40_allowed = false;
+		c = (chanspec_t)dtoh32(list->element[i]);
+		c = wl_chspec_driver_to_host(c);
+		channel = wf_chspec_ctlchan(c);
+
+		if (!CHSPEC_IS40(c) && ! CHSPEC_IS20(c)) {
+			WL_DBG(("HT80/160/80p80 center channel : %d\n", channel));
+			continue;
+		}
+		if (CHSPEC_IS2G(c) && (channel >= CH_MIN_2G_CHANNEL) &&
+			(channel <= CH_MAX_2G_CHANNEL)) {
+			band_chan_arr = __wl_2ghz_channels;
+			array_size = ARRAYSIZE(__wl_2ghz_channels);
+			n_cnt = &n_2g;
+			band = NL80211_BAND_2GHZ;
+			ht40_allowed = (bw_cap  == WLC_N_BW_40ALL)? true : false;
+		} else if (CHSPEC_IS5G(c) && channel >= CH_MIN_5G_CHANNEL) {
+			band_chan_arr = __wl_5ghz_a_channels;
+			array_size = ARRAYSIZE(__wl_5ghz_a_channels);
+			n_cnt = &n_5g;
+			band = NL80211_BAND_5GHZ;
+			ht40_allowed = (bw_cap  == WLC_N_BW_20ALL)? false : true;
+		} else {
+			WL_ERR(("Invalid channel Sepc. 0x%x.\n", c));
+			continue;
+		}
+		if (!ht40_allowed && CHSPEC_IS40(c))
+			continue;
+		for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
+			if (band_chan_arr[j].hw_value == channel) {
+				update = true;
+				break;
+			}
+		}
+		if (update)
+			index = j;
+		else
+			index = *n_cnt;
+		if (index <  array_size) {
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+			band_chan_arr[index].center_freq =
+				ieee80211_channel_to_frequency(channel);
+#else
+			band_chan_arr[index].center_freq =
+				ieee80211_channel_to_frequency(channel, band);
+#endif
+			band_chan_arr[index].hw_value = channel;
+
+			if (CHSPEC_IS40(c) && ht40_allowed) {
+				/* assuming the order is HT20, HT40 Upper,
+				 *  HT40 lower from chanspecs
+				 */
+				u32 ht40_flag = band_chan_arr[index].flags & IEEE80211_CHAN_NO_HT40;
+				if (CHSPEC_SB_UPPER(c)) {
+					if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+						band_chan_arr[index].flags &=
+							~IEEE80211_CHAN_NO_HT40;
+					band_chan_arr[index].flags |= IEEE80211_CHAN_NO_HT40PLUS;
+				} else {
+					/* It should be one of
+					 * IEEE80211_CHAN_NO_HT40 or IEEE80211_CHAN_NO_HT40PLUS
+					 */
+					band_chan_arr[index].flags &= ~IEEE80211_CHAN_NO_HT40;
+					if (ht40_flag == IEEE80211_CHAN_NO_HT40)
+						band_chan_arr[index].flags |=
+							IEEE80211_CHAN_NO_HT40MINUS;
+				}
+			} else {
+				band_chan_arr[index].flags = IEEE80211_CHAN_NO_HT40;
+				if (!dfs_radar_disabled) {
+					if (band == NL80211_BAND_2GHZ)
+						channel |= WL_CHANSPEC_BAND_2G;
+					else
+						channel |= WL_CHANSPEC_BAND_5G;
+					channel |= WL_CHANSPEC_BW_20;
+					channel = wl_chspec_host_to_driver(channel);
+					err = wldev_iovar_getint(dev, "per_chan_info", &channel);
+					if (!err) {
+						if (channel & WL_CHAN_RADAR) {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+							band_chan_arr[index].flags |=
+								(IEEE80211_CHAN_RADAR
+								| IEEE80211_CHAN_NO_IBSS);
+#else
+							band_chan_arr[index].flags |=
+								IEEE80211_CHAN_RADAR;
+#endif
+						}
+
+						if (channel & WL_CHAN_PASSIVE)
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 14, 0))
+							band_chan_arr[index].flags |=
+								IEEE80211_CHAN_PASSIVE_SCAN;
+#else
+							band_chan_arr[index].flags |=
+								IEEE80211_CHAN_NO_IR;
+#endif
+					} else if (err == BCME_UNSUPPORTED) {
+						dfs_radar_disabled = TRUE;
+						WL_ERR(("does not support per_chan_info\n"));
+					}
+				}
+			}
+			if (!update)
+				(*n_cnt)++;
+		}
+
+	}
+	__wl_band_2ghz.n_channels = n_2g;
+	__wl_band_5ghz_a.n_channels = n_5g;
+	kfree(pbuf);
+	return err;
+}
+
+s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify)
+{
+	struct wiphy *wiphy;
+	struct net_device *dev;
+	u32 bandlist[3];
+	u32 nband = 0;
+	u32 i = 0;
+	s32 err = 0;
+	s32 index = 0;
+	s32 nmode = 0;
+	bool rollback_lock = false;
+	s32 bw_cap = 0;
+	s32 cur_band = -1;
+	struct ieee80211_supported_band *bands[NUM_NL80211_BANDS] = {NULL, };
+
+	if (cfg == NULL) {
+		cfg = g_bcm_cfg;
+		mutex_lock(&cfg->usr_sync);
+		rollback_lock = true;
+	}
+	dev = bcmcfg_to_prmry_ndev(cfg);
+
+	memset(bandlist, 0, sizeof(bandlist));
+	err = wldev_ioctl(dev, WLC_GET_BANDLIST, bandlist,
+		sizeof(bandlist), false);
+	if (unlikely(err)) {
+		WL_ERR(("error read bandlist (%d)\n", err));
+		goto end_bands;
+	}
+	err = wldev_ioctl(dev, WLC_GET_BAND, &cur_band,
+		sizeof(s32), false);
+	if (unlikely(err)) {
+		WL_ERR(("error (%d)\n", err));
+		goto end_bands;
+	}
+
+	err = wldev_iovar_getint(dev, "nmode", &nmode);
+	if (unlikely(err)) {
+		WL_ERR(("error reading nmode (%d)\n", err));
+	} else {
+		/* For nmodeonly  check bw cap */
+		err = wldev_iovar_getint(dev, "mimo_bw_cap", &bw_cap);
+		if (unlikely(err)) {
+			WL_ERR(("error get mimo_bw_cap (%d)\n", err));
+		}
+	}
+
+	err = wl_construct_reginfo(cfg, bw_cap);
+	if (err) {
+		WL_ERR(("wl_construct_reginfo() fails err=%d\n", err));
+		if (err != BCME_UNSUPPORTED)
+			goto end_bands;
+		err = 0;
+	}
+	wiphy = bcmcfg_to_wiphy(cfg);
+	nband = bandlist[0];
+
+	for (i = 1; i <= nband && i < ARRAYSIZE(bandlist); i++) {
+		index = -1;
+		if (bandlist[i] == WLC_BAND_5G && __wl_band_5ghz_a.n_channels > 0) {
+			bands[NL80211_BAND_5GHZ] =
+				&__wl_band_5ghz_a;
+			index = NL80211_BAND_5GHZ;
+			if (bw_cap == WLC_N_BW_40ALL || bw_cap == WLC_N_BW_20IN2G_40IN5G)
+				bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+		}
+		else if (bandlist[i] == WLC_BAND_2G && __wl_band_2ghz.n_channels > 0) {
+			bands[NL80211_BAND_2GHZ] =
+				&__wl_band_2ghz;
+			index = NL80211_BAND_2GHZ;
+			if (bw_cap == WLC_N_BW_40ALL)
+				bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+		}
+
+		if ((index >= 0) && nmode) {
+			bands[index]->ht_cap.cap |=
+				(IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_DSSSCCK40);
+			bands[index]->ht_cap.ht_supported = TRUE;
+			bands[index]->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+			bands[index]->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+			/* An HT shall support all EQM rates for one spatial stream */
+			bands[index]->ht_cap.mcs.rx_mask[0] = 0xff;
+		}
+
+	}
+
+	wiphy->bands[NL80211_BAND_2GHZ] = bands[NL80211_BAND_2GHZ];
+	wiphy->bands[NL80211_BAND_5GHZ] = bands[NL80211_BAND_5GHZ];
+
+	/* check if any bands populated otherwise makes 2Ghz as default */
+	if (wiphy->bands[NL80211_BAND_2GHZ] == NULL &&
+		wiphy->bands[NL80211_BAND_5GHZ] == NULL) {
+		/* Setup 2Ghz band as default */
+		wiphy->bands[NL80211_BAND_2GHZ] = &__wl_band_2ghz;
+	}
+
+	if (notify)
+		wiphy_apply_custom_regulatory(wiphy, &brcm_regdom);
+
+end_bands:
+	if (rollback_lock)
+		mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+
+static s32 __wl_cfg80211_up(struct bcm_cfg80211 *cfg)
+{
+	s32 err = 0;
+#ifdef WL_HOST_BAND_MGMT
+	s32 ret = 0;
+#endif /* WL_HOST_BAND_MGMT */
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	struct wireless_dev *wdev = ndev->ieee80211_ptr;
+
+	WL_DBG(("In\n"));
+
+	err = dhd_config_dongle(cfg);
+	if (unlikely(err))
+		return err;
+
+	err = wl_config_ifmode(cfg, ndev, wdev->iftype);
+	if (unlikely(err && err != -EINPROGRESS)) {
+		WL_ERR(("wl_config_ifmode failed\n"));
+		if (err == -1) {
+			WL_ERR(("return error %d\n", err));
+			return err;
+		}
+	}
+	err = wl_update_wiphybands(cfg, true);
+	if (unlikely(err)) {
+		WL_ERR(("wl_update_wiphybands failed\n"));
+		if (err == -1) {
+			WL_ERR(("return error %d\n", err));
+			return err;
+		}
+	}
+
+	err = dhd_monitor_init(cfg->pub);
+
+#ifdef WL_HOST_BAND_MGMT
+	/* By default the curr_band is initialized to BAND_AUTO */
+	if ((ret = wl_cfg80211_set_band(ndev, WLC_BAND_AUTO)) < 0) {
+		if (ret == BCME_UNSUPPORTED) {
+			/* Don't fail the initialization, lets just
+			 * fall back to the original method
+			 */
+			WL_ERR(("WL_HOST_BAND_MGMT defined, "
+				"but roam_band iovar not supported \n"));
+		} else {
+			WL_ERR(("roam_band failed. ret=%d", ret));
+			err = -1;
+		}
+	}
+#endif /* WL_HOST_BAND_MGMT */
+#if defined(DHCP_SCAN_SUPPRESS)
+	/* wlan scan_supp timer and work thread info */
+	init_timer(&cfg->scan_supp_timer);
+	cfg->scan_supp_timer.data = (ulong)cfg;
+	cfg->scan_supp_timer.function = wl_cfg80211_scan_supp_timerfunc;
+	INIT_WORK(&cfg->wlan_work, wl_cfg80211_work_handler);
+#endif /* DHCP_SCAN_SUPPRESS */
+	INIT_DELAYED_WORK(&cfg->pm_enable_work, wl_cfg80211_work_handler);
+	wl_set_drv_status(cfg, READY, ndev);
+	return err;
+}
+
+static s32 __wl_cfg80211_down(struct bcm_cfg80211 *cfg)
+{
+	s32 err = 0;
+	unsigned long flags;
+	struct net_info *iter, *next;
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+#if defined(WL_CFG80211) && (defined(WL_ENABLE_P2P_IF)|| \
+	defined(WL_NEWCFG_PRIVCMD_SUPPORT))
+	struct net_device *p2p_net = cfg->p2p_net;
+#endif /* WL_CFG80211 && (WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT) */
+	u32 bssidx = 0;
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+	dhd_pub_t *dhd =  (dhd_pub_t *)(cfg->pub);
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+	WL_DBG(("In\n"));
+	/* Delete pm_enable_work */
+	wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_DEL);
+
+#ifdef WL_NAN
+	wl_cfgnan_stop_handler(ndev, g_bcm_cfg, NULL, NULL);
+#endif /* WL_NAN */
+
+	if (cfg->p2p_supported) {
+		wl_clr_p2p_status(cfg, GO_NEG_PHASE);
+#ifdef PROP_TXSTATUS_VSDB
+#if defined(BCMSDIO)
+		if (cfg->p2p->vif_created) {
+			bool enabled = false;
+			dhd_wlfc_get_enable(dhd, &enabled);
+			if (enabled && cfg->wlfc_on && dhd->op_mode != DHD_FLAG_HOSTAP_MODE &&
+				dhd->op_mode != DHD_FLAG_IBSS_MODE) {
+				dhd_wlfc_deinit(dhd);
+				cfg->wlfc_on = false;
+			}
+		}
+#endif
+#endif /* PROP_TXSTATUS_VSDB */
+	}
+
+#if defined(DHCP_SCAN_SUPPRESS)
+	/* Force clear of scan_suppress */
+	if (cfg->scan_suppressed)
+		wl_cfg80211_scan_suppress(ndev, 0);
+	if (timer_pending(&cfg->scan_supp_timer))
+		del_timer_sync(&cfg->scan_supp_timer);
+	cancel_work_sync(&cfg->wlan_work);
+#endif /* DHCP_SCAN_SUPPRESS */
+
+	/* If primary BSS is operational (for e.g SoftAP), bring it down */
+	if (!(wl_cfgp2p_find_idx(cfg, ndev, &bssidx)) &&
+		wl_cfgp2p_bss_isup(ndev, bssidx)) {
+		if (wl_cfgp2p_bss(cfg, ndev, bssidx, 0) < 0)
+			WL_ERR(("BSS down failed \n"));
+	}
+
+	/* Check if cfg80211 interface is already down */
+	if (!wl_get_drv_status(cfg, READY, ndev))
+		return err;	/* it is even not ready */
+	for_each_ndev(cfg, iter, next)
+		wl_set_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+
+#ifdef WL_SDO
+	wl_cfg80211_sdo_deinit(cfg);
+#endif
+
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	if (cfg->scan_request) {
+		struct cfg80211_scan_info info = {
+			.aborted = true,
+		};
+		cfg80211_scan_done(cfg->scan_request, &info);
+		cfg->scan_request = NULL;
+	}
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+	for_each_ndev(cfg, iter, next) {
+		wl_clr_drv_status(cfg, READY, iter->ndev);
+		wl_clr_drv_status(cfg, SCANNING, iter->ndev);
+		wl_clr_drv_status(cfg, SCAN_ABORTING, iter->ndev);
+		wl_clr_drv_status(cfg, CONNECTING, iter->ndev);
+		wl_clr_drv_status(cfg, CONNECTED, iter->ndev);
+		wl_clr_drv_status(cfg, DISCONNECTING, iter->ndev);
+		wl_clr_drv_status(cfg, AP_CREATED, iter->ndev);
+		wl_clr_drv_status(cfg, AP_CREATING, iter->ndev);
+	}
+	bcmcfg_to_prmry_ndev(cfg)->ieee80211_ptr->iftype =
+		NL80211_IFTYPE_STATION;
+#if defined(WL_CFG80211) && (defined(WL_ENABLE_P2P_IF)|| \
+	defined(WL_NEWCFG_PRIVCMD_SUPPORT))
+		if (p2p_net)
+			dev_close(p2p_net);
+#endif /* WL_CFG80211 && (WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT) */
+	wl_flush_eq(cfg);
+	wl_link_down(cfg);
+	if (cfg->p2p_supported)
+		wl_cfgp2p_down(cfg);
+	if (cfg->ap_info) {
+		kfree(cfg->ap_info->wpa_ie);
+		kfree(cfg->ap_info->rsn_ie);
+		kfree(cfg->ap_info->wps_ie);
+		kfree(cfg->ap_info);
+		cfg->ap_info = NULL;
+	}
+	dhd_monitor_uninit();
+#ifdef WLAIBSS_MCHAN
+	bcm_cfg80211_del_ibss_if(cfg->wdev->wiphy, cfg->ibss_cfgdev);
+#endif /* WLAIBSS_MCHAN */
+
+#if defined(DUAL_STA) || defined(DUAL_STA_STATIC_IF)
+	/* Clean up if not removed already */
+	if (cfg->bss_cfgdev)
+		wl_cfg80211_del_iface(cfg->wdev->wiphy, cfg->bss_cfgdev);
+#endif /* defined (DUAL_STA) || defined (DUAL_STA_STATIC_IF) */
+
+	DNGL_FUNC(dhd_cfg80211_down, (cfg));
+
+	return err;
+}
+
+s32 wl_cfg80211_up(void *para)
+{
+	struct bcm_cfg80211 *cfg;
+	s32 err = 0;
+	int val = 1;
+	dhd_pub_t *dhd;
+
+	(void)para;
+	WL_DBG(("In\n"));
+	cfg = g_bcm_cfg;
+
+	if ((err = wldev_ioctl(bcmcfg_to_prmry_ndev(cfg), WLC_GET_VERSION, &val,
+		sizeof(int), false) < 0)) {
+		WL_ERR(("WLC_GET_VERSION failed, err=%d\n", err));
+		return err;
+	}
+	val = dtoh32(val);
+	if (val != WLC_IOCTL_VERSION && val != 1) {
+		WL_ERR(("Version mismatch, please upgrade. Got %d, expected %d or 1\n",
+			val, WLC_IOCTL_VERSION));
+		return BCME_VERSION;
+	}
+	ioctl_version = val;
+	WL_TRACE(("WLC_GET_VERSION=%d\n", ioctl_version));
+
+	mutex_lock(&cfg->usr_sync);
+	dhd = (dhd_pub_t *)(cfg->pub);
+	if (!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) {
+		err = wl_cfg80211_attach_post(bcmcfg_to_prmry_ndev(cfg));
+		if (unlikely(err))
+			return err;
+	}
+#if defined(BCMSUP_4WAY_HANDSHAKE) && defined(WLAN_AKM_SUITE_FT_8021X)
+	if (dhd->fw_4way_handshake)
+		cfg->wdev->wiphy->features |= NL80211_FEATURE_FW_4WAY_HANDSHAKE;
+#endif
+	err = __wl_cfg80211_up(cfg);
+	if (unlikely(err))
+		WL_ERR(("__wl_cfg80211_up failed\n"));
+	mutex_unlock(&cfg->usr_sync);
+
+#ifdef WLAIBSS_MCHAN
+	bcm_cfg80211_add_ibss_if(cfg->wdev->wiphy, IBSS_IF_NAME);
+#endif /* WLAIBSS_MCHAN */
+
+#ifdef DUAL_STA_STATIC_IF
+#ifdef DUAL_STA
+#error "Both DUAL_STA and DUAL_STA_STATIC_IF can't be enabled together"
+#endif
+	/* Static Interface support is currently supported only for STA only builds (without P2P) */
+	wl_cfg80211_create_iface(cfg->wdev->wiphy, NL80211_IFTYPE_STATION, NULL, "wlan%d");
+#endif /* DUAL_STA_STATIC_IF */
+
+	return err;
+}
+
+/* Private Event to Supplicant with indication that chip hangs */
+int wl_cfg80211_hang(struct net_device *dev, u16 reason)
+{
+	struct bcm_cfg80211 *cfg;
+	cfg = g_bcm_cfg;
+
+	WL_ERR(("In : chip crash eventing\n"));
+	wl_add_remove_pm_enable_work(cfg, FALSE, WL_HANDLER_DEL);
+	cfg80211_disconnected(dev, reason, NULL, 0, true, GFP_KERNEL);
+#if defined(RSSIAVG)
+	wl_free_rssi_cache(&g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+	wl_free_bss_cache(&g_bss_cache_ctrl);
+#endif
+	if (cfg != NULL) {
+		wl_link_down(cfg);
+	}
+	return 0;
+}
+
+s32 wl_cfg80211_down(void *para)
+{
+	struct bcm_cfg80211 *cfg;
+	s32 err = 0;
+
+	(void)para;
+	WL_DBG(("In\n"));
+	cfg = g_bcm_cfg;
+	mutex_lock(&cfg->usr_sync);
+#if defined(RSSIAVG)
+	wl_free_rssi_cache(&g_rssi_cache_ctrl);
+#endif
+#if defined(BSSCACHE)
+	wl_free_bss_cache(&g_bss_cache_ctrl);
+#endif
+	err = __wl_cfg80211_down(cfg);
+	mutex_unlock(&cfg->usr_sync);
+
+	return err;
+}
+
+static void *wl_read_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 item)
+{
+	unsigned long flags;
+	void *rptr = NULL;
+	struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+	if (!profile)
+		return NULL;
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	switch (item) {
+	case WL_PROF_SEC:
+		rptr = &profile->sec;
+		break;
+	case WL_PROF_ACT:
+		rptr = &profile->active;
+		break;
+	case WL_PROF_BSSID:
+		rptr = profile->bssid;
+		break;
+	case WL_PROF_SSID:
+		rptr = &profile->ssid;
+		break;
+	case WL_PROF_CHAN:
+		rptr = &profile->channel;
+		break;
+	}
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+	if (!rptr)
+		WL_ERR(("invalid item (%d)\n", item));
+	return rptr;
+}
+
+static s32
+wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const wl_event_msg_t *e, void *data, s32 item)
+{
+	s32 err = 0;
+	struct wlc_ssid *ssid;
+	unsigned long flags;
+	struct wl_profile *profile = wl_get_profile_by_netdev(cfg, ndev);
+
+	if (!profile)
+		return WL_INVALID;
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+	switch (item) {
+	case WL_PROF_SSID:
+		ssid = (wlc_ssid_t *) data;
+		memset(profile->ssid.SSID, 0,
+			sizeof(profile->ssid.SSID));
+		memcpy(profile->ssid.SSID, ssid->SSID, ssid->SSID_len);
+		profile->ssid.SSID_len = ssid->SSID_len;
+		break;
+	case WL_PROF_BSSID:
+		if (data)
+			memcpy(profile->bssid, data, ETHER_ADDR_LEN);
+		else
+			memset(profile->bssid, 0, ETHER_ADDR_LEN);
+		break;
+	case WL_PROF_SEC:
+		memcpy(&profile->sec, data, sizeof(profile->sec));
+		break;
+	case WL_PROF_ACT:
+		profile->active = *(bool *)data;
+		break;
+	case WL_PROF_BEACONINT:
+		profile->beacon_interval = *(u16 *)data;
+		break;
+	case WL_PROF_DTIMPERIOD:
+		profile->dtim_period = *(u8 *)data;
+		break;
+	case WL_PROF_CHAN:
+		profile->channel = *(u32*)data;
+		break;
+	default:
+		err = -EOPNOTSUPP;
+		break;
+	}
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+	if (err == -EOPNOTSUPP)
+		WL_ERR(("unsupported item (%d)\n", item));
+
+	return err;
+}
+
+void wl_cfg80211_dbg_level(u32 level)
+{
+	/*
+	* prohibit to change debug level
+	* by insmod parameter.
+	* eventually debug level will be configured
+	* in compile time by using CONFIG_XXX
+	*/
+	/* wl_dbg_level = level; */
+}
+
+static bool wl_is_ibssmode(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	return wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_IBSS;
+}
+
+static __used bool wl_is_ibssstarter(struct bcm_cfg80211 *cfg)
+{
+	return cfg->ibss_starter;
+}
+
+static void wl_rst_ie(struct bcm_cfg80211 *cfg)
+{
+	struct wl_ie *ie = wl_to_ie(cfg);
+
+	ie->offset = 0;
+}
+
+static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v)
+{
+	struct wl_ie *ie = wl_to_ie(cfg);
+	s32 err = 0;
+
+	if (unlikely(ie->offset + l + 2 > WL_TLV_INFO_MAX)) {
+		WL_ERR(("ei crosses buffer boundary\n"));
+		return -ENOSPC;
+	}
+	ie->buf[ie->offset] = t;
+	ie->buf[ie->offset + 1] = l;
+	memcpy(&ie->buf[ie->offset + 2], v, l);
+	ie->offset += l + 2;
+
+	return err;
+}
+
+static void wl_update_hidden_ap_ie(struct wl_bss_info *bi, u8 *ie_stream, u32 *ie_size, bool roam)
+{
+	u8 *ssidie;
+	ssidie = (u8 *)cfg80211_find_ie(WLAN_EID_SSID, ie_stream, *ie_size);
+	if (!ssidie)
+		return;
+	if (ssidie[1] != bi->SSID_len) {
+		if (ssidie[1]) {
+			WL_ERR(("%s: Wrong SSID len: %d != %d\n",
+				__FUNCTION__, ssidie[1], bi->SSID_len));
+		}
+		if (roam) {
+			WL_ERR(("Changing the SSID Info.\n"));
+			memmove(ssidie + bi->SSID_len + 2,
+				(ssidie + 2) + ssidie[1],
+				*ie_size - (ssidie + 2 + ssidie[1] - ie_stream));
+			memcpy(ssidie + 2, bi->SSID, bi->SSID_len);
+			*ie_size = *ie_size + bi->SSID_len - ssidie[1];
+			ssidie[1] = bi->SSID_len;
+		}
+		return;
+	}
+	if (*(ssidie + 2) == '\0')
+		 memcpy(ssidie + 2, bi->SSID, bi->SSID_len);
+	return;
+}
+
+static s32 wl_mrg_ie(struct bcm_cfg80211 *cfg, u8 *ie_stream, u16 ie_size)
+{
+	struct wl_ie *ie = wl_to_ie(cfg);
+	s32 err = 0;
+
+	if (unlikely(ie->offset + ie_size > WL_TLV_INFO_MAX)) {
+		WL_ERR(("ei_stream crosses buffer boundary\n"));
+		return -ENOSPC;
+	}
+	memcpy(&ie->buf[ie->offset], ie_stream, ie_size);
+	ie->offset += ie_size;
+
+	return err;
+}
+
+static s32 wl_cp_ie(struct bcm_cfg80211 *cfg, u8 *dst, u16 dst_size)
+{
+	struct wl_ie *ie = wl_to_ie(cfg);
+	s32 err = 0;
+
+	if (unlikely(ie->offset > dst_size)) {
+		WL_ERR(("dst_size is not enough\n"));
+		return -ENOSPC;
+	}
+	memcpy(dst, &ie->buf[0], ie->offset);
+
+	return err;
+}
+
+static u32 wl_get_ielen(struct bcm_cfg80211 *cfg)
+{
+	struct wl_ie *ie = wl_to_ie(cfg);
+
+	return ie->offset;
+}
+
+static void wl_link_up(struct bcm_cfg80211 *cfg)
+{
+	cfg->link_up = true;
+}
+
+static void wl_link_down(struct bcm_cfg80211 *cfg)
+{
+	struct wl_connect_info *conn_info = wl_to_conn(cfg);
+
+	WL_DBG(("In\n"));
+	cfg->link_up = false;
+	conn_info->req_ie_len = 0;
+	conn_info->resp_ie_len = 0;
+}
+
+static unsigned long wl_lock_eq(struct bcm_cfg80211 *cfg)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&cfg->eq_lock, flags);
+	return flags;
+}
+
+static void wl_unlock_eq(struct bcm_cfg80211 *cfg, unsigned long flags)
+{
+	spin_unlock_irqrestore(&cfg->eq_lock, flags);
+}
+
+static void wl_init_eq_lock(struct bcm_cfg80211 *cfg)
+{
+	spin_lock_init(&cfg->eq_lock);
+}
+
+static void wl_delay(u32 ms)
+{
+	if (in_atomic() || (ms < jiffies_to_msecs(1))) {
+		OSL_DELAY(ms*1000);
+	} else {
+		OSL_SLEEP(ms);
+	}
+}
+
+s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	struct ether_addr p2pif_addr;
+	struct ether_addr primary_mac;
+	if (!cfg->p2p)
+		return -1;
+	if (!p2p_is_on(cfg)) {
+		get_primary_mac(cfg, &primary_mac);
+		wl_cfgp2p_generate_bss_mac(&primary_mac, p2pdev_addr, &p2pif_addr);
+	} else {
+		memcpy(p2pdev_addr->octet,
+			cfg->p2p->dev_addr.octet, ETHER_ADDR_LEN);
+	}
+
+
+	return 0;
+}
+s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len)
+{
+	struct bcm_cfg80211 *cfg;
+
+	cfg = g_bcm_cfg;
+
+	return wl_cfgp2p_set_p2p_noa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len)
+{
+	struct bcm_cfg80211 *cfg;
+	cfg = g_bcm_cfg;
+
+	return wl_cfgp2p_get_p2p_noa(cfg, net, buf, len);
+}
+
+s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len)
+{
+	struct bcm_cfg80211 *cfg;
+	cfg = g_bcm_cfg;
+
+	return wl_cfgp2p_set_p2p_ps(cfg, net, buf, len);
+}
+#ifdef P2PLISTEN_AP_SAMECHN
+s32 wl_cfg80211_set_p2p_resp_ap_chn(struct net_device *net, s32 enable)
+{
+	s32 ret = wldev_iovar_setint(net, "p2p_resp_ap_chn", enable);
+
+	if ((ret == 0) && enable) {
+		/* disable PM for p2p responding on infra AP channel */
+		s32 pm = PM_OFF;
+
+		ret = wldev_ioctl(net, WLC_SET_PM, &pm, sizeof(pm), true);
+	}
+
+	return ret;
+}
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+s32 wl_cfg80211_channel_to_freq(u32 channel)
+{
+	int freq = 0;
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 38) && !defined(WL_COMPAT_WIRELESS)
+	freq = ieee80211_channel_to_frequency(channel);
+#else
+	{
+		u16 band = 0;
+		if (channel <= CH_MAX_2G_CHANNEL)
+			band = NL80211_BAND_2GHZ;
+		else
+			band = NL80211_BAND_5GHZ;
+		freq = ieee80211_channel_to_frequency(channel, band);
+	}
+#endif
+	return freq;
+}
+
+#ifdef WL_SDO
+#define MAX_QR_LEN NLMSG_GOODSIZE
+
+typedef struct wl_cfg80211_dev_info {
+	u16 band;
+	u16 freq;
+	s16 rssi;
+	u16 ie_len;
+	u8 bssid[ETH_ALEN];
+} wl_cfg80211_dev_info_t;
+
+static s32
+wl_notify_device_discovery(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	int err = 0;
+	u32 event = ntoh32(e->event_type);
+	wl_cfg80211_dev_info_t info;
+	struct wl_bss_info *bi = NULL;
+	struct net_device *ndev = NULL;
+	u8 *buf = NULL;
+	u32 buflen = 0;
+	u16 channel = 0;
+	 wl_escan_result_t *escan_result;
+
+	WL_SD(("Enter. type:%d \n", event));
+
+	if ((event != WLC_E_P2PO_ADD_DEVICE) && (event != WLC_E_P2PO_DEL_DEVICE)) {
+		WL_ERR(("Unknown Event\n"));
+		return -EINVAL;
+	}
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	mutex_lock(&cfg->usr_sync);
+	if (event == WLC_E_P2PO_DEL_DEVICE) {
+		WL_SD(("DEV_LOST MAC:"MACDBG" \n", MAC2STRDBG(e->addr.octet)));
+		err = wl_genl_send_msg(ndev, event, (u8 *)e->addr.octet, ETH_ALEN, 0, 0);
+	} else {
+
+		escan_result = (wl_escan_result_t *) data;
+
+		if (dtoh16(escan_result->bss_count) != 1) {
+			WL_ERR(("Invalid bss_count %d: ignoring\n", escan_result->bss_count));
+			err = -EINVAL;
+			goto exit;
+		}
+
+		bi = escan_result->bss_info;
+		buflen = dtoh32(bi->length);
+		if (unlikely(buflen > WL_BSS_INFO_MAX)) {
+			WL_DBG(("Beacon is larger than buffer. Discarding\n"));
+			err = -EINVAL;
+			goto exit;
+		}
+
+		/* Update sub-header */
+		bzero(&info, sizeof(wl_cfg80211_dev_info_t));
+		channel = wf_chspec_ctlchan(wl_chspec_driver_to_host(bi->chanspec));
+		info.freq = wl_cfg80211_channel_to_freq(channel);
+		info.rssi = dtoh16(bi->RSSI);
+#if defined(RSSIOFFSET)
+		info.rssi = wl_update_rssi_offset(ndev, info.rssi);
+#endif
+#if !defined(RSSIAVG) && !defined(RSSIOFFSET)
+		// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+		info->rssi = MIN(info->rssi, RSSI_MAXVAL);
+#endif
+		memcpy(info.bssid, &bi->BSSID, ETH_ALEN);
+		info.ie_len = buflen;
+
+		WL_SD(("DEV_FOUND band:%x Freq:%d rssi:%x "MACDBG" \n",
+			info.band, info.freq, info.rssi, MAC2STRDBG(info.bssid)));
+
+		buf =  ((u8 *) bi) + bi->ie_offset;
+		err = wl_genl_send_msg(ndev, event, buf,
+			buflen, (u8 *)&info, sizeof(wl_cfg80211_dev_info_t));
+	}
+exit:
+	mutex_unlock(&cfg->usr_sync);
+	return err;
+}
+
+s32
+wl_cfg80211_sdo_init(struct bcm_cfg80211 *cfg)
+{
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+	if (cfg->sdo) {
+		WL_SD(("SDO already initialized\n"));
+		return 0;
+	}
+
+	cfg->sdo = kzalloc(sizeof(sd_offload_t), kflags);
+	if (!cfg->sdo) {
+		WL_ERR(("malloc failed for SDO \n"));
+		return -ENOMEM;
+	}
+
+	return  0;
+}
+
+s32
+wl_cfg80211_sdo_deinit(struct bcm_cfg80211 *cfg)
+{
+	s32 bssidx;
+	int ret = 0;
+	int sdo_pause = 0;
+	if (!cfg || !cfg->p2p) {
+		WL_ERR(("Wl %p or cfg->p2p %p is null\n",
+			cfg, cfg ? cfg->p2p : 0));
+		return 0;
+	}
+
+	bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	if (!cfg->sdo) {
+		WL_DBG(("SDO Not Initialized. Do nothing. \n"));
+		return 0;
+	}
+	if (cfg->sdo->dd_state &&
+		(ret = wldev_iovar_setbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg),
+		"p2po_stop", (void*)&sdo_pause, sizeof(sdo_pause),
+		cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, NULL)) < 0) {
+		WL_ERR(("p2po_stop Failed :%d\n", ret));
+	}
+	kfree(cfg->sdo);
+	cfg->sdo = NULL;
+
+	WL_SD(("SDO Deinit Done \n"));
+
+	return  0;
+}
+
+s32
+wl_cfg80211_resume_sdo(struct net_device *dev, struct bcm_cfg80211 *cfg)
+{
+	wl_sd_listen_t sd_listen;
+	int ret = 0;
+	s32 bssidx =  wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+
+	WL_DBG(("Enter\n"));
+
+	if (!cfg->sdo) {
+		return -EINVAL;
+	}
+
+	if (dev == NULL)
+		dev = bcmcfg_to_prmry_ndev(cfg);
+
+	/* Disable back the ESCAN events for the offload */
+	wl_add_remove_eventmsg(dev, WLC_E_ESCAN_RESULT, false);
+
+	/* Resume according to the saved state */
+	if (cfg->sdo->dd_state == WL_DD_STATE_SEARCH) {
+		if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_find", NULL, 0,
+			cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, NULL)) < 0) {
+			WL_ERR(("p2po_find Failed :%d\n", ret));
+		}
+	} else if (cfg->sdo->dd_state == WL_DD_STATE_LISTEN) {
+		sd_listen.interval = cfg->sdo->sd_listen.interval;
+		sd_listen.period = cfg->sdo->sd_listen.period;
+
+		if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen", (void*)&sd_listen,
+			sizeof(wl_sd_listen_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+			bssidx, NULL)) < 0) {
+			WL_ERR(("p2po_listen Failed :%d\n", ret));
+		}
+
+	}
+
+	 /* p2po_stop clears of the eventmask for GAS. Set it back */
+	 wl_add_remove_eventmsg(dev, WLC_E_SERVICE_FOUND, true);
+	 wl_add_remove_eventmsg(dev, WLC_E_GAS_FRAGMENT_RX, true);
+	 wl_add_remove_eventmsg(dev, WLC_E_GAS_COMPLETE, true);
+
+	WL_SD(("SDO Resumed \n"));
+
+	return ret;
+}
+
+s32 wl_cfg80211_pause_sdo(struct net_device *dev, struct bcm_cfg80211 *cfg)
+{
+
+	int ret = 0;
+	s32 bssidx =  wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	int sdo_pause = 1;
+
+	WL_DBG(("Enter \n"));
+
+	if (!cfg->sdo) {
+		WL_ERR(("SDO not initialized \n"));
+		return -EINVAL;
+	}
+
+	if (dev == NULL)
+		dev = bcmcfg_to_prmry_ndev(cfg);
+
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_stop",
+		(void*)&sdo_pause, sizeof(sdo_pause),
+		cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("p2po_stop Failed :%d\n", ret));
+	}
+
+	/* Enable back the ESCAN events for the SCAN */
+	wl_add_remove_eventmsg(dev, WLC_E_ESCAN_RESULT, true);
+
+	WL_SD(("SDO Paused \n"));
+
+	return ret;
+}
+
+static s32
+wl_svc_resp_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	u32 event = ntoh32(e->event_type);
+	struct net_device *ndev = NULL;
+	u8 *dst_mac = (u8 *)e->addr.octet;
+	int ret = 0;
+	wl_event_sd_t *gas = NULL;
+	int status = ntoh32(e->status);
+	sdo_event_t sdo_hdr;
+	u32 data_len = ntoh32(e->datalen);
+	u8 *data_ptr = NULL;
+	u32 tot_len = 0;
+
+
+	WL_SD(("Enter event_type:%d status:%d\n", event, status));
+
+	if (!cfg->sdo) {
+		WL_ERR(("SDO Not initialized \n"));
+		return -EINVAL;
+	}
+
+	if (!(cfg->sdo->sd_state & WL_SD_SEARCH_SVC)) {
+		/* We are not searching for any service. Drop
+		 * any bogus Event
+		 */
+		WL_ERR(("Bogus SDO Event. Do nothing.. \n"));
+		return -1;
+	}
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	mutex_lock(&cfg->usr_sync);
+	if (event == WLC_E_SERVICE_FOUND) {
+
+		if ((status != WLC_E_STATUS_SUCCESS) && (status != WLC_E_STATUS_PARTIAL)) {
+			WL_ERR(("WLC_E_SERVICE_FOUND: unknown status \n"));
+			goto exit;
+		}
+
+		gas = (wl_event_sd_t *)data;
+		if (!gas) {
+			ret = -EINVAL;
+			goto exit;
+		}
+
+		bzero(&sdo_hdr, sizeof(sdo_event_t));
+		sdo_hdr.freq = wl_cfg80211_channel_to_freq(gas->channel);
+		sdo_hdr.count = gas->count;
+		memcpy(sdo_hdr.addr, dst_mac, ETH_ALEN);
+		data_ptr = (char *)gas->tlv;
+		tot_len = data_len - (sizeof(wl_event_sd_t) - sizeof(wl_sd_tlv_t));
+
+		WL_SD(("WLC_E_SERVICE_FOUND "MACDBG" data_len:%d tlv_count:%d \n",
+			MAC2STRDBG(dst_mac), data_len, sdo_hdr.count));
+
+		if (tot_len > NLMSG_DEFAULT_SIZE) {
+			WL_ERR(("size(%u)  > %lu not supported \n", tot_len, NLMSG_DEFAULT_SIZE));
+			ret = -ENOMEM;
+			goto exit;
+		}
+
+		if (wl_genl_send_msg(ndev, event, data_ptr,
+			tot_len, (u8 *)&sdo_hdr, sizeof(sdo_event_t)) < 0)
+			WL_ERR(("Couldn't send up the NETLINK Event \n"));
+		else
+			WL_SD(("GAS event sent up \n"));
+	} else {
+		WL_ERR(("Unsupported Event: %d \n", event));
+	}
+
+exit:
+	mutex_unlock(&cfg->usr_sync);
+	return ret;
+}
+
+s32 wl_cfg80211_DsdOffloadParseProto(char* proto_str, u8* proto)
+{
+	s32 len = -1;
+	int i = 0;
+
+	for (i = 0; i < MAX_SDO_PROTO; i++) {
+		if (strncmp(proto_str, wl_sdo_protos[i].str, strlen(wl_sdo_protos[i].str)) == 0) {
+			WL_SD(("Matching proto (%d) found \n", wl_sdo_protos[i].val));
+			*proto = wl_sdo_protos[i].val;
+			len = strlen(wl_sdo_protos[i].str);
+			break;
+		}
+	}
+	return len;
+}
+
+/*
+ * register to search for a UPnP service
+ * ./DRIVER P2P_SD_REQ upnp 0x10urn:schemas-upnporg:device:InternetGatewayDevice:1
+ *
+ * Enable discovery
+ * ./cfg p2po_find
+*/
+#define UPNP_QUERY_VER_OFFSET 3
+s32 wl_sd_handle_sd_req(
+	struct net_device *dev,
+	u8 * buf,
+	int len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx = 0;
+	wl_sd_qr_t *sdreq;
+	u8 proto = 0;
+	s32 ret = 0;
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+	u32 tot_len = len + sizeof(wl_sd_qr_t);
+	u16 version = 0;
+
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("find_idx failed\n"));
+		return -EINVAL;
+	}
+	/* Check for the least arg length expected */
+	if (!buf || (len < strlen("all"))) {
+		WL_ERR(("Wrong Arg\n"));
+		return -EINVAL;
+	}
+
+	if (tot_len > WLC_IOCTL_MAXLEN) {
+		WL_ERR(("Length > %lu not supported \n", MAX_QR_LEN));
+		return -EINVAL;
+	}
+
+	sdreq = kzalloc(tot_len, kflags);
+	if (!sdreq) {
+		WL_ERR(("malloc failed\n"));
+		return -ENOMEM;
+	}
+
+	WL_SD(("%s Len: %d\n", buf, len));
+	if ((ret = wl_cfg80211_DsdOffloadParseProto(buf, &proto)) < 0) {
+		WL_ERR(("Unknown proto \n"));
+		goto exit;
+	}
+
+	sdreq->protocol = proto;
+	buf += ret;
+	buf++; /* skip the space */
+	sdreq->transaction_id = simple_strtoul(buf, NULL, 16);
+	WL_SD(("transaction_id:%d\n", sdreq->transaction_id));
+	buf += sizeof(sdreq->transaction_id);
+
+	if (*buf == '\0') {
+		WL_SD(("No Query present. Proto:%d \n", proto));
+		sdreq->query_len = 0;
+	} else {
+		buf++; /* skip the space */
+		/* UPNP version needs to put as binary val */
+		if (sdreq->protocol == SVC_RPOTYPE_UPNP) {
+			/* Extract UPNP version */
+			version = simple_strtoul(buf, NULL, 16);
+			buf = buf + UPNP_QUERY_VER_OFFSET;
+			buf[0] = version;
+			WL_SD(("Upnp version: 0x%x \n", version));
+		}
+
+		len = strlen(buf);
+		WL_SD(("Len after stripping proto: %d Query: %s\n", len, buf));
+		/* copy the query part */
+		memcpy(sdreq->qrbuf, buf, len);
+		sdreq->query_len = len;
+	}
+
+	/* Enable discovery */
+	if ((ret = wl_cfgp2p_enable_discovery(cfg, dev, NULL, 0)) < 0) {
+		WL_ERR(("cfgp2p_enable discovery failed"));
+		goto exit;
+	}
+
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_sd_req_resp", (void*)sdreq,
+		tot_len, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+		bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("Find SVC Failed \n"));
+		goto exit;
+	}
+
+	cfg->sdo->sd_state |= WL_SD_SEARCH_SVC;
+
+exit:
+	kfree(sdreq);
+	return ret;
+}
+
+s32 wl_sd_handle_sd_cancel_req(
+	struct net_device *dev,
+	u8 *buf)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx =  wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+
+	if (wldev_iovar_setbuf_bsscfg(dev, "p2po_sd_cancel", NULL,
+		0, cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+		bssidx, &cfg->ioctl_buf_sync) < 0) {
+		WL_ERR(("Cancel SD Failed \n"));
+		return -EINVAL;
+	}
+
+	cfg->sdo->sd_state &= ~WL_SD_SEARCH_SVC;
+
+	return 0;
+}
+
+/*
+ * register a UPnP service to be discovered
+ * ./cfg P2P_SD_SVC_ADD upnp 0x10urn:schemas-upnporg:device:InternetGatewayDevice:1 0x10uu
+ * id:6859dede-8574-59ab-9332-123456789012::urn:schemas-upnporg:device:InternetGate
+ * wayDevice:1
+*/
+s32 wl_sd_handle_sd_add_svc(
+	struct net_device *dev,
+	u8 * buf,
+	int len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx = 0;
+	wl_sd_qr_t *sdreq;
+	u8 proto = 0;
+	u16 version = 0;
+	s32 ret = 0;
+	u8 *resp = NULL;
+	u8 *query = NULL;
+	u32 tot_len = len + sizeof(wl_sd_qr_t);
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+
+	if (!buf || !len)
+		return -EINVAL;
+
+	WL_SD(("%s Len: %d\n", buf, len));
+	if (tot_len > WLC_IOCTL_MAXLEN) {
+		WL_ERR(("Query-Resp length > %d not supported \n", WLC_IOCTL_MAXLEN));
+		return -ENOMEM;
+	}
+
+	sdreq = kzalloc(tot_len, kflags);
+	if (!sdreq) {
+		WL_ERR(("malloc failed\n"));
+		return -ENOMEM;
+	}
+
+	if ((ret = wl_cfg80211_DsdOffloadParseProto(buf, &proto)) < 0) {
+		WL_ERR(("Unknown Proto \n"));
+		goto exit;
+	}
+
+	sdreq->protocol = proto;
+	buf += ret;
+
+	if (*buf == '\0') {
+		WL_ERR(("No Query Resp pair present \n"));
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	buf++; /* Skip the space */
+	len = strlen(buf);
+	query = strsep((char **)&buf, " ");
+	if (!query || !buf) {
+		WL_ERR(("No Query RESP Present\n"));
+		ret = -EINVAL;
+		goto exit;
+	}
+	resp = buf;
+
+	if (sdreq->protocol == SVC_RPOTYPE_UPNP) {
+		/* Extract UPNP version */
+		version = simple_strtoul(query, NULL, 16);
+		query = query + UPNP_QUERY_VER_OFFSET;
+		resp = resp + UPNP_QUERY_VER_OFFSET;
+		query[0] = version;
+		resp[0] = version;
+		WL_SD(("Upnp version: 0x%x \n", version));
+	}
+
+	sdreq->query_len = strlen(query);
+	sdreq->response_len = strlen(buf);
+	WL_SD(("query:%s len:%u \n", query, sdreq->query_len));
+	WL_SD(("resp:%s len:%u \n", buf, sdreq->response_len));
+
+	memcpy(sdreq->qrbuf, query, sdreq->query_len);
+	memcpy((sdreq->qrbuf + sdreq->query_len), resp, sdreq->response_len);
+
+	/* Enable discovery */
+	if ((ret = wl_cfgp2p_enable_discovery(cfg, dev, NULL, 0)) < 0) {
+		WL_ERR(("cfgp2p_enable discovery failed"));
+		goto exit;
+	}
+
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_addsvc", (void*)sdreq,
+		tot_len, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+		bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("FW Failed in doing p2po_addsvc. RET:%d \n", ret));
+		goto exit;
+	}
+
+	cfg->sdo->sd_state |= WL_SD_ADV_SVC;
+
+exit:
+	kfree(sdreq);
+	return ret;
+}
+
+s32 wl_sd_handle_sd_del_svc(
+	struct net_device *dev,
+	u8 * buf,
+	int len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx = 0;
+	wl_sd_qr_t *sdreq;
+	u8 proto = 0;
+	s32 ret = 0;
+	u32 tot_len = len + sizeof(wl_sd_qr_t);
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+	u16 version = 0;
+
+	if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+		WL_ERR(("find_idx failed\n"));
+		return -EINVAL;
+	}
+
+	sdreq = (wl_sd_qr_t *)kzalloc(tot_len, kflags);
+	if (!sdreq) {
+		WL_ERR(("malloc failed\n"));
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	/* Check for the least arg length expected */
+	if (buf && len >= strlen("all")) {
+		WL_DBG(("%s Len: %d\n", buf, len));
+		if ((ret = wl_cfg80211_DsdOffloadParseProto(buf, &proto)) < 0) {
+			WL_ERR(("Unknown Proto \n"));
+			goto exit;
+		}
+		sdreq->protocol = proto;
+		buf += ret;
+
+		if (*buf == ' ') {
+			/* Query present */
+			buf++; /* Skip the space */
+			/* UPNP version needs to put as binary val */
+			if (sdreq->protocol == SVC_RPOTYPE_UPNP) {
+				/* Extract UPNP version */
+				version = simple_strtoul(buf, NULL, 16);
+				buf = buf + UPNP_QUERY_VER_OFFSET;
+				buf[0] = version;
+				WL_SD(("Upnp version: 0x%x \n", version));
+			}
+			memcpy(sdreq->qrbuf, buf, strlen(buf));
+			sdreq->query_len = strlen(buf);
+			WL_SD(("Query to be deleted:%s len:%d\n", buf, sdreq->query_len));
+		}
+	} else {
+		/* ALL */
+		proto = 0;
+	}
+
+	sdreq->protocol = proto;
+	WL_SD(("Proto: %d \n", proto));
+
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_delsvc", (void*)sdreq,
+		tot_len, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+		bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("FW Failed in doing sd_delsvc. ret=%d \n", ret));
+		goto exit;
+	}
+
+	cfg->sdo->sd_state &= ~WL_SD_ADV_SVC;
+
+exit:
+	if (sdreq)
+		kfree(sdreq);
+
+	return ret;
+}
+
+s32 wl_sd_handle_sd_stop_discovery(
+	struct net_device *dev,
+	u8 * buf,
+	int len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	int ret = 0;
+	int sdo_pause = 0;
+
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_stop", (void*)&sdo_pause,
+		sizeof(sdo_pause), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+		bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("p2po_stop Failed :%d\n", ret));
+		return -1;
+	}
+
+	if (wldev_iovar_setint(dev, "mpc", 1) < 0) {
+		/* Setting of MPC failed */
+		WL_ERR(("mpc enabling back failed\n"));
+		return -1;
+	}
+
+	/* clear the states */
+	cfg->sdo->dd_state = WL_DD_STATE_IDLE;
+	wl_clr_p2p_status(cfg, DISC_IN_PROGRESS);
+
+	bzero(&cfg->sdo->sd_listen, sizeof(wl_sd_listen_t));
+
+	/* Remove ESCAN from waking up the host if ofind/olisten is enabled */
+	wl_add_remove_eventmsg(dev, WLC_E_ESCAN_RESULT, true);
+
+	return ret;
+}
+
+s32 wl_sd_handle_sd_find(
+	struct net_device *dev,
+	u8 * buf,
+	int len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	int ret = 0;
+	s32 disc_bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	vndr_ie_setbuf_t *ie_setbuf;
+	vndr_ie_t *vndrie;
+	vndr_ie_buf_t *vndriebuf;
+	u16 kflags = in_atomic() ? GFP_ATOMIC : GFP_KERNEL;
+	int tot_len = 0;
+	uint channel = 0;
+
+	u8 p2pie_buf[] = {
+				0x09, 0x02, 0x02, 0x00, 0x27, 0x0c, 0x06, 0x05, 0x00,
+				0x55, 0x53, 0x04, 0x51, 0x0b, 0x11, 0x05, 0x00, 0x55,
+				0x53, 0x04, 0x51, 0x0b
+			  };
+
+	/* Enable discovery */
+	if ((ret = wl_cfgp2p_enable_discovery(cfg, dev, NULL, 0)) < 0) {
+		WL_ERR(("cfgp2p_enable discovery failed"));
+		return -1;
+	}
+
+	if (buf && strncmp(buf, "chan=", strlen("chan=")) == 0) {
+		buf += strlen("chan=");
+		channel = simple_strtol(buf, NULL, 10);
+		WL_SD(("listen_chan to be set:%d\n", channel));
+		if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen_channel", (void*)&channel,
+			sizeof(channel), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+			bssidx, &cfg->ioctl_buf_sync)) < 0) {
+				WL_ERR(("p2po_listen_channel Failed :%d\n", ret));
+				return -1;
+		}
+	}
+
+	tot_len = sizeof(vndr_ie_setbuf_t) + sizeof(p2pie_buf);
+	ie_setbuf = (vndr_ie_setbuf_t *) kzalloc(tot_len, kflags);
+	if (!ie_setbuf) {
+		WL_ERR(("IE memory alloc failed\n"));
+		return -ENOMEM;
+	}
+
+	/* Apply the p2p_ie for p2po_find */
+	strcpy(ie_setbuf->cmd, "add");
+
+	vndriebuf = &ie_setbuf->vndr_ie_buffer;
+	vndriebuf->iecount = htod32(1);
+	vndriebuf->vndr_ie_list[0].pktflag =  htod32(16);
+
+	vndrie =  &vndriebuf->vndr_ie_list[0].vndr_ie_data;
+
+	vndrie->id = (uchar) DOT11_MNG_PROPR_ID;
+	vndrie->len = sizeof(p2pie_buf);
+	memcpy(vndrie->oui, WFA_OUI, WFA_OUI_LEN);
+	memcpy(vndrie->data, p2pie_buf, sizeof(p2pie_buf));
+
+	/* Remove ESCAN from waking up the host if SDO is enabled */
+	wl_add_remove_eventmsg(dev, WLC_E_ESCAN_RESULT, false);
+
+	if (wldev_iovar_setbuf_bsscfg(dev, "ie", (void*)ie_setbuf,
+		tot_len, cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+		disc_bssidx, &cfg->ioctl_buf_sync) < 0) {
+		WL_ERR(("p2p add_ie failed \n"));
+		ret = -EINVAL;
+		goto exit;
+	} else
+		WL_SD(("p2p add_ie applied successfully len:%d \n", tot_len));
+
+	if (wldev_iovar_setint(dev, "mpc", 0) < 0) {
+		/* Setting of MPC failed */
+		WL_ERR(("mpc disabling faild\n"));
+		ret = -1;
+		goto exit;
+	}
+
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_find", NULL, 0,
+		cfg->ioctl_buf, WLC_IOCTL_SMLEN, bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("p2po_find Failed :%d\n", ret));
+		ret = -1;
+		goto exit;
+	}
+
+	/* set the states */
+	cfg->sdo->dd_state = WL_DD_STATE_SEARCH;
+	wl_set_p2p_status(cfg, DISC_IN_PROGRESS);
+
+exit:
+	if (ie_setbuf)
+		kfree(ie_setbuf);
+
+	/* Incase of failure enable back the ESCAN event */
+	if (ret)
+		wl_add_remove_eventmsg(dev, WLC_E_ESCAN_RESULT, true);
+
+	return ret;
+}
+
+s32 wl_sd_handle_sd_listen(
+	struct net_device *dev,
+	u8 *buf,
+	int len)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	s32 bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	wl_sd_listen_t sd_listen;
+	int ret = 0;
+	u8 * ptr = NULL;
+	uint channel = 0;
+
+	/* Just in case if it is not enabled */
+	if ((ret = wl_cfgp2p_enable_discovery(cfg, dev, NULL, 0)) < 0) {
+		WL_ERR(("cfgp2p_enable discovery failed"));
+		return -1;
+	}
+
+	if (wldev_iovar_setint(dev, "mpc", 0) < 0) {
+		/* Setting of MPC failed */
+		WL_ERR(("mpc disabling faild\n"));
+		return -1;
+	}
+
+	bzero(&sd_listen, sizeof(wl_sd_listen_t));
+
+	if (len) {
+		ptr = strsep((char **)&buf, " ");
+		if (ptr == NULL) {
+			/* period and duration given wrongly */
+			WL_ERR(("Arguments in wrong format \n"));
+			return -EINVAL;
+		}
+		else if (strncmp(ptr, "chan=", strlen("chan=")) == 0) {
+			sd_listen.interval = 65535;
+			sd_listen.period = 65535;
+			ptr += strlen("chan=");
+			channel = simple_strtol(ptr, NULL, 10);
+		}
+		else {
+			sd_listen.period = simple_strtol(ptr, NULL, 10);
+			ptr = strsep((char **)&buf, " ");
+			if (ptr == NULL) {
+				WL_ERR(("Arguments in wrong format \n"));
+				return -EINVAL;
+			}
+			sd_listen.interval = simple_strtol(ptr, NULL, 10);
+			if (buf && strncmp(buf, "chan=", strlen("chan=")) == 0) {
+				buf += strlen("chan=");
+				channel = simple_strtol(buf, NULL, 10);
+			}
+		}
+		WL_SD(("listen_period:%d, listen_interval:%d and listen_channel:%d\n",
+			sd_listen.period, sd_listen.interval, channel));
+	}
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen_channel", (void*)&channel,
+		sizeof(channel), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+		bssidx, &cfg->ioctl_buf_sync)) < 0) {
+			WL_ERR(("p2po_listen_channel Failed :%d\n", ret));
+			return -1;
+	}
+
+	WL_SD(("p2po_listen period:%d  interval:%d \n",
+		sd_listen.period, sd_listen.interval));
+	if ((ret = wldev_iovar_setbuf_bsscfg(dev, "p2po_listen", (void*)&sd_listen,
+		sizeof(wl_sd_listen_t), cfg->ioctl_buf, WLC_IOCTL_SMLEN,
+		bssidx, &cfg->ioctl_buf_sync)) < 0) {
+		WL_ERR(("p2po_listen Failed :%d\n", ret));
+		return -1;
+	}
+
+	/* Remove ESCAN from waking up the host if ofind/olisten is enabled */
+	wl_add_remove_eventmsg(dev, WLC_E_ESCAN_RESULT, false);
+
+	/* Store the extended listen values for use in sdo_resume */
+	cfg->sdo->sd_listen.interval = sd_listen.interval;
+	cfg->sdo->sd_listen.period = sd_listen.period;
+
+	/* set the states */
+	cfg->sdo->dd_state = WL_DD_STATE_LISTEN;
+	wl_set_p2p_status(cfg, DISC_IN_PROGRESS);
+
+	return 0;
+}
+
+s32 wl_cfg80211_sd_offload(struct net_device *dev, char *cmd, char* buf, int len)
+{
+	int ret = 0;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	WL_SD(("Entry cmd:%s arg_len:%d \n", cmd, len));
+
+	if (!cfg->sdo) {
+		WL_SD(("Initializing SDO \n"));
+		if ((ret = wl_cfg80211_sdo_init(cfg)) < 0)
+			goto exit;
+	}
+
+	if (strncmp(cmd, "P2P_SD_REQ", strlen("P2P_SD_REQ")) == 0) {
+		ret = wl_sd_handle_sd_req(dev, buf, len);
+	} else if (strncmp(cmd, "P2P_SD_CANCEL_REQ", strlen("P2P_SD_CANCEL_REQ")) == 0) {
+		ret = wl_sd_handle_sd_cancel_req(dev, buf);
+	} else if (strncmp(cmd, "P2P_SD_SVC_ADD", strlen("P2P_SD_SVC_ADD")) == 0) {
+		ret = wl_sd_handle_sd_add_svc(dev, buf, len);
+	} else if (strncmp(cmd, "P2P_SD_SVC_DEL", strlen("P2P_SD_SVC_DEL")) == 0) {
+		ret = wl_sd_handle_sd_del_svc(dev, buf, len);
+	} else if (strncmp(cmd, "P2P_SD_FIND", strlen("P2P_SD_FIND")) == 0) {
+		ret = wl_sd_handle_sd_find(dev, buf, len);
+	} else if (strncmp(cmd, "P2P_SD_LISTEN", strlen("P2P_SD_LISTEN")) == 0) {
+		ret = wl_sd_handle_sd_listen(dev, buf, len);
+	} else if (strncmp(cmd, "P2P_SD_STOP", strlen("P2P_STOP")) == 0) {
+		ret = wl_sd_handle_sd_stop_discovery(dev, buf, len);
+	} else {
+		WL_ERR(("Request for Unsupported CMD:%s \n", buf));
+		ret = -EINVAL;
+	}
+
+exit:
+	return ret;
+}
+#endif /* WL_SDO */
+
+#ifdef WLTDLS
+static s32
+wl_tdls_event_handler(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data) {
+
+	struct net_device *ndev = NULL;
+	u32 reason = ntoh32(e->reason);
+	s8 *msg = NULL;
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	switch (reason) {
+	case WLC_E_TDLS_PEER_DISCOVERED :
+		msg = " TDLS PEER DISCOVERD ";
+		break;
+	case WLC_E_TDLS_PEER_CONNECTED :
+#ifdef PCIE_FULL_DONGLE
+		dhd_tdls_update_peer_info(ndev, TRUE, (uint8 *)&e->addr.octet[0]);
+#endif /* PCIE_FULL_DONGLE */
+		if (cfg->tdls_mgmt_frame) {
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0))
+			cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+				cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len, 0);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 12, 0))
+			cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+				cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+				0, GFP_ATOMIC);
+#elif (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 4, 0)) || \
+	defined(WL_COMPAT_WIRELESS)
+			cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq, 0,
+				cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+				GFP_ATOMIC);
+#else
+			cfg80211_rx_mgmt(cfgdev, cfg->tdls_mgmt_freq,
+				cfg->tdls_mgmt_frame, cfg->tdls_mgmt_frame_len,
+				GFP_ATOMIC);
+#endif /* LINUX_VERSION >= VERSION(3, 12, 0) */
+		}
+		msg = " TDLS PEER CONNECTED ";
+		break;
+	case WLC_E_TDLS_PEER_DISCONNECTED :
+#ifdef PCIE_FULL_DONGLE
+		dhd_tdls_update_peer_info(ndev, FALSE, (uint8 *)&e->addr.octet[0]);
+#endif /* PCIE_FULL_DONGLE */
+		if (cfg->tdls_mgmt_frame) {
+			kfree(cfg->tdls_mgmt_frame);
+			cfg->tdls_mgmt_frame = NULL;
+			cfg->tdls_mgmt_freq = 0;
+		}
+		msg = "TDLS PEER DISCONNECTED ";
+		break;
+	}
+	if (msg) {
+		WL_ERR(("%s: " MACDBG " on %s ndev\n", msg, MAC2STRDBG((u8*)(&e->addr)),
+			(bcmcfg_to_prmry_ndev(cfg) == ndev) ? "primary" : "secondary"));
+	}
+	return 0;
+
+}
+#endif  /* WLTDLS */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 2, 0)) || defined(WL_COMPAT_WIRELESS)
+static s32
+#if defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+        u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+        u32 peer_capability, const u8 *data, size_t len)
+#else
+wl_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+	const u8 *peer, u8 action_code, u8 dialog_token, u16 status_code,
+	u32 peer_capability, bool initiator, const u8 *data, size_t len)
+#endif  /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+{
+	s32 ret = 0;
+#ifdef WLTDLS
+	struct bcm_cfg80211 *cfg;
+	tdls_wfd_ie_iovar_t info;
+	memset(&info, 0, sizeof(tdls_wfd_ie_iovar_t));
+	cfg = g_bcm_cfg;
+
+#if defined(CONFIG_ARCH_MSM) && defined(TDLS_MGMT_VERSION2)
+	/* Some customer platform back ported this feature from kernel 3.15 to kernel 3.10
+	* and that cuases build error
+	*/
+	BCM_REFERENCE(peer_capability);
+#endif  /* CONFIG_ARCH_MSM && TDLS_MGMT_VERSION2 */
+
+	switch (action_code) {
+	/* We need to set TDLS Wifi Display IE to firmware
+	 * using tdls_wfd_ie iovar
+	 */
+	case WLAN_TDLS_SET_PROBE_WFD_IE:
+		info.mode = TDLS_WFD_PROBE_IE_TX;
+		memcpy(&info.data, data, len);
+		info.length = len;
+		break;
+	case WLAN_TDLS_SET_SETUP_WFD_IE:
+		info.mode = TDLS_WFD_IE_TX;
+		memcpy(&info.data, data, len);
+		info.length = len;
+		break;
+	default:
+		WL_ERR(("Unsupported action code : %d\n", action_code));
+		goto out;
+	}
+
+	ret = wldev_iovar_setbuf(dev, "tdls_wfd_ie", &info, sizeof(info),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+	if (ret) {
+		WL_ERR(("tdls_wfd_ie error %d\n", ret));
+	}
+out:
+#endif /* WLTDLS */
+	return ret;
+}
+
+static s32
+wl_cfg80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+	NL_u8 *peer, enum nl80211_tdls_operation oper)
+{
+	s32 ret = 0;
+#ifdef WLTDLS
+	struct bcm_cfg80211 *cfg;
+	tdls_iovar_t info;
+	cfg = g_bcm_cfg;
+	memset(&info, 0, sizeof(tdls_iovar_t));
+	if (peer)
+		memcpy(&info.ea, peer, ETHER_ADDR_LEN);
+	switch (oper) {
+	case NL80211_TDLS_DISCOVERY_REQ:
+		/* turn on TDLS */
+		ret = dhd_tdls_enable(dev, true, false, NULL);
+		if (ret < 0)
+			return ret;
+		/* If the discovery request is broadcast then we need to set
+		 * info.mode to Tunneled Probe Request
+		 */
+		if (memcmp(peer, (const uint8 *)BSSID_BROADCAST, ETHER_ADDR_LEN) == 0) {
+			info.mode = TDLS_MANUAL_EP_WFD_TPQ;
+		}
+		else {
+			info.mode = TDLS_MANUAL_EP_DISCOVERY;
+		}
+		break;
+	case NL80211_TDLS_SETUP:
+		/* auto mode on */
+		ret = dhd_tdls_enable(dev, true, true, (struct ether_addr *)peer);
+		if (ret < 0)
+			return ret;
+		break;
+	case NL80211_TDLS_TEARDOWN:
+		info.mode = TDLS_MANUAL_EP_DELETE;
+		/* auto mode off */
+		ret = dhd_tdls_enable(dev, true, false, (struct ether_addr *)peer);
+		if (ret < 0)
+			return ret;
+		break;
+	default:
+		WL_ERR(("Unsupported operation : %d\n", oper));
+		goto out;
+	}
+	if (info.mode) {
+		ret = wldev_iovar_setbuf(dev, "tdls_endpoint", &info, sizeof(info),
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+		if (ret) {
+			WL_ERR(("tdls_endpoint error %d\n", ret));
+		}
+	}
+out:
+#endif /* WLTDLS */
+	return ret;
+}
+#endif /* LINUX_VERSION > VERSION(3,2,0) || WL_COMPAT_WIRELESS */
+
+s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *net, char *buf, int len,
+	enum wl_management_type type)
+{
+	struct bcm_cfg80211 *cfg;
+	struct net_device *ndev = NULL;
+	struct ether_addr primary_mac;
+	s32 ret = 0;
+	s32 bssidx = 0;
+	s32 pktflag = 0;
+	cfg = g_bcm_cfg;
+
+	if (wl_get_drv_status(cfg, AP_CREATING, net)) {
+		/* Vendor IEs should be set to FW
+		 * after SoftAP interface is brought up
+		 */
+		goto exit;
+	} else if (wl_get_drv_status(cfg, AP_CREATED, net)) {
+		ndev = net;
+		bssidx = 0;
+	} else if (cfg->p2p) {
+		net = ndev_to_wlc_ndev(net, cfg);
+		if (!cfg->p2p->on) {
+			get_primary_mac(cfg, &primary_mac);
+			wl_cfgp2p_generate_bss_mac(&primary_mac, &cfg->p2p->dev_addr,
+				&cfg->p2p->int_addr);
+			/* In case of p2p_listen command, supplicant send remain_on_channel
+			* without turning on P2P
+			*/
+
+			p2p_on(cfg) = true;
+			ret = wl_cfgp2p_enable_discovery(cfg, net, NULL, 0);
+
+			if (unlikely(ret)) {
+				goto exit;
+			}
+		}
+		if (net  != bcmcfg_to_prmry_ndev(cfg)) {
+			if (wl_get_mode_by_netdev(cfg, net) == WL_MODE_AP) {
+				ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION);
+				bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION);
+			}
+		} else {
+				ndev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+				bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+		}
+	}
+	if (ndev != NULL) {
+		switch (type) {
+			case WL_BEACON:
+				pktflag = VNDR_IE_BEACON_FLAG;
+				break;
+			case WL_PROBE_RESP:
+				pktflag = VNDR_IE_PRBRSP_FLAG;
+				break;
+			case WL_ASSOC_RESP:
+				pktflag = VNDR_IE_ASSOCRSP_FLAG;
+				break;
+		}
+		if (pktflag)
+			ret = wl_cfgp2p_set_management_ie(cfg, ndev, bssidx, pktflag, buf, len);
+	}
+exit:
+	return ret;
+}
+
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+static s32
+wl_cfg80211_set_auto_channel_scan_state(struct net_device *ndev)
+{
+	u32 val = 0;
+	s32 ret = BCME_ERROR;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	/* Disable mpc, to avoid automatic interface down. */
+	val = 0;
+
+	ret = wldev_iovar_setbuf_bsscfg(ndev, "mpc", (void *)&val,
+		sizeof(val), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+		&cfg->ioctl_buf_sync);
+	if (ret < 0) {
+		WL_ERR(("set 'mpc' failed, error = %d\n", ret));
+		goto done;
+	}
+
+	/* Set interface up, explicitly. */
+	val = 1;
+
+	ret = wldev_ioctl(ndev, WLC_UP, (void *)&val, sizeof(val), true);
+	if (ret < 0) {
+		WL_ERR(("set interface up failed, error = %d\n", ret));
+		goto done;
+	}
+
+	/* Stop all scan explicitly, till auto channel selection complete. */
+	wl_set_drv_status(cfg, SCANNING, ndev);
+	if (cfg->escan_info.ndev == NULL) {
+		ret = BCME_OK;
+		goto done;
+	}
+	ret = wl_notify_escan_complete(cfg, ndev, true, true);
+	if (ret < 0) {
+		WL_ERR(("set scan abort failed, error = %d\n", ret));
+		ret = BCME_OK; // terence 20140115: fix escan_complete error
+		goto done;
+	}
+
+done:
+	return ret;
+}
+
+static bool
+wl_cfg80211_valid_chanspec_p2p(chanspec_t chanspec)
+{
+	bool valid = false;
+	char chanbuf[CHANSPEC_STR_LEN];
+
+	/* channel 1 to 14 */
+	if ((chanspec >= 0x2b01) && (chanspec <= 0x2b0e)) {
+		valid = true;
+	}
+	/* channel 36 to 48 */
+	else if ((chanspec >= 0x1b24) && (chanspec <= 0x1b30)) {
+		valid = true;
+	}
+	/* channel 149 to 161 */
+	else if ((chanspec >= 0x1b95) && (chanspec <= 0x1ba1)) {
+		valid = true;
+	}
+	else {
+		valid = false;
+		WL_INFORM(("invalid P2P chanspec, chanspec = %s\n",
+			wf_chspec_ntoa_ex(chanspec, chanbuf)));
+	}
+
+	return valid;
+}
+
+static s32
+wl_cfg80211_get_chanspecs_2g(struct net_device *ndev, void *buf, s32 buflen)
+{
+	s32 ret = BCME_ERROR;
+	struct bcm_cfg80211 *cfg = NULL;
+	wl_uint32_list_t *list = NULL;
+	chanspec_t chanspec = 0;
+
+	memset(buf, 0, buflen);
+
+	cfg = g_bcm_cfg;
+	list = (wl_uint32_list_t *)buf;
+	list->count = htod32(WL_NUMCHANSPECS);
+
+	/* Restrict channels to 2.4GHz, 20MHz BW, no SB. */
+	chanspec |= (WL_CHANSPEC_BAND_2G | WL_CHANSPEC_BW_20 |
+		WL_CHANSPEC_CTL_SB_NONE);
+	chanspec = wl_chspec_host_to_driver(chanspec);
+
+	ret = wldev_iovar_getbuf_bsscfg(ndev, "chanspecs", (void *)&chanspec,
+		sizeof(chanspec), buf, buflen, 0, &cfg->ioctl_buf_sync);
+	if (ret < 0) {
+		WL_ERR(("get 'chanspecs' failed, error = %d\n", ret));
+	}
+
+	return ret;
+}
+
+static s32
+wl_cfg80211_get_chanspecs_5g(struct net_device *ndev, void *buf, s32 buflen)
+{
+	u32 channel = 0;
+	s32 ret = BCME_ERROR;
+	s32 i = 0;
+	s32 j = 0;
+	struct bcm_cfg80211 *cfg = NULL;
+	wl_uint32_list_t *list = NULL;
+	chanspec_t chanspec = 0;
+
+	memset(buf, 0, buflen);
+
+	cfg = g_bcm_cfg;
+	list = (wl_uint32_list_t *)buf;
+	list->count = htod32(WL_NUMCHANSPECS);
+
+	/* Restrict channels to 5GHz, 20MHz BW, no SB. */
+	chanspec |= (WL_CHANSPEC_BAND_5G | WL_CHANSPEC_BW_20 |
+		WL_CHANSPEC_CTL_SB_NONE);
+	chanspec = wl_chspec_host_to_driver(chanspec);
+
+	ret = wldev_iovar_getbuf_bsscfg(ndev, "chanspecs", (void *)&chanspec,
+		sizeof(chanspec), buf, buflen, 0, &cfg->ioctl_buf_sync);
+	if (ret < 0) {
+		WL_ERR(("get 'chanspecs' failed, error = %d\n", ret));
+		goto done;
+	}
+
+	/* Skip DFS and inavlid P2P channel. */
+	for (i = 0, j = 0; i < dtoh32(list->count); i++) {
+		chanspec = (chanspec_t) dtoh32(list->element[i]);
+		channel = CHSPEC_CHANNEL(chanspec);
+
+		ret = wldev_iovar_getint(ndev, "per_chan_info", &channel);
+		if (ret < 0) {
+			WL_ERR(("get 'per_chan_info' failed, error = %d\n", ret));
+			goto done;
+		}
+
+		if (CHANNEL_IS_RADAR(channel) ||
+			!(wl_cfg80211_valid_chanspec_p2p(chanspec))) {
+			continue;
+		} else {
+			list->element[j] = list->element[i];
+		}
+
+		j++;
+	}
+
+	list->count = j;
+
+done:
+	return ret;
+}
+
+static s32
+wl_cfg80211_get_best_channel(struct net_device *ndev, void *buf, int buflen,
+	int *channel)
+{
+	s32 ret = BCME_ERROR;
+	int chosen = 0;
+	int retry = 0;
+	uint chip;
+
+	/* Start auto channel selection scan. */
+	ret = wldev_ioctl(ndev, WLC_START_CHANNEL_SEL, buf, buflen, true);
+	if (ret < 0) {
+		WL_ERR(("can't start auto channel scan, error = %d\n", ret));
+		*channel = 0;
+		goto done;
+	}
+
+	/* Wait for auto channel selection, worst case possible delay is 5250ms. */
+	retry = CHAN_SEL_RETRY_COUNT;
+
+	while (retry--) {
+		OSL_SLEEP(CHAN_SEL_IOCTL_DELAY);
+
+		ret = wldev_ioctl(ndev, WLC_GET_CHANNEL_SEL, &chosen, sizeof(chosen),
+			false);
+		if ((ret == 0) && (dtoh32(chosen) != 0)) {
+			chip = dhd_conf_get_chip(dhd_get_pub(ndev));
+			if (chip != BCM43362_CHIP_ID &&	chip != BCM4330_CHIP_ID) {
+				u32 chanspec = 0;
+				int ctl_chan;
+				chanspec = wl_chspec_driver_to_host(chosen);
+				printf("selected chanspec = 0x%x\n", chanspec);
+				ctl_chan = wf_chspec_ctlchan(chanspec);
+				printf("selected ctl_chan = 0x%x\n", ctl_chan);
+				*channel = (u16)(ctl_chan & 0x00FF);
+			} else
+				*channel = (u16)(chosen & 0x00FF);
+			WL_INFORM(("selected channel = %d\n", *channel));
+			break;
+		}
+		WL_INFORM(("attempt = %d, ret = %d, chosen = %d\n",
+			(CHAN_SEL_RETRY_COUNT - retry), ret, dtoh32(chosen)));
+	}
+
+	if (retry <= 0)	{
+		WL_ERR(("failure, auto channel selection timed out\n"));
+		*channel = 0;
+		ret = BCME_ERROR;
+	}
+
+done:
+	return ret;
+}
+
+static s32
+wl_cfg80211_restore_auto_channel_scan_state(struct net_device *ndev)
+{
+	u32 val = 0;
+	s32 ret = BCME_ERROR;
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	/* Clear scan stop driver status. */
+	wl_clr_drv_status(cfg, SCANNING, ndev);
+
+	/* Enable mpc back to 1, irrespective of initial state. */
+	val = 1;
+
+	ret = wldev_iovar_setbuf_bsscfg(ndev, "mpc", (void *)&val,
+		sizeof(val), cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0,
+		&cfg->ioctl_buf_sync);
+	if (ret < 0) {
+		WL_ERR(("set 'mpc' failed, error = %d\n", ret));
+	}
+
+	return ret;
+}
+
+s32
+wl_cfg80211_get_best_channels(struct net_device *dev, char* cmd, int total_len)
+{
+	int channel = 0, band, band_cur;
+	s32 ret = BCME_ERROR;
+	u8 *buf = NULL;
+	char *pos = cmd;
+	struct bcm_cfg80211 *cfg = NULL;
+	struct net_device *ndev = NULL;
+
+	memset(cmd, 0, total_len);
+
+	buf = kmalloc(CHANSPEC_BUF_SIZE, GFP_KERNEL);
+	if (buf == NULL) {
+		WL_ERR(("failed to allocate chanspec buffer\n"));
+		return -ENOMEM;
+	}
+
+	/*
+	 * Always use primary interface, irrespective of interface on which
+	 * command came.
+	 */
+	cfg = g_bcm_cfg;
+	ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	/*
+	 * Make sure that FW and driver are in right state to do auto channel
+	 * selection scan.
+	 */
+	ret = wl_cfg80211_set_auto_channel_scan_state(ndev);
+	if (ret < 0) {
+		WL_ERR(("can't set auto channel scan state, error = %d\n", ret));
+		goto done;
+	}
+
+	/* Best channel selection in 2.4GHz band. */
+	ret = wl_cfg80211_get_chanspecs_2g(ndev, (void *)buf, CHANSPEC_BUF_SIZE);
+	if (ret < 0) {
+		WL_ERR(("can't get chanspecs in 2.4GHz, error = %d\n", ret));
+		goto done;
+	}
+
+	ret = wl_cfg80211_get_best_channel(ndev, (void *)buf, CHANSPEC_BUF_SIZE,
+		&channel);
+	if (ret < 0) {
+		WL_ERR(("can't select best channel scan in 2.4GHz, error = %d\n", ret));
+		goto done;
+	}
+
+	if (CHANNEL_IS_2G(channel)) {
+		channel = ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
+	} else {
+		WL_ERR(("invalid 2.4GHz channel, channel = %d\n", channel));
+		channel = 0;
+	}
+
+	sprintf(pos, "%04d ", channel);
+	pos += 5;
+
+	// terence 20140120: fix for some chipsets only return 2.4GHz channel (4330b2/43341b0/4339a0)
+	ret = wldev_ioctl(dev, WLC_GET_BAND, &band_cur, sizeof(band_cur), false);
+	band = band_cur==WLC_BAND_2G ? band_cur : WLC_BAND_5G;
+	ret = wldev_ioctl(dev, WLC_SET_BAND, &band, sizeof(band), true);
+	if (ret < 0)
+		WL_ERR(("WLC_SET_BAND error %d\n", ret));
+
+	/* Best channel selection in 5GHz band. */
+	ret = wl_cfg80211_get_chanspecs_5g(ndev, (void *)buf, CHANSPEC_BUF_SIZE);
+	if (ret < 0) {
+		WL_ERR(("can't get chanspecs in 5GHz, error = %d\n", ret));
+		goto done;
+	}
+
+	ret = wl_cfg80211_get_best_channel(ndev, (void *)buf, CHANSPEC_BUF_SIZE,
+		&channel);
+	if (ret < 0) {
+		WL_ERR(("can't select best channel scan in 5GHz, error = %d\n", ret));
+		goto done;
+	}
+
+	if (CHANNEL_IS_5G(channel)) {
+		channel = ieee80211_channel_to_frequency(channel, NL80211_BAND_5GHZ);
+	} else {
+		WL_ERR(("invalid 5GHz channel, channel = %d\n", channel));
+		channel = 0;
+	}
+
+	ret = wldev_ioctl(dev, WLC_SET_BAND, &band_cur, sizeof(band_cur), true);
+	if (ret < 0)
+		WL_ERR(("WLC_SET_BAND error %d\n", ret));
+
+	sprintf(pos, "%04d ", channel);
+	pos += 5;
+
+	/* Set overall best channel same as 5GHz best channel. */
+	sprintf(pos, "%04d ", channel);
+	pos += 5;
+
+done:
+	if (NULL != buf) {
+		kfree(buf);
+	}
+
+	/* Restore FW and driver back to normal state. */
+	ret = wl_cfg80211_restore_auto_channel_scan_state(ndev);
+	if (ret < 0) {
+		WL_ERR(("can't restore auto channel scan state, error = %d\n", ret));
+	}
+
+	printf("%s: channel %s\n", __FUNCTION__, cmd);
+
+	return (pos - cmd);
+}
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+static const struct rfkill_ops wl_rfkill_ops = {
+	.set_block = wl_rfkill_set
+};
+
+static int wl_rfkill_set(void *data, bool blocked)
+{
+	struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+
+	WL_DBG(("Enter \n"));
+	WL_DBG(("RF %s\n", blocked ? "blocked" : "unblocked"));
+
+	if (!cfg)
+		return -EINVAL;
+
+	cfg->rf_blocked = blocked;
+
+	return 0;
+}
+
+static int wl_setup_rfkill(struct bcm_cfg80211 *cfg, bool setup)
+{
+	s32 err = 0;
+
+	WL_DBG(("Enter \n"));
+	if (!cfg)
+		return -EINVAL;
+	if (setup) {
+		cfg->rfkill = rfkill_alloc("brcmfmac-wifi",
+			wl_cfg80211_get_parent_dev(),
+			RFKILL_TYPE_WLAN, &wl_rfkill_ops, (void *)cfg);
+
+		if (!cfg->rfkill) {
+			err = -ENOMEM;
+			goto err_out;
+		}
+
+		err = rfkill_register(cfg->rfkill);
+
+		if (err)
+			rfkill_destroy(cfg->rfkill);
+	} else {
+		if (!cfg->rfkill) {
+			err = -ENOMEM;
+			goto err_out;
+		}
+
+		rfkill_unregister(cfg->rfkill);
+		rfkill_destroy(cfg->rfkill);
+	}
+
+err_out:
+	return err;
+}
+
+#ifdef DEBUGFS_CFG80211
+/**
+* Format : echo "SCAN:1 DBG:1" > /sys/kernel/debug/dhd/debug_level
+* to turn on SCAN and DBG log.
+* To turn off SCAN partially, echo "SCAN:0" > /sys/kernel/debug/dhd/debug_level
+* To see current setting of debug level,
+* cat /sys/kernel/debug/dhd/debug_level
+*/
+static ssize_t
+wl_debuglevel_write(struct file *file, const char __user *userbuf,
+	size_t count, loff_t *ppos)
+{
+	char tbuf[S_SUBLOGLEVEL * ARRAYSIZE(sublogname_map)], sublog[S_SUBLOGLEVEL];
+	char *params, *token, *colon;
+	uint i, tokens, log_on = 0;
+	memset(tbuf, 0, sizeof(tbuf));
+	memset(sublog, 0, sizeof(sublog));
+	if (copy_from_user(&tbuf, userbuf, min_t(size_t, (sizeof(tbuf) - 1), count)))
+		return -EFAULT;
+
+	params = &tbuf[0];
+	colon = strchr(params, '\n');
+	if (colon != NULL)
+		*colon = '\0';
+	while ((token = strsep(&params, " ")) != NULL) {
+		memset(sublog, 0, sizeof(sublog));
+		if (token == NULL || !*token)
+			break;
+		if (*token == '\0')
+			continue;
+		colon = strchr(token, ':');
+		if (colon != NULL) {
+			*colon = ' ';
+		}
+		tokens = sscanf(token, "%s %u", sublog, &log_on);
+		if (colon != NULL)
+			*colon = ':';
+
+		if (tokens == 2) {
+				for (i = 0; i < ARRAYSIZE(sublogname_map); i++) {
+					if (!strncmp(sublog, sublogname_map[i].sublogname,
+						strlen(sublogname_map[i].sublogname))) {
+						if (log_on)
+							wl_dbg_level |=
+							(sublogname_map[i].log_level);
+						else
+							wl_dbg_level &=
+							~(sublogname_map[i].log_level);
+					}
+				}
+		} else
+			WL_ERR(("%s: can't parse '%s' as a "
+			       "SUBMODULE:LEVEL (%d tokens)\n",
+			       tbuf, token, tokens));
+
+
+	}
+	return count;
+}
+
+static ssize_t
+wl_debuglevel_read(struct file *file, char __user *user_buf,
+	size_t count, loff_t *ppos)
+{
+	char *param;
+	char tbuf[S_SUBLOGLEVEL * ARRAYSIZE(sublogname_map)];
+	uint i;
+	memset(tbuf, 0, sizeof(tbuf));
+	param = &tbuf[0];
+	for (i = 0; i < ARRAYSIZE(sublogname_map); i++) {
+		param += snprintf(param, sizeof(tbuf) - 1, "%s:%d ",
+			sublogname_map[i].sublogname,
+			(wl_dbg_level & sublogname_map[i].log_level) ? 1 : 0);
+	}
+	*param = '\n';
+	return simple_read_from_buffer(user_buf, count, ppos, tbuf, strlen(&tbuf[0]));
+
+}
+static const struct file_operations fops_debuglevel = {
+	.open = NULL,
+	.write = wl_debuglevel_write,
+	.read = wl_debuglevel_read,
+	.owner = THIS_MODULE,
+	.llseek = NULL,
+};
+
+static s32 wl_setup_debugfs(struct bcm_cfg80211 *cfg)
+{
+	s32 err = 0;
+	struct dentry *_dentry;
+	if (!cfg)
+		return -EINVAL;
+	cfg->debugfs = debugfs_create_dir(KBUILD_MODNAME, NULL);
+	if (!cfg->debugfs || IS_ERR(cfg->debugfs)) {
+		if (cfg->debugfs == ERR_PTR(-ENODEV))
+			WL_ERR(("Debugfs is not enabled on this kernel\n"));
+		else
+			WL_ERR(("Can not create debugfs directory\n"));
+		cfg->debugfs = NULL;
+		goto exit;
+
+	}
+	_dentry = debugfs_create_file("debug_level", S_IRUSR | S_IWUSR,
+		cfg->debugfs, cfg, &fops_debuglevel);
+	if (!_dentry || IS_ERR(_dentry)) {
+		WL_ERR(("failed to create debug_level debug file\n"));
+		wl_free_debugfs(cfg);
+	}
+exit:
+	return err;
+}
+static s32 wl_free_debugfs(struct bcm_cfg80211 *cfg)
+{
+	if (!cfg)
+		return -EINVAL;
+	if (cfg->debugfs)
+		debugfs_remove_recursive(cfg->debugfs);
+	cfg->debugfs = NULL;
+	return 0;
+}
+#endif /* DEBUGFS_CFG80211 */
+
+struct device *wl_cfg80211_get_parent_dev(void)
+{
+	return cfg80211_parent_dev;
+}
+
+void wl_cfg80211_set_parent_dev(void *dev)
+{
+	cfg80211_parent_dev = dev;
+}
+
+static void wl_cfg80211_clear_parent_dev(void)
+{
+	cfg80211_parent_dev = NULL;
+}
+
+void get_primary_mac(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+	wldev_iovar_getbuf_bsscfg(bcmcfg_to_prmry_ndev(cfg), "cur_etheraddr", NULL,
+		0, cfg->ioctl_buf, WLC_IOCTL_SMLEN, 0, &cfg->ioctl_buf_sync);
+	memcpy(mac->octet, cfg->ioctl_buf, ETHER_ADDR_LEN);
+}
+static bool check_dev_role_integrity(struct bcm_cfg80211 *cfg, u32 dev_role)
+{
+	dhd_pub_t *dhd = (dhd_pub_t *)(cfg->pub);
+	if (((dev_role == NL80211_IFTYPE_AP) &&
+		!(dhd->op_mode & DHD_FLAG_HOSTAP_MODE)) ||
+		((dev_role == NL80211_IFTYPE_P2P_GO) &&
+		!(dhd->op_mode & DHD_FLAG_P2P_GO_MODE)))
+	{
+		WL_ERR(("device role select failed\n"));
+		return false;
+	}
+	return true;
+}
+
+int wl_cfg80211_do_driver_init(struct net_device *net)
+{
+	struct bcm_cfg80211 *cfg = *(struct bcm_cfg80211 **)netdev_priv(net);
+
+	if (!cfg || !cfg->wdev)
+		return -EINVAL;
+
+#if !defined(P2PONEINT)
+	if (dhd_do_driver_init(cfg->wdev->netdev) < 0)
+		return -1;
+#endif /* BCMDONGLEHOST */
+
+	return 0;
+}
+
+void wl_cfg80211_enable_trace(u32 level)
+{
+	wl_dbg_level = level;
+	printf("%s: wl_dbg_level = 0x%x\n", __FUNCTION__, wl_dbg_level);
+}
+
+#if defined(WL_SUPPORT_BACKPORTED_KPATCHES) || (LINUX_VERSION_CODE >= KERNEL_VERSION(3, \
+	2, 0))
+static s32
+wl_cfg80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
+	bcm_struct_cfgdev *cfgdev, u64 cookie)
+{
+	/* CFG80211 checks for tx_cancel_wait callback when ATTR_DURATION
+	 * is passed with CMD_FRAME. This callback is supposed to cancel
+	 * the OFFCHANNEL Wait. Since we are already taking care of that
+	 *  with the tx_mgmt logic, do nothing here.
+	 */
+
+	return 0;
+}
+#endif /* WL_SUPPORT_BACKPORTED_PATCHES || KERNEL >= 3.2.0 */
+
+#ifdef WL11U
+bcm_tlv_t *
+wl_cfg80211_find_interworking_ie(u8 *parse, u32 len)
+{
+	bcm_tlv_t *ie;
+
+	while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_INTERWORKING_ID))) {
+			return (bcm_tlv_t *)ie;
+	}
+	return NULL;
+}
+
+
+static s32
+wl_cfg80211_add_iw_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx, s32 pktflag,
+            uint8 ie_id, uint8 *data, uint8 data_len)
+{
+	s32 err = BCME_OK;
+	s32 buf_len;
+	s32 iecount;
+	ie_setbuf_t *ie_setbuf;
+
+	if (ie_id != DOT11_MNG_INTERWORKING_ID)
+		return BCME_UNSUPPORTED;
+
+	/* Validate the pktflag parameter */
+	if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+	            VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+	            VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG|
+	            VNDR_IE_CUSTOM_FLAG))) {
+		WL_ERR(("cfg80211 Add IE: Invalid packet flag 0x%x\n", pktflag));
+		return -1;
+	}
+
+	/* use VNDR_IE_CUSTOM_FLAG flags for none vendor IE . currently fixed value */
+	pktflag = htod32(pktflag);
+
+	buf_len = sizeof(ie_setbuf_t) + data_len - 1;
+	ie_setbuf = (ie_setbuf_t *) kzalloc(buf_len, GFP_KERNEL);
+
+	if (!ie_setbuf) {
+		WL_ERR(("Error allocating buffer for IE\n"));
+		return -ENOMEM;
+	}
+
+	if (cfg->iw_ie_len == data_len && !memcmp(cfg->iw_ie, data, data_len)) {
+		WL_ERR(("Previous IW IE is equals to current IE\n"));
+		err = BCME_OK;
+		goto exit;
+	}
+
+	strncpy(ie_setbuf->cmd, "add", VNDR_IE_CMD_LEN - 1);
+	ie_setbuf->cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+	/* Buffer contains only 1 IE */
+	iecount = htod32(1);
+	memcpy((void *)&ie_setbuf->ie_buffer.iecount, &iecount, sizeof(int));
+	memcpy((void *)&ie_setbuf->ie_buffer.ie_list[0].pktflag, &pktflag, sizeof(uint32));
+
+	/* Now, add the IE to the buffer */
+	ie_setbuf->ie_buffer.ie_list[0].ie_data.id = ie_id;
+
+	/* if already set with previous values, delete it first */
+	if (cfg->iw_ie_len != 0) {
+		WL_DBG(("Different IW_IE was already set. clear first\n"));
+
+		ie_setbuf->ie_buffer.ie_list[0].ie_data.len = 0;
+
+		err = wldev_iovar_setbuf_bsscfg(ndev, "ie", ie_setbuf, buf_len,
+			cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+		if (err != BCME_OK)
+			goto exit;
+	}
+
+	ie_setbuf->ie_buffer.ie_list[0].ie_data.len = data_len;
+	memcpy((uchar *)&ie_setbuf->ie_buffer.ie_list[0].ie_data.data[0], data, data_len);
+
+	err = wldev_iovar_setbuf_bsscfg(ndev, "ie", ie_setbuf, buf_len,
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+	if (err == BCME_OK) {
+		memcpy(cfg->iw_ie, data, data_len);
+		cfg->iw_ie_len = data_len;
+		cfg->wl11u = TRUE;
+
+		err = wldev_iovar_setint_bsscfg(ndev, "grat_arp", 1, bssidx);
+	}
+
+exit:
+	if (ie_setbuf)
+		kfree(ie_setbuf);
+	return err;
+}
+#endif /* WL11U */
+
+#ifdef WL_HOST_BAND_MGMT
+s32
+wl_cfg80211_set_band(struct net_device *ndev, int band)
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+	int ret = 0;
+	s32 roam_off;
+	char ioctl_buf[50];
+
+	if ((band < WLC_BAND_AUTO) || (band > WLC_BAND_2G)) {
+		WL_ERR(("Invalid band\n"));
+		return -EINVAL;
+	}
+
+	if ((ret = wldev_iovar_getint(ndev, "roam_off", &roam_off)) < 0) {
+		WL_ERR(("geting roam_off failed code=%d\n", ret));
+		return ret;
+	} else if (roam_off == 1) {
+		WL_DBG(("Roaming off, no need to set roam_band\n"));
+		cfg->curr_band = band;
+		return 0;
+	}
+
+	if ((ret = wldev_iovar_setbuf(ndev, "roam_band", &band,
+		sizeof(int), ioctl_buf, sizeof(ioctl_buf), NULL)) < 0) {
+		WL_ERR(("seting roam_band failed code=%d\n", ret));
+		return ret;
+	}
+
+	WL_DBG(("Setting band to %d\n", band));
+	cfg->curr_band = band;
+
+	return 0;
+}
+#endif /* WL_HOST_BAND_MGMT */
+
+#if defined(DHCP_SCAN_SUPPRESS)
+static void wl_cfg80211_scan_supp_timerfunc(ulong data)
+{
+	struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *)data;
+
+	WL_DBG(("Enter \n"));
+	schedule_work(&cfg->wlan_work);
+}
+
+int wl_cfg80211_scan_suppress(struct net_device *dev, int suppress)
+{
+	int ret = 0;
+	struct wireless_dev *wdev;
+	struct bcm_cfg80211 *cfg;
+	if (!dev || ((suppress != 0) && (suppress != 1))) {
+		ret = -EINVAL;
+		goto exit;
+	}
+	wdev = ndev_to_wdev(dev);
+	if (!wdev) {
+		ret = -EINVAL;
+		goto exit;
+	}
+	cfg = (struct bcm_cfg80211 *)wiphy_priv(wdev->wiphy);
+	if (!cfg) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
+	if (suppress == cfg->scan_suppressed) {
+		WL_DBG(("No change in scan_suppress state. Ignoring cmd..\n"));
+		return 0;
+	}
+
+	if (timer_pending(&cfg->scan_supp_timer))
+		del_timer_sync(&cfg->scan_supp_timer);
+
+	if ((ret = wldev_ioctl(dev, WLC_SET_SCANSUPPRESS,
+		&suppress, sizeof(int), true)) < 0) {
+		WL_ERR(("Scan suppress setting failed ret:%d \n", ret));
+	} else {
+		WL_DBG(("Scan suppress %s \n", suppress ? "Enabled" : "Disabled"));
+		cfg->scan_suppressed = suppress;
+	}
+
+	/* If scan_suppress is set, Start a timer to monitor it (just incase) */
+	if (cfg->scan_suppressed) {
+		if (ret) {
+			WL_ERR(("Retry scan_suppress reset at a later time \n"));
+			mod_timer(&cfg->scan_supp_timer,
+				jiffies + msecs_to_jiffies(WL_SCAN_SUPPRESS_RETRY));
+		} else {
+			WL_DBG(("Start wlan_timer to clear of scan_suppress \n"));
+			mod_timer(&cfg->scan_supp_timer,
+				jiffies + msecs_to_jiffies(WL_SCAN_SUPPRESS_TIMEOUT));
+		}
+	}
+exit:
+	return ret;
+}
+#endif /* DHCP_SCAN_SUPPRESS */
+
+int wl_cfg80211_scan_stop(bcm_struct_cfgdev *cfgdev)
+{
+	struct bcm_cfg80211 *cfg = NULL;
+	struct net_device *ndev = NULL;
+	unsigned long flags;
+	int clear_flag = 0;
+	int ret = 0;
+
+	WL_TRACE(("Enter\n"));
+
+	cfg = g_bcm_cfg;
+	if (!cfg)
+		return -EINVAL;
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	spin_lock_irqsave(&cfg->cfgdrv_lock, flags);
+#ifdef WL_CFG80211_P2P_DEV_IF
+	if (cfg->scan_request && cfg->scan_request->wdev == cfgdev)
+#else
+	if (cfg->scan_request && cfg->scan_request->dev == cfgdev)
+#endif
+	{
+		struct cfg80211_scan_info info = {
+			.aborted = true,
+		};
+		cfg80211_scan_done(cfg->scan_request, &info);
+		cfg->scan_request = NULL;
+		clear_flag = 1;
+	}
+	spin_unlock_irqrestore(&cfg->cfgdrv_lock, flags);
+
+	if (clear_flag)
+		wl_clr_drv_status(cfg, SCANNING, ndev);
+
+	return ret;
+}
+
+bool wl_cfg80211_is_vsdb_mode(void)
+{
+	return (g_bcm_cfg && g_bcm_cfg->vsdb_mode);
+}
+
+void* wl_cfg80211_get_dhdp()
+{
+	struct bcm_cfg80211 *cfg = g_bcm_cfg;
+
+	return cfg->pub;
+}
+
+bool wl_cfg80211_is_p2p_active(void)
+{
+	return (g_bcm_cfg && g_bcm_cfg->p2p);
+}
+
+static void wl_cfg80211_work_handler(struct work_struct * work)
+{
+	struct bcm_cfg80211 *cfg = NULL;
+	struct net_info *iter, *next;
+	s32 err = BCME_OK;
+	s32 pm = PM_FAST;
+	dhd_pub_t *dhd;
+
+	cfg = container_of(work, struct bcm_cfg80211, pm_enable_work.work);
+	WL_DBG(("Enter \n"));
+	if (cfg->pm_enable_work_on) {
+		cfg->pm_enable_work_on = false;
+		for_each_ndev(cfg, iter, next) {
+			if (!wl_get_drv_status(cfg, CONNECTED, iter->ndev) ||
+				(wl_get_mode_by_netdev(cfg, iter->ndev) != WL_MODE_BSS))
+				continue;
+			if (iter->ndev) {
+				dhd = (dhd_pub_t *)(cfg->pub);
+				if (pm != PM_OFF && dhd_conf_get_pm(dhd) >= 0)
+					pm = dhd_conf_get_pm(dhd);
+				if ((err = wldev_ioctl(iter->ndev, WLC_SET_PM,
+					&pm, sizeof(pm), true)) != 0) {
+					if (err == -ENODEV)
+						WL_DBG(("%s:netdev not ready\n", iter->ndev->name));
+					else
+						WL_ERR(("%s:error (%d)\n", iter->ndev->name, err));
+				} else
+					wl_cfg80211_update_power_mode(iter->ndev);
+			}
+		}
+	}
+#if defined(DHCP_SCAN_SUPPRESS)
+	else if (cfg->scan_suppressed) {
+		/* There is pending scan_suppress. Clean it */
+		WL_ERR(("Clean up from timer after %d msec\n", WL_SCAN_SUPPRESS_TIMEOUT));
+		wl_cfg80211_scan_suppress(bcmcfg_to_prmry_ndev(cfg), 0);
+	}
+#endif /* DHCP_SCAN_SUPPRESS */
+}
+
+u8
+wl_get_action_category(void *frame, u32 frame_len)
+{
+	u8 category;
+	u8 *ptr = (u8 *)frame;
+	if (frame == NULL)
+		return DOT11_ACTION_CAT_ERR_MASK;
+	if (frame_len < DOT11_ACTION_HDR_LEN)
+		return DOT11_ACTION_CAT_ERR_MASK;
+	category = ptr[DOT11_ACTION_CAT_OFF];
+	WL_INFORM(("Action Category: %d\n", category));
+	return category;
+}
+
+int
+wl_get_public_action(void *frame, u32 frame_len, u8 *ret_action)
+{
+	u8 *ptr = (u8 *)frame;
+	if (frame == NULL || ret_action == NULL)
+		return BCME_ERROR;
+	if (frame_len < DOT11_ACTION_HDR_LEN)
+		return BCME_ERROR;
+	if (DOT11_ACTION_CAT_PUBLIC != wl_get_action_category(frame, frame_len))
+		return BCME_ERROR;
+	*ret_action = ptr[DOT11_ACTION_ACT_OFF];
+	WL_INFORM(("Public Action : %d\n", *ret_action));
+	return BCME_OK;
+}
+
+#ifdef WLFBT
+void
+wl_cfg80211_get_fbt_key(uint8 *key)
+{
+	memcpy(key, g_bcm_cfg->fbt_key, FBT_KEYLEN);
+}
+#endif /* WLFBT */
+
+static int
+wl_cfg80211_delayed_roam(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	const struct ether_addr *bssid)
+{
+	s32 err;
+	wl_event_msg_t e;
+
+	bzero(&e, sizeof(e));
+	e.event_type = cpu_to_be32(WLC_E_BSSID);
+	memcpy(&e.addr, bssid, ETHER_ADDR_LEN);
+	/* trigger the roam event handler */
+	err = wl_notify_roaming_status(cfg, ndev_to_cfgdev(ndev), &e, NULL);
+
+	return err;
+}
+
+#ifdef WL_CFG80211_ACL
+static int
+wl_cfg80211_set_mac_acl(struct wiphy *wiphy, struct net_device *cfgdev,
+	const struct cfg80211_acl_data *acl)
+{
+	int i;
+	int ret = 0;
+	int macnum = 0;
+	int macmode = MACLIST_MODE_DISABLED;
+	struct maclist *list;
+
+	/* get the MAC filter mode */
+	if (acl && acl->acl_policy == NL80211_ACL_POLICY_DENY_UNLESS_LISTED) {
+		macmode = MACLIST_MODE_ALLOW;
+	} else if (acl && acl->acl_policy == NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
+	acl->n_acl_entries) {
+		macmode = MACLIST_MODE_DENY;
+	}
+
+	/* if acl == NULL, macmode is still disabled.. */
+	if (macmode == MACLIST_MODE_DISABLED) {
+		if ((ret = wl_android_set_ap_mac_list(cfgdev, macmode, NULL)) != 0)
+			WL_ERR(("%s : Setting MAC list failed error=%d\n", __FUNCTION__, ret));
+
+		return ret;
+	}
+
+	macnum = acl->n_acl_entries;
+	if (macnum < 0 || macnum > MAX_NUM_MAC_FILT) {
+		WL_ERR(("%s : invalid number of MAC address entries %d\n",
+			__FUNCTION__, macnum));
+		return -1;
+	}
+
+	/* allocate memory for the MAC list */
+	list = (struct maclist*)kmalloc(sizeof(int) +
+		sizeof(struct ether_addr) * macnum, GFP_KERNEL);
+	if (!list) {
+		WL_ERR(("%s : failed to allocate memory\n", __FUNCTION__));
+		return -1;
+	}
+
+	/* prepare the MAC list */
+	list->count = htod32(macnum);
+	for (i = 0; i < macnum; i++) {
+		memcpy(&list->ea[i], &acl->mac_addrs[i], ETHER_ADDR_LEN);
+	}
+	/* set the list */
+	if ((ret = wl_android_set_ap_mac_list(cfgdev, macmode, list)) != 0)
+		WL_ERR(("%s : Setting MAC list failed error=%d\n", __FUNCTION__, ret));
+
+	kfree(list);
+
+	return ret;
+}
+#endif /* WL_CFG80211_ACL */
+
+#ifdef WL_NAN
+int
+wl_cfg80211_nan_cmd_handler(struct net_device *ndev, char *cmd, int cmd_len)
+{
+	return wl_cfgnan_cmd_handler(ndev, g_bcm_cfg, cmd, cmd_len);
+}
+#endif /* WL_NAN */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_cfg80211.h b/drivers/net/wireless/bcm4336/wl_cfg80211.h
--- a/drivers/net/wireless/bcm4336/wl_cfg80211.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_cfg80211.h	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,1076 @@
+/*
+ * Linux cfg80211 driver
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfg80211.h 505096 2014-09-26 12:49:04Z $
+ */
+
+/**
+ * Older Linux versions support the 'iw' interface, more recent ones the 'cfg80211' interface.
+ */
+
+#ifndef _wl_cfg80211_h_
+#define _wl_cfg80211_h_
+
+#include <linux/wireless.h>
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+#include <linux/rfkill.h>
+
+#include <wl_cfgp2p.h>
+
+struct wl_conf;
+struct wl_iface;
+struct bcm_cfg80211;
+struct wl_security;
+struct wl_ibss;
+
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define WL_DBG_NONE	0
+#define WL_DBG_P2P_ACTION (1 << 5)
+#define WL_DBG_TRACE	(1 << 4)
+#define WL_DBG_SCAN 	(1 << 3)
+#define WL_DBG_DBG 	(1 << 2)
+#define WL_DBG_INFO	(1 << 1)
+#define WL_DBG_ERR	(1 << 0)
+
+/* 0 invalidates all debug messages.  default is 1 */
+#define WL_DBG_LEVEL 0xFF
+
+#define CFG80211_ERROR_TEXT		"CFG80211-ERROR) "
+
+#define MAX_WAIT_TIME 1500
+#define DNGL_FUNC(func, parameters) func parameters;
+
+#define PM_BLOCK 1
+#define PM_ENABLE 0
+
+#if defined(DHD_DEBUG)
+#define	WL_ERR(args)									\
+do {										\
+	if (wl_dbg_level & WL_DBG_ERR) {				\
+			printk(KERN_INFO CFG80211_ERROR_TEXT "%s : ", __func__);	\
+			printk args;						\
+		}								\
+} while (0)
+#else /* defined(DHD_DEBUG) */
+#define	WL_ERR(args)									\
+do {										\
+	if ((wl_dbg_level & WL_DBG_ERR) && net_ratelimit()) {				\
+			printk(KERN_INFO CFG80211_ERROR_TEXT "%s : ", __func__);	\
+			printk args;						\
+		}								\
+} while (0)
+#endif /* defined(DHD_DEBUG) */
+
+#ifdef WL_INFORM
+#undef WL_INFORM
+#endif
+
+#define	WL_INFORM(args)									\
+do {										\
+	if (wl_dbg_level & WL_DBG_INFO) {				\
+			printk(KERN_INFO "CFG80211-INFO) %s : ", __func__);	\
+			printk args;						\
+		}								\
+} while (0)
+
+
+#ifdef WL_SCAN
+#undef WL_SCAN
+#endif
+#define	WL_SCAN(args)								\
+do {									\
+	if (wl_dbg_level & WL_DBG_SCAN) {			\
+		printk(KERN_INFO "CFG80211-SCAN) %s :", __func__);	\
+		printk args;							\
+	}									\
+} while (0)
+#ifdef WL_TRACE
+#undef WL_TRACE
+#endif
+#define	WL_TRACE(args)								\
+do {									\
+	if (wl_dbg_level & WL_DBG_TRACE) {			\
+		printk(KERN_INFO "CFG80211-TRACE) %s :", __func__);	\
+		printk args;							\
+	}									\
+} while (0)
+#ifdef WL_TRACE_HW4
+#undef WL_TRACE_HW4
+#endif
+#define	WL_TRACE_HW4			WL_TRACE
+#if (WL_DBG_LEVEL > 0)
+#define	WL_DBG(args)								\
+do {									\
+	if (wl_dbg_level & WL_DBG_DBG) {			\
+		printk(KERN_INFO "CFG80211-DEBUG) %s :", __func__);	\
+		printk args;							\
+	}									\
+} while (0)
+#else				/* !(WL_DBG_LEVEL > 0) */
+#define	WL_DBG(args)
+#endif				/* (WL_DBG_LEVEL > 0) */
+#define WL_PNO(x)
+#define WL_SD(x)
+
+
+#define WL_SCAN_RETRY_MAX	3
+#define WL_NUM_PMKIDS_MAX	MAXPMKID
+#define WL_SCAN_BUF_MAX 	(1024 * 8)
+#define WL_TLV_INFO_MAX 	1500
+#define WL_SCAN_IE_LEN_MAX      2048
+#define WL_BSS_INFO_MAX		2048
+#define WL_ASSOC_INFO_MAX	512
+#define WL_IOCTL_LEN_MAX	2048
+#define WL_EXTRA_BUF_MAX	2048
+#define WL_SCAN_ERSULTS_LAST 	(WL_SCAN_RESULTS_NO_MEM+1)
+#define WL_AP_MAX		256
+#define WL_FILE_NAME_MAX	256
+#define WL_DWELL_TIME 		200
+#define WL_MED_DWELL_TIME       400
+#define WL_MIN_DWELL_TIME	100
+#define WL_LONG_DWELL_TIME 	1000
+#define IFACE_MAX_CNT 		2
+#define WL_SCAN_CONNECT_DWELL_TIME_MS 		200
+#define WL_SCAN_JOIN_PROBE_INTERVAL_MS 		20
+#define WL_SCAN_JOIN_ACTIVE_DWELL_TIME_MS 	320
+#define WL_SCAN_JOIN_PASSIVE_DWELL_TIME_MS 	400
+#define WL_AF_TX_MAX_RETRY 	5
+
+#define WL_AF_SEARCH_TIME_MAX           450
+#define WL_AF_TX_EXTRA_TIME_MAX         200
+
+#define WL_SCAN_TIMER_INTERVAL_MS	10000 /* Scan timeout */
+#define WL_CHANNEL_SYNC_RETRY 	5
+#define WL_INVALID 		-1
+
+/* Bring down SCB Timeout to 20secs from 60secs default */
+#ifndef WL_SCB_TIMEOUT
+#define WL_SCB_TIMEOUT 20
+#endif
+
+/* SCAN_SUPPRESS timer values in ms */
+#define WL_SCAN_SUPPRESS_TIMEOUT 31000 /* default Framwork DHCP timeout is 30 sec */
+#define WL_SCAN_SUPPRESS_RETRY 3000
+
+#define WL_PM_ENABLE_TIMEOUT 10000
+
+#ifdef WLAIBSS
+/* Custom AIBSS beacon parameters */
+#define AIBSS_INITIAL_MIN_BCN_DUR	500
+#define AIBSS_MIN_BCN_DUR		5000
+#define AIBSS_BCN_FLOOD_DUR		5000
+#endif /* WLAIBSS */
+
+/* driver status */
+enum wl_status {
+	WL_STATUS_READY = 0,
+	WL_STATUS_SCANNING,
+	WL_STATUS_SCAN_ABORTING,
+	WL_STATUS_CONNECTING,
+	WL_STATUS_CONNECTED,
+	WL_STATUS_DISCONNECTING,
+	WL_STATUS_AP_CREATING,
+	WL_STATUS_AP_CREATED,
+	/* whole sending action frame procedure:
+	 * includes a) 'finding common channel' for public action request frame
+	 * and b) 'sending af via 'actframe' iovar'
+	 */
+	WL_STATUS_SENDING_ACT_FRM,
+	/* find a peer to go to a common channel before sending public action req frame */
+	WL_STATUS_FINDING_COMMON_CHANNEL,
+	/* waiting for next af to sync time of supplicant.
+	 * it includes SENDING_ACT_FRM and WAITING_NEXT_ACT_FRM_LISTEN
+	 */
+	WL_STATUS_WAITING_NEXT_ACT_FRM,
+#ifdef WL_CFG80211_SYNC_GON
+	/* go to listen state to wait for next af after SENDING_ACT_FRM */
+	WL_STATUS_WAITING_NEXT_ACT_FRM_LISTEN,
+#endif /* WL_CFG80211_SYNC_GON */
+	/* it will be set when upper layer requests listen and succeed in setting listen mode.
+	 * if set, other scan request can abort current listen state
+	 */
+	WL_STATUS_REMAINING_ON_CHANNEL,
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	/* it's fake listen state to keep current scan state.
+	 * it will be set when upper layer requests listen but scan is running. then just run
+	 * a expire timer without actual listen state.
+	 * if set, other scan request does not need to abort scan.
+	 */
+	WL_STATUS_FAKE_REMAINING_ON_CHANNEL
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+};
+
+/* wi-fi mode */
+enum wl_mode {
+	WL_MODE_BSS,
+	WL_MODE_IBSS,
+	WL_MODE_AP
+};
+
+/* driver profile list */
+enum wl_prof_list {
+	WL_PROF_MODE,
+	WL_PROF_SSID,
+	WL_PROF_SEC,
+	WL_PROF_IBSS,
+	WL_PROF_BAND,
+	WL_PROF_CHAN,
+	WL_PROF_BSSID,
+	WL_PROF_ACT,
+	WL_PROF_BEACONINT,
+	WL_PROF_DTIMPERIOD
+};
+
+/* donlge escan state */
+enum wl_escan_state {
+    WL_ESCAN_STATE_IDLE,
+    WL_ESCAN_STATE_SCANING
+};
+/* fw downloading status */
+enum wl_fw_status {
+	WL_FW_LOADING_DONE,
+	WL_NVRAM_LOADING_DONE
+};
+
+enum wl_management_type {
+	WL_BEACON = 0x1,
+	WL_PROBE_RESP = 0x2,
+	WL_ASSOC_RESP = 0x4
+};
+
+enum wl_handler_del_type {
+	WL_HANDLER_NOTUSE,
+	WL_HANDLER_DEL,
+	WL_HANDLER_MAINTAIN,
+	WL_HANDLER_PEND
+};
+
+/* beacon / probe_response */
+struct beacon_proberesp {
+	__le64 timestamp;
+	__le16 beacon_int;
+	__le16 capab_info;
+	u8 variable[0];
+} __attribute__ ((packed));
+
+/* driver configuration */
+struct wl_conf {
+	u32 frag_threshold;
+	u32 rts_threshold;
+	u32 retry_short;
+	u32 retry_long;
+	s32 tx_power;
+	struct ieee80211_channel channel;
+};
+
+typedef s32(*EVENT_HANDLER) (struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+                            const wl_event_msg_t *e, void *data);
+
+/* bss inform structure for cfg80211 interface */
+struct wl_cfg80211_bss_info {
+	u16 band;
+	u16 channel;
+	s16 rssi;
+	u16 frame_len;
+	u8 frame_buf[1];
+};
+
+/* basic structure of scan request */
+struct wl_scan_req {
+	struct wlc_ssid ssid;
+};
+
+/* basic structure of information element */
+struct wl_ie {
+	u16 offset;
+	u8 buf[WL_TLV_INFO_MAX];
+};
+
+/* event queue for cfg80211 main event */
+struct wl_event_q {
+	struct list_head eq_list;
+	u32 etype;
+	wl_event_msg_t emsg;
+	s8 edata[1];
+};
+
+/* security information with currently associated ap */
+struct wl_security {
+	u32 wpa_versions;
+	u32 auth_type;
+	u32 cipher_pairwise;
+	u32 cipher_group;
+	u32 wpa_auth;
+	u32 auth_assoc_res_status;
+};
+
+/* ibss information for currently joined ibss network */
+struct wl_ibss {
+	u8 beacon_interval;	/* in millisecond */
+	u8 atim;		/* in millisecond */
+	s8 join_only;
+	u8 band;
+	u8 channel;
+};
+
+/* cfg driver profile */
+struct wl_profile {
+	u32 mode;
+	s32 band;
+	u32 channel;
+	struct wlc_ssid ssid;
+	struct wl_security sec;
+	struct wl_ibss ibss;
+	u8 bssid[ETHER_ADDR_LEN];
+	u16 beacon_interval;
+	u8 dtim_period;
+	bool active;
+};
+
+struct net_info {
+	struct net_device *ndev;
+	struct wireless_dev *wdev;
+	struct wl_profile profile;
+	s32 mode;
+	s32 roam_off;
+	unsigned long sme_state;
+	bool pm_restore;
+	bool pm_block;
+	s32 pm;
+	struct list_head list; /* list of all net_info structure */
+};
+
+/* association inform */
+#define MAX_REQ_LINE 1024
+struct wl_connect_info {
+	u8 req_ie[MAX_REQ_LINE];
+	s32 req_ie_len;
+	u8 resp_ie[MAX_REQ_LINE];
+	s32 resp_ie_len;
+};
+
+/* firmware /nvram downloading controller */
+struct wl_fw_ctrl {
+	const struct firmware *fw_entry;
+	unsigned long status;
+	u32 ptr;
+	s8 fw_name[WL_FILE_NAME_MAX];
+	s8 nvram_name[WL_FILE_NAME_MAX];
+};
+
+/* assoc ie length */
+struct wl_assoc_ielen {
+	u32 req_len;
+	u32 resp_len;
+};
+
+/* wpa2 pmk list */
+struct wl_pmk_list {
+	pmkid_list_t pmkids;
+	pmkid_t foo[MAXPMKID - 1];
+};
+
+
+#define ESCAN_BUF_SIZE (64 * 1024)
+
+struct escan_info {
+	u32 escan_state;
+#if defined(STATIC_WL_PRIV_STRUCT)
+#ifndef CONFIG_DHD_USE_STATIC_BUF
+#error STATIC_WL_PRIV_STRUCT should be used with CONFIG_DHD_USE_STATIC_BUF
+#endif /* CONFIG_DHD_USE_STATIC_BUF */
+	u8 *escan_buf;
+#else
+	u8 escan_buf[ESCAN_BUF_SIZE];
+#endif /* STATIC_WL_PRIV_STRUCT */
+	struct wiphy *wiphy;
+	struct net_device *ndev;
+};
+
+#ifdef ESCAN_BUF_OVERFLOW_MGMT
+#define BUF_OVERFLOW_MGMT_COUNT 3
+typedef struct {
+	int RSSI;
+	int length;
+	struct ether_addr BSSID;
+} removal_element_t;
+#endif /* ESCAN_BUF_OVERFLOW_MGMT */
+
+struct ap_info {
+/* Structure to hold WPS, WPA IEs for a AP */
+	u8   probe_res_ie[VNDR_IES_MAX_BUF_LEN];
+	u8   beacon_ie[VNDR_IES_MAX_BUF_LEN];
+	u8   assoc_res_ie[VNDR_IES_MAX_BUF_LEN];
+	u32 probe_res_ie_len;
+	u32 beacon_ie_len;
+	u32 assoc_res_ie_len;
+	u8 *wpa_ie;
+	u8 *rsn_ie;
+	u8 *wps_ie;
+	bool security_mode;
+};
+
+struct sta_info {
+	/* Structure to hold WPS IE for a STA */
+	u8  probe_req_ie[VNDR_IES_BUF_LEN];
+	u8  assoc_req_ie[VNDR_IES_BUF_LEN];
+	u32 probe_req_ie_len;
+	u32 assoc_req_ie_len;
+};
+
+struct afx_hdl {
+	wl_af_params_t *pending_tx_act_frm;
+	struct ether_addr	tx_dst_addr;
+	struct net_device *dev;
+	struct work_struct work;
+	u32 bssidx;
+	u32 retry;
+	s32 peer_chan;
+	s32 peer_listen_chan; /* search channel: configured by upper layer */
+	s32 my_listen_chan;	/* listen chanel: extract it from prb req or gon req */
+	bool is_listen;
+	bool ack_recv;
+	bool is_active;
+};
+
+struct parsed_ies {
+	wpa_ie_fixed_t *wps_ie;
+	u32 wps_ie_len;
+	wpa_ie_fixed_t *wpa_ie;
+	u32 wpa_ie_len;
+	bcm_tlv_t *wpa2_ie;
+	u32 wpa2_ie_len;
+};
+
+#ifdef WL_SDO
+/* Service discovery */
+typedef struct {
+	uint8	transaction_id; /* Transaction ID */
+	uint8   protocol;       /* Service protocol type */
+	uint16  query_len;      /* Length of query */
+	uint16  response_len;   /* Length of response */
+	uint8   qrbuf[1];
+} wl_sd_qr_t;
+
+typedef struct {
+	uint16	period;                 /* extended listen period */
+	uint16	interval;               /* extended listen interval */
+} wl_sd_listen_t;
+
+#define WL_SD_STATE_IDLE 0x0000
+#define WL_SD_SEARCH_SVC 0x0001
+#define WL_SD_ADV_SVC    0x0002
+
+enum wl_dd_state {
+    WL_DD_STATE_IDLE,
+    WL_DD_STATE_SEARCH,
+    WL_DD_STATE_LISTEN
+};
+
+#define MAX_SDO_PROTO_STR_LEN 20
+typedef struct wl_sdo_proto {
+	char str[MAX_SDO_PROTO_STR_LEN];
+	u32 val;
+} wl_sdo_proto_t;
+
+typedef struct sd_offload {
+	u32 sd_state;
+	enum wl_dd_state dd_state;
+	wl_sd_listen_t sd_listen;
+} sd_offload_t;
+
+typedef struct sdo_event {
+	u8 addr[ETH_ALEN];
+	uint16	freq;        /* channel Freq */
+	uint8	count;       /* Tlv count  */
+	uint16	update_ind;
+} sdo_event_t;
+#endif /* WL_SDO */
+
+#ifdef WL11U
+/* Max length of Interworking element */
+#define IW_IES_MAX_BUF_LEN 		9
+#endif
+#ifdef WLFBT
+#define FBT_KEYLEN		32
+#endif
+#define MAX_EVENT_BUF_NUM 16
+typedef struct wl_eventmsg_buf {
+    u16 num;
+    struct {
+		u16 type;
+		bool set;
+	} event [MAX_EVENT_BUF_NUM];
+} wl_eventmsg_buf_t;
+
+typedef struct wl_if_event_info {
+	bool valid;
+	int ifidx;
+	int bssidx;
+	uint8 mac[ETHER_ADDR_LEN];
+	char name[IFNAMSIZ+1];
+} wl_if_event_info;
+
+/* private data of cfg80211 interface */
+struct bcm_cfg80211 {
+	struct wireless_dev *wdev;	/* representing cfg cfg80211 device */
+
+	struct wireless_dev *p2p_wdev;	/* representing cfg cfg80211 device for P2P */
+	struct net_device *p2p_net;    /* reference to p2p0 interface */
+
+	struct wl_conf *conf;
+	struct cfg80211_scan_request *scan_request;	/* scan request object */
+	EVENT_HANDLER evt_handler[WLC_E_LAST];
+	struct list_head eq_list;	/* used for event queue */
+	struct list_head net_list;     /* used for struct net_info */
+	spinlock_t eq_lock;	/* for event queue synchronization */
+	spinlock_t cfgdrv_lock;	/* to protect scan status (and others if needed) */
+	struct completion act_frm_scan;
+	struct completion iface_disable;
+	struct completion wait_next_af;
+	struct mutex usr_sync;	/* maily for up/down synchronization */
+	struct wl_scan_results *bss_list;
+	struct wl_scan_results *scan_results;
+
+	/* scan request object for internal purpose */
+	struct wl_scan_req *scan_req_int;
+	/* information element object for internal purpose */
+#if defined(STATIC_WL_PRIV_STRUCT)
+	struct wl_ie *ie;
+#else
+	struct wl_ie ie;
+#endif
+
+	/* association information container */
+#if defined(STATIC_WL_PRIV_STRUCT)
+	struct wl_connect_info *conn_info;
+#else
+	struct wl_connect_info conn_info;
+#endif
+#ifdef DEBUGFS_CFG80211
+	struct dentry		*debugfs;
+#endif /* DEBUGFS_CFG80211 */
+	struct wl_pmk_list *pmk_list;	/* wpa2 pmk list */
+	tsk_ctl_t event_tsk;  		/* task of main event handler thread */
+	void *pub;
+	u32 iface_cnt;
+	u32 channel;		/* current channel */
+	u32 af_sent_channel;	/* channel action frame is sent */
+	/* next af subtype to cancel the remained dwell time in rx process */
+	u8 next_af_subtype;
+#ifdef WL_CFG80211_SYNC_GON
+	ulong af_tx_sent_jiffies;
+#endif /* WL_CFG80211_SYNC_GON */
+	struct escan_info escan_info;   /* escan information */
+	bool active_scan;	/* current scan mode */
+	bool ibss_starter;	/* indicates this sta is ibss starter */
+	bool link_up;		/* link/connection up flag */
+
+	/* indicate whether chip to support power save mode */
+	bool pwr_save;
+	bool roam_on;		/* on/off switch for self-roaming */
+	bool scan_tried;	/* indicates if first scan attempted */
+#if defined(BCMSDIO) || defined(BCMPCIE)
+	bool wlfc_on;
+#endif
+	bool vsdb_mode;
+	bool roamoff_on_concurrent;
+	u8 *ioctl_buf;		/* ioctl buffer */
+	struct mutex ioctl_buf_sync;
+	u8 *escan_ioctl_buf;
+	u8 *extra_buf;	/* maily to grab assoc information */
+	struct dentry *debugfsdir;
+	struct rfkill *rfkill;
+	bool rf_blocked;
+	struct ieee80211_channel remain_on_chan;
+	enum nl80211_channel_type remain_on_chan_type;
+	u64 send_action_id;
+	u64 last_roc_id;
+	wait_queue_head_t netif_change_event;
+	wl_if_event_info if_event_info;
+	struct completion send_af_done;
+	struct afx_hdl *afx_hdl;
+	struct ap_info *ap_info;
+	struct sta_info *sta_info;
+	struct p2p_info *p2p;
+	bool p2p_supported;
+	void *btcoex_info;
+	struct timer_list scan_timeout;   /* Timer for catch scan event timeout */
+	s32(*state_notifier) (struct bcm_cfg80211 *cfg,
+		struct net_info *_net_info, enum wl_status state, bool set);
+	unsigned long interrested_state;
+	wlc_ssid_t hostapd_ssid;
+#ifdef WL_SDO
+	sd_offload_t *sdo;
+#endif
+#ifdef WL11U
+	bool wl11u;
+	u8 iw_ie[IW_IES_MAX_BUF_LEN];
+	u32 iw_ie_len;
+#endif /* WL11U */
+	bool sched_scan_running;	/* scheduled scan req status */
+#ifdef WL_SCHED_SCAN
+	struct cfg80211_sched_scan_request *sched_scan_req;	/* scheduled scan req */
+#endif /* WL_SCHED_SCAN */
+#ifdef WL_HOST_BAND_MGMT
+	u8 curr_band;
+#endif /* WL_HOST_BAND_MGMT */
+	bool scan_suppressed;
+	struct timer_list scan_supp_timer;
+	struct work_struct wlan_work;
+	struct mutex event_sync;	/* maily for up/down synchronization */
+	bool disable_roam_event;
+	bool pm_enable_work_on;
+	struct delayed_work pm_enable_work;
+	vndr_ie_setbuf_t *ibss_vsie;	/* keep the VSIE for IBSS */
+	int ibss_vsie_len;
+#ifdef WLAIBSS
+	u32 aibss_txfail_pid;
+	u32 aibss_txfail_seq;
+#endif /* WLAIBSS */
+	u32 rmc_event_pid;
+	u32 rmc_event_seq;
+#ifdef WLAIBSS_MCHAN
+	struct ether_addr ibss_if_addr;
+	bcm_struct_cfgdev *ibss_cfgdev; /* For AIBSS */
+#endif /* WLAIBSS_MCHAN */
+	bcm_struct_cfgdev *bss_cfgdev;  /* For DUAL STA/STA+AP */
+	s32 cfgdev_bssidx;
+	bool bss_pending_op;		/* indicate where there is a pending IF operation */
+#ifdef WLFBT
+	uint8 fbt_key[FBT_KEYLEN];
+#endif
+	int roam_offload;
+	bool nan_running;
+#ifdef P2PLISTEN_AP_SAMECHN
+	bool p2p_resp_apchn_status;
+#endif /* P2PLISTEN_AP_SAMECHN */
+#ifdef WLTDLS
+	u8 *tdls_mgmt_frame;
+	u32 tdls_mgmt_frame_len;
+	s32 tdls_mgmt_freq;
+#endif /* WLTDLS */
+};
+
+
+static inline struct wl_bss_info *next_bss(struct wl_scan_results *list, struct wl_bss_info *bss)
+{
+	return bss = bss ?
+		(struct wl_bss_info *)((uintptr) bss + dtoh32(bss->length)) : list->bss_info;
+}
+static inline s32
+wl_alloc_netinfo(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	struct wireless_dev * wdev, s32 mode, bool pm_block)
+{
+	struct net_info *_net_info;
+	s32 err = 0;
+	if (cfg->iface_cnt == IFACE_MAX_CNT)
+		return -ENOMEM;
+	_net_info = kzalloc(sizeof(struct net_info), GFP_KERNEL);
+	if (!_net_info)
+		err = -ENOMEM;
+	else {
+		_net_info->mode = mode;
+		_net_info->ndev = ndev;
+		_net_info->wdev = wdev;
+		_net_info->pm_restore = 0;
+		_net_info->pm = 0;
+		_net_info->pm_block = pm_block;
+		_net_info->roam_off = WL_INVALID;
+		cfg->iface_cnt++;
+		list_add(&_net_info->list, &cfg->net_list);
+	}
+	return err;
+}
+static inline void
+wl_dealloc_netinfo(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+		if (ndev && (_net_info->ndev == ndev)) {
+			list_del(&_net_info->list);
+			cfg->iface_cnt--;
+			kfree(_net_info);
+		}
+	}
+
+}
+static inline void
+wl_delete_all_netinfo(struct bcm_cfg80211 *cfg)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+		list_del(&_net_info->list);
+			if (_net_info->wdev)
+				kfree(_net_info->wdev);
+			kfree(_net_info);
+	}
+	cfg->iface_cnt = 0;
+}
+static inline u32
+wl_get_status_all(struct bcm_cfg80211 *cfg, s32 status)
+
+{
+	struct net_info *_net_info, *next;
+	u32 cnt = 0;
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+		if (_net_info->ndev &&
+			test_bit(status, &_net_info->sme_state))
+			cnt++;
+	}
+	return cnt;
+}
+static inline void
+wl_set_status_all(struct bcm_cfg80211 *cfg, s32 status, u32 op)
+{
+	struct net_info *_net_info, *next;
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+		switch (op) {
+			case 1:
+				return; /* set all status is not allowed */
+			case 2:
+				clear_bit(status, &_net_info->sme_state);
+				if (cfg->state_notifier &&
+					test_bit(status, &(cfg->interrested_state)))
+					cfg->state_notifier(cfg, _net_info, status, false);
+				break;
+			case 4:
+				return; /* change all status is not allowed */
+			default:
+				return; /* unknown operation */
+		}
+	}
+}
+static inline void
+wl_set_status_by_netdev(struct bcm_cfg80211 *cfg, s32 status,
+	struct net_device *ndev, u32 op)
+{
+
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+		if (ndev && (_net_info->ndev == ndev)) {
+			switch (op) {
+				case 1:
+					set_bit(status, &_net_info->sme_state);
+					if (cfg->state_notifier &&
+						test_bit(status, &(cfg->interrested_state)))
+						cfg->state_notifier(cfg, _net_info, status, true);
+					break;
+				case 2:
+					clear_bit(status, &_net_info->sme_state);
+					if (cfg->state_notifier &&
+						test_bit(status, &(cfg->interrested_state)))
+						cfg->state_notifier(cfg, _net_info, status, false);
+					break;
+				case 4:
+					change_bit(status, &_net_info->sme_state);
+					break;
+			}
+		}
+
+	}
+
+}
+
+static inline u32
+wl_get_status_by_netdev(struct bcm_cfg80211 *cfg, s32 status,
+	struct net_device *ndev)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+				if (ndev && (_net_info->ndev == ndev))
+					return test_bit(status, &_net_info->sme_state);
+	}
+	return 0;
+}
+
+static inline s32
+wl_get_mode_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+				if (ndev && (_net_info->ndev == ndev))
+					return _net_info->mode;
+	}
+	return -1;
+}
+
+
+static inline void
+wl_set_mode_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	s32 mode)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+				if (ndev && (_net_info->ndev == ndev))
+					_net_info->mode = mode;
+	}
+}
+static inline struct wl_profile *
+wl_get_profile_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+				if (ndev && (_net_info->ndev == ndev))
+					return &_net_info->profile;
+	}
+	return NULL;
+}
+static inline struct net_info *
+wl_get_netinfo_by_netdev(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	struct net_info *_net_info, *next;
+
+	list_for_each_entry_safe(_net_info, next, &cfg->net_list, list) {
+				if (ndev && (_net_info->ndev == ndev))
+					return _net_info;
+	}
+	return NULL;
+}
+#define bcmcfg_to_wiphy(cfg) (cfg->wdev->wiphy)
+#define bcmcfg_to_prmry_ndev(cfg) (cfg->wdev->netdev)
+#define bcmcfg_to_prmry_wdev(cfg) (cfg->wdev)
+#define bcmcfg_to_p2p_wdev(cfg) (cfg->p2p_wdev)
+#define ndev_to_wl(n) (wdev_to_wl(n->ieee80211_ptr))
+#define ndev_to_wdev(ndev) (ndev->ieee80211_ptr)
+#define wdev_to_ndev(wdev) (wdev->netdev)
+
+#if defined(WL_ENABLE_P2P_IF)
+#define ndev_to_wlc_ndev(ndev, cfg)	((ndev == cfg->p2p_net) ? \
+	bcmcfg_to_prmry_ndev(cfg) : ndev)
+#else
+#define ndev_to_wlc_ndev(ndev, cfg)	(ndev)
+#endif /* WL_ENABLE_P2P_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define wdev_to_wlc_ndev(wdev, cfg)	\
+	((wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) ? \
+	bcmcfg_to_prmry_ndev(cfg) : wdev_to_ndev(wdev))
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)	wdev_to_wlc_ndev(cfgdev, cfg)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) bcmcfg_to_prmry_wdev(cfg)
+#elif defined(WL_ENABLE_P2P_IF)
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)	ndev_to_wlc_ndev(cfgdev, cfg)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) bcmcfg_to_prmry_ndev(cfg)
+#else
+#define cfgdev_to_wlc_ndev(cfgdev, cfg)	(cfgdev)
+#define bcmcfg_to_prmry_cfgdev(cfgdev, cfg) (cfgdev)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define ndev_to_cfgdev(ndev)	ndev_to_wdev(ndev)
+#define cfgdev_to_ndev(cfgdev)  cfgdev ? (cfgdev->netdev) : NULL
+#define discover_cfgdev(cfgdev, cfg) (cfgdev->iftype == NL80211_IFTYPE_P2P_DEVICE)
+#else
+#define ndev_to_cfgdev(ndev)	(ndev)
+#define cfgdev_to_ndev(cfgdev)	(cfgdev)
+#define discover_cfgdev(cfgdev, cfg) (cfgdev == cfg->p2p_net)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define scan_req_match(cfg)	(((cfg) && (cfg->scan_request) && \
+	(cfg->scan_request->wdev == cfg->p2p_wdev)) ? true : false)
+#elif defined(WL_ENABLE_P2P_IF)
+#define scan_req_match(cfg)	(((cfg) && (cfg->scan_request) && \
+	(cfg->scan_request->dev == cfg->p2p_net)) ? true : false)
+#else
+#define scan_req_match(cfg)	(((cfg) && p2p_is_on(cfg) && p2p_scan(cfg)) ? \
+	true : false)
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#define wl_to_sr(w) (w->scan_req_int)
+#if defined(STATIC_WL_PRIV_STRUCT)
+#define wl_to_ie(w) (w->ie)
+#define wl_to_conn(w) (w->conn_info)
+#else
+#define wl_to_ie(w) (&w->ie)
+#define wl_to_conn(w) (&w->conn_info)
+#endif
+#define wiphy_from_scan(w) (w->escan_info.wiphy)
+#define wl_get_drv_status_all(cfg, stat) \
+	(wl_get_status_all(cfg, WL_STATUS_ ## stat))
+#define wl_get_drv_status(cfg, stat, ndev)  \
+	(wl_get_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev))
+#define wl_set_drv_status(cfg, stat, ndev)  \
+	(wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 1))
+#define wl_clr_drv_status(cfg, stat, ndev)  \
+	(wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 2))
+#define wl_clr_drv_status_all(cfg, stat)  \
+	(wl_set_status_all(cfg, WL_STATUS_ ## stat, 2))
+#define wl_chg_drv_status(cfg, stat, ndev)  \
+	(wl_set_status_by_netdev(cfg, WL_STATUS_ ## stat, ndev, 4))
+
+#define for_each_bss(list, bss, __i)	\
+	for (__i = 0; __i < list->count && __i < WL_AP_MAX; __i++, bss = next_bss(list, bss))
+
+#define for_each_ndev(cfg, iter, next) \
+	list_for_each_entry_safe(iter, next, &cfg->net_list, list)
+
+
+/* In case of WPS from wpa_supplicant, pairwise siute and group suite is 0.
+ * In addtion to that, wpa_version is WPA_VERSION_1
+ */
+#define is_wps_conn(_sme) \
+	((wl_cfgp2p_find_wpsie((u8 *)_sme->ie, _sme->ie_len) != NULL) && \
+	 (!_sme->crypto.n_ciphers_pairwise) && \
+	 (!_sme->crypto.cipher_group))
+extern s32 wl_cfg80211_attach(struct net_device *ndev, void *context);
+extern s32 wl_cfg80211_attach_post(struct net_device *ndev);
+extern void wl_cfg80211_detach(void *para);
+
+extern void wl_cfg80211_event(struct net_device *ndev, const wl_event_msg_t *e,
+            void *data);
+void wl_cfg80211_set_parent_dev(void *dev);
+struct device *wl_cfg80211_get_parent_dev(void);
+
+extern s32 wl_cfg80211_up(void *para);
+extern s32 wl_cfg80211_down(void *para);
+extern s32 wl_cfg80211_notify_ifadd(int ifidx, char *name, uint8 *mac, uint8 bssidx);
+extern s32 wl_cfg80211_notify_ifdel(int ifidx, char *name, uint8 *mac, uint8 bssidx);
+extern s32 wl_cfg80211_notify_ifchange(int ifidx, char *name, uint8 *mac, uint8 bssidx);
+extern struct net_device* wl_cfg80211_allocate_if(struct bcm_cfg80211 *cfg, int ifidx, char *name,
+	uint8 *mac, uint8 bssidx);
+extern int wl_cfg80211_register_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev);
+extern int wl_cfg80211_remove_if(struct bcm_cfg80211 *cfg, int ifidx, struct net_device* ndev);
+extern int wl_cfg80211_scan_stop(bcm_struct_cfgdev *cfgdev);
+extern bool wl_cfg80211_is_vsdb_mode(void);
+extern void* wl_cfg80211_get_dhdp(void);
+extern bool wl_cfg80211_is_p2p_active(void);
+extern void wl_cfg80211_dbg_level(u32 level);
+extern s32 wl_cfg80211_get_p2p_dev_addr(struct net_device *net, struct ether_addr *p2pdev_addr);
+extern s32 wl_cfg80211_set_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_get_p2p_noa(struct net_device *net, char* buf, int len);
+extern s32 wl_cfg80211_set_wps_p2p_ie(struct net_device *net, char *buf, int len,
+	enum wl_management_type type);
+extern s32 wl_cfg80211_set_p2p_ps(struct net_device *net, char* buf, int len);
+#ifdef P2PLISTEN_AP_SAMECHN
+extern s32 wl_cfg80211_set_p2p_resp_ap_chn(struct net_device *net, s32 enable);
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+/* btcoex functions */
+void* wl_cfg80211_btcoex_init(struct net_device *ndev);
+void wl_cfg80211_btcoex_deinit(void);
+
+#ifdef WL_SDO
+extern s32 wl_cfg80211_sdo_init(struct bcm_cfg80211 *cfg);
+extern s32 wl_cfg80211_sdo_deinit(struct bcm_cfg80211 *cfg);
+extern s32 wl_cfg80211_sd_offload(struct net_device *net, char *cmd, char* buf, int len);
+extern s32 wl_cfg80211_pause_sdo(struct net_device *dev, struct bcm_cfg80211 *cfg);
+extern s32 wl_cfg80211_resume_sdo(struct net_device *dev, struct bcm_cfg80211 *cfg);
+
+#endif
+
+#ifdef WL_SUPPORT_AUTO_CHANNEL
+#define CHANSPEC_BUF_SIZE	1024
+#define CHAN_SEL_IOCTL_DELAY	300
+#define CHAN_SEL_RETRY_COUNT	15
+#define CHANNEL_IS_RADAR(channel)	(((channel & WL_CHAN_RADAR) || \
+	(channel & WL_CHAN_PASSIVE)) ? true : false)
+#define CHANNEL_IS_2G(channel)	(((channel >= 1) && (channel <= 14)) ? \
+	true : false)
+#define CHANNEL_IS_5G(channel)	(((channel >= 36) && (channel <= 165)) ? \
+	true : false)
+extern s32 wl_cfg80211_get_best_channels(struct net_device *dev, char* command,
+	int total_len);
+#endif /* WL_SUPPORT_AUTO_CHANNEL */
+
+extern int wl_cfg80211_ether_atoe(const char *a, struct ether_addr *n);
+extern int wl_cfg80211_hex_str_to_bin(unsigned char *data, int dlen, char *str);
+extern int wl_cfg80211_hang(struct net_device *dev, u16 reason);
+extern s32 wl_mode_to_nl80211_iftype(s32 mode);
+int wl_cfg80211_do_driver_init(struct net_device *net);
+void wl_cfg80211_enable_trace(u32 level);
+extern s32 wl_update_wiphybands(struct bcm_cfg80211 *cfg, bool notify);
+extern s32 wl_cfg80211_if_is_group_owner(void);
+extern  chanspec_t wl_chspec_host_to_driver(chanspec_t chanspec);
+extern chanspec_t wl_ch_host_to_driver(u16 channel);
+extern s32 wl_set_tx_power(struct net_device *dev,
+	enum nl80211_tx_power_setting type, s32 dbm);
+extern s32 wl_get_tx_power(struct net_device *dev, s32 *dbm);
+extern s32 wl_add_remove_eventmsg(struct net_device *ndev, u16 event, bool add);
+extern void wl_stop_wait_next_action_frame(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+#ifdef WL_HOST_BAND_MGMT
+extern s32 wl_cfg80211_set_band(struct net_device *ndev, int band);
+#endif /* WL_HOST_BAND_MGMT */
+#if defined(DHCP_SCAN_SUPPRESS)
+extern int wl_cfg80211_scan_suppress(struct net_device *dev, int suppress);
+#endif /* OEM_ANDROID */
+extern void wl_cfg80211_add_to_eventbuffer(wl_eventmsg_buf_t *ev, u16 event, bool set);
+extern s32 wl_cfg80211_apply_eventbuffer(struct net_device *ndev,
+	struct bcm_cfg80211 *cfg, wl_eventmsg_buf_t *ev);
+extern void get_primary_mac(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern void wl_cfg80211_update_power_mode(struct net_device *dev);
+#define SCAN_BUF_CNT	2
+#define SCAN_BUF_NEXT	1
+#define WL_SCANTYPE_LEGACY	0x1
+#define WL_SCANTYPE_P2P		0x2
+#define wl_escan_set_sync_id(a, b) ((a) = htod16(0x1234))
+#define wl_escan_set_type(a, b)
+#define wl_escan_get_buf(a, b) ((wl_scan_results_t *) (a)->escan_info.escan_buf)
+#define wl_escan_check_sync_id(a, b, c) 0
+#define wl_escan_print_sync_id(a, b, c)
+#define wl_escan_increment_sync_id(a, b)
+#define wl_escan_init_sync_id(a)
+extern void wl_cfg80211_ibss_vsie_set_buffer(vndr_ie_setbuf_t *ibss_vsie, int ibss_vsie_len);
+extern s32 wl_cfg80211_ibss_vsie_delete(struct net_device *dev);
+#ifdef WLAIBSS
+extern void wl_cfg80211_set_txfail_pid(int pid);
+#endif /* WLAIBSS */
+extern void wl_cfg80211_set_rmc_pid(int pid);
+
+#ifdef WLFBT
+extern void wl_cfg80211_get_fbt_key(uint8 *key);
+#endif
+
+/* Action frame specific functions */
+extern u8 wl_get_action_category(void *frame, u32 frame_len);
+extern int wl_get_public_action(void *frame, u32 frame_len, u8 *ret_action);
+
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+struct net_device *wl_cfg80211_get_remain_on_channel_ndev(struct bcm_cfg80211 *cfg);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#ifdef WL_SUPPORT_ACS
+#define ACS_MSRMNT_DELAY 1000 /* dump_obss delay in ms */
+#define IOCTL_RETRY_COUNT 5
+#define CHAN_NOISE_DUMMY -80
+#define OBSS_TOKEN_IDX 15
+#define IBSS_TOKEN_IDX 15
+#define TX_TOKEN_IDX 14
+#define CTG_TOKEN_IDX 13
+#define PKT_TOKEN_IDX 15
+#define IDLE_TOKEN_IDX 12
+#endif /* WL_SUPPORT_ACS */
+
+extern int wl_cfg80211_get_ioctl_version(void);
+extern int wl_cfg80211_enable_roam_offload(struct net_device *dev, int enable);
+
+#ifdef WL_NAN
+extern int wl_cfg80211_nan_cmd_handler(struct net_device *ndev, char *cmd,
+	int cmd_len);
+#endif /* WL_NAN */
+
+#ifdef WL_CFG80211_P2P_DEV_IF
+extern void wl_cfg80211_del_p2p_wdev(void);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#endif /* _wl_cfg80211_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_cfg_btcoex.c b/drivers/net/wireless/bcm4336/wl_cfg_btcoex.c
--- a/drivers/net/wireless/bcm4336/wl_cfg_btcoex.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_cfg_btcoex.c	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,538 @@
+/*
+ * Linux cfg80211 driver - Dongle Host Driver (DHD) related
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfg_btcoex.c 467328 2014-04-03 01:23:40Z $
+ */
+
+#include <net/rtnetlink.h>
+
+#include <bcmutils.h>
+#include <wldev_common.h>
+#include <wl_cfg80211.h>
+#include <dhd_cfg80211.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+#include <dhdioctl.h>
+#include <wlioctl.h>
+
+#ifdef PKT_FILTER_SUPPORT
+extern uint dhd_pkt_filter_enable;
+extern uint dhd_master_mode;
+extern void dhd_pktfilter_offload_enable(dhd_pub_t * dhd, char *arg, int enable, int master_mode);
+#endif
+
+struct btcoex_info {
+	struct timer_list timer;
+	u32 timer_ms;
+	u32 timer_on;
+	u32 ts_dhcp_start;	/* ms ts ecord time stats */
+	u32 ts_dhcp_ok;		/* ms ts ecord time stats */
+	bool dhcp_done;	/* flag, indicates that host done with
+					 * dhcp before t1/t2 expiration
+					 */
+	s32 bt_state;
+	struct work_struct work;
+	struct net_device *dev;
+};
+
+static struct btcoex_info *btcoex_info_loc = NULL;
+
+/* TODO: clean up the BT-Coex code, it still have some legacy ioctl/iovar functions */
+
+/* use New SCO/eSCO smart YG suppression */
+#define BT_DHCP_eSCO_FIX
+/* this flag boost wifi pkt priority to max, caution: -not fair to sco */
+#define BT_DHCP_USE_FLAGS
+/* T1 start SCO/ESCo priority suppression */
+#define BT_DHCP_OPPR_WIN_TIME	2500
+/* T2 turn off SCO/SCO supperesion is (timeout) */
+#define BT_DHCP_FLAG_FORCE_TIME 5500
+
+enum wl_cfg80211_btcoex_status {
+	BT_DHCP_IDLE,
+	BT_DHCP_START,
+	BT_DHCP_OPPR_WIN,
+	BT_DHCP_FLAG_FORCE_TIMEOUT
+};
+
+/*
+ * get named driver variable to uint register value and return error indication
+ * calling example: dev_wlc_intvar_get_reg(dev, "btc_params",66, &reg_value)
+ */
+static int
+dev_wlc_intvar_get_reg(struct net_device *dev, char *name,
+	uint reg, int *retval)
+{
+	union {
+		char buf[WLC_IOCTL_SMLEN];
+		int val;
+	} var;
+	int error;
+
+	bcm_mkiovar(name, (char *)(&reg), sizeof(reg),
+		(char *)(&var), sizeof(var.buf));
+	error = wldev_ioctl(dev, WLC_GET_VAR, (char *)(&var), sizeof(var.buf), false);
+
+	*retval = dtoh32(var.val);
+	return (error);
+}
+
+static int
+dev_wlc_bufvar_set(struct net_device *dev, char *name, char *buf, int len)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	char ioctlbuf_local[1024];
+#else
+	static char ioctlbuf_local[1024];
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31) */
+
+	bcm_mkiovar(name, buf, len, ioctlbuf_local, sizeof(ioctlbuf_local));
+
+	return (wldev_ioctl(dev, WLC_SET_VAR, ioctlbuf_local, sizeof(ioctlbuf_local), true));
+}
+/*
+get named driver variable to uint register value and return error indication
+calling example: dev_wlc_intvar_set_reg(dev, "btc_params",66, value)
+*/
+static int
+dev_wlc_intvar_set_reg(struct net_device *dev, char *name, char *addr, char * val)
+{
+	char reg_addr[8];
+
+	memset(reg_addr, 0, sizeof(reg_addr));
+	memcpy((char *)&reg_addr[0], (char *)addr, 4);
+	memcpy((char *)&reg_addr[4], (char *)val, 4);
+
+	return (dev_wlc_bufvar_set(dev, name, (char *)&reg_addr[0], sizeof(reg_addr)));
+}
+
+static bool btcoex_is_sco_active(struct net_device *dev)
+{
+	int ioc_res = 0;
+	bool res = FALSE;
+	int sco_id_cnt = 0;
+	int param27;
+	int i;
+
+	for (i = 0; i < 12; i++) {
+
+		ioc_res = dev_wlc_intvar_get_reg(dev, "btc_params", 27, &param27);
+
+		WL_TRACE(("sample[%d], btc params: 27:%x\n", i, param27));
+
+		if (ioc_res < 0) {
+			WL_ERR(("ioc read btc params error\n"));
+			break;
+		}
+
+		if ((param27 & 0x6) == 2) { /* count both sco & esco  */
+			sco_id_cnt++;
+		}
+
+		if (sco_id_cnt > 2) {
+			WL_TRACE(("sco/esco detected, pkt id_cnt:%d  samples:%d\n",
+				sco_id_cnt, i));
+			res = TRUE;
+			break;
+		}
+
+		OSL_SLEEP(5);
+	}
+
+	return res;
+}
+
+#if defined(BT_DHCP_eSCO_FIX)
+/* Enhanced BT COEX settings for eSCO compatibility during DHCP window */
+static int set_btc_esco_params(struct net_device *dev, bool trump_sco)
+{
+	static bool saved_status = FALSE;
+
+	char buf_reg50va_dhcp_on[8] =
+		{ 50, 00, 00, 00, 0x22, 0x80, 0x00, 0x00 };
+	char buf_reg51va_dhcp_on[8] =
+		{ 51, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+	char buf_reg64va_dhcp_on[8] =
+		{ 64, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+	char buf_reg65va_dhcp_on[8] =
+		{ 65, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+	char buf_reg71va_dhcp_on[8] =
+		{ 71, 00, 00, 00, 0x00, 0x00, 0x00, 0x00 };
+	uint32 regaddr;
+	static uint32 saved_reg50;
+	static uint32 saved_reg51;
+	static uint32 saved_reg64;
+	static uint32 saved_reg65;
+	static uint32 saved_reg71;
+
+	if (trump_sco) {
+		/* this should reduce eSCO agressive retransmit
+		 * w/o breaking it
+		 */
+
+		/* 1st save current */
+		WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+			  "override}\n"));
+		if ((!dev_wlc_intvar_get_reg(dev, "btc_params", 50, &saved_reg50)) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 51, &saved_reg51)) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 64, &saved_reg64)) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 65, &saved_reg65)) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 71, &saved_reg71))) {
+			saved_status = TRUE;
+			WL_TRACE(("saved bt_params[50,51,64,65,71]:"
+				  "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+				  saved_reg50, saved_reg51,
+				  saved_reg64, saved_reg65, saved_reg71));
+		} else {
+			WL_ERR((":%s: save btc_params failed\n",
+				__FUNCTION__));
+			saved_status = FALSE;
+			return -1;
+		}
+
+		WL_TRACE(("override with [50,51,64,65,71]:"
+			  "0x%x 0x%x 0x%x 0x%x 0x%x\n",
+			  *(u32 *)(buf_reg50va_dhcp_on+4),
+			  *(u32 *)(buf_reg51va_dhcp_on+4),
+			  *(u32 *)(buf_reg64va_dhcp_on+4),
+			  *(u32 *)(buf_reg65va_dhcp_on+4),
+			  *(u32 *)(buf_reg71va_dhcp_on+4)));
+
+		dev_wlc_bufvar_set(dev, "btc_params",
+			(char *)&buf_reg50va_dhcp_on[0], 8);
+		dev_wlc_bufvar_set(dev, "btc_params",
+			(char *)&buf_reg51va_dhcp_on[0], 8);
+		dev_wlc_bufvar_set(dev, "btc_params",
+			(char *)&buf_reg64va_dhcp_on[0], 8);
+		dev_wlc_bufvar_set(dev, "btc_params",
+			(char *)&buf_reg65va_dhcp_on[0], 8);
+		dev_wlc_bufvar_set(dev, "btc_params",
+			(char *)&buf_reg71va_dhcp_on[0], 8);
+
+		saved_status = TRUE;
+	} else if (saved_status) {
+		/* restore previously saved bt params */
+		WL_TRACE(("Do new SCO/eSCO coex algo {save &"
+			  "override}\n"));
+
+		regaddr = 50;
+		dev_wlc_intvar_set_reg(dev, "btc_params",
+			(char *)&regaddr, (char *)&saved_reg50);
+		regaddr = 51;
+		dev_wlc_intvar_set_reg(dev, "btc_params",
+			(char *)&regaddr, (char *)&saved_reg51);
+		regaddr = 64;
+		dev_wlc_intvar_set_reg(dev, "btc_params",
+			(char *)&regaddr, (char *)&saved_reg64);
+		regaddr = 65;
+		dev_wlc_intvar_set_reg(dev, "btc_params",
+			(char *)&regaddr, (char *)&saved_reg65);
+		regaddr = 71;
+		dev_wlc_intvar_set_reg(dev, "btc_params",
+			(char *)&regaddr, (char *)&saved_reg71);
+
+		WL_TRACE(("restore bt_params[50,51,64,65,71]:"
+			"0x%x 0x%x 0x%x 0x%x 0x%x\n",
+			saved_reg50, saved_reg51, saved_reg64,
+			saved_reg65, saved_reg71));
+
+		saved_status = FALSE;
+	} else {
+		WL_ERR((":%s att to restore not saved BTCOEX params\n",
+			__FUNCTION__));
+		return -1;
+	}
+	return 0;
+}
+#endif /* BT_DHCP_eSCO_FIX */
+
+static void
+wl_cfg80211_bt_setflag(struct net_device *dev, bool set)
+{
+#if defined(BT_DHCP_USE_FLAGS)
+	char buf_flag7_dhcp_on[8] = { 7, 00, 00, 00, 0x1, 0x0, 0x00, 0x00 };
+	char buf_flag7_default[8]   = { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+#endif
+
+
+#if defined(BT_DHCP_eSCO_FIX)
+	/* set = 1, save & turn on  0 - off & restore prev settings */
+	set_btc_esco_params(dev, set);
+#endif
+
+#if defined(BT_DHCP_USE_FLAGS)
+	WL_TRACE(("WI-FI priority boost via bt flags, set:%d\n", set));
+	if (set == TRUE)
+		/* Forcing bt_flag7  */
+		dev_wlc_bufvar_set(dev, "btc_flags",
+			(char *)&buf_flag7_dhcp_on[0],
+			sizeof(buf_flag7_dhcp_on));
+	else
+		/* Restoring default bt flag7 */
+		dev_wlc_bufvar_set(dev, "btc_flags",
+			(char *)&buf_flag7_default[0],
+			sizeof(buf_flag7_default));
+#endif
+}
+
+static void wl_cfg80211_bt_timerfunc(ulong data)
+{
+	struct btcoex_info *bt_local = (struct btcoex_info *)data;
+	WL_TRACE(("Enter\n"));
+	bt_local->timer_on = 0;
+	schedule_work(&bt_local->work);
+}
+
+static void wl_cfg80211_bt_handler(struct work_struct *work)
+{
+	struct btcoex_info *btcx_inf;
+
+	btcx_inf = container_of(work, struct btcoex_info, work);
+
+	if (btcx_inf->timer_on) {
+		btcx_inf->timer_on = 0;
+		del_timer_sync(&btcx_inf->timer);
+	}
+
+	switch (btcx_inf->bt_state) {
+		case BT_DHCP_START:
+			/* DHCP started
+			 * provide OPPORTUNITY window to get DHCP address
+			 */
+			WL_TRACE(("bt_dhcp stm: started \n"));
+
+			btcx_inf->bt_state = BT_DHCP_OPPR_WIN;
+			mod_timer(&btcx_inf->timer,
+				jiffies + msecs_to_jiffies(BT_DHCP_OPPR_WIN_TIME));
+			btcx_inf->timer_on = 1;
+			break;
+
+		case BT_DHCP_OPPR_WIN:
+			if (btcx_inf->dhcp_done) {
+				WL_TRACE(("DHCP Done before T1 expiration\n"));
+				goto btc_coex_idle;
+			}
+
+			/* DHCP is not over yet, start lowering BT priority
+			 * enforce btc_params + flags if necessary
+			 */
+			WL_TRACE(("DHCP T1:%d expired\n", BT_DHCP_OPPR_WIN_TIME));
+			if (btcx_inf->dev)
+				wl_cfg80211_bt_setflag(btcx_inf->dev, TRUE);
+			btcx_inf->bt_state = BT_DHCP_FLAG_FORCE_TIMEOUT;
+			mod_timer(&btcx_inf->timer,
+				jiffies + msecs_to_jiffies(BT_DHCP_FLAG_FORCE_TIME));
+			btcx_inf->timer_on = 1;
+			break;
+
+		case BT_DHCP_FLAG_FORCE_TIMEOUT:
+			if (btcx_inf->dhcp_done) {
+				WL_TRACE(("DHCP Done before T2 expiration\n"));
+			} else {
+				/* Noo dhcp during T1+T2, restore BT priority */
+				WL_TRACE(("DHCP wait interval T2:%d msec expired\n",
+					BT_DHCP_FLAG_FORCE_TIME));
+			}
+
+			/* Restoring default bt priority */
+			if (btcx_inf->dev)
+				wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+btc_coex_idle:
+			btcx_inf->bt_state = BT_DHCP_IDLE;
+			btcx_inf->timer_on = 0;
+			break;
+
+		default:
+			WL_ERR(("error g_status=%d !!!\n",	btcx_inf->bt_state));
+			if (btcx_inf->dev)
+				wl_cfg80211_bt_setflag(btcx_inf->dev, FALSE);
+			btcx_inf->bt_state = BT_DHCP_IDLE;
+			btcx_inf->timer_on = 0;
+			break;
+	}
+
+	net_os_wake_unlock(btcx_inf->dev);
+}
+
+void* wl_cfg80211_btcoex_init(struct net_device *ndev)
+{
+	struct btcoex_info *btco_inf = NULL;
+
+	btco_inf = kmalloc(sizeof(struct btcoex_info), GFP_KERNEL);
+	if (!btco_inf)
+		return NULL;
+
+	btco_inf->bt_state = BT_DHCP_IDLE;
+	btco_inf->ts_dhcp_start = 0;
+	btco_inf->ts_dhcp_ok = 0;
+	/* Set up timer for BT  */
+	btco_inf->timer_ms = 10;
+	init_timer(&btco_inf->timer);
+	btco_inf->timer.data = (ulong)btco_inf;
+	btco_inf->timer.function = wl_cfg80211_bt_timerfunc;
+
+	btco_inf->dev = ndev;
+
+	INIT_WORK(&btco_inf->work, wl_cfg80211_bt_handler);
+
+	btcoex_info_loc = btco_inf;
+	return btco_inf;
+}
+
+void wl_cfg80211_btcoex_deinit()
+{
+	if (!btcoex_info_loc)
+		return;
+
+	if (btcoex_info_loc->timer_on) {
+		btcoex_info_loc->timer_on = 0;
+		del_timer_sync(&btcoex_info_loc->timer);
+	}
+
+	cancel_work_sync(&btcoex_info_loc->work);
+
+	kfree(btcoex_info_loc);
+}
+
+int wl_cfg80211_set_btcoex_dhcp(struct net_device *dev, dhd_pub_t *dhd, char *command)
+{
+
+	struct btcoex_info *btco_inf = btcoex_info_loc;
+	char powermode_val = 0;
+	char buf_reg66va_dhcp_on[8] = { 66, 00, 00, 00, 0x10, 0x27, 0x00, 0x00 };
+	char buf_reg41va_dhcp_on[8] = { 41, 00, 00, 00, 0x33, 0x00, 0x00, 0x00 };
+	char buf_reg68va_dhcp_on[8] = { 68, 00, 00, 00, 0x90, 0x01, 0x00, 0x00 };
+
+	uint32 regaddr;
+	static uint32 saved_reg66;
+	static uint32 saved_reg41;
+	static uint32 saved_reg68;
+	static bool saved_status = FALSE;
+
+	char buf_flag7_default[8] =   { 7, 00, 00, 00, 0x0, 0x00, 0x00, 0x00};
+
+	/* Figure out powermode 1 or o command */
+	strncpy((char *)&powermode_val, command + strlen("BTCOEXMODE") +1, 1);
+
+	if (strncasecmp((char *)&powermode_val, "1", strlen("1")) == 0) {
+		WL_TRACE_HW4(("DHCP session starts\n"));
+
+#if defined(DHCP_SCAN_SUPPRESS)
+		/* Suppress scan during the DHCP */
+		wl_cfg80211_scan_suppress(dev, 1);
+#endif /* OEM_ANDROID */
+
+#ifdef PKT_FILTER_SUPPORT
+		dhd->dhcp_in_progress = 1;
+
+		if (dhd->early_suspended) {
+			WL_TRACE_HW4(("DHCP in progressing , disable packet filter!!!\n"));
+			dhd_enable_packet_filter(0, dhd);
+		}
+#endif
+
+		/* Retrieve and saved orig regs value */
+		if ((saved_status == FALSE) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 66,  &saved_reg66)) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 41,  &saved_reg41)) &&
+			(!dev_wlc_intvar_get_reg(dev, "btc_params", 68,  &saved_reg68)))   {
+				saved_status = TRUE;
+				WL_TRACE(("Saved 0x%x 0x%x 0x%x\n",
+					saved_reg66, saved_reg41, saved_reg68));
+
+				/* Disable PM mode during dhpc session */
+
+				/* Disable PM mode during dhpc session */
+				/* Start  BT timer only for SCO connection */
+				if (btcoex_is_sco_active(dev)) {
+					/* btc_params 66 */
+					dev_wlc_bufvar_set(dev, "btc_params",
+						(char *)&buf_reg66va_dhcp_on[0],
+						sizeof(buf_reg66va_dhcp_on));
+					/* btc_params 41 0x33 */
+					dev_wlc_bufvar_set(dev, "btc_params",
+						(char *)&buf_reg41va_dhcp_on[0],
+						sizeof(buf_reg41va_dhcp_on));
+					/* btc_params 68 0x190 */
+					dev_wlc_bufvar_set(dev, "btc_params",
+						(char *)&buf_reg68va_dhcp_on[0],
+						sizeof(buf_reg68va_dhcp_on));
+					saved_status = TRUE;
+
+					btco_inf->bt_state = BT_DHCP_START;
+					btco_inf->timer_on = 1;
+					mod_timer(&btco_inf->timer, btco_inf->timer.expires);
+					WL_TRACE(("enable BT DHCP Timer\n"));
+				}
+		}
+		else if (saved_status == TRUE) {
+			WL_ERR(("was called w/o DHCP OFF. Continue\n"));
+		}
+	}
+	else if (strncasecmp((char *)&powermode_val, "2", strlen("2")) == 0) {
+
+#if defined(DHCP_SCAN_SUPPRESS)
+		/* Since DHCP is complete, enable the scan back */
+		wl_cfg80211_scan_suppress(dev, 0);
+#endif /* OEM_ANDROID */
+
+#ifdef PKT_FILTER_SUPPORT
+		dhd->dhcp_in_progress = 0;
+		WL_TRACE_HW4(("DHCP is complete \n"));
+
+		/* Enable packet filtering */
+		if (dhd->early_suspended) {
+			WL_TRACE_HW4(("DHCP is complete , enable packet filter!!!\n"));
+			dhd_enable_packet_filter(1, dhd);
+		}
+#endif /* PKT_FILTER_SUPPORT */
+
+		/* Restoring PM mode */
+
+		/* Stop any bt timer because DHCP session is done */
+		WL_TRACE(("disable BT DHCP Timer\n"));
+		if (btco_inf->timer_on) {
+			btco_inf->timer_on = 0;
+			del_timer_sync(&btco_inf->timer);
+
+			if (btco_inf->bt_state != BT_DHCP_IDLE) {
+			/* need to restore original btc flags & extra btc params */
+				WL_TRACE(("bt->bt_state:%d\n", btco_inf->bt_state));
+				/* wake up btcoex thread to restore btlags+params  */
+				schedule_work(&btco_inf->work);
+			}
+		}
+
+		/* Restoring btc_flag paramter anyway */
+		if (saved_status == TRUE)
+			dev_wlc_bufvar_set(dev, "btc_flags",
+				(char *)&buf_flag7_default[0], sizeof(buf_flag7_default));
+
+		/* Restore original values */
+		if (saved_status == TRUE) {
+			regaddr = 66;
+			dev_wlc_intvar_set_reg(dev, "btc_params",
+				(char *)&regaddr, (char *)&saved_reg66);
+			regaddr = 41;
+			dev_wlc_intvar_set_reg(dev, "btc_params",
+				(char *)&regaddr, (char *)&saved_reg41);
+			regaddr = 68;
+			dev_wlc_intvar_set_reg(dev, "btc_params",
+				(char *)&regaddr, (char *)&saved_reg68);
+
+			WL_TRACE(("restore regs {66,41,68} <- 0x%x 0x%x 0x%x\n",
+				saved_reg66, saved_reg41, saved_reg68));
+		}
+		saved_status = FALSE;
+
+	}
+	else {
+		WL_ERR(("Unkwown yet power setting, ignored\n"));
+	}
+
+	snprintf(command, 3, "OK");
+
+	return (strlen("OK"));
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_cfgp2p.c b/drivers/net/wireless/bcm4336/wl_cfgp2p.c
--- a/drivers/net/wireless/bcm4336/wl_cfgp2p.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_cfgp2p.c	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,2931 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfgp2p.c 504573 2014-09-24 15:21:25Z $
+ *
+ */
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+#include <proto/802.11.h>
+#include <net/rtnetlink.h>
+
+#include <wl_cfg80211.h>
+#include <wl_cfgp2p.h>
+#include <wldev_common.h>
+#include <wl_android.h>
+
+#if defined(P2PONEINT)
+#include <dngl_stats.h>
+#include <dhd.h>
+#endif
+
+static s8 scanparambuf[WLC_IOCTL_SMLEN];
+static s8 g_mgmt_ie_buf[2048];
+static bool
+wl_cfgp2p_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type);
+
+static u32
+wl_cfgp2p_vndr_ie(struct bcm_cfg80211 *cfg, u8 *iebuf, s32 pktflag,
+            s8 *oui, s32 ie_id, s8 *data, s32 datalen, const s8* add_del_cmd);
+static s32 wl_cfgp2p_cancel_listen(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	struct wireless_dev *wdev, bool notify);
+
+#ifdef  P2PONEINT
+void wl_cfg80211_scan_abort(struct bcm_cfg80211 *cfg);
+chanspec_t wl_cfg80211_get_shared_freq(struct wiphy *wiphy);
+s32 dhd_cfg80211_set_p2p_info(struct bcm_cfg80211 *cfg, int val);
+int wl_cfgp2p_if_open(struct net_device *net);
+int wl_cfgp2p_if_stop(struct net_device *net);
+#endif
+
+#if defined(WL_ENABLE_P2P_IF)
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd);
+int wl_cfgp2p_if_open(struct net_device *net);
+int wl_cfgp2p_if_stop(struct net_device *net);
+
+static const struct net_device_ops wl_cfgp2p_if_ops = {
+	.ndo_open       = wl_cfgp2p_if_open,
+	.ndo_stop       = wl_cfgp2p_if_stop,
+	.ndo_do_ioctl   = wl_cfgp2p_do_ioctl,
+#ifndef  P2PONEINT
+	.ndo_start_xmit = wl_cfgp2p_start_xmit,
+#endif
+};
+#endif /* WL_ENABLE_P2P_IF */
+
+#if defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd);
+
+static int wl_cfgp2p_if_dummy(struct net_device *net)
+{
+	return 0;
+}
+
+static const struct net_device_ops wl_cfgp2p_if_ops = {
+	.ndo_open       = wl_cfgp2p_if_dummy,
+	.ndo_stop       = wl_cfgp2p_if_dummy,
+	.ndo_do_ioctl   = wl_cfgp2p_do_ioctl,
+	.ndo_start_xmit = wl_cfgp2p_start_xmit,
+};
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+bool wl_cfgp2p_is_pub_action(void *frame, u32 frame_len)
+{
+	wifi_p2p_pub_act_frame_t *pact_frm;
+
+	if (frame == NULL)
+		return false;
+	pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+	if (frame_len < sizeof(wifi_p2p_pub_act_frame_t) -1)
+		return false;
+
+	if (pact_frm->category == P2P_PUB_AF_CATEGORY &&
+		pact_frm->action == P2P_PUB_AF_ACTION &&
+		pact_frm->oui_type == P2P_VER &&
+		memcmp(pact_frm->oui, P2P_OUI, sizeof(pact_frm->oui)) == 0) {
+		return true;
+	}
+
+	return false;
+}
+
+bool wl_cfgp2p_is_p2p_action(void *frame, u32 frame_len)
+{
+	wifi_p2p_action_frame_t *act_frm;
+
+	if (frame == NULL)
+		return false;
+	act_frm = (wifi_p2p_action_frame_t *)frame;
+	if (frame_len < sizeof(wifi_p2p_action_frame_t) -1)
+		return false;
+
+	if (act_frm->category == P2P_AF_CATEGORY &&
+		act_frm->type  == P2P_VER &&
+		memcmp(act_frm->OUI, P2P_OUI, DOT11_OUI_LEN) == 0) {
+		return true;
+	}
+
+	return false;
+}
+
+#define GAS_RESP_LEN		2
+#define DOUBLE_TLV_BODY_OFF	4
+#define GAS_RESP_OFFSET		4
+#define GAS_CRESP_OFFSET	5
+
+bool wl_cfgp2p_find_gas_subtype(u8 subtype, u8* data, u32 len)
+{
+	bcm_tlv_t *ie = (bcm_tlv_t *)data;
+	u8 *frame = NULL;
+	u16 id, flen;
+
+	/* Skipped first ANQP Element, if frame has anqp elemnt */
+	ie = bcm_parse_tlvs(ie, (int)len, DOT11_MNG_ADVERTISEMENT_ID);
+
+	if (ie == NULL)
+		return false;
+
+	frame = (uint8 *)ie + ie->len + TLV_HDR_LEN + GAS_RESP_LEN;
+	id = ((u16) (((frame)[1] << 8) | (frame)[0]));
+	flen = ((u16) (((frame)[3] << 8) | (frame)[2]));
+
+	/* If the contents match the OUI and the type */
+	if (flen >= WFA_OUI_LEN + 1 &&
+		id ==  P2PSD_GAS_NQP_INFOID &&
+		!bcmp(&frame[DOUBLE_TLV_BODY_OFF], (const uint8*)WFA_OUI, WFA_OUI_LEN) &&
+		subtype == frame[DOUBLE_TLV_BODY_OFF+WFA_OUI_LEN]) {
+		return true;
+	}
+
+	return false;
+}
+
+bool wl_cfgp2p_is_gas_action(void *frame, u32 frame_len)
+{
+
+	wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+
+	if (frame == NULL)
+		return false;
+
+	sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+	if (frame_len < (sizeof(wifi_p2psd_gas_pub_act_frame_t) - 1))
+		return false;
+	if (sd_act_frm->category != P2PSD_ACTION_CATEGORY)
+		return false;
+
+	if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ ||
+		sd_act_frm->action == P2PSD_ACTION_ID_GAS_IRESP ||
+		sd_act_frm->action == P2PSD_ACTION_ID_GAS_CREQ ||
+		sd_act_frm->action == P2PSD_ACTION_ID_GAS_CRESP)
+		return true;
+	else
+		return false;
+}
+void wl_cfgp2p_print_actframe(bool tx, void *frame, u32 frame_len, u32 channel)
+{
+	wifi_p2p_pub_act_frame_t *pact_frm;
+	wifi_p2p_action_frame_t *act_frm;
+	wifi_p2psd_gas_pub_act_frame_t *sd_act_frm;
+	if (!frame || frame_len <= 2)
+		return;
+
+	if (wl_cfgp2p_is_pub_action(frame, frame_len)) {
+		pact_frm = (wifi_p2p_pub_act_frame_t *)frame;
+		switch (pact_frm->subtype) {
+			case P2P_PAF_GON_REQ:
+				CFGP2P_ACTION(("%s P2P Group Owner Negotiation Req Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_GON_RSP:
+				CFGP2P_ACTION(("%s P2P Group Owner Negotiation Rsp Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_GON_CONF:
+				CFGP2P_ACTION(("%s P2P Group Owner Negotiation Confirm Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_INVITE_REQ:
+				CFGP2P_ACTION(("%s P2P Invitation Request  Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_INVITE_RSP:
+				CFGP2P_ACTION(("%s P2P Invitation Response Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_DEVDIS_REQ:
+				CFGP2P_ACTION(("%s P2P Device Discoverability Request Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_DEVDIS_RSP:
+				CFGP2P_ACTION(("%s P2P Device Discoverability Response Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_PROVDIS_REQ:
+				CFGP2P_ACTION(("%s P2P Provision Discovery Request Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_PAF_PROVDIS_RSP:
+				CFGP2P_ACTION(("%s P2P Provision Discovery Response Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			default:
+				CFGP2P_ACTION(("%s Unknown P2P Public Action Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+
+		}
+
+	} else if (wl_cfgp2p_is_p2p_action(frame, frame_len)) {
+		act_frm = (wifi_p2p_action_frame_t *)frame;
+		switch (act_frm->subtype) {
+			case P2P_AF_NOTICE_OF_ABSENCE:
+				CFGP2P_ACTION(("%s P2P Notice of Absence Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_AF_PRESENCE_REQ:
+				CFGP2P_ACTION(("%s P2P Presence Request Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_AF_PRESENCE_RSP:
+				CFGP2P_ACTION(("%s P2P Presence Response Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			case P2P_AF_GO_DISC_REQ:
+				CFGP2P_ACTION(("%s P2P Discoverability Request Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+				break;
+			default:
+				CFGP2P_ACTION(("%s Unknown P2P Action Frame,"
+					" channel=%d\n", (tx)? "TX": "RX", channel));
+		}
+
+	} else if (wl_cfgp2p_is_gas_action(frame, frame_len)) {
+		sd_act_frm = (wifi_p2psd_gas_pub_act_frame_t *)frame;
+		switch (sd_act_frm->action) {
+			case P2PSD_ACTION_ID_GAS_IREQ:
+				CFGP2P_ACTION(("%s P2P GAS Initial Request,"
+					" channel=%d\n", (tx)? "TX" : "RX", channel));
+				break;
+			case P2PSD_ACTION_ID_GAS_IRESP:
+				CFGP2P_ACTION(("%s P2P GAS Initial Response,"
+					" channel=%d\n", (tx)? "TX" : "RX", channel));
+				break;
+			case P2PSD_ACTION_ID_GAS_CREQ:
+				CFGP2P_ACTION(("%s P2P GAS Comback Request,"
+					" channel=%d\n", (tx)? "TX" : "RX", channel));
+				break;
+			case P2PSD_ACTION_ID_GAS_CRESP:
+				CFGP2P_ACTION(("%s P2P GAS Comback Response,"
+					" channel=%d\n", (tx)? "TX" : "RX", channel));
+				break;
+			default:
+				CFGP2P_ACTION(("%s Unknown P2P GAS Frame,"
+					" channel=%d\n", (tx)? "TX" : "RX", channel));
+		}
+
+
+	}
+}
+
+/*
+ *  Initialize variables related to P2P
+ *
+ */
+s32
+wl_cfgp2p_init_priv(struct bcm_cfg80211 *cfg)
+{
+	if (!(cfg->p2p = kzalloc(sizeof(struct p2p_info), GFP_KERNEL))) {
+		CFGP2P_ERR(("struct p2p_info allocation failed\n"));
+		return -ENOMEM;
+	}
+#define INIT_IE(IE_TYPE, BSS_TYPE)		\
+	do {							\
+		memset(wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie, 0, \
+		   sizeof(wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie)); \
+		wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie_len = 0; \
+	} while (0);
+
+	INIT_IE(probe_req, P2PAPI_BSSCFG_PRIMARY);
+	INIT_IE(probe_res, P2PAPI_BSSCFG_PRIMARY);
+	INIT_IE(assoc_req, P2PAPI_BSSCFG_PRIMARY);
+	INIT_IE(assoc_res, P2PAPI_BSSCFG_PRIMARY);
+	INIT_IE(beacon,    P2PAPI_BSSCFG_PRIMARY);
+	INIT_IE(probe_req, P2PAPI_BSSCFG_DEVICE);
+	INIT_IE(probe_res, P2PAPI_BSSCFG_DEVICE);
+	INIT_IE(assoc_req, P2PAPI_BSSCFG_DEVICE);
+	INIT_IE(assoc_res, P2PAPI_BSSCFG_DEVICE);
+	INIT_IE(beacon,    P2PAPI_BSSCFG_DEVICE);
+	INIT_IE(probe_req, P2PAPI_BSSCFG_CONNECTION);
+	INIT_IE(probe_res, P2PAPI_BSSCFG_CONNECTION);
+	INIT_IE(assoc_req, P2PAPI_BSSCFG_CONNECTION);
+	INIT_IE(assoc_res, P2PAPI_BSSCFG_CONNECTION);
+	INIT_IE(beacon,    P2PAPI_BSSCFG_CONNECTION);
+#undef INIT_IE
+	wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY) = bcmcfg_to_prmry_ndev(cfg);
+	wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY) = 0;
+	wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+	wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+	wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION) = NULL;
+	wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION) = 0;
+	return BCME_OK;
+
+}
+/*
+ *  Deinitialize variables related to P2P
+ *
+ */
+void
+wl_cfgp2p_deinit_priv(struct bcm_cfg80211 *cfg)
+{
+	CFGP2P_DBG(("In\n"));
+	if (cfg->p2p) {
+		kfree(cfg->p2p);
+		cfg->p2p = NULL;
+	}
+	cfg->p2p_supported = 0;
+}
+/*
+ * Set P2P functions into firmware
+ */
+s32
+wl_cfgp2p_set_firm_p2p(struct bcm_cfg80211 *cfg)
+{
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	struct ether_addr null_eth_addr = { { 0, 0, 0, 0, 0, 0 } };
+	s32 ret = BCME_OK;
+	s32 val = 0;
+	/* Do we have to check whether APSTA is enabled or not ? */
+	ret = wldev_iovar_getint(ndev, "apsta", &val);
+	if (ret < 0) {
+		CFGP2P_ERR(("get apsta error %d\n", ret));
+		return ret;
+	}
+	if (val == 0) {
+		val = 1;
+		ret = wldev_ioctl(ndev, WLC_DOWN, &val, sizeof(s32), true);
+		if (ret < 0) {
+			CFGP2P_ERR(("WLC_DOWN error %d\n", ret));
+			return ret;
+		}
+		wldev_iovar_setint(ndev, "apsta", val);
+		ret = wldev_ioctl(ndev, WLC_UP, &val, sizeof(s32), true);
+		if (ret < 0) {
+			CFGP2P_ERR(("WLC_UP error %d\n", ret));
+			return ret;
+		}
+	}
+
+	/* In case of COB type, firmware has default mac address
+	 * After Initializing firmware, we have to set current mac address to
+	 * firmware for P2P device address
+	 */
+	ret = wldev_iovar_setbuf_bsscfg(ndev, "p2p_da_override", &null_eth_addr,
+		sizeof(null_eth_addr), cfg->ioctl_buf, WLC_IOCTL_MAXLEN, 0, &cfg->ioctl_buf_sync);
+	if (ret && ret != BCME_UNSUPPORTED) {
+		CFGP2P_ERR(("failed to update device address ret %d\n", ret));
+	}
+	return ret;
+}
+
+/* Create a new P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to create
+ * @if_type  : interface type: WL_P2P_IF_GO or WL_P2P_IF_CLIENT
+ * @chspec   : chspec to use if creating a GO BSS.
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifadd(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec)
+{
+	wl_p2p_if_t ifreq;
+	s32 err;
+	u32 scb_timeout = WL_SCB_TIMEOUT;
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	ifreq.type = if_type;
+	ifreq.chspec = chspec;
+	memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+	CFGP2P_DBG(("---cfg p2p_ifadd "MACDBG" %s %u\n",
+		MAC2STRDBG(ifreq.addr.octet),
+		(if_type == WL_P2P_IF_GO) ? "go" : "client",
+	        (chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT));
+
+	err = wldev_iovar_setbuf(ndev, "p2p_ifadd", &ifreq, sizeof(ifreq),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+	if (unlikely(err < 0))
+		printk("'cfg p2p_ifadd' error %d\n", err);
+	else if (if_type == WL_P2P_IF_GO) {
+		err = wldev_ioctl(ndev, WLC_SET_SCB_TIMEOUT, &scb_timeout, sizeof(u32), true);
+		if (unlikely(err < 0))
+			printk("'cfg scb_timeout' error %d\n", err);
+	}
+	return err;
+}
+
+/* Disable a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to disable
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdisable(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+	s32 ret;
+	struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+	CFGP2P_INFO(("------primary idx %d : cfg p2p_ifdis "MACDBG"\n",
+		netdev->ifindex, MAC2STRDBG(mac->octet)));
+	ret = wldev_iovar_setbuf(netdev, "p2p_ifdis", mac, sizeof(*mac),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+	if (unlikely(ret < 0)) {
+		printk("'cfg p2p_ifdis' error %d\n", ret);
+	}
+	return ret;
+}
+
+/* Delete a P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the BSS to delete
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifdel(struct bcm_cfg80211 *cfg, struct ether_addr *mac)
+{
+	s32 ret;
+	struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+	CFGP2P_INFO(("------primary idx %d : cfg p2p_ifdel "MACDBG"\n",
+	    netdev->ifindex, MAC2STRDBG(mac->octet)));
+	ret = wldev_iovar_setbuf(netdev, "p2p_ifdel", mac, sizeof(*mac),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+	if (unlikely(ret < 0)) {
+		printk("'cfg p2p_ifdel' error %d\n", ret);
+	}
+	return ret;
+}
+
+/* Change a P2P Role.
+ * Parameters:
+ * @mac      : MAC address of the BSS to change a role
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifchange(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec)
+{
+	wl_p2p_if_t ifreq;
+	s32 err;
+	u32 scb_timeout = WL_SCB_TIMEOUT;
+
+	struct net_device *netdev =  wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION);
+
+	ifreq.type = if_type;
+	ifreq.chspec = chspec;
+	memcpy(ifreq.addr.octet, mac->octet, sizeof(ifreq.addr.octet));
+
+	CFGP2P_INFO(("---cfg p2p_ifchange "MACDBG" %s %u"
+		" chanspec 0x%04x\n", MAC2STRDBG(ifreq.addr.octet),
+		(if_type == WL_P2P_IF_GO) ? "go" : "client",
+		(chspec & WL_CHANSPEC_CHAN_MASK) >> WL_CHANSPEC_CHAN_SHIFT,
+		ifreq.chspec));
+
+	err = wldev_iovar_setbuf(netdev, "p2p_ifupd", &ifreq, sizeof(ifreq),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+	if (unlikely(err < 0)) {
+		printk("'cfg p2p_ifupd' error %d\n", err);
+	} else if (if_type == WL_P2P_IF_GO) {
+		err = wldev_ioctl(netdev, WLC_SET_SCB_TIMEOUT, &scb_timeout, sizeof(u32), true);
+		if (unlikely(err < 0))
+			printk("'cfg scb_timeout' error %d\n", err);
+	}
+	return err;
+}
+
+
+/* Get the index of a created P2P BSS.
+ * Parameters:
+ * @mac      : MAC address of the created BSS
+ * @index    : output: index of created BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_ifidx(struct bcm_cfg80211 *cfg, struct ether_addr *mac, s32 *index)
+{
+	s32 ret;
+	u8 getbuf[64];
+	struct net_device *dev = bcmcfg_to_prmry_ndev(cfg);
+
+	CFGP2P_INFO(("---cfg p2p_if "MACDBG"\n", MAC2STRDBG(mac->octet)));
+
+	ret = wldev_iovar_getbuf_bsscfg(dev, "p2p_if", mac, sizeof(*mac), getbuf,
+		sizeof(getbuf), wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY), NULL);
+
+	if (ret == 0) {
+		memcpy(index, getbuf, sizeof(s32));
+		CFGP2P_INFO(("---cfg p2p_if   ==> %d\n", *index));
+	}
+
+	return ret;
+}
+
+static s32
+wl_cfgp2p_set_discovery(struct bcm_cfg80211 *cfg, s32 on)
+{
+	s32 ret = BCME_OK;
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+	CFGP2P_DBG(("enter\n"));
+
+	ret = wldev_iovar_setint(ndev, "p2p_disc", on);
+
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR(("p2p_disc %d error %d\n", on, ret));
+	}
+
+	return ret;
+}
+
+/* Set the WL driver's P2P mode.
+ * Parameters :
+ * @mode      : is one of WL_P2P_DISC_ST_{SCAN,LISTEN,SEARCH}.
+ * @channel   : the channel to listen
+ * @listen_ms : the time (milli seconds) to wait
+ * @bssidx    : bss index for BSSCFG
+ * Returns 0 if success
+ */
+
+s32
+wl_cfgp2p_set_p2p_mode(struct bcm_cfg80211 *cfg, u8 mode, u32 channel, u16 listen_ms, int bssidx)
+{
+	wl_p2p_disc_st_t discovery_mode;
+	s32 ret;
+	struct net_device *dev;
+	CFGP2P_DBG(("enter\n"));
+
+	if (unlikely(bssidx == WL_INVALID)) {
+		CFGP2P_ERR((" %d index out of range\n", bssidx));
+		return -1;
+	}
+
+	dev = wl_cfgp2p_find_ndev(cfg, bssidx);
+	if (unlikely(dev == NULL)) {
+		CFGP2P_ERR(("bssidx %d is not assigned\n", bssidx));
+		return BCME_NOTFOUND;
+	}
+
+#ifdef P2PLISTEN_AP_SAMECHN
+	CFGP2P_DBG(("p2p0 listen channel %d  AP connection chan %d \n",
+		channel, cfg->channel));
+	if ((mode == WL_P2P_DISC_ST_LISTEN) && (cfg->channel == channel)) {
+		struct net_device *primary_ndev = bcmcfg_to_prmry_ndev(cfg);
+
+		if (cfg->p2p_resp_apchn_status) {
+			CFGP2P_DBG(("p2p_resp_apchn_status already ON \n"));
+			return BCME_OK;
+		}
+
+		if (wl_get_drv_status(cfg, CONNECTED, primary_ndev)) {
+			ret = wl_cfg80211_set_p2p_resp_ap_chn(primary_ndev, 1);
+			cfg->p2p_resp_apchn_status = true;
+			CFGP2P_DBG(("p2p_resp_apchn_status ON \n"));
+			return ret;
+		}
+	}
+#endif /* P2PLISTEN_AP_SAMECHN */
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#if defined(P2P_DISCOVERY_WAR)
+	if (mode == WL_P2P_DISC_ST_LISTEN || mode == WL_P2P_DISC_ST_SEARCH) {
+		if (!cfg->p2p->vif_created) {
+			if (wldev_iovar_setint(wl_to_prmry_ndev(cfg), "mpc", 0) < 0) {
+				WL_ERR(("mpc disabling failed\n"));
+			}
+		}
+	}
+#endif /* defined(P2P_DISCOVERY_WAR) */
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+	/* Put the WL driver into P2P Listen Mode to respond to P2P probe reqs */
+	discovery_mode.state = mode;
+	discovery_mode.chspec = wl_ch_host_to_driver(channel);
+	discovery_mode.dwell = listen_ms;
+	ret = wldev_iovar_setbuf_bsscfg(dev, "p2p_state", &discovery_mode,
+		sizeof(discovery_mode), cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+		bssidx, &cfg->ioctl_buf_sync);
+
+	return ret;
+}
+
+/* Get the index of the P2P Discovery BSS */
+static s32
+wl_cfgp2p_get_disc_idx(struct bcm_cfg80211 *cfg, s32 *index)
+{
+	s32 ret;
+	struct net_device *dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+
+	ret = wldev_iovar_getint(dev, "p2p_dev", index);
+	CFGP2P_INFO(("p2p_dev bsscfg_idx=%d ret=%d\n", *index, ret));
+
+	if (unlikely(ret <  0)) {
+	    CFGP2P_ERR(("'p2p_dev' error %d\n", ret));
+		return ret;
+	}
+	return ret;
+}
+
+s32
+wl_cfgp2p_init_discovery(struct bcm_cfg80211 *cfg)
+{
+
+	s32 index = 0;
+	s32 ret = BCME_OK;
+
+	CFGP2P_DBG(("enter\n"));
+
+	if (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) > 0) {
+		CFGP2P_ERR(("do nothing, already initialized\n"));
+		return ret;
+	}
+
+	ret = wl_cfgp2p_set_discovery(cfg, 1);
+	if (ret < 0) {
+		CFGP2P_ERR(("set discover error\n"));
+		return ret;
+	}
+	/* Enable P2P Discovery in the WL Driver */
+	ret = wl_cfgp2p_get_disc_idx(cfg, &index);
+
+	if (ret < 0) {
+		return ret;
+	}
+	wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) =
+	    wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+	wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = index;
+
+	/* Set the initial discovery state to SCAN */
+	ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+		wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+
+	if (unlikely(ret != 0)) {
+		CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+		wl_cfgp2p_set_discovery(cfg, 0);
+		wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = 0;
+		wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+		return 0;
+	}
+	return ret;
+}
+
+/* Deinitialize P2P Discovery
+ * Parameters :
+ * @cfg        : wl_private data
+ * Returns 0 if succes
+ */
+static s32
+wl_cfgp2p_deinit_discovery(struct bcm_cfg80211 *cfg)
+{
+	s32 ret = BCME_OK;
+	CFGP2P_DBG(("enter\n"));
+
+	if (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) <= 0) {
+		CFGP2P_ERR(("do nothing, not initialized\n"));
+		return -1;
+	}
+	/* Set the discovery state to SCAN */
+	ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+	            wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+	/* Disable P2P discovery in the WL driver (deletes the discovery BSSCFG) */
+	ret = wl_cfgp2p_set_discovery(cfg, 0);
+
+	/* Clear our saved WPS and P2P IEs for the discovery BSS.  The driver
+	 * deleted these IEs when wl_cfgp2p_set_discovery() deleted the discovery
+	 * BSS.
+	 */
+
+	/* Clear the saved bsscfg index of the discovery BSSCFG to indicate we
+	 * have no discovery BSS.
+	 */
+	wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) = WL_INVALID;
+	wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE) = NULL;
+
+	return ret;
+
+}
+/* Enable P2P Discovery
+ * Parameters:
+ * @cfg	: wl_private data
+ * @ie  : probe request ie (WPS IE + P2P IE)
+ * @ie_len   : probe request ie length
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_enable_discovery(struct bcm_cfg80211 *cfg, struct net_device *dev,
+	const u8 *ie, u32 ie_len)
+{
+	s32 ret = BCME_OK;
+	s32 bssidx;
+
+	if (wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+		CFGP2P_INFO((" DISCOVERY is already initialized, we have nothing to do\n"));
+		goto set_ie;
+	}
+
+	wl_set_p2p_status(cfg, DISCOVERY_ON);
+
+	CFGP2P_DBG(("enter\n"));
+
+	ret = wl_cfgp2p_init_discovery(cfg);
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR((" init discovery error %d\n", ret));
+		goto exit;
+	}
+	/* Set wsec to any non-zero value in the discovery bsscfg to ensure our
+	 * P2P probe responses have the privacy bit set in the 802.11 WPA IE.
+	 * Some peer devices may not initiate WPS with us if this bit is not set.
+	 */
+	ret = wldev_iovar_setint_bsscfg(wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE),
+			"wsec", AES_ENABLED, wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR((" wsec error %d\n", ret));
+	}
+set_ie:
+	if (ie_len) {
+		if (bcmcfg_to_prmry_ndev(cfg) == dev) {
+			bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+		} else if (wl_cfgp2p_find_idx(cfg, dev, &bssidx) != BCME_OK) {
+			WL_ERR(("Find p2p index from dev(%p) failed\n", dev));
+			return BCME_ERROR;
+		}
+
+		ret = wl_cfgp2p_set_management_ie(cfg, dev,
+			bssidx,
+			VNDR_IE_PRBREQ_FLAG, ie, ie_len);
+
+		if (unlikely(ret < 0)) {
+			CFGP2P_ERR(("set probreq ie occurs error %d\n", ret));
+			goto exit;
+		}
+	}
+exit:
+	return ret;
+}
+
+/* Disable P2P Discovery
+ * Parameters:
+ * @cfg       : wl_private_data
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_disable_discovery(struct bcm_cfg80211 *cfg)
+{
+	s32 ret = BCME_OK;
+	CFGP2P_DBG((" enter\n"));
+	wl_clr_p2p_status(cfg, DISCOVERY_ON);
+
+	if (!cfg->p2p) { // terence 20130113: Fix for p2p NULL pointer
+		ret = BCME_ERROR;
+		CFGP2P_ERR(("wl->p2p is NULL\n"));
+		goto exit;
+	}
+
+	if (wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE) == 0) {
+		CFGP2P_ERR((" do nothing, not initialized\n"));
+		goto exit;
+	}
+
+	ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+	            wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+
+	if (unlikely(ret < 0)) {
+
+		CFGP2P_ERR(("unable to set WL_P2P_DISC_ST_SCAN\n"));
+	}
+	/* Do a scan abort to stop the driver's scan engine in case it is still
+	 * waiting out an action frame tx dwell time.
+	 */
+	wl_clr_p2p_status(cfg, DISCOVERY_ON);
+	ret = wl_cfgp2p_deinit_discovery(cfg);
+
+exit:
+	return ret;
+}
+
+s32
+wl_cfgp2p_escan(struct bcm_cfg80211 *cfg, struct net_device *dev, u16 active,
+	u32 num_chans, u16 *channels,
+	s32 search_state, u16 action, u32 bssidx, struct ether_addr *tx_dst_addr,
+	p2p_scan_purpose_t p2p_scan_purpose)
+{
+	s32 ret = BCME_OK;
+	s32 memsize;
+	s32 eparams_size;
+	u32 i;
+	s8 *memblk;
+	wl_p2p_scan_t *p2p_params;
+	wl_escan_params_t *eparams;
+	wlc_ssid_t ssid;
+	/* Scan parameters */
+#define P2PAPI_SCAN_NPROBES 1
+#define P2PAPI_SCAN_DWELL_TIME_MS 80
+#define P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS 40
+#define P2PAPI_SCAN_HOME_TIME_MS 60
+#define P2PAPI_SCAN_NPROBS_TIME_MS 30
+#define P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS 100
+
+	struct net_device *pri_dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_PRIMARY);
+	/* Allocate scan params which need space for 3 channels and 0 ssids */
+	eparams_size = (WL_SCAN_PARAMS_FIXED_SIZE +
+	    OFFSETOF(wl_escan_params_t, params)) +
+		num_chans * sizeof(eparams->params.channel_list[0]);
+
+	memsize = sizeof(wl_p2p_scan_t) + eparams_size;
+	memblk = scanparambuf;
+	if (memsize > sizeof(scanparambuf)) {
+		CFGP2P_ERR((" scanpar buf too small (%u > %zu)\n",
+		    memsize, sizeof(scanparambuf)));
+		return -1;
+	}
+	memset(memblk, 0, memsize);
+	memset(cfg->ioctl_buf, 0, WLC_IOCTL_MAXLEN);
+	if (search_state == WL_P2P_DISC_ST_SEARCH) {
+		/*
+		 * If we in SEARCH STATE, we don't need to set SSID explictly
+		 * because dongle use P2P WILDCARD internally by default
+		 */
+		wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SEARCH, 0, 0, bssidx);
+		/* use null ssid */
+		ssid.SSID_len = 0;
+		memset(&ssid.SSID, 0, sizeof(ssid.SSID));
+	} else if (search_state == WL_P2P_DISC_ST_SCAN) {
+		/* SCAN STATE 802.11 SCAN
+		 * WFD Supplicant has p2p_find command with (type=progressive, type= full)
+		 * So if P2P_find command with type=progressive,
+		 * we have to set ssid to P2P WILDCARD because
+		 * we just do broadcast scan unless setting SSID
+		 */
+		wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0, bssidx);
+		/* use wild card ssid */
+		ssid.SSID_len = WL_P2P_WILDCARD_SSID_LEN;
+		memset(&ssid.SSID, 0, sizeof(ssid.SSID));
+		memcpy(&ssid.SSID, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN);
+	} else {
+		CFGP2P_ERR((" invalid search state %d\n", search_state));
+		return -1;
+	}
+
+
+	/* Fill in the P2P scan structure at the start of the iovar param block */
+	p2p_params = (wl_p2p_scan_t*) memblk;
+	p2p_params->type = 'E';
+	/* Fill in the Scan structure that follows the P2P scan structure */
+	eparams = (wl_escan_params_t*) (p2p_params + 1);
+	eparams->params.bss_type = DOT11_BSSTYPE_ANY;
+	if (active)
+		eparams->params.scan_type = DOT11_SCANTYPE_ACTIVE;
+	else
+		eparams->params.scan_type = DOT11_SCANTYPE_PASSIVE;
+
+	if (tx_dst_addr == NULL)
+		memcpy(&eparams->params.bssid, &ether_bcast, ETHER_ADDR_LEN);
+	else
+		memcpy(&eparams->params.bssid, tx_dst_addr, ETHER_ADDR_LEN);
+
+	if (ssid.SSID_len)
+		memcpy(&eparams->params.ssid, &ssid, sizeof(wlc_ssid_t));
+
+	eparams->params.home_time = htod32(P2PAPI_SCAN_HOME_TIME_MS);
+
+	switch (p2p_scan_purpose) {
+		case P2P_SCAN_SOCIAL_CHANNEL:
+		eparams->params.active_time = htod32(P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS);
+			break;
+		case P2P_SCAN_AFX_PEER_NORMAL:
+		case P2P_SCAN_AFX_PEER_REDUCED:
+		eparams->params.active_time = htod32(P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS);
+			break;
+		case P2P_SCAN_CONNECT_TRY:
+			eparams->params.active_time = htod32(WL_SCAN_CONNECT_DWELL_TIME_MS);
+			break;
+		default :
+			if (wl_get_drv_status_all(cfg, CONNECTED))
+		eparams->params.active_time = -1;
+	else
+		eparams->params.active_time = htod32(P2PAPI_SCAN_DWELL_TIME_MS);
+			break;
+	}
+
+	if (p2p_scan_purpose == P2P_SCAN_CONNECT_TRY)
+		eparams->params.nprobes = htod32(eparams->params.active_time /
+			WL_SCAN_JOIN_PROBE_INTERVAL_MS);
+	else
+	eparams->params.nprobes = htod32((eparams->params.active_time /
+		P2PAPI_SCAN_NPROBS_TIME_MS));
+
+
+	if (eparams->params.nprobes <= 0)
+		eparams->params.nprobes = 1;
+	CFGP2P_DBG(("nprobes # %d, active_time %d\n",
+		eparams->params.nprobes, eparams->params.active_time));
+	eparams->params.passive_time = htod32(-1);
+	eparams->params.channel_num = htod32((0 << WL_SCAN_PARAMS_NSSID_SHIFT) |
+	    (num_chans & WL_SCAN_PARAMS_COUNT_MASK));
+
+	for (i = 0; i < num_chans; i++) {
+		eparams->params.channel_list[i] = wl_ch_host_to_driver(channels[i]);
+	}
+	eparams->version = htod32(ESCAN_REQ_VERSION);
+	eparams->action =  htod16(action);
+	wl_escan_set_sync_id(eparams->sync_id, cfg);
+	wl_escan_set_type(cfg, WL_SCANTYPE_P2P);
+	CFGP2P_INFO(("SCAN CHANNELS : "));
+
+	for (i = 0; i < num_chans; i++) {
+		if (i == 0) CFGP2P_INFO(("%d", channels[i]));
+		else CFGP2P_INFO((",%d", channels[i]));
+	}
+
+	CFGP2P_INFO(("\n"));
+
+	ret = wldev_iovar_setbuf_bsscfg(pri_dev, "p2p_scan",
+		memblk, memsize, cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+	if (ret == BCME_OK)
+		wl_set_p2p_status(cfg, SCANNING);
+	return ret;
+}
+
+/* search function to reach at common channel to send action frame
+ * Parameters:
+ * @cfg       : wl_private data
+ * @ndev     : net device for bssidx
+ * @bssidx   : bssidx for BSS
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_act_frm_search(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	s32 bssidx, s32 channel, struct ether_addr *tx_dst_addr)
+{
+	s32 ret = 0;
+	u32 chan_cnt = 0;
+	u16 *default_chan_list = NULL;
+	p2p_scan_purpose_t p2p_scan_purpose = P2P_SCAN_AFX_PEER_NORMAL;
+	if (!p2p_is_on(cfg) || ndev == NULL || bssidx == WL_INVALID)
+		return -BCME_ERROR;
+	WL_TRACE_HW4((" Enter\n"));
+	if (bssidx == wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_PRIMARY))
+		bssidx = wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE);
+	if (channel)
+		chan_cnt = AF_PEER_SEARCH_CNT;
+	else
+		chan_cnt = SOCIAL_CHAN_CNT;
+	default_chan_list = kzalloc(chan_cnt * sizeof(*default_chan_list), GFP_KERNEL);
+	if (default_chan_list == NULL) {
+		CFGP2P_ERR(("channel list allocation failed \n"));
+		ret = -ENOMEM;
+		goto exit;
+	}
+	if (channel) {
+		u32 i;
+		/* insert same channel to the chan_list */
+		for (i = 0; i < chan_cnt; i++) {
+			default_chan_list[i] = channel;
+		}
+	} else {
+		default_chan_list[0] = SOCIAL_CHAN_1;
+		default_chan_list[1] = SOCIAL_CHAN_2;
+		default_chan_list[2] = SOCIAL_CHAN_3;
+	}
+	ret = wl_cfgp2p_escan(cfg, ndev, true, chan_cnt,
+		default_chan_list, WL_P2P_DISC_ST_SEARCH,
+		WL_SCAN_ACTION_START, bssidx, NULL, p2p_scan_purpose);
+	kfree(default_chan_list);
+exit:
+	return ret;
+}
+
+/* Check whether pointed-to IE looks like WPA. */
+#define wl_cfgp2p_is_wpa_ie(ie, tlvs, len)	wl_cfgp2p_has_ie(ie, tlvs, len, \
+		(const uint8 *)WPS_OUI, WPS_OUI_LEN, WPA_OUI_TYPE)
+/* Check whether pointed-to IE looks like WPS. */
+#define wl_cfgp2p_is_wps_ie(ie, tlvs, len)	wl_cfgp2p_has_ie(ie, tlvs, len, \
+		(const uint8 *)WPS_OUI, WPS_OUI_LEN, WPS_OUI_TYPE)
+/* Check whether the given IE looks like WFA P2P IE. */
+#define wl_cfgp2p_is_p2p_ie(ie, tlvs, len)	wl_cfgp2p_has_ie(ie, tlvs, len, \
+		(const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_P2P)
+/* Check whether the given IE looks like WFA WFDisplay IE. */
+#ifndef WFA_OUI_TYPE_WFD
+#define WFA_OUI_TYPE_WFD	0x0a			/* WiFi Display OUI TYPE */
+#endif
+#define wl_cfgp2p_is_wfd_ie(ie, tlvs, len)	wl_cfgp2p_has_ie(ie, tlvs, len, \
+		(const uint8 *)WFA_OUI, WFA_OUI_LEN, WFA_OUI_TYPE_WFD)
+
+static s32
+wl_cfgp2p_parse_vndr_ies(u8 *parse, u32 len,
+	struct parsed_vndr_ies *vndr_ies)
+{
+	s32 err = BCME_OK;
+	vndr_ie_t *vndrie;
+	bcm_tlv_t *ie;
+	struct parsed_vndr_ie_info *parsed_info;
+	u32	count = 0;
+	s32 remained_len;
+
+	remained_len = (s32)len;
+	memset(vndr_ies, 0, sizeof(*vndr_ies));
+
+	WL_INFORM(("---> len %d\n", len));
+	ie = (bcm_tlv_t *) parse;
+	if (!bcm_valid_tlv(ie, remained_len))
+		ie = NULL;
+	while (ie) {
+		if (count >= MAX_VNDR_IE_NUMBER)
+			break;
+		if (ie->id == DOT11_MNG_VS_ID) {
+			vndrie = (vndr_ie_t *) ie;
+			/* len should be bigger than OUI length + one data length at least */
+			if (vndrie->len < (VNDR_IE_MIN_LEN + 1)) {
+				CFGP2P_ERR(("%s: invalid vndr ie. length is too small %d\n",
+					__FUNCTION__, vndrie->len));
+				goto end;
+			}
+			/* if wpa or wme ie, do not add ie */
+			if (!bcmp(vndrie->oui, (u8*)WPA_OUI, WPA_OUI_LEN) &&
+				((vndrie->data[0] == WPA_OUI_TYPE) ||
+				(vndrie->data[0] == WME_OUI_TYPE))) {
+				CFGP2P_DBG(("Found WPA/WME oui. Do not add it\n"));
+				goto end;
+			}
+
+			parsed_info = &vndr_ies->ie_info[count++];
+
+			/* save vndr ie information */
+			parsed_info->ie_ptr = (char *)vndrie;
+			parsed_info->ie_len = (vndrie->len + TLV_HDR_LEN);
+			memcpy(&parsed_info->vndrie, vndrie, sizeof(vndr_ie_t));
+
+			vndr_ies->count = count;
+
+			CFGP2P_DBG(("\t ** OUI %02x %02x %02x, type 0x%02x \n",
+				parsed_info->vndrie.oui[0], parsed_info->vndrie.oui[1],
+				parsed_info->vndrie.oui[2], parsed_info->vndrie.data[0]));
+		}
+end:
+		ie = bcm_next_tlv(ie, &remained_len);
+	}
+	return err;
+}
+
+
+/* Delete and Set a management vndr ie to firmware
+ * Parameters:
+ * @cfg       : wl_private data
+ * @ndev     : net device for bssidx
+ * @bssidx   : bssidx for BSS
+ * @pktflag  : packet flag for IE (VNDR_IE_PRBREQ_FLAG,VNDR_IE_PRBRSP_FLAG, VNDR_IE_ASSOCRSP_FLAG,
+ *                                 VNDR_IE_ASSOCREQ_FLAG)
+ * @ie       :  VNDR IE (such as P2P IE , WPS IE)
+ * @ie_len   : VNDR IE Length
+ * Returns 0 if success.
+ */
+
+s32
+wl_cfgp2p_set_management_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx,
+    s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len)
+{
+	s32 ret = BCME_OK;
+	u8  *curr_ie_buf = NULL;
+	u8  *mgmt_ie_buf = NULL;
+	u32 mgmt_ie_buf_len = 0;
+	u32 *mgmt_ie_len = 0;
+	u32 del_add_ie_buf_len = 0;
+	u32 total_ie_buf_len = 0;
+	u32 parsed_ie_buf_len = 0;
+	struct parsed_vndr_ies old_vndr_ies;
+	struct parsed_vndr_ies new_vndr_ies;
+	s32 i;
+	u8 *ptr;
+	s32 type = -1;
+	s32 remained_buf_len;
+#define IE_TYPE(type, bsstype) (wl_to_p2p_bss_saved_ie(cfg, bsstype).p2p_ ## type ## _ie)
+#define IE_TYPE_LEN(type, bsstype) (wl_to_p2p_bss_saved_ie(cfg, bsstype).p2p_ ## type ## _ie_len)
+	memset(g_mgmt_ie_buf, 0, sizeof(g_mgmt_ie_buf));
+	curr_ie_buf = g_mgmt_ie_buf;
+	CFGP2P_DBG((" bssidx %d, pktflag : 0x%02X\n", bssidx, pktflag));
+
+#ifdef DUAL_STA
+	if ((cfg->p2p != NULL) && ((bssidx == 0) || (bssidx != cfg->cfgdev_bssidx)))
+#else
+	if (cfg->p2p != NULL)
+#endif
+	{
+		if (wl_cfgp2p_find_type(cfg, bssidx, &type)) {
+			CFGP2P_ERR(("cannot find type from bssidx : %d\n", bssidx));
+			return BCME_ERROR;
+		}
+
+		switch (pktflag) {
+			case VNDR_IE_PRBREQ_FLAG :
+				mgmt_ie_buf = IE_TYPE(probe_req, type);
+				mgmt_ie_len = &IE_TYPE_LEN(probe_req, type);
+				mgmt_ie_buf_len = sizeof(IE_TYPE(probe_req, type));
+				break;
+			case VNDR_IE_PRBRSP_FLAG :
+				mgmt_ie_buf = IE_TYPE(probe_res, type);
+				mgmt_ie_len = &IE_TYPE_LEN(probe_res, type);
+				mgmt_ie_buf_len = sizeof(IE_TYPE(probe_res, type));
+				break;
+			case VNDR_IE_ASSOCREQ_FLAG :
+				mgmt_ie_buf = IE_TYPE(assoc_req, type);
+				mgmt_ie_len = &IE_TYPE_LEN(assoc_req, type);
+				mgmt_ie_buf_len = sizeof(IE_TYPE(assoc_req, type));
+				break;
+			case VNDR_IE_ASSOCRSP_FLAG :
+				mgmt_ie_buf = IE_TYPE(assoc_res, type);
+				mgmt_ie_len = &IE_TYPE_LEN(assoc_res, type);
+				mgmt_ie_buf_len = sizeof(IE_TYPE(assoc_res, type));
+				break;
+			case VNDR_IE_BEACON_FLAG :
+				mgmt_ie_buf = IE_TYPE(beacon, type);
+				mgmt_ie_len = &IE_TYPE_LEN(beacon, type);
+				mgmt_ie_buf_len = sizeof(IE_TYPE(beacon, type));
+				break;
+			default:
+				mgmt_ie_buf = NULL;
+				mgmt_ie_len = NULL;
+				CFGP2P_ERR(("not suitable type\n"));
+				return BCME_ERROR;
+		}
+	} else if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_AP) {
+		if (cfg->ap_info == NULL) {
+			CFGP2P_ERR(("hostapd ap_info null ptr refrence while setting  IE\n"));
+			return BCME_ERROR;
+
+		}
+		switch (pktflag) {
+			case VNDR_IE_PRBRSP_FLAG :
+				mgmt_ie_buf = cfg->ap_info->probe_res_ie;
+				mgmt_ie_len = &cfg->ap_info->probe_res_ie_len;
+				mgmt_ie_buf_len = sizeof(cfg->ap_info->probe_res_ie);
+				break;
+			case VNDR_IE_BEACON_FLAG :
+				mgmt_ie_buf = cfg->ap_info->beacon_ie;
+				mgmt_ie_len = &cfg->ap_info->beacon_ie_len;
+				mgmt_ie_buf_len = sizeof(cfg->ap_info->beacon_ie);
+				break;
+			case VNDR_IE_ASSOCRSP_FLAG :
+				/* WPS-AP WSC2.0 assoc res includes wps_ie */
+				mgmt_ie_buf = cfg->ap_info->assoc_res_ie;
+				mgmt_ie_len = &cfg->ap_info->assoc_res_ie_len;
+				mgmt_ie_buf_len = sizeof(cfg->ap_info->assoc_res_ie);
+				break;
+			default:
+				mgmt_ie_buf = NULL;
+				mgmt_ie_len = NULL;
+				CFGP2P_ERR(("not suitable type\n"));
+				return BCME_ERROR;
+		}
+		bssidx = 0;
+	} else if (wl_get_mode_by_netdev(cfg, ndev) == WL_MODE_BSS) {
+		switch (pktflag) {
+			case VNDR_IE_PRBREQ_FLAG :
+				mgmt_ie_buf = cfg->sta_info->probe_req_ie;
+				mgmt_ie_len = &cfg->sta_info->probe_req_ie_len;
+				mgmt_ie_buf_len = sizeof(cfg->sta_info->probe_req_ie);
+				break;
+			case VNDR_IE_ASSOCREQ_FLAG :
+				mgmt_ie_buf = cfg->sta_info->assoc_req_ie;
+				mgmt_ie_len = &cfg->sta_info->assoc_req_ie_len;
+				mgmt_ie_buf_len = sizeof(cfg->sta_info->assoc_req_ie);
+				break;
+			default:
+				mgmt_ie_buf = NULL;
+				mgmt_ie_len = NULL;
+				CFGP2P_ERR(("not suitable type\n"));
+				return BCME_ERROR;
+		}
+		bssidx = 0;
+	} else {
+		CFGP2P_ERR(("not suitable type\n"));
+		return BCME_ERROR;
+	}
+
+	if (vndr_ie_len > mgmt_ie_buf_len) {
+		CFGP2P_ERR(("extra IE size too big\n"));
+		ret = -ENOMEM;
+	} else {
+		/* parse and save new vndr_ie in curr_ie_buff before comparing it */
+		if (vndr_ie && vndr_ie_len && curr_ie_buf) {
+			ptr = curr_ie_buf;
+
+			wl_cfgp2p_parse_vndr_ies((u8*)vndr_ie,
+				vndr_ie_len, &new_vndr_ies);
+
+			for (i = 0; i < new_vndr_ies.count; i++) {
+				struct parsed_vndr_ie_info *vndrie_info =
+					&new_vndr_ies.ie_info[i];
+
+				memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
+					vndrie_info->ie_len);
+				parsed_ie_buf_len += vndrie_info->ie_len;
+			}
+		}
+
+		if (mgmt_ie_buf != NULL) {
+			if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
+			     (memcmp(mgmt_ie_buf, curr_ie_buf, parsed_ie_buf_len) == 0)) {
+				CFGP2P_INFO(("Previous mgmt IE is equals to current IE\n"));
+				goto exit;
+			}
+
+			/* parse old vndr_ie */
+			wl_cfgp2p_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len,
+				&old_vndr_ies);
+
+			/* make a command to delete old ie */
+			for (i = 0; i < old_vndr_ies.count; i++) {
+				struct parsed_vndr_ie_info *vndrie_info =
+					&old_vndr_ies.ie_info[i];
+
+				CFGP2P_INFO(("DELETED ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
+					vndrie_info->vndrie.id, vndrie_info->vndrie.len,
+					vndrie_info->vndrie.oui[0], vndrie_info->vndrie.oui[1],
+					vndrie_info->vndrie.oui[2]));
+
+				del_add_ie_buf_len = wl_cfgp2p_vndr_ie(cfg, curr_ie_buf,
+					pktflag, vndrie_info->vndrie.oui,
+					vndrie_info->vndrie.id,
+					vndrie_info->ie_ptr + VNDR_IE_FIXED_LEN,
+					vndrie_info->ie_len - VNDR_IE_FIXED_LEN,
+					"del");
+
+				curr_ie_buf += del_add_ie_buf_len;
+				total_ie_buf_len += del_add_ie_buf_len;
+			}
+		}
+
+		*mgmt_ie_len = 0;
+		/* Add if there is any extra IE */
+		if (mgmt_ie_buf && parsed_ie_buf_len) {
+			ptr = mgmt_ie_buf;
+
+			remained_buf_len = mgmt_ie_buf_len;
+
+			/* make a command to add new ie */
+			for (i = 0; i < new_vndr_ies.count; i++) {
+				struct parsed_vndr_ie_info *vndrie_info =
+					&new_vndr_ies.ie_info[i];
+
+				CFGP2P_INFO(("ADDED ID : %d, Len: %d(%d), OUI:%02x:%02x:%02x\n",
+					vndrie_info->vndrie.id, vndrie_info->vndrie.len,
+					vndrie_info->ie_len - 2,
+					vndrie_info->vndrie.oui[0], vndrie_info->vndrie.oui[1],
+					vndrie_info->vndrie.oui[2]));
+
+				del_add_ie_buf_len = wl_cfgp2p_vndr_ie(cfg, curr_ie_buf,
+					pktflag, vndrie_info->vndrie.oui,
+					vndrie_info->vndrie.id,
+					vndrie_info->ie_ptr + VNDR_IE_FIXED_LEN,
+					vndrie_info->ie_len - VNDR_IE_FIXED_LEN,
+					"add");
+
+				/* verify remained buf size before copy data */
+				if (remained_buf_len >= vndrie_info->ie_len) {
+					remained_buf_len -= vndrie_info->ie_len;
+				} else {
+					CFGP2P_ERR(("no space in mgmt_ie_buf: pktflag = %d, "
+						"found vndr ies # = %d(cur %d), remained len %d, "
+						"cur mgmt_ie_len %d, new ie len = %d\n",
+						pktflag, new_vndr_ies.count, i, remained_buf_len,
+						*mgmt_ie_len, vndrie_info->ie_len));
+					break;
+				}
+
+				/* save the parsed IE in cfg struct */
+				memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
+					vndrie_info->ie_len);
+				*mgmt_ie_len += vndrie_info->ie_len;
+
+				curr_ie_buf += del_add_ie_buf_len;
+				total_ie_buf_len += del_add_ie_buf_len;
+			}
+		}
+		if (total_ie_buf_len) {
+			ret  = wldev_iovar_setbuf_bsscfg(ndev, "vndr_ie", g_mgmt_ie_buf,
+				total_ie_buf_len, cfg->ioctl_buf, WLC_IOCTL_MAXLEN,
+				bssidx, &cfg->ioctl_buf_sync);
+			if (ret)
+				CFGP2P_ERR(("vndr ie set error : %d\n", ret));
+		}
+	}
+#undef IE_TYPE
+#undef IE_TYPE_LEN
+exit:
+	return ret;
+}
+
+/* Clear the manament IE buffer of BSSCFG
+ * Parameters:
+ * @cfg       : wl_private data
+ * @bssidx   : bssidx for BSS
+ *
+ * Returns 0 if success.
+ */
+s32
+wl_cfgp2p_clear_management_ie(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+
+	s32 vndrie_flag[] = {VNDR_IE_BEACON_FLAG, VNDR_IE_PRBRSP_FLAG, VNDR_IE_ASSOCRSP_FLAG,
+		VNDR_IE_PRBREQ_FLAG, VNDR_IE_ASSOCREQ_FLAG};
+	s32 index = -1;
+	s32 type = -1;
+	struct net_device *ndev = wl_cfgp2p_find_ndev(cfg, bssidx);
+#define INIT_IE(IE_TYPE, BSS_TYPE)		\
+	do {							\
+		memset(wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie, 0, \
+		   sizeof(wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie)); \
+		wl_to_p2p_bss_saved_ie(cfg, BSS_TYPE).p2p_ ## IE_TYPE ## _ie_len = 0; \
+	} while (0);
+
+	if (bssidx < 0 || ndev == NULL) {
+		CFGP2P_ERR(("invalid %s\n", (bssidx < 0) ? "bssidx" : "ndev"));
+		return BCME_BADARG;
+	}
+
+	if (wl_cfgp2p_find_type(cfg, bssidx, &type)) {
+		CFGP2P_ERR(("invalid argument\n"));
+		return BCME_BADARG;
+	}
+	for (index = 0; index < ARRAYSIZE(vndrie_flag); index++) {
+		/* clean up vndr ies in dongle */
+		wl_cfgp2p_set_management_ie(cfg, ndev, bssidx, vndrie_flag[index], NULL, 0);
+	}
+	INIT_IE(probe_req, type);
+	INIT_IE(probe_res, type);
+	INIT_IE(assoc_req, type);
+	INIT_IE(assoc_res, type);
+	INIT_IE(beacon, type);
+	return BCME_OK;
+}
+
+
+/* Is any of the tlvs the expected entry? If
+ * not update the tlvs buffer pointer/length.
+ */
+static bool
+wl_cfgp2p_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len, const u8 *oui, u32 oui_len, u8 type)
+{
+	/* If the contents match the OUI and the type */
+	if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
+		!bcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
+		type == ie[TLV_BODY_OFF + oui_len]) {
+		return TRUE;
+	}
+
+	if (tlvs == NULL)
+		return FALSE;
+	/* point to the next ie */
+	ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
+	/* calculate the length of the rest of the buffer */
+	*tlvs_len -= (int)(ie - *tlvs);
+	/* update the pointer to the start of the buffer */
+	*tlvs = ie;
+
+	return FALSE;
+}
+
+wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(u8 *parse, u32 len)
+{
+	bcm_tlv_t *ie;
+
+	while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_VS_ID))) {
+		if (wl_cfgp2p_is_wpa_ie((u8*)ie, &parse, &len)) {
+			return (wpa_ie_fixed_t *)ie;
+		}
+	}
+	return NULL;
+}
+
+wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(u8 *parse, u32 len)
+{
+	bcm_tlv_t *ie;
+
+	while ((ie = bcm_parse_tlvs(parse, (u32)len, DOT11_MNG_VS_ID))) {
+		if (wl_cfgp2p_is_wps_ie((u8*)ie, &parse, &len)) {
+			return (wpa_ie_fixed_t *)ie;
+		}
+	}
+	return NULL;
+}
+
+wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(u8 *parse, u32 len)
+{
+	bcm_tlv_t *ie;
+
+	while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+		if (wl_cfgp2p_is_p2p_ie((uint8*)ie, &parse, &len)) {
+			return (wifi_p2p_ie_t *)ie;
+		}
+	}
+	return NULL;
+}
+
+wifi_wfd_ie_t *
+wl_cfgp2p_find_wfdie(u8 *parse, u32 len)
+{
+	bcm_tlv_t *ie;
+
+	while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+		if (wl_cfgp2p_is_wfd_ie((uint8*)ie, &parse, &len)) {
+			return (wifi_wfd_ie_t *)ie;
+		}
+	}
+	return NULL;
+}
+static u32
+wl_cfgp2p_vndr_ie(struct bcm_cfg80211 *cfg, u8 *iebuf, s32 pktflag,
+            s8 *oui, s32 ie_id, s8 *data, s32 datalen, const s8* add_del_cmd)
+{
+	vndr_ie_setbuf_t hdr;	/* aligned temporary vndr_ie buffer header */
+	s32 iecount;
+	u32 data_offset;
+
+	/* Validate the pktflag parameter */
+	if ((pktflag & ~(VNDR_IE_BEACON_FLAG | VNDR_IE_PRBRSP_FLAG |
+	            VNDR_IE_ASSOCRSP_FLAG | VNDR_IE_AUTHRSP_FLAG |
+	            VNDR_IE_PRBREQ_FLAG | VNDR_IE_ASSOCREQ_FLAG))) {
+		CFGP2P_ERR(("p2pwl_vndr_ie: Invalid packet flag 0x%x\n", pktflag));
+		return -1;
+	}
+
+	/* Copy the vndr_ie SET command ("add"/"del") to the buffer */
+	strncpy(hdr.cmd, add_del_cmd, VNDR_IE_CMD_LEN - 1);
+	hdr.cmd[VNDR_IE_CMD_LEN - 1] = '\0';
+
+	/* Set the IE count - the buffer contains only 1 IE */
+	iecount = htod32(1);
+	memcpy((void *)&hdr.vndr_ie_buffer.iecount, &iecount, sizeof(s32));
+
+	/* Copy packet flags that indicate which packets will contain this IE */
+	pktflag = htod32(pktflag);
+	memcpy((void *)&hdr.vndr_ie_buffer.vndr_ie_list[0].pktflag, &pktflag,
+		sizeof(u32));
+
+	/* Add the IE ID to the buffer */
+	hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.id = ie_id;
+
+	/* Add the IE length to the buffer */
+	hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.len =
+		(uint8) VNDR_IE_MIN_LEN + datalen;
+
+	/* Add the IE OUI to the buffer */
+	hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[0] = oui[0];
+	hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[1] = oui[1];
+	hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.oui[2] = oui[2];
+
+	/* Copy the aligned temporary vndr_ie buffer header to the IE buffer */
+	memcpy(iebuf, &hdr, sizeof(hdr) - 1);
+
+	/* Copy the IE data to the IE buffer */
+	data_offset =
+		(u8*)&hdr.vndr_ie_buffer.vndr_ie_list[0].vndr_ie_data.data[0] -
+		(u8*)&hdr;
+	memcpy(iebuf + data_offset, data, datalen);
+	return data_offset + datalen;
+
+}
+
+/*
+ * Search the bssidx based on dev argument
+ * Parameters:
+ * @cfg       : wl_private data
+ * @ndev     : net device to search bssidx
+ * @bssidx  : output arg to store bssidx of the bsscfg of firmware.
+ * Returns error
+ */
+s32
+wl_cfgp2p_find_idx(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 *bssidx)
+{
+	u32 i;
+	if (ndev == NULL || bssidx == NULL) {
+		CFGP2P_ERR((" argument is invalid\n"));
+		return BCME_BADARG;
+	}
+	if (!cfg->p2p_supported) {
+		*bssidx = P2PAPI_BSSCFG_PRIMARY;
+		return BCME_OK;
+	}
+	/* we cannot find the bssidx of DISCOVERY BSS
+	 *  because the ndev is same with ndev of PRIMARY BSS.
+	 */
+	for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+		if (ndev == wl_to_p2p_bss_ndev(cfg, i)) {
+			*bssidx = wl_to_p2p_bss_bssidx(cfg, i);
+			return BCME_OK;
+		}
+	}
+
+#ifdef DUAL_STA
+	if (cfg->bss_cfgdev && (cfg->bss_cfgdev == ndev_to_cfgdev(ndev))) {
+		CFGP2P_INFO(("cfgdev is present, return the bssidx"));
+		*bssidx = cfg->cfgdev_bssidx;
+		return BCME_OK;
+	}
+#endif
+
+	return BCME_BADARG;
+
+}
+struct net_device *
+wl_cfgp2p_find_ndev(struct bcm_cfg80211 *cfg, s32 bssidx)
+{
+	u32 i;
+	struct net_device *ndev = NULL;
+	if (bssidx < 0) {
+		CFGP2P_ERR((" bsscfg idx is invalid\n"));
+		goto exit;
+	}
+
+	for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+		if (bssidx == wl_to_p2p_bss_bssidx(cfg, i)) {
+			ndev = wl_to_p2p_bss_ndev(cfg, i);
+			break;
+		}
+	}
+
+exit:
+	return ndev;
+}
+/*
+ * Search the driver array idx based on bssidx argument
+ * Parameters:
+ * @cfg     : wl_private data
+ * @bssidx : bssidx which indicate bsscfg->idx of firmware.
+ * @type   : output arg to store array idx of p2p->bss.
+ * Returns error
+ */
+
+s32
+wl_cfgp2p_find_type(struct bcm_cfg80211 *cfg, s32 bssidx, s32 *type)
+{
+	u32 i;
+	if (bssidx < 0 || type == NULL) {
+		CFGP2P_ERR((" argument is invalid\n"));
+		goto exit;
+	}
+
+	for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+		if (bssidx == wl_to_p2p_bss_bssidx(cfg, i)) {
+			*type = i;
+			return BCME_OK;
+		}
+	}
+
+#ifdef DUAL_STA
+	if (bssidx == cfg->cfgdev_bssidx) {
+		CFGP2P_DBG(("bssidx matching with the virtual I/F \n"));
+		*type = 1;
+		return BCME_OK;
+	}
+#endif
+
+exit:
+	return BCME_BADARG;
+}
+
+/*
+ * Callback function for WLC_E_P2P_DISC_LISTEN_COMPLETE
+ */
+s32
+wl_cfgp2p_listen_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data)
+{
+	s32 ret = BCME_OK;
+	struct net_device *ndev = NULL;
+
+	if (!cfg || !cfg->p2p)
+		return BCME_ERROR;
+
+	CFGP2P_DBG((" Enter\n"));
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+#if defined(P2P_DISCOVERY_WAR)
+	if (!cfg->p2p->vif_created) {
+		if (wldev_iovar_setint(ndev, "mpc", 1) < 0) {
+			WL_ERR(("mpc enabling back failed\n"));
+		}
+	}
+#endif /* defined(P2P_DISCOVERY_WAR) */
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+	if (wl_get_p2p_status(cfg, LISTEN_EXPIRED) == 0) {
+		wl_set_p2p_status(cfg, LISTEN_EXPIRED);
+		if (timer_pending(&cfg->p2p->listen_timer)) {
+			del_timer_sync(&cfg->p2p->listen_timer);
+		}
+
+		if (cfg->afx_hdl->is_listen == TRUE &&
+			wl_get_drv_status_all(cfg, FINDING_COMMON_CHANNEL)) {
+			WL_DBG(("Listen DONE for action frame\n"));
+			complete(&cfg->act_frm_scan);
+		}
+#ifdef WL_CFG80211_SYNC_GON
+		else if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM_LISTEN)) {
+			wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM_LISTEN, ndev);
+			WL_DBG(("Listen DONE and wake up wait_next_af !!(%d)\n",
+				jiffies_to_msecs(jiffies - cfg->af_tx_sent_jiffies)));
+
+			if (wl_get_drv_status_all(cfg, WAITING_NEXT_ACT_FRM))
+				wl_clr_drv_status(cfg, WAITING_NEXT_ACT_FRM, ndev);
+
+			complete(&cfg->wait_next_af);
+		}
+#endif /* WL_CFG80211_SYNC_GON */
+
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+		if (wl_get_drv_status_all(cfg, REMAINING_ON_CHANNEL))
+#else
+		if (wl_get_drv_status_all(cfg, REMAINING_ON_CHANNEL) ||
+			wl_get_drv_status_all(cfg, FAKE_REMAINING_ON_CHANNEL))
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+		{
+			WL_DBG(("Listen DONE for ramain on channel expired\n"));
+			wl_clr_drv_status(cfg, REMAINING_ON_CHANNEL, ndev);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+			wl_clr_drv_status(cfg, FAKE_REMAINING_ON_CHANNEL, ndev);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+			if (ndev && (ndev->ieee80211_ptr != NULL)) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+				cfg80211_remain_on_channel_expired(bcmcfg_to_p2p_wdev(cfg),
+					cfg->last_roc_id, &cfg->remain_on_chan, GFP_KERNEL);
+#else
+				cfg80211_remain_on_channel_expired(cfgdev, cfg->last_roc_id,
+					&cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+			}
+		}
+		if (wl_add_remove_eventmsg(bcmcfg_to_prmry_ndev(cfg),
+			WLC_E_P2P_PROBREQ_MSG, false) != BCME_OK) {
+			CFGP2P_ERR((" failed to unset WLC_E_P2P_PROPREQ_MSG\n"));
+		}
+	} else
+		wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+
+	return ret;
+
+}
+
+/*
+ *  Timer expire callback function for LISTEN
+ *  We can't report cfg80211_remain_on_channel_expired from Timer ISR context,
+ *  so lets do it from thread context.
+ */
+void
+wl_cfgp2p_listen_expired(unsigned long data)
+{
+	wl_event_msg_t msg;
+	struct bcm_cfg80211 *cfg = (struct bcm_cfg80211 *) data;
+	CFGP2P_DBG((" Enter\n"));
+	bzero(&msg, sizeof(wl_event_msg_t));
+	msg.event_type =  hton32(WLC_E_P2P_DISC_LISTEN_COMPLETE);
+#if defined(WL_ENABLE_P2P_IF)
+	wl_cfg80211_event(cfg->p2p_net ? cfg->p2p_net :
+		wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE), &msg, NULL);
+#else
+	wl_cfg80211_event(wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_DEVICE), &msg,
+		NULL);
+#endif /* WL_ENABLE_P2P_IF */
+}
+/*
+ *  Routine for cancelling the P2P LISTEN
+ */
+static s32
+wl_cfgp2p_cancel_listen(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+                         struct wireless_dev *wdev, bool notify)
+{
+	WL_DBG(("Enter \n"));
+	/* Irrespective of whether timer is running or not, reset
+	 * the LISTEN state.
+	 */
+	if (timer_pending(&cfg->p2p->listen_timer)) {
+		del_timer_sync(&cfg->p2p->listen_timer);
+		if (notify) {
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#ifdef P2PONEINT
+			if (wdev == NULL)
+				wdev = bcmcfg_to_p2p_wdev(cfg);
+#endif
+			if (wdev)
+				cfg80211_remain_on_channel_expired(bcmcfg_to_p2p_wdev(cfg),
+					cfg->last_roc_id, &cfg->remain_on_chan, GFP_KERNEL);
+#else
+			if (ndev && ndev->ieee80211_ptr)
+				cfg80211_remain_on_channel_expired(ndev, cfg->last_roc_id,
+					&cfg->remain_on_chan, cfg->remain_on_chan_type, GFP_KERNEL);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+		}
+	}
+	return 0;
+}
+/*
+ * Do a P2P Listen on the given channel for the given duration.
+ * A listen consists of sitting idle and responding to P2P probe requests
+ * with a P2P probe response.
+ *
+ * This fn assumes dongle p2p device discovery is already enabled.
+ * Parameters   :
+ * @cfg          : wl_private data
+ * @channel     : channel to listen
+ * @duration_ms : the time (milli seconds) to wait
+ */
+s32
+wl_cfgp2p_discover_listen(struct bcm_cfg80211 *cfg, s32 channel, u32 duration_ms)
+{
+#define EXTRA_DELAY_TIME	100
+	s32 ret = BCME_OK;
+	struct timer_list *_timer;
+	s32 extra_delay;
+	struct net_device *netdev = bcmcfg_to_prmry_ndev(cfg);
+
+	CFGP2P_DBG((" Enter Listen Channel : %d, Duration : %d\n", channel, duration_ms));
+	if (unlikely(wl_get_p2p_status(cfg, DISCOVERY_ON) == 0)) {
+
+		CFGP2P_ERR((" Discovery is not set, so we have noting to do\n"));
+
+		ret = BCME_NOTREADY;
+		goto exit;
+	}
+	if (timer_pending(&cfg->p2p->listen_timer)) {
+		CFGP2P_DBG(("previous LISTEN is not completed yet\n"));
+		goto exit;
+
+	}
+#ifndef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	else
+		wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+#endif /* not WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+	if (wl_add_remove_eventmsg(netdev, WLC_E_P2P_PROBREQ_MSG, true) != BCME_OK) {
+			CFGP2P_ERR((" failed to set WLC_E_P2P_PROPREQ_MSG\n"));
+	}
+
+	ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_LISTEN, channel, (u16) duration_ms,
+	            wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+	_timer = &cfg->p2p->listen_timer;
+
+	/*  We will wait to receive WLC_E_P2P_DISC_LISTEN_COMPLETE from dongle ,
+	 *  otherwise we will wait up to duration_ms + 100ms + duration / 10
+	 */
+	if (ret == BCME_OK) {
+		extra_delay = EXTRA_DELAY_TIME + (duration_ms / 10);
+	} else {
+		/* if failed to set listen, it doesn't need to wait whole duration. */
+		duration_ms = 100 + duration_ms / 20;
+		extra_delay = 0;
+	}
+
+	INIT_TIMER(_timer, wl_cfgp2p_listen_expired, duration_ms, extra_delay);
+#ifdef WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST
+	wl_clr_p2p_status(cfg, LISTEN_EXPIRED);
+#endif /* WL_CFG80211_VSDB_PRIORITIZE_SCAN_REQUEST */
+
+#undef EXTRA_DELAY_TIME
+exit:
+	return ret;
+}
+
+
+s32
+wl_cfgp2p_discover_enable_search(struct bcm_cfg80211 *cfg, u8 enable)
+{
+	s32 ret = BCME_OK;
+	CFGP2P_DBG((" Enter\n"));
+	if (!wl_get_p2p_status(cfg, DISCOVERY_ON)) {
+
+		CFGP2P_DBG((" do nothing, discovery is off\n"));
+		return ret;
+	}
+	if (wl_get_p2p_status(cfg, SEARCH_ENABLED) == enable) {
+		CFGP2P_DBG(("already : %d\n", enable));
+		return ret;
+	}
+
+	wl_chg_p2p_status(cfg, SEARCH_ENABLED);
+	/* When disabling Search, reset the WL driver's p2p discovery state to
+	 * WL_P2P_DISC_ST_SCAN.
+	 */
+	if (!enable) {
+		wl_clr_p2p_status(cfg, SCANNING);
+		ret = wl_cfgp2p_set_p2p_mode(cfg, WL_P2P_DISC_ST_SCAN, 0, 0,
+		            wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_DEVICE));
+	}
+
+	return ret;
+}
+
+/*
+ * Callback function for WLC_E_ACTION_FRAME_COMPLETE, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE
+ */
+s32
+wl_cfgp2p_action_tx_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+            const wl_event_msg_t *e, void *data)
+{
+	s32 ret = BCME_OK;
+	u32 event_type = ntoh32(e->event_type);
+	u32 status = ntoh32(e->status);
+	struct net_device *ndev = NULL;
+	CFGP2P_DBG((" Enter\n"));
+
+	ndev = cfgdev_to_wlc_ndev(cfgdev, cfg);
+
+	if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM)) {
+		if (event_type == WLC_E_ACTION_FRAME_COMPLETE) {
+
+			CFGP2P_INFO((" WLC_E_ACTION_FRAME_COMPLETE is received : %d\n", status));
+			if (status == WLC_E_STATUS_SUCCESS) {
+				wl_set_p2p_status(cfg, ACTION_TX_COMPLETED);
+				CFGP2P_DBG(("WLC_E_ACTION_FRAME_COMPLETE : ACK\n"));
+			}
+			else if (!wl_get_p2p_status(cfg, ACTION_TX_COMPLETED)) {
+				wl_set_p2p_status(cfg, ACTION_TX_NOACK);
+				CFGP2P_INFO(("WLC_E_ACTION_FRAME_COMPLETE : NO ACK\n"));
+				wl_stop_wait_next_action_frame(cfg, ndev);
+			}
+		} else {
+			CFGP2P_INFO((" WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE is received,"
+						"status : %d\n", status));
+
+			if (wl_get_drv_status_all(cfg, SENDING_ACT_FRM))
+				complete(&cfg->send_af_done);
+		}
+	}
+	return ret;
+}
+/* Send an action frame immediately without doing channel synchronization.
+ *
+ * This function does not wait for a completion event before returning.
+ * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
+ * frame is transmitted.
+ * The WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE event will be received when an
+ * 802.11 ack has been received for the sent action frame.
+ */
+s32
+wl_cfgp2p_tx_action_frame(struct bcm_cfg80211 *cfg, struct net_device *dev,
+	wl_af_params_t *af_params, s32 bssidx)
+{
+	s32 ret = BCME_OK;
+	s32 evt_ret = BCME_OK;
+	s32 timeout = 0;
+	wl_eventmsg_buf_t buf;
+
+
+	CFGP2P_INFO(("\n"));
+	CFGP2P_INFO(("channel : %u , dwell time : %u\n",
+	    af_params->channel, af_params->dwell_time));
+
+	wl_clr_p2p_status(cfg, ACTION_TX_COMPLETED);
+	wl_clr_p2p_status(cfg, ACTION_TX_NOACK);
+
+	bzero(&buf, sizeof(wl_eventmsg_buf_t));
+	wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, true);
+	wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_COMPLETE, true);
+	if ((evt_ret = wl_cfg80211_apply_eventbuffer(bcmcfg_to_prmry_ndev(cfg), cfg, &buf)) < 0)
+		return evt_ret;
+
+	cfg->af_sent_channel  = af_params->channel;
+#ifdef WL_CFG80211_SYNC_GON
+	cfg->af_tx_sent_jiffies = jiffies;
+#endif /* WL_CFG80211_SYNC_GON */
+
+	ret = wldev_iovar_setbuf_bsscfg(dev, "actframe", af_params, sizeof(*af_params),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, bssidx, &cfg->ioctl_buf_sync);
+
+	if (ret < 0) {
+		CFGP2P_ERR((" sending action frame is failed\n"));
+		goto exit;
+	}
+
+	timeout = wait_for_completion_timeout(&cfg->send_af_done,
+		msecs_to_jiffies(af_params->dwell_time + WL_AF_TX_EXTRA_TIME_MAX));
+
+	if (timeout >= 0 && wl_get_p2p_status(cfg, ACTION_TX_COMPLETED)) {
+		CFGP2P_INFO(("tx action frame operation is completed\n"));
+		ret = BCME_OK;
+	} else if (ETHER_ISBCAST(&cfg->afx_hdl->tx_dst_addr)) {
+		CFGP2P_INFO(("bcast tx action frame operation is completed\n"));
+		ret = BCME_OK;
+	} else {
+		ret = BCME_ERROR;
+		CFGP2P_INFO(("tx action frame operation is failed\n"));
+	}
+	/* clear status bit for action tx */
+	wl_clr_p2p_status(cfg, ACTION_TX_COMPLETED);
+	wl_clr_p2p_status(cfg, ACTION_TX_NOACK);
+
+exit:
+	CFGP2P_INFO((" via act frame iovar : status = %d\n", ret));
+
+	bzero(&buf, sizeof(wl_eventmsg_buf_t));
+	wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_OFF_CHAN_COMPLETE, false);
+	wl_cfg80211_add_to_eventbuffer(&buf, WLC_E_ACTION_FRAME_COMPLETE, false);
+	if ((evt_ret = wl_cfg80211_apply_eventbuffer(bcmcfg_to_prmry_ndev(cfg), cfg, &buf)) < 0) {
+		WL_ERR(("TX frame events revert back failed \n"));
+		return evt_ret;
+	}
+
+	return ret;
+}
+
+/* Generate our P2P Device Address and P2P Interface Address from our primary
+ * MAC address.
+ */
+void
+wl_cfgp2p_generate_bss_mac(struct ether_addr *primary_addr,
+            struct ether_addr *out_dev_addr, struct ether_addr *out_int_addr)
+{
+	memset(out_dev_addr, 0, sizeof(*out_dev_addr));
+	memset(out_int_addr, 0, sizeof(*out_int_addr));
+
+	/* Generate the P2P Device Address.  This consists of the device's
+	 * primary MAC address with the locally administered bit set.
+	 */
+	memcpy(out_dev_addr, primary_addr, sizeof(*out_dev_addr));
+	out_dev_addr->octet[0] |= 0x02;
+
+	/* Generate the P2P Interface Address.  If the discovery and connection
+	 * BSSCFGs need to simultaneously co-exist, then this address must be
+	 * different from the P2P Device Address.
+	 */
+	memcpy(out_int_addr, out_dev_addr, sizeof(*out_int_addr));
+#ifndef  P2PONEINT
+	out_int_addr->octet[4] ^= 0x80;
+#endif
+
+}
+
+/* P2P IF Address change to Virtual Interface MAC Address */
+void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id)
+{
+	wifi_p2p_ie_t *ie = (wifi_p2p_ie_t*) buf;
+	u16 len = ie->len;
+	u8 *subel;
+	u8 subelt_id;
+	u16 subelt_len;
+	CFGP2P_DBG((" Enter\n"));
+
+	/* Point subel to the P2P IE's subelt field.
+	 * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+	 */
+	subel = ie->subelts;
+	len -= 4;	/* exclude OUI + OUI_TYPE */
+
+	while (len >= 3) {
+	/* attribute id */
+		subelt_id = *subel;
+		subel += 1;
+		len -= 1;
+
+		/* 2-byte little endian */
+		subelt_len = *subel++;
+		subelt_len |= *subel++ << 8;
+
+		len -= 2;
+		len -= subelt_len;	/* for the remaining subelt fields */
+
+		if (subelt_id == element_id) {
+			if (subelt_id == P2P_SEID_INTINTADDR) {
+				memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+				CFGP2P_INFO(("Intended P2P Interface Address ATTR FOUND\n"));
+			} else if (subelt_id == P2P_SEID_DEV_ID) {
+				memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+				CFGP2P_INFO(("Device ID ATTR FOUND\n"));
+			} else if (subelt_id == P2P_SEID_DEV_INFO) {
+				memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+				CFGP2P_INFO(("Device INFO ATTR FOUND\n"));
+			} else if (subelt_id == P2P_SEID_GROUP_ID) {
+				memcpy(subel, p2p_int_addr->octet, ETHER_ADDR_LEN);
+				CFGP2P_INFO(("GROUP ID ATTR FOUND\n"));
+			}			return;
+		} else {
+			CFGP2P_DBG(("OTHER id : %d\n", subelt_id));
+		}
+		subel += subelt_len;
+	}
+}
+/*
+ * Check if a BSS is up.
+ * This is a common implementation called by most OSL implementations of
+ * p2posl_bss_isup().  DO NOT call this function directly from the
+ * common code -- call p2posl_bss_isup() instead to allow the OSL to
+ * override the common implementation if necessary.
+ */
+bool
+wl_cfgp2p_bss_isup(struct net_device *ndev, int bsscfg_idx)
+{
+	s32 result, val;
+	bool isup = false;
+	s8 getbuf[64];
+
+	/* Check if the BSS is up */
+	*(int*)getbuf = -1;
+	result = wldev_iovar_getbuf_bsscfg(ndev, "bss", &bsscfg_idx,
+		sizeof(bsscfg_idx), getbuf, sizeof(getbuf), 0, NULL);
+	if (result != 0) {
+		CFGP2P_ERR(("'cfg bss -C %d' failed: %d\n", bsscfg_idx, result));
+		CFGP2P_ERR(("NOTE: this ioctl error is normal "
+					"when the BSS has not been created yet.\n"));
+	} else {
+		val = *(int*)getbuf;
+		val = dtoh32(val);
+		CFGP2P_INFO(("---cfg bss -C %d   ==> %d\n", bsscfg_idx, val));
+		isup = (val ? TRUE : FALSE);
+	}
+	return isup;
+}
+
+
+/* Bring up or down a BSS */
+s32
+wl_cfgp2p_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bsscfg_idx, s32 up)
+{
+	s32 ret = BCME_OK;
+	s32 val = up ? 1 : 0;
+
+	struct {
+		s32 cfg;
+		s32 val;
+	} bss_setbuf;
+
+	bss_setbuf.cfg = htod32(bsscfg_idx);
+	bss_setbuf.val = htod32(val);
+	CFGP2P_INFO(("---cfg bss -C %d %s\n", bsscfg_idx, up ? "up" : "down"));
+	ret = wldev_iovar_setbuf(ndev, "bss", &bss_setbuf, sizeof(bss_setbuf),
+		cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+	if (ret != 0) {
+		CFGP2P_ERR(("'bss %d' failed with %d\n", up, ret));
+	}
+
+	return ret;
+}
+
+/* Check if 'p2p' is supported in the driver */
+s32
+wl_cfgp2p_supported(struct bcm_cfg80211 *cfg, struct net_device *ndev)
+{
+	s32 ret = BCME_OK;
+	s32 p2p_supported = 0;
+	ret = wldev_iovar_getint(ndev, "p2p",
+	               &p2p_supported);
+	if (ret < 0) {
+		if (ret == BCME_UNSUPPORTED) {
+			CFGP2P_INFO(("p2p is unsupported\n"));
+			return 0;
+		} else {
+			CFGP2P_ERR(("cfg p2p error %d\n", ret));
+			return ret;
+		}
+	}
+	if (p2p_supported == 1) {
+		CFGP2P_INFO(("p2p is supported\n"));
+	} else {
+		CFGP2P_INFO(("p2p is unsupported\n"));
+		p2p_supported = 0;
+	}
+	return p2p_supported;
+}
+/* Cleanup P2P resources */
+s32
+wl_cfgp2p_down(struct bcm_cfg80211 *cfg)
+{
+	struct net_device *ndev = NULL;
+	struct wireless_dev *wdev = NULL;
+	s32 i = 0, index = -1;
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+	wdev = bcmcfg_to_p2p_wdev(cfg);
+#ifdef P2PONEINT
+	ndev = wdev_to_ndev(wdev);
+#else
+	ndev = bcmcfg_to_prmry_ndev(cfg);
+#endif
+#elif defined(WL_ENABLE_P2P_IF)
+	ndev = cfg->p2p_net ? cfg->p2p_net : bcmcfg_to_prmry_ndev(cfg);
+	wdev = ndev_to_wdev(ndev);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+	wl_cfgp2p_cancel_listen(cfg, ndev, wdev, TRUE);
+	for (i = 0; i < P2PAPI_BSSCFG_MAX; i++) {
+			index = wl_to_p2p_bss_bssidx(cfg, i);
+			if (index != WL_INVALID)
+				wl_cfgp2p_clear_management_ie(cfg, index);
+	}
+	wl_cfgp2p_deinit_priv(cfg);
+	return 0;
+}
+s32
+wl_cfgp2p_set_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+	s32 ret = -1;
+	int count, start, duration;
+	wl_p2p_sched_t dongle_noa;
+
+	CFGP2P_DBG((" Enter\n"));
+
+	memset(&dongle_noa, 0, sizeof(dongle_noa));
+
+	if (cfg->p2p && cfg->p2p->vif_created) {
+
+		cfg->p2p->noa.desc[0].start = 0;
+
+		sscanf(buf, "%10d %10d %10d", &count, &start, &duration);
+		CFGP2P_DBG(("set_p2p_noa count %d start %d duration %d\n",
+			count, start, duration));
+		if (count != -1)
+			cfg->p2p->noa.desc[0].count = count;
+
+		/* supplicant gives interval as start */
+		if (start != -1)
+			cfg->p2p->noa.desc[0].interval = start;
+
+		if (duration != -1)
+			cfg->p2p->noa.desc[0].duration = duration;
+
+		if (cfg->p2p->noa.desc[0].count != 255 && cfg->p2p->noa.desc[0].count != 0) {
+			cfg->p2p->noa.desc[0].start = 200;
+			dongle_noa.type = WL_P2P_SCHED_TYPE_REQ_ABS;
+			dongle_noa.action = WL_P2P_SCHED_ACTION_GOOFF;
+			dongle_noa.option = WL_P2P_SCHED_OPTION_TSFOFS;
+		}
+		else if (cfg->p2p->noa.desc[0].count == 0) {
+			cfg->p2p->noa.desc[0].start = 0;
+			dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+			dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+			dongle_noa.action = WL_P2P_SCHED_ACTION_RESET;
+		}
+		else {
+			/* Continuous NoA interval. */
+			dongle_noa.action = WL_P2P_SCHED_ACTION_NONE;
+			dongle_noa.type = WL_P2P_SCHED_TYPE_ABS;
+			if ((cfg->p2p->noa.desc[0].interval == 102) ||
+				(cfg->p2p->noa.desc[0].interval == 100)) {
+				cfg->p2p->noa.desc[0].start = 100 -
+					cfg->p2p->noa.desc[0].duration;
+				dongle_noa.option = WL_P2P_SCHED_OPTION_BCNPCT;
+			}
+			else {
+				dongle_noa.option = WL_P2P_SCHED_OPTION_NORMAL;
+			}
+		}
+		/* Put the noa descriptor in dongle format for dongle */
+		dongle_noa.desc[0].count = htod32(cfg->p2p->noa.desc[0].count);
+		if (dongle_noa.option == WL_P2P_SCHED_OPTION_BCNPCT) {
+			dongle_noa.desc[0].start = htod32(cfg->p2p->noa.desc[0].start);
+			dongle_noa.desc[0].duration = htod32(cfg->p2p->noa.desc[0].duration);
+		}
+		else {
+			dongle_noa.desc[0].start = htod32(cfg->p2p->noa.desc[0].start*1000);
+			dongle_noa.desc[0].duration = htod32(cfg->p2p->noa.desc[0].duration*1000);
+		}
+		dongle_noa.desc[0].interval = htod32(cfg->p2p->noa.desc[0].interval*1000);
+
+		ret = wldev_iovar_setbuf(wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION),
+			"p2p_noa", &dongle_noa, sizeof(dongle_noa), cfg->ioctl_buf,
+			WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+
+		if (ret < 0) {
+			CFGP2P_ERR(("fw set p2p_noa failed %d\n", ret));
+		}
+	}
+	else {
+		CFGP2P_ERR(("ERROR: set_noa in non-p2p mode\n"));
+	}
+	return ret;
+}
+s32
+wl_cfgp2p_get_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int buf_len)
+{
+
+	wifi_p2p_noa_desc_t *noa_desc;
+	int len = 0, i;
+	char _buf[200];
+
+	CFGP2P_DBG((" Enter\n"));
+	buf[0] = '\0';
+	if (cfg->p2p && cfg->p2p->vif_created) {
+		if (cfg->p2p->noa.desc[0].count || cfg->p2p->ops.ops) {
+			_buf[0] = 1; /* noa index */
+			_buf[1] = (cfg->p2p->ops.ops ? 0x80: 0) |
+				(cfg->p2p->ops.ctw & 0x7f); /* ops + ctw */
+			len += 2;
+			if (cfg->p2p->noa.desc[0].count) {
+				noa_desc = (wifi_p2p_noa_desc_t*)&_buf[len];
+				noa_desc->cnt_type = cfg->p2p->noa.desc[0].count;
+				noa_desc->duration = cfg->p2p->noa.desc[0].duration;
+				noa_desc->interval = cfg->p2p->noa.desc[0].interval;
+				noa_desc->start = cfg->p2p->noa.desc[0].start;
+				len += sizeof(wifi_p2p_noa_desc_t);
+			}
+			if (buf_len <= len * 2) {
+				CFGP2P_ERR(("ERROR: buf_len %d in not enough for"
+					"returning noa in string format\n", buf_len));
+				return -1;
+			}
+			/* We have to convert the buffer data into ASCII strings */
+			for (i = 0; i < len; i++) {
+				snprintf(buf, 3, "%02x", _buf[i]);
+				buf += 2;
+			}
+			buf[i*2] = '\0';
+		}
+	}
+	else {
+		CFGP2P_ERR(("ERROR: get_noa in non-p2p mode\n"));
+		return -1;
+	}
+	return len * 2;
+}
+s32
+wl_cfgp2p_set_p2p_ps(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len)
+{
+	int ps, ctw;
+	int ret = -1;
+	s32 legacy_ps;
+	struct net_device *dev;
+
+	CFGP2P_DBG((" Enter\n"));
+	if (cfg->p2p && cfg->p2p->vif_created) {
+		sscanf(buf, "%10d %10d %10d", &legacy_ps, &ps, &ctw);
+		CFGP2P_DBG((" Enter legacy_ps %d ps %d ctw %d\n", legacy_ps, ps, ctw));
+		dev = wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION);
+		if (ctw != -1) {
+			cfg->p2p->ops.ctw = ctw;
+			ret = 0;
+		}
+		if (ps != -1) {
+			cfg->p2p->ops.ops = ps;
+			ret = wldev_iovar_setbuf(dev,
+				"p2p_ops", &cfg->p2p->ops, sizeof(cfg->p2p->ops),
+				cfg->ioctl_buf, WLC_IOCTL_MAXLEN, &cfg->ioctl_buf_sync);
+			if (ret < 0) {
+				CFGP2P_ERR(("fw set p2p_ops failed %d\n", ret));
+			}
+		}
+
+		if ((legacy_ps != -1) && ((legacy_ps == PM_MAX) || (legacy_ps == PM_OFF))) {
+			ret = wldev_ioctl(dev,
+				WLC_SET_PM, &legacy_ps, sizeof(legacy_ps), true);
+			if (unlikely(ret))
+				CFGP2P_ERR(("error (%d)\n", ret));
+			wl_cfg80211_update_power_mode(dev);
+		}
+		else
+			CFGP2P_ERR(("ilegal setting\n"));
+	}
+	else {
+		CFGP2P_ERR(("ERROR: set_p2p_ps in non-p2p mode\n"));
+		ret = -1;
+	}
+	return ret;
+}
+
+u8 *
+wl_cfgp2p_retreive_p2pattrib(void *buf, u8 element_id)
+{
+	wifi_p2p_ie_t *ie = NULL;
+	u16 len = 0;
+	u8 *subel;
+	u8 subelt_id;
+	u16 subelt_len;
+
+	if (!buf) {
+		WL_ERR(("P2P IE not present"));
+		return 0;
+	}
+
+	ie = (wifi_p2p_ie_t*) buf;
+	len = ie->len;
+
+	/* Point subel to the P2P IE's subelt field.
+	 * Subtract the preceding fields (id, len, OUI, oui_type) from the length.
+	 */
+	subel = ie->subelts;
+	len -= 4;	/* exclude OUI + OUI_TYPE */
+
+	while (len >= 3) {
+		/* attribute id */
+		subelt_id = *subel;
+		subel += 1;
+		len -= 1;
+
+		/* 2-byte little endian */
+		subelt_len = *subel++;
+		subelt_len |= *subel++ << 8;
+
+		len -= 2;
+		len -= subelt_len;	/* for the remaining subelt fields */
+
+		if (subelt_id == element_id) {
+			/* This will point to start of subelement attrib after
+			 * attribute id & len
+			 */
+			return subel;
+		}
+
+		/* Go to next subelement */
+		subel += subelt_len;
+	}
+
+	/* Not Found */
+	return NULL;
+}
+
+#define P2P_GROUP_CAPAB_GO_BIT	0x01
+
+u8*
+wl_cfgp2p_find_attrib_in_all_p2p_Ies(u8 *parse, u32 len, u32 attrib)
+{
+	bcm_tlv_t *ie;
+	u8* pAttrib;
+
+	CFGP2P_INFO(("Starting parsing parse %p attrib %d remaining len %d ", parse, attrib, len));
+	while ((ie = bcm_parse_tlvs(parse, (int)len, DOT11_MNG_VS_ID))) {
+		if (wl_cfgp2p_is_p2p_ie((uint8*)ie, &parse, &len) == TRUE) {
+			/* Have the P2p ie. Now check for attribute */
+			if ((pAttrib = wl_cfgp2p_retreive_p2pattrib(parse, attrib)) != NULL) {
+				CFGP2P_INFO(("P2P attribute %d was found at parse %p",
+					attrib, parse));
+				return pAttrib;
+			}
+			else {
+				parse += (ie->len + TLV_HDR_LEN);
+				len -= (ie->len + TLV_HDR_LEN);
+				CFGP2P_INFO(("P2P Attribute %d not found Moving parse"
+					" to %p len to %d", attrib, parse, len));
+			}
+		}
+		else {
+			/* It was not p2p IE. parse will get updated automatically to next TLV */
+			CFGP2P_INFO(("IT was NOT P2P IE parse %p len %d", parse, len));
+		}
+	}
+	CFGP2P_ERR(("P2P attribute %d was NOT found", attrib));
+	return NULL;
+}
+
+u8 *
+wl_cfgp2p_retreive_p2p_dev_addr(wl_bss_info_t *bi, u32 bi_length)
+{
+	u8 *capability = NULL;
+	bool p2p_go	= 0;
+	u8 *ptr = NULL;
+
+	if ((capability = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+	bi->ie_length, P2P_SEID_P2P_INFO)) == NULL) {
+		WL_ERR(("P2P Capability attribute not found"));
+		return NULL;
+	}
+
+	/* Check Group capability for Group Owner bit */
+	p2p_go = capability[1] & P2P_GROUP_CAPAB_GO_BIT;
+	if (!p2p_go) {
+		return bi->BSSID.octet;
+	}
+
+	/* In probe responses, DEVICE INFO attribute will be present */
+	if (!(ptr = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+	bi->ie_length,  P2P_SEID_DEV_INFO))) {
+		/* If DEVICE_INFO is not found, this might be a beacon frame.
+		 * check for DEVICE_ID in the beacon frame.
+		 */
+		ptr = wl_cfgp2p_find_attrib_in_all_p2p_Ies(((u8 *) bi) + bi->ie_offset,
+		bi->ie_length,  P2P_SEID_DEV_ID);
+	}
+
+	if (!ptr)
+		WL_ERR((" Both DEVICE_ID & DEVICE_INFO attribute not present in P2P IE "));
+
+	return ptr;
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+static void
+wl_cfgp2p_ethtool_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *info)
+{
+	snprintf(info->driver, sizeof(info->driver), "p2p");
+	snprintf(info->version, sizeof(info->version), "%lu", (unsigned long)(0));
+}
+
+struct ethtool_ops cfgp2p_ethtool_ops = {
+	.get_drvinfo = wl_cfgp2p_ethtool_get_drvinfo
+};
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#if defined(WL_ENABLE_P2P_IF) || defined(WL_NEWCFG_PRIVCMD_SUPPORT) || \
+	defined(P2PONEINT)
+#ifdef  P2PONEINT
+s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg)
+{
+
+	struct net_device *_ndev;
+	struct ether_addr primary_mac;
+	struct net_device *new_ndev;
+	chanspec_t chspec;
+	uint8 name[IFNAMSIZ];
+	s32 mode = 0;
+	s32 val = 0;
+
+
+	s32 wlif_type = -1;
+	s32 err, timeout = -1;
+
+	memset(name, 0, IFNAMSIZ);
+	strncpy(name, "p2p0", 4);
+	name[IFNAMSIZ - 1] = '\0';
+
+	if (cfg->p2p_net) {
+		CFGP2P_ERR(("p2p_net defined already.\n"));
+		return -EINVAL;
+	}
+
+	if (!cfg->p2p)
+		return -EINVAL;
+
+	if (cfg->p2p && !cfg->p2p->on && strstr(name, WL_P2P_INTERFACE_PREFIX)) {
+		p2p_on(cfg) = true;
+		wl_cfgp2p_set_firm_p2p(cfg);
+		wl_cfgp2p_init_discovery(cfg);
+		get_primary_mac(cfg, &primary_mac);
+		wl_cfgp2p_generate_bss_mac(&primary_mac,
+			&cfg->p2p->dev_addr, &cfg->p2p->int_addr);
+	}
+
+	_ndev = bcmcfg_to_prmry_ndev(cfg);
+	memset(cfg->p2p->vir_ifname, 0, IFNAMSIZ);
+	strncpy(cfg->p2p->vir_ifname, name, IFNAMSIZ - 1);
+
+	wl_cfg80211_scan_abort(cfg);
+
+
+	/* In concurrency case, STA may be already associated in a particular channel.
+	 * so retrieve the current channel of primary interface and then start the virtual
+	 * interface on that.
+	 */
+	chspec = wl_cfg80211_get_shared_freq(cfg->wdev->wiphy);
+
+	/* For P2P mode, use P2P-specific driver features to create the
+	 * bss: "cfg p2p_ifadd"
+	 */
+	wl_set_p2p_status(cfg, IF_ADDING);
+	memset(&cfg->if_event_info, 0, sizeof(cfg->if_event_info));
+	wlif_type = WL_P2P_IF_CLIENT;
+
+
+	err = wl_cfgp2p_ifadd(cfg, &cfg->p2p->int_addr, htod32(wlif_type), chspec);
+	if (unlikely(err)) {
+		wl_clr_p2p_status(cfg, IF_ADDING);
+		WL_ERR((" virtual iface add failed (%d) \n", err));
+		return -ENOMEM;
+	}
+
+	timeout = wait_event_interruptible_timeout(cfg->netif_change_event,
+		(wl_get_p2p_status(cfg, IF_ADDING) == false),
+		msecs_to_jiffies(MAX_WAIT_TIME));
+
+
+	if (timeout > 0 && !wl_get_p2p_status(cfg, IF_ADDING) && cfg->if_event_info.valid) {
+		struct wireless_dev *vwdev;
+		int pm_mode = PM_ENABLE;
+		wl_if_event_info *event = &cfg->if_event_info;
+
+		/* IF_ADD event has come back, we can proceed to to register
+		 * the new interface now, use the interface name provided by caller (thus
+		 * ignore the one from wlc)
+		 */
+		strncpy(cfg->if_event_info.name, name, IFNAMSIZ - 1);
+		new_ndev = wl_cfg80211_allocate_if(cfg, event->ifidx, cfg->p2p->vir_ifname,
+			event->mac, event->bssidx);
+		if (new_ndev == NULL)
+			goto fail;
+
+		wl_to_p2p_bss_ndev(cfg, P2PAPI_BSSCFG_CONNECTION) = new_ndev;
+		wl_to_p2p_bss_bssidx(cfg, P2PAPI_BSSCFG_CONNECTION) = event->bssidx;
+
+		vwdev = kzalloc(sizeof(*vwdev), GFP_KERNEL);
+		if (unlikely(!vwdev)) {
+			WL_ERR(("Could not allocate wireless device\n"));
+			goto fail;
+		}
+		vwdev->wiphy = cfg->wdev->wiphy;
+		WL_TRACE(("virtual interface(%s) is created\n", cfg->p2p->vir_ifname));
+		vwdev->iftype = NL80211_IFTYPE_P2P_DEVICE;
+		vwdev->netdev = new_ndev;
+		new_ndev->ieee80211_ptr = vwdev;
+		SET_NETDEV_DEV(new_ndev, wiphy_dev(vwdev->wiphy));
+		wl_set_drv_status(cfg, READY, new_ndev);
+		cfg->p2p->vif_created = true;
+		wl_set_mode_by_netdev(cfg, new_ndev, mode);
+
+		if (wl_cfg80211_register_if(cfg, event->ifidx, new_ndev) != BCME_OK) {
+			wl_cfg80211_remove_if(cfg, event->ifidx, new_ndev);
+			goto fail;
+		}
+
+		wl_alloc_netinfo(cfg, new_ndev, vwdev, mode, pm_mode);
+		val = 1;
+		/* Disable firmware roaming for P2P interface  */
+		wldev_iovar_setint(new_ndev, "roam_off", val);
+
+		if (mode != WL_MODE_AP)
+			wldev_iovar_setint(new_ndev, "buf_key_b4_m4", 1);
+
+		WL_ERR((" virtual interface(%s) is "
+					"created net attach done\n", cfg->p2p->vir_ifname));
+
+		/* reinitialize completion to clear previous count */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(3, 13, 0))
+		INIT_COMPLETION(cfg->iface_disable);
+#else
+		init_completion(&cfg->iface_disable);
+#endif
+		cfg->p2p_net = new_ndev;
+		cfg->p2p_wdev = vwdev;
+
+		return 0;
+	} else {
+		wl_clr_p2p_status(cfg, IF_ADDING);
+		WL_ERR((" virtual interface(%s) is not created \n", cfg->p2p->vir_ifname));
+		memset(cfg->p2p->vir_ifname, '\0', IFNAMSIZ);
+		cfg->p2p->vif_created = false;
+	}
+
+
+fail:
+	if (wlif_type == WL_P2P_IF_GO)
+		wldev_iovar_setint(_ndev, "mpc", 1);
+	return -ENODEV;
+
+}
+#else
+s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg)
+{
+	int ret = 0;
+	struct net_device* net = NULL;
+#ifndef	WL_NEWCFG_PRIVCMD_SUPPORT
+	struct wireless_dev *wdev = NULL;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+	uint8 temp_addr[ETHER_ADDR_LEN] = { 0x00, 0x90, 0x4c, 0x33, 0x22, 0x11 };
+
+	if (cfg->p2p_net) {
+		CFGP2P_ERR(("p2p_net defined already.\n"));
+		return -EINVAL;
+	}
+
+	/* Allocate etherdev, including space for private structure */
+	if (!(net = alloc_etherdev(sizeof(struct bcm_cfg80211 *)))) {
+		CFGP2P_ERR(("%s: OOM - alloc_etherdev\n", __FUNCTION__));
+		return -ENODEV;
+	}
+
+#ifndef	WL_NEWCFG_PRIVCMD_SUPPORT
+	wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+	if (unlikely(!wdev)) {
+		WL_ERR(("Could not allocate wireless device\n"));
+		free_netdev(net);
+		return -ENOMEM;
+	}
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	strncpy(net->name, "p2p%d", sizeof(net->name) - 1);
+	net->name[IFNAMSIZ - 1] = '\0';
+
+	/* Copy the reference to bcm_cfg80211 */
+	memcpy((void *)netdev_priv(net), &cfg, sizeof(struct bcm_cfg80211 *));
+
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31))
+	ASSERT(!net->open);
+	net->do_ioctl = wl_cfgp2p_do_ioctl;
+	net->hard_start_xmit = wl_cfgp2p_start_xmit;
+	net->open = wl_cfgp2p_if_open;
+	net->stop = wl_cfgp2p_if_stop;
+#else
+	ASSERT(!net->netdev_ops);
+	net->netdev_ops = &wl_cfgp2p_if_ops;
+#endif
+
+	/* Register with a dummy MAC addr */
+	memcpy(net->dev_addr, temp_addr, ETHER_ADDR_LEN);
+
+#ifndef	WL_NEWCFG_PRIVCMD_SUPPORT
+	wdev->wiphy = cfg->wdev->wiphy;
+
+	wdev->iftype = wl_mode_to_nl80211_iftype(WL_MODE_BSS);
+
+	net->ieee80211_ptr = wdev;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+	net->ethtool_ops = &cfgp2p_ethtool_ops;
+#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24) */
+
+#ifndef	WL_NEWCFG_PRIVCMD_SUPPORT
+	SET_NETDEV_DEV(net, wiphy_dev(wdev->wiphy));
+
+	/* Associate p2p0 network interface with new wdev */
+	wdev->netdev = net;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	ret = register_netdev(net);
+	if (ret) {
+		CFGP2P_ERR((" register_netdevice failed (%d)\n", ret));
+		free_netdev(net);
+#ifndef	WL_NEWCFG_PRIVCMD_SUPPORT
+		kfree(wdev);
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+		return -ENODEV;
+	}
+
+	/* store p2p net ptr for further reference. Note that iflist won't have this
+	 * entry as there corresponding firmware interface is a "Hidden" interface.
+	 */
+#ifndef	WL_NEWCFG_PRIVCMD_SUPPORT
+	cfg->p2p_wdev = wdev;
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+	cfg->p2p_net = net;
+
+	printf("%s: P2P Interface Registered\n", net->name);
+
+	return ret;
+}
+#endif /* P2PONEINT */
+
+s32
+wl_cfgp2p_unregister_ndev(struct bcm_cfg80211 *cfg)
+{
+
+	if (!cfg || !cfg->p2p_net) {
+		CFGP2P_ERR(("Invalid Ptr\n"));
+		return -EINVAL;
+	}
+
+	unregister_netdev(cfg->p2p_net);
+	free_netdev(cfg->p2p_net);
+
+	return 0;
+}
+
+#ifndef  P2PONEINT
+static int wl_cfgp2p_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+
+	if (skb)
+	{
+		CFGP2P_DBG(("(%s) is not used for data operations.Droping the packet.\n",
+			ndev->name));
+		dev_kfree_skb_any(skb);
+	}
+
+	return 0;
+}
+
+static int wl_cfgp2p_do_ioctl(struct net_device *net, struct ifreq *ifr, int cmd)
+{
+	int ret = 0;
+	struct bcm_cfg80211 *cfg = *(struct bcm_cfg80211 **)netdev_priv(net);
+	struct net_device *ndev = bcmcfg_to_prmry_ndev(cfg);
+
+	/* There is no ifidx corresponding to p2p0 in our firmware. So we should
+	 * not Handle any IOCTL cmds on p2p0 other than ANDROID PRIVATE CMDs.
+	 * For Android PRIV CMD handling map it to primary I/F
+	 */
+	if (cmd == SIOCDEVPRIVATE+1) {
+		ret = wl_android_priv_cmd(ndev, ifr, cmd);
+
+	} else {
+		CFGP2P_DBG(("%s: IOCTL req 0x%x on p2p0 I/F. Ignoring. \n",
+		__FUNCTION__, cmd));
+		return -1;
+	}
+
+	return ret;
+}
+#endif /*  P2PONEINT */
+#endif /* WL_ENABLE_P2P_IF || WL_NEWCFG_PRIVCMD_SUPPORT || defined(P2PONEINT) */
+
+#if defined(WL_ENABLE_P2P_IF) || defined(P2PONEINT)
+int
+#ifdef  P2PONEINT
+wl_cfgp2p_if_open(struct net_device *net)
+#else
+wl_cfgp2p_if_open(struct net_device *net)
+#endif
+{
+	struct wireless_dev *wdev = net->ieee80211_ptr;
+
+	if (!wdev || !wl_cfg80211_is_p2p_active())
+		return -EINVAL;
+	WL_TRACE(("Enter\n"));
+#if !defined(WL_IFACE_COMB_NUM_CHANNELS)
+	/* If suppose F/W download (ifconfig wlan0 up) hasn't been done by now,
+	 * do it here. This will make sure that in concurrent mode, supplicant
+	 * is not dependent on a particular order of interface initialization.
+	 * i.e you may give wpa_supp -iwlan0 -N -ip2p0 or wpa_supp -ip2p0 -N
+	 * -iwlan0.
+	 */
+	wdev->wiphy->interface_modes |= (BIT(NL80211_IFTYPE_P2P_CLIENT)
+		| BIT(NL80211_IFTYPE_P2P_GO));
+#endif /* !WL_IFACE_COMB_NUM_CHANNELS */
+	wl_cfg80211_do_driver_init(net);
+
+	return 0;
+}
+
+int
+#ifdef  P2PONEINT
+wl_cfgp2p_if_stop(struct net_device *net)
+#else
+wl_cfgp2p_if_stop(struct net_device *net)
+#endif
+{
+	struct wireless_dev *wdev = net->ieee80211_ptr;
+#ifdef P2PONEINT
+	bcm_struct_cfgdev *cfgdev;
+#endif
+	if (!wdev)
+		return -EINVAL;
+
+#ifdef P2PONEINT
+	cfgdev = ndev_to_cfgdev(net);
+	wl_cfg80211_scan_stop(cfgdev);
+#else
+	wl_cfg80211_scan_stop(net);
+#endif
+
+#if !defined(WL_IFACE_COMB_NUM_CHANNELS)
+	wdev->wiphy->interface_modes = (wdev->wiphy->interface_modes)
+					& (~(BIT(NL80211_IFTYPE_P2P_CLIENT)|
+					BIT(NL80211_IFTYPE_P2P_GO)));
+#endif /* !WL_IFACE_COMB_NUM_CHANNELS */
+	return 0;
+}
+#endif /* defined(WL_ENABLE_P2P_IF) || defined(P2PONEINT) */
+
+#if defined(WL_ENABLE_P2P_IF)
+bool wl_cfgp2p_is_ifops(const struct net_device_ops *if_ops)
+{
+	return (if_ops == &wl_cfgp2p_if_ops);
+}
+#endif /* WL_ENABLE_P2P_IF */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+struct wireless_dev *
+wl_cfgp2p_add_p2p_disc_if(struct bcm_cfg80211 *cfg)
+{
+	struct wireless_dev *wdev = NULL;
+	struct ether_addr primary_mac;
+
+	if (!cfg || !cfg->p2p_supported)
+		return ERR_PTR(-EINVAL);
+
+	WL_TRACE(("Enter\n"));
+
+	if (cfg->p2p_wdev) {
+		CFGP2P_ERR(("p2p_wdev defined already.\n"));
+#if (defined(CUSTOMER_HW10) && defined(CONFIG_ARCH_ODIN))
+		wl_cfgp2p_del_p2p_disc_if(cfg->p2p_wdev, cfg);
+		CFGP2P_ERR(("p2p_wdev deleted.\n"));
+#else
+		return ERR_PTR(-ENFILE);
+#endif
+	}
+
+	wdev = kzalloc(sizeof(*wdev), GFP_KERNEL);
+	if (unlikely(!wdev)) {
+		WL_ERR(("Could not allocate wireless device\n"));
+		return ERR_PTR(-ENOMEM);
+	}
+
+	memset(&primary_mac, 0, sizeof(primary_mac));
+	get_primary_mac(cfg, &primary_mac);
+	wl_cfgp2p_generate_bss_mac(&primary_mac,
+		&cfg->p2p->dev_addr, &cfg->p2p->int_addr);
+
+	wdev->wiphy = cfg->wdev->wiphy;
+	wdev->iftype = NL80211_IFTYPE_P2P_DEVICE;
+	memcpy(wdev->address, &cfg->p2p->dev_addr, ETHER_ADDR_LEN);
+
+#if defined(WL_NEWCFG_PRIVCMD_SUPPORT)
+	if (cfg->p2p_net)
+		memcpy(cfg->p2p_net->dev_addr, &cfg->p2p->dev_addr, ETHER_ADDR_LEN);
+#endif /* WL_NEWCFG_PRIVCMD_SUPPORT */
+
+	/* store p2p wdev ptr for further reference. */
+	cfg->p2p_wdev = wdev;
+
+	WL_TRACE(("P2P interface registered\n"));
+
+	return wdev;
+}
+
+int
+wl_cfgp2p_start_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+	int ret = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+	if (!cfg)
+		return -EINVAL;
+
+	WL_TRACE(("Enter\n"));
+
+	ret = wl_cfgp2p_set_firm_p2p(cfg);
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR(("Set P2P in firmware failed, ret=%d\n", ret));
+		goto exit;
+	}
+
+	ret = wl_cfgp2p_enable_discovery(cfg, bcmcfg_to_prmry_ndev(cfg), NULL, 0);
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR(("P2P enable discovery failed, ret=%d\n", ret));
+		goto exit;
+	}
+
+	p2p_on(cfg) = true;
+
+	CFGP2P_DBG(("P2P interface started\n"));
+
+exit:
+	return ret;
+}
+
+void
+wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+	int ret = 0;
+	struct bcm_cfg80211 *cfg = wiphy_priv(wiphy);
+
+	if (!cfg)
+		return;
+
+	WL_TRACE(("Enter\n"));
+
+	ret = wl_cfg80211_scan_stop(wdev);
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR(("P2P scan stop failed, ret=%d\n", ret));
+	}
+
+	if (!cfg->p2p)
+		return;
+
+	ret = wl_cfgp2p_disable_discovery(cfg);
+	if (unlikely(ret < 0)) {
+		CFGP2P_ERR(("P2P disable discovery failed, ret=%d\n", ret));
+	}
+
+	p2p_on(cfg) = false;
+
+	CFGP2P_DBG(("P2P interface stopped\n"));
+
+	return;
+}
+
+int
+wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg)
+{
+	bool rollback_lock = false;
+
+	if (!wdev)
+		return -EINVAL;
+
+#ifdef P2PONEINT
+	return -EINVAL;
+#endif
+
+	WL_TRACE(("Enter\n"));
+
+	if (!rtnl_is_locked()) {
+		rtnl_lock();
+		rollback_lock = true;
+	}
+
+	cfg80211_unregister_wdev(wdev);
+
+	if (rollback_lock)
+		rtnl_unlock();
+
+	kfree(wdev);
+
+	if (cfg)
+		cfg->p2p_wdev = NULL;
+
+	CFGP2P_ERR(("P2P interface unregistered\n"));
+
+	return 0;
+}
+#endif /* WL_CFG80211_P2P_DEV_IF */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_cfgp2p.h b/drivers/net/wireless/bcm4336/wl_cfgp2p.h
--- a/drivers/net/wireless/bcm4336/wl_cfgp2p.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_cfgp2p.h	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,398 @@
+/*
+ * Linux cfgp2p driver
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfgp2p.h 497431 2014-08-19 11:03:27Z $
+ */
+#ifndef _wl_cfgp2p_h_
+#define _wl_cfgp2p_h_
+#include <proto/802.11.h>
+#include <proto/p2p.h>
+
+struct bcm_cfg80211;
+extern u32 wl_dbg_level;
+
+typedef struct wifi_p2p_ie wifi_wfd_ie_t;
+/* Enumeration of the usages of the BSSCFGs used by the P2P Library.  Do not
+ * confuse this with a bsscfg index.  This value is an index into the
+ * saved_ie[] array of structures which in turn contains a bsscfg index field.
+ */
+typedef enum {
+	P2PAPI_BSSCFG_PRIMARY, /* maps to driver's primary bsscfg */
+	P2PAPI_BSSCFG_DEVICE, /* maps to driver's P2P device discovery bsscfg */
+	P2PAPI_BSSCFG_CONNECTION, /* maps to driver's P2P connection bsscfg */
+	P2PAPI_BSSCFG_MAX
+} p2p_bsscfg_type_t;
+
+typedef enum {
+	P2P_SCAN_PURPOSE_MIN,
+	P2P_SCAN_SOCIAL_CHANNEL, /* scan for social channel */
+	P2P_SCAN_AFX_PEER_NORMAL, /* scan for action frame search */
+	P2P_SCAN_AFX_PEER_REDUCED, /* scan for action frame search with short time */
+	P2P_SCAN_DURING_CONNECTED, /* scan during connected status */
+	P2P_SCAN_CONNECT_TRY, /* scan for connecting */
+	P2P_SCAN_NORMAL, /* scan during not-connected status */
+	P2P_SCAN_PURPOSE_MAX
+} p2p_scan_purpose_t;
+
+/* vendor ies max buffer length for probe response or beacon */
+#define VNDR_IES_MAX_BUF_LEN	1400
+/* normal vendor ies buffer length */
+#define VNDR_IES_BUF_LEN 		512
+
+/* Structure to hold all saved P2P and WPS IEs for a BSSCFG */
+struct p2p_saved_ie {
+	u8  p2p_probe_req_ie[VNDR_IES_BUF_LEN];
+	u8  p2p_probe_res_ie[VNDR_IES_MAX_BUF_LEN];
+	u8  p2p_assoc_req_ie[VNDR_IES_BUF_LEN];
+	u8  p2p_assoc_res_ie[VNDR_IES_BUF_LEN];
+	u8  p2p_beacon_ie[VNDR_IES_MAX_BUF_LEN];
+	u32 p2p_probe_req_ie_len;
+	u32 p2p_probe_res_ie_len;
+	u32 p2p_assoc_req_ie_len;
+	u32 p2p_assoc_res_ie_len;
+	u32 p2p_beacon_ie_len;
+};
+
+struct p2p_bss {
+	s32 bssidx;
+	struct net_device *dev;
+	struct p2p_saved_ie saved_ie;
+	void *private_data;
+};
+
+struct p2p_info {
+	bool on;    /* p2p on/off switch */
+	bool scan;
+	int16 search_state;
+	bool vif_created;
+	s8 vir_ifname[IFNAMSIZ];
+	unsigned long status;
+	struct ether_addr dev_addr;
+	struct ether_addr int_addr;
+	struct p2p_bss bss[P2PAPI_BSSCFG_MAX];
+	struct timer_list listen_timer;
+	wl_p2p_sched_t noa;
+	wl_p2p_ops_t ops;
+	wlc_ssid_t ssid;
+};
+
+#define MAX_VNDR_IE_NUMBER	5
+
+struct parsed_vndr_ie_info {
+	char *ie_ptr;
+	u32 ie_len;	/* total length including id & length field */
+	vndr_ie_t vndrie;
+};
+
+struct parsed_vndr_ies {
+	u32 count;
+	struct parsed_vndr_ie_info ie_info[MAX_VNDR_IE_NUMBER];
+};
+
+/* dongle status */
+enum wl_cfgp2p_status {
+	WLP2P_STATUS_DISCOVERY_ON = 0,
+	WLP2P_STATUS_SEARCH_ENABLED,
+	WLP2P_STATUS_IF_ADDING,
+	WLP2P_STATUS_IF_DELETING,
+	WLP2P_STATUS_IF_CHANGING,
+	WLP2P_STATUS_IF_CHANGED,
+	WLP2P_STATUS_LISTEN_EXPIRED,
+	WLP2P_STATUS_ACTION_TX_COMPLETED,
+	WLP2P_STATUS_ACTION_TX_NOACK,
+	WLP2P_STATUS_SCANNING,
+	WLP2P_STATUS_GO_NEG_PHASE,
+	WLP2P_STATUS_DISC_IN_PROGRESS
+};
+
+
+#define wl_to_p2p_bss_ndev(cfg, type)		((cfg)->p2p->bss[type].dev)
+#define wl_to_p2p_bss_bssidx(cfg, type)		((cfg)->p2p->bss[type].bssidx)
+#define wl_to_p2p_bss_saved_ie(cfg, type)	((cfg)->p2p->bss[type].saved_ie)
+#define wl_to_p2p_bss_private(cfg, type)		((cfg)->p2p->bss[type].private_data)
+#define wl_to_p2p_bss(cfg, type)			((cfg)->p2p->bss[type])
+#define wl_get_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+		test_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_set_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+		set_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_clr_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+		clear_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define wl_chg_p2p_status(cfg, stat) ((!(cfg)->p2p_supported) ? 0 : \
+	change_bit(WLP2P_STATUS_ ## stat, &(cfg)->p2p->status))
+#define p2p_on(cfg) ((cfg)->p2p->on)
+#define p2p_scan(cfg) ((cfg)->p2p->scan)
+#define p2p_is_on(cfg) ((cfg)->p2p && (cfg)->p2p->on)
+
+/* dword align allocation */
+#define WLC_IOCTL_MAXLEN 8192
+
+#define CFGP2P_ERROR_TEXT		"CFGP2P-ERROR) "
+
+
+#define CFGP2P_ERR(args)									\
+	do {										\
+		if (wl_dbg_level & WL_DBG_ERR) {				\
+			printk(KERN_INFO CFGP2P_ERROR_TEXT "%s : ", __func__);	\
+			printk args;						\
+		}									\
+	} while (0)
+#define	CFGP2P_INFO(args)									\
+	do {										\
+		if (wl_dbg_level & WL_DBG_INFO) {				\
+			printk(KERN_INFO "CFGP2P-INFO) %s : ", __func__);	\
+			printk args;						\
+		}									\
+	} while (0)
+#define	CFGP2P_DBG(args)								\
+	do {									\
+		if (wl_dbg_level & WL_DBG_DBG) {			\
+			printk(KERN_INFO "CFGP2P-DEBUG) %s :", __func__);	\
+			printk args;							\
+		}									\
+	} while (0)
+
+#define	CFGP2P_ACTION(args)								\
+	do {									\
+		if (wl_dbg_level & WL_DBG_P2P_ACTION) {			\
+			printk(KERN_INFO "CFGP2P-ACTION) %s :", __func__);	\
+			printk args;							\
+		}									\
+	} while (0)
+#define INIT_TIMER(timer, func, duration, extra_delay)	\
+	do {				   \
+		init_timer(timer); \
+		timer->function = func; \
+		timer->expires = jiffies + msecs_to_jiffies(duration + extra_delay); \
+		timer->data = (unsigned long) cfg; \
+		add_timer(timer); \
+	} while (0);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)) && !defined(WL_CFG80211_P2P_DEV_IF)
+#define WL_CFG80211_P2P_DEV_IF
+
+#ifdef WL_ENABLE_P2P_IF
+#undef WL_ENABLE_P2P_IF
+#endif
+
+#ifdef WL_SUPPORT_BACKPORTED_KPATCHES
+#undef WL_SUPPORT_BACKPORTED_KPATCHES
+#endif
+#else
+#ifdef WLP2P
+#ifndef WL_ENABLE_P2P_IF
+/* Enable P2P network Interface if P2P support is enabled */
+#define WL_ENABLE_P2P_IF
+#endif /* WL_ENABLE_P2P_IF */
+#endif /* WLP2P */
+#endif /* (LINUX_VERSION >= VERSION(3, 8, 0)) */
+
+#ifndef WL_CFG80211_P2P_DEV_IF
+#ifdef WL_NEWCFG_PRIVCMD_SUPPORT
+#undef WL_NEWCFG_PRIVCMD_SUPPORT
+#endif
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+#if defined(WL_ENABLE_P2P_IF) && (defined(WL_CFG80211_P2P_DEV_IF) || \
+	(LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)))
+#error Disable 'WL_ENABLE_P2P_IF', if 'WL_CFG80211_P2P_DEV_IF' is enabled \
+	or kernel version is 3.8.0 or above
+#endif /* WL_ENABLE_P2P_IF && (WL_CFG80211_P2P_DEV_IF || (LINUX_VERSION >= VERSION(3, 8, 0))) */
+
+#if !defined(WLP2P) && (defined(WL_ENABLE_P2P_IF) || defined(WL_CFG80211_P2P_DEV_IF))
+#error WLP2P not defined
+#endif /* !WLP2P && (WL_ENABLE_P2P_IF || WL_CFG80211_P2P_DEV_IF) */
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+#define bcm_struct_cfgdev	struct wireless_dev
+#else
+#define bcm_struct_cfgdev	struct net_device
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+extern void
+wl_cfgp2p_listen_expired(unsigned long data);
+extern bool
+wl_cfgp2p_is_pub_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_p2p_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_is_gas_action(void *frame, u32 frame_len);
+extern bool
+wl_cfgp2p_find_gas_subtype(u8 subtype, u8* data, u32 len);
+extern void
+wl_cfgp2p_print_actframe(bool tx, void *frame, u32 frame_len, u32 channel);
+extern s32
+wl_cfgp2p_init_priv(struct bcm_cfg80211 *cfg);
+extern void
+wl_cfgp2p_deinit_priv(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_set_firm_p2p(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_set_p2p_mode(struct bcm_cfg80211 *cfg, u8 mode,
+            u32 channel, u16 listen_ms, int bssidx);
+extern s32
+wl_cfgp2p_ifadd(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type,
+            chanspec_t chspec);
+extern s32
+wl_cfgp2p_ifdisable(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifdel(struct bcm_cfg80211 *cfg, struct ether_addr *mac);
+extern s32
+wl_cfgp2p_ifchange(struct bcm_cfg80211 *cfg, struct ether_addr *mac, u8 if_type, chanspec_t chspec);
+
+extern s32
+wl_cfgp2p_ifidx(struct bcm_cfg80211 *cfg, struct ether_addr *mac, s32 *index);
+
+extern s32
+wl_cfgp2p_init_discovery(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_enable_discovery(struct bcm_cfg80211 *cfg, struct net_device *dev, const u8 *ie,
+	u32 ie_len);
+extern s32
+wl_cfgp2p_disable_discovery(struct bcm_cfg80211 *cfg);
+extern s32
+wl_cfgp2p_escan(struct bcm_cfg80211 *cfg, struct net_device *dev, u16 active, u32 num_chans,
+	u16 *channels,
+	s32 search_state, u16 action, u32 bssidx, struct ether_addr *tx_dst_addr,
+	p2p_scan_purpose_t p2p_scan_purpose);
+
+extern s32
+wl_cfgp2p_act_frm_search(struct bcm_cfg80211 *cfg, struct net_device *ndev,
+	s32 bssidx, s32 channel, struct ether_addr *tx_dst_addr);
+
+extern wpa_ie_fixed_t *
+wl_cfgp2p_find_wpaie(u8 *parse, u32 len);
+
+extern wpa_ie_fixed_t *
+wl_cfgp2p_find_wpsie(u8 *parse, u32 len);
+
+extern wifi_p2p_ie_t *
+wl_cfgp2p_find_p2pie(u8 *parse, u32 len);
+
+extern wifi_wfd_ie_t *
+wl_cfgp2p_find_wfdie(u8 *parse, u32 len);
+extern s32
+wl_cfgp2p_set_management_ie(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bssidx,
+            s32 pktflag, const u8 *vndr_ie, u32 vndr_ie_len);
+extern s32
+wl_cfgp2p_clear_management_ie(struct bcm_cfg80211 *cfg, s32 bssidx);
+
+extern s32
+wl_cfgp2p_find_idx(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 *index);
+extern struct net_device *
+wl_cfgp2p_find_ndev(struct bcm_cfg80211 *cfg, s32 bssidx);
+extern s32
+wl_cfgp2p_find_type(struct bcm_cfg80211 *cfg, s32 bssidx, s32 *type);
+
+
+extern s32
+wl_cfgp2p_listen_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+extern s32
+wl_cfgp2p_discover_listen(struct bcm_cfg80211 *cfg, s32 channel, u32 duration_ms);
+
+extern s32
+wl_cfgp2p_discover_enable_search(struct bcm_cfg80211 *cfg, u8 enable);
+
+extern s32
+wl_cfgp2p_action_tx_complete(struct bcm_cfg80211 *cfg, bcm_struct_cfgdev *cfgdev,
+	const wl_event_msg_t *e, void *data);
+
+extern s32
+wl_cfgp2p_tx_action_frame(struct bcm_cfg80211 *cfg, struct net_device *dev,
+	wl_af_params_t *af_params, s32 bssidx);
+
+extern void
+wl_cfgp2p_generate_bss_mac(struct ether_addr *primary_addr, struct ether_addr *out_dev_addr,
+            struct ether_addr *out_int_addr);
+
+extern void
+wl_cfg80211_change_ifaddr(u8* buf, struct ether_addr *p2p_int_addr, u8 element_id);
+extern bool
+wl_cfgp2p_bss_isup(struct net_device *ndev, int bsscfg_idx);
+
+extern s32
+wl_cfgp2p_bss(struct bcm_cfg80211 *cfg, struct net_device *ndev, s32 bsscfg_idx, s32 up);
+
+
+extern s32
+wl_cfgp2p_supported(struct bcm_cfg80211 *cfg, struct net_device *ndev);
+
+extern s32
+wl_cfgp2p_down(struct bcm_cfg80211 *cfg);
+
+extern s32
+wl_cfgp2p_set_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_get_p2p_noa(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern s32
+wl_cfgp2p_set_p2p_ps(struct bcm_cfg80211 *cfg, struct net_device *ndev, char* buf, int len);
+
+extern u8 *
+wl_cfgp2p_retreive_p2pattrib(void *buf, u8 element_id);
+
+extern u8*
+wl_cfgp2p_find_attrib_in_all_p2p_Ies(u8 *parse, u32 len, u32 attrib);
+
+extern u8 *
+wl_cfgp2p_retreive_p2p_dev_addr(wl_bss_info_t *bi, u32 bi_length);
+
+extern s32
+wl_cfgp2p_register_ndev(struct bcm_cfg80211 *cfg);
+
+extern s32
+wl_cfgp2p_unregister_ndev(struct bcm_cfg80211 *cfg);
+
+extern bool
+wl_cfgp2p_is_ifops(const struct net_device_ops *if_ops);
+
+#if defined(WL_CFG80211_P2P_DEV_IF)
+extern struct wireless_dev *
+wl_cfgp2p_add_p2p_disc_if(struct bcm_cfg80211 *cfg);
+
+extern int
+wl_cfgp2p_start_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+extern void
+wl_cfgp2p_stop_p2p_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+
+extern int
+wl_cfgp2p_del_p2p_disc_if(struct wireless_dev *wdev, struct bcm_cfg80211 *cfg);
+#endif /* WL_CFG80211_P2P_DEV_IF */
+
+/* WiFi Direct */
+#define SOCIAL_CHAN_1 1
+#define SOCIAL_CHAN_2 6
+#define SOCIAL_CHAN_3 11
+#define IS_P2P_SOCIAL_CHANNEL(channel) ((channel == SOCIAL_CHAN_1) || \
+					(channel == SOCIAL_CHAN_2) || \
+					(channel == SOCIAL_CHAN_3))
+#define SOCIAL_CHAN_CNT 3
+#define AF_PEER_SEARCH_CNT 2
+#define WL_P2P_WILDCARD_SSID "DIRECT-"
+#define WL_P2P_WILDCARD_SSID_LEN 7
+#define WL_P2P_INTERFACE_PREFIX "p2p"
+#define WL_P2P_TEMP_CHAN 11
+
+/* If the provision discovery is for JOIN operations,
+ * or the device discoverablity frame is destined to GO
+ * then we need not do an internal scan to find GO.
+ */
+#define IS_ACTPUB_WITHOUT_GROUP_ID(p2p_ie, len) \
+	(wl_cfgp2p_retreive_p2pattrib(p2p_ie, P2P_SEID_GROUP_ID) == NULL)
+
+#define IS_GAS_REQ(frame, len) (wl_cfgp2p_is_gas_action(frame, len) && \
+					((frame->action == P2PSD_ACTION_ID_GAS_IREQ) || \
+					(frame->action == P2PSD_ACTION_ID_GAS_CREQ)))
+
+#define IS_P2P_PUB_ACT_RSP_SUBTYPE(subtype) ((subtype == P2P_PAF_GON_RSP) || \
+							((subtype == P2P_PAF_GON_CONF) || \
+							(subtype == P2P_PAF_INVITE_RSP) || \
+							(subtype == P2P_PAF_PROVDIS_RSP)))
+#define IS_P2P_SOCIAL(ch) ((ch == SOCIAL_CHAN_1) || (ch == SOCIAL_CHAN_2) || (ch == SOCIAL_CHAN_3))
+#define IS_P2P_SSID(ssid, len) (!memcmp(ssid, WL_P2P_WILDCARD_SSID, WL_P2P_WILDCARD_SSID_LEN) && \
+					(len == WL_P2P_WILDCARD_SSID_LEN))
+#endif				/* _wl_cfgp2p_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_cfgvendor.h b/drivers/net/wireless/bcm4336/wl_cfgvendor.h
--- a/drivers/net/wireless/bcm4336/wl_cfgvendor.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_cfgvendor.h	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,33 @@
+/*
+ * Linux cfg80211 Vendor Extension Code
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_cfgvendor.h 455257 2014-02-20 08:10:24Z $
+ */
+
+
+#ifndef _wl_cfgvendor_h_
+#define _wl_cfgvendor_h_
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0)) && !defined(VENDOR_EXT_SUPPORT)
+#define VENDOR_EXT_SUPPORT
+#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(3, 14, 0) && !VENDOR_EXT_SUPPORT */
+
+enum wl_vendor_event {
+	BRCM_VENDOR_EVENT_UNSPEC,
+	BRCM_VENDOR_EVENT_PRIV_STR
+};
+
+/* Capture the BRCM_VENDOR_SUBCMD_PRIV_STRINGS* here */
+#define BRCM_VENDOR_SCMD_CAPA	"cap"
+
+#ifdef VENDOR_EXT_SUPPORT
+extern int cfgvendor_attach(struct wiphy *wiphy);
+extern int cfgvendor_detach(struct wiphy *wiphy);
+#else
+static INLINE int cfgvendor_attach(struct wiphy *wiphy) { return 0; }
+static INLINE int cfgvendor_detach(struct wiphy *wiphy) { return 0; }
+#endif /*  VENDOR_EXT_SUPPORT */
+
+#endif /* _wl_cfgvendor_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_dbg.h b/drivers/net/wireless/bcm4336/wl_dbg.h
--- a/drivers/net/wireless/bcm4336/wl_dbg.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_dbg.h	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,392 @@
+/*
+ * Minimal debug/trace/assert driver definitions for
+ * Broadcom 802.11 Networking Adapter.
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_dbg.h 472390 2014-04-23 23:32:01Z $
+ */
+
+
+#ifndef _wl_dbg_h_
+#define _wl_dbg_h_
+
+/* wl_msg_level is a bit vector with defs in wlioctl.h */
+extern uint32 wl_msg_level;
+extern uint32 wl_msg_level2;
+
+#define WL_TIMESTAMP()
+
+#if 0 && (VERSION_MAJOR > 9)
+extern int osl_printf(const char *fmt, ...);
+#include <IOKit/apple80211/IO8Log.h>
+#define WL_PRINT(args)		do { osl_printf args; } while (0)
+#define RELEASE_PRINT(args)	do { WL_PRINT(args); IO8Log args; } while (0)
+#else
+#define WL_PRINT(args)		do { WL_TIMESTAMP(); printf args; } while (0)
+#endif
+
+#if defined(EVENT_LOG_COMPILE) && defined(WLMSG_SRSCAN)
+#define _WL_SRSCAN(fmt, ...)	EVENT_LOG(EVENT_LOG_TAG_SRSCAN, fmt, ##__VA_ARGS__)
+#define WL_SRSCAN(args)		_WL_SRSCAN args
+#else
+#define WL_SRSCAN(args)
+#endif
+
+#if defined(BCMCONDITIONAL_LOGGING)
+
+/* Ideally this should be some include file that vendors can include to conditionalize logging */
+
+/* DBGONLY() macro to reduce ifdefs in code for statements that are only needed when
+ * BCMDBG is defined.
+ */
+#define DBGONLY(x)
+
+/* To disable a message completely ... until you need it again */
+#define WL_NONE(args)
+#define WL_ERROR(args)		do {if (wl_msg_level & WL_ERROR_VAL) WL_PRINT(args);} while (0)
+#define WL_TRACE(args)
+#define WL_PRHDRS_MSG(args)
+#define WL_PRHDRS(i, p, f, t, r, l)
+#define WL_PRPKT(m, b, n)
+#define WL_INFORM(args)
+#define WL_TMP(args)
+#define WL_OID(args)
+#define WL_RATE(args)		do {if (wl_msg_level & WL_RATE_VAL) WL_PRINT(args);} while (0)
+#define WL_ASSOC(args)		do {if (wl_msg_level & WL_ASSOC_VAL) WL_PRINT(args);} while (0)
+#define WL_PRUSR(m, b, n)
+#define WL_PS(args)		do {if (wl_msg_level & WL_PS_VAL) WL_PRINT(args);} while (0)
+
+#define WL_PORT(args)
+#define WL_DUAL(args)
+#define WL_REGULATORY(args)	do {if (wl_msg_level & WL_REGULATORY_VAL) WL_PRINT(args);} while (0)
+
+#define WL_MPC(args)
+#define WL_APSTA(args)
+#define WL_APSTA_BCN(args)
+#define WL_APSTA_TX(args)
+#define WL_APSTA_TSF(args)
+#define WL_APSTA_BSSID(args)
+#define WL_BA(args)
+#define WL_MBSS(args)
+#define WL_PROTO(args)
+
+#define	WL_CAC(args)		do {if (wl_msg_level & WL_CAC_VAL) WL_PRINT(args);} while (0)
+#define WL_AMSDU(args)
+#define WL_AMPDU(args)
+#define WL_FFPLD(args)
+#define WL_MCHAN(args)
+
+#define WL_DFS(args)
+#define WL_WOWL(args)
+#define WL_DPT(args)
+#define WL_ASSOC_OR_DPT(args)
+#define WL_SCAN(args)		do {if (wl_msg_level2 & WL_SCAN_VAL) WL_PRINT(args);} while (0)
+#define WL_COEX(args)
+#define WL_RTDC(w, s, i, j)
+#define WL_RTDC2(w, s, i, j)
+#define WL_CHANINT(args)
+#define WL_BTA(args)
+#define WL_P2P(args)
+#define WL_ITFR(args)
+#define WL_TDLS(args)
+#define WL_MCNX(args)
+#define WL_PROT(args)
+#define WL_PSTA(args)
+#define WL_TRF_MGMT(args)
+#define WL_L2FILTER(args)
+#define WL_MQ(args)
+#define WL_TXBF(args)
+#define WL_P2PO(args)
+#define WL_NET_DETECT(args)
+#define WL_ROAM(args)
+#define WL_WNM(args)
+
+
+#define WL_AMPDU_UPDN(args)
+#define WL_AMPDU_RX(args)
+#define WL_AMPDU_ERR(args)
+#define WL_AMPDU_TX(args)
+#define WL_AMPDU_CTL(args)
+#define WL_AMPDU_HW(args)
+#define WL_AMPDU_HWTXS(args)
+#define WL_AMPDU_HWDBG(args)
+#define WL_AMPDU_STAT(args)
+#define WL_AMPDU_ERR_ON()       0
+#define WL_AMPDU_HW_ON()        0
+#define WL_AMPDU_HWTXS_ON()     0
+
+#define WL_APSTA_UPDN(args)
+#define WL_APSTA_RX(args)
+#define WL_WSEC(args)
+#define WL_WSEC_DUMP(args)
+#define WL_PCIE(args)
+#define WL_CHANLOG(w, s, i, j)
+
+#define WL_ERROR_ON()		(wl_msg_level & WL_ERROR_VAL)
+#define WL_TRACE_ON()		0
+#define WL_PRHDRS_ON()		0
+#define WL_PRPKT_ON()		0
+#define WL_INFORM_ON()		0
+#define WL_TMP_ON()		0
+#define WL_OID_ON()		0
+#define WL_RATE_ON()		(wl_msg_level & WL_RATE_VAL)
+#define WL_ASSOC_ON()		(wl_msg_level & WL_ASSOC_VAL)
+#define WL_PRUSR_ON()		0
+#define WL_PS_ON()		(wl_msg_level & WL_PS_VAL)
+#define WL_PORT_ON()		0
+#define WL_WSEC_ON()		0
+#define WL_WSEC_DUMP_ON()	0
+#define WL_MPC_ON()		0
+#define WL_REGULATORY_ON()	(wl_msg_level & WL_REGULATORY_VAL)
+#define WL_APSTA_ON()		0
+#define WL_DFS_ON()		0
+#define WL_MBSS_ON()		0
+#define WL_CAC_ON()		(wl_msg_level & WL_CAC_VAL)
+#define WL_AMPDU_ON()		0
+#define WL_DPT_ON()		0
+#define WL_WOWL_ON()		0
+#define WL_SCAN_ON()		(wl_msg_level2 & WL_SCAN_VAL)
+#define WL_BTA_ON()		0
+#define WL_P2P_ON()		0
+#define WL_ITFR_ON()		0
+#define WL_MCHAN_ON()		0
+#define WL_TDLS_ON()		0
+#define WL_MCNX_ON()		0
+#define WL_PROT_ON()		0
+#define WL_PSTA_ON()		0
+#define WL_TRF_MGMT_ON()	0
+#define WL_LPC_ON()		0
+#define WL_L2FILTER_ON()	0
+#define WL_TXBF_ON()		0
+#define WL_P2PO_ON()		0
+#define WL_CHANLOG_ON()		0
+#define WL_NET_DETECT_ON()	0
+#define WL_WNM_ON()		0
+#define WL_PCIE_ON()		0
+
+#else /* !BCMDBG */
+
+/* DBGONLY() macro to reduce ifdefs in code for statements that are only needed when
+ * BCMDBG is defined.
+ */
+#define DBGONLY(x)
+
+/* To disable a message completely ... until you need it again */
+#define WL_NONE(args)
+
+#define	WL_ERROR(args)
+#define	WL_TRACE(args)
+#ifndef LINUX_POSTMOGRIFY_REMOVAL
+#ifdef WLMSG_PRHDRS
+#define	WL_PRHDRS_MSG(args)		WL_PRINT(args)
+#define WL_PRHDRS(i, p, f, t, r, l)	wlc_print_hdrs(i, p, f, t, r, l)
+#else
+#define	WL_PRHDRS_MSG(args)
+#define	WL_PRHDRS(i, p, f, t, r, l)
+#endif
+#ifdef WLMSG_PRPKT
+#define	WL_PRPKT(m, b, n)	prhex(m, b, n)
+#else
+#define	WL_PRPKT(m, b, n)
+#endif
+#ifdef WLMSG_INFORM
+#define	WL_INFORM(args)		WL_PRINT(args)
+#else
+#define	WL_INFORM(args)
+#endif
+#define	WL_TMP(args)
+#ifdef WLMSG_OID
+#define WL_OID(args)		WL_PRINT(args)
+#else
+#define WL_OID(args)
+#endif
+#define	WL_RATE(args)
+#ifdef WLMSG_ASSOC
+#define	WL_ASSOC(args)		WL_PRINT(args)
+#else
+#define	WL_ASSOC(args)
+#endif
+#define	WL_PRUSR(m, b, n)
+#ifdef WLMSG_PS
+#define WL_PS(args)		WL_PRINT(args)
+#else
+#define WL_PS(args)
+#endif
+#ifdef WLMSG_ROAM
+#define WL_ROAM(args)	WL_PRINT(args)
+#else
+#define WL_ROAM(args)
+#endif
+#define WL_PORT(args)
+#define WL_DUAL(args)
+#define WL_REGULATORY(args)
+
+#ifdef WLMSG_MPC
+#define WL_MPC(args)		WL_PRINT(args)
+#else
+#define WL_MPC(args)
+#endif
+#define WL_APSTA(args)
+#define WL_APSTA_BCN(args)
+#define WL_APSTA_TX(args)
+#define WL_APSTA_TSF(args)
+#define WL_APSTA_BSSID(args)
+#define WL_BA(args)
+#define WL_MBSS(args)
+#define WL_MODE_SWITCH(args)
+#define	WL_PROTO(args)
+
+#define	WL_CAC(args)
+#define WL_AMSDU(args)
+#define WL_AMPDU(args)
+#define WL_FFPLD(args)
+#define WL_MCHAN(args)
+
+/* Define WLMSG_DFS automatically for WLTEST builds */
+
+#ifdef WLMSG_DFS
+#define WL_DFS(args)		do {if (wl_msg_level & WL_DFS_VAL) WL_PRINT(args);} while (0)
+#else /* WLMSG_DFS */
+#define WL_DFS(args)
+#endif /* WLMSG_DFS */
+#define WL_WOWL(args)
+#ifdef WLMSG_SCAN
+#define WL_SCAN(args)		WL_PRINT(args)
+#else
+#define WL_SCAN(args)
+#endif
+#define	WL_COEX(args)
+#define WL_RTDC(w, s, i, j)
+#define WL_RTDC2(w, s, i, j)
+#define WL_CHANINT(args)
+#ifdef WLMSG_BTA
+#define WL_BTA(args)		WL_PRINT(args)
+#else
+#define WL_BTA(args)
+#endif
+#define WL_WMF(args)
+#define WL_P2P(args)
+#define WL_ITFR(args)
+#define WL_TDLS(args)
+#define WL_MCNX(args)
+#define WL_PROT(args)
+#define WL_PSTA(args)
+#define WL_TBTT(args)
+#define WL_TRF_MGMT(args)
+#define WL_L2FILTER(args)
+#define WL_MQ(args)
+#define WL_P2PO(args)
+#define WL_WNM(args)
+#define WL_TXBF(args)
+#define WL_CHANLOG(w, s, i, j)
+#define WL_NET_DETECT(args)
+
+#define WL_ERROR_ON()		0
+#define WL_TRACE_ON()		0
+#ifdef WLMSG_PRHDRS
+#define WL_PRHDRS_ON()		1
+#else
+#define WL_PRHDRS_ON()		0
+#endif
+#ifdef WLMSG_PRPKT
+#define WL_PRPKT_ON()		1
+#else
+#define WL_PRPKT_ON()		0
+#endif
+#ifdef WLMSG_INFORM
+#define WL_INFORM_ON()		1
+#else
+#define WL_INFORM_ON()		0
+#endif
+#ifdef WLMSG_OID
+#define WL_OID_ON()		1
+#else
+#define WL_OID_ON()		0
+#endif
+#define WL_TMP_ON()		0
+#define WL_RATE_ON()		0
+#ifdef WLMSG_ASSOC
+#define WL_ASSOC_ON()		1
+#else
+#define WL_ASSOC_ON()		0
+#endif
+#define WL_PORT_ON()		0
+#ifdef WLMSG_WSEC
+#define WL_WSEC_ON()		1
+#define WL_WSEC_DUMP_ON()	1
+#else
+#define WL_WSEC_ON()		0
+#define WL_WSEC_DUMP_ON()	0
+#endif
+#ifdef WLMSG_MPC
+#define WL_MPC_ON()		1
+#else
+#define WL_MPC_ON()		0
+#endif
+#define WL_REGULATORY_ON()	0
+
+#define WL_APSTA_ON()		0
+#define WL_BA_ON()		0
+#define WL_MBSS_ON()		0
+#define WL_MODE_SWITCH_ON()		0
+#ifdef WLMSG_DFS
+#define WL_DFS_ON()		1
+#else /* WLMSG_DFS */
+#define WL_DFS_ON()		0
+#endif /* WLMSG_DFS */
+#ifdef WLMSG_SCAN
+#define WL_SCAN_ON()            1
+#else
+#define WL_SCAN_ON()            0
+#endif
+#ifdef WLMSG_BTA
+#define WL_BTA_ON()		1
+#else
+#define WL_BTA_ON()		0
+#endif
+#define WL_WMF_ON()		0
+#define WL_P2P_ON()		0
+#define WL_MCHAN_ON()		0
+#define WL_TDLS_ON()		0
+#define WL_MCNX_ON()		0
+#define WL_PROT_ON()		0
+#define WL_TBTT_ON()		0
+#define WL_PWRSEL_ON()		0
+#define WL_L2FILTER_ON()	0
+#define WL_MQ_ON()		0
+#define WL_P2PO_ON()		0
+#define WL_TXBF_ON()            0
+#define WL_CHANLOG_ON()		0
+
+#define WL_AMPDU_UPDN(args)
+#define WL_AMPDU_RX(args)
+#define WL_AMPDU_ERR(args)
+#define WL_AMPDU_TX(args)
+#define WL_AMPDU_CTL(args)
+#define WL_AMPDU_HW(args)
+#define WL_AMPDU_HWTXS(args)
+#define WL_AMPDU_HWDBG(args)
+#define WL_AMPDU_STAT(args)
+#define WL_AMPDU_ERR_ON()       0
+#define WL_AMPDU_HW_ON()        0
+#define WL_AMPDU_HWTXS_ON()     0
+
+#define WL_WNM_ON()		0
+#endif /* LINUX_POSTMOGRIFY_REMOVAL */
+#define WL_APSTA_UPDN(args)
+#define WL_APSTA_RX(args)
+#ifdef WLMSG_WSEC
+#define WL_WSEC(args)		WL_PRINT(args)
+#define WL_WSEC_DUMP(args)	WL_PRINT(args)
+#else
+#define WL_WSEC(args)
+#define WL_WSEC_DUMP(args)
+#endif
+#define WL_PCIE(args)		do {if (wl_msg_level2 & WL_PCIE_VAL) WL_PRINT(args);} while (0)
+#define WL_PCIE_ON()		(wl_msg_level2 & WL_PCIE_VAL)
+#endif
+
+extern uint32 wl_msg_level;
+extern uint32 wl_msg_level2;
+#endif /* _wl_dbg_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wldev_common.c b/drivers/net/wireless/bcm4336/wldev_common.c
--- a/drivers/net/wireless/bcm4336/wldev_common.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wldev_common.c	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,370 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wldev_common.c 504503 2014-09-24 11:28:56Z $
+ */
+
+#include <osl.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+#include <linux/netdevice.h>
+
+#include <wldev_common.h>
+#include <bcmutils.h>
+#include <dhd_config.h>
+
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+#define	WLDEV_ERROR(args)						\
+	do {										\
+		printk(KERN_ERR "WLDEV-ERROR) %s : ", __func__);	\
+		printk args;							\
+	} while (0)
+
+extern int dhd_ioctl_entry_local(struct net_device *net, wl_ioctl_t *ioc, int cmd);
+
+s32 wldev_ioctl(
+	struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set)
+{
+	s32 ret = 0;
+	struct wl_ioctl ioc;
+
+
+	memset(&ioc, 0, sizeof(ioc));
+	ioc.cmd = cmd;
+	ioc.buf = arg;
+	ioc.len = len;
+	ioc.set = set;
+
+	ret = dhd_ioctl_entry_local(dev, &ioc, cmd);
+
+	return ret;
+}
+
+/* Format a iovar buffer, not bsscfg indexed. The bsscfg index will be
+ * taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ * wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+static s32 wldev_mkiovar(
+	s8 *iovar_name, s8 *param, s32 paramlen,
+	s8 *iovar_buf, u32 buflen)
+{
+	s32 iolen = 0;
+
+	iolen = bcm_mkiovar(iovar_name, param, paramlen, iovar_buf, buflen);
+	return iolen;
+}
+
+s32 wldev_iovar_getbuf(
+	struct net_device *dev, s8 *iovar_name,
+	void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+	s32 ret = 0;
+	if (buf_sync) {
+		mutex_lock(buf_sync);
+	}
+	wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+	ret = wldev_ioctl(dev, WLC_GET_VAR, buf, buflen, FALSE);
+	if (buf_sync)
+		mutex_unlock(buf_sync);
+	return ret;
+}
+
+
+s32 wldev_iovar_setbuf(
+	struct net_device *dev, s8 *iovar_name,
+	void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync)
+{
+	s32 ret = 0;
+	s32 iovar_len;
+	if (buf_sync) {
+		mutex_lock(buf_sync);
+	}
+	iovar_len = wldev_mkiovar(iovar_name, param, paramlen, buf, buflen);
+	if (iovar_len > 0)
+		ret = wldev_ioctl(dev, WLC_SET_VAR, buf, iovar_len, TRUE);
+	else
+		ret = BCME_BUFTOOSHORT;
+
+	if (buf_sync)
+		mutex_unlock(buf_sync);
+	return ret;
+}
+
+s32 wldev_iovar_setint(
+	struct net_device *dev, s8 *iovar, s32 val)
+{
+	s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+	val = htod32(val);
+	memset(iovar_buf, 0, sizeof(iovar_buf));
+	return wldev_iovar_setbuf(dev, iovar, &val, sizeof(val), iovar_buf,
+		sizeof(iovar_buf), NULL);
+}
+
+
+s32 wldev_iovar_getint(
+	struct net_device *dev, s8 *iovar, s32 *pval)
+{
+	s8 iovar_buf[WLC_IOCTL_SMLEN];
+	s32 err;
+
+	memset(iovar_buf, 0, sizeof(iovar_buf));
+	err = wldev_iovar_getbuf(dev, iovar, pval, sizeof(*pval), iovar_buf,
+		sizeof(iovar_buf), NULL);
+	if (err == 0)
+	{
+		memcpy(pval, iovar_buf, sizeof(*pval));
+		*pval = dtoh32(*pval);
+	}
+	return err;
+}
+
+/** Format a bsscfg indexed iovar buffer. The bsscfg index will be
+ *  taken care of in dhd_ioctl_entry. Internal use only, not exposed to
+ *  wl_iw, wl_cfg80211 and wl_cfgp2p
+ */
+s32 wldev_mkiovar_bsscfg(
+	const s8 *iovar_name, s8 *param, s32 paramlen,
+	s8 *iovar_buf, s32 buflen, s32 bssidx)
+{
+	const s8 *prefix = "bsscfg:";
+	s8 *p;
+	u32 prefixlen;
+	u32 namelen;
+	u32 iolen;
+
+	if (bssidx == 0) {
+		return wldev_mkiovar((s8*)iovar_name, (s8 *)param, paramlen,
+			(s8 *) iovar_buf, buflen);
+	}
+
+	prefixlen = (u32) strlen(prefix); /* lengh of bsscfg prefix */
+	namelen = (u32) strlen(iovar_name) + 1; /* lengh of iovar  name + null */
+	iolen = prefixlen + namelen + sizeof(u32) + paramlen;
+
+	if (buflen < 0 || iolen > (u32)buflen)
+	{
+		WLDEV_ERROR(("%s: buffer is too short\n", __FUNCTION__));
+		return BCME_BUFTOOSHORT;
+	}
+
+	p = (s8 *)iovar_buf;
+
+	/* copy prefix, no null */
+	memcpy(p, prefix, prefixlen);
+	p += prefixlen;
+
+	/* copy iovar name including null */
+	memcpy(p, iovar_name, namelen);
+	p += namelen;
+
+	/* bss config index as first param */
+	bssidx = htod32(bssidx);
+	memcpy(p, &bssidx, sizeof(u32));
+	p += sizeof(u32);
+
+	/* parameter buffer follows */
+	if (paramlen)
+		memcpy(p, param, paramlen);
+
+	return iolen;
+
+}
+
+s32 wldev_iovar_getbuf_bsscfg(
+	struct net_device *dev, s8 *iovar_name,
+	void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync)
+{
+	s32 ret = 0;
+	if (buf_sync) {
+		mutex_lock(buf_sync);
+	}
+
+	wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+	ret = wldev_ioctl(dev, WLC_GET_VAR, buf, buflen, FALSE);
+	if (buf_sync) {
+		mutex_unlock(buf_sync);
+	}
+	return ret;
+
+}
+
+s32 wldev_iovar_setbuf_bsscfg(
+	struct net_device *dev, s8 *iovar_name,
+	void *param, s32 paramlen, void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync)
+{
+	s32 ret = 0;
+	s32 iovar_len;
+	if (buf_sync) {
+		mutex_lock(buf_sync);
+	}
+	iovar_len = wldev_mkiovar_bsscfg(iovar_name, param, paramlen, buf, buflen, bsscfg_idx);
+	if (iovar_len > 0)
+		ret = wldev_ioctl(dev, WLC_SET_VAR, buf, iovar_len, TRUE);
+	else {
+		ret = BCME_BUFTOOSHORT;
+	}
+
+	if (buf_sync) {
+		mutex_unlock(buf_sync);
+	}
+	return ret;
+}
+
+s32 wldev_iovar_setint_bsscfg(
+	struct net_device *dev, s8 *iovar, s32 val, s32 bssidx)
+{
+	s8 iovar_buf[WLC_IOCTL_SMLEN];
+
+	val = htod32(val);
+	memset(iovar_buf, 0, sizeof(iovar_buf));
+	return wldev_iovar_setbuf_bsscfg(dev, iovar, &val, sizeof(val), iovar_buf,
+		sizeof(iovar_buf), bssidx, NULL);
+}
+
+
+s32 wldev_iovar_getint_bsscfg(
+	struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx)
+{
+	s8 iovar_buf[WLC_IOCTL_SMLEN];
+	s32 err;
+
+	memset(iovar_buf, 0, sizeof(iovar_buf));
+	err = wldev_iovar_getbuf_bsscfg(dev, iovar, pval, sizeof(*pval), iovar_buf,
+		sizeof(iovar_buf), bssidx, NULL);
+	if (err == 0)
+	{
+		memcpy(pval, iovar_buf, sizeof(*pval));
+		*pval = dtoh32(*pval);
+	}
+	return err;
+}
+
+int wldev_get_link_speed(
+	struct net_device *dev, int *plink_speed)
+{
+	int error;
+
+	if (!plink_speed)
+		return -ENOMEM;
+	error = wldev_ioctl(dev, WLC_GET_RATE, plink_speed, sizeof(int), 0);
+	if (unlikely(error))
+		return error;
+
+	/* Convert internal 500Kbps to Kbps */
+	*plink_speed *= 500;
+	return error;
+}
+
+int wldev_get_rssi(
+	struct net_device *dev, int *prssi)
+{
+	scb_val_t scb_val;
+	int error;
+
+	if (!prssi)
+		return -ENOMEM;
+	bzero(&scb_val, sizeof(scb_val_t));
+
+	error = wldev_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t), 0);
+	if (unlikely(error))
+		return error;
+
+	*prssi = dtoh32(scb_val.val);
+	return error;
+}
+
+int wldev_get_ssid(
+	struct net_device *dev, wlc_ssid_t *pssid)
+{
+	int error;
+
+	if (!pssid)
+		return -ENOMEM;
+	error = wldev_ioctl(dev, WLC_GET_SSID, pssid, sizeof(wlc_ssid_t), 0);
+	if (unlikely(error))
+		return error;
+	pssid->SSID_len = dtoh32(pssid->SSID_len);
+	return error;
+}
+
+int wldev_get_band(
+	struct net_device *dev, uint *pband)
+{
+	int error;
+
+	error = wldev_ioctl(dev, WLC_GET_BAND, pband, sizeof(uint), 0);
+	return error;
+}
+
+int wldev_set_band(
+	struct net_device *dev, uint band)
+{
+	int error = -1;
+
+	if ((band == WLC_BAND_AUTO) || (band == WLC_BAND_5G) || (band == WLC_BAND_2G)) {
+		error = wldev_ioctl(dev, WLC_SET_BAND, &band, sizeof(band), true);
+		if (!error)
+			dhd_bus_band_set(dev, band);
+	}
+	return error;
+}
+
+int wldev_set_country(
+	struct net_device *dev, char *country_code, bool notify, bool user_enforced)
+{
+	int error = -1;
+	wl_country_t cspec = {{0}, 0, {0}};
+	scb_val_t scbval;
+	char smbuf[WLC_IOCTL_SMLEN];
+
+	if (!country_code)
+		return error;
+
+	bzero(&scbval, sizeof(scb_val_t));
+	error = wldev_iovar_getbuf(dev, "country", NULL, 0, &cspec, sizeof(cspec), NULL);
+	if (error < 0) {
+		WLDEV_ERROR(("%s: get country failed = %d\n", __FUNCTION__, error));
+		return error;
+	}
+
+	if ((error < 0) ||
+	    (strncmp(country_code, cspec.country_abbrev, WLC_CNTRY_BUF_SZ) != 0)) {
+
+		if (user_enforced) {
+			bzero(&scbval, sizeof(scb_val_t));
+			error = wldev_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t), true);
+			if (error < 0) {
+				WLDEV_ERROR(("%s: set country failed due to Disassoc error %d\n",
+					__FUNCTION__, error));
+				return error;
+			}
+		}
+
+		cspec.rev = -1;
+		memcpy(cspec.country_abbrev, country_code, WLC_CNTRY_BUF_SZ);
+		memcpy(cspec.ccode, country_code, WLC_CNTRY_BUF_SZ);
+		dhd_get_customized_country_code(dev, (char *)&cspec.country_abbrev, &cspec);
+		error = wldev_iovar_setbuf(dev, "country", &cspec, sizeof(cspec),
+			smbuf, sizeof(smbuf), NULL);
+		if (error < 0) {
+			WLDEV_ERROR(("%s: set country for %s as %s rev %d failed\n",
+				__FUNCTION__, country_code, cspec.ccode, cspec.rev));
+			return error;
+		}
+		dhd_conf_fix_country(dhd_get_pub(dev));
+		dhd_conf_get_country(dhd_get_pub(dev), &cspec);
+		dhd_bus_country_set(dev, &cspec, notify);
+		WLDEV_ERROR(("%s: set country for %s as %s rev %d\n",
+			__FUNCTION__, country_code, cspec.ccode, cspec.rev));
+	}
+	return 0;
+}
diff -ENwbur a/drivers/net/wireless/bcm4336/wldev_common.h b/drivers/net/wireless/bcm4336/wldev_common.h
--- a/drivers/net/wireless/bcm4336/wldev_common.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wldev_common.h	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,106 @@
+/*
+ * Common function shared by Linux WEXT, cfg80211 and p2p drivers
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wldev_common.h 504503 2014-09-24 11:28:56Z $
+ */
+#ifndef __WLDEV_COMMON_H__
+#define __WLDEV_COMMON_H__
+
+#include <wlioctl.h>
+
+/* wl_dev_ioctl - get/set IOCTLs, will call net_device's do_ioctl (or
+ *  netdev_ops->ndo_do_ioctl in new kernels)
+ *  @dev: the net_device handle
+ */
+s32 wldev_ioctl(
+	struct net_device *dev, u32 cmd, void *arg, u32 len, u32 set);
+
+/** Retrieve named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf(
+	struct net_device *dev, s8 *iovar_name,
+	void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync);
+
+/** Set named IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf(
+	struct net_device *dev, s8 *iovar_name,
+	void *param, s32 paramlen, void *buf, s32 buflen, struct mutex* buf_sync);
+
+s32 wldev_iovar_setint(
+	struct net_device *dev, s8 *iovar, s32 val);
+
+s32 wldev_iovar_getint(
+	struct net_device *dev, s8 *iovar, s32 *pval);
+
+/** The following function can be implemented if there is a need for bsscfg
+ *  indexed IOVARs
+ */
+
+s32 wldev_mkiovar_bsscfg(
+	const s8 *iovar_name, s8 *param, s32 paramlen,
+	s8 *iovar_buf, s32 buflen, s32 bssidx);
+
+/** Retrieve named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_GET_VAR IOCTL code
+ */
+s32 wldev_iovar_getbuf_bsscfg(
+	struct net_device *dev, s8 *iovar_name, void *param, s32 paramlen,
+	void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync);
+
+/** Set named and bsscfg indexed IOVARs, this function calls wl_dev_ioctl with
+ *  WLC_SET_VAR IOCTL code
+ */
+s32 wldev_iovar_setbuf_bsscfg(
+	struct net_device *dev, s8 *iovar_name, void *param, s32 paramlen,
+	void *buf, s32 buflen, s32 bsscfg_idx, struct mutex* buf_sync);
+
+s32 wldev_iovar_getint_bsscfg(
+	struct net_device *dev, s8 *iovar, s32 *pval, s32 bssidx);
+
+s32 wldev_iovar_setint_bsscfg(
+	struct net_device *dev, s8 *iovar, s32 val, s32 bssidx);
+
+extern int dhd_net_set_fw_path(struct net_device *dev, char *fw);
+extern int dhd_net_bus_suspend(struct net_device *dev);
+extern int dhd_net_bus_resume(struct net_device *dev, uint8 stage);
+extern int dhd_net_wifi_platform_set_power(struct net_device *dev, bool on,
+	unsigned long delay_msec);
+extern void dhd_get_customized_country_code(struct net_device *dev, char *country_iso_code,
+	wl_country_t *cspec);
+extern void dhd_bus_country_set(struct net_device *dev, wl_country_t *cspec, bool notify);
+extern void dhd_bus_band_set(struct net_device *dev, uint band);
+extern int wldev_set_country(struct net_device *dev, char *country_code, bool notify,
+	bool user_enforced);
+extern int net_os_wake_lock(struct net_device *dev);
+extern int net_os_wake_unlock(struct net_device *dev);
+extern int net_os_wake_lock_timeout(struct net_device *dev);
+extern int net_os_wake_lock_timeout_enable(struct net_device *dev, int val);
+extern int net_os_set_dtim_skip(struct net_device *dev, int val);
+extern int net_os_set_suspend_disable(struct net_device *dev, int val);
+extern int net_os_set_suspend(struct net_device *dev, int val, int force);
+extern int wl_iw_parse_ssid_list_tlv(char** list_str, wlc_ssid_t* ssid,
+	int max, int *bytes_left);
+
+/* Get the link speed from dongle, speed is in kpbs */
+int wldev_get_link_speed(struct net_device *dev, int *plink_speed);
+
+int wldev_get_rssi(struct net_device *dev, int *prssi);
+
+int wldev_get_ssid(struct net_device *dev, wlc_ssid_t *pssid);
+
+int wldev_get_band(struct net_device *dev, uint *pband);
+
+int wldev_set_band(struct net_device *dev, uint band);
+
+#if defined(CUSTOM_PLATFORM_NV_TEGRA)
+int wldev_miracast_tuning(struct net_device *dev, char *command, int total_len);
+int wldev_get_assoc_resp_ie(struct net_device *dev, char *command, int total_len);
+int wldev_get_rx_rate_stats(struct net_device *dev, char *command, int total_len);
+#endif /* defined(CUSTOM_PLATFORM_NV_TEGRA) */
+
+#endif /* __WLDEV_COMMON_H__ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_iw.c b/drivers/net/wireless/bcm4336/wl_iw.c
--- a/drivers/net/wireless/bcm4336/wl_iw.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_iw.c	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,3909 @@
+/*
+ * Linux Wireless Extensions support
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_iw.c 467328 2014-04-03 01:23:40Z $
+ */
+
+#if defined(USE_IW)
+#define LINUX_PORT
+
+#include <typedefs.h>
+#include <linuxver.h>
+#include <osl.h>
+
+#include <bcmutils.h>
+#include <bcmendian.h>
+#include <proto/ethernet.h>
+
+#include <linux/if_arp.h>
+#include <asm/uaccess.h>
+
+typedef const struct si_pub	si_t;
+#include <wlioctl.h>
+#include <wl_android.h>
+
+
+/* message levels */
+#define WL_ERROR_LEVEL	0x0001
+#define WL_SCAN_LEVEL	0x0002
+#define WL_ASSOC_LEVEL	0x0004
+#define WL_INFORM_LEVEL	0x0008
+#define WL_WSEC_LEVEL	0x0010
+#define WL_PNO_LEVEL	0x0020
+#define WL_COEX_LEVEL	0x0040
+#define WL_SOFTAP_LEVEL	0x0080
+#define WL_TRACE_LEVEL	0x0100
+
+uint iw_msg_level = WL_ERROR_LEVEL;
+
+#define WL_ERROR(x)		do {if (iw_msg_level & WL_ERROR_LEVEL) printf x;} while (0)
+#define WL_SCAN(x)		do {if (iw_msg_level & WL_SCAN_LEVEL) printf x;} while (0)
+#define WL_ASSOC(x)		do {if (iw_msg_level & WL_ASSOC_LEVEL) printf x;} while (0)
+#define WL_INFORM(x)	do {if (iw_msg_level & WL_INFORM_LEVEL) printf x;} while (0)
+#define WL_WSEC(x)		do {if (iw_msg_level & WL_WSEC_LEVEL) printf x;} while (0)
+#define WL_PNO(x)		do {if (iw_msg_level & WL_PNO_LEVEL) printf x;} while (0)
+#define WL_COEX(x)		do {if (iw_msg_level & WL_COEX_LEVEL) printf x;} while (0)
+#define WL_SOFTAP(x)	do {if (iw_msg_level & WL_SOFTAP_LEVEL) printf x;} while (0)
+#define WL_TRACE(x)		do {if (iw_msg_level & WL_TRACE_LEVEL) printf x;} while (0)
+
+#include <wl_iw.h>
+
+#ifdef BCMWAPI_WPI
+/* these items should evetually go into wireless.h of the linux system headfile dir */
+#ifndef IW_ENCODE_ALG_SM4
+#define IW_ENCODE_ALG_SM4 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_ENABLED
+#define IW_AUTH_WAPI_ENABLED 0x20
+#endif
+
+#ifndef IW_AUTH_WAPI_VERSION_1
+#define IW_AUTH_WAPI_VERSION_1	0x00000008
+#endif
+
+#ifndef IW_AUTH_CIPHER_SMS4
+#define IW_AUTH_CIPHER_SMS4	0x00000020
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_PSK
+#define IW_AUTH_KEY_MGMT_WAPI_PSK 4
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_WAPI_CERT
+#define IW_AUTH_KEY_MGMT_WAPI_CERT 8
+#endif
+#endif /* BCMWAPI_WPI */
+
+/* Broadcom extensions to WEXT, linux upstream has obsoleted WEXT */
+#ifndef IW_AUTH_KEY_MGMT_FT_802_1X
+#define IW_AUTH_KEY_MGMT_FT_802_1X 0x04
+#endif
+
+#ifndef IW_AUTH_KEY_MGMT_FT_PSK
+#define IW_AUTH_KEY_MGMT_FT_PSK 0x08
+#endif
+
+#ifndef IW_ENC_CAPA_FW_ROAM_ENABLE
+#define IW_ENC_CAPA_FW_ROAM_ENABLE	0x00000020
+#endif
+
+
+/* FC9: wireless.h 2.6.25-14.fc9.i686 is missing these, even though WIRELESS_EXT is set to latest
+ * version 22.
+ */
+#ifndef IW_ENCODE_ALG_PMK
+#define IW_ENCODE_ALG_PMK 4
+#endif
+#ifndef IW_ENC_CAPA_4WAY_HANDSHAKE
+#define IW_ENC_CAPA_4WAY_HANDSHAKE 0x00000010
+#endif
+/* End FC9. */
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+#include <linux/rtnetlink.h>
+#endif
+#if defined(SOFTAP)
+struct net_device *ap_net_dev = NULL;
+tsk_ctl_t ap_eth_ctl;  /* apsta AP netdev waiter thread */
+#endif /* SOFTAP */
+
+extern bool wl_iw_conn_status_str(uint32 event_type, uint32 status,
+	uint32 reason, char* stringBuf, uint buflen);
+
+#define MAX_WLIW_IOCTL_LEN 1024
+
+/* IOCTL swapping mode for Big Endian host with Little Endian dongle.  Default to off */
+#define htod32(i) (i)
+#define htod16(i) (i)
+#define dtoh32(i) (i)
+#define dtoh16(i) (i)
+#define htodchanspec(i) (i)
+#define dtohchanspec(i) (i)
+
+extern struct iw_statistics *dhd_get_wireless_stats(struct net_device *dev);
+extern int dhd_wait_pend8021x(struct net_device *dev);
+
+#if WIRELESS_EXT < 19
+#define IW_IOCTL_IDX(cmd)	((cmd) - SIOCIWFIRST)
+#define IW_EVENT_IDX(cmd)	((cmd) - IWEVFIRST)
+#endif /* WIRELESS_EXT < 19 */
+
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0))
+#define DAEMONIZE(a)	do { \
+		allow_signal(SIGKILL);	\
+		allow_signal(SIGTERM);	\
+	} while (0)
+#elif ((LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)) && \
+	(LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)))
+#define DAEMONIZE(a) daemonize(a); \
+	allow_signal(SIGKILL); \
+	allow_signal(SIGTERM);
+#else /* Linux 2.4 (w/o preemption patch) */
+#define RAISE_RX_SOFTIRQ() \
+	cpu_raise_softirq(smp_processor_id(), NET_RX_SOFTIRQ)
+#define DAEMONIZE(a) daemonize(); \
+	do { if (a) \
+		strncpy(current->comm, a, MIN(sizeof(current->comm), (strlen(a) + 1))); \
+	} while (0);
+#endif /* LINUX_VERSION_CODE  */
+
+#define ISCAN_STATE_IDLE   0
+#define ISCAN_STATE_SCANING 1
+
+/* the buf lengh can be WLC_IOCTL_MAXLEN (8K) to reduce iteration */
+#define WLC_IW_ISCAN_MAXLEN   2048
+typedef struct iscan_buf {
+	struct iscan_buf * next;
+	char   iscan_buf[WLC_IW_ISCAN_MAXLEN];
+} iscan_buf_t;
+
+typedef struct iscan_info {
+	struct net_device *dev;
+	struct timer_list timer;
+	uint32 timer_ms;
+	uint32 timer_on;
+	int    iscan_state;
+	iscan_buf_t * list_hdr;
+	iscan_buf_t * list_cur;
+
+	/* Thread to work on iscan */
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+	struct task_struct *kthread;
+#endif
+	long sysioc_pid;
+	struct semaphore sysioc_sem;
+	struct completion sysioc_exited;
+
+
+	char ioctlbuf[WLC_IOCTL_SMLEN];
+} iscan_info_t;
+iscan_info_t *g_iscan = NULL;
+static void wl_iw_timerfunc(ulong data);
+static void wl_iw_set_event_mask(struct net_device *dev);
+static int wl_iw_iscan(iscan_info_t *iscan, wlc_ssid_t *ssid, uint16 action);
+
+/* priv_link becomes netdev->priv and is the link between netdev and wlif struct */
+typedef struct priv_link {
+	wl_iw_t *wliw;
+} priv_link_t;
+
+/* dev to priv_link */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24))
+#define WL_DEV_LINK(dev)       (priv_link_t*)(dev->priv)
+#else
+#define WL_DEV_LINK(dev)       (priv_link_t*)netdev_priv(dev)
+#endif
+
+/* dev to wl_iw_t */
+#define IW_DEV_IF(dev)          ((wl_iw_t*)(WL_DEV_LINK(dev))->wliw)
+
+static void swap_key_from_BE(
+	        wl_wsec_key_t *key
+)
+{
+	key->index = htod32(key->index);
+	key->len = htod32(key->len);
+	key->algo = htod32(key->algo);
+	key->flags = htod32(key->flags);
+	key->rxiv.hi = htod32(key->rxiv.hi);
+	key->rxiv.lo = htod16(key->rxiv.lo);
+	key->iv_initialized = htod32(key->iv_initialized);
+}
+
+static void swap_key_to_BE(
+	        wl_wsec_key_t *key
+)
+{
+	key->index = dtoh32(key->index);
+	key->len = dtoh32(key->len);
+	key->algo = dtoh32(key->algo);
+	key->flags = dtoh32(key->flags);
+	key->rxiv.hi = dtoh32(key->rxiv.hi);
+	key->rxiv.lo = dtoh16(key->rxiv.lo);
+	key->iv_initialized = dtoh32(key->iv_initialized);
+}
+
+static int
+dev_wlc_ioctl(
+	struct net_device *dev,
+	int cmd,
+	void *arg,
+	int len
+)
+{
+	struct ifreq ifr;
+	wl_ioctl_t ioc;
+	mm_segment_t fs;
+	int ret;
+
+	memset(&ioc, 0, sizeof(ioc));
+	ioc.cmd = cmd;
+	ioc.buf = arg;
+	ioc.len = len;
+
+	strcpy(ifr.ifr_name, dev->name);
+	ifr.ifr_data = (caddr_t) &ioc;
+
+	fs = get_fs();
+	set_fs(get_ds());
+#if defined(WL_USE_NETDEV_OPS)
+	ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+#else
+	ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
+#endif
+	set_fs(fs);
+
+	return ret;
+}
+
+/*
+set named driver variable to int value and return error indication
+calling example: dev_wlc_intvar_set(dev, "arate", rate)
+*/
+
+static int
+dev_wlc_intvar_set(
+	struct net_device *dev,
+	char *name,
+	int val)
+{
+	char buf[WLC_IOCTL_SMLEN];
+	uint len;
+
+	val = htod32(val);
+	len = bcm_mkiovar(name, (char *)(&val), sizeof(val), buf, sizeof(buf));
+	ASSERT(len);
+
+	return (dev_wlc_ioctl(dev, WLC_SET_VAR, buf, len));
+}
+
+static int
+dev_iw_iovar_setbuf(
+	struct net_device *dev,
+	char *iovar,
+	void *param,
+	int paramlen,
+	void *bufptr,
+	int buflen)
+{
+	int iolen;
+
+	iolen = bcm_mkiovar(iovar, param, paramlen, bufptr, buflen);
+	ASSERT(iolen);
+	BCM_REFERENCE(iolen);
+
+	return (dev_wlc_ioctl(dev, WLC_SET_VAR, bufptr, iolen));
+}
+
+static int
+dev_iw_iovar_getbuf(
+	struct net_device *dev,
+	char *iovar,
+	void *param,
+	int paramlen,
+	void *bufptr,
+	int buflen)
+{
+	int iolen;
+
+	iolen = bcm_mkiovar(iovar, param, paramlen, bufptr, buflen);
+	ASSERT(iolen);
+	BCM_REFERENCE(iolen);
+
+	return (dev_wlc_ioctl(dev, WLC_GET_VAR, bufptr, buflen));
+}
+
+#if WIRELESS_EXT > 17
+static int
+dev_wlc_bufvar_set(
+	struct net_device *dev,
+	char *name,
+	char *buf, int len)
+{
+	char *ioctlbuf;
+	uint buflen;
+	int error;
+
+	ioctlbuf = kmalloc(MAX_WLIW_IOCTL_LEN, GFP_KERNEL);
+	if (!ioctlbuf)
+		return -ENOMEM;
+
+	buflen = bcm_mkiovar(name, buf, len, ioctlbuf, MAX_WLIW_IOCTL_LEN);
+	ASSERT(buflen);
+	error = dev_wlc_ioctl(dev, WLC_SET_VAR, ioctlbuf, buflen);
+
+	kfree(ioctlbuf);
+	return error;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+/*
+get named driver variable to int value and return error indication
+calling example: dev_wlc_bufvar_get(dev, "arate", &rate)
+*/
+
+static int
+dev_wlc_bufvar_get(
+	struct net_device *dev,
+	char *name,
+	char *buf, int buflen)
+{
+	char *ioctlbuf;
+	int error;
+
+	uint len;
+
+	ioctlbuf = kmalloc(MAX_WLIW_IOCTL_LEN, GFP_KERNEL);
+	if (!ioctlbuf)
+		return -ENOMEM;
+	len = bcm_mkiovar(name, NULL, 0, ioctlbuf, MAX_WLIW_IOCTL_LEN);
+	ASSERT(len);
+	BCM_REFERENCE(len);
+	error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)ioctlbuf, MAX_WLIW_IOCTL_LEN);
+	if (!error)
+		bcopy(ioctlbuf, buf, buflen);
+
+	kfree(ioctlbuf);
+	return (error);
+}
+
+/*
+get named driver variable to int value and return error indication
+calling example: dev_wlc_intvar_get(dev, "arate", &rate)
+*/
+
+static int
+dev_wlc_intvar_get(
+	struct net_device *dev,
+	char *name,
+	int *retval)
+{
+	union {
+		char buf[WLC_IOCTL_SMLEN];
+		int val;
+	} var;
+	int error;
+
+	uint len;
+	uint data_null;
+
+	len = bcm_mkiovar(name, (char *)(&data_null), 0, (char *)(&var), sizeof(var.buf));
+	ASSERT(len);
+	error = dev_wlc_ioctl(dev, WLC_GET_VAR, (void *)&var, len);
+
+	*retval = dtoh32(var.val);
+
+	return (error);
+}
+
+/* Maintain backward compatibility */
+#if WIRELESS_EXT < 13
+struct iw_request_info
+{
+	__u16		cmd;		/* Wireless Extension command */
+	__u16		flags;		/* More to come ;-) */
+};
+
+typedef int (*iw_handler)(struct net_device *dev, struct iw_request_info *info,
+	void *wrqu, char *extra);
+#endif /* WIRELESS_EXT < 13 */
+
+#if WIRELESS_EXT > 12
+static int
+wl_iw_set_leddc(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu,
+	char *extra
+)
+{
+	int dc = *(int *)extra;
+	int error;
+
+	error = dev_wlc_intvar_set(dev, "leddc", dc);
+	return error;
+}
+
+static int
+wl_iw_set_vlanmode(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu,
+	char *extra
+)
+{
+	int mode = *(int *)extra;
+	int error;
+
+	mode = htod32(mode);
+	error = dev_wlc_intvar_set(dev, "vlan_mode", mode);
+	return error;
+}
+
+static int
+wl_iw_set_pm(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu,
+	char *extra
+)
+{
+	int pm = *(int *)extra;
+	int error;
+
+	pm = htod32(pm);
+	error = dev_wlc_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm));
+	return error;
+}
+
+#if WIRELESS_EXT > 17
+#endif /* WIRELESS_EXT > 17 */
+#endif /* WIRELESS_EXT > 12 */
+
+int
+wl_iw_send_priv_event(
+	struct net_device *dev,
+	char *flag
+)
+{
+	union iwreq_data wrqu;
+	char extra[IW_CUSTOM_MAX + 1];
+	int cmd;
+
+	cmd = IWEVCUSTOM;
+	memset(&wrqu, 0, sizeof(wrqu));
+	if (strlen(flag) > sizeof(extra))
+		return -1;
+
+	strcpy(extra, flag);
+	wrqu.data.length = strlen(extra);
+	wireless_send_event(dev, cmd, &wrqu, extra);
+	WL_TRACE(("Send IWEVCUSTOM Event as %s\n", extra));
+
+	return 0;
+}
+
+static int
+wl_iw_config_commit(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	void *zwrq,
+	char *extra
+)
+{
+	wlc_ssid_t ssid;
+	int error;
+	struct sockaddr bssid;
+
+	WL_TRACE(("%s: SIOCSIWCOMMIT\n", dev->name));
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid))))
+		return error;
+
+	ssid.SSID_len = dtoh32(ssid.SSID_len);
+
+	if (!ssid.SSID_len)
+		return 0;
+
+	bzero(&bssid, sizeof(struct sockaddr));
+	if ((error = dev_wlc_ioctl(dev, WLC_REASSOC, &bssid, ETHER_ADDR_LEN))) {
+		WL_ERROR(("%s: WLC_REASSOC failed (%d)\n", __FUNCTION__, error));
+		return error;
+	}
+
+	return 0;
+}
+
+static int
+wl_iw_get_name(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *cwrq,
+	char *extra
+)
+{
+	int phytype, err;
+	uint band[3];
+	char cap[5];
+
+	WL_TRACE(("%s: SIOCGIWNAME\n", dev->name));
+
+	cap[0] = 0;
+	if ((err = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &phytype, sizeof(phytype))) < 0)
+		goto done;
+	if ((err = dev_wlc_ioctl(dev, WLC_GET_BANDLIST, band, sizeof(band))) < 0)
+		goto done;
+
+	band[0] = dtoh32(band[0]);
+	switch (phytype) {
+		case WLC_PHY_TYPE_A:
+			strcpy(cap, "a");
+			break;
+		case WLC_PHY_TYPE_B:
+			strcpy(cap, "b");
+			break;
+		case WLC_PHY_TYPE_LP:
+		case WLC_PHY_TYPE_G:
+			if (band[0] >= 2)
+				strcpy(cap, "abg");
+			else
+				strcpy(cap, "bg");
+			break;
+		case WLC_PHY_TYPE_N:
+			if (band[0] >= 2)
+				strcpy(cap, "abgn");
+			else
+				strcpy(cap, "bgn");
+			break;
+	}
+done:
+	snprintf(cwrq->name, IFNAMSIZ, "IEEE 802.11%s", cap);
+	return 0;
+}
+
+static int
+wl_iw_set_freq(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_freq *fwrq,
+	char *extra
+)
+{
+	int error, chan;
+	uint sf = 0;
+
+	WL_TRACE(("%s: SIOCSIWFREQ\n", dev->name));
+
+	/* Setting by channel number */
+	if (fwrq->e == 0 && fwrq->m < MAXCHANNEL) {
+		chan = fwrq->m;
+	}
+
+	/* Setting by frequency */
+	else {
+		/* Convert to MHz as best we can */
+		if (fwrq->e >= 6) {
+			fwrq->e -= 6;
+			while (fwrq->e--)
+				fwrq->m *= 10;
+		} else if (fwrq->e < 6) {
+			while (fwrq->e++ < 6)
+				fwrq->m /= 10;
+		}
+	/* handle 4.9GHz frequencies as Japan 4 GHz based channelization */
+	if (fwrq->m > 4000 && fwrq->m < 5000)
+		sf = WF_CHAN_FACTOR_4_G; /* start factor for 4 GHz */
+
+		chan = wf_mhz2channel(fwrq->m, sf);
+	}
+	WL_ERROR(("%s: chan=%d\n", __FUNCTION__, chan));
+	chan = htod32(chan);
+	if ((error = dev_wlc_ioctl(dev, WLC_SET_CHANNEL, &chan, sizeof(chan)))) {
+		WL_ERROR(("%s: WLC_DISASSOC failed (%d).\n", __FUNCTION__, error));
+		return error;
+	}
+
+	/* -EINPROGRESS: Call commit handler */
+	return -EINPROGRESS;
+}
+
+static int
+wl_iw_get_freq(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_freq *fwrq,
+	char *extra
+)
+{
+	channel_info_t ci;
+	int error;
+
+	WL_TRACE(("%s: SIOCGIWFREQ\n", dev->name));
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(ci))))
+		return error;
+
+	/* Return radio channel in channel form */
+	fwrq->m = dtoh32(ci.hw_channel);
+	fwrq->e = dtoh32(0);
+	return 0;
+}
+
+static int
+wl_iw_set_mode(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	__u32 *uwrq,
+	char *extra
+)
+{
+	int infra = 0, ap = 0, error = 0;
+
+	WL_TRACE(("%s: SIOCSIWMODE\n", dev->name));
+
+	switch (*uwrq) {
+	case IW_MODE_MASTER:
+		infra = ap = 1;
+		break;
+	case IW_MODE_ADHOC:
+	case IW_MODE_AUTO:
+		break;
+	case IW_MODE_INFRA:
+		infra = 1;
+		break;
+	default:
+		return -EINVAL;
+	}
+	infra = htod32(infra);
+	ap = htod32(ap);
+
+	if ((error = dev_wlc_ioctl(dev, WLC_SET_INFRA, &infra, sizeof(infra))) ||
+	    (error = dev_wlc_ioctl(dev, WLC_SET_AP, &ap, sizeof(ap))))
+		return error;
+
+	/* -EINPROGRESS: Call commit handler */
+	return -EINPROGRESS;
+}
+
+static int
+wl_iw_get_mode(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	__u32 *uwrq,
+	char *extra
+)
+{
+	int error, infra = 0, ap = 0;
+
+	WL_TRACE(("%s: SIOCGIWMODE\n", dev->name));
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_INFRA, &infra, sizeof(infra))) ||
+	    (error = dev_wlc_ioctl(dev, WLC_GET_AP, &ap, sizeof(ap))))
+		return error;
+
+	infra = dtoh32(infra);
+	ap = dtoh32(ap);
+	*uwrq = infra ? ap ? IW_MODE_MASTER : IW_MODE_INFRA : IW_MODE_ADHOC;
+
+	return 0;
+}
+
+static int
+wl_iw_get_range(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	struct iw_range *range = (struct iw_range *) extra;
+	static int channels[MAXCHANNEL+1];
+	wl_uint32_list_t *list = (wl_uint32_list_t *) channels;
+	wl_rateset_t rateset;
+	int error, i, k;
+	uint sf, ch;
+
+	int phytype;
+	int bw_cap = 0, sgi_tx = 0, nmode = 0;
+	channel_info_t ci;
+	uint8 nrate_list2copy = 0;
+	uint16 nrate_list[4][8] = { {13, 26, 39, 52, 78, 104, 117, 130},
+		{14, 29, 43, 58, 87, 116, 130, 144},
+		{27, 54, 81, 108, 162, 216, 243, 270},
+		{30, 60, 90, 120, 180, 240, 270, 300}};
+	int fbt_cap = 0;
+
+	WL_TRACE(("%s: SIOCGIWRANGE\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	dwrq->length = sizeof(struct iw_range);
+	memset(range, 0, sizeof(*range));
+
+	/* We don't use nwids */
+	range->min_nwid = range->max_nwid = 0;
+
+	/* Set available channels/frequencies */
+	list->count = htod32(MAXCHANNEL);
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_VALID_CHANNELS, channels, sizeof(channels))))
+		return error;
+	for (i = 0; i < dtoh32(list->count) && i < IW_MAX_FREQUENCIES; i++) {
+		range->freq[i].i = dtoh32(list->element[i]);
+
+		ch = dtoh32(list->element[i]);
+		if (ch <= CH_MAX_2G_CHANNEL)
+			sf = WF_CHAN_FACTOR_2_4_G;
+		else
+			sf = WF_CHAN_FACTOR_5_G;
+
+		range->freq[i].m = wf_channel2mhz(ch, sf);
+		range->freq[i].e = 6;
+	}
+	range->num_frequency = range->num_channels = i;
+
+	/* Link quality (use NDIS cutoffs) */
+	range->max_qual.qual = 5;
+	/* Signal level (use RSSI) */
+	range->max_qual.level = 0x100 - 200;	/* -200 dBm */
+	/* Noise level (use noise) */
+	range->max_qual.noise = 0x100 - 200;	/* -200 dBm */
+	/* Signal level threshold range (?) */
+	range->sensitivity = 65535;
+
+#if WIRELESS_EXT > 11
+	/* Link quality (use NDIS cutoffs) */
+	range->avg_qual.qual = 3;
+	/* Signal level (use RSSI) */
+	range->avg_qual.level = 0x100 + WL_IW_RSSI_GOOD;
+	/* Noise level (use noise) */
+	range->avg_qual.noise = 0x100 - 75;	/* -75 dBm */
+#endif /* WIRELESS_EXT > 11 */
+
+	/* Set available bitrates */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
+		return error;
+	rateset.count = dtoh32(rateset.count);
+	range->num_bitrates = rateset.count;
+	for (i = 0; i < rateset.count && i < IW_MAX_BITRATES; i++)
+		range->bitrate[i] = (rateset.rates[i] & 0x7f) * 500000; /* convert to bps */
+	if ((error = dev_wlc_intvar_get(dev, "nmode", &nmode)))
+		return error;
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &phytype, sizeof(phytype))))
+		return error;
+	if (nmode == 1 && ((phytype == WLC_PHY_TYPE_SSN) || (phytype == WLC_PHY_TYPE_LCN) ||
+		(phytype == WLC_PHY_TYPE_LCN40))) {
+		if ((error = dev_wlc_intvar_get(dev, "mimo_bw_cap", &bw_cap)))
+			return error;
+		if ((error = dev_wlc_intvar_get(dev, "sgi_tx", &sgi_tx)))
+			return error;
+		if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(channel_info_t))))
+			return error;
+		ci.hw_channel = dtoh32(ci.hw_channel);
+
+		if (bw_cap == 0 ||
+			(bw_cap == 2 && ci.hw_channel <= 14)) {
+			if (sgi_tx == 0)
+				nrate_list2copy = 0;
+			else
+				nrate_list2copy = 1;
+		}
+		if (bw_cap == 1 ||
+			(bw_cap == 2 && ci.hw_channel >= 36)) {
+			if (sgi_tx == 0)
+				nrate_list2copy = 2;
+			else
+				nrate_list2copy = 3;
+		}
+		range->num_bitrates += 8;
+		ASSERT(range->num_bitrates < IW_MAX_BITRATES);
+		for (k = 0; i < range->num_bitrates; k++, i++) {
+			/* convert to bps */
+			range->bitrate[i] = (nrate_list[nrate_list2copy][k]) * 500000;
+		}
+	}
+
+	/* Set an indication of the max TCP throughput
+	 * in bit/s that we can expect using this interface.
+	 * May be use for QoS stuff... Jean II
+	 */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_PHYTYPE, &i, sizeof(i))))
+		return error;
+	i = dtoh32(i);
+	if (i == WLC_PHY_TYPE_A)
+		range->throughput = 24000000;	/* 24 Mbits/s */
+	else
+		range->throughput = 1500000;	/* 1.5 Mbits/s */
+
+	/* RTS and fragmentation thresholds */
+	range->min_rts = 0;
+	range->max_rts = 2347;
+	range->min_frag = 256;
+	range->max_frag = 2346;
+
+	range->max_encoding_tokens = DOT11_MAX_DEFAULT_KEYS;
+	range->num_encoding_sizes = 4;
+	range->encoding_size[0] = WEP1_KEY_SIZE;
+	range->encoding_size[1] = WEP128_KEY_SIZE;
+#if WIRELESS_EXT > 17
+	range->encoding_size[2] = TKIP_KEY_SIZE;
+#else
+	range->encoding_size[2] = 0;
+#endif
+	range->encoding_size[3] = AES_KEY_SIZE;
+
+	/* Do not support power micro-management */
+	range->min_pmp = 0;
+	range->max_pmp = 0;
+	range->min_pmt = 0;
+	range->max_pmt = 0;
+	range->pmp_flags = 0;
+	range->pm_capa = 0;
+
+	/* Transmit Power - values are in mW */
+	range->num_txpower = 2;
+	range->txpower[0] = 1;
+	range->txpower[1] = 255;
+	range->txpower_capa = IW_TXPOW_MWATT;
+
+#if WIRELESS_EXT > 10
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 19;
+
+	/* Only support retry limits */
+	range->retry_capa = IW_RETRY_LIMIT;
+	range->retry_flags = IW_RETRY_LIMIT;
+	range->r_time_flags = 0;
+	/* SRL and LRL limits */
+	range->min_retry = 1;
+	range->max_retry = 255;
+	/* Retry lifetime limits unsupported */
+	range->min_r_time = 0;
+	range->max_r_time = 0;
+#endif /* WIRELESS_EXT > 10 */
+
+#if WIRELESS_EXT > 17
+	range->enc_capa = IW_ENC_CAPA_WPA;
+	range->enc_capa |= IW_ENC_CAPA_CIPHER_TKIP;
+	range->enc_capa |= IW_ENC_CAPA_CIPHER_CCMP;
+	range->enc_capa |= IW_ENC_CAPA_WPA2;
+
+	/* Determine driver FBT capability. */
+	if (dev_wlc_intvar_get(dev, "fbt_cap", &fbt_cap) == 0) {
+		if (fbt_cap == WLC_FBT_CAP_DRV_4WAY_AND_REASSOC) {
+			/* Tell the host (e.g. wpa_supplicant) to let driver do the handshake */
+			range->enc_capa |= IW_ENC_CAPA_4WAY_HANDSHAKE;
+		}
+	}
+
+#ifdef BCMFW_ROAM_ENABLE_WEXT
+	/* Advertise firmware roam capability to the external supplicant */
+	range->enc_capa |= IW_ENC_CAPA_FW_ROAM_ENABLE;
+#endif /* BCMFW_ROAM_ENABLE_WEXT */
+
+	/* Event capability (kernel) */
+	IW_EVENT_CAPA_SET_KERNEL(range->event_capa);
+	/* Event capability (driver) */
+	IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWAP);
+	IW_EVENT_CAPA_SET(range->event_capa, SIOCGIWSCAN);
+	IW_EVENT_CAPA_SET(range->event_capa, IWEVTXDROP);
+	IW_EVENT_CAPA_SET(range->event_capa, IWEVMICHAELMICFAILURE);
+	IW_EVENT_CAPA_SET(range->event_capa, IWEVASSOCREQIE);
+	IW_EVENT_CAPA_SET(range->event_capa, IWEVASSOCRESPIE);
+	IW_EVENT_CAPA_SET(range->event_capa, IWEVPMKIDCAND);
+
+#if WIRELESS_EXT >= 22 && defined(IW_SCAN_CAPA_ESSID)
+	/* FC7 wireless.h defines EXT 22 but doesn't define scan_capa bits */
+	range->scan_capa = IW_SCAN_CAPA_ESSID;
+#endif
+#endif /* WIRELESS_EXT > 17 */
+
+	return 0;
+}
+
+static int
+rssi_to_qual(int rssi)
+{
+	if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+		return 0;
+	else if (rssi <= WL_IW_RSSI_VERY_LOW)
+		return 1;
+	else if (rssi <= WL_IW_RSSI_LOW)
+		return 2;
+	else if (rssi <= WL_IW_RSSI_GOOD)
+		return 3;
+	else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+		return 4;
+	else
+		return 5;
+}
+
+static int
+wl_iw_set_spy(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_iw_t *iw = IW_DEV_IF(dev);
+	struct sockaddr *addr = (struct sockaddr *) extra;
+	int i;
+
+	WL_TRACE(("%s: SIOCSIWSPY\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	iw->spy_num = MIN(ARRAYSIZE(iw->spy_addr), dwrq->length);
+	for (i = 0; i < iw->spy_num; i++)
+		memcpy(&iw->spy_addr[i], addr[i].sa_data, ETHER_ADDR_LEN);
+	memset(iw->spy_qual, 0, sizeof(iw->spy_qual));
+
+	return 0;
+}
+
+static int
+wl_iw_get_spy(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_iw_t *iw = IW_DEV_IF(dev);
+	struct sockaddr *addr = (struct sockaddr *) extra;
+	struct iw_quality *qual = (struct iw_quality *) &addr[iw->spy_num];
+	int i;
+
+	WL_TRACE(("%s: SIOCGIWSPY\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	dwrq->length = iw->spy_num;
+	for (i = 0; i < iw->spy_num; i++) {
+		memcpy(addr[i].sa_data, &iw->spy_addr[i], ETHER_ADDR_LEN);
+		addr[i].sa_family = AF_UNIX;
+		memcpy(&qual[i], &iw->spy_qual[i], sizeof(struct iw_quality));
+		iw->spy_qual[i].updated = 0;
+	}
+
+	return 0;
+}
+
+static int
+wl_iw_set_wap(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct sockaddr *awrq,
+	char *extra
+)
+{
+	int error = -EINVAL;
+
+	WL_TRACE(("%s: SIOCSIWAP\n", dev->name));
+
+	if (awrq->sa_family != ARPHRD_ETHER) {
+		WL_ERROR(("%s: Invalid Header...sa_family\n", __FUNCTION__));
+		return -EINVAL;
+	}
+
+	/* Ignore "auto" or "off" */
+	if (ETHER_ISBCAST(awrq->sa_data) || ETHER_ISNULLADDR(awrq->sa_data)) {
+		scb_val_t scbval;
+		bzero(&scbval, sizeof(scb_val_t));
+		WL_ERROR(("%s: WLC_DISASSOC\n", __FUNCTION__));
+		if ((error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t)))) {
+			WL_ERROR(("%s: WLC_DISASSOC failed (%d).\n", __FUNCTION__, error));
+		}
+		return 0;
+	}
+	/* WL_ASSOC(("Assoc to %s\n", bcm_ether_ntoa((struct ether_addr *)&(awrq->sa_data),
+	 * eabuf)));
+	 */
+	/* Reassociate to the specified AP */
+	if ((error = dev_wlc_ioctl(dev, WLC_REASSOC, awrq->sa_data, ETHER_ADDR_LEN))) {
+		WL_ERROR(("%s: WLC_REASSOC failed (%d).\n", __FUNCTION__, error));
+		return error;
+	}
+	WL_ERROR(("%s: join BSSID="MACSTR"\n", __FUNCTION__, MAC2STR((u8 *)awrq->sa_data)));
+
+	return 0;
+}
+
+static int
+wl_iw_get_wap(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct sockaddr *awrq,
+	char *extra
+)
+{
+	WL_TRACE(("%s: SIOCGIWAP\n", dev->name));
+
+	awrq->sa_family = ARPHRD_ETHER;
+	memset(awrq->sa_data, 0, ETHER_ADDR_LEN);
+
+	/* Ignore error (may be down or disassociated) */
+	(void) dev_wlc_ioctl(dev, WLC_GET_BSSID, awrq->sa_data, ETHER_ADDR_LEN);
+
+	return 0;
+}
+
+#if WIRELESS_EXT > 17
+static int
+wl_iw_mlme(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct sockaddr *awrq,
+	char *extra
+)
+{
+	struct iw_mlme *mlme;
+	scb_val_t scbval;
+	int error  = -EINVAL;
+
+	WL_TRACE(("%s: SIOCSIWMLME\n", dev->name));
+
+	mlme = (struct iw_mlme *)extra;
+	if (mlme == NULL) {
+		WL_ERROR(("Invalid ioctl data.\n"));
+		return error;
+	}
+
+	scbval.val = mlme->reason_code;
+	bcopy(&mlme->addr.sa_data, &scbval.ea, ETHER_ADDR_LEN);
+
+	if (mlme->cmd == IW_MLME_DISASSOC) {
+		scbval.val = htod32(scbval.val);
+		error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t));
+	}
+	else if (mlme->cmd == IW_MLME_DEAUTH) {
+		scbval.val = htod32(scbval.val);
+		error = dev_wlc_ioctl(dev, WLC_SCB_DEAUTHENTICATE_FOR_REASON, &scbval,
+			sizeof(scb_val_t));
+	}
+	else {
+		WL_ERROR(("%s: Invalid ioctl data.\n", __FUNCTION__));
+		return error;
+	}
+
+	return error;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+static int
+wl_iw_get_aplist(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_scan_results_t *list;
+	struct sockaddr *addr = (struct sockaddr *) extra;
+	struct iw_quality qual[IW_MAX_AP];
+	wl_bss_info_t *bi = NULL;
+	int error, i;
+	uint buflen = dwrq->length;
+	int16 rssi;
+
+	WL_TRACE(("%s: SIOCGIWAPLIST\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	/* Get scan results (too large to put on the stack) */
+	list = kmalloc(buflen, GFP_KERNEL);
+	if (!list)
+		return -ENOMEM;
+	memset(list, 0, buflen);
+	list->buflen = htod32(buflen);
+	if ((error = dev_wlc_ioctl(dev, WLC_SCAN_RESULTS, list, buflen))) {
+		WL_ERROR(("%d: Scan results error %d\n", __LINE__, error));
+		kfree(list);
+		return error;
+	}
+	list->buflen = dtoh32(list->buflen);
+	list->version = dtoh32(list->version);
+	list->count = dtoh32(list->count);
+	ASSERT(list->version == WL_BSS_INFO_VERSION);
+
+	for (i = 0, dwrq->length = 0; i < list->count && dwrq->length < IW_MAX_AP; i++) {
+		bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+		ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+			buflen));
+
+		/* Infrastructure only */
+		if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+			continue;
+
+		/* BSSID */
+		memcpy(addr[dwrq->length].sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+		addr[dwrq->length].sa_family = ARPHRD_ETHER;
+		// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+		rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+		qual[dwrq->length].qual = rssi_to_qual(rssi);
+		qual[dwrq->length].level = 0x100 + rssi;
+		qual[dwrq->length].noise = 0x100 + bi->phy_noise;
+
+		/* Updated qual, level, and noise */
+#if WIRELESS_EXT > 18
+		qual[dwrq->length].updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+#else
+		qual[dwrq->length].updated = 7;
+#endif /* WIRELESS_EXT > 18 */
+
+		dwrq->length++;
+	}
+
+	kfree(list);
+
+	if (dwrq->length) {
+		memcpy(&addr[dwrq->length], qual, sizeof(struct iw_quality) * dwrq->length);
+		/* Provided qual */
+		dwrq->flags = 1;
+	}
+
+	return 0;
+}
+
+static int
+wl_iw_iscan_get_aplist(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_scan_results_t *list;
+	iscan_buf_t * buf;
+	iscan_info_t *iscan = g_iscan;
+
+	struct sockaddr *addr = (struct sockaddr *) extra;
+	struct iw_quality qual[IW_MAX_AP];
+	wl_bss_info_t *bi = NULL;
+	int i;
+	int16 rssi;
+
+	WL_TRACE(("%s: SIOCGIWAPLIST\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	if ((!iscan) || (iscan->sysioc_pid < 0)) {
+		return wl_iw_get_aplist(dev, info, dwrq, extra);
+	}
+
+	buf = iscan->list_hdr;
+	/* Get scan results (too large to put on the stack) */
+	while (buf) {
+	    list = &((wl_iscan_results_t*)buf->iscan_buf)->results;
+	    ASSERT(list->version == WL_BSS_INFO_VERSION);
+
+	    bi = NULL;
+	for (i = 0, dwrq->length = 0; i < list->count && dwrq->length < IW_MAX_AP; i++) {
+		bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+		ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+			WLC_IW_ISCAN_MAXLEN));
+
+		/* Infrastructure only */
+		if (!(dtoh16(bi->capability) & DOT11_CAP_ESS))
+			continue;
+
+		/* BSSID */
+		memcpy(addr[dwrq->length].sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+		addr[dwrq->length].sa_family = ARPHRD_ETHER;
+		// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+		rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+		qual[dwrq->length].qual = rssi_to_qual(rssi);
+		qual[dwrq->length].level = 0x100 + rssi;
+		qual[dwrq->length].noise = 0x100 + bi->phy_noise;
+
+		/* Updated qual, level, and noise */
+#if WIRELESS_EXT > 18
+		qual[dwrq->length].updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+#else
+		qual[dwrq->length].updated = 7;
+#endif /* WIRELESS_EXT > 18 */
+
+		dwrq->length++;
+	    }
+	    buf = buf->next;
+	}
+	if (dwrq->length) {
+		memcpy(&addr[dwrq->length], qual, sizeof(struct iw_quality) * dwrq->length);
+		/* Provided qual */
+		dwrq->flags = 1;
+	}
+
+	return 0;
+}
+
+#if WIRELESS_EXT > 13
+static int
+wl_iw_set_scan(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu,
+	char *extra
+)
+{
+	wlc_ssid_t ssid;
+
+	WL_TRACE(("%s: SIOCSIWSCAN\n", dev->name));
+
+	/* default Broadcast scan */
+	memset(&ssid, 0, sizeof(ssid));
+
+#if WIRELESS_EXT > 17
+	/* check for given essid */
+	if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+			struct iw_scan_req *req = (struct iw_scan_req *)extra;
+			ssid.SSID_len = MIN(sizeof(ssid.SSID), req->essid_len);
+			memcpy(ssid.SSID, req->essid, ssid.SSID_len);
+			ssid.SSID_len = htod32(ssid.SSID_len);
+		}
+	}
+#endif
+	/* Ignore error (most likely scan in progress) */
+	(void) dev_wlc_ioctl(dev, WLC_SCAN, &ssid, sizeof(ssid));
+
+	return 0;
+}
+
+static int
+wl_iw_iscan_set_scan(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	union iwreq_data *wrqu,
+	char *extra
+)
+{
+	wlc_ssid_t ssid;
+	iscan_info_t *iscan = g_iscan;
+
+	WL_TRACE(("%s: SIOCSIWSCAN iscan=%p\n", dev->name, iscan));
+
+	/* use backup if our thread is not successful */
+	if ((!iscan) || (iscan->sysioc_pid < 0)) {
+		return wl_iw_set_scan(dev, info, wrqu, extra);
+	}
+	if (iscan->iscan_state == ISCAN_STATE_SCANING) {
+		return 0;
+	}
+
+	/* default Broadcast scan */
+	memset(&ssid, 0, sizeof(ssid));
+
+#if WIRELESS_EXT > 17
+	/* check for given essid */
+	if (wrqu->data.length == sizeof(struct iw_scan_req)) {
+		if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
+			struct iw_scan_req *req = (struct iw_scan_req *)extra;
+			ssid.SSID_len = MIN(sizeof(ssid.SSID), req->essid_len);
+			memcpy(ssid.SSID, req->essid, ssid.SSID_len);
+			ssid.SSID_len = htod32(ssid.SSID_len);
+		}
+	}
+#endif
+
+	iscan->list_cur = iscan->list_hdr;
+	iscan->iscan_state = ISCAN_STATE_SCANING;
+
+
+	wl_iw_set_event_mask(dev);
+	wl_iw_iscan(iscan, &ssid, WL_SCAN_ACTION_START);
+
+	iscan->timer.expires = jiffies + msecs_to_jiffies(iscan->timer_ms);
+	add_timer(&iscan->timer);
+	iscan->timer_on = 1;
+
+	return 0;
+}
+
+#if WIRELESS_EXT > 17
+static bool
+ie_is_wpa_ie(uint8 **wpaie, uint8 **tlvs, int *tlvs_len)
+{
+/* Is this body of this tlvs entry a WPA entry? If */
+/* not update the tlvs buffer pointer/length */
+	uint8 *ie = *wpaie;
+
+	/* If the contents match the WPA_OUI and type=1 */
+	if ((ie[1] >= 6) &&
+		!bcmp((const void *)&ie[2], (const void *)(WPA_OUI "\x01"), 4)) {
+		return TRUE;
+	}
+
+	/* point to the next ie */
+	ie += ie[1] + 2;
+	/* calculate the length of the rest of the buffer */
+	*tlvs_len -= (int)(ie - *tlvs);
+	/* update the pointer to the start of the buffer */
+	*tlvs = ie;
+	return FALSE;
+}
+
+static bool
+ie_is_wps_ie(uint8 **wpsie, uint8 **tlvs, int *tlvs_len)
+{
+/* Is this body of this tlvs entry a WPS entry? If */
+/* not update the tlvs buffer pointer/length */
+	uint8 *ie = *wpsie;
+
+	/* If the contents match the WPA_OUI and type=4 */
+	if ((ie[1] >= 4) &&
+		!bcmp((const void *)&ie[2], (const void *)(WPA_OUI "\x04"), 4)) {
+		return TRUE;
+	}
+
+	/* point to the next ie */
+	ie += ie[1] + 2;
+	/* calculate the length of the rest of the buffer */
+	*tlvs_len -= (int)(ie - *tlvs);
+	/* update the pointer to the start of the buffer */
+	*tlvs = ie;
+	return FALSE;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+#ifdef BCMWAPI_WPI
+static inline int _wpa_snprintf_hex(char *buf, size_t buf_size, const u8 *data,
+	size_t len, int uppercase)
+{
+	size_t i;
+	char *pos = buf, *end = buf + buf_size;
+	int ret;
+	if (buf_size == 0)
+		return 0;
+	for (i = 0; i < len; i++) {
+		ret = snprintf(pos, end - pos, uppercase ? "%02X" : "%02x",
+			data[i]);
+		if (ret < 0 || ret >= end - pos) {
+			end[-1] = '\0';
+			return pos - buf;
+		}
+		pos += ret;
+	}
+	end[-1] = '\0';
+	return pos - buf;
+}
+
+/**
+ * wpa_snprintf_hex - Print data as a hex string into a buffer
+ * @buf: Memory area to use as the output buffer
+ * @buf_size: Maximum buffer size in bytes (should be at least 2 * len + 1)
+ * @data: Data to be printed
+ * @len: Length of data in bytes
+ * Returns: Number of bytes written
+ */
+static int
+wpa_snprintf_hex(char *buf, size_t buf_size, const u8 *data, size_t len)
+{
+	return _wpa_snprintf_hex(buf, buf_size, data, len, 0);
+}
+#endif /* BCMWAPI_WPI */
+
+static int
+wl_iw_handle_scanresults_ies(char **event_p, char *end,
+	struct iw_request_info *info, wl_bss_info_t *bi)
+{
+#if WIRELESS_EXT > 17
+	struct iw_event	iwe;
+	char *event;
+#ifdef BCMWAPI_WPI
+	char *buf;
+	int custom_event_len;
+#endif
+
+	event = *event_p;
+	if (bi->ie_length) {
+		/* look for wpa/rsn ies in the ie list... */
+		bcm_tlv_t *ie;
+		uint8 *ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+		int ptr_len = bi->ie_length;
+
+		/* OSEN IE */
+		if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_VS_ID)) &&
+			ie->len > WFA_OUI_LEN + 1 &&
+			!bcmp((const void *)&ie->data[0], (const void *)WFA_OUI, WFA_OUI_LEN) &&
+			ie->data[WFA_OUI_LEN] == WFA_OUI_TYPE_OSEN) {
+			iwe.cmd = IWEVGENIE;
+			iwe.u.data.length = ie->len + 2;
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+		}
+		ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+
+		if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_RSN_ID))) {
+			iwe.cmd = IWEVGENIE;
+			iwe.u.data.length = ie->len + 2;
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+		}
+		ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+
+		if ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_MDIE_ID))) {
+			iwe.cmd = IWEVGENIE;
+			iwe.u.data.length = ie->len + 2;
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+		}
+		ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+
+		while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WPA_ID))) {
+			/* look for WPS IE */
+			if (ie_is_wps_ie(((uint8 **)&ie), &ptr, &ptr_len)) {
+				iwe.cmd = IWEVGENIE;
+				iwe.u.data.length = ie->len + 2;
+				event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+				break;
+			}
+		}
+
+		ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+		ptr_len = bi->ie_length;
+		while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WPA_ID))) {
+			if (ie_is_wpa_ie(((uint8 **)&ie), &ptr, &ptr_len)) {
+				iwe.cmd = IWEVGENIE;
+				iwe.u.data.length = ie->len + 2;
+				event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+				break;
+			}
+		}
+
+#ifdef BCMWAPI_WPI
+		ptr = ((uint8 *)bi) + sizeof(wl_bss_info_t);
+		ptr_len = bi->ie_length;
+
+		while ((ie = bcm_parse_tlvs(ptr, ptr_len, DOT11_MNG_WAPI_ID))) {
+			WL_TRACE(("%s: found a WAPI IE...\n", __FUNCTION__));
+#ifdef WAPI_IE_USE_GENIE
+			iwe.cmd = IWEVGENIE;
+			iwe.u.data.length = ie->len + 2;
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)ie);
+#else /* using CUSTOM event */
+			iwe.cmd = IWEVCUSTOM;
+			custom_event_len = strlen("wapi_ie=") + 2*(ie->len + 2);
+			iwe.u.data.length = custom_event_len;
+
+			buf = kmalloc(custom_event_len+1, GFP_KERNEL);
+			if (buf == NULL)
+			{
+				WL_ERROR(("malloc(%d) returned NULL...\n", custom_event_len));
+				break;
+			}
+
+			memcpy(buf, "wapi_ie=", 8);
+			wpa_snprintf_hex(buf + 8, 2+1, &(ie->id), 1);
+			wpa_snprintf_hex(buf + 10, 2+1, &(ie->len), 1);
+			wpa_snprintf_hex(buf + 12, 2*ie->len+1, ie->data, ie->len);
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, buf);
+			kfree(buf);
+#endif /* WAPI_IE_USE_GENIE */
+			break;
+		}
+#endif /* BCMWAPI_WPI */
+	*event_p = event;
+	}
+
+#endif /* WIRELESS_EXT > 17 */
+	return 0;
+}
+static int
+wl_iw_get_scan(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	channel_info_t ci;
+	wl_scan_results_t *list;
+	struct iw_event	iwe;
+	wl_bss_info_t *bi = NULL;
+	int error, i, j;
+	char *event = extra, *end = extra + dwrq->length, *value;
+	uint buflen = dwrq->length;
+	int16 rssi;
+	int channel;
+
+	WL_TRACE(("%s: %s SIOCGIWSCAN\n", __FUNCTION__, dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	/* Check for scan in progress */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_CHANNEL, &ci, sizeof(ci))))
+		return error;
+	ci.scan_channel = dtoh32(ci.scan_channel);
+	if (ci.scan_channel)
+		return -EAGAIN;
+
+	/* Get scan results (too large to put on the stack) */
+	list = kmalloc(buflen, GFP_KERNEL);
+	if (!list)
+		return -ENOMEM;
+	memset(list, 0, buflen);
+	list->buflen = htod32(buflen);
+	if ((error = dev_wlc_ioctl(dev, WLC_SCAN_RESULTS, list, buflen))) {
+		kfree(list);
+		return error;
+	}
+	list->buflen = dtoh32(list->buflen);
+	list->version = dtoh32(list->version);
+	list->count = dtoh32(list->count);
+
+	ASSERT(list->version == WL_BSS_INFO_VERSION);
+
+	for (i = 0; i < list->count && i < IW_MAX_AP; i++) {
+		bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+		ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+			buflen));
+
+		// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+		rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+		channel = (bi->ctl_ch == 0) ? CHSPEC_CHANNEL(bi->chanspec) : bi->ctl_ch;
+		WL_SCAN(("%s: BSSID="MACSTR", channel=%d, RSSI=%d, merge broadcast SSID=\"%s\"\n",
+		__FUNCTION__, MAC2STR(bi->BSSID.octet), channel, rssi, bi->SSID));
+
+		/* First entry must be the BSSID */
+		iwe.cmd = SIOCGIWAP;
+		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+		memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+		event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+
+		/* SSID */
+		iwe.u.data.length = dtoh32(bi->SSID_len);
+		iwe.cmd = SIOCGIWESSID;
+		iwe.u.data.flags = 1;
+		event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+		/* Mode */
+		if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+			iwe.cmd = SIOCGIWMODE;
+			if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+				iwe.u.mode = IW_MODE_INFRA;
+			else
+				iwe.u.mode = IW_MODE_ADHOC;
+			event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_UINT_LEN);
+		}
+
+		/* Channel */
+		iwe.cmd = SIOCGIWFREQ;
+		iwe.u.freq.m = wf_channel2mhz(channel,
+			(CHSPEC_IS2G(bi->chanspec)) ?
+			WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+		iwe.u.freq.e = 6;
+		event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+		/* Channel quality */
+		iwe.cmd = IWEVQUAL;
+		iwe.u.qual.qual = rssi_to_qual(rssi);
+		iwe.u.qual.level = 0x100 + rssi;
+		iwe.u.qual.noise = 0x100 + bi->phy_noise;
+		event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+		/* WPA, WPA2, WPS, WAPI IEs */
+		 wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+		/* Encryption */
+		iwe.cmd = SIOCGIWENCODE;
+		if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+			iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+		else
+			iwe.u.data.flags = IW_ENCODE_DISABLED;
+		iwe.u.data.length = 0;
+		event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+		/* Rates */
+		if (bi->rateset.count) {
+			value = event + IW_EV_LCP_LEN;
+			iwe.cmd = SIOCGIWRATE;
+			/* Those two flags are ignored... */
+			iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+			for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+				iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
+				value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+					IW_EV_PARAM_LEN);
+			}
+			event = value;
+		}
+	}
+
+	kfree(list);
+
+	dwrq->length = event - extra;
+	dwrq->flags = 0;	/* todo */
+
+	return 0;
+}
+
+static int
+wl_iw_iscan_get_scan(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_scan_results_t *list;
+	struct iw_event	iwe;
+	wl_bss_info_t *bi = NULL;
+	int ii, j;
+	int apcnt;
+	char *event = extra, *end = extra + dwrq->length, *value;
+	iscan_info_t *iscan = g_iscan;
+	iscan_buf_t * p_buf;
+	int16 rssi;
+	int channel;
+
+	WL_TRACE(("%s: %s SIOCGIWSCAN\n", __FUNCTION__, dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	/* use backup if our thread is not successful */
+	if ((!iscan) || (iscan->sysioc_pid < 0)) {
+		return wl_iw_get_scan(dev, info, dwrq, extra);
+	}
+
+	/* Check for scan in progress */
+	if (iscan->iscan_state == ISCAN_STATE_SCANING) {
+		WL_TRACE(("%s: SIOCGIWSCAN GET still scanning\n", dev->name));
+		return -EAGAIN;
+	}
+
+	apcnt = 0;
+	p_buf = iscan->list_hdr;
+	/* Get scan results */
+	while (p_buf != iscan->list_cur) {
+		list = &((wl_iscan_results_t*)p_buf->iscan_buf)->results;
+
+		if (list->version != WL_BSS_INFO_VERSION) {
+			WL_ERROR(("list->version %d != WL_BSS_INFO_VERSION\n", list->version));
+		}
+
+		bi = NULL;
+		for (ii = 0; ii < list->count && apcnt < IW_MAX_AP; apcnt++, ii++) {
+			bi = bi ? (wl_bss_info_t *)((uintptr)bi + dtoh32(bi->length)) : list->bss_info;
+			ASSERT(((uintptr)bi + dtoh32(bi->length)) <= ((uintptr)list +
+				WLC_IW_ISCAN_MAXLEN));
+
+			/* overflow check cover fields before wpa IEs */
+			if (event + ETHER_ADDR_LEN + bi->SSID_len + IW_EV_UINT_LEN + IW_EV_FREQ_LEN +
+				IW_EV_QUAL_LEN >= end)
+				return -E2BIG;
+
+			// terence 20150419: limit the max. rssi to -2 or the bss will be filtered out in android OS
+			rssi = MIN(dtoh16(bi->RSSI), RSSI_MAXVAL);
+			channel = (bi->ctl_ch == 0) ? CHSPEC_CHANNEL(bi->chanspec) : bi->ctl_ch;
+			WL_SCAN(("%s: BSSID="MACSTR", channel=%d, RSSI=%d, merge broadcast SSID=\"%s\"\n",
+			__FUNCTION__, MAC2STR(bi->BSSID.octet), channel, rssi, bi->SSID));
+
+			/* First entry must be the BSSID */
+			iwe.cmd = SIOCGIWAP;
+			iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+			memcpy(iwe.u.ap_addr.sa_data, &bi->BSSID, ETHER_ADDR_LEN);
+			event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_ADDR_LEN);
+
+			/* SSID */
+			iwe.u.data.length = dtoh32(bi->SSID_len);
+			iwe.cmd = SIOCGIWESSID;
+			iwe.u.data.flags = 1;
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, bi->SSID);
+
+			/* Mode */
+			if (dtoh16(bi->capability) & (DOT11_CAP_ESS | DOT11_CAP_IBSS)) {
+				iwe.cmd = SIOCGIWMODE;
+				if (dtoh16(bi->capability) & DOT11_CAP_ESS)
+					iwe.u.mode = IW_MODE_INFRA;
+				else
+					iwe.u.mode = IW_MODE_ADHOC;
+				event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_UINT_LEN);
+			}
+
+			/* Channel */
+			iwe.cmd = SIOCGIWFREQ;
+			iwe.u.freq.m = wf_channel2mhz(channel,
+				(CHSPEC_IS2G(bi->chanspec)) ?
+				WF_CHAN_FACTOR_2_4_G : WF_CHAN_FACTOR_5_G);
+			iwe.u.freq.e = 6;
+			event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_FREQ_LEN);
+
+			/* Channel quality */
+			iwe.cmd = IWEVQUAL;
+			iwe.u.qual.qual = rssi_to_qual(rssi);
+			iwe.u.qual.level = 0x100 + rssi;
+			iwe.u.qual.noise = 0x100 + bi->phy_noise;
+			event = IWE_STREAM_ADD_EVENT(info, event, end, &iwe, IW_EV_QUAL_LEN);
+
+			/* WPA, WPA2, WPS, WAPI IEs */
+			wl_iw_handle_scanresults_ies(&event, end, info, bi);
+
+			/* Encryption */
+			iwe.cmd = SIOCGIWENCODE;
+			if (dtoh16(bi->capability) & DOT11_CAP_PRIVACY)
+				iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+			else
+				iwe.u.data.flags = IW_ENCODE_DISABLED;
+			iwe.u.data.length = 0;
+			event = IWE_STREAM_ADD_POINT(info, event, end, &iwe, (char *)event);
+
+			/* Rates */
+			if (bi->rateset.count <= sizeof(bi->rateset.rates)) {
+				if (event + IW_MAX_BITRATES*IW_EV_PARAM_LEN >= end)
+					return -E2BIG;
+
+				value = event + IW_EV_LCP_LEN;
+				iwe.cmd = SIOCGIWRATE;
+				/* Those two flags are ignored... */
+				iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+				for (j = 0; j < bi->rateset.count && j < IW_MAX_BITRATES; j++) {
+					iwe.u.bitrate.value = (bi->rateset.rates[j] & 0x7f) * 500000;
+					value = IWE_STREAM_ADD_VALUE(info, event, value, end, &iwe,
+						IW_EV_PARAM_LEN);
+				}
+				event = value;
+			}
+		}
+		p_buf = p_buf->next;
+	} /* while (p_buf) */
+
+	dwrq->length = event - extra;
+	dwrq->flags = 0;	/* todo */
+
+	return 0;
+}
+
+#endif /* WIRELESS_EXT > 13 */
+
+
+static int
+wl_iw_set_essid(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wlc_ssid_t ssid;
+	int error;
+
+	WL_TRACE(("%s: SIOCSIWESSID\n", dev->name));
+
+	/* default Broadcast SSID */
+	memset(&ssid, 0, sizeof(ssid));
+	if (dwrq->length && extra) {
+#if WIRELESS_EXT > 20
+		ssid.SSID_len = MIN(sizeof(ssid.SSID), dwrq->length);
+#else
+		ssid.SSID_len = MIN(sizeof(ssid.SSID), dwrq->length-1);
+#endif
+		memcpy(ssid.SSID, extra, ssid.SSID_len);
+		ssid.SSID_len = htod32(ssid.SSID_len);
+
+		if ((error = dev_wlc_ioctl(dev, WLC_SET_SSID, &ssid, sizeof(ssid)))) {
+			WL_ERROR(("%s: WLC_SET_SSID failed (%d).\n", __FUNCTION__, error));
+			return error;
+		}
+		WL_ERROR(("%s: join SSID=%s\n", __FUNCTION__, ssid.SSID));
+	}
+	/* If essid null then it is "iwconfig <interface> essid off" command */
+	else {
+		scb_val_t scbval;
+		bzero(&scbval, sizeof(scb_val_t));
+		WL_ERROR(("%s: WLC_DISASSOC\n", __FUNCTION__));
+		if ((error = dev_wlc_ioctl(dev, WLC_DISASSOC, &scbval, sizeof(scb_val_t)))) {
+			WL_ERROR(("%s: WLC_DISASSOC failed (%d).\n", __FUNCTION__, error));
+			return error;
+		}
+	}
+	return 0;
+}
+
+static int
+wl_iw_get_essid(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wlc_ssid_t ssid;
+	int error;
+
+	WL_TRACE(("%s: SIOCGIWESSID\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_SSID, &ssid, sizeof(ssid)))) {
+		WL_ERROR(("Error getting the SSID\n"));
+		return error;
+	}
+
+	ssid.SSID_len = dtoh32(ssid.SSID_len);
+
+	/* Get the current SSID */
+	memcpy(extra, ssid.SSID, ssid.SSID_len);
+
+	dwrq->length = ssid.SSID_len;
+
+	dwrq->flags = 1; /* active */
+
+	return 0;
+}
+
+static int
+wl_iw_set_nick(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_iw_t *iw = IW_DEV_IF(dev);
+	WL_TRACE(("%s: SIOCSIWNICKN\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	/* Check the size of the string */
+	if (dwrq->length > sizeof(iw->nickname))
+		return -E2BIG;
+
+	memcpy(iw->nickname, extra, dwrq->length);
+	iw->nickname[dwrq->length - 1] = '\0';
+
+	return 0;
+}
+
+static int
+wl_iw_get_nick(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_iw_t *iw = IW_DEV_IF(dev);
+	WL_TRACE(("%s: SIOCGIWNICKN\n", dev->name));
+
+	if (!extra)
+		return -EINVAL;
+
+	strcpy(extra, iw->nickname);
+	dwrq->length = strlen(extra) + 1;
+
+	return 0;
+}
+
+static int wl_iw_set_rate(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	wl_rateset_t rateset;
+	int error, rate, i, error_bg, error_a;
+
+	WL_TRACE(("%s: SIOCSIWRATE\n", dev->name));
+
+	/* Get current rateset */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_CURR_RATESET, &rateset, sizeof(rateset))))
+		return error;
+
+	rateset.count = dtoh32(rateset.count);
+
+	if (vwrq->value < 0) {
+		/* Select maximum rate */
+		rate = rateset.rates[rateset.count - 1] & 0x7f;
+	} else if (vwrq->value < rateset.count) {
+		/* Select rate by rateset index */
+		rate = rateset.rates[vwrq->value] & 0x7f;
+	} else {
+		/* Specified rate in bps */
+		rate = vwrq->value / 500000;
+	}
+
+	if (vwrq->fixed) {
+		/*
+			Set rate override,
+			Since the is a/b/g-blind, both a/bg_rate are enforced.
+		*/
+		error_bg = dev_wlc_intvar_set(dev, "bg_rate", rate);
+		error_a = dev_wlc_intvar_set(dev, "a_rate", rate);
+
+		if (error_bg && error_a)
+			return (error_bg | error_a);
+	} else {
+		/*
+			clear rate override
+			Since the is a/b/g-blind, both a/bg_rate are enforced.
+		*/
+		/* 0 is for clearing rate override */
+		error_bg = dev_wlc_intvar_set(dev, "bg_rate", 0);
+		/* 0 is for clearing rate override */
+		error_a = dev_wlc_intvar_set(dev, "a_rate", 0);
+
+		if (error_bg && error_a)
+			return (error_bg | error_a);
+
+		/* Remove rates above selected rate */
+		for (i = 0; i < rateset.count; i++)
+			if ((rateset.rates[i] & 0x7f) > rate)
+				break;
+		rateset.count = htod32(i);
+
+		/* Set current rateset */
+		if ((error = dev_wlc_ioctl(dev, WLC_SET_RATESET, &rateset, sizeof(rateset))))
+			return error;
+	}
+
+	return 0;
+}
+
+static int wl_iw_get_rate(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, rate;
+
+	WL_TRACE(("%s: SIOCGIWRATE\n", dev->name));
+
+	/* Report the current tx rate */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_RATE, &rate, sizeof(rate))))
+		return error;
+	rate = dtoh32(rate);
+	vwrq->value = rate * 500000;
+
+	return 0;
+}
+
+static int
+wl_iw_set_rts(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, rts;
+
+	WL_TRACE(("%s: SIOCSIWRTS\n", dev->name));
+
+	if (vwrq->disabled)
+		rts = DOT11_DEFAULT_RTS_LEN;
+	else if (vwrq->value < 0 || vwrq->value > DOT11_DEFAULT_RTS_LEN)
+		return -EINVAL;
+	else
+		rts = vwrq->value;
+
+	if ((error = dev_wlc_intvar_set(dev, "rtsthresh", rts)))
+		return error;
+
+	return 0;
+}
+
+static int
+wl_iw_get_rts(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, rts;
+
+	WL_TRACE(("%s: SIOCGIWRTS\n", dev->name));
+
+	if ((error = dev_wlc_intvar_get(dev, "rtsthresh", &rts)))
+		return error;
+
+	vwrq->value = rts;
+	vwrq->disabled = (rts >= DOT11_DEFAULT_RTS_LEN);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+static int
+wl_iw_set_frag(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, frag;
+
+	WL_TRACE(("%s: SIOCSIWFRAG\n", dev->name));
+
+	if (vwrq->disabled)
+		frag = DOT11_DEFAULT_FRAG_LEN;
+	else if (vwrq->value < 0 || vwrq->value > DOT11_DEFAULT_FRAG_LEN)
+		return -EINVAL;
+	else
+		frag = vwrq->value;
+
+	if ((error = dev_wlc_intvar_set(dev, "fragthresh", frag)))
+		return error;
+
+	return 0;
+}
+
+static int
+wl_iw_get_frag(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, fragthreshold;
+
+	WL_TRACE(("%s: SIOCGIWFRAG\n", dev->name));
+
+	if ((error = dev_wlc_intvar_get(dev, "fragthresh", &fragthreshold)))
+		return error;
+
+	vwrq->value = fragthreshold;
+	vwrq->disabled = (fragthreshold >= DOT11_DEFAULT_FRAG_LEN);
+	vwrq->fixed = 1;
+
+	return 0;
+}
+
+static int
+wl_iw_set_txpow(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, disable;
+	uint16 txpwrmw;
+	WL_TRACE(("%s: SIOCSIWTXPOW\n", dev->name));
+
+	/* Make sure radio is off or on as far as software is concerned */
+	disable = vwrq->disabled ? WL_RADIO_SW_DISABLE : 0;
+	disable += WL_RADIO_SW_DISABLE << 16;
+
+	disable = htod32(disable);
+	if ((error = dev_wlc_ioctl(dev, WLC_SET_RADIO, &disable, sizeof(disable))))
+		return error;
+
+	/* If Radio is off, nothing more to do */
+	if (disable & WL_RADIO_SW_DISABLE)
+		return 0;
+
+	/* Only handle mW */
+	if (!(vwrq->flags & IW_TXPOW_MWATT))
+		return -EINVAL;
+
+	/* Value < 0 means just "on" or "off" */
+	if (vwrq->value < 0)
+		return 0;
+
+	if (vwrq->value > 0xffff) txpwrmw = 0xffff;
+	else txpwrmw = (uint16)vwrq->value;
+
+
+	error = dev_wlc_intvar_set(dev, "qtxpower", (int)(bcm_mw_to_qdbm(txpwrmw)));
+	return error;
+}
+
+static int
+wl_iw_get_txpow(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, disable, txpwrdbm;
+	uint8 result;
+
+	WL_TRACE(("%s: SIOCGIWTXPOW\n", dev->name));
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_RADIO, &disable, sizeof(disable))) ||
+	    (error = dev_wlc_intvar_get(dev, "qtxpower", &txpwrdbm)))
+		return error;
+
+	disable = dtoh32(disable);
+	result = (uint8)(txpwrdbm & ~WL_TXPWR_OVERRIDE);
+	vwrq->value = (int32)bcm_qdbm_to_mw(result);
+	vwrq->fixed = 0;
+	vwrq->disabled = (disable & (WL_RADIO_SW_DISABLE | WL_RADIO_HW_DISABLE)) ? 1 : 0;
+	vwrq->flags = IW_TXPOW_MWATT;
+
+	return 0;
+}
+
+#if WIRELESS_EXT > 10
+static int
+wl_iw_set_retry(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, lrl, srl;
+
+	WL_TRACE(("%s: SIOCSIWRETRY\n", dev->name));
+
+	/* Do not handle "off" or "lifetime" */
+	if (vwrq->disabled || (vwrq->flags & IW_RETRY_LIFETIME))
+		return -EINVAL;
+
+	/* Handle "[min|max] limit" */
+	if (vwrq->flags & IW_RETRY_LIMIT) {
+		/* "max limit" or just "limit" */
+#if WIRELESS_EXT > 20
+		if ((vwrq->flags & IW_RETRY_LONG) ||(vwrq->flags & IW_RETRY_MAX) ||
+			!((vwrq->flags & IW_RETRY_SHORT) || (vwrq->flags & IW_RETRY_MIN)))
+#else
+		if ((vwrq->flags & IW_RETRY_MAX) || !(vwrq->flags & IW_RETRY_MIN))
+#endif /* WIRELESS_EXT > 20 */
+		{
+			lrl = htod32(vwrq->value);
+			if ((error = dev_wlc_ioctl(dev, WLC_SET_LRL, &lrl, sizeof(lrl))))
+				return error;
+		}
+		/* "min limit" or just "limit" */
+#if WIRELESS_EXT > 20
+		if ((vwrq->flags & IW_RETRY_SHORT) ||(vwrq->flags & IW_RETRY_MIN) ||
+			!((vwrq->flags & IW_RETRY_LONG) || (vwrq->flags & IW_RETRY_MAX)))
+#else
+		if ((vwrq->flags & IW_RETRY_MIN) || !(vwrq->flags & IW_RETRY_MAX))
+#endif /* WIRELESS_EXT > 20 */
+		{
+			srl = htod32(vwrq->value);
+			if ((error = dev_wlc_ioctl(dev, WLC_SET_SRL, &srl, sizeof(srl))))
+				return error;
+		}
+	}
+
+	return 0;
+}
+
+static int
+wl_iw_get_retry(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, lrl, srl;
+
+	WL_TRACE(("%s: SIOCGIWRETRY\n", dev->name));
+
+	vwrq->disabled = 0;      /* Can't be disabled */
+
+	/* Do not handle lifetime queries */
+	if ((vwrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME)
+		return -EINVAL;
+
+	/* Get retry limits */
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_LRL, &lrl, sizeof(lrl))) ||
+	    (error = dev_wlc_ioctl(dev, WLC_GET_SRL, &srl, sizeof(srl))))
+		return error;
+
+	lrl = dtoh32(lrl);
+	srl = dtoh32(srl);
+
+	/* Note : by default, display the min retry number */
+	if (vwrq->flags & IW_RETRY_MAX) {
+		vwrq->flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+		vwrq->value = lrl;
+	} else {
+		vwrq->flags = IW_RETRY_LIMIT;
+		vwrq->value = srl;
+		if (srl != lrl)
+			vwrq->flags |= IW_RETRY_MIN;
+	}
+
+	return 0;
+}
+#endif /* WIRELESS_EXT > 10 */
+
+static int
+wl_iw_set_encode(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_wsec_key_t key;
+	int error, val, wsec;
+
+	WL_TRACE(("%s: SIOCSIWENCODE\n", dev->name));
+
+	memset(&key, 0, sizeof(key));
+
+	if ((dwrq->flags & IW_ENCODE_INDEX) == 0) {
+		/* Find the current key */
+		for (key.index = 0; key.index < DOT11_MAX_DEFAULT_KEYS; key.index++) {
+			val = htod32(key.index);
+			if ((error = dev_wlc_ioctl(dev, WLC_GET_KEY_PRIMARY, &val, sizeof(val))))
+				return error;
+			val = dtoh32(val);
+			if (val)
+				break;
+		}
+		/* Default to 0 */
+		if (key.index == DOT11_MAX_DEFAULT_KEYS)
+			key.index = 0;
+	} else {
+		key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+		if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+			return -EINVAL;
+	}
+
+	/* Interpret "off" to mean no encryption */
+	wsec = (dwrq->flags & IW_ENCODE_DISABLED) ? 0 : WEP_ENABLED;
+
+	if ((error = dev_wlc_intvar_set(dev, "wsec", wsec)))
+		return error;
+
+	/* Old API used to pass a NULL pointer instead of IW_ENCODE_NOKEY */
+	if (!extra || !dwrq->length || (dwrq->flags & IW_ENCODE_NOKEY)) {
+		/* Just select a new current key */
+		val = htod32(key.index);
+		if ((error = dev_wlc_ioctl(dev, WLC_SET_KEY_PRIMARY, &val, sizeof(val))))
+			return error;
+	} else {
+		key.len = dwrq->length;
+
+		if (dwrq->length > sizeof(key.data))
+			return -EINVAL;
+
+		memcpy(key.data, extra, dwrq->length);
+
+		key.flags = WL_PRIMARY_KEY;
+		switch (key.len) {
+		case WEP1_KEY_SIZE:
+			key.algo = CRYPTO_ALGO_WEP1;
+			break;
+		case WEP128_KEY_SIZE:
+			key.algo = CRYPTO_ALGO_WEP128;
+			break;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
+		case TKIP_KEY_SIZE:
+			key.algo = CRYPTO_ALGO_TKIP;
+			break;
+#endif
+		case AES_KEY_SIZE:
+			key.algo = CRYPTO_ALGO_AES_CCM;
+			break;
+		default:
+			return -EINVAL;
+		}
+
+		/* Set the new key/index */
+		swap_key_from_BE(&key);
+		if ((error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key))))
+			return error;
+	}
+
+	/* Interpret "restricted" to mean shared key authentication */
+	val = (dwrq->flags & IW_ENCODE_RESTRICTED) ? 1 : 0;
+	val = htod32(val);
+	if ((error = dev_wlc_ioctl(dev, WLC_SET_AUTH, &val, sizeof(val))))
+		return error;
+
+	return 0;
+}
+
+static int
+wl_iw_get_encode(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_wsec_key_t key;
+	int error, val, wsec, auth;
+
+	WL_TRACE(("%s: SIOCGIWENCODE\n", dev->name));
+
+	/* assure default values of zero for things we don't touch */
+	bzero(&key, sizeof(wl_wsec_key_t));
+
+	if ((dwrq->flags & IW_ENCODE_INDEX) == 0) {
+		/* Find the current key */
+		for (key.index = 0; key.index < DOT11_MAX_DEFAULT_KEYS; key.index++) {
+			val = key.index;
+			if ((error = dev_wlc_ioctl(dev, WLC_GET_KEY_PRIMARY, &val, sizeof(val))))
+				return error;
+			val = dtoh32(val);
+			if (val)
+				break;
+		}
+	} else
+		key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+	if (key.index >= DOT11_MAX_DEFAULT_KEYS)
+		key.index = 0;
+
+	/* Get info */
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_WSEC, &wsec, sizeof(wsec))) ||
+	    (error = dev_wlc_ioctl(dev, WLC_GET_AUTH, &auth, sizeof(auth))))
+		return error;
+
+	swap_key_to_BE(&key);
+
+	wsec = dtoh32(wsec);
+	auth = dtoh32(auth);
+	/* Get key length */
+	dwrq->length = MIN(IW_ENCODING_TOKEN_MAX, key.len);
+
+	/* Get flags */
+	dwrq->flags = key.index + 1;
+	if (!(wsec & (WEP_ENABLED | TKIP_ENABLED | AES_ENABLED))) {
+		/* Interpret "off" to mean no encryption */
+		dwrq->flags |= IW_ENCODE_DISABLED;
+	}
+	if (auth) {
+		/* Interpret "restricted" to mean shared key authentication */
+		dwrq->flags |= IW_ENCODE_RESTRICTED;
+	}
+
+	/* Get key */
+	if (dwrq->length && extra)
+		memcpy(extra, key.data, dwrq->length);
+
+	return 0;
+}
+
+static int
+wl_iw_set_power(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, pm;
+
+	WL_TRACE(("%s: SIOCSIWPOWER\n", dev->name));
+
+	pm = vwrq->disabled ? PM_OFF : PM_MAX;
+
+	pm = htod32(pm);
+	if ((error = dev_wlc_ioctl(dev, WLC_SET_PM, &pm, sizeof(pm))))
+		return error;
+
+	return 0;
+}
+
+static int
+wl_iw_get_power(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error, pm;
+
+	WL_TRACE(("%s: SIOCGIWPOWER\n", dev->name));
+
+	if ((error = dev_wlc_ioctl(dev, WLC_GET_PM, &pm, sizeof(pm))))
+		return error;
+
+	pm = dtoh32(pm);
+	vwrq->disabled = pm ? 0 : 1;
+	vwrq->flags = IW_POWER_ALL_R;
+
+	return 0;
+}
+
+#if WIRELESS_EXT > 17
+static int
+wl_iw_set_wpaie(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *iwp,
+	char *extra
+)
+{
+#if defined(BCMWAPI_WPI)
+	uchar buf[WLC_IOCTL_SMLEN] = {0};
+	uchar *p = buf;
+	int wapi_ie_size;
+
+	WL_TRACE(("%s: SIOCSIWGENIE\n", dev->name));
+
+	if (extra[0] == DOT11_MNG_WAPI_ID)
+	{
+		wapi_ie_size = iwp->length;
+		memcpy(p, extra, iwp->length);
+		dev_wlc_bufvar_set(dev, "wapiie", buf, wapi_ie_size);
+	}
+	else
+#endif
+		dev_wlc_bufvar_set(dev, "wpaie", extra, iwp->length);
+
+	return 0;
+}
+
+static int
+wl_iw_get_wpaie(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *iwp,
+	char *extra
+)
+{
+	WL_TRACE(("%s: SIOCGIWGENIE\n", dev->name));
+	iwp->length = 64;
+	dev_wlc_bufvar_get(dev, "wpaie", extra, iwp->length);
+	return 0;
+}
+
+static int
+wl_iw_set_encodeext(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_point *dwrq,
+	char *extra
+)
+{
+	wl_wsec_key_t key;
+	int error;
+	struct iw_encode_ext *iwe;
+
+	WL_TRACE(("%s: SIOCSIWENCODEEXT\n", dev->name));
+
+	memset(&key, 0, sizeof(key));
+	iwe = (struct iw_encode_ext *)extra;
+
+	/* disable encryption completely  */
+	if (dwrq->flags & IW_ENCODE_DISABLED) {
+
+	}
+
+	/* get the key index */
+	key.index = 0;
+	if (dwrq->flags & IW_ENCODE_INDEX)
+		key.index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+
+	key.len = iwe->key_len;
+
+	/* Instead of bcast for ea address for default wep keys, driver needs it to be Null */
+	if (!ETHER_ISMULTI(iwe->addr.sa_data))
+		bcopy((void *)&iwe->addr.sa_data, (char *)&key.ea, ETHER_ADDR_LEN);
+
+	/* check for key index change */
+	if (key.len == 0) {
+		if (iwe->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+			WL_WSEC(("Changing the the primary Key to %d\n", key.index));
+			/* change the key index .... */
+			key.index = htod32(key.index);
+			error = dev_wlc_ioctl(dev, WLC_SET_KEY_PRIMARY,
+				&key.index, sizeof(key.index));
+			if (error)
+				return error;
+		}
+		/* key delete */
+		else {
+			swap_key_from_BE(&key);
+			error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+			if (error)
+				return error;
+		}
+	}
+	/* This case is used to allow an external 802.1x supplicant
+	 * to pass the PMK to the in-driver supplicant for use in
+	 * the 4-way handshake.
+	 */
+	else if (iwe->alg == IW_ENCODE_ALG_PMK) {
+		int j;
+		wsec_pmk_t pmk;
+		char keystring[WSEC_MAX_PSK_LEN + 1];
+		char* charptr = keystring;
+		uint len;
+
+		/* copy the raw hex key to the appropriate format */
+		for (j = 0; j < (WSEC_MAX_PSK_LEN / 2); j++) {
+			sprintf(charptr, "%02x", iwe->key[j]);
+			charptr += 2;
+		}
+		len = strlen(keystring);
+		pmk.key_len = htod16(len);
+		bcopy(keystring, pmk.key, len);
+		pmk.flags = htod16(WSEC_PASSPHRASE);
+
+		error = dev_wlc_ioctl(dev, WLC_SET_WSEC_PMK, &pmk, sizeof(pmk));
+		if (error)
+			return error;
+	}
+
+	else {
+		if (iwe->key_len > sizeof(key.data))
+			return -EINVAL;
+
+		WL_WSEC(("Setting the key index %d\n", key.index));
+		if (iwe->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+			WL_WSEC(("key is a Primary Key\n"));
+			key.flags = WL_PRIMARY_KEY;
+		}
+
+		bcopy((void *)iwe->key, key.data, iwe->key_len);
+
+		if (iwe->alg == IW_ENCODE_ALG_TKIP) {
+			uint8 keybuf[8];
+			bcopy(&key.data[24], keybuf, sizeof(keybuf));
+			bcopy(&key.data[16], &key.data[24], sizeof(keybuf));
+			bcopy(keybuf, &key.data[16], sizeof(keybuf));
+		}
+
+		/* rx iv */
+		if (iwe->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+			uchar *ivptr;
+			ivptr = (uchar *)iwe->rx_seq;
+			key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
+				(ivptr[3] << 8) | ivptr[2];
+			key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
+			key.iv_initialized = TRUE;
+		}
+
+		switch (iwe->alg) {
+			case IW_ENCODE_ALG_NONE:
+				key.algo = CRYPTO_ALGO_OFF;
+				break;
+			case IW_ENCODE_ALG_WEP:
+				if (iwe->key_len == WEP1_KEY_SIZE)
+					key.algo = CRYPTO_ALGO_WEP1;
+				else
+					key.algo = CRYPTO_ALGO_WEP128;
+				break;
+			case IW_ENCODE_ALG_TKIP:
+				key.algo = CRYPTO_ALGO_TKIP;
+				break;
+			case IW_ENCODE_ALG_CCMP:
+				key.algo = CRYPTO_ALGO_AES_CCM;
+				break;
+#ifdef BCMWAPI_WPI
+			case IW_ENCODE_ALG_SM4:
+				key.algo = CRYPTO_ALGO_SMS4;
+				if (iwe->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+					key.flags &= ~WL_PRIMARY_KEY;
+				}
+				break;
+#endif
+			default:
+				break;
+		}
+		swap_key_from_BE(&key);
+
+		dhd_wait_pend8021x(dev);
+
+		error = dev_wlc_ioctl(dev, WLC_SET_KEY, &key, sizeof(key));
+		if (error)
+			return error;
+	}
+	return 0;
+}
+
+
+#if WIRELESS_EXT > 17
+struct {
+	pmkid_list_t pmkids;
+	pmkid_t foo[MAXPMKID-1];
+} pmkid_list;
+static int
+wl_iw_set_pmksa(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	struct iw_pmksa *iwpmksa;
+	uint i;
+	char eabuf[ETHER_ADDR_STR_LEN];
+	pmkid_t * pmkid_array = pmkid_list.pmkids.pmkid;
+
+	WL_TRACE(("%s: SIOCSIWPMKSA\n", dev->name));
+	iwpmksa = (struct iw_pmksa *)extra;
+	bzero((char *)eabuf, ETHER_ADDR_STR_LEN);
+	if (iwpmksa->cmd == IW_PMKSA_FLUSH) {
+		WL_TRACE(("wl_iw_set_pmksa - IW_PMKSA_FLUSH\n"));
+		bzero((char *)&pmkid_list, sizeof(pmkid_list));
+	}
+	if (iwpmksa->cmd == IW_PMKSA_REMOVE) {
+		pmkid_list_t pmkid, *pmkidptr;
+		pmkidptr = &pmkid;
+		bcopy(&iwpmksa->bssid.sa_data[0], &pmkidptr->pmkid[0].BSSID, ETHER_ADDR_LEN);
+		bcopy(&iwpmksa->pmkid[0], &pmkidptr->pmkid[0].PMKID, WPA2_PMKID_LEN);
+		{
+			uint j;
+			WL_TRACE(("wl_iw_set_pmksa,IW_PMKSA_REMOVE - PMKID: %s = ",
+				bcm_ether_ntoa(&pmkidptr->pmkid[0].BSSID,
+				eabuf)));
+			for (j = 0; j < WPA2_PMKID_LEN; j++)
+				WL_TRACE(("%02x ", pmkidptr->pmkid[0].PMKID[j]));
+			WL_TRACE(("\n"));
+		}
+		for (i = 0; i < pmkid_list.pmkids.npmkid; i++)
+			if (!bcmp(&iwpmksa->bssid.sa_data[0], &pmkid_array[i].BSSID,
+				ETHER_ADDR_LEN))
+				break;
+		for (; i < pmkid_list.pmkids.npmkid; i++) {
+			bcopy(&pmkid_array[i+1].BSSID,
+				&pmkid_array[i].BSSID,
+				ETHER_ADDR_LEN);
+			bcopy(&pmkid_array[i+1].PMKID,
+				&pmkid_array[i].PMKID,
+				WPA2_PMKID_LEN);
+		}
+		pmkid_list.pmkids.npmkid--;
+	}
+	if (iwpmksa->cmd == IW_PMKSA_ADD) {
+		bcopy(&iwpmksa->bssid.sa_data[0],
+			&pmkid_array[pmkid_list.pmkids.npmkid].BSSID,
+			ETHER_ADDR_LEN);
+		bcopy(&iwpmksa->pmkid[0], &pmkid_array[pmkid_list.pmkids.npmkid].PMKID,
+			WPA2_PMKID_LEN);
+		{
+			uint j;
+			uint k;
+			k = pmkid_list.pmkids.npmkid;
+			BCM_REFERENCE(k);
+			WL_TRACE(("wl_iw_set_pmksa,IW_PMKSA_ADD - PMKID: %s = ",
+				bcm_ether_ntoa(&pmkid_array[k].BSSID,
+				eabuf)));
+			for (j = 0; j < WPA2_PMKID_LEN; j++)
+				WL_TRACE(("%02x ", pmkid_array[k].PMKID[j]));
+			WL_TRACE(("\n"));
+		}
+		pmkid_list.pmkids.npmkid++;
+	}
+	WL_TRACE(("PRINTING pmkid LIST - No of elements %d\n", pmkid_list.pmkids.npmkid));
+	for (i = 0; i < pmkid_list.pmkids.npmkid; i++) {
+		uint j;
+		WL_TRACE(("PMKID[%d]: %s = ", i,
+			bcm_ether_ntoa(&pmkid_array[i].BSSID,
+			eabuf)));
+		for (j = 0; j < WPA2_PMKID_LEN; j++)
+			WL_TRACE(("%02x ", pmkid_array[i].PMKID[j]));
+		printf("\n");
+	}
+	WL_TRACE(("\n"));
+	dev_wlc_bufvar_set(dev, "pmkid_info", (char *)&pmkid_list, sizeof(pmkid_list));
+	return 0;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+static int
+wl_iw_get_encodeext(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	WL_TRACE(("%s: SIOCGIWENCODEEXT\n", dev->name));
+	return 0;
+}
+
+static int
+wl_iw_set_wpaauth(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error = 0;
+	int paramid;
+	int paramval;
+	uint32 cipher_combined;
+	int val = 0;
+	wl_iw_t *iw = IW_DEV_IF(dev);
+
+	WL_TRACE(("%s: SIOCSIWAUTH\n", dev->name));
+
+	paramid = vwrq->flags & IW_AUTH_INDEX;
+	paramval = vwrq->value;
+
+	WL_TRACE(("%s: SIOCSIWAUTH, paramid = 0x%0x, paramval = 0x%0x\n",
+		dev->name, paramid, paramval));
+
+	switch (paramid) {
+
+	case IW_AUTH_WPA_VERSION:
+		/* supported wpa version disabled or wpa or wpa2 */
+		if (paramval & IW_AUTH_WPA_VERSION_DISABLED)
+			val = WPA_AUTH_DISABLED;
+		else if (paramval & (IW_AUTH_WPA_VERSION_WPA))
+			val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
+		else if (paramval & IW_AUTH_WPA_VERSION_WPA2)
+			val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
+#ifdef BCMWAPI_WPI
+		else if (paramval & IW_AUTH_WAPI_VERSION_1)
+			val = WAPI_AUTH_UNSPECIFIED;
+#endif
+		WL_TRACE(("%s: %d: setting wpa_auth to 0x%0x\n", __FUNCTION__, __LINE__, val));
+		if ((error = dev_wlc_intvar_set(dev, "wpa_auth", val)))
+			return error;
+		break;
+
+	case IW_AUTH_CIPHER_PAIRWISE:
+	case IW_AUTH_CIPHER_GROUP: {
+		int fbt_cap = 0;
+
+		if (paramid == IW_AUTH_CIPHER_PAIRWISE) {
+			iw->pwsec = paramval;
+		}
+		else {
+			iw->gwsec = paramval;
+		}
+
+		if ((error = dev_wlc_intvar_get(dev, "wsec", &val)))
+			return error;
+
+		cipher_combined = iw->gwsec | iw->pwsec;
+		val &= ~(WEP_ENABLED | TKIP_ENABLED | AES_ENABLED);
+		if (cipher_combined & (IW_AUTH_CIPHER_WEP40 | IW_AUTH_CIPHER_WEP104))
+			val |= WEP_ENABLED;
+		if (cipher_combined & IW_AUTH_CIPHER_TKIP)
+			val |= TKIP_ENABLED;
+		if (cipher_combined & IW_AUTH_CIPHER_CCMP)
+			val |= AES_ENABLED;
+#ifdef BCMWAPI_WPI
+		val &= ~SMS4_ENABLED;
+		if (cipher_combined & IW_AUTH_CIPHER_SMS4)
+			val |= SMS4_ENABLED;
+#endif
+
+		if (iw->privacy_invoked && !val) {
+			WL_WSEC(("%s: %s: 'Privacy invoked' TRUE but clearing wsec, assuming "
+			         "we're a WPS enrollee\n", dev->name, __FUNCTION__));
+			if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", TRUE))) {
+				WL_WSEC(("Failed to set iovar is_WPS_enrollee\n"));
+				return error;
+			}
+		} else if (val) {
+			if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", FALSE))) {
+				WL_WSEC(("Failed to clear iovar is_WPS_enrollee\n"));
+				return error;
+			}
+		}
+
+		if ((error = dev_wlc_intvar_set(dev, "wsec", val)))
+			return error;
+
+		/* Ensure in-dongle supplicant is turned on when FBT wants to do the 4-way
+		 * handshake.
+		 */
+		if (dev_wlc_intvar_get(dev, "fbt_cap", &fbt_cap) == 0) {
+			if (fbt_cap == WLC_FBT_CAP_DRV_4WAY_AND_REASSOC) {
+				if ((paramid == IW_AUTH_CIPHER_PAIRWISE) && (val & AES_ENABLED)) {
+					if ((error = dev_wlc_intvar_set(dev, "sup_wpa", 1)))
+						return error;
+				}
+				else if (val == 0) {
+					if ((error = dev_wlc_intvar_set(dev, "sup_wpa", 0)))
+						return error;
+				}
+			}
+		}
+		break;
+	}
+
+	case IW_AUTH_KEY_MGMT:
+		if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+			return error;
+
+		if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
+			if (paramval & (IW_AUTH_KEY_MGMT_FT_PSK | IW_AUTH_KEY_MGMT_PSK))
+				val = WPA_AUTH_PSK;
+			else
+				val = WPA_AUTH_UNSPECIFIED;
+			if (paramval & (IW_AUTH_KEY_MGMT_FT_802_1X | IW_AUTH_KEY_MGMT_FT_PSK))
+				val |= WPA2_AUTH_FT;
+		}
+		else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
+			if (paramval & (IW_AUTH_KEY_MGMT_FT_PSK | IW_AUTH_KEY_MGMT_PSK))
+				val = WPA2_AUTH_PSK;
+			else
+				val = WPA2_AUTH_UNSPECIFIED;
+			if (paramval & (IW_AUTH_KEY_MGMT_FT_802_1X | IW_AUTH_KEY_MGMT_FT_PSK))
+				val |= WPA2_AUTH_FT;
+		}
+#ifdef BCMWAPI_WPI
+		if (paramval & (IW_AUTH_KEY_MGMT_WAPI_PSK | IW_AUTH_KEY_MGMT_WAPI_CERT))
+			val = WAPI_AUTH_UNSPECIFIED;
+#endif
+		WL_TRACE(("%s: %d: setting wpa_auth to %d\n", __FUNCTION__, __LINE__, val));
+		if ((error = dev_wlc_intvar_set(dev, "wpa_auth", val)))
+			return error;
+		break;
+
+	case IW_AUTH_TKIP_COUNTERMEASURES:
+		dev_wlc_bufvar_set(dev, "tkip_countermeasures", (char *)&paramval, 1);
+		break;
+
+	case IW_AUTH_80211_AUTH_ALG:
+		/* open shared */
+		WL_ERROR(("Setting the D11auth %d\n", paramval));
+		if (paramval & IW_AUTH_ALG_OPEN_SYSTEM)
+			val = 0;
+		else if (paramval & IW_AUTH_ALG_SHARED_KEY)
+			val = 1;
+		else
+			error = 1;
+		if (!error && (error = dev_wlc_intvar_set(dev, "auth", val)))
+			return error;
+		break;
+
+	case IW_AUTH_WPA_ENABLED:
+		if (paramval == 0) {
+			val = 0;
+			WL_TRACE(("%s: %d: setting wpa_auth to %d\n", __FUNCTION__, __LINE__, val));
+			error = dev_wlc_intvar_set(dev, "wpa_auth", val);
+			return error;
+		}
+		else {
+			/* If WPA is enabled, wpa_auth is set elsewhere */
+		}
+		break;
+
+	case IW_AUTH_DROP_UNENCRYPTED:
+		dev_wlc_bufvar_set(dev, "wsec_restrict", (char *)&paramval, 1);
+		break;
+
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+		dev_wlc_bufvar_set(dev, "rx_unencrypted_eapol", (char *)&paramval, 1);
+		break;
+
+#if WIRELESS_EXT > 17
+
+	case IW_AUTH_ROAMING_CONTROL:
+		WL_TRACE(("%s: IW_AUTH_ROAMING_CONTROL\n", __FUNCTION__));
+		/* driver control or user space app control */
+		break;
+
+	case IW_AUTH_PRIVACY_INVOKED: {
+		int wsec;
+
+		if (paramval == 0) {
+			iw->privacy_invoked = FALSE;
+			if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", FALSE))) {
+				WL_WSEC(("Failed to clear iovar is_WPS_enrollee\n"));
+				return error;
+			}
+		} else {
+			iw->privacy_invoked = TRUE;
+			if ((error = dev_wlc_intvar_get(dev, "wsec", &wsec)))
+				return error;
+
+			if (!WSEC_ENABLED(wsec)) {
+				/* if privacy is true, but wsec is false, we are a WPS enrollee */
+				if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", TRUE))) {
+					WL_WSEC(("Failed to set iovar is_WPS_enrollee\n"));
+					return error;
+				}
+			} else {
+				if ((error = dev_wlc_intvar_set(dev, "is_WPS_enrollee", FALSE))) {
+					WL_WSEC(("Failed to clear iovar is_WPS_enrollee\n"));
+					return error;
+				}
+			}
+		}
+		break;
+	}
+
+
+#endif /* WIRELESS_EXT > 17 */
+
+#ifdef BCMWAPI_WPI
+
+	case IW_AUTH_WAPI_ENABLED:
+		if ((error = dev_wlc_intvar_get(dev, "wsec", &val)))
+			return error;
+		if (paramval) {
+			val |= SMS4_ENABLED;
+			if ((error = dev_wlc_intvar_set(dev, "wsec", val))) {
+				WL_ERROR(("%s: setting wsec to 0x%0x returned error %d\n",
+					__FUNCTION__, val, error));
+				return error;
+			}
+			if ((error = dev_wlc_intvar_set(dev, "wpa_auth", WAPI_AUTH_UNSPECIFIED))) {
+				WL_ERROR(("%s: setting wpa_auth(%d) returned %d\n",
+					__FUNCTION__, WAPI_AUTH_UNSPECIFIED,
+					error));
+				return error;
+			}
+		}
+
+		break;
+
+#endif /* BCMWAPI_WPI */
+
+	default:
+		break;
+	}
+	return 0;
+}
+#define VAL_PSK(_val) (((_val) & WPA_AUTH_PSK) || ((_val) & WPA2_AUTH_PSK))
+
+static int
+wl_iw_get_wpaauth(
+	struct net_device *dev,
+	struct iw_request_info *info,
+	struct iw_param *vwrq,
+	char *extra
+)
+{
+	int error;
+	int paramid;
+	int paramval = 0;
+	int val;
+	wl_iw_t *iw = IW_DEV_IF(dev);
+
+	WL_TRACE(("%s: SIOCGIWAUTH\n", dev->name));
+
+	paramid = vwrq->flags & IW_AUTH_INDEX;
+
+	switch (paramid) {
+	case IW_AUTH_WPA_VERSION:
+		/* supported wpa version disabled or wpa or wpa2 */
+		if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+			return error;
+		if (val & (WPA_AUTH_NONE | WPA_AUTH_DISABLED))
+			paramval = IW_AUTH_WPA_VERSION_DISABLED;
+		else if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED))
+			paramval = IW_AUTH_WPA_VERSION_WPA;
+		else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED))
+			paramval = IW_AUTH_WPA_VERSION_WPA2;
+		break;
+
+	case IW_AUTH_CIPHER_PAIRWISE:
+		paramval = iw->pwsec;
+		break;
+
+	case IW_AUTH_CIPHER_GROUP:
+		paramval = iw->gwsec;
+		break;
+
+	case IW_AUTH_KEY_MGMT:
+		/* psk, 1x */
+		if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+			return error;
+		if (VAL_PSK(val))
+			paramval = IW_AUTH_KEY_MGMT_PSK;
+		else
+			paramval = IW_AUTH_KEY_MGMT_802_1X;
+
+		break;
+	case IW_AUTH_TKIP_COUNTERMEASURES:
+		dev_wlc_bufvar_get(dev, "tkip_countermeasures", (char *)&paramval, 1);
+		break;
+
+	case IW_AUTH_DROP_UNENCRYPTED:
+		dev_wlc_bufvar_get(dev, "wsec_restrict", (char *)&paramval, 1);
+		break;
+
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+		dev_wlc_bufvar_get(dev, "rx_unencrypted_eapol", (char *)&paramval, 1);
+		break;
+
+	case IW_AUTH_80211_AUTH_ALG:
+		/* open, shared, leap */
+		if ((error = dev_wlc_intvar_get(dev, "auth", &val)))
+			return error;
+		if (!val)
+			paramval = IW_AUTH_ALG_OPEN_SYSTEM;
+		else
+			paramval = IW_AUTH_ALG_SHARED_KEY;
+		break;
+	case IW_AUTH_WPA_ENABLED:
+		if ((error = dev_wlc_intvar_get(dev, "wpa_auth", &val)))
+			return error;
+		if (val)
+			paramval = TRUE;
+		else
+			paramval = FALSE;
+		break;
+
+#if WIRELESS_EXT > 17
+
+	case IW_AUTH_ROAMING_CONTROL:
+		WL_ERROR(("%s: IW_AUTH_ROAMING_CONTROL\n", __FUNCTION__));
+		/* driver control or user space app control */
+		break;
+
+	case IW_AUTH_PRIVACY_INVOKED:
+		paramval = iw->privacy_invoked;
+		break;
+
+#endif /* WIRELESS_EXT > 17 */
+	}
+	vwrq->value = paramval;
+	return 0;
+}
+#endif /* WIRELESS_EXT > 17 */
+
+static const iw_handler wl_iw_handler[] =
+{
+	(iw_handler) wl_iw_config_commit,	/* SIOCSIWCOMMIT */
+	(iw_handler) wl_iw_get_name,		/* SIOCGIWNAME */
+	(iw_handler) NULL,			/* SIOCSIWNWID */
+	(iw_handler) NULL,			/* SIOCGIWNWID */
+	(iw_handler) wl_iw_set_freq,		/* SIOCSIWFREQ */
+	(iw_handler) wl_iw_get_freq,		/* SIOCGIWFREQ */
+	(iw_handler) wl_iw_set_mode,		/* SIOCSIWMODE */
+	(iw_handler) wl_iw_get_mode,		/* SIOCGIWMODE */
+	(iw_handler) NULL,			/* SIOCSIWSENS */
+	(iw_handler) NULL,			/* SIOCGIWSENS */
+	(iw_handler) NULL,			/* SIOCSIWRANGE */
+	(iw_handler) wl_iw_get_range,		/* SIOCGIWRANGE */
+	(iw_handler) NULL,			/* SIOCSIWPRIV */
+	(iw_handler) NULL,			/* SIOCGIWPRIV */
+	(iw_handler) NULL,			/* SIOCSIWSTATS */
+	(iw_handler) NULL,			/* SIOCGIWSTATS */
+	(iw_handler) wl_iw_set_spy,		/* SIOCSIWSPY */
+	(iw_handler) wl_iw_get_spy,		/* SIOCGIWSPY */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) wl_iw_set_wap,		/* SIOCSIWAP */
+	(iw_handler) wl_iw_get_wap,		/* SIOCGIWAP */
+#if WIRELESS_EXT > 17
+	(iw_handler) wl_iw_mlme,		/* SIOCSIWMLME */
+#else
+	(iw_handler) NULL,			/* -- hole -- */
+#endif
+	(iw_handler) wl_iw_iscan_get_aplist,	/* SIOCGIWAPLIST */
+#if WIRELESS_EXT > 13
+	(iw_handler) wl_iw_iscan_set_scan,	/* SIOCSIWSCAN */
+	(iw_handler) wl_iw_iscan_get_scan,	/* SIOCGIWSCAN */
+#else	/* WIRELESS_EXT > 13 */
+	(iw_handler) NULL,			/* SIOCSIWSCAN */
+	(iw_handler) NULL,			/* SIOCGIWSCAN */
+#endif	/* WIRELESS_EXT > 13 */
+	(iw_handler) wl_iw_set_essid,		/* SIOCSIWESSID */
+	(iw_handler) wl_iw_get_essid,		/* SIOCGIWESSID */
+	(iw_handler) wl_iw_set_nick,		/* SIOCSIWNICKN */
+	(iw_handler) wl_iw_get_nick,		/* SIOCGIWNICKN */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) wl_iw_set_rate,		/* SIOCSIWRATE */
+	(iw_handler) wl_iw_get_rate,		/* SIOCGIWRATE */
+	(iw_handler) wl_iw_set_rts,		/* SIOCSIWRTS */
+	(iw_handler) wl_iw_get_rts,		/* SIOCGIWRTS */
+	(iw_handler) wl_iw_set_frag,		/* SIOCSIWFRAG */
+	(iw_handler) wl_iw_get_frag,		/* SIOCGIWFRAG */
+	(iw_handler) wl_iw_set_txpow,		/* SIOCSIWTXPOW */
+	(iw_handler) wl_iw_get_txpow,		/* SIOCGIWTXPOW */
+#if WIRELESS_EXT > 10
+	(iw_handler) wl_iw_set_retry,		/* SIOCSIWRETRY */
+	(iw_handler) wl_iw_get_retry,		/* SIOCGIWRETRY */
+#endif /* WIRELESS_EXT > 10 */
+	(iw_handler) wl_iw_set_encode,		/* SIOCSIWENCODE */
+	(iw_handler) wl_iw_get_encode,		/* SIOCGIWENCODE */
+	(iw_handler) wl_iw_set_power,		/* SIOCSIWPOWER */
+	(iw_handler) wl_iw_get_power,		/* SIOCGIWPOWER */
+#if WIRELESS_EXT > 17
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) NULL,			/* -- hole -- */
+	(iw_handler) wl_iw_set_wpaie,		/* SIOCSIWGENIE */
+	(iw_handler) wl_iw_get_wpaie,		/* SIOCGIWGENIE */
+	(iw_handler) wl_iw_set_wpaauth,		/* SIOCSIWAUTH */
+	(iw_handler) wl_iw_get_wpaauth,		/* SIOCGIWAUTH */
+	(iw_handler) wl_iw_set_encodeext,	/* SIOCSIWENCODEEXT */
+	(iw_handler) wl_iw_get_encodeext,	/* SIOCGIWENCODEEXT */
+	(iw_handler) wl_iw_set_pmksa,		/* SIOCSIWPMKSA */
+#endif /* WIRELESS_EXT > 17 */
+};
+
+#if WIRELESS_EXT > 12
+enum {
+	WL_IW_SET_LEDDC = SIOCIWFIRSTPRIV,
+	WL_IW_SET_VLANMODE,
+	WL_IW_SET_PM,
+#if WIRELESS_EXT > 17
+#endif /* WIRELESS_EXT > 17 */
+	WL_IW_SET_LAST
+};
+
+static iw_handler wl_iw_priv_handler[] = {
+	wl_iw_set_leddc,
+	wl_iw_set_vlanmode,
+	wl_iw_set_pm,
+#if WIRELESS_EXT > 17
+#endif /* WIRELESS_EXT > 17 */
+	NULL
+};
+
+static struct iw_priv_args wl_iw_priv_args[] = {
+	{
+		WL_IW_SET_LEDDC,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+		0,
+		"set_leddc"
+	},
+	{
+		WL_IW_SET_VLANMODE,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+		0,
+		"set_vlanmode"
+	},
+	{
+		WL_IW_SET_PM,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
+		0,
+		"set_pm"
+	},
+#if WIRELESS_EXT > 17
+#endif /* WIRELESS_EXT > 17 */
+	{ 0, 0, 0, { 0 } }
+};
+
+const struct iw_handler_def wl_iw_handler_def =
+{
+	.num_standard = ARRAYSIZE(wl_iw_handler),
+	.num_private = ARRAY_SIZE(wl_iw_priv_handler),
+	.num_private_args = ARRAY_SIZE(wl_iw_priv_args),
+	.standard = (iw_handler *) wl_iw_handler,
+	.private = wl_iw_priv_handler,
+	.private_args = wl_iw_priv_args,
+#if WIRELESS_EXT >= 19
+	get_wireless_stats: dhd_get_wireless_stats,
+#endif /* WIRELESS_EXT >= 19 */
+	};
+#endif /* WIRELESS_EXT > 12 */
+
+int
+wl_iw_ioctl(
+	struct net_device *dev,
+	struct ifreq *rq,
+	int cmd
+)
+{
+	struct iwreq *wrq = (struct iwreq *) rq;
+	struct iw_request_info info;
+	iw_handler handler;
+	char *extra = NULL;
+	size_t token_size = 1;
+	int max_tokens = 0, ret = 0;
+
+	if (cmd < SIOCIWFIRST ||
+		IW_IOCTL_IDX(cmd) >= ARRAYSIZE(wl_iw_handler) ||
+		!(handler = wl_iw_handler[IW_IOCTL_IDX(cmd)]))
+		return -EOPNOTSUPP;
+
+	switch (cmd) {
+
+	case SIOCSIWESSID:
+	case SIOCGIWESSID:
+	case SIOCSIWNICKN:
+	case SIOCGIWNICKN:
+		max_tokens = IW_ESSID_MAX_SIZE + 1;
+		break;
+
+	case SIOCSIWENCODE:
+	case SIOCGIWENCODE:
+#if WIRELESS_EXT > 17
+	case SIOCSIWENCODEEXT:
+	case SIOCGIWENCODEEXT:
+#endif
+		max_tokens = IW_ENCODING_TOKEN_MAX;
+		break;
+
+	case SIOCGIWRANGE:
+		max_tokens = sizeof(struct iw_range);
+		break;
+
+	case SIOCGIWAPLIST:
+		token_size = sizeof(struct sockaddr) + sizeof(struct iw_quality);
+		max_tokens = IW_MAX_AP;
+		break;
+
+#if WIRELESS_EXT > 13
+	case SIOCGIWSCAN:
+	if (g_iscan)
+		max_tokens = wrq->u.data.length;
+	else
+		max_tokens = IW_SCAN_MAX_DATA;
+		break;
+#endif /* WIRELESS_EXT > 13 */
+
+	case SIOCSIWSPY:
+		token_size = sizeof(struct sockaddr);
+		max_tokens = IW_MAX_SPY;
+		break;
+
+	case SIOCGIWSPY:
+		token_size = sizeof(struct sockaddr) + sizeof(struct iw_quality);
+		max_tokens = IW_MAX_SPY;
+		break;
+	default:
+		break;
+	}
+
+	if (max_tokens && wrq->u.data.pointer) {
+		if (wrq->u.data.length > max_tokens)
+			return -E2BIG;
+
+		if (!(extra = kmalloc(max_tokens * token_size, GFP_KERNEL)))
+			return -ENOMEM;
+
+		if (copy_from_user(extra, wrq->u.data.pointer, wrq->u.data.length * token_size)) {
+			kfree(extra);
+			return -EFAULT;
+		}
+	}
+
+	info.cmd = cmd;
+	info.flags = 0;
+
+	ret = handler(dev, &info, &wrq->u, extra);
+
+	if (extra) {
+		if (copy_to_user(wrq->u.data.pointer, extra, wrq->u.data.length * token_size)) {
+			kfree(extra);
+			return -EFAULT;
+		}
+
+		kfree(extra);
+	}
+
+	return ret;
+}
+
+/* Convert a connection status event into a connection status string.
+ * Returns TRUE if a matching connection status string was found.
+ */
+bool
+wl_iw_conn_status_str(uint32 event_type, uint32 status, uint32 reason,
+	char* stringBuf, uint buflen)
+{
+	typedef struct conn_fail_event_map_t {
+		uint32 inEvent;			/* input: event type to match */
+		uint32 inStatus;		/* input: event status code to match */
+		uint32 inReason;		/* input: event reason code to match */
+		const char* outName;	/* output: failure type */
+		const char* outCause;	/* output: failure cause */
+	} conn_fail_event_map_t;
+
+	/* Map of WLC_E events to connection failure strings */
+#	define WL_IW_DONT_CARE	9999
+	const conn_fail_event_map_t event_map [] = {
+		/* inEvent           inStatus                inReason         */
+		/* outName outCause                                           */
+		{WLC_E_SET_SSID,     WLC_E_STATUS_SUCCESS,   WL_IW_DONT_CARE,
+		"Conn", "Success"},
+		{WLC_E_SET_SSID,     WLC_E_STATUS_NO_NETWORKS, WL_IW_DONT_CARE,
+		"Conn", "NoNetworks"},
+		{WLC_E_SET_SSID,     WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+		"Conn", "ConfigMismatch"},
+		{WLC_E_PRUNE,        WL_IW_DONT_CARE,        WLC_E_PRUNE_ENCR_MISMATCH,
+		"Conn", "EncrypMismatch"},
+		{WLC_E_PRUNE,        WL_IW_DONT_CARE,        WLC_E_RSN_MISMATCH,
+		"Conn", "RsnMismatch"},
+		{WLC_E_AUTH,         WLC_E_STATUS_TIMEOUT,   WL_IW_DONT_CARE,
+		"Conn", "AuthTimeout"},
+		{WLC_E_AUTH,         WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+		"Conn", "AuthFail"},
+		{WLC_E_AUTH,         WLC_E_STATUS_NO_ACK,    WL_IW_DONT_CARE,
+		"Conn", "AuthNoAck"},
+		{WLC_E_REASSOC,      WLC_E_STATUS_FAIL,      WL_IW_DONT_CARE,
+		"Conn", "ReassocFail"},
+		{WLC_E_REASSOC,      WLC_E_STATUS_TIMEOUT,   WL_IW_DONT_CARE,
+		"Conn", "ReassocTimeout"},
+		{WLC_E_REASSOC,      WLC_E_STATUS_ABORT,     WL_IW_DONT_CARE,
+		"Conn", "ReassocAbort"},
+		{WLC_E_PSK_SUP,      WLC_SUP_KEYED,          WL_IW_DONT_CARE,
+		"Sup", "ConnSuccess"},
+		{WLC_E_PSK_SUP,      WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+		"Sup", "WpaHandshakeFail"},
+		{WLC_E_DEAUTH_IND,   WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+		"Conn", "Deauth"},
+		{WLC_E_DISASSOC_IND, WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+		"Conn", "DisassocInd"},
+		{WLC_E_DISASSOC,     WL_IW_DONT_CARE,        WL_IW_DONT_CARE,
+		"Conn", "Disassoc"}
+	};
+
+	const char* name = "";
+	const char* cause = NULL;
+	int i;
+
+	/* Search the event map table for a matching event */
+	for (i = 0;  i < sizeof(event_map)/sizeof(event_map[0]);  i++) {
+		const conn_fail_event_map_t* row = &event_map[i];
+		if (row->inEvent == event_type &&
+		    (row->inStatus == status || row->inStatus == WL_IW_DONT_CARE) &&
+		    (row->inReason == reason || row->inReason == WL_IW_DONT_CARE)) {
+			name = row->outName;
+			cause = row->outCause;
+			break;
+		}
+	}
+
+	/* If found, generate a connection failure string and return TRUE */
+	if (cause) {
+		memset(stringBuf, 0, buflen);
+		snprintf(stringBuf, buflen, "%s %s %02d %02d",
+			name, cause, status, reason);
+		WL_TRACE(("Connection status: %s\n", stringBuf));
+		return TRUE;
+	} else {
+		return FALSE;
+	}
+}
+
+#if (WIRELESS_EXT > 14)
+/* Check if we have received an event that indicates connection failure
+ * If so, generate a connection failure report string.
+ * The caller supplies a buffer to hold the generated string.
+ */
+static bool
+wl_iw_check_conn_fail(wl_event_msg_t *e, char* stringBuf, uint buflen)
+{
+	uint32 event = ntoh32(e->event_type);
+	uint32 status =  ntoh32(e->status);
+	uint32 reason =  ntoh32(e->reason);
+
+	if (wl_iw_conn_status_str(event, status, reason, stringBuf, buflen)) {
+		return TRUE;
+	} else
+	{
+		return FALSE;
+	}
+}
+#endif /* WIRELESS_EXT > 14 */
+
+#ifndef IW_CUSTOM_MAX
+#define IW_CUSTOM_MAX 256 /* size of extra buffer used for translation of events */
+#endif /* IW_CUSTOM_MAX */
+
+void
+wl_iw_event(struct net_device *dev, wl_event_msg_t *e, void* data)
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	char extra[IW_CUSTOM_MAX + 1];
+	int cmd = 0;
+	uint32 event_type = ntoh32(e->event_type);
+	uint16 flags =  ntoh16(e->flags);
+	uint32 datalen = ntoh32(e->datalen);
+	uint32 status =  ntoh32(e->status);
+
+	memset(&wrqu, 0, sizeof(wrqu));
+	memset(extra, 0, sizeof(extra));
+
+	memcpy(wrqu.addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+	wrqu.addr.sa_family = ARPHRD_ETHER;
+
+	switch (event_type) {
+	case WLC_E_TXFAIL:
+		cmd = IWEVTXDROP;
+		break;
+#if WIRELESS_EXT > 14
+	case WLC_E_JOIN:
+	case WLC_E_ASSOC_IND:
+	case WLC_E_REASSOC_IND:
+		cmd = IWEVREGISTERED;
+		break;
+	case WLC_E_DEAUTH_IND:
+	case WLC_E_DISASSOC_IND:
+		cmd = SIOCGIWAP;
+		wrqu.data.length = strlen(extra);
+		bzero(wrqu.addr.sa_data, ETHER_ADDR_LEN);
+		bzero(&extra, ETHER_ADDR_LEN);
+		break;
+
+	case WLC_E_LINK:
+	case WLC_E_NDIS_LINK:
+		cmd = SIOCGIWAP;
+		wrqu.data.length = strlen(extra);
+		if (!(flags & WLC_EVENT_MSG_LINK)) {
+			printf("%s: Link Down with BSSID="MACSTR"\n", __FUNCTION__,
+				MAC2STR((u8 *)wrqu.addr.sa_data));
+			bzero(wrqu.addr.sa_data, ETHER_ADDR_LEN);
+			bzero(&extra, ETHER_ADDR_LEN);
+		} else {
+			printf("%s: Link UP with BSSID="MACSTR"\n", __FUNCTION__,
+				MAC2STR((u8 *)wrqu.addr.sa_data));
+		}
+		break;
+	case WLC_E_ACTION_FRAME:
+		cmd = IWEVCUSTOM;
+		if (datalen + 1 <= sizeof(extra)) {
+			wrqu.data.length = datalen + 1;
+			extra[0] = WLC_E_ACTION_FRAME;
+			memcpy(&extra[1], data, datalen);
+			WL_TRACE(("WLC_E_ACTION_FRAME len %d \n", wrqu.data.length));
+		}
+		break;
+
+	case WLC_E_ACTION_FRAME_COMPLETE:
+		cmd = IWEVCUSTOM;
+		if (sizeof(status) + 1 <= sizeof(extra)) {
+			wrqu.data.length = sizeof(status) + 1;
+			extra[0] = WLC_E_ACTION_FRAME_COMPLETE;
+			memcpy(&extra[1], &status, sizeof(status));
+			WL_TRACE(("wl_iw_event status %d  \n", status));
+		}
+		break;
+#endif /* WIRELESS_EXT > 14 */
+#if WIRELESS_EXT > 17
+	case WLC_E_MIC_ERROR: {
+		struct	iw_michaelmicfailure  *micerrevt = (struct  iw_michaelmicfailure  *)&extra;
+		cmd = IWEVMICHAELMICFAILURE;
+		wrqu.data.length = sizeof(struct iw_michaelmicfailure);
+		if (flags & WLC_EVENT_MSG_GROUP)
+			micerrevt->flags |= IW_MICFAILURE_GROUP;
+		else
+			micerrevt->flags |= IW_MICFAILURE_PAIRWISE;
+		memcpy(micerrevt->src_addr.sa_data, &e->addr, ETHER_ADDR_LEN);
+		micerrevt->src_addr.sa_family = ARPHRD_ETHER;
+
+		break;
+	}
+
+	case WLC_E_ASSOC_REQ_IE:
+		cmd = IWEVASSOCREQIE;
+		wrqu.data.length = datalen;
+		if (datalen < sizeof(extra))
+			memcpy(extra, data, datalen);
+		break;
+
+	case WLC_E_ASSOC_RESP_IE:
+		cmd = IWEVASSOCRESPIE;
+		wrqu.data.length = datalen;
+		if (datalen < sizeof(extra))
+			memcpy(extra, data, datalen);
+		break;
+
+	case WLC_E_PMKID_CACHE: {
+		struct iw_pmkid_cand *iwpmkidcand = (struct iw_pmkid_cand *)&extra;
+		pmkid_cand_list_t *pmkcandlist;
+		pmkid_cand_t	*pmkidcand;
+		int count;
+
+		if (data == NULL)
+			break;
+
+		cmd = IWEVPMKIDCAND;
+		pmkcandlist = data;
+		count = ntoh32_ua((uint8 *)&pmkcandlist->npmkid_cand);
+		wrqu.data.length = sizeof(struct iw_pmkid_cand);
+		pmkidcand = pmkcandlist->pmkid_cand;
+		while (count) {
+			bzero(iwpmkidcand, sizeof(struct iw_pmkid_cand));
+			if (pmkidcand->preauth)
+				iwpmkidcand->flags |= IW_PMKID_CAND_PREAUTH;
+			bcopy(&pmkidcand->BSSID, &iwpmkidcand->bssid.sa_data,
+			      ETHER_ADDR_LEN);
+			wireless_send_event(dev, cmd, &wrqu, extra);
+			pmkidcand++;
+			count--;
+		}
+		break;
+	}
+#endif /* WIRELESS_EXT > 17 */
+
+	case WLC_E_SCAN_COMPLETE:
+#if WIRELESS_EXT > 14
+		cmd = SIOCGIWSCAN;
+#endif
+		WL_TRACE(("event WLC_E_SCAN_COMPLETE\n"));
+		// terence 20150224: fix "wlan0: (WE) : Wireless Event too big (65306)"
+		memset(&wrqu, 0, sizeof(wrqu));
+		if ((g_iscan) && (g_iscan->sysioc_pid >= 0) &&
+			(g_iscan->iscan_state != ISCAN_STATE_IDLE))
+			up(&g_iscan->sysioc_sem);
+		break;
+
+	default:
+		/* Cannot translate event */
+		break;
+	}
+
+	if (cmd) {
+		if (cmd == SIOCGIWSCAN) {
+			if ((!g_iscan) || (g_iscan->sysioc_pid < 0)) {
+				wireless_send_event(dev, cmd, &wrqu, NULL);
+			};
+		} else
+			wireless_send_event(dev, cmd, &wrqu, extra);
+	}
+
+#if WIRELESS_EXT > 14
+	/* Look for WLC events that indicate a connection failure.
+	 * If found, generate an IWEVCUSTOM event.
+	 */
+	memset(extra, 0, sizeof(extra));
+	if (wl_iw_check_conn_fail(e, extra, sizeof(extra))) {
+		cmd = IWEVCUSTOM;
+		wrqu.data.length = strlen(extra);
+		wireless_send_event(dev, cmd, &wrqu, extra);
+	}
+#endif /* WIRELESS_EXT > 14 */
+
+#endif /* WIRELESS_EXT > 13 */
+}
+
+int wl_iw_get_wireless_stats(struct net_device *dev, struct iw_statistics *wstats)
+{
+	int res = 0;
+	wl_cnt_t cnt;
+	int phy_noise;
+	int rssi;
+	scb_val_t scb_val;
+
+	phy_noise = 0;
+	if ((res = dev_wlc_ioctl(dev, WLC_GET_PHY_NOISE, &phy_noise, sizeof(phy_noise))))
+		goto done;
+
+	phy_noise = dtoh32(phy_noise);
+	WL_TRACE(("wl_iw_get_wireless_stats phy noise=%d\n *****", phy_noise));
+
+	scb_val.val = 0;
+	if ((res = dev_wlc_ioctl(dev, WLC_GET_RSSI, &scb_val, sizeof(scb_val_t))))
+		goto done;
+
+	rssi = dtoh32(scb_val.val);
+	WL_TRACE(("wl_iw_get_wireless_stats rssi=%d ****** \n", rssi));
+	if (rssi <= WL_IW_RSSI_NO_SIGNAL)
+		wstats->qual.qual = 0;
+	else if (rssi <= WL_IW_RSSI_VERY_LOW)
+		wstats->qual.qual = 1;
+	else if (rssi <= WL_IW_RSSI_LOW)
+		wstats->qual.qual = 2;
+	else if (rssi <= WL_IW_RSSI_GOOD)
+		wstats->qual.qual = 3;
+	else if (rssi <= WL_IW_RSSI_VERY_GOOD)
+		wstats->qual.qual = 4;
+	else
+		wstats->qual.qual = 5;
+
+	/* Wraps to 0 if RSSI is 0 */
+	wstats->qual.level = 0x100 + rssi;
+	wstats->qual.noise = 0x100 + phy_noise;
+#if WIRELESS_EXT > 18
+	wstats->qual.updated |= (IW_QUAL_ALL_UPDATED | IW_QUAL_DBM);
+#else
+	wstats->qual.updated |= 7;
+#endif /* WIRELESS_EXT > 18 */
+
+#if WIRELESS_EXT > 11
+	WL_TRACE(("wl_iw_get_wireless_stats counters=%d\n *****", (int)sizeof(wl_cnt_t)));
+
+	memset(&cnt, 0, sizeof(wl_cnt_t));
+	res = dev_wlc_bufvar_get(dev, "counters", (char *)&cnt, sizeof(wl_cnt_t));
+	if (res)
+	{
+		WL_ERROR(("wl_iw_get_wireless_stats counters failed error=%d ****** \n", res));
+		goto done;
+	}
+
+	cnt.version = dtoh16(cnt.version);
+	if (cnt.version != WL_CNT_T_VERSION) {
+		WL_TRACE(("\tIncorrect version of counters struct: expected %d; got %d\n",
+			WL_CNT_T_VERSION, cnt.version));
+		goto done;
+	}
+
+	wstats->discard.nwid = 0;
+	wstats->discard.code = dtoh32(cnt.rxundec);
+	wstats->discard.fragment = dtoh32(cnt.rxfragerr);
+	wstats->discard.retries = dtoh32(cnt.txfail);
+	wstats->discard.misc = dtoh32(cnt.rxrunt) + dtoh32(cnt.rxgiant);
+	wstats->miss.beacon = 0;
+
+	WL_TRACE(("wl_iw_get_wireless_stats counters txframe=%d txbyte=%d\n",
+		dtoh32(cnt.txframe), dtoh32(cnt.txbyte)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters rxfrmtoolong=%d\n", dtoh32(cnt.rxfrmtoolong)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters rxbadplcp=%d\n", dtoh32(cnt.rxbadplcp)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters rxundec=%d\n", dtoh32(cnt.rxundec)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters rxfragerr=%d\n", dtoh32(cnt.rxfragerr)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters txfail=%d\n", dtoh32(cnt.txfail)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters rxrunt=%d\n", dtoh32(cnt.rxrunt)));
+	WL_TRACE(("wl_iw_get_wireless_stats counters rxgiant=%d\n", dtoh32(cnt.rxgiant)));
+
+#endif /* WIRELESS_EXT > 11 */
+
+done:
+	return res;
+}
+
+static void
+wl_iw_timerfunc(ulong data)
+{
+	iscan_info_t *iscan = (iscan_info_t *)data;
+	iscan->timer_on = 0;
+	if (iscan->iscan_state != ISCAN_STATE_IDLE) {
+		WL_TRACE(("timer trigger\n"));
+		up(&iscan->sysioc_sem);
+	}
+}
+
+static void
+wl_iw_set_event_mask(struct net_device *dev)
+{
+	char eventmask[WL_EVENTING_MASK_LEN];
+	char iovbuf[WL_EVENTING_MASK_LEN + 12];	/* Room for "event_msgs" + '\0' + bitvec */
+
+	dev_iw_iovar_getbuf(dev, "event_msgs", "", 0, iovbuf, sizeof(iovbuf));
+	bcopy(iovbuf, eventmask, WL_EVENTING_MASK_LEN);
+	setbit(eventmask, WLC_E_SCAN_COMPLETE);
+	dev_iw_iovar_setbuf(dev, "event_msgs", eventmask, WL_EVENTING_MASK_LEN,
+		iovbuf, sizeof(iovbuf));
+
+}
+
+static int
+wl_iw_iscan_prep(wl_scan_params_t *params, wlc_ssid_t *ssid)
+{
+	int err = 0;
+
+	memcpy(&params->bssid, &ether_bcast, ETHER_ADDR_LEN);
+	params->bss_type = DOT11_BSSTYPE_ANY;
+	params->scan_type = 0;
+	params->nprobes = -1;
+	params->active_time = -1;
+	params->passive_time = -1;
+	params->home_time = -1;
+	params->channel_num = 0;
+
+	params->nprobes = htod32(params->nprobes);
+	params->active_time = htod32(params->active_time);
+	params->passive_time = htod32(params->passive_time);
+	params->home_time = htod32(params->home_time);
+	if (ssid && ssid->SSID_len)
+		memcpy(&params->ssid, ssid, sizeof(wlc_ssid_t));
+
+	return err;
+}
+
+static int
+wl_iw_iscan(iscan_info_t *iscan, wlc_ssid_t *ssid, uint16 action)
+{
+	int params_size = (WL_SCAN_PARAMS_FIXED_SIZE + OFFSETOF(wl_iscan_params_t, params));
+	wl_iscan_params_t *params;
+	int err = 0;
+
+	if (ssid && ssid->SSID_len) {
+		params_size += sizeof(wlc_ssid_t);
+	}
+	params = (wl_iscan_params_t*)kmalloc(params_size, GFP_KERNEL);
+	if (params == NULL) {
+		return -ENOMEM;
+	}
+	memset(params, 0, params_size);
+	ASSERT(params_size < WLC_IOCTL_SMLEN);
+
+	err = wl_iw_iscan_prep(&params->params, ssid);
+
+	if (!err) {
+		params->version = htod32(ISCAN_REQ_VERSION);
+		params->action = htod16(action);
+		params->scan_duration = htod16(0);
+
+		/* params_size += OFFSETOF(wl_iscan_params_t, params); */
+		(void) dev_iw_iovar_setbuf(iscan->dev, "iscan", params, params_size,
+			iscan->ioctlbuf, WLC_IOCTL_SMLEN);
+	}
+
+	kfree(params);
+	return err;
+}
+
+static uint32
+wl_iw_iscan_get(iscan_info_t *iscan)
+{
+	iscan_buf_t * buf;
+	iscan_buf_t * ptr;
+	wl_iscan_results_t * list_buf;
+	wl_iscan_results_t list;
+	wl_scan_results_t *results;
+	uint32 status;
+
+	/* buffers are allocated on demand */
+	if (iscan->list_cur) {
+		buf = iscan->list_cur;
+		iscan->list_cur = buf->next;
+	}
+	else {
+		buf = kmalloc(sizeof(iscan_buf_t), GFP_KERNEL);
+		if (!buf)
+			return WL_SCAN_RESULTS_ABORTED;
+		buf->next = NULL;
+		if (!iscan->list_hdr)
+			iscan->list_hdr = buf;
+		else {
+			ptr = iscan->list_hdr;
+			while (ptr->next) {
+				ptr = ptr->next;
+			}
+			ptr->next = buf;
+		}
+	}
+	memset(buf->iscan_buf, 0, WLC_IW_ISCAN_MAXLEN);
+	list_buf = (wl_iscan_results_t*)buf->iscan_buf;
+	results = &list_buf->results;
+	results->buflen = WL_ISCAN_RESULTS_FIXED_SIZE;
+	results->version = 0;
+	results->count = 0;
+
+	memset(&list, 0, sizeof(list));
+	list.results.buflen = htod32(WLC_IW_ISCAN_MAXLEN);
+	(void) dev_iw_iovar_getbuf(
+		iscan->dev,
+		"iscanresults",
+		&list,
+		WL_ISCAN_RESULTS_FIXED_SIZE,
+		buf->iscan_buf,
+		WLC_IW_ISCAN_MAXLEN);
+	results->buflen = dtoh32(results->buflen);
+	results->version = dtoh32(results->version);
+	results->count = dtoh32(results->count);
+	WL_TRACE(("results->count = %d\n", results->count));
+
+	WL_TRACE(("results->buflen = %d\n", results->buflen));
+	status = dtoh32(list_buf->status);
+	return status;
+}
+
+static void wl_iw_send_scan_complete(iscan_info_t *iscan)
+{
+	union iwreq_data wrqu;
+
+	memset(&wrqu, 0, sizeof(wrqu));
+
+	/* wext expects to get no data for SIOCGIWSCAN Event  */
+	wireless_send_event(iscan->dev, SIOCGIWSCAN, &wrqu, NULL);
+}
+
+static int
+_iscan_sysioc_thread(void *data)
+{
+	uint32 status;
+	iscan_info_t *iscan = (iscan_info_t *)data;
+
+	printf("%s: thread Enter\n", __FUNCTION__);
+	DAEMONIZE("iscan_sysioc");
+
+	status = WL_SCAN_RESULTS_PARTIAL;
+	while (down_interruptible(&iscan->sysioc_sem) == 0) {
+		if (iscan->timer_on) {
+			del_timer(&iscan->timer);
+			iscan->timer_on = 0;
+		}
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+		rtnl_lock();
+#endif
+		status = wl_iw_iscan_get(iscan);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+		rtnl_unlock();
+#endif
+
+		switch (status) {
+			case WL_SCAN_RESULTS_PARTIAL:
+				WL_TRACE(("iscanresults incomplete\n"));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+				rtnl_lock();
+#endif
+				/* make sure our buffer size is enough before going next round */
+				wl_iw_iscan(iscan, NULL, WL_SCAN_ACTION_CONTINUE);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27))
+				rtnl_unlock();
+#endif
+				/* Reschedule the timer */
+				iscan->timer.expires = jiffies + msecs_to_jiffies(iscan->timer_ms);
+				add_timer(&iscan->timer);
+				iscan->timer_on = 1;
+				break;
+			case WL_SCAN_RESULTS_SUCCESS:
+				WL_TRACE(("iscanresults complete\n"));
+				iscan->iscan_state = ISCAN_STATE_IDLE;
+				wl_iw_send_scan_complete(iscan);
+				break;
+			case WL_SCAN_RESULTS_PENDING:
+				WL_TRACE(("iscanresults pending\n"));
+				/* Reschedule the timer */
+				iscan->timer.expires = jiffies + msecs_to_jiffies(iscan->timer_ms);
+				add_timer(&iscan->timer);
+				iscan->timer_on = 1;
+				break;
+			case WL_SCAN_RESULTS_ABORTED:
+				WL_TRACE(("iscanresults aborted\n"));
+				iscan->iscan_state = ISCAN_STATE_IDLE;
+				wl_iw_send_scan_complete(iscan);
+				break;
+			default:
+				WL_TRACE(("iscanresults returned unknown status %d\n", status));
+				break;
+		 }
+	}
+	printf("%s: was terminated\n", __FUNCTION__);
+	complete_and_exit(&iscan->sysioc_exited, 0);
+}
+
+int
+wl_iw_attach(struct net_device *dev, void * dhdp)
+{
+	iscan_info_t *iscan = NULL;
+
+	printf("%s: Enter\n", __FUNCTION__);
+
+	if (!dev)
+		return 0;
+
+	iscan = kmalloc(sizeof(iscan_info_t), GFP_KERNEL);
+	if (!iscan)
+		return -ENOMEM;
+	memset(iscan, 0, sizeof(iscan_info_t));
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+	iscan->kthread = NULL;
+#endif
+	iscan->sysioc_pid = -1;
+	/* we only care about main interface so save a global here */
+	g_iscan = iscan;
+	iscan->dev = dev;
+	iscan->iscan_state = ISCAN_STATE_IDLE;
+
+
+	/* Set up the timer */
+	iscan->timer_ms    = 2000;
+	init_timer(&iscan->timer);
+	iscan->timer.data = (ulong)iscan;
+	iscan->timer.function = wl_iw_timerfunc;
+
+	sema_init(&iscan->sysioc_sem, 0);
+	init_completion(&iscan->sysioc_exited);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 7, 0))
+	iscan->kthread = kthread_run(_iscan_sysioc_thread, iscan, "iscan_sysioc");
+	iscan->sysioc_pid = iscan->kthread->pid;
+#else
+	iscan->sysioc_pid = kernel_thread(_iscan_sysioc_thread, iscan, 0);
+#endif
+	if (iscan->sysioc_pid < 0)
+		return -ENOMEM;
+	return 0;
+}
+
+void wl_iw_detach(void)
+{
+	iscan_buf_t  *buf;
+	iscan_info_t *iscan = g_iscan;
+	if (!iscan)
+		return;
+	if (iscan->sysioc_pid >= 0) {
+		KILL_PROC(iscan->sysioc_pid, SIGTERM);
+		wait_for_completion(&iscan->sysioc_exited);
+	}
+
+	while (iscan->list_hdr) {
+		buf = iscan->list_hdr->next;
+		kfree(iscan->list_hdr);
+		iscan->list_hdr = buf;
+	}
+	kfree(iscan);
+	g_iscan = NULL;
+}
+
+#endif /* USE_IW */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_iw.h b/drivers/net/wireless/bcm4336/wl_iw.h
--- a/drivers/net/wireless/bcm4336/wl_iw.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_iw.h	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,143 @@
+/*
+ * Linux Wireless Extensions support
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_iw.h 488316 2014-06-30 15:22:21Z $
+ */
+
+#ifndef _wl_iw_h_
+#define _wl_iw_h_
+
+#include <linux/wireless.h>
+
+#include <typedefs.h>
+#include <proto/ethernet.h>
+#include <wlioctl.h>
+
+#define WL_SCAN_PARAMS_SSID_MAX 	10
+#define GET_SSID			"SSID="
+#define GET_CHANNEL			"CH="
+#define GET_NPROBE 			"NPROBE="
+#define GET_ACTIVE_ASSOC_DWELL  	"ACTIVE="
+#define GET_PASSIVE_ASSOC_DWELL  	"PASSIVE="
+#define GET_HOME_DWELL  		"HOME="
+#define GET_SCAN_TYPE			"TYPE="
+
+#define BAND_GET_CMD				"GETBAND"
+#define BAND_SET_CMD				"SETBAND"
+#define DTIM_SKIP_GET_CMD			"DTIMSKIPGET"
+#define DTIM_SKIP_SET_CMD			"DTIMSKIPSET"
+#define SETSUSPEND_CMD				"SETSUSPENDOPT"
+#define PNOSSIDCLR_SET_CMD			"PNOSSIDCLR"
+/* Lin - Is the extra space needed? */
+#define PNOSETUP_SET_CMD			"PNOSETUP " /* TLV command has extra end space */
+#define PNOENABLE_SET_CMD			"PNOFORCE"
+#define PNODEBUG_SET_CMD			"PNODEBUG"
+#define TXPOWER_SET_CMD			"TXPOWER"
+
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTR "%02X:%02X:%02X:%02X:%02X:%02X"
+
+/* Structure to keep global parameters */
+typedef struct wl_iw_extra_params {
+	int 	target_channel; /* target channel */
+} wl_iw_extra_params_t;
+
+struct cntry_locales_custom {
+	char iso_abbrev[WLC_CNTRY_BUF_SZ];	/* ISO 3166-1 country abbreviation */
+	char custom_locale[WLC_CNTRY_BUF_SZ];	/* Custom firmware locale */
+	int32 custom_locale_rev;		/* Custom local revisin default -1 */
+};
+/* ============================================== */
+/* Defines from wlc_pub.h */
+#define	WL_IW_RSSI_MINVAL		-200	/* Low value, e.g. for forcing roam */
+#define	WL_IW_RSSI_NO_SIGNAL	-91	/* NDIS RSSI link quality cutoffs */
+#define	WL_IW_RSSI_VERY_LOW	-80	/* Very low quality cutoffs */
+#define	WL_IW_RSSI_LOW		-70	/* Low quality cutoffs */
+#define	WL_IW_RSSI_GOOD		-68	/* Good quality cutoffs */
+#define	WL_IW_RSSI_VERY_GOOD	-58	/* Very good quality cutoffs */
+#define	WL_IW_RSSI_EXCELLENT	-57	/* Excellent quality cutoffs */
+#define	WL_IW_RSSI_INVALID	 0	/* invalid RSSI value */
+#define MAX_WX_STRING 80
+#define SSID_FMT_BUF_LEN	((4 * 32) + 1)
+#define isprint(c) bcm_isprint(c)
+#define WL_IW_SET_ACTIVE_SCAN	(SIOCIWFIRSTPRIV+1)
+#define WL_IW_GET_RSSI			(SIOCIWFIRSTPRIV+3)
+#define WL_IW_SET_PASSIVE_SCAN	(SIOCIWFIRSTPRIV+5)
+#define WL_IW_GET_LINK_SPEED	(SIOCIWFIRSTPRIV+7)
+#define WL_IW_GET_CURR_MACADDR	(SIOCIWFIRSTPRIV+9)
+#define WL_IW_SET_STOP				(SIOCIWFIRSTPRIV+11)
+#define WL_IW_SET_START			(SIOCIWFIRSTPRIV+13)
+
+#define 		G_SCAN_RESULTS 8*1024
+#define 		WE_ADD_EVENT_FIX	0x80
+#define          G_WLAN_SET_ON	0
+#define          G_WLAN_SET_OFF	1
+
+
+typedef struct wl_iw {
+	char nickname[IW_ESSID_MAX_SIZE];
+
+	struct iw_statistics wstats;
+
+	int spy_num;
+	uint32 pwsec;			/* pairwise wsec setting */
+	uint32 gwsec;			/* group wsec setting  */
+	bool privacy_invoked; 		/* IW_AUTH_PRIVACY_INVOKED setting */
+	struct ether_addr spy_addr[IW_MAX_SPY];
+	struct iw_quality spy_qual[IW_MAX_SPY];
+	void  *wlinfo;
+} wl_iw_t;
+
+struct wl_ctrl {
+	struct timer_list *timer;
+	struct net_device *dev;
+	long sysioc_pid;
+	struct semaphore sysioc_sem;
+	struct completion sysioc_exited;
+};
+
+
+#if WIRELESS_EXT > 12
+#include <net/iw_handler.h>
+extern const struct iw_handler_def wl_iw_handler_def;
+#endif /* WIRELESS_EXT > 12 */
+
+extern int wl_iw_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
+extern void wl_iw_event(struct net_device *dev, wl_event_msg_t *e, void* data);
+extern int wl_iw_get_wireless_stats(struct net_device *dev, struct iw_statistics *wstats);
+int wl_iw_attach(struct net_device *dev, void * dhdp);
+int wl_iw_send_priv_event(struct net_device *dev, char *flag);
+
+void wl_iw_detach(void);
+
+#define CSCAN_COMMAND				"CSCAN "
+#define CSCAN_TLV_PREFIX 			'S'
+#define CSCAN_TLV_VERSION			1
+#define CSCAN_TLV_SUBVERSION			0
+#define CSCAN_TLV_TYPE_SSID_IE          'S'
+#define CSCAN_TLV_TYPE_CHANNEL_IE   'C'
+#define CSCAN_TLV_TYPE_NPROBE_IE     'N'
+#define CSCAN_TLV_TYPE_ACTIVE_IE      'A'
+#define CSCAN_TLV_TYPE_PASSIVE_IE    'P'
+#define CSCAN_TLV_TYPE_HOME_IE         'H'
+#define CSCAN_TLV_TYPE_STYPE_IE        'T'
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 27)
+#define IWE_STREAM_ADD_EVENT(info, stream, ends, iwe, extra) \
+	iwe_stream_add_event(info, stream, ends, iwe, extra)
+#define IWE_STREAM_ADD_VALUE(info, event, value, ends, iwe, event_len) \
+	iwe_stream_add_value(info, event, value, ends, iwe, event_len)
+#define IWE_STREAM_ADD_POINT(info, stream, ends, iwe, extra) \
+	iwe_stream_add_point(info, stream, ends, iwe, extra)
+#else
+#define IWE_STREAM_ADD_EVENT(info, stream, ends, iwe, extra) \
+	iwe_stream_add_event(stream, ends, iwe, extra)
+#define IWE_STREAM_ADD_VALUE(info, event, value, ends, iwe, event_len) \
+	iwe_stream_add_value(event, value, ends, iwe, event_len)
+#define IWE_STREAM_ADD_POINT(info, stream, ends, iwe, extra) \
+	iwe_stream_add_point(stream, ends, iwe, extra)
+#endif
+
+#endif /* _wl_iw_h_ */
diff -ENwbur a/drivers/net/wireless/bcm4336/wl_linux_mon.c b/drivers/net/wireless/bcm4336/wl_linux_mon.c
--- a/drivers/net/wireless/bcm4336/wl_linux_mon.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/net/wireless/bcm4336/wl_linux_mon.c	2018-05-06 08:49:50.638754662 +0200
@@ -0,0 +1,385 @@
+/*
+ * Broadcom Dongle Host Driver (DHD), Linux monitor network interface
+ *
+ * $Copyright Open Broadcom Corporation$
+ *
+ * $Id: wl_linux_mon.c 467328 2014-04-03 01:23:40Z $
+ */
+
+#include <osl.h>
+#include <linux/string.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_arp.h>
+#include <linux/ieee80211.h>
+#include <linux/rtnetlink.h>
+#include <net/ieee80211_radiotap.h>
+
+#include <wlioctl.h>
+#include <bcmutils.h>
+#include <dhd_dbg.h>
+#include <dngl_stats.h>
+#include <dhd.h>
+
+typedef enum monitor_states
+{
+	MONITOR_STATE_DEINIT = 0x0,
+	MONITOR_STATE_INIT = 0x1,
+	MONITOR_STATE_INTERFACE_ADDED = 0x2,
+	MONITOR_STATE_INTERFACE_DELETED = 0x4
+} monitor_states_t;
+int dhd_add_monitor(char *name, struct net_device **new_ndev);
+extern int dhd_start_xmit(struct sk_buff *skb, struct net_device *net);
+int dhd_del_monitor(struct net_device *ndev);
+int dhd_monitor_init(void *dhd_pub);
+int dhd_monitor_uninit(void);
+
+/**
+ * Local declarations and defintions (not exposed)
+ */
+#ifndef DHD_MAX_IFS
+#define DHD_MAX_IFS 16
+#endif
+#define MON_PRINT(format, ...) printk("DHD-MON: %s " format, __func__, ##__VA_ARGS__)
+#define MON_TRACE MON_PRINT
+
+typedef struct monitor_interface {
+	int radiotap_enabled;
+	struct net_device* real_ndev;	/* The real interface that the monitor is on */
+	struct net_device* mon_ndev;
+} monitor_interface;
+
+typedef struct dhd_linux_monitor {
+	void *dhd_pub;
+	monitor_states_t monitor_state;
+	monitor_interface mon_if[DHD_MAX_IFS];
+	struct mutex lock;		/* lock to protect mon_if */
+} dhd_linux_monitor_t;
+
+static dhd_linux_monitor_t g_monitor;
+
+static struct net_device* lookup_real_netdev(char *name);
+static monitor_interface* ndev_to_monif(struct net_device *ndev);
+static int dhd_mon_if_open(struct net_device *ndev);
+static int dhd_mon_if_stop(struct net_device *ndev);
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev);
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr);
+
+static const struct net_device_ops dhd_mon_if_ops = {
+	.ndo_open		= dhd_mon_if_open,
+	.ndo_stop		= dhd_mon_if_stop,
+	.ndo_start_xmit		= dhd_mon_if_subif_start_xmit,
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0))
+	.ndo_set_rx_mode = dhd_mon_if_set_multicast_list,
+#else
+	.ndo_set_multicast_list = dhd_mon_if_set_multicast_list,
+#endif
+	.ndo_set_mac_address 	= dhd_mon_if_change_mac,
+};
+
+/**
+ * Local static function defintions
+ */
+
+/* Look up dhd's net device table to find a match (e.g. interface "eth0" is a match for "mon.eth0"
+ * "p2p-eth0-0" is a match for "mon.p2p-eth0-0")
+ */
+static struct net_device* lookup_real_netdev(char *name)
+{
+	struct net_device *ndev_found = NULL;
+
+	int i;
+	int len = 0;
+	int last_name_len = 0;
+	struct net_device *ndev;
+
+	/* We need to find interface "p2p-p2p-0" corresponding to monitor interface "mon-p2p-0",
+	 * Once mon iface name reaches IFNAMSIZ, it is reset to p2p0-0 and corresponding mon
+	 * iface would be mon-p2p0-0.
+	 */
+	for (i = 0; i < DHD_MAX_IFS; i++) {
+		ndev = dhd_idx2net(g_monitor.dhd_pub, i);
+
+		/* Skip "p2p" and look for "-p2p0-x" in monitor interface name. If it
+		 * it matches, then this netdev is the corresponding real_netdev.
+		 */
+		if (ndev && strstr(ndev->name, "p2p-p2p0")) {
+			len = strlen("p2p");
+		} else {
+		/* if p2p- is not present, then the IFNAMSIZ have reached and name
+		 * would have got reset. In this casse,look for p2p0-x in mon-p2p0-x
+		 */
+			len = 0;
+		}
+		if (ndev && strstr(name, (ndev->name + len))) {
+			if (strlen(ndev->name) > last_name_len) {
+				ndev_found = ndev;
+				last_name_len = strlen(ndev->name);
+			}
+		}
+	}
+
+	return ndev_found;
+}
+
+static monitor_interface* ndev_to_monif(struct net_device *ndev)
+{
+	int i;
+
+	for (i = 0; i < DHD_MAX_IFS; i++) {
+		if (g_monitor.mon_if[i].mon_ndev == ndev)
+			return &g_monitor.mon_if[i];
+	}
+
+	return NULL;
+}
+
+static int dhd_mon_if_open(struct net_device *ndev)
+{
+	int ret = 0;
+
+	MON_PRINT("enter\n");
+	return ret;
+}
+
+static int dhd_mon_if_stop(struct net_device *ndev)
+{
+	int ret = 0;
+
+	MON_PRINT("enter\n");
+	return ret;
+}
+
+static int dhd_mon_if_subif_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+	int ret = 0;
+	int rtap_len;
+	int qos_len = 0;
+	int dot11_hdr_len = 24;
+	int snap_len = 6;
+	unsigned char *pdata;
+	unsigned short frame_ctl;
+	unsigned char src_mac_addr[6];
+	unsigned char dst_mac_addr[6];
+	struct ieee80211_hdr *dot11_hdr;
+	struct ieee80211_radiotap_header *rtap_hdr;
+	monitor_interface* mon_if;
+
+	MON_PRINT("enter\n");
+
+	mon_if = ndev_to_monif(ndev);
+	if (mon_if == NULL || mon_if->real_ndev == NULL) {
+		MON_PRINT(" cannot find matched net dev, skip the packet\n");
+		goto fail;
+	}
+
+	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
+		goto fail;
+
+	rtap_hdr = (struct ieee80211_radiotap_header *)skb->data;
+	if (unlikely(rtap_hdr->it_version))
+		goto fail;
+
+	rtap_len = ieee80211_get_radiotap_len(skb->data);
+	if (unlikely(skb->len < rtap_len))
+		goto fail;
+
+	MON_PRINT("radiotap len (should be 14): %d\n", rtap_len);
+
+	/* Skip the ratio tap header */
+	skb_pull(skb, rtap_len);
+
+	dot11_hdr = (struct ieee80211_hdr *)skb->data;
+	frame_ctl = le16_to_cpu(dot11_hdr->frame_control);
+	/* Check if the QoS bit is set */
+	if ((frame_ctl & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
+		/* Check if this ia a Wireless Distribution System (WDS) frame
+		 * which has 4 MAC addresses
+		 */
+		if (dot11_hdr->frame_control & 0x0080)
+			qos_len = 2;
+		if ((dot11_hdr->frame_control & 0x0300) == 0x0300)
+			dot11_hdr_len += 6;
+
+		memcpy(dst_mac_addr, dot11_hdr->addr1, sizeof(dst_mac_addr));
+		memcpy(src_mac_addr, dot11_hdr->addr2, sizeof(src_mac_addr));
+
+		/* Skip the 802.11 header, QoS (if any) and SNAP, but leave spaces for
+		 * for two MAC addresses
+		 */
+		skb_pull(skb, dot11_hdr_len + qos_len + snap_len - sizeof(src_mac_addr) * 2);
+		pdata = (unsigned char*)skb->data;
+		memcpy(pdata, dst_mac_addr, sizeof(dst_mac_addr));
+		memcpy(pdata + sizeof(dst_mac_addr), src_mac_addr, sizeof(src_mac_addr));
+		PKTSETPRIO(skb, 0);
+
+		MON_PRINT("if name: %s, matched if name %s\n", ndev->name, mon_if->real_ndev->name);
+
+		/* Use the real net device to transmit the packet */
+		ret = dhd_start_xmit(skb, mon_if->real_ndev);
+
+		return ret;
+	}
+fail:
+	dev_kfree_skb(skb);
+	return 0;
+}
+
+static void dhd_mon_if_set_multicast_list(struct net_device *ndev)
+{
+	monitor_interface* mon_if;
+
+	mon_if = ndev_to_monif(ndev);
+	if (mon_if == NULL || mon_if->real_ndev == NULL) {
+		MON_PRINT(" cannot find matched net dev, skip the packet\n");
+	} else {
+		MON_PRINT("enter, if name: %s, matched if name %s\n",
+		ndev->name, mon_if->real_ndev->name);
+	}
+}
+
+static int dhd_mon_if_change_mac(struct net_device *ndev, void *addr)
+{
+	int ret = 0;
+	monitor_interface* mon_if;
+
+	mon_if = ndev_to_monif(ndev);
+	if (mon_if == NULL || mon_if->real_ndev == NULL) {
+		MON_PRINT(" cannot find matched net dev, skip the packet\n");
+	} else {
+		MON_PRINT("enter, if name: %s, matched if name %s\n",
+		ndev->name, mon_if->real_ndev->name);
+	}
+	return ret;
+}
+
+/**
+ * Global function definitions (declared in dhd_linux_mon.h)
+ */
+
+int dhd_add_monitor(char *name, struct net_device **new_ndev)
+{
+	int i;
+	int idx = -1;
+	int ret = 0;
+	struct net_device* ndev = NULL;
+	dhd_linux_monitor_t **dhd_mon;
+
+	mutex_lock(&g_monitor.lock);
+
+	MON_TRACE("enter, if name: %s\n", name);
+	if (!name || !new_ndev) {
+		MON_PRINT("invalid parameters\n");
+		ret = -EINVAL;
+		goto out;
+	}
+
+	/*
+	 * Find a vacancy
+	 */
+	for (i = 0; i < DHD_MAX_IFS; i++)
+		if (g_monitor.mon_if[i].mon_ndev == NULL) {
+			idx = i;
+			break;
+		}
+	if (idx == -1) {
+		MON_PRINT("exceeds maximum interfaces\n");
+		ret = -EFAULT;
+		goto out;
+	}
+
+	ndev = alloc_etherdev(sizeof(dhd_linux_monitor_t*));
+	if (!ndev) {
+		MON_PRINT("failed to allocate memory\n");
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+	strncpy(ndev->name, name, IFNAMSIZ);
+	ndev->name[IFNAMSIZ - 1] = 0;
+	ndev->netdev_ops = &dhd_mon_if_ops;
+
+	ret = register_netdevice(ndev);
+	if (ret) {
+		MON_PRINT(" register_netdevice failed (%d)\n", ret);
+		goto out;
+	}
+
+	*new_ndev = ndev;
+	g_monitor.mon_if[idx].radiotap_enabled = TRUE;
+	g_monitor.mon_if[idx].mon_ndev = ndev;
+	g_monitor.mon_if[idx].real_ndev = lookup_real_netdev(name);
+	dhd_mon = (dhd_linux_monitor_t **)netdev_priv(ndev);
+	*dhd_mon = &g_monitor;
+	g_monitor.monitor_state = MONITOR_STATE_INTERFACE_ADDED;
+	MON_PRINT("net device returned: 0x%p\n", ndev);
+	MON_PRINT("found a matched net device, name %s\n", g_monitor.mon_if[idx].real_ndev->name);
+
+out:
+	if (ret && ndev)
+		free_netdev(ndev);
+
+	mutex_unlock(&g_monitor.lock);
+	return ret;
+
+}
+
+int dhd_del_monitor(struct net_device *ndev)
+{
+	int i;
+	if (!ndev)
+		return -EINVAL;
+	mutex_lock(&g_monitor.lock);
+	for (i = 0; i < DHD_MAX_IFS; i++) {
+		if (g_monitor.mon_if[i].mon_ndev == ndev ||
+			g_monitor.mon_if[i].real_ndev == ndev) {
+
+			g_monitor.mon_if[i].real_ndev = NULL;
+			unregister_netdevice(g_monitor.mon_if[i].mon_ndev);
+			free_netdev(g_monitor.mon_if[i].mon_ndev);
+			g_monitor.mon_if[i].mon_ndev = NULL;
+			g_monitor.monitor_state = MONITOR_STATE_INTERFACE_DELETED;
+			break;
+		}
+	}
+
+	if (g_monitor.monitor_state != MONITOR_STATE_INTERFACE_DELETED)
+		MON_PRINT("IF not found in monitor array, is this a monitor IF? 0x%p\n", ndev);
+	mutex_unlock(&g_monitor.lock);
+
+	return 0;
+}
+
+int dhd_monitor_init(void *dhd_pub)
+{
+	if (g_monitor.monitor_state == MONITOR_STATE_DEINIT) {
+		g_monitor.dhd_pub = dhd_pub;
+		mutex_init(&g_monitor.lock);
+		g_monitor.monitor_state = MONITOR_STATE_INIT;
+	}
+	return 0;
+}
+
+int dhd_monitor_uninit(void)
+{
+	int i;
+	struct net_device *ndev;
+	mutex_lock(&g_monitor.lock);
+	if (g_monitor.monitor_state != MONITOR_STATE_DEINIT) {
+		for (i = 0; i < DHD_MAX_IFS; i++) {
+			ndev = g_monitor.mon_if[i].mon_ndev;
+			if (ndev) {
+				unregister_netdevice(ndev);
+				free_netdev(ndev);
+				g_monitor.mon_if[i].real_ndev = NULL;
+				g_monitor.mon_if[i].mon_ndev = NULL;
+			}
+		}
+		g_monitor.monitor_state = MONITOR_STATE_DEINIT;
+	}
+	mutex_unlock(&g_monitor.lock);
+	return 0;
+}
diff -ENwbur a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c	2018-05-06 08:47:37.769361990 +0200
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c	2018-05-06 08:49:50.650755149 +0200
@@ -3164,6 +3164,9 @@
 	if (status == BRCMF_E_STATUS_ABORT)
 		goto exit;

+	if (status == BRCMF_E_STATUS_ABORT)
+		goto exit;
+
 	if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
 		brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
 		return -EPERM;
@@ -5876,7 +5879,7 @@
 	s32 err = 0;

 	cfg->scan_request = NULL;
-	cfg->pwr_save = true;
+	cfg->pwr_save = !cfg->pub->settings->powersave_default_off;
 	cfg->active_scan = true;	/* we do active scan per default */
 	cfg->dongle_up = false;		/* dongle is not up yet */
 	err = brcmf_init_priv_mem(cfg);
@@ -6617,8 +6620,9 @@
 				    BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
 				    BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);

+	if( ! ifp->drvr->settings->powersave_default_off )
+		wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
-			WIPHY_FLAG_PS_ON_BY_DEFAULT |
 			WIPHY_FLAG_OFFCHAN_TX |
 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
diff -ENwbur a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c	2018-05-06 08:47:37.769361990 +0200
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c	2018-05-06 08:49:50.650755149 +0200
@@ -1217,6 +1217,14 @@
 	core = brcmf_chip_get_core(&chip->pub, BCMA_CORE_ARM_CM3);
 	brcmf_chip_resetcore(core, 0, 0, 0);

+	if( chip->pub.chip == BRCM_CC_43430_CHIP_ID && chip->pub.chiprev == 0 ) {
+		/* ap6212: fix occasional I/O timeout occuring after this reset.
+		 * Usually appropriate delay (~50ms) provides sdio_enable_func()
+		 * invoked after reset to enable F2. But sometimes (after rmmod
+		 * followed by insmod) the enable function returns immediately.
+		 */
+		usleep_range(40000, 60000);
+	}
 	return true;
 }

diff -ENwbur a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c	2018-05-06 08:47:37.769361990 +0200
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c	2018-05-06 08:49:50.650755149 +0200
@@ -80,6 +80,10 @@
 MODULE_PARM_DESC(ignore_probe_fail, "always succeed probe for debugging");
 #endif

+static int brcmf_powersave_default = -1;
+module_param_named(powersave_default, brcmf_powersave_default, int, 0);
+MODULE_PARM_DESC(powersave_default, "Set powersave default on/off on wiphy");
+
 static struct brcmfmac_platform_data *brcmfmac_pdata;
 struct brcmf_mp_global_t brcmf_mp_global;

@@ -319,6 +323,8 @@
 		/* No platform data for this device, try OF (Open Firwmare) */
 		brcmf_of_probe(dev, bus_type, settings);
 	}
+	if( brcmf_powersave_default >= 0 )
+		settings->powersave_default_off = !brcmf_powersave_default;
 	return settings;
 }

diff -ENwbur a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h	2018-05-06 08:47:37.769361990 +0200
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h	2018-05-06 08:49:50.650755149 +0200
@@ -59,6 +59,7 @@
 	int		fcmode;
 	bool		roamoff;
 	bool		ignore_probe_fail;
+	bool		powersave_default_off;
 	struct brcmfmac_pd_cc *country_codes;
 	union {
 		struct brcmfmac_sdio_pd sdio;
diff -ENwbur a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c	2018-05-06 08:47:37.773362153 +0200
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c	2018-05-06 08:49:50.654755310 +0200
@@ -39,6 +39,9 @@
 	if (of_property_read_u32(np, "brcm,drive-strength", &val) == 0)
 		sdio->drive_strength = val;

+	settings->powersave_default_off = of_property_read_bool(np,
+			"brcm,powersave-default-off");
+
 	/* make sure there are interrupts defined in the node */
 	if (!of_find_property(np, "interrupts", NULL))
 		return;
diff -ENwbur a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
--- a/drivers/net/wireless/Kconfig	2018-05-06 08:47:37.717359879 +0200
+++ b/drivers/net/wireless/Kconfig	2018-05-06 08:49:50.574752064 +0200
@@ -33,6 +33,7 @@
 source "drivers/net/wireless/admtek/Kconfig"
 source "drivers/net/wireless/ath/Kconfig"
 source "drivers/net/wireless/atmel/Kconfig"
+source "drivers/net/wireless/bcm4336/Kconfig"
 source "drivers/net/wireless/broadcom/Kconfig"
 source "drivers/net/wireless/cisco/Kconfig"
 source "drivers/net/wireless/intel/Kconfig"
diff -ENwbur a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
--- a/drivers/net/wireless/Makefile	2018-05-06 08:47:37.717359879 +0200
+++ b/drivers/net/wireless/Makefile	2018-05-06 08:49:50.574752064 +0200
@@ -6,6 +6,7 @@
 obj-$(CONFIG_WLAN_VENDOR_ADMTEK) += admtek/
 obj-$(CONFIG_WLAN_VENDOR_ATH) += ath/
 obj-$(CONFIG_WLAN_VENDOR_ATMEL) += atmel/
+obj-$(CONFIG_BCMDHD)			+= bcm4336/
 obj-$(CONFIG_WLAN_VENDOR_BROADCOM) += broadcom/
 obj-$(CONFIG_WLAN_VENDOR_CISCO) += cisco/
 obj-$(CONFIG_WLAN_VENDOR_INTEL) += intel/
diff -ENwbur a/drivers/phy/samsung/Kconfig b/drivers/phy/samsung/Kconfig
--- a/drivers/phy/samsung/Kconfig	2018-05-06 08:47:37.941368973 +0200
+++ b/drivers/phy/samsung/Kconfig	2018-05-06 08:49:50.826762291 +0200
@@ -93,3 +93,9 @@
 	  Exynos5250 based SoCs.This SerDes/Phy supports SATA 1.5 Gb/s,
 	  SATA 3.0 Gb/s, SATA 6.0 Gb/s speeds. It supports one SATA host
 	  port to accept one SATA device.
+
+config PHY_NX_USB2
+	bool "Nexell USB 2.0 PHY driver"
+	depends on PHY_SAMSUNG_USB2
+	default ARCH_S5P4418 || ARCH_S5P6818
+
diff -ENwbur a/drivers/phy/samsung/Makefile b/drivers/phy/samsung/Makefile
--- a/drivers/phy/samsung/Makefile	2018-05-06 08:47:37.941368973 +0200
+++ b/drivers/phy/samsung/Makefile	2018-05-06 08:49:50.826762291 +0200
@@ -8,5 +8,6 @@
 phy-exynos-usb2-$(CONFIG_PHY_EXYNOS4X12_USB2)	+= phy-exynos4x12-usb2.o
 phy-exynos-usb2-$(CONFIG_PHY_EXYNOS5250_USB2)	+= phy-exynos5250-usb2.o
 phy-exynos-usb2-$(CONFIG_PHY_S5PV210_USB2)	+= phy-s5pv210-usb2.o
+phy-exynos-usb2-$(CONFIG_PHY_NX_USB2)	+= phy-nexell-usb2.o
 obj-$(CONFIG_PHY_EXYNOS5_USBDRD)	+= phy-exynos5-usbdrd.o
 obj-$(CONFIG_PHY_EXYNOS5250_SATA)	+= phy-exynos5250-sata.o
diff -ENwbur a/drivers/phy/samsung/phy-nexell-usb2.c b/drivers/phy/samsung/phy-nexell-usb2.c
--- a/drivers/phy/samsung/phy-nexell-usb2.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/phy/samsung/phy-nexell-usb2.c	2018-05-06 08:49:50.826762291 +0200
@@ -0,0 +1,398 @@
+/*
+ * Nexell SoC USB 1.1/2.0 PHY driver
+ *
+ * Copyright (C) 2016 Nexell Co., Ltd.
+ * Author: Hyunseok Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/phy/phy.h>
+#include <linux/regmap.h>
+#include "phy-samsung-usb2.h"
+
+/* Nexell USBHOST PHY registers */
+
+/* USBHOST Configuration 0 Register */
+#define NX_HOST_CON0				0x14
+#define NX_HOST_CON0_SS_WORD_IF			BIT(26)
+#define NX_HOST_CON0_SS_WORD_IF_ENB		BIT(25)
+#define NX_HOST_CON0_SS_WORD_IF_16 ( \
+	NX_HOST_CON0_SS_WORD_IF | \
+	NX_HOST_CON0_SS_WORD_IF_ENB)
+
+#define NX_HOST_CON0_HSIC_480M_FROM_OTG_PHY	BIT(24)
+#define NX_HOST_CON0_HSIC_FREE_CLOCK_ENB	BIT(23)
+#define NX_HOST_CON0_HSIC_CLK_MASK		(0x3 << 23)
+
+#define NX_HOST_CON0_N_HOST_HSIC_RESET_SYNC	BIT(22)
+#define NX_HOST_CON0_N_HOST_UTMI_RESET_SYNC	BIT(21)
+#define NX_HOST_CON0_N_HOST_PHY_RESET_SYNC	BIT(20)
+#define NX_HOST_CON0_UTMI_RESET_SYNC ( \
+	NX_HOST_CON0_N_HOST_HSIC_RESET_SYNC | \
+	NX_HOST_CON0_N_HOST_UTMI_RESET_SYNC | \
+	NX_HOST_CON0_N_HOST_PHY_RESET_SYNC)
+
+#define NX_HOST_CON0_N_AUXWELL_RESET_SYNC	BIT(19)
+#define NX_HOST_CON0_N_OHCI_RESET_SYNC		BIT(18)
+#define NX_HOST_CON0_N_RESET_SYNC		BIT(17)
+#define NX_HOST_CON0_AHB_RESET_SYNC ( \
+	NX_HOST_CON0_N_AUXWELL_RESET_SYNC | \
+	NX_HOST_CON0_N_OHCI_RESET_SYNC | \
+	NX_HOST_CON0_N_RESET_SYNC)
+
+#define NX_HOST_CON0_HSIC_EN_PORT1		(0x2 << 14)
+#define NX_HOST_CON0_HSIC_EN_MASK		(0x7 << 14)
+
+/* USBHOST Configuration 1 Register */
+#define NX_HOST_CON1				0x18
+
+/* USBHOST Configuration 2 Register */
+#define NX_HOST_CON2				0x1C
+#define NX_HOST_CON2_SS_ENA_INCRX_ALIGN		(0x1 << 28)
+#define NX_HOST_CON2_SS_ENA_INCR4		(0x1 << 27)
+#define NX_HOST_CON2_SS_ENA_INCR8		(0x1 << 26)
+#define NX_HOST_CON2_SS_ENA_INCR16		(0x1 << 25)
+#define NX_HOST_CON2_SS_DMA_BURST_MASK  \
+	(NX_HOST_CON2_SS_ENA_INCR16 | NX_HOST_CON2_SS_ENA_INCR8 | \
+	 NX_HOST_CON2_SS_ENA_INCR4 | NX_HOST_CON2_SS_ENA_INCRX_ALIGN)
+
+#define NX_HOST_CON2_EHCI_SS_ENABLE_DMA_BURST \
+	(NX_HOST_CON2_SS_ENA_INCR16 | NX_HOST_CON2_SS_ENA_INCR8 | \
+	 NX_HOST_CON2_SS_ENA_INCR4 | NX_HOST_CON2_SS_ENA_INCRX_ALIGN)
+
+#define NX_HOST_CON2_OHCI_SS_ENABLE_DMA_BURST \
+	(NX_HOST_CON2_SS_ENA_INCR4 | NX_HOST_CON2_SS_ENA_INCRX_ALIGN)
+
+#define NX_HOST_CON2_SS_FLADJ_VAL_0_OFFSET	(21)
+#define NX_HOST_CON2_SS_FLADJ_VAL_OFFSET	(3)
+#define NX_HOST_CON2_SS_FLADJ_VAL_NUM		(6)
+#define NX_HOST_CON2_SS_FLADJ_VAL_0_SEL		BIT(5)
+#define NX_HOST_CON2_SS_FLADJ_VAL_MAX		0x7
+
+/* USBHOST Configuration 3 Register */
+#define NX_HOST_CON3				0x20
+#define NX_HOST_CON3_POR			BIT(8)
+#define NX_HOST_CON3_POR_ENB			BIT(7)
+#define NX_HOST_CON3_POR_MASK			(0x3 << 7)
+#define NX_HOST_OHCI_SUSP_LGCY			(0x1 << 3)
+
+/* USBHOST Configuration 4 Register */
+#define NX_HOST_CON4				0x24
+#define NX_HOST_CON4_WORDINTERFACE		BIT(9)
+#define NX_HOST_CON4_WORDINTERFACE_ENB		BIT(8)
+#define NX_HOST_CON4_WORDINTERFACE_16 ( \
+	NX_HOST_CON4_WORDINTERFACE | \
+	NX_HOST_CON4_WORDINTERFACE_ENB)
+
+/* USBHOST Configuration 5 Register */
+#define NX_HOST_CON5				0x28
+#define NX_HOST_CON5_HSIC_POR			BIT(19)
+#define NX_HOST_CON5_HSIC_POR_ENB		BIT(18)
+#define NX_HOST_CON5_HSIC_POR_MASK		(0x3 << 18)
+
+/* USBHOST Configuration 6 Register */
+#define NX_HOST_CON6				0x2C
+#define NX_HOST_CON6_HSIC_WORDINTERFACE		BIT(13)
+#define NX_HOST_CON6_HSIC_WORDINTERFACE_ENB	BIT(12)
+#define NX_HOST_CON6_HSIC_WORDINTERFACE_16 ( \
+	NX_HOST_CON6_HSIC_WORDINTERFACE | \
+	NX_HOST_CON6_HSIC_WORDINTERFACE_ENB)
+
+/* Nexell USBOTG PHY registers */
+
+/* USBOTG Configuration 0 Register */
+#define NX_OTG_CON0				0x30
+#define NX_OTG_CON0_SS_SCALEDOWN_MODE		(3 << 0)
+
+/* USBOTG Configuration 1 Register */
+#define NX_OTG_CON1				0x34
+#define NX_OTG_CON1_VBUSVLDEXTSEL		BIT(25)
+#define NX_OTG_CON1_VBUSVLDEXT			BIT(24)
+#define NX_OTG_CON1_VBUS_INTERNAL ~( \
+	NX_OTG_CON1_VBUSVLDEXTSEL | \
+	NX_OTG_CON1_VBUSVLDEXT)
+#define NX_OTG_CON1_VBUS_VLDEXT0 ( \
+	NX_OTG_CON1_VBUSVLDEXTSEL | \
+	NX_OTG_CON1_VBUSVLDEXT)
+
+#define NX_OTG_CON1_POR				BIT(8)
+#define NX_OTG_CON1_POR_ENB			BIT(7)
+#define NX_OTG_CON1_POR_MASK			(0x3 << 7)
+#define NX_OTG_CON1_RST				BIT(3)
+#define NX_OTG_CON1_UTMI_RST			BIT(2)
+
+/* USBOTG Configuration 2 Register */
+#define NX_OTG_CON2				0x38
+#define NX_OTG_CON2_OTGTUNE_MASK		(0x7 << 23)
+#define NX_OTG_CON2_WORDINTERFACE		BIT(9)
+#define NX_OTG_CON2_WORDINTERFACE_ENB		BIT(8)
+#define NX_OTG_CON2_WORDINTERFACE_16 ( \
+	NX_OTG_CON2_WORDINTERFACE | \
+	NX_OTG_CON2_WORDINTERFACE_ENB)
+
+/* USBOTG Configuration 3 Register */
+#define NX_OTG_CON3				0x3C
+#define NX_OTG_CON3_ACAENB			BIT(15)
+#define NX_OTG_CON3_DCDENB			BIT(14)
+#define NX_OTG_CON3_VDATSRCENB			BIT(13)
+#define NX_OTG_CON3_VDATDETENB			BIT(12)
+#define NX_OTG_CON3_CHRGSEL			BIT(11)
+#define NX_OTG_CON3_DET_N_CHG ( \
+	NX_OTG_CON3_ACAENB | \
+	NX_OTG_CON3_DCDENB | \
+	NX_OTG_CON3_VDATSRCENB | \
+	NX_OTG_CON3_VDATDETENB | \
+	NX_OTG_CON3_CHRGSEL)
+
+enum nx_phy_id {
+	NX_OTG,
+	NX_HOST,
+	NX_HSIC,
+	NX_NUM_PHYS,
+};
+
+static int nx_otg_power_on(struct samsung_usb2_phy_instance *inst)
+{
+	struct samsung_usb2_phy_driver *drv = inst->drv;
+	u32 reg;
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON3)) &
+	       ~NX_OTG_CON3_DET_N_CHG,
+	       (void *)(drv->reg_phy + NX_OTG_CON3));
+
+	reg  = readl((void *)(drv->reg_phy + NX_OTG_CON2)) &
+		~NX_OTG_CON2_OTGTUNE_MASK;
+	writel(reg, (void *)(drv->reg_phy +  NX_OTG_CON2));
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON0)) &
+	       ~NX_OTG_CON0_SS_SCALEDOWN_MODE,
+	       (void *)(drv->reg_phy + NX_OTG_CON0));
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON2)) |
+	       NX_OTG_CON2_WORDINTERFACE_16,
+	       (void *)(drv->reg_phy + NX_OTG_CON2));
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) &
+	       NX_OTG_CON1_VBUS_INTERNAL,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+
+	reg = readl((void *)(drv->reg_phy + NX_OTG_CON1));
+	reg &= ~NX_OTG_CON1_POR_MASK;
+	reg |= NX_OTG_CON1_POR_ENB;
+	writel(reg, (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(1);
+	reg |= NX_OTG_CON1_POR_MASK;
+	writel(reg, (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(1);
+	reg &= ~NX_OTG_CON1_POR;
+	writel(reg, (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(10);
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) | NX_OTG_CON1_RST,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(50);
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) |
+	       NX_OTG_CON1_UTMI_RST,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(1);
+
+	return 0;
+}
+
+static int nx_otg_power_off(struct samsung_usb2_phy_instance *inst)
+{
+	struct samsung_usb2_phy_driver *drv = inst->drv;
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) |
+	       NX_OTG_CON1_VBUS_VLDEXT0,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) & ~NX_OTG_CON1_RST,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(10);
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) &
+	       ~NX_OTG_CON1_UTMI_RST,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(10);
+
+	writel(readl((void *)(drv->reg_phy + NX_OTG_CON1)) |
+	       NX_OTG_CON1_POR_MASK,
+	       (void *)(drv->reg_phy + NX_OTG_CON1));
+	udelay(10);
+
+	return 0;
+}
+
+static int nx_host_power_on(struct samsung_usb2_phy_instance *inst)
+{
+	struct samsung_usb2_phy_driver *drv = inst->drv;
+	u32 reg;
+	u32 reg1, reg2;
+	u32 fladj_val, bit_num, bit_pos = NX_HOST_CON2_SS_FLADJ_VAL_0_OFFSET;
+
+	fladj_val = NX_HOST_CON2_SS_FLADJ_VAL_0_SEL;
+
+	reg = fladj_val;
+
+	for (bit_num = 0; bit_num < NX_HOST_CON2_SS_FLADJ_VAL_NUM; bit_num++) {
+		if (fladj_val & (1 << bit_num))
+			reg |= (NX_HOST_CON2_SS_FLADJ_VAL_MAX << bit_pos);
+		bit_pos -= NX_HOST_CON2_SS_FLADJ_VAL_OFFSET;
+	}
+
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON2));
+
+	reg = readl((void *)(drv->reg_phy + NX_HOST_CON2)) &
+		~NX_HOST_CON2_SS_DMA_BURST_MASK;
+	writel(reg | NX_HOST_CON2_EHCI_SS_ENABLE_DMA_BURST,
+	       (void *)(drv->reg_phy +	NX_HOST_CON2));
+
+	reg1 = readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+		NX_HOST_CON0_SS_WORD_IF_16;
+	reg2 = readl((void *)(drv->reg_phy + NX_HOST_CON4)) |
+		NX_HOST_CON4_WORDINTERFACE_16;
+
+	writel(reg1, (void *)(drv->reg_phy + NX_HOST_CON0));
+	writel(reg2, (void *)(drv->reg_phy + NX_HOST_CON4));
+
+	reg = readl((void *)(drv->reg_phy + NX_HOST_CON3));
+	reg |= NX_HOST_OHCI_SUSP_LGCY;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON3));
+
+	reg   = readl((void *)(drv->reg_phy + NX_HOST_CON3));
+	reg  &= ~NX_HOST_CON3_POR_MASK;
+	reg  |=  NX_HOST_CON3_POR_ENB;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON3));
+	udelay(10);
+
+	reg = readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+		NX_HOST_CON0_N_HOST_UTMI_RESET_SYNC |
+		NX_HOST_CON0_N_HOST_PHY_RESET_SYNC;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+	       NX_HOST_CON0_AHB_RESET_SYNC,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	return 0;
+}
+
+static int nx_host_power_off(struct samsung_usb2_phy_instance *inst)
+{
+	struct samsung_usb2_phy_driver *drv = inst->drv;
+	u32 reg;
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) &
+	       ~NX_HOST_CON0_AHB_RESET_SYNC,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) &
+	       ~NX_HOST_CON0_UTMI_RESET_SYNC,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	reg    = readl((void *)(drv->reg_phy + NX_HOST_CON3));
+	reg   &= ~NX_HOST_CON3_POR_MASK;
+	reg   |=  NX_HOST_CON3_POR_ENB;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON3));
+	udelay(1);
+	reg   |=  NX_HOST_CON3_POR_MASK;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON3));
+	udelay(1);
+	reg   &= ~(NX_HOST_CON3_POR);
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON3));
+
+	udelay(10);
+
+	return 0;
+}
+
+static int nx_hsic_power_on(struct samsung_usb2_phy_instance *inst)
+{
+	struct samsung_usb2_phy_driver *drv = inst->drv;
+	u32 reg;
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) &
+	       ~NX_HOST_CON0_HSIC_CLK_MASK,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+	       NX_HOST_CON0_HSIC_480M_FROM_OTG_PHY,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) &
+	       ~NX_HOST_CON0_HSIC_EN_MASK,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+	       NX_HOST_CON0_HSIC_EN_PORT1,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	reg = readl((void *)(drv->reg_phy + NX_HOST_CON6)) |
+		NX_HOST_CON6_HSIC_WORDINTERFACE_16;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON6));
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+	       NX_HOST_CON0_HSIC_CLK_MASK,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON5)) &
+	       ~NX_HOST_CON5_HSIC_POR_MASK,
+	       (void *)(drv->reg_phy + NX_HOST_CON5));
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON5)) |
+	       NX_HOST_CON5_HSIC_POR_ENB,
+	       (void *)(drv->reg_phy + NX_HOST_CON5));
+
+	udelay(100);
+
+	reg = readl((void *)(drv->reg_phy + NX_HOST_CON0)) |
+		NX_HOST_CON0_N_HOST_HSIC_RESET_SYNC;
+	writel(reg, (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	return 0;
+}
+
+static int nx_hsic_power_off(struct samsung_usb2_phy_instance *inst)
+{
+	struct samsung_usb2_phy_driver *drv = inst->drv;
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON0)) &
+	       ~NX_HOST_CON0_HSIC_CLK_MASK,
+	       (void *)(drv->reg_phy + NX_HOST_CON0));
+
+	writel(readl((void *)(drv->reg_phy + NX_HOST_CON5)) |
+	       NX_HOST_CON5_HSIC_POR_MASK,
+	       (void *)(drv->reg_phy + NX_HOST_CON5));
+
+	return 0;
+}
+
+static const struct samsung_usb2_common_phy nx_phys[] = {
+	{
+		.label		= "otg",
+		.id		= NX_OTG,
+		.power_on	= nx_otg_power_on,
+		.power_off	= nx_otg_power_off,
+	},
+	{
+		.label		= "host",
+		.id		= NX_HOST,
+		.power_on	= nx_host_power_on,
+		.power_off	= nx_host_power_off,
+	},
+	{
+		.label		= "hsic",
+		.id		= NX_HSIC,
+		.power_on	= nx_hsic_power_on,
+		.power_off	= nx_hsic_power_off,
+	},
+};
+
+const struct samsung_usb2_phy_config nexell_usb2_phy_config = {
+	.num_phys		= NX_NUM_PHYS,
+	.phys			= nx_phys,
+};
diff -ENwbur a/drivers/phy/samsung/phy-samsung-usb2.c b/drivers/phy/samsung/phy-samsung-usb2.c
--- a/drivers/phy/samsung/phy-samsung-usb2.c	2018-05-06 08:47:37.945369136 +0200
+++ b/drivers/phy/samsung/phy-samsung-usb2.c	2018-05-06 08:49:50.826762291 +0200
@@ -38,21 +38,34 @@
 	ret = clk_prepare_enable(drv->clk);
 	if (ret)
 		goto err_main_clk;
+
+	if (of_device_is_compatible(drv->dev->of_node,
+					"nexell,nexell-usb2-phy"))
+		goto skip_ref_clk_en;
+
 	ret = clk_prepare_enable(drv->ref_clk);
 	if (ret)
 		goto err_instance_clk;
+
+skip_ref_clk_en:
+
 	if (inst->cfg->power_on) {
 		spin_lock(&drv->lock);
 		ret = inst->cfg->power_on(inst);
 		spin_unlock(&drv->lock);
-		if (ret)
+		if (ret) {
+			if (of_device_is_compatible(drv->dev->of_node,
+						    "nexell,nexell-usb2-phy"))
+				goto skip_err_power_on;
 			goto err_power_on;
 	}
+	}

 	return 0;

 err_power_on:
 	clk_disable_unprepare(drv->ref_clk);
+skip_err_power_on:
 err_instance_clk:
 	clk_disable_unprepare(drv->clk);
 err_main_clk:
@@ -77,7 +90,12 @@
 		if (ret)
 			return ret;
 	}
+	if (of_device_is_compatible(drv->dev->of_node,
+					"nexell,nexell-usb2-phy"))
+		goto skip_ref_clk_dis;
+
 	clk_disable_unprepare(drv->ref_clk);
+skip_ref_clk_dis:
 	clk_disable_unprepare(drv->clk);
 	if (drv->vbus)
 		ret = regulator_disable(drv->vbus);
@@ -137,6 +155,12 @@
 		.data = &s5pv210_usb2_phy_config,
 	},
 #endif
+#ifdef CONFIG_PHY_NX_USB2
+	{
+		.compatible = "nexell,nexell-usb2-phy",
+		.data = &nexell_usb2_phy_config,
+	},
+#endif
 	{ },
 };
 MODULE_DEVICE_TABLE(of, samsung_usb2_phy_of_match);
@@ -178,6 +202,16 @@
 		return PTR_ERR(drv->reg_phy);
 	}

+	if (of_device_is_compatible(pdev->dev.of_node,
+					"nexell,nexell-usb2-phy")) {
+		drv->clk = devm_clk_get(dev, "phy");
+		if (IS_ERR(drv->clk)) {
+			dev_err(dev, "Failed to get clock of phy controller\n");
+			return PTR_ERR(drv->clk);
+		}
+		goto skip_syscon_refclk;
+	}
+
 	drv->reg_pmu = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
 		"samsung,pmureg-phandle");
 	if (IS_ERR(drv->reg_pmu)) {
@@ -221,6 +255,8 @@
 		drv->vbus = NULL;
 	}

+skip_syscon_refclk:
+
 	for (i = 0; i < drv->cfg->num_phys; i++) {
 		char *label = drv->cfg->phys[i].label;
 		struct samsung_usb2_phy_instance *p = &drv->instances[i];
@@ -235,6 +271,10 @@

 		p->cfg = &drv->cfg->phys[i];
 		p->drv = drv;
+		if (of_device_is_compatible(pdev->dev.of_node,
+					"nexell,nexell-usb2-phy")) {
+			phy_set_bus_width(p->phy, 16);
+		} else
 		phy_set_bus_width(p->phy, 8);
 		phy_set_drvdata(p->phy, p);
 	}
diff -ENwbur a/drivers/phy/samsung/phy-samsung-usb2.h b/drivers/phy/samsung/phy-samsung-usb2.h
--- a/drivers/phy/samsung/phy-samsung-usb2.h	2018-05-06 08:47:37.945369136 +0200
+++ b/drivers/phy/samsung/phy-samsung-usb2.h	2018-05-06 08:49:50.826762291 +0200
@@ -70,4 +70,5 @@
 extern const struct samsung_usb2_phy_config exynos4x12_usb2_phy_config;
 extern const struct samsung_usb2_phy_config exynos5250_usb2_phy_config;
 extern const struct samsung_usb2_phy_config s5pv210_usb2_phy_config;
+extern const struct samsung_usb2_phy_config nexell_usb2_phy_config;
 #endif
diff -ENwbur a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
--- a/drivers/pinctrl/Kconfig	2018-05-06 08:47:37.945369136 +0200
+++ b/drivers/pinctrl/Kconfig	2018-05-06 08:49:50.826762291 +0200
@@ -370,6 +370,7 @@
 source "drivers/pinctrl/vt8500/Kconfig"
 source "drivers/pinctrl/mediatek/Kconfig"
 source "drivers/pinctrl/zte/Kconfig"
+source "drivers/pinctrl/nexell/Kconfig"

 config PINCTRL_XWAY
 	bool
diff -ENwbur a/drivers/pinctrl/Makefile b/drivers/pinctrl/Makefile
--- a/drivers/pinctrl/Makefile	2018-05-06 08:47:37.945369136 +0200
+++ b/drivers/pinctrl/Makefile	2018-05-06 08:49:50.826762291 +0200
@@ -66,3 +66,4 @@
 obj-$(CONFIG_ARCH_VT8500)	+= vt8500/
 obj-$(CONFIG_PINCTRL_MTK)	+= mediatek/
 obj-$(CONFIG_PINCTRL_ZX)	+= zte/
+obj-$(CONFIG_PINCTRL_NEXELL)	+= nexell/
diff -ENwbur a/drivers/pinctrl/nexell/Kconfig b/drivers/pinctrl/nexell/Kconfig
--- a/drivers/pinctrl/nexell/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/Kconfig	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,7 @@
+#
+# NEXELL Pin control drivers
+#
+config PINCTRL_NEXELL
+	bool "Nexell SoC pinctrl driver"
+	select PINMUX
+	select PINCONF
diff -ENwbur a/drivers/pinctrl/nexell/Makefile b/drivers/pinctrl/nexell/Makefile
--- a/drivers/pinctrl/nexell/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/Makefile	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,5 @@
+#
+# NEXELL Pin control drivers
+#
+
+obj-$(CONFIG_PINCTRL_NEXELL)		+= pinctrl-s5pxx18.o pinctrl-nexell.o
diff -ENwbur a/drivers/pinctrl/nexell/pinctrl-nexell.c b/drivers/pinctrl/nexell/pinctrl-nexell.c
--- a/drivers/pinctrl/nexell/pinctrl-nexell.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/pinctrl-nexell.c	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,1196 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/irqdomain.h>
+#include <linux/spinlock.h>
+#include <linux/syscore_ops.h>
+#include <linux/of_irq.h>
+
+#include "../core.h"
+#include "s5pxx18-gpio.h"
+#include "pinctrl-nexell.h"
+
+/* list of all possible config options supported */
+static struct pin_config {
+	const char *property;
+	enum pincfg_type param;
+} cfg_params[] = {
+	{"nexell,pin-pull", PINCFG_TYPE_PULL},
+	{"nexell,pin-strength", PINCFG_TYPE_DRV},
+};
+
+/* Global list of devices (struct nexell_pinctrl_drv_data) */
+static LIST_HEAD(drvdata_list);
+
+static unsigned int pin_base;
+
+static inline struct nexell_pin_bank *gc_to_pin_bank(struct gpio_chip *gc)
+{
+	return container_of(gc, struct nexell_pin_bank, gpio_chip);
+}
+
+static int nexell_get_group_count(struct pinctrl_dev *pctldev)
+{
+	struct nexell_pinctrl_drv_data *pmx = pinctrl_dev_get_drvdata(pctldev);
+
+	return pmx->nr_groups;
+}
+
+static const char *nexell_get_group_name(struct pinctrl_dev *pctldev,
+					 unsigned group)
+{
+	struct nexell_pinctrl_drv_data *pmx = pinctrl_dev_get_drvdata(pctldev);
+
+	return pmx->pin_groups[group].name;
+}
+
+static int nexell_get_group_pins(struct pinctrl_dev *pctldev, unsigned group,
+				 const unsigned **pins, unsigned *num_pins)
+{
+	struct nexell_pinctrl_drv_data *pmx = pinctrl_dev_get_drvdata(pctldev);
+
+	*pins = pmx->pin_groups[group].pins;
+	*num_pins = pmx->pin_groups[group].num_pins;
+
+	return 0;
+}
+
+static int reserve_map(struct device *dev, struct pinctrl_map **map,
+		       unsigned *reserved_maps, unsigned *num_maps,
+		       unsigned reserve)
+{
+	unsigned old_num = *reserved_maps;
+	unsigned new_num = *num_maps + reserve;
+	struct pinctrl_map *new_map;
+
+	if (old_num >= new_num)
+		return 0;
+
+	new_map = krealloc(*map, sizeof(*new_map) * new_num, GFP_KERNEL);
+	if (!new_map) {
+		dev_err(dev, "krealloc(map) failed\n");
+		return -ENOMEM;
+	}
+
+	memset(new_map + old_num, 0, (new_num - old_num) * sizeof(*new_map));
+
+	*map = new_map;
+	*reserved_maps = new_num;
+
+	return 0;
+}
+
+static int add_map_mux(struct pinctrl_map **map, unsigned *reserved_maps,
+		       unsigned *num_maps, const char *group,
+		       const char *function)
+{
+	if (WARN_ON(*num_maps == *reserved_maps))
+		return -ENOSPC;
+
+	(*map)[*num_maps].type = PIN_MAP_TYPE_MUX_GROUP;
+	(*map)[*num_maps].data.mux.group = group;
+	(*map)[*num_maps].data.mux.function = function;
+	(*num_maps)++;
+
+	return 0;
+}
+
+static int add_map_configs(struct device *dev, struct pinctrl_map **map,
+			   unsigned *reserved_maps, unsigned *num_maps,
+			   const char *group, unsigned long *configs,
+			   unsigned num_configs)
+{
+	unsigned long *dup_configs;
+
+	if (WARN_ON(*num_maps == *reserved_maps))
+		return -ENOSPC;
+
+	dup_configs =
+	    kmemdup(configs, num_configs * sizeof(*dup_configs), GFP_KERNEL);
+	if (!dup_configs) {
+		dev_err(dev, "kmemdup(configs) failed\n");
+		return -ENOMEM;
+	}
+
+	(*map)[*num_maps].type = PIN_MAP_TYPE_CONFIGS_GROUP;
+	(*map)[*num_maps].data.configs.group_or_pin = group;
+	(*map)[*num_maps].data.configs.configs = dup_configs;
+	(*map)[*num_maps].data.configs.num_configs = num_configs;
+	(*num_maps)++;
+
+	return 0;
+}
+
+static int add_config(struct device *dev, unsigned long **configs,
+		      unsigned *num_configs, unsigned long config)
+{
+	unsigned old_num = *num_configs;
+	unsigned new_num = old_num + 1;
+	unsigned long *new_configs;
+
+	new_configs =
+	    krealloc(*configs, sizeof(*new_configs) * new_num, GFP_KERNEL);
+	if (!new_configs) {
+		dev_err(dev, "krealloc(configs) failed\n");
+		return -ENOMEM;
+	}
+
+	new_configs[old_num] = config;
+
+	*configs = new_configs;
+	*num_configs = new_num;
+
+	return 0;
+}
+
+static void nexell_dt_free_map(struct pinctrl_dev *pctldev,
+			       struct pinctrl_map *map, unsigned num_maps)
+{
+	int i;
+
+	for (i = 0; i < num_maps; i++)
+		if (map[i].type == PIN_MAP_TYPE_CONFIGS_GROUP)
+			kfree(map[i].data.configs.configs);
+
+	kfree(map);
+}
+
+static int nexell_dt_subnode_to_map(struct nexell_pinctrl_drv_data *drvdata,
+				    struct device *dev, struct device_node *np,
+				    struct pinctrl_map **map,
+				    unsigned *reserved_maps, unsigned *num_maps)
+{
+	int ret, i;
+	u32 val;
+	unsigned long config;
+	unsigned long *configs = NULL;
+	unsigned num_configs = 0;
+	unsigned reserve;
+	struct property *prop;
+	const char *group;
+	bool has_func = false;
+
+	ret = of_property_read_u32(np, "nexell,pin-function", &val);
+	if (!ret)
+		has_func = true;
+
+	for (i = 0; i < ARRAY_SIZE(cfg_params); i++) {
+		ret = of_property_read_u32(np, cfg_params[i].property, &val);
+		if (!ret) {
+			config = PINCFG_PACK(cfg_params[i].param, val);
+			ret = add_config(dev, &configs, &num_configs, config);
+			if (ret < 0)
+				goto exit;
+			/* EINVAL=missing, which is fine since it's optional */
+		} else if (ret != -EINVAL) {
+			dev_err(dev, "could not parse property %s\n",
+				cfg_params[i].property);
+		}
+	}
+
+	reserve = 0;
+	if (has_func)
+		reserve++;
+	if (num_configs)
+		reserve++;
+	ret = of_property_count_strings(np, "nexell,pins");
+	if (ret < 0) {
+		dev_err(dev, "could not parse property nexell,pins\n");
+		goto exit;
+	}
+	reserve *= ret;
+
+	ret = reserve_map(dev, map, reserved_maps, num_maps, reserve);
+	if (ret < 0)
+		goto exit;
+
+	of_property_for_each_string(np, "nexell,pins", prop, group) {
+		if (has_func) {
+			ret = add_map_mux(map, reserved_maps, num_maps, group,
+					  np->full_name);
+			if (ret < 0)
+				goto exit;
+		}
+
+		if (num_configs) {
+			ret = add_map_configs(dev, map, reserved_maps, num_maps,
+					      group, configs, num_configs);
+			if (ret < 0)
+				goto exit;
+		}
+	}
+
+	ret = 0;
+
+exit:
+	kfree(configs);
+	return ret;
+}
+
+static int nexell_dt_node_to_map(struct pinctrl_dev *pctldev,
+				 struct device_node *np_config,
+				 struct pinctrl_map **map, unsigned *num_maps)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+	unsigned reserved_maps;
+	struct device_node *np;
+	int ret;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+
+	reserved_maps = 0;
+	*map = NULL;
+	*num_maps = 0;
+
+	if (!of_get_child_count(np_config))
+		return nexell_dt_subnode_to_map(drvdata, pctldev->dev,
+						np_config, map, &reserved_maps,
+						num_maps);
+
+	for_each_child_of_node(np_config, np) {
+		ret = nexell_dt_subnode_to_map(drvdata, pctldev->dev, np, map,
+					       &reserved_maps, num_maps);
+		if (ret < 0) {
+			nexell_dt_free_map(pctldev, *map, *num_maps);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+/* list of pinctrl callbacks for the pinctrl core */
+static const struct pinctrl_ops nexell_pctrl_ops = {
+	.get_groups_count = nexell_get_group_count,
+	.get_group_name = nexell_get_group_name,
+	.get_group_pins = nexell_get_group_pins,
+	.dt_node_to_map = nexell_dt_node_to_map,
+	.dt_free_map = nexell_dt_free_map,
+};
+
+/* check if the selector is a valid pin function selector */
+static int nexell_get_functions_count(struct pinctrl_dev *pctldev)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	return drvdata->nr_functions;
+}
+
+/* return the name of the pin function specified */
+static const char *nexell_pinmux_get_fname(struct pinctrl_dev *pctldev,
+					   unsigned selector)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	return drvdata->pmx_functions[selector].name;
+}
+
+/* return the groups associated for the specified function selector */
+static int nexell_pinmux_get_groups(struct pinctrl_dev *pctldev,
+				    unsigned selector,
+				    const char *const **groups,
+				    unsigned *const num_groups)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	*groups = drvdata->pmx_functions[selector].groups;
+	*num_groups = drvdata->pmx_functions[selector].num_groups;
+	return 0;
+}
+
+/*
+ * given a pin number that is local to a pin controller, find out the pin bank
+ * and the register base of the pin bank.
+ */
+static void pin_to_reg_bank(struct nexell_pinctrl_drv_data *drvdata,
+			    unsigned pin, void __iomem **reg, u32 *offset,
+			    struct nexell_pin_bank **bank)
+{
+	struct nexell_pin_bank *b;
+
+	b = drvdata->ctrl->pin_banks;
+
+	while ((pin >= b->pin_base) && ((b->pin_base + b->nr_pins - 1) < pin))
+		b++;
+
+	*reg = b->virt_base;
+	*offset = pin - b->pin_base;
+	if (bank)
+		*bank = b;
+}
+
+/* enable or disable a pinmux function */
+static void nexell_pinmux_setup(struct pinctrl_dev *pctldev, unsigned selector,
+				unsigned group, bool enable)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+	const struct nexell_pmx_func *func;
+	const struct nexell_pin_group *grp;
+	int io;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	func = &drvdata->pmx_functions[selector];
+	grp = &drvdata->pin_groups[group];
+
+	io = grp->pins[0];
+	nx_soc_gpio_set_io_func(io, func->val);
+}
+
+/* enable a specified pinmux by writing to registers */
+static int nexell_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
+				 unsigned group)
+{
+	nexell_pinmux_setup(pctldev, selector, group, true);
+	return 0;
+}
+
+/* list of pinmux callbacks for the pinmux vertical in pinctrl core */
+static const struct pinmux_ops nexell_pinmux_ops = {
+	.get_functions_count = nexell_get_functions_count,
+	.get_function_name = nexell_pinmux_get_fname,
+	.get_function_groups = nexell_pinmux_get_groups,
+	.set_mux = nexell_pinmux_set_mux,
+};
+
+/* set or get the pin config settings for a specified pin */
+static int nexell_soc_write_pin(unsigned int io,
+				enum pincfg_type cfg_type,
+				u32 data)
+{
+	if (cfg_type >= PINCFG_TYPE_NUM)
+		return -EINVAL;
+
+	switch (cfg_type) {
+	case PINCFG_TYPE_DAT:
+		nx_soc_gpio_set_out_value(io, data);
+		break;
+	case PINCFG_TYPE_PULL:
+		nx_soc_gpio_set_io_pull(io, data);
+		break;
+	case PINCFG_TYPE_DRV:
+		nx_soc_gpio_set_io_drv(io, data);
+		break;
+	case PINCFG_TYPE_FUNC:
+		nx_soc_gpio_set_io_func(io, data);
+		break;
+	case PINCFG_TYPE_DIR:
+		nx_soc_gpio_set_io_dir(io, data);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int nexell_soc_read_pin(unsigned int io,
+			       enum pincfg_type cfg_type,
+			       u32 *data)
+{
+	if (cfg_type >= PINCFG_TYPE_NUM)
+		return -EINVAL;
+
+	switch (cfg_type) {
+	case PINCFG_TYPE_DAT:
+		*data = nx_soc_gpio_get_in_value(io);
+		break;
+	case PINCFG_TYPE_PULL:
+		*data = nx_soc_gpio_get_io_pull(io);
+		break;
+	case PINCFG_TYPE_DRV:
+		*data = nx_soc_gpio_get_io_drv(io);
+		break;
+	case PINCFG_TYPE_DIR:
+		*data = nx_soc_gpio_get_io_dir(io);
+		break;
+	case PINCFG_TYPE_FUNC:
+		*data = nx_soc_gpio_get_io_func(io);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static int nexell_pinconf_rw(struct pinctrl_dev *pctldev, unsigned int pin,
+			     unsigned long *config, bool set)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+	struct nexell_pin_bank *bank;
+	void __iomem *reg_base;
+	enum pincfg_type cfg_type = PINCFG_UNPACK_TYPE(*config);
+	u32 pin_offset;
+	u32 cfg_value;
+	int io;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	pin_to_reg_bank(drvdata, pin - drvdata->ctrl->base, &reg_base,
+			&pin_offset, &bank);
+
+	io = bank->grange.pin_base + pin_offset;
+
+	if (cfg_type >= PINCFG_TYPE_NUM)
+		return -EINVAL;
+
+	if (set) {
+		cfg_value = PINCFG_UNPACK_VALUE(*config);
+		nexell_soc_write_pin(io, cfg_type, cfg_value);
+	} else {
+		nexell_soc_read_pin(io, cfg_type, &cfg_value);
+		*config = PINCFG_PACK(cfg_type, cfg_value);
+	}
+
+	return 0;
+}
+
+/* set the pin config settings for a specified pin */
+static int nexell_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+			      unsigned long *configs, unsigned num_configs)
+{
+	int i, ret;
+
+	for (i = 0; i < num_configs; i++) {
+		ret = nexell_pinconf_rw(pctldev, pin, &configs[i], true);
+		if (ret < 0)
+			return ret;
+	} /* for each config */
+
+	return 0;
+}
+
+/* get the pin config settings for a specified pin */
+static int nexell_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin,
+			      unsigned long *config)
+{
+	return nexell_pinconf_rw(pctldev, pin, config, false);
+}
+
+/* set the pin config settings for a specified pin group */
+static int nexell_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
+				    unsigned long *configs,
+				    unsigned num_configs)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+	const unsigned int *pins;
+	unsigned int cnt;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	pins = drvdata->pin_groups[group].pins;
+
+	for (cnt = 0; cnt < drvdata->pin_groups[group].num_pins; cnt++)
+		nexell_pinconf_set(pctldev, pins[cnt], configs, num_configs);
+
+	return 0;
+}
+
+/* get the pin config settings for a specified pin group */
+static int nexell_pinconf_group_get(struct pinctrl_dev *pctldev,
+				    unsigned int group, unsigned long *config)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+	const unsigned int *pins;
+
+	drvdata = pinctrl_dev_get_drvdata(pctldev);
+	pins = drvdata->pin_groups[group].pins;
+	nexell_pinconf_get(pctldev, pins[0], config);
+	return 0;
+}
+
+/* list of pinconfig callbacks for pinconfig vertical in the pinctrl code */
+static const struct pinconf_ops nexell_pinconf_ops = {
+	.pin_config_get = nexell_pinconf_get,
+	.pin_config_set = nexell_pinconf_set,
+	.pin_config_group_get = nexell_pinconf_group_get,
+	.pin_config_group_set = nexell_pinconf_group_set,
+};
+
+/* gpiolib gpio_set callback function */
+static void nx_gpio_set(struct gpio_chip *gc, unsigned offset, int value)
+{
+	struct nexell_pin_bank *bank = gc_to_pin_bank(gc);
+	int io;
+
+	io = bank->grange.pin_base + offset;
+	nx_soc_gpio_set_out_value(io, value);
+}
+
+/* gpiolib gpio_get callback function */
+static int nx_gpio_get(struct gpio_chip *gc, unsigned offset)
+{
+	u32 data;
+	struct nexell_pin_bank *bank = gc_to_pin_bank(gc);
+	int io;
+
+	io = bank->grange.pin_base + offset;
+	data = nx_soc_gpio_get_in_value(io);
+
+	return data;
+}
+
+/*
+ * The calls to gpio_direction_output() and gpio_direction_input()
+ * leads to this function call.
+ */
+static int nx_gpio_set_direction(struct gpio_chip *gc, unsigned offset,
+				 bool input)
+{
+	struct nexell_pin_bank *bank;
+	struct nexell_pinctrl_drv_data *drvdata;
+	int io;
+	int fn;
+
+	bank = gc_to_pin_bank(gc);
+	drvdata = bank->drvdata;
+
+	io = bank->grange.pin_base + offset;
+	fn = nx_soc_gpio_get_altnum(io);
+
+	/*nx_soc_gpio_set_io_func(io, fn);*/
+	nx_soc_gpio_set_io_dir(io, input ? 0 : 1);
+
+	return 0;
+}
+
+/* gpiolib gpio_direction_input callback function. */
+static int nx_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
+{
+	return nx_gpio_set_direction(gc, offset, true);
+}
+
+/* gpiolib gpio_direction_output callback function. */
+static int nx_gpio_direction_output(struct gpio_chip *gc, unsigned offset,
+				    int value)
+{
+	nx_gpio_set(gc, offset, value);
+	return nx_gpio_set_direction(gc, offset, false);
+}
+
+/*
+ * gpiolib gpio_to_irq callback function. Creates a mapping between a GPIO pin
+ * and a virtual IRQ, if not already present.
+ */
+static int nx_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
+{
+	struct nexell_pin_bank *bank = gc_to_pin_bank(gc);
+	unsigned int virq;
+
+	if (!bank->irq_domain)
+		return -ENXIO;
+
+	virq = irq_create_mapping(bank->irq_domain, offset);
+
+	return (virq) ?: -ENXIO;
+}
+
+static struct nexell_pin_group *
+nexell_pinctrl_create_groups(struct device *dev,
+			     struct nexell_pinctrl_drv_data *drvdata,
+			     unsigned int *cnt)
+{
+	struct pinctrl_desc *ctrldesc = &drvdata->pctl;
+	struct nexell_pin_group *groups, *grp;
+	const struct pinctrl_pin_desc *pdesc;
+	int i;
+
+	groups =
+	    devm_kzalloc(dev, ctrldesc->npins * sizeof(*groups), GFP_KERNEL);
+	if (!groups)
+		return ERR_PTR(-EINVAL);
+	grp = groups;
+
+	pdesc = ctrldesc->pins;
+	for (i = 0; i < ctrldesc->npins; ++i, ++pdesc, ++grp) {
+		grp->name = pdesc->name;
+		grp->pins = &pdesc->number;
+		grp->num_pins = 1;
+	}
+
+	*cnt = ctrldesc->npins;
+	return groups;
+}
+
+static int nexell_pinctrl_create_function(struct device *dev,
+				struct nexell_pinctrl_drv_data *drvdata,
+				struct device_node *func_np,
+				struct nexell_pmx_func *func)
+{
+	int npins;
+	int ret;
+	int i;
+
+	if (of_property_read_u32(func_np, "nexell,pin-function", &func->val))
+		return 0;
+
+	npins = of_property_count_strings(func_np, "nexell,pins");
+	if (npins < 1) {
+		dev_err(dev, "invalid pin list in %s node", func_np->name);
+		return -EINVAL;
+	}
+
+	func->name = func_np->full_name;
+
+	func->groups = devm_kzalloc(dev, npins * sizeof(char *), GFP_KERNEL);
+	if (!func->groups)
+		return -ENOMEM;
+
+	for (i = 0; i < npins; ++i) {
+		const char *gname;
+
+		ret = of_property_read_string_index(func_np, "nexell,pins", i,
+						    &gname);
+		if (ret) {
+			dev_err(dev,
+				"failed to read pin name %d from %s node\n", i,
+				func_np->name);
+			return ret;
+		}
+
+		func->groups[i] = gname;
+	}
+
+	func->num_groups = npins;
+	return 1;
+}
+
+static struct nexell_pmx_func *
+nexell_pinctrl_create_functions(struct device *dev,
+				struct nexell_pinctrl_drv_data *drvdata,
+				unsigned int *cnt)
+{
+	struct nexell_pmx_func *functions, *func;
+	struct device_node *dev_np = dev->of_node;
+	struct device_node *cfg_np;
+	unsigned int func_cnt = 0;
+	int ret;
+
+	/*
+	 * Iterate over all the child nodes of the pin controller node
+	 * and create pin groups and pin function lists.
+	 */
+	for_each_child_of_node(dev_np, cfg_np) {
+		struct device_node *func_np;
+
+		if (!of_get_child_count(cfg_np)) {
+			if (!of_find_property(cfg_np, "nexell,pin-function",
+					      NULL))
+				continue;
+			++func_cnt;
+			continue;
+		}
+
+		for_each_child_of_node(cfg_np, func_np) {
+			if (!of_find_property(func_np, "nexell,pin-function",
+					      NULL))
+				continue;
+			++func_cnt;
+		}
+	}
+
+	functions =
+	    devm_kzalloc(dev, func_cnt * sizeof(*functions), GFP_KERNEL);
+	if (!functions) {
+		dev_err(dev, "failed to allocate memory for function list\n");
+		return ERR_PTR(-EINVAL);
+	}
+	func = functions;
+
+	/*
+	 * Iterate over all the child nodes of the pin controller node
+	 * and create pin groups and pin function lists.
+	 */
+	func_cnt = 0;
+	for_each_child_of_node(dev_np, cfg_np) {
+		struct device_node *func_np;
+
+		if (!of_get_child_count(cfg_np)) {
+			ret = nexell_pinctrl_create_function(dev, drvdata,
+							     cfg_np, func);
+			if (ret < 0)
+				return ERR_PTR(ret);
+			if (ret > 0) {
+				++func;
+				++func_cnt;
+			}
+			continue;
+		}
+
+		for_each_child_of_node(cfg_np, func_np) {
+			ret = nexell_pinctrl_create_function(dev, drvdata,
+							     func_np, func);
+			if (ret < 0)
+				return ERR_PTR(ret);
+			if (ret > 0) {
+				++func;
+				++func_cnt;
+			}
+		}
+	}
+
+	*cnt = func_cnt;
+	return functions;
+}
+
+/*
+ * Parse the information about all the available pin groups and pin functions
+ * from device node of the pin-controller. A pin group is formed with all
+ * the pins listed in the "nexell,pins" property.
+ */
+static int nexell_pinctrl_parse_dt(struct platform_device *pdev,
+				   struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct device *dev = &pdev->dev;
+	struct nexell_pin_group *groups;
+	struct nexell_pmx_func *functions;
+	unsigned int grp_cnt = 0, func_cnt = 0;
+
+	groups = nexell_pinctrl_create_groups(dev, drvdata, &grp_cnt);
+	if (IS_ERR(groups)) {
+		dev_err(dev, "failed to parse pin groups\n");
+		return PTR_ERR(groups);
+	}
+
+	functions = nexell_pinctrl_create_functions(dev, drvdata, &func_cnt);
+	if (IS_ERR(functions)) {
+		dev_err(dev, "failed to parse pin functions\n");
+		return PTR_ERR(groups);
+	}
+
+	drvdata->pin_groups = groups;
+	drvdata->nr_groups = grp_cnt;
+	drvdata->pmx_functions = functions;
+	drvdata->nr_functions = func_cnt;
+
+	return 0;
+}
+
+/* register the pinctrl interface with the pinctrl subsystem */
+static int nexell_pinctrl_register(struct platform_device *pdev,
+				   struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct pinctrl_desc *ctrldesc = &drvdata->pctl;
+	struct pinctrl_pin_desc *pindesc, *pdesc;
+	struct nexell_pin_bank *pin_bank;
+	char *pin_names;
+	int pin, bank, ret;
+
+	ctrldesc->name = "nexell-pinctrl";
+	ctrldesc->owner = THIS_MODULE;
+	ctrldesc->pctlops = &nexell_pctrl_ops;
+	ctrldesc->pmxops = &nexell_pinmux_ops;
+	ctrldesc->confops = &nexell_pinconf_ops;
+
+	pindesc = devm_kzalloc(
+	    &pdev->dev, sizeof(*pindesc) * drvdata->ctrl->nr_pins, GFP_KERNEL);
+	if (!pindesc)
+		return -ENOMEM;
+	ctrldesc->pins = pindesc;
+	ctrldesc->npins = drvdata->ctrl->nr_pins;
+
+	/* dynamically populate the pin number and pin name for pindesc */
+	for (pin = 0, pdesc = pindesc; pin < ctrldesc->npins; pin++, pdesc++)
+		pdesc->number = pin + drvdata->ctrl->base;
+
+	/*
+	 * allocate space for storing the dynamically generated names for all
+	 * the pins which belong to this pin-controller.
+	 */
+	pin_names = devm_kzalloc(&pdev->dev, sizeof(char) * PIN_NAME_LENGTH *
+						 drvdata->ctrl->nr_pins,
+				 GFP_KERNEL);
+	if (!pin_names) {
+		dev_err(&pdev->dev, "mem alloc for pin names failed\n");
+		return -ENOMEM;
+	}
+
+	/* for each pin, the name of the pin is pin-bank name + pin number */
+	for (bank = 0; bank < drvdata->ctrl->nr_banks; bank++) {
+		pin_bank = &drvdata->ctrl->pin_banks[bank];
+		for (pin = 0; pin < pin_bank->nr_pins; pin++) {
+			sprintf(pin_names, "%s-%d", pin_bank->name, pin);
+			pdesc = pindesc + pin_bank->pin_base + pin;
+			pdesc->name = pin_names;
+			pin_names += PIN_NAME_LENGTH;
+		}
+	}
+
+	ret = nexell_pinctrl_parse_dt(pdev, drvdata);
+	if (ret)
+		return ret;
+
+	drvdata->pctl_dev = pinctrl_register(ctrldesc, &pdev->dev, drvdata);
+	if (!drvdata->pctl_dev) {
+		dev_err(&pdev->dev, "could not register pinctrl driver\n");
+		return -EINVAL;
+	}
+
+	for (bank = 0; bank < drvdata->ctrl->nr_banks; ++bank) {
+		pin_bank = &drvdata->ctrl->pin_banks[bank];
+		pin_bank->grange.name = pin_bank->name;
+		pin_bank->grange.id = bank;
+		pin_bank->grange.pin_base =
+		    drvdata->ctrl->base + pin_bank->pin_base;
+		pin_bank->grange.base = pin_bank->gpio_chip.base;
+		pin_bank->grange.npins = pin_bank->gpio_chip.ngpio;
+		pin_bank->grange.gc = &pin_bank->gpio_chip;
+		pinctrl_add_gpio_range(drvdata->pctl_dev, &pin_bank->grange);
+	}
+
+	return 0;
+}
+
+static int nx_gpio_request(struct gpio_chip *gc, unsigned offset)
+{
+	struct nexell_pin_bank *bank;
+	struct nexell_pinctrl_drv_data *drvdata;
+
+	int io;
+	int fn;
+
+	bank = gc_to_pin_bank(gc);
+	drvdata = bank->drvdata;
+
+	io = bank->grange.pin_base + offset;
+	fn = nx_soc_gpio_get_altnum(io);
+
+	nx_soc_gpio_set_io_func(io, fn);
+
+	return pinctrl_request_gpio(gc->base + offset);
+}
+
+static void nx_gpio_free(struct gpio_chip *gc, unsigned offset)
+{
+	pinctrl_free_gpio(gc->base + offset);
+}
+
+static const struct gpio_chip nexell_gpiolib_chip = {
+	.request = nx_gpio_request,
+	.free = nx_gpio_free,
+	.set = nx_gpio_set,
+	.get = nx_gpio_get,
+	.direction_input = nx_gpio_direction_input,
+	.direction_output = nx_gpio_direction_output,
+	.to_irq = nx_gpio_to_irq,
+	.owner = THIS_MODULE,
+};
+
+/* register the gpiolib interface with the gpiolib subsystem */
+static int nexell_gpiolib_register(struct platform_device *pdev,
+				   struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+	struct nexell_pin_bank *bank = ctrl->pin_banks;
+	struct gpio_chip *gc;
+	int ret;
+	int i;
+
+	pr_debug("gpiolib register ctr: %p, nr banks: %d\n", ctrl,
+		 ctrl->nr_banks);
+
+	for (i = 0; i < ctrl->nr_banks; ++i, ++bank) {
+		bank->gpio_chip = nexell_gpiolib_chip;
+
+		gc = &bank->gpio_chip;
+		gc->base = ctrl->base + bank->pin_base;
+		gc->ngpio = bank->nr_pins;
+		gc->parent = &pdev->dev;
+		gc->of_node = bank->of_node;
+		gc->label = bank->name;
+
+		ret = gpiochip_add(gc);
+		if (ret) {
+			dev_err(
+			    &pdev->dev,
+			    "failed to register gpio_chip %s, error code: %d\n",
+			    gc->label, ret);
+			goto fail;
+		}
+	}
+
+	return 0;
+
+fail:
+	for (--i, --bank; i >= 0; --i, --bank)
+		gpiochip_remove(&bank->gpio_chip);
+	return ret;
+}
+
+/* unregister the gpiolib interface with the gpiolib subsystem */
+static int nexell_gpiolib_unregister(struct platform_device *pdev,
+				     struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+	struct nexell_pin_bank *bank = ctrl->pin_banks;
+	int i;
+
+	for (i = 0; i < ctrl->nr_banks; ++i, ++bank)
+		gpiochip_remove(&bank->gpio_chip);
+	return 0;
+}
+
+static const struct of_device_id nexell_pinctrl_dt_match[];
+
+/* retrieve the soc specific data */
+static struct nexell_pin_ctrl *
+nexell_pinctrl_get_soc_data(struct nexell_pinctrl_drv_data *d,
+			    struct platform_device *pdev)
+{
+	int id;
+	const struct of_device_id *match;
+	struct device_node *node = pdev->dev.of_node;
+	struct device_node *np;
+	struct nexell_pin_ctrl *ctrl;
+	struct nexell_pin_bank *bank;
+	int i;
+
+	id = of_alias_get_id(node, "pinctrl");
+	if (id < 0) {
+		dev_err(&pdev->dev, "failed to get alias id\n");
+		return NULL;
+	}
+	match = of_match_node(nexell_pinctrl_dt_match, node);
+	ctrl = (struct nexell_pin_ctrl *)match->data + id;
+
+	bank = ctrl->pin_banks;
+	for (i = 0; i < ctrl->nr_banks; ++i, ++bank) {
+		spin_lock_init(&bank->slock);
+		bank->drvdata = d;
+		bank->pin_base = ctrl->nr_pins;
+		ctrl->nr_pins += bank->nr_pins;
+	}
+
+	for_each_child_of_node(node, np) {
+		if (!of_find_property(np, "gpio-controller", NULL))
+			continue;
+		bank = ctrl->pin_banks;
+		for (i = 0; i < ctrl->nr_banks; ++i, ++bank) {
+			if (!strcmp(bank->name, np->name)) {
+				bank->of_node = np;
+				break;
+			}
+		}
+	}
+
+	ctrl->base = pin_base;
+	pin_base += ctrl->nr_pins;
+
+	return ctrl;
+}
+
+static int nexell_pinctrl_probe(struct platform_device *pdev)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+	struct device *dev = &pdev->dev;
+	struct nexell_pin_ctrl *ctrl;
+	struct resource *res;
+	int irq;
+	int ret;
+	int i;
+
+	if (!dev->of_node) {
+		dev_err(dev, "device tree node not found\n");
+		return -ENODEV;
+	}
+
+	drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL);
+	if (!drvdata)
+		return -ENOMEM;
+
+	ctrl = nexell_pinctrl_get_soc_data(drvdata, pdev);
+	if (!ctrl) {
+		dev_err(&pdev->dev, "driver data not available\n");
+		return -EINVAL;
+	}
+	drvdata->ctrl = ctrl;
+	drvdata->dev = dev;
+
+	for (i = 0;; i++) {
+		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+		if (!res)
+			break;
+	}
+	if (i != ctrl->nr_banks) {
+		dev_err(&pdev->dev, "bank count mismatch\n");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ctrl->nr_banks; i++) {
+		struct nexell_pin_bank *bank = &ctrl->pin_banks[i];
+
+		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+		bank->virt_base = devm_ioremap_resource(&pdev->dev, res);
+		if (IS_ERR(bank->virt_base))
+			return PTR_ERR(bank->virt_base);
+	}
+
+	for (i = 0; i < ctrl->nr_banks; i++) {
+		struct nexell_pin_bank *bank = &ctrl->pin_banks[i];
+
+		if (bank->eint_type == EINT_TYPE_NONE)
+			continue;
+
+		irq = irq_of_parse_and_map(dev->of_node, i);
+		if (irq <= 0) {
+			dev_err(dev, "irq parsing failed\n");
+			return -EINVAL;
+		}
+
+		bank->irq = irq;
+	}
+
+	ret = nexell_gpiolib_register(pdev, drvdata);
+	if (ret)
+		return ret;
+
+	ret = nexell_pinctrl_register(pdev, drvdata);
+	if (ret) {
+		nexell_gpiolib_unregister(pdev, drvdata);
+		return ret;
+	}
+
+	if (ctrl->base_init)
+		ctrl->base_init(drvdata);
+	if (ctrl->gpio_irq_init)
+		ctrl->gpio_irq_init(drvdata);
+	if (ctrl->alive_irq_init)
+		ctrl->alive_irq_init(drvdata);
+
+	platform_set_drvdata(pdev, drvdata);
+
+	/* Add to the global list */
+	list_add_tail(&drvdata->node, &drvdata_list);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+
+/**
+ * nexell_pinctrl_suspend_dev - save pinctrl state for suspend for a device
+ *
+ * Save data for all banks handled by this device.
+ */
+static void nexell_pinctrl_suspend_dev(
+	struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+
+	if (ctrl->suspend)
+		ctrl->suspend(drvdata);
+}
+
+/**
+ * nexell_pinctrl_resume_dev - restore pinctrl state from suspend for a device
+ *
+ * Restore one of the banks that was saved during suspend.
+ *
+ * We don't bother doing anything complicated to avoid glitching lines since
+ * we're called before pad retention is turned off.
+ */
+static void nexell_pinctrl_resume_dev(struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+
+	if (ctrl->resume)
+		ctrl->resume(drvdata);
+}
+
+/**
+ * nexell_pinctrl_suspend - save pinctrl state for suspend
+ *
+ * Save data for all banks across all devices.
+ */
+static int nexell_pinctrl_suspend(void)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+
+	list_for_each_entry(drvdata, &drvdata_list, node) {
+		nexell_pinctrl_suspend_dev(drvdata);
+	}
+
+	return 0;
+}
+
+/**
+ * nexell_pinctrl_resume - restore pinctrl state for suspend
+ *
+ * Restore data for all banks across all devices.
+ */
+static void nexell_pinctrl_resume(void)
+{
+	struct nexell_pinctrl_drv_data *drvdata;
+
+	list_for_each_entry_reverse(drvdata, &drvdata_list, node) {
+		nexell_pinctrl_resume_dev(drvdata);
+	}
+}
+
+#else
+#define nexell_pinctrl_suspend		NULL
+#define nexell_pinctrl_resume		NULL
+#endif
+
+static struct syscore_ops nexell_pinctrl_syscore_ops = {
+	.suspend	= nexell_pinctrl_suspend,
+	.resume		= nexell_pinctrl_resume,
+};
+
+static const struct of_device_id nexell_pinctrl_dt_match[] = {
+	{ .compatible = "nexell,s5p6818-pinctrl",
+		.data = (void *)s5pxx18_pin_ctrl },
+	{ .compatible = "nexell,s5pxx18-pinctrl",
+		.data = (void *)s5pxx18_pin_ctrl },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nexell_pinctrl_dt_match);
+
+static struct platform_driver nexell_pinctrl_driver = {
+	.probe = nexell_pinctrl_probe,
+	.driver = {
+		.name = "nexell-pinctrl",
+		.owner = THIS_MODULE,
+		.of_match_table = nexell_pinctrl_dt_match,
+	},
+};
+
+static int __init nexell_pinctrl_drv_register(void)
+{
+	register_syscore_ops(&nexell_pinctrl_syscore_ops);
+
+	return platform_driver_register(&nexell_pinctrl_driver);
+}
+postcore_initcall(nexell_pinctrl_drv_register);
+
+static void __exit nexell_pinctrl_drv_unregister(void)
+{
+	platform_driver_unregister(&nexell_pinctrl_driver);
+}
+module_exit(nexell_pinctrl_drv_unregister);
+
+MODULE_AUTHOR("Bon-gyu, KOO <freestyle@nexell.co.kr>");
+MODULE_DESCRIPTION("Nexell pinctrl driver");
+MODULE_LICENSE("GPL v2");
diff -ENwbur a/drivers/pinctrl/nexell/pinctrl-nexell.h b/drivers/pinctrl/nexell/pinctrl-nexell.h
--- a/drivers/pinctrl/nexell/pinctrl-nexell.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/pinctrl-nexell.h	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __PINCTRL_NEXELL_H
+#define __PINCTRL_NEXELL_H
+
+#include <linux/pinctrl/pinctrl.h>
+#include <linux/pinctrl/pinmux.h>
+#include <linux/pinctrl/pinconf.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/pinctrl/machine.h>
+
+#include <linux/gpio.h>
+
+/**
+ * enum pincfg_type - possible pin configuration types supported.
+ * @PINCFG_TYPE_FUNC: Function configuration.
+ * @PINCFG_TYPE_DAT: Pin value configuration.
+ * @PINCFG_TYPE_PULL: Pull up/down configuration.
+ * @PINCFG_TYPE_DRV: Drive strength configuration.
+ * @PINCFG_TYPE_DIR: pin direction for GPIO mode.
+ */
+enum pincfg_type {
+	PINCFG_TYPE_FUNC,
+	PINCFG_TYPE_DAT,
+	PINCFG_TYPE_PULL,
+	PINCFG_TYPE_DRV,
+	PINCFG_TYPE_DIR,
+
+	PINCFG_TYPE_NUM
+};
+
+/*
+ * pin configuration (pull up/down and drive strength) type and its value are
+ * packed together into a 16-bits. The upper 8-bits represent the configuration
+ * type and the lower 8-bits hold the value of the configuration type.
+ */
+#define PINCFG_TYPE_MASK		0xFF
+#define PINCFG_VALUE_SHIFT		8
+#define PINCFG_VALUE_MASK		(0xFF << PINCFG_VALUE_SHIFT)
+#define PINCFG_PACK(type, value)	(((value) << PINCFG_VALUE_SHIFT) | type)
+#define PINCFG_UNPACK_TYPE(cfg)		((cfg) & PINCFG_TYPE_MASK)
+#define PINCFG_UNPACK_VALUE(cfg)	(((cfg) & PINCFG_VALUE_MASK) >> \
+						PINCFG_VALUE_SHIFT)
+/**
+ * enum eint_type - possible external interrupt types.
+ * @EINT_TYPE_NONE: bank does not support external interrupts
+ * @EINT_TYPE_GPIO: bank supportes external gpio interrupts
+ * @EINT_TYPE_WKUP: bank supportes external wakeup interrupts
+ *
+ * GPIO controller groups all the available pins into banks. The pins
+ * in a pin bank can support external gpio interrupts or external wakeup
+ * interrupts or no interrupts at all. From a software perspective, the only
+ * difference between external gpio and external wakeup interrupts is that
+ * the wakeup interrupts can additionally wakeup the system if it is in
+ * suspended state.
+ */
+enum eint_type {
+	EINT_TYPE_NONE,
+	EINT_TYPE_GPIO,
+	EINT_TYPE_WKUP,
+};
+
+/* maximum length of a pin in pin descriptor (example: "gpioa-30") */
+#define PIN_NAME_LENGTH	10
+
+#define PIN_GROUP(n, p, f)				\
+	{						\
+		.name		= n,			\
+		.pins		= p,			\
+		.num_pins	= ARRAY_SIZE(p),	\
+		.func		= f			\
+	}
+
+#define PMX_FUNC(n, g)					\
+	{						\
+		.name		= n,			\
+		.groups		= g,			\
+		.num_groups	= ARRAY_SIZE(g),	\
+	}
+
+struct nexell_pinctrl_drv_data;
+
+/**
+ * struct nexell_pin_bank: represent a controller pin-bank.
+ * @pctl_offset: starting offset of the pin-bank registers.
+ * @pin_base: starting pin number of the bank.
+ * @nr_pins: number of pins included in this bank.
+ * @eint_func: function to set in CON register to configure pin as EINT.
+ * @eint_type: type of the external interrupt supported by the bank.
+ * @eint_mask: bit mask of pins which support EINT function.
+ * @name: name to be prefixed for each pin in this pin bank.
+ * @of_node: OF node of the bank.
+ * @drvdata: link to controller driver data
+ * @irq_domain: IRQ domain of the bank.
+ * @gpio_chip: GPIO chip of the bank.
+ * @grange: linux gpio pin range supported by this bank.
+ * @slock: spinlock protecting bank registers
+ */
+struct nexell_pin_bank {
+	u32		pctl_offset;
+	u32		pin_base;
+	u8		nr_pins;
+	u8		eint_func;
+	enum eint_type	eint_type;
+	u32		eint_mask;
+	void __iomem	*virt_base;
+	char		*name;
+	void		*soc_priv;
+	int		irq;
+	struct device_node *of_node;
+	struct nexell_pinctrl_drv_data *drvdata;
+	struct irq_domain *irq_domain;
+	struct gpio_chip gpio_chip;
+	struct pinctrl_gpio_range grange;
+	struct nexell_irq_chip *irq_chip;
+	spinlock_t slock;
+};
+
+/**
+ * struct nexell_pin_ctrl: represent a pin controller.
+ * @pin_banks: list of pin banks included in this controller.
+ * @nr_banks: number of pin banks.
+ * @base: starting system wide pin number.
+ * @nr_pins: number of pins supported by the controller.
+ * @eint_gpio_init: platform specific callback to setup the external gpio
+ *	interrupts for the controller.
+ * @eint_alive_init: platform specific callback to setup the external wakeup
+ *	interrupts for the controller.
+ * @label: for debug information.
+ */
+struct nexell_pin_ctrl {
+	struct nexell_pin_bank	*pin_banks;
+	u32		nr_banks;
+
+	u32		base;
+	u32		nr_pins;
+
+	int		(*base_init)(struct nexell_pinctrl_drv_data *);
+	int		(*gpio_irq_init)(struct nexell_pinctrl_drv_data *);
+	int		(*alive_irq_init)(struct nexell_pinctrl_drv_data *);
+	void		(*suspend)(struct nexell_pinctrl_drv_data *);
+	void		(*resume)(struct nexell_pinctrl_drv_data *);
+};
+
+/**
+ * struct nexell_pinctrl_drv_data: wrapper for holding driver data together.
+ * @node: global list node
+ * @virt_base: register base address of the controller.
+ * @dev: device instance representing the controller.
+ * @irq: interrpt number used by the controller to notify gpio interrupts.
+ * @ctrl: pin controller instance managed by the driver.
+ * @pctl: pin controller descriptor registered with the pinctrl subsystem.
+ * @pctl_dev: cookie representing pinctrl device instance.
+ * @pin_groups: list of pin groups available to the driver.
+ * @nr_groups: number of such pin groups.
+ * @pmx_functions: list of pin functions available to the driver.
+ * @nr_function: number of such pin functions.
+ */
+struct nexell_pinctrl_drv_data {
+	struct list_head		node;
+	void __iomem			*virt_base;
+	struct device			*dev;
+	int				irq;
+
+	struct nexell_pin_ctrl		*ctrl;
+	struct pinctrl_desc		pctl;
+	struct pinctrl_dev		*pctl_dev;
+
+	const struct nexell_pin_group	*pin_groups;
+	unsigned int			nr_groups;
+	const struct nexell_pmx_func	*pmx_functions;
+	unsigned int			nr_functions;
+};
+
+/**
+ * struct nexell_pin_group: represent group of pins of a pinmux function.
+ * @name: name of the pin group, used to lookup the group.
+ * @pins: the pins included in this group.
+ * @num_pins: number of pins included in this group.
+ * @func: the function number to be programmed when selected.
+ */
+struct nexell_pin_group {
+	const char		*name;
+	const unsigned int	*pins;
+	u8			num_pins;
+	u8			func;
+};
+
+/**
+ * struct nexell_pmx_func: represent a pin function.
+ * @name: name of the pin function, used to lookup the function.
+ * @groups: one or more names of pin groups that provide this function.
+ * @num_groups: number of groups included in @groups.
+ */
+struct nexell_pmx_func {
+	const char		*name;
+	const char		**groups;
+	u8			num_groups;
+	u32			val;
+};
+
+/* list of all exported SoC specific data */
+extern const struct nexell_pin_ctrl s5pxx18_pin_ctrl[];
+
+#endif	/* __PINCTRL_NEXELL_H */
diff -ENwbur a/drivers/pinctrl/nexell/pinctrl-s5pxx18.c b/drivers/pinctrl/nexell/pinctrl-s5pxx18.c
--- a/drivers/pinctrl/nexell/pinctrl-s5pxx18.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/pinctrl-s5pxx18.c	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,2143 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/interrupt.h>
+#include <linux/irqdomain.h>
+#include <linux/irq.h>
+#include <linux/irqchip/chained_irq.h>
+#include <linux/of_irq.h>
+#include <linux/io.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/err.h>
+
+#include "pinctrl-nexell.h"
+#include "pinctrl-s5pxx18.h"
+#include "s5pxx18-gpio.h"
+
+static struct {
+	struct nx_gpio_reg_set *gpio_regs;
+	struct nx_gpio_reg_set gpio_save;
+} gpio_modules[NUMBER_OF_GPIO_MODULE];
+
+static struct nx_alive_reg_set *alive_regs;
+static struct nx_alive_reg_set alive_saves;
+
+/*
+ * gpio functions
+ */
+
+void nx_gpio_setbit(u32 *p, u32 bit, bool enable)
+{
+	u32 newvalue = readl(p);
+
+	newvalue &= ~(1UL << bit);
+	newvalue |= (u32)enable << bit;
+
+	writel(newvalue, p);
+}
+
+bool nx_gpio_getbit(u32 value, u32 bit)
+{
+	return (bool)((value >> bit) & (1UL));
+}
+
+void nx_gpio_setbit2(u32 *p, u32 bit, u32 value)
+{
+	u32 newvalue = readl(p);
+
+	newvalue = (u32)(newvalue & ~(3UL << (bit * 2)));
+	newvalue = (u32)(newvalue | (value << (bit * 2)));
+
+	writel(newvalue, p);
+}
+
+u32 nx_gpio_getbit2(u32 value, u32 bit)
+{
+	return (u32)((u32)(value >> (bit * 2)) & 3UL);
+}
+
+bool nx_gpio_open_module(u32 idx)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	writel(0xFFFFFFFF, &p_register->GPIOx_SLEW_DISABLE_DEFAULT);
+	writel(0xFFFFFFFF, &p_register->GPIOx_DRV1_DISABLE_DEFAULT);
+	writel(0xFFFFFFFF, &p_register->GPIOx_DRV0_DISABLE_DEFAULT);
+	writel(0xFFFFFFFF, &p_register->GPIOx_PULLSEL_DISABLE_DEFAULT);
+	writel(0xFFFFFFFF, &p_register->GPIOx_PULLENB_DISABLE_DEFAULT);
+
+	return true;
+}
+
+void nx_gpio_set_output_enable(u32 idx, u32 bitnum, bool enable)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOxOUTENB, bitnum, enable);
+}
+
+bool nx_gpio_get_detect_enable(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	return nx_gpio_getbit(readl(&p_register->GPIOxDETENB), bitnum);
+}
+
+void nx_gpio_set_detect_enable(u32 idx, u32 bitnum, bool enable)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOxDETENB, bitnum, enable);
+}
+
+bool nx_gpio_get_output_enable(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	return nx_gpio_getbit(readl(&p_register->GPIOxOUTENB), bitnum);
+}
+
+void nx_gpio_set_output_value(u32 idx, u32 bitnum, bool value)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOxOUT, bitnum, value);
+}
+
+bool nx_gpio_get_output_value(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	return nx_gpio_getbit(readl(&p_register->GPIOxOUT), bitnum);
+}
+
+bool nx_gpio_get_input_value(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	return nx_gpio_getbit(readl(&p_register->GPIOxPAD), bitnum);
+}
+
+void nx_gpio_set_pull_select(u32 idx, u32 bitnum, bool enable)
+{
+	nx_gpio_setbit(
+	    &gpio_modules[idx].gpio_regs->GPIOx_PULLSEL_DISABLE_DEFAULT,
+	    bitnum, true);
+	nx_gpio_setbit(&gpio_modules[idx].gpio_regs->GPIOx_PULLSEL, bitnum,
+		       enable);
+}
+
+bool nx_gpio_get_pull_select(u32 idx, u32 bitnum)
+{
+	return nx_gpio_getbit(gpio_modules[idx].gpio_regs->GPIOx_PULLSEL,
+			      bitnum);
+}
+
+void nx_gpio_set_pull_mode(u32 idx, u32 bitnum, int mode)
+{
+	nx_gpio_setbit(
+	    &gpio_modules[idx].gpio_regs->GPIOx_PULLSEL_DISABLE_DEFAULT,
+	    bitnum, true);
+	nx_gpio_setbit(
+	    &gpio_modules[idx].gpio_regs->GPIOx_PULLENB_DISABLE_DEFAULT,
+	    bitnum, true);
+
+	if (mode == nx_gpio_pull_off) {
+		nx_gpio_setbit(&gpio_modules[idx].gpio_regs->GPIOx_PULLENB,
+			       bitnum, false);
+		nx_gpio_setbit(&gpio_modules[idx].gpio_regs->GPIOx_PULLSEL,
+			       bitnum, false);
+	} else {
+		nx_gpio_setbit(&gpio_modules[idx].gpio_regs->GPIOx_PULLSEL,
+			       bitnum, (mode & 1 ? true : false));
+		nx_gpio_setbit(&gpio_modules[idx].gpio_regs->GPIOx_PULLENB,
+			       bitnum, true);
+	}
+}
+
+void nx_gpio_set_pad_function(u32 idx, u32 bitnum, int padfunc)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit2(&p_register->GPIOxALTFN[bitnum / 16], bitnum % 16,
+			(u32)padfunc);
+}
+
+int nx_gpio_get_pad_function(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	return nx_gpio_getbit2(
+	    readl(&p_register->GPIOxALTFN[bitnum / 16]), bitnum % 16);
+}
+
+void nx_gpio_set_slew(u32 idx, u32 bitnum, bool enable)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOx_SLEW, bitnum, enable);
+}
+
+void nx_gpio_set_slew_disable_default(u32 idx, u32 bitnum, bool enable)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOx_SLEW_DISABLE_DEFAULT, bitnum,
+		       enable);
+}
+
+bool nx_gpio_get_slew(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	return (bool)nx_gpio_getbit(readl(&p_register->GPIOx_SLEW), bitnum);
+}
+
+void nx_gpio_set_drive_strength(u32 idx, u32 bitnum, int drvstrength)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOx_DRV1, bitnum,
+		       (bool)(((u32)drvstrength >> 0) & 0x1));
+	nx_gpio_setbit(&p_register->GPIOx_DRV0, bitnum,
+		       (bool)(((u32)drvstrength >> 1) & 0x1));
+}
+
+void nx_gpio_set_drive_strength_disable_default(u32 idx, u32 bitnum,
+						bool enable)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit(&p_register->GPIOx_DRV1_DISABLE_DEFAULT, bitnum,
+		       (bool)(enable));
+	nx_gpio_setbit(&p_register->GPIOx_DRV0_DISABLE_DEFAULT, bitnum,
+		       (bool)(enable));
+}
+
+int nx_gpio_get_drive_strength(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+	u32 retvalue;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	retvalue = nx_gpio_getbit(readl(&p_register->GPIOx_DRV0), bitnum)
+		   << 1;
+	retvalue |= nx_gpio_getbit(readl(&p_register->GPIOx_DRV1), bitnum)
+		    << 0;
+
+	return (int)retvalue;
+}
+
+void nx_gpio_set_pull_enable(u32 idx, u32 bitnum, int pullsel)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	if (pullsel == nx_gpio_pull_down || pullsel == nx_gpio_pull_up) {
+		nx_gpio_setbit(&p_register->GPIOx_PULLSEL, bitnum,
+			       (bool)pullsel);
+		nx_gpio_setbit(&p_register->GPIOx_PULLENB, bitnum, true);
+	} else
+		nx_gpio_setbit(&p_register->GPIOx_PULLENB, bitnum, false);
+}
+
+int nx_gpio_get_pull_enable(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+	bool enable;
+
+	p_register = gpio_modules[idx].gpio_regs;
+	enable = nx_gpio_getbit(readl(&p_register->GPIOx_PULLENB), bitnum);
+
+	if (enable == true)
+		return (int)nx_gpio_getbit(
+		    readl(&p_register->GPIOx_PULLSEL), bitnum);
+	else
+		return (int)(nx_gpio_pull_off);
+}
+
+void nx_gpio_set_input_mux_select0(u32 idx, u32 value)
+{
+	writel(value, &gpio_modules[idx].gpio_regs->GPIOx_InputMuxSelect0);
+}
+
+void nx_gpio_set_input_mux_select1(u32 idx, u32 value)
+{
+	writel(value, &gpio_modules[idx].gpio_regs->GPIOx_InputMuxSelect1);
+}
+
+void nx_gpio_set_interrupt_enable(u32 idx, s32 irqnum, bool enable)
+{
+	struct nx_gpio_reg_set *p_register;
+	u32 ReadValue;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	ReadValue = readl(&p_register->GPIOxINTENB);
+
+	ReadValue &= ~((u32)1 << irqnum);
+	ReadValue |= ((u32)enable << irqnum);
+
+	writel(ReadValue, &p_register->GPIOxINTENB);
+
+	nx_gpio_set_detect_enable(idx, irqnum, enable);
+}
+
+bool nx_gpio_get_interrupt_enable(u32 idx, s32 irqnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	if (readl(&p_register->GPIOxINTENB) & (1UL << irqnum))
+		return true;
+
+	return false;
+}
+
+bool nx_gpio_get_interrupt_pending(u32 idx, s32 irqnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	if (readl(&p_register->GPIOxDET) & (1UL << irqnum))
+		return true;
+
+	return false;
+}
+
+void nx_gpio_clear_interrupt_pending(u32 idx, s32 irqnum)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	writel(1UL << irqnum, &p_register->GPIOxDET);
+}
+
+s32 nx_gpio_get_interrupt_pending_number(u32 idx)
+{
+	struct nx_gpio_reg_set *p_register;
+	u32 intnum;
+	u32 intpend;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	intpend = readl(&p_register->GPIOxDET);
+
+	for (intnum = 0; intnum < 32; intnum++) {
+		if (0 != (intpend & (1UL << intnum)))
+			return intnum;
+	}
+
+	return -1;
+}
+
+/*
+ * GPIO Operation.
+ */
+
+void nx_gpio_set_interrupt_mode(u32 idx, u32 bitnum, int irqmode)
+{
+	struct nx_gpio_reg_set *p_register;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	nx_gpio_setbit2(&p_register->GPIOxDETMODE[bitnum / 16],
+			bitnum % 16, (u32)irqmode & 0x03);
+	nx_gpio_setbit(&p_register->GPIOxDETMODEEX, bitnum,
+		       (u32)(irqmode >> 2));
+}
+
+int nx_gpio_get_interrupt_mode(u32 idx, u32 bitnum)
+{
+	struct nx_gpio_reg_set *p_register;
+	u32 regvalue;
+
+	p_register = gpio_modules[idx].gpio_regs;
+
+	regvalue = nx_gpio_getbit2(
+	    readl(&p_register->GPIOxDETMODE[bitnum / 16]), bitnum % 16);
+	regvalue |=
+	    (nx_gpio_getbit(readl(&p_register->GPIOxDETMODEEX), bitnum) << 2);
+
+	return regvalue;
+}
+
+
+/*
+ * alive functions
+ */
+
+void nx_alive_set_interrupt_enable(s32 irqnum, bool enable)
+{
+	u32 INTENB_MASK;
+
+	INTENB_MASK = (1UL << irqnum);
+
+	if (enable)
+		writel(INTENB_MASK, &alive_regs->ALIVEGPIOINTENBSETREG);
+	else
+		writel(INTENB_MASK, &alive_regs->ALIVEGPIOINTENBRSTREG);
+}
+
+bool nx_alive_get_interrupt_enable(s32 irqnum)
+{
+	return (bool)((alive_regs->ALIVEGPIOINTENBREADREG >> irqnum) & 0x01);
+}
+
+bool nx_alive_get_interrupt_pending(s32 irqnum)
+{
+	return ((alive_regs->ALIVEGPIODETECTPENDREG >> irqnum) & 0x01);
+}
+
+void nx_alive_clear_interrupt_pending(s32 irqnum)
+{
+	writel(1 << irqnum, &alive_regs->ALIVEGPIODETECTPENDREG);
+}
+
+s32 nx_alive_get_interrupt_pending_number(void)
+{
+	struct nx_alive_reg_set *p_register;
+	u32 Pend;
+	u32 int_num;
+
+	p_register = alive_regs;
+
+	Pend = (p_register->ALIVEGPIODETECTPENDREG &
+		p_register->ALIVEGPIOINTENBREADREG);
+
+	for (int_num = 0; int_num < 6; int_num++)
+		if (Pend & (1 << int_num))
+			return int_num;
+
+	return -1;
+}
+
+/*
+ * PAD Configuration
+ */
+
+void nx_alive_set_write_enable(bool enable)
+{
+	writel((u32)enable, &alive_regs->ALIVEPWRGATEREG);
+}
+
+bool nx_alive_get_write_enable(void)
+{
+	return (bool)(alive_regs->ALIVEPWRGATEREG & 0x01);
+}
+
+void nx_alive_set_scratch_reg(u32 data)
+{
+	writel(data, &alive_regs->ALIVESCRATCHSETREG);
+	writel(~data, &alive_regs->ALIVESCRATCHRSTREG);
+}
+
+u32 nx_alive_get_scratch_reg(void)
+{
+	return (u32)(alive_regs->ALIVESCRATCHREADREG);
+}
+
+void nx_alive_set_pullup_enable(u32 bitnum, bool enable)
+{
+	u32 PULLUP_MASK;
+
+	PULLUP_MASK = (1UL << bitnum);
+
+	if (enable)
+		writel(PULLUP_MASK, &alive_regs->ALIVEGPIOPADPULLUPSETREG);
+	else
+		writel(PULLUP_MASK, &alive_regs->ALIVEGPIOPADPULLUPRSTREG);
+}
+
+bool nx_alive_get_pullup_enable(u32 bitnum)
+{
+	return (bool)((alive_regs->ALIVEGPIOPADPULLUPREADREG >> bitnum) &
+		      0x01);
+}
+
+/*
+ * Input Setting Function
+ */
+
+void nx_alive_set_detect_enable(u32 bitnum, bool enable)
+{
+	u32 detectenb_mask;
+
+	detectenb_mask = (1UL << bitnum);
+
+	if (enable)
+		writel(detectenb_mask, &alive_regs->ALIVEGPIODETECTENBSETREG);
+	else
+		writel(detectenb_mask, &alive_regs->ALIVEGPIODETECTENBRSTREG);
+}
+
+bool nx_alive_get_detect_enable(u32 bitnum)
+{
+	return (bool)((alive_regs->ALIVEGPIODETECTENBREADREG >> bitnum) &
+		      0x01);
+}
+
+void nx_alive_set_detect_mode(int detect_mode, u32 bitnum, bool enable)
+{
+	u32 *pSetReg = 0;
+	u32 *pRstReg = 0;
+
+	switch (detect_mode) {
+	case nx_alive_detect_mode_async_lowlevel:
+		pSetReg = &alive_regs->ALIVEGPIOASYNCDETECTMODESETREG0;
+		pRstReg = &alive_regs->ALIVEGPIOASYNCDETECTMODERSTREG0;
+		break;
+
+	case nx_alive_detect_mode_async_highlevel:
+		pSetReg = &alive_regs->ALIVEGPIOASYNCDETECTMODESETREG1;
+		pRstReg = &alive_regs->ALIVEGPIOASYNCDETECTMODERSTREG1;
+		break;
+
+	case nx_alive_detect_mode_sync_fallingedge:
+		pSetReg = &alive_regs->ALIVEGPIODETECTMODESETREG0;
+		pRstReg = &alive_regs->ALIVEGPIODETECTMODERSTREG0;
+		break;
+
+	case nx_alive_detect_mode_sync_risingedge:
+		pSetReg = &alive_regs->ALIVEGPIODETECTMODESETREG1;
+		pRstReg = &alive_regs->ALIVEGPIODETECTMODERSTREG1;
+		break;
+
+	case nx_alive_detect_mode_sync_lowlevel:
+		pSetReg = &alive_regs->ALIVEGPIODETECTMODESETREG2;
+		pRstReg = &alive_regs->ALIVEGPIODETECTMODERSTREG2;
+		break;
+
+	case nx_alive_detect_mode_sync_highlevel:
+		pSetReg = &alive_regs->ALIVEGPIODETECTMODESETREG3;
+		pRstReg = &alive_regs->ALIVEGPIODETECTMODERSTREG3;
+		break;
+
+	default:
+		break;
+	}
+
+	if (enable)
+		writel((1UL << bitnum), pSetReg);
+	else
+		writel((1UL << bitnum), pRstReg);
+}
+
+bool nx_alive_get_detect_mode(int detect_mode, u32 bitnum)
+{
+	switch (detect_mode) {
+	case nx_alive_detect_mode_async_lowlevel:
+		return (bool)((alive_regs->ALIVEGPIOLOWASYNCDETECTMODEREADREG >>
+			       bitnum) & 0x01);
+
+	case nx_alive_detect_mode_async_highlevel:
+		return (
+		    bool)((alive_regs->ALIVEGPIOHIGHASYNCDETECTMODEREADREG >>
+			   bitnum) & 0x01);
+
+	case nx_alive_detect_mode_sync_fallingedge:
+		return (bool)((alive_regs->ALIVEGPIOFALLDETECTMODEREADREG >>
+			       bitnum) & 0x01);
+
+	case nx_alive_detect_mode_sync_risingedge:
+		return (bool)((alive_regs->ALIVEGPIORISEDETECTMODEREADREG >>
+			       bitnum) & 0x01);
+
+	case nx_alive_detect_mode_sync_lowlevel:
+		return (bool)((alive_regs->ALIVEGPIOLOWDETECTMODEREADREG >>
+			       bitnum) & 0x01);
+
+	case nx_alive_detect_mode_sync_highlevel:
+		return (bool)((alive_regs->ALIVEGPIOHIGHDETECTMODEREADREG >>
+			       bitnum) & 0x01);
+
+	default:
+		break;
+	}
+
+	return false;
+}
+
+bool nx_alive_get_vdd_pwr_toggle(void)
+{
+	const u32 VDDPWRTOGGLE_BITPOS = 10;
+
+	return (bool)((alive_regs->VDDCTRLREADREG >> VDDPWRTOGGLE_BITPOS) &
+		      0x01);
+}
+
+/*
+ * Output Setting Function
+ */
+
+void nx_alive_set_output_enable(u32 bitnum, bool enable)
+{
+	u32 padoutenb_mask;
+
+	padoutenb_mask = (1UL << bitnum);
+
+	if (enable)
+		writel(padoutenb_mask, &alive_regs->ALIVEGPIOPADOUTENBSETREG);
+	else
+		writel(padoutenb_mask, &alive_regs->ALIVEGPIOPADOUTENBRSTREG);
+}
+
+bool nx_alive_get_output_enable(u32 bitnum)
+{
+	return (bool)((alive_regs->ALIVEGPIOPADOUTENBREADREG >> bitnum) &
+		      0x01);
+}
+
+bool nx_alive_get_input_enable(u32 bitnum)
+{
+	return (bool)((alive_regs->ALIVEGPIOPADOUTENBREADREG >> bitnum) &
+		      0x01)
+		   ? false
+		   : true;
+}
+
+void nx_alive_set_output_value(u32 bitnum, bool value)
+{
+	u32 padout_mask;
+
+	padout_mask = (1UL << bitnum);
+
+	if (value)
+		writel(padout_mask, &alive_regs->ALIVEGPIOPADOUTSETREG);
+	else
+		writel(padout_mask, &alive_regs->ALIVEGPIOPADOUTRSTREG);
+}
+
+bool nx_alive_get_output_value(u32 bitnum)
+{
+	return (bool)((alive_regs->ALIVEGPIOPADOUTREADREG >> bitnum) & 0x01);
+}
+
+bool nx_alive_get_input_value(u32 bitnum)
+{
+	return (bool)((alive_regs->ALIVEGPIOINPUTVALUE >> bitnum) & 0x01);
+}
+
+u32 nx_alive_get_wakeup_status(void)
+{
+	u32 status;
+
+	status = alive_regs->WAKEUPSTATUS;
+	return status;
+}
+
+void nx_alive_clear_wakeup_status(void) { alive_regs->CLEARWAKEUPSTATUS = 1; }
+
+/*
+ * end of nx_alive
+ */
+
+const unsigned char (*gpio_fn_no)[GPIO_NUM_PER_BANK] = NULL;
+
+const unsigned char s5pxx18_pio_fn_no[][GPIO_NUM_PER_BANK] = {
+	ALT_NO_GPIO_A, ALT_NO_GPIO_B, ALT_NO_GPIO_C,
+	ALT_NO_GPIO_D, ALT_NO_GPIO_E, ALT_NO_ALIVE,
+};
+
+/*----------------------------------------------------------------------------*/
+#define ALIVE_INDEX 5			 /* number of gpio module */
+static spinlock_t lock[ALIVE_INDEX + 1]; /* A, B, C, D, E, alive */
+static unsigned long lock_flags[ALIVE_INDEX + 1];
+
+#define IO_LOCK_INIT(x) spin_lock_init(&lock[x])
+#define IO_LOCK(x) spin_lock_irqsave(&lock[x], lock_flags[x])
+#define IO_UNLOCK(x) spin_unlock_irqrestore(&lock[x], lock_flags[x])
+
+void nx_soc_gpio_set_io_func(unsigned int io, unsigned int func)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_set_pad_function(grp, bit, func);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+}
+
+int nx_soc_gpio_get_altnum(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	return gpio_fn_no[grp][bit];
+}
+
+unsigned int nx_soc_gpio_get_io_func(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	unsigned int fn = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		fn = nx_gpio_get_pad_function(grp, bit);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		fn = 0;
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return fn;
+}
+
+void nx_soc_gpio_set_io_dir(unsigned int io, int out)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_set_output_enable(grp, bit, out ? true : false);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		nx_alive_set_output_enable(bit, out ? true : false);
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+}
+
+int nx_soc_gpio_get_io_dir(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int dir = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		dir = nx_gpio_get_output_enable(grp, bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		dir = nx_alive_get_output_enable(bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return dir;
+}
+
+void nx_soc_gpio_set_io_pull(unsigned int io, int val)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d.%02d) sel:%d\n", __func__, grp, bit, val);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_set_pull_enable(grp, bit, val);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		if (val & 1)	/* up */
+			nx_alive_set_pullup_enable(bit, true);
+		else	/* down, off */
+			nx_alive_set_pullup_enable(bit, false);
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+				__func__);
+		break;
+	};
+}
+
+int nx_soc_gpio_get_io_pull(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int up = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		up = nx_gpio_get_pull_enable(grp, bit);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		up = nx_alive_get_pullup_enable(bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+				__func__);
+		break;
+	};
+
+	return up;
+}
+
+void nx_soc_gpio_set_io_drv(int gpio, int mode)
+{
+	int grp, bit;
+
+	if (gpio > (PAD_GPIO_ALV - 1))
+		return;
+
+	grp = PAD_GET_GROUP(gpio);
+	bit = PAD_GET_BITNO(gpio);
+	pr_debug("%s (%d.%02d) mode:%d\n", __func__, grp, bit, mode);
+
+	nx_gpio_set_drive_strength(grp, bit, (int)mode);
+}
+
+int nx_soc_gpio_get_io_drv(int gpio)
+{
+	int grp, bit;
+
+	if (gpio > (PAD_GPIO_ALV - 1))
+		return -1;
+
+	grp = PAD_GET_GROUP(gpio);
+	bit = PAD_GET_BITNO(gpio);
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	return (int)nx_gpio_get_drive_strength(grp, bit);
+}
+
+void nx_soc_gpio_set_out_value(unsigned int io, int high)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_set_output_value(grp, bit, high ? true : false);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		nx_alive_set_output_value(bit, high ? true : false);
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+}
+
+int nx_soc_gpio_get_out_value(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int val = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		val = nx_gpio_get_output_value(grp, bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		val = nx_alive_get_output_value(bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return val;
+}
+
+int nx_soc_gpio_get_in_value(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int val = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		val = nx_gpio_get_input_value(grp, bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		val = nx_alive_get_input_value(bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return val;
+}
+
+void nx_soc_gpio_set_int_enable(unsigned int io, int on)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_set_interrupt_enable(grp, bit, on ? true : false);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		nx_alive_set_detect_enable(bit, on ? true : false);
+		nx_alive_set_interrupt_enable(bit, on ? true : false);
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+}
+
+int nx_soc_gpio_get_int_enable(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int enb = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		enb = nx_gpio_get_interrupt_enable(grp, bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		enb = nx_alive_get_interrupt_enable(bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return enb;
+}
+
+void nx_soc_gpio_set_int_mode(unsigned int io, unsigned int mode)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int det = 0;
+
+	pr_debug("%s (%d.%02d, %d)\n", __func__, grp, bit, mode);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_set_interrupt_mode(grp, bit, mode);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		/* all disable */
+		for (det = 0; 6 > det; det++)
+			nx_alive_set_detect_mode(det, bit, false);
+		/* enable */
+		nx_alive_set_detect_mode(mode, bit, true);
+		nx_alive_set_output_enable(bit, false);
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+}
+
+int nx_soc_gpio_get_int_mode(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int mod = -1;
+	int det = 0;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		mod = nx_gpio_get_interrupt_mode(grp, bit);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		for (det = 0; 6 > det; det++) {
+			if (nx_alive_get_detect_mode(det, bit)) {
+				mod = det;
+				break;
+			}
+		}
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return mod;
+}
+
+int nx_soc_gpio_get_int_pend(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+	int pend = -1;
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		pend = nx_gpio_get_interrupt_pending(grp, bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		pend = nx_alive_get_interrupt_pending(bit) ? 1 : 0;
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+	return pend;
+}
+
+void nx_soc_gpio_clr_int_pend(unsigned int io)
+{
+	unsigned int grp = PAD_GET_GROUP(io);
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d.%02d)\n", __func__, grp, bit);
+
+	switch (io & ~(32 - 1)) {
+	case PAD_GPIO_A:
+	case PAD_GPIO_B:
+	case PAD_GPIO_C:
+	case PAD_GPIO_D:
+	case PAD_GPIO_E:
+		IO_LOCK(grp);
+		nx_gpio_clear_interrupt_pending(grp, bit);
+		nx_gpio_get_interrupt_pending(grp, bit);
+		IO_UNLOCK(grp);
+		break;
+	case PAD_GPIO_ALV:
+		IO_LOCK(grp);
+		nx_alive_clear_interrupt_pending(bit);
+		nx_alive_get_interrupt_pending(bit);
+		IO_UNLOCK(grp);
+		break;
+	default:
+		pr_err("fail, soc gpio io:%d, group:%d (%s)\n", io, grp,
+		       __func__);
+		break;
+	};
+}
+
+void nx_soc_alive_set_det_enable(unsigned int io, int on)
+{
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d)\n", __func__, bit);
+
+	IO_LOCK(ALIVE_INDEX);
+
+	nx_alive_set_output_enable(bit, false);
+	nx_alive_set_detect_enable(bit, on ? true : false);
+
+	IO_UNLOCK(ALIVE_INDEX);
+}
+
+int nx_soc_alive_get_det_enable(unsigned int io)
+{
+	unsigned int bit = PAD_GET_BITNO(io);
+	int mod = 0;
+
+	pr_debug("%s (%d)\n", __func__, bit);
+
+	IO_LOCK(ALIVE_INDEX);
+	mod = nx_alive_get_detect_enable(bit) ? 1 : 0;
+	IO_UNLOCK(ALIVE_INDEX);
+
+	return mod;
+}
+
+void nx_soc_alive_set_det_mode(unsigned int io, unsigned int mode, int on)
+{
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d)\n", __func__, bit);
+
+	IO_LOCK(ALIVE_INDEX);
+	nx_alive_set_detect_mode(mode, bit, on ? true : false);
+	IO_UNLOCK(ALIVE_INDEX);
+}
+
+int nx_soc_alive_get_det_mode(unsigned int io, unsigned int mode)
+{
+	unsigned int bit = PAD_GET_BITNO(io);
+	int mod = 0;
+
+	pr_debug("%s (%d)\n", __func__, bit);
+
+	IO_LOCK(ALIVE_INDEX);
+	mod = nx_alive_get_detect_mode(mode, bit) ? 1 : 0;
+	IO_UNLOCK(ALIVE_INDEX);
+
+	return mod;
+}
+
+int nx_soc_alive_get_int_pend(unsigned int io)
+{
+	unsigned int bit = PAD_GET_BITNO(io);
+	int pend = -1;
+
+	pr_debug("%s (%d)\n", __func__, bit);
+
+	IO_LOCK(ALIVE_INDEX);
+	pend = nx_alive_get_interrupt_pending(bit);
+	IO_UNLOCK(ALIVE_INDEX);
+
+	return pend;
+}
+
+void nx_soc_alive_clr_int_pend(unsigned int io)
+{
+	unsigned int bit = PAD_GET_BITNO(io);
+
+	pr_debug("%s (%d)\n", __func__, bit);
+
+	IO_LOCK(ALIVE_INDEX);
+	nx_alive_clear_interrupt_pending(bit);
+	IO_UNLOCK(ALIVE_INDEX);
+}
+
+int s5pxx18_gpio_suspend(int idx)
+{
+	struct nx_gpio_reg_set *reg;
+	struct nx_gpio_reg_set *gpio_save;
+
+	if (idx < 0 || idx >= NUMBER_OF_GPIO_MODULE)
+		return -ENXIO;
+
+	reg = gpio_modules[idx].gpio_regs;
+	gpio_save = &gpio_modules[idx].gpio_save;
+
+	gpio_save->GPIOxOUT = readl(&reg->GPIOxOUT);
+	gpio_save->GPIOxOUTENB = readl(&reg->GPIOxOUTENB);
+	gpio_save->GPIOxALTFN[0] = readl(&reg->GPIOxALTFN[0]);
+	gpio_save->GPIOxALTFN[1] = readl(&reg->GPIOxALTFN[1]);
+	gpio_save->GPIOxDETMODE[0] = readl(&reg->GPIOxDETMODE[0]);
+	gpio_save->GPIOxDETMODE[1] = readl(&reg->GPIOxDETMODE[1]);
+	gpio_save->GPIOxDETMODEEX = readl(&reg->GPIOxDETMODEEX);
+	gpio_save->GPIOxINTENB = readl(&reg->GPIOxINTENB);
+
+	gpio_save->GPIOx_SLEW = readl(&reg->GPIOx_SLEW);
+	gpio_save->GPIOx_SLEW_DISABLE_DEFAULT =
+		readl(&reg->GPIOx_SLEW_DISABLE_DEFAULT);
+	gpio_save->GPIOx_DRV1 = readl(&reg->GPIOx_DRV1);
+	gpio_save->GPIOx_DRV1_DISABLE_DEFAULT =
+		readl(&reg->GPIOx_DRV1_DISABLE_DEFAULT);
+	gpio_save->GPIOx_DRV0 = readl(&reg->GPIOx_DRV0);
+	gpio_save->GPIOx_DRV0_DISABLE_DEFAULT =
+		readl(&reg->GPIOx_DRV0_DISABLE_DEFAULT);
+	gpio_save->GPIOx_PULLSEL = readl(&reg->GPIOx_PULLSEL);
+	gpio_save->GPIOx_PULLSEL_DISABLE_DEFAULT =
+		readl(&reg->GPIOx_PULLSEL_DISABLE_DEFAULT);
+	gpio_save->GPIOx_PULLENB = readl(&reg->GPIOx_PULLENB);
+	gpio_save->GPIOx_PULLENB_DISABLE_DEFAULT =
+		readl(&reg->GPIOx_PULLENB_DISABLE_DEFAULT);
+
+	return 0;
+}
+
+int s5pxx18_gpio_resume(int idx)
+{
+	struct nx_gpio_reg_set *reg;
+	struct nx_gpio_reg_set *gpio_save;
+
+	if (idx < 0 || idx >= NUMBER_OF_GPIO_MODULE)
+		return -ENXIO;
+
+	reg = gpio_modules[idx].gpio_regs;
+	gpio_save = &gpio_modules[idx].gpio_save;
+
+	writel(gpio_save->GPIOx_SLEW, &reg->GPIOx_SLEW);
+	writel(gpio_save->GPIOx_SLEW_DISABLE_DEFAULT,
+		&reg->GPIOx_SLEW_DISABLE_DEFAULT);
+	writel(gpio_save->GPIOx_DRV1, &reg->GPIOx_DRV1);
+	writel(gpio_save->GPIOx_DRV1_DISABLE_DEFAULT,
+		&reg->GPIOx_DRV1_DISABLE_DEFAULT);
+	writel(gpio_save->GPIOx_DRV0, &reg->GPIOx_DRV0);
+	writel(gpio_save->GPIOx_DRV0_DISABLE_DEFAULT,
+		&reg->GPIOx_DRV0_DISABLE_DEFAULT);
+	writel(gpio_save->GPIOx_PULLSEL, &reg->GPIOx_PULLSEL);
+	writel(gpio_save->GPIOx_PULLSEL_DISABLE_DEFAULT,
+		&reg->GPIOx_PULLSEL_DISABLE_DEFAULT);
+	writel(gpio_save->GPIOx_PULLENB, &reg->GPIOx_PULLENB);
+	writel(gpio_save->GPIOx_PULLENB_DISABLE_DEFAULT,
+		&reg->GPIOx_PULLENB_DISABLE_DEFAULT);
+
+	writel(gpio_save->GPIOxOUT, &reg->GPIOxOUT);
+	writel(gpio_save->GPIOxOUTENB, &reg->GPIOxOUTENB);
+	writel(gpio_save->GPIOxALTFN[0], &reg->GPIOxALTFN[0]);
+	writel(gpio_save->GPIOxALTFN[1], &reg->GPIOxALTFN[1]);
+	writel(gpio_save->GPIOxDETMODE[0], &reg->GPIOxDETMODE[0]);
+	writel(gpio_save->GPIOxDETMODE[1], &reg->GPIOxDETMODE[1]);
+	writel(gpio_save->GPIOxDETMODEEX, &reg->GPIOxDETMODEEX);
+	writel(gpio_save->GPIOxINTENB, &reg->GPIOxINTENB);
+	writel(gpio_save->GPIOxINTENB, &reg->GPIOxDETENB);/* DETECT ENABLE */
+	writel((u32)0xFFFFFFFF, &reg->GPIOxDET);	/* CLEAR PENDING */
+
+	return 0;
+}
+
+int s5pxx18_alive_suspend(void)
+{
+	struct nx_alive_reg_set *reg;
+	struct nx_alive_reg_set *alive_save;
+	u32 both_edge = 0;
+
+	reg = alive_regs;
+	alive_save = &alive_saves;
+
+	nx_alive_set_write_enable(true);
+
+	alive_save->ALIVEGPIOLOWASYNCDETECTMODEREADREG =
+		readl(&reg->ALIVEGPIOLOWASYNCDETECTMODEREADREG);
+	alive_save->ALIVEGPIOHIGHASYNCDETECTMODEREADREG =
+		readl(&reg->ALIVEGPIOHIGHASYNCDETECTMODEREADREG);
+	alive_save->ALIVEGPIOFALLDETECTMODEREADREG =
+		readl(&reg->ALIVEGPIOFALLDETECTMODEREADREG);
+	alive_save->ALIVEGPIORISEDETECTMODEREADREG =
+		readl(&reg->ALIVEGPIORISEDETECTMODEREADREG);
+	alive_save->ALIVEGPIOLOWDETECTMODEREADREG =
+		readl(&reg->ALIVEGPIOLOWDETECTMODEREADREG);
+	alive_save->ALIVEGPIOHIGHDETECTMODEREADREG =
+		readl(&reg->ALIVEGPIOHIGHDETECTMODEREADREG);
+
+	alive_save->ALIVEGPIODETECTENBREADREG =
+		readl(&reg->ALIVEGPIODETECTENBREADREG);
+	alive_save->ALIVEGPIOINTENBREADREG =
+		readl(&reg->ALIVEGPIOINTENBREADREG);
+	alive_save->ALIVEGPIOPADOUTENBREADREG =
+		readl(&reg->ALIVEGPIOPADOUTENBREADREG);
+	alive_save->ALIVEGPIOPADOUTREADREG =
+		readl(&reg->ALIVEGPIOPADOUTREADREG);
+	alive_save->ALIVEGPIOPADPULLUPREADREG
+		= readl(&reg->ALIVEGPIOPADPULLUPREADREG);
+
+	/* change both edge detect to falling only */
+	both_edge = (alive_save->ALIVEGPIOFALLDETECTMODEREADREG &
+		    alive_save->ALIVEGPIORISEDETECTMODEREADREG);
+	writel((u32)both_edge, &reg->ALIVEGPIODETECTMODERSTREG1);
+
+	return 0;
+}
+
+int s5pxx18_alive_resume(void)
+{
+	struct nx_alive_reg_set *reg;
+	struct nx_alive_reg_set *alive_save;
+
+	reg = alive_regs;
+	alive_save = &alive_saves;
+
+	nx_alive_set_write_enable(true);
+
+	/* clear and set */
+	if (alive_save->ALIVEGPIOPADOUTENBREADREG !=
+			readl(&reg->ALIVEGPIOPADOUTENBREADREG)) {
+		writel((u32)0xFFFFFFFF, &reg->ALIVEGPIOPADOUTENBRSTREG);
+		writel(alive_save->ALIVEGPIOPADOUTENBREADREG,
+				&reg->ALIVEGPIOPADOUTENBSETREG);
+	}
+	if (alive_save->ALIVEGPIOPADOUTREADREG !=
+			readl(&reg->ALIVEGPIOPADOUTREADREG)) {
+		writel((u32)0xFFFFFFFF, &reg->ALIVEGPIOPADOUTRSTREG);
+		writel(alive_save->ALIVEGPIOPADOUTREADREG,
+				&reg->ALIVEGPIOPADOUTSETREG);
+	}
+	if (alive_save->ALIVEGPIOPADPULLUPREADREG !=
+			readl(&reg->ALIVEGPIOPADPULLUPREADREG)) {
+		writel((u32)0xFFFFFFFF, &reg->ALIVEGPIOPADPULLUPRSTREG);
+		writel(alive_save->ALIVEGPIOPADPULLUPREADREG,
+				&reg->ALIVEGPIOPADPULLUPSETREG);
+	}
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIODETECTENBRSTREG);
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIOINTENBRSTREG);
+
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIOASYNCDETECTMODERSTREG0);
+	writel(alive_save->ALIVEGPIOLOWASYNCDETECTMODEREADREG,
+				&reg->ALIVEGPIOASYNCDETECTMODESETREG0);
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIOASYNCDETECTMODERSTREG1);
+	writel(alive_save->ALIVEGPIOHIGHASYNCDETECTMODEREADREG,
+				&reg->ALIVEGPIOASYNCDETECTMODESETREG1);
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIODETECTMODERSTREG0);
+	writel(alive_save->ALIVEGPIOFALLDETECTMODEREADREG,
+				&reg->ALIVEGPIODETECTMODESETREG0);
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIODETECTMODERSTREG1);
+	writel(alive_save->ALIVEGPIORISEDETECTMODEREADREG,
+				&reg->ALIVEGPIODETECTMODESETREG1);
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIODETECTMODERSTREG2);
+	writel(alive_save->ALIVEGPIOLOWDETECTMODEREADREG,
+				&reg->ALIVEGPIODETECTMODESETREG2);
+
+	writel((u32)0xFFFFFFFF, &reg->ALIVEGPIODETECTMODERSTREG3);
+	writel(alive_save->ALIVEGPIOHIGHDETECTMODEREADREG,
+				&reg->ALIVEGPIODETECTMODESETREG3);
+
+	writel(alive_save->ALIVEGPIODETECTENBREADREG,
+				&reg->ALIVEGPIODETECTENBSETREG);
+	writel(alive_save->ALIVEGPIOINTENBREADREG,
+				&reg->ALIVEGPIOINTENBSETREG);
+
+	return 0;
+}
+
+int s5pxx18_gpio_device_init(struct list_head *banks, int nr_banks)
+{
+	struct module_init_data *init_data;
+	int n = ALIVE_INDEX + 1;
+	int i;
+
+	for (i = 0; n > i; i++)
+		IO_LOCK_INIT(i);
+
+	gpio_fn_no = s5pxx18_pio_fn_no;
+
+	i = 0;
+	list_for_each_entry(init_data, banks, node) {
+		if (init_data->bank_type == 1) { /* gpio */
+			gpio_modules[i].gpio_regs =
+			    (struct nx_gpio_reg_set *)(init_data->bank_base);
+
+			nx_gpio_open_module(i);
+			i++;
+		} else if (init_data->bank_type == 2) { /* alive */
+			alive_regs =
+			    (struct nx_alive_reg_set *)(init_data->bank_base);
+
+			/*
+			 * ALIVE Power Gate must enable for RTC register access.
+			 * must be clear wfi jump address
+			 */
+			nx_alive_set_write_enable(true);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * irq_chip functions
+ */
+
+static void irq_gpio_ack(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: gpio irq=%d, %s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+
+	writel((1 << bit), base + GPIO_INT_STATUS); /* irq pend clear */
+	ARM_DMB();
+}
+
+static void irq_gpio_mask(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: gpio irq=%d, %s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+
+	/* mask:irq disable */
+	writel(readl(base + GPIO_INT_ENB) & ~(1 << bit), base + GPIO_INT_ENB);
+	writel(readl(base + GPIO_INT_DET) & ~(1 << bit), base + GPIO_INT_DET);
+}
+
+static void irq_gpio_unmask(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: gpio irq=%d, %s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+
+	/* unmask:irq enable */
+	writel(readl(base + GPIO_INT_ENB) | (1 << bit), base + GPIO_INT_ENB);
+	writel(readl(base + GPIO_INT_DET) | (1 << bit), base + GPIO_INT_DET);
+	ARM_DMB();
+}
+
+static int irq_gpio_set_type(struct irq_data *irqd, unsigned int type)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+	u32 val, alt;
+	ulong reg;
+
+	int mode = 0;
+
+	pr_debug("%s: gpio irq=%d, %s.%d, type=0x%x\n", __func__, bank->irq,
+		 bank->name, bit, type);
+
+	switch (type) {
+	case IRQ_TYPE_NONE:
+		pr_warn("%s: No edge setting!\n", __func__);
+		break;
+	case IRQ_TYPE_EDGE_RISING:
+		mode = NX_GPIO_INTMODE_RISINGEDGE;
+		break;
+	case IRQ_TYPE_EDGE_FALLING:
+		mode = NX_GPIO_INTMODE_FALLINGEDGE;
+		break;
+	case IRQ_TYPE_EDGE_BOTH:
+		mode = NX_GPIO_INTMODE_BOTHEDGE;
+		break;
+	case IRQ_TYPE_LEVEL_LOW:
+		mode = NX_GPIO_INTMODE_LOWLEVEL;
+		break;
+	case IRQ_TYPE_LEVEL_HIGH:
+		mode = NX_GPIO_INTMODE_HIGHLEVEL;
+		break;
+	default:
+		pr_err("%s: No such irq type %d", __func__, type);
+		return -1;
+	}
+
+	/*
+	 * must change mode to gpio to use gpio interrupt
+	 */
+
+	/* gpio out : output disable */
+	writel(readl(base + GPIO_INT_OUT) & ~(1 << bit), base + GPIO_INT_OUT);
+
+	/* gpio mode : interrupt mode */
+	reg = (ulong)(base + GPIO_INT_MODE0 + (bit / 16) * 4);
+	val = (readl((void *)reg) & ~(3 << ((bit & 0xf) * 2))) |
+	      ((mode & 0x3) << ((bit & 0xf) * 2));
+	writel(val, (void *)reg);
+
+	reg = (ulong)(base + GPIO_INT_MODE1);
+	val = (readl((void *)reg) & ~(1 << bit)) | (((mode >> 2) & 0x1) << bit);
+	writel(val, (void *)reg);
+
+	/* gpio alt : gpio mode for irq */
+	reg = (ulong)(base + GPIO_INT_ALT + (bit / 16) * 4);
+	val = readl((void *)reg) & ~(3 << ((bit & 0xf) * 2));
+	alt = nx_soc_gpio_get_altnum(bank->grange.pin_base + bit);
+	val |= alt << ((bit & 0xf) * 2);
+	writel(val, (void *)reg);
+	pr_debug("%s: set func to gpio. alt:%d, base:%d, bit:%d\n", __func__,
+		 alt, bank->grange.pin_base, bit);
+
+	return 0;
+}
+
+static void irq_gpio_enable(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: gpio irq=%d, %s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+
+	/* unmask:irq enable */
+	writel(readl(base + GPIO_INT_ENB) | (1 << bit), base + GPIO_INT_ENB);
+	writel(readl(base + GPIO_INT_DET) | (1 << bit), base + GPIO_INT_DET);
+}
+
+static void irq_gpio_disable(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: gpio irq=%d, %s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+
+	/* mask:irq disable */
+	writel(readl(base + GPIO_INT_ENB) & ~(1 << bit), base + GPIO_INT_ENB);
+	writel(readl(base + GPIO_INT_DET) & ~(1 << bit), base + GPIO_INT_DET);
+}
+
+/*
+ * irq_chip for gpio interrupts.
+ */
+static struct irq_chip s5pxx18_gpio_irq_chip = {
+	.name = "GPIO",
+	.irq_ack = irq_gpio_ack,
+	.irq_mask = irq_gpio_mask,
+	.irq_unmask = irq_gpio_unmask,
+	.irq_set_type = irq_gpio_set_type,
+	.irq_enable = irq_gpio_enable,
+	.irq_disable = irq_gpio_disable,
+	.flags = IRQCHIP_SKIP_SET_WAKE,
+};
+
+static int s5pxx18_gpio_irq_map(struct irq_domain *h, unsigned int virq,
+				irq_hw_number_t hw)
+{
+	struct nexell_pin_bank *b = h->host_data;
+
+	pr_debug("%s domain map: virq %d and hw %d\n", __func__, virq, (int)hw);
+
+	irq_set_chip_data(virq, b);
+	irq_set_chip_and_handler(virq, &s5pxx18_gpio_irq_chip,
+				 handle_level_irq);
+	return 0;
+}
+
+/*
+ * irq domain callbacks for external gpio interrupt controller.
+ */
+static const struct irq_domain_ops s5pxx18_gpio_irqd_ops = {
+	.map = s5pxx18_gpio_irq_map, .xlate = irq_domain_xlate_twocell,
+};
+
+static irqreturn_t s5pxx18_gpio_irq_handler(int irq, void *data)
+{
+	struct nexell_pin_bank *bank = data;
+	void __iomem *base = bank->virt_base;
+	u32 stat, mask;
+	unsigned int virq;
+	int bit;
+
+	mask = readl(base + GPIO_INT_ENB);
+	stat = readl(base + GPIO_INT_STATUS) & mask;
+	bit = ffs(stat) - 1;
+
+	if (-1 == bit) {
+		pr_err("Unknown gpio irq=%d, status=0x%08x, mask=0x%08x\r\n",
+		       irq, stat, mask);
+		writel(-1, (base + GPIO_INT_STATUS)); /* clear gpio status all*/
+		return IRQ_NONE;
+	}
+
+	virq = irq_linear_revmap(bank->irq_domain, bit);
+	if (!virq)
+		return IRQ_NONE;
+
+	pr_debug("Gpio irq=%d [%d] (hw %u), stat=0x%08x, mask=0x%08x\n", irq,
+		 bit, virq, stat, mask);
+	generic_handle_irq(virq);
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * s5pxx18_gpio_irq_init() - setup handling of external gpio interrupts.
+ * @d: driver data of nexell pinctrl driver.
+ */
+static int s5pxx18_gpio_irq_init(struct nexell_pinctrl_drv_data *d)
+{
+	struct nexell_pin_bank *bank;
+	struct device *dev = d->dev;
+	int ret;
+	int i;
+
+	bank = d->ctrl->pin_banks;
+	for (i = 0; i < d->ctrl->nr_banks; ++i, ++bank) {
+		if (bank->eint_type != EINT_TYPE_GPIO)
+			continue;
+
+		ret = devm_request_irq(dev, bank->irq, s5pxx18_gpio_irq_handler,
+				       0, dev_name(dev), bank);
+		if (ret) {
+			dev_err(dev, "irq request failed\n");
+			ret = -ENXIO;
+			goto err_domains;
+		}
+
+		bank->irq_domain = irq_domain_add_linear(
+		    bank->of_node, bank->nr_pins, &s5pxx18_gpio_irqd_ops, bank);
+		if (!bank->irq_domain) {
+			dev_err(dev, "gpio irq domain add failed\n");
+			ret = -ENXIO;
+			goto err_domains;
+		}
+	}
+
+	return 0;
+
+err_domains:
+	for (--i, --bank; i >= 0; --i, --bank) {
+		if (bank->eint_type != EINT_TYPE_GPIO)
+			continue;
+		irq_domain_remove(bank->irq_domain);
+		devm_free_irq(dev, bank->irq, d);
+	}
+
+	return ret;
+}
+
+static void irq_alive_ack(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: irq=%d, hwirq=%d\n", __func__, irqd->irq, bit);
+	/* ack: irq pend clear */
+	writel(1 << bit, base + ALIVE_INT_STATUS);
+
+	ARM_DMB();
+}
+
+static void irq_alive_mask(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: irq=%d, hwirq=%d\n", __func__, irqd->irq, bit);
+	/* mask: irq reset (disable) */
+	writel((1 << bit), base + ALIVE_INT_RESET);
+}
+
+static void irq_alive_unmask(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: irq=%d, hwirq=%d\n", __func__, irqd->irq, bit);
+	writel((1 << bit), base + ALIVE_INT_SET);
+	ARM_DMB();
+}
+
+static int irq_alive_set_type(struct irq_data *irqd, unsigned int type)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+	int offs = 0, i = 0;
+	int mode = 0;
+
+	pr_debug("%s: irq=%d, hwirq=%d, type=0x%x\n", __func__, irqd->irq, bit,
+		 type);
+
+	switch (type) {
+	case IRQ_TYPE_NONE:
+		pr_warn("%s: No edge setting!\n", __func__);
+		break;
+	case IRQ_TYPE_EDGE_FALLING:
+		mode = NX_ALIVE_DETECTMODE_SYNC_FALLINGEDGE;
+		break;
+	case IRQ_TYPE_EDGE_RISING:
+		mode = NX_ALIVE_DETECTMODE_SYNC_RISINGEDGE;
+		break;
+	case IRQ_TYPE_EDGE_BOTH:
+		mode = NX_ALIVE_DETECTMODE_SYNC_FALLINGEDGE;
+		break; /* and Rising Edge */
+	case IRQ_TYPE_LEVEL_LOW:
+		mode = NX_ALIVE_DETECTMODE_ASYNC_LOWLEVEL;
+		break;
+	case IRQ_TYPE_LEVEL_HIGH:
+		mode = NX_ALIVE_DETECTMODE_ASYNC_HIGHLEVEL;
+		break;
+	default:
+		pr_err("%s: No such irq type %d", __func__, type);
+		return -1;
+	}
+
+	/* setting all alive detect mode set/reset register */
+	for (; 6 > i; i++, offs += 0x0C) {
+		u32 reg = (i == mode ? ALIVE_MOD_SET : ALIVE_MOD_RESET);
+
+		writel(1 << bit, (base + reg + offs));
+	}
+
+	/*
+	 * set risingedge mode for both edge
+	 * 0x2C : Risingedge
+	 */
+	if (IRQ_TYPE_EDGE_BOTH == type)
+		writel(1 << bit, (base + 0x2C));
+
+	writel(1 << bit, base + ALIVE_DET_SET);
+	writel(1 << bit, base + ALIVE_INT_SET);
+	writel(1 << bit, base + ALIVE_OUT_RESET);
+
+	return 0;
+}
+
+static u32 alive_wake_mask = 0xffffffff;
+
+u32 get_wake_mask(void)
+{
+	return alive_wake_mask;
+}
+
+static int irq_set_alive_wake(struct irq_data *irqd, unsigned int on)
+{
+	int bit = (int)(irqd->hwirq);
+
+	pr_info("alive wake bit[%d] %s for irq %d\n",
+		       bit, on ? "enabled" : "disabled", irqd->irq);
+
+	if (!on)
+		alive_wake_mask |= bit;
+	else
+		alive_wake_mask &= ~bit;
+
+	return 0;
+}
+
+static void irq_alive_enable(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: irq=%d, io=%s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+	/* unmask:irq set (enable) */
+	writel((1 << bit), base + ALIVE_INT_SET);
+	ARM_DMB();
+}
+
+static void irq_alive_disable(struct irq_data *irqd)
+{
+	struct nexell_pin_bank *bank = irq_data_get_irq_chip_data(irqd);
+	int bit = (int)(irqd->hwirq);
+	void __iomem *base = bank->virt_base;
+
+	pr_debug("%s: irq=%d, io=%s.%d\n", __func__, bank->irq, bank->name,
+		 bit);
+	/* mask:irq reset (disable) */
+	writel((1 << bit), base + ALIVE_INT_RESET);
+}
+
+/*
+ * irq_chip for wakeup interrupts
+ */
+static struct irq_chip s5pxx18_alive_irq_chip = {
+	.name = "ALIVE",
+	.irq_ack = irq_alive_ack,
+	.irq_mask = irq_alive_mask,
+	.irq_unmask = irq_alive_unmask,
+	.irq_set_type = irq_alive_set_type,
+	.irq_set_wake = irq_set_alive_wake,
+	.irq_enable = irq_alive_enable,
+	.irq_disable = irq_alive_disable,
+};
+
+static irqreturn_t s5pxx18_alive_irq_handler(int irq, void *data)
+{
+	struct nexell_pin_bank *bank = data;
+	void __iomem *base = bank->virt_base;
+	u32 stat, mask;
+	unsigned int virq;
+	int bit;
+
+	mask = readl(base + ALIVE_INT_SET_READ);
+	stat = readl(base + ALIVE_INT_STATUS) & mask;
+	bit = ffs(stat) - 1;
+
+	if (-1 == bit) {
+		pr_err("Unknown alive irq=%d, status=0x%08x, mask=0x%08x\r\n",
+		       irq, stat, mask);
+		writel(-1, (base + ALIVE_INT_STATUS)); /* clear alive status */
+		return IRQ_NONE;
+	}
+
+	virq = irq_linear_revmap(bank->irq_domain, bit);
+	pr_debug("alive irq=%d [%d] (hw %u), stat=0x%08x, mask=0x%08x\n", irq,
+		 bit, virq, stat, mask);
+	if (!virq)
+		return IRQ_NONE;
+
+	generic_handle_irq(virq);
+
+	return IRQ_HANDLED;
+}
+
+static int s5pxx18_alive_irq_map(struct irq_domain *h, unsigned int virq,
+				 irq_hw_number_t hw)
+{
+	pr_debug("%s domain map: virq %d and hw %d\n", __func__, virq, (int)hw);
+
+	irq_set_chip_and_handler(virq, &s5pxx18_alive_irq_chip,
+				 handle_level_irq);
+	irq_set_chip_data(virq, h->host_data);
+	return 0;
+}
+
+static const struct irq_domain_ops s5pxx18_alive_irqd_ops = {
+	.map = s5pxx18_alive_irq_map, .xlate = irq_domain_xlate_twocell,
+};
+
+/*
+ * s5pxx18_alive_irq_init() - setup handling of wakeup interrupts.
+ * @d: driver data of nexell pinctrl driver.
+ */
+static int s5pxx18_alive_irq_init(struct nexell_pinctrl_drv_data *d)
+{
+	struct nexell_pin_bank *bank;
+	struct device *dev = d->dev;
+	int ret;
+	int i;
+
+	bank = d->ctrl->pin_banks;
+	for (i = 0; i < d->ctrl->nr_banks; ++i, ++bank) {
+		void __iomem *base = bank->virt_base;
+
+		if (bank->eint_type != EINT_TYPE_WKUP)
+			continue;
+
+		/* clear pending, disable irq detect */
+		writel(-1, base + ALIVE_INT_RESET);
+		writel(-1, base + ALIVE_INT_STATUS);
+
+		ret =
+		    devm_request_irq(dev, bank->irq, s5pxx18_alive_irq_handler,
+				     0, dev_name(dev), bank);
+		if (ret) {
+			dev_err(dev, "irq request failed\n");
+			ret = -ENXIO;
+			goto err_domains;
+		}
+
+		bank->irq_domain =
+		    irq_domain_add_linear(bank->of_node, bank->nr_pins,
+					  &s5pxx18_alive_irqd_ops, bank);
+		if (!bank->irq_domain) {
+			dev_err(dev, "gpio irq domain add failed\n");
+			ret = -ENXIO;
+			goto err_domains;
+		}
+	}
+
+	return 0;
+
+err_domains:
+	for (--i, --bank; i >= 0; --i, --bank) {
+		if (bank->eint_type != EINT_TYPE_WKUP)
+			continue;
+		irq_domain_remove(bank->irq_domain);
+		devm_free_irq(dev, bank->irq, d);
+	}
+
+	return ret;
+}
+
+static void s5pxx18_suspend(struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+	int nr_banks = ctrl->nr_banks;
+	int i;
+
+	for (i = 0; i < nr_banks; i++) {
+		struct nexell_pin_bank *bank = &ctrl->pin_banks[i];
+
+		if (bank->eint_type == EINT_TYPE_WKUP) {
+			s5pxx18_alive_suspend();
+			continue;
+		}
+
+		if (bank->eint_type != EINT_TYPE_GPIO)
+			continue;
+
+		if (s5pxx18_gpio_suspend(i) < 0)
+			dev_err(drvdata->dev, "failed to suspend bank %d\n", i);
+	}
+
+	nx_alive_clear_wakeup_status();
+}
+
+
+static const char *wake_event_name[] = {
+	[0] = "VDDPOWER",
+	[1] = "RTC",
+	[2] = "ALIVE 0",
+	[3] = "ALIVE 1",
+	[4] = "ALIVE 2",
+	[5] = "ALIVE 3",
+	[6] = "ALIVE 4",
+	[7] = "ALIVE 5",
+};
+
+#define	WAKE_EVENT_NUM	ARRAY_SIZE(wake_event_name)
+
+static void print_wake_event(void)
+{
+	int i = 0;
+	u32 wake_status = nx_alive_get_wakeup_status();
+
+	for (i = 0; WAKE_EVENT_NUM > i; i++) {
+		if (wake_status & (1 << i))
+			pr_notice("WAKE SOURCE [%s]\n", wake_event_name[i]);
+	}
+}
+
+static void s5pxx18_resume(struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+	int nr_banks = ctrl->nr_banks;
+	int i;
+
+	for (i = 0; i < nr_banks; i++) {
+		struct nexell_pin_bank *bank = &ctrl->pin_banks[i];
+
+		if (bank->eint_type == EINT_TYPE_WKUP) {
+			s5pxx18_alive_resume();
+			continue;
+		}
+
+		if (bank->eint_type != EINT_TYPE_GPIO)
+			continue;
+
+		if (s5pxx18_gpio_resume(i) < 0)
+			dev_err(drvdata->dev, "failed to resume bank %d\n", i);
+	}
+
+	print_wake_event();
+}
+
+static int s5pxx18_base_init(struct nexell_pinctrl_drv_data *drvdata)
+{
+	struct nexell_pin_ctrl *ctrl = drvdata->ctrl;
+	int nr_banks = ctrl->nr_banks;
+	int ret;
+	int i;
+	struct module_init_data *init_data, *n;
+	LIST_HEAD(banks);
+
+	for (i = 0; i < nr_banks; i++) {
+		struct nexell_pin_bank *bank = &ctrl->pin_banks[i];
+
+		init_data = kmalloc(sizeof(*init_data), GFP_KERNEL);
+		if (!init_data) {
+			ret = -ENOMEM;
+			goto done;
+		}
+
+		INIT_LIST_HEAD(&init_data->node);
+		init_data->bank_base = bank->virt_base;
+		init_data->bank_type = bank->eint_type;
+
+		list_add_tail(&init_data->node, &banks);
+	}
+
+	s5pxx18_gpio_device_init(&banks, nr_banks);
+
+done:
+	/* free */
+	list_for_each_entry_safe(init_data, n, &banks, node) {
+		list_del(&init_data->node);
+		kfree(init_data);
+	}
+
+	return 0;
+}
+
+/* pin banks of s5pxx18 pin-controller 0 */
+static struct nexell_pin_bank s5pxx18_pin_banks[] = {
+	SOC_PIN_BANK_EINTG(32, 0xA000, "gpioa"),
+	SOC_PIN_BANK_EINTG(32, 0xB000, "gpiob"),
+	SOC_PIN_BANK_EINTG(32, 0xC000, "gpioc"),
+	SOC_PIN_BANK_EINTG(32, 0xD000, "gpiod"),
+	SOC_PIN_BANK_EINTG(32, 0xE000, "gpioe"),
+	SOC_PIN_BANK_EINTW(6, 0x0800, "alive"),
+};
+
+/*
+ * Nexell pinctrl driver data for SoC.
+ */
+const struct nexell_pin_ctrl s5pxx18_pin_ctrl[] = {
+	{
+		.pin_banks = s5pxx18_pin_banks,
+		.nr_banks = ARRAY_SIZE(s5pxx18_pin_banks),
+		.base_init = s5pxx18_base_init,
+		.gpio_irq_init = s5pxx18_gpio_irq_init,
+		.alive_irq_init = s5pxx18_alive_irq_init,
+		.suspend = s5pxx18_suspend,
+		.resume = s5pxx18_resume,
+	}
+};
diff -ENwbur a/drivers/pinctrl/nexell/pinctrl-s5pxx18.h b/drivers/pinctrl/nexell/pinctrl-s5pxx18.h
--- a/drivers/pinctrl/nexell/pinctrl-s5pxx18.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/pinctrl-s5pxx18.h	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define SOC_PIN_BANK_EINTN(pins, reg, id)		\
+	{						\
+		.pctl_offset	= reg,			\
+		.nr_pins	= pins,			\
+		.eint_type	= EINT_TYPE_NONE,	\
+		.name		= id			\
+	}
+
+#define SOC_PIN_BANK_EINTG(pins, reg, id)	\
+	{							\
+		.pctl_offset	= reg,				\
+		.nr_pins	= pins,				\
+		.eint_type	= EINT_TYPE_GPIO,		\
+		.name		= id				\
+	}
+
+#define SOC_PIN_BANK_EINTW(pins, reg, id)	\
+	{							\
+		.pctl_offset	= reg,				\
+		.nr_pins	= pins,				\
+		.eint_type	= EINT_TYPE_WKUP,		\
+		.name		= id				\
+	}
+
+
+#define GPIO_INT_OUT (0x04)
+#define GPIO_INT_MODE0 (0x08) /* 0x08,0x0C */
+#define GPIO_INT_MODE1 (0x28)
+#define GPIO_INT_ENB (0x10)
+#define GPIO_INT_STATUS (0x14)
+#define GPIO_INT_ALT (0x20) /* 0x20,0x24 */
+#define GPIO_INT_DET (0x3C)
+
+#define ALIVE_MOD_RESET (0x04) /* detect mode reset */
+#define ALIVE_MOD_SET (0x08)   /* detect mode set */
+#define ALIVE_MOD_READ (0x0C)  /* detect mode read */
+#define ALIVE_DET_RESET (0x4C)
+#define ALIVE_DET_SET (0x50)
+#define ALIVE_DET_READ (0x54)
+#define ALIVE_INT_RESET (0x58)    /* interrupt reset : disable */
+#define ALIVE_INT_SET (0x5C)      /* interrupt set   : enable */
+#define ALIVE_INT_SET_READ (0x60) /* interrupt set read */
+#define ALIVE_INT_STATUS (0x64)   /* interrupt detect pending and clear */
+#define ALIVE_OUT_RESET (0x74)
+#define ALIVE_OUT_SET (0x78)
+#define ALIVE_OUT_READ (0x7C)
+
+/* alive interrupt detect type */
+#define NX_ALIVE_DETECTMODE_ASYNC_LOWLEVEL 0
+#define NX_ALIVE_DETECTMODE_ASYNC_HIGHLEVEL 1
+#define NX_ALIVE_DETECTMODE_SYNC_FALLINGEDGE 2
+#define NX_ALIVE_DETECTMODE_SYNC_RISINGEDGE 3
+#define NX_ALIVE_DETECTMODE_SYNC_LOWLEVEL 4
+#define NX_ALIVE_DETECTMODE_SYNC_HIGHLEVEL 5
+
+/* gpio interrupt detect type */
+#define NX_GPIO_INTMODE_LOWLEVEL 0
+#define NX_GPIO_INTMODE_HIGHLEVEL 1
+#define NX_GPIO_INTMODE_FALLINGEDGE 2
+#define NX_GPIO_INTMODE_RISINGEDGE 3
+#define NX_GPIO_INTMODE_BOTHEDGE 4
+
+#define NX_GPIO_PADFUNC_0 0
+#define NX_GPIO_PADFUNC_1 1
+#define NX_GPIO_PADFUNC_2 2
+#define NX_GPIO_PADFUNC_3 3
+
+#define NX_GPIO_DRVSTRENGTH_0 0
+#define NX_GPIO_DRVSTRENGTH_1 1
+#define NX_GPIO_DRVSTRENGTH_2 2
+#define NX_GPIO_DRVSTRENGTH_3 3
+
+#define NX_GPIO_PULL_DOWN 0
+#define NX_GPIO_PULL_UP 1
+#define NX_GPIO_PULL_OFF 2
+
+#ifdef CONFIG_ARM64
+#define ARM_DMB() dmb(sy)
+#else
+#define ARM_DMB() dmb()
+#endif
+
+
diff -ENwbur a/drivers/pinctrl/nexell/s5pxx18-gpio.h b/drivers/pinctrl/nexell/s5pxx18-gpio.h
--- a/drivers/pinctrl/nexell/s5pxx18-gpio.h	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/pinctrl/nexell/s5pxx18-gpio.h	2018-05-06 08:49:50.838762778 +0200
@@ -0,0 +1,520 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __S5Pxx18_GPIO_H
+#define __S5Pxx18_GPIO_H
+
+#define PAD_MD_POS 0
+#define PAD_MD_MASK 0xF
+
+#define PAD_FN_POS 4
+#define PAD_FN_MASK 0xF
+
+#define PAD_LV_POS 8
+#define PAD_LV_MASK 0xF
+
+#define PAD_PU_POS 12
+#define PAD_PU_MASK 0xF
+
+#define PAD_ST_POS 16
+#define PAD_ST_MASK 0xF
+
+#define PIN_MODE_ALT (0)
+#define PIN_MODE_IN (1)
+#define PIN_MODE_OUT (2)
+#define PIN_MODE_INT (3)
+
+#define PIN_FUNC_ALT0 (0)
+#define PIN_FUNC_ALT1 (1)
+#define PIN_FUNC_ALT2 (2)
+#define PIN_FUNC_ALT3 (3)
+
+#define PIN_LEVEL_LOW (0)		/* if alive, async lowlevel */
+#define PIN_LEVEL_HIGH (1)		/* if alive, async highlevel */
+#define PIN_LEVEL_FALLINGEDGE (2)	/* if alive, async fallingedge */
+#define PIN_LEVEL_RISINGEDGE (3)	/* if alive, async eisingedge */
+#define PIN_LEVEL_LOW_SYNC (4)		/* if gpio , not support */
+#define PIN_LEVEL_HIGH_SYNC (5)		/* if gpio , not support */
+#define PIN_LEVEL_BOTHEDGE (4)		/* if alive, not support */
+#define PIN_LEVEL_ALT (6)		/* if pad function is alt, not set */
+
+#define PIN_PULL_DN (0)			/* Do not support Alive-GPIO */
+#define PIN_PULL_UP (1)
+#define PIN_PULL_OFF (2)
+
+#define PIN_STRENGTH_0 (0)
+#define PIN_STRENGTH_1 (1)
+#define PIN_STRENGTH_2 (2)
+#define PIN_STRENGTH_3 (3)
+
+#define PAD_MODE_ALT ((PIN_MODE_ALT & PAD_MD_MASK) << PAD_MD_POS)
+#define PAD_MODE_IN ((PIN_MODE_IN & PAD_MD_MASK) << PAD_MD_POS)
+#define PAD_MODE_OUT ((PIN_MODE_OUT & PAD_MD_MASK) << PAD_MD_POS)
+#define PAD_MODE_INT ((PIN_MODE_INT & PAD_MD_MASK) << PAD_MD_POS)
+
+#define PAD_FUNC_ALT0 ((PIN_FUNC_ALT0 & PAD_FN_MASK) << PAD_FN_POS)
+#define PAD_FUNC_ALT1 ((PIN_FUNC_ALT1 & PAD_FN_MASK) << PAD_FN_POS)
+#define PAD_FUNC_ALT2 ((PIN_FUNC_ALT2 & PAD_FN_MASK) << PAD_FN_POS)
+#define PAD_FUNC_ALT3 ((PIN_FUNC_ALT3 & PAD_FN_MASK) << PAD_FN_POS)
+
+#define PAD_LEVEL_LOW                                                          \
+	((PIN_LEVEL_LOW & PAD_LV_MASK)                                         \
+	 << PAD_LV_POS) /* if alive, async lowlevel */
+#define PAD_LEVEL_HIGH                                                         \
+	((PIN_LEVEL_HIGH & PAD_LV_MASK)                                        \
+	 << PAD_LV_POS) /* if alive, async highlevel */
+#define PAD_LEVEL_FALLINGEDGE                                                  \
+	((PIN_LEVEL_FALLINGEDGE & PAD_LV_MASK)                                 \
+	 << PAD_LV_POS) /* if alive, async fallingedge */
+#define PAD_LEVEL_RISINGEDGE                                                   \
+	((PIN_LEVEL_RISINGEDGE & PAD_LV_MASK)                                  \
+	 << PAD_LV_POS) /* if alive, async eisingedge */
+#define PAD_LEVEL_LOW_SYNC                                                     \
+	((PIN_LEVEL_LOW_SYNC & PAD_LV_MASK)                                    \
+	 << PAD_LV_POS) /* if gpio , not support */
+#define PAD_LEVEL_HIGH_SYNC                                                    \
+	((PIN_LEVEL_HIGH_SYNC & PAD_LV_MASK)                                   \
+	 << PAD_LV_POS) /* if gpio , not support */
+#define PAD_LEVEL_BOTHEDGE                                                     \
+	((PIN_LEVEL_BOTHEDGE & PAD_LV_MASK)                                    \
+	 << PAD_LV_POS) /* if alive, not support */
+#define PAD_LEVEL_ALT                                                          \
+	((PIN_LEVEL_ALT & PAD_LV_MASK)                                         \
+	 << PAD_LV_POS) /* if pad function is alt, not set */
+
+#define PAD_PULL_DN                                                            \
+	((PIN_PULL_DN & PAD_PU_MASK)                                           \
+	 << PAD_PU_POS) /* Do not support Alive-GPIO */
+#define PAD_PULL_UP ((PIN_PULL_UP & PAD_PU_MASK) << PAD_PU_POS)
+#define PAD_PULL_OFF ((PIN_PULL_OFF & PAD_PU_MASK) << PAD_PU_POS)
+
+#define PAD_STRENGTH_0 ((PIN_STRENGTH_0 & PAD_ST_MASK) << PAD_ST_POS)
+#define PAD_STRENGTH_1 ((PIN_STRENGTH_1 & PAD_ST_MASK) << PAD_ST_POS)
+#define PAD_STRENGTH_2 ((PIN_STRENGTH_2 & PAD_ST_MASK) << PAD_ST_POS)
+#define PAD_STRENGTH_3 ((PIN_STRENGTH_3 & PAD_ST_MASK) << PAD_ST_POS)
+
+#define PAD_GET_GROUP(pin) ((pin >> 0x5) & 0x07) /* Divide 32 */
+#define PAD_GET_BITNO(pin) (pin & 0x1F)
+#define PAD_GET_FUNC(pin) ((pin >> PAD_FN_POS) & PAD_FN_MASK)
+#define PAD_GET_MODE(pin) ((pin >> PAD_MD_POS) & PAD_MD_MASK)
+#define PAD_GET_LEVEL(pin) ((pin >> PAD_LV_POS) & PAD_LV_MASK)
+#define PAD_GET_PULLUP(pin) ((pin >> PAD_PU_POS) & PAD_PU_MASK)
+#define PAD_GET_STRENGTH(pin) ((pin >> PAD_ST_POS) & PAD_ST_MASK)
+
+#define PAD_GPIO_A (0 * 32)
+#define PAD_GPIO_B (1 * 32)
+#define PAD_GPIO_C (2 * 32)
+#define PAD_GPIO_D (3 * 32)
+#define PAD_GPIO_E (4 * 32)
+#define PAD_GPIO_ALV (5 * 32)
+
+/*
+ * gpio descriptor
+ */
+#define IO_ALT_0 (0)
+#define IO_ALT_1 (1)
+#define IO_ALT_2 (2)
+#define IO_ALT_3 (3)
+
+/* s5pxx18 GPIO function number */
+
+#define ALT_NO_GPIO_A                                                          \
+	{                                                                      \
+		IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,    \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0,                                                  \
+	}
+
+#define ALT_NO_GPIO_B                                                          \
+	{                                                                      \
+		IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,    \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_2, IO_ALT_2, IO_ALT_1, IO_ALT_2, IO_ALT_1,          \
+		    IO_ALT_2, IO_ALT_1, IO_ALT_2, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1,                                                  \
+	}
+
+#define ALT_NO_GPIO_C                                                          \
+	{                                                                      \
+		IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,    \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0,                                                  \
+	}
+
+#define ALT_NO_GPIO_D                                                          \
+	{                                                                      \
+		IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,    \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0,                                                  \
+	}
+
+#define ALT_NO_GPIO_E                                                          \
+	{                                                                      \
+		IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,    \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_1,          \
+		    IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1, IO_ALT_1,          \
+		    IO_ALT_1,                                                  \
+	}
+
+#define ALT_NO_ALIVE                                                           \
+	{                                                                      \
+		IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,    \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0, IO_ALT_0,          \
+		    IO_ALT_0,                                                  \
+	}
+
+#define GPIO_NUM_PER_BANK (32)
+
+#define NUMBER_OF_GPIO_MODULE 5
+
+#define nx_gpio_intmode_lowlevel 1
+#define nx_gpio_intmode_highlevel 2
+#define nx_gpio_intmode_fallingedge 2
+#define nx_gpio_intmode_risingedge 3
+#define nx_gpio_intmode_bothedge 4
+
+#define nx_gpio_padfunc_0 0
+#define nx_gpio_padfunc_1 1
+#define nx_gpio_padfunc_2 2
+#define nx_gpio_padfunc_3 3
+
+#define nx_gpio_drvstrength_0 0
+#define nx_gpio_drvstrength_1 1
+#define nx_gpio_drvstrength_2 2
+#define nx_gpio_drvstrength_3 3
+
+#define nx_gpio_pull_down 0
+#define nx_gpio_pull_up 1
+#define nx_gpio_pull_off 2
+
+/* GPIO Module's Register List */
+struct nx_gpio_reg_set {
+	/* 0x00	: Output Register */
+	u32 GPIOxOUT;
+	/* 0x04	: Output Enable Register */
+	u32 GPIOxOUTENB;
+	/* 0x08	: Event Detect Mode Register */
+	u32 GPIOxDETMODE[2];
+	/* 0x10	: Interrupt Enable Register */
+	u32 GPIOxINTENB;
+	/* 0x14	: Event Detect Register */
+	u32 GPIOxDET;
+	/* 0x18	: PAD Status Register */
+	u32 GPIOxPAD;
+	/* 0x1C	: Pull Up Enable Register */
+	u32 GPIOxPUENB;
+	/* 0x20	: Alternate Function Select Register */
+	u32 GPIOxALTFN[2];
+	/* 0x28	: Event Detect Mode extended Register */
+	u32 GPIOxDETMODEEX;
+	/* 0x2B	: */
+	u32 __Reserved[4];
+	/* 0x3C	: IntPend Detect Enable Register */
+	u32 GPIOxDETENB;
+
+	/* 0x40	: Slew Register */
+	u32 GPIOx_SLEW;
+	/* 0x44	: Slew set On/Off Register */
+	u32 GPIOx_SLEW_DISABLE_DEFAULT;
+	/* 0x48	: drive strength LSB Register */
+	u32 GPIOx_DRV1;
+	/* 0x4C	: drive strength LSB set On/Off Register */
+	u32 GPIOx_DRV1_DISABLE_DEFAULT;
+	/* 0x50	: drive strength MSB Register */
+	u32 GPIOx_DRV0;
+	/* 0x54	: drive strength MSB set On/Off Register */
+	u32 GPIOx_DRV0_DISABLE_DEFAULT;
+	/* 0x58	: Pull UP/DOWN Selection Register */
+	u32 GPIOx_PULLSEL;
+	/* 0x5C	: Pull UP/DOWN Selection On/Off Register */
+	u32 GPIOx_PULLSEL_DISABLE_DEFAULT;
+	/* 0x60	: Pull Enable/Disable Register */
+	u32 GPIOx_PULLENB;
+	/* 0x64	: Pull Enable/Disable selection On/Off Register */
+	u32 GPIOx_PULLENB_DISABLE_DEFAULT;
+	/* 0x68 */
+	u32 GPIOx_InputMuxSelect0;
+	/* 0x6C */
+	u32 GPIOx_InputMuxSelect1;
+};
+
+struct module_init_data {
+	struct list_head node;
+	void *bank_base;
+	int bank_type;		/* 0: none, 1: gpio, 2: alive */
+};
+
+/*
+ * nx_alive
+ */
+
+/* ALIVE Interrupts for interrupt interface */
+#define nx_alive_int_alivegpio0 0
+#define nx_alive_int_alivegpio1 1
+#define nx_alive_int_alivegpio2 2
+#define nx_alive_int_alivegpio3 3
+#define nx_alive_int_alivegpio4 4
+#define nx_alive_int_alivegpio5 5
+#define nx_alive_int_alivegpio6 6
+#define nx_alive_int_alivegpio7 7
+
+/* ALIVE GPIO Detect Mode */
+#define nx_alive_detect_mode_async_lowlevel 0
+#define nx_alive_detect_mode_async_highlevel 1
+#define nx_alive_detect_mode_sync_fallingedge 2
+#define nx_alive_detect_mode_sync_risingedge 3
+#define nx_alive_detect_mode_sync_lowlevel 4
+#define nx_alive_detect_mode_sync_highlevel 5
+
+#define nx_alive_number_of_gpio 6
+
+struct nx_alive_reg_set {
+	/* 0x00 : Alive Power Gating Register */
+	u32 ALIVEPWRGATEREG;
+	/* 0x04 : Alive GPIO ASync Detect Mode Reset Register0 */
+	u32 ALIVEGPIOASYNCDETECTMODERSTREG0;
+	/* 0x08 : Alive GPIO gASync Detect Mode Set gRegister0 */
+	u32 ALIVEGPIOASYNCDETECTMODESETREG0;
+	/* 0x0C : Alive GPIO gLow ASync Detect gMode Read Register */
+	u32 ALIVEGPIOLOWASYNCDETECTMODEREADREG;
+
+	/* 0x10 : Alive GPIO gASync Detect Mode Reset gRegister1 */
+	u32 ALIVEGPIOASYNCDETECTMODERSTREG1;
+	/* 0x14 : Alive GPIO gASync Detect Mode Set gRegister1 */
+	u32 ALIVEGPIOASYNCDETECTMODESETREG1;
+	/* 0x18 : Alive GPIO gHigh ASync Detect gMode Read Register */
+	u32 ALIVEGPIOHIGHASYNCDETECTMODEREADREG;
+
+	/* 0x1C : Alive GPIO Detect gMode Reset Register0 */
+	u32 ALIVEGPIODETECTMODERSTREG0;
+	/* 0x20 : Alive GPIO Detect gMode Reset Register0 */
+	u32 ALIVEGPIODETECTMODESETREG0;
+	/* 0x24 : Alive GPIO gFalling Edge Detect Mode gRead Register */
+	u32 ALIVEGPIOFALLDETECTMODEREADREG;
+
+	/* 0x28 : Alive GPIO Detect Mode Reset Register1 */
+	u32 ALIVEGPIODETECTMODERSTREG1;
+	/* 0x2C : Alive GPIO Detect Mode Reset Register1 */
+	u32 ALIVEGPIODETECTMODESETREG1;
+	/* 0x30 : Alive GPIO Rising Edge Detect Mode Read Register */
+	u32 ALIVEGPIORISEDETECTMODEREADREG;
+
+	/* 0x34 : Alive GPIO Detect Mode Reset Register2 */
+	u32 ALIVEGPIODETECTMODERSTREG2;
+	/* 0x38 : Alive GPIO Detect Mode Reset Register2 */
+	u32 ALIVEGPIODETECTMODESETREG2;
+	/* 0x3C : Alive GPIO Low Level Detect Mode Read gRegister */
+	u32 ALIVEGPIOLOWDETECTMODEREADREG;
+
+	/* 0x40 : Alive GPIO Detect Mode Reset Register3 */
+	u32 ALIVEGPIODETECTMODERSTREG3;
+	/* 0x44 : Alive GPIO Detect Mode Reset Register3 */
+	u32 ALIVEGPIODETECTMODESETREG3;
+	/* 0x48 : Alive GPIO High Level Detect Mode Read gRegister */
+	u32 ALIVEGPIOHIGHDETECTMODEREADREG;
+
+	/* 0x4C : Alive GPIO Detect Enable Reset Register */
+	u32 ALIVEGPIODETECTENBRSTREG;
+	/* 0x50 : Alive GPIO Detect Enable Set Register */
+	u32 ALIVEGPIODETECTENBSETREG;
+	/* 0x54 : Alive GPIO Detect Enable Read Register */
+	u32 ALIVEGPIODETECTENBREADREG;
+
+	/* 0x58 : Alive GPIO Interrupt Enable Reset Register */
+	u32 ALIVEGPIOINTENBRSTREG;
+	/* 0x5C : Alive GPIO Interrupt Enable Set Register */
+	u32 ALIVEGPIOINTENBSETREG;
+	/* 0x60 : Alive GPIO Interrupt Enable Read Register */
+	u32 ALIVEGPIOINTENBREADREG;
+
+	/* 0x64 : Alive GPIO Detect Pending Register */
+	u32 ALIVEGPIODETECTPENDREG;
+
+	/* 0x68 : Alive Scratch Reset Register */
+	u32 ALIVESCRATCHRSTREG;
+	/* 0x6C : Alive Scratch Set Register */
+	u32 ALIVESCRATCHSETREG;
+	/* 0x70 : Alive Scratch Read Register */
+	u32 ALIVESCRATCHREADREG;
+
+	/* 0x74 : Alive GPIO PAD Out Enable Reset Register */
+	u32 ALIVEGPIOPADOUTENBRSTREG;
+	/* 0x78 : Alive GPIO PAD Out Enable Set Register */
+	u32 ALIVEGPIOPADOUTENBSETREG;
+	/* 0x7C : Alive GPIO PAD Out Enable Read Register */
+	u32 ALIVEGPIOPADOUTENBREADREG;
+
+	/* 0x80 : Alive GPIO PAD Pullup Reset Register */
+	u32 ALIVEGPIOPADPULLUPRSTREG;
+	/* 0x84 : Alive GPIO PAD Pullup Set Register */
+	u32 ALIVEGPIOPADPULLUPSETREG;
+	/* 0x88 : Alive GPIO PAD Pullup Read Register */
+	u32 ALIVEGPIOPADPULLUPREADREG;
+
+	/* 0x8C : Alive GPIO PAD Out Reset Register */
+	u32 ALIVEGPIOPADOUTRSTREG;
+	/* 0x90 : Alive GPIO PAD Out Set Register */
+	u32 ALIVEGPIOPADOUTSETREG;
+	/* 0x94 : Alive GPIO PAD Out Read Register */
+	u32 ALIVEGPIOPADOUTREADREG;
+
+	/*  0x98 : VDD Control Reset Register */
+	u32 VDDCTRLRSTREG;
+	/*  0x9C : VDD Control Set Register */
+	u32 VDDCTRLSETREG;
+	/* 0xA0 : VDD Control Read Register */
+	u32 VDDCTRLREADREG;
+
+	/* 0x0A4 :  wCS[41] */
+	u32 CLEARWAKEUPSTATUS;
+	/* 0x0A8 :  wCS[42] */
+	u32 WAKEUPSTATUS;
+
+	/* 0x0AC :  wCS[43] */
+	u32 ALIVESCRATCHRST1;
+	/* 0x0B0 :  wCS[44] */
+	u32 ALIVESCRATCHSET1;
+	/* 0x0B4 :  wCS[45] */
+	u32 ALIVESCRATCHVALUE1;
+
+	/* 0x0B8 :  wCS[46] */
+	u32 ALIVESCRATCHRST2;
+	/* 0x0BC :  wCS[47] */
+	u32 ALIVESCRATCHSET2;
+	/* 0x0C0 :  wCS[48] */
+	u32 ALIVESCRATCHVALUE2;
+
+	/* 0x0C4 :  wCS[49] */
+	u32 ALIVESCRATCHRST3;
+	/* 0x0C8 :  wCS[50] */
+	u32 ALIVESCRATCHSET3;
+	/* 0x0CC :  wCS[51] */
+	u32 ALIVESCRATCHVALUE3;
+
+	/* 0x0D0 :  wCS[52] */
+	u32 ALIVESCRATCHRST4;
+	/* 0x0D4 :  wCS[53] */
+	u32 ALIVESCRATCHSET4;
+	/* 0x0D8 :  wCS[54] */
+	u32 ALIVESCRATCHVALUE4;
+
+	/* 0x0DC :  wCS[55] */
+	u32 ALIVESCRATCHRST5;
+	/* 0x0E0 :  wCS[56] */
+	u32 ALIVESCRATCHSET5;
+	/* 0x0E4 :  wCS[57] */
+	u32 ALIVESCRATCHVALUE5;
+
+	/* 0x0E8 :  wCS[58] */
+	u32 ALIVESCRATCHRST6;
+	/* 0x0EC :  wCS[59] */
+	u32 ALIVESCRATCHSET6;
+	/* 0x0F0 :  wCS[60] */
+	u32 ALIVESCRATCHVALUE6;
+
+	/* 0x0F4 :  wCS[61] */
+	u32 ALIVESCRATCHRST7;
+	/* 0x0F8 :  wCS[62] */
+	u32 ALIVESCRATCHSET7;
+	/* 0x0FC :  wCS[63] */
+	u32 ALIVESCRATCHVALUE7;
+
+	/* 0x100 :  wCS[64] */
+	u32 ALIVESCRATCHRST8;
+	/* 0x104 :  wCS[65] */
+	u32 ALIVESCRATCHSET8;
+	/* 0x108 :  wCS[66] */
+	u32 ALIVESCRATCHVALUE8;
+
+	/* 0x10C :  wCS[67] */
+	u32 VDDOFFCNTVALUERST;
+	/* 0x110 :  wCS[68] */
+	u32 VDDOFFCNTVALUESET;
+
+	/* 0x114 :  wCS[69] */
+	u32 VDDOFFCNTVALUE0;
+	/* 0x118 :  wCS[70] */
+	u32 VDDOFFCNTVALUE1;
+
+	/* 0x11C :  wCS[71] */
+	u32 ALIVEGPIOINPUTVALUE;
+};
+
+/*
+ * nx_soc functions
+ */
+extern void nx_soc_gpio_set_io_func(unsigned int io, unsigned int func);
+extern int nx_soc_gpio_get_altnum(unsigned int io);
+extern unsigned int nx_soc_gpio_get_io_func(unsigned int io);
+extern void nx_soc_gpio_set_io_dir(unsigned int io, int out);
+extern int nx_soc_gpio_get_io_dir(unsigned int io);
+extern void nx_soc_gpio_set_io_pull(unsigned int io, int val);
+extern int nx_soc_gpio_get_io_pull(unsigned int io);
+extern void nx_soc_gpio_set_io_drv(int gpio, int mode);
+extern int nx_soc_gpio_get_io_drv(int gpio);
+extern void nx_soc_gpio_set_out_value(unsigned int io, int high);
+extern int nx_soc_gpio_get_out_value(unsigned int io);
+extern int nx_soc_gpio_get_in_value(unsigned int io);
+extern void nx_soc_gpio_set_int_enable(unsigned int io, int on);
+extern int nx_soc_gpio_get_int_enable(unsigned int io);
+extern void nx_soc_gpio_set_int_mode(unsigned int io, unsigned int mode);
+extern int nx_soc_gpio_get_int_mode(unsigned int io);
+extern int nx_soc_gpio_get_int_pend(unsigned int io);
+extern void nx_soc_gpio_clr_int_pend(unsigned int io);
+
+extern void nx_soc_alive_set_det_enable(unsigned int io, int on);
+extern int nx_soc_alive_get_det_enable(unsigned int io);
+extern void nx_soc_alive_set_det_mode(unsigned int io, unsigned int mode,
+				      int on);
+extern int nx_soc_alive_get_det_mode(unsigned int io, unsigned int mode);
+extern int nx_soc_alive_get_int_pend(unsigned int io);
+extern void nx_soc_alive_clr_int_pend(unsigned int io);
+
+extern int s5pxx18_gpio_device_init(struct list_head *banks, int nr_banks);
+
+extern int s5pxx18_gpio_suspend(int idx);
+extern int s5pxx18_gpio_resume(int idx);
+
+extern int s5pxx18_alive_suspend(void);
+extern int s5pxx18_alive_resume(void);
+
+extern u32 nx_alive_get_wakeup_status(void);
+extern void nx_alive_clear_wakeup_status(void);
+
+#endif /* __S5Pxx18_GPIO_H */
diff -ENwbur a/drivers/pwm/Kconfig b/drivers/pwm/Kconfig
--- a/drivers/pwm/Kconfig	2018-05-06 08:47:38.013371896 +0200
+++ b/drivers/pwm/Kconfig	2018-05-06 08:49:50.894765050 +0200
@@ -380,7 +380,7 @@

 config PWM_SAMSUNG
 	tristate "Samsung PWM support"
-	depends on PLAT_SAMSUNG || ARCH_EXYNOS
+	depends on PLAT_SAMSUNG || ARCH_EXYNOS || ARCH_S5P4418 || ARCH_S5P6818
 	help
 	  Generic PWM framework driver for Samsung.

diff -ENwbur a/drivers/pwm/pwm-samsung.c b/drivers/pwm/pwm-samsung.c
--- a/drivers/pwm/pwm-samsung.c	2018-05-06 08:47:38.017372059 +0200
+++ b/drivers/pwm/pwm-samsung.c	2018-05-06 08:49:50.898765212 +0200
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/time.h>
+#include <linux/reset.h>

 /* For struct samsung_timer_variant and samsung_pwm_lock. */
 #include <clocksource/samsung_pwm.h>
@@ -80,6 +81,10 @@
  * @base_clk:		base clock used to drive the timers
  * @tclk0:		external clock 0 (can be ERR_PTR if not present)
  * @tclk1:		external clock 1 (can be ERR_PTR if not present)
+ * add for s5p4418
+ * @tclk2:		external clock 0 (can be ERR_PTR if not present)
+ * @tclk3:		external clock 1 (can be ERR_PTR if not present)
+
  */
 struct samsung_pwm_chip {
 	struct pwm_chip chip;
@@ -91,6 +96,17 @@
 	struct clk *base_clk;
 	struct clk *tclk0;
 	struct clk *tclk1;
+	/* add for s5p4418 */
+	struct clk *tclk2;
+	struct clk *tclk3;
+
+	/* for suspend/resume of s5p4418/s5p6818 */
+	u32 tcfg0;
+	u32 tcfg1;
+	u32 tcon;
+	u32 tcntb[SAMSUNG_PWM_NUM];
+	u32 tcmpb[SAMSUNG_PWM_NUM];
+	u32 is_enabled;
 };

 #ifndef CONFIG_CLKSRC_SAMSUNG_PWM
@@ -140,6 +156,22 @@
 	spin_unlock_irqrestore(&samsung_pwm_lock, flags);
 }

+static void pwm_samsung_set_tclk(struct samsung_pwm_chip *pwm,
+					unsigned int chan)
+{
+	u32 tclk = 5;
+	unsigned long flags;
+	u32 reg;
+
+	spin_lock_irqsave(&samsung_pwm_lock, flags);
+
+	reg = readl(pwm->base + REG_TCFG1);
+	reg |= tclk << TCFG1_SHIFT(chan);
+	writel(reg, pwm->base + REG_TCFG1);
+
+	spin_unlock_irqrestore(&samsung_pwm_lock, flags);
+}
+
 static int pwm_samsung_is_tdiv(struct samsung_pwm_chip *chip, unsigned int chan)
 {
 	struct samsung_pwm_variant *variant = &chip->variant;
@@ -168,6 +200,117 @@
 	return rate / (reg + 1);
 }

+static unsigned long calc_base_freq(unsigned long clk_freq,
+					unsigned long req_freq)
+{
+	unsigned long pwm_freq, calc_freq;
+	unsigned long optimal_freq;
+	unsigned int pre, div, tcnt = 2;
+
+	optimal_freq = req_freq;
+
+	for (pre = 0; pre < 256; ++pre) {
+		for (div = 0; div < 4; ++div) {
+			pwm_freq = clk_freq / (pre+1) / (1<<div) / tcnt;
+			if (req_freq > pwm_freq)
+				calc_freq = req_freq - pwm_freq;
+			else
+				calc_freq = pwm_freq - req_freq;
+
+			if (calc_freq < optimal_freq) {
+				optimal_freq = calc_freq;
+				if (optimal_freq == 0)
+					goto END;
+			}
+		}
+	}
+END:
+	return optimal_freq;
+}
+
+static unsigned long calc_tclk_freq(unsigned long tclk_freq,
+					unsigned long req_freq)
+{
+	unsigned long pwm_freq, calc_freq;
+	unsigned long optimal_freq;
+	unsigned long pre, tcnt = 2;
+
+	optimal_freq = req_freq;
+
+	for (pre = 0; pre < 256; ++pre) {
+		pwm_freq = tclk_freq / (pre+1) / tcnt;
+
+		if (req_freq > pwm_freq)
+			calc_freq = req_freq - pwm_freq;
+		else
+			calc_freq = pwm_freq - req_freq;
+
+		if (calc_freq < optimal_freq) {
+			optimal_freq = calc_freq;
+
+			if (optimal_freq == 0)
+				break;
+		}
+	}
+
+	return optimal_freq;
+}
+
+static unsigned int pwm_samsung_optimal_freq(struct samsung_pwm_chip *chip,
+					unsigned int chan, unsigned long freq)
+{
+	struct clk *tclk, *clk;
+	unsigned long tclk_rate, clk_rate;
+	unsigned long optimal_freq[2];
+
+	if (of_device_is_compatible(chip->chip.dev->of_node,
+				    "nexell,s5p4418-pwm")) {
+		switch (chan) {
+		case 0:
+			tclk = chip->tclk0;
+			break;
+		case 1:
+			tclk = chip->tclk1;
+			break;
+		case 2:
+			tclk = chip->tclk2;
+			break;
+		case 3:
+			tclk = chip->tclk3;
+			break;
+		default:
+			tclk = NULL;
+			break;
+		}
+	} else
+		tclk = (chan < 2) ? chip->tclk0 : chip->tclk1;
+
+	if (IS_ERR(tclk))
+		return 0;
+	tclk_rate = clk_get_rate(tclk);
+	if (!tclk_rate)
+		return 0;
+
+	optimal_freq[0] = calc_tclk_freq(tclk_rate, freq);
+	if (optimal_freq[0] == 0) {
+		pwm_samsung_set_tclk(chip, chan);
+		return 0;
+	}
+
+	if (!IS_ERR(chip->base_clk)) {
+		clk = chip->base_clk;
+		clk_rate = clk_get_rate(clk);
+		optimal_freq[1] = calc_base_freq(clk_rate, freq);
+
+		if (optimal_freq[0] >= optimal_freq[1])
+			pwm_samsung_set_tclk(chip, chan);
+	} else {
+		pwm_samsung_set_tclk(chip, chan);
+	}
+
+	return 0;
+}
+
 static unsigned long pwm_samsung_calc_tin(struct samsung_pwm_chip *chip,
 					  unsigned int chan, unsigned long freq)
 {
@@ -176,6 +319,17 @@
 	struct clk *clk;
 	u8 div;

+	/*
+	 * patch for s5p6818
+	 * according to the pwm clock request, determine use tclk.
+	 */
+	if (of_device_is_compatible(chip->chip.dev->of_node,
+				    "nexell,s5p4418-pwm") ||
+	    of_device_is_compatible(chip->chip.dev->of_node,
+				    "nexell,s5p6818-pwm")) {
+		pwm_samsung_optimal_freq(chip, chan, freq);
+	}
+
 	if (!pwm_samsung_is_tdiv(chip, chan)) {
 		clk = (chan < 2) ? chip->tclk0 : chip->tclk1;
 		if (!IS_ERR(clk)) {
@@ -473,6 +627,8 @@
 	{ .compatible = "samsung,s5p6440-pwm", .data = &s5p64x0_variant },
 	{ .compatible = "samsung,s5pc100-pwm", .data = &s5pc100_variant },
 	{ .compatible = "samsung,exynos4210-pwm", .data = &s5p64x0_variant },
+	{ .compatible = "nexell,s5p4418-pwm", .data = &s5pc100_variant },
+	{ .compatible = "nexell,s5p6818-pwm", .data = &s5pc100_variant },
 	{},
 };
 MODULE_DEVICE_TABLE(of, samsung_pwm_matches);
@@ -562,14 +718,76 @@
 		return ret;
 	}

-	for (chan = 0; chan < SAMSUNG_PWM_NUM; ++chan)
-		if (chip->variant.output_mask & BIT(chan))
-			pwm_samsung_set_invert(chip, chan, true);
-
 	/* Following clocks are optional. */
 	chip->tclk0 = devm_clk_get(&pdev->dev, "pwm-tclk0");
 	chip->tclk1 = devm_clk_get(&pdev->dev, "pwm-tclk1");

+	if (of_device_is_compatible(pdev->dev.of_node, "nexell,s5p4418-pwm")) {
+		/* Following clocks are optional. */
+		chip->tclk2 = devm_clk_get(&pdev->dev, "pwm-tclk2");
+		chip->tclk3 = devm_clk_get(&pdev->dev, "pwm-tclk3");
+	}
+
+	/*
+	 * patch for s5p6818
+	 * s5p6818 pwm optional tclk enable.
+	 */
+	if (of_device_is_compatible(pdev->dev.of_node, "nexell,s5p4418-pwm") ||
+	    of_device_is_compatible(pdev->dev.of_node, "nexell,s5p6818-pwm")) {
+		if (!IS_ERR(chip->tclk0)) {
+			ret = clk_prepare_enable(chip->tclk0);
+			if (ret < 0)
+				dev_warn(&pdev->dev, "PWM tclk0 not using\n");
+		}
+
+		if (!IS_ERR(chip->tclk1)) {
+			ret = clk_prepare_enable(chip->tclk1);
+			if (ret < 0)
+				dev_warn(&pdev->dev, "PWM tclk1 not using\n");
+		}
+	}
+	if (of_device_is_compatible(pdev->dev.of_node, "nexell,s5p4418-pwm")) {
+		if (!IS_ERR(chip->tclk2)) {
+			ret = clk_prepare_enable(chip->tclk2);
+			if (ret < 0)
+				dev_warn(&pdev->dev, "PWM tclk2 not using\n");
+		}
+
+		if (!IS_ERR(chip->tclk3)) {
+			ret = clk_prepare_enable(chip->tclk3);
+			if (ret < 0)
+				dev_warn(&pdev->dev, "PWM tclk3 not using\n");
+		}
+	}
+
+	/*
+         * patch for s5p6818
+         * s5p6818 pwm must be reset before enabled
+         */
+#ifdef CONFIG_RESET_CONTROLLER
+	if (of_device_is_compatible(pdev->dev.of_node, "nexell,s5p4418-pwm") ||
+	    of_device_is_compatible(pdev->dev.of_node, "nexell,s5p6818-pwm")) {
+		struct reset_control *rst =
+			devm_reset_control_get(&pdev->dev, "pwm-reset");
+		if (IS_ERR(rst)) {
+			dev_err(&pdev->dev,
+					"PWM failed to get reset_control\n");
+			return -EINVAL;
+		}
+
+		if (reset_control_status(rst))
+			reset_control_reset(rst);
+	}
+#endif
+	/*
+         * move for s5p6818
+	 * TCON register value faded away by reset controller
+	 * So, invert setup moved after reset
+	 */
+	for (chan = 0; chan < SAMSUNG_PWM_NUM; ++chan)
+		if (chip->variant.output_mask & BIT(chan))
+			pwm_samsung_set_invert(chip, chan, true);
+
 	platform_set_drvdata(pdev, chip);

 	ret = pwmchip_add(&chip->chip);
@@ -602,12 +820,109 @@
 }

 #ifdef CONFIG_PM_SLEEP
+static int pwm_samsung_suspend(struct device *dev)
+{
+	struct samsung_pwm_chip *chip = dev_get_drvdata(dev);
+	unsigned int i;
+
+	/*
+	 * patch for s5p4418/s5p6818
+	 * s5p4418/s5p6818 pwm register backup and tclk disable.
+	 */
+	if (of_device_is_compatible(dev->of_node, "nexell,s5p4418-pwm") ||
+	    of_device_is_compatible(dev->of_node, "nexell,s5p6818-pwm")) {
+		chip->tcfg0 = readl(chip->base + REG_TCFG0);
+		chip->tcfg1 = readl(chip->base + REG_TCFG1);
+		chip->tcon = readl(chip->base + REG_TCON);
+		for (i = 0; i < SAMSUNG_PWM_NUM; ++i) {
+			struct pwm_device *pwm = &chip->chip.pwms[i];
+			unsigned int tcon_chan = to_tcon_channel(pwm->hwpwm);
+
+			chip->tcntb[i] = readl(chip->base + REG_TCNTB(i));
+			chip->tcmpb[i] = readl(chip->base + REG_TCMPB(i));
+			if ((chip->tcon & TCON_AUTORELOAD(tcon_chan)) &&
+			    (chip->variant.output_mask & BIT(i))) {
+				chip->is_enabled |= BIT(i);
+				pwm_samsung_disable(&chip->chip, pwm);
+			} else
+				chip->is_enabled &= ~BIT(i);
+		}
+		chip->tcon = readl(chip->base + REG_TCON);
+
+		if (!IS_ERR(chip->tclk0))
+			clk_disable_unprepare(chip->tclk0);
+		if (!IS_ERR(chip->tclk1))
+			clk_disable_unprepare(chip->tclk1);
+
+		if (of_device_is_compatible(dev->of_node,
+					    "nexell,s5p4418-pwm")) {
+			if (chip->tclk2)
+				clk_disable_unprepare(chip->tclk2);
+			if (chip->tclk3)
+				clk_disable_unprepare(chip->tclk3);
+		}
+		if (!IS_ERR(chip->base_clk))
+			clk_disable_unprepare(chip->base_clk);
+	}
+	return 0;
+}
+
 static int pwm_samsung_resume(struct device *dev)
 {
 	struct samsung_pwm_chip *our_chip = dev_get_drvdata(dev);
 	struct pwm_chip *chip = &our_chip->chip;
 	unsigned int i;

+	/*
+	 * patch for s5p4418/s5p6818
+	 * s5p4418/s5p6818 pwm must be reset before enabled
+	 */
+	if (of_device_is_compatible(dev->of_node, "nexell,s5p4418-pwm") ||
+	    of_device_is_compatible(dev->of_node, "nexell,s5p6818-pwm")) {
+#ifdef CONFIG_RESET_CONTROLLER
+		struct reset_control *rst =
+			devm_reset_control_get(dev, "pwm-reset");
+		if (IS_ERR(rst)) {
+			dev_err(dev, "PWM failed to get reset_control\n");
+			return -EINVAL;
+		}
+
+		if (reset_control_status(rst))
+			reset_control_reset(rst);
+#endif
+		/*
+		 * patch for s5p4418/s5p6818
+		 * s5p4418/s5p6818 pwm register restore and tclk enable.
+		 */
+		if (!IS_ERR(our_chip->base_clk))
+			clk_prepare_enable(our_chip->base_clk);
+		if (!IS_ERR(our_chip->tclk0))
+			clk_prepare_enable(our_chip->tclk0);
+		if (!IS_ERR(our_chip->tclk1))
+			clk_prepare_enable(our_chip->tclk1);
+
+		if (of_device_is_compatible(dev->of_node,
+					    "nexell,s5p4418-pwm")) {
+			if (!IS_ERR(our_chip->tclk2))
+				clk_prepare_enable(our_chip->tclk2);
+			if (!IS_ERR(our_chip->tclk3))
+				clk_prepare_enable(our_chip->tclk3);
+		}
+		writel(our_chip->tcfg0, our_chip->base + REG_TCFG0);
+		writel(our_chip->tcfg1, our_chip->base + REG_TCFG1);
+		writel(our_chip->tcon, our_chip->base + REG_TCON);
+		for (i = 0; i < SAMSUNG_PWM_NUM; ++i) {
+			struct pwm_device *pwm = &our_chip->chip.pwms[i];
+
+			writel(our_chip->tcntb[i], our_chip->base + REG_TCNTB(i));
+			writel(our_chip->tcmpb[i], our_chip->base + REG_TCMPB(i));
+			if ((our_chip->is_enabled & BIT(i)) &&
+			    (our_chip->variant.output_mask & BIT(i))) {
+				pwm_samsung_enable(&our_chip->chip, pwm);
+			}
+		}
+	}
+
 	for (i = 0; i < SAMSUNG_PWM_NUM; i++) {
 		struct pwm_device *pwm = &chip->pwms[i];
 		struct samsung_pwm_channel *chan = pwm_get_chip_data(pwm);
@@ -636,7 +951,7 @@
 }
 #endif

-static SIMPLE_DEV_PM_OPS(pwm_samsung_pm_ops, NULL, pwm_samsung_resume);
+static SIMPLE_DEV_PM_OPS(pwm_samsung_pm_ops, pwm_samsung_suspend, pwm_samsung_resume);

 static struct platform_driver pwm_samsung_driver = {
 	.driver		= {
diff -ENwbur a/drivers/regulator/axp228-regu.c b/drivers/regulator/axp228-regu.c
--- a/drivers/regulator/axp228-regu.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/regulator/axp228-regu.c	2018-05-06 08:49:50.902765374 +0200
@@ -0,0 +1,814 @@
+/*
+ * axp228-regu.c  --  PMIC driver for the X-Powers AXP228
+ *
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongshin, Park <pjsin865@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/kernel.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/pm.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/of_gpio.h>
+
+#include <linux/mfd/core.h>
+#include <linux/mfd/axp228-mfd.h>
+#include <linux/mfd/axp228-cfg.h>
+
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
+#include <linux/regulator/axp228-regu.h>
+
+static unsigned int axp_suspend_status;
+
+static inline struct device *to_axp_dev(struct regulator_dev *rdev)
+{
+	return rdev_get_dev(rdev)->parent->parent;
+}
+
+static inline int check_range(struct axp_regulator_info *info, int min_uV,
+			      int max_uV)
+{
+	if (min_uV < info->min_uV || min_uV > info->max_uV)
+		return -EINVAL;
+
+	return 0;
+}
+
+/* AXP common operations */
+static int axp_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
+			   unsigned *selector)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	uint8_t val, mask;
+	int ret = 0;
+
+	if (axp_suspend_status)
+		return -EBUSY;
+
+	if (check_range(info, min_uV, max_uV)) {
+		pr_err("invalid voltage range (%d, %d) uV\n", min_uV, max_uV);
+		return -EINVAL;
+	}
+	val = (min_uV - info->min_uV + info->step_uV - 1) / info->step_uV;
+	if (selector)
+		*selector = val;
+	val <<= info->vol_shift;
+	mask = ((1 << info->vol_nbits) - 1) << info->vol_shift;
+
+	info->vout_reg_cache = val;
+
+	ret = axp_update(axp_dev, info->vol_reg, val, mask);
+
+#ifdef CONFIG_PM_DBGOUT
+	{
+		uint8_t reg_val = 0;
+
+		ret = axp_read(axp_dev, info->vol_reg, &reg_val);
+		if ((info->vout_reg_cache != reg_val) || ret)
+			dev_info(axp_dev,
+			"## %s() Data is different! set:0x%02x, read:0x%02x, ret:%d\n",
+			__func__, val, reg_val, ret);
+	}
+#endif
+	return ret;
+}
+
+static int axp_get_voltage(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	uint8_t val, mask;
+	int ret;
+
+	ret = axp_read(axp_dev, info->vol_reg, &val);
+	if (ret)
+		return ret;
+
+	mask = ((1 << info->vol_nbits) - 1) << info->vol_shift;
+	val = (val & mask) >> info->vol_shift;
+
+	return info->min_uV + info->step_uV * val;
+}
+
+static int axp_set_voltage_time_sel(struct regulator_dev *rdev,
+				    unsigned int old_sel, unsigned int new_sel)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+
+	if (old_sel < new_sel)
+		return ((new_sel - old_sel) * info->vrc_ramp_delay);
+
+	return 0;
+}
+
+static int axp_set_voltage_sel(struct regulator_dev *rdev, unsigned selector)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	int uV;
+
+	if (axp_suspend_status)
+		return -EBUSY;
+
+	uV = info->min_uV + (info->step_uV * selector);
+
+	return axp_set_voltage(rdev, uV, uV, NULL);
+}
+static int axp_get_voltage_sel(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	uint8_t val, vsel, mask;
+	int ret;
+
+	ret = axp_read(axp_dev, info->vol_reg, &val);
+	if (ret)
+		return ret;
+
+	mask = ((1 << info->vol_nbits) - 1) << info->vol_shift;
+	vsel = (val & mask) >> info->vol_shift;
+
+	return vsel;
+}
+
+static int axp_enable(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+
+	return axp_set_bits(axp_dev, info->enable_reg, 1 << info->enable_bit);
+}
+
+static int axp_disable(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+
+	return axp_clr_bits(axp_dev, info->enable_reg, 1 << info->enable_bit);
+}
+
+static int axp_is_enabled(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	uint8_t reg_val;
+	int ret;
+
+	ret = axp_read(axp_dev, info->enable_reg, &reg_val);
+	if (ret)
+		return ret;
+
+	return !!(reg_val & (1 << info->enable_bit));
+}
+
+static int axp_list_voltage(struct regulator_dev *rdev, unsigned selector)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	int ret;
+
+	ret = info->min_uV + info->step_uV * selector;
+
+	if (ret > info->max_uV)
+		return -EINVAL;
+	return ret;
+}
+
+static int axp_set_suspend_voltage(struct regulator_dev *rdev, int uV)
+{
+	return axp_set_voltage(rdev, uV, uV, NULL);
+}
+
+static struct regulator_ops axp22_dcdc_ops = {
+	.set_voltage_sel = axp_set_voltage_sel,
+	.set_voltage_time_sel = axp_set_voltage_time_sel,
+	.get_voltage_sel = axp_get_voltage_sel,
+	.list_voltage = axp_list_voltage,
+	.enable = axp_enable,
+	.disable = axp_disable,
+	.is_enabled = axp_is_enabled,
+	.set_suspend_enable = axp_enable,
+	.set_suspend_disable = axp_disable,
+	.set_suspend_voltage = axp_set_suspend_voltage,
+};
+
+static struct regulator_ops axp22_ops = {
+	.set_voltage = axp_set_voltage,
+	.get_voltage = axp_get_voltage,
+	.list_voltage = axp_list_voltage,
+	.enable = axp_enable,
+	.disable = axp_disable,
+	.is_enabled = axp_is_enabled,
+	.set_suspend_enable = axp_enable,
+	.set_suspend_disable = axp_disable,
+	.set_suspend_voltage = axp_set_suspend_voltage,
+};
+
+static int axp_ldoio01_enable(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+
+	axp_set_bits(axp_dev, info->enable_reg, 0x03);
+	return axp_clr_bits(axp_dev, info->enable_reg, 0x04);
+}
+
+static int axp_ldoio01_disable(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+
+	return axp_clr_bits(axp_dev, info->enable_reg, 0x07);
+}
+
+static int axp_ldoio01_is_enabled(struct regulator_dev *rdev)
+{
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	uint8_t reg_val;
+	int ret;
+
+	ret = axp_read(axp_dev, info->enable_reg, &reg_val);
+	if (ret)
+		return ret;
+
+	return (((reg_val &= 0x07) == 0x03) ? 1 : 0);
+}
+
+static struct regulator_ops axp22_ldoio01_ops = {
+	.set_voltage = axp_set_voltage,
+	.get_voltage = axp_get_voltage,
+	.list_voltage = axp_list_voltage,
+	.enable = axp_ldoio01_enable,
+	.disable = axp_ldoio01_disable,
+	.is_enabled = axp_ldoio01_is_enabled,
+	.set_suspend_enable = axp_ldoio01_enable,
+	.set_suspend_disable = axp_ldoio01_disable,
+	.set_suspend_voltage = axp_set_suspend_voltage,
+};
+
+#define AXP22_LDO(_id, min, max, step, vreg, shift,	\
+		nbits, ereg, ebit, vrc_ramp)	\
+	AXP_LDO(AXP22, _id, min, max, step, vreg, shift,	\
+		nbits, ereg, ebit, vrc_ramp)
+
+#define AXP22_DCDC(_id, min, max, step, vreg, shift,	\
+		nbits, ereg, ebit, vrc_ramp)	\
+	AXP_DCDC(AXP22, _id, min, max, step, vreg, shift,	\
+		nbits, ereg, ebit, vrc_ramp)
+
+static struct axp_regulator_info axp_regulator_info[] = {
+	AXP22_LDO(1, 3000,	3000,   0, LDO1,
+	0, 0,	LDO1EN,   0, 0), /* ldo1 for rtc */
+	AXP22_LDO(2,  700,	3300, 100, LDO2,
+	0,	 5,	LDO2EN,   6, 0), /* ldo2 for aldo1  */
+	AXP22_LDO(3,  700,	3300, 100, LDO3,
+	0,	 5,	LDO3EN,   7, 0), /* ldo3 for aldo2 */
+	AXP22_LDO(4,  700,	3300, 100, LDO4,
+	0,	 5,	LDO4EN,   7, 0), /* ldo3 for aldo3 */
+	AXP22_LDO(5,  700,	3300, 100, LDO5,
+	0,	 5,	LDO5EN,   3, 0), /* ldo5 for dldo1 */
+	AXP22_LDO(6,  700,	3300, 100, LDO6,
+	0,	 5,	LDO6EN,   4, 0), /* ldo6 for dldo2 */
+	AXP22_LDO(7,  700,	3300, 100, LDO7,
+	0,	 5,	LDO7EN,   5, 0), /* ldo7 for dldo3 */
+	AXP22_LDO(8,  700,	3300, 100, LDO8,
+	0,	 5,	LDO8EN,   6, 0), /* ldo8 for dldo4 */
+	AXP22_LDO(9,  700,	3300, 100, LDO9,
+	0,	 5,	LDO9EN,   0, 0), /* ldo9 for eldo1 */
+	AXP22_LDO(10,  700,	3300, 100, LDO10,
+	0,	 5,	LDO10EN,  1, 0), /* ldo10 for eldo2  */
+	AXP22_LDO(11,  700,	3300, 100, LDO11,
+	0,	 5,	LDO11EN,  2, 0), /* ldo11 for eldo3 */
+	AXP22_LDO(12,  700,	3300, 100, LDO12,
+	0,	 3,	LDO12EN,  0, 0), /* ldo12 for dc5ldo */
+	AXP22_DCDC(1, 1600,	3400, 100, DCDC1,
+	0,	 5,	DCDC1EN,  1, 0), /* buck1 for io */
+	AXP22_DCDC(2,  600,	1540,  20, DCDC2,
+	0, 6,	DCDC2EN,  2, 16), /* buck2 for cpu */
+	AXP22_DCDC(3,  600,	1860,  20, DCDC3,
+	0, 6,	DCDC3EN,  3, 16), /* buck3 for gpu */
+	AXP22_DCDC(4,  600,	1540,  20, DCDC4,
+	0, 6,	DCDC4EN,  4, 0), /* buck4 for core */
+	AXP22_DCDC(5, 1000,	2550,  50, DCDC5,
+	0, 5,	DCDC5EN,  5, 0), /* buck5 for ddr */
+	AXP22_LDO(IO0,  700,	3300, 100, LDOIO0,
+	0,	 5,	LDOIO0EN, 0, 0), /* ldoio0 */
+	AXP22_LDO(IO1,  700,	3300, 100, LDOIO1,
+	0,	 5,	LDOIO1EN, 0, 0), /* ldoio1 */
+};
+
+static ssize_t workmode_show(struct device *dev, struct device_attribute *attr,
+			     char *buf)
+{
+	struct regulator_dev *rdev = dev_get_drvdata(dev);
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	int ret;
+	uint8_t val;
+
+	ret = axp_read(axp_dev, AXP22_BUCKMODE, &val);
+	if (ret)
+		return sprintf(buf, "IO ERROR\n");
+
+	if (info->desc.id == AXP22_ID_DCDC1) {
+		switch (val & 0x04) {
+		case 0:
+			return sprintf(buf, "AUTO\n");
+		case 4:
+			return sprintf(buf, "PWM\n");
+		default:
+			return sprintf(buf, "UNKNOWN\n");
+		}
+	} else if (info->desc.id == AXP22_ID_DCDC2) {
+		switch (val & 0x02) {
+		case 0:
+			return sprintf(buf, "AUTO\n");
+		case 2:
+			return sprintf(buf, "PWM\n");
+		default:
+			return sprintf(buf, "UNKNOWN\n");
+		}
+	} else if (info->desc.id == AXP22_ID_DCDC3) {
+		switch (val & 0x02) {
+		case 0:
+			return sprintf(buf, "AUTO\n");
+		case 2:
+			return sprintf(buf, "PWM\n");
+		default:
+			return sprintf(buf, "UNKNOWN\n");
+		}
+	} else if (info->desc.id == AXP22_ID_DCDC4) {
+		switch (val & 0x02) {
+		case 0:
+			return sprintf(buf, "AUTO\n");
+		case 2:
+			return sprintf(buf, "PWM\n");
+		default:
+			return sprintf(buf, "UNKNOWN\n");
+		}
+	} else if (info->desc.id == AXP22_ID_DCDC5) {
+		switch (val & 0x02) {
+		case 0:
+			return sprintf(buf, "AUTO\n");
+		case 2:
+			return sprintf(buf, "PWM\n");
+		default:
+			return sprintf(buf, "UNKNOWN\n");
+		}
+	} else {
+		return sprintf(buf, "IO ID ERROR\n");
+	}
+}
+
+static ssize_t workmode_store(struct device *dev, struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+	struct regulator_dev *rdev = dev_get_drvdata(dev);
+	struct axp_regulator_info *info = rdev_get_drvdata(rdev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	char mode;
+	uint8_t val;
+
+	if (buf[0] > '0' &&
+	    buf[0] < '9') /* 1/AUTO: auto mode; 2/PWM: pwm mode; */
+		mode = buf[0];
+	else
+		mode = buf[1];
+
+	switch (mode) {
+	case 'U':
+	case 'u':
+	case '1':
+		val = 0;
+		break;
+	case 'W':
+	case 'w':
+	case '2':
+		val = 1;
+		break;
+	default:
+		val = 0;
+	}
+
+	if (info->desc.id == AXP22_ID_DCDC1) {
+		if (val)
+			axp_set_bits(axp_dev, AXP22_BUCKMODE, 0x01);
+		else
+			axp_clr_bits(axp_dev, AXP22_BUCKMODE, 0x01);
+	} else if (info->desc.id == AXP22_ID_DCDC2) {
+		if (val)
+			axp_set_bits(axp_dev, AXP22_BUCKMODE, 0x02);
+		else
+			axp_clr_bits(axp_dev, AXP22_BUCKMODE, 0x02);
+	} else if (info->desc.id == AXP22_ID_DCDC3) {
+		if (val)
+			axp_set_bits(axp_dev, AXP22_BUCKMODE, 0x04);
+		else
+			axp_clr_bits(axp_dev, AXP22_BUCKMODE, 0x04);
+	} else if (info->desc.id == AXP22_ID_DCDC4) {
+		if (val)
+			axp_set_bits(axp_dev, AXP22_BUCKMODE, 0x08);
+		else
+			axp_clr_bits(axp_dev, AXP22_BUCKMODE, 0x08);
+	} else if (info->desc.id == AXP22_ID_DCDC5) {
+		if (val)
+			axp_set_bits(axp_dev, AXP22_BUCKMODE, 0x10);
+		else
+			axp_clr_bits(axp_dev, AXP22_BUCKMODE, 0x10);
+	}
+	return count;
+}
+
+static ssize_t frequency_show(struct device *dev, struct device_attribute *attr,
+			      char *buf)
+{
+	struct regulator_dev *rdev = dev_get_drvdata(dev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	int ret;
+	uint8_t val;
+
+	ret = axp_read(axp_dev, AXP22_BUCKFREQ, &val);
+	if (ret)
+		return ret;
+	ret = val & 0x0F;
+	return sprintf(buf, "%d\n", (ret * 75 + 750));
+}
+
+static ssize_t frequency_store(struct device *dev,
+			       struct device_attribute *attr, const char *buf,
+			       size_t count)
+{
+	struct regulator_dev *rdev = dev_get_drvdata(dev);
+	struct device *axp_dev = to_axp_dev(rdev);
+	uint8_t val, tmp;
+	unsigned long tmp1;
+	int var;
+	int err;
+
+	err = kstrtoul(buf, 10, &tmp1);
+	if (err)
+		return err;
+
+	var = (uint8_t)tmp1;
+
+	if (var < 750)
+		var = 750;
+	if (var > 1875)
+		var = 1875;
+
+	val = (var - 750) / 75;
+	val &= 0x0F;
+
+	axp_read(axp_dev, AXP22_BUCKFREQ, &tmp);
+	tmp &= 0xF0;
+	val |= tmp;
+	axp_write(axp_dev, AXP22_BUCKFREQ, val);
+	return count;
+}
+
+static struct device_attribute axp_regu_attrs[] = {
+	AXP_REGU_ATTR(workmode),
+	AXP_REGU_ATTR(frequency),
+};
+
+int axp_regu_create_attrs(struct platform_device *pdev)
+{
+	int j, ret;
+
+	for (j = 0; j < ARRAY_SIZE(axp_regu_attrs); j++) {
+		ret = device_create_file(&pdev->dev, &axp_regu_attrs[j]);
+		if (ret)
+			goto sysfs_failed;
+	}
+
+	return ret;
+
+sysfs_failed:
+	while (j--)
+		device_remove_file(&pdev->dev, &axp_regu_attrs[j]);
+
+	return ret;
+}
+
+static inline struct axp_regulator_info *find_regulator_info(int id)
+{
+	struct axp_regulator_info *ri;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(axp_regulator_info); i++) {
+		ri = &axp_regulator_info[i];
+		if (ri->desc.id == id)
+			return ri;
+	}
+	return NULL;
+}
+
+static inline int axp_set_sleep_mod(struct regulator_dev *rdev)
+{
+	struct device *axp_dev = to_axp_dev(rdev);
+
+	axp_set_bits(axp_dev, 0x8C, 0x0f);
+	axp_set_bits(axp_dev, 0x92, 0x07);
+	axp_set_bits(axp_dev, 0x100, 0x04);
+	dev_dbg(axp_dev, "[AXP228] :Set PMIC sleep mode\n");
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static int axp_regulator_dt_parse_pdata(struct platform_device *pdev,
+					struct axp_platform_data *pdata)
+{
+	struct axp_mfd_chip *iodev = dev_get_drvdata(pdev->dev.parent);
+	struct axp_funcdev_info *rdata;
+	struct regulator_init_data *regu_initdata;
+	struct device_node *pmic_np, *regulators_np, *reg_np;
+	u32 val;
+
+	pmic_np = of_node_get(iodev->dev->of_node);
+
+	if (!pmic_np) {
+		dev_err(&pdev->dev, "could not find pmic sub-node\n");
+		return -ENODEV;
+	}
+
+	regulators_np = of_find_node_by_name(pmic_np, "regulators");
+	if (!regulators_np) {
+		dev_err(&pdev->dev, "could not find regulators sub-node\n");
+		return -EINVAL;
+	}
+
+	/* count the number of regulators to be supported in pmic */
+	pdata->num_regl_devs = of_get_child_count(regulators_np);
+
+	rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) * pdata->num_regl_devs,
+			     GFP_KERNEL);
+	if (!rdata) {
+		of_node_put(regulators_np);
+		dev_err(&pdev->dev,
+			"could not allocate memory for regulator data\n");
+		return -ENOMEM;
+	}
+
+	pdata->regl_devs = rdata;
+
+	for_each_child_of_node(regulators_np, reg_np) {
+		rdata->reg_node = reg_np;
+		rdata->name = "axp228-regulator";
+
+		if (!of_property_read_u32(reg_np, "nx,id", &val))
+			rdata->id = val;
+		else
+			dev_err(&pdev->dev, "%s() Error : id\n",
+				__func__);
+
+		regu_initdata = (void *)of_get_regulator_init_data(
+		    &pdev->dev, reg_np, &axp_regulator_info[rdata->id].desc);
+
+		regu_initdata->constraints.name = reg_np->name;
+
+		if (!of_property_read_u32(reg_np, "nx,always_on", &val))
+			regu_initdata->constraints.always_on = val;
+		else
+			dev_err(&pdev->dev,
+				"%s() Error : always_on\n",
+				__func__);
+
+		if (!of_property_read_u32(reg_np, "nx,boot_on", &val))
+			regu_initdata->constraints.boot_on = val;
+		else
+			dev_err(&pdev->dev,
+				"%s() Error : always_on\n",
+				__func__);
+
+		regu_initdata->consumer_supplies = devm_kzalloc(
+		    &pdev->dev, sizeof(struct regulator_consumer_supply),
+		    GFP_KERNEL);
+		if (of_property_read_string(
+			reg_np, "regulator-name",
+			&regu_initdata->consumer_supplies->supply))
+			dev_err(&pdev->dev,
+				"%s() Error : regulator-name\n",
+				__func__);
+
+		regu_initdata->num_consumer_supplies = 1;
+		regu_initdata->constraints.valid_ops_mask =
+		    REGULATOR_CHANGE_VOLTAGE | REGULATOR_CHANGE_STATUS;
+
+#if defined(CONFIG_KP_OUTPUTINIT)
+		regu_initdata->constraints.initial_state = PM_SUSPEND_STANDBY;
+
+		if (!of_property_read_u32(reg_np, "nx,init_uV", &val))
+			regu_initdata->constraints.state_standby.uV = (int)val;
+		else
+			dev_err(&pdev->dev,
+				"%s() Error : nx,init_uV\n",
+				__func__);
+
+		if (!of_property_read_u32(reg_np, "nx,init_enable", &val))
+			regu_initdata->constraints.state_standby.enabled =
+			    (int)val;
+		else
+			dev_err(&pdev->dev,
+				"%s() Error : nx,init_enable\n",
+				__func__);
+#endif
+		rdata->platform_data = (void *)regu_initdata;
+		rdata++;
+	}
+	of_node_put(regulators_np);
+
+	return 0;
+}
+#else
+static int axp_regulator_dt_parse_pdata(struct platform_device *pdev,
+					struct axp_platform_data *pdata)
+{
+	return 0;
+}
+#endif /* CONFIG_OF */
+
+static int axp_regulator_probe(struct platform_device *pdev)
+{
+	struct axp_mfd_chip *iodev = dev_get_drvdata(pdev->dev.parent);
+	struct axp_platform_data *pdata = iodev->pdata;
+	struct axp_funcdev_info *regl_devs;
+	struct axp_regulator_info *tps_pdata = NULL;
+	struct regulator_config config = {};
+	int i, ret = -EIO, err;
+
+	if (iodev->dev->of_node) {
+		err = axp_regulator_dt_parse_pdata(pdev, pdata);
+		if (err) {
+			dev_err(&pdev->dev,
+				"%s() Error: No parse pdata\n",
+				__func__);
+			return err;
+		}
+	} else {
+		dev_err(&pdev->dev, "%s() Error: Not find of_node\n",
+			__func__);
+		goto err_out;
+	}
+
+	regl_devs = pdata->regl_devs;
+
+	for (i = 0; i < pdata->num_regl_devs; i++) {
+		tps_pdata = find_regulator_info(regl_devs->id);
+		if (tps_pdata == NULL) {
+			dev_err(&pdev->dev,
+				"%s() Error: invalid regulator ID specified(%d)\n",
+				__func__, regl_devs->id);
+			return -EINVAL;
+		}
+
+		if (tps_pdata->desc.id == AXP22_ID_LDO1 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO2 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO3 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO4 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO5 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO6 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO7 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO8 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO9 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO10 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO11 ||
+		    tps_pdata->desc.id == AXP22_ID_LDO12 ||
+		    tps_pdata->desc.id == AXP22_ID_DCDC1 ||
+		    tps_pdata->desc.id == AXP22_ID_DCDC4 ||
+		    tps_pdata->desc.id == AXP22_ID_DCDC5)
+			tps_pdata->desc.ops = &axp22_ops;
+
+		if (tps_pdata->desc.id == AXP22_ID_LDOIO0 ||
+		    tps_pdata->desc.id == AXP22_ID_LDOIO1)
+			tps_pdata->desc.ops = &axp22_ldoio01_ops;
+
+		if (tps_pdata->desc.id == AXP22_ID_DCDC2 ||
+		    tps_pdata->desc.id == AXP22_ID_DCDC3)
+			tps_pdata->desc.ops = &axp22_dcdc_ops;
+
+		/* Register the regulators */
+		config.dev = &pdev->dev;
+		config.init_data =
+		    (struct regulator_init_data *)regl_devs->platform_data;
+		config.driver_data = tps_pdata;
+		config.of_node = regl_devs->reg_node;
+
+		axp_regulator_info[i].rdev = devm_regulator_register(&pdev->dev,
+			&tps_pdata->desc,
+			&config);
+		if (IS_ERR(axp_regulator_info[i].rdev)) {
+			dev_err(&pdev->dev,
+				"%s() Error: regulator register failed\n",
+				__func__);
+			return PTR_ERR(axp_regulator_info[i].rdev);
+		}
+
+#ifdef ENABLE_DEBUG
+		dev_info(&pdev->dev,
+		" DTS data : %12s, %16s, desc.id:%2d, id:%2d, minV:%7d, maxV:%7d, initV:%7d, enabled:%d\n",
+		config.init_data->constraints.name,
+		config.init_data->consumer_supplies->supply,
+		tps_pdata->desc.id, regl_devs->id,
+		config.init_data->constraints.min_uV,
+		config.init_data->constraints.max_uV,
+		config.init_data->constraints.state_standby.uV,
+		config.init_data->constraints.state_standby.enabled);
+#endif
+		regl_devs++;
+	}
+
+	return 0;
+
+err_out:
+	dev_err(&pdev->dev, "%s() Error\n", __func__);
+	return ret;
+}
+
+static int axp_regulator_remove(struct platform_device *pdev)
+{
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int axp_regulator_suspend(struct device *dev)
+{
+	struct regulator_dev *rdev = dev_get_drvdata(dev);
+	struct regulation_constraints *constraints = rdev->constraints;
+	struct regulator_state *state_standby = &constraints->state_standby;
+	int ret = 0;
+
+	axp_suspend_status = 0;
+
+	/* When the CPU to wake up, it operates at 800MHz speeds.
+	 * So, to set the Arm voltage to 1.1V.
+	 */
+	if (!strcmp(constraints->name, "axp22_dcdc2")) {
+		if (state_standby)
+			ret = axp_set_voltage(rdev, 1100000, 1100000, NULL);
+	}
+
+	axp_suspend_status = 1;
+	return ret;
+}
+
+static int axp_regulator_resume(struct device *dev)
+{
+	axp_suspend_status = 0;
+
+	return 0;
+}
+
+static const struct dev_pm_ops axp_regulator_pm_ops = {
+	.suspend = axp_regulator_suspend,
+	.resume = axp_regulator_resume,
+};
+#endif
+
+static struct platform_driver axp_regulator_driver = {
+	.driver	= {
+		.name = "axp228-regulator",
+		.owner = THIS_MODULE,
+#ifdef CONFIG_PM
+		.pm	= &axp_regulator_pm_ops,
+#endif
+	},
+	.probe = axp_regulator_probe,
+	.remove = axp_regulator_remove,
+};
+
+static int __init axp_regulator_init(void)
+{
+	return platform_driver_register(&axp_regulator_driver);
+}
+subsys_initcall(axp_regulator_init);
+
+static void __exit axp_regulator_exit(void)
+{
+	platform_driver_unregister(&axp_regulator_driver);
+}
+module_exit(axp_regulator_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("King Zhong");
+MODULE_DESCRIPTION("Regulator Driver for X-powers AXP22 PMIC");
+MODULE_ALIAS("platform:axp-regulator");
diff -ENwbur a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
--- a/drivers/regulator/Kconfig	2018-05-06 08:47:38.021372221 +0200
+++ b/drivers/regulator/Kconfig	2018-05-06 08:49:50.902765374 +0200
@@ -163,6 +163,15 @@
 	  This driver provides support for the voltage regulators on the
 	  AXP20X PMIC.

+config REGULATOR_AXP228
+	tristate "X-Powers AXP228 Power regulator"
+	select MFD_AXP228
+	help
+	  This driver supports regulator driver for the X-Powers AXP228
+	  Power Management device.
+	  It delivers digitally programmable output,
+	  the voltage is programmed via I2C interface.
+
 config REGULATOR_BCM590XX
 	tristate "Broadcom BCM590xx PMU Regulators"
 	depends on MFD_BCM590XX
diff -ENwbur a/drivers/regulator/Makefile b/drivers/regulator/Makefile
--- a/drivers/regulator/Makefile	2018-05-06 08:47:38.021372221 +0200
+++ b/drivers/regulator/Makefile	2018-05-06 08:49:50.902765374 +0200
@@ -122,6 +122,7 @@
 obj-$(CONFIG_REGULATOR_WM8350) += wm8350-regulator.o
 obj-$(CONFIG_REGULATOR_WM8400) += wm8400-regulator.o
 obj-$(CONFIG_REGULATOR_WM8994) += wm8994-regulator.o
+obj-$(CONFIG_REGULATOR_AXP228)	+= axp228-regu.o


 ccflags-$(CONFIG_REGULATOR_DEBUG) += -DDEBUG
diff -ENwbur a/drivers/reset/Makefile b/drivers/reset/Makefile
--- a/drivers/reset/Makefile	2018-05-06 08:47:38.033372709 +0200
+++ b/drivers/reset/Makefile	2018-05-06 08:49:50.914765862 +0200
@@ -21,4 +21,4 @@
 obj-$(CONFIG_RESET_UNIPHIER) += reset-uniphier.o
 obj-$(CONFIG_RESET_ZX2967) += reset-zx2967.o
 obj-$(CONFIG_RESET_ZYNQ) += reset-zynq.o
-
+obj-$(CONFIG_ARCH_S5P6818) += reset-nexell.o
diff -ENwbur a/drivers/reset/reset-nexell.c b/drivers/reset/reset-nexell.c
--- a/drivers/reset/reset-nexell.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/reset/reset-nexell.c	2018-05-06 08:49:50.914765862 +0200
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include <linux/reset-controller.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+
+#define NX_ID_TO_BANK(id)	((id >> 0x5) & 0x07)       /* Divide 32 */
+#define NX_ID_TO_BIT(id)	(id & 0x1F)
+
+
+struct nexell_reset_data {
+	spinlock_t			lock;
+	void __iomem			*base;	/* mapped address */
+	struct reset_controller_dev	rcdev;
+};
+
+
+static int nexell_reset_assert(struct reset_controller_dev *rcdev,
+			       unsigned long id)
+{
+	struct nexell_reset_data *data = container_of(rcdev,
+						      struct nexell_reset_data,
+						      rcdev);
+	int bank = NX_ID_TO_BANK(id);
+	int offset = NX_ID_TO_BIT(id);
+	unsigned long flags;
+	u32 reg;
+
+	pr_debug("%s: id=%ld [0x%p]\n", __func__, id, data->base + (bank * 4));
+
+	spin_lock_irqsave(&data->lock, flags);
+
+	reg = readl(data->base + (bank * 4));
+	writel(reg & ~BIT(offset), data->base + (bank * 4));
+	spin_unlock_irqrestore(&data->lock, flags);
+
+	return 0;
+}
+
+static int nexell_reset_deassert(struct reset_controller_dev *rcdev,
+				 unsigned long id)
+{
+	struct nexell_reset_data *data = container_of(rcdev,
+						      struct nexell_reset_data,
+						      rcdev);
+	int bank = NX_ID_TO_BANK(id);
+	int offset = NX_ID_TO_BIT(id);
+	unsigned long flags;
+	u32 reg;
+
+	pr_debug("%s: id=%ld [0x%p]\n", __func__, id, data->base + (bank * 4));
+
+	spin_lock_irqsave(&data->lock, flags);
+
+	reg = readl(data->base + (bank * 4));
+	writel(reg | BIT(offset), data->base + (bank * 4));
+
+	spin_unlock_irqrestore(&data->lock, flags);
+
+	return 0;
+}
+
+static int nexell_reset_reset(struct reset_controller_dev *rcdev,
+			      unsigned long id)
+{
+	nexell_reset_assert(rcdev, id);
+
+	mdelay(1);
+
+	nexell_reset_deassert(rcdev, id);
+
+	return 0;
+}
+
+static int nexell_reset_status(struct reset_controller_dev *rcdev,
+			       unsigned long id)
+{
+	struct nexell_reset_data *data = container_of(rcdev,
+						      struct nexell_reset_data,
+						      rcdev);
+	int bank = NX_ID_TO_BANK(id);
+	int offset = NX_ID_TO_BIT(id);
+	unsigned long flags;
+	u32 reg;
+	int rst;
+
+	spin_lock_irqsave(&data->lock, flags);
+
+	reg = readl(data->base + (bank * 4));
+
+	spin_unlock_irqrestore(&data->lock, flags);
+
+	rst = !(reg & BIT(offset));
+	pr_debug("%s: id=%ld [0x%p] val: %d\n", __func__,
+		id, data->base + (bank * 4), rst);
+
+	return rst;
+}
+
+
+static struct reset_control_ops nexell_reset_ops = {
+	.reset		= nexell_reset_reset,
+	.assert		= nexell_reset_assert,
+	.deassert	= nexell_reset_deassert,
+	.status		= nexell_reset_status,
+};
+
+
+static const struct of_device_id nexell_reset_dt_ids[] = {
+	{ .compatible = "nexell,s5pxx18-reset", },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, nexell_reset_dt_ids);
+
+static int nexell_reset_probe(struct platform_device *pdev)
+{
+	struct nexell_reset_data *data;
+	struct resource *res;
+
+	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	data->base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(data->base))
+		return PTR_ERR(data->base);
+
+	spin_lock_init(&data->lock);
+
+	data->rcdev.owner = THIS_MODULE;
+	data->rcdev.nr_resets = resource_size(res) * 32;
+	data->rcdev.ops = &nexell_reset_ops;
+	data->rcdev.of_node = pdev->dev.of_node;
+	dev_info(&pdev->dev, "nexell reset: nr_resets [%d], base [%p]\n",
+		 data->rcdev.nr_resets, data->base);
+
+	return reset_controller_register(&data->rcdev);
+}
+
+static int nexell_reset_remove(struct platform_device *pdev)
+{
+	struct nexell_reset_data *data = platform_get_drvdata(pdev);
+
+	reset_controller_unregister(&data->rcdev);
+
+	return 0;
+}
+
+static struct platform_driver nexell_reset_driver = {
+	.probe	= nexell_reset_probe,
+	.remove	= nexell_reset_remove,
+	.driver = {
+		.name		= "nexell-reset",
+		.owner		= THIS_MODULE,
+		.of_match_table	= nexell_reset_dt_ids,
+	},
+};
+
+static int __init nexell_reset_init(void)
+{
+	return platform_driver_register(&nexell_reset_driver);
+}
+pure_initcall(nexell_reset_init);
+
+MODULE_AUTHOR("Bon-gyu, KOO <freestyle@nexell.co.kr");
+MODULE_DESCRIPTION("Reset Controller Driver for Nexell");
+MODULE_LICENSE("GPL");
diff -ENwbur a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
--- a/drivers/rtc/Kconfig	2018-05-06 08:47:38.033372709 +0200
+++ b/drivers/rtc/Kconfig	2018-05-06 08:49:50.918766024 +0200
@@ -1773,6 +1773,13 @@
 	  If you say yes here, you get support for the RTD1295 SoC
 	  Real Time Clock.

+config RTC_DRV_NX
+	tristate "Nexell RTC"
+	depends on ARCH_S5P4418 || ARCH_S5P6818
+	help
+	  Driver for the internal RTC (Realtime Clock) module found on
+	  Nexell's processor.
+
 comment "HID Sensor RTC drivers"

 config RTC_DRV_HID_SENSOR_TIME
diff -ENwbur a/drivers/rtc/Makefile b/drivers/rtc/Makefile
--- a/drivers/rtc/Makefile	2018-05-06 08:47:38.033372709 +0200
+++ b/drivers/rtc/Makefile	2018-05-06 08:49:50.918766024 +0200
@@ -173,3 +173,4 @@
 obj-$(CONFIG_RTC_DRV_XGENE)	+= rtc-xgene.o
 obj-$(CONFIG_RTC_DRV_ZYNQMP)	+= rtc-zynqmp.o
 obj-$(CONFIG_RTC_DRV_GOLDFISH)	+= rtc-goldfish.o
+obj-$(CONFIG_RTC_DRV_NX)	+= rtc-nx.o
diff -ENwbur a/drivers/rtc/rtc-nx.c b/drivers/rtc/rtc-nx.c
--- a/drivers/rtc/rtc-nx.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/rtc/rtc-nx.c	2018-05-06 08:49:50.926766349 +0200
@@ -0,0 +1,686 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/rtc.h>
+#include <linux/bcd.h>
+#include <linux/clk.h>
+#include <linux/log2.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include <asm/irq.h>
+
+#define PWRCONT				0x24
+
+static void __iomem *clkpwr_reg_for_rtc;
+
+void nx_clkpwr_set_rtc_wakeup_enable(bool enable)
+{
+	const u32 rtc_wk_enb_pit_pos = 1;
+	const u32 rtc_wk_enb_mask = 1 << rtc_wk_enb_pit_pos;
+
+	register u32 readvalue;
+
+	readvalue = readl((void *)(clkpwr_reg_for_rtc + PWRCONT));
+	readvalue &= ~rtc_wk_enb_mask;
+	readvalue |= (u32)enable << rtc_wk_enb_pit_pos;
+
+	writel(readvalue, (void *)(clkpwr_reg_for_rtc + PWRCONT));
+}
+
+/*------------------------------------------------------------------------------
+ * local data and macro
+ */
+
+#define	RTC_TIME_YEAR			(1970)		/* 1970.01.01 00:00:00
+							 */
+#define RTC_TIME_MAX			0x69546780	/* 2025.12.31 00:00:00
+							 */
+#define RTC_TIME_MIN			0x52c35a80	/* 2014.01.01 00:00:00
+							 */
+#define RTC_TIME_DFT			0x4a9c6400	/* 2009.09.01 00:00:00
+							 */
+
+#define	RTC_COUNT_BIT			(0)
+#define	RTC_ALARM_BIT			(1)
+
+#define RTC_CNT_WRITE			0x00
+#define RTC_CNT_READ			0x04
+#define RTC_ALARM			0x08
+#define RTC_CTRL			0x0C
+#define RTC_INT_ENB			0x10
+#define RTC_INT_PND			0x14
+#define RTC_CORE_RST_TIME_SEL		0x18
+#define RTC_SCRATCH			0x1C
+
+struct nx_rtc {
+	struct device *dev;
+	struct rtc_device *rtc;
+
+	void __iomem *base;
+
+	int irq_rtc;
+
+	spinlock_t rtc_lock;
+
+	int rtc_enable_irq;
+	int alm_enable_irq;
+};
+
+static unsigned long	rtc_time_offs;
+
+enum {
+	NX_RTC_INT_COUNTER = 0,
+	NX_RTC_INT_ALARM = 1
+};
+
+enum nx_rtc_resetdelay {
+	NX_RTC_RESETDELAY_BYPASS = 1ul << 0,
+	NX_RTC_RESETDELAY_31MS	 = 1ul << 1,
+	NX_RTC_RESETDELAY_62MS	 = 1ul << 2,
+	NX_RTC_RESETDELAY_93MS	 = 1ul << 3,
+	NX_RTC_RESETDELAY_124MS	 = 1ul << 4,
+	NX_RTC_RESETDELAY_155MS	 = 1ul << 5,
+	NX_RTC_RESETDELAY_186MS	 = 1ul << 6,
+	NX_RTC_RESETDELAY_210MS	 = 0
+};
+
+enum nx_rtc_oscsel {
+	NX_RTC_OSCSEL_1HZ	= 0,
+	NX_RTC_OSCSEL_32HZ	= 1,
+};
+
+void nx_rtc_set_interrupt_enable(struct nx_rtc *info, int32_t int_num,
+				 bool enable)
+{
+	u32 regvalue;
+
+	regvalue = readl(info->base + RTC_INT_ENB);
+	regvalue &= ~(1ul << int_num);
+	regvalue |= (u32)enable << int_num;
+	writel(regvalue, info->base + RTC_INT_ENB);
+}
+
+int nx_rtc_get_interrupt_enable(struct nx_rtc *info, int32_t int_num)
+{
+	u32 regvalue;
+
+	regvalue = (int)((readl(info->base + RTC_INT_ENB) >> int_num) & 0x01);
+
+	return regvalue;
+}
+
+void nx_rtc_set_interrupt_enable32(struct nx_rtc *info, u32 enable_flag)
+{
+	const u32 enb_mask = 0x03;
+
+	writel(enable_flag & enb_mask, info->base + RTC_INT_ENB);
+}
+
+u32 nx_rtc_get_interrupt_enable32(struct nx_rtc *info)
+{
+	u32 regvalue;
+	const u32 enb_mask = 0x03;
+
+	regvalue = (u32)(readl(info->base + RTC_INT_ENB) & enb_mask);
+	return regvalue;
+}
+
+int nx_rtc_get_interrupt_pending(struct nx_rtc *info, int32_t int_num)
+{
+	u32 regvalue;
+
+	regvalue = (int)((readl(info->base + RTC_INT_PND) >> int_num) & 0x01);
+	return regvalue;
+}
+
+void nx_rtc_clear_interrupt_pending(struct nx_rtc *info, int32_t int_num)
+{
+	writel((u32)(1 << int_num),  info->base + RTC_INT_PND);
+}
+
+void nx_rtc_clear_interrupt_pending_all(struct nx_rtc *info)
+
+{
+	writel(0x03, info->base + RTC_INT_PND);
+}
+
+void nx_rtc_set_interrupt_enable_all(struct nx_rtc *info, bool enable)
+{
+	if (enable)
+		writel(0x03, info->base + RTC_INT_ENB);
+	else
+		writel(0x00, info->base + RTC_INT_ENB);
+}
+
+u32 nx_rtc_get_rtc_counter(struct nx_rtc *info)
+{
+	u32 rtc_cnt;
+
+	rtc_cnt = readl(info->base + RTC_CNT_READ);
+	return rtc_cnt;
+}
+
+void nx_rtc_set_rtc_counter_write_enable(struct nx_rtc *info, int enable)
+{
+	const u32 write_enb_pos = 0;
+	const u32 write_enb = 1ul << 0;
+	u32 regvalue;
+
+	regvalue = readl(info->base + RTC_CTRL);
+	regvalue &= ~(write_enb);
+	regvalue |= (enable) <<	write_enb_pos;
+	writel(regvalue, info->base + RTC_CTRL);
+}
+
+bool nx_rtc_is_busy_rtc_counter(struct nx_rtc *info)
+{
+	bool is_busy;
+	const u32 rtc_cnt_wait = (1ul << 4);
+
+	is_busy = (readl(info->base + RTC_CTRL) & rtc_cnt_wait) ? true : false;
+	return is_busy;
+}
+
+void nx_rtc_set_rtc_counter(struct nx_rtc *info, u32 rtc_counter)
+{
+	bool ret;
+
+	do {
+		ret = nx_rtc_is_busy_rtc_counter(info);
+	} while (ret);
+	writel(rtc_counter, info->base + RTC_CNT_WRITE);
+}
+
+void nx_rtc_set_alarm_counter(struct nx_rtc *info, u32 alarm_counter)
+{
+	writel(alarm_counter, info->base + RTC_ALARM);
+}
+
+u32 nx_rtc_get_alarm_counter(struct nx_rtc *info)
+{
+	u32 regvalue;
+
+	regvalue = readl(info->base + RTC_ALARM);
+	return regvalue;
+}
+
+int nx_rtc_is_busy_alarm_counter(struct nx_rtc *info)
+{
+	u32 regvalue;
+	const u32 alarm_cnt_wait = (1ul << 3);
+
+	regvalue = (readl(info->base + RTC_CTRL) & alarm_cnt_wait) ? true :
+		false;
+	return regvalue;
+}
+
+static void nx_rtc_setup(struct nx_rtc *info)
+{
+	unsigned long rtc, curr;
+	struct rtc_time rtc_tm;
+	bool ret;
+
+	dev_dbg(info->dev, "%s\n", __func__);
+
+	nx_rtc_clear_interrupt_pending_all(info);
+	nx_rtc_set_interrupt_enable_all(info, false);
+
+	rtc_time_offs = mktime(RTC_TIME_YEAR, 1, 1, 0, 0, 0);
+
+	rtc = nx_rtc_get_rtc_counter(info);
+
+	curr = rtc + rtc_time_offs;
+
+	if ((curr > RTC_TIME_MAX) || (curr < RTC_TIME_MIN)) {
+		/* set hw rtc */
+		nx_rtc_set_rtc_counter_write_enable(info, true);
+		nx_rtc_set_rtc_counter(info, RTC_TIME_DFT - rtc_time_offs);
+		do {
+			ret = nx_rtc_is_busy_rtc_counter(info);
+		} while (ret);
+
+		nx_rtc_set_rtc_counter_write_enable(info, false);
+
+		/* Confirm the write value. */
+		do {
+			ret = nx_rtc_is_busy_rtc_counter(info);
+		} while (ret);
+
+		rtc = nx_rtc_get_rtc_counter(info);
+	}
+
+	rtc_time_to_tm(rtc + rtc_time_offs, &rtc_tm);
+	dev_info(info->dev, "[RTC] day=%04d.%02d.%02d time=%02d:%02d:%02d\n",
+		 rtc_tm.tm_year + 1900, rtc_tm.tm_mon + 1, rtc_tm.tm_mday,
+		 rtc_tm.tm_hour, rtc_tm.tm_min, rtc_tm.tm_sec);
+}
+
+static int nx_rtc_irq_enable(int alarm, struct device *dev,
+			      unsigned int enable)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	int bit = alarm ? RTC_ALARM_BIT : RTC_COUNT_BIT;
+
+	dev_dbg(info->dev, "%s %s (enb:%d)\n",
+		__func__, alarm?"alarm":"count", enable);
+
+	if (enable)
+		nx_rtc_set_interrupt_enable(info, bit, true);
+	else
+		nx_rtc_set_interrupt_enable(info, bit, false);
+
+	if (alarm)
+		info->alm_enable_irq = enable;
+	else
+		info->rtc_enable_irq = enable;
+
+	return 0;
+}
+
+static irqreturn_t nx_rtc_interrupt(int irq, void *id)
+{
+	struct nx_rtc *info = (struct nx_rtc *)id;
+	int pend = nx_rtc_get_interrupt_enable32(info);
+
+	if (info->rtc_enable_irq && (pend & (1 << RTC_COUNT_BIT))) {
+		rtc_update_irq(info->rtc, 1, RTC_PF | RTC_UF | RTC_IRQF);
+		nx_rtc_clear_interrupt_pending(info, RTC_COUNT_BIT);
+		dev_dbg(info->dev, "IRQ: RTC Count (PND:0x%x, ENB:%d)\n",
+			pend, nx_rtc_get_interrupt_enable(info, RTC_COUNT_BIT));
+		return IRQ_HANDLED;
+	}
+
+	if (info->alm_enable_irq && (pend & (1 << RTC_ALARM_BIT))) {
+		rtc_update_irq(info->rtc, 1, RTC_AF | RTC_IRQF);
+		nx_rtc_clear_interrupt_pending(info, RTC_ALARM_BIT);
+		dev_dbg(info->dev, "IRQ: RTC Alarm (PND:0x%x, ENB:%d)\n",
+			pend, nx_rtc_get_interrupt_enable(info, RTC_ALARM_BIT));
+		return IRQ_HANDLED;
+	}
+
+	dev_info(info->dev, "IRQ: RTC Unknown (PND:0x%x, RTC ENB:%d, ALARM ENB:%d)\n",
+		 pend, nx_rtc_get_interrupt_enable(info, RTC_COUNT_BIT),
+		 nx_rtc_get_interrupt_enable(info, RTC_ALARM_BIT));
+
+	nx_rtc_clear_interrupt_pending_all(info);
+	return IRQ_NONE;
+}
+
+/*
+ * RTC OPS
+ */
+static int nx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	unsigned long rtc;
+
+	spin_lock_irq(&info->rtc_lock);
+
+	rtc = nx_rtc_get_rtc_counter(info);
+	rtc_time_to_tm(rtc + rtc_time_offs, tm);
+	dev_dbg(info->dev, "read time day=%04d.%02d.%02d time=%02d:%02d:%02d, rtc 0x%x\n",
+		tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+		tm->tm_hour, tm->tm_min, tm->tm_sec, (uint)rtc);
+
+	spin_unlock_irq(&info->rtc_lock);
+
+	return 0;
+}
+
+static int nx_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	unsigned long rtc, curr_sec;
+	bool ret;
+
+	spin_lock_irq(&info->rtc_lock);
+
+	curr_sec = mktime(tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+			  tm->tm_hour, tm->tm_min, tm->tm_sec);
+
+	rtc = curr_sec - rtc_time_offs;
+
+	dev_dbg(info->dev, "set time day=%02d.%02d.%02d time=%02d:%02d:%02d, rtc 0x%x\n",
+		 tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+		 tm->tm_hour, tm->tm_min, tm->tm_sec, (uint)rtc);
+
+	/* set hw rtc */
+	nx_rtc_set_rtc_counter_write_enable(info, true);
+	nx_rtc_set_rtc_counter(info, rtc);
+	do {
+		ret = nx_rtc_is_busy_rtc_counter(info);
+	} while (ret);
+
+	nx_rtc_set_rtc_counter_write_enable(info, false);
+
+	/* Confirm the write value. */
+	do {
+		ret = nx_rtc_is_busy_rtc_counter(info);
+	} while (ret);
+
+	spin_unlock_irq(&info->rtc_lock);
+	return 0;
+}
+
+static int nx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	struct rtc_time *tm = &alrm->time;
+	unsigned long count;
+
+	spin_lock_irq(&info->rtc_lock);
+
+	count = nx_rtc_get_alarm_counter(info);
+
+	rtc_time_to_tm(count + rtc_time_offs, tm);
+
+	alrm->enabled =
+		(true == nx_rtc_get_interrupt_enable(info, RTC_ALARM_BIT)
+		 ? 1 : 0);
+	alrm->pending =
+		(true == nx_rtc_get_interrupt_pending(info, RTC_ALARM_BIT)
+		 ? 1 : 0);
+
+	dev_dbg(info->dev, "read alarm day=%04d.%02d.%02d time=%02d:%02d:%02d,",
+		 tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+		 tm->tm_hour, tm->tm_min, tm->tm_sec);
+	dev_dbg(info->dev, "alarm 0x%08x\n", (uint)count);
+
+
+	spin_unlock_irq(&info->rtc_lock);
+
+	return 0;
+}
+
+static int nx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	struct rtc_time *tm = &alrm->time;
+	unsigned long count, seconds;
+	int ret;
+
+	spin_lock_irq(&info->rtc_lock);
+
+	seconds = mktime(tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+				tm->tm_hour, tm->tm_min, tm->tm_sec);
+
+	count = seconds - rtc_time_offs;
+
+	dev_dbg(info->dev, "set alarm day=%04d.%02d.%02d time=%02d:%02d:%02d, ",
+		 tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday,
+		 tm->tm_hour, tm->tm_min, tm->tm_sec);
+	dev_dbg(info->dev, "alarm %lu, %s\n", count, alrm->enabled?"ON":"OFF");
+
+	/* set hw rtc */
+	do {
+		ret = nx_rtc_is_busy_alarm_counter(info);
+	} while (ret > 0);
+
+	nx_rtc_set_alarm_counter(info, count);
+
+	/* Confirm the write value. */
+	do {
+		ret = nx_rtc_is_busy_alarm_counter(info);
+	} while (ret > 0);
+
+	nx_rtc_clear_interrupt_pending(info, RTC_ALARM_BIT);
+
+	/* 0: RTC Counter, 1: RTC Alarm */
+	nx_rtc_set_interrupt_enable(info, RTC_ALARM_BIT,
+				  alrm->enabled ? true : false);
+	/* set wakeup source form stop mode */
+	nx_clkpwr_set_rtc_wakeup_enable(alrm->enabled ? true : false);
+
+	info->alm_enable_irq = alrm->enabled;
+
+	spin_unlock_irq(&info->rtc_lock);
+	return 0;
+}
+
+static int nx_rtc_alarm_irq_enable(struct device *dev, unsigned int enable)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+
+	dev_dbg(info->dev, "%s (enb:%d)\n", __func__, enable);
+	return nx_rtc_irq_enable(1, dev, enable);
+}
+
+static int nx_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	int ret = 0;
+
+	dev_dbg(info->dev, "%s cmd=%08x, arg=%08lx\n", __func__, cmd, arg);
+
+	spin_lock_irq(&info->rtc_lock);
+
+	switch (cmd) {
+	case RTC_AIE_OFF:
+		nx_rtc_irq_enable(1, dev, 0);
+		break;
+	case RTC_AIE_ON:
+		nx_rtc_irq_enable(1, dev, 1);
+		break;
+	case RTC_UIE_OFF:
+		nx_rtc_irq_enable(0, dev, 0);
+		break;
+	case RTC_UIE_ON:
+		nx_rtc_irq_enable(0, dev, 1);
+		break;
+	case RTC_IRQP_SET:
+		ret = ENOTTY;
+		break;
+	default:
+		ret = -ENOIOCTLCMD;
+	}
+
+	spin_unlock_irq(&info->rtc_lock);
+	return ret;
+}
+
+/*
+ * Provide additional RTC information in /proc/driver/rtc
+ */
+static int nx_rtc_proc(struct device *dev, struct seq_file *seq)
+{
+	struct nx_rtc *info = dev_get_drvdata(dev);
+	bool irq = nx_rtc_get_interrupt_enable(info, RTC_COUNT_BIT);
+
+	seq_printf(seq, "update_IRQ\t: %s\n", irq ? "yes" : "no");
+	seq_printf(seq, "periodic_IRQ\t: %s\n", irq ? "yes" : "no");
+	return 0;
+}
+
+static const struct rtc_class_ops nx_rtc_ops = {
+	.ioctl			= nx_rtc_ioctl,
+	.read_time		= nx_rtc_read_time,
+	.set_time		= nx_rtc_set_time,
+	.read_alarm		= nx_rtc_read_alarm,
+	.set_alarm		= nx_rtc_set_alarm,
+	.proc			= nx_rtc_proc,
+	.alarm_irq_enable	= nx_rtc_alarm_irq_enable,
+};
+
+/*
+ * RTC platform driver functions
+ */
+static int nx_rtc_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	struct nx_rtc *info = platform_get_drvdata(pdev);
+
+	dev_dbg(info->dev, "+%s (rtc irq:%s, alarm irq:%s, wakeup=%d)\n",
+		__func__, info->rtc_enable_irq?"on":"off",
+		info->alm_enable_irq?"on":"off", device_may_wakeup(&pdev->dev));
+
+	if (info->rtc_enable_irq) {
+		nx_rtc_clear_interrupt_pending(info, RTC_COUNT_BIT);
+		nx_rtc_set_interrupt_enable(info, RTC_COUNT_BIT, false);
+	}
+
+	if (info->alm_enable_irq) {
+		unsigned long count = nx_rtc_get_alarm_counter(info);
+		struct rtc_time tm;
+
+		rtc_time_to_tm(count, &tm);
+		dev_dbg(info->dev, "%s (alarm day=%04d.%02d.%02d time=%02d:%02d:%02d, ",
+			__func__, tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+			tm.tm_hour, tm.tm_min, tm.tm_sec);
+		dev_dbg(info->dev, "alarm %lu)\n", count);
+	}
+
+	dev_dbg(info->dev, "-%s\n", __func__);
+	return 0;
+}
+
+static int nx_rtc_resume(struct platform_device *pdev)
+{
+	struct nx_rtc *info = platform_get_drvdata(pdev);
+
+	dev_dbg(info->dev, "+%s (rtc irq:%s, alarm irq:%s)\n",
+		__func__, info->rtc_enable_irq?"on":"off",
+		info->alm_enable_irq?"on":"off");
+
+	if (info->rtc_enable_irq) {
+		nx_rtc_clear_interrupt_pending(info, RTC_COUNT_BIT);
+		nx_rtc_set_interrupt_enable(info, RTC_COUNT_BIT, true);
+	}
+	dev_dbg(info->dev, "-%s\n", __func__);
+	return 0;
+}
+
+static int nx_rtc_probe(struct platform_device *pdev)
+{
+	struct nx_rtc *info = NULL;
+	struct resource *res;
+	int ret;
+
+	info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	/* find the IRQs */
+	info->irq_rtc = platform_get_irq(pdev, 0);
+	if (info->irq_rtc < 0) {
+		dev_err(&pdev->dev, "no irq for rtc\n");
+		return info->irq_rtc;
+	}
+
+	info->dev = &pdev->dev;
+	spin_lock_init(&info->rtc_lock);
+
+	platform_set_drvdata(pdev, info);
+
+	dev_dbg(info->dev, "%s: rtc irq %d\n", __func__, info->irq_rtc);
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	info->base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(info->base))
+		return PTR_ERR(info->base);
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	clkpwr_reg_for_rtc = ioremap_nocache(res->start, resource_size(res));
+	if (IS_ERR(clkpwr_reg_for_rtc))
+		return PTR_ERR(clkpwr_reg_for_rtc);
+
+	nx_rtc_setup(info);
+
+	/* cpu init code should really have flagged this device as
+	 * being wake-capable; if it didn't, do that here.
+	 */
+	if (!device_can_wakeup(&pdev->dev))
+		device_init_wakeup(&pdev->dev, 1);
+
+	/* register RTC and exit */
+	info->rtc = devm_rtc_device_register(&pdev->dev, "nx", &nx_rtc_ops,
+				  THIS_MODULE);
+	if (IS_ERR(info->rtc)) {
+		dev_err(&pdev->dev, "cannot attach rtc\n");
+		ret = PTR_ERR(info->rtc);
+		return ret;
+	}
+
+	/* register disabled irq */
+	ret = devm_request_irq(&pdev->dev, info->irq_rtc,
+					 nx_rtc_interrupt, 0, "rtc 1hz", info);
+	if (ret) {
+		dev_err(&pdev->dev, "IRQ%d error %d\n", info->irq_rtc, ret);
+		return ret;
+	}
+
+	/* set rtc frequency value */
+	info->rtc->irq_freq	   = 1;
+	info->rtc->max_user_freq = 1;
+
+	dev_dbg(info->dev, "done: rtc probe ...\n");
+
+	return 0;
+}
+
+static int nx_rtc_remove(struct platform_device *pdev)
+{
+	struct nx_rtc *info = platform_get_drvdata(pdev);
+
+	dev_dbg(info->dev, "%s\n", __func__);
+
+	free_irq(info->irq_rtc, info->rtc);
+
+	devm_rtc_device_unregister(&pdev->dev, info->rtc);
+	platform_set_drvdata(pdev, NULL);
+
+	kfree(info->rtc);
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nx_rtc_dt_match[] = {
+	{ .compatible = "nexell,nx-rtc"},
+	{ },
+};
+MODULE_DEVICE_TABLE(of, nx_rtc_dt_match);
+#else
+#define nx_rtc_dt_match NULL
+#endif
+
+static struct platform_driver nx_rtc_driver = {
+	.probe		= nx_rtc_probe,
+	.remove		= nx_rtc_remove,
+	.suspend	= nx_rtc_suspend,
+	.resume		= nx_rtc_resume,
+	.driver		= {
+		.name	= "nx-rtc",
+		.owner	= THIS_MODULE,
+		.of_match_table	= of_match_ptr(nx_rtc_dt_match),
+	},
+};
+module_platform_driver(nx_rtc_driver);
+
+MODULE_DESCRIPTION("RTC driver for the Nexell");
+MODULE_AUTHOR("Hyunseok Jung <hsjung@nexell.co.kr>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:rtc");
diff -ENwbur a/drivers/soc/Kconfig b/drivers/soc/Kconfig
--- a/drivers/soc/Kconfig	2018-05-06 08:47:38.209379854 +0200
+++ b/drivers/soc/Kconfig	2018-05-06 08:49:51.090773002 +0200
@@ -17,5 +17,6 @@
 source "drivers/soc/ux500/Kconfig"
 source "drivers/soc/versatile/Kconfig"
 source "drivers/soc/zte/Kconfig"
+source "drivers/soc/nexell/Kconfig"

 endmenu
diff -ENwbur a/drivers/soc/Makefile b/drivers/soc/Makefile
--- a/drivers/soc/Makefile	2018-05-06 08:47:38.209379854 +0200
+++ b/drivers/soc/Makefile	2018-05-06 08:49:51.090773002 +0200
@@ -23,3 +23,4 @@
 obj-$(CONFIG_ARCH_U8500)	+= ux500/
 obj-$(CONFIG_PLAT_VERSATILE)	+= versatile/
 obj-$(CONFIG_ARCH_ZX)		+= zte/
+obj-$(CONFIG_ARCH_S5P6818)   	+= nexell/
diff -ENwbur a/drivers/soc/nexell/Kconfig b/drivers/soc/nexell/Kconfig
--- a/drivers/soc/nexell/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/soc/nexell/Kconfig	2018-05-06 08:49:51.094773166 +0200
@@ -0,0 +1,3 @@
+if ARCH_S5P6818
+source "drivers/soc/nexell/s5pxx18/Kconfig"
+endif
diff -ENwbur a/drivers/soc/nexell/Makefile b/drivers/soc/nexell/Makefile
--- a/drivers/soc/nexell/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/soc/nexell/Makefile	2018-05-06 08:49:51.094773166 +0200
@@ -0,0 +1,2 @@
+obj-$(CONFIG_ARCH_S5P6818) += s5pxx18/
+obj-$(CONFIG_ARCH_S5P4418) += s5pxx18/
diff -ENwbur a/drivers/soc/nexell/s5pxx18/cpu-sys.c b/drivers/soc/nexell/s5pxx18/cpu-sys.c
--- a/drivers/soc/nexell/s5pxx18/cpu-sys.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/soc/nexell/s5pxx18/cpu-sys.c	2018-05-06 08:49:51.094773166 +0200
@@ -0,0 +1,301 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/ctype.h>
+#include <linux/io.h>
+
+#define PHY_BASEADDR_ECID_MODULE	(0xC0067000)
+
+struct nx_ecid_register_set {
+	u32 ecid[4];
+	u8 chipname[48];
+	u32 reserved;
+	u32 guid0;
+	u16 guid1;
+	u16 guid2;
+	u8 guid3[8];
+	u32 ec[3];
+};
+
+struct nx_guid {
+	u32 guid0;
+	u16 guid1;
+	u16 guid2;
+	u8 guid3[8];
+};
+
+static struct {
+	struct nx_ecid_register_set *pregister;
+} __g_module_variables = {
+	NULL,
+};
+
+
+static unsigned int convertmsblsb(uint32_t data, int bits)
+{
+	uint32_t result = 0;
+	uint32_t mask = 1;
+	int i = 0;
+
+	for (i = 0; i < bits ; i++) {
+		if (data & (1<<i))
+			result |= mask<<(bits-i-1);
+	}
+	return result;
+}
+
+static const char gst36Strtable[36] = {
+	'0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
+	'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',
+	'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S',
+	'T', 'U', 'V', 'W', 'X', 'Y', 'Z'
+};
+
+static void lotid_num2string(uint32_t lotId, char str[6])
+{
+	uint32_t value[3];
+	uint32_t mad[3];
+
+	value[0] = lotId / 36;
+	mad[0] = lotId % 36;
+
+	value[1] = value[0] / 36;
+	mad[1] = value[0] % 36;
+
+	value[2] = value[1] / 36;
+	mad[2] = value[1]  % 36;
+
+	str[0] = 'N';
+	str[1] = gst36Strtable[value[2]];
+	str[2] = gst36Strtable[mad[2]];
+	str[3] = gst36Strtable[mad[1]];
+	str[4] = gst36Strtable[mad[0]];
+	str[5] = '\0';
+}
+
+void nx_ecid_set_base_address(void *base_address)
+{
+	__g_module_variables.pregister =
+	    (struct nx_ecid_register_set *)base_address;
+}
+
+int nx_ecid_get_key_ready(void)
+{
+	const u32 ready_pos = 15;
+	const u32 ready_mask = 1ul << ready_pos;
+
+	register u32 regval;
+
+	regval = __g_module_variables.pregister->ec[2];
+
+	return (int)((regval & ready_mask) >> ready_pos);
+}
+
+void nx_ecid_get_chip_name(u8 chip_name[49])
+{
+	u32 i;
+
+	for (i = 0; i < 48; i++)
+		chip_name[i] = __g_module_variables.pregister->chipname[i];
+
+	for (i = 0; i < 48; i++) {
+		if ((chip_name[i] == '-') && (chip_name[i + 1] == '-')) {
+			chip_name[i] = 0;
+			chip_name[i + 1] = 0;
+		}
+	}
+}
+
+void nx_ecid_get_ecid(u32 ecid[4])
+{
+	ecid[0] = __g_module_variables.pregister->ecid[0];
+	ecid[1] = __g_module_variables.pregister->ecid[1];
+	ecid[2] = __g_module_variables.pregister->ecid[2];
+	ecid[3] = __g_module_variables.pregister->ecid[3];
+}
+
+void nx_ecid_get_guid(struct nx_guid *guid)
+{
+	guid->guid0 = __g_module_variables.pregister->guid0;
+	guid->guid1 = __g_module_variables.pregister->guid1;
+	guid->guid2 = __g_module_variables.pregister->guid2;
+	guid->guid3[0] = __g_module_variables.pregister->guid3[0];
+	guid->guid3[1] = __g_module_variables.pregister->guid3[1];
+	guid->guid3[2] = __g_module_variables.pregister->guid3[2];
+	guid->guid3[3] = __g_module_variables.pregister->guid3[3];
+	guid->guid3[4] = __g_module_variables.pregister->guid3[4];
+	guid->guid3[5] = __g_module_variables.pregister->guid3[5];
+	guid->guid3[6] = __g_module_variables.pregister->guid3[6];
+	guid->guid3[7] = __g_module_variables.pregister->guid3[7];
+}
+
+static inline int wait_key_ready(void)
+{
+	while (!nx_ecid_get_key_ready()) {
+		if (time_after(jiffies, jiffies + 1)) {
+			if (nx_ecid_get_key_ready())
+				break;
+			pr_err("Error: id not key ready\n");
+			return -EINVAL;
+		}
+		cpu_relax();
+	}
+	return 0;
+}
+
+int nxp_cpu_id_guid(u32 guid[4])
+{
+	if (0 > wait_key_ready())
+		return -EINVAL;
+	nx_ecid_get_guid((struct nx_guid *)guid);
+	return 0;
+}
+
+int nxp_cpu_id_ecid(u32 ecid[4])
+{
+	if (0 > wait_key_ready())
+		return -EINVAL;
+	nx_ecid_get_ecid(ecid);
+	return 0;
+}
+
+int nxp_cpu_id_string(u32 *string)
+{
+	if (0 > wait_key_ready())
+		return -EINVAL;
+	nx_ecid_get_chip_name((char *)string);
+	return 0;
+}
+
+/* Notify cpu GUID: /sys/devices/platform/cpu,  guid, uuid,  name  */
+static ssize_t sys_id_show(struct device *pdev, struct device_attribute *attr,
+			   char *buf)
+{
+	struct attribute *at = &attr->attr;
+	char *s = buf;
+	u32 uid[4] = {0, };
+	u8  name[12*4] = {0,};
+	int string = -EINVAL;
+
+	pr_debug("[%s : name =%s ]\n", __func__, at->name);
+
+	if (!strcmp(at->name, "uuid"))
+		nxp_cpu_id_ecid(uid);
+	else if (!strcmp(at->name, "guid"))
+		nxp_cpu_id_guid(uid);
+	else if (!strcmp(at->name, "name"))
+		string = nxp_cpu_id_string((u32 *)name);
+	else
+		return -EINVAL;
+
+	if (!string) {
+		if (isprint(name[0])) {
+			s += sprintf(s, "%s\n", name);
+		} else {
+			#define _W	(12)	/* width */
+			int i;
+
+			for (i = 0; i < sizeof(name); i++) {
+				s += sprintf(s, "%02x", name[i]);
+				if ((i+1) % _W == 0)
+					s += sprintf(s, " ");
+			}
+			s += sprintf(s, "\n");
+		}
+	} else {
+		s += sprintf(s, "%08x:%08x:%08x:%08x\n",
+			     uid[0], uid[1], uid[2], uid[3]);
+	}
+
+	if (s != buf)
+		*(s-1) = '\n';
+
+	return (s - buf);
+}
+
+static struct device_attribute __guid__ =
+			__ATTR(guid, 0644, sys_id_show, NULL);
+static struct device_attribute __uuid__ =
+			__ATTR(uuid, 0644, sys_id_show, NULL);
+static struct device_attribute __name__ =
+			__ATTR(name, 0644, sys_id_show, NULL);
+
+static struct attribute *sys_attrs[] = {
+	&__guid__.attr,
+	&__uuid__.attr,
+	&__name__.attr,
+	NULL,
+};
+
+static struct attribute_group sys_attr_group = {
+	.attrs = (struct attribute **)sys_attrs,
+};
+
+static int __init cpu_sys_id_setup(void)
+{
+	struct kobject *kobj;
+	u32 uid[4] = {0, };
+	int ret = 0;
+	u32 lotid;
+	char strlotid[6];
+	void __iomem *base_addr = NULL;
+
+	base_addr = ioremap_nocache(PHY_BASEADDR_ECID_MODULE, 0x1000);
+	if (!base_addr) {
+		pr_err("Failed to ioremap to ECIO base address.\n");
+		return -EIO;
+	}
+
+	nx_ecid_set_base_address(base_addr);
+
+	kobj = kobject_create_and_add("cpu", &platform_bus.kobj);
+	if (!kobj) {
+		pr_err("Failed create cpu kernel object ....\n");
+		return -ret;
+	}
+
+	ret = sysfs_create_group(kobj, &sys_attr_group);
+	if (ret) {
+		pr_err("Failed create cpu sysfs group ...\n");
+		kobject_del(kobj);
+		return -ret;
+	}
+
+	if (0 > nxp_cpu_id_ecid(uid))
+		pr_err("FAIL: ecid !!!\n");
+
+	lotid =  convertmsblsb(uid[0] & 0x1FFFFF, 21);
+	lotid_num2string(lotid, strlotid);
+
+	pr_info("ECID: %08x:%08x:%08x:%08x\n", uid[0], uid[1], uid[2], uid[3]);
+	pr_info("LOT ID : %s\n", strlotid);
+
+	return ret;
+}
+
+static int __init cpu_sys_init_setup(void)
+{
+	cpu_sys_id_setup();
+	return 0;
+}
+core_initcall(cpu_sys_init_setup);
diff -ENwbur a/drivers/soc/nexell/s5pxx18/Kconfig b/drivers/soc/nexell/s5pxx18/Kconfig
--- a/drivers/soc/nexell/s5pxx18/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/soc/nexell/s5pxx18/Kconfig	2018-05-06 08:49:51.094773166 +0200
@@ -0,0 +1,3 @@
+menu "NEXELL s5pxx18"
+
+endmenu
diff -ENwbur a/drivers/soc/nexell/s5pxx18/Makefile b/drivers/soc/nexell/s5pxx18/Makefile
--- a/drivers/soc/nexell/s5pxx18/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/soc/nexell/s5pxx18/Makefile	2018-05-06 08:49:51.094773166 +0200
@@ -0,0 +1,2 @@
+obj-y += tieoff_init.o
+obj-y += cpu-sys.o
diff -ENwbur a/drivers/soc/nexell/s5pxx18/tieoff_init.c b/drivers/soc/nexell/s5pxx18/tieoff_init.c
--- a/drivers/soc/nexell/s5pxx18/tieoff_init.c	1970-01-01 01:00:00.000000000 +0100
+++ b/drivers/soc/nexell/s5pxx18/tieoff_init.c	2018-05-06 08:49:51.094773166 +0200
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/of.h>
+#include <linux/of_fdt.h>
+#include <linux/of_address.h>
+#include <linux/io.h>
+
+#define	NX_PIN_FN_SIZE	4
+#define TIEOFF_REG_NUM 33
+
+struct	nx_tieoff_registerset {
+	u32	tieoffreg[TIEOFF_REG_NUM];
+};
+
+static struct nx_tieoff_registerset *nx_tieoff;
+
+
+void nx_tieoff_set(u32 tieoff_index, u32 tieoff_value)
+{
+	u32 regindex, mask;
+	u32 lsb, msb;
+	u32 regval;
+
+	u32 position;
+	u32 BitWidth;
+
+	position = tieoff_index & 0xffff;
+	BitWidth = (tieoff_index>>16) & 0xffff;
+
+	regindex	= position>>5;
+
+	lsb = position & 0x1F;
+	msb = lsb+BitWidth;
+
+	if (msb > 32) {
+		msb &= 0x1F;
+		mask   = ~(0xffffffff<<lsb);
+		regval = readl(&nx_tieoff->tieoffreg[regindex]) & mask;
+		regval |= ((tieoff_value & ((1UL<<BitWidth)-1))<<lsb);
+		writel(regval, &nx_tieoff->tieoffreg[regindex]);
+
+		mask   = (0xffffffff<<msb);
+		regval = readl(&nx_tieoff->tieoffreg[regindex+1]) & mask;
+		regval |= ((tieoff_value & ((1UL<<BitWidth)-1))>>msb);
+		writel(regval, &nx_tieoff->tieoffreg[regindex+1]);
+	} else	{
+		mask	= (0xffffffff<<msb) | (~(0xffffffff<<lsb));
+		regval	= readl(&nx_tieoff->tieoffreg[regindex]) & mask;
+		regval	|= ((tieoff_value & ((1UL<<BitWidth)-1))<<lsb);
+		writel(regval, &nx_tieoff->tieoffreg[regindex]);
+	}
+}
+EXPORT_SYMBOL_GPL(nx_tieoff_set);
+
+u32 nx_tieoff_get(u32 tieoff_index)
+{
+	u32 regindex, mask;
+	u32 lsb, msb;
+	u32 regval;
+
+	u32 position;
+	u32 BitWidth;
+
+	position = tieoff_index & 0xffff;
+	BitWidth = (tieoff_index>>16) & 0xffff;
+
+	regindex = position/32;
+	lsb = position % 32;
+	msb = lsb+BitWidth;
+
+	if (msb > 32) {
+		msb &= 0x1F;
+		mask   = 0xffffffff<<lsb;
+		regval = readl(&nx_tieoff->tieoffreg[regindex]) & mask;
+		regval >>= lsb;
+
+		mask   = ~(0xffffffff<<msb);
+		regval |= ((readl(&nx_tieoff->tieoffreg[regindex+1]) & mask)
+			  << (32-lsb));
+	} else	{
+		mask   = ~(0xffffffff<<msb) & (0xffffffff<<lsb);
+		regval = readl(&nx_tieoff->tieoffreg[regindex]) & mask;
+		regval >>= lsb;
+	}
+	return regval;
+}
+EXPORT_SYMBOL_GPL(nx_tieoff_get);
+
+static const struct of_device_id nexell_tieoff_match[] = {
+	{ .compatible = "nexell,tieoff", .data = NULL },
+};
+
+static int __init cpu_early_initcall_setup(void)
+{
+	const struct of_device_id *match;
+	struct device_node *np;
+	struct resource regs;
+	struct device_node *child;
+	const __be32 *list;
+	u32 pins[32];
+	int index = 0, size = 0;
+
+	np = of_find_matching_node_and_match(NULL, nexell_tieoff_match, &match);
+	if (!np) {
+		regs.start = 0xc0011000;
+		regs.end = 0xc0012000;
+		regs.flags = IORESOURCE_MEM;
+	} else {
+		if (of_address_to_resource(np, 0, &regs) < 0) {
+			pr_err("failed to get tieoff registers\n");
+			return -ENXIO;
+		}
+	};
+
+	nx_tieoff = ioremap_nocache(regs.start, resource_size(&regs));
+	if (!nx_tieoff) {
+		pr_err("failed to map tieoff registers\n");
+		return -ENXIO;
+	}
+
+	np = of_find_node_by_name(NULL, "soc");
+	if (!np) {
+		pr_err("** WARNING: Not exist tieoff DTS for init Tieoff.**\n");
+		return -EINVAL;
+	}
+
+	for_each_child_of_node(np, child) {
+		list = of_get_property(child, "soc,tieoff", &size);
+		size /= NX_PIN_FN_SIZE;
+		if (!list)
+			continue;
+
+		for (index = 0; index < size; index++)
+			pins[index] = be32_to_cpu(*list++);
+
+		for (index = 0; size > index; index += 2)
+			nx_tieoff_set(pins[index], pins[index+1]);
+
+	}
+	return 0;
+}
+early_initcall(cpu_early_initcall_setup);
diff -ENwbur a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
--- a/drivers/thermal/Kconfig	2018-05-06 08:47:38.497391546 +0200
+++ b/drivers/thermal/Kconfig	2018-05-06 08:49:51.374784527 +0200
@@ -419,7 +419,7 @@
 endmenu

 menu "Samsung thermal drivers"
-depends on ARCH_EXYNOS || COMPILE_TEST
+depends on ARCH_EXYNOS || ARCH_S5P6818 || COMPILE_TEST
 source "drivers/thermal/samsung/Kconfig"
 endmenu

diff -ENwbur a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
--- a/drivers/thermal/samsung/exynos_tmu.c	2018-05-06 08:47:38.501391709 +0200
+++ b/drivers/thermal/samsung/exynos_tmu.c	2018-05-06 08:49:51.378784688 +0200
@@ -37,6 +37,7 @@

 #include "exynos_tmu.h"
 #include "../thermal_core.h"
+#include "../thermal_hwmon.h"

 /* Exynos generic registers */
 #define EXYNOS_TMU_REG_TRIMINFO		0x0
@@ -165,6 +166,12 @@
 #define EXYNOS7_EMUL_DATA_SHIFT			7
 #define EXYNOS7_EMUL_DATA_MASK			0x1ff

+/* s5p6818 specific  */
+#define S5P6818_TMU_REG_INTEN			0xB0
+#define S5P6818_TMU_REG_INTSTAT			0xB4
+#define S5P6818_TMU_REG_INTCLEAR		0xB8
+#define S5P6818_TMU_REG_EMUL_CON		0x100
+
 #define MCELSIUS	1000
 /**
  * struct exynos_tmu_data : A structure to hold the private data of the TMU
@@ -213,6 +213,8 @@ struct exynos_tmu_data {
 	struct regulator *regulator;
 	struct thermal_zone_device *tzd;
 	unsigned int ntrip;
+	bool isInitialized;
+	bool isAddedToSysfs;
 	bool enabled;
 
 	int (*tmu_initialize)(struct platform_device *pdev);
@@ -770,6 +779,10 @@
 		con &= ~(1 << EXYNOS_TMU_CORE_EN_SHIFT);
 		interrupt_en = 0; /* Disable all interrupts */
 	}
+
+	if (data->soc == SOC_ARCH_S5P6818)
+		writel(interrupt_en, data->base + S5P6818_TMU_REG_INTEN);
+	else
 	writel(interrupt_en, data->base + EXYNOS_TMU_REG_INTEN);
 	writel(con, data->base + EXYNOS_TMU_REG_CONTROL);
 }
@@ -893,6 +906,14 @@
 	if (!data || !data->tmu_read)
 		return -EINVAL;

+	if( ! data->isInitialized ) {
+		/* We are probably within thermal_zone_of_sensor_register call.
+		 * Return fake temperature, low enough to not trigger shutdown sequence
+		 * by thermal zone handler.
+		 */
+		*temp = 25 * MCELSIUS;
+		return 0;
+	}
 	mutex_lock(&data->lock);
 	clk_enable(data->clk);

@@ -947,6 +968,8 @@
 		emul_con = EXYNOS5433_TMU_EMUL_CON;
 	else if (data->soc == SOC_ARCH_EXYNOS7)
 		emul_con = EXYNOS7_TMU_REG_EMUL_CON;
+	else if (data->soc == SOC_ARCH_S5P6818)
+		emul_con = S5P6818_TMU_REG_EMUL_CON;
 	else
 		emul_con = EXYNOS_EMUL_CON;

@@ -1060,6 +1083,9 @@
 	} else if (data->soc == SOC_ARCH_EXYNOS5433) {
 		tmu_intstat = EXYNOS5433_TMU_REG_INTPEND;
 		tmu_intclear = EXYNOS5433_TMU_REG_INTPEND;
+	} else if (data->soc == SOC_ARCH_S5P6818) {
+		tmu_intstat = S5P6818_TMU_REG_INTSTAT;
+		tmu_intclear = S5P6818_TMU_REG_INTCLEAR;
 	} else {
 		tmu_intstat = EXYNOS_TMU_REG_INTSTAT;
 		tmu_intclear = EXYNOS_TMU_REG_INTCLEAR;
@@ -1107,6 +1133,7 @@
 	{ .compatible = "samsung,exynos5433-tmu", },
 	{ .compatible = "samsung,exynos5440-tmu", },
 	{ .compatible = "samsung,exynos7-tmu", },
+	{ .compatible = "nexell,s5p6818-tmu", },
 	{ /* sentinel */ },
 };
 MODULE_DEVICE_TABLE(of, exynos_tmu_match);
@@ -1134,7 +1161,8 @@
 		return SOC_ARCH_EXYNOS5440;
 	else if (of_device_is_compatible(np, "samsung,exynos7-tmu"))
 		return SOC_ARCH_EXYNOS7;
-
+	else if (of_device_is_compatible(np, "nexell,s5p6818-tmu"))
+		return SOC_ARCH_S5P6818;
 	return -EINVAL;
 }

@@ -1226,6 +1254,7 @@
 	case SOC_ARCH_EXYNOS5250:
 	case SOC_ARCH_EXYNOS5260:
 	case SOC_ARCH_EXYNOS5420:
+	case SOC_ARCH_S5P6818:
 	case SOC_ARCH_EXYNOS5420_TRIMINFO:
 		data->tmu_initialize = exynos4412_tmu_initialize;
 		data->tmu_control = exynos4210_tmu_control;
@@ -1401,6 +1430,13 @@
 	}

 	exynos_tmu_control(pdev, true);
+	data->isInitialized = true;
+	if( (ret = thermal_add_hwmon_sysfs(data->tzd)) == 0 ) {
+		data->isAddedToSysfs = true;
+	}else{
+		/* don't run away - print error only */
+		dev_err(&pdev->dev, "Failed to add in sysfs as hwmon: %d\n", ret);
+	}
 	return 0;

 err_thermal:
@@ -1424,6 +1460,8 @@
 	struct exynos_tmu_data *data = platform_get_drvdata(pdev);
 	struct thermal_zone_device *tzd = data->tzd;

+	if( data->isAddedToSysfs )
+		thermal_remove_hwmon_sysfs(tzd);
 	thermal_zone_of_sensor_unregister(&pdev->dev, tzd);
 	exynos_tmu_control(pdev, false);

diff -ENwbur a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
--- a/drivers/thermal/samsung/exynos_tmu.h	2018-05-06 08:47:38.501391709 +0200
+++ b/drivers/thermal/samsung/exynos_tmu.h	2018-05-06 08:49:51.378784688 +0200
@@ -36,6 +36,7 @@
 	SOC_ARCH_EXYNOS5433,
 	SOC_ARCH_EXYNOS5440,
 	SOC_ARCH_EXYNOS7,
+	SOC_ARCH_S5P6818,
 };

 /**
diff -ENwbur a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
--- a/drivers/tty/serial/Kconfig	2018-05-06 08:47:38.517392359 +0200
+++ b/drivers/tty/serial/Kconfig	2018-05-06 08:49:51.394785339 +0200
@@ -241,7 +241,7 @@

 config SERIAL_SAMSUNG
 	tristate "Samsung SoC serial support"
-	depends on PLAT_SAMSUNG || ARCH_EXYNOS
+	depends on PLAT_SAMSUNG || ARCH_EXYNOS || ARCH_S5P6818
 	select SERIAL_CORE
 	help
 	  Support for the on-chip UARTs on the Samsung S3C24XX series CPUs,
@@ -259,6 +259,7 @@
 config SERIAL_SAMSUNG_UARTS
 	int
 	depends on SERIAL_SAMSUNG
+	default 6 if ARCH_S5P6818
 	default 4 if SERIAL_SAMSUNG_UARTS_4 || CPU_S3C2416
 	default 3
 	help
diff -ENwbur a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
--- a/drivers/tty/serial/samsung.c	2018-05-06 08:47:38.529392846 +0200
+++ b/drivers/tty/serial/samsung.c	2018-05-06 08:49:51.406785825 +0200
@@ -1553,6 +1553,32 @@
 			.flags		= UPF_BOOT_AUTOCONF,
 			.line		= 3,
 		}
+	},
+#endif
+#if CONFIG_SERIAL_SAMSUNG_UARTS > 4
+	[4] = {
+		.port = {
+			.lock		= __PORT_LOCK_UNLOCKED(4),
+			.iotype		= UPIO_MEM,
+			.uartclk	= 0,
+			.fifosize	= 16,
+			.ops		= &s3c24xx_serial_ops,
+			.flags		= UPF_BOOT_AUTOCONF,
+			.line		= 4,
+		}
+	},
+#endif
+#if CONFIG_SERIAL_SAMSUNG_UARTS > 5
+	[5] = {
+		.port = {
+			.lock		= __PORT_LOCK_UNLOCKED(5),
+			.iotype		= UPIO_MEM,
+			.uartclk	= 0,
+			.fifosize	= 16,
+			.ops		= &s3c24xx_serial_ops,
+			.flags		= UPF_BOOT_AUTOCONF,
+			.line		= 5,
+		}
 	}
 #endif
 };
@@ -1845,6 +1871,24 @@
 		ourport->port.fifosize = ourport->info->fifosize;

 	/*
+	 * patch for s5p6818
+	 * s5p6818 uart needs reset before enabled
+	 */
+#ifdef CONFIG_RESET_CONTROLLER
+	if (ourport->info->has_reset_control) {
+		struct reset_control *rst;
+
+		rst = devm_reset_control_get(&pdev->dev, "uart-reset");
+		if (IS_ERR(rst)) {
+			dev_err(&pdev->dev, "failed to get reset control\n");
+			return -EINVAL;
+		}
+		if (reset_control_status(rst))
+			reset_control_reset(rst);
+        reset_control_put(rst);
+	}
+#endif
+	/*
 	 * DMA transfers must be aligned at least to cache line size,
 	 * so find minimal transfer size suitable for DMA mode
 	 */
@@ -1933,6 +1977,23 @@
 	struct s3c24xx_uart_port *ourport = to_ourport(port);

 	if (port) {
+		/*
+		 * patch for s5p6818
+		 * s5p6818 uart needs reset before enabled
+		 */
+#ifdef CONFIG_RESET_CONTROLLER
+		if (ourport->info->has_reset_control) {
+			struct reset_control *rst;
+
+			rst = devm_reset_control_get(dev, "uart-reset");
+			if (!rst) {
+				dev_err(dev, "failed to get reset control\n");
+				return -EINVAL;
+			}
+            reset_control_reset(rst);
+            reset_control_put(rst);
+		}
+#endif
 		/* restore IRQ mask */
 		if (s3c24xx_serial_has_interrupt_mask(port)) {
 			unsigned int uintm = 0xf;
@@ -2353,6 +2414,36 @@
 #define EXYNOS5433_SERIAL_DRV_DATA (kernel_ulong_t)NULL
 #endif

+#if defined(CONFIG_ARCH_S5P6818)
+static struct s3c24xx_serial_drv_data nexell_serial_drv_data = {
+	.info = &(struct s3c24xx_uart_info) {
+		.name		= "Nexell UART",
+		.type		= PORT_S3C6400,
+		.has_divslot	= 1,
+		.has_reset_control = 1,
+		.rx_fifomask	= S5PV210_UFSTAT_RXMASK,
+		.rx_fifoshift	= S5PV210_UFSTAT_RXSHIFT,
+		.rx_fifofull	= S5PV210_UFSTAT_RXFULL,
+		.tx_fifofull	= S5PV210_UFSTAT_TXFULL,
+		.tx_fifomask	= S5PV210_UFSTAT_TXMASK,
+		.tx_fifoshift	= S5PV210_UFSTAT_TXSHIFT,
+		.def_clk_sel	= S3C2410_UCON_CLKSEL0,
+		.num_clks	= 1,
+		.clksel_mask	= 0,
+		.clksel_shift	= 0,
+	},
+	.def_cfg = &(struct s3c2410_uartcfg) {
+		.ucon		= S5PV210_UCON_DEFAULT,
+		.ufcon		= S5PV210_UFCON_DEFAULT,
+		.has_fracval	= 1,
+	},
+	.fifosize = { 256, 64, 16, 16, 16, 16 },
+};
+#define NEXELL_SERIAL_DRV_DATA	   ((kernel_ulong_t)&nexell_serial_drv_data)
+#else
+#define NEXELL_SERIAL_DRV_DATA	   (kernel_ulong_t)NULL
+#endif
+
 static const struct platform_device_id s3c24xx_serial_driver_ids[] = {
 	{
 		.name		= "s3c2410-uart",
@@ -2375,6 +2466,9 @@
 	}, {
 		.name		= "exynos5433-uart",
 		.driver_data	= EXYNOS5433_SERIAL_DRV_DATA,
+	}, {
+		.name		= "s5p6818-uart",
+		.driver_data	= NEXELL_SERIAL_DRV_DATA,
 	},
 	{ },
 };
@@ -2396,6 +2490,8 @@
 		.data = (void *)EXYNOS4210_SERIAL_DRV_DATA },
 	{ .compatible = "samsung,exynos5433-uart",
 		.data = (void *)EXYNOS5433_SERIAL_DRV_DATA },
+	{ .compatible = "nexell,s5p6818-uart",
+		.data = (void *)NEXELL_SERIAL_DRV_DATA },
 	{},
 };
 MODULE_DEVICE_TABLE(of, s3c24xx_uart_dt_match);
@@ -2511,6 +2607,8 @@
 			s5pv210_early_console_setup);
 OF_EARLYCON_DECLARE(exynos4210, "samsung,exynos4210-uart",
 			s5pv210_early_console_setup);
+OF_EARLYCON_DECLARE(s5p6818, "nexell,s5p6818-uart",
+			s5pv210_early_console_setup);
 #endif

 MODULE_ALIAS("platform:samsung-uart");
diff -ENwbur a/drivers/tty/serial/samsung.h b/drivers/tty/serial/samsung.h
--- a/drivers/tty/serial/samsung.h	2018-05-06 08:47:38.529392846 +0200
+++ b/drivers/tty/serial/samsung.h	2018-05-06 08:49:51.406785825 +0200
@@ -13,6 +13,7 @@
 */

 #include <linux/dmaengine.h>
+#include <linux/reset.h>

 struct s3c24xx_uart_info {
 	char			*name;
@@ -32,6 +33,7 @@
 	/* uart port features */

 	unsigned int		has_divslot:1;
+	unsigned int		has_reset_control:1;

 	/* uart controls */
 	int (*reset_port)(struct uart_port *, struct s3c2410_uartcfg *);
diff -ENwbur a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
--- a/drivers/usb/dwc2/core.h	2018-05-06 08:47:38.549393658 +0200
+++ b/drivers/usb/dwc2/core.h	2018-05-06 08:49:51.426786637 +0200
@@ -1023,6 +1023,7 @@
 	u32 hfnum_other_samples_b;
 	u64 hfnum_other_frrem_accum_b;
 #endif
+	u32 ext_vbus_io;
 #endif /* CONFIG_USB_DWC2_HOST || CONFIG_USB_DWC2_DUAL_ROLE */

 #if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \
diff -ENwbur a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
--- a/drivers/usb/dwc2/gadget.c	2018-05-06 08:47:38.549393658 +0200
+++ b/drivers/usb/dwc2/gadget.c	2018-05-06 08:49:51.426786637 +0200
@@ -4742,6 +4742,16 @@
 	if (hsotg->lx_state != DWC2_L0)
 		return 0;

+	if (of_device_is_compatible(hsotg->dev->of_node,
+				    "nexell,nexell-dwc2otg")) {
+		u32 usb_status = readl(hsotg->regs + GOTGCTL);
+
+		if (usb_status & GOTGCTL_BSESVLD) {
+			dev_warn(hsotg->dev, "usb device is still connected\n");
+			return -EBUSY;
+		}
+	}
+
 	if (hsotg->driver) {
 		int ep;

@@ -4761,6 +4771,12 @@
 			if (hsotg->eps_out[ep])
 				dwc2_hsotg_ep_disable(&hsotg->eps_out[ep]->ep);
 		}
+	} else {
+		if (of_device_is_compatible(hsotg->dev->of_node,
+					    "nexell,nexell-dwc2otg")) {
+			phy_exit(hsotg->phy);
+			phy_power_off(hsotg->phy);
+		}
 	}

 	return 0;
@@ -4782,6 +4798,12 @@
 		if (hsotg->enabled)
 			dwc2_hsotg_core_connect(hsotg);
 		spin_unlock_irqrestore(&hsotg->lock, flags);
+	} else {
+		if (of_device_is_compatible(hsotg->dev->of_node,
+					    "nexell,nexell-dwc2otg")) {
+			phy_power_on(hsotg->phy);
+			phy_init(hsotg->phy);
+		}
 	}

 	return 0;
diff -ENwbur a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
--- a/drivers/usb/dwc2/hcd.c	2018-05-06 08:47:38.549393658 +0200
+++ b/drivers/usb/dwc2/hcd.c	2018-05-06 08:49:51.426786637 +0200
@@ -48,6 +48,7 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/usb.h>
+#include <linux/gpio.h>

 #include <linux/usb/hcd.h>
 #include <linux/usb/ch11.h>
@@ -2418,6 +2419,11 @@
 	if (hsotg->op_state == OTG_STATE_A_HOST) {
 		u32 hprt0 = dwc2_read_hprt0(hsotg);

+		if (of_device_is_compatible(hsotg->dev->of_node,
+					    "nexell,nexell-dwc2otg")) {
+			if (gpio_is_valid(hsotg->ext_vbus_io))
+				gpio_set_value(hsotg->ext_vbus_io, 1);
+		}
 		dev_dbg(hsotg->dev, "Init: Power Port (%d)\n",
 			!!(hprt0 & HPRT0_PWR));
 		if (!(hprt0 & HPRT0_PWR)) {
@@ -3274,6 +3280,11 @@
 			dev_err(hsotg->dev,
 				"Connection id status change timed out\n");
 		hsotg->op_state = OTG_STATE_B_PERIPHERAL;
+		if (of_device_is_compatible(hsotg->dev->of_node,
+					    "nexell,nexell-dwc2otg")) {
+			if (gpio_is_valid(hsotg->ext_vbus_io))
+				gpio_set_value(hsotg->ext_vbus_io, 0);
+		}
 		dwc2_core_init(hsotg, false);
 		dwc2_enable_global_interrupts(hsotg);
 		spin_lock_irqsave(&hsotg->lock, flags);
@@ -4381,10 +4392,168 @@

 	usleep_range(1000, 3000);
 }
+#if defined(CONFIG_PM) && (defined(CONFIG_ARCH_S5P4418) || \
+	defined(CONFIG_ARCH_S5P6818))
+struct dwc2_core_global_regs {
+	uint32_t gotgctl;
+	uint32_t gotgint;
+	uint32_t gahbcfg;
+	uint32_t gusbcfg;
+	uint32_t grstctl;
+	uint32_t gintmsk;
+	uint32_t grxfsiz;
+	uint32_t gnptxfsiz;
+	uint32_t gi2cctl;
+	uint32_t gpvndctl;
+	uint32_t ggpio;
+	uint32_t ghwcfg1;
+	uint32_t ghwcfg2;
+	uint32_t ghwcfg3;
+	uint32_t ghwcfg4;
+	uint32_t glpmcfg;
+	uint32_t gpwrdn;
+	uint32_t gdfifocfg;
+	uint32_t adpctl;
+	uint32_t hptxfsiz;
+	uint32_t dtxfsiz[15];
+};
+
+static struct dwc2_core_global_regs save_global_regs;
+
+static void dwc2_driver_suspend_regs(struct dwc2_hsotg *hsotg, int suspend)
+{
+	struct dwc2_core_global_regs *regs = &save_global_regs;
+	int idx;
+
+	dev_dbg(hsotg->dev, "%s %d suspend %d\n", __func__, __LINE__, suspend);
+
+	if (suspend) {
+		regs->gotgctl = readl(hsotg->regs + GOTGCTL);
+		regs->gotgint = readl(hsotg->regs + GOTGINT);
+		regs->gahbcfg = readl(hsotg->regs + GAHBCFG);
+		regs->gusbcfg = readl(hsotg->regs + GUSBCFG);
+		regs->grstctl = readl(hsotg->regs + GRSTCTL);
+		regs->gintmsk = readl(hsotg->regs + GINTMSK);
+		regs->grxfsiz = readl(hsotg->regs + GRXFSIZ);
+		regs->gnptxfsiz = readl(hsotg->regs + GNPTXFSIZ);
+		regs->gi2cctl = readl(hsotg->regs + GI2CCTL);
+		regs->gpvndctl = readl(hsotg->regs + GPVNDCTL);
+		regs->ggpio = readl(hsotg->regs + GGPIO);
+		regs->ghwcfg1 = readl(hsotg->regs + GHWCFG1);
+		regs->ghwcfg2 = readl(hsotg->regs + GHWCFG2);
+		regs->ghwcfg3 = readl(hsotg->regs + GHWCFG3);
+		regs->ghwcfg4 = readl(hsotg->regs + GHWCFG4);
+		regs->glpmcfg = readl(hsotg->regs + GLPMCFG);
+		regs->gpwrdn = readl(hsotg->regs + GPWRDN);
+		regs->gdfifocfg = readl(hsotg->regs + GDFIFOCFG);
+		regs->adpctl = readl(hsotg->regs + ADPCTL);
+		regs->hptxfsiz = readl(hsotg->regs + HPTXFSIZ);
+		for (idx = 1; idx < hsotg->num_of_eps; idx++)
+			regs->dtxfsiz[idx] = readl(hsotg->regs +
+						   DPTXFSIZN(idx));
+	} else {
+		writel(regs->gotgctl, hsotg->regs + GOTGCTL);
+		writel(regs->gotgint, hsotg->regs + GOTGINT);
+		writel(regs->gahbcfg, hsotg->regs + GAHBCFG);
+		writel(regs->gusbcfg, hsotg->regs + GUSBCFG);
+		writel(regs->grstctl, hsotg->regs + GRSTCTL);
+		writel(regs->gintmsk, hsotg->regs + GINTMSK);
+		writel(regs->grxfsiz, hsotg->regs + GRXFSIZ);
+		writel(regs->gnptxfsiz, hsotg->regs + GNPTXFSIZ);
+		writel(regs->gi2cctl, hsotg->regs + GI2CCTL);
+		writel(regs->gpvndctl, hsotg->regs + GPVNDCTL);
+		writel(regs->ggpio, hsotg->regs + GGPIO);
+		writel(regs->ghwcfg1, hsotg->regs + GHWCFG1);
+		writel(regs->ghwcfg2, hsotg->regs + GHWCFG2);
+		writel(regs->ghwcfg3, hsotg->regs + GHWCFG3);
+		writel(regs->ghwcfg4, hsotg->regs + GHWCFG4);
+		writel(regs->glpmcfg, hsotg->regs + GLPMCFG);
+		writel(regs->gpwrdn, hsotg->regs + GPWRDN);
+		writel(regs->gdfifocfg, hsotg->regs + GDFIFOCFG);
+		writel(regs->adpctl, hsotg->regs + ADPCTL);
+		writel(regs->hptxfsiz, hsotg->regs + HPTXFSIZ);
+		for (idx = 1; idx < hsotg->num_of_eps; idx++)
+			writel(regs->dtxfsiz[idx], hsotg->regs +
+			       DPTXFSIZN(idx));
+	}
+}

 static int _dwc2_hcd_suspend(struct usb_hcd *hcd)
 {
 	struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+
+	dev_dbg(hsotg->dev, "%s %d\n", __func__, __LINE__);
+
+	dwc2_driver_suspend_regs(hsotg, 1);
+
+	if (hsotg->op_state == OTG_STATE_B_PERIPHERAL) {
+		dev_warn(hsotg->dev, "%s, usb device mode\n", __func__);
+		return 0;
+	}
+
+#ifdef CONFIG_USB_DWC2_PERIPHERAL
+	return 0;
+#endif
+
+	/*
+	 * Disable the global interrupt until all the interrupt handlers are
+	 * installed
+	 */
+	dwc2_disable_global_interrupts(hsotg);
+
+	/* Clear any pending interrupts */
+	writel(0xffffffff, hsotg->regs + GINTSTS);
+
+	return 0;
+}
+
+static int _dwc2_hcd_resume(struct usb_hcd *hcd)
+{
+	struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+	u32 gotgctl;
+
+	dev_dbg(hsotg->dev, "%s %d\n", __func__, __LINE__);
+
+	dwc2_driver_suspend_regs(hsotg, 0);
+
+	if (hsotg->op_state == OTG_STATE_B_PERIPHERAL) {
+		dev_warn(hsotg->dev, "%s, usb device mode\n", __func__);
+		return 0;
+	}
+
+#ifdef CONFIG_USB_DWC2_PERIPHERAL
+	return 0;
+#endif
+
+	dwc2_core_init(hsotg, false);
+	dwc2_enable_global_interrupts(hsotg);
+
+	gotgctl = readl(hsotg->regs + GOTGCTL);
+
+	/* B-Device connector (Device Mode) */
+	if (gotgctl & GOTGCTL_CONID_B) {
+		dev_dbg(hsotg->dev, "connId B\n");
+		hsotg->op_state = OTG_STATE_B_PERIPHERAL;
+		if (of_device_is_compatible(hsotg->dev->of_node,
+					    "nexell,nexell-dwc2otg")) {
+			if (gpio_is_valid(hsotg->ext_vbus_io))
+				gpio_set_value(hsotg->ext_vbus_io, 0);
+		}
+		dwc2_hsotg_core_init_disconnected(hsotg, false);
+		dwc2_hsotg_core_connect(hsotg);
+	} else {
+		/* A-Device connector (Host Mode) */
+		dev_dbg(hsotg->dev, "connId A\n");
+		hsotg->op_state = OTG_STATE_A_HOST;
+		dwc2_hcd_start(hsotg);
+	}
+
+	return 0;
+}
+#else
+static int _dwc2_hcd_suspend(struct usb_hcd *hcd)
+{
+	struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
 	unsigned long flags;
 	int ret = 0;
 	u32 hprt0;
@@ -4514,6 +4683,7 @@

 	return ret;
 }
+#endif

 /* Returns the current frame number */
 static int _dwc2_hcd_get_frame_number(struct usb_hcd *hcd)
diff -ENwbur a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
--- a/drivers/usb/dwc2/params.c	2018-05-06 08:47:38.549393658 +0200
+++ b/drivers/usb/dwc2/params.c	2018-05-06 08:49:51.430786798 +0200
@@ -113,6 +113,20 @@
 	p->uframe_sched = false;
 }

+static void dwc2_set_nexell_params(struct dwc2_hsotg *hsotg)
+{
+	struct dwc2_core_params *p = &hsotg->params;
+
+	p->host_rx_fifo_size		= 1024;	/* 1024 DWORDs */
+	p->host_nperio_tx_fifo_size	= 256;	/* 256 DWORDs */
+	p->host_perio_tx_fifo_size	= 512;	/* 512 DWORDs */
+	p->max_transfer_size		= 65535;
+	p->max_packet_count		    = 511;
+	p->host_channels			= 8;
+	p->reload_ctl			    = false;
+	p->uframe_sched			    = false;
+}
+
 static void dwc2_set_amcc_params(struct dwc2_hsotg *hsotg)
 {
 	struct dwc2_core_params *p = &hsotg->params;
@@ -144,6 +158,7 @@
 	{ .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
 	{ .compatible = "snps,dwc2" },
 	{ .compatible = "samsung,s3c6400-hsotg" },
+	{ .compatible = "nexell,nexell-dwc2otg", .data = dwc2_set_nexell_params },
 	{ .compatible = "amlogic,meson8-usb",
 	  .data = dwc2_set_amlogic_params },
 	{ .compatible = "amlogic,meson8b-usb",
diff -ENwbur a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
--- a/drivers/usb/dwc2/platform.c	2018-05-06 08:47:38.553393820 +0200
+++ b/drivers/usb/dwc2/platform.c	2018-05-06 08:49:51.430786798 +0200
@@ -46,6 +46,7 @@
 #include <linux/phy/phy.h>
 #include <linux/platform_data/s3c-hsotg.h>
 #include <linux/reset.h>
+#include <linux/of_gpio.h>

 #include <linux/usb/of.h>

@@ -136,6 +137,21 @@
 			return ret;
 	}

+	if (of_device_is_compatible(hsotg->dev->of_node,
+					    "nexell,nexell-dwc2otg")) {
+#ifdef CONFIG_RESET_CONTROLLER
+			struct reset_control *rst;
+
+			rst = devm_reset_control_get(hsotg->dev,
+						     "usbotg-reset");
+			if (!IS_ERR(rst)) {
+				if (reset_control_status(rst))
+					reset_control_reset(rst);
+                reset_control_put(rst);
+			}
+#endif
+	}
+
 	if (hsotg->uphy) {
 		ret = usb_phy_init(hsotg->uphy);
 	} else if (hsotg->plat && hsotg->plat->phy_init) {
@@ -402,6 +418,27 @@
 	if (retval)
 		return retval;

+	if (of_device_is_compatible(hsotg->dev->of_node,
+				    "nexell,nexell-dwc2otg")) {
+#ifdef CONFIG_GPIOLIB
+		hsotg->ext_vbus_io = of_get_named_gpio(dev->dev.of_node,
+						       "gpios", 0);
+		if (gpio_is_valid(hsotg->ext_vbus_io)) {
+			retval = devm_gpio_request_one(&dev->dev,
+						   hsotg->ext_vbus_io,
+						   GPIOF_OUT_INIT_LOW,
+						   "otg_vbus");
+
+			if (retval < 0) {
+				dev_err(hsotg->dev,
+					"can't request otg_vbus gpio %d\n",
+					hsotg->ext_vbus_io);
+				return 0;
+			}
+		}
+#endif
+	}
+
 	retval = dwc2_lowlevel_hw_enable(hsotg);
 	if (retval)
 		return retval;
diff -ENwbur a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c
--- a/drivers/usb/host/ehci-exynos.c	2018-05-06 08:47:38.573394633 +0200
+++ b/drivers/usb/host/ehci-exynos.c	2018-05-06 08:49:51.450787610 +0200
@@ -23,6 +23,9 @@
 #include <linux/platform_device.h>
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
+#ifdef CONFIG_RESET_CONTROLLER
+#include <linux/reset.h>
+#endif

 #include "ehci.h"

@@ -36,6 +39,9 @@
 #define EHCI_INSNREG00_ENABLE_DMA_BURST	\
 	(EHCI_INSNREG00_ENA_INCR16 | EHCI_INSNREG00_ENA_INCR8 |	\
 	 EHCI_INSNREG00_ENA_INCR4 | EHCI_INSNREG00_ENA_INCRX_ALIGN)
+#if defined(CONFIG_ARCH_S5P4418) || defined(CONFIG_ARCH_S5P6818)
+#define EHCI_INSNREG08(base)			(base + 0xb0)
+#endif

 static const char hcd_name[] = "ehci-exynos";
 static struct hc_driver __read_mostly exynos_ehci_hc_driver;
@@ -98,6 +104,20 @@
 	int i;
 	int ret = 0;

+	if (of_device_is_compatible(dev->of_node,
+					"nexell,nexell-ehci")) {
+#ifdef CONFIG_RESET_CONTROLLER
+		struct reset_control *rst;
+
+		rst = devm_reset_control_get(dev, "usbhost-reset");
+		if (!IS_ERR(rst)) {
+			if (reset_control_status(rst))
+				reset_control_reset(rst);
+            reset_control_put(rst);
+		}
+#endif
+	}
+
 	for (i = 0; ret == 0 && i < PHY_NUMBER; i++)
 		if (!IS_ERR(exynos_ehci->phy[i]))
 			ret = phy_power_on(exynos_ehci->phy[i]);
@@ -306,10 +326,26 @@
 	.resume		= exynos_ehci_resume,
 };

+#if defined(CONFIG_ARCH_S5P4418) || defined(CONFIG_ARCH_S5P6818)
+int hsic_port_power(struct usb_hcd *hcd, int portnum, bool enable)
+{
+	if (portnum == 1) {
+		if (enable)
+			writel(readl(EHCI_INSNREG08(hcd->regs)) |
+			       1 << portnum, EHCI_INSNREG08(hcd->regs));
+		else
+			writel(readl(EHCI_INSNREG08(hcd->regs)) &
+			       ~(1 << portnum), EHCI_INSNREG08(hcd->regs));
+	}
+	return 0;
+}
+#endif
+
 #ifdef CONFIG_OF
 static const struct of_device_id exynos_ehci_match[] = {
 	{ .compatible = "samsung,exynos4210-ehci" },
 	{ .compatible = "samsung,exynos5440-ehci" },
+	{ .compatible = "nexell,nexell-ehci" },
 	{},
 };
 MODULE_DEVICE_TABLE(of, exynos_ehci_match);
@@ -327,6 +363,9 @@
 };
 static const struct ehci_driver_overrides exynos_overrides __initconst = {
 	.extra_priv_size = sizeof(struct exynos_ehci_hcd),
+#if defined(CONFIG_ARCH_S5P4418) || defined(CONFIG_ARCH_S5P6818)
+	.port_power = hsic_port_power,
+#endif
 };

 static int __init ehci_exynos_init(void)
diff -ENwbur a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
--- a/drivers/usb/host/Kconfig	2018-05-06 08:47:38.573394633 +0200
+++ b/drivers/usb/host/Kconfig	2018-05-06 08:49:51.450787610 +0200
@@ -262,7 +262,7 @@

 config USB_EHCI_EXYNOS
        tristate "EHCI support for Samsung S5P/EXYNOS SoC Series"
-       depends on ARCH_S5PV210 || ARCH_EXYNOS
+       depends on ARCH_S5PV210 || ARCH_EXYNOS || ARCH_S5P4418 || ARCH_S5P6818
        help
 	Enable support for the Samsung Exynos SOC's on-chip EHCI controller.

@@ -567,7 +567,7 @@

 config USB_OHCI_EXYNOS
 	tristate "OHCI support for Samsung S5P/EXYNOS SoC Series"
-	depends on ARCH_S5PV210 || ARCH_EXYNOS
+	depends on ARCH_S5PV210 || ARCH_EXYNOS || ARCH_S5P4418 || ARCH_S5P6818
 	help
 	 Enable support for the Samsung Exynos SOC's on-chip OHCI controller.

diff -ENwbur a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c
--- a/drivers/usb/host/ohci-exynos.c	2018-05-06 08:47:38.581394957 +0200
+++ b/drivers/usb/host/ohci-exynos.c	2018-05-06 08:49:51.458787935 +0200
@@ -21,6 +21,9 @@
 #include <linux/phy/phy.h>
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
+#ifdef CONFIG_RESET_CONTROLLER
+#include <linux/reset.h>
+#endif

 #include "ohci.h"

@@ -87,6 +90,20 @@
 	int i;
 	int ret = 0;

+	if (of_device_is_compatible(dev->of_node,
+					"nexell,nexell-ohci")) {
+#ifdef CONFIG_RESET_CONTROLLER
+		struct reset_control *rst;
+
+		rst = devm_reset_control_get(dev, "usbhost-reset");
+		if (!IS_ERR(rst)) {
+			if (reset_control_status(rst))
+				reset_control_reset(rst);
+            reset_control_put(rst);
+		}
+#endif
+	}
+
 	for (i = 0; ret == 0 && i < PHY_NUMBER; i++)
 		if (!IS_ERR(exynos_ohci->phy[i]))
 			ret = phy_power_on(exynos_ohci->phy[i]);
@@ -215,10 +232,12 @@

 static void exynos_ohci_shutdown(struct platform_device *pdev)
 {
+#if !(defined(CONFIG_ARCH_S5P4418) || defined(CONFIG_ARCH_S5P6818))
 	struct usb_hcd *hcd = platform_get_drvdata(pdev);

 	if (hcd->driver->shutdown)
 		hcd->driver->shutdown(hcd);
+#endif
 }

 #ifdef CONFIG_PM
@@ -276,6 +295,7 @@
 static const struct of_device_id exynos_ohci_match[] = {
 	{ .compatible = "samsung,exynos4210-ohci" },
 	{ .compatible = "samsung,exynos5440-ohci" },
+	{ .compatible = "nexell,nexell-ohci" },
 	{},
 };
 MODULE_DEVICE_TABLE(of, exynos_ohci_match);
diff -ENwbur a/drivers/video/Kconfig b/drivers/video/Kconfig
--- a/drivers/video/Kconfig	2018-05-06 08:47:38.629396905 +0200
+++ b/drivers/video/Kconfig	2018-05-06 08:49:51.506789882 +0200
@@ -20,6 +20,8 @@

 source "drivers/gpu/drm/Kconfig"

+source "drivers/gpu/arm/Kconfig"
+
 menu "Frame buffer Devices"
 source "drivers/video/fbdev/Kconfig"
 endmenu
diff -ENwbur a/include/drm/nexell_drm.h b/include/drm/nexell_drm.h
--- a/include/drm/nexell_drm.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/drm/nexell_drm.h	2018-05-06 08:49:51.802801894 +0200
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef _NX_DRM_H_
+#define _NX_DRM_H_
+
+#include <uapi/drm/nexell_drm.h>
+
+#endif
diff -ENwbur a/include/dt-bindings/interrupt-controller/s5p6818-irq.h b/include/dt-bindings/interrupt-controller/s5p6818-irq.h
--- a/include/dt-bindings/interrupt-controller/s5p6818-irq.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/dt-bindings/interrupt-controller/s5p6818-irq.h	2018-05-06 08:49:51.810802219 +0200
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _S5P6818_IRQ_H
+#define _S5P6818_IRQ_H
+
+/*
+ * GIC remmap hwirq to hwirq+16+ (0~16: For SGI, 16~31:PPI)
+ */
+#define IRQ_OFFSET			(0)
+#define IRQ_MCUSTOP			(IRQ_OFFSET +  0)
+#define IRQ_DMA0			(IRQ_OFFSET +  1)
+#define IRQ_DMA1			(IRQ_OFFSET +  2)
+#define IRQ_INTREQPWR			(IRQ_OFFSET +  3)
+#define IRQ_ALIVE			(IRQ_OFFSET +  4)
+#define IRQ_RTC				(IRQ_OFFSET +  5)
+#define IRQ_UART1			(IRQ_OFFSET +  6)
+#define IRQ_UART0			(IRQ_OFFSET +  7)
+#define IRQ_UART2			(IRQ_OFFSET +  8)
+#define IRQ_UART3			(IRQ_OFFSET +  9)
+#define IRQ_UART4			(IRQ_OFFSET + 10)
+#define IRQ_UART5			(IRQ_OFFSET + 11)
+#define IRQ_SSP0			(IRQ_OFFSET + 12)
+#define IRQ_SSP1			(IRQ_OFFSET + 13)
+#define IRQ_SSP2			(IRQ_OFFSET + 14)
+#define IRQ_I2C0			(IRQ_OFFSET + 15)
+#define IRQ_I2C1			(IRQ_OFFSET + 16)
+#define IRQ_I2C2			(IRQ_OFFSET + 17)
+#define IRQ_DEINTERLACE			(IRQ_OFFSET + 18)
+#define IRQ_SCALER			(IRQ_OFFSET + 19)
+#define IRQ_AC97			(IRQ_OFFSET + 20)
+#define IRQ_SPDIFRX			(IRQ_OFFSET + 21)
+#define IRQ_SPDIFTX			(IRQ_OFFSET + 22)
+#define IRQ_TIMER0			(IRQ_OFFSET + 23)
+#define IRQ_TIMER1			(IRQ_OFFSET + 24)
+#define IRQ_TIMER2			(IRQ_OFFSET + 25)
+#define IRQ_TIMER3			(IRQ_OFFSET + 26)
+#define IRQ_PWM_INT0			(IRQ_OFFSET + 27)
+#define IRQ_PWM_INT1			(IRQ_OFFSET + 28)
+#define IRQ_PWM_INT2			(IRQ_OFFSET + 29)
+#define IRQ_PWM_INT3			(IRQ_OFFSET + 30)
+#define IRQ_WDT				(IRQ_OFFSET + 31)
+#define IRQ_MPEGTSI			(IRQ_OFFSET + 32)
+#define IRQ_DPC_P			(IRQ_OFFSET + 33)
+#define IRQ_DPC_S			(IRQ_OFFSET + 34)
+#define IRQ_RESCONV			(IRQ_OFFSET + 35)
+#define IRQ_HDMI			(IRQ_OFFSET + 36)
+#define IRQ_VIP0			(IRQ_OFFSET + 37)
+#define IRQ_VIP1			(IRQ_OFFSET + 38)
+#define IRQ_MIPI			(IRQ_OFFSET + 39)
+#define IRQ_VR				(IRQ_OFFSET + 40)
+#define IRQ_ADC				(IRQ_OFFSET + 41)
+#define IRQ_PPM				(IRQ_OFFSET + 42)
+#define IRQ_SDMMC0			(IRQ_OFFSET + 43)
+#define IRQ_SDMMC1			(IRQ_OFFSET + 44)
+#define IRQ_SDMMC2			(IRQ_OFFSET + 45)
+#define IRQ_CODA960_HOST		(IRQ_OFFSET + 46)
+#define IRQ_CODA960_JPG			(IRQ_OFFSET + 47)
+#define IRQ_GMAC			(IRQ_OFFSET + 48)
+#define IRQ_USB20OTG			(IRQ_OFFSET + 49)
+#define IRQ_USB20HOST			(IRQ_OFFSET + 50)
+#define IRQ_CAN0			(IRQ_OFFSET + 51)
+#define IRQ_CAN1			(IRQ_OFFSET + 52)
+#define IRQ_GPIOA			(IRQ_OFFSET + 53)
+#define IRQ_GPIOB			(IRQ_OFFSET + 54)
+#define IRQ_GPIOC			(IRQ_OFFSET + 55)
+#define IRQ_GPIOD			(IRQ_OFFSET + 56)
+#define IRQ_GPIOE			(IRQ_OFFSET + 57)
+#define IRQ_CRYPTO			(IRQ_OFFSET + 58)
+#define IRQ_PDM				(IRQ_OFFSET + 59)
+#define IRQ_TMU0			(IRQ_OFFSET + 60)
+#define IRQ_TMU1			(IRQ_OFFSET + 61)
+#define IRQ_VIP2			(IRQ_OFFSET + 72)
+#define IRQ_P0_PMUIRQ0			(IRQ_OFFSET + 82)
+#define IRQ_P0_PMUIRQ1			(IRQ_OFFSET + 83)
+#define IRQ_P0_PMUIRQ2			(IRQ_OFFSET + 84)
+#define IRQ_P0_PMUIRQ3			(IRQ_OFFSET + 85)
+#define IRQ_P1_PMUIRQ0			(IRQ_OFFSET + 95)
+#define IRQ_P1_PMUIRQ1			(IRQ_OFFSET + 96)
+#define IRQ_P1_PMUIRQ2			(IRQ_OFFSET + 97)
+#define IRQ_P1_PMUIRQ3			(IRQ_OFFSET + 98)
+
+#define IRQ_PHY_NR			(160)		/* GIC: GIC_DIST_CTR */
+
+/*
+ * gpio interrupt Number 160 (160~320)
+ */
+#define IRQ_GPIO_START			IRQ_PHY_NR
+#define IRQ_GPIO_END			(IRQ_GPIO_START + 32 * 5)
+
+#define IRQ_GPIO_A_START		(IRQ_GPIO_START + 32*0)
+#define IRQ_GPIO_B_START		(IRQ_GPIO_START + 32*1)
+#define IRQ_GPIO_C_START		(IRQ_GPIO_START + 32*2)
+#define IRQ_GPIO_D_START		(IRQ_GPIO_START + 32*3)
+#define IRQ_GPIO_E_START		(IRQ_GPIO_START + 32*4)
+
+#define IRQ_GPIO_NR			(IRQ_GPIO_END-IRQ_GPIO_START)
+
+/*
+ * ALIVE Interrupt Number 6 (320~326)
+ */
+#define IRQ_ALIVE_START			IRQ_GPIO_END
+#define IRQ_ALIVE_END			(IRQ_ALIVE_START + 6)
+
+#define IRQ_ALIVE_0			(IRQ_ALIVE_START + 0)
+#define IRQ_ALIVE_1			(IRQ_ALIVE_START + 1)
+#define IRQ_ALIVE_2			(IRQ_ALIVE_START + 2)
+#define IRQ_ALIVE_3			(IRQ_ALIVE_START + 3)
+#define IRQ_ALIVE_4			(IRQ_ALIVE_START + 4)
+#define IRQ_ALIVE_5			(IRQ_ALIVE_START + 5)
+
+#define IRQ_ALIVE_NR			(IRQ_ALIVE_END-IRQ_ALIVE_START)
+
+/*
+ * MAX(Physical+Virtual) Interrupt Number
+ */
+#define IRQ_RESERVED_START		IRQ_ALIVE_END
+#define IRQ_RESERVED_NR			72
+
+#define IRQ_TOTAL_NR			(IRQ_RESERVED_START + IRQ_RESERVED_NR)
+
+#endif
diff -ENwbur a/include/dt-bindings/media/nexell-vip.h b/include/dt-bindings/media/nexell-vip.h
--- a/include/dt-bindings/media/nexell-vip.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/dt-bindings/media/nexell-vip.h	2018-05-06 08:49:51.810802219 +0200
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Sungwoo, Park <swpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __DT_BINDINGS_MEDIA_NEXELL_VIP_H__
+#define __DT_BINDINGS_MEDIA_NEXELL_VIP_H__
+
+/* capture hw interface type */
+#define NX_CAPTURE_INTERFACE_PARALLEL		0
+#define NX_CAPTURE_INTERFACE_MIPI_CSI		1
+
+/* camera sensor <--> vip data order(yuv422) */
+#define NX_VIN_CBY0CRY1				0
+#define NX_VIN_CRY1CBY0				1
+#define NX_VIN_Y0CBY1CR				2
+#define NX_VIN_Y1CRY0CB				3
+
+/* camera sensor configuration interface */
+#define NX_CAPTURE_SENSOR_I2C			0
+#define NX_CAPTURE_SENSOR_SPI			1
+#define NX_CAPTURE_SENSOR_LOOPBACK		2
+
+/* camera enable sequence marker */
+#define NX_ACTION_START				0x12345678
+#define NX_ACTION_END				0x87654321
+#define NX_ACTION_TYPE_GPIO			0xffff0001
+#define NX_ACTION_TYPE_PMIC			0xffff0002
+#define NX_ACTION_TYPE_CLOCK			0xffff0003
+
+#endif /* __DT_BINDINGS_MEDIA_NEXELL_V4L2_H__ */
diff -ENwbur a/include/dt-bindings/reset/nexell,s5p6818-reset.h b/include/dt-bindings/reset/nexell,s5p6818-reset.h
--- a/include/dt-bindings/reset/nexell,s5p6818-reset.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/dt-bindings/reset/nexell,s5p6818-reset.h	2018-05-06 08:49:51.814802381 +0200
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Bon-gyu, KOO <freestyle@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Reset ID
+ */
+
+#define RESET_ID_START		0
+#define RESET_ID_AC97		0
+#define RESET_ID_CRYPTO		7
+#define RESET_ID_DEINTERLACE	8
+#define RESET_ID_DISP_TOP	9
+#define RESET_ID_DISPLAY	10
+#define RESET_ID_RESCONV	11
+#define RESET_ID_LCDIF		12
+#define RESET_ID_HDMI		13
+#define RESET_ID_HDMI_VIDEO	14
+#define RESET_ID_HDMI_SPDIF	15
+#define RESET_ID_HDMI_TMDS	16
+#define RESET_ID_HDMI_PHY	17
+#define RESET_ID_LVDS		18
+#define RESET_ID_ECID		19
+#define RESET_ID_I2C0		20
+#define RESET_ID_I2C1		21
+#define RESET_ID_I2C2		22
+#define RESET_ID_I2S0		23
+#define RESET_ID_I2S1		24
+#define RESET_ID_I2S2		25
+#define RESET_ID_DREX_C		26
+#define RESET_ID_DREX_A		27
+#define RESET_ID_DREX		28
+#define RESET_ID_MIPI		29
+#define RESET_ID_MIPI_DSI	30
+#define RESET_ID_MIPI_CSI	31
+#define RESET_ID_MIPI_PHY_S	32
+#define RESET_ID_MIPI_PHY_M	33
+#define RESET_ID_MPEGTSI	34
+#define RESET_ID_PDM		35
+#define RESET_ID_TIMER		36
+#define RESET_ID_PWM		37
+#define RESET_ID_SCALER		38
+#define RESET_ID_SDMMC0		39
+#define RESET_ID_SDMMC1		40
+#define RESET_ID_SDMMC2		41
+#define RESET_ID_SPDIFRX	42
+#define RESET_ID_SPDIFTX	43
+#define RESET_ID_SSP0_P		44
+#define RESET_ID_SSP0		45
+#define RESET_ID_SSP1_P		46
+#define RESET_ID_SSP1		47
+#define RESET_ID_SSP2_P		48
+#define RESET_ID_SSP2		49
+#define RESET_ID_UART0		50
+#define RESET_ID_UART1		51
+#define RESET_ID_UART2		52
+#define RESET_ID_UART3		53
+#define RESET_ID_UART4		54
+#define RESET_ID_UART5		55
+#define RESET_ID_USB20HOST	56
+#define RESET_ID_USB20OTG	57
+#define RESET_ID_WDT		58
+#define RESET_ID_WDT_POR	59
+#define RESET_ID_ADC		60
+#define RESET_ID_CODA_A		61
+#define RESET_ID_CODA_P		62
+#define RESET_ID_CODA_C		63
+#define RESET_ID_DWC_GMAC	64
+#define RESET_ID_VR		65
+#define RESET_ID_PPM		66
+#define RESET_ID_VIP1		67
+#define RESET_ID_VIP0		68
+#define RESET_ID_VIP2		69
+#define RESET_ID_END		(RESET_ID_VIP2)
diff -ENwbur a/include/dt-bindings/soc/s5p6818-base.h b/include/dt-bindings/soc/s5p6818-base.h
--- a/include/dt-bindings/soc/s5p6818-base.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/dt-bindings/soc/s5p6818-base.h	2018-05-06 08:49:51.814802381 +0200
@@ -0,0 +1,395 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _S5P6818_BASE_H
+#define _S5P6818_BASE_H
+
+#define PHYS_BASE_DMA0 (0xC0000000)
+#define PHYS_BASE_DMA1 (0xC0001000)
+#define PHYS_BASE_INT (0xC0008000)
+#define PHYS_BASE_INT_DIST (0xC0009000)
+#define PHYS_BASE_INT_CPU (0xC000a000)
+#define PHYS_BASE_CLKPWR (0xC0010000)
+#define PHYS_BASE_RTC (0xC0010C00)
+#define PHYS_BASE_ALIVE (0xC0010800)
+#define PHYS_BASE_RSTCON (0xC0012000)
+#define PHYS_BASE_TIEOFF (0xC0011000)
+#define PHYS_BASE_PDM (0xC0014000)
+#define PHYS_BASE_CRYPTO (0xC0015000)
+#define PHYS_BASE_TIMER (0xC0017000)
+#define PHYS_BASE_PWM (0xC0018000)
+#define PHYS_BASE_WDT (0xC0019000)
+#define PHYS_BASE_GPIOA (0xC001A000)
+#define PHYS_BASE_GPIOB (0xC001B000)
+#define PHYS_BASE_GPIOC (0xC001C000)
+#define PHYS_BASE_GPIOD (0xC001D000)
+#define PHYS_BASE_GPIOE (0xC001E000)
+#define PHYS_BASE_OHCI (0xC0020000)
+#define PHYS_BASE_EHCI (0xC0030000)
+#define PHYS_BASE_HSOTG (0xC0040000)
+#define PHYS_BASE_MCUS (0xC0051000)
+#define PHYS_BASE_ADC (0xC0053000)
+#define PHYS_BASE_PPM (0xC0054000)
+#define PHYS_BASE_I2S0 (0xC0055000)
+#define PHYS_BASE_I2S1 (0xC0056000)
+#define PHYS_BASE_I2S2 (0xC0057000)
+#define PHYS_BASE_AC97 (0xC0058000)
+#define PHYS_BASE_SPDIF_TX (0xC0059000)
+#define PHYS_BASE_SPDIF_RX (0xC005A000)
+#define PHYS_BASE_SSP0 (0xC005B000)
+#define PHYS_BASE_SSP1 (0xC005C000)
+#define PHYS_BASE_SSP2 (0xC005F000)
+#define PHYS_BASE_MPEGTSI (0xC005D000)
+#define PHYS_BASE_GMAC (0xC0060000)
+#define PHYS_BASE_VIP0 (0xC0063000)
+#define PHYS_BASE_VIP1 (0xC0064000)
+#define PHYS_BASE_VIP2 (0xC0099000)
+#define PHYS_BASE_DEINTERLACE (0xC0065000)
+#define PHYS_BASE_SCALER (0xC0066000)
+#define PHYS_BASE_ECID (0xC0067000)
+#define PHYS_BASE_SDMMC0 (0xC0062000)
+#define PHYS_BASE_SDMMC1 (0xC0068000)
+#define PHYS_BASE_SDMMC2 (0xC0069000)
+#define PHYS_BASE_VR (0xC0070000)
+#define PHYS_BASE_CODA_APB0 (0xC0080000)
+#define PHYS_BASE_CODA_APB1 (0xC0081000)
+#define PHYS_BASE_CODA_APB2 (0xC0082000)
+#define PHYS_BASE_CODA_APB3 (0xC0083000)
+#define PHYS_BASE_UART0                                                        \
+	(0xC00A1000) /* dma (O), modem(X), UART0_MODULE		*/
+#define PHYS_BASE_UART1                                                        \
+	(0xC00A0000) /* dma (O), modem(O), pl01115_Uart_modem_MODULE */
+#define PHYS_BASE_UART2                                                        \
+	(0xC00A2000) /* dma (O), modem(X), UART1_MODULE              */
+#define PHYS_BASE_UART3                                                        \
+	(0xC00A3000) /* dma (X), modem(X), pl01115_Uart_nodma0_MODULE*/
+#define PHYS_BASE_UART4                                                        \
+	(0xC006D000) /* dma (X), modem(X), pl01115_Uart_nodma1_MODULE*/
+#define PHYS_BASE_UART5                                                        \
+	(0xC006F000) /* dma (X), modem(X), pl01115_Uart_nodma2_MODULE*/
+#define PHYS_BASE_I2C0 (0xC00A4000)
+#define PHYS_BASE_I2C1 (0xC00A5000)
+#define PHYS_BASE_I2C2 (0xC00A6000)
+#define PHYS_BASE_CAN0 (0xC00CE000)
+#define PHYS_BASE_CAN1 (0xC00CF000)
+#define PHYS_BASE_MIPI (0xC00D0000)
+#define PHYS_BASE_DISPLAYTOP (0xC0100000)
+#define PHYS_BASE_TMU0 (0xC0096000)
+#define PHYS_BASE_TMU1 (0xC0097000)
+#define PHYS_BASE_TMU2 (0xC0092800)
+
+#define PHYS_BASE_MCUS_SHADOW (0x2C000000)
+
+#define PHYS_BASE_CLK_0 (0xC00BB000)  /* TIMER_1     */
+#define PHYS_BASE_CLK_1 (0xC00BC000)  /* TIMER_2     */
+#define PHYS_BASE_CLK_2 (0xC00BD000)  /* TIMER_3     */
+#define PHYS_BASE_CLK_3 (0xC00BE000)  /* PWM_1       */
+#define PHYS_BASE_CLK_4 (0xC00BF000)  /* PWM_2       */
+#define PHYS_BASE_CLK_5 (0xC00C0000)  /* PWM_3       */
+#define PHYS_BASE_CLK_6 (0xC00AE000)  /* I2C_0       */
+#define PHYS_BASE_CLK_7 (0xC00AF000)  /* I2C_1       */
+#define PHYS_BASE_CLK_8 (0xC00B0000)  /* I2C_2       */
+#define PHYS_BASE_CLK_9 (0xC00CA000)  /* MIPI        */
+#define PHYS_BASE_CLK_10 (0xC00C8000) /* GMAC        */
+#define PHYS_BASE_CLK_11 (0xC00B8000) /* SPDIF_TX    */
+#define PHYS_BASE_CLK_12 (0xC00B7000) /* MPEGTSI     */
+#define PHYS_BASE_CLK_13 (0xC00BA000) /* PWM_0       */
+#define PHYS_BASE_CLK_14 (0xC00B9000) /* TIMER_0     */
+#define PHYS_BASE_CLK_15 (0xC00B2000) /* I2S_0       */
+#define PHYS_BASE_CLK_16 (0xC00B3000) /* I2S_1       */
+#define PHYS_BASE_CLK_17 (0xC00B4000) /* I2S_2       */
+#define PHYS_BASE_CLK_18 (0xC00C5000) /* SDHC_0      */
+#define PHYS_BASE_CLK_19 (0xC00CC000) /* SDHC_1      */
+#define PHYS_BASE_CLK_20 (0xC00CD000) /* SDHC_2      */
+#define PHYS_BASE_CLK_21 (0xC00C3000) /* VR          */
+#define PHYS_BASE_CLK_22 (0xC00A9000) /* UART_0      */
+#define PHYS_BASE_CLK_23 (0xC00AA000) /* UART_2      */
+#define PHYS_BASE_CLK_24 (0xC00A8000) /* UART_1      */
+#define PHYS_BASE_CLK_25 (0xC00AB000) /* UART_3      */
+#define PHYS_BASE_CLK_26 (0xC006E000) /* UART_4      */
+#define PHYS_BASE_CLK_27 (0xC00B1000) /* UART_5      */
+#define PHYS_BASE_CLK_28 (0xC00B5000) /* DEINTERLACE */
+#define PHYS_BASE_CLK_29 (0xC00C4000) /* PPM         */
+#define PHYS_BASE_CLK_30 (0xC00C1000) /* VIP_0       */
+#define PHYS_BASE_CLK_31 (0xC00C2000) /* VIP_1       */
+#define PHYS_BASE_CLK_32 (0xC006B000) /* USB2HOST    */
+#define PHYS_BASE_CLK_33 (0xC00C7000) /* CODA        */
+#define PHYS_BASE_CLK_34 (0xC00C6000) /* CRYPTO      */
+#define PHYS_BASE_CLK_35 (0xC00B6000) /* SCALER      */
+#define PHYS_BASE_CLK_36 (0xC00CB000) /* PDM         */
+#define PHYS_BASE_CLK_37 (0xC00AC000) /* SPI0        */
+#define PHYS_BASE_CLK_38 (0xC00AD000) /* SPI1        */
+#define PHYS_BASE_CLK_39 (0xC00A7000) /* SPI2        */
+#define PHYS_BASE_CLK_40 (0xC009A000) /* VIP2	     */
+
+#define PHYS_BASE_DREX (0xC00E0000)
+
+/*
+ * clock
+ */
+#define CLK_CPU_PLL0 "sys-pll0"
+#define CLK_CPU_PLL1 "sys-pll1"
+#define CLK_CPU_PLL2 "sys-pll2"
+#define CLK_CPU_PLL3 "sys-pll3"
+#define CLK_CPU_FCLK "sys-cfclk"
+#define CLK_CPU_HCLK "sys-chclk"
+#define CLK_MEM_FCLK "sys-mfclk"
+#define CLK_MEM_DCLK "sys-mdclk"
+#define CLK_MEM_BCLK "sys-mbclk"
+#define CLK_MEM_PCLK "sys-mpclk"
+#define CLK_BUS_BCLK "sys-bbclk"
+#define CLK_BUS_PCLK "sys-bpclk"
+#define CLK_VPU_BCLK "sys-vpubclk"
+#define CLK_VPU_PCLK "sys-vpupclk"
+#define CLK_DIS_BCLK "sys-disbclk"
+#define CLK_DIS_PCLK "sys-disspclk"
+#define CLK_CCI_BCLK "sys-ccibclk"
+#define CLK_CCI_PCLK "sys-ccipclk"
+#define CLK_G3D_BCLK "sys-g3dbclk"
+
+#define CLK_ID_TIMER_1 0
+#define CLK_ID_TIMER_2 1
+#define CLK_ID_TIMER_3 2
+#define CLK_ID_PWM_1 3
+#define CLK_ID_PWM_2 4
+#define CLK_ID_PWM_3 5
+#define CLK_ID_I2C_0 6
+#define CLK_ID_I2C_1 7
+#define CLK_ID_I2C_2 8
+#define CLK_ID_MIPI 9
+#define CLK_ID_GMAC 10 /* External Clock 1 */
+#define CLK_ID_SPDIF_TX 11
+#define CLK_ID_MPEGTSI 12
+#define CLK_ID_PWM_0 13
+#define CLK_ID_TIMER_0 14
+#define CLK_ID_I2S_0 15 /* External Clock 1 */
+#define CLK_ID_I2S_1 16 /* External Clock 1 */
+#define CLK_ID_I2S_2 17 /* External Clock 1 */
+#define CLK_ID_SDHC_0 18
+#define CLK_ID_SDHC_1 19
+#define CLK_ID_SDHC_2 20
+#define CLK_ID_VR 21
+#define CLK_ID_UART_0 22 /* UART0_MODULE */
+#define CLK_ID_UART_2 23 /* UART1_MODULE */
+#define CLK_ID_UART_1 24 /* pl01115_Uart_modem_MODULE  */
+#define CLK_ID_UART_3 25 /* pl01115_Uart_nodma0_MODULE */
+#define CLK_ID_UART_4 26 /* pl01115_Uart_nodma1_MODULE */
+#define CLK_ID_UART_5 27 /* pl01115_Uart_nodma2_MODULE */
+#define CLK_ID_DIT 28
+#define CLK_ID_PPM 29
+#define CLK_ID_VIP_0 30    /* External Clock 1 */
+#define CLK_ID_VIP_1 31    /* External Clock 1, 2 */
+#define CLK_ID_USB2HOST 32 /* External Clock 2 */
+#define CLK_ID_CODA 33
+#define CLK_ID_CRYPTO 34
+#define CLK_ID_SCALER 35
+#define CLK_ID_PDM 36
+#define CLK_ID_SPI_0 37
+#define CLK_ID_SPI_1 38
+#define CLK_ID_SPI_2 39
+#define CLK_ID_MAX 39
+#define CLK_ID_USBOTG 40 /* Shared with USB2HOST */
+#define CLK_ID_VIP_2 41  /* External Clock 1, 2 */
+
+#define I_PLL0_BIT (0)
+#define I_PLL1_BIT (1)
+#define I_PLL2_BIT (2)
+#define I_PLL3_BIT (3)
+#define I_EXT1_BIT (4)
+#define I_EXT2_BIT (5)
+#define I_CLKn_BIT (7)
+
+#define I_PLL0 (1 << I_PLL0_BIT)
+#define I_PLL1 (1 << I_PLL1_BIT)
+#define I_PLL2 (1 << I_PLL2_BIT)
+#define I_PLL3 (1 << I_PLL3_BIT)
+#define I_EXTCLK1 (1 << I_EXT1_BIT)
+#define I_EXTCLK2 (1 << I_EXT2_BIT)
+
+#define I_PLL_0_1 (I_PLL0 | I_PLL1)
+#define I_PLL_0_2 (I_PLL_0_1 | I_PLL2)
+#define I_PLL_0_3 (I_PLL_0_2 | I_PLL3)
+#define I_CLKnOUT (0)
+
+#define I_PCLK (1 << 8)
+#define I_BCLK (1 << 9)
+#define I_GATE_PCLK (1 << 12)
+#define I_GATE_BCLK (1 << 13)
+#define I_PCLK_MASK (I_GATE_PCLK | I_PCLK)
+#define I_BCLK_MASK (I_GATE_BCLK | I_BCLK)
+
+#define CLK_INPUT_TIMER (I_PLL_0_2)
+#define CLK_INPUT_UART (I_PLL_0_2)
+#define CLK_INPUT_PWM (I_PLL_0_2)
+#define CLK_INPUT_I2C (I_GATE_PCLK)
+#define CLK_INPUT_SDHC (I_PLL_0_2 | I_GATE_PCLK)
+#define CLK_INPUT_I2S (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_I2S_IN1 (I_CLKnOUT)
+#define CLK_INPUT_SPI (I_PLL_0_2)
+#define CLK_INPUT_VIP0 (I_PLL_0_3 | I_EXTCLK1 | I_GATE_BCLK)
+#define CLK_INPUT_VIP1 (I_PLL_0_3 | I_EXTCLK1 | I_EXTCLK2 | I_GATE_BCLK)
+#define CLK_INPUT_VIP2 (I_PLL_0_3 | I_EXTCLK1 | I_EXTCLK2 | I_GATE_BCLK)
+#define CLK_INPUT_MIPI (I_PLL_0_2)
+#define CLK_INPUT_GMAC (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_GMAC_IN1 (I_CLKnOUT)
+#define CLK_INPUT_SPDIFTX (I_PLL_0_2)
+#define CLK_INPUT_MPEGTS (I_GATE_BCLK)
+#define CLK_INPUT_VR (I_GATE_BCLK)
+#define CLK_INPUT_DIT (I_GATE_BCLK)
+#define CLK_INPUT_PPM (I_PLL_0_2)
+#define CLK_INPUT_EHCI (I_PLL_0_3)
+#define CLK_INPUT_EHCI_IN1 (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_VPU (I_GATE_PCLK | I_GATE_BCLK)
+#define CLK_INPUT_CRYPTO (I_GATE_PCLK)
+#define CLK_INPUT_SCALER (I_GATE_BCLK)
+#define CLK_INPUT_OTG (I_PLL_0_3)
+#define CLK_INPUT_OTG_IN1 (I_PLL_0_3 | I_EXTCLK1)
+#define CLK_INPUT_PDM (I_GATE_PCLK)
+
+/*
+ * DMA
+ */
+#define PL08X_DMA_ID_UART1_TX 0 /* pl01115_Uart_modem_MODULE */
+#define PL08X_DMA_ID_UART1_RX 1 /* pl01115_Uart_modem_MODULE */
+#define PL08X_DMA_ID_UART0_TX 2 /* UART0_MODULE              */
+#define PL08X_DMA_ID_UART0_RX 3 /* UART0_MODULE              */
+#define PL08X_DMA_ID_UART2_TX 4 /* UART1_MODULE              */
+#define PL08X_DMA_ID_UART2_RX 5 /* UART1_MODULE              */
+#define PL08X_DMA_ID_SSP0_TX 6
+#define PL08X_DMA_ID_SSP0_RX 7
+#define PL08X_DMA_ID_SSP1_TX 8
+#define PL08X_DMA_ID_SSP1_RX 9
+#define PL08X_DMA_ID_SSP2_TX 10
+#define PL08X_DMA_ID_SSP2_RX 11
+#define PL08X_DMA_ID_I2S0_TX 12
+#define PL08X_DMA_ID_I2S0_RX 13
+#define PL08X_DMA_ID_I2S1_TX 14
+#define PL08X_DMA_ID_I2S1_RX 15
+#define PL08X_DMA_ID_I2S2_TX 16
+#define PL08X_DMA_ID_I2S2_RX 17
+#define PL08X_DMA_ID_AC97_PCMOUT 18
+#define PL08X_DMA_ID_AC97_PCMIN 19
+#define PL08X_DMA_ID_AC97_MICIN 20
+#define PL08X_DMA_ID_SPDIFRX 21
+#define PL08X_DMA_ID_SPDIFTX 22
+#define PL08X_DMA_ID_MPEGTSI0 23
+#define PL08X_DMA_ID_MPEGTSI1 24
+#define PL08X_DMA_ID_MPEGTSI2 25
+#define PL08X_DMA_ID_MPEGTSI3 26
+#define PL08X_DMA_ID_CRYPTO_BR 27
+#define PL08X_DMA_ID_CRYPTO_BW 28
+#define PL08X_DMA_ID_CRYPTO_HR 29
+#define PL08X_DMA_ID_PDM 30
+
+#define PL08X_DMA_NAME_UART1_TX                                                \
+	"uart1_tx" /* ID: 0, pl01115_Uart_modem_MODULE */
+#define PL08X_DMA_NAME_UART1_RX                                                \
+	"uart1_rx" /* ID: 1, pl01115_Uart_modem_MODULE */
+#define PL08X_DMA_NAME_UART0_TX                                                \
+	"uart0_tx" /* ID: 2, UART0_MODULE              */
+#define PL08X_DMA_NAME_UART0_RX                                                \
+	"uart0_rx" /* ID: 3, UART0_MODULE              */
+#define PL08X_DMA_NAME_UART2_TX                                                \
+	"uart2_tx" /* ID: 4, UART1_MODULE              */
+#define PL08X_DMA_NAME_UART2_RX                                                \
+	"uart2_rx" /* ID: 5, UART1_MODULE              */
+#define PL08X_DMA_NAME_SSP0_TX "ssp0_tx" /* ID: 6 */
+#define PL08X_DMA_NAME_SSP0_RX "ssp0_rx" /* ID: 7 */
+#define PL08X_DMA_NAME_SSP1_TX "ssp1_tx" /* ID: 8 */
+#define PL08X_DMA_NAME_SSP1_RX "ssp1_rx" /* ID: 9 */
+#define PL08X_DMA_NAME_SSP2_TX "ssp2_tx" /* ID: 10 */
+#define PL08X_DMA_NAME_SSP2_RX "ssp2_rx" /* ID: 11 */
+#define PL08X_DMA_NAME_I2S0_TX "i2s0_tx" /* ID: 12 */
+#define PL08X_DMA_NAME_I2S0_RX "i2s0_rx" /* ID: 13 */
+#define PL08X_DMA_NAME_I2S1_TX "i2s1_tx" /* ID: 14 */
+#define PL08X_DMA_NAME_I2S1_RX "i2s1_rx" /* ID: 15 */
+#define PL08X_DMA_NAME_I2S2_TX "i2s2_tx" /* ID: 16 */
+#define PL08X_DMA_NAME_I2S2_RX "i2s2_rx" /* ID: 17 */
+#define PL08X_DMA_NAME_AC97_PCMOUT                                             \
+	"ac97_pcmout" /* ID: 18                           */
+#define PL08X_DMA_NAME_AC97_PCMIN                                              \
+	"ac97_pcmin" /* ID: 19                           */
+#define PL08X_DMA_NAME_AC97_MICIN                                              \
+	"ac97_micin" /* ID: 20                           */
+#define PL08X_DMA_NAME_SPDIFRX "spdif_rx" /* ID: 21 */
+#define PL08X_DMA_NAME_SPDIFTX "spdif_tx" /* ID: 22 */
+#define PL08X_DMA_NAME_MPEGTSI0                                                \
+	"mpegtsi0" /* ID: 23                           */
+#define PL08X_DMA_NAME_MPEGTSI1                                                \
+	"mpegtsi1" /* ID: 24                           */
+#define PL08X_DMA_NAME_MPEGTSI2                                                \
+	"mpegtsi2" /* ID: 25                           */
+#define PL08X_DMA_NAME_MPEGTSI3                                                \
+	"mpegtsi3" /* ID: 26                           */
+#define PL08X_DMA_NAME_CRYPTO_BR                                               \
+	"crypto_br" /* ID: 27                           */
+#define PL08X_DMA_NAME_CRYPTO_BW                                               \
+	"crypto_bw" /* ID: 28                           */
+#define PL08X_DMA_NAME_CRYPTO_HR                                               \
+	"crypto_hr"		 /* ID: 29                           */
+#define PL08X_DMA_NAME_PDM "pdm" /* ID: 30                           */
+
+/*
+ * Refer to include/linux/amba/pl080.h
+ */
+#define PL08X_AHB1 (1 << 0)
+#define PL08X_AHB2 (1 << 1)
+
+#define PL080_CONTROL_TC_IRQ_EN (1 << 31)
+#define PL080_CONTROL_PROT_MASK (0x7 << 28)
+#define PL080_CONTROL_PROT_SHIFT (28)
+#define PL080_CONTROL_PROT_CACHE (1 << 30)
+#define PL080_CONTROL_PROT_BUFF (1 << 29)
+#define PL080_CONTROL_PROT_SYS (1 << 28)
+#define PL080_CONTROL_DST_INCR (1 << 27)
+#define PL080_CONTROL_SRC_INCR (1 << 26)
+#define PL080_CONTROL_DST_AHB2 (1 << 25)
+#define PL080_CONTROL_SRC_AHB2 (1 << 24)
+#define PL080_CONTROL_DWIDTH_MASK (0x7 << 21)
+#define PL080_CONTROL_DWIDTH_SHIFT (21)
+#define PL080_CONTROL_SWIDTH_MASK (0x7 << 18)
+#define PL080_CONTROL_SWIDTH_SHIFT (18)
+#define PL080_CONTROL_DB_SIZE_MASK (0x7 << 15)
+#define PL080_CONTROL_DB_SIZE_SHIFT (15)
+#define PL080_CONTROL_SB_SIZE_MASK (0x7 << 12)
+#define PL080_CONTROL_SB_SIZE_SHIFT (12)
+#define PL080_CONTROL_TRANSFER_SIZE_MASK (0xfff << 0)
+#define PL080_CONTROL_TRANSFER_SIZE_SHIFT (0)
+
+#define PL080_BSIZE_1 (0x0)
+#define PL080_BSIZE_4 (0x1)
+#define PL080_BSIZE_8 (0x2)
+#define PL080_BSIZE_16 (0x3)
+#define PL080_BSIZE_32 (0x4)
+#define PL080_BSIZE_64 (0x5)
+#define PL080_BSIZE_128 (0x6)
+#define PL080_BSIZE_256 (0x7)
+
+#define PL080_WIDTH_8BIT (0x0)
+#define PL080_WIDTH_16BIT (0x1)
+#define PL080_WIDTH_32BIT (0x2)
+
+#define PRIMECELL_MEMORU_CCTL                                                  \
+	(PL080_BSIZE_256 << PL080_CONTROL_SB_SIZE_SHIFT |                      \
+	 PL080_BSIZE_256 << PL080_CONTROL_DB_SIZE_SHIFT |                      \
+	 PL080_WIDTH_32BIT << PL080_CONTROL_SWIDTH_SHIFT |                     \
+	 PL080_WIDTH_32BIT << PL080_CONTROL_DWIDTH_SHIFT |                     \
+	 PL080_CONTROL_PROT_BUFF | PL080_CONTROL_PROT_CACHE |                  \
+	 PL080_CONTROL_PROT_SYS)
+
+#endif
diff -ENwbur a/include/dt-bindings/tieoff/s5p6818-tieoff.h b/include/dt-bindings/tieoff/s5p6818-tieoff.h
--- a/include/dt-bindings/tieoff/s5p6818-tieoff.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/dt-bindings/tieoff/s5p6818-tieoff.h	2018-05-06 08:49:51.818802542 +0200
@@ -0,0 +1,409 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+ #ifndef _S5P6818_TIEOFF_H
+ #define _S5P6818_TIEOFF_H
+
+#define NX_TIEOFF_MMC_8BIT				((1<<16) | 5)
+#define NX_TIEOFF_AXISRAM0_i_TIE_ra2w_EMAA		((3<<16) | 47)
+#define NX_TIEOFF_AXISRAM0_i_TIE_ra2w_EMAB		((3<<16) | 50)
+#define NX_TIEOFF_AXISRAM0_i_TIE_ra2w_EMAWA		((2<<16) | 53)
+#define NX_TIEOFF_AXISRAM0_i_TIE_ra2w_EMAWB		((2<<16) | 55)
+#define NX_TIEOFF_AXISRAM0_i_nPowerDown			((1<<16) | 57)
+#define NX_TIEOFF_AXISRAM0_i_nSleep			((1<<16) | 58)
+#define NX_TIEOFF_CAN0_i_TIE_rf1_EMA			((3<<16) | 59)
+#define NX_TIEOFF_CAN0_i_TIE_rf1_EMAW			((2<<16) | 62)
+#define NX_TIEOFF_CAN0_i_nPowerDown			((1<<16) | 64)
+#define NX_TIEOFF_CAN0_i_nSleep				((1<<16) | 65)
+#define NX_TIEOFF_CAN1_i_TIE_rf1_EMA			((3<<16) | 66)
+#define NX_TIEOFF_CAN1_i_TIE_rf1_EMAW			((2<<16) | 69)
+#define NX_TIEOFF_CAN1_i_nPowerDown			((1<<16) | 71)
+#define NX_TIEOFF_CAN1_i_nSleep				((1<<16) | 72)
+#define NX_TIEOFF_DEINTERLACE0_i_NX_RF1_EMA		((3<<16) | 73)
+#define NX_TIEOFF_DEINTERLACE0_i_NX_RF1_EMAW		((2<<16) | 76)
+#define NX_TIEOFF_DEINTERLACE0_i_NX_RF2_EMAA		((3<<16) | 78)
+#define NX_TIEOFF_DEINTERLACE0_i_NX_RF2_EMAB		((3<<16) | 81)
+#define NX_TIEOFF_DEINTERLACE0_i_NX_RF2W_EMAA		((3<<16) | 84)
+#define NX_TIEOFF_DEINTERLACE0_i_NX_RF2W_EMAB		((3<<16) | 87)
+#define NX_TIEOFF_DISPLAYTOP0_i_ResConv_nPowerDown	((1<<16) | 90)
+#define NX_TIEOFF_DISPLAYTOP0_i_ResConv_nSleep		((1<<16) | 91)
+#define NX_TIEOFF_DISPLAYTOP0_i_HDMI_nPowerDown		((2<<16) | 92)
+#define NX_TIEOFF_DISPLAYTOP0_i_HDMI_nSleep		((2<<16) | 94)
+#define NX_TIEOFF_DISPLAYTOP0_i_HDMI_PHY_REFCLK_SEL	((1<<16) | 96)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_SPSRAM_EMA	((3<<16) | 97)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_SPSRAM_EMAW	((2<<16) | 100)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_DPSRAM_1R1W_EMAA ((3<<16) | 102)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_DPSRAM_1R1W_EMAB ((3<<16) | 105)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_DPSRAM_EMAA	((3<<16) | 108)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_DPSRAM_EMAB	((3<<16) | 111)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_DPSRAM_EMAWA	((2<<16) | 114)
+#define NX_TIEOFF_DISPLAYTOP0_i_TIEOFF_DPSRAM_EMAWB	((2<<16) | 116)
+#define NX_TIEOFF_MCUSTOP0_i_vrom_EMA			((3<<16) | 118)
+#define NX_TIEOFF_DREX0_CKE_INIT			((1<<16) | 121)
+#define NX_TIEOFF_DREX0_CA_SWAP				((1<<16) | 122)
+#define NX_TIEOFF_DREX0_CSYSREQ				((1<<16) | 123)
+#define NX_TIEOFF_DREX0_PAUSE_REQ			((1<<16) | 124)
+#define NX_TIEOFF_DREX0_PEREV_TRIGGER			((1<<16) | 125)
+#define NX_TIEOFF_DREX0_CTRL_HCKE			((1<<16) | 126)
+#define NX_TIEOFF_DREX0_DFI_RESET_N_P0			((1<<16) | 127)
+#define NX_TIEOFF_DREX0_DFI_RESET_N_P1			((1<<16) | 128)
+#define NX_TIEOFF_MIPI0_NX_DPSRAM_1R1W_EMAA		((3<<16) | 129)
+#define NX_TIEOFF_MIPI0_NX_DPSRAM_1R1W_EMAB		((3<<16) | 132)
+#define NX_TIEOFF_MIPI0_i_NX_NPOWERDOWN			((4<<16) | 135)
+#define NX_TIEOFF_MIPI0_i_NX_NSLEEP			((4<<16) | 139)
+#define NX_TIEOFF_SCALER0_i_NX_EMA			((3<<16) | 143)
+#define NX_TIEOFF_SCALER0_i_NX_EMAW			((2<<16) | 146)
+#define NX_TIEOFF_UART0_USESMC				((1<<16) | 148)
+#define NX_TIEOFF_UART0_SMCTXENB			((1<<16) | 149)
+#define NX_TIEOFF_UART0_SMCRXENB			((1<<16) | 150)
+#define NX_TIEOFF_UART1_USESMC				((1<<16) | 151)
+#define NX_TIEOFF_UART1_SMCTXENB			((1<<16) | 152)
+#define NX_TIEOFF_UART1_SMCRXENB			((1<<16) | 153)
+#define NX_TIEOFF_UART2_USESMC				((1<<16) | 154)
+#define NX_TIEOFF_UART2_SMCTXENB			((1<<16) | 155)
+#define NX_TIEOFF_UART2_SMCRXENB			((1<<16) | 156)
+#define NX_TIEOFF_UART3_USESMC				((1<<16) | 157)
+#define NX_TIEOFF_UART3_SMCTXENB			((1<<16) | 158)
+#define NX_TIEOFF_UART3_SMCRXENB			((1<<16) | 159)
+#define NX_TIEOFF_UART4_USESMC				((1<<16) | 160)
+#define NX_TIEOFF_UART4_SMCTXENB			((1<<16) | 161)
+#define NX_TIEOFF_UART4_SMCRXENB			((1<<16) | 162)
+#define NX_TIEOFF_UART5_USESMC				((1<<16) | 163)
+#define NX_TIEOFF_UART5_SMCTXENB			((1<<16) | 164)
+#define NX_TIEOFF_UART5_SMCRXENB			((1<<16) | 165)
+#define NX_TIEOFF_USB20HOST0_i_nPowerDown		((1<<16) | 166)
+#define NX_TIEOFF_USB20HOST0_i_nSleep			((1<<16) | 167)
+#define NX_TIEOFF_USB20HOST0_i_NX_RF1_EMA		((3<<16) | 168)
+#define NX_TIEOFF_USB20HOST0_i_NX_RF1_EMAW		((2<<16) | 171)
+#define NX_TIEOFF_USB20HOST0_sys_interrupt_i		((1<<16) | 173)
+#define NX_TIEOFF_USB20HOST0_i_hsic_en			((3<<16) | 174)
+#define NX_TIEOFF_USB20HOST0_ss_word_if_enb_i		((1<<16) | 185)
+#define NX_TIEOFF_USB20HOST0_ss_word_if_i		((1<<16) | 186)
+#define NX_TIEOFF_USB20HOST0_ss_utmi_backward_enb_i	((1<<16) | 187)
+#define NX_TIEOFF_USB20HOST0_ss_resume_utmi_pls_dis_i	((1<<16) | 188)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_0_i		((3<<16) | 189)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_1_i		((3<<16) | 192)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_2_i		((3<<16) | 195)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_3_i		((3<<16) | 198)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_4_i		((3<<16) | 201)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_5_i		((3<<16) | 204)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_6_i		((3<<16) | 207)
+#define NX_TIEOFF_USB20HOST0_phy_vstatus_7_i		((3<<16) | 210)
+#define NX_TIEOFF_USB20HOST0_ss_power_state_valid_i	((1<<16) | 213)
+#define NX_TIEOFF_USB20HOST0_ss_nxt_power_state_valid_i ((1<<16) | 214)
+#define NX_TIEOFF_USB20HOST0_ss_power_state_i		((2<<16) | 215)
+#define NX_TIEOFF_USB20HOST0_ss_next_power_state_i	((2<<16) | 217)
+#define NX_TIEOFF_USB20HOST0_app_prt_ovrcur_i		((3<<16) | 219)
+#define NX_TIEOFF_USB20HOST0_ss_simulation_mode_i	((1<<16) | 222)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_host_i	((6<<16) | 224)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_5_i		((3<<16) | 230)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_4_i		((3<<16) | 233)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_3_i		((3<<16) | 236)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_2_i		((3<<16) | 239)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_1_i		((3<<16) | 242)
+#define NX_TIEOFF_USB20HOST0_ss_fladj_val_0_i		((3<<16) | 245)
+#define NX_TIEOFF_USB20HOST0_ss_autoppd_on_overcur_en_i ((1<<16) | 248)
+#define NX_TIEOFF_USB20HOST0_ss_ena_incr16_i		((1<<16) | 249)
+#define NX_TIEOFF_USB20HOST0_ss_ena_incr8_i		((1<<16) | 250)
+#define NX_TIEOFF_USB20HOST0_ss_ena_incr4_i		((1<<16) | 251)
+#define NX_TIEOFF_USB20HOST0_ss_ena_incrx_align_i	((1<<16) | 252)
+#define NX_TIEOFF_USB20HOST0_i_ohci_0_cntsel_n		((1<<16) | 253)
+#define NX_TIEOFF_USB20HOST0_ohci_0_app_irq1_i		((1<<16) | 254)
+#define NX_TIEOFF_USB20HOST0_ohci_0_app_irq12_i		((1<<16) | 255)
+#define NX_TIEOFF_USB20HOST0_ohci_0_app_io_hit_i	((1<<16) | 256)
+#define NX_TIEOFF_USB20HOST0_ss_hubsetup_min_i		((1<<16) | 257)
+#define NX_TIEOFF_USB20HOST0_app_start_clk_i		((1<<16) | 258)
+#define NX_TIEOFF_USB20HOST0_ohci_susp_lgcy_i		((1<<16) | 259)
+#define NX_TIEOFF_USB20HOST0_i_SIDDQ			((1<<16) | 260)
+#define NX_TIEOFF_USB20HOST0_i_VATESTENB		((2<<16) | 261)
+#define NX_TIEOFF_USB20HOST0_i_POR_ENB			((1<<16) | 263)
+#define NX_TIEOFF_USB20HOST0_i_POR			((1<<16) | 264)
+#define NX_TIEOFF_USB20HOST0_i_REFCLKSEL		((2<<16) | 265)
+#define NX_TIEOFF_USB20HOST0_i_FSEL			((3<<16) | 267)
+#define NX_TIEOFF_USB20HOST0_i_COMMONONN		((1<<16) | 270)
+#define NX_TIEOFF_USB20HOST0_i_RESREQIN			((1<<16) | 271)
+#define NX_TIEOFF_USB20HOST0_i_PORTRESET		((1<<16) | 272)
+#define NX_TIEOFF_USB20HOST0_i_OTGDISABLE		((1<<16) | 273)
+#define NX_TIEOFF_USB20HOST0_i_LOOPBACKENB		((1<<16) | 274)
+#define NX_TIEOFF_USB20HOST0_i_IDPULLUPi		((1<<16) | 275)
+#define NX_TIEOFF_USB20HOST0_i_DRVVBUS			((1<<16) | 276)
+#define NX_TIEOFF_USB20HOST0_i_ADPCHRG			((1<<16) | 277)
+#define NX_TIEOFF_USB20HOST0_i_ADPDISCHRG		((1<<16) | 278)
+#define NX_TIEOFF_USB20HOST0_i_ADPPRBENB		((1<<16) | 279)
+#define NX_TIEOFF_USB20HOST0_i_VBUSVLDEXT		((1<<16) | 280)
+#define NX_TIEOFF_USB20HOST0_i_VBUSVLDEXTSEL		((1<<16) | 281)
+#define NX_TIEOFF_USB20HOST0_i_DPPULLDOWN		((1<<16) | 282)
+#define NX_TIEOFF_USB20HOST0_i_DMPULLDOWN		((1<<16) | 283)
+#define NX_TIEOFF_USB20HOST0_i_SUSPENDM_ENB		((1<<16) | 284)
+#define NX_TIEOFF_USB20HOST0_i_SUSPENDM			((1<<16) | 285)
+#define NX_TIEOFF_USB20HOST0_i_SLEEPM_ENB		((1<<16) | 286)
+#define NX_TIEOFF_USB20HOST0_i_SLEEPM			((1<<16) | 287)
+#define NX_TIEOFF_USB20HOST0_i_OPMODE_ENB		((1<<16) | 288)
+#define NX_TIEOFF_USB20HOST0_i_OPMODE			((2<<16) | 289)
+#define NX_TIEOFF_USB20HOST0_i_TERMSEL_ENB		((1<<16) | 291)
+#define NX_TIEOFF_USB20HOST0_i_TERMSEL			((1<<16) | 292)
+#define NX_TIEOFF_USB20HOST0_i_XCVRSEL_ENB		((1<<16) | 293)
+#define NX_TIEOFF_USB20HOST0_i_XCVRSEL			((2<<16) | 294)
+#define NX_TIEOFF_USB20HOST0_i_WORDINTERFACE_ENB	((1<<16) | 296)
+#define NX_TIEOFF_USB20HOST0_i_WORDINTERFACE		((1<<16) | 297)
+#define NX_TIEOFF_USB20HOST0_i_TXBITSTUFFEN		((1<<16) | 298)
+#define NX_TIEOFF_USB20HOST0_i_TXBITSTUFFENH		((1<<16) | 299)
+#define NX_TIEOFF_USB20HOST0_i_BYPASSDPDATA		((1<<16) | 300)
+#define NX_TIEOFF_USB20HOST0_i_BYPASSDMDATA		((1<<16) | 301)
+#define NX_TIEOFF_USB20HOST0_i_BYPASSDPEN		((1<<16) | 302)
+#define NX_TIEOFF_USB20HOST0_i_BYPASSDMEN		((1<<16) | 303)
+#define NX_TIEOFF_USB20HOST0_i_BYPASSSEL		((1<<16) | 304)
+#define NX_TIEOFF_USB20HOST0_i_COMPDISTUNE		((3<<16) | 305)
+#define NX_TIEOFF_USB20HOST0_i_SQRXTUNE			((3<<16) | 308)
+#define NX_TIEOFF_USB20HOST0_i_OTGTUNE			((3<<16) | 311)
+#define NX_TIEOFF_USB20HOST0_i_TXHSXVTUNE		((2<<16) | 314)
+#define NX_TIEOFF_USB20HOST0_i_TXFSLSTUNE		((4<<16) | 316)
+#define NX_TIEOFF_USB20HOST0_i_TXVREFTUNE		((4<<16) | 320)
+#define NX_TIEOFF_USB20HOST0_i_TXRISETUNE		((2<<16) | 324)
+#define NX_TIEOFF_USB20HOST0_i_TXRESTUNE		((2<<16) | 326)
+#define NX_TIEOFF_USB20HOST0_i_TXPREEMPAMPTUNE		((2<<16) | 328)
+#define NX_TIEOFF_USB20HOST0_i_TXPREEMPPULSETUNE	((1<<16) | 330)
+#define NX_TIEOFF_USB20HOST0_i_CHRGSEL			((1<<16) | 331)
+#define NX_TIEOFF_USB20HOST0_i_VDATDETENB		((1<<16) | 332)
+#define NX_TIEOFF_USB20HOST0_i_VDATSRCENB		((1<<16) | 333)
+#define NX_TIEOFF_USB20HOST0_i_DCDENB			((1<<16) | 334)
+#define NX_TIEOFF_USB20HOST0_i_ACAENB			((1<<16) | 335)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_MSTRXCVR		((1<<16) | 336)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_SIDDQ		((1<<16) | 337)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_POR_ENB		((1<<16) | 338)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_POR			((1<<16) | 339)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_REFCLKDIV		((7<<16) | 340)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_REFCLKSEL		((2<<16) | 347)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_COMMONONN		((1<<16) | 349)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_PORTRESET		((1<<16) | 350)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_LOOPBACKENB		((1<<16) | 351)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_DPPULLDOWN		((1<<16) | 352)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_DMPULLDOWN		((1<<16) | 353)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_SUSPENDM_ENB	((1<<16) | 354)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_SUSPENDM		((1<<16) | 355)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_SLEEPM_ENB		((1<<16) | 356)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_SLEEPM		((1<<16) | 357)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_MSTRXOPU		((1<<16) | 358)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_OPMODE_ENB		((1<<16) | 359)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_OPMODE		((2<<16) | 360)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_XCVRSELECT_ENB	((1<<16) | 362)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_XCVRSELECT		((1<<16) | 363)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_WORDINTERFACE_ENB	((1<<16) | 364)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_WORDINTERFACE	((1<<16) | 365)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_TXBITSTUFFEN	((1<<16) | 366)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_TXBITSTUFFENH	((1<<16) | 367)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_TXRPUTUNE		((2<<16) | 368)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_TXRPDTUNE		((2<<16) | 370)
+#define NX_TIEOFF_USB20HOST0_i_HSIC_TXSRTUNE		((4<<16) | 372)
+#define NX_TIEOFF_USB20OTG0_i_nPowerDown		((1<<16) | 376)
+#define NX_TIEOFF_USB20OTG0_i_nSleep			((1<<16) | 377)
+#define NX_TIEOFF_USB20OTG0_i_NX_RF1_EMA		((3<<16) | 378)
+#define NX_TIEOFF_USB20OTG0_i_NX_RF1_EMAW		((2<<16) | 381)
+#define NX_TIEOFF_USB20OTG0_i_ss_scaledown_mode		((2<<16) | 384)
+#define NX_TIEOFF_USB20OTG0_i_gp_in			((16<<16) | 386)
+#define NX_TIEOFF_USB20OTG0_i_sof_count			((14<<16) | 402)
+#define NX_TIEOFF_USB20OTG0_i_sys_dma_done		((1<<16) | 416)
+#define NX_TIEOFF_USB20OTG0_i_if_select_hsic		((1<<16) | 417)
+#define NX_TIEOFF_USB20OTG0_i_nResetSync		((1<<16) | 418)
+#define NX_TIEOFF_USB20OTG0_i_nUtmiResetSync		((1<<16) | 419)
+#define NX_TIEOFF_USB20OTG0_i_SIDDQ			((1<<16) | 420)
+#define NX_TIEOFF_USB20OTG0_i_VATESTENB			((2<<16) | 421)
+#define NX_TIEOFF_USB20OTG0_i_POR_ENB			((1<<16) | 423)
+#define NX_TIEOFF_USB20OTG0_i_POR			((1<<16) | 424)
+#define NX_TIEOFF_USB20OTG0_i_REFCLKSEL			((2<<16) | 425)
+#define NX_TIEOFF_USB20OTG0_i_FSEL			((3<<16) | 427)
+#define NX_TIEOFF_USB20OTG0_i_COMMONONN			((1<<16) | 430)
+#define NX_TIEOFF_USB20OTG0_i_RESREQIN			((1<<16) | 431)
+#define NX_TIEOFF_USB20OTG0_i_PORTRESET			((1<<16) | 432)
+#define NX_TIEOFF_USB20OTG0_i_OTGDISABLE		((1<<16) | 433)
+#define NX_TIEOFF_USB20OTG0_i_LOOPBACKENB		((1<<16) | 434)
+#define NX_TIEOFF_USB20OTG0_i_IDPULLUP			((1<<16) | 435)
+#define NX_TIEOFF_USB20OTG0_i_DRVVBUS			((1<<16) | 436)
+#define NX_TIEOFF_USB20OTG0_i_ADPCHRG			((1<<16) | 437)
+#define NX_TIEOFF_USB20OTG0_i_ADPDISCHRG		((1<<16) | 438)
+#define NX_TIEOFF_USB20OTG0_i_ADPPRBENB			((1<<16) | 439)
+#define NX_TIEOFF_USB20OTG0_i_VBUSVLDEXT		((1<<16) | 440)
+#define NX_TIEOFF_USB20OTG0_i_VBUSVLDEXTSEL		((1<<16) | 441)
+#define NX_TIEOFF_USB20OTG0_i_DPPULLDOWN		((1<<16) | 442)
+#define NX_TIEOFF_USB20OTG0_i_DMPULLDOWN		((1<<16) | 443)
+#define NX_TIEOFF_USB20OTG0_i_SUSPENDM_ENB		((1<<16) | 444)
+#define NX_TIEOFF_USB20OTG0_i_SUSPENDM			((1<<16) | 445)
+#define NX_TIEOFF_USB20OTG0_i_SLEEPM_ENB		((1<<16) | 446)
+#define NX_TIEOFF_USB20OTG0_i_SLEEPM			((1<<16) | 447)
+#define NX_TIEOFF_USB20OTG0_i_OPMODE_ENB		((1<<16) | 448)
+#define NX_TIEOFF_USB20OTG0_i_OPMODE			((2<<16) | 449)
+#define NX_TIEOFF_USB20OTG0_i_TERMSEL_ENB		((1<<16) | 451)
+#define NX_TIEOFF_USB20OTG0_i_TERMSEL			((1<<16) | 452)
+#define NX_TIEOFF_USB20OTG0_i_XCVRSEL_ENB		((1<<16) | 453)
+#define NX_TIEOFF_USB20OTG0_i_XCVRSEL			((2<<16) | 454)
+#define NX_TIEOFF_USB20OTG0_i_WORDINTERFACE_ENB		((1<<16) | 456)
+#define NX_TIEOFF_USB20OTG0_i_WORDINTERFACE		((1<<16) | 457)
+#define NX_TIEOFF_USB20OTG0_i_TXBITSTUFFEN		((1<<16) | 458)
+#define NX_TIEOFF_USB20OTG0_i_TXBITSTUFFENH		((1<<16) | 459)
+#define NX_TIEOFF_USB20OTG0_i_BYPASSDPDATA		((1<<16) | 460)
+#define NX_TIEOFF_USB20OTG0_i_BYPASSDMDATA		((1<<16) | 461)
+#define NX_TIEOFF_USB20OTG0_i_BYPASSDPEN		((1<<16) | 462)
+#define NX_TIEOFF_USB20OTG0_i_BYPASSDMEN		((1<<16) | 463)
+#define NX_TIEOFF_USB20OTG0_i_BYPASSSEL			((1<<16) | 464)
+#define NX_TIEOFF_USB20OTG0_i_COMPDISTUNE		((3<<16) | 465)
+#define NX_TIEOFF_USB20OTG0_i_SQRXTUNE			((3<<16) | 468)
+#define NX_TIEOFF_USB20OTG0_i_OTGTUNE			((3<<16) | 471)
+#define NX_TIEOFF_USB20OTG0_i_TXHSXVTUNE		((2<<16) | 474)
+#define NX_TIEOFF_USB20OTG0_i_TXFSLSTUNE		((4<<16) | 476)
+#define NX_TIEOFF_USB20OTG0_i_TXVREFTUNE		((4<<16) | 480)
+#define NX_TIEOFF_USB20OTG0_i_TXRISETUNE		((2<<16) | 484)
+#define NX_TIEOFF_USB20OTG0_i_TXRESTUNE			((2<<16) | 486)
+#define NX_TIEOFF_USB20OTG0_i_TXPREEMPAMPTUNE		((2<<16) | 488)
+#define NX_TIEOFF_USB20OTG0_i_TXPREEMPPULSETUNE		((1<<16) | 490)
+#define NX_TIEOFF_USB20OTG0_i_CHRGSEL			((1<<16) | 491)
+#define NX_TIEOFF_USB20OTG0_i_VDATDETENB		((1<<16) | 492)
+#define NX_TIEOFF_USB20OTG0_i_VDATSRCENB		((1<<16) | 493)
+#define NX_TIEOFF_USB20OTG0_i_DCDENB			((1<<16) | 494)
+#define NX_TIEOFF_USB20OTG0_i_ACAENB			((1<<16) | 495)
+#define NX_TIEOFF_USB20OTG0_i_IDPULLUP_ENB		((1<<16) | 496)
+#define NX_TIEOFF_USB20OTG0_i_DPPULLDOWN_ENB		((1<<16) | 497)
+#define NX_TIEOFF_USB20OTG0_i_DMPULLDOWN_ENB		((1<<16) | 498)
+#define NX_TIEOFF_USB20OTG0_i_DRVVBUS_ENB		((1<<16) | 499)
+#define NX_TIEOFF_USB20OTG0_i_LPMClkMuxCntrl		((1<<16) | 500)
+#define NX_TIEOFF_USB20OTG0_i_GLITCHLESSMUXCntrl	((1<<16) | 501)
+#define NX_TIEOFF_CODA9600_i_nPWRDN00			((4<<16) | 502)
+#define NX_TIEOFF_CODA9600_i_nSLEEP00			((4<<16) | 506)
+#define NX_TIEOFF_CODA9600_i_nPWRDN01			((8<<16) | 512)
+#define NX_TIEOFF_CODA9600_i_nSLEEP01			((8<<16) | 520)
+#define NX_TIEOFF_CODA9600_i_nPWRDN02			((10<<16) | 528)
+#define NX_TIEOFF_CODA9600_i_nSLEEP02			((10<<16) | 544)
+#define NX_TIEOFF_CODA9600_i_nPWRDN03			((2<<16) | 554)
+#define NX_TIEOFF_CODA9600_i_nSLEEP03			((2<<16) | 556)
+#define NX_TIEOFF_CODA9600_i_nPWRDN04			((8<<16) | 558)
+#define NX_TIEOFF_CODA9600_i_nSLEEP04			((8<<16) | 566)
+#define NX_TIEOFF_CODA9600_i_nPWRDN05			((3<<16) | 576)
+#define NX_TIEOFF_CODA9600_i_nSLEEP05			((3<<16) | 579)
+#define NX_TIEOFF_CODA9600_i_nPWRDN06			((7<<16) | 582)
+#define NX_TIEOFF_CODA9600_i_nSLEEP06			((7<<16) | 589)
+#define NX_TIEOFF_CODA9600_i_nPWRDN07			((12<<16) | 596)
+#define NX_TIEOFF_CODA9600_i_nSLEEP07			((12<<16) | 608)
+#define NX_TIEOFF_CODA9600_i_nPWRDN08			((1<<16) | 620)
+#define NX_TIEOFF_CODA9600_i_nSLEEP08			((1<<16) | 621)
+#define NX_TIEOFF_CODA9600_i_nPWRDN09			((2<<16) | 622)
+#define NX_TIEOFF_CODA9600_i_nSLEEP09			((2<<16) | 624)
+#define NX_TIEOFF_CODA9600_i_nPWRDN10			((10<<16) | 626)
+#define NX_TIEOFF_CODA9600_i_nSLEEP10			((10<<16) | 640)
+#define NX_TIEOFF_CODA9600_i_nPWRDN11			((1<<16) | 650)
+#define NX_TIEOFF_CODA9600_i_nSLEEP11			((1<<16) | 651)
+#define NX_TIEOFF_CODA9600_i_TIE_rf2_EMAA		((3<<16) | 652)
+#define NX_TIEOFF_CODA9600_i_TIE_rf2_EMAB		((3<<16) | 655)
+#define NX_TIEOFF_CODA9600_i_TIE_rf2w_EMAA		((3<<16) | 658)
+#define NX_TIEOFF_CODA9600_i_TIE_rf2w_EMAB		((3<<16) | 661)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2_EMAA		((3<<16) | 664)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2_EMAB		((3<<16) | 667)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2_EMAWA		((2<<16) | 670)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2_EMAWB		((2<<16) | 672)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2w_EMAA		((3<<16) | 674)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2w_EMAB		((3<<16) | 677)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2w_EMAWA		((2<<16) | 680)
+#define NX_TIEOFF_CODA9600_i_TIE_ra2w_EMAWB		((2<<16) | 682)
+#define NX_TIEOFF_CODA9600_i_TIE_rf1_EMA		((3<<16) | 684)
+#define NX_TIEOFF_CODA9600_i_TIE_rf1_EMAW		((2<<16) | 687)
+#define NX_TIEOFF_CODA9600_i_TIE_rf1w_EMA		((3<<16) | 689)
+#define NX_TIEOFF_CODA9600_i_TIE_rf1w_EMAW		((2<<16) | 692)
+#define NX_TIEOFF_DWC_GMAC0_sbd_flowctrl_i		((1<<16) | 694)
+#define NX_TIEOFF_DWC_GMAC0_phy_intf_sel_i		((3<<16) | 695)
+#define NX_TIEOFF_DWC_GMAC0_i_NX_RF2_EMAA		((3<<16) | 698)
+#define NX_TIEOFF_DWC_GMAC0_i_NX_RF2_EMAB		((3<<16) | 701)
+#define NX_TIEOFF_MALI4000_NX_DPSRAM_1R1W_EMAA		((3<<16) | 704)
+#define NX_TIEOFF_MALI4000_NX_DPSRAM_1R1W_EMAB		((3<<16) | 707)
+#define NX_TIEOFF_MALI4000_NX_SPSRAM_EMA		((3<<16) | 710)
+#define NX_TIEOFF_MALI4000_NX_SPSRAM_EMAW		((2<<16) | 713)
+#define NX_TIEOFF_MALI4000_NX_SPSRAM_BW_EMA		((3<<16) | 715)
+#define NX_TIEOFF_MALI4000_NX_SPSRAM_BW_EMAW		((2<<16) | 718)
+#define NX_TIEOFF_MALI4000_PWRDNBYPASS			((1<<16) | 720)
+#define NX_TIEOFF_MALI4000_GP_NX_NPOWERDOWN		((15<<16) | 721)
+#define NX_TIEOFF_MALI4000_GP_NX_NSLEEP			((15<<16) | 736)
+#define NX_TIEOFF_MALI4000_L2_NX_NPOWERDOWN		((3<<16) | 751)
+#define NX_TIEOFF_MALI4000_L2_NX_NSLEEP			((3<<16) | 754)
+#define NX_TIEOFF_MALI4000_PP0_NX_NPOWERDOWN		((32<<16) | 768)
+#define NX_TIEOFF_MALI4000_PP0_NX_NSLEEP		((32<<16) | 800)
+#define NX_TIEOFF_MALI4000_PP1_NX_NPOWERDOWN		((32<<16) | 832)
+#define NX_TIEOFF_MALI4000_PP1_NX_NSLEEP		((32<<16) | 864)
+#define NX_TIEOFF_MALI4000_PP2_NX_NPOWERDOWN		((32<<16) | 896)
+#define NX_TIEOFF_MALI4000_PP2_NX_NSLEEP		((32<<16) | 928)
+#define NX_TIEOFF_MALI4000_PP3_NX_NPOWERDOWN		((32<<16) | 960)
+#define NX_TIEOFF_MALI4000_PP3_NX_NSLEEP		((32<<16) | 992)
+#define NX_TIEOFF_A3BM_AXI_PERI_BUS0_SYNCMODEREQm9	((1<<16) | 1024)
+#define NX_TIEOFF_A3BM_AXI_PERI_BUS0_SYNCMODEREQm10	((1<<16) | 1025)
+#define NX_TIEOFF_A3BM_AXI_PERI_BUS0_SYNCMODEREQm16	((1<<16) | 1026)
+#define NX_TIEOFF_A3BM_AXI_TOP_MASTER_BUS0_REMAP	((2<<16) | 1027)
+#define NX_TIEOFF_Inst_TMU0_SENSING_START		((1<<16) | 2432)
+#define NX_TIEOFF_Inst_TMU1_SENSING_START		((1<<16) | 2433)
+#define NX_TIEOFF_Inst_TMU2_SENSING_START		((1<<16) | 2434)
+#define NX_TIEOFF_Inst_TMU0_SENSING_DONE		((2<<16) | 2435)
+#define NX_TIEOFF_Inst_TMU1_SENSING_DONE		((2<<16) | 2436)
+#define NX_TIEOFF_Inst_TMU2_SENSING_DONE		((2<<16) | 2437)
+#define NX_TIEOFF_Inst_ARMTOP_SMPEN			((4<<16) | 2816)
+#define NX_TIEOFF_Inst_ARMTOP_STANBYWFI			((4<<16) | 2880)
+#define NX_TIEOFF_Inst_ARMTOP_STANBYWFIL2		((1<<16) | 2884)
+#define NX_TIEOFF_Inst_ARMTOP_DBGNOPWRDWN		((4<<16) | 2889)
+#define NX_TIEOFF_Inst_ARMTOP_DBGPWRUPREQ		((4<<16) | 2893)
+#define NX_TIEOFF_Inst_ARMTOP_COREPWRDOWNPRE		((1<<16) | 2901)
+#define NX_TIEOFF_Inst_ARMTOP_CPU0PWRDOWNPRE		((1<<16) | 2902)
+#define NX_TIEOFF_Inst_ARMTOP_CPU1PWRDOWNPRE		((1<<16) | 2903)
+#define NX_TIEOFF_Inst_ARMTOP_CPU2PWRDOWNPRE		((1<<16) | 2904)
+#define NX_TIEOFF_Inst_ARMTOP_CPU3PWRDOWNPRE		((1<<16) | 2905)
+#define NX_TIEOFF_Inst_ARMTOP_COREPWRDOWNALL		((1<<16) | 2906)
+#define NX_TIEOFF_Inst_ARMTOP_CPU0PWRDOWNALL		((1<<16) | 2907)
+#define NX_TIEOFF_Inst_ARMTOP_CPU1PWRDOWNALL		((1<<16) | 2908)
+#define NX_TIEOFF_Inst_ARMTOP_CPU2PWRDOWNALL		((1<<16) | 2909)
+#define NX_TIEOFF_Inst_ARMTOP_CPU3PWRDOWNALL		((1<<16) | 2910)
+#define NX_TIEOFF_Inst_ARMTOP_CLAMPL2			((1<<16) | 2920)
+#define NX_TIEOFF_Inst_ARMTOP_L2FLUSHREQ		((1<<16) | 3018)
+#define NX_TIEOFF_Inst_ARMTOP_L2FLUSHDONE		((1<<16) | 3019)
+#define NX_TIEOFF_Inst_ARMTOP_ACINACTM			((1<<16) | 3023)
+#define NX_TIEOFF_Inst_ARMTOP_P1_SMPEN			((4<<16) | 3360)
+#define NX_TIEOFF_Inst_ARMTOP_P1_STANBYWFI		((4<<16) | 3424)
+#define NX_TIEOFF_Inst_ARMTOP_P1_STANBYWFIL2		((1<<16) | 3428)
+#define NX_TIEOFF_Inst_ARMTOP_P1_DBGNOPWRDWN		((4<<16) | 3442)
+#define NX_TIEOFF_Inst_ARMTOP_P1_DBGPWRUPREQ		((4<<16) | 3443)
+#define NX_TIEOFF_Inst_ARMTOP_P1_DBGPWRDUP		((4<<16) | 3444)
+#define NX_TIEOFF_Inst_ARMTOP_P1_COREPWRDOWNPRE		((1<<16) | 3445)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU0PWRDOWNPRE		((1<<16) | 3446)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU1PWRDOWNPRE		((1<<16) | 3447)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU2PWRDOWNPRE		((1<<16) | 3448)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU3PWRDOWNPRE		((1<<16) | 3449)
+#define NX_TIEOFF_Inst_ARMTOP_P1_COREPWRDOWNALL		((1<<16) | 3450)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU0PWRDOWNALL		((1<<16) | 3451)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU1PWRDOWNALL		((1<<16) | 3452)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU2PWRDOWNALL		((1<<16) | 3453)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CPU3PWRDOWNALL		((1<<16) | 3454)
+#define NX_TIEOFF_Inst_ARMTOP_P1_CLAMPL2		((1<<16) | 3464)
+#define NX_TIEOFF_Inst_ARMTOP_P1_L2FLUSHREQ		((1<<16) | 3562)
+#define NX_TIEOFF_Inst_ARMTOP_P1_L2FLUSHDONE		((1<<16) | 3563)
+#define NX_TIEOFF_Inst_ARMTOP_P1_ACINACTM		((1<<16) | 3567)
+#define NX_TIEOFF_Inst_VR_MBUS_AXILPI_S0_CSYSREQ	((1<<16) | (69*32+1))
+#define NX_TIEOFF_Inst_VR_PBUS_AXILPI_S0_CSYSREQ	((1<<16) | (69*32+2))
+#define NX_TIEOFF_Inst_ASYNCXUI0_CSYSREQ		((1<<16) | (69*32+3))
+#define NX_TIEOFF_Inst_ASYNCXUI1_CSYSREQ		((1<<16) | (69*32+4))
+#define NX_TIEOFF_Inst_VR_PBUS_AXILPI_S0_CACTIVE	((1<<16) | (131*32+12))
+#define NX_TIEOFF_Inst_VR_PBUS_AXILPI_S0_CSYSACK	((1<<16) | (131*32+13))
+#define NX_TIEOFF_Inst_CODA960_ASYNCXIU0_CSYSACK_S	((1<<16) | (131*32+14))
+#define NX_TIEOFF_Inst_CODA960_ASYNCXIU0_CACTIVE_S	((1<<16) | (131*32+15))
+#define NX_TIEOFF_Inst_CODA960_ASYNCXIU1_CSYSACK_S	((1<<16) | (131*32+16))
+#define NX_TIEOFF_Inst_CODA960_ASYNCXIU1_CACTIVE_S	((1<<16) | (131*32+17))
+#define NX_TIEOFF_Inst_VR_MBUS_AXILPI_S0_CACTIVE	((1<<16) | (131*32+20))
+#define NX_TIEOFF_Inst_VR_MBUS_AXILPI_S0_CSYSACK	((1<<16) | (131*32+21))
+
+#endif /* _S5P6818_TIEOFF_H */
diff -ENwbur a/include/linux/devfreq.h b/include/linux/devfreq.h
--- a/include/linux/devfreq.h	2018-05-06 08:47:38.953410059 +0200
+++ b/include/linux/devfreq.h	2018-05-06 08:49:51.830803031 +0200
@@ -234,6 +234,13 @@
 };
 #endif

+#if IS_ENABLED(CONFIG_ARM_S5Pxx18_DEVFREQ)
+struct devfreq_notifier_block {
+	struct notifier_block nb;
+	struct devfreq *df;
+};
+#endif
+
 #if IS_ENABLED(CONFIG_DEVFREQ_GOV_PASSIVE)
 /**
  * struct devfreq_passive_data - void *data fed to struct devfreq
diff -ENwbur a/include/linux/fence.h b/include/linux/fence.h
--- a/include/linux/fence.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/fence.h	2018-05-06 08:49:51.838803354 +0200
@@ -0,0 +1,377 @@
+/*
+ * Fence mechanism for dma-buf to allow for asynchronous dma access
+ *
+ * Copyright (C) 2012 Canonical Ltd
+ * Copyright (C) 2012 Texas Instruments
+ *
+ * Authors:
+ * Rob Clark <robdclark@gmail.com>
+ * Maarten Lankhorst <maarten.lankhorst@canonical.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef __LINUX_FENCE_H
+#define __LINUX_FENCE_H
+
+#include <linux/err.h>
+#include <linux/wait.h>
+#include <linux/list.h>
+#include <linux/bitops.h>
+#include <linux/kref.h>
+#include <linux/sched.h>
+#include <linux/printk.h>
+#include <linux/rcupdate.h>
+
+struct fence;
+struct fence_ops;
+struct fence_cb;
+
+/**
+ * struct fence - software synchronization primitive
+ * @refcount: refcount for this fence
+ * @ops: fence_ops associated with this fence
+ * @rcu: used for releasing fence with kfree_rcu
+ * @cb_list: list of all callbacks to call
+ * @lock: spin_lock_irqsave used for locking
+ * @context: execution context this fence belongs to, returned by
+ *           fence_context_alloc()
+ * @seqno: the sequence number of this fence inside the execution context,
+ * can be compared to decide which fence would be signaled later.
+ * @flags: A mask of FENCE_FLAG_* defined below
+ * @timestamp: Timestamp when the fence was signaled.
+ * @status: Optional, only valid if < 0, must be set before calling
+ * fence_signal, indicates that the fence has completed with an error.
+ *
+ * the flags member must be manipulated and read using the appropriate
+ * atomic ops (bit_*), so taking the spinlock will not be needed most
+ * of the time.
+ *
+ * FENCE_FLAG_SIGNALED_BIT - fence is already signaled
+ * FENCE_FLAG_ENABLE_SIGNAL_BIT - enable_signaling might have been called*
+ * FENCE_FLAG_USER_BITS - start of the unused bits, can be used by the
+ * implementer of the fence for its own purposes. Can be used in different
+ * ways by different fence implementers, so do not rely on this.
+ *
+ * *) Since atomic bitops are used, this is not guaranteed to be the case.
+ * Particularly, if the bit was set, but fence_signal was called right
+ * before this bit was set, it would have been able to set the
+ * FENCE_FLAG_SIGNALED_BIT, before enable_signaling was called.
+ * Adding a check for FENCE_FLAG_SIGNALED_BIT after setting
+ * FENCE_FLAG_ENABLE_SIGNAL_BIT closes this race, and makes sure that
+ * after fence_signal was called, any enable_signaling call will have either
+ * been completed, or never called at all.
+ */
+struct fence {
+	struct kref refcount;
+	const struct fence_ops *ops;
+	struct rcu_head rcu;
+	struct list_head cb_list;
+	spinlock_t *lock;
+	unsigned context, seqno;
+	unsigned long flags;
+	ktime_t timestamp;
+	int status;
+};
+
+enum fence_flag_bits {
+	FENCE_FLAG_SIGNALED_BIT,
+	FENCE_FLAG_ENABLE_SIGNAL_BIT,
+	FENCE_FLAG_USER_BITS, /* must always be last member */
+};
+
+typedef void (*fence_func_t)(struct fence *fence, struct fence_cb *cb);
+
+/**
+ * struct fence_cb - callback for fence_add_callback
+ * @node: used by fence_add_callback to append this struct to fence::cb_list
+ * @func: fence_func_t to call
+ *
+ * This struct will be initialized by fence_add_callback, additional
+ * data can be passed along by embedding fence_cb in another struct.
+ */
+struct fence_cb {
+	struct list_head node;
+	fence_func_t func;
+};
+
+/**
+ * struct fence_ops - operations implemented for fence
+ * @get_driver_name: returns the driver name.
+ * @get_timeline_name: return the name of the context this fence belongs to.
+ * @enable_signaling: enable software signaling of fence.
+ * @signaled: [optional] peek whether the fence is signaled, can be null.
+ * @wait: custom wait implementation, or fence_default_wait.
+ * @release: [optional] called on destruction of fence, can be null
+ * @fill_driver_data: [optional] callback to fill in free-form debug info
+ * Returns amount of bytes filled, or -errno.
+ * @fence_value_str: [optional] fills in the value of the fence as a string
+ * @timeline_value_str: [optional] fills in the current value of the timeline
+ * as a string
+ *
+ * Notes on enable_signaling:
+ * For fence implementations that have the capability for hw->hw
+ * signaling, they can implement this op to enable the necessary
+ * irqs, or insert commands into cmdstream, etc.  This is called
+ * in the first wait() or add_callback() path to let the fence
+ * implementation know that there is another driver waiting on
+ * the signal (ie. hw->sw case).
+ *
+ * This function can be called called from atomic context, but not
+ * from irq context, so normal spinlocks can be used.
+ *
+ * A return value of false indicates the fence already passed,
+ * or some failure occurred that made it impossible to enable
+ * signaling. True indicates successful enabling.
+ *
+ * fence->status may be set in enable_signaling, but only when false is
+ * returned.
+ *
+ * Calling fence_signal before enable_signaling is called allows
+ * for a tiny race window in which enable_signaling is called during,
+ * before, or after fence_signal. To fight this, it is recommended
+ * that before enable_signaling returns true an extra reference is
+ * taken on the fence, to be released when the fence is signaled.
+ * This will mean fence_signal will still be called twice, but
+ * the second time will be a noop since it was already signaled.
+ *
+ * Notes on signaled:
+ * May set fence->status if returning true.
+ *
+ * Notes on wait:
+ * Must not be NULL, set to fence_default_wait for default implementation.
+ * the fence_default_wait implementation should work for any fence, as long
+ * as enable_signaling works correctly.
+ *
+ * Must return -ERESTARTSYS if the wait is intr = true and the wait was
+ * interrupted, and remaining jiffies if fence has signaled, or 0 if wait
+ * timed out. Can also return other error values on custom implementations,
+ * which should be treated as if the fence is signaled. For example a hardware
+ * lockup could be reported like that.
+ *
+ * Notes on release:
+ * Can be NULL, this function allows additional commands to run on
+ * destruction of the fence. Can be called from irq context.
+ * If pointer is set to NULL, kfree will get called instead.
+ */
+
+struct fence_ops {
+	const char * (*get_driver_name)(struct fence *fence);
+	const char * (*get_timeline_name)(struct fence *fence);
+	bool (*enable_signaling)(struct fence *fence);
+	bool (*signaled)(struct fence *fence);
+	signed long (*wait)(struct fence *fence, bool intr, signed long timeout);
+	void (*release)(struct fence *fence);
+
+	int (*fill_driver_data)(struct fence *fence, void *data, int size);
+	void (*fence_value_str)(struct fence *fence, char *str, int size);
+	void (*timeline_value_str)(struct fence *fence, char *str, int size);
+};
+
+void fence_init(struct fence *fence, const struct fence_ops *ops,
+		spinlock_t *lock, unsigned context, unsigned seqno);
+
+void fence_release(struct kref *kref);
+void fence_free(struct fence *fence);
+
+/**
+ * fence_get - increases refcount of the fence
+ * @fence:	[in]	fence to increase refcount of
+ *
+ * Returns the same fence, with refcount increased by 1.
+ */
+static inline struct fence *fence_get(struct fence *fence)
+{
+	if (fence)
+		kref_get(&fence->refcount);
+	return fence;
+}
+
+/**
+ * fence_get_rcu - get a fence from a reservation_object_list with rcu read lock
+ * @fence:	[in]	fence to increase refcount of
+ *
+ * Function returns NULL if no refcount could be obtained, or the fence.
+ */
+static inline struct fence *fence_get_rcu(struct fence *fence)
+{
+	if (kref_get_unless_zero(&fence->refcount))
+		return fence;
+	else
+		return NULL;
+}
+
+/**
+ * fence_put - decreases refcount of the fence
+ * @fence:	[in]	fence to reduce refcount of
+ */
+static inline void fence_put(struct fence *fence)
+{
+	if (fence)
+		kref_put(&fence->refcount, fence_release);
+}
+
+int fence_signal(struct fence *fence);
+int fence_signal_locked(struct fence *fence);
+signed long fence_default_wait(struct fence *fence, bool intr, signed long timeout);
+int fence_add_callback(struct fence *fence, struct fence_cb *cb,
+		       fence_func_t func);
+bool fence_remove_callback(struct fence *fence, struct fence_cb *cb);
+void fence_enable_sw_signaling(struct fence *fence);
+
+/**
+ * fence_is_signaled_locked - Return an indication if the fence is signaled yet.
+ * @fence:	[in]	the fence to check
+ *
+ * Returns true if the fence was already signaled, false if not. Since this
+ * function doesn't enable signaling, it is not guaranteed to ever return
+ * true if fence_add_callback, fence_wait or fence_enable_sw_signaling
+ * haven't been called before.
+ *
+ * This function requires fence->lock to be held.
+ */
+static inline bool
+fence_is_signaled_locked(struct fence *fence)
+{
+	if (test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->flags))
+		return true;
+
+	if (fence->ops->signaled && fence->ops->signaled(fence)) {
+		fence_signal_locked(fence);
+		return true;
+	}
+
+	return false;
+}
+
+/**
+ * fence_is_signaled - Return an indication if the fence is signaled yet.
+ * @fence:	[in]	the fence to check
+ *
+ * Returns true if the fence was already signaled, false if not. Since this
+ * function doesn't enable signaling, it is not guaranteed to ever return
+ * true if fence_add_callback, fence_wait or fence_enable_sw_signaling
+ * haven't been called before.
+ *
+ * It's recommended for seqno fences to call fence_signal when the
+ * operation is complete, it makes it possible to prevent issues from
+ * wraparound between time of issue and time of use by checking the return
+ * value of this function before calling hardware-specific wait instructions.
+ */
+static inline bool
+fence_is_signaled(struct fence *fence)
+{
+	if (test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->flags))
+		return true;
+
+	if (fence->ops->signaled && fence->ops->signaled(fence)) {
+		fence_signal(fence);
+		return true;
+	}
+
+	return false;
+}
+
+/**
+ * fence_is_later - return if f1 is chronologically later than f2
+ * @f1:	[in]	the first fence from the same context
+ * @f2:	[in]	the second fence from the same context
+ *
+ * Returns true if f1 is chronologically later than f2. Both fences must be
+ * from the same context, since a seqno is not re-used across contexts.
+ */
+static inline bool fence_is_later(struct fence *f1, struct fence *f2)
+{
+	if (WARN_ON(f1->context != f2->context))
+		return false;
+
+	return f1->seqno - f2->seqno < INT_MAX;
+}
+
+/**
+ * fence_later - return the chronologically later fence
+ * @f1:	[in]	the first fence from the same context
+ * @f2:	[in]	the second fence from the same context
+ *
+ * Returns NULL if both fences are signaled, otherwise the fence that would be
+ * signaled last. Both fences must be from the same context, since a seqno is
+ * not re-used across contexts.
+ */
+static inline struct fence *fence_later(struct fence *f1, struct fence *f2)
+{
+	if (WARN_ON(f1->context != f2->context))
+		return NULL;
+
+	/*
+	 * can't check just FENCE_FLAG_SIGNALED_BIT here, it may never have been
+	 * set if enable_signaling wasn't called, and enabling that here is
+	 * overkill.
+	 */
+	if (fence_is_later(f1, f2))
+		return fence_is_signaled(f1) ? NULL : f1;
+	else
+		return fence_is_signaled(f2) ? NULL : f2;
+}
+
+signed long fence_wait_timeout(struct fence *, bool intr, signed long timeout);
+signed long fence_wait_any_timeout(struct fence **fences, uint32_t count,
+				   bool intr, signed long timeout);
+
+/**
+ * fence_wait - sleep until the fence gets signaled
+ * @fence:	[in]	the fence to wait on
+ * @intr:	[in]	if true, do an interruptible wait
+ *
+ * This function will return -ERESTARTSYS if interrupted by a signal,
+ * or 0 if the fence was signaled. Other error values may be
+ * returned on custom implementations.
+ *
+ * Performs a synchronous wait on this fence. It is assumed the caller
+ * directly or indirectly holds a reference to the fence, otherwise the
+ * fence might be freed before return, resulting in undefined behavior.
+ */
+static inline signed long fence_wait(struct fence *fence, bool intr)
+{
+	signed long ret;
+
+	/* Since fence_wait_timeout cannot timeout with
+	 * MAX_SCHEDULE_TIMEOUT, only valid return values are
+	 * -ERESTARTSYS and MAX_SCHEDULE_TIMEOUT.
+	 */
+	ret = fence_wait_timeout(fence, intr, MAX_SCHEDULE_TIMEOUT);
+
+	return ret < 0 ? ret : 0;
+}
+
+unsigned fence_context_alloc(unsigned num);
+
+#define FENCE_TRACE(f, fmt, args...) \
+	do {								\
+		struct fence *__ff = (f);				\
+		if (config_enabled(CONFIG_FENCE_TRACE))			\
+			pr_info("f %u#%u: " fmt,			\
+				__ff->context, __ff->seqno, ##args);	\
+	} while (0)
+
+#define FENCE_WARN(f, fmt, args...) \
+	do {								\
+		struct fence *__ff = (f);				\
+		pr_warn("f %u#%u: " fmt, __ff->context, __ff->seqno,	\
+			 ##args);					\
+	} while (0)
+
+#define FENCE_ERR(f, fmt, args...) \
+	do {								\
+		struct fence *__ff = (f);				\
+		pr_err("f %u#%u: " fmt, __ff->context, __ff->seqno,	\
+			##args);					\
+	} while (0)
+
+#endif /* __LINUX_FENCE_H */
diff -ENwbur a/include/linux/mfd/axp228-cfg.h b/include/linux/mfd/axp228-cfg.h
--- a/include/linux/mfd/axp228-cfg.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/mfd/axp228-cfg.h	2018-05-06 08:49:51.862804329 +0200
@@ -0,0 +1,179 @@
+/*
+ * axp228-cfg.h  --  PMIC driver for the X-Powers AXP228
+ *
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongshin, Park <pjsin865@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __LINUX_AXP_CFG_H_
+#define __LINUX_AXP_CFG_H_
+
+/* i2c slave address */
+#define AXP_DEVICES_ADDR (0x68 >> 1)
+
+#define BATCAP 3000 /* CFG_BATTERY_CAP */
+
+#define BATRDC 137 /* 100 */
+
+#define AXP_VOL_MAX 1
+
+#define CHGEN 1
+
+#define STACHGCUR (1500 * 1000) /* AXP22:300~2550,100/step */
+#define EARCHGCUR (1500 * 1000) /* AXP22:300~2550,100/step */
+#define SUSCHGCUR (1500 * 1000) /* AXP22:300~2550,100/step */
+#define CLSCHGCUR (1500 * 1000) /* AXP22:300~2550,100/step */
+
+/* AC current charge */
+/*#define AC_CHARGE_CURRENT	1500*1000*/
+/* AC current limit */
+#define AC_LIMIT_CURRENT_1500 (1500 * 1000)
+#define AC_LIMIT_CURRENT_500 (500 * 1000)
+
+#define CHGVOL (4200 * 1000) /* AXP22:4100/4220/4200/4240 */
+
+#define ENDCHGRATE 10 /* AXP22:10\15 */
+
+#define SHUTDOWNVOL 2600
+
+#define ADCFREQ 100 /* AXP22:100\200\400\800 */
+
+#define CHGPRETIME 50 /* AXP22:40\50\60\70 */
+
+#define CHGCSTTIME 480 /* AXP22:360\480\600\720 */
+
+/* pok open time set */
+#define PEKOPEN 1000 /* AXP22:128/1000/2000/3000 */
+
+/* pok long time set*/
+#define PEKLONG 1500 /* AXP22:1000/1500/2000/2500 */
+
+/* pek offlevel poweroff en set*/
+#define PEKOFFEN 1
+
+/*Init offlevel restart or not */
+#define PEKOFFRESTART 0
+
+/* pek delay set */
+#define PEKDELAY 32 /* AXP20:8/16/32/64 */
+
+/*  pek offlevel time set */
+#define PEKOFF 6000 /* AXP22:4000/6000/8000/10000 */
+
+/* Init PMU Over Temperature protection*/
+#define OTPOFFEN 0
+
+#define USBVOLLIMEN 1
+
+#define USBVOLLIM 4700 /* AXP22:4000~4700£¬100/step */
+
+#define USBVOLLIMPC 4700 /* AXP22:4000~4700£¬100/step */
+
+#define USBCURLIMEN 0
+
+#define USBCURLIM 500 /* AXP22:500/900 */
+
+#define USBCURLIMPC 0 /* AXP22:500/900 */
+
+/* Init IRQ wakeup en*/
+#define IRQWAKEUP 0
+
+/* Init N_VBUSEN status*/
+#define VBUSEN 1
+
+/* Init InShort status*/
+#define VBUSACINSHORT 0
+
+/* Init CHGLED function*/
+#define CHGLEDFUN 1
+
+/* set CHGLED Indication Type*/
+#define CHGLEDTYPE 0
+
+/* Init battery capacity correct function*/
+#define BATCAPCORRENT 1
+
+/* Init battery regulator enable or not when charge finish*/
+#define BATREGUEN 0
+
+#define BATDET 1
+
+/* Init 16's Reset PMU en */
+#define PMURESET 0
+
+/* set lowe power warning level */
+#define BATLOWLV1 15 /* AXP22:5%~20% */
+
+/* set lowe power shutdown level */
+#define BATLOWLV2 0 /* AXP22:0%~15% */
+
+#define ABS(x) ((x) > 0 ? (x) : -(x))
+
+/*AXP GPIO start NUM, */
+#define AXP22_NR_BASE 100
+
+/*AXP GPIO NUM, LCD power VBUS driver pin*/
+#define AXP22_NR 5
+
+/*  AXP IRQ */
+#define AXP_IRQ_USBLO AXP22_IRQ_USBLO
+#define AXP_IRQ_USBRE AXP22_IRQ_USBRE
+#define AXP_IRQ_USBIN AXP22_IRQ_USBIN
+#define AXP_IRQ_USBOV AXP22_IRQ_USBOV
+#define AXP_IRQ_ACRE AXP22_IRQ_ACRE
+#define AXP_IRQ_ACIN AXP22_IRQ_ACIN
+#define AXP_IRQ_ACOV AXP22_IRQ_ACOV
+#define AXP_IRQ_TEMLO AXP22_IRQ_TEMLO
+#define AXP_IRQ_TEMOV AXP22_IRQ_TEMOV
+#define AXP_IRQ_CHAOV AXP22_IRQ_CHAOV
+#define AXP_IRQ_CHAST AXP22_IRQ_CHAST
+#define AXP_IRQ_BATATOU AXP22_IRQ_BATATOU
+#define AXP_IRQ_BATATIN AXP22_IRQ_BATATIN
+#define AXP_IRQ_BATRE AXP22_IRQ_BATRE
+#define AXP_IRQ_BATIN AXP22_IRQ_BATIN
+#define AXP_IRQ_PEKLO AXP22_IRQ_POKLO
+#define AXP_IRQ_PEKSH AXP22_IRQ_POKSH
+
+#define AXP_IRQ_CHACURLO AXP22_IRQ_CHACURLO
+#define AXP_IRQ_ICTEMOV AXP22_IRQ_ICTEMOV
+#define AXP_IRQ_EXTLOWARN2 AXP22_IRQ_EXTLOWARN2
+#define AXP_IRQ_EXTLOWARN1 AXP22_IRQ_EXTLOWARN1
+
+#define AXP_IRQ_GPIO0TG AXP22_IRQ_GPIO0TG
+#define AXP_IRQ_GPIO1TG AXP22_IRQ_GPIO1TG
+
+#define AXP_IRQ_PEKFE AXP22_IRQ_PEKFE
+#define AXP_IRQ_PEKRE AXP22_IRQ_PEKRE
+#define AXP_IRQ_TIMER AXP22_IRQ_TIMER
+
+static const uint64_t AXP22_NOTIFIER_ON =
+	(AXP_IRQ_USBIN | AXP_IRQ_USBRE |
+	AXP_IRQ_ACIN | AXP_IRQ_ACRE |
+	AXP_IRQ_BATIN | AXP_IRQ_BATRE |
+	AXP_IRQ_CHAST | AXP_IRQ_CHAOV |
+	AXP_IRQ_PEKLO | AXP_IRQ_PEKSH |
+	(uint64_t)AXP_IRQ_PEKFE |
+	(uint64_t)AXP_IRQ_PEKRE |
+	(uint64_t)AXP_IRQ_EXTLOWARN2 |
+	(uint64_t)AXP_IRQ_EXTLOWARN1);
+
+#define POWER_START 0
+
+/* debug log */
+/* #define ENABLE_DEBUG */
+/* #define DBG_AXP_PSY */
+
+#endif
diff -ENwbur a/include/linux/mfd/axp228-mfd.h b/include/linux/mfd/axp228-mfd.h
--- a/include/linux/mfd/axp228-mfd.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/mfd/axp228-mfd.h	2018-05-06 08:49:51.862804329 +0200
@@ -0,0 +1,307 @@
+/*
+ * axp228-mfd.h  --  PMIC driver for the X-Powers AXP228
+ *
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongshin, Park <pjsin865@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __LINUX_AXP_MFD_H_
+#define __LINUX_AXP_MFD_H_
+
+/*For AXP22*/
+#define AXP22 (22)
+#define AXP22_STATUS (0x00)
+#define AXP22_MODE_CHGSTATUS (0x01)
+#define AXP22_IC_TYPE (0x03)
+#define AXP22_BUFFER1 (0x04)
+#define AXP22_BUFFER2 (0x05)
+#define AXP22_BUFFER3 (0x06)
+#define AXP22_BUFFER4 (0x07)
+#define AXP22_BUFFER5 (0x08)
+#define AXP22_BUFFER6 (0x09)
+#define AXP22_BUFFER7 (0x0A)
+#define AXP22_BUFFER8 (0x0B)
+#define AXP22_BUFFER9 (0x0C)
+#define AXP22_BUFFERA (0x0D)
+#define AXP22_BUFFERB (0x0E)
+#define AXP22_BUFFERC (0x0F)
+#define AXP22_IPS_SET (0x30)
+#define AXP22_VOFF_SET (0x31)
+#define AXP22_OFF_CTL (0x32)
+#define AXP22_CHARGE1 (0x33)
+#define AXP22_CHARGE2 (0x34)
+#define AXP22_CHARGE3 (0x35)
+#define AXP22_POK_SET (0x36)
+#define AXP22_INTEN1 (0x40)
+#define AXP22_INTEN2 (0x41)
+#define AXP22_INTEN3 (0x42)
+#define AXP22_INTEN4 (0x43)
+#define AXP22_INTEN5 (0x44)
+#define AXP22_INTSTS1 (0x48)
+#define AXP22_INTSTS2 (0x49)
+#define AXP22_INTSTS3 (0x4A)
+#define AXP22_INTSTS4 (0x4B)
+#define AXP22_INTSTS5 (0x4C)
+
+#define AXP22_LDO_DC_EN1 (0X10)
+#define AXP22_LDO_DC_EN2 (0X12)
+#define AXP22_LDO_DC_EN3 (0X13)
+#define AXP22_DLDO1OUT_VOL (0x15)
+#define AXP22_DLDO2OUT_VOL (0x16)
+#define AXP22_DLDO3OUT_VOL (0x17)
+#define AXP22_DLDO4OUT_VOL (0x18)
+#define AXP22_ELDO1OUT_VOL (0x19)
+#define AXP22_ELDO2OUT_VOL (0x1A)
+#define AXP22_ELDO3OUT_VOL (0x1B)
+#define AXP22_DC5LDOOUT_VOL (0x1C)
+#define AXP22_DC1OUT_VOL (0x21)
+#define AXP22_DC2OUT_VOL (0x22)
+#define AXP22_DC3OUT_VOL (0x23)
+#define AXP22_DC4OUT_VOL (0x24)
+#define AXP22_DC5OUT_VOL (0x25)
+#define AXP22_GPIO0LDOOUT_VOL (0x91)
+#define AXP22_GPIO1LDOOUT_VOL (0x93)
+#define AXP22_ALDO1OUT_VOL (0x28)
+#define AXP22_ALDO2OUT_VOL (0x29)
+#define AXP22_ALDO3OUT_VOL (0x2A)
+
+#define AXP22_DCDC_MODESET (0x80)
+#define AXP22_DCDC_FREQSET (0x37)
+#define AXP22_ADC_EN (0x82)
+#define AXP22_PWREN_CTL1 (0x8C)
+#define AXP22_PWREN_CTL2 (0x8D)
+#define AXP22_HOTOVER_CTL (0x8F)
+
+#define AXP22_GPIO0_CTL (0x90)
+#define AXP22_GPIO1_CTL (0x92)
+#define AXP22_GPIO01_SIGNAL (0x94)
+#define AXP22_BAT_CHGCOULOMB3 (0xB0)
+#define AXP22_BAT_CHGCOULOMB2 (0xB1)
+#define AXP22_BAT_CHGCOULOMB1 (0xB2)
+#define AXP22_BAT_CHGCOULOMB0 (0xB3)
+#define AXP22_BAT_DISCHGCOULOMB3 (0xB4)
+#define AXP22_BAT_DISCHGCOULOMB2 (0xB5)
+#define AXP22_BAT_DISCHGCOULOMB1 (0xB6)
+#define AXP22_BAT_DISCHGCOULOMB0 (0xB7)
+#define AXP22_COULOMB_CTL (0xB8)
+
+/* bit definitions for AXP events ,irq event */
+/*  AXP22  */
+#define AXP22_IRQ_USBLO (1 << 1)
+#define AXP22_IRQ_USBRE (1 << 2)
+#define AXP22_IRQ_USBIN (1 << 3)
+#define AXP22_IRQ_USBOV (1 << 4)
+#define AXP22_IRQ_ACRE (1 << 5)
+#define AXP22_IRQ_ACIN (1 << 6)
+#define AXP22_IRQ_ACOV (1 << 7)
+#define AXP22_IRQ_TEMLO (1 << 8)
+#define AXP22_IRQ_TEMOV (1 << 9)
+#define AXP22_IRQ_CHAOV (1 << 10)
+#define AXP22_IRQ_CHAST (1 << 11)
+#define AXP22_IRQ_BATATOU (1 << 12)
+#define AXP22_IRQ_BATATIN (1 << 13)
+#define AXP22_IRQ_BATRE (1 << 14)
+#define AXP22_IRQ_BATIN (1 << 15)
+#define AXP22_IRQ_POKLO (1 << 16)
+#define AXP22_IRQ_POKSH (1 << 17)
+#define AXP22_IRQ_CHACURLO (1 << 22)
+#define AXP22_IRQ_ICTEMOV (1 << 23)
+#define AXP22_IRQ_EXTLOWARN2 (1 << 24)
+#define AXP22_IRQ_EXTLOWARN1 (1 << 25)
+#define AXP22_IRQ_GPIO0TG ((uint64_t)1 << 32)
+#define AXP22_IRQ_GPIO1TG ((uint64_t)1 << 33)
+#define AXP22_IRQ_GPIO2TG ((uint64_t)1 << 34)
+#define AXP22_IRQ_GPIO3TG ((uint64_t)1 << 35)
+
+#define AXP22_IRQ_PEKFE ((uint64_t)1 << 37)
+#define AXP22_IRQ_PEKRE ((uint64_t)1 << 38)
+#define AXP22_IRQ_TIMER ((uint64_t)1 << 39)
+
+/* Status Query Interface */
+/*  AXP22  */
+#define AXP22_STATUS_SOURCE (1 << 0)
+#define AXP22_STATUS_ACUSBSH (1 << 1)
+#define AXP22_STATUS_BATCURDIR (1 << 2)
+#define AXP22_STATUS_USBLAVHO (1 << 3)
+#define AXP22_STATUS_USBVA (1 << 4)
+#define AXP22_STATUS_USBEN (1 << 5)
+#define AXP22_STATUS_ACVA (1 << 6)
+#define AXP22_STATUS_ACEN (1 << 7)
+
+#define AXP22_STATUS_BATINACT (1 << 11)
+
+#define AXP22_STATUS_BATEN (1 << 13)
+#define AXP22_STATUS_INCHAR (1 << 14)
+#define AXP22_STATUS_ICTEMOV (1 << 15)
+
+#define AXP22_DCDC1_MIN 1600000
+#define AXP22_DCDC1_MAX 3400000
+#define AXP22_DCDC2_MIN 600000
+#define AXP22_DCDC2_MAX 1540000
+#define AXP22_DCDC3_MIN 600000
+#define AXP22_DCDC3_MAX 1860000
+#define AXP22_DCDC4_MIN 600000
+#define AXP22_DCDC4_MAX 1540000
+#define AXP22_DCDC5_MIN 1000000
+#define AXP22_DCDC5_MAX 2550000
+
+#define AXP22_LDO1_MIN 3000000
+#define AXP22_LDO1_MAX 3000000
+#define AXP22_LDO2_MIN 700000
+#define AXP22_LDO2_MAX 3300000
+#define AXP22_LDO3_MIN 700000
+#define AXP22_LDO3_MAX 3300000
+#define AXP22_LDO4_MIN 700000
+#define AXP22_LDO4_MAX 3300000
+#define AXP22_LDO5_MIN 700000
+#define AXP22_LDO5_MAX 3300000
+#define AXP22_LDO6_MIN 700000
+#define AXP22_LDO6_MAX 3300000
+#define AXP22_LDO7_MIN 700000
+#define AXP22_LDO7_MAX 3300000
+#define AXP22_LDO8_MIN 700000
+#define AXP22_LDO8_MAX 3300000
+#define AXP22_LDO9_MIN 700000
+#define AXP22_LDO9_MAX 3300000
+#define AXP22_LDO10_MIN 700000
+#define AXP22_LDO10_MAX 3300000
+#define AXP22_LDO11_MIN 700000
+#define AXP22_LDO11_MAX 3300000
+#define AXP22_LDO12_MIN 700000
+#define AXP22_LDO12_MAX 1400000
+
+#define AXP22_LDOIO0_MIN 700000
+#define AXP22_LDOIO0_MAX 3300000
+#define AXP22_LDOIO1_MIN 700000
+#define AXP22_LDOIO1_MAX 3300000
+
+/* Unified sub device IDs for AXP */
+/* LDO0 For RTCLDO ,LDO1-3 for ALDO,LDO*/
+enum {
+	AXP22_ID_LDO1,  /* RTCLDO */
+	AXP22_ID_LDO2,  /* ALDO1 */
+	AXP22_ID_LDO3,  /* ALDO2 */
+	AXP22_ID_LDO4,  /* ALDO3 */
+	AXP22_ID_LDO5,  /* DLDO1 */
+	AXP22_ID_LDO6,  /* DLDO2 */
+	AXP22_ID_LDO7,  /* DLDO3 */
+	AXP22_ID_LDO8,  /* DLDO4 */
+	AXP22_ID_LDO9,  /* ELDO1 */
+	AXP22_ID_LDO10, /* ELDO2 */
+	AXP22_ID_LDO11, /* ELDO3 */
+	AXP22_ID_LDO12, /* DC5LDO */
+	AXP22_ID_DCDC1,
+	AXP22_ID_DCDC2,
+	AXP22_ID_DCDC3,
+	AXP22_ID_DCDC4,
+	AXP22_ID_DCDC5,
+	AXP22_ID_LDOIO0,
+	AXP22_ID_LDOIO1,
+	AXP22_ID_SUPPLY,
+	AXP22_ID_GPIO,
+};
+
+#define AXP_MFD_ATTR(_name)			\
+{									\
+	.attr = { .name = #_name, .mode = 0644 },	\
+	.show = _name##_show,			\
+	.store = _name##_store,			\
+}
+
+/* AXP battery charger data */
+struct power_supply_info;
+
+struct axp_supply_init_data {
+	/* battery parameters */
+	struct power_supply_info *battery_info;
+
+	/* current and voltage to use for battery charging */
+	unsigned int chgcur;
+	unsigned int chgvol;
+	unsigned int chgend;
+	/*charger control*/
+	bool chgen;
+	bool limit_on;
+	/*charger time */
+	int chgpretime;
+	int chgcsttime;
+
+	/*adc sample time */
+	unsigned int sample_time;
+
+	/* platform callbacks for battery low and critical IRQs */
+	void (*battery_low)(void);
+	void (*battery_critical)(void);
+};
+
+struct axp_funcdev_info {
+	struct device_node *reg_node;
+	int id;
+	const char *name;
+	void *platform_data;
+};
+
+struct axp_platform_data {
+	int id;
+	int num_regl_devs;
+	int num_sply_devs;
+	int num_gpio_devs;
+	int gpio_base;
+	struct axp_funcdev_info *regl_devs;
+	struct axp_funcdev_info *sply_devs;
+	struct axp_funcdev_info *gpio_devs;
+};
+
+struct axp_mfd_chip {
+	struct device *dev;
+	struct i2c_client *client;
+	struct mutex lock;
+	struct work_struct irq_work;
+	struct blocking_notifier_head notifier_list;
+
+	struct axp_mfd_chip_ops *ops;
+	struct axp_platform_data *pdata;
+
+	int irq;
+	int type;
+	uint64_t irqs_enabled;
+};
+
+struct axp_mfd_chip_ops {
+	int (*init_chip)(struct axp_mfd_chip *);
+	int (*enable_irqs)(struct axp_mfd_chip *, uint64_t irqs);
+	int (*disable_irqs)(struct axp_mfd_chip *, uint64_t irqs);
+	int (*read_irqs)(struct axp_mfd_chip *, uint64_t *irqs);
+};
+
+extern struct device *axp_get_dev(void);
+extern int axp_register_notifier(struct device *dev, struct notifier_block *nb,
+				 uint64_t irqs);
+extern int axp_unregister_notifier(struct device *dev,
+				   struct notifier_block *nb, uint64_t irqs);
+
+/* NOTE: the functions below are not intended for use outside
+ * of the AXP sub-device drivers
+ */
+extern int axp_write(struct device *dev, int reg, uint8_t val);
+extern int axp_writes(struct device *dev, int reg, int len, uint8_t *val);
+extern int axp_read(struct device *dev, int reg, uint8_t *val);
+extern int axp_reads(struct device *dev, int reg, int len, uint8_t *val);
+extern int axp_update(struct device *dev, int reg, uint8_t val, uint8_t mask);
+extern int axp_set_bits(struct device *dev, int reg, uint8_t bit_mask);
+extern int axp_clr_bits(struct device *dev, int reg, uint8_t bit_mask);
+extern struct i2c_client *axp;
+#endif /* __LINUX_PMIC_AXP_H */
diff -ENwbur a/include/linux/pm_qos.h b/include/linux/pm_qos.h
--- a/include/linux/pm_qos.h	2018-05-06 08:47:39.025412983 +0200
+++ b/include/linux/pm_qos.h	2018-05-06 08:49:51.902805952 +0200
@@ -16,6 +16,11 @@
 	PM_QOS_NETWORK_LATENCY,
 	PM_QOS_NETWORK_THROUGHPUT,
 	PM_QOS_MEMORY_BANDWIDTH,
+	PM_QOS_BUS_THROUGHPUT,
+	PM_QOS_CPU_ONLINE_MIN,
+	PM_QOS_CPU_ONLINE_MAX,
+	PM_QOS_CPU_FREQ_MIN,
+	PM_QOS_CPU_FREQ_MAX,

 	/* insert new class ID */
 	PM_QOS_NUM_CLASSES,
@@ -34,10 +39,15 @@
 #define PM_QOS_NETWORK_LAT_DEFAULT_VALUE	(2000 * USEC_PER_SEC)
 #define PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE	0
 #define PM_QOS_MEMORY_BANDWIDTH_DEFAULT_VALUE	0
+#define PM_QOS_BUS_THROUGHPUT_DEFAULT_VALUE	0
 #define PM_QOS_RESUME_LATENCY_DEFAULT_VALUE	0
 #define PM_QOS_LATENCY_TOLERANCE_DEFAULT_VALUE	0
 #define PM_QOS_LATENCY_TOLERANCE_NO_CONSTRAINT	(-1)
 #define PM_QOS_LATENCY_ANY			((s32)(~(__u32)0 >> 1))
+#define PM_QOS_CPU_ONLINE_MIN_DEFAULT_VALUE	-1
+#define PM_QOS_CPU_ONLINE_MAX_DEFAULT_VALUE	-1
+#define PM_QOS_CPU_FREQ_MIN_DEFAULT_VALUE	0
+#define PM_QOS_CPU_FREQ_MAX_DEFAULT_VALUE	INT_MAX

 #define PM_QOS_FLAG_NO_POWER_OFF	(1 << 0)
 #define PM_QOS_FLAG_REMOTE_WAKEUP	(1 << 1)
diff -ENwbur a/include/linux/regulator/axp228-regu.h b/include/linux/regulator/axp228-regu.h
--- a/include/linux/regulator/axp228-regu.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/regulator/axp228-regu.h	2018-05-06 08:49:51.910806277 +0200
@@ -0,0 +1,197 @@
+/*
+ * axp228-regu.h  --  PMIC driver for the X-Powers AXP228
+ *
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongshin, Park <pjsin865@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _LINUX_AXP_REGU_H_
+#define _LINUX_AXP_REGU_H_
+
+/* AXP22 Regulator Registers */
+#define AXP22_LDO1 AXP22_STATUS
+#define AXP22_LDO5 AXP22_DLDO1OUT_VOL
+#define AXP22_LDO6 AXP22_DLDO2OUT_VOL
+#define AXP22_LDO7 AXP22_DLDO3OUT_VOL
+#define AXP22_LDO8 AXP22_DLDO4OUT_VOL
+#define AXP22_LDO9 AXP22_ELDO1OUT_VOL
+#define AXP22_LDO10 AXP22_ELDO2OUT_VOL
+#define AXP22_LDO11 AXP22_ELDO3OUT_VOL
+#define AXP22_LDO12 AXP22_DC5LDOOUT_VOL
+#define AXP22_DCDC1 AXP22_DC1OUT_VOL
+#define AXP22_DCDC2 AXP22_DC2OUT_VOL
+#define AXP22_DCDC3 AXP22_DC3OUT_VOL
+#define AXP22_DCDC4 AXP22_DC4OUT_VOL
+#define AXP22_DCDC5 AXP22_DC5OUT_VOL
+
+#define AXP22_LDOIO0 AXP22_GPIO0LDOOUT_VOL
+#define AXP22_LDOIO1 AXP22_GPIO1LDOOUT_VOL
+#define AXP22_LDO2 AXP22_ALDO1OUT_VOL
+#define AXP22_LDO3 AXP22_ALDO2OUT_VOL
+#define AXP22_LDO4 AXP22_ALDO3OUT_VOL
+
+#define AXP22_LDO1EN AXP22_STATUS
+#define AXP22_LDO2EN AXP22_LDO_DC_EN1
+#define AXP22_LDO3EN AXP22_LDO_DC_EN1
+#define AXP22_LDO4EN AXP22_LDO_DC_EN3
+#define AXP22_LDO5EN AXP22_LDO_DC_EN2
+#define AXP22_LDO6EN AXP22_LDO_DC_EN2
+#define AXP22_LDO7EN AXP22_LDO_DC_EN2
+#define AXP22_LDO8EN AXP22_LDO_DC_EN2
+#define AXP22_LDO9EN AXP22_LDO_DC_EN2
+#define AXP22_LDO10EN AXP22_LDO_DC_EN2
+#define AXP22_LDO11EN AXP22_LDO_DC_EN2
+#define AXP22_LDO12EN AXP22_LDO_DC_EN1
+#define AXP22_DCDC1EN AXP22_LDO_DC_EN1
+#define AXP22_DCDC2EN AXP22_LDO_DC_EN1
+#define AXP22_DCDC3EN AXP22_LDO_DC_EN1
+#define AXP22_DCDC4EN AXP22_LDO_DC_EN1
+#define AXP22_DCDC5EN AXP22_LDO_DC_EN1
+#define AXP22_LDOIO0EN AXP22_GPIO0_CTL
+#define AXP22_LDOIO1EN AXP22_GPIO1_CTL
+#define AXP22_DC1SW1EN AXP22_LDO_DC_EN2
+
+#define AXP22_BUCKMODE AXP22_DCDC_MODESET
+#define AXP22_BUCKFREQ AXP22_DCDC_FREQSET
+
+#define AXP22_PWREN_CONTROL1 AXP22_PWREN_CTL1
+#define AXP_DCDC1_BIT (7)
+#define AXP_DCDC2_BIT (6)
+#define AXP_DCDC3_BIT (5)
+#define AXP_DCDC4_BIT (4)
+#define AXP_DCDC5_BIT (3)
+#define AXP_ALDO1_BIT (2)
+#define AXP_ALDO2_BIT (1)
+#define AXP_ALDO3_BIT (0)
+
+#define AXP22_PWREN_CONTROL2 AXP22_PWREN_CTL2
+#define AXP_DLDO1_BIT (7)
+#define AXP_DLDO2_BIT (6)
+#define AXP_DLDO3_BIT (5)
+#define AXP_DLDO4_BIT (4)
+#define AXP_ELDO1_BIT (3)
+#define AXP_ELDO2_BIT (2)
+#define AXP_ELDO3_BIT (1)
+#define AXP_DC5LDO_BIT (0)
+
+#define AXP_LDO(_pmic, _id, min, max, step, vreg, shift,\
+			nbits, ereg, ebit, vrc_ramp)	\
+{	\
+	.desc = {	\
+		.name = #_pmic"_LDO" #_id,	\
+		.type = REGULATOR_VOLTAGE,	\
+		.id = _pmic##_ID_LDO##_id,	\
+		.n_voltages = (step) ? ((max - min) / step + 1) : 1,\
+		.owner = THIS_MODULE,	\
+	},	\
+	.min_uV = (min) * 1000,	\
+	.max_uV = (max) * 1000,	\
+	.step_uV = (step) * 1000,	\
+	.vol_reg = _pmic##_##vreg,	\
+	.vol_shift = (shift),	\
+	.vol_nbits = (nbits),	\
+	.enable_reg = _pmic##_##ereg,	\
+	.enable_bit = (ebit),	\
+	.vrc_ramp_delay = (vrc_ramp),	\
+}
+
+#define AXP_BUCK(_pmic, _id, min, max, step, vreg, shift,\
+			nbits, ereg, ebit, vrc_ramp)	\
+{	\
+	.desc = {	\
+		.name = #_pmic"_BUCK" #_id,	\
+		.type = REGULATOR_VOLTAGE,	\
+		.id = _pmic##_ID_BUCK##_id,	\
+		.n_voltages = (step) ? ((max - min) / step + 1) : 1,\
+		.owner	= THIS_MODULE,	\
+	},	\
+	.min_uV = (min) * 1000,	\
+	.max_uV = (max) * 1000,	\
+	.step_uV = (step) * 1000,	\
+	.vol_reg = _pmic##_##vreg,	\
+	.vol_shift = (shift),	\
+	.vol_nbits = (nbits),	\
+	.enable_reg = _pmic##_##ereg,	\
+	.enable_bit = (ebit),	\
+	.vrc_ramp_delay = (vrc_ramp),	\
+}
+
+#define AXP_DCDC(_pmic, _id, min, max, step, vreg, shift,\
+			nbits, ereg, ebit, vrc_ramp)	\
+{	\
+	.desc = {	\
+		.name = #_pmic"_DCDC" #_id,	\
+		.type = REGULATOR_VOLTAGE,	\
+		.id = _pmic##_ID_DCDC##_id,	\
+		.n_voltages = (step) ? ((max - min) / step + 1) : 1,\
+		.owner = THIS_MODULE,	\
+	},	\
+	.min_uV = (min) * 1000,	\
+	.max_uV = (max) * 1000,	\
+	.step_uV = (step) * 1000,	\
+	.vol_reg = _pmic##_##vreg,	\
+	.vol_shift = (shift),	\
+	.vol_nbits = (nbits),	\
+	.enable_reg = _pmic##_##ereg,	\
+	.enable_bit = (ebit),	\
+	.vrc_ramp_delay = (vrc_ramp),	\
+}
+
+#define AXP_SW(_pmic, _id, min, max, step, vreg, shift,\
+			nbits, ereg, ebit, vrc_ramp)	\
+{	\
+	.desc = {	\
+		.name = #_pmic"_SW" #_id,	\
+		.type = REGULATOR_VOLTAGE,	\
+		.id = _pmic##_ID_SW##_id,	\
+		.n_voltages = (step) ? ((max - min) / step + 1) : 1,\
+		.owner = THIS_MODULE,	\
+	},	\
+	.min_uV = (min) * 1000,	\
+	.max_uV = (max) * 1000,	\
+	.step_uV = (step) * 1000,	\
+	.vol_reg = _pmic##_##vreg,	\
+	.vol_shift = (shift),	\
+	.vol_nbits = (nbits),	\
+	.enable_reg = _pmic##_##ereg,	\
+	.enable_bit = (ebit),	\
+	.vrc_ramp_delay = (vrc_ramp),	\
+}
+
+#define AXP_REGU_ATTR(_name)	\
+{	\
+	.attr = { .name = #_name, .mode = 0644 },\
+	.show = _name##_show,	\
+	.store = _name##_store,	\
+}
+
+struct axp_regulator_info {
+	struct regulator_dev *rdev;
+	struct regulator_desc desc;
+
+	int min_uV;
+	int max_uV;
+	int step_uV;
+	int vol_reg;
+	int vol_shift;
+	int vol_nbits;
+	int enable_reg;
+	int enable_bit;
+	u16 vrc_ramp_delay;
+	u8 vout_reg_cache;
+};
+
+#endif
diff -ENwbur a/include/linux/soc/nexell/cpufreq.h b/include/linux/soc/nexell/cpufreq.h
--- a/include/linux/soc/nexell/cpufreq.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/soc/nexell/cpufreq.h	2018-05-06 08:49:51.922806763 +0200
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ARCH_CPUFREQ_H__
+#define __ARCH_CPUFREQ_H__
+
+/*
+ *    CPU Freq platform data
+ */
+struct nxp_cpufreq_plat_data {
+	int pll_dev;                    /* core pll : 0, 1, 2, 3 */
+	unsigned long (*dvfs_table)[2]; /* [freq KHz].[u volt] */
+	int  table_size;
+	char *supply_name;		/* voltage regulator name */
+	long supply_delay_us;
+};
+
+int nx_change_bus_freq(u32 pll_data);
+
+/* BUS CLOCK */
+#define NX_BUS_CLK_HIGH_KHZ     400000
+#define NX_BUS_CLK_MID_KHZ      150000
+#define NX_BUS_CLK_LOW_KHZ      100000
+
+/* defines for per IP */
+#define NX_BUS_CLK_GPU_KHZ	NX_BUS_CLK_HIGH_KHZ
+#define NX_BUS_CLK_VPU_KHZ	NX_BUS_CLK_HIGH_KHZ
+#define NX_BUS_CLK_MMC_KHZ	NX_BUS_CLK_HIGH_KHZ
+#define NX_BUS_CLK_SPI_KHZ	NX_BUS_CLK_HIGH_KHZ
+#define NX_BUS_CLK_VIP_KHZ	NX_BUS_CLK_MID_KHZ
+
+#if defined(CONFIG_ARCH_S5P4418)
+#define NX_BUS_CLK_DISP_KHZ	NX_BUS_CLK_HIGH_KHZ
+#define NX_BUS_CLK_AUDIO_KHZ	NX_BUS_CLK_HIGH_KHZ
+#else
+#define NX_BUS_CLK_DISP_KHZ	NX_BUS_CLK_MID_KHZ
+#define NX_BUS_CLK_AUDIO_KHZ	NX_BUS_CLK_MID_KHZ
+#endif
+#define NX_BUS_CLK_IDLE_KHZ	NX_BUS_CLK_LOW_KHZ
+
+
+void nx_bus_qos_update(int val);
+int  nx_bus_add_notifier(void *data);
+void nx_bus_remove_notifier(void *data);
+
+#endif
diff -ENwbur a/include/linux/soc/nexell/nx-media-device.h b/include/linux/soc/nexell/nx-media-device.h
--- a/include/linux/soc/nexell/nx-media-device.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/soc/nexell/nx-media-device.h	2018-05-06 08:49:51.922806763 +0200
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Sungwoo, Park <swpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _NX_MEDIA_DEVICE_H
+#define _NX_MEDIA_DEVICE_H
+
+enum {
+	NX_CAPTURE_START = 6,
+	NX_VPU_START = 14,
+	NX_RENDER_START = 22,
+};
+
+#endif
diff -ENwbur a/include/linux/soc/nexell/sec_reg.h b/include/linux/soc/nexell/sec_reg.h
--- a/include/linux/soc/nexell/sec_reg.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/linux/soc/nexell/sec_reg.h	2018-05-06 08:49:51.922806763 +0200
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Youngbok, Park <ybpark@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef CONFIG_SECURE_REG_ACCESS
+void write_sec_reg(void __iomem *reg, int val);
+int read_sec_reg(void __iomem *reg);
+#endif
+
diff -ENwbur a/include/linux/stmmac.h b/include/linux/stmmac.h
--- a/include/linux/stmmac.h	2018-05-06 08:47:39.045413795 +0200
+++ b/include/linux/stmmac.h	2018-05-06 08:49:51.926806925 +0200
@@ -144,6 +144,8 @@
 	u32 prio;
 };

+struct ethtool_wolinfo;
+
 struct plat_stmmacenet_data {
 	int bus_id;
 	int phy_addr;
@@ -190,5 +192,7 @@
 	bool tso_en;
 	int mac_port_sel_speed;
 	bool en_tx_lpi_clockgating;
+	void (*get_wol)(struct net_device *, struct ethtool_wolinfo *);
+	int (*set_wol)(struct net_device *, struct ethtool_wolinfo *);
 };
 #endif
diff -ENwbur a/include/soc/nexell/panel-nanopi.h b/include/soc/nexell/panel-nanopi.h
--- a/include/soc/nexell/panel-nanopi.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/soc/nexell/panel-nanopi.h	2018-05-06 08:49:51.974808873 +0200
@@ -0,0 +1,33 @@
+#ifndef _PANEL_NANOPI_H
+#define _PANEL_NANOPI_H
+
+struct nanopi_panel_desc {
+	char name[8];
+	const char *i2c_touch_drv;	// touch sensor driver name for i2c bus
+	int  i2c_touch_reg;			// i2c address of touch sensor
+	unsigned onewireType;		// id reported by onewire channel
+	unsigned bpc;				// max bits per color
+	unsigned p_width;			// physical width, in millimeters
+	unsigned p_height;			// physical height
+	const struct drm_display_mode *mode;
+};
+
+
+/* returns type ID reported by panel on onewire bus
+ */
+int onewire_get_lcd_type(void);
+
+
+/* Returns RGB panel currently connected, NULL when none
+ */
+const struct nanopi_panel_desc *nanopi_panelrgb_get_connected(void);
+
+
+/* Returns true when touch sensor connected to RGB panel should be
+ * handled by onewire protocol.
+ *
+ * onewireType parameter is the type reported by panel on onewire bus.
+ */
+bool nanopi_panelrgb_issensor_1wire(int onewireType);
+
+#endif // _PANEL_NANOPI_H
diff -ENwbur a/include/soc/nexell/tieoff.h b/include/soc/nexell/tieoff.h
--- a/include/soc/nexell/tieoff.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/soc/nexell/tieoff.h	2018-05-06 08:49:51.974808873 +0200
@@ -0,0 +1,16 @@
+/*
+ * Header file for the Nexell tieoff control
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef __SOC_NEXELL_TIEOFF_H__
+#define __SOC_NEXELL_TIEOFF_H__
+
+void nx_tieoff_set(u32 tieoff_index, u32 tieoff_value);
+u32 nx_tieoff_get(u32 tieoff_index);
+
+#endif /* __SOC_NEXELL_TIEOFF_H__ */
diff -ENwbur a/include/uapi/drm/nexell_drm.h b/include/uapi/drm/nexell_drm.h
--- a/include/uapi/drm/nexell_drm.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/uapi/drm/nexell_drm.h	2018-05-06 08:49:51.990809523 +0200
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: junghyun, kim <jhkim@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _UAPI_NX_DRM_H_
+#define _UAPI_NX_DRM_H_
+
+#include <drm/drm.h>
+
+/**
+ * User-desired buffer creation information structure.
+ *
+ * @size: user-desired memory allocation size.
+ *	- this size value would be page-aligned internally.
+ * @flags: user request for setting memory type or cache attributes.
+ * @handle: returned a handle to created gem object.
+ *	- this handle will be set by gem module of kernel side.
+ */
+struct nx_gem_create {
+	uint64_t size;
+	unsigned int flags;
+	unsigned int handle;
+	void *priv_data;
+};
+
+/**
+ * A structure to gem information.
+ *
+ * @handle: a handle to gem object created.
+ * @flags: flag value including memory type and cache attribute and
+ *	this value would be set by driver.
+ * @size: size to memory region allocated by gem and this size would
+ *	be set by driver.
+ */
+struct nx_gem_info {
+	unsigned int handle;
+	unsigned int flags;
+	uint64_t size;
+};
+
+/*
+ * nexell gem memory type
+ */
+enum nx_gem_type {
+	/*
+	 * DMA continuous memory
+	 * user   : non-cacheable
+	 * kernel : non-cacheable
+	 */
+	NEXELL_BO_DMA,
+
+	/*
+	 * DMA continuous memory, allocate from DMA,
+	 * user   : cacheable
+	 * kernel : non-cacheable
+	 */
+	NEXELL_BO_DMA_CACHEABLE,
+
+	/*
+	 * System continuous memory, allocate from system
+	 * user   : non-cacheable
+	 * kernel : non-cacheable
+	 */
+	NEXELL_BO_SYSTEM,
+
+	/*
+	 * System continuous memory, allocate from system
+	 * user   : cacheable
+	 * kernel : cacheable
+	 */
+	NEXELL_BO_SYSTEM_CACHEABLE,
+
+	/*
+	 * System non-continuous memory, allocate from system
+	 * user   : non-cacheable
+	 * kernel : non-cacheable
+	 */
+	NEXELL_BO_SYSTEM_NONCONTIG,
+
+	/*
+	 * System non-continuous memory, allocate from system
+	 * user   : cacheable
+	 * kernel : cacheable
+	 */
+	NEXELL_BO_SYSTEM_NONCONTIG_CACHEABLE,
+
+	NEXELL_BO_MAX,
+};
+
+/*
+ * nexell private ioctl
+ */
+#define DRM_NX_GEM_CREATE		0x00
+/* Reserved 0x03 ~ 0x05 for nx specific gem ioctl */
+#define DRM_NX_GEM_GET			0x04
+#define DRM_NX_GEM_SYNC			0x05
+
+#define DRM_IOCTL_NX_GEM_CREATE	DRM_IOWR(DRM_COMMAND_BASE + \
+		DRM_NX_GEM_CREATE, struct nx_gem_create)
+
+#define DRM_IOCTL_NX_GEM_SYNC	DRM_IOWR(DRM_COMMAND_BASE + \
+		DRM_NX_GEM_SYNC, struct nx_gem_create)
+
+#define DRM_IOCTL_NX_GEM_GET	DRM_IOWR(DRM_COMMAND_BASE + \
+		DRM_NX_GEM_GET,	struct nx_gem_info)
+
+#endif
diff -ENwbur a/include/uapi/linux/nx-scaler.h b/include/uapi/linux/nx-scaler.h
--- a/include/uapi/linux/nx-scaler.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/uapi/linux/nx-scaler.h	2018-05-06 08:49:52.014810496 +0200
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Jongkeun, Choi <jkchoi@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __UAPI_NX_SCALER_H
+#define __UAPI_NX_SCALER_H
+
+#include <linux/ioctl.h>
+
+#define	IOC_NX_MAGIC	0x6e78	/* nx */
+#define	MAX_PLANE_NUM	3
+
+struct rect {
+	int x;
+	int y;
+	int width;
+	int height;
+};
+
+struct nx_scaler_ioctl_data {
+	int		src_plane_num;
+	int		src_fds[MAX_PLANE_NUM];
+	uint32_t	src_stride[MAX_PLANE_NUM];
+	unsigned int	src_width;
+	unsigned int	src_height;
+	unsigned int	src_code;
+
+	int		dst_plane_num;
+	int		dst_fds[MAX_PLANE_NUM];
+	int		dst_stride[MAX_PLANE_NUM];
+	unsigned int	dst_width;
+	unsigned int	dst_height;
+	unsigned int	dst_code;
+
+	struct rect	crop;
+};
+
+enum	{
+	IOCTL_SCALER_SET_AND_RUN	=	_IO(IOC_NX_MAGIC, 1),
+};
+#endif
diff -ENwbur a/include/uapi/linux/videodev2_nxp_media.h b/include/uapi/linux/videodev2_nxp_media.h
--- a/include/uapi/linux/videodev2_nxp_media.h	1970-01-01 01:00:00.000000000 +0100
+++ b/include/uapi/linux/videodev2_nxp_media.h	2018-05-06 08:49:52.022810821 +0200
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Seonghee, Kim <kshblue@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _VIDEODEV2_NXP_MEDIA_H
+#define _VIDEODEV2_NXP_MEDIA_H
+
+/*
+ * F O R M A T S
+ */
+
+
+/* compressed formats */
+#define V4L2_PIX_FMT_DIV3			v4l2_fourcc('D', 'I', 'V', '3')
+#define V4L2_PIX_FMT_DIV4			v4l2_fourcc('D', 'I', 'V', '4')
+#define V4L2_PIX_FMT_DIV5			v4l2_fourcc('D', 'I', 'V', '5')
+#define V4L2_PIX_FMT_DIV6			v4l2_fourcc('D', 'I', 'V', '6')
+#define V4L2_PIX_FMT_DIVX			v4l2_fourcc('D', 'I', 'V', 'X')
+#define V4L2_PIX_FMT_RV8			v4l2_fourcc('R', 'V', '3', '0')
+#define V4L2_PIX_FMT_RV9			v4l2_fourcc('R', 'V', '4', '0')
+#define V4L2_PIX_FMT_WMV9			v4l2_fourcc('W', 'M', 'V', '3')
+#define V4L2_PIX_FMT_WVC1			v4l2_fourcc('W', 'V', 'C', '1')
+#define V4L2_PIX_FMT_FLV1			v4l2_fourcc('F', 'L', 'V', '1')
+#define V4L2_PIX_FMT_THEORA			v4l2_fourcc('T', 'H', 'E', 'O')
+
+/* two non contiguous planes - one Y, one Cr + Cb interleaved  */
+/* 24  Y/CbCr 4:4:4 */
+#define V4L2_PIX_FMT_NV24M	v4l2_fourcc('N', 'M', '2', '4')
+/* 24  Y/CrCb 4:4:4 */
+#define V4L2_PIX_FMT_NV42M	v4l2_fourcc('N', 'M', '4', '2')
+
+/* three non contiguous planes - Y, Cb, Cr */
+/* 16  YUV422 planar */
+#define V4L2_PIX_FMT_YUV422M	v4l2_fourcc('Y', 'M', '1', '6')
+/* 24  YUV444 planar */
+#define V4L2_PIX_FMT_YUV444M	v4l2_fourcc('Y', 'M', '2', '4')
+
+
+
+/*
+ * C O N T R O L S
+ */
+
+
+/* Video Codec */
+#define V4L2_CID_NXP_VPU_BASE			(V4L2_CTRL_CLASS_MPEG | 0x3000)
+
+#define V4L2_CID_MPEG_VIDEO_FPS_NUM		(V4L2_CID_NXP_VPU_BASE + 0x1)
+#define V4L2_CID_MPEG_VIDEO_FPS_DEN		(V4L2_CID_NXP_VPU_BASE + 0x2)
+#define V4L2_CID_MPEG_VIDEO_SEARCH_RANGE	(V4L2_CID_NXP_VPU_BASE + 0x4)
+#define V4L2_CID_MPEG_VIDEO_H264_AUD_INSERT	(V4L2_CID_NXP_VPU_BASE + 0x5)
+#define V4L2_CID_MPEG_VIDEO_RC_DELAY		(V4L2_CID_NXP_VPU_BASE + 0x6)
+#define V4L2_CID_MPEG_VIDEO_RC_GAMMA_FACTOR	(V4L2_CID_NXP_VPU_BASE + 0x7)
+#define V4L2_CID_MPEG_VIDEO_FRAME_SKIP_MODE	(V4L2_CID_NXP_VPU_BASE + 0x8)
+#define V4L2_CID_MPEG_VIDEO_FORCE_I_FRAME	(V4L2_CID_NXP_VPU_BASE + 0x9)
+#define V4L2_CID_MPEG_VIDEO_FORCE_SKIP_FRAME	(V4L2_CID_NXP_VPU_BASE + 0xA)
+
+#define V4L2_CID_MPEG_VIDEO_H263_PROFILE	(V4L2_CID_NXP_VPU_BASE + 0xB)
+enum v4l2_mpeg_video_h263_profile {
+	V4L2_MPEG_VIDEO_H263_PROFILE_P0	= 0,
+	V4L2_MPEG_VIDEO_H263_PROFILE_P3	= 1,
+};
+
+#define V4L2_CID_MPEG_VIDEO_THUMBNAIL_MODE	(V4L2_CID_NXP_VPU_BASE + 0xC)
+
+#endif
diff -ENwbur a/kernel/power/qos.c b/kernel/power/qos.c
--- a/kernel/power/qos.c	2018-05-06 08:47:39.177419154 +0200
+++ b/kernel/power/qos.c	2018-05-06 08:49:52.058812282 +0200
@@ -122,12 +122,82 @@
 };


+static BLOCKING_NOTIFIER_HEAD(bus_throughput_notifier);
+static struct pm_qos_constraints bus_tput_constraints = {
+	.list = PLIST_HEAD_INIT(bus_tput_constraints.list),
+	.target_value = PM_QOS_BUS_THROUGHPUT_DEFAULT_VALUE,
+	.default_value = PM_QOS_BUS_THROUGHPUT_DEFAULT_VALUE,
+	.type = PM_QOS_MAX,
+	.notifiers = &bus_throughput_notifier,
+};
+static struct pm_qos_object bus_throughput_pm_qos = {
+	.constraints = &bus_tput_constraints,
+	.name = "bus_throughput",
+};
+
+static BLOCKING_NOTIFIER_HEAD(cpu_online_min_notifier);
+static struct pm_qos_constraints cpu_online_min_constraints = {
+	.list = PLIST_HEAD_INIT(cpu_online_min_constraints.list),
+	.target_value = PM_QOS_CPU_ONLINE_MIN_DEFAULT_VALUE,
+	.default_value = PM_QOS_CPU_ONLINE_MIN_DEFAULT_VALUE,
+	.type = PM_QOS_MAX,
+	.notifiers = &cpu_online_min_notifier,
+};
+static struct pm_qos_object cpu_online_min_pm_qos = {
+	.constraints = &cpu_online_min_constraints,
+	.name = "cpu_online_min",
+};
+
+static BLOCKING_NOTIFIER_HEAD(cpu_online_max_notifier);
+static struct pm_qos_constraints cpu_online_max_constraints = {
+	.list = PLIST_HEAD_INIT(cpu_online_max_constraints.list),
+	.target_value = PM_QOS_CPU_ONLINE_MAX_DEFAULT_VALUE,
+	.default_value = PM_QOS_CPU_ONLINE_MAX_DEFAULT_VALUE,
+	.type = PM_QOS_MAX,
+	.notifiers = &cpu_online_max_notifier,
+};
+static struct pm_qos_object cpu_online_max_pm_qos = {
+	.constraints = &cpu_online_max_constraints,
+	.name = "cpu_online_max",
+};
+
+static BLOCKING_NOTIFIER_HEAD(cpu_freq_min_notifier);
+static struct pm_qos_constraints cpu_freq_min_constraints = {
+	.list = PLIST_HEAD_INIT(cpu_freq_min_constraints.list),
+	.target_value = PM_QOS_CPU_FREQ_MIN_DEFAULT_VALUE,
+	.default_value = PM_QOS_CPU_FREQ_MIN_DEFAULT_VALUE,
+	.type = PM_QOS_MAX,
+	.notifiers = &cpu_freq_min_notifier,
+};
+static struct pm_qos_object cpu_freq_min_pm_qos = {
+	.constraints = &cpu_freq_min_constraints,
+	.name = "cpu_freq_min",
+};
+
+static BLOCKING_NOTIFIER_HEAD(cpu_freq_max_notifier);
+static struct pm_qos_constraints cpu_freq_max_constraints = {
+	.list = PLIST_HEAD_INIT(cpu_freq_max_constraints.list),
+	.target_value = PM_QOS_CPU_FREQ_MAX_DEFAULT_VALUE,
+	.default_value = PM_QOS_CPU_FREQ_MAX_DEFAULT_VALUE,
+	.type = PM_QOS_MIN,
+	.notifiers = &cpu_freq_max_notifier,
+};
+static struct pm_qos_object cpu_freq_max_pm_qos = {
+	.constraints = &cpu_freq_max_constraints,
+	.name = "cpu_freq_max",
+};
+
 static struct pm_qos_object *pm_qos_array[] = {
 	&null_pm_qos,
 	&cpu_dma_pm_qos,
 	&network_lat_pm_qos,
 	&network_throughput_pm_qos,
 	&memory_bandwidth_pm_qos,
+	&bus_throughput_pm_qos,
+	&cpu_online_min_pm_qos,
+	&cpu_online_max_pm_qos,
+	&cpu_freq_min_pm_qos,
+	&cpu_freq_max_pm_qos,
 };

 static ssize_t pm_qos_power_write(struct file *filp, const char __user *buf,
diff -ENwbur a/Makefile b/Makefile
--- a/Makefile	2018-05-06 08:47:34.973248474 +0200
+++ b/Makefile	2018-05-06 08:49:47.990647213 +0200
@@ -311,7 +311,9 @@
 # Default value for CROSS_COMPILE is not to prefix executables
 # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
 ARCH		?= $(SUBARCH)
+ARCH		= arm64
 CROSS_COMPILE	?= $(CONFIG_CROSS_COMPILE:"%"=%)
+CROSS_COMPILE	= aarch64-linux-gnu-

 # Architecture as present in compile.h
 UTS_MACHINE 	:= $(ARCH)
diff -ENwbur a/mm/page_alloc.c b/mm/page_alloc.c
--- a/mm/page_alloc.c	2018-05-06 08:47:39.257422402 +0200
+++ b/mm/page_alloc.c	2018-05-06 08:49:52.118814717 +0200
@@ -2447,6 +2447,22 @@
 		drain_pages(cpu);
 }

+/* another version, as of smp_processor_id() cannot be used in preemptible code
+ */
+static void drain_local_pages_v2(struct zone *zone)
+{
+	struct per_cpu_pages *pcp;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	pcp = &this_cpu_ptr(zone->pageset)->pcp;
+	if( pcp->count ) {
+		free_pcppages_bulk(zone, pcp->count, pcp);
+		pcp->count = 0;
+	}
+	local_irq_restore(flags);
+}
+
 static void drain_local_pages_wq(struct work_struct *work)
 {
 	/*
@@ -7650,6 +7666,7 @@
 void free_contig_range(unsigned long pfn, unsigned nr_pages)
 {
 	unsigned int count = 0;
+	struct zone *zone = page_zone(pfn_to_page(pfn));

 	for (; nr_pages--; pfn++) {
 		struct page *page = pfn_to_page(pfn);
@@ -7658,6 +7675,7 @@
 		__free_page(page);
 	}
 	WARN(count != 0, "%d pages are still in use!\n", count);
+	drain_local_pages_v2(zone);
 }
 #endif

diff -ENwbur a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
--- a/sound/soc/codecs/es8316.c	2018-05-06 08:47:39.569435068 +0200
+++ b/sound/soc/codecs/es8316.c	2018-05-06 08:49:52.446828026 +0200
@@ -503,7 +503,12 @@
 			SNDRV_PCM_FMTBIT_S24_LE)

 static const struct snd_soc_dai_ops es8316_ops = {
-	.startup = es8316_pcm_startup,
+	/* XXX: es8316_pcm_startup is invoked when control device is opened;
+	 * es8316_set_dai_sysclk is invoked later, at ioctl
+	 * how sysclk variable may be initialized at startup???
+	 * The same question for sysclk_constraints set by
+	 * es8316_set_dai_sysclk and used by es8316_pcm_startup. */
+	//.startup = es8316_pcm_startup,
 	.hw_params = es8316_pcm_hw_params,
 	.set_fmt = es8316_set_dai_fmt,
 	.set_sysclk = es8316_set_dai_sysclk,
diff -ENwbur a/sound/soc/Kconfig b/sound/soc/Kconfig
--- a/sound/soc/Kconfig	2018-05-06 08:47:39.553434419 +0200
+++ b/sound/soc/Kconfig	2018-05-06 08:49:52.430827377 +0200
@@ -71,6 +71,7 @@
 source "sound/soc/ux500/Kconfig"
 source "sound/soc/xtensa/Kconfig"
 source "sound/soc/zte/Kconfig"
+source "sound/soc/nexell/Kconfig"

 # Supported codecs
 source "sound/soc/codecs/Kconfig"
diff -ENwbur a/sound/soc/Makefile b/sound/soc/Makefile
--- a/sound/soc/Makefile	2018-05-06 08:47:39.553434419 +0200
+++ b/sound/soc/Makefile	2018-05-06 08:49:52.430827377 +0200
@@ -52,3 +52,4 @@
 obj-$(CONFIG_SND_SOC)	+= ux500/
 obj-$(CONFIG_SND_SOC)	+= xtensa/
 obj-$(CONFIG_SND_SOC)	+= zte/
+obj-$(CONFIG_SND_SOC)	+= nexell/
diff -ENwbur a/sound/soc/nexell/Kconfig b/sound/soc/nexell/Kconfig
--- a/sound/soc/nexell/Kconfig	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/Kconfig	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,56 @@
+#
+# Copyright 2016 Nexell.
+#
+# Configuration options for the Nexell Sound
+
+config SND_NX_SOC
+	tristate "Nexell SoC Audio"
+	depends on ARCH_S5P4418 || ARCH_S5P6818
+	select AMBA_PL08X
+	help
+	  Say Y or M if you want to add support for codecs attached to
+	  the AC97 and I2S interface.
+
+config SND_NX_I2S
+	tristate
+
+config SND_NX_I2S_CH0
+	bool "I2S 0"
+	depends on SND_NX_SOC
+	select SND_NX_I2S
+	default y
+
+config SND_NX_I2S_CH1
+	bool "I2S 1"
+	depends on SND_NX_SOC
+	select SND_NX_I2S
+	default n
+
+config SND_NX_I2S_CH2
+	bool "I2S 2"
+	depends on SND_NX_SOC
+	select SND_NX_I2S
+	default n
+
+config SND_NX_SPDIF_TX
+	tristate
+
+config SND_SPDIF_TRANSCEIVER
+	tristate "SPDIF transceiver (PCM)"
+	depends on SND_NX_SOC
+	select SND_NX_SPDIF_TX
+	select SND_SOC_SPDIF
+
+config SND_CODEC_NULL
+	tristate "I2S audio null codec."
+	depends on SND_NX_I2S
+
+config SND_CODEC_ES8316
+	tristate "es8316 I2S audio codec."
+	depends on SND_NX_I2S
+	select SND_SOC_ES8316
+
+config SND_CODEC_ALC5658
+	tristate "ALC5658 I2S audio codec."
+	depends on SND_NX_I2S
+	select SND_SOC_RT5659
diff -ENwbur a/sound/soc/nexell/Makefile b/sound/soc/nexell/Makefile
--- a/sound/soc/nexell/Makefile	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/Makefile	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,22 @@
+#
+# Copyright 2016 Nexell Co.
+#
+# Makefile for the Nexell Sound
+
+obj-$(CONFIG_SND_NX_SOC)			+= nexell-snd-pcm.o
+obj-$(CONFIG_SND_NX_I2S)			+= nexell-snd-i2s.o
+obj-$(CONFIG_SND_NX_SPDIF_TX)			+= nexell-snd-spdiftx.o
+
+nexell-snd-pcm-objs				:= nexell-pcm.o
+nexell-snd-i2s-objs				:= nexell-i2s.o
+nexell-snd-spdiftx-objs				:= nexell-spdiftx.o
+
+obj-$(CONFIG_SND_CODEC_ES8316)			+= nexell-snd-es8316.o
+obj-$(CONFIG_SND_CODEC_ALC5658)			+= nexell-snd-alc5658.o
+obj-$(CONFIG_SND_CODEC_NULL)			+= nexell-snd-null.o
+obj-$(CONFIG_SND_SPDIF_TRANSCEIVER)		+= nexell-snd-spdif-transceiver.o
+
+nexell-snd-es8316-objs 				:= nexell-es8316.o
+nexell-snd-alc5658-objs 			:= nexell-alc5658.o
+nexell-snd-null-objs				:= nexell-null.o
+nexell-snd-spdif-transceiver-objs 		:= nexell-spdif-transceiver.o
diff -ENwbur a/sound/soc/nexell/nexell-alc5658.c b/sound/soc/nexell/nexell-alc5658.c
--- a/sound/soc/nexell/nexell-alc5658.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-alc5658.c	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,433 @@
+/*
+ * Copyright (C) 2016 YICSYSTEM Co., Ltd.
+ * Author: Young-ho david yeo < yhyeo@yicsystem.com >
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see < http://www.gnu.org/licenses/ >.
+ */
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/jack.h>
+#include "nexell-i2s.h"
+#ifdef CONFIG_GPIOLIB
+#include <linux/of_gpio.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+int amp_io;
+#endif
+#define I2S_BASEADDR 0xC0055000
+#define I2S_CH_OFFSET 0x1000
+
+#define DEBUG
+
+static char str_dai_name[16] = "c0055000.i2s";
+static int (*cpu_resume_fn)(struct snd_soc_dai *dai);
+static struct snd_soc_codec *alc5658;
+static int codec_bias_level;
+
+/* sound DAI (I2S/SPDIF and codec interface) */
+struct nx_snd_jack_pin {
+	int support;
+	int detect_level;
+	int detect_io;
+	int debounce_time;
+};
+
+static int alc5658_jack_status_check(void *data);
+/* Headphones jack detection GPIO */
+static struct snd_soc_jack_gpio jack_gpio = {
+	.invert = true, /* High detect : invert = false */
+	.name = "hp-gpio",
+	.report = SND_JACK_HEADPHONE,
+	.debounce_time = 200,
+	.jack_status_check = alc5658_jack_status_check,
+};
+
+static struct snd_soc_jack hp_jack;
+
+static int alc5658_jack_status_check(void *data)
+{
+	struct snd_soc_codec *codec = alc5658;
+	int invert = jack_gpio.invert;
+	int level = 1;/*gpio_get_value_cansleep(jack);*/
+
+	if (!codec)
+		return -1;
+	if (invert)
+		level = !level;
+	dev_dbg(codec->dev, "%s: hp jack %s\n", __func__, level?"IN":"OUT");
+
+	if (!level) {
+		/* TODO: you want */
+		dev_dbg(codec->dev, "hp jack ejected\n");
+	} else {
+		/* TODO: you want */
+		dev_dbg(codec->dev, "hp jack inserted\n");
+	}
+	return level;
+}
+
+static int alc5658_hw_params(struct snd_pcm_substream *substream,
+			struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	/* 48K * 256 = 12.288 Mhz */
+	unsigned int freq = params_rate(params) * 256;
+	unsigned int fmt = SND_SOC_DAIFMT_I2S |
+			SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS;
+	int ret = 0;
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, 0, freq,
+					SND_SOC_CLOCK_IN);
+	if (0 > ret)
+		return ret;
+
+	ret = snd_soc_dai_set_fmt(codec_dai, fmt);
+
+	if (0 > ret)
+		return ret;
+	return ret;
+}
+
+static int alc5658_suspend_pre(struct snd_soc_card *card)
+{
+	dev_dbg(card->dev, "+%s\n", __func__);
+#ifdef CONFIG_GPIOLIB
+	if (amp_io > 0)
+		gpio_set_value(amp_io, 0);
+#endif
+	return 0;
+}
+
+static int alc5658_resume_pre(struct snd_soc_card *card)
+{
+	struct snd_soc_dai *cpu_dai = card->rtd->cpu_dai;
+	struct snd_soc_codec *codec = alc5658;
+	struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+	int ret = 0;
+
+	dev_dbg(card->dev, "+%s\n", __func__);
+
+	/*
+	 * first execute cpu(i2s) resume and execute codec resume.
+	 */
+	if (cpu_dai->driver->resume && !cpu_resume_fn) {
+		cpu_resume_fn = cpu_dai->driver->resume;
+		cpu_dai->driver->resume = NULL;
+	}
+
+	if (cpu_resume_fn)
+		ret = cpu_resume_fn(cpu_dai);
+	dev_dbg(card->dev, "-%s\n", __func__);
+	codec_bias_level = dapm->bias_level;
+
+	return ret;
+}
+
+static int alc5658_resume_post(struct snd_soc_card *card)
+{
+	struct snd_soc_codec *codec = alc5658;
+	struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+	int invert = jack_gpio.invert;
+	int level = 1; /* gpio_get_value_cansleep(jack); */
+
+	dev_dbg(card->dev, "%s BAIAS=%d, PRE=%d\n", __func__,
+		dapm->bias_level, codec_bias_level);
+
+	if (!codec)
+		return -1;
+	if (SND_SOC_BIAS_OFF != codec_bias_level)
+		codec->driver->resume(codec);
+
+	if (NULL == jack_gpio.name)
+		return 0;
+
+	if (invert)
+		level = !level;
+	dev_dbg(card->dev, "%s: hp jack %s\n", __func__, level?"IN":"OUT");
+
+	if (!level) {
+		/* TODO: you want */
+		dev_dbg(codec->dev, "hp jack ejected\n");
+	} else {
+		/* TODO: you want */
+		dev_dbg(codec->dev, "hp jack inserted\n");
+	}
+	snd_soc_jack_report(&hp_jack, level, jack_gpio.report);
+	return 0;
+}
+
+static struct snd_soc_ops alc5658_ops = {
+	.hw_params = alc5658_hw_params,
+};
+
+static int alc5658_spk_event(struct snd_soc_dapm_widget *w,
+				struct snd_kcontrol *k, int event)
+{
+#ifdef CONFIG_GPIOLIB
+	if (amp_io > 0) {
+		if (SND_SOC_DAPM_EVENT_ON(event))
+			gpio_set_value(amp_io, 1);
+		else
+			gpio_set_value(amp_io, 0);
+	}
+#endif
+	return 0;
+}
+
+/* alc5658 machine dapm widgets */
+static const struct snd_soc_dapm_widget alc5658_dapm_widgets[] = {
+	SND_SOC_DAPM_SPK("Ext Spk", alc5658_spk_event),
+	/* TODO: change initial path */
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+	/* TODO: change initial path */
+	SND_SOC_DAPM_MIC("Main Mic", NULL),
+};
+
+/* Corgi machine audio map (connections to the codec pins) */
+static const struct snd_soc_dapm_route alc5658_audio_map[] = {
+	/* headphone connected to HPOL, HPOR */ /* TODO: change initial path */
+	{"Headphone Jack", NULL, "HPOL"},
+	{"Headphone Jack", NULL, "HPOR"},
+	/* speaker connected to HPOL, HPOR */ /* TODO: change initial path */
+	{"Ext Spk", NULL, "HPOL"},
+	{"Ext Spk", NULL, "HPOR"},
+	/* Main Mic Connected to IN2P */
+	{"IN2P", NULL, "MICBIAS1"},
+	{"IN2P", NULL, "Main Mic"},
+};
+
+/* Headphones jack detection DAPM pin */
+static struct snd_soc_jack_pin jack_pins[] = {
+	{
+		.pin = "Headphone Jack", /* TODO: change initial path */
+		.mask = SND_JACK_HEADPHONE,
+	},
+	{
+		.pin = "Ext Spk", /* TODO: change initial path */
+		.mask = SND_JACK_HEADPHONE,
+		.invert = 1, /* when insert disable */
+	},
+};
+
+static int alc5658_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+	struct snd_soc_jack_gpio *jack = &jack_gpio;
+	int ret;
+
+	alc5658 = codec;
+	/* set endpoints to not connected */
+	snd_soc_dapm_nc_pin(dapm, "DMIC");/* TODO: change initial path */
+	snd_soc_dapm_nc_pin(dapm, "MIC2");/* TODO: change initial path */
+	if (NULL == jack->name)
+		return 0;
+
+	/* Headset jack detection */
+	ret = snd_soc_card_jack_new(rtd->card, "Headphone Jack",
+					SND_JACK_HEADPHONE, &hp_jack, jack_pins,
+					ARRAY_SIZE(jack_pins));
+	if (ret)
+		return ret;
+	/* to power up alc5658 (HP Depop: hp_event) */
+	snd_soc_dapm_enable_pin(dapm, "Headphone Jack");
+	/* TODO: change initial path */
+	snd_soc_dapm_sync(dapm);
+
+	ret = snd_soc_jack_add_gpios(&hp_jack, 1, jack);
+	if (ret)
+		dev_err(codec->dev, "Fail, register audio jack detect, io [%d]...\n",
+				jack->gpio);
+	return 0;
+}
+
+static struct snd_soc_dai_link alc5658_dai_link = {
+	.name = "ASOC-ALC5658",
+	.stream_name = "ALC5658_AIF1",
+	.cpu_dai_name = str_dai_name,
+	.codec_dai_name = "rt5659-aif1",
+	.ops = &alc5658_ops,
+	.symmetric_rates = 1,
+	.init = alc5658_dai_init,
+};
+
+static struct snd_soc_card alc5658_card = {
+	.name = "I2S-ALC5658", /* proc/asound/cards */
+	.owner = THIS_MODULE,
+	.dai_link = &alc5658_dai_link,
+	.num_links = 1,
+	.suspend_pre = &alc5658_suspend_pre,
+	.resume_pre = &alc5658_resume_pre,
+	.resume_post = &alc5658_resume_post,
+	.dapm_widgets = alc5658_dapm_widgets,
+	.num_dapm_widgets = ARRAY_SIZE(alc5658_dapm_widgets),
+	.dapm_routes = alc5658_audio_map,
+	.num_dapm_routes = ARRAY_SIZE(alc5658_audio_map),
+};
+
+/*
+ * codec driver
+ */
+static int alc5658_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &alc5658_card;
+	struct snd_soc_jack_gpio *jack = &jack_gpio;
+	struct snd_soc_dai_driver *i2s_dai = NULL;
+	struct nx_snd_jack_pin hpin = {0.};
+	unsigned int rates = 0, format = 0;
+	int ret;
+	int ch;
+	const char *format_name;
+
+	/* set I2S name */
+	of_property_read_u32(pdev->dev.of_node, "ch", &ch);
+	sprintf(str_dai_name, "%x%s",
+	 (I2S_BASEADDR + (ch * I2S_CH_OFFSET)), ".i2s");
+	of_property_read_u32(pdev->dev.of_node, "sample-rate", &rates);
+	format_name = of_get_property(pdev->dev.of_node, "format", NULL);
+	if (format_name != NULL) {
+		if (strcmp(format_name, "S16") == 0)
+			format = SNDRV_PCM_FMTBIT_S16_LE;
+		else if (strcmp(format_name, "S24") == 0) {
+			format = SNDRV_PCM_FMTBIT_S16_LE |
+					SNDRV_PCM_FMTBIT_S24_LE;
+		}
+	}
+	of_property_read_u32(pdev->dev.of_node, "hpin-support", &hpin.support);
+	if (hpin.support) {
+		hpin.detect_io = of_get_named_gpio(pdev->dev.of_node,
+		  "hpin-gpio", 0);
+		of_property_read_u32(pdev->dev.of_node, "hpin-level",
+		  &hpin.detect_level);
+		jack->gpio = hpin.detect_io;
+		jack->invert = hpin.detect_level ? false : true;
+		jack->debounce_time = hpin.debounce_time ?
+		   hpin.debounce_time : 200;
+	} else {
+		jack->name = NULL;
+	}
+#ifdef CONFIG_GPIOLIB
+	amp_io = of_get_named_gpio(pdev->dev.of_node, "amp-gpio", 0);
+	if (gpio_is_valid(amp_io)) {
+		ret = devm_gpio_request(&pdev->dev, amp_io, "alc5658_amp_en");
+		if (ret < 0)
+			dev_err(&pdev->dev,
+			  "can't request amp gpio %d\n", amp_io);
+		ret = gpio_direction_output(amp_io, 0);
+		if (ret < 0) {
+			dev_err(&pdev->dev, "can't request output direction");
+			dev_err(&pdev->dev, "amp gpio %d\n", amp_io);
+		}
+	} else {
+		dev_err(&pdev->dev, "amp_io is invalid pin(amp_io #%d)\n",
+				amp_io);
+	}
+#endif
+	card->dev = &pdev->dev;
+	if (!alc5658_dai_link.codec_name) {
+		alc5658_dai_link.codec_name = NULL;
+		alc5658_dai_link.codec_of_node = of_parse_phandle(
+		pdev->dev.of_node, "audio-codec", 0);
+		if (!alc5658_dai_link.codec_of_node) {
+			dev_err(&pdev->dev,
+			    "Property 'audio-codec' missing or invalid\n");
+		}
+	}
+
+	ret = snd_soc_register_card(card);
+	if (ret) {
+		dev_err(&pdev->dev,
+			"snd_soc_register_card() failed: %d\n", ret);
+		return ret;
+	}
+
+	if (card->rtd) {
+		struct snd_soc_dai *cpu_dai = card->rtd->cpu_dai;
+
+		if (cpu_dai)
+			i2s_dai = cpu_dai->driver;
+	}
+	dev_dbg(&pdev->dev, "alc5658-dai: register card %s -> %s\n",
+			card->dai_link->codec_dai_name,
+			card->dai_link->cpu_dai_name);
+	if (NULL == i2s_dai)
+		return 0;
+	/*
+	 * Reset i2s sample rates
+	 */
+	if (rates) {
+		rates = snd_pcm_rate_to_rate_bit(rates);
+		if (SNDRV_PCM_RATE_KNOT == rates)
+			dev_err(&pdev->dev, "%s, invalid sample rates=%d\n",
+					__func__, rates);
+		else {
+			i2s_dai->playback.rates = rates;
+			i2s_dai->capture.rates = rates;
+		}
+	}
+	/*
+	 * Reset i2s format
+	 */
+	if (format) {
+		i2s_dai->playback.formats = format;
+		i2s_dai->capture.formats = format;
+	}
+
+	return ret;
+}
+
+static int alc5658_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	snd_soc_unregister_card(card);
+#ifdef CONFIG_GPIOLIB
+	if (amp_io > 0) {
+		gpio_set_value(amp_io, 0);
+		devm_gpio_free(&pdev->dev, amp_io);
+	}
+#endif
+	return 0;
+}
+#ifdef CONFIG_OF
+static const struct of_device_id nx_alc5658_match[] = {
+	{ .compatible = "nexell,nexell-alc5658" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_alc5658_match);
+#else
+#define nx_alc5658_match NULL
+#endif
+
+static struct platform_driver alc5658_driver = {
+	.driver = {
+		.name = "alc5658-audio",
+		.owner = THIS_MODULE,
+		.pm = &snd_soc_pm_ops, /* for suspend */
+		.of_match_table = of_match_ptr(nx_alc5658_match),
+	},
+	.probe = alc5658_probe,
+	.remove = alc5658_remove,
+};
+module_platform_driver(alc5658_driver);
+
+MODULE_AUTHOR("david yeo < yhyeo@yicsystem.com >");
+MODULE_DESCRIPTION("Sound codec-alc5658 driver for Nexell sound");
+MODULE_LICENSE("GPL");
diff -ENwbur a/sound/soc/nexell/nexell-es8316.c b/sound/soc/nexell/nexell-es8316.c
--- a/sound/soc/nexell/nexell-es8316.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-es8316.c	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/jack.h>
+#include "nexell-i2s.h"
+
+#include "../codecs/es8316.h"
+
+#ifdef CONFIG_GPIOLIB
+#include <linux/of_gpio.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+int es8316_amp_io;
+#endif
+
+#define I2S_BASEADDR		0xC0055000
+#define I2S_CH_OFFSET           0x1000
+
+static char str_dai_name[16] = "c0055000.i2s";
+static int (*cpu_resume_fn)(struct snd_soc_dai *dai);
+static struct snd_soc_codec *es8316;
+static int codec_bias_level;
+
+/* sound DAI (I2S/SPDIF and codec interface) */
+struct nx_snd_jack_pin {
+	int support;
+	int detect_level;
+	int detect_io;
+	int debounce_time;
+};
+
+static int es8316_jack_status_check(void *data);
+/* Headphones jack detection GPIO */
+static struct snd_soc_jack_gpio jack_gpio = {
+	.invert		= false,	/* High detect : invert = false */
+	.name		= "hp-gpio",
+	.report		= SND_JACK_HEADPHONE,
+	.debounce_time	= 200,
+	.jack_status_check = es8316_jack_status_check,
+};
+
+static struct snd_soc_jack hp_jack;
+
+static int es8316_jack_status_check(void *data)
+{
+	struct snd_soc_codec *codec = es8316;
+	int jack = jack_gpio.gpio;
+	int invert = jack_gpio.invert;
+	int level = gpio_get_value_cansleep(jack);
+
+	if (!codec)
+		return -1;
+
+	if (invert)
+		level = !level;
+
+	dev_dbg(codec->dev, "%s: hp jack %s\n", __func__, level?"IN":"OUT");
+
+	if (!level) {
+		es8316_jack_insert = 0;
+		es8316_mono_en(1);
+		if (es8316_amp_io >= 0 && snd_soc_codec_get_bias_level(codec) >= SND_SOC_BIAS_PREPARE)
+			gpio_set_value(es8316_amp_io, 1);
+	} else {
+		es8316_jack_insert = 1;
+		es8316_mono_en(0);
+		if( es8316_amp_io >= 0 )
+			gpio_set_value(es8316_amp_io, 0);
+	}
+
+	dev_dbg(codec->dev, "%s: jack_insert %d\n", __func__,
+		es8316_jack_insert);
+
+	return level;
+}
+
+static int es8316_hw_params(struct snd_pcm_substream *substream,
+				struct snd_pcm_hw_params *params)
+{
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	struct snd_soc_dai *codec_dai = rtd->codec_dai;
+	/* 48K * 256 = 12.288 Mhz */
+	unsigned int freq = params_rate(params) * 256;
+	unsigned int fmt  = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+						SND_SOC_DAIFMT_CBS_CFS;
+	int ret = 0;
+
+	ret = snd_soc_dai_set_sysclk(codec_dai, 0, freq, SND_SOC_CLOCK_IN);
+	if (0 > ret)
+		return ret;
+
+	ret = snd_soc_dai_set_fmt(codec_dai, fmt);
+	if (0 > ret)
+		return ret;
+	return ret;
+}
+
+static int es8316_suspend_pre(struct snd_soc_card *card)
+{
+	dev_dbg(card->dev, "+%s\n", __func__);
+
+	if( es8316_amp_io >= 0 )
+		gpio_set_value(es8316_amp_io, 0);
+
+	return 0;
+}
+
+static int es8316_resume_pre(struct snd_soc_card *card)
+{
+	struct snd_soc_pcm_runtime *rtd;
+	struct snd_soc_dai *cpu_dai;
+	struct snd_soc_codec *codec = es8316;
+	int ret = 0;
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	cpu_dai = rtd->cpu_dai;
+	dev_dbg(card->dev, "+%s\n", __func__);
+
+	/*
+	 * first execute cpu(i2s) resume and execute codec resume.
+	 */
+	if (cpu_dai->driver->resume && !cpu_resume_fn) {
+		cpu_resume_fn  = cpu_dai->driver->resume;
+		cpu_dai->driver->resume = NULL;
+	}
+
+	if (cpu_resume_fn)
+		ret = cpu_resume_fn(cpu_dai);
+
+	dev_dbg(card->dev, "-%s\n", __func__);
+	codec_bias_level = snd_soc_codec_get_bias_level(codec);
+
+	return ret;
+}
+
+static int es8316_resume_post(struct snd_soc_card *card)
+{
+	struct snd_soc_codec *codec = es8316;
+	int jack = jack_gpio.gpio;
+	int invert = jack_gpio.invert;
+	int level = gpio_get_value_cansleep(jack);
+
+	dev_dbg(card->dev, "%s BAIAS=%d, PRE=%d\n", __func__,
+		snd_soc_codec_get_bias_level(codec), codec_bias_level);
+
+	if (!codec)
+		return -1;
+
+	if (SND_SOC_BIAS_OFF != codec_bias_level)
+		codec->driver->resume(codec);
+
+	if (invert)
+		level = !level;
+
+	dev_dbg(card->dev, "%s: hp jack %s\n", __func__, level?"IN":"OUT");
+
+	if (!level)
+		es8316_jack_insert = 0;
+	else
+		es8316_jack_insert = 1;
+
+	dev_dbg(card->dev, "%s: jack_insert %d\n", __func__,
+		es8316_jack_insert);
+
+	snd_soc_jack_report(&hp_jack, level, jack_gpio.report);
+
+	return 0;
+}
+
+static struct snd_soc_ops es8316_ops = {
+	.hw_params = es8316_hw_params,
+};
+
+int es8316_spk_on(int enable)
+{
+	if (es8316_amp_io >= 0) {
+		if (enable)
+			gpio_set_value(es8316_amp_io, 1);
+		else
+			gpio_set_value(es8316_amp_io, 0);
+	}
+	return 0;
+}
+EXPORT_SYMBOL(es8316_spk_on);
+
+static int es8316_spk_event(struct snd_soc_dapm_widget *w,
+	struct snd_kcontrol *k, int event)
+{
+	if (es8316_amp_io >= 0) {
+		if (SND_SOC_DAPM_EVENT_ON(event))
+			gpio_set_value(es8316_amp_io, 1);
+		else
+			gpio_set_value(es8316_amp_io, 0);
+	}
+	return 0;
+}
+
+/* es8316 machine dapm widgets */
+static const struct snd_soc_dapm_widget es8316_dapm_widgets[] = {
+	SND_SOC_DAPM_SPK("Ext Spk", es8316_spk_event),
+	SND_SOC_DAPM_HP("Headphone Jack", NULL),
+};
+
+/* Corgi machine audio map (connections to the codec pins) */
+static const struct snd_soc_dapm_route es8316_audio_map[] = {
+	/* headphone connected to HPOL, HPOR */
+	{"Headphone Jack", NULL, "HPOL"},
+	{"Headphone Jack", NULL, "HPOR"},
+
+	/* speaker connected to HPOL, HPOR */
+	{"Ext Spk", NULL, "HPOL"},
+	{"Ext Spk", NULL, "HPOR"},
+};
+
+/* Headphones jack detection DAPM pin */
+static struct snd_soc_jack_pin jack_pins[] = {
+	{
+		.pin	= "Headphone Jack",
+		.mask	= SND_JACK_HEADPHONE,
+	},
+	{
+		.pin	= "Ext Spk",
+		.mask   = SND_JACK_HEADPHONE,
+		.invert	= 1,			/* when insert disable */
+	},
+};
+
+static int es8316_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+	struct snd_soc_codec *codec = rtd->codec;
+	struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+	struct snd_soc_jack_gpio *jack = &jack_gpio;
+	int ret;
+
+	es8316 = codec;
+
+	/* set endpoints to not connected */
+	snd_soc_dapm_nc_pin(dapm, "DMIC");
+	snd_soc_dapm_nc_pin(dapm, "MIC2");
+
+	if (NULL == jack->name)
+		return 0;
+
+	/* Headset jack detection */
+	ret = snd_soc_card_jack_new(rtd->card, "Headphone Jack",
+				SND_JACK_HEADPHONE, &hp_jack, jack_pins,
+				ARRAY_SIZE(jack_pins));
+	if (ret)
+		return ret;
+
+	/* to power up es8316 (HP Depop: hp_event) */
+	snd_soc_dapm_enable_pin(dapm, "Headphone Jack");
+	snd_soc_dapm_sync(dapm);
+
+	ret = snd_soc_jack_add_gpios(&hp_jack, 1, jack);
+	if (ret)
+		dev_err(codec->dev, "Fail, register audio jack detect, io [%d]...\n",
+		       jack->gpio);
+
+	return 0;
+}
+
+static struct snd_soc_dai_link es8316_dai_link = {
+	.name		= "ASOC-ES8316",
+	.stream_name	= "es8316 HiFi",
+	.cpu_dai_name	= str_dai_name,		/* nx_snd_i2s_driver name */
+	.platform_name  = "nexell-pcm",		/* nx_snd_pcm_driver name */
+	.codec_dai_name = "ES8316 HiFi",	/* es8316_dai's name */
+	.codec_name	= "ES8316.0-0011",	/* es8316_i2c_driver name
+						   + '.' + bus + '-'
+						   + address(7bit) */
+	.ops		= &es8316_ops,
+	.symmetric_rates = 1,
+	.init		= es8316_dai_init,
+};
+
+static struct snd_soc_card es8316_card = {
+	.name			= "I2S-ES8316",	/* proc/asound/cards */
+	.owner			= THIS_MODULE,
+	.dai_link		= &es8316_dai_link,
+	.num_links		= 1,
+	.suspend_pre		= &es8316_suspend_pre,
+	.resume_pre		= &es8316_resume_pre,
+	.resume_post		= &es8316_resume_post,
+	.dapm_widgets		= es8316_dapm_widgets,
+	.num_dapm_widgets	= ARRAY_SIZE(es8316_dapm_widgets),
+	.dapm_routes		= es8316_audio_map,
+	.num_dapm_routes	= ARRAY_SIZE(es8316_audio_map),
+};
+
+/*
+ * codec driver
+ */
+static int es8316_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &es8316_card;
+	struct snd_soc_jack_gpio *jack = &jack_gpio;
+	struct snd_soc_dai_driver *i2s_dai = NULL;
+	struct snd_soc_pcm_runtime *rtd;
+	struct nx_snd_jack_pin hpin = {0.};
+	unsigned int rates = 0, format = 0;
+	int ret;
+	int ch;
+	const char *format_name;
+
+	/* set I2S name */
+	of_property_read_u32(pdev->dev.of_node, "ch", &ch);
+	sprintf(str_dai_name, "%x%s", (I2S_BASEADDR + (ch * I2S_CH_OFFSET)),
+		".i2s");
+	of_property_read_u32(pdev->dev.of_node, "sample-rate", &rates);
+	format_name = of_get_property(pdev->dev.of_node, "format", NULL);
+	if (format_name != NULL) {
+		if (strcmp(format_name, "S16") == 0)
+			format = SNDRV_PCM_FMTBIT_S16_LE;
+		else if (strcmp(format_name, "S24") == 0) {
+			format = SNDRV_PCM_FMTBIT_S16_LE |
+				SNDRV_PCM_FMTBIT_S24_LE;
+		}
+	}
+	of_property_read_u32(pdev->dev.of_node, "hpin-support", &hpin.support);
+	hpin.detect_io = of_get_named_gpio(pdev->dev.of_node, "hpin-gpio", 0);
+	of_property_read_u32(pdev->dev.of_node, "hpin-level",
+			     &hpin.detect_level);
+	if (hpin.support) {
+		jack->gpio = hpin.detect_io;
+		jack->invert = hpin.detect_level ?  false : true;
+		jack->debounce_time = hpin.debounce_time ?
+				hpin.debounce_time : 200;
+	} else {
+		jack->name = NULL;
+	}
+#ifdef CONFIG_GPIOLIB
+	if( of_get_property(pdev->dev.of_node, "amp-gpio", NULL) )
+		es8316_amp_io = of_get_named_gpio(pdev->dev.of_node, "amp-gpio", 0);
+	else
+		es8316_amp_io = -1;
+	if (gpio_is_valid(es8316_amp_io)) {
+		ret = devm_gpio_request(&pdev->dev, es8316_amp_io,
+					"es8316_amp_en");
+
+		if (ret < 0) {
+			dev_err(&pdev->dev,
+				"can't request amp gpio %d\n", es8316_amp_io);
+		}
+
+		ret = gpio_direction_output(es8316_amp_io, 0);
+		if (ret < 0) {
+			dev_err(&pdev->dev,
+				"can't request output direction");
+			dev_err(&pdev->dev, "amp gpio %d\n", es8316_amp_io);
+		}
+	}else
+		es8316_amp_io = -1;
+#endif
+	card->dev = &pdev->dev;
+	ret = snd_soc_register_card(card);
+	if (ret) {
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+		return ret;
+	}
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (rtd) {
+		struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+
+		if (cpu_dai)
+			i2s_dai = cpu_dai->driver;
+	}
+	dev_dbg(&pdev->dev, "es8316-dai: register card %s -> %s\n",
+		card->dai_link->codec_dai_name, card->dai_link->cpu_dai_name);
+
+	if (NULL == i2s_dai)
+		return 0;
+
+	/*
+	 * Reset i2s sample rates
+	 */
+	if (rates) {
+		rates = snd_pcm_rate_to_rate_bit(rates);
+		if (SNDRV_PCM_RATE_KNOT == rates)
+			dev_err(&pdev->dev, "%s, invalid sample rates=%d\n",
+				__func__, rates);
+		else {
+			i2s_dai->playback.rates = rates;
+			i2s_dai->capture.rates = rates;
+		}
+	}
+
+	/*
+	 * Reset i2s format
+	 */
+	if (format) {
+		i2s_dai->playback.formats = format;
+		i2s_dai->capture.formats = format;
+	}
+
+	return ret;
+}
+
+static int es8316_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	snd_soc_unregister_card(card);
+#ifdef CONFIG_GPIOLIB
+	if( es8316_amp_io >= 0 ) {
+		gpio_set_value(es8316_amp_io, 0);
+		devm_gpio_free(&pdev->dev, es8316_amp_io);
+	}
+#endif
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nx_es8316_match[] = {
+	{ .compatible = "nexell,nexell-es8316" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_es8316_match);
+#else
+#define nx_es8316_match NULL
+#endif
+
+static struct platform_driver es8316_driver = {
+	.driver		= {
+		.name	= "es8316-audio",
+		.owner	= THIS_MODULE,
+		.pm	= &snd_soc_pm_ops,	/* for suspend */
+		.of_match_table = nx_es8316_match,
+	},
+	.probe		= es8316_probe,
+	.remove		= es8316_remove,
+};
+module_platform_driver(es8316_driver);
+
+MODULE_AUTHOR("hsjung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("Sound codec-es8316 driver for Nexell sound");
+MODULE_LICENSE("GPL");
diff -ENwbur a/sound/soc/nexell/nexell-i2s.c b/sound/soc/nexell/nexell-i2s.c
--- a/sound/soc/nexell/nexell-i2s.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-i2s.c	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,914 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+
+#include <linux/init.h>
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#ifdef CONFIG_RESET_CONTROLLER
+#include <linux/reset.h>
+#endif
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+#include <linux/pm_qos.h>
+#include <linux/soc/nexell/cpufreq.h>
+#endif
+
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+#include "nexell-i2s.h"
+
+#define	DEF_SAMPLE_RATE			48000
+#define	DEF_FRAME_BIT			32	/* 32, 48(BFS) */
+
+#define	I2S_BASEADDR			0xC0055000
+#define	I2S_CH_OFFSET			0x1000
+#define	I2S_BUS_WIDTH			4	/* Byte */
+#define	I2S_PERI_BURST			4	/* Byte */
+#define	I2S_MAX_CLOCK			166000000
+
+#define	I2S0_PRESETn			(23)
+#define	I2S1_PRESETn			(24)
+#define	I2S2_PRESETn			(25)
+
+/*
+ * I2S register
+ */
+struct i2s_register {
+	unsigned int CON;		/* 0x00 */
+	unsigned int CSR;		/* 0x04 */
+	unsigned int FIC;		/* 0x08 */
+};
+
+#define	I2S_CON_OFFSET			(0x00)
+#define	I2S_CSR_OFFSET			(0x04)
+#define	I2S_FIC_OFFSET			(0x08)
+#define	I2S_TXD_OFFSET			(0x10)
+#define	I2S_RXD_OFFSET			(0x14)
+
+#define	CON_TXDMAPAUSE_POS		6
+#define	CON_RXDMAPAUSE_POS		5
+#define	CON_TXCHPAUSE_POS		4
+#define	CON_RXCHPAUSE_POS		3
+#define	CON_TXDMACTIVE_POS		2
+#define	CON_RXDMACTIVE_POS		1
+#define	CON_I2SACTIVE_POS		0
+
+#define	CSR_BLC_POS			13
+#define	CSR_CDCLKCON_POS		12
+#if defined(CONFIG_ARCH_S5P4418)
+#define	CSR_IMS_POS			10
+#elif defined(CONFIG_ARCH_S5P6818)
+#define	CSR_IMS_POS			11
+#endif
+#define	CSR_TXR_POS			8
+#define	CSR_LRP_POS			7
+#define	CSR_SDF_POS			5
+#define	CSR_RFS_POS			3
+#define	CSR_BFS_POS			1
+
+#if defined(CONFIG_ARCH_S5P4418)
+#define	IMS_BIT_EXTCLK			(1<<0)
+#define	IMS_BIT_SLAVE			(3<<0)
+#elif defined(CONFIG_ARCH_S5P6818)
+#define	IMS_BIT_EXTCLK			(0<<0)
+#define	IMS_BIT_SLAVE			(1<<0)
+#endif
+
+#define BLC_8BIT			1
+#define BLC_16BIT			0
+#define BLC_24BIT			2
+
+#define TX_MODE				0
+#define RX_MODE				1
+#define TXRX_MODE			2
+#define TRANS_MODE_MASK			3
+
+#define BFS_16BIT			2
+#define BFS_24BIT			3
+#define BFS_32BIT			0
+#define BFS_48BIT			1
+
+#define RATIO_256			0
+#define RATIO_384			2
+
+#define FIC_TFULSH_POS			15
+#define FIC_RFULSH_POS			7
+
+#define FIC_FLUSH_EN			1
+
+struct clock_ratio {
+	unsigned int sample_rate;
+	unsigned int ratio_256;
+	unsigned int ratio_384;
+};
+
+static struct clock_ratio clk_ratio[] = {
+	{   8000,  2048000,  3072000 },
+	{  11025,  2822400,  4233600 },
+	{  16000,  4096000,  6144000 },
+	{  22050,  5644800,  8467200 },
+	{  32000,  8192000, 12288000 },
+	{  44100, 11289600, 16934400 },
+	{  48000, 12288000, 18432000 },
+	{  64000, 16384000, 24576000 },
+	{  88200, 22579200, 33868800 },
+	{  96000, 24576000, 36864000 },
+	{ 192000, 49152000, 73728000 },
+};
+
+/*
+ * parameters
+ */
+struct nx_i2s_snd_param {
+	int channel;
+	int master_mode;	/* 1 = master_mode, 0 = slave */
+	int mclk_in;
+	int trans_mode;		/* 0 = I2S, 1 = Left-Justified,
+				   2 = Right-Justified  */
+	int sample_rate;
+	int frame_bit;		/* 16, 24, 32, 48 */
+	int LR_pol_inv;
+	int in_clkgen;
+	int pre_supply_mclk;
+	bool ext_is_en;
+	unsigned long (*set_ext_mclk)(unsigned long clk, int ch);
+	int status;
+	spinlock_t lock;
+	unsigned long flags;
+	/* clock control */
+	struct clk *clk;
+	long clk_rate;
+	/* DMA channel */
+	struct nx_pcm_dma_param play;
+	struct nx_pcm_dma_param capt;
+	/* Register */
+	void __iomem *base_addr;
+	struct i2s_register i2s;
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	struct work_struct qos_work;
+#endif
+};
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+static struct pm_qos_request nx_i2s_qos;
+
+static void nx_i2s_qos_update(int val)
+{
+	if (!pm_qos_request_active(&nx_i2s_qos))
+		pm_qos_add_request(&nx_i2s_qos, PM_QOS_BUS_THROUGHPUT, val);
+	else
+		pm_qos_update_request(&nx_i2s_qos, val);
+}
+
+static void qos_worker(struct work_struct *work)
+{
+	nx_i2s_qos_update(NX_BUS_CLK_IDLE_KHZ);
+}
+#endif
+
+#define	SND_I2S_LOCK_INIT(x)		spin_lock_init(x)
+#define	SND_I2S_LOCK(x, f)		spin_lock_irqsave(x, f)
+#define	SND_I2S_UNLOCK(x, f)		spin_unlock_irqrestore(x, f)
+
+static int set_sample_rate_clock(struct device *dev, struct clk *clk,
+				 unsigned long request,	unsigned long *rate_hz)
+{
+	unsigned long find, rate = 0, clock = request;
+	int dio = 0, din = 0, div = 1;
+	int ret = 0;
+
+	/* form clock generator */
+	find = clk_round_rate(clk, clock);
+	din = abs(find - clock);
+	dio = din, rate = find;
+	div = 0, ret = 0;
+	clk_set_rate(clk, find);
+
+	dev_dbg(dev, "%s: req=%ld, acq=%ld, div=%2d\n",
+		__func__, request, rate, div);
+
+	if (rate_hz)
+		*rate_hz = rate;
+	return ret;
+}
+
+static void supply_master_clock(struct device *dev,
+				struct nx_i2s_snd_param *par)
+{
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+
+	dev_dbg(dev, "%s: %s (status=0x%x)\n",
+		__func__, par->master_mode?"master":"slave", par->status);
+
+	if (!par->master_mode ||
+		(SNDDEV_STATUS_POWER & par->status))
+		return;
+
+	if (par->in_clkgen)
+		clk_prepare_enable(par->clk);
+
+	i2s->CSR &= ~(1 << CSR_CDCLKCON_POS);
+	writel(i2s->CSR, (base+I2S_CSR_OFFSET));
+
+	par->status |= SNDDEV_STATUS_POWER;
+}
+
+static void cutoff_master_clock(struct device *dev,
+				struct nx_i2s_snd_param *par)
+{
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+
+	dev_dbg(dev, "%s: %s (status=0x%x)\n",
+		__func__, par->master_mode?"master":"slave", par->status);
+
+	if (!par->master_mode ||
+		!(SNDDEV_STATUS_POWER & par->status))
+		return;
+
+	if (par->in_clkgen)
+		clk_disable_unprepare(par->clk);
+
+	/* when high is MCLK OUT enable */
+	i2s->CSR |= (1 << CSR_CDCLKCON_POS);
+	writel(i2s->CSR, (base+I2S_CSR_OFFSET));
+
+	par->status &= ~SNDDEV_STATUS_POWER;
+}
+
+static void i2s_reset(struct device *dev)
+{
+#ifdef CONFIG_RESET_CONTROLLER
+	struct reset_control *rst;
+
+	rst = devm_reset_control_get(dev, "i2s-reset");
+
+	if (!IS_ERR(rst)) {
+		if (reset_control_status(rst))
+			reset_control_reset(rst);
+	}
+#endif
+}
+
+static int i2s_start(struct snd_soc_dai *dai, int stream)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+	unsigned int FIC = 0;
+
+	dev_dbg(dai->dev, "%s %d\n", __func__, par->channel);
+
+	SND_I2S_LOCK(&par->lock, par->flags);
+
+	if (!par->pre_supply_mclk) {
+		if (par->ext_is_en)
+			par->set_ext_mclk(true, par->channel);
+		supply_master_clock(dai->dev, par);
+	}
+
+	if (SNDRV_PCM_STREAM_PLAYBACK == stream) {
+		/* flush fifo */
+		FIC |= (FIC_FLUSH_EN << FIC_TFULSH_POS);
+		i2s->CON |=  ((1 << CON_TXDMACTIVE_POS) |
+			      (1 << CON_I2SACTIVE_POS));
+		i2s->CSR &= ~(TRANS_MODE_MASK << CSR_TXR_POS);
+		/* Transmit only */
+		i2s->CSR |=  (TX_MODE << CSR_TXR_POS);
+		par->status |= SNDDEV_STATUS_PLAY;
+	} else {
+		/* flush fifo */
+		FIC |= (FIC_FLUSH_EN << FIC_RFULSH_POS);
+		i2s->CON |=  ((1 << CON_RXDMACTIVE_POS) |
+			      (1 << CON_I2SACTIVE_POS));
+		i2s->CSR &= ~(TRANS_MODE_MASK << CSR_TXR_POS);
+		/* Receive only */
+		i2s->CSR |=  (RX_MODE << CSR_TXR_POS);
+		par->status |= SNDDEV_STATUS_CAPT;
+	}
+
+	if ((par->status & SNDDEV_STATUS_PLAY) &&
+		(par->status & SNDDEV_STATUS_CAPT)) {
+		i2s->CSR &= ~(TRANS_MODE_MASK << CSR_TXR_POS);
+		/* Transmit and Receive simultaneous mode */
+		i2s->CSR |=  (TXRX_MODE << CSR_TXR_POS);
+	}
+
+	writel(FIC, (base+I2S_FIC_OFFSET));	/* Flush the current FIFO */
+	writel(0x0, (base+I2S_FIC_OFFSET));	/* Clear the Flush bit */
+
+	writel(i2s->CSR, (base+I2S_CSR_OFFSET));
+	writel(i2s->CON, (base+I2S_CON_OFFSET));
+
+	SND_I2S_UNLOCK(&par->lock, par->flags);
+
+	return 0;
+}
+
+static void i2s_stop(struct snd_soc_dai *dai, int stream)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+
+	dev_dbg(dai->dev, "%s %d\n", __func__, par->channel);
+
+	SND_I2S_LOCK(&par->lock, par->flags);
+
+	if (SNDRV_PCM_STREAM_PLAYBACK == stream) {
+		par->status &= ~SNDDEV_STATUS_PLAY;
+		i2s->CON &= ~(1 << CON_TXDMACTIVE_POS);
+		i2s->CSR &= ~(TRANS_MODE_MASK << CSR_TXR_POS);
+		/* Receive only */
+		i2s->CSR |=  (RX_MODE << CSR_TXR_POS);
+	} else {
+		par->status &= ~SNDDEV_STATUS_CAPT;
+		i2s->CON &= ~(1 << CON_RXDMACTIVE_POS);
+		i2s->CSR &= ~(TRANS_MODE_MASK << CSR_TXR_POS);
+		/* Transmit only */
+		i2s->CSR |=  (TX_MODE << CSR_TXR_POS);
+	}
+
+	if (!(par->status & SNDDEV_STATUS_RUNNING)) {
+		if (!par->pre_supply_mclk)
+			i2s->CON &= ~(1 << CON_I2SACTIVE_POS);
+		/* no tx/rx */
+		i2s->CSR |=  (TRANS_MODE_MASK << CSR_TXR_POS);
+	}
+
+	writel(i2s->CON, (base+I2S_CON_OFFSET));
+	writel(i2s->CSR, (base+I2S_CSR_OFFSET));
+
+	/* I2S Inactive */
+	if (!(par->status & SNDDEV_STATUS_RUNNING) &&
+		!par->pre_supply_mclk) {
+		cutoff_master_clock(dai->dev, par);
+		if (par->ext_is_en)
+			par->set_ext_mclk(false, par->channel);
+	}
+
+	SND_I2S_UNLOCK(&par->lock, par->flags);
+}
+
+static struct snd_soc_dai_driver i2s_dai_driver;
+
+static int nx_i2s_check_param(struct nx_i2s_snd_param *par, struct device *dev)
+{
+	static struct snd_soc_dai_driver *dai = &i2s_dai_driver;
+	struct i2s_register *i2s = &par->i2s;
+	struct nx_pcm_dma_param *dmap_play = &par->play;
+	struct nx_pcm_dma_param *dmap_capt = &par->capt;
+	void __iomem *base = par->base_addr;
+	unsigned long request = 0, rate_hz = 0;
+	int i = 0;
+
+	int LRP, IMS, BLC = BLC_16BIT, BFS = 0, RFS = RATIO_256;
+	int SDF = 0, OEN = 0;
+
+	IMS = par->master_mode ? IMS_BIT_EXTCLK : IMS_BIT_SLAVE;
+	/* 0:I2S, 1:Left 2:Right justfied */
+	SDF = par->trans_mode & 0x03;
+	LRP = par->LR_pol_inv ? 1 : 0;
+	/* Active low : MLCK out enable */
+	OEN = !par->master_mode ? 1 : par->mclk_in;
+
+	switch (par->frame_bit) {
+	case 32:
+		BFS = BFS_32BIT; break;
+	case 48:
+		BFS = BFS_48BIT; break;
+	default:
+		dev_err(dev, "Fail, not support i2s frame bits");
+		dev_err(dev, "%d (32, 48)\n", par->frame_bit);
+		return -EINVAL;
+	}
+
+	if (!par->master_mode) {
+		/* 384 RATIO */
+		RFS = RATIO_384, request = clk_ratio[i].ratio_384;
+		/* 256 RATIO */
+		if (BFS_32BIT == BFS)
+			RFS = RATIO_256, request = clk_ratio[i].ratio_256;
+		goto done;
+	}
+
+	for (i = 0; ARRAY_SIZE(clk_ratio) > i; i++) {
+		if (par->sample_rate == clk_ratio[i].sample_rate)
+			break;
+	}
+
+	if (i >= ARRAY_SIZE(clk_ratio)) {
+		dev_err(dev, "Fail, not support i2s sample rate %d\n",
+			par->sample_rate);
+		return -EINVAL;
+	}
+
+	if (par->ext_is_en) {
+		if (BFS_48BIT == BFS)
+			request = clk_ratio[i].ratio_384;
+		else
+			request = clk_ratio[i].ratio_256;
+	    par->set_ext_mclk(request, par->channel);
+	}
+
+	/* 384 RATIO */
+	RFS = RATIO_384, request = clk_ratio[i].ratio_384;
+	set_sample_rate_clock(dev, par->clk, request, &rate_hz);
+
+
+	/* 256 RATIO */
+	if (rate_hz != request && BFS_32BIT == BFS) {
+		unsigned int rate = rate_hz;
+
+		RFS = RATIO_256, request = clk_ratio[i].ratio_256;
+		set_sample_rate_clock(dev, par->clk, request, &rate_hz);
+		if (abs(request - rate_hz) >
+			abs(request - rate)) {
+			rate_hz = rate, RFS = RATIO_384;
+		}
+	}
+
+	/* input clock */
+	clk_set_rate(par->clk, rate_hz);
+	par->clk_rate = rate_hz;
+	par->in_clkgen = 1;
+
+done:
+	i2s->CSR =	(BLC << CSR_BLC_POS) |
+				(OEN << CSR_CDCLKCON_POS) |
+				(IMS << CSR_IMS_POS) |
+				(LRP << CSR_LRP_POS) |
+				(SDF << CSR_SDF_POS) |
+				(RFS << CSR_RFS_POS) |
+				(BFS << CSR_BFS_POS);
+	i2s_reset(dev);
+
+	if (par->pre_supply_mclk) {
+		if (par->ext_is_en)
+			rate_hz = par->set_ext_mclk(true, par->channel);
+		supply_master_clock(dev, par);
+		i2s->CON |=  1 << CON_I2SACTIVE_POS;
+		writel(i2s->CON, (base+I2S_CON_OFFSET));
+	} else {
+		if (par->ext_is_en) {
+			rate_hz = par->set_ext_mclk(true, par->channel);
+			par->set_ext_mclk(false, par->channel);
+		}
+	}
+
+	dmap_play->real_clock = rate_hz/(RATIO_256 == RFS ? 256:384);
+	dmap_capt->real_clock = rate_hz/(RATIO_256 == RFS ? 256:384);
+	dev_info(dev, "snd i2s: ch %d, %s, %s mode, %d(%ld)hz, %d FBITs,",
+	       par->channel, par->master_mode ? "master":"slave",
+	       par->trans_mode == 0 ? "iis" :
+	       (par->trans_mode == 1 ? "left justified" : "right justified"),
+	       par->sample_rate, rate_hz/(RATIO_256 == RFS ? 256:384),
+	       par->frame_bit);
+	dev_info(dev, "MCLK=%ldhz, RFS=%d\n", rate_hz,
+		 (RATIO_256 == RFS ? 256:384));
+	dev_dbg(dev, "snd i2s: BLC=%d, IMS=%d, LRP=%d", BLC, IMS, LRP);
+	dev_dbg(dev, "SDF=%d, RFS=%d, BFS=%d\n", SDF, RFS, BFS);
+
+	/* i2s support format */
+	if (RFS == RATIO_256 || BFS != BFS_48BIT) {
+		dai->playback.formats &= ~(SNDRV_PCM_FMTBIT_S24_LE |
+					   SNDRV_PCM_FMTBIT_U24_LE);
+		dai->capture.formats  &= ~(SNDRV_PCM_FMTBIT_S24_LE |
+					   SNDRV_PCM_FMTBIT_U24_LE);
+	}
+
+	return 0;
+}
+
+static int nx_i2s_set_plat_param(struct nx_i2s_snd_param *par, void *data)
+{
+	struct platform_device *pdev = data;
+	struct nx_pcm_dma_param *dma = &par->play;
+	unsigned int phy_base = 0;
+	int i = 0, ret = 0;
+	unsigned int id = 0;
+	static struct snd_soc_dai_driver *dai = &i2s_dai_driver;
+
+	id = of_alias_get_id(pdev->dev.of_node, "i2s");
+
+	par->channel = id;
+
+	phy_base = I2S_BASEADDR + (par->channel * I2S_CH_OFFSET);
+
+	of_property_read_u32(pdev->dev.of_node, "master-mode",
+			     &par->master_mode);
+	of_property_read_u32(pdev->dev.of_node, "mclk-in",
+			     &par->mclk_in);
+	of_property_read_u32(pdev->dev.of_node, "trans-mode",
+			     &par->trans_mode);
+	of_property_read_u32(pdev->dev.of_node, "frame-bit",
+			     &par->frame_bit);
+	if (!par->frame_bit)
+		par->frame_bit = DEF_FRAME_BIT;
+
+	if (par->frame_bit == 32) {
+		dai->playback.formats = SNDRV_PCM_FMTBIT_S16_LE;
+		dai->capture.formats = SNDRV_PCM_FMTBIT_S16_LE;
+	} else {
+		dai->playback.formats = SNDRV_PCM_FMTBIT_S24_LE;
+		dai->capture.formats = SNDRV_PCM_FMTBIT_S24_LE;
+	}
+
+	of_property_read_u32(pdev->dev.of_node, "sample-rate",
+			     &par->sample_rate);
+	if (!par->sample_rate)
+		par->sample_rate = DEF_SAMPLE_RATE;
+
+	dai->playback.rates =
+		snd_pcm_rate_to_rate_bit(par->sample_rate);
+	dai->capture.rates =
+		snd_pcm_rate_to_rate_bit(par->sample_rate);
+
+	of_property_read_u32(pdev->dev.of_node, "pre-supply-mclk",
+			     &par->pre_supply_mclk);
+	of_property_read_u32(pdev->dev.of_node, "LR-pol-inv",
+			     &par->LR_pol_inv);
+	par->base_addr = of_iomap(pdev->dev.of_node, 0);
+	SND_I2S_LOCK_INIT(&par->lock);
+
+	for (i = 0; 2 > i; i++, dma = &par->capt) {
+		dma->active = true;
+		dma->dev = &pdev->dev;
+
+		/* I2S TXD/RXD */
+		dma->peri_addr = phy_base + (i == 0 ? I2S_TXD_OFFSET :
+					     I2S_RXD_OFFSET);
+		dma->bus_width_byte = I2S_BUS_WIDTH;
+		dma->max_burst_byte = I2S_PERI_BURST;
+		dev_dbg(&pdev->dev, "snd i2s: %s dma (peri 0x%p, bus %dbits)\n",
+			STREAM_STR(i), (void *)dma->peri_addr,
+			dma->bus_width_byte*8);
+	}
+
+	par->clk = clk_get(&pdev->dev, NULL);
+	if (IS_ERR(par->clk)) {
+		ret = PTR_ERR(par->clk);
+		return ret;
+	}
+
+	return nx_i2s_check_param(par, &pdev->dev);
+}
+
+static int nx_i2s_setup(struct snd_soc_dai *dai)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+
+	SND_I2S_LOCK(&par->lock, par->flags);
+
+	if (SNDDEV_STATUS_SETUP & par->status) {
+		SND_I2S_UNLOCK(&par->lock, par->flags);
+		return 0;
+	}
+
+	writel(i2s->CSR, (base+I2S_CSR_OFFSET));
+
+	par->status |= SNDDEV_STATUS_SETUP;
+
+	SND_I2S_UNLOCK(&par->lock, par->flags);
+
+	return 0;
+}
+
+static void nx_i2s_release(struct snd_soc_dai *dai)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+
+	SND_I2S_LOCK(&par->lock, par->flags);
+
+	i2s->CON = ~((1 << CON_TXDMAPAUSE_POS) | (1 << CON_RXDMAPAUSE_POS) |
+		    (1 << CON_TXCHPAUSE_POS) | (1 << CON_RXCHPAUSE_POS) |
+		    (1 << CON_TXDMACTIVE_POS) | (1 << CON_RXDMACTIVE_POS) |
+		    (1 << CON_I2SACTIVE_POS));
+
+	writel(i2s->CON, (base+I2S_CON_OFFSET));
+
+	cutoff_master_clock(dai->dev, par);
+	clk_put(par->clk);
+
+	par->status = SNDDEV_STATUS_CLEAR;
+
+	SND_I2S_UNLOCK(&par->lock, par->flags);
+}
+
+/*
+ * snd_soc_dai_ops
+ */
+static int nx_i2s_startup(struct snd_pcm_substream *substream,
+				struct snd_soc_dai *dai)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct nx_pcm_dma_param *dmap
+		= SNDRV_PCM_STREAM_PLAYBACK == substream->stream ?
+		&par->play : &par->capt;
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	nx_i2s_qos_update(NX_BUS_CLK_AUDIO_KHZ);
+#endif
+
+	snd_soc_dai_set_dma_data(dai, substream, dmap);
+
+	return 0;
+}
+
+static void nx_i2s_shutdown(struct snd_pcm_substream *substream,
+				struct snd_soc_dai *dai)
+{
+	i2s_stop(dai, substream->stream);
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	nx_i2s_qos_update(NX_BUS_CLK_IDLE_KHZ);
+#endif
+}
+
+static int nx_i2s_trigger(struct snd_pcm_substream *substream,
+				int cmd, struct snd_soc_dai *dai)
+{
+	int stream = substream->stream;
+
+	dev_dbg(dai->dev, "%s: %s cmd=%d\n", __func__, STREAM_STR(stream), cmd);
+
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+	case SNDRV_PCM_TRIGGER_START:
+		i2s_start(dai, stream);
+		break;
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+	case SNDRV_PCM_TRIGGER_STOP:
+		i2s_stop(dai, stream);
+		break;
+
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int nx_i2s_hw_params(struct snd_pcm_substream *substream,
+			    struct snd_pcm_hw_params *params,
+			    struct snd_soc_dai *dai)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct i2s_register *i2s = &par->i2s;
+	unsigned int format = params_format(params);
+	int RFS = (i2s->CSR >> CSR_RFS_POS) & 0x3;
+	int BFS = (i2s->CSR >> CSR_BFS_POS) & 0x3;
+	int BLC = (i2s->CSR >> CSR_BLC_POS) & 0x3;
+	int ret = 0;
+
+	switch (format) {
+	case SNDRV_PCM_FORMAT_S8:
+		dev_dbg(dai->dev, "i2s: change sample bits S08\n");
+		if (BLC != BLC_8BIT) {
+			i2s->CSR &= ~(0x3 << CSR_BLC_POS);
+			i2s->CSR |=  (BLC_8BIT << CSR_BLC_POS);
+		}
+		break;
+	case SNDRV_PCM_FORMAT_S16_LE:
+		dev_dbg(dai->dev, "i2s: change i2s sample bits %s -> S16\n",
+			 BLC == BLC_16BIT ? "S16":"S24");
+		if (BLC != BLC_16BIT) {
+			i2s->CSR &= ~(0x3 << CSR_BLC_POS);
+			i2s->CSR |=  (BLC_16BIT << CSR_BLC_POS);
+		}
+		break;
+	case SNDRV_PCM_FORMAT_S24_LE:
+		dev_dbg(dai->dev, "i2s: change i2s sample bits %s -> S24\n",
+			 BLC == BLC_16BIT ? "S16":"S24");
+		if (RFS == RATIO_256 || BFS != BFS_48BIT) {
+			dev_err(dai->dev, "Fail, i2s RFS 256/BFS 32 not support");
+			dev_err(dai->dev, "24 sample bits\n");
+			return -EINVAL;
+		}
+		if (BLC != BLC_24BIT) {
+			i2s->CSR &= ~(0x3 << CSR_BLC_POS);
+			i2s->CSR |=  (BLC_24BIT << CSR_BLC_POS);
+		}
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+static int nx_i2s_set_sysclk(struct snd_soc_dai *dai,
+				   int clk_id, unsigned int freq, int dir)
+{
+	return 0;
+}
+
+static struct snd_soc_dai_ops nx_i2s_ops = {
+	.startup	= nx_i2s_startup,
+	.shutdown	= nx_i2s_shutdown,
+	.trigger	= nx_i2s_trigger,
+	.hw_params	= nx_i2s_hw_params,
+	.set_sysclk	= nx_i2s_set_sysclk,
+};
+
+/*
+ * snd_soc_dai_driver
+ */
+static int nx_i2s_dai_suspend(struct snd_soc_dai *dai)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+
+	dev_dbg(dai->dev, "%s\n", __func__);
+
+	if (par->in_clkgen)
+		clk_disable_unprepare(par->clk);
+	return 0;
+}
+
+static int nx_i2s_dai_resume(struct snd_soc_dai *dai)
+{
+	struct nx_i2s_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct i2s_register *i2s = &par->i2s;
+	void __iomem *base = par->base_addr;
+	unsigned int FIC = 0;
+
+	dev_dbg(dai->dev, "%s\n", __func__);
+
+	i2s_reset(dai->dev);
+
+	if (par->pre_supply_mclk && par->ext_is_en)
+		par->set_ext_mclk(true, par->channel);
+
+	if (par->master_mode && par->in_clkgen) {
+		clk_set_rate(par->clk, par->clk_rate);
+		if (SNDDEV_STATUS_POWER & par->status)
+			clk_prepare_enable(par->clk);
+	}
+
+	/* flush fifo */
+	FIC |= (par->status & SNDDEV_STATUS_PLAY) ? (1 << 15) : 0;
+	FIC |= (par->status & SNDDEV_STATUS_CAPT) ? (1 << 7) : 0;
+
+	writel(FIC, (base+I2S_FIC_OFFSET));	/* Flush the current FIFO */
+	writel(0x0, (base+I2S_FIC_OFFSET));	/* Clear the Flush bit */
+	writel(i2s->CSR, (base+I2S_CSR_OFFSET));
+	writel(i2s->CON, (base+I2S_CON_OFFSET));
+
+	return 0;
+}
+
+static int nx_i2s_dai_probe(struct snd_soc_dai *dai)
+{
+	return nx_i2s_setup(dai);
+}
+
+static int nx_i2s_dai_remove(struct snd_soc_dai *dai)
+{
+	nx_i2s_release(dai);
+	return 0;
+}
+
+static struct snd_soc_dai_driver i2s_dai_driver = {
+	.probe		= nx_i2s_dai_probe,
+	.remove		= nx_i2s_dai_remove,
+	.suspend	= nx_i2s_dai_suspend,
+	.resume		= nx_i2s_dai_resume,
+	.playback	= {
+		.channels_min	= 2,
+		.channels_max	= 2,
+		.formats		= SND_SOC_I2S_FORMATS,
+		.rates			= SND_SOC_I2S_RATES,
+		.rate_min		= 0,
+		.rate_max		= 1562500,
+		},
+	.capture	= {
+		.channels_min	= 2,
+		.channels_max	= 2,
+		.formats		= SND_SOC_I2S_FORMATS,
+		.rates			= SND_SOC_I2S_RATES,
+		.rate_min		= 0,
+		.rate_max		= 1562500,
+		},
+	.ops = &nx_i2s_ops,
+	.symmetric_rates = 1,
+};
+
+static const struct snd_soc_component_driver nx_i2s_component = {
+	.name = "nx-i2sc",
+};
+
+static int nx_i2s_probe(struct platform_device *pdev)
+{
+	struct nx_i2s_snd_param *par;
+	int ret = 0;
+
+	/*  allocate i2c_port data */
+	par = kzalloc(sizeof(struct nx_i2s_snd_param), GFP_KERNEL);
+	if (!par)
+		return -ENOMEM;
+
+	ret = nx_i2s_set_plat_param(par, pdev);
+	if (ret)
+		goto err_out;
+
+	ret = devm_snd_soc_register_component(&pdev->dev, &nx_i2s_component,
+					 &i2s_dai_driver, 1);
+	if (ret) {
+		dev_err(&pdev->dev, "fail, %s snd_soc_register_component ...\n",
+		       pdev->name);
+		goto err_out;
+	}
+
+	ret = devm_snd_soc_register_platform(&pdev->dev, &nx_pcm_platform);
+	if (ret) {
+		dev_err(&pdev->dev, "fail, snd_soc_register_platform ...\n");
+		goto err_out;
+	}
+
+#ifdef CONFIG_ARM_S5Pxx18_DEVFREQ
+	INIT_WORK(&par->qos_work, qos_worker);
+#endif
+
+	dev_set_drvdata(&pdev->dev, par);
+	return ret;
+
+err_out:
+	kfree(NULL);
+	return ret;
+}
+
+static int nx_i2s_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_component(&pdev->dev);
+	kfree(NULL);
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nx_i2s_match[] = {
+	{ .compatible = "nexell,nexell-i2s" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_i2s_match);
+#else
+#define nx_i2s_match NULL
+#endif
+
+static struct platform_driver i2s_driver = {
+	.probe  = nx_i2s_probe,
+	.remove = nx_i2s_remove,
+	.driver = {
+		.name	= "nexell-i2s",
+		.owner	= THIS_MODULE,
+	.of_match_table = of_match_ptr(nx_i2s_match),
+	},
+};
+
+static int __init nx_i2s_init(void)
+{
+	return platform_driver_register(&i2s_driver);
+}
+
+static void __exit nx_i2s_exit(void)
+{
+	platform_driver_unregister(&i2s_driver);
+}
+
+module_init(nx_i2s_init);
+module_exit(nx_i2s_exit);
+
+MODULE_AUTHOR("hsjung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("Sound I2S driver for Nexell sound");
+MODULE_LICENSE("GPL");
diff -ENwbur a/sound/soc/nexell/nexell-i2s.h b/sound/soc/nexell/nexell-i2s.h
--- a/sound/soc/nexell/nexell-i2s.h	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-i2s.h	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_I2S_H__
+#define __NX_I2S_H__
+
+#include "nexell-pcm.h"
+
+#define SND_SOC_I2S_FORMATS	(SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S8 | \
+			SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_U16_LE | \
+			SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_U24_LE)
+
+#define SND_SOC_I2S_RATES	SNDRV_PCM_RATE_8000_192000
+
+#endif /* __NX_I2S_H__ */
+
diff -ENwbur a/sound/soc/nexell/nexell-null.c b/sound/soc/nexell/nexell-null.c
--- a/sound/soc/nexell/nexell-null.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-null.c	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+
+#include "nexell-pcm.h"
+
+#define I2S_BASEADDR            0xC0055000
+#define I2S_CH_OFFSET           0x1000
+
+static char str_dai_name[16] = "c0055000.i2s";
+
+#define STUB_RATES	SNDRV_PCM_RATE_8000_192000
+#define STUB_FORMATS	(SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+static struct snd_soc_codec_driver soc_codec_snd_null;
+
+static struct snd_soc_dai_driver null_stub_dai = {
+	.name		= "snd-null-voice",
+	.playback	= {
+		.stream_name	= "Null Playback",
+		.channels_min	= 1,
+		.channels_max	= 2,
+		.rates			= STUB_RATES,
+		.formats		= STUB_FORMATS,
+	},
+	.capture	= {
+		.stream_name	= "Null Capture",
+		.channels_min	= 1,
+		.channels_max	= 2,
+		.rates			= STUB_RATES,
+		.formats		= STUB_FORMATS,
+	},
+};
+
+static int snd_null_probe(struct platform_device *pdev)
+{
+	int ret = snd_soc_register_codec(&pdev->dev, &soc_codec_snd_null,
+			&null_stub_dai, 1);
+	if (ret < 0)
+		dev_err(&pdev->dev,
+			"snd null codec driver register fail.(%d)\n", ret);
+	return ret;
+}
+
+static int snd_null_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_codec(&pdev->dev);
+	return 0;
+}
+
+/*
+ * SND-NULL codec
+ */
+
+#ifdef CONFIG_OF
+static const struct of_device_id snd_null_match[] = {
+	{ .compatible = "nexell,snd-null" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_null_match);
+#else
+#define snd_null_match NULL
+#endif
+
+static struct platform_driver snd_null_driver = {
+	.probe		= snd_null_probe,
+	.remove		= snd_null_remove,
+	.driver		= {
+		.name	= "snd-null",
+		.owner	= THIS_MODULE,
+		.of_match_table = of_match_ptr(snd_null_match),
+	},
+};
+
+module_platform_driver(snd_null_driver);
+
+MODULE_AUTHOR("hsjung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("ASoc NULL codec driver");
+MODULE_LICENSE("GPL");
+
+/*
+ * SND-NULL Card DAI
+ */
+static struct snd_soc_dai_link snd_null_dai_link = {
+	.name		= "ASoc-NULL",
+	.stream_name	= "Null Voice",
+	.cpu_dai_name	= str_dai_name,
+	.platform_name  = "nexell-pcm",		/* nx_snd_pcm_driver name */
+	.codec_dai_name = "snd-null-voice",
+	.codec_name	= "0.snd-null",
+	.symmetric_rates = 1,
+};
+
+static struct snd_soc_card snd_null_card[] = {
+	{
+	.name		= "SND-NULL.0",	/* proc/asound/cards */
+	.dai_link	= &snd_null_dai_link,
+	.num_links	= 1,
+	},
+	{
+	.name		= "SND-NULL.1",	/* proc/asound/cards */
+	.dai_link	= &snd_null_dai_link,
+	.num_links	= 1,
+	},
+	{
+	.name		= "SND-NULL.2",	/* proc/asound/cards */
+	.dai_link	= &snd_null_dai_link,
+	.num_links	= 1,
+	},
+};
+
+static int snd_card_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &snd_null_card[0];
+	struct snd_soc_dai_driver *cpudrv = NULL;
+	unsigned int rates = 0, format = 0;
+	int ret;
+	int ch;
+	const char *format_name;
+
+	/* set I2S name */
+	of_property_read_u32(pdev->dev.of_node, "ch", &ch);
+	sprintf(str_dai_name, "%x%s", (I2S_BASEADDR + (ch * I2S_CH_OFFSET)),
+		".i2s");
+	card = &snd_null_card[ch];
+	of_property_read_u32(pdev->dev.of_node, "sample-rate", &rates);
+	format_name = of_get_property(pdev->dev.of_node, "format", NULL);
+	if (format_name != NULL) {
+		if (strcmp(format_name, "S16") == 0)
+			format = SNDRV_PCM_FMTBIT_S16_LE;
+		else if (strcmp(format_name, "S24") == 0) {
+			format = SNDRV_PCM_FMTBIT_S16_LE |
+				SNDRV_PCM_FMTBIT_S24_LE;
+		}
+	}
+
+	card->dev = &pdev->dev;
+	ret = snd_soc_register_card(card);
+	if (ret) {
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+		return ret;
+	}
+
+	if (card->rtd) {
+		struct snd_soc_dai *cpu_dai = card->rtd->cpu_dai;
+
+		if (cpu_dai)
+			cpudrv = cpu_dai->driver;
+	}
+	dev_dbg(&pdev->dev, "snd-null-dai: register card %s -> %s\n",
+		card->dai_link->codec_dai_name, card->dai_link->cpu_dai_name);
+
+	if (NULL == cpudrv)
+		return 0;
+
+	/*
+	 * Reset i2s sample rates
+	 */
+	if (rates) {
+		rates = snd_pcm_rate_to_rate_bit(rates);
+		if (SNDRV_PCM_RATE_KNOT == rates)
+			dev_err(&pdev->dev,
+				"%s, invalid sample rates=%d\n", __func__,
+			       rates);
+		else {
+			cpudrv->playback.rates = rates;
+			cpudrv->capture.rates = rates;
+		}
+	}
+
+	/*
+	 * Reset i2s format
+	 */
+	if (format) {
+		cpudrv->playback.formats = format;
+		cpudrv->capture.formats = format;
+	}
+
+	return ret;
+}
+
+static int snd_card_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	snd_soc_unregister_card(card);
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id snd_null_card_match[] = {
+	{ .compatible = "nexell,snd-null-card" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, snd_null_card_match);
+#else
+#define snd_null_card_match NULL
+#endif
+
+static struct platform_driver snd_card_driver = {
+	.driver		= {
+		.name	= "snd-null-card",
+		.owner	= THIS_MODULE,
+		.pm	= &snd_soc_pm_ops,	/* for suspend */
+		.of_match_table = of_match_ptr(snd_null_card_match),
+	},
+	.probe		= snd_card_probe,
+	.remove		= snd_card_remove,
+};
+module_platform_driver(snd_card_driver);
+
+MODULE_AUTHOR("hsjung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("Sound codec-null driver for Nexell Audio");
+MODULE_LICENSE("GPL");
diff -ENwbur a/sound/soc/nexell/nexell-pcm.c b/sound/soc/nexell/nexell-pcm.c
--- a/sound/soc/nexell/nexell-pcm.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-pcm.c	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,649 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/dmaengine.h>
+#include <linux/syscalls.h>
+#include <linux/fcntl.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/vmalloc.h>
+#include <linux/uaccess.h>
+
+#include <sound/core.h>
+#include <sound/initval.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+#include "nexell-pcm.h"
+
+/* #define DUMP_DMA_ENABLE */
+#define	DUMP_DMA_PATH_P			"/tmp/pcm_dma_p.raw"
+#define	DUMP_DMA_PATH_C			"/tmp/pcm_dma_c.raw"
+#define	DUMP_DMA_TIME			20	/* sec */
+#define	DUMP_SAMPLE_COMPLETED
+/* #define DUMP_DMA_CONTINUOUS */
+
+/*
+ * PCM INFO
+ */
+#define	PERIOD_BYTES_MAX		8192
+
+static struct snd_pcm_hardware nx_pcm_hardware = {
+	/*  | SNDRV_PCM_INFO_BLOCK_TRANSFER */
+	.info			= SNDRV_PCM_INFO_MMAP |
+					SNDRV_PCM_INFO_MMAP_VALID |
+					SNDRV_PCM_INFO_INTERLEAVED |
+					SNDRV_PCM_INFO_PAUSE |
+					SNDRV_PCM_INFO_RESUME,
+	.formats		= SND_SOC_PCM_FORMATS,
+	.rate_min		= 8000,
+	.rate_max		= 192000,
+	.channels_min		= 1,
+	.channels_max		= 2,
+	.buffer_bytes_max	= 64 * 1024 * 2,
+	.period_bytes_min	= 32,
+	.period_bytes_max	= PERIOD_BYTES_MAX,
+	.periods_min		= 2,
+	.periods_max		= 64,
+	.fifo_size		= 32,
+};
+#define	substream_to_prtd(s)	(substream->runtime->private_data)
+
+/*
+ * DMA DUMP
+ */
+#ifdef DUMP_DMA_ENABLE
+static void nx_pcm_file_mem_allocate(char *filename,
+				     struct snd_pcm_substream *substream,
+				     struct snd_pcm_hw_params *params)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	int sample_bits = snd_pcm_format_physical_width(params_format(params));
+	int sample_rate = params->rate_num;
+	int sample_ch = params_channels(params);
+
+	if (prtd->mem_area)
+		return;
+
+	prtd->mem_len = (sample_rate * sample_ch * (sample_bits/8))
+			* DUMP_DMA_TIME;
+	prtd->mem_area = vzalloc(prtd->mem_len);
+
+	/* delete previous file */
+#ifndef DUMP_DMA_CONTINUOUS
+	if (prtd->mem_area) {
+		mm_segment_t old_fs = get_fs();
+
+		set_fs(KERNEL_DS);
+		sys_unlink(filename);
+		set_fs(old_fs);
+	}
+#endif
+	dev_dbg(prtd->dev, "file mem = 0x%p (%ld = rate:%d, ch:%d, bits:%d,",
+		 prtd->mem_area, prtd->mem_len, sample_rate, sample_ch,
+		 sample_bits);
+	dev_dbg(prtd->dev, "time:%dsec)\n", DUMP_DMA_TIME);
+}
+
+static void nx_pcm_file_mem_free(char *filename,
+				 struct snd_pcm_substream *substream)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+
+	if (prtd->mem_area) {
+		unsigned int mode = O_CREAT|O_RDWR|O_LARGEFILE|O_APPEND;
+		struct file *filp = filp_open(filename, mode, 0777);
+
+		if (filp) {
+			loff_t pos = 0;
+			mm_segment_t old_fs = get_fs();
+
+			set_fs(KERNEL_DS);
+			vfs_write(filp, (void *)prtd->mem_area,
+				  prtd->mem_len, &pos);
+			set_fs(old_fs);
+			filp_close(filp, NULL);
+		}
+		vfree((const void *)prtd->mem_area);
+	}
+	prtd->mem_area = 0;
+}
+
+static void nx_pcm_file_mem_write(struct snd_pcm_substream *substream)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+
+	if (prtd->mem_area && substream->runtime) {
+		struct snd_pcm_runtime *runtime = substream->runtime;
+		unsigned offset = prtd->offset;
+		int length = snd_pcm_lib_period_bytes(substream);
+		void *dst_addr = (void *)(prtd->mem_area + prtd->mem_offs);
+		void *src_addr;
+
+	#ifdef DUMP_SAMPLE_COMPLETED
+		if (offset == 0)
+			offset = snd_pcm_lib_buffer_bytes(substream);
+		offset  -= length;
+		src_addr = (void *)(runtime->dma_area + offset);
+	#else
+		src_addr = (void *)(runtime->dma_area + offset);
+	#endif
+		memcpy(dst_addr, src_addr, length);
+		prtd->mem_offs += length;
+		if (prtd->mem_offs >= prtd->mem_len)
+			prtd->mem_offs = 0;
+	}
+}
+
+#else
+#define	nx_pcm_file_mem_allocate(f, s, p)
+#define	nx_pcm_file_mem_free(f, s)
+#define	nx_pcm_file_mem_write(s)
+#endif
+
+static void nx_pcm_dma_clear(struct snd_pcm_substream *substream)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct snd_pcm_runtime *runtime = substream->runtime;
+	unsigned offset = prtd->offset;
+	int length = snd_pcm_lib_period_bytes(substream);
+	void *src_addr = NULL;
+
+	if (offset == 0)
+			offset = snd_pcm_lib_buffer_bytes(substream);
+	offset  -= length;
+	src_addr = (void *)(runtime->dma_area + offset);
+
+	if (strstr(dev_name(prtd->dma_param->dev), "i2s")) {
+		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+			memset(src_addr, 0, length);
+	}
+}
+
+/*
+ * PCM INTERFACE
+ */
+static void nx_pcm_dma_complete(void *arg)
+{
+	struct snd_pcm_substream *substream = arg;
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+
+	prtd->offset += snd_pcm_lib_period_bytes(substream);
+	if (prtd->offset >= snd_pcm_lib_buffer_bytes(substream))
+		prtd->offset = 0;
+
+	nx_pcm_file_mem_write(substream);
+	nx_pcm_dma_clear(substream);
+	snd_pcm_period_elapsed(substream);
+}
+
+static int nx_pcm_dma_request_channel(void *runtime_data, int stream)
+{
+	struct nx_pcm_runtime_data *prtd = runtime_data;
+	dma_cap_mask_t mask;
+
+	if (NULL == prtd || NULL == prtd->dma_param)
+		return -ENXIO;
+
+	dma_cap_zero(mask);
+	dma_cap_set(DMA_SLAVE, mask);
+	dma_cap_set(DMA_CYCLIC, mask);
+	dev_dbg(prtd->dev, "request %s dma '%s_%s'\n", STREAM_STR(stream),
+		 dev_name(prtd->dma_param->dev),
+		 (stream == SNDRV_PCM_STREAM_PLAYBACK)?"tx":"rx");
+
+	prtd->dma_chan
+		= dma_request_slave_channel_compat(mask,
+						   prtd->dma_param->dma_filter,
+						   prtd->dma_param->dma_ch_name,
+						   prtd->dma_param->dev,
+						   (stream ==
+						    SNDRV_PCM_STREAM_PLAYBACK)
+						    ? "tx":"rx");
+	if (!prtd->dma_chan) {
+		dev_err(prtd->dev, "Error: %s dma '%s_%s'\n",
+			STREAM_STR(stream), dev_name(prtd->dma_param->dev),
+			(stream == SNDRV_PCM_STREAM_PLAYBACK) ? "tx":"rx");
+		return -ENXIO;
+	}
+	return 0;
+}
+
+static void nx_pcm_dma_release_channel(void *runtime_data, int stream)
+{
+	struct nx_pcm_runtime_data *prtd = runtime_data;
+
+	if (prtd && prtd->dma_chan)
+		dma_release_channel(prtd->dma_chan);
+	dev_dbg(prtd->dev, "release dma '%s_%s'\n",
+		dev_name(prtd->dma_param->dev),
+	       (stream == SNDRV_PCM_STREAM_PLAYBACK) ? "tx":"rx");
+}
+
+static int nx_pcm_dma_slave_config(void *runtime_data, int stream)
+{
+	struct nx_pcm_runtime_data *prtd = runtime_data;
+	struct nx_pcm_dma_param *dma_param = prtd->dma_param;
+	struct dma_slave_config slave_config = { 0, };
+	dma_addr_t peri_addr = dma_param->peri_addr;
+	int bus_width = dma_param->bus_width_byte;
+	int max_burst = dma_param->max_burst_byte/bus_width;
+	int ret;
+
+	if (SNDRV_PCM_STREAM_PLAYBACK == stream) {
+		slave_config.direction		= DMA_MEM_TO_DEV;
+		slave_config.dst_addr		= peri_addr;
+		slave_config.dst_addr_width = bus_width;
+		slave_config.dst_maxburst	= max_burst;
+		slave_config.src_addr_width = bus_width;
+		slave_config.src_maxburst	= max_burst;
+		slave_config.device_fc		= false;
+	} else {
+		slave_config.direction		= DMA_DEV_TO_MEM;
+		slave_config.src_addr		= peri_addr;
+		slave_config.src_addr_width = bus_width;
+		slave_config.src_maxburst	= max_burst;
+		slave_config.dst_addr_width = bus_width;
+		slave_config.dst_maxburst	= max_burst;
+		slave_config.device_fc		= false;
+	}
+
+	ret = dmaengine_slave_config(prtd->dma_chan, &slave_config);
+
+	dev_dbg(prtd->dev, "%s: %s %s, %s, addr=0x%p, bus=%d byte, burst=%d (%d)\n",
+		__func__, ret?"FAIL":"DONE", STREAM_STR(stream),
+		dma_param->dma_ch_name,	(void *)peri_addr, bus_width,
+		dma_param->max_burst_byte, max_burst);
+	return ret;
+}
+
+static int nx_pcm_dma_prepare_and_submit(struct snd_pcm_substream *substream)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct snd_pcm_runtime *runtime = substream->runtime;
+	struct dma_chan *chan = prtd->dma_chan;
+	struct dma_async_tx_descriptor *desc;
+	enum dma_transfer_direction direction;
+	unsigned long flags = DMA_CTRL_ACK;
+	int period_time_us;
+
+	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+		direction = DMA_MEM_TO_DEV;
+	else
+		direction = DMA_DEV_TO_MEM;
+
+	if (!substream->runtime->no_period_wakeup)
+		flags |= DMA_PREP_INTERRUPT;
+
+	/* dma offset */
+	prtd->offset = 0;
+
+	desc = dmaengine_prep_dma_cyclic(chan,
+				runtime->dma_addr,
+				snd_pcm_lib_buffer_bytes(substream),
+				snd_pcm_lib_period_bytes(substream),
+				direction, flags);
+
+	if (!desc) {
+		dev_err(prtd->dev, "%s: cannot prepare slave %s dma\n",
+			__func__, prtd->dma_param->dma_ch_name);
+		return -EINVAL;
+	}
+
+	desc->callback = nx_pcm_dma_complete;
+	desc->callback_param = substream;
+	dmaengine_submit(desc);
+
+	/*
+	 * debug msg
+	 */
+	if (prtd->dma_param->real_clock != 0) /* i2s master mode */
+		period_time_us = (1000000*1000)/
+				((prtd->dma_param->real_clock*1000)/
+				 runtime->period_size);
+	else /* i2s slave mode */
+		period_time_us = 1000;
+
+	dev_dbg(prtd->dev, "%s: %s\n", __func__, STREAM_STR(substream->stream));
+	dev_dbg(prtd->dev, "buffer_bytes=%6zu, period_bytes=%6zu, periods=%2d,",
+		 snd_pcm_lib_buffer_bytes(substream),
+		 snd_pcm_lib_period_bytes(substream), runtime->periods);
+	dev_dbg(prtd->dev, "rate=%6d, period_time=%3d ms\n",
+		 runtime->rate, period_time_us/1000);
+
+	return 0;
+}
+
+static int nx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+
+	dev_dbg(prtd->dev, "%s: %s cmd=%d\n", __func__,
+		 STREAM_STR(substream->stream), cmd);
+
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_START:
+		dma_async_issue_pending(prtd->dma_chan);
+		break;
+
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+		dmaengine_resume(prtd->dma_chan);
+		break;
+
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+		dmaengine_pause(prtd->dma_chan);
+		break;
+
+	case SNDRV_PCM_TRIGGER_STOP:
+		dmaengine_terminate_all(prtd->dma_chan);
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static snd_pcm_uframes_t nx_pcm_pointer(struct snd_pcm_substream *substream)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	struct snd_pcm_runtime *runtime = substream->runtime;
+
+	return bytes_to_frames(runtime, prtd->offset);
+}
+
+static int nx_pcm_open(struct snd_pcm_substream *substream)
+{
+	struct snd_pcm_runtime *runtime = substream->runtime;
+	struct snd_soc_pcm_runtime *rtd = substream->private_data;
+	static struct snd_pcm_hardware *hw = &nx_pcm_hardware;
+	struct nx_pcm_runtime_data *prtd;
+	int ret = 0;
+
+	pcm_dbg(substream->pcm, "%s %s\n", __func__,
+		STREAM_STR(substream->stream));
+	prtd = kzalloc(sizeof(struct nx_pcm_runtime_data), GFP_KERNEL);
+	if (prtd == NULL)
+		return -ENOMEM;
+
+	runtime->private_data = prtd;
+
+	prtd->dev = substream->pcm->card->dev;
+	prtd->dma_param = snd_soc_dai_get_dma_data(rtd->cpu_dai, substream);
+	ret = nx_pcm_dma_request_channel(prtd, substream->stream);
+	if (0 > ret)
+		return ret;
+
+	ret = snd_pcm_hw_constraint_integer(runtime,
+					    SNDRV_PCM_HW_PARAM_PERIODS);
+	if (0 > ret) {
+		nx_pcm_dma_release_channel(prtd, substream->stream);
+		return ret;
+	}
+
+	if (strstr(dev_name(prtd->dma_param->dev), "spdiftx"))
+		hw->period_bytes_max = 4096;
+	else
+		hw->period_bytes_max = PERIOD_BYTES_MAX;
+
+	return snd_soc_set_runtime_hwparams(substream, &nx_pcm_hardware);
+}
+
+static int nx_pcm_close(struct snd_pcm_substream *substream)
+{
+	struct snd_pcm_runtime *runtime = substream->runtime;
+	struct nx_pcm_runtime_data *prtd = runtime->private_data;
+
+	dev_dbg(prtd->dev, "%s %s\n", __func__, STREAM_STR(substream->stream));
+	nx_pcm_dma_release_channel(prtd, substream->stream);
+	kfree(prtd);
+
+	return 0;
+}
+
+static int nx_pcm_hw_params(struct snd_pcm_substream *substream,
+					struct snd_pcm_hw_params *params)
+{
+	struct nx_pcm_runtime_data *prtd = substream_to_prtd(substream);
+	int ret;
+
+	ret = nx_pcm_dma_slave_config(prtd, substream->stream);
+	if (0 > ret)
+		return ret;
+
+	/* debug info */
+	prtd->periods = params_periods(params);
+	prtd->period_bytes = params_period_bytes(params);
+	prtd->buffer_bytes = params_buffer_bytes(params);
+
+	/* i2s master mode */
+	if (prtd->dma_param->real_clock != 0)
+		prtd->period_time_us = (1000000*1000)/
+					((prtd->dma_param->real_clock*1000)/
+					 params_period_size(params));
+	else /* i2s slave mode */
+		prtd->period_time_us = 1000;
+
+	snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
+
+	if (substream->stream == 0)
+		nx_pcm_file_mem_allocate(DUMP_DMA_PATH_P, substream, params);
+	else
+		nx_pcm_file_mem_allocate(DUMP_DMA_PATH_C, substream, params);
+
+	/*
+	 * debug msg
+	 */
+	dev_dbg(prtd->dev, "%s: %s\n", __func__, STREAM_STR(substream->stream));
+	dev_dbg(prtd->dev, "buffer_size =%6d, period_size =%6d, periods=%2d,",
+		 params_buffer_size(params), params_period_size(params),
+		 params_periods(params));
+	dev_dbg(prtd->dev, "rate=%6d\n, real_rate=%6d\n", params_rate(params),
+		  prtd->dma_param->real_clock);
+	dev_dbg(prtd->dev, "buffer_bytes=%6d, period_bytes=%6d, periods=%2d,",
+		 prtd->buffer_bytes, prtd->period_bytes, prtd->periods);
+	dev_dbg(prtd->dev, "period_time=%3lld us\n", prtd->period_time_us);
+	return 0;
+}
+
+static int nx_pcm_hw_free(struct snd_pcm_substream *substream)
+{
+	if (substream->stream == 0)
+		nx_pcm_file_mem_free(DUMP_DMA_PATH_P, substream);
+	else
+		nx_pcm_file_mem_free(DUMP_DMA_PATH_C, substream);
+
+	snd_pcm_set_runtime_buffer(substream, NULL);
+	return 0;
+}
+
+static int nx_pcm_mmap(struct snd_pcm_substream *substream,
+		struct vm_area_struct *vma)
+{
+	struct snd_pcm_runtime *runtime = substream->runtime;
+
+	return dma_mmap_coherent(substream->pcm->card->dev, vma,
+					runtime->dma_area,
+					runtime->dma_addr,
+					runtime->dma_bytes);
+}
+
+static struct snd_pcm_ops nx_pcm_ops = {
+	.open		= nx_pcm_open,
+	.close		= nx_pcm_close,
+	.ioctl		= snd_pcm_lib_ioctl,
+	.hw_params	= nx_pcm_hw_params,
+	.hw_free	= nx_pcm_hw_free,
+	.trigger	= nx_pcm_trigger,
+	.pointer	= nx_pcm_pointer,
+	.mmap		= nx_pcm_mmap,
+	.prepare	= nx_pcm_dma_prepare_and_submit,
+};
+
+static int nx_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream)
+{
+	struct snd_pcm_substream *substream = pcm->streams[stream].substream;
+	struct snd_dma_buffer *buf = &substream->dma_buffer;
+	size_t size = nx_pcm_hardware.buffer_bytes_max;
+
+	pcm_dbg(pcm, "%s: %s, dma_alloc_coherent %zu byte\n",
+		__func__, STREAM_STR(substream->stream), size);
+
+	buf->dev.type = SNDRV_DMA_TYPE_DEV;
+	buf->dev.dev = pcm->card->dev;
+	buf->private_data = NULL;
+	buf->bytes = size;
+	buf->area = dma_alloc_coherent(buf->dev.dev, size, &buf->addr,
+				       GFP_KERNEL);
+	if (!buf->area) {
+		pcm_err(pcm, "Fail, %s dma buffer allocate (%zu)\n",
+			STREAM_STR(substream->stream), size);
+		return -ENOMEM;
+	}
+
+	pcm_dbg(pcm, "%s: %s, dma_alloc_coherent %zu byte, vir = 0x%p,",
+		 __func__, STREAM_STR(substream->stream), size,
+		 (void *)buf->area);
+	pcm_dbg(pcm, "phy = 0x%p\n", (void *)buf->addr);
+	return 0;
+}
+
+static void nx_pcm_release_dma_buffer(struct snd_pcm *pcm, int stream)
+{
+	struct snd_pcm_substream *substream;
+	struct snd_dma_buffer *buf;
+
+	substream = pcm->streams[stream].substream;
+	if (!substream)
+		return;
+
+	buf = &substream->dma_buffer;
+	if (!buf->area)
+		return;
+
+	dma_free_coherent(pcm->card->dev, buf->bytes,
+				buf->area, buf->addr);
+	buf->area = NULL;
+}
+
+static u64 nx_pcm_dmamask = DMA_BIT_MASK(32);
+
+static int nx_pcm_new(struct snd_soc_pcm_runtime *runtime)
+{
+	struct snd_card *card = runtime->card->snd_card;
+	struct snd_pcm *pcm = runtime->pcm;
+	int ret = 0;
+
+	/* dma mask */
+	if (!card->dev->dma_mask)
+		card->dev->dma_mask = &nx_pcm_dmamask;
+	if (!card->dev->coherent_dma_mask)
+		card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+
+	if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
+		ret = nx_pcm_preallocate_dma_buffer(pcm,
+						    SNDRV_PCM_STREAM_PLAYBACK);
+		if (ret)
+			goto err;
+	}
+
+	if (pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream) {
+		ret = nx_pcm_preallocate_dma_buffer(pcm,
+						    SNDRV_PCM_STREAM_CAPTURE);
+		if (ret)
+			goto err_free;
+	}
+	return 0;
+
+err_free:
+	nx_pcm_release_dma_buffer(pcm, SNDRV_PCM_STREAM_PLAYBACK);
+err:
+	return ret;
+}
+
+static void nx_pcm_free(struct snd_pcm *pcm)
+{
+	nx_pcm_release_dma_buffer(pcm, SNDRV_PCM_STREAM_CAPTURE);
+	nx_pcm_release_dma_buffer(pcm, SNDRV_PCM_STREAM_PLAYBACK);
+}
+
+struct snd_soc_platform_driver nx_pcm_platform = {
+	.ops		= &nx_pcm_ops,
+	.pcm_new	= nx_pcm_new,
+	.pcm_free	= nx_pcm_free,
+};
+
+static int nx_pcm_probe(struct platform_device *pdev)
+{
+	int ret = devm_snd_soc_register_platform(&pdev->dev, &nx_pcm_platform);
+
+	dev_info(&pdev->dev, "snd pcm: %s sound platform '%s'\n",
+	       ret?"fail":"register", pdev->name);
+	return ret;
+}
+
+static int nx_pcm_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_platform(&pdev->dev);
+	return 0;
+}
+
+static struct platform_driver pcm_driver = {
+	.driver = {
+		.name  = "nexell-pcm",
+		.owner = THIS_MODULE,
+	},
+	.probe = nx_pcm_probe,
+	.remove = nx_pcm_remove,
+};
+
+static struct platform_device pcm_device = {
+	.name	= "nexell-pcm",
+	.id		= -1,
+};
+
+static int __init nx_pcm_init(void)
+{
+	platform_device_register(&pcm_device);
+	return platform_driver_register(&pcm_driver);
+}
+
+static void __exit nx_pcm_exit(void)
+{
+	platform_driver_unregister(&pcm_driver);
+	platform_device_unregister(&pcm_device);
+}
+
+module_init(nx_pcm_init);
+module_exit(nx_pcm_exit);
+
+MODULE_AUTHOR("hsjung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("Sound PCM driver for Nexell sound");
+MODULE_LICENSE("GPL");
+
diff -ENwbur a/sound/soc/nexell/nexell-pcm.h b/sound/soc/nexell/nexell-pcm.h
--- a/sound/soc/nexell/nexell-pcm.h	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-pcm.h	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_PCM_H__
+#define __NX_PCM_H__
+
+#include <linux/amba/pl08x.h>
+
+#include "nexell-i2s.h"
+
+#define SND_SOC_PCM_FORMATS	(SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S8 | \
+				SNDRV_PCM_FMTBIT_S16_LE | \
+				SNDRV_PCM_FMTBIT_U16_LE | \
+				SNDRV_PCM_FMTBIT_S24_LE | \
+				SNDRV_PCM_FMTBIT_U24_LE | \
+				SNDRV_PCM_FMTBIT_S32_LE | \
+				SNDRV_PCM_FMTBIT_U32_LE)
+
+struct nx_pcm_dma_param {
+	bool active;
+	bool (*dma_filter)(struct dma_chan *chan, void *filter_param);
+	char *dma_ch_name;
+	dma_addr_t peri_addr;
+	int bus_width_byte;
+	int max_burst_byte;
+	unsigned int real_clock;
+	struct device *dev;
+};
+
+struct nx_pcm_dma_area {
+	dma_addr_t physical;		/* dma virtual addr */
+	unsigned char *virtual;		/* dma physical addr */
+};
+
+struct nx_pcm_runtime_data {
+	struct device *dev;
+	/* hw params */
+	int period_bytes;
+	int periods;
+	int buffer_bytes;
+	unsigned int dma_area;	/* virtual addr */
+	unsigned int offset;
+	/* DMA param */
+	struct dma_chan  *dma_chan;
+	struct nx_pcm_dma_param *dma_param;
+	/* dbg dma */
+	void *mem_area;
+	long mem_len;
+	unsigned int mem_offs;
+	long long period_time_us;
+};
+
+#define	STREAM_STR(dir)	\
+	(SNDRV_PCM_STREAM_PLAYBACK == dir ? "playback" : "capture ")
+
+#define	SNDDEV_STATUS_CLEAR	(0)
+#define	SNDDEV_STATUS_SETUP	(1<<0)
+#define	SNDDEV_STATUS_POWER	(1<<1)
+#define	SNDDEV_STATUS_PLAY	(1<<2)
+#define	SNDDEV_STATUS_CAPT	(1<<3)
+#define	SNDDEV_STATUS_RUNNING	(SNDDEV_STATUS_PLAY | SNDDEV_STATUS_CAPT)
+
+extern struct snd_soc_platform_driver nx_pcm_platform;
+
+#endif
diff -ENwbur a/sound/soc/nexell/nexell-spdif.h b/sound/soc/nexell/nexell-spdif.h
--- a/sound/soc/nexell/nexell-spdif.h	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-spdif.h	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __NX_SPDIF_H__
+#define __NX_SPDIF_H__
+
+#include "nexell-pcm.h"
+
+#define SND_SOC_SPDIF_TX_FORMATS \
+	(SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+#define SND_SOC_SPDIF_RATES \
+	(SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_96000)
+
+#endif /* __NX_SPDIF_H__ */
diff -ENwbur a/sound/soc/nexell/nexell-spdif-transceiver.c b/sound/soc/nexell/nexell-spdif-transceiver.c
--- a/sound/soc/nexell/nexell-spdif-transceiver.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-spdif-transceiver.c	2018-05-06 08:49:52.502830297 +0200
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/jack.h>
+
+#include "nexell-spdif.h"
+#include "nexell-pcm.h"
+
+static struct snd_soc_dai_link spdiftx_dai_link = {
+	.name		= "SPDIF Transceiver",
+	.stream_name	= "SPDIF PCM Playback",
+	.cpu_dai_name	= "c0059000.spdiftx",	/* spdif_driver name */
+	.platform_name  = "nexell-pcm",		/* nx_snd_pcm_driver name */
+	.codec_dai_name = "dit-hifi",		/* spidf_transceiver.c */
+	.codec_name	= "spdif-out",		/* spidf_transceiver.c */
+	.symmetric_rates = 1,
+};
+
+static struct snd_soc_card spdiftx_card = {
+	.name		= "SPDIF-Transceiver",	/* proc/asound/cards */
+	.dai_link	= &spdiftx_dai_link,
+	.num_links	= 1,
+};
+
+/*
+ * codec driver
+ */
+static int spdiftx_probe(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = &spdiftx_card;
+	struct snd_soc_dai *codec_dai = NULL;
+	struct snd_soc_dai_driver *driver = NULL;
+	struct snd_soc_pcm_runtime *rtd;
+	unsigned int sample_rate = 0, format = 0;
+	int ret;
+	const char *format_name;
+
+	/* register card */
+	card->dev = &pdev->dev;
+	ret = snd_soc_register_card(card);
+	if (ret) {
+		dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+			ret);
+		return ret;
+	}
+
+	of_property_read_u32(pdev->dev.of_node, "sample_rate", &sample_rate);
+	format_name = of_get_property(pdev->dev.of_node, "format", NULL);
+	if (format_name != NULL) {
+		if (strcmp(format_name, "S16") == 0)
+			format = SNDRV_PCM_FMTBIT_S16_LE;
+		else if (strcmp(format_name, "S24") == 0)
+			format = SNDRV_PCM_FMTBIT_S16_LE
+				| SNDRV_PCM_FMTBIT_S24_LE;
+	}
+
+	rtd = snd_soc_get_pcm_runtime(card, card->dai_link[0].name);
+	if (rtd) {
+		codec_dai = rtd->codec_dai;
+		if (codec_dai)
+			driver = codec_dai->driver;
+	}
+
+	/* Reset spdif sample rates and format */
+	if (sample_rate) {
+		sample_rate = snd_pcm_rate_to_rate_bit(sample_rate);
+		if (SNDRV_PCM_RATE_KNOT != sample_rate)
+			driver->playback.rates = sample_rate;
+		else
+			dev_err(&pdev->dev, "%s, invalid sample rates=%d\n",
+				__func__, sample_rate);
+	}
+
+	if (format)
+		driver->playback.formats = format;
+
+	dev_dbg(&pdev->dev, "spdif-rx-dai: register card %s -> %s\n",
+		card->dai_link->codec_dai_name, card->dai_link->cpu_dai_name);
+	return ret;
+}
+
+static int spdiftx_remove(struct platform_device *pdev)
+{
+	struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+	snd_soc_unregister_card(card);
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nx_spdiftx_match[] = {
+	{ .compatible = "nexell,spdif-transceiver" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_spdiftx_match);
+#else
+#define nx_spdiftx_match NULL
+#endif
+
+static struct platform_driver spdiftx_driver = {
+	.driver		= {
+		.name	= "spdif-transceiver",
+		.owner	= THIS_MODULE,
+		.pm	= &snd_soc_pm_ops,	/* for suspend */
+		.of_match_table = of_match_ptr(nx_spdiftx_match),
+	},
+	.probe		= spdiftx_probe,
+	.remove		= spdiftx_remove,
+};
+module_platform_driver(spdiftx_driver);
+
+MODULE_AUTHOR("Hyunseok Jung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("Sound SPDIF transceiver driver for Nexell sound");
+MODULE_LICENSE("GPL");
diff -ENwbur a/sound/soc/nexell/nexell-spdiftx.c b/sound/soc/nexell/nexell-spdiftx.c
--- a/sound/soc/nexell/nexell-spdiftx.c	1970-01-01 01:00:00.000000000 +0100
+++ b/sound/soc/nexell/nexell-spdiftx.c	2018-05-06 08:49:52.506830461 +0200
@@ -0,0 +1,631 @@
+/*
+ * Copyright (C) 2016  Nexell Co., Ltd.
+ * Author: Hyunseok, Jung <hsjung@nexell.co.kr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/init.h>
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#ifdef CONFIG_RESET_CONTROLLER
+#include <linux/reset.h>
+#endif
+
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+#include "nexell-spdif.h"
+
+#define	DEF_SAMPLE_RATE			48000
+#define	DEF_SAMPLE_BIT			16	/* 8, 16, 24 (PCM) */
+
+#define	SPDIF_BASEADDR			0xC0059000
+
+#if (DEF_SAMPLE_BIT == 16)
+#define	SPDIF_BUS_WIDTH			2	/* Byte */
+#else
+#define	SPDIF_BUS_WIDTH			4	/* Byte */
+#endif
+
+#define	SPDIF_MAX_BURST			4	/* Byte */
+#define	SPDIF_MAX_CLOCK			166000000
+
+#define	SPDIFTX_PRESETn			(43)
+
+/*
+ * SPDIF register
+ */
+struct spdif_register {
+	unsigned int clkcon;
+	unsigned int con;
+	unsigned int bstas;
+	unsigned int cstas;
+	unsigned int data;
+	unsigned int count;
+	unsigned int bstas_shd;
+	unsigned int cnt_shd;
+	unsigned int userbit1;
+	unsigned int userbit2;
+	unsigned int userbit3;
+	unsigned int userbit1_shd;
+	unsigned int userbit2_shd;
+	unsigned int userbit3_shd;
+	unsigned int version_info;
+};
+
+#define	SPDIF_CLKCON_OFFSET		(0x00)
+#define	SPDIF_CON_OFFSET		(0x04)
+#define	SPDIF_BSTAS_OFFSET		(0x08)
+#define	SPDIF_CSTAS_OFFSET		(0x0C)
+#define	SPDIF_DAT_OFFSET		(0x10)
+#define	SPDIF_CNT_OFFSET		(0x14)
+
+#define	CLKCON_MCLK_SEL_POS		2
+#define	CLKCON_POWER_POS		0
+
+#define	CON_FIFO_LV_POS			22
+#define	CON_FIFO_TH_POS			19
+#define	CON_FIFO_TR_POS			17
+#define	CON_ENDIAN_POS			13
+#define CON_USERDATA_POS		12
+#define	CON_SW_RESET_POS		5
+#define	CON_RATIO_POS			3
+#define	CON_PCM_BIT_POS			1
+#define	CON_PCM_POS			0
+
+#define	CSTAS_FREQUENCY_POS		24
+#define	CSTAS_CATEGORY_POS		8
+#define	CSTAS_COPYRIGHT_POS		2
+#define	CSTAS_PCM_TYPE_POS		1
+
+#define	CON_FIFO_LEVEL_0		0
+#define	CON_FIFO_LEVEL_1		1
+#define	CON_FIFO_LEVEL_4		2
+#define	CON_FIFO_LEVEL_6		3
+#define	CON_FIFO_LEVEL_10		4
+#define	CON_FIFO_LEVEL_12		5
+#define	CON_FIFO_LEVEL_14		6
+#define	CON_FIFO_LEVEL_15		7
+
+#define	CON_FIFO_TR_DMA			0
+#define	CON_FIFO_TR_POLLING		1
+#define	CON_FIFO_TR_INTR		2
+
+#define	CON_ENDIAN_BIG			0
+#define	CON_ENDIAN_4B_SWAP		1
+#define	CON_ENDIAN_3B_SWAP		2
+#define	CON_ENDIAN_2B_SWAP		3
+
+#define PCM_16BIT			0
+#define PCM_20BIT			1
+#define PCM_24BIT			2
+
+#define RATIO_256			0
+#define RATIO_384			1
+
+#define	CATEGORY_CD			1
+#define	CATEGORY_DAT			3
+#define	CATEGORY_DCC			0x43
+#define	CATEGORY_MiNi_DISC		0x49
+
+#define	NO_COPYRIGHT			1
+#define	LINEAR_PCM			0
+#define	NON_LINEAR_PCM			1
+
+struct clock_ratio {
+	unsigned int sample_rate;
+	unsigned int ratio_256;
+	unsigned int ratio_384;
+	int reg_val;
+};
+
+static struct clock_ratio clk_ratio[] = {
+	{  32000,  8192000, 12288000,  3, },
+	{  44100, 11289600, 16934400,  0, },
+	{  48000, 12288000, 18432000,  2, },
+	{  96000, 24576000, 36864000, 10, },
+};
+
+/*
+ * parameters
+ */
+struct nx_spdif_snd_param {
+	int sample_rate;
+	int pcm_bit;
+	int status;
+	long master_clock;
+	int  master_ratio;
+	spinlock_t lock;
+	/* clock control */
+	struct clk *clk;
+	long clk_rate;
+	/* DMA channel */
+	struct nx_pcm_dma_param dma;
+	/* Register */
+	void __iomem *base_addr;
+	struct spdif_register spdif;
+};
+
+#define	SPDIF_MASTER_CLKGEN_BASE	0xC0105000
+#define	SPDIF_IN_CLKS			4
+#define	MAX_DIVIDER			((1<<8) - 1)	/* 256, align 2 */
+#define	DIVIDER_ALIGN			2
+
+static void spdif_reset(struct device *dev,
+			       struct nx_spdif_snd_param *par)
+{
+	void __iomem *base = par->base_addr;
+
+#ifdef CONFIG_RESET_CONTROLLER
+	struct reset_control *rst;
+
+	rst = devm_reset_control_get(dev, "spdiftx-reset");
+
+	if (!IS_ERR(rst)) {
+		if (reset_control_status(rst))
+			reset_control_reset(rst);
+	}
+#endif
+	writel((1 << CON_SW_RESET_POS), (base+SPDIF_CON_OFFSET));
+}
+
+static int spdif_start(struct nx_spdif_snd_param *par, int stream)
+{
+	struct spdif_register *spdif = &par->spdif;
+	void __iomem *base = par->base_addr;
+
+	spdif->clkcon |= (1<<CLKCON_POWER_POS);
+	writel(spdif->con, (base+SPDIF_CON_OFFSET));
+	writel(spdif->clkcon, (base+SPDIF_CLKCON_OFFSET));	/* Power On */
+
+	par->status |= SNDDEV_STATUS_PLAY;
+	return 0;
+}
+
+static void spdif_stop(struct nx_spdif_snd_param *par, int stream)
+{
+	struct spdif_register *spdif = &par->spdif;
+	void __iomem *base = par->base_addr;
+
+	spdif->clkcon &= ~(1 << CLKCON_POWER_POS);
+	writel(spdif->clkcon, (base+SPDIF_CLKCON_OFFSET));
+
+	par->status &= ~SNDDEV_STATUS_PLAY;
+
+}
+
+static int nx_spdif_check_param(struct nx_spdif_snd_param *par, struct device
+				*dev)
+{
+	struct spdif_register *spdif = &par->spdif;
+	struct nx_pcm_dma_param *dmap = &par->dma;
+	unsigned long request = 0, rate_hz = 0;
+	int MCLK = 0; /* only support internal */
+	int PCM  = 0;
+	int RATIO, SAMPLE_HZ, DATA_23RDBIT = 1, PCM_OR_STREAM = 1;
+	int i = 0;
+
+	switch (par->pcm_bit) {
+	case 16:
+		PCM = PCM_16BIT; break;
+	case 24:
+		PCM = PCM_24BIT; break;
+	default:
+		dev_err(dev, "Fail, not support spdiftx pcm bits");
+			dev_err(dev, "%d (16, 24)\n", par->pcm_bit);
+			return -EINVAL;
+	}
+
+	for (i = 0; ARRAY_SIZE(clk_ratio) > i; i++) {
+		if (par->sample_rate == clk_ratio[i].sample_rate) {
+			SAMPLE_HZ = clk_ratio[i].reg_val;
+			break;
+		}
+	}
+
+	if (i >= ARRAY_SIZE(clk_ratio)) {
+		dev_err(dev, "Fail, not support spdif sample rate %d\n",
+			par->sample_rate);
+		return -EINVAL;
+	}
+
+	/* 384 RATIO */
+	RATIO = RATIO_384, request = clk_ratio[i].ratio_384;
+	rate_hz = clk_round_rate(par->clk, request);
+
+	/* 256 RATIO */
+	if (rate_hz != request && PCM == PCM_16BIT) {
+		unsigned int o_rate = rate_hz;
+
+		RATIO = RATIO_256, request = clk_ratio[i].ratio_256;
+		rate_hz = clk_round_rate(par->clk, request);
+		if (abs(request - rate_hz) > abs(request - o_rate))
+			rate_hz = o_rate, RATIO = RATIO_384;
+	}
+
+	par->master_clock = rate_hz;
+	par->master_ratio = RATIO;
+
+	dmap->real_clock = rate_hz/(RATIO_256 == RATIO?256:384);
+
+	spdif->clkcon = (MCLK << CLKCON_MCLK_SEL_POS);
+	spdif->con = (CON_FIFO_LEVEL_15 << CON_FIFO_TH_POS) |
+		(CON_FIFO_TR_DMA << CON_FIFO_TR_POS) |
+		(CON_ENDIAN_BIG << CON_ENDIAN_POS) |
+		(DATA_23RDBIT << CON_USERDATA_POS) |
+		(RATIO << CON_RATIO_POS) |
+		(PCM << CON_PCM_BIT_POS) |
+		(PCM_OR_STREAM << CON_PCM_POS);
+	spdif->cstas = (SAMPLE_HZ << CSTAS_FREQUENCY_POS) |
+		(CATEGORY_CD << CSTAS_CATEGORY_POS) |
+		(LINEAR_PCM << CSTAS_PCM_TYPE_POS) |
+		(NO_COPYRIGHT << CSTAS_COPYRIGHT_POS);
+
+	return 0;
+}
+
+static struct snd_soc_dai_driver spdif_dai_driver;
+
+static int nx_spdif_set_plat_param(struct nx_spdif_snd_param *par, void *data)
+{
+	struct platform_device *pdev = data;
+	struct nx_pcm_dma_param *dma = &par->dma;
+	unsigned int phy_base = SPDIF_BASEADDR;
+	int ret = 0;
+	static struct snd_soc_dai_driver *dai = &spdif_dai_driver;
+
+	of_property_read_u32(pdev->dev.of_node, "pcm-bit",
+			     &par->pcm_bit);
+	if (!par->pcm_bit)
+		par->pcm_bit = DEF_SAMPLE_BIT;
+	if (par->pcm_bit == 16)
+		dai->playback.formats = SNDRV_PCM_FMTBIT_S16_LE;
+	else
+		dai->playback.formats = SNDRV_PCM_FMTBIT_S24_LE;
+
+	of_property_read_u32(pdev->dev.of_node, "sample_rate",
+			     &par->sample_rate);
+	if (!par->sample_rate)
+		par->sample_rate = DEF_SAMPLE_RATE;
+	dai->playback.rates =
+		snd_pcm_rate_to_rate_bit(par->sample_rate);
+
+	par->base_addr = of_iomap(pdev->dev.of_node, 0);
+	spin_lock_init(&par->lock);
+
+	dma->active = true;
+	dma->dev = &pdev->dev;
+
+	dma->peri_addr = phy_base + SPDIF_DAT_OFFSET;	/* SPDIF DAT */
+	dma->bus_width_byte = SPDIF_BUS_WIDTH;
+	dma->max_burst_byte = SPDIF_MAX_BURST;
+	dev_dbg(&pdev->dev, "spdif-tx: %s dma, addr 0x%p, bus %dbyte, burst %dbyte\n",
+		 STREAM_STR(0), (void *)dma->peri_addr, dma->bus_width_byte,
+		 dma->max_burst_byte);
+
+	par->clk = clk_get(&pdev->dev, NULL);
+	if (IS_ERR(par->clk)) {
+		ret = PTR_ERR(par->clk);
+		return ret;
+	}
+
+	return nx_spdif_check_param(par, &pdev->dev);
+}
+
+static int nx_spdif_setup(struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct spdif_register *spdif = &par->spdif;
+	void __iomem *base = par->base_addr;
+	long rate_hz = par->master_clock;
+	int  ratio = par->master_ratio;
+	unsigned int cstas = spdif->cstas;
+
+	if (SNDDEV_STATUS_SETUP & par->status)
+		return 0;
+
+	dev_info(dai->dev, "spdif-tx: %d(%ld)Hz, MCLK=%ldhz\n",
+		par->sample_rate, rate_hz/(RATIO_256 == ratio?256:384),
+		rate_hz);
+
+	/* set clock */
+	par->clk_rate = clk_set_rate(par->clk, rate_hz);
+	clk_prepare_enable(par->clk);
+
+	spdif_reset(dai->dev, par);
+
+	cstas |= readl(base+SPDIF_CSTAS_OFFSET) & 0x3fffffff;
+	writel(spdif->con, (base+SPDIF_CON_OFFSET));
+	writel(cstas, (base+SPDIF_CSTAS_OFFSET));
+
+	par->status |= SNDDEV_STATUS_SETUP;
+	return 0;
+}
+
+static void nx_spdif_release(struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct spdif_register *spdif = &par->spdif;
+	void __iomem *base = par->base_addr;
+
+	spdif->clkcon &= ~(1 << CLKCON_POWER_POS);
+	writel(spdif->clkcon, (base+SPDIF_CLKCON_OFFSET));
+
+	clk_disable_unprepare(par->clk);
+	clk_put(par->clk);
+
+	par->status = SNDDEV_STATUS_CLEAR;
+}
+
+/*
+ * snd_soc_dai_ops
+ */
+static int  nx_spdif_startup(struct snd_pcm_substream *substream,
+				struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct nx_pcm_dma_param *dmap = &par->dma;
+
+	snd_soc_dai_set_dma_data(dai, substream, dmap);
+	return 0;
+}
+
+
+static void nx_spdif_shutdown(struct snd_pcm_substream *substream,
+				struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+
+	spdif_stop(par, substream->stream);
+}
+
+static int nx_spdif_trigger(struct snd_pcm_substream *substream,
+				int cmd, struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	int stream = substream->stream;
+
+	dev_dbg(dai->dev, "%s: %s cmd=%d\n", __func__, STREAM_STR(stream), cmd);
+
+	switch (cmd) {
+	case SNDRV_PCM_TRIGGER_RESUME:
+	case SNDRV_PCM_TRIGGER_START:
+		spdif_start(par, stream);
+		break;
+	case SNDRV_PCM_TRIGGER_SUSPEND:
+	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+	case SNDRV_PCM_TRIGGER_STOP:
+		spdif_stop(par, stream);
+		break;
+
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static int nx_spdif_hw_params(struct snd_pcm_substream *substream,
+				 struct snd_pcm_hw_params *params,
+				 struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct spdif_register *spdif = &par->spdif;
+	struct nx_pcm_dma_param *dmap = &par->dma;
+	unsigned int format = params_format(params);
+	int PCM = (spdif->con >> CON_PCM_BIT_POS) & 0x3;
+	int ret = 0;
+
+	switch (format) {
+	case SNDRV_PCM_FORMAT_S16_LE:
+		dev_dbg(dai->dev, "spdiftx: change sample bits %s -> S16\n",
+			 PCM == PCM_16BIT?"S16":"S24");
+		if (PCM != PCM_16BIT) {
+			spdif->con &= ~(0x3 << CON_PCM_BIT_POS);
+			spdif->con |=  (PCM_16BIT << CON_PCM_BIT_POS);
+			dmap->bus_width_byte = 2; /* change dma bus width */
+			dmap->max_burst_byte = SPDIF_MAX_BURST;
+		}
+		break;
+	case SNDRV_PCM_FORMAT_S24_LE:
+		dev_dbg(dai->dev, "spdiftx: change sample bits %s -> S24\n",
+			 PCM == PCM_16BIT?"S16":"S24");
+		if (PCM != PCM_24BIT) {
+			spdif->con &= ~(0x3 << CON_PCM_BIT_POS);
+			spdif->con |=  (PCM_24BIT << CON_PCM_BIT_POS);
+			dmap->bus_width_byte = 4; /* change dma bus width */
+			dmap->max_burst_byte = SPDIF_MAX_BURST;
+		}
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+static int nx_spdif_set_dai_sysclk(struct snd_soc_dai *dai,
+				   int clk_id, unsigned int freq, int dir)
+{
+	return 0;
+}
+
+static struct snd_soc_dai_ops nx_spdif_ops = {
+	.startup	= nx_spdif_startup,
+	.shutdown	= nx_spdif_shutdown,
+	.trigger	= nx_spdif_trigger,
+	.hw_params	= nx_spdif_hw_params,
+	.set_sysclk	= nx_spdif_set_dai_sysclk,
+};
+
+/*
+ * snd_soc_dai_driver
+ */
+static int nx_spdif_dai_suspend(struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct spdif_register *spdif = &par->spdif;
+	void __iomem *base = par->base_addr;
+
+	dev_dbg(dai->dev, "%s\n", __func__);
+
+	spdif->clkcon &= ~(1 << CLKCON_POWER_POS);
+	writel(spdif->clkcon, (base+SPDIF_CLKCON_OFFSET));
+
+	clk_disable_unprepare(par->clk);
+
+	return 0;
+}
+
+static int nx_spdif_dai_resume(struct snd_soc_dai *dai)
+{
+	struct nx_spdif_snd_param *par = snd_soc_dai_get_drvdata(dai);
+	struct spdif_register *spdif = &par->spdif;
+	unsigned int cstas = spdif->cstas;
+	void __iomem *base = par->base_addr;
+	long rate_hz = par->master_clock;
+
+	dev_dbg(dai->dev, "%s\n", __func__);
+
+	par->clk_rate = clk_set_rate(par->clk, rate_hz);
+	clk_prepare_enable(par->clk);
+
+	spdif_reset(dai->dev, par);
+
+	cstas |= readl(base+SPDIF_CSTAS_OFFSET) & 0x3fffffff;
+	writel(spdif->con, (base+SPDIF_CON_OFFSET));
+	writel(cstas, (base+SPDIF_CSTAS_OFFSET));
+
+	return 0;
+}
+
+static int nx_spdif_dai_probe(struct snd_soc_dai *dai)
+{
+	return nx_spdif_setup(dai);
+}
+
+static int nx_spdif_dai_remove(struct snd_soc_dai *dai)
+{
+	nx_spdif_release(dai);
+	return 0;
+}
+
+static struct snd_soc_dai_driver spdif_dai_driver = {
+	.playback	= {
+		.channels_min	= 2,
+		.channels_max	= 2,
+		.formats	= SND_SOC_SPDIF_TX_FORMATS,
+		.rates		= SND_SOC_SPDIF_RATES,
+		.rate_min	= 0,
+		.rate_max	= 1562500,
+		},
+	.probe		= nx_spdif_dai_probe,
+	.remove		= nx_spdif_dai_remove,
+	.suspend	= nx_spdif_dai_suspend,
+	.resume		= nx_spdif_dai_resume,
+	.ops		= &nx_spdif_ops,
+};
+
+static const struct snd_soc_component_driver nx_spdif_component = {
+	    .name       = "nx-spdif-txc",
+};
+
+static int nx_spdif_probe(struct platform_device *pdev)
+{
+	struct nx_spdif_snd_param *par;
+	int ret = 0;
+
+	/*  allocate i2c_port data */
+	par = kzalloc(sizeof(struct nx_spdif_snd_param), GFP_KERNEL);
+	if (!par)
+		return -ENOMEM;
+
+	ret = nx_spdif_set_plat_param(par, pdev);
+	if (ret)
+		goto err_out;
+
+	ret = devm_snd_soc_register_component(&pdev->dev, &nx_spdif_component,
+					 &spdif_dai_driver, 1);
+	if (ret) {
+		dev_err(&pdev->dev, "fail, %s snd_soc_register_component ...\n",
+		       pdev->name);
+		goto err_out;
+	}
+
+	ret = devm_snd_soc_register_platform(&pdev->dev, &nx_pcm_platform);
+	if (ret) {
+		dev_err(&pdev->dev, "fail, snd_soc_register_platform...\n");
+		goto err_out;
+	}
+
+	dev_set_drvdata(&pdev->dev, par);
+	return ret;
+
+err_out:
+	kfree(NULL);
+	return ret;
+}
+
+static int nx_spdif_remove(struct platform_device *pdev)
+{
+	snd_soc_unregister_component(&pdev->dev);
+	kfree(NULL);
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id nx_spdif_match[] = {
+	{ .compatible = "nexell,nexell-spdif-tx" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, nx_spdif_match);
+#else
+#define nx_spdif_match NULL
+#endif
+
+static struct platform_driver spdif_driver = {
+	.probe  = nx_spdif_probe,
+	.remove = nx_spdif_remove,
+	.driver = {
+		.name	= "nexell-spdif-tx",
+		.owner	= THIS_MODULE,
+		.of_match_table = of_match_ptr(nx_spdif_match),
+	},
+};
+
+static int __init nx_spdif_init(void)
+{
+	return platform_driver_register(&spdif_driver);
+}
+
+static void __exit nx_spdif_exit(void)
+{
+	platform_driver_unregister(&spdif_driver);
+}
+
+module_init(nx_spdif_init);
+module_exit(nx_spdif_exit);
+
+MODULE_AUTHOR("Hyunseok Jung <hsjung@nexell.co.kr>");
+MODULE_DESCRIPTION("Sound S/PDIF tx driver for Nexell sound");
+MODULE_LICENSE("GPL");
